diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
new file mode 100644
index 0000000000..9704601ae9
--- /dev/null
+++ b/.devcontainer/Dockerfile
@@ -0,0 +1,11 @@
+FROM golang:1.24
+
+RUN apt-get update && apt-get install -y sudo
+RUN curl -fsSL https://deb.nodesource.com/setup_16.x | sudo -E bash - && \
+	apt-get install -y nodejs
+
+ADD scripts /scripts
+RUN bash /scripts/install.sh
+RUN bash /scripts/godeps.sh
+
+ENV ENCORE_GOROOT=/encore-release/encore-go
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
new file mode 100644
index 0000000000..e5a5e6c09d
--- /dev/null
+++ b/.devcontainer/devcontainer.json
@@ -0,0 +1,10 @@
+{
+  "build": {"dockerfile": "Dockerfile"},
+  "containerEnv": {
+    "ENCORE_DAEMON_DEV": "1",
+    "ENCORE_RUNTIMES_PATH": "${containerWorkspaceFolder}/runtimes"
+  },
+  "extensions": ["golang.go"],
+  "postCreateCommand": "bash /scripts/prepare.sh",
+  "forwardPorts": [4000, 9400]
+}
diff --git a/.devcontainer/scripts/godeps.sh b/.devcontainer/scripts/godeps.sh
new file mode 100644
index 0000000000..f887beb36a
--- /dev/null
+++ b/.devcontainer/scripts/godeps.sh
@@ -0,0 +1,15 @@
+#!/usr/bin/env
+set -ex
+
+go install github.com/uudashr/gopkgs/v2/cmd/gopkgs@latest 
+go install github.com/ramya-rao-a/go-outline@latest
+go install github.com/cweill/gotests/gotests@latest
+go install github.com/fatih/gomodifytags@latest
+go install github.com/josharian/impl@latest
+go install github.com/haya14busa/goplay/cmd/goplay@latest
+go install github.com/go-delve/delve/cmd/dlv@latest
+go install honnef.co/go/tools/cmd/staticcheck@master
+go install golang.org/x/tools/gopls@latest
+
+GOBIN=/tmp/ go install github.com/go-delve/delve/cmd/dlv@master
+mv /tmp/dlv $GOPATH/bin/dlv-dap
diff --git a/.devcontainer/scripts/install.sh b/.devcontainer/scripts/install.sh
new file mode 100644
index 0000000000..b9b9fcf314
--- /dev/null
+++ b/.devcontainer/scripts/install.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+set -e
+
+target="$(go env GOOS)_$(go env GOARCH)"
+
+encore_uri=$(curl -sSf -N "https://encore.dev/api/releases?target=${target}&show=url")
+if [ ! "$encore_uri" ]; then
+    echo "Error: Unable to determine latest Encore release." 1>&2
+    exit 1
+fi
+
+encore_install="/encore-release"
+bin_dir="$encore_install/bin"
+exe="$bin_dir/encore"
+tar="$encore_install/encore.tar.gz"
+
+if [ ! -d "$bin_dir" ]; then
+ 	mkdir -p "$bin_dir"
+fi
+
+curl --fail --location --progress-bar --output "$tar" "$encore_uri"
+cd "$encore_install"
+tar -C "$encore_install" -xzf "$tar"
+chmod +x "$bin_dir"/*
+rm "$tar"
+
+"$exe" version
+
+echo "Encore was installed successfully to $exe"
+if command -v encore >/dev/null; then
+	echo "Run 'encore --help' to get started"
+else
+	case $SHELL in
+	/bin/zsh) shell_profile=".zshrc" ;;
+	*) shell_profile=".bash_profile" ;;
+	esac
+	echo "Manually add the directory to your \$HOME/$shell_profile (or similar)"
+	echo "  export ENCORE_INSTALL=\"$encore_install\""
+	echo "  export PATH=\"\$ENCORE_INSTALL/bin:\$PATH\""
+	echo "Run '$exe --help' to get started"
+fi
\ No newline at end of file
diff --git a/.devcontainer/scripts/prepare.sh b/.devcontainer/scripts/prepare.sh
new file mode 100644
index 0000000000..dce83401f9
--- /dev/null
+++ b/.devcontainer/scripts/prepare.sh
@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+
+set -e
+set -x
+
+go mod download
diff --git a/.github/dockerimg/Dockerfile b/.github/dockerimg/Dockerfile
new file mode 100644
index 0000000000..34ccf199e6
--- /dev/null
+++ b/.github/dockerimg/Dockerfile
@@ -0,0 +1,17 @@
+# syntax=docker/dockerfile:1.4
+FROM --platform=$TARGETPLATFORM ubuntu:22.04 AS build
+ARG TARGETPLATFORM
+ARG RELEASE_VERSION
+RUN mkdir /encore
+ADD rename-binary-if-needed.bash rename-binary-if-needed.bash
+ADD artifacts /artifacts
+RUN /bin/bash -c 'SRC=encore-$(echo $TARGETPLATFORM | tr '/' '_'); tar -C /encore -xzf /artifacts/$SRC.tar.gz'
+RUN /bin/bash rename-binary-if-needed.bash
+
+FROM --platform=$TARGETPLATFORM ubuntu:22.04
+RUN apt-get update && apt-get install -y -f ca-certificates
+ENV PATH="/encore/bin:${PATH}"
+WORKDIR /src
+ADD encore-entrypoint.bash /bin/encore-entrypoint.bash
+ENTRYPOINT ["/bin/encore-entrypoint.bash"]
+COPY --from=build /encore /encore
diff --git a/.github/dockerimg/encore-entrypoint.bash b/.github/dockerimg/encore-entrypoint.bash
new file mode 100755
index 0000000000..00ede15a7d
--- /dev/null
+++ b/.github/dockerimg/encore-entrypoint.bash
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+# If the ENCORE_AUTHKEY environment variable is set, log in with it.
+if [ -n "$ENCORE_AUTHKEY" ]; then
+  echo "Logging in to Encore using provided auth key..."
+  encore auth login --auth-key "$ENCORE_AUTHKEY"
+fi
+
+# Run the encore command.
+encore "$@"
diff --git a/.github/dockerimg/rename-binary-if-needed.bash b/.github/dockerimg/rename-binary-if-needed.bash
new file mode 100755
index 0000000000..8dfca402ce
--- /dev/null
+++ b/.github/dockerimg/rename-binary-if-needed.bash
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+set -eo pipefail
+
+# Check if `encore-nightly`, `encore-beta` or `encore-develop` are present, and if one of them are, rename it to `encore`.
+for binary in encore-nightly encore-beta encore-develop; do
+  if [ -f "/encore/bin/$binary" ]; then
+    echo "Renaming $binary to encore..."
+    mv /encore/bin/$binary /encore/bin/encore
+  fi
+done
+
+# Sanity check that /ecore/bin/encore exists.
+if [ ! -f "/encore/bin/encore" ]; then
+  echo "ERROR: /encore/bin/encore does not exist. Did you mount the Encore binary directory to /encore/bin?"
+  exit 1
+fi
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000000..b382785bd0
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,274 @@
+name: CI
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    - cron: "30 2 * * *" # Every night at 2:30am UTC (if you change this schedule, also change the if statement in the test steps)
+
+jobs:
+  build:
+    name: "Build"
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: encr.dev
+
+      - name: Set up Node
+        uses: actions/setup-node@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: "encr.dev/go.mod"
+          check-latest: true
+          cache-dependency-path: "encr.dev/go.sum"
+
+      - name: Build
+        run: cd encr.dev && go build ./...
+
+      - name: Build for Windows
+        run: cd encr.dev && go build ./...
+        env:
+          GOOS: windows
+
+  test:
+    name: "Test"
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: encr.dev
+
+      - name: Set up Node
+        uses: actions/setup-node@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: "encr.dev/go.mod"
+          check-latest: true
+          cache-dependency-path: "encr.dev/go.sum"
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+      - name: Install Protoc
+        uses: arduino/setup-protoc@a8b67ba40b37d35169e222f3bb352603327985b6 # v2
+      - name: Set up cargo cache
+        uses: actions/cache@v3
+        continue-on-error: false
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo
+
+      - name: Install encore-go
+        run: |
+          URL=$(curl -s https://api.github.com/repos/encoredev/go/releases/latest | grep "browser_download_url.*linux_x86-64.tar.gz" | cut -d : -f 2,3 | tr -d \" | tr -d '[:space:]')
+          curl --fail -L -o encore-go.tar.gz $URL && tar -C . -xzf ./encore-go.tar.gz
+
+      - name: Install tsparser
+        run: cargo install --path encr.dev/tsparser --force --debug
+
+      # If we're not running on a schedule, we only want to run tests on changed code
+      - name: Run tests on changed code on the CLI
+        run: cd encr.dev && go test -short -tags=dev_build 2>&1 ./...
+        if: github.event.schedule != '30 2 * * *'
+        env:
+          ENCORE_GOROOT: ${{ github.workspace }}/encore-go
+          ENCORE_RUNTIMES_PATH: ${{ github.workspace }}/encr.dev/runtimes
+
+      - name: Run tests on changed runtime code
+        run: cd encr.dev/runtimes/go && go test -short -tags=dev_build ./...
+        if: github.event.schedule != '30 2 * * *'
+
+      # Each night we want to run all tests multiple times to catch any flaky tests
+      # We will shuffle the order in which tests are run and run them 25 times looking
+      # for failures. We will also fail fast so that we don't waste time running tests
+      # that are already failing.
+      - name: Run all tests multiple times on the CLI
+        run: cd encr.dev && go test -v --count=5 -failfast -shuffle=on -timeout=30m -tags=dev_build ./...
+        if: github.event.schedule == '30 2 * * *'
+        env:
+          ENCORE_GOROOT: ${{ github.workspace }}/encore-go
+          ENCORE_RUNTIMES_PATH: ${{ github.workspace }}/encr.dev/runtimes
+
+      - name: Run all tests multiple times on the runtime
+        run: cd encr.dev/runtimes/go && go test -v --count=5 -failfast -shuffle=on -timeout=30m -tags=dev_build ./...
+        if: github.event.schedule == '30 2 * * *'
+
+      - name: Report Nightly Failure
+        uses: ravsamhq/notify-slack-action@bca2d7f5660b833a27bda4f6b8bef389ebfefd25
+        if: ${{ failure() && github.event.schedule == '30 2 * * *' }}
+        with:
+          status: ${{ job.status }} # required
+          notification_title: "{workflow} has {status_message}"
+          message_format: "{emoji} *{workflow}* {status_message} in <{repo_url}|{repo}>"
+          footer: "Linked Repo <{repo_url}|{repo}> | <{workflow_url}|View Workflow>"
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_ALERT_WEBHOOK_URL }} # required
+
+  test-e2e:
+    name: "Test e2e"
+    runs-on: ubuntu-24.04
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: encr.dev
+
+      - name: Set up Node
+        uses: actions/setup-node@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: "encr.dev/go.mod"
+          check-latest: true
+          cache-dependency-path: "encr.dev/go.sum"
+
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+      - name: Install Protoc
+        uses: arduino/setup-protoc@a8b67ba40b37d35169e222f3bb352603327985b6 # v2
+      - name: Set up cargo cache
+        uses: actions/cache@v3
+        continue-on-error: false
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo
+
+      - name: Install encore-go
+        run: |
+          URL=$(curl -s https://api.github.com/repos/encoredev/go/releases/latest | grep "browser_download_url.*linux_x86-64.tar.gz" | cut -d : -f 2,3 | tr -d \" | tr -d '[:space:]')
+          curl --fail -L -o encore-go.tar.gz $URL && tar -C . -xzf ./encore-go.tar.gz
+
+      - name: Install tsparser
+        run: cargo install --path encr.dev/tsparser --force --debug
+
+      - name: Install tsbundler
+        run: cd encr.dev && go install ./cli/cmd/tsbundler-encore
+
+      - name: Build jsruntime
+        run: cd encr.dev && go run ./pkg/encorebuild/cmd/build-local-binary encore-runtime.node
+
+      # If we're not running on a schedule, we only want to run tests on changed code
+      - name: Run tests on changed code on the CLI
+        run: cd encr.dev && go test -short -tags=e2e 2>&1 ./e2e-tests
+        if: github.event.schedule != '30 2 * * *'
+        env:
+          ENCORE_GOROOT: ${{ github.workspace }}/encore-go
+          ENCORE_RUNTIMES_PATH: ${{ github.workspace }}/encr.dev/runtimes
+
+      # Each night we want to run all tests multiple times to catch any flaky tests
+      # We will shuffle the order in which tests are run and run them 25 times looking
+      # for failures. We will also fail fast so that we don't waste time running tests
+      # that are already failing.
+      - name: Run all tests multiple times on the CLI
+        run: cd encr.dev && go test -v --count=5 -failfast -shuffle=on -timeout=30m -tags=e2e ./e2e-tests
+        if: github.event.schedule == '30 2 * * *'
+        env:
+          ENCORE_GOROOT: ${{ github.workspace }}/encore-go
+          ENCORE_RUNTIMES_PATH: ${{ github.workspace }}/encr.dev/runtimes
+
+      - name: Report Nightly Failure
+        uses: ravsamhq/notify-slack-action@bca2d7f5660b833a27bda4f6b8bef389ebfefd25
+        if: ${{ failure() && github.event.schedule == '30 2 * * *' }}
+        with:
+          status: ${{ job.status }} # required
+          notification_title: "{workflow} has {status_message}"
+          message_format: "{emoji} *{workflow}* {status_message} in <{repo_url}|{repo}>"
+          footer: "Linked Repo <{repo_url}|{repo}> | <{workflow_url}|View Workflow>"
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_ALERT_WEBHOOK_URL }} # required
+
+  # Run static analysis on the PR
+  static-analysis:
+    name: "Static Analysis"
+    # We're using buildjet for this as it's very slow on Github's own runners
+    runs-on: buildjet-4vcpu-ubuntu-2204
+
+    # Skip any PR created by dependabot to avoid permission issues:
+    if: (github.actor != 'dependabot[bot]')
+
+    permissions:
+      checks: write
+      contents: read
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install jq
+        uses: dcarbone/install-jq-action@91d8da7268538e8a0ae0c8b72af44f1763228455
+
+      - name: Install semgrep
+        run: |
+          python3 -m pip install semgrep
+          python3 -m pip install --upgrade requests
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: "go.mod"
+          cache: false
+
+      - name: Install ci tools
+        run: |
+          go install honnef.co/go/tools/cmd/staticcheck@master
+          go install github.com/kisielk/errcheck@latest
+          go install github.com/gordonklaus/ineffassign@latest
+
+  rust_core:
+    name: "Test core runtime"
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout codebase
+        uses: actions/checkout@v4
+      - name: Set up Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: stable
+          components: rustfmt,clippy
+      - name: Install Protoc
+        uses: arduino/setup-protoc@a8b67ba40b37d35169e222f3bb352603327985b6 # v2
+      - name: Set up cargo cache
+        uses: actions/cache@v3
+        continue-on-error: false
+        with:
+          path: |
+            ~/.cargo/bin/
+            ~/.cargo/registry/index/
+            ~/.cargo/registry/cache/
+            ~/.cargo/git/db/
+            target/
+          key: ${{ runner.os }}-cargo
+      - uses: taiki-e/install-action@nextest
+      - name: Run test
+        run: cargo nextest run
+        env:
+          CARGO_TERM_COLOR: always
+      - name: Run rustfmt
+        run: cargo fmt --all --check
+      - name: Run clippy
+        run: cargo clippy --all-targets --all-features -- -D warnings
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
deleted file mode 100644
index c94b3bd520..0000000000
--- a/.github/workflows/go.yml
+++ /dev/null
@@ -1,55 +0,0 @@
-name: Go
-
-on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-
-jobs:
-
-  build:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v2
-      with:
-        path: encr.dev
-
-    - name: Set up Node
-      uses: actions/setup-node@v2.1.5
-        
-    - name: Set up Go
-      uses: actions/setup-go@v2
-      with:
-        go-version: 1.16
-
-    - id: go-cache-paths
-      run: |
-        echo "::set-output name=go-build::$(go env GOCACHE)"
-        echo "::set-output name=go-mod::$(go env GOMODCACHE)"
-    
-    - name: Install encore-go
-      run: curl -o encore-go.tar.gz https://d2f391esomvqpi.cloudfront.net/encore-go-0.9.6-linux_amd64.tar.gz && tar -C . -xzf ./encore-go.tar.gz
-
-    - name: Go Build Cache
-      uses: actions/cache@v2
-      with:
-        path: ${{ steps.go-cache-paths.outputs.go-build }}
-        key: ${{ runner.os }}-go-build-${{ hashFiles('**/go.sum') }}
-
-    - name: Go Mod Cache
-      uses: actions/cache@v2
-      with:
-        path: ${{ steps.go-cache-paths.outputs.go-mod }}
-        key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}
-        
-    - name: Build dashapp
-      run: cd encr.dev/cli/daemon/dash/dashapp && npm install && npm run build
-
-    - name: Build
-      run: cd encr.dev && go build ./...
-
-    - name: Test
-      run: cd encr.dev && go test -short ./...
-      env:
-        ENCORE_GOROOT: ${{ github.workspace }}/encore-go
diff --git a/.github/workflows/makefile b/.github/workflows/makefile
new file mode 100644
index 0000000000..da16fb58b7
--- /dev/null
+++ b/.github/workflows/makefile
@@ -0,0 +1,59 @@
+# This makefile is used inconjunction with the .reviewdog.yml file in the root of the repo
+.PHONY: list-modules go-vet staticcheck errcheck ineffassign go-fmt
+
+# Automatically gather all information
+ALL_SRC :=  $(shell find ../../ -name "*.go")
+ALL_MODS = $(shell find ../../ -name go.mod)
+MOD_DIRS = $(sort $(realpath $(dir $(ALL_MODS))))
+REPO_DIR := $(realpath ../../)
+SEMGREP_DIR := "$(REPO_DIR)/tools/semgrep-rules"
+
+# List modules reports all found Go modules within the repository
+list-modules:
+	@echo $(MOD_DIRS)
+
+# Function to run a command in each Go module with appropriate build tags
+#
+# REL_DIR is the relative path to the file from the repository root
+#         it is computed by removing the REPO_DIR prefix from the $dir variable,
+#		  then we remove the prefix "/" to make it relative
+#         and finally escaping the slashes so we can use it in sed
+define run_for_each_module
+	@for dir in $(MOD_DIRS); do \
+		TAGS=""; \
+		if [ "$$dir" != "$(REPO_DIR)" ]; then \
+			TAGS="-tags encore,encore_internal,encore_app"; \
+		fi; \
+		REL_DIR=$$(echo "$${dir#$(REPO_DIR)}/" | sed 's/^\///' | sed 's/\//\\\//g'); \
+		(cd "$$dir" && $(1) $$TAGS $(2) | sed "s/^\.\//$$REL_DIR/"); \
+	done;
+endef
+
+# Run Go vet
+go-vet: $(ALL_SRC)
+	# The sed statements are:
+	#
+	# 1. Remove any lines starting with "#" (go vet uses these for each package)
+	# 2. Remove any "vet: " prefix from the output (sometimes we get this sometimes we dont)
+	# 3. Remove any "./" prefix from the output (we'll get this for files which exist directly in the module root folder - this is done so we don't double up next)
+	# 4. Add a "./" prefix to the output (this is so the sed within the run_for_each_module function can add the module path to each line)
+	$(call run_for_each_module,go vet,./... 2>&1  | sed '/^#/d' | sed 's/^vet: //' | sed 's/^\.\///' | sed "s/^/\.\//")
+
+## Run staticcheck
+staticcheck: $(ALL_SRC)
+	$(call run_for_each_module,staticcheck -tests=false -f=json,./... | jq -f "$(REPO_DIR)/.github/workflows/staticcheck-to-rdjsonl.jq" -c)
+
+# Run errcheck
+errcheck: $(ALL_SRC)
+	$(call run_for_each_module,errcheck -abspath,./...)
+
+
+## Run ineffassign
+ineffassign: $(ALL_SRC)
+	$(call run_for_each_module,ineffassign,./... 2>&1)
+
+semgrep: $(ALL_SRC)
+	@cd $(REPO_DIR) && semgrep scan --quiet --config=auto --config=$(SEMGREP_DIR) --json | jq -f "$(REPO_DIR)/.github/workflows/semgrep-to-rdjson.jq" -c
+
+go-fmt: $(ALL_SRC)
+	@cd $(REPO_DIR) && gofmt -s -d . || exit 0
diff --git a/.github/workflows/release-2.yml b/.github/workflows/release-2.yml
new file mode 100644
index 0000000000..a56791f8ba
--- /dev/null
+++ b/.github/workflows/release-2.yml
@@ -0,0 +1,119 @@
+name: Release (2.0)
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to build ("v1.2.3", "v1.2.3-nightly.20231231", "v1.2.3-beta.1" or "v0.0.0-develop+[commitHash]")'
+        type: string
+        required: true
+
+jobs:
+  release:
+    name: "Run Release Script"
+    runs-on: self-hosted
+    env:
+      GOROOT: /usr/local/go-1.21.4
+      RUSTUP_HOME: /usr/local/rust/rustup
+
+    steps:
+      - name: Checkout the repo
+        uses: actions/checkout@v4
+        with:
+          path: encr.dev
+
+      - name: Trigger release script
+        env:
+          NPM_PUBLISH_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
+        run: |
+          cd ${{ github.workspace }}/encr.dev
+          go run ./pkg/encorebuild/cmd/make-release/ -dst "${{ github.workspace	}}/build" -v "${{ github.event.inputs.version }}" -publish-npm=true
+
+      - name: Publish artifact (darwin_amd64)
+        uses: actions/upload-artifact@v3
+        with:
+          name: encore-${{ github.event.inputs.version }}-darwin_amd64
+          path: ${{ github.workspace }}/build/artifacts/encore-${{ github.event.inputs.version }}-darwin_amd64.tar.gz
+
+      - name: Publish artifact (darwin_arm64)
+        uses: actions/upload-artifact@v3
+        with:
+          name: encore-${{ github.event.inputs.version }}-darwin_arm64
+          path: ${{ github.workspace }}/build/artifacts/encore-${{ github.event.inputs.version }}-darwin_arm64.tar.gz
+
+      - name: Publish artifact (linux_amd64)
+        uses: actions/upload-artifact@v3
+        with:
+          name: encore-${{ github.event.inputs.version }}-linux_amd64
+          path: ${{ github.workspace }}/build/artifacts/encore-${{ github.event.inputs.version }}-linux_amd64.tar.gz
+
+      - name: Publish artifact (linux_arm64)
+        uses: actions/upload-artifact@v3
+        with:
+          name: encore-${{ github.event.inputs.version }}-linux_arm64
+          path: ${{ github.workspace }}/build/artifacts/encore-${{ github.event.inputs.version }}-linux_arm64.tar.gz
+
+      - name: Publish artifact (windows_amd64)
+        uses: actions/upload-artifact@v3
+        with:
+          name: encore-${{ github.event.inputs.version }}-windows_amd64
+          path: ${{ github.workspace }}/build/artifacts/encore-${{ github.event.inputs.version }}-windows_amd64.tar.gz
+
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Copy linux artifacts to docker context folder
+        run: |
+          mkdir -p ${{ github.workspace }}/encr.dev/.github/dockerimg/artifacts
+          cp ${{ github.workspace }}/build/artifacts/encore-${{ github.event.inputs.version }}-linux_amd64.tar.gz ${{ github.workspace }}/encr.dev/.github/dockerimg/artifacts/encore-linux_amd64.tar.gz
+          cp ${{ github.workspace }}/build/artifacts/encore-${{ github.event.inputs.version }}-linux_arm64.tar.gz ${{ github.workspace }}/encr.dev/.github/dockerimg/artifacts/encore-linux_arm64.tar.gz
+
+      - name: Create metadata (tags, labels) for Docker image
+        id: docker-meta
+        uses: docker/metadata-action@v5
+        with:
+          images: encoredotdev/encore
+          labels: |
+            org.opencontainers.image.title=Encore
+            org.opencontainers.image.vendor=encore.dev
+            org.opencontainers.image.authors=support@encore.dev
+            org.opencontainers.image.description=Encore is the end-to-end Backend Development Platform that lets you escape cloud complexity.
+          tags: |
+            type=raw,value=latest,enable=${{ !contains(github.event.inputs.version, '-') }}
+            type=semver,pattern={{version}},value=${{ github.event.inputs.version }}
+            type=sha
+            type=schedule,pattern=nightly,enable=${{ contains(github.event.inputs.version, '-nightly.') }}
+            type=semver,pattern={{major}}.{{minor}},value=${{ github.event.inputs.version }},enable=${{ !contains(github.event.inputs.version, '-') }}
+            type=semver,pattern={{major}},value=${{ github.event.inputs.version }},enable=${{ !contains(github.event.inputs.version, '-') }}
+
+      - name: Build and push docker images
+        uses: docker/build-push-action@v4
+        with:
+          context: encr.dev/.github/dockerimg
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.docker-meta.outputs.tags }}
+          labels: ${{ steps.docker-meta.outputs.labels }}
+          cache-from: type=inline
+          cache-to: type=inline
+          build-args: |
+            RELEASE_VERSION=${{ github.event.inputs.version }}
+
+  notify_release_success:
+    name: "Notify release system of successful build"
+    runs-on: self-hosted
+    needs:
+      - release
+    steps:
+      - name: Webhook
+        uses: distributhor/workflow-webhook@f5a294e144d6ef44cfac4d3d5e20b613bcee0d4b # v3.0.7
+        env:
+          webhook_type: "json"
+          webhook_url: ${{ secrets.RELEASE_WEBHOOK }}
+          data: '{ "version": "${{ github.event.inputs.version }}", "run_id": "${{ github.run_id }}" }'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 08f419b8b2..765ba0ec72 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,7 @@ on:
         description: 'Version to build ("1.2.3")'
         required: true
       encorego_version:
-        description: 'Encore-Go version to use ("1.2.3")'
+        description: 'Encore-Go version to use ("encore-go1.17.7")'
         required: true
 
 jobs:
@@ -15,62 +15,142 @@ jobs:
     strategy:
       matrix:
         include:
-          - builder: ubuntu-latest
+          - builder: ubuntu-24.04
             goos: linux
             goarch: amd64
-          - builder: macos-latest
+            release_key: linux_x86-64
+          - builder: ubuntu-24.04
+            goos: linux
+            goarch: arm64
+            release_key: linux_arm64
+          - builder: macos-11
             goos: darwin
             goarch: amd64
-          - builder: macos-latest
+            release_key: macos_x86-64
+          - builder: macos-11
             goos: darwin
             goarch: arm64
+            release_key: macos_arm64
           - builder: windows-latest
             goos: windows
             goarch: amd64
-    
+            release_key: windows_x86-64
+
     runs-on: ${{ matrix.builder }}
     steps:
-    - name: Check out repo
-      uses: actions/checkout@v2
-      with:
-        path: encr.dev
-      
-    - name: Set up Go
-      uses: actions/setup-go@v2
-      with:
-        go-version: 1.16
-
-    - id: go-cache-paths
-      run: |
-        echo "::set-output name=go-mod::$(go env GOMODCACHE)"
-
-    - name: Install encore-go
-      run: curl -o encore-go.tar.gz https://d2f391esomvqpi.cloudfront.net/encore-go-${{ github.event.inputs.encorego_version }}-${{ matrix.goos }}_${{ matrix.goarch }}.tar.gz && tar -C ${{ github.workspace }} -xzf ./encore-go.tar.gz
-
-    - name: Go Mod Cache
-      uses: actions/cache@v2
-      with:
-        path: ${{ steps.go-cache-paths.outputs.go-mod }}
-        key: ${{ matrix.goos }}-${{ matrix.goarch }}-go-mod-${{ hashFiles('**/go.sum') }}
-
-    - name: Build
-      run: cd encr.dev && go run ./pkg/make-release/make-release.go -v="${{ github.event.inputs.version }}" -dst=dist -goos=${{ matrix.goos }} -goarch=${{ matrix.goarch }} -encore-go="../encore-go"
-      env: 
-        GO111MODULE: "on"
-      if: runner.os != 'windows'
-
-    - name: Build
-      run: cd encr.dev && .\pkg\make-release\windows\build.bat
-      env: 
-        GO111MODULE: "on"
-        ENCORE_VERSION: "${{ github.event.inputs.version }}"
-        ENCORE_GOROOT: "../encore-go"
-      if: runner.os == 'windows'
-
-    - name: 'Tar artifacts'
-      run: tar -czvf encore-${{ github.event.inputs.version }}-${{ matrix.goos }}_${{ matrix.goarch }}.tar.gz -C encr.dev/dist/${{ matrix.goos }}_${{ matrix.goarch }} .
-    - name: Publish artifact
-      uses: actions/upload-artifact@v2
-      with:
-        name: encore-${{ github.event.inputs.version }}-${{ matrix.goos }}_${{ matrix.goarch }}
-        path: encore-${{ github.event.inputs.version }}-${{ matrix.goos }}_${{ matrix.goarch }}.tar.gz
+      - name: Check out repo
+        uses: actions/checkout@v4
+        with:
+          path: encr.dev
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version-file: "encr.dev/go.mod"
+          check-latest: true
+          cache-dependency-path: "encr.dev/go.sum"
+
+      - name: Set up Zig
+        uses: goto-bus-stop/setup-zig@7ab2955eb728f5440978d5824358023be3a2802d # v2.2.0
+        with:
+          version: 0.10.1
+
+      - name: Install encore-go
+        run: curl --fail -o encore-go.tar.gz -L https://github.com/encoredev/go/releases/download/${{ github.event.inputs.encorego_version }}/${{ matrix.release_key }}.tar.gz && tar -C ${{ github.workspace }} -xzf ./encore-go.tar.gz
+
+      - name: Build
+        run: cd encr.dev && go run ./pkg/make-release/make-release.go -v="${{ github.event.inputs.version }}" -dst=dist -goos=${{ matrix.goos }} -goarch=${{ matrix.goarch }} -encore-go="../encore-go"
+        env:
+          GO111MODULE: "on"
+        if: runner.os != 'windows'
+
+      - name: Build
+        run: cd encr.dev && .\pkg\make-release\windows\build.bat
+        env:
+          GO111MODULE: "on"
+          ENCORE_VERSION: "${{ github.event.inputs.version }}"
+          ENCORE_GOROOT: "../encore-go"
+        if: runner.os == 'windows'
+
+      - name: "Tar artifacts"
+        run: tar -czvf encore-${{ github.event.inputs.version }}-${{ matrix.goos }}_${{ matrix.goarch }}.tar.gz -C encr.dev/dist/${{ matrix.goos }}_${{ matrix.goarch }} .
+      - name: Publish artifact
+        uses: actions/upload-artifact@v3
+        with:
+          name: encore-${{ github.event.inputs.version }}-${{ matrix.goos }}_${{ matrix.goarch }}
+          path: encore-${{ github.event.inputs.version }}-${{ matrix.goos }}_${{ matrix.goarch }}.tar.gz
+
+  publish-docker-images:
+    name: "publish docker images"
+    runs-on: ubuntu-24.04
+    needs: build
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          sparse-checkout: .github
+      - name: Download Artifacts
+        uses: actions/download-artifact@v3
+        with:
+          path: .github/dockerimg/artifacts
+      - name: Setup Docker Buildx
+        uses: docker/setup-buildx-action@v1
+
+      - name: Login to Docker Registry
+        uses: docker/login-action@v2
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      - name: Cache Docker layers
+        uses: actions/cache@v2
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-buildx-
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v4
+        with:
+          images: encoredotdev/encore
+          labels: |
+            org.opencontainers.image.title=Encore
+            org.opencontainers.image.vendor=encore.dev
+            org.opencontainers.image.authors=support@encore.dev
+            org.opencontainers.image.description=Encore is the end-to-end Backend Development Platform that lets you escape cloud complexity.
+          tags: |
+            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
+            type=semver,pattern={{version}},value=v${{ github.event.inputs.version }}
+            type=semver,pattern={{major}}.{{minor}},value=v${{ github.event.inputs.version }}
+            type=semver,pattern={{major}},value=v${{ github.event.inputs.version }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v4
+        with:
+          context: .github/dockerimg
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          build-args: |
+            RELEASE_VERSION=${{ github.event.inputs.version }}
+
+  notify_release_success:
+    needs:
+      - build
+      - publish-docker-images
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Webhook
+        uses: distributhor/workflow-webhook@v3.0.7
+        env:
+          webhook_type: "json"
+          webhook_url: ${{ secrets.RELEASE_WEBHOOK }}
+          data: '{ "version": "${{ github.event.inputs.version }}", "run_id": "${{ github.run_id }}" }'
diff --git a/.github/workflows/semgrep-to-rdjson.jq b/.github/workflows/semgrep-to-rdjson.jq
new file mode 100644
index 0000000000..e374fb476e
--- /dev/null
+++ b/.github/workflows/semgrep-to-rdjson.jq
@@ -0,0 +1,43 @@
+# See https://github.com/reviewdog/reviewdog/tree/master/proto/rdf
+{
+    source: {
+        name: "semgrep",
+        url: "https://semgrep.dev/",
+    },
+    diagnostics: [
+        .results[] | {
+            code: {
+                value: .check_id,
+                url: [
+                        .extra.metadata.shortlink?,
+                        .extra.metadata.source?,
+                        .extra."semgrep.dev".rule.url?,
+                        "https://github.com/encoredev/encore/blob/main/\(.check_id | gsub("\\."; "/")).yml"
+                    ] | map(select(. != null)) | first,
+            },
+            message: .extra.message,
+            location: {
+                path: .path,
+                range: {
+                    start: {
+                        line: .start.line,
+                        column: .start.col
+                    },
+                    end: {
+                        line: .end.line,
+                        column: .end.col
+                    },
+                },
+            },
+            severity: .extra.severity,
+
+            # Temporary variable we store to track the fix
+            _res: .
+        } |
+            if ._res.extra.fix then .suggestions = [{
+                range: .location.range,
+                text: ._res.extra.fix,
+            }] else . end |
+            del(._res)
+    ]
+}
diff --git a/.github/workflows/staticcheck-to-rdjsonl.jq b/.github/workflows/staticcheck-to-rdjsonl.jq
new file mode 100644
index 0000000000..2ca6946eae
--- /dev/null
+++ b/.github/workflows/staticcheck-to-rdjsonl.jq
@@ -0,0 +1,19 @@
+# See https://github.com/reviewdog/reviewdog/tree/master/proto/rdf
+{
+  source: {
+    name: "staticcheck",
+    url: "https://staticcheck.io"
+  },
+  message: .message,
+  code: {value: .code, url: "https://staticcheck.io/docs/checks#\(.code)"},
+  location: {
+    path: .location.file,
+    range: {
+      start: {
+        line: .location.line,
+        column: .location.column
+      }
+    }
+  },
+  severity: ((.severity|ascii_upcase|select(match("ERROR|WARNING|INFO")))//null)
+}
diff --git a/.gitignore b/.gitignore
index 30a3d5eb4c..8ef7422ae3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,10 +2,25 @@
 /dist
 /encore
 /git-remote-encore
+/target
 
 # Don't commit dotfiles
 /.encore
 /.vscode
 
 # Build artifact that must be placed alongside go files for Windows
-*.syso
\ No newline at end of file
+*.syso
+
+# JetBrains
+.idea
+.fleet
+.run
+
+# MacOS
+.DS_Store
+
+runtimes/supervisor-encore
+
+runtimes/supervisor-encore-linux-amd64
+
+encore-runtime.node-linux-amd64
diff --git a/.prettierrc.toml b/.prettierrc.toml
new file mode 100644
index 0000000000..66c04fd783
--- /dev/null
+++ b/.prettierrc.toml
@@ -0,0 +1 @@
+trailingComma = "none"
diff --git a/.reviewdog.yml b/.reviewdog.yml
new file mode 100644
index 0000000000..74a5d9e16a
--- /dev/null
+++ b/.reviewdog.yml
@@ -0,0 +1,33 @@
+# Encore's reviewdog configuration file.
+#
+# This runs in our CI pipeline when you open a PR. To run this locally
+# and get the same results as our CI pipeline, run: `./check.bash`
+#
+# We use a makefile rather than the commands directly as this repo
+# has multiple Go modules within it and most tools only look at the
+# module in the current directory. Thus our make file runs the tool
+# for each module, combining the results into a single standardised
+# that review dog can then parse and display as a single "run" for
+# each tool.
+runner:
+  go-vet:
+    cmd: make -s -C .github/workflows go-vet
+    format: govet
+  go-fmt:
+    cmd: make -s -C .github/workflows go-fmt
+    format: diff
+# Disable staticcheck until it supports Go 1.21: https://github.com/dominikh/go-tools/issues/1431
+#  staticcheck:
+#    cmd: make -s -C .github/workflows staticcheck
+#    format: rdjsonl
+  errcheck:
+    cmd: make -s -C .github/workflows errcheck
+    errorformat:
+      - "%f:%l:%c:\t%m"
+  ineffassign:
+    cmd: make -s -C .github/workflows ineffassign
+    errorformat:
+      - "%f:%l:%c: %m"
+  semgrep:
+    cmd: make -s -C .github/workflows semgrep
+    format: rdjson
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000000..1304d55a1c
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,92 @@
+# Contributing to Encore
+
+We're so excited that you are interested in contributing to Encore!
+All contributions are welcome, and there are several valuable ways to contribute.
+
+Below is a technical walkthrough of developing the `encore` command for contributing code
+to the Encore project. Head over to the community section for [more ways to contribute](https://encore.dev/docs/community/contribute)!
+
+## GitHub Codespaces / VS Code Remote Containers
+The easiest way to get started with developing Encore is using
+GitHub Codespaces. Simply open this repository in a new Codespace
+and your development environment will be set up with everything preconfigured for building the `encore` CLI and running applications with it.
+
+This also works just as well with [Visual Studio Code's Remote Development](https://code.visualstudio.com/docs/remote/remote-overview).
+
+
+## Building the encore command from source
+To build from the source simply run `go build ./cli/cmd/encore` and `go install ./cli/cmd/git-remote-encore`.
+
+Running an Encore application requires both the Encore runtime (the `encore.dev` package) as well as a custom-built
+[Go runtime](https://github.com/encoredev/go) to implement Encore's request semantics and automated instrumentation.
+
+As a result, the Encore Daemon must know where these two things exist on the filesystem to compile the Encore application properly.
+
+This must be done in one of two ways: embedding the installation path at compile time (similar to `GOROOT`)
+or by setting an environment variable at runtime.
+
+The environment variables are:
+- `ENCORE_RUNTIMES_PATH` – the path to the `encore.dev` runtime implementation.
+- `ENCORE_GOROOT` – the path to encore-go on disk
+
+**ENCORE_RUNTIMES_PATH**
+
+This must be set to the location of the `encore.dev` runtime package.
+It's located in this Git repository in the `runtimes` directory:
+
+```bash
+export ENCORE_RUNTIMES_PATH=/path/to/encore/runtimes
+```
+
+**ENCORE_GOROOT**
+
+The `ENCORE_GOROOT` must be set to the path to the [Encore Go runtime](https://github.com/encoredev/go).
+Unless you want to make changes to the Go runtime it's easiest to point this to an existing Encore installation.
+
+To do that, run `encore daemon env` and grab the value of `ENCORE_GOROOT`. For example (yours is probably different):
+
+```bash
+export ENCORE_GOROOT=/opt/homebrew/Cellar/encore/0.16.2/libexec/encore-go
+```
+
+### Running applications when building from source
+Once you've built your own `encore` binary and set the environment variables above, you're ready to go!
+
+Start the daemon with the built binary: `./encore daemon -f`
+
+Note that when you run commands like `encore run` must use the same `encore` binary the daemon is running.
+
+
+### Testing the Daemon run logic
+The codegen tests in the `internal/clientgen/client_test.go` file uses many auto generated files from the
+`e2e-tests/testdata` directory. To generate the client files and other test files, run `go test -golden-update` from
+the `e2e-tests` directory. This will generate client files for all the supported client generation languages.
+
+Running `go test ./internal/clientgen` will now work and use the most recent client generated files. If
+you change the client or content of the `testdata` folder, you may need to regenerate the client files again.
+
+## Architecture
+
+The code base is divided into several parts:
+
+### cli
+The `encore` command line interface. The encore background daemon
+is located at `cli/daemon` and is responsible for managing processes,
+setting up databases and talking with the Encore servers for operations like
+fetching production logs.
+
+### parser
+The Encore Parser statically analyzes Encore apps to build up a model
+of the application dubbed the Encore Syntax Tree (EST) that lives in
+`parser/est`.
+
+For speed the parser does not perform traditional type-checking; it does
+limited type-checking for enforcing Encore-specific rules but otherwise
+relies on the underlying Go compiler to perform type-checking as part of
+building the application.
+
+### compiler
+The Encore Compiler rewrites the source code based on the parsed
+Encore Syntax Tree to create a fully functioning application.
+It rewrites API calls & API handlers, injects instrumentation
+and secret values, and more.
diff --git a/Cargo.lock b/Cargo.lock
new file mode 100644
index 0000000000..462758d190
--- /dev/null
+++ b/Cargo.lock
@@ -0,0 +1,7647 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "Inflector"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe438c63458706e03479442743baae6c88256498e6431708f6dfc520a26515d3"
+dependencies = [
+ "lazy_static",
+ "regex",
+]
+
+[[package]]
+name = "addr2line"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
+dependencies = [
+ "gimli",
+]
+
+[[package]]
+name = "adler2"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
+
+[[package]]
+name = "ahash"
+version = "0.8.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e89da841a80418a9b391ebaea17f5c112ffaaa96f621d2c285b5174da76b9011"
+dependencies = [
+ "cfg-if",
+ "getrandom 0.2.15",
+ "once_cell",
+ "version_check",
+ "zerocopy",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e60d3430d3a69478ad0993f19238d2df97c507009a52b3c10addcd7f6bcb916"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "alloc-no-stdlib"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94fb8275041c72129eb51b7d0322c29b8387a0386127718b096429201a5d6ece"
+dependencies = [
+ "alloc-no-stdlib",
+]
+
+[[package]]
+name = "allocator-api2"
+version = "0.2.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
+
+[[package]]
+name = "android-tzdata"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "anstream"
+version = "0.6.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2109dbce0e72be3ec00bed26e6a7479ca384ad226efdd66db8fa2e3a38c83125"
+dependencies = [
+ "anstyle",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04"
+dependencies = [
+ "backtrace",
+]
+
+[[package]]
+name = "approx"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cab112f0a86d568ea0e627cc1d6be74a1e9cd55214684db5561995f6dad897c6"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "arc-swap"
+version = "1.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457"
+
+[[package]]
+name = "array-init"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d62b7694a562cdf5a74227903507c56ab2cc8bdd1f781ed5cb4cf9c9f810bfc"
+
+[[package]]
+name = "arrayvec"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c02d123df017efcdfbd739ef81735b36c5ba83ec3c59c80a9d7ecc718f92e50"
+
+[[package]]
+name = "assert_fs"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7efdb1fdb47602827a342857666feb372712cbc64b414172bd6b167a02927674"
+dependencies = [
+ "anstyle",
+ "doc-comment",
+ "globwalk",
+ "predicates 3.1.3",
+ "predicates-core",
+ "predicates-tree",
+ "tempfile",
+]
+
+[[package]]
+name = "assert_matches"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b34d609dfbaf33d6889b2b7106d3ca345eacad44200913df5ba02bfd31d2ba9"
+
+[[package]]
+name = "ast_node"
+version = "0.9.5"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "swc_macros_common",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "async-channel"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81953c529336010edd6d8e358f886d9581267795c61b19475b71314bffa46d35"
+dependencies = [
+ "concurrent-queue",
+ "event-listener",
+ "futures-core",
+]
+
+[[package]]
+name = "async-compression"
+version = "0.3.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "942c7cd7ae39e91bde4820d74132e9862e62c2f386c3aa90ccf55949f5bad63a"
+dependencies = [
+ "flate2",
+ "futures-core",
+ "memchr",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "async-stream"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b5a71a6f37880a80d1d7f19efd781e4b5de42c88f0722cc13bcb6cc2cfe8476"
+dependencies = [
+ "async-stream-impl",
+ "futures-core",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "async-stream-impl"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7c24de15d275a1ecfd47a380fb4d5ec9bfe0933f309ed5e705b775596a3574d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "async-trait"
+version = "0.1.85"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f934833b4b7233644e5848f235df3f57ed8c80f1528a26c3dfa13d2147fa056"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "atomic-waker"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
+
+[[package]]
+name = "aws-config"
+version = "1.5.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c03a50b30228d3af8865ce83376b4e99e1ffa34728220fe2860e4df0bb5278d6"
+dependencies = [
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-sdk-sso",
+ "aws-sdk-ssooidc",
+ "aws-sdk-sts",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "fastrand",
+ "hex",
+ "http 0.2.12",
+ "ring 0.17.8",
+ "time",
+ "tokio",
+ "tracing",
+ "url",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-credential-types"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60e8f6b615cb5fc60a98132268508ad104310f0cfb25a1c22eee76efdf9154da"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-runtime"
+version = "1.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b16d1aa50accc11a4b4d5c50f7fb81cc0cf60328259c587d0e6b0f11385bde46"
+dependencies = [
+ "aws-credential-types",
+ "aws-sigv4",
+ "aws-smithy-async",
+ "aws-smithy-eventstream",
+ "aws-smithy-http",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "fastrand",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "tracing",
+ "uuid",
+]
+
+[[package]]
+name = "aws-sdk-s3"
+version = "1.68.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc5ddf1dc70287dc9a2f953766a1fe15e3e74aef02fd1335f2afa475c9b4f4fc"
+dependencies = [
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-sigv4",
+ "aws-smithy-async",
+ "aws-smithy-checksums",
+ "aws-smithy-eventstream",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-smithy-xml",
+ "aws-types",
+ "bytes",
+ "fastrand",
+ "hex",
+ "hmac",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "lru",
+ "once_cell",
+ "percent-encoding",
+ "regex-lite",
+ "sha2",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "aws-sdk-sns"
+version = "1.54.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71d976a6c87d15fd3ceab6fcaa17e0d02a05a06d30f5e268e4160b25dbde26d"
+dependencies = [
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-query",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-smithy-xml",
+ "aws-types",
+ "http 0.2.12",
+ "once_cell",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sdk-sqs"
+version = "1.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6493ce2b27a2687b0d8a2453bf6ad2499012e9720c3367cb1206496ede475443"
+dependencies = [
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "http 0.2.12",
+ "once_cell",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sdk-sso"
+version = "1.53.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1605dc0bf9f0a4b05b451441a17fcb0bda229db384f23bf5cead3adbab0664ac"
+dependencies = [
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "http 0.2.12",
+ "once_cell",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sdk-ssooidc"
+version = "1.54.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59f3f73466ff24f6ad109095e0f3f2c830bfb4cd6c8b12f744c8e61ebf4d3ba1"
+dependencies = [
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-types",
+ "bytes",
+ "http 0.2.12",
+ "once_cell",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sdk-sts"
+version = "1.54.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "249b2acaa8e02fd4718705a9494e3eb633637139aa4bb09d70965b0448e865db"
+dependencies = [
+ "aws-credential-types",
+ "aws-runtime",
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-json",
+ "aws-smithy-query",
+ "aws-smithy-runtime",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "aws-smithy-xml",
+ "aws-types",
+ "http 0.2.12",
+ "once_cell",
+ "regex-lite",
+ "tracing",
+]
+
+[[package]]
+name = "aws-sigv4"
+version = "1.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d3820e0c08d0737872ff3c7c1f21ebbb6693d832312d6152bf18ef50a5471c2"
+dependencies = [
+ "aws-credential-types",
+ "aws-smithy-eventstream",
+ "aws-smithy-http",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "crypto-bigint 0.5.5",
+ "form_urlencoded",
+ "hex",
+ "hmac",
+ "http 0.2.12",
+ "http 1.2.0",
+ "once_cell",
+ "p256",
+ "percent-encoding",
+ "ring 0.17.8",
+ "sha2",
+ "subtle",
+ "time",
+ "tracing",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-smithy-async"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "427cb637d15d63d6f9aae26358e1c9a9c09d5aa490d64b09354c8217cfef0f28"
+dependencies = [
+ "futures-util",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "aws-smithy-checksums"
+version = "0.60.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba1a71073fca26775c8b5189175ea8863afb1c9ea2cceb02a5de5ad9dfbaa795"
+dependencies = [
+ "aws-smithy-http",
+ "aws-smithy-types",
+ "bytes",
+ "crc32c",
+ "crc32fast",
+ "hex",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "md-5",
+ "pin-project-lite",
+ "sha1",
+ "sha2",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-eventstream"
+version = "0.60.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cef7d0a272725f87e51ba2bf89f8c21e4df61b9e49ae1ac367a6d69916ef7c90"
+dependencies = [
+ "aws-smithy-types",
+ "bytes",
+ "crc32fast",
+]
+
+[[package]]
+name = "aws-smithy-http"
+version = "0.60.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c8bc3e8fdc6b8d07d976e301c02fe553f72a39b7a9fea820e023268467d7ab6"
+dependencies = [
+ "aws-smithy-eventstream",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "bytes-utils",
+ "futures-core",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "pin-utils",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-json"
+version = "0.61.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee4e69cc50921eb913c6b662f8d909131bb3e6ad6cb6090d3a39b66fc5c52095"
+dependencies = [
+ "aws-smithy-types",
+]
+
+[[package]]
+name = "aws-smithy-query"
+version = "0.60.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2fbd61ceb3fe8a1cb7352e42689cec5335833cd9f94103a61e98f9bb61c64bb"
+dependencies = [
+ "aws-smithy-types",
+ "urlencoding",
+]
+
+[[package]]
+name = "aws-smithy-runtime"
+version = "1.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a05dd41a70fc74051758ee75b5c4db2c0ca070ed9229c3df50e9475cda1cb985"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-http",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "bytes",
+ "fastrand",
+ "h2 0.3.26",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "http-body 1.0.1",
+ "httparse",
+ "hyper 0.14.32",
+ "hyper-rustls 0.24.2",
+ "once_cell",
+ "pin-project-lite",
+ "pin-utils",
+ "rustls 0.21.12",
+ "tokio",
+ "tracing",
+]
+
+[[package]]
+name = "aws-smithy-runtime-api"
+version = "1.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92165296a47a812b267b4f41032ff8069ab7ff783696d217f0994a0d7ab585cd"
+dependencies = [
+ "aws-smithy-async",
+ "aws-smithy-types",
+ "bytes",
+ "http 0.2.12",
+ "http 1.2.0",
+ "pin-project-lite",
+ "tokio",
+ "tracing",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-smithy-types"
+version = "1.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38ddc9bd6c28aeb303477170ddd183760a956a03e083b3902a990238a7e3792d"
+dependencies = [
+ "base64-simd",
+ "bytes",
+ "bytes-utils",
+ "futures-core",
+ "http 0.2.12",
+ "http 1.2.0",
+ "http-body 0.4.6",
+ "http-body 1.0.1",
+ "http-body-util",
+ "itoa",
+ "num-integer",
+ "pin-project-lite",
+ "pin-utils",
+ "ryu",
+ "serde",
+ "time",
+ "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "aws-smithy-xml"
+version = "0.60.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab0b0166827aa700d3dc519f72f8b3a91c35d0b8d042dc5d643a91e6f80648fc"
+dependencies = [
+ "xmlparser",
+]
+
+[[package]]
+name = "aws-types"
+version = "1.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5221b91b3e441e6675310829fd8984801b772cb1546ef6c0e54dec9f1ac13fef"
+dependencies = [
+ "aws-credential-types",
+ "aws-smithy-async",
+ "aws-smithy-runtime-api",
+ "aws-smithy-types",
+ "rustc_version",
+ "tracing",
+]
+
+[[package]]
+name = "axum"
+version = "0.6.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b829e4e32b91e643de6eafe82b1d90675f5874230191a4ffbc1b336dec4d6bf"
+dependencies = [
+ "async-trait",
+ "axum-core 0.3.4",
+ "bitflags 1.3.2",
+ "bytes",
+ "futures-util",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "hyper 0.14.32",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustversion",
+ "serde",
+ "sync_wrapper 0.1.2",
+ "tower 0.4.13",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+dependencies = [
+ "async-trait",
+ "axum-core 0.4.5",
+ "base64 0.22.1",
+ "bytes",
+ "futures-util",
+ "http 1.2.0",
+ "http-body 1.0.1",
+ "http-body-util",
+ "hyper 1.5.2",
+ "hyper-util",
+ "itoa",
+ "matchit",
+ "memchr",
+ "mime",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustversion",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "sha1",
+ "sync_wrapper 1.0.2",
+ "tokio",
+ "tokio-tungstenite 0.24.0",
+ "tower 0.5.2",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "759fa577a247914fd3f7f76d62972792636412fbfd634cd452f6a385a74d2d2c"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "futures-util",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "mime",
+ "rustversion",
+ "tower-layer",
+ "tower-service",
+]
+
+[[package]]
+name = "axum-core"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "futures-util",
+ "http 1.2.0",
+ "http-body 1.0.1",
+ "http-body-util",
+ "mime",
+ "pin-project-lite",
+ "rustversion",
+ "sync_wrapper 1.0.2",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "backoff"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "721c249ab59cbc483ad4294c9ee2671835c1e43e9ffc277e6b4ecfef733cfdc5"
+dependencies = [
+ "instant",
+ "rand 0.7.3",
+]
+
+[[package]]
+name = "backtrace"
+version = "0.3.74"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
+dependencies = [
+ "addr2line",
+ "cfg-if",
+ "libc",
+ "miniz_oxide",
+ "object",
+ "rustc-demangle",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "base16ct"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "349a06037c7bf932dd7e7d1f653678b2038b9ad46a74102f1fc7bd7872678cce"
+
+[[package]]
+name = "base32"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23ce669cd6c8588f79e15cf450314f9638f967fc5770ff1c7c1deb0925ea7cfa"
+
+[[package]]
+name = "base64"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
+
+[[package]]
+name = "base64"
+version = "0.21.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d297deb1925b89f2ccc13d7635fa0714f12c87adce1c75356b39ca9b7178567"
+
+[[package]]
+name = "base64"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
+
+[[package]]
+name = "base64-simd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "339abbe78e73178762e23bea9dfd08e697eb3f3301cd4be981c0f78ba5859195"
+dependencies = [
+ "outref",
+ "vsimd",
+]
+
+[[package]]
+name = "base64ct"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c3c1a368f70d6cf7302d78f8f7093da241fb8e8807c05cc9e51a125895a6d5b"
+
+[[package]]
+name = "bb8"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89aabfae550a5c44b43ab941844ffcd2e993cb6900b342debf59e9ea74acdb8"
+dependencies = [
+ "async-trait",
+ "futures-util",
+ "parking_lot",
+ "tokio",
+]
+
+[[package]]
+name = "bb8-postgres"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56ac82c42eb30889b5c4ee4763a24b8c566518171ebea648cd7e3bc532c60680"
+dependencies = [
+ "async-trait",
+ "bb8",
+ "tokio",
+ "tokio-postgres",
+]
+
+[[package]]
+name = "better_scoped_tls"
+version = "0.1.1"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "scoped-tls",
+]
+
+[[package]]
+name = "bindgen"
+version = "0.66.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2b84e06fc203107bfbad243f4aba2af864eb7db3b1cf46ea0a023b0b433d2a7"
+dependencies = [
+ "bitflags 2.9.4",
+ "cexpr",
+ "clang-sys",
+ "lazy_static",
+ "lazycell",
+ "log",
+ "peeking_take_while",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "rustc-hash",
+ "shlex",
+ "syn 2.0.95",
+ "which",
+]
+
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2261d10cca569e4643e526d8dc2e62e433cc8aba21ab764233731f8d369bf394"
+
+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
+[[package]]
+name = "brotli"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d640d25bc63c50fb1f0b545ffd80207d2e10a4c965530809b40ba3386825c391"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "2.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e2e4afe60d7dd600fdd3de8d0f08c2b7ec039712e3b6137ff98b7004e82de4f"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
+[[package]]
+name = "bstr"
+version = "1.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "531a9155a481e2ee699d4f98f43c0ca4ff8ee1bfd55c31e9e98fb29d2b176fe0"
+dependencies = [
+ "memchr",
+ "regex-automata 0.4.9",
+ "serde",
+]
+
+[[package]]
+name = "built"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b99c4cdc7b2c2364182331055623bdf45254fcb679fea565c40c3c11c101889a"
+dependencies = [
+ "cargo-lock",
+]
+
+[[package]]
+name = "bumpalo"
+version = "3.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+
+[[package]]
+name = "bytemuck"
+version = "1.23.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3995eaeebcdf32f91f980d360f78732ddc061097ab4e39991ae7a6ace9194677"
+
+[[package]]
+name = "byteorder"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
+
+[[package]]
+name = "bytes"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "325918d6fe32f23b19878fe4b34794ae41fc19ddbe53b10571a4874d44ffd39b"
+
+[[package]]
+name = "bytes-utils"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dafe3a8757b027e2be6e4e5601ed563c55989fcf1546e933c66c8eb3a058d35"
+dependencies = [
+ "bytes",
+ "either",
+]
+
+[[package]]
+name = "cargo-lock"
+version = "9.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e11c675378efb449ed3ce8de78d75d0d80542fc98487c26aba28eb3b82feac72"
+dependencies = [
+ "semver",
+ "serde",
+ "toml",
+ "url",
+]
+
+[[package]]
+name = "cc"
+version = "1.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a012a0df96dd6d06ba9a1b29d6402d1a5d77c6befd2566afdc26e10603dc93d7"
+dependencies = [
+ "jobserver",
+ "libc",
+ "shlex",
+]
+
+[[package]]
+name = "cexpr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fac387a98bb7c37292057cffc56d62ecb629900026402633ae9160df93a8766"
+dependencies = [
+ "nom",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "chrono"
+version = "0.4.39"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825"
+dependencies = [
+ "android-tzdata",
+ "iana-time-zone",
+ "js-sys",
+ "num-traits",
+ "serde",
+ "wasm-bindgen",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "cidr"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd1b64030216239a2e7c364b13cd96a2097ebf0dfe5025f2dedee14a23f2ab60"
+
+[[package]]
+name = "clang-sys"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b023947811758c97c59bf9d1c188fd619ad4718dcaa767947df1cadb14f39f4"
+dependencies = [
+ "glob",
+ "libc",
+ "libloading",
+]
+
+[[package]]
+name = "clap"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
+dependencies = [
+ "atty",
+ "bitflags 1.3.2",
+ "clap_derive",
+ "clap_lex",
+ "indexmap 1.9.3",
+ "once_cell",
+ "strsim 0.10.0",
+ "termcolor",
+ "textwrap",
+]
+
+[[package]]
+name = "clap_derive"
+version = "3.2.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae6371b8bdc8b7d3959e9cf7b22d4435ef3e79e138688421ec654acf8c81b008"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "clap_lex"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2850f2f5a82cbf437dd5af4d49848fbdfc27c157c3d010345776f952765261c5"
+dependencies = [
+ "os_str_bytes",
+]
+
+[[package]]
+name = "clean-path"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaa6b4b263a5d737e9bf6b7c09b72c41a5480aec4d7219af827f6564e950b6a5"
+
+[[package]]
+name = "cmake"
+version = "0.1.52"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c682c223677e0e5b6b7f63a64b9351844c3f1b1678a68b7ee617e30fb082620e"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "colorchoice"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
+
+[[package]]
+name = "colored"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "117725a109d387c937a1533ce01b450cbde6b88abceea8473c4d7a85853cda3c"
+dependencies = [
+ "lazy_static",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "console"
+version = "0.15.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea3c6ecd8059b57859df5c69830340ed3c41d30e3da0c1cbed90a96ac853041b"
+dependencies = [
+ "encode_unicode",
+ "libc",
+ "once_cell",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
+[[package]]
+name = "constant_time_eq"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6"
+
+[[package]]
+name = "convert_case"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec182b0ca2f35d8fc196cf3404988fd8b8c739a4d270ff118a398feb0cbec1ca"
+dependencies = [
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "cookie"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ddef33a339a91ea89fb53151bd0a4689cfce27055c291dfa69945475d22c747"
+dependencies = [
+ "time",
+ "version_check",
+]
+
+[[package]]
+name = "core-foundation"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "core-foundation-sys"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
+
+[[package]]
+name = "cpufeatures"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "16b80225097f2e5ae4e7179dd2266824648f3e2f49d9134d584b76389d31c4c3"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "crc32c"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a47af21622d091a8f0fb295b88bc886ac74efcc613efc19f5d0b21de5c89e47"
+dependencies = [
+ "rustc_version",
+]
+
+[[package]]
+name = "crc32fast"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "cron-parser"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa8b40ccc59e09cc54bec675bea0e79dae34f5b900c8c5e06d8d6db884107adb"
+dependencies = [
+ "chrono",
+]
+
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06ba6d68e24814cb8de6bb986db8222d3a027d15872cabc0d18817bc3c0e4471"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-epoch"
+version = "0.9.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-queue"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f58bbc28f91df819d0aa2a2c00cd19754769c2fad90579b3592b1c9ba7a3115"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "crossbeam-utils"
+version = "0.8.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
+
+[[package]]
+name = "crypto-bigint"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef2b4b23cddf68b89b8f8069890e8c270d54e2d5fe1b143820234805e4cb17ef"
+dependencies = [
+ "generic-array",
+ "rand_core 0.6.4",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "crypto-bigint"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "crypto-common"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
+[[package]]
+name = "ctor"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a2785755761f3ddc1492979ce1e48d2c00d09311c39e4466429188f3dd6501"
+dependencies = [
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "daemonize"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab8bfdaacb3c887a54d41bdf48d3af8873b3f5566469f8ba21b92057509f116e"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "darling"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f63b86c8a8826a49b8c21f08a2d07338eec8d900540f8630dc76284be802989"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95133861a8032aaea082871032f5815eb9e98cef03fa916ab4500513994df9e5"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim 0.11.1",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.20.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d336a2a514f6ccccaa3e09b02d41d35330c07ddf03a62165fcec10bb561c7806"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "dashmap"
+version = "5.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
+dependencies = [
+ "cfg-if",
+ "hashbrown 0.14.5",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "data-encoding"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"
+
+[[package]]
+name = "der"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1a467a65c5e759bce6e65eaf91cc29f466cdc57cb65777bd646872a8a1fd4de"
+dependencies = [
+ "const-oid",
+ "zeroize",
+]
+
+[[package]]
+name = "der"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f55bf8e7b65898637379c1b74eb1551107c8294ed26d855ceb9fd1a09cfc9bc0"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
+[[package]]
+name = "deranged"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"
+dependencies = [
+ "powerfmt",
+ "serde",
+]
+
+[[package]]
+name = "derivative"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcc3dd5e9e9c0b295d6e1e4d811fb6f157d5ffd784b8d202fc62eac8035a770b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "difflib"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"
+
+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer",
+ "const-oid",
+ "crypto-common",
+ "subtle",
+]
+
+[[package]]
+name = "displaydoc"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "duct"
+version = "0.13.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4ab5718d1224b63252cd0c6f74f6480f9ffeb117438a2e0f5cf6d9a4798929c"
+dependencies = [
+ "libc",
+ "once_cell",
+ "os_pipe",
+ "shared_child",
+]
+
+[[package]]
+name = "duration-string"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fcc1d9ae294a15ed05aeae8e11ee5f2b3fe971c077d45a42fb20825fba6ee13"
+
+[[package]]
+name = "ecdsa"
+version = "0.14.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413301934810f597c1d19ca71c8710e99a3f1ba28a0d2ebc01551a2daeea3c5c"
+dependencies = [
+ "der 0.6.1",
+ "elliptic-curve",
+ "rfc6979",
+ "signature 1.6.4",
+]
+
+[[package]]
+name = "either"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
+
+[[package]]
+name = "elliptic-curve"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7bb888ab5300a19b8e5bceef25ac745ad065f3c9f7efc6de1b91958110891d3"
+dependencies = [
+ "base16ct",
+ "crypto-bigint 0.4.9",
+ "der 0.6.1",
+ "digest",
+ "ff",
+ "generic-array",
+ "group",
+ "pkcs8 0.9.0",
+ "rand_core 0.6.4",
+ "sec1",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "email_address"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "encode_unicode"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34aa73646ffb006b8f5147f3dc182bd4bcb190227ce861fc4a4844bf8e3cb2c0"
+
+[[package]]
+name = "encoding_rs"
+version = "0.8.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "encore-js-runtime"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum 0.7.9",
+ "bytes",
+ "chrono",
+ "encore-runtime-core",
+ "futures",
+ "log",
+ "malachite",
+ "mappable-rc",
+ "napi",
+ "napi-build",
+ "napi-derive",
+ "num_cpus",
+ "prost 0.12.6",
+ "prost-types 0.12.6",
+ "serde_json",
+ "tokio",
+ "tokio-util",
+]
+
+[[package]]
+name = "encore-runtime-core"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "assert_matches",
+ "async-stream",
+ "aws-config",
+ "aws-credential-types",
+ "aws-sdk-s3",
+ "aws-sdk-sns",
+ "aws-sdk-sqs",
+ "aws-smithy-types",
+ "axum 0.7.9",
+ "backtrace",
+ "base32",
+ "base64 0.21.7",
+ "bb8",
+ "bb8-postgres",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "cidr",
+ "colored",
+ "cookie",
+ "duct",
+ "email_address",
+ "env_logger 0.10.2",
+ "flate2",
+ "form_urlencoded",
+ "futures",
+ "futures-core",
+ "futures-util",
+ "gjson",
+ "google-cloud-gax",
+ "google-cloud-googleapis",
+ "google-cloud-pubsub",
+ "google-cloud-storage",
+ "hex",
+ "hmac",
+ "http 1.2.0",
+ "http-body-util",
+ "httpdate",
+ "hyper 1.5.2",
+ "indexmap 2.7.0",
+ "insta",
+ "jsonwebtoken",
+ "log",
+ "malachite",
+ "matchit",
+ "md5",
+ "mime",
+ "native-tls",
+ "once_cell",
+ "openssl",
+ "openssl-probe",
+ "percent-encoding",
+ "pgvector",
+ "pingora",
+ "postgres-native-tls",
+ "postgres-protocol",
+ "proptest",
+ "prost 0.12.6",
+ "prost-build 0.12.6",
+ "prost-types 0.12.6",
+ "quickcheck",
+ "radix_fmt",
+ "rand 0.8.5",
+ "regex",
+ "reqwest 0.12.12",
+ "rsa",
+ "serde",
+ "serde_json",
+ "serde_path_to_error",
+ "serde_urlencoded",
+ "serde_with",
+ "sha2",
+ "sha3",
+ "subtle",
+ "thiserror 1.0.69",
+ "tokio",
+ "tokio-nsq",
+ "tokio-postgres",
+ "tokio-retry",
+ "tokio-stream",
+ "tokio-tungstenite 0.21.0",
+ "tokio-util",
+ "tower-http",
+ "tower-service",
+ "tracing",
+ "tracing-subscriber",
+ "url",
+ "urlencoding",
+ "uuid",
+ "xid",
+]
+
+[[package]]
+name = "encore-supervisor"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "axum 0.7.9",
+ "base64 0.21.7",
+ "bytes",
+ "env_logger 0.11.6",
+ "flate2",
+ "futures",
+ "http 1.2.0",
+ "hyper 1.5.2",
+ "libc",
+ "log",
+ "openssl",
+ "pingora",
+ "prost 0.12.6",
+ "prost-build 0.12.6",
+ "prost-types 0.12.6",
+ "reqwest 0.12.12",
+ "serde",
+ "serde_json",
+ "tokio",
+ "tokio-retry",
+ "tokio-util",
+ "url",
+]
+
+[[package]]
+name = "encore-tsparser"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "assert_fs",
+ "assert_matches",
+ "chrono",
+ "clean-path",
+ "convert_case",
+ "cron-parser",
+ "duct",
+ "env_logger 0.10.2",
+ "handlebars",
+ "indexmap 2.7.0",
+ "insta",
+ "itertools 0.13.0",
+ "junction",
+ "litparser",
+ "litparser-derive",
+ "log",
+ "matchit",
+ "once_cell",
+ "pg_query",
+ "prost 0.12.6",
+ "prost-build 0.12.6",
+ "regex",
+ "semver",
+ "serde",
+ "serde_json",
+ "serde_yaml 0.9.34+deprecated",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_ecma_loader",
+ "swc_ecma_parser",
+ "swc_ecma_transforms_base",
+ "swc_ecma_visit",
+ "symlink",
+ "tempdir",
+ "thiserror 1.0.69",
+ "tracing",
+ "tracing-subscriber",
+ "txtar",
+ "url",
+ "walkdir",
+]
+
+[[package]]
+name = "env_filter"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "186e05a59d4c50738528153b83b0b0194d3a29507dfec16eccd4b342903397d0"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a19187fea3ac7e84da7dacf48de0c45d63c6a76f9490dae389aead16c243fce3"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd405aab171cb85d6735e5c8d9db038c17d3ca007a4d2c25f337935c3d90580"
+dependencies = [
+ "humantime",
+ "is-terminal",
+ "log",
+ "regex",
+ "termcolor",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dcaee3d8e3cfc3fd92428d477bc97fc29ec8716d180c0d74c643bb26166660e0"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "env_filter",
+ "humantime",
+ "log",
+]
+
+[[package]]
+name = "equivalent"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
+
+[[package]]
+name = "erased-serde"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24e2389d65ab4fab27dc2a5de7b191e1f6617d1f1c8855c0dc569c94a4cbb18d"
+dependencies = [
+ "serde",
+ "typeid",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33d852cb9b869c2a9b3df2f71a3074817f01e1844f839a144f5fcef059a4eb5d"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "event-listener"
+version = "2.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
+
+[[package]]
+name = "fallible-iterator"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4443176a9f2c162692bd3d352d745ef9413eec5782a80d8fd6f8a1ac692a07f7"
+
+[[package]]
+name = "fastrand"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+
+[[package]]
+name = "ff"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d013fc25338cc558c5c2cfbad646908fb23591e2404481826742b651c9af7160"
+dependencies = [
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "fixedbitset"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce7134b9999ecaf8bcd65542e436736ef32ddca1b3e06094cb6ec5755203b80"
+
+[[package]]
+name = "flate2"
+version = "1.0.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c936bfdafb507ebbf50b8074c54fa31c5be9a1e7e5f467dd659697041407d07c"
+dependencies = [
+ "crc32fast",
+ "libz-ng-sys",
+ "miniz_oxide",
+]
+
+[[package]]
+name = "float-cmp"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98de4bbd547a563b716d8dfa9aad1cb19bfab00f4fa09a6a4ed21dbcf44ce9c4"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "foldhash"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0d2fde1f7b3d48b8395d5f2de76c18a528bd6a9cdde438df747bfcba3e05d6f"
+
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13624c2627564efccf4934284bdd98cbaa14e79b0b5a141218e507b3a823456"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "from_variant"
+version = "0.1.6"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "swc_macros_common",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
+[[package]]
+name = "fuchsia-cprng"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a06f77d526c1a601b7c4cdd98f54b5eaabffc14d5f2f0296febdc7f357c6d3ba"
+
+[[package]]
+name = "futures"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65bc07b1a8bc7c85c5f2e110c476c7389b4554ba72af57d8445ea63a576b0876"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-channel"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2dff15bf788c671c1934e366d07e30c1814a8ef514e1af724a602e8a2fbe1b10"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+]
+
+[[package]]
+name = "futures-core"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05f29059c0c2090612e8d742178b0580d2dc940c837851ad723096f87af6663e"
+
+[[package]]
+name = "futures-executor"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e28d1d997f585e54aebc3f97d39e72338912123a67330d723fdbb564d646c9f"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "futures-util",
+]
+
+[[package]]
+name = "futures-io"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e5c1b78ca4aae1ac06c48a526a655760685149f0d465d21f37abfe57ce075c6"
+
+[[package]]
+name = "futures-macro"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "162ee34ebcb7c64a8abebc059ce0fee27c2262618d7b60ed8faf72fef13c3650"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "futures-sink"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e575fab7d1e0dcb8d0c7bcf9a63ee213816ab51902e6d244a95819acacf1d4f7"
+
+[[package]]
+name = "futures-task"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f90f7dce0722e95104fcb095585910c0977252f286e354b5e3bd38902cd99988"
+
+[[package]]
+name = "futures-util"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fa08315bb612088cc391249efdc3bc77536f16c91f6cf495e6fbe85b20a4a81"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-macro",
+ "futures-sink",
+ "futures-task",
+ "memchr",
+ "pin-project-lite",
+ "pin-utils",
+ "slab",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "geo-types"
+version = "0.7.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6f47c611187777bbca61ea7aba780213f5f3441fd36294ab333e96cfa791b65"
+dependencies = [
+ "approx",
+ "num-traits",
+ "serde",
+]
+
+[[package]]
+name = "gethostname"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1ebd34e35c46e00bb73e81363248d627782724609fe1b6396f553f68fe3862e"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.9.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26145e563e54f2cadc477553f1ec5ee650b00862f0a58bcd12cbdc5f0ea2d2f4"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+ "wasi 0.14.2+wasi-0.2.4",
+]
+
+[[package]]
+name = "gimli"
+version = "0.31.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
+
+[[package]]
+name = "gjson"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43503cc176394dd30a6525f5f36e838339b8b5619be33ed9a7783841580a97b6"
+
+[[package]]
+name = "glob"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
+
+[[package]]
+name = "globset"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15f1ce686646e7f1e19bf7d5533fe443a45dbfb990e00629110797578b42fb19"
+dependencies = [
+ "aho-corasick",
+ "bstr",
+ "log",
+ "regex-automata 0.4.9",
+ "regex-syntax 0.8.5",
+]
+
+[[package]]
+name = "globwalk"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf760ebf69878d9fd8f110c89703d90ce35095324d1f1edcb595c63945ee757"
+dependencies = [
+ "bitflags 2.9.4",
+ "ignore",
+ "walkdir",
+]
+
+[[package]]
+name = "google-cloud-auth"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3bf7cb7864f08a92e77c26bb230d021ea57691788fb5dd51793f96965d19e7f9"
+dependencies = [
+ "async-trait",
+ "base64 0.21.7",
+ "google-cloud-metadata 0.4.0",
+ "google-cloud-token",
+ "home",
+ "jsonwebtoken",
+ "reqwest 0.11.27",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+ "time",
+ "tokio",
+ "tracing",
+ "urlencoding",
+]
+
+[[package]]
+name = "google-cloud-auth"
+version = "0.17.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57a13fbacc5e9c41ded3ad8d0373175a6b7a6ad430d99e89d314ac121b7ab06"
+dependencies = [
+ "async-trait",
+ "base64 0.21.7",
+ "google-cloud-metadata 0.5.0",
+ "google-cloud-token",
+ "home",
+ "jsonwebtoken",
+ "reqwest 0.12.12",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+ "time",
+ "tokio",
+ "tracing",
+ "urlencoding",
+]
+
+[[package]]
+name = "google-cloud-gax"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8cb60314136e37de9e2a05ddb427b9c5a39c3d188de2e2f026c6af74425eef44"
+dependencies = [
+ "google-cloud-token",
+ "http 0.2.12",
+ "thiserror 1.0.69",
+ "tokio",
+ "tokio-retry",
+ "tonic",
+ "tower 0.4.13",
+ "tracing",
+]
+
+[[package]]
+name = "google-cloud-googleapis"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db8a478015d079296167e3f08e096dc99cffc2cb50fa203dd38aaa9dd37f8354"
+dependencies = [
+ "prost 0.12.6",
+ "prost-types 0.12.6",
+ "tonic",
+]
+
+[[package]]
+name = "google-cloud-metadata"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc279bfb50487d7bcd900e8688406475fc750fe474a835b2ab9ade9eb1fc90e2"
+dependencies = [
+ "reqwest 0.11.27",
+ "thiserror 1.0.69",
+ "tokio",
+]
+
+[[package]]
+name = "google-cloud-metadata"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04f945a208886a13d07636f38fb978da371d0abc3e34bad338124b9f8c135a8f"
+dependencies = [
+ "reqwest 0.12.12",
+ "thiserror 1.0.69",
+ "tokio",
+]
+
+[[package]]
+name = "google-cloud-pubsub"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f6e4fdcd8303ad0d0cdb8b5722aa3a57de9534af27d4da71fc4d3179174a896"
+dependencies = [
+ "async-channel",
+ "async-stream",
+ "google-cloud-auth 0.13.2",
+ "google-cloud-gax",
+ "google-cloud-googleapis",
+ "google-cloud-token",
+ "prost-types 0.12.6",
+ "thiserror 1.0.69",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "google-cloud-storage"
+version = "0.22.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7347a3d65cd64db51e5b4aebf0c68c484042948c6d53f856f58269bc9816360"
+dependencies = [
+ "anyhow",
+ "async-stream",
+ "async-trait",
+ "base64 0.21.7",
+ "bytes",
+ "futures-util",
+ "google-cloud-auth 0.17.2",
+ "google-cloud-metadata 0.5.0",
+ "google-cloud-token",
+ "hex",
+ "once_cell",
+ "percent-encoding",
+ "pkcs8 0.10.2",
+ "regex",
+ "reqwest 0.12.12",
+ "reqwest-middleware",
+ "ring 0.17.8",
+ "serde",
+ "serde_json",
+ "sha2",
+ "thiserror 1.0.69",
+ "time",
+ "tokio",
+ "tracing",
+ "url",
+]
+
+[[package]]
+name = "google-cloud-token"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f49c12ba8b21d128a2ce8585955246977fbce4415f680ebf9199b6f9d6d725f"
+dependencies = [
+ "async-trait",
+]
+
+[[package]]
+name = "group"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dfbfb3a6cfbd390d5c9564ab283a0349b9b9fcd46a706c1eb10e0db70bfbac7"
+dependencies = [
+ "ff",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
+[[package]]
+name = "h2"
+version = "0.3.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
+dependencies = [
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http 0.2.12",
+ "indexmap 2.7.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "h2"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccae279728d634d083c00f6099cb58f01cc99c145b84b8be2f6c74618d79922e"
+dependencies = [
+ "atomic-waker",
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "http 1.2.0",
+ "indexmap 2.7.0",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
+[[package]]
+name = "handlebars"
+version = "4.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faa67bab9ff362228eb3d00bd024a4965d8231bbb7921167f0cfa66c6626b225"
+dependencies = [
+ "log",
+ "pest",
+ "pest_derive",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
+
+[[package]]
+name = "hashbrown"
+version = "0.15.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf151400ff0baff5465007dd2f3e717f3fe502074ca563069ce3a6629d07b289"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
+
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
+
+[[package]]
+name = "hermit-abi"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fbf6a919d6cf397374f7dfeeea91d974c7c0a7221d0d0f4f20d859d329e53fcc"
+
+[[package]]
+name = "hex"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
+[[package]]
+name = "home"
+version = "0.5.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589533453244b0995c858700322199b2becb13b627df2851f64a2775d024abcf"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "hostname"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c731c3e10504cc8ed35cfe2f1db4c9274c3d35fa486e3b31df46f068ef3e867"
+dependencies = [
+ "libc",
+ "match_cfg",
+ "winapi",
+]
+
+[[package]]
+name = "hstr"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63d6824358c0fd9a68bb23999ed2ef76c84f79408a26ef7ae53d5f370c94ad36"
+dependencies = [
+ "hashbrown 0.14.5",
+ "new_debug_unreachable",
+ "once_cell",
+ "phf 0.11.3",
+ "rustc-hash",
+ "triomphe",
+]
+
+[[package]]
+name = "http"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f16ca2af56261c99fba8bac40a10251ce8188205a4c448fbb745a2e4daa76fea"
+dependencies = [
+ "bytes",
+ "fnv",
+ "itoa",
+]
+
+[[package]]
+name = "http-body"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
+dependencies = [
+ "bytes",
+ "http 0.2.12",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-body"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
+dependencies = [
+ "bytes",
+ "http 1.2.0",
+]
+
+[[package]]
+name = "http-body-util"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
+dependencies = [
+ "bytes",
+ "futures-util",
+ "http 1.2.0",
+ "http-body 1.0.1",
+ "pin-project-lite",
+]
+
+[[package]]
+name = "http-range-header"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9171a2ea8a68358193d15dd5d70c1c10a2afc3e7e4c5bc92bc9f025cebd7359c"
+
+[[package]]
+name = "httparse"
+version = "1.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d71d3574edd2771538b901e6549113b4006ece66150fb69c0fb6d9a2adae946"
+
+[[package]]
+name = "httpdate"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
+
+[[package]]
+name = "humantime"
+version = "2.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
+
+[[package]]
+name = "hyper"
+version = "0.14.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2 0.3.26",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+ "want",
+]
+
+[[package]]
+name = "hyper"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "256fb8d4bd6413123cc9d91832d78325c48ff41677595be797d90f42969beae0"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "h2 0.4.7",
+ "http 1.2.0",
+ "http-body 1.0.1",
+ "httparse",
+ "httpdate",
+ "itoa",
+ "pin-project-lite",
+ "smallvec",
+ "tokio",
+ "want",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.24.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
+dependencies = [
+ "futures-util",
+ "http 0.2.12",
+ "hyper 0.14.32",
+ "log",
+ "rustls 0.21.12",
+ "rustls-native-certs 0.6.3",
+ "tokio",
+ "tokio-rustls 0.24.1",
+]
+
+[[package]]
+name = "hyper-rustls"
+version = "0.27.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d191583f3da1305256f22463b9bb0471acad48a4e534a5218b9963e9c1f59b2"
+dependencies = [
+ "futures-util",
+ "http 1.2.0",
+ "hyper 1.5.2",
+ "hyper-util",
+ "rustls 0.23.20",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls 0.26.1",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-timeout"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbb958482e8c7be4bc3cf272a766a2b0bf1a6755e7a6ae777f017a31d11b13b1"
+dependencies = [
+ "hyper 0.14.32",
+ "pin-project-lite",
+ "tokio",
+ "tokio-io-timeout",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
+dependencies = [
+ "bytes",
+ "hyper 0.14.32",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+]
+
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper 1.5.2",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
+[[package]]
+name = "hyper-util"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df2dcfbe0677734ab2f3ffa7fa7bfd4706bfdc1ef393f2ee30184aed67e631b4"
+dependencies = [
+ "bytes",
+ "futures-channel",
+ "futures-util",
+ "http 1.2.0",
+ "http-body 1.0.1",
+ "hyper 1.5.2",
+ "pin-project-lite",
+ "socket2",
+ "tokio",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "iana-time-zone"
+version = "0.1.61"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "icu_collections"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db2fa452206ebee18c4b5c2274dbf1de17008e874b4dc4f0aea9d01ca79e4526"
+dependencies = [
+ "displaydoc",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13acbb8371917fc971be86fc8057c41a64b521c184808a698c02acc242dbf637"
+dependencies = [
+ "displaydoc",
+ "litemap",
+ "tinystr",
+ "writeable",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01d11ac35de8e40fdeda00d9e1e9d92525f3f9d887cdd7aa81d727596788b54e"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_locid_transform_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_locid_transform_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdc8ff3388f852bede6b579ad4e978ab004f139284d7b28715f773507b946f6e"
+
+[[package]]
+name = "icu_normalizer"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19ce3e0da2ec68599d193c93d088142efd7f9c5d6fc9b803774855747dc6a84f"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_normalizer_data",
+ "icu_properties",
+ "icu_provider",
+ "smallvec",
+ "utf16_iter",
+ "utf8_iter",
+ "write16",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_normalizer_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8cafbf7aa791e9b22bec55a167906f9e1215fd475cd22adfcf660e03e989516"
+
+[[package]]
+name = "icu_properties"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93d6020766cfc6302c15dbbc9c8778c37e62c14427cb7f6e601d849e092aeef5"
+dependencies = [
+ "displaydoc",
+ "icu_collections",
+ "icu_locid_transform",
+ "icu_properties_data",
+ "icu_provider",
+ "tinystr",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_properties_data"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67a8effbc3dd3e4ba1afa8ad918d5684b8868b3b26500753effea8d2eed19569"
+
+[[package]]
+name = "icu_provider"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ed421c8a8ef78d3e2dbc98a973be2f3770cb42b606e3ab18d6237c4dfde68d9"
+dependencies = [
+ "displaydoc",
+ "icu_locid",
+ "icu_provider_macros",
+ "stable_deref_trait",
+ "tinystr",
+ "writeable",
+ "yoke",
+ "zerofrom",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_provider_macros"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ec89e9337638ecdc08744df490b221a7399bf8d164eb52a665454e60e075ad6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "idna"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "686f825264d630750a544639377bae737628043f20d38bbc029e8f29ea968a7e"
+dependencies = [
+ "idna_adapter",
+ "smallvec",
+ "utf8_iter",
+]
+
+[[package]]
+name = "idna_adapter"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daca1df1c957320b2cf139ac61e7bd64fed304c5040df000a745aa1de3b4ef71"
+dependencies = [
+ "icu_normalizer",
+ "icu_properties",
+]
+
+[[package]]
+name = "ignore"
+version = "0.4.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d89fd380afde86567dfba715db065673989d6253f42b88179abd3eae47bda4b"
+dependencies = [
+ "crossbeam-deque",
+ "globset",
+ "log",
+ "memchr",
+ "regex-automata 0.4.9",
+ "same-file",
+ "walkdir",
+ "winapi-util",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+ "serde",
+]
+
+[[package]]
+name = "indexmap"
+version = "2.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62f822373a4fe84d4bb149bf54e584a7f4abec90e072ed49cda0edea5b95471f"
+dependencies = [
+ "equivalent",
+ "hashbrown 0.15.2",
+ "serde",
+]
+
+[[package]]
+name = "insta"
+version = "1.42.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6513e4067e16e69ed1db5ab56048ed65db32d10ba5fc1217f5393f8f17d8b5a5"
+dependencies = [
+ "console",
+ "globset",
+ "linked-hash-map",
+ "once_cell",
+ "serde",
+ "similar",
+ "walkdir",
+]
+
+[[package]]
+name = "instant"
+version = "0.1.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e0242819d153cba4b4b05a5a8f2a7e9bbf97b6055b2a002b395c96b5ff3c0222"
+dependencies = [
+ "cfg-if",
+]
+
+[[package]]
+name = "ipnet"
+version = "2.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ddc24109865250148c2e0f3d25d4f0f479571723792d3802153c60922a4fb708"
+
+[[package]]
+name = "is-macro"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d57a3e447e24c22647738e4607f1df1e0ec6f72e16182c4cd199f647cdfb0e4"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "is-terminal"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "261f68e344040fbd0edea105bef17c66edf46f984ddb1115b775ce31be948f4b"
+dependencies = [
+ "hermit-abi 0.4.0",
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+
+[[package]]
+name = "itertools"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itertools"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itertools"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "413ee7dfc52ee1a4949ceeb7dbc8a33f2d6c088194d9f922fb8318faf1f01186"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itertools"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d75a2a4b1b190afb6f5425f10f6a8f959d2ea0b9c2b1d79553551850539e4674"
+
+[[package]]
+name = "jobserver"
+version = "0.1.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48d1dbcbbeb6a7fec7e059840aa538bd62aaccf972c7346c4d9d2059312853d0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "js-sys"
+version = "0.3.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6717b6b5b077764fb5966237269cb3c64edddde4b14ce42647430a78ced9e7b7"
+dependencies = [
+ "once_cell",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "jsonwebtoken"
+version = "9.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9ae10193d25051e74945f1ea2d0b42e03cc3b890f7e4cc5faa44997d808193f"
+dependencies = [
+ "base64 0.21.7",
+ "js-sys",
+ "pem",
+ "ring 0.17.8",
+ "serde",
+ "serde_json",
+ "simple_asn1",
+]
+
+[[package]]
+name = "junction"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72bbdfd737a243da3dfc1f99ee8d6e166480f17ab4ac84d7c34aacd73fc7bd16"
+dependencies = [
+ "scopeguard",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "keccak"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecc2af9a1119c51f12a14607e783cb977bde58bc069ff0c3da1095e635d70654"
+dependencies = [
+ "cpufeatures",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin 0.9.8",
+]
+
+[[package]]
+name = "lazycell"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
+
+[[package]]
+name = "libc"
+version = "0.2.169"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+
+[[package]]
+name = "libloading"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc2f4eb4bc735547cfed7c0a4922cbd04a4655978c09b54f1f7b228750664c34"
+dependencies = [
+ "cfg-if",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "libm"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8355be11b20d696c8f18f6cc018c4e372165b1fa8126cef092399c9951984ffa"
+
+[[package]]
+name = "libz-ng-sys"
+version = "1.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cee1488e961a80d172564fd6fcda11d8a4ac6672c06fe008e9213fa60520c2b"
+dependencies = [
+ "cmake",
+ "libc",
+]
+
+[[package]]
+name = "linked-hash-map"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0717cef1bc8b636c6e1c1bbdefc09e6322da8a9321966e8928ef80d20f7f770f"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+
+[[package]]
+name = "litemap"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ee93343901ab17bd981295f2cf0026d4ad018c7c31ba84549a4ddbb47a45104"
+
+[[package]]
+name = "litparser"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "clean-path",
+ "duration-string",
+ "num-bigint",
+ "num-integer",
+ "num-traits",
+ "swc_common",
+ "swc_ecma_ast",
+]
+
+[[package]]
+name = "litparser-derive"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "litparser",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_ecma_parser",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "log"
+version = "0.4.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+dependencies = [
+ "serde",
+ "value-bag",
+]
+
+[[package]]
+name = "lru"
+version = "0.12.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
+dependencies = [
+ "hashbrown 0.15.2",
+]
+
+[[package]]
+name = "malachite"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec410515e231332b14cd986a475d1c3323bcfa4c7efc038bfa1d5b410b1c57e4"
+dependencies = [
+ "malachite-base",
+ "malachite-nz",
+ "malachite-q",
+]
+
+[[package]]
+name = "malachite-base"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c738d3789301e957a8f7519318fcbb1b92bb95863b28f6938ae5a05be6259f34"
+dependencies = [
+ "hashbrown 0.15.2",
+ "itertools 0.14.0",
+ "libm",
+ "ryu",
+]
+
+[[package]]
+name = "malachite-nz"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1707c9a1fa36ce21749b35972bfad17bbf34cf5a7c96897c0491da321e387d3b"
+dependencies = [
+ "itertools 0.14.0",
+ "libm",
+ "malachite-base",
+ "wide",
+]
+
+[[package]]
+name = "malachite-q"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d764801aa4e96bbb69b389dcd03b50075345131cd63ca2e380bca71cc37a3675"
+dependencies = [
+ "itertools 0.14.0",
+ "malachite-base",
+ "malachite-nz",
+]
+
+[[package]]
+name = "mappable-rc"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "204651f31b0a6a7b2128d2b92c372cd94607b210c3a6b6e542c57a8cfd4db996"
+
+[[package]]
+name = "match_cfg"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ffbee8634e0d45d258acb448e7eaab3fce7a0a467395d4d9f228e3c1f01fb2e4"
+
+[[package]]
+name = "matchers"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8263075bb86c5a1b1427b5ae862e8889656f126e9f77c484496e8b47cf5c5558"
+dependencies = [
+ "regex-automata 0.1.10",
+]
+
+[[package]]
+name = "matches"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2532096657941c2fea9c289d370a250971c689d4f143798ff67113ec042024a5"
+
+[[package]]
+name = "matchit"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+
+[[package]]
+name = "md-5"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+dependencies = [
+ "cfg-if",
+ "digest",
+]
+
+[[package]]
+name = "md5"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "490cc448043f947bae3cbee9c203358d62dbee0db12107a74be5c30ccfd09771"
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "memoffset"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5aa361d4faea93603064a027415f07bd8e1d5c88c9fbf68bf56a285428fd79ce"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
+name = "mime_guess"
+version = "2.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c44f8e672c00fe5308fa235f821cb4198414e1c77935c1ab6948d3fd78550e"
+dependencies = [
+ "mime",
+ "unicase",
+]
+
+[[package]]
+name = "minimal-lexical"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
+
+[[package]]
+name = "miniz_oxide"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ffbe83022cedc1d264172192511ae958937694cd57ce297164951b8b3568394"
+dependencies = [
+ "adler2",
+]
+
+[[package]]
+name = "mio"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
+dependencies = [
+ "libc",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "multimap"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "defc4c55412d89136f966bbb339008b474350e5e6e78d2714439c386b3137a03"
+
+[[package]]
+name = "napi"
+version = "2.16.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "214f07a80874bb96a8433b3cdfc84980d56c7b02e1a0d7ba4ba0db5cef785e2b"
+dependencies = [
+ "anyhow",
+ "bitflags 2.9.4",
+ "ctor",
+ "napi-derive",
+ "napi-sys",
+ "once_cell",
+ "serde",
+ "serde_json",
+ "tokio",
+]
+
+[[package]]
+name = "napi-build"
+version = "2.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db836caddef23662b94e16bf1f26c40eceb09d6aee5d5b06a7ac199320b69b19"
+
+[[package]]
+name = "napi-derive"
+version = "2.16.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cbe2585d8ac223f7d34f13701434b9d5f4eb9c332cccce8dee57ea18ab8ab0c"
+dependencies = [
+ "cfg-if",
+ "convert_case",
+ "napi-derive-backend",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "napi-derive-backend"
+version = "1.0.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1639aaa9eeb76e91c6ae66da8ce3e89e921cd3885e99ec85f4abacae72fc91bf"
+dependencies = [
+ "convert_case",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "regex",
+ "semver",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "napi-sys"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "427802e8ec3a734331fec1035594a210ce1ff4dc5bc1950530920ab717964ea3"
+dependencies = [
+ "libloading",
+]
+
+[[package]]
+name = "native-tls"
+version = "0.2.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8614eb2c83d59d1c8cc974dd3f920198647674a0a035e1af1fa58707e317466"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
+[[package]]
+name = "nix"
+version = "0.24.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa52e972a9a719cecb6864fb88568781eb706bac2cd1d4f04a648542dbf78069"
+dependencies = [
+ "bitflags 1.3.2",
+ "cfg-if",
+ "libc",
+ "memoffset",
+]
+
+[[package]]
+name = "nom"
+version = "7.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d273983c5a657a70a3e8f2a01329822f3b8c8172b73826411a55751e404a0a4a"
+dependencies = [
+ "memchr",
+ "minimal-lexical",
+]
+
+[[package]]
+name = "normalize-line-endings"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61807f77802ff30975e01f4f071c8ba10c022052f98b3294119f3e615d13e5be"
+
+[[package]]
+name = "normpath"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a9da8c9922c35a1033d76f7272dfc2e7ee20392083d75aeea6ced23c6266578"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "nu-ansi-term"
+version = "0.46.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77a8165726e8236064dbb45459242600304b42a5ea24ee2948e18e023bf7ba84"
+dependencies = [
+ "overload",
+ "winapi",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5e44f723f1133c9deac646763579fdb3ac745e418f2a7af9cd0c431da1f20b9"
+dependencies = [
+ "num-integer",
+ "num-traits",
+ "serde",
+]
+
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc84195820f291c7697304f3cbdadd1cb7199c0efc917ff5eafd71225c136151"
+dependencies = [
+ "byteorder",
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.5",
+ "smallvec",
+ "zeroize",
+]
+
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
+[[package]]
+name = "num-integer"
+version = "0.1.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7969661fd2958a5cb096e56c8e1ad0444ac2bbcd0061bd28660485a44879858f"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "num-iter"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1429034a0490724d0075ebb2bc9e875d6503c3cf69e235a8941aa757d83ef5bf"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
+dependencies = [
+ "autocfg",
+ "libm",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
+dependencies = [
+ "hermit-abi 0.3.9",
+ "libc",
+]
+
+[[package]]
+name = "object"
+version = "0.36.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
+
+[[package]]
+name = "openssl"
+version = "0.10.68"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6174bc48f102d208783c2c84bf931bb75927a617866870de8a4ea85597f871f5"
+dependencies = [
+ "bitflags 2.9.4",
+ "cfg-if",
+ "foreign-types",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "openssl-probe"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
+
+[[package]]
+name = "openssl-src"
+version = "300.4.1+3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faa4eac4138c62414b5622d1b31c5c304f34b406b013c079c2bbc652fdd6678c"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.104"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "45abf306cbf99debc8195b66b7346498d7b10c210de50418b5ccd7ceba08c741"
+dependencies = [
+ "cc",
+ "libc",
+ "openssl-src",
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "os_pipe"
+version = "1.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ffd2b0a5634335b135d5728d84c5e0fd726954b87111f7506a61c502280d982"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "os_str_bytes"
+version = "6.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2355d85b9a3786f481747ced0e0ff2ba35213a1f9bd406ed906554d7af805a1"
+
+[[package]]
+name = "outref"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4030760ffd992bef45b0ae3f10ce1aba99e33464c90d14dd7c039884963ddc7a"
+
+[[package]]
+name = "overload"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15813163c1d831bf4a13c3610c05c0d03b39feb07f7e09fa234dac9b15aaf39"
+
+[[package]]
+name = "p256"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51f44edd08f51e2ade572f141051021c5af22677e42b7dd28a88155151c33594"
+dependencies = [
+ "ecdsa",
+ "elliptic-curve",
+ "sha2",
+]
+
+[[package]]
+name = "parking_lot"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
+[[package]]
+name = "path-clean"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecba01bf2678719532c5e3059e0b5f0811273d94b397088b82e3bd0a78c78fdd"
+
+[[package]]
+name = "pathdiff"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df94ce210e5bc13cb6651479fa48d14f601d9858cfe0467f43ae157023b938d3"
+
+[[package]]
+name = "peeking_take_while"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19b17cddbe7ec3f8bc800887bab5e717348c95ea2ca0b1bf0837fb964dc67099"
+
+[[package]]
+name = "pem"
+version = "3.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e459365e590736a54c3fa561947c84837534b8e9af6fc5bf781307e82658fae"
+dependencies = [
+ "base64 0.22.1",
+ "serde",
+]
+
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3148f5046208a5d56bcfc03053e3ca6334e51da8dfb19b6cdc8b306fae3283e"
+
+[[package]]
+name = "pest"
+version = "2.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b7cafe60d6cf8e62e1b9b2ea516a089c008945bb5a275416789e7db0bc199dc"
+dependencies = [
+ "memchr",
+ "thiserror 2.0.10",
+ "ucd-trie",
+]
+
+[[package]]
+name = "pest_derive"
+version = "2.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "816518421cfc6887a0d62bf441b6ffb4536fcc926395a69e1a85852d4363f57e"
+dependencies = [
+ "pest",
+ "pest_generator",
+]
+
+[[package]]
+name = "pest_generator"
+version = "2.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d1396fd3a870fc7838768d171b4616d5c91f6cc25e377b673d714567d99377b"
+dependencies = [
+ "pest",
+ "pest_meta",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "pest_meta"
+version = "2.7.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1e58089ea25d717bfd31fb534e4f3afcc2cc569c70de3e239778991ea3b7dea"
+dependencies = [
+ "once_cell",
+ "pest",
+ "sha2",
+]
+
+[[package]]
+name = "petgraph"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
+dependencies = [
+ "fixedbitset",
+ "indexmap 2.7.0",
+]
+
+[[package]]
+name = "pg_query"
+version = "6.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ca6fdb8f9d32182abf17328789f87f305dd8c8ce5bf48c5aa2b5cffc94e1c04"
+dependencies = [
+ "bindgen",
+ "cc",
+ "fs_extra",
+ "glob",
+ "itertools 0.10.5",
+ "prost 0.13.5",
+ "prost-build 0.13.5",
+ "serde",
+ "serde_json",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "pgvector"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fc58e2d255979a31caa7cabfa7aac654af0354220719ab7a68520ae7a91e8c0b"
+dependencies = [
+ "bytes",
+ "postgres-types",
+ "serde",
+]
+
+[[package]]
+name = "phf"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
+dependencies = [
+ "phf_macros 0.10.0",
+ "phf_shared 0.10.0",
+ "proc-macro-hack",
+]
+
+[[package]]
+name = "phf"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fd6780a80ae0c52cc120a26a1a42c1ae51b247a253e4e06113d23d2c2edd078"
+dependencies = [
+ "phf_macros 0.11.3",
+ "phf_shared 0.11.3",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
+dependencies = [
+ "phf_shared 0.10.0",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c80231409c20246a13fddb31776fb942c38553c51e871f8cbd687a4cfb5843d"
+dependencies = [
+ "phf_shared 0.11.3",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58fdf3184dd560f160dd73922bea2d5cd6e8f064bf4b13110abd81b03697b4e0"
+dependencies = [
+ "phf_generator 0.10.0",
+ "phf_shared 0.10.0",
+ "proc-macro-hack",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f84ac04429c13a7ff43785d75ad27569f2951ce0ffd30a3321230db2fc727216"
+dependencies = [
+ "phf_generator 0.11.3",
+ "phf_shared 0.11.3",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
+dependencies = [
+ "siphasher 0.3.11",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
+dependencies = [
+ "siphasher 1.0.1",
+]
+
+[[package]]
+name = "pin-project"
+version = "1.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e2ec53ad785f4d35dac0adea7f7dc6f1bb277ad84a680c7afefeae05d1f5916"
+dependencies = [
+ "pin-project-internal",
+]
+
+[[package]]
+name = "pin-project-internal"
+version = "1.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d56a66c0c55993aa927429d0f8a0abfd74f084e4d9c192cffed01e418d83eefb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b3cff922bd51709b605d9ead9aa71031d81447142d828eb4a6eba76fe619f9b"
+
+[[package]]
+name = "pin-utils"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
+
+[[package]]
+name = "pingora"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79c9fc7098dc3e7d09d2d1647921005be9301cf68536826195dc5369e05124bd"
+dependencies = [
+ "pingora-cache",
+ "pingora-core",
+ "pingora-http",
+ "pingora-load-balancing",
+ "pingora-proxy",
+ "pingora-timeout",
+]
+
+[[package]]
+name = "pingora-cache"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35ee62f28526d8d484621e77f8d6a1807f1bd07558a06ab5a204b4834d6be056"
+dependencies = [
+ "ahash",
+ "async-trait",
+ "blake2",
+ "bytes",
+ "hex",
+ "http 1.2.0",
+ "httparse",
+ "httpdate",
+ "indexmap 1.9.3",
+ "log",
+ "lru",
+ "once_cell",
+ "parking_lot",
+ "pingora-core",
+ "pingora-error",
+ "pingora-header-serde",
+ "pingora-http",
+ "pingora-lru",
+ "pingora-timeout",
+ "regex",
+ "rmp",
+ "rmp-serde",
+ "rustracing",
+ "rustracing_jaeger",
+ "serde",
+ "strum",
+ "tokio",
+]
+
+[[package]]
+name = "pingora-core"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d123320b69bd06e897fc16bd1dde962a7b488c4d2ae825683fbca0198fad8669"
+dependencies = [
+ "ahash",
+ "async-trait",
+ "brotli",
+ "bytes",
+ "chrono",
+ "clap",
+ "daemonize",
+ "flate2",
+ "futures",
+ "h2 0.4.7",
+ "http 1.2.0",
+ "httparse",
+ "httpdate",
+ "libc",
+ "log",
+ "lru",
+ "nix",
+ "once_cell",
+ "openssl-probe",
+ "parking_lot",
+ "percent-encoding",
+ "pingora-error",
+ "pingora-http",
+ "pingora-openssl",
+ "pingora-pool",
+ "pingora-runtime",
+ "pingora-timeout",
+ "prometheus",
+ "rand 0.8.5",
+ "regex",
+ "serde",
+ "serde_yaml 0.8.26",
+ "sfv",
+ "socket2",
+ "strum",
+ "strum_macros",
+ "thread_local",
+ "tokio",
+ "tokio-test",
+ "unicase",
+ "windows-sys 0.59.0",
+ "zstd",
+]
+
+[[package]]
+name = "pingora-error"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6389511530152c535a554f592ae4a9691b1246cff20eb4564f2a34fc921195c0"
+
+[[package]]
+name = "pingora-header-serde"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bcb3f62d852da015e76ced56e93e6d52941679a9825281c90f2897841129e59d"
+dependencies = [
+ "bytes",
+ "http 1.2.0",
+ "httparse",
+ "pingora-error",
+ "pingora-http",
+ "thread_local",
+ "zstd",
+ "zstd-safe",
+]
+
+[[package]]
+name = "pingora-http"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70202f126056f366549afc804741e12dd9f419cfc79a0063ab15653007a0f4c6"
+dependencies = [
+ "bytes",
+ "http 1.2.0",
+ "pingora-error",
+]
+
+[[package]]
+name = "pingora-ketama"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c1bb6c2e11823a05ec9140fc8827f112b8380d78b837535f284e0a98f24cc0a"
+dependencies = [
+ "crc32fast",
+]
+
+[[package]]
+name = "pingora-load-balancing"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "84d558167ecb05cea487a6479700390a67fe414724f203e10c3912584a0f2cb1"
+dependencies = [
+ "arc-swap",
+ "async-trait",
+ "derivative",
+ "fnv",
+ "futures",
+ "http 1.2.0",
+ "log",
+ "pingora-core",
+ "pingora-error",
+ "pingora-http",
+ "pingora-ketama",
+ "pingora-runtime",
+ "rand 0.9.1",
+ "tokio",
+]
+
+[[package]]
+name = "pingora-lru"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb50f65f06c4b81ccb3edcceaa54bb9439608506b0b3b8c048798169a64aad8e"
+dependencies = [
+ "arrayvec",
+ "hashbrown 0.15.2",
+ "parking_lot",
+ "rand 0.9.1",
+]
+
+[[package]]
+name = "pingora-openssl"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f18158b901a02289f2a2a954a531c96e4d0703c94f7c9291981c9e53fddc6c1"
+dependencies = [
+ "foreign-types",
+ "libc",
+ "openssl",
+ "openssl-src",
+ "openssl-sys",
+ "tokio-openssl",
+]
+
+[[package]]
+name = "pingora-pool"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bacdd5dbdec690d468856d988b170c8bb4ab62e0edefc0f432ba5e326489f421"
+dependencies = [
+ "crossbeam-queue",
+ "log",
+ "lru",
+ "parking_lot",
+ "pingora-timeout",
+ "thread_local",
+ "tokio",
+]
+
+[[package]]
+name = "pingora-proxy"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5031783d6743bd31e4de7d7c7a19e9eecf369174c3cbd8a57eb52bc6bf882d92"
+dependencies = [
+ "async-trait",
+ "bytes",
+ "clap",
+ "futures",
+ "h2 0.4.7",
+ "http 1.2.0",
+ "log",
+ "once_cell",
+ "pingora-cache",
+ "pingora-core",
+ "pingora-error",
+ "pingora-http",
+ "pingora-timeout",
+ "regex",
+ "tokio",
+]
+
+[[package]]
+name = "pingora-runtime"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "31a7c445ca224630961045684201e3cf8da9af0b01f286ed54ff8b2403aaabff"
+dependencies = [
+ "once_cell",
+ "rand 0.8.5",
+ "thread_local",
+ "tokio",
+]
+
+[[package]]
+name = "pingora-timeout"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "685bb8808cc1919c63a06ab14fdac9b84a4887ced49259a5c0adc8bfb2ffe558"
+dependencies = [
+ "once_cell",
+ "parking_lot",
+ "pin-project-lite",
+ "thread_local",
+ "tokio",
+]
+
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der 0.7.9",
+ "pkcs8 0.10.2",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9eca2c590a5f85da82668fa685c09ce2888b9430e83299debf1f34b65fd4a4ba"
+dependencies = [
+ "der 0.6.1",
+ "spki 0.6.0",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der 0.7.9",
+ "spki 0.7.3",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
+
+[[package]]
+name = "pmutil"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52a40bc70c2c58040d2d8b167ba9a5ff59fc9dab7ad44771cfde3dcfde7a09c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "postgres-native-tls"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d442770e2b1e244bb5eb03b31c79b65bb2568f413b899eaba850fa945a65954"
+dependencies = [
+ "futures",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tokio-postgres",
+]
+
+[[package]]
+name = "postgres-protocol"
+version = "0.6.8"
+source = "git+https://github.com/encoredev/rust-postgres?branch=encore-patches-sync#e71577eea1d14769a3021b6dd214448e3de3ffb6"
+dependencies = [
+ "base64 0.22.1",
+ "byteorder",
+ "bytes",
+ "fallible-iterator",
+ "hmac",
+ "log",
+ "md-5",
+ "memchr",
+ "rand 0.9.1",
+ "sha2",
+ "stringprep",
+]
+
+[[package]]
+name = "postgres-types"
+version = "0.2.9"
+source = "git+https://github.com/encoredev/rust-postgres?branch=encore-patches-sync#e71577eea1d14769a3021b6dd214448e3de3ffb6"
+dependencies = [
+ "array-init",
+ "bytes",
+ "chrono",
+ "cidr",
+ "fallible-iterator",
+ "geo-types",
+ "postgres-protocol",
+ "serde",
+ "serde_json",
+ "uuid",
+]
+
+[[package]]
+name = "powerfmt"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
+dependencies = [
+ "zerocopy",
+]
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "predicates"
+version = "2.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59230a63c37f3e18569bdb90e4a89cbf5bf8b06fea0b84e65ea10cc4df47addd"
+dependencies = [
+ "difflib",
+ "float-cmp",
+ "itertools 0.10.5",
+ "normalize-line-endings",
+ "predicates-core",
+ "regex",
+]
+
+[[package]]
+name = "predicates"
+version = "3.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a5d19ee57562043d37e82899fade9a22ebab7be9cef5026b07fda9cdd4293573"
+dependencies = [
+ "anstyle",
+ "difflib",
+ "predicates-core",
+]
+
+[[package]]
+name = "predicates-core"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "727e462b119fe9c93fd0eb1429a5f7647394014cf3c04ab2c0350eeb09095ffa"
+
+[[package]]
+name = "predicates-tree"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72dd2d6d381dfb73a193c7fca536518d7caee39fc8503f74e7dc0be0531b425c"
+dependencies = [
+ "predicates-core",
+ "termtree",
+]
+
+[[package]]
+name = "prettyplease"
+version = "0.2.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "483f8c21f64f3ea09fe0f30f5d48c3e8eefe5dac9129f0075f76593b4c1da705"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-hack"
+version = "0.5.20+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.92"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "prometheus"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d33c28a30771f7f96db69893f78b857f7450d7e0237e9c8fc6427a81bae7ed1"
+dependencies = [
+ "cfg-if",
+ "fnv",
+ "lazy_static",
+ "memchr",
+ "parking_lot",
+ "protobuf",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "proptest"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fcdab19deb5195a31cf7726a210015ff1496ba1464fd42cb4f537b8b01b471f"
+dependencies = [
+ "bit-set",
+ "bit-vec",
+ "bitflags 2.9.4",
+ "lazy_static",
+ "num-traits",
+ "rand 0.9.1",
+ "rand_chacha 0.9.0",
+ "rand_xorshift",
+ "regex-syntax 0.8.5",
+ "rusty-fork",
+ "tempfile",
+ "unarray",
+]
+
+[[package]]
+name = "prost"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "deb1435c188b76130da55f17a466d252ff7b1418b2ad3e037d127b94e3411f29"
+dependencies = [
+ "bytes",
+ "prost-derive 0.12.6",
+]
+
+[[package]]
+name = "prost"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2796faa41db3ec313a31f7624d9286acf277b52de526150b7e69f3debf891ee5"
+dependencies = [
+ "bytes",
+ "prost-derive 0.13.5",
+]
+
+[[package]]
+name = "prost-build"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22505a5c94da8e3b7c2996394d1c933236c4d743e81a410bcca4e6989fc066a4"
+dependencies = [
+ "bytes",
+ "heck 0.5.0",
+ "itertools 0.12.1",
+ "log",
+ "multimap",
+ "once_cell",
+ "petgraph",
+ "prettyplease",
+ "prost 0.12.6",
+ "prost-types 0.12.6",
+ "regex",
+ "syn 2.0.95",
+ "tempfile",
+]
+
+[[package]]
+name = "prost-build"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
+dependencies = [
+ "heck 0.5.0",
+ "itertools 0.14.0",
+ "log",
+ "multimap",
+ "once_cell",
+ "petgraph",
+ "prettyplease",
+ "prost 0.13.5",
+ "prost-types 0.13.5",
+ "regex",
+ "syn 2.0.95",
+ "tempfile",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "81bddcdb20abf9501610992b6759a4c888aef7d1a7247ef75e2404275ac24af1"
+dependencies = [
+ "anyhow",
+ "itertools 0.12.1",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "prost-derive"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
+dependencies = [
+ "anyhow",
+ "itertools 0.14.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.12.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9091c90b0a32608e984ff2fa4091273cbdd755d54935c51d520887f4a1dbd5b0"
+dependencies = [
+ "prost 0.12.6",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.13.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52c2c1bf36ddb1a1c396b3601a3cec27c2462e45f07c386894ec3ccf5332bd16"
+dependencies = [
+ "prost 0.13.5",
+]
+
+[[package]]
+name = "protobuf"
+version = "2.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "106dd99e98437432fed6519dedecfade6a06a73bb7b2a1e019fdd2bee5778d94"
+
+[[package]]
+name = "quick-error"
+version = "1.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0"
+
+[[package]]
+name = "quickcheck"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "588f6378e4dd99458b60ec275b4477add41ce4fa9f64dcba6f15adccb19b50d6"
+dependencies = [
+ "env_logger 0.8.4",
+ "log",
+ "rand 0.8.5",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.38"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "5.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
+
+[[package]]
+name = "radix_fmt"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce082a9940a7ace2ad4a8b7d0b1eac6aa378895f18be598230c5f2284ac05426"
+
+[[package]]
+name = "rand"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "552840b97013b1a26992c11eac34bdd778e464601a4c2054b5f0bff7c6761293"
+dependencies = [
+ "fuchsia-cprng",
+ "libc",
+ "rand_core 0.3.1",
+ "rdrand",
+ "winapi",
+]
+
+[[package]]
+name = "rand"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+dependencies = [
+ "getrandom 0.1.16",
+ "libc",
+ "rand_chacha 0.2.2",
+ "rand_core 0.5.1",
+ "rand_hc",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.3",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.3",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a6fdeb83b075e8266dcc8762c22776f6877a63111121f5f8c7411e5be7eed4b"
+dependencies = [
+ "rand_core 0.4.2",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c33a3c44ca05fa6f1807d8e6743f3824e8509beca625669633be0acbdf509dc"
+
+[[package]]
+name = "rand_core"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+dependencies = [
+ "getrandom 0.1.16",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.15",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
+dependencies = [
+ "getrandom 0.3.3",
+]
+
+[[package]]
+name = "rand_hc"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+dependencies = [
+ "rand_core 0.5.1",
+]
+
+[[package]]
+name = "rand_xorshift"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a"
+dependencies = [
+ "rand_core 0.9.3",
+]
+
+[[package]]
+name = "rdrand"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "678054eb77286b51581ba43620cc911abf02758c91f93f479767aed0f90458b2"
+dependencies = [
+ "rand_core 0.3.1",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03a862b389f93e68874fbf580b9de08dd02facb9a788ebadaf4a3fd33cf58834"
+dependencies = [
+ "bitflags 2.9.4",
+]
+
+[[package]]
+name = "regex"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata 0.4.9",
+ "regex-syntax 0.8.5",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+dependencies = [
+ "regex-syntax 0.6.29",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax 0.8.5",
+]
+
+[[package]]
+name = "regex-lite"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53a49587ad06b26609c52e423de037e7f57f20d53535d66e08c695f347df952a"
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.29"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f162c6dd7b008981e4d40210aca20b4bd0f9b60ca9271061b07f78537722f2e1"
+
+[[package]]
+name = "regex-syntax"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+
+[[package]]
+name = "remove_dir_all"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3acd125665422973a33ac9d3dd2df85edad0f4ae9b00dafb1a05e43a9f5ef8e7"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.11.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62"
+dependencies = [
+ "base64 0.21.7",
+ "bytes",
+ "encoding_rs",
+ "futures-core",
+ "futures-util",
+ "h2 0.3.26",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "hyper 0.14.32",
+ "hyper-tls 0.5.0",
+ "ipnet",
+ "js-sys",
+ "log",
+ "mime",
+ "native-tls",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls-pemfile 1.0.4",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper 0.1.2",
+ "system-configuration 0.5.1",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+ "winreg 0.50.0",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.12.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43e734407157c3c2034e0258f5e4473ddb361b1e85f95a66690d67264d7cd1da"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "encoding_rs",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "h2 0.4.7",
+ "http 1.2.0",
+ "http-body 1.0.1",
+ "http-body-util",
+ "hyper 1.5.2",
+ "hyper-rustls 0.27.5",
+ "hyper-tls 0.6.0",
+ "hyper-util",
+ "ipnet",
+ "js-sys",
+ "log",
+ "mime",
+ "mime_guess",
+ "native-tls",
+ "once_cell",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls-pemfile 2.2.0",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper 1.0.2",
+ "system-configuration 0.6.1",
+ "tokio",
+ "tokio-native-tls",
+ "tokio-util",
+ "tower 0.5.2",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams",
+ "web-sys",
+ "windows-registry",
+]
+
+[[package]]
+name = "reqwest-middleware"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "562ceb5a604d3f7c885a792d42c199fd8af239d0a51b2fa6a78aafa092452b04"
+dependencies = [
+ "anyhow",
+ "async-trait",
+ "http 1.2.0",
+ "reqwest 0.12.12",
+ "serde",
+ "thiserror 1.0.69",
+ "tower-service",
+]
+
+[[package]]
+name = "rfc6979"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7743f17af12fa0b03b803ba12cd6a8d9483a587e89c69445e3909655c0b9fabb"
+dependencies = [
+ "crypto-bigint 0.4.9",
+ "hmac",
+ "zeroize",
+]
+
+[[package]]
+name = "ring"
+version = "0.16.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3053cf52e236a3ed746dfc745aa9cacf1b791d846bdaf412f60a8d7d6e17c8fc"
+dependencies = [
+ "cc",
+ "libc",
+ "once_cell",
+ "spin 0.5.2",
+ "untrusted 0.7.1",
+ "web-sys",
+ "winapi",
+]
+
+[[package]]
+name = "ring"
+version = "0.17.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "getrandom 0.2.15",
+ "libc",
+ "spin 0.9.8",
+ "untrusted 0.9.0",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "rmp"
+version = "0.8.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "228ed7c16fa39782c3b3468e974aec2795e9089153cd08ee2e9aefb3613334c4"
+dependencies = [
+ "byteorder",
+ "num-traits",
+ "paste",
+]
+
+[[package]]
+name = "rmp-serde"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52e599a477cf9840e92f2cde9a7189e67b42c57532749bf90aea6ec10facd4db"
+dependencies = [
+ "byteorder",
+ "rmp",
+ "serde",
+]
+
+[[package]]
+name = "rsa"
+version = "0.9.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47c75d7c5c6b673e58bf54d8544a9f432e3a925b0e80f7cd3602ab5c50c55519"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8 0.10.2",
+ "rand_core 0.6.4",
+ "signature 2.2.0",
+ "spki 0.7.3",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rust_decimal"
+version = "1.36.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b082d80e3e3cc52b2ed634388d436fe1f4de6af5786cc2de9ba9737527bdf555"
+dependencies = [
+ "arrayvec",
+ "num-traits",
+]
+
+[[package]]
+name = "rustc-demangle"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "rustc_version"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfcb3a22ef46e85b45de6ee7e79d063319ebb6594faafcf1c225ea92ab6e9b92"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "rustix"
+version = "0.38.43"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a78891ee6bf2340288408954ac787aa063d8e8817e9f53abb37c695c6d834ef6"
+dependencies = [
+ "bitflags 2.9.4",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "rustls"
+version = "0.19.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35edb675feee39aec9c99fa5ff985081995a06d594114ae14cbe797ad7b7a6d7"
+dependencies = [
+ "base64 0.13.1",
+ "log",
+ "ring 0.16.20",
+ "sct 0.6.1",
+ "webpki",
+]
+
+[[package]]
+name = "rustls"
+version = "0.21.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
+dependencies = [
+ "log",
+ "ring 0.17.8",
+ "rustls-webpki 0.101.7",
+ "sct 0.7.1",
+]
+
+[[package]]
+name = "rustls"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf4ef73721ac7bcd79b2b315da7779d8fc09718c6b3d2d1b2d94850eb8c18432"
+dependencies = [
+ "log",
+ "ring 0.17.8",
+ "rustls-pki-types",
+ "rustls-webpki 0.102.8",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls"
+version = "0.23.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5065c3f250cbd332cd894be57c40fa52387247659b14a2d6041d121547903b1b"
+dependencies = [
+ "once_cell",
+ "rustls-pki-types",
+ "rustls-webpki 0.102.8",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
+dependencies = [
+ "openssl-probe",
+ "rustls-pemfile 1.0.4",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5bfb394eeed242e909609f56089eecfe5fda225042e8b171791b9c95f5931e5"
+dependencies = [
+ "openssl-probe",
+ "rustls-pemfile 2.2.0",
+ "rustls-pki-types",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
+dependencies = [
+ "base64 0.21.7",
+]
+
+[[package]]
+name = "rustls-pemfile"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dce314e5fee3f39953d46bb63bb8a46d40c2f8fb7cc5a3b6cab2bde9721d6e50"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2bf47e6ff922db3825eb750c4e2ff784c6ff8fb9e13046ef6a1d1c5401b0b37"
+
+[[package]]
+name = "rustls-webpki"
+version = "0.101.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+dependencies = [
+ "ring 0.17.8",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "rustls-webpki"
+version = "0.102.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
+dependencies = [
+ "ring 0.17.8",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "rustracing"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a44822b10c095e574869de2b891e40c724fef42cadaea040d1cd3bdbb13d36a5"
+dependencies = [
+ "backtrace",
+ "crossbeam-channel",
+ "rand 0.8.5",
+ "trackable 0.2.24",
+]
+
+[[package]]
+name = "rustracing_jaeger"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6c2fe9411ef5f43ac773f0e84ad735804c55719346a7aad52de2d9162db97c8"
+dependencies = [
+ "crossbeam-channel",
+ "hostname",
+ "percent-encoding",
+ "rand 0.8.5",
+ "rustracing",
+ "thrift_codec",
+ "trackable 0.2.24",
+]
+
+[[package]]
+name = "rustversion"
+version = "1.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
+
+[[package]]
+name = "rusty-fork"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb3dcc6e454c328bb824492db107ab7c0ae8fcffe4ad210136ef014458c1bc4f"
+dependencies = [
+ "fnv",
+ "quick-error",
+ "tempfile",
+ "wait-timeout",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "safe_arch"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96b02de82ddbe1b636e6170c21be622223aea188ef2e139be0a5b219ec215323"
+dependencies = [
+ "bytemuck",
+]
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "schannel"
+version = "0.1.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f29ebaa345f945cec9fbbc532eb307f0fdad8161f281b6369539c8d84876b3d"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "sct"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b362b83898e0e69f38515b82ee15aa80636befe47c3b6d3d89a911e78fc228ce"
+dependencies = [
+ "ring 0.16.20",
+ "untrusted 0.7.1",
+]
+
+[[package]]
+name = "sct"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
+dependencies = [
+ "ring 0.17.8",
+ "untrusted 0.9.0",
+]
+
+[[package]]
+name = "sec1"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3be24c1842290c45df0a7bf069e0c268a747ad05a192f2fd7dcfdbc1cba40928"
+dependencies = [
+ "base16ct",
+ "der 0.6.1",
+ "generic-array",
+ "pkcs8 0.9.0",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "security-framework"
+version = "2.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+dependencies = [
+ "bitflags 2.9.4",
+ "core-foundation",
+ "core-foundation-sys",
+ "libc",
+ "security-framework-sys",
+]
+
+[[package]]
+name = "security-framework-sys"
+version = "2.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49db231d56a190491cb4aeda9527f1ad45345af50b0851622a7adb8c03b01c32"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "semver"
+version = "1.0.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3cb6eb87a131f756572d7fb904f6e7b68633f09cca868c5df1c4b8d1a694bbba"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.217"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.217"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "serde_fmt"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d4ddca14104cd60529e8c7f7ba71a2c8acd8f7f5cfcdc2faf97eeb7c3010a4"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.135"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b0d7ba2887406110130a978386c4e1befb98c674b4fba677954e4db976630d9"
+dependencies = [
+ "indexmap 2.7.0",
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_path_to_error"
+version = "0.1.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af99884400da37c88f5e9146b7f1fd0fbcae8f6eec4e9da38b67d05486f814a6"
+dependencies = [
+ "itoa",
+ "serde",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87607cb1398ed59d48732e575a4c28a7a8ebf2454b964fe3f224f2afc07909e1"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_urlencoded"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3491c14715ca2294c4d6a88f15e84739788c1d030eed8c110436aafdaa2f3fd"
+dependencies = [
+ "form_urlencoded",
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "serde_with"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d6b6f7f2fcb69f747921f79f3926bd1e203fce4fef62c268dd3abfb6d86029aa"
+dependencies = [
+ "base64 0.22.1",
+ "chrono",
+ "hex",
+ "indexmap 1.9.3",
+ "indexmap 2.7.0",
+ "serde",
+ "serde_derive",
+ "serde_json",
+ "serde_with_macros",
+ "time",
+]
+
+[[package]]
+name = "serde_with_macros"
+version = "3.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d00caa5193a3c8362ac2b73be6b9e768aa5a4b2f721d8f4b339600c3cb51f8e"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "serde_yaml"
+version = "0.8.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "578a7433b776b56a35785ed5ce9a7e777ac0598aac5a6dd1b4b18a307c7fc71b"
+dependencies = [
+ "indexmap 1.9.3",
+ "ryu",
+ "serde",
+ "yaml-rust",
+]
+
+[[package]]
+name = "serde_yaml"
+version = "0.9.34+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6a8b1a1a2ebf674015cc02edccce75287f1a0130d394307b36743c2f5d504b47"
+dependencies = [
+ "indexmap 2.7.0",
+ "itoa",
+ "ryu",
+ "serde",
+ "unsafe-libyaml",
+]
+
+[[package]]
+name = "sfv"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f27daf6ed3fc7ffd5ea3ce9f684fe351c47e50f2fdbb6236e2bad0b440dbe408"
+dependencies = [
+ "data-encoding",
+ "indexmap 2.7.0",
+ "rust_decimal",
+]
+
+[[package]]
+name = "sha1"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha2"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "digest",
+]
+
+[[package]]
+name = "sha3"
+version = "0.10.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75872d278a8f37ef87fa0ddbda7802605cb18344497949862c0d4dcb291eba60"
+dependencies = [
+ "digest",
+ "keccak",
+]
+
+[[package]]
+name = "sharded-slab"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f40ca3c46823713e0d4209592e8d6e826aa57e928f09752619fc696c499637f6"
+dependencies = [
+ "lazy_static",
+]
+
+[[package]]
+name = "shared_child"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09fa9338aed9a1df411814a5b2252f7cd206c55ae9bf2fa763f8de84603aa60c"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
+[[package]]
+name = "signal-hook-registry"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a9e9e0b4211b72e7b8b6e85c807d36c212bdb33ea8587f7569562a84df5465b1"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "signature"
+version = "1.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "similar"
+version = "2.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1de1d4f81173b03af4c0cbed3c898f6bff5b870e4a7f5d6f4057d62a7a4b686e"
+dependencies = [
+ "bstr",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "similar-asserts"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cfe85670573cd6f0fa97940f26e7e6601213c3b0555246c24234131f88c5709e"
+dependencies = [
+ "console",
+ "similar",
+]
+
+[[package]]
+name = "simple_asn1"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adc4e5204eb1910f40f9cfa375f6f05b68c3abac4b6fd879c8ff5e7ae8a0a085"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "thiserror 1.0.69",
+ "time",
+]
+
+[[package]]
+name = "siphasher"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+
+[[package]]
+name = "siphasher"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56199f7ddabf13fe5074ce809e7d3f42b42ae711800501b5b16ea82ad029c39d"
+
+[[package]]
+name = "slab"
+version = "0.4.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f92a496fb766b417c996b9c5e57daf2f7ad3b0bebe1ccfca4856390e3d3bb67"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
+
+[[package]]
+name = "smartstring"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fb72c633efbaa2dd666986505016c32c3044395ceaf881518399d2f4127ee29"
+dependencies = [
+ "autocfg",
+ "static_assertions",
+ "version_check",
+]
+
+[[package]]
+name = "snap"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b6b67fb9a61334225b5b790716f609cd58395f895b3fe8b328786812a40bc3b"
+
+[[package]]
+name = "socket2"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c970269d99b64e60ec3bd6ad27270092a5394c4e309314b18ae3fe575695fbe8"
+dependencies = [
+ "libc",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "spin"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e63cff320ae2c57904679ba7cb63280a3dc4613885beafb148ee7bf9aa9042d"
+
+[[package]]
+name = "spin"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+
+[[package]]
+name = "spki"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67cf02bbac7a337dc36e4f5a693db6c21e7863f45070f7064577eb4367a3212b"
+dependencies = [
+ "base64ct",
+ "der 0.6.1",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der 0.7.9",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "string_cache"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f91138e76242f575eb1d3b38b4f1362f10d3a43f47d182a5b359af488a02293b"
+dependencies = [
+ "new_debug_unreachable",
+ "once_cell",
+ "parking_lot",
+ "phf_shared 0.10.0",
+ "precomputed-hash",
+ "serde",
+]
+
+[[package]]
+name = "string_enum"
+version = "0.4.1"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "swc_macros_common",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "strsim"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
+[[package]]
+name = "strum"
+version = "0.26.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fec0f0aef304996cf250b31b5a10dee7980c85da9d759361292b8bca5a18f06"
+dependencies = [
+ "strum_macros",
+]
+
+[[package]]
+name = "strum_macros"
+version = "0.26.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c6bee85a5a24955dc440386795aa378cd9cf82acd5f764469152d2270e581be"
+dependencies = [
+ "heck 0.5.0",
+ "proc-macro2",
+ "quote",
+ "rustversion",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "subtle"
+version = "2.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
+
+[[package]]
+name = "sval"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6dc0f9830c49db20e73273ffae9b5240f63c42e515af1da1fceefb69fceafd8"
+
+[[package]]
+name = "sval_buffer"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "429922f7ad43c0ef8fd7309e14d750e38899e32eb7e8da656ea169dd28ee212f"
+dependencies = [
+ "sval",
+ "sval_ref",
+]
+
+[[package]]
+name = "sval_dynamic"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "68f16ff5d839396c11a30019b659b0976348f3803db0626f736764c473b50ff4"
+dependencies = [
+ "sval",
+]
+
+[[package]]
+name = "sval_fmt"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c01c27a80b6151b0557f9ccbe89c11db571dc5f68113690c1e028d7e974bae94"
+dependencies = [
+ "itoa",
+ "ryu",
+ "sval",
+]
+
+[[package]]
+name = "sval_json"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0deef63c70da622b2a8069d8600cf4b05396459e665862e7bdb290fd6cf3f155"
+dependencies = [
+ "itoa",
+ "ryu",
+ "sval",
+]
+
+[[package]]
+name = "sval_nested"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a39ce5976ae1feb814c35d290cf7cf8cd4f045782fe1548d6bc32e21f6156e9f"
+dependencies = [
+ "sval",
+ "sval_buffer",
+ "sval_ref",
+]
+
+[[package]]
+name = "sval_ref"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bb7c6ee3751795a728bc9316a092023529ffea1783499afbc5c66f5fabebb1fa"
+dependencies = [
+ "sval",
+]
+
+[[package]]
+name = "sval_serde"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a5572d0321b68109a343634e3a5d576bf131b82180c6c442dee06349dfc652a"
+dependencies = [
+ "serde",
+ "sval",
+ "sval_nested",
+]
+
+[[package]]
+name = "swc_atoms"
+version = "0.6.4"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "hstr",
+ "once_cell",
+ "rustc-hash",
+ "serde",
+]
+
+[[package]]
+name = "swc_cached"
+version = "0.3.18"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "ahash",
+ "anyhow",
+ "dashmap",
+ "once_cell",
+ "regex",
+ "serde",
+]
+
+[[package]]
+name = "swc_common"
+version = "0.33.8"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "ast_node",
+ "atty",
+ "better_scoped_tls",
+ "cfg-if",
+ "either",
+ "from_variant",
+ "new_debug_unreachable",
+ "num-bigint",
+ "once_cell",
+ "rustc-hash",
+ "serde",
+ "siphasher 0.3.11",
+ "string_cache",
+ "swc_atoms",
+ "swc_eq_ignore_macros",
+ "swc_visit",
+ "termcolor",
+ "tracing",
+ "unicode-width",
+ "url",
+]
+
+[[package]]
+name = "swc_ecma_ast"
+version = "0.110.9"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "bitflags 2.9.4",
+ "is-macro",
+ "num-bigint",
+ "phf 0.11.3",
+ "scoped-tls",
+ "string_enum",
+ "swc_atoms",
+ "swc_common",
+ "unicode-id",
+]
+
+[[package]]
+name = "swc_ecma_loader"
+version = "0.45.9"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "anyhow",
+ "dashmap",
+ "indexmap 1.9.3",
+ "normpath",
+ "once_cell",
+ "path-clean",
+ "pathdiff",
+ "serde",
+ "serde_json",
+ "swc_cached",
+ "swc_common",
+ "tracing",
+]
+
+[[package]]
+name = "swc_ecma_parser"
+version = "0.141.21"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "either",
+ "new_debug_unreachable",
+ "num-bigint",
+ "num-traits",
+ "phf 0.11.3",
+ "serde",
+ "smallvec",
+ "smartstring",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "tracing",
+ "typed-arena",
+]
+
+[[package]]
+name = "swc_ecma_transforms_base"
+version = "0.134.30"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "better_scoped_tls",
+ "bitflags 2.9.4",
+ "indexmap 1.9.3",
+ "once_cell",
+ "phf 0.10.1",
+ "rustc-hash",
+ "serde",
+ "smallvec",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_ecma_parser",
+ "swc_ecma_utils",
+ "swc_ecma_visit",
+ "tracing",
+]
+
+[[package]]
+name = "swc_ecma_utils"
+version = "0.124.26"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "indexmap 1.9.3",
+ "num_cpus",
+ "once_cell",
+ "rustc-hash",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_ecma_visit",
+ "tracing",
+ "unicode-id",
+]
+
+[[package]]
+name = "swc_ecma_visit"
+version = "0.96.9"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "num-bigint",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_visit",
+ "tracing",
+]
+
+[[package]]
+name = "swc_eq_ignore_macros"
+version = "0.1.2"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "swc_macros_common"
+version = "0.3.8"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "swc_visit"
+version = "0.5.7"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "either",
+ "swc_visit_macros",
+]
+
+[[package]]
+name = "swc_visit_macros"
+version = "0.5.8"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#3ccddcb7d70380b6952296717b2d9f2056f4c2ac"
+dependencies = [
+ "Inflector",
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "swc_macros_common",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "symlink"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7973cce6668464ea31f176d85b13c7ab3bba2cb3b77a2ed26abd7801688010a"
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.95"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46f71c0377baf4ef1cc3e3402ded576dccc315800fbc62dfc7fe04b009773b4a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "sync_wrapper"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
+
+[[package]]
+name = "sync_wrapper"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bf256ce5efdfa370213c1dabab5935a12e49f2c58d15e9eac2870d3b4f27263"
+dependencies = [
+ "futures-core",
+]
+
+[[package]]
+name = "synstructure"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8af7666ab7b6390ab78131fb5b0fce11d6b7a6951602017c35fa82800708971"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "sysctl"
+version = "0.4.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225e483f02d0ad107168dc57381a8a40c3aeea6abe47f37506931f861643cfa8"
+dependencies = [
+ "bitflags 1.3.2",
+ "byteorder",
+ "libc",
+ "thiserror 1.0.69",
+ "walkdir",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
+dependencies = [
+ "bitflags 1.3.2",
+ "core-foundation",
+ "system-configuration-sys 0.5.0",
+]
+
+[[package]]
+name = "system-configuration"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
+dependencies = [
+ "bitflags 2.9.4",
+ "core-foundation",
+ "system-configuration-sys 0.6.0",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "system-configuration-sys"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e1d1b10ced5ca923a1fcb8d03e96b8d3268065d724548c0211415ff6ac6bac4"
+dependencies = [
+ "core-foundation-sys",
+ "libc",
+]
+
+[[package]]
+name = "tempdir"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15f2b5fb00ccdf689e0149d1b1b3c03fead81c2b37735d812fa8bddbbf41b6d8"
+dependencies = [
+ "rand 0.4.6",
+ "remove_dir_all",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a8a559c81686f576e8cd0290cd2a24a2a9ad80c98b3478856500fcbd7acd704"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "getrandom 0.2.15",
+ "once_cell",
+ "rustix",
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06794f8f6c5c898b3275aebefa6b8a1cb24cd2c6c79397ab15774837a0bc5755"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "termtree"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f50febec83f5ee1df3015341d8bd429f2d1cc62bcba7ea2076759d315084683"
+
+[[package]]
+name = "textwrap"
+version = "0.16.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23d434d3f8967a09480fb04132ebe0a3e088c173e6d0ee7897abbdf4eab0f8b9"
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3ac7f54ca534db81081ef1c1e7f6ea8a3ef428d2fc069097c079443d24124d3"
+dependencies = [
+ "thiserror-impl 2.0.10",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e9465d30713b56a37ede7185763c3492a91be2f5fa68d958c44e41ab9248beb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b9ef9bad013ada3808854ceac7b46812a6465ba368859a37e2100283d2d719c"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+]
+
+[[package]]
+name = "thrift_codec"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fb61fb3d0a0af14949f3a6949b2639112e13226647112824f4d081533f9b1a8"
+dependencies = [
+ "byteorder",
+ "trackable 0.2.24",
+]
+
+[[package]]
+name = "time"
+version = "0.3.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
+dependencies = [
+ "deranged",
+ "itoa",
+ "num-conv",
+ "powerfmt",
+ "serde",
+ "time-core",
+ "time-macros",
+]
+
+[[package]]
+name = "time-core"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
+
+[[package]]
+name = "time-macros"
+version = "0.2.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2834e6017e3e5e4b9834939793b282bc03b37a3336245fa820e35e233e2a85de"
+dependencies = [
+ "num-conv",
+ "time-core",
+]
+
+[[package]]
+name = "tinystr"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9117f5d4db391c1cf6927e7bea3db74b9a1c1add8f7eda9ffd5364f40f57b82f"
+dependencies = [
+ "displaydoc",
+ "zerovec",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "022db8904dfa342efe721985167e9fcd16c29b226db4397ed752a761cfce81e8"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tokio"
+version = "1.43.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d61fa4ffa3de412bfea335c6ecff681de2b609ba3c77ef3e00e521813a9ed9e"
+dependencies = [
+ "backtrace",
+ "bytes",
+ "libc",
+ "mio",
+ "parking_lot",
+ "pin-project-lite",
+ "signal-hook-registry",
+ "socket2",
+ "tokio-macros",
+ "windows-sys 0.52.0",
+]
+
+[[package]]
+name = "tokio-io-timeout"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30b74022ada614a1b4834de765f9bb43877f910cc8ce4be40e89042c9223a8bf"
+dependencies = [
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-macros"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e06d43f1345a3bcd39f6a56dbb7dcab2ba47e68e8ac134855e7e2bdbaf8cab8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-nsq"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "289e54c5548b30d6fd1edb525812fa26c745ba0dccdf5fc552ffe7f8b0f7991e"
+dependencies = [
+ "anyhow",
+ "async-compression",
+ "backoff",
+ "built",
+ "byteorder",
+ "futures",
+ "futures-util",
+ "gethostname",
+ "hyper 0.14.32",
+ "lazy_static",
+ "log",
+ "matches",
+ "regex",
+ "rustls 0.19.1",
+ "serde",
+ "serde_json",
+ "snap",
+ "thiserror 1.0.69",
+ "tokio",
+ "tokio-io-timeout",
+ "tokio-rustls 0.22.0",
+]
+
+[[package]]
+name = "tokio-openssl"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59df6849caa43bb7567f9a36f863c447d95a11d5903c9cc334ba32576a27eadd"
+dependencies = [
+ "openssl",
+ "openssl-sys",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-postgres"
+version = "0.7.13"
+source = "git+https://github.com/encoredev/rust-postgres?branch=encore-patches-sync#e71577eea1d14769a3021b6dd214448e3de3ffb6"
+dependencies = [
+ "async-trait",
+ "byteorder",
+ "bytes",
+ "constant_time_eq",
+ "fallible-iterator",
+ "futures-channel",
+ "futures-util",
+ "log",
+ "parking_lot",
+ "percent-encoding",
+ "phf 0.11.3",
+ "pin-project-lite",
+ "postgres-protocol",
+ "postgres-types",
+ "rand 0.9.1",
+ "socket2",
+ "tokio",
+ "tokio-util",
+ "whoami",
+]
+
+[[package]]
+name = "tokio-retry"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f57eb36ecbe0fc510036adff84824dd3c24bb781e21bfa67b69d556aa85214f"
+dependencies = [
+ "pin-project",
+ "rand 0.8.5",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc6844de72e57df1980054b38be3a9f4702aba4858be64dd700181a8a6d0e1b6"
+dependencies = [
+ "rustls 0.19.1",
+ "tokio",
+ "webpki",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+dependencies = [
+ "rustls 0.21.12",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
+dependencies = [
+ "rustls 0.22.4",
+ "rustls-pki-types",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-rustls"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f6d0975eaace0cf0fcadee4e4aaa5da15b5c079146f2cffb67c113be122bf37"
+dependencies = [
+ "rustls 0.23.20",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eca58d7bba4a75707817a2c44174253f9236b2d5fbd055602e9d5c07c139a047"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-test"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2468baabc3311435b55dd935f702f42cd1b8abb7e754fb7dfb16bd36aa88f9f7"
+dependencies = [
+ "async-stream",
+ "bytes",
+ "futures-core",
+ "tokio",
+ "tokio-stream",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c83b561d025642014097b66e6c1bb422783339e0909e4429cde4749d1990bc38"
+dependencies = [
+ "futures-util",
+ "log",
+ "rustls 0.22.4",
+ "rustls-native-certs 0.7.3",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls 0.25.0",
+ "tungstenite 0.21.0",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "edc5f74e248dc973e0dbb7b74c7e0d6fcc301c694ff50049504004ef4d0cdcd9"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite 0.24.0",
+]
+
+[[package]]
+name = "tokio-util"
+version = "0.7.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d7fcaa8d55a2bdd6b83ace262b016eca0d79ee02818c5c1bcdf0305114081078"
+dependencies = [
+ "bytes",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "hashbrown 0.14.5",
+ "pin-project-lite",
+ "tokio",
+]
+
+[[package]]
+name = "toml"
+version = "0.7.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd79e69d3b627db300ff956027cc6c3798cef26d22526befdfcd12feeb6d2257"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dd7358ecb8fc2f8d014bf86f6f638ce72ba252a2c3a2572f2a795f1d23efb41"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.19.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
+dependencies = [
+ "indexmap 2.7.0",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "winnow",
+]
+
+[[package]]
+name = "tonic"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d560933a0de61cf715926b9cac824d4c883c2c43142f787595e48280c40a1d0e"
+dependencies = [
+ "async-stream",
+ "async-trait",
+ "axum 0.6.20",
+ "base64 0.21.7",
+ "bytes",
+ "flate2",
+ "h2 0.3.26",
+ "http 0.2.12",
+ "http-body 0.4.6",
+ "hyper 0.14.32",
+ "hyper-timeout",
+ "percent-encoding",
+ "pin-project",
+ "prost 0.12.6",
+ "rustls 0.21.12",
+ "rustls-pemfile 1.0.4",
+ "tokio",
+ "tokio-rustls 0.24.1",
+ "tokio-stream",
+ "tower 0.4.13",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+ "webpki-roots",
+]
+
+[[package]]
+name = "tower"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "indexmap 1.9.3",
+ "pin-project",
+ "pin-project-lite",
+ "rand 0.8.5",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
+dependencies = [
+ "futures-core",
+ "futures-util",
+ "pin-project-lite",
+ "sync_wrapper 1.0.2",
+ "tokio",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9cd434a998747dd2c4276bc96ee2e0c7a2eadf3cae88e52be55a05fa9053f5"
+dependencies = [
+ "bitflags 2.9.4",
+ "bytes",
+ "futures-util",
+ "http 1.2.0",
+ "http-body 1.0.1",
+ "http-body-util",
+ "http-range-header",
+ "httpdate",
+ "mime",
+ "mime_guess",
+ "percent-encoding",
+ "pin-project-lite",
+ "tokio",
+ "tokio-util",
+ "tower-layer",
+ "tower-service",
+ "tracing",
+]
+
+[[package]]
+name = "tower-layer"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "121c2a6cda46980bb0fcd1647ffaf6cd3fc79a013de288782836f6df9c48780e"
+
+[[package]]
+name = "tower-service"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
+
+[[package]]
+name = "tracing"
+version = "0.1.41"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "784e0ac535deb450455cbfa28a6f0df145ea1bb7ae51b821cf5e7927fdcfbdd0"
+dependencies = [
+ "log",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.28"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "395ae124c09f9e6918a2310af6038fba074bcf474ac352496d5910dd59a2226d"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e672c95779cf947c5311f83787af4fa8fffd12fb27e4993211a84bdfd9610f9c"
+dependencies = [
+ "once_cell",
+ "valuable",
+]
+
+[[package]]
+name = "tracing-log"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee855f1f400bd0e5c02d150ae5de3840039a3f54b025156404e34c23c03f47c3"
+dependencies = [
+ "log",
+ "once_cell",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-subscriber"
+version = "0.3.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e8189decb5ac0fa7bc8b96b7cb9b2701d60d48805aca84a238004d665fcc4008"
+dependencies = [
+ "matchers",
+ "nu-ansi-term",
+ "once_cell",
+ "regex",
+ "sharded-slab",
+ "smallvec",
+ "thread_local",
+ "tracing",
+ "tracing-core",
+ "tracing-log",
+]
+
+[[package]]
+name = "trackable"
+version = "0.2.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b98abb9e7300b9ac902cc04920945a874c1973e08c310627cc4458c04b70dd32"
+dependencies = [
+ "trackable 1.3.0",
+ "trackable_derive",
+]
+
+[[package]]
+name = "trackable"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b15bd114abb99ef8cee977e517c8f37aee63f184f2d08e3e6ceca092373369ae"
+dependencies = [
+ "trackable_derive",
+]
+
+[[package]]
+name = "trackable_derive"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ebeb235c5847e2f82cfe0f07eb971d1e5f6804b18dac2ae16349cc604380f82f"
+dependencies = [
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "triomphe"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef8f7726da4807b58ea5c96fdc122f80702030edc33b35aff9190a51148ccc85"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "try-lock"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
+
+[[package]]
+name = "tungstenite"
+version = "0.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ef1a641ea34f399a848dea702823bbecfb4c486f911735368f1f137cb8257e1"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http 1.2.0",
+ "httparse",
+ "log",
+ "rand 0.8.5",
+ "rustls 0.22.4",
+ "rustls-pki-types",
+ "sha1",
+ "thiserror 1.0.69",
+ "url",
+ "utf-8",
+]
+
+[[package]]
+name = "tungstenite"
+version = "0.24.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18e5b8366ee7a95b16d32197d0b2604b43a0be89dc5fac9f8e96ccafbaedda8a"
+dependencies = [
+ "byteorder",
+ "bytes",
+ "data-encoding",
+ "http 1.2.0",
+ "httparse",
+ "log",
+ "rand 0.8.5",
+ "sha1",
+ "thiserror 1.0.69",
+ "utf-8",
+]
+
+[[package]]
+name = "txtar"
+version = "1.0.0"
+dependencies = [
+ "assert_fs",
+ "clean-path",
+ "predicates 2.1.5",
+ "similar-asserts",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "typed-arena"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
+
+[[package]]
+name = "typeid"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e13db2e0ccd5e14a544e8a246ba2312cd25223f616442d7f2cb0e3db614236e"
+
+[[package]]
+name = "typenum"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42ff0bf0c66b8238c6f3b578df37d0b7848e55df8577b3f74f92a69acceeb825"
+
+[[package]]
+name = "ucd-trie"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
+
+[[package]]
+name = "unarray"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94"
+
+[[package]]
+name = "unicase"
+version = "2.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75b844d17643ee918803943289730bec8aac480150456169e647ed0b576ba539"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
+[[package]]
+name = "unicode-id"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "10103c57044730945224467c09f71a4db0071c123a0648cc3e818913bde6b561"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.24"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5033c97c4262335cded6d6fc3e5c18ab755e1a3dc96376350f3d8e9f009ad956"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e70f2a8b45122e719eb623c01822704c4e0907e7e426a05927e1a1cfff5b75d0"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6ccf251212114b54433ec949fd6a7841275f9ada20dddd2f29e9ceea4501493"
+
+[[package]]
+name = "unicode-width"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
+
+[[package]]
+name = "unsafe-libyaml"
+version = "0.2.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "673aac59facbab8a9007c7f6108d11f63b603f7cabff99fabf650fea5c32b861"
+
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
+[[package]]
+name = "untrusted"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
+
+[[package]]
+name = "url"
+version = "2.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32f8b686cadd1473f4bd0117a5d28d36b1ade384ea9b5069a1c40aefed7fda60"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+]
+
+[[package]]
+name = "urlencoding"
+version = "2.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "daf8dba3b7eb870caf1ddeed7bc9d2a049f3cfdfae7cb521b087cc33ae4c49da"
+
+[[package]]
+name = "utf-8"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09cc8ee72d2a9becf2f2febe0205bbed8fc6615b7cb429ad062dc7b7ddd036a9"
+
+[[package]]
+name = "utf16_iter"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8232dd3cdaed5356e0f716d285e4b40b932ac434100fe9b7e0e8e935b9e6246"
+
+[[package]]
+name = "utf8_iter"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+
+[[package]]
+name = "utf8parse"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
+
+[[package]]
+name = "uuid"
+version = "1.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8c5f0a0af699448548ad1a2fbf920fb4bee257eae39953ba95cb84891a0446a"
+
+[[package]]
+name = "valuable"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
+
+[[package]]
+name = "value-bag"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ef4c4aa54d5d05a279399bfa921ec387b7aba77caf7a682ae8d86785b8fdad2"
+dependencies = [
+ "value-bag-serde1",
+ "value-bag-sval2",
+]
+
+[[package]]
+name = "value-bag-serde1"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4bb773bd36fd59c7ca6e336c94454d9c66386416734817927ac93d81cb3c5b0b"
+dependencies = [
+ "erased-serde",
+ "serde",
+ "serde_fmt",
+]
+
+[[package]]
+name = "value-bag-sval2"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53a916a702cac43a88694c97657d449775667bcd14b70419441d05b7fea4a83a"
+dependencies = [
+ "sval",
+ "sval_buffer",
+ "sval_dynamic",
+ "sval_fmt",
+ "sval_json",
+ "sval_ref",
+ "sval_serde",
+]
+
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
+name = "version_check"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "vsimd"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64"
+
+[[package]]
+name = "wait-timeout"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ac3b126d3914f9849036f826e054cbabdc8519970b8998ddaf3b5bd3c65f11"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "want"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfa7760aed19e106de2c7c0b581b509f2f25d3dacaf737cb82ac61bc6d760b0e"
+dependencies = [
+ "try-lock",
+]
+
+[[package]]
+name = "wasi"
+version = "0.9.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "wasi"
+version = "0.14.2+wasi-0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
+dependencies = [
+ "wit-bindgen-rt",
+]
+
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a474f6281d1d70c17ae7aa6a613c87fce69a127e2624002df63dcb39d6cf6396"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+ "wasm-bindgen-macro",
+]
+
+[[package]]
+name = "wasm-bindgen-backend"
+version = "0.2.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f89bb38646b4f81674e8f5c3fb81b562be1fd936d84320f3264486418519c79"
+dependencies = [
+ "bumpalo",
+ "log",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-futures"
+version = "0.4.49"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38176d9b44ea84e9184eff0bc34cc167ed044f816accfe5922e54d84cf48eca2"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "once_cell",
+ "wasm-bindgen",
+ "web-sys",
+]
+
+[[package]]
+name = "wasm-bindgen-macro"
+version = "0.2.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2cc6181fd9a7492eef6fef1f33961e3695e4579b9872a6f7c83aee556666d4fe"
+dependencies = [
+ "quote",
+ "wasm-bindgen-macro-support",
+]
+
+[[package]]
+name = "wasm-bindgen-macro-support"
+version = "0.2.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d7a95b763d3c45903ed6c81f156801839e5ee968bb07e534c44df0fcd330c2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+ "wasm-bindgen-backend",
+ "wasm-bindgen-shared",
+]
+
+[[package]]
+name = "wasm-bindgen-shared"
+version = "0.2.99"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "943aab3fdaaa029a6e0271b35ea10b72b943135afe9bffca82384098ad0e06a6"
+
+[[package]]
+name = "wasm-streams"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15053d8d85c7eccdbefef60f06769760a563c7f0a9d6902a13d35c7800b0ad65"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
+[[package]]
+name = "web-sys"
+version = "0.3.76"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04dd7223427d52553d3702c004d3b2fe07c148165faa56313cb00211e31c12bc"
+dependencies = [
+ "js-sys",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "webpki"
+version = "0.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e38c0608262c46d4a56202ebabdeb094cef7e560ca7a226c6bf055188aa4ea"
+dependencies = [
+ "ring 0.16.20",
+ "untrusted 0.7.1",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.25.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
+
+[[package]]
+name = "which"
+version = "4.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87ba24419a2078cd2b0f2ede2691b6c66d8e47836da3b6db8265ebad47afbfc7"
+dependencies = [
+ "either",
+ "home",
+ "once_cell",
+ "rustix",
+]
+
+[[package]]
+name = "whoami"
+version = "1.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "372d5b87f58ec45c384ba03563b03544dc5fadc3983e434b286913f5b4a9bb6d"
+dependencies = [
+ "redox_syscall",
+ "wasite",
+ "web-sys",
+]
+
+[[package]]
+name = "wide"
+version = "0.7.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0ce5da8ecb62bcd8ec8b7ea19f69a51275e91299be594ea5cc6ef7819e16cd03"
+dependencies = [
+ "bytemuck",
+ "safe_arch",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-core"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-registry"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e400001bb720a623c1c69032f8e3e4cf09984deec740f007dd2b03ec864804b0"
+dependencies = [
+ "windows-result",
+ "windows-strings",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-result"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d1043d8214f791817bab27572aaa8af63732e11bf84aa21a45a78d6c317ae0e"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-strings"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cd9b125c486025df0eabcb585e62173c6c9eddcec5d117d3b6e8c30e2ee4d10"
+dependencies = [
+ "windows-result",
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.52.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets 0.52.6",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "winnow"
+version = "0.5.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winreg"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d107f8c6e916235c4c01cabb3e8acf7bea8ef6a63ca2e7fa0527c049badfc48c"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winreg"
+version = "0.50.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "524e57b2c537c0f9b1e69f1965311ec12182b4122e45035b1508cd24d2adadb1"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
+dependencies = [
+ "bitflags 2.9.4",
+]
+
+[[package]]
+name = "write16"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1890f4022759daae28ed4fe62859b1236caebfc61ede2f63ed4e695f3f6d936"
+
+[[package]]
+name = "writeable"
+version = "0.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e9df38ee2d2c3c5948ea468a8406ff0db0b29ae1ffde1bcf20ef305bcc95c51"
+
+[[package]]
+name = "xid"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3752a194518cdee5d019812fb7978c51d8f0b7cfe9ace5983df1780964bb84c0"
+dependencies = [
+ "crc32fast",
+ "hostname",
+ "md5",
+ "once_cell",
+ "rand 0.8.5",
+ "sysctl",
+ "thiserror 1.0.69",
+ "winreg 0.8.0",
+]
+
+[[package]]
+name = "xmlparser"
+version = "0.13.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "66fee0b777b0f5ac1c69bb06d361268faafa61cd4682ae064a171c16c433e9e4"
+
+[[package]]
+name = "yaml-rust"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "56c1936c4cc7a1c9ab21a1ebb602eb942ba868cbd44a99cb7cdc5892335e1c85"
+dependencies = [
+ "linked-hash-map",
+]
+
+[[package]]
+name = "yoke"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "120e6aef9aa629e3d4f52dc8cc43a015c7724194c97dfaf45180d2daf2b77f40"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+ "yoke-derive",
+ "zerofrom",
+]
+
+[[package]]
+name = "yoke-derive"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2380878cad4ac9aac1e2435f3eb4020e8374b5f13c296cb75b4620ff8e229154"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+ "synstructure",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
+dependencies = [
+ "byteorder",
+ "zerocopy-derive",
+]
+
+[[package]]
+name = "zerocopy-derive"
+version = "0.7.35"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fa4f8080344d4671fb4e831a13ad1e68092748387dfc4f55e356242fae12ce3e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "zerofrom"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cff3ee08c995dee1859d998dea82f7374f2826091dd9cd47def953cae446cd2e"
+dependencies = [
+ "zerofrom-derive",
+]
+
+[[package]]
+name = "zerofrom-derive"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "595eed982f7d355beb85837f651fa22e90b3c044842dc7f2c2842c086f295808"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+ "synstructure",
+]
+
+[[package]]
+name = "zeroize"
+version = "1.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ced3678a2879b30306d323f4542626697a464a97c0a07c9aebf7ebca65cd4dde"
+
+[[package]]
+name = "zerovec"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa2b893d79df23bfb12d5461018d408ea19dfafe76c2c7ef6d4eba614f8ff079"
+dependencies = [
+ "yoke",
+ "zerofrom",
+ "zerovec-derive",
+]
+
+[[package]]
+name = "zerovec-derive"
+version = "0.10.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6eafa6dfb17584ea3e2bd6e76e0cc15ad7af12b09abdd1ca55961bed9b1063c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.95",
+]
+
+[[package]]
+name = "zstd"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fcf2b778a664581e31e389454a7072dab1647606d44f7feea22cd5abb9c9f3f9"
+dependencies = [
+ "zstd-safe",
+]
+
+[[package]]
+name = "zstd-safe"
+version = "7.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "54a3ab4db68cea366acc5c897c7b4d4d1b8994a9cd6e6f841f8964566a419059"
+dependencies = [
+ "zstd-sys",
+]
+
+[[package]]
+name = "zstd-sys"
+version = "2.0.13+zstd.1.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38ff0f21cfee8f97d94cef41359e0c89aa6113028ab0291aa8ca0038995a95aa"
+dependencies = [
+ "cc",
+ "pkg-config",
+]
diff --git a/Cargo.toml b/Cargo.toml
new file mode 100644
index 0000000000..fed5c568c6
--- /dev/null
+++ b/Cargo.toml
@@ -0,0 +1,21 @@
+[workspace]
+resolver = "2"
+members = ["runtimes/core", "runtimes/js", "tsparser", "supervisor"]
+
+[profile.dev.package]
+insta.opt-level = 3
+
+[profile.release]
+lto = true
+
+[patch.crates-io]
+tokio-postgres = { git = "https://github.com/encoredev/rust-postgres", branch = "encore-patches-sync" }
+postgres-protocol = { git = "https://github.com/encoredev/rust-postgres", branch = "encore-patches-sync" }
+postgres-types = { git = "https://github.com/encoredev/rust-postgres", branch = "encore-patches-sync" }
+swc_ecma_parser = { git = "https://github.com/encoredev/swc", branch = "node-resolve-exports" }
+swc_ecma_ast = { git = "https://github.com/encoredev/swc", branch = "node-resolve-exports" }
+swc_ecma_transforms_base = { git = "https://github.com/encoredev/swc", branch = "node-resolve-exports" }
+swc_atoms = { git = "https://github.com/encoredev/swc", branch = "node-resolve-exports" }
+swc_common = { git = "https://github.com/encoredev/swc", branch = "node-resolve-exports" }
+swc_ecma_loader = { git = "https://github.com/encoredev/swc", branch = "node-resolve-exports" }
+swc_ecma_visit = { git = "https://github.com/encoredev/swc", branch = "node-resolve-exports" }
diff --git a/Cross.toml b/Cross.toml
new file mode 100644
index 0000000000..4a264df650
--- /dev/null
+++ b/Cross.toml
@@ -0,0 +1,12 @@
+[build]
+pre-build = [
+    "apt-get install unzip &&",
+    "curl -LO https://github.com/protocolbuffers/protobuf/releases/download/v24.4/protoc-24.4-linux-x86_64.zip &&",
+    "unzip protoc-24.4-linux-x86_64.zip -d /usr/local &&",
+    "rm protoc-24.4-linux-x86_64.zip &&",
+    "export PATH=$PATH:/usr/local/bin",
+]
+
+[build.env]
+volumes = ["ENCORE_WORKDIR"]
+passthrough = ["TYPE_DEF_TMP_PATH", "ENCORE_VERSION"]
\ No newline at end of file
diff --git a/DEVELOPING.md b/DEVELOPING.md
deleted file mode 100644
index b7e6cf1947..0000000000
--- a/DEVELOPING.md
+++ /dev/null
@@ -1,44 +0,0 @@
-# Developing Encore
-
-Building an Encore application requires access to both the Encore runtime (the `encore.dev` package) as well as a custom-built
-([Go runtime](https://github.com/encoredev/go)) to implement Encore's request semantics and automated instrumentation.
-
-As a result the Encore Daemon must know where these two things exist on the filesystem in order to properly compile the Encore application.
-
-This must be done in one of two ways: embedding the installation path at compile time (similar to `GOROOT`)
-or by setting an environment variable at runtime.
-
-The environment variables are:
-- `ENCORE_GOROOT` – the path to encore-go on disk
-- `ENCORE_RUNTIME_PATH` – the path to the `encore.dev` runtime implementation.
-
-`ENCORE_RUNTIME_PATH` can be set to location of the `compiler/runtime` package in this repository,
-while `ENCORE_GOROOT` must be pointed to where `encore-go` was built.
-
-For more information on this see [cli/internal/env/env.go](cli/internal/env/env.go).
-
-## Architecture
-
-The code base is divided into several parts:
-
-### cli
-The `encore` command line interface. The encore background daemon
-is located at `cli/daemon` and is responsible for managing processes,
-setting up databases and talking with the Encore servers for operations like
-fetching production logs.
-
-### parser
-The Encore Parser statically analyzes Encore apps to build up a model
-of the application dubbed the Encore Syntax Tree (EST) that lives in
-`parser/est`.
-
-For speed the parser does not perform traditional type-checking; it does
-limited type-checking for enforcing Encore-specific rules but otherwise
-relies on the underlying Go compiler to perform type-checking as part of
-building the application.
-
-### compiler
-The Encore Compiler rewrites the source code based on the parsed
-Encore Syntax Tree to create a fully functioning application.
-It rewrites API calls & API handlers, injects instrumentation
-and secret values, and more.
\ No newline at end of file
diff --git a/README.md b/README.md
index 09ca89b986..98b159f113 100644
--- a/README.md
+++ b/README.md
@@ -1,216 +1,335 @@
-# Encore - The Go backend framework with superpowers
+<p align="center" dir="auto">
+<a href="https://encore.dev"><img src="https://user-images.githubusercontent.com/78424526/214602214-52e0483a-b5fc-4d4c-b03e-0b7b23e012df.svg" width="160px" alt="encore icon"></img></a><br/><br/><br/>
+<b>Open Source Framework for creating type-safe distributed systems with declarative infrastructure</b><br/>
+</p>
 
-<img align="right" width="189px" src="https://encore.dev/assets/img/encore-gopher.svg">
+- **Backend Frameworks:** [Encore.ts](https://encore.dev) and [Encore.go](https://encore.dev/go) simplify creating microservices and type-safe APIs, and provide an AI-ready declarative approach to define infrastructure in code.
+- **Local Development:** Encore's CLI automatically manages local infrastructure and provides a development dashboard with tracing, service catalog, and architecture diagrams.
+- **Infrastructure Integration:** Simplified integration with cloud infrastructure using the open source CLI ([learn more](https://encore.dev/docs/ts/self-host/build)), or using the optional [Encore Cloud](https://encore.cloud) platform to automate DevOps and infrastructure provisioning in your cloud on AWS and GCP.
 
-https://encore.dev
+**⭐ Star this repository** to help spread the word.
 
-Encore is a Go backend framework for rapidly creating APIs and distributed systems.
+**💿 Install Encore:**
+- **macOS:** `brew install encoredev/tap/encore`
+- **Linux:** `curl -L https://encore.dev/install.sh | bash`
+- **Windows:** `iwr https://encore.dev/install.ps1 | iex`
 
-It uses static analysis and code generation to reduce the boilerplate you have to write,
-resulting in an extremely productive developer experience.
+**🕹 Create your first app:**
+- **TypeScript:** `encore app create --example=ts/hello-world`
+- **Go:** `encore app create --example=hello-world`
 
-The key features of Encore are:
+**🤖 Add Encore LLM instructions to your app:**
+- **Encore.ts:** [ts_llm_instructions.txt](./ts_llm_instructions.txt)
+- **Encore.go:** [go_llm_instructions.txt](./go_llm_instructions.txt)
+- **How to use:**
+  - Cursor: Rename the file to `.cursorrules`.
+  - GitHub Copilot: Paste content in `.github/copilot-instructions.md`.
+  - For other tools, place the file in your app root.
+ 
+**⚡️ Build your first Encore.ts app with AI using Leap.new**
+- [**Leap**](https://leap.new) is an AI developer agent for building full-stack Encore.ts applications. It's the fastest way to build your first app.
 
-* **No boilerplate**: Encore drastically reduces the boilerplate needed to set up
-  a production ready backend application. Define backend services, API endpoints,
-  and call APIs with a single line of Go code. 
+**🧩 See example apps:** [Example Apps Repo](https://github.com/encoredev/examples/)
 
-* **Distributed Tracing**: Encore uses a combination of static analysis and code
-  generation to automatically instrument your application for excellent observability.
-  Automatically captures information about API calls, goroutines, HTTP requests,
-  database queries, and more. Automatically works for local development as well
-  as in production.
+**🚀 See products being build with Encore:** [Showcase](https://encore.cloud/showcase)
 
-* **Infrastructure Provisioning**: Encore understands how your application works,
-  and uses that understanding to provision and manage your cloud infrastructure.
-  Automatically works with all the major cloud providers, as well as for local development.
+**👋 Have questions?** Join the friendly developer community on [Discord](https://encore.dev/discord).
 
-* **Simple Secrets**: Encore makes it easy to store and securely use secrets and API keys. 
-  Never worry about how to store and get access to secret values again.
+**📞 Talk to a human:** [Book a 1:1 demo](https://encore.dev/book) with one of our founders.
 
-* **API Documentation**: Encore parses your source code to understand the request/response
-  schemas for all your APIs. Encore can automatically generate high-quality, interactive
-  API Documentation for you. It can also automatically generate type-safe, documented
-  clients for your frontends.
+## 🍿 Intro video
+[Watch the intro video](https://youtu.be/vvqTGfoXVsw) for a quick introduction to Encore concepts & code examples.
 
-**Read the complete documentation at [encore.dev/docs](https://encore.dev/docs).**
+<a href="https://youtu.be/vvqTGfoXVsw" target="_blank"><img width="589" alt="Encore Intro Video" src="https://github.com/encoredev/encore/assets/78424526/89737146-be48-429f-a83f-41bc8da37980"></a>
 
-## Quick Start
+## Introduction to Encore
 
-### Install
-```bash
-# macOS
-brew install encoredev/tap/encore
-# Linux
-curl -L https://encore.dev/install.sh | bash
-# Windows
-iwr https://encore.dev/install.ps1 | iex
-```
+Building scalable applications with cloud services is powerful but often frustrating. Developers face complex setups and repetitive tasks that slow them down.
 
-### Create your app
-```bash
-encore app create my-app
-cd my-app
-encore run
-```
+Encore solves this with an all-in-one backend development toolkit, streamlining everything from local testing to cloud integration and DevOps.
 
-### Deploy
-```bash
-git push encore
-```
+<p align="center">
+<img width="589" alt="Encore Overview" src="https://github.com/encoredev/encore/assets/78424526/ecb65a20-866c-449c-bf0e-e6d99c78430b">
+</p>
 
-#### Setup Demo
-[![Setup demo](https://asciinema.org/a/406681.svg)](https://asciinema.org/a/406681)
+### How it works
 
-## Superpowers
+Encore's open source backend frameworks [Encore.ts](https://encore.dev/docs/ts) and [Encore.go](https://encore.dev/docs/primitives/overview) enable you to define resources like services, databases, cron jobs, and Pub/Sub, as type-safe objects in your application code.
 
-Encore comes with tons of superpowers that radically simplify backend development compared to traditional frameworks:
+With the frameworks you only define **infrastructure semantics** — _the things that matter to your application's behavior_ — not configuration for _specific_ cloud services. Encore parses your application and builds a graph of both its logical architecture and its infrastructure requirements, it then automatically generates boilerplate and helps orchestrate the relevant infrastructure for each environment. This means the same application code can be used to run locally, test in preview environments, and deploy to cloud environments on e.g. AWS and GCP.
 
-- A state of the art developer experience with unmatched productivity
-- Define services, APIs, and make API calls with a single line of Go code
-- Autocomplete and get compile-time checks for API calls 
-- Generates beautiful API docs and API clients automatically
-- Instruments your app with Distributed Tracing, logs, and metrics – automatically
-- Runs serverlessly on Encore's cloud, or deploys to your own favorite cloud
-- Sets up dedicated Preview Environments for your pull requests
-- Supports flexible authentication 
-- Manages your databases and migrates them automatically
-- Provides an extremely simple yet secure secrets management
-- And lots more...
+This often removes the need for separate infrastructure configuration like Terraform, increases standardization in both your codebase and infrastructure, and makes your application highly portable across cloud providers.
 
-## Using Encore
+Encore is fully open source, there is **no proprietary code running in your application**.
 
-Encore makes it super easy to create backend services and APIs.
+### Example: Hello World
 
-### Creating a service with an API
+Defining microservices and API endpoints is incredibly simple—with less than 10 lines of code, you can create a production-ready, deployable service.
 
-In Encore, a backend service is just a regular Go package with one or more APIs defined.
-The Go package name becomes the service name (which must be unique within your app).
+**Hello World in Encore.ts**
 
-```go
-package greet
+```typescript
+import { api } from "encore.dev/api";
 
-import (
-    "context"
-    "fmt"
-)
+export const get = api(
+  { expose: true, method: "GET", path: "/hello/:name" },
+  async ({ name }: { name: string }): Promise<Response> => {
+    const msg = `Hello ${name}!`;
+    return { message: msg };
+  }
+);
 
-type Params struct {
-    Name string
+interface Response {
+  message: string;
 }
+```
 
-type Response struct {
-    Message string
+**Hello World in Encore.go**
+
+```go
+package hello
+
+//encore:api public path=/hello/:name
+func World(ctx context.Context, name string) (*Response, error) {
+	msg := fmt.Sprintf("Hello, %s!", name)
+	return &Response{Message: msg}, nil
 }
 
-//encore:api public
-func Person(ctx context.Context, params *Params) (*Response, error) {
-    msg := fmt.Sprintf("Hello, %s!", params.Name)
-    return &Response{Message: msg}, nil
+type Response struct {
+	Message string
 }
 ```
 
-This creates a backend service named `greet`, with a single API endpoint named `Person`.
+### Example: Using Pub/Sub
 
-Calling it is easy:
-```bash
-$ encore run  # run the app in a separate terminal
-$ curl http://localhost:4060/greet.Person -d '{"Name": "Jane"}'
-# Outputs: {"Message": "Hello, Jane!"}
-```
+If you want a Pub/Sub Topic, you declare it directly in your application code and Encore will integrate the infrastructure and generate the boilerplate code necessary.
+Encore supports the following Pub/Sub infrastructure:
+- **NSQ** for local environments (automatically provisioned by Encore's CLI)
+- **GCP Pub/Sub** for environments on GCP
+- **SNS/SQS** for environments on AWS
 
-[Learn more in the Encore docs](https://encore.dev/docs/concepts/services-and-apis).
+**Using Pub/Sub in Encore.ts**
 
-### Calling an API endpoint
-Calling an API endpoint from another endpoint is easy.
+```typescript
+import { Topic } "encore.dev/pubsub"
 
-Just import the service (with a regular Go import), and then call the function
-as if it were a regular Go function:
+export interface SignupEvent {
+    userID: string;
+}
+
+export const signups = new Topic<SignupEvent>("signups", {
+    deliveryGuarantee: "at-least-once",
+});
+```
+
+**Using Pub/Sub in Encore.go**
 
 ```go
-import "my.app/greet"
-
-func MyAPI(ctx context.Context) error {
-    resp, err := greet.Person(ctx, &greet.Params{Name: "John"})
-    if err != nil {
-        fmt.Println("The greeting message is:", resp.Message)
-    }
-    return err
-}
+import "encore.dev/pubsub"
+
+type User struct { /* fields... */ }
+
+var Signup = pubsub.NewTopic[*User]("signup", pubsub.TopicConfig{
+  DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+
+// Publish messages by calling a method
+Signup.Publish(ctx, &User{...})
 ```
 
-Encore uses its static analysis and code generation to turn this into a proper API call.
+### Learn more in the docs
 
-[Learn more in the Encore docs](https://encore.dev/docs/concepts/services-and-apis).
+See how to use the backend frameworks in the docs:
 
-### SQL Databases
+- **Services:** [Go](https://encore.dev/docs/go/primitives/services) / [TypeScript](https://encore.dev/docs/ts/primitives/services)
+- **APIs:** [Go](https://encore.dev/docs/go/primitives/defining-apis) / [TypeScript](https://encore.dev/docs/ts/primitives/defining-apis)
+- **Databases:** [Go](https://encore.dev/docs/go/primitives/databases) / [TypeScript](https://encore.dev/docs/ts/primitives/databases)
+- **Cron Jobs:** [Go](https://encore.dev/docs/go/primitives/cron-jobs) / [TypeScript](https://encore.dev/docs/ts/primitives/cron-jobs)
+- **Pub/Sub:** [Go](https://encore.dev/docs/go/primitives/pubsub) / [TypeScript](https://encore.dev/docs/ts/primitives/pubsub)
+- **Object Storage:** [Go](https://encore.dev/docs/go/primitives/object-storage) / [TypeScript](https://encore.dev/docs/ts/primitives/object-storage)
+- **Caching:** [Go](https://encore.dev/docs/go/primitives/caching) / TypeScript (Coming soon)
 
-Encore automatically provisions, connects to, and performs schema migrations of SQL databases for you.
 
-All you have to do is define the SQL migrations:
+## Using Encore: An end-to-end workflow from local to cloud
 
-```sql
--- greet/migrations/1_create_table.up.sql
-CREATE TABLE person (
-    name TEXT PRIMARY KEY,
-    count INT NOT NULL
-);
-```
+Encore provides purpose-built tooling for each step in the development process, from local development and testing, to cloud DevOps. Here we'll cover the key features for each part of the process.
 
-Then import `encore.dev/storage/sqldb` and just start querying:
+### Local Development
 
-```go
-// genGreeting generates a personalized greeting for the given name.
-func genGreeting(ctx context.Context, name string) (string, error) {
-    var count int
-    // Insert the row, and increment count if the row is already in the db.
-    err := sqldb.QueryRow(ctx, `
-        INSERT INTO "person" (name, count)
-        VALUES ($1, 1)
-        ON CONFLICT (name) DO UPDATE
-        SET count = person.count + 1
-        RETURNING count
-    `, name).Scan(&count)
-    if err != nil {
-        return "", err
-    }
-
-    switch count {
-    case 1:
-        return fmt.Sprintf("Nice to meet you, %s!", name), nil
-    case 2:
-        return fmt.Sprintf("Hi again, %s!", name), nil
-    default:
-        return fmt.Sprintf("Good to see you, %s! We've met %d times before.", name, count-1), nil
-    }
-}
-```
+<p align="center">
+<img width="578" alt="Local Development" src="https://github.com/encoredev/encore/assets/78424526/6bf682bb-f57e-4a02-9c92-ff83f7fb59d2">
+</p>
+
+When you run your app locally using the [Encore CLI](https://encore.dev/docs/install), Encore parses your code and automatically sets up the necessary local infrastructure on the fly. _No more messing around with Docker Compose!_
+
+You also get built-in tools for an efficient workflow when creating distributed systems and event-driven applications:
+
+- **Local environment matches cloud:** Encore automatically handles the semantics of service communication and interfacing with different types of infrastructure services, so that the local environment is a 1:1 representation of your cloud environment.
+- **Cross-service type-safety:** When building microservices applications with Encore, you get type-safety and auto-complete in your IDE when making cross-service API calls.
+- **Type-aware infrastructure:** With Encore, infrastructure like Pub/Sub queues are type-aware objects in your program. This enables full end-to-end type-safety when building event-driven applications.
+- **Secrets management:** Built-in [secrets management](https://encore.dev/docs/ts/primitives/secrets) for all environments.
+- **Tracing:** The [local development dashboard](https://encore.dev/docs/ts/observability/dev-dash) provides local tracing to help understand application behavior and find bugs.
+- **Automatic API docs & clients:** Encore generates [API docs](https://encore.dev/docs/ts/obsevability/service-catalog) and [API clients](https://encore.dev/docs/ts/cli/client-generation) in Go, TypeScript, JavaScript, and OpenAPI specification.
+
+_Here's a video showing the local development dashboard:_
+
+https://github.com/encoredev/encore/assets/78424526/4d066c76-9e6c-4c0e-b4c7-6b2ba6161dc8
+
+### Testing
+
+<p align="center">
+<img width="573" alt="testing" src="https://github.com/encoredev/encore/assets/78424526/516a043c-66ac-464e-a4ca-f8ecd5642d54">
+</p>
+
+Encore comes with several built-in tools to help with testing:
+
+- **Built-in service/API mocking:** Encore provides built-in support for [mocking API calls](https://encore.dev/docs/go/develop/testing/mocking), and interfaces for automatically generating mock objects for your services.
+- **Local test infra:** When running tests locally, Encore automatically provides dedicated [test infrastructure](https://encore.dev/docs/go/develop/testing#test-only-infrastructure) to isolate individual tests.
+- **Local test tracing:** The [Local Development Dashboard](https://encore.dev/docs/ts/observability/dev-dash) provides distributed tracing for tests, providing great visibility into what's happening and making it easier to understand why a test failed.
+- **Preview Environments:** When using Encore Cloud (optional), it automatically provisions a temporary cloud-based [Preview Environment](https://encore.dev/docs/platform/deploy/preview-environments) for each Pull Request, an effective tool when doing end-to-end testing.
+
+### Optional: Automate your AWS/GCP with Encore Cloud
+
+<p align="center">
+<img width="573" alt="DevOps" src="https://github.com/encoredev/encore/assets/78424526/e00d3e92-3301-4f3a-89cc-575c4a520aae">
+</p>
+
+Encore Cloud is Encore's managed service offering for teams wanting to focus their engineering effort on their product development, avoiding investing time in platformization and DevOps.
+
+Encore Cloud provides **automatic infrastructure provisioning in your cloud on AWS & GCP**. So instead of writing Terraform, YAML, or clicking in cloud consoles, you [connect your cloud account](https://encore.dev/docs/platform/deploy/own-cloud) and simply deploy your application. Since using Encore's open source backend frameworks means your application code is cloud agnostic and not tied to any specific infrastructure services, Encore Cloud enables you to change your infrastructure depending on your evolving needs, without needing to make code changes or manually update infrastructure config files.
+
+When you deploy, Encore Cloud automatically provisions [infrastructure](https://encore.dev/docs/platform/infrastructure/infra) using battle-tested cloud services on AWS and GCP, such as:
+- **Compute:** GCP Cloud Run, AWS Fargate, Kubernetes (GKE and EKS)
+- **Databases:** GCP Cloud SQL, AWS RDS
+- **Pub/Sub:** GCP Pub/Sub, AWS SQS/SNS
+- **Caches:** GCP Memorystore, Amazon ElastiCache
+- **Object Storage:** GCS, Amazon S3
+- **Secrets:**	GCP Secret Manager, AWS Secrets Manager
+- Etc.
+
+Encore Cloud also includes cloud versions of Encore's built-in development tools:
+
+- [Service Catalog & API Docs](https://encore.dev/docs/ts/observability/service-catalog)
+- [Architecture Diagrams](https://encore.dev/docs/ts/observability/flow)
+- [Tracing](https://encore.dev/docs/ts/observability/tracing)
+
+_Here's a video showing the Encore Cloud dashboard:_
+
+https://github.com/encoredev/encore/assets/78424526/8116b387-d4d4-4e54-8768-3686ba0245f5
+
+## Why use Encore?
+
+- **Faster Development**: Encore streamlines the development process with its backend frameworks, clear abstractions, and built-in local development tools.
+- **Scalability & Performance**: Encore simplifies building large-scale microservices applications that can handle growing user bases and demands, without the normal boilerplate and complexity.
+- **Control & Standardization**: Built-in tools like automated architecture diagrams, infrastructure tracking and approval workflows, make it easy for teams and leaders to get an overview of the entire application.
+- **Security & Compliance**: Encore Cloud helps ensure your application is secure and compliant by enforcing security standards like least privilege IAM, and provisioning infrastructure according to best practices for each cloud provider.
+- **Reduced Costs**: Encore Cloud's automatic infrastructure management minimizes wasteful cloud expenses and reduces DevOps workload, allowing you to work more efficiently.
+
+## Common use cases
+
+Encore is designed to give teams a productive and less complex experience when solving most backend use cases. Many teams use Encore to build things like:
+
+-   High-performance B2B Platforms
+-   Fintech & Consumer apps
+-   Global E-commerce marketplaces
+-   Microservices backends for SaaS applications and mobile apps
+-   And much more...
+
+## Getting started
+
+- **1. Install Encore:**
+  - **macOS:** `brew install encoredev/tap/encore`
+  - **Linux:** `curl -L https://encore.dev/install.sh | bash`
+  - **Windows:** `iwr https://encore.dev/install.ps1 | iex`
+- **2. Create your first app:**
+  - **TypeScript:** `encore app create --example=ts/introduction`
+  - **Go:** `encore app create --example=hello-world`
+- **3. Star the project** on [GitHub](https://github.com/encoredev/encore) to stay up-to-date
+- **4. Explore the [Documentation](https://encore.dev/docs)** to learn more about Encore's features
+- **5. [Join Discord](https://encore.dev/discord)** to ask questions and meet other Encore developers
+
+## Open Source
+
+Everything needed to develop and deploy Encore applications is Open Source, including the backend frameworks, parser, compiler, runtime, and CLI.
+This includes all code needed for local development and everything that runs in your application when it is deployed.
+
+The Open Source CLI also provides a mechanism to generate a Docker images for your application, so you easily self-host your application. [Learn more in the docs](https://encore.dev/docs/ts/self-host/build).
+
+## Join the most pioneering developer community
+
+Developers building with Encore are forward-thinkers who want to focus on creative programming and building great software to solve meaningful problems. It's a friendly place, great for exchanging ideas and learning new things! **Join the conversation on [Discord](https://encore.dev/discord).**
+
+We rely on your contributions and feedback to improve Encore for everyone who is using it.
+Here's how you can contribute:
+
+- ⭐ **Star and watch this repository to help spread the word and stay up to date.**
+- Meet fellow Encore developers and chat on [Discord](https://encore.dev/discord).
+- Follow Encore on [Twitter](https://twitter.com/encoredotdev).
+- Share feedback or ask questions via [email](mailto:hello@encore.dev).
+- Leave feedback on the [Public Roadmap](https://encore.dev/roadmap).
+- Send a pull request here on GitHub with your contribution.
+
+## Videos
+
+- <a href="https://youtu.be/vvqTGfoXVsw" alt="Intro video: Encore concepts & features" target="_blank">Intro: Encore concepts & features</a>
+- <a href="https://youtu.be/wiLDz-JUuqY" alt="Demo video: Getting started with Encore.ts" target="_blank">Demo video: Getting started with Encore.ts</a>
+- <a href="https://youtu.be/IwplIbwJtD0" alt="Demo video: Building and deploying a simple service" target="_blank">Demo: Building and deploying a simple Go service</a>
+- <a href="https://youtu.be/ipj1HdG4dWA" alt="Demo video: Building an event-driven system" target="_blank">Demo: Building an event-driven system in Go</a>
+
+## Visuals
+
+### Code example (Go)
+
+https://github.com/encoredev/encore/assets/78424526/f511b3fe-751f-4bb8-a1da-6c9e0765ac08
+
+### Local Development Dashboard
+
+https://github.com/encoredev/encore/assets/78424526/4c659fb8-e9ec-4f14-820b-c2b8d35e5359
+
+### Generated Architecture Diagrams & Service Catalog
+
+https://github.com/encoredev/encore/assets/78424526/a880ed2d-e9a6-4add-b5a8-a4b44b97587b
+
+### Auto-Provisioning Infrastructure & Multi-cloud Deployments
+
+https://github.com/encoredev/encore/assets/78424526/8116b387-d4d4-4e54-8768-3686ba0245f5
+
+### Distributed Tracing & Metrics
+
+https://github.com/encoredev/encore/assets/78424526/35189335-e3d7-4046-bab0-1af0f00d2504
+
+## Frequently Asked Questions (FAQ)
+
+### Who's behind Encore?
+
+Encore was founded by long-time backend engineers from Spotify, Google, and Monzo with over 50 years of collective experience. We’ve lived through the challenges of building complex distributed systems with thousands of services, and scaling to hundreds of millions of users.
+
+Encore grew out of these experiences and is a solution to the frustrations that came with them: unnecessary crippling complexity and constant repetition of undifferentiated work that suffocates the developer’s creativity. With Encore, we want to set developers free to achieve their creative potential.
+
+### Who is Encore for?
 
-#### Database Demo
-[![Setting up a database](https://asciinema.org/a/406695.svg)](https://asciinema.org/a/406695)
+**For individual developers** building for the cloud, Encore provides a radically improved experience. With Encore you’re able to stay in the flow state and experience the joy and creativity of building.
 
-[Learn more in the Encore docs](https://encore.dev/docs/concepts/databases).
+**For startup teams** who need to build a scalable backend to support the growth of their product, Encore lets them get up and running in the cloud within minutes. It lets them focus on solving the needs of their users, instead of spending most of their time re-solving the everyday challenges of building distributed systems in the cloud.
 
-### API Documentation
+**For individual teams in large organizations** that want to focus on innovating and building new features, Encore lets them stop spending time on operations and onboarding new team members. Using Encore for new feature development is easy, just spin up a new backend service in a few minutes.
 
-Encore automatically generates API documentation for your app.
+### How is Encore different?
 
-You can access it by viewing the local development dashboard by opening the API URL
-in your browser when your app is running (normally [localhost:4060](http://localhost:4060)).
+Encore is the only tool that understands what you’re building. Encore uses static analysis to deeply understand the application you’re building. This enables a unique developer experience that helps you stay in the flow as you’re building. For instance, you don't need to bother with configuring and managing infrastructure, setting up environments and keeping them in sync, or writing documentation and drafting architecture diagrams. Encore does all of this automatically out of the box.
 
-[![API Documentation](https://encore.dev/assets/img/api-docs-screenshot.png)](https://encore.dev/docs/concepts/api-docs)
+### Why does Encore provide infrastructure integrations through Encore Cloud?
 
-### Distributed Tracing
+We've found that to meaningfully improve the developer experience, you have to operate across the full stack. Unless you understand how an application is deployed, there are a large number of things in the development process that you can't simplify. That's why so many other developer tools have such a limited impact. With Encore's more integrated approach, we're able to unlock a radically better experience for developers.
 
-Encore automatically instruments your app with Distributed Tracing.
+### What if I want to migrate away from Encore?
 
-For local development you can access it by viewing the local development dashboard by opening the API URL
-in your browser when your app is running (normally [localhost:4060](http://localhost:4060)).
+Encore is designed to let you go outside of the framework when you want to, and easily drop down in abstraction level when you need to, so you never run into any dead-ends.
 
-Any API calls to your app automatically produces traces.
+Should you want to migrate away, it's straightforward and does not require a big rewrite. 99% of your code is regular Go or TypeScript.
 
-![Automatic Tracing](https://encore.dev/assets/img/tracing.jpg)
+Encore provides tools for [self-hosting](https://encore.dev/docs/ts/self-host/build) your application, by using the Open Source CLI to produce a standalone Docker image that can be deployed anywhere you'd like.
 
-## Developing Encore and building from source
+## Contributing to Encore and building from source
 
-See [DEVELOPING.md](DEVELOPING.md).
\ No newline at end of file
+See [CONTRIBUTING.md](CONTRIBUTING.md).
diff --git a/check.bash b/check.bash
new file mode 100755
index 0000000000..d5d5e66557
--- /dev/null
+++ b/check.bash
@@ -0,0 +1,189 @@
+#!/usr/bin/env bash
+#
+# This script will run the same checks as Encore's CI pipeline and report the same static analysis errors
+# as the pipeline by default. It can be used to check for what errors might be reported by the pipeline
+# before you commit and open a PR.
+#
+# Usage:
+#   ./check.bash [options]
+#
+# Options:
+#   --base <ref>         The merge base to compare against (default: origin/main)
+#   --diff               Show the diff against base instead of running the checks
+#   --filter-mode <mode> The filter mode to use for reviewdog; added, file, diff_context, nofilter (default: file)
+#   --all                Alias for `--filter-mode nofilter` (runs checks against all files in the working directory)
+#
+# Examples:
+#
+#   # Run the checks against files changed since branching from origin/main
+#   # (This is the default behavior and what our CI process does)
+#   ./check.bash
+#
+#   # Show the diff between the current working directory and origin/main
+#   ./check.bash --diff
+#
+#   # Run the checks against the entire working directory (regardless of changes made)
+#   ./check.bash --all
+
+
+##############################################################################################################################
+# Step 0: Setup the script with basic error handling                                                                         #
+##############################################################################################################################
+
+  set -euo pipefail
+  # nosemgrep
+  IFS=$'\n\t'
+
+  function errHandler() {
+    echo "Exiting due to an error line $1" >&2
+    echo "" >&2
+    awk 'NR>L-4 && NR<L+4 { printf "%-5d%3s%s\n",NR,(NR==L?">> ":""),$0 }' L="$1" "$0" >&2
+  }
+  trap 'errHandler $LINENO' ERR
+
+
+##############################################################################################################################
+# Step 1: Configure the script with the parameters the use wants                                                             #
+##############################################################################################################################
+
+  # Parameters
+  WORK_DIR=$( dirname "${BASH_SOURCE[0]}" ) # Get the directory this script is in
+  BASE_REF="origin/main"                    # The merge base to compare against
+  DIFF_ONLY="false"                         # If true, show the diff instead of running the checks
+  FILTER_MODE="file"                        # The filter mode to use for reviewdog (added, file, diff_context, nofilter)
+
+  # Parse the command line arguments
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --base)
+        BASE_REF="$2"
+        shift 2
+        ;;
+      --diff)
+        DIFF_ONLY="true"
+        shift 1
+        ;;
+      --filter-mode)
+        FILTER_MODE="$2"
+        shift 2
+        ;;
+      --all)
+        FILTER_MODE="nofilter"
+        shift 1
+        ;;
+      *)
+        echo "Unknown argument: $1"
+        exit 1
+        ;;
+    esac
+  done
+
+
+##############################################################################################################################
+# Step 2: Check for required tools and error out if anything is missing which we can't install for the user                  #
+##############################################################################################################################
+
+  # Check for tools we can't install using go
+  command -v go >/dev/null 2>&1 || { echo >&2 "go is required but not installed. Aborting."; exit 1; }
+  command -v git >/dev/null 2>&1 || { echo >&2 "git is required but not installed. Aborting."; exit 1; }
+  command -v sed >/dev/null 2>&1 || { echo >&2 "sed is required but not installed. Aborting."; exit 1; }
+  command -v semgrep >/dev/null 2>&1 || { echo >&2 "semgrep is required but not installed. Aborting."; exit 1; }
+
+  # Now install all missing tools
+  command -v reviewdog >/dev/null 2>&1 || go install github.com/reviewdog/reviewdog/cmd/reviewdog@latest || { echo >&2 "Unable to install reviewdog. Aborting."; exit 1; }
+  command -v staticcheck >/dev/null 2>&1 || go install honnef.co/go/tools/cmd/staticcheck@latest || { echo >&2 "Unable to install staticcheck. Aborting."; exit 1; }
+  command -v errcheck >/dev/null 2>&1 || go install github.com/kisielk/errcheck@latest || { echo >&2 "Unable to install errcheck. Aborting."; exit 1; }
+  command -v ineffassign >/dev/null 2>&1 || go install github.com/gordonklaus/ineffassign@latest || { echo >&2 "Unable to install ineffassign. Aborting."; exit 1; }
+
+
+##############################################################################################################################
+# Step 3: Create a diff of the changes in the working directory against the common ancestor of the current branch and main   #
+#         This will be used to run static analysis checks on only the files that have changed. This diff should mimic the    #
+#         diff that would be created by GitHub when all current changes are committed and pushed into a PR on GitHub.        #
+##############################################################################################################################
+
+  # Don't generate the diff if we don't need it to filter!
+  if [[ "$FILTER_MODE" != "nofilter" ]]; then
+
+    # Create a temp directory to store the common ancestor commit
+    TMP_DIR=$(mktemp -d)
+    if [[ ! "$TMP_DIR" || ! -d "$TMP_DIR" ]]; then
+      echo "Could not create temp dir"
+      exit 1
+    fi
+
+    # Create a temp file to store the diff we need
+    DIFF_FILE=$(mktemp)
+    if [[ ! "$DIFF_FILE" || ! -f "$DIFF_FILE" ]]; then
+      echo "Could not create temp diff file"
+      exit 1
+    fi
+
+    # Create a blank file to use as a comparison when a file is missing because either it's new or been deleted
+    BLANK_FILE=$(mktemp)
+    if [[ ! "$BLANK_FILE" || ! -f "$BLANK_FILE" ]]; then
+      echo "Could not create blank file"
+      exit 1
+    fi
+
+    # Clean up on exit and delete all the temp files we just created
+    function cleanup() {
+      rm -rf "$TMP_DIR"
+      rm -f "$DIFF_FILE"
+      rm -f "$BLANK_FILE"
+    }
+    trap cleanup EXIT
+
+    # Clone the repo into the temp directory
+    git clone -q "$WORK_DIR" "$TMP_DIR"
+
+    # Change our temp directory to be a clean copy of the common ancestor commit
+    pushd "$TMP_DIR" > /dev/null
+    git reset -q --hard HEAD
+    git checkout -q "$(git merge-base "$BASE_REF" HEAD)"
+    TRACKED_FILES_FROM_MAIN=$(git ls-files)
+    popd > /dev/null
+
+    # Create a list of files that we care about
+    MODIFICATIONS_IN_WORKING_DIR=$(git status --short | awk '{print $2}')
+    TRACKED_FILES_IN_WORKING_DIR=$(git ls-files)
+    ALL_FILES=$(echo "$TRACKED_FILES_IN_WORKING_DIR $MODIFICATIONS_IN_WORKING_DIR $TRACKED_FILES_FROM_MAIN" | tr ' ' '\n' | sort -u)
+
+    # Create a diff of the changes in the working directory against the common ancestor of the current branch and main
+    for file in $ALL_FILES; do
+      # If the original file doesn't exist, use a blank file instead
+      # (This means it was a new file that was added in the current version of the code base)
+      ORIGINAL_FILE="$TMP_DIR/$file"
+      if [[ ! -f "$ORIGINAL_FILE" ]]; then
+        ORIGINAL_FILE="$BLANK_FILE"
+      fi
+
+      # If the updated file doesn't exist, use a blank file instead
+      # (This means the file was deleted in the current version of the code base)
+      UPDATED_FILE="$WORK_DIR/$file"
+      if [[ ! -f "$UPDATED_FILE" ]]; then
+        UPDATED_FILE="$BLANK_FILE"
+      fi
+
+      # Run git diff between the original file and the updated file
+      # Replace the file paths in the diff to match the relative path in the working directory
+      # Then write the diff into our diff file
+      git diff "$ORIGINAL_FILE" "$UPDATED_FILE" | sed "s|$ORIGINAL_FILE|/$file|g" | sed "s|$UPDATED_FILE|/$file|g" >> "$DIFF_FILE" || true # Suppress the exit code
+    done
+
+    if [[ "$DIFF_ONLY" == "true" ]]; then
+      cat "$DIFF_FILE"
+      exit 0
+    fi
+  fi
+
+
+##############################################################################################################################
+# Step 4: Run review dog using the diff we just created, allowing reviewdog to only show errors from changes we've made      #
+##############################################################################################################################
+
+  if [[ "$FILTER_MODE" == "nofilter" ]]; then
+    reviewdog -filter-mode=nofilter
+  else
+    reviewdog -filter-mode="$FILTER_MODE" -diff="cat $DIFF_FILE"
+  fi
diff --git a/cli/cmd/encore/app.go b/cli/cmd/encore/app.go
deleted file mode 100644
index 3124deec05..0000000000
--- a/cli/cmd/encore/app.go
+++ /dev/null
@@ -1,628 +0,0 @@
-package main
-
-import (
-	"archive/tar"
-	"bytes"
-	"compress/gzip"
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"io/ioutil"
-	"net/http"
-	"net/url"
-	"os"
-	"os/exec"
-	"path"
-	"path/filepath"
-	"strings"
-	"time"
-
-	"encr.dev/cli/internal/conf"
-	"github.com/AlecAivazis/survey/v2"
-	"github.com/briandowns/spinner"
-	"github.com/fatih/color"
-	"github.com/spf13/cobra"
-	"github.com/tailscale/hujson"
-)
-
-func init() {
-	appCmd := &cobra.Command{
-		Use:   "app",
-		Short: "Commands to create and link Encore apps",
-	}
-	rootCmd.AddCommand(appCmd)
-
-	var createAppTemplate string
-
-	createAppCmd := &cobra.Command{
-		Use:   "create [name]",
-		Short: "Create a new Encore app",
-		Args:  cobra.MaximumNArgs(1),
-		Run: func(cmd *cobra.Command, args []string) {
-			name := ""
-			if len(args) > 0 {
-				name = args[0]
-			}
-			if err := createApp(context.Background(), name, createAppTemplate); err != nil {
-				fatal(err)
-			}
-		},
-	}
-	appCmd.AddCommand(createAppCmd)
-	createAppCmd.Flags().StringVar(&createAppTemplate, "example", "", "URL to example code to use.")
-
-	var forceLink bool
-	linkAppCmd := &cobra.Command{
-		Use:   "link [app-id]",
-		Short: "Link an Encore app with the server",
-		Args:  cobra.MaximumNArgs(1),
-		Run: func(cmd *cobra.Command, args []string) {
-			var appID string
-			if len(args) > 0 {
-				appID = args[0]
-			}
-			linkApp(appID, forceLink)
-		},
-	}
-	appCmd.AddCommand(linkAppCmd)
-	linkAppCmd.Flags().BoolVarP(&forceLink, "force", "f", false, "Force link even if the app is already linked.")
-
-	cloneAppCmd := &cobra.Command{
-		Use:   "clone [app-id] [directory]",
-		Short: "Clone an Encore app to your computer",
-		Args:  cobra.MinimumNArgs(1),
-		Run: func(c *cobra.Command, args []string) {
-			cmdArgs := append([]string{"clone", "encore://" + args[0]}, args[1:]...)
-			cmd := exec.Command("git", cmdArgs...)
-			cmd.Stdin = os.Stdin
-			cmd.Stdout = os.Stdout
-			cmd.Stderr = os.Stderr
-			if err := cmd.Run(); err != nil {
-				os.Exit(1)
-			}
-		},
-	}
-	appCmd.AddCommand(cloneAppCmd)
-}
-
-// createApp is the implementation of the "encore app create" command.
-func createApp(ctx context.Context, name, template string) (err error) {
-	yellow := color.New(color.FgYellow)
-	cyan := color.New(color.FgCyan)
-	green := color.New(color.FgGreen)
-
-	if _, err := conf.CurrentUser(); errors.Is(err, fs.ErrNotExist) {
-		var loginNow bool
-		cyan.Fprintln(os.Stderr, "You are not logged in to encore.dev.")
-		survey.AskOne(&survey.Confirm{
-			Message: cyan.Sprint("Log in now to automatically link your app with encore.dev?"),
-			Default: true,
-		}, &loginNow)
-		if loginNow {
-			if err := doLogin(); err != nil {
-				fatal(err)
-			}
-		} else {
-			yellow.Fprintln(os.Stderr, "Continuing without logging in. You can manually link your app later using `encore app link`.")
-		}
-	}
-
-	if name == "" {
-		survey.AskOne(&survey.Input{
-			Message: "App Name (lowercase letters, digits, and dashes)",
-		}, &name, survey.WithValidator(func(in interface{}) error { return validateName(in.(string)) }))
-	}
-
-	if err := validateName(name); err != nil {
-		return err
-	} else if _, err := os.Stat(name); err == nil {
-		return fmt.Errorf("directory %s already exists", name)
-	}
-
-	if template == "" {
-		var idx int
-
-		dockerMsg := ""
-		if _, err := exec.LookPath("docker"); err != nil {
-			dockerMsg = " [requires Docker]"
-		}
-		prompt := &survey.Select{
-			Message: "Select app template:",
-			Options: []string{
-				"Trello clone" + dockerMsg,
-				"Hello World",
-				"Empty app",
-			},
-		}
-		survey.AskOne(prompt, &idx)
-		switch idx {
-		case 0:
-			template = "trello-clone"
-		case 1:
-			template = "hello-world"
-		case 2:
-			template = ""
-		}
-	}
-
-	// Parse template information, if provided.
-	var ex *repoInfo
-	if template != "" {
-		var err error
-		ex, err = parseTemplate(ctx, template)
-		if err != nil {
-			return err
-		}
-	}
-
-	if err := os.Mkdir(name, 0755); err != nil {
-		return err
-	}
-	defer func() {
-		if err != nil {
-			// Clean up the directory we just created in case of an error.
-			os.RemoveAll(name)
-		}
-	}()
-
-	if ex != nil {
-		s := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
-		s.Prefix = fmt.Sprintf("Downloading template %s ", ex.Name)
-		s.Start()
-		err := downloadAndExtractTemplate(ctx, name, *ex)
-		s.Stop()
-		fmt.Println()
-
-		if err != nil {
-			return fmt.Errorf("failed to download template %s: %v", ex.Name, err)
-		}
-		gray := color.New(color.Faint)
-		gray.Printf("Downloaded template %s.\n", ex.Name)
-	} else {
-		// Set up files that we need when we don't have an example
-		if err := ioutil.WriteFile(filepath.Join(name, ".gitignore"), []byte("/.encore\n"), 0644); err != nil {
-			fatal(err)
-		}
-		encoreModData := []byte("module encore.app\n")
-		if err := ioutil.WriteFile(filepath.Join(name, "go.mod"), encoreModData, 0644); err != nil {
-			fatal(err)
-		}
-	}
-
-	// Create the app on the server.
-	_, err = conf.CurrentUser()
-	loggedIn := err == nil
-
-	var app *appConf
-	if loggedIn {
-		s := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
-		s.Prefix = "Creating app on encore.dev "
-		s.Start()
-		app, err = createAppOnServer(name)
-		s.Stop()
-		if err != nil {
-			return fmt.Errorf("creating app on encore.dev: %v", err)
-		}
-	}
-
-	// Create the encore.app file
-	var encoreAppData []byte
-	if loggedIn {
-		encoreAppData = []byte(`{
-	"id": "` + app.Slug + `",
-}
-`)
-	} else {
-		encoreAppData = []byte(`{
-	// The app is not currently linked to the encore.dev platform.
-	// Use "encore app link" to link it.
-	"id": "",
-}
-`)
-	}
-	if err := ioutil.WriteFile(filepath.Join(name, "encore.app"), encoreAppData, 0644); err != nil {
-		return err
-	}
-
-	if err := initGitRepo(name, app); err != nil {
-		return err
-	}
-
-	green.Printf("\nSuccessfully created app %s!\n", name)
-	cyanf := cyan.SprintfFunc()
-	if app != nil {
-		fmt.Printf("App ID:  %s\n", cyanf(app.Slug))
-		fmt.Printf("Web URL: %s%s", cyanf("https://app.encore.dev/"+app.Slug), newline)
-	}
-
-	fmt.Print("\nUseful commands:\n\n")
-
-	cyan.Printf("    encore run\n")
-	fmt.Print("        Run your app locally\n\n")
-
-	cyan.Printf("    encore test ./...\n")
-	fmt.Print("        Run tests\n\n")
-
-	if app != nil {
-		cyan.Printf("    git push encore\n")
-		fmt.Print("        Deploys your app\n\n")
-	}
-
-	greenBoldF := green.Add(color.Bold).SprintfFunc()
-	fmt.Printf("Get started now: %s\n", greenBoldF("cd %s && encore run", name))
-
-	return nil
-}
-
-func validateName(name string) error {
-	ln := len(name)
-	if ln == 0 {
-		return fmt.Errorf("name must not be empty")
-	} else if ln > 50 {
-		return fmt.Errorf("name too long (max 50 chars)")
-	}
-
-	for i, s := range name {
-		// Outside of [a-z], [0-9] and != '-'?
-		if !((s >= 'a' && s <= 'z') || (s >= '0' && s <= '9') || s == '-') {
-			return fmt.Errorf("name must only contain lowercase letters, digits, or dashes")
-		} else if s == '-' {
-			if i == 0 {
-				return fmt.Errorf("name cannot start with a dash")
-			} else if (i + 1) == ln {
-				return fmt.Errorf("name cannot end with a dash")
-			} else if name[i-1] == '-' {
-				return fmt.Errorf("name cannot contain repeated dashes")
-			}
-		}
-	}
-	return nil
-}
-
-type appConf struct {
-	Slug          string  `json:"slug"`
-	DefaultBranch *string `json:"main_branch"`
-}
-
-func createAppOnServer(name string) (*appConf, error) {
-	if _, err := conf.CurrentUser(); err != nil {
-		return nil, err
-	}
-
-	url := "https://api.encore.dev/apps"
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	reqData, _ := json.Marshal(map[string]string{"Name": name})
-	req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(reqData))
-	if err != nil {
-		return nil, err
-	}
-	req.Header.Set("Content-Type", "application/json")
-	var respData struct {
-		Data appConf
-	}
-	err = slurpJSON(req, &respData)
-	return &respData.Data, err
-}
-
-func validateAppID(id string) (ok bool, err error) {
-	if _, err := conf.CurrentUser(); errors.Is(err, fs.ErrNotExist) {
-		fatal("not logged in. Run 'encore auth login' first.")
-	} else if err != nil {
-		return false, err
-	}
-
-	url := "https://api.encore.dev/apps/" + url.PathEscape(id)
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	req, err := http.NewRequestWithContext(ctx, "POST", url, nil)
-	if err != nil {
-		return false, err
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	client := conf.AuthClient()
-	resp, err := client.Do(req)
-	if err != nil {
-		return false, err
-	}
-	defer resp.Body.Close()
-	switch resp.StatusCode {
-	case 200:
-		return true, nil
-	case 404:
-		return false, nil
-	default:
-		body, _ := ioutil.ReadAll(resp.Body)
-		return false, fmt.Errorf("server responded with HTTP %s: %s", resp.Status, body)
-	}
-}
-
-type repoInfo struct {
-	Owner  string
-	Repo   string
-	Branch string
-	Path   string // subdirectory to copy ("." for whole project)
-	Name   string // example name
-}
-
-func parseTemplate(ctx context.Context, tmpl string) (*repoInfo, error) {
-	switch {
-	case strings.HasPrefix(tmpl, "http"):
-		// Already an URL; do nothing
-	case strings.HasPrefix(tmpl, "github.com"):
-		// Assume a URL without the scheme
-		tmpl = "https://" + tmpl
-	default:
-		// Simple template name
-		tmpl = "https://github.com/encoredev/examples/tree/main/" + tmpl
-	}
-
-	u, err := url.Parse(tmpl)
-	if err != nil {
-		return nil, fmt.Errorf("invalid template: %v", err)
-	}
-	if u.Host != "github.com" {
-		return nil, fmt.Errorf("template must be hosted on GitHub, not %s", u.Host)
-	}
-	// Path must be one of:
-	// "/owner/repo"
-	// "/owner/repo/tree/<branch>"
-	// "/owner/repo/tree/<branch>/path"
-	parts := strings.SplitN(u.Path, "/", 6)
-	switch {
-	case len(parts) == 3: // "/owner/repo"
-		owner, repo := parts[1], parts[2]
-		// Check the default branch
-		var resp struct {
-			DefaultBranch string `json:"default_branch"`
-		}
-		url := fmt.Sprintf("https://api.github.com/repos/%s/%s", owner, repo)
-		req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
-		if err != nil {
-			return nil, err
-		} else if err := slurpJSON(req, &resp); err != nil {
-			return nil, err
-		}
-		return &repoInfo{
-			Owner:  owner,
-			Repo:   repo,
-			Branch: resp.DefaultBranch,
-			Path:   ".",
-			Name:   repo,
-		}, nil
-	case len(parts) >= 5: // "/owner/repo"
-		owner, repo, t, branch := parts[1], parts[2], parts[3], parts[4]
-		p := "."
-		name := repo
-		if len(parts) == 6 {
-			p = parts[5]
-			name = path.Base(p)
-		}
-		if t != "tree" {
-			return nil, fmt.Errorf("unsupported template url: %s", tmpl)
-		}
-		return &repoInfo{
-			Owner:  owner,
-			Repo:   repo,
-			Branch: branch,
-			Path:   p,
-			Name:   name,
-		}, nil
-	default:
-		return nil, fmt.Errorf("unsupported template url: %s", tmpl)
-	}
-}
-
-func downloadAndExtractTemplate(ctx context.Context, dst string, info repoInfo) error {
-	url := fmt.Sprintf("https://codeload.github.com/%s/%s/tar.gz/%s", info.Owner, info.Repo, info.Branch)
-	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
-	if err != nil {
-		return err
-	}
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != 200 {
-		return fmt.Errorf("GET %s: got non-200 response: %s", url, resp.Status)
-	}
-	gz, err := gzip.NewReader(resp.Body)
-	if err != nil {
-		return fmt.Errorf("could not read gzip response: %v", err)
-	}
-	defer gz.Close()
-	tr := tar.NewReader(gz)
-
-	prefix := path.Join(info.Repo+"-"+info.Branch, info.Path)
-	prefix += "/"
-	files := 0
-	for {
-		hdr, err := tr.Next()
-		if err == io.EOF {
-			if files == 0 {
-				return fmt.Errorf("could not find template")
-			}
-			return nil
-		} else if err != nil {
-			return fmt.Errorf("reading repo data: %v", err)
-		}
-		if hdr.FileInfo().IsDir() {
-			continue
-		}
-		if p := path.Clean(hdr.Name); strings.HasPrefix(p, prefix) {
-			files++
-			p = p[len(prefix):]
-			filePath := filepath.Join(dst, filepath.FromSlash(p))
-			if err := createFile(tr, filePath); err != nil {
-				return fmt.Errorf("create %s: %v", p, err)
-			}
-		}
-	}
-}
-
-func createFile(src io.Reader, dst string) error {
-	if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
-		return err
-	}
-	f, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0644)
-	if err != nil {
-		return err
-	}
-	_, err = io.Copy(f, src)
-	if err2 := f.Close(); err == nil {
-		err = err2
-	}
-	return err
-}
-
-func slurpJSON(req *http.Request, respData interface{}) error {
-	resp, err := conf.AuthClient().Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != 200 {
-		body, _ := ioutil.ReadAll(resp.Body)
-		return fmt.Errorf("got non-200 response: %s: %s", resp.Status, body)
-	}
-	if err := json.NewDecoder(resp.Body).Decode(respData); err != nil {
-		return fmt.Errorf("could not decode response: %v", err)
-	}
-	return nil
-}
-
-// initGitRepo initializes the git repo.
-// If app is not nil, it configures the repo to push to the given app.
-// If git does not exist, it reports an error matching exec.ErrNotFound.
-func initGitRepo(path string, app *appConf) (err error) {
-	defer func() {
-		if e := recover(); e != nil {
-			if ee, ok := e.(error); ok {
-				err = ee
-			} else {
-				panic(e)
-			}
-		}
-	}()
-
-	git := func(args ...string) []byte {
-		cmd := exec.Command("git", args...)
-		cmd.Dir = path
-		out, err := cmd.CombinedOutput()
-		if err != nil && err != exec.ErrNotFound {
-			panic(fmt.Errorf("git %s: %s (%w)", strings.Join(args, " "), out, err))
-		}
-		return out
-	}
-
-	// Initialize git repo
-	git("init")
-	if app != nil && app.DefaultBranch != nil {
-		git("checkout", "-b", *app.DefaultBranch)
-	}
-	git("config", "--local", "push.default", "current")
-	git("add", "-A")
-
-	cmd := exec.Command("git", "commit", "-m", "Initial commit")
-	cmd.Dir = path
-	// Configure the committer if the user hasn't done it themselves yet.
-	if ok, _ := gitUserConfigured(); !ok {
-		cmd.Env = append(os.Environ(),
-			"GIT_AUTHOR_NAME=Encore",
-			"GIT_AUTHOR_EMAIL=git-bot@encore.dev",
-			"GIT_COMMITTER_NAME=Encore",
-			"GIT_COMMITTER_EMAIL=git-bot@encore.dev",
-		)
-	}
-	if out, err := cmd.CombinedOutput(); err != nil && err != exec.ErrNotFound {
-		return fmt.Errorf("create initial commit repository: %s (%v)", out, err)
-	}
-
-	if app != nil {
-		git("remote", "add", "encore", "encore://"+app.Slug)
-	}
-
-	return nil
-}
-
-func addEncoreRemote(root, appID string) {
-	// Determine if there are any remotes
-	cmd := exec.Command("git", "remote")
-	cmd.Dir = root
-	out, err := cmd.CombinedOutput()
-	if err != nil {
-		return
-	}
-	out = bytes.TrimSpace(out)
-	if len(out) == 0 {
-		cmd = exec.Command("git", "remote", "add", "encore", "encore://"+appID)
-		cmd.Dir = root
-		if err := cmd.Run(); err == nil {
-			fmt.Println("Configured git remote 'encore' to push/pull with Encore.")
-		}
-	}
-}
-
-func linkApp(appID string, force bool) {
-	root, _ := determineAppRoot()
-	filePath := filepath.Join(root, "encore.app")
-
-	// Parse the app data using a map so we preserve all
-	// the keys present when writing it back below.
-	var appData map[string]interface{}
-	if data, err := ioutil.ReadFile(filePath); err != nil {
-		fatal(err)
-		os.Exit(1)
-	} else if err := hujson.Unmarshal(data, &appData); err != nil {
-		fatal("could not parse encore.app: ", err)
-		os.Exit(1)
-	} else if appData["id"] != nil && appData["id"] != "" {
-		fatal("the app is already linked.\n\nNote: to link to a different app, specify the --force flag.")
-	}
-
-	if appID == "" {
-		fmt.Println("Make sure the app is created on app.encore.dev, and then enter its ID to link it.")
-		fmt.Print("App ID: ")
-		if _, err := fmt.Scanln(&appID); err != nil {
-			fatal(err)
-		} else if appID == "" {
-			fatal("no app id given.")
-		}
-	}
-
-	if linked, err := validateAppID(appID); err != nil {
-		fatal(err)
-	} else if !linked {
-		fmt.Fprintln(os.Stderr, "Error: that app does not exist, or you don't have access to it.")
-		os.Exit(1)
-	}
-
-	appData["id"] = appID
-	data, _ := hujson.MarshalIndent(appData, "", "    ")
-	if err := ioutil.WriteFile(filePath, data, 0644); err != nil {
-		fatal(err)
-		os.Exit(1)
-	}
-
-	addEncoreRemote(root, appID)
-	fmt.Println("Successfully linked app!")
-}
-
-// gitUserConfigured reports whether the user has configured
-// user.name and user.email in git.
-func gitUserConfigured() (bool, error) {
-	for _, s := range []string{"user.name", "user.email"} {
-		out, err := exec.Command("git", "config", s).CombinedOutput()
-		if err != nil {
-			return false, err
-		} else if len(bytes.TrimSpace(out)) == 0 {
-			return false, nil
-		}
-	}
-	return true, nil
-}
diff --git a/cli/cmd/encore/app/app.go b/cli/cmd/encore/app/app.go
new file mode 100644
index 0000000000..cd4969445b
--- /dev/null
+++ b/cli/cmd/encore/app/app.go
@@ -0,0 +1,23 @@
+package app
+
+import (
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/root"
+)
+
+// These can be overwritten using
+// `go build -ldflags "-X encr.dev/cli/cmd/encore/app.defaultGitRemoteName=encore"`.
+var (
+	defaultGitRemoteName = "encore"
+	defaultGitRemoteURL  = "encore://"
+)
+
+var appCmd = &cobra.Command{
+	Use:   "app",
+	Short: "Commands to create and link Encore apps",
+}
+
+func init() {
+	root.Cmd.AddCommand(appCmd)
+}
diff --git a/cli/cmd/encore/app/clone.go b/cli/cmd/encore/app/clone.go
new file mode 100644
index 0000000000..ceef94b513
--- /dev/null
+++ b/cli/cmd/encore/app/clone.go
@@ -0,0 +1,42 @@
+package app
+
+import (
+	"os"
+	"os/exec"
+
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+)
+
+var cloneAppCmd = &cobra.Command{
+	Use:   "clone [app-id] [directory]",
+	Short: "Clone an Encore app to your computer",
+	Args:  cobra.MinimumNArgs(1),
+
+	DisableFlagsInUseLine: true,
+	Run: func(c *cobra.Command, args []string) {
+		cmdArgs := append([]string{"clone", "--origin", defaultGitRemoteName, defaultGitRemoteURL + args[0]}, args[1:]...)
+		cmd := exec.Command("git", cmdArgs...)
+		cmd.Stdin = os.Stdin
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		if err := cmd.Run(); err != nil {
+			os.Exit(1)
+		}
+	},
+	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		switch len(args) {
+		case 0:
+			return cmdutil.AutoCompleteAppSlug(cmd, args, toComplete)
+		case 1:
+			return nil, cobra.ShellCompDirectiveFilterDirs
+		default:
+			return nil, cobra.ShellCompDirectiveDefault
+		}
+	},
+}
+
+func init() {
+	appCmd.AddCommand(cloneAppCmd)
+}
diff --git a/cli/cmd/encore/app/create.go b/cli/cmd/encore/app/create.go
new file mode 100644
index 0000000000..a38a31aba7
--- /dev/null
+++ b/cli/cmd/encore/app/create.go
@@ -0,0 +1,696 @@
+package app
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io/fs"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/briandowns/spinner"
+	"github.com/cockroachdb/errors"
+	"github.com/fatih/color"
+	"github.com/spf13/cobra"
+	"github.com/tailscale/hujson"
+
+	"encr.dev/cli/cmd/encore/auth"
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/cli/internal/telemetry"
+	"encr.dev/internal/conf"
+	"encr.dev/internal/env"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/github"
+	"encr.dev/pkg/xos"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+var (
+	createAppTemplate   string
+	createAppOnPlatform bool
+)
+
+var createAppCmd = &cobra.Command{
+	Use:   "create [name]",
+	Short: "Create a new Encore app",
+	Args:  cobra.MaximumNArgs(1),
+
+	DisableFlagsInUseLine: true,
+	Run: func(cmd *cobra.Command, args []string) {
+		name := ""
+		if len(args) > 0 {
+			name = args[0]
+		}
+		if err := createApp(context.Background(), name, createAppTemplate); err != nil {
+			cmdutil.Fatal(err)
+		}
+	},
+}
+
+func init() {
+	appCmd.AddCommand(createAppCmd)
+	createAppCmd.Flags().BoolVar(&createAppOnPlatform, "platform", true, "whether to create the app with the Encore Platform")
+	createAppCmd.Flags().StringVar(&createAppTemplate, "example", "", "URL to example code to use.")
+}
+
+func promptAccountCreation() {
+	cyan := color.New(color.FgCyan)
+	red := color.New(color.FgRed)
+	// Prompt the user for creating an account if they're not logged in.
+	if _, err := conf.CurrentUser(); errors.Is(err, fs.ErrNotExist) && createAppOnPlatform {
+	PromptLoop:
+		for {
+			_, _ = cyan.Fprint(os.Stderr, "Log in / Sign up for a free Encore Cloud account to enable automated cloud deployments? (Y/n): ")
+			var input string
+			_, _ = fmt.Scanln(&input)
+			input = strings.TrimSpace(input)
+			switch input {
+			case "Y", "y", "yes", "":
+				telemetry.Send("app.create.account", map[string]any{"response": true})
+				if err := auth.DoLogin(auth.AutoFlow); err != nil {
+					cmdutil.Fatal(err)
+				}
+			case "N", "n", "no":
+				telemetry.Send("app.create.account", map[string]any{"response": false})
+				// Continue without creating an account.
+			case "q", "quit", "exit":
+				os.Exit(1)
+			default:
+				// Try again.
+				_, _ = red.Fprintln(os.Stderr, "Unexpected answer, please enter 'y' or 'n'.")
+				continue PromptLoop
+			}
+			break
+		}
+	}
+}
+
+func promptRunApp() bool {
+	cyan := color.New(color.FgCyan)
+	red := color.New(color.FgRed)
+	for {
+		_, _ = cyan.Fprint(os.Stderr, "Run your app now? (Y/n): ")
+		var input string
+		_, _ = fmt.Scanln(&input)
+		input = strings.TrimSpace(input)
+		switch input {
+		case "Y", "y", "yes", "":
+			telemetry.Send("app.create.run", map[string]any{"response": true})
+			return true
+		case "N", "n", "no":
+			telemetry.Send("app.create.run", map[string]any{"response": false})
+			return false
+		case "q", "quit", "exit":
+			telemetry.Send("app.create.run", map[string]any{"response": false})
+			return false
+		default:
+			// Try again.
+			_, _ = red.Fprintln(os.Stderr, "Unexpected answer, please enter 'y' or 'n'.")
+		}
+	}
+}
+
+// createApp is the implementation of the "encore app create" command.
+func createApp(ctx context.Context, name, template string) (err error) {
+	var lang language
+	defer func() {
+		// We need to send the telemetry synchronously to ensure it's sent before the command exits.
+		telemetry.SendSync("app.create", map[string]any{
+			"template": template,
+			"lang":     lang,
+			"error":    err != nil,
+		})
+	}()
+	cyan := color.New(color.FgCyan)
+	green := color.New(color.FgGreen)
+
+	promptAccountCreation()
+
+	if name == "" || template == "" {
+		name, template, lang = selectTemplate(name, template, false)
+	}
+	// Treat the special name "empty" as the empty app template
+	// (the rest of the code assumes that's the empty string).
+	if template == "empty" {
+		template = ""
+	}
+
+	if err := validateName(name); err != nil {
+		return err
+	} else if _, err := os.Stat(name); err == nil {
+		return fmt.Errorf("directory %s already exists", name)
+	}
+
+	// Parse template information, if provided.
+	var ex *github.Tree
+	if template != "" {
+		var err error
+		ex, err = parseTemplate(ctx, template)
+		if err != nil {
+			return err
+		}
+	}
+
+	if err := os.Mkdir(name, 0755); err != nil {
+		return err
+	}
+	defer func() {
+		if err != nil {
+			// Clean up the directory we just created in case of an error.
+			_ = os.RemoveAll(name)
+		}
+	}()
+
+	if ex != nil {
+		s := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
+		s.Prefix = fmt.Sprintf("Downloading template %s ", ex.Name())
+		s.Start()
+		err := github.ExtractTree(ctx, ex, name)
+		s.Stop()
+		fmt.Println()
+
+		if err != nil {
+			return fmt.Errorf("failed to download template %s: %v", ex.Name(), err)
+		}
+		gray := color.New(color.Faint)
+		_, _ = gray.Printf("Downloaded template %s.\n", ex.Name())
+	} else {
+		// Set up files that we need when we don't have an example
+		if err := xos.WriteFile(filepath.Join(name, ".gitignore"), []byte("/.encore\n"), 0644); err != nil {
+			cmdutil.Fatal(err)
+		}
+		encoreModData := []byte("module encore.app\n")
+		if err := xos.WriteFile(filepath.Join(name, "go.mod"), encoreModData, 0644); err != nil {
+			cmdutil.Fatal(err)
+		}
+	}
+
+	_, err = conf.CurrentUser()
+	loggedIn := err == nil
+
+	exCfg, err := parseExampleConfig(name)
+	if err != nil {
+		return fmt.Errorf("failed to parse example config: %v", err)
+	}
+
+	// Delete the example config file.
+	_ = os.Remove(exampleJSONPath(name))
+
+	var app *platform.App
+	if loggedIn && createAppOnPlatform {
+		s := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
+		s.Prefix = "Creating app on encore.dev "
+		s.Start()
+		app, err = createAppOnServer(name, exCfg)
+		s.Stop()
+		if err != nil {
+			return fmt.Errorf("creating app on encore.dev: %v", err)
+		}
+	}
+
+	appRootRelpath := filepath.FromSlash(exCfg.EncoreAppPath)
+	encoreAppPath := filepath.Join(name, appRootRelpath, "encore.app")
+	appData, err := os.ReadFile(encoreAppPath)
+	if err != nil {
+		appData, err = []byte("{}"), nil
+	}
+
+	if app != nil {
+		appData, err = setEncoreAppID(appData, app.Slug, []string{})
+	} else {
+		appData, err = setEncoreAppID(appData, "", []string{
+			"The app is not currently linked to the encore.dev platform.",
+			`Use "encore app link" to link it.`,
+		})
+	}
+	if err != nil {
+		return errors.Wrap(err, "write encore.app file")
+	}
+	if err := xos.WriteFile(encoreAppPath, appData, 0644); err != nil {
+		return errors.Wrap(err, "write encore.app file")
+	}
+
+	// Update to latest encore.dev release
+	if _, err := os.Stat(filepath.Join(name, appRootRelpath, "go.mod")); err == nil {
+		s := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
+		s.Prefix = "Running go get encore.dev@latest"
+		s.Start()
+		if err := gogetEncore(filepath.Join(name, appRootRelpath)); err != nil {
+			s.FinalMSG = fmt.Sprintf("failed, skipping: %v", err.Error())
+		}
+		s.Stop()
+	} else if _, err := os.Stat(filepath.Join(name, appRootRelpath, "package.json")); err == nil {
+		s := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
+		s.Prefix = "Running npm install encore.dev@latest"
+		s.Start()
+		if err := npmInstallEncore(filepath.Join(name, appRootRelpath)); err != nil {
+			s.FinalMSG = fmt.Sprintf("failed, skipping: %v", err.Error())
+		}
+		s.Stop()
+	}
+
+	// Rewrite any existence of ENCORE_APP_ID to the allocated app id.
+	if app != nil {
+		if err := rewritePlaceholders(name, app); err != nil {
+			red := color.New(color.FgRed)
+			_, _ = red.Printf("Failed rewriting source code placeholders, skipping: %v\n", err)
+		}
+	}
+
+	if err := initGitRepo(name, app); err != nil {
+		return err
+	}
+
+	// Try to generate wrappers. Don't error out if it fails for some reason,
+	// it's a nice-to-have to avoid IDEs thinking there are compile errors before 'encore run' runs.
+	_ = generateWrappers(filepath.Join(name, appRootRelpath))
+
+	// Create the app on the daemon.
+	appRoot, err := filepath.Abs(filepath.Join(name, appRootRelpath))
+	if err != nil {
+		cmdutil.Fatalf("failed to get absolute path: %v", err)
+	}
+	daemon := cmdutil.ConnectDaemon(ctx)
+	_, err = daemon.CreateApp(ctx, &daemonpb.CreateAppRequest{
+		AppRoot:  appRoot,
+		Tutorial: exCfg.Tutorial,
+		Template: template,
+	})
+	if err != nil {
+		color.Red("Failed to create app on daemon: %s\n", err)
+	}
+	cmdutil.ClearTerminalExceptFirstNLines(0)
+	_, _ = green.Printf("Successfully created app %s!\n", name)
+	if app != nil {
+		cyanf := cyan.SprintfFunc()
+		fmt.Println()
+		fmt.Printf("App ID:   %s\n", cyanf(app.Slug))
+		fmt.Printf("Web URL:  %s%s", cyanf("https://app.encore.cloud/"+app.Slug), cmdutil.Newline)
+		fmt.Printf("App Root: %s\n", cyanf(appRoot))
+		fmt.Println()
+	}
+	greenBoldF := green.Add(color.Bold).SprintfFunc()
+	fmt.Printf("Run your app with: %s\n", greenBoldF("cd %s && encore run", filepath.Join(name, appRootRelpath)))
+	fmt.Println()
+	if promptRunApp() {
+		cmdutil.ClearTerminalExceptFirstNLines(0)
+		stream, err := daemon.Run(ctx, &daemonpb.RunRequest{
+			AppRoot:    appRoot,
+			Watch:      true,
+			WorkingDir: ".",
+			Environ:    os.Environ(),
+			ListenAddr: "127.0.0.1:4000",
+			Browser:    daemonpb.RunRequest_BROWSER_ALWAYS,
+		})
+		if err != nil {
+			cmdutil.Fatalf("failed to run app: %v", err)
+		}
+		converter := cmdutil.ConvertJSONLogs(cmdutil.Colorize(true))
+		_ = cmdutil.StreamCommandOutput(stream, converter)
+		return nil
+	}
+	cmdutil.ClearTerminalExceptFirstNLines(0)
+	fmt.Print("Useful commands:\n\n")
+
+	_, _ = cyan.Printf("    encore run\n")
+	fmt.Print("        Run your app locally\n\n")
+
+	if detectLang(name) == languageGo {
+		_, _ = cyan.Printf("    encore test ./...\n")
+	} else {
+		_, _ = cyan.Printf("    encore test\n")
+	}
+	fmt.Print("        Run tests\n\n")
+
+	if app != nil {
+		_, _ = cyan.Printf("    git push encore\n")
+		fmt.Print("        Deploys your app\n\n")
+	}
+
+	fmt.Printf("Get started now: %s\n", greenBoldF("cd %s && encore run", filepath.Join(name, appRootRelpath)))
+	return nil
+}
+
+// detectLang attempts to detect the application language for an Encore application
+// situated at appRoot.
+func detectLang(appRoot string) language {
+	if _, err := os.Stat(filepath.Join(appRoot, "go.mod")); err == nil {
+		return languageGo
+	} else if _, err := os.Stat(filepath.Join(appRoot, "package.json")); err == nil {
+		return languageTS
+	}
+	return languageGo
+}
+
+func validateName(name string) error {
+	ln := len(name)
+	if ln == 0 {
+		return fmt.Errorf("name must not be empty")
+	} else if ln > 50 {
+		return fmt.Errorf("name too long (max 50 chars)")
+	}
+
+	for i, s := range name {
+		// Outside of [a-z], [0-9] and != '-'?
+		if !((s >= 'a' && s <= 'z') || (s >= '0' && s <= '9') || s == '-') {
+			return fmt.Errorf("name must only contain lowercase letters, digits, or dashes")
+		} else if s == '-' {
+			if i == 0 {
+				return fmt.Errorf("name cannot start with a dash")
+			} else if (i + 1) == ln {
+				return fmt.Errorf("name cannot end with a dash")
+			} else if name[i-1] == '-' {
+				return fmt.Errorf("name cannot contain repeated dashes")
+			}
+		}
+	}
+	return nil
+}
+
+func gogetEncore(dir string) error {
+	var goBinPath string
+
+	// Prefer the 'go' binary from the Encore GOROOT if available.
+	if goroot, ok := env.OptEncoreGoRoot().Get(); ok {
+		goBinPath = filepath.Join(goroot, "bin", "go")
+	} else {
+		// Otherwise fall back to just "go", so that exec.Command
+		// does a path lookup.
+		goBinPath = "go"
+	}
+
+	// Use the 'go' binary from the Encore GOROOT in case the user
+	// does not have Go installed separately from Encore.
+	// nosemgrep go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
+	cmd := exec.Command(goBinPath, "get", "encore.dev@latest")
+	cmd.Dir = dir
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return errors.Newf("go get failed: %v: %s", err, out)
+	}
+	return nil
+}
+
+func npmInstallEncore(dir string) error {
+	args := []string{"install"}
+	if version.Channel == version.DevBuild {
+		args = append(args, filepath.Join(env.EncoreRuntimesPath(), "js", "encore.dev"))
+	} else {
+		args = append(args, fmt.Sprintf("encore.dev@%s", strings.TrimPrefix(version.Version, "v")))
+	}
+
+	// First install the 'encore.dev' package.
+	cmd := exec.Command("npm", args...)
+	cmd.Dir = dir
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		err = fmt.Errorf("installing encore.dev package failed: %v: %s", err, out)
+	}
+
+	// Then run 'npm install'.
+	cmd = exec.Command("npm", "install")
+	cmd.Dir = dir
+	if out2, err2 := cmd.CombinedOutput(); err2 != nil && err == nil {
+		err = fmt.Errorf("'npm install' failed: %v: %s", err2, out2)
+	}
+
+	return err
+}
+
+func createAppOnServer(name string, cfg exampleConfig) (*platform.App, error) {
+	if _, err := conf.CurrentUser(); err != nil {
+		return nil, err
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+	params := &platform.CreateAppParams{
+		Name:           name,
+		InitialSecrets: cfg.InitialSecrets,
+		AppRootDir:     cfg.EncoreAppPath,
+	}
+	return platform.CreateApp(ctx, params)
+}
+
+func parseTemplate(ctx context.Context, tmpl string) (*github.Tree, error) {
+	// If the template does not contain a colon or a dot, it's definitely
+	// not a github.com URL. Assume it's a simple template name.
+	if !strings.Contains(tmpl, ":") && !strings.Contains(tmpl, ".") {
+		tmpl = "https://github.com/encoredev/examples/tree/main/" + tmpl
+	}
+	return github.ParseTree(ctx, tmpl)
+}
+
+// initGitRepo initializes the git repo.
+// If app is not nil, it configures the repo to push to the given app.
+// If git does not exist, it reports an error matching exec.ErrNotFound.
+func initGitRepo(path string, app *platform.App) (err error) {
+	defer func() {
+		if e := recover(); e != nil {
+			if ee, ok := e.(error); ok {
+				err = ee
+			} else {
+				panic(e)
+			}
+		}
+	}()
+
+	git := func(args ...string) []byte {
+		cmd := exec.Command("git", args...)
+		cmd.Dir = path
+		out, err := cmd.CombinedOutput()
+		if err != nil && !errors.Is(err, exec.ErrNotFound) {
+			panic(fmt.Errorf("git %s: %s (%w)", strings.Join(args, " "), out, err))
+		}
+		return out
+	}
+
+	// Initialize git repo
+	git("init")
+	if app != nil && app.MainBranch != nil {
+		git("checkout", "-b", *app.MainBranch)
+	}
+	git("config", "--local", "push.default", "current")
+	git("add", "-A")
+
+	cmd := exec.Command("git", "commit", "-m", "Initial commit")
+	cmd.Dir = path
+	// Configure the committer if the user hasn't done it themselves yet.
+	if ok, _ := gitUserConfigured(); !ok {
+		cmd.Env = append(os.Environ(),
+			"GIT_AUTHOR_NAME=Encore",
+			"GIT_AUTHOR_EMAIL=git-bot@encore.dev",
+			"GIT_COMMITTER_NAME=Encore",
+			"GIT_COMMITTER_EMAIL=git-bot@encore.dev",
+		)
+	}
+	if out, err := cmd.CombinedOutput(); err != nil && !errors.Is(err, exec.ErrNotFound) {
+		return fmt.Errorf("create initial commit repository: %s (%v)", out, err)
+	}
+
+	if app != nil {
+		git("remote", "add", defaultGitRemoteName, defaultGitRemoteURL+app.Slug)
+	}
+
+	return nil
+}
+
+func addEncoreRemote(root, appID string) {
+	// Determine if there are any remotes
+	cmd := exec.Command("git", "remote")
+	cmd.Dir = root
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return
+	}
+	out = bytes.TrimSpace(out)
+	if len(out) == 0 {
+		cmd = exec.Command("git", "remote", "add", defaultGitRemoteName, defaultGitRemoteURL+appID)
+		cmd.Dir = root
+		if err := cmd.Run(); err == nil {
+			fmt.Println("Configured git remote 'encore' to push/pull with Encore.")
+		}
+	}
+}
+
+// gitUserConfigured reports whether the user has configured
+// user.name and user.email in git.
+func gitUserConfigured() (bool, error) {
+	for _, s := range []string{"user.name", "user.email"} {
+		out, err := exec.Command("git", "config", s).CombinedOutput()
+		if err != nil {
+			return false, err
+		} else if len(bytes.TrimSpace(out)) == 0 {
+			return false, nil
+		}
+	}
+	return true, nil
+}
+
+// rewritePlaceholders recursively rewrites all files within basePath
+// to replace placeholders with the actual values for this particular app.
+func rewritePlaceholders(basePath string, app *platform.App) error {
+	var first error
+	err := filepath.WalkDir(basePath, func(path string, info fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if info.IsDir() {
+			return nil
+		}
+		if err := rewritePlaceholder(path, info, app); err != nil {
+			if first == nil {
+				first = err
+			}
+		}
+		return nil
+	})
+	if err == nil {
+		err = first
+	}
+	return err
+}
+
+// rewritePlaceholder rewrites a file to replace placeholders with the
+// actual values for this particular app. If the file contains none of
+// the placeholders, this is a no-op.
+func rewritePlaceholder(path string, info fs.DirEntry, app *platform.App) error {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return err
+	}
+	placeholders := []string{
+		"{{ENCORE_APP_ID}}", app.Slug,
+	}
+
+	var replaced bool
+	for i := 0; i < len(placeholders); i += 2 {
+		placeholder := []byte(placeholders[i])
+		target := []byte(placeholders[i+1])
+		if bytes.Contains(data, placeholder) {
+			data = bytes.ReplaceAll(data, placeholder, target)
+			replaced = true
+		}
+	}
+
+	if replaced {
+		return xos.WriteFile(path, data, info.Type().Perm())
+	}
+	return nil
+}
+
+// exampleConfig is the optional configuration file for example apps.
+type exampleConfig struct {
+	// Relative path to the directory where the `encore.app` should be located.
+	// Defaults to ".".
+	EncoreAppPath string `json:"encore_app_path"`
+
+	InitialSecrets map[string]string `json:"initial_secrets"`
+	Tutorial       bool              `json:"tutorial"`
+}
+
+func parseExampleConfig(repoPath string) (cfg exampleConfig, err error) {
+	baseConfig := exampleConfig{
+		EncoreAppPath: ".",
+	}
+	data, err := os.ReadFile(exampleJSONPath(repoPath))
+	if errors.Is(err, fs.ErrNotExist) {
+		return baseConfig, nil
+	} else if err != nil {
+		return baseConfig, err
+	}
+
+	data, err = hujson.Standardize(data)
+	if err != nil {
+		return baseConfig, err
+	} else if err := json.Unmarshal(data, &cfg); err != nil {
+		return baseConfig, err
+	}
+
+	if cfg.EncoreAppPath == "" {
+		cfg.EncoreAppPath = "."
+	}
+	if !filepath.IsLocal(cfg.EncoreAppPath) {
+		return baseConfig, errors.New("encore_app_path must be a local path")
+	}
+	return cfg, nil
+}
+
+func exampleJSONPath(repoPath string) string {
+	return filepath.Join(repoPath, "example-initial-setup.json")
+}
+
+// setEncoreAppID rewrites the encore.app file to replace the app id, preserving comments.
+// It optionally adds comment lines before the "id" field if commentLines is not nil.
+func setEncoreAppID(data []byte, id string, commentLines []string) ([]byte, error) {
+	if len(data) == 0 {
+		data = []byte("{}")
+	}
+
+	root, err := hujson.Parse(data)
+	if err != nil {
+		return data, errors.Wrap(err, "parse encore.app")
+	}
+	obj, ok := root.Value.(*hujson.Object)
+	if !ok {
+		return data, errors.New("invalid encore.app format: not a json object")
+	}
+
+	var buf bytes.Buffer
+	for i, ln := range commentLines {
+		if i == 0 {
+			fmt.Fprintf(&buf, "\n")
+		}
+		fmt.Fprintf(&buf, "\t// %s\n", strings.TrimSpace(ln))
+	}
+	extra := hujson.Extra(buf.Bytes())
+	jsonValue, _ := json.Marshal(id)
+	value := hujson.Value{
+		Value: hujson.Literal(jsonValue),
+	}
+
+	found := false
+	for i := range obj.Members {
+		m := &obj.Members[i]
+		if lit, ok := m.Name.Value.(hujson.Literal); ok && lit.String() == "id" {
+			if commentLines != nil {
+				m.Name.BeforeExtra = extra
+			}
+			m.Value = value
+			found = true
+			break
+		}
+	}
+
+	if !found {
+		obj.Members = append([]hujson.ObjectMember{{
+			Name: hujson.Value{
+				BeforeExtra: extra,
+				Value:       hujson.Literal(`"id"`),
+			},
+			Value: value,
+		}}, obj.Members...)
+	}
+
+	root.Format()
+	return root.Pack(), nil
+}
+
+// generateWrappers runs 'encore gen wrappers' in the given directory.
+func generateWrappers(dir string) error {
+	// Use this executable if we can.
+	exe, err := os.Executable()
+	if err != nil {
+		exe = "encore"
+	}
+	// nosemgrep go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
+	cmd := exec.Command(exe, "gen", "wrappers")
+	cmd.Dir = dir
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return fmt.Errorf("encore gen wrappers failed: %v: %s", err, out)
+	}
+	return nil
+}
diff --git a/cli/cmd/encore/app/create_form.go b/cli/cmd/encore/app/create_form.go
new file mode 100644
index 0000000000..2cc5667acd
--- /dev/null
+++ b/cli/cmd/encore/app/create_form.go
@@ -0,0 +1,725 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/charmbracelet/bubbles/list"
+	"github.com/charmbracelet/bubbles/spinner"
+	"github.com/charmbracelet/bubbles/textinput"
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/charmbracelet/lipgloss"
+	"github.com/tailscale/hujson"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+)
+
+const (
+	codeBlue       = "#6D89FF"
+	codePurple     = "#A36C8C"
+	codeGreen      = "#B3D77E"
+	validationFail = "#CB1010"
+)
+
+var (
+	inputStyle   = lipgloss.NewStyle().Foreground(lipgloss.AdaptiveColor{Dark: codeBlue, Light: codeBlue})
+	descStyle    = lipgloss.NewStyle().Foreground(lipgloss.AdaptiveColor{Dark: codeGreen, Light: codePurple})
+	docStyle     = lipgloss.NewStyle().Padding(0, 2, 0, 2)
+	errorStyle   = lipgloss.NewStyle().Foreground(lipgloss.Color(validationFail))
+	successStyle = lipgloss.NewStyle().Foreground(lipgloss.Color("#00C200"))
+)
+
+type templateItem struct {
+	ItemTitle string   `json:"title"`
+	Desc      string   `json:"desc"`
+	Template  string   `json:"template"`
+	Lang      language `json:"lang"`
+}
+
+func (i templateItem) Title() string       { return i.ItemTitle }
+func (i templateItem) Description() string { return i.Desc }
+func (i templateItem) FilterValue() string { return i.ItemTitle }
+
+type createFormModel struct {
+	step int // 0, 1, 2, 3
+
+	lang      languageSelectModel
+	templates templateListModel
+	appName   appNameModel
+
+	skipShowingTemplate bool
+
+	aborted bool
+}
+
+func (m createFormModel) Init() tea.Cmd {
+	return tea.Batch(
+		m.appName.Init(),
+		m.templates.Init(),
+	)
+}
+
+type languageSelectDone struct {
+	lang language
+}
+
+type languageSelectModel struct {
+	list list.Model
+}
+
+func (m languageSelectModel) Selected() language {
+	sel := m.list.SelectedItem()
+	if sel == nil {
+		return ""
+	}
+	return sel.(langItem).lang
+}
+
+func (m languageSelectModel) Update(msg tea.Msg) (languageSelectModel, tea.Cmd) {
+	var c tea.Cmd
+
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch msg.Type {
+		case tea.KeyEnter:
+			// Have we selected a language?
+			if idx := m.list.Index(); idx >= 0 {
+				return m, func() tea.Msg {
+					return languageSelectDone{
+						lang: m.Selected(),
+					}
+				}
+			}
+		}
+	}
+
+	m.list, c = m.list.Update(msg)
+	return m, c
+}
+
+func (m *languageSelectModel) SetSize(width, height int) {
+	m.list.SetWidth(width)
+	m.list.SetHeight(max(height-1, 0))
+}
+
+const checkmark = "✔"
+
+func (m languageSelectModel) View() string {
+	var b strings.Builder
+	b.WriteString(inputStyle.Render("Select language for your application"))
+	b.WriteString(descStyle.Render(" [Use arrows to move]"))
+	b.WriteString("\n")
+	b.WriteString(m.list.View())
+
+	return b.String()
+}
+
+type appNameDone struct{}
+
+type appNameModel struct {
+	predefined string
+	text       textinput.Model
+	dirExists  bool
+}
+
+func (m appNameModel) Init() tea.Cmd {
+	return tea.Batch(
+		textinput.Blink,
+	)
+}
+
+func (m appNameModel) Selected() string {
+	if m.predefined != "" {
+		return m.predefined
+	}
+	return m.text.Value()
+}
+
+func (m appNameModel) Update(msg tea.Msg) (appNameModel, tea.Cmd) {
+	var cmds []tea.Cmd
+	var c tea.Cmd
+	m.text, c = m.text.Update(msg)
+	cmds = append(cmds, c)
+
+	if val := m.text.Value(); val != "" {
+		_, err := os.Stat(val)
+		m.dirExists = err == nil
+	}
+
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch msg.Type {
+		case tea.KeyEnter:
+			if m.text.Value() != "" && !m.dirExists {
+				cmds = append(cmds, func() tea.Msg {
+					return appNameDone{}
+				})
+			}
+		}
+	}
+
+	return m, tea.Batch(cmds...)
+}
+
+func (m appNameModel) View() string {
+	var b strings.Builder
+	if m.text.Focused() {
+		b.WriteString(inputStyle.Render("App Name"))
+		b.WriteString(descStyle.Render(" [Use only lowercase letters, digits, and dashes]"))
+		b.WriteByte('\n')
+		b.WriteString(m.text.View())
+		if m.dirExists {
+			b.WriteString(errorStyle.Render(" error: dir already exists"))
+		}
+	} else {
+		fmt.Fprintf(&b, "%s App Name: %s", checkmark, m.text.Value())
+	}
+	b.WriteByte('\n')
+	return b.String()
+}
+
+type templateListModel struct {
+	predefined string
+	filter     language
+
+	all     []templateItem
+	list    list.Model
+	loading spinner.Model
+}
+
+func (m templateListModel) Init() tea.Cmd {
+	return tea.Batch(
+		loadTemplates,
+		m.loading.Tick,
+	)
+}
+
+func (m *templateListModel) SetSize(width, height int) {
+	m.list.SetWidth(width)
+	m.list.SetHeight(max(height-1, 0))
+}
+
+type templateSelectDone struct{}
+
+func (m templateListModel) Update(msg tea.Msg) (templateListModel, tea.Cmd) {
+	var cmds []tea.Cmd
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch msg.Type {
+		case tea.KeyEnter:
+			// Have we selected a language?
+			if idx := m.list.Index(); idx >= 0 {
+				return m, func() tea.Msg { return templateSelectDone{} }
+			}
+		}
+
+	case spinner.TickMsg:
+		m.loading, _ = m.loading.Update(msg)
+
+	case loadedTemplates:
+		m.all = msg
+		m.refreshFilter()
+		newList, c := m.list.Update(msg)
+		m.list = newList
+		cmds = append(cmds, c)
+	}
+
+	newList, c := m.list.Update(msg)
+	m.list = newList
+	cmds = append(cmds, c)
+
+	return m, tea.Batch(cmds...)
+}
+
+func (m *templateListModel) UpdateFilter(lang language) {
+	m.filter = lang
+	m.refreshFilter()
+}
+
+func (m *templateListModel) refreshFilter() {
+	var listItems []list.Item
+	for _, it := range m.all {
+		if it.Lang == m.filter {
+			listItems = append(listItems, it)
+		}
+	}
+	m.list.SetItems(listItems)
+}
+
+func (m templateListModel) View() string {
+	var b strings.Builder
+	b.WriteString(inputStyle.Render("Template"))
+	b.WriteString(descStyle.Render(" [Use arrows to move]"))
+	b.WriteByte('\n')
+	b.WriteString(m.list.View())
+
+	return b.String()
+}
+
+func (m templateListModel) Selected() string {
+	if m.predefined != "" {
+		return m.predefined
+	}
+	idx := m.list.Index()
+	if idx < 0 {
+		return ""
+	}
+	return m.list.Items()[idx].FilterValue()
+}
+
+func (m createFormModel) Update(msg tea.Msg) (tea.Model, tea.Cmd) {
+	var (
+		cmds []tea.Cmd
+		c    tea.Cmd
+	)
+
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch msg.Type {
+		case tea.KeyCtrlC, tea.KeyEsc, 'q':
+			m.aborted = true
+			return m, tea.Quit
+		}
+
+		switch m.step {
+		case 0:
+			m.lang, c = m.lang.Update(msg)
+			cmds = append(cmds, c)
+		case 1:
+			m.templates, c = m.templates.Update(msg)
+			cmds = append(cmds, c)
+		case 2:
+			m.appName, c = m.appName.Update(msg)
+			cmds = append(cmds, c)
+		}
+		return m, tea.Batch(cmds...)
+
+	case languageSelectDone:
+		m.step = 1
+		if m.skipShowingTemplate {
+			m.step = 2
+		}
+		m.templates.UpdateFilter(msg.lang)
+
+	case templateSelectDone:
+		if m.appName.predefined != "" {
+			// We're done.
+			m.step = 3
+			cmds = append(cmds, tea.Quit)
+		} else {
+			m.step = 2
+		}
+
+	case appNameDone:
+		cmds = append(cmds, tea.Quit)
+		m.step = 3
+
+	case tea.WindowSizeMsg:
+		m.SetSize(msg.Width, msg.Height)
+		return m, nil
+	}
+
+	// Update all submodels for other messages.
+	m.lang, c = m.lang.Update(msg)
+	cmds = append(cmds, c)
+	m.templates, c = m.templates.Update(msg)
+	cmds = append(cmds, c)
+	m.appName, c = m.appName.Update(msg)
+	cmds = append(cmds, c)
+
+	return m, tea.Batch(cmds...)
+}
+
+func (m *createFormModel) SetSize(width, height int) {
+	// Step 1
+	doneHeight := lipgloss.Height(m.doneView())
+	{
+		availHeight := height - doneHeight
+		m.lang.SetSize(width, availHeight)
+	}
+
+	// Step 2
+	{
+		availHeight := height - doneHeight
+		m.templates.SetSize(width, availHeight)
+	}
+}
+
+func (m createFormModel) doneView() string {
+	var b strings.Builder
+
+	renderDone := func(title, value string) {
+		b.WriteString(successStyle.Render(fmt.Sprintf("%s %s: ", checkmark, title)))
+		b.WriteString(value)
+		b.WriteByte('\n')
+	}
+
+	renderLangDone := func() {
+		renderDone("Language", m.lang.Selected().Display())
+	}
+
+	renderNameDone := func() {
+		renderDone("App Name", m.appName.Selected())
+	}
+
+	renderTemplateDone := func() {
+		renderDone("Template", m.templates.Selected())
+	}
+
+	if m.appName.predefined != "" {
+		renderNameDone()
+	}
+	if m.templates.predefined == "" && m.step > 0 {
+		renderLangDone()
+	}
+	if !m.skipShowingTemplate {
+		if m.templates.predefined != "" || m.step > 1 {
+			renderTemplateDone()
+		}
+	}
+	if m.appName.predefined == "" && m.step > 2 {
+		renderNameDone()
+	}
+
+	return b.String()
+}
+
+func (m createFormModel) View() string {
+	var b strings.Builder
+
+	doneView := m.doneView()
+
+	b.WriteString(doneView)
+	if doneView != "" {
+		b.WriteByte('\n')
+	}
+
+	if m.step == 0 {
+		b.WriteString(m.lang.View())
+	}
+
+	if m.step == 1 {
+		b.WriteString(m.templates.View())
+	}
+
+	if m.step == 2 {
+		b.WriteString(m.appName.View())
+	}
+
+	return docStyle.Render(b.String())
+}
+
+func (m templateListModel) templatesLoading() bool {
+	return len(m.list.Items()) == 0
+}
+
+func (m templateListModel) SelectedItem() (templateItem, bool) {
+	if m.predefined != "" {
+		return templateItem{}, false
+	}
+	idx := m.list.Index()
+	items := m.list.Items()
+	if idx >= 0 && len(items) > idx {
+		return items[idx].(templateItem), true
+	}
+	return templateItem{}, false
+}
+
+func selectTemplate(inputName, inputTemplate string, skipShowingTemplate bool) (appName, template string, selectedLang language) {
+	// If we have both name and template already, return them.
+	if inputName != "" && inputTemplate != "" {
+		return inputName, inputTemplate, ""
+	}
+
+	var lang languageSelectModel
+	{
+		ls := list.NewDefaultItemStyles()
+		ls.SelectedTitle = ls.SelectedTitle.Foreground(lipgloss.Color(codeBlue)).BorderForeground(lipgloss.Color(codeBlue))
+		ls.SelectedDesc = ls.SelectedDesc.Foreground(lipgloss.Color(codeBlue)).BorderForeground(lipgloss.Color(codeBlue))
+		del := list.NewDefaultDelegate()
+		del.Styles = ls
+		del.ShowDescription = false
+		del.SetSpacing(0)
+
+		items := []list.Item{
+			langItem{
+				lang: languageGo,
+				desc: "Build performant and scalable backends with Go",
+			},
+			langItem{
+				lang: languageTS,
+				desc: "Build backend and full-stack applications with TypeScript",
+			},
+		}
+
+		ll := list.New(items, del, 0, 0)
+		ll.SetShowTitle(false)
+		ll.SetShowHelp(false)
+		ll.SetShowPagination(true)
+		ll.SetShowFilter(false)
+		ll.SetFilteringEnabled(false)
+		ll.SetShowStatusBar(false)
+		lang = languageSelectModel{
+			list: ll,
+		}
+		lang.SetSize(0, 20)
+	}
+
+	var templates templateListModel
+	{
+		ls := list.NewDefaultItemStyles()
+		ls.SelectedTitle = ls.SelectedTitle.Foreground(lipgloss.Color(codeBlue)).BorderForeground(lipgloss.Color(codeBlue))
+		ls.SelectedDesc = ls.SelectedDesc.Foreground(lipgloss.Color(codeBlue)).BorderForeground(lipgloss.Color(codeBlue))
+		del := list.NewDefaultDelegate()
+		del.Styles = ls
+
+		ll := list.New(nil, del, 0, 20)
+		ll.SetShowTitle(false)
+		ll.SetShowHelp(false)
+		ll.SetShowPagination(true)
+		ll.SetShowFilter(false)
+		ll.SetFilteringEnabled(false)
+		ll.SetShowStatusBar(false)
+
+		sp := spinner.New()
+		sp.Spinner = spinner.Dot
+		sp.Style = inputStyle.Copy().Inline(true)
+		templates = templateListModel{
+			predefined: inputTemplate,
+			list:       ll,
+			loading:    sp,
+		}
+	}
+
+	var nameModel appNameModel
+	{
+		text := textinput.New()
+		text.Focus()
+		text.CharLimit = 20
+		text.Width = 30
+		text.Validate = incrementalValidateNameInput
+
+		nameModel = appNameModel{predefined: inputName, text: text}
+	}
+
+	m := createFormModel{
+		step:                0,
+		lang:                lang,
+		templates:           templates,
+		appName:             nameModel,
+		skipShowingTemplate: skipShowingTemplate,
+	}
+
+	// If we have a name, start the list without any selection.
+	if m.appName.predefined != "" {
+		m.templates.list.Select(-1)
+	}
+	if m.templates.predefined != "" {
+		m.step = 2 // skip to app name selection
+	}
+
+	p := tea.NewProgram(m)
+
+	result, err := p.Run()
+	if err != nil {
+		cmdutil.Fatal(err)
+	}
+
+	// Validate the result.
+	res := result.(createFormModel)
+	if res.aborted {
+		os.Exit(1)
+	}
+
+	appName, template = inputName, inputTemplate
+
+	if appName == "" {
+		appName = res.appName.text.Value()
+	}
+
+	if template == "" {
+		sel, ok := res.templates.SelectedItem()
+		if !ok {
+			cmdutil.Fatal("no template selected")
+		}
+		template = sel.Template
+	}
+
+	return appName, template, res.lang.Selected()
+}
+
+type langItem struct {
+	lang language
+	desc string
+}
+
+func (i langItem) FilterValue() string {
+	return i.lang.Display()
+}
+func (i langItem) Title() string {
+	return i.FilterValue()
+}
+func (i langItem) Description() string { return "" }
+
+type language string
+
+const (
+	languageGo language = "go"
+	languageTS language = "ts"
+)
+
+func (lang language) Display() string {
+	switch lang {
+	case languageGo:
+		return "Go"
+	case languageTS:
+		return "TypeScript"
+	default:
+		return string(lang)
+	}
+}
+
+type loadedTemplates []templateItem
+
+var defaultTutorials = []templateItem{
+	{
+		ItemTitle: "Intro to Encore.ts",
+		Desc:      "An interactive tutorial",
+		Template:  "ts/introduction",
+		Lang:      "ts",
+	},
+}
+
+var defaultTemplates = []templateItem{
+	{
+		ItemTitle: "Hello World",
+		Desc:      "A simple REST API",
+		Template:  "hello-world",
+		Lang:      "go",
+	},
+	{
+		ItemTitle: "Hello World",
+		Desc:      "A simple REST API",
+		Template:  "ts/hello-world",
+		Lang:      "ts",
+	},
+	{
+		ItemTitle: "Uptime Monitor",
+		Desc:      "Microservices, SQL Databases, Pub/Sub, Cron Jobs",
+		Template:  "uptime",
+		Lang:      "go",
+	},
+	{
+		ItemTitle: "Uptime Monitor",
+		Desc:      "Microservices, SQL Databases, Pub/Sub, Cron Jobs",
+		Template:  "ts/uptime",
+		Lang:      "ts",
+	},
+	{
+		ItemTitle: "GraphQL",
+		Desc:      "GraphQL API, Microservices, SQL Database",
+		Template:  "graphql",
+		Lang:      "go",
+	},
+	{
+		ItemTitle: "URL Shortener",
+		Desc:      "REST API, SQL Database",
+		Template:  "url-shortener",
+		Lang:      "go",
+	},
+	{
+		ItemTitle: "URL Shortener",
+		Desc:      "REST API, SQL Database",
+		Template:  "ts/url-shortener",
+		Lang:      "ts",
+	},
+	{
+		ItemTitle: "SaaS Starter",
+		Desc:      "Complete app with Clerk auth, Stripe billing, etc. (advanced)",
+		Template:  "ts/saas-starter",
+		Lang:      "ts",
+	},
+	{
+		ItemTitle: "Empty app",
+		Desc:      "Start from scratch (experienced users only)",
+		Template:  "",
+		Lang:      "go",
+	},
+	{
+		ItemTitle: "Empty app",
+		Desc:      "Start from scratch (experienced users only)",
+		Template:  "ts/empty",
+		Lang:      "ts",
+	},
+}
+
+func fetchTemplates(url string, defaults []templateItem) []templateItem {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if req, err := http.NewRequestWithContext(ctx, "GET", url, nil); err == nil {
+		if resp, err := http.DefaultClient.Do(req); err == nil {
+			if data, err := io.ReadAll(resp.Body); err == nil {
+				data, err = hujson.Standardize(data)
+				if err == nil {
+					var items []templateItem
+					if err := json.Unmarshal(data, &items); err == nil && len(items) > 0 {
+						return items
+					}
+				}
+			}
+		}
+	}
+	return defaults
+}
+
+func loadTemplates() tea.Msg {
+	var wg sync.WaitGroup
+	var templates, tutorials []templateItem
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		templates = fetchTemplates("https://raw.githubusercontent.com/encoredev/examples/main/cli-templates.json", defaultTemplates)
+	}()
+	wg.Add(1)
+	go func() {
+		defer wg.Done()
+		tutorials = fetchTemplates("https://raw.githubusercontent.com/encoredev/examples/main/cli-tutorials.json", defaultTutorials)
+	}()
+	wg.Wait()
+	return loadedTemplates(append(tutorials, templates...))
+}
+
+// incrementalValidateNameInput is like validateName but only
+// checks for valid/invalid characters. It can't check for
+// whether the last character is a dash, since if we treat that
+// as an error the user won't be able to enter dashes at all.
+func incrementalValidateNameInput(name string) error {
+	ln := len(name)
+	if ln == 0 {
+		return fmt.Errorf("name must not be empty")
+	} else if ln > 50 {
+		return fmt.Errorf("name too long (max 50 chars)")
+	}
+
+	for i, s := range name {
+		// Outside of [a-z], [0-9] and != '-'?
+		if !((s >= 'a' && s <= 'z') || (s >= '0' && s <= '9') || s == '-') {
+			return fmt.Errorf("name must only contain lowercase letters, digits, or dashes")
+		} else if s == '-' {
+			if i == 0 {
+				return fmt.Errorf("name cannot start with a dash")
+			} else if name[i-1] == '-' {
+				return fmt.Errorf("name cannot contain repeated dashes")
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/cli/cmd/encore/app/create_test.go b/cli/cmd/encore/app/create_test.go
new file mode 100644
index 0000000000..f260070627
--- /dev/null
+++ b/cli/cmd/encore/app/create_test.go
@@ -0,0 +1,79 @@
+package app
+
+import (
+	"fmt"
+	"testing"
+)
+
+func Test_setEncoreAppID(t *testing.T) {
+	tests := []struct {
+		data         []byte
+		id           string
+		commentLines []string
+		want         string
+	}{
+		{
+			data:         []byte(`{}`),
+			id:           "foo",
+			commentLines: []string{"bar"},
+			want: `{
+	// bar
+	"id": "foo",
+}
+`,
+		},
+		{
+			data:         []byte(``),
+			id:           "foo",
+			commentLines: []string{"bar"},
+			want: `{
+	// bar
+	"id": "foo",
+}
+`,
+		},
+		{
+			data: []byte(`{
+	// foo
+	"id": "test",
+}`),
+			id:           "foo",
+			commentLines: []string{"bar", "baz"},
+			want: `{
+	// bar
+	// baz
+	"id": "foo",
+}
+`,
+		},
+		{
+			data: []byte(`{
+	"some_other_field": true,
+	// foo
+	"id": "test",
+}`),
+			id:           "foo",
+			commentLines: []string{"bar", "baz"},
+			want: `{
+	"some_other_field": true,
+	// bar
+	// baz
+	"id": "foo",
+}
+`,
+		},
+	}
+	for i, tt := range tests {
+		t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
+			got, err := setEncoreAppID(tt.data, tt.id, tt.commentLines)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			gotStr := string(got)
+			if gotStr != tt.want {
+				t.Errorf("setEncoreAppID() = %q, want %q", gotStr, tt.want)
+			}
+		})
+	}
+}
diff --git a/cli/cmd/encore/app/initialize.go b/cli/cmd/encore/app/initialize.go
new file mode 100644
index 0000000000..7d9607ce9d
--- /dev/null
+++ b/cli/cmd/encore/app/initialize.go
@@ -0,0 +1,132 @@
+package app
+
+import (
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/briandowns/spinner"
+	"github.com/fatih/color"
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/internal/conf"
+	"encr.dev/pkg/xos"
+)
+
+const (
+	tsEncoreAppData = `{%s
+	"id": "%s",
+	"lang": "typescript",
+}
+`
+	goEncoreAppData = `{%s
+	"id": "%s",
+}
+`
+)
+
+// Create a new app from scratch: `encore app create`
+// Link an existing app to an existing repo: `encore app link <app-id>`
+// Link an existing repo to a new app: `encore app init <name>`
+
+func init() {
+	initAppCmd := &cobra.Command{
+		Use:   "init [name]",
+		Short: "Create a new Encore app from an existing repository",
+		Args:  cobra.MaximumNArgs(1),
+
+		DisableFlagsInUseLine: true,
+		Run: func(cmd *cobra.Command, args []string) {
+			var name string
+			if len(args) > 0 {
+				name = args[0]
+			}
+			if err := initializeApp(name); err != nil {
+				cmdutil.Fatal(err)
+			}
+		},
+	}
+
+	appCmd.AddCommand(initAppCmd)
+}
+
+func initializeApp(name string) error {
+	// Check if encore.app file exists
+	_, _, err := cmdutil.MaybeAppRoot()
+	if errors.Is(err, cmdutil.ErrNoEncoreApp) {
+		// expected
+	} else if err != nil {
+		cmdutil.Fatal(err)
+	} else if err == nil {
+		// There is already an app here or in a parent directory.
+		cmdutil.Fatal("an encore.app file already exists (here or in a parent directory)")
+	}
+
+	cyan := color.New(color.FgCyan)
+	promptAccountCreation()
+
+	name, _, lang := selectTemplate(name, "", true)
+
+	if err := validateName(name); err != nil {
+		return err
+	}
+
+	appSlug := ""
+	appSlugComments := ""
+	// Create the app on the server.
+	if _, err := conf.CurrentUser(); err == nil {
+		s := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
+		s.Prefix = "Creating app on encore.dev "
+		s.Start()
+
+		app, err := createAppOnServer(name, exampleConfig{})
+		s.Stop()
+		if err != nil {
+			return fmt.Errorf("creating app on encore.dev: %v", err)
+		}
+		appSlug = app.Slug
+	}
+
+	// Create the encore.app file
+	var encoreAppTemplate = goEncoreAppData
+	if lang == "ts" {
+		encoreAppTemplate = tsEncoreAppData
+	}
+	if appSlug == "" {
+		appSlugComments = strings.Join([]string{
+			"",
+			"The app is not currently linked to the encore.dev platform.",
+			`Use "encore app link" to link it.`,
+		}, "\n\t//")
+	}
+	encoreAppData := []byte(fmt.Sprintf(encoreAppTemplate, appSlugComments, appSlug))
+	if err := xos.WriteFile("encore.app", encoreAppData, 0644); err != nil {
+		return err
+	}
+
+	// Update to latest encore.dev release if this looks to be a go module.
+	if _, err := os.Stat("go.mod"); err == nil {
+		s := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
+		s.Prefix = "Running go get encore.dev@latest"
+		s.Start()
+		if err := gogetEncore("."); err != nil {
+			s.FinalMSG = fmt.Sprintf("failed, skipping: %v", err.Error())
+		}
+		s.Stop()
+	}
+
+	green := color.New(color.FgGreen)
+	_, _ = green.Fprint(os.Stdout, "Successfully initialized application on Encore Cloud!\n")
+	if appSlug == "" {
+		_, _ = fmt.Fprintf(os.Stdout, "The app is not currently linked to the encore.dev platform.\n")
+		_, _ = fmt.Fprintf(os.Stdout, "Use \"encore app link\" to link it.\n")
+		return nil
+	}
+	_, _ = fmt.Fprintf(os.Stdout, "- App ID:          %s\n", cyan.Sprint(appSlug))
+	_, _ = fmt.Fprintf(os.Stdout, "- Cloud Dashboard: %s\n\n", cyan.Sprintf("https://app.encore.cloud/%s", appSlug))
+
+	return nil
+}
diff --git a/cli/cmd/encore/app/link.go b/cli/cmd/encore/app/link.go
new file mode 100644
index 0000000000..0573e78d7d
--- /dev/null
+++ b/cli/cmd/encore/app/link.go
@@ -0,0 +1,148 @@
+package app
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/spf13/cobra"
+	"github.com/tailscale/hujson"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/internal/conf"
+	"encr.dev/pkg/xos"
+)
+
+var forceLink bool
+var linkAppCmd = &cobra.Command{
+	Use:   "link [app-id]",
+	Short: "Link an Encore app with the server",
+	Args:  cobra.MaximumNArgs(1),
+
+	DisableFlagsInUseLine: true,
+	Run: func(cmd *cobra.Command, args []string) {
+		var appID string
+		if len(args) > 0 {
+			appID = args[0]
+		}
+		linkApp(appID, forceLink)
+	},
+	ValidArgsFunction: cmdutil.AutoCompleteAppSlug,
+}
+
+func init() {
+	appCmd.AddCommand(linkAppCmd)
+	linkAppCmd.Flags().BoolVarP(&forceLink, "force", "f", false, "Force link even if the app is already linked.")
+}
+
+func linkApp(appID string, force bool) {
+	// Determine the app root.
+	root, _, err := cmdutil.MaybeAppRoot()
+	if errors.Is(err, cmdutil.ErrNoEncoreApp) {
+		root, err = os.Getwd()
+	}
+	if err != nil {
+		cmdutil.Fatal(err)
+	}
+
+	filePath := filepath.Join(root, "encore.app")
+	data, err := os.ReadFile(filePath)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		cmdutil.Fatal(err)
+		os.Exit(1)
+	}
+	if len(bytes.TrimSpace(data)) == 0 {
+		// Treat missing and empty files as an empty object.
+		data = []byte("{}")
+	}
+
+	val, err := hujson.Parse(data)
+	if err != nil {
+		cmdutil.Fatal("could not parse encore.app: ", err)
+	}
+
+	appData, ok := val.Value.(*hujson.Object)
+	if !ok {
+		cmdutil.Fatal("could not parse encore.app: expected JSON object")
+	}
+
+	// Find the "id" value, if any.
+	var idValue *hujson.Value
+	for i := 0; i < len(appData.Members); i++ {
+		kv := &appData.Members[i]
+		lit, ok := kv.Name.Value.(hujson.Literal)
+		if !ok || lit.String() != "id" {
+			continue
+		}
+		idValue = &kv.Value
+	}
+
+	if idValue != nil {
+		val, ok := idValue.Value.(hujson.Literal)
+		if ok && val.String() != "" && val.String() != appID && !force {
+			cmdutil.Fatal("the app is already linked.\n\nNote: to link to a different app, specify the --force flag.")
+		}
+	}
+
+	if appID == "" {
+		// The app is not linked. Prompt the user for an app ID.
+		fmt.Println("Make sure the app is created on app.encore.cloud, and then enter its ID to link it.")
+		fmt.Print("App ID: ")
+		if _, err := fmt.Scanln(&appID); err != nil {
+			cmdutil.Fatal(err)
+		} else if appID == "" {
+			cmdutil.Fatal("no app id given.")
+		}
+	}
+
+	if linked, err := validateAppSlug(appID); err != nil {
+		cmdutil.Fatal(err)
+	} else if !linked {
+		fmt.Fprintln(os.Stderr, "Error: that app does not exist, or you don't have access to it.")
+		os.Exit(1)
+	}
+
+	// Write it back to our data structure.
+	if idValue != nil {
+		idValue.Value = hujson.String(appID)
+	} else {
+		appData.Members = append(appData.Members, hujson.ObjectMember{
+			Name:  hujson.Value{Value: hujson.String("id")},
+			Value: hujson.Value{Value: hujson.String(appID)},
+		})
+	}
+
+	val.Format()
+	if err := xos.WriteFile(filePath, val.Pack(), 0644); err != nil {
+		cmdutil.Fatal(err)
+		os.Exit(1)
+	}
+
+	addEncoreRemote(root, appID)
+	fmt.Println("Successfully linked app!")
+}
+
+func validateAppSlug(slug string) (ok bool, err error) {
+	if _, err := conf.CurrentUser(); errors.Is(err, fs.ErrNotExist) {
+		cmdutil.Fatal("not logged in. Run 'encore auth login' first.")
+	} else if err != nil {
+		return false, err
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	if _, err := platform.GetApp(ctx, slug); err != nil {
+		var e platform.Error
+		if errors.As(err, &e) && e.HTTPCode == 404 {
+			return false, nil
+		}
+		return false, err
+	}
+	return true, nil
+}
diff --git a/cli/cmd/encore/auth.go b/cli/cmd/encore/auth.go
deleted file mode 100644
index 7b5484bc8e..0000000000
--- a/cli/cmd/encore/auth.go
+++ /dev/null
@@ -1,122 +0,0 @@
-package main
-
-import (
-	"errors"
-	"fmt"
-	"os"
-	"runtime"
-	"time"
-
-	"encr.dev/cli/internal/browser"
-	"encr.dev/cli/internal/conf"
-	"encr.dev/cli/internal/login"
-	"github.com/briandowns/spinner"
-	"github.com/spf13/cobra"
-)
-
-func init() {
-	authCmd := &cobra.Command{
-		Use:   "auth",
-		Short: "Commands to authenticate with Encore",
-	}
-
-	signupCmd := &cobra.Command{
-		Use:   "signup",
-		Short: "Create a new Encore account",
-		Run: func(cmd *cobra.Command, args []string) {
-			doLogin()
-		},
-	}
-
-	loginCmd := &cobra.Command{
-		Use:   "login",
-		Short: "Log in to Encore",
-		Run: func(cmd *cobra.Command, args []string) {
-			if err := doLogin(); err != nil {
-				fatal(err)
-			}
-		},
-	}
-
-	logoutCmd := &cobra.Command{
-		Use:   "logout",
-		Short: "Logs out the currently logged in user",
-		Run: func(cmd *cobra.Command, args []string) {
-			doLogout()
-		},
-	}
-
-	whoamiCmd := &cobra.Command{
-		Use:   "whoami",
-		Short: "Show the current logged in user",
-		Run: func(cmd *cobra.Command, args []string) {
-			whoami()
-		},
-	}
-
-	authCmd.AddCommand(signupCmd)
-	authCmd.AddCommand(loginCmd)
-	authCmd.AddCommand(logoutCmd)
-	authCmd.AddCommand(whoamiCmd)
-	rootCmd.AddCommand(authCmd)
-}
-
-func doLogin() error {
-	flow, err := login.Begin()
-	if err != nil {
-		return err
-	}
-
-	browser.Open(flow.URL)
-
-	// On Windows we need a proper \r\n newline to ensure the URL detection doesn't extend to the next line.
-	// fmt.Fprintln and family prints just a simple \n, so don't use that.
-	fmt.Fprint(os.Stdout, "Log in to Encore using your browser here: ", flow.URL, newline)
-
-	s := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
-	s.Prefix = "Waiting for login to complete "
-	s.Start()
-	defer s.Stop()
-
-	select {
-	case cfg := <-flow.LoginCh:
-		if err := conf.Write(cfg); err != nil {
-			return fmt.Errorf("write credentials: %v", err)
-		}
-		fmt.Fprintln(os.Stdout, "Successfully logged in!")
-		return nil
-	case <-time.After(10 * time.Minute):
-		flow.Close()
-		return fmt.Errorf("timed out")
-	}
-}
-
-func doLogout() {
-	if err := conf.Logout(); err != nil {
-		fmt.Fprintln(os.Stderr, "could not logout:", err)
-		os.Exit(1)
-	}
-	fmt.Fprintln(os.Stdout, "encore: logged out.")
-}
-
-func whoami() {
-	cfg, err := conf.CurrentUser()
-	if errors.Is(err, os.ErrNotExist) {
-		fmt.Fprint(os.Stdout, "not logged in.", newline)
-	} else if err != nil {
-		fatal(err)
-	} else {
-		fmt.Fprintf(os.Stdout, "logged in as %s%s", cfg.Email, newline)
-	}
-}
-
-var newline string
-
-func init() {
-	switch runtime.GOOS {
-	case "windows":
-		newline = "\r\n"
-	default:
-		newline = "\n"
-	}
-}
diff --git a/cli/cmd/encore/auth/auth.go b/cli/cmd/encore/auth/auth.go
new file mode 100644
index 0000000000..f4d06fd38c
--- /dev/null
+++ b/cli/cmd/encore/auth/auth.go
@@ -0,0 +1,150 @@
+package auth
+
+import (
+	"errors"
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/cmd/encore/root"
+	"encr.dev/cli/internal/login"
+	"encr.dev/internal/conf"
+)
+
+var authKey string
+
+func init() {
+	authCmd := &cobra.Command{
+		Use:   "auth",
+		Short: "Commands to authenticate with Encore",
+	}
+
+	signupCmd := &cobra.Command{
+		Use:   "signup",
+		Short: "Create a new Encore account",
+
+		DisableFlagsInUseLine: true,
+		Run: func(cmd *cobra.Command, args []string) {
+			if err := DoLogin(DeviceAuth); err != nil {
+				cmdutil.Fatal(err)
+			}
+		},
+	}
+
+	loginCmd := &cobra.Command{
+		Use:   "login [--auth-key=<KEY>]",
+		Short: "Log in to Encore",
+
+		Run: func(cmd *cobra.Command, args []string) {
+			if authKey != "" {
+				if err := DoLoginWithAuthKey(); err != nil {
+					cmdutil.Fatal(err)
+				}
+			} else {
+				if err := DoLogin(DeviceAuth); err != nil {
+					cmdutil.Fatal(err)
+				}
+			}
+		},
+	}
+
+	logoutCmd := &cobra.Command{
+		Use:   "logout",
+		Short: "Logs out the currently logged in user",
+
+		DisableFlagsInUseLine: true,
+		Run: func(cmd *cobra.Command, args []string) {
+			DoLogout()
+		},
+	}
+
+	whoamiCmd := &cobra.Command{
+		Use:   "whoami",
+		Short: "Show the current logged in user",
+
+		DisableFlagsInUseLine: true,
+		Run: func(cmd *cobra.Command, args []string) {
+			Whoami()
+		},
+	}
+
+	authCmd.AddCommand(signupCmd)
+
+	authCmd.AddCommand(loginCmd)
+	loginCmd.Flags().StringVarP(&authKey, "auth-key", "k", "", "Auth Key to use for login")
+
+	authCmd.AddCommand(logoutCmd)
+	authCmd.AddCommand(whoamiCmd)
+	root.Cmd.AddCommand(authCmd)
+}
+
+type Flow int
+
+const (
+	AutoFlow Flow = iota
+	Interactive
+	DeviceAuth
+)
+
+func DoLogin(flow Flow) (err error) {
+	var fn func() (*conf.Config, error)
+	switch flow {
+	case Interactive:
+		fn = login.Interactive
+	case DeviceAuth:
+		fn = login.DeviceAuth
+	default:
+		fn = login.DecideFlow
+	}
+	cfg, err := fn()
+	if err != nil {
+		return err
+	}
+
+	if err := conf.Write(cfg); err != nil {
+		return fmt.Errorf("write credentials: %v", err)
+	}
+	fmt.Fprintln(os.Stdout, "Successfully logged in!")
+	return nil
+}
+
+func DoLogout() {
+	if err := conf.Logout(); err != nil {
+		fmt.Fprintln(os.Stderr, "could not logout:", err)
+		os.Exit(1)
+	}
+	// Stop running daemon to clear any cached credentials
+	cmdutil.StopDaemon()
+	fmt.Fprintln(os.Stdout, "encore: logged out.")
+}
+
+func DoLoginWithAuthKey() error {
+	cfg, err := login.WithAuthKey(authKey)
+	if err != nil {
+		return err
+	}
+	if err := conf.Write(cfg); err != nil {
+		return fmt.Errorf("write credentials: %v", err)
+	}
+	fmt.Fprintln(os.Stdout, "Successfully logged in!")
+	return nil
+}
+
+func Whoami() {
+	cfg, err := conf.CurrentUser()
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			fmt.Fprint(os.Stdout, "not logged in.", cmdutil.Newline)
+			return
+		}
+		cmdutil.Fatal(err)
+	}
+
+	if cfg.AppSlug != "" {
+		fmt.Fprintf(os.Stdout, "logged in as app %s%s", cfg.AppSlug, cmdutil.Newline)
+	} else {
+		fmt.Fprintf(os.Stdout, "logged in as %s%s", cfg.Email, cmdutil.Newline)
+	}
+}
diff --git a/cli/cmd/encore/bits/add.go b/cli/cmd/encore/bits/add.go
new file mode 100644
index 0000000000..dbad38efbf
--- /dev/null
+++ b/cli/cmd/encore/bits/add.go
@@ -0,0 +1,61 @@
+package bits
+
+import (
+	"context"
+	"fmt"
+	"os"
+
+	"github.com/cockroachdb/errors"
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/pkg/bits"
+)
+
+var addCmd = &cobra.Command{
+	Use:   "add <name> [<path>]",
+	Short: "Add an Encore Bit to your application",
+	Args:  cobra.MinimumNArgs(1),
+
+	DisableFlagsInUseLine: true,
+	Run: func(c *cobra.Command, args []string) {
+		slug := args[0]
+		ctx := context.Background()
+		bit, err := bits.Get(ctx, slug)
+		if errors.Is(err, errBitNotFound) {
+			cmdutil.Fatalf("encore bit not found: %s", slug)
+		} else if err != nil {
+			cmdutil.Fatalf("could not lookup encore bit: %v", err)
+		}
+
+		workdir, err := os.MkdirTemp("", "encore-bit")
+		if err != nil {
+			cmdutil.Fatal(err)
+		}
+		defer os.RemoveAll(workdir)
+
+		//prefix := args[0]
+		//if len(args) > 1 {
+		//	prefix = args[1]
+		//}
+
+		fmt.Fprintf(os.Stderr, "Downloading Encore Bit: %s\n", bit.Title)
+		if err := bits.Extract(ctx, bit, workdir); err != nil {
+			cmdutil.Fatalf("download failed: %v", err)
+		}
+
+		meta, err := bits.Describe(ctx, workdir)
+		if err != nil {
+			cmdutil.Fatalf("could not parse bit metadata: %v", err)
+		}
+
+		fmt.Fprintf(os.Stderr, "successfully got bit: %+v\n", meta)
+
+		//fmt.Fprintf(os.Stderr, "\n\nSuccessfully added Encore Bit: %s!\n", bit.Title)
+		//fmt.Fprintf(os.Stderr, "You can find the new bit under the %s/ directory.\n", prefix)
+	},
+}
+
+func init() {
+	bitsCmd.AddCommand(addCmd)
+}
diff --git a/cli/cmd/encore/bits/api.go b/cli/cmd/encore/bits/api.go
new file mode 100644
index 0000000000..977230bf4d
--- /dev/null
+++ b/cli/cmd/encore/bits/api.go
@@ -0,0 +1,64 @@
+package bits
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/url"
+
+	"github.com/cockroachdb/errors"
+)
+
+type Bit struct {
+	ID          int64
+	Slug        string
+	Title       string
+	Description string
+	GitRepo     string
+	GitBranch   string
+}
+
+type ListResponse struct {
+	Bits []*Bit
+}
+
+func List(ctx context.Context) ([]*Bit, error) {
+	resp, err := http.Get("https://automativity.encore.dev/bits")
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		slurp, _ := io.ReadAll(resp.Body)
+		return nil, errors.Newf("got status %d: %s", resp.StatusCode, slurp)
+	}
+	var data ListResponse
+	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
+		return nil, errors.Wrap(err, "decode json response")
+	}
+	return data.Bits, nil
+}
+
+var errBitNotFound = errors.New("bit not found")
+
+func Get(ctx context.Context, slug string) (*Bit, error) {
+	resp, err := http.Get("https://automativity.encore.dev/bits/" + url.PathEscape(slug))
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == 404 {
+		return nil, errBitNotFound
+	} else if resp.StatusCode != 200 {
+		slurp, _ := io.ReadAll(resp.Body)
+		return nil, errors.Newf("got status %d: %s", resp.StatusCode, slurp)
+	}
+	var bit Bit
+	if err := json.NewDecoder(resp.Body).Decode(&bit); err != nil {
+		return nil, errors.Wrap(err, "decode json response")
+	}
+	return &bit, nil
+}
diff --git a/cli/cmd/encore/bits/bits.go b/cli/cmd/encore/bits/bits.go
new file mode 100644
index 0000000000..50995c351a
--- /dev/null
+++ b/cli/cmd/encore/bits/bits.go
@@ -0,0 +1,16 @@
+package bits
+
+import (
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/root"
+)
+
+var bitsCmd = &cobra.Command{
+	Use:   "bits",
+	Short: "Commands to manage encore bits, reusable functionality for Encore applications",
+}
+
+func init() {
+	root.Cmd.AddCommand(bitsCmd)
+}
diff --git a/cli/cmd/encore/bits/list.go b/cli/cmd/encore/bits/list.go
new file mode 100644
index 0000000000..c5877fe13e
--- /dev/null
+++ b/cli/cmd/encore/bits/list.go
@@ -0,0 +1,37 @@
+package bits
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"text/tabwriter"
+
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/pkg/bits"
+)
+
+var listCmd = &cobra.Command{
+	Use:   "list",
+	Short: "Lists available Encore Bits to add to your application",
+	Args:  cobra.ExactArgs(0),
+	Run: func(c *cobra.Command, args []string) {
+		bits, err := bits.List(context.Background())
+		if err != nil {
+			cmdutil.Fatalf("could not list encore bits: %v", err)
+		}
+
+		tw := tabwriter.NewWriter(os.Stdout, 0, 8, 0, '\t', 0)
+		fmt.Fprintln(tw, "ID\tTitle\tDescription")
+		for _, bit := range bits {
+			fmt.Fprintf(tw, "%s\t%s\t%s\n", bit.Slug, bit.Title, bit.Description)
+			fmt.Fprintln(tw)
+		}
+		tw.Flush()
+	},
+}
+
+func init() {
+	bitsCmd.AddCommand(listCmd)
+}
diff --git a/cli/cmd/encore/build.go b/cli/cmd/encore/build.go
new file mode 100644
index 0000000000..954ee4a14e
--- /dev/null
+++ b/cli/cmd/encore/build.go
@@ -0,0 +1,157 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"os/signal"
+	"path/filepath"
+
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/pkg/appfile"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+var (
+	targetOS = cmdutil.Oneof{
+		Value:   "linux",
+		Allowed: []string{"linux"},
+		Flag:    "os",
+		Desc:    "the target operating system",
+	}
+	targetArch = cmdutil.Oneof{
+		Value:   "amd64",
+		Allowed: []string{"amd64", "arm64"},
+		Flag:    "arch",
+		Desc:    "the target architecture",
+	}
+)
+
+func init() {
+	buildCmd := &cobra.Command{
+		Use:     "build",
+		Aliases: []string{"eject"},
+		Short:   "build provides ways to build your application for deployment",
+	}
+
+	p := buildParams{
+		CgoEnabled: os.Getenv("CGO_ENABLED") == "1",
+	}
+	dockerBuildCmd := &cobra.Command{
+		Use:   "docker IMAGE_TAG",
+		Short: "docker builds a portable docker image of your Encore application",
+		Args:  cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			p.Goarch = targetArch.Value
+			p.Goos = targetOS.Value
+			p.AppRoot, _ = determineAppRoot()
+			p.WorkspaceRoot = determineWorkspaceRoot(p.AppRoot)
+			file, err := appfile.ParseFile(filepath.Join(p.AppRoot, appfile.Name))
+			if err == nil {
+				if !cmd.Flag("base").Changed && file.Lang == appfile.LangTS {
+					p.BaseImg = "node:slim"
+				}
+				if !cmd.Flag("cgo").Changed {
+					p.CgoEnabled = file.Build.CgoEnabled
+				}
+			}
+			p.ImageTag = args[0]
+			dockerBuild(p)
+		},
+	}
+
+	dockerBuildCmd.Flags().BoolVarP(&p.Push, "push", "p", false, "push image to remote repository")
+	dockerBuildCmd.Flags().StringVar(&p.BaseImg, "base", "scratch", "base image to build from")
+	dockerBuildCmd.Flags().BoolVar(&p.CgoEnabled, "cgo", false, "enable cgo")
+	dockerBuildCmd.Flags().BoolVar(&p.SkipInfraConf, "skip-config", false, "do not read or generate a infra configuration file")
+	dockerBuildCmd.Flags().StringVar(&p.InfraConfPath, "config", "", "infra configuration file path")
+	p.Services = dockerBuildCmd.Flags().StringSlice("services", nil, "services to include in the image")
+	p.Gateways = dockerBuildCmd.Flags().StringSlice("gateways", nil, "gateways to include in the image")
+	targetOS.AddFlag(dockerBuildCmd)
+	targetArch.AddFlag(dockerBuildCmd)
+	rootCmd.AddCommand(buildCmd)
+	buildCmd.AddCommand(dockerBuildCmd)
+}
+
+type buildParams struct {
+	AppRoot       string
+	WorkspaceRoot string
+	ImageTag      string
+	Push          bool
+	BaseImg       string
+	Goos          string
+	Goarch        string
+	CgoEnabled    bool
+	SkipInfraConf bool
+	InfraConfPath string
+	Services      *[]string
+	Gateways      *[]string
+}
+
+func dockerBuild(p buildParams) {
+	interrupt := make(chan os.Signal, 1)
+	signal.Notify(interrupt, os.Interrupt)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		<-interrupt
+		cancel()
+	}()
+
+	daemon := setupDaemon(ctx)
+	params := &daemonpb.DockerExportParams{
+		BaseImageTag: p.BaseImg,
+	}
+	if p.Push {
+		params.PushDestinationTag = p.ImageTag
+	} else {
+		params.LocalDaemonTag = p.ImageTag
+	}
+
+	var services, gateways []string
+	if p.Services != nil {
+		services = *p.Services
+	}
+	if p.Gateways != nil {
+		gateways = *p.Gateways
+	}
+	var err error
+	cfgPath := ""
+	if p.InfraConfPath != "" {
+		cfgPath, err = filepath.Abs(p.InfraConfPath)
+		if err != nil {
+			cmdutil.Fatalf("failed to resolve absolute path for %s: %v", p.InfraConfPath, err)
+		}
+	}
+	stream, err := daemon.Export(ctx, &daemonpb.ExportRequest{
+		AppRoot:       p.AppRoot,
+		WorkspaceRoot: p.WorkspaceRoot,
+		CgoEnabled:    p.CgoEnabled,
+		Goos:          p.Goos,
+		Goarch:        p.Goarch,
+		Environ:       os.Environ(),
+		Format: &daemonpb.ExportRequest_Docker{
+			Docker: params,
+		},
+		InfraConfPath: cfgPath,
+		Services:      services,
+		Gateways:      gateways,
+		SkipInfraConf: p.SkipInfraConf,
+	})
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "fatal: ", err)
+		os.Exit(1)
+	}
+	if code := cmdutil.StreamCommandOutput(stream, cmdutil.ConvertJSONLogs()); code != 0 {
+		os.Exit(code)
+	}
+}
+
+func or(a, b string) string {
+	if a != "" {
+		return a
+	}
+	return b
+}
diff --git a/cli/cmd/encore/check.go b/cli/cmd/encore/check.go
index a813e4b064..5c31ad2844 100644
--- a/cli/cmd/encore/check.go
+++ b/cli/cmd/encore/check.go
@@ -6,13 +6,22 @@ import (
 	"os"
 	"os/signal"
 
-	daemonpb "encr.dev/proto/encore/daemon"
 	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+var (
+	codegenDebug    bool
+	checkParseTests bool
 )
 
 var checkCmd = &cobra.Command{
 	Use:   "check",
-	Short: "Checks your application for errors",
+	Short: "Checks your application for compile-time errors using Encore's compiler.",
+
+	DisableFlagsInUseLine: true,
 	Run: func(cmd *cobra.Command, args []string) {
 		appRoot, relPath := determineAppRoot()
 		runChecks(appRoot, relPath)
@@ -21,6 +30,8 @@ var checkCmd = &cobra.Command{
 
 func init() {
 	rootCmd.AddCommand(checkCmd)
+	checkCmd.Flags().BoolVar(&codegenDebug, "codegen-debug", false, "Dump generated code (for debugging Encore's code generation)")
+	checkCmd.Flags().BoolVar(&checkParseTests, "tests", false, "Parse tests as well")
 }
 
 func runChecks(appRoot, relPath string) {
@@ -34,10 +45,16 @@ func runChecks(appRoot, relPath string) {
 	}()
 
 	daemon := setupDaemon(ctx)
-	stream, err := daemon.Check(ctx, &daemonpb.CheckRequest{AppRoot: appRoot, WorkingDir: relPath})
+	stream, err := daemon.Check(ctx, &daemonpb.CheckRequest{
+		AppRoot:      appRoot,
+		WorkingDir:   relPath,
+		CodegenDebug: codegenDebug,
+		ParseTests:   checkParseTests,
+		Environ:      os.Environ(),
+	})
 	if err != nil {
 		fmt.Fprintln(os.Stderr, "fatal: ", err)
 		os.Exit(1)
 	}
-	streamCommandOutput(stream)
+	os.Exit(cmdutil.StreamCommandOutput(stream, nil))
 }
diff --git a/cli/cmd/encore/cmdutil/autocompletes.go b/cli/cmd/encore/cmdutil/autocompletes.go
new file mode 100644
index 0000000000..d484c75848
--- /dev/null
+++ b/cli/cmd/encore/cmdutil/autocompletes.go
@@ -0,0 +1,87 @@
+package cmdutil
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/internal/platform"
+	"encr.dev/internal/conf"
+)
+
+func AutoCompleteFromStaticList(args ...string) func(cmd *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	return func(cmd *cobra.Command, _ []string, toComplete string) (rtn []string, dir cobra.ShellCompDirective) {
+		toComplete = strings.ToLower(toComplete)
+
+		for _, option := range args {
+			before, _, _ := strings.Cut(option, "\t")
+
+			if strings.HasPrefix(before, toComplete) {
+				rtn = append(rtn, option)
+			}
+		}
+
+		return rtn, cobra.ShellCompDirectiveNoFileComp
+	}
+}
+
+func AutoCompleteAppSlug(cmd *cobra.Command, _ []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	// incase of not being logged in or an error, we give no auto competition
+	_, err := conf.CurrentUser()
+	if err != nil {
+		return nil, cobra.ShellCompDirectiveError
+	}
+
+	apps, err := platform.ListApps(cmd.Context())
+	if err != nil {
+		return nil, cobra.ShellCompDirectiveError
+	}
+
+	toComplete = strings.ToLower(toComplete)
+
+	rtn := make([]string, 0, len(apps))
+	for _, app := range apps {
+		if strings.HasPrefix(strings.ToLower(app.Slug), toComplete) {
+			desc := app.Description
+			if desc == "" {
+				desc = app.Name
+			}
+
+			rtn = append(rtn, fmt.Sprintf("%s\t%s", app.Slug, desc))
+		}
+	}
+
+	return rtn, cobra.ShellCompDirectiveNoFileComp
+}
+
+func AutoCompleteEnvSlug(cmd *cobra.Command, args []string, toComplete string) (rtn []string, dir cobra.ShellCompDirective) {
+	toComplete = strings.ToLower(toComplete)
+
+	// Support the local environment
+	if strings.HasPrefix("local", toComplete) {
+		rtn = append(rtn, "local\tThis local development environment")
+	}
+
+	_, err := conf.CurrentUser()
+	if err != nil {
+		return rtn, cobra.ShellCompDirectiveError
+	}
+
+	// Assume the app slug is the first argument
+	appSlug := args[len(args)-1]
+
+	// Get the environments for the app and filter by what the user has already entered
+	envs, err := platform.ListEnvs(cmd.Context(), appSlug)
+	if err != nil {
+		return rtn, cobra.ShellCompDirectiveError
+	}
+
+	for _, env := range envs {
+		if strings.HasPrefix(strings.ToLower(env.Slug), toComplete) {
+			rtn = append(rtn, fmt.Sprintf("%s\tA %s enviroment running on %s", env.Slug, env.Type, env.Cloud))
+		}
+	}
+
+	return rtn, cobra.ShellCompDirectiveNoFileComp
+}
diff --git a/cli/cmd/encore/cmdutil/cmdutil.go b/cli/cmd/encore/cmdutil/cmdutil.go
new file mode 100644
index 0000000000..c1c8883b25
--- /dev/null
+++ b/cli/cmd/encore/cmdutil/cmdutil.go
@@ -0,0 +1,187 @@
+package cmdutil
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+
+	"github.com/fatih/color"
+	"golang.org/x/crypto/ssh/terminal"
+	"google.golang.org/grpc/status"
+
+	"encr.dev/cli/internal/manifest"
+	"encr.dev/pkg/appfile"
+	"encr.dev/pkg/errinsrc"
+	"encr.dev/pkg/errlist"
+)
+
+var (
+	ErrNoEncoreApp    = errors.New("no encore.app found in directory (or any of the parent directories)")
+	ErrEncoreAppIsDir = errors.New("encore.app is a directory, not a file")
+)
+
+// MaybeAppRoot determines the app root by looking for the "encore.app" file,
+// initially in the current directory and then recursively in parent directories
+// up to the filesystem root.
+//
+// It reports the absolute path to the app root, and the
+// relative path from the app root to the working directory.
+func MaybeAppRoot() (appRoot, relPath string, err error) {
+	dir, err := os.Getwd()
+	if err != nil {
+		return "", "", err
+	}
+	return FindAppRootFromDir(dir)
+}
+
+func FindAppRootFromDir(dir string) (appRoot, relPath string, err error) {
+	rel := "."
+	for {
+		path := filepath.Join(dir, "encore.app")
+		fi, err := os.Stat(path)
+		if errors.Is(err, fs.ErrNotExist) {
+			dir2 := filepath.Dir(dir)
+			if dir2 == dir {
+				return "", "", ErrNoEncoreApp
+			}
+			rel = filepath.Join(filepath.Base(dir), rel)
+			dir = dir2
+			continue
+		} else if err != nil {
+			return "", "", err
+		} else if fi.IsDir() {
+			return "", "", ErrEncoreAppIsDir
+		} else {
+			return dir, rel, nil
+		}
+	}
+}
+
+// AppRoot is like MaybeAppRoot but instead of returning an error
+// it prints it to stderr and exits.
+func AppRoot() (appRoot, relPath string) {
+	appRoot, relPath, err := MaybeAppRoot()
+	if err != nil {
+		Fatal(err)
+	}
+	return appRoot, relPath
+}
+
+// WorkspaceRoot determines the workspace root by looking for the .git folder in app root or parents to it.
+// It reports the absolute path to the workspace root.
+func WorkspaceRoot(appRoot string) string {
+	dir := appRoot
+	for {
+		path := filepath.Join(dir, ".git")
+		fi, err := os.Stat(path)
+		if errors.Is(err, fs.ErrNotExist) {
+			dir2 := filepath.Dir(dir)
+			if dir2 == dir {
+				return appRoot
+			}
+			dir = dir2
+			continue
+		} else if err != nil {
+			Fatal(err)
+		} else if !fi.IsDir() {
+			continue
+		} else {
+			return dir
+		}
+	}
+}
+
+func AppSlugOrLocalID() string {
+	appRoot, _ := AppRoot()
+	appID, _ := appfile.Slug(appRoot)
+	if appID == "" {
+		mf, err := manifest.ReadOrCreate(appRoot)
+		if err != nil {
+			Fatalf("failed to read app manifest: %v", err)
+		}
+		appID = mf.LocalID
+	}
+	return appID
+}
+
+// AppSlug reports the current app's app slug.
+// It throws a fatal error if the app is not connected with the Encore Platform.
+func AppSlug() string {
+	appRoot, _ := AppRoot()
+	appSlug, err := appfile.Slug(appRoot)
+	if err != nil {
+		Fatal(err)
+	} else if appSlug == "" {
+		Fatal("app is not linked with the Encore Platform (see 'encore app link')")
+	}
+	return appSlug
+}
+
+func Fatal(args ...any) {
+	// Prettify gRPC errors
+	for i, arg := range args {
+		if err, ok := arg.(error); ok {
+			if s, ok := status.FromError(err); ok {
+				args[i] = s.Message()
+			}
+		}
+	}
+
+	red := color.New(color.FgRed)
+	_, _ = red.Fprint(os.Stderr, "error: ")
+	_, _ = red.Fprintln(os.Stderr, args...)
+	os.Exit(1)
+}
+
+func Fatalf(format string, args ...any) {
+	// Prettify gRPC errors
+	for i, arg := range args {
+		if err, ok := arg.(error); ok {
+			if s, ok := status.FromError(err); ok {
+				args[i] = s.Message()
+			}
+		}
+	}
+
+	Fatal(fmt.Sprintf(format, args...))
+}
+
+func DisplayError(out *os.File, err []byte) {
+	if len(err) == 0 {
+		return
+	}
+
+	// Get the width of the terminal we're rendering in
+	// if we can so we render using the most space possible.
+	width, _, sizeErr := terminal.GetSize(int(out.Fd()))
+	if sizeErr == nil {
+		errinsrc.TerminalWidth = width
+	}
+
+	// Unmarshal the error into a structured errlist
+	errList := errlist.New(nil)
+	if err := json.Unmarshal(err, &errList); err != nil {
+		Fatalf("unable to parse error: %v", err)
+	}
+
+	if errList.Len() == 0 {
+		return
+	}
+
+	_, _ = os.Stderr.Write([]byte(errList.Error()))
+}
+
+var Newline string
+
+func init() {
+	switch runtime.GOOS {
+	case "windows":
+		Newline = "\r\n"
+	default:
+		Newline = "\n"
+	}
+}
diff --git a/cli/cmd/encore/cmdutil/daemon.go b/cli/cmd/encore/cmdutil/daemon.go
new file mode 100644
index 0000000000..728532cd96
--- /dev/null
+++ b/cli/cmd/encore/cmdutil/daemon.go
@@ -0,0 +1,188 @@
+package cmdutil
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"time"
+
+	"github.com/golang/protobuf/ptypes/empty"
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"encr.dev/internal/version"
+	"encr.dev/pkg/xos"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+func IsDaemonRunning(ctx context.Context) bool {
+	socketPath, err := daemonSockPath()
+	if err != nil {
+		return false
+	}
+	if _, err := xos.SocketStat(socketPath); err == nil {
+		// The socket exists; check that it is responsive.
+		if cc, err := dialDaemon(ctx, socketPath); err == nil {
+			_ = cc.Close()
+			return true
+		}
+		// socket is not responding, remove it
+		_ = os.Remove(socketPath)
+	}
+	return false
+
+}
+
+// ConnectDaemon returns a client connection to the Encore daemon.
+// By default, it will start the daemon if it is not already running.
+func ConnectDaemon(ctx context.Context) daemonpb.DaemonClient {
+	socketPath, err := daemonSockPath()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "fatal: ", err)
+		os.Exit(1)
+	}
+
+	if _, err := xos.SocketStat(socketPath); err == nil {
+		// The socket exists; check that it is responsive.
+		if cc, err := dialDaemon(ctx, socketPath); err == nil {
+			// Make sure the daemon is running an up-to-date version;
+			// restart it otherwise.
+			cl := daemonpb.NewDaemonClient(cc)
+			if resp, err := cl.Version(ctx, &empty.Empty{}); err == nil {
+				diff := version.Compare(resp.Version)
+				switch {
+				case diff < 0:
+					// Daemon is running a newer version
+					return cl
+				case diff == 0:
+					if configHash, err := version.ConfigHash(); err != nil {
+						Fatal("unable to get config path: ", err)
+					} else if configHash == resp.ConfigHash {
+						return cl
+					}
+
+					// If we're running a development release, and so is the daemon, don't restart.
+					// This is to avoid spurious restarts during development.
+					if version.Channel == version.DevBuild && version.ChannelFor(resp.Version) == version.DevBuild {
+						return cl
+					}
+
+					// Daemon is running the same version but different config
+					fmt.Fprintf(os.Stderr, "encore: restarting daemon due to configuration change.\n")
+				case diff > 0:
+					fmt.Fprintf(os.Stderr, "encore: daemon is running an outdated version (%s), restarting.\n", resp.Version)
+				}
+			}
+		}
+		// Remove the socket file which triggers the daemon to exit.
+		_ = os.Remove(socketPath)
+	}
+
+	// Start the daemon.
+	if err := StartDaemonInBackground(ctx); err != nil {
+		Fatal("starting daemon: ", err)
+	}
+	cc, err := dialDaemon(ctx, socketPath)
+	if err != nil {
+		Fatal("dialing daemon: ", err)
+	}
+	return daemonpb.NewDaemonClient(cc)
+}
+
+func StopDaemon() {
+	socketPath, err := daemonSockPath()
+	if err != nil {
+		Fatal("stopping daemon: ", err)
+	}
+	if _, err := xos.SocketStat(socketPath); err == nil {
+		_ = os.Remove(socketPath)
+	}
+}
+
+// daemonSockPath reports the path to the Encore daemon unix socket.
+func daemonSockPath() (string, error) {
+	cacheDir, err := os.UserCacheDir()
+	if err != nil {
+		return "", fmt.Errorf("could not determine cache dir: %v", err)
+	}
+	return filepath.Join(cacheDir, "encore", "encored.sock"), nil
+}
+
+// StartDaemonInBackground starts the Encore daemon in the background.
+func StartDaemonInBackground(ctx context.Context) error {
+	socketPath, err := daemonSockPath()
+	if err != nil {
+		return err
+	}
+
+	// nosemgrep
+	exe, err := os.Executable()
+	if err != nil {
+		exe, err = exec.LookPath("encore")
+	}
+	if err != nil {
+		return fmt.Errorf("could not determine location of encore executable: %v", err)
+	}
+	// nosemgrep
+	cmd := exec.Command(exe, "daemon", "-f")
+	cmd.SysProcAttr = xos.CreateNewProcessGroup()
+	if err := cmd.Start(); err != nil {
+		return fmt.Errorf("could not start encore daemon: %v", err)
+	}
+
+	// Wait for it to come up
+	for i := 0; i < 50; i++ {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		time.Sleep(100 * time.Millisecond)
+		if _, err := xos.SocketStat(socketPath); err == nil {
+			return nil
+		}
+	}
+	return fmt.Errorf("timed out waiting for daemon to start")
+}
+
+func dialDaemon(ctx context.Context, socketPath string) (*grpc.ClientConn, error) {
+	ctx, cancel := context.WithTimeout(ctx, 500*time.Millisecond)
+	defer cancel()
+
+	dialer := func(ctx context.Context, addr string) (net.Conn, error) {
+		return (&net.Dialer{}).DialContext(ctx, "unix", socketPath)
+	}
+	// Set max message size to 16mb (up from default 4mb) for json formatted debug metadata for large applications.
+	return grpc.DialContext(ctx, "",
+		grpc.WithInsecure(),
+		grpc.WithBlock(),
+		grpc.WithUnaryInterceptor(errInterceptor),
+		grpc.WithContextDialer(dialer),
+		grpc.WithDefaultCallOptions(grpc.MaxCallRecvMsgSize(16*1024*1024)),
+	)
+}
+
+func errInterceptor(ctx context.Context, method string, req, reply interface{}, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
+	err := invoker(ctx, method, req, reply, cc, opts...)
+	if err != nil {
+		if st, ok := status.FromError(err); ok {
+			if st.Code() == codes.Unauthenticated {
+				Fatal("not logged in: run 'encore auth login' first")
+			}
+			for _, detail := range st.Details() {
+				switch t := detail.(type) {
+				case *errdetails.PreconditionFailure:
+					for _, violation := range t.Violations {
+						if violation.Type == "INVALID_REFRESH_TOKEN" {
+							Fatal("OAuth refresh token was invalid. Please run `encore auth login` again.")
+						}
+					}
+				}
+			}
+		}
+	}
+	return err
+}
diff --git a/cli/cmd/encore/cmdutil/output.go b/cli/cmd/encore/cmdutil/output.go
new file mode 100644
index 0000000000..be78f7802e
--- /dev/null
+++ b/cli/cmd/encore/cmdutil/output.go
@@ -0,0 +1,111 @@
+package cmdutil
+
+import (
+	"errors"
+	"slices"
+	"strconv"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+type Oneof struct {
+	Value       string
+	Allowed     []string
+	Flag        string // defaults to "output" if empty
+	FlagShort   string // defaults to "o" if both Flag and FlagShort are empty
+	Desc        string // usage desc
+	TypeDesc    string // type description, defaults to the name of the flag
+	NoOptDefVal string // default value when no option is provided
+}
+
+func (o *Oneof) AddFlag(cmd *cobra.Command) {
+	name, short := o.FlagName()
+	cmd.Flags().AddFlag(
+		&pflag.Flag{
+			Name:        name,
+			NoOptDefVal: o.NoOptDefVal,
+			Shorthand:   short,
+			Usage:       o.Usage(),
+			Value:       o,
+			DefValue:    o.String(),
+		})
+	_ = cmd.RegisterFlagCompletionFunc(name, func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		return o.Allowed, cobra.ShellCompDirectiveNoFileComp
+	})
+}
+
+func (o *Oneof) FlagName() (name, short string) {
+	name, short = o.Flag, o.FlagShort
+	if name == "" {
+		name, short = "output", "o"
+	}
+	return name, short
+}
+
+func (o *Oneof) String() string {
+	return o.Value
+}
+
+func (o *Oneof) Type() string {
+	if o.TypeDesc != "" {
+		return o.TypeDesc
+	}
+	name, _ := o.FlagName()
+	return name
+}
+
+func (o *Oneof) Set(v string) error {
+	if slices.Contains(o.Allowed, v) {
+		o.Value = v
+		return nil
+	}
+
+	var b strings.Builder
+	b.WriteString("must be one of ")
+	o.oneOf(&b)
+	return errors.New(b.String())
+}
+
+func (o *Oneof) Usage() string {
+	var b strings.Builder
+	desc := o.Desc
+	if desc == "" {
+		desc = "Output format"
+	}
+	b.WriteString(desc + ". One of (")
+	o.oneOf(&b)
+	b.WriteString(").")
+	return b.String()
+}
+
+// Alternatives lists the alternatives in the format "a|b|c".
+func (o *Oneof) Alternatives() string {
+	var b strings.Builder
+	for i, s := range o.Allowed {
+		if i > 0 {
+			b.WriteByte('|')
+		}
+		b.WriteString(s)
+	}
+	return b.String()
+}
+
+func (o *Oneof) oneOf(b *strings.Builder) {
+	n := len(o.Allowed)
+	for i, s := range o.Allowed {
+		if i > 0 {
+			switch {
+			case n == 2:
+				b.WriteString(" or ")
+			case i == n-1:
+				b.WriteString(", or ")
+			default:
+				b.WriteString(", ")
+			}
+		}
+
+		b.WriteString(strconv.Quote(s))
+	}
+}
diff --git a/cli/cmd/encore/cmdutil/stream.go b/cli/cmd/encore/cmdutil/stream.go
new file mode 100644
index 0000000000..e62790cf83
--- /dev/null
+++ b/cli/cmd/encore/cmdutil/stream.go
@@ -0,0 +1,203 @@
+package cmdutil
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+	"sync"
+
+	"github.com/logrusorgru/aurora/v3"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"golang.org/x/crypto/ssh/terminal"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"encr.dev/pkg/ansi"
+	"encr.dev/proto/encore/daemon"
+)
+
+// CommandOutputStream is the interface for gRPC streams that
+// stream the output of a command.
+type CommandOutputStream interface {
+	Recv() (*daemon.CommandMessage, error)
+}
+
+type OutputConverter func(line []byte) []byte
+
+// StreamCommandOutput streams the output from the given command stream,
+// and reports the command's exit code.
+// If convertJSON is true, lines that look like JSON are fed through
+// zerolog's console writer.
+func StreamCommandOutput(stream CommandOutputStream, converter OutputConverter) int {
+	var outWrite io.Writer = os.Stdout
+	var errWrite io.Writer = os.Stderr
+
+	var writesDone sync.WaitGroup
+	defer writesDone.Wait()
+
+	if converter != nil {
+		// Create a pipe that we read from line-by-line so we can detect JSON lines.
+		outRead, outw := io.Pipe()
+		errRead, errw := io.Pipe()
+		outWrite = outw
+		errWrite = errw
+		defer func() { _ = outw.Close() }()
+		defer func() { _ = errw.Close() }()
+
+		for i, read := range []io.Reader{outRead, errRead} {
+			read := read
+			stdout := i == 0
+			writesDone.Add(1)
+			go func() {
+				defer writesDone.Done()
+
+				for {
+					scanner := bufio.NewScanner(read)
+					for scanner.Scan() {
+						line := append(scanner.Bytes(), '\n')
+						line = converter(line)
+						if stdout {
+							_, _ = os.Stdout.Write(line)
+						} else {
+							_, _ = os.Stderr.Write(line)
+						}
+					}
+					if err := scanner.Err(); err != nil {
+						// The scanner failed, likely due to a too-long line. Log an error
+						// and create a new scanner since the old one is in an unrecoverable state.
+						fmt.Fprintln(os.Stderr, "failed to read output:", err)
+						scanner = bufio.NewScanner(read)
+						continue
+					} else {
+						break
+					}
+				}
+			}()
+		}
+	}
+
+	for {
+		msg, err := stream.Recv()
+		if err != nil {
+			st := status.Convert(err)
+			switch {
+			case st.Code() == codes.FailedPrecondition:
+				_, _ = fmt.Fprintln(os.Stderr, st.Message())
+				return 1
+			case err == io.EOF || st.Code() == codes.Canceled || strings.HasSuffix(err.Error(), "error reading from server: EOF"):
+				return 0
+			default:
+				log.Fatal().Err(err).Msg("connection failure")
+			}
+		}
+
+		switch m := msg.Msg.(type) {
+		case *daemon.CommandMessage_Output:
+			if m.Output.Stdout != nil {
+				_, _ = outWrite.Write(m.Output.Stdout)
+			}
+			if m.Output.Stderr != nil {
+				_, _ = errWrite.Write(m.Output.Stderr)
+			}
+		case *daemon.CommandMessage_Errors:
+			DisplayError(os.Stderr, m.Errors.Errinsrc)
+
+		case *daemon.CommandMessage_Exit:
+			return int(m.Exit.Code)
+		}
+	}
+}
+
+type ConvertLogOptions struct {
+	Color bool
+}
+
+type ConvertLogOption func(*ConvertLogOptions)
+
+func Colorize(enable bool) ConvertLogOption {
+	return func(clo *ConvertLogOptions) {
+		clo.Color = enable
+	}
+}
+
+func ConvertJSONLogs(opts ...ConvertLogOption) OutputConverter {
+	// Default to colorized output.
+	options := ConvertLogOptions{Color: true}
+
+	for _, opt := range opts {
+		opt(&options)
+	}
+
+	var logMutex sync.Mutex
+	logLineBuffer := bytes.NewBuffer(make([]byte, 0, 1024))
+	cout := zerolog.NewConsoleWriter(func(w *zerolog.ConsoleWriter) {
+		w.Out = logLineBuffer
+		w.FieldsExclude = []string{"stack"}
+		w.FormatExtra = func(vals map[string]any, buf *bytes.Buffer) error {
+			if stack, ok := vals["stack"]; ok {
+				return FormatStack(stack, buf)
+			}
+			return nil
+		}
+	})
+	if !options.Color {
+		cout.NoColor = true
+	}
+
+	return func(line []byte) []byte {
+		// If this isn't a JSON log line, just return it as-is
+		if len(line) == 0 || line[0] != '{' {
+			return line
+		}
+
+		// Otherwise grab the converter buffer and reset it
+		logMutex.Lock()
+		defer logMutex.Unlock()
+		logLineBuffer.Reset()
+
+		// Then convert the JSON log line to pretty formatted text
+		_, err := cout.Write(line)
+		if err != nil {
+			return line
+		}
+		out := make([]byte, len(logLineBuffer.Bytes()))
+		copy(out, logLineBuffer.Bytes())
+		return out
+	}
+}
+
+func FormatStack(val any, buf *bytes.Buffer) error {
+	var frames []struct {
+		File string
+		Line int
+		Func string
+	}
+
+	if jsonRepr, err := json.Marshal(val); err != nil {
+		return err
+	} else if err := json.Unmarshal(jsonRepr, &frames); err != nil {
+		return err
+	}
+	for _, f := range frames {
+		fmt.Fprintf(buf, "\n    %s\n        %s",
+			f.Func,
+			aurora.Gray(12, fmt.Sprintf("%s:%d", f.File, f.Line)))
+	}
+	return nil
+}
+
+func ClearTerminalExceptFirstNLines(n int) {
+	// Clear the screen except for the first line.
+	if _, height, err := terminal.GetSize(int(os.Stdout.Fd())); err == nil {
+		count := height - (1 + n)
+		if count > 0 {
+			_, _ = os.Stdout.Write(bytes.Repeat([]byte{'\n'}, count))
+		}
+		_, _ = fmt.Fprint(os.Stdout, ansi.SetCursorPosition(2, 1)+ansi.ClearScreen(ansi.CursorToBottom))
+	}
+}
diff --git a/cli/cmd/encore/config/config.go b/cli/cmd/encore/config/config.go
new file mode 100644
index 0000000000..0723ba80fd
--- /dev/null
+++ b/cli/cmd/encore/config/config.go
@@ -0,0 +1,127 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/cmd/encore/root"
+	"encr.dev/internal/userconfig"
+	"github.com/spf13/cobra"
+)
+
+var (
+	forceApp, forceGlobal bool
+	viewAllSettings       bool
+)
+
+var autoCompleteConfigKeys = cmdutil.AutoCompleteFromStaticList(userconfig.Keys()...)
+
+var longDocs = `Gets or sets configuration values for customizing the behavior of the Encore CLI.
+
+Configuration options can be set both for individual Encore applications,
+as well as globally for the local user.
+
+Configuration options can be set using ` + bt("encore config <key> <value>") + `,
+and options can similarly be read using ` + bt("encore config <key>") + `.
+
+When running ` + bt("encore config") + ` within an Encore application,
+it automatically sets and gets configuration for that application.
+
+To set or get global configuration, use the ` + bt("--global") + ` flag.
+
+Available configuration settings are:
+
+` + userconfig.CLIDocs()
+
+var configCmd = &cobra.Command{
+	Use:   "config <key> [<value>]",
+	Short: "Get or set a configuration value",
+	Long:  longDocs,
+	Args:  cobra.RangeArgs(0, 2),
+
+	Run: func(cmd *cobra.Command, args []string) {
+		appRoot, _, _ := cmdutil.MaybeAppRoot()
+
+		appScope := appRoot != ""
+		if forceApp {
+			appScope = true
+		} else if forceGlobal {
+			appScope = false
+		}
+
+		if appScope && appRoot == "" {
+			// If the user specified --app, error if there is no app.
+			cmdutil.Fatal(cmdutil.ErrNoEncoreApp)
+		}
+
+		if len(args) == 2 {
+			var err error
+			if appScope {
+				err = userconfig.SetForApp(appRoot, args[0], args[1])
+			} else {
+				err = userconfig.SetGlobal(args[0], args[1])
+			}
+			if err != nil {
+				cmdutil.Fatal(err)
+			}
+		} else {
+			var (
+				cfg *userconfig.Config
+				err error
+			)
+			if appScope {
+				appRoot, _ := cmdutil.AppRoot()
+				cfg, err = userconfig.ForApp(appRoot).Get()
+			} else {
+				cfg, err = userconfig.Global().Get()
+			}
+			if err != nil {
+				cmdutil.Fatal(err)
+			}
+
+			if viewAllSettings {
+				if len(args) > 0 {
+					cmdutil.Fatalf("cannot specify a settings key when using --all")
+				}
+				s := strings.TrimSuffix(cfg.Render(), "\n")
+				fmt.Println(s)
+				return
+			}
+
+			if len(args) == 0 {
+				// No args are only allowed when --all is specified.
+				_ = cmd.Usage()
+				os.Exit(1)
+			}
+
+			val, ok := cfg.GetByKey(args[0])
+			if !ok {
+				cmdutil.Fatalf("unknown key %q", args[0])
+			}
+			fmt.Printf("%v\n", val)
+		}
+	},
+	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		if len(args) == 0 {
+			// Completing the first argument, the config key
+			return autoCompleteConfigKeys(cmd, args, toComplete)
+		}
+		return nil, cobra.ShellCompDirectiveNoFileComp
+	},
+}
+
+func init() {
+	configCmd.Flags().BoolVar(&viewAllSettings, "all", false, "view all settings")
+	configCmd.Flags().BoolVar(&forceApp, "app", false, "set the value for the current app")
+	configCmd.Flags().BoolVar(&forceGlobal, "global", false, "set the value at the global level")
+	configCmd.MarkFlagsMutuallyExclusive("app", "global")
+
+	root.Cmd.AddCommand(configCmd)
+}
+
+// bt renders a backtick-enclosed string.
+func bt(val string) string {
+	return fmt.Sprintf("`%s`", val)
+}
diff --git a/cli/cmd/encore/daemon.go b/cli/cmd/encore/daemon.go
index f8897f2857..c2d11933cf 100644
--- a/cli/cmd/encore/daemon.go
+++ b/cli/cmd/encore/daemon.go
@@ -3,19 +3,14 @@ package main
 import (
 	"context"
 	"fmt"
-	"net"
 	"os"
-	"os/exec"
-	"path/filepath"
-	"time"
 
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
 	daemonpkg "encr.dev/cli/cmd/encore/daemon"
-	"encr.dev/cli/internal/xos"
+	"encr.dev/internal/env"
 	daemonpb "encr.dev/proto/encore/daemon"
-	"github.com/golang/protobuf/ptypes/empty"
-	"github.com/spf13/cobra"
-	"golang.org/x/mod/semver"
-	"google.golang.org/grpc"
 )
 
 var daemonizeForeground bool
@@ -25,9 +20,9 @@ var daemonCmd = &cobra.Command{
 	Short: "Starts the encore daemon",
 	Run: func(cc *cobra.Command, args []string) {
 		if daemonizeForeground {
-			daemonpkg.Main(Version)
+			daemonpkg.Main()
 		} else {
-			if err := daemonize(context.Background()); err != nil {
+			if err := cmdutil.StartDaemonInBackground(context.Background()); err != nil {
 				fatal(err)
 			}
 			fmt.Fprintln(os.Stdout, "encore daemon is now running")
@@ -38,96 +33,20 @@ var daemonCmd = &cobra.Command{
 func init() {
 	rootCmd.AddCommand(daemonCmd)
 	daemonCmd.Flags().BoolVarP(&daemonizeForeground, "foreground", "f", false, "Start the daemon in the foreground")
+	daemonCmd.AddCommand(daemonEnvCmd)
 }
 
-// daemonize starts the Encore daemon in the background.
-func daemonize(ctx context.Context) error {
-	socketPath, err := daemonSockPath()
-	if err != nil {
-		return err
-	}
-
-	exe, err := os.Executable()
-	if err != nil {
-		exe, err = exec.LookPath("encore")
-	}
-	if err != nil {
-		return fmt.Errorf("could not determine location of encore executable: %v", err)
-	}
-	cmd := exec.Command(exe, "daemon", "-f")
-	cmd.SysProcAttr = xos.CreateNewProcessGroup()
-	if err := cmd.Start(); err != nil {
-		return fmt.Errorf("could not start encore daemon: %v", err)
-	}
-
-	// Wait for it to come up
-	for i := 0; i < 50; i++ {
-		if err := ctx.Err(); err != nil {
-			return err
-		}
-		time.Sleep(100 * time.Millisecond)
-		if _, err := xos.SocketStat(socketPath); err == nil {
-			return nil
-		}
-	}
-	return fmt.Errorf("timed out waiting for daemon to start")
-}
-
-// daemonSockPath reports the path to the Encore daemon unix socket.
-func daemonSockPath() (string, error) {
-	cacheDir, err := os.UserCacheDir()
-	if err != nil {
-		return "", fmt.Errorf("could not determine cache dir: %v", err)
-	}
-	return filepath.Join(cacheDir, "encore", "encored.sock"), nil
-}
-
-// setupDaemon sets up the Encore daemon if it isn't already running
-// and returns a client connected to it.
 func setupDaemon(ctx context.Context) daemonpb.DaemonClient {
-	socketPath, err := daemonSockPath()
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "fatal: ", err)
-		os.Exit(1)
-	}
-
-	if _, err := xos.SocketStat(socketPath); err == nil {
-		// The socket exists; check that it is responsive.
-		if cc, err := dialDaemon(ctx, socketPath); err == nil {
-			// Make sure the daemon is running an up-to-date version;
-			// restart it otherwise.
-			cl := daemonpb.NewDaemonClient(cc)
-			if resp, err := cl.Version(ctx, &empty.Empty{}); err == nil {
-				if semver.Compare(Version, resp.Version) >= 0 {
-					return cl
-				}
-				fmt.Fprintf(os.Stderr, "encore: daemon is running an outdated version (%s), restarting.\n", resp.Version)
-			}
-		}
-		// Remove the socket file which triggers the daemon to exit.
-		os.Remove(socketPath)
-	}
-
-	// Start the daemon.
-	if err := daemonize(ctx); err != nil {
-		fatal("starting daemon: ", err)
-	}
-	cc, err := dialDaemon(ctx, socketPath)
-	if err != nil {
-		fatal("dialing daemon: ", err)
-	}
-	return daemonpb.NewDaemonClient(cc)
+	return cmdutil.ConnectDaemon(ctx)
 }
 
-func dialDaemon(ctx context.Context, socketPath string) (*grpc.ClientConn, error) {
-	ctx, cancel := context.WithTimeout(ctx, 500*time.Millisecond)
-	defer cancel()
-
-	dialer := func(ctx context.Context, addr string) (net.Conn, error) {
-		return (&net.Dialer{}).DialContext(ctx, "unix", socketPath)
-	}
-	return grpc.DialContext(ctx, "",
-		grpc.WithInsecure(),
-		grpc.WithBlock(),
-		grpc.WithContextDialer(dialer))
+var daemonEnvCmd = &cobra.Command{
+	Use:   "env",
+	Short: "Prints Encore environment information",
+	Run: func(cc *cobra.Command, args []string) {
+		envs := env.List()
+		for _, e := range envs {
+			fmt.Println(e)
+		}
+	},
 }
diff --git a/cli/cmd/encore/daemon/daemon.go b/cli/cmd/encore/daemon/daemon.go
index 07bd91254f..2ce07e859e 100644
--- a/cli/cmd/encore/daemon/daemon.go
+++ b/cli/cmd/encore/daemon/daemon.go
@@ -1,72 +1,120 @@
 package daemon
 
 import (
+	"context"
+	"database/sql"
+	"embed"
+	_ "embed" // for go:embed
 	"fmt"
 	"io"
+	"io/fs"
 	"net"
 	"net/http"
+	"net/http/pprof"
+	"net/netip"
 	"os"
+	"os/signal"
 	"path/filepath"
+	"strconv"
+	"strings"
+	"syscall"
 	"time"
 
+	"github.com/cenkalti/backoff/v4"
+	"github.com/cockroachdb/errors"
+	"github.com/golang-migrate/migrate/v4"
+	"github.com/golang-migrate/migrate/v4/database"
+	"github.com/golang-migrate/migrate/v4/database/sqlite3"
+	"github.com/golang-migrate/migrate/v4/source/iofs"
+	_ "github.com/mattn/go-sqlite3" // for "sqlite3" driver
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"google.golang.org/genproto/googleapis/rpc/errdetails"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
 	"encr.dev/cli/daemon"
+	"encr.dev/cli/daemon/apps"
 	"encr.dev/cli/daemon/dash"
+	"encr.dev/cli/daemon/engine"
+	"encr.dev/cli/daemon/engine/trace2"
+	"encr.dev/cli/daemon/engine/trace2/sqlite"
+	"encr.dev/cli/daemon/mcp"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/objects"
 	"encr.dev/cli/daemon/run"
-	"encr.dev/cli/daemon/runtime"
-	"encr.dev/cli/daemon/runtime/trace"
 	"encr.dev/cli/daemon/secret"
 	"encr.dev/cli/daemon/sqldb"
-	"encr.dev/cli/internal/conf"
-	"encr.dev/cli/internal/xos"
+	"encr.dev/cli/daemon/sqldb/docker"
+	"encr.dev/cli/daemon/sqldb/external"
+	"encr.dev/internal/conf"
+	"encr.dev/internal/env"
+	"encr.dev/pkg/eerror"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/watcher"
+	"encr.dev/pkg/xos"
 	daemonpb "encr.dev/proto/encore/daemon"
-	"encr.dev/proto/encore/server/remote"
-	"github.com/rs/zerolog"
-	"github.com/rs/zerolog/log"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/credentials"
-	"google.golang.org/grpc/credentials/oauth"
-	"google.golang.org/grpc/keepalive"
 )
 
 // Main runs the daemon.
-func Main(version string) {
-	if err := runMain(version); err != nil {
+func Main() {
+	watcher.BumpRLimitSoftToHardLimit()
+
+	if err := redirectLogOutput(); err != nil {
+		log.Error().Err(err).Msg("could not setup daemon log file, skipping")
+	}
+	if err := runMain(); err != nil {
 		log.Fatal().Err(err).Msg("daemon failed")
 	}
 }
 
-func runMain(version string) (err error) {
-	// xit receives signals from the different subsystems
+func runMain() (err error) {
+	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT)
+	defer cancel()
+
+	// exit receives signals from the different subsystems
 	// that something went wrong and it's time to exit.
 	// Sending nil indicates it's time to gracefully exit.
 	exit := make(chan error)
 
-	d := &Daemon{exit: exit, Version: version}
+	d := &Daemon{dev: conf.DevDaemon, exit: exit}
 	defer handleBailout(&err)
 	defer d.closeAll()
 
-	d.init()
+	d.init(ctx)
 	d.serve()
 
-	return <-exit
+	select {
+	case err := <-exit:
+		return err
+	case <-ctx.Done():
+		return nil
+	}
 }
 
 // Daemon orchestrates setting up the different daemon subsystems.
 type Daemon struct {
-	Log     zerolog.Logger
-	Daemon  *net.UnixListener
-	Runtime *net.TCPListener
-	DBProxy *net.TCPListener
-	Dash    *net.TCPListener
-	Version string
-
-	Remote     remote.RemoteClient
-	Secret     *secret.Manager
-	RunMgr     *run.Manager
-	ClusterMgr *sqldb.ClusterManager
-	Trace      *trace.Store
-	DashSrv    *dash.Server
-	Server     *daemon.Server
+	Daemon        *net.UnixListener
+	Runtime       *retryingTCPListener
+	DBProxy       *retryingTCPListener
+	Dash          *retryingTCPListener
+	Debug         *retryingTCPListener
+	ObjectStorage *retryingTCPListener
+	MCP           *retryingTCPListener
+	EncoreDB      *sql.DB
+
+	Apps          *apps.Manager
+	Secret        *secret.Manager
+	RunMgr        *run.Manager
+	NS            *namespace.Manager
+	ClusterMgr    *sqldb.ClusterManager
+	ObjectsMgr    *objects.ClusterManager
+	MCPMgr        *mcp.Manager
+	PublicBuckets *objects.PublicBucketServer
+	Trace         trace2.Store
+	Server        *daemon.Server
+	dev           bool // whether we're in development mode
 
 	// exit is a channel that shuts down the daemon when sent on.
 	// A nil error indicates graceful exit.
@@ -76,24 +124,66 @@ type Daemon struct {
 	close []io.Closer
 }
 
-func (d *Daemon) init() {
+func (d *Daemon) init(ctx context.Context) {
 	d.Daemon = d.listenDaemonSocket()
-	d.Runtime = d.listenTCP()
-	d.DBProxy = d.listenTCP()
-	d.Dash = d.listenTCP()
-
-	d.Trace = trace.NewStore()
-	d.ClusterMgr = sqldb.NewClusterManager()
-	d.Remote = d.setupRemoteClient()
-	d.Secret = secret.New(d.Remote)
+	d.Dash = d.listenTCPRetry("dashboard", env.EncoreDevDashListenAddr(), 9400)
+	d.DBProxy = d.listenTCPRetry("dbproxy", option.None[string](), 9500)
+	d.Runtime = d.listenTCPRetry("runtime", option.None[string](), 9600)
+	d.Debug = d.listenTCPRetry("debug", option.None[string](), 9700)
+	d.ObjectStorage = d.listenTCPRetry("objectstorage", env.EncoreObjectStorageListAddr(), 9800)
+	d.MCP = d.listenTCPRetry("mcp", env.EncoreMCPSSEListenAddr(), 9900)
+	d.EncoreDB = d.openDB()
+
+	d.Apps = apps.NewManager(d.EncoreDB)
+	d.close = append(d.close, d.Apps)
+
+	// If ENCORE_SQLDB_HOST is set, use the external cluster instead of
+	// creating our own docker container cluster.
+	var sqldbDriver sqldb.Driver = &docker.Driver{}
+	if host := os.Getenv("ENCORE_SQLDB_HOST"); host != "" {
+		sqldbDriver = &external.Driver{
+			Host:              host,
+			Database:          os.Getenv("ENCORE_SQLDB_DATABASE"),
+			SuperuserUsername: os.Getenv("ENCORE_SQLDB_USER"),
+			SuperuserPassword: os.Getenv("ENCORE_SQLDB_PASSWORD"),
+		}
+		log.Info().Msgf("using external postgres cluster: %s", host)
+	}
+
+	d.NS = namespace.NewManager(d.EncoreDB)
+	d.Secret = secret.New()
+	d.ClusterMgr = sqldb.NewClusterManager(sqldbDriver, d.Apps, d.NS, d.Secret)
+	d.ObjectsMgr = objects.NewClusterManager(d.NS)
+	d.PublicBuckets = objects.NewPublicBucketServer("http://"+d.ObjectStorage.ClientAddr(), d.ObjectsMgr.PersistentStoreFallback)
+
+	traceStore := sqlite.New(d.EncoreDB)
+	go traceStore.CleanEvery(ctx, 1*time.Minute, 500, 100, 10000)
+	d.Trace = traceStore
+
 	d.RunMgr = &run.Manager{
-		RuntimePort: tcpPort(d.Runtime),
-		DBProxyPort: tcpPort(d.DBProxy),
-		DashPort:    tcpPort(d.Dash),
-		Secret:      d.Secret,
+		RuntimePort:   d.Runtime.Port(),
+		DBProxyPort:   d.DBProxy.Port(),
+		DashBaseURL:   fmt.Sprintf("http://%s", d.Dash.ClientAddr()),
+		Secret:        d.Secret,
+		ClusterMgr:    d.ClusterMgr,
+		ObjectsMgr:    d.ObjectsMgr,
+		PublicBuckets: d.PublicBuckets,
 	}
-	d.DashSrv = dash.NewServer(d.RunMgr, d.Trace)
-	d.Server = daemon.New(d.Version, d.RunMgr, d.ClusterMgr, d.Secret, d.Remote)
+	d.MCPMgr = mcp.NewManager(
+		d.Apps,
+		d.ClusterMgr,
+		d.NS,
+		d.Trace,
+		d.RunMgr,
+		fmt.Sprintf("http://%s", d.MCP.ClientAddr()),
+	)
+
+	// Register namespace deletion handlers.
+	d.NS.RegisterDeletionHandler(d.ClusterMgr)
+	d.NS.RegisterDeletionHandler(d.RunMgr)
+	d.NS.RegisterDeletionHandler(d.ObjectsMgr)
+
+	d.Server = daemon.New(d.Apps, d.RunMgr, d.ClusterMgr, d.Secret, d.NS, d.MCPMgr)
 }
 
 func (d *Daemon) serve() {
@@ -101,6 +191,9 @@ func (d *Daemon) serve() {
 	go d.serveRuntime()
 	go d.serveDBProxy()
 	go d.serveDash()
+	go d.serveDebug()
+	go d.serveObjects()
+	go d.serveMCP()
 }
 
 // listenDaemonSocket listens on the encored.sock UNIX socket
@@ -117,7 +210,7 @@ func (d *Daemon) listenDaemonSocket() *net.UnixListener {
 
 	// If the daemon socket already exists, remove it so we can take over listening.
 	if _, err := xos.SocketStat(socketPath); err == nil {
-		os.Remove(socketPath)
+		_ = os.Remove(socketPath)
 	}
 	ln, err := net.ListenUnix("unix", &net.UnixAddr{Name: socketPath, Net: "unix"})
 	if err != nil {
@@ -132,34 +225,44 @@ func (d *Daemon) listenDaemonSocket() *net.UnixListener {
 	return ln
 }
 
-// setupRemoteClient sets up a grpc client to Encore's backend service.
-func (d *Daemon) setupRemoteClient() remote.RemoteClient {
-	ts := &conf.TokenSource{}
-	dialOpts := []grpc.DialOption{
-		grpc.WithTransportCredentials(credentials.NewTLS(nil)),
-		grpc.WithPerRPCCredentials(oauth.TokenSource{TokenSource: ts}),
-		grpc.WithKeepaliveParams(keepalive.ClientParameters{
-			Time: 20 * time.Second,
-		}),
-	}
-	conn, err := grpc.Dial("remote.encoreapis.com:443", dialOpts...)
+func failedPreconditionError(msg, typ, desc string) error {
+	st, err := status.New(codes.FailedPrecondition, msg).WithDetails(
+		&errdetails.PreconditionFailure{
+			Violations: []*errdetails.PreconditionFailure_Violation{
+				{
+					Type:        typ,
+					Description: desc,
+				},
+			},
+		},
+	)
 	if err != nil {
-		fatalf("failed to dial encore server: %v", err)
+		panic(err)
 	}
-	d.closeOnExit(conn)
-	return remote.NewRemoteClient(conn)
+	return st.Err()
+}
+
+func ErrInterceptor(ctx context.Context, req interface{}, info *grpc.UnaryServerInfo, handler grpc.UnaryHandler) (resp interface{}, err error) {
+	resp, err = handler(ctx, req)
+	if errors.Is(err, conf.ErrInvalidRefreshToken) {
+		return nil, failedPreconditionError("invalid refresh token", "INVALID_REFRESH_TOKEN", "invalid refresh token")
+	} else if errors.Is(err, conf.ErrNotLoggedIn) {
+		return nil, status.Error(codes.Unauthenticated, "not logged in")
+	}
+	return resp, err
 }
 
 func (d *Daemon) serveDaemon() {
 	log.Info().Stringer("addr", d.Daemon.Addr()).Msg("serving daemon")
-	srv := grpc.NewServer()
+	srv := grpc.NewServer(grpc.UnaryInterceptor(ErrInterceptor))
 	daemonpb.RegisterDaemonServer(srv, d.Server)
 	d.exit <- srv.Serve(d.Daemon)
 }
 
 func (d *Daemon) serveRuntime() {
 	log.Info().Stringer("addr", d.Runtime.Addr()).Msg("serving runtime")
-	srv := runtime.NewServer(d.RunMgr, d.Trace, d.Remote)
+	rec := trace2.NewRecorder(d.Trace)
+	srv := engine.NewServer(d.RunMgr, rec)
 	d.exit <- http.Serve(d.Runtime, srv)
 }
 
@@ -168,24 +271,139 @@ func (d *Daemon) serveDBProxy() {
 	d.exit <- d.ClusterMgr.ServeProxy(d.DBProxy)
 }
 
+func (d *Daemon) serveMCP() {
+	log.Info().Stringer("addr", d.MCP.Addr()).Msg("serving mcp")
+	d.exit <- d.MCPMgr.Serve(d.MCP)
+}
+
+func (d *Daemon) serveObjects() {
+	log.Info().Stringer("addr", d.ObjectStorage.Addr()).Msg("serving object storage")
+	d.exit <- d.PublicBuckets.Serve(d.ObjectStorage)
+}
+
 func (d *Daemon) serveDash() {
 	log.Info().Stringer("addr", d.Dash.Addr()).Msg("serving dash")
-	srv := dash.NewServer(d.RunMgr, d.Trace)
+	srv := dash.NewServer(d.Apps, d.RunMgr, d.NS, d.Trace, d.Dash.Port())
 	d.exit <- http.Serve(d.Dash, srv)
 }
 
-// listenTCP listens for TCP connections on a random port on localhost.
-func (d *Daemon) listenTCP() *net.TCPListener {
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
+func (d *Daemon) serveDebug() {
+	log.Info().Stringer("addr", d.Debug.Addr()).Msg("serving debug")
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/debug/pprof/", pprof.Index)
+	mux.HandleFunc("/debug/pprof/cmdline", pprof.Cmdline)
+	mux.HandleFunc("/debug/pprof/profile", pprof.Profile)
+	mux.HandleFunc("/debug/pprof/symbol", pprof.Symbol)
+	mux.HandleFunc("/debug/pprof/trace", pprof.Trace)
+	d.exit <- http.Serve(d.Debug, mux)
+}
+
+// listenTCPRetry listens for TCP connections on the given port, retrying
+// in the background if it's already in use.
+func (d *Daemon) listenTCPRetry(component string, addrOverride option.Option[string], defaultPort uint16) *retryingTCPListener {
+	addr, err := parseInterface(addrOverride.GetOrElse("127.0.0.1:0"))
 	if err != nil {
-		fatal(err)
+		log.Fatal().Str("component", component).Err(err).Msg("failed to parse interface")
+	}
+	if addr.Port() == 0 {
+		addr = netip.AddrPortFrom(addr.Addr(), defaultPort)
 	}
+	ln := listenLocalhostTCP(component, addr)
 	d.closeOnExit(ln)
-	return ln.(*net.TCPListener)
+	return ln
+}
+
+func (d *Daemon) openDB() *sql.DB {
+	dir, err := conf.Dir()
+	if err != nil {
+		fatal(err)
+	} else if err := os.MkdirAll(dir, 0755); err != nil {
+		fatal(err)
+	}
+
+	dbPath := filepath.Join(dir, "encore.db")
+
+	// Create the database file if it doesn't exist, as
+	// we've observed some failures to open the database file when it doesn't already exist.
+	if _, err := os.Stat(dbPath); os.IsNotExist(err) {
+		if f, err := os.OpenFile(dbPath, os.O_CREATE|os.O_WRONLY, 0600); err == nil {
+			_ = f.Close()
+		}
+	}
+
+	db, err := sql.Open("sqlite3", fmt.Sprintf("file:%s?cache=shared&_journal=wal&_txlock=immediate", dbPath))
+	if err != nil {
+		fatal(err)
+	}
+
+	// Initialize db schema
+	if err := d.runDBMigrations(db); err != nil {
+		fatalf("unable to migrate management database: %v", err)
+	}
+	d.closeOnExit(db)
+
+	return db
 }
 
-func tcpPort(ln net.Listener) int {
-	return ln.Addr().(*net.TCPAddr).Port
+//go:embed migrations
+var dbMigrations embed.FS
+
+func (d *Daemon) runDBMigrations(db *sql.DB) error {
+	{
+		// Convert old-style schema definition to golang-migrate, if necessary.
+		var isLegacy bool
+		err := db.QueryRow(`
+			SELECT COUNT(*) > 0 FROM pragma_table_info('schema_migrations') WHERE name = 'dummy'
+		`).Scan(&isLegacy)
+		if err != nil {
+			return err
+		} else if isLegacy {
+			_, _ = db.Exec("DROP TABLE schema_migrations;")
+		}
+	}
+
+	src, err := iofs.New(dbMigrations, "migrations")
+	if err != nil {
+		return fmt.Errorf("read db migrations: %v", err)
+	}
+	instance, err := sqlite3.WithInstance(db, &sqlite3.Config{})
+	if err != nil {
+		return fmt.Errorf("initialize migration instance: %v", err)
+	}
+	m, err := migrate.NewWithInstance("iofs", src, "encore", instance)
+	if err != nil {
+		return fmt.Errorf("setup migrate instance: %v", err)
+	}
+
+	err = m.Up()
+	if errors.Is(err, migrate.ErrNoChange) {
+		return nil
+	}
+
+	// If we have a dirty migration, reset the dirty flag and try again.
+	// This is safe since all migrations run inside transactions.
+	var dirty migrate.ErrDirty
+	if errors.As(err, &dirty) {
+		// Find the version that preceded the dirty version so
+		// we can force the migration to that version and then
+		// re-apply the migration.
+		var prevVer uint
+		prevVer, err = src.Prev(uint(dirty.Version))
+		targetVer := int(prevVer)
+		if errors.Is(err, fs.ErrNotExist) {
+			// No previous migration exists
+			targetVer = database.NilVersion
+		} else if err != nil {
+			return errors.Wrap(err, "failed to find previous version")
+		}
+
+		if err = m.Force(targetVer); err == nil {
+			err = m.Up()
+		}
+	}
+
+	return err
 }
 
 // detectSocketClose polls for the unix socket at socketPath to be removed
@@ -205,7 +423,7 @@ func detectSocketClose(ln *net.UnixListener, socketPath string) error {
 	for {
 		time.Sleep(200 * time.Millisecond)
 		fi, err := xos.SocketStat(socketPath)
-		if os.IsNotExist(err) {
+		if errors.Is(err, fs.ErrNotExist) {
 			// Socket was removed; don't remove it again
 			return nil
 		} else if err != nil {
@@ -228,7 +446,7 @@ func (d *Daemon) closeOnExit(c io.Closer) {
 
 func (d *Daemon) closeAll() {
 	for _, c := range d.close {
-		c.Close()
+		_ = c.Close()
 	}
 }
 
@@ -253,3 +471,199 @@ func handleBailout(err *error) {
 		}
 	}
 }
+
+// redirectLogOutput redirects the global logger to also write to a file.
+func redirectLogOutput() error {
+	logPath := env.EncoreDaemonLogPath()
+	if err := os.MkdirAll(filepath.Dir(logPath), 0755); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(logPath, os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0600)
+	if err != nil {
+		return err
+	}
+	log.Info().Msgf("writing output to %s", logPath)
+
+	zerolog.TimeFieldFormat = time.RFC3339Nano
+	consoleWriter := zerolog.ConsoleWriter{
+		Out:           os.Stderr,
+		FieldsExclude: []string{zerolog.ErrorStackFieldName},
+	}
+	consoleWriter.FormatExtra = eerror.ZeroLogConsoleExtraFormatter
+	consoleWriter.TimeFormat = time.TimeOnly
+	zerolog.ErrorStackMarshaler = eerror.ZeroLogStackMarshaller
+	log.Logger = log.With().Caller().Stack().Logger().Output(io.MultiWriter(consoleWriter, f))
+	return nil
+}
+
+// retryingTCPListener is a TCP listener that attempts multiple times
+// to listen on a given port. It is designed to handle race conditions
+// between multiple daemon processes handing off to each other
+// and the port still being in use momentarily.
+type retryingTCPListener struct {
+	component string
+	addr      netip.AddrPort
+	ctx       context.Context
+	cancel    func() // call to cancel ctx
+
+	// doneListening is closed when the underlying listener is open,
+	// or it gave up due to an error.
+	doneListening chan struct{}
+	underlying    net.Listener
+	listenErr     error
+}
+
+func listenLocalhostTCP(component string, addr netip.AddrPort) *retryingTCPListener {
+	ctx, cancel := context.WithCancel(context.Background())
+	ln := &retryingTCPListener{
+		component:     component,
+		addr:          addr,
+		ctx:           ctx,
+		cancel:        cancel,
+		doneListening: make(chan struct{}),
+	}
+	go ln.listen()
+	return ln
+}
+
+func (ln *retryingTCPListener) Accept() (net.Conn, error) {
+	select {
+	case <-ln.ctx.Done():
+		return nil, net.ErrClosed
+	case <-ln.doneListening:
+		if ln.listenErr != nil {
+			return nil, ln.listenErr
+		}
+		return ln.underlying.Accept()
+	}
+}
+
+func (ln *retryingTCPListener) Close() error {
+	ln.cancel()
+	select {
+	case <-ln.doneListening:
+		if ln.listenErr == nil {
+			return ln.underlying.Close()
+		}
+	default:
+	}
+	return nil
+}
+
+func (ln *retryingTCPListener) Addr() net.Addr {
+	return &net.TCPAddr{IP: net.IP(ln.addr.Addr().AsSlice()), Port: int(ln.addr.Port())}
+}
+
+func (ln *retryingTCPListener) ClientAddr() string {
+	// If our addr is 0.0.0.0 or the ipv6 equivalent, return 127.0.0.1 instead
+	// so that clients can connect to us.
+	if ln.addr.Addr().IsUnspecified() {
+		if ln.addr.Addr().Is6() {
+			return fmt.Sprintf("[::1]:%d", ln.addr.Port())
+		}
+		return fmt.Sprintf("127.0.0.1:%d", ln.addr.Port())
+	}
+	return ln.addr.String()
+}
+
+func (ln *retryingTCPListener) Port() int {
+	return int(ln.addr.Port())
+}
+
+func (ln *retryingTCPListener) listen() {
+	defer close(ln.doneListening)
+
+	logger := log.With().Str("component", ln.component).Int("port", ln.Port()).Logger()
+	addr := ln.addr.String()
+
+	b := backoff.NewExponentialBackOff()
+	b.InitialInterval = 50 * time.Millisecond
+	b.MaxInterval = 500 * time.Millisecond
+	b.MaxElapsedTime = 5 * time.Second
+
+	ln.listenErr = backoff.Retry(func() (err error) {
+		if err := ln.ctx.Err(); err != nil {
+			return backoff.Permanent(err)
+		}
+		ln.underlying, err = net.Listen("tcp", addr)
+		if err != nil {
+			logger.Error().Err(ln.listenErr).Msg("unable to listen, retrying")
+		}
+		return err
+	}, b)
+
+	if ln.listenErr != nil {
+		logger.Error().Err(ln.listenErr).Msg("unable to listen, giving up")
+	} else {
+		logger.Info().Msg("listening on port")
+	}
+}
+
+func parseInterface(s string) (netip.AddrPort, error) {
+	addr, portStr, _, err := splitAddrPort(s)
+	if err != nil {
+		return netip.AddrPort{}, err
+	}
+
+	port, err := strconv.ParseUint(portStr, 10, 16)
+	if err != nil {
+		return netip.AddrPort{}, err
+	}
+
+	// Is addr a valid ip? If so we're done.
+	if ip, err := netip.ParseAddr(addr); err == nil {
+		return netip.AddrPortFrom(ip, uint16(port)), nil
+	}
+
+	// Otherwise perform name resolution.
+	ips, err := net.LookupIP(addr)
+	if err != nil {
+		return netip.AddrPort{}, err
+	}
+	if len(ips) == 0 {
+		return netip.AddrPort{}, fmt.Errorf("no IP addresses found for %s", addr)
+	}
+
+	// Prefer IPv4 addresses.
+	for _, ip := range ips {
+		if ip.To4() != nil {
+			if addr, err := netip.ParseAddr(ip.String()); err == nil {
+				return netip.AddrPortFrom(addr, uint16(port)), nil
+			}
+		}
+	}
+
+	if addr, err := netip.ParseAddr(ips[0].String()); err == nil {
+		return netip.AddrPortFrom(addr, uint16(port)), nil
+	}
+	return netip.AddrPort{}, fmt.Errorf("unable to parse IP address %s", addr)
+}
+
+// splitAddrPort splits s into an IP address string and a port
+// string. It splits strings shaped like "foo:bar" or "[foo]:bar",
+// without further validating the substrings. v6 indicates whether the
+// ip string should parse as an IPv6 address or an IPv4 address, in
+// order for s to be a valid ip:port string.
+func splitAddrPort(s string) (ip, port string, v6 bool, err error) {
+	i := strings.LastIndexByte(s, ':')
+	if i == -1 {
+		return "", "", false, errors.New("not an ip:port")
+	}
+
+	ip, port = s[:i], s[i+1:]
+	if len(ip) == 0 {
+		return "", "", false, errors.New("no IP")
+	}
+	if len(port) == 0 {
+		return "", "", false, errors.New("no port")
+	}
+	if ip[0] == '[' {
+		if len(ip) < 2 || ip[len(ip)-1] != ']' {
+			return "", "", false, errors.New("missing ]")
+		}
+		ip = ip[1 : len(ip)-1]
+		v6 = true
+	}
+
+	return ip, port, v6, nil
+}
diff --git a/cli/cmd/encore/daemon/migrations/1_initial_schema.up.sql b/cli/cmd/encore/daemon/migrations/1_initial_schema.up.sql
new file mode 100644
index 0000000000..d28954ba14
--- /dev/null
+++ b/cli/cmd/encore/daemon/migrations/1_initial_schema.up.sql
@@ -0,0 +1,40 @@
+CREATE TABLE IF NOT EXISTS app (
+    root TEXT PRIMARY KEY,
+    local_id TEXT NOT NULL,
+    platform_id TEXT NULL, -- NULL if not linked
+    updated_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS trace_event (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    app_id TEXT NOT NULL, -- platform_id or local_id
+    trace_id TEXT NOT NULL,
+    span_id TEXT NOT NULL,
+    event_data TEXT NOT NULL -- json
+);
+
+CREATE INDEX IF NOT EXISTS trace_event_span_key ON trace_event (trace_id, span_id);
+
+CREATE TABLE IF NOT EXISTS trace_span_index (
+    trace_id TEXT NOT NULL,
+    span_id TEXT NOT NULL,
+    app_id TEXT NOT NULL, -- platform_id or local_id
+    span_type INTEGER NOT NULL, -- enum
+
+    -- request fields
+    started_at INTEGER NULL, -- unix nanosecond
+    is_root BOOLEAN NULL,
+    service_name TEXT NULL,
+    endpoint_name TEXT NULL,
+    topic_name TEXT NULL,
+    subscription_name TEXT NULL,
+    message_id TEXT NULL,
+    external_request_id TEXT NULL,
+
+    -- response fields
+    has_response BOOLEAN NOT NULL,
+    is_error BOOLEAN NULL,
+    duration_nanos INTEGER NULL,
+    user_id TEXT NULL,
+    PRIMARY KEY (trace_id, span_id)
+);
diff --git a/cli/cmd/encore/daemon/migrations/2_infra_namespaces.up.sql b/cli/cmd/encore/daemon/migrations/2_infra_namespaces.up.sql
new file mode 100644
index 0000000000..dcdbb05359
--- /dev/null
+++ b/cli/cmd/encore/daemon/migrations/2_infra_namespaces.up.sql
@@ -0,0 +1,12 @@
+CREATE TABLE IF NOT EXISTS namespace (
+    id TEXT PRIMARY KEY, -- uuid
+    app_id TEXT NOT NULL, -- platform_id or local_id
+    name TEXT NOT NULL,
+    active BOOL NOT NULL DEFAULT FALSE,
+    created_at TIMESTAMP NOT NULL,
+    last_active_at TIMESTAMP NULL,
+    UNIQUE (app_id, name)
+);
+
+-- Ensure there's a single active namespace per app.
+CREATE UNIQUE INDEX active_namespace ON namespace (app_id) WHERE active = true;
diff --git a/cli/cmd/encore/daemon/migrations/3_test_tracing.up.sql b/cli/cmd/encore/daemon/migrations/3_test_tracing.up.sql
new file mode 100644
index 0000000000..0ec669f547
--- /dev/null
+++ b/cli/cmd/encore/daemon/migrations/3_test_tracing.up.sql
@@ -0,0 +1,3 @@
+ALTER TABLE trace_span_index ADD COLUMN test_skipped BOOLEAN NOT NULL DEFAULT FALSE;
+ALTER TABLE trace_span_index ADD COLUMN src_file TEXT NULL;
+ALTER TABLE trace_span_index  ADD COLUMN src_line INTEGER NULL;
diff --git a/cli/cmd/encore/db.go b/cli/cmd/encore/db.go
index 893fbc5e1f..bcb9b8d137 100644
--- a/cli/cmd/encore/db.go
+++ b/cli/cmd/encore/db.go
@@ -10,9 +10,14 @@ import (
 	"runtime"
 	"strings"
 
-	daemonpb "encr.dev/proto/encore/daemon"
 	"github.com/rs/zerolog/log"
 	"github.com/spf13/cobra"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/daemon/sqldb/docker"
+	daemonpb "encr.dev/proto/encore/daemon"
 )
 
 var dbCmd = &cobra.Command{
@@ -20,53 +25,88 @@ var dbCmd = &cobra.Command{
 	Short: "Database management commands",
 }
 
-var resetAll bool
+var (
+	resetAll  bool
+	testDB    bool
+	shadowDB  bool
+	write     bool
+	admin     bool
+	superuser bool
+	nsName    string
+)
+
+func getDBRole() daemonpb.DBRole {
+	switch {
+	case superuser:
+		return daemonpb.DBRole_DB_ROLE_SUPERUSER
+	case admin:
+		return daemonpb.DBRole_DB_ROLE_ADMIN
+	case write:
+		return daemonpb.DBRole_DB_ROLE_WRITE
+	default:
+		return daemonpb.DBRole_DB_ROLE_READ
+	}
+}
 
 var dbResetCmd = &cobra.Command{
-	Use:   "reset [servicenames...]",
-	Short: "Resets the databases for the given services, or the current directory if unspecified",
+	Use:   "reset <database-names...|--all>",
+	Short: "Resets the databases with the given names. Use --all to reset all databases.",
 
 	Run: func(command *cobra.Command, args []string) {
-		appRoot, relPath := determineAppRoot()
-		svcNames := args
-		if resetAll && len(svcNames) > 0 {
-			fatal("cannot specify both --all and service names")
-		}
-		if !resetAll && len(svcNames) == 0 {
-			pkgs, err := resolvePackages(filepath.Join(appRoot, relPath), ".")
-			if err != nil {
-				log.Fatal().Err(err).Msg("could not resolve packages")
+		appRoot, _ := determineAppRoot()
+		dbNames := args
+		if resetAll {
+			if len(dbNames) > 0 {
+				fatal("cannot specify both --all and database names")
+			}
+			dbNames = nil
+		} else {
+			if len(dbNames) == 0 {
+				fatal("no database names given")
 			}
-			svcNames = []string{filepath.Base(pkgs[0])}
 		}
 
 		ctx := context.Background()
 		daemon := setupDaemon(ctx)
 		stream, err := daemon.DBReset(ctx, &daemonpb.DBResetRequest{
-			AppRoot:  appRoot,
-			Services: svcNames,
+			AppRoot:       appRoot,
+			DatabaseNames: dbNames,
+			ClusterType:   dbClusterType(),
+			Namespace:     nonZeroPtr(nsName),
 		})
 		if err != nil {
 			fatal("reset databases: ", err)
 		}
-		streamCommandOutput(stream)
+		os.Exit(cmdutil.StreamCommandOutput(stream, nil))
 	},
 }
 
 var dbEnv string
 
 var dbShellCmd = &cobra.Command{
-	Use:   "shell [service-name]",
+	Use:   "shell DATABASE_NAME [--env=<name>] [--test|--shadow]",
 	Short: "Connects to the database via psql shell",
-	Args:  cobra.MaximumNArgs(1),
+	Long: `Defaults to connecting to your local environment.
+Specify --env to connect to another environment.
+
+Use --test to connect to databases used for integration testing.
+Use --shadow to connect to the shadow database, used for database drift detection
+when using tools like Prisma.
 
+--test and --shadow imply --env=local.
+`,
+	Args: cobra.MaximumNArgs(1),
+
+	DisableFlagsInUseLine: true,
 	Run: func(command *cobra.Command, args []string) {
 		appRoot, relPath := determineAppRoot()
 		ctx := context.Background()
 		daemon := setupDaemon(ctx)
-		svcName := ""
+		dbName := ""
 		if len(args) > 0 {
-			svcName = args[0]
+			dbName = args[0]
+			// Ignore the trailing slash to support auto-completion of directory names
+			dbName = strings.TrimSuffix(dbName, "/")
 		} else {
 			// Find the enclosing service by looking for the "migrations" folder
 		SvcNameLoop:
@@ -75,24 +115,31 @@ var dbShellCmd = &cobra.Command{
 				if _, err := os.Stat(filepath.Join(absPath, "migrations")); err == nil {
 					pkgs, err := resolvePackages(absPath, ".")
 					if err == nil && len(pkgs) > 0 {
-						svcName = filepath.Base(pkgs[0])
+						dbName = filepath.Base(pkgs[0])
 						break SvcNameLoop
 					}
 				}
 			}
-			if svcName == "" {
+			if dbName == "" {
 				fatal("could not find an Encore service with a database in this directory (or any of the parent directories).\n\n" +
-					"Note: You can specify a service name to connect to it directly using the command 'encore db shell <service-name>'.")
+					"Note: You can specify a service name to connect to it directly using the command 'encore db shell <database-name>'.")
 			}
 		}
 
+		if testDB || shadowDB {
+			dbEnv = "local"
+		}
+
 		resp, err := daemon.DBConnect(ctx, &daemonpb.DBConnectRequest{
-			AppRoot: appRoot,
-			SvcName: svcName,
-			EnvName: dbEnv,
+			AppRoot:     appRoot,
+			DbName:      dbName,
+			EnvName:     dbEnv,
+			ClusterType: dbClusterType(),
+			Namespace:   nonZeroPtr(nsName),
+			Role:        getDBRole(),
 		})
 		if err != nil {
-			fatalf("could not connect to the database for service %s: %v", svcName, err)
+			fatalf("could not connect to the database for service %s: %v", dbName, err)
 		}
 
 		// If we have the psql binary, use that.
@@ -104,15 +151,15 @@ var dbShellCmd = &cobra.Command{
 			fmt.Fprintln(os.Stderr, "encore: no 'psql' executable found in $PATH; using docker to run 'psql' instead.\n\nNote: install psql to hide this message.")
 			dsn := resp.Dsn
 
-			if runtime.GOOS == "darwin" {
-				// Docker for Mac's networking setup requires
+			if runtime.GOOS == "darwin" || runtime.GOOS == "windows" {
+				// Docker for {Mac, Windows}'s networking setup requires
 				// using "host.docker.internal" instead of "localhost"
 				for _, rep := range []string{"localhost", "127.0.0.1"} {
 					dsn = strings.Replace(dsn, rep, "host.docker.internal", -1)
 				}
 			}
 
-			cmd = exec.Command("docker", "run", "-it", "--rm", "--network=host", "postgres", "psql", dsn)
+			cmd = exec.Command("docker", "run", "-it", "--rm", "--network=host", docker.Image, "psql", dsn)
 		}
 		cmd.Stdout = os.Stdout
 		cmd.Stderr = os.Stderr
@@ -126,13 +173,27 @@ var dbShellCmd = &cobra.Command{
 			log.Fatal().Err(err).Msg("psql failed")
 		}
 	},
+	ValidArgsFunction: func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+		if len(args) > 0 {
+			return nil, cobra.ShellCompDirectiveNoFileComp
+		}
+		return nil, cobra.ShellCompDirectiveFilterDirs
+	},
 }
 
 var dbProxyPort int32
 
 var dbProxyCmd = &cobra.Command{
-	Use:   "proxy [--env=<name>]",
+	Use:   "proxy [--env=<name>] [--test|--shadow]",
 	Short: "Sets up a proxy tunnel to the database",
+	Long: `Set up a proxy tunnel to a database for use with other tools.
+
+Use --test to connect to databases used for integration testing.
+Use --shadow to connect to the shadow database, used for database drift detection
+when using tools like Prisma.
+
+--test and --shadow imply --env=local.
+`,
 
 	Run: func(command *cobra.Command, args []string) {
 		appRoot, _ := determineAppRoot()
@@ -145,76 +206,142 @@ var dbProxyCmd = &cobra.Command{
 			cancel()
 		}()
 
+		if testDB || shadowDB {
+			dbEnv = "local"
+		}
+
 		daemon := setupDaemon(ctx)
 		stream, err := daemon.DBProxy(ctx, &daemonpb.DBProxyRequest{
-			AppRoot: appRoot,
-			EnvName: dbEnv,
-			Port:    dbProxyPort,
+			AppRoot:     appRoot,
+			EnvName:     dbEnv,
+			Port:        dbProxyPort,
+			ClusterType: dbClusterType(),
+			Namespace:   nonZeroPtr(nsName),
+			Role:        getDBRole(),
 		})
 		if err != nil {
 			log.Fatal().Err(err).Msg("could not setup db proxy")
 		}
-		streamCommandOutput(stream)
+		os.Exit(cmdutil.StreamCommandOutput(stream, nil))
 	},
 }
 
 var dbConnURICmd = &cobra.Command{
-	Use:   "conn-uri [servicename]",
+	Use:   "conn-uri [<db-name>] [--test|--shadow]",
 	Short: "Outputs the database connection string",
-	Args:  cobra.MaximumNArgs(1),
+	Long: `Retrieve a stable connection uri for connecting to a database.
+
+Use --test to connect to databases used for integration testing.
+Use --shadow to connect to the shadow database, used for database drift detection
+when using tools like Prisma.
+
+--test and --shadow imply --env=local.
+`,
+	Args: cobra.MaximumNArgs(1),
 
 	Run: func(command *cobra.Command, args []string) {
 		appRoot, relPath := determineAppRoot()
 		ctx := context.Background()
 		daemon := setupDaemon(ctx)
-		svcName := ""
+		dbName := ""
 		if len(args) > 0 {
-			svcName = args[0]
+			dbName = args[0]
 		} else {
 			// Find the enclosing service by looking for the "migrations" folder
-		SvcNameLoop:
+		DBNameLoop:
 			for p := relPath; p != "."; p = filepath.Dir(p) {
 				absPath := filepath.Join(appRoot, p)
 				if _, err := os.Stat(filepath.Join(absPath, "migrations")); err == nil {
 					pkgs, err := resolvePackages(absPath, ".")
 					if err == nil && len(pkgs) > 0 {
-						svcName = filepath.Base(pkgs[0])
-						break SvcNameLoop
+						dbName = filepath.Base(pkgs[0])
+						break DBNameLoop
 					}
 				}
 			}
-			if svcName == "" {
+			if dbName == "" {
 				fatal("could not find Encore service with a database in this directory (or any parent directory).\n\n" +
 					"Note: You can specify a service name to connect to it directly using the command 'encore db conn-uri <service-name>'.")
 			}
 		}
 
+		if testDB || shadowDB {
+			dbEnv = "local"
+		}
+
 		resp, err := daemon.DBConnect(ctx, &daemonpb.DBConnectRequest{
-			AppRoot: appRoot,
-			SvcName: svcName,
-			EnvName: dbEnv,
+			AppRoot:     appRoot,
+			DbName:      dbName,
+			EnvName:     dbEnv,
+			ClusterType: dbClusterType(),
+			Namespace:   nonZeroPtr(nsName),
+			Role:        getDBRole(),
 		})
 		if err != nil {
-			fatalf("could not connect to the database for service %s: %v", svcName, err)
+			st, ok := status.FromError(err)
+			if ok {
+				if st.Code() == codes.NotFound {
+					fatalf("no such database found: %s", dbName)
+				}
+			}
+			fatalf("could not connect to the database for service %s: %v", dbName, err)
 		}
 
-		fmt.Fprintln(os.Stdout, resp.Dsn)
+		_, _ = fmt.Fprintln(os.Stdout, resp.Dsn)
 	},
 }
 
 func init() {
 	rootCmd.AddCommand(dbCmd)
 
+	dbResetCmd.Flags().StringVarP(&nsName, "namespace", "n", "", "Namespace to use (defaults to active namespace)")
 	dbResetCmd.Flags().BoolVar(&resetAll, "all", false, "Reset all services in the application")
+	dbResetCmd.Flags().BoolVarP(&testDB, "test", "t", false, "Reset databases in the test cluster instead")
+	dbResetCmd.Flags().BoolVar(&shadowDB, "shadow", false, "Reset databases in the shadow cluster instead")
 	dbCmd.AddCommand(dbResetCmd)
 
+	dbShellCmd.Flags().StringVarP(&nsName, "namespace", "n", "", "Namespace to use (defaults to active namespace)")
 	dbShellCmd.Flags().StringVarP(&dbEnv, "env", "e", "local", "Environment name to connect to (such as \"prod\")")
+	dbShellCmd.Flags().BoolVarP(&testDB, "test", "t", false, "Connect to the integration test database (implies --env=local)")
+	dbShellCmd.Flags().BoolVar(&shadowDB, "shadow", false, "Connect to the shadow database (implies --env=local)")
+	dbShellCmd.Flags().BoolVar(&write, "write", false, "Connect with write privileges")
+	dbShellCmd.Flags().BoolVar(&admin, "admin", false, "Connect with admin privileges")
+	dbShellCmd.Flags().BoolVar(&superuser, "superuser", false, "Connect as a superuser")
+	dbShellCmd.MarkFlagsMutuallyExclusive("write", "admin", "superuser")
 	dbCmd.AddCommand(dbShellCmd)
 
+	dbProxyCmd.Flags().StringVarP(&nsName, "namespace", "n", "", "Namespace to use (defaults to active namespace)")
 	dbProxyCmd.Flags().StringVarP(&dbEnv, "env", "e", "local", "Environment name to connect to (such as \"prod\")")
 	dbProxyCmd.Flags().Int32VarP(&dbProxyPort, "port", "p", 0, "Port to listen on (defaults to a random port)")
+	dbProxyCmd.Flags().BoolVarP(&testDB, "test", "t", false, "Connect to the integration test database (implies --env=local)")
+	dbProxyCmd.Flags().BoolVar(&shadowDB, "shadow", false, "Connect to the shadow database (implies --env=local)")
+	dbProxyCmd.Flags().BoolVar(&write, "write", false, "Connect with write privileges")
+	dbProxyCmd.Flags().BoolVar(&admin, "admin", false, "Connect with admin privileges")
+	dbProxyCmd.Flags().BoolVar(&superuser, "superuser", false, "Connect as a superuser")
+	dbProxyCmd.MarkFlagsMutuallyExclusive("write", "admin", "superuser")
 	dbCmd.AddCommand(dbProxyCmd)
 
+	dbConnURICmd.Flags().StringVarP(&nsName, "namespace", "n", "", "Namespace to use (defaults to active namespace)")
 	dbConnURICmd.Flags().StringVarP(&dbEnv, "env", "e", "local", "Environment name to connect to (such as \"prod\")")
+	dbConnURICmd.Flags().BoolVarP(&testDB, "test", "t", false, "Connect to the integration test database (implies --env=local)")
+	dbConnURICmd.Flags().BoolVar(&shadowDB, "shadow", false, "Connect to the shadow database (implies --env=local)")
+	dbConnURICmd.Flags().BoolVar(&write, "write", false, "Connect with write privileges")
+	dbConnURICmd.Flags().BoolVar(&admin, "admin", false, "Connect with admin privileges")
+	dbConnURICmd.Flags().BoolVar(&superuser, "superuser", false, "Connect as a superuser")
+	dbConnURICmd.MarkFlagsMutuallyExclusive("write", "admin", "superuser")
 	dbCmd.AddCommand(dbConnURICmd)
 }
+
+func dbClusterType() daemonpb.DBClusterType {
+	if testDB && shadowDB {
+		fatal("cannot specify both --test and --shadow")
+	}
+	switch {
+	case testDB:
+		return daemonpb.DBClusterType_DB_CLUSTER_TYPE_TEST
+	case shadowDB:
+		return daemonpb.DBClusterType_DB_CLUSTER_TYPE_SHADOW
+	default:
+		return daemonpb.DBClusterType_DB_CLUSTER_TYPE_RUN
+	}
+}
diff --git a/cli/cmd/encore/debug.go b/cli/cmd/encore/debug.go
new file mode 100644
index 0000000000..5393e043d8
--- /dev/null
+++ b/cli/cmd/encore/debug.go
@@ -0,0 +1,83 @@
+package main
+
+import (
+	"context"
+	"os"
+	"os/signal"
+
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+func init() {
+	debugCmd := &cobra.Command{
+		Use:    "debug",
+		Short:  "debug is a collection of debug commands",
+		Hidden: true,
+	}
+
+	format := cmdutil.Oneof{
+		Value:     "proto",
+		Allowed:   []string{"proto", "json"},
+		Flag:      "format",
+		FlagShort: "f",
+		Desc:      "Output format",
+	}
+
+	toFormat := func() daemonpb.DumpMetaRequest_Format {
+		switch format.Value {
+		case "proto":
+			return daemonpb.DumpMetaRequest_FORMAT_PROTO
+		case "json":
+			return daemonpb.DumpMetaRequest_FORMAT_JSON
+		default:
+			return daemonpb.DumpMetaRequest_FORMAT_UNSPECIFIED
+		}
+	}
+
+	var p dumpMetaParams
+	dumpMeta := &cobra.Command{
+		Use:   "meta",
+		Short: "Outputs the parsed metadata",
+		Args:  cobra.NoArgs,
+		Run: func(cmd *cobra.Command, args []string) {
+			p.AppRoot, p.WorkingDir = determineAppRoot()
+			p.Environ = os.Environ()
+			p.Format = toFormat()
+			dumpMeta(p)
+		},
+	}
+
+	format.AddFlag(dumpMeta)
+	dumpMeta.Flags().BoolVar(&p.ParseTests, "tests", false, "Parse tests as well")
+	rootCmd.AddCommand(debugCmd)
+	debugCmd.AddCommand(dumpMeta)
+}
+
+type dumpMetaParams struct {
+	AppRoot    string
+	WorkingDir string
+	ParseTests bool
+	Format     daemonpb.DumpMetaRequest_Format
+	Environ    []string
+}
+
+func dumpMeta(p dumpMetaParams) {
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer cancel()
+
+	daemon := setupDaemon(ctx)
+	resp, err := daemon.DumpMeta(ctx, &daemonpb.DumpMetaRequest{
+		AppRoot:    p.AppRoot,
+		WorkingDir: p.WorkingDir,
+		ParseTests: p.ParseTests,
+		Environ:    p.Environ,
+		Format:     p.Format,
+	})
+	if err != nil {
+		fatal(err)
+	}
+	_, _ = os.Stdout.Write(resp.Meta)
+}
diff --git a/cli/cmd/encore/deploy.go b/cli/cmd/encore/deploy.go
new file mode 100644
index 0000000000..02db03158a
--- /dev/null
+++ b/cli/cmd/encore/deploy.go
@@ -0,0 +1,104 @@
+package main
+
+import (
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+	"github.com/logrusorgru/aurora/v3"
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/pkg/appfile"
+)
+
+var (
+	appSlug string
+	envName string
+	commit  string
+	branch  string
+	format  = cmdutil.Oneof{
+		Value:     "text",
+		Allowed:   []string{"text", "json"},
+		Flag:      "format",
+		FlagShort: "f",
+		Desc:      "Output format",
+	}
+)
+
+var deployAppCmd = &cobra.Command{
+	Use:                   "deploy --commit COMMIT_SHA | --branch BRANCH_NAME",
+	Short:                 "Deploy an Encore app to a cloud environment",
+	DisableFlagsInUseLine: true,
+	Run: func(c *cobra.Command, args []string) {
+		if commit != "" {
+			hb, err := hex.DecodeString(commit)
+			if err != nil || len(hb) != 20 {
+				cmdutil.Fatalf("invalid commit: %s", commit)
+			}
+		}
+		if appSlug == "" {
+			appRoot, _, err := cmdutil.MaybeAppRoot()
+			if err != nil {
+				cmdutil.Fatalf("no app found. Run deploy inside an encore app directory or specify the app with --app")
+			}
+			appSlug, err = appfile.Slug(appRoot)
+			if err != nil {
+				cmdutil.Fatalf("no app found. Run deploy inside an encore app directory or specify the app with --app")
+			}
+		}
+		rollout, err := platform.Deploy(c.Context(), appSlug, envName, commit, branch)
+		var pErr platform.Error
+		if ok := errors.As(err, &pErr); ok {
+			switch pErr.Code {
+			case "app_not_found":
+				cmdutil.Fatalf("app not found: %s", appSlug)
+			case "validation":
+				var details platform.ValidationDetails
+				err := json.Unmarshal(pErr.Detail, &details)
+				if err != nil {
+					cmdutil.Fatalf("failed to deploy: %v", err)
+				}
+				switch details.Field {
+				case "commit":
+					cmdutil.Fatalf("could not find commit: %s. Is it pushed to the remote repository?", commit)
+				case "branch":
+					cmdutil.Fatalf("could not find branch: %s. Is it pushed to the remote repository?", branch)
+				case "env":
+					cmdutil.Fatalf("could not find environment: %s/%s", appSlug, envName)
+				}
+			}
+		}
+		if err != nil {
+			cmdutil.Fatalf("failed to deploy: %v", err)
+		}
+		url := fmt.Sprintf("https://app.encore.cloud/%s/deploys/%s/%s", appSlug, rollout.EnvName, strings.TrimPrefix(rollout.ID, "roll_"))
+		switch format.Value {
+		case "text":
+			fmt.Println(aurora.Sprintf("\n%s %s\n", aurora.Bold("Started Deploy:"), url))
+		case "json":
+			output, _ := json.Marshal(map[string]string{
+				"id":  strings.TrimPrefix(rollout.ID, "roll_"),
+				"env": rollout.EnvName,
+				"app": appSlug,
+				"url": url,
+			})
+			fmt.Println(string(output))
+		}
+	},
+}
+
+func init() {
+	alphaCmd.AddCommand(deployAppCmd)
+	deployAppCmd.Flags().StringVar(&appSlug, "app", "", "app slug to deploy to (default current app)")
+	deployAppCmd.Flags().StringVarP(&envName, "env", "e", "", "environment to deploy to (default primary env)")
+	deployAppCmd.Flags().StringVar(&commit, "commit", "", "commit to deploy")
+	deployAppCmd.Flags().StringVar(&branch, "branch", "", "branch to deploy")
+	format.AddFlag(deployAppCmd)
+	_ = deployAppCmd.MarkFlagRequired("env")
+	deployAppCmd.MarkFlagsMutuallyExclusive("commit", "branch")
+	deployAppCmd.MarkFlagsOneRequired("commit", "branch")
+}
diff --git a/cli/cmd/encore/exec.go b/cli/cmd/encore/exec.go
new file mode 100644
index 0000000000..6ecaca198c
--- /dev/null
+++ b/cli/cmd/encore/exec.go
@@ -0,0 +1,82 @@
+package main
+
+import (
+	"context"
+	"os"
+	"os/signal"
+
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/cmd/encore/root"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+var execCmd = &cobra.Command{
+	Use:   "exec path/to/script [args...]",
+	Short: "Runs executable scripts against the local Encore app",
+	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) == 0 {
+			args = []string{"."} // current directory
+		}
+		appRoot, wd := determineAppRoot()
+		execScript(appRoot, wd, args)
+	},
+}
+var execCmdAlpha = &cobra.Command{
+	Use:        "exec path/to/script [args...]",
+	Short:      "Runs executable scripts against the local Encore app",
+	Hidden:     true,
+	Deprecated: "use \"encore exec\" instead",
+	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) == 0 {
+			args = []string{"."} // current directory
+		}
+		appRoot, wd := determineAppRoot()
+		execScript(appRoot, wd, args)
+	},
+}
+
+func execScript(appRoot, relWD string, args []string) {
+	interrupt := make(chan os.Signal, 1)
+	signal.Notify(interrupt, os.Interrupt)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	go func() {
+		<-interrupt
+		cancel()
+	}()
+
+	daemon := setupDaemon(ctx)
+	stream, err := daemon.ExecScript(ctx, &daemonpb.ExecScriptRequest{
+		AppRoot:    appRoot,
+		WorkingDir: relWD,
+		ScriptArgs: args,
+		Environ:    os.Environ(),
+		TraceFile:  root.TraceFile,
+		Namespace:  nonZeroPtr(nsName),
+	})
+	if err != nil {
+		fatal(err)
+	}
+
+	cmdutil.ClearTerminalExceptFirstNLines(1)
+	code := cmdutil.StreamCommandOutput(stream, cmdutil.ConvertJSONLogs())
+	os.Exit(code)
+}
+
+var alphaCmd = &cobra.Command{
+	Use:    "alpha",
+	Short:  "Pre-release functionality in alpha stage",
+	Hidden: true,
+}
+
+func init() {
+	rootCmd.AddCommand(alphaCmd)
+}
+
+func init() {
+	execCmd.Flags().StringVarP(&nsName, "namespace", "n", "", "Namespace to use (defaults to active namespace)")
+	alphaCmd.AddCommand(execCmdAlpha)
+	rootCmd.AddCommand(execCmd)
+}
diff --git a/cli/cmd/encore/gen.go b/cli/cmd/encore/gen.go
index b18cac212b..7f9718c213 100644
--- a/cli/cmd/encore/gen.go
+++ b/cli/cmd/encore/gen.go
@@ -2,14 +2,18 @@ package main
 
 import (
 	"context"
-	"io/ioutil"
+	"errors"
+	"fmt"
 	"os"
-	"path/filepath"
-	"strings"
 	"time"
 
-	daemonpb "encr.dev/proto/encore/daemon"
 	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/internal/manifest"
+	"encr.dev/pkg/appfile"
+	"encr.dev/pkg/clientgen"
+	daemonpb "encr.dev/proto/encore/daemon"
 )
 
 func init() {
@@ -20,64 +24,187 @@ func init() {
 	rootCmd.AddCommand(genCmd)
 
 	var (
-		output  string
-		lang    string
-		envName string
+		output                         string
+		lang                           string
+		envName                        string
+		genServiceNames                []string
+		excludedServices               []string
+		endpointTags                   []string
+		excludedEndpointTags           []string
+		openAPIExcludePrivateEndpoints bool
+		tsSharedTypes                  bool
+		target                         string
+		tsDefaultClient                string
 	)
 
 	genClientCmd := &cobra.Command{
-		Use:   "client <app-id>",
+		Use:   "client [<app-id>] [--env=<name>] [--services=foo,bar] [--excluded-services=baz,qux] [--tags=cache,mobile] [--excluded-tags=internal] [--openapi-exclude-private-endpoints]",
 		Short: "Generates an API client for your app",
-		Args:  cobra.ExactArgs(1),
+		Long: `Generates an API client for your app.
+
+By default generates the API based on your local environment.
+Use '--env=<name>' to generate it based on your cloud environments.
+
+Supported language codes are:
+  typescript: A TypeScript client using the Fetch API
+  javascript: A JavaScript client using the Fetch API
+  go: A Go client using net/http"
+  openapi: An OpenAPI specification (EXPERIMENTAL)
+
+By default all services with a non-private API endpoint are included.
+To further narrow down the services to generate, use the '--services' flag.
+`,
+		Args: cobra.MaximumNArgs(1),
 		Run: func(cmd *cobra.Command, args []string) {
+			if target == "leap" {
+				lang = "typescript"
+				tsDefaultClient = "import.meta.env.VITE_CLIENT_TARGET"
+				if output == "" {
+					output = "../frontend/client.ts"
+				}
+				excludedServices = append(excludedServices, "frontend")
+				tsSharedTypes = true
+			}
+
 			if output == "" && lang == "" {
 				fatal("specify at least one of --output or --lang.")
 			}
-			appID := args[0]
+
+			// Determine the app id, either from the argument or from the current directory.
+			var appID string
+			if len(args) == 0 {
+				// First check the encore.app file.
+				appRoot, _, err := cmdutil.MaybeAppRoot()
+				if err != nil && !errors.Is(err, cmdutil.ErrNoEncoreApp) {
+					fatal(err)
+				} else if appRoot != "" {
+					if slug, err := appfile.Slug(appRoot); err == nil {
+						appID = slug
+					}
+				}
+
+				// If we still don't have an app id, read it from the manifest.
+				if appID == "" {
+					mf, err := manifest.ReadOrCreate(appRoot)
+					if err != nil {
+						fatal(err)
+					}
+					appID = mf.AppID
+					if appID == "" {
+						appID = mf.LocalID
+					}
+				}
+			} else {
+				appID = args[0]
+			}
 
 			if lang == "" {
 				var ok bool
-				lang, ok = detectLang(output)
+				l, ok := clientgen.Detect(output)
 				if !ok {
 					fatal("could not detect language from output.\n\nNote: you can specify the language explicitly with --lang.")
 				}
+				lang = string(l)
+			} else {
+				// Validate the user input for the language
+				l, err := clientgen.GetLang(lang)
+				if err != nil {
+					fatal(fmt.Sprintf("%s: supported languages are `typescript`, `javascript`, `go` and `openapi`", err))
+				}
+				lang = string(l)
 			}
 
-			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			ctx, cancel := context.WithTimeout(context.Background(), 120*time.Second)
 			defer cancel()
 
 			daemon := setupDaemon(ctx)
+
+			if genServiceNames == nil {
+				genServiceNames = []string{"*"}
+			}
+
 			resp, err := daemon.GenClient(ctx, &daemonpb.GenClientRequest{
-				AppId:   appID,
-				EnvName: envName,
-				Lang:    lang,
+				AppId:                          appID,
+				EnvName:                        envName,
+				Lang:                           lang,
+				Services:                       genServiceNames,
+				ExcludedServices:               excludedServices,
+				EndpointTags:                   endpointTags,
+				ExcludedEndpointTags:           excludedEndpointTags,
+				OpenapiExcludePrivateEndpoints: &openAPIExcludePrivateEndpoints,
+				TsSharedTypes:                  &tsSharedTypes,
+				TsClientTarget:                 &tsDefaultClient,
 			})
 			if err != nil {
 				fatal(err)
 			}
 
 			if output == "" {
-				os.Stdout.Write(resp.Code)
+				_, _ = os.Stdout.Write(resp.Code)
 			} else {
-				if err := ioutil.WriteFile(output, resp.Code, 0755); err != nil {
+				if err := os.WriteFile(output, resp.Code, 0755); err != nil {
 					fatal(err)
 				}
 			}
 		},
+
+		ValidArgsFunction: cmdutil.AutoCompleteAppSlug,
+	}
+
+	genWrappersCmd := &cobra.Command{
+		Use:   "wrappers",
+		Short: "Generates user-facing wrapper code",
+		Long: `Manually regenerates user-facing wrapper code.
+
+This is typically not something you ever need to call during regular development,
+as Encore automatically regenerates the wrappers whenever the code-base changes.
+
+Its core use case is for CI/CD workflows where you want to run custom linters,
+which may require the user-facing wrapper code to be manually generated.`,
+		Args: cobra.ExactArgs(0),
+		Run: func(cmd *cobra.Command, args []string) {
+			appRoot, _ := determineAppRoot()
+			ctx := context.Background()
+			daemon := setupDaemon(ctx)
+			_, err := daemon.GenWrappers(ctx, &daemonpb.GenWrappersRequest{
+				AppRoot: appRoot,
+			})
+			if err != nil {
+				fatal(err)
+			} else {
+				fmt.Println("successfully generated encore wrappers.")
+			}
+		},
 	}
 
 	genCmd.AddCommand(genClientCmd)
+	genCmd.AddCommand(genWrappersCmd)
+
+	genClientCmd.Flags().StringVarP(&lang, "lang", "l", "", "The language to generate code for (\"typescript\", \"javascript\", \"go\", and \"openapi\" are supported)")
+	_ = genClientCmd.RegisterFlagCompletionFunc("lang", cmdutil.AutoCompleteFromStaticList(
+		"typescript\tA TypeScript client using the in-browser Fetch API",
+		"javascript\tA JavaScript client using the in-browser Fetch API",
+		"go\tA Go client using net/http",
+		"openapi\tAn OpenAPI specification",
+	))
+
 	genClientCmd.Flags().StringVarP(&output, "output", "o", "", "The filename to write the generated client code to")
-	genClientCmd.Flags().StringVarP(&lang, "lang", "l", "", "The language to generate code for (only \"ts\" is supported for now)")
-	genClientCmd.Flags().StringVarP(&envName, "env", "e", "", "The environment to fetch the API for (defaults to the primary environment)")
-}
+	_ = genClientCmd.MarkFlagFilename("output", "go", "ts", "tsx", "js", "jsx")
 
-func detectLang(path string) (string, bool) {
-	suffix := strings.ToLower(filepath.Ext(path))
-	switch suffix {
-	case ".ts":
-		return "typescript", true
-	default:
-		return "", false
-	}
+	genClientCmd.Flags().StringVarP(&envName, "env", "e", "local", "The environment to fetch the API for (defaults to the local environment)")
+	_ = genClientCmd.RegisterFlagCompletionFunc("env", cmdutil.AutoCompleteEnvSlug)
+
+	genClientCmd.Flags().StringSliceVarP(&genServiceNames, "services", "s", nil, "The names of the services to include in the output")
+	genClientCmd.Flags().StringSliceVarP(&excludedServices, "excluded-services", "x", nil, "The names of the services to exclude in the output")
+	genClientCmd.Flags().StringSliceVarP(&endpointTags, "tags", "t", nil, "The names of endpoint tags to include in the output")
+	genClientCmd.Flags().
+		StringSliceVar(&excludedEndpointTags, "excluded-tags", nil, "The names of endpoint tags to exclude in the output")
+	genClientCmd.Flags().
+		BoolVar(&openAPIExcludePrivateEndpoints, "openapi-exclude-private-endpoints", false, "Exclude private endpoints from the OpenAPI spec")
+	genClientCmd.Flags().
+		BoolVar(&tsSharedTypes, "ts:shared-types", false, "Import types from ~backend instead of re-generating them")
+	genClientCmd.Flags().StringVar(&target, "target", "", "An optional target for the client (\"leap\")")
+	_ = genClientCmd.RegisterFlagCompletionFunc("target", cmdutil.AutoCompleteFromStaticList(
+		"leap\tA TypeScript client for apps created with Leap (https://leap.new) ",
+	))
 }
diff --git a/cli/cmd/encore/init_windows.go b/cli/cmd/encore/init_windows.go
new file mode 100644
index 0000000000..2578b7a25f
--- /dev/null
+++ b/cli/cmd/encore/init_windows.go
@@ -0,0 +1,23 @@
+//go:build windows
+// +build windows
+
+package main
+
+import (
+	"golang.org/x/sys/windows"
+)
+
+// init activates virtual terminal feature on "windows", this enables colored
+// terminal output.
+func init() {
+	setConsoleMode(windows.Stdout, windows.ENABLE_VIRTUAL_TERMINAL_PROCESSING)
+	setConsoleMode(windows.Stderr, windows.ENABLE_VIRTUAL_TERMINAL_PROCESSING)
+}
+
+// setConsoleMode enables VT processing on stout and stderr.
+func setConsoleMode(handle windows.Handle, flag uint32) {
+	var mode uint32
+	if err := windows.GetConsoleMode(handle, &mode); err == nil {
+		windows.SetConsoleMode(handle, mode|flag)
+	}
+}
diff --git a/cli/cmd/encore/k8s/auth.go b/cli/cmd/encore/k8s/auth.go
new file mode 100644
index 0000000000..cb8ac804c6
--- /dev/null
+++ b/cli/cmd/encore/k8s/auth.go
@@ -0,0 +1,56 @@
+package k8s
+
+import (
+	"encoding/json"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/cmd/encore/k8s/types"
+	"encr.dev/internal/conf"
+)
+
+var genAuthCmd = &cobra.Command{
+	Use:                   "exec-credentials",
+	Short:                 "Used by kubectl to get an authentication token for the Encore Kubernetes Proxy",
+	Args:                  cobra.NoArgs,
+	Hidden:                true,
+	DisableFlagsInUseLine: true,
+	Run:                   func(cmd *cobra.Command, args []string) { generateExecCredentials() },
+}
+
+func init() {
+	kubernetesCmd.AddCommand(genAuthCmd)
+}
+
+// GenerateExecCredentials generates the Kubernetes exec credentials and writes them to stdout.
+//
+// If an error occurs, it is written to stderr and the program exits with a non-zero exit code.
+func generateExecCredentials() {
+	// Get the OAuth token from the Encore API
+	token, err := conf.DefaultTokenSource.Token()
+	if err != nil {
+		cmdutil.Fatalf("error getting token: %v", err)
+	}
+
+	// Generate the kuberentes exec credentials datastructures
+	expiryTime := types.NewTime(token.Expiry)
+	execCredentials := &types.ExecCredential{
+		TypeMeta: types.TypeMeta{
+			APIVersion: "client.authentication.k8s.io/v1",
+			Kind:       "ExecCredential",
+		},
+		Status: &types.ExecCredentialStatus{
+			Token:               token.AccessToken,
+			ExpirationTimestamp: &expiryTime,
+		},
+	}
+
+	// Marshal the exec credentials to JSON and write to stdout
+	output, err := json.MarshalIndent(execCredentials, "", "  ")
+	if err != nil {
+		cmdutil.Fatalf("error marshalling exec credentials: %v", err)
+	}
+	_, _ = os.Stdout.Write(output)
+}
diff --git a/cli/cmd/encore/k8s/config.go b/cli/cmd/encore/k8s/config.go
new file mode 100644
index 0000000000..a5b0834134
--- /dev/null
+++ b/cli/cmd/encore/k8s/config.go
@@ -0,0 +1,279 @@
+package k8s
+
+import (
+	"context"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"text/tabwriter"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/fatih/color"
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/cmd/encore/k8s/types"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/internal/conf"
+	"encr.dev/pkg/xos"
+
+	"sigs.k8s.io/yaml"
+)
+
+var configCmd = &cobra.Command{
+	Use:   "configure --env=ENV_NAME",
+	Short: "Updates your kubectl config to point to the Kubernetes cluster(s) for the specified environment",
+	Run: func(cmd *cobra.Command, args []string) {
+		appSlug := cmdutil.AppSlug()
+		ctx, cancel := context.WithTimeout(cmd.Context(), 5*time.Second)
+		defer cancel()
+
+		if k8sEnvName == "" {
+			_ = cmd.Help()
+			cmdutil.Fatal("must specify environment name with --env")
+		}
+
+		err := configureForAppEnv(ctx, appSlug, k8sEnvName)
+		if err != nil {
+			cmdutil.Fatalf("error configuring kubectl: %v", err)
+		}
+	},
+}
+
+var (
+	k8sEnvName string
+)
+
+func init() {
+	configCmd.Flags().StringVarP(&k8sEnvName, "env", "e", "", "Environment name")
+	_ = configCmd.MarkFlagRequired("env")
+	kubernetesCmd.AddCommand(configCmd)
+}
+
+func configureForAppEnv(ctx context.Context, appID string, envName string) error {
+	appSlug, envName, clusters, err := platform.KubernetesClusters(ctx, appID, envName)
+	if err != nil {
+		return errors.Wrap(err, "unable to get Kubernetes clusters for environment")
+	}
+	if len(clusters) == 0 {
+		return errors.New("no Kubernetes clusters found for environment")
+	}
+
+	// Read the existing kubeconfig file
+	configFilePath := filepath.Join(types.HomeDir(), ".kube", "config")
+	cfg, err := readKubeConfig(configFilePath)
+	if err != nil {
+		return err
+	}
+
+	// Add the clusters
+	contextPrefix := fmt.Sprintf("encore_%s_%s", appSlug, envName)
+	authName := "encore-proxy-auth"
+	contextNames := make([]string, len(clusters))
+	for i, cluster := range clusters {
+		// Create a context name for the cluster
+		// by default we use the app slug and env name seperated by a underscore (e.g. encore-myapp_prod)
+		// however if the environment has multiple clusters then we also include the cluster name (e.g. encore-myapp_prod_cluster1)
+		contextName := contextPrefix
+		if len(clusters) > 1 {
+			contextName += "_" + cluster.Name
+		}
+		contextNames[i] = contextName
+
+		// Add the cluster using the cluster name as the context name
+		cfg.clusters = appendOrUpdate(cfg.clusters, map[string]any{
+			"name": contextName,
+			"cluster": map[string]any{
+				"server": fmt.Sprintf("%s/k8s-api-proxy/%s/%s/", conf.APIBaseURL, cluster.EnvID, cluster.ResID),
+			},
+		})
+
+		k8sContext := map[string]any{
+			"cluster": contextName,
+			"user":    authName,
+		}
+		if cluster.DefaultNamespace != "" {
+			k8sContext["namespace"] = cluster.DefaultNamespace
+		}
+
+		cfg.contexts = appendOrUpdate(cfg.contexts, map[string]any{
+			"name":    contextName,
+			"context": k8sContext,
+		})
+	}
+
+	// Remove any old contexts or clusters
+	// We do this by iterating over the existing contexts and clusters and removing any that are not in the new list
+	for i := len(cfg.contexts) - 1; i >= 0; i-- {
+		if foundContext, ok := cfg.contexts[i].(map[string]any); ok {
+			if contextName, ok := foundContext["name"].(string); ok {
+				if strings.HasPrefix(contextName, contextPrefix) && !slices.Contains(contextNames, contextName) {
+					cfg.contexts = append(cfg.contexts[:i], cfg.contexts[i+1:]...)
+				}
+			}
+		}
+	}
+	for i := len(cfg.clusters) - 1; i >= 0; i-- {
+		if foundCluster, ok := cfg.clusters[i].(map[string]any); ok {
+			if clusterName, ok := foundCluster["name"].(string); ok {
+				if strings.HasPrefix(clusterName, contextPrefix) && !slices.Contains(contextNames, clusterName) {
+					cfg.clusters = append(cfg.clusters[:i], cfg.clusters[i+1:]...)
+				}
+			}
+		}
+	}
+
+	// If we added a cluster then we need to update the encore-k8s-proxy user
+	cfg.users = appendOrUpdate(cfg.users, map[string]any{
+		"name": authName,
+		"user": map[string]any{
+			"exec": map[string]any{
+				"apiVersion":         "client.authentication.k8s.io/v1",
+				"args":               []string{"kubernetes", "exec-credentials"},
+				"command":            "encore",
+				"env":                nil,
+				"installHint":        "Install encore for use with kubectl, see https://encore.dev",
+				"interactiveMode":    "Never",
+				"provideClusterInfo": false,
+			},
+		},
+	})
+
+	// Update the current context to the first cluster for the environment
+	cfg.raw["current-context"] = contextNames[0]
+
+	if err := writeKubeConfig(configFilePath, cfg); err != nil {
+		return err
+	}
+
+	if len(clusters) == 1 {
+		_, _ = fmt.Fprintf(os.Stdout, "kubectl configured for cluster %s under context %s.\n", color.CyanString(clusters[0].Name), color.CyanString(contextNames[0]))
+	} else {
+		_, _ = fmt.Fprintf(os.Stdout, "kubectl configured for %d clusters:\n\n", len(clusters))
+
+		w := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', tabwriter.StripEscape)
+		_, _ = fmt.Fprint(w, "CLUSTER\tCONTEXT\tACTIVE\n")
+		for i, cluster := range clusters {
+			active := ""
+			if i == 0 {
+				active = "yes"
+			}
+			_, _ = fmt.Fprintf(w, "%s\t%s\t%s\n", cluster.Name, contextNames[0], active)
+		}
+		_ = w.Flush()
+	}
+
+	return nil
+}
+
+// readKubeConfig reads the existing kubeconfig file and returns a Cfg struct.
+// however this is as untyped as possible, so that we can easily marshal it back without losing any data.
+func readKubeConfig(file string) (*Cfg, error) {
+	b, err := os.ReadFile(file)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return nil, errors.Wrap(err, "unable to read kubeconfig file")
+	}
+
+	// Read the existing kubeconfig file
+	var kubeConfig map[string]any
+	if len(b) > 0 {
+		if err = yaml.Unmarshal(b, &kubeConfig); err != nil {
+			return nil, errors.Wrap(err, "unable to parse kubeconfig file")
+		}
+	}
+
+	// Ensure the kubeConfig struct is valid
+	if kubeConfig == nil {
+		kubeConfig = map[string]any{
+			"apiVersion": "v1",
+			"kind":       "Config",
+		}
+	} else if kubeConfig["apiVersion"] != "v1" || kubeConfig["kind"] != "Config" {
+		return nil, errors.New("invalid existing kubeconfig file")
+	}
+	cfg := &Cfg{
+		raw: kubeConfig,
+	}
+
+	if clusters, ok := kubeConfig["clusters"]; ok {
+		if clusters, ok := clusters.([]any); ok {
+			cfg.clusters = clusters
+		} else {
+			return nil, errors.Newf("clusters is not an array got %T", clusters)
+		}
+	}
+
+	if users, ok := kubeConfig["users"]; ok {
+		if users, ok := users.([]any); ok {
+			cfg.users = users
+		} else {
+			return nil, errors.Newf("users is not an array got %T", users)
+		}
+	}
+
+	if contexts, ok := kubeConfig["contexts"]; ok {
+		if contexts, ok := contexts.([]any); ok {
+			cfg.contexts = contexts
+		} else {
+			return nil, errors.Newf("contexts is not an array got %T", contexts)
+		}
+	}
+
+	return cfg, nil
+}
+
+// writeKubeConfig writes the kubeconfig back to the file.
+func writeKubeConfig(file string, cfg *Cfg) error {
+	// Update the raw kubeconfig struct
+	cfg.raw["clusters"] = cfg.clusters
+	cfg.raw["users"] = cfg.users
+	cfg.raw["contexts"] = cfg.contexts
+
+	b, err := yaml.Marshal(cfg.raw)
+	if err != nil {
+		return errors.Wrap(err, "unable to marshal kubeconfig back into yaml")
+	}
+
+	// Ensure the directory exists
+	if err := os.MkdirAll(filepath.Dir(file), 0755); err != nil {
+		return errors.Wrap(err, "unable to create kubeconfig directory")
+	}
+
+	// Then write the file
+	err = xos.WriteFile(file, b, 0600)
+	if err != nil {
+		return errors.Wrap(err, "unable to write kubeconfig file")
+	}
+	return nil
+}
+
+type Cfg struct {
+	raw      map[string]any
+	clusters []any
+	users    []any
+	contexts []any
+}
+
+// appendOrUpdate looks at the array for an entry which is a map and has a "name" key which matches the name in val, if found
+// it will update the entry with val, otherwise it will append val to the array.
+func appendOrUpdate(dst []any, val map[string]any) []any {
+	idx := slices.IndexFunc(dst, func(entry any) bool {
+		if entry, ok := entry.(map[string]any); ok {
+			if entry["name"] == val["name"] {
+				return true
+			}
+		}
+		return false
+	})
+
+	if idx == -1 {
+		return append(dst, val)
+	} else {
+		dst[idx] = val
+		return dst
+	}
+}
diff --git a/cli/cmd/encore/k8s/kubernetes.go b/cli/cmd/encore/k8s/kubernetes.go
new file mode 100644
index 0000000000..86a21bd4e8
--- /dev/null
+++ b/cli/cmd/encore/k8s/kubernetes.go
@@ -0,0 +1,17 @@
+package k8s
+
+import (
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/root"
+)
+
+var kubernetesCmd = &cobra.Command{
+	Use:     "kubernetes",
+	Short:   "Kubernetes management commands",
+	Aliases: []string{"k8s"},
+}
+
+func init() {
+	root.Cmd.AddCommand(kubernetesCmd)
+}
diff --git a/cli/cmd/encore/k8s/types/KUBERNETES_LICENSE.txt b/cli/cmd/encore/k8s/types/KUBERNETES_LICENSE.txt
new file mode 100644
index 0000000000..d645695673
--- /dev/null
+++ b/cli/cmd/encore/k8s/types/KUBERNETES_LICENSE.txt
@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/cli/cmd/encore/k8s/types/README.md b/cli/cmd/encore/k8s/types/README.md
new file mode 100644
index 0000000000..038a9fcdbe
--- /dev/null
+++ b/cli/cmd/encore/k8s/types/README.md
@@ -0,0 +1,4 @@
+# Kubernetes Types
+
+This package contains types copied directly from the [Kubernetes](https://github.com/kubernetes/kubernetes) project, this
+is to prevent the Encore CLI needing to have a dependency on the Kubernetes project for just these types.
diff --git a/cli/cmd/encore/k8s/types/clientauthentication_types.go b/cli/cmd/encore/k8s/types/clientauthentication_types.go
new file mode 100644
index 0000000000..29e31d3aa4
--- /dev/null
+++ b/cli/cmd/encore/k8s/types/clientauthentication_types.go
@@ -0,0 +1,120 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+// ExecCredential is used by exec-based plugins to communicate credentials to
+// HTTP transports.
+type ExecCredential struct {
+	TypeMeta `json:",inline"`
+
+	// Spec holds information passed to the plugin by the transport.
+	Spec ExecCredentialSpec `json:"spec,omitempty"`
+
+	// Status is filled in by the plugin and holds the credentials that the transport
+	// should use to contact the API.
+	// +optional
+	Status *ExecCredentialStatus `json:"status,omitempty"`
+}
+
+// ExecCredentialSpec holds request and runtime specific information provided by
+// the transport.
+type ExecCredentialSpec struct {
+	// Cluster contains information to allow an exec plugin to communicate with the
+	// kubernetes cluster being authenticated to. Note that Cluster is non-nil only
+	// when provideClusterInfo is set to true in the exec provider config (i.e.,
+	// ExecConfig.ProvideClusterInfo).
+	// +optional
+	Cluster *Cluster `json:"cluster,omitempty"`
+
+	// Interactive declares whether stdin has been passed to this exec plugin.
+	Interactive bool `json:"interactive"`
+}
+
+// ExecCredentialStatus holds credentials for the transport to use.
+//
+// Token and ClientKeyData are sensitive fields. This data should only be
+// transmitted in-memory between client and exec plugin process. Exec plugin
+// itself should at least be protected via file permissions.
+type ExecCredentialStatus struct {
+	// ExpirationTimestamp indicates a time when the provided credentials expire.
+	// +optional
+	ExpirationTimestamp *Time `json:"expirationTimestamp,omitempty"`
+	// Token is a bearer token used by the client for request authentication.
+	Token string `json:"token,omitempty" datapolicy:"token"`
+	// PEM-encoded client TLS certificates (including intermediates, if any).
+	ClientCertificateData string `json:"clientCertificateData,omitempty"`
+	// PEM-encoded private key for the above certificate.
+	ClientKeyData string `json:"clientKeyData,omitempty" datapolicy:"security-key"`
+}
+
+// Cluster contains information to allow an exec plugin to communicate
+// with the kubernetes cluster being authenticated to.
+//
+// To ensure that this struct contains everything someone would need to communicate
+// with a kubernetes cluster (just like they would via a kubeconfig), the fields
+// should shadow "k8s.io/client-go/tools/clientcmd/api/v1".Cluster, with the exception
+// of CertificateAuthority, since CA data will always be passed to the plugin as bytes.
+type Cluster struct {
+	// Server is the address of the kubernetes cluster (https://hostname:port).
+	Server string `json:"server"`
+	// TLSServerName is passed to the server for SNI and is used in the client to
+	// check server certificates against. If ServerName is empty, the hostname
+	// used to contact the server is used.
+	// +optional
+	TLSServerName string `json:"tls-server-name,omitempty"`
+	// InsecureSkipTLSVerify skips the validity check for the server's certificate.
+	// This will make your HTTPS connections insecure.
+	// +optional
+	InsecureSkipTLSVerify bool `json:"insecure-skip-tls-verify,omitempty"`
+	// CAData contains PEM-encoded certificate authority certificates.
+	// If empty, system roots should be used.
+	// +listType=atomic
+	// +optional
+	CertificateAuthorityData []byte `json:"certificate-authority-data,omitempty"`
+	// ProxyURL is the URL to the proxy to be used for all requests to this
+	// cluster.
+	// +optional
+	ProxyURL string `json:"proxy-url,omitempty"`
+	// DisableCompression allows client to opt-out of response compression for all requests to the server. This is useful
+	// to speed up requests (specifically lists) when client-server network bandwidth is ample, by saving time on
+	// compression (server-side) and decompression (client-side): https://github.com/kubernetes/kubernetes/issues/112296.
+	// +optional
+	DisableCompression bool `json:"disable-compression,omitempty"`
+	// Config holds additional config data that is specific to the exec
+	// plugin with regards to the cluster being authenticated to.
+	//
+	// This data is sourced from the clientcmd Cluster object's
+	// extensions[client.authentication.k8s.io/exec] field:
+	//
+	// clusters:
+	// - name: my-cluster
+	//   cluster:
+	//     ...
+	//     extensions:
+	//     - name: client.authentication.k8s.io/exec  # reserved extension name for per cluster exec config
+	//       extension:
+	//         audience: 06e3fbd18de8  # arbitrary config
+	//
+	// In some environments, the user config may be exactly the same across many clusters
+	// (i.e. call this exec plugin) minus some details that are specific to each cluster
+	// such as the audience.  This field allows the per cluster config to be directly
+	// specified with the cluster info.  Using this field to store secret data is not
+	// recommended as one of the prime benefits of exec plugins is that no secrets need
+	// to be stored directly in the kubeconfig.
+	// +optional
+	Config RawExtension `json:"config,omitempty"`
+}
diff --git a/cli/cmd/encore/k8s/types/homedir.go b/cli/cmd/encore/k8s/types/homedir.go
new file mode 100644
index 0000000000..c041f40c71
--- /dev/null
+++ b/cli/cmd/encore/k8s/types/homedir.go
@@ -0,0 +1,92 @@
+/*
+Copyright 2016 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+import (
+	"os"
+	"path/filepath"
+	"runtime"
+)
+
+// HomeDir returns the home directory for the current user.
+// On Windows:
+// 1. the first of %HOME%, %HOMEDRIVE%%HOMEPATH%, %USERPROFILE% containing a `.kube\config` file is returned.
+// 2. if none of those locations contain a `.kube\config` file, the first of %HOME%, %USERPROFILE%, %HOMEDRIVE%%HOMEPATH% that exists and is writeable is returned.
+// 3. if none of those locations are writeable, the first of %HOME%, %USERPROFILE%, %HOMEDRIVE%%HOMEPATH% that exists is returned.
+// 4. if none of those locations exists, the first of %HOME%, %USERPROFILE%, %HOMEDRIVE%%HOMEPATH% that is set is returned.
+func HomeDir() string {
+	if runtime.GOOS == "windows" {
+		home := os.Getenv("HOME")
+		homeDriveHomePath := ""
+		if homeDrive, homePath := os.Getenv("HOMEDRIVE"), os.Getenv("HOMEPATH"); len(homeDrive) > 0 && len(homePath) > 0 {
+			homeDriveHomePath = homeDrive + homePath
+		}
+		userProfile := os.Getenv("USERPROFILE")
+
+		// Return first of %HOME%, %HOMEDRIVE%/%HOMEPATH%, %USERPROFILE% that contains a `.kube\config` file.
+		// %HOMEDRIVE%/%HOMEPATH% is preferred over %USERPROFILE% for backwards-compatibility.
+		for _, p := range []string{home, homeDriveHomePath, userProfile} {
+			if len(p) == 0 {
+				continue
+			}
+			if _, err := os.Stat(filepath.Join(p, ".kube", "config")); err != nil {
+				continue
+			}
+			return p
+		}
+
+		firstSetPath := ""
+		firstExistingPath := ""
+
+		// Prefer %USERPROFILE% over %HOMEDRIVE%/%HOMEPATH% for compatibility with other auth-writing tools
+		for _, p := range []string{home, userProfile, homeDriveHomePath} {
+			if len(p) == 0 {
+				continue
+			}
+			if len(firstSetPath) == 0 {
+				// remember the first path that is set
+				firstSetPath = p
+			}
+			info, err := os.Stat(p)
+			if err != nil {
+				continue
+			}
+			if len(firstExistingPath) == 0 {
+				// remember the first path that exists
+				firstExistingPath = p
+			}
+			if info.IsDir() && info.Mode().Perm()&(1<<(uint(7))) != 0 {
+				// return first path that is writeable
+				return p
+			}
+		}
+
+		// If none are writeable, return first location that exists
+		if len(firstExistingPath) > 0 {
+			return firstExistingPath
+		}
+
+		// If none exist, return first location that is set
+		if len(firstSetPath) > 0 {
+			return firstSetPath
+		}
+
+		// We've got nothing
+		return ""
+	}
+	return os.Getenv("HOME")
+}
diff --git a/cli/cmd/encore/k8s/types/meta_types.go b/cli/cmd/encore/k8s/types/meta_types.go
new file mode 100644
index 0000000000..b9dadd8cfe
--- /dev/null
+++ b/cli/cmd/encore/k8s/types/meta_types.go
@@ -0,0 +1,96 @@
+/*
+Copyright 2021 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package types
+
+import (
+	"encoding/json"
+	"time"
+)
+
+// TypeMeta describes an individual object in an API response or request
+// with strings representing the type of the object and its API schema version.
+// Structures that are versioned or persisted should inline TypeMeta.
+//
+// +k8s:deepcopy-gen=false
+type TypeMeta struct {
+	// Kind is a string value representing the REST resource this object represents.
+	// Servers may infer this from the endpoint the client submits requests to.
+	// Cannot be updated.
+	// In CamelCase.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	Kind string `json:"kind,omitempty" protobuf:"bytes,1,opt,name=kind"`
+
+	// APIVersion defines the versioned schema of this representation of an object.
+	// Servers should convert recognized schemas to the latest internal value, and
+	// may reject unrecognized values.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+	// +optional
+	APIVersion string `json:"apiVersion,omitempty" protobuf:"bytes,2,opt,name=apiVersion"`
+}
+
+// Time is a wrapper around time.Time which supports correct
+// marshaling to YAML and JSON.  Wrappers are provided for many
+// of the factory methods that the time package offers.
+//
+// +protobuf.options.marshal=false
+// +protobuf.as=Timestamp
+// +protobuf.options.(gogoproto.goproto_stringer)=false
+type Time struct {
+	time.Time `protobuf:"-"`
+}
+
+// NewTime returns a wrapped instance of the provided time
+func NewTime(time time.Time) Time {
+	return Time{time}
+}
+
+// UnmarshalJSON implements the json.Unmarshaller interface.
+func (t *Time) UnmarshalJSON(b []byte) error {
+	if len(b) == 4 && string(b) == "null" {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	var str string
+	err := json.Unmarshal(b, &str)
+	if err != nil {
+		return err
+	}
+
+	pt, err := time.Parse(time.RFC3339, str)
+	if err != nil {
+		return err
+	}
+
+	t.Time = pt.Local()
+	return nil
+}
+
+// MarshalJSON implements the json.Marshaler interface.
+func (t Time) MarshalJSON() ([]byte, error) {
+	if t.IsZero() {
+		// Encode unset/nil objects as JSON's "null".
+		return []byte("null"), nil
+	}
+	buf := make([]byte, 0, len(time.RFC3339)+2)
+	buf = append(buf, '"')
+	// time cannot contain non escapable JSON characters
+	buf = t.UTC().AppendFormat(buf, time.RFC3339)
+	buf = append(buf, '"')
+	return buf, nil
+}
diff --git a/cli/cmd/encore/k8s/types/runtime_types.go b/cli/cmd/encore/k8s/types/runtime_types.go
new file mode 100644
index 0000000000..23cf5a5160
--- /dev/null
+++ b/cli/cmd/encore/k8s/types/runtime_types.go
@@ -0,0 +1,76 @@
+/*
+Copyright 2014 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+package types
+
+// RawExtension is used to hold extensions in external versions.
+//
+// To use this, make a field which has RawExtension as its type in your external, versioned
+// struct, and Object in your internal struct. You also need to register your
+// various plugin types.
+//
+// // Internal package:
+//
+//	type MyAPIObject struct {
+//		runtime.TypeMeta `json:",inline"`
+//		MyPlugin runtime.Object `json:"myPlugin"`
+//	}
+//
+//	type PluginA struct {
+//		AOption string `json:"aOption"`
+//	}
+//
+// // External package:
+//
+//	type MyAPIObject struct {
+//		runtime.TypeMeta `json:",inline"`
+//		MyPlugin runtime.RawExtension `json:"myPlugin"`
+//	}
+//
+//	type PluginA struct {
+//		AOption string `json:"aOption"`
+//	}
+//
+// // On the wire, the JSON will look something like this:
+//
+//	{
+//		"kind":"MyAPIObject",
+//		"apiVersion":"v1",
+//		"myPlugin": {
+//			"kind":"PluginA",
+//			"aOption":"foo",
+//		},
+//	}
+//
+// So what happens? Decode first uses json or yaml to unmarshal the serialized data into
+// your external MyAPIObject. That causes the raw JSON to be stored, but not unpacked.
+// The next step is to copy (using pkg/conversion) into the internal struct. The runtime
+// package's DefaultScheme has conversion functions installed which will unpack the
+// JSON stored in RawExtension, turning it into the correct object type, and storing it
+// in the Object. (TODO: In the case where the object is of an unknown type, a
+// runtime.Unknown object will be created and stored.)
+//
+// +k8s:deepcopy-gen=true
+// +protobuf=true
+// +k8s:openapi-gen=true
+type RawExtension struct {
+	// Raw is the underlying serialization of this object.
+	//
+	// TODO: Determine how to detect ContentType and ContentEncoding of 'Raw' data.
+	Raw []byte `json:"-" protobuf:"bytes,1,opt,name=raw"`
+	// Object can hold a representation of this extension - useful for working with versioned
+	// structs.
+	Object any `json:"-"`
+}
diff --git a/cli/cmd/encore/logs.go b/cli/cmd/encore/logs.go
index d9bb39e1a8..307d7e17c3 100644
--- a/cli/cmd/encore/logs.go
+++ b/cli/cmd/encore/logs.go
@@ -3,26 +3,33 @@ package main
 import (
 	"bytes"
 	"context"
+	"encoding/json"
+	"errors"
 	"fmt"
-	"io"
 	"os"
 	"os/signal"
+	"time"
 
-	daemonpb "encr.dev/proto/encore/daemon"
+	"github.com/gorilla/websocket"
+	"github.com/logrusorgru/aurora/v3"
 	"github.com/rs/zerolog"
 	"github.com/spf13/cobra"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
+
+	"encr.dev/cli/internal/platform"
+	"encr.dev/pkg/appfile"
 )
 
 var (
-	logsEnv  string
-	logsJSON bool
+	logsEnv   string
+	logsJSON  bool
+	logsQuiet bool
 )
 
 var logsCmd = &cobra.Command{
-	Use:   "logs",
+	Use:   "logs [--env=prod] [--json]",
 	Short: "Streams logs from your application",
+
+	DisableFlagsInUseLine: true,
 	Run: func(cmd *cobra.Command, args []string) {
 		appRoot, _ := determineAppRoot()
 		streamLogs(appRoot, logsEnv)
@@ -30,51 +37,104 @@ var logsCmd = &cobra.Command{
 }
 
 func streamLogs(appRoot, envName string) {
-	interrupt := make(chan os.Signal, 1)
-	signal.Notify(interrupt, os.Interrupt)
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer cancel()
+	appSlug, err := appfile.Slug(appRoot)
+	if err != nil {
+		fatal(err)
+	} else if appSlug == "" {
+		fatal("app is not linked with Encore Cloud")
+	}
+
+	if envName == "" {
+		envName = "@primary"
+	}
+	logs, err := platform.EnvLogs(ctx, appSlug, envName)
+	if err != nil {
+		var e platform.Error
+		if errors.As(err, &e) {
+			switch e.Code {
+			case "env_not_found":
+				fatalf("environment %q not found", envName)
+			}
+		}
+		fatal(err)
+	}
 
-	ctx, cancel := context.WithCancel(context.Background())
 	go func() {
-		<-interrupt
-		cancel()
+		<-ctx.Done()
+		logs.Close()
 	}()
 
-	daemon := setupDaemon(ctx)
-	stream, err := daemon.Logs(ctx, &daemonpb.LogsRequest{
-		AppRoot: appRoot,
-		EnvName: envName,
-	})
-	if err != nil {
-		fatal("could not stream logs: ", err)
+	// Use the same configuration as the runtime
+	zerolog.TimeFieldFormat = time.RFC3339Nano
+
+	if !logsQuiet {
+		fmt.Println(aurora.Gray(12, "Connected, waiting for logs..."))
 	}
 
 	cw := zerolog.NewConsoleWriter()
 	for {
-		msg, err := stream.Recv()
-		if err == io.EOF || status.Code(err) == codes.Canceled {
+		_, message, err := logs.ReadMessage()
+		if err != nil {
+			if websocket.IsUnexpectedCloseError(err, websocket.CloseGoingAway, websocket.CloseAbnormalClosure) {
+				fatal("the server closed the connection unexpectedly.")
+			}
 			return
-		} else if err != nil {
-			fatal(err)
 		}
-		for _, line := range msg.Lines {
+
+		lines := bytes.Split(message, []byte("\n"))
+		for _, line := range lines {
 			// Pretty-print logs if requested and it looks like a JSON log line
 			if !logsJSON && bytes.HasPrefix(line, []byte{'{'}) {
-				if _, err := cw.Write(line); err != nil {
+				if _, err := cw.Write(mapCloudFieldNamesToExpected(line)); err != nil {
 					// Fall back to regular stdout in case of error
 					os.Stdout.Write(line)
+					os.Stdout.Write([]byte("\n"))
 				}
 			} else {
 				os.Stdout.Write(line)
+				os.Stdout.Write([]byte("\n"))
 			}
 		}
-		if msg.DropNotice {
-			fmt.Fprintln(os.Stderr, "--- NOTICE: log lines were not sent due to high volume or slow reader ---")
-		}
 	}
 }
 
+// mapCloudFieldNamesToExpected detects if we're logging with GCP style logging and then swaps
+// the field names to what is expected by zerolog
+func mapCloudFieldNamesToExpected(jsonBytes []byte) []byte {
+	unmarshaled := map[string]any{}
+	err := json.Unmarshal(jsonBytes, &unmarshaled)
+	if err != nil {
+		return jsonBytes
+	}
+
+	_, hasSeverity := unmarshaled["severity"]
+	_, hasExpectedLevelField := unmarshaled[zerolog.LevelFieldName]
+	_, hasTimestamp := unmarshaled["timestamp"]
+	_, hasExpectedTimeField := unmarshaled[zerolog.TimestampFieldName]
+
+	// GCP logs have a severity field and a timestamp field and not the default level and timestamp
+	if hasSeverity && !hasExpectedLevelField && hasTimestamp && !hasExpectedTimeField {
+		unmarshaled[zerolog.LevelFieldName] = unmarshaled["severity"]
+		delete(unmarshaled, "severity")
+		unmarshaled[zerolog.TimestampFieldName] = unmarshaled["timestamp"]
+		delete(unmarshaled, "timestamp")
+	} else {
+		// No changes, return the original bytes unmodified
+		return jsonBytes
+	}
+
+	newBytes, err := json.Marshal(unmarshaled)
+	if err != nil {
+		return jsonBytes
+	}
+	return newBytes
+}
+
 func init() {
 	rootCmd.AddCommand(logsCmd)
-	logsCmd.Flags().StringVarP(&logsEnv, "env", "e", "", "Environment name to stream logs from (defaults to the production environment)")
+	logsCmd.Flags().StringVarP(&logsEnv, "env", "e", "", "Environment name to stream logs from (defaults to the primary environment)")
 	logsCmd.Flags().BoolVar(&logsJSON, "json", false, "Whether to print logs in raw JSON format")
+	logsCmd.Flags().BoolVarP(&logsQuiet, "quiet", "q", false, "Whether to print initial message when the command is waiting for logs")
 }
diff --git a/cli/cmd/encore/main.go b/cli/cmd/encore/main.go
index 4b5f845888..ffb4dc4a77 100644
--- a/cli/cmd/encore/main.go
+++ b/cli/cmd/encore/main.go
@@ -2,28 +2,29 @@ package main
 
 import (
 	"fmt"
-	"io"
 	"os"
-	"path/filepath"
 
-	daemonpb "encr.dev/proto/encore/daemon"
-	"github.com/fatih/color"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
-	"github.com/spf13/cobra"
 	"golang.org/x/tools/go/packages"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/cmd/encore/root"
+
+	// Register commands
+	_ "encr.dev/cli/cmd/encore/app"
+	_ "encr.dev/cli/cmd/encore/config"
+	_ "encr.dev/cli/cmd/encore/k8s"
+	_ "encr.dev/cli/cmd/encore/namespace"
+	_ "encr.dev/cli/cmd/encore/secrets"
 )
 
-var rootCmd = &cobra.Command{
-	Use:   "encore",
-	Short: "encore is the fastest way of developing backend applications",
-}
+// for backwards compatibility, for now
+var rootCmd = root.Cmd
 
 func main() {
 	log.Logger = log.Output(zerolog.ConsoleWriter{Out: os.Stderr})
-	if err := rootCmd.Execute(); err != nil {
+	if err := root.Cmd.Execute(); err != nil {
 		fmt.Fprintln(os.Stderr, err)
 		os.Exit(1)
 	}
@@ -36,30 +37,11 @@ func main() {
 // relative path from the app root to the working directory.
 // On errors it prints an error message and exits.
 func determineAppRoot() (appRoot, relPath string) {
-	dir, err := os.Getwd()
-	if err != nil {
-		fatal(err)
-	}
-	rel := "."
-	for {
-		path := filepath.Join(dir, "encore.app")
-		fi, err := os.Stat(path)
-		if os.IsNotExist(err) {
-			dir2 := filepath.Dir(dir)
-			if dir2 == dir {
-				fatal("no encore.app found in directory (or any of the parent directories).")
-			}
-			rel = filepath.Join(filepath.Base(dir), rel)
-			dir = dir2
-			continue
-		} else if err != nil {
-			fatal(err)
-		} else if fi.IsDir() {
-			fatal("encore.app is a directory, not a file")
-		} else {
-			return dir, rel
-		}
-	}
+	return cmdutil.AppRoot()
+}
+
+func determineWorkspaceRoot(appRoot string) string {
+	return cmdutil.WorkspaceRoot(appRoot)
 }
 
 func resolvePackages(dir string, patterns ...string) ([]string, error) {
@@ -78,69 +60,22 @@ func resolvePackages(dir string, patterns ...string) ([]string, error) {
 	return paths, nil
 }
 
-// commandOutputStream is the interface for gRPC streams that
-// stream the output of a command.
-type commandOutputStream interface {
-	Recv() (*daemonpb.CommandMessage, error)
-}
-
-// streamCommandOutput streams the output from the given command stream,
-// and exits with the same exit code as the command.
-func streamCommandOutput(stream commandOutputStream) {
-	for {
-		msg, err := stream.Recv()
-		if err != nil {
-			st := status.Convert(err)
-			switch {
-			case st.Code() == codes.FailedPrecondition:
-				fmt.Fprintln(os.Stderr, st.Message())
-				os.Exit(1)
-			case err == io.EOF || st.Code() == codes.Canceled:
-				return
-			default:
-				log.Fatal().Err(err).Msg("connection failure")
-			}
-		}
-
-		switch m := msg.Msg.(type) {
-		case *daemonpb.CommandMessage_Output:
-			if m.Output.Stdout != nil {
-				os.Stdout.Write(m.Output.Stdout)
-			}
-			if m.Output.Stderr != nil {
-				os.Stderr.Write(m.Output.Stderr)
-			}
-		case *daemonpb.CommandMessage_Exit:
-			os.Exit(int(m.Exit.Code))
-		}
-	}
+func displayError(out *os.File, err []byte) {
+	cmdutil.DisplayError(out, err)
 }
 
 func fatal(args ...interface{}) {
-	// Prettify gRPC errors
-	for i, arg := range args {
-		if err, ok := arg.(error); ok {
-			if s, ok := status.FromError(err); ok {
-				args[i] = s.Message()
-			}
-		}
-	}
-
-	red := color.New(color.FgRed)
-	red.Fprint(os.Stderr, "error: ")
-	red.Fprintln(os.Stderr, args...)
-	os.Exit(1)
+	cmdutil.Fatal(args...)
 }
 
 func fatalf(format string, args ...interface{}) {
-	// Prettify gRPC errors
-	for i, arg := range args {
-		if err, ok := arg.(error); ok {
-			if s, ok := status.FromError(err); ok {
-				args[i] = s.Message()
-			}
-		}
-	}
+	cmdutil.Fatalf(format, args...)
+}
 
-	fatal(fmt.Sprintf(format, args...))
+func nonZeroPtr[T comparable](v T) *T {
+	var zero T
+	if v == zero {
+		return nil
+	}
+	return &v
 }
diff --git a/cli/cmd/encore/mcp.go b/cli/cmd/encore/mcp.go
new file mode 100644
index 0000000000..9ce2b5cf7f
--- /dev/null
+++ b/cli/cmd/encore/mcp.go
@@ -0,0 +1,412 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"maps"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/logrusorgru/aurora/v3"
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/cmd/encore/root"
+	"encr.dev/cli/internal/jsonrpc2"
+)
+
+var mcpCmd = &cobra.Command{
+	Use:   "mcp",
+	Short: "MCP (Message Context Provider) commands",
+}
+
+var (
+	appID   string
+	mcpPort int = 9900
+)
+
+var startCmd = &cobra.Command{
+	Use:   "start",
+	Short: "Starts an SSE based MCP session and prints the SSE URL",
+	Run: func(cmd *cobra.Command, args []string) {
+		ctx := cmd.Context()
+		if appID == "" {
+			appID = cmdutil.AppSlugOrLocalID()
+		}
+		setupDaemon(ctx)
+
+		_, _ = fmt.Fprintf(os.Stderr, "  MCP Service is running!\n\n")
+		_, _ = fmt.Fprintf(os.Stderr, "  MCP SSE URL:        %s\n", aurora.Cyan(fmt.Sprintf(
+			"http://localhost:%d/sse?app=%s", mcpPort, appID)))
+		_, _ = fmt.Fprintf(os.Stderr, "  MCP stdio Command:  %s\n", aurora.Cyan(fmt.Sprintf(
+			"encore mcp run --app=%s", appID)))
+	},
+}
+
+type sseConnection struct {
+	read  func() (typ, data string, err error)
+	close func() error
+
+	appID     string
+	connected bool
+	path      string
+	client    *http.Client
+
+	// Track outstanding request IDs
+	mu         sync.Mutex
+	requestIDs map[jsonrpc2.ID]struct{}
+}
+
+func (c *sseConnection) Read() (typ, data string, err error) {
+	typ, data, err = c.read()
+	if err != nil {
+		c.connected = false
+		return "", "", err
+	}
+	return typ, data, nil
+}
+
+func (c *sseConnection) Close() error {
+	if c.close != nil {
+		c.connected = false
+		return c.close()
+	}
+	return nil
+}
+
+func (c *sseConnection) reconnect(ctx context.Context) error {
+	// Close the existing connection if there is one
+	if c.close != nil {
+		_ = c.close()
+	}
+	c.connected = false
+
+	// Initial backoff duration
+	backoff := 1000 * time.Millisecond
+	maxBackoff := 10 * time.Second
+
+	for {
+		// Check if context is canceled
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		default:
+		}
+
+		if root.Verbosity > 0 {
+			fmt.Fprintf(os.Stderr, "Reconnecting to MCP: %v\n", backoff)
+		}
+
+		// Try to connect
+		err := c.connect(ctx)
+		if err == nil {
+			c.connected = true
+			return nil
+		}
+
+		// If connection failed, wait and retry with exponential backoff
+		if root.Verbosity > 0 {
+			fmt.Fprintf(os.Stderr, "Failed to connect to MCP: %v, retrying in %v\n", err, backoff)
+		}
+
+		select {
+		case <-time.After(backoff):
+			// Double the backoff for next attempt, but cap at maxBackoff
+			backoff *= 2
+			if backoff > maxBackoff {
+				backoff = maxBackoff
+			}
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+}
+
+func (c *sseConnection) connect(ctx context.Context) error {
+	setupDaemon(ctx)
+	if c.client == nil {
+		c.client = &http.Client{}
+	}
+
+	// Initialize the request IDs map
+	c.mu.Lock()
+	c.requestIDs = make(map[jsonrpc2.ID]struct{})
+	c.mu.Unlock()
+
+	resp, err := c.client.Get(fmt.Sprintf("http://localhost:%d/sse?app=%s", mcpPort, c.appID))
+	if err != nil {
+		return err
+	}
+	if resp.StatusCode != 200 {
+		resp.Body.Close()
+		return fmt.Errorf("error getting session ID: %v", resp.Status)
+	}
+	c.read = eventReader(startLineReader(ctx, bufio.NewReader(resp.Body).ReadString))
+	c.close = resp.Body.Close
+	c.connected = true
+
+	// Read the endpoint path
+	event, path, err := c.Read()
+	if err != nil {
+		return fmt.Errorf("error reading endpoint path: %v", err)
+	}
+	if event != "endpoint" {
+		return fmt.Errorf("expected endpoint event, got %q", event)
+	}
+	c.path = path
+
+	return nil
+}
+
+func (c *sseConnection) SendMessage(data []byte) error {
+	if !c.connected {
+		return fmt.Errorf("not connected to MCP")
+	}
+
+	if c.client == nil {
+		c.client = &http.Client{}
+	}
+
+	// Track the request ID if it's a Call
+	msg, err := jsonrpc2.DecodeMessage(data)
+	if err == nil {
+		if call, ok := msg.(*jsonrpc2.Call); ok {
+			c.mu.Lock()
+			c.requestIDs[call.ID()] = struct{}{}
+			c.mu.Unlock()
+		}
+	}
+
+	resp, err := c.client.Post(fmt.Sprintf("http://localhost:%d%s", mcpPort, c.path), "application/json", bytes.NewReader(data))
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 202 {
+		return fmt.Errorf("error forwarding request: %v", resp.Status)
+	}
+
+	return nil
+}
+
+// CreateErrorResponse creates a JSON-RPC error response with the correct ID if available
+func (c *sseConnection) CreateErrorResponse(id *jsonrpc2.ID, code int, message string) string {
+	// Build the error response
+	response := map[string]interface{}{
+		"jsonrpc": "2.0",
+		"error": map[string]interface{}{
+			"code":    code,
+			"message": message,
+		},
+	}
+
+	// Include ID if available
+	if id != nil {
+		response["id"] = id
+
+		// Remove from tracking as we're responding to it
+		c.mu.Lock()
+		delete(c.requestIDs, *id)
+		c.mu.Unlock()
+	} else {
+		response["id"] = nil
+	}
+
+	// Marshal to JSON
+	jsonData, err := json.Marshal(response)
+	if err != nil {
+		// Fallback if marshaling fails
+		return fmt.Sprintf(`{"jsonrpc":"2.0","id":null,"error":{"code":%d,"message":"%s"}}`, code, message)
+	}
+
+	return string(jsonData)
+}
+
+// RemoveRequestID removes a request ID from tracking once a response is received
+func (c *sseConnection) RemoveRequestID(id jsonrpc2.ID) {
+	c.mu.Lock()
+	delete(c.requestIDs, id)
+	c.mu.Unlock()
+}
+
+var runCmd = &cobra.Command{
+	Use:   "run",
+	Short: "Runs an stdio-based MCP session",
+	Run: func(cmd *cobra.Command, args []string) {
+
+		ctx := cmd.Context()
+
+		if appID == "" {
+			appID = cmdutil.AppSlugOrLocalID()
+		}
+
+		if root.Verbosity > 0 {
+			_, _ = fmt.Fprintf(os.Stderr, "Starting an MCP session for app %s\n", appID)
+		}
+
+		conn := &sseConnection{appID: appID}
+		if err := conn.connect(ctx); err != nil {
+			fmt.Fprintf(os.Stderr, "Error connecting to MCP: %v\n", err)
+			os.Exit(1)
+		}
+		defer conn.Close()
+
+		go func() {
+			for {
+				event, data, err := conn.Read()
+				if err != nil {
+					fmt.Fprintf(os.Stderr, "Error reading event: %v\n", err)
+
+					conn.mu.Lock()
+					requestIDs := maps.Clone(conn.requestIDs)
+					conn.mu.Unlock()
+					for id := range requestIDs {
+						fmt.Println(conn.CreateErrorResponse(&id, -32700, "error"))
+					}
+					if err := conn.reconnect(ctx); err != nil {
+						fmt.Fprintf(os.Stderr, "Error reconnecting to MCP: %v\n", err)
+						os.Exit(1)
+					}
+					continue
+				}
+				if root.Verbosity > 0 {
+					fmt.Fprintf(os.Stderr, "Received event: %s: %s\n", event, data)
+				}
+				if event == "message" {
+					// If it's a response message, remove the ID from tracking
+					responseMsg := struct {
+						JSONRPC string       `json:"jsonrpc"`
+						ID      *jsonrpc2.ID `json:"id"`
+						Result  interface{}  `json:"result,omitempty"`
+						Error   interface{}  `json:"error,omitempty"`
+					}{}
+
+					if err := json.Unmarshal([]byte(data), &responseMsg); err == nil && responseMsg.ID != nil {
+						conn.RemoveRequestID(*responseMsg.ID)
+					}
+
+					fmt.Println(data)
+				}
+			}
+		}()
+
+		stdinReader := startLineReader(ctx, bufio.NewReader(os.Stdin).ReadBytes)
+		if root.Verbosity > 0 {
+			_, _ = fmt.Fprintf(os.Stderr, "Listening on stdin for MCP requests\n\n")
+		}
+
+		for {
+			line, err := stdinReader()
+			if err != nil {
+				if err == io.EOF || err == context.Canceled {
+					break
+				}
+				fmt.Fprintf(os.Stderr, "Error reading input: %v\n", err)
+				os.Exit(1)
+			}
+			if strings.TrimSpace(string(line)) == "" {
+				continue
+			}
+
+			msg, err := jsonrpc2.DecodeMessage(line)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "Error decoding request: %v\n", err)
+				fmt.Println(conn.CreateErrorResponse(nil, -32700, "parse error"))
+				continue
+			}
+
+			if root.Verbosity > 0 {
+				fmt.Fprintf(os.Stderr, "Sending request: %s\n", line)
+			}
+
+			err = conn.SendMessage(line)
+			if err != nil {
+				fmt.Fprintf(os.Stderr, "Error sending message: %v\n", err)
+
+				// Create error response with the request ID if available
+				var requestID *jsonrpc2.ID
+				if call, ok := msg.(*jsonrpc2.Call); ok {
+					id := call.ID()
+					requestID = &id
+				}
+
+				fmt.Println(conn.CreateErrorResponse(requestID, -32700, "error sending message"))
+				continue
+			}
+		}
+	},
+}
+
+type lineResult[T any] struct {
+	res T
+	err error
+}
+
+func startLineReader[T any](ctx context.Context, rd func(byte) (T, error)) func() (T, error) {
+	channel := make(chan lineResult[T])
+	go func() {
+		for {
+			line, err := rd('\n') // wait for Enter key
+			if err != nil {
+				channel <- lineResult[T]{err: err}
+				return
+			}
+			channel <- lineResult[T]{res: line}
+		}
+	}()
+	return func() (T, error) {
+		var t T
+		select {
+		case <-ctx.Done():
+			return t, ctx.Err()
+		case result := <-channel:
+			if result.err != nil {
+				return t, result.err
+			}
+			return result.res, nil
+		}
+	}
+}
+
+func eventReader(reader func() (string, error)) func() (typ, data string, err error) {
+	return func() (typ, data string, err error) {
+		var line string
+		for {
+			line, err = reader()
+			if err != nil {
+				return "", "", err
+			}
+			if strings.HasPrefix(line, "event:") {
+				break
+			}
+		}
+		typ = strings.TrimSpace(strings.TrimPrefix(line, "event:"))
+		line, err = reader()
+		if err != nil {
+			return "", "", err
+		}
+		if !strings.HasPrefix(line, "data:") {
+			return "", "", fmt.Errorf("expected data: prefix, got %q", line)
+		}
+		data = strings.TrimSpace(strings.TrimPrefix(line, "data:"))
+		return typ, data, nil
+	}
+}
+
+func init() {
+	mcpCmd.AddCommand(runCmd)
+	runCmd.Flags().StringVar(&appID, "app", "", "The app ID to use for the MCP session")
+
+	mcpCmd.AddCommand(startCmd)
+	startCmd.Flags().StringVar(&appID, "app", "", "The app ID to use for the MCP session")
+
+	root.Cmd.AddCommand(mcpCmd)
+}
diff --git a/cli/cmd/encore/namespace/namespace.go b/cli/cmd/encore/namespace/namespace.go
new file mode 100644
index 0000000000..61af5a7f46
--- /dev/null
+++ b/cli/cmd/encore/namespace/namespace.go
@@ -0,0 +1,210 @@
+package namespace
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"slices"
+	"text/tabwriter"
+	"time"
+
+	"github.com/spf13/cobra"
+	"google.golang.org/protobuf/encoding/protojson"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/cmd/encore/root"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+var nsCmd = &cobra.Command{
+	Use:     "namespace",
+	Short:   "Manage infrastructure namespaces",
+	Aliases: []string{"ns"},
+}
+
+func init() {
+	output := cmdutil.Oneof{Value: "columns", Allowed: []string{"columns", "json"}}
+	listCmd := &cobra.Command{
+		Use:     "list",
+		Short:   "List infrastructure namespaces",
+		Aliases: []string{"ls"},
+		Args:    cobra.NoArgs,
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+
+			appRoot, _ := cmdutil.AppRoot()
+			daemon := cmdutil.ConnectDaemon(ctx)
+			resp, err := daemon.ListNamespaces(ctx, &daemonpb.ListNamespacesRequest{AppRoot: appRoot})
+			if err != nil {
+				cmdutil.Fatal(err)
+			}
+			nss := resp.Namespaces
+
+			// Sort by active first, then name second.
+			slices.SortFunc(nss, func(a, b *daemonpb.Namespace) int {
+				if a.Active != b.Active {
+					if a.Active {
+						return -1
+					} else {
+						return 1
+					}
+				}
+				return cmp.Compare(a.Name, b.Name)
+			})
+
+			if output.Value == "json" {
+				var buf bytes.Buffer
+				buf.WriteByte('[')
+				for i, ns := range nss {
+					data, err := protojson.MarshalOptions{
+						UseProtoNames:   true,
+						EmitUnpopulated: true,
+					}.Marshal(ns)
+					if err != nil {
+						cmdutil.Fatal(err)
+					}
+					if i > 0 {
+						buf.WriteByte(',')
+					}
+					buf.Write(data)
+				}
+				buf.WriteByte(']')
+
+				var dst bytes.Buffer
+				if err := json.Indent(&dst, buf.Bytes(), "", "  "); err != nil {
+					cmdutil.Fatal(err)
+				}
+				_, _ = fmt.Fprintln(os.Stdout, dst.String())
+				return
+			}
+
+			w := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', tabwriter.StripEscape)
+
+			_, _ = fmt.Fprint(w, "NAME\tID\tACTIVE\n")
+
+			for _, ns := range nss {
+				active := ""
+				if ns.Active {
+					active = "yes"
+				}
+				_, _ = fmt.Fprintf(w, "%s\t%s\t%s\n", ns.Name, ns.Id, active)
+			}
+			_ = w.Flush()
+		},
+	}
+	output.AddFlag(listCmd)
+
+	nsCmd.AddCommand(listCmd)
+}
+
+var createCmd = &cobra.Command{
+	Use:   "create NAME",
+	Short: "Create a new infrastructure namespace",
+
+	Args: cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+
+		appRoot, _ := cmdutil.AppRoot()
+		daemon := cmdutil.ConnectDaemon(ctx)
+		ns, err := daemon.CreateNamespace(ctx, &daemonpb.CreateNamespaceRequest{
+			AppRoot: appRoot,
+			Name:    args[0],
+		})
+		if err != nil {
+			cmdutil.Fatal(err)
+		}
+		_, _ = fmt.Fprintf(os.Stdout, "created namespace %s\n", ns.Name)
+	},
+}
+
+var deleteCmd = &cobra.Command{
+	Use:     "delete NAME",
+	Short:   "Delete an infrastructure namespace",
+	Aliases: []string{"del"},
+
+	Args:              cobra.ExactArgs(1),
+	ValidArgsFunction: namespaceListCompletion,
+	Run: func(cmd *cobra.Command, args []string) {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+
+		appRoot, _ := cmdutil.AppRoot()
+		daemon := cmdutil.ConnectDaemon(ctx)
+		name := args[0]
+		_, err := daemon.DeleteNamespace(ctx, &daemonpb.DeleteNamespaceRequest{
+			AppRoot: appRoot,
+			Name:    name,
+		})
+		if err != nil {
+			cmdutil.Fatal(err)
+		}
+		_, _ = fmt.Fprintf(os.Stdout, "deleted namespace %s\n", name)
+	},
+}
+
+func init() {
+	var create bool
+	switchCmd := &cobra.Command{
+		Use:   "switch [--create] NAME",
+		Short: "Switch to a different infrastructure namespace",
+		Long: `Switch to a specified infrastructure namespace. Subsequent commands will use the given namespace by default.
+
+If -c is specified, the namespace will first be created before switching to it.
+
+You can use '-' as the namespace name to switch back to the previously active namespace.
+`,
+
+		Args:              cobra.ExactArgs(1),
+		ValidArgsFunction: namespaceListCompletion,
+		Run: func(cmd *cobra.Command, args []string) {
+			ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+			defer cancel()
+
+			appRoot, _ := cmdutil.AppRoot()
+			daemon := cmdutil.ConnectDaemon(ctx)
+			ns, err := daemon.SwitchNamespace(ctx, &daemonpb.SwitchNamespaceRequest{
+				AppRoot: appRoot,
+				Name:    args[0],
+				Create:  create,
+			})
+			if err != nil {
+				cmdutil.Fatal(err)
+			}
+			_, _ = fmt.Fprintf(os.Stdout, "switched to namespace %s\n", ns.Name)
+		},
+	}
+
+	switchCmd.Flags().BoolVarP(&create, "create", "c", false, "create the namespace before switching")
+	nsCmd.AddCommand(switchCmd)
+}
+
+func init() {
+	nsCmd.AddCommand(createCmd)
+	nsCmd.AddCommand(deleteCmd)
+	root.Cmd.AddCommand(nsCmd)
+}
+
+func namespaceListCompletion(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
+	// List namespaces from the daemon for completion.
+	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+	defer cancel()
+
+	appRoot, _ := cmdutil.AppRoot()
+	daemon := cmdutil.ConnectDaemon(ctx)
+	resp, err := daemon.ListNamespaces(ctx, &daemonpb.ListNamespacesRequest{AppRoot: appRoot})
+	if err != nil {
+		return nil, cobra.ShellCompDirectiveError
+	}
+
+	namespaces := make([]string, len(resp.Namespaces))
+	for i, ns := range resp.Namespaces {
+		namespaces[i] = ns.Name
+	}
+	return namespaces, cobra.ShellCompDirectiveNoFileComp
+}
diff --git a/cli/cmd/encore/rand.go b/cli/cmd/encore/rand.go
new file mode 100644
index 0000000000..ce8dd29b93
--- /dev/null
+++ b/cli/cmd/encore/rand.go
@@ -0,0 +1,186 @@
+package main
+
+import (
+	cryptorand "crypto/rand"
+	"encoding/base32"
+	"encoding/base64"
+	"encoding/hex"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+
+	"github.com/gofrs/uuid"
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/pkg/words"
+)
+
+var randCmd = &cobra.Command{
+	Use:   "rand",
+	Short: "Utilities for generating cryptographically secure random data",
+}
+
+func init() {
+	rootCmd.AddCommand(randCmd)
+}
+
+// UUID command
+func init() {
+	var v1, v4, v6, v7 bool
+	uuidCmd := &cobra.Command{
+		Use:   "uuid [-1|-4|-6|-7]",
+		Short: "Generates a random UUID (defaults to version 4)",
+		Args:  cobra.NoArgs,
+		Run: func(cmd *cobra.Command, args []string) {
+			versions := map[bool]func() (uuid.UUID, error){
+				v1: uuid.NewV1,
+				v4: uuid.NewV4,
+				v6: uuid.NewV6,
+				v7: uuid.NewV7,
+			}
+			fn, ok := versions[true]
+			if !ok {
+				fatalf("unsupported UUID version")
+			}
+			u, err := fn()
+			if err != nil {
+				fatalf("failed to generate UUID: %v", err)
+			}
+			_, _ = fmt.Println(u.String())
+		},
+	}
+	uuidCmd.Flags().BoolVarP(&v1, "v1", "1", false, "Generate a version 1 UUID")
+	uuidCmd.Flags().BoolVarP(&v4, "v4", "4", true, "Generate a version 4 UUID")
+	uuidCmd.Flags().BoolVarP(&v6, "v6", "6", false, "Generate a version 6 UUID")
+	uuidCmd.Flags().BoolVarP(&v7, "v7", "7", false, "Generate a version 7 UUID")
+	uuidCmd.MarkFlagsMutuallyExclusive("v1", "v4", "v6", "v7")
+
+	randCmd.AddCommand(uuidCmd)
+}
+
+// Bytes command
+func init() {
+	format := cmdutil.Oneof{
+		Value:     "hex",
+		Allowed:   []string{"hex", "base32", "base32hex", "base32crockford", "base64", "base64url", "raw"},
+		Flag:      "format",
+		FlagShort: "f",
+		Desc:      "Output format",
+	}
+
+	noPadding := false
+	doFormat := func(data []byte) string {
+		switch format.Value {
+		case "hex":
+			return hex.EncodeToString(data)
+		case "base32":
+			enc := base32.StdEncoding
+			if noPadding {
+				enc = enc.WithPadding(base32.NoPadding)
+			}
+			return enc.EncodeToString(data)
+		case "base32hex":
+			enc := base32.HexEncoding
+			if noPadding {
+				enc = enc.WithPadding(base32.NoPadding)
+			}
+			return enc.EncodeToString(data)
+		case "base32crockford":
+			enc := base32.NewEncoding("0123456789ABCDEFGHJKMNPQRSTVWXYZ")
+			if noPadding {
+				enc = enc.WithPadding(base32.NoPadding)
+			}
+			return enc.EncodeToString(data)
+		case "base64":
+			enc := base64.StdEncoding
+			if noPadding {
+				enc = enc.WithPadding(base64.NoPadding)
+			}
+			return enc.EncodeToString(data)
+		case "base64url":
+			enc := base64.URLEncoding
+			if noPadding {
+				enc = enc.WithPadding(base64.NoPadding)
+			}
+			return enc.EncodeToString(data)
+		default:
+			fatalf("unsupported output format: %s", format.Value)
+			panic("unreachable")
+		}
+	}
+
+	bytesCmd := &cobra.Command{
+		Use:   "bytes BYTES [-f " + format.Alternatives() + "]",
+		Short: "Generates random bytes and outputs them in the specified format",
+		Args:  cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			num, err := strconv.ParseInt(args[0], 10, 64)
+			if err != nil {
+				fatalf("invalid number of bytes: %v", err)
+			} else if num < 1 {
+				fatalf("number of bytes must be positive")
+			} else if num > 1024*1024 {
+				fatalf("too many bytes requested")
+			}
+
+			data := make([]byte, num)
+			_, err = cryptorand.Read(data)
+			if err != nil {
+				fatalf("failed to generate random bytes: %v", err)
+			}
+
+			if format.Value == "raw" {
+				_, err = os.Stdout.Write(data)
+				if err != nil {
+					fatalf("failed to write: %v", err)
+				}
+			} else {
+				formatted := doFormat(data)
+				if _, err := os.Stdout.WriteString(formatted); err != nil {
+					fatalf("failed to write: %v", err)
+				}
+				_, _ = os.Stdout.Write([]byte{'\n'})
+			}
+		},
+	}
+
+	format.AddFlag(bytesCmd)
+	bytesCmd.Flags().BoolVar(&noPadding, "no-padding", false, "omit padding characters from base32/base64 output")
+	randCmd.AddCommand(bytesCmd)
+}
+
+// Words command
+func init() {
+	var sep string
+	wordsCmd := &cobra.Command{
+		Use:   "words [--sep=SEPARATOR] NUM",
+		Short: "Generates random 4-5 letter words for memorable passphrases",
+		Args:  cobra.ExactArgs(1),
+		Run: func(cmd *cobra.Command, args []string) {
+			num, err := strconv.ParseInt(args[0], 10, 64)
+			if err != nil {
+				fatalf("invalid number of words: %v", err)
+			} else if num < 1 {
+				fatalf("number of words must be positive")
+			} else if num > 1024 {
+				fatalf("too many words requested")
+			}
+
+			selected, err := words.Select(int(num))
+			if err != nil {
+				fatalf("failed to select words: %v", err)
+			}
+
+			formatted := strings.Join(selected, sep)
+			if _, err := os.Stdout.WriteString(formatted); err != nil {
+				fatalf("failed to write: %v", err)
+			}
+			_, _ = os.Stdout.Write([]byte{'\n'})
+		},
+	}
+
+	wordsCmd.Flags().StringVarP(&sep, "sep", "s", " ", "separator between words")
+	randCmd.AddCommand(wordsCmd)
+}
diff --git a/cli/cmd/encore/root/rootcmd.go b/cli/cmd/encore/root/rootcmd.go
new file mode 100644
index 0000000000..fc1fd99af7
--- /dev/null
+++ b/cli/cmd/encore/root/rootcmd.go
@@ -0,0 +1,60 @@
+package root
+
+import (
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"github.com/spf13/cobra"
+
+	"encr.dev/pkg/errlist"
+)
+
+var (
+	Verbosity int
+	traceFile string
+
+	// TraceFile is the file to write trace logs to.
+	// If nil (the default), trace logs are not written.
+	TraceFile *string
+)
+
+var preRuns []func(cmd *cobra.Command, args []string)
+
+// AddPreRun adds a function to be executed before the command runs.
+func AddPreRun(f func(cmd *cobra.Command, args []string)) {
+	preRuns = append(preRuns, f)
+}
+
+var Cmd = &cobra.Command{
+	Use:           "encore",
+	Short:         "encore is the fastest way of developing backend applications",
+	SilenceErrors: true, // We'll handle displaying an error in our main func
+	CompletionOptions: cobra.CompletionOptions{
+		HiddenDefaultCmd: true, // Hide the "completion" command from help (used for generating auto-completions for the shell)
+	},
+	PersistentPreRun: func(cmd *cobra.Command, args []string) {
+		if traceFile != "" {
+			TraceFile = &traceFile
+		}
+
+		level := zerolog.InfoLevel
+		if Verbosity == 1 {
+			level = zerolog.DebugLevel
+		} else if Verbosity >= 2 {
+			level = zerolog.TraceLevel
+		}
+
+		if Verbosity >= 1 {
+			errlist.Verbose = true
+		}
+		log.Logger = log.Logger.Level(level)
+
+		for _, f := range preRuns {
+			f(cmd, args)
+		}
+	},
+}
+
+func init() {
+	Cmd.PersistentFlags().CountVarP(&Verbosity, "verbose", "v", "verbose output")
+	Cmd.PersistentFlags().StringVar(&traceFile, "trace", "", "file to write execution trace data to")
+}
diff --git a/cli/cmd/encore/run.go b/cli/cmd/encore/run.go
index 8c808fcb91..57656a21e6 100644
--- a/cli/cmd/encore/run.go
+++ b/cli/cmd/encore/run.go
@@ -3,88 +3,150 @@ package main
 import (
 	"context"
 	"fmt"
-	"io"
+	"net"
 	"os"
 	"os/signal"
+	"strconv"
 
-	daemonpb "encr.dev/proto/encore/daemon"
+	"github.com/logrusorgru/aurora/v3"
 	"github.com/spf13/cobra"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
+	"golang.org/x/term"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/cmd/encore/root"
+	"encr.dev/cli/internal/onboarding"
+	daemonpb "encr.dev/proto/encore/daemon"
 )
 
 var (
-	tunnel bool
-	debug  bool
-	watch  bool
+	color   bool
+	noColor bool // for "--no-color" compatibility
+	debug   = cmdutil.Oneof{
+		Value:       "",
+		NoOptDefVal: "enabled",
+		Allowed:     []string{"enabled", "break"},
+		Flag:        "debug",
+		FlagShort:   "", // no short flag
+		Desc:        "Compile for debugging (disables some optimizations)",
+		TypeDesc:    "string",
+	}
+	watch    bool
+	listen   string
+	port     uint
+	jsonLogs bool
+	browser  = cmdutil.Oneof{
+		Value:     "auto",
+		Allowed:   []string{"auto", "never", "always"},
+		Flag:      "browser",
+		FlagShort: "", // no short flag
+		Desc:      "Whether to open the local development dashboard in the browser on startup",
+		TypeDesc:  "string",
+	}
 )
 
-var runCmd = &cobra.Command{
-	Use:   "run",
-	Short: "Runs your application",
-	Run: func(cmd *cobra.Command, args []string) {
-		appRoot, wd := determineAppRoot()
-		runApp(appRoot, wd, tunnel, watch)
-	},
+func init() {
+	runCmd := &cobra.Command{
+		Use:   "run [--debug] [--watch=true] [--port=4000] [--listen=<listen-addr>]",
+		Short: "Runs your application",
+		Args:  cobra.NoArgs,
+		Run: func(cmd *cobra.Command, args []string) {
+			appRoot, wd := determineAppRoot()
+			// If the user didn't explicitly set --watch and we're in debug mode, disable watching
+			// as we typically don't want to swap the process when the user is debugging.
+			if !cmd.Flag("watch").Changed && debug.Value != "" {
+				watch = false
+			}
+			runApp(appRoot, wd)
+		},
+	}
+
+	isTerm := term.IsTerminal(int(os.Stdout.Fd()))
+
+	rootCmd.AddCommand(runCmd)
+	runCmd.Flags().BoolVarP(&watch, "watch", "w", true, "Watch for changes and live-reload")
+	runCmd.Flags().StringVar(&listen, "listen", "", "Address to listen on (for example \"0.0.0.0:4000\")")
+	runCmd.Flags().UintVarP(&port, "port", "p", 4000, "Port to listen on")
+	runCmd.Flags().BoolVar(&jsonLogs, "json", false, "Display logs in JSON format")
+	runCmd.Flags().StringVarP(&nsName, "namespace", "n", "", "Namespace to use (defaults to active namespace)")
+	runCmd.Flags().BoolVar(&color, "color", isTerm, "Whether to display colorized output")
+	runCmd.Flags().BoolVar(&noColor, "no-color", false, "Equivalent to --color=false")
+	runCmd.Flags().MarkHidden("no-color")
+	debug.AddFlag(runCmd)
+	browser.AddFlag(runCmd)
 }
 
 // runApp runs the app.
-func runApp(appRoot, wd string, tunnel, watch bool) {
-	interrupt := make(chan os.Signal, 1)
-	signal.Notify(interrupt, os.Interrupt)
+func runApp(appRoot, wd string) {
+	ctx, cancel := signal.NotifyContext(context.Background(), os.Interrupt)
+	defer cancel()
+
+	// Determine listen addr.
+	var listenAddr string
 
-	ctx, cancel := context.WithCancel(context.Background())
-	go func() {
-		<-interrupt
-		cancel()
-	}()
+	if listen == "" {
+		// If we have no listen address at all, listen on localhost.
+		// (we do this so MacOS's firewall doesn't ask for permission for the daemon to listen on all interfaces)
+		listenAddr = fmt.Sprintf("127.0.0.1:%d", port)
+	} else if _, _, err := net.SplitHostPort(listen); err == nil {
+		// If --listen is given with a port, use that directly and ignore --port.
+		listenAddr = listen
+	} else {
+		// Otherwise use --listen as the host and --port as the port.
+		listenAddr = net.JoinHostPort(listen, strconv.Itoa(int(port)))
+	}
+
+	browserMode := daemonpb.RunRequest_BROWSER_AUTO
+	switch browser.Value {
+	case "auto":
+		browserMode = daemonpb.RunRequest_BROWSER_AUTO
+	case "never":
+		browserMode = daemonpb.RunRequest_BROWSER_NEVER
+	case "always":
+		browserMode = daemonpb.RunRequest_BROWSER_ALWAYS
+	}
+
+	debugMode := daemonpb.RunRequest_DEBUG_DISABLED
+	switch debug.Value {
+	case "enabled":
+		debugMode = daemonpb.RunRequest_DEBUG_ENABLED
+	case "break":
+		debugMode = daemonpb.RunRequest_DEBUG_BREAK
+	}
 
 	daemon := setupDaemon(ctx)
 	stream, err := daemon.Run(ctx, &daemonpb.RunRequest{
 		AppRoot:    appRoot,
-		Tunnel:     tunnel,
-		Debug:      debug,
+		DebugMode:  debugMode,
 		Watch:      watch,
 		WorkingDir: wd,
+		ListenAddr: listenAddr,
+		Environ:    os.Environ(),
+		TraceFile:  root.TraceFile,
+		Namespace:  nonZeroPtr(nsName),
+		Browser:    browserMode,
 	})
 	if err != nil {
 		fatal(err)
 	}
 
-	for {
-		msg, err := stream.Recv()
-		if err == io.EOF || status.Code(err) == codes.Canceled {
-			return
-		} else if err != nil {
-			fatal(err)
-		}
-		switch resp := msg.Msg.(type) {
-		case *daemonpb.RunMessage_Started:
-			fmt.Fprintf(os.Stderr, "Running on http://localhost:%d\n", resp.Started.Port)
-			if debug && resp.Started.Pid > 0 {
-				fmt.Fprintf(os.Stderr, "Process ID (for debugging): %d\n", resp.Started.Pid)
-			}
-			if url := resp.Started.TunnelUrl; url != "" {
-				fmt.Fprintf(os.Stderr, "Tunnel active on %s\n", url)
-			}
+	cmdutil.ClearTerminalExceptFirstNLines(1)
 
-		case *daemonpb.RunMessage_Output:
-			if out := resp.Output.Stdout; len(out) > 0 {
-				os.Stdout.Write(out)
-			}
-			if out := resp.Output.Stderr; len(out) > 0 {
-				os.Stderr.Write(out)
+	var converter cmdutil.OutputConverter
+	if !jsonLogs {
+		converter = cmdutil.ConvertJSONLogs(cmdutil.Colorize(color && !noColor))
+	}
+	code := cmdutil.StreamCommandOutput(stream, converter)
+	if code == 0 {
+		if state, err := onboarding.Load(); err == nil {
+			if state.DeployHint.Set() {
+				if err := state.Write(); err == nil {
+					_, _ = fmt.Println(aurora.Sprintf("\nHint: deploy your app to the cloud by running: %s", aurora.Cyan("git push encore")))
+				}
 			}
-
-		case *daemonpb.RunMessage_Exit:
-			os.Exit(int(resp.Exit.Code))
 		}
 	}
+	os.Exit(code)
 }
 
 func init() {
-	rootCmd.AddCommand(runCmd)
-	runCmd.Flags().BoolVar(&tunnel, "tunnel", false, "Create a tunnel to your machine for others to test against")
-	runCmd.Flags().BoolVar(&debug, "debug", false, "Compile for debugging (disables some optimizations)")
-	runCmd.Flags().BoolVarP(&watch, "watch", "w", true, "Watch for changes and live-reload")
 }
diff --git a/cli/cmd/encore/secret.go b/cli/cmd/encore/secret.go
deleted file mode 100644
index 8f4fdfe095..0000000000
--- a/cli/cmd/encore/secret.go
+++ /dev/null
@@ -1,107 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"context"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"syscall"
-	"time"
-
-	daemonpb "encr.dev/proto/encore/daemon"
-	"github.com/spf13/cobra"
-	"golang.org/x/crypto/ssh/terminal"
-)
-
-var secretCmd = &cobra.Command{
-	Use:   "secret",
-	Short: "Secret management commands",
-}
-
-var (
-	secretDevFlag  bool
-	secretProdFlag bool
-)
-
-var setSecretCmd = &cobra.Command{
-	Use:   "set --dev|prod <key>",
-	Short: "Sets a secret value",
-	Example: `
-Entering a secret directly in terminal:
-
-	$ encore secret set --dev MySecret
-	Enter secret value: ...
-	Successfully created development secret MySecret.
-
-Piping a secret from a file:
-
-	$ encore secret set --dev MySecret < my-secret.txt
-	Successfully created development secret MySecret.
-
-Note that this strips trailing newlines from the secret value.
-	`,
-	Args: cobra.ExactArgs(1),
-	Run: func(cmd *cobra.Command, args []string) {
-		if !secretDevFlag && !secretProdFlag {
-			fatal("must specify either --dev or --prod.")
-		} else if secretDevFlag && secretProdFlag {
-			fatal("cannot specify both --dev and --prod.")
-		}
-
-		appRoot, _ := determineAppRoot()
-
-		key := args[0]
-		var value string
-		fd := syscall.Stdin
-		if terminal.IsTerminal(int(fd)) {
-			fmt.Fprint(os.Stderr, "Enter secret value: ")
-			data, err := terminal.ReadPassword(int(fd))
-			if err != nil {
-				fatal(err)
-			}
-			value = string(data)
-			fmt.Fprintln(os.Stderr)
-		} else {
-			data, err := ioutil.ReadAll(os.Stdin)
-			if err != nil {
-				fatal(err)
-			}
-			value = string(bytes.TrimRight(data, "\r\n"))
-		}
-
-		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-		defer cancel()
-
-		daemon := setupDaemon(ctx)
-		typName := "development"
-		typ := daemonpb.SetSecretRequest_DEVELOPMENT
-		if secretProdFlag {
-			typName = "production"
-			typ = daemonpb.SetSecretRequest_PRODUCTION
-		}
-
-		resp, err := daemon.SetSecret(ctx, &daemonpb.SetSecretRequest{
-			AppRoot: appRoot,
-			Key:     key,
-			Value:   value,
-			Type:    typ,
-		})
-		if err != nil {
-			fmt.Fprintln(os.Stderr, err)
-			os.Exit(1)
-		}
-		if resp.Created {
-			fmt.Fprintf(os.Stderr, "Successfully created %s secret %s!\n", typName, key)
-		} else {
-			fmt.Fprintf(os.Stderr, "Successfully updated %s secret %s.\n", typName, key)
-		}
-	},
-}
-
-func init() {
-	rootCmd.AddCommand(secretCmd)
-	secretCmd.AddCommand(setSecretCmd)
-	setSecretCmd.Flags().BoolVarP(&secretDevFlag, "dev", "d", false, "To set the secret for development use")
-	setSecretCmd.Flags().BoolVarP(&secretProdFlag, "prod", "p", false, "To set the secret for production use")
-}
diff --git a/cli/cmd/encore/secrets/archive.go b/cli/cmd/encore/secrets/archive.go
new file mode 100644
index 0000000000..13ceb5730b
--- /dev/null
+++ b/cli/cmd/encore/secrets/archive.go
@@ -0,0 +1,60 @@
+package secrets
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/internal/platform"
+)
+
+var archiveSecretCmd = &cobra.Command{
+	Use:                   "archive <id>",
+	Short:                 "Archives a secret value",
+	DisableFlagsInUseLine: true,
+	Args:                  cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		doArchiveOrUnarchive(args[0], true)
+	},
+}
+
+var unarchiveSecretCmd = &cobra.Command{
+	Use:                   "unarchive <id>",
+	Short:                 "Unarchives a secret value",
+	DisableFlagsInUseLine: true,
+	Args:                  cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		doArchiveOrUnarchive(args[0], false)
+	},
+}
+
+func doArchiveOrUnarchive(groupID string, archive bool) {
+	if !strings.HasPrefix(groupID, "secgrp") {
+		cmdutil.Fatal("the id must begin with 'secgrp_'. Valid ids can be found with 'encore secret list <key>'.")
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	err := platform.UpdateSecretGroup(ctx, platform.UpdateSecretGroupParams{
+		ID:       groupID,
+		Archived: &archive,
+	})
+	if err != nil {
+		cmdutil.Fatal(err)
+	}
+	if archive {
+		fmt.Printf("Successfully archived secret group %s.\n", groupID)
+	} else {
+		fmt.Printf("Successfully unarchived secret group %s.\n", groupID)
+	}
+}
+
+func init() {
+	secretCmd.AddCommand(archiveSecretCmd)
+	secretCmd.AddCommand(unarchiveSecretCmd)
+}
diff --git a/cli/cmd/encore/secrets/check.go b/cli/cmd/encore/secrets/check.go
new file mode 100644
index 0000000000..77e395b442
--- /dev/null
+++ b/cli/cmd/encore/secrets/check.go
@@ -0,0 +1,221 @@
+package secrets
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"os"
+	"slices"
+	"strings"
+	"text/tabwriter"
+	"time"
+
+	"github.com/fatih/color"
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/cli/internal/platform/gql"
+)
+
+var checkSecretCmd = &cobra.Command{
+	Use:   "check [envs...]",
+	Short: "Check if secrets are properly set across environments",
+	Long: `Check if secrets are properly set across specified environments.
+This command validates that all secrets required by your application
+are configured in the specified environments.
+
+Example usage:
+  encore secret check prod dev
+  encore secret check production development`,
+	DisableFlagsInUseLine: true,
+	Run: func(cmd *cobra.Command, args []string) {
+		if len(args) == 0 {
+			cmdutil.Fatal("at least one environment must be specified")
+		}
+
+		appSlug := cmdutil.AppSlug()
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+
+		// Get all secrets for the app
+		secrets, err := platform.ListSecretGroups(ctx, appSlug, nil)
+		if err != nil {
+			cmdutil.Fatal(err)
+		}
+
+		// Normalize environment names
+		envNames := normalizeEnvNames(args)
+		
+		// Check secrets across environments
+		result := CheckSecretsAcrossEnvs(secrets, envNames)
+		
+		// Display results
+		DisplayCheckResults(result, envNames)
+		
+		// Exit with error if any secrets are missing
+		if result.HasMissing {
+			os.Exit(1)
+		}
+	},
+}
+
+type CheckResult struct {
+	SecretResults []SecretCheckResult
+	HasMissing    bool
+}
+
+type SecretCheckResult struct {
+	Key     string
+	EnvStatus map[string]bool // env name -> has secret
+}
+
+func normalizeEnvNames(args []string) []string {
+	var normalized []string
+	for _, arg := range args {
+		switch strings.ToLower(arg) {
+		case "prod", "production":
+			normalized = append(normalized, "production")
+		case "dev", "development":
+			normalized = append(normalized, "development")
+		case "local":
+			normalized = append(normalized, "local")
+		case "preview":
+			normalized = append(normalized, "preview")
+		default:
+			// Assume it's a specific environment name
+			normalized = append(normalized, arg)
+		}
+	}
+	return normalized
+}
+
+func CheckSecretsAcrossEnvs(secrets []*gql.Secret, envNames []string) CheckResult {
+	var result CheckResult
+	
+	for _, secret := range secrets {
+		secretResult := SecretCheckResult{
+			Key:       secret.Key,
+			EnvStatus: make(map[string]bool),
+		}
+		
+		// Initialize all environments as missing
+		for _, envName := range envNames {
+			secretResult.EnvStatus[envName] = false
+		}
+		
+		// Check which environments have this secret
+		for _, group := range secret.Groups {
+			if group.ArchivedAt != nil {
+				continue // Skip archived secrets
+			}
+			
+			for _, selector := range group.Selector {
+				switch sel := selector.(type) {
+				case *gql.SecretSelectorEnvType:
+					if contains(envNames, sel.Kind) {
+						secretResult.EnvStatus[sel.Kind] = true
+					}
+				case *gql.SecretSelectorSpecificEnv:
+					if contains(envNames, sel.Env.Name) {
+						secretResult.EnvStatus[sel.Env.Name] = true
+					}
+				}
+			}
+		}
+		
+		// Check if any environment is missing this secret
+		for _, hasSecret := range secretResult.EnvStatus {
+			if !hasSecret {
+				result.HasMissing = true
+				break
+			}
+		}
+		
+		result.SecretResults = append(result.SecretResults, secretResult)
+	}
+	
+	return result
+}
+
+func DisplayCheckResults(result CheckResult, envNames []string) {
+	if len(result.SecretResults) == 0 {
+		fmt.Println("No secrets found.")
+		return
+	}
+
+	var buf bytes.Buffer
+	w := tabwriter.NewWriter(&buf, 0, 0, 3, ' ', tabwriter.StripEscape)
+
+	// Header
+	header := "Secret Key"
+	for _, envName := range envNames {
+		header += fmt.Sprintf("\t%s", strings.Title(envName))
+	}
+	header += "\t\n"
+	fmt.Fprint(w, header)
+
+	const (
+		checkYes = "\u2713"
+		checkNo  = "\u2717"
+	)
+
+	missingCount := 0
+	
+	// Sort secrets by key for consistent output
+	slices.SortFunc(result.SecretResults, func(a, b SecretCheckResult) int {
+		return strings.Compare(a.Key, b.Key)
+	})
+
+	for _, secretResult := range result.SecretResults {
+		line := secretResult.Key
+		secretHasMissing := false
+		
+		for _, envName := range envNames {
+			hasSecret := secretResult.EnvStatus[envName]
+			if hasSecret {
+				line += fmt.Sprintf("\t%s", checkYes)
+			} else {
+				line += fmt.Sprintf("\t%s", checkNo)
+				secretHasMissing = true
+			}
+		}
+		line += "\t\n"
+		
+		if secretHasMissing {
+			missingCount++
+		}
+		
+		fmt.Fprint(w, line)
+	}
+
+	w.Flush()
+
+	// Add color to the checkmarks
+	r := strings.NewReplacer(checkYes, color.GreenString(checkYes), checkNo, color.RedString(checkNo))
+	r.WriteString(os.Stdout, buf.String())
+
+	// Print summary
+	if result.HasMissing {
+		if missingCount == 1 {
+			fmt.Printf("\nError: There is 1 secret missing.\n")
+		} else {
+			fmt.Printf("\nError: There are %d secrets missing.\n", missingCount)
+		}
+	} else {
+		fmt.Printf("\nAll secrets are properly configured across specified environments.\n")
+	}
+}
+
+func contains(slice []string, item string) bool {
+	for _, s := range slice {
+		if s == item {
+			return true
+		}
+	}
+	return false
+}
+
+func init() {
+	secretCmd.AddCommand(checkSecretCmd)
+}
\ No newline at end of file
diff --git a/cli/cmd/encore/secrets/list.go b/cli/cmd/encore/secrets/list.go
new file mode 100644
index 0000000000..d481b95ec0
--- /dev/null
+++ b/cli/cmd/encore/secrets/list.go
@@ -0,0 +1,169 @@
+package secrets
+
+import (
+	"bytes"
+	"cmp"
+	"context"
+	"fmt"
+	"os"
+	"slices"
+	"strings"
+	"text/tabwriter"
+	"time"
+
+	"github.com/fatih/color"
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/cli/internal/platform/gql"
+)
+
+var listSecretCmd = &cobra.Command{
+	Use:                   "list [keys...]",
+	Short:                 "Lists secrets, optionally for a specific key",
+	DisableFlagsInUseLine: true,
+	Run: func(cmd *cobra.Command, args []string) {
+		appSlug := cmdutil.AppSlug()
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+
+		var keys []string
+		if len(args) > 0 {
+			keys = args
+		}
+		secrets, err := platform.ListSecretGroups(ctx, appSlug, keys)
+		if err != nil {
+			cmdutil.Fatal(err)
+		}
+
+		if keys == nil {
+			// Print secrets overview
+			var buf bytes.Buffer
+			w := tabwriter.NewWriter(&buf, 0, 0, 3, ' ', tabwriter.StripEscape)
+
+			_, _ = fmt.Fprint(w, "Secret Key\tProduction\tDevelopment\tLocal\tPreview\tSpecific Envs\t\n")
+			const (
+				checkYes = "\u2713"
+				checkNo  = "\u2717"
+			)
+			for _, s := range secrets {
+				render := func(b bool) string {
+					if b {
+						return checkYes
+					} else {
+						return checkNo
+					}
+				}
+				d := getSecretEnvDesc(s.Groups)
+				if !d.hasAny {
+					continue
+				}
+				_, _ = fmt.Fprintf(w, "%s\t%v\t%v\t%v\t%v\t", s.Key,
+					render(d.prod), render(d.dev), render(d.local), render(d.preview))
+				// Render specific envs, if any
+				for i, env := range d.specific {
+					if i > 0 {
+						_, _ = fmt.Fprintf(w, ",")
+					}
+					_, _ = fmt.Fprintf(w, "%s", env.Name)
+				}
+
+				_, _ = fmt.Fprint(w, "\t\n")
+			}
+			_ = w.Flush()
+
+			// Add color to the checkmarks now that the table is correctly laid out.
+			// We can't do it before since the tabwriter will get the alignment wrong
+			// if we include a bunch of ANSI escape codes that it doesn't understand.
+			r := strings.NewReplacer(checkYes, color.GreenString(checkYes), checkNo, color.RedString(checkNo))
+			_, _ = r.WriteString(os.Stdout, buf.String())
+		} else {
+			// Specific secrets
+			w := tabwriter.NewWriter(os.Stdout, 0, 0, 3, ' ', 0)
+			_, _ = fmt.Fprint(w, "ID\tSecret Key\tEnvironment(s)\t\n")
+
+			slices.SortFunc(secrets, func(a, b *gql.Secret) int {
+				return cmp.Compare(a.Key, b.Key)
+			})
+			for _, s := range secrets {
+				// Sort the archived groups to the end
+				slices.SortFunc(s.Groups, func(a, b *gql.SecretGroup) int {
+					aa, ab := a.ArchivedAt != nil, b.ArchivedAt != nil
+					if aa != ab {
+						if aa {
+							return 1
+						} else {
+							return -1
+						}
+					} else if aa {
+						return a.ArchivedAt.Compare(*b.ArchivedAt)
+					} else {
+						return cmp.Compare(a.ID, b.ID)
+					}
+				})
+
+				for _, g := range s.Groups {
+					var sel []string
+					for _, s := range g.Selector {
+						switch s := s.(type) {
+						case *gql.SecretSelectorSpecificEnv:
+							// If we have a specific environment, render the name
+							// instead of the id (which is the default when using s.String()).
+							sel = append(sel, "env:"+s.Env.Name)
+						default:
+							sel = append(sel, s.String())
+						}
+					}
+
+					s := fmt.Sprintf("%s\t%s\t%s\t", g.ID, s.Key, strings.Join(sel, ", "))
+					if g.ArchivedAt != nil {
+						s += "(archived)\t"
+						_, _ = color.New(color.Concealed).Fprintln(w, s)
+					} else {
+						_, _ = fmt.Fprintln(w, s)
+					}
+				}
+			}
+			_ = w.Flush()
+		}
+	},
+}
+
+func init() {
+	secretCmd.AddCommand(listSecretCmd)
+}
+
+type secretEnvDesc struct {
+	hasAny                    bool // if there are any non-archived groups at all
+	prod, dev, local, preview bool
+	specific                  []*gql.Env
+}
+
+func getSecretEnvDesc(groups []*gql.SecretGroup) secretEnvDesc {
+	var desc secretEnvDesc
+	for _, g := range groups {
+		if g.ArchivedAt != nil {
+			continue
+		}
+		desc.hasAny = true
+		for _, sel := range g.Selector {
+			switch sel := sel.(type) {
+			case *gql.SecretSelectorEnvType:
+				switch sel.Kind {
+				case "production":
+					desc.prod = true
+				case "development":
+					desc.dev = true
+				case "local":
+					desc.local = true
+				case "preview":
+					desc.preview = true
+				}
+			case *gql.SecretSelectorSpecificEnv:
+				desc.specific = append(desc.specific, sel.Env)
+			}
+		}
+	}
+	return desc
+}
diff --git a/cli/cmd/encore/secrets/secrets.go b/cli/cmd/encore/secrets/secrets.go
new file mode 100644
index 0000000000..6a057bb61e
--- /dev/null
+++ b/cli/cmd/encore/secrets/secrets.go
@@ -0,0 +1,17 @@
+package secrets
+
+import (
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/root"
+)
+
+var secretCmd = &cobra.Command{
+	Use:     "secret",
+	Short:   "Secret management commands",
+	Aliases: []string{"secrets"},
+}
+
+func init() {
+	root.Cmd.AddCommand(secretCmd)
+}
diff --git a/cli/cmd/encore/secrets/set.go b/cli/cmd/encore/secrets/set.go
new file mode 100644
index 0000000000..d07fd3369d
--- /dev/null
+++ b/cli/cmd/encore/secrets/set.go
@@ -0,0 +1,272 @@
+package secrets
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"slices"
+	"sort"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/spf13/cobra"
+	"golang.org/x/crypto/ssh/terminal"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/cli/internal/platform/gql"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+var setSecretCmd = &cobra.Command{
+	Use:   "set --type <types> <secret-name>",
+	Short: "Sets a secret value",
+	Long: `
+Sets a secret value for one or more environment types.
+
+The valid environment types are 'prod', 'dev', 'pr' and 'local'.
+`,
+
+	Example: `
+Entering a secret directly in terminal:
+
+	$ encore secret set --type dev,local MySecret
+	Enter secret value: ...
+	Successfully created secret value for MySecret.
+
+Piping a secret from a file:
+
+	$ encore secret set --type dev,local,pr MySecret < my-secret.txt
+	Successfully created secret value for MySecret.
+
+Note that this strips trailing newlines from the secret value.`,
+	Args:                  cobra.ExactArgs(1),
+	DisableFlagsInUseLine: true,
+	Run: func(cmd *cobra.Command, args []string) {
+		setSecret(args[0])
+	},
+}
+
+var secretEnvs secretEnvSelector
+
+type secretEnvSelector struct {
+	devFlag  bool
+	prodFlag bool
+	envTypes []string
+	envNames []string
+}
+
+func init() {
+	secretCmd.AddCommand(setSecretCmd)
+	setSecretCmd.Flags().BoolVarP(&secretEnvs.devFlag, "dev", "d", false, "To set the secret for development use")
+	setSecretCmd.Flags().BoolVarP(&secretEnvs.prodFlag, "prod", "p", false, "To set the secret for production use")
+	setSecretCmd.Flags().StringSliceVarP(&secretEnvs.envTypes, "type", "t", nil, "environment type(s) to set for (comma-separated list)")
+	setSecretCmd.Flags().StringSliceVarP(&secretEnvs.envNames, "env", "e", nil, "environment name(s) to set for (comma-separated list)")
+	_ = setSecretCmd.Flags().MarkHidden("dev")
+	_ = setSecretCmd.Flags().MarkHidden("prod")
+}
+
+func setSecret(key string) {
+	plaintextValue := readSecretValue()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+
+	appRoot, _ := cmdutil.AppRoot()
+	appSlug := cmdutil.AppSlug()
+	sel := secretEnvs.ParseSelector(ctx, appSlug)
+
+	app, err := platform.GetApp(ctx, appSlug)
+	if err != nil {
+		cmdutil.Fatalf("unable to lookup app %s: %v", appSlug, err)
+	}
+
+	// Does a matching secret group already exist?
+	secrets, err := platform.ListSecretGroups(ctx, app.Slug, []string{key})
+	if err != nil {
+		cmdutil.Fatalf("unable to list secrets: %v", err)
+	}
+
+	if matching := findMatchingSecretGroup(secrets, key, sel); matching != nil {
+		// We found a matching secret group. Update it.
+		err := platform.CreateSecretVersion(ctx, platform.CreateSecretVersionParams{
+			GroupID:        matching.ID,
+			PlaintextValue: plaintextValue,
+			Etag:           matching.Etag,
+		})
+		if err != nil {
+			cmdutil.Fatalf("unable to update secret: %v", err)
+		}
+		fmt.Printf("Successfully updated secret value for %s.\n", key)
+		return
+	}
+
+	// Otherwise create a new secret group.
+	err = platform.CreateSecretGroup(ctx, platform.CreateSecretGroupParams{
+		AppID:          app.ID,
+		Key:            key,
+		PlaintextValue: plaintextValue,
+		Selector:       sel,
+		Description:    "", // not yet supported from CLI
+	})
+	if err != nil {
+		if ce, ok := getConflictError(err); ok {
+			var errMsg strings.Builder
+			fmt.Fprintln(&errMsg, "the environment selection conflicts with other secret values:")
+			for _, c := range ce.Conflicts {
+				fmt.Fprintf(&errMsg, "\t%s %s\n", c.GroupID, strings.Join(c.Conflicts, ", "))
+			}
+			cmdutil.Fatal(errMsg.String())
+		}
+		cmdutil.Fatalf("unable to create secret: %v", err)
+	}
+
+	daemon := cmdutil.ConnectDaemon(ctx)
+	if _, err := daemon.SecretsRefresh(ctx, &daemonpb.SecretsRefreshRequest{AppRoot: appRoot}); err != nil {
+		fmt.Fprintln(os.Stderr, "warning: failed to refresh secret secret, skipping:", err)
+	}
+
+	fmt.Printf("Successfully created secret value for %s.\n", key)
+}
+
+func (s secretEnvSelector) ParseSelector(ctx context.Context, appSlug string) []gql.SecretSelector {
+	if s.devFlag && s.prodFlag {
+		cmdutil.Fatal("cannot specify both --dev and --prod")
+	} else if s.devFlag && (len(s.envTypes) > 0 || len(s.envNames) > 0) {
+		cmdutil.Fatal("cannot combine --dev with --type/--env")
+	} else if s.prodFlag && (len(s.envTypes) > 0 || len(s.envNames) > 0) {
+		cmdutil.Fatal("cannot combine --prod with --type/--env")
+	}
+
+	// Look up the environments
+	envMap := make(map[string]string) // name -> id
+	envs, err := platform.ListEnvs(ctx, appSlug)
+	if err != nil {
+		cmdutil.Fatalf("unable to list environments: %v", err)
+	}
+	for _, env := range envs {
+		envMap[env.Slug] = env.ID
+	}
+
+	var sel []gql.SecretSelector
+	if s.devFlag {
+		sel = append(sel,
+			&gql.SecretSelectorEnvType{Kind: "development"},
+			&gql.SecretSelectorEnvType{Kind: "preview"},
+			&gql.SecretSelectorEnvType{Kind: "local"},
+		)
+	} else if s.prodFlag {
+		sel = append(sel, &gql.SecretSelectorEnvType{Kind: "production"})
+	} else {
+		// Parse env types and env names
+		seenTypes := make(map[string]bool)
+		validTypes := map[string]string{
+			// Actual names
+			"development": "development",
+			"production":  "production",
+			"preview":     "preview",
+			"local":       "local",
+
+			// Aliases
+			"dev":       "development",
+			"prod":      "production",
+			"pr":        "preview",
+			"ephemeral": "preview",
+		}
+
+		for _, t := range s.envTypes {
+			val, ok := validTypes[t]
+			if !ok {
+				cmdutil.Fatalf("invalid environment type %q", t)
+			}
+			if !seenTypes[val] {
+				seenTypes[val] = true
+				sel = append(sel, &gql.SecretSelectorEnvType{Kind: val})
+			}
+		}
+		for _, n := range s.envNames {
+			envID, ok := envMap[n]
+			if !ok {
+				cmdutil.Fatalf("environment %q not found", n)
+			}
+			sel = append(sel, &gql.SecretSelectorSpecificEnv{Env: &gql.Env{ID: envID}})
+		}
+	}
+
+	if len(sel) == 0 {
+		cmdutil.Fatal("must specify at least one environment with --type/--env (or --dev/--prod)")
+	}
+	return sel
+}
+
+// readSecretValue reads the secret value from the user.
+// If it's a terminal it becomes an interactive prompt,
+// otherwise it reads from stdin.
+func readSecretValue() string {
+	var value string
+	fd := syscall.Stdin
+	if terminal.IsTerminal(int(fd)) {
+		fmt.Fprint(os.Stderr, "Enter secret value: ")
+		data, err := terminal.ReadPassword(int(fd))
+		if err != nil {
+			cmdutil.Fatal(err)
+		}
+		value = string(data)
+		fmt.Fprintln(os.Stderr)
+	} else {
+		data, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			cmdutil.Fatal(err)
+		}
+		value = string(bytes.TrimRight(data, "\r\n"))
+	}
+	return value
+}
+
+// findMatchingSecretGroup find whether a matching secret group already exists
+// for the given secret key and selector.
+func findMatchingSecretGroup(secrets []*gql.Secret, key string, selector []gql.SecretSelector) *gql.SecretGroup {
+	// canonicalize returns the secret selectors in canonical form
+	canonicalize := func(sels []gql.SecretSelector) []string {
+		var strs []string
+		for _, s := range sels {
+			strs = append(strs, s.String())
+		}
+		sort.Strings(strs)
+		return strs
+	}
+
+	want := canonicalize(selector)
+	for _, s := range secrets {
+		if s.Key == key {
+			for _, g := range s.Groups {
+				got := canonicalize(g.Selector)
+				if slices.Equal(got, want) {
+					return g
+				}
+			}
+		}
+	}
+	return nil
+}
+
+func getConflictError(err error) (*gql.ConflictError, bool) {
+	var gqlErr gql.ErrorList
+	if !errors.As(err, &gqlErr) {
+		return nil, false
+	}
+	for _, e := range gqlErr {
+		if conflict := e.Extensions["conflict"]; len(conflict) > 0 {
+			var cerr gql.ConflictError
+			if err := json.Unmarshal(conflict, &cerr); err == nil {
+				return &cerr, true
+			}
+		}
+	}
+	return nil, false
+}
diff --git a/cli/cmd/encore/sqlc.go b/cli/cmd/encore/sqlc.go
new file mode 100644
index 0000000000..86de21206e
--- /dev/null
+++ b/cli/cmd/encore/sqlc.go
@@ -0,0 +1,178 @@
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+
+	"github.com/golang/protobuf/proto"
+	"github.com/spf13/cobra"
+	"github.com/sqlc-dev/sqlc/pkg/cli"
+	"google.golang.org/protobuf/encoding/protojson"
+
+	"encr.dev/proto/encore/daemon"
+)
+
+type sqlcSQL struct {
+	Schema  string        `json:"schema"`
+	Queries string        `json:"queries"`
+	Engine  string        `json:"engine"`
+	Codegen []sqlcCodegen `json:"codegen"`
+}
+
+type sqlcCodegen struct {
+	Out    string `json:"out"`
+	Plugin string `json:"plugin"`
+}
+
+type sqlcPlugin struct {
+	Name    string      `json:"name"`
+	Process sqlcProcess `json:"process"`
+}
+
+type sqlcProcess struct {
+	Cmd string `json:"cmd"`
+}
+
+type sqlcConfig struct {
+	Version string       `json:"version"`
+	SQL     []sqlcSQL    `json:"sql"`
+	Plugins []sqlcPlugin `json:"plugins"`
+}
+
+func init() {
+	var useProto bool
+	genCmd := &cobra.Command{
+		Use:    "generate-sql-schema <migration-dir>",
+		Short:  "Plugin for SQLC: stores the parsed sqlc model in a protobuf file",
+		Hidden: true,
+		Args:   cobra.ExactArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			schemaPath, err := filepath.Abs(args[0])
+			if err != nil {
+				return err
+			}
+			tmpDir, err := os.MkdirTemp("", "encore-sqlc")
+			if err != nil {
+				return err
+			}
+			defer func() {
+				_ = os.RemoveAll(tmpDir)
+			}()
+
+			sqlcPath := filepath.Join(tmpDir, "sqlc.json")
+			queryPath := filepath.Join(tmpDir, "query.sql")
+			outPath := filepath.Join(tmpDir, "gen")
+			// SQLC requires the schema path to be relative to the sqlc.json file
+			schemaPath, err = filepath.Rel(tmpDir, schemaPath)
+			if err != nil {
+				return err
+			}
+			cfg := sqlcConfig{
+				Version: "2",
+				SQL: []sqlcSQL{
+					{
+						Schema:  schemaPath,
+						Queries: "query.sql",
+						Engine:  "postgresql",
+						Codegen: []sqlcCodegen{
+							{
+								Out:    "gen",
+								Plugin: "encore",
+							},
+						},
+					},
+				},
+				Plugins: []sqlcPlugin{
+					{
+						Name: "encore",
+						Process: sqlcProcess{
+							Cmd: os.Args[0],
+						},
+					},
+				},
+			}
+			cfgData, err := json.Marshal(cfg)
+			if err != nil {
+				return err
+			}
+			err = os.WriteFile(sqlcPath, cfgData, 0644)
+			if err != nil {
+				return err
+			}
+
+			// SQLC requires at least one query to be present in the query file
+			err = os.WriteFile(queryPath, []byte("-- name: Dummy :one\nSELECT 'dummy';"), 0644)
+			if err != nil {
+				return err
+			}
+
+			res := cli.Run([]string{"generate", "-f", sqlcPath})
+			if res != 0 {
+				return fmt.Errorf("sqlc exited with code %d", res)
+			}
+			reqBlob, err := os.ReadFile(filepath.Join(outPath, "output.pb"))
+			if !useProto {
+				req := &daemon.SQLCPlugin_GenerateRequest{}
+				if err := proto.Unmarshal(reqBlob, req); err != nil {
+					return err
+				}
+				reqBlob, err = protojson.MarshalOptions{
+					EmitUnpopulated: true,
+					Indent:          "  ",
+					UseProtoNames:   true,
+				}.Marshal(req)
+				if err != nil {
+					return err
+				}
+			}
+
+			w := bufio.NewWriter(os.Stdout)
+			if _, err := w.Write(reqBlob); err != nil {
+				return err
+			}
+			if err := w.Flush(); err != nil {
+				return err
+			}
+			return nil
+		},
+	}
+	genCmd.Flags().BoolVar(&useProto, "proto", false, "Output the parsed schema as protobuf")
+	pluginCmd := &cobra.Command{
+		Use:    "/plugin.CodegenService/Generate",
+		Short:  "Plugin for SQLC: stores the parsed sqlc model in a protobuf file",
+		Hidden: true,
+		Args:   cobra.NoArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			reqBlob, err := io.ReadAll(os.Stdin)
+			if err != nil {
+				return err
+			}
+			resp := &daemon.SQLCPlugin_GenerateResponse{
+				Files: []*daemon.SQLCPlugin_File{
+					{
+						Name:     "output.pb",
+						Contents: reqBlob,
+					},
+				},
+			}
+			respBlob, err := proto.Marshal(resp)
+			if err != nil {
+				return err
+			}
+			w := bufio.NewWriter(os.Stdout)
+			if _, err := w.Write(respBlob); err != nil {
+				return err
+			}
+			if err := w.Flush(); err != nil {
+				return err
+			}
+			return nil
+		},
+	}
+	rootCmd.AddCommand(genCmd)
+	rootCmd.AddCommand(pluginCmd)
+}
diff --git a/cli/cmd/encore/telemetry.go b/cli/cmd/encore/telemetry.go
new file mode 100644
index 0000000000..f5ae08146a
--- /dev/null
+++ b/cli/cmd/encore/telemetry.go
@@ -0,0 +1,129 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"slices"
+	"strings"
+
+	"github.com/logrusorgru/aurora/v3"
+	"github.com/rs/zerolog/log"
+	"github.com/spf13/cobra"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/cmd/encore/root"
+	"encr.dev/cli/internal/telemetry"
+	"encr.dev/pkg/fns"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+var TelemetryDisabledByEnvVar = os.Getenv("DISABLE_ENCORE_TELEMETRY") == "1"
+var TelemetryDebugByEnvVar = os.Getenv("ENCORE_TELEMETRY_DEBUG") == "1"
+
+func printTelemetryStatus() {
+	status := aurora.Green("Enabled").String()
+	if !telemetry.IsEnabled() {
+		status = aurora.Red("Disabled").String()
+	}
+	fmt.Println(aurora.Sprintf("%s\n", aurora.Bold("Encore Telemetry")))
+	items := [][2]string{
+		{"Status", status},
+	}
+	if root.Verbosity > 0 {
+		items = append(items, [2]string{"Install ID", telemetry.GetAnonID()})
+	}
+	if telemetry.IsDebug() {
+		items = append(items, [2]string{"Debug", aurora.Green("Enabled").String()})
+	}
+	maxKeyLen := fns.Max(items, func(entry [2]string) int { return len(entry[0]) })
+	for _, item := range items {
+		spacing := strings.Repeat(" ", maxKeyLen-len(item[0]))
+		fmt.Printf("%s: %s%s\n", item[0], spacing, item[1])
+	}
+	fmt.Println(aurora.Sprintf("\nLearn more: %s", aurora.Underline("https://encore.dev/docs/telemetry")))
+}
+
+func updateTelemetry(ctx context.Context) {
+	// Update the telemetry config on the daemon if it is running
+	if cmdutil.IsDaemonRunning(ctx) {
+		daemon := cmdutil.ConnectDaemon(ctx)
+		_, err := daemon.Telemetry(ctx, &daemonpb.TelemetryConfig{
+			AnonId:  telemetry.GetAnonID(),
+			Enabled: telemetry.IsEnabled(),
+			Debug:   telemetry.IsDebug(),
+		})
+		if err != nil {
+			log.Debug().Err(err).Msgf("could not update daemon telemetry: %s", err)
+		}
+	}
+	if err := telemetry.SaveConfig(); err != nil {
+		log.Debug().Err(err).Msgf("could not save telemetry: %s", err)
+	}
+}
+
+var telemetryCommand = &cobra.Command{
+	Use:   "telemetry",
+	Short: "Reports the current telemetry status",
+
+	Run: func(cmd *cobra.Command, args []string) {
+		printTelemetryStatus()
+	},
+}
+
+var telemetryEnableCommand = &cobra.Command{
+	Use:   "enable",
+	Short: "Enables telemetry reporting",
+	Run: func(cmd *cobra.Command, args []string) {
+		if telemetry.SetEnabled(true) {
+			updateTelemetry(cmd.Context())
+		}
+		printTelemetryStatus()
+	},
+}
+
+var telemetryDisableCommand = &cobra.Command{
+	Use:   "disable",
+	Short: "Disables telemetry reporting",
+	Run: func(cmd *cobra.Command, args []string) {
+		if telemetry.SetEnabled(false) {
+			updateTelemetry(cmd.Context())
+		}
+		printTelemetryStatus()
+	},
+}
+
+func isCommand(cmd *cobra.Command, name ...string) bool {
+	for cmd != nil {
+		if slices.Contains(name, cmd.Name()) {
+			return true
+		}
+		cmd = cmd.Parent()
+	}
+	return false
+}
+
+func init() {
+	telemetryCommand.AddCommand(telemetryEnableCommand, telemetryDisableCommand)
+	rootCmd.AddCommand(telemetryCommand)
+	root.AddPreRun(func(cmd *cobra.Command, args []string) {
+		update := false
+		if TelemetryDisabledByEnvVar {
+			update = telemetry.SetEnabled(false)
+		}
+		if cmd.Use == "daemon" {
+			return
+		}
+		update = update || telemetry.SetDebug(TelemetryDebugByEnvVar)
+		if update {
+			go updateTelemetry(cmd.Context())
+		}
+		if telemetry.ShouldShowWarning() && !isCommand(cmd, "version", "completion") {
+			fmt.Println()
+			fmt.Println(aurora.Sprintf("%s: This CLI tool collects usage data to help us improve Encore.", aurora.Bold("Note")))
+			fmt.Println(aurora.Sprintf("      You can disable this by running '%s'.\n", aurora.Yellow("encore telemetry disable")))
+			telemetry.SetShownWarning()
+		}
+	})
+
+}
diff --git a/cli/cmd/encore/test.go b/cli/cmd/encore/test.go
index f05362fcf3..01a8ea1fb7 100644
--- a/cli/cmd/encore/test.go
+++ b/cli/cmd/encore/test.go
@@ -2,31 +2,82 @@ package main
 
 import (
 	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
 	"os"
+	"os/exec"
 	"os/signal"
+	"path/filepath"
+	"slices"
+	"strings"
+	"time"
 
-	daemonpb "encr.dev/proto/encore/daemon"
 	"github.com/spf13/cobra"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	daemonpb "encr.dev/proto/encore/daemon"
 )
 
 var testCmd = &cobra.Command{
-	Use:   "test",
+	Use:   "test [go test flags]",
 	Short: "Tests your application",
+	Long:  "Takes all the same flags as `go test`.",
+
+	DisableFlagsInUseLine: true,
 	Run: func(cmd *cobra.Command, args []string) {
-		// Support --help but otherwise let all args be passed on to "go test"
-		for _, arg := range args {
+		var (
+			traceFile    string
+			codegenDebug bool
+			prepareOnly  bool
+			noColor      bool
+		)
+		// Support specific args but otherwise let all args be passed on to "go test"
+		for i := 0; i < len(args); i++ {
+			arg := args[i]
 			if arg == "-h" || arg == "--help" {
-				cmd.Help()
+				_ = cmd.Help()
 				return
+			} else if arg == "--trace" || strings.HasPrefix(arg, "--trace=") {
+				// Drop this argument always.
+				args = slices.Delete(args, i, i+1)
+				i--
+
+				// We either have '--trace=file' or '--trace file'.
+				// Handle both.
+				if _, value, ok := strings.Cut(arg, "="); ok {
+					traceFile = value
+				} else {
+					// Make sure there is a next argument.
+					if i < len(args) {
+						traceFile = args[i]
+						args = slices.Delete(args, i, i+1)
+						i--
+					}
+				}
+			} else if arg == "--codegen-debug" {
+				codegenDebug = true
+				args = slices.Delete(args, i, i+1)
+				i--
+			} else if arg == "--prepare" {
+				prepareOnly = true
+				args = slices.Delete(args, i, i+1)
+				i--
+			} else if arg == "--no-color" {
+				noColor = true
+				args = slices.Delete(args, i, i+1)
+				i--
 			}
 		}
 
 		appRoot, relPath := determineAppRoot()
-		runTests(appRoot, relPath, args)
+		runTests(appRoot, relPath, args, traceFile, codegenDebug, prepareOnly, noColor)
 	},
 }
 
-func runTests(appRoot, testDir string, args []string) {
+func runTests(appRoot, testDir string, args []string, traceFile string, codegenDebug, prepareOnly, noColor bool) {
 	interrupt := make(chan os.Signal, 1)
 	signal.Notify(interrupt, os.Interrupt)
 
@@ -36,19 +87,121 @@ func runTests(appRoot, testDir string, args []string) {
 		cancel()
 	}()
 
+	converter := cmdutil.ConvertJSONLogs(cmdutil.Colorize(!noColor))
+	if slices.Contains(args, "-json") {
+		converter = convertTestEventOutputOnly(converter)
+	}
+
 	daemon := setupDaemon(ctx)
+
+	// Is this a node package?
+	packageJsonPath := filepath.Join(appRoot, "package.json")
+	if _, err := os.Stat(packageJsonPath); err == nil || prepareOnly {
+		spec, err := daemon.TestSpec(ctx, &daemonpb.TestSpecRequest{
+			AppRoot:    appRoot,
+			WorkingDir: testDir,
+			Args:       args,
+			Environ:    os.Environ(),
+		})
+		if status.Code(err) == codes.NotFound {
+			fatal("application does not define any tests.\nNote: Add a 'test' script command to package.json to run tests.")
+		} else if err != nil {
+			fatal(err)
+		}
+
+		if prepareOnly {
+			for _, ln := range spec.Environ {
+				fmt.Println(ln)
+			}
+			return
+		}
+
+		cmd := exec.Command(spec.Command, spec.Args...)
+		cmd.Env = spec.Environ
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		cmd.Stdin = os.Stdin
+
+		if err := cmd.Run(); err != nil {
+			var exitErr *exec.ExitError
+			if errors.As(err, &exitErr) {
+				os.Exit(exitErr.ExitCode())
+			} else {
+				fatal(err)
+			}
+		}
+		return
+	}
+
 	stream, err := daemon.Test(ctx, &daemonpb.TestRequest{
-		AppRoot:    appRoot,
-		WorkingDir: testDir,
-		Args:       args,
+		AppRoot:      appRoot,
+		WorkingDir:   testDir,
+		Args:         args,
+		Environ:      os.Environ(),
+		TraceFile:    nonZeroPtr(traceFile),
+		CodegenDebug: codegenDebug,
 	})
 	if err != nil {
 		fatal(err)
 	}
-	streamCommandOutput(stream)
+	os.Exit(cmdutil.StreamCommandOutput(stream, converter))
 }
 
 func init() {
 	testCmd.DisableFlagParsing = true
 	rootCmd.AddCommand(testCmd)
+
+	// Even though we've disabled flag parsing, we still need to define the flags
+	// so that the help text is correct.
+	testCmd.Flags().Bool("codegen-debug", false, "Dump generated code (for debugging Encore's code generation)")
+	testCmd.Flags().Bool("prepare", false, "Prepare for running tests (without running them)")
+	testCmd.Flags().String("trace", "", "Specifies a trace file to write trace information about the parse and compilation process to.")
+	testCmd.Flags().Bool("no-color", false, "Disable colorized output")
+
+}
+
+func convertTestEventOutputOnly(converter cmdutil.OutputConverter) cmdutil.OutputConverter {
+	return func(line []byte) []byte {
+		// If this isn't a JSON log line, just return it as-is
+		if len(line) == 0 || line[0] != '{' {
+			return line
+		}
+
+		testEvent := &testJSONEvent{}
+		if err := json.Unmarshal(line, testEvent); err == nil && testEvent.Action == "output" {
+			if testEvent.Output != nil && (*(testEvent.Output))[0] == '{' {
+				convertedLogs := textBytes(converter(*testEvent.Output))
+				testEvent.Output = &convertedLogs
+
+				newLine, err := json.Marshal(testEvent)
+				if err == nil {
+					return append(newLine, '\n')
+				}
+			}
+		}
+
+		return line
+	}
+}
+
+// testJSONEvent and textBytes taken from the Go source code
+type testJSONEvent struct {
+	Time    *time.Time `json:",omitempty"`
+	Action  string
+	Package string     `json:",omitempty"`
+	Test    string     `json:",omitempty"`
+	Elapsed *float64   `json:",omitempty"`
+	Output  *textBytes `json:",omitempty"`
+}
+
+// textBytes is a hack to get JSON to emit a []byte as a string
+// without actually copying it to a string.
+// It implements encoding.TextMarshaler, which returns its text form as a []byte,
+// and then json encodes that text form as a string (which was our goal).
+type textBytes []byte
+
+func (b *textBytes) MarshalText() ([]byte, error) { return *b, nil }
+func (b *textBytes) UnmarshalText(in []byte) error {
+	*b = in
+	return nil
 }
diff --git a/cli/cmd/encore/version.go b/cli/cmd/encore/version.go
index f7d7274382..d7cbf1d412 100644
--- a/cli/cmd/encore/version.go
+++ b/cli/cmd/encore/version.go
@@ -1,24 +1,95 @@
 package main
 
 import (
+	"context"
 	"fmt"
 	"os"
+	"strings"
+	"time"
 
+	"github.com/logrusorgru/aurora/v3"
 	"github.com/spf13/cobra"
-)
 
-// Version is the version of the encore binary.
-// It is set using `go build -ldflags "-X main.Version=v1.2.3"`.
-var Version string
+	"encr.dev/cli/internal/update"
+	"encr.dev/internal/version"
+)
 
 var versionCmd = &cobra.Command{
 	Use:   "version",
 	Short: "Reports the current version of the encore application",
+
+	DisableFlagsInUseLine: true,
+	Run: func(cmd *cobra.Command, args []string) {
+		var (
+			ver *update.LatestVersion
+			err error
+		)
+		if version.Version != "" {
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+			ver, err = update.Check(ctx)
+		}
+
+		// NOTE: This output format is relied on by the Encore IntelliJ plugin.
+		// Don't change this without considering its impact on that plugin.
+		fmt.Fprintln(os.Stdout, "encore version", version.Version)
+
+		if err != nil {
+			fatalf("could not check for update: %v", err)
+		} else if ver.IsNewer(version.Version) {
+			if ver.ForceUpgrade {
+				fmt.Println(aurora.Red("An urgent security update for Encore is available."))
+				if ver.SecurityNotes != "" {
+					fmt.Println(aurora.Sprintf(aurora.Yellow("%s"), ver.SecurityNotes))
+				}
+
+				versionUpdateCmd.Run(cmd, args)
+			} else {
+				if ver.SecurityUpdate {
+					fmt.Println(aurora.Sprintf(aurora.Red("A security update is update available: %s -> %s\nUpdate with: encore version update"), version.Version, ver.Version()))
+
+					if ver.SecurityNotes != "" {
+						fmt.Println(aurora.Sprintf(aurora.Yellow("%s"), ver.SecurityNotes))
+					}
+				} else {
+					fmt.Println(aurora.Sprintf(aurora.Yellow("Update available: %s -> %s\nUpdate with: encore version update"), version.Version, ver.Version()))
+				}
+			}
+		}
+	},
+}
+
+var versionUpdateCmd = &cobra.Command{
+	Use:   "update",
+	Short: "Checks for an update of encore and, if one is available, runs the appropriate command to update it.",
+
+	DisableFlagsInUseLine: true,
 	Run: func(cmd *cobra.Command, args []string) {
-		fmt.Fprintln(os.Stdout, "encore version", Version)
+		if version.Version == "" || strings.HasPrefix(version.Version, "devel") {
+			fatal("cannot update development build, first install Encore from https://encore.dev/docs/install")
+		}
+
+		ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+		defer cancel()
+		ver, err := update.Check(ctx)
+		if err != nil {
+			fatalf("could not check for update: %v", err)
+		}
+		if ver.IsNewer(version.Version) {
+			fmt.Printf("Upgrading Encore to %v...\n", ver.Version())
+
+			if err := ver.DoUpgrade(os.Stdout, os.Stderr); err != nil {
+				fatalf("could not update: %v", err)
+				os.Exit(1)
+			}
+			os.Exit(0)
+		} else {
+			fmt.Println("Encore already up to date.")
+		}
 	},
 }
 
 func init() {
+	versionCmd.AddCommand(versionUpdateCmd)
 	rootCmd.AddCommand(versionCmd)
 }
diff --git a/cli/cmd/encore/vpn.go b/cli/cmd/encore/vpn.go
deleted file mode 100644
index 80060d9747..0000000000
--- a/cli/cmd/encore/vpn.go
+++ /dev/null
@@ -1,111 +0,0 @@
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log"
-	"os"
-	"time"
-
-	"encr.dev/cli/internal/conf"
-	"encr.dev/cli/internal/wgtunnel"
-	"encr.dev/cli/internal/xos"
-	"github.com/spf13/cobra"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-var vpnCmd = &cobra.Command{
-	Use:   "vpn",
-	Short: "VPN management commands",
-}
-
-func init() {
-	rootCmd.AddCommand(vpnCmd)
-
-	startCmd := &cobra.Command{
-		Use:   "start",
-		Short: "Sets up a secure connection to private environments",
-		Run: func(cmd *cobra.Command, args []string) {
-			if admin, err := xos.IsAdminUser(); err == nil && !admin {
-				log.Fatalf("fatal: must start VPN as root user (use 'sudo'?)")
-			}
-
-			cfg, err := conf.OriginalUser("")
-			if errors.Is(err, os.ErrNotExist) {
-				log.Fatalf("fatal: not logged in. run 'encore auth login' first")
-			} else if err != nil {
-				log.Fatalf("fatal: could not read encore config (did you run 'encore auth login'?): %v", err)
-			} else if cfg.WireGuard.PrivateKey == "" || cfg.WireGuard.PublicKey == "" {
-				log.Println("encore: generating WireGuard key...")
-				pub, priv, err := wgtunnel.GenKey()
-				if err != nil {
-					log.Fatalf("fatal: could not generate WireGuard key: %v", err)
-				}
-				cfg.WireGuard.PublicKey = pub.String()
-				cfg.WireGuard.PrivateKey = priv.String()
-				if err := conf.Write(cfg); err != nil {
-					log.Fatalf("fatal: could not write updated config: %v", err)
-				}
-				log.Println("encore: successfully generated and persisted WireGuard key")
-			}
-
-			pubKey, err1 := wgtypes.ParseKey(cfg.WireGuard.PublicKey)
-			privKey, err2 := wgtypes.ParseKey(cfg.WireGuard.PrivateKey)
-			if err1 != nil || err2 != nil {
-				fatalf("could not parse public/private key: %v/%v", err1, err2)
-			}
-
-			log.Printf("encore: registering device with server...")
-			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-			defer cancel()
-			ip, err := wgtunnel.RegisterDevice(ctx, pubKey)
-			if err != nil {
-				log.Fatalf("fatal: could not register device: %v", err)
-			}
-			log.Printf("encore: successfully registered device, assigned address %s", ip)
-
-			log.Printf("encore: starting WireGuard tunnel...")
-			cc := &wgtunnel.ClientConfig{
-				Addr:    ip,
-				PrivKey: privKey,
-			}
-			if err := wgtunnel.Start(cc, nil); err != nil {
-				log.Fatalf("fatal: could not start tunnel: %v", err)
-			}
-			log.Printf("encore: successfully started WireGuard tunnel")
-		},
-	}
-	vpnCmd.AddCommand(startCmd)
-
-	stopCmd := &cobra.Command{
-		Use:   "stop",
-		Short: "Stops the VPN connection",
-		Run: func(cmd *cobra.Command, args []string) {
-			if err := wgtunnel.Stop(); os.IsPermission(err) {
-				log.Fatal("fatal: permission denied to stop tunnel (use 'sudo'?)")
-			} else if err != nil {
-				log.Fatalf("fatal: could not stop tunnel: %v", err)
-			}
-			log.Printf("encore: stopped WireGuard tunnel")
-		},
-	}
-	vpnCmd.AddCommand(stopCmd)
-
-	statusCmd := &cobra.Command{
-		Use:   "status",
-		Short: "Determines the status of the VPN connection",
-		Run: func(cmd *cobra.Command, args []string) {
-			if running, err := wgtunnel.Status(); os.IsPermission(err) {
-				log.Fatal("fatal: permission denied to check tunnel status (use 'sudo'?)")
-			} else if err != nil {
-				log.Fatalf("fatal: could not check tunnel status: %v", err)
-			} else if running {
-				fmt.Fprintln(os.Stdout, "running")
-			} else {
-				fmt.Fprintln(os.Stdout, "not running")
-			}
-		},
-	}
-	vpnCmd.AddCommand(statusCmd)
-}
diff --git a/cli/cmd/encore/vpn_darwin.go b/cli/cmd/encore/vpn_darwin.go
deleted file mode 100644
index 0c85936d6e..0000000000
--- a/cli/cmd/encore/vpn_darwin.go
+++ /dev/null
@@ -1,27 +0,0 @@
-package main
-
-import (
-	"log"
-
-	"encr.dev/cli/internal/wgtunnel"
-	"encr.dev/cli/internal/xos"
-	"github.com/spf13/cobra"
-)
-
-func init() {
-	runCmd := &cobra.Command{
-		Use:    "__run",
-		Short:  "Runs the WireGuard tunnel synchronously.",
-		Hidden: true,
-		Run: func(cmd *cobra.Command, args []string) {
-			if admin, err := xos.IsAdminUser(); err == nil && !admin {
-				log.Fatalf("fatal: must start VPN as root user (use 'sudo'?)")
-			}
-			if err := wgtunnel.Run(); err != nil {
-				fatal(err)
-			}
-		},
-	}
-
-	vpnCmd.AddCommand(runCmd)
-}
diff --git a/cli/cmd/encore/vpn_windows.go b/cli/cmd/encore/vpn_windows.go
deleted file mode 100644
index 7ba2d477e3..0000000000
--- a/cli/cmd/encore/vpn_windows.go
+++ /dev/null
@@ -1,69 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"os"
-
-	"encr.dev/cli/internal/winsvc"
-	"github.com/spf13/cobra"
-)
-
-func init() {
-	installCmd := &cobra.Command{
-		Hidden: true,
-		Use:    "svc-install",
-		Short:  "Installs the windows service for the WireGuard tunnel",
-		Args:   cobra.ExactArgs(1),
-		Run: func(cmd *cobra.Command, args []string) {
-			if err := winsvc.Install(args[0]); err != nil {
-				fatal(err)
-			}
-		},
-	}
-	vpnCmd.AddCommand(installCmd)
-
-	uninstallCmd := &cobra.Command{
-		Hidden: true,
-		Use:    "svc-uninstall",
-		Short:  "Uninstalls the windows service",
-		Args:   cobra.ExactArgs(1),
-		Run: func(cmd *cobra.Command, args []string) {
-			if err := winsvc.Uninstall(args[0]); err != nil {
-				fatal(err)
-			}
-		},
-	}
-	vpnCmd.AddCommand(uninstallCmd)
-
-	statusCmd := &cobra.Command{
-		Hidden: true,
-		Use:    "svc-status",
-		Short:  "Uninstalls the windows service",
-		Args:   cobra.ExactArgs(1),
-		Run: func(cmd *cobra.Command, args []string) {
-			installed, err := winsvc.Status(args[0])
-			if err != nil {
-				fatal(err)
-			}
-			if installed {
-				fmt.Fprintln(os.Stdout, "installed")
-			} else {
-				fmt.Fprintln(os.Stdout, "not installed")
-			}
-		},
-	}
-	vpnCmd.AddCommand(statusCmd)
-
-	runCmd := &cobra.Command{
-		Hidden: true,
-		Use:    "svc-run",
-		Short:  "Runs the windows service",
-		Args:   cobra.ExactArgs(1),
-		Run: func(cmd *cobra.Command, args []string) {
-			if err := winsvc.Run(args[0]); err != nil {
-				fatal(err)
-			}
-		},
-	}
-	vpnCmd.AddCommand(runCmd)
-}
diff --git a/cli/cmd/git-remote-encore/main.go b/cli/cmd/git-remote-encore/main.go
index b26a36dae1..c22bdcc0d9 100644
--- a/cli/cmd/git-remote-encore/main.go
+++ b/cli/cmd/git-remote-encore/main.go
@@ -9,9 +9,10 @@ import (
 	"net/url"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 
-	"encr.dev/cli/internal/conf"
+	"encr.dev/internal/conf"
 )
 
 func main() {
@@ -21,6 +22,20 @@ func main() {
 	}
 }
 
+var isLocalTest = (func() bool {
+	return filepath.Base(os.Args[0]) == "git-remote-encorelocal"
+})()
+
+// remoteScheme is the remote scheme we expect.
+// It's "encore" in general but "encorelocal" for local development.
+var remoteScheme = (func() string {
+	if isLocalTest {
+		return "encorelocal"
+	} else {
+		return "encore"
+	}
+})()
+
 func run(args []string) error {
 	stdin := bufio.NewReader(os.Stdin)
 	stdout := os.Stdout
@@ -52,12 +67,12 @@ func connect(args []string, svc string) error {
 	uri, err := url.Parse(args[2])
 	if err != nil {
 		return fmt.Errorf("connect %s: invalid remote uri: %v", os.Args[2], err)
-	} else if uri.Scheme != "encore" {
-		return fmt.Errorf("connect %s: expected remote scheme \"encore\", got %q", os.Args[2], uri.Scheme)
+	} else if uri.Scheme != remoteScheme {
+		return fmt.Errorf("connect %s: expected remote scheme %q, got %q", os.Args[2], remoteScheme, uri.Scheme)
 	}
 	appID := uri.Hostname()
 
-	ts := &conf.TokenSource{}
+	ts := conf.NewTokenSource()
 	tok, err := ts.Token()
 	if err != nil {
 		return fmt.Errorf("could not get Encore auth token: %v", err)
@@ -68,25 +83,46 @@ func connect(args []string, svc string) error {
 		return err
 	}
 	keyPath := f.Name()
-	defer os.Remove(keyPath)
+	defer func() { _ = os.Remove(keyPath) }()
+
 	if err := f.Chmod(0600); err != nil {
-		f.Close()
+		_ = f.Close()
 		return err
 	} else if _, err := f.Write([]byte(SentinelPrivateKey)); err != nil {
-		f.Close()
+		_ = f.Close()
 		return err
 	} else if err := f.Close(); err != nil {
 		return err
 	}
 
+	// Create a dummy config file so that we can work around any host overrides
+	// present on the system.
+	cfg, err := os.CreateTemp("", "encore-dummy-ssh-config")
+	if err != nil {
+		return err
+	}
+	cfgPath := cfg.Name()
+	defer func() { _ = os.Remove(cfgPath) }()
+
 	// Communicate to Git that the connection is established.
-	os.Stdout.Write([]byte("\n"))
+	_, _ = os.Stdout.Write([]byte("\n"))
+
+	sshServer, port := "git.encore.dev", "22"
+	if isLocalTest {
+		sshServer, port = "localhost", "9040"
+	}
 
 	// Set up an SSH tunnel with a sentinel key as a way to signal
 	// Encore to use token-based authentication, and pass the token
 	// as part of the command.
-	cmd := exec.Command("ssh", "-x", "-T", "-o", "IdentitiesOnly=yes", "-i", keyPath,
-		"git.encore.dev", fmt.Sprintf("token=%s %s '%s'", tok.AccessToken, svc, appID))
+	cmd := exec.Command("ssh",
+		"-x", "-T",
+		"-F", cfgPath,
+		"-o", "IdentitiesOnly=yes",
+		"-i", keyPath,
+		"-p", port,
+		sshServer,
+		fmt.Sprintf("token=%s %s '%s'", tok.AccessToken, svc, appID))
 	cmd.Env = []string{}
 	cmd.Stdin = os.Stdin
 	cmd.Stdout = os.Stdout
@@ -100,20 +136,12 @@ func connect(args []string, svc string) error {
 //
 // NOTE: This is not a security problem. The key is meant to be public
 // and does not serve as a means of authentication.
+// nosemgrep
 const SentinelPrivateKey = `-----BEGIN OPENSSH PRIVATE KEY-----
-b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAlwAAAAdzc2gtcn
-NhAAAAAwEAAQAAAIEA1ZrV6bnLgKI7cZHGn3Z93jTATaGjw6ytPdSorrnwYRP3K833BC19
-ANPSWAoXcYXNDIR90j/V+sd5ILv5NUoctdV1+2J8jzW/hedj0HuDou1YruNHVowfE3JFYr
-6eMK15kvc/K9EsIl/TfH9/RiWVnWq1wHwOdZtH2UZE9QdT+r0AAAIIrcJlP63CZT8AAAAH
-c3NoLXJzYQAAAIEA1ZrV6bnLgKI7cZHGn3Z93jTATaGjw6ytPdSorrnwYRP3K833BC19AN
-PSWAoXcYXNDIR90j/V+sd5ILv5NUoctdV1+2J8jzW/hedj0HuDou1YruNHVowfE3JFYr6e
-MK15kvc/K9EsIl/TfH9/RiWVnWq1wHwOdZtH2UZE9QdT+r0AAAADAQABAAAAgBndpgmndf
-0dqBUYkfS9ZICD4sWDzVDkmBXkqoh9+53FzSiAyGi5GWoAPHhswGn+ydW6NYJAOKklfoV4
-PbU2REOHwXYblAZmDmPksSN1IbjDdFZ+0vXFUmS2k30eqIgIEGOrN1tnLXoK+B4kwFQ1IN
-UMMpB39vRyhyrEGv+S4gQBAAAAQFiOrnRAtY50ZiqXND3SdCnQxnjmUxcE7pcQaaQK6KMP
-A7bQpMNzJop/UpNRIjLb5bPG9FPgTzQ5+5l4fGL5OwYAAABBAP4V8q7KQLqoPsHaWG7pga
-iE9cUzE9hle2zXiRCcXt2qXxB7P1U9DQVdzVwarfAggIGRsqjJmEDe69F/I4QAkj8AAABB
-ANc20AXzRmnneRyZuOEUhTsdNWcQf9qv+tQh3DDr7SW7NhuSKW9CqC18nbDckEp0yOCjIR
-k5HAPXd2pDop0UvAMAAAAPZWFuZHJlQG0xLmxvY2FsAQIDBA==
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACCyj3F5Tp1eBIp7rMohszumYzlys/BFfmX/LVkXJS8magAAAJjsp3yz7Kd8
+swAAAAtzc2gtZWQyNTUxOQAAACCyj3F5Tp1eBIp7rMohszumYzlys/BFfmX/LVkXJS8mag
+AAAEDMiwRrf5WET2mTKjKjX7z6vox3n6hKGKbP7V4MDtVre7KPcXlOnV4EinusyiGzO6Zj
+OXKz8EV+Zf8tWRclLyZqAAAAE2VuY29yZS1zZW50aW5lbC1rZXkBAg==
 -----END OPENSSH PRIVATE KEY-----
 `
diff --git a/cli/cmd/tsbundler-encore/main.go b/cli/cmd/tsbundler-encore/main.go
new file mode 100644
index 0000000000..90aa1e4fa3
--- /dev/null
+++ b/cli/cmd/tsbundler-encore/main.go
@@ -0,0 +1,297 @@
+package main
+
+import (
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/evanw/esbuild/pkg/api"
+
+	"encr.dev/internal/version"
+
+	flag "github.com/spf13/pflag"
+)
+
+var (
+	entryPoints      []string
+	specifiedEngines []string
+	// replacementFile  string
+	outDir   string
+	bundle   bool
+	minify   bool
+	help     bool
+	logLevel int
+)
+
+// main is the entry point for the tsbundler-encore command.
+//
+// It is responsible for parsing the command line flags, validating the input, and then triggering esbuild.
+//
+// Run with --help for more information.
+func main() {
+	// Required flags
+	// flag.StringVar(&replacementFile, "replacements", "", "Replacement file or json object (default read from stdin)")
+
+	// Optional flags
+	flag.StringVar(&outDir, "outdir", "dist", "Output directory")
+	flag.BoolVar(&bundle, "bundle", true, "Bundle all dependencies")
+	flag.BoolVar(&minify, "minify", false, "Minify output (default false)")
+	flag.StringArrayVar(&specifiedEngines, "engine", []string{"node:21"}, "Target engine")
+	flag.CountVarP(&logLevel, "verbose", "v", "Increase logging level (can be specified multiple times)")
+	flag.BoolVarP(&help, "help", "h", false, "Print help")
+	flag.Usage = printHelp
+	flag.Parse()
+
+	entryPoints = flag.Args()
+	if help {
+		printHelp()
+		os.Exit(0)
+	}
+
+	// Validate input (note: these functions will exit on error)
+	validateEntrypointParams()
+	engines := readEngines()
+	// replacements := readReplacementMapping()
+
+	// Create our transformer plugin
+	// rewritePlugin := api.Plugin{
+	// 	Name: "encore-codegen-transformer",
+	// 	Setup: func(build api.PluginBuild) {
+	// 		build.OnLoad(
+	// 			api.OnLoadOptions{Filter: `\.(ts|js)(x?)$`},
+	// 			func(args api.OnLoadArgs) (api.OnLoadResult, error) {
+	// 				replacement, found := replacements[args.Path]
+	// 				if !found {
+	// 					return api.OnLoadResult{}, nil
+	// 				}
+
+	// 				contentsBytes, err := os.ReadFile(replacement)
+	// 				if err != nil {
+	// 					return api.OnLoadResult{}, fmt.Errorf("error reading replacement file: %w", err)
+	// 				}
+	// 				content := string(contentsBytes)
+
+	// 				return api.OnLoadResult{
+	// 					PluginName: "encore-codegen-transformer",
+	// 					Contents:   &content,
+	// 					Loader:     api.LoaderTS,
+	// 				}, nil
+	// 			},
+	// 		)
+	// 	},
+	// }
+
+	banner := `// This file was bundled by Encore ` + version.Version + `
+//
+// https://encore.dev`
+
+	outBase := ""
+	if len(entryPoints) == 1 {
+		// If there's a single entrypoint, use its directory as the outbase
+		// as otherwise esbuild won't include the "[dir]" token in the output.
+		outBase = filepath.Dir(filepath.Dir(entryPoints[0]))
+	}
+
+	// Trigger esbuild
+	result := api.Build(api.BuildOptions{
+		// Setup base settings
+		LogLevel:  api.LogLevelWarning - api.LogLevel(logLevel),
+		Banner:    map[string]string{"js": banner},
+		Charset:   api.CharsetUTF8,
+		Sourcemap: api.SourceMapLinked,
+		Packages:  api.PackagesExternal,
+		Plugins:   []api.Plugin{
+			// rewritePlugin,
+		},
+		TreeShaking: api.TreeShakingTrue,
+
+		// Set our build target
+		Platform: api.PlatformNode,
+		Format:   api.FormatESModule,
+		Target:   api.ES2022,
+		Engines:  engines,
+
+		// Minification settings
+		MinifyWhitespace:  minify,
+		MinifySyntax:      minify,
+		MinifyIdentifiers: minify,
+
+		// Pass in what we want to build
+		EntryNames:  "[dir]/[name]",
+		EntryPoints: entryPoints,
+		Bundle:      bundle,
+		Outdir:      outDir,
+		Outbase:     outBase,
+		Write:       true, // Write to outdir
+		OutExtension: map[string]string{
+			".js": ".mjs",
+		},
+		Define: map[string]string{
+			"ENCORE_DROP_TESTS": "true",
+		},
+	})
+
+	if len(result.Errors) > 0 {
+		os.Exit(1)
+	}
+}
+
+func printHelp() {
+	binary := filepath.Base(os.Args[0])
+
+	// Base usage help
+	versionStr := fmt.Sprintf("tsbundler-encore (%s)", version.Version)
+	_, _ = fmt.Fprintf(os.Stderr, "%s\n%s\n", versionStr, strings.Repeat("=", len(versionStr)))
+	_, _ = fmt.Fprintf(os.Stderr, "\nUsage: %s <entry point(s)...> [options]\n", binary)
+	flag.PrintDefaults()
+
+	// Replacements help
+	// _, _ = fmt.Fprintf(os.Stderr, "\nReplacements JSON Format:\n")
+	// _, _ = fmt.Fprintf(os.Stderr, "      {\n")
+	// _, _ = fmt.Fprintf(os.Stderr, "        \"/absolute/path/to/file.ts\": \"/path/to/replacement.ts\",\n")
+	// _, _ = fmt.Fprintf(os.Stderr, "        \"/absolute/path/to/file2.ts\": \"/path/to/replacement2.ts\"\n")
+	// _, _ = fmt.Fprintf(os.Stderr, "      }\n")
+
+	// Engine help
+	_, _ = fmt.Fprintf(os.Stderr, "\nEngines:\n\nEngines can be specified as a name, or a name and version separated by a colon,\nfor example \"node:21\" or \"node\". Multiple engines can be specified if required.\n\nThe supported engines are:\n")
+	_, _ = fmt.Fprintf(os.Stderr, "      - node\n")
+	_, _ = fmt.Fprintf(os.Stderr, "      - bun\n")
+	_, _ = fmt.Fprintf(os.Stderr, "      - deno\n")
+	_, _ = fmt.Fprintf(os.Stderr, "      - rhino\n")
+}
+
+// validateEntrypointParams validates that the entry points parameters was specified and that all entry points exist
+// and are readable on the file system.
+func validateEntrypointParams() {
+	if len(entryPoints) == 0 {
+		_, _ = fmt.Fprintf(os.Stderr, "Error: at least one entry point must be specified\n\n")
+		printHelp()
+		os.Exit(1)
+	}
+
+	for _, entryPoint := range entryPoints {
+		if st, err := os.Stat(entryPoint); errors.Is(err, fs.ErrNotExist) {
+			_, _ = fmt.Fprintf(os.Stderr, "Error: entry point %s does not exist\n", entryPoint)
+			os.Exit(1)
+		} else if err != nil {
+			_, _ = fmt.Fprintf(os.Stderr, "Error: error reading entry point %s: %s\n", entryPoint, err)
+			os.Exit(1)
+		} else if st.IsDir() {
+			_, _ = fmt.Fprintf(os.Stderr, "Error: entry point %s is a directory\n", entryPoint)
+			os.Exit(1)
+		}
+	}
+}
+
+// readReplacementMapping reads a replacement mapping from either a file or stdin depending
+// on if the replacementFile flag was specified.
+//
+// It then validates that all the keys are valid paths to files and the values are valid paths to files.
+// func readReplacementMapping() map[string]string {
+// 	out := make(map[string]string)
+
+// 	// If a replacement file was specified, read it
+// 	replacementFile = strings.TrimSpace(replacementFile)
+// 	if replacementFile != "" {
+// 		if replacementFile[0] == '{' {
+// 			err := json.Unmarshal([]byte(replacementFile), &out)
+// 			if err != nil {
+// 				_, _ = fmt.Fprintf(os.Stderr, "Error parsing replacement object: %s\n", err)
+// 				os.Exit(1)
+// 			}
+// 		} else {
+// 			data, err := os.ReadFile(replacementFile)
+// 			if err != nil {
+// 				_, _ = fmt.Fprintf(os.Stderr, "Error reading replacement file: %s\n", err)
+// 				os.Exit(1)
+// 			}
+
+// 			err = json.Unmarshal(data, &out)
+// 			if err != nil {
+// 				_, _ = fmt.Fprintf(os.Stderr, "Error parsing replacement file: %s\n", err)
+// 				os.Exit(1)
+// 			}
+// 		}
+// 	} else {
+// 		// Check something is being piped in
+// 		info, _ := os.Stdin.Stat()
+// 		if (info.Mode()&os.ModeCharDevice) != 0 || info.Size() <= 0 {
+// 			_, _ = fmt.Fprintf(os.Stderr, "Error: no replacement file specified and nothing piped in\n")
+// 			os.Exit(1)
+// 		}
+
+// 		// Otherwise, read from stdin
+// 		if err := json.NewDecoder(os.Stdin).Decode(&out); err != nil {
+// 			_, _ = fmt.Fprintf(os.Stderr, "Error reading replacement file from stdin: %s\n", err)
+// 			os.Exit(1)
+// 		}
+// 	}
+
+// 	// Validate that all the keys are valid paths to files and the values are valid paths to files
+// 	for key, value := range out {
+// 		// Validate key
+// 		if st, err := os.Stat(key); errors.Is(err, fs.ErrNotExist) {
+// 			_, _ = fmt.Fprintf(os.Stderr, "Error: replacement key %s does not exist\n", key)
+// 			os.Exit(1)
+// 		} else if err != nil {
+// 			_, _ = fmt.Fprintf(os.Stderr, "Error: error reading replacement key %s: %s\n", key, err)
+// 			os.Exit(1)
+// 		} else if st.IsDir() {
+// 			_, _ = fmt.Fprintf(os.Stderr, "Error: replacement key %s is a directory\n", key)
+// 			os.Exit(1)
+// 		} else if !filepath.IsAbs(key) {
+// 			_, _ = fmt.Fprintf(os.Stderr, "Error: replacement key %s is not an absolute path\n", key)
+// 			os.Exit(1)
+// 		}
+
+// 		// Validate value
+// 		if st, err := os.Stat(value); errors.Is(err, fs.ErrNotExist) {
+// 			_, _ = fmt.Fprintf(os.Stderr, "Error: replacement value %s does not exist\n", value)
+// 			os.Exit(1)
+// 		} else if err != nil {
+// 			_, _ = fmt.Fprintf(os.Stderr, "Error: error reading replacement value %s: %s\n", value, err)
+// 			os.Exit(1)
+// 		} else if st.IsDir() {
+// 			_, _ = fmt.Fprintf(os.Stderr, "Error: replacement value %s is a directory\n", value)
+// 			os.Exit(1)
+// 		}
+// 	}
+
+// 	return out
+// }
+
+// readEngines reads the engines from the specified flag and returns a list of engines.
+func readEngines() []api.Engine {
+	if len(specifiedEngines) == 0 {
+		_, _ = fmt.Fprintf(os.Stderr, "Error: at least one engine must be specified\n\n")
+		printHelp()
+		os.Exit(1)
+	}
+
+	var engines []api.Engine
+	for _, engineName := range specifiedEngines {
+		engineName = strings.ToLower(strings.TrimSpace(engineName))
+		engineName, engineVersion, _ := strings.Cut(engineName, ":")
+
+		var eng api.Engine
+		switch engineName {
+		case "node", "bun": // Note: esbuild doesn't have a "bun" engine (yet), but to future proof we'll alias it to node
+			eng = api.Engine{Name: api.EngineNode, Version: engineVersion}
+		case "deno":
+			eng = api.Engine{Name: api.EngineDeno, Version: engineVersion}
+		case "rhino":
+			eng = api.Engine{Name: api.EngineRhino, Version: engineVersion}
+		default:
+			_, _ = fmt.Fprintf(os.Stderr, "Error: unknown/unsupported engine %s\n\n", engineName)
+			printHelp()
+			os.Exit(1)
+		}
+
+		engines = append(engines, eng)
+	}
+
+	return engines
+}
diff --git a/cli/daemon/apps/apps.go b/cli/daemon/apps/apps.go
new file mode 100644
index 0000000000..8169a9f66f
--- /dev/null
+++ b/cli/daemon/apps/apps.go
@@ -0,0 +1,566 @@
+package apps
+
+import (
+	"database/sql"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/golang/protobuf/proto"
+	"github.com/rs/zerolog/log"
+	"go4.org/syncutil"
+
+	"encore.dev/appruntime/exported/experiments"
+	"encr.dev/cli/internal/manifest"
+	"encr.dev/internal/conf"
+	"encr.dev/internal/env"
+	"encr.dev/internal/goldfish"
+	"encr.dev/pkg/appfile"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/watcher"
+	"encr.dev/pkg/xos"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+var ErrNotFound = errors.New("app not found")
+
+func NewManager(db *sql.DB) *Manager {
+	return &Manager{
+		db:        db,
+		instances: make(map[string]*Instance),
+	}
+}
+
+// Manager keeps track of known apps and watches them for changes.
+type Manager struct {
+	db         *sql.DB
+	setupWatch syncutil.Once
+
+	appRegMu     sync.Mutex
+	appListeners []func(*Instance)
+
+	watchMu  sync.Mutex
+	watchers []WatchFunc
+
+	instanceMu sync.Mutex
+	instances  map[string]*Instance // root -> instance
+}
+
+type TrackOption func(*Instance) error
+
+func WithTutorial(tutorial string) TrackOption {
+	return func(i *Instance) error {
+		err := manifest.SetTutorial(i.root, tutorial)
+		if err != nil {
+			return errors.Wrap(err, "set tutorial")
+		}
+		i.tutorial = tutorial
+		return nil
+	}
+}
+
+// Track begins tracking an app, and marks it as updated
+// if the app is already tracked.
+func (mgr *Manager) Track(appRoot string, options ...TrackOption) (*Instance, error) {
+	app, err := mgr.resolve(appRoot)
+	for _, opt := range options {
+		if err := opt(app); err != nil {
+			return nil, err
+		}
+	}
+	if err != nil {
+		return nil, err
+	}
+	_, err = mgr.db.Exec(`
+		INSERT OR REPLACE INTO app (root, local_id, platform_id, updated_at)
+		VALUES (?, ?, ?, ?)
+	`, app.root, app.localID, app.PlatformID(), time.Now())
+	if err != nil {
+		return nil, errors.Wrap(err, "update app store")
+	}
+	log.Info().Str("app_id", app.PlatformOrLocalID()).Msg("tracking app")
+	return app, nil
+}
+
+// FindLatestByPlatformID finds the most recently updated app instance with the given platformID.
+// If no such app is found it reports an error matching ErrNotFound.
+func (mgr *Manager) FindLatestByPlatformID(platformID string) (*Instance, error) {
+	var root string
+	err := mgr.db.QueryRow(`
+		SELECT root
+		FROM app
+		WHERE platform_id = ?
+		ORDER BY updated_at DESC
+		LIMIT 1
+	`, platformID).Scan(&root)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, errors.WithStack(ErrNotFound)
+	} else if err != nil {
+		return nil, errors.Wrap(err, "query app store")
+	}
+
+	return mgr.resolve(root)
+}
+
+func (mgr *Manager) FindLatestByPlatformOrLocalID(id string) (*Instance, error) {
+	// Local ID do not contain hyphens, platform ID's always contain hyphens.
+	if strings.Contains(id, "-") {
+		return mgr.FindLatestByPlatformID(id)
+	}
+
+	var root string
+	err := mgr.db.QueryRow(`
+		SELECT root
+		FROM app
+		WHERE local_id = ?
+		ORDER BY updated_at DESC
+		LIMIT 1
+	`, id).Scan(&root)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, errors.WithStack(ErrNotFound)
+	} else if err != nil {
+		return nil, errors.Wrap(err, "query app store")
+	}
+
+	return mgr.resolve(root)
+}
+
+// List lists all known apps.
+func (mgr *Manager) List() ([]*Instance, error) {
+	roots, err := mgr.listRoots()
+	if err != nil {
+		return nil, err
+	}
+
+	var apps []*Instance
+	for _, root := range roots {
+		app, err := mgr.resolve(root)
+		if errors.Is(err, fs.ErrNotExist) {
+			log.Debug().Str("root", root).Msg("app no longer exists, skipping")
+			// Delete the
+			_, _ = mgr.db.Exec(`DELETE FROM app WHERE root = ?`, root)
+			continue
+		} else if err != nil {
+			log.Error().Err(err).Str("root", root).Msg("unable to resolve app")
+			continue
+		}
+		apps = append(apps, app)
+	}
+
+	return apps, nil
+}
+
+func (mgr *Manager) listRoots() ([]string, error) {
+	rows, err := mgr.db.Query(`SELECT root FROM app`)
+	if err != nil {
+		return nil, errors.Wrap(err, "query app roots")
+	}
+	defer fns.CloseIgnore(rows)
+
+	var roots []string
+	for rows.Next() {
+		var root string
+		if err := rows.Scan(&root); err != nil {
+			return nil, errors.Wrap(err, "scan row")
+		}
+		roots = append(roots, root)
+	}
+	err = errors.Wrap(rows.Err(), "iterate rows")
+	return roots, err
+}
+
+// RegisterAppListener registers a callback that gets invoked every time
+// an app is tracked.
+func (mgr *Manager) RegisterAppListener(fn func(*Instance)) {
+	mgr.instanceMu.Lock()
+	defer mgr.instanceMu.Unlock()
+
+	mgr.appRegMu.Lock()
+	mgr.appListeners = append(mgr.appListeners, fn)
+	mgr.appRegMu.Unlock()
+
+	// Call the handler for all existing apps
+	for _, inst := range mgr.instances {
+		fn(inst)
+	}
+}
+
+// WatchFunc is the signature of functions registered as app watchers.
+type WatchFunc func(*Instance, []watcher.Event)
+
+// WatchAll watches all apps for changes.
+func (mgr *Manager) WatchAll(fn WatchFunc) error {
+	err := mgr.setupWatch.Do(func() error {
+		// Begin tracking all known apps by calling List (since it calls resolve).
+		_, err := mgr.List()
+		return err
+	})
+	if err != nil {
+		return err
+	}
+
+	mgr.watchMu.Lock()
+	mgr.watchers = append(mgr.watchers, fn)
+	mgr.watchMu.Unlock()
+	return nil
+}
+
+func (mgr *Manager) onWatchEvent(i *Instance, ev []watcher.Event) {
+	mgr.watchMu.Lock()
+	watchers := mgr.watchers
+	mgr.watchMu.Unlock()
+	for _, fn := range watchers {
+		fn(i, ev)
+	}
+}
+
+// resolve resolves the current information about the app located at appRoot.
+// If the app does not exist (either because appRoot does not exist,
+// or because encore.app does not exist within it), it reports an error
+// matching fs.ErrNotExist.
+func (mgr *Manager) resolve(appRoot string) (*Instance, error) {
+	mgr.instanceMu.Lock()
+	defer mgr.instanceMu.Unlock()
+
+	if existing, ok := mgr.instances[appRoot]; ok {
+		return existing, nil
+	}
+
+	platformID, err := readPlatformID(appRoot)
+	if err != nil {
+		return nil, err
+	}
+
+	// Parse the manifest file
+	man, err := manifest.ReadOrCreate(appRoot)
+	if err != nil {
+		return nil, errors.Wrap(err, "parse manifest")
+	}
+
+	i := NewInstance(appRoot, man.LocalID, platformID)
+	i.tutorial = man.Tutorial
+	i.mgr = mgr
+	if err := i.beginWatch(); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		log.Error().Err(err).Str("id", i.PlatformOrLocalID()).Msg("unable to begin watching app")
+	}
+	mgr.instances[appRoot] = i
+
+	// Notify any listeners about the new app
+	for _, fn := range mgr.appListeners {
+		fn(i)
+	}
+
+	return i, nil
+}
+
+func (mgr *Manager) Close() error {
+	mgr.instanceMu.Lock()
+	defer mgr.instanceMu.Unlock()
+
+	for _, inst := range mgr.instances {
+		if err := inst.Close(); err != nil {
+			log.Err(err).Str("id", inst.PlatformOrLocalID()).Msg("unable to close app instance")
+			// do not return an error here as we want to close all instances
+		}
+	}
+
+	return nil
+}
+
+// Instance describes an app instance known by the Encore daemon.
+type Instance struct {
+	root       string
+	localID    string
+	platformID *goldfish.Cache[string]
+	tutorial   string
+
+	// mgr is a reference to the manager that created it.
+	// It may be nil if an instance was created without a manager.
+	mgr     *Manager
+	watcher *watcher.Watcher
+
+	setupWatch  syncutil.Once
+	watchMu     sync.Mutex
+	nextWatchID WatchSubscriptionID
+	watchers    map[WatchSubscriptionID]*watchSubscription
+
+	mdMu     sync.Mutex
+	cachedMd *meta.Data
+}
+
+func NewInstance(root, localID, platformID string) *Instance {
+	i := &Instance{
+		root:     root,
+		localID:  localID,
+		watchers: make(map[WatchSubscriptionID]*watchSubscription),
+	}
+	i.platformID = goldfish.New[string](1*time.Second, i.fetchPlatformID)
+	if platformID != "" {
+		i.platformID.Set(platformID)
+	}
+	return i
+}
+
+func (i *Instance) Tutorial() string {
+	return i.tutorial
+}
+
+// Root returns the filesystem path for the app root.
+// It always returns a non-empty string.
+func (i *Instance) Root() string { return i.root }
+
+// LocalID reports a local, random id unique for this app,
+// as persisted in the .encore/manifest.json file.
+// It always returns a non-empty string.
+func (i *Instance) LocalID() string { return i.localID }
+
+// PlatformID reports the Encore Platform's ID for this app.
+// If the app is not linked it reports the empty string.
+func (i *Instance) PlatformID() string {
+	val, _ := i.platformID.Get()
+	return val
+}
+
+// PlatformOrLocalID reports PlatformID() if set and otherwise LocalID().
+func (i *Instance) PlatformOrLocalID() string {
+	if id := i.PlatformID(); id != "" {
+		return id
+	}
+	return i.localID
+}
+
+// Name returns the platform ID for the app, or if there isn't one
+// it returns the folder name the app is in.
+func (i *Instance) Name() string {
+	if id := i.PlatformID(); id != "" {
+		return id
+	}
+
+	return filepath.Base(i.root)
+}
+
+func (i *Instance) fetchPlatformID() (string, error) {
+	return readPlatformID(i.root)
+}
+
+func readPlatformID(appRoot string) (string, error) {
+	// Parse the encore.app file
+	path := filepath.Join(appRoot, appfile.Name)
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return "", err
+	}
+	encore, err := appfile.Parse(data)
+	if err != nil {
+		return "", errors.Wrap(err, "parse encore.app")
+	}
+	return encore.ID, nil
+}
+
+// Experiments returns the enabled experiments for this app.
+//
+// Note: we read the app file here instead of a cached value so we
+// can detect changes between runs of the compiler if we're in
+// watch mode.
+func (i *Instance) Experiments(environ []string) (*experiments.Set, error) {
+	exp, err := appfile.Experiments(i.root)
+	if err != nil {
+		return nil, err
+	}
+
+	return experiments.FromAppFileAndEnviron(exp, environ)
+}
+
+func (i *Instance) Lang() appfile.Lang {
+	appFile, err := appfile.ParseFile(filepath.Join(i.root, appfile.Name))
+	if err != nil {
+		return appfile.LangGo
+	}
+	return appFile.Lang
+}
+
+func (i *Instance) AppFile() (*appfile.File, error) {
+	return appfile.ParseFile(filepath.Join(i.root, appfile.Name))
+}
+
+func (i *Instance) BuildSettings() (appfile.Build, error) {
+	appFile, err := appfile.ParseFile(filepath.Join(i.root, appfile.Name))
+	if err != nil {
+		return appfile.Build{}, err
+	}
+	return appFile.Build, nil
+}
+
+// GlobalCORS returns the CORS configuration for the app which
+// will be applied against all API gateways into the app
+func (i *Instance) GlobalCORS() (appfile.CORS, error) {
+	cors, err := appfile.GlobalCORS(i.root)
+	if err != nil {
+		return appfile.CORS{}, err
+	}
+
+	// If there are no Global CORS return the default
+	if cors == nil {
+		return appfile.CORS{}, nil
+	}
+
+	return *cors, nil
+
+}
+
+func (i *Instance) Watch(fn WatchFunc) (WatchSubscriptionID, error) {
+	if err := i.beginWatch(); err != nil {
+		return 0, err
+	}
+
+	i.watchMu.Lock()
+	i.nextWatchID++
+	id := i.nextWatchID
+	i.watchers[id] = &watchSubscription{id, fn}
+	i.watchMu.Unlock()
+	return id, nil
+}
+
+func (i *Instance) Unwatch(id WatchSubscriptionID) {
+	i.watchMu.Lock()
+	delete(i.watchers, id)
+	i.watchMu.Unlock()
+}
+
+func (i *Instance) beginWatch() error {
+	return i.setupWatch.Do(func() error {
+		watch, err := watcher.New(i.PlatformOrLocalID())
+		if err != nil {
+			return errors.Wrap(err, "unable to create watcher")
+		}
+		i.watcher = watch
+
+		if err := i.watcher.RecursivelyWatch(i.root); err != nil {
+			return errors.Wrap(err, "unable to watch app")
+		}
+
+		// If we're in dev mode, we want to watch the runtime
+		// too, so we can develop changes to the runtime without
+		// needing to restart the application.
+		if conf.DevDaemon {
+			if err := i.watcher.RecursivelyWatch(env.EncoreRuntimesPath()); err != nil {
+				return errors.Wrap(err, "unable to watch runtime")
+			}
+		}
+
+		go func() {
+			for {
+				events, ok := i.watcher.WaitForEvents()
+				if !ok {
+					// We're done watching.
+					return
+				}
+
+				if i.mgr != nil {
+					i.mgr.onWatchEvent(i, events)
+				}
+
+				i.watchMu.Lock()
+				watchers := i.watchers
+				i.watchMu.Unlock()
+				for _, sub := range watchers {
+					sub.f(i, events)
+				}
+			}
+		}()
+
+		return nil
+	})
+}
+
+// CachePath returns the path to the cache directory for this app.
+// It creates the directory if it does not exist.
+func (i *Instance) CachePath() (string, error) {
+	cacheDir, err := conf.CacheDir()
+	if err != nil {
+		return "", errors.Wrap(err, "unable to get encore cache dir")
+	}
+
+	// we use local ID to be stable if the app is linked to the platform later
+	cacheDir = filepath.Join(cacheDir, i.localID)
+	if err := os.MkdirAll(cacheDir, 0755); err != nil {
+		return "", errors.Wrap(err, "unable to create app cache dir")
+	}
+
+	return cacheDir, nil
+}
+
+// CacheMetadata caches the metadata for this app onto the file system
+func (i *Instance) CacheMetadata(md *meta.Data) error {
+	i.mdMu.Lock()
+	defer i.mdMu.Unlock()
+
+	i.cachedMd = md
+
+	cacheDir, err := i.CachePath()
+	if err != nil {
+		return err
+	}
+
+	data, err := proto.Marshal(md)
+	if err != nil {
+		return errors.Wrap(err, "unable to marshal metadata")
+	}
+
+	err = xos.WriteFile(filepath.Join(cacheDir, "metadata.pb"), data, 0644)
+	if err != nil {
+		return errors.Wrap(err, "unable to write metadata")
+	}
+
+	return nil
+}
+
+// CachedMetadata returns the cached metadata for this app, if any
+func (i *Instance) CachedMetadata() (*meta.Data, error) {
+	i.mdMu.Lock()
+	defer i.mdMu.Unlock()
+
+	if i.cachedMd != nil {
+		return i.cachedMd, nil
+	}
+
+	cacheDir, err := i.CachePath()
+	if err != nil {
+		return nil, err
+	}
+
+	data, err := os.ReadFile(filepath.Join(cacheDir, "metadata.pb"))
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil, nil
+		}
+		return nil, errors.Wrap(err, "unable to read metadata")
+	}
+
+	md := &meta.Data{}
+	err = proto.Unmarshal(data, md)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to unmarshal metadata")
+	}
+
+	i.cachedMd = md
+	return md, nil
+}
+
+func (i *Instance) Close() error {
+	if i.watcher != nil {
+		return i.watcher.Close()
+	}
+	return nil
+}
+
+type WatchSubscriptionID int64
+
+type watchSubscription struct {
+	id WatchSubscriptionID
+	f  WatchFunc
+}
diff --git a/cli/daemon/check.go b/cli/daemon/check.go
new file mode 100644
index 0000000000..09f306cddd
--- /dev/null
+++ b/cli/daemon/check.go
@@ -0,0 +1,39 @@
+package daemon
+
+import (
+	"encr.dev/cli/daemon/run"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+// Check checks the app for compilation errors.
+func (s *Server) Check(req *daemonpb.CheckRequest, stream daemonpb.Daemon_CheckServer) error {
+	slog := &streamLog{stream: stream, buffered: false}
+	log := newStreamLogger(slog)
+
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		log.Error().Err(err).Msg("failed to resolve app")
+		streamExit(stream, 1)
+		return nil
+	}
+
+	buildDir, err := s.mgr.Check(stream.Context(), run.CheckParams{
+		App:          app,
+		WorkingDir:   req.WorkingDir,
+		CodegenDebug: req.CodegenDebug,
+		Environ:      req.Environ,
+		Tests:        req.ParseTests,
+	})
+
+	exitCode := 0
+	if err != nil {
+		exitCode = 1
+		log.Error().Msg(err.Error())
+	}
+
+	if req.CodegenDebug && buildDir != "" {
+		log.Info().Msgf("wrote generated code to: %s", buildDir)
+	}
+	streamExit(stream, exitCode)
+	return nil
+}
diff --git a/cli/daemon/common.go b/cli/daemon/common.go
new file mode 100644
index 0000000000..0465b5dc32
--- /dev/null
+++ b/cli/daemon/common.go
@@ -0,0 +1,178 @@
+package daemon
+
+import (
+	"io"
+	"net"
+	"os"
+	"runtime"
+	"strconv"
+	"strings"
+	"syscall"
+
+	"github.com/logrusorgru/aurora/v3"
+
+	"encr.dev/cli/daemon/run"
+	"encr.dev/cli/internal/onboarding"
+	"encr.dev/pkg/errlist"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+// OnStart implements run.EventListener.
+func (s *Server) OnStart(r *run.Run) {}
+
+func (s *Server) OnCompileStart(r *run.Run) {}
+
+// OnReload implements run.EventListener.
+func (s *Server) OnReload(r *run.Run) {}
+
+// OnStop implements run.EventListener.
+func (s *Server) OnStop(r *run.Run) {}
+
+// OnStdout implements run.EventListener.
+func (s *Server) OnStdout(r *run.Run, line []byte) {
+	s.mu.Lock()
+	slog, ok := s.streams[r.ID]
+	s.mu.Unlock()
+
+	if ok {
+		_, _ = slog.Stdout(true).Write(line)
+	}
+}
+
+// OnStderr implements run.EventListener.
+func (s *Server) OnStderr(r *run.Run, line []byte) {
+	s.mu.Lock()
+	slog, ok := s.streams[r.ID]
+	s.mu.Unlock()
+
+	if ok {
+		_, _ = slog.Stderr(true).Write(line)
+	}
+}
+
+func (s *Server) OnError(r *run.Run, err *errlist.List) {
+	s.mu.Lock()
+	slog, ok := s.streams[r.ID]
+	s.mu.Unlock()
+
+	if ok {
+		slog.Error(err)
+	}
+}
+
+func showFirstRunExperience(run *run.Run, md *meta.Data, stdout io.Writer) {
+	if state, err := onboarding.Load(); err == nil {
+		if !state.FirstRun.IsSet() {
+			// Is there a suitable endpoint to call?
+			var rpc *meta.RPC
+			var command string
+			for _, svc := range md.Svcs {
+				for _, r := range svc.Rpcs {
+					if cmd := genCurlCommand(run, md, r); rpc == nil || len(command) < len(cmd) {
+						rpc = r
+						command = cmd
+					}
+				}
+			}
+			if rpc != nil {
+				state.FirstRun.Set()
+				if err := state.Write(); err == nil {
+					_, _ = stdout.Write([]byte(aurora.Sprintf("\nHint: make an API call by running: %s\n", aurora.Cyan(command))))
+				}
+			}
+		}
+	}
+}
+
+// findAvailableAddr attempts to find an available host:port that's near
+// the given startAddr.
+func findAvailableAddr(startAddr string) (host string, port int, ok bool) {
+	host, portStr, err := net.SplitHostPort(startAddr)
+	if err != nil {
+		host = "localhost"
+		portStr = "4000"
+	}
+	startPort, err := strconv.Atoi(portStr)
+	if err != nil {
+		startPort = 4000
+	}
+
+	for p := startPort + 1; p <= startPort+10 && p <= 65535; p++ {
+		addr := host + ":" + strconv.Itoa(p)
+		ln, err := net.Listen("tcp", addr)
+		if err == nil {
+			_ = ln.Close()
+			return host, p, true
+		}
+	}
+	return "", 0, false
+}
+
+func genCurlCommand(run *run.Run, md *meta.Data, rpc *meta.RPC) string {
+	var payload []byte
+	method := rpc.HttpMethods[0]
+	switch method {
+	case "GET", "HEAD", "DELETE":
+		// doesn't use HTTP body payloads
+	default:
+		payload = genSchema(md, rpc.RequestSchema)
+	}
+
+	var segments []string
+	for _, seg := range rpc.Path.Segments {
+		var v string
+		switch seg.Type {
+		default:
+			v = "foo"
+		case meta.PathSegment_LITERAL:
+			v = seg.Value
+		case meta.PathSegment_WILDCARD, meta.PathSegment_FALLBACK:
+			v = "foo"
+		case meta.PathSegment_PARAM:
+			switch seg.ValueType {
+			case meta.PathSegment_STRING:
+				v = "foo"
+			case meta.PathSegment_BOOL:
+				v = "true"
+			case meta.PathSegment_INT8, meta.PathSegment_INT16, meta.PathSegment_INT32, meta.PathSegment_INT64,
+				meta.PathSegment_UINT8, meta.PathSegment_UINT16, meta.PathSegment_UINT32, meta.PathSegment_UINT64:
+				v = "1"
+			case meta.PathSegment_UUID:
+				v = "be23a21f-d12c-432c-91ec-fb8a52e23967" // some random UUID
+			default:
+				v = "foo"
+			}
+		}
+		segments = append(segments, v)
+	}
+
+	parts := []string{"curl"}
+	if (payload != nil && method != "POST") || (payload == nil && method != "GET") {
+		parts = append(parts, " -X ", method)
+	}
+	// nosemgrep
+	path := "/" + strings.Join(segments, "/")
+	parts = append(parts, " http://", run.ListenAddr, path)
+	if payload != nil {
+		parts = append(parts, " -d '", string(payload), "'")
+	}
+	return strings.Join(parts, "")
+}
+
+// errIsAddrInUse reports whether the error is due to the address already being in use.
+func errIsAddrInUse(err error) bool {
+	if opErr, ok := err.(*net.OpError); ok {
+		if syscallErr, ok := opErr.Err.(*os.SyscallError); ok {
+			if errno, ok := syscallErr.Err.(syscall.Errno); ok {
+				const WSAEADDRINUSE = 10048
+				switch {
+				case errno == syscall.EADDRINUSE:
+					return true
+				case runtime.GOOS == "windows" && errno == WSAEADDRINUSE:
+					return true
+				}
+			}
+		}
+	}
+	return false
+}
diff --git a/cli/daemon/create.go b/cli/daemon/create.go
new file mode 100644
index 0000000000..06b064dd89
--- /dev/null
+++ b/cli/daemon/create.go
@@ -0,0 +1,21 @@
+package daemon
+
+import (
+	"context"
+
+	"encr.dev/cli/daemon/apps"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+// CreateApp adds tracking for a new app
+func (s *Server) CreateApp(ctx context.Context, req *daemonpb.CreateAppRequest) (*daemonpb.CreateAppResponse, error) {
+	var options []apps.TrackOption
+	if req.Tutorial {
+		options = append(options, apps.WithTutorial(req.Template))
+	}
+	app, err := s.apps.Track(req.AppRoot, options...)
+	if err != nil {
+		return nil, err
+	}
+	return &daemonpb.CreateAppResponse{AppId: app.PlatformOrLocalID()}, nil
+}
diff --git a/cli/daemon/daemon.go b/cli/daemon/daemon.go
index 3bc1ad74f6..463ed23e6b 100644
--- a/cli/daemon/daemon.go
+++ b/cli/daemon/daemon.go
@@ -2,164 +2,228 @@
 package daemon
 
 import (
+	"bytes"
 	"context"
-	"fmt"
 	"io"
+	"strings"
 	"sync"
+	"sync/atomic"
+	"time"
 
-	"encr.dev/cli/daemon/internal/appfile"
-	"encr.dev/cli/daemon/run"
-	"encr.dev/cli/daemon/secret"
-	"encr.dev/cli/daemon/sqldb"
-	"encr.dev/cli/internal/codegen"
-	daemonpb "encr.dev/proto/encore/daemon"
-	meta "encr.dev/proto/encore/parser/meta/v1"
-	"encr.dev/proto/encore/server/remote"
+	"github.com/cockroachdb/errors"
 	"github.com/golang/protobuf/ptypes/empty"
 	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
 	"google.golang.org/genproto/googleapis/rpc/errdetails"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/mcp"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/run"
+	"encr.dev/cli/daemon/secret"
+	"encr.dev/cli/daemon/sqldb"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/cli/internal/update"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/builder/builderimpl"
+	"encr.dev/pkg/clientgen"
+	"encr.dev/pkg/clientgen/clientgentypes"
+	"encr.dev/pkg/errlist"
+	"encr.dev/pkg/fns"
+	daemonpb "encr.dev/proto/encore/daemon"
+	meta "encr.dev/proto/encore/parser/meta/v1"
 )
 
 var _ daemonpb.DaemonServer = (*Server)(nil)
 
 // Server implements daemonpb.DaemonServer.
 type Server struct {
-	version string
-	mgr     *run.Manager
-	cm      *sqldb.ClusterManager
-	sm      *secret.Manager
-	rc      remote.RemoteClient
+	apps *apps.Manager
+	mgr  *run.Manager
+	cm   *sqldb.ClusterManager
+	sm   *secret.Manager
+	ns   *namespace.Manager
+	mcp  *mcp.Manager
+
+	mu      sync.Mutex
+	streams map[string]*streamLog // run id -> stream
 
-	mu       sync.Mutex
-	streams  map[string]daemonpb.Daemon_RunServer // run id -> stream
-	appRoots map[string]string                    // cache of app id -> app root
+	availableVerInit sync.Once
+	availableVer     atomic.Value // string
+
+	appDebounceMu sync.Mutex
+	appDebouncers map[*apps.Instance]*regenerateCodeDebouncer
 
 	daemonpb.UnimplementedDaemonServer
 }
 
 // New creates a new Server.
-func New(version string, mgr *run.Manager, cm *sqldb.ClusterManager, sm *secret.Manager, rc remote.RemoteClient) *Server {
+func New(appsMgr *apps.Manager, mgr *run.Manager, cm *sqldb.ClusterManager, sm *secret.Manager, ns *namespace.Manager, mcp *mcp.Manager) *Server {
 	srv := &Server{
-		version:  version,
-		mgr:      mgr,
-		cm:       cm,
-		sm:       sm,
-		rc:       rc,
-		streams:  make(map[string]daemonpb.Daemon_RunServer),
-		appRoots: make(map[string]string),
+		apps:    appsMgr,
+		mgr:     mgr,
+		cm:      cm,
+		sm:      sm,
+		ns:      ns,
+		mcp:     mcp,
+		streams: make(map[string]*streamLog),
+
+		appDebouncers: make(map[*apps.Instance]*regenerateCodeDebouncer),
 	}
+
 	mgr.AddListener(srv)
+
+	// Check immediately for the latest version to avoid blocking 'encore run'
+	go srv.availableUpdate()
+
+	// Begin watching known apps for changes
+	go srv.watchApps()
+
 	return srv
 }
 
 // GenClient generates a client based on the app's API.
 func (s *Server) GenClient(ctx context.Context, params *daemonpb.GenClientRequest) (*daemonpb.GenClientResponse, error) {
 	var md *meta.Data
-	if params.EnvName == "local" {
+
+	envName := params.EnvName
+	if envName == "" {
+		envName = "local"
+	}
+
+	if envName == "local" {
 		// Determine the app root
-		s.mu.Lock()
-		appRoot, ok := s.appRoots[params.AppId]
-		s.mu.Unlock()
-		if !ok {
+		app, err := s.apps.FindLatestByPlatformOrLocalID(params.AppId)
+		if errors.Is(err, apps.ErrNotFound) {
 			return nil, status.Errorf(codes.FailedPrecondition, "the app %s must be run locally before generating a client for the 'local' environment.",
 				params.AppId)
+		} else if err != nil {
+			return nil, status.Errorf(codes.Internal, "unable to query app info: %v", err)
 		}
 
 		// Get the app metadata
-		result, err := s.parseApp(appRoot, ".", false)
+		expSet, err := app.Experiments(nil)
+		if err != nil {
+			return nil, status.Errorf(codes.InvalidArgument, "failed to parse app experiments: %v", err)
+		}
+
+		// Parse the app to figure out what infrastructure is needed.
+		bld := builderimpl.Resolve(app.Lang(), expSet)
+		defer fns.CloseIgnore(bld)
+		parse, err := bld.Parse(ctx, builder.ParseParams{
+			Build:       builder.DefaultBuildInfo(),
+			App:         app,
+			Experiments: expSet,
+			WorkingDir:  ".",
+			ParseTests:  false,
+		})
 		if err != nil {
 			return nil, status.Errorf(codes.InvalidArgument, "failed to parse app metadata: %v", err)
 		}
-		md = result.Meta
+		md = parse.Meta
+
+		if err := app.CacheMetadata(md); err != nil {
+			return nil, status.Errorf(codes.Internal, "failed to cache app metadata: %v", err)
+		}
 	} else {
-		meta, err := s.rc.Meta(ctx, &remote.MetaRequest{
-			AppSlug: params.AppId,
-			EnvName: params.EnvName,
-		})
+		meta, err := platform.GetEnvMeta(ctx, params.AppId, envName)
 		if err != nil {
-			return nil, status.Errorf(status.Code(err), "could not fetch API metadata: %v", err)
+			if strings.Contains(err.Error(), "env_not_found") || strings.Contains(err.Error(), "env_not_deployed") {
+				if envName == "@primary" {
+					return nil, status.Error(codes.NotFound, "You have no deployments of this application.\n\nYou can generate the client for your local code by setting `--env=local`.")
+				}
+				return nil, status.Errorf(codes.NotFound, "A deployed environment called `%s` not found.\n\nYou can generate the client for your local code by setting `--env=local`.", envName)
+			}
+			return nil, status.Errorf(codes.Unavailable, "could not fetch API metadata: %v", err)
 		}
 		md = meta
 	}
 
-	lang := codegen.Lang(params.Lang)
-	code, err := codegen.Client(lang, params.AppId, md)
+	lang := clientgen.Lang(params.Lang)
+
+	servicesToGenerate := clientgentypes.NewServiceSet(md, params.Services, params.ExcludedServices)
+	tagSet := clientgentypes.NewTagSet(params.EndpointTags, params.ExcludedEndpointTags)
+	opts := clientgentypes.Options{}
+	if params.OpenapiExcludePrivateEndpoints != nil {
+		opts.OpenAPIExcludePrivateEndpoints = *params.OpenapiExcludePrivateEndpoints
+	}
+	if params.TsSharedTypes != nil {
+		opts.TSSharedTypes = *params.TsSharedTypes
+	}
+	if params.TsClientTarget != nil {
+		opts.TSClientTarget = *params.TsClientTarget
+	}
+	code, err := clientgen.Client(lang, params.AppId, md, servicesToGenerate, tagSet, opts)
 	if err != nil {
 		return nil, status.Error(codes.InvalidArgument, err.Error())
 	}
 	return &daemonpb.GenClientResponse{Code: code}, nil
 }
 
-// SetSecret sets a secret key on the encore.dev platform.
-func (s *Server) SetSecret(ctx context.Context, req *daemonpb.SetSecretRequest) (*daemonpb.SetSecretResponse, error) {
-	// Get the app id from the app file
-	appSlug, err := appfile.Slug(req.AppRoot)
-	if err != nil {
-		return nil, status.Errorf(codes.InvalidArgument, err.Error())
-	} else if appSlug == "" {
-		return nil, errNotLinked
-	}
-
-	resp, err := s.rc.SetSecret(ctx, &remote.SetSecretRequest{
-		AppSlug: appSlug,
-		Key:     req.Key,
-		Value:   req.Value,
-		Type:    remote.SetSecretRequest_Type(req.Type),
-	})
+func (s *Server) SecretsRefresh(ctx context.Context, req *daemonpb.SecretsRefreshRequest) (*daemonpb.SecretsRefreshResponse, error) {
+	app, err := s.apps.Track(req.AppRoot)
 	if err != nil {
 		return nil, err
 	}
-	go s.sm.UpdateKey(appSlug, req.Key, req.Value)
-	return &daemonpb.SetSecretResponse{Created: resp.Created}, nil
+	s.sm.UpdateKey(app.PlatformID(), req.Key, req.Value)
+	return &daemonpb.SecretsRefreshResponse{}, nil
 }
 
 // Version reports the daemon version.
 func (s *Server) Version(context.Context, *empty.Empty) (*daemonpb.VersionResponse, error) {
-	return &daemonpb.VersionResponse{Version: s.version}, nil
-}
-
-// Logs streams logs from the encore.dev platform.
-func (s *Server) Logs(params *daemonpb.LogsRequest, stream daemonpb.Daemon_LogsServer) error {
-	appSlug, err := appfile.Slug(params.AppRoot)
+	configHash, err := version.ConfigHash()
 	if err != nil {
-		return status.Errorf(codes.InvalidArgument, err.Error())
-	} else if appSlug == "" {
-		return errNotLinked
+		return nil, err
 	}
 
-	logs, err := s.rc.Logs(stream.Context(), &remote.LogsRequest{
-		AppSlug: appSlug,
-		EnvName: params.EnvName,
-	})
-	if err != nil {
-		return err
-	}
-	for {
-		msg, err := logs.Recv()
-		if status.Code(err) == codes.Canceled {
-			return nil
-		} else if err != nil {
-			return err
-		}
-		err = stream.Send(&daemonpb.LogsMessage{
-			Lines:      msg.Lines,
-			DropNotice: msg.DropNotice,
-		})
+	return &daemonpb.VersionResponse{
+		Version:    version.Version,
+		ConfigHash: configHash,
+	}, nil
+}
+
+// availableUpdate checks for updates to Encore.
+// If there is a new version it returns it as a semver string.
+func (s *Server) availableUpdate() *update.LatestVersion {
+	check := func() *update.LatestVersion {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		ver, err := update.Check(ctx)
 		if err != nil {
-			return err
+			log.Error().Err(err).Msg("could not check for new encore release")
 		}
+		return ver
 	}
-}
 
-// cacheAppRoot adds the appID -> appRoot mapping to the app root cache.
-func (s *Server) cacheAppRoot(appID, appRoot string) {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	s.appRoots[appID] = appRoot
+	s.availableVerInit.Do(func() {
+		ver := check()
+		s.availableVer.Store(ver)
+		go func() {
+			for {
+				time.Sleep(1 * time.Hour)
+				if ver := check(); ver != nil {
+					s.availableVer.Store(ver)
+				}
+			}
+		}()
+	})
+
+	curr := version.Version
+	latest := s.availableVer.Load().(*update.LatestVersion)
+	if latest.IsNewer(curr) {
+		return latest
+	}
+	return nil
 }
 
+var errDatabaseNotFound = (func() error {
+	st := status.New(codes.NotFound, "database not found")
+	return st.Err()
+})()
+
 var errNotLinked = (func() error {
 	st, err := status.New(codes.FailedPrecondition, "app not linked").WithDetails(
 		&errdetails.PreconditionFailure{
@@ -181,35 +245,32 @@ type commandStream interface {
 	Send(msg *daemonpb.CommandMessage) error
 }
 
-func newStreamLogger(stream commandStream) zerolog.Logger {
-	return zerolog.New(zerolog.ConsoleWriter{Out: zerolog.SyncWriter(streamWriter{stream: stream})})
+func newStreamLogger(slog *streamLog) zerolog.Logger {
+	return zerolog.New(zerolog.SyncWriter(slog.Stderr(false))).With().Timestamp().Logger()
 }
 
 type streamWriter struct {
-	stream commandStream
+	mu     *sync.Mutex
+	sl     *streamLog
 	stderr bool // if true write to stderr, otherwise stdout
+	buffer bool
 }
 
 func (w streamWriter) Write(b []byte) (int, error) {
-	out := &daemonpb.CommandOutput{}
-	if w.stderr {
-		out.Stderr = b
-	} else {
-		out.Stdout = b
-	}
-	err := w.stream.Send(&daemonpb.CommandMessage{
-		Msg: &daemonpb.CommandMessage_Output{
-			Output: out,
-		},
-	})
-	if err != nil {
-		return 0, err
+	w.mu.Lock()
+	defer w.mu.Unlock()
+	if w.buffer && w.sl.buffered {
+		if w.stderr {
+			return w.sl.writeBuffered(&w.sl.stderr, b)
+		} else {
+			return w.sl.writeBuffered(&w.sl.stdout, b)
+		}
 	}
-	return len(b), nil
+	return w.sl.writeStream(w.stderr, b)
 }
 
 func streamExit(stream commandStream, code int) {
-	stream.Send(&daemonpb.CommandMessage{Msg: &daemonpb.CommandMessage_Exit{
+	_ = stream.Send(&daemonpb.CommandMessage{Msg: &daemonpb.CommandMessage_Exit{
 		Exit: &daemonpb.CommandExit{
 			Code: int32(code),
 		},
@@ -218,31 +279,66 @@ func streamExit(stream commandStream, code int) {
 
 type streamLog struct {
 	stream commandStream
+	mu     sync.Mutex
+
+	buffered bool
+	stdout   *bytes.Buffer // lazily allocated
+	stderr   *bytes.Buffer // lazily allocated
 }
 
-func (log streamLog) Stdout() io.Writer {
-	return streamWriter{stream: log.stream, stderr: false}
+func (log *streamLog) Stdout(buffer bool) io.Writer {
+	return streamWriter{mu: &log.mu, sl: log, stderr: false, buffer: buffer}
 }
 
-func (log streamLog) Stderr() io.Writer {
-	return streamWriter{stream: log.stream, stderr: true}
+func (log *streamLog) Stderr(buffer bool) io.Writer {
+	return streamWriter{mu: &log.mu, sl: log, stderr: true, buffer: buffer}
 }
 
-type runStreamAdapter struct {
-	stream daemonpb.Daemon_RunServer
+func (log *streamLog) Error(err *errlist.List) {
+	log.mu.Lock()
+	defer log.mu.Unlock()
+	_ = err.SendToStream(log.stream)
 }
 
-func (a runStreamAdapter) Send(msg *daemonpb.CommandMessage) error {
-	switch msg := msg.Msg.(type) {
-	case *daemonpb.CommandMessage_Output:
-		return a.stream.Send(&daemonpb.RunMessage{
-			Msg: &daemonpb.RunMessage_Output{Output: msg.Output},
-		})
-	case *daemonpb.CommandMessage_Exit:
-		return a.stream.Send(&daemonpb.RunMessage{
-			Msg: &daemonpb.RunMessage_Exit{Exit: msg.Exit},
-		})
-	default:
-		panic(fmt.Sprintf("unknown CommandMessage type %T", msg))
+func (log *streamLog) FlushBuffers() {
+	var stdout, stderr []byte
+	log.mu.Lock()
+	defer log.mu.Unlock()
+	if b := log.stdout; b != nil {
+		stdout = b.Bytes()
+		log.stdout = nil
+	}
+	if b := log.stderr; b != nil {
+		stderr = b.Bytes()
+		log.stderr = nil
+	}
+
+	_, _ = log.writeStream(false, stderr)
+	_, _ = log.writeStream(true, stdout)
+	log.buffered = false
+}
+
+func (log *streamLog) writeBuffered(b **bytes.Buffer, p []byte) (int, error) {
+	if *b == nil {
+		*b = &bytes.Buffer{}
 	}
+	return (*b).Write(p)
+}
+
+func (log *streamLog) writeStream(stderr bool, b []byte) (int, error) {
+	out := &daemonpb.CommandOutput{}
+	if stderr {
+		out.Stderr = b
+	} else {
+		out.Stdout = b
+	}
+	err := log.stream.Send(&daemonpb.CommandMessage{
+		Msg: &daemonpb.CommandMessage_Output{
+			Output: out,
+		},
+	})
+	if err != nil {
+		return 0, err
+	}
+	return len(b), nil
 }
diff --git a/cli/daemon/dash/ai/assembler.go b/cli/daemon/dash/ai/assembler.go
new file mode 100644
index 0000000000..289930e1bb
--- /dev/null
+++ b/cli/daemon/dash/ai/assembler.go
@@ -0,0 +1,278 @@
+package ai
+
+import (
+	"context"
+	"slices"
+	"strings"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/idents"
+	"encr.dev/v2/parser/apis/api/apienc"
+)
+
+// partialEndpoint is a helper struct that is used to assemble the endpoint
+// from the incoming websocket updates.
+type partialEndpoint struct {
+	service  string
+	endpoint *Endpoint
+}
+
+// notification generates a partially assembled endpoint structure to return to the client
+func (e *partialEndpoint) notification() LocalEndpointUpdate {
+	e.endpoint.EndpointSource = e.endpoint.Render()
+	e.endpoint.TypeSource = ""
+	for i, s := range e.endpoint.Types {
+		if i > 0 {
+			e.endpoint.TypeSource += "\n\n"
+		}
+		e.endpoint.TypeSource += s.Render()
+	}
+	return LocalEndpointUpdate{
+		Service:  e.service,
+		Endpoint: e.endpoint,
+		Type:     "EndpointUpdate",
+	}
+}
+
+func (e *partialEndpoint) upsertType(name, doc string) *Type {
+	if name == "" {
+		return nil
+	}
+	for _, s := range e.endpoint.Types {
+		if s.Name == name {
+			if doc != "" {
+				s.Doc = wrapDoc(doc, 77)
+			}
+			return s
+		}
+	}
+	si := &Type{Name: name, Doc: wrapDoc(doc, 77)}
+	e.endpoint.Types = append(e.endpoint.Types, si)
+	return si
+}
+
+func wrapDoc(doc string, width int) string {
+	doc = strings.ReplaceAll(doc, "\n", " ")
+	doc = strings.TrimSpace(doc)
+	bytes := []byte(doc)
+	i := 0
+	for {
+		start := i
+		if start+width >= len(bytes) {
+			break
+		}
+		i += width
+		for i > start && bytes[i] != ' ' {
+			i--
+		}
+		if i > start {
+			bytes[i] = '\n'
+		} else {
+			for i < len(bytes) && bytes[i] != ' ' {
+				i++
+			}
+			if i < len(bytes) {
+				bytes[i] = '\n'
+			}
+		}
+	}
+	return string(bytes)
+}
+
+func (e *partialEndpoint) upsertError(err ErrorUpdate) *Error {
+	for _, s := range e.endpoint.Errors {
+		if s.Code == err.Code {
+			if err.Doc != "" {
+				s.Doc = wrapDoc(err.Doc, 60)
+			}
+			return s
+		}
+	}
+	si := &Error{Code: err.Code, Doc: wrapDoc(err.Doc, 60)}
+	e.endpoint.Errors = append(e.endpoint.Errors, si)
+	return si
+}
+
+func (e *partialEndpoint) upsertPathParam(up PathParamUpdate) PathSegment {
+	for i, s := range e.endpoint.Path {
+		if s.Value != nil && *s.Value == up.Param {
+			if up.Doc != "" {
+				e.endpoint.Path[i].Doc = wrapDoc(up.Doc, 73)
+			}
+			return s
+		}
+	}
+	seg := PathSegment{
+		Type:      SegmentTypeParam,
+		ValueType: ptr[SegmentValueType]("string"),
+		Value:     &up.Param,
+		Doc:       wrapDoc(up.Doc, 73),
+	}
+	e.endpoint.Path = append(e.endpoint.Path, seg)
+	return seg
+}
+
+func (e *partialEndpoint) upsertField(up TypeFieldUpdate) *Type {
+	if up.Struct == "" {
+		return nil
+	}
+	s := e.upsertType(up.Struct, "")
+	for _, f := range s.Fields {
+		if f.Name == up.Name {
+			if up.Doc != "" {
+				f.Doc = wrapDoc(up.Doc, 73)
+			}
+			if up.Type != "" {
+				f.Type = up.Type
+			}
+			return s
+		}
+	}
+	defaultLoc := apienc.Body
+	isRequest := up.Struct == e.endpoint.RequestType
+	if slices.Contains([]string{"GET", "HEAD", "DELETE"}, e.endpoint.Method) && isRequest {
+		defaultLoc = apienc.Query
+	}
+	fi := &TypeField{
+		Name:     up.Name,
+		Doc:      wrapDoc(up.Doc, 73),
+		Type:     up.Type,
+		Location: defaultLoc,
+		WireName: idents.Convert(up.Name, idents.CamelCase),
+	}
+	s.Fields = append(s.Fields, fi)
+	return s
+}
+
+// The endpointsAssembler is a helper struct that is used to assemble the endpoint
+// from the incoming websocket updates. It keeps track of the existing endpoints and services
+// and updates them accordingly.
+type endpointsAssembler struct {
+	eps map[string]*partialEndpoint
+}
+
+func newEndpointAssembler(existing []Service) *endpointsAssembler {
+	eas := &endpointsAssembler{
+		eps: make(map[string]*partialEndpoint),
+	}
+	for _, svc := range existing {
+		for _, ep := range svc.Endpoints {
+			key := svc.Name + "." + ep.Name
+			eas.eps[key] = &partialEndpoint{
+				service:  svc.Name,
+				endpoint: ep,
+			}
+		}
+	}
+	return eas
+}
+
+func (s *endpointsAssembler) upsertEndpoint(e EndpointUpdate) *partialEndpoint {
+	for _, ep := range s.eps {
+		if ep.service != e.Service || ep.endpoint.Name != e.Name {
+			continue
+		}
+		if e.Doc != "" {
+			ep.endpoint.Doc = wrapDoc(e.Doc, 77)
+		}
+		if e.Method != "" {
+			ep.endpoint.Method = e.Method
+		}
+		if e.Visibility != "" {
+			ep.endpoint.Visibility = e.Visibility
+		}
+		if len(e.Path) > 0 {
+			ep.endpoint.Path = e.Path
+		}
+		if e.RequestType != "" {
+			ep.endpoint.RequestType = e.RequestType
+			ep.upsertType(e.RequestType, "")
+		}
+		if e.ResponseType != "" {
+			ep.endpoint.ResponseType = e.ResponseType
+			ep.upsertType(e.ResponseType, "")
+		}
+		if e.Errors != nil {
+			ep.endpoint.Errors = fns.Map(e.Errors, func(e string) *Error {
+				return &Error{Code: e}
+			})
+		}
+		return ep
+	}
+	ep := &partialEndpoint{
+		service: e.Service,
+		endpoint: &Endpoint{
+			Name:         e.Name,
+			Doc:          wrapDoc(e.Doc, 77),
+			Method:       e.Method,
+			Visibility:   e.Visibility,
+			Path:         e.Path,
+			RequestType:  e.RequestType,
+			ResponseType: e.ResponseType,
+			Errors: fns.Map(e.Errors, func(e string) *Error {
+				return &Error{Code: e}
+			}),
+			Language: "GO",
+		},
+	}
+	s.eps[e.Service+"."+e.Name] = ep
+	return ep
+}
+
+func (s *endpointsAssembler) endpoint(service, endpoint string) *partialEndpoint {
+	key := service + "." + endpoint
+	ep, ok := s.eps[key]
+	if !ok {
+		ep := &partialEndpoint{
+			service:  service,
+			endpoint: &Endpoint{Name: endpoint},
+		}
+		s.eps[key] = ep
+	}
+	return ep
+}
+
+func newEndpointAssemblerHandler(existing []Service, notifier AINotifier, epComplete bool) AINotifier {
+	epCache := newEndpointAssembler(existing)
+	var lastEp *partialEndpoint
+	return func(ctx context.Context, msg *AINotification) error {
+		var ep *partialEndpoint
+		msgVal := msg.Value
+		switch val := msg.Value.(type) {
+		case TypeUpdate:
+			ep = epCache.endpoint(val.Service, val.Endpoint)
+			ep.upsertType(val.Name, val.Doc)
+			msgVal = ep.notification()
+		case TypeFieldUpdate:
+			ep = epCache.endpoint(val.Service, val.Endpoint)
+			ep.upsertField(val)
+			msgVal = ep.notification()
+		case EndpointUpdate:
+			ep = epCache.upsertEndpoint(val)
+			msgVal = ep.notification()
+		case ErrorUpdate:
+			ep = epCache.endpoint(val.Service, val.Endpoint)
+			ep.upsertError(val)
+			msgVal = ep.notification()
+		case PathParamUpdate:
+			ep = epCache.endpoint(val.Service, val.Endpoint)
+			ep.upsertPathParam(val)
+			msgVal = ep.notification()
+		}
+		if epComplete && lastEp != ep {
+			if lastEp != nil {
+				msg.Value = struct {
+					Type     string `json:"type"`
+					Service  string `json:"service"`
+					Endpoint string `json:"endpoint"`
+				}{"EndpointComplete", lastEp.service, lastEp.endpoint.Name}
+				if err := notifier(ctx, msg); err != nil || msg.Finished {
+					return err
+				}
+			}
+			lastEp = ep
+		}
+		msg.Value = msgVal
+		return notifier(ctx, msg)
+	}
+}
diff --git a/cli/daemon/dash/ai/client.go b/cli/daemon/dash/ai/client.go
new file mode 100644
index 0000000000..18762a4c31
--- /dev/null
+++ b/cli/daemon/dash/ai/client.go
@@ -0,0 +1,153 @@
+package ai
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/hasura/go-graphql-client"
+	"github.com/hasura/go-graphql-client/pkg/jsonutil"
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/internal/conf"
+)
+
+type TaskMessage struct {
+	Type string `graphql:"__typename"`
+
+	ServiceUpdate   `graphql:"... on ServiceUpdate"`
+	TypeUpdate      `graphql:"... on TypeUpdate"`
+	TypeFieldUpdate `graphql:"... on TypeFieldUpdate"`
+	ErrorUpdate     `graphql:"... on ErrorUpdate"`
+	EndpointUpdate  `graphql:"... on EndpointUpdate"`
+	SessionUpdate   `graphql:"... on SessionUpdate"`
+	TitleUpdate     `graphql:"... on TitleUpdate"`
+	PathParamUpdate `graphql:"... on PathParamUpdate"`
+}
+
+func (u *TaskMessage) GetValue() AIUpdateType {
+	switch u.Type {
+	case "ServiceUpdate":
+		return u.ServiceUpdate
+	case "TypeUpdate":
+		return u.TypeUpdate
+	case "TypeFieldUpdate":
+		return u.TypeFieldUpdate
+	case "ErrorUpdate":
+		return u.ErrorUpdate
+	case "EndpointUpdate":
+		return u.EndpointUpdate
+	case "SessionUpdate":
+		return u.SessionUpdate
+	case "TitleUpdate":
+		return u.TitleUpdate
+	case "PathParamUpdate":
+		return u.PathParamUpdate
+	}
+	return nil
+}
+
+type AIStreamMessage struct {
+	Value    TaskMessage
+	Error    string
+	Finished bool
+}
+
+type aiTask struct {
+	Message *AIStreamMessage `graphql:"result"`
+}
+
+func getClient(errHandler func(err error)) *graphql.SubscriptionClient {
+	client := graphql.NewSubscriptionClient(conf.WSBaseURL + "/graphql").
+		WithRetryTimeout(5 * time.Second).
+		WithRetryDelay(2 * time.Second).
+		WithRetryStatusCodes("500-599").
+		WithWebSocketOptions(
+			graphql.WebsocketOptions{
+				HTTPClient: conf.AuthClient,
+			}).WithSyncMode(true)
+	go func() {
+		log.Info().Msg("starting ai client")
+		err := client.Run()
+		log.Info().Msg("closed ai client")
+		if err != nil {
+			errHandler(err)
+		}
+	}()
+	return client
+}
+
+type AITask struct {
+	SubscriptionID string
+	client         *graphql.SubscriptionClient
+}
+
+func (t *AITask) Stop() error {
+	return t.client.Unsubscribe(t.SubscriptionID)
+}
+
+// startAITask is a helper function to intitiate an AI query to the encore platform. The query
+// should be assembled to stream a 'result' graphql field that is a AIStreamMessage.
+func startAITask[Query any](ctx context.Context, params map[string]interface{}, notifier AINotifier) (*AITask, error) {
+	var subId string
+	var errStrReply = func(error string, code any) error {
+		log.Error().Msgf("ai error: %s (%v)", error, code)
+		_ = notifier(ctx, &AINotification{
+			SubscriptionID: subId,
+			Error:          &AIError{Message: error, Code: fmt.Sprintf("%v", code)},
+			Finished:       true,
+		})
+		return graphql.ErrSubscriptionStopped
+	}
+	var errReply = func(err error) error {
+		var graphqlErr graphql.Errors
+		if errors.As(err, &graphqlErr) {
+			for _, e := range graphqlErr {
+				_ = errStrReply(e.Message, e.Extensions["code"])
+			}
+			return graphql.ErrSubscriptionStopped
+		}
+		return errStrReply(err.Error(), "")
+	}
+	var query Query
+	client := getClient(func(err error) { _ = errReply(err) })
+	subId, err := client.Subscribe(&query, params, func(message []byte, err error) error {
+		if err != nil {
+			return errReply(err)
+		}
+		var result aiTask
+		err = jsonutil.UnmarshalGraphQL(message, &result)
+		if err != nil {
+			return errReply(err)
+		}
+		if result.Message.Error != "" {
+			return errStrReply(result.Message.Error, "")
+		}
+		err = notifier(ctx, &AINotification{
+			SubscriptionID: subId,
+			Value:          result.Message.Value.GetValue(),
+			Finished:       result.Message.Finished,
+		})
+		if err != nil {
+			return errReply(err)
+		}
+		return nil
+	})
+	return &AITask{SubscriptionID: subId, client: client}, err
+}
+
+// AINotification is a wrapper around messages and errors from the encore platform ai service
+type AINotification struct {
+	SubscriptionID string   `json:"subscriptionId,omitempty"`
+	Value          any      `json:"value,omitempty"`
+	Error          *AIError `json:"error,omitempty"`
+	Finished       bool     `json:"finished,omitempty"`
+}
+
+type AIError struct {
+	Message string `json:"message"`
+	Code    string `json:"code"`
+}
+
+type AINotifier func(context.Context, *AINotification) error
diff --git a/cli/daemon/dash/ai/codegen.go b/cli/daemon/dash/ai/codegen.go
new file mode 100644
index 0000000000..ab167b5a55
--- /dev/null
+++ b/cli/daemon/dash/ai/codegen.go
@@ -0,0 +1,418 @@
+package ai
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"path"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"golang.org/x/exp/maps"
+	"golang.org/x/tools/go/packages"
+	"golang.org/x/tools/imports"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/internal/env"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/codegen/rewrite"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/apis/api/apienc"
+	"encr.dev/v2/parser/apis/directive"
+)
+
+const defAuthHandler = `package auth
+
+import (
+	"context"
+
+	"encore.dev/beta/auth"
+)
+
+type Data struct {
+    Username string
+}
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, token string) (auth.UID, *Data, error) {
+    panic("not yet implemented")
+}`
+
+const (
+	PathDocPrefix = "Path Parameters"
+	ErrDocPrefix  = "Errors"
+)
+
+func (p PathSegments) Render() (docPath string, goParams []string) {
+	var params []string
+	return "/" + path.Join(fns.Map(p, func(s PathSegment) string {
+		switch s.Type {
+		case SegmentTypeLiteral:
+			return *s.Value
+		case SegmentTypeParam:
+			params = append(params, fmt.Sprintf("%s %s", *s.Value, *s.ValueType))
+			return fmt.Sprintf(":%s", *s.Value)
+		case SegmentTypeWildcard:
+			params = append(params, fmt.Sprintf("%s %s", *s.Value, SegmentValueTypeString))
+			return fmt.Sprintf("*%s", *s.Value)
+		case SegmentTypeFallback:
+			params = append(params, fmt.Sprintf("%s %s", *s.Value, SegmentValueTypeString))
+			return fmt.Sprintf("!%s", *s.Value)
+		default:
+			panic(fmt.Sprintf("unknown path segment type: %s", s.Type))
+		}
+	})...), params
+}
+
+func (s *Type) Render() string {
+	rtn := strings.Builder{}
+	if s.Doc != "" {
+		rtn.WriteString(fmtComment(strings.TrimSpace(s.Doc), 0, 1))
+	}
+	rtn.WriteString(fmt.Sprintf("type %s struct {\n", s.Name))
+	for i, f := range s.Fields {
+		if i > 0 {
+			rtn.WriteString("\n")
+		}
+		if f.Doc != "" {
+			rtn.WriteString(fmtComment(strings.TrimSpace(f.Doc), 2, 1))
+		}
+		tags := ""
+		switch f.Location {
+		case apienc.Body:
+			tags = fmt.Sprintf(" `json:\"%s\"`", f.WireName)
+		case apienc.Query:
+			tags = fmt.Sprintf(" `query:\"%s\"`", f.WireName)
+		case apienc.Header:
+			tags = fmt.Sprintf(" `header:\"%s\"`", f.WireName)
+		}
+		rtn.WriteString(fmt.Sprintf("  %s %s%s\n", f.Name, f.Type, tags))
+	}
+	rtn.WriteString("}")
+	return rtn.String()
+}
+
+func (e *Endpoint) Render() string {
+	buf := strings.Builder{}
+	if e.Doc != "" {
+		buf.WriteString(fmtComment(strings.TrimSpace(e.Doc)+"\n", 0, 1))
+	}
+	buf.WriteString(renderDocList(PathDocPrefix, e.Path))
+	buf.WriteString(renderDocList(ErrDocPrefix, e.Errors))
+	pathStr, pathParams := e.Path.Render()
+	params := []string{"ctx context.Context"}
+	params = append(params, pathParams...)
+	if e.RequestType != "" {
+		params = append(params, "req *"+e.RequestType)
+	}
+	var rtnParams []string
+	if e.ResponseType != "" {
+		rtnParams = append(rtnParams, "*"+e.ResponseType)
+	}
+	rtnParams = append(rtnParams, "error")
+	buf.WriteString(fmtComment("encore:api %s method=%s path=%s", 0, 0, e.Visibility, e.Method, pathStr))
+	paramsStr := strings.Join(params, ", ")
+	rtnParamsStr := strings.Join(rtnParams, ", ")
+	if len(rtnParams) > 1 {
+		rtnParamsStr = fmt.Sprintf("(%s)", rtnParamsStr)
+	}
+	buf.WriteString(fmt.Sprintf("func %s(%s) %s", e.Name, paramsStr, rtnParamsStr))
+	return buf.String()
+}
+
+func indentItem(header, comment string) string {
+	buf := strings.Builder{}
+	buf.WriteString(header)
+	for i, line := range strings.Split(strings.TrimSpace(comment), "\n") {
+		indent := ""
+		if i > 0 {
+			indent = strings.Repeat(" ", len(header))
+		}
+		buf.WriteString(fmt.Sprintf("%s%s\n", indent, line))
+	}
+	return buf.String()
+}
+
+func renderDocList[T interface{ DocItem() (string, string) }](header string, items []T) string {
+	maxLen := 0
+	items = fns.Filter(items, func(p T) bool {
+		key, val := p.DocItem()
+		if val == "" {
+			return false
+		}
+		maxLen = max(maxLen, len(key))
+		return true
+	})
+	buf := strings.Builder{}
+	for i, item := range items {
+		if i == 0 {
+			buf.WriteString(header)
+			buf.WriteString(":\n")
+		}
+		key, value := item.DocItem()
+		spacing := strings.Repeat(" ", maxLen-len(key))
+		itemHeader := fmt.Sprintf(" - %s: %s", key, spacing)
+		buf.WriteString(indentItem(itemHeader, value))
+	}
+	return fmtComment(buf.String(), 0, 1)
+}
+
+// fmtComment prepends '//' to each line of the given comment and indents it with the given number of spaces.
+func fmtComment(comment string, before, after int, args ...any) string {
+	if comment == "" {
+		return ""
+	}
+	prefix := fmt.Sprintf("%s//%s", strings.Repeat(" ", before), strings.Repeat(" ", after))
+	result := prefix + strings.ReplaceAll(comment, "\n", "\n"+prefix)
+	return fmt.Sprintf(result, args...) + "\n"
+}
+
+// generateSrcFiles generates source files for the given services.
+func generateSrcFiles(services []Service, app *apps.Instance) (map[paths.RelSlash]string, error) {
+	svcPaths, err := newServicePaths(app)
+	if err != nil {
+		return nil, err
+	}
+	needAuth := fns.Any(fns.FlatMap(services, Service.GetEndpoints), (*Endpoint).Auth)
+	files := map[paths.RelSlash]string{}
+	if needAuth {
+		md, err := app.CachedMetadata()
+		if err != nil {
+			return nil, err
+		}
+		if md.AuthHandler == nil {
+			relFile, err := svcPaths.RelFileName("auth", "handler")
+			if err != nil {
+				return nil, err
+			}
+			file := paths.FS(app.Root()).JoinSlash(relFile)
+			err = os.MkdirAll(file.Dir().ToIO(), 0755)
+			if err != nil {
+				return nil, err
+			}
+			files[relFile] = string(defAuthHandler)
+		}
+	}
+	for _, s := range services {
+		if svcPaths.IsNew(s.Name) {
+			relFile, err := svcPaths.RelFileName(s.Name, s.Name)
+			if err != nil {
+				return nil, err
+			}
+			file := paths.FS(app.Root()).JoinSlash(relFile)
+			err = os.MkdirAll(file.Dir().ToIO(), 0755)
+			if err != nil {
+				return nil, err
+			}
+			files[relFile] = fmt.Sprintf("%spackage %s\n", fmtComment(s.Doc, 0, 1), strings.ToLower(s.Name))
+		}
+		for _, e := range s.Endpoints {
+			relFile, err := svcPaths.RelFileName(s.Name, e.Name)
+			if err != nil {
+				return nil, err
+			}
+			filePath := paths.FS(app.Root()).JoinSlash(relFile)
+			_, content := toSrcFile(filePath, s.Name, e.EndpointSource, e.TypeSource)
+			files[relFile], err = addMissingFuncBodies(content)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+	return files, nil
+}
+
+// addMissingFuncBodies adds a panic statement to functions that are missing a body.
+// This is used to generate a valid Go source file when the user has not implemented
+// the body of the endpoint functions.
+func addMissingFuncBodies(content []byte) (string, error) {
+	set := token.NewFileSet()
+	rewriter := rewrite.New(content, 0)
+	file, err := parser.ParseFile(set, "", content, parser.ParseComments|parser.AllErrors)
+	if err != nil {
+		return "", err
+	}
+	ast.Inspect(file, func(n ast.Node) bool {
+		switch n := n.(type) {
+		case *ast.FuncDecl:
+			if n.Body != nil {
+				break
+			}
+			rewriter.Insert(n.End()-1, []byte(" {\n    panic(\"not yet implemented\")\n}\n"))
+		}
+		return true
+	})
+	return string(rewriter.Data()), err
+}
+
+// writeFiles writes the generated source files to disk.
+func writeFiles(services []Service, app *apps.Instance) ([]paths.RelSlash, error) {
+	files, err := generateSrcFiles(services, app)
+	if err != nil {
+		return nil, err
+	}
+	for fileName, content := range files {
+		root := paths.FS(app.Root())
+		err = os.WriteFile(root.JoinSlash(fileName).ToIO(), []byte(content), 0644)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return maps.Keys(files), nil
+}
+
+// toSrcFile wraps a code fragment in a package declaration and adds missing imports
+// using the goimports tool.
+func toSrcFile(filePath paths.FS, svc string, srcs ...string) (offset token.Position, data []byte) {
+	const divider = "// @code-start\n"
+	header := fmt.Sprintf("package %s\n\n", strings.ToLower(svc))
+	src := []byte(header + divider + strings.Join(srcs, "\n"))
+	importedSrc, err := imports.Process(filePath.ToIO(), src, &imports.Options{
+		Comments:  true,
+		TabIndent: false,
+		TabWidth:  4,
+	})
+	// We don't need to handle the error here, as we'll catch parser/scanner errors in a later
+	// phase. This is just a best effort to import missing packages.
+	if err == nil {
+		src = importedSrc
+	}
+	codeOffset := bytes.Index(src, []byte(divider))
+	// Remove the divider and any formatting made by the imports tool
+	src = append(src[:codeOffset], strings.Join(srcs, "\n")...)
+	// Compute offset of the user defined code
+	lines := strings.Split(string(src[:codeOffset]), "\n")
+	return token.Position{
+		Filename: filePath.ToIO(),
+		Offset:   codeOffset,
+		Line:     len(lines) - 1,
+		Column:   0,
+	}, src
+}
+
+// updateCode updates the source code fields of the EndpointInputs in the given services.
+// if overwrite is set, the code will be regenerated from scratch and replace the existing code,
+// otherwise, we'll modify the code in place
+func updateCode(ctx context.Context, services []Service, app *apps.Instance, overwrite bool) (rtn *SyncResult, err error) {
+	overlays, err := newOverlays(app, overwrite, services...)
+	fset := token.NewFileSet()
+	perrs := perr.NewList(ctx, fset, overlays.ReadFile)
+	defer func() {
+		perr.CatchBailout(recover())
+		if rtn == nil {
+			rtn = &SyncResult{
+				Services: services,
+			}
+		}
+		rtn.Errors = overlays.validationErrors(perrs)
+	}()
+	for p, olay := range overlays.items {
+		astFile, err := parser.ParseFile(fset, p.ToIO(), olay.content, parser.ParseComments|parser.AllErrors)
+		if err != nil {
+			perrs.AddStd(err)
+		}
+		rewriter := rewrite.New(olay.content, int(astFile.FileStart))
+		typeByName := map[string]*ast.GenDecl{}
+		funcByName := map[string]*ast.FuncDecl{}
+		for _, decl := range astFile.Decls {
+			switch decl := decl.(type) {
+			case *ast.GenDecl:
+				if decl.Tok != token.TYPE {
+					continue
+				}
+				for _, spec := range decl.Specs {
+					typeSpec := spec.(*ast.TypeSpec)
+					typeByName[typeSpec.Name.Name] = decl
+				}
+			case *ast.FuncDecl:
+				funcByName[decl.Name.Name] = decl
+			}
+		}
+		if olay.codeType == CodeTypeEndpoint {
+			funcDecl, ok := funcByName[olay.endpoint.Name]
+			if !ok {
+				for _, f := range funcByName {
+					dir, _, _ := directive.Parse(perrs, f.Doc)
+					if dir != nil && dir.Name == "api" {
+						funcDecl = f
+						break
+					}
+				}
+			}
+			if funcDecl != nil {
+				start := funcDecl.Pos()
+				if funcDecl.Doc != nil {
+					start = funcDecl.Doc.Pos()
+				}
+				end := funcDecl.End()
+				if funcDecl.Body != nil {
+					end = funcDecl.Body.Lbrace
+				}
+				rewriter.Replace(start, end, []byte(olay.endpoint.Render()))
+			} else {
+				if len(funcByName) > 0 {
+					rewriter.Append([]byte("\n"))
+				}
+				rewriter.Append([]byte(olay.endpoint.Render()))
+			}
+			olay.content = rewriter.Data()
+			content := string(olay.content[olay.headerOffset.Offset:])
+			olay.endpoint.EndpointSource = strings.TrimSpace(content)
+		} else {
+			for _, typ := range olay.endpoint.Types {
+				typeSpec := typeByName[typ.Name]
+				code := typ.Render()
+				if typeSpec != nil {
+					start := typeSpec.Pos()
+					if typeSpec.Doc != nil {
+						start = typeSpec.Doc.Pos()
+					}
+					rewriter.Replace(start, typeSpec.End(), []byte(code))
+				} else {
+					rewriter.Append([]byte("\n\n" + code))
+				}
+			}
+			olay.content = rewriter.Data()
+			content := string(olay.content[olay.headerOffset.Offset:])
+			olay.endpoint.TypeSource = strings.TrimSpace(content)
+		}
+	}
+	goRoot := paths.RootedFSPath(env.EncoreGoRoot(), ".")
+
+	// Parse the end result to catch any syntax errors
+	pkginfo.UpdateGoPath(goRoot)
+	pkgs, err := packages.Load(&packages.Config{
+		Mode: packages.NeedTypes | packages.NeedSyntax,
+		Dir:  app.Root(),
+		Env: append(os.Environ(),
+			"GOOS="+runtime.GOOS,
+			"GOARCH="+runtime.GOARCH,
+			"GOROOT="+goRoot.ToIO(),
+			"PATH="+goRoot.Join("bin").ToIO()+string(filepath.ListSeparator)+os.Getenv("PATH"),
+		),
+		Fset:    fset,
+		Overlay: overlays.PkgOverlay(),
+	}, fns.Map(overlays.pkgPaths(), paths.Pkg.String)...)
+	if err != nil {
+		return nil, err
+	}
+	for _, pkg := range pkgs {
+		for _, err := range pkg.Errors {
+			// ignore missing function bodies error (it's allowed)
+			if strings.Contains(err.Error(), "missing function body") {
+				continue
+			}
+			perrs.AddStd(err)
+		}
+	}
+	return &SyncResult{
+		Services: services,
+	}, nil
+}
diff --git a/cli/daemon/dash/ai/conv.go b/cli/daemon/dash/ai/conv.go
new file mode 100644
index 0000000000..e149fd8ea0
--- /dev/null
+++ b/cli/daemon/dash/ai/conv.go
@@ -0,0 +1,142 @@
+package ai
+
+import (
+	"slices"
+	"strings"
+
+	"encr.dev/pkg/clientgen"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+	"encr.dev/v2/internals/resourcepaths"
+)
+
+func toPathSegments(p *resourcepaths.Path, docs map[string]string) []PathSegment {
+	rtn := make([]PathSegment, 0, len(p.Segments))
+	for _, s := range p.Segments {
+		switch s.Type {
+		case resourcepaths.Literal:
+			rtn = append(rtn, PathSegment{Type: SegmentTypeLiteral, Value: ptr(s.Value)})
+		case resourcepaths.Param:
+			rtn = append(rtn, PathSegment{
+				Type:      SegmentTypeParam,
+				Value:     ptr(s.Value),
+				ValueType: ptr(SegmentValueType(strings.ToLower(s.ValueType.String()))),
+				Doc:       docs[s.Value],
+			})
+		case resourcepaths.Wildcard:
+			rtn = append(rtn, PathSegment{
+				Type:      SegmentTypeWildcard,
+				Value:     ptr(s.Value),
+				ValueType: ptr(SegmentValueType(strings.ToLower(s.ValueType.String()))),
+				Doc:       docs[s.Value],
+			})
+		case resourcepaths.Fallback:
+			rtn = append(rtn, PathSegment{
+				Type:      SegmentTypeFallback,
+				Value:     ptr(s.Value),
+				ValueType: ptr(SegmentValueType(strings.ToLower(s.ValueType.String()))),
+				Doc:       docs[s.Value],
+			})
+		}
+	}
+	return rtn
+}
+
+func metaPathToPathSegments(metaPath *meta.Path) []PathSegment {
+	var segments []PathSegment
+	for _, seg := range metaPath.Segments {
+		segments = append(segments, PathSegment{
+			Type:      toSegmentType(seg.Type),
+			Value:     ptr(seg.Value),
+			ValueType: ptr(toSegmentValueType(seg.ValueType)),
+		})
+	}
+	return segments
+}
+
+func toSegmentValueType(valueType meta.PathSegment_ParamType) SegmentValueType {
+	switch valueType {
+	case meta.PathSegment_UUID:
+		return "string"
+	default:
+		return SegmentValueType(strings.ToLower(valueType.String()))
+	}
+}
+
+func toSegmentType(segmentType meta.PathSegment_SegmentType) SegmentType {
+	switch segmentType {
+	case meta.PathSegment_LITERAL:
+		return SegmentTypeLiteral
+	case meta.PathSegment_PARAM:
+		return SegmentTypeParam
+	case meta.PathSegment_WILDCARD:
+		return SegmentTypeWildcard
+	case meta.PathSegment_FALLBACK:
+		return SegmentTypeFallback
+	default:
+		panic("unknown segment type")
+	}
+}
+
+func toVisibility(accessType meta.RPC_AccessType) VisibilityType {
+	switch accessType {
+	case meta.RPC_PUBLIC:
+		return VisibilityTypePublic
+	case meta.RPC_PRIVATE:
+		return VisibilityTypePrivate
+	case meta.RPC_AUTH:
+		return ""
+	default:
+		panic("unknown access type")
+	}
+}
+
+func renderTypesFromMetadata(md *meta.Data, svcs ...string) string {
+	var types []*schema.Decl
+	for _, metaSvc := range md.Svcs {
+		if len(svcs) > 0 && !slices.Contains(svcs, metaSvc.Name) {
+			continue
+		}
+		for _, rpc := range metaSvc.Rpcs {
+			if rpc.RequestSchema != nil {
+				types = append(types, md.Decls[rpc.RequestSchema.GetNamed().Id])
+			}
+			if rpc.ResponseSchema != nil {
+				types = append(types, md.Decls[rpc.ResponseSchema.GetNamed().Id])
+			}
+		}
+	}
+	src, _ := clientgen.GenTypes(md, types...)
+	return string(src)
+}
+
+func parseServicesFromMetadata(md *meta.Data, svcs ...string) []ServiceInput {
+	services := []ServiceInput{}
+	for _, metaSvc := range md.Svcs {
+		if len(svcs) > 0 && !slices.Contains(svcs, metaSvc.Name) {
+			continue
+		}
+		svc := ServiceInput{
+			Name: metaSvc.Name,
+		}
+		for _, rpc := range metaSvc.Rpcs {
+			ep := &Endpoint{
+				Name:       rpc.Name,
+				Method:     rpc.HttpMethods[0],
+				Visibility: toVisibility(rpc.AccessType),
+				Path:       metaPathToPathSegments(rpc.Path),
+			}
+			if rpc.RequestSchema != nil {
+				decl := md.Decls[rpc.RequestSchema.GetNamed().Id]
+				ep.RequestType = decl.Name
+			}
+			if rpc.ResponseSchema != nil {
+				decl := md.Decls[rpc.ResponseSchema.GetNamed().Id]
+				ep.ResponseType = decl.Name
+			}
+			svc.Endpoints = append(svc.Endpoints, ep)
+		}
+		services = append(services, svc)
+	}
+	return services
+}
diff --git a/cli/daemon/dash/ai/manager.go b/cli/daemon/dash/ai/manager.go
new file mode 100644
index 0000000000..3d740a457d
--- /dev/null
+++ b/cli/daemon/dash/ai/manager.go
@@ -0,0 +1,91 @@
+package ai
+
+import (
+	"context"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/paths"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+var ErrorCodeMap = map[string]int64{
+	"ai_task_limit_reached": 100,
+}
+
+// Manager exposes the ai functionality to the local dashboard
+type Manager struct{}
+
+func NewAIManager() *Manager {
+	return &Manager{}
+}
+
+func (m *Manager) DefineEndpoints(ctx context.Context, appSlug string, sessionID AISessionID, prompt string, md *meta.Data, proposed []Service, notifier AINotifier) (*AITask, error) {
+	svcs := fns.Map(proposed, Service.GetName)
+	return startAITask[struct {
+		Message *AIStreamMessage `graphql:"result: defineEndpoints(appSlug: $appSlug, sessionID: $sessionID, prompt: $prompt, current: $current, proposedDesign: $proposedDesign, existingTypes: $existingTypes)"`
+	}](ctx, map[string]interface{}{
+		"appSlug":        appSlug,
+		"prompt":         prompt,
+		"current":        parseServicesFromMetadata(md, svcs...),
+		"proposedDesign": fns.Map(proposed, Service.GraphQL),
+		"sessionID":      sessionID,
+		"existingTypes":  renderTypesFromMetadata(md, svcs...),
+	}, newEndpointAssemblerHandler(proposed, notifier, true))
+}
+
+func (m *Manager) ProposeSystemDesign(ctx context.Context, appSlug, prompt string, md *meta.Data, notifier AINotifier) (*AITask, error) {
+	return startAITask[struct {
+		Message *AIStreamMessage `graphql:"result: proposeSystemDesign(appSlug: $appSlug, prompt: $prompt, current: $current)"`
+	}](ctx, map[string]interface{}{
+		"appSlug": appSlug,
+		"prompt":  prompt,
+		"current": parseServicesFromMetadata(md),
+	}, newEndpointAssemblerHandler(nil, notifier, false))
+}
+
+func (m *Manager) ModifySystemDesign(ctx context.Context, appSlug string, sessionID AISessionID, originalPrompt string, proposed []Service, newPrompt string, md *meta.Data, notifier AINotifier) (*AITask, error) {
+	return startAITask[struct {
+		Message *AIStreamMessage `graphql:"result: modifySystemDesign(appSlug: $appSlug, sessionID: $sessionID, originalPrompt: $originalPrompt, proposedDesign: $proposedDesign, newPrompt: $newPrompt, current: $current)"`
+	}](ctx, map[string]interface{}{
+		"appSlug":        appSlug,
+		"originalPrompt": originalPrompt,
+		"proposedDesign": fns.Map(proposed, Service.GraphQL),
+		"current":        parseServicesFromMetadata(md),
+		"newPrompt":      newPrompt,
+		"sessionID":      sessionID,
+	}, newEndpointAssemblerHandler(proposed, notifier, false))
+}
+
+func (m *Manager) ParseCode(ctx context.Context, services []Service, app *apps.Instance) (*SyncResult, error) {
+	return parseCode(ctx, app, services)
+}
+
+func (m *Manager) UpdateCode(ctx context.Context, services []Service, app *apps.Instance, overwrite bool) (*SyncResult, error) {
+	return updateCode(ctx, services, app, overwrite)
+}
+
+type WriteFilesResponse struct {
+	FilesPaths []paths.RelSlash `json:"paths"`
+}
+
+func (m *Manager) WriteFiles(ctx context.Context, services []Service, app *apps.Instance) (*WriteFilesResponse, error) {
+	files, err := writeFiles(services, app)
+	return &WriteFilesResponse{FilesPaths: files}, err
+}
+
+type PreviewFile struct {
+	Path    paths.RelSlash `json:"path"`
+	Content string         `json:"content"`
+}
+
+type PreviewFilesResponse struct {
+	Files []PreviewFile `json:"files"`
+}
+
+func (m *Manager) PreviewFiles(ctx context.Context, services []Service, app *apps.Instance) (*PreviewFilesResponse, error) {
+	files, err := generateSrcFiles(services, app)
+	return &PreviewFilesResponse{Files: fns.TransformMapToSlice(files, func(k paths.RelSlash, v string) PreviewFile {
+		return PreviewFile{Path: k, Content: v}
+	})}, err
+}
diff --git a/cli/daemon/dash/ai/overlay.go b/cli/daemon/dash/ai/overlay.go
new file mode 100644
index 0000000000..8976445522
--- /dev/null
+++ b/cli/daemon/dash/ai/overlay.go
@@ -0,0 +1,347 @@
+package ai
+
+import (
+	"bytes"
+	"fmt"
+	"go/token"
+	"io"
+	"os"
+	"strings"
+	"time"
+
+	"golang.org/x/exp/maps"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/pkg/errinsrc"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/idents"
+	"encr.dev/pkg/paths"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/perr"
+)
+
+// servicePaths is a helper struct to manage mapping between service names, pkg paths and filepaths
+// It's created by parsing the metadata of the app
+type servicePaths struct {
+	relPaths map[string]paths.RelSlash
+	root     paths.FS
+	module   paths.Mod
+}
+
+func (s *servicePaths) IsNew(svc string) bool {
+	_, ok := s.relPaths[svc]
+	return !ok
+}
+
+func (s *servicePaths) Add(svc string, path paths.RelSlash) *servicePaths {
+	s.relPaths[svc] = path
+	return s
+}
+
+func (s *servicePaths) PkgPath(svc string) paths.Pkg {
+	rel := s.RelPath(svc)
+	return s.module.Pkg(rel)
+}
+
+func (s *servicePaths) FullPath(svc string) paths.FS {
+	rel := s.RelPath(svc)
+	return s.root.JoinSlash(rel)
+}
+
+func (s *servicePaths) RelPath(svc string) paths.RelSlash {
+	pkgName, ok := s.relPaths[svc]
+	if !ok {
+		pkgName = paths.RelSlash(strings.ToLower(svc))
+	}
+	return pkgName
+}
+
+func (s *servicePaths) FileName(svc, name string) (paths.FS, error) {
+	relPath, err := s.RelFileName(svc, name)
+	if err != nil {
+		return "", err
+	}
+	return s.root.JoinSlash(relPath), nil
+}
+
+func (s *servicePaths) RelFileName(svc, name string) (paths.RelSlash, error) {
+	pkgPath := s.FullPath(svc)
+	name = idents.Convert(name, idents.SnakeCase)
+	fileName := name + ".go"
+	var i int
+	for {
+		fspath := pkgPath.Join(fileName)
+		if _, err := os.Stat(fspath.ToIO()); os.IsNotExist(err) {
+			return s.RelPath(svc).Join(fileName), nil
+		} else if err != nil {
+			return "", err
+		}
+		i++
+		fileName = fmt.Sprintf("%s_%d.go", name, i)
+	}
+}
+
+func newServicePaths(app *apps.Instance) (*servicePaths, error) {
+	md, err := app.CachedMetadata()
+	if err != nil {
+		return nil, err
+	}
+	pkgRelPath := fns.ToMap(md.Pkgs, func(p *meta.Package) string { return p.RelPath })
+	svcPaths := &servicePaths{
+		relPaths: map[string]paths.RelSlash{},
+		root:     paths.FS(app.Root()),
+		module:   paths.Mod(md.ModulePath),
+	}
+	for _, svc := range md.Svcs {
+		if pkgRelPath[svc.RelPath] != nil {
+			svcPaths.Add(svc.Name, paths.RelSlash(pkgRelPath[svc.RelPath].RelPath))
+		}
+	}
+	return svcPaths, nil
+}
+
+// An overlay is a virtual file that is used to store the source code of an endpoint or types
+// It automatically generates a header with pkg name and imports.
+// It implements os.FileInfo and os.DirEntry interfaces
+type overlay struct {
+	path         paths.FS
+	endpoint     *Endpoint
+	service      *Service
+	codeType     CodeType
+	content      []byte
+	headerOffset token.Position
+}
+
+func (o *overlay) Type() os.FileMode {
+	return o.Mode()
+}
+
+func (o *overlay) Info() (os.FileInfo, error) {
+	return o, nil
+}
+
+func (o *overlay) Name() string {
+	return o.path.Base()
+}
+
+func (o *overlay) Size() int64 {
+	return int64(len(o.content))
+}
+
+func (o *overlay) Mode() os.FileMode {
+	return os.ModePerm
+}
+
+func (o *overlay) ModTime() time.Time {
+	return time.Now()
+}
+
+func (o *overlay) IsDir() bool {
+	return false
+}
+
+func (o *overlay) Sys() any {
+	//TODO implement me
+	panic("implement me")
+}
+
+func (o *overlay) Stat() (os.FileInfo, error) {
+	return o, nil
+}
+
+func (o *overlay) Reader() io.ReadCloser {
+	return &overlayReader{o, bytes.NewReader(o.content)}
+}
+
+// overlayReader is a wrapper around the overlay to implement io.ReadCloser
+type overlayReader struct {
+	*overlay
+	*bytes.Reader
+}
+
+func (o *overlayReader) Close() error { return nil }
+
+var (
+	_ os.FileInfo = (*overlay)(nil)
+	_ os.DirEntry = (*overlay)(nil)
+)
+
+func newOverlays(app *apps.Instance, overwrite bool, services ...Service) (*overlays, error) {
+	svcPaths, err := newServicePaths(app)
+	if err != nil {
+		return nil, err
+	}
+	o := &overlays{
+		items: map[paths.FS]*overlay{},
+		paths: svcPaths,
+	}
+	for _, s := range services {
+		for _, e := range s.Endpoints {
+			if overwrite {
+				e.TypeSource = ""
+				e.EndpointSource = ""
+			}
+			if err := o.add(s, e); err != nil {
+				return nil, err
+			}
+		}
+	}
+	return o, nil
+}
+
+// overlays is a collection of virtual files that are used to store the source code of endpoints and types
+// in memory. It's modelled as a replacement for the os package.
+type overlays struct {
+	items map[paths.FS]*overlay
+	paths *servicePaths
+}
+
+func (o *overlays) Stat(name string) (os.FileInfo, error) {
+	f, ok := o.items[paths.FS(name)]
+	if !ok {
+		// else return the filesystem file
+		return os.Stat(name)
+	}
+	return f, nil
+}
+
+func (o *overlays) ReadDir(name string) ([]os.DirEntry, error) {
+	entries := map[string]os.DirEntry{}
+	osFiles, err := os.ReadDir(name)
+	for _, f := range osFiles {
+		entries[f.Name()] = f
+	}
+	dir := paths.FS(name)
+	for _, info := range o.items {
+		if dir == info.path.Dir() {
+			entries[info.path.Base()] = info
+		}
+	}
+	if len(entries) == 0 && err != nil {
+		return nil, err
+	}
+	return maps.Values(entries), nil
+}
+
+func (o *overlays) PkgOverlay() map[string][]byte {
+	files := map[string][]byte{}
+	for f, info := range o.items {
+		files[f.ToIO()] = info.content
+	}
+	return files
+}
+
+func (o *overlays) ReadFile(name string) ([]byte, error) {
+	f, ok := o.items[paths.FS(name)]
+	if !ok {
+		// else return the filesystem file
+		return os.ReadFile(name)
+	}
+	return f.content, nil
+}
+
+func (o *overlays) Open(name string) (io.ReadCloser, error) {
+	f, ok := o.items[paths.FS(name)]
+	if !ok {
+		// else return the filesystem file
+		return os.Open(name)
+	}
+	return f.Reader(), nil
+}
+
+func (o *overlays) pkgPaths() []paths.Pkg {
+	pkgs := map[paths.Pkg]struct{}{}
+	for _, info := range o.items {
+		pkgs[o.paths.PkgPath(info.service.Name)] = struct{}{}
+	}
+	return maps.Keys(pkgs)
+}
+
+func (o *overlays) get(p paths.FS) (*overlay, bool) {
+	rtn, ok := o.items[p]
+	return rtn, ok
+}
+
+// validationErrors converts a perr.List into a slice of ValidationErrors
+func (o *overlays) validationErrors(list *perr.List) []ValidationError {
+	var rtn []ValidationError
+	for i := 0; i < list.Len(); i++ {
+		err := list.At(i)
+		rtn = append(rtn, o.validationError(err)...)
+	}
+	return rtn
+}
+
+// validationError translates errinsrc.ErrInSrc into a ValidationError which is a simplified error
+// used for displaying errors in the dashboard
+func (o *overlays) validationError(err *errinsrc.ErrInSrc) []ValidationError {
+	if err.Params.Locations == nil {
+		return []ValidationError{{
+			Message: err.Params.Summary,
+		}}
+	}
+	var rtn []ValidationError
+	for _, loc := range err.Params.Locations {
+		o, ok := o.get(paths.FS(loc.File.FullPath))
+		if !ok {
+			rtn = append(rtn, ValidationError{
+				Message: err.Params.Summary,
+			})
+			continue
+		}
+		rtn = append(rtn, ValidationError{
+			Service:  o.service.ID,
+			Endpoint: o.endpoint.ID,
+			CodeType: o.codeType,
+			Message:  err.Params.Summary,
+			Start: &Pos{
+				Line:   loc.Start.Line - o.headerOffset.Line,
+				Column: loc.Start.Col - o.headerOffset.Column,
+			},
+			End: &Pos{
+				Line:   loc.End.Line - o.headerOffset.Line,
+				Column: loc.End.Col - o.headerOffset.Column,
+			},
+		})
+	}
+	return rtn
+}
+
+// add creates new overlays for an endpoint and its types.
+// We create separate overlays for each endpoint and its types to allow for easier parsing and code generation.
+func (o *overlays) add(s Service, e *Endpoint) error {
+	p, err := o.paths.FileName(s.Name, e.Name+"_func")
+	if err != nil {
+		return err
+	}
+	offset, content := toSrcFile(p, s.Name, e.EndpointSource)
+	e.EndpointSource = string(content[offset.Offset:])
+	o.items[p] = &overlay{
+		path:         p,
+		endpoint:     e,
+		service:      &s,
+		codeType:     CodeTypeEndpoint,
+		content:      content,
+		headerOffset: offset,
+	}
+	p, err = o.paths.FileName(s.Name, e.Name+"_types")
+	if err != nil {
+		return err
+	}
+	offset, content = toSrcFile(p, s.Name, e.TypeSource)
+	e.TypeSource = string(content[offset.Offset:])
+	o.items[p] = &overlay{
+		path:         p,
+		endpoint:     e,
+		service:      &s,
+		codeType:     CodeTypeTypes,
+		content:      content,
+		headerOffset: offset,
+	}
+	return nil
+}
+
+var (
+	_ parsectx.OverlaidOSFS = (*overlays)(nil)
+)
diff --git a/cli/daemon/dash/ai/parser.go b/cli/daemon/dash/ai/parser.go
new file mode 100644
index 0000000000..331a0bd50a
--- /dev/null
+++ b/cli/daemon/dash/ai/parser.go
@@ -0,0 +1,315 @@
+package ai
+
+import (
+	"context"
+	"go/ast"
+	"go/token"
+	"runtime"
+	"slices"
+	"strings"
+
+	"github.com/rs/zerolog"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/internal/env"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/parser/apis"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/api/apienc"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+// parseErrorList parses a list of errors docs from a doc string.
+func parseErrorList(doc string) (string, []*Error) {
+	doc, errs := parseDocList(doc, ErrDocPrefix)
+	return doc, fns.Map(errs, func(e docListItem) *Error {
+		return &Error{
+			Code: e.Key,
+			Doc:  e.Doc,
+		}
+	})
+}
+
+// parsePathList parses a list of path docs from a doc string.
+func parsePathList(doc string) (string, map[string]string) {
+	doc, docs := parseDocList(doc, PathDocPrefix)
+	rtn := map[string]string{}
+	for _, d := range docs {
+		rtn[d.Key] = d.Doc
+	}
+	return doc, rtn
+}
+
+// parseDocList parses a list of key-value pairs from a doc string.
+// e.g.
+//
+// Errors:
+//   - NotFound: The requested resource was not found.
+//   - InvalidArgument: The request had invalid arguments.
+func parseDocList(doc, section string) (string, []docListItem) {
+	var errs []docListItem
+	lines := strings.Split(doc, "\n")
+	start := -1
+	end := -1
+	for i, line := range lines {
+		end = i
+		if strings.HasPrefix(strings.TrimSpace(line), section+":") {
+			start = i
+
+		} else if start == -1 {
+			continue
+		} else if len(line) > 2 {
+			switch strings.TrimSpace(line[:2]) {
+			case "-", "":
+			default:
+				end = i - 1
+				break
+			}
+		}
+		lines[i] = strings.TrimSpace(line)
+		if line == "" && lines[i-1] == "" {
+			break
+		}
+	}
+	if start == -1 {
+		return doc, errs
+	}
+
+	for _, line := range lines[start+1 : end+1] {
+		key, doc, ok := strings.Cut(line, ":")
+		key = strings.TrimPrefix(key, "-")
+		key = strings.TrimSpace(key)
+		if ok {
+			errs = append(errs, docListItem{
+				Key: key,
+				Doc: strings.TrimSpace(doc),
+			})
+		} else if len(errs) > 0 && line != "" {
+			errs[len(errs)-1].Doc += "\n" + line
+		}
+	}
+	return strings.Join(lines[:start], "\n"), errs
+}
+
+// docListItem represents a key-value pair in a doc list.
+type docListItem struct {
+	Key string
+	Doc string
+}
+
+// deref returns the underlying type of a pointer type.
+func deref(p schema.Type) schema.Type {
+	for {
+		if pt, ok := p.(schema.PointerType); ok {
+			p = pt.Elem
+		} else {
+			return p
+		}
+	}
+}
+
+// parseCode updates the structured EndpointInput data based on the code in
+// EndpointInput.TypeSource and EndpointInput.EndpointSource fields.
+func parseCode(ctx context.Context, app *apps.Instance, services []Service) (rtn *SyncResult, err error) {
+	// assamble an overlay with all our newly defined endpoints
+	overlays, err := newOverlays(app, false, services...)
+	if err != nil {
+		return nil, err
+	}
+
+	fs := token.NewFileSet()
+	errs := perr.NewList(ctx, fs, overlays.ReadFile)
+	rootDir := paths.RootedFSPath(app.Root(), ".")
+	pc := &parsectx.Context{
+		Ctx: ctx,
+		Log: zerolog.Logger{},
+		Build: parsectx.BuildInfo{
+			Experiments: nil,
+			GOROOT:      paths.RootedFSPath(env.EncoreGoRoot(), "."),
+			GOARCH:      runtime.GOARCH,
+			GOOS:        runtime.GOOS,
+		},
+		MainModuleDir: rootDir,
+		FS:            fs,
+		ParseTests:    false,
+		Errs:          errs,
+		Overlay:       overlays,
+	}
+
+	// Catch parser bailouts and convert them to ValidationErrors
+	defer func() {
+		perr.CatchBailout(recover())
+		if rtn == nil {
+			rtn = &SyncResult{
+				Services: services,
+			}
+		}
+		rtn.Errors = overlays.validationErrors(errs)
+	}()
+
+	// Load overlay packages using the encore loader
+	loader := pkginfo.New(pc)
+	pkgs := map[paths.Pkg]*pkginfo.Package{}
+	for _, pkgPath := range overlays.pkgPaths() {
+		pkg, ok := loader.LoadPkg(token.NoPos, pkgPath)
+		if ok {
+			pkgs[pkgPath] = pkg
+		}
+	}
+
+	// Create a schema parser to help us parse the types
+	schemaParser := schema.NewParser(pc, loader)
+
+	for _, pkg := range pkgs {
+		// Use the API parser to parser the endpoints for each overlaid package
+		pass := &resourceparser.Pass{
+			Context:      pc,
+			SchemaParser: schemaParser,
+			Pkg:          pkg,
+		}
+		apis.Parser.Run(pass)
+		for _, r := range pass.Resources() {
+			switch r := r.(type) {
+			case *api.Endpoint:
+				// We're only interested in endpoints that are in our overlays
+				overlay, ok := overlays.get(r.File.FSPath)
+				if !ok {
+					continue
+				}
+				e := overlay.endpoint
+
+				pathDocs := map[string]string{}
+				e.Doc, e.Errors = parseErrorList(r.Doc)
+				e.Doc, pathDocs = parsePathList(e.Doc)
+				e.Name = r.Name
+				e.Method = r.HTTPMethods[0]
+				e.Visibility = VisibilityType(r.Access)
+				e.Language = "GO"
+				e.Path = toPathSegments(r.Path, pathDocs)
+
+				// Clear the types as we will reparse them
+				e.Types = []*Type{}
+				if nr, ok := deref(r.Request).(schema.NamedType); ok {
+					e.RequestType = nr.String()
+					// If the request type is in the overlays, we should parse it and
+					// add it to the endpoint associated with the overlay
+					ov, ok := overlays.get(nr.DeclInfo.File.FSPath)
+					if len(r.RequestEncoding()) > 0 && ok {
+						e = ov.endpoint
+						e.Types = append(e.Types, &Type{
+							Name: nr.String(),
+							Doc:  strings.TrimSpace(nr.DeclInfo.Doc),
+							Fields: fns.Map(r.RequestEncoding()[0].AllParameters(), func(f *apienc.ParameterEncoding) *TypeField {
+								return &TypeField{
+									Name:     f.SrcName,
+									WireName: f.WireName,
+									Location: f.Location,
+									Type:     f.Type.String(),
+									Doc:      strings.TrimSpace(f.Doc),
+								}
+							}),
+						})
+					}
+				}
+				if nr, ok := deref(r.Response).(schema.NamedType); ok {
+					e.ResponseType = nr.String()
+					// If the response type is in the overlays, we should parse it and
+					// add it to the endpoint associated with the overlay
+					ov, ok := overlays.get(nr.DeclInfo.File.FSPath)
+					if r.ResponseEncoding() != nil && ok {
+						e = ov.endpoint
+						e.Types = append(e.Types, &Type{
+							Name: nr.String(),
+							Doc:  strings.TrimSpace(nr.DeclInfo.Doc),
+							Fields: fns.Map(r.ResponseEncoding().AllParameters(), func(f *apienc.ParameterEncoding) *TypeField {
+								return &TypeField{
+									Name:     f.SrcName,
+									WireName: f.WireName,
+									Location: f.Location,
+									Type:     f.Type.String(),
+									Doc:      strings.TrimSpace(f.Doc),
+								}
+							}),
+						})
+					}
+				}
+			}
+		}
+		// Parse types which are in the overlays but not used in request/response
+		for _, file := range pkg.Files {
+			ast.Inspect(file.AST(), func(node ast.Node) bool {
+				switch node := node.(type) {
+				case *ast.GenDecl:
+					// We're only interested in type declarations
+					if node.Tok != token.TYPE {
+						return true
+					}
+					for _, spec := range node.Specs {
+						d := spec.(*ast.TypeSpec)
+						// If the type is not defined in our overlays, skip it.
+						olay, ok := overlays.get(file.FSPath)
+						if !ok {
+							continue
+						}
+
+						// If it's not a struct type, skip it.
+						s, ok := schemaParser.ParseType(file, d.Type).(schema.StructType)
+						if !ok {
+							continue
+						}
+
+						e := olay.endpoint
+						// If the type has already been parsed, skip it.
+						if slices.ContainsFunc(e.Types, func(t *Type) bool { return t.Name == d.Name.Name }) {
+							continue
+						}
+
+						// Otherwise we should add it
+						e.Types = append(e.Types, &Type{
+							Name:   d.Name.Name,
+							Doc:    docText(node.Doc),
+							Fields: fns.MapAndFilter(s.Fields, parseTypeField),
+						})
+					}
+				}
+				return true
+			})
+		}
+	}
+	return &SyncResult{
+		Services: services,
+	}, nil
+}
+
+// parseTypeField is a helper function to parse a schema field into a TypeField.
+func parseTypeField(f schema.StructField) (*TypeField, bool) {
+	name, ok := f.Name.Get()
+	if !ok {
+		return nil, false
+	}
+	// Fields which are parsed by this functions are not a request or response type,
+	// so we can assume the wire name is the json tag name.
+	wireName := name
+	if tag, err := f.Tag.Get("json"); err == nil {
+		wireName = tag.Name
+	}
+	return &TypeField{
+		Name:     name,
+		Type:     f.Type.String(),
+		Doc:      f.Doc,
+		WireName: wireName,
+	}, true
+}
+
+// helper function to extract the text from a comment node or "" if nil
+func docText(c *ast.CommentGroup) string {
+	if c == nil {
+		return ""
+	}
+	return strings.TrimSpace(c.Text())
+}
diff --git a/cli/daemon/dash/ai/sql.go b/cli/daemon/dash/ai/sql.go
new file mode 100644
index 0000000000..48ac26485d
--- /dev/null
+++ b/cli/daemon/dash/ai/sql.go
@@ -0,0 +1,28 @@
+package ai
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"github.com/golang/protobuf/proto"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/proto/encore/daemon"
+)
+
+// ParseSQLSchema uses SQLC to parse the migration files for an encore database and returns
+// the parsed catalog
+func ParseSQLSchema(app *apps.Instance, schema string) (*daemon.SQLCPlugin_Catalog, error) {
+	schemaPath := filepath.Join(app.Root(), schema)
+	cmd := exec.Command(os.Args[0], "generate-sql-schema", "--proto", schemaPath)
+	output, err := cmd.Output()
+	if err != nil {
+		return nil, err
+	}
+	var req daemon.SQLCPlugin_GenerateRequest
+	if err := proto.Unmarshal(output, &req); err != nil {
+		return nil, err
+	}
+	return req.Catalog, nil
+}
diff --git a/cli/daemon/dash/ai/types.go b/cli/daemon/dash/ai/types.go
new file mode 100644
index 0000000000..8b0ea15568
--- /dev/null
+++ b/cli/daemon/dash/ai/types.go
@@ -0,0 +1,248 @@
+package ai
+
+import (
+	"encr.dev/v2/parser/apis/api/apienc"
+)
+
+type VisibilityType string
+
+const (
+	VisibilityTypePublic  VisibilityType = "public"
+	VisibilityTypePrivate VisibilityType = "private"
+	VisibilityTypeAuth    VisibilityType = "auth"
+)
+
+type SegmentType string
+
+const (
+	SegmentTypeLiteral  SegmentType = "literal"
+	SegmentTypeParam    SegmentType = "param"
+	SegmentTypeWildcard SegmentType = "wildcard"
+	SegmentTypeFallback SegmentType = "fallback"
+)
+
+type SegmentValueType string
+
+const SegmentValueTypeString SegmentValueType = "string"
+
+type PathSegments []PathSegment
+
+type PathSegment struct {
+	Type      SegmentType       `json:"type,omitempty"`
+	Value     *string           `json:"value,omitempty"`
+	ValueType *SegmentValueType `json:"valueType,omitempty"`
+	Doc       string            `graphql:"-" json:"doc,omitempty"`
+}
+
+func (p PathSegment) DocItem() (string, string) {
+	return *p.Value, p.Doc
+}
+
+type Endpoint struct {
+	ID             string         `json:"id,omitempty"`
+	Name           string         `json:"name"`
+	Doc            string         `json:"doc"`
+	Method         string         `json:"method"`
+	Visibility     VisibilityType `json:"visibility"`
+	Path           PathSegments   `json:"path"`
+	RequestType    string         `json:"requestType,omitempty"`
+	ResponseType   string         `json:"responseType,omitempty"`
+	Errors         []*Error       `json:"errors,omitempty"`
+	Types          []*Type        `json:"types,omitempty"`
+	Language       string         `json:"language,omitempty"`
+	TypeSource     string         `json:"typeSource,omitempty"`
+	EndpointSource string         `json:"endpointSource,omitempty"`
+}
+
+func (s *Endpoint) Auth() bool {
+	return s.Visibility == VisibilityTypeAuth
+}
+
+// GraphQL scrubs data that is not needed for the graphql client
+func (s *Endpoint) GraphQL() *Endpoint {
+	s.ID = ""
+	s.EndpointSource = ""
+	s.TypeSource = ""
+	s.Types = nil
+	s.Language = ""
+	for i, _ := range s.Path {
+		s.Path[i].Doc = ""
+	}
+	return s
+}
+
+type Type struct {
+	Name   string       `json:"name,omitempty"`
+	Doc    string       `json:"doc,omitempty"`
+	Fields []*TypeField `json:"fields,omitempty"`
+}
+
+type Service struct {
+	ID        string      `json:"id,omitempty"`
+	Name      string      `json:"name,omitempty"`
+	Doc       string      `json:"doc,omitempty"`
+	Endpoints []*Endpoint `json:"endpoints,omitempty"`
+}
+
+func (s Service) GetName() string {
+	return s.Name
+}
+
+func (s Service) GetEndpoints() []*Endpoint {
+	return s.Endpoints
+}
+
+// ServiceInput is the graphql input type for our queries
+// the graphQL client we use requires the type name to match the
+// graphql type
+type ServiceInput Service
+
+// GraphQL scrubs data that is not needed for the graphql client
+func (s Service) GraphQL() ServiceInput {
+	s.ID = ""
+	for _, e := range s.Endpoints {
+		e.GraphQL()
+	}
+	return ServiceInput(s)
+}
+
+type BaseAIUpdateType struct {
+	Type string `graphql:"__typename" json:"type"`
+}
+
+func (b BaseAIUpdateType) IsAIUpdateType() {}
+
+type AIUpdateType interface {
+	IsAIUpdateType()
+}
+
+type AIStreamUpdate = Result[AIUpdateType]
+
+func ptr[T any](val T) *T {
+	return &val
+}
+
+type Result[T any] struct {
+	Value    T
+	Finished *bool
+	Error    *string
+}
+
+type EndpointUpdate struct {
+	BaseAIUpdateType
+	Service      string         `json:"service,omitempty"`
+	Name         string         `json:"name,omitempty"`
+	Doc          string         `json:"doc,omitempty"`
+	Method       string         `json:"method,omitempty"`
+	Visibility   VisibilityType `json:"visibility,omitempty"`
+	Path         []PathSegment  `json:"path,omitempty"`
+	RequestType  string         `json:"requestType,omitempty"`
+	ResponseType string         `json:"responseType,omitempty"`
+	Errors       []string       `json:"errors,omitempty"`
+}
+
+type ServiceUpdate struct {
+	BaseAIUpdateType
+	Name string `json:"name,omitempty"`
+	Doc  string `json:"doc,omitempty"`
+}
+
+type TypeUpdate struct {
+	BaseAIUpdateType
+	Service  string `json:"service,omitempty"`
+	Endpoint string `json:"endpoint,omitempty"`
+	Name     string `json:"name,omitempty"`
+	Doc      string `graphql:"mdoc: doc" json:"doc,omitempty"`
+}
+
+type AISessionID string
+
+type SessionUpdate struct {
+	BaseAIUpdateType
+	Id AISessionID
+}
+
+type TitleUpdate struct {
+	BaseAIUpdateType
+	Title string
+}
+
+type LocalEndpointUpdate struct {
+	Type     string    `json:"type,omitempty"`
+	Service  string    `json:"service,omitempty"`
+	Endpoint *Endpoint `json:"endpoint,omitempty"`
+}
+
+type TypeField struct {
+	Name     string         `json:"name,omitempty"`
+	WireName string         `json:"wireName,omitempty"`
+	Type     string         `json:"type,omitempty"`
+	Location apienc.WireLoc `json:"location,omitempty"`
+	Doc      string         `json:"doc,omitempty"`
+}
+
+type TypeFieldUpdate struct {
+	BaseAIUpdateType
+	Service  string `json:"service,omitempty"`
+	Endpoint string `json:"endpoint,omitempty"`
+	Struct   string `json:"struct,omitempty"`
+	Name     string `json:"name,omitempty"`
+	Type     string `json:"type,omitempty"`
+	Doc      string `graphql:"mdoc: doc" json:"doc,omitempty"`
+}
+
+type Error struct {
+	Code string `json:"code,omitempty"`
+	Doc  string `json:"doc,omitempty"`
+}
+
+func (e Error) DocItem() (string, string) {
+	return e.Code, e.Doc
+}
+
+func (e Error) String() string {
+	return e.Code
+}
+
+type ErrorUpdate struct {
+	BaseAIUpdateType
+	Code     string `json:"code,omitempty"`
+	Doc      string `json:"doc,omitempty"`
+	Service  string `json:"service,omitempty"`
+	Endpoint string `json:"endpoint,omitempty"`
+}
+
+type PathParamUpdate struct {
+	BaseAIUpdateType
+	Service  string `json:"service,omitempty"`
+	Endpoint string `json:"endpoint,omitempty"`
+	Param    string `json:"param,omitempty"`
+	Doc      string `json:"doc,omitempty"`
+}
+
+type SyncResult struct {
+	Services []Service         `json:"services"`
+	Errors   []ValidationError `json:"errors"`
+}
+
+// ValidationError is a simplified ErrInSrc to return to the dashboard
+type ValidationError struct {
+	Service  string   `json:"service"`
+	Endpoint string   `json:"endpoint"`
+	CodeType CodeType `json:"codeType"`
+	Message  string   `json:"message"`
+	Start    *Pos     `json:"start,omitempty"`
+	End      *Pos     `json:"end,omitempty"`
+}
+
+type CodeType string
+
+const (
+	CodeTypeEndpoint CodeType = "endpoint"
+	CodeTypeTypes    CodeType = "types"
+)
+
+type Pos struct {
+	Line   int `json:"line"`
+	Column int `json:"column"`
+}
diff --git a/cli/daemon/dash/ai/types_test.go b/cli/daemon/dash/ai/types_test.go
new file mode 100644
index 0000000000..cb513853db
--- /dev/null
+++ b/cli/daemon/dash/ai/types_test.go
@@ -0,0 +1,39 @@
+package ai
+
+import (
+	"fmt"
+	"strings"
+	"testing"
+)
+
+func TestWrapDoc(t *testing.T) {
+	var wrapTests = []struct {
+		width  int
+		string string
+	}{
+		{1, "Lorem ipsum dolor sit amet"},
+		{80, "Lorem ipsum dolor sit amet"},
+		{80, "Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum."},
+		{80, "Lorem Loremipsumdolorsitamet,consecteturadipiscingelit,seddoeiusmodtemporincididuntutlaboreetdoloremagna"},
+		{30, "Loremipsumdolorsitamet,consecteturadipiscingelit,seddoeiusmodtemporincididuntutlaboreetdoloremagna"},
+		{80, ""},
+		{80, "a\nb\nc\nd"},
+	}
+	for _, test := range wrapTests {
+		t.Run(fmt.Sprintf("WrapDoc(%d, %s)", test.width, test.string), func(t *testing.T) {
+			result := wrapDoc(test.string, test.width)
+			lines := strings.Split(result, "\n")
+			for i, line := range lines {
+				if len(line) > test.width && strings.Contains(line, " ") {
+					t.Errorf("Line too long: %s", line)
+				}
+				if i+1 < len(lines) {
+					nextWord, _, _ := strings.Cut(lines[i+1], " ")
+					if len(line)+len(nextWord) < test.width {
+						t.Errorf("Line too short: %s", line)
+					}
+				}
+			}
+		})
+	}
+}
diff --git a/cli/daemon/dash/apiproxy/apiproxy.go b/cli/daemon/dash/apiproxy/apiproxy.go
new file mode 100644
index 0000000000..f17232bff7
--- /dev/null
+++ b/cli/daemon/dash/apiproxy/apiproxy.go
@@ -0,0 +1,45 @@
+package apiproxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"runtime"
+
+	"github.com/cockroachdb/errors"
+	"golang.org/x/oauth2"
+
+	"encr.dev/internal/conf"
+	"encr.dev/internal/version"
+)
+
+func New(targetURL string) (*httputil.ReverseProxy, error) {
+	target, err := url.Parse(targetURL)
+	if err != nil {
+		return nil, errors.Wrap(err, "parse target url")
+	}
+
+	proxy := &httputil.ReverseProxy{
+		Transport: &oauth2.Transport{
+			Base:   http.DefaultTransport,
+			Source: oauth2.ReuseTokenSource(nil, conf.DefaultTokenSource),
+		},
+		ErrorHandler: func(writer http.ResponseWriter, request *http.Request, err error) {
+			if errors.Is(err, conf.ErrNotLoggedIn) {
+				writer.WriteHeader(http.StatusUnauthorized)
+				return
+			}
+			writer.WriteHeader(http.StatusBadGateway)
+
+		},
+		Rewrite: func(r *httputil.ProxyRequest) {
+			r.Out.URL = target
+			r.Out.Header.Set("User-Agent", "EncoreCLI/"+version.Version)
+			r.Out.Header.Set("X-Encore-Dev-Dash", "true")
+			r.Out.Header.Set("X-Encore-Version", version.Version)
+			r.Out.Header.Set("X-Encore-GOOS", runtime.GOOS)
+			r.Out.Header.Set("X-Encore-GOARCH", runtime.GOARCH)
+		},
+	}
+	return proxy, nil
+}
diff --git a/cli/daemon/dash/dash.go b/cli/daemon/dash/dash.go
index d8ae14dae6..bff59e1c4d 100644
--- a/cli/daemon/dash/dash.go
+++ b/cli/daemon/dash/dash.go
@@ -2,28 +2,87 @@
 package dash
 
 import (
-	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
-	"io/ioutil"
-	"net/http"
 	"path/filepath"
+	"slices"
+	"strings"
+	"sync"
+	"time"
 
-	"encr.dev/cli/daemon/run"
-	"encr.dev/cli/daemon/runtime/trace"
-	"encr.dev/cli/internal/jsonrpc2"
 	"github.com/golang/protobuf/jsonpb"
 	"github.com/rs/zerolog/log"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/dash/ai"
+	"encr.dev/cli/daemon/engine/trace2"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/run"
+	"encr.dev/cli/daemon/sqldb"
+	"encr.dev/cli/internal/browser"
+	"encr.dev/cli/internal/jsonrpc2"
+	"encr.dev/cli/internal/onboarding"
+	"encr.dev/cli/internal/telemetry"
+	"encr.dev/internal/version"
+	"encr.dev/parser/encoding"
+	"encr.dev/pkg/editors"
+	"encr.dev/pkg/errlist"
+	"encr.dev/pkg/jsonext"
+	tracepb2 "encr.dev/proto/encore/engine/trace2"
+	meta "encr.dev/proto/encore/parser/meta/v1"
 )
 
 type handler struct {
-	rpc jsonrpc2.Conn
-	run *run.Manager
-	tr  *trace.Store
+	rpc  jsonrpc2.Conn
+	apps *apps.Manager
+	run  *run.Manager
+	ns   *namespace.Manager
+	ai   *ai.Manager
+	tr   trace2.Store
+}
+
+func (h *handler) GetMeta(appID string) (*meta.Data, error) {
+	runInstance := h.run.FindRunByAppID(appID)
+	var md *meta.Data
+	if runInstance != nil && runInstance.ProcGroup() != nil {
+		md = runInstance.ProcGroup().Meta
+	} else {
+		app, err := h.apps.FindLatestByPlatformOrLocalID(appID)
+		if err != nil {
+			return nil, err
+		}
+		md, err = app.CachedMetadata()
+		if err != nil {
+			return nil, err
+		} else if md == nil {
+			return nil, err
+		}
+	}
+	return md, nil
+}
+
+func (h *handler) GetNamespace(ctx context.Context, appID string) (*namespace.Namespace, error) {
+	runInstance := h.run.FindRunByAppID(appID)
+	if runInstance != nil && runInstance.ProcGroup() != nil {
+		return runInstance.NS, nil
+	} else {
+		app, err := h.apps.FindLatestByPlatformOrLocalID(appID)
+		if err != nil {
+			return nil, err
+		}
+		ns, err := h.ns.GetActive(ctx, app)
+		if err != nil {
+			return nil, err
+		}
+		return ns, nil
+	}
 }
 
 func (h *handler) Handle(ctx context.Context, reply jsonrpc2.Replier, r jsonrpc2.Request) error {
+	reply = makeProtoReplier(reply)
+
 	unmarshal := func(dst interface{}) error {
 		if r.Params() == nil {
 			return fmt.Errorf("missing params")
@@ -32,46 +91,210 @@ func (h *handler) Handle(ctx context.Context, reply jsonrpc2.Replier, r jsonrpc2
 	}
 
 	switch r.Method() {
+	case "db/query":
+		var p QueryRequest
+		if err := unmarshal(&p); err != nil {
+			return reply(ctx, nil, err)
+		}
+		res, err := h.Query(ctx, p)
+		return reply(ctx, res, err)
+	case "db/transaction":
+		var p TransactionRequest
+		if err := unmarshal(&p); err != nil {
+			return reply(ctx, nil, err)
+		}
+		res, err := h.Transaction(ctx, p)
+		return reply(ctx, res, err)
+	case "onboarding/get":
+		state, err := onboarding.Load()
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		resp := map[string]time.Time{}
+		for key, val := range state.EventMap {
+			if val.IsSet() {
+				resp[key] = val.UTC()
+			}
+		}
+		return reply(ctx, resp, nil)
+	case "onboarding/set":
+		type params struct {
+			Properties []string `json:"properties"`
+		}
+		var p params
+		if err := unmarshal(&p); err != nil {
+			return reply(ctx, nil, err)
+		}
+		state, err := onboarding.Load()
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		for _, prop := range p.Properties {
+			state.Property(prop).Set()
+		}
+		err = state.Write()
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		return reply(ctx, nil, nil)
+	case "telemetry":
+		type params struct {
+			Event      string                 `json:"event"`
+			Properties map[string]interface{} `json:"properties"`
+			Once       bool                   `json:"once,omitempty"`
+		}
+		var p params
+		if err := unmarshal(&p); err != nil {
+			return reply(ctx, nil, err)
+		}
+		if p.Once {
+			telemetry.SendOnce(p.Event, p.Properties)
+		} else {
+			telemetry.Send(p.Event, p.Properties)
+		}
+		return reply(ctx, "ok", nil)
+	case "version":
+		type versionResp struct {
+			Version string `json:"version"`
+			Channel string `json:"channel"`
+		}
+
+		rtn := versionResp{
+			Version: version.Version,
+			Channel: string(version.Channel),
+		}
+
+		return reply(ctx, rtn, nil)
+
 	case "list-apps":
 		type app struct {
-			ID   string `json:"id"`
-			Name string `json:"name"`
+			ID      string `json:"id"`
+			Name    string `json:"name"`
+			AppRoot string `json:"app_root"`
+			Offline bool   `json:"offline,omitempty"`
 		}
-		runs := h.run.ListRuns()
+
 		apps := []app{} // prevent marshalling as null
-		seen := make(map[string]bool)
-		for _, r := range runs {
-			id := r.AppID
-			name := r.AppSlug
-			if name == "" {
-				name = filepath.Base(r.Root)
+
+		// Load all the apps we know about
+		allApp, err := h.apps.List()
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		for _, instance := range allApp {
+			data := app{
+				ID:      instance.PlatformOrLocalID(),
+				Name:    instance.Name(),
+				AppRoot: instance.Root(),
+				Offline: true,
 			}
-			if !seen[id] {
-				seen[id] = true
-				apps = append(apps, app{ID: id, Name: name})
+
+			if run := h.run.FindRunByAppID(instance.PlatformOrLocalID()); run != nil {
+				data.Offline = false
 			}
+
+			apps = append(apps, data)
 		}
+
+		// Sort the apps by offline status, then by name
+		slices.SortStableFunc(apps, func(a, b app) int {
+			if a.Offline == b.Offline {
+				return strings.Compare(a.Name, b.Name)
+			}
+			if a.Offline {
+				return 1
+			}
+			return -1
+		})
+
 		return reply(ctx, apps, nil)
+	case "traces/clear":
+		telemetry.Send("traces.clear")
+		var params struct {
+			AppID string `json:"app_id"`
+		}
+		if err := unmarshal(&params); err != nil {
+			return reply(ctx, nil, err)
+		}
+		err := h.tr.Clear(ctx, params.AppID)
+		return reply(ctx, "ok", err)
+	case "traces/list":
+		telemetry.Send("traces.list")
+		var params struct {
+			AppID      string `json:"app_id"`
+			MessageID  string `json:"message_id"`
+			TestTraces *bool  `json:"test_traces,omitempty"`
+		}
+		if err := unmarshal(&params); err != nil {
+			return reply(ctx, nil, err)
+		}
+
+		query := &trace2.Query{
+			AppID:      params.AppID,
+			TestFilter: params.TestTraces,
+			MessageID:  params.MessageID,
+			Limit:      100,
+		}
+		var list []*tracepb2.SpanSummary
+		iter := func(s *tracepb2.SpanSummary) bool {
+			list = append(list, s)
+			return true
+		}
+		err := h.tr.List(ctx, query, iter)
+		if err != nil {
+			log.Error().Err(err).Msg("dash: could not list traces")
+		}
+		return reply(ctx, list, err)
+
+	case "traces/get":
+		telemetry.Send("traces.get")
+		var params struct {
+			AppID   string `json:"app_id"`
+			TraceID string `json:"trace_id"`
+		}
+		if err := unmarshal(&params); err != nil {
+			return reply(ctx, nil, err)
+		}
 
-	case "list-traces":
+		var events []*tracepb2.TraceEvent
+		iter := func(ev *tracepb2.TraceEvent) bool {
+			events = append(events, ev)
+			return true
+		}
+		err := h.tr.Get(ctx, params.AppID, params.TraceID, iter)
+		if err != nil {
+			log.Error().Err(err).Msg("dash: could not list trace events")
+		}
+		return reply(ctx, events, err)
+
+	case "status":
 		var params struct {
 			AppID string
 		}
 		if err := unmarshal(&params); err != nil {
 			return reply(ctx, nil, err)
 		}
-		traces := h.tr.List(params.AppID)
-		tr := make([]*Trace, len(traces))
-		for i, t := range traces {
-			tt, err := TransformTrace(t)
-			if err != nil {
+
+		// Find the latest app by platform ID or local ID.
+		app, err := h.apps.FindLatestByPlatformOrLocalID(params.AppID)
+		if err != nil {
+			if errors.Is(err, apps.ErrNotFound) {
+				return reply(ctx, map[string]interface{}{"running": false}, nil)
+			} else {
 				return reply(ctx, nil, err)
 			}
-			tr[i] = tt
 		}
-		return reply(ctx, tr, nil)
 
-	case "status":
+		// Now find the running instance(s)
+		runInstance := h.run.FindRunByAppID(params.AppID)
+		status, err := buildAppStatus(app, runInstance)
+		if err != nil {
+			log.Error().Err(err).Msg("dash: could not build app status")
+			return reply(ctx, nil, err)
+		}
+
+		return reply(ctx, status, nil)
+	case "db-migration-status":
 		var params struct {
 			AppID string
 		}
@@ -79,82 +302,290 @@ func (h *handler) Handle(ctx context.Context, reply jsonrpc2.Replier, r jsonrpc2
 			return reply(ctx, nil, err)
 		}
 
-		run := h.run.FindRunByAppID(params.AppID)
-		if run == nil {
-			return reply(ctx, map[string]interface{}{"running": false}, nil)
-		}
-		proc := run.Proc()
-		if proc == nil {
-			return reply(ctx, map[string]interface{}{"running": false}, nil)
+		// Find the latest app by platform ID or local ID.
+		app, err := h.apps.FindLatestByPlatformOrLocalID(params.AppID)
+		if err != nil {
+			return reply(ctx, nil, err)
 		}
 
-		m := &jsonpb.Marshaler{OrigName: true, EmitDefaults: true}
-		for _, svc := range proc.Meta.Svcs {
-			for _, rpc := range svc.Rpcs {
-				log.Info().Str("rpc", svc.Name+"."+rpc.Name).Msg("rpc")
-			}
+		appMeta, err := h.GetMeta(params.AppID)
+		if err != nil {
+			return reply(ctx, nil, err)
 		}
 
-		str, err := m.MarshalToString(proc.Meta)
+		namespace, err := h.GetNamespace(ctx, params.AppID)
 		if err != nil {
-			log.Error().Err(err).Msg("dash: could not marshal app metadata")
 			return reply(ctx, nil, err)
 		}
 
-		return reply(ctx, map[string]interface{}{
-			"running": true,
-			"appID":   run.AppID,
-			"pid":     run.ID,
-			"meta":    json.RawMessage(str),
-			"port":    run.Port,
-		}, nil)
+		clusterType := sqldb.Run
+		cluster, ok := h.run.ClusterMgr.Get(sqldb.GetClusterID(app, clusterType, namespace))
+		if !ok {
+			return reply(ctx, nil, fmt.Errorf("failed to get database cluster of type %s", clusterType))
+		}
 
+		status := buildDbMigrationStatus(ctx, appMeta, cluster)
+
+		return reply(ctx, status, nil)
 	case "api-call":
-		var params struct {
-			AppID     string
-			Endpoint  string
-			Payload   []byte
-			AuthToken string
+		telemetry.Send("api.call")
+		var params run.ApiCallParams
+		if err := unmarshal(&params); err != nil {
+			return reply(ctx, nil, err)
+		}
+		res, err := run.CallAPI(ctx, h.run.FindRunByAppID(params.AppID), &params)
+		return reply(ctx, res, err)
+
+	case "editors/list":
+		var resp struct {
+			Editors []string `json:"editors"`
 		}
 
+		found, err := editors.Resolve(ctx)
+		if err != nil {
+			log.Err(err).Msg("dash: could not list editors")
+			return reply(ctx, nil, err)
+		}
+
+		for _, e := range found {
+			resp.Editors = append(resp.Editors, string(e.Editor))
+		}
+		return reply(ctx, resp, nil)
+	case "ai/propose-system-design":
+		telemetry.Send("ai.propose")
+		log.Debug().Msg("dash: propose-system-design")
+		var params struct {
+			AppID  string `json:"app_id"`
+			Prompt string `json:"prompt"`
+		}
 		if err := unmarshal(&params); err != nil {
 			return reply(ctx, nil, err)
 		}
-		run := h.run.FindRunByAppID(params.AppID)
-		if run == nil {
-			log.Error().Str("appID", params.AppID).Msg("dash: cannot make api call: app not running")
-			return reply(ctx, nil, fmt.Errorf("app not running"))
+		md, err := h.GetMeta(params.AppID)
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		sessionCh := make(chan *ai.AINotification)
+		defer close(sessionCh)
+		idResp := sync.Once{}
+		task, err := h.ai.ProposeSystemDesign(ctx, params.AppID, params.Prompt, md, func(ctx context.Context, msg *ai.AINotification) error {
+			if _, ok := msg.Value.(ai.SessionUpdate); ok || msg.Error != nil {
+				idResp.Do(func() {
+					sessionCh <- msg
+				})
+				if ok {
+					return nil
+				}
+			}
+			return h.rpc.Notify(ctx, r.Method()+"/stream", msg)
+		})
+		if err != nil {
+			return reply(ctx, nil, err)
 		}
 
-		url := fmt.Sprintf("http://localhost:%d/%s", run.Port, params.Endpoint)
-		log := log.With().Str("appID", params.AppID).Str("endpoint", params.Endpoint).Logger()
+		select {
+		case msg := <-sessionCh:
+			su, ok := msg.Value.(ai.SessionUpdate)
+			if !ok || msg.Error != nil {
+				if msg.Error != nil {
+					err = jsonrpc2.NewError(ai.ErrorCodeMap[msg.Error.Code], msg.Error.Message)
+				} else {
+					err = jsonrpc2.NewError(1, "missing session_id")
+				}
+				return reply(ctx, nil, err)
+			}
+			return reply(ctx, map[string]string{
+				"session_id":      string(su.Id),
+				"subscription_id": task.SubscriptionID,
+			}, nil)
+		case <-ctx.Done():
+			return reply(ctx, nil, ctx.Err())
+		case <-time.NewTimer(10 * time.Second).C:
+			_ = task.Stop()
+			return reply(ctx, nil, errors.New("timed out waiting for response"))
+		}
 
-		req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(params.Payload))
+	case "ai/modify-system-design":
+		telemetry.Send("ai.modify")
+		log.Debug().Msg("dash: modify-system-design")
+		var params struct {
+			AppID          string         `json:"app_id"`
+			SessionID      ai.AISessionID `json:"session_id"`
+			OriginalPrompt string         `json:"original_prompt"`
+			Prompt         string         `json:"prompt"`
+			Proposed       []ai.Service   `json:"proposed"`
+		}
+		if err := unmarshal(&params); err != nil {
+			return reply(ctx, nil, err)
+		}
+		md, err := h.GetMeta(params.AppID)
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		task, err := h.ai.ModifySystemDesign(ctx, params.AppID, params.SessionID, params.OriginalPrompt, params.Proposed, params.Prompt, md, func(ctx context.Context, msg *ai.AINotification) error {
+			return h.rpc.Notify(ctx, r.Method()+"/stream", msg)
+		})
+		return reply(ctx, task.SubscriptionID, err)
+	case "ai/define-endpoints":
+		telemetry.Send("ai.details")
+		log.Debug().Msg("dash: define-endpoints")
+		log.Debug().Msg("dash: define-endpoints")
+		var params struct {
+			AppID     string         `json:"app_id"`
+			SessionID ai.AISessionID `json:"session_id"`
+			Prompt    string         `json:"prompt"`
+			Proposed  []ai.Service   `json:"proposed"`
+		}
+		if err := unmarshal(&params); err != nil {
+			return reply(ctx, nil, err)
+		}
+		md, err := h.GetMeta(params.AppID)
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		task, err := h.ai.DefineEndpoints(ctx, params.AppID, params.SessionID, params.Prompt, md, params.Proposed, func(ctx context.Context, msg *ai.AINotification) error {
+			return h.rpc.Notify(ctx, r.Method()+"/stream", msg)
+		})
+		return reply(ctx, task.SubscriptionID, err)
+	case "ai/parse-code":
+		log.Debug().Msg("dash: parse-code")
+		var params struct {
+			AppID    string       `json:"app_id"`
+			Services []ai.Service `json:"services"`
+		}
+		if err := unmarshal(&params); err != nil {
+			return reply(ctx, nil, err)
+		}
+		app, err := h.apps.FindLatestByPlatformOrLocalID(params.AppID)
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		results, err := h.ai.ParseCode(ctx, params.Services, app)
+		return reply(ctx, results, err)
+	case "ai/update-code":
+		log.Debug().Msg("dash: update-code")
+		var params struct {
+			AppID     string       `json:"app_id"`
+			Services  []ai.Service `json:"services"`
+			Overwrite bool         `json:"overwrite"` // Ovwerwrite any existing endpoint code
+		}
+		if err := unmarshal(&params); err != nil {
+			return reply(ctx, nil, err)
+		}
+		app, err := h.apps.FindLatestByPlatformOrLocalID(params.AppID)
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		results, err := h.ai.UpdateCode(ctx, params.Services, app, params.Overwrite)
+		return reply(ctx, results, err)
+	case "ai/preview-files":
+		telemetry.Send("ai.preview")
+		log.Debug().Msg("dash: preview-files")
+		var params struct {
+			AppID    string       `json:"app_id"`
+			Services []ai.Service `json:"services"`
+		}
+		if err := unmarshal(&params); err != nil {
+			return reply(ctx, nil, err)
+		}
+		app, err := h.apps.FindLatestByPlatformOrLocalID(params.AppID)
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		result, err := h.ai.PreviewFiles(ctx, params.Services, app)
+		return reply(ctx, result, err)
+	case "ai/write-files":
+		telemetry.Send("ai.write")
+		log.Debug().Msg("dash: write-files")
+		var params struct {
+			AppID    string       `json:"app_id"`
+			Services []ai.Service `json:"services"`
+		}
+		if err := unmarshal(&params); err != nil {
+			return reply(ctx, nil, err)
+		}
+		app, err := h.apps.FindLatestByPlatformOrLocalID(params.AppID)
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		result, err := h.ai.WriteFiles(ctx, params.Services, app)
+		return reply(ctx, result, err)
+	case "ai/parse-sql-schema":
+		var params struct {
+			AppID string `json:"app_id"`
+		}
+		if err := unmarshal(&params); err != nil {
+			return reply(ctx, nil, err)
+		}
+		app, err := h.apps.FindLatestByPlatformOrLocalID(params.AppID)
+		if err != nil {
+			return reply(ctx, nil, err)
+		}
+		md, err := h.GetMeta(params.AppID)
 		if err != nil {
-			log.Err(err).Msg("dash: api call failed")
 			return reply(ctx, nil, err)
 		}
-		if tok := params.AuthToken; tok != "" {
-			req.Header.Set("Authorization", "Bearer "+tok)
+		for _, db := range md.SqlDatabases {
+			_, err := ai.ParseSQLSchema(app, *db.MigrationRelPath)
+			if err != nil {
+				return reply(ctx, nil, err)
+			}
+		}
+		return reply(ctx, true, err)
+	case "editors/open":
+		telemetry.Send("editors.open")
+		var params struct {
+			AppID     string             `json:"app_id"`
+			Editor    editors.EditorName `json:"editor"`
+			File      string             `json:"file"`
+			StartLine int                `json:"start_line,omitempty"`
+			StartCol  int                `json:"start_col,omitempty"`
+			EndLine   int                `json:"end_line,omitempty"`
+			EndCol    int                `json:"end_col,omitempty"`
+		}
+		if err := unmarshal(&params); err != nil {
+			log.Warn().Err(err).Msg("dash: could not parse open command")
+			return reply(ctx, nil, err)
+		}
+
+		editor, err := editors.Find(ctx, params.Editor)
+		if err != nil {
+			log.Err(err).Str("editor", string(params.Editor)).Msg("dash: could not find editor")
+			return reply(ctx, nil, err)
 		}
-		resp, err := http.DefaultClient.Do(req)
+
+		app, err := h.apps.FindLatestByPlatformOrLocalID(params.AppID)
 		if err != nil {
-			log.Error().Err(err).Msg("dash: api call failed")
+			if errors.Is(err, apps.ErrNotFound) {
+				return reply(ctx, nil, fmt.Errorf("app not found, try running encore run"))
+			}
+			log.Err(err).Str("app_id", params.AppID).Msg("dash: could not find app")
 			return reply(ctx, nil, err)
 		}
-		body, _ := ioutil.ReadAll(resp.Body)
-		resp.Body.Close()
-		log.Info().Int("status", resp.StatusCode).Msg("dash: api call completed")
-		return reply(ctx, map[string]interface{}{
-			"status":      resp.Status,
-			"status_code": resp.StatusCode,
-			"body":        body,
-		}, nil)
+
+		if !filepath.IsLocal(params.File) {
+			log.Warn().Str("file", params.File).Msg("dash: file was not local to the repo")
+			return reply(ctx, nil, errors.New("file path must be local"))
+		}
+		params.File = filepath.Join(app.Root(), params.File)
+
+		if err := editors.LaunchExternalEditor(params.File, params.StartLine, params.StartCol, editor); err != nil {
+			log.Err(err).Str("editor", string(params.Editor)).Msg("dash: could not open file")
+			return reply(ctx, nil, err)
+		}
+
+		type openResp struct{}
+		return reply(ctx, openResp{}, nil)
 	}
 
 	return jsonrpc2.MethodNotFound(ctx, reply, r)
 }
 
+type sourceContextResponse struct {
+	Lines []string `json:"lines"`
+	Start int      `json:"start"`
+}
+
 func (h *handler) listenNotify(ctx context.Context, ch <-chan *notification) {
 	for {
 		select {
@@ -169,9 +600,8 @@ func (h *handler) listenNotify(ctx context.Context, ch <-chan *notification) {
 }
 
 func (s *Server) listenTraces() {
-	for tt := range s.traceCh {
-		// Transforming a trace is fairly expensive, so only do it
-		// if somebody is listening.
+	for sp := range s.traceCh {
+		// Only marshal the trace if someone's listening.
 		s.mu.Lock()
 		hasClients := len(s.clients) > 0
 		s.mu.Unlock()
@@ -179,14 +609,19 @@ func (s *Server) listenTraces() {
 			continue
 		}
 
-		tr, err := TransformTrace(tt)
+		data, err := jsonext.ProtoEncoder.Marshal(sp.Span)
 		if err != nil {
-			log.Error().Err(err).Msg("dash: could not process trace")
+			log.Error().Err(err).Msg("dash: could not marshal trace")
 			continue
 		}
+
 		s.notify(&notification{
 			Method: "trace/new",
-			Params: tr,
+			Params: map[string]any{
+				"app_id":     sp.AppID,
+				"test_trace": sp.TestTrace,
+				"span":       json.RawMessage(data),
+			},
 		})
 	}
 }
@@ -195,52 +630,65 @@ var _ run.EventListener = (*Server)(nil)
 
 // OnStart notifies active websocket clients about the started run.
 func (s *Server) OnStart(r *run.Run) {
-	m := &jsonpb.Marshaler{OrigName: true, EmitDefaults: true}
-	proc := r.Proc()
-	str, err := m.MarshalToString(proc.Meta)
+	status, err := buildAppStatus(r.App, r)
 	if err != nil {
-		log.Error().Err(err).Msg("dash: could not marshal app meta")
+		log.Error().Err(err).Msg("dash: could not build app status")
 		return
 	}
 
+	// Open the browser if needed.
+	browserMode := r.Params.Browser
+	if browserMode == run.BrowserModeAlways || (browserMode == run.BrowserModeAuto && !s.hasClients()) {
+		u := fmt.Sprintf("http://localhost:%d/%s", s.dashPort, r.App.PlatformOrLocalID())
+		browser.Open(u)
+	}
+
 	s.notify(&notification{
 		Method: "process/start",
-		Params: map[string]interface{}{
-			"appID": r.AppID,
-			"pid":   r.ID,
-			"port":  r.Port,
-			"meta":  json.RawMessage(str),
-		},
+		Params: status,
+	})
+}
+
+func (s *Server) OnCompileStart(r *run.Run) {
+	status, err := buildAppStatus(r.App, r)
+	if err != nil {
+		log.Error().Err(err).Msg("dash: could not build app status")
+		return
+	}
+
+	status.Compiling = true
+
+	s.notify(&notification{
+		Method: "process/compile-start",
+		Params: status,
 	})
 }
 
 // OnReload notifies active websocket clients about the reloaded run.
 func (s *Server) OnReload(r *run.Run) {
-	m := &jsonpb.Marshaler{OrigName: true, EmitDefaults: true}
-	proc := r.Proc()
-	str, err := m.MarshalToString(proc.Meta)
+	status, err := buildAppStatus(r.App, r)
 	if err != nil {
-		log.Error().Err(err).Msg("dash: could not marshal app meta")
+		log.Error().Err(err).Msg("dash: could not build app status")
 		return
 	}
+
 	s.notify(&notification{
 		Method: "process/reload",
-		Params: map[string]interface{}{
-			"appID": r.AppID,
-			"pid":   r.ID,
-			"meta":  json.RawMessage(str),
-		},
+		Params: status,
 	})
 }
 
 // OnStop notifies active websocket clients about the stopped run.
 func (s *Server) OnStop(r *run.Run) {
+	status, err := buildAppStatus(r.App, nil)
+	if err != nil {
+		log.Error().Err(err).Msg("dash: could not build app status")
+		return
+	}
+
 	s.notify(&notification{
 		Method: "process/stop",
-		Params: map[string]interface{}{
-			"appID": r.AppID,
-			"pid":   r.ID,
-		},
+		Params: status,
 	})
 }
 
@@ -254,6 +702,27 @@ func (s *Server) OnStderr(r *run.Run, out []byte) {
 	s.onOutput(r, out)
 }
 
+func (s *Server) OnError(r *run.Run, err *errlist.List) {
+	if err == nil {
+		return
+	}
+
+	status, statusErr := buildAppStatus(r.App, nil)
+	if statusErr != nil {
+		log.Error().Err(statusErr).Msg("dash: could not build app status")
+		return
+	}
+
+	err.MakeRelative(r.App.Root(), "")
+
+	status.CompileError = err.Error()
+
+	s.notify(&notification{
+		Method: "process/compile-error",
+		Params: status,
+	})
+}
+
 func (s *Server) onOutput(r *run.Run, out []byte) {
 	// Copy to a new slice since we cannot retain it after the call ends, and notify is async.
 	out2 := make([]byte, len(out))
@@ -261,9 +730,151 @@ func (s *Server) onOutput(r *run.Run, out []byte) {
 	s.notify(&notification{
 		Method: "process/output",
 		Params: map[string]interface{}{
-			"appID":  r.AppID,
+			"appID":  r.App.PlatformOrLocalID(),
 			"pid":    r.ID,
 			"output": out2,
 		},
 	})
 }
+
+// protoReplier is a jsonrpc2.Replier that wraps another replier and serializes
+// any protobuf message with protojson.
+func makeProtoReplier(rep jsonrpc2.Replier) jsonrpc2.Replier {
+	return func(ctx context.Context, result any, err error) error {
+		if err != nil {
+			return rep(ctx, nil, err)
+		}
+		jsonData, err := jsonext.ProtoEncoder.Marshal(result)
+		return rep(ctx, json.RawMessage(jsonData), err)
+	}
+}
+
+// appStatus is the the shared data structure to communicate app status to the client.
+//
+// It is mirrored in the frontend at src/lib/client/dev-dash-client.ts as `AppStatus`.
+type appStatus struct {
+	Running      bool                  `json:"running"`
+	Tutorial     string                `json:"tutorial,omitempty"`
+	AppID        string                `json:"appID"`
+	PlatformID   string                `json:"platformID,omitempty"`
+	AppRoot      string                `json:"appRoot"`
+	PID          string                `json:"pid,omitempty"`
+	Meta         json.RawMessage       `json:"meta,omitempty"`
+	Addr         string                `json:"addr,omitempty"`
+	APIEncoding  *encoding.APIEncoding `json:"apiEncoding,omitempty"`
+	Compiling    bool                  `json:"compiling"`
+	CompileError string                `json:"compileError,omitempty"`
+}
+
+type dbMigrationHistory struct {
+	DatabaseName string        `json:"databaseName"`
+	Migrations   []dbMigration `json:"migrations"`
+}
+
+type dbMigration struct {
+	Filename    string `json:"filename"`
+	Number      uint64 `json:"number"`
+	Description string `json:"description"`
+	Applied     bool   `json:"applied"`
+}
+
+func buildAppStatus(app *apps.Instance, runInstance *run.Run) (s appStatus, err error) {
+	// Now try and grab latest metadata for the app
+	var md *meta.Data
+	if runInstance != nil {
+		proc := runInstance.ProcGroup()
+		if proc != nil {
+			md = proc.Meta
+		}
+	}
+
+	if md == nil {
+		md, err = app.CachedMetadata()
+		if err != nil {
+			return appStatus{}, err
+		}
+	}
+
+	// Convert the metadata into a format we can send to the client
+	mdStr := "null"
+	var apiEnc *encoding.APIEncoding
+	if md != nil {
+		m := &jsonpb.Marshaler{OrigName: true, EmitDefaults: true}
+
+		mdStr, err = m.MarshalToString(md)
+		if err != nil {
+			return appStatus{}, err
+		}
+
+		apiEnc = encoding.DescribeAPI(md)
+	}
+
+	// Build the response
+	resp := appStatus{
+		Running:     false,
+		Tutorial:    app.Tutorial(),
+		AppID:       app.PlatformOrLocalID(),
+		PlatformID:  app.PlatformID(),
+		Meta:        json.RawMessage(mdStr),
+		AppRoot:     app.Root(),
+		APIEncoding: apiEnc,
+	}
+	if runInstance != nil {
+		resp.Running = true
+		resp.PID = runInstance.ID
+		resp.Addr = runInstance.ListenAddr
+	}
+
+	return resp, nil
+}
+
+func buildDbMigrationStatus(ctx context.Context, appMeta *meta.Data, cluster *sqldb.Cluster) []dbMigrationHistory {
+	var statuses []dbMigrationHistory
+	for _, dbMeta := range appMeta.SqlDatabases {
+		db, ok := cluster.GetDB(dbMeta.Name)
+		if !ok {
+			// Remote database migration status are not supported yet
+			continue
+		}
+		appliedVersions, err := db.ListAppliedMigrations(ctx)
+		if err != nil {
+			log.Error().Msgf("failed to list applied migrations for database %s: %v", dbMeta.Name, err)
+			continue
+		}
+		statuses = append(statuses, buildMigrationHistory(dbMeta, appliedVersions))
+	}
+	return statuses
+}
+
+func buildMigrationHistory(dbMeta *meta.SQLDatabase, appliedVersions map[uint64]bool) dbMigrationHistory {
+	history := dbMigrationHistory{
+		DatabaseName: dbMeta.Name,
+		Migrations:   []dbMigration{},
+	}
+	// Go over migrations from latest to earliest
+	sortedMigrations := make([]*meta.DBMigration, len(dbMeta.Migrations))
+	copy(sortedMigrations, dbMeta.Migrations)
+	slices.SortStableFunc(sortedMigrations, func(a, b *meta.DBMigration) int {
+		return int(b.Number - a.Number)
+	})
+	implicitlyApplied := false
+	for _, migration := range sortedMigrations {
+		dirty, attempted := appliedVersions[migration.Number]
+		applied := attempted && !dirty
+		// If the database doesn't allow non-sequential migrations,
+		// then any migrations before the last applied will also have
+		// been applied even if we don't see them in the database.
+		if !dbMeta.AllowNonSequentialMigrations && applied {
+			implicitlyApplied = true
+		}
+
+		status := dbMigration{
+			Filename:    migration.Filename,
+			Number:      migration.Number,
+			Description: migration.Description,
+			Applied:     applied || implicitlyApplied,
+		}
+		history.Migrations = append(history.Migrations, status)
+	}
+	return history
+}
diff --git a/cli/daemon/dash/dash_test.go b/cli/daemon/dash/dash_test.go
new file mode 100644
index 0000000000..b5fa38acd9
--- /dev/null
+++ b/cli/daemon/dash/dash_test.go
@@ -0,0 +1,138 @@
+package dash
+
+import (
+	"reflect"
+	"testing"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+func TestBuildMigrationHistory(t *testing.T) {
+	tests := []struct {
+		name            string
+		dbMeta          *meta.SQLDatabase
+		appliedVersions map[uint64]bool
+		want            dbMigrationHistory
+	}{
+		{
+			name: "sequential migrations all applied cleanly",
+			dbMeta: &meta.SQLDatabase{
+				Name: "test-db",
+				Migrations: []*meta.DBMigration{
+					{Number: 1, Filename: "001.sql", Description: "first"},
+					{Number: 2, Filename: "002.sql", Description: "second"},
+					{Number: 3, Filename: "003.sql", Description: "third"},
+				},
+				AllowNonSequentialMigrations: false,
+			},
+			appliedVersions: map[uint64]bool{
+				1: false, // clean
+				2: false, // clean
+				3: false, // clean
+			},
+			want: dbMigrationHistory{
+				DatabaseName: "test-db",
+				Migrations: []dbMigration{
+					{Number: 3, Filename: "003.sql", Description: "third", Applied: true},
+					{Number: 2, Filename: "002.sql", Description: "second", Applied: true},
+					{Number: 1, Filename: "001.sql", Description: "first", Applied: true},
+				},
+			},
+		},
+		{
+			name: "sequential migrations with dirty migration",
+			dbMeta: &meta.SQLDatabase{
+				Name: "test-db",
+				Migrations: []*meta.DBMigration{
+					{Number: 1, Filename: "001.sql", Description: "first"},
+					{Number: 2, Filename: "002.sql", Description: "second"},
+					{Number: 3, Filename: "003.sql", Description: "third"},
+				},
+				AllowNonSequentialMigrations: false,
+			},
+			appliedVersions: map[uint64]bool{
+				1: false, // clean
+				2: true,  // dirty
+			},
+			want: dbMigrationHistory{
+				DatabaseName: "test-db",
+				Migrations: []dbMigration{
+					{Number: 3, Filename: "003.sql", Description: "third", Applied: false},
+					{Number: 2, Filename: "002.sql", Description: "second", Applied: false},
+					{Number: 1, Filename: "001.sql", Description: "first", Applied: true},
+				},
+			},
+		},
+		{
+			name: "sequential migrations partially applied",
+			dbMeta: &meta.SQLDatabase{
+				Name: "test-db",
+				Migrations: []*meta.DBMigration{
+					{Number: 1, Filename: "001.sql", Description: "first"},
+					{Number: 2, Filename: "002.sql", Description: "second"},
+					{Number: 3, Filename: "003.sql", Description: "third"},
+				},
+				AllowNonSequentialMigrations: false,
+			},
+			appliedVersions: map[uint64]bool{
+				1: false, // clean
+				2: false, // clean
+			},
+			want: dbMigrationHistory{
+				DatabaseName: "test-db",
+				Migrations: []dbMigration{
+					{Number: 3, Filename: "003.sql", Description: "third", Applied: false},
+					{Number: 2, Filename: "002.sql", Description: "second", Applied: true},
+					{Number: 1, Filename: "001.sql", Description: "first", Applied: true},
+				},
+			},
+		},
+		{
+			name: "non-sequential migrations with mix of clean and dirty",
+			dbMeta: &meta.SQLDatabase{
+				Name: "test-db",
+				Migrations: []*meta.DBMigration{
+					{Number: 1, Filename: "001.sql", Description: "first"},
+					{Number: 2, Filename: "002.sql", Description: "second"},
+					{Number: 3, Filename: "003.sql", Description: "third"},
+				},
+				AllowNonSequentialMigrations: true,
+			},
+			appliedVersions: map[uint64]bool{
+				1: false, // clean
+				2: true,  // dirty
+				3: false, // clean
+			},
+			want: dbMigrationHistory{
+				DatabaseName: "test-db",
+				Migrations: []dbMigration{
+					{Number: 3, Filename: "003.sql", Description: "third", Applied: true},
+					{Number: 2, Filename: "002.sql", Description: "second", Applied: false},
+					{Number: 1, Filename: "001.sql", Description: "first", Applied: true},
+				},
+			},
+		},
+		{
+			name: "empty migrations list",
+			dbMeta: &meta.SQLDatabase{
+				Name:                         "test-db",
+				Migrations:                   []*meta.DBMigration{},
+				AllowNonSequentialMigrations: false,
+			},
+			appliedVersions: map[uint64]bool{},
+			want: dbMigrationHistory{
+				DatabaseName: "test-db",
+				Migrations:   []dbMigration{},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := buildMigrationHistory(tt.dbMeta, tt.appliedVersions)
+			if !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("buildMigrationHistory() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/cli/daemon/dash/dashapp/.gitignore b/cli/daemon/dash/dashapp/.gitignore
deleted file mode 100644
index d451ff16c1..0000000000
--- a/cli/daemon/dash/dashapp/.gitignore
+++ /dev/null
@@ -1,5 +0,0 @@
-node_modules
-.DS_Store
-dist
-dist-ssr
-*.local
diff --git a/cli/daemon/dash/dashapp/index.html b/cli/daemon/dash/dashapp/index.html
deleted file mode 100644
index aa72ddc665..0000000000
--- a/cli/daemon/dash/dashapp/index.html
+++ /dev/null
@@ -1,13 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Encore Dashboard</title>
-  </head>
-  <body>
-    <div id="root"></div>
-    <div id="modal-root"></div>
-    <script type="module" src="/src/main.tsx"></script>
-  </body>
-</html>
diff --git a/cli/daemon/dash/dashapp/package-lock.json b/cli/daemon/dash/dashapp/package-lock.json
deleted file mode 100644
index ef5fc1dd9b..0000000000
--- a/cli/daemon/dash/dashapp/package-lock.json
+++ /dev/null
@@ -1,2883 +0,0 @@
-{
-  "name": "dashapp",
-  "version": "0.0.0",
-  "lockfileVersion": 2,
-  "requires": true,
-  "packages": {
-    "": {
-      "version": "0.0.0",
-      "dependencies": {
-        "@headlessui/react": "^0.2.0",
-        "@tailwindcss/forms": "^0.2.1",
-        "codemirror": "^5.59.2",
-        "events": "^3.2.0",
-        "json-rpc-protocol": "^0.13.1",
-        "luxon": "^1.25.0",
-        "react": "^17.0.0",
-        "react-dom": "^17.0.0",
-        "react-router-dom": "^5.2.0",
-        "tailwindcss": "^2.0.2"
-      },
-      "devDependencies": {
-        "@types/codemirror": "^0.0.108",
-        "@types/events": "^3.0.0",
-        "@types/luxon": "^1.25.1",
-        "@types/node": "^14.14.25",
-        "@types/react": "^17.0.0",
-        "@types/react-dom": "^17.0.0",
-        "@types/react-router-dom": "^5.1.7",
-        "@vitejs/plugin-react-refresh": "^1.1.0",
-        "autoprefixer": "^10.2.4",
-        "postcss": "^8.2.5",
-        "typescript": "^4.1.2",
-        "vite": "^2.0.0-beta.64"
-      }
-    },
-    "node_modules/@babel/code-frame": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.12.13.tgz",
-      "integrity": "sha512-HV1Cm0Q3ZrpCR93tkWOYiuYIgLxZXZFVG2VgK+MBWjUqZTundupbfx2aXarXuw5Ko5aMcjtJgbSs4vUGBS5v6g==",
-      "dev": true,
-      "dependencies": {
-        "@babel/highlight": "^7.12.13"
-      }
-    },
-    "node_modules/@babel/core": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.12.13.tgz",
-      "integrity": "sha512-BQKE9kXkPlXHPeqissfxo0lySWJcYdEP0hdtJOH/iJfDdhOCcgtNCjftCJg3qqauB4h+lz2N6ixM++b9DN1Tcw==",
-      "dev": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.12.13",
-        "@babel/generator": "^7.12.13",
-        "@babel/helper-module-transforms": "^7.12.13",
-        "@babel/helpers": "^7.12.13",
-        "@babel/parser": "^7.12.13",
-        "@babel/template": "^7.12.13",
-        "@babel/traverse": "^7.12.13",
-        "@babel/types": "^7.12.13",
-        "convert-source-map": "^1.7.0",
-        "debug": "^4.1.0",
-        "gensync": "^1.0.0-beta.1",
-        "json5": "^2.1.2",
-        "lodash": "^4.17.19",
-        "semver": "^5.4.1",
-        "source-map": "^0.5.0"
-      },
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/@babel/generator": {
-      "version": "7.12.15",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.12.15.tgz",
-      "integrity": "sha512-6F2xHxBiFXWNSGb7vyCUTBF8RCLY66rS0zEPcP8t/nQyXjha5EuK4z7H5o7fWG8B4M7y6mqVWq1J+1PuwRhecQ==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.12.13",
-        "jsesc": "^2.5.1",
-        "source-map": "^0.5.0"
-      }
-    },
-    "node_modules/@babel/helper-function-name": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.12.13.tgz",
-      "integrity": "sha512-TZvmPn0UOqmvi5G4vvw0qZTpVptGkB1GL61R6lKvrSdIxGm5Pky7Q3fpKiIkQCAtRCBUwB0PaThlx9vebCDSwA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-get-function-arity": "^7.12.13",
-        "@babel/template": "^7.12.13",
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "node_modules/@babel/helper-get-function-arity": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-get-function-arity/-/helper-get-function-arity-7.12.13.tgz",
-      "integrity": "sha512-DjEVzQNz5LICkzN0REdpD5prGoidvbdYk1BVgRUOINaWJP2t6avB27X1guXK1kXNrX0WMfsrm1A/ZBthYuIMQg==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "node_modules/@babel/helper-member-expression-to-functions": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.12.13.tgz",
-      "integrity": "sha512-B+7nN0gIL8FZ8SvMcF+EPyB21KnCcZHQZFczCxbiNGV/O0rsrSBlWGLzmtBJ3GMjSVMIm4lpFhR+VdVBuIsUcQ==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "node_modules/@babel/helper-module-imports": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.12.13.tgz",
-      "integrity": "sha512-NGmfvRp9Rqxy0uHSSVP+SRIW1q31a7Ji10cLBcqSDUngGentY4FRiHOFZFE1CLU5eiL0oE8reH7Tg1y99TDM/g==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "node_modules/@babel/helper-module-transforms": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.12.13.tgz",
-      "integrity": "sha512-acKF7EjqOR67ASIlDTupwkKM1eUisNAjaSduo5Cz+793ikfnpe7p4Q7B7EWU2PCoSTPWsQkR7hRUWEIZPiVLGA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-module-imports": "^7.12.13",
-        "@babel/helper-replace-supers": "^7.12.13",
-        "@babel/helper-simple-access": "^7.12.13",
-        "@babel/helper-split-export-declaration": "^7.12.13",
-        "@babel/helper-validator-identifier": "^7.12.11",
-        "@babel/template": "^7.12.13",
-        "@babel/traverse": "^7.12.13",
-        "@babel/types": "^7.12.13",
-        "lodash": "^4.17.19"
-      }
-    },
-    "node_modules/@babel/helper-optimise-call-expression": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.12.13.tgz",
-      "integrity": "sha512-BdWQhoVJkp6nVjB7nkFWcn43dkprYauqtk++Py2eaf/GRDFm5BxRqEIZCiHlZUGAVmtwKcsVL1dC68WmzeFmiA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "node_modules/@babel/helper-plugin-utils": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.12.13.tgz",
-      "integrity": "sha512-C+10MXCXJLiR6IeG9+Wiejt9jmtFpxUc3MQqCmPY8hfCjyUGl9kT+B2okzEZrtykiwrc4dbCPdDoz0A/HQbDaA==",
-      "dev": true
-    },
-    "node_modules/@babel/helper-replace-supers": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.12.13.tgz",
-      "integrity": "sha512-pctAOIAMVStI2TMLhozPKbf5yTEXc0OJa0eENheb4w09SrgOWEs+P4nTOZYJQCqs8JlErGLDPDJTiGIp3ygbLg==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-member-expression-to-functions": "^7.12.13",
-        "@babel/helper-optimise-call-expression": "^7.12.13",
-        "@babel/traverse": "^7.12.13",
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "node_modules/@babel/helper-simple-access": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.12.13.tgz",
-      "integrity": "sha512-0ski5dyYIHEfwpWGx5GPWhH35j342JaflmCeQmsPWcrOQDtCN6C1zKAVRFVbK53lPW2c9TsuLLSUDf0tIGJ5hA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "node_modules/@babel/helper-split-export-declaration": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.12.13.tgz",
-      "integrity": "sha512-tCJDltF83htUtXx5NLcaDqRmknv652ZWCHyoTETf1CXYJdPC7nohZohjUgieXhv0hTJdRf2FjDueFehdNucpzg==",
-      "dev": true,
-      "dependencies": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.12.11",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.12.11.tgz",
-      "integrity": "sha512-np/lG3uARFybkoHokJUmf1QfEvRVCPbmQeUQpKow5cQ3xWrV9i3rUHodKDJPQfTVX61qKi+UdYk8kik84n7XOw==",
-      "dev": true
-    },
-    "node_modules/@babel/helpers": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.12.13.tgz",
-      "integrity": "sha512-oohVzLRZ3GQEk4Cjhfs9YkJA4TdIDTObdBEZGrd6F/T0GPSnuV6l22eMcxlvcvzVIPH3VTtxbseudM1zIE+rPQ==",
-      "dev": true,
-      "dependencies": {
-        "@babel/template": "^7.12.13",
-        "@babel/traverse": "^7.12.13",
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "node_modules/@babel/highlight": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.12.13.tgz",
-      "integrity": "sha512-kocDQvIbgMKlWxXe9fof3TQ+gkIPOUSEYhJjqUjvKMez3krV7vbzYCDq39Oj11UAVK7JqPVGQPlgE85dPNlQww==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.12.11",
-        "chalk": "^2.0.0",
-        "js-tokens": "^4.0.0"
-      }
-    },
-    "node_modules/@babel/parser": {
-      "version": "7.12.15",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.12.15.tgz",
-      "integrity": "sha512-AQBOU2Z9kWwSZMd6lNjCX0GUgFonL1wAM1db8L8PMk9UDaGsRCArBkU4Sc+UCM3AE4hjbXx+h58Lb3QT4oRmrA==",
-      "dev": true,
-      "bin": {
-        "parser": "bin/babel-parser.js"
-      },
-      "engines": {
-        "node": ">=6.0.0"
-      }
-    },
-    "node_modules/@babel/plugin-syntax-import-meta": {
-      "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz",
-      "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-plugin-utils": "^7.10.4"
-      }
-    },
-    "node_modules/@babel/runtime": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.12.13.tgz",
-      "integrity": "sha512-8+3UMPBrjFa/6TtKi/7sehPKqfAm4g6K+YQjyyFOLUTxzOngcRZTlAVY8sc2CORJYqdHQY8gRPHmn+qo15rCBw==",
-      "dependencies": {
-        "regenerator-runtime": "^0.13.4"
-      }
-    },
-    "node_modules/@babel/template": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.12.13.tgz",
-      "integrity": "sha512-/7xxiGA57xMo/P2GVvdEumr8ONhFOhfgq2ihK3h1e6THqzTAkHbkXgB0xI9yeTfIUoH3+oAeHhqm/I43OTbbjA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.12.13",
-        "@babel/parser": "^7.12.13",
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "node_modules/@babel/traverse": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.12.13.tgz",
-      "integrity": "sha512-3Zb4w7eE/OslI0fTp8c7b286/cQps3+vdLW3UcwC8VSJC6GbKn55aeVVu2QJNuCDoeKyptLOFrPq8WqZZBodyA==",
-      "dev": true,
-      "dependencies": {
-        "@babel/code-frame": "^7.12.13",
-        "@babel/generator": "^7.12.13",
-        "@babel/helper-function-name": "^7.12.13",
-        "@babel/helper-split-export-declaration": "^7.12.13",
-        "@babel/parser": "^7.12.13",
-        "@babel/types": "^7.12.13",
-        "debug": "^4.1.0",
-        "globals": "^11.1.0",
-        "lodash": "^4.17.19"
-      }
-    },
-    "node_modules/@babel/types": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.12.13.tgz",
-      "integrity": "sha512-oKrdZTld2im1z8bDwTOQvUbxKwE+854zc16qWZQlcTqMN00pWxHQ4ZeOq0yDMnisOpRykH2/5Qqcrk/OlbAjiQ==",
-      "dev": true,
-      "dependencies": {
-        "@babel/helper-validator-identifier": "^7.12.11",
-        "lodash": "^4.17.19",
-        "to-fast-properties": "^2.0.0"
-      }
-    },
-    "node_modules/@fullhuman/postcss-purgecss": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/@fullhuman/postcss-purgecss/-/postcss-purgecss-3.1.3.tgz",
-      "integrity": "sha512-kwOXw8fZ0Lt1QmeOOrd+o4Ibvp4UTEBFQbzvWldjlKv5n+G9sXfIPn1hh63IQIL8K8vbvv1oYMJiIUbuy9bGaA==",
-      "dependencies": {
-        "purgecss": "^3.1.3"
-      }
-    },
-    "node_modules/@headlessui/react": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/@headlessui/react/-/react-0.2.0.tgz",
-      "integrity": "sha512-YV+vF+QhTRcspydPdHF3ZXe+FkOiJpRdqMjjFIIX9bSdT2O2T7GurgKQdGgamNUM+B99MZBOTRqxS8Dlh485eg==",
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/@tailwindcss/forms": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/forms/-/forms-0.2.1.tgz",
-      "integrity": "sha512-czfvEdY+J2Ogfd6RUSr/ZSUmDxTujr34M++YLnp2cCPC3oJ4kFvFMaRXA6cEXKw7F1hJuapdjXRjsXIEXGgORg==",
-      "dependencies": {
-        "mini-svg-data-uri": "^1.2.3"
-      }
-    },
-    "node_modules/@types/codemirror": {
-      "version": "0.0.108",
-      "resolved": "https://registry.npmjs.org/@types/codemirror/-/codemirror-0.0.108.tgz",
-      "integrity": "sha512-3FGFcus0P7C2UOGCNUVENqObEb4SFk+S8Dnxq7K6aIsLVs/vDtlangl3PEO0ykaKXyK56swVF6Nho7VsA44uhw==",
-      "dev": true,
-      "dependencies": {
-        "@types/tern": "*"
-      }
-    },
-    "node_modules/@types/estree": {
-      "version": "0.0.46",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-0.0.46.tgz",
-      "integrity": "sha512-laIjwTQaD+5DukBZaygQ79K1Z0jb1bPEMRrkXSLjtCcZm+abyp5YbrqpSLzD42FwWW6gK/aS4NYpJ804nG2brg==",
-      "dev": true
-    },
-    "node_modules/@types/events": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@types/events/-/events-3.0.0.tgz",
-      "integrity": "sha512-EaObqwIvayI5a8dCzhFrjKzVwKLxjoG9T6Ppd5CEo07LRKfQ8Yokw54r5+Wq7FaBQ+yXRvQAYPrHwya1/UFt9g==",
-      "dev": true
-    },
-    "node_modules/@types/history": {
-      "version": "4.7.8",
-      "resolved": "https://registry.npmjs.org/@types/history/-/history-4.7.8.tgz",
-      "integrity": "sha512-S78QIYirQcUoo6UJZx9CSP0O2ix9IaeAXwQi26Rhr/+mg7qqPy8TzaxHSUut7eGjL8WmLccT7/MXf304WjqHcA==",
-      "dev": true
-    },
-    "node_modules/@types/luxon": {
-      "version": "1.25.1",
-      "resolved": "https://registry.npmjs.org/@types/luxon/-/luxon-1.25.1.tgz",
-      "integrity": "sha512-enkMO4WJcbdkhK1eZrItF616buau02wtrSN+DDt9Qj9U23boSAXNJm0fMlgwpTDaRHq3S0D/SPIRbxy4YxBjiA==",
-      "dev": true
-    },
-    "node_modules/@types/node": {
-      "version": "14.14.25",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-14.14.25.tgz",
-      "integrity": "sha512-EPpXLOVqDvisVxtlbvzfyqSsFeQxltFbluZNRndIb8tr9KiBnYNLzrc1N3pyKUCww2RNrfHDViqDWWE1LCJQtQ==",
-      "dev": true
-    },
-    "node_modules/@types/prop-types": {
-      "version": "15.7.3",
-      "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.3.tgz",
-      "integrity": "sha512-KfRL3PuHmqQLOG+2tGpRO26Ctg+Cq1E01D2DMriKEATHgWLfeNDmq9e29Q9WIky0dQ3NPkd1mzYH8Lm936Z9qw==",
-      "dev": true
-    },
-    "node_modules/@types/react": {
-      "version": "17.0.1",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-17.0.1.tgz",
-      "integrity": "sha512-w8t9f53B2ei4jeOqf/gxtc2Sswnc3LBK5s0DyJcg5xd10tMHXts2N31cKjWfH9IC/JvEPa/YF1U4YeP1t4R6HQ==",
-      "dev": true,
-      "dependencies": {
-        "@types/prop-types": "*",
-        "csstype": "^3.0.2"
-      }
-    },
-    "node_modules/@types/react-dom": {
-      "version": "17.0.0",
-      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-17.0.0.tgz",
-      "integrity": "sha512-lUqY7OlkF/RbNtD5nIq7ot8NquXrdFrjSOR6+w9a9RFQevGi1oZO1dcJbXMeONAPKtZ2UrZOEJ5UOCVsxbLk/g==",
-      "dev": true,
-      "dependencies": {
-        "@types/react": "*"
-      }
-    },
-    "node_modules/@types/react-router": {
-      "version": "5.1.11",
-      "resolved": "https://registry.npmjs.org/@types/react-router/-/react-router-5.1.11.tgz",
-      "integrity": "sha512-ofHbZMlp0Y2baOHgsWBQ4K3AttxY61bDMkwTiBOkPg7U6C/3UwwB5WaIx28JmSVi/eX3uFEMRo61BV22fDQIvg==",
-      "dev": true,
-      "dependencies": {
-        "@types/history": "*",
-        "@types/react": "*"
-      }
-    },
-    "node_modules/@types/react-router-dom": {
-      "version": "5.1.7",
-      "resolved": "https://registry.npmjs.org/@types/react-router-dom/-/react-router-dom-5.1.7.tgz",
-      "integrity": "sha512-D5mHD6TbdV/DNHYsnwBTv+y73ei+mMjrkGrla86HthE4/PVvL1J94Bu3qABU+COXzpL23T1EZapVVpwHuBXiUg==",
-      "dev": true,
-      "dependencies": {
-        "@types/history": "*",
-        "@types/react": "*",
-        "@types/react-router": "*"
-      }
-    },
-    "node_modules/@types/tern": {
-      "version": "0.23.3",
-      "resolved": "https://registry.npmjs.org/@types/tern/-/tern-0.23.3.tgz",
-      "integrity": "sha512-imDtS4TAoTcXk0g7u4kkWqedB3E4qpjXzCpD2LU5M5NAXHzCDsypyvXSaG7mM8DKYkCRa7tFp4tS/lp/Wo7Q3w==",
-      "dev": true,
-      "dependencies": {
-        "@types/estree": "*"
-      }
-    },
-    "node_modules/@vitejs/plugin-react-refresh": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react-refresh/-/plugin-react-refresh-1.2.2.tgz",
-      "integrity": "sha512-MEVSqncF/u1nvfeZsBJtPc3pLZWccN77CjY0itW7/Vji5BMmttW25a1kjSmooE+4JK4kaF3ElwF3LbV2kiVZWw==",
-      "dev": true,
-      "dependencies": {
-        "@babel/core": "^7.12.10",
-        "@babel/plugin-syntax-import-meta": "^7.10.4",
-        "react-refresh": "^0.9.0"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      }
-    },
-    "node_modules/acorn": {
-      "version": "7.4.1",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
-      "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A==",
-      "bin": {
-        "acorn": "bin/acorn"
-      },
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/acorn-node": {
-      "version": "1.8.2",
-      "resolved": "https://registry.npmjs.org/acorn-node/-/acorn-node-1.8.2.tgz",
-      "integrity": "sha512-8mt+fslDufLYntIoPAaIMUe/lrbrehIiwmR3t2k9LljIzoigEPF27eLk2hy8zSGzmR/ogr7zbRKINMo1u0yh5A==",
-      "dependencies": {
-        "acorn": "^7.0.0",
-        "acorn-walk": "^7.0.0",
-        "xtend": "^4.0.2"
-      }
-    },
-    "node_modules/acorn-walk": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-7.2.0.tgz",
-      "integrity": "sha512-OPdCF6GsMIP+Az+aWfAAOEt2/+iVDKE7oy6lJ098aoe59oAmK76qV6Gw60SbZ8jHuG2wH058GF4pLFbYamYrVA==",
-      "engines": {
-        "node": ">=0.4.0"
-      }
-    },
-    "node_modules/ansi-styles": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-      "dependencies": {
-        "color-convert": "^1.9.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/at-least-node": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
-      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg==",
-      "engines": {
-        "node": ">= 4.0.0"
-      }
-    },
-    "node_modules/autoprefixer": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.2.4.tgz",
-      "integrity": "sha512-DCCdUQiMD+P/as8m3XkeTUkUKuuRqLGcwD0nll7wevhqoJfMRpJlkFd1+MQh1pvupjiQuip42lc/VFvfUTMSKw==",
-      "dev": true,
-      "dependencies": {
-        "browserslist": "^4.16.1",
-        "caniuse-lite": "^1.0.30001181",
-        "colorette": "^1.2.1",
-        "fraction.js": "^4.0.13",
-        "normalize-range": "^0.1.2",
-        "postcss-value-parser": "^4.1.0"
-      },
-      "bin": {
-        "autoprefixer": "bin/autoprefixer"
-      },
-      "engines": {
-        "node": "^10 || ^12 || >=14"
-      }
-    },
-    "node_modules/balanced-match": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.0.tgz",
-      "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c="
-    },
-    "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
-      "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "node_modules/browserslist": {
-      "version": "4.16.3",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.16.3.tgz",
-      "integrity": "sha512-vIyhWmIkULaq04Gt93txdh+j02yX/JzlyhLYbV3YQCn/zvES3JnY7TifHHvvr1w5hTDluNKMkV05cs4vy8Q7sw==",
-      "dev": true,
-      "dependencies": {
-        "caniuse-lite": "^1.0.30001181",
-        "colorette": "^1.2.1",
-        "electron-to-chromium": "^1.3.649",
-        "escalade": "^3.1.1",
-        "node-releases": "^1.1.70"
-      },
-      "bin": {
-        "browserslist": "cli.js"
-      },
-      "engines": {
-        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
-      }
-    },
-    "node_modules/bytes": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
-      "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg==",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/camelcase-css": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/camelcase-css/-/camelcase-css-2.0.1.tgz",
-      "integrity": "sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA==",
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/caniuse-lite": {
-      "version": "1.0.30001185",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001185.tgz",
-      "integrity": "sha512-Fpi4kVNtNvJ15H0F6vwmXtb3tukv3Zg3qhKkOGUq7KJ1J6b9kf4dnNgtEAFXhRsJo0gNj9W60+wBvn0JcTvdTg==",
-      "dev": true
-    },
-    "node_modules/chalk": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-      "dependencies": {
-        "ansi-styles": "^3.2.1",
-        "escape-string-regexp": "^1.0.5",
-        "supports-color": "^5.3.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/codemirror": {
-      "version": "5.59.2",
-      "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-5.59.2.tgz",
-      "integrity": "sha512-/D5PcsKyzthtSy2NNKCyJi3b+htRkoKv3idswR/tR6UAvMNKA7SrmyZy6fOONJxSRs1JlUWEDAbxqfdArbK8iA=="
-    },
-    "node_modules/color": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/color/-/color-3.1.3.tgz",
-      "integrity": "sha512-xgXAcTHa2HeFCGLE9Xs/R82hujGtu9Jd9x4NW3T34+OMs7VoPsjwzRczKHvTAHeJwWFwX5j15+MgAppE8ztObQ==",
-      "dependencies": {
-        "color-convert": "^1.9.1",
-        "color-string": "^1.5.4"
-      }
-    },
-    "node_modules/color-convert": {
-      "version": "1.9.3",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-      "dependencies": {
-        "color-name": "1.1.3"
-      }
-    },
-    "node_modules/color-name": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-      "integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU="
-    },
-    "node_modules/color-string": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/color-string/-/color-string-1.5.4.tgz",
-      "integrity": "sha512-57yF5yt8Xa3czSEW1jfQDE79Idk0+AkN/4KWad6tbdxUmAs3MvjxlWSWD4deYytcRfoZ9nhKyFl1kj5tBvidbw==",
-      "dependencies": {
-        "color-name": "^1.0.0",
-        "simple-swizzle": "^0.2.2"
-      }
-    },
-    "node_modules/colorette": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/colorette/-/colorette-1.2.1.tgz",
-      "integrity": "sha512-puCDz0CzydiSYOrnXpz/PKd69zRrribezjtE9yd4zvytoRc8+RY/KJPvtPFKZS3E3wP6neGyMe0vOTlHO5L3Pw=="
-    },
-    "node_modules/commander": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-6.2.1.tgz",
-      "integrity": "sha512-U7VdrJFnJgo4xjrHpTzu0yrHPGImdsmD95ZlgYSEajAn2JKzDhDTPG9kBTefmObL2w/ngeZnilk+OV9CG3d7UA==",
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/concat-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s="
-    },
-    "node_modules/convert-source-map": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.7.0.tgz",
-      "integrity": "sha512-4FJkXzKXEDB1snCFZlLP4gpC3JILicCpGbzG9f9G7tGqGCzETQ2hWPrcinA9oU4wtf2biUaEH5065UnMeR33oA==",
-      "dev": true,
-      "dependencies": {
-        "safe-buffer": "~5.1.1"
-      }
-    },
-    "node_modules/css-unit-converter": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/css-unit-converter/-/css-unit-converter-1.1.2.tgz",
-      "integrity": "sha512-IiJwMC8rdZE0+xiEZHeru6YoONC4rfPMqGm2W85jMIbkFvv5nFTwJVFHam2eFrN6txmoUYFAFXiv8ICVeTO0MA=="
-    },
-    "node_modules/cssesc": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
-      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg==",
-      "bin": {
-        "cssesc": "bin/cssesc"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/csstype": {
-      "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.0.6.tgz",
-      "integrity": "sha512-+ZAmfyWMT7TiIlzdqJgjMb7S4f1beorDbWbsocyK4RaiqA5RTX3K14bnBWmmA9QEM0gRdsjyyrEmcyga8Zsxmw==",
-      "dev": true
-    },
-    "node_modules/debug": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.1.tgz",
-      "integrity": "sha512-doEwdvm4PCeK4K3RQN2ZC2BYUBaxwLARCqZmMjtF8a51J2Rb0xpVloFRnCODwqjpwnAoao4pelN8l3RJdv3gRQ==",
-      "dev": true,
-      "dependencies": {
-        "ms": "2.1.2"
-      },
-      "engines": {
-        "node": ">=6.0"
-      }
-    },
-    "node_modules/defined": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/defined/-/defined-1.0.0.tgz",
-      "integrity": "sha1-yY2bzvdWdBiOEQlpFRGZ45sfppM="
-    },
-    "node_modules/detective": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/detective/-/detective-5.2.0.tgz",
-      "integrity": "sha512-6SsIx+nUUbuK0EthKjv0zrdnajCCXVYGmbYYiYjFVpzcjwEs/JMDZ8tPRG29J/HhN56t3GJp2cGSWDRjjot8Pg==",
-      "dependencies": {
-        "acorn-node": "^1.6.1",
-        "defined": "^1.0.0",
-        "minimist": "^1.1.1"
-      },
-      "bin": {
-        "detective": "bin/detective.js"
-      },
-      "engines": {
-        "node": ">=0.8.0"
-      }
-    },
-    "node_modules/didyoumean": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/didyoumean/-/didyoumean-1.2.1.tgz",
-      "integrity": "sha1-6S7f2tplN9SE1zwBcv0eugxJdv8="
-    },
-    "node_modules/electron-to-chromium": {
-      "version": "1.3.657",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.657.tgz",
-      "integrity": "sha512-/9ROOyvEflEbaZFUeGofD+Tqs/WynbSTbNgNF+/TJJxH1ePD/e6VjZlDJpW3FFFd3nj5l3Hd8ki2vRwy+gyRFw==",
-      "dev": true
-    },
-    "node_modules/esbuild": {
-      "version": "0.8.42",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.8.42.tgz",
-      "integrity": "sha512-zUtj5RMqROCCCH0vV/a7cd8YQg8I0GWBhV3A3PklWRT+oM/YwVbnrtFnITzE1otGdnXplWHWdZ4OcYiV0PN+JQ==",
-      "dev": true,
-      "bin": {
-        "esbuild": "bin/esbuild"
-      }
-    },
-    "node_modules/escalade": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
-      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
-      "dev": true,
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/escape-string-regexp": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-      "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ=",
-      "engines": {
-        "node": ">=0.8.0"
-      }
-    },
-    "node_modules/events": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/events/-/events-3.2.0.tgz",
-      "integrity": "sha512-/46HWwbfCX2xTawVfkKLGxMifJYQBWMwY1mjywRtb4c9x8l5NP3KoJtnIOiL1hfdRkIuYhETxQlo62IF8tcnlg==",
-      "engines": {
-        "node": ">=0.8.x"
-      }
-    },
-    "node_modules/fraction.js": {
-      "version": "4.0.13",
-      "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.0.13.tgz",
-      "integrity": "sha512-E1fz2Xs9ltlUp+qbiyx9wmt2n9dRzPsS11Jtdb8D2o+cC7wr9xkkKsVKJuBX0ST+LVS+LhLO+SbLJNtfWcJvXA==",
-      "dev": true,
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/fs-extra": {
-      "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
-      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
-      "dependencies": {
-        "at-least-node": "^1.0.0",
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/fs.realpath": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8="
-    },
-    "node_modules/fsevents": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.1.3.tgz",
-      "integrity": "sha512-Auw9a4AxqWpa9GUfj370BMPzzyncfBABW8Mab7BGWBYDj4Isgq+cDKtx0i6u9jcX9pQDnswsaaOTgTmA5pEjuQ==",
-      "dev": true,
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
-    "node_modules/function-bind": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz",
-      "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A=="
-    },
-    "node_modules/gensync": {
-      "version": "1.0.0-beta.2",
-      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
-      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
-      "dev": true,
-      "engines": {
-        "node": ">=6.9.0"
-      }
-    },
-    "node_modules/glob": {
-      "version": "7.1.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.6.tgz",
-      "integrity": "sha512-LwaxwyZ72Lk7vZINtNNrywX0ZuLyStrdDtabefZKAY5ZGJhVtgdznluResxNmPitE0SAO+O26sWTHeKSI2wMBA==",
-      "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.0.4",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/globals": {
-      "version": "11.12.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
-      "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/graceful-fs": {
-      "version": "4.2.5",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.5.tgz",
-      "integrity": "sha512-kBBSQbz2K0Nyn+31j/w36fUfxkBW9/gfwRWdUY1ULReH3iokVJgddZAFcD1D0xlgTmFxJCbUkUclAlc6/IDJkw=="
-    },
-    "node_modules/has": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has/-/has-1.0.3.tgz",
-      "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==",
-      "dependencies": {
-        "function-bind": "^1.1.1"
-      },
-      "engines": {
-        "node": ">= 0.4.0"
-      }
-    },
-    "node_modules/has-flag": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-      "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0=",
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/history": {
-      "version": "4.10.1",
-      "resolved": "https://registry.npmjs.org/history/-/history-4.10.1.tgz",
-      "integrity": "sha512-36nwAD620w12kuzPAsyINPWJqlNbij+hpK1k9XRloDtym8mxzGYl2c17LnV6IAGB2Dmg4tEa7G7DlawS0+qjew==",
-      "dependencies": {
-        "@babel/runtime": "^7.1.2",
-        "loose-envify": "^1.2.0",
-        "resolve-pathname": "^3.0.0",
-        "tiny-invariant": "^1.0.2",
-        "tiny-warning": "^1.0.0",
-        "value-equal": "^1.0.1"
-      }
-    },
-    "node_modules/hoist-non-react-statics": {
-      "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/hoist-non-react-statics/-/hoist-non-react-statics-3.3.2.tgz",
-      "integrity": "sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==",
-      "dependencies": {
-        "react-is": "^16.7.0"
-      }
-    },
-    "node_modules/html-tags": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/html-tags/-/html-tags-3.1.0.tgz",
-      "integrity": "sha512-1qYz89hW3lFDEazhjW0yVAV87lw8lVkrJocr72XmBkMKsoSVJCQx3W8BXsC7hO2qAt8BoVjYjtAcZ9perqGnNg==",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/indexes-of": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/indexes-of/-/indexes-of-1.0.1.tgz",
-      "integrity": "sha1-8w9xbI4r00bHtn0985FVZqfAVgc="
-    },
-    "node_modules/inflight": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
-      "dependencies": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
-    },
-    "node_modules/is-arrayish": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.3.2.tgz",
-      "integrity": "sha512-eVRqCvVlZbuw3GrM63ovNSNAeA1K16kaR/LRY/92w0zxQ5/1YzwblUX652i4Xs9RwAGjW9d9y6X88t8OaAJfWQ=="
-    },
-    "node_modules/is-core-module": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.2.0.tgz",
-      "integrity": "sha512-XRAfAdyyY5F5cOXn7hYQDqh2Xmii+DEfIcQGxK/uNwMHhIkPWO0g8msXcbzLe+MpGoR951MlqM/2iIlU4vKDdQ==",
-      "dependencies": {
-        "has": "^1.0.3"
-      }
-    },
-    "node_modules/isarray": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-0.0.1.tgz",
-      "integrity": "sha1-ihis/Kmo9Bd+Cav8YDiTmwXR7t8="
-    },
-    "node_modules/js-tokens": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
-      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="
-    },
-    "node_modules/jsesc": {
-      "version": "2.5.2",
-      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
-      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
-      "dev": true,
-      "bin": {
-        "jsesc": "bin/jsesc"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/json-rpc-protocol": {
-      "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/json-rpc-protocol/-/json-rpc-protocol-0.13.1.tgz",
-      "integrity": "sha512-gdb0TnNf0ITRjLm0QGNODgK1E6ORLhe+6L+RV8owg4X3d6x8jAfyHQC+xMG4T/qU2SPaNLpav29QRLC+3oF6gg==",
-      "dependencies": {
-        "make-error": "^1.3.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/json5": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.0.tgz",
-      "integrity": "sha512-f+8cldu7X/y7RAJurMEJmdoKXGB/X550w2Nr3tTbezL6RwEE/iMcm+tZnXeoZtKuOq6ft8+CqzEkrIgx1fPoQA==",
-      "dev": true,
-      "dependencies": {
-        "minimist": "^1.2.5"
-      },
-      "bin": {
-        "json5": "lib/cli.js"
-      },
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/jsonfile": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
-      "dependencies": {
-        "graceful-fs": "^4.1.6",
-        "universalify": "^2.0.0"
-      }
-    },
-    "node_modules/lodash": {
-      "version": "4.17.20",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz",
-      "integrity": "sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA=="
-    },
-    "node_modules/lodash.toarray": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/lodash.toarray/-/lodash.toarray-4.4.0.tgz",
-      "integrity": "sha1-JMS/zWsvuji/0FlNsRedjptlZWE="
-    },
-    "node_modules/loose-envify": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz",
-      "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==",
-      "dependencies": {
-        "js-tokens": "^3.0.0 || ^4.0.0"
-      },
-      "bin": {
-        "loose-envify": "cli.js"
-      }
-    },
-    "node_modules/luxon": {
-      "version": "1.25.0",
-      "resolved": "https://registry.npmjs.org/luxon/-/luxon-1.25.0.tgz",
-      "integrity": "sha512-hEgLurSH8kQRjY6i4YLey+mcKVAWXbDNlZRmM6AgWDJ1cY3atl8Ztf5wEY7VBReFbmGnwQPz7KYJblL8B2k0jQ==",
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/make-error": {
-      "version": "1.3.6",
-      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
-      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw=="
-    },
-    "node_modules/mini-create-react-context": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/mini-create-react-context/-/mini-create-react-context-0.4.1.tgz",
-      "integrity": "sha512-YWCYEmd5CQeHGSAKrYvXgmzzkrvssZcuuQDDeqkT+PziKGMgE+0MCCtcKbROzocGBG1meBLl2FotlRwf4gAzbQ==",
-      "dependencies": {
-        "@babel/runtime": "^7.12.1",
-        "tiny-warning": "^1.0.3"
-      }
-    },
-    "node_modules/mini-svg-data-uri": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/mini-svg-data-uri/-/mini-svg-data-uri-1.2.3.tgz",
-      "integrity": "sha512-zd6KCAyXgmq6FV1mR10oKXYtvmA9vRoB6xPSTUJTbFApCtkefDnYueVR1gkof3KcdLZo1Y8mjF2DFmQMIxsHNQ=="
-    },
-    "node_modules/minimatch": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
-      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
-      "dependencies": {
-        "brace-expansion": "^1.1.7"
-      },
-      "engines": {
-        "node": "*"
-      }
-    },
-    "node_modules/minimist": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
-      "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw=="
-    },
-    "node_modules/modern-normalize": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/modern-normalize/-/modern-normalize-1.0.0.tgz",
-      "integrity": "sha512-1lM+BMLGuDfsdwf3rsgBSrxJwAZHFIrQ8YR61xIqdHo0uNKI9M52wNpHSrliZATJp51On6JD0AfRxd4YGSU0lw==",
-      "engines": {
-        "node": ">=6"
-      }
-    },
-    "node_modules/ms": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
-      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
-      "dev": true
-    },
-    "node_modules/nanoid": {
-      "version": "3.1.20",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.1.20.tgz",
-      "integrity": "sha512-a1cQNyczgKbLX9jwbS/+d7W8fX/RfgYR7lVWwWOGIPNgK2m0MWvrGF6/m4kk6U3QcFMnZf3RIhL0v2Jgh/0Uxw==",
-      "bin": {
-        "nanoid": "bin/nanoid.cjs"
-      },
-      "engines": {
-        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
-      }
-    },
-    "node_modules/node-emoji": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/node-emoji/-/node-emoji-1.10.0.tgz",
-      "integrity": "sha512-Yt3384If5H6BYGVHiHwTL+99OzJKHhgp82S8/dktEK73T26BazdgZ4JZh92xSVtGNJvz9UbXdNAc5hcrXV42vw==",
-      "dependencies": {
-        "lodash.toarray": "^4.4.0"
-      }
-    },
-    "node_modules/node-releases": {
-      "version": "1.1.70",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-1.1.70.tgz",
-      "integrity": "sha512-Slf2s69+2/uAD79pVVQo8uSiC34+g8GWY8UH2Qtqv34ZfhYrxpYpfzs9Js9d6O0mbDmALuxaTlplnBTnSELcrw==",
-      "dev": true
-    },
-    "node_modules/normalize-range": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/normalize-range/-/normalize-range-0.1.2.tgz",
-      "integrity": "sha1-LRDAa9/TEuqXd2laTShDlFa3WUI=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-assign": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha1-IQmtx5ZYh8/AXLvUQsrIv7s2CGM=",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/object-hash": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-2.1.1.tgz",
-      "integrity": "sha512-VOJmgmS+7wvXf8CjbQmimtCnEx3IAoLxI3fp2fbWehxrWBcAQFbk+vcwb6vzR0VZv/eNCJ/27j151ZTwqW/JeQ==",
-      "engines": {
-        "node": ">= 6"
-      }
-    },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
-    "node_modules/path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18=",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/path-parse": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz",
-      "integrity": "sha512-GSmOT2EbHrINBf9SR7CDELwlJ8AENk3Qn7OikK4nFYAu3Ote2+JYNVvkpAEQm3/TLNEJFD/xZJjzyxg3KBWOzw=="
-    },
-    "node_modules/path-to-regexp": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.8.0.tgz",
-      "integrity": "sha512-n43JRhlUKUAlibEJhPeir1ncUID16QnEjNpwzNdO3Lm4ywrBpBZ5oLD0I6br9evr1Y9JTqwRtAh7JLoOzAQdVA==",
-      "dependencies": {
-        "isarray": "0.0.1"
-      }
-    },
-    "node_modules/postcss": {
-      "version": "8.2.5",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.2.5.tgz",
-      "integrity": "sha512-wMcb7BpDcm3gxQOQx46NDNT36Kk0Ao6PJLLI2ed5vehbbbxCEuslSQzbQ2sfSKy+gkYxhWcGWSeaK+gwm4KIZg==",
-      "dependencies": {
-        "colorette": "^1.2.1",
-        "nanoid": "^3.1.20",
-        "source-map": "^0.6.1"
-      },
-      "engines": {
-        "node": "^10 || ^12 || >=14"
-      }
-    },
-    "node_modules/postcss-functions": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/postcss-functions/-/postcss-functions-3.0.0.tgz",
-      "integrity": "sha1-DpTQFERwCkgd4g3k1V+yZAVkJQ4=",
-      "dependencies": {
-        "glob": "^7.1.2",
-        "object-assign": "^4.1.1",
-        "postcss": "^6.0.9",
-        "postcss-value-parser": "^3.3.0"
-      }
-    },
-    "node_modules/postcss-functions/node_modules/postcss": {
-      "version": "6.0.23",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz",
-      "integrity": "sha512-soOk1h6J3VMTZtVeVpv15/Hpdl2cBLX3CAw4TAbkpTJiNPk9YP/zWcD1ND+xEtvyuuvKzbxliTOIyvkSeSJ6ag==",
-      "dependencies": {
-        "chalk": "^2.4.1",
-        "source-map": "^0.6.1",
-        "supports-color": "^5.4.0"
-      },
-      "engines": {
-        "node": ">=4.0.0"
-      }
-    },
-    "node_modules/postcss-functions/node_modules/postcss-value-parser": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-3.3.1.tgz",
-      "integrity": "sha512-pISE66AbVkp4fDQ7VHBwRNXzAAKJjw4Vw7nWI/+Q3vuly7SNfgYXvm6i5IgFylHGK5sP/xHAbB7N49OS4gWNyQ=="
-    },
-    "node_modules/postcss-functions/node_modules/source-map": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/postcss-js": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/postcss-js/-/postcss-js-3.0.3.tgz",
-      "integrity": "sha512-gWnoWQXKFw65Hk/mi2+WTQTHdPD5UJdDXZmX073EY/B3BWnYjO4F4t0VneTCnCGQ5E5GsCdMkzPaTXwl3r5dJw==",
-      "dependencies": {
-        "camelcase-css": "^2.0.1",
-        "postcss": "^8.1.6"
-      },
-      "engines": {
-        "node": ">=10.0"
-      }
-    },
-    "node_modules/postcss-nested": {
-      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/postcss-nested/-/postcss-nested-5.0.3.tgz",
-      "integrity": "sha512-R2LHPw+u5hFfDgJG748KpGbJyTv7Yr33/2tIMWxquYuHTd9EXu27PYnKi7BxMXLtzKC0a0WVsqHtd7qIluQu/g==",
-      "dependencies": {
-        "postcss-selector-parser": "^6.0.4"
-      },
-      "engines": {
-        "node": ">=10.0"
-      }
-    },
-    "node_modules/postcss-selector-parser": {
-      "version": "6.0.4",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.4.tgz",
-      "integrity": "sha512-gjMeXBempyInaBqpp8gODmwZ52WaYsVOsfr4L4lDQ7n3ncD6mEyySiDtgzCT+NYC0mmeOLvtsF8iaEf0YT6dBw==",
-      "dependencies": {
-        "cssesc": "^3.0.0",
-        "indexes-of": "^1.0.1",
-        "uniq": "^1.0.1",
-        "util-deprecate": "^1.0.2"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/postcss-value-parser": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.1.0.tgz",
-      "integrity": "sha512-97DXOFbQJhk71ne5/Mt6cOu6yxsSfM0QGQyl0L25Gca4yGWEGJaig7l7gbCX623VqTBNGLRLaVUCnNkcedlRSQ=="
-    },
-    "node_modules/postcss/node_modules/source-map": {
-      "version": "0.6.1",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/pretty-hrtime": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/pretty-hrtime/-/pretty-hrtime-1.0.3.tgz",
-      "integrity": "sha1-t+PqQkNaTJsnWdmeDyAesZWALuE=",
-      "engines": {
-        "node": ">= 0.8"
-      }
-    },
-    "node_modules/prop-types": {
-      "version": "15.7.2",
-      "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.7.2.tgz",
-      "integrity": "sha512-8QQikdH7//R2vurIJSutZ1smHYTcLpRWEOlHnzcWHmBYrOGUysKwSsrC89BCiFj3CbrfJ/nXFdJepOVrY1GCHQ==",
-      "dependencies": {
-        "loose-envify": "^1.4.0",
-        "object-assign": "^4.1.1",
-        "react-is": "^16.8.1"
-      }
-    },
-    "node_modules/purgecss": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/purgecss/-/purgecss-3.1.3.tgz",
-      "integrity": "sha512-hRSLN9mguJ2lzlIQtW4qmPS2kh6oMnA9RxdIYK8sz18QYqd6ePp4GNDl18oWHA1f2v2NEQIh51CO8s/E3YGckQ==",
-      "dependencies": {
-        "commander": "^6.0.0",
-        "glob": "^7.0.0",
-        "postcss": "^8.2.1",
-        "postcss-selector-parser": "^6.0.2"
-      },
-      "bin": {
-        "purgecss": "bin/purgecss.js"
-      }
-    },
-    "node_modules/react": {
-      "version": "17.0.1",
-      "resolved": "https://registry.npmjs.org/react/-/react-17.0.1.tgz",
-      "integrity": "sha512-lG9c9UuMHdcAexXtigOZLX8exLWkW0Ku29qPRU8uhF2R9BN96dLCt0psvzPLlHc5OWkgymP3qwTRgbnw5BKx3w==",
-      "dependencies": {
-        "loose-envify": "^1.1.0",
-        "object-assign": "^4.1.1"
-      },
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/react-dom": {
-      "version": "17.0.1",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-17.0.1.tgz",
-      "integrity": "sha512-6eV150oJZ9U2t9svnsspTMrWNyHc6chX0KzDeAOXftRa8bNeOKTTfCJ7KorIwenkHd2xqVTBTCZd79yk/lx/Ug==",
-      "dependencies": {
-        "loose-envify": "^1.1.0",
-        "object-assign": "^4.1.1",
-        "scheduler": "^0.20.1"
-      }
-    },
-    "node_modules/react-is": {
-      "version": "16.13.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
-      "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="
-    },
-    "node_modules/react-refresh": {
-      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/react-refresh/-/react-refresh-0.9.0.tgz",
-      "integrity": "sha512-Gvzk7OZpiqKSkxsQvO/mbTN1poglhmAV7gR/DdIrRrSMXraRQQlfikRJOr3Nb9GTMPC5kof948Zy6jJZIFtDvQ==",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/react-router": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-5.2.0.tgz",
-      "integrity": "sha512-smz1DUuFHRKdcJC0jobGo8cVbhO3x50tCL4icacOlcwDOEQPq4TMqwx3sY1TP+DvtTgz4nm3thuo7A+BK2U0Dw==",
-      "dependencies": {
-        "@babel/runtime": "^7.1.2",
-        "history": "^4.9.0",
-        "hoist-non-react-statics": "^3.1.0",
-        "loose-envify": "^1.3.1",
-        "mini-create-react-context": "^0.4.0",
-        "path-to-regexp": "^1.7.0",
-        "prop-types": "^15.6.2",
-        "react-is": "^16.6.0",
-        "tiny-invariant": "^1.0.2",
-        "tiny-warning": "^1.0.0"
-      }
-    },
-    "node_modules/react-router-dom": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-5.2.0.tgz",
-      "integrity": "sha512-gxAmfylo2QUjcwxI63RhQ5G85Qqt4voZpUXSEqCwykV0baaOTQDR1f0PmY8AELqIyVc0NEZUj0Gov5lNGcXgsA==",
-      "dependencies": {
-        "@babel/runtime": "^7.1.2",
-        "history": "^4.9.0",
-        "loose-envify": "^1.3.1",
-        "prop-types": "^15.6.2",
-        "react-router": "5.2.0",
-        "tiny-invariant": "^1.0.2",
-        "tiny-warning": "^1.0.0"
-      }
-    },
-    "node_modules/reduce-css-calc": {
-      "version": "2.1.8",
-      "resolved": "https://registry.npmjs.org/reduce-css-calc/-/reduce-css-calc-2.1.8.tgz",
-      "integrity": "sha512-8liAVezDmUcH+tdzoEGrhfbGcP7nOV4NkGE3a74+qqvE7nt9i4sKLGBuZNOnpI4WiGksiNPklZxva80061QiPg==",
-      "dependencies": {
-        "css-unit-converter": "^1.1.1",
-        "postcss-value-parser": "^3.3.0"
-      }
-    },
-    "node_modules/reduce-css-calc/node_modules/postcss-value-parser": {
-      "version": "3.3.1",
-      "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-3.3.1.tgz",
-      "integrity": "sha512-pISE66AbVkp4fDQ7VHBwRNXzAAKJjw4Vw7nWI/+Q3vuly7SNfgYXvm6i5IgFylHGK5sP/xHAbB7N49OS4gWNyQ=="
-    },
-    "node_modules/regenerator-runtime": {
-      "version": "0.13.7",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.7.tgz",
-      "integrity": "sha512-a54FxoJDIr27pgf7IgeQGxmqUNYrcV338lf/6gH456HZ/PhX+5BcwHXG9ajESmwe6WRO0tAzRUrRmNONWgkrew=="
-    },
-    "node_modules/resolve": {
-      "version": "1.19.0",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.19.0.tgz",
-      "integrity": "sha512-rArEXAgsBG4UgRGcynxWIWKFvh/XZCcS8UJdHhwy91zwAvCZIbcs+vAbflgBnNjYMs/i/i+/Ux6IZhML1yPvxg==",
-      "dependencies": {
-        "is-core-module": "^2.1.0",
-        "path-parse": "^1.0.6"
-      }
-    },
-    "node_modules/resolve-pathname": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-pathname/-/resolve-pathname-3.0.0.tgz",
-      "integrity": "sha512-C7rARubxI8bXFNB/hqcp/4iUeIXJhJZvFPFPiSPRnhU5UPxzMFIl+2E6yY6c4k9giDJAhtV+enfA+G89N6Csng=="
-    },
-    "node_modules/rollup": {
-      "version": "2.38.5",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.38.5.tgz",
-      "integrity": "sha512-VoWt8DysFGDVRGWuHTqZzT02J0ASgjVq/hPs9QcBOGMd7B+jfTr/iqMVEyOi901rE3xq+Deq66GzIT1yt7sGwQ==",
-      "dev": true,
-      "bin": {
-        "rollup": "dist/bin/rollup"
-      },
-      "engines": {
-        "node": ">=10.0.0"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.3.1"
-      }
-    },
-    "node_modules/rollup/node_modules/fsevents": {
-      "version": "2.3.2",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
-      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-      "dev": true,
-      "optional": true,
-      "os": [
-        "darwin"
-      ],
-      "engines": {
-        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
-      }
-    },
-    "node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "dev": true
-    },
-    "node_modules/scheduler": {
-      "version": "0.20.1",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.20.1.tgz",
-      "integrity": "sha512-LKTe+2xNJBNxu/QhHvDR14wUXHRQbVY5ZOYpOGWRzhydZUqrLb2JBvLPY7cAqFmqrWuDED0Mjk7013SZiOz6Bw==",
-      "dependencies": {
-        "loose-envify": "^1.1.0",
-        "object-assign": "^4.1.1"
-      }
-    },
-    "node_modules/semver": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-      "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
-      "dev": true,
-      "bin": {
-        "semver": "bin/semver"
-      }
-    },
-    "node_modules/simple-swizzle": {
-      "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/simple-swizzle/-/simple-swizzle-0.2.2.tgz",
-      "integrity": "sha1-pNprY1/8zMoz9w0Xy5JZLeleVXo=",
-      "dependencies": {
-        "is-arrayish": "^0.3.1"
-      }
-    },
-    "node_modules/source-map": {
-      "version": "0.5.7",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
-      "integrity": "sha1-igOdLRAh0i0eoUyA2OpGi6LvP8w=",
-      "dev": true,
-      "engines": {
-        "node": ">=0.10.0"
-      }
-    },
-    "node_modules/supports-color": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-      "dependencies": {
-        "has-flag": "^3.0.0"
-      },
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/tailwindcss": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-2.0.2.tgz",
-      "integrity": "sha512-nO9JRE1pO7SF9RnYAl6g7uzeHdrmKAFqNjT9NtZUfxqimJZAOOLOEyIEUiMq12+xIc7mC2Ey3Vf90XjHpWKfbw==",
-      "dependencies": {
-        "@fullhuman/postcss-purgecss": "^3.0.0",
-        "bytes": "^3.0.0",
-        "chalk": "^4.1.0",
-        "color": "^3.1.3",
-        "detective": "^5.2.0",
-        "didyoumean": "^1.2.1",
-        "fs-extra": "^9.0.1",
-        "html-tags": "^3.1.0",
-        "lodash": "^4.17.20",
-        "modern-normalize": "^1.0.0",
-        "node-emoji": "^1.8.1",
-        "object-hash": "^2.0.3",
-        "postcss-functions": "^3",
-        "postcss-js": "^3.0.3",
-        "postcss-nested": "^5.0.1",
-        "postcss-selector-parser": "^6.0.4",
-        "postcss-value-parser": "^4.1.0",
-        "pretty-hrtime": "^1.0.3",
-        "reduce-css-calc": "^2.1.6",
-        "resolve": "^1.19.0"
-      },
-      "bin": {
-        "tailwind": "lib/cli.js",
-        "tailwindcss": "lib/cli.js"
-      },
-      "engines": {
-        "node": ">=12.13.0"
-      }
-    },
-    "node_modules/tailwindcss/node_modules/ansi-styles": {
-      "version": "4.3.0",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-      "dependencies": {
-        "color-convert": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/tailwindcss/node_modules/chalk": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.0.tgz",
-      "integrity": "sha512-qwx12AxXe2Q5xQ43Ac//I6v5aXTipYrSESdOgzrN+9XjgEpyjpKuvSGaN4qE93f7TQTlerQQ8S+EQ0EyDoVL1A==",
-      "dependencies": {
-        "ansi-styles": "^4.1.0",
-        "supports-color": "^7.1.0"
-      },
-      "engines": {
-        "node": ">=10"
-      }
-    },
-    "node_modules/tailwindcss/node_modules/color-convert": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-      "dependencies": {
-        "color-name": "~1.1.4"
-      },
-      "engines": {
-        "node": ">=7.0.0"
-      }
-    },
-    "node_modules/tailwindcss/node_modules/color-name": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
-    },
-    "node_modules/tailwindcss/node_modules/has-flag": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/tailwindcss/node_modules/supports-color": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-      "dependencies": {
-        "has-flag": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/tiny-invariant": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.1.0.tgz",
-      "integrity": "sha512-ytxQvrb1cPc9WBEI/HSeYYoGD0kWnGEOR8RY6KomWLBVhqz0RgTwVO9dLrGz7dC+nN9llyI7OKAgRq8Vq4ZBSw=="
-    },
-    "node_modules/tiny-warning": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/tiny-warning/-/tiny-warning-1.0.3.tgz",
-      "integrity": "sha512-lBN9zLN/oAf68o3zNXYrdCt1kP8WsiGW8Oo2ka41b2IM5JL/S1CTyX1rW0mb/zSuJun0ZUrDxx4sqvYS2FWzPA=="
-    },
-    "node_modules/to-fast-properties": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
-      "integrity": "sha1-3F5pjL0HkmW8c+A3doGk5Og/YW4=",
-      "dev": true,
-      "engines": {
-        "node": ">=4"
-      }
-    },
-    "node_modules/typescript": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.1.3.tgz",
-      "integrity": "sha512-B3ZIOf1IKeH2ixgHhj6la6xdwR9QrLC5d1VKeCSY4tvkqhF2eqd9O7txNlS0PO3GrBAFIdr3L1ndNwteUbZLYg==",
-      "dev": true,
-      "bin": {
-        "tsc": "bin/tsc",
-        "tsserver": "bin/tsserver"
-      },
-      "engines": {
-        "node": ">=4.2.0"
-      }
-    },
-    "node_modules/uniq": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/uniq/-/uniq-1.0.1.tgz",
-      "integrity": "sha1-sxxa6CVIRKOoKBVBzisEuGWnNP8="
-    },
-    "node_modules/universalify": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.0.tgz",
-      "integrity": "sha512-hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ==",
-      "engines": {
-        "node": ">= 10.0.0"
-      }
-    },
-    "node_modules/util-deprecate": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha1-RQ1Nyfpw3nMnYvvS1KKJgUGaDM8="
-    },
-    "node_modules/value-equal": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/value-equal/-/value-equal-1.0.1.tgz",
-      "integrity": "sha512-NOJ6JZCAWr0zlxZt+xqCHNTEKOsrks2HQd4MqhP1qy4z1SkbEP467eNx6TgDKXMvUOb+OENfJCZwM+16n7fRfw=="
-    },
-    "node_modules/vite": {
-      "version": "2.0.0-beta.65",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-2.0.0-beta.65.tgz",
-      "integrity": "sha512-mdHNTP6fGeb8m8lWAM3UbSPw1+un1lUv0i4MQJcNiK2/P01RHIY02VjQeXBv3NemkExkgLji88LN9ySFMUQpIw==",
-      "dev": true,
-      "dependencies": {
-        "esbuild": "^0.8.34",
-        "postcss": "^8.2.1",
-        "resolve": "^1.19.0",
-        "rollup": "^2.35.1"
-      },
-      "bin": {
-        "vite": "bin/vite.js"
-      },
-      "engines": {
-        "node": ">=12.0.0"
-      },
-      "optionalDependencies": {
-        "fsevents": "~2.1.2"
-      }
-    },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8="
-    },
-    "node_modules/xtend": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
-      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
-      "engines": {
-        "node": ">=0.4"
-      }
-    }
-  },
-  "dependencies": {
-    "@babel/code-frame": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.12.13.tgz",
-      "integrity": "sha512-HV1Cm0Q3ZrpCR93tkWOYiuYIgLxZXZFVG2VgK+MBWjUqZTundupbfx2aXarXuw5Ko5aMcjtJgbSs4vUGBS5v6g==",
-      "dev": true,
-      "requires": {
-        "@babel/highlight": "^7.12.13"
-      }
-    },
-    "@babel/core": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.12.13.tgz",
-      "integrity": "sha512-BQKE9kXkPlXHPeqissfxo0lySWJcYdEP0hdtJOH/iJfDdhOCcgtNCjftCJg3qqauB4h+lz2N6ixM++b9DN1Tcw==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.12.13",
-        "@babel/generator": "^7.12.13",
-        "@babel/helper-module-transforms": "^7.12.13",
-        "@babel/helpers": "^7.12.13",
-        "@babel/parser": "^7.12.13",
-        "@babel/template": "^7.12.13",
-        "@babel/traverse": "^7.12.13",
-        "@babel/types": "^7.12.13",
-        "convert-source-map": "^1.7.0",
-        "debug": "^4.1.0",
-        "gensync": "^1.0.0-beta.1",
-        "json5": "^2.1.2",
-        "lodash": "^4.17.19",
-        "semver": "^5.4.1",
-        "source-map": "^0.5.0"
-      }
-    },
-    "@babel/generator": {
-      "version": "7.12.15",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.12.15.tgz",
-      "integrity": "sha512-6F2xHxBiFXWNSGb7vyCUTBF8RCLY66rS0zEPcP8t/nQyXjha5EuK4z7H5o7fWG8B4M7y6mqVWq1J+1PuwRhecQ==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.12.13",
-        "jsesc": "^2.5.1",
-        "source-map": "^0.5.0"
-      }
-    },
-    "@babel/helper-function-name": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.12.13.tgz",
-      "integrity": "sha512-TZvmPn0UOqmvi5G4vvw0qZTpVptGkB1GL61R6lKvrSdIxGm5Pky7Q3fpKiIkQCAtRCBUwB0PaThlx9vebCDSwA==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-get-function-arity": "^7.12.13",
-        "@babel/template": "^7.12.13",
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "@babel/helper-get-function-arity": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-get-function-arity/-/helper-get-function-arity-7.12.13.tgz",
-      "integrity": "sha512-DjEVzQNz5LICkzN0REdpD5prGoidvbdYk1BVgRUOINaWJP2t6avB27X1guXK1kXNrX0WMfsrm1A/ZBthYuIMQg==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "@babel/helper-member-expression-to-functions": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-member-expression-to-functions/-/helper-member-expression-to-functions-7.12.13.tgz",
-      "integrity": "sha512-B+7nN0gIL8FZ8SvMcF+EPyB21KnCcZHQZFczCxbiNGV/O0rsrSBlWGLzmtBJ3GMjSVMIm4lpFhR+VdVBuIsUcQ==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "@babel/helper-module-imports": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.12.13.tgz",
-      "integrity": "sha512-NGmfvRp9Rqxy0uHSSVP+SRIW1q31a7Ji10cLBcqSDUngGentY4FRiHOFZFE1CLU5eiL0oE8reH7Tg1y99TDM/g==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "@babel/helper-module-transforms": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.12.13.tgz",
-      "integrity": "sha512-acKF7EjqOR67ASIlDTupwkKM1eUisNAjaSduo5Cz+793ikfnpe7p4Q7B7EWU2PCoSTPWsQkR7hRUWEIZPiVLGA==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-module-imports": "^7.12.13",
-        "@babel/helper-replace-supers": "^7.12.13",
-        "@babel/helper-simple-access": "^7.12.13",
-        "@babel/helper-split-export-declaration": "^7.12.13",
-        "@babel/helper-validator-identifier": "^7.12.11",
-        "@babel/template": "^7.12.13",
-        "@babel/traverse": "^7.12.13",
-        "@babel/types": "^7.12.13",
-        "lodash": "^4.17.19"
-      }
-    },
-    "@babel/helper-optimise-call-expression": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-optimise-call-expression/-/helper-optimise-call-expression-7.12.13.tgz",
-      "integrity": "sha512-BdWQhoVJkp6nVjB7nkFWcn43dkprYauqtk++Py2eaf/GRDFm5BxRqEIZCiHlZUGAVmtwKcsVL1dC68WmzeFmiA==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "@babel/helper-plugin-utils": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.12.13.tgz",
-      "integrity": "sha512-C+10MXCXJLiR6IeG9+Wiejt9jmtFpxUc3MQqCmPY8hfCjyUGl9kT+B2okzEZrtykiwrc4dbCPdDoz0A/HQbDaA==",
-      "dev": true
-    },
-    "@babel/helper-replace-supers": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-replace-supers/-/helper-replace-supers-7.12.13.tgz",
-      "integrity": "sha512-pctAOIAMVStI2TMLhozPKbf5yTEXc0OJa0eENheb4w09SrgOWEs+P4nTOZYJQCqs8JlErGLDPDJTiGIp3ygbLg==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-member-expression-to-functions": "^7.12.13",
-        "@babel/helper-optimise-call-expression": "^7.12.13",
-        "@babel/traverse": "^7.12.13",
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "@babel/helper-simple-access": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.12.13.tgz",
-      "integrity": "sha512-0ski5dyYIHEfwpWGx5GPWhH35j342JaflmCeQmsPWcrOQDtCN6C1zKAVRFVbK53lPW2c9TsuLLSUDf0tIGJ5hA==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "@babel/helper-split-export-declaration": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.12.13.tgz",
-      "integrity": "sha512-tCJDltF83htUtXx5NLcaDqRmknv652ZWCHyoTETf1CXYJdPC7nohZohjUgieXhv0hTJdRf2FjDueFehdNucpzg==",
-      "dev": true,
-      "requires": {
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "@babel/helper-validator-identifier": {
-      "version": "7.12.11",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.12.11.tgz",
-      "integrity": "sha512-np/lG3uARFybkoHokJUmf1QfEvRVCPbmQeUQpKow5cQ3xWrV9i3rUHodKDJPQfTVX61qKi+UdYk8kik84n7XOw==",
-      "dev": true
-    },
-    "@babel/helpers": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.12.13.tgz",
-      "integrity": "sha512-oohVzLRZ3GQEk4Cjhfs9YkJA4TdIDTObdBEZGrd6F/T0GPSnuV6l22eMcxlvcvzVIPH3VTtxbseudM1zIE+rPQ==",
-      "dev": true,
-      "requires": {
-        "@babel/template": "^7.12.13",
-        "@babel/traverse": "^7.12.13",
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "@babel/highlight": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.12.13.tgz",
-      "integrity": "sha512-kocDQvIbgMKlWxXe9fof3TQ+gkIPOUSEYhJjqUjvKMez3krV7vbzYCDq39Oj11UAVK7JqPVGQPlgE85dPNlQww==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-validator-identifier": "^7.12.11",
-        "chalk": "^2.0.0",
-        "js-tokens": "^4.0.0"
-      }
-    },
-    "@babel/parser": {
-      "version": "7.12.15",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.12.15.tgz",
-      "integrity": "sha512-AQBOU2Z9kWwSZMd6lNjCX0GUgFonL1wAM1db8L8PMk9UDaGsRCArBkU4Sc+UCM3AE4hjbXx+h58Lb3QT4oRmrA==",
-      "dev": true
-    },
-    "@babel/plugin-syntax-import-meta": {
-      "version": "7.10.4",
-      "resolved": "https://registry.npmjs.org/@babel/plugin-syntax-import-meta/-/plugin-syntax-import-meta-7.10.4.tgz",
-      "integrity": "sha512-Yqfm+XDx0+Prh3VSeEQCPU81yC+JWZ2pDPFSS4ZdpfZhp4MkFMaDC1UqseovEKwSUpnIL7+vK+Clp7bfh0iD7g==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-plugin-utils": "^7.10.4"
-      }
-    },
-    "@babel/runtime": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.12.13.tgz",
-      "integrity": "sha512-8+3UMPBrjFa/6TtKi/7sehPKqfAm4g6K+YQjyyFOLUTxzOngcRZTlAVY8sc2CORJYqdHQY8gRPHmn+qo15rCBw==",
-      "requires": {
-        "regenerator-runtime": "^0.13.4"
-      }
-    },
-    "@babel/template": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.12.13.tgz",
-      "integrity": "sha512-/7xxiGA57xMo/P2GVvdEumr8ONhFOhfgq2ihK3h1e6THqzTAkHbkXgB0xI9yeTfIUoH3+oAeHhqm/I43OTbbjA==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.12.13",
-        "@babel/parser": "^7.12.13",
-        "@babel/types": "^7.12.13"
-      }
-    },
-    "@babel/traverse": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.12.13.tgz",
-      "integrity": "sha512-3Zb4w7eE/OslI0fTp8c7b286/cQps3+vdLW3UcwC8VSJC6GbKn55aeVVu2QJNuCDoeKyptLOFrPq8WqZZBodyA==",
-      "dev": true,
-      "requires": {
-        "@babel/code-frame": "^7.12.13",
-        "@babel/generator": "^7.12.13",
-        "@babel/helper-function-name": "^7.12.13",
-        "@babel/helper-split-export-declaration": "^7.12.13",
-        "@babel/parser": "^7.12.13",
-        "@babel/types": "^7.12.13",
-        "debug": "^4.1.0",
-        "globals": "^11.1.0",
-        "lodash": "^4.17.19"
-      }
-    },
-    "@babel/types": {
-      "version": "7.12.13",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.12.13.tgz",
-      "integrity": "sha512-oKrdZTld2im1z8bDwTOQvUbxKwE+854zc16qWZQlcTqMN00pWxHQ4ZeOq0yDMnisOpRykH2/5Qqcrk/OlbAjiQ==",
-      "dev": true,
-      "requires": {
-        "@babel/helper-validator-identifier": "^7.12.11",
-        "lodash": "^4.17.19",
-        "to-fast-properties": "^2.0.0"
-      }
-    },
-    "@fullhuman/postcss-purgecss": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/@fullhuman/postcss-purgecss/-/postcss-purgecss-3.1.3.tgz",
-      "integrity": "sha512-kwOXw8fZ0Lt1QmeOOrd+o4Ibvp4UTEBFQbzvWldjlKv5n+G9sXfIPn1hh63IQIL8K8vbvv1oYMJiIUbuy9bGaA==",
-      "requires": {
-        "purgecss": "^3.1.3"
-      }
-    },
-    "@headlessui/react": {
-      "version": "0.2.0",
-      "resolved": "https://registry.npmjs.org/@headlessui/react/-/react-0.2.0.tgz",
-      "integrity": "sha512-YV+vF+QhTRcspydPdHF3ZXe+FkOiJpRdqMjjFIIX9bSdT2O2T7GurgKQdGgamNUM+B99MZBOTRqxS8Dlh485eg=="
-    },
-    "@tailwindcss/forms": {
-      "version": "0.2.1",
-      "resolved": "https://registry.npmjs.org/@tailwindcss/forms/-/forms-0.2.1.tgz",
-      "integrity": "sha512-czfvEdY+J2Ogfd6RUSr/ZSUmDxTujr34M++YLnp2cCPC3oJ4kFvFMaRXA6cEXKw7F1hJuapdjXRjsXIEXGgORg==",
-      "requires": {
-        "mini-svg-data-uri": "^1.2.3"
-      }
-    },
-    "@types/codemirror": {
-      "version": "0.0.108",
-      "resolved": "https://registry.npmjs.org/@types/codemirror/-/codemirror-0.0.108.tgz",
-      "integrity": "sha512-3FGFcus0P7C2UOGCNUVENqObEb4SFk+S8Dnxq7K6aIsLVs/vDtlangl3PEO0ykaKXyK56swVF6Nho7VsA44uhw==",
-      "dev": true,
-      "requires": {
-        "@types/tern": "*"
-      }
-    },
-    "@types/estree": {
-      "version": "0.0.46",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-0.0.46.tgz",
-      "integrity": "sha512-laIjwTQaD+5DukBZaygQ79K1Z0jb1bPEMRrkXSLjtCcZm+abyp5YbrqpSLzD42FwWW6gK/aS4NYpJ804nG2brg==",
-      "dev": true
-    },
-    "@types/events": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/@types/events/-/events-3.0.0.tgz",
-      "integrity": "sha512-EaObqwIvayI5a8dCzhFrjKzVwKLxjoG9T6Ppd5CEo07LRKfQ8Yokw54r5+Wq7FaBQ+yXRvQAYPrHwya1/UFt9g==",
-      "dev": true
-    },
-    "@types/history": {
-      "version": "4.7.8",
-      "resolved": "https://registry.npmjs.org/@types/history/-/history-4.7.8.tgz",
-      "integrity": "sha512-S78QIYirQcUoo6UJZx9CSP0O2ix9IaeAXwQi26Rhr/+mg7qqPy8TzaxHSUut7eGjL8WmLccT7/MXf304WjqHcA==",
-      "dev": true
-    },
-    "@types/luxon": {
-      "version": "1.25.1",
-      "resolved": "https://registry.npmjs.org/@types/luxon/-/luxon-1.25.1.tgz",
-      "integrity": "sha512-enkMO4WJcbdkhK1eZrItF616buau02wtrSN+DDt9Qj9U23boSAXNJm0fMlgwpTDaRHq3S0D/SPIRbxy4YxBjiA==",
-      "dev": true
-    },
-    "@types/node": {
-      "version": "14.14.25",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-14.14.25.tgz",
-      "integrity": "sha512-EPpXLOVqDvisVxtlbvzfyqSsFeQxltFbluZNRndIb8tr9KiBnYNLzrc1N3pyKUCww2RNrfHDViqDWWE1LCJQtQ==",
-      "dev": true
-    },
-    "@types/prop-types": {
-      "version": "15.7.3",
-      "resolved": "https://registry.npmjs.org/@types/prop-types/-/prop-types-15.7.3.tgz",
-      "integrity": "sha512-KfRL3PuHmqQLOG+2tGpRO26Ctg+Cq1E01D2DMriKEATHgWLfeNDmq9e29Q9WIky0dQ3NPkd1mzYH8Lm936Z9qw==",
-      "dev": true
-    },
-    "@types/react": {
-      "version": "17.0.1",
-      "resolved": "https://registry.npmjs.org/@types/react/-/react-17.0.1.tgz",
-      "integrity": "sha512-w8t9f53B2ei4jeOqf/gxtc2Sswnc3LBK5s0DyJcg5xd10tMHXts2N31cKjWfH9IC/JvEPa/YF1U4YeP1t4R6HQ==",
-      "dev": true,
-      "requires": {
-        "@types/prop-types": "*",
-        "csstype": "^3.0.2"
-      }
-    },
-    "@types/react-dom": {
-      "version": "17.0.0",
-      "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-17.0.0.tgz",
-      "integrity": "sha512-lUqY7OlkF/RbNtD5nIq7ot8NquXrdFrjSOR6+w9a9RFQevGi1oZO1dcJbXMeONAPKtZ2UrZOEJ5UOCVsxbLk/g==",
-      "dev": true,
-      "requires": {
-        "@types/react": "*"
-      }
-    },
-    "@types/react-router": {
-      "version": "5.1.11",
-      "resolved": "https://registry.npmjs.org/@types/react-router/-/react-router-5.1.11.tgz",
-      "integrity": "sha512-ofHbZMlp0Y2baOHgsWBQ4K3AttxY61bDMkwTiBOkPg7U6C/3UwwB5WaIx28JmSVi/eX3uFEMRo61BV22fDQIvg==",
-      "dev": true,
-      "requires": {
-        "@types/history": "*",
-        "@types/react": "*"
-      }
-    },
-    "@types/react-router-dom": {
-      "version": "5.1.7",
-      "resolved": "https://registry.npmjs.org/@types/react-router-dom/-/react-router-dom-5.1.7.tgz",
-      "integrity": "sha512-D5mHD6TbdV/DNHYsnwBTv+y73ei+mMjrkGrla86HthE4/PVvL1J94Bu3qABU+COXzpL23T1EZapVVpwHuBXiUg==",
-      "dev": true,
-      "requires": {
-        "@types/history": "*",
-        "@types/react": "*",
-        "@types/react-router": "*"
-      }
-    },
-    "@types/tern": {
-      "version": "0.23.3",
-      "resolved": "https://registry.npmjs.org/@types/tern/-/tern-0.23.3.tgz",
-      "integrity": "sha512-imDtS4TAoTcXk0g7u4kkWqedB3E4qpjXzCpD2LU5M5NAXHzCDsypyvXSaG7mM8DKYkCRa7tFp4tS/lp/Wo7Q3w==",
-      "dev": true,
-      "requires": {
-        "@types/estree": "*"
-      }
-    },
-    "@vitejs/plugin-react-refresh": {
-      "version": "1.2.2",
-      "resolved": "https://registry.npmjs.org/@vitejs/plugin-react-refresh/-/plugin-react-refresh-1.2.2.tgz",
-      "integrity": "sha512-MEVSqncF/u1nvfeZsBJtPc3pLZWccN77CjY0itW7/Vji5BMmttW25a1kjSmooE+4JK4kaF3ElwF3LbV2kiVZWw==",
-      "dev": true,
-      "requires": {
-        "@babel/core": "^7.12.10",
-        "@babel/plugin-syntax-import-meta": "^7.10.4",
-        "react-refresh": "^0.9.0"
-      }
-    },
-    "acorn": {
-      "version": "7.4.1",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-7.4.1.tgz",
-      "integrity": "sha512-nQyp0o1/mNdbTO1PO6kHkwSrmgZ0MT/jCCpNiwbUjGoRN4dlBhqJtoQuCnEOKzgTVwg0ZWiCoQy6SxMebQVh8A=="
-    },
-    "acorn-node": {
-      "version": "1.8.2",
-      "resolved": "https://registry.npmjs.org/acorn-node/-/acorn-node-1.8.2.tgz",
-      "integrity": "sha512-8mt+fslDufLYntIoPAaIMUe/lrbrehIiwmR3t2k9LljIzoigEPF27eLk2hy8zSGzmR/ogr7zbRKINMo1u0yh5A==",
-      "requires": {
-        "acorn": "^7.0.0",
-        "acorn-walk": "^7.0.0",
-        "xtend": "^4.0.2"
-      }
-    },
-    "acorn-walk": {
-      "version": "7.2.0",
-      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-7.2.0.tgz",
-      "integrity": "sha512-OPdCF6GsMIP+Az+aWfAAOEt2/+iVDKE7oy6lJ098aoe59oAmK76qV6Gw60SbZ8jHuG2wH058GF4pLFbYamYrVA=="
-    },
-    "ansi-styles": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
-      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
-      "requires": {
-        "color-convert": "^1.9.0"
-      }
-    },
-    "at-least-node": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/at-least-node/-/at-least-node-1.0.0.tgz",
-      "integrity": "sha512-+q/t7Ekv1EDY2l6Gda6LLiX14rU9TV20Wa3ofeQmwPFZbOMo9DXrLbOjFaaclkXKWidIaopwAObQDqwWtGUjqg=="
-    },
-    "autoprefixer": {
-      "version": "10.2.4",
-      "resolved": "https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.2.4.tgz",
-      "integrity": "sha512-DCCdUQiMD+P/as8m3XkeTUkUKuuRqLGcwD0nll7wevhqoJfMRpJlkFd1+MQh1pvupjiQuip42lc/VFvfUTMSKw==",
-      "dev": true,
-      "requires": {
-        "browserslist": "^4.16.1",
-        "caniuse-lite": "^1.0.30001181",
-        "colorette": "^1.2.1",
-        "fraction.js": "^4.0.13",
-        "normalize-range": "^0.1.2",
-        "postcss-value-parser": "^4.1.0"
-      }
-    },
-    "balanced-match": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.0.tgz",
-      "integrity": "sha1-ibTRmasr7kneFk6gK4nORi1xt2c="
-    },
-    "brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
-      "requires": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
-      }
-    },
-    "browserslist": {
-      "version": "4.16.3",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.16.3.tgz",
-      "integrity": "sha512-vIyhWmIkULaq04Gt93txdh+j02yX/JzlyhLYbV3YQCn/zvES3JnY7TifHHvvr1w5hTDluNKMkV05cs4vy8Q7sw==",
-      "dev": true,
-      "requires": {
-        "caniuse-lite": "^1.0.30001181",
-        "colorette": "^1.2.1",
-        "electron-to-chromium": "^1.3.649",
-        "escalade": "^3.1.1",
-        "node-releases": "^1.1.70"
-      }
-    },
-    "bytes": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.0.tgz",
-      "integrity": "sha512-zauLjrfCG+xvoyaqLoV8bLVXXNGC4JqlxFCutSDWA6fJrTo2ZuvLYTqZ7aHBLZSMOopbzwv8f+wZcVzfVTI2Dg=="
-    },
-    "camelcase-css": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/camelcase-css/-/camelcase-css-2.0.1.tgz",
-      "integrity": "sha512-QOSvevhslijgYwRx6Rv7zKdMF8lbRmx+uQGx2+vDc+KI/eBnsy9kit5aj23AgGu3pa4t9AgwbnXWqS+iOY+2aA=="
-    },
-    "caniuse-lite": {
-      "version": "1.0.30001185",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001185.tgz",
-      "integrity": "sha512-Fpi4kVNtNvJ15H0F6vwmXtb3tukv3Zg3qhKkOGUq7KJ1J6b9kf4dnNgtEAFXhRsJo0gNj9W60+wBvn0JcTvdTg==",
-      "dev": true
-    },
-    "chalk": {
-      "version": "2.4.2",
-      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
-      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
-      "requires": {
-        "ansi-styles": "^3.2.1",
-        "escape-string-regexp": "^1.0.5",
-        "supports-color": "^5.3.0"
-      }
-    },
-    "codemirror": {
-      "version": "5.59.2",
-      "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-5.59.2.tgz",
-      "integrity": "sha512-/D5PcsKyzthtSy2NNKCyJi3b+htRkoKv3idswR/tR6UAvMNKA7SrmyZy6fOONJxSRs1JlUWEDAbxqfdArbK8iA=="
-    },
-    "color": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/color/-/color-3.1.3.tgz",
-      "integrity": "sha512-xgXAcTHa2HeFCGLE9Xs/R82hujGtu9Jd9x4NW3T34+OMs7VoPsjwzRczKHvTAHeJwWFwX5j15+MgAppE8ztObQ==",
-      "requires": {
-        "color-convert": "^1.9.1",
-        "color-string": "^1.5.4"
-      }
-    },
-    "color-convert": {
-      "version": "1.9.3",
-      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
-      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
-      "requires": {
-        "color-name": "1.1.3"
-      }
-    },
-    "color-name": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
-      "integrity": "sha1-p9BVi9icQveV3UIyj3QIMcpTvCU="
-    },
-    "color-string": {
-      "version": "1.5.4",
-      "resolved": "https://registry.npmjs.org/color-string/-/color-string-1.5.4.tgz",
-      "integrity": "sha512-57yF5yt8Xa3czSEW1jfQDE79Idk0+AkN/4KWad6tbdxUmAs3MvjxlWSWD4deYytcRfoZ9nhKyFl1kj5tBvidbw==",
-      "requires": {
-        "color-name": "^1.0.0",
-        "simple-swizzle": "^0.2.2"
-      }
-    },
-    "colorette": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/colorette/-/colorette-1.2.1.tgz",
-      "integrity": "sha512-puCDz0CzydiSYOrnXpz/PKd69zRrribezjtE9yd4zvytoRc8+RY/KJPvtPFKZS3E3wP6neGyMe0vOTlHO5L3Pw=="
-    },
-    "commander": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-6.2.1.tgz",
-      "integrity": "sha512-U7VdrJFnJgo4xjrHpTzu0yrHPGImdsmD95ZlgYSEajAn2JKzDhDTPG9kBTefmObL2w/ngeZnilk+OV9CG3d7UA=="
-    },
-    "concat-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s="
-    },
-    "convert-source-map": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.7.0.tgz",
-      "integrity": "sha512-4FJkXzKXEDB1snCFZlLP4gpC3JILicCpGbzG9f9G7tGqGCzETQ2hWPrcinA9oU4wtf2biUaEH5065UnMeR33oA==",
-      "dev": true,
-      "requires": {
-        "safe-buffer": "~5.1.1"
-      }
-    },
-    "css-unit-converter": {
-      "version": "1.1.2",
-      "resolved": "https://registry.npmjs.org/css-unit-converter/-/css-unit-converter-1.1.2.tgz",
-      "integrity": "sha512-IiJwMC8rdZE0+xiEZHeru6YoONC4rfPMqGm2W85jMIbkFvv5nFTwJVFHam2eFrN6txmoUYFAFXiv8ICVeTO0MA=="
-    },
-    "cssesc": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/cssesc/-/cssesc-3.0.0.tgz",
-      "integrity": "sha512-/Tb/JcjK111nNScGob5MNtsntNM1aCNUDipB/TkwZFhyDrrE47SOx/18wF2bbjgc3ZzCSKW1T5nt5EbFoAz/Vg=="
-    },
-    "csstype": {
-      "version": "3.0.6",
-      "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.0.6.tgz",
-      "integrity": "sha512-+ZAmfyWMT7TiIlzdqJgjMb7S4f1beorDbWbsocyK4RaiqA5RTX3K14bnBWmmA9QEM0gRdsjyyrEmcyga8Zsxmw==",
-      "dev": true
-    },
-    "debug": {
-      "version": "4.3.1",
-      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.1.tgz",
-      "integrity": "sha512-doEwdvm4PCeK4K3RQN2ZC2BYUBaxwLARCqZmMjtF8a51J2Rb0xpVloFRnCODwqjpwnAoao4pelN8l3RJdv3gRQ==",
-      "dev": true,
-      "requires": {
-        "ms": "2.1.2"
-      }
-    },
-    "defined": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/defined/-/defined-1.0.0.tgz",
-      "integrity": "sha1-yY2bzvdWdBiOEQlpFRGZ45sfppM="
-    },
-    "detective": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/detective/-/detective-5.2.0.tgz",
-      "integrity": "sha512-6SsIx+nUUbuK0EthKjv0zrdnajCCXVYGmbYYiYjFVpzcjwEs/JMDZ8tPRG29J/HhN56t3GJp2cGSWDRjjot8Pg==",
-      "requires": {
-        "acorn-node": "^1.6.1",
-        "defined": "^1.0.0",
-        "minimist": "^1.1.1"
-      }
-    },
-    "didyoumean": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/didyoumean/-/didyoumean-1.2.1.tgz",
-      "integrity": "sha1-6S7f2tplN9SE1zwBcv0eugxJdv8="
-    },
-    "electron-to-chromium": {
-      "version": "1.3.657",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.3.657.tgz",
-      "integrity": "sha512-/9ROOyvEflEbaZFUeGofD+Tqs/WynbSTbNgNF+/TJJxH1ePD/e6VjZlDJpW3FFFd3nj5l3Hd8ki2vRwy+gyRFw==",
-      "dev": true
-    },
-    "esbuild": {
-      "version": "0.8.42",
-      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.8.42.tgz",
-      "integrity": "sha512-zUtj5RMqROCCCH0vV/a7cd8YQg8I0GWBhV3A3PklWRT+oM/YwVbnrtFnITzE1otGdnXplWHWdZ4OcYiV0PN+JQ==",
-      "dev": true
-    },
-    "escalade": {
-      "version": "3.1.1",
-      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
-      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
-      "dev": true
-    },
-    "escape-string-regexp": {
-      "version": "1.0.5",
-      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
-      "integrity": "sha1-G2HAViGQqN/2rjuyzwIAyhMLhtQ="
-    },
-    "events": {
-      "version": "3.2.0",
-      "resolved": "https://registry.npmjs.org/events/-/events-3.2.0.tgz",
-      "integrity": "sha512-/46HWwbfCX2xTawVfkKLGxMifJYQBWMwY1mjywRtb4c9x8l5NP3KoJtnIOiL1hfdRkIuYhETxQlo62IF8tcnlg=="
-    },
-    "fraction.js": {
-      "version": "4.0.13",
-      "resolved": "https://registry.npmjs.org/fraction.js/-/fraction.js-4.0.13.tgz",
-      "integrity": "sha512-E1fz2Xs9ltlUp+qbiyx9wmt2n9dRzPsS11Jtdb8D2o+cC7wr9xkkKsVKJuBX0ST+LVS+LhLO+SbLJNtfWcJvXA==",
-      "dev": true
-    },
-    "fs-extra": {
-      "version": "9.1.0",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-9.1.0.tgz",
-      "integrity": "sha512-hcg3ZmepS30/7BSFqRvoo3DOMQu7IjqxO5nCDt+zM9XWjb33Wg7ziNT+Qvqbuc3+gWpzO02JubVyk2G4Zvo1OQ==",
-      "requires": {
-        "at-least-node": "^1.0.0",
-        "graceful-fs": "^4.2.0",
-        "jsonfile": "^6.0.1",
-        "universalify": "^2.0.0"
-      }
-    },
-    "fs.realpath": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8="
-    },
-    "fsevents": {
-      "version": "2.1.3",
-      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.1.3.tgz",
-      "integrity": "sha512-Auw9a4AxqWpa9GUfj370BMPzzyncfBABW8Mab7BGWBYDj4Isgq+cDKtx0i6u9jcX9pQDnswsaaOTgTmA5pEjuQ==",
-      "dev": true,
-      "optional": true
-    },
-    "function-bind": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.1.tgz",
-      "integrity": "sha512-yIovAzMX49sF8Yl58fSCWJ5svSLuaibPxXQJFLmBObTuCr0Mf1KiPopGM9NiFjiYBCbfaa2Fh6breQ6ANVTI0A=="
-    },
-    "gensync": {
-      "version": "1.0.0-beta.2",
-      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
-      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
-      "dev": true
-    },
-    "glob": {
-      "version": "7.1.6",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-7.1.6.tgz",
-      "integrity": "sha512-LwaxwyZ72Lk7vZINtNNrywX0ZuLyStrdDtabefZKAY5ZGJhVtgdznluResxNmPitE0SAO+O26sWTHeKSI2wMBA==",
-      "requires": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^3.0.4",
-        "once": "^1.3.0",
-        "path-is-absolute": "^1.0.0"
-      }
-    },
-    "globals": {
-      "version": "11.12.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
-      "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
-      "dev": true
-    },
-    "graceful-fs": {
-      "version": "4.2.5",
-      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.5.tgz",
-      "integrity": "sha512-kBBSQbz2K0Nyn+31j/w36fUfxkBW9/gfwRWdUY1ULReH3iokVJgddZAFcD1D0xlgTmFxJCbUkUclAlc6/IDJkw=="
-    },
-    "has": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/has/-/has-1.0.3.tgz",
-      "integrity": "sha512-f2dvO0VU6Oej7RkWJGrehjbzMAjFp5/VKPp5tTpWIV4JHHZK1/BxbFRtf/siA2SWTe09caDmVtYYzWEIbBS4zw==",
-      "requires": {
-        "function-bind": "^1.1.1"
-      }
-    },
-    "has-flag": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
-      "integrity": "sha1-tdRU3CGZriJWmfNGfloH87lVuv0="
-    },
-    "history": {
-      "version": "4.10.1",
-      "resolved": "https://registry.npmjs.org/history/-/history-4.10.1.tgz",
-      "integrity": "sha512-36nwAD620w12kuzPAsyINPWJqlNbij+hpK1k9XRloDtym8mxzGYl2c17LnV6IAGB2Dmg4tEa7G7DlawS0+qjew==",
-      "requires": {
-        "@babel/runtime": "^7.1.2",
-        "loose-envify": "^1.2.0",
-        "resolve-pathname": "^3.0.0",
-        "tiny-invariant": "^1.0.2",
-        "tiny-warning": "^1.0.0",
-        "value-equal": "^1.0.1"
-      }
-    },
-    "hoist-non-react-statics": {
-      "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/hoist-non-react-statics/-/hoist-non-react-statics-3.3.2.tgz",
-      "integrity": "sha512-/gGivxi8JPKWNm/W0jSmzcMPpfpPLc3dY/6GxhX2hQ9iGj3aDfklV4ET7NjKpSinLpJ5vafa9iiGIEZg10SfBw==",
-      "requires": {
-        "react-is": "^16.7.0"
-      }
-    },
-    "html-tags": {
-      "version": "3.1.0",
-      "resolved": "https://registry.npmjs.org/html-tags/-/html-tags-3.1.0.tgz",
-      "integrity": "sha512-1qYz89hW3lFDEazhjW0yVAV87lw8lVkrJocr72XmBkMKsoSVJCQx3W8BXsC7hO2qAt8BoVjYjtAcZ9perqGnNg=="
-    },
-    "indexes-of": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/indexes-of/-/indexes-of-1.0.1.tgz",
-      "integrity": "sha1-8w9xbI4r00bHtn0985FVZqfAVgc="
-    },
-    "inflight": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
-      "requires": {
-        "once": "^1.3.0",
-        "wrappy": "1"
-      }
-    },
-    "inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
-    },
-    "is-arrayish": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.3.2.tgz",
-      "integrity": "sha512-eVRqCvVlZbuw3GrM63ovNSNAeA1K16kaR/LRY/92w0zxQ5/1YzwblUX652i4Xs9RwAGjW9d9y6X88t8OaAJfWQ=="
-    },
-    "is-core-module": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.2.0.tgz",
-      "integrity": "sha512-XRAfAdyyY5F5cOXn7hYQDqh2Xmii+DEfIcQGxK/uNwMHhIkPWO0g8msXcbzLe+MpGoR951MlqM/2iIlU4vKDdQ==",
-      "requires": {
-        "has": "^1.0.3"
-      }
-    },
-    "isarray": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/isarray/-/isarray-0.0.1.tgz",
-      "integrity": "sha1-ihis/Kmo9Bd+Cav8YDiTmwXR7t8="
-    },
-    "js-tokens": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
-      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="
-    },
-    "jsesc": {
-      "version": "2.5.2",
-      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
-      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
-      "dev": true
-    },
-    "json-rpc-protocol": {
-      "version": "0.13.1",
-      "resolved": "https://registry.npmjs.org/json-rpc-protocol/-/json-rpc-protocol-0.13.1.tgz",
-      "integrity": "sha512-gdb0TnNf0ITRjLm0QGNODgK1E6ORLhe+6L+RV8owg4X3d6x8jAfyHQC+xMG4T/qU2SPaNLpav29QRLC+3oF6gg==",
-      "requires": {
-        "make-error": "^1.3.0"
-      }
-    },
-    "json5": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.0.tgz",
-      "integrity": "sha512-f+8cldu7X/y7RAJurMEJmdoKXGB/X550w2Nr3tTbezL6RwEE/iMcm+tZnXeoZtKuOq6ft8+CqzEkrIgx1fPoQA==",
-      "dev": true,
-      "requires": {
-        "minimist": "^1.2.5"
-      }
-    },
-    "jsonfile": {
-      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
-      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
-      "requires": {
-        "graceful-fs": "^4.1.6",
-        "universalify": "^2.0.0"
-      }
-    },
-    "lodash": {
-      "version": "4.17.20",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz",
-      "integrity": "sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA=="
-    },
-    "lodash.toarray": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/lodash.toarray/-/lodash.toarray-4.4.0.tgz",
-      "integrity": "sha1-JMS/zWsvuji/0FlNsRedjptlZWE="
-    },
-    "loose-envify": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/loose-envify/-/loose-envify-1.4.0.tgz",
-      "integrity": "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q==",
-      "requires": {
-        "js-tokens": "^3.0.0 || ^4.0.0"
-      }
-    },
-    "luxon": {
-      "version": "1.25.0",
-      "resolved": "https://registry.npmjs.org/luxon/-/luxon-1.25.0.tgz",
-      "integrity": "sha512-hEgLurSH8kQRjY6i4YLey+mcKVAWXbDNlZRmM6AgWDJ1cY3atl8Ztf5wEY7VBReFbmGnwQPz7KYJblL8B2k0jQ=="
-    },
-    "make-error": {
-      "version": "1.3.6",
-      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
-      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw=="
-    },
-    "mini-create-react-context": {
-      "version": "0.4.1",
-      "resolved": "https://registry.npmjs.org/mini-create-react-context/-/mini-create-react-context-0.4.1.tgz",
-      "integrity": "sha512-YWCYEmd5CQeHGSAKrYvXgmzzkrvssZcuuQDDeqkT+PziKGMgE+0MCCtcKbROzocGBG1meBLl2FotlRwf4gAzbQ==",
-      "requires": {
-        "@babel/runtime": "^7.12.1",
-        "tiny-warning": "^1.0.3"
-      }
-    },
-    "mini-svg-data-uri": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/mini-svg-data-uri/-/mini-svg-data-uri-1.2.3.tgz",
-      "integrity": "sha512-zd6KCAyXgmq6FV1mR10oKXYtvmA9vRoB6xPSTUJTbFApCtkefDnYueVR1gkof3KcdLZo1Y8mjF2DFmQMIxsHNQ=="
-    },
-    "minimatch": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
-      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
-      "requires": {
-        "brace-expansion": "^1.1.7"
-      }
-    },
-    "minimist": {
-      "version": "1.2.5",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz",
-      "integrity": "sha512-FM9nNUYrRBAELZQT3xeZQ7fmMOBg6nWNmJKTcgsJeaLstP/UODVpGsr5OhXhhXg6f+qtJ8uiZ+PUxkDWcgIXLw=="
-    },
-    "modern-normalize": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/modern-normalize/-/modern-normalize-1.0.0.tgz",
-      "integrity": "sha512-1lM+BMLGuDfsdwf3rsgBSrxJwAZHFIrQ8YR61xIqdHo0uNKI9M52wNpHSrliZATJp51On6JD0AfRxd4YGSU0lw=="
-    },
-    "ms": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
-      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
-      "dev": true
-    },
-    "nanoid": {
-      "version": "3.1.20",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.1.20.tgz",
-      "integrity": "sha512-a1cQNyczgKbLX9jwbS/+d7W8fX/RfgYR7lVWwWOGIPNgK2m0MWvrGF6/m4kk6U3QcFMnZf3RIhL0v2Jgh/0Uxw=="
-    },
-    "node-emoji": {
-      "version": "1.10.0",
-      "resolved": "https://registry.npmjs.org/node-emoji/-/node-emoji-1.10.0.tgz",
-      "integrity": "sha512-Yt3384If5H6BYGVHiHwTL+99OzJKHhgp82S8/dktEK73T26BazdgZ4JZh92xSVtGNJvz9UbXdNAc5hcrXV42vw==",
-      "requires": {
-        "lodash.toarray": "^4.4.0"
-      }
-    },
-    "node-releases": {
-      "version": "1.1.70",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-1.1.70.tgz",
-      "integrity": "sha512-Slf2s69+2/uAD79pVVQo8uSiC34+g8GWY8UH2Qtqv34ZfhYrxpYpfzs9Js9d6O0mbDmALuxaTlplnBTnSELcrw==",
-      "dev": true
-    },
-    "normalize-range": {
-      "version": "0.1.2",
-      "resolved": "https://registry.npmjs.org/normalize-range/-/normalize-range-0.1.2.tgz",
-      "integrity": "sha1-LRDAa9/TEuqXd2laTShDlFa3WUI=",
-      "dev": true
-    },
-    "object-assign": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
-      "integrity": "sha1-IQmtx5ZYh8/AXLvUQsrIv7s2CGM="
-    },
-    "object-hash": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/object-hash/-/object-hash-2.1.1.tgz",
-      "integrity": "sha512-VOJmgmS+7wvXf8CjbQmimtCnEx3IAoLxI3fp2fbWehxrWBcAQFbk+vcwb6vzR0VZv/eNCJ/27j151ZTwqW/JeQ=="
-    },
-    "once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
-      "requires": {
-        "wrappy": "1"
-      }
-    },
-    "path-is-absolute": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
-      "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18="
-    },
-    "path-parse": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz",
-      "integrity": "sha512-GSmOT2EbHrINBf9SR7CDELwlJ8AENk3Qn7OikK4nFYAu3Ote2+JYNVvkpAEQm3/TLNEJFD/xZJjzyxg3KBWOzw=="
-    },
-    "path-to-regexp": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-1.8.0.tgz",
-      "integrity": "sha512-n43JRhlUKUAlibEJhPeir1ncUID16QnEjNpwzNdO3Lm4ywrBpBZ5oLD0I6br9evr1Y9JTqwRtAh7JLoOzAQdVA==",
-      "requires": {
-        "isarray": "0.0.1"
-      }
-    },
-    "postcss": {
-      "version": "8.2.5",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.2.5.tgz",
-      "integrity": "sha512-wMcb7BpDcm3gxQOQx46NDNT36Kk0Ao6PJLLI2ed5vehbbbxCEuslSQzbQ2sfSKy+gkYxhWcGWSeaK+gwm4KIZg==",
-      "requires": {
-        "colorette": "^1.2.1",
-        "nanoid": "^3.1.20",
-        "source-map": "^0.6.1"
-      },
-      "dependencies": {
-        "source-map": {
-          "version": "0.6.1",
-          "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="
-        }
-      }
-    },
-    "postcss-functions": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/postcss-functions/-/postcss-functions-3.0.0.tgz",
-      "integrity": "sha1-DpTQFERwCkgd4g3k1V+yZAVkJQ4=",
-      "requires": {
-        "glob": "^7.1.2",
-        "object-assign": "^4.1.1",
-        "postcss": "^6.0.9",
-        "postcss-value-parser": "^3.3.0"
-      },
-      "dependencies": {
-        "postcss": {
-          "version": "6.0.23",
-          "resolved": "https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz",
-          "integrity": "sha512-soOk1h6J3VMTZtVeVpv15/Hpdl2cBLX3CAw4TAbkpTJiNPk9YP/zWcD1ND+xEtvyuuvKzbxliTOIyvkSeSJ6ag==",
-          "requires": {
-            "chalk": "^2.4.1",
-            "source-map": "^0.6.1",
-            "supports-color": "^5.4.0"
-          }
-        },
-        "postcss-value-parser": {
-          "version": "3.3.1",
-          "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-3.3.1.tgz",
-          "integrity": "sha512-pISE66AbVkp4fDQ7VHBwRNXzAAKJjw4Vw7nWI/+Q3vuly7SNfgYXvm6i5IgFylHGK5sP/xHAbB7N49OS4gWNyQ=="
-        },
-        "source-map": {
-          "version": "0.6.1",
-          "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
-          "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="
-        }
-      }
-    },
-    "postcss-js": {
-      "version": "3.0.3",
-      "resolved": "https://registry.npmjs.org/postcss-js/-/postcss-js-3.0.3.tgz",
-      "integrity": "sha512-gWnoWQXKFw65Hk/mi2+WTQTHdPD5UJdDXZmX073EY/B3BWnYjO4F4t0VneTCnCGQ5E5GsCdMkzPaTXwl3r5dJw==",
-      "requires": {
-        "camelcase-css": "^2.0.1",
-        "postcss": "^8.1.6"
-      }
-    },
-    "postcss-nested": {
-      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/postcss-nested/-/postcss-nested-5.0.3.tgz",
-      "integrity": "sha512-R2LHPw+u5hFfDgJG748KpGbJyTv7Yr33/2tIMWxquYuHTd9EXu27PYnKi7BxMXLtzKC0a0WVsqHtd7qIluQu/g==",
-      "requires": {
-        "postcss-selector-parser": "^6.0.4"
-      }
-    },
-    "postcss-selector-parser": {
-      "version": "6.0.4",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.4.tgz",
-      "integrity": "sha512-gjMeXBempyInaBqpp8gODmwZ52WaYsVOsfr4L4lDQ7n3ncD6mEyySiDtgzCT+NYC0mmeOLvtsF8iaEf0YT6dBw==",
-      "requires": {
-        "cssesc": "^3.0.0",
-        "indexes-of": "^1.0.1",
-        "uniq": "^1.0.1",
-        "util-deprecate": "^1.0.2"
-      }
-    },
-    "postcss-value-parser": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.1.0.tgz",
-      "integrity": "sha512-97DXOFbQJhk71ne5/Mt6cOu6yxsSfM0QGQyl0L25Gca4yGWEGJaig7l7gbCX623VqTBNGLRLaVUCnNkcedlRSQ=="
-    },
-    "pretty-hrtime": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/pretty-hrtime/-/pretty-hrtime-1.0.3.tgz",
-      "integrity": "sha1-t+PqQkNaTJsnWdmeDyAesZWALuE="
-    },
-    "prop-types": {
-      "version": "15.7.2",
-      "resolved": "https://registry.npmjs.org/prop-types/-/prop-types-15.7.2.tgz",
-      "integrity": "sha512-8QQikdH7//R2vurIJSutZ1smHYTcLpRWEOlHnzcWHmBYrOGUysKwSsrC89BCiFj3CbrfJ/nXFdJepOVrY1GCHQ==",
-      "requires": {
-        "loose-envify": "^1.4.0",
-        "object-assign": "^4.1.1",
-        "react-is": "^16.8.1"
-      }
-    },
-    "purgecss": {
-      "version": "3.1.3",
-      "resolved": "https://registry.npmjs.org/purgecss/-/purgecss-3.1.3.tgz",
-      "integrity": "sha512-hRSLN9mguJ2lzlIQtW4qmPS2kh6oMnA9RxdIYK8sz18QYqd6ePp4GNDl18oWHA1f2v2NEQIh51CO8s/E3YGckQ==",
-      "requires": {
-        "commander": "^6.0.0",
-        "glob": "^7.0.0",
-        "postcss": "^8.2.1",
-        "postcss-selector-parser": "^6.0.2"
-      }
-    },
-    "react": {
-      "version": "17.0.1",
-      "resolved": "https://registry.npmjs.org/react/-/react-17.0.1.tgz",
-      "integrity": "sha512-lG9c9UuMHdcAexXtigOZLX8exLWkW0Ku29qPRU8uhF2R9BN96dLCt0psvzPLlHc5OWkgymP3qwTRgbnw5BKx3w==",
-      "requires": {
-        "loose-envify": "^1.1.0",
-        "object-assign": "^4.1.1"
-      }
-    },
-    "react-dom": {
-      "version": "17.0.1",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-17.0.1.tgz",
-      "integrity": "sha512-6eV150oJZ9U2t9svnsspTMrWNyHc6chX0KzDeAOXftRa8bNeOKTTfCJ7KorIwenkHd2xqVTBTCZd79yk/lx/Ug==",
-      "requires": {
-        "loose-envify": "^1.1.0",
-        "object-assign": "^4.1.1",
-        "scheduler": "^0.20.1"
-      }
-    },
-    "react-is": {
-      "version": "16.13.1",
-      "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
-      "integrity": "sha512-24e6ynE2H+OKt4kqsOvNd8kBpV65zoxbA4BVsEOB3ARVWQki/DHzaUoC5KuON/BiccDaCCTZBuOcfZs70kR8bQ=="
-    },
-    "react-refresh": {
-      "version": "0.9.0",
-      "resolved": "https://registry.npmjs.org/react-refresh/-/react-refresh-0.9.0.tgz",
-      "integrity": "sha512-Gvzk7OZpiqKSkxsQvO/mbTN1poglhmAV7gR/DdIrRrSMXraRQQlfikRJOr3Nb9GTMPC5kof948Zy6jJZIFtDvQ==",
-      "dev": true
-    },
-    "react-router": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/react-router/-/react-router-5.2.0.tgz",
-      "integrity": "sha512-smz1DUuFHRKdcJC0jobGo8cVbhO3x50tCL4icacOlcwDOEQPq4TMqwx3sY1TP+DvtTgz4nm3thuo7A+BK2U0Dw==",
-      "requires": {
-        "@babel/runtime": "^7.1.2",
-        "history": "^4.9.0",
-        "hoist-non-react-statics": "^3.1.0",
-        "loose-envify": "^1.3.1",
-        "mini-create-react-context": "^0.4.0",
-        "path-to-regexp": "^1.7.0",
-        "prop-types": "^15.6.2",
-        "react-is": "^16.6.0",
-        "tiny-invariant": "^1.0.2",
-        "tiny-warning": "^1.0.0"
-      }
-    },
-    "react-router-dom": {
-      "version": "5.2.0",
-      "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-5.2.0.tgz",
-      "integrity": "sha512-gxAmfylo2QUjcwxI63RhQ5G85Qqt4voZpUXSEqCwykV0baaOTQDR1f0PmY8AELqIyVc0NEZUj0Gov5lNGcXgsA==",
-      "requires": {
-        "@babel/runtime": "^7.1.2",
-        "history": "^4.9.0",
-        "loose-envify": "^1.3.1",
-        "prop-types": "^15.6.2",
-        "react-router": "5.2.0",
-        "tiny-invariant": "^1.0.2",
-        "tiny-warning": "^1.0.0"
-      }
-    },
-    "reduce-css-calc": {
-      "version": "2.1.8",
-      "resolved": "https://registry.npmjs.org/reduce-css-calc/-/reduce-css-calc-2.1.8.tgz",
-      "integrity": "sha512-8liAVezDmUcH+tdzoEGrhfbGcP7nOV4NkGE3a74+qqvE7nt9i4sKLGBuZNOnpI4WiGksiNPklZxva80061QiPg==",
-      "requires": {
-        "css-unit-converter": "^1.1.1",
-        "postcss-value-parser": "^3.3.0"
-      },
-      "dependencies": {
-        "postcss-value-parser": {
-          "version": "3.3.1",
-          "resolved": "https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-3.3.1.tgz",
-          "integrity": "sha512-pISE66AbVkp4fDQ7VHBwRNXzAAKJjw4Vw7nWI/+Q3vuly7SNfgYXvm6i5IgFylHGK5sP/xHAbB7N49OS4gWNyQ=="
-        }
-      }
-    },
-    "regenerator-runtime": {
-      "version": "0.13.7",
-      "resolved": "https://registry.npmjs.org/regenerator-runtime/-/regenerator-runtime-0.13.7.tgz",
-      "integrity": "sha512-a54FxoJDIr27pgf7IgeQGxmqUNYrcV338lf/6gH456HZ/PhX+5BcwHXG9ajESmwe6WRO0tAzRUrRmNONWgkrew=="
-    },
-    "resolve": {
-      "version": "1.19.0",
-      "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.19.0.tgz",
-      "integrity": "sha512-rArEXAgsBG4UgRGcynxWIWKFvh/XZCcS8UJdHhwy91zwAvCZIbcs+vAbflgBnNjYMs/i/i+/Ux6IZhML1yPvxg==",
-      "requires": {
-        "is-core-module": "^2.1.0",
-        "path-parse": "^1.0.6"
-      }
-    },
-    "resolve-pathname": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/resolve-pathname/-/resolve-pathname-3.0.0.tgz",
-      "integrity": "sha512-C7rARubxI8bXFNB/hqcp/4iUeIXJhJZvFPFPiSPRnhU5UPxzMFIl+2E6yY6c4k9giDJAhtV+enfA+G89N6Csng=="
-    },
-    "rollup": {
-      "version": "2.38.5",
-      "resolved": "https://registry.npmjs.org/rollup/-/rollup-2.38.5.tgz",
-      "integrity": "sha512-VoWt8DysFGDVRGWuHTqZzT02J0ASgjVq/hPs9QcBOGMd7B+jfTr/iqMVEyOi901rE3xq+Deq66GzIT1yt7sGwQ==",
-      "dev": true,
-      "requires": {
-        "fsevents": "~2.3.1"
-      },
-      "dependencies": {
-        "fsevents": {
-          "version": "2.3.2",
-          "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
-          "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
-          "dev": true,
-          "optional": true
-        }
-      }
-    },
-    "safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g==",
-      "dev": true
-    },
-    "scheduler": {
-      "version": "0.20.1",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.20.1.tgz",
-      "integrity": "sha512-LKTe+2xNJBNxu/QhHvDR14wUXHRQbVY5ZOYpOGWRzhydZUqrLb2JBvLPY7cAqFmqrWuDED0Mjk7013SZiOz6Bw==",
-      "requires": {
-        "loose-envify": "^1.1.0",
-        "object-assign": "^4.1.1"
-      }
-    },
-    "semver": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-      "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
-      "dev": true
-    },
-    "simple-swizzle": {
-      "version": "0.2.2",
-      "resolved": "https://registry.npmjs.org/simple-swizzle/-/simple-swizzle-0.2.2.tgz",
-      "integrity": "sha1-pNprY1/8zMoz9w0Xy5JZLeleVXo=",
-      "requires": {
-        "is-arrayish": "^0.3.1"
-      }
-    },
-    "source-map": {
-      "version": "0.5.7",
-      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
-      "integrity": "sha1-igOdLRAh0i0eoUyA2OpGi6LvP8w=",
-      "dev": true
-    },
-    "supports-color": {
-      "version": "5.5.0",
-      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
-      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
-      "requires": {
-        "has-flag": "^3.0.0"
-      }
-    },
-    "tailwindcss": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-2.0.2.tgz",
-      "integrity": "sha512-nO9JRE1pO7SF9RnYAl6g7uzeHdrmKAFqNjT9NtZUfxqimJZAOOLOEyIEUiMq12+xIc7mC2Ey3Vf90XjHpWKfbw==",
-      "requires": {
-        "@fullhuman/postcss-purgecss": "^3.0.0",
-        "bytes": "^3.0.0",
-        "chalk": "^4.1.0",
-        "color": "^3.1.3",
-        "detective": "^5.2.0",
-        "didyoumean": "^1.2.1",
-        "fs-extra": "^9.0.1",
-        "html-tags": "^3.1.0",
-        "lodash": "^4.17.20",
-        "modern-normalize": "^1.0.0",
-        "node-emoji": "^1.8.1",
-        "object-hash": "^2.0.3",
-        "postcss-functions": "^3",
-        "postcss-js": "^3.0.3",
-        "postcss-nested": "^5.0.1",
-        "postcss-selector-parser": "^6.0.4",
-        "postcss-value-parser": "^4.1.0",
-        "pretty-hrtime": "^1.0.3",
-        "reduce-css-calc": "^2.1.6",
-        "resolve": "^1.19.0"
-      },
-      "dependencies": {
-        "ansi-styles": {
-          "version": "4.3.0",
-          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
-          "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
-          "requires": {
-            "color-convert": "^2.0.1"
-          }
-        },
-        "chalk": {
-          "version": "4.1.0",
-          "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.0.tgz",
-          "integrity": "sha512-qwx12AxXe2Q5xQ43Ac//I6v5aXTipYrSESdOgzrN+9XjgEpyjpKuvSGaN4qE93f7TQTlerQQ8S+EQ0EyDoVL1A==",
-          "requires": {
-            "ansi-styles": "^4.1.0",
-            "supports-color": "^7.1.0"
-          }
-        },
-        "color-convert": {
-          "version": "2.0.1",
-          "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
-          "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
-          "requires": {
-            "color-name": "~1.1.4"
-          }
-        },
-        "color-name": {
-          "version": "1.1.4",
-          "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
-          "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
-        },
-        "has-flag": {
-          "version": "4.0.0",
-          "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
-          "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="
-        },
-        "supports-color": {
-          "version": "7.2.0",
-          "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
-          "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
-          "requires": {
-            "has-flag": "^4.0.0"
-          }
-        }
-      }
-    },
-    "tiny-invariant": {
-      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/tiny-invariant/-/tiny-invariant-1.1.0.tgz",
-      "integrity": "sha512-ytxQvrb1cPc9WBEI/HSeYYoGD0kWnGEOR8RY6KomWLBVhqz0RgTwVO9dLrGz7dC+nN9llyI7OKAgRq8Vq4ZBSw=="
-    },
-    "tiny-warning": {
-      "version": "1.0.3",
-      "resolved": "https://registry.npmjs.org/tiny-warning/-/tiny-warning-1.0.3.tgz",
-      "integrity": "sha512-lBN9zLN/oAf68o3zNXYrdCt1kP8WsiGW8Oo2ka41b2IM5JL/S1CTyX1rW0mb/zSuJun0ZUrDxx4sqvYS2FWzPA=="
-    },
-    "to-fast-properties": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
-      "integrity": "sha1-3F5pjL0HkmW8c+A3doGk5Og/YW4=",
-      "dev": true
-    },
-    "typescript": {
-      "version": "4.1.3",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.1.3.tgz",
-      "integrity": "sha512-B3ZIOf1IKeH2ixgHhj6la6xdwR9QrLC5d1VKeCSY4tvkqhF2eqd9O7txNlS0PO3GrBAFIdr3L1ndNwteUbZLYg==",
-      "dev": true
-    },
-    "uniq": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/uniq/-/uniq-1.0.1.tgz",
-      "integrity": "sha1-sxxa6CVIRKOoKBVBzisEuGWnNP8="
-    },
-    "universalify": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.0.tgz",
-      "integrity": "sha512-hAZsKq7Yy11Zu1DE0OzWjw7nnLZmJZYTDZZyEFHZdUhV8FkH5MCfoU1XMaxXovpyW5nq5scPqq0ZDP9Zyl04oQ=="
-    },
-    "util-deprecate": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
-      "integrity": "sha1-RQ1Nyfpw3nMnYvvS1KKJgUGaDM8="
-    },
-    "value-equal": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/value-equal/-/value-equal-1.0.1.tgz",
-      "integrity": "sha512-NOJ6JZCAWr0zlxZt+xqCHNTEKOsrks2HQd4MqhP1qy4z1SkbEP467eNx6TgDKXMvUOb+OENfJCZwM+16n7fRfw=="
-    },
-    "vite": {
-      "version": "2.0.0-beta.65",
-      "resolved": "https://registry.npmjs.org/vite/-/vite-2.0.0-beta.65.tgz",
-      "integrity": "sha512-mdHNTP6fGeb8m8lWAM3UbSPw1+un1lUv0i4MQJcNiK2/P01RHIY02VjQeXBv3NemkExkgLji88LN9ySFMUQpIw==",
-      "dev": true,
-      "requires": {
-        "esbuild": "^0.8.34",
-        "fsevents": "~2.1.2",
-        "postcss": "^8.2.1",
-        "resolve": "^1.19.0",
-        "rollup": "^2.35.1"
-      }
-    },
-    "wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8="
-    },
-    "xtend": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
-      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ=="
-    }
-  }
-}
diff --git a/cli/daemon/dash/dashapp/package.json b/cli/daemon/dash/dashapp/package.json
deleted file mode 100644
index 872e85d9db..0000000000
--- a/cli/daemon/dash/dashapp/package.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "name": "dashapp",
-  "version": "0.0.0",
-  "scripts": {
-    "dev": "vite",
-    "build": "tsc && vite build",
-    "serve": "vite preview"
-  },
-  "dependencies": {
-    "@headlessui/react": "^0.2.0",
-    "@tailwindcss/forms": "^0.2.1",
-    "codemirror": "^5.59.2",
-    "events": "^3.2.0",
-    "json-rpc-protocol": "^0.13.1",
-    "luxon": "^1.25.0",
-    "react": "^17.0.0",
-    "react-dom": "^17.0.0",
-    "react-router-dom": "^5.2.0",
-    "tailwindcss": "^2.0.2"
-  },
-  "devDependencies": {
-    "@types/codemirror": "^0.0.108",
-    "@types/events": "^3.0.0",
-    "@types/luxon": "^1.25.1",
-    "@types/node": "^14.14.25",
-    "@types/react": "^17.0.0",
-    "@types/react-dom": "^17.0.0",
-    "@types/react-router-dom": "^5.1.7",
-    "@vitejs/plugin-react-refresh": "^1.1.0",
-    "autoprefixer": "^10.2.4",
-    "postcss": "^8.2.5",
-    "typescript": "^4.1.2",
-    "vite": "^2.0.0-beta.64"
-  }
-}
diff --git a/cli/daemon/dash/dashapp/postcss.config.js b/cli/daemon/dash/dashapp/postcss.config.js
deleted file mode 100644
index 33ad091d26..0000000000
--- a/cli/daemon/dash/dashapp/postcss.config.js
+++ /dev/null
@@ -1,6 +0,0 @@
-module.exports = {
-  plugins: {
-    tailwindcss: {},
-    autoprefixer: {},
-  },
-}
diff --git a/cli/daemon/dash/dashapp/public/favicon.ico b/cli/daemon/dash/dashapp/public/favicon.ico
deleted file mode 100644
index f8a3d8683e..0000000000
Binary files a/cli/daemon/dash/dashapp/public/favicon.ico and /dev/null differ
diff --git a/cli/daemon/dash/dashapp/src/App.tsx b/cli/daemon/dash/dashapp/src/App.tsx
deleted file mode 100644
index 6f449b0844..0000000000
--- a/cli/daemon/dash/dashapp/src/App.tsx
+++ /dev/null
@@ -1,42 +0,0 @@
-import React, { useEffect, useRef, useState } from 'react'
-import {
-  BrowserRouter as Router,
-  Route, Switch
-} from "react-router-dom";
-import Client from '~lib/client/client';
-import JSONRPCConn from '~lib/client/jsonrpc';
-import AppList from '~p/AppList';
-import AppHome from '~p/AppHome';
-import { ConnContext } from '~lib/ctx';
-import AppAPI from '~p/AppAPI';
-
-function App() {
-  const [conn, setConn] = useState<JSONRPCConn | undefined>(undefined)
-  const [err, setErr] = useState<Error | undefined>(undefined)
-  const mounted = useRef(true)
-
-  useEffect(() => {
-    const client = new Client()
-    client.base.jsonrpc("/__encore").then(
-      conn => mounted.current && setConn(conn)
-    ).catch(err => mounted.current && setErr(err))
-    return () => { conn?.close(); mounted.current = false }
-  }, [])
-
-  if (err) return <div>Error: {err.message}</div>
-  if (!conn) return <div>Loading...</div>
-
-  return (
-    <ConnContext.Provider value={conn}>
-      <Router>
-        <Switch>
-          <Route path="/:appID/api"><AppAPI /></Route>
-          <Route path="/:appID"><AppHome /></Route>
-          <Route path="/"><AppList /></Route>
-        </Switch>
-      </Router>
-    </ConnContext.Provider>
-  )
-}
-
-export default App
diff --git a/cli/daemon/dash/dashapp/src/components/Button.tsx b/cli/daemon/dash/dashapp/src/components/Button.tsx
deleted file mode 100644
index 9369e961eb..0000000000
--- a/cli/daemon/dash/dashapp/src/components/Button.tsx
+++ /dev/null
@@ -1,49 +0,0 @@
-import React, { FunctionComponent, MouseEventHandler } from "react";
-
-export interface Props {
-  theme: "purple" | "purple:secondary" | "purple:border" | "white" | "red" | "red:secondary" | "gray" | "gray:border";
-  size: "xxs" | "xs" | "sm" | "md" | "lg" | "xl";
-  cls?: string;
-  disabled?: boolean;
-  onClick?: MouseEventHandler<HTMLButtonElement>;
-  type?: "button" | "submit";
-}
-
-const sizeClasses = {
-  "xxs": "px-1 py-0.5 text-xs leading-4 rounded",
-  "xs": "px-2.5 py-1.5 text-xs leading-4 rounded",
-  "sm": "px-3 py-2 text-sm leading-4 rounded-md",
-  "md": "px-4 py-2 text-sm leading-5 rounded-md",
-  "lg": "px-4 py-2 text-base leading-6 rounded-md",
-  "xl": "px-6 py-3 text-base leading-6 rounded-md",
-}
-
-const enabledClasses = {
-  "purple": "border-transparent text-white bg-purple-600 hover:bg-purple-500 focus:outline-none focus:border-purple-700 focus:shadow-outline-purple active:bg-purple-700",
-  "purple:secondary": "border-transparent text-purple-700 bg-purple-100 hover:bg-purple-50 focus:outline-none focus:border-purple-300 focus:shadow-outline-purple active:bg-purple-200",
-  "purple:border": "border-purple-600 text-purple-700 bg-white hover:text-purple-500 hover:bg-purple-50 focus:outline-none focus:border-purple-500 focus:shadow-outline-purple active:text-purple-800 active:bg-gray-50",
-  "white": "border-gray-300 text-gray-700 bg-white hover:text-gray-500 focus:outline-none focus:border-purple-300 focus:shadow-outline-purple active:text-gray-800 active:bg-gray-50",
-  "red": "border-transparent bg-red-600 text-white hover:bg-red-500 focus:outline-none focus:border-red-700 focus:shadow-outline-red active:bg-red-700",
-  "red:secondary": "border-red-600 text-red-700 bg-white hover:text-white hover:bg-red-600 focus:outline-none focus:border-red-500 focus:shadow-outline-red active:text-white active:bg-red-600",
-  "gray": "border-transparent text-white bg-gray-700 hover:bg-gray-600 focus:outline-none active:bg-gray-800",
-  "gray:border": "border-gray-700 text-gray-800 bg-white hover:text-gray-600 hover:bg-gray-50 focus:outline-none focus:border-gray-600 active:text-gray-800 active:bg-gray-50",
-}
-
-const disabledClasses = {
-  "purple": "border-transparent text-white bg-purple-500 opacity-50 cursor-not-allowed focus:outline-none",
-  "purple:secondary": "border-transparent text-purple-700 bg-purple-100 opacity-50 cursor-not-allowed focus:outline-none",
-  "purple:border": "border-gray-200 text-gray-600 bg-white opacity-50 cursor-not-allowed focus:outline-none",
-  "white": "border-gray-200 text-gray-600 bg-white opacity-50 cursor-not-allowed focus:outline-none",
-  "red": "border-transparent text-white bg-red-500 opacity-50 cursor-not-allowed focus:outline-none",
-  "red:secondary": "border-gray-200 text-red-800 bg-white opacity-50 cursor-not-allowed focus:outline-none",
-  "gray": "border-transparent text-white bg-gray-500 opacity-50 cursor-not-allowed focus:outline-none",
-  "gray:border": "border-gray-200 text-gray-600 bg-white opacity-50 cursor-not-allowed focus:outline-none",
-}
-
-const Button: FunctionComponent<Props> = (props) => {
-  const baseCls = "inline-flex justify-center items-center border font-medium transition duration-150 ease-in-out"
-  const cls = `${baseCls} ${props.disabled ? disabledClasses[props.theme] : enabledClasses[props.theme]} ${sizeClasses[props.size]} ${props.cls || ""}`
-  return <button onClick={props.onClick} type={props.type ?? "button"} className={cls}>{props.children}</button>
-}
-
-export default Button
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/Input.tsx b/cli/daemon/dash/dashapp/src/components/Input.tsx
deleted file mode 100644
index 4e5a050b7a..0000000000
--- a/cli/daemon/dash/dashapp/src/components/Input.tsx
+++ /dev/null
@@ -1,318 +0,0 @@
-import React, { FunctionComponent, useRef, useState, useEffect } from 'react'
-
-type Type = "text" | "number" | "email" | "password";
-
-export interface InputProps {
-    id: string;
-    value: string;
-    type?: Type;
-    onChange?: (value: string) => void;
-
-    required?: boolean;
-    label?: string;
-    desc?: string;
-    htmlDesc?: string;
-    placeholder?: string;
-    error?: string;
-    prefix?: string;
-    cls?: string;
-    disabled?: boolean;
-}
-
-
-const Input: FunctionComponent<InputProps> = (props: InputProps) => {
-  const typ = props.type || "text"
-  const onChange = (event: React.ChangeEvent<HTMLInputElement>) => {
-    if (props.onChange) {
-      props.onChange(event.target.value)
-    }
-  }
-
-  const extraCls = props.disabled ? "bg-gray-100 text-gray-600" : ""
-
-  return (
-    <div className={props.cls}>
-      {props.label &&
-        <label htmlFor={props.id} className="block text-sm font-medium leading-5 text-gray-700 mb-1">{props.label}</label>
-      }
-
-      {props.error ? (
-        <>
-          {props.prefix ? (
-            <div className="flex relative rounded-md shadow-sm">
-              <span className="inline-flex items-center px-3 rounded-l-md border border-r-0 border-red-300 bg-gray-50 text-gray-500 sm:text-sm">
-                {props.prefix}
-              </span>
-              <input id={props.id} type={typ} className={`${extraCls} form-input flex-1 block w-full pl-3 pr-10 py-2 rounded-none rounded-r-md border-red-300 text-red-900 placeholder-red-300 focus:border-red-300 focus:shadow-outline-red sm:text-sm sm:leading-5`}
-                  onChange={onChange} disabled={props.disabled} required={props.required} placeholder={props.placeholder} value={props.value} aria-invalid="true" aria-describedby={props.id+"-error"} />
-              <div className="absolute inset-y-0 right-0 pr-3 flex items-center pointer-events-none">
-                <svg className="h-5 w-5 text-red-500" fill="currentColor" viewBox="0 0 20 20">
-                  <path fillRule="evenodd" d="M18 10a8 8 0 11-16 0 8 8 0 0116 0zm-7 4a1 1 0 11-2 0 1 1 0 012 0zm-1-9a1 1 0 00-1 1v4a1 1 0 102 0V6a1 1 0 00-1-1z" clipRule="evenodd" />
-                </svg>
-              </div>
-            </div>
-          ) : (
-            <div className="relative rounded-md shadow-sm">
-              <input id={props.id} type={typ} className={`${extraCls} form-input block w-full pr-10 border-red-300 text-red-900 placeholder-red-300 focus:border-red-300 focus:shadow-outline-red sm:text-sm sm:leading-5`}
-                  onChange={onChange} disabled={props.disabled} required={props.required} placeholder={props.placeholder} value={props.value} aria-invalid="true" aria-describedby={props.id+"-error"} />
-              <div className="absolute inset-y-0 right-0 pr-3 flex items-center pointer-events-none">
-                <svg className="h-5 w-5 text-red-500" fill="currentColor" viewBox="0 0 20 20">
-                  <path fillRule="evenodd" d="M18 10a8 8 0 11-16 0 8 8 0 0116 0zm-7 4a1 1 0 11-2 0 1 1 0 012 0zm-1-9a1 1 0 00-1 1v4a1 1 0 102 0V6a1 1 0 00-1-1z" clipRule="evenodd" />
-                </svg>
-              </div>
-            </div>
-          )}
-          <p className="mt-2 text-sm text-red-600" id={props.id+"-error"}>{props.error}</p>
-        </>
-      ) : (
-        <>
-          {props.prefix ? (
-            <div className="flex rounded-md shadow-sm">
-              <span className="inline-flex items-center px-3 rounded-l-md border border-r-0 border-gray-300 bg-gray-50 text-gray-500 sm:text-sm">
-                {props.prefix}
-              </span>
-              <input id={props.id} type={typ} className={`${extraCls} form-input flex-1 block w-full px-3 py-2 rounded-none rounded-r-md sm:text-sm sm:leading-5`}
-                  onChange={onChange} disabled={props.disabled} required={props.required} placeholder={props.placeholder} value={props.value} aria-describedby={props.desc ? `${props.id}-description` : ""} />
-            </div>
-          ) : (
-            <div className="relative rounded-md shadow-sm">
-              <input id={props.id} type={typ} className={`${extraCls} form-input block w-full sm:text-sm sm:leading-5`}
-                  onChange={onChange} disabled={props.disabled} required={props.required} placeholder={props.placeholder} value={props.value} aria-describedby={props.desc ? `${props.id}-description` : ""} />
-            </div>
-          )}
-
-          {props.desc ? (
-            <p className="mt-2 text-sm text-gray-500" id={props.id + "-description"}>{props.desc}</p>
-          ) : props.htmlDesc ? (
-            <p className="mt-2 text-sm text-gray-500" id={props.id + "-description"}
-                dangerouslySetInnerHTML={{ __html: props.htmlDesc}} />
-          ) : null}
-        </>
-      )}
-    </div>
-  )
-}
-
-export interface TextAreaProps {
-    id: string;
-    value: string;
-    onChange?: (value: string) => void;
-
-    rows?: number;
-    required?: boolean;
-    label?: string;
-    desc?: string;
-    htmlDesc?: string;
-    placeholder?: string;
-    error?: string;
-    cls?: string;
-    disabled?: boolean;
-}
-
-
-export const TextArea: FunctionComponent<TextAreaProps> = (props) => {
-  const onChange = (event: React.ChangeEvent<HTMLTextAreaElement>) => {
-    if (props.onChange) {
-      props.onChange(event.target.value)
-    }
-  }
-
-  const extraCls = props.disabled ? "bg-gray-100 text-gray-600" : ""
-
-  return (
-    <div className={props.cls}>
-      {props.label &&
-        <label htmlFor={props.id} className="block text-sm font-medium leading-5 text-gray-700 mb-1">{props.label}</label>
-      }
-
-      {props.error ? (
-        <>
-          <div className="relative rounded-md shadow-sm">
-            <textarea id={props.id} rows={props.rows} className={`${extraCls} form-textarea block w-full border-red-300 text-red-900 placeholder-red-300 focus:border-red-300 focus:shadow-outline-red sm:text-sm sm:leading-5`}
-                onChange={onChange} disabled={props.disabled} required={props.required} placeholder={props.placeholder} value={props.value} aria-invalid="true" aria-describedby={props.id+"-error"} />
-          </div>
-          <p className="mt-2 text-sm text-red-600" id={props.id+"-error"}>{props.error}</p>
-        </>
-      ) : (
-        <>
-          <div className="relative rounded-md shadow-sm">
-            <textarea id={props.id} rows={props.rows} className={`${extraCls} form-textarea block w-full sm:text-sm sm:leading-5`}
-                onChange={onChange} disabled={props.disabled} required={props.required} placeholder={props.placeholder} value={props.value} aria-describedby={props.desc ? `${props.id}-description` : ""} />
-          </div>
-
-          {props.desc ? (
-            <p className="mt-2 text-sm text-gray-500" id={props.id + "-description"}>{props.desc}</p>
-          ) : props.htmlDesc ? (
-            <p className="mt-2 text-sm text-gray-500" id={props.id + "-description"}
-                dangerouslySetInnerHTML={{ __html: props.htmlDesc}} />
-          ) : null}
-        </>
-      )}
-    </div>
-  )
-}
-
-interface RangeProps {
-  id?: string;
-  value: number;
-  min: number;
-  max: number;
-  onChange: (value: number, frac: number) => void;
-
-  minLabel?: string;
-  maxLabel?: string;
-  valueLabel?: string;
-  title?: string;
-}
-
-export const Range: FunctionComponent<RangeProps> = (props) => {
-  const filled = (((props.value - props.min) / (props.max - props.min)) * 100) + "%"
-  const slider = useRef<HTMLDivElement>(null)
-  const [dragging, setDragging] = useState(false)
-
-  const update = (event: {pageX: number}) => {
-    const rect = slider.current?.getBoundingClientRect()
-    if (rect) {
-      let frac = (event.pageX - rect.left) / rect.width
-      frac = Math.max(Math.min(frac, 1), 0)
-      const newValue = props.min + Math.round(frac * (props.max - props.min))
-      props.onChange(newValue, frac)
-    }
-  }
-
-  const onMouseUp = (event: MouseEvent) => {
-    if (event.button !== 0 || !dragging) {
-      return
-    }
-
-    const rect = slider.current?.getBoundingClientRect()
-    const x = event.pageX
-    const y = event.pageY
-    if (rect && rect.left <= x && x <= rect.right && rect.top <= y && y <= rect.bottom) {
-      update(event)
-    }
-
-    setDragging(false)
-    event.stopPropagation()
-    event.preventDefault()
-  }
-
-  const onMouseDown = (event: React.MouseEvent) => {
-    if (event.button !== 0) {
-      return
-    }
-    setDragging(true)
-    event.stopPropagation()
-    event.preventDefault()
-  }
-
-  const onClick = (event: React.MouseEvent) => {
-    if (event.button !== 0) {
-      return
-    }
-    update(event)
-    event.stopPropagation()
-    event.preventDefault()
-  }
-
-  useEffect(() => {
-    document.addEventListener("mouseup", onMouseUp)
-    return () => document.removeEventListener("mouseup", onMouseUp)
-  })
-
-  const onMouseMove = (event: React.MouseEvent) => {
-    if (dragging && props.onChange) {
-      const rect = slider.current?.getBoundingClientRect()
-      if (rect) {
-        let frac = (event.pageX - rect.left) / rect.width
-        frac = Math.max(Math.min(frac, 1), 0)
-        const newValue = props.min + Math.round(frac * (props.max - props.min))
-        props.onChange(newValue, frac)
-      }
-    }
-    event.stopPropagation()
-    event.preventDefault()
-  }
-
-  return (
-    <div className="flex justify-center h-8">
-      <div className="pt-1 pb-6 relative min-w-full">
-        <input type="hidden" id={props.id} value={props.value} />
-        <div className="group h-2 bg-gray-200 rounded-full cursor-pointer" ref={slider}
-          onMouseDown={onMouseDown} onMouseMove={onMouseMove} onClick={onClick}>
-          <div className="absolute h-2 rounded-full bg-teal-600 w-0" style={{ width: filled }}></div>
-
-          <div className="absolute h-4 flex items-center justify-center w-4 rounded-full bg-white shadow border border-gray-300 -ml-2 top-0 cursor-pointer select-none" style={{left: filled}}>
-            <div className="relative -mt-2 w-1">
-              <div className="invisible group-hover:visible absolute z-40 opacity-100 bottom-100 mb-2 left-0 min-w-full" style={{ marginLeft: "-20.5px" }}>
-                <div className="relative shadow-md">
-                  <div className="bg-black -mt-8 text-white truncate text-xs rounded py-1 px-4">{props.valueLabel ?? props.value}</div>
-                  <svg className="absolute text-black w-full h-2 left-0 top-100" x="0px" y="0px" viewBox="0 0 255 255" xmlSpace="preserve">
-                    <polygon className="fill-current" points="0,0 127.5,127.5 255,0"></polygon>
-                  </svg>
-                </div>
-              </div>
-            </div>
-          </div>
-          <div className="absolute text-gray-400 -ml-1 bottom-0 left-0 -mb-1">{props.minLabel ?? props.min}</div>
-          <div className="absolute text-gray-800 -ml-1 text-center inset-x-0 bottom-0 -mb-1">{props.valueLabel ?? props.value}</div>
-          <div className="absolute text-gray-400 -mr-1 bottom-0 right-0 -mb-1">{props.maxLabel ?? props.max}</div>
-        </div>
-      </div>
-    </div>
-  )
-}
-
-interface CounterProps {
-  id?: string;
-  label?: string;
-  min?: number;
-  max?: number;
-  value: number;
-  onChange: (val: number) => void;
-  increment?: (val: number) => number;
-  decrement?: (val: number) => number;
-}
-
-export const Counter: FunctionComponent<CounterProps> = (props) => {
-  const inc = props.increment ?? ((val: number) => val+1)
-  const dec = props.decrement ?? ((val: number) => val-1)
-  const update = (val: number) => {
-    if (props.max && val > props.max) {
-      val = props.max
-    }
-    if (props.min && val < props.min) {
-      val = props.min
-    }
-    props.onChange(val)
-  }
-
-  return (
-    <div>
-      <style>{`
-        input[type='number']::-webkit-inner-spin-button,
-        input[type='number']::-webkit-outer-spin-button {
-          -webkit-appearance: none;
-          margin: 0;
-        }
-        input:focus { outline: none !important; }
-        button:focus { outline: none !important; }
-      `}</style>
-      {props.label &&
-        <label htmlFor={props.id} className="w-full text-gray-700 text-sm font-medium">{props.label}</label>
-      }
-      <div className="flex flex-row h-10 w-full rounded-lg relative bg-transparent mt-1">
-        <button onClick={() => update(dec(props.value))} className="bg-gray-300 text-gray-600 hover:text-gray-700 hover:bg-gray-400 h-full w-20 rounded-l cursor-pointer outline-none">
-          <span className="m-auto text-2xl font-thin">−</span>
-        </button>
-        <input id={props.id} type="number" className="outline-none focus:outline-none text-center w-full bg-gray-300 font-semibold text-md hover:text-black focus:text-black md:text-basecursor-default flex items-center text-gray-700"
-            value={props.value} min={props.min} max={props.max} onChange={(e) => update(parseInt(e.target.value))}/>
-        <button onClick={() => update(inc(props.value))} className="bg-gray-300 text-gray-600 hover:text-gray-700 hover:bg-gray-400 h-full w-20 rounded-r cursor-pointer">
-          <span className="m-auto text-2xl font-thin">+</span>
-        </button>
-      </div>
-    </div>
-  )
-}
-
-export default Input
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/Modal.tsx b/cli/daemon/dash/dashapp/src/components/Modal.tsx
deleted file mode 100644
index 1efff435e8..0000000000
--- a/cli/daemon/dash/dashapp/src/components/Modal.tsx
+++ /dev/null
@@ -1,97 +0,0 @@
-import React from "react";
-import ReactDOM from "react-dom";
-import { Transition } from "@headlessui/react"
-
-interface Props {
-  show: boolean;
-  close?: () => void;
-  width?: string;
-}
-
-export class Modal extends React.Component<Props> {
-  el?: HTMLDivElement;
-  root?: HTMLElement;
-  bgRef: React.RefObject<HTMLDivElement>;
-
-  constructor(props: Props) {
-    super(props)
-    this.handleClick = this.handleClick.bind(this)
-    this.handleKeyPress = this.handleKeyPress.bind(this)
-    this.bgRef = React.createRef()
-  }
-
-  componentDidMount() {
-    this.el = document.createElement("div");
-    const root = document.getElementById("modal-root")
-    if (root === null) {
-      throw new Error("could not find #modal-root element")
-    }
-    this.root = root
-    this.root.appendChild(this.el);
-    window.addEventListener("keyup", this.handleKeyPress)
-  }
-
-  componentWillUnmount() {
-    window.removeEventListener("keypress", this.handleKeyPress)
-    if (this.root && this.el) {
-      this.root.removeChild(this.el)
-    }
-  }
-
-  handleClick(ev: React.MouseEvent) {
-    ev.stopPropagation()
-    if (ev.target === this.bgRef.current && this.props.close) {
-      this.props.close()
-    }
-  }
-
-  handleKeyPress(e: KeyboardEvent) {
-    if(e.key === "Escape" && this.props.close) {
-      this.props.close()
-    }
-  }
-
-  render() {
-    if (!this.el) {
-      return null
-    }
-    const width = this.props.width ?? "sm:max-w-lg sm:w-full"
-
-    return ReactDOM.createPortal(
-      (
-        <div className="fixed inset-0 pointer-events-none z-40">
-          <Transition
-              show={this.props.show}
-              appear={true}
-              enter="ease-linear duration-300"
-              enterFrom="opacity-0"
-              enterTo="opacity-100"
-              leave="ease-linear duration-300"
-              leaveFrom="opacity-100"
-              leaveTo="opacity-0"
-              className="transition-opacity">
-            <div className="fixed inset-0">
-              <div className="absolute inset-0 bg-gray-500 opacity-75 pointer-events-auto" onClick={this.handleClick} ref={this.bgRef}></div>
-            </div>
-          </Transition>
-
-          <Transition
-              show={this.props.show}
-              appear={true}
-              enter="ease-out duration-300"
-              enterFrom="opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95"
-              enterTo="opacity-100 translate-y-0 sm:scale-100"
-              leave="ease-in duration-200"
-              leaveFrom="opacity-100 translate-y-0 sm:scale-100"
-              leaveTo="opacity-0 translate-y-4 sm:translate-y-0 sm:scale-95"
-              className="transition-all transform fixed bottom-0 inset-x-0 px-4 pb-4 sm:inset-0 sm:flex sm:items-center sm:justify-center pointer-events-none">
-            <div className={`bg-white rounded-lg px-4 pt-5 pb-4 overflow-hidden shadow-xl ${width} sm:p-6 pointer-events-auto`}>
-              {this.props.children}
-            </div>
-          </Transition>
-        </div>
-      ),
-      this.el
-    );
-  }
-}
diff --git a/cli/daemon/dash/dashapp/src/components/Nav.tsx b/cli/daemon/dash/dashapp/src/components/Nav.tsx
deleted file mode 100644
index c7672537b0..0000000000
--- a/cli/daemon/dash/dashapp/src/components/Nav.tsx
+++ /dev/null
@@ -1,142 +0,0 @@
-import React, { FunctionComponent, useState, useEffect } from "react";
-import { Link, useParams, useRouteMatch } from "react-router-dom"
-import { useConn } from "~lib/ctx"
-import logo from "../logo.svg"
-
-const menuItems: {href: string; name: string}[] = [
-  {href: "", name: "Requests"},
-  {href: "/api", name: "API Docs"},
-]
-
-const Nav: FunctionComponent = (props) => {
-  const { appID } = useParams<{appID: string}>()
-  const [menuOpen, setMenuOpen] = useState(false)
-  const [appsOpen, setAppsOpen] = useState(false)
-  const route = useRouteMatch()
-
-  return (
-    <nav className="bg-gray-800">
-      {appsOpen &&
-        <div className="absolute inset-0 z-10" onClick={() => setAppsOpen(false)} />
-      }
-      <div className="max-w-7xl mx-auto px-4 sm:px-6 lg:px-8">
-        <div className="flex items-center justify-between h-16">
-          <div className="flex items-center">
-            <div className="flex-shrink-0">
-              <img className="h-8 w-8" src={logo} alt="Encore Logo" />
-            </div>
-            <div className="hidden md:block">
-              <div className="ml-10 flex items-baseline space-x-4">
-                {menuItems.map(it => {
-                  const as = `/${appID}${it.href}`
-                  const selected = route.path === ("/:appID"+it.href)
-                  return (
-                    <Link key={it.name} to={as}
-                        className={`px-3 py-2 rounded-md text-sm font-medium ${selected ? "text-white bg-gray-600" : "text-gray-300 hover:text-white hover:bg-gray-700"} focus:outline-none focus:text-white focus:bg-gray-700`}>
-                      {it.name}
-                    </Link>
-                  )
-                })}
-              </div>
-            </div>
-          </div>
-
-          <div className="absolute inset-y-0 right-0 hidden md:flex items-center pr-2 sm:static sm:inset-auto sm:ml-6 sm:pr-0">
-            {/* <-- App dropdown --> */}
-            <div className="ml-3">
-              <AppDropdown appID={appID} open={appsOpen} setOpen={setAppsOpen} />
-            </div>
-          </div>
-
-          <div className="-mr-2 flex md:hidden">
-            <button onClick={() => setMenuOpen(!menuOpen)} className="inline-flex items-center justify-center p-2 rounded-md text-gray-400 hover:text-white hover:bg-gray-700 focus:outline-none focus:bg-gray-700 focus:text-white">
-              <svg className={`${menuOpen ? "hidden" : "block"} h-6 w-6`} stroke="currentColor" fill="none" viewBox="0 0 24 24">
-                <path strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" d="M4 6h16M4 12h16M4 18h16" />
-              </svg>
-              <svg className={`${menuOpen ? "block" : "hidden"} h-6 w-6`} stroke="currentColor" fill="none" viewBox="0 0 24 24">
-                <path strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" d="M6 18L18 6M6 6l12 12" />
-              </svg>
-            </button>
-          </div>
-        </div>
-      </div>
-
-      <div className={`${menuOpen ? "block" : "hidden"} md:hidden`}>
-        <div className="px-2 pt-2 pb-3 space-y-1 sm:px-3">
-          {menuItems.map(it => {
-            const as = `/${appID}${it.href}`
-            const selected = false // TODO
-            return (
-              <Link key={it.name} to={as}
-                  className={`block px-3 py-2 rounded-md text-base font-medium ${selected ? "text-white bg-gray-900" : "text-gray-300 hover:text-white hover:bg-gray-700"} focus:outline-none focus:text-white focus:bg-gray-700`}>
-                {it.name}
-              </Link>
-            )
-          })}
-        </div>
-        
-      </div>
-    </nav>
-  )
-}
-
-export default Nav
-
-interface AppDropdownProps {
-  appID: string;
-  open: boolean;
-  setOpen: (open: boolean) => void;
-}
-
-const AppDropdown: FunctionComponent<AppDropdownProps> = (props): JSX.Element => {
-  interface app {
-    id: string;
-    name: string;
-  }
-  const [apps, setApps] = useState<app[] | undefined>(undefined)
-  const appName = apps?.find(a => a.id === props.appID)?.name
-  const conn = useConn()
-
-  useEffect(() => {
-    conn.request("list-apps").then(apps => setApps(apps as app[]))
-  }, [props.open])
-  
-  return (
-    <>
-      <div className="relative inline-block text-left">
-        <div>
-          <button type="button" className="inline-flex justify-center text-sm leading-5 font-medium text-gray-300 hover:text-white focus:outline-none active:text-white transition ease-in-out duration-150"
-              id="app-menu" aria-haspopup="true" aria-expanded="true" onClick={() => props.setOpen(!props.open)}>
-            {appName ?? "Loading..."}
-            <svg className="h-5 w-5 -mr-1 ml-2" fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-              <path d="M8 9l4-4 4 4m0 6l-4 4-4-4" />
-            </svg>
-          </button>
-        </div>
-
-        {props.open &&
-          <div className="origin-top-right absolute right-0 mt-2 w-56 rounded-md shadow-lg z-20">
-            <div className="rounded-md bg-white shadow-xs" role="menu" aria-orientation="vertical" aria-labelledby="app-menu">
-              <div className="py-1">
-                {apps !== undefined ? (
-                  <>
-                    <div className="font-bold px-2 py-1 text-xs text-gray-600">Running Apps</div>
-                    {apps.map(app =>
-                      <Link key={app.id} to={"/"+app.id}
-                        className="block px-4 py-2 text-sm text-gray-700 hover:bg-gray-100 hover:text-gray-900 focus:outline-none focus:bg-gray-100 focus:text-gray-900" role="menuitem"
-                            onClick={(e) => props.setOpen(false)}>
-                          <div className="truncate leading-4">{app.name}</div>
-                      </Link>
-                    )}
-                  </>
-                ) : (
-                  <span>Loading...</span>
-                )}
-              </div>
-            </div>
-          </div>
-        }
-      </div>
-    </>
-  )
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/api/RPCCaller.tsx b/cli/daemon/dash/dashapp/src/components/api/RPCCaller.tsx
deleted file mode 100644
index 01a5c59031..0000000000
--- a/cli/daemon/dash/dashapp/src/components/api/RPCCaller.tsx
+++ /dev/null
@@ -1,352 +0,0 @@
-import { Menu, Transition } from "@headlessui/react";
-import CodeMirror, { EditorConfiguration } from "codemirror";
-import React, { FC } from "react";
-import * as icons from "~c/icons";
-import Input from "~c/Input";
-import { decodeBase64, encodeBase64 } from "~lib/base64";
-import JSONRPCConn from "~lib/client/jsonrpc";
-import { copyToClipboard } from "~lib/clipboard";
-import { APIMeta, RPC, Service } from "./api";
-import CM from "./cm/CM";
-import { BuiltinType, Decl, ListType, MapType, NamedType, StructType, Type } from "./schema";
-
-interface Props {
-  conn: JSONRPCConn;
-  appID: string;
-  md: APIMeta;
-  svc: Service;
-  rpc: RPC;
-  port?: number;
-}
-
-interface State {
-  loading: boolean;
-  response?: string;
-  respErr?: string;
-  authToken: string;
-}
-
-export const cfg: EditorConfiguration = {
-  theme: "encore",
-  mode: "json",
-  lineNumbers: false,
-  lineWrapping: false,
-  indentWithTabs: true,
-  indentUnit: 4,
-  tabSize: 4,
-  autoCloseBrackets: true,
-  matchBrackets: true,
-  styleActiveLine: false,
-}
-
-export default class RPCCaller extends React.Component<Props, State> {
-  cm: React.RefObject<CM>;
-  docs: Map<RPC, CodeMirror.Doc>;
-
-  constructor(props: Props) {
-    super(props)
-    this.cm = React.createRef()
-    this.docs = new Map()
-    this.state = {loading: false, authToken: ""}
-  }
-
-  componentDidMount() {
-    this.open(this.props.rpc)
-  }
-
-  componentDidUpdate(prevProps: Props) {
-    if (prevProps.svc.name !== this.props.svc.name || prevProps.rpc.name !== this.props.rpc.name) {
-      this.open(this.props.rpc)
-    }
-  }
-
-  private open(rpc: RPC) {
-    if (rpc.request_schema) {
-      let doc = this.docs.get(rpc)
-      if (doc === undefined) {
-        const js = new JSONRenderer(this.props.md).render(rpc.request_schema!)
-        doc = new CodeMirror.Doc(js, {
-          name: "javascript",
-          json: true
-        })
-        this.docs.set(rpc, doc)
-      }
-      this.cm.current?.open(doc)
-    }
-    this.setState({response: undefined, respErr: undefined})
-  }
-
-  async send() {
-    const rpc = this.props.rpc
-    let reqBody = ""
-    if (rpc.request_schema) {
-      const doc = this.docs.get(rpc)
-      if (doc === undefined) {
-        return
-      }
-      reqBody = doc.getValue()
-    }
-
-    const payload = encodeBase64(reqBody)
-    const authToken = this.state.authToken
-    const endpoint = `${this.props.svc.name}.${rpc.name}`
-    try {
-      this.setState({loading: true})
-      const resp = await this.props.conn.request("api-call", {
-        appID: this.props.appID,
-        endpoint,
-        payload,
-        authToken,
-      }) as any
-
-      let respBody = ""
-      if (resp.body.length > 0) {
-        respBody = decodeBase64(resp.body)
-      }
-      if (resp.status_code !== 200) {
-        this.setState({response: undefined, respErr: `HTTP ${resp.status}: ${respBody}`})
-      } else if (rpc.response_schema) {
-        this.setState({response: respBody, respErr: undefined})
-      } else {
-        this.setState({response: "Request completed successfully.", respErr: undefined})
-      }
-    } catch(err) {
-      this.setState({response: undefined, respErr: `Internal Error: ${err}`})
-    } finally {
-      this.setState({loading: false})
-    }
-  }
-
-  copyCurl() {
-    let reqBody = ""
-    const rpc = this.props.rpc
-    if (rpc.request_schema) {
-      const doc = this.docs.get(rpc)
-      if (doc === undefined) {
-        return
-      }
-      reqBody = doc.getValue()
-      // Convert to JSON and back, if possible, to simplify indentation
-      try {
-        reqBody = JSON.stringify(JSON.parse(reqBody), undefined, " ")
-      } catch(err) { /* do nothing */ }
-
-      reqBody = reqBody.replaceAll("'", "'\''")
-    }
-
-    let cmd = `curl http://localhost:${this.props.port ?? 4060}/${this.props.svc.name}.${this.props.rpc.name}`
-    if (reqBody !== "") {
-      cmd += ` -d '${reqBody}'`
-    }
-    copyToClipboard(cmd)
-  }
-
-  render() {
-    const rpc = this.props.rpc
-    return (
-      <div>
-        <h4 className="text-base text-bold">
-          Request
-        </h4>
-        <div className={`text-xs mt-1 rounded border border-gray-200 ${rpc.request_schema ? "block" : "hidden"}`}>
-          <CM ref={this.cm} cfg={cfg} />
-        </div>
-        <div className={`text-xs mt-1 ${rpc.request_schema ? "hidden" : "block"}`}>
-          This API takes no request data.
-        </div>
-        <div className="flex items-center mt-1">
-          {this.props.md.auth_handler && 
-            <div className="flex-1 min-w-0 mr-1 relative rounded-md shadow-sm">
-              <Input id="" cls="w-full" placeholder="Auth Token" required={rpc.access_type === "AUTH"} 
-                value={this.state.authToken} onChange={(authToken) => this.setState({authToken})} />
-            </div>
-          }
-          <APICallButton send={() => this.send()} copyCurl={() => this.copyCurl()} />
-          
-        </div>
-
-        <h4 className="mt-4 mb-1 text-base text-bold flex items-center">
-          Response {this.state.loading && icons.loading("ml-1 h-5 w-5", "#A081D9", "transparent", 4)}
-        </h4>
-        {this.state.response ? (
-          <pre className="text-xs shadow-inner rounded border border-gray-300 bg-gray-200 p-2 overflow-x-auto">
-            {this.state.response}
-          </pre>
-        ) : this.state.respErr ? (
-          <div className="text-xs text-red-600 font-mono">
-            {this.state.respErr}
-          </div>
-        ) : <div className="text-xs text-gray-400">Make a request to see the response.</div>}
-      </div>
-    )
-  }
-}
-
-class JSONRenderer {
-  buf: string[];
-  level: number;
-  md: APIMeta;
-  seenDecls: Set<number>;
-
-  constructor(md: APIMeta) {
-    this.buf = []
-    this.level = 0
-    this.md = md
-    this.seenDecls = new Set()
-  }
-
-  render(d: Decl): string {
-    this.writeType(d.type)
-    return this.buf.join("")
-  }
-
-  private writeType(t: Type) {
-    t.struct ? this.renderStruct(t.struct) :
-    t.map ? this.renderMap(t.map) :
-    t.list ? this.renderList(t.list) :
-    t.builtin ? this.write(this.renderBuiltin(t.builtin)) :
-    t.named ? this.renderNamed(t.named)
-    : this.write("<unknown type>")
-  }
-
-  private renderNamed(t: NamedType) {
-    if (this.seenDecls.has(t.id)) {
-      this.write("null")
-      return
-    }
-    
-    // Add the decl to our map while recursing to avoid infinite recursion.
-    this.seenDecls.add(t.id)
-    const decl = this.md.decls[t.id]
-    this.writeType(decl.type)
-    this.seenDecls.delete(t.id)
-  }
-
-  private renderStruct(t: StructType) {
-    this.writeln("{")
-    this.level++
-    for (let i = 0; i < t.fields.length; i++) {
-      const f = t.fields[i]
-      this.indent()
-      this.write(`"${f.json_name !== "" ? f.json_name : f.name}": `)
-      this.writeType(f.typ)
-      if (i < (t.fields.length-1)) {
-        this.write(",")
-      }
-      this.writeln()
-    }
-    this.level--
-    this.indent()
-    this.write("}")
-  }
-
-  private renderMap(t: MapType) {
-    this.writeln("{")
-    this.level++
-    this.indent()
-    this.writeType(t.key)
-    this.write(": ")
-    this.writeType(t.value)
-    this.writeln()
-    this.write("}")
-  }
-
-  private renderList(t: ListType) {
-    this.write("[")
-    this.writeType(t.elem)
-    this.write("]")
-  }
-
-  private renderBuiltin(t: BuiltinType) {
-    switch (t) {
-    case BuiltinType.Any: return "<any>"
-    case BuiltinType.Bool: return "true"
-    case BuiltinType.Int8: return "1"
-    case BuiltinType.Int16: return "1"
-    case BuiltinType.Int32: return "1"
-    case BuiltinType.Int64: return "1"
-    case BuiltinType.Uint8: return "1"
-    case BuiltinType.Uint16: return "1"
-    case BuiltinType.Uint32: return "1"
-    case BuiltinType.Uint64: return "1"
-    case BuiltinType.Float32: return "2.3"
-    case BuiltinType.Float64: return "fl2.3"
-    case BuiltinType.String: return "\"some string\""
-    case BuiltinType.Bytes: return "\"base64-encoded-bytes\""
-    case BuiltinType.Time: return "\"2009-11-10T23:00:00Z\""
-    case BuiltinType.UUID: return "\"7d42f515-3517-4e76-be13-30880443546f\""
-    case BuiltinType.JSON: return "{\"some json data\": true}"
-    default: return "<unknown>"
-    }
-  }
-
-  private indent() {
-    this.write(" ".repeat(this.level*4))
-  }
-
-  private write(...strs: string[]) {
-    for (const s of strs) {
-      this.buf.push(s)
-    }
-  }
-
-  private writeln(...strs: string[]) {
-    this.write(...strs)
-    this.write("\n")
-  }
-}
-
-const APICallButton: FC<{send: () => void; copyCurl: () => void;}> = (props) => {
-  return (
-    <span className="ml-auto flex-none relative z-0 inline-flex shadow-sm rounded-md">
-      <button type="button" className="relative inline-flex items-center px-4 py-2 rounded-l-md border border-purple-700 bg-purple-600 text-sm font-medium text-white hover:bg-purple-500 focus:z-10 focus:outline-none focus:ring-0 focus:border-purple-500"
-        onClick={() => props.send()}>
-        Call API
-      </button>
-      <span className="-ml-px relative block z-10">
-        <Menu>
-          {({ open }) => (
-            <>
-              <Menu.Button className="relative inline-flex items-center px-2 py-2 rounded-r-md border border-purple-700 bg-purple-600 text-sm font-medium text-white hover:bg-purple-500 focus:z-10 focus:outline-none focus:ring-0">
-                <span className="sr-only">Open options</span>
-                {icons.chevronDown("h-5 w-5")}
-              </Menu.Button>
-
-              <Transition
-                show={open}
-                enter="transition ease-out duration-100"
-                enterFrom="transform opacity-0 scale-95"
-                enterTo="transform opacity-100 scale-100"
-                leave="transition ease-in duration-75"
-                leaveFrom="transform opacity-100 scale-100"
-                leaveTo="transform opacity-0 scale-95"
-              >
-                <Menu.Items
-                  static
-                  className="absolute right-0 w-56 mt-2 origin-top-right bg-white border border-gray-200 divide-y divide-gray-100 rounded-md shadow-lg outline-none"
-                >
-                  <div className="py-1">
-                    <Menu.Item>
-                      {({ active }) => (
-                        <button
-                          className={`${
-                            active
-                              ? "bg-gray-100 text-gray-900"
-                              : "text-gray-700"
-                          } flex justify-between w-full px-4 py-2 text-sm leading-5 text-left`}
-                          onClick={() => props.copyCurl()}
-                        >
-                          Copy as curl
-                        </button>
-                      )}
-                    </Menu.Item>
-                  </div>
-                </Menu.Items>
-              </Transition>
-            </>
-          )}
-        </Menu>
-      </span>
-    </span>
-  )
-}
diff --git a/cli/daemon/dash/dashapp/src/components/api/SchemaView.tsx b/cli/daemon/dash/dashapp/src/components/api/SchemaView.tsx
deleted file mode 100644
index 7cf619b6dd..0000000000
--- a/cli/daemon/dash/dashapp/src/components/api/SchemaView.tsx
+++ /dev/null
@@ -1,403 +0,0 @@
-import { Type, StructType, MapType, ListType, BuiltinType, Decl, NamedType, Field } from "./schema";
-import React from "react";
-import { APIMeta } from "./api";
-
-export type Dialect = "go" | "typescript" | "json" | "table";
-
-interface Props {
-  meta: APIMeta;
-  decl: Decl;
-  dialect: Dialect;
-}
-
-export default class extends React.Component<Props> {
-  render() {
-    const d = dialects[this.props.dialect](this.props.meta)
-    return d.render(this.props.decl)
-  }
-}
-
-abstract class DialectIface {
-  meta: APIMeta;
-  constructor(meta: APIMeta) {
-    this.meta = meta
-  }
-
-  abstract render(d: Decl): JSX.Element;
-}
-
-class GoDialect extends DialectIface {
-  seenDecls: Set<number>;
-  constructor(meta: APIMeta) {
-    super(meta)
-    this.seenDecls = new Set()
-  }
-
-  render(d: Decl) {
-    this.seenDecls.add(d.id)
-    const res = <>type {d.name} {this.renderType(d.type, 0)}</>
-    this.seenDecls.delete(d.id)
-    return res
-  }
-
-  renderType(t: Type, level: number) {
-    return <span className="whitespace-no-wrap">{(
-      t.struct ? this.renderStruct(t.struct, level) :
-      t.map ? this.renderMap(t.map, level) :
-      t.list ? this.renderList(t.list, level) :
-      t.builtin ? this.renderBuiltin(t.builtin, level) :
-      t.named ? this.renderNamed(t.named, level)
-      : "<unknown>"
-    )}</span>
-  }
-
-  renderNamed(t: NamedType, level: number) {
-    const decl = this.meta.decls[t.id]
-    if (this.seenDecls.has(t.id)) {
-      return <>{`*${decl.loc.pkg_name}.${decl.name}`}</>
-    }
-
-    // Mark this decl as seen for the duration of this call
-    // to avoid infinite recursion.
-    this.seenDecls.add(t.id)
-    const res = this.renderType(decl.type, level)
-    this.seenDecls.delete(t.id)
-    return res
-  }
-
-  renderStruct(t: StructType, level: number) {
-    return <>
-      {"struct {"}
-      <div style={{paddingLeft: "4ch"}}>
-        {t.fields.map(f =>
-          <div key={f.name}>
-            {f.name} {this.renderType(f.typ, level+1)}
-            {this.renderTag(f)}
-          </div>
-        )}
-      </div>
-      <div>{"}"}</div>
-    </>
-  }
-
-  renderMap(t: MapType, level: number) {
-    return <>
-      {"map["}
-      {this.renderType(t.key, level)}
-      {"]"}
-      {this.renderType(t.value, level)}
-    </>
-  }
-
-  renderList(t: ListType, level: number) {
-    return <>
-      {"[]"}
-      {this.renderType(t.elem, level)}
-    </>
-  }
-
-  renderBuiltin(t: BuiltinType, level: number) {
-    switch (t) {
-    case BuiltinType.Any: return "interface{}"
-    case BuiltinType.Bool: return "bool"
-    case BuiltinType.Int8: return "int8"
-    case BuiltinType.Int16: return "int16"
-    case BuiltinType.Int32: return "int32"
-    case BuiltinType.Int64: return "int64"
-    case BuiltinType.Uint8: return "uint8"
-    case BuiltinType.Uint16: return "uint16"
-    case BuiltinType.Uint32: return "uint32"
-    case BuiltinType.Uint64: return "uint64"
-    case BuiltinType.Float32: return "float32"
-    case BuiltinType.Float64: return "float64"
-    case BuiltinType.String: return "string"
-    case BuiltinType.Bytes: return "[]byte"
-    case BuiltinType.Time: return "time.Time"
-    case BuiltinType.UUID: return "uuid.UUID"
-    case BuiltinType.USER_ID: return "auth.UID"
-    case BuiltinType.JSON: return "json.RawMessage"
-    default: return "unknown"
-    }
-  }
-
-  renderTag(f: Field): string | null {
-    let parts = []
-    if (f.optional) {
-      parts.push(`encore:"optional"`)
-    }
-    if (f.json_name !== "") {
-      parts.push(`json:"${f.json_name}"`)
-    }
-    if (parts.length === 0) {
-      return null
-    }
-    return " `" + parts.join(" ") + "`"
-  }
-}
-
-class TypescriptDialect extends DialectIface {
-  seenDecls: Set<number>;
-  constructor(meta: APIMeta) {
-    super(meta)
-    this.seenDecls = new Set()
-  }
-
-  render(d: Decl) {
-    return this.renderType(d.type, 0)
-  }
-
-  renderType(t: Type, level: number) {
-    return <span className="whitespace-no-wrap">{(
-      t.struct ? this.renderStruct(t.struct, level) :
-      t.map ? this.renderMap(t.map, level) :
-      t.list ? this.renderList(t.list, level) :
-      t.builtin ? this.renderBuiltin(t.builtin, level) :
-      t.named ? this.renderNamed(t.named, level)
-      : "<unknown>"
-    )}</span>
-  }
-
-  renderNamed(t: NamedType, level: number) {
-    if (this.seenDecls.has(t.id)) {
-      return <>null</>
-    }
-    const decl = this.meta.decls[t.id]
-
-    // Mark this decl as seen for the duration of this call
-    // to avoid infinite recursion.
-    this.seenDecls.add(t.id)
-    const res = this.renderType(decl.type, level)
-    this.seenDecls.delete(t.id)
-    return res
-  }
-
-  renderStruct(t: StructType, level: number) {
-    return <>
-      {"{"}
-      <div style={{paddingLeft: "2ch"}}>
-        {t.fields.map(f =>
-          <div key={f.name}>{f.json_name !== "" ? f.json_name : f.name}: {this.renderType(f.typ, level+1)};</div>
-        )}
-      </div>
-      {"}"}
-    </>
-  }
-
-  renderMap(t: MapType, level: number) {
-    return <>
-      {"{ [key: "}
-      {this.renderType(t.key, level)}
-      {"]: "}
-      {this.renderType(t.value, level)}
-      {"}"}
-    </>
-  }
-
-  renderList(t: ListType, level: number) {
-    return <>
-      {this.renderType(t.elem, level)}
-      {"[]"}
-    </>
-  }
-
-  renderBuiltin(t: BuiltinType, level: number) {
-    switch (t) {
-    case BuiltinType.Any: return "any"
-    case BuiltinType.Bool: return "boolean"
-    case BuiltinType.Int8: return "int8"
-    case BuiltinType.Int16: return "int16"
-    case BuiltinType.Int32: return "int32"
-    case BuiltinType.Int64: return "int64"
-    case BuiltinType.Uint8: return "uint8"
-    case BuiltinType.Uint16: return "uint16"
-    case BuiltinType.Uint32: return "uint32"
-    case BuiltinType.Uint64: return "uint64"
-    case BuiltinType.Float32: return "float32"
-    case BuiltinType.Float64: return "float64"
-    case BuiltinType.String: return "string"
-    case BuiltinType.Bytes: return "[]byte"
-    case BuiltinType.Time: return "Time"
-    case BuiltinType.UUID: return "UUID"
-    case BuiltinType.JSON: return "any"
-    case BuiltinType.USER_ID: return "UserID"
-    default: return "unknown"
-    }
-  }
-}
-
-class JSONDialect extends DialectIface {
-  seenDecls: Set<number>;
-  constructor(meta: APIMeta) {
-    super(meta)
-    this.seenDecls = new Set()
-  }
-
-  render(d: Decl) {
-    return this.renderType(d.type, 0)
-  }
-
-  renderType(t: Type, level: number) {
-    return <span className="whitespace-no-wrap">{(
-      t.struct ? this.renderStruct(t.struct, level) :
-      t.map ? this.renderMap(t.map, level) :
-      t.list ? this.renderList(t.list, level) :
-      t.builtin ? this.renderBuiltin(t.builtin, level) :
-      t.named ? this.renderNamed(t.named, level)
-      : "<unknown>"
-    )}</span>
-  }
-
-  renderNamed(t: NamedType, level: number) {
-    if (this.seenDecls.has(t.id)) {
-      return <>null</>
-    }
-    const decl = this.meta.decls[t.id]
-
-    // Mark this decl as seen for the duration of this call
-    // to avoid infinite recursion.
-    this.seenDecls.add(t.id)
-    const res = this.renderType(decl.type, level)
-    this.seenDecls.delete(t.id)
-    return res
-  }
-
-  renderStruct(t: StructType, level: number) {
-    return <>
-      {"{"}
-      <div style={{paddingLeft: "2ch"}}>
-        {t.fields.map((f, i) =>
-          <div key={f.name}>
-            "{f.json_name !== "" ? f.json_name : f.name}": {this.renderType(f.typ, level+1)}
-            {
-              /* Render trailing comma if it's not the last key */
-              (i < (t.fields.length-1)) ? "," : ""
-            }
-          </div>
-        )}
-      </div>
-      {"}"}
-    </>
-  }
-
-  renderMap(t: MapType, level: number) {
-    return <>
-      {"{"}
-      {this.renderType(t.key, level)}
-      {": "}
-      {this.renderType(t.value, level)}
-      {"}"}
-    </>
-  }
-
-  renderList(t: ListType, level: number) {
-    return <>
-      {"["}
-      {this.renderType(t.elem, level)}
-      {"]"}
-    </>
-  }
-
-  renderBuiltin(t: BuiltinType, level: number) {
-    switch (t) {
-    case BuiltinType.Any: return "<any>"
-    case BuiltinType.Bool: return "true"
-    case BuiltinType.Int8: return "1"
-    case BuiltinType.Int16: return "1"
-    case BuiltinType.Int32: return "1"
-    case BuiltinType.Int64: return "1"
-    case BuiltinType.Uint8: return "1"
-    case BuiltinType.Uint16: return "1"
-    case BuiltinType.Uint32: return "1"
-    case BuiltinType.Uint64: return "1"
-    case BuiltinType.Float32: return "2.3"
-    case BuiltinType.Float64: return "fl2.3"
-    case BuiltinType.String: return "\"some-string\""
-    case BuiltinType.Bytes: return "\"base64-encoded-bytes\""
-    case BuiltinType.Time: return "\"2009-11-10T23:00:00Z\""
-    case BuiltinType.UUID: return "\"7d42f515-3517-4e76-be13-30880443546f\""
-    case BuiltinType.JSON: return "{\"some-json-data\": true}"
-    case BuiltinType.USER_ID: return "\"some-user-id\""
-    default: return "<unknown>"
-    }
-  }
-}
-
-class TableDialect extends DialectIface {
-  render(d: Decl) {
-    const st = d.type.struct
-    if (!st) {
-      throw new Error("TableDialect can only render named structs")
-    }
-    return this.renderStruct(st, 0)
-  }
-
-  renderStruct(t: StructType, level: number): JSX.Element {
-    return (
-      <div className={level !== 0 ? "rounded-sm border-gray-200" : ""}>
-          {t.fields.map((f, i) =>
-            <div key={f.name} className={i > 0 ? "border-t border-gray-200" : ""}>
-              <div className="flex leading-6 font-mono">
-                <div className="font-bold text-gray-900 text-sm">
-                  {f.name}
-                </div>
-                <div className="ml-2 text-xs text-gray-500">{this.describeType(f.typ)}</div>
-              </div>
-              {f.doc !== "" ? (
-                <div className="text-sm text-gray-700">{f.doc}</div>
-              ) : (
-                <div className="text-xs text-gray-400">No description.</div>
-              )}
-            </div>
-          )}
-      </div>
-    )
-  }
-
-  describeType(t: Type): string {
-    return (
-      t.struct ? "struct" :
-      t.map ? "map" :
-      t.list ? "list of " + this.describeType(t.list.elem) :
-      t.builtin ? this.describeBuiltin(t.builtin) :
-      t.named ? this.describeNamed(t.named)
-      : "<unknown>"
-    )
-  }
-
-
-  describeBuiltin(t: BuiltinType): string {
-    switch (t) {
-    case BuiltinType.Any: return "<any>"
-    case BuiltinType.Bool: return "boolean"
-    case BuiltinType.Int8: return "int"
-    case BuiltinType.Int16: return "int"
-    case BuiltinType.Int32: return "int"
-    case BuiltinType.Int64: return "int"
-    case BuiltinType.Uint8: return "uint"
-    case BuiltinType.Uint16: return "uint"
-    case BuiltinType.Uint32: return "uint"
-    case BuiltinType.Uint64: return "uint"
-    case BuiltinType.Float32: return "float"
-    case BuiltinType.Float64: return "float"
-    case BuiltinType.String: return "string"
-    case BuiltinType.Bytes: return "bytes"
-    case BuiltinType.Time: return "RFC 3339-formatted timestamp"
-    case BuiltinType.UUID: return "UUID"
-    case BuiltinType.JSON: return "unspecified JSON"
-    case BuiltinType.USER_ID: return "User ID"
-    default: return "<unknown>"
-    }
-  }
-
-  describeNamed(named: NamedType): string {
-    const decl = this.meta.decls[named.id]
-    return decl.loc.pkg_name + "." + decl.name
-  }
-}
-
-const dialects: { [key in Dialect]: (meta: APIMeta) => DialectIface} = {
-  "go": (meta) => new GoDialect(meta),
-  "typescript": (meta) => new TypescriptDialect(meta),
-  "json": (meta) => new JSONDialect(meta),
-  "table": (meta) => new TableDialect(meta),
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/api/api.ts b/cli/daemon/dash/dashapp/src/components/api/api.ts
deleted file mode 100644
index 12767ffddd..0000000000
--- a/cli/daemon/dash/dashapp/src/components/api/api.ts
+++ /dev/null
@@ -1,56 +0,0 @@
-import { Decl, Loc } from "./schema";
-
-export interface APIMeta {
-  module_path: string;
-  pkgs: Package[];
-  svcs: Service[];
-  version: string;
-  decls: Decl[];
-  auth_handler: AuthHandler;
-}
-
-export interface Service {
-  name: string;
-  rel_path: string;
-  rpcs: RPC[];
-  migrations: DBMigration[];
-}
-
-export interface Package {
-  rel_path: string;
-  name: string;
-  doc: string;
-  svc: string; // can be empty
-  secrets: string[];
-  rpc_calls: QualifiedName[];
-}
-
-export interface RPC {
-  name: string;
-  doc: string;
-  access_type: "PRIVATE" | "PUBLIC" | "AUTH";
-  rpc_calls: QualifiedName[];
-  request_schema?: Decl;
-  response_schema?: Decl;
-  proto: "REGULAR" | "RAW";
-  loc: Loc;
-}
-
-export interface QualifiedName {
-  pkg: string;
-  name: string;
-}
-
-export interface DBMigration {
-  filename: string;
-  number: number;
-  description: string;
-  up: boolean;
-}
-
-export interface AuthHandler {
-  name: string;
-  doc: string;
-  user_data?: Decl;
-  loc: Loc;
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/api/cm/CM.tsx b/cli/daemon/dash/dashapp/src/components/api/cm/CM.tsx
deleted file mode 100644
index a478a910e4..0000000000
--- a/cli/daemon/dash/dashapp/src/components/api/cm/CM.tsx
+++ /dev/null
@@ -1,84 +0,0 @@
-import React from 'react'
-
-import CodeMirror, { EditorConfiguration } from 'codemirror';
-import './codemirror.css';
-import './codemirror-show-hint.css';
-import './codemirror-encore.css';
-import './codemirror-idea.css';
-import 'codemirror/mode/go/go.js';
-import 'codemirror/mode/sql/sql.js';
-import 'codemirror/mode/javascript/javascript.js';
-import 'codemirror/addon/edit/closebrackets.js';
-import 'codemirror/addon/edit/matchbrackets.js';
-import 'codemirror/addon/selection/active-line.js';
-
-import 'codemirror/addon/hint/show-hint.js';
-
-export interface TextEdit {
-  newText: string;
-  range: {
-    start: {line: number, character: number};
-    end: {line: number, character: number};
-  };
-}
-
-export const DefaultCfg: EditorConfiguration = {
-  theme: "encore",
-  mode: "go",
-  lineNumbers: true,
-  lineWrapping: false,
-  indentWithTabs: true,
-  indentUnit: 4,
-  tabSize: 4,
-  autoCloseBrackets: true,
-  matchBrackets: true,
-  styleActiveLine: false,
-  gutters: ['CodeMirror-linenumbers'],
-}
-
-interface Props {
-  cfg?: EditorConfiguration
-  className?: string;
-  onFocus?: () => void;
-}
-
-export default class CM extends React.Component<Props> {
-  container: React.RefObject<HTMLDivElement>
-  target: React.RefObject<HTMLDivElement>
-  cm?: CodeMirror.Editor;
-
-  constructor(props: Props) {
-    super(props)
-    this.container = React.createRef()
-    this.target = React.createRef()
-  }
-
-  componentDidMount() {
-    this.cm = CodeMirror(this.target.current!, this.props.cfg ?? DefaultCfg)
-    this.cm.on("focus", () => this.props.onFocus?.())
-  }
-  
-  shouldComponentUpdate(): boolean {
-    return false
-  }
-
-  open(doc: CodeMirror.Doc) {
-    this.cm!.swapDoc(doc)
-  }
-
-  render() {
-    return (
-      <div ref={this.container}
-          className={`relative h-full font-mono subpixel-antialiased shadow-inner ${this.props.className}`}>
-        <style>{`
-          .CodeMirror {
-            height: 100%;
-            font-family: inherit;
-            overflow: scroll;
-          }
-        `}</style>
-        <div className="h-full" ref={this.target} />
-      </div>
-    )
-  }
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-encore.css b/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-encore.css
deleted file mode 100644
index 8fe54da470..0000000000
--- a/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-encore.css
+++ /dev/null
@@ -1,150 +0,0 @@
-.cm-s-encore {
-  --color-bg: #2d3748;
-  --color-green: #b5f4a5;
-  --color-yellow: #ffe484;
-  --color-purple: #d9a9ff;
-  --color-red: #ff8383;
-  --color-blue: #93ddfd;
-  --color-white: #fff;
-  --color-selection: #5F87B5;
-
-  color: var(--color-white);
-  border-radius: 0.25rem;
-}
-
-.cm-s-encore.CodeMirror {
-  background-color: var(--color-bg);
-}
-
-.cm-s-encore .CodeMirror-gutters {
-  background-color: var(--color-bg);
-  border-right: 0;
-}
-
-.cm-s-encore .CodeMirror-linenumber {
-  color: #718096;
-  padding: 0 5px;
-}
-.cm-s-encore .CodeMirror-guttermarker-subtle { color: #586e75; }
-.cm-s-encore .CodeMirror-guttermarker { color: #ddd; }
-
-.cm-s-encore .CodeMirror-activeline-background {
-  background: rgba(255, 255, 255, 0.06);
-}
-
-.cm-s-encore .CodeMirror-cursor {
-  border-left: 1px solid #e2e8f0;
-  color: #718096;
-}
-
-.cm-s-encore div.CodeMirror-selected { background: var(--color-selection); }
-.cm-s-encore .CodeMirror-line::selection, .cm-s-encore .CodeMirror-line > span::selection, .cm-s-encore .CodeMirror-line > span > span::selection { background: var(--color-selection); }
-.cm-s-encore .CodeMirror-line::-moz-selection, .cm-s-encore .CodeMirror-line > span::-moz-selection, .cm-s-encore .CodeMirror-line > span > span::-moz-selection { background: var(--color-selection); }
-
-.cm-s-encore .cm-header { color: #586e75; }
-.cm-s-encore .cm-quote { color: #93a1a1; }
-.cm-s-encore .cm-keyword { color: var(--color-blue); }
-.cm-s-encore .cm-atom { color: var(--color-purple); }
-.cm-s-encore .cm-number { color: var(--color-yellow); }
-.cm-s-encore .cm-def { color: var(--color-white); }
-.cm-s-encore .cm-variable { color: var(--color-white); }
-.cm-s-encore .cm-variable-2 { color: #b58900; }
-.cm-s-encore .cm-variable-3, .cm-s-solarized .cm-type { color: #6c71c4; }
-.cm-s-encore .cm-property { color: var(--color-purple); }
-.cm-s-encore .cm-operator { color: var(--color-blue); }
-.cm-s-encore .cm-comment { color: var(--color-green); }
-.cm-s-encore .cm-string { color: var(--color-green); }
-.cm-s-encore .cm-string-2 { color: #b58900; }
-.cm-s-encore .cm-meta { color: #859900; }
-.cm-s-encore .cm-qualifier { color: #b58900; }
-.cm-s-encore .cm-builtin { color: #d33682; }
-.cm-s-encore .cm-bracket { color: #cb4b16; }
-.cm-s-encore .CodeMirror-matchingbracket { background: rgba(255, 255, 255, 0.1); color: var(--color-red); }
-.cm-s-encore .CodeMirror-nonmatchingbracket { }
-.cm-s-encore .cm-tag { color: #93a1a1; }
-.cm-s-encore .cm-attribute { color: #2aa198; }
-.cm-s-encore .cm-hr {
-  color: transparent;
-  border-top: 1px solid #586e75;
-  display: block;
-}
-.cm-s-encore .cm-link { color: #93a1a1; cursor: pointer; }
-.cm-s-encore .cm-special { color: #6c71c4; }
-.cm-s-encore .cm-em {
-  color: #999;
-  text-decoration: underline;
-  text-decoration-style: dotted;
-}
-.cm-s-encore .cm-error,
-.cm-s-encore .cm-invalidchar {
-  background-image: url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAQAAAACCAYAAAB/qH1jAAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAB3RJTUUH3QUXCToH00Y1UgAAACFJREFUCNdjPMDBUc/AwNDAAAFMTAwMDA0OP34wQgX/AQBYgwYEx4f9lQAAAABJRU5ErkJggg==);
-  background-position: bottom left;
-  background-repeat: repeat-x;
-}
-
-.cm-s-encore .CodeMirror-gutter.webedit {
-  width: 10px;
-  height: 24px;
-}
-
-.cm-s-encore .webedit-guttermarker {
-  width: 10px;
-  height: 10px;
-  margin-top: 7px;
-  border-radius: 50%;
-  background-color: #900;
-}
-
-
-/* TODO Customize */
-.cm-s-solarized .cm-header { color: #586e75; }
-.cm-s-solarized .cm-quote { color: #93a1a1; }
-.cm-s-solarized .cm-keyword { color: #cb4b16; }
-.cm-s-solarized .cm-atom { color: #d33682; }
-.cm-s-solarized .cm-number { color: #d33682; }
-.cm-s-solarized .cm-def { color: #2aa198; }
-.cm-s-solarized .cm-variable { color: #839496; }
-.cm-s-solarized .cm-variable-2 { color: #b58900; }
-.cm-s-solarized .cm-variable-3, .cm-s-solarized .cm-type { color: #6c71c4; }
-.cm-s-solarized .cm-property { color: #2aa198; }
-.cm-s-solarized .cm-operator { color: #6c71c4; }
-.cm-s-solarized .cm-comment { color: #586e75; font-style:italic; }
-.cm-s-solarized .cm-string { color: #859900; }
-.cm-s-solarized .cm-string-2 { color: #b58900; }
-.cm-s-solarized .cm-meta { color: #859900; }
-.cm-s-solarized .cm-qualifier { color: #b58900; }
-.cm-s-solarized .cm-builtin { color: #d33682; }
-.cm-s-solarized .cm-bracket { color: #cb4b16; }
-.cm-s-solarized .CodeMirror-matchingbracket { color: #859900; }
-.cm-s-solarized .CodeMirror-nonmatchingbracket { color: #dc322f; }
-.cm-s-solarized .cm-tag { color: #93a1a1; }
-.cm-s-solarized .cm-attribute { color: #2aa198; }
-.cm-s-solarized .cm-hr {
-  color: transparent;
-  border-top: 1px solid #586e75;
-  display: block;
-}
-.cm-s-solarized .cm-link { color: #93a1a1; cursor: pointer; }
-.cm-s-solarized .cm-special { color: #6c71c4; }
-.cm-s-solarized .cm-em {
-  color: #999;
-  text-decoration: underline;
-  text-decoration-style: dotted;
-}
-.cm-s-solarized .cm-error,
-.cm-s-solarized .cm-invalidchar {
-  color: #586e75;
-  border-bottom: 1px dotted #dc322f;
-}
-
-/* Gutter colors and line number styling based of color scheme (dark / light) */
-
-/* Dark */
-.cm-s-solarized.cm-s-dark .CodeMirror-gutters {
-  background-color: #073642;
-}
-
-.cm-s-solarized.cm-s-dark .CodeMirror-linenumber {
-  color: #586e75;
-  text-shadow: #021014 0 -1px;
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-idea.css b/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-idea.css
deleted file mode 100644
index e0a6cef83a..0000000000
--- a/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-idea.css
+++ /dev/null
@@ -1,44 +0,0 @@
-/**
-    Name:       IDEA default theme
-    From IntelliJ IDEA by JetBrains
- */
-
-.cm-s-idea span.cm-meta { color: #808000; }
-.cm-s-idea span.cm-number { color: #0000FF; }
-.cm-s-idea span.cm-keyword { line-height: 1em; font-weight: bold; color: #000080; }
-.cm-s-idea span.cm-atom { font-weight: bold; color: #000080; }
-.cm-s-idea span.cm-def { color: #000000; }
-.cm-s-idea span.cm-variable { color: black; }
-.cm-s-idea span.cm-variable-2 { color: black; }
-.cm-s-idea span.cm-variable-3, .cm-s-idea span.cm-type { color: black; }
-.cm-s-idea span.cm-property { color: black; }
-.cm-s-idea span.cm-operator { color: black; }
-.cm-s-idea span.cm-comment { color: #808080; }
-.cm-s-idea span.cm-string { color: #008000; }
-.cm-s-idea span.cm-string-2 { color: #008000; }
-.cm-s-idea span.cm-qualifier { color: #555; }
-.cm-s-idea span.cm-error { color: #FF0000; }
-.cm-s-idea span.cm-attribute { color: #0000FF; }
-.cm-s-idea span.cm-tag { color: #000080; }
-.cm-s-idea span.cm-link { color: #0000FF; }
-.cm-s-idea .CodeMirror-activeline-background { background: #FFFAE3; }
-
-.cm-s-idea span.cm-builtin { color: #30a; }
-.cm-s-idea span.cm-bracket { color: #cc7; }
-.cm-s-idea {
-  border-radius: 0.25rem;
-}
-
-
-.cm-s-idea .CodeMirror-matchingbracket { outline:1px solid grey; color:black !important; }
-
-.CodeMirror-hints.idea {
-  font-family: Menlo, Monaco, Consolas, 'Courier New', monospace;
-  color: #616569;
-  background-color: #ebf3fd !important;
-}
-
-.CodeMirror-hints.idea .CodeMirror-hint-active {
-  background-color: #a2b8c9 !important;
-  color: #5c6065 !important;
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-show-hint.css b/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-show-hint.css
deleted file mode 100644
index 89e88aad9a..0000000000
--- a/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-show-hint.css
+++ /dev/null
@@ -1,36 +0,0 @@
-.CodeMirror-hints {
-  position: absolute;
-  z-index: 10;
-  overflow: hidden;
-  list-style: none;
-
-  margin: 0;
-  padding: 2px;
-
-  -webkit-box-shadow: 2px 3px 5px rgba(0,0,0,.2);
-  -moz-box-shadow: 2px 3px 5px rgba(0,0,0,.2);
-  box-shadow: 2px 3px 5px rgba(0,0,0,.2);
-  border-radius: 3px;
-  border: 1px solid silver;
-
-  background: white;
-  font-size: 90%;
-  font-family: monospace;
-
-  max-height: 20em;
-  overflow-y: auto;
-}
-
-.CodeMirror-hint {
-  margin: 0;
-  padding: 0 4px;
-  border-radius: 2px;
-  white-space: pre;
-  color: black;
-  cursor: pointer;
-}
-
-li.CodeMirror-hint-active {
-  background: #08f;
-  color: white;
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-solarized.css b/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-solarized.css
deleted file mode 100644
index 902374a416..0000000000
--- a/cli/daemon/dash/dashapp/src/components/api/cm/codemirror-solarized.css
+++ /dev/null
@@ -1,168 +0,0 @@
-/*
-Solarized theme for code-mirror
-http://ethanschoonover.com/solarized
-*/
-
-/*
-Solarized color palette
-http://ethanschoonover.com/solarized/img/solarized-palette.png
-*/
-
-.solarized.base03 { color: #002b36; }
-.solarized.base02 { color: #073642; }
-.solarized.base01 { color: #586e75; }
-.solarized.base00 { color: #657b83; }
-.solarized.base0 { color: #839496; }
-.solarized.base1 { color: #93a1a1; }
-.solarized.base2 { color: #eee8d5; }
-.solarized.base3  { color: #fdf6e3; }
-.solarized.solar-yellow  { color: #b58900; }
-.solarized.solar-orange  { color: #cb4b16; }
-.solarized.solar-red { color: #dc322f; }
-.solarized.solar-magenta { color: #d33682; }
-.solarized.solar-violet  { color: #6c71c4; }
-.solarized.solar-blue { color: #268bd2; }
-.solarized.solar-cyan { color: #2aa198; }
-.solarized.solar-green { color: #859900; }
-
-/* Color scheme for code-mirror */
-
-.cm-s-solarized {
-  line-height: 1.45em;
-  color-profile: sRGB;
-  rendering-intent: auto;
-}
-.cm-s-solarized.cm-s-dark {
-  color: #839496;
-  background-color: #002b36;
-  text-shadow: #002b36 0 1px;
-}
-.cm-s-solarized.cm-s-light {
-  background-color: #fdf6e3;
-  color: #657b83;
-  text-shadow: #eee8d5 0 1px;
-}
-
-.cm-s-solarized .CodeMirror-widget {
-  text-shadow: none;
-}
-
-.cm-s-solarized .cm-header { color: #586e75; }
-.cm-s-solarized .cm-quote { color: #93a1a1; }
-
-.cm-s-solarized .cm-keyword { color: #cb4b16; }
-.cm-s-solarized .cm-atom { color: #d33682; }
-.cm-s-solarized .cm-number { color: #d33682; }
-.cm-s-solarized .cm-def { color: #2aa198; }
-
-.cm-s-solarized .cm-variable { color: #839496; }
-.cm-s-solarized .cm-variable-2 { color: #b58900; }
-.cm-s-solarized .cm-variable-3, .cm-s-solarized .cm-type { color: #6c71c4; }
-
-.cm-s-solarized .cm-property { color: #2aa198; }
-.cm-s-solarized .cm-operator { color: #6c71c4; }
-
-.cm-s-solarized .cm-comment { color: #586e75; font-style:italic; }
-
-.cm-s-solarized .cm-string { color: #859900; }
-.cm-s-solarized .cm-string-2 { color: #b58900; }
-
-.cm-s-solarized .cm-meta { color: #859900; }
-.cm-s-solarized .cm-qualifier { color: #b58900; }
-.cm-s-solarized .cm-builtin { color: #d33682; }
-.cm-s-solarized .cm-bracket { color: #cb4b16; }
-.cm-s-solarized .CodeMirror-matchingbracket { color: #859900; }
-.cm-s-solarized .CodeMirror-nonmatchingbracket { color: #dc322f; }
-.cm-s-solarized .cm-tag { color: #93a1a1; }
-.cm-s-solarized .cm-attribute { color: #2aa198; }
-.cm-s-solarized .cm-hr {
-  color: transparent;
-  border-top: 1px solid #586e75;
-  display: block;
-}
-.cm-s-solarized .cm-link { color: #93a1a1; cursor: pointer; }
-.cm-s-solarized .cm-special { color: #6c71c4; }
-.cm-s-solarized .cm-em {
-  color: #999;
-  text-decoration: underline;
-  text-decoration-style: dotted;
-}
-.cm-s-solarized .cm-error,
-.cm-s-solarized .cm-invalidchar {
-  color: #586e75;
-  border-bottom: 1px dotted #dc322f;
-}
-
-.cm-s-solarized.cm-s-dark div.CodeMirror-selected { background: #073642; }
-.cm-s-solarized.cm-s-dark.CodeMirror ::selection { background: rgba(7, 54, 66, 0.99); }
-.cm-s-solarized.cm-s-dark .CodeMirror-line::-moz-selection, .cm-s-dark .CodeMirror-line > span::-moz-selection, .cm-s-dark .CodeMirror-line > span > span::-moz-selection { background: rgba(7, 54, 66, 0.99); }
-
-.cm-s-solarized.cm-s-light div.CodeMirror-selected { background: #eee8d5; }
-.cm-s-solarized.cm-s-light .CodeMirror-line::selection, .cm-s-light .CodeMirror-line > span::selection, .cm-s-light .CodeMirror-line > span > span::selection { background: #eee8d5; }
-.cm-s-solarized.cm-s-light .CodeMirror-line::-moz-selection, .cm-s-ligh .CodeMirror-line > span::-moz-selection, .cm-s-ligh .CodeMirror-line > span > span::-moz-selection { background: #eee8d5; }
-
-/* Editor styling */
-
-
-
-/* Little shadow on the view-port of the buffer view */
-.cm-s-solarized.CodeMirror {
-  -moz-box-shadow: inset 7px 0 12px -6px #000;
-  -webkit-box-shadow: inset 7px 0 12px -6px #000;
-  box-shadow: inset 7px 0 12px -6px #000;
-}
-
-/* Remove gutter border */
-.cm-s-solarized .CodeMirror-gutters {
-  border-right: 0;
-}
-
-/* Gutter colors and line number styling based of color scheme (dark / light) */
-
-/* Dark */
-.cm-s-solarized.cm-s-dark .CodeMirror-gutters {
-  background-color: #073642;
-}
-
-.cm-s-solarized.cm-s-dark .CodeMirror-linenumber {
-  color: #586e75;
-  text-shadow: #021014 0 -1px;
-}
-
-/* Light */
-.cm-s-solarized.cm-s-light .CodeMirror-gutters {
-  background-color: #eee8d5;
-}
-
-.cm-s-solarized.cm-s-light .CodeMirror-linenumber {
-  color: #839496;
-}
-
-/* Common */
-.cm-s-solarized .CodeMirror-linenumber {
-  padding: 0 5px;
-}
-.cm-s-solarized .CodeMirror-guttermarker-subtle { color: #586e75; }
-.cm-s-solarized.cm-s-dark .CodeMirror-guttermarker { color: #ddd; }
-.cm-s-solarized.cm-s-light .CodeMirror-guttermarker { color: #cb4b16; }
-
-.cm-s-solarized .CodeMirror-gutter .CodeMirror-gutter-text {
-  color: #586e75;
-}
-
-/* Cursor */
-.cm-s-solarized .CodeMirror-cursor { border-left: 1px solid #819090; }
-
-/* Fat cursor */
-.cm-s-solarized.cm-s-light.cm-fat-cursor .CodeMirror-cursor { background: #77ee77; }
-.cm-s-solarized.cm-s-light .cm-animate-fat-cursor { background-color: #77ee77; }
-.cm-s-solarized.cm-s-dark.cm-fat-cursor .CodeMirror-cursor { background: #586e75; }
-.cm-s-solarized.cm-s-dark .cm-animate-fat-cursor { background-color: #586e75; }
-
-/* Active line */
-.cm-s-solarized.cm-s-dark .CodeMirror-activeline-background {
-  background: rgba(255, 255, 255, 0.06);
-}
-.cm-s-solarized.cm-s-light .CodeMirror-activeline-background {
-  background: rgba(0, 0, 0, 0.06);
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/api/cm/codemirror.css b/cli/daemon/dash/dashapp/src/components/api/cm/codemirror.css
deleted file mode 100644
index 14ebd6cce2..0000000000
--- a/cli/daemon/dash/dashapp/src/components/api/cm/codemirror.css
+++ /dev/null
@@ -1,343 +0,0 @@
-/* BASICS */
-.CodeMirror {
-  /* Set height, width, borders, and global font properties here */
-  font-family: monospace;
-  height: 300px;
-  color: black;
-  direction: ltr;
-}
-
-/* PADDING */
-
-.CodeMirror-lines {
-  padding: 4px 0; /* Vertical padding around content */
-}
-.CodeMirror pre.CodeMirror-line,
-.CodeMirror pre.CodeMirror-line-like {
-  padding: 0 4px; /* Horizontal padding of content */
-}
-
-.CodeMirror-scrollbar-filler, .CodeMirror-gutter-filler {
-  background-color: white; /* The little square between H and V scrollbars */
-}
-
-/* GUTTER */
-
-.CodeMirror-gutters {
-  border-right: 1px solid #ddd;
-  background-color: #f7f7f7;
-  white-space: nowrap;
-}
-.CodeMirror-linenumbers {}
-.CodeMirror-linenumber {
-  padding: 0 3px 0 5px;
-  min-width: 20px;
-  text-align: right;
-  color: #999;
-  white-space: nowrap;
-}
-
-.CodeMirror-guttermarker { color: black; }
-.CodeMirror-guttermarker-subtle { color: #999; }
-
-/* CURSOR */
-
-.CodeMirror-cursor {
-  border-left: 1px solid black;
-  border-right: none;
-  width: 0;
-}
-/* Shown when moving in bi-directional text */
-.CodeMirror div.CodeMirror-secondarycursor {
-  border-left: 1px solid silver;
-}
-.cm-fat-cursor .CodeMirror-cursor {
-  width: auto;
-  border: 0 !important;
-  background: #7e7;
-}
-.cm-fat-cursor div.CodeMirror-cursors {
-  z-index: 1;
-}
-.cm-fat-cursor-mark {
-  background-color: rgba(20, 255, 20, 0.5);
-  -webkit-animation: blink 1.06s steps(1) infinite;
-  -moz-animation: blink 1.06s steps(1) infinite;
-  animation: blink 1.06s steps(1) infinite;
-}
-.cm-animate-fat-cursor {
-  width: auto;
-  border: 0;
-  -webkit-animation: blink 1.06s steps(1) infinite;
-  -moz-animation: blink 1.06s steps(1) infinite;
-  animation: blink 1.06s steps(1) infinite;
-  background-color: #7e7;
-}
-@-moz-keyframes blink {
-  0% {}
-  50% { background-color: transparent; }
-  100% {}
-}
-@-webkit-keyframes blink {
-  0% {}
-  50% { background-color: transparent; }
-  100% {}
-}
-@keyframes blink {
-  0% {}
-  50% { background-color: transparent; }
-  100% {}
-}
-
-/* Can style cursor different in overwrite (non-insert) mode */
-.CodeMirror-overwrite .CodeMirror-cursor {}
-
-.cm-tab { display: inline-block; text-decoration: inherit; }
-
-.CodeMirror-rulers {
-  position: absolute;
-  left: 0; right: 0; top: -50px; bottom: 0;
-  overflow: hidden;
-}
-.CodeMirror-ruler {
-  border-left: 1px solid #ccc;
-  top: 0; bottom: 0;
-  position: absolute;
-}
-
-/* DEFAULT THEME */
-
-.cm-s-default .cm-header {color: blue;}
-.cm-s-default .cm-quote {color: #090;}
-.cm-negative {color: #d44;}
-.cm-positive {color: #292;}
-.cm-header, .cm-strong {font-weight: bold;}
-.cm-em {font-style: italic;}
-.cm-link {text-decoration: underline;}
-.cm-strikethrough {text-decoration: line-through;}
-
-.cm-s-default .cm-keyword {color: #708;}
-.cm-s-default .cm-atom {color: #219;}
-.cm-s-default .cm-number {color: #164;}
-.cm-s-default .cm-def {color: #00f;}
-.cm-s-default .cm-variable,
-.cm-s-default .cm-punctuation,
-.cm-s-default .cm-property,
-.cm-s-default .cm-operator {}
-.cm-s-default .cm-variable-2 {color: #05a;}
-.cm-s-default .cm-variable-3, .cm-s-default .cm-type {color: #085;}
-.cm-s-default .cm-comment {color: #a50;}
-.cm-s-default .cm-string {color: #a11;}
-.cm-s-default .cm-string-2 {color: #f50;}
-.cm-s-default .cm-meta {color: #555;}
-.cm-s-default .cm-qualifier {color: #555;}
-.cm-s-default .cm-builtin {color: #30a;}
-.cm-s-default .cm-bracket {color: #997;}
-.cm-s-default .cm-tag {color: #170;}
-.cm-s-default .cm-attribute {color: #00c;}
-.cm-s-default .cm-hr {color: #999;}
-.cm-s-default .cm-link {color: #00c;}
-
-.cm-s-default .cm-error {color: #f00;}
-.cm-invalidchar {color: #f00;}
-
-.CodeMirror-composing { border-bottom: 2px solid; }
-
-/* Default styles for common addons */
-
-/* STOP */
-
-/* The rest of this file contains styles related to the mechanics of
-   the editor. You probably shouldn't touch them. */
-
-.CodeMirror {
-  position: relative;
-  overflow: hidden;
-  background: white;
-}
-
-.CodeMirror-scroll {
-  overflow: scroll !important; /* Things will break if this is overridden */
-  /* 50px is the magic margin used to hide the element's real scrollbars */
-  /* See overflow: hidden in .CodeMirror */
-  margin-bottom: -50px; margin-right: -50px;
-  padding-bottom: 50px;
-  height: 100%;
-  outline: none; /* Prevent dragging from highlighting the element */
-  position: relative;
-}
-.CodeMirror-sizer {
-  position: relative;
-  border-right: 50px solid transparent;
-}
-
-/* The fake, visible scrollbars. Used to force redraw during scrolling
-   before actual scrolling happens, thus preventing shaking and
-   flickering artifacts. */
-.CodeMirror-vscrollbar, .CodeMirror-hscrollbar, .CodeMirror-scrollbar-filler, .CodeMirror-gutter-filler {
-  position: absolute;
-  z-index: 6;
-  display: none;
-}
-.CodeMirror-vscrollbar {
-  right: 0; top: 0;
-  overflow-x: hidden;
-  overflow-y: scroll;
-}
-.CodeMirror-hscrollbar {
-  bottom: 0; left: 0;
-  overflow-y: hidden;
-  overflow-x: scroll;
-}
-.CodeMirror-scrollbar-filler {
-  right: 0; bottom: 0;
-}
-.CodeMirror-gutter-filler {
-  left: 0; bottom: 0;
-}
-
-.CodeMirror-gutters {
-  position: absolute; left: 0; top: 0;
-  min-height: 100%;
-  z-index: 3;
-}
-.CodeMirror-gutter {
-  white-space: normal;
-  height: 100%;
-  display: inline-block;
-  vertical-align: top;
-  margin-bottom: -50px;
-}
-.CodeMirror-gutter-wrapper {
-  position: absolute;
-  z-index: 4;
-  background: none !important;
-  border: none !important;
-}
-.CodeMirror-gutter-background {
-  position: absolute;
-  top: 0; bottom: 0;
-  z-index: 4;
-}
-.CodeMirror-gutter-elt {
-  position: absolute;
-  cursor: default;
-  z-index: 4;
-}
-.CodeMirror-gutter-wrapper ::selection { background-color: transparent }
-.CodeMirror-gutter-wrapper ::-moz-selection { background-color: transparent }
-
-.CodeMirror-lines {
-  cursor: text;
-  min-height: 1px; /* prevents collapsing before first draw */
-}
-.CodeMirror pre.CodeMirror-line,
-.CodeMirror pre.CodeMirror-line-like {
-  /* Reset some styles that the rest of the page might have set */
-  -moz-border-radius: 0; -webkit-border-radius: 0; border-radius: 0;
-  border-width: 0;
-  background: transparent;
-  font-family: inherit;
-  font-size: inherit;
-  margin: 0;
-  white-space: pre;
-  word-wrap: normal;
-  line-height: inherit;
-  color: inherit;
-  z-index: 2;
-  position: relative;
-  overflow: visible;
-  -webkit-tap-highlight-color: transparent;
-  -webkit-font-variant-ligatures: contextual;
-  font-variant-ligatures: contextual;
-}
-.CodeMirror-wrap pre.CodeMirror-line,
-.CodeMirror-wrap pre.CodeMirror-line-like {
-  word-wrap: break-word;
-  white-space: pre-wrap;
-  word-break: normal;
-}
-
-.CodeMirror-linebackground {
-  position: absolute;
-  left: 0; right: 0; top: 0; bottom: 0;
-  z-index: 0;
-}
-
-.CodeMirror-linewidget {
-  position: relative;
-  z-index: 2;
-  padding: 0.1px; /* Force widget margins to stay inside of the container */
-}
-
-.CodeMirror-widget {}
-
-.CodeMirror-rtl pre { direction: rtl; }
-
-.CodeMirror-code {
-  outline: none;
-}
-
-/* Force content-box sizing for the elements where we expect it */
-.CodeMirror-scroll,
-.CodeMirror-sizer,
-.CodeMirror-gutter,
-.CodeMirror-gutters,
-.CodeMirror-linenumber {
-  -moz-box-sizing: content-box;
-  box-sizing: content-box;
-}
-
-.CodeMirror-measure {
-  position: absolute;
-  width: 100%;
-  height: 0;
-  overflow: hidden;
-  visibility: hidden;
-}
-
-.CodeMirror-cursor {
-  position: absolute;
-  pointer-events: none;
-}
-.CodeMirror-measure pre { position: static; }
-
-div.CodeMirror-cursors {
-  visibility: hidden;
-  position: relative;
-  z-index: 3;
-}
-div.CodeMirror-dragcursors {
-  visibility: visible;
-}
-
-.CodeMirror-focused div.CodeMirror-cursors {
-  visibility: visible;
-}
-
-.CodeMirror-selected { background: #d9d9d9; }
-.CodeMirror-focused .CodeMirror-selected { background: #d7d4f0; }
-.CodeMirror-crosshair { cursor: crosshair; }
-.CodeMirror-line::selection, .CodeMirror-line > span::selection, .CodeMirror-line > span > span::selection { background: #d7d4f0; }
-.CodeMirror-line::-moz-selection, .CodeMirror-line > span::-moz-selection, .CodeMirror-line > span > span::-moz-selection { background: #d7d4f0; }
-
-.cm-searching {
-  background-color: #ffa;
-  background-color: rgba(255, 255, 0, .4);
-}
-
-/* Used to force a border model for a node */
-.cm-force-border { padding-right: .1px; }
-
-@media print {
-  /* Hide the cursor when printing */
-  .CodeMirror div.CodeMirror-cursors {
-    visibility: hidden;
-  }
-}
-
-/* See issue #2901 */
-.cm-tab-wrap-hack:after { content: ''; }
-
-/* Help users use markselection to safely style text background */
-span.CodeMirror-selectedtext { background: none; }
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/api/schema.ts b/cli/daemon/dash/dashapp/src/components/api/schema.ts
deleted file mode 100644
index 623408fc57..0000000000
--- a/cli/daemon/dash/dashapp/src/components/api/schema.ts
+++ /dev/null
@@ -1,84 +0,0 @@
-export type TypeName = "struct" | "map" | "list" | "builtin" | "named";
-
-export const typeName: (typ: Type) => TypeName = (typ: Type) => (
-  typ.struct ? "struct" :
-  typ.map ? "map" :
-  typ.list ? "list" :
-  typ.named ? "named" :
-  "builtin"
-)
-
-export interface Type {
-  // oneof these
-  struct?: StructType;
-  map?: MapType;
-  list?: ListType;
-  builtin?: BuiltinType;
-  named?: NamedType;
-}
-
-export interface StructType {
-  fields: Field[];
-}
-
-export interface Field {
-  typ: Type;
-  name: string;
-  doc: string;
-  json_name: string;
-  optional: boolean;
-}
-
-export interface MapType {
-  key: Type;
-  value: Type;
-}
-
-export interface ListType {
-  elem: Type;
-}
-
-export interface NamedType {
-  id: number;
-}
-
-export interface Decl {
-  id: number;
-  name: string;
-  type: Type;
-  doc: string;
-  loc: Loc;
-}
-
-export interface Loc {
-  pkg_path: string;
-  pkg_name: string;
-  filename: string;
-  start_pos: number;
-  end_pos: number;
-  src_line_start: number;
-  src_line_end: number;
-  src_col_start: number;
-  src_col_end: number;
-}
-
-export enum BuiltinType {
-  Any = "ANY",
-  Bool = "BOOL",
-  Int8 = "INT8",
-  Int16 = "INT16",
-  Int32 = "INT32",
-  Int64 = "INT64",
-  Uint8  = "UINT8",
-  Uint16 = "UINT16",
-  Uint32 = "UINT32",
-  Uint64 = "UINT64",
-  Float32 = "FLOAT32",
-  Float64 = "FLOAT64",
-  String = "STRING",
-  Bytes = "BYTES",
-  Time = "TIME",
-  UUID = "UUID",
-  JSON = "JSON",
-  USER_ID = "USER_ID",
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/app/AppAPI.tsx b/cli/daemon/dash/dashapp/src/components/app/AppAPI.tsx
deleted file mode 100644
index 9e68a8fa23..0000000000
--- a/cli/daemon/dash/dashapp/src/components/app/AppAPI.tsx
+++ /dev/null
@@ -1,233 +0,0 @@
-import React, { FunctionComponent, useState } from 'react'
-import { APIMeta, RPC, Service } from '~c/api/api'
-import RPCCaller from "~c/api/RPCCaller"
-import SchemaView, { Dialect } from '~c/api/SchemaView'
-import { ProcessReload } from '~lib/client/client'
-import JSONRPCConn, { NotificationMsg } from '~lib/client/jsonrpc'
-
-interface Props {
-  appID: string;
-  conn: JSONRPCConn;
-}
-
-interface State {
-  meta?: APIMeta;
-}
-
-export default class AppAPI extends React.Component<Props, State> {
-  constructor(props: Props) {
-    super(props)
-    this.state = {}
-    this.onNotification = this.onNotification.bind(this)
-  }
-
-  async componentDidMount() {
-    this.props.conn.on("notification", this.onNotification)
-    const status: any = await this.props.conn.request("status", {appID: this.props.appID})
-    if (status.meta) {
-      this.setState({meta: status.meta})
-    }
-  }
-
-  componentWillUnmount() {
-    this.props.conn.off("notification", this.onNotification)
-  }
-
-  onNotification(msg: NotificationMsg) {
-    if (msg.method === "process/reload") {
-      const data = msg.params as ProcessReload
-      if (data.appID === this.props.appID) {
-        this.setState({meta: data.meta})
-      }
-    }
-  }
-
-  render() {
-    return (
-      <div className="flex flex-col">
-        {this.state.meta ? this.renderAPI() : (
-          <div className="flex flex-col h-full items-center justify-center">
-            <div className="text-gray-400 text-lg px-4 mb-6">
-              No API schema available yet.
-            </div>
-          </div>
-        )}
-      </div>
-    )
-  }
-
-  renderAPI() {
-    const meta = this.state.meta!
-    const svcPkg = (svc: Service) => {
-      return meta.pkgs.find(pkg => pkg.rel_path === svc.rel_path)!
-    }
-
-    return (
-      <div className="flex-grow flex items-start relative">
-        <div className="w-56 flex-none hidden md:block sticky top-4">
-          <SvcMenu svcs={meta.svcs} />
-        </div>
-        <div className="md:ml-6 flex-grow min-w-0 bg-white rounded-lg shadow-lg h-full">
-          {meta.svcs.map(svc => {
-            const rootPkg = svcPkg(svc)
-            return (
-              <div key={svc.name} className="border-b border-gray-300 px-4 md:px-8 lg:px-16">
-                <div className="py-4 md:py-8 lg:py-16">
-                  <h2 className="text-3xl leading-10 font-bold text-gray-600">Service {svc.name}</h2>
-                  {rootPkg.doc &&
-                    <p className="mt-4 mb-6 leading-6">{rootPkg.doc}</p>
-                  }
-                </div>
-
-                {svc.rpcs.map(rpc =>
-                  <div key={rpc.name} className="border-t border-gray-300 py-10">
-                    <h3 id={svc.name+"."+rpc.name} className="text-2xl leading-10 font-sans font-medium text-gray-700 flex items-center">
-                      <span className="flex-grow truncate min-w-0">func {rpc.name}</span>
-                    </h3>
-                    <div className="md:flex md:items-stretch">
-                      <div className="flex-initial min-w-0 md:mr-12 w-full" style={{maxWidth: "600px"}}>
-                        {rpc.doc &&
-                          <p className="mb-6 leading-6">{rpc.doc}</p>
-                        }
-
-                        {rpc.proto === "RAW" ? (
-                          <div className="mt-4">
-                            <div className="flex leading-6 text-gray-900 text-sm">
-                              This API processes unstructured HTTP requests and therefore has no explicit schema.
-                            </div>
-                          </div>
-                        ) : (
-                          <>
-                            <div className="mt-4">
-                              <h4 className="font-medium font-sans text-gray-700">Parameters</h4>
-                              <hr className="my-4 border-gray-200" />
-                              {rpc.request_schema ? <SchemaView meta={meta} decl={rpc.request_schema} dialect="table" /> :
-                                <div className="text-gray-400 text-sm">No parameters.</div>
-                              }
-                            </div>
-
-                            <div className="mt-12">
-                              <h4 className="font-medium font-sans text-gray-700">Response</h4>
-                              <hr className="my-4 border-gray-200" />
-                              {rpc.response_schema ? <SchemaView meta={meta} decl={rpc.response_schema} dialect="table" /> :
-                                <div className="text-gray-400 text-sm">No response.</div>
-                              }
-                            </div>
-                          </>
-                        )}
-                      </div>
-                      {rpc.proto !== "RAW" &&
-                        <div className="flex-initial min-w-0 mt-10 md:mt-0 w-full" style={{maxWidth: "600px"}}>
-                          <div className="sticky top-4">
-                            <RPCDemo conn={this.props.conn} appID={this.props.appID} meta={meta} svc={svc} rpc={rpc} />
-                          </div>
-                        </div>
-                      }
-                    </div>
-                  </div>
-                )}
-              </div>
-            )
-          })}
-        </div>
-      </div>
-    )
-  }
-}
-
-interface RPCDemoProps {
-  conn: JSONRPCConn;
-  appID: string;
-  meta: APIMeta;
-  svc: Service;
-  rpc: RPC;
-}
-
-const RPCDemo: FunctionComponent<RPCDemoProps> = (props) => {
-  const [respDialect, setRespDialect] = useState("json" as Dialect)
-
-  type TabType = "schema" | "call"
-  const [selectedTab, setSelectedTab] = useState<TabType>("schema")
-  const tabs: {title: string; type: TabType}[] = [
-    {title: "Schema", type: "schema"},
-    {title: "Call", type: "call"},
-  ]
-
-    return <div>
-      <nav className="flex justify-end space-x-4 mb-3">
-        {tabs.map(t =>
-          <button key={t.type} className={`px-3 py-2 font-medium text-sm rounded-md focus:outline-none ${selectedTab === t.type ? "text-purple-700 bg-purple-100" : "text-gray-500 hover:text-gray-700"}`}
-              onClick={() => setSelectedTab(t.type)}>
-            {t.title}
-          </button>
-        )}
-      </nav>
-
-      {selectedTab === "schema" ? <>
-      {props.rpc.request_schema &&
-        <div className="rounded-md border-gray-200 shadow">
-          <div className="rounded-t-md bg-gray-600 p-2 uppercase text-gray-200 font-header text-xs tracking-wider flex">
-            <div className="flex-grow">Request</div>
-            <div className="flex-shrink-0">
-              <select value={respDialect} onChange={(e) => setRespDialect(e.target.value as Dialect)}
-                  className="form-select h-full py-0 border-transparent bg-transparent text-gray-300 text-xs leading-none">
-                <option value="json">JSON</option>
-                <option value="go">Go</option>
-                <option value="typescript">TypeScript</option>
-              </select>
-            </div>
-          </div>
-          <div className="rounded-b-md bg-gray-800 text-gray-100 p-2 font-mono overflow-auto">
-            <SchemaView meta={props.meta} decl={props.rpc.request_schema} dialect={respDialect} />
-          </div>
-        </div>
-      }
-      {props.rpc.response_schema &&
-        <div className="rounded-md border-gray-200 shadow mt-6">
-          <div className="rounded-t-md bg-gray-200 p-2 uppercase text-gray-600 font-header text-xs tracking-wider flex">
-            <div className="flex-grow">Response</div>
-            <div className="flex-shrink-0">
-              <select value={respDialect} onChange={(e) => setRespDialect(e.target.value as Dialect)}
-                  className="form-select h-full py-0 border-transparent bg-transparent text-gray-500 text-xs leading-none">
-                <option value="json">JSON</option>
-                <option value="go">Go</option>
-                <option value="typescript">TypeScript</option>
-              </select>
-            </div>
-          </div>
-          <div className="rounded-b-md bg-gray-100 p-2 font-mono overflow-auto">
-            <SchemaView meta={props.meta} decl={props.rpc.response_schema} dialect={respDialect} />
-          </div>
-        </div>
-      }
-    </> : (
-      <RPCCaller conn={props.conn} appID={props.appID} md={props.meta} svc={props.svc} rpc={props.rpc} />
-    )}
-  </div>
-}
-
-interface SvcMenuProps {
-  svcs: Service[];
-}
-
-const SvcMenu: FunctionComponent<SvcMenuProps> = (props) => {
-  return <>
-    {props.svcs.map((svc, i) =>
-      <div key={svc.name} className={(i > 0) ? "border-t border-gray-300" : ""}>
-        <div className="flex w-full text-left px-4 py-2 text-gray-900">
-          <div className="flex-grow flex">
-            <div className="flex-grow text-sm text-gray-800 font-medium leading-5">{svc.name}</div>
-            <div className="text-xs text-gray-400 flex-shrink-0 font-light">Service</div>
-          </div>
-        </div>
-        <div className="py-1">
-          {svc.rpcs.map((rpc, j) =>
-            <a key={j} href={`#${svc.name}.${rpc.name}`} className="block pl-6 pr-4 py-2 text-sm leading-5 rounded-sm text-gray-700 hover:bg-gray-300 hover:text-gray-900 focus:outline-none focus:bg-gray-100 focus:text-gray-900">
-              {rpc.name}
-            </a>
-          )}
-        </div>
-      </div>
-    )}
-  </>
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/app/AppCaller.tsx b/cli/daemon/dash/dashapp/src/components/app/AppCaller.tsx
deleted file mode 100644
index 2dbd2a81c1..0000000000
--- a/cli/daemon/dash/dashapp/src/components/app/AppCaller.tsx
+++ /dev/null
@@ -1,88 +0,0 @@
-import React, { FC, useEffect, useReducer, useState } from 'react'
-import { APIMeta, RPC, Service } from '~c/api/api'
-import RPCCaller from '~c/api/RPCCaller'
-import { ProcessReload, ProcessStart } from '~lib/client/client'
-import JSONRPCConn, { NotificationMsg } from '~lib/client/jsonrpc'
-
-interface API {
-  svc: Service;
-  rpc: RPC;
-  name: string;
-}
-
-const AppCaller: FC<{appID: string; conn: JSONRPCConn}> = ({appID, conn}) => {
-  const [port, setPort] = useState(4060)
-  interface State {
-    md?: APIMeta;
-    list?: API[];
-    selected?: API;
-  }
-  function reducer(state: State, action: {type: "meta" | "select"; meta?: APIMeta; name?: string}): State {
-    switch (action.type) {
-      case "meta":
-        // Recompute our API list
-        const list: API[] = []
-        const md = action.meta!
-        md.svcs.forEach(svc => {
-          svc.rpcs.forEach(rpc => {
-            list.push({svc, rpc, name: `${svc.name}.${rpc.name}`})
-          })
-        })
-        list.sort((a, b) => a.name.localeCompare(b.name))
-
-        // Does the selected API still exist?
-        const exists = state.selected ? list.findIndex(a => a.name === state.selected!.name) >= 0 : false
-        const newSel = exists ? state.selected : list.length > 0 ? list[0] : undefined
-        return {md: md, list: list, selected: newSel}
-      case "select":
-        const sel = state.list?.find(a => a.name === action.name)
-        return {...state, selected: sel ?? state.selected}
-    }
-  }
-
-  const [state, dispatch] = useReducer(reducer, {})
-  const onNotify = (msg: NotificationMsg) => {
-    if (msg.method === "process/start") {
-      const data = msg.params as ProcessStart
-      if (data.appID === appID) {
-        setPort(data.port)
-      }
-    } else if (msg.method === "process/reload") {
-      const data = msg.params as ProcessReload
-      if (data.appID === appID) {
-        dispatch({type: "meta", meta: data.meta})
-      }
-    }
-  }
-
-  useEffect(() => {
-    conn.request("status", {appID}).then((resp: any) => {
-      if (resp.port) { setPort(resp.port) }
-      if (resp.meta) { dispatch({type: "meta", meta: resp.meta}) }
-    })
-
-    conn.on("notification", onNotify)
-    return () => { conn.off("notification", onNotify) }
-  }, [])
-
-  if (!state.md || !state.selected) { return null }
-
-  return (
-    <div className="bg-white p-4">
-      <div>
-        <label htmlFor="endpoint" className="block text-sm font-medium text-gray-700">API Endpoint</label>
-        <select id="endpoint" className="mt-1 block w-full pl-3 pr-10 py-2 text-base border-gray-300 focus:outline-none focus:ring-indigo-500 focus:border-indigo-500 sm:text-sm rounded-md"
-            value={state.selected!.name} onChange={(e) => dispatch({type: "select", name: e.target.value})}>
-          {state.list!.map(a =>
-            <option key={a.name} value={a.name}>{a.name}</option>
-          )}
-        </select>
-      </div>
-      <div className="mt-3">
-        <RPCCaller conn={conn} appID={appID} md={state.md} svc={state.selected.svc} rpc={state.selected.rpc} port={port} />
-      </div>
-    </div>
-  )
-}
-
-export default AppCaller
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/app/AppLogs.tsx b/cli/daemon/dash/dashapp/src/components/app/AppLogs.tsx
deleted file mode 100644
index 42ec46fa4c..0000000000
--- a/cli/daemon/dash/dashapp/src/components/app/AppLogs.tsx
+++ /dev/null
@@ -1,141 +0,0 @@
-import React from 'react'
-import { decodeBase64 } from '~lib/base64'
-import { ProcessOutput, ProcessReload, ProcessStart, ProcessStop } from '~lib/client/client'
-import JSONRPCConn, { NotificationMsg } from '~lib/client/jsonrpc'
-import parseAnsi, { Chunk } from "~lib/parse-ansi"
-
-interface Props {
-  appID: string;
-  conn: JSONRPCConn;
-}
-
-interface State {
-  lines: Chunk[][];
-}
-
-export default class AppLogs extends React.Component<Props, State> {
-  constructor(props: Props) {
-    super(props)
-    this.state = {lines: [[]]}
-    this.onNotification = this.onNotification.bind(this)
-  }
-
-  componentDidMount() {
-    this.props.conn.on("notification", this.onNotification)
-  }
-
-  componentWillUnmount() {
-    this.props.conn.off("notification", this.onNotification)
-  }
-
-  onNotification(msg: NotificationMsg) {
-    if (msg.method === "process/start") {
-      const data = msg.params as ProcessStart
-      if (data.appID === this.props.appID) {
-        this.setState(state => {
-          return {
-            lines: [...state.lines, [
-              {type: "text", style: {}, value: "Running on "},
-              {type: "text", style: {bold: true}, value: `http://localhost:${data.port}`},
-            ], []]
-          }
-        })
-      }
-    } else if (msg.method === "process/reload") {
-      const data = msg.params as ProcessReload
-      if (data.appID === this.props.appID) {
-        this.setState(state => {
-          return {
-            lines: [...state.lines, [
-              {type: "text", style: {}, value: "App reloaded!"},
-            ], []]
-          }
-        })
-      }
-    } else if (msg.method === "process/stop") {
-      const data = msg.params as ProcessStop
-      if (data.appID === this.props.appID) {
-        this.setState(state => {
-          return {
-            lines: [...state.lines, [
-              {type: "text", style: {foregroundColor: "red"}, value: "App stopped."},
-            ], []]
-          }
-        })
-      }
-    } else if (msg.method === "process/output") {
-      const data = msg.params as ProcessOutput
-      if (data.appID === this.props.appID) {
-        let chunks = parseAnsi(decodeBase64(data.output)).chunks as Chunk[]
-        let newLines: Chunk[][] = [[]]
-        for (const ch of chunks) {
-          if (ch.type === "newline") {
-            newLines.push([])
-          } else if (ch.type === "text") {
-            newLines[newLines.length - 1].push(ch)
-          }
-        }
-        this.setState(state => {
-          let prev = state.lines.slice(0, -1)
-          let curr = state.lines[state.lines.length - 1]
-          curr = curr.concat(newLines[0])
-          return {
-            lines: [...prev, curr, ...newLines.slice(1)],
-          }
-        })
-      }
-    }
-  }
-
-  render() {
-    return (
-      <div className="h-full relative text-sm font-mono subpixel-antialiased bg-gray-800 px-5 py-2 leading-normal" style={{lineHeight: 1.675}}>
-        <style>{`
-          .gray     { color: rgb(228, 218, 199); }
-          .green    { color: #B5F4A5; }
-          .blue     { color: #93DDFD; }
-          .red      { color: #FF8383; }
-          .purple   { color: #D9A9FF; }
-          .white    { color: #FFFFFF; }
-          .darkgray { color: #718096; }
-          div {
-            font-size: 14px;
-            line-height: 1.375;
-            tab-size: 4;
-          }
-        `}</style>
-        <div className="h-full font-mono whitespace-pre text-white overflow-auto">
-          {this.state.lines.map((line, i) =>
-            <div key={i}>
-              {line.map((ch, j) =>
-                <span key={j} className={chunkStyle(ch)}>{ch.value}</span>
-              )}
-              {line.length === 0 ? <span>&nbsp;</span> : null}
-            </div>
-          )}
-        </div>
-      </div>
-    )
-  }
-}
-
-function chunkStyle(ch: Chunk): string {
-  const cls = []
-  if (ch.style.bold) { cls.push("font-bold") }
-  if (ch.style.italic) { cls.push("italic") }
-  if (ch.style.strikethrough) { cls.push("line-through") }
-  if (ch.style.underline) { cls.push("underline") }
-
-  const fc = ch.style.foregroundColor
-  if (fc) {
-    cls.push(
-      fc === "gray" ? "text-gray-500" :
-      fc === "green" ? "green" :
-      fc === "red" ? "red" :
-      fc === "blue" ? "blue" :
-      fc === "cyan" ? "purple" :
-      "text-white"
-    )
-  }
-  return cls.join(" ")
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/app/AppTraces.tsx b/cli/daemon/dash/dashapp/src/components/app/AppTraces.tsx
deleted file mode 100644
index 03c842e2e1..0000000000
--- a/cli/daemon/dash/dashapp/src/components/app/AppTraces.tsx
+++ /dev/null
@@ -1,185 +0,0 @@
-import React from 'react'
-import { Modal } from '~c/Modal'
-import { Request, Trace } from '~c/trace/model'
-import SpanDetail from '~c/trace/SpanDetail'
-import SpanList from '~c/trace/SpanList'
-import TraceMap from '~c/trace/TraceMap'
-import { latencyStr } from '~c/trace/util'
-import { decodeBase64 } from '~lib/base64'
-import JSONRPCConn, { NotificationMsg } from '~lib/client/jsonrpc'
-import { timeToDate } from '~lib/time'
-
-interface Props {
-  appID: string;
-  conn: JSONRPCConn;
-}
-
-interface State {
-  traces: Trace[];
-  selected?: Trace;
-}
-
-export default class AppTraces extends React.Component<Props, State> {
-  constructor(props: Props) {
-    super(props)
-    this.state = {traces: []}
-    this.onNotification = this.onNotification.bind(this)
-  }
-
-  async componentDidMount() {
-    const traces = await this.props.conn.request("list-traces", {appID: this.props.appID}) as Trace[]
-    this.setState({traces: traces.reverse()})
-    this.props.conn.on("notification", this.onNotification)
-  }
-
-  componentWillUnmount() {
-    this.props.conn.off("notification", this.onNotification)
-  }
-
-  onNotification(msg: NotificationMsg) {
-    if (msg.method === "trace/new") {
-      const tr = msg.params as Trace
-      this.setState((st) => {
-        return {traces: [tr, ...st.traces]}
-      })
-    }
-  }
-
-  render() {
-    return (
-      <div className="flex flex-col">
-        <Modal show={this.state.selected !== undefined} close={() => this.setState({selected: undefined})} width="w-full h-full mt-4">
-          {this.state.selected && <TraceView trace={this.state.selected} close={() => this.setState({selected: undefined})} /> }
-        </Modal>
-
-        <div className="bg-white shadow overflow-hidden sm:rounded-md">
-          {this.state.traces.length === 0 && (
-            <div className="p-4">
-              No traces yet. Make an API call to see it here!
-            </div>
-          )}
-          <ul className="divide-y divide-gray-200">
-            {this.state.traces.map(tr => {
-              const loc = tr.locations[tr.root.def_loc]
-              let endpoint = "<unknown endpoint>"
-              if ("rpc_def" in loc) {
-                endpoint = loc.rpc_def.service_name + "." + loc.rpc_def.rpc_name
-              }
-              return <li key={tr.id}>
-                <div className="px-4 py-4 sm:px-6 hover:bg-gray-50" onClick={() => this.setState({selected: tr})}>
-                  <div className="flex items-center justify-between">
-                    <p className="text-base font-medium text-gray-800 truncate">
-                      {endpoint}
-                    </p>
-                    <div className="ml-2 flex-shrink-0 flex">
-                      {tr.root.err === null ? (
-                        <span className="px-2 inline-flex text-xs leading-5 font-semibold rounded-full bg-green-100 text-green-800">
-                          Success
-                        </span>
-                      ) : (
-                        <span className="px-2 inline-flex text-xs leading-5 font-semibold rounded-full bg-red-100 text-red-800">
-                          Error
-                        </span>
-                      )}
-                    </div>
-                  </div>
-                  <div className="mt-2 sm:flex sm:justify-between">
-                    <div className="sm:flex">
-                      <p className="text-sm font-medium text-indigo-600 truncate flex items-center hover:underline cursor-pointer">
-                        <svg className="h-4 w-4 mr-1" fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-                          <polyline points="2 14.308 5.076 14.308 8.154 2 11.231 20.462 14.308 9.692 15.846 14.308 18.924 14.308" />
-                          <circle cx="20.462" cy="14.308" r="1.538" />
-                        </svg>
-                        View Trace
-                      </p>
-                    </div>
-                    <div className="mt-2 flex items-center text-sm text-gray-500 sm:mt-0">
-                      <svg className="h-4 w-4 mr-1" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                        <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
-                      </svg>
-                      {tr.end_time ? latencyStr(tr.end_time - tr.start_time) : "Unknown"}
-                    </div>
-                  </div>
-                </div>
-              </li>
-            })}
-          </ul>
-        </div>
-
-      </div>
-    )
-  }
-}
-
-interface TraceViewProps {
-  trace: Trace;
-  close: () => void;
-}
-
-interface TraceViewState {
-  selected: Request;
-}
-
-class TraceView extends React.Component<TraceViewProps, TraceViewState> {
-  constructor(props: TraceViewProps) {
-    super(props)
-    this.state = {
-      selected: props.trace.root
-    }
-  }
-
-  render() {
-    const tr = this.props.trace
-    const dt = timeToDate(tr.date)!
-
-    return (
-      <section className="bg-white flex-grow flex items-stretch h-full relative">
-        <div className="absolute -top-2 -right-2">
-          <div className="hover:bg-gray-100 rounded-full p-1 cursor-pointer"
-              onClick={() => this.props.close()}>
-            <svg className="h-5 w-5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-              <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M6 18L18 6M6 6l12 12" />
-            </svg>
-          </div>
-        </div>
-
-        <div className="flex-grow flex flex-col overflow-scroll">
-          <div className="flex p-4 border-b border-gray-100">
-            <div className="flex-shrink-0 mr-4">
-              <h1 className="text-2xl font-bold leading-none text-gray-900 mb-1">
-                Trace Details
-              </h1>
-              <table className="text-sm">
-                <tbody>
-                  <tr>
-                    <th className="text-left text-sm font-light text-gray-400 pr-2">Recorded</th>
-                    <td>{dt.toFormat("ff")}</td>
-                  </tr>
-                  {tr.auth !== null && <>
-                    <tr className="text-left font-normal">
-                      <th className="text-left text-sm font-light text-gray-400 pr-2">User ID</th>
-                      <td className="font-mono">{JSON.parse(decodeBase64(tr.auth.outputs[0]))}</td>
-                    </tr>
-                  </>}
-                </tbody>
-              </table>
-            </div>
-            <div className="flex-grow">
-              <TraceMap trace={this.props.trace!} selected={this.state.selected}
-                  onSelect={(req: Request) => this.setState({selected: req})} />
-            </div>
-          </div>
-
-          <div className="flex flex-col mt-4">
-            <SpanList trace={tr} selected={this.state.selected}
-                onSelect={(req: Request) => this.setState({selected: req})} />
-          </div>
-        </div>
-
-        <div className="flex-shrink-0 w-96 md:w-1/2 p-4 border-l border-gray-100 overflow-scroll">
-          <SpanDetail req={this.state.selected!} trace={tr} />
-        </div>
-      </section>
-    )
-  }
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/icons.tsx b/cli/daemon/dash/dashapp/src/components/icons.tsx
deleted file mode 100644
index a317eaa675..0000000000
--- a/cli/daemon/dash/dashapp/src/components/icons.tsx
+++ /dev/null
@@ -1,332 +0,0 @@
-import React from "react"
-export type Icon = (cls?: string, title?: string) => JSX.Element
-
-export const commit: Icon = (cls, title): JSX.Element => 
-  <svg className={cls} fill="currentColor" viewBox="0 0 896 1024">
-    {renderTitle(title)}
-    <path d="M694.875 448C666.375 337.781 567.125 256 448 256c-119.094 0-218.375 81.781-246.906 192H0v128h201.094C229.625 686.25 328.906 768 448 768c119.125 0 218.375-81.75 246.875-192H896V448H694.875zM448 640c-70.656 0-128-57.375-128-128 0-70.656 57.344-128 128-128 70.625 0 128 57.344 128 128C576 582.625 518.625 640 448 640z" />
-  </svg>
-
-export const lightningBolt: Icon = (cls, title) => 
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" stroke="currentColor" viewBox="0 0 24 24">
-    {renderTitle(title)}
-    <path d="M13 10V3L4 14h7v7l9-11h-7z" />
-  </svg>
-
-export const lightBulb: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M9.663 17h4.673M12 3v1m6.364 1.636l-.707.707M21 12h-1M4 12H3m3.343-5.657l-.707-.707m2.828 9.9a5 5 0 117.072 0l-.548.547A3.374 3.374 0 0014 18.469V19a2 2 0 11-4 0v-.531c0-.895-.356-1.754-.988-2.386l-.548-.547z" />
-  </svg>
-
-export const code: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" stroke="currentColor" viewBox="0 0 24 24">
-    {renderTitle(title)}
-    <path d="M10 20l4-16m4 4l4 4-4 4M6 16l-4-4 4-4" />
-  </svg>
-
-export const cloud: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" stroke="currentColor" viewBox="0 0 24 24">
-    {renderTitle(title)}
-    <path d="M 8 18.999 C 4.151 19.002 1.743 14.837 3.665 11.502 C 4.396 10.234 5.645 9.35 7.084 9.083 C 7.795 5.299 12.336 3.703 15.258 6.211 C 16.121 6.952 16.706 7.965 16.916 9.083 C 20.699 9.802 22.285 14.346 19.771 17.263 C 18.825 18.36 17.449 18.994 16 18.999 Z" />
-  </svg>
-
-export const cloudUpload: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M8 17a5 5 0 01-.916-9.916 5.002 5.002 0 019.832 0A5.002 5.002 0 0116 17m-7-5l3-3m0 0l3 3m-3-3v12" />
-  </svg>
-
-export const document: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" stroke="currentColor" viewBox="0 0 24 24">
-    {renderTitle(title)}
-    <path d="M7 21h10a2 2 0 002-2V9.414a1 1 0 00-.293-.707l-5.414-5.414A1 1 0 0012.586 3H7a2 2 0 00-2 2v14a2 2 0 002 2z" />
-  </svg>
-
-export const documentReport: Icon = (cls, title) => 
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" stroke="currentColor" viewBox="0 0 24 24">
-    {renderTitle(title)}
-    <path d="M9 17v-2m3 2v-4m3 4v-6m2 10H7a2 2 0 01-2-2V5a2 2 0 012-2h5.586a1 1 0 01.707.293l5.414 5.414a1 1 0 01.293.707V19a2 2 0 01-2 2z" />
-  </svg>
-
-export const documentDuplicate: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" stroke="currentColor" viewBox="0 0 24 24">
-    {renderTitle(title)}
-    <path d="M8 7v8a2 2 0 002 2h6M8 7V5a2 2 0 012-2h4.586a1 1 0 01.707.293l4.414 4.414a1 1 0 01.293.707V15a2 2 0 01-2 2h-2M8 7H6a2 2 0 00-2 2v10a2 2 0 002 2h8a2 2 0 002-2v-2" />
-  </svg>
-
-export const solidDocument: Icon = (cls, title) =>
-  <svg className={cls} fill="currentColor" viewBox="0 0 24 24 ">
-    {renderTitle(title)}
-    <path fillRule="evenodd" d="M4 4a2 2 0 012-2h4.586A2 2 0 0112 2.586L15.414 6A2 2 0 0116 7.414V16a2 2 0 01-2 2H6a2 2 0 01-2-2V4z" clipRule="evenodd" />
-  </svg>
-
-export const pencil: Icon = (cls, title) => 
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" stroke="currentColor" viewBox="0 0 24 24">
-    {renderTitle(title)}
-    <path d="M15.232 5.232l3.536 3.536m-2.036-5.036a2.5 2.5 0 113.536 3.536L6.5 21.036H3v-3.572L16.732 3.732z" />
-  </svg>
-
-export const merge: Icon = (cls, title) =>
-  <svg className={cls} fill="currentColor" viewBox="0 0 768 1024">
-    {renderTitle(title)}
-    <path d="M640 448c-47.625 0-88.625 26.312-110.625 64.906C523.625 512.5 518 512 512 512c-131.062 0-255.438-99.844-300.812-223.438C238.469 265.09400000000005 256 230.71900000000005 256 192c0-70.656-57.344-128-128-128S0 121.34400000000005 0 192c0 47.219 25.844 88.062 64 110.281V721.75C25.844 743.938 0 784.75 0 832c0 70.625 57.344 128 128 128s128-57.375 128-128c0-47.25-25.844-88.062-64-110.25V491.469C276.156 580.5 392.375 640 512 640c6.375 0 11.625-0.438 17.375-0.625C551.5 677.812 592.5 704 640 704c70.625 0 128-57.375 128-128C768 505.344 710.625 448 640 448zM128 896c-35.312 0-64-28.625-64-64 0-35.312 28.688-64 64-64 35.406 0 64 28.688 64 64C192 867.375 163.406 896 128 896zM128 256c-35.312 0-64-28.594-64-64s28.688-64 64-64c35.406 0 64 28.594 64 64S163.406 256 128 256zM640 640c-35.312 0-64-28.625-64-64 0-35.406 28.688-64 64-64 35.375 0 64 28.594 64 64C704 611.375 675.375 640 640 640z"/>
-  </svg>
-
-export const calendar: Icon = (cls, title) =>
-  <svg className={cls} fill="currentColor" viewBox="0 0 20 20">
-    {renderTitle(title)}
-    <path fillRule="evenodd" d="M6 2a1 1 0 00-1 1v1H4a2 2 0 00-2 2v10a2 2 0 002 2h12a2 2 0 002-2V6a2 2 0 00-2-2h-1V3a1 1 0 10-2 0v1H7V3a1 1 0 00-1-1zm0 5a1 1 0 000 2h8a1 1 0 100-2H6z" clipRule="evenodd"/>
-  </svg>
-
-export const search: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" stroke="currentColor" viewBox="0 0 24 24">
-    {renderTitle(title)}
-    <path d="M21 21l-6-6m2-5a7 7 0 11-14 0 7 7 0 0114 0z" />
-  </svg>
-
-export const chevronDown: Icon = (cls, title) =>
-  <svg className={cls} fill="currentColor" viewBox="0 0 20 20">
-    {renderTitle(title)}
-    <path fillRule="evenodd" d="M5.293 7.293a1 1 0 011.414 0L10 10.586l3.293-3.293a1 1 0 111.414 1.414l-4 4a1 1 0 01-1.414 0l-4-4a1 1 0 010-1.414z" clipRule="evenodd"/>
-  </svg>
-
-export const chevronRight: Icon = (cls, title) =>
-  <svg className={cls} fill="currentColor" viewBox="0 0 20 20">
-    {renderTitle(title)}
-    <path transform="rotate(-90 10 10)" fillRule="evenodd" d="M5.293 7.293a1 1 0 011.414 0L10 10.586l3.293-3.293a1 1 0 111.414 1.414l-4 4a1 1 0 01-1.414 0l-4-4a1 1 0 010-1.414z" clipRule="evenodd"/>
-  </svg>
-
-export const x: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" stroke="currentColor" viewBox="0 0 24 24">
-    {renderTitle(title)}
-    <path d="M6 18L18 6M6 6l12 12" />
-  </svg>
-
-export const check: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M5 13l4 4L19 7" />
-  </svg>
-
-export const checkCircle: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M9 12l2 2 4-4m6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
-  </svg>
-
-export const xCircle: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M10 14l2-2m0 0l2-2m-2 2l-2-2m2 2l2 2m7-2a9 9 0 11-18 0 9 9 0 0118 0z" />
-  </svg>
-
-export const exclamation: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
-  </svg>
-
-export const exclamationCircle: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M12 8v4m0 4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
-  </svg>
-
-export const playCircle: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M14.752 11.168l-3.197-2.132A1 1 0 0010 9.87v4.263a1 1 0 001.555.832l3.197-2.132a1 1 0 000-1.664z" />
-  </svg>
-
-export const questionMarkCircle: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M8.228 9c.549-1.165 2.03-2 3.772-2 2.21 0 4 1.343 4 3 0 1.4-1.278 2.575-3.006 2.907-.542.104-.994.54-.994 1.093m0 3h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
-  </svg>
-
-export const dotsCircle: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M8 12h.01M12 12h.01M16 12h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
-  </svg>
-
-export const plusCircle: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M12 9v3m0 0v3m0-3h3m-3 0H9m12 0a9 9 0 11-18 0 9 9 0 0118 0z" />
-  </svg>
-
-export const minusCircle: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M15 12H9m12 0a9 9 0 11-18 0 9 9 0 0118 0z" />
-  </svg>
-
-export const refresh: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M4 4v5h.582m15.356 2A8.001 8.001 0 004.582 9m0 0H9m11 11v-5h-.581m0 0a8.003 8.003 0 01-15.357-2m15.357 2H15" />
-  </svg>
-
-export const chip: Icon = (cls, title) =>
-  <svg className={cls} viewBox="0 0 20 20" fill="currentColor">
-    {renderTitle(title)}
-    <path d="M13 7H7v6h6V7z" />
-    <path fillRule="evenodd" d="M7 2a1 1 0 012 0v1h2V2a1 1 0 112 0v1h2a2 2 0 012 2v2h1a1 1 0 110 2h-1v2h1a1 1 0 110 2h-1v2a2 2 0 01-2 2h-2v1a1 1 0 11-2 0v-1H9v1a1 1 0 11-2 0v-1H5a2 2 0 01-2-2v-2H2a1 1 0 110-2h1V9H2a1 1 0 010-2h1V5a2 2 0 012-2h2V2zM5 5h10v10H5V5z" clipRule="evenodd" />
-  </svg>
-
-export const clock: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
-  </svg>
-
-export const puzzle: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M11 4a2 2 0 114 0v1a1 1 0 001 1h3a1 1 0 011 1v3a1 1 0 01-1 1h-1a2 2 0 100 4h1a1 1 0 011 1v3a1 1 0 01-1 1h-3a1 1 0 01-1-1v-1a2 2 0 10-4 0v1a1 1 0 01-1 1H7a1 1 0 01-1-1v-3a1 1 0 00-1-1H4a2 2 0 110-4h1a1 1 0 001-1V7a1 1 0 011-1h3a1 1 0 001-1V4z" />
-  </svg>
-
-export const filter: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M3 4a1 1 0 011-1h16a1 1 0 011 1v2.586a1 1 0 01-.293.707l-6.414 6.414a1 1 0 00-.293.707V17l-4 4v-6.586a1 1 0 00-.293-.707L3.293 7.293A1 1 0 013 6.586V4z" />
-  </svg>
-
-export const slash: Icon = (cls, title) =>
-  <svg className={cls} viewBox="0 0 24 24" stroke="currentColor" strokeWidth="1" strokeLinecap="round" strokeLinejoin="round" fill="none" shapeRendering="geometricPrecision">
-    {renderTitle(title)}
-    <path d="M16.88 3.549L7.12 20.451" />
-  </svg>
-
-export const selector: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M8 9l4-4 4 4m0 6l-4 4-4-4" />
-  </svg>
-
-export const user: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M16 7a4 4 0 11-8 0 4 4 0 018 0zM12 14a7 7 0 00-7 7h14a7 7 0 00-7-7z" />
-  </svg>
-
-export const userAdd: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M18 9v3m0 0v3m0-3h3m-3 0h-3m-2-5a4 4 0 11-8 0 4 4 0 018 0zM3 20a6 6 0 0112 0v1H3v-1z" />
-  </svg>
-
-export const userRemove: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M13 7a4 4 0 11-8 0 4 4 0 018 0zM9 14a6 6 0 00-6 6v1h12v-1a6 6 0 00-6-6zM21 12h-6" />
-  </svg>
-
-export const userCircle: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M5.121 17.804A13.937 13.937 0 0112 16c2.5 0 4.847.655 6.879 1.804M15 10a3 3 0 11-6 0 3 3 0 016 0zm6 2a9 9 0 11-18 0 9 9 0 0118 0z" />
-  </svg>
-
-export const logout: Icon = (cls, title) =>
-  <svg className={cls} viewBox="0 0 20 20" fill="currentColor">
-    {renderTitle(title)}
-    <path fillRule="evenodd" d="M3 3a1 1 0 00-1 1v12a1 1 0 102 0V4a1 1 0 00-1-1zm10.293 9.293a1 1 0 001.414 1.414l3-3a1 1 0 000-1.414l-3-3a1 1 0 10-1.414 1.414L14.586 9H7a1 1 0 100 2h7.586l-1.293 1.293z" clipRule="evenodd" />
-  </svg>
-
-export const key: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M15 7a2 2 0 012 2m4 0a6 6 0 01-7.743 5.743L11 17H9v2H7v2H4a1 1 0 01-1-1v-2.586a1 1 0 01.293-.707l5.964-5.964A6 6 0 1121 9z" />
-  </svg>
-
-export const wrench: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <path d="M 10.78 9.805 L 1.5 19.009 L 4.999 22.497 L 14.26 13.209 C 16.438 14.027 19.205 13.797 20.962 12.048 C 22.858 10.158 22.853 6.986 21.75 4.699 L 17.657 8.779 L 15.205 6.336 L 19.298 2.256 C 17.014 1.146 13.811 1.141 11.916 3.03 C 10.133 4.807 9.911 7.605 10.78 9.805 Z" />
-  </svg>
-
-export const database: Icon = (cls, title) =>
-  <svg className={cls} viewBox="0 0 20 20" fill="currentColor">
-    {renderTitle(title)}
-    <path d="M3 12v3c0 1.657 3.134 3 7 3s7-1.343 7-3v-3c0 1.657-3.134 3-7 3s-7-1.343-7-3z" />
-    <path d="M3 7v3c0 1.657 3.134 3 7 3s7-1.343 7-3V7c0 1.657-3.134 3-7 3S3 8.657 3 7z" />
-    <path d="M17 5c0 1.657-3.134 3-7 3S3 6.657 3 5s3.134-3 7-3 7 1.343 7 3z" />
-  </svg>
-
-export const errCircle: Icon = (cls, title) =>
-  <svg className={cls} viewBox="0 0 20 20" fill="currentColor">
-    {renderTitle(title)}
-    <path fillRule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zM8.707 7.293a1 1 0 00-1.414 1.414L8.586 10l-1.293 1.293a1 1 0 101.414 1.414L10 11.414l1.293 1.293a1 1 0 001.414-1.414L11.414 10l1.293-1.293a1 1 0 00-1.414-1.414L10 8.586 8.707 7.293z" clipRule="evenodd" />
-  </svg>
-
-export const photograph: Icon = (cls, title) =>
-  <svg className={cls} viewBox="0 0 20 20" fill="currentColor">
-    {renderTitle(title)}
-    <path fillRule="evenodd" d="M4 3a2 2 0 00-2 2v10a2 2 0 002 2h12a2 2 0 002-2V5a2 2 0 00-2-2H4zm12 12H4l4-8 3 6 2-4 3 6z" clipRule="evenodd" />
-  </svg>
-
-export const pulse: Icon = (cls, title) =>
-  <svg className={cls} fill="none" strokeLinecap="round" strokeLinejoin="round" strokeWidth="2" viewBox="0 0 24 24" stroke="currentColor">
-    {renderTitle(title)}
-    <polyline points="2 14.308 5.076 14.308 8.154 2 11.231 20.462 14.308 9.692 15.846 14.308 18.924 14.308" />
-    <circle cx="20.462" cy="14.308" r="1.538" />
-  </svg>
-
-export const githubLogo: Icon = (cls, title) =>
-  <svg className={cls} viewBox="0 0 16 16" fill="currentColor">
-    {renderTitle(title)}
-    <path fillRule="evenodd" d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z" />
-  </svg>
-
-export const azureLogo: Icon = (cls, title) =>
-  <svg className={cls} viewBox="0 0 19.7 15.2" fill="currentColor">
-    {renderTitle(title)}
-    <path d="M 9.105 14.431 C 11.634 13.984 13.723 13.614 13.747 13.609 L 13.79 13.6 L 11.403 10.76 C 10.09 9.199 9.016 7.915 9.016 7.907 C 9.016 7.893 11.481 1.105 11.495 1.081 C 11.499 1.073 13.177 3.969 15.561 8.102 C 17.793 11.971 19.634 15.161 19.651 15.191 L 19.682 15.245 L 12.095 15.244 L 4.508 15.243 L 9.105 14.431 Z M 0 13.565 C 0 13.561 1.125 11.608 2.5 9.225 L 5 4.893 L 7.913 2.448 C 9.515 1.104 10.83 0.002 10.836 0 C 10.841 -0.002 10.82 0.051 10.789 0.118 C 10.758 0.185 9.334 3.238 7.625 6.903 L 4.518 13.566 L 2.259 13.569 C 1.017 13.571 0 13.569 0 13.565 Z" />
-  </svg>
-
-export const encoreLogo: Icon = (cls, title) =>
-  <svg className={cls} viewBox="0 0 243 203" fill="currentColor">
-    {renderTitle(title)}
-    <path fillRule="evenodd" d="M0,175 C0,82.9190589 73,0 175,0 C175,0 175,67 175,67 C111.870929,67 67,117.841363 67,175 C66.8660649,175 0,175 0,175 Z" />
-    <path fillRule="evenodd" d="M175.279086,107.763158 C214.190992,107.763158 242.731481,138.782778 242.731481,175.001086 C242.800404,196.117137 201.758492,202.631579 175.11111,202.631579 C148.463728,202.631579 107.615418,196.151462 107.546296,175.001086 C107.546296,138.251969 136.367179,107.763158 175.279086,107.763158 Z" />
-  </svg>
-
-export const gcpLogo: Icon = (cls, title) =>
-  <svg className={cls} viewBox="0 0 18 14.5">
-    {renderTitle(title)}
-    <path fill="#EA4335" d="M 11.414 3.993 L 11.963 3.993 L 13.527 2.428 L 13.604 1.764 C 10.692 -0.807 6.248 -0.529 3.678 2.383 C 2.963 3.191 2.446 4.154 2.163 5.195 C 2.337 5.124 2.53 5.112 2.712 5.163 L 5.841 4.646 C 5.841 4.646 6 4.383 6.083 4.399 C 7.474 2.87 9.817 2.692 11.425 3.993 L 11.414 3.993 Z" />
-    <path fill="#4285F4" d="M 15.757 5.195 C 15.397 3.871 14.659 2.68 13.632 1.77 L 11.437 3.966 C 12.364 4.723 12.892 5.865 12.869 7.062 L 12.869 7.452 C 13.949 7.452 14.824 8.328 14.824 9.407 C 14.824 10.486 13.949 11.362 12.869 11.362 L 8.96 11.362 L 8.57 11.757 L 8.57 14.102 L 8.96 14.492 L 12.869 14.492 C 15.677 14.514 17.97 12.255 17.992 9.448 C 18.005 7.743 17.165 6.148 15.757 5.195 Z" />
-    <path fill="#34A853" d="M 5.046 14.467 L 8.955 14.467 L 8.955 11.338 L 5.046 11.338 C 4.767 11.338 4.492 11.277 4.238 11.162 L 3.69 11.333 L 2.114 12.897 L 1.977 13.446 C 2.86 14.114 3.938 14.472 5.046 14.467 Z" />
-    <path fill="#FBBC05" d="M 5.046 4.317 C 2.237 4.333 -0.024 6.623 -0.008 9.431 C 0.002 10.999 0.733 12.475 1.977 13.43 L 4.244 11.163 C 3.261 10.719 2.823 9.56 3.267 8.577 C 3.711 7.594 4.869 7.156 5.853 7.6 C 6.286 7.796 6.633 8.144 6.829 8.577 L 9.096 6.31 C 8.133 5.048 6.633 4.31 5.046 4.317 Z" />
-  </svg>
-
-export const loading = (cls: string, color: string, baseColor: string, borderWidth: number) => (
-  <>
-    <style>{`
-      .loading {
-        -webkit-animation: spinner 0.5s linear infinite;
-        animation: spinner 0.5s linear infinite;
-        border-color: ${baseColor};
-      }
-
-      @-webkit-keyframes spinner {
-        0% { -webkit-transform: rotate(0deg); }
-        100% { -webkit-transform: rotate(360deg); }
-      }
-
-      @keyframes spinner {
-        0% { transform: rotate(0deg); }
-        100% { transform: rotate(360deg); }
-      }
-    `}</style>
-    <div className={`inline-block ${cls} border-transparent loading ease-linear rounded-full`}
-        style={{borderWidth, borderTopColor: color}} />
-  </>
-)
-
-const renderTitle = (title?: string) => (
-  title && <title>{title}</title>
-)
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/trace/SpanDetail.tsx b/cli/daemon/dash/dashapp/src/components/trace/SpanDetail.tsx
deleted file mode 100644
index f5b976ff4b..0000000000
--- a/cli/daemon/dash/dashapp/src/components/trace/SpanDetail.tsx
+++ /dev/null
@@ -1,430 +0,0 @@
-import { FunctionComponent, useState, useRef, useEffect } from "react"
-import { Request, Trace, Event, DBTransaction, DBQuery, TraceExpr, RPCCall, AuthCall, HTTPCall } from "./model"
-import { latencyStr, svcColor } from "./util"
-import * as icons from "~c/icons"
-import { decodeBase64, Base64EncodedBytes } from "~lib/base64"
-import React from "react"
-
-interface Props {
-  trace: Trace;
-  req: Request;
-}
-
-const SpanDetail: FunctionComponent<Props> = (props) => {
-  const req = props.req
-  const defLoc = props.trace.locations[req.def_loc]
-  const callLoc = req.call_loc !== null ? props.trace.locations[req.call_loc] : null
-
-  const numCalls = req.children.length
-  let numQueries = 0
-  for (const e of req.events) {
-    if (e.type === "DBQuery" ) { numQueries++ }
-    else if (e.type === "DBTransaction" ) { numQueries += e.queries.length }
-  }
-
-  let svcName = "unknown", rpcName = "Unknown"
-  if ("rpc_def" in defLoc) {
-    svcName = defLoc.rpc_def.service_name
-    rpcName = defLoc.rpc_def.rpc_name
-  } else if ("auth_handler_def" in defLoc) {
-    svcName = defLoc.auth_handler_def.service_name
-    rpcName = defLoc.auth_handler_def.name
-  }
-
-  return <>
-    <div>
-      <h2 className="text-2xl font-bold">{svcName}.{rpcName}</h2>
-      <div className="text-xs">
-        <span className="text-blue-700">
-          {defLoc.filepath}:{defLoc.src_line_start}
-        </span>
-        {callLoc !== null &&
-          <span className="text-gray-400">{" "}
-            (Called from <span className="text-blue-700">{callLoc.filepath}:{callLoc.src_line_start}</span>)
-          </span>
-        }
-      </div>
-
-      <div className="py-3 grid grid-cols-3 gap-4 border-b border-gray-100">
-        <div className="flex items-center text-sm font-light text-gray-400">
-          {icons.clock("h-5 w-auto")}
-          <span className="font-bold mx-1 text-gray-800">{req.end_time ? latencyStr(req.end_time - req.start_time) : "Unknown"}</span>
-          Duration
-        </div>
-
-        <div className="flex items-center text-sm font-light text-gray-400">
-          {icons.logout("h-5 w-auto")}
-          <span className="font-bold mx-1 text-gray-800">{numCalls}</span>
-          API Call{numCalls !== 1 ? "s" : ""}
-        </div>
-
-        <div className="flex items-center text-sm font-light text-gray-400">
-          {icons.database("h-5 w-auto")}
-          <span className="font-bold mx-1 text-gray-800">{numQueries}</span>
-          DB Quer{numQueries !== 1 ? "ies" : "y"}
-        </div>
-      </div>
-
-      <div>
-        <div className="mt-6">
-          <EventMap trace={props.trace} req={req} />
-        </div>
-
-        {req.type === "AUTH" ? (
-          req.err !== null ? (
-            <div className="mt-4">
-              <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Error</h4>
-              <pre className="rounded overflow-auto border border-gray-200 p-2 bg-gray-100 text-red-800 text-sm">{decodeBase64(req.err)}</pre>
-            </div>
-          ) : (
-            <>
-              <div className="mt-6">
-                <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">User ID</h4>
-                {renderData([req.outputs[0]])}
-              </div>
-              {req.outputs.length > 1 &&
-                <div className="mt-4">
-                  <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">User Data</h4>
-                  {renderData([req.outputs[1]])}
-                </div>
-              }
-            </>
-          )
-        ) : <>
-          <div className="mt-6">
-            <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Request</h4>
-            {req.inputs.length > 0 ? renderData(req.inputs) : <div className="text-gray-700 text-sm">No request data.</div>}
-          </div>
-          {req.err !== null ? (
-            <div className="mt-4">
-              <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Error</h4>
-              <pre className="rounded overflow-auto border border-gray-200 p-2 bg-gray-100 text-red-800 text-sm">{decodeBase64(req.err)}</pre>
-            </div>
-          ) : (
-            <div className="mt-4">
-              <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Response</h4>
-              {req.outputs.length > 0 ? renderData(req.outputs) : <div className="text-gray-700 text-sm">No response data.</div>}
-            </div>
-          )}
-        </>}
-      </div>
-
-    </div>
-  </>
-}
-
-export default SpanDetail
-
-type gdata = {goid: number, start: number, end: number | undefined, events: Event[]}
-
-const EventMap: FunctionComponent<{req: Request, trace: Trace}> = (props) => {
-  const req = props.req
-
-  // Compute the list of interesting goroutines
-  const gmap: {[key: number]: gdata} = {
-    [req.goid]: {
-      goid: req.goid,
-      start: req.start_time,
-      end: req.end_time,
-      events: [],
-    }
-  }
-  const gnums: number[] = [req.goid]
-
-  for (const ev of req.events) {
-    if (ev.type === "Goroutine") {
-      gmap[ev.goid] = { goid: ev.goid, start: ev.start_time, end: ev.end_time, events: [] }
-      gnums.push(ev.goid)
-    } else if (ev.type === "DBTransaction") {
-      let g = gmap[ev.goid]
-      g.events = g.events.concat(ev.queries)
-    } else {
-      gmap[ev.goid].events.push(ev)
-    }
-  }
-
-  const lines = gnums.map(n => gmap[n]).filter(g => (g.events.length > 0 || g.goid === req.goid))
-  return (
-    <div>
-      <div className="flex items-center text-xs font-light text-gray-400 mb-1">
-        {icons.chip("h-4 w-auto")}
-        <span className="font-bold mx-1 text-gray-800">{lines.length}</span>
-        Goroutine{lines.length !== 1 ? "s" : ""}
-      </div>
-      {lines.map((g, i) => 
-        <div key={g.goid} className={i > 0 ? "mt-1" : ""}>
-          <GoroutineDetail key={g.goid} g={g} req={req} trace={props.trace} />
-        </div>
-      )}
-    </div>
-  )
-}
-
-const GoroutineDetail: FunctionComponent<{g: gdata, req: Request, trace: Trace}> = (props) => {
-  const req = props.req
-  const reqDur = req.end_time! - req.start_time
-  const start = Math.round((props.g.start - req.start_time) / reqDur * 100)
-  const end = Math.round((props.g.end! - req.start_time) / reqDur * 100)
-  const g = props.g
-  const gdur = g.end! - g.start
-  const lineHeight = 18
-
-  const tooltipRef = useRef<HTMLDivElement>(null)
-  const goroutineEl = useRef<HTMLDivElement>(null)
-  const [hoverObj, setHoverObj] = useState<Request | Event | null>(null)
-  const [barOver, setBarOver] = useState(false)
-  const [tooltipOver, setTooltipOver] = useState(false)
-
-  const setHover = (ev: React.MouseEvent, obj: Request | Event | null) => {
-    if (obj === null) {
-      setBarOver(false)
-      return
-    }
-
-    const el = tooltipRef.current
-    if (!el) {
-      return
-    }
-
-    setBarOver(true)
-    setHoverObj(obj)
-    const spanEl = (ev.target as HTMLElement)
-    el.style.marginTop = `calc(${spanEl.offsetTop}px - 40px)`;
-    el.style.marginLeft = `calc(${spanEl.offsetLeft}px)`;
-  }
-
-  return <>
-    <div className="relative" style={{height: lineHeight+"px"}}>
-      <div ref={goroutineEl} className={`absolute bg-gray-600`}
-        style={{
-          borderRadius: "3px",
-          height: lineHeight + "px",
-          left: start+"%", right: (100-end)+"%",
-          minWidth: "1px", // so it at least renders
-        }}>
-
-        {g.events.map((ev, i) => {
-          const start = Math.round((ev.start_time - g.start) / gdur * 100)
-          const end = Math.round((ev.end_time! - g.start) / gdur * 100)
-          const clsid = `ev-${req.id}-${g.goid}-${i}`
-
-          if (ev.type === "DBQuery") {
-            const [color, highlightColor] = svcColor(ev.txid !== null ? ("tx:"+ev.txid) : ("query:"+ev.start_time))
-            return <React.Fragment key={i}>
-              <style>{`
-                .${clsid}       { background-color: ${highlightColor}; }
-                .${clsid}:hover { background-color: ${color}; }
-              `}</style>
-              <div className={`absolute ${clsid}`}
-                onMouseEnter={(e) => setHover(e, ev)}
-                onMouseLeave={(e) => setHover(e, null)}
-                style={{
-                  borderRadius: "3px",
-                  top: "3px", bottom: "3px",
-                  left: start+"%", right: (100-end)+"%",
-                  minWidth: "1px" // so it at least renders if start === stop
-                }} />
-              </React.Fragment>
-          } else if (ev.type === "RPCCall") {
-            const defLoc = props.trace.locations[ev.def_loc]
-            let svcName = "unknown"
-            if ("rpc_def" in defLoc) {
-              svcName = defLoc.rpc_def.service_name
-            }
-            const [color, highlightColor] = svcColor(svcName)
-            return <React.Fragment key={i}>
-              <style>{`
-                .${clsid}       { background-color: ${highlightColor}; }
-                .${clsid}:hover { background-color: ${color}; }
-              `}</style>
-              <div className={`absolute ${clsid}`}
-                onMouseEnter={(e) => setHover(e, ev)}
-                onMouseLeave={(e) => setHover(e, null)}
-                style={{
-                  borderRadius: "3px",
-                  top: "3px", bottom: "3px",
-                  left: start+"%", right: (100-end)+"%",
-                  minWidth: "1px" // so it at least renders if start === stop
-                }}
-              />
-            </React.Fragment>
-          } else if (ev.type === "HTTPCall") {
-            const [color, highlightColor] = svcColor(ev.url)
-            return <React.Fragment key={i}>
-              <style>{`
-                .${clsid}       { background-color: ${highlightColor}; }
-                .${clsid}:hover { background-color: ${color}; }
-              `}</style>
-              <div className={`absolute ${clsid}`}
-                onMouseEnter={(e) => setHover(e, ev)}
-                onMouseLeave={(e) => setHover(e, null)}
-                style={{
-                  borderRadius: "3px",
-                  top: "3px", bottom: "3px",
-                  left: start+"%", right: (100-end)+"%",
-                  minWidth: "1px" // so it at least renders if start === stop
-                }}
-              />
-            </React.Fragment>
-          }
-        })}
-      </div>
-
-    </div>
-    <div ref={tooltipRef} className="absolute w-full max-w-md pr-2 z-30 transform -translate-x-full"
-        style={{paddingRight: "10px" /* extra padding to make it easier to hover into the tooltip */}}
-        onMouseEnter={() => setTooltipOver(true)} onMouseLeave={() => setTooltipOver(false)}>
-      {(barOver || tooltipOver) && 
-        <div className="bg-white w-full p-3 border border-gray-100 rounded-md shadow-lg">
-          {hoverObj && "type" in hoverObj && (
-            hoverObj.type === "DBQuery" ? <DBQueryTooltip q={hoverObj} trace={props.trace} /> :
-            hoverObj.type === "RPCCall" ? <RPCCallTooltip call={hoverObj as RPCCall} req={req} trace={props.trace} /> :
-            hoverObj.type === "HTTPCall" ? <HTTPCallTooltip call={hoverObj as HTTPCall} req={req} trace={props.trace} /> :
-            null)}
-        </div>
-      }
-    </div>
-  </>
-}
-
-const DBQueryTooltip: FunctionComponent<{q: DBQuery, trace: Trace}> = (props) => {
-  const q = props.q
-  return <div>
-    <h3 className="flex items-center text-gray-800 font-bold text-lg">
-      {icons.database("h-8 w-auto text-gray-400 mr-2")}
-      DB Query
-      <div className="ml-auto text-sm font-normal text-gray-500">{q.end_time ? latencyStr(q.end_time - q.start_time) : "Unknown"}</div>
-    </h3>
-
-    <div className="mt-4">
-      <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Query</h4>
-      {q.html_query !== null ? (
-        <pre className="rounded overflow-auto border border-gray-200 text-sm p-2"
-            dangerouslySetInnerHTML={{__html: decodeBase64(q.html_query)}} />
-      ) : (
-        <pre className="rounded overflow-auto border border-gray-200 p-2 bg-gray-100 text-gray-800 text-sm">
-          {decodeBase64(q.query)}
-        </pre>
-      )}
-    </div>
-
-    <div className="mt-4">
-      <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Error</h4>
-      {q.err !== null ? (
-        <pre className="rounded overflow-auto border border-gray-200 p-2 bg-gray-100 text-gray-800 text-sm">
-          {decodeBase64(q.err)}
-        </pre>
-      ) : (
-        <div className="text-gray-700 text-sm">Completed successfully.</div>
-      )}
-    </div>
-
-  </div>
-}
-
-const RPCCallTooltip: FunctionComponent<{call: RPCCall, req: Request, trace: Trace}> = (props) => {
-  const c = props.call
-  const target = props.req.children.find(r => r.id === c.req_id)
-  const defLoc = props.trace.locations[c.def_loc]
-  let endpoint: string | null = null
-  if ("rpc_def" in defLoc) {
-    endpoint = `${defLoc.rpc_def.service_name}.${defLoc.rpc_def.rpc_name}`
-  }
-
-  return <div>
-    <h3 className="flex items-center text-gray-800 font-bold text-lg">
-      {icons.logout("h-8 w-auto text-gray-400 mr-2")}
-      API Call
-      {endpoint !== null ? (
-        <span>: {endpoint}</span>
-      ) : (
-        <span className="italic text-sm text-gray-500">Unknown Endpoint</span>
-      )}
-      <div className="ml-auto text-sm font-normal text-gray-500">{c.end_time ? latencyStr(c.end_time - c.start_time) : "Unknown"}</div>
-    </h3>
-
-    <div className="mt-4">
-      <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Request</h4>
-      {target !== undefined ? (
-        target.inputs.length > 0 ? renderData(target.inputs) : <div className="text-gray-700 text-sm">No request data.</div>
-      ) : <div className="text-gray-700 text-sm">Not captured.</div>
-      }
-    </div>
-
-    <div className="mt-4">
-      <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Response</h4>
-      {target !== undefined ? (
-        target.outputs.length > 0 ? renderData(target.outputs) : <div className="text-gray-700 text-sm">No response data.</div>
-      ) : <div className="text-gray-700 text-sm">Not captured.</div>
-      }
-    </div>
-
-    <div className="mt-4">
-      <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Error</h4>
-      {c.err !== null ? (
-        <pre className="rounded overflow-auto border border-gray-200 p-2 bg-gray-100 text-gray-800 text-sm">
-          {decodeBase64(c.err)}
-        </pre>
-      ) : (
-        <div className="text-gray-700 text-sm">Completed successfully.</div>
-      )}
-    </div>
-
-  </div>
-}
-
-const HTTPCallTooltip: FunctionComponent<{call: HTTPCall, req: Request, trace: Trace}> = ({call, req, trace}) => {
-  const m = call.metrics
-  return <div>
-    <h3 className="flex items-center text-gray-800 font-bold text-lg">
-      {icons.logout("h-8 w-auto text-gray-400 mr-2")}
-      HTTP {call.method} {call.host}{call.path}
-      <div className="ml-auto text-sm font-normal text-gray-500">{call.end_time ? latencyStr(call.end_time - call.start_time) : "Unknown"}</div>
-    </h3>
-
-    <div className="mt-4">
-      <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">URL</h4>
-      <pre className="rounded overflow-auto border border-gray-200 p-2 bg-gray-100 text-gray-800 text-sm">{call.url}</pre>
-    </div>
-
-    <div className="mt-4">
-      <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Response</h4>
-      {call.end_time !== -1 ? (
-        <div className="text-gray-700 text-sm">HTTP {call.status_code}</div>
-      ) : (
-        <div className="text-gray-700 text-sm">No response recorded.</div>
-      )}
-    </div>
-
-    <div className="mt-4">
-      <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Error</h4>
-      {call.err !== null ? (
-        <pre className="rounded overflow-auto border border-gray-200 p-2 bg-gray-100 text-gray-800 text-sm">
-          {decodeBase64(call.err)}
-        </pre>
-      ) : (
-        <div className="text-gray-700 text-sm">Completed successfully.</div>
-      )}
-    </div>
-
-    <div className="mt-4">
-      <h4 className="text-xs font-semibold font-sans text-gray-300 leading-3 tracking-wider uppercase mb-2">Timeline</h4>
-      <div className="text-gray-600 text-xs inline-grid grid-cols-2">
-        {m.conn_reused ? <>
-          <span>Reused Connection:</span> <span className="text-right">Yes</span>
-        </> : <>
-          {m.dns_done && <><span>DNS Lookup:</span> <span className="text-right">{latencyStr(m.dns_done - call.start_time)}</span></>}
-          {m.tls_handshake_done && <><span>TLS Handshake:</span> <span className="text-right">{latencyStr(m.tls_handshake_done - (m.dns_done ?? call.start_time))}</span></>}
-        </>}
-        {m.wrote_request && <><span>Wrote Request:</span> <span className="text-right">{latencyStr(m.wrote_request - (m.tls_handshake_done ?? m.got_conn ?? call.start_time))}</span></>}
-        {m.first_response && <><span>Response Start:</span> <span className="text-right">{latencyStr(m.first_response - (m.wrote_headers ?? m.got_conn ?? call.start_time))}</span></>}
-      </div>
-    </div>
-
-  </div>
-}
-
-const renderData = (data: Base64EncodedBytes[]) => {
-  const json = JSON.parse(decodeBase64(data[0]))
-  return <pre className="rounded overflow-auto border border-gray-200 p-2 bg-gray-100 text-gray-800 text-sm">{JSON.stringify(json, undefined, "  ")}</pre>
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/trace/SpanList.tsx b/cli/daemon/dash/dashapp/src/components/trace/SpanList.tsx
deleted file mode 100644
index d2c43f3f4f..0000000000
--- a/cli/daemon/dash/dashapp/src/components/trace/SpanList.tsx
+++ /dev/null
@@ -1,104 +0,0 @@
-import { FunctionComponent, useState } from "react"
-import { Request, Trace } from "./model"
-import { svcColor } from "./util"
-import * as icons from "~c/icons"
-import React from "react"
-
-interface Props {
-  trace: Trace;
-  selected?: Request;
-  onSelect?: (req: Request) => void;
-}
-
-const SpanList: FunctionComponent<Props> = (props) => {
-  const traceDur = props.trace.end_time! - props.trace.start_time
-  const [contracted, setContracted] = useState(new Map<string, boolean>())
-
-  let spanCounter = 0
-  const renderSpan: (req: Request, level: number, siblings: number[]) => JSX.Element = (req, level, siblings) => {
-    const start = Math.round((req.start_time - props.trace.start_time) / traceDur * 100)
-    const end = Math.round((req.end_time! - props.trace.start_time) / traceDur * 100)
-    const defLoc = props.trace.locations[req.def_loc]
-
-    let svcName = "unknown", rpcName = "Unknown"
-    if ("rpc_def" in defLoc) {
-      svcName = defLoc.rpc_def.service_name
-      rpcName = defLoc.rpc_def.rpc_name
-    } else if ("auth_handler_def" in defLoc) {
-      svcName = defLoc.auth_handler_def.service_name
-      rpcName = defLoc.auth_handler_def.name
-    }
-
-    const [color, highlightColor] = svcColor(svcName)
-    const sel = props.selected?.id === req.id 
-
-    const select = () => {
-      if (props.onSelect) props.onSelect(req)
-      contracted.set(req.id, !(contracted.get(req.id) ?? false))
-      setContracted(contracted)
-    }
-
-    const isContracted = contracted.get(req.id) ?? false
-    const showChildren = !isContracted && req.children.length > 0
-    spanCounter++
-    return <React.Fragment key={req.id}>
-      <div className={`flex items-stretch p-4 cursor-pointer ${sel ? "bg-blue-50" : "hover:bg-gray-50"}`} onClick={select}>
-        <TreeHint up={level > 0} down={showChildren} siblings={siblings} level={level} />
-
-        {(isContracted && req.children.length > 0) ?
-          icons.chevronRight("h-4 w-auto ml-1 mr-0.5") :
-          icons.chevronDown("h-4 w-auto ml-1 mr-0.5")
-        }
-
-        <div className="flex flex-grow items-center ml-1">
-          <div className="w-64 flex-shrink-0 text-xs">
-            <div className={`font-semibold ${req.err !== null ? "text-red-700" : "text-gray-800"}`}>
-              {svcName}.{rpcName}
-            </div>
-          </div>
-          <div className="flex-grow flex-shrink min-w-0">
-            <style>{`
-              .spanlist-${spanCounter}       { background-color: ${sel ? highlightColor : color}; }
-              .spanlist-${spanCounter}:hover { background-color: ${highlightColor}; }
-            `}</style>
-            <div className="relative" style={{height: "8px"}}>
-              <div className="absolute inset-x-0 bg-gray-200" style={{height: "1px", top: "3px"}} />
-              <div key={req.id} className={`absolute inset-y-0 spanlist-${spanCounter}`}
-                  style={{
-                    left: start+"%", right: (100-end)+"%",
-                    minWidth: "2px", // so it at least renders if start === stop
-                    borderRadius: "3px",
-                  }} />
-            </div>
-          </div>
-        </div>
-      </div>
-
-      {showChildren && req.children.map((ch, i) =>
-        renderSpan(ch, level+1, siblings.concat(i < (req.children.length-1) ? [level+1] : []))
-      )}
-    </React.Fragment>
-  }
-
-  return (
-    <div>
-      {props.trace.auth && renderSpan(props.trace.auth, 0, [])}
-      {renderSpan(props.trace.root, 0, [])}
-    </div>
-  )
-}
-
-const TreeHint: FunctionComponent<{up: boolean, down: boolean, siblings: number[], level: number}> = (props) => {
-  const lvl = props.level
-  return <div className="-my-4 relative" style={{width: (lvl*10 + 20)+"px"}}>
-    {props.siblings.map(s =>
-      <div key={s} className="bg-gray-200 absolute" style={{top: 0, bottom: 0, width: "1px", left: (s*10)+"px"}} />
-    )}
-
-    {props.up && <div className="bg-gray-200 absolute" style={{left: (lvl*10)+"px", top: 0, bottom: "50%", width: "1px"}} />}
-    <div className="bg-gray-200 absolute" style={{left: (lvl*10)+"px", right: 0, height: "1px", top: "50%"}} />
-    {props.down && <div className="bg-gray-200 absolute" style={{width: "1px", left: (lvl*10 + 10)+"px", top: "50%", bottom: 0}} />}
-  </div>
-}
-
-export default SpanList
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/trace/TraceMap.tsx b/cli/daemon/dash/dashapp/src/components/trace/TraceMap.tsx
deleted file mode 100644
index ee772df3d5..0000000000
--- a/cli/daemon/dash/dashapp/src/components/trace/TraceMap.tsx
+++ /dev/null
@@ -1,115 +0,0 @@
-import { FunctionComponent, useEffect, useState } from "react"
-import { Request, Trace } from "./model"
-import { svcColor } from "./util"
-import React from "react"
-
-interface Props {
-  trace: Trace;
-  selected?: Request;
-  onSelect?: (req: Request) => void;
-}
-
-const TraceMap: FunctionComponent<Props> = (props) => {
-  const root = props.trace.root
-  const traceStart = props.trace.start_time
-  const traceDur = props.trace.end_time! - traceStart
-  const lineHeight = 8
-  const lineGap = 2
-
-  const renderSpan = (req: Request, line: number) => {
-    const start = Math.round((req.start_time - traceStart) / traceDur * 100)
-    const end = Math.round((req.end_time! - traceStart) / traceDur * 100)
-    const defLoc = props.trace.locations[req.def_loc]
-    let svcName = "unknown"
-    if ("rpc_def" in defLoc) {
-      svcName = defLoc.rpc_def.service_name
-    }
-    const [color, highlightColor] = svcColor(svcName)
-    const sel = props.selected?.id === req.id 
-    const select = () => props.onSelect && props.onSelect(req)
-
-    return <React.Fragment key={req.id}>
-      <style>{`
-        .mapspan-${req.id}       { background-color: ${sel ? highlightColor : color}; }
-        .mapspan-${req.id}:hover { background-color: ${highlightColor}; }
-      `}</style>
-      <div key={req.id} className={`absolute mapspan-${req.id}`} onClick={select}
-          style={{
-            borderRadius: "3px",
-            top: (line * (lineHeight + lineGap)) + "px",
-            height: lineHeight + "px",
-            left: start+"%", right: (100-end)+"%",
-            minWidth: "1px" // so it at least renders if start === stop
-          }} />
-    </React.Fragment>
-  }
-
-  let [lines, setLines] = useState<Request[][]>([])
-  let roots = [root]
-  if (props.trace.auth !== null) {
-    roots.push(props.trace.auth)
-  }
-  useEffect(() => setLines(buildTraceMap(roots)), [props.trace])
-
-  return (
-    <div className="relative" style={{height: (lines.length * (lineHeight+lineGap) - lineGap) + "px"}}>
-      {lines.map((line, i) =>
-        line.map((span, j) =>
-          renderSpan(span, i)
-      ))}
-    </div>
-  )
-}
-
-export default TraceMap
-
-// buildTraceMaps computes the layout for the trace map.
-// The result is a two-dimensional array, where the outer array consists of lines
-// and the inner array is a list of non-overlapping spans in that line.
-function buildTraceMap(roots: Request[]): Request[][] {
-  // Layout the spans on the trace map.
-  // For a given span, look for available space in lines through
-  // a naive loop over the spans in lines with idx > x, where x
-  // is the parent's line index.
-  const lines: Request[][] = []
-  const queue = roots.map(r => { return {span: r, minLine: 0} })
-  while (queue.length > 0) {
-    const {span, minLine} = queue.shift()!
-    let spanLine: number | undefined = undefined
-    for (let i = minLine; i < lines.length; i++) {
-      const line = lines[i]
-      const nl = line.length
-
-      // Find an available gap in the line. 
-      for (let j = 0; j < nl; j++) {
-        const start = line[j].start_time
-        const end = line[j].end_time!
-        if (
-          (j === 0 && span.end_time! <= start) || // before first
-          (j === (nl-1) && span.start_time >= end) || // after last
-          (j > 0 && j < (nl-1) && span.start_time >= end && span.end_time! <= line[j+1].start_time) // in gap between spans
-        ) {
-          spanLine = i
-          line.splice(j, 0, span)
-          break
-        }
-      }
-      if (spanLine !== undefined) {
-        break
-      }
-    }
-
-    if (spanLine === undefined) {
-      // Add a new line to accommodate it
-      lines.push([span])
-      spanLine = lines.length - 1
-    }
-
-    // Add all child spans to the queue
-    for (const child of span.children) {
-      queue.push({span: child, minLine: spanLine+1})
-    }
-  }
-
-  return lines
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/trace/model.ts b/cli/daemon/dash/dashapp/src/components/trace/model.ts
deleted file mode 100644
index eba8545a14..0000000000
--- a/cli/daemon/dash/dashapp/src/components/trace/model.ts
+++ /dev/null
@@ -1,153 +0,0 @@
-import { Base64EncodedBytes } from "~lib/base64"
-
-export interface Trace {
-  id: string;
-  app_version: string;
-  date: string;
-  start_time: number;
-  end_time?: number;
-  root: Request;
-  auth: Request | null;
-  locations: {[key: number]: TraceExpr};
-}
-
-export interface Request {
-  type: "RPC" | "AUTH";
-  id: string;
-  parent_id: string | null;
-  goid: number;
-  caller_goid: number | null;
-  def_loc: number;
-  call_loc: number | null;
-  start_time: number;
-  end_time?: number;
-  inputs: Base64EncodedBytes[];
-  outputs: Base64EncodedBytes[];
-  err: Base64EncodedBytes | null;
-  events: Event[];
-  children: Request[];
-}
-
-export interface DBTransaction {
-  type: "DBTransaction";
-  goid: number;
-  txid: number;
-  start_loc: number;
-  end_loc: number;
-  start_time: number;
-  end_time?: number;
-  completion_type: "COMMIT" | "ROLLBACK";
-  err: Base64EncodedBytes | null;
-  queries: DBQuery[];
-}
-
-export interface DBQuery {
-  type: "DBQuery";
-  goid: number;
-  txid: number | null;
-  call_loc: number;
-  start_time: number;
-  end_time?: number;
-  query: Base64EncodedBytes;
-  html_query: Base64EncodedBytes | null;
-  err: Base64EncodedBytes | null;
-}
-
-export interface Goroutine {
-  type: "Goroutine";
-  goid: number;
-  call_loc: number;
-  start_time: number;
-  end_time?: number;
-}
-
-export interface RPCCall {
-  type: "RPCCall";
-  goid: number;
-  req_id: string;
-  call_loc: number;
-  def_loc: number;
-  start_time: number;
-  end_time?: number;
-  err: Base64EncodedBytes | null;
-}
-
-export interface AuthCall {
-  type: "AuthCall";
-  goid: number;
-  def_loc: number;
-  start_time: number;
-  end_time?: number;
-  uid: string;
-  auth_data: Base64EncodedBytes | null;
-  err: Base64EncodedBytes | null;
-}
-
-export interface HTTPCall {
-  type: "HTTPCall";
-  goid: number;
-  req_id: string;
-  start_time: number;
-  end_time?: number;
-  method: string;
-  host: string;
-  path: string;
-  url: string;
-  status_code: number;
-  err: Base64EncodedBytes | null;
-  metrics: HTTPCallMetrics;
-}
-
-export interface HTTPCallMetrics {
-  got_conn?: number;
-  conn_reused: boolean;
-  dns_done?: number;
-  tls_handshake_done?: number;
-  wrote_headers?: number;
-  wrote_request?: number;
-  first_response?: number;
-  body_closed?: number;
-}
-
-export type Event = DBTransaction | DBQuery | RPCCall | HTTPCall | Goroutine;
-
-export type TraceExpr = RpcDefExpr | RpcCallExpr | StaticCallExpr | AuthHandlerDefExpr
-
-interface BaseExpr {
-  filepath: string;       // source file path
-  src_line_start: number; // line number in source file
-  src_line_end: number;   // line number in source file
-  src_col_start: number;  // column start in source file
-  src_col_end: number;    // colum end in source file (exclusive)
-}
-
-type RpcDefExpr = BaseExpr & {
-  rpc_def: {
-    service_name: string;
-    rpc_name: string;
-    context: string;
-  }
-}
-
-type RpcCallExpr = BaseExpr & {
-  rpc_call: {
-    service_name: string;
-    rpc_name: string;
-    context: string;
-  }
-}
-
-type StaticCallExpr = BaseExpr & {
-  static_call: {
-    package: "SQLDB" | "RLOG";
-    func: string;
-  }
-}
-
-type AuthHandlerDefExpr = BaseExpr & {
-  auth_handler_def: {
-    service_name: string;
-    name: string;
-    context: string;
-  }
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/components/trace/util.ts b/cli/daemon/dash/dashapp/src/components/trace/util.ts
deleted file mode 100644
index 78a0730eec..0000000000
--- a/cli/daemon/dash/dashapp/src/components/trace/util.ts
+++ /dev/null
@@ -1,43 +0,0 @@
-const unselected = ["#fde8e8", "#feecdc", "#fdf6b2", "#def7ec", "#d5f5f6", "#e1effe", "#e5edff", "#edebfe", "#fce8f3"]
-const selected =   ["#fbd5d5", "#fcd9bd", "#fce96a", "#bcf0da", "#afecef", "#c3ddfd", "#cddbfe", "#dcd7fe", "#fad1e8"]
-
-export function svcColor(svc: string): [string, string] {
-  const n = unselected.length
-  let idx = strhash(svc) % n
-  if (idx < 0) idx += n
-  return [unselected[idx], selected[idx]]
-}
-
-function strhash(s: string): number {
-  let hash = 0;
-  for (var i = 0; i < s.length; i++) {
-      const c = s.charCodeAt(i)
-      hash = ((hash<<5)-hash)+c
-      hash &= hash // Convert to 32bit integer
-  }
-  return hash
-}
-
-export function latencyStr(n: number): string {
-  if (n < 1000) {
-    return Math.round(n) + "µs"
-  }
-  n /= 1000
-
-  if (n < 1000) {
-    return Math.round(n) + "ms"
-  }
-  n /= 1000
-
-  if (n < 10) {
-    return (Math.round(n*10)/10) + "s"
-  } else if (n < 3600) {
-    return Math.round(n) + "s"
-  }
-
-  n /= 3600
-  if (n < 10) {
-    return (Math.round(n*10)/10) + "h"
-  }
-  return Math.round(n) + "h"
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/index.css b/cli/daemon/dash/dashapp/src/index.css
deleted file mode 100644
index 30ec6696be..0000000000
--- a/cli/daemon/dash/dashapp/src/index.css
+++ /dev/null
@@ -1,27 +0,0 @@
-@tailwind base;
-@tailwind components;
-@tailwind utilities;
-
-html, body {
-  height: 100%;
-}
-
-body {
-  margin: 0;
-  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Roboto", "Oxygen",
-    "Ubuntu", "Cantarell", "Fira Sans", "Droid Sans", "Helvetica Neue",
-    sans-serif;
-  -webkit-font-smoothing: antialiased;
-  -moz-osx-font-smoothing: grayscale;
-}
-
-code {
-  font-family: source-code-pro, Menlo, Monaco, Consolas, "Courier New",
-    monospace;
-}
-
-#root {
-  height: 100%;
-  display: flex;
-  flex-direction: column;
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/lib/base64.ts b/cli/daemon/dash/dashapp/src/lib/base64.ts
deleted file mode 100644
index 44cae0fe1c..0000000000
--- a/cli/daemon/dash/dashapp/src/lib/base64.ts
+++ /dev/null
@@ -1,15 +0,0 @@
-export type Base64EncodedBytes = string;
-
-export function decodeBase64(str: string): string {
-    const raw = atob(str)
-    return decodeURIComponent(raw.split('').map(function(c) {
-        return '%' + ('00' + c.charCodeAt(0).toString(16)).slice(-2)
-    }).join(''))
-}
-
-export function encodeBase64(str: string): string {
-    let encoded = encodeURIComponent(str).replace(/%([0-9A-F]{2})/g, function(match, p1) {
-        return String.fromCharCode(('0x' + p1) as any)
-    })
-    return btoa(encoded)
-}
diff --git a/cli/daemon/dash/dashapp/src/lib/client/base.ts b/cli/daemon/dash/dashapp/src/lib/client/base.ts
deleted file mode 100644
index ff7d9fa7b1..0000000000
--- a/cli/daemon/dash/dashapp/src/lib/client/base.ts
+++ /dev/null
@@ -1,69 +0,0 @@
-import JSONRPCConn from "./jsonrpc";
-import { ResponseError } from "./errs";
-
-export default class BaseClient {
-  base: string;
-
-  constructor() {
-    this.base = window.location.host
-  }
-
-  async do<T>(path: string, data?: any): Promise<T> {
-    try {
-      let resp = await this._do<T>(path, data);
-      if (!resp.ok) {
-        return Promise.reject(new ResponseError(path, resp.error.code, resp.error.detail, ""));
-      }
-      return Promise.resolve(resp.data);
-    } catch (err) {
-      return Promise.reject(new ResponseError(path, "network_error", null, err))
-    }
-  }
-
-  ws(path: string): Promise<WebSocket> {
-    const base = this.base
-    return new Promise<WebSocket>(function(resolve, reject) {
-      let ws = new WebSocket(`ws://${base}${path}`);
-      ws.onopen = function() {
-        ws.onerror = null
-        resolve(ws)
-      };
-      ws.onerror = function(err: any) {
-        reject(new ResponseError(path, "network", null, err))
-      }
-    })
-  }
-
-  async jsonrpc(path: string): Promise<JSONRPCConn> {
-    const ws = await this.ws(path)
-    return new JSONRPCConn(ws)
-  }
-
-  async _do<T>(path: string, data?: any): Promise<APIResponse<T>> {
-    let body = null
-    if (data) {
-      body = JSON.stringify(data)
-    }
-
-    let resp = await fetch(`http://${this.base}${path}`, {
-      method: "POST",
-      body: body,
-    })
-    return await resp.json()
-  }
-}
-
-interface ErrorResponse {
-  ok: false;
-  error: {
-    code: string;
-    detail: any;
-  }
-}
-
-interface SuccessResponse<T> {
-  ok: true;
-  data: T;
-}
-
-type APIResponse<T> = SuccessResponse<T> | ErrorResponse;
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/lib/client/client.ts b/cli/daemon/dash/dashapp/src/lib/client/client.ts
deleted file mode 100644
index d881efcf2a..0000000000
--- a/cli/daemon/dash/dashapp/src/lib/client/client.ts
+++ /dev/null
@@ -1,34 +0,0 @@
-import BaseClient from "./base";
-import { APIMeta } from "~c/api/api";
-
-export default class Client {
-  base: BaseClient;
-
-  constructor() {
-    this.base = new BaseClient()
-  }
-}
-
-export interface ProcessStart {
-  appID: string;
-  pid: string
-  meta: APIMeta;
-  port: number;
-}
-
-export interface ProcessReload {
-  appID: string;
-  pid: string
-  meta: APIMeta;
-}
-
-export interface ProcessStop {
-  appID: string;
-  pid: string
-}
-
-export interface ProcessOutput {
-  appID: string;
-  pid: string
-  output: string;
-}
diff --git a/cli/daemon/dash/dashapp/src/lib/client/errs.ts b/cli/daemon/dash/dashapp/src/lib/client/errs.ts
deleted file mode 100644
index fb23ea0ba8..0000000000
--- a/cli/daemon/dash/dashapp/src/lib/client/errs.ts
+++ /dev/null
@@ -1,62 +0,0 @@
-export class ResponseError extends Error {
-  path: string;
-  code: string;
-  detail: any | null;
-
-  constructor(path: string, code: string, detail: any | null, message: string) {
-    let d = detail ? JSON.stringify(detail) : "(no details)";
-    if (message) {
-        super(`API ${path} failed with code: ${code} - ${d}: ${message}`)
-    } else {
-        super(`API ${path} failed with code: ${code} - ${d}`)
-    }
-    this.path = path;
-    this.code = code;
-    this.detail = detail;
-  }
-}
-
-export function errCode(err: any): string {
-  if (!err || !err.code) {
-    return "unknown"
-  }
-  return err.code ?? "unknown"
-}
-
-export function errDetail(err: any): any | null {
-  if (!err || !err.detail) {
-    return null
-  }
-  return err.detail || null
-}
-
-export function isErr(err: any, code?: string, detail?: any) {
-    if (!err) {
-      return false;
-    } else if (err.code !== code) {
-      return false;
-    }
-
-    if (!detail) {
-      return true;
-    } else if (!err.detail) {
-      return false;
-    }
-
-    for (let key in detail) {
-      if (detail[key] !== err.detail[key]) {
-        return false;
-      }
-    }
-    return true;
-}
-
-export function isValidationErr(err: any, field?: string, type?: string) {
-  if (type) {
-    return isErr(err, "validation", {"field": field, "type": type})
-  } else if (field) {
-    return isErr(err, "validation", {"field": field})
-  } else {
-    return isErr(err, "validation")
-  }
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/lib/client/jsonrpc.ts b/cli/daemon/dash/dashapp/src/lib/client/jsonrpc.ts
deleted file mode 100644
index 493272503e..0000000000
--- a/cli/daemon/dash/dashapp/src/lib/client/jsonrpc.ts
+++ /dev/null
@@ -1,195 +0,0 @@
-import { EventEmitter } from 'events';
-import * as protocol from "json-rpc-protocol"
-
-function makeAsync<T>(fn: (msg: Message) => T): (msg: Message) => Promise<T> {
-  return function(msg) {
-    return new Promise(function(resolve) {
-      return resolve(fn(msg));
-    });
-  }
-}
-
-export interface RequestMsg {
-  type: "request";
-  id: number;
-  method: string;
-  params: any;
-}
-
-export interface ResponseMsg {
-  type: "response";
-  id: number;
-  method: string;
-  result: any;
-}
-
-export interface NotificationMsg {
-  type: "notification";
-  method: string;
-  params: any;
-}
-
-export interface ErrorMsg {
-  type: "error";
-  id: number | null;
-  error: {
-    message: string;
-    code: any;
-    data: any;
-  };
-}
-
-export type Message = RequestMsg | ResponseMsg | NotificationMsg | ErrorMsg;
-
-export default class JSONRPCConn extends EventEmitter {
-  _peer: Peer;
-  _ws: WebSocket;
-
-  constructor(ws: WebSocket) {
-    super();
-    this._ws = ws
-    this._peer = new Peer(
-      (msg) => ws.send(msg),
-      (msg) => this.emit("notification", msg),
-    )
-    ws.onmessage = (event) => this._peer.processMsg(event.data);
-  }
-
-  async request<T>(method: string, params?: any): Promise<T> {
-      return await this._peer.request<T>(method, params);
-  }
-
-  async notify(method: string, params?: any): Promise<void> {
-    this._peer.notify(method, params)
-  }
-
-  close() {
-    this._peer.failPendingRequests("closing connection")
-    this._ws.close()
-  }
-}
-
-const parseMessage = (message: string): Message => {
-  try {
-    return protocol.parse(message) as Message;
-  } catch (error) {
-    throw protocol.format.error(null, error);
-  }
-};
-
-// Default onMessage implementation:
-//
-// - ignores notifications
-// - throw MethodNotFound for all requests
-function defaultOnMessage(message: Message) {
-  if (message.type === "request") {
-    throw new protocol.MethodNotFound(message.method);
-  }
-}
-
-function noop() {}
-
-interface Deferred {
-  resolve: (x: any) => void;
-  reject: (x: any) => void;
-}
-
-// Starts the autoincrement id with the JavaScript minimal safe integer to have
-// more room before running out of integers (it's very far fetched but a very
-// long running process with a LOT of messages could run out).
-let nextRequestId = -9007199254740991;
-
-// ===================================================================
-
-export class Peer {
-  _deferreds: {[key: number]: Deferred};
-  _handle: (msg: Message) => Promise<any>;
-  _send: (msg: string) => void;
-
-  constructor(send: (msg: string) => void, onMessage = defaultOnMessage) {
-    this._send = send;
-    this._handle = makeAsync(onMessage);
-    this._deferreds = Object.create(null);
-  }
-
-  _getDeferred(id: number): Deferred {
-    const deferred = this._deferreds[id];
-    delete this._deferreds[id];
-    return deferred;
-  }
-
-  async processMsg(message: string) {
-    const msg = parseMessage(message);
-
-    if (msg.type === "error") {
-      // Some errors do not have an identifier, simply discard them.
-      if (msg.id === null) {
-        return;
-      }
-
-      const { error } = msg;
-      this._getDeferred(msg.id).reject(
-        // TODO: it would be great if we could return an error with of
-        // a more specific type (and custom types with registration).
-        new (Error as any)(error.message, error.code, error.data)
-      );
-    } else if (msg.type === "response") {
-      this._getDeferred(msg.id).resolve(msg.result);
-    } else if (msg.type === "notification") {
-      this._handle(msg).catch(noop);
-    } else if (msg.type === "request") {
-      return this._handle(msg)
-        .then(result =>
-          protocol.format.response(msg.id, result === undefined ? null : result)
-        )
-        .catch(error =>
-          protocol.format.error(
-            msg.id,
-
-            // If the method name is not defined, default to the method passed
-            // in the request.
-            error instanceof protocol.MethodNotFound && !error.data
-              ? new protocol.MethodNotFound(msg.method)
-              : error
-          )
-        );
-    }
-  }
-
-  // Fails all pending requests.
-  failPendingRequests(reason: any) {
-    Object.entries(this._deferreds).forEach(([id, deferred]) => {
-      deferred.reject(reason);
-      delete this._deferreds[(id as unknown) as number];
-    });
-  }
-
-  /**
-   * This function should be called to send a request to the other end.
-   *
-   * TODO: handle multi-requests.
-   */
-  request<T>(method: string, params: any): Promise<T> {
-    return new Promise((resolve, reject) => {
-      const requestId = nextRequestId++;
-
-      try {
-        this._send(protocol.format.request(requestId, method, params));
-      } catch(err) {
-        reject(err);
-        return;
-      }
-
-      this._deferreds[requestId] = { resolve, reject };
-    });
-  }
-
-  /**
-   * This function should be called to send a notification to the other end.
-   *
-   * TODO: handle multi-notifications.
-   */
-  notify(method: string, params: any) {
-    this._send(protocol.format.notification(method, params));
-  }
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/lib/clipboard.ts b/cli/daemon/dash/dashapp/src/lib/clipboard.ts
deleted file mode 100644
index ba9bc24e76..0000000000
--- a/cli/daemon/dash/dashapp/src/lib/clipboard.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-export const copyToClipboard = (text: string) => {
-  let textField = document.createElement('textarea')
-  textField.innerText = text
-  document.body.appendChild(textField)
-  textField.select()
-  document.execCommand('copy')
-  textField.remove()
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/lib/ctx.ts b/cli/daemon/dash/dashapp/src/lib/ctx.ts
deleted file mode 100644
index 884b06ff74..0000000000
--- a/cli/daemon/dash/dashapp/src/lib/ctx.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-import React, { useContext } from "react"
-import JSONRPCConn from "./client/jsonrpc"
-
-export const ConnContext = React.createContext<JSONRPCConn | undefined>(undefined)
-
-export function useConn(): JSONRPCConn {
-  return useContext(ConnContext)!
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/lib/parse-ansi.ts b/cli/daemon/dash/dashapp/src/lib/parse-ansi.ts
deleted file mode 100644
index ad541fe410..0000000000
--- a/cli/daemon/dash/dashapp/src/lib/parse-ansi.ts
+++ /dev/null
@@ -1,433 +0,0 @@
-export interface Chunk {
-  type: "text" | "ansi" | "newline";
-  value: string;
-  style: Style;
-}
-
-export interface Style {
-  foregroundColor?: string;
-  backgroundColor?: string;
-  dim?: boolean;
-  bold?: boolean;
-  italic?: boolean;
-  underline?: boolean;
-  strikethrough?: boolean;
-  inverse?: boolean;
-}
-
-const ansiRegex = ({onlyFirst = false} = {}) => {
-	const pattern = [
-		'[\\u001B\\u009B][[\\]()#;?]*(?:(?:(?:[a-zA-Z\\d]*(?:;[-a-zA-Z\\d\\/#&.:=?%@~_]*)*)?\\u0007)',
-		'(?:(?:\\d{1,4}(?:;\\d{0,4})*)?[\\dA-PR-TZcf-ntqry=><~]))'
-	].join('|');
-
-	return new RegExp(pattern, onlyFirst ? undefined : 'g');
-};
-
-const stripAnsi = (string: any) => typeof string === 'string' ? string.replace(ansiRegex(), '') : string;
-
-
-const ansiTags: {[key: string]: string} = {
-  '\u001B[30m': 'black',
-  '\u001B[31m': 'red',
-  '\u001B[32m': 'green',
-  '\u001B[33m': 'yellow',
-  '\u001B[34m': 'blue',
-  '\u001B[35m': 'magenta',
-  '\u001B[36m': 'cyan',
-  '\u001B[37m': 'white',
-
-  '\u001B[90m': 'gray',
-  '\u001B[91m': 'redBright',
-  '\u001B[92m': 'greenBright',
-  '\u001B[93m': 'yellowBright',
-  '\u001B[94m': 'blueBright',
-  '\u001B[95m': 'magentaBright',
-  '\u001B[96m': 'cyanBright',
-  '\u001B[97m': 'whiteBright',
-
-  '\u001B[39m': 'foregroundColorClose',
-
-  '\u001B[40m': 'bgBlack',
-  '\u001B[41m': 'bgRed',
-  '\u001B[42m': 'bgGreen',
-  '\u001B[43m': 'bgYellow',
-  '\u001B[44m': 'bgBlue',
-  '\u001B[45m': 'bgMagenta',
-  '\u001B[46m': 'bgCyan',
-  '\u001B[47m': 'bgWhite',
-
-  '\u001B[100m': 'bgGray',
-  '\u001B[101m': 'bgRedBright',
-  '\u001B[102m': 'bgGreenBright',
-  '\u001B[103m': 'bgYellowBright',
-  '\u001B[104m': 'bgBlueBright',
-  '\u001B[105m': 'bgMagentaBright',
-  '\u001B[106m': 'bgCyanBright',
-  '\u001B[107m': 'bgWhiteBright',
-
-  '\u001B[49m': 'backgroundColorClose',
-
-  '\u001B[1m': 'boldOpen',
-  '\u001B[2m': 'dimOpen',
-  '\u001B[3m': 'italicOpen',
-  '\u001B[4m': 'underlineOpen',
-  '\u001B[7m': 'inverseOpen',
-  '\u001B[8m': 'hiddenOpen',
-  '\u001B[9m': 'strikethroughOpen',
-
-  '\u001B[22m': 'boldDimClose',
-  '\u001B[23m': 'italicClose',
-  '\u001B[24m': 'underlineClose',
-  '\u001B[27m': 'inverseClose',
-  '\u001B[28m': 'hiddenClose',
-  '\u001B[29m': 'strikethroughClose',
-
-  '\u001B[0m': 'reset'
-}
-
-const decorators: {[key: string]: string} = {
-  black: 'foregroundColorOpen',
-  red: 'foregroundColorOpen',
-  green: 'foregroundColorOpen',
-  yellow: 'foregroundColorOpen',
-  blue: 'foregroundColorOpen',
-  magenta: 'foregroundColorOpen',
-  cyan: 'foregroundColorOpen',
-  white: 'foregroundColorOpen',
-
-  gray: 'foregroundColorOpen',
-  redBright: 'foregroundColorOpen',
-  greenBright: 'foregroundColorOpen',
-  yellowBright: 'foregroundColorOpen',
-  blueBright: 'foregroundColorOpen',
-  magentaBright: 'foregroundColorOpen',
-  cyanBright: 'foregroundColorOpen',
-  whiteBright: 'foregroundColorOpen',
-
-  bgBlack: 'backgroundColorOpen',
-  bgRed: 'backgroundColorOpen',
-  bgGreen: 'backgroundColorOpen',
-  bgYellow: 'backgroundColorOpen',
-  bgBlue: 'backgroundColorOpen',
-  bgMagenta: 'backgroundColorOpen',
-  bgCyan: 'backgroundColorOpen',
-  bgWhite: 'backgroundColorOpen',
-
-  bgGray: 'backgroundColorOpen',
-  bgRedBright: 'backgroundColorOpen',
-  bgGreenBright: 'backgroundColorOpen',
-  bgYellowBright: 'backgroundColorOpen',
-  bgBlueBright: 'backgroundColorOpen',
-  bgMagentaBright: 'backgroundColorOpen',
-  bgCyanBright: 'backgroundColorOpen',
-  bgWhiteBright: 'backgroundColorOpen',
-
-  foregroundColorClose: 'foregroundColorClose',
-  backgroundColorClose: 'backgroundColorClose',
-
-  boldOpen: 'boldOpen',
-  dimOpen: 'dimOpen',
-  italicOpen: 'italicOpen',
-  underlineOpen: 'underlineOpen',
-  inverseOpen: 'inverseOpen',
-  hiddenOpen: 'hiddenOpen',
-  strikethroughOpen: 'strikethroughOpen',
-
-  boldDimClose: 'boldDimClose',
-  italicClose: 'italicClose',
-  underlineClose: 'underlineClose',
-  inverseClose: 'inverseClose',
-  hiddenClose: 'hiddenClose',
-  strikethroughClose: 'strikethroughClose',
-
-  reset: 'reset'
-}
-
-const arrayUniq = (array: any[]) => [...new Set(array)];
-
-// Atomize
-// Splits text into "words" by sticky delimiters [ANSI Escape Seq, \n]
-// Eg: words = ['\u001b[37m', 'Line 1', '\n', 'Line 2', '\u001b[39m']
-const atomize = (text: string) => {
-	const ansies = arrayUniq(text.match(ansiRegex()) as string[])
-	const words = superSplit(text, ansies.concat(['\n']))
-	return {ansies, words}
-}
-
-const parse = (ansi: string) => {
-	const plainText = stripAnsi(ansi)
-
-	const result: any = {
-		raw: ansi,
-		plainText,
-		chunks: []
-	}
-
-	const {
-		ansies,
-		words
-	} = atomize(ansi)
-
-	const styleStack: any = {
-		foregroundColor: [],
-		backgroundColor: [],
-		boldDim: []
-	}
-
-	const getForegroundColor = () => {
-		if (styleStack.foregroundColor.length > 0) {
-			return styleStack.foregroundColor[styleStack.foregroundColor.length - 1]
-		}
-		return false
-	}
-
-	const getBackgroundColor = () => {
-		if (styleStack.backgroundColor.length > 0) {
-			return styleStack.backgroundColor[styleStack.backgroundColor.length - 1]
-		}
-		return false
-	}
-
-	const getDim = () => {
-		return styleStack.boldDim.includes('dim')
-	}
-
-	const getBold = () => {
-		return styleStack.boldDim.includes('bold')
-	}
-
-	const styleState = {
-		italic: false,
-		underline: false,
-		inverse: false,
-		hidden: false,
-		strikethrough: false
-	}
-
-	let x = 0
-	let y = 0
-	let nAnsi = 0
-	let nPlain = 0
-
-	const bundle = (type: any, value: any) => {
-		const chunk: Chunk = {
-			type,
-			value,
-      style: {},
-		}
-
-		if (type === 'text' || type === 'ansi') {
-			const style = chunk.style
-
-			const foregroundColor = getForegroundColor()
-			const backgroundColor = getBackgroundColor()
-			const dim = getDim()
-			const bold = getBold()
-
-			if (foregroundColor) {
-				style.foregroundColor = foregroundColor
-			}
-
-			if (backgroundColor) {
-				style.backgroundColor = backgroundColor
-			}
-
-			if (dim) {
-				style.dim = dim
-			}
-
-			if (bold) {
-				style.bold = bold
-			}
-
-			if (styleState.italic) {
-				style.italic = true
-			}
-
-			if (styleState.underline) {
-				style.underline = true
-			}
-
-			if (styleState.inverse) {
-				style.inverse = true
-			}
-
-			if (styleState.strikethrough) {
-				style.strikethrough = true
-			}
-		}
-
-		return chunk
-	}
-
-	words.forEach((word: string) => {
-		// Newline character
-		if (word === '\n') {
-			const chunk = bundle('newline', '\n')
-			result.chunks.push(chunk)
-
-			x = 0
-			y += 1
-			nAnsi += 1
-			nPlain += 1
-			return
-		}
-
-		// Text characters
-		if (ansies.includes(word) === false) {
-			const chunk = bundle('text', word)
-			result.chunks.push(chunk)
-
-			x += word.length
-			nAnsi += word.length
-			nPlain += word.length
-			return
-		}
-
-		// ANSI Escape characters
-		const ansiTag = ansiTags[word]
-		const decorator = decorators[ansiTag]
-		const color = ansiTag
-
-		if (decorator === 'foregroundColorOpen') {
-			styleStack.foregroundColor.push(color)
-		}
-
-		if (decorator === 'foregroundColorClose') {
-			styleStack.foregroundColor.pop()
-		}
-
-		if (decorator === 'backgroundColorOpen') {
-			styleStack.backgroundColor.push(color)
-		}
-
-		if (decorator === 'backgroundColorClose') {
-			styleStack.backgroundColor.pop()
-		}
-
-		if (decorator === 'boldOpen') {
-			styleStack.boldDim.push('bold')
-		}
-
-		if (decorator === 'dimOpen') {
-			styleStack.boldDim.push('dim')
-		}
-
-		if (decorator === 'boldDimClose') {
-			styleStack.boldDim.pop()
-		}
-
-		if (decorator === 'italicOpen') {
-			styleState.italic = true
-		}
-
-		if (decorator === 'italicClose') {
-			styleState.italic = false
-		}
-
-		if (decorator === 'underlineOpen') {
-			styleState.underline = true
-		}
-
-		if (decorator === 'underlineClose') {
-			styleState.underline = false
-		}
-
-		if (decorator === 'inverseOpen') {
-			styleState.inverse = true
-		}
-
-		if (decorator === 'inverseClose') {
-			styleState.inverse = false
-		}
-
-		if (decorator === 'strikethroughOpen') {
-			styleState.strikethrough = true
-		}
-
-		if (decorator === 'strikethroughClose') {
-			styleState.strikethrough = false
-		}
-
-		if (decorator === 'reset') {
-			styleState.strikethrough = false
-			styleState.inverse = false
-			styleState.italic = false
-			styleStack.boldDim = []
-			styleStack.backgroundColor = []
-			styleStack.foregroundColor = []
-		}
-
-		const chunk = bundle('ansi', {
-			tag: ansiTag,
-			ansi: word,
-			decorator
-		})
-
-		result.chunks.push(chunk)
-		nAnsi += word.length
-	})
-
-	return result
-}
-
-function splitString(str: any, delimiter: any): any {
-	const result: any = []
-
-	str.split(delimiter).forEach((str: any) => {
-		result.push(str)
-		result.push(delimiter)
-	})
-
-	result.pop()
-
-	return result
-}
-
-const splitArray = (ary: any, delimiter: any) => {
-	let result: any = []
-
-	ary.forEach((part: any) => {
-		let subRes: any = []
-
-		part.split(delimiter).forEach((str: any) => {
-			subRes.push(str)
-			subRes.push(delimiter)
-		})
-
-		subRes.pop()
-		subRes = subRes.filter((str: any) => {
-			if (str) {
-				return str
-			}
-			return undefined
-		})
-
-		result = result.concat(subRes)
-	})
-
-	return result
-}
-
-function superSplit(splittable: any, delimiters: any): any {
-	if (delimiters.length === 0) {
-		return splittable
-	}
-
-	if (typeof splittable === 'string') {
-		const delimiter = delimiters[delimiters.length - 1]
-		const split = splitString(splittable, delimiter)
-		return superSplit(split, delimiters.slice(0, -1))
-	}
-
-	if (Array.isArray(splittable)) {
-		const delimiter = delimiters[delimiters.length - 1]
-		const split = splitArray(splittable, delimiter)
-		return superSplit(split, delimiters.slice(0, -1))
-	}
-
-	return false
-}
-
-export default parse
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/lib/time.ts b/cli/daemon/dash/dashapp/src/lib/time.ts
deleted file mode 100644
index ff4cfca336..0000000000
--- a/cli/daemon/dash/dashapp/src/lib/time.ts
+++ /dev/null
@@ -1,27 +0,0 @@
-import {DateTime, Duration} from 'luxon';
-
-export function timeToDate(timeStr: string): DateTime | null {
-    let d = DateTime.fromISO(timeStr);
-    if (d.year === 1) {
-        return null;
-    }
-    return d;
-}
-
-export function durationStr(dur: Duration, format?: "long" | "short"): string {
-    const short = format === "short"
-    dur = dur.shiftTo("hours", "minutes", "seconds", "milliseconds")
-    let parts: [number, string][]
-    if (short) {
-        parts = [[dur.hours, "h"], [dur.minutes, "m"], [dur.seconds, "s"]]
-    } else {
-        parts = [[dur.hours, "hour"], [dur.minutes, "minute"], [dur.seconds, "second"]]
-    }
-
-    for (var part of parts) {
-        if (part[0] > 0) {
-            return short ? (part[0] + part[1]) : (part[0] + " " + part[1] + (part[0] > 1 ? "s" : ""))
-        }
-    }
-    return short ? "<1s" : "less than a second"
-}
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/logo.svg b/cli/daemon/dash/dashapp/src/logo.svg
deleted file mode 100644
index d0c4ed3660..0000000000
--- a/cli/daemon/dash/dashapp/src/logo.svg
+++ /dev/null
@@ -1 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="60.213" height="50.266" viewBox="0 0 60.213 50.266" fill="#ffffff"><g transform="translate(0 0)"><path d="M0,43.412A43.276,43.276,0,0,1,43.412,0V16.62A26.628,26.628,0,0,0,16.62,43.412Z" transform="translate(0 0)" fill-rule="evenodd"/><path d="M124.349,107.763a16.588,16.588,0,0,1,16.733,16.679c.017,5.238-10.164,6.854-16.774,6.854s-16.743-1.608-16.761-6.854A16.566,16.566,0,0,1,124.349,107.763Z" transform="translate(-80.868 -81.031)" fill-rule="evenodd"/></g></svg>
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/main.tsx b/cli/daemon/dash/dashapp/src/main.tsx
deleted file mode 100644
index 606a3cf44e..0000000000
--- a/cli/daemon/dash/dashapp/src/main.tsx
+++ /dev/null
@@ -1,11 +0,0 @@
-import React from 'react'
-import ReactDOM from 'react-dom'
-import './index.css'
-import App from './App'
-
-ReactDOM.render(
-  <React.StrictMode>
-    <App />
-  </React.StrictMode>,
-  document.getElementById('root')
-)
diff --git a/cli/daemon/dash/dashapp/src/pages/AppAPI.tsx b/cli/daemon/dash/dashapp/src/pages/AppAPI.tsx
deleted file mode 100644
index ba6a10529e..0000000000
--- a/cli/daemon/dash/dashapp/src/pages/AppAPI.tsx
+++ /dev/null
@@ -1,24 +0,0 @@
-import React, { FunctionComponent } from 'react'
-import { useParams } from 'react-router-dom'
-import AppAPI from '~c/app/AppAPI'
-import Nav from '~c/Nav'
-import { useConn } from '~lib/ctx'
-
-const API: FunctionComponent = (props) => {
-  const conn = useConn()
-  const { appID } = useParams<{appID: string}>()
-
-  return (
-    <>
-      <Nav />
-
-      <section className="bg-gray-200 flex-grow flex flex-col items-center">
-        <div className="w-full mt-6 px-10">
-          <AppAPI appID={appID} conn={conn} />
-        </div>
-      </section>
-    </>
-  )
-}
-
-export default API
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/pages/AppHome.tsx b/cli/daemon/dash/dashapp/src/pages/AppHome.tsx
deleted file mode 100644
index 696b767654..0000000000
--- a/cli/daemon/dash/dashapp/src/pages/AppHome.tsx
+++ /dev/null
@@ -1,38 +0,0 @@
-import React, { FunctionComponent } from 'react'
-import { useParams } from 'react-router-dom'
-import AppCaller from '~c/app/AppCaller'
-import AppTraces from '~c/app/AppTraces'
-import Nav from '~c/Nav'
-import { useConn } from '~lib/ctx'
-
-const AppHome: FunctionComponent = (props) => {
-  const { appID } = useParams<{appID: string}>()
-  const conn = useConn()
-
-  return (
-    <>
-      <Nav />
-
-      <section className="bg-gray-200 flex-grow flex flex-col items-center py-6">
-        <div className="w-full px-10">
-          <div className="md:flex md:items-stretch">
-            <div className="flex-1 min-w-0 md:mr-8">
-              <h2 className="px-2 text-lg font-medium">API Explorer</h2>
-              <div className="mt-2 rounded-lg overflow-hidden">
-                <AppCaller appID={appID} conn={conn} />
-              </div>
-            </div>
-            <div className="mt-4 md:mt-0 flex-1 min-w-0">
-              <h2 className="px-2 text-lg font-medium">Traces</h2>
-              <div className="mt-2 rounded-lg overflow-hidden">
-                <AppTraces appID={appID} conn={conn} />
-              </div>
-            </div>
-          </div>
-        </div>
-      </section>
-    </>
-  )
-}
-
-export default AppHome
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/src/pages/AppList.tsx b/cli/daemon/dash/dashapp/src/pages/AppList.tsx
deleted file mode 100644
index ee3c0f5c56..0000000000
--- a/cli/daemon/dash/dashapp/src/pages/AppList.tsx
+++ /dev/null
@@ -1,35 +0,0 @@
-import React, { FunctionComponent, useEffect, useState } from 'react'
-import { Link } from 'react-router-dom'
-import { useConn } from '~lib/ctx'
-
-const AppList: FunctionComponent = (props) => {
-  const conn = useConn()
-  const [apps, setApps] = useState<{id: string; name: string}[] | undefined>(undefined)
-  useEffect(() => {
-    conn.request("list-apps").then(apps => setApps(apps as {id: string; name: string}[]))
-  }, [])
-
-  return (
-    <>
-      <section className="bg-gray-200 flex-grow flex items-center justify-center">
-        <div className="max-w-xl w-full bg-white overflow-hidden shadow-xl rounded-lg">
-          <div className="border-b border-gray-200 px-4 py-5 sm:px-6 flex items-center">
-            <h1 className="mr-auto text-xl font-bold">Your Apps</h1>
-          </div>
-          <div className="px-4 py-5 sm:p-6">
-            {apps !== undefined ? (
-              apps.map((app) => 
-                <div key={app.id}>
-                  <Link to={"/"+app.id} className="text-purple-600 hover:text-purple-700">{app.name}</Link>
-                </div>
-              )
-            ) : <p>Loading...</p>
-            }
-          </div>
-        </div>
-      </section>
-    </>
-  )
-}
-
-export default AppList
\ No newline at end of file
diff --git a/cli/daemon/dash/dashapp/tailwind.config.js b/cli/daemon/dash/dashapp/tailwind.config.js
deleted file mode 100644
index a535525cab..0000000000
--- a/cli/daemon/dash/dashapp/tailwind.config.js
+++ /dev/null
@@ -1,11 +0,0 @@
-module.exports = {
-  purge: ['./index.html', './src/**/*.{js,ts,jsx,tsx}'],
-  darkMode: false, // or 'media' or 'class'
-  theme: {
-    extend: {},
-  },
-  variants: {
-    extend: {},
-  },
-  plugins: [require("@tailwindcss/forms")],
-}
diff --git a/cli/daemon/dash/dashapp/tsconfig.json b/cli/daemon/dash/dashapp/tsconfig.json
deleted file mode 100644
index 8acbbdf7a7..0000000000
--- a/cli/daemon/dash/dashapp/tsconfig.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ESNext",
-    "lib": ["DOM", "DOM.Iterable", "ESNext"],
-    "types": ["vite/client"],
-    "allowJs": false,
-    "skipLibCheck": false,
-    "esModuleInterop": true,
-    "allowSyntheticDefaultImports": true,
-    "strict": true,
-    "forceConsistentCasingInFileNames": true,
-    "module": "ESNext",
-    "moduleResolution": "Node",
-    "resolveJsonModule": true,
-    "isolatedModules": true,
-    "noEmit": true,
-    "jsx": "react",
-    "paths": {
-      "~c/*": ["./src/components/*"],
-      "~lib/*": ["./src/lib/*"],
-      "~mod/*": ["./src/mod/*"],
-      "~p/*": ["./src/pages/*"],
-    }
-  },
-  "include": ["./src"]
-}
diff --git a/cli/daemon/dash/dashapp/vite.config.ts b/cli/daemon/dash/dashapp/vite.config.ts
deleted file mode 100644
index d8371d9d78..0000000000
--- a/cli/daemon/dash/dashapp/vite.config.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import reactRefresh from '@vitejs/plugin-react-refresh'
-import path from 'path';
-import { defineConfig } from 'vite'
-
-const projectRootDir = path.resolve(__dirname)
-
-// https://vitejs.dev/config/
-export default defineConfig({
-  plugins: [reactRefresh()],
-  alias: [
-    {find: "~c", replacement: path.resolve(projectRootDir, "src", "components")},
-    {find: "~p", replacement: path.resolve(projectRootDir, "src", "pages")},
-    {find: "~mod", replacement: path.resolve(projectRootDir, "src", "mod")},
-    {find: "~lib", replacement: path.resolve(projectRootDir, "src", "lib")},
-  ],
-})
diff --git a/cli/daemon/dash/dashproxy/dashproxy.go b/cli/daemon/dash/dashproxy/dashproxy.go
new file mode 100644
index 0000000000..66ab4b6bc1
--- /dev/null
+++ b/cli/daemon/dash/dashproxy/dashproxy.go
@@ -0,0 +1,79 @@
+// Package dashproxy proxies requests to the dash server,
+// caching them locally for offline access.
+package dashproxy
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"os"
+	"path/filepath"
+
+	"github.com/cockroachdb/errors"
+	"github.com/peterbourgon/diskv"
+
+	"encr.dev/internal/conf"
+	"encr.dev/internal/httpcache"
+	"encr.dev/internal/httpcache/diskcache"
+	"encr.dev/internal/version"
+)
+
+func New(targetURL string) (*httputil.ReverseProxy, error) {
+	target, err := url.Parse(targetURL)
+	if err != nil {
+		return nil, errors.Wrap(err, "parse target url")
+	}
+
+	var transport http.RoundTripper = &versionAddingTransport{version: version.Version}
+	if conf.CacheDevDash {
+		cacheDir, err := os.UserCacheDir()
+		if err != nil {
+			return nil, errors.Wrap(err, "get user cache dir")
+		}
+
+		cache := diskcache.NewWithDiskv(diskv.New(diskv.Options{
+			BasePath:     filepath.Join(cacheDir, "encore", "dashcache"),
+			CacheSizeMax: 1024 * 1024 * 1024, // 1GiB
+			Compression:  diskv.NewGzipCompression(),
+		}))
+
+		// Wrap the transport with a caching transport.
+		cachingTransport := httpcache.NewTransport(cache)
+		cachingTransport.Transport = transport
+		transport = cachingTransport
+	}
+
+	proxy := &httputil.ReverseProxy{
+		Transport: transport,
+		Rewrite: func(r *httputil.ProxyRequest) {
+			r.SetURL(target)
+
+			// Configure cache headers so the cache behaves the way we want it to.
+			r.Out.Header.Del("Cookie")
+			r.Out.Header.Set("Cache-Control", "stale-if-error")
+			r.Out.Header.Del("Vary")
+		},
+		ModifyResponse: func(resp *http.Response) error {
+			if resp.StatusCode < 300 {
+				resp.Header.Del("Vary")
+				resp.Header.Set("Cache-Control", "max-age=60,stale-if-error=86400")
+			}
+			return nil
+		},
+	}
+
+	return proxy, nil
+}
+
+type versionAddingTransport struct {
+	version string
+}
+
+func (t *versionAddingTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	if t.version != "" {
+		vals := req.URL.Query()
+		vals.Set("cli_version", t.version)
+		req.URL.RawQuery = vals.Encode()
+	}
+	return http.DefaultTransport.RoundTrip(req)
+}
diff --git a/cli/daemon/dash/dbbrowser.go b/cli/daemon/dash/dbbrowser.go
new file mode 100644
index 0000000000..a88de30b17
--- /dev/null
+++ b/cli/daemon/dash/dbbrowser.go
@@ -0,0 +1,187 @@
+package dash
+
+import (
+	"context"
+
+	"encr.dev/cli/daemon/sqldb"
+	"encr.dev/pkg/fns"
+	"github.com/cockroachdb/errors"
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+// QueryRequest represents the request body for the /query endpoint
+type QueryRequest struct {
+	Query     string `json:"query"`
+	Params    []any  `json:"params"`
+	ArrayMode bool   `json:"arrayMode"`
+	DbID      string `json:"dbId"`
+	AppID     string `json:"appId"`
+}
+
+// TransactionRequest represents the request body for the /transaction endpoint
+type TransactionRequest struct {
+	Queries []struct {
+		SQL    string `json:"sql"`
+		Params []any  `json:"params"`
+	} `json:"queries"`
+	DbID  string `json:"dbId"`
+	AppID string `json:"appId"`
+}
+
+func (h *handler) Query(ctx context.Context, req QueryRequest) ([]any, error) {
+
+	pgConn, err := h.browserConn(ctx, req.AppID, req.DbID)
+	if err != nil {
+		return nil, err
+	}
+
+	defer fns.CloseIgnoreCtx(ctx, pgConn.Close)
+
+	rows, err := pgConn.Query(context.Background(), req.Query, req.Params...)
+
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	results := []any{}
+	if req.ArrayMode {
+		// Return results as arrays
+		for rows.Next() {
+			values, err := rows.Values()
+			if err != nil {
+				return nil, err
+			}
+			results = append(results, values)
+		}
+	} else {
+		// Return results as objects
+		fieldDescriptions := rows.FieldDescriptions()
+		for rows.Next() {
+			values, err := rows.Values()
+			if err != nil {
+				return nil, err
+			}
+
+			row := make(map[string]any)
+			for i, value := range values {
+				row[fieldDescriptions[i].Name] = value
+			}
+			results = append(results, row)
+		}
+	}
+
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	return results, nil
+}
+
+// handleTransaction handles the /transaction endpoint
+func (h *handler) Transaction(ctx context.Context, req TransactionRequest) ([]any, error) {
+	// Start a transaction
+	conn, err := h.browserConn(ctx, req.AppID, req.DbID)
+	if err != nil {
+		return nil, err
+	}
+	defer fns.CloseIgnoreCtx(ctx, conn.Close)
+
+	tx, err := conn.Begin(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer tx.Rollback(context.Background())
+
+	results := []any{}
+	for _, query := range req.Queries {
+		rows, err := tx.Query(context.Background(), query.SQL, query.Params...)
+		if err != nil {
+			return nil, err
+		}
+
+		var queryResults []map[string]any
+		fieldDescriptions := rows.FieldDescriptions()
+		for rows.Next() {
+			values, err := rows.Values()
+			if err != nil {
+				rows.Close()
+				return nil, err
+			}
+
+			row := make(map[string]any)
+			for i, value := range values {
+				row[fieldDescriptions[i].Name] = value
+			}
+			queryResults = append(queryResults, row)
+		}
+		rows.Close()
+
+		if err := rows.Err(); err != nil {
+			return nil, err
+		}
+
+		results = append(results, queryResults)
+	}
+
+	// Commit the transaction
+	if err := tx.Commit(context.Background()); err != nil {
+		return nil, err
+	}
+
+	return results, nil
+}
+
+func (s *handler) browserConn(ctx context.Context, appID string, dbID string) (*pgx.Conn, error) {
+	// Find the latest app by platform ID or local ID.
+	app, err := s.apps.FindLatestByPlatformOrLocalID(appID)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to find latest app")
+	}
+
+	namespace, err := s.GetNamespace(ctx, appID)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to get namespace")
+	}
+
+	clusterType := sqldb.Run
+	cluster := s.run.ClusterMgr.Create(ctx, &sqldb.CreateParams{
+		ClusterID: sqldb.GetClusterID(app, clusterType, namespace),
+		Memfs:     false,
+	})
+	appMeta, err := s.GetMeta(appID)
+	if err != nil {
+		return nil, err
+	}
+
+	if _, err = cluster.Start(ctx, nil); err != nil {
+		return nil, errors.Wrap(err, "failed to start database cluster")
+	}
+	db, ok := cluster.GetDB(dbID)
+	if !ok {
+		if err := cluster.Setup(ctx, app.Root(), appMeta); err != nil {
+			return nil, errors.Wrap(err, "failed to setup database cluster")
+		}
+		db, ok = cluster.GetDB(dbID)
+		if !ok {
+			return nil, errors.Newf("failed to get database %s", dbID)
+		}
+	}
+
+	info, err := db.Cluster.Info(ctx)
+	if err != nil {
+		return nil, err
+	}
+	uri := info.ConnURI(db.EncoreName, info.Config.Superuser)
+	conn, err := pgx.Connect(ctx, uri)
+	if err != nil {
+		return nil, err
+	}
+	conn.TypeMap().RegisterType(&pgtype.Type{
+		Name:  "char",
+		OID:   18,
+		Codec: pgtype.TextCodec{},
+	})
+	return conn, nil
+}
diff --git a/cli/daemon/dash/server.go b/cli/daemon/dash/server.go
index 141f870afb..2b56a2627d 100644
--- a/cli/daemon/dash/server.go
+++ b/cli/daemon/dash/server.go
@@ -2,41 +2,56 @@ package dash
 
 import (
 	"context"
-	"embed"
 	"encoding/json"
 	"fmt"
-	"io/fs"
 	"net/http"
-	"strings"
+	"net/http/httputil"
 	"sync"
 
-	"encr.dev/cli/daemon/run"
-	"encr.dev/cli/daemon/runtime/trace"
-	"encr.dev/cli/internal/jsonrpc2"
 	"github.com/gorilla/websocket"
 	"github.com/rs/zerolog/log"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/dash/ai"
+	"encr.dev/cli/daemon/dash/apiproxy"
+	"encr.dev/cli/daemon/dash/dashproxy"
+	"encr.dev/cli/daemon/engine/trace2"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/run"
+	"encr.dev/cli/internal/jsonrpc2"
+	"encr.dev/internal/conf"
+	"encr.dev/pkg/fns"
 )
 
 var upgrader = websocket.Upgrader{
 	CheckOrigin: func(*http.Request) bool { return true },
 }
 
-//go:embed dashapp/dist/*
-var assets embed.FS
-
 // NewServer starts a new server and returns it.
-func NewServer(runMgr *run.Manager, tr *trace.Store) *Server {
-	assets, err := fs.Sub(assets, "dashapp/dist")
+func NewServer(appsMgr *apps.Manager, runMgr *run.Manager, nsMgr *namespace.Manager, tr trace2.Store, dashPort int) *Server {
+	proxy, err := dashproxy.New(conf.DevDashURL)
 	if err != nil {
-		log.Fatal().Err(err).Msg("could not get dash assets")
+		log.Fatal().Err(err).Msg("could not create dash proxy")
 	}
 
+	apiProxy, err := apiproxy.New(conf.APIBaseURL + "/graphql")
+	if err != nil {
+		log.Fatal().Err(err).Msg("could not create graphql proxy")
+	}
+
+	aiMgr := ai.NewAIManager()
+
 	s := &Server{
-		run:     runMgr,
-		tr:      tr,
-		assets:  assets,
-		traceCh: make(chan *trace.TraceMeta, 10),
-		clients: make(map[chan<- *notification]struct{}),
+		proxy:    proxy,
+		apiProxy: apiProxy,
+		apps:     appsMgr,
+		run:      runMgr,
+		ns:       nsMgr,
+		tr:       tr,
+		dashPort: dashPort,
+		traceCh:  make(chan trace2.NewSpanEvent, 10),
+		clients:  make(map[chan<- *notification]struct{}),
+		ai:       aiMgr,
 	}
 
 	runMgr.AddListener(s)
@@ -47,27 +62,28 @@ func NewServer(runMgr *run.Manager, tr *trace.Store) *Server {
 
 // Server is the http.Handler for serving the developer dashboard.
 type Server struct {
-	run     *run.Manager
-	tr      *trace.Store
-	traceCh chan *trace.TraceMeta
-	assets  fs.FS
+	proxy    *httputil.ReverseProxy
+	apiProxy *httputil.ReverseProxy
+	apps     *apps.Manager
+	run      *run.Manager
+	ns       *namespace.Manager
+	tr       trace2.Store
+	dashPort int
+	traceCh  chan trace2.NewSpanEvent
+	ai       *ai.Manager
 
 	mu      sync.Mutex
 	clients map[chan<- *notification]struct{}
 }
 
 func (s *Server) ServeHTTP(w http.ResponseWriter, req *http.Request) {
-	path := req.URL.Path
-	fs := http.FileServer(http.FS(s.assets))
-	switch {
-	case path == "/__encore":
+	switch req.URL.Path {
+	case "/__encore":
 		s.WebSocket(w, req)
-	case strings.HasPrefix(path, "/assets/") || path == "/favicon.ico":
-		fs.ServeHTTP(w, req)
+	case "/__graphql":
+		s.apiProxy.ServeHTTP(w, req)
 	default:
-		// Serve the index page for all other paths since we use client-side routing.
-		req.URL.Path = "/"
-		fs.ServeHTTP(w, req)
+		s.proxy.ServeHTTP(w, req)
 	}
 }
 
@@ -78,17 +94,19 @@ func (s *Server) WebSocket(w http.ResponseWriter, req *http.Request) {
 		log.Error().Err(err).Msg("dash: could not upgrade websocket")
 		return
 	}
-	defer c.Close()
+	defer fns.CloseIgnore(c)
 	log.Info().Msg("dash: websocket connection established")
 
 	stream := &wsStream{c: c}
 	conn := jsonrpc2.NewConn(stream)
-	handler := &handler{rpc: conn, run: s.run, tr: s.tr}
+	handler := &handler{rpc: conn, apps: s.apps, run: s.run, ns: s.ns, tr: s.tr, ai: s.ai}
 	conn.Go(req.Context(), handler.Handle)
 
 	ch := make(chan *notification, 20)
 	s.addClient(ch)
 	defer s.removeClient(ch)
+
+	// nosemgrep: tools.semgrep-rules.semgrep-go.http-request-go-context
 	go handler.listenNotify(req.Context(), ch)
 
 	<-conn.Done()
@@ -113,11 +131,19 @@ func (s *Server) removeClient(ch chan *notification) {
 	delete(s.clients, ch)
 }
 
+// hasClients reports whether there are any active clients.
+func (s *Server) hasClients() bool {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return len(s.clients) > 0
+}
+
 type notification struct {
 	Method string
 	Params interface{}
 }
 
+// notify notifies any active clients.
 func (s *Server) notify(n *notification) {
 	var clients []chan<- *notification
 	s.mu.Lock()
diff --git a/cli/daemon/dash/trace.go b/cli/daemon/dash/trace.go
deleted file mode 100644
index 60c03fe8c5..0000000000
--- a/cli/daemon/dash/trace.go
+++ /dev/null
@@ -1,429 +0,0 @@
-package dash
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"net/url"
-	"strconv"
-	"time"
-
-	"encr.dev/cli/daemon/runtime/trace"
-	"encr.dev/cli/internal/dedent"
-	tracepb "encr.dev/proto/encore/engine/trace"
-	"github.com/alecthomas/chroma/formatters/html"
-	"github.com/alecthomas/chroma/lexers"
-	"github.com/alecthomas/chroma/styles"
-	"github.com/gofrs/uuid"
-	"github.com/golang/protobuf/jsonpb"
-)
-
-type Trace struct {
-	ID        uuid.UUID `json:"id"`
-	Date      time.Time `json:"date"`
-	StartTime int64     `json:"start_time"`
-	EndTime   int64     `json:"end_time"`
-	Root      *Request  `json:"root"`
-	Auth      *Request  `json:"auth"`
-	UID       *string   `json:"uid"`
-	UserData  []byte    `json:"user_data"`
-
-	Locations map[int32]json.RawMessage `json:"locations"`
-}
-
-type Request struct {
-	ID        string     `json:"id"`
-	Type      string     `json:"type"`
-	ParentID  *string    `json:"parent_id"`
-	Goid      uint32     `json:"goid"`
-	StartTime int64      `json:"start_time"`
-	EndTime   *int64     `json:"end_time,omitempty"`
-	CallLoc   *int32     `json:"call_loc"`
-	DefLoc    int32      `json:"def_loc"`
-	Inputs    [][]byte   `json:"inputs"`
-	Outputs   [][]byte   `json:"outputs"`
-	Err       []byte     `json:"err"`
-	Events    []Event    `json:"events"`
-	Children  []*Request `json:"children"`
-}
-
-type Goroutine struct {
-	Type      string `json:"type"`
-	Goid      uint32 `json:"goid"`
-	CallLoc   int32  `json:"call_loc"`
-	StartTime int64  `json:"start_time"`
-	EndTime   *int64 `json:"end_time,omitempty"`
-}
-
-type DBTransaction struct {
-	Type           string     `json:"type"`
-	Goid           uint32     `json:"goid"`
-	Txid           uint32     `json:"txid"`
-	StartLoc       int32      `json:"start_loc"`
-	EndLoc         int32      `json:"end_loc"`
-	StartTime      int64      `json:"start_time"`
-	EndTime        *int64     `json:"end_time,omitempty"`
-	Err            []byte     `json:"err"`
-	CompletionType string     `json:"completion_type"`
-	Queries        []*DBQuery `json:"queries"`
-}
-
-type DBQuery struct {
-	Type      string  `json:"type"`
-	Goid      uint32  `json:"goid"`
-	Txid      *uint32 `json:"txid"`
-	CallLoc   int32   `json:"call_loc"`
-	StartTime int64   `json:"start_time"`
-	EndTime   *int64  `json:"end_time,omitempty"`
-	Query     []byte  `json:"query"`
-	HTMLQuery []byte  `json:"html_query"`
-	Err       []byte  `json:"err"`
-}
-
-type RPCCall struct {
-	Type      string `json:"type"`
-	Goid      uint32 `json:"goid"`
-	ReqID     string `json:"req_id"`
-	CallLoc   int32  `json:"call_loc"`
-	DefLoc    int32  `json:"def_loc"`
-	StartTime int64  `json:"start_time"`
-	EndTime   *int64 `json:"end_time,omitempty"`
-	Err       []byte `json:"err"`
-}
-
-type HTTPCall struct {
-	Type       string          `json:"type"`
-	Goid       uint32          `json:"goid"`
-	ReqID      string          `json:"req_id"`
-	StartTime  int64           `json:"start_time"`
-	EndTime    *int64          `json:"end_time,omitempty"`
-	Method     string          `json:"method"`
-	Host       string          `json:"host"`
-	Path       string          `json:"path"`
-	URL        string          `json:"url"`
-	StatusCode int             `json:"status_code"`
-	Err        []byte          `json:"err"`
-	Metrics    HTTPCallMetrics `json:"metrics"`
-}
-
-type HTTPCallMetrics struct {
-	// Times are all 0 if not set
-	GotConn           *int64 `json:"got_conn,omitempty"`
-	ConnReused        bool   `json:"conn_reused,omitempty"`
-	DNSDone           *int64 `json:"dns_done,omitempty"`
-	TLSHandshakeDone  *int64 `json:"tls_handshake_done,omitempty"`
-	WroteHeaders      *int64 `json:"wrote_headers,omitempty"`
-	WroteRequest      *int64 `json:"wrote_request,omitempty"`
-	FirstResponseByte *int64 `json:"first_response,omitempty"`
-	BodyClosed        *int64 `json:"body_closed,omitempty"`
-}
-
-type Event interface {
-	traceEvent()
-}
-
-func (Goroutine) traceEvent()     {}
-func (DBTransaction) traceEvent() {}
-func (DBQuery) traceEvent()       {}
-func (RPCCall) traceEvent()       {}
-func (HTTPCall) traceEvent()      {}
-
-func TransformTrace(ct *trace.TraceMeta) (*Trace, error) {
-	traceID := traceUUID(ct.ID)
-	tr := &Trace{
-		ID:   traceID,
-		Date: ct.Date,
-	}
-
-	tp := &traceParser{}
-	reqMap := make(map[string]*Request)
-	for _, req := range ct.Reqs {
-		if tp.startTime == 0 {
-			tp.startTime = int64(req.StartTime / 1000)
-		}
-		r, err := tp.parseReq(req)
-		if err != nil {
-			return nil, fmt.Errorf("parsing request: %v", err)
-		}
-		reqMap[r.ID] = r
-
-		switch {
-		case req.Type == tracepb.Request_AUTH:
-			if tr.Auth != nil {
-				return nil, fmt.Errorf("got multiple auth calls in trace")
-			}
-			tr.Auth = r
-		case r.ParentID == nil:
-			if tr.Root != nil {
-				return nil, fmt.Errorf("got multiple root requests (%v and %v)", tr.Root.ID, r.ID)
-			}
-			tr.Root = r
-		default:
-			parent, ok := reqMap[*r.ParentID]
-			if !ok {
-				return nil, fmt.Errorf("could not find parent request: %v", *r.ParentID)
-			}
-			parent.Children = append(parent.Children, r)
-		}
-	}
-
-	if tr.Root == nil && tr.Auth == nil {
-		return nil, fmt.Errorf("could not find a root request")
-	}
-
-	// Copy certain properties to the trace from the root request
-	for _, req := range ct.Reqs {
-		if t := tp.time(req.StartTime); t < tr.StartTime {
-			tr.StartTime = t
-		}
-		if t := tp.time(req.EndTime); t > tr.EndTime {
-			tr.EndTime = t
-		}
-	}
-
-	locs := make(map[int32]json.RawMessage)
-	m := &jsonpb.Marshaler{OrigName: true, EmitDefaults: true}
-	for _, pkg := range ct.Meta.Pkgs {
-		for _, e := range pkg.TraceNodes {
-			s, err := m.MarshalToString(e)
-			if err != nil {
-				return nil, err
-			}
-			locs[e.Id] = json.RawMessage(s)
-		}
-	}
-	tr.Locations = locs
-	return tr, nil
-}
-
-type traceParser struct {
-	startTime int64
-	txCounter uint32
-}
-
-func (tp *traceParser) parseReq(req *tracepb.Request) (*Request, error) {
-	// Prevent marshalling as null
-	inputs, outputs := req.Inputs, req.Outputs
-	if inputs == nil {
-		inputs = [][]byte{}
-	}
-	if outputs == nil {
-		outputs = [][]byte{}
-	}
-
-	r := &Request{
-		Type:      req.Type.String(),
-		ID:        strconv.FormatUint(req.SpanId, 10),
-		ParentID:  nullIntStr(req.ParentSpanId),
-		Goid:      req.Goid,
-		StartTime: tp.time(req.StartTime),
-		EndTime:   tp.maybeTime(req.EndTime),
-		CallLoc:   nullInt32(req.CallLoc),
-		DefLoc:    req.DefLoc,
-		Inputs:    inputs,
-		Outputs:   outputs,
-		Err:       nullBytes(req.Err),
-		Events:    []Event{},    // prevent marshalling as null
-		Children:  []*Request{}, // prevent marshalling as null
-	}
-	for _, ev := range req.Events {
-		switch e := ev.Data.(type) {
-		case *tracepb.Event_Tx:
-			tx, err := tp.parseTx(e.Tx)
-			if err != nil {
-				return nil, fmt.Errorf("parsing db transaction event: %v", err)
-			}
-			r.Events = append(r.Events, tx)
-
-		case *tracepb.Event_Query:
-			r.Events = append(r.Events, tp.parseQuery(e.Query, 0))
-
-		case *tracepb.Event_Rpc:
-			r.Events = append(r.Events, tp.parseCall(e.Rpc))
-
-		case *tracepb.Event_Http:
-			r.Events = append(r.Events, tp.parseHTTP(e.Http))
-
-		case *tracepb.Event_Goroutine:
-			r.Events = append(r.Events, tp.parseGoroutine(e.Goroutine))
-		}
-	}
-
-	return r, nil
-}
-
-func (tp *traceParser) parseGoroutine(g *tracepb.Goroutine) *Goroutine {
-	return &Goroutine{
-		Type:      "Goroutine",
-		Goid:      g.Goid,
-		CallLoc:   g.CallLoc,
-		StartTime: tp.time(g.StartTime),
-		EndTime:   tp.maybeTime(g.EndTime),
-	}
-}
-
-func (tp *traceParser) parseTx(tx *tracepb.DBTransaction) (*DBTransaction, error) {
-	tp.txCounter++
-	txid := tp.txCounter
-	t := &DBTransaction{
-		Type:      "DBTransaction",
-		Goid:      tx.Goid,
-		Txid:      txid,
-		StartLoc:  tx.StartLoc,
-		EndLoc:    tx.EndLoc,
-		StartTime: tp.time(tx.StartTime),
-		EndTime:   tp.maybeTime(tx.EndTime),
-		Err:       nullBytes(tx.Err),
-		Queries:   []*DBQuery{}, // prevent marshalling as null
-	}
-	switch tx.Completion {
-	case tracepb.DBTransaction_COMMIT:
-		t.CompletionType = "COMMIT"
-	case tracepb.DBTransaction_ROLLBACK:
-		t.CompletionType = "ROLLBACK"
-	default:
-		return nil, fmt.Errorf("unknown completion type %v", tx.Completion)
-	}
-	for _, q := range tx.Queries {
-		t.Queries = append(t.Queries, tp.parseQuery(q, txid))
-	}
-	return t, nil
-}
-
-func (tp *traceParser) parseQuery(q *tracepb.DBQuery, txid uint32) *DBQuery {
-	query := dedent.Bytes(q.Query)
-	lexer := lexers.Get("postgres")
-	iterator, err := lexer.Tokenise(nil, string(query))
-	var htmlQuery []byte
-	if err == nil {
-		var buf bytes.Buffer
-		formatter := html.New()
-		style := styles.VisualStudio
-		if err = formatter.Format(&buf, style, iterator); err == nil {
-			htmlQuery = buf.Bytes()
-		}
-	}
-
-	return &DBQuery{
-		Type:      "DBQuery",
-		Goid:      q.Goid,
-		Txid:      nullUint32(txid),
-		CallLoc:   q.CallLoc,
-		StartTime: tp.time(q.StartTime),
-		EndTime:   tp.maybeTime(q.EndTime),
-		Query:     dedent.Bytes(q.Query),
-		HTMLQuery: htmlQuery,
-		Err:       nullBytes(q.Err),
-	}
-}
-
-func (tp *traceParser) parseCall(c *tracepb.RPCCall) *RPCCall {
-	return &RPCCall{
-		Type:      "RPCCall",
-		Goid:      c.Goid,
-		ReqID:     strconv.FormatUint(c.SpanId, 10),
-		CallLoc:   c.CallLoc,
-		DefLoc:    c.DefLoc,
-		StartTime: tp.time(c.StartTime),
-		EndTime:   tp.maybeTime(c.EndTime),
-		Err:       nullBytes(c.Err),
-	}
-}
-
-func (tp *traceParser) parseHTTP(c *tracepb.HTTPCall) *HTTPCall {
-	host := ""
-	path := ""
-	if u, err := url.Parse(c.Url); err == nil {
-		host = u.Host
-		path = u.Path
-	}
-
-	call := &HTTPCall{
-		Type:       "HTTPCall",
-		Goid:       c.Goid,
-		ReqID:      strconv.FormatUint(c.SpanId, 10),
-		Method:     c.Method,
-		Host:       host,
-		Path:       path,
-		URL:        c.Url,
-		StatusCode: int(c.StatusCode),
-		StartTime:  tp.time(c.StartTime),
-		EndTime:    tp.maybeTime(c.EndTime),
-		Err:        nullBytes(c.Err),
-		Metrics: HTTPCallMetrics{
-			BodyClosed: tp.maybeTime(c.BodyClosedTime),
-		},
-	}
-	m := &call.Metrics
-	for _, ev := range c.Events {
-		switch ev.Code {
-		case tracepb.HTTPTraceEventCode_GOT_CONN:
-			m.GotConn = tp.maybeTime(ev.Time)
-			m.ConnReused = ev.GetGotConn().Reused
-		case tracepb.HTTPTraceEventCode_DNS_DONE:
-			m.DNSDone = tp.maybeTime(ev.Time)
-		case tracepb.HTTPTraceEventCode_TLS_HANDSHAKE_DONE:
-			m.TLSHandshakeDone = tp.maybeTime(ev.Time)
-		case tracepb.HTTPTraceEventCode_WROTE_HEADERS:
-			m.WroteHeaders = tp.maybeTime(ev.Time)
-		case tracepb.HTTPTraceEventCode_WROTE_REQUEST:
-			m.WroteRequest = tp.maybeTime(ev.Time)
-		case tracepb.HTTPTraceEventCode_GOT_FIRST_RESPONSE_BYTE:
-			m.FirstResponseByte = tp.maybeTime(ev.Time)
-		}
-	}
-	return call
-}
-
-func (tp *traceParser) time(ns uint64) int64 {
-	if ns == 0 {
-		return -1
-	}
-	t := int64(ns/1000) - tp.startTime
-	return t
-}
-
-func (tp *traceParser) maybeTime(ns uint64) *int64 {
-	if ns == 0 {
-		return nil
-	}
-	t := int64(ns/1000) - tp.startTime
-	return &t
-}
-
-func nullIntStr(n uint64) *string {
-	if n == 0 {
-		return nil
-	}
-	s := strconv.FormatUint(n, 10)
-	return &s
-}
-
-func nullInt32(n int32) *int32 {
-	if n == 0 {
-		return nil
-	}
-	return &n
-}
-
-func nullUint32(n uint32) *uint32 {
-	if n == 0 {
-		return nil
-	}
-	return &n
-}
-
-func nullBytes(b []byte) []byte {
-	if len(b) == 0 {
-		return nil
-	}
-	return b
-}
-
-func parseTime(ns uint64) time.Time {
-	return time.Unix(0, int64(ns))
-}
-
-func traceUUID(traceID trace.ID) uuid.UUID {
-	return uuid.UUID(traceID)
-}
diff --git a/cli/daemon/db.go b/cli/daemon/db.go
index e6dfbd1f9b..0719eb78fd 100644
--- a/cli/daemon/db.go
+++ b/cli/daemon/db.go
@@ -2,22 +2,42 @@ package daemon
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net"
 	"strconv"
-	"sync"
 	"time"
 
-	"encr.dev/cli/daemon/internal/appfile"
-	"encr.dev/cli/daemon/internal/manifest"
-	"encr.dev/cli/daemon/internal/runlog"
-	"encr.dev/cli/daemon/sqldb"
-	daemonpb "encr.dev/proto/encore/daemon"
 	"github.com/rs/zerolog/log"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+
+	"encr.dev/cli/daemon/sqldb"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/pkg/appfile"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/builder/builderimpl"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/pgproxy"
+	daemonpb "encr.dev/proto/encore/daemon"
 )
 
+func toRoleType(role daemonpb.DBRole) sqldb.RoleType {
+	switch role {
+	case daemonpb.DBRole_DB_ROLE_READ:
+		return sqldb.RoleRead
+	case daemonpb.DBRole_DB_ROLE_WRITE:
+		return sqldb.RoleWrite
+	case daemonpb.DBRole_DB_ROLE_ADMIN:
+		return sqldb.RoleAdmin
+	case daemonpb.DBRole_DB_ROLE_SUPERUSER:
+		return sqldb.RoleSuperuser
+	default:
+		return sqldb.RoleRead
+	}
+
+}
+
 // DBConnect starts the database and returns the DSN for connecting to it.
 func (s *Server) DBConnect(ctx context.Context, req *daemonpb.DBConnectRequest) (*daemonpb.DBConnectResponse, error) {
 	if req.EnvName == "local" {
@@ -30,44 +50,109 @@ func (s *Server) DBConnect(ctx context.Context, req *daemonpb.DBConnectRequest)
 	} else if appID == "" {
 		return nil, errNotLinked
 	}
-	port, passwd, err := sqldb.OneshotProxy(s.rc, appID, req.EnvName)
+	port, passwd, err := sqldb.OneshotProxy(appID, req.EnvName, toRoleType(req.Role))
 	if err != nil {
 		return nil, err
 	}
-	dsn := fmt.Sprintf("postgresql://encore:%s@localhost:%d/%s?sslmode=disable", passwd, port, req.SvcName)
+	dsn := fmt.Sprintf("postgresql://encore:%s@127.0.0.1:%d/%s?sslmode=disable", passwd, port, req.DbName)
 	return &daemonpb.DBConnectResponse{Dsn: dsn}, nil
 }
 
 func (s *Server) dbConnectLocal(ctx context.Context, req *daemonpb.DBConnectRequest) (*daemonpb.DBConnectResponse, error) {
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		return nil, err
+	}
+
+	expSet, err := app.Experiments(nil)
+	if err != nil {
+		return nil, err
+	}
+
 	// Parse the app to figure out what infrastructure is needed.
-	parse, err := s.parseApp(req.AppRoot, ".", false)
+	bld := builderimpl.Resolve(app.Lang(), expSet)
+	defer fns.CloseIgnore(bld)
+	parse, err := bld.Parse(ctx, builder.ParseParams{
+		Build:       builder.DefaultBuildInfo(),
+		App:         app,
+		Experiments: expSet,
+		WorkingDir:  ".",
+		ParseTests:  false,
+	})
 	if err != nil {
 		return nil, err
 	}
 
-	man, err := manifest.ReadOrCreate(req.AppRoot)
+	// The Encore IDE plugins will request a connection to the database "_any_"
+	// as they will be unaware of any database names ahead of time.
+	//
+	// We will use the first database name in the app's schema on the returned connection string
+	if req.DbName == "_any_" {
+		req.DbName = ""
+		if len(parse.Meta.SqlDatabases) > 0 {
+			req.DbName = parse.Meta.SqlDatabases[0].Name
+		}
+
+		// If no database has been found, return an error
+		if req.DbName == "" {
+			return nil, errDatabaseNotFound
+		}
+	} else {
+		// Otherwise we need to check the requested service exists
+		databaseExists := false
+		for _, s := range parse.Meta.SqlDatabases {
+			if s.Name == req.DbName {
+				databaseExists = true
+				break
+			}
+		}
+		if !databaseExists {
+			return nil, errDatabaseNotFound
+		}
+	}
+
+	clusterNS, err := s.namespaceOrActive(ctx, app, req.Namespace)
 	if err != nil {
 		return nil, err
 	}
 
-	clusterID := man.AppID
-	log := log.With().Str("appID", man.AppID).Logger()
+	var passwd string
+	clusterType := getClusterType(req)
+	switch clusterType {
+	case sqldb.Run:
+		// If the user didn't specify a namespace, leave it out from the password
+		// so it uses the active namespace.
+		if req.Namespace != nil {
+			passwd = "local-" + string(clusterNS.ID)
+		} else {
+			passwd = "local"
+		}
+	default:
+		passwd = fmt.Sprintf("%s-%s", clusterType, clusterNS.ID)
+	}
+
+	clusterID := sqldb.GetClusterID(app, clusterType, clusterNS)
+	log := log.With().Interface("cluster", clusterID).Logger()
 	log.Info().Msg("setting up database cluster")
-	cluster := s.cm.Init(ctx, &sqldb.InitParams{
+	cluster := s.cm.Create(ctx, &sqldb.CreateParams{
 		ClusterID: clusterID,
-		Meta:      parse.Meta,
-		Memfs:     false,
+		Memfs:     clusterType.Memfs(),
 	})
+	if cluster.IsExternalDB(req.DbName) {
+		return nil, errors.New("connecting to an external database is disabled")
+	}
 	// TODO would be nice to stream this to the CLI
-	if err := cluster.Start(runlog.OS()); err != nil {
+	if _, err := cluster.Start(ctx, nil); err != nil {
 		log.Error().Err(err).Msg("failed to start db cluster")
 		return nil, err
-	} else if err := cluster.Create(ctx, req.AppRoot, parse.Meta); err != nil {
+	} else if err := cluster.Setup(ctx, req.AppRoot, parse.Meta); err != nil {
 		log.Error().Err(err).Msg("failed to create databases")
 		return nil, err
 	}
 	log.Info().Msg("created database cluster")
-	dsn := fmt.Sprintf("postgresql://encore:%s@localhost:%d/%s?sslmode=disable", clusterID, s.mgr.DBProxyPort, req.SvcName)
+
+	dsn := fmt.Sprintf("postgresql://%s:%s@127.0.0.1:%d/%s?sslmode=disable",
+		app.PlatformOrLocalID(), passwd, s.mgr.DBProxyPort, req.DbName)
 	return &daemonpb.DBConnectResponse{Dsn: dsn}, nil
 }
 
@@ -87,12 +172,11 @@ func (s *Server) DBProxy(params *daemonpb.DBProxyRequest, stream daemonpb.Daemon
 	if err != nil {
 		return status.Error(codes.FailedPrecondition, err.Error())
 	}
-	defer func() {
-		if err != nil {
-			ln.Close()
-		}
-	}()
 	port := ln.Addr().(*net.TCPAddr).Port
+	go func() {
+		<-ctx.Done()
+		_ = ln.Close()
+	}()
 
 	log.Info().Msgf("dbproxy: listening on localhost:%d", port)
 	defer log.Info().Msg("dbproxy: proxy closed")
@@ -105,43 +189,82 @@ func (s *Server) DBProxy(params *daemonpb.DBProxyRequest, stream daemonpb.Daemon
 		return err
 	}
 
-	var handler func(context.Context, net.Conn)
+	var runProxy func() error
 	if params.EnvName == "local" {
+		app, err := s.apps.Track(params.AppRoot)
+		if err != nil {
+			return err
+		}
+
+		expSet, err := app.Experiments(nil)
+		if err != nil {
+			return err
+		}
+
 		// Parse the app to figure out what infrastructure is needed.
-		parse, err := s.parseApp(params.AppRoot, ".", false)
+		bld := builderimpl.Resolve(app.Lang(), expSet)
+		defer fns.CloseIgnore(bld)
+		parse, err := bld.Parse(ctx, builder.ParseParams{
+			Build:       builder.DefaultBuildInfo(),
+			App:         app,
+			Experiments: expSet,
+			WorkingDir:  ".",
+			ParseTests:  false,
+		})
 		if err != nil {
 			return err
 		}
 
-		man, err := manifest.ReadOrCreate(params.AppRoot)
+		clusterType := getClusterType(params)
+
+		clusterNS, err := s.namespaceOrActive(stream.Context(), app, params.Namespace)
 		if err != nil {
 			return err
 		}
 
-		clusterID := man.AppID
-		cluster := s.cm.Init(ctx, &sqldb.InitParams{
+		clusterID := sqldb.GetClusterID(app, clusterType, clusterNS)
+		cluster := s.cm.Create(ctx, &sqldb.CreateParams{
 			ClusterID: clusterID,
-			Meta:      parse.Meta,
-			Memfs:     false,
+			Memfs:     clusterType.Memfs(),
 		})
-		if err := cluster.Start(streamLog{stream: stream}); err != nil {
+		if _, err := cluster.Start(ctx, nil); err != nil {
 			return err
-		} else if err := cluster.Create(ctx, params.AppRoot, parse.Meta); err != nil {
+		} else if err := cluster.Setup(ctx, params.AppRoot, parse.Meta); err != nil {
 			return err
 		}
-		handler = func(ctx context.Context, frontend net.Conn) {
-			s.cm.PreauthProxyConn(frontend, clusterID)
+		runProxy = func() error {
+			return serveProxy(ctx, ln, func(ctx context.Context, client net.Conn) {
+				_ = s.cm.PreauthProxyConn(client, clusterID)
+			})
 		}
 	} else {
-		handler = func(ctx context.Context, frontend net.Conn) {
-			sqldb.ProxyRemoteConn(ctx, s.rc, frontend, "", appID, params.EnvName)
+		proxy := &pgproxy.SingleBackendProxy{
+			Log:             log.Logger,
+			RequirePassword: false,
+			FrontendTLS:     nil,
+			DialBackend: func(ctx context.Context, startup *pgproxy.StartupData) (pgproxy.LogicalConn, error) {
+				startupData, err := startup.Raw.Encode(nil)
+				if err != nil {
+					return nil, err
+				}
+				ws, err := platform.DBConnect(ctx, appID, params.EnvName, startup.Database, toRoleType(params.Role).String(), startupData)
+				if err != nil {
+					return nil, err
+				}
+				return &sqldb.WebsocketLogicalConn{Conn: ws}, nil
+			},
+		}
+
+		runProxy = func() error {
+			return proxy.Serve(ctx, ln)
 		}
 	}
 
 	msgs := make(chan string, 10)
+	defer close(msgs)
 	go func() {
 		for msg := range msgs {
-			stream.Send(&daemonpb.CommandMessage{Msg: &daemonpb.CommandMessage_Output{
+			_ = stream.Send(&daemonpb.CommandMessage{Msg: &daemonpb.CommandMessage_Output{
 				Output: &daemonpb.CommandOutput{
 					Stdout: []byte(msg),
 				},
@@ -149,68 +272,72 @@ func (s *Server) DBProxy(params *daemonpb.DBProxyRequest, stream daemonpb.Daemon
 		}
 	}()
 
-	var wg sync.WaitGroup
-	err = serveProxy(ctx, ln, func(ctx context.Context, frontend net.Conn) {
-		wg.Add(1)
-		defer wg.Done()
-		msgs <- "dbproxy: connection opened\n"
-		handler(ctx, frontend)
-		msgs <- "dbproxy: connection closed\n"
-	})
-
-	go func() {
-		// Close the msgs chan when all connections are closed
-		wg.Wait()
-		close(msgs)
-	}()
-
-	return err
+	return runProxy()
 }
 
 // DBReset resets the given databases, recreating them from scratch.
 func (s *Server) DBReset(req *daemonpb.DBResetRequest, stream daemonpb.Daemon_DBResetServer) error {
 	sendErr := func(err error) {
-		stream.Send(&daemonpb.CommandMessage{
+		_ = stream.Send(&daemonpb.CommandMessage{
 			Msg: &daemonpb.CommandMessage_Output{Output: &daemonpb.CommandOutput{
 				Stderr: []byte(err.Error() + "\n"),
 			}},
 		})
-		stream.Send(&daemonpb.CommandMessage{
+		_ = stream.Send(&daemonpb.CommandMessage{
 			Msg: &daemonpb.CommandMessage_Exit{Exit: &daemonpb.CommandExit{
 				Code: 1,
 			}},
 		})
 	}
 
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		sendErr(err)
+		return nil
+	}
+
+	expSet, err := app.Experiments(nil)
+	if err != nil {
+		sendErr(err)
+		return nil
+	}
+
 	// Parse the app to figure out what infrastructure is needed.
-	parse, err := s.parseApp(req.AppRoot, ".", false)
+	bld := builderimpl.Resolve(app.Lang(), expSet)
+	defer fns.CloseIgnore(bld)
+	parse, err := bld.Parse(stream.Context(), builder.ParseParams{
+		Build:       builder.DefaultBuildInfo(),
+		App:         app,
+		Experiments: expSet,
+		WorkingDir:  ".",
+		ParseTests:  false,
+	})
 	if err != nil {
 		sendErr(err)
 		return nil
 	}
 
-	man, err := manifest.ReadOrCreate(req.AppRoot)
+	clusterNS, err := s.namespaceOrActive(stream.Context(), app, req.Namespace)
 	if err != nil {
 		sendErr(err)
 		return nil
 	}
 
-	clusterID := man.AppID
+	clusterType := getClusterType(req)
+	clusterID := sqldb.GetClusterID(app, clusterType, clusterNS)
 	cluster, ok := s.cm.Get(clusterID)
 	if !ok {
-		cluster = s.cm.Init(stream.Context(), &sqldb.InitParams{
+		cluster = s.cm.Create(stream.Context(), &sqldb.CreateParams{
 			ClusterID: clusterID,
-			Memfs:     false,
-			Meta:      parse.Meta,
+			Memfs:     clusterType.Memfs(),
 		})
 	}
 
-	if err := cluster.Start(streamLog{stream: stream}); err != nil {
+	if _, err := cluster.Start(stream.Context(), nil); err != nil {
 		sendErr(err)
 		return nil
 	}
-
-	err = cluster.Recreate(stream.Context(), req.AppRoot, req.Services, parse.Meta)
+	err = cluster.Recreate(stream.Context(), req.AppRoot, req.DatabaseNames, parse.Meta)
 	if err != nil {
 		sendErr(err)
 	}
@@ -241,3 +368,16 @@ func serveProxy(ctx context.Context, ln net.Listener, handler func(context.Conte
 		go handler(ctx, frontend)
 	}
 }
+
+func getClusterType(req interface{ GetClusterType() daemonpb.DBClusterType }) sqldb.ClusterType {
+	switch req.GetClusterType() {
+	case daemonpb.DBClusterType_DB_CLUSTER_TYPE_RUN:
+		return sqldb.Run
+	case daemonpb.DBClusterType_DB_CLUSTER_TYPE_TEST:
+		return sqldb.Test
+	case daemonpb.DBClusterType_DB_CLUSTER_TYPE_SHADOW:
+		return sqldb.Shadow
+	default:
+		return sqldb.Run
+	}
+}
diff --git a/cli/daemon/debug.go b/cli/daemon/debug.go
new file mode 100644
index 0000000000..840591882a
--- /dev/null
+++ b/cli/daemon/debug.go
@@ -0,0 +1,83 @@
+package daemon
+
+import (
+	"bytes"
+	"context"
+	"runtime"
+
+	"github.com/golang/protobuf/jsonpb"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+
+	"encr.dev/internal/version"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/builder/builderimpl"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/vcs"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+func (s *Server) DumpMeta(ctx context.Context, req *daemonpb.DumpMetaRequest) (*daemonpb.DumpMetaResponse, error) {
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	expSet, err := app.Experiments(req.Environ)
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	// TODO: We should check that all secret keys are defined as well.
+
+	vcsRevision := vcs.GetRevision(app.Root())
+	buildInfo := builder.BuildInfo{
+		BuildTags:          builder.LocalBuildTags,
+		CgoEnabled:         true,
+		StaticLink:         false,
+		DebugMode:          builder.DebugModeDisabled,
+		Environ:            req.Environ,
+		GOOS:               runtime.GOOS,
+		GOARCH:             runtime.GOARCH,
+		KeepOutput:         false,
+		Revision:           vcsRevision.Revision,
+		UncommittedChanges: vcsRevision.Uncommitted,
+
+		// Use the local JS runtime if this is a development build.
+		UseLocalJSRuntime: version.Channel == version.DevBuild,
+	}
+
+	bld := builderimpl.Resolve(app.Lang(), expSet)
+	defer fns.CloseIgnore(bld)
+	parse, err := bld.Parse(ctx, builder.ParseParams{
+		Build:       buildInfo,
+		App:         app,
+		Experiments: expSet,
+		WorkingDir:  req.WorkingDir,
+		ParseTests:  req.ParseTests,
+	})
+	if err != nil {
+		return nil, status.Error(codes.InvalidArgument, err.Error())
+	}
+
+	var out []byte
+	switch req.Format {
+	case daemonpb.DumpMetaRequest_FORMAT_PROTO:
+		out, err = proto.Marshal(parse.Meta)
+		if err != nil {
+			return nil, status.Error(codes.InvalidArgument, err.Error())
+		}
+	case daemonpb.DumpMetaRequest_FORMAT_JSON:
+		var buf bytes.Buffer
+		m := &jsonpb.Marshaler{OrigName: true, EmitDefaults: true, Indent: "  "}
+		if err := m.Marshal(&buf, parse.Meta); err != nil {
+			return nil, status.Error(codes.InvalidArgument, err.Error())
+		}
+		out = buf.Bytes()
+	default:
+		return nil, status.Error(codes.InvalidArgument, "invalid format")
+	}
+
+	return &daemonpb.DumpMetaResponse{Meta: out}, nil
+}
diff --git a/cli/daemon/engine/runtime.go b/cli/daemon/engine/runtime.go
new file mode 100644
index 0000000000..2fe2aa28e0
--- /dev/null
+++ b/cli/daemon/engine/runtime.go
@@ -0,0 +1,89 @@
+package engine
+
+import (
+	"bufio"
+	"fmt"
+	"net/http"
+	"strconv"
+
+	"github.com/cockroachdb/errors"
+
+	tracemodel "encore.dev/appruntime/exported/trace2"
+	"encr.dev/cli/daemon/engine/trace2"
+	"encr.dev/cli/daemon/run"
+)
+
+type server struct {
+	runMgr *run.Manager
+	rec    *trace2.Recorder
+}
+
+func NewServer(runMgr *run.Manager, rec *trace2.Recorder) http.Handler {
+	s := &server{runMgr: runMgr, rec: rec}
+	return s
+}
+
+// ServeHTTP implements http.Handler.
+func (s *server) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	switch req.URL.Path {
+	case "/trace":
+		s.RecordTrace(w, req)
+	default:
+		http.Error(w, "Not Found", http.StatusNotFound)
+	}
+}
+
+func (s *server) RecordTrace(w http.ResponseWriter, req *http.Request) {
+	data, err := s.parseTraceData(req)
+	if err != nil {
+		http.Error(w, "unable to parse trace header: "+err.Error(), http.StatusBadRequest)
+		return
+	}
+
+	err = s.rec.RecordTrace(data)
+	if err != nil {
+		http.Error(w, "unable to record trace: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+}
+
+func (s *server) parseTraceData(req *http.Request) (d trace2.RecordData, err error) {
+	// Parse trace version
+	traceVersion := req.Header.Get("X-Encore-Trace-Version")
+	version, err := strconv.Atoi(traceVersion)
+	if err != nil || version <= 0 {
+		return d, fmt.Errorf("bad trace protocol version %q", traceVersion)
+	}
+	d.TraceVersion = tracemodel.Version(version)
+
+	pid := req.Header.Get("X-Encore-Env-ID")
+	if pid == "test" {
+		appID := req.Header.Get("X-Encore-App-ID")
+		if appID == "" {
+			return d, errors.New("missing X-Encore-App-ID header")
+		}
+		d.Meta = &trace2.Meta{AppID: appID}
+	} else {
+		if pid == "" {
+			return d, errors.New("missing X-Encore-Env-ID header")
+		}
+		proc := s.runMgr.FindProc(pid)
+		if proc == nil {
+			return d, errors.Newf("process %q is not running", pid)
+		}
+		d.Meta = &trace2.Meta{AppID: proc.Run.App.PlatformOrLocalID()}
+	}
+
+	// Parse time anchor
+	timeAnchor := req.Header.Get("X-Encore-Trace-TimeAnchor")
+	if timeAnchor == "" {
+		return d, errors.New("missing X-Encore-Trace-TimeAnchor header")
+	}
+
+	if err := d.Anchor.UnmarshalText([]byte(timeAnchor)); err != nil {
+		return d, errors.Wrap(err, "unable to parse X-Encore-Trace-TimeAnchor header")
+	}
+
+	d.Buf = bufio.NewReader(req.Body)
+	return d, nil
+}
diff --git a/cli/daemon/engine/trace/parse_test.go b/cli/daemon/engine/trace/parse_test.go
new file mode 100644
index 0000000000..3b8d8ebb1c
--- /dev/null
+++ b/cli/daemon/engine/trace/parse_test.go
@@ -0,0 +1,110 @@
+package trace
+
+import (
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/trace"
+	"encore.dev/beta/errs"
+)
+
+type parseTest[T any] struct {
+	name string
+	val  T
+	emit func(l *trace.Log, val T)
+}
+
+func (pt parseTest[T]) Name() string {
+	return pt.name
+}
+
+func (pt parseTest[T]) Data() []byte {
+	log := &trace.Log{}
+	pt.emit(log, pt.val)
+	return log.GetAndClear()
+}
+
+func TestParse(t *testing.T) {
+	type reqResp struct {
+		Req  *model.Request
+		Resp *model.Response
+	}
+	tests := []interface {
+		Name() string
+		Data() []byte
+	}{
+		parseTest[*model.Request]{
+			name: "basic",
+			val: &model.Request{
+				Type:         model.RPCCall,
+				SpanID:       model.SpanID{0, 0, 0, 0, 0, 0, 0, 1},
+				ParentSpanID: model.SpanID{},
+				Start:        time.Now(),
+				Traced:       true,
+				RPCData: &model.RPCData{
+					Desc: &model.RPCDesc{
+						Service:  "service",
+						Endpoint: "endpoint",
+						Raw:      false,
+					},
+					HTTPMethod:     "POST",
+					Path:           "/path/hello",
+					PathParams:     model.PathParams{{Name: "one", Value: "hello"}},
+					UserID:         "",
+					AuthData:       nil,
+					NonRawPayload:  []byte(`{"Body":"foo"}`),
+					RequestHeaders: http.Header{"Content-Type": []string{"application/json"}},
+				},
+			},
+			emit: func(l *trace.Log, val *model.Request) { l.BeginRequest(val, 0) },
+		},
+		parseTest[reqResp]{
+			name: "raw_err",
+			val: reqResp{
+				Req: &model.Request{
+					Type:         model.RPCCall,
+					SpanID:       model.SpanID{0, 0, 0, 0, 0, 0, 0, 1},
+					ParentSpanID: model.SpanID{},
+					Start:        time.Now(),
+					Traced:       true,
+					RPCData: &model.RPCData{
+						Desc: &model.RPCDesc{
+							Service:  "service",
+							Endpoint: "endpoint",
+							Raw:      true,
+						},
+						HTTPMethod:     "POST",
+						Path:           "/path/hello",
+						PathParams:     model.PathParams{{Name: "one", Value: "hello"}},
+						RequestHeaders: http.Header{"Content-Type": []string{"application/json"}},
+					},
+				},
+				Resp: &model.Response{
+					HTTPStatus:         500,
+					Err:                &errs.Error{Code: errs.Unavailable},
+					RawRequestPayload:  []byte("foo"),
+					RawResponsePayload: []byte("bar"),
+				},
+			},
+			emit: func(l *trace.Log, val reqResp) {
+				l.BeginRequest(val.Req, 0)
+				l.FinishRequest(val.Req, val.Resp)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.Name(), func(t *testing.T) {
+			data := tt.Data()
+			logger := zerolog.New(zerolog.NewTestWriter(t))
+			_, err := Parse(&logger, ID{}, data, trace.CurrentVersion, nil)
+			if err != nil {
+				t.Fatalf("failed to parse trace: %v", err)
+			}
+		})
+	}
+}
diff --git a/cli/daemon/engine/trace/trace.go b/cli/daemon/engine/trace/trace.go
new file mode 100644
index 0000000000..7c8cbe0aa6
--- /dev/null
+++ b/cli/daemon/engine/trace/trace.go
@@ -0,0 +1,1398 @@
+package trace
+
+import (
+	"context"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"math"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"encore.dev/appruntime/exported/trace"
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/internal/sym"
+	"encr.dev/pkg/eerror"
+	tracepb "encr.dev/proto/encore/engine/trace"
+	metapb "encr.dev/proto/encore/parser/meta/v1"
+)
+
+type ID [16]byte
+
+type TraceMeta struct {
+	ID    ID
+	Reqs  []*tracepb.Request
+	App   *apps.Instance
+	EnvID string
+	Date  time.Time
+	Meta  *metapb.Data
+}
+
+// A Store stores traces received from running applications.
+type Store struct {
+	trmu             sync.Mutex
+	traces           map[string][]*TraceMeta
+	requestIDMapping map[string]*tracepb.Request // Trace ID -> Request
+
+	lnmu sync.Mutex
+	ln   map[chan<- *TraceMeta]struct{}
+}
+
+func NewStore() *Store {
+	return &Store{
+		traces:           make(map[string][]*TraceMeta),
+		requestIDMapping: make(map[string]*tracepb.Request),
+		ln:               make(map[chan<- *TraceMeta]struct{}),
+	}
+}
+
+func (st *Store) Listen(ch chan<- *TraceMeta) {
+	st.lnmu.Lock()
+	st.ln[ch] = struct{}{}
+	st.lnmu.Unlock()
+}
+
+func (st *Store) Store(ctx context.Context, tr *TraceMeta) error {
+	appID := tr.App.PlatformOrLocalID()
+	st.trmu.Lock()
+	st.traces[appID] = append(st.traces[appID], tr)
+
+	const limit = 100
+	// Remove earlier traces if we exceed the limit.
+	if n := len(st.traces[appID]); n > limit {
+		st.traces[appID] = st.traces[appID][n-limit:]
+	}
+
+	for _, req := range tr.Reqs {
+		st.requestIDMapping[req.TraceId.String()] = req
+	}
+
+	st.trmu.Unlock()
+
+	st.lnmu.Lock()
+	defer st.lnmu.Unlock()
+	for ch := range st.ln {
+		// Don't block trying to send
+		select {
+		case ch <- tr:
+		default:
+		}
+	}
+	return nil
+}
+
+func (st *Store) GetRootTrace(traceID *tracepb.TraceID) (rtn *tracepb.Request) {
+	st.trmu.Lock()
+	defer st.trmu.Unlock()
+
+	next := st.requestIDMapping[traceID.String()]
+	for next != nil {
+		rtn = next
+		next = st.requestIDMapping[rtn.ParentTraceId.String()]
+	}
+
+	return rtn
+}
+
+func (st *Store) List(appID string) []*TraceMeta {
+	st.trmu.Lock()
+	tr := st.traces[appID]
+	st.trmu.Unlock()
+	return tr
+}
+
+func Parse(log *zerolog.Logger, traceID ID, data []byte, version trace.Version, symTable SymTabler) ([]*tracepb.Request, error) {
+	id := &tracepb.TraceID{
+		Low:  bin.Uint64(traceID[:8]),
+		High: bin.Uint64(traceID[8:]),
+	}
+	tp := &traceParser{
+		log:          log,
+		version:      version,
+		traceReader:  traceReader{buf: data},
+		symTable:     symTable,
+		traceID:      id,
+		reqMap:       make(map[uint64]*tracepb.Request),
+		txMap:        make(map[uint64]*tracepb.DBTransaction),
+		queryMap:     make(map[uint64]*tracepb.DBQuery),
+		callMap:      make(map[uint64]interface{}),
+		goMap:        make(map[goKey]*tracepb.Goroutine),
+		httpMap:      make(map[uint64]*tracepb.HTTPCall),
+		publishMap:   make(map[uint64]*tracepb.PubsubMsgPublished),
+		serviceInits: make(map[uint64]*tracepb.ServiceInit),
+		cacheMap:     make(map[uint64]*tracepb.CacheOp),
+	}
+	if err := tp.Parse(); err != nil {
+		return nil, err
+	}
+	return tp.reqs, nil
+}
+
+type goKey struct {
+	spanID uint64
+	goid   uint32
+}
+
+type SymTabler interface {
+	SymTable(ctx context.Context) (*sym.Table, error)
+}
+
+type traceParser struct {
+	traceReader
+	log          *zerolog.Logger
+	version      trace.Version
+	symTable     SymTabler
+	traceID      *tracepb.TraceID
+	reqs         []*tracepb.Request
+	reqMap       map[uint64]*tracepb.Request
+	txMap        map[uint64]*tracepb.DBTransaction
+	queryMap     map[uint64]*tracepb.DBQuery
+	callMap      map[uint64]interface{} // *RPCCall or *AuthCall
+	httpMap      map[uint64]*tracepb.HTTPCall
+	goMap        map[goKey]*tracepb.Goroutine
+	publishMap   map[uint64]*tracepb.PubsubMsgPublished
+	serviceInits map[uint64]*tracepb.ServiceInit
+	cacheMap     map[uint64]*tracepb.CacheOp
+}
+
+func (tp *traceParser) Parse() error {
+	for i := 0; !tp.Done(); i++ {
+		ev := trace.EventType(tp.Byte())
+		ts := tp.Uint64()
+		size := int(tp.Uint32())
+		startOff := tp.Offset()
+
+		var err error
+		if tp.version >= 3 {
+			err = tp.parseEventV3(ev, ts, size)
+		} else {
+			err = tp.parseEventV1(byte(ev), ts, size)
+		}
+
+		if errors.Is(err, errUnknownEvent) {
+			tp.log.Info().Msgf("trace: event #%d: unknown event type %s, skipping", i, ev.String())
+			tp.Skip(size)
+			err = nil
+		} else if err != nil {
+			return eerror.WithMeta(err, map[string]any{"event#": i, "event": ev.String()})
+		}
+
+		if tp.Overflow() {
+			return eerror.New("trace_parser", "invalid trace format: reader overflow parsing event", map[string]any{"event#": i, "event": ev})
+		} else if off, want := tp.Offset(), startOff+size; off < want {
+			tp.log.Warn().Msgf("trace: event #%d: parsing event=%s ended before end of frame, skipping ahead %d bytes", i, ev, want-off)
+			tp.Skip(want - off)
+		} else if off > want {
+			return eerror.New("trace_parser", "event exceed frame size", map[string]any{"event#": i, "event": ev.String(), "excess": off - want})
+		}
+	}
+
+	return nil
+}
+
+var errUnknownEvent = errors.New("unknown event")
+
+func (tp *traceParser) parseEventV3(ev trace.EventType, ts uint64, size int) error {
+	switch ev {
+	case trace.RequestStart:
+		return tp.requestStart(ts)
+	case trace.RequestEnd:
+		return tp.requestEnd(ts)
+	case trace.GoStart:
+		return tp.goroutineStart(ts)
+	case trace.GoEnd:
+		return tp.goroutineEnd(ts)
+	case trace.GoClear:
+		return tp.goroutineClear(ts)
+	case trace.TxStart:
+		return tp.transactionStart(ts)
+	case trace.TxEnd:
+		return tp.transactionEnd(ts)
+	case trace.QueryStart:
+		return tp.queryStart(ts)
+	case trace.QueryEnd:
+		return tp.queryEnd(ts)
+	case trace.CallStart:
+		return tp.callStart(ts, size)
+	case trace.CallEnd:
+		return tp.callEnd(ts)
+	case trace.AuthStart, trace.AuthEnd:
+		// Skip these events for now
+		tp.Skip(size)
+		return nil
+
+	case trace.HTTPCallStart:
+		return tp.httpStart(ts)
+	case trace.HTTPCallEnd:
+		return tp.httpEnd(ts)
+	case trace.HTTPCallBodyClosed:
+		return tp.httpBodyClosed(ts)
+	case trace.LogMessage:
+		return tp.logMessage(ts)
+	case trace.PublishStart:
+		return tp.publishStart(ts)
+	case trace.PublishEnd:
+		return tp.publishEnd(ts)
+	case trace.ServiceInitStart:
+		return tp.serviceInitStart(ts)
+	case trace.ServiceInitEnd:
+		return tp.serviceInitEnd(ts)
+	case trace.CacheOpStart:
+		return tp.cacheOpStart(ts)
+	case trace.CacheOpEnd:
+		return tp.cacheOpEnd(ts)
+	case trace.BodyStream:
+		return tp.bodyStream(ts)
+	default:
+		return errUnknownEvent
+	}
+}
+
+func (tp *traceParser) parseEventV1(ev byte, ts uint64, size int) error {
+	switch ev {
+	case 0x01:
+		return tp.requestStart(ts)
+	case 0x02:
+		return tp.requestEnd(ts)
+	case 0x03:
+		return tp.goroutineStart(ts)
+	case 0x04:
+		return tp.goroutineEnd(ts)
+	case 0x05:
+		return tp.goroutineClear(ts)
+	case 0x06:
+		return tp.transactionStart(ts)
+	case 0x07:
+		return tp.transactionEnd(ts)
+	case 0x08:
+		return tp.queryStart(ts)
+	case 0x09:
+		return tp.queryEnd(ts)
+	case 0x10:
+		return tp.callStart(ts, size)
+	case 0x11:
+		return tp.callEnd(ts)
+	case 0x12, 0x13:
+		// Skip these events for now
+		tp.Skip(size)
+		return nil
+
+	default:
+		return errUnknownEvent
+	}
+}
+
+func (tp *traceParser) requestStart(ts uint64) error {
+	typ, err := tp.parseRequestType()
+	if err != nil {
+		return err
+	}
+
+	// Determine the absolute start time.
+	var absStart time.Time
+	if tp.version >= 6 {
+		absStart = tp.Time()
+	} else {
+		// We don't have enough information to determine the exact start time,
+		// but approximate it from the monotonic clock reading
+		absStart = time.Unix(0, int64(ts))
+	}
+
+	// Set the trace ID
+	traceID := tp.traceID
+	if tp.version >= 11 {
+		parsedTraceID := tp.parseTraceID()
+		if parsedTraceID.Low != 0 || parsedTraceID.High != 0 {
+			traceID = parsedTraceID
+		}
+	}
+	var parentTraceID *tracepb.TraceID
+	if tp.version >= 12 {
+		parentTraceID = tp.parseTraceID()
+	}
+
+	spanID := tp.Uint64()
+	parentSpanID := tp.Uint64()
+
+	var service, endpoint string
+	if tp.version < 6 {
+		service, endpoint = "unknown", "Unknown"
+	} else if tp.version < 9 {
+		service = tp.String()
+		endpoint = tp.String()
+	}
+
+	goid := uint32(tp.UVarint())
+	if tp.version < 9 {
+		_ = tp.UVarint() // skip CallLoc: no longer used
+	}
+	defLoc := int32(tp.UVarint())
+
+	req := &tracepb.Request{
+		TraceId:       traceID,
+		ParentTraceId: parentTraceID,
+		SpanId:        spanID,
+		ParentSpanId:  parentSpanID,
+		StartTime:     ts,
+		ServiceName:   service,
+		EndpointName:  endpoint,
+		AbsStartTime:  uint64(absStart.UnixNano()),
+		// EndTime not set yet
+		DefLoc: defLoc,
+		Goid:   goid,
+		Type:   typ,
+	}
+
+	if tp.version < 9 {
+		req.Uid = tp.String()
+
+		for n, i := tp.UVarint(), uint64(0); i < n; i++ {
+			size := tp.UVarint()
+			if size > (10 << 20) {
+				return eerror.New("trace_parser", "input too large", map[string]any{"size": size})
+			}
+			input := make([]byte, size)
+			tp.Bytes(input)
+			req.Inputs = append(req.Inputs, input)
+		}
+	}
+
+	switch typ {
+	case tracepb.Request_RPC:
+		if tp.version >= 9 {
+			isRaw := tp.Bool()
+			req.ServiceName = tp.String()
+			req.EndpointName = tp.String()
+			req.HttpMethod = tp.String()
+			req.Path = tp.String()
+
+			numParams := tp.UVarint()
+			req.PathParams = make([]string, numParams)
+			for i := uint64(0); i < numParams; i++ {
+				req.PathParams[i] = tp.String()
+			}
+
+			req.Uid = tp.String()
+
+			if tp.version >= 11 {
+				req.ExternalRequestId = tp.String()
+
+				if tp.version >= 12 {
+					req.ExternalCorrelationId = tp.String()
+				}
+			}
+
+			if isRaw {
+				req.RawRequestHeaders = tp.parseHTTPHeaders()
+			} else {
+				req.RequestPayload = tp.ByteString()
+			}
+		}
+
+	case tracepb.Request_AUTH:
+		if tp.version >= 9 {
+			req.ServiceName = tp.String()
+			req.EndpointName = tp.String()
+			req.RequestPayload = tp.ByteString()
+		}
+
+	case tracepb.Request_PUBSUB_MSG:
+		if tp.version >= 9 {
+			req.ServiceName = tp.String()
+		}
+
+		req.TopicName = tp.String()
+		req.SubscriptionName = tp.String()
+		req.MessageId = tp.String()
+		req.Attempt = tp.Uint32()
+		req.PublishTime = uint64(tp.Time().UnixMilli())
+
+		if tp.version >= 10 {
+			req.RequestPayload = tp.ByteString()
+		}
+	}
+
+	tp.reqs = append(tp.reqs, req)
+	tp.reqMap[req.SpanId] = req
+	return nil
+}
+
+func (tp *traceParser) bodyStream(ts uint64) error {
+	spanID := tp.Uint64()
+	req, ok := tp.reqMap[spanID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown request span", map[string]any{"spanID": spanID})
+	}
+	flags := tp.Byte()
+	data := tp.ByteString()
+
+	isResponse := (flags & 1) == 1
+	overflowed := (flags & 2) == 2
+
+	req.Events = append(req.Events, &tracepb.Event{
+		Data: &tracepb.Event_BodyStream{
+			BodyStream: &tracepb.BodyStream{
+				IsResponse: isResponse,
+				Overflowed: overflowed,
+				Data:       data,
+			},
+		},
+	})
+
+	return nil
+}
+
+func (tp *traceParser) requestEnd(ts uint64) error {
+	var typ tracepb.Request_Type
+	if tp.version >= 9 {
+		var err error
+		typ, err = tp.parseRequestType()
+		if err != nil {
+			return err
+		}
+	}
+
+	spanID := tp.Uint64()
+	req, ok := tp.reqMap[spanID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown request span", map[string]any{"spanID": spanID})
+	}
+	if tp.version < 9 {
+		// Not captured by the protocol for old versions,
+		// so grab it from the request.
+		typ = req.Type
+	}
+
+	// dur := ts - rd.startTs
+	req.EndTime = ts
+
+	if tp.version >= 9 {
+		errMsg := tp.ByteString()
+		if len(errMsg) > 0 {
+			req.Err = errMsg
+
+			req.ErrStack = tp.stack(filterNone)
+			if tp.version >= 13 {
+				req.PanicStack = tp.formattedStack()
+			}
+		}
+
+		switch typ {
+		case tracepb.Request_RPC:
+			if isRaw := tp.Bool(); isRaw {
+				req.RawResponseHeaders = tp.parseHTTPHeaders()
+			} else {
+				req.ResponsePayload = tp.ByteString()
+			}
+		case tracepb.Request_AUTH:
+			req.Uid = tp.String()
+			req.ResponsePayload = tp.ByteString()
+		case tracepb.Request_PUBSUB_MSG:
+			req.ResponsePayload = tp.ByteString()
+		}
+	} else {
+		isErr := tp.Bool()
+		if isErr {
+			msg := tp.ByteString()
+			if len(msg) == 0 {
+				msg = []byte("unknown error")
+			}
+			if tp.version >= 5 {
+				req.ErrStack = tp.stack(filterNone)
+			}
+		} else {
+			for n, i := tp.UVarint(), uint64(0); i < n; i++ {
+				size := tp.UVarint()
+				if size > (10 << 20) {
+					return eerror.New("trace_parser", "input too large", map[string]any{"size": size})
+				}
+				output := make([]byte, size)
+				tp.Bytes(output)
+				req.Outputs = append(req.Outputs, output)
+			}
+		}
+	}
+
+	return nil
+}
+
+func (tp *traceParser) goroutineStart(ts uint64) error {
+	spanID := tp.Uint64()
+	req, ok := tp.reqMap[spanID]
+	if !ok {
+		// This is an expected error in certain situations like goroutines
+		// living past the request end that then spawn additional goroutines.
+		// Treat it as a warning but don't fail the parse.
+		tp.log.Warn().Uint64("span_id", spanID).Msg("unknown request span")
+		return nil
+	}
+	goid := tp.Uint32()
+	g := &tracepb.Goroutine{
+		Goid:      goid,
+		StartTime: ts,
+	}
+	k := goKey{spanID: spanID, goid: goid}
+	req.Events = append(req.Events, &tracepb.Event{
+		Data: &tracepb.Event_Goroutine{Goroutine: g},
+	})
+	tp.goMap[k] = g
+	return nil
+}
+
+func (tp *traceParser) goroutineEnd(ts uint64) error {
+	spanID := tp.Uint64()
+	goid := tp.Uint32()
+	k := goKey{spanID: spanID, goid: goid}
+	g, ok := tp.goMap[k]
+	if !ok {
+		return eerror.New("trace_parser", "unknown goroutine id", map[string]any{"goid": goid})
+	}
+	g.EndTime = ts
+	delete(tp.goMap, k)
+	return nil
+}
+
+func (tp *traceParser) goroutineClear(ts uint64) error {
+	spanID := tp.Uint64()
+	goid := tp.Uint32()
+	k := goKey{spanID: spanID, goid: goid}
+	g, ok := tp.goMap[k]
+	if !ok {
+		return eerror.New("trace_parser", "unknown goroutine id", map[string]any{"spanID": spanID, "goid": goid})
+	}
+	g.EndTime = ts
+	delete(tp.goMap, k)
+	return nil
+}
+
+func (tp *traceParser) transactionStart(ts uint64) error {
+	txid := tp.UVarint()
+	spanID := tp.Uint64()
+	req, ok := tp.reqMap[spanID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown request span", map[string]any{"spanID": spanID})
+	}
+	goid := uint32(tp.UVarint())
+
+	if tp.version < 4 {
+		_ = tp.UVarint() // StartLoc; no longer used
+	}
+
+	tx := &tracepb.DBTransaction{
+		Goid:      goid,
+		StartTime: ts,
+	}
+	if tp.version >= 5 {
+		tx.BeginStack = tp.stack(filterDB)
+	}
+	tp.txMap[txid] = tx
+	req.Events = append(req.Events, &tracepb.Event{
+		Data: &tracepb.Event_Tx{Tx: tx},
+	})
+	return nil
+}
+
+func (tp *traceParser) transactionEnd(ts uint64) error {
+	txid := tp.UVarint()
+	_ = tp.Uint64() // spanID
+	tx, ok := tp.txMap[txid]
+	if !ok {
+		return eerror.New("trace_parser", "unknown transaction id", map[string]any{"txid": txid})
+	}
+	_ = uint32(tp.UVarint()) // goid
+	compl := tp.Byte()
+	if tp.version < 4 {
+		_ = int32(tp.UVarint()) // EndLoc; no longer used
+	}
+	errMsg := tp.ByteString()
+
+	var stack *tracepb.StackTrace
+	if tp.version >= 5 {
+		stack = tp.stack(filterDB)
+	}
+
+	// It's possible to get multiple transaction end events.
+	// Ignore them for now; we will expose this information later.
+	if tx.EndTime == 0 {
+		tx.EndTime = ts
+		tx.Err = errMsg
+		tx.EndStack = stack
+		switch compl {
+		case 0:
+			tx.Completion = tracepb.DBTransaction_ROLLBACK
+		case 1:
+			tx.Completion = tracepb.DBTransaction_COMMIT
+		default:
+			return eerror.New("trace_parser", "unknown completion type", map[string]any{"compl": compl})
+		}
+	}
+	return nil
+}
+
+func (tp *traceParser) queryStart(ts uint64) error {
+	qid := tp.UVarint()
+	spanID := tp.Uint64()
+	req, ok := tp.reqMap[spanID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown request span", map[string]any{"spanID": spanID})
+	}
+	txid := tp.UVarint()
+	goid := uint32(tp.UVarint())
+
+	if tp.version < 4 {
+		_ = tp.UVarint() // CallLoc; no longer used
+	}
+	q := &tracepb.DBQuery{
+		Goid:      goid,
+		StartTime: ts,
+		Query:     tp.ByteString(),
+	}
+	if tp.version >= 5 {
+		q.Stack = tp.stack(filterDB)
+	}
+	tp.queryMap[qid] = q
+
+	if txid != 0 {
+		tx, ok := tp.txMap[txid]
+		if !ok {
+			return eerror.New("trace_parser", "unknown transaction id", map[string]any{"txid": txid})
+		}
+		tx.Queries = append(tx.Queries, q)
+	} else {
+		req.Events = append(req.Events, &tracepb.Event{
+			Data: &tracepb.Event_Query{Query: q},
+		})
+	}
+
+	return nil
+}
+
+func (tp *traceParser) queryEnd(ts uint64) error {
+	qid := tp.UVarint()
+	q, ok := tp.queryMap[qid]
+	if !ok {
+		return eerror.New("trace_parser", "unknown query id", map[string]any{"qid": qid})
+	}
+	q.EndTime = ts
+	q.Err = tp.ByteString()
+	return nil
+}
+
+func (tp *traceParser) callStart(ts uint64, size int) error {
+	callID := tp.UVarint()
+	spanID := tp.Uint64()
+	// TODO(eandre) We currently (Dec 2, 2020) have an old format
+	// that leaves out the child span id. Detect this based on the size
+	// and provide a workaround that doesn't crash.
+	var childSpanID uint64
+	if size == 12 {
+		childSpanID = spanID
+	} else {
+		childSpanID = tp.Uint64()
+	}
+	req, ok := tp.reqMap[spanID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown request span", map[string]any{"spanID": spanID})
+	}
+
+	goid := uint32(tp.UVarint())
+	_ = tp.UVarint() // CallLoc: no longer used
+	defLoc := int32(tp.UVarint())
+
+	c := &tracepb.RPCCall{
+		SpanId:    childSpanID,
+		Goid:      goid,
+		DefLoc:    defLoc,
+		StartTime: ts,
+	}
+	if tp.version >= 5 {
+		c.Stack = tp.stack(filterNone)
+	}
+	tp.callMap[callID] = c
+	req.Events = append(req.Events, &tracepb.Event{
+		Data: &tracepb.Event_Rpc{Rpc: c},
+	})
+	return nil
+}
+
+func (tp *traceParser) callEnd(ts uint64) error {
+	callID := tp.UVarint()
+	errMsg := tp.ByteString()
+	c, ok := tp.callMap[callID].(*tracepb.RPCCall)
+	if !ok {
+		return eerror.New("trace_parser", "unknown call ", map[string]any{"callID": callID})
+	}
+	c.EndTime = ts
+	c.Err = errMsg
+	delete(tp.callMap, callID)
+	return nil
+}
+
+func (tp *traceParser) httpStart(ts uint64) error {
+	callID := tp.UVarint()
+	spanID := tp.Uint64()
+	childSpanID := tp.Uint64()
+	req, ok := tp.reqMap[spanID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown request span", map[string]any{"spanID": spanID})
+	}
+	c := &tracepb.HTTPCall{
+		SpanId:    childSpanID,
+		Goid:      uint32(tp.UVarint()),
+		Method:    tp.String(),
+		Url:       tp.String(),
+		StartTime: ts,
+	}
+	tp.httpMap[callID] = c
+	req.Events = append(req.Events, &tracepb.Event{
+		Data: &tracepb.Event_Http{Http: c},
+	})
+	return nil
+}
+
+func (tp *traceParser) httpEnd(ts uint64) error {
+	callID := tp.UVarint()
+	errMsg := tp.ByteString()
+	status := tp.UVarint()
+	c, ok := tp.httpMap[callID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown call ", map[string]any{"callID": callID})
+	}
+	c.EndTime = ts
+	c.Err = errMsg
+	c.StatusCode = uint32(status)
+
+	numEvents := tp.UVarint()
+	c.Events = make([]*tracepb.HTTPTraceEvent, 0, numEvents)
+	for i := 0; i < int(numEvents); i++ {
+		ev, err := tp.httpEvent()
+		if err != nil {
+			return err
+		}
+		c.Events = append(c.Events, ev)
+	}
+
+	return nil
+}
+
+func (tp *traceParser) httpBodyClosed(ts uint64) error {
+	callID := tp.UVarint()
+	_ = tp.ByteString() // close error
+	c, ok := tp.httpMap[callID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown call ", map[string]any{"callID": callID})
+	}
+	c.BodyClosedTime = ts
+	delete(tp.httpMap, callID)
+	return nil
+}
+
+func (tp *traceParser) httpEvent() (*tracepb.HTTPTraceEvent, error) {
+	code := tracepb.HTTPTraceEventCode(tp.Byte())
+	ts := tp.Int64()
+	ev := &tracepb.HTTPTraceEvent{
+		Code: code,
+		Time: uint64(ts),
+	}
+
+	switch code {
+	case tracepb.HTTPTraceEventCode_GET_CONN:
+		ev.Data = &tracepb.HTTPTraceEvent_GetConn{
+			GetConn: &tracepb.HTTPGetConnData{
+				HostPort: tp.String(),
+			},
+		}
+
+	case tracepb.HTTPTraceEventCode_GOT_CONN:
+		ev.Data = &tracepb.HTTPTraceEvent_GotConn{
+			GotConn: &tracepb.HTTPGotConnData{
+				Reused:         tp.Bool(),
+				WasIdle:        tp.Bool(),
+				IdleDurationNs: tp.Int64(),
+			},
+		}
+
+	case tracepb.HTTPTraceEventCode_GOT_FIRST_RESPONSE_BYTE:
+		// no data
+
+	case tracepb.HTTPTraceEventCode_GOT_1XX_RESPONSE:
+		ev.Data = &tracepb.HTTPTraceEvent_Got_1XxResponse{
+			Got_1XxResponse: &tracepb.HTTPGot1XxResponseData{
+				Code: int32(tp.Varint()),
+			},
+		}
+
+	case tracepb.HTTPTraceEventCode_DNS_START:
+		ev.Data = &tracepb.HTTPTraceEvent_DnsStart{
+			DnsStart: &tracepb.HTTPDNSStartData{
+				Host: tp.String(),
+			},
+		}
+
+	case tracepb.HTTPTraceEventCode_DNS_DONE:
+		data := &tracepb.HTTPDNSDoneData{
+			Err: tp.ByteString(),
+		}
+		addrs := int(tp.UVarint())
+		for j := 0; j < addrs; j++ {
+			data.Addrs = append(data.Addrs, &tracepb.DNSAddr{
+				Ip: tp.ByteString(),
+			})
+		}
+		ev.Data = &tracepb.HTTPTraceEvent_DnsDone{DnsDone: data}
+
+	case tracepb.HTTPTraceEventCode_CONNECT_START:
+		ev.Data = &tracepb.HTTPTraceEvent_ConnectStart{
+			ConnectStart: &tracepb.HTTPConnectStartData{
+				Network: tp.String(),
+				Addr:    tp.String(),
+			},
+		}
+
+	case tracepb.HTTPTraceEventCode_CONNECT_DONE:
+		ev.Data = &tracepb.HTTPTraceEvent_ConnectDone{
+			ConnectDone: &tracepb.HTTPConnectDoneData{
+				Network: tp.String(),
+				Addr:    tp.String(),
+				Err:     tp.ByteString(),
+			},
+		}
+
+	case tracepb.HTTPTraceEventCode_TLS_HANDSHAKE_START:
+		// no data
+
+	case tracepb.HTTPTraceEventCode_TLS_HANDSHAKE_DONE:
+		ev.Data = &tracepb.HTTPTraceEvent_TlsHandshakeDone{
+			TlsHandshakeDone: &tracepb.HTTPTLSHandshakeDoneData{
+				Err:                tp.ByteString(),
+				TlsVersion:         tp.Uint32(),
+				CipherSuite:        tp.Uint32(),
+				ServerName:         tp.String(),
+				NegotiatedProtocol: tp.String(),
+			},
+		}
+
+	case tracepb.HTTPTraceEventCode_WROTE_HEADERS:
+		// no data
+
+	case tracepb.HTTPTraceEventCode_WROTE_REQUEST:
+		ev.Data = &tracepb.HTTPTraceEvent_WroteRequest{
+			WroteRequest: &tracepb.HTTPWroteRequestData{
+				Err: tp.ByteString(),
+			},
+		}
+
+	case tracepb.HTTPTraceEventCode_WAIT_100_CONTINUE:
+		// no data
+
+	default:
+		return nil, eerror.New("trace_parser", "unknown http event", map[string]any{"code": code})
+	}
+	return ev, nil
+}
+
+func (tp *traceParser) logMessage(ts uint64) error {
+	spanID := tp.Uint64()
+	goid := uint32(tp.UVarint())
+	level := tp.Byte()
+	msg := tp.String()
+	fields := int(tp.UVarint())
+
+	req, ok := tp.reqMap[spanID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown request", map[string]any{"spanID": spanID})
+	} else if fields > 64 {
+		return eerror.New("trace_parser", "too many fields", map[string]any{"fields": fields})
+	}
+
+	log := &tracepb.LogMessage{
+		SpanId: spanID,
+		Goid:   goid,
+		Time:   ts,
+		Msg:    msg,
+	}
+
+	// We introduced more log levels in trace version 8.
+	if tp.version >= 8 {
+		switch level {
+		case 0:
+			log.Level = tracepb.LogMessage_TRACE
+		case 1:
+			log.Level = tracepb.LogMessage_DEBUG
+		case 2:
+			log.Level = tracepb.LogMessage_INFO
+		case 3:
+			log.Level = tracepb.LogMessage_WARN
+		case 4:
+			log.Level = tracepb.LogMessage_ERROR
+		default:
+			return eerror.New("trace_parser", "unknown log message level", map[string]any{"level": level})
+		}
+	} else {
+		switch level {
+		case 0:
+			log.Level = tracepb.LogMessage_DEBUG
+		case 1:
+			log.Level = tracepb.LogMessage_INFO
+		case 2:
+			log.Level = tracepb.LogMessage_ERROR
+		default:
+			return eerror.New("trace_parser", "unknown log message level", map[string]any{"level": level})
+		}
+	}
+
+	for i := 0; i < fields; i++ {
+		f, err := tp.logField()
+		if err != nil {
+			return eerror.Wrap(err, "trace_parser", "error parsing field", map[string]any{"field#": i})
+		}
+		log.Fields = append(log.Fields, f)
+	}
+	if tp.version >= 5 {
+		log.Stack = tp.stack(filterNone)
+	}
+
+	req.Events = append(req.Events, &tracepb.Event{
+		Data: &tracepb.Event_Log{Log: log},
+	})
+	return nil
+}
+
+func (tp *traceParser) logField() (*tracepb.LogField, error) {
+	typ := tp.Byte()
+	key := tp.String()
+	f := &tracepb.LogField{
+		Key: key,
+	}
+	switch typ {
+	case 1:
+		if tp.version >= 7 { // We only added stack's to error log fields with version 7 (it was missing from the internal runtime before that)
+			f.Value = &tracepb.LogField_ErrorWithStack{ErrorWithStack: &tracepb.ErrWithStack{
+				Error: tp.String(),
+				Stack: tp.stack(filterNone),
+			}}
+		} else {
+			f.Value = &tracepb.LogField_ErrorWithoutStack{ErrorWithoutStack: tp.String()}
+		}
+	case 2:
+		f.Value = &tracepb.LogField_Str{Str: tp.String()}
+	case 3:
+		f.Value = &tracepb.LogField_Bool{Bool: tp.Bool()}
+	case 4:
+		f.Value = &tracepb.LogField_Time{Time: timestamppb.New(tp.Time())}
+	case 5:
+		f.Value = &tracepb.LogField_Dur{Dur: tp.Int64()}
+	case 6:
+		b := make([]byte, 16)
+		tp.Bytes(b)
+		f.Value = &tracepb.LogField_Uuid{Uuid: b}
+	case 7:
+		val := tp.ByteString()
+		err := tp.String()
+		if err != "" {
+			f.Value = &tracepb.LogField_ErrorWithoutStack{ErrorWithoutStack: err}
+		} else {
+			f.Value = &tracepb.LogField_Json{Json: val}
+		}
+	case 8:
+		f.Value = &tracepb.LogField_Int{Int: tp.Varint()}
+	case 9:
+		f.Value = &tracepb.LogField_Uint{Uint: tp.UVarint()}
+	case 10:
+		f.Value = &tracepb.LogField_Float32{Float32: tp.Float32()}
+	case 11:
+		f.Value = &tracepb.LogField_Float64{Float64: tp.Float64()}
+	default:
+		return nil, eerror.New("trace_parser", "unknown field type", map[string]any{"typ": typ})
+	}
+	return f, nil
+}
+
+func (tp *traceParser) publishStart(ts uint64) error {
+	publishID := tp.UVarint()
+	spanID := tp.Uint64()
+	req, ok := tp.reqMap[spanID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown request span", map[string]any{"spanID": spanID})
+	}
+
+	publish := &tracepb.PubsubMsgPublished{
+		Goid:      tp.UVarint(),
+		StartTime: ts,
+		Topic:     tp.String(),
+		Message:   tp.ByteString(),
+		Stack:     tp.stack(filterNone),
+	}
+	tp.publishMap[publishID] = publish
+
+	req.Events = append(req.Events, &tracepb.Event{
+		Data: &tracepb.Event_PublishedMsg{PublishedMsg: publish},
+	})
+	return nil
+}
+
+func (tp *traceParser) publishEnd(ts uint64) error {
+	publishID := tp.UVarint()
+	publish, ok := tp.publishMap[publishID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown publish", map[string]any{"publishID": publishID})
+	}
+	publish.EndTime = ts
+	publish.MessageId = tp.String()
+	publish.Err = tp.ByteString()
+	delete(tp.publishMap, publishID)
+	return nil
+}
+
+func (tp *traceParser) serviceInitStart(ts uint64) error {
+	spanID := tp.Uint64()
+	req, ok := tp.reqMap[spanID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown request span", map[string]any{"spanID": spanID})
+	}
+
+	initID := tp.UVarint()
+	svcInit := &tracepb.ServiceInit{
+		Goid:      tp.UVarint(),
+		DefLoc:    int32(tp.UVarint()),
+		StartTime: ts,
+		Service:   tp.String(),
+	}
+	tp.serviceInits[initID] = svcInit
+
+	req.Events = append(req.Events, &tracepb.Event{
+		Data: &tracepb.Event_ServiceInit{ServiceInit: svcInit},
+	})
+	return nil
+}
+
+func (tp *traceParser) serviceInitEnd(ts uint64) error {
+	initID := tp.UVarint()
+	svcInit, ok := tp.serviceInits[initID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown service init", map[string]any{"initID": initID})
+	}
+	svcInit.EndTime = ts
+	svcInit.Err = tp.ByteString()
+	if len(svcInit.Err) > 0 {
+		svcInit.ErrStack = tp.stack(filterNone)
+	}
+	delete(tp.serviceInits, initID)
+	return nil
+}
+
+func (tp *traceParser) cacheOpStart(ts uint64) error {
+	opID := tp.UVarint()
+	spanID := tp.Uint64()
+	req, ok := tp.reqMap[spanID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown request span", map[string]any{"spanID": spanID})
+	}
+
+	op := &tracepb.CacheOp{
+		Goid:      uint32(tp.UVarint()),
+		DefLoc:    int32(tp.UVarint()),
+		StartTime: ts,
+		Operation: tp.String(),
+		Write:     tp.Bool(),
+		Result:    tracepb.CacheOp_UNKNOWN,
+		Stack:     tp.stack(filterNone),
+	}
+
+	numKeys := tp.UVarint()
+	op.Keys = make([]string, numKeys)
+	for i := 0; i < int(numKeys); i++ {
+		op.Keys[i] = tp.String()
+	}
+
+	numInputs := tp.UVarint()
+	op.Inputs = make([][]byte, numInputs)
+	for i := 0; i < int(numInputs); i++ {
+		op.Inputs[i] = tp.ByteString()
+	}
+	tp.cacheMap[opID] = op
+
+	req.Events = append(req.Events, &tracepb.Event{
+		Data: &tracepb.Event_Cache{Cache: op},
+	})
+	return nil
+}
+
+func (tp *traceParser) cacheOpEnd(ts uint64) error {
+	opID := tp.UVarint()
+	op, ok := tp.cacheMap[opID]
+	if !ok {
+		return eerror.New("trace_parser", "unknown cache", map[string]any{"opID": opID})
+	}
+	op.EndTime = ts
+
+	res := trace.CacheOpResult(tp.Byte())
+	switch res {
+	case trace.CacheOK:
+		op.Result = tracepb.CacheOp_OK
+	case trace.CacheNoSuchKey:
+		op.Result = tracepb.CacheOp_NO_SUCH_KEY
+	case trace.CacheConflict:
+		op.Result = tracepb.CacheOp_CONFLICT
+	case trace.CacheErr:
+		op.Result = tracepb.CacheOp_ERR
+		op.Err = tp.ByteString()
+	}
+
+	numOutputs := tp.UVarint()
+	op.Outputs = make([][]byte, numOutputs)
+	for i := 0; i < int(numOutputs); i++ {
+		op.Outputs[i] = tp.ByteString()
+	}
+
+	delete(tp.cacheMap, opID)
+	return nil
+}
+
+type stackFilter int
+
+const (
+	filterNone stackFilter = iota
+	filterDB
+)
+
+func (tp *traceParser) stack(filterMode stackFilter) *tracepb.StackTrace {
+	n := int(tp.Byte())
+	tr := &tracepb.StackTrace{}
+	if n == 0 {
+		return tr
+	}
+
+	diffs := make([]int64, n)
+	for i := 0; i < n; i++ {
+		diff := tp.Varint()
+		diffs[i] = diff
+	}
+	tr.Pcs = diffs
+
+	if tp.symTable == nil {
+		return tr
+	}
+
+	// If we have a symTable, we can extract the full set of frames from the trace
+	sym, err := tp.symTable.SymTable(context.Background())
+	if err != nil {
+		log.Error().Err(err).Msg("could not parse sym table")
+		return tr
+	}
+
+	prev := int64(0)
+	pcs := make([]uint64, n)
+	for i := 0; i < n; i++ {
+		x := prev + diffs[i]
+		prev = x
+		pcs[i] = uint64(x) + sym.BaseOffset
+	}
+
+	tr.Frames = make([]*tracepb.StackFrame, 0, n)
+PCLoop:
+	for _, pc := range pcs {
+		file, line, fn := sym.PCToLine(pc)
+		if fn != nil {
+			if filterMode == filterDB && strings.Contains(filepath.ToSlash(file), "/src/database/sql/") {
+				continue PCLoop
+			}
+			tr.Frames = append(tr.Frames, &tracepb.StackFrame{
+				Func:     fn.Name,
+				Filename: file,
+				Line:     int32(line),
+			})
+		}
+	}
+	return tr
+}
+
+func (tp *traceParser) formattedStack() *tracepb.StackTrace {
+	n := int(tp.Byte())
+	tr := &tracepb.StackTrace{}
+	if n == 0 {
+		return tr
+	}
+
+	tr.Frames = make([]*tracepb.StackFrame, 0, n)
+	for i := 0; i < n; i++ {
+		tr.Frames = append(tr.Frames, &tracepb.StackFrame{
+			Filename: tp.String(),
+			Line:     int32(tp.UVarint()),
+			Func:     tp.String(),
+		})
+	}
+
+	return tr
+}
+
+func (tp *traceParser) parseRequestType() (tracepb.Request_Type, error) {
+	switch b := tp.Byte(); b {
+	case 0x01:
+		return tracepb.Request_RPC, nil
+	case 0x02:
+		return tracepb.Request_AUTH, nil
+	case 0x03:
+		return tracepb.Request_PUBSUB_MSG, nil
+	default:
+		return -1, eerror.New("trace_parser", "unknown request type", map[string]any{"type": fmt.Sprintf("%x", b)})
+	}
+}
+
+func (tp *traceParser) parseTraceID() *tracepb.TraceID {
+	var traceID [16]byte
+	tp.Bytes(traceID[:])
+	return &tracepb.TraceID{
+		Low:  bin.Uint64(traceID[:8]),
+		High: bin.Uint64(traceID[8:]),
+	}
+}
+
+func (tp *traceParser) parseHTTPHeaders() map[string]string {
+	numHeaders := tp.UVarint()
+	h := make(map[string]string, numHeaders)
+	for i := uint64(0); i < numHeaders; i++ {
+		h[tp.String()] = tp.String()
+	}
+	return h
+}
+
+var bin = binary.LittleEndian
+
+type traceReader struct {
+	buf []byte
+	off int
+	err bool
+}
+
+func (tr *traceReader) Offset() int {
+	return tr.off
+}
+
+func (tr *traceReader) Done() bool {
+	return tr.off >= len(tr.buf)
+}
+
+func (tr *traceReader) Overflow() bool {
+	return tr.err
+}
+
+func (tr *traceReader) Bytes(b []byte) {
+	n := copy(b, tr.buf[tr.off:])
+	tr.off += n
+	if len(b) > n {
+		tr.err = true
+	}
+}
+
+func (tr *traceReader) Skip(n int) {
+	tr.off += n
+	if tr.off > len(tr.buf) {
+		tr.off = len(tr.buf)
+		tr.err = true
+	}
+}
+
+func (tr *traceReader) Byte() byte {
+	var buf [1]byte
+	tr.Bytes(buf[:])
+	return buf[0]
+}
+
+func (tr *traceReader) Bool() bool {
+	return tr.Byte() != 0
+}
+
+func (tr *traceReader) String() string {
+	return string(tr.ByteString())
+}
+
+func (tr *traceReader) ByteString() []byte {
+	size := tr.UVarint()
+	if (size) == 0 {
+		return nil
+	}
+	b := make([]byte, int(size))
+	tr.Bytes(b)
+	return b
+}
+
+func (tr *traceReader) Time() time.Time {
+	sec := tr.Int64()
+	nsec := tr.Int32()
+	return time.Unix(sec, int64(nsec)).UTC()
+}
+
+func (tr *traceReader) Int32() int32 {
+	u := tr.Uint32()
+	var v int32
+	if u&1 == 0 {
+		v = int32(u >> 1)
+	} else {
+		v = ^int32(u >> 1)
+	}
+	return v
+}
+
+func (tr *traceReader) Uint32() uint32 {
+	var buf [4]byte
+	tr.Bytes(buf[:])
+	return bin.Uint32(buf[:])
+}
+
+func (tr *traceReader) Int64() int64 {
+	u := tr.Uint64()
+	var v int64
+	if u&1 == 0 {
+		v = int64(u >> 1)
+	} else {
+		v = ^int64(u >> 1)
+	}
+	return v
+}
+
+func (tr *traceReader) Uint64() uint64 {
+	var buf [8]byte
+	tr.Bytes(buf[:])
+	return bin.Uint64(buf[:])
+}
+
+func (tr *traceReader) Varint() int64 {
+	u := tr.UVarint()
+	var v int64
+	if u&1 == 0 {
+		v = int64(u >> 1)
+	} else {
+		v = ^int64(u >> 1)
+	}
+	return v
+}
+
+func (tr *traceReader) UVarint() uint64 {
+	var u uint64
+	for i := 0; tr.off < len(tr.buf); i += 7 {
+		b := tr.buf[tr.off]
+		u |= uint64(b&^0x80) << i
+		tr.off++
+		if b&0x80 == 0 {
+			break
+		}
+	}
+	return u
+}
+
+func (tr *traceReader) Float32() float32 {
+	b := tr.Uint32()
+	return math.Float32frombits(b)
+}
+
+func (tr *traceReader) Float64() float64 {
+	b := tr.Uint64()
+	return math.Float64frombits(b)
+}
diff --git a/cli/daemon/engine/trace2/recorder.go b/cli/daemon/engine/trace2/recorder.go
new file mode 100644
index 0000000000..680e7a21c6
--- /dev/null
+++ b/cli/daemon/engine/trace2/recorder.go
@@ -0,0 +1,104 @@
+package trace2
+
+import (
+	"bufio"
+	"context"
+	"io"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog/log"
+
+	"encore.dev/appruntime/exported/trace2"
+	"encr.dev/pkg/traceparser"
+	tracepb2 "encr.dev/proto/encore/engine/trace2"
+)
+
+type Recorder struct {
+	s Store
+}
+
+func NewRecorder(s Store) *Recorder {
+	return &Recorder{s}
+}
+
+type RecordData struct {
+	Meta         *Meta
+	TraceVersion trace2.Version
+	Buf          *bufio.Reader
+	Anchor       trace2.TimeAnchor
+}
+
+func (h *Recorder) RecordTrace(data RecordData) error {
+	eventCh := make(chan *tracepb2.TraceEvent, 100)
+	go func() {
+		defer close(eventCh)
+		for {
+			ev, err := traceparser.ParseEvent(data.Buf, data.Anchor, data.TraceVersion)
+			if ev != nil {
+				eventCh <- ev
+			}
+			if err == nil {
+				continue
+			}
+
+			// We have an error.
+			if !errors.Is(err, io.EOF) {
+				log.Error().Err(err).Msg("unable to parse trace")
+			}
+			return
+		}
+	}()
+
+	writeEvents := func(ctx context.Context, ev []*tracepb2.TraceEvent) error {
+		if len(ev) == 0 {
+			return nil
+		}
+		return h.s.WriteEvents(ctx, data.Meta, ev)
+	}
+
+	// pendingWrites are the accumulated events that we have parsed so far
+	// that have not yet been written to the store.
+	pendingWrites := make([]*tracepb2.TraceEvent, 0, 100)
+
+	flushWrites := func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		if err := writeEvents(ctx, pendingWrites); err != nil {
+			log.Error().Err(err).Msg("unable to write trace events")
+			return
+		}
+
+		// Garbage collect the slice if it's too big.
+		if cap(pendingWrites) > 1000 {
+			pendingWrites = make([]*tracepb2.TraceEvent, 0, 100)
+		} else {
+			pendingWrites = pendingWrites[:0]
+		}
+	}
+
+	debounce := time.NewTicker(500 * time.Millisecond)
+	defer debounce.Stop()
+
+	for {
+		select {
+		case ev, ok := <-eventCh:
+			if !ok {
+				// No more events.
+				flushWrites()
+				return nil
+			}
+			debounce.Reset(500 * time.Millisecond)
+			pendingWrites = append(pendingWrites, ev)
+
+			// Flush immediately if we've accumulated a bunch of events
+			// since the debounce may never run in a high throughput scenario.
+			if len(pendingWrites) >= 100 {
+				flushWrites()
+			}
+
+		case <-debounce.C:
+			flushWrites()
+		}
+	}
+}
diff --git a/cli/daemon/engine/trace2/sqlite/read.go b/cli/daemon/engine/trace2/sqlite/read.go
new file mode 100644
index 0000000000..799a7e1fa6
--- /dev/null
+++ b/cli/daemon/engine/trace2/sqlite/read.go
@@ -0,0 +1,147 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"strconv"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog/log"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"encr.dev/cli/daemon/engine/trace2"
+	"encr.dev/pkg/fns"
+	tracepb2 "encr.dev/proto/encore/engine/trace2"
+)
+
+func (s *Store) List(ctx context.Context, q *trace2.Query, iter trace2.ListEntryIterator) error {
+	limit := q.Limit
+	if limit <= 0 {
+		limit = 100
+	}
+
+	args := []any{
+		q.AppID, tracepb2.SpanSummary_AUTH, /* ignore auth spans */
+	}
+
+	extraWhereClause := ""
+
+	if q.MessageID != "" {
+		args = append(args, q.MessageID)
+		extraWhereClause += " AND message_id = $" + strconv.Itoa(len(args))
+	}
+
+	// If we're filter for tests / not tests, add the extra where clause
+	if q.TestFilter != nil {
+		args = append(args, tracepb2.SpanSummary_TEST)
+		if *q.TestFilter {
+			extraWhereClause += " AND span_type = $" + strconv.Itoa(len(args))
+		} else {
+			extraWhereClause += " AND span_type != $" + strconv.Itoa(len(args))
+		}
+	}
+
+	rows, err := s.db.QueryContext(ctx, `
+		SELECT
+		    trace_id, span_id, started_at, span_type, is_root, service_name, endpoint_name,
+		    topic_name, subscription_name, message_id, is_error, test_skipped, duration_nanos, src_file, src_line
+		FROM trace_span_index
+		WHERE app_id = $1 AND has_response AND is_root AND span_type != $2 `+extraWhereClause+`
+		ORDER BY started_at DESC
+		LIMIT `+strconv.Itoa(limit)+`
+	`, args...)
+	if err != nil {
+		return errors.Wrap(err, "query traces")
+	}
+
+	defer fns.CloseIgnore(rows)
+	n := 0
+	for rows.Next() {
+		if n >= limit {
+			break
+		}
+		n++
+
+		var t tracepb2.SpanSummary
+		var startedAt int64
+		err := rows.Scan(
+			&t.TraceId, &t.SpanId, &startedAt, &t.Type, &t.IsRoot, &t.ServiceName, &t.EndpointName,
+			&t.TopicName, &t.SubscriptionName, &t.MessageId, &t.IsError, &t.TestSkipped, &t.DurationNanos, &t.SrcFile, &t.SrcLine)
+		if err != nil {
+			return errors.Wrap(err, "scan trace")
+		}
+		ts := time.Unix(0, startedAt)
+		t.StartedAt = timestamppb.New(ts)
+
+		if !iter(&t) {
+			return nil
+		}
+	}
+
+	return errors.Wrap(rows.Err(), "iterate traces")
+}
+
+// emitCompleteSpanToListeners emits the given trace/span to all listeners
+// if it's a complete root span (meaning it has a response and is not an auth span).
+func (s *Store) emitCompleteSpanToListeners(ctx context.Context, appID, traceID, spanID string) {
+	var t tracepb2.SpanSummary
+	var startedAt int64
+	err := s.db.QueryRowContext(ctx, `
+		SELECT
+			trace_id, span_id, started_at, span_type, is_root, service_name, endpoint_name,
+			topic_name, subscription_name, message_id, is_error, test_skipped, duration_nanos, src_file, src_line
+		FROM trace_span_index
+		WHERE app_id = ? AND trace_id = ? AND span_id = ? AND has_response AND is_root AND span_type != ?
+		ORDER BY started_at DESC
+	`, appID, traceID, spanID, tracepb2.SpanSummary_AUTH).Scan(
+		&t.TraceId, &t.SpanId, &startedAt, &t.Type, &t.IsRoot, &t.ServiceName, &t.EndpointName,
+		&t.TopicName, &t.SubscriptionName, &t.MessageId, &t.IsError, &t.TestSkipped, &t.DurationNanos, &t.SrcFile, &t.SrcLine)
+	if errors.Is(err, sql.ErrNoRows) {
+		return
+	} else if err != nil {
+		log.Error().Err(err).Msg("unable to query trace span")
+		return
+	}
+
+	ts := time.Unix(0, startedAt)
+	t.StartedAt = timestamppb.New(ts)
+	for _, ln := range s.listeners {
+		ln <- trace2.NewSpanEvent{
+			AppID:     appID,
+			TestTrace: t.Type == tracepb2.SpanSummary_TEST,
+			Span:      &t,
+		}
+	}
+}
+
+func (s *Store) Get(ctx context.Context, appID, traceID string, iter trace2.EventIterator) error {
+	rows, err := s.db.QueryContext(ctx, `
+		SELECT event_data
+		FROM trace_event
+		WHERE app_id = ? AND trace_id = ?
+	`, appID, traceID)
+	if err != nil {
+		return errors.Wrap(err, "get trace")
+	}
+
+	defer fns.CloseIgnore(rows)
+	for rows.Next() {
+		var data []byte
+		err := rows.Scan(&data)
+		if err != nil {
+			return errors.Wrap(err, "scan trace data")
+		}
+
+		var ev tracepb2.TraceEvent
+		if err := protojson.Unmarshal(data, &ev); err != nil {
+			return errors.Wrap(err, "unmarshal trace event")
+		}
+		if !iter(&ev) {
+			return nil
+		}
+	}
+
+	return errors.Wrap(rows.Err(), "iterate events")
+}
diff --git a/cli/daemon/engine/trace2/sqlite/write.go b/cli/daemon/engine/trace2/sqlite/write.go
new file mode 100644
index 0000000000..036fc424a4
--- /dev/null
+++ b/cli/daemon/engine/trace2/sqlite/write.go
@@ -0,0 +1,372 @@
+package sqlite
+
+import (
+	"context"
+	"database/sql"
+	"encoding/base32"
+	"encoding/binary"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/lib/pq"
+	"github.com/rs/zerolog/log"
+	"google.golang.org/protobuf/encoding/protojson"
+
+	"encr.dev/cli/daemon/engine/trace2"
+	"encr.dev/pkg/fns"
+	tracepbcli "encr.dev/proto/encore/engine/trace2"
+)
+
+// New creates a new store backed by the given db.
+func New(db *sql.DB) *Store {
+	return &Store{
+		db: db,
+	}
+}
+
+type Store struct {
+	db        *sql.DB
+	listeners []chan<- trace2.NewSpanEvent
+}
+
+var _ trace2.Store = (*Store)(nil)
+
+func scanRows[T any](rows *sql.Rows) ([]T, error) {
+	defer rows.Close()
+	var out []T
+	for rows.Next() {
+		var v T
+		err := rows.Scan(&v)
+		if err != nil {
+			return nil, err
+		}
+		out = append(out, v)
+	}
+	return out, nil
+}
+
+func (s *Store) CleanEvery(ctx context.Context, freq time.Duration, triggerAt, eventsToKeep, batchSize int) {
+	for {
+		timer := time.NewTimer(freq)
+		select {
+		case <-ctx.Done():
+			return
+		case <-timer.C:
+			if err := s.DoClean(ctx, triggerAt, eventsToKeep, batchSize); err != nil {
+				log.Error().Err(err).Msg("trace cleanup failed")
+			}
+		}
+	}
+}
+
+func (s *Store) DoClean(ctx context.Context, triggerAt, eventsToKeep, batchSize int) error {
+	log.Info().Msg("initiating trace event cleanup sweep")
+	rows, err := s.db.QueryContext(ctx, "SELECT app_id FROM trace_event GROUP BY app_id HAVING COUNT(distinct trace_id) > ?", triggerAt)
+	if err != nil {
+		return errors.Wrap(err, "query app ids")
+	}
+	appIDs, err := scanRows[string](rows)
+	if err != nil {
+		return errors.Wrap(err, "scan app ids")
+	}
+
+	for _, appID := range appIDs {
+		row := s.db.QueryRowContext(ctx, `
+						WITH latest_events AS (
+							SELECT trace_id, min(id) as id FROM trace_event WHERE app_id = ? GROUP BY 1 ORDER BY 2 DESC LIMIT ?
+						) SELECT min(id) FROM latest_events;
+					`, appID, eventsToKeep)
+		var traceID int64
+		err := row.Scan(&traceID)
+		if err != nil {
+			log.Error().Err(err).Msg("failed to get trace id")
+			continue
+		}
+		rows, err := s.db.QueryContext(ctx, "SELECT DISTINCT trace_id FROM trace_event WHERE app_id = ? AND id < ? ORDER BY id DESC LIMIT ?", appID, traceID, batchSize)
+		if err != nil {
+			log.Error().Err(err).Msg("failed to get old trace ids")
+			continue
+		}
+		traceIDs, err := scanRows[string](rows)
+		if len(traceIDs) == 0 {
+			continue
+		}
+		idArgs := strings.Join(fns.Map(traceIDs, pq.QuoteLiteral), ",")
+		res, err := s.db.ExecContext(ctx, "DELETE FROM trace_event WHERE app_id = ? AND trace_id IN ("+idArgs+")", appID)
+		if err != nil {
+			log.Error().Err(err).Msg("failed to delete old trace events")
+			continue
+		}
+		rowCount, err := res.RowsAffected()
+		if err != nil {
+			log.Error().Err(err).Msg("failed to get rows affected")
+			continue
+		}
+		log.Info().Str("app_id", appID).Int64("deleted", rowCount).Msg("cleaned up old trace events")
+		res, err = s.db.ExecContext(ctx, "DELETE FROM trace_span_index WHERE app_id = ? AND trace_id IN ("+idArgs+")", appID)
+		if err != nil {
+			log.Error().Err(err).Msg("failed to delete old trace spans")
+			continue
+		}
+		rowCount, err = res.RowsAffected()
+		if err != nil {
+			log.Error().Err(err).Msg("failed to get rows affected")
+			continue
+		}
+		log.Info().Str("app_id", appID).Int64("deleted", rowCount).Msg("cleaned up old trace spans")
+	}
+
+	return nil
+}
+
+func (s *Store) Listen(ch chan<- trace2.NewSpanEvent) {
+	s.listeners = append(s.listeners, ch)
+}
+
+func (s *Store) Clear(ctx context.Context, appID string) error {
+	_, err := s.db.ExecContext(ctx, "DELETE FROM trace_event WHERE app_id = ?", appID)
+	if err != nil {
+		return errors.Wrap(err, "failed to clear trace events")
+	}
+	_, err = s.db.ExecContext(ctx, "DELETE FROM trace_span_index WHERE app_id = ?", appID)
+	return errors.Wrap(err, "failed to clear trace spans")
+}
+
+func (s *Store) WriteEvents(ctx context.Context, meta *trace2.Meta, events []*tracepbcli.TraceEvent) error {
+	for _, ev := range events {
+		if err := s.insertEvent(ctx, meta, ev); err != nil {
+			log.Error().Err(err).Msg("unable to insert trace span event")
+			continue
+		}
+	}
+
+	return nil
+}
+
+func (s *Store) insertEvent(ctx context.Context, meta *trace2.Meta, ev *tracepbcli.TraceEvent) error {
+	data, err := protojson.Marshal(ev)
+	if err != nil {
+		return errors.Wrap(err, "marshal trace event")
+	}
+
+	_, err = s.db.ExecContext(ctx, `
+		INSERT INTO trace_event (
+			app_id, trace_id, span_id, event_data)
+		VALUES (?, ?, ?, ?)
+	`, meta.AppID, encodeTraceID(ev.TraceId), encodeSpanID(ev.SpanId), data)
+	if err != nil {
+		return errors.Wrap(err, "insert trace span event")
+	}
+
+	if start := ev.GetSpanStart(); start != nil {
+		if err := s.updateSpanStartIndex(ctx, meta, ev, start); err != nil {
+			return errors.Wrap(err, "update span start index")
+		}
+	} else if end := ev.GetSpanEnd(); end != nil {
+		if err := s.updateSpanEndIndex(ctx, meta, ev, end); err != nil {
+			return errors.Wrap(err, "update span end index")
+		}
+	}
+
+	return nil
+}
+
+func (s *Store) updateSpanStartIndex(ctx context.Context, meta *trace2.Meta, ev *tracepbcli.TraceEvent, start *tracepbcli.SpanStart) error {
+	isRoot := start.ParentSpanId == nil
+	if req := start.GetRequest(); req != nil {
+		extRequestID := req.RequestHeaders[http.CanonicalHeaderKey("X-Request-ID")]
+		_, err := s.db.ExecContext(ctx, `
+			INSERT INTO trace_span_index (
+				app_id, trace_id, span_id, span_type, started_at, is_root, service_name, endpoint_name, external_request_id, has_response, test_skipped
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, false, false)
+			ON CONFLICT (trace_id, span_id) DO UPDATE SET
+				is_root = excluded.is_root,
+				service_name = excluded.service_name,
+				endpoint_name = excluded.endpoint_name,
+				external_request_id = excluded.external_request_id
+		`, meta.AppID, encodeTraceID(ev.TraceId), encodeSpanID(ev.SpanId),
+			tracepbcli.SpanSummary_REQUEST, ev.EventTime.AsTime().UnixNano(),
+			isRoot, req.ServiceName, req.EndpointName, extRequestID)
+		if err != nil {
+			return errors.Wrap(err, "insert trace span event")
+		}
+		return nil
+	}
+
+	if auth := start.GetAuth(); auth != nil {
+		_, err := s.db.ExecContext(ctx, `
+			INSERT INTO trace_span_index (
+				app_id, trace_id, span_id, span_type, started_at, is_root, service_name,
+				endpoint_name, has_response, test_skipped
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, false, false)
+			ON CONFLICT (trace_id, span_id) DO UPDATE SET
+				is_root = excluded.is_root,
+				service_name = excluded.service_name,
+				endpoint_name = excluded.endpoint_name
+		`, meta.AppID, encodeTraceID(ev.TraceId), encodeSpanID(ev.SpanId),
+			tracepbcli.SpanSummary_AUTH, ev.EventTime.AsTime().UnixNano(),
+			isRoot, auth.ServiceName, auth.EndpointName)
+		if err != nil {
+			return errors.Wrap(err, "insert trace span event")
+		}
+		return nil
+	}
+
+	if msg := start.GetPubsubMessage(); msg != nil {
+		_, err := s.db.ExecContext(ctx, `
+			INSERT INTO trace_span_index (
+				app_id, trace_id, span_id, span_type, started_at, is_root, service_name,
+				topic_name, subscription_name, message_id, has_response, test_skipped
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, false, false)
+			ON CONFLICT (trace_id, span_id) DO UPDATE SET
+				is_root = excluded.is_root,
+				service_name = excluded.service_name,
+				topic_name = excluded.topic_name,
+				subscription_name = excluded.subscription_name,
+				message_id = excluded.message_id
+		`, meta.AppID, encodeTraceID(ev.TraceId), encodeSpanID(ev.SpanId),
+			tracepbcli.SpanSummary_PUBSUB_MESSAGE, ev.EventTime.AsTime().UnixNano(),
+			isRoot, msg.ServiceName, msg.TopicName, msg.SubscriptionName, msg.MessageId)
+		if err != nil {
+			return errors.Wrap(err, "insert trace span event")
+		}
+		return nil
+	}
+
+	if msg := start.GetTest(); msg != nil {
+		_, err := s.db.ExecContext(ctx, `
+			INSERT INTO trace_span_index (
+				app_id, trace_id, span_id, span_type, started_at, is_root, service_name,
+				endpoint_name, user_id, src_file, src_line, has_response, test_skipped
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, false, false)
+			ON CONFLICT (trace_id, span_id) DO UPDATE SET
+				is_root = excluded.is_root,
+				service_name = excluded.service_name,
+				endpoint_name = excluded.endpoint_name
+		`, meta.AppID, encodeTraceID(ev.TraceId), encodeSpanID(ev.SpanId),
+			tracepbcli.SpanSummary_TEST, ev.EventTime.AsTime().UnixNano(),
+			isRoot, msg.ServiceName, msg.TestName, msg.Uid, msg.TestFile, msg.TestLine)
+		if err != nil {
+			return errors.Wrap(err, "insert trace span event")
+		}
+		return nil
+	}
+
+	return nil
+}
+
+func (s *Store) updateSpanEndIndex(ctx context.Context, meta *trace2.Meta, ev *tracepbcli.TraceEvent, end *tracepbcli.SpanEnd) (err error) {
+	traceID := encodeTraceID(ev.TraceId)
+	spanID := encodeSpanID(ev.SpanId)
+
+	defer func() {
+		if err == nil {
+			// If the span is complete, emit it to listeners.
+			s.emitCompleteSpanToListeners(ctx, meta.AppID, traceID, spanID)
+		}
+	}()
+
+	if req := end.GetRequest(); req != nil {
+		_, err := s.db.ExecContext(ctx, `
+			INSERT INTO trace_span_index (
+				app_id, trace_id, span_id, span_type, has_response, is_error, duration_nanos
+			) VALUES (?, ?, ?, ?, ?, ?, ?)
+			ON CONFLICT (trace_id, span_id) DO UPDATE SET
+				has_response = excluded.has_response,
+				is_error = excluded.is_error,
+				duration_nanos = excluded.duration_nanos
+		`, meta.AppID, traceID, spanID,
+			tracepbcli.SpanSummary_REQUEST, true,
+			end.Error != nil, end.DurationNanos)
+		if err != nil {
+			return errors.Wrap(err, "insert trace span event")
+		}
+		return nil
+	}
+
+	if auth := end.GetAuth(); auth != nil {
+		_, err := s.db.ExecContext(ctx, `
+			INSERT INTO trace_span_index (
+				app_id, trace_id, span_id, span_type, has_response, is_error, duration_nanos, user_id
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+			ON CONFLICT (trace_id, span_id) DO UPDATE SET
+				has_response = excluded.has_response,
+				is_error = excluded.is_error,
+				duration_nanos = excluded.duration_nanos,
+				user_id = excluded.user_id
+		`, meta.AppID, traceID, spanID,
+			tracepbcli.SpanSummary_AUTH, true,
+			end.Error != nil, end.DurationNanos, auth.Uid)
+		if err != nil {
+			return errors.Wrap(err, "insert trace span event")
+		}
+		return nil
+	}
+
+	if msg := end.GetPubsubMessage(); msg != nil {
+		_, err := s.db.ExecContext(ctx, `
+			INSERT INTO trace_span_index (
+				app_id, trace_id, span_id, span_type, has_response, is_error, duration_nanos
+			) VALUES (?, ?, ?, ?, ?, ?, ?)
+			ON CONFLICT (trace_id, span_id) DO UPDATE SET
+				has_response = excluded.has_response,
+				is_error = excluded.is_error,
+				duration_nanos = excluded.duration_nanos
+		`, meta.AppID, traceID, spanID,
+			tracepbcli.SpanSummary_PUBSUB_MESSAGE, true,
+			end.Error != nil, end.DurationNanos)
+		if err != nil {
+			return errors.Wrap(err, "insert trace span event")
+		}
+		return nil
+	}
+
+	if msg := end.GetTest(); msg != nil {
+		_, err := s.db.ExecContext(ctx, `
+			INSERT INTO trace_span_index (
+				app_id, trace_id, span_id, span_type, has_response, is_error, test_skipped, duration_nanos
+			) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+			ON CONFLICT (trace_id, span_id) DO UPDATE SET
+				has_response = excluded.has_response,
+				is_error = excluded.is_error,
+				test_skipped = excluded.test_skipped,
+				duration_nanos = excluded.duration_nanos
+		`, meta.AppID, traceID, spanID,
+			tracepbcli.SpanSummary_TEST, true,
+			msg.Failed, msg.Skipped, end.DurationNanos)
+		if err != nil {
+			return errors.Wrap(err, "insert trace span event")
+		}
+		return nil
+	}
+
+	return nil
+}
+
+var (
+	binBE = binary.BigEndian
+	binLE = binary.LittleEndian
+)
+
+// encodeTraceID encodes the trace id as a human-readable string.
+func encodeTraceID(id *tracepbcli.TraceID) string {
+	var b [16]byte
+	binLE.PutUint64(b[0:8], id.Low)
+	binLE.PutUint64(b[8:16], id.High)
+	return base32hex.EncodeToString(b[:])
+}
+
+// encodeSpanID encodes the span id as a human-readable string.
+func encodeSpanID(id uint64) string {
+	var b [8]byte
+	binLE.PutUint64(b[:], id)
+	return base32hex.EncodeToString(b[:])
+}
+
+var (
+	// base32hex is a lowercase base32 hex encoding without padding
+	// that preserves lexicographic sort order.
+	base32hex = base32.NewEncoding("0123456789abcdefghijklmnopqrstuv").WithPadding(base32.NoPadding)
+)
diff --git a/cli/daemon/engine/trace2/store.go b/cli/daemon/engine/trace2/store.go
new file mode 100644
index 0000000000..391f7b9ffb
--- /dev/null
+++ b/cli/daemon/engine/trace2/store.go
@@ -0,0 +1,86 @@
+package trace2
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	tracepb2 "encr.dev/proto/encore/engine/trace2"
+)
+
+type Meta struct {
+	AppID string
+}
+
+type Query struct {
+	AppID        string
+	Service      string
+	Endpoint     string
+	Topic        string
+	Subscription string
+	TraceID      string
+	MessageID    string
+	TestFilter   *bool // nil means both test and non-test traces are returned
+	Tags         []Tag
+
+	// StartTime and EndTime specify the time range to query.
+	// If zero values they are not bounded.
+	StartTime, EndTime time.Time
+
+	IsError *bool // nil means both successes and failures are returned
+
+	// Minimum and maximum duration (in nanoseconds) to filter requests for.
+	// If MaxDurMicros is 0 it defaults to no limit.
+	MinDurNanos, MaxDurNanos uint64
+
+	Limit int // if 0 defaults to 100.
+}
+
+type Tag struct {
+	Key   string
+	Value string
+}
+
+// ErrNotFound is reported by Store.Get when a trace is not found.
+var ErrNotFound = errors.New("trace not found")
+
+// A ListEntryIterator is called once for each trace matching the query string,
+// sequentially and in streaming fashion as traces are read from the store.
+//
+// If it returns false the listing operation is stopped and the function is
+// not called again.
+type ListEntryIterator func(*tracepb2.SpanSummary) bool
+
+// An EventIterator is called once for each event in a trace,
+// sequentially and in streaming fashion as events are read from the store.
+//
+// If it returns false the stream is aborted and the function is
+// not called again.
+type EventIterator func(*tracepb2.TraceEvent) bool
+
+// Store is the interface for storing and retrieving traces.
+type Store interface {
+	// WriteEvents persists requests in the store.
+	WriteEvents(ctx context.Context, meta *Meta, events []*tracepb2.TraceEvent) error
+
+	// List lists traces that match the query.
+	// It calls fn for each trace read; see ListEntryIterator.
+	List(ctx context.Context, q *Query, iter ListEntryIterator) error
+
+	// Get streams events matching the given trace id.
+	// fn may be called with events out of order.
+	// If the trace is not found it reports an error matching ErrNotFound.
+	Get(ctx context.Context, appID, traceID string, iter EventIterator) error
+
+	// Listen listens for new spans.
+	Listen(ch chan<- NewSpanEvent)
+
+	// Clear removes all traces for an app
+	Clear(ctx context.Context, appID string) error
+}
+
+type NewSpanEvent struct {
+	AppID     string
+	TestTrace bool
+	Span      *tracepb2.SpanSummary
+}
diff --git a/cli/daemon/exec_script.go b/cli/daemon/exec_script.go
new file mode 100644
index 0000000000..e2191aff27
--- /dev/null
+++ b/cli/daemon/exec_script.go
@@ -0,0 +1,129 @@
+package daemon
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/rs/zerolog/log"
+	"golang.org/x/mod/modfile"
+
+	"encr.dev/cli/daemon/run"
+	"encr.dev/internal/optracker"
+	"encr.dev/pkg/appfile"
+	"encr.dev/pkg/paths"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+// ExecScript executes a one-off script.
+func (s *Server) ExecScript(req *daemonpb.ExecScriptRequest, stream daemonpb.Daemon_ExecScriptServer) error {
+	ctx := stream.Context()
+	slog := &streamLog{stream: stream, buffered: true}
+	stderr := slog.Stderr(false)
+	sendErr := func(err error) {
+		if list := run.AsErrorList(err); list != nil {
+			_ = list.SendToStream(stream)
+		} else {
+			errStr := err.Error()
+			if !strings.HasSuffix(errStr, "\n") {
+				errStr += "\n"
+			}
+			slog.Stderr(false).Write([]byte(errStr))
+		}
+		streamExit(stream, 1)
+	}
+
+	ctx, tracer, err := s.beginTracing(ctx, req.AppRoot, req.WorkingDir, req.TraceFile)
+	if err != nil {
+		sendErr(err)
+		return nil
+	}
+	defer tracer.Close()
+
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		sendErr(err)
+		return nil
+	}
+
+	ns, err := s.namespaceOrActive(ctx, app, req.Namespace)
+	if err != nil {
+		sendErr(err)
+		return nil
+	}
+
+	ops := optracker.New(stderr, stream)
+	defer ops.AllDone() // Kill the tracker when we exit this function
+
+	testResults := make(chan error, 1)
+	defer func() {
+		if recovered := recover(); recovered != nil {
+			var err error
+			switch recovered := recovered.(type) {
+			case error:
+				err = recovered
+			default:
+				err = fmt.Errorf("%v", recovered)
+			}
+			log.Err(err).Msg("panic during script execution")
+			testResults <- fmt.Errorf("panic occured within Encore during script execution: %v\n", recovered)
+		}
+	}()
+
+	switch app.Lang() {
+	case appfile.LangGo:
+		modPath := filepath.Join(app.Root(), "go.mod")
+		modData, err := os.ReadFile(modPath)
+		if err != nil {
+			sendErr(err)
+			return nil
+		}
+		mod, err := modfile.Parse(modPath, modData, nil)
+		if err != nil {
+			sendErr(err)
+			return nil
+		}
+
+		commandRelPath := filepath.ToSlash(filepath.Join(req.WorkingDir, req.ScriptArgs[0]))
+		scriptArgs := req.ScriptArgs[1:]
+		commandPkg := paths.Pkg(mod.Module.Mod.Path).JoinSlash(paths.RelSlash(commandRelPath))
+
+		p := run.ExecScriptParams{
+			App:        app,
+			NS:         ns,
+			WorkingDir: req.WorkingDir,
+			Environ:    req.Environ,
+			MainPkg:    commandPkg,
+			ScriptArgs: scriptArgs,
+			Stdout:     slog.Stdout(false),
+			Stderr:     slog.Stderr(false),
+			OpTracker:  ops,
+		}
+		if err := s.mgr.ExecScript(stream.Context(), p); err != nil {
+			sendErr(err)
+		} else {
+			streamExit(stream, 0)
+		}
+	case appfile.LangTS:
+		p := run.ExecCommandParams{
+			App:        app,
+			NS:         ns,
+			WorkingDir: req.WorkingDir,
+			Environ:    req.Environ,
+			Command:    req.ScriptArgs[0],
+			ScriptArgs: req.ScriptArgs[1:],
+			Stdout:     slog.Stdout(false),
+			Stderr:     slog.Stderr(false),
+			OpTracker:  ops,
+		}
+
+		if err := s.mgr.ExecCommand(stream.Context(), p); err != nil {
+			sendErr(err)
+		} else {
+			streamExit(stream, 0)
+		}
+	}
+
+	return nil
+}
diff --git a/cli/daemon/export.go b/cli/daemon/export.go
new file mode 100644
index 0000000000..71108ab418
--- /dev/null
+++ b/cli/daemon/export.go
@@ -0,0 +1,39 @@
+package daemon
+
+import (
+	"go/scanner"
+
+	"encr.dev/cli/daemon/export"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+// Export exports the app.
+func (s *Server) Export(req *daemonpb.ExportRequest, stream daemonpb.Daemon_ExportServer) error {
+	slog := &streamLog{stream: stream, buffered: false}
+	log := newStreamLogger(slog)
+
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		log.Error().Err(err).Msg("failed to resolve app")
+		streamExit(stream, 1)
+		return nil
+	}
+
+	exitCode := 0
+	success, err := export.Docker(stream.Context(), app, req, log)
+	if err != nil {
+		exitCode = 1
+		if list, ok := err.(scanner.ErrorList); ok {
+			for _, e := range list {
+				log.Error().Msg(e.Error())
+			}
+		} else {
+			log.Error().Msg(err.Error())
+		}
+	} else if !success {
+		exitCode = 1
+	}
+
+	streamExit(stream, exitCode)
+	return nil
+}
diff --git a/cli/daemon/export/download.go b/cli/daemon/export/download.go
new file mode 100644
index 0000000000..fe0ff5cbcb
--- /dev/null
+++ b/cli/daemon/export/download.go
@@ -0,0 +1,150 @@
+package export
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"runtime"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/internal/conf"
+	"encr.dev/internal/env"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/dockerbuild"
+)
+
+const (
+	DOWNLOAD_BASE_URL = "https://storage.googleapis.com/encore-optional/encore"
+)
+
+func downloadBinary(platform, arch string, binary string, log zerolog.Logger) (dockerbuild.HostPath, error) {
+	if version.Channel == version.DevBuild {
+		suffix := ""
+		if platform != runtime.GOOS || arch != runtime.GOARCH {
+			suffix = "-" + platform + "-" + arch
+		}
+		if binary == "encore-runtime.node" {
+			binary = "js/" + binary
+		}
+		path := filepath.Join(env.EncoreRuntimesPath(), binary+suffix)
+		if _, err := os.Stat(path); err == nil {
+			return dockerbuild.HostPath(path), nil
+		}
+		return "", fmt.Errorf("development build of %s/%s %s not found at %s. Build it with `go run ./pkg/encorebuild/cmd/build-local-binary %[3]s --os=%[1]s --arch=%[2]s`", platform, arch, binary, path)
+	}
+	cacheDir, err := conf.CacheDir()
+	if err != nil {
+		return "", err
+	}
+	binDir := dockerbuild.HostPath(cacheDir).Join("bin")
+	archDir := binDir.Join(version.Version, platform, arch)
+	binaryPath := archDir.Join(binary)
+	if _, err := os.Stat(binaryPath.String()); err == nil {
+		return binaryPath, nil
+	}
+	if err := os.MkdirAll(archDir.String(), 0755); err != nil {
+		return "", err
+	}
+	// Download the binaries
+	archURL := fmt.Sprintf("%s/%s/%s-%s", DOWNLOAD_BASE_URL, version.Version, platform, arch)
+	url := fmt.Sprintf("%s/%s", archURL, binary)
+	log.Info().Msgf("Downloading %s/%s %s", platform, arch, binary)
+	if err := downloadFile(url, binaryPath.String()); err != nil {
+		return "", err
+	}
+	tryCleanupPreviousVersions(binDir)
+	return binaryPath, nil
+}
+
+func tryCleanupPreviousVersions(binDir dockerbuild.HostPath) {
+	// Clean up binaries for other versions
+	entries, err := os.ReadDir(binDir.String())
+	if err != nil {
+		log.Warn().Msgf("failed to read directory %s: %v", binDir, err)
+		return
+	}
+	for _, entry := range entries {
+		if entry.IsDir() && entry.Name() != version.Version {
+			oldVersionPath := filepath.Join(binDir.String(), entry.Name())
+			if err := os.RemoveAll(oldVersionPath); err != nil {
+				log.Warn().Msgf("failed to remove old version directory %s: %v", oldVersionPath, err)
+			}
+		}
+	}
+	return
+}
+
+func downloadFile(url, dest string) error {
+	// Download the file to a temporary destination
+	resp, err := http.Get(url)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("failed to download %s: %s", url, resp.Status)
+	}
+
+	tmpDest := dest + ".tmp"
+	out, err := os.OpenFile(tmpDest, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0755)
+	if err != nil {
+		return err
+	}
+	defer out.Close()
+
+	_, err = io.Copy(out, resp.Body)
+	if err != nil {
+		return err
+	}
+	out.Close()
+
+	// Download the checksum
+	sha256url := url + ".sha256"
+	resp, err = http.Get(sha256url)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return fmt.Errorf("failed to download %s: %s", sha256url, resp.Status)
+	}
+	hash, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return err
+	}
+
+	// Validate the checksum
+	if err := validateHash(tmpDest, string(hash)); err != nil {
+		return err
+	}
+
+	// Move the file
+	if err := os.Rename(tmpDest, dest); err != nil {
+		return err
+	}
+	return nil
+}
+
+func validateHash(file, hash string) error {
+	f, err := os.Open(file)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return err
+	}
+	if fileHash := hex.EncodeToString(h.Sum(nil)); hash != fileHash {
+		return fmt.Errorf("file checksum failed. Expected %s, got %s", hash, fileHash)
+	}
+	return nil
+}
diff --git a/cli/daemon/export/export.go b/cli/daemon/export/export.go
new file mode 100644
index 0000000000..9be8a4b476
--- /dev/null
+++ b/cli/daemon/export/export.go
@@ -0,0 +1,311 @@
+package export
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"path/filepath"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/google/go-containerregistry/pkg/authn"
+	"github.com/google/go-containerregistry/pkg/name"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/google/go-containerregistry/pkg/v1/daemon"
+	"github.com/google/go-containerregistry/pkg/v1/empty"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/rs/zerolog"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/internal/env"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/appfile"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/builder/builderimpl"
+	"encr.dev/pkg/cueutil"
+	"encr.dev/pkg/dockerbuild"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/vcs"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+// Docker exports the app as a docker image.
+func Docker(ctx context.Context, app *apps.Instance, req *daemonpb.ExportRequest, log zerolog.Logger) (success bool, err error) {
+	params := req.GetDocker()
+	if params == nil {
+		return false, errors.Newf("unsupported format: %T", req.Format)
+	}
+
+	expSet, err := app.Experiments(req.Environ)
+	if err != nil {
+		return false, errors.Wrap(err, "get experimental features")
+	}
+
+	vcsRevision := vcs.GetRevision(app.Root())
+	buildInfo := builder.BuildInfo{
+		BuildTags:          []string{"timetzdata"},
+		CgoEnabled:         req.CgoEnabled,
+		StaticLink:         true,
+		DebugMode:          builder.DebugModeDisabled,
+		Environ:            req.Environ,
+		GOOS:               req.Goos,
+		GOARCH:             req.Goarch,
+		KeepOutput:         false,
+		Revision:           vcsRevision.Revision,
+		UncommittedChanges: vcsRevision.Uncommitted,
+
+		// Use the local JS runtime if this is a development build.
+		UseLocalJSRuntime: version.Channel == version.DevBuild,
+	}
+	appLang := app.Lang()
+	bld := builderimpl.Resolve(appLang, expSet)
+	defer fns.CloseIgnore(bld)
+	parse, err := bld.Parse(ctx, builder.ParseParams{
+		Build:       buildInfo,
+		App:         app,
+		Experiments: expSet,
+		WorkingDir:  ".",
+		ParseTests:  false,
+	})
+	if err != nil {
+		return false, err
+	}
+	if err := app.CacheMetadata(parse.Meta); err != nil {
+		log.Info().Err(err).Msg("failed to cache metadata")
+		return false, errors.Wrap(err, "cache metadata")
+	}
+
+	// Validate the service configs.
+	_, err = bld.ServiceConfigs(ctx, builder.ServiceConfigsParams{
+		Parse: parse,
+		CueMeta: &cueutil.Meta{
+			// Dummy data to satisfy config validation.
+			APIBaseURL: "http://localhost:0",
+			EnvName:    "encore-eject",
+			EnvType:    cueutil.EnvType_Development,
+			CloudType:  cueutil.CloudType_Local,
+		},
+	})
+	if err != nil {
+		return false, err
+	}
+
+	log.Info().Msgf("compiling Encore application for %s/%s", req.Goos, req.Goarch)
+	result, err := bld.Compile(ctx, builder.CompileParams{
+		Build:       buildInfo,
+		App:         app,
+		Parse:       parse,
+		OpTracker:   nil, // TODO
+		Experiments: expSet,
+		WorkingDir:  ".",
+	})
+
+	if err != nil {
+		log.Info().Err(err).Msg("compilation failed")
+		return false, errors.Wrap(err, "compilation failed")
+	}
+
+	var crossNodeRuntime option.Option[dockerbuild.HostPath]
+	if appLang == appfile.LangTS && buildInfo.IsCrossBuild() {
+		binary, err := downloadBinary(req.Goos, req.Goarch, "encore-runtime.node", log)
+		if err != nil {
+			return false, errors.Wrap(err, "download runtime binaries")
+		}
+		crossNodeRuntime = option.Some(binary)
+	}
+
+	buildSettings, err := app.BuildSettings()
+	if err != nil {
+		return false, errors.Wrap(err, "get build settings")
+	}
+
+	describeCfg := dockerbuild.DescribeConfig{
+		Meta:              parse.Meta,
+		Compile:           result,
+		BundleSource:      option.Option[dockerbuild.BundleSourceSpec]{},
+		DockerBaseImage:   option.AsOptional(params.BaseImageTag),
+		Runtimes:          dockerbuild.HostPath(env.EncoreRuntimesPath()),
+		NodeRuntime:       crossNodeRuntime,
+		ProcessPerService: buildSettings.Docker.ProcessPerService,
+	}
+
+	if buildSettings.Docker.BundleSource || appLang == appfile.LangTS {
+		workspaceRoot := req.WorkspaceRoot
+		appRoot := app.Root()
+
+		relPath, err := filepath.Rel(workspaceRoot, appRoot)
+		if err != nil {
+			return false, errors.Wrap(err, "relative path from workspace root to app root")
+		}
+
+		relPath = filepath.ToSlash(relPath)
+
+		includedPaths, err := dockerbuild.DetermineIncludes(appLang, buildSettings.Docker.BundleSource, workspaceRoot, appRoot)
+		if err != nil {
+			return false, errors.Wrap(err, "determine extra includes")
+		}
+
+		imageAppRoot := dockerbuild.ImagePath("/workspace").Join(relPath)
+
+		describeCfg.BundleSource = option.Some(dockerbuild.BundleSourceSpec{
+			Source:         dockerbuild.HostPath(workspaceRoot),
+			Dest:           "/workspace",
+			AppRootRelpath: dockerbuild.RelPath(relPath),
+			IncludeSource:  includedPaths,
+			ExcludeSource: []dockerbuild.RelPath{
+				".git",
+			},
+		})
+
+		if describeCfg.WorkingDir.Empty() {
+			// Set the working directory to app root by default.
+			describeCfg.WorkingDir = option.Some(imageAppRoot)
+		}
+	}
+
+	spec, err := dockerbuild.Describe(describeCfg)
+	if err != nil {
+		return false, errors.Wrap(err, "describe docker image")
+	}
+
+	cors, err := app.GlobalCORS()
+	if err != nil {
+		return false, errors.Wrap(err, "get global CORS")
+	}
+	var logResponse string
+	if !req.SkipInfraConf {
+		cfg, infraCfgOutput, err := buildAndValidateInfraConfig(EmbeddedInfraConfigParams{
+			File:       dockerbuild.HostPath(req.InfraConfPath),
+			Services:   req.Services,
+			Gateways:   req.Gateways,
+			GlobalCORS: cors,
+			Meta:       parse.Meta,
+		})
+		logResponse = infraCfgOutput
+		if err != nil {
+			return false, errors.Wrap(err, "build infra config")
+		}
+		data, err := json.Marshal(cfg)
+		if err != nil {
+			return false, errors.Wrap(err, "marshal infra config")
+		}
+		spec.WriteFiles[defaultInfraConfigPath] = data
+		spec.Env = append(spec.Env, fmt.Sprintf("ENCORE_INFRA_CONFIG_PATH=%s", defaultInfraConfigPath))
+	}
+	var baseImgOverride option.Option[v1.Image]
+	if params.BaseImageTag != "" {
+		baseImg, err := resolveBaseImage(ctx, log, params, spec)
+		if err != nil {
+			return false, errors.Wrap(err, "resolve base image")
+		}
+		baseImgOverride = option.Some(baseImg)
+	}
+
+	var supervisorPath option.Option[dockerbuild.HostPath]
+	if spec.Supervisor.Present() {
+		binary, err := downloadBinary(req.Goos, req.Goarch, "supervisor-encore", log)
+		if err != nil {
+			return false, errors.Wrap(err, "download supervisor binaries")
+		}
+		supervisorPath = option.Some(binary)
+	}
+	img, err := dockerbuild.BuildImage(ctx, spec, dockerbuild.ImageBuildConfig{
+		BuildTime:         time.Now(),
+		BaseImageOverride: baseImgOverride,
+		AddCACerts:        option.Some[dockerbuild.ImagePath](""),
+		SupervisorPath:    supervisorPath,
+	})
+	if err != nil {
+		return false, errors.Wrap(err, "build docker image")
+	}
+
+	if params.LocalDaemonTag != "" {
+		tag, err := name.NewTag(params.LocalDaemonTag, name.WeakValidation)
+		if err != nil {
+			log.Error().Err(err).Msg("invalid image tag")
+			return false, nil
+		}
+		log.Info().Msg("saving image to local docker daemon")
+
+		_, err = daemon.Write(tag, img, daemon.WithUnbufferedOpener())
+		if err != nil {
+			log.Error().Err(err).Msg("unable to save docker image")
+			return false, nil
+		}
+		log.Info().Msg("successfully saved local docker image")
+	}
+
+	if params.PushDestinationTag != "" {
+		tag, err := name.NewTag(params.PushDestinationTag, name.WeakValidation)
+		if err != nil {
+			log.Error().Err(err).Msg("invalid image tag")
+			return false, nil
+		}
+		log.Info().Msg("pushing image to docker registry")
+		if err := pushDockerImage(ctx, log, img, tag); err != nil {
+			log.Error().Err(err).Msg("unable to push docker image")
+			return false, nil
+		}
+	}
+
+	log.Info().Msgf("successfully exported app as docker image\n%s", logResponse)
+	return true, nil
+}
+
+func resolveBaseImage(ctx context.Context, log zerolog.Logger, p *daemonpb.DockerExportParams, spec *dockerbuild.ImageSpec) (v1.Image, error) {
+	baseImgTag := p.BaseImageTag
+	if baseImgTag == "" || baseImgTag == "scratch" {
+		return empty.Image, nil
+	}
+
+	// Try to get it from the daemon if it exists.
+	log.Info().Msgf("resolving base image %s", baseImgTag)
+	baseImgRef, err := name.ParseReference(baseImgTag)
+	if err != nil {
+		return nil, errors.Wrap(err, "parse base image")
+	}
+
+	fetchRemote := true
+	img, err := daemon.Image(baseImgRef, daemon.WithUnbufferedOpener())
+	if err == nil {
+		file, err := img.ConfigFile()
+		if err == nil {
+			fetchRemote = file.OS != spec.OS || file.Architecture != spec.Arch
+		}
+	}
+	if fetchRemote {
+		log.Info().Msg("could not get image from local daemon, fetching it remotely")
+		keychain := authn.DefaultKeychain
+		img, err = remote.Image(baseImgRef, remote.WithAuthFromKeychain(keychain), remote.WithContext(ctx), remote.WithPlatform(v1.Platform{
+			OS:           spec.OS,
+			Architecture: spec.Arch,
+		}))
+		if err != nil {
+			return nil, errors.Wrap(err, "unable to fetch image")
+		}
+		// If the user requested to push the image locally, save the remote image locally as well.
+		if p.LocalDaemonTag != "" {
+			if tag, err := name.NewTag(baseImgTag, name.WeakValidation); err == nil {
+				log.Info().Msgf("saving remote image %s to local docker daemon", baseImgTag)
+				if _, err = daemon.Write(tag, img); err != nil {
+					log.Warn().Err(err).Msg("unable to save remote image to local docker daemon, skipping")
+				} else {
+					log.Info().Msgf("saved remote image to local docker daemon")
+				}
+			}
+		}
+	}
+
+	return img, nil
+}
+
+func pushDockerImage(ctx context.Context, log zerolog.Logger, img v1.Image, destination name.Tag) error {
+	log.Info().Msg("pushing docker image to container registry")
+	keychain := authn.DefaultKeychain
+	if err := remote.Write(destination, img, remote.WithAuthFromKeychain(keychain), remote.WithContext(ctx)); err != nil {
+		return errors.WithStack(err)
+	}
+	log.Info().Msg("successfully pushed docker image")
+	return nil
+}
diff --git a/cli/daemon/export/infra_config.go b/cli/daemon/export/infra_config.go
new file mode 100644
index 0000000000..238adc3945
--- /dev/null
+++ b/cli/daemon/export/infra_config.go
@@ -0,0 +1,492 @@
+package export
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"slices"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+	"github.com/logrusorgru/aurora"
+	"github.com/tailscale/hujson"
+	"golang.org/x/exp/maps"
+
+	"encore.dev/appruntime/exported/config/infra"
+	"encr.dev/pkg/appfile"
+	"encr.dev/pkg/dockerbuild"
+	"encr.dev/pkg/fns"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+var (
+	LEARN_MORE = aurora.Italic("Learn More: https://encore.dev/docs/how-to/self-host").String()
+)
+
+// defaultInfraConfigPath is the path in the image where the environment configuration is mounted.
+const defaultInfraConfigPath dockerbuild.ImagePath = "/encore/infra.config.json"
+
+type EmbeddedInfraConfigParams struct {
+	// The path to the infra config file.
+	File dockerbuild.HostPath
+
+	// Services to include in the image.
+	Services []string
+
+	// Gateways to include in the image.
+	Gateways []string
+
+	// CORS config to include in the image.
+	GlobalCORS appfile.CORS
+
+	Meta *meta.Data
+}
+
+func buildAndValidateInfraConfig(params EmbeddedInfraConfigParams) (*infra.InfraConfig, string, error) {
+	missing := map[string][]string{}
+	md := params.Meta
+	services := params.Services
+	gateways := params.Gateways
+	if len(services)+len(gateways) == 0 {
+		services = fns.Map(md.Svcs, (*meta.Service).GetName)
+		gateways = fns.Map(md.Gateways, (*meta.Gateway).GetEncoreName)
+	}
+
+	unknownServices := fns.Filter(services, func(s string) bool {
+		return !fns.Any(md.Svcs, func(svc *meta.Service) bool {
+			return svc.Name == s
+		})
+	})
+	if len(unknownServices) > 0 {
+		return nil, "", errors.Newf("unknown services: %v", unknownServices)
+	}
+
+	unknownGateways := fns.Filter(gateways, func(s string) bool {
+		return !fns.Any(md.Gateways, func(gw *meta.Gateway) bool {
+			return gw.EncoreName == s
+		})
+	})
+	if len(unknownGateways) > 0 {
+		return nil, "", errors.Newf("unknown gateways: %v", unknownGateways)
+	}
+
+	var infraCfg infra.InfraConfig
+	if params.File != "" {
+		data, err := os.ReadFile(params.File.String())
+		if err != nil {
+			return nil, "", errors.Wrap(err, "infra config not found")
+		}
+		data, err = hujson.Standardize(data)
+		if err != nil {
+			return nil, "", errors.Wrap(err, "could not standardize infra config")
+		}
+		err = json.Unmarshal(data, &infraCfg)
+		if err != nil {
+			return nil, "", errors.Wrap(err, "could not decode infra config")
+		}
+	}
+	infraCfg.HostedGateways = gateways
+	infraCfg.HostedServices = services
+	envVars, validationErrors := infra.Validate(&infraCfg)
+
+	hostedSvcs := fns.ToMap(fns.Filter(md.Svcs, func(svc *meta.Service) bool {
+		return fns.Any(services, func(s string) bool {
+			return svc.Name == s
+		})
+	}), (*meta.Service).GetName)
+
+	var secrets []string
+	// Find all service dependencies for our hosted services.
+	var svcDeps = map[string]struct{}{}
+	pkgs := fns.ToMap(md.Pkgs, (*meta.Package).GetRelPath)
+
+	// Add dependencies for all outbound RPCs for our hosted services
+	// and collect all required secrets.
+	for _, p := range md.Pkgs {
+		if p.ServiceName == "" {
+			secrets = append(secrets, p.Secrets...)
+			continue
+		} else if _, ok := hostedSvcs[p.ServiceName]; !ok {
+			continue
+		}
+		secrets = append(secrets, p.Secrets...)
+		for _, r := range p.RpcCalls {
+			svcDeps[pkgs[r.Pkg].ServiceName] = struct{}{}
+		}
+	}
+
+	// Add auth handler to service discovery if we host any auth RPCs.
+	if md.AuthHandler != nil {
+		requiresAuth := fns.Any(md.Svcs, func(svc *meta.Service) bool {
+			return fns.Any(svc.Rpcs, func(rpc *meta.RPC) bool {
+				return rpc.AccessType == meta.RPC_AUTH
+			})
+		})
+		if requiresAuth {
+			svcDeps[md.AuthHandler.ServiceName] = struct{}{}
+		}
+	}
+
+	// Make sure we have service discovery for all services that are not private
+	// if we are hosting gateways.
+	if len(gateways) > 0 {
+		for _, svc := range md.Svcs {
+			if _, ok := hostedSvcs[svc.Name]; ok {
+				continue
+			}
+			for _, rpc := range svc.Rpcs {
+				if rpc.AccessType != meta.RPC_PRIVATE {
+					svcDeps[svc.Name] = struct{}{}
+					break
+				}
+			}
+		}
+	}
+
+	// Remove any services that we host from our service dependencies.
+	for _, svc := range hostedSvcs {
+		delete(svcDeps, svc.Name)
+	}
+
+	// Remove any service discovery entries for services that we don't host.
+	for svc := range infraCfg.ServiceDiscovery {
+		if _, ok := svcDeps[svc]; !ok {
+			delete(infraCfg.ServiceDiscovery, svc)
+		} else {
+			delete(svcDeps, svc)
+		}
+	}
+
+	// Make sure all our service dependencies are accounted for.
+	if len(svcDeps) > 0 {
+		missing["Service Discovery"] = maps.Keys(svcDeps)
+	}
+
+	// Remove secrets we don't need for our hosted services.
+	slices.Sort(secrets)
+	secrets = slices.Compact(secrets)
+	var ok bool
+	if infraCfg.Secrets.EnvRef == nil {
+		for secret := range infraCfg.Secrets.SecretsMap {
+			secrets, ok = fns.Delete(secrets, secret)
+			if !ok {
+				delete(infraCfg.Secrets.SecretsMap, secret)
+			}
+		}
+
+		// Make sure all our secrets are accounted for.
+		if len(secrets) > 0 {
+			missing["Secrets"] = secrets
+		}
+	} else {
+		// Print that you need to define a secrets map in the infra config.
+	}
+
+	// Find all databases for our hosted services.
+	databases := fns.FlatMap(maps.Values(hostedSvcs), func(db *meta.Service) []string {
+		return db.Databases
+	})
+	slices.Sort(databases)
+	databases = slices.Compact(databases)
+
+	for i, sqlServer := range append([]*infra.SQLServer{}, infraCfg.SQLServers...) {
+		for name := range sqlServer.Databases {
+			databases, ok = fns.Delete(databases, name)
+			if !ok {
+				delete(sqlServer.Databases, name)
+			}
+		}
+		if len(sqlServer.Databases) == 0 {
+			infraCfg.SQLServers = append(infraCfg.SQLServers[:i], infraCfg.SQLServers[i+1:]...)
+		}
+	}
+
+	if len(databases) > 0 {
+		missing["Databases"] = databases
+	}
+
+	caches := fns.MapAndFilter(md.CacheClusters, func(cache *meta.CacheCluster) (string, bool) {
+		return cache.Name, fns.Any(cache.Keyspaces, func(ks *meta.CacheCluster_Keyspace) bool {
+			return fns.Any(services, func(s string) bool {
+				return ks.Service == s
+			})
+		})
+	})
+
+	for name := range infraCfg.Redis {
+		caches, ok = fns.Delete(caches, name)
+		if !ok {
+			delete(infraCfg.Redis, name)
+		}
+	}
+
+	if len(caches) > 0 {
+		missing["Redis"] = caches
+	}
+
+	subscriptions := fns.FlatMap(md.PubsubTopics, func(topic *meta.PubSubTopic) [][2]string {
+		return fns.MapAndFilter(topic.Subscriptions, func(s *meta.PubSubTopic_Subscription) ([2]string, bool) {
+			return [2]string{topic.Name, s.Name}, fns.Any(services, func(svc string) bool {
+				return s.ServiceName == svc
+			})
+		})
+	})
+
+	for _, pubsub := range infraCfg.PubSub {
+		for topicName, topic := range pubsub.GetTopics() {
+			for subName := range topic.GetSubscriptions() {
+				found := false
+				for i, sub := range subscriptions {
+					if sub[0] == topicName && sub[1] == subName {
+						subscriptions = append(subscriptions[:i], subscriptions[i+1:]...)
+						found = true
+						break
+					}
+				}
+				if !found {
+					topic.DeleteSubscription(subName)
+				}
+			}
+		}
+	}
+
+	if len(subscriptions) > 0 {
+		missing["Subscriptions"] = fns.Map(subscriptions, func(sub [2]string) string {
+			return sub[0] + "/" + sub[1]
+		})
+	}
+
+	topics := fns.MapAndFilter(md.PubsubTopics, func(topic *meta.PubSubTopic) (string, bool) {
+		return topic.Name, fns.Any(topic.Publishers, func(p *meta.PubSubTopic_Publisher) bool {
+			return fns.Any(services, func(s string) bool {
+				return p.ServiceName == s
+			})
+		})
+	})
+
+	for i, pubsub := range infraCfg.PubSub {
+		for topicName, topic := range pubsub.GetTopics() {
+			i := slices.Index(topics, topicName)
+			if i != -1 {
+				topics = append(topics[:i], topics[i+1:]...)
+			} else if len(topic.GetSubscriptions()) == 0 {
+				pubsub.DeleteTopic(topicName)
+			}
+		}
+		if len(pubsub.GetTopics()) == 0 {
+			infraCfg.PubSub = append(infraCfg.PubSub[:i], infraCfg.PubSub[i+1:]...)
+		}
+	}
+	if len(topics) > 0 {
+		missing["Topics"] = topics
+	}
+
+	// Validate bucket config
+	buckets := fns.FlatMap(maps.Values(hostedSvcs), func(svc *meta.Service) []string {
+		return fns.Map(svc.Buckets, (*meta.BucketUsage).GetBucket)
+	})
+	slices.Sort(buckets)
+	buckets = slices.Compact(buckets)
+
+	for _, storage := range infraCfg.ObjectStorage {
+		for name, infraCfg := range storage.GetBuckets() {
+			metaBkt, ok := fns.Find(md.Buckets, func(b *meta.Bucket) bool {
+				return b.Name == name
+			})
+			if ok {
+				if metaBkt.Public && infraCfg.PublicBaseURL == "" {
+					path := infra.JSONPath("buckets").Append(infra.JSONPath(name)).Append("public_base_url")
+					validationErrors[path] = errors.New("Bucket is public but no public base URL is set")
+					return nil, "", configError(missing, validationErrors)
+				}
+			}
+
+			buckets, ok = fns.Delete(buckets, name)
+			if !ok {
+				storage.DeleteBucket(name)
+			}
+		}
+	}
+	if len(buckets) > 0 {
+		missing["Buckets"] = buckets
+	}
+
+	// Copy CORS config
+	cors := infra.CORS(params.GlobalCORS)
+	infraCfg.CORS = &cors
+
+	if len(missing) > 0 || len(validationErrors) > 0 {
+		return nil, "", configError(missing, validationErrors)
+	}
+
+	cronJobStr, err := formatCronJobInstructions(services, md)
+	if err != nil {
+		return nil, "", err
+	}
+	envStr := formatEnvVars(envVars)
+	var resp strings.Builder
+	if len(cronJobStr)+len(envStr) > 0 {
+		resp.WriteString(aurora.Bold("Before you deploy, you may need to configure the following:\n").String())
+		resp.WriteString(cronJobStr)
+		resp.WriteString(envStr)
+	}
+	resp.WriteString(LEARN_MORE)
+
+	return &infraCfg, resp.String(), nil
+}
+
+func formatCronJobInstructions(services []string, md *meta.Data) (string, error) {
+	if len(md.CronJobs) == 0 {
+		return "", nil
+	}
+	svcByRelPath := fns.ToMap(md.Svcs, func(p *meta.Service) string {
+		return p.RelPath
+	})
+	cronsTable := [][]string{
+		{"ID", "Endpoint Path", "Schedule"},
+	}
+	for _, cronJob := range md.CronJobs {
+		svc, ok := svcByRelPath[cronJob.Endpoint.Pkg]
+		if !ok {
+			return "", errors.Newf("could not find service for cron job %s", cronJob.Id)
+		}
+		if !slices.Contains(services, svc.Name) {
+			continue
+		}
+		rpc, ok := fns.Find(svc.Rpcs, func(r *meta.RPC) bool {
+			return r.Name == cronJob.Endpoint.Name
+		})
+		if !ok {
+			return "", errors.Newf("could not find rpc for cron job %s", cronJob.Id)
+		}
+		cronsTable = append(cronsTable, []string{cronJob.Id, pathToString(rpc.Path), cronJob.Schedule})
+	}
+	if len(cronsTable) == 1 {
+		return "", nil
+	}
+
+	return aurora.Sprintf("\n%s\n%s\n", aurora.Bold("Cron Jobs:"), generateTable(cronsTable)), nil
+}
+
+func generateTable(rows [][]string) string {
+	au := aurora.NewAurora(true)
+	var sb strings.Builder
+
+	// Calculate column widths
+	colWidths := make([]int, len(rows[0]))
+	for _, row := range rows {
+		for i, cell := range row {
+			colWidths[i] = max(colWidths[i], len(cell))
+		}
+	}
+
+	// Helper function to create a horizontal line
+	createLine := func() string {
+		line := "+"
+		for _, width := range colWidths {
+			line += strings.Repeat("-", width+2) + "+"
+		}
+		return line + "\n"
+	}
+
+	// Write top border
+	sb.WriteString(au.Cyan(createLine()).String())
+
+	// Write header
+	sb.WriteString(au.Cyan("| ").String())
+	for i, header := range rows[0] {
+		sb.WriteString(au.Bold(fmt.Sprintf("%-*s", colWidths[i], header)).String())
+		sb.WriteString(au.Cyan(" | ").String())
+	}
+	sb.WriteString("\n")
+
+	// Write header-content separator
+	sb.WriteString(au.Cyan(createLine()).String())
+
+	// Write content rows
+	for _, row := range rows[1:] {
+		sb.WriteString(au.Cyan("| ").String())
+		for i, cell := range row {
+			sb.WriteString(fmt.Sprintf("%-*s", colWidths[i], cell))
+			sb.WriteString(au.Cyan(" | ").String())
+		}
+		sb.WriteString("\n")
+	}
+
+	// Write bottom border
+	sb.WriteString(au.Cyan(createLine()).String())
+
+	return sb.String()
+}
+
+func pathToString(path *meta.Path) string {
+	b := strings.Builder{}
+	for _, s := range path.Segments {
+		b.WriteByte('/')
+		switch s.Type {
+		case meta.PathSegment_PARAM:
+			b.WriteByte(':')
+		case meta.PathSegment_WILDCARD:
+			b.WriteByte('*')
+		case meta.PathSegment_FALLBACK:
+			b.WriteByte('!')
+		}
+		b.WriteString(s.Value)
+	}
+	return b.String()
+
+}
+
+func formatEnvVars(envVars map[infra.JSONPath]infra.EnvDesc) string {
+	if len(envVars) == 0 {
+		return ""
+	}
+
+	envByName := map[string]infra.EnvDesc{}
+	for _, envVar := range envVars {
+		envByName[envVar.Name] = envVar
+	}
+	envTable := [][]string{
+		{"Name", "Description"},
+	}
+	for _, envVar := range envByName {
+		envTable = append(envTable, []string{envVar.Name, envVar.Description})
+	}
+	return aurora.Sprintf("%s\n%s\n", aurora.Bold("Environment Variables:"), generateTable(envTable))
+}
+
+func configError(missing map[string][]string, validation map[infra.JSONPath]error) error {
+	au := aurora.NewAurora(true)
+	var errorMsg strings.Builder
+
+	errorMsg.WriteString("\n")
+	errorMsg.WriteString(au.Red("\nYour infra configuration is incomplete\n").String())
+	errorMsg.WriteString("\n")
+
+	if len(missing) > 0 {
+		errorMsg.WriteString(au.Red("Missing Resource Configurations:\n").String())
+		maxTypeLen := 0
+		for dataType := range missing {
+			if len(dataType) > maxTypeLen {
+				maxTypeLen = len(dataType)
+			}
+		}
+
+		for dataType, values := range missing {
+			paddedType := fmt.Sprintf("%-*s", maxTypeLen, dataType)
+			errorMsg.WriteString(fmt.Sprintf("  %s: %s\n",
+				au.Bold(paddedType),
+				strings.Join(values, ", ")))
+		}
+		errorMsg.WriteString(" \n ")
+	}
+	if len(validation) > 0 {
+		errorMsg.WriteString(au.Red("Validation Errors:\n").String())
+		for dataType, err := range validation {
+			errorMsg.WriteString(fmt.Sprintf("  %s: %s\n", au.Bold(dataType), err.Error()))
+		}
+		errorMsg.WriteString(" \n ")
+	}
+	errorMsg.WriteString(LEARN_MORE)
+	return errors.Newf(errorMsg.String())
+}
diff --git a/cli/daemon/internal/appfile/appfile.go b/cli/daemon/internal/appfile/appfile.go
deleted file mode 100644
index 786dda0eca..0000000000
--- a/cli/daemon/internal/appfile/appfile.go
+++ /dev/null
@@ -1,54 +0,0 @@
-// Package appfile reads and writes encore.app files.
-package appfile
-
-import (
-	"errors"
-	"fmt"
-	"io/fs"
-	"os"
-	"path/filepath"
-
-	"github.com/tailscale/hujson"
-)
-
-// Name is the name of the Encore app file.
-// It is expected to be located in the root of the Encore app
-// (which is usually the Git repository root).
-const Name = "encore.app"
-
-// File is a parsed encore.app file.
-type File struct {
-	// ID is the encore.dev app id for the app.
-	// It is empty if the app is not linked to encore.dev.
-	ID string `json:"id"` // can be empty
-}
-
-// Parse parses the app file data into a File.
-func Parse(data []byte) (*File, error) {
-	var f File
-	if err := hujson.Unmarshal(data, &f); err != nil {
-		return nil, fmt.Errorf("appfile.Parse: %v", err)
-	}
-	return &f, nil
-}
-
-// ParseFile parses the app file located at path.
-func ParseFile(path string) (*File, error) {
-	data, err := os.ReadFile(path)
-	if errors.Is(err, fs.ErrNotExist) {
-		return &File{}, nil
-	} else if err != nil {
-		return nil, fmt.Errorf("appfile.ParseFile: %w", err)
-	}
-	return Parse(data)
-}
-
-// Slug parses the app slug for the encore.app file located at path.
-// The slug can be empty if the app is not linked to encore.dev.
-func Slug(appRoot string) (string, error) {
-	f, err := ParseFile(filepath.Join(appRoot, Name))
-	if err != nil {
-		return "", err
-	}
-	return f.ID, nil
-}
diff --git a/cli/daemon/internal/manifest/manifest.go b/cli/daemon/internal/manifest/manifest.go
deleted file mode 100644
index 623bc4533b..0000000000
--- a/cli/daemon/internal/manifest/manifest.go
+++ /dev/null
@@ -1,86 +0,0 @@
-// Package manifest reads and writes Encore app manifests.
-package manifest
-
-import (
-	"crypto/rand"
-	"encoding/base32"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/fs"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-
-	"encr.dev/cli/daemon/internal/appfile"
-)
-
-// Manifest represents the persisted manifest for
-// an Encore application. It is not intended to be committed to
-// source control.
-type Manifest struct {
-	// AppID is a unique identifier for the app.
-	// It uses the encore.dev app slug if the app
-	// is linked, and is otherwise a randomly generated id.
-	AppID string `json:"appID"`
-}
-
-// ReadOrCreate reads the manifest for the app rooted at appRoot.
-// If it doesn't exist it creates it first.
-func ReadOrCreate(appRoot string) (mf *Manifest, err error) {
-	defer func() {
-		if err != nil {
-			err = fmt.Errorf("read/create manifest: %v", err)
-		}
-	}()
-
-	var man Manifest
-
-	// Use the existing manifest if we have one.
-	cfgPath := filepath.Join(appRoot, ".encore", "manifest.json")
-	if data, err := os.ReadFile(cfgPath); err != nil && !errors.Is(err, fs.ErrNotExist) {
-		return nil, err
-	} else if err == nil {
-		err = json.Unmarshal(data, &man)
-		if err != nil {
-			return nil, err
-		} else if man.AppID != "" {
-			return &Manifest{AppID: man.AppID}, nil
-		}
-	}
-
-	// Otherwise create it. Default to the App ID in the encore.app file,
-	// and fall back to randomly generating an ID if the app is not linked.
-	if f, err := appfile.ParseFile(filepath.Join(appRoot, appfile.Name)); err == nil && f.ID != "" {
-		man.AppID = f.ID
-	}
-	if man.AppID == "" {
-		id, err := genID()
-		if err != nil {
-			return nil, err
-		}
-		man.AppID = id
-	}
-
-	// Write it back.
-	out, _ := json.Marshal(&man)
-	if err := os.MkdirAll(filepath.Dir(cfgPath), 0755); err != nil {
-		return nil, err
-	} else if err := ioutil.WriteFile(cfgPath, out, 0644); err != nil {
-		return nil, err
-	}
-	return &man, nil
-}
-
-const encodeStr = "23456789abcdefghikmnopqrstuvwxyz"
-
-var encoding = base32.NewEncoding(encodeStr).WithPadding(base32.NoPadding)
-
-// genID generates a
-func genID() (string, error) {
-	var data [3]byte
-	if _, err := rand.Read(data[:]); err != nil {
-		return "", err
-	}
-	return encoding.EncodeToString(data[:]), nil
-}
diff --git a/cli/daemon/internal/runlog/runlog.go b/cli/daemon/internal/runlog/runlog.go
index 866cefaf5c..be1432bb74 100644
--- a/cli/daemon/internal/runlog/runlog.go
+++ b/cli/daemon/internal/runlog/runlog.go
@@ -6,14 +6,14 @@ import (
 )
 
 type Log interface {
-	Stdout() io.Writer
-	Stderr() io.Writer
+	Stdout(buffered bool) io.Writer
+	Stderr(buffered bool) io.Writer
 }
 
 type oslog struct{}
 
-func (oslog) Stdout() io.Writer { return os.Stdout }
-func (oslog) Stderr() io.Writer { return os.Stderr }
+func (oslog) Stdout(buffered bool) io.Writer { return os.Stdout }
+func (oslog) Stderr(buffered bool) io.Writer { return os.Stderr }
 
 func OS() Log {
 	return oslog{}
diff --git a/cli/daemon/internal/sym/sym.go b/cli/daemon/internal/sym/sym.go
new file mode 100644
index 0000000000..f21653a958
--- /dev/null
+++ b/cli/daemon/internal/sym/sym.go
@@ -0,0 +1,22 @@
+// Package sym parses symbol tables from Go binaries.
+package sym
+
+import (
+	"fmt"
+	"io"
+
+	"encr.dev/cli/internal/gosym"
+)
+
+type Table struct {
+	*gosym.Table
+	BaseOffset uint64
+}
+
+func Load(r io.ReaderAt) (*Table, error) {
+	tbl, err := load(r)
+	if err != nil {
+		return nil, fmt.Errorf("sym.Load: %v", err)
+	}
+	return tbl, nil
+}
diff --git a/cli/daemon/internal/sym/sym_darwin.go b/cli/daemon/internal/sym/sym_darwin.go
new file mode 100644
index 0000000000..4bf7c2c0c6
--- /dev/null
+++ b/cli/daemon/internal/sym/sym_darwin.go
@@ -0,0 +1,48 @@
+package sym
+
+import (
+	"debug/macho"
+	"fmt"
+	"io"
+
+	"encr.dev/cli/internal/gosym"
+)
+
+func load(r io.ReaderAt) (*Table, error) {
+	exe, err := macho.NewFile(r)
+	if err != nil {
+		return nil, err
+	}
+	defer exe.Close()
+
+	text := exe.Section("__text")
+	if text == nil {
+		return nil, fmt.Errorf("cannot find __text section")
+	}
+	textAddr := text.Addr
+
+	pctbl := exe.Section("__gopclntab")
+	if pctbl == nil {
+		return nil, fmt.Errorf("cannot find __gopclntab section")
+	}
+	pctblData, err := pctbl.Data()
+	if err != nil {
+		return nil, fmt.Errorf("cannot read __gopclntab: %v", err)
+	}
+
+	symtab := exe.Section("__gosymtab")
+	if symtab == nil {
+		return nil, fmt.Errorf("cannot find __gosymtab section")
+	}
+	symtabData, err := symtab.Data()
+	if err != nil {
+		return nil, fmt.Errorf("cannot read __gosymtab: %v", err)
+	}
+
+	lntbl := gosym.NewLineTable(pctblData, textAddr)
+	tbl, err := gosym.NewTable(symtabData, lntbl)
+	if err != nil {
+		return nil, err
+	}
+	return &Table{Table: tbl, BaseOffset: textAddr}, nil
+}
diff --git a/cli/daemon/internal/sym/sym_elf.go b/cli/daemon/internal/sym/sym_elf.go
new file mode 100644
index 0000000000..082605ee5f
--- /dev/null
+++ b/cli/daemon/internal/sym/sym_elf.go
@@ -0,0 +1,51 @@
+//go:build !windows && !darwin
+// +build !windows,!darwin
+
+package sym
+
+import (
+	"debug/elf"
+	"fmt"
+	"io"
+
+	"encr.dev/cli/internal/gosym"
+)
+
+func load(r io.ReaderAt) (*Table, error) {
+	exe, err := elf.NewFile(r)
+	if err != nil {
+		return nil, err
+	}
+	defer exe.Close()
+
+	text := exe.Section(".text")
+	if text == nil {
+		return nil, fmt.Errorf("cannot find .text section")
+	}
+	textAddr := text.Addr
+
+	pctbl := exe.Section(".gopclntab")
+	if pctbl == nil {
+		return nil, fmt.Errorf("cannot find .gopclntab section")
+	}
+	pctblData, err := pctbl.Data()
+	if err != nil {
+		return nil, fmt.Errorf("cannot read .gopclntab: %v", err)
+	}
+
+	symtab := exe.Section(".gosymtab")
+	if symtab == nil {
+		return nil, fmt.Errorf("cannot find .gosymtab section")
+	}
+	symtabData, err := symtab.Data()
+	if err != nil {
+		return nil, fmt.Errorf("cannot read .gosymtab: %v", err)
+	}
+
+	lntbl := gosym.NewLineTable(pctblData, textAddr)
+	tbl, err := gosym.NewTable(symtabData, lntbl)
+	if err != nil {
+		return nil, err
+	}
+	return &Table{Table: tbl, BaseOffset: textAddr}, nil
+}
diff --git a/cli/daemon/internal/sym/sym_windows.go b/cli/daemon/internal/sym/sym_windows.go
new file mode 100644
index 0000000000..487c9c122b
--- /dev/null
+++ b/cli/daemon/internal/sym/sym_windows.go
@@ -0,0 +1,83 @@
+package sym
+
+import (
+	"debug/pe"
+	"fmt"
+	"io"
+
+	"encr.dev/cli/internal/gosym"
+)
+
+// This code is a simplified version of $GOROOT/src/cmd/internal/objfile/pe.go.
+
+func load(r io.ReaderAt) (*Table, error) {
+	exe, err := pe.NewFile(r)
+	if err != nil {
+		return nil, err
+	}
+	defer exe.Close()
+
+	var imageBase, textStart uint64
+	switch oh := exe.OptionalHeader.(type) {
+	case *pe.OptionalHeader32:
+		imageBase = uint64(oh.ImageBase)
+	case *pe.OptionalHeader64:
+		imageBase = oh.ImageBase
+	default:
+		return nil, fmt.Errorf("pe file format not recognized")
+	}
+	if sect := exe.Section(".text"); sect != nil {
+		textStart = imageBase + uint64(sect.VirtualAddress)
+	}
+	pclntab, err := loadPETable(exe, "runtime.pclntab", "runtime.epclntab")
+	if err != nil {
+		return nil, err
+	}
+	symtab, err := loadPETable(exe, "runtime.symtab", "runtime.esymtab")
+	if err != nil {
+		return nil, err
+	}
+
+	lntbl := gosym.NewLineTable(pclntab, textStart)
+	tbl, err := gosym.NewTable(symtab, lntbl)
+	if err != nil {
+		return nil, err
+	}
+	return &Table{Table: tbl, BaseOffset: textStart}, nil
+}
+
+func findPESymbol(f *pe.File, name string) (*pe.Symbol, error) {
+	for _, s := range f.Symbols {
+		if s.Name != name {
+			continue
+		}
+		if s.SectionNumber <= 0 {
+			return nil, fmt.Errorf("symbol %s: invalid section number %d", name, s.SectionNumber)
+		}
+		if len(f.Sections) < int(s.SectionNumber) {
+			return nil, fmt.Errorf("symbol %s: section number %d is larger than max %d", name, s.SectionNumber, len(f.Sections))
+		}
+		return s, nil
+	}
+	return nil, fmt.Errorf("no %s symbol found", name)
+}
+
+func loadPETable(f *pe.File, sname, ename string) ([]byte, error) {
+	ssym, err := findPESymbol(f, sname)
+	if err != nil {
+		return nil, err
+	}
+	esym, err := findPESymbol(f, ename)
+	if err != nil {
+		return nil, err
+	}
+	if ssym.SectionNumber != esym.SectionNumber {
+		return nil, fmt.Errorf("%s and %s symbols must be in the same section", sname, ename)
+	}
+	sect := f.Sections[ssym.SectionNumber-1]
+	data, err := sect.Data()
+	if err != nil {
+		return nil, err
+	}
+	return data[ssym.Value:esym.Value], nil
+}
diff --git a/cli/daemon/mcp/api_tools.go b/cli/daemon/mcp/api_tools.go
new file mode 100644
index 0000000000..074c3f45c5
--- /dev/null
+++ b/cli/daemon/mcp/api_tools.go
@@ -0,0 +1,703 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"google.golang.org/protobuf/encoding/protojson"
+
+	"encr.dev/cli/daemon/run"
+	"encr.dev/pkg/builder"
+	metav1 "encr.dev/proto/encore/parser/meta/v1"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+func (m *Manager) registerAPITools() {
+
+	// Add tool for calling an API endpoint
+	m.server.AddTool(mcp.NewTool("call_endpoint",
+		mcp.WithDescription("Make HTTP requests to any API endpoint in the currently open Encore. Always use this tool to make API calls and do not use curl. This tool will automatically start the application if it's not already running. This tool allows testing and interacting with the application's API endpoints, including authentication and custom payloads."),
+		mcp.WithString("service", mcp.Description("The name of the service containing the endpoint to call. This must match a service defined in the currently open Encore.")),
+		mcp.WithString("endpoint", mcp.Description("The name of the endpoint to call within the specified service. This must match an endpoint defined in the service.")),
+		mcp.WithString("method", mcp.Description("The HTTP method to use for the request (GET, POST, PUT, DELETE, etc.). Must be a valid HTTP method.")),
+		mcp.WithString("path", mcp.Description("The API request path, including any path parameters. This should match the endpoint's defined path pattern.")),
+		mcp.WithString("payload", mcp.Description("JSON payload for the request containing all endpoint parameters. This includes path parameters, query parameters, headers, and request body as key-value pairs.")),
+		mcp.WithString("auth_token", mcp.Description("Optional authentication token to include in the request. This is used for endpoints that require authentication.")),
+		mcp.WithString("auth_payload", mcp.Description("Optional authentication payload in JSON format. This is used for custom authentication schemes.")),
+		mcp.WithString("correlation_id", mcp.Description("Optional correlation ID to track the request through the system. Useful for debugging and tracing.")),
+	), m.callEndpoint)
+
+	// Add tool for getting all services and endpoints
+	m.server.AddTool(mcp.NewTool("get_services",
+		mcp.WithDescription("Retrieve comprehensive information about all services and their endpoints in the currently open Encore. This includes endpoint schemas, documentation, and service-level metadata."),
+		mcp.WithArray("services",
+			mcp.Items(map[string]any{
+				"type":        "string",
+				"description": "Optional list of specific service names to retrieve information for. If not provided, returns information for all services in the currently open Encore.",
+			})),
+		mcp.WithArray("endpoints",
+			mcp.Items(map[string]any{
+				"type":        "string",
+				"description": "Optional list of specific endpoint names to filter by. If not provided, returns all endpoints for the specified services.",
+			})),
+		mcp.WithBoolean("include_schemas", mcp.Description("When true, includes detailed request and response schemas for each endpoint. This is useful for understanding the data structures used by the API.")),
+		mcp.WithBoolean("include_service_details", mcp.Description("When true, includes additional service-level information such as middleware, dependencies, and configuration.")),
+		mcp.WithBoolean("include_endpoints", mcp.Description("When true, includes endpoint information in the response. Set to false to get only service-level information.")),
+	), m.getEndpoints)
+
+	// Add tool for getting middleware metadata
+	m.server.AddTool(mcp.NewTool("get_middleware",
+		mcp.WithDescription("Retrieve detailed information about all middleware components in the currently open Encore, including their configuration, order of execution, and which services/endpoints they affect."),
+	), m.getMiddleware)
+
+	// Add tool for getting auth handler metadata
+	m.server.AddTool(mcp.NewTool("get_auth_handlers",
+		mcp.WithDescription("Retrieve information about all authentication handlers in the currently open Encore, including their configuration, supported authentication methods, and which services/endpoints they protect."),
+	), m.getAuthHandlers)
+}
+
+func (m *Manager) callEndpoint(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	// Extract and validate required arguments
+	serviceStr, ok := request.Params.Arguments["service"].(string)
+	if !ok {
+		return nil, fmt.Errorf("missing or invalid service argument")
+	}
+
+	endpointStr, ok := request.Params.Arguments["endpoint"].(string)
+	if !ok {
+		return nil, fmt.Errorf("missing or invalid endpoint argument")
+	}
+
+	methodStr, ok := request.Params.Arguments["method"].(string)
+	if !ok {
+		return nil, fmt.Errorf("missing or invalid method argument")
+	}
+
+	pathStr, ok := request.Params.Arguments["path"].(string)
+	if !ok {
+		return nil, fmt.Errorf("missing or invalid path argument")
+	}
+
+	// Build API call parameters
+	params := &run.ApiCallParams{
+		AppID:         inst.PlatformOrLocalID(),
+		Service:       serviceStr,
+		Endpoint:      endpointStr,
+		Path:          pathStr,
+		Method:        methodStr,
+		CorrelationID: "",
+	}
+
+	if !strings.HasPrefix(params.Path, "/") {
+		params.Path = "/" + params.Path
+	}
+
+	// Add optional parameters
+	if payload, ok := request.Params.Arguments["payload"].(string); ok && payload != "" {
+		params.Payload = []byte(payload)
+	}
+	if authToken, ok := request.Params.Arguments["auth_token"].(string); ok && authToken != "" {
+		params.AuthToken = authToken
+	}
+	if authPayload, ok := request.Params.Arguments["auth_payload"].(string); ok && authPayload != "" {
+		params.AuthPayload = []byte(authPayload)
+	}
+	if correlationID, ok := request.Params.Arguments["correlation_id"].(string); ok && correlationID != "" {
+		params.CorrelationID = correlationID
+	}
+	ns, err := m.ns.GetActive(ctx, inst)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get active namespace: %w", err)
+	}
+
+	// Get the app's run instance
+	appRun := m.run.FindRunByAppID(inst.PlatformOrLocalID())
+	if appRun == nil {
+		ln, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			return nil, fmt.Errorf("failed to create listener: %w", err)
+		}
+		port := ln.Addr().(*net.TCPAddr).Port
+		appRun, err = m.run.Start(ctx, run.StartParams{
+			App:        inst,
+			NS:         ns,
+			WorkingDir: "/",
+			Watch:      true,
+			Listener:   ln,
+			ListenAddr: "127.0.0.1:" + fmt.Sprint(port),
+			Environ:    os.Environ(),
+			OpsTracker: nil,
+			Browser:    run.BrowserModeNever,
+			Debug:      builder.DebugModeDisabled,
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to start app run: %w", err)
+		}
+	}
+
+	started := false
+	for !started {
+		select {
+		case <-appRun.Done():
+			return nil, fmt.Errorf("app run failed to start")
+		case <-time.After(100 * time.Millisecond):
+			// Check if the app is ready by polling the health endpoint
+			resp, err := http.Get("http://" + appRun.ListenAddr + "/__encore/healthz")
+			if err != nil {
+				continue
+			}
+			resp.Body.Close()
+			started = resp.StatusCode == 200
+		}
+	}
+
+	// Call the API
+	result, err := run.CallAPI(ctx, appRun, params)
+
+	if err != nil {
+		return nil, fmt.Errorf("API call failed: %w", err)
+	}
+
+	// Serialize the response
+	jsonData, err := json.Marshal(result)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal response: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
+
+func (m *Manager) getEndpoints(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	md, err := inst.CachedMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata: %w", err)
+	}
+
+	// Get the list of services to retrieve endpoints for
+	var serviceNames []string
+	if services, ok := request.Params.Arguments["services"].([]interface{}); ok {
+		for _, svc := range services {
+			if svcName, ok := svc.(string); ok && svcName != "" {
+				serviceNames = append(serviceNames, svcName)
+			}
+		}
+	}
+
+	// If no services specified, get all services
+	if len(serviceNames) == 0 {
+		for _, svc := range md.Svcs {
+			serviceNames = append(serviceNames, svc.Name)
+		}
+	}
+
+	// Parse request parameters
+	includeEndpoints := true
+	if include, ok := request.Params.Arguments["include_endpoints"].(bool); ok {
+		includeEndpoints = include
+	}
+
+	var endpointNames []string
+	var endpointFilter map[string]bool
+	var hasEndpointFilter bool
+
+	// Only process endpoint filters if we're including endpoints
+	if includeEndpoints {
+		// Get the list of endpoint names to filter by
+		if endpoints, ok := request.Params.Arguments["endpoints"].([]interface{}); ok {
+			for _, ep := range endpoints {
+				if epName, ok := ep.(string); ok && epName != "" {
+					endpointNames = append(endpointNames, epName)
+				}
+			}
+		}
+		// Create a map for faster lookups when filtering endpoints
+		endpointFilter = make(map[string]bool)
+		for _, name := range endpointNames {
+			endpointFilter[name] = true
+		}
+		hasEndpointFilter = len(endpointFilter) > 0
+	}
+
+	includeSchemas := false
+	if include, ok := request.Params.Arguments["include_schemas"].(bool); ok {
+		includeSchemas = include
+	}
+
+	includeServiceDetails := false
+	if include, ok := request.Params.Arguments["include_service_details"].(bool); ok {
+		includeServiceDetails = include
+	}
+
+	// Set up decl map for schema info if needed
+	var declByID map[uint32]*schema.Decl
+	if includeEndpoints && includeSchemas {
+		declByID = map[uint32]*schema.Decl{}
+		for _, decl := range md.Decls {
+			declByID[decl.Id] = decl
+		}
+	}
+
+	// Create a map to store services with their endpoints
+	serviceMap := make(map[string]map[string]interface{})
+
+	// Process each requested service
+	for _, serviceName := range serviceNames {
+		// Find the service in metadata
+		var targetService *metav1.Service
+		for _, svc := range md.Svcs {
+			if svc.Name == serviceName {
+				targetService = svc
+				break
+			}
+		}
+
+		if targetService == nil {
+			// Skip services that don't exist instead of returning an error
+			continue
+		}
+
+		// Initialize service data
+		serviceData := map[string]interface{}{}
+
+		// Add service details if requested
+		if includeServiceDetails {
+			serviceData["name"] = targetService.Name
+			serviceData["rel_path"] = targetService.RelPath
+			serviceData["has_config"] = targetService.HasConfig
+			serviceData["databases"] = targetService.Databases
+			serviceData["rpc_count"] = len(targetService.Rpcs)
+		}
+
+		// Process endpoints if requested
+		if includeEndpoints {
+			// Initialize an empty array for this service's endpoints
+			endpoints := make([]map[string]interface{}, 0)
+
+			// Process all RPCs for this service
+			for _, rpc := range targetService.Rpcs {
+				// Skip this endpoint if it's not in the filter list (when filter is provided)
+				if hasEndpointFilter && !endpointFilter[rpc.Name] {
+					continue
+				}
+
+				endpoint := map[string]interface{}{
+					"name":         rpc.Name,
+					"access_type":  rpc.AccessType.String(),
+					"http_methods": rpc.HttpMethods,
+				}
+
+				// Add path if available
+				if rpc.Path != nil {
+					pathSegments := make([]string, 0)
+					for _, segment := range rpc.Path.Segments {
+						pathSegments = append(pathSegments, segment.Value)
+					}
+					endpoint["path"] = strings.Join(pathSegments, "/")
+				}
+
+				// Add documentation if available
+				if rpc.Doc != nil {
+					endpoint["doc"] = *rpc.Doc
+				}
+
+				// Include schema information if requested
+				if includeSchemas {
+					schemas := map[string]interface{}{}
+
+					// For request and response schemas
+					if rpc.RequestSchema != nil {
+						str, _ := NamedOrInlineStruct(declByID, rpc.RequestSchema)
+						qry, headers, cookies, body := StructBits(str, rpc.HttpMethods[0], false, false, true)
+						schemas["request_schema"] = strings.Join([]string{"{", qry, headers, cookies, body, "}"}, "")
+					}
+
+					if rpc.ResponseSchema != nil {
+						str, _ := NamedOrInlineStruct(declByID, rpc.ResponseSchema)
+						qry, headers, cookies, body := StructBits(str, rpc.HttpMethods[0], true, false, true)
+						schemas["response_schema"] = strings.Join([]string{"{", qry, headers, cookies, body, "}"}, "")
+					}
+
+					if len(schemas) > 0 {
+						endpoint["schemas"] = schemas
+					}
+				}
+
+				endpoints = append(endpoints, endpoint)
+			}
+
+			// Add endpoints to the service data if any were found
+			if len(endpoints) > 0 {
+				serviceData["endpoints"] = endpoints
+			}
+		}
+
+		// Add service to the result map if it has data or endpoints
+		if len(serviceData) > 0 {
+			serviceMap[serviceName] = serviceData
+		}
+	}
+
+	// Create the result object with services and summary
+	result := map[string]interface{}{
+		"services": serviceMap,
+		"summary": map[string]interface{}{
+			"total_services": len(serviceMap),
+		},
+	}
+
+	// Add endpoint count to summary if we're including endpoints
+	if includeEndpoints {
+		totalEndpoints := 0
+		for _, serviceData := range serviceMap {
+			if endpoints, ok := serviceData["endpoints"].([]map[string]interface{}); ok {
+				totalEndpoints += len(endpoints)
+			}
+		}
+		result["summary"].(map[string]interface{})["total_endpoints"] = totalEndpoints
+	}
+
+	// Add filter information to summary if filters were applied
+	if len(serviceNames) < len(md.Svcs) || (includeEndpoints && hasEndpointFilter) {
+		filters := map[string]interface{}{}
+		if len(serviceNames) < len(md.Svcs) {
+			filters["services"] = serviceNames
+		}
+		if includeEndpoints && hasEndpointFilter {
+			filters["endpoints"] = endpointNames
+		}
+		result["summary"].(map[string]interface{})["filters_applied"] = filters
+	}
+
+	jsonData, err := json.Marshal(result)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal services and endpoints: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
+
+func (m *Manager) getMiddleware(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	md, err := inst.CachedMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata: %w", err)
+	}
+
+	// Find middleware definition locations from trace nodes
+	middlewareDefLocations := make(map[string]map[string]interface{})
+
+	// Scan through all packages to find trace nodes related to middleware
+	for _, pkg := range md.Pkgs {
+		for _, node := range pkg.TraceNodes {
+			// Check for middleware definitions
+			if node.GetMiddlewareDef() != nil {
+				middlewareDef := node.GetMiddlewareDef()
+				middlewareName := middlewareDef.Name
+
+				// Use package path + name as a unique identifier
+				middlewareID := fmt.Sprintf("%s/%s", middlewareDef.PkgRelPath, middlewareName)
+
+				middlewareDefLocations[middlewareID] = map[string]interface{}{
+					"filepath":     node.Filepath,
+					"line_start":   node.SrcLineStart,
+					"line_end":     node.SrcLineEnd,
+					"column_start": node.SrcColStart,
+					"column_end":   node.SrcColEnd,
+					"package_path": middlewareDef.PkgRelPath,
+				}
+			}
+		}
+	}
+
+	// Group middleware by type (global vs service-specific)
+	globalMiddleware := make([]map[string]interface{}, 0)
+	serviceMiddleware := make(map[string][]map[string]interface{})
+
+	// Process all middleware
+	for _, middleware := range md.Middleware {
+		middlewareInfo := map[string]interface{}{
+			"doc":    middleware.Doc,
+			"global": middleware.Global,
+		}
+
+		// Add qualified name information if available
+		if middleware.Name != nil {
+			name := map[string]interface{}{
+				"package": middleware.Name.Pkg,
+				"name":    middleware.Name.Name,
+			}
+			middlewareInfo["name"] = name
+
+			// Add definition location if available
+			middlewareID := fmt.Sprintf("%s/%s", middleware.Name.Pkg, middleware.Name.Name)
+			if location, exists := middlewareDefLocations[middlewareID]; exists {
+				middlewareInfo["definition"] = map[string]interface{}{
+					"filepath":     location["filepath"],
+					"line_start":   location["line_start"],
+					"line_end":     location["line_end"],
+					"column_start": location["column_start"],
+					"column_end":   location["column_end"],
+				}
+			}
+		}
+
+		// Add target information if available
+		if len(middleware.Target) > 0 {
+			targets := make([]map[string]interface{}, 0, len(middleware.Target))
+			for _, target := range middleware.Target {
+				targetInfo := map[string]interface{}{
+					"type":  target.Type.String(),
+					"value": target.Value,
+				}
+				targets = append(targets, targetInfo)
+			}
+			middlewareInfo["targets"] = targets
+		}
+
+		// Add to the appropriate group
+		if middleware.Global {
+			globalMiddleware = append(globalMiddleware, middlewareInfo)
+		} else if middleware.ServiceName != nil {
+			serviceName := *middleware.ServiceName
+			if _, exists := serviceMiddleware[serviceName]; !exists {
+				serviceMiddleware[serviceName] = make([]map[string]interface{}, 0)
+			}
+			serviceMiddleware[serviceName] = append(serviceMiddleware[serviceName], middlewareInfo)
+		}
+	}
+
+	// Build the final result
+	result := map[string]interface{}{
+		"global":   globalMiddleware,
+		"services": serviceMiddleware,
+		"summary": map[string]interface{}{
+			"total_middleware":   len(md.Middleware),
+			"global_middleware":  len(globalMiddleware),
+			"service_middleware": make(map[string]int),
+			"service_count":      len(serviceMiddleware),
+		},
+	}
+
+	// Add counts by service
+	summary := result["summary"].(map[string]interface{})
+	for service, middleware := range serviceMiddleware {
+		summary["service_middleware"].(map[string]int)[service] = len(middleware)
+	}
+
+	// Sort middleware by name for consistent output
+	sort.Slice(globalMiddleware, func(i, j int) bool {
+		nameI := ""
+		nameJ := ""
+		if name, ok := globalMiddleware[i]["name"].(map[string]interface{}); ok {
+			nameI = name["name"].(string)
+		}
+		if name, ok := globalMiddleware[j]["name"].(map[string]interface{}); ok {
+			nameJ = name["name"].(string)
+		}
+		return nameI < nameJ
+	})
+
+	// Sort service middleware as well
+	for service, middleware := range serviceMiddleware {
+		sort.Slice(middleware, func(i, j int) bool {
+			nameI := ""
+			nameJ := ""
+			if name, ok := middleware[i]["name"].(map[string]interface{}); ok {
+				nameI = name["name"].(string)
+			}
+			if name, ok := middleware[j]["name"].(map[string]interface{}); ok {
+				nameJ = name["name"].(string)
+			}
+			return nameI < nameJ
+		})
+		serviceMiddleware[service] = middleware
+	}
+
+	jsonData, err := json.Marshal(result)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal middleware information: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
+
+func (m *Manager) getAuthHandlers(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	md, err := inst.CachedMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata: %w", err)
+	}
+
+	// Find auth handler definition locations from trace nodes
+	authHandlerDefLocations := make(map[string]map[string]interface{})
+
+	// Scan through all packages to find trace nodes related to auth handlers
+	for _, pkg := range md.Pkgs {
+		for _, node := range pkg.TraceNodes {
+			// Check for auth handler definitions
+			if node.GetAuthHandlerDef() != nil {
+				authHandlerDef := node.GetAuthHandlerDef()
+				serviceName := authHandlerDef.ServiceName
+				handlerName := authHandlerDef.Name
+
+				// Use service name + handler name as a unique identifier
+				handlerID := fmt.Sprintf("%s/%s", serviceName, handlerName)
+
+				authHandlerDefLocations[handlerID] = map[string]interface{}{
+					"filepath":     node.Filepath,
+					"line_start":   node.SrcLineStart,
+					"line_end":     node.SrcLineEnd,
+					"column_start": node.SrcColStart,
+					"column_end":   node.SrcColEnd,
+					"service_name": serviceName,
+				}
+			}
+		}
+	}
+
+	// Process the main auth handler if it exists
+	var mainAuthHandler map[string]interface{}
+	if md.AuthHandler != nil {
+		auth := md.AuthHandler
+
+		authData := map[string]interface{}{
+			"name":         auth.Name,
+			"doc":          auth.Doc,
+			"service_name": auth.ServiceName,
+			"pkg_path":     auth.PkgPath,
+			"pkg_name":     auth.PkgName,
+		}
+
+		// Add parameter and auth data type information
+		if auth.Params != nil {
+			paramsData, err := protojson.Marshal(auth.Params)
+			if err == nil {
+				var paramsJson interface{}
+				if err := json.Unmarshal(paramsData, &paramsJson); err == nil {
+					authData["params"] = paramsJson
+				}
+			}
+		}
+
+		if auth.AuthData != nil {
+			authDataTypeData, err := protojson.Marshal(auth.AuthData)
+			if err == nil {
+				var authDataJson interface{}
+				if err := json.Unmarshal(authDataTypeData, &authDataJson); err == nil {
+					authData["auth_data"] = authDataJson
+				}
+			}
+		}
+
+		// Add location information if available
+		handlerID := fmt.Sprintf("%s/%s", auth.ServiceName, auth.Name)
+		if location, exists := authHandlerDefLocations[handlerID]; exists {
+			authData["definition"] = map[string]interface{}{
+				"filepath":     location["filepath"],
+				"line_start":   location["line_start"],
+				"line_end":     location["line_end"],
+				"column_start": location["column_start"],
+				"column_end":   location["column_end"],
+			}
+		}
+
+		mainAuthHandler = authData
+	}
+
+	// Process gateway auth handlers
+	gatewayAuthHandlers := make(map[string]map[string]interface{})
+
+	for _, gateway := range md.Gateways {
+		if gateway.Explicit != nil && gateway.Explicit.AuthHandler != nil {
+			auth := gateway.Explicit.AuthHandler
+
+			authData := map[string]interface{}{
+				"name":         auth.Name,
+				"doc":          auth.Doc,
+				"service_name": auth.ServiceName,
+				"pkg_path":     auth.PkgPath,
+				"pkg_name":     auth.PkgName,
+				"gateway_name": gateway.EncoreName,
+			}
+
+			// Add parameter and auth data type information
+			if auth.Params != nil {
+				paramsData, err := protojson.Marshal(auth.Params)
+				if err == nil {
+					var paramsJson interface{}
+					if err := json.Unmarshal(paramsData, &paramsJson); err == nil {
+						authData["params"] = paramsJson
+					}
+				}
+			}
+
+			if auth.AuthData != nil {
+				authDataTypeData, err := protojson.Marshal(auth.AuthData)
+				if err == nil {
+					var authDataJson interface{}
+					if err := json.Unmarshal(authDataTypeData, &authDataJson); err == nil {
+						authData["auth_data"] = authDataJson
+					}
+				}
+			}
+
+			// Add location information if available
+			handlerID := fmt.Sprintf("%s/%s", auth.ServiceName, auth.Name)
+			if location, exists := authHandlerDefLocations[handlerID]; exists {
+				authData["definition"] = map[string]interface{}{
+					"filepath":     location["filepath"],
+					"line_start":   location["line_start"],
+					"line_end":     location["line_end"],
+					"column_start": location["column_start"],
+					"column_end":   location["column_end"],
+				}
+			}
+
+			gatewayAuthHandlers[gateway.EncoreName] = authData
+		}
+	}
+
+	// Build the final result
+	result := map[string]interface{}{
+		"main_auth_handler":     mainAuthHandler,
+		"gateway_auth_handlers": gatewayAuthHandlers,
+		"summary": map[string]interface{}{
+			"has_main_auth":      mainAuthHandler != nil,
+			"gateway_count":      len(md.Gateways),
+			"auth_gateway_count": len(gatewayAuthHandlers),
+		},
+	}
+
+	jsonData, err := json.Marshal(result)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal auth handler information: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
diff --git a/cli/daemon/mcp/bucket_tools.go b/cli/daemon/mcp/bucket_tools.go
new file mode 100644
index 0000000000..d75e12dd97
--- /dev/null
+++ b/cli/daemon/mcp/bucket_tools.go
@@ -0,0 +1,154 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"encr.dev/pkg/emulators/storage/gcsemu"
+)
+
+func (m *Manager) registerBucketTools() {
+	m.server.AddTool(mcp.NewTool("get_storage_buckets",
+		mcp.WithDescription("Retrieve comprehensive information about all storage buckets in the currently open Encore, including their configurations, access patterns, and the services that interact with them. This tool helps understand the application's storage architecture and data management strategy."),
+	), m.getStorageBuckets)
+
+	m.server.AddTool(mcp.NewTool("get_objects",
+		mcp.WithDescription("List and retrieve metadata about objects stored in one or more storage buckets. This tool helps inspect the contents of storage buckets and understand the data stored in them."),
+		mcp.WithArray("buckets",
+			mcp.Items(map[string]any{
+				"type":        "string",
+				"description": "List of bucket names to list objects from. Each bucket must be defined in the currently open Encore's storage configuration.",
+			})),
+	), m.listObjects)
+}
+
+func (m *Manager) listObjects(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	app, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+	clusterNS, err := m.ns.GetActive(ctx, app)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get active namespace: %w", err)
+	}
+	dir, err := m.objects.BaseDir(clusterNS.ID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get base directory: %w", err)
+	}
+	store := gcsemu.NewFileStore(dir)
+	buckets, ok := request.Params.Arguments["buckets"].([]any)
+	if !ok {
+		return nil, fmt.Errorf("buckets is not an array")
+	}
+	objects := map[string][]map[string]interface{}{}
+	for _, bucket := range buckets {
+		bucketName := bucket.(string)
+		var bucketObjects []map[string]interface{}
+		err = store.Walk(ctx, bucketName, func(ctx context.Context, filename string, fInfo os.FileInfo) error {
+			objectInfo := map[string]interface{}{
+				"name":          filename,
+				"size":          fInfo.Size(),
+				"last_modified": fInfo.ModTime(),
+				"is_directory":  fInfo.IsDir(),
+			}
+			bucketObjects = append(bucketObjects, objectInfo)
+			return nil
+		})
+		if err != nil {
+			return nil, fmt.Errorf("failed to walk bucket objects: %w", err)
+		}
+		objects[bucketName] = bucketObjects
+	}
+	jsonData, err := json.Marshal(objects)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal object information: %w", err)
+	}
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
+
+func (m *Manager) getStorageBuckets(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	md, err := inst.CachedMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata: %w", err)
+	}
+
+	// Build map of services that use each bucket with their operations
+	bucketUsageByService := make(map[string][]map[string]interface{})
+
+	for _, svc := range md.Svcs {
+		for _, bucketUsage := range svc.Buckets {
+			bucketName := bucketUsage.Bucket
+
+			// Convert operations to strings
+			operations := make([]string, 0, len(bucketUsage.Operations))
+			for _, op := range bucketUsage.Operations {
+				operations = append(operations, op.String())
+			}
+
+			// Create usage info
+			usageInfo := map[string]interface{}{
+				"service_name": svc.Name,
+				"operations":   operations,
+			}
+
+			// Add to map
+			if _, exists := bucketUsageByService[bucketName]; !exists {
+				bucketUsageByService[bucketName] = make([]map[string]interface{}, 0)
+			}
+			bucketUsageByService[bucketName] = append(bucketUsageByService[bucketName], usageInfo)
+		}
+	}
+
+	// Collect bucket definition locations from trace nodes
+	bucketDefLocations := make(map[string]map[string]interface{})
+
+	// Find bucket definitions in trace nodes if possible
+	// Currently no specific bucket definition node type in the TraceNode,
+	// so we leave this empty for now. This could be expanded in the future
+	// if the metadata provides better tracking.
+
+	// Process all buckets
+	buckets := make([]map[string]interface{}, 0)
+	for _, bucket := range md.Buckets {
+		bucketInfo := map[string]interface{}{
+			"name":      bucket.Name,
+			"versioned": bucket.Versioned,
+			"public":    bucket.Public,
+		}
+
+		// Add documentation if available
+		if bucket.Doc != nil {
+			bucketInfo["doc"] = *bucket.Doc
+		}
+
+		// Add location information if available
+		if location, exists := bucketDefLocations[bucket.Name]; exists {
+			bucketInfo["definition"] = location
+		}
+
+		// Add service usage information
+		if usages, exists := bucketUsageByService[bucket.Name]; exists {
+			bucketInfo["service_usage"] = usages
+		} else {
+			bucketInfo["service_usage"] = []map[string]interface{}{}
+		}
+
+		buckets = append(buckets, bucketInfo)
+	}
+
+	jsonData, err := json.Marshal(buckets)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal storage buckets information: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
diff --git a/cli/daemon/mcp/cache_tools.go b/cli/daemon/mcp/cache_tools.go
new file mode 100644
index 0000000000..dfa7a18de9
--- /dev/null
+++ b/cli/daemon/mcp/cache_tools.go
@@ -0,0 +1,152 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sort"
+	"strings"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"google.golang.org/protobuf/encoding/protojson"
+)
+
+func (m *Manager) registerCacheTools() {
+	m.server.AddTool(mcp.NewTool("get_cache_keyspaces",
+		mcp.WithDescription("Retrieve comprehensive information about all cache keyspaces in the currently open Encore, including their configurations, usage patterns, and the services that interact with them. This tool helps understand the application's caching strategy and data access patterns."),
+	), m.getCacheKeyspaces)
+}
+
+func (m *Manager) getCacheKeyspaces(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	md, err := inst.CachedMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata: %w", err)
+	}
+
+	// Find keyspace definition locations from trace nodes
+	keyspaceDefLocations := make(map[string]map[string]map[string]interface{})
+
+	// Scan through all packages to find trace nodes related to cache keyspaces
+	for _, pkg := range md.Pkgs {
+		for _, node := range pkg.TraceNodes {
+			// Check for cache keyspace definitions
+			if node.GetCacheKeyspace() != nil {
+				keyspaceDef := node.GetCacheKeyspace()
+				clusterName := keyspaceDef.ClusterName
+				keyspaceName := keyspaceDef.VarName
+
+				// Initialize maps if needed
+				if _, exists := keyspaceDefLocations[clusterName]; !exists {
+					keyspaceDefLocations[clusterName] = make(map[string]map[string]interface{})
+				}
+
+				if _, exists := keyspaceDefLocations[clusterName][keyspaceName]; !exists {
+					keyspaceDefLocations[clusterName][keyspaceName] = map[string]interface{}{
+						"filepath":     node.Filepath,
+						"line_start":   node.SrcLineStart,
+						"line_end":     node.SrcLineEnd,
+						"column_start": node.SrcColStart,
+						"column_end":   node.SrcColEnd,
+						"package_path": keyspaceDef.PkgRelPath,
+					}
+				}
+			}
+		}
+	}
+
+	// Build the result
+	result := make([]map[string]interface{}, 0)
+
+	// Process all cache clusters
+	for _, cluster := range md.CacheClusters {
+		clusterInfo := map[string]interface{}{
+			"name":            cluster.Name,
+			"eviction_policy": cluster.EvictionPolicy,
+			"doc":             cluster.Doc,
+		}
+
+		// Process keyspaces for this cluster
+		keyspaces := make([]map[string]interface{}, 0)
+		for _, keyspace := range cluster.Keyspaces {
+			keyspaceInfo := map[string]interface{}{
+				"service": keyspace.Service,
+				"doc":     keyspace.Doc,
+			}
+
+			// Add key and value type information from protojson
+			if keyspace.KeyType != nil {
+				keyTypeData, err := protojson.Marshal(keyspace.KeyType)
+				if err == nil {
+					var keyTypeJson interface{}
+					if err := json.Unmarshal(keyTypeData, &keyTypeJson); err == nil {
+						keyspaceInfo["key_type"] = keyTypeJson
+					}
+				}
+			}
+
+			if keyspace.ValueType != nil {
+				valueTypeData, err := protojson.Marshal(keyspace.ValueType)
+				if err == nil {
+					var valueTypeJson interface{}
+					if err := json.Unmarshal(valueTypeData, &valueTypeJson); err == nil {
+						keyspaceInfo["value_type"] = valueTypeJson
+					}
+				}
+			}
+
+			// Add path pattern if available
+			if keyspace.PathPattern != nil {
+				pathPattern := make([]string, 0)
+				for _, segment := range keyspace.PathPattern.Segments {
+					pathPattern = append(pathPattern, segment.Value)
+				}
+				keyspaceInfo["path_pattern"] = strings.Join(pathPattern, "/")
+			}
+
+			// Add definition location if available
+			// We need to find the keyspace variable name from the definition data
+			// This is approximate as we don't have a direct mapping in the metadata
+			if locations, ok := keyspaceDefLocations[cluster.Name]; ok {
+				for keyspaceName, location := range locations {
+					// Try to match by service
+					if location["package_path"] != "" && keyspace.Service != "" {
+						// If this location is for a keyspace in this service, add it
+						if packageService := findServiceNameForPackage(md, location["package_path"].(string)); packageService == keyspace.Service {
+							keyspaceInfo["name"] = keyspaceName
+							keyspaceInfo["definition"] = map[string]interface{}{
+								"filepath":     location["filepath"],
+								"line_start":   location["line_start"],
+								"line_end":     location["line_end"],
+								"column_start": location["column_start"],
+								"column_end":   location["column_end"],
+							}
+							break
+						}
+					}
+				}
+			}
+
+			keyspaces = append(keyspaces, keyspaceInfo)
+		}
+
+		clusterInfo["keyspaces"] = keyspaces
+		result = append(result, clusterInfo)
+	}
+
+	// Sort by cluster name for consistent output
+	sort.Slice(result, func(i, j int) bool {
+		return result[i]["name"].(string) < result[j]["name"].(string)
+	})
+
+	jsonData, err := json.Marshal(result)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal cache keyspaces information: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
diff --git a/cli/daemon/mcp/cron_tools.go b/cli/daemon/mcp/cron_tools.go
new file mode 100644
index 0000000000..de926803ba
--- /dev/null
+++ b/cli/daemon/mcp/cron_tools.go
@@ -0,0 +1,109 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/mark3labs/mcp-go/mcp"
+)
+
+func (m *Manager) registerCronTools() {
+	m.server.AddTool(mcp.NewTool("get_cronjobs",
+		mcp.WithDescription("Retrieve detailed information about all scheduled cron jobs in the currently open Encore, including their schedules, endpoints they trigger, and execution history. This tool helps understand the application's background task scheduling and automation capabilities."),
+	), m.getCronJobs)
+}
+
+func (m *Manager) getCronJobs(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	md, err := inst.CachedMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata: %w", err)
+	}
+
+	// Create a map to find service and endpoint locations
+	endpointLocations := make(map[string]map[string]map[string]interface{})
+
+	// Scan through all packages to find trace nodes related to RPC definitions
+	for _, pkg := range md.Pkgs {
+		for _, node := range pkg.TraceNodes {
+			// Check for RPC definitions
+			if node.GetRpcDef() != nil {
+				rpcDef := node.GetRpcDef()
+				serviceName := rpcDef.ServiceName
+				rpcName := rpcDef.RpcName
+
+				// Initialize maps if needed
+				if _, exists := endpointLocations[serviceName]; !exists {
+					endpointLocations[serviceName] = make(map[string]map[string]interface{})
+				}
+
+				if _, exists := endpointLocations[serviceName][rpcName]; !exists {
+					endpointLocations[serviceName][rpcName] = map[string]interface{}{
+						"filepath":     node.Filepath,
+						"line_start":   node.SrcLineStart,
+						"line_end":     node.SrcLineEnd,
+						"column_start": node.SrcColStart,
+						"column_end":   node.SrcColEnd,
+					}
+				}
+			}
+		}
+	}
+
+	// Process cron jobs with location information
+	cronjobs := make([]map[string]interface{}, 0)
+	for _, job := range md.CronJobs {
+		jobInfo := map[string]interface{}{
+			"id":       job.Id,
+			"title":    job.Title,
+			"schedule": job.Schedule,
+		}
+
+		// Add documentation if available
+		if job.Doc != nil {
+			jobInfo["doc"] = *job.Doc
+		}
+
+		// Add endpoint information
+		if job.Endpoint != nil {
+			endpoint := map[string]interface{}{
+				"package": job.Endpoint.Pkg,
+				"name":    job.Endpoint.Name,
+			}
+
+			// If we can find the service for this endpoint, add location info
+			for _, svc := range md.Svcs {
+				for _, rpc := range svc.Rpcs {
+					if rpc.Name == job.Endpoint.Name && (svc.RelPath == job.Endpoint.Pkg || svc.Name == findServiceNameForPackage(md, job.Endpoint.Pkg)) {
+						endpoint["service_name"] = svc.Name
+
+						// Add location if we found it
+						if locations, ok := endpointLocations[svc.Name]; ok {
+							if loc, ok := locations[rpc.Name]; ok {
+								endpoint["definition"] = loc
+							}
+						}
+
+						break
+					}
+				}
+			}
+
+			jobInfo["endpoint"] = endpoint
+		}
+
+		cronjobs = append(cronjobs, jobInfo)
+	}
+
+	jsonData, err := json.Marshal(cronjobs)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal cron jobs information: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
diff --git a/cli/daemon/mcp/db_tools.go b/cli/daemon/mcp/db_tools.go
new file mode 100644
index 0000000000..f9247ae516
--- /dev/null
+++ b/cli/daemon/mcp/db_tools.go
@@ -0,0 +1,310 @@
+package mcp
+
+import (
+	"context"
+	"database/sql"
+	"encoding/json"
+	"errors"
+	"fmt"
+
+	"github.com/lib/pq"
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"encr.dev/cli/daemon/sqldb"
+	"encr.dev/pkg/fns"
+)
+
+func (m *Manager) registerDatabaseTools() {
+	// Add tool for getting all databases and optionally their tables
+	m.server.AddTool(mcp.NewTool("get_databases",
+		mcp.WithDescription("Retrieve metadata about all SQL databases defined in the currently open Encore, including their schema, tables, and relationships. This tool helps understand the database structure and can optionally include detailed table information."),
+		mcp.WithBoolean("include_tables", mcp.Description("When true, includes detailed information about each table in the database, including column names, types, and constraints. This is useful for understanding the complete database schema.")),
+		mcp.WithArray("databases",
+			mcp.Items(map[string]any{
+				"type":        "string",
+				"description": "Optional list of specific database names to retrieve information for. If not provided, returns information for all databases in the currently open Encore.",
+			})),
+	), m.getDatabases)
+
+	// Add tool for querying a database
+	m.server.AddTool(mcp.NewTool("query_database",
+		mcp.WithDescription("Execute SQL queries against one or more databases in the currently open Encore. This tool allows running custom SQL queries to inspect or manipulate data while respecting the application's database access patterns."),
+		mcp.WithArray("queries",
+			mcp.Items(map[string]any{
+				"type":        "object",
+				"description": "Array of query objects, where each object must contain 'database' (the database name to query) and 'query' (the SQL query to execute) fields. Multiple queries can be executed in a single call.",
+				"properties": map[string]any{
+					"database": map[string]any{
+						"type":        "string",
+						"description": "The database name to query",
+					},
+					"query": map[string]any{
+						"type":        "string",
+						"description": "The SQL query to execute",
+					},
+				},
+				"required": []string{"database", "query"},
+			})),
+	), m.runQuery)
+}
+
+func (m *Manager) getDatabases(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	md, err := inst.CachedMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata: %w", err)
+	}
+
+	includeTables := false
+	if includeTablesParam, ok := request.Params.Arguments["include_tables"]; ok {
+		includeTables, _ = includeTablesParam.(bool)
+	}
+
+	// Parse databases parameter if provided
+	var filterDBs map[string]bool
+	if dbsParam, ok := request.Params.Arguments["databases"]; ok && dbsParam != nil {
+		dbsArray, ok := dbsParam.([]interface{})
+		if ok && len(dbsArray) > 0 {
+			filterDBs = make(map[string]bool)
+			for _, db := range dbsArray {
+				if dbName, ok := db.(string); ok {
+					filterDBs[dbName] = true
+				}
+			}
+		}
+	}
+
+	// Build database list
+	databases := make([]map[string]interface{}, 0)
+	for _, db := range md.SqlDatabases {
+		// Skip if we have a filter and this database isn't in it
+		if filterDBs != nil && !filterDBs[db.Name] {
+			continue
+		}
+
+		dbInfo := map[string]interface{}{
+			"name": db.Name,
+			"doc":  db.Doc,
+		}
+
+		// If we should include tables, get table information
+		if includeTables {
+			tables, err := m.getTablesForDatabase(ctx, db.Name)
+			if err != nil {
+				// Don't fail the whole request if one database fails
+				dbInfo["tables_error"] = err.Error()
+			} else {
+				dbInfo["tables"] = tables
+			}
+		}
+
+		databases = append(databases, dbInfo)
+	}
+
+	jsonData, err := json.Marshal(databases)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal database list: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
+
+func (m *Manager) getTablesForDatabase(ctx context.Context, dbName string) ([]map[string]interface{}, error) {
+	var tables []map[string]interface{}
+
+	err := m.withConn(ctx, dbName, func(db *sql.DB) error {
+		// Query to get tables and their columns from PostgreSQL
+		query := `
+			SELECT 
+				t.table_name,
+				ARRAY_AGG(c.column_name ORDER BY c.ordinal_position) as columns,
+				ARRAY_AGG(c.data_type ORDER BY c.ordinal_position) as column_types
+			FROM 
+				information_schema.tables t
+			JOIN 
+				information_schema.columns c ON t.table_name = c.table_name AND t.table_schema = c.table_schema
+			WHERE 
+				t.table_schema = 'public'
+			GROUP BY 
+				t.table_name
+			ORDER BY 
+				t.table_name;
+		`
+
+		rows, err := db.QueryContext(ctx, query)
+		if err != nil {
+			return fmt.Errorf("failed to query tables: %w", err)
+		}
+		defer rows.Close()
+
+		tables = []map[string]interface{}{}
+
+		for rows.Next() {
+			var tableName string
+			var columns pq.StringArray
+			var columnTypes pq.StringArray
+
+			if err := rows.Scan(&tableName, &columns, &columnTypes); err != nil {
+				return fmt.Errorf("failed to scan row: %w", err)
+			}
+
+			// Create structured column information
+			columnInfo := make([]map[string]string, len(columns))
+			for i := range columns {
+				columnInfo[i] = map[string]string{
+					"name": columns[i],
+					"type": columnTypes[i],
+				}
+			}
+
+			tables = append(tables, map[string]interface{}{
+				"table_name": tableName,
+				"columns":    columnInfo,
+			})
+		}
+
+		if err := rows.Err(); err != nil {
+			return fmt.Errorf("error iterating rows: %w", err)
+		}
+
+		return nil
+	})
+
+	return tables, err
+}
+
+func (m *Manager) withConn(ctx context.Context, dbName string, fn func(db *sql.DB) error) error {
+	app, err := m.getApp(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to get app: %w", err)
+	}
+	clusterNS, err := m.ns.GetActive(ctx, app)
+	if err != nil {
+		return fmt.Errorf("failed to get active namespace: %w", err)
+	}
+	md, err := app.CachedMetadata()
+	if err != nil {
+		return fmt.Errorf("failed to get metadata: %w", err)
+	}
+
+	clusterID := sqldb.GetClusterID(app, sqldb.Run, clusterNS)
+	cluster := m.cluster.Create(ctx, &sqldb.CreateParams{
+		ClusterID: clusterID,
+		Memfs:     sqldb.Run.Memfs(),
+	})
+	if _, err := cluster.Start(ctx, nil); err != nil {
+		return err
+	} else if err := cluster.Setup(ctx, app.Root(), md); err != nil {
+		return err
+	}
+
+	info, err := cluster.Info(ctx)
+	if err != nil {
+		return fmt.Errorf("failed to get cluster info: %w", err)
+	} else if info.Status != sqldb.Running {
+		return errors.New("cluster not running")
+	}
+
+	admin, ok := info.Encore.First(sqldb.RoleRead)
+	if !ok {
+		return errors.New("unable to find superuser or admin roles")
+	}
+
+	uri := info.ConnURI(dbName, admin)
+
+	pool, err := sql.Open("pgx", uri)
+	if err != nil {
+		return err
+	}
+	defer fns.CloseIgnore(pool)
+
+	return fn(pool)
+}
+
+func (m *Manager) runQuery(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	queriesParam, ok := request.Params.Arguments["queries"].([]interface{})
+	if !ok || len(queriesParam) == 0 {
+		return nil, fmt.Errorf("missing or invalid 'queries' parameter")
+	}
+
+	results := make(map[string][]map[string]interface{})
+
+	for _, queryObj := range queriesParam {
+		queryMap, ok := queryObj.(map[string]interface{})
+		if !ok {
+			continue
+		}
+
+		dbName, ok := queryMap["database"].(string)
+		if !ok || dbName == "" {
+			continue
+		}
+
+		sqlQuery, ok := queryMap["query"].(string)
+		if !ok || sqlQuery == "" {
+			continue
+		}
+
+		// Execute the query for this database
+		var queryResults []map[string]interface{}
+		err := m.withConn(ctx, dbName, func(db *sql.DB) error {
+			rows, err := db.QueryContext(ctx, sqlQuery)
+			if err != nil {
+				return fmt.Errorf("failed to execute query: %w", err)
+			}
+			defer rows.Close()
+
+			// Serialize rows to JSON
+			columns, err := rows.Columns()
+			if err != nil {
+				return fmt.Errorf("failed to get columns: %w", err)
+			}
+
+			queryResults = make([]map[string]interface{}, 0)
+			for rows.Next() {
+				values := make([]interface{}, len(columns))
+				valuePtrs := make([]interface{}, len(columns))
+				for i := range values {
+					valuePtrs[i] = &values[i]
+				}
+
+				if err := rows.Scan(valuePtrs...); err != nil {
+					return fmt.Errorf("failed to scan row: %w", err)
+				}
+
+				row := make(map[string]interface{})
+				for i, col := range columns {
+					row[col] = values[i]
+				}
+				queryResults = append(queryResults, row)
+			}
+
+			if err := rows.Err(); err != nil {
+				return fmt.Errorf("error iterating rows: %w", err)
+			}
+
+			return nil
+		})
+
+		// Store results for this query
+		key := fmt.Sprintf("%s: %s", dbName, sqlQuery)
+		if err != nil {
+			results[key] = []map[string]interface{}{
+				{"error": err.Error()},
+			}
+		} else {
+			results[key] = queryResults
+		}
+	}
+
+	jsonData, err := json.Marshal(results)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal results: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
diff --git a/cli/daemon/mcp/docs_tools.go b/cli/daemon/mcp/docs_tools.go
new file mode 100644
index 0000000000..857a90ebb6
--- /dev/null
+++ b/cli/daemon/mcp/docs_tools.go
@@ -0,0 +1,320 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/algolia/algoliasearch-client-go/v3/algolia/opt"
+	"github.com/algolia/algoliasearch-client-go/v3/algolia/search"
+	"github.com/mark3labs/mcp-go/mcp"
+	"golang.org/x/net/html"
+)
+
+func (m *Manager) registerDocsTools() {
+	// Add tool for searching Encore documentation using Algolia
+	m.server.AddTool(mcp.NewTool("search_docs",
+		mcp.WithDescription("Search the Encore documentation using Algolia's search engine. This tool helps find relevant documentation about Encore features, best practices, and examples."),
+		mcp.WithString("query", mcp.Description("The search query to find relevant documentation. Can include keywords, feature names, or specific topics you're looking for.")),
+		mcp.WithNumber("page", mcp.Description("Page number for pagination, starting from 0. Use this to navigate through large result sets.")),
+		mcp.WithNumber("hits_per_page", mcp.Description("Number of results to return per page. Default is 10. Adjust this to control the size of the result set.")),
+		mcp.WithArray("facet_filters",
+			mcp.Items(map[string]any{
+				"type":        "string",
+				"description": "Optional array of facet filters to narrow down search results. These can include categories, tags, or other metadata to refine the search.",
+			})),
+	), m.searchDocs)
+
+	// Add tool for fetching Encore documentation content
+	m.server.AddTool(mcp.NewTool("get_docs",
+		mcp.WithDescription("Retrieve the full content of specific documentation pages. This tool is useful for getting detailed information about specific topics after finding them with search_docs."),
+		mcp.WithArray("paths",
+			mcp.Items(map[string]any{
+				"type":        "string",
+				"description": "List of documentation paths to fetch (e.g. ['/docs/concepts', '/docs/services']). These paths should be valid documentation URLs without the domain.",
+			})),
+	), m.getDocs)
+}
+
+func (m *Manager) searchDocs(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	// Extract parameters from the request
+	query, ok := request.Params.Arguments["query"].(string)
+	if !ok || query == "" {
+		return nil, fmt.Errorf("invalid or missing query parameter")
+	}
+
+	// Default pagination settings
+	page := 0
+	if p, ok := request.Params.Arguments["page"].(float64); ok {
+		page = int(p)
+	}
+
+	hitsPerPage := 10
+	if hpp, ok := request.Params.Arguments["hits_per_page"].(float64); ok {
+		hitsPerPage = int(hpp)
+	}
+
+	// Process facet filters if provided
+	var facetFilters []string
+	if filters, ok := request.Params.Arguments["facet_filters"].([]interface{}); ok {
+		for _, filter := range filters {
+			if filterStr, ok := filter.(string); ok && filterStr != "" {
+				facetFilters = append(facetFilters, filterStr)
+			}
+		}
+	}
+
+	// Set context timeout
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+
+	// Perform the actual search with Algolia
+	result, err := performAlgoliaSearch(ctx, query, page, hitsPerPage, facetFilters)
+	if err != nil {
+		return nil, fmt.Errorf("failed to search docs: %w", err)
+	}
+
+	// Marshal the response
+	jsonData, err := json.Marshal(result)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal search results: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
+
+// performAlgoliaSearch performs the actual search against Algolia
+func performAlgoliaSearch(ctx context.Context, query string, page, hitsPerPage int, facetFilters []string) (map[string]interface{}, error) {
+	// Initialize Algolia client with configurable app ID and API key
+	// In a production environment, these should be loaded from configuration
+	appID := "R7DAHI8GEL"
+	apiKey := "85bf0533142cccdbbc6b9deb92b19fdf"
+
+	client := search.NewClient(appID, apiKey)
+	index := client.InitIndex("encore_docs")
+
+	// Build search parameters
+	params := []interface{}{
+		opt.Page(page),
+		opt.HitsPerPage(hitsPerPage),
+	}
+
+	// Add facet filters if any
+	if len(facetFilters) > 0 {
+		// For a simple AND of all filters - need to convert []string to variadic arguments
+		if len(facetFilters) == 1 {
+			params = append(params, opt.FacetFilter(facetFilters[0]))
+		} else {
+			// Convert []string to []interface{} for compatibility
+			facetFilterInterfaces := make([]interface{}, len(facetFilters))
+			for i, filter := range facetFilters {
+				facetFilterInterfaces[i] = filter
+			}
+			params = append(params, opt.FacetFilterAnd(facetFilterInterfaces...))
+		}
+	}
+
+	// Perform the search
+	res, err := index.Search(query, params...)
+	if err != nil {
+		return nil, fmt.Errorf("algolia search failed: %w", err)
+	}
+
+	// Convert the Algolia response to our expected format
+	result := map[string]interface{}{
+		"hits":             res.Hits,
+		"page":             res.Page,
+		"nbHits":           res.NbHits,
+		"nbPages":          res.NbPages,
+		"hitsPerPage":      res.HitsPerPage,
+		"processingTimeMS": res.ProcessingTimeMS,
+		"query":            query,
+		"params":           res.Params,
+	}
+
+	return result, nil
+}
+
+func (m *Manager) getDocs(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	// Extract paths parameter from the request
+	var docPaths []string
+	if paths, ok := request.Params.Arguments["paths"].([]interface{}); ok {
+		for _, path := range paths {
+			if pathStr, ok := path.(string); ok && pathStr != "" {
+				docPaths = append(docPaths, pathStr)
+			}
+		}
+	}
+
+	if len(docPaths) == 0 {
+		return nil, fmt.Errorf("no valid documentation paths provided")
+	}
+
+	// Set context timeout
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
+	// Fetch content for each path
+	result := make(map[string]interface{})
+	docs := make(map[string]interface{})
+
+	for _, path := range docPaths {
+		// Ensure path starts with a slash
+		if !strings.HasPrefix(path, "/") {
+			path = "/" + path
+		}
+
+		url := "https://encore.dev" + path
+		content, err := fetchDocContent(ctx, url)
+		if err != nil {
+			docs[path] = map[string]interface{}{
+				"error":   err.Error(),
+				"success": false,
+			}
+		} else {
+			docs[path] = map[string]interface{}{
+				"content": content,
+				"url":     url,
+				"success": true,
+			}
+		}
+	}
+
+	result["docs"] = docs
+	result["summary"] = map[string]interface{}{
+		"total":        len(docPaths),
+		"base_url":     "https://encore.dev",
+		"requested_at": time.Now().UTC().Format(time.RFC3339),
+	}
+
+	// Marshal the response
+	jsonData, err := json.Marshal(result)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal document results: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
+
+// fetchDocContent fetches content from a URL and returns only the text content from the <main> tag
+func fetchDocContent(ctx context.Context, url string) (string, error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return "", fmt.Errorf("failed to create request: %w", err)
+	}
+
+	// Add appropriate headers to mimic a browser request
+	req.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36")
+	req.Header.Set("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8")
+
+	client := &http.Client{
+		Timeout: 10 * time.Second,
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("failed to fetch URL: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("received non-OK status code: %d", resp.StatusCode)
+	}
+
+	// Parse the HTML document
+	doc, err := html.Parse(resp.Body)
+	if err != nil {
+		return "", fmt.Errorf("failed to parse HTML: %w", err)
+	}
+
+	// Find the main tag
+	mainNode := findMainElement(doc)
+	if mainNode == nil {
+		return "", fmt.Errorf("no <main> tag found in the document")
+	}
+
+	// Extract text content from the main tag
+	var textContent strings.Builder
+	extractText(mainNode, &textContent)
+
+	// Clean up the text content
+	cleanedText := cleanText(textContent.String())
+
+	return cleanedText, nil
+}
+
+// findMainElement finds the <main> element in the HTML document
+func findMainElement(n *html.Node) *html.Node {
+	if n.Type == html.ElementNode && strings.ToLower(n.Data) == "main" {
+		return n
+	}
+
+	for c := n.FirstChild; c != nil; c = c.NextSibling {
+		if result := findMainElement(c); result != nil {
+			return result
+		}
+	}
+
+	return nil
+}
+
+// extractText recursively extracts text nodes from an HTML node
+func extractText(n *html.Node, sb *strings.Builder) {
+	// Skip script, style, and non-visible elements
+	if n.Type == html.ElementNode {
+		nodeName := strings.ToLower(n.Data)
+		if nodeName == "script" || nodeName == "style" || nodeName == "noscript" ||
+			nodeName == "meta" || nodeName == "link" || nodeName == "iframe" {
+			return
+		}
+	}
+
+	// Process text nodes
+	if n.Type == html.TextNode {
+		text := strings.TrimSpace(n.Data)
+		if text != "" {
+			sb.WriteString(text)
+			sb.WriteString(" ")
+		}
+	}
+
+	// Recursively process all child nodes
+	for c := n.FirstChild; c != nil; c = c.NextSibling {
+		extractText(c, sb)
+	}
+
+	// Add line breaks for certain block elements
+	if n.Type == html.ElementNode {
+		nodeName := strings.ToLower(n.Data)
+		if nodeName == "p" || nodeName == "div" || nodeName == "h1" ||
+			nodeName == "h2" || nodeName == "h3" || nodeName == "h4" ||
+			nodeName == "h5" || nodeName == "h6" || nodeName == "li" ||
+			nodeName == "br" || nodeName == "tr" {
+			sb.WriteString("\n")
+		}
+
+		// Add extra line break for more significant sections
+		if nodeName == "section" || nodeName == "article" ||
+			nodeName == "header" || nodeName == "footer" {
+			sb.WriteString("\n\n")
+		}
+	}
+}
+
+// cleanText removes excessive whitespace and normalizes line breaks
+func cleanText(text string) string {
+	// Replace multiple spaces with a single space
+	text = regexp.MustCompile(`\s+`).ReplaceAllString(text, " ")
+
+	// Replace multiple newlines with a maximum of two
+	text = regexp.MustCompile(`\n{3,}`).ReplaceAllString(text, "\n\n")
+
+	// Trim leading/trailing whitespace
+	text = strings.TrimSpace(text)
+
+	return text
+}
diff --git a/cli/daemon/mcp/mcp.go b/cli/daemon/mcp/mcp.go
new file mode 100644
index 0000000000..b9cb3fc346
--- /dev/null
+++ b/cli/daemon/mcp/mcp.go
@@ -0,0 +1,112 @@
+package mcp
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+
+	"github.com/mark3labs/mcp-go/server"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/engine/trace2"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/objects"
+	"encr.dev/cli/daemon/run"
+	"encr.dev/cli/daemon/sqldb"
+)
+
+type Manager struct {
+	server  *server.MCPServer
+	sse     *server.SSEServer
+	cluster *sqldb.ClusterManager
+	ns      *namespace.Manager
+	traces  trace2.Store
+	run     *run.Manager
+	objects *objects.ClusterManager
+	apps    *apps.Manager
+
+	BaseURL string
+}
+
+type appContextKey struct{}
+
+type appContext struct {
+	AppID string
+}
+
+func WithAppID(ctx context.Context, appID string) context.Context {
+	return context.WithValue(ctx, appContextKey{}, &appContext{AppID: appID})
+}
+
+func GetAppID(ctx context.Context) (string, bool) {
+	if appCtx, ok := ctx.Value(appContextKey{}).(*appContext); ok {
+		return appCtx.AppID, true
+	}
+	return "", false
+}
+
+func NewManager(apps *apps.Manager, cluster *sqldb.ClusterManager, ns *namespace.Manager, traces trace2.Store, runMgr *run.Manager, baseURL string) *Manager {
+	// Create hooks for handling session registration
+	hooks := &server.Hooks{}
+
+	// Create a new MCP server
+	s := server.NewMCPServer(
+		"Encore MCP Server",
+		"1.0.0",
+		server.WithToolCapabilities(false),
+		server.WithHooks(hooks),
+	)
+
+	m := &Manager{
+		server: s,
+		sse: server.NewSSEServer(s,
+			server.WithAppendQueryToMessageEndpoint(),
+			server.WithKeepAlive(true),
+			server.WithHTTPContextFunc(addAppToContext)),
+		apps:    apps,
+		ns:      ns,
+		cluster: cluster,
+		traces:  traces,
+		run:     runMgr,
+		BaseURL: baseURL,
+	}
+
+	m.registerDatabaseTools()
+	m.registerTraceTools()
+	m.registerAPITools()
+	m.registerPubSubTools()
+	m.registerSrcTools()
+	m.registerBucketTools()
+	m.registerCacheTools()
+	m.registerMetricsTools()
+	m.registerCronTools()
+	m.registerSecretTools()
+	m.registerDocsTools()
+
+	m.registerTraceResources()
+	return m
+}
+
+func addAppToContext(ctx context.Context, r *http.Request) context.Context {
+	if appID := r.URL.Query().Get("app"); appID != "" {
+		return WithAppID(ctx, appID)
+	}
+	return ctx
+}
+
+func (m *Manager) Serve(listener net.Listener) error {
+	return http.Serve(listener, m.sse)
+}
+
+func (m *Manager) getApp(ctx context.Context) (*apps.Instance, error) {
+	appID, ok := GetAppID(ctx)
+	if !ok {
+		return nil, fmt.Errorf("app not found in context")
+	}
+	inst, err := m.apps.FindLatestByPlatformOrLocalID(appID)
+	if err != nil {
+		return nil, fmt.Errorf("failed to find app: %w", err)
+	}
+	return inst, nil
+}
diff --git a/cli/daemon/mcp/metrics_tools.go b/cli/daemon/mcp/metrics_tools.go
new file mode 100644
index 0000000000..582be10f94
--- /dev/null
+++ b/cli/daemon/mcp/metrics_tools.go
@@ -0,0 +1,125 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sort"
+
+	"github.com/mark3labs/mcp-go/mcp"
+)
+
+func (m *Manager) registerMetricsTools() {
+	m.server.AddTool(mcp.NewTool("get_metrics",
+		mcp.WithDescription("Retrieve comprehensive information about all metrics defined in the currently open Encore, including their types, labels, documentation, and usage across services. This tool helps understand the application's observability and monitoring capabilities."),
+	), m.getMetrics)
+}
+
+func (m *Manager) getMetrics(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	md, err := inst.CachedMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata: %w", err)
+	}
+
+	// Group metrics by service for better organization
+	metricsByService := make(map[string][]map[string]interface{})
+	globalMetrics := make([]map[string]interface{}, 0)
+
+	// Process all metrics
+	for _, metric := range md.Metrics {
+		metricInfo := map[string]interface{}{
+			"name":       metric.Name,
+			"kind":       metric.Kind.String(),
+			"value_type": metric.ValueType.String(),
+			"doc":        metric.Doc,
+		}
+
+		// Add labels if any
+		if len(metric.Labels) > 0 {
+			labels := make([]map[string]interface{}, 0, len(metric.Labels))
+			for _, label := range metric.Labels {
+				labelInfo := map[string]interface{}{
+					"key":  label.Key,
+					"type": label.Type.String(),
+					"doc":  label.Doc,
+				}
+				labels = append(labels, labelInfo)
+			}
+			metricInfo["labels"] = labels
+		}
+
+		// Add to appropriate group (service-specific or global)
+		if metric.ServiceName != nil {
+			serviceName := *metric.ServiceName
+			if _, exists := metricsByService[serviceName]; !exists {
+				metricsByService[serviceName] = make([]map[string]interface{}, 0)
+			}
+			metricsByService[serviceName] = append(metricsByService[serviceName], metricInfo)
+		} else {
+			globalMetrics = append(globalMetrics, metricInfo)
+		}
+	}
+
+	// Build the final result
+	result := map[string]interface{}{
+		"services": make(map[string]interface{}),
+		"global":   globalMetrics,
+	}
+
+	// Add each service's metrics
+	servicesMap := result["services"].(map[string]interface{})
+	for serviceName, metrics := range metricsByService {
+		// Sort metrics by name within each service
+		sort.Slice(metrics, func(i, j int) bool {
+			return metrics[i]["name"].(string) < metrics[j]["name"].(string)
+		})
+		servicesMap[serviceName] = metrics
+	}
+
+	// Also sort global metrics
+	sort.Slice(globalMetrics, func(i, j int) bool {
+		return globalMetrics[i]["name"].(string) < globalMetrics[j]["name"].(string)
+	})
+
+	// Add summary counts
+	summary := map[string]interface{}{
+		"total_metrics":      len(md.Metrics),
+		"global_metrics":     len(globalMetrics),
+		"service_count":      len(metricsByService),
+		"metrics_by_service": make(map[string]int),
+		"metrics_by_kind":    make(map[string]int),
+		"metrics_by_type":    make(map[string]int),
+	}
+
+	// Count metrics by service
+	for service, metrics := range metricsByService {
+		summary["metrics_by_service"].(map[string]int)[service] = len(metrics)
+	}
+
+	// Count metrics by kind and type
+	kindCounts := make(map[string]int)
+	typeCounts := make(map[string]int)
+	for _, metric := range md.Metrics {
+		kindStr := metric.Kind.String()
+		kindCounts[kindStr] = kindCounts[kindStr] + 1
+
+		typeStr := metric.ValueType.String()
+		typeCounts[typeStr] = typeCounts[typeStr] + 1
+	}
+	summary["metrics_by_kind"] = kindCounts
+	summary["metrics_by_type"] = typeCounts
+
+	result["summary"] = summary
+
+	jsonData, err := json.Marshal(result)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal metrics information: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
diff --git a/cli/daemon/mcp/pubsub_tools.go b/cli/daemon/mcp/pubsub_tools.go
new file mode 100644
index 0000000000..dcfb5e2cd4
--- /dev/null
+++ b/cli/daemon/mcp/pubsub_tools.go
@@ -0,0 +1,170 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"google.golang.org/protobuf/encoding/protojson"
+)
+
+func (m *Manager) registerPubSubTools() {
+	m.server.AddTool(mcp.NewTool("get_pubsub",
+		mcp.WithDescription("Retrieve detailed information about all PubSub topics and their subscriptions in the currently open Encore. This includes topic configurations, subscription patterns, message schemas, and the services that publish to or subscribe to each topic."),
+	), m.getPubSub)
+}
+
+func (m *Manager) getPubSub(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	md, err := inst.CachedMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata: %w", err)
+	}
+
+	// Create a map to find topic and subscription definitions from trace nodes
+	topicDefLocations := make(map[string]map[string]interface{})
+	subscriptionDefLocations := make(map[string]map[string]map[string]interface{})
+
+	// Scan through all packages to find trace nodes related to pubsub
+	for _, pkg := range md.Pkgs {
+		for _, node := range pkg.TraceNodes {
+			// Check for topic definition nodes
+			if node.GetPubsubTopicDef() != nil {
+				topicDef := node.GetPubsubTopicDef()
+				if _, exists := topicDefLocations[topicDef.TopicName]; !exists {
+					topicDefLocations[topicDef.TopicName] = map[string]interface{}{
+						"filepath":     node.Filepath,
+						"line_start":   node.SrcLineStart,
+						"line_end":     node.SrcLineEnd,
+						"column_start": node.SrcColStart,
+						"column_end":   node.SrcColEnd,
+					}
+				}
+			}
+
+			// Check for subscription definition nodes
+			if node.GetPubsubSubscriber() != nil {
+				subDef := node.GetPubsubSubscriber()
+				if _, exists := subscriptionDefLocations[subDef.TopicName]; !exists {
+					subscriptionDefLocations[subDef.TopicName] = make(map[string]map[string]interface{})
+				}
+
+				if _, exists := subscriptionDefLocations[subDef.TopicName][subDef.SubscriberName]; !exists {
+					subscriptionDefLocations[subDef.TopicName][subDef.SubscriberName] = map[string]interface{}{
+						"filepath":     node.Filepath,
+						"line_start":   node.SrcLineStart,
+						"line_end":     node.SrcLineEnd,
+						"column_start": node.SrcColStart,
+						"column_end":   node.SrcColEnd,
+					}
+				}
+			}
+		}
+	}
+
+	// Now build the response with locations
+	topics := make([]map[string]interface{}, 0)
+	for _, topic := range md.PubsubTopics {
+		// Extract publishers
+		publishers := make([]map[string]interface{}, 0)
+		for _, publisher := range topic.Publishers {
+			publishers = append(publishers, map[string]interface{}{
+				"service_name": publisher.ServiceName,
+			})
+		}
+
+		// Extract subscriptions
+		subscriptions := make([]map[string]interface{}, 0)
+		for _, subscription := range topic.Subscriptions {
+			subscriptionInfo := map[string]interface{}{
+				"name":         subscription.Name,
+				"service_name": subscription.ServiceName,
+			}
+
+			// Add location information for subscription if available
+			if subLocations, topicExists := subscriptionDefLocations[topic.Name]; topicExists {
+				if subLocation, subExists := subLocations[subscription.Name]; subExists {
+					subscriptionInfo["definition"] = subLocation
+				}
+			}
+
+			// Add optional fields if they're set
+			if subscription.AckDeadline > 0 {
+				subscriptionInfo["ack_deadline"] = formatDuration(subscription.AckDeadline)
+			}
+			if subscription.MessageRetention > 0 {
+				subscriptionInfo["message_retention"] = formatDuration(subscription.MessageRetention)
+			}
+			if subscription.MaxConcurrency != nil {
+				subscriptionInfo["max_concurrency"] = *subscription.MaxConcurrency
+			}
+
+			// Add retry policy if available
+			if subscription.RetryPolicy != nil {
+				retryPolicy := map[string]interface{}{}
+				if subscription.RetryPolicy.MinBackoff > 0 {
+					retryPolicy["min_backoff"] = formatDuration(subscription.RetryPolicy.MinBackoff)
+				}
+				if subscription.RetryPolicy.MaxBackoff > 0 {
+					retryPolicy["max_backoff"] = formatDuration(subscription.RetryPolicy.MaxBackoff)
+				}
+				if subscription.RetryPolicy.MaxRetries > 0 {
+					retryPolicy["max_retries"] = subscription.RetryPolicy.MaxRetries
+				}
+				subscriptionInfo["retry_policy"] = retryPolicy
+			}
+
+			subscriptions = append(subscriptions, subscriptionInfo)
+		}
+
+		// Build topic info
+		topicInfo := map[string]interface{}{
+			"name":               topic.Name,
+			"publishers":         publishers,
+			"subscriptions":      subscriptions,
+			"delivery_guarantee": topic.DeliveryGuarantee.String(),
+		}
+
+		// Add location information for topic if available
+		if location, exists := topicDefLocations[topic.Name]; exists {
+			topicInfo["definition"] = location
+		}
+
+		// Add documentation if available
+		if topic.Doc != nil {
+			topicInfo["doc"] = *topic.Doc
+		}
+
+		// Add ordering key if available
+		if topic.OrderingKey != "" {
+			topicInfo["ordering_key"] = topic.OrderingKey
+		}
+
+		// Add message type if available
+		if topic.MessageType != nil {
+			messageTypeData, err := protojson.Marshal(topic.MessageType)
+			if err != nil {
+				return nil, fmt.Errorf("failed to marshal message type: %w", err)
+			}
+			var messageTypeJson interface{}
+			if err := json.Unmarshal(messageTypeData, &messageTypeJson); err != nil {
+				return nil, fmt.Errorf("failed to unmarshal message type JSON: %w", err)
+			}
+			topicInfo["message_type"] = messageTypeJson
+		}
+
+		topics = append(topics, topicInfo)
+	}
+
+	jsonData, err := json.Marshal(topics)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal PubSub information: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
diff --git a/cli/daemon/mcp/schema_json.go b/cli/daemon/mcp/schema_json.go
new file mode 100644
index 0000000000..16df30a006
--- /dev/null
+++ b/cli/daemon/mcp/schema_json.go
@@ -0,0 +1,391 @@
+package mcp
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/url"
+	"strconv"
+	"strings"
+
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+// FieldLocation represents where a field is located in the API request/response
+type FieldLocation int
+
+const (
+	FieldLocationBody   FieldLocation = 0
+	FieldLocationQuery  FieldLocation = 1
+	FieldLocationHeader FieldLocation = 2
+	FieldLocationCookie FieldLocation = 3
+	FieldLocationUnused FieldLocation = 4
+)
+
+// DescribedField is a field with additional metadata
+type DescribedField struct {
+	*schema.Field
+	SrcName  string
+	Name     string
+	Location FieldLocation
+}
+
+// StructBits generates JSON representations of a struct's fields separated by location
+// It returns query, headers, cookies, and JSON body as strings
+func StructBits(s *schema.Struct, method string, asResponse bool, asGoStruct bool, queryParamsAsObject bool) (query, headers, cookies, jsonBody string) {
+	// Split the fields by location
+	fieldsByLocation := splitFieldsByLocation(s, method, asResponse)
+
+	// Generate query string
+	if len(fieldsByLocation[FieldLocationQuery]) > 0 {
+		if asGoStruct || queryParamsAsObject {
+			query = writeFieldsAsJSON(fieldsByLocation[FieldLocationQuery], asGoStruct)
+		} else {
+			var queryParams []string
+			for _, field := range fieldsByLocation[FieldLocationQuery] {
+				fieldName := field.Name
+				fieldValue := renderFieldValueAsQueryParam(field.Typ)
+
+				queryParams = append(queryParams, url.QueryEscape(fieldName)+"="+fieldValue)
+
+				// If it's a list, add a second parameter to show it's a list
+				if field.Typ.GetList() != nil {
+					queryParams = append(queryParams, url.QueryEscape(fieldName)+"="+fieldValue)
+				}
+			}
+			query = "?" + strings.Join(queryParams, "&")
+		}
+	}
+
+	// Generate headers
+	if len(fieldsByLocation[FieldLocationHeader]) > 0 {
+		headers = writeFieldsAsJSON(fieldsByLocation[FieldLocationHeader], asGoStruct)
+	}
+
+	// Generate cookies
+	if len(fieldsByLocation[FieldLocationCookie]) > 0 {
+		cookies = writeCookiesAsJSON(fieldsByLocation[FieldLocationCookie], asGoStruct)
+	}
+
+	// Generate JSON body
+	if len(fieldsByLocation[FieldLocationBody]) > 0 {
+		jsonBody = writeFieldsAsJSON(fieldsByLocation[FieldLocationBody], asGoStruct)
+	}
+
+	return
+}
+
+// writeFieldsAsJSON renders a list of fields as a JSON object
+func writeFieldsAsJSON(fields []DescribedField, asGoStruct bool) string {
+	var buf bytes.Buffer
+	buf.WriteString("\n")
+
+	for i, f := range fields {
+		fieldName := f.SrcName
+		if !asGoStruct {
+			fieldName = f.Name
+		}
+
+		buf.WriteString("    \"")
+		buf.WriteString(fieldName)
+		buf.WriteString("\": ")
+
+		renderTypeValue(&buf, f.Typ)
+
+		if i < len(fields)-1 {
+			buf.WriteString(",")
+		}
+		buf.WriteString("\n")
+	}
+
+	return buf.String()
+}
+
+// writeCookiesAsJSON renders cookie fields as JSON
+func writeCookiesAsJSON(fields []DescribedField, asGoStruct bool) string {
+	var buf bytes.Buffer
+	buf.WriteString("\n")
+
+	for i, f := range fields {
+		fieldName := f.SrcName
+		if !asGoStruct {
+			fieldName = f.Name
+		}
+
+		buf.WriteString("    \"")
+		buf.WriteString(fieldName)
+		buf.WriteString("\": ")
+
+		// If it's a builtin, render it normally, otherwise render as an empty string
+		if f.Typ.GetBuiltin() != schema.Builtin_ANY {
+			renderTypeValue(&buf, f.Typ)
+		} else {
+			buf.WriteString("\"\"")
+		}
+
+		if i < len(fields)-1 {
+			buf.WriteString(",")
+		}
+		buf.WriteString("\n")
+	}
+
+	return buf.String()
+}
+
+// renderTypeValue renders a type value to the buffer
+func renderTypeValue(buf *bytes.Buffer, typ *schema.Type) {
+	switch {
+	case typ.GetBuiltin() != schema.Builtin_ANY:
+		renderBuiltinValue(buf, typ.GetBuiltin(), false)
+	case typ.GetList() != nil:
+		buf.WriteString("[")
+		renderTypeValue(buf, typ.GetList().Elem)
+		buf.WriteString("]")
+	case typ.GetStruct() != nil:
+		buf.WriteString("{")
+		for i, f := range typ.GetStruct().Fields {
+			if f.JsonName == "-" {
+				continue
+			}
+
+			jsonName := f.JsonName
+			if jsonName == "" {
+				jsonName = f.Name
+			}
+
+			buf.WriteString("\"")
+			buf.WriteString(jsonName)
+			buf.WriteString("\": ")
+
+			renderTypeValue(buf, f.Typ)
+
+			if i < len(typ.GetStruct().Fields)-1 {
+				buf.WriteString(", ")
+			}
+		}
+		buf.WriteString("}")
+	case typ.GetMap() != nil:
+		buf.WriteString("{")
+		renderTypeValue(buf, typ.GetMap().Key)
+		buf.WriteString(": ")
+		renderTypeValue(buf, typ.GetMap().Value)
+		buf.WriteString("}")
+	case typ.GetNamed() != nil:
+		// Just render as null for simplicity
+		buf.WriteString("null")
+	case typ.GetPointer() != nil:
+		renderTypeValue(buf, typ.GetPointer().Base)
+	case typ.GetUnion() != nil && len(typ.GetUnion().Types) > 0:
+		// Just render the first type of the union
+		renderTypeValue(buf, typ.GetUnion().Types[0])
+	case typ.GetLiteral() != nil:
+		renderLiteralValue(buf, typ.GetLiteral())
+	default:
+		buf.WriteString("<unknown>")
+	}
+}
+
+// renderBuiltinValue renders a builtin type value
+func renderBuiltinValue(buf *bytes.Buffer, b schema.Builtin, urlEncode bool) {
+	var value string
+
+	switch b {
+	case schema.Builtin_ANY:
+		value = "<any data>"
+	case schema.Builtin_BOOL:
+		value = "false"
+	case schema.Builtin_INT, schema.Builtin_INT8, schema.Builtin_INT16, schema.Builtin_INT32, schema.Builtin_INT64,
+		schema.Builtin_UINT, schema.Builtin_UINT8, schema.Builtin_UINT16, schema.Builtin_UINT32, schema.Builtin_UINT64:
+		value = "0"
+	case schema.Builtin_FLOAT32, schema.Builtin_FLOAT64:
+		value = "0.0"
+	case schema.Builtin_STRING:
+		value = "\"\""
+	case schema.Builtin_BYTES:
+		value = "\"\" /* base64 */"
+	case schema.Builtin_TIME:
+		value = "\"2009-11-10T23:00:00Z\""
+	case schema.Builtin_UUID:
+		value = "\"7d42f515-3517-4e76-be13-30880443546f\""
+	case schema.Builtin_JSON:
+		value = "{}"
+	case schema.Builtin_USER_ID:
+		value = "\"userID\""
+	case schema.Builtin_DECIMAL:
+		value = "\"0.0\""
+	default:
+		value = "<unknown>"
+	}
+
+	if urlEncode {
+		// Remove quotes for URL encoding if they exist
+		if len(value) >= 2 && value[0] == '"' && value[len(value)-1] == '"' {
+			value = value[1 : len(value)-1]
+		}
+		buf.WriteString(url.QueryEscape(value))
+	} else {
+		buf.WriteString(value)
+	}
+}
+
+// renderLiteralValue renders a literal value
+func renderLiteralValue(buf *bytes.Buffer, lit *schema.Literal) {
+	switch v := lit.Value.(type) {
+	case *schema.Literal_Boolean:
+		if v.Boolean {
+			buf.WriteString("true")
+		} else {
+			buf.WriteString("false")
+		}
+	case *schema.Literal_Int:
+		buf.WriteString(strconv.FormatInt(v.Int, 10))
+	case *schema.Literal_Float:
+		buf.WriteString(strconv.FormatFloat(v.Float, 'f', -1, 64))
+	case *schema.Literal_Str:
+		jsonStr, _ := json.Marshal(v.Str)
+		buf.Write(jsonStr)
+	case *schema.Literal_Null:
+		buf.WriteString("null")
+	default:
+		buf.WriteString("<unknown>")
+	}
+}
+
+// renderFieldValueAsQueryParam returns a URL-encoded string representation of a field's value
+func renderFieldValueAsQueryParam(typ *schema.Type) string {
+	var buf bytes.Buffer
+
+	if typ.GetBuiltin() != schema.Builtin_ANY {
+		renderBuiltinValue(&buf, typ.GetBuiltin(), true)
+	} else if typ.GetList() != nil {
+		renderTypeValue(&buf, typ.GetList().Elem)
+	} else {
+		buf.WriteString("<value>")
+	}
+
+	return buf.String()
+}
+
+// splitFieldsByLocation categorizes struct fields by their HTTP location
+func splitFieldsByLocation(s *schema.Struct, method string, asResponse bool) map[FieldLocation][]DescribedField {
+	result := make(map[FieldLocation][]DescribedField)
+
+	for _, f := range s.Fields {
+		name, location := fieldNameAndLocation(f, method, asResponse)
+
+		// Skip unused fields
+		if location == FieldLocationUnused {
+			continue
+		}
+
+		result[location] = append(result[location], DescribedField{
+			Field:    f,
+			SrcName:  f.Name,
+			Name:     name,
+			Location: location,
+		})
+	}
+
+	return result
+}
+
+// fieldNameAndLocation determines the name and location of a field based on HTTP method and tags
+func fieldNameAndLocation(f *schema.Field, method string, asResponse bool) (string, FieldLocation) {
+	// For response, all fields go in the body unless explicitly tagged
+	if asResponse {
+		// Check for explicit wire location
+		if f.Wire != nil {
+			if f.Wire.GetHeader() != nil {
+				name := f.Wire.GetHeader().GetName()
+				if name == "" {
+					name = f.Name
+				}
+				return name, FieldLocationHeader
+			} else if f.Wire.GetQuery() != nil {
+				name := f.Wire.GetQuery().GetName()
+				if name == "" {
+					name = f.Name
+				}
+				return name, FieldLocationQuery
+			}
+		}
+
+		// Default response location is body
+		jsonName := f.JsonName
+		if jsonName == "" {
+			jsonName = f.Name
+		}
+		return jsonName, FieldLocationBody
+	}
+
+	// For request, location depends on method and tags
+	isGetLike := method == "GET" || method == "HEAD" || method == "DELETE"
+
+	// Check for explicit wire location
+	if f.Wire != nil {
+		if f.Wire.GetHeader() != nil {
+			name := f.Wire.GetHeader().GetName()
+			if name == "" {
+				name = f.Name
+			}
+			return name, FieldLocationHeader
+		} else if f.Wire.GetQuery() != nil {
+			name := f.Wire.GetQuery().GetName()
+			if name == "" {
+				name = f.Name
+			}
+			return name, FieldLocationQuery
+		}
+	}
+
+	// Check for Cookie
+	for _, tag := range f.Tags {
+		if tag.Key == "cookie" {
+			name := tag.Name
+			if name == "" {
+				name = f.Name
+			}
+			return name, FieldLocationCookie
+		}
+	}
+
+	// For GET-like methods, fields go in query by default
+	if isGetLike {
+		name := f.QueryStringName
+		if name == "-" {
+			return f.Name, FieldLocationUnused
+		} else if name == "" {
+			name = f.Name
+		}
+		return name, FieldLocationQuery
+	}
+
+	// Default request location for POST/PUT/PATCH is body
+	jsonName := f.JsonName
+	if jsonName == "-" {
+		return f.Name, FieldLocationUnused
+	} else if jsonName == "" {
+		jsonName = f.Name
+	}
+	return jsonName, FieldLocationBody
+}
+
+// NamedOrInlineStruct returns the struct type and type arguments for a named or inline struct.
+// Returns nil if the type is neither a named struct nor an inline struct.
+func NamedOrInlineStruct(meta map[uint32]*schema.Decl, t *schema.Type) (*schema.Struct, []*schema.Type) {
+	if t == nil {
+		return nil, nil
+	}
+
+	if named := t.GetNamed(); named != nil {
+		st := meta[named.Id]
+		if st != nil && st.GetType() != nil {
+			if structType := st.GetType().GetStruct(); structType != nil {
+				return structType, named.GetTypeArguments()
+			}
+		}
+	} else if structType := t.GetStruct(); structType != nil {
+		return structType, []*schema.Type{}
+	}
+
+	return nil, nil
+}
diff --git a/cli/daemon/mcp/secret_tools.go b/cli/daemon/mcp/secret_tools.go
new file mode 100644
index 0000000000..35054c7239
--- /dev/null
+++ b/cli/daemon/mcp/secret_tools.go
@@ -0,0 +1,86 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sort"
+
+	"github.com/mark3labs/mcp-go/mcp"
+)
+
+func (m *Manager) registerSecretTools() {
+	m.server.AddTool(mcp.NewTool("get_secrets",
+		mcp.WithDescription("Retrieve metadata about all secrets used in the currently open Encore, including their usage patterns, which services depend on them, and their configuration. This tool helps understand the application's security requirements and secret management strategy."),
+	), m.getSecrets)
+}
+
+func (m *Manager) getSecrets(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	md, err := inst.CachedMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata: %w", err)
+	}
+
+	// Build a map of all secrets and the services that use them
+	secretUsageMap := make(map[string][]map[string]interface{})
+
+	// First go through all packages to find secrets
+	for _, pkg := range md.Pkgs {
+		if len(pkg.Secrets) > 0 && pkg.ServiceName != "" {
+			// For each secret in this package
+			for _, secretName := range pkg.Secrets {
+				// Create usage info
+				usageInfo := map[string]interface{}{
+					"service_name": pkg.ServiceName,
+					"package_path": pkg.RelPath,
+				}
+
+				// Add to the map
+				if _, exists := secretUsageMap[secretName]; !exists {
+					secretUsageMap[secretName] = make([]map[string]interface{}, 0)
+				}
+				secretUsageMap[secretName] = append(secretUsageMap[secretName], usageInfo)
+			}
+		}
+	}
+
+	// Build the result
+	secrets := make([]map[string]interface{}, 0)
+
+	// Convert the map to an array
+	for secretName, usages := range secretUsageMap {
+		secretInfo := map[string]interface{}{
+			"name":   secretName,
+			"usages": usages,
+		}
+
+		// Count unique services
+		serviceSet := make(map[string]bool)
+		for _, usage := range usages {
+			if svcName, ok := usage["service_name"].(string); ok {
+				serviceSet[svcName] = true
+			}
+		}
+
+		secretInfo["service_count"] = len(serviceSet)
+
+		secrets = append(secrets, secretInfo)
+	}
+
+	// Sort by name for consistent output
+	sort.Slice(secrets, func(i, j int) bool {
+		return secrets[i]["name"].(string) < secrets[j]["name"].(string)
+	})
+
+	jsonData, err := json.Marshal(secrets)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal secrets information: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
diff --git a/cli/daemon/mcp/src_tools.go b/cli/daemon/mcp/src_tools.go
new file mode 100644
index 0000000000..b8460f6d33
--- /dev/null
+++ b/cli/daemon/mcp/src_tools.go
@@ -0,0 +1,73 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+
+	"github.com/mark3labs/mcp-go/mcp"
+	"google.golang.org/protobuf/encoding/protojson"
+)
+
+func (m *Manager) registerSrcTools() {
+	// Add tool handlers
+	m.server.AddTool(mcp.NewTool("get_metadata",
+		mcp.WithDescription("Retrieve the complete application metadata, including service definitions, database schemas, API endpoints, and other infrastructure components. This tool provides a comprehensive view of the application's architecture and configuration."),
+	), m.getMetadata)
+
+	// Add tool handlers
+	m.server.AddTool(mcp.NewTool("get_src_files",
+		mcp.WithDescription("Retrieve the contents of one or more source files from the application. This tool is useful for examining specific parts of the codebase or understanding implementation details."),
+		mcp.WithArray("files", mcp.Items(map[string]any{
+			"type":        "string",
+			"description": "List of file paths to retrieve, relative to the application root. Each path should point to a valid source file in the project.",
+		})),
+	), m.getSrcFiles)
+
+}
+
+func (m *Manager) getMetadata(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+	md, err := inst.CachedMetadata()
+	if err != nil {
+		return nil, fmt.Errorf("failed to get metadata: %w", err)
+	}
+	data, err := protojson.Marshal(md)
+
+	return mcp.NewToolResultText(string(data)), nil
+}
+
+func (m *Manager) getSrcFiles(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	files, ok := request.Params.Arguments["files"].([]any)
+	if !ok || len(files) == 0 {
+		return nil, fmt.Errorf("no files provided")
+	}
+
+	rtn := map[string]string{}
+	for _, file := range files {
+		fileStr := file.(string)
+		content, err := os.ReadFile(filepath.Join(inst.Root(), fileStr))
+		if err != nil {
+			return nil, fmt.Errorf("failed to read file: %w", err)
+		}
+		rtn[fileStr] = string(content)
+	}
+
+	jsonData, err := json.Marshal(rtn)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal json: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
diff --git a/cli/daemon/mcp/trace_tools.go b/cli/daemon/mcp/trace_tools.go
new file mode 100644
index 0000000000..745ab5030c
--- /dev/null
+++ b/cli/daemon/mcp/trace_tools.go
@@ -0,0 +1,192 @@
+package mcp
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strings"
+	"time"
+
+	"github.com/mark3labs/mcp-go/mcp"
+
+	"encr.dev/cli/daemon/engine/trace2"
+	tracepb2 "encr.dev/proto/encore/engine/trace2"
+)
+
+func (m *Manager) registerTraceResources() {
+	// Register the trace resources
+	m.server.AddResourceTemplate(mcp.NewResourceTemplate(
+		"trace://{id}",
+		"API trace",
+		mcp.WithTemplateDescription("Retrieve detailed information about a specific trace, including all spans, timing information, and associated metadata. This resource is useful for deep debugging of individual requests."),
+		mcp.WithTemplateMIMEType("application/json"),
+	), m.getTraceResource)
+}
+
+func (m *Manager) registerTraceTools() {
+	// Add tool for listing traces
+	m.server.AddTool(mcp.NewTool("get_traces",
+		mcp.WithDescription("Retrieve a list of request traces from the application, including their timing, status, and associated metadata. This tool helps understand the flow of requests through the system and diagnose issues."),
+		mcp.WithString("service", mcp.Description("Optional service name to filter traces by. Only returns traces that involve the specified service.")),
+		mcp.WithString("endpoint", mcp.Description("Optional endpoint name to filter traces by. Only returns traces that involve the specified endpoint.")),
+		mcp.WithString("error", mcp.Description("Optional filter for traces with errors. Set to 'true' to see only failed traces, 'false' for successful traces, or omit to see all traces.")),
+		mcp.WithString("limit", mcp.Description("Maximum number of traces to return. Helps manage response size when dealing with many traces.")),
+		mcp.WithString("start_time", mcp.Description("ISO format timestamp to filter traces created after this time. Useful for focusing on recent activity.")),
+		mcp.WithString("end_time", mcp.Description("ISO format timestamp to filter traces created before this time. Useful for focusing on a specific time period.")),
+	), m.listTraces)
+
+	// Add tool for getting a single trace with all spans
+	m.server.AddTool(mcp.NewTool("get_trace_spans",
+		mcp.WithDescription("Retrieve detailed information about one or more traces, including all spans, timing information, and associated metadata. This tool is useful for deep debugging of individual requests."),
+		mcp.WithArray("trace_ids",
+			mcp.Items(map[string]any{
+				"type":        "string",
+				"description": "The unique identifiers of the traces to retrieve. These IDs are returned by the get_traces tool.",
+			})),
+	), m.getTrace)
+}
+
+func (m *Manager) listTraces(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	// Build trace query
+	query := &trace2.Query{
+		AppID: inst.PlatformOrLocalID(),
+		Limit: 100, // Default limit
+	}
+
+	if service, ok := request.Params.Arguments["service"].(string); ok && service != "" {
+		query.Service = service
+	}
+	if endpoint, ok := request.Params.Arguments["endpoint"].(string); ok && endpoint != "" {
+		query.Endpoint = endpoint
+	}
+	if errorStr, ok := request.Params.Arguments["error"].(string); ok && errorStr != "" {
+		if errorStr == "true" {
+			isError := true
+			query.IsError = &isError
+		} else if errorStr == "false" {
+			isError := false
+			query.IsError = &isError
+		}
+	}
+	if limitStr, ok := request.Params.Arguments["limit"].(string); ok && limitStr != "" {
+		var limit int
+		if _, err := fmt.Sscanf(limitStr, "%d", &limit); err == nil && limit > 0 {
+			query.Limit = limit
+		}
+	}
+	if startTime, ok := request.Params.Arguments["start_time"].(string); ok && startTime != "" {
+		if t, err := time.Parse(time.RFC3339, startTime); err == nil {
+			query.StartTime = t
+		}
+	}
+	if endTime, ok := request.Params.Arguments["end_time"].(string); ok && endTime != "" {
+		if t, err := time.Parse(time.RFC3339, endTime); err == nil {
+			query.EndTime = t
+		}
+	}
+
+	// Collect traces
+	var traces []*tracepb2.SpanSummary
+	err = m.traces.List(ctx, query, func(span *tracepb2.SpanSummary) bool {
+		traces = append(traces, span)
+		return true
+	})
+	if err != nil {
+		return nil, fmt.Errorf("failed to list traces: %w", err)
+	}
+
+	// Convert to JSON
+	jsonData, err := json.Marshal(traces)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal traces: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
+
+func (m *Manager) getTrace(ctx context.Context, request mcp.CallToolRequest) (*mcp.CallToolResult, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	traceIDs, ok := request.Params.Arguments["trace_ids"].([]interface{})
+	if !ok || len(traceIDs) == 0 {
+		return nil, fmt.Errorf("trace_ids is required and must be a non-empty array")
+	}
+
+	result := make(map[string][]*tracepb2.TraceEvent)
+
+	for _, traceIDVal := range traceIDs {
+		traceID, ok := traceIDVal.(string)
+		if !ok || traceID == "" {
+			continue // Skip invalid IDs
+		}
+
+		// Collect all events for the trace
+		var events []*tracepb2.TraceEvent
+		err = m.traces.Get(ctx, inst.PlatformOrLocalID(), traceID, func(event *tracepb2.TraceEvent) bool {
+			events = append(events, event)
+			return true
+		})
+		if err != nil {
+			if errors.Is(err, trace2.ErrNotFound) {
+				// Just skip not found traces
+				continue
+			}
+			return nil, fmt.Errorf("failed to get trace %s: %w", traceID, err)
+		}
+
+		result[traceID] = events
+	}
+
+	// Convert to JSON
+	jsonData, err := json.Marshal(result)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal traces: %w", err)
+	}
+
+	return mcp.NewToolResultText(string(jsonData)), nil
+}
+
+func (m *Manager) getTraceResource(ctx context.Context, request mcp.ReadResourceRequest) ([]mcp.ResourceContents, error) {
+	inst, err := m.getApp(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get app: %w", err)
+	}
+
+	traceID := strings.TrimPrefix(request.Params.URI, "trace://")
+
+	// Collect all events for the trace
+	var events []*tracepb2.TraceEvent
+	err = m.traces.Get(ctx, inst.PlatformOrLocalID(), traceID, func(event *tracepb2.TraceEvent) bool {
+		events = append(events, event)
+		return true
+	})
+	if err != nil {
+		if errors.Is(err, trace2.ErrNotFound) {
+			return nil, fmt.Errorf("trace %s not found", traceID)
+		}
+		return nil, fmt.Errorf("failed to get trace %s: %w", traceID, err)
+	}
+
+	// Convert to JSON
+	jsonData, err := json.Marshal(events)
+	if err != nil {
+		return nil, fmt.Errorf("failed to marshal events: %w", err)
+	}
+
+	return []mcp.ResourceContents{
+		mcp.TextResourceContents{
+			URI:      request.Params.URI,
+			MIMEType: "application/json",
+			Text:     string(jsonData),
+		},
+	}, nil
+}
diff --git a/cli/daemon/mcp/util.go b/cli/daemon/mcp/util.go
new file mode 100644
index 0000000000..cd844d5218
--- /dev/null
+++ b/cli/daemon/mcp/util.go
@@ -0,0 +1,23 @@
+package mcp
+
+import (
+	"time"
+
+	metav1 "encr.dev/proto/encore/parser/meta/v1"
+)
+
+// findServiceNameForPackage returns the service name for a given package path
+func findServiceNameForPackage(md *metav1.Data, pkgPath string) string {
+	for _, pkg := range md.Pkgs {
+		if pkg.RelPath == pkgPath && pkg.ServiceName != "" {
+			return pkg.ServiceName
+		}
+	}
+	return ""
+}
+
+// formatDuration formats a nanosecond duration into a human-readable string
+func formatDuration(nanos int64) string {
+	duration := time.Duration(nanos) * time.Nanosecond
+	return duration.String()
+}
diff --git a/cli/daemon/namespace.go b/cli/daemon/namespace.go
new file mode 100644
index 0000000000..042467f086
--- /dev/null
+++ b/cli/daemon/namespace.go
@@ -0,0 +1,75 @@
+package daemon
+
+import (
+	"context"
+
+	"github.com/golang/protobuf/ptypes/empty"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/pkg/fns"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+func (s *Server) CreateNamespace(ctx context.Context, req *daemonpb.CreateNamespaceRequest) (*daemonpb.Namespace, error) {
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		return nil, err
+	}
+	ns, err := s.ns.Create(ctx, app, namespace.Name(req.Name))
+	if err != nil {
+		return nil, err
+	}
+	return ns.ToProto(), nil
+}
+
+func (s *Server) ListNamespaces(ctx context.Context, req *daemonpb.ListNamespacesRequest) (*daemonpb.ListNamespacesResponse, error) {
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		return nil, err
+	}
+	nss, err := s.ns.List(ctx, app)
+	if err != nil {
+		return nil, err
+	}
+	protos := fns.Map(nss, (*namespace.Namespace).ToProto)
+	return &daemonpb.ListNamespacesResponse{Namespaces: protos}, nil
+}
+
+func (s *Server) DeleteNamespace(ctx context.Context, req *daemonpb.DeleteNamespaceRequest) (*empty.Empty, error) {
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.ns.Delete(ctx, app, namespace.Name(req.Name)); err != nil {
+		return nil, err
+	}
+	return &empty.Empty{}, nil
+}
+
+func (s *Server) SwitchNamespace(ctx context.Context, req *daemonpb.SwitchNamespaceRequest) (*daemonpb.Namespace, error) {
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		return nil, err
+	}
+
+	if req.Create {
+		_, err := s.ns.Create(ctx, app, namespace.Name(req.Name))
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	ns, err := s.ns.Switch(ctx, app, namespace.Name(req.Name))
+	if err != nil {
+		return nil, err
+	}
+	return ns.ToProto(), nil
+}
+
+func (s *Server) namespaceOrActive(ctx context.Context, app *apps.Instance, ns *string) (*namespace.Namespace, error) {
+	if ns == nil {
+		return s.ns.GetActive(ctx, app)
+	}
+	return s.ns.GetByName(ctx, app, namespace.Name(*ns))
+}
diff --git a/cli/daemon/namespace/namespace.go b/cli/daemon/namespace/namespace.go
new file mode 100644
index 0000000000..d7ca1f1c2f
--- /dev/null
+++ b/cli/daemon/namespace/namespace.go
@@ -0,0 +1,339 @@
+package namespace
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/xid"
+
+	"encr.dev/cli/daemon/apps"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+var (
+	ErrNotFound = errors.New("namespace not found")
+	ErrActive   = errors.New("namespace is active")
+)
+
+type (
+	ID   string
+	Name string
+)
+
+func (id ID) String() string { return string(id) }
+
+func ParseID(s string) (ID, bool) {
+	id, err := xid.FromString(s)
+	if err != nil {
+		return "", false
+	}
+	return ID(id.String()), true
+}
+
+func NewManager(db *sql.DB) *Manager {
+	return &Manager{db, nil}
+}
+
+// Manager manages namespaces.
+type Manager struct {
+	db       *sql.DB
+	handlers []DeletionHandler
+}
+
+func (mgr *Manager) RegisterDeletionHandler(h DeletionHandler) {
+	mgr.handlers = append(mgr.handlers, h)
+}
+
+type Namespace struct {
+	ID           ID
+	App          *apps.Instance
+	Name         Name
+	Active       bool
+	CreatedAt    time.Time
+	LastActiveAt *time.Time
+}
+
+func (m *Manager) Create(ctx context.Context, app *apps.Instance, name Name) (*Namespace, error) {
+	now := time.Now()
+	id := ID(xid.NewWithTime(now).String())
+
+	tx, err := m.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, err
+	}
+	defer tx.Rollback() // committed explicitly on success
+
+	_, err = tx.ExecContext(ctx, `
+		INSERT INTO namespace (id, app_id, name, active, created_at)
+		VALUES (?, ?, ?, ?, ?)
+	`, id, app.PlatformOrLocalID(), name, false, now)
+	if err != nil {
+		return nil, errors.Wrap(err, "create namespace")
+	}
+
+	ns := &Namespace{
+		ID:        id,
+		App:       app,
+		Name:      name,
+		CreatedAt: now,
+	}
+
+	// If there is no active namespace, make this one active.
+	{
+		var activeName string
+		err = tx.QueryRowContext(ctx, `
+			SELECT name FROM namespace WHERE app_id = ? AND active = true
+		`, app.PlatformOrLocalID()).Scan(&activeName)
+		if err != nil {
+			if errors.Is(err, sql.ErrNoRows) {
+				// No active namespace; make this one active.
+				_, err = tx.ExecContext(ctx, `
+					UPDATE namespace
+					SET active = true, last_active_at = ?
+					WHERE id = ?
+				`, now, id)
+			}
+			if err != nil {
+				return nil, errors.Wrap(err, "create namespace")
+			}
+		}
+		ns.Active = true
+		ns.LastActiveAt = &now
+	}
+
+	if err := tx.Commit(); err != nil {
+		return nil, errors.Wrap(err, "create namespace")
+	}
+
+	return ns, nil
+}
+
+func (m *Manager) List(ctx context.Context, app *apps.Instance) ([]*Namespace, error) {
+	rows, err := m.db.QueryContext(ctx, `
+		SELECT id, name, active, created_at, last_active_at
+		FROM namespace
+		WHERE app_id = ?
+		ORDER BY name ASC
+	`, app.PlatformOrLocalID())
+	if err != nil {
+		return nil, errors.Wrap(err, "list namespaces")
+	}
+	defer rows.Close()
+	var nss []*Namespace
+
+	for rows.Next() {
+		var ns Namespace
+		if err := rows.Scan(&ns.ID, &ns.Name, &ns.Active, &ns.CreatedAt, &ns.LastActiveAt); err != nil {
+			return nil, errors.Wrap(err, "scan namespace")
+		}
+		ns.App = app
+		nss = append(nss, &ns)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, errors.Wrap(err, "list namespaces")
+	}
+
+	// If we have no namespaces at all, create a default one.
+	if len(nss) == 0 {
+		ns, err := m.Create(ctx, app, "default")
+		if err != nil {
+			return nil, err
+		}
+		nss = []*Namespace{ns}
+	}
+
+	return nss, nil
+}
+
+func (m *Manager) GetByName(ctx context.Context, app *apps.Instance, name Name) (*Namespace, error) {
+	var ns Namespace
+	err := m.db.QueryRowContext(ctx, `
+		SELECT id, name, active, created_at, last_active_at
+		FROM namespace
+		WHERE app_id = ? AND name = ?
+	`, app.PlatformOrLocalID(), name).Scan(&ns.ID, &ns.Name, &ns.Active, &ns.CreatedAt, &ns.LastActiveAt)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, errors.Wrap(err, "get namespace")
+	}
+	ns.App = app
+	return &ns, nil
+}
+
+func (m *Manager) GetByID(ctx context.Context, app *apps.Instance, id ID) (*Namespace, error) {
+	var ns Namespace
+	err := m.db.QueryRowContext(ctx, `
+		SELECT id, name, active, created_at, last_active_at
+		FROM namespace
+		WHERE app_id = ? AND id = ?
+	`, app.PlatformOrLocalID(), id).Scan(&ns.ID, &ns.Name, &ns.Active, &ns.CreatedAt, &ns.LastActiveAt)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, ErrNotFound
+		}
+		return nil, errors.Wrap(err, "get namespace")
+	}
+	ns.App = app
+	return &ns, nil
+}
+
+func (m *Manager) Delete(ctx context.Context, app *apps.Instance, name Name) error {
+	tx, err := m.db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback() // committed explicitly on success
+
+	var ns Namespace
+	err = tx.QueryRowContext(ctx, `
+		DELETE FROM namespace
+		WHERE app_id = ? AND name = ?
+		RETURNING id, name, active, created_at, last_active_at
+	`, app.PlatformOrLocalID(), name).Scan(&ns.ID, &ns.Name, &ns.Active, &ns.CreatedAt, &ns.LastActiveAt)
+	if ns.Active {
+		return ErrActive
+	}
+	ns.App = app
+
+	// Check all the deletion handlers.
+	for _, h := range m.handlers {
+		if err := h.CanDeleteNamespace(ctx, app, &ns); err != nil {
+			return errors.Newf("cannot delete namespace: %v", err)
+		}
+	}
+
+	// Actually delete the namespace.
+	for _, h := range m.handlers {
+		if err := h.DeleteNamespace(ctx, app, &ns); err != nil {
+			return errors.Newf("failed to delete namespace: %v", err)
+		}
+	}
+
+	err = tx.Commit()
+	return errors.Wrap(err, "delete namespace")
+}
+
+func (m *Manager) Switch(ctx context.Context, app *apps.Instance, name Name) (*Namespace, error) {
+	// Resolve the namespace to switch to.
+	var target *Namespace
+
+	// If the name is "-", switch to the previous namespace.
+	if name == "-" {
+		nss, err := m.List(ctx, app)
+		if err != nil {
+			return nil, err
+		}
+
+		// Find the non-active namespace that was most recently active
+		var lastActive *Namespace
+		for _, ns := range nss {
+			if !ns.Active && ns.LastActiveAt != nil {
+				if lastActive == nil || ns.LastActiveAt.After(*lastActive.LastActiveAt) {
+					lastActive = ns
+				}
+			}
+		}
+
+		if lastActive == nil {
+			return nil, ErrNotFound
+		}
+		target = lastActive
+	} else {
+		var err error
+		target, err = m.GetByName(ctx, app, name)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	tx, err := m.db.BeginTx(ctx, nil)
+	if err != nil {
+		return nil, errors.WithStack(err)
+	}
+	defer tx.Rollback() // committed explicitly on success
+
+	// Mark all namespaces as inactive.
+	_, err = tx.ExecContext(ctx, `
+		UPDATE namespace SET active = false
+		WHERE app_id = ?
+	`, app.PlatformOrLocalID())
+	if err != nil {
+		return nil, errors.Wrap(err, "switch namespace")
+	}
+
+	// Mark the selected namespace as active.
+	_, err = tx.ExecContext(ctx, `
+		UPDATE namespace SET active = true, last_active_at = ?
+		WHERE id = ?
+	`, time.Now(), target.ID)
+	if err != nil {
+		return nil, errors.Wrap(err, "switch namespace")
+	}
+
+	if err := tx.Commit(); err != nil {
+		return nil, errors.Wrap(err, "switch namespace")
+	}
+
+	target.Active = true
+	return target, nil
+}
+
+// GetActive returns the active namespace for the given app.
+func (m *Manager) GetActive(ctx context.Context, app *apps.Instance) (*Namespace, error) {
+	var ns Namespace
+	err := m.db.QueryRowContext(ctx, `
+		SELECT id, name, active, created_at, last_active_at
+		FROM namespace
+		WHERE app_id = ? AND active = true
+	`, app.PlatformOrLocalID()).Scan(&ns.ID, &ns.Name, &ns.Active, &ns.CreatedAt, &ns.LastActiveAt)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return nil, err
+	} else if err == nil {
+		ns.App = app
+		return &ns, nil
+	}
+
+	// No active namespace.
+
+	// Do we have any namespaces at all?
+	nss, err := m.List(ctx, app)
+	if err != nil {
+		return nil, err
+	} else if len(nss) > 0 {
+		return m.Switch(ctx, app, nss[0].Name)
+	} else {
+		// No namespaces. Create a new one.
+		return m.Create(ctx, app, "default")
+	}
+}
+
+func (ns *Namespace) ToProto() *daemonpb.Namespace {
+	res := &daemonpb.Namespace{
+		Id:        string(ns.ID),
+		Name:      string(ns.Name),
+		Active:    ns.Active,
+		CreatedAt: ns.CreatedAt.String(),
+	}
+	if ns.LastActiveAt != nil {
+		s := ns.LastActiveAt.String()
+		res.LastActiveAt = &s
+	}
+	return res
+}
+
+// DeletionHandler is the interface for components that want to listen for
+// and handle namespace deletion events.
+type DeletionHandler interface {
+	// CanDeleteNamespace is called to determine whether the namespace can be deleted
+	// by the component. To signal the namespace cannot be deleted, return a non-nil error.
+	CanDeleteNamespace(ctx context.Context, app *apps.Instance, ns *Namespace) error
+
+	// DeleteNamespace is called when a namespace is deleted.
+	// Due to the non-atomic nature of many components, failure to handle
+	// the deletion cannot be fully rolled back.
+	DeleteNamespace(ctx context.Context, app *apps.Instance, ns *Namespace) error
+}
diff --git a/cli/daemon/objects/manager.go b/cli/daemon/objects/manager.go
new file mode 100644
index 0000000000..1023687d9a
--- /dev/null
+++ b/cli/daemon/objects/manager.go
@@ -0,0 +1,57 @@
+package objects
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/pkg/emulators/storage/gcsemu"
+)
+
+// NewClusterManager creates a new ClusterManager.
+func NewClusterManager(ns *namespace.Manager) *ClusterManager {
+	mgr := &ClusterManager{
+		ns: ns,
+	}
+	return mgr
+}
+
+type ClusterManager struct {
+	ns *namespace.Manager
+}
+
+func (cm *ClusterManager) BaseDir(ns namespace.ID) (string, error) {
+	cache, err := os.UserCacheDir()
+	if err != nil {
+		return "", err
+	}
+
+	return filepath.Join(cache, "encore", "objects", ns.String()), nil
+}
+
+// CanDeleteNamespace implements namespace.DeletionHandler.
+func (cm *ClusterManager) CanDeleteNamespace(ctx context.Context, app *apps.Instance, ns *namespace.Namespace) error {
+	return nil
+}
+
+// DeleteNamespace implements namespace.DeletionHandler.
+func (cm *ClusterManager) DeleteNamespace(ctx context.Context, app *apps.Instance, ns *namespace.Namespace) error {
+	baseDir, err := cm.BaseDir(ns.ID)
+	if err == nil {
+		err = os.RemoveAll(baseDir)
+	}
+	return err
+}
+
+// PersistentStoreFallback is a public server fallback handler
+// for resolving stores based on the cluster manager's base directory.
+func (cm *ClusterManager) PersistentStoreFallback(id string) (gcsemu.Store, bool) {
+	if baseDir, err := cm.BaseDir(namespace.ID(id)); err == nil {
+		if _, err := os.Stat(baseDir); err == nil {
+			return gcsemu.NewFileStore(baseDir), true
+		}
+	}
+	return nil, false
+}
diff --git a/cli/daemon/objects/objects.go b/cli/daemon/objects/objects.go
new file mode 100644
index 0000000000..d0b3478917
--- /dev/null
+++ b/cli/daemon/objects/objects.go
@@ -0,0 +1,109 @@
+package objects
+
+import (
+	// nosemgrep
+
+	"fmt"
+	"net"
+	"net/http"
+
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/pkg/emulators/storage/gcsemu"
+	"github.com/cockroachdb/errors"
+	"github.com/rs/xid"
+	"github.com/rs/zerolog/log"
+	"go4.org/syncutil"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+type Server struct {
+	id        string
+	public    *PublicBucketServer
+	startOnce syncutil.Once
+	cancel    func() // set by Start
+	store     gcsemu.Store
+	emu       *gcsemu.GcsEmu
+	ln        net.Listener
+	srv       *http.Server
+	inMemory  bool
+}
+
+func NewInMemoryServer(public *PublicBucketServer) *Server {
+	id := xid.New().String()
+	store := gcsemu.NewMemStore()
+	return newServer(public, id, store, true)
+}
+
+func NewDirServer(public *PublicBucketServer, nsID namespace.ID, baseDir string) *Server {
+	store := gcsemu.NewFileStore(baseDir)
+	return newServer(public, nsID.String(), store, false)
+}
+
+func newServer(public *PublicBucketServer, id string, store gcsemu.Store, isInMem bool) *Server {
+	return &Server{
+		public:   public,
+		id:       id,
+		store:    store,
+		emu:      gcsemu.NewGcsEmu(gcsemu.Options{Store: store}),
+		inMemory: isInMem,
+	}
+}
+
+func (s *Server) Initialize(md *meta.Data) error {
+	for _, bucket := range md.Buckets {
+		if err := s.emu.InitBucket(bucket.Name); err != nil {
+			return errors.Wrap(err, "initialize object storage bucket")
+		}
+	}
+	return nil
+}
+
+func (s *Server) Start() error {
+	return s.startOnce.Do(func() error {
+		if s.inMemory {
+			s.public.Register(s.id, s.store)
+		}
+		mux := http.NewServeMux()
+		ln, err := net.Listen("tcp", "127.0.0.1:0")
+		if err != nil {
+			return errors.Wrap(err, "listen tcp")
+		}
+		s.emu.Register(mux)
+		s.ln = ln
+		s.srv = &http.Server{Handler: mux}
+
+		go func() {
+			if err := s.srv.Serve(ln); !errors.Is(err, http.ErrServerClosed) {
+				log.Error().Err(err).Msg("unable to listen to gcs server")
+			}
+		}()
+
+		return nil
+	})
+}
+
+func (s *Server) Stop() {
+	_ = s.srv.Close()
+	if s.inMemory {
+		s.public.Deregister(s.id)
+	}
+}
+
+func (s *Server) Endpoint() string {
+	// Ensure the server has been started
+	if err := s.Start(); err != nil {
+		panic(err)
+	}
+	port := s.ln.Addr().(*net.TCPAddr).Port
+	return fmt.Sprintf("http://localhost:%d", port)
+}
+
+func (s *Server) PublicBaseURL() string {
+	return fmt.Sprintf("%s/%s", s.public.BaseAddr(), s.id)
+}
+
+// IsUsed reports whether the application uses object storage at all.
+func IsUsed(md *meta.Data) bool {
+	return len(md.Buckets) > 0
+}
diff --git a/cli/daemon/objects/public.go b/cli/daemon/objects/public.go
new file mode 100644
index 0000000000..f1003909b2
--- /dev/null
+++ b/cli/daemon/objects/public.go
@@ -0,0 +1,211 @@
+package objects
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"google.golang.org/api/storage/v1"
+
+	"encr.dev/pkg/emulators/storage/gcsemu"
+)
+
+// Fallback is a function that returns a store for a given namespace.
+// It is used for resolving namespace ids to stores, where
+// the store is not pre-registered by Register.
+type Fallback func(namespace string) (gcsemu.Store, bool)
+
+// NewPublicBucketServer creates a new PublicBucketServer.
+// If fallback is nil, no fallback will be used.
+func NewPublicBucketServer(baseAddr string, fallback Fallback) *PublicBucketServer {
+	mux := http.NewServeMux()
+	srv := &PublicBucketServer{
+		mux:        mux,
+		baseAddr:   baseAddr,
+		fallback:   fallback,
+		namespaces: make(map[string]gcsemu.Store),
+	}
+	mux.HandleFunc("/{namespace}/{bucket}/{object...}", srv.handler)
+	return srv
+}
+
+type PublicBucketServer struct {
+	mux      *http.ServeMux
+	baseAddr string
+	fallback Fallback
+
+	mu         sync.RWMutex
+	namespaces map[string]gcsemu.Store
+}
+
+func (s *PublicBucketServer) Serve(ln net.Listener) error {
+	return http.Serve(ln, s)
+}
+
+func (s *PublicBucketServer) Register(namespace string, store gcsemu.Store) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.namespaces[namespace] = store
+}
+
+func (s *PublicBucketServer) Deregister(namespace string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	delete(s.namespaces, namespace)
+}
+
+func (s *PublicBucketServer) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	s.mux.ServeHTTP(w, req)
+}
+
+func (s *PublicBucketServer) BaseAddr() string {
+	return s.baseAddr
+}
+
+func (s *PublicBucketServer) handler(w http.ResponseWriter, req *http.Request) {
+	nsID := req.PathValue("namespace")
+	bucketName := req.PathValue("bucket")
+	objName := req.PathValue("object")
+
+	// Determine which store to use
+	s.mu.RLock()
+	store, ok := s.namespaces[nsID]
+	s.mu.RUnlock()
+	if !ok && s.fallback != nil {
+		store, ok = s.fallback(nsID)
+	}
+	if !ok {
+		http.Error(w, "unknown namespace", http.StatusNotFound)
+		return
+	}
+	switch req.Method {
+	case "OPTIONS":
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Access-Control-Allow-Methods", "PUT, GET, HEAD")
+		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Content-Length, Content-Encoding, Date, X-Goog-Generation, X-Goog-Metageneration")
+		w.Header().Set("Access-Control-Expose-Headers", "Content-Type, Content-Length, Content-Encoding, Date, X-Goog-Generation, X-Goog-Metageneration")
+	case "GET", "HEAD":
+		_, isSigned := (queryLowerCase(req))["x-goog-signature"]
+		if isSigned {
+			err := validateGcsSignedRequest(req, time.Now())
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusBadRequest)
+				return
+			}
+		}
+		obj, contents, err := store.Get("", bucketName, objName)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		} else if obj == nil {
+			http.Error(w, "object not found", http.StatusNotFound)
+			return
+		}
+
+		if obj.ContentType != "" {
+			w.Header().Set("Content-Type", obj.ContentType)
+		}
+		if obj.Etag != "" {
+			w.Header().Set("Etag", obj.Etag)
+		}
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Access-Control-Expose-Headers", "Content-Type, Content-Length, Content-Encoding, Date, X-Goog-Generation, X-Goog-Metageneration")
+		w.Header().Set("Content-Length", strconv.Itoa(len(contents)))
+		w.Header().Set("Accept-Ranges", "bytes")
+
+		// Only write the body for GET requests, not HEAD
+		if req.Method == "GET" {
+			http.ServeContent(w, req, obj.Name, time.Time{}, bytes.NewReader(contents))
+		}
+	case "PUT":
+		err := validateGcsSignedRequest(req, time.Now())
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+
+		buf, err := io.ReadAll(req.Body)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		metaIn := parseObjectMeta(req)
+		err = store.Add(bucketName, objName, buf, &metaIn)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+
+		// Read back the object so we can add the etag value to the response.
+		metaOut, _, err := store.Get("", bucketName, objName)
+		if err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+			return
+		}
+		w.Header().Set("Access-Control-Allow-Origin", "*")
+		w.Header().Set("Access-Control-Expose-Headers", "Content-Type, Content-Length, Content-Encoding, Date, X-Goog-Generation, X-Goog-Metageneration")
+		w.Header().Set("Etag", metaOut.Etag)
+	default:
+		http.Error(w, "method not allowed", http.StatusBadRequest)
+	}
+}
+
+// Only GCS is supported for local development
+func validateGcsSignedRequest(req *http.Request, now time.Time) error {
+	const dateLayout = "20060102T150405Z"
+	const gracePeriod = time.Duration(30) * time.Second
+
+	query := queryLowerCase(req)
+
+	// We don't try to actually verify the signature, we only check that it's non-empty.
+
+	for _, s := range []string{
+		"x-goog-signature",
+		"x-goog-credential",
+		"x-goog-date",
+		"x-goog-expires"} {
+		if len(query[s]) <= 0 {
+			return fmt.Errorf("missing or empty query param %q", s)
+		}
+	}
+
+	t0, err := time.Parse(dateLayout, query["x-goog-date"])
+	if err != nil {
+		return errors.New("failed to parse x-goog-date")
+	}
+	if t0.After(now.Add(gracePeriod)) {
+		return errors.New("URL expiration base date is in the future")
+	}
+
+	td, err := strconv.Atoi(query["x-goog-expires"])
+	if err != nil {
+		return errors.New("failed to parse x-goog-expires value into an integer")
+	}
+	t := t0.Add(time.Duration(td) * time.Second)
+
+	if t.Before(now.Add(-gracePeriod)) {
+		return errors.New("URL is expired")
+	}
+
+	return nil
+}
+
+func queryLowerCase(req *http.Request) map[string]string {
+	query := map[string]string{}
+	for k, vs := range req.URL.Query() {
+		query[strings.ToLower(k)] = vs[0]
+	}
+	return query
+}
+
+func parseObjectMeta(req *http.Request) storage.Object {
+	return storage.Object{ContentType: req.Header.Get("Content-Type")}
+}
diff --git a/cli/daemon/pubsub/nsq.go b/cli/daemon/pubsub/nsq.go
new file mode 100644
index 0000000000..b4f589415e
--- /dev/null
+++ b/cli/daemon/pubsub/nsq.go
@@ -0,0 +1,133 @@
+package pubsub
+
+import (
+	"os"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+	"github.com/nsqio/go-nsq"
+	"github.com/nsqio/nsq/nsqd"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"go4.org/syncutil"
+)
+
+type NSQDaemon struct {
+	nsqd      *nsqd.NSQD
+	startOnce syncutil.Once
+
+	Opts *nsqd.Options
+}
+
+func (n *NSQDaemon) Stats() (*nsqd.Stats, error) {
+	if n.nsqd == nil {
+		return nil, errors.New("nsqd not started")
+	}
+	stats := n.nsqd.GetStats("", "", true)
+	return &stats, nil
+}
+
+func (n *NSQDaemon) isReady() error {
+	p, err := nsq.NewProducer(n.Addr(), nsq.NewConfig())
+	p.SetLogger(&logAdapter{"nsq producer"}, nsq.LogLevelWarning)
+	if err != nil {
+		return err
+	}
+	err = p.Ping()
+	p.Stop()
+	n.nsqd.GetError()
+	return err
+}
+
+func (n *NSQDaemon) Addr() string {
+	return n.nsqd.RealTCPAddr().String()
+}
+
+func (n *NSQDaemon) Start() error {
+	return n.startOnce.Do(func() error {
+		if n.Opts == nil {
+			n.Opts = nsqd.NewOptions()
+			tmpDir, err := os.MkdirTemp("", "encore-nsqd")
+			if err != nil {
+				return errors.Wrap(err, "failed to create tmp nsqd datapath")
+			}
+			n.Opts.DataPath = tmpDir
+
+			n.Opts.LogLevel = nsqd.LOG_WARN
+			n.Opts.Logger = &logAdapter{"nsqd"}
+
+			// Take the default address options and scope down to localhost (to prevent firewall warnings / permission requests)
+			// then set the port to 0 to allow any port to be used which is free
+			n.Opts.TCPAddress = "127.0.0.1:0"
+			n.Opts.HTTPAddress = "127.0.0.1:0"
+			n.Opts.HTTPSAddress = "127.0.0.1:0"
+			n.Opts.MaxMsgSize = 10 * 1024 * 1024 // 10MB
+		}
+		nsq, err := nsqd.New(n.Opts)
+		if err != nil {
+			return errors.Wrap(err, "failed to create new nsqd")
+		}
+		n.nsqd = nsq
+		go func() {
+			err = nsq.Main()
+			if err != nil {
+				log.Err(err).Msg("failed to start nsqd")
+			}
+		}()
+		// Ping the daemon to make sure it has started correctly
+		return n.isReady()
+	})
+}
+
+func (n *NSQDaemon) Stop() {
+	if n.nsqd != nil {
+		n.nsqd.Exit()
+	}
+}
+
+type logAdapter struct{ serviceName string }
+
+var _ nsqd.Logger = (*logAdapter)(nil)
+
+func (l *logAdapter) Output(maxdepth int, s string) error {
+	// Attempt to extract the level, start with cutting on ":"
+	lvl, logMsg, found := strings.Cut(s, ":")
+	if !found || strings.Contains(lvl, " ") {
+		// then if that fails or we have a space in that cut, try cutting on the first space
+		newLvl, suffix, _ := strings.Cut(lvl, " ")
+		lvl = newLvl
+
+		if found {
+			logMsg = suffix + ":" + logMsg
+		}
+	}
+
+	// Attempt to convert the level string to a zerolog level
+	logLevel := l.OutputLevel(lvl)
+	if logLevel == zerolog.NoLevel {
+		// and if that fails, then just log the message
+		logMsg = s
+	}
+
+	log.WithLevel(logLevel).Str("service", l.serviceName).Msg(strings.TrimSpace(logMsg))
+
+	return nil
+}
+
+func (l *logAdapter) OutputLevel(lvl string) zerolog.Level {
+	switch strings.ToLower(lvl) {
+	case "debug", "dbg":
+		return zerolog.DebugLevel
+	case "info", "inf":
+		return zerolog.InfoLevel
+	case "warn", "wrn":
+		return zerolog.WarnLevel
+	case "error", "err":
+		return zerolog.ErrorLevel
+	case "fatal":
+		return zerolog.FatalLevel
+	default:
+		log.Warn().Msg("unknown level: " + lvl)
+		return zerolog.NoLevel
+	}
+}
diff --git a/cli/daemon/pubsub/utils.go b/cli/daemon/pubsub/utils.go
new file mode 100644
index 0000000000..ca89e4eb4f
--- /dev/null
+++ b/cli/daemon/pubsub/utils.go
@@ -0,0 +1,10 @@
+package pubsub
+
+import (
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+// IsUsed reports whether the application uses pubsub at all.
+func IsUsed(md *meta.Data) bool {
+	return len(md.PubsubTopics) > 0
+}
diff --git a/cli/daemon/redis/redis.go b/cli/daemon/redis/redis.go
new file mode 100644
index 0000000000..439cd47d93
--- /dev/null
+++ b/cli/daemon/redis/redis.go
@@ -0,0 +1,104 @@
+package redis
+
+import (
+	mathrand "math/rand" // nosemgrep
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/cockroachdb/errors"
+	"go4.org/syncutil"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+type Server struct {
+	startOnce syncutil.Once
+	mini      *miniredis.Miniredis
+	cleanup   *time.Ticker
+	quit      chan struct{}
+	addr      string
+}
+
+const tickInterval = 1 * time.Second
+
+func New() *Server {
+	return &Server{
+		mini: miniredis.NewMiniRedis(),
+		quit: make(chan struct{}),
+	}
+}
+
+func (s *Server) Start() error {
+	return s.startOnce.Do(func() error {
+		if err := s.mini.Start(); err != nil {
+			return errors.Wrap(err, "failed to start redis server")
+		}
+		s.addr = s.mini.Addr()
+		s.cleanup = time.NewTicker(tickInterval)
+		go s.doCleanup()
+		return nil
+	})
+}
+func (s *Server) Stop() {
+	s.mini.Close()
+	s.cleanup.Stop()
+	close(s.quit)
+}
+
+func (s *Server) Miniredis() *miniredis.Miniredis {
+	return s.mini
+}
+
+func (s *Server) Addr() string {
+	// Ensure the server has been started
+	if err := s.Start(); err != nil {
+		panic(err)
+	}
+	return s.addr
+}
+
+func (s *Server) doCleanup() {
+	var acc time.Duration
+	const cleanupInterval = 15 * time.Second
+
+	for {
+		select {
+		case <-s.quit:
+			return
+		case <-s.cleanup.C:
+		}
+		s.mini.FastForward(tickInterval)
+
+		// Clean up keys every so often
+		acc += tickInterval
+		if acc > cleanupInterval {
+			acc -= cleanupInterval
+			s.clearKeys()
+		}
+	}
+}
+
+// clearKeys clears random keys to get the redis server
+// down to 100 persisted keys, as a simple way to bound
+// the max memory usage.
+func (s *Server) clearKeys() {
+	const maxKeys = 100
+	keys := s.mini.Keys()
+	if n := len(keys); n > maxKeys {
+		toDelete := n - maxKeys
+		deleted := 0
+		for deleted < toDelete {
+			id := mathrand.Intn(len(keys))
+			if keys[id] != "" {
+				s.mini.Del(keys[id])
+				keys[id] = "" // mark it as deleted
+				deleted++
+			}
+		}
+	}
+}
+
+// IsUsed reports whether the application uses redis at all.
+func IsUsed(md *meta.Data) bool {
+	return len(md.CacheClusters) > 0
+}
diff --git a/cli/daemon/run.go b/cli/daemon/run.go
index 5f7bb56582..d40d774278 100644
--- a/cli/daemon/run.go
+++ b/cli/daemon/run.go
@@ -1,281 +1,266 @@
 package daemon
 
 import (
-	"context"
+	"encoding/json"
 	"fmt"
-	"io/ioutil"
-	"os/exec"
-	"path/filepath"
+	"net"
+	"net/url"
+	"os"
+	"strings"
 	"time"
 
-	"encr.dev/cli/daemon/internal/appfile"
-	"encr.dev/cli/daemon/internal/manifest"
+	"github.com/logrusorgru/aurora/v3"
+	"github.com/rs/zerolog/log"
+
 	"encr.dev/cli/daemon/run"
-	"encr.dev/cli/daemon/sqldb"
-	"encr.dev/parser"
+	"encr.dev/internal/optracker"
+	"encr.dev/internal/userconfig"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/fns"
 	daemonpb "encr.dev/proto/encore/daemon"
-	meta "encr.dev/proto/encore/parser/meta/v1"
-	"github.com/rs/zerolog/log"
-	"golang.org/x/mod/modfile"
 )
 
 // Run runs the application.
 func (s *Server) Run(req *daemonpb.RunRequest, stream daemonpb.Daemon_RunServer) error {
-	sendErr := func(err error) {
-		stream.Send(&daemonpb.RunMessage{
-			Msg: &daemonpb.RunMessage_Output{Output: &daemonpb.CommandOutput{
-				Stderr: []byte(err.Error() + "\n"),
+	ctx := stream.Context()
+	slog := &streamLog{stream: stream, buffered: true}
+	stderr := slog.Stderr(false)
+
+	sendExit := func(code int32) {
+		_ = stream.Send(&daemonpb.CommandMessage{
+			Msg: &daemonpb.CommandMessage_Exit{Exit: &daemonpb.CommandExit{
+				Code: code,
 			}},
 		})
-		stream.Send(&daemonpb.RunMessage{
-			Msg: &daemonpb.RunMessage_Exit{Exit: &daemonpb.CommandExit{
-				Code: 1,
-			}},
-		})
-	}
-
-	// Prefetch secrets if the app is linked.
-	if appSlug, err := appfile.Slug(req.AppRoot); err == nil && appSlug != "" {
-		s.sm.Prefetch(appSlug)
 	}
 
-	// Parse the app to figure out what infrastructure is needed.
-	parse, err := s.parseApp(req.AppRoot, req.WorkingDir, false)
+	userConfig, err := userconfig.ForApp(req.AppRoot).Get()
 	if err != nil {
-		sendErr(err)
+		_, _ = fmt.Fprintln(stderr, aurora.Sprintf(aurora.Red("failed to load config: %v"), err))
+		sendExit(1)
 		return nil
 	}
 
-	man, err := manifest.ReadOrCreate(req.AppRoot)
+	ctx, tracer, err := s.beginTracing(ctx, req.AppRoot, req.WorkingDir, req.TraceFile)
 	if err != nil {
-		sendErr(err)
+		_, _ = fmt.Fprintln(stderr, aurora.Sprintf(aurora.Red("failed to begin tracing: %v"), err))
+		sendExit(1)
 		return nil
 	}
-	s.cacheAppRoot(man.AppID, req.AppRoot)
+	defer fns.CloseIgnore(tracer)
 
-	clusterID := man.AppID
-	dbSetupErr := make(chan error, 1)
-
-	// Set up the database only if the app requires it.
-	if requiresSQLDB(parse.Meta) {
-		cluster := s.cm.Init(stream.Context(), &sqldb.InitParams{
-			ClusterID: clusterID,
-			Meta:      parse.Meta,
-			Memfs:     false,
-		})
-		if _, err := exec.LookPath("docker"); err != nil {
-			sendErr(fmt.Errorf("This application requires docker to run since it uses an SQL database. Install docker first."))
-			return nil
+	// ListenAddr should always be passed but guard against old clients.
+	listenAddr := req.ListenAddr
+	if listenAddr == "" {
+		listenAddr = ":4000"
+	}
+	ln, err := net.Listen("tcp", listenAddr)
+	if err != nil {
+		if errIsAddrInUse(err) {
+			_, _ = fmt.Fprintln(stderr, aurora.Sprintf(aurora.Red("Failed to run on %s - port is already in use"), listenAddr))
+		} else {
+			_, _ = fmt.Fprintln(stderr, aurora.Sprintf(aurora.Red("Failed to run on %s - %v"), listenAddr, err))
 		}
 
-		if err := cluster.Start(streamLog{stream: runStreamAdapter{stream}}); err != nil {
-			sendErr(fmt.Errorf("Database setup failed: %v", err))
-			return nil
+		if host, port, ok := findAvailableAddr(listenAddr); ok {
+			if host == "localhost" || host == "127.0.0.1" {
+				_, _ = fmt.Fprintf(stderr, "Note: port %d is available; specify %s to use it\n",
+					port, aurora.Sprintf(aurora.Cyan("--port=%d"), port))
+			} else {
+				_, _ = fmt.Fprintf(stderr, "Note: address %s:%d is available; specify %s to use it\n",
+					host, port, aurora.Sprintf(aurora.Cyan("--listen=%s:%d"), host, port))
+			}
+		} else {
+			_, _ = fmt.Fprintf(stderr, "Note: specify %s to run on another port\n",
+				aurora.Cyan("--port=NUMBER"))
 		}
 
-		// Set up the database asynchronously since it can take a while.
-		go func() {
-			if err := cluster.CreateAndMigrate(stream.Context(), req.AppRoot, parse.Meta); err != nil {
-				dbSetupErr <- err
-			}
-		}()
+		sendExit(1)
+		return nil
 	}
+	defer fns.CloseIgnore(ln)
 
-	// Hold the stream mutex so we can set up the stream map
-	// before output starts.
-	s.mu.Lock()
-	run, err := s.mgr.Start(stream.Context(), run.StartParams{
-		AppRoot:     req.AppRoot,
-		AppID:       man.AppID,
-		WorkingDir:  req.WorkingDir,
-		DBClusterID: clusterID,
-		Parse:       parse,
-		Watch:       req.Watch,
-	})
+	app, err := s.apps.Track(req.AppRoot)
 	if err != nil {
-		s.mu.Unlock()
-		sendErr(err)
+		_, _ = fmt.Fprintln(stderr, aurora.Sprintf(aurora.Red("failed to resolve app: %v"), err))
+		sendExit(1)
 		return nil
 	}
-	s.streams[run.ID] = stream
-	s.mu.Unlock()
 
-	pid := run.Proc().Pid
-	_ = stream.Send(&daemonpb.RunMessage{
-		Msg: &daemonpb.RunMessage_Started{Started: &daemonpb.RunStarted{
-			RunId: run.ID,
-			Pid:   int32(pid),
-			Port:  int32(run.Port),
-		}},
-	})
-
-	// Wait for the run to close, or the database setup to fail.
-	select {
-	case <-run.Done():
-	case err := <-dbSetupErr:
-		log.Error().Err(err).Str("appID", run.AppID).Msg("failed to setup db")
-		sendErr(fmt.Errorf("Database setup failed: %v", err))
+	ns, err := s.namespaceOrActive(ctx, app, req.Namespace)
+	if err != nil {
+		_, _ = fmt.Fprintln(stderr, aurora.Sprintf(aurora.Red("failed to resolve namespace: %v"), err))
+		sendExit(1)
+		return nil
 	}
 
-	s.mu.Lock()
-	delete(s.streams, run.ID)
-	s.mu.Unlock()
-	return nil
-}
+	ops := optracker.New(stderr, stream)
+	defer ops.AllDone() // Kill the tracker when we exit this function
 
-// Test runs tests.
-func (s *Server) Test(req *daemonpb.TestRequest, stream daemonpb.Daemon_TestServer) error {
-	sendErr := func(err error) {
-		stream.Send(&daemonpb.CommandMessage{
-			Msg: &daemonpb.CommandMessage_Output{Output: &daemonpb.CommandOutput{
-				Stderr: []byte(err.Error() + "\n"),
-			}},
-		})
-		streamExit(stream, 1)
-	}
+	// Check for available update before we start the proc
+	// so the output from the proc doesn't race with our
+	// prints below.
+	newVer := s.availableUpdate()
 
-	// Prefetch secrets if the app is linked.
-	if appSlug, err := appfile.Slug(req.AppRoot); err == nil && appSlug != "" {
-		s.sm.Prefetch(appSlug)
-	}
+	// If force upgrade has been enabled, we force the upgrade now before we try and run the app
+	if newVer != nil && newVer.ForceUpgrade {
+		_, _ = fmt.Fprintf(stderr, aurora.Red("An urgent security update for Encore is available.").String()+"\n")
+		if newVer.SecurityNotes != "" {
+			_, _ = fmt.Fprintf(stderr, aurora.Sprintf(aurora.Yellow("%s"), newVer.SecurityNotes)+"\n")
+		}
 
-	// Parse the app to figure out what infrastructure is needed.
-	parse, err := s.parseApp(req.AppRoot, req.WorkingDir, true /* parse tests */)
-	if err != nil {
-		sendErr(err)
-		return nil
-	}
+		_, _ = fmt.Fprintf(stderr, "Upgrading Encore to %v...\n", newVer.Version())
+		if err := newVer.DoUpgrade(stderr, stderr); err != nil {
+			_, _ = fmt.Fprintf(stderr, aurora.Sprintf(aurora.Red("Upgrade failed: %v"), err)+"\n")
+		}
 
-	man, err := manifest.ReadOrCreate(req.AppRoot)
-	if err != nil {
-		sendErr(err)
+		slog.FlushBuffers()
+		sendExit(1) // Kill the client
+		os.Exit(1)  // Kill the daemon too
 		return nil
 	}
-	s.cacheAppRoot(man.AppID, req.AppRoot)
-
-	setupCtx, setupCancel := context.WithTimeout(context.Background(), 30*time.Second)
-	clusterID := man.AppID + "-test"
-	cluster := s.cm.Init(setupCtx, &sqldb.InitParams{
-		ClusterID: clusterID,
-		Memfs:     true,
-		Meta:      parse.Meta,
-	})
 
-	// Set up the database asynchronously since it can take a while.
-	dbSetupErr := make(chan error, 1)
-	go func() {
-		defer setupCancel()
-		if err := cluster.Start(streamLog{stream: stream}); err != nil {
-			dbSetupErr <- err
-		} else if err := cluster.Recreate(setupCtx, req.AppRoot, nil, parse.Meta); err != nil {
-			dbSetupErr <- err
-		}
-	}()
+	// Hold the stream mutex so we can set up the stream map
+	// before output starts.
+	s.mu.Lock()
 
-	testCtx, cancel := context.WithCancel(stream.Context())
-	defer cancel()
+	// If the listen addr contains no interface, render it as "localhost:port"
+	// instead of just ":port".
+	displayListenAddr := req.ListenAddr
+	if strings.HasPrefix(listenAddr, ":") {
+		displayListenAddr = "localhost" + req.ListenAddr
+	}
 
-	testResults := make(chan error, 1)
-	go func() {
-		testResults <- s.mgr.Test(testCtx, run.TestParams{
-			AppRoot:     req.AppRoot,
-			WorkingDir:  req.WorkingDir,
-			DBClusterID: clusterID,
-			Args:        req.Args,
-			Stdout:      &streamWriter{stream: stream, stderr: false},
-			Stderr:      &streamWriter{stream: stream, stderr: true},
-		})
-	}()
+	browser := run.BrowserModeFromProto(req.Browser)
+	if browser == run.BrowserModeAuto {
+		browser = run.BrowserModeFromConfig(userConfig)
+	}
 
-	select {
-	case err := <-dbSetupErr:
-		sendErr(err)
-		return nil
-	case err := <-testResults:
-		if err != nil {
-			sendErr(err)
+	runInstance, err := s.mgr.Start(ctx, run.StartParams{
+		App:        app,
+		NS:         ns,
+		WorkingDir: req.WorkingDir,
+		Listener:   ln,
+		ListenAddr: displayListenAddr,
+		Watch:      req.Watch,
+		Environ:    req.Environ,
+		OpsTracker: ops,
+		Browser:    browser,
+		Debug:      run.DebugModeFromProto(req.DebugMode),
+	})
+	if err != nil {
+		s.mu.Unlock()
+		if errList := run.AsErrorList(err); errList != nil {
+			_ = errList.SendToStream(stream)
 		} else {
-			streamExit(stream, 0)
+			errStr := err.Error()
+			if !strings.HasSuffix(errStr, "\n") {
+				errStr += "\n"
+			}
+			_, _ = stderr.Write([]byte(errStr))
 		}
+		sendExit(1)
 		return nil
 	}
-}
-
-// Check checks the app for compilation errors.
-func (s *Server) Check(req *daemonpb.CheckRequest, stream daemonpb.Daemon_CheckServer) error {
-	log := newStreamLogger(stream)
-	err := s.mgr.Check(stream.Context(), req.AppRoot, req.WorkingDir)
-	if err != nil {
-		log.Error().Msg(err.Error())
-		streamExit(stream, 1)
-	} else {
-		streamExit(stream, 0)
-	}
-	return nil
-}
-
-// OnStart implements run.EventListener.
-func (s *Server) OnStart(r *run.Run) {}
-
-// OnReload implements run.EventListener.
-func (s *Server) OnReload(r *run.Run) {}
-
-// OnStop implements run.EventListener.
-func (s *Server) OnStop(r *run.Run) {}
-
-// OnStdout implements run.EventListener.
-func (s *Server) OnStdout(r *run.Run, line []byte) {
-	s.mu.Lock()
-	stream, ok := s.streams[r.ID]
+	defer runInstance.Close()
+	s.streams[runInstance.ID] = slog
 	s.mu.Unlock()
 
-	if ok {
-		stream.Send(&daemonpb.RunMessage{Msg: &daemonpb.RunMessage_Output{
-			Output: &daemonpb.CommandOutput{Stdout: line},
-		}})
-	}
-}
+	ops.AllDone()
 
-// OnStderr implements run.EventListener.
-func (s *Server) OnStderr(r *run.Run, line []byte) {
-	s.mu.Lock()
-	stream, ok := s.streams[r.ID]
-	s.mu.Unlock()
+	secrets, _ := s.sm.Load(app).Get(ctx, nil)
+	externalDBs := map[string]string{}
+	for key, val := range secrets.Values {
+		if db, ok := strings.CutPrefix(key, "sqldb::"); ok {
+			var connCfg struct {
+				ConnString string `json:"connection_string"`
+			}
+			err := json.Unmarshal([]byte(val), &connCfg)
+			if err != nil {
+				log.Warn().Err(err).Str("key", key).Msg("failed to unmarshal connection string")
+				continue
+			}
+			connURL, err := url.Parse(connCfg.ConnString)
+			if err != nil {
+				log.Warn().Err(err).Str("key", key).Msg("failed to parse connection string")
+				continue
+			}
+			connURL.User = url.User(connURL.User.Username())
+			externalDBs[db] = connURL.String()
 
-	if ok {
-		stream.Send(&daemonpb.RunMessage{Msg: &daemonpb.RunMessage_Output{
-			Output: &daemonpb.CommandOutput{Stderr: line},
-		}})
+		}
 	}
-}
-
-// parseApp parses the app.
-func (s *Server) parseApp(appRoot, workingDir string, parseTests bool) (*parser.Result, error) {
-	modPath := filepath.Join(appRoot, "go.mod")
-	modData, err := ioutil.ReadFile(modPath)
-	if err != nil {
-		return nil, err
+	_, _ = stderr.Write([]byte("\n"))
+	_, _ = fmt.Fprintf(stderr, "  Encore development server running!\n\n")
+
+	_, _ = fmt.Fprintf(stderr, "  Your API is running at:     %s\n", aurora.Cyan("http://"+runInstance.ListenAddr))
+	_, _ = fmt.Fprintf(stderr, "  Development Dashboard URL:  %s\n", aurora.Cyan(fmt.Sprintf(
+		"%s/%s", s.mgr.DashBaseURL, app.PlatformOrLocalID())))
+	_, _ = fmt.Fprintf(stderr, "  MCP SSE URL:                %s\n", aurora.Cyan(fmt.Sprintf(
+		"%s/sse?appID=%s", s.mcp.BaseURL, app.PlatformOrLocalID())))
+
+	if ns := runInstance.NS; !ns.Active || ns.Name != "default" {
+		_, _ = fmt.Fprintf(stderr, "  Namespace:                  %s\n", aurora.Cyan(ns.Name))
+		if len(externalDBs) > 0 {
+			_, _ = fmt.Fprintln(stderr, "  External databases:")
+		}
 	}
-	mod, err := modfile.Parse(modPath, modData, nil)
-	if err != nil {
-		return nil, err
+	for db, connStr := range externalDBs {
+		_, _ = fmt.Fprintf(stderr, "     %s: %s\n", db, aurora.Cyan(connStr))
 	}
-
-	cfg := &parser.Config{
-		AppRoot:    appRoot,
-		Version:    "",
-		ModulePath: mod.Module.Mod.Path,
-		WorkingDir: workingDir,
-		ParseTests: parseTests,
+	if req.DebugMode == daemonpb.RunRequest_DEBUG_ENABLED {
+		// Print the pid for debugging. Currently we only support this if we have a default gateway.
+		if gw, ok := runInstance.ProcGroup().Gateways["api-gateway"]; ok {
+			_, _ = fmt.Fprintf(stderr, "  Process ID:                 %d\n", aurora.Cyan(gw.Pid))
+		}
+	}
+	// Log which experiments are enabled, if any
+	if exp := runInstance.ProcGroup().Experiments.List(); len(exp) > 0 {
+		strs := make([]string, len(exp))
+		for i, e := range exp {
+			strs[i] = string(e)
+		}
+		_, _ = fmt.Fprintf(stderr, "  Enabled experiment(s):      %s\n", aurora.Yellow(strings.Join(strs, ", ")))
 	}
-	return parser.Parse(cfg)
-}
 
-func requiresSQLDB(md *meta.Data) bool {
-	for _, svc := range md.Svcs {
-		if len(svc.Migrations) > 0 {
-			return true
+	// If there's a newer version available, print a message.
+	if newVer != nil {
+		if newVer.SecurityUpdate {
+			_, _ = stderr.Write([]byte(aurora.Sprintf(
+				aurora.Yellow("\n  New Encore release available with security updates: %s (you have %s)\n  Update with: encore version update\n"),
+				newVer.Version(), version.Version)))
+
+			if newVer.SecurityNotes != "" {
+				_, _ = stderr.Write([]byte(aurora.Sprintf(
+					aurora.Faint("\n  %s\n"),
+					newVer.SecurityNotes)))
+			}
+		} else {
+			_, _ = stderr.Write([]byte(aurora.Sprintf(
+				aurora.Faint("\n  New Encore release available: %s (you have %s)\n  Update with: encore version update\n"),
+				newVer.Version(), version.Version)))
 		}
 	}
-	return false
+	_, _ = stderr.Write([]byte("\n"))
+
+	slog.FlushBuffers()
+
+	go func() {
+		// Wait a little bit for the app to start
+		select {
+		case <-runInstance.Done():
+			return
+		case <-time.After(5 * time.Second):
+			if proc := runInstance.ProcGroup(); proc != nil {
+				showFirstRunExperience(runInstance, proc.Meta, stderr)
+			}
+		}
+	}()
+
+	<-runInstance.Done() // wait for run to complete
+
+	s.mu.Lock()
+	delete(s.streams, runInstance.ID)
+	s.mu.Unlock()
+	return nil
 }
diff --git a/cli/daemon/run/call.go b/cli/daemon/run/call.go
new file mode 100644
index 0000000000..c98608d045
--- /dev/null
+++ b/cli/daemon/run/call.go
@@ -0,0 +1,329 @@
+package run
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/rs/zerolog/log"
+	"github.com/tailscale/hujson"
+
+	"encr.dev/parser/encoding"
+	v1 "encr.dev/proto/encore/parser/meta/v1"
+)
+
+type ApiCallParams struct {
+	AppID         string
+	Service       string
+	Endpoint      string
+	Path          string
+	Method        string
+	Payload       []byte
+	AuthPayload   []byte `json:"auth_payload,omitempty"`
+	AuthToken     string `json:"auth_token,omitempty"`
+	CorrelationID string `json:"correlation_id,omitempty"`
+}
+
+func CallAPI(ctx context.Context, run *Run, p *ApiCallParams) (map[string]any, error) {
+	log := log.With().Str("app_id", p.AppID).Str("path", p.Path).Str("service", p.Service).Str("endpoint", p.Endpoint).Logger()
+	if run == nil {
+		log.Error().Str("app_id", p.AppID).Msg("dash: cannot make api call: app not running")
+		return nil, fmt.Errorf("app not running")
+	}
+	proc := run.ProcGroup()
+	if proc == nil {
+		log.Error().Str("app_id", p.AppID).Msg("dash: cannot make api call: app not running")
+		return nil, fmt.Errorf("app not running")
+	}
+
+	baseURL := "http://" + run.ListenAddr
+	req, err := prepareRequest(ctx, baseURL, proc.Meta, p)
+	if err != nil {
+		log.Error().Err(err).Msg("dash: unable to prepare request")
+		return nil, err
+	}
+
+	if p.CorrelationID != "" {
+		req.Header.Set("X-Correlation-ID", p.CorrelationID)
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		log.Error().Err(err).Msg("dash: api call failed")
+		return nil, err
+	}
+	body, _ := io.ReadAll(resp.Body)
+	_ = resp.Body.Close()
+
+	// Encode the body back into a Go style struct
+	if resp.StatusCode >= 200 && resp.StatusCode < 300 {
+		body = handleResponse(proc.Meta, p, resp.Header, body)
+	}
+
+	log.Info().Int("status", resp.StatusCode).Msg("dash: api call completed")
+	return map[string]interface{}{
+		"status":      resp.Status,
+		"status_code": resp.StatusCode,
+		"body":        body,
+		"trace_id":    resp.Header.Get("X-Encore-Trace-Id"),
+	}, nil
+}
+
+// findRPC finds the RPC with the given service and endpoint name.
+// If it cannot be found it reports nil.
+func findRPC(md *v1.Data, service, endpoint string) *v1.RPC {
+	for _, svc := range md.Svcs {
+		if svc.Name == service {
+			for _, rpc := range svc.Rpcs {
+				if rpc.Name == endpoint {
+					return rpc
+				}
+			}
+			break
+		}
+	}
+	return nil
+}
+
+// prepareRequest prepares a request for sending based on the given ApiCallParams.
+func prepareRequest(ctx context.Context, baseURL string, md *v1.Data, p *ApiCallParams) (*http.Request, error) {
+	reqSpec := newHTTPRequestSpec()
+	rpc := findRPC(md, p.Service, p.Endpoint)
+	if rpc == nil {
+		return nil, fmt.Errorf("unknown service/endpoint: %s/%s", p.Service, p.Endpoint)
+	}
+
+	rpcEncoding, err := encoding.DescribeRPC(md, rpc, nil)
+	if err != nil {
+		return nil, fmt.Errorf("describe rpc: %v", err)
+	}
+
+	// Add request encoding
+	{
+		reqEnc := rpcEncoding.RequestEncodingForMethod(p.Method)
+		if reqEnc == nil {
+			return nil, fmt.Errorf("unsupported method: %s (supports: %s)", p.Method, strings.Join(rpc.HttpMethods, ","))
+		}
+		if len(p.Payload) > 0 {
+			if err := addToRequest(reqSpec, p.Payload, reqEnc.ParameterEncodingMapByName()); err != nil {
+				return nil, fmt.Errorf("encode request params: %v", err)
+			}
+		}
+	}
+
+	// Add auth encoding, if any
+	if h := md.AuthHandler; h != nil {
+		auth, err := encoding.DescribeAuth(md, h.Params, nil)
+		if err != nil {
+			return nil, fmt.Errorf("describe auth: %v", err)
+		}
+		if auth.LegacyTokenFormat {
+			reqSpec.Header.Set("Authorization", "Bearer "+p.AuthToken)
+		} else {
+			if err := addToRequest(reqSpec, p.AuthPayload, auth.ParameterEncodingMapByName()); err != nil {
+				return nil, fmt.Errorf("encode auth params: %v", err)
+			}
+		}
+	}
+
+	var body io.Reader = nil
+	if reqSpec.Body != nil {
+		data, _ := json.Marshal(reqSpec.Body)
+		body = bytes.NewReader(data)
+		if reqSpec.Header["Content-Type"] == nil {
+			reqSpec.Header.Set("Content-Type", "application/json")
+		}
+	}
+
+	reqURL := baseURL + p.Path
+	if len(reqSpec.Query) > 0 {
+		reqURL += "?" + reqSpec.Query.Encode()
+	}
+
+	req, err := http.NewRequestWithContext(ctx, p.Method, reqURL, body)
+	if err != nil {
+		return nil, err
+	}
+	for k, v := range reqSpec.Header {
+		req.Header[k] = v
+	}
+	for _, c := range reqSpec.Cookies {
+		req.AddCookie(c)
+	}
+	return req, nil
+}
+
+func handleResponse(md *v1.Data, p *ApiCallParams, headers http.Header, body []byte) []byte {
+	rpc := findRPC(md, p.Service, p.Endpoint)
+	if rpc == nil {
+		return body
+	}
+
+	encodingOptions := &encoding.Options{}
+	rpcEncoding, err := encoding.DescribeRPC(md, rpc, encodingOptions)
+	if err != nil {
+		return body
+	}
+
+	decoded := map[string]json.RawMessage{}
+	if err := json.Unmarshal(body, &decoded); err != nil {
+		return body
+	}
+
+	members := make([]hujson.ObjectMember, 0)
+	if rpcEncoding.ResponseEncoding != nil {
+		for i, m := range rpcEncoding.ResponseEncoding.HeaderParameters {
+			value := headers.Get(m.Name)
+
+			var beforeExtra []byte
+			if i == 0 {
+				beforeExtra = []byte("\n    // HTTP Headers\n    ")
+			}
+
+			members = append(members, hujson.ObjectMember{
+				Name:  hujson.Value{Value: hujson.String(m.Name), BeforeExtra: beforeExtra},
+				Value: hujson.Value{Value: hujson.String(value)},
+			})
+		}
+
+		for i, m := range rpcEncoding.ResponseEncoding.BodyParameters {
+			value, ok := decoded[m.Name]
+			if !ok {
+				value = []byte("null")
+			}
+
+			var beforeExtra []byte
+			if i == 0 {
+				if len(rpcEncoding.ResponseEncoding.HeaderParameters) > 0 {
+					beforeExtra = []byte("\n\n    // JSON Payload\n    ")
+				} else {
+					beforeExtra = []byte("\n    ")
+				}
+			}
+
+			// nosemgrep: trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable
+			hValue, err := hujson.Parse(value)
+			if err != nil {
+				hValue = hujson.Value{Value: hujson.Literal(value)}
+			}
+
+			members = append(members, hujson.ObjectMember{
+				Name:  hujson.Value{Value: hujson.String(m.Name), BeforeExtra: beforeExtra},
+				Value: hValue,
+			})
+		}
+	}
+
+	value := hujson.Value{Value: &hujson.Object{Members: members}}
+	value.Format()
+	return value.Pack()
+}
+
+// httpRequestSpec specifies how the HTTP request should be generated.
+type httpRequestSpec struct {
+	// Body are the fields to encode as the JSON body.
+	// If nil, no body is added.
+	Body map[string]json.RawMessage
+
+	// Header are the HTTP headers to set in the request.
+	Header http.Header
+
+	// Query are the query string fields to set.
+	Query url.Values
+
+	// Cookies are the cookies to send.
+	Cookies []*http.Cookie
+}
+
+func newHTTPRequestSpec() *httpRequestSpec {
+	return &httpRequestSpec{
+		Body:   nil, // to distinguish between no body and "{}".
+		Header: make(http.Header),
+		Query:  make(url.Values),
+	}
+}
+
+// addToRequest decodes rawPayload and adds it to the request according to the given parameter encodings.
+// The body argument is where body parameters are added; other parameter locations are added
+// directly to the request object itself.
+func addToRequest(req *httpRequestSpec, rawPayload []byte, params map[string][]*encoding.ParameterEncoding) error {
+	payload, err := hujson.Parse(rawPayload)
+	if err != nil {
+		return fmt.Errorf("invalid payload: %v", err)
+	}
+	vals, ok := payload.Value.(*hujson.Object)
+	if !ok {
+		return fmt.Errorf("invalid payload: expected JSON object, got %s", payload.Pack())
+	}
+
+	seenKeys := make(map[string]int)
+
+	for _, kv := range vals.Members {
+		lit, _ := kv.Name.Value.(hujson.Literal)
+		key := lit.String()
+		val := kv.Value
+		val.Standardize()
+
+		if matches := params[key]; len(matches) > 0 {
+			// Get the index of this particular match, in case we have conflicts.
+			idx := seenKeys[key]
+			seenKeys[key]++
+			if idx < len(matches) {
+				param := matches[idx]
+				switch param.Location {
+				case encoding.Body:
+					if req.Body == nil {
+						req.Body = make(map[string]json.RawMessage)
+					}
+					req.Body[param.WireFormat] = val.Pack()
+
+				case encoding.Query:
+					switch v := val.Value.(type) {
+					case hujson.Literal:
+						req.Query.Add(param.WireFormat, v.String())
+					case *hujson.Array:
+						for _, elem := range v.Elements {
+							if lit, ok := elem.Value.(hujson.Literal); ok {
+								req.Query.Add(param.WireFormat, lit.String())
+							} else {
+								return fmt.Errorf("unsupported value type for query string array element: %T", elem.Value)
+							}
+						}
+					default:
+						return fmt.Errorf("unsupported value type for query string: %T", v)
+					}
+
+				case encoding.Header:
+					switch v := val.Value.(type) {
+					case hujson.Literal:
+						req.Header.Add(param.WireFormat, v.String())
+					default:
+						return fmt.Errorf("unsupported value type for query string: %T", v)
+					}
+
+				case encoding.Cookie:
+					switch v := val.Value.(type) {
+					case hujson.Literal:
+						// nosemgrep
+						req.Cookies = append(req.Cookies, &http.Cookie{
+							Name:  param.WireFormat,
+							Value: v.String(),
+						})
+					default:
+						return fmt.Errorf("unsupported value type for cookie: %T", v)
+					}
+
+				default:
+					return fmt.Errorf("unsupported parameter location %v", param.Location)
+				}
+			}
+		}
+	}
+
+	return nil
+}
diff --git a/cli/daemon/run/check.go b/cli/daemon/run/check.go
new file mode 100644
index 0000000000..2d68a95c6c
--- /dev/null
+++ b/cli/daemon/run/check.go
@@ -0,0 +1,109 @@
+package run
+
+import (
+	"context"
+	"runtime"
+
+	"github.com/cockroachdb/errors"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/builder/builderimpl"
+	"encr.dev/pkg/cueutil"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/vcs"
+)
+
+type CheckParams struct {
+	// App is the app to start.
+	App *apps.Instance
+
+	// WorkingDir is the working dir, for formatting
+	// error messages with relative paths.
+	WorkingDir string
+
+	// CodegenDebug, if true, specifies to keep the output
+	// around for codegen debugging purposes.
+	CodegenDebug bool
+
+	// Environ are the environment variables to set,
+	// in the same format as os.Environ().
+	Environ []string
+
+	// Tests specifies whether to parse and codegen for tests as well.
+	Tests bool
+}
+
+// Check checks the app for errors.
+// It reports a buildDir (if available) when codegenDebug is true.
+func (mgr *Manager) Check(ctx context.Context, p CheckParams) (buildDir string, err error) {
+	expSet, err := p.App.Experiments(p.Environ)
+	if err != nil {
+		return "", err
+	}
+
+	// TODO: We should check that all secret keys are defined as well.
+
+	vcsRevision := vcs.GetRevision(p.App.Root())
+	buildInfo := builder.BuildInfo{
+		BuildTags:          builder.LocalBuildTags,
+		CgoEnabled:         true,
+		StaticLink:         false,
+		DebugMode:          builder.DebugModeDisabled,
+		Environ:            p.Environ,
+		GOOS:               runtime.GOOS,
+		GOARCH:             runtime.GOARCH,
+		KeepOutput:         p.CodegenDebug,
+		Revision:           vcsRevision.Revision,
+		UncommittedChanges: vcsRevision.Uncommitted,
+
+		// Use the local JS runtime if this is a development build.
+		UseLocalJSRuntime: version.Channel == version.DevBuild,
+	}
+
+	bld := builderimpl.Resolve(p.App.Lang(), expSet)
+	defer fns.CloseIgnore(bld)
+	parse, err := bld.Parse(ctx, builder.ParseParams{
+		Build:       buildInfo,
+		App:         p.App,
+		Experiments: expSet,
+		WorkingDir:  p.WorkingDir,
+		ParseTests:  p.Tests,
+	})
+	if err != nil {
+		return "", err
+	}
+	if err := p.App.CacheMetadata(parse.Meta); err != nil {
+		return "", errors.Wrap(err, "cache metadata")
+	}
+
+	// Validate the service configs.
+	_, err = bld.ServiceConfigs(ctx, builder.ServiceConfigsParams{
+		Parse: parse,
+		CueMeta: &cueutil.Meta{
+			// Dummy data to satisfy config validation.
+			APIBaseURL: "http://localhost:0",
+			EnvName:    "encore-check",
+			EnvType:    cueutil.EnvType_Development,
+			CloudType:  cueutil.CloudType_Local,
+		},
+	})
+	if err != nil {
+		return "", err
+	}
+
+	result, err := bld.Compile(ctx, builder.CompileParams{
+		Build:       buildInfo,
+		App:         p.App,
+		Parse:       parse,
+		OpTracker:   nil, // TODO
+		Experiments: expSet,
+		WorkingDir:  p.WorkingDir,
+	})
+
+	if result != nil && len(result.Outputs) > 0 {
+		buildDir = result.Outputs[0].GetArtifactDir().ToIO()
+	}
+	return buildDir, err
+}
diff --git a/cli/daemon/run/errors.go b/cli/daemon/run/errors.go
new file mode 100644
index 0000000000..20b7757881
--- /dev/null
+++ b/cli/daemon/run/errors.go
@@ -0,0 +1,20 @@
+package run
+
+import (
+	"errors"
+
+	"encr.dev/pkg/errlist"
+	"encr.dev/v2/internals/perr"
+)
+
+func AsErrorList(err error) *errlist.List {
+	if errList := errlist.Convert(err); errList != nil {
+		return errList
+	}
+
+	list := &perr.ListAsErr{}
+	if errors.As(err, &list) {
+		return &errlist.List{List: list.ErrorList()}
+	}
+	return nil
+}
diff --git a/cli/daemon/run/exec_command.go b/cli/daemon/run/exec_command.go
new file mode 100644
index 0000000000..529a7ea098
--- /dev/null
+++ b/cli/daemon/run/exec_command.go
@@ -0,0 +1,193 @@
+package run
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"time"
+
+	"github.com/cockroachdb/errors"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/run/infra"
+	"encr.dev/internal/optracker"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/builder/builderimpl"
+	"encr.dev/pkg/cueutil"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/promise"
+	"encr.dev/pkg/vcs"
+)
+
+// ExecCommandParams groups the parameters for the ExecCommand method.
+type ExecCommandParams struct {
+	// App is the app to execute the script for.
+	App *apps.Instance
+
+	// NS is the namespace to use.
+	NS *namespace.Namespace
+
+	// Command to execute
+	Command string
+
+	// ScriptArgs are the arguments to pass to the script binary.
+	ScriptArgs []string
+
+	// WorkingDir is the working dir to execute the script from.
+	// It's relative to the app root.
+	WorkingDir string
+
+	// Environ are the environment variables to set when running the tests,
+	// in the same format as os.Environ().
+	Environ []string
+
+	// Stdout and Stderr are where "go test" output should be written.
+	Stdout, Stderr io.Writer
+
+	OpTracker *optracker.OpTracker
+}
+
+// ExecCommand executes the script.
+func (mgr *Manager) ExecCommand(ctx context.Context, p ExecCommandParams) (err error) {
+	expSet, err := p.App.Experiments(p.Environ)
+	if err != nil {
+		return err
+	}
+
+	rm := infra.NewResourceManager(p.App, mgr.ClusterMgr, mgr.ObjectsMgr, mgr.PublicBuckets, p.NS, p.Environ, mgr.DBProxyPort, false)
+	defer rm.StopAll()
+
+	tracker := p.OpTracker
+	jobs := optracker.NewAsyncBuildJobs(ctx, p.App.PlatformOrLocalID(), tracker)
+
+	// Parse the app to figure out what infrastructure is needed.
+	start := time.Now()
+	parseOp := tracker.Add("Building Encore application graph", start)
+	topoOp := tracker.Add("Analyzing service topology", start)
+
+	bld := builderimpl.Resolve(p.App.Lang(), expSet)
+	defer fns.CloseIgnore(bld)
+	vcsRevision := vcs.GetRevision(p.App.Root())
+	buildInfo := builder.BuildInfo{
+		BuildTags:          builder.LocalBuildTags,
+		CgoEnabled:         true,
+		StaticLink:         false,
+		DebugMode:          builder.DebugModeDisabled,
+		Environ:            p.Environ,
+		GOOS:               runtime.GOOS,
+		GOARCH:             runtime.GOARCH,
+		KeepOutput:         false,
+		Revision:           vcsRevision.Revision,
+		UncommittedChanges: vcsRevision.Uncommitted,
+
+		// Use the local JS runtime if this is a development build.
+		UseLocalJSRuntime: version.Channel == version.DevBuild,
+	}
+
+	parse, err := bld.Parse(ctx, builder.ParseParams{
+		Build:       buildInfo,
+		App:         p.App,
+		Experiments: expSet,
+		WorkingDir:  p.WorkingDir,
+		ParseTests:  false,
+	})
+	if err != nil {
+		// Don't use the error itself in tracker.Fail, as it will lead to duplicate error output.
+		tracker.Fail(parseOp, errors.New("parse error"))
+		return err
+	}
+	if err := p.App.CacheMetadata(parse.Meta); err != nil {
+		return errors.Wrap(err, "cache metadata")
+	}
+	tracker.Done(parseOp, 500*time.Millisecond)
+	tracker.Done(topoOp, 300*time.Millisecond)
+
+	rm.StartRequiredServices(jobs, parse.Meta)
+
+	var secrets map[string]string
+	if usesSecrets(parse.Meta) {
+		jobs.Go("Fetching application secrets", true, 150*time.Millisecond, func(ctx context.Context) error {
+			data, err := mgr.Secret.Load(p.App).Get(ctx, expSet)
+			if err != nil {
+				return err
+			}
+			secrets = data.Values
+			return nil
+		})
+	}
+
+	apiBaseURL := fmt.Sprintf("http://localhost:%d", mgr.RuntimePort)
+
+	configProm := promise.New(func() (*builder.ServiceConfigsResult, error) {
+		return bld.ServiceConfigs(ctx, builder.ServiceConfigsParams{
+			Parse: parse,
+			CueMeta: &cueutil.Meta{
+				APIBaseURL: apiBaseURL,
+				EnvName:    "local",
+				EnvType:    cueutil.EnvType_Development,
+				CloudType:  cueutil.CloudType_Local,
+			},
+		})
+	})
+
+	if err := jobs.Wait(); err != nil {
+		return err
+	}
+
+	gateways := make(map[string]GatewayConfig)
+	for _, gw := range parse.Meta.Gateways {
+		gateways[gw.EncoreName] = GatewayConfig{
+			BaseURL:   apiBaseURL,
+			Hostnames: []string{"localhost"},
+		}
+	}
+
+	cfg, err := configProm.Get(ctx)
+	if err != nil {
+		return err
+	}
+
+	authKey := genAuthKey()
+	configGen := &RuntimeConfigGenerator{
+		app:            p.App,
+		infraManager:   rm,
+		md:             parse.Meta,
+		AppID:          option.Some(GenID()),
+		EnvID:          option.Some(GenID()),
+		TraceEndpoint:  option.Some(fmt.Sprintf("http://localhost:%d/trace", mgr.RuntimePort)),
+		AuthKey:        authKey,
+		Gateways:       gateways,
+		DefinedSecrets: secrets,
+		SvcConfigs:     cfg.Configs,
+		IncludeMetaEnv: bld.NeedsMeta(),
+	}
+	procConf, err := configGen.AllInOneProc()
+	if err != nil {
+		return err
+	}
+	procEnv, err := configGen.ProcEnvs(procConf, bld.UseNewRuntimeConfig())
+	if err != nil {
+		return errors.Wrap(err, "compute proc envs")
+	}
+
+	defaultEnv := []string{"ENCORE_RUNTIME_LOG=error"}
+	env := append(defaultEnv, p.Environ...)
+	env = append(env, procConf.ExtraEnv...)
+	env = append(env, procEnv...)
+
+	tracker.AllDone()
+
+	// nosemgrep: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
+	cmd := exec.CommandContext(ctx, p.Command, p.ScriptArgs...)
+	cmd.Dir = filepath.Join(p.App.Root(), p.WorkingDir)
+	cmd.Stdout = p.Stdout
+	cmd.Stderr = p.Stderr
+	cmd.Env = env
+	return cmd.Run()
+}
diff --git a/cli/daemon/run/exec_script.go b/cli/daemon/run/exec_script.go
new file mode 100644
index 0000000000..ece65995f9
--- /dev/null
+++ b/cli/daemon/run/exec_script.go
@@ -0,0 +1,237 @@
+package run
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"time"
+
+	"github.com/cockroachdb/errors"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/run/infra"
+	encoreEnv "encr.dev/internal/env"
+	"encr.dev/internal/lookpath"
+	"encr.dev/internal/optracker"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/builder/builderimpl"
+	"encr.dev/pkg/cueutil"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/pkg/promise"
+	"encr.dev/pkg/vcs"
+)
+
+// ExecScriptParams groups the parameters for the ExecScript method.
+type ExecScriptParams struct {
+	// App is the app to execute the script for.
+	App *apps.Instance
+
+	// NS is the namespace to use.
+	NS *namespace.Namespace
+
+	// MainPkg is the package path to the command to execute.
+	MainPkg paths.Pkg
+
+	// ScriptArgs are the arguments to pass to the script binary.
+	ScriptArgs []string
+
+	// WorkingDir is the working dir to execute the script from.
+	// It's relative to the app root.
+	WorkingDir string
+
+	// Environ are the environment variables to set when running the tests,
+	// in the same format as os.Environ().
+	Environ []string
+
+	// Stdout and Stderr are where "go test" output should be written.
+	Stdout, Stderr io.Writer
+
+	OpTracker *optracker.OpTracker
+}
+
+// ExecScript executes the script.
+func (mgr *Manager) ExecScript(ctx context.Context, p ExecScriptParams) (err error) {
+	expSet, err := p.App.Experiments(p.Environ)
+	if err != nil {
+		return err
+	}
+
+	rm := infra.NewResourceManager(p.App, mgr.ClusterMgr, mgr.ObjectsMgr, mgr.PublicBuckets, p.NS, p.Environ, mgr.DBProxyPort, false)
+	defer rm.StopAll()
+
+	tracker := p.OpTracker
+	jobs := optracker.NewAsyncBuildJobs(ctx, p.App.PlatformOrLocalID(), tracker)
+
+	// Parse the app to figure out what infrastructure is needed.
+	start := time.Now()
+	parseOp := tracker.Add("Building Encore application graph", start)
+	topoOp := tracker.Add("Analyzing service topology", start)
+
+	bld := builderimpl.Resolve(p.App.Lang(), expSet)
+	defer fns.CloseIgnore(bld)
+	vcsRevision := vcs.GetRevision(p.App.Root())
+	buildInfo := builder.BuildInfo{
+		BuildTags:          builder.LocalBuildTags,
+		CgoEnabled:         true,
+		StaticLink:         false,
+		DebugMode:          builder.DebugModeDisabled,
+		Environ:            p.Environ,
+		GOOS:               runtime.GOOS,
+		GOARCH:             runtime.GOARCH,
+		KeepOutput:         false,
+		Revision:           vcsRevision.Revision,
+		UncommittedChanges: vcsRevision.Uncommitted,
+		MainPkg:            option.Some(p.MainPkg),
+
+		// Use the local JS runtime if this is a development build.
+		UseLocalJSRuntime: version.Channel == version.DevBuild,
+	}
+
+	parse, err := bld.Parse(ctx, builder.ParseParams{
+		Build:       buildInfo,
+		App:         p.App,
+		Experiments: expSet,
+		WorkingDir:  p.WorkingDir,
+		ParseTests:  false,
+	})
+	if err != nil {
+		// Don't use the error itself in tracker.Fail, as it will lead to duplicate error output.
+		tracker.Fail(parseOp, errors.New("parse error"))
+		return err
+	}
+	if err := p.App.CacheMetadata(parse.Meta); err != nil {
+		return errors.Wrap(err, "cache metadata")
+	}
+	tracker.Done(parseOp, 500*time.Millisecond)
+	tracker.Done(topoOp, 300*time.Millisecond)
+
+	rm.StartRequiredServices(jobs, parse.Meta)
+
+	var secrets map[string]string
+	if usesSecrets(parse.Meta) {
+		jobs.Go("Fetching application secrets", true, 150*time.Millisecond, func(ctx context.Context) error {
+			data, err := mgr.Secret.Load(p.App).Get(ctx, expSet)
+			if err != nil {
+				return err
+			}
+			secrets = data.Values
+			return nil
+		})
+	}
+
+	apiBaseURL := fmt.Sprintf("http://localhost:%d", mgr.RuntimePort)
+
+	configProm := promise.New(func() (*builder.ServiceConfigsResult, error) {
+		return bld.ServiceConfigs(ctx, builder.ServiceConfigsParams{
+			Parse: parse,
+			CueMeta: &cueutil.Meta{
+				APIBaseURL: apiBaseURL,
+				EnvName:    "local",
+				EnvType:    cueutil.EnvType_Development,
+				CloudType:  cueutil.CloudType_Local,
+			},
+		})
+	})
+
+	var build *builder.CompileResult
+	jobs.Go("Compiling application source code", false, 0, func(ctx context.Context) (err error) {
+		build, err = bld.Compile(ctx, builder.CompileParams{
+			Build:       buildInfo,
+			App:         p.App,
+			Parse:       parse,
+			OpTracker:   tracker,
+			Experiments: expSet,
+			WorkingDir:  p.WorkingDir,
+		})
+		if err != nil {
+			return errors.Wrap(err, "compile error on exec")
+		}
+		return nil
+	})
+
+	if err := jobs.Wait(); err != nil {
+		return err
+	}
+
+	gateways := make(map[string]GatewayConfig)
+	for _, gw := range parse.Meta.Gateways {
+		gateways[gw.EncoreName] = GatewayConfig{
+			BaseURL:   apiBaseURL,
+			Hostnames: []string{"localhost"},
+		}
+	}
+
+	outputs := build.Outputs
+	if len(outputs) != 1 {
+		return errors.New("ExecScript currently only supports a single build output")
+	}
+	entrypoints := outputs[0].GetEntrypoints()
+	if len(entrypoints) != 1 {
+		return errors.New("ExecScript currently only supports a single entrypoint")
+	}
+	proc := entrypoints[0].Cmd.Expand(outputs[0].GetArtifactDir())
+
+	cfg, err := configProm.Get(ctx)
+	if err != nil {
+		return err
+	}
+
+	authKey := genAuthKey()
+	configGen := &RuntimeConfigGenerator{
+		app:            p.App,
+		infraManager:   rm,
+		md:             parse.Meta,
+		AppID:          option.Some(GenID()),
+		EnvID:          option.Some(GenID()),
+		TraceEndpoint:  option.Some(fmt.Sprintf("http://localhost:%d/trace", mgr.RuntimePort)),
+		AuthKey:        authKey,
+		Gateways:       gateways,
+		DefinedSecrets: secrets,
+		SvcConfigs:     cfg.Configs,
+		IncludeMetaEnv: bld.NeedsMeta(),
+	}
+	procConf, err := configGen.AllInOneProc()
+	if err != nil {
+		return err
+	}
+	procEnv, err := configGen.ProcEnvs(procConf, bld.UseNewRuntimeConfig())
+	if err != nil {
+		return errors.Wrap(err, "compute proc envs")
+	}
+
+	env := append(os.Environ(), proc.Env...)
+	env = append(env, p.Environ...)
+	env = append(env, procConf.ExtraEnv...)
+
+	env = append(env, procEnv...)
+	env = append(env, encodeServiceConfigs(cfg.Configs)...)
+	if runtimeLibPath := encoreEnv.EncoreRuntimeLib(); runtimeLibPath != "" {
+		env = append(env, "ENCORE_RUNTIME_LIB="+runtimeLibPath)
+	}
+
+	tracker.AllDone()
+
+	cwd := filepath.Join(p.App.Root(), p.WorkingDir)
+	binary, err := lookpath.InDir(cwd, env, proc.Command[0])
+	if err != nil {
+		return err
+	}
+
+	args := append(slices.Clone(proc.Command[1:]), p.ScriptArgs...)
+	// nosemgrep: go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
+	cmd := exec.CommandContext(ctx, binary, args...)
+	cmd.Dir = filepath.Join(p.App.Root(), p.WorkingDir)
+	cmd.Stdout = p.Stdout
+	cmd.Stderr = p.Stderr
+	cmd.Env = env
+	return cmd.Run()
+}
diff --git a/cli/daemon/run/http.go b/cli/daemon/run/http.go
index 5beb87724c..e7d3730cba 100644
--- a/cli/daemon/run/http.go
+++ b/cli/daemon/run/http.go
@@ -1,77 +1,39 @@
 package run
 
 import (
-	"context"
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/binary"
 	"fmt"
-	"net"
 	"net/http"
-	"net/http/httputil"
-	"strconv"
-	"strings"
+	"time"
+
+	"encore.dev/appruntime/exported/config"
 )
 
 // ServeHTTP implements http.Handler by forwarding the request to the currently running process.
 func (r *Run) ServeHTTP(w http.ResponseWriter, req *http.Request) {
-	endpoint := strings.TrimLeft(req.URL.Path, "/")
-	if endpoint == "" {
-		// If this appears to be a browser, serve a redirect to the dashboard.
-		// Otherwise, give a helpful error message for terminals and such.
-		dashURL := fmt.Sprintf("http://localhost:%d/%s", r.mgr.DashPort, r.AppID)
-		if ua := req.Header.Get("User-Agent"); strings.Contains(ua, "Gecko") {
-			http.Redirect(w, req, dashURL, http.StatusFound)
-			return
-		}
-
-		http.Error(w, "No endpoint given. Make API calls to /service.Endpoint instead."+
-			"Visit the browser dashboard at: "+dashURL, http.StatusBadRequest)
-		return
-	}
-
-	proc := r.proc.Load().(*Proc)
-	proc.forwardReq(endpoint, w, req)
+	proc := r.proc.Load().(*ProcGroup)
+	proc.ProxyReq(w, req)
 }
 
-// forwardReq forwards the request to the Encore app.
-func (p *Proc) forwardReq(endpoint string, w http.ResponseWriter, req *http.Request) {
-	if req.Method == "OPTIONS" {
-		w.Header().Set("Access-Control-Allow-Origin", "*")
-		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
-		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
-		w.WriteHeader(200)
-		return
-	}
-	// director is a simplified version from httputil.NewSingleHostReverseProxy.
-	director := func(r *http.Request) {
-		r.URL.Scheme = "http"
-		r.URL.Host = "localhost:" + strconv.Itoa(p.Run.Port)
-		r.URL.Path = "/" + endpoint
-		r.URL.RawQuery = req.URL.RawQuery
-		if _, ok := r.Header["User-Agent"]; !ok {
-			// explicitly disable User-Agent so it's not set to default value
-			r.Header.Set("User-Agent", "")
-		}
-	}
-	// modifyResponse sets the appropriate CORS headers for local development.
-	modifyResponse := func(r *http.Response) error {
-		r.Header.Set("Access-Control-Allow-Origin", "*")
-		r.Header.Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
-		r.Header.Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
-		return nil
+func addAuthKeyToRequest(req *http.Request, authKey config.EncoreAuthKey) {
+	if req.Header == nil {
+		req.Header = make(http.Header)
 	}
 
-	// Create a transport that connects over yamux.
-	// Normally transports should be long-lived, but since we disable keep-alives
-	// and don't create real TCP connections we can get away with this.
-	transport := &http.Transport{
-		DisableKeepAlives: true,
-		DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
-			return p.client.Open()
-		},
-	}
+	date := time.Now().UTC().Format(http.TimeFormat)
+	req.Header.Set("Date", date)
 
-	(&httputil.ReverseProxy{
-		Director:       director,
-		ModifyResponse: modifyResponse,
-		Transport:      transport,
-	}).ServeHTTP(w, req)
+	mac := hmac.New(sha256.New, authKey.Data)
+	_, _ = fmt.Fprintf(mac, "%s\x00%s", date, req.URL.Path)
+
+	bytes := make([]byte, 4, 4+sha256.Size)
+	binary.BigEndian.PutUint32(bytes[0:4], authKey.KeyID)
+	bytes = mac.Sum(bytes)
+	auth := base64.RawStdEncoding.EncodeToString(bytes)
+	req.Header.Set("X-Encore-Auth", auth)
 }
+
+const TestHeaderDisablePlatformAuth = "X-Encore-Test-Disable-Platform-Auth"
diff --git a/cli/daemon/run/infra/encorecloudtesting.go b/cli/daemon/run/infra/encorecloudtesting.go
new file mode 100644
index 0000000000..66a40dd5cd
--- /dev/null
+++ b/cli/daemon/run/infra/encorecloudtesting.go
@@ -0,0 +1,56 @@
+package infra
+
+import (
+	"encoding/base64"
+	"strconv"
+
+	"github.com/cockroachdb/errors"
+
+	"go.encore.dev/platform-sdk/pkg/auth"
+
+	"encore.dev/appruntime/exported/config"
+)
+
+// setTestEncoreCloud sets the Encore Cloud API configuration to use a local
+// Encore Cloud API server.
+//
+// It returns true if one has been configured, or false if not.
+//
+// To use it the `encore run` command must be started with the following environment variables:
+// - ENCORECLOUD_LOCAL_SERVER: the URL of the local Encore Cloud API server
+// - ENCORECLOUD_LOCAL_KEY_ID: the ID of the key to use for authentication
+// - ENCORECLOUD_LOCAL_KEY_DATA: the base64-encoded data of the key to use for authentication
+func (rm *ResourceManager) setTestEncoreCloud(cfg *config.Runtime) (useLocalCloudServer bool, err error) {
+	localServer := rm.environ.Get("ENCORECLOUD_LOCAL_SERVER")
+	if localServer == "" {
+		return false, nil
+	}
+
+	// Get the key and secret
+	keyIDStr := rm.environ.Get("ENCORECLOUD_LOCAL_KEY_ID")
+	keyData64 := rm.environ.Get("ENCORECLOUD_LOCAL_KEY_DATA")
+	if keyIDStr == "" || keyData64 == "" {
+		return false, errors.New("ENCORECLOUD_LOCAL_KEY_ID and ENCORECLOUD_LOCAL_KEY_DATA must be set if using ENCORECLOUD_LOCAL_SERVER")
+	}
+
+	keyID, err := strconv.Atoi(keyIDStr)
+	if err != nil || keyID <= 0 {
+		return false, errors.New("ENCORECLOUD_LOCAL_KEY_ID must be a positive integer")
+	}
+
+	keyData, err := base64.StdEncoding.DecodeString(keyData64)
+	if err != nil {
+		return false, errors.New("ENCORECLOUD_LOCAL_KEY_DATA must be a valid base64 string")
+	}
+
+	cfg.EncoreCloudAPI = &config.EncoreCloudAPI{
+		Server: localServer,
+		AuthKeys: []auth.Key{
+			{
+				KeyID: uint32(keyID),
+				Data:  keyData,
+			},
+		},
+	}
+	return true, nil
+}
diff --git a/cli/daemon/run/infra/infra.go b/cli/daemon/run/infra/infra.go
new file mode 100644
index 0000000000..5f02ee11e3
--- /dev/null
+++ b/cli/daemon/run/infra/infra.go
@@ -0,0 +1,477 @@
+package infra
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+
+	"encore.dev/appruntime/exported/config"
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/objects"
+	"encr.dev/cli/daemon/pubsub"
+	"encr.dev/cli/daemon/redis"
+	"encr.dev/cli/daemon/sqldb"
+	"encr.dev/internal/optracker"
+	"encr.dev/pkg/environ"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+type Type string
+
+const (
+	PubSub  Type = "pubsub"
+	Cache   Type = "cache"
+	SQLDB   Type = "sqldb"
+	Objects Type = "objects"
+)
+
+const (
+	// this ID is used in the Encore Cloud README file as an example
+	// on how to create a topic resource
+	encoreCloudExampleTopicID = "res_0o9ioqnrirflhhm3t720"
+
+	// this ID is used in the Encore Cloud README file as a example
+	// on how to create a subscription on the above topic
+	encoreCloudExampleSubscriptionID = "res_0o9ioqnrirflhhm3t730"
+)
+
+// ResourceManager manages a set of infrastructure resources
+// to support the running Encore application.
+type ResourceManager struct {
+	app           *apps.Instance
+	dbProxyPort   int
+	sqlMgr        *sqldb.ClusterManager
+	objectsMgr    *objects.ClusterManager
+	publicBuckets *objects.PublicBucketServer
+	ns            *namespace.Namespace
+	environ       environ.Environ
+	log           zerolog.Logger
+	forTests      bool
+
+	mutex   sync.Mutex
+	servers map[Type]Resource
+}
+
+func NewResourceManager(app *apps.Instance, sqlMgr *sqldb.ClusterManager, objectsMgr *objects.ClusterManager, publicBuckets *objects.PublicBucketServer, ns *namespace.Namespace, environ environ.Environ, dbProxyPort int, forTests bool) *ResourceManager {
+	return &ResourceManager{
+		app:           app,
+		dbProxyPort:   dbProxyPort,
+		sqlMgr:        sqlMgr,
+		objectsMgr:    objectsMgr,
+		publicBuckets: publicBuckets,
+		ns:            ns,
+		environ:       environ,
+		forTests:      forTests,
+
+		servers: make(map[Type]Resource),
+		log:     log.With().Str("app_id", app.PlatformOrLocalID()).Logger(),
+	}
+}
+
+func (rm *ResourceManager) StopAll() {
+	rm.mutex.Lock()
+	defer rm.mutex.Unlock()
+
+	rm.log.Info().Int("num", len(rm.servers)).Msg("Stopping all resource services")
+
+	for _, daemon := range rm.servers {
+		daemon.Stop()
+	}
+}
+
+type Resource interface {
+	// Stop shuts down the resource.
+	Stop()
+}
+
+// StartRequiredServices will start the required services for the current application
+// if they are not already running based on the given parse result
+func (rm *ResourceManager) StartRequiredServices(a *optracker.AsyncBuildJobs, md *meta.Data) {
+	if sqldb.IsUsed(md) && rm.GetSQLCluster() == nil {
+		a.Go("Creating PostgreSQL database cluster", true, 300*time.Millisecond, rm.StartSQLCluster(a, md))
+	}
+
+	if pubsub.IsUsed(md) && rm.GetPubSub() == nil {
+		a.Go("Starting PubSub daemon", true, 250*time.Millisecond, rm.StartPubSub)
+	}
+
+	if redis.IsUsed(md) && rm.GetRedis() == nil {
+		a.Go("Starting Redis server", true, 250*time.Millisecond, rm.StartRedis)
+	}
+
+	if objects.IsUsed(md) && rm.GetObjects() == nil {
+		a.Go("Starting Object Storage server", true, 250*time.Millisecond, rm.StartObjects(md))
+	}
+}
+
+// StartPubSub starts a PubSub daemon.
+func (rm *ResourceManager) StartPubSub(ctx context.Context) error {
+	nsqd := &pubsub.NSQDaemon{}
+	err := nsqd.Start()
+	if err != nil {
+		return err
+	}
+
+	rm.mutex.Lock()
+	rm.servers[PubSub] = nsqd
+	rm.mutex.Unlock()
+	return nil
+}
+
+// GetPubSub returns the PubSub daemon if it is running otherwise it returns nil
+func (rm *ResourceManager) GetPubSub() *pubsub.NSQDaemon {
+	rm.mutex.Lock()
+	defer rm.mutex.Unlock()
+
+	if daemon, found := rm.servers[PubSub]; found {
+		return daemon.(*pubsub.NSQDaemon)
+	}
+	return nil
+}
+
+// StartRedis starts a Redis server.
+func (rm *ResourceManager) StartRedis(ctx context.Context) error {
+	srv := redis.New()
+	err := srv.Start()
+	if err != nil {
+		return err
+	}
+
+	rm.mutex.Lock()
+	rm.servers[Cache] = srv
+	rm.mutex.Unlock()
+	return nil
+}
+
+// GetRedis returns the Redis server if it is running otherwise it returns nil
+func (rm *ResourceManager) GetRedis() *redis.Server {
+	rm.mutex.Lock()
+	defer rm.mutex.Unlock()
+
+	if srv, found := rm.servers[Cache]; found {
+		return srv.(*redis.Server)
+	}
+	return nil
+}
+
+// StartObjects starts an Object Storage server.
+func (rm *ResourceManager) StartObjects(md *meta.Data) func(context.Context) error {
+	return func(ctx context.Context) error {
+		var srv *objects.Server
+		if rm.forTests {
+			srv = objects.NewInMemoryServer(rm.publicBuckets)
+		} else {
+			if rm.objectsMgr == nil {
+				return fmt.Errorf("StartObjects: no Object Storage cluster manager provided")
+			} else if rm.publicBuckets == nil {
+				return fmt.Errorf("StartObjects: no Object Storage public bucket server provided")
+			}
+			baseDir, err := rm.objectsMgr.BaseDir(rm.ns.ID)
+			if err != nil {
+				return err
+			}
+			srv = objects.NewDirServer(rm.publicBuckets, rm.ns.ID, baseDir)
+		}
+
+		if err := srv.Initialize(md); err != nil {
+			return err
+		} else if err := srv.Start(); err != nil {
+			return err
+		}
+
+		rm.mutex.Lock()
+		rm.servers[Objects] = srv
+		rm.mutex.Unlock()
+		return nil
+	}
+}
+
+// GetObjects returns the Object Storage server if it is running otherwise it returns nil
+func (rm *ResourceManager) GetObjects() *objects.Server {
+	rm.mutex.Lock()
+	defer rm.mutex.Unlock()
+
+	if srv, found := rm.servers[Objects]; found {
+		return srv.(*objects.Server)
+	}
+	return nil
+}
+
+func (rm *ResourceManager) StartSQLCluster(a *optracker.AsyncBuildJobs, md *meta.Data) func(ctx context.Context) error {
+	return func(ctx context.Context) error {
+		// This can be the case in tests.
+		if rm.sqlMgr == nil {
+			return fmt.Errorf("StartSQLCluster: no SQL Cluster manager provided")
+		}
+
+		typ := sqldb.Run
+		if rm.forTests {
+			typ = sqldb.Test
+		}
+
+		if err := rm.sqlMgr.Ready(); err != nil {
+			return err
+		}
+
+		cluster := rm.sqlMgr.Create(ctx, &sqldb.CreateParams{
+			ClusterID: sqldb.GetClusterID(rm.app, typ, rm.ns),
+			Memfs:     typ.Memfs(),
+		})
+
+		if _, err := cluster.Start(ctx, a.Tracker()); err != nil {
+			return errors.Wrap(err, "failed to start cluster")
+		}
+
+		rm.mutex.Lock()
+		rm.servers[SQLDB] = cluster
+		rm.mutex.Unlock()
+
+		// Set up the database asynchronously since it can take a while.
+		if rm.forTests {
+			a.Go("Recreating databases", true, 250*time.Millisecond, func(ctx context.Context) error {
+				err := cluster.Recreate(ctx, rm.app.Root(), nil, md)
+				if err != nil {
+					rm.log.Error().Err(err).Msg("failed to recreate db")
+					return err
+				}
+				return nil
+			})
+		} else {
+			a.Go("Running database migrations", true, 250*time.Millisecond, func(ctx context.Context) error {
+				err := cluster.SetupAndMigrate(ctx, rm.app.Root(), md.SqlDatabases)
+				if err != nil {
+					rm.log.Error().Err(err).Msg("failed to setup db")
+					return err
+				}
+				return nil
+			})
+		}
+
+		return nil
+	}
+}
+
+// GetSQLCluster returns the SQL cluster
+func (rm *ResourceManager) GetSQLCluster() *sqldb.Cluster {
+	rm.mutex.Lock()
+	defer rm.mutex.Unlock()
+
+	if cluster, found := rm.servers[SQLDB]; found {
+		return cluster.(*sqldb.Cluster)
+	}
+	return nil
+}
+
+// UpdateConfig updates the given config with infrastructure information.
+// Note that all the requisite services must have started up already,
+// which in practice means that (*optracker.AsyncBuildJobs).Wait must have returned first.
+func (rm *ResourceManager) UpdateConfig(cfg *config.Runtime, md *meta.Data, dbProxyPort int) error {
+	useLocalEncoreCloudAPIForTesting, err := rm.setTestEncoreCloud(cfg)
+	if err != nil {
+		return err
+	}
+
+	if cluster := rm.GetSQLCluster(); cluster != nil {
+		srv := &config.SQLServer{
+			Host: "localhost:" + strconv.Itoa(dbProxyPort),
+		}
+		serverID := len(cfg.SQLServers)
+		cfg.SQLServers = append(cfg.SQLServers, srv)
+
+		for _, db := range md.SqlDatabases {
+			cfg.SQLDatabases = append(cfg.SQLDatabases, &config.SQLDatabase{
+				ServerID:     serverID,
+				EncoreName:   db.Name,
+				DatabaseName: db.Name,
+				User:         "encore",
+				Password:     cluster.Password,
+			})
+		}
+
+		// Configure max connections based on 96 connections
+		// divided evenly among the databases
+		maxConns := 96 / len(cfg.SQLDatabases)
+		for _, db := range cfg.SQLDatabases {
+			db.MaxConnections = maxConns
+		}
+	}
+
+	if nsq := rm.GetPubSub(); nsq != nil {
+		provider := &config.PubsubProvider{
+			NSQ: &config.NSQProvider{
+				Host: nsq.Addr(),
+			},
+		}
+		providerID := len(cfg.PubsubProviders)
+		cfg.PubsubProviders = append(cfg.PubsubProviders, provider)
+
+		// If we're testing the Encore Cloud API locally, override from NSQ
+		if useLocalEncoreCloudAPIForTesting {
+			providerID = len(cfg.PubsubProviders)
+			cfg.PubsubProviders = append(cfg.PubsubProviders, &config.PubsubProvider{
+				EncoreCloud: &config.EncoreCloudPubsubProvider{},
+			})
+		}
+
+		cfg.PubsubTopics = make(map[string]*config.PubsubTopic)
+		for _, t := range md.PubsubTopics {
+			providerName := t.Name
+			if useLocalEncoreCloudAPIForTesting {
+				providerName = encoreCloudExampleTopicID
+			}
+
+			topicCfg := &config.PubsubTopic{
+				ProviderID:    providerID,
+				EncoreName:    t.Name,
+				ProviderName:  providerName,
+				Subscriptions: make(map[string]*config.PubsubSubscription),
+			}
+
+			for _, s := range t.Subscriptions {
+				subscriptionID := t.Name
+				if useLocalEncoreCloudAPIForTesting {
+					subscriptionID = encoreCloudExampleSubscriptionID
+				}
+
+				topicCfg.Subscriptions[s.Name] = &config.PubsubSubscription{
+					ID:           subscriptionID,
+					EncoreName:   s.Name,
+					ProviderName: s.Name,
+				}
+			}
+
+			cfg.PubsubTopics[t.Name] = topicCfg
+		}
+	}
+
+	if redis := rm.GetRedis(); redis != nil {
+		srv := &config.RedisServer{
+			Host: redis.Addr(),
+		}
+		serverID := len(cfg.RedisServers)
+		cfg.RedisServers = append(cfg.RedisServers, srv)
+
+		for _, cluster := range md.CacheClusters {
+			cfg.RedisDatabases = append(cfg.RedisDatabases, &config.RedisDatabase{
+				ServerID:   serverID,
+				Database:   0,
+				EncoreName: cluster.Name,
+				KeyPrefix:  cluster.Name + "/",
+			})
+		}
+	}
+
+	return nil
+}
+
+// SQLServerConfig returns the SQL server configuration.
+func (rm *ResourceManager) SQLServerConfig() (config.SQLServer, error) {
+	cluster := rm.GetSQLCluster()
+	if cluster == nil {
+		return config.SQLServer{}, errors.New("no SQL cluster found")
+	}
+
+	srvCfg := config.SQLServer{
+		Host: "localhost:" + strconv.Itoa(rm.dbProxyPort),
+	}
+
+	return srvCfg, nil
+}
+
+// SQLDatabaseConfig returns the SQL server and database configuration for the given database.
+func (rm *ResourceManager) SQLDatabaseConfig(db *meta.SQLDatabase) (config.SQLDatabase, error) {
+	cluster := rm.GetSQLCluster()
+	if cluster == nil {
+		return config.SQLDatabase{}, errors.New("no SQL cluster found")
+	}
+
+	dbCfg := config.SQLDatabase{
+		EncoreName:   db.Name,
+		DatabaseName: db.Name,
+		User:         "encore",
+		Password:     cluster.Password,
+	}
+
+	return dbCfg, nil
+}
+
+// PubSubProviderConfig returns the PubSub provider configuration.
+func (rm *ResourceManager) PubSubProviderConfig() (config.PubsubProvider, error) {
+	nsq := rm.GetPubSub()
+	if nsq == nil {
+		return config.PubsubProvider{}, errors.New("no PubSub server found")
+	}
+
+	return config.PubsubProvider{
+		NSQ: &config.NSQProvider{
+			Host: nsq.Addr(),
+		},
+	}, nil
+}
+
+// PubSubTopicConfig returns the PubSub provider and topic configuration for the given topic.
+func (rm *ResourceManager) PubSubTopicConfig(topic *meta.PubSubTopic) (config.PubsubProvider, config.PubsubTopic, error) {
+	providerCfg, err := rm.PubSubProviderConfig()
+	if err != nil {
+		return config.PubsubProvider{}, config.PubsubTopic{}, err
+	}
+
+	topicCfg := config.PubsubTopic{
+		EncoreName:    topic.Name,
+		ProviderName:  topic.Name,
+		Subscriptions: make(map[string]*config.PubsubSubscription),
+	}
+
+	return providerCfg, topicCfg, nil
+}
+
+// PubSubSubscriptionConfig returns the PubSub subscription configuration for the given subscription.
+func (rm *ResourceManager) PubSubSubscriptionConfig(_ *meta.PubSubTopic, sub *meta.PubSubTopic_Subscription) (config.PubsubSubscription, error) {
+	subCfg := config.PubsubSubscription{
+		ID:           sub.Name,
+		EncoreName:   sub.Name,
+		ProviderName: sub.Name,
+	}
+
+	return subCfg, nil
+}
+
+// RedisConfig returns the Redis server and database configuration for the given database.
+func (rm *ResourceManager) RedisConfig(redis *meta.CacheCluster) (config.RedisServer, config.RedisDatabase, error) {
+	server := rm.GetRedis()
+	if server == nil {
+		return config.RedisServer{}, config.RedisDatabase{}, errors.New("no Redis server found")
+	}
+
+	srvCfg := config.RedisServer{
+		Host: server.Addr(),
+	}
+
+	dbCfg := config.RedisDatabase{
+		EncoreName: redis.Name,
+		KeyPrefix:  redis.Name + "/",
+	}
+
+	return srvCfg, dbCfg, nil
+}
+
+// BucketProviderConfig returns the bucket provider configuration.
+func (rm *ResourceManager) BucketProviderConfig() (config.BucketProvider, string, error) {
+	obj := rm.GetObjects()
+	if obj == nil {
+		return config.BucketProvider{}, "", errors.New("no object storage found")
+	}
+
+	return config.BucketProvider{
+		GCS: &config.GCSBucketProvider{
+			Endpoint: obj.Endpoint(),
+		},
+	}, obj.PublicBaseURL(), nil
+}
diff --git a/cli/daemon/run/manager.go b/cli/daemon/run/manager.go
index 6ff0e07e40..54fad63170 100644
--- a/cli/daemon/run/manager.go
+++ b/cli/daemon/run/manager.go
@@ -2,28 +2,37 @@ package run
 
 import (
 	"fmt"
-	"net"
 	"sort"
-	"strconv"
 	"sync"
+	"time"
 
+	"github.com/cockroachdb/errors"
+	"github.com/rs/xid"
+
+	encore "encore.dev"
+	"encore.dev/appruntime/exported/config"
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/objects"
+	"encr.dev/cli/daemon/run/infra"
 	"encr.dev/cli/daemon/secret"
+	"encr.dev/cli/daemon/sqldb"
+	"encr.dev/pkg/errlist"
+	meta "encr.dev/proto/encore/parser/meta/v1"
 )
 
-// BasePort is the default port Encore apps start listening on.
-const BasePort = 4060
-
 // Manager manages the set of running applications.
 type Manager struct {
-	RuntimePort int // port for Encore runtime
-	DBProxyPort int // port for sqldb proxy
-	DashPort    int // port for dev dashboard
-	Secret      *secret.Manager
+	RuntimePort   int    // port for Encore runtime
+	DBProxyPort   int    // port for sqldb proxy
+	DashBaseURL   string // base url for the dev dashboard
+	Secret        *secret.Manager
+	ClusterMgr    *sqldb.ClusterManager
+	ObjectsMgr    *objects.ClusterManager
+	PublicBuckets *objects.PublicBucketServer
 
 	listeners []EventListener
-
-	mu   sync.Mutex
-	runs map[string]*Run // id -> run
+	mu        sync.Mutex
+	runs      map[string]*Run // id -> run
 }
 
 // EventListener is the interface for listening to events
@@ -31,6 +40,8 @@ type Manager struct {
 type EventListener interface {
 	// OnStart is called when a run starts.
 	OnStart(r *Run)
+	// OnCompileStart is called when a run starts compiling.
+	OnCompileStart(r *Run)
 	// OnReload is called when a run reloads.
 	OnReload(r *Run)
 	// OnStop is called when a run stops.
@@ -39,15 +50,17 @@ type EventListener interface {
 	OnStdout(r *Run, out []byte)
 	// OnStderr is called when a run outputs something on stderr.
 	OnStderr(r *Run, out []byte)
+	// OnError is called when a run encounters an error.
+	OnError(r *Run, err *errlist.List)
 }
 
 // FindProc finds the proc with the given id.
 // It reports nil if no such proc was found.
-func (mgr *Manager) FindProc(procID string) *Proc {
+func (mgr *Manager) FindProc(procID string) *ProcGroup {
 	mgr.mu.Lock()
 	defer mgr.mu.Unlock()
 	for _, run := range mgr.runs {
-		if p := run.Proc(); p != nil && p.ID == procID {
+		if p := run.ProcGroup(); p != nil && p.ID == procID {
 			return p
 		}
 	}
@@ -60,8 +73,13 @@ func (mgr *Manager) FindRunByAppID(appID string) *Run {
 	mgr.mu.Lock()
 	defer mgr.mu.Unlock()
 	for _, run := range mgr.runs {
-		if run.AppID == appID {
-			return run
+		if appID == run.App.PlatformID() || appID == run.App.LocalID() {
+			select {
+			case <-run.Done():
+				// exited
+			default:
+				return run
+			}
 		}
 	}
 	return nil
@@ -76,34 +94,17 @@ func (mgr *Manager) ListRuns() []*Run {
 	}
 	mgr.mu.Unlock()
 
-	sort.Slice(runs, func(i, j int) bool { return runs[i].AppID < runs[j].AppID })
+	sort.Slice(runs, func(i, j int) bool { return runs[i].App.PlatformOrLocalID() < runs[j].App.PlatformOrLocalID() })
 	return runs
 }
 
-// newListener attempts to find an unused port at BasePort or above
-// and opens a TCP listener on localhost for that port.
-func (mgr *Manager) newListener() (ln net.Listener, port int, err error) {
-	// Try up to 10 ports, plus however many processes we have
-	mgr.mu.Lock()
-	n := len(mgr.runs)
-	mgr.mu.Unlock()
-	for i := 0; i < (10 + n); i++ {
-		port := BasePort + i
-		ln, err := net.Listen("tcp", "localhost:"+strconv.Itoa(port))
-		if err == nil {
-			return ln, port, nil
-		}
-	}
-	return nil, 0, fmt.Errorf("could not find available port in %d-%d", BasePort, BasePort+(n+9))
-}
-
 // AddListener adds an event listener to mgr.
 // It must be called before starting the first run.
 func (mgr *Manager) AddListener(ln EventListener) {
 	mgr.listeners = append(mgr.listeners, ln)
 }
 
-func (mgr *Manager) runStdout(r *Run, out []byte) {
+func (mgr *Manager) RunStdout(r *Run, out []byte) {
 	// Make sure the run has started before we start outputting
 	<-r.started
 	for _, ln := range mgr.listeners {
@@ -111,10 +112,128 @@ func (mgr *Manager) runStdout(r *Run, out []byte) {
 	}
 }
 
-func (mgr *Manager) runStderr(r *Run, out []byte) {
+func (mgr *Manager) RunStderr(r *Run, out []byte) {
 	// Make sure the run has started before we start outputting
 	<-r.started
 	for _, ln := range mgr.listeners {
 		ln.OnStderr(r, out)
 	}
 }
+
+func (mgr *Manager) RunError(r *Run, err *errlist.List) {
+	for _, ln := range mgr.listeners {
+		ln.OnError(r, err)
+	}
+}
+
+type parseAppParams struct {
+	App           *apps.Instance
+	Environ       []string
+	WorkingDir    string
+	ParseTests    bool
+	ScriptMainPkg string
+}
+
+type generateConfigParams struct {
+	App  *apps.Instance
+	RM   *infra.ResourceManager
+	Meta *meta.Data
+
+	ForTests   bool
+	AuthKey    config.EncoreAuthKey
+	APIBaseURL string
+
+	ConfigAppID string
+	ConfigEnvID string
+
+	ExternalCalls bool
+}
+
+// generateServiceDiscoveryMap generates a map of service names to
+// where the Encore daemon is listening to forward to that service binary.
+func (mgr *Manager) generateServiceDiscoveryMap(p generateConfigParams) (map[string]config.Service, error) {
+	services := make(map[string]config.Service)
+
+	// Add all the services from the app
+	for _, svc := range p.Meta.Svcs {
+		services[svc.Name] = config.Service{
+			Name: svc.Name,
+			// For now all services are hosted by the same running instance
+			URL:         p.APIBaseURL,
+			Protocol:    config.Http,
+			ServiceAuth: mgr.getInternalServiceToServiceAuthMethod(),
+		}
+	}
+
+	return services, nil
+}
+
+// getInternalServiceToServiceAuthMethod returns the auth method to use
+// when making service to service calls locally.
+//
+// This currently just returns the noop auth method, but in the future
+// this function will allow us to use environmental variables to configure
+// the auth method and test different auth methods locally.
+func (mgr *Manager) getInternalServiceToServiceAuthMethod() config.ServiceAuth {
+	return config.ServiceAuth{Method: "encore-auth"}
+}
+
+func (mgr *Manager) generateConfig(p generateConfigParams) (*config.Runtime, error) {
+	envType := encore.EnvDevelopment
+	if p.ForTests {
+		envType = encore.EnvTest
+	}
+
+	globalCORS, err := p.App.GlobalCORS()
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to get global CORS")
+	}
+
+	deployID := xid.New().String()
+	if p.ForTests {
+		deployID = "clitest_" + deployID
+	} else {
+		deployID = "run_" + deployID
+	}
+
+	serviceDiscovery, err := mgr.generateServiceDiscoveryMap(p)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to generate service discovery map")
+	}
+
+	cfg := &config.Runtime{
+		AppID:         p.ConfigAppID,
+		AppSlug:       p.App.PlatformID(),
+		APIBaseURL:    p.APIBaseURL,
+		DeployID:      deployID,
+		DeployedAt:    time.Now().UTC(), // Force UTC to not cause confusion
+		EnvID:         p.ConfigEnvID,
+		EnvName:       "local",
+		EnvCloud:      string(encore.CloudLocal),
+		EnvType:       string(envType),
+		TraceEndpoint: fmt.Sprintf("http://localhost:%d/trace", mgr.RuntimePort),
+		AuthKeys:      []config.EncoreAuthKey{p.AuthKey},
+		CORS: &config.CORS{
+			Debug: globalCORS.Debug,
+			AllowOriginsWithCredentials: []string{
+				// Allow all origins with credentials for local development;
+				// since it's only running on localhost for development this is safe.
+				config.UnsafeAllOriginWithCredentials,
+			},
+			AllowOriginsWithoutCredentials: []string{"*"},
+			ExtraAllowedHeaders:            globalCORS.AllowHeaders,
+			ExtraExposedHeaders:            globalCORS.ExposeHeaders,
+			AllowPrivateNetworkAccess:      true,
+		},
+		ServiceDiscovery: serviceDiscovery,
+		ServiceAuth: []config.ServiceAuth{
+			mgr.getInternalServiceToServiceAuthMethod(),
+		},
+		DynamicExperiments: nil, // All experiments would be included in the static config here
+	}
+
+	if err := p.RM.UpdateConfig(cfg, p.Meta, mgr.DBProxyPort); err != nil {
+		return nil, err
+	}
+	return cfg, nil
+}
diff --git a/cli/daemon/run/manager_test.go b/cli/daemon/run/manager_test.go
deleted file mode 100644
index c34d0fc861..0000000000
--- a/cli/daemon/run/manager_test.go
+++ /dev/null
@@ -1,30 +0,0 @@
-package run
-
-import (
-	"testing"
-
-	qt "github.com/frankban/quicktest"
-	"go.uber.org/goleak"
-)
-
-// TestNewListener tests that newListener tries multiple ports.
-func TestNewListener(t *testing.T) {
-	defer goleak.VerifyNone(t, goleak.IgnoreCurrent())
-	c := qt.New(t)
-	mgr := &Manager{}
-
-	ln1, port1, err1 := mgr.newListener()
-	ln2, port2, err2 := mgr.newListener()
-	defer closeAll(ln1, ln2)
-	c.Assert(err1, qt.IsNil)
-	c.Assert(err2, qt.IsNil)
-	c.Assert(port1 >= BasePort && port1 <= (BasePort+10), qt.IsTrue)
-	c.Assert(port2, qt.Equals, port1+1)
-
-	// newListener should pick up the original port again once ln1 is closed.
-	ln1.Close()
-	ln3, port3, err3 := mgr.newListener()
-	defer closeAll(ln3)
-	c.Assert(err3, qt.IsNil)
-	c.Assert(port3, qt.Equals, port1)
-}
diff --git a/cli/daemon/run/proc_groups.go b/cli/daemon/run/proc_groups.go
new file mode 100644
index 0000000000..2ed5627d7b
--- /dev/null
+++ b/cli/daemon/run/proc_groups.go
@@ -0,0 +1,532 @@
+package run
+
+import (
+	"context"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/netip"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/apisdk/api/transport"
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/experiments"
+	"encr.dev/cli/daemon/internal/sym"
+	"encr.dev/internal/lookpath"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/noopgateway"
+	"encr.dev/pkg/noopgwdesc"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+type procGroupOptions struct {
+	Ctx         context.Context
+	ProcID      string           // unique process id
+	Run         *Run             // the run the process belongs to
+	Meta        *meta.Data       // app metadata snapshot
+	Experiments *experiments.Set // enabled experiments
+	AuthKey     config.EncoreAuthKey
+	Logger      RunLogger
+	WorkingDir  string
+	ConfigGen   *RuntimeConfigGenerator
+}
+
+func newProcGroup(opts procGroupOptions) *ProcGroup {
+	p := &ProcGroup{
+		ID:          opts.ProcID,
+		Run:         opts.Run,
+		Meta:        opts.Meta,
+		Experiments: opts.Experiments,
+		workingDir:  opts.WorkingDir,
+		ctx:         opts.Ctx,
+		logger:      opts.Logger,
+		log:         opts.Run.log.With().Str("proc_id", opts.ProcID).Logger(),
+		ConfigGen:   opts.ConfigGen,
+
+		symParsed: make(chan struct{}),
+		Services:  make(map[string]*Proc),
+		Gateways:  make(map[string]*Proc),
+		authKey:   opts.AuthKey,
+	}
+
+	p.procCond.L = &p.procMu
+	return p
+}
+
+// ProcGroup represents a running Encore application
+//
+// It is a collection of [Proc]'s that are all part of the same application,
+// where each [Proc] represents a one or more services or an API gateway.
+type ProcGroup struct {
+	ID          string           // unique process id
+	Run         *Run             // the run the process belongs to
+	Meta        *meta.Data       // app metadata snapshot
+	Experiments *experiments.Set // enabled experiments
+
+	Gateways map[string]*Proc // the gateway processes, by name (if any)
+	Services map[string]*Proc // all the service processes by name
+
+	ConfigGen *RuntimeConfigGenerator // generates runtime configuration
+
+	procMu       sync.Mutex // protects both allProcesses and runningProcs
+	procCond     sync.Cond  // used to signal a change in runningProcs
+	allProcesses []*Proc    // all processes in the group
+	runningProcs uint32     // number of running processes
+
+	ctx        context.Context
+	logger     RunLogger
+	log        zerolog.Logger
+	workingDir string
+
+	// Used for proxying requests when there is no gateway.
+	noopGW *noopgateway.Gateway
+
+	authKey   config.EncoreAuthKey
+	sym       *sym.Table
+	symErr    error
+	symParsed chan struct{} // closed when sym and symErr are set
+}
+
+func (pg *ProcGroup) ProxyReq(w http.ResponseWriter, req *http.Request) {
+	// Currently we only support proxying to the default gateway.
+	// Need to rethink how this should work when we support multiple gateways.
+	if gw, ok := pg.Gateways["api-gateway"]; ok {
+		gw.ProxyReq(w, req)
+	} else {
+		pg.noopGW.ServeHTTP(w, req)
+	}
+}
+
+// Done returns a channel that is closed when all processes in the group have exited.
+func (pg *ProcGroup) Done() <-chan struct{} {
+	c := make(chan struct{})
+	go func() {
+		pg.procMu.Lock()
+		defer pg.procMu.Unlock()
+
+		for pg.runningProcs > 0 {
+			// If we have more than one process, wait for one to exit
+			pg.procCond.Wait()
+		}
+
+		close(c)
+	}()
+
+	return c
+}
+
+// Start starts all the processes in the group.
+func (pg *ProcGroup) Start() (err error) {
+	pg.procMu.Lock()
+	defer pg.procMu.Unlock()
+
+	for _, p := range pg.allProcesses {
+		if err = p.start(); err != nil {
+			p.Kill()
+			return err
+		}
+	}
+
+	pg.noopGW = newNoopGateway(pg)
+	return nil
+}
+
+// Close closes the process and waits for it to shutdown.
+// It can safely be called multiple times.
+func (pg *ProcGroup) Close() {
+	var wg sync.WaitGroup
+	pg.procMu.Lock()
+	wg.Add(len(pg.allProcesses))
+	for _, p := range pg.allProcesses {
+		go func(p *Proc) {
+			p.Close()
+			wg.Done()
+		}(p)
+	}
+
+	pg.procMu.Unlock()
+
+	wg.Wait()
+}
+
+// Kill kills all the processes in the group.
+// It does not wait for them to exit.
+func (pg *ProcGroup) Kill() {
+	pg.procMu.Lock()
+	defer pg.procMu.Unlock()
+
+	for _, p := range pg.allProcesses {
+		p.Kill()
+	}
+}
+
+// parseSymTable parses the symbol table of the binary at binPath
+// and stores the result in p.sym and p.symErr.
+func (pg *ProcGroup) parseSymTable(binPath string) {
+	parse := func() (*sym.Table, error) {
+		f, err := os.Open(binPath)
+		if err != nil {
+			return nil, err
+		}
+		defer fns.CloseIgnore(f)
+		return sym.Load(f)
+	}
+
+	defer close(pg.symParsed)
+	pg.sym, pg.symErr = parse()
+}
+
+// SymTable waits for the proc's symbol table to be parsed and then returns it.
+// ctx is used to cancel the wait.
+func (pg *ProcGroup) SymTable(ctx context.Context) (*sym.Table, error) {
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	case <-pg.symParsed:
+		return pg.sym, pg.symErr
+	}
+}
+
+// newProc creates a new process in the group and sets up the required stuff in the struct
+func (pg *ProcGroup) newProc(processName string, listenAddr netip.AddrPort) (*Proc, error) {
+	dst := &url.URL{
+		Scheme: "http",
+		Host:   listenAddr.String(),
+	}
+	proxy := &httputil.ReverseProxy{
+		// Enable h2c for the proxy.
+		Transport: transport.NewH2CTransport(http.DefaultTransport),
+		Rewrite: func(r *httputil.ProxyRequest) {
+			r.SetURL(dst)
+			r.Out.Header["X-Forwarded-For"] = r.In.Header["X-Forwarded-For"]
+			r.SetXForwarded()
+			// Copy the host head over.
+			r.Out.Host = r.In.Host
+
+			// Add the auth key unless the test header is set.
+			if r.Out.Header.Get(TestHeaderDisablePlatformAuth) == "" {
+				addAuthKeyToRequest(r.Out, pg.authKey)
+			}
+		},
+	}
+
+	p := &Proc{
+		group:      pg,
+		log:        pg.log.With().Str("proc", processName).Logger(),
+		listenAddr: listenAddr,
+		httpProxy:  proxy,
+		exit:       make(chan struct{}),
+	}
+
+	pg.procMu.Lock()
+	pg.allProcesses = append(pg.allProcesses, p)
+	pg.procMu.Unlock()
+
+	return p, nil
+}
+
+func (pg *ProcGroup) NewAllInOneProc(spec builder.Cmd, listenAddr netip.AddrPort, env []string) error {
+	p, err := pg.newProc("all-in-one", listenAddr)
+	if err != nil {
+		return err
+	}
+
+	// Append both the command-specific env and the base environment.
+	env = append(env, spec.Env...)
+
+	cwd := filepath.Join(pg.Run.App.Root(), pg.workingDir)
+	binary, err := lookpath.InDir(cwd, env, spec.Command[0])
+	if err != nil {
+		return err
+	}
+
+	// This is safe since the command comes from our build.
+	// nosemgrep go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
+	cmd := exec.CommandContext(pg.ctx, binary, spec.Command[1:]...)
+	cmd.Env = env
+	cmd.Dir = cwd
+
+	// Proxy stdout and stderr to the given app logger, if any.
+	if l := pg.logger; l != nil {
+		cmd.Stdout = newLogWriter(pg.Run, l.RunStdout)
+		cmd.Stderr = newLogWriter(pg.Run, l.RunStderr)
+	}
+
+	p.cmd = cmd
+
+	// Assign all the gateways to this process.
+	for _, gw := range pg.Meta.Gateways {
+		pg.Gateways[gw.EncoreName] = p
+	}
+
+	return nil
+}
+
+func (pg *ProcGroup) NewProcForService(serviceName string, listenAddr netip.AddrPort, spec builder.Cmd, env []string) error {
+	if !listenAddr.IsValid() {
+		return errors.New("invalid listen address")
+	}
+
+	p, err := pg.newProc(serviceName, listenAddr)
+	if err != nil {
+		return err
+	}
+	pg.Services[serviceName] = p
+
+	// Append both the command-specific env and the base environment.
+	env = append(env, spec.Env...)
+
+	cwd := filepath.Join(pg.Run.App.Root(), pg.workingDir)
+	binary, err := lookpath.InDir(cwd, env, spec.Command[0])
+	if err != nil {
+		return err
+	}
+
+	// This is safe since the command comes from our build.
+	// nosemgrep go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
+	cmd := exec.CommandContext(pg.ctx, binary, spec.Command[1:]...)
+	cmd.Env = env
+	cmd.Dir = cwd
+
+	// Proxy stdout and stderr to the given app logger, if any.
+	if l := pg.logger; l != nil {
+		cmd.Stdout = newLogWriter(pg.Run, l.RunStdout)
+		cmd.Stderr = newLogWriter(pg.Run, l.RunStderr)
+	}
+
+	p.cmd = cmd
+
+	return nil
+}
+
+func (pg *ProcGroup) NewProcForGateway(gatewayName string, listenAddr netip.AddrPort, spec builder.Cmd, env []string) error {
+	if !listenAddr.IsValid() {
+		return errors.New("invalid listen address")
+	}
+
+	p, err := pg.newProc("gateway-"+gatewayName, listenAddr)
+	if err != nil {
+		return err
+	}
+	pg.Gateways[gatewayName] = p
+
+	// Append both the command-specific env and the base environment.
+	env = append(env, spec.Env...)
+
+	cwd := filepath.Join(pg.Run.App.Root(), pg.workingDir)
+	binary, err := lookpath.InDir(cwd, env, spec.Command[0])
+	if err != nil {
+		return err
+	}
+
+	// This is safe since the command comes from our build.
+	// nosemgrep go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
+	cmd := exec.CommandContext(pg.ctx, binary, spec.Command[1:]...)
+	cmd.Env = env
+	cmd.Dir = cwd
+
+	// Bound the wait time to esure prompt live reload if something goes wrong
+	// with IO copying.
+	cmd.WaitDelay = 500 * time.Millisecond
+
+	// Proxy stdout and stderr to the given app logger, if any.
+	if l := pg.logger; l != nil {
+		cmd.Stdout = newLogWriter(pg.Run, l.RunStdout)
+		cmd.Stderr = newLogWriter(pg.Run, l.RunStderr)
+	}
+
+	p.cmd = cmd
+
+	return nil
+}
+
+type warning struct {
+	Title string
+	Help  string
+}
+
+func (pg *ProcGroup) Warnings() (rtn []warning) {
+	if missing := pg.ConfigGen.MissingSecrets(); len(missing) > 0 {
+		rtn = append(rtn, warning{
+			Title: "secrets not defined: " + strings.Join(missing, ", "),
+			Help:  "undefined secrets are left empty for local development only.\nsee https://encore.dev/docs/primitives/secrets for more information",
+		})
+	}
+
+	return rtn
+}
+
+// Proc represents a single Encore process running within a [ProcGroup].
+type Proc struct {
+	group *ProcGroup     // The group this process belongs to
+	log   zerolog.Logger // The logger for this process
+	exit  chan struct{}  // closed when the process has exited
+	cmd   *exec.Cmd      // The command for this specific process
+
+	listenAddr netip.AddrPort         // The port the HTTP server of the process should listen on
+	httpProxy  *httputil.ReverseProxy // The reverse proxy for the HTTP server of the process
+
+	// The following fields are only valid after Start() has been called.
+	Started   atomic.Bool // whether the process has started
+	StartedAt time.Time   // when the process started
+	Pid       int         // the OS process id
+}
+
+// Start starts the process and returns immediately.
+//
+// If the process has already been started, this is a no-op.
+func (p *Proc) Start() error {
+	p.group.procMu.Lock()
+	defer p.group.procMu.Unlock()
+
+	return p.start()
+}
+
+// start starts the process and returns immediately
+//
+// It must be called while locked under the p.group.procMu lock.
+func (p *Proc) start() error {
+	if !p.Started.CompareAndSwap(false, true) {
+		return nil
+	}
+
+	if err := p.cmd.Start(); err != nil {
+		return errors.Wrap(err, "could not start process")
+	}
+	p.log.Info().Str("addr", p.listenAddr.String()).Msg("process started")
+	p.group.runningProcs++
+
+	p.Pid = p.cmd.Process.Pid
+	p.StartedAt = time.Now()
+
+	// Start watching the process for when it quits.
+	go func() {
+		defer close(p.exit)
+
+		// Wait for the process to exit.
+		err := p.cmd.Wait()
+		if err != nil && p.group.ctx.Err() == nil {
+			p.log.Error().Err(err).Msg("process exited with error")
+		} else {
+			p.log.Info().Msg("process exited successfully")
+		}
+
+		// Flush the logs in case the output did not end in a newline.
+		for _, w := range [...]io.Writer{p.cmd.Stdout, p.cmd.Stderr} {
+			if w != nil {
+				w.(*logWriter).Flush()
+			}
+		}
+	}()
+
+	// When the process exits, decrement the running count for the group
+	// and wake up any goroutines waiting for on the running count to shrink
+	go func() {
+		<-p.exit
+		p.group.procMu.Lock()
+		defer p.group.procMu.Unlock()
+		p.group.runningProcs--
+
+		p.group.procCond.Broadcast()
+	}()
+
+	return nil
+}
+
+// Close closes the process and waits for it to exit.
+// It is safe to call Close multiple times.
+func (p *Proc) Close() {
+	if err := p.cmd.Process.Signal(os.Interrupt); err != nil {
+		// If there's an error sending the signal, just kill the process.
+		// This might happen because Interrupt is not supported on Windows.
+		p.Kill()
+	}
+
+	timer := time.NewTimer(gracefulShutdownTime + (500 * time.Millisecond))
+	defer timer.Stop()
+
+	select {
+	case <-p.exit:
+		// already exited
+	case <-timer.C:
+		p.group.log.Error().Msg("timed out waiting for process to exit; killing")
+		p.Kill()
+		<-p.exit
+	}
+}
+
+// ProxyReq proxies the request to the Encore app.
+func (p *Proc) ProxyReq(w http.ResponseWriter, req *http.Request) {
+	p.httpProxy.ServeHTTP(w, req)
+}
+
+// Kill causes the Process to exit immediately. Kill does not wait until
+// the Process has actually exited. This only kills the Process itself,
+// not any other processes it may have started.
+func (p *Proc) Kill() {
+	if p.cmd != nil && p.cmd.Process != nil {
+		_ = p.cmd.Process.Kill()
+	}
+}
+
+// pollUntilProcessIsListening polls the listen address until
+// the process is actively listening, five seconds have passed,
+// or the context is canceled, whichever happens first.
+//
+// It reports true if the process is listening on return, false otherwise.
+func (p *Proc) pollUntilProcessIsListening(ctx context.Context) (ok bool) {
+	b := backoff.NewExponentialBackOff()
+	b.InitialInterval = 50 * time.Millisecond
+	b.MaxInterval = 250 * time.Millisecond
+	b.MaxElapsedTime = 5 * time.Second
+
+	err := backoff.Retry(func() error {
+		if err := ctx.Err(); err != nil {
+			return backoff.Permanent(err)
+		}
+
+		conn, err := (&net.Dialer{}).DialContext(ctx, "tcp", p.listenAddr.String())
+		if err == nil {
+			_ = conn.Close()
+		}
+		return err
+	}, b)
+	return err == nil
+}
+
+func newNoopGateway(pg *ProcGroup) *noopgateway.Gateway {
+	svcDiscovery := make(map[noopgateway.ServiceName]string)
+	for _, svc := range pg.Meta.Svcs {
+		if proc, ok := pg.Services[svc.Name]; ok {
+			svcDiscovery[noopgateway.ServiceName(svc.Name)] = proc.listenAddr.String()
+		}
+	}
+
+	desc := noopgwdesc.Describe(pg.Meta, svcDiscovery)
+	gw := noopgateway.New(desc)
+
+	gw.Rewrite = func(rp *httputil.ProxyRequest) {
+		// Copy the host head over.
+		rp.Out.Host = rp.In.Host
+
+		// Add the auth key unless the test header is set.
+		if rp.Out.Header.Get(TestHeaderDisablePlatformAuth) == "" {
+			addAuthKeyToRequest(rp.Out, pg.authKey)
+		}
+	}
+
+	return gw
+}
diff --git a/cli/daemon/run/run.go b/cli/daemon/run/run.go
index b28b64af1b..fabccdfdc9 100644
--- a/cli/daemon/run/run.go
+++ b/cli/daemon/run/run.go
@@ -6,105 +6,177 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/base64"
+	"encoding/binary"
 	"fmt"
-	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
+	"net/netip"
+	"runtime"
+	"slices"
 	"sort"
-	"strconv"
+	"strings"
 	"sync/atomic"
 	"time"
 
+	"github.com/cockroachdb/errors"
+	"github.com/logrusorgru/aurora/v3"
+	"github.com/rs/xid"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
-	"golang.org/x/mod/modfile"
-
-	"encr.dev/cli/daemon/internal/appfile"
-	"encr.dev/cli/internal/env"
-	"encr.dev/cli/internal/xos"
-	"encr.dev/compiler"
-	"encr.dev/parser"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/h2c"
+	"golang.org/x/sync/errgroup"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/experiments"
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/run/infra"
+	"encr.dev/cli/daemon/secret"
+	"encr.dev/internal/optracker"
+	"encr.dev/internal/userconfig"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/builder/builderimpl"
+	"encr.dev/pkg/cueutil"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/promise"
+	"encr.dev/pkg/svcproxy"
+	"encr.dev/pkg/vcs"
+	daemonpb "encr.dev/proto/encore/daemon"
 	meta "encr.dev/proto/encore/parser/meta/v1"
-	"github.com/hashicorp/yamux"
 )
 
 // Run represents a running Encore application.
 type Run struct {
-	ID      string // unique ID for this instance of the running app
-	AppID   string // unique identifier for the app
-	AppSlug string // the optional app slug, if linked to encore.dev
-	Root    string // the filesystem path to the app root
-	Port    int    // the port the app is listening on
-
+	ID              string // unique ID for this instance of the running app
+	App             *apps.Instance
+	ListenAddr      string // the address the app is listening on
+	SvcProxy        *svcproxy.SvcProxy
+	ResourceManager *infra.ResourceManager
+	NS              *namespace.Namespace
+
+	Builder builder.Impl
 	log     zerolog.Logger
-	mgr     *Manager
-	params  *StartParams
+	Mgr     *Manager
+	Params  *StartParams
+	secrets *secret.LoadResult
+
 	ctx     context.Context // ctx is closed when the run is to exit
 	proc    atomic.Value    // current process
 	exited  chan struct{}   // exit is closed when the run has fully exited
 	started chan struct{}   // started is closed once the run has fully started
-
 }
 
 // StartParams groups the parameters for the Run method.
 type StartParams struct {
-	// AppRoot is the application root.
-	AppRoot string
+	// App is the app to start.
+	App *apps.Instance
 
-	// AppID is the unique app id, as defined by the manifest.
-	AppID string
+	// NS is the namespace to use.
+	NS *namespace.Namespace
 
 	// WorkingDir is the working dir, for formatting
 	// error messages with relative paths.
 	WorkingDir string
 
-	// DBClusterID is the database cluster id to connect to.
-	DBClusterID string
-
-	// Parse is the parse result for the initial run of the app.
-	// If nil the app is parsed before starting.
-	Parse *parser.Result
-
 	// Watch enables watching for code changes for live reloading.
 	Watch bool
+
+	Listener   net.Listener // listener to use
+	ListenAddr string       // address we're listening on
+
+	// Environ are the environment variables to set for the running app,
+	// in the same format as os.Environ().
+	Environ []string
+
+	// The Ops tracker being used for this run
+	OpsTracker *optracker.OpTracker
+
+	// Browser specifies the browser mode to use.
+	Browser BrowserMode
+
+	// Debug specifies to compile the application for debugging.
+	Debug builder.DebugMode
+}
+
+// BrowserMode specifies how to open the browser when starting 'encore run'.
+type BrowserMode int
+
+const (
+	BrowserModeAuto   BrowserMode = iota // open if not already open
+	BrowserModeNever                     // never open
+	BrowserModeAlways                    // always open
+)
+
+func BrowserModeFromConfig(cfg *userconfig.Config) BrowserMode {
+	switch cfg.RunBrowser {
+	case "never":
+		return BrowserModeNever
+	case "always":
+		return BrowserModeAlways
+	default:
+		return BrowserModeAuto
+	}
+}
+
+func BrowserModeFromProto(b daemonpb.RunRequest_BrowserMode) BrowserMode {
+	switch b {
+	case daemonpb.RunRequest_BROWSER_AUTO:
+		return BrowserModeAuto
+	case daemonpb.RunRequest_BROWSER_NEVER:
+		return BrowserModeNever
+	case daemonpb.RunRequest_BROWSER_ALWAYS:
+		return BrowserModeAlways
+	default:
+		return BrowserModeAuto
+	}
+}
+
+func DebugModeFromProto(d daemonpb.RunRequest_DebugMode) builder.DebugMode {
+	switch d {
+	case daemonpb.RunRequest_DEBUG_DISABLED:
+		return builder.DebugModeDisabled
+	case daemonpb.RunRequest_DEBUG_ENABLED:
+		return builder.DebugModeEnabled
+	case daemonpb.RunRequest_DEBUG_BREAK:
+		return builder.DebugModeBreak
+	default:
+		return builder.DebugModeDisabled
+	}
 }
 
 // Start starts the application.
 // Its lifetime is bounded by ctx.
 func (mgr *Manager) Start(ctx context.Context, params StartParams) (run *Run, err error) {
-	ln, port, err := mgr.newListener()
-	if err != nil {
-		return nil, err
-	}
-	defer func() {
-		if err != nil {
-			ln.Close()
-		}
-	}()
+	logger := log.With().Str("app_id", params.App.PlatformOrLocalID()).Logger()
 
-	appSlug, err := appfile.Slug(params.AppRoot)
+	svcProxy, err := svcproxy.New(ctx, logger)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, "failed to create service proxy")
 	}
 
 	run = &Run{
-		ID:      genID(),
-		AppID:   params.AppID,
-		Root:    params.AppRoot,
-		AppSlug: appSlug,
-		Port:    port,
-
-		log:     log.With().Str("appID", params.AppID).Logger(),
-		mgr:     mgr,
-		params:  &params,
-		ctx:     ctx,
-		exited:  make(chan struct{}),
-		started: make(chan struct{}),
-	}
+		ID:              GenID(),
+		App:             params.App,
+		NS:              params.NS,
+		ResourceManager: infra.NewResourceManager(params.App, mgr.ClusterMgr, mgr.ObjectsMgr, mgr.PublicBuckets, params.NS, params.Environ, mgr.DBProxyPort, false),
+		ListenAddr:      params.ListenAddr,
+		SvcProxy:        svcProxy,
+		log:             logger,
+		Mgr:             mgr,
+		Params:          &params,
+		secrets:         mgr.Secret.Load(params.App),
+		ctx:             ctx,
+		exited:          make(chan struct{}),
+		started:         make(chan struct{}),
+	}
+	defer func(r *Run) {
+		// Stop all the resource servers if we exit due to an error
+		if err != nil {
+			r.Close()
+		}
+	}(run)
 
 	// Add the run to our map before starting to avoid
 	// racing with initialization (though it's unlikely to ever matter).
@@ -115,7 +187,10 @@ func (mgr *Manager) Start(ctx context.Context, params StartParams) (run *Run, er
 	mgr.runs[run.ID] = run
 	mgr.mu.Unlock()
 
-	if err := run.start(ln); err != nil {
+	if err := run.start(params.Listener, params.OpsTracker); err != nil {
+		if errList := AsErrorList(err); errList != nil {
+			return nil, errList
+		}
 		return nil, err
 	}
 
@@ -128,17 +203,37 @@ func (mgr *Manager) Start(ctx context.Context, params StartParams) (run *Run, er
 	return run, nil
 }
 
-// runLogger is the interface for listening to run logs.
+func (r *Run) Close() {
+	if r.Builder != nil {
+		_ = r.Builder.Close()
+	}
+	r.SvcProxy.Close()
+	r.ResourceManager.StopAll()
+}
+
+// RunLogger is the interface for listening to run logs.
 // The log methods are called for each logline on stdout and stderr respectively.
-type runLogger interface {
-	runStdout(r *Run, line []byte)
-	runStderr(r *Run, line []byte)
+type RunLogger interface {
+	RunStdout(r *Run, line []byte)
+	RunStderr(r *Run, line []byte)
 }
 
-// Proc returns the current running process.
+// ProcGroup returns the current running process.
 // It may have already exited.
-func (r *Run) Proc() *Proc {
-	return r.proc.Load().(*Proc)
+// If the proc has not yet started it may return nil.
+//
+// If run is nil then nil will be returned
+func (r *Run) ProcGroup() *ProcGroup {
+	if r == nil {
+		return nil
+	}
+
+	p, _ := r.proc.Load().(*ProcGroup)
+	return p
+}
+
+func (r *Run) StoreProc(p *ProcGroup) {
+	r.proc.Store(p)
 }
 
 // Done returns a channel that is closed when the run is closed.
@@ -148,47 +243,21 @@ func (r *Run) Done() <-chan struct{} {
 
 // Reload rebuilds the app and, if successful,
 // starts a new proc and switches over.
-func (r *Run) Reload() (*Proc, error) {
-	modPath := filepath.Join(r.Root, "go.mod")
-	modData, err := ioutil.ReadFile(modPath)
-	if err != nil {
-		return nil, err
-	}
-	mod, err := modfile.Parse(modPath, modData, nil)
-	if err != nil {
-		return nil, err
-	}
-
-	cfg := &parser.Config{
-		AppRoot:    r.Root,
-		Version:    "",
-		ModulePath: mod.Module.Mod.Path,
-		WorkingDir: r.params.WorkingDir,
-		ParseTests: false,
-	}
-	parse, err := parser.Parse(cfg)
-	if err != nil {
-		return nil, err
-	}
-
-	p, err := r.buildAndStart(r.ctx, parse)
+func (r *Run) Reload() error {
+	err := r.buildAndStart(r.ctx, nil, true)
 	if err != nil {
-		return nil, err
+		return err
 	}
 
-	prev := r.Proc()
-	r.proc.Store(p)
-	prev.close()
-
-	for _, ln := range r.mgr.listeners {
+	for _, ln := range r.Mgr.listeners {
 		ln.OnReload(r)
 	}
 
-	return p, nil
+	return nil
 }
 
 // start starts the application and serves requests over HTTP using ln.
-func (r *Run) start(ln net.Listener) (err error) {
+func (r *Run) start(ln net.Listener, tracker *optracker.OpTracker) (err error) {
 	defer func() {
 		if err != nil {
 			// This is closed below when err == nil,
@@ -198,46 +267,49 @@ func (r *Run) start(ln net.Listener) (err error) {
 		}
 	}()
 
-	p, err := r.buildAndStart(r.ctx, r.params.Parse)
+	err = r.buildAndStart(r.ctx, tracker, false)
 	if err != nil {
 		return err
 	}
-	r.proc.Store(p)
 
 	// Below this line the function must never return an error
-	// in order to only ensure we close r.exited exactly once.
+	// in order to only ensure we Close r.exited exactly once.
 
 	go func() {
-		for _, ln := range r.mgr.listeners {
+		for _, ln := range r.Mgr.listeners {
 			ln.OnStart(r)
 		}
 		close(r.started)
 	}()
 
+	// Wrap the handler with h2c support to enable HTTP/2 in cleartext
+	// (the std http library only accepts HTTP/2 over TLS).
+	// We need this to be able to forward e.g. gRPC requests to the app.
+	handler := h2c.NewHandler(r, &http2.Server{})
+
 	// Run the http server until the app exits.
-	srv := &http.Server{Addr: ln.Addr().String(), Handler: r}
+	srv := &http.Server{Addr: ln.Addr().String(), Handler: handler}
 	go func() {
-		if err := srv.Serve(ln); err != http.ErrServerClosed {
+		if err := srv.Serve(ln); !errors.Is(err, http.ErrServerClosed) {
 			r.log.Error().Err(err).Msg("could not serve")
 		}
 	}()
 	go func() {
 		<-r.ctx.Done()
-		srv.Close()
-		ln.Close()
+		_ = srv.Close()
 	}()
 
-	// Monitor the running proc and close the app when it exits.
+	// Monitor the running proc and Close the app when it exits.
 	go func() {
 		for {
-			p := r.proc.Load().(*Proc)
+			p := r.proc.Load().(*ProcGroup)
 			<-p.Done()
 			// p exited, but it could have been a reload.
 			// Check to make sure p is still the active proc.
-			p2 := r.proc.Load().(*Proc)
+			p2 := r.proc.Load().(*ProcGroup)
 			if p2 == p {
 				// We're done.
-				for _, ln := range r.mgr.listeners {
+				for _, ln := range r.Mgr.listeners {
 					ln.OnStop(r)
 				}
 				close(r.exited)
@@ -251,241 +323,363 @@ func (r *Run) start(ln net.Listener) (err error) {
 // buildAndStart builds the app, starts the proc, and cleans up
 // the build dir when it exits.
 // The proc exits when ctx is canceled.
-func (r *Run) buildAndStart(ctx context.Context, parse *parser.Result) (p *Proc, err error) {
+func (r *Run) buildAndStart(ctx context.Context, tracker *optracker.OpTracker, isReload bool) error {
 	// Return early if the ctx is already canceled.
 	if err := ctx.Err(); err != nil {
-		return nil, err
+		return err
 	}
 
-	cfg := &compiler.Config{
-		Version:           "",
-		WorkingDir:        r.params.WorkingDir,
-		CgoEnabled:        true,
-		EncoreRuntimePath: env.EncoreRuntimePath(),
-		EncoreGoRoot:      env.EncoreGoRoot(),
-		Parse:             parse,
+	for _, ln := range r.Mgr.listeners {
+		ln.OnCompileStart(r)
 	}
 
-	build, err := compiler.Build(r.Root, cfg)
+	jobs := optracker.NewAsyncBuildJobs(ctx, r.App.PlatformOrLocalID(), tracker)
+
+	// Parse the app source code
+	// Parse the app to figure out what infrastructure is needed.
+	start := time.Now()
+	parseOp := tracker.Add("Building Encore application graph", start)
+	topoOp := tracker.Add("Analyzing service topology", start)
+
+	expSet, err := r.App.Experiments(r.Params.Environ)
 	if err != nil {
-		return nil, fmt.Errorf("compile error: %v", err)
+		return err
+	}
+
+	if r.Builder == nil {
+		r.Builder = builderimpl.Resolve(r.App.Lang(), expSet)
+	}
+
+	vcsRevision := vcs.GetRevision(r.App.Root())
+	buildInfo := builder.BuildInfo{
+		BuildTags:          builder.LocalBuildTags,
+		CgoEnabled:         true,
+		StaticLink:         false,
+		DebugMode:          r.Params.Debug,
+		Environ:            r.Params.Environ,
+		GOOS:               runtime.GOOS,
+		GOARCH:             runtime.GOARCH,
+		KeepOutput:         false,
+		Revision:           vcsRevision.Revision,
+		UncommittedChanges: vcsRevision.Uncommitted,
+
+		// Use the local JS runtime if this is a development build.
+		UseLocalJSRuntime: version.Channel == version.DevBuild,
 	}
+
+	// A context that is canceled when the proc exits.
+	procCtx, cancelProcCtx := context.WithCancel(ctx)
+
+	// Cancel the proc context if we exit with a non-nil error.
 	defer func() {
 		if err != nil {
-			os.RemoveAll(build.Dir)
+			cancelProcCtx()
 		}
 	}()
 
-	var secrets map[string]string
-	if usesSecrets(r.params.Parse.Meta) {
-		if r.AppSlug == "" {
-			return nil, fmt.Errorf("the app defines secrets, but is not yet linked to encore.dev; link it with `encore app link` to use secrets")
+	parse, err := r.Builder.Parse(procCtx, builder.ParseParams{
+		Build:       buildInfo,
+		App:         r.App,
+		Experiments: expSet,
+		WorkingDir:  r.Params.WorkingDir,
+		ParseTests:  false,
+	})
+	if err != nil {
+		// Don't use the error itself in tracker.Fail, as it will lead to duplicate error output.
+		tracker.Fail(parseOp, errors.New("parse error"))
+		return err
+	}
+
+	if err := r.App.CacheMetadata(parse.Meta); err != nil {
+		return errors.Wrap(err, "cache metadata")
+	}
+	tracker.Done(parseOp, 500*time.Millisecond)
+	tracker.Done(topoOp, 300*time.Millisecond)
+
+	r.ResourceManager.StartRequiredServices(jobs, parse.Meta)
+
+	configProm := promise.New(func() (*builder.ServiceConfigsResult, error) {
+		return r.Builder.ServiceConfigs(ctx, builder.ServiceConfigsParams{
+			Parse: parse,
+			CueMeta: &cueutil.Meta{
+				APIBaseURL: fmt.Sprintf("http://%s", r.ListenAddr),
+				EnvName:    "local",
+				EnvType:    cueutil.EnvType_Development,
+				CloudType:  cueutil.CloudType_Local,
+			},
+		})
+	})
+
+	var build *builder.CompileResult
+	jobs.Go("Compiling application source code", false, 0, func(ctx context.Context) (err error) {
+		build, err = r.Builder.Compile(ctx, builder.CompileParams{
+			Build:       buildInfo,
+			App:         r.App,
+			Parse:       parse,
+			OpTracker:   tracker,
+			Experiments: expSet,
+			WorkingDir:  r.Params.WorkingDir,
+			Environ:     r.Params.Environ,
+		})
+		if err != nil {
+			return errors.Wrap(err, "compile error")
 		}
-		data, err := r.mgr.Secret.Get(ctx, r.AppSlug)
+		return nil
+	})
+
+	var secrets map[string]string
+	jobs.Go("Fetching application secrets", true, 150*time.Millisecond, func(ctx context.Context) error {
+		data, err := r.secrets.Get(ctx, expSet)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		secrets = data.Values
+		return nil
+	})
+
+	if err := jobs.Wait(); err != nil {
+		return err
 	}
 
-	p, err = r.startProc(&startProcParams{
-		Ctx:         ctx,
-		BuildDir:    build.Dir,
-		BinPath:     build.Exe,
-		Meta:        build.Parse.Meta,
-		Logger:      r.mgr,
-		RuntimePort: r.mgr.RuntimePort,
-		DBProxyPort: r.mgr.DBProxyPort,
-		DBClusterID: r.params.DBClusterID,
-		Secrets:     secrets,
+	svcCfg, err := configProm.Get(ctx)
+	if err != nil {
+		return err
+	}
+
+	startOp := tracker.Add("Starting Encore application", start)
+	newProcess, err := r.StartProcGroup(&StartProcGroupParams{
+		Ctx:            ctx,
+		Outputs:        build.Outputs,
+		Meta:           parse.Meta,
+		Logger:         r.Mgr,
+		Secrets:        secrets,
+		ServiceConfigs: svcCfg.Configs,
+		Environ:        r.Params.Environ,
+		WorkingDir:     r.Params.WorkingDir,
+		IsReload:       isReload,
+		Experiments:    expSet,
 	})
 	if err != nil {
-		return nil, err
+		tracker.Fail(startOp, err)
+		return err
 	}
+
+	// Close the proc context when the proc exits.
 	go func() {
-		<-p.Done()
-		os.RemoveAll(build.Dir)
+		select {
+		case <-procCtx.Done():
+		// Already done
+		case <-newProcess.Done():
+			cancelProcCtx()
+		}
+	}()
+
+	previousProcess := r.proc.Swap(newProcess)
+	if previousProcess != nil {
+		previousProcess.(*ProcGroup).Close()
+	}
+
+	tracker.Done(startOp, 50*time.Millisecond)
+
+	go func() {
+		// Wait one second before logging all the missing secrets.
+		time.Sleep(1 * time.Second)
+
+		// Log any warnings.
+		for _, warning := range newProcess.Warnings() {
+			line := "\n" + aurora.Red(fmt.Sprintf("warning: %s", warning.Title)).String() + "\n" +
+				aurora.Gray(16, fmt.Sprintf("note: %s", warning.Help)).String() + "\n\n"
+			r.Mgr.RunStderr(r, []byte(line))
+		}
 	}()
-	return p, nil
-}
 
-// Proc represents a running Encore process.
-type Proc struct {
-	ID      string     // unique process id
-	Run     *Run       // the run the process belongs to
-	Pid     int        // the OS process id
-	Meta    *meta.Data // app metadata snapshot
-	Started time.Time  // when the process started
-
-	log      zerolog.Logger
-	exit     chan struct{} // closed when the process has exited
-	cmd      *exec.Cmd
-	reqWr    *os.File
-	respRd   *os.File
-	buildDir string
-	client   *yamux.Session
+	return nil
 }
 
-type startProcParams struct {
-	Ctx         context.Context
-	BuildDir    string
-	BinPath     string
-	Meta        *meta.Data
-	Secrets     map[string]string
-	RuntimePort int
-	DBProxyPort int
-	DBClusterID string
-	Logger      runLogger
+type StartProcGroupParams struct {
+	Ctx            context.Context
+	Outputs        []builder.BuildOutput
+	Meta           *meta.Data
+	Secrets        map[string]string
+	ServiceConfigs map[string]string
+	Logger         RunLogger
+	Environ        []string
+	WorkingDir     string
+	IsReload       bool
+	Experiments    *experiments.Set
 }
 
-// startProc starts a single actual OS process for app.
-func (r *Run) startProc(params *startProcParams) (p *Proc, err error) {
-	pid := genID()
-	p = &Proc{
-		ID:       pid,
-		Run:      r,
-		Meta:     params.Meta,
-		exit:     make(chan struct{}),
-		buildDir: params.BuildDir,
-		log:      r.log.With().Str("procID", pid).Logger(),
-	}
-
-	cmd := exec.Command(params.BinPath)
-	cmd.Env = []string{
-		"ENCORE_APP_ID=" + r.ID,
-		"ENCORE_PROC_ID=" + p.ID,
-		"ENCORE_RUNTIME_ADDRESS=localhost:" + strconv.Itoa(params.RuntimePort),
-		"ENCORE_SQLDB_ADDRESS=localhost:" + strconv.Itoa(params.DBProxyPort),
-		"ENCORE_SQLDB_PASSWORD=" + params.DBClusterID,
-		"ENCORE_SECRETS=" + encodeSecretsEnv(params.Secrets),
-	}
-	p.cmd = cmd
-
-	// Proxy stdout and stderr to the given app logger, if any.
-	if l := params.Logger; l != nil {
-		cmd.Stdout = newLogWriter(r, l.runStdout)
-		cmd.Stderr = newLogWriter(r, l.runStderr)
-	}
-
-	// Set up extra file descriptors for communicating requests/responses:
-	// - reqRd is for reading incoming requests (handed over procchild)
-	// - reqWr is for writing incoming requests
-	// - respRd is for reading responses
-	// - respWr is for writing responses (handed over to proc)
-	reqRd, reqWr, err1 := os.Pipe()
-	respRd, respWr, err2 := os.Pipe()
-	defer func() {
-		// Close all the files if we return an error.
-		if err != nil {
-			closeAll(reqRd, reqWr, respRd, respWr)
+const gracefulShutdownTime = 10 * time.Second
+
+// StartProcGroup starts a single actual OS process for app.
+func (r *Run) StartProcGroup(params *StartProcGroupParams) (p *ProcGroup, err error) {
+	pid := GenID()
+
+	userEnv := append([]string{
+		"ENCORE_RUNTIME_LOG=error",
+		// Always include internal messages when developing locally.
+		"ENCORE_API_INCLUDE_INTERNAL_MESSAGE=1",
+	}, params.Environ...)
+
+	daemonProxyAddr, err := netip.ParseAddrPort(strings.ReplaceAll(r.ListenAddr, "localhost", "127.0.0.1"))
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed to parse listen address: %s", r.ListenAddr)
+	}
+	gatewayBaseURL := fmt.Sprintf("http://%s", daemonProxyAddr)
+	gateways := make(map[string]GatewayConfig)
+	for _, gw := range params.Meta.Gateways {
+		gateways[gw.EncoreName] = GatewayConfig{
+			BaseURL:   gatewayBaseURL,
+			Hostnames: []string{"localhost"},
 		}
-	}()
-	if err := firstErr(err1, err2); err != nil {
-		return nil, err
-	} else if err := xos.ArrangeExtraFiles(cmd, reqRd, respWr); err != nil {
-		return nil, err
 	}
 
-	if err := cmd.Start(); err != nil {
-		return nil, err
-	}
-	p.log.Info().Msg("started process")
-	defer func() {
+	authKey := genAuthKey()
+	p = newProcGroup(procGroupOptions{
+		ProcID:  pid,
+		Run:     r,
+		AuthKey: authKey,
+		ConfigGen: &RuntimeConfigGenerator{
+			app:            r.App,
+			infraManager:   r.ResourceManager,
+			md:             params.Meta,
+			AppID:          option.Some(r.ID),
+			EnvID:          option.Some(pid),
+			TraceEndpoint:  option.Some(fmt.Sprintf("http://localhost:%d/trace", r.Mgr.RuntimePort)),
+			AuthKey:        authKey,
+			Gateways:       gateways,
+			DefinedSecrets: params.Secrets,
+			SvcConfigs:     params.ServiceConfigs,
+			DeployID:       option.Some(fmt.Sprintf("run_%s", xid.New().String())),
+			IncludeMetaEnv: r.Builder.NeedsMeta(),
+		},
+		Experiments: params.Experiments,
+		Meta:        params.Meta,
+		Ctx:         params.Ctx,
+		WorkingDir:  params.WorkingDir,
+		Logger:      params.Logger,
+	})
+
+	if isSingleProc(params.Outputs) {
+		conf, err := p.ConfigGen.AllInOneProc()
 		if err != nil {
-			cmd.Process.Kill()
+			return nil, err
 		}
-	}()
 
-	// Close the files we handed over to the child.
-	closeAll(reqRd, respWr)
+		entrypoint := params.Outputs[0].GetEntrypoints()[0]
 
-	rwc := &struct {
-		io.ReadCloser
-		io.Writer
-	}{
-		ReadCloser: ioutil.NopCloser(respRd),
-		Writer:     reqWr,
-	}
-	p.client, err = yamux.Client(rwc, yamux.DefaultConfig())
-	if err != nil {
-		return nil, fmt.Errorf("could not initialize connection: %v", err)
-	}
+		// Generate the environmental variables for the process
+		procEnv, err := p.ConfigGen.ProcEnvs(conf, entrypoint.UseRuntimeConfigV2)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to generate environment variables")
+		}
 
-	p.reqWr = reqWr
-	p.respRd = respRd
-	p.Pid = cmd.Process.Pid
-	p.Started = time.Now()
+		env := slices.Clone(userEnv)
+		env = append(env, procEnv...)
 
-	// Monitor the context and close the process when it is done.
-	go func() {
-		select {
-		case <-params.Ctx.Done():
-			p.close()
-		case <-p.exit:
+		// Otherwise we're running everything inside a single process
+		cmd := entrypoint.Cmd.Expand(params.Outputs[0].GetArtifactDir())
+		if err := p.NewAllInOneProc(cmd, conf.ListenAddr, env); err != nil {
+			return nil, err
+		}
+	} else {
+		var (
+			svcConfs map[string]*ProcConfig
+			gwConfs  map[string]*ProcConfig
+		)
+
+		if r.Builder.UseNewRuntimeConfig() {
+			_, svcConfs, gwConfs, err = p.ConfigGen.ProcPerServiceWithNewRuntimeConfig(r.SvcProxy)
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			svcConfs, gwConfs, err = p.ConfigGen.ProcPerService(r.SvcProxy)
+			if err != nil {
+				return nil, err
+			}
 		}
-	}()
 
-	go p.waitForExit()
-	return p, nil
-}
+		for _, o := range params.Outputs {
+			for _, ep := range o.GetEntrypoints() {
+				cmd := ep.Cmd.Expand(o.GetArtifactDir())
+				// create a process for each service
+				for _, svcName := range ep.Services {
+					// Generate the environmental variables for the process
+					procConf, ok := svcConfs[svcName]
+					if !ok {
+						return nil, errors.Newf("unknown service %q", svcName)
+					}
+					procEnv, err := p.ConfigGen.ProcEnvs(procConf, ep.UseRuntimeConfigV2)
+					if err != nil {
+						return nil, errors.Wrap(err, "failed to generate environment variables")
+					}
+
+					env := slices.Clone(userEnv)
+					env = append(env, procEnv...)
+
+					if err := p.NewProcForService(svcName, procConf.ListenAddr, cmd, env); err != nil {
+						return nil, err
+					}
+				}
 
-// Done returns a channel that is closed when the process has exited.
-func (p *Proc) Done() <-chan struct{} {
-	return p.exit
-}
+				for _, gwName := range ep.Gateways {
+					procConf, ok := gwConfs[gwName]
+					if !ok {
+						return nil, errors.Newf("unknown gateway %q", gwName)
+					}
 
-// close closes the process and waits for it to shutdown.
-// It can safely be called multiple times.
-func (p *Proc) close() {
-	p.reqWr.Close()
-	timer := time.NewTimer(10 * time.Second)
-	defer timer.Stop()
-	select {
-	case <-p.exit:
-	case <-timer.C:
-		// The process didn't exit after 10s
-		p.log.Error().Msg("timed out waiting for process to exit; killing")
-		p.cmd.Process.Kill()
-		<-p.exit
-	}
-}
+					procEnv, err := p.ConfigGen.ProcEnvs(procConf, ep.UseRuntimeConfigV2)
+					if err != nil {
+						return nil, errors.Wrap(err, "failed to generate environment variables")
+					}
 
-func (p *Proc) waitForExit() {
-	defer close(p.exit)
-	defer closeAll(p.reqWr, p.respRd)
+					env := slices.Clone(userEnv)
+					env = append(env, procEnv...)
 
-	if err := p.cmd.Wait(); err != nil {
-		p.log.Error().Err(err).Msg("process exited with error")
-	} else {
-		p.log.Info().Err(err).Msg("process exited successfully")
+					if err := p.NewProcForGateway(gwName, procConf.ListenAddr, cmd, env); err != nil {
+						return nil, err
+					}
+				}
+			}
+		}
 	}
 
-	// Flush the logs in case the output did not end in a newline.
-	for _, w := range [...]io.Writer{p.cmd.Stdout, p.cmd.Stderr} {
-		if w != nil {
-			w.(*logWriter).Flush()
-		}
+	// Start the processes of the application
+	if err := p.Start(); err != nil {
+		return nil, err
 	}
-}
+	defer func() {
+		if err != nil {
+			p.Kill()
+		}
+	}()
 
-// closeAll closes all the given closers, skipping ones that are nil.
-func closeAll(closers ...io.Closer) {
-	for _, c := range closers {
-		if c != nil {
-			c.Close()
+	// Monitor the context and Close the process when it is done.
+	go func() {
+		select {
+		case <-params.Ctx.Done():
+			p.Close()
+		case <-p.Done():
 		}
-	}
-}
+	}()
 
-// firstErr reports the first non-nil error out of errs.
-// If all are nil, it reports nil.
-func firstErr(errs ...error) error {
-	for _, err := range errs {
-		if err != nil {
-			return err
+	// If this is a live reload, wait for the process to be ready.
+	// This way we ensure requests are always hitting a running server,
+	// in case a batch job or something is running.
+	if params.IsReload {
+		g, ctx := errgroup.WithContext(params.Ctx)
+		for _, gw := range p.Gateways {
+			gw := gw
+			g.Go(func() error {
+				gw.pollUntilProcessIsListening(ctx)
+				return nil
+			})
 		}
+		_ = g.Wait()
 	}
-	return nil
+
+	return p, nil
 }
 
 // logWriter is an io.Writer that buffers incoming logs
@@ -498,7 +692,7 @@ type logWriter struct {
 }
 
 func newLogWriter(run *Run, fn func(*Run, []byte)) *logWriter {
-	const maxLine = 10 * 1024
+	const maxLine = 100 * 1024
 	return &logWriter{
 		run:     run,
 		fn:      fn,
@@ -541,9 +735,9 @@ func (w *logWriter) Flush() {
 	}
 }
 
-// genID generates a random run/process id.
+// GenID generates a random run/process id.
 // It panics if it cannot get random bytes.
-func genID() string {
+func GenID() string {
 	var b [8]byte
 	if _, err := rand.Read(b[:]); err != nil {
 		panic("cannot generate random data: " + err.Error())
@@ -574,7 +768,7 @@ func encodeSecretsEnv(secrets map[string]string) string {
 
 		buf.WriteString(k)
 		buf.WriteByte('=')
-		buf.WriteString(base64.RawStdEncoding.EncodeToString([]byte(secrets[k])))
+		buf.WriteString(base64.RawURLEncoding.EncodeToString([]byte(secrets[k])))
 	}
 	return buf.String()
 }
@@ -587,3 +781,46 @@ func usesSecrets(md *meta.Data) bool {
 	}
 	return false
 }
+
+func genAuthKey() config.EncoreAuthKey {
+	// read a uint32 from crypto/rand to use as the key ID
+	var kidBytes [4]byte
+	if _, err := rand.Read(kidBytes[:]); err != nil {
+		panic("cannot generate random data: " + err.Error())
+	}
+	kid := binary.BigEndian.Uint32(kidBytes[:])
+
+	// kid := mathrand.Uint32()
+	var b [16]byte
+	if _, err := rand.Read(b[:]); err != nil {
+		panic("cannot generate random data: " + err.Error())
+	}
+	return config.EncoreAuthKey{KeyID: kid, Data: b[:]}
+}
+
+// CanDeleteNamespace implements namespace.DeletionHandler.
+func (m *Manager) CanDeleteNamespace(ctx context.Context, app *apps.Instance, ns *namespace.Namespace) error {
+	// Check if any of the active runs are using this namespace.
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	for _, r := range m.runs {
+		if r.NS.ID == ns.ID && r.ctx.Err() == nil {
+			return errors.New("namespace is in use by 'encore run'")
+		}
+	}
+	return nil
+}
+
+// DeleteNamespace implements namespace.DeletionHandler.
+func (m *Manager) DeleteNamespace(ctx context.Context, app *apps.Instance, ns *namespace.Namespace) error {
+	// We don't need to do anything here; we only implement DeletionHandler for
+	// the CanDeleteNamespace check.
+	return nil
+}
+
+func isSingleProc(outputs []builder.BuildOutput) bool {
+	if len(outputs) != 1 {
+		return false
+	}
+	return len(outputs[0].GetEntrypoints()) == 1
+}
diff --git a/cli/daemon/run/run_test.go b/cli/daemon/run/run_test.go
deleted file mode 100644
index 743374f641..0000000000
--- a/cli/daemon/run/run_test.go
+++ /dev/null
@@ -1,106 +0,0 @@
-package run
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"net/http/httptest"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"encr.dev/cli/internal/env"
-	"encr.dev/compiler"
-	qt "github.com/frankban/quicktest"
-	"go.uber.org/goleak"
-)
-
-// TestStartProc tests that (*app).startProc correctly starts Encore processes
-// for sending requests.
-func TestStartProc(t *testing.T) {
-	defer goleak.VerifyNone(t, goleak.IgnoreCurrent())
-	run := &Run{ID: genID()}
-	c := qt.New(t)
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	build := testBuild(c, "./testdata/echo")
-	p, err := run.startProc(&startProcParams{
-		Ctx:         ctx,
-		BuildDir:    build.Dir,
-		BinPath:     build.Exe,
-		Meta:        build.Parse.Meta,
-		RuntimePort: 0,
-		DBProxyPort: 0,
-		Logger:      testRunLogger{t},
-	})
-	c.Assert(err, qt.IsNil)
-	defer p.close()
-	run.proc.Store(p)
-
-	// Send a simple message and make sure it is echoed back.
-	input := struct{ Message string }{Message: "hello"}
-	body, _ := json.Marshal(&input)
-
-	w := httptest.NewRecorder()
-	req := httptest.NewRequest("POST", "/echo.Echo", bytes.NewReader(body))
-	run.ServeHTTP(w, req)
-	c.Assert(w.Code, qt.Equals, 200)
-	c.Assert(w.Body.Bytes(), qt.JSONEquals, input)
-}
-
-// TestProcClosedOnCtxCancel tests that the proc is closed when
-// the given ctx is cancelled.
-func TestProcClosedOnCtxCancel(t *testing.T) {
-	defer goleak.VerifyNone(t, goleak.IgnoreCurrent())
-	app := &Run{ID: genID()}
-	c := qt.New(t)
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-
-	build := testBuild(c, "./testdata/echo")
-	p, err := app.startProc(&startProcParams{
-		Ctx:         ctx,
-		BuildDir:    build.Dir,
-		BinPath:     build.Exe,
-		Meta:        build.Parse.Meta,
-		RuntimePort: 0,
-		DBProxyPort: 0,
-		Logger:      testRunLogger{t},
-	})
-	c.Assert(err, qt.IsNil)
-	cancel()
-	<-p.Done()
-}
-
-// testBuild is a helper that compiles the app situated at appRoot
-// and cleans up the build dir during test cleanup.
-func testBuild(c *qt.C, appRoot string) *compiler.Result {
-	wd, err := os.Getwd()
-	c.Assert(err, qt.IsNil)
-	runtimePath := filepath.Join(wd, "../../../compiler/runtime")
-	build, err := compiler.Build("./testdata/echo", &compiler.Config{
-		EncoreRuntimePath: runtimePath,
-		EncoreGoRoot:      env.EncoreGoRoot(),
-	})
-	c.Assert(err, qt.IsNil)
-	c.Cleanup(func() {
-		os.RemoveAll(build.Dir)
-	})
-	return build
-}
-
-// testRunLogger implements runLogger by calling t.Log.
-type testRunLogger struct {
-	t *testing.T
-}
-
-func (l testRunLogger) runStdout(r *Run, line []byte) {
-	line = bytes.TrimSuffix(line, []byte{'\n'})
-	l.t.Log(string(line))
-}
-
-func (l testRunLogger) runStderr(r *Run, line []byte) {
-	line = bytes.TrimSuffix(line, []byte{'\n'})
-	l.t.Log(string(line))
-}
diff --git a/cli/daemon/run/runtime_config2.go b/cli/daemon/run/runtime_config2.go
new file mode 100644
index 0000000000..acf2a2603a
--- /dev/null
+++ b/cli/daemon/run/runtime_config2.go
@@ -0,0 +1,927 @@
+package run
+
+import (
+	"bytes"
+	"compress/gzip"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/netip"
+	"os"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/jackc/pgx/v5"
+	"github.com/rs/xid"
+	"go4.org/syncutil"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/types/known/durationpb"
+
+	"encore.dev/appruntime/exported/config"
+	encoreEnv "encr.dev/internal/env"
+	"encr.dev/pkg/appfile"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/rtconfgen"
+	"encr.dev/pkg/svcproxy"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	runtimev1 "encr.dev/proto/encore/runtime/v1"
+)
+
+const (
+	runtimeCfgEnvVar    = "ENCORE_RUNTIME_CONFIG"
+	appSecretsEnvVar    = "ENCORE_APP_SECRETS"
+	serviceCfgEnvPrefix = "ENCORE_CFG_"
+	listenEnvVar        = "ENCORE_LISTEN_ADDR"
+	metaEnvVar          = "ENCORE_APP_META"
+)
+
+type RuntimeConfigGenerator struct {
+	initOnce syncutil.Once
+	md       *meta.Data
+
+	// The application to generate the config for
+	app interface {
+		PlatformID() string
+		PlatformOrLocalID() string
+		GlobalCORS() (appfile.CORS, error)
+		AppFile() (*appfile.File, error)
+		BuildSettings() (appfile.Build, error)
+	}
+
+	// The infra manager to use
+	infraManager interface {
+		SQLServerConfig() (config.SQLServer, error)
+		PubSubProviderConfig() (config.PubsubProvider, error)
+
+		SQLDatabaseConfig(db *meta.SQLDatabase) (config.SQLDatabase, error)
+		PubSubTopicConfig(topic *meta.PubSubTopic) (config.PubsubProvider, config.PubsubTopic, error)
+		PubSubSubscriptionConfig(topic *meta.PubSubTopic, sub *meta.PubSubTopic_Subscription) (config.PubsubSubscription, error)
+		RedisConfig(redis *meta.CacheCluster) (config.RedisServer, config.RedisDatabase, error)
+		BucketProviderConfig() (config.BucketProvider, string, error)
+	}
+
+	AppID         option.Option[string]
+	EnvID         option.Option[string]
+	EnvName       option.Option[string]
+	EnvType       option.Option[runtimev1.Environment_Type]
+	EnvCloud      option.Option[runtimev1.Environment_Cloud]
+	TraceEndpoint option.Option[string]
+	DeployID      option.Option[string]
+	Gateways      map[string]GatewayConfig
+	AuthKey       config.EncoreAuthKey
+
+	// Whether to include the metadata as an environment variable.
+	IncludeMetaEnv bool
+
+	// The values of defined secrets.
+	DefinedSecrets map[string]string
+	// The configs, per service.
+	SvcConfigs map[string]string
+
+	conf     *rtconfgen.Builder
+	authKeys []*runtimev1.EncoreAuthKey
+}
+
+type GatewayConfig struct {
+	BaseURL   string
+	Hostnames []string
+}
+
+func (g *RuntimeConfigGenerator) initialize() error {
+	return g.initOnce.Do(func() error {
+		g.conf = rtconfgen.NewBuilder()
+
+		newRid := func() string { return "res_" + xid.New().String() }
+
+		if deployID, ok := g.DeployID.Get(); ok {
+			g.conf.DeployID(deployID)
+		}
+		g.conf.DeployedAt(time.Now())
+
+		g.conf.Env(&runtimev1.Environment{
+			AppId:   g.AppID.GetOrElseF(g.app.PlatformOrLocalID),
+			AppSlug: g.app.PlatformID(),
+			EnvId:   g.EnvID.GetOrElse("local"),
+			EnvName: g.EnvName.GetOrElse("local"),
+			EnvType: g.EnvType.GetOrElse(runtimev1.Environment_TYPE_DEVELOPMENT),
+			Cloud:   g.EnvCloud.GetOrElse(runtimev1.Environment_CLOUD_LOCAL),
+		})
+
+		toSecret := func(b []byte) *runtimev1.SecretData {
+			return &runtimev1.SecretData{
+				Source: &runtimev1.SecretData_Embedded{Embedded: b},
+			}
+		}
+		ak := g.AuthKey
+		g.authKeys = []*runtimev1.EncoreAuthKey{{Id: ak.KeyID, Data: toSecret(ak.Data)}}
+
+		g.conf.EncorePlatform(&runtimev1.EncorePlatform{
+			PlatformSigningKeys: g.authKeys,
+			EncoreCloud:         nil,
+		})
+
+		if traceEndpoint, ok := g.TraceEndpoint.Get(); ok {
+			sampleRate := 1.0
+			if val, err := strconv.ParseFloat(os.Getenv("ENCORE_TRACE_SAMPLING_RATE"), 64); err == nil {
+				sampleRate = min(max(val, 0), 1)
+			}
+			g.conf.TracingProvider(&runtimev1.TracingProvider{
+				Rid: newRid(),
+				Provider: &runtimev1.TracingProvider_Encore{
+					Encore: &runtimev1.TracingProvider_EncoreTracingProvider{
+						TraceEndpoint: traceEndpoint,
+						SamplingRate:  &sampleRate,
+					},
+				},
+			})
+		}
+
+		appFile, err := g.app.AppFile()
+		if err != nil {
+			return errors.Wrap(err, "failed to get app's build settings")
+		}
+		for _, svc := range g.md.Svcs {
+			cfg := &runtimev1.HostedService{
+				Name:      svc.Name,
+				LogConfig: ptrOrNil(appFile.LogLevel),
+			}
+
+			if appFile.Build.WorkerPooling {
+				n := int32(0)
+				cfg.WorkerThreads = &n
+			}
+			g.conf.ServiceConfig(cfg)
+		}
+
+		g.conf.AuthMethods([]*runtimev1.ServiceAuth{
+			{
+				AuthMethod: &runtimev1.ServiceAuth_EncoreAuth_{
+					EncoreAuth: &runtimev1.ServiceAuth_EncoreAuth{
+						AuthKeys: g.authKeys,
+					},
+				},
+			},
+		})
+
+		g.conf.DefaultGracefulShutdown(&runtimev1.GracefulShutdown{
+			Total:         durationpb.New(10 * time.Second),
+			ShutdownHooks: durationpb.New(4 * time.Second),
+			Handlers:      durationpb.New(2 * time.Second),
+		})
+
+		for _, gw := range g.md.Gateways {
+			cors, err := g.app.GlobalCORS()
+			if err != nil {
+				return errors.Wrap(err, "failed to generate global CORS config")
+			}
+
+			g.conf.Infra.Gateway(&runtimev1.Gateway{
+				Rid:        newRid(),
+				EncoreName: gw.EncoreName,
+				BaseUrl:    g.Gateways[gw.EncoreName].BaseURL,
+				Hostnames:  g.Gateways[gw.EncoreName].Hostnames,
+				Cors: &runtimev1.Gateway_CORS{
+					Debug:               cors.Debug,
+					DisableCredentials:  false,
+					ExtraAllowedHeaders: cors.AllowHeaders,
+					ExtraExposedHeaders: cors.ExposeHeaders,
+
+					AllowedOriginsWithCredentials: &runtimev1.Gateway_CORS_UnsafeAllowAllOriginsWithCredentials{
+						UnsafeAllowAllOriginsWithCredentials: true,
+					},
+
+					AllowedOriginsWithoutCredentials: &runtimev1.Gateway_CORSAllowedOrigins{
+						AllowedOrigins: []string{"*"},
+					},
+
+					AllowPrivateNetworkAccess: true,
+				},
+			})
+		}
+
+		if len(g.md.PubsubTopics) > 0 {
+			pubsubConfig, err := g.infraManager.PubSubProviderConfig()
+			if err != nil {
+				return errors.Wrap(err, "failed to generate pubsub provider config")
+			}
+
+			cluster := g.conf.Infra.PubSubCluster(&runtimev1.PubSubCluster{
+				Rid: newRid(),
+				Provider: &runtimev1.PubSubCluster_Nsq{
+					Nsq: &runtimev1.PubSubCluster_NSQ{Hosts: []string{pubsubConfig.NSQ.Host}},
+				},
+			})
+
+			for _, topic := range g.md.PubsubTopics {
+				topicRid := newRid()
+
+				var deliveryGuarantee runtimev1.PubSubTopic_DeliveryGuarantee
+				switch topic.DeliveryGuarantee {
+				case meta.PubSubTopic_AT_LEAST_ONCE:
+					deliveryGuarantee = runtimev1.PubSubTopic_DELIVERY_GUARANTEE_AT_LEAST_ONCE
+				case meta.PubSubTopic_EXACTLY_ONCE:
+					deliveryGuarantee = runtimev1.PubSubTopic_DELIVERY_GUARANTEE_EXACTLY_ONCE
+				default:
+					return errors.Newf("unknown delivery guarantee %q", topic.DeliveryGuarantee)
+				}
+
+				cluster.PubSubTopic(&runtimev1.PubSubTopic{
+					Rid:               topicRid,
+					EncoreName:        topic.Name,
+					CloudName:         topic.Name,
+					DeliveryGuarantee: deliveryGuarantee,
+					OrderingAttr:      ptrOrNil(topic.OrderingKey),
+					ProviderConfig:    nil,
+				})
+
+				for _, sub := range topic.Subscriptions {
+					cluster.PubSubSubscription(&runtimev1.PubSubSubscription{
+						Rid:                    newRid(),
+						TopicEncoreName:        topic.Name,
+						SubscriptionEncoreName: sub.Name,
+						TopicCloudName:         topic.Name,
+						SubscriptionCloudName:  sub.Name,
+						PushOnly:               false,
+						ProviderConfig:         nil,
+					})
+				}
+			}
+		}
+
+		if len(g.md.SqlDatabases) > 0 {
+			srvConfig, err := g.infraManager.SQLServerConfig()
+			if err != nil {
+				return errors.Wrap(err, "failed to generate SQL server config")
+			}
+
+			cluster := g.conf.Infra.SQLCluster(&runtimev1.SQLCluster{
+				Rid: newRid(),
+			})
+
+			var tlsConfig *runtimev1.TLSConfig
+			if srvConfig.ServerCACert != "" {
+				tlsConfig = &runtimev1.TLSConfig{
+					ServerCaCert: &srvConfig.ServerCACert,
+				}
+			}
+
+			cluster.SQLServer(&runtimev1.SQLServer{
+				Rid:       newRid(),
+				Kind:      runtimev1.ServerKind_SERVER_KIND_PRIMARY,
+				Host:      srvConfig.Host,
+				TlsConfig: tlsConfig,
+			})
+
+			for _, db := range g.md.SqlDatabases {
+				if externalDB, ok := g.DefinedSecrets["sqldb::"+db.Name]; ok {
+					var extCfg struct {
+						ConnectionString string `json:"connection_string"`
+					}
+					if err := json.Unmarshal([]byte(externalDB), &extCfg); err != nil {
+						return errors.Wrapf(err, "failed to unmarshal external DB config for %q", db.Name)
+					}
+					pCfg, err := pgx.ParseConfig(extCfg.ConnectionString)
+					if err != nil {
+						return errors.Wrapf(err, "failed to parse external DB connection string for %q", db.Name)
+					}
+					cluster := g.conf.Infra.SQLCluster(&runtimev1.SQLCluster{
+						Rid: newRid(),
+					})
+					cluster.SQLServer(&runtimev1.SQLServer{
+						Rid:  newRid(),
+						Kind: runtimev1.ServerKind_SERVER_KIND_PRIMARY,
+						Host: pCfg.Host,
+						TlsConfig: &runtimev1.TLSConfig{
+							DisableCaValidation: true,
+						},
+					})
+					// Generate a role rid based on the cluster+username combination.
+					roleRid := fmt.Sprintf("role:%s:%s", cluster.Val.Rid, pCfg.User)
+					g.conf.Infra.SQLRole(&runtimev1.SQLRole{
+						Rid:           roleRid,
+						Username:      pCfg.User,
+						Password:      toSecret([]byte(pCfg.Password)),
+						ClientCertRid: nil,
+					})
+					cluster.SQLDatabase(&runtimev1.SQLDatabase{
+						Rid:        newRid(),
+						EncoreName: db.Name,
+						CloudName:  pCfg.Database,
+						ConnPools:  nil,
+					}).AddConnectionPool(&runtimev1.SQLConnectionPool{
+						IsReadonly:     false,
+						RoleRid:        roleRid,
+						MinConnections: int32(0),
+						MaxConnections: int32(0),
+					})
+				} else {
+					dbConfig, err := g.infraManager.SQLDatabaseConfig(db)
+					if err != nil {
+						return errors.Wrap(err, "failed to generate SQL database config")
+					}
+
+					// Generate a role rid based on the cluster+username combination.
+					roleRid := fmt.Sprintf("role:%s:%s", cluster.Val.Rid, dbConfig.User)
+					g.conf.Infra.SQLRole(&runtimev1.SQLRole{
+						Rid:           roleRid,
+						Username:      dbConfig.User,
+						Password:      toSecret([]byte(dbConfig.Password)),
+						ClientCertRid: nil,
+					})
+					cluster.SQLDatabase(&runtimev1.SQLDatabase{
+						Rid:        newRid(),
+						EncoreName: dbConfig.EncoreName,
+						CloudName:  dbConfig.DatabaseName,
+						ConnPools:  nil,
+					}).AddConnectionPool(&runtimev1.SQLConnectionPool{
+						IsReadonly:     false,
+						RoleRid:        roleRid,
+						MinConnections: int32(dbConfig.MinConnections),
+						MaxConnections: int32(dbConfig.MaxConnections),
+					})
+
+				}
+
+			}
+		}
+
+		if len(g.md.CacheClusters) > 0 {
+			for _, cl := range g.md.CacheClusters {
+				srvConfig, dbConfig, err := g.infraManager.RedisConfig(cl)
+				if err != nil {
+					return errors.Wrap(err, "failed to generate Redis cluster config")
+				}
+
+				cluster := g.conf.Infra.RedisCluster(&runtimev1.RedisCluster{
+					Rid:     newRid(),
+					Servers: nil,
+				})
+
+				// Generate a role rid based on the cluster+username combination.
+				roleRid := fmt.Sprintf("role:%s:%s", cluster.Val.Rid, srvConfig.User)
+				g.conf.Infra.RedisRoleFn(roleRid, func() *runtimev1.RedisRole {
+					r := &runtimev1.RedisRole{
+						Rid:           roleRid,
+						ClientCertRid: nil,
+					}
+					switch {
+					case srvConfig.User != "" && srvConfig.Password != "":
+						r.Auth = &runtimev1.RedisRole_Acl{Acl: &runtimev1.RedisRole_AuthACL{
+							Username: srvConfig.User,
+							Password: toSecret([]byte(srvConfig.Password)),
+						}}
+					case srvConfig.Password != "":
+						r.Auth = &runtimev1.RedisRole_AuthString{AuthString: toSecret([]byte(srvConfig.Password))}
+					default:
+						r.Auth = nil
+					}
+					return r
+				})
+
+				var tlsConfig *runtimev1.TLSConfig
+				if srvConfig.EnableTLS || srvConfig.ServerCACert != "" {
+					tlsConfig = &runtimev1.TLSConfig{
+						ServerCaCert: ptrOrNil(srvConfig.ServerCACert),
+					}
+				}
+
+				cluster.RedisServer(&runtimev1.RedisServer{
+					Rid:       newRid(),
+					Host:      srvConfig.Host,
+					Kind:      runtimev1.ServerKind_SERVER_KIND_PRIMARY,
+					TlsConfig: tlsConfig,
+				})
+				cluster.RedisDatabase(&runtimev1.RedisDatabase{
+					Rid:         newRid(),
+					EncoreName:  dbConfig.EncoreName,
+					DatabaseIdx: int32(dbConfig.Database),
+					KeyPrefix:   ptrOrNil(dbConfig.KeyPrefix),
+					ConnPools:   nil,
+				}).AddConnectionPool(&runtimev1.RedisConnectionPool{
+					IsReadonly:     false,
+					RoleRid:        roleRid,
+					MinConnections: int32(dbConfig.MinConnections),
+					MaxConnections: int32(dbConfig.MaxConnections),
+				})
+			}
+		}
+
+		if len(g.md.Buckets) > 0 {
+			bktProviderConfig, publicBaseURL, err := g.infraManager.BucketProviderConfig()
+			if err != nil {
+				return errors.Wrap(err, "failed to generate bucket provider config")
+			}
+
+			cluster := g.conf.Infra.BucketCluster(&runtimev1.BucketCluster{
+				Rid: newRid(),
+				Provider: &runtimev1.BucketCluster_Gcs{
+					Gcs: &runtimev1.BucketCluster_GCS{
+						Endpoint:  &bktProviderConfig.GCS.Endpoint,
+						Anonymous: true,
+						LocalSign: &runtimev1.BucketCluster_GCS_LocalSignOptions{
+							BaseUrl:    publicBaseURL,
+							AccessId:   "dummy-sa@encore.local",
+							PrivateKey: reverseString(dummyPrivateKeyReversed),
+						},
+					},
+				},
+			})
+
+			for _, bkt := range g.md.Buckets {
+				bktRid := newRid()
+
+				var publicURL *string
+				if bkt.Public {
+					u := publicBaseURL + "/" + bkt.Name
+					publicURL = &u
+				}
+				cluster.Bucket(&runtimev1.Bucket{
+					Rid:           bktRid,
+					EncoreName:    bkt.Name,
+					CloudName:     bkt.Name,
+					PublicBaseUrl: publicURL,
+				})
+			}
+		}
+
+		for secretName, secretVal := range g.DefinedSecrets {
+			g.conf.Infra.AppSecret(&runtimev1.AppSecret{
+				Rid:        newRid(),
+				EncoreName: secretName,
+				Data:       toSecret([]byte(secretVal)),
+			})
+		}
+
+		return nil
+	})
+}
+
+type ProcConfig struct {
+	// The runtime config to add to the process, if any.
+	Runtime option.Option[*runtimev1.RuntimeConfig]
+
+	ListenAddr netip.AddrPort
+	ExtraEnv   []string
+}
+
+func (g *RuntimeConfigGenerator) ProcPerService(proxy *svcproxy.SvcProxy) (services, gateways map[string]*ProcConfig, err error) {
+	if err := g.initialize(); err != nil {
+		return nil, nil, err
+	}
+
+	services = make(map[string]*ProcConfig)
+	gateways = make(map[string]*ProcConfig)
+
+	newRid := func() string { return "res_" + xid.New().String() }
+
+	sd := &runtimev1.ServiceDiscovery{Services: make(map[string]*runtimev1.ServiceDiscovery_Location)}
+
+	svcListenAddr := make(map[string]netip.AddrPort)
+	for _, svc := range g.md.Svcs {
+		listenAddr, err := freeLocalhostAddress()
+		if err != nil {
+			return nil, nil, errors.Wrap(err, "failed to find free localhost address")
+		}
+		svcListenAddr[svc.Name] = listenAddr
+		sd.Services[svc.Name] = &runtimev1.ServiceDiscovery_Location{
+			BaseUrl: proxy.RegisterService(svc.Name, listenAddr),
+			AuthMethods: []*runtimev1.ServiceAuth{
+				{
+					AuthMethod: &runtimev1.ServiceAuth_EncoreAuth_{
+						EncoreAuth: &runtimev1.ServiceAuth_EncoreAuth{
+							AuthKeys: g.authKeys,
+						},
+					},
+				},
+			},
+		}
+	}
+
+	// Set up the service processes.
+	for _, svc := range g.md.Svcs {
+		conf, err := g.conf.Deployment(newRid()).
+			ServiceDiscovery(sd).
+			HostsServices(svc.Name).
+			ReduceWithMeta(g.md).
+			BuildRuntimeConfig()
+		if err != nil {
+			return nil, nil, errors.Wrap(err, "failed to generate runtime config")
+		}
+
+		usedSecrets := secretsUsedByServices(g.md, svc.Name)
+		listenAddr := svcListenAddr[svc.Name]
+		configEnvs := g.encodeConfigs(svc.Name)
+
+		services[svc.Name] = &ProcConfig{
+			Runtime:    option.Some(conf),
+			ListenAddr: listenAddr,
+			ExtraEnv: append([]string{
+				fmt.Sprintf("%s=%s", appSecretsEnvVar, g.encodeSecrets(usedSecrets)),
+			}, configEnvs...),
+		}
+	}
+
+	// Set up the gateways.
+	for _, gw := range g.md.Gateways {
+		conf, err := g.conf.Deployment(newRid()).ServiceDiscovery(sd).HostsGateways(gw.EncoreName).ReduceWithMeta(g.md).BuildRuntimeConfig()
+		if err != nil {
+			return nil, nil, errors.Wrap(err, "failed to generate runtime config")
+		}
+		listenAddr, err := freeLocalhostAddress()
+		if err != nil {
+			return nil, nil, errors.Wrap(err, "failed to find free localhost address")
+		}
+		gateways[gw.EncoreName] = &ProcConfig{
+			Runtime:    option.Some(conf),
+			ListenAddr: listenAddr,
+			ExtraEnv:   []string{},
+		}
+	}
+
+	return
+}
+
+func (g *RuntimeConfigGenerator) AllInOneProc() (*ProcConfig, error) {
+	if err := g.initialize(); err != nil {
+		return nil, err
+	}
+
+	newRid := func() string { return "res_" + xid.New().String() }
+
+	sd := &runtimev1.ServiceDiscovery{Services: make(map[string]*runtimev1.ServiceDiscovery_Location)}
+
+	d := g.conf.Deployment(newRid()).ServiceDiscovery(sd)
+	for _, gw := range g.md.Gateways {
+		d.HostsGateways(gw.EncoreName)
+	}
+	for _, svc := range g.md.Svcs {
+		d.HostsServices(svc.Name)
+	}
+
+	conf, err := d.ReduceWithMeta(g.md).BuildRuntimeConfig()
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to generate runtime config")
+	}
+
+	listenAddr, err := freeLocalhostAddress()
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to find free localhost address")
+	}
+
+	configEnvs := g.encodeConfigs(fns.Map(g.md.Svcs, func(svc *meta.Service) string { return svc.Name })...)
+
+	return &ProcConfig{
+		Runtime:    option.Some(conf),
+		ListenAddr: listenAddr,
+		ExtraEnv: append([]string{
+			fmt.Sprintf("%s=%s", appSecretsEnvVar, encodeSecretsEnv(g.DefinedSecrets)),
+		}, configEnvs...),
+	}, nil
+}
+
+func (g *RuntimeConfigGenerator) ProcPerServiceWithNewRuntimeConfig(proxy *svcproxy.SvcProxy) (conf *runtimev1.RuntimeConfig, services, gateways map[string]*ProcConfig, err error) {
+	if err := g.initialize(); err != nil {
+		return nil, nil, nil, err
+	}
+
+	if len(g.SvcConfigs) > 0 {
+		return nil, nil, nil, errors.New("service configs not yet supported")
+	}
+
+	services = make(map[string]*ProcConfig)
+	gateways = make(map[string]*ProcConfig)
+
+	newRid := func() string { return "res_" + xid.New().String() }
+
+	sd := &runtimev1.ServiceDiscovery{Services: make(map[string]*runtimev1.ServiceDiscovery_Location)}
+
+	svcListenAddr := make(map[string]netip.AddrPort)
+	var svcNames []string
+	for _, svc := range g.md.Svcs {
+		svcNames = append(svcNames, svc.Name)
+		listenAddr, err := freeLocalhostAddress()
+		if err != nil {
+			return nil, nil, nil, errors.Wrap(err, "failed to find free localhost address")
+		}
+		svcListenAddr[svc.Name] = listenAddr
+		sd.Services[svc.Name] = &runtimev1.ServiceDiscovery_Location{
+			BaseUrl: proxy.RegisterService(svc.Name, listenAddr),
+			AuthMethods: []*runtimev1.ServiceAuth{
+				{
+					AuthMethod: &runtimev1.ServiceAuth_EncoreAuth_{
+						EncoreAuth: &runtimev1.ServiceAuth_EncoreAuth{
+							AuthKeys: g.authKeys,
+						},
+					},
+				},
+			},
+		}
+	}
+
+	for _, svc := range g.md.Svcs {
+		conf, err = g.conf.Deployment(newRid()).
+			ServiceDiscovery(sd).
+			HostsServices(svc.Name).
+			ReduceWithMeta(g.md).
+			BuildRuntimeConfig()
+		if err != nil {
+			return nil, nil, nil, errors.Wrap(err, "failed to generate runtime config")
+		}
+
+		listenAddr := svcListenAddr[svc.Name]
+		services[svc.Name] = &ProcConfig{
+			Runtime:    option.Some(conf),
+			ListenAddr: listenAddr,
+		}
+	}
+
+	// Set up the gateways.
+	for _, gw := range g.md.Gateways {
+		listenAddr, err := freeLocalhostAddress()
+		if err != nil {
+			return nil, nil, nil, errors.Wrap(err, "failed to find free localhost address")
+		}
+
+		conf, err = g.conf.Deployment(newRid()).
+			ServiceDiscovery(sd).
+			HostsGateways(gw.EncoreName).
+			//ReduceWithMeta(g.md).
+			BuildRuntimeConfig()
+		if err != nil {
+			return nil, nil, nil, errors.Wrap(err, "failed to generate runtime config")
+		}
+		gateways[gw.EncoreName] = &ProcConfig{
+			Runtime:    option.Some(conf),
+			ListenAddr: listenAddr,
+		}
+	}
+
+	return
+}
+
+func (g *RuntimeConfigGenerator) ForTests(newRuntimeConf bool) (envs []string, err error) {
+	if err := g.initialize(); err != nil {
+		return nil, err
+	}
+
+	newRid := func() string { return "res_" + xid.New().String() }
+
+	sd := &runtimev1.ServiceDiscovery{Services: make(map[string]*runtimev1.ServiceDiscovery_Location)}
+
+	d := g.conf.Deployment(newRid()).ServiceDiscovery(sd)
+	for _, gw := range g.md.Gateways {
+		d.HostsGateways(gw.EncoreName)
+	}
+	for _, svc := range g.md.Svcs {
+		d.HostsServices(svc.Name)
+	}
+
+	conf, err := d.ReduceWithMeta(g.md).BuildRuntimeConfig()
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to generate runtime config")
+	}
+
+	var runtimeCfgStr string
+	if newRuntimeConf {
+		runtimeCfgBytes, err := proto.Marshal(conf)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to marshal runtime config")
+		}
+		gzipped := gzipBytes(runtimeCfgBytes)
+		runtimeCfgStr = "gzip:" + base64.StdEncoding.EncodeToString(gzipped)
+	} else {
+		// We don't use secretEnvs because for local development we use
+		// plaintext secrets across the board.
+		var secretEnvs map[string][]byte = nil
+
+		runtimeCfg, err := rtconfgen.ToLegacy(conf, secretEnvs)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to generate runtime config")
+		}
+		runtimeCfgBytes, err := json.Marshal(runtimeCfg)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to marshal runtime config")
+		}
+		runtimeCfgStr = base64.RawURLEncoding.EncodeToString(runtimeCfgBytes)
+	}
+
+	envs = append(envs,
+		fmt.Sprintf("%s=%s", appSecretsEnvVar, encodeSecretsEnv(g.DefinedSecrets)),
+		fmt.Sprintf("%s=%s", runtimeCfgEnvVar, runtimeCfgStr),
+	)
+
+	svcNames := fns.Map(g.md.Svcs, func(svc *meta.Service) string { return svc.Name })
+	envs = append(envs, g.encodeConfigs(svcNames...)...)
+
+	if g.IncludeMetaEnv {
+		metaBytes, err := proto.Marshal(g.md)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to marshal metadata")
+		}
+		gzipped := gzipBytes(metaBytes)
+		metaEnvStr := "gzip:" + base64.StdEncoding.EncodeToString(gzipped)
+		envs = append(envs, fmt.Sprintf("%s=%s", metaEnvVar, metaEnvStr))
+	}
+
+	if runtimeLibPath := encoreEnv.EncoreRuntimeLib(); runtimeLibPath != "" {
+		envs = append(envs, "ENCORE_RUNTIME_LIB="+runtimeLibPath)
+	}
+
+	return envs, nil
+}
+
+func ptrOrNil[T comparable](val T) *T {
+	var zero T
+	if val == zero {
+		return nil
+	}
+	return &val
+}
+
+func (g *RuntimeConfigGenerator) ProcEnvs(proc *ProcConfig, useRuntimeConfigV2 bool) ([]string, error) {
+	env := append([]string{
+		fmt.Sprintf("%s=%s", listenEnvVar, proc.ListenAddr.String()),
+	}, proc.ExtraEnv...)
+
+	if rt, ok := proc.Runtime.Get(); ok {
+		var runtimeCfgStr string
+
+		if useRuntimeConfigV2 {
+			runtimeCfgBytes, err := proto.Marshal(rt)
+			if err != nil {
+				return nil, errors.Wrap(err, "failed to marshal runtime config")
+			}
+			gzipped := gzipBytes(runtimeCfgBytes)
+			runtimeCfgStr = "gzip:" + base64.StdEncoding.EncodeToString(gzipped)
+		} else {
+			// We don't use secretEnvs because for local development we use
+			// plaintext secrets across the board.
+			var secretEnvs map[string][]byte = nil
+
+			runtimeCfg, err := rtconfgen.ToLegacy(rt, secretEnvs)
+			if err != nil {
+				return nil, errors.Wrap(err, "failed to generate runtime config")
+			}
+
+			runtimeCfgBytes, err := json.Marshal(runtimeCfg)
+			if err != nil {
+				return nil, errors.Wrap(err, "failed to marshal runtime config")
+			}
+			runtimeCfgStr = base64.RawURLEncoding.EncodeToString(runtimeCfgBytes)
+		}
+
+		env = append(env, fmt.Sprintf("%s=%s", runtimeCfgEnvVar, runtimeCfgStr))
+	}
+
+	if g.IncludeMetaEnv {
+		metaBytes, err := proto.Marshal(g.md)
+		if err != nil {
+			return nil, errors.Wrap(err, "failed to marshal metadata")
+		}
+		gzipped := gzipBytes(metaBytes)
+		metaEnvStr := "gzip:" + base64.StdEncoding.EncodeToString(gzipped)
+		env = append(env, fmt.Sprintf("%s=%s", metaEnvVar, metaEnvStr))
+	}
+
+	if runtimeLibPath := encoreEnv.EncoreRuntimeLib(); runtimeLibPath != "" {
+		env = append(env, "ENCORE_RUNTIME_LIB="+runtimeLibPath)
+	}
+
+	return env, nil
+}
+
+func (g *RuntimeConfigGenerator) MissingSecrets() []string {
+	var missing []string
+	for _, pkg := range g.md.Pkgs {
+		for _, name := range pkg.Secrets {
+			if _, ok := g.DefinedSecrets[name]; !ok {
+				missing = append(missing, name)
+			}
+		}
+	}
+
+	sort.Strings(missing)
+	missing = slices.Compact(missing)
+	return missing
+}
+
+func (g *RuntimeConfigGenerator) encodeSecrets(secretNames map[string]bool) string {
+	vals := make(map[string]string)
+	for name := range secretNames {
+		vals[name] = g.DefinedSecrets[name]
+	}
+	return encodeSecretsEnv(vals)
+}
+
+func (g *RuntimeConfigGenerator) encodeConfigs(svcNames ...string) []string {
+	envs := make([]string, 0, len(svcNames))
+	for _, svcName := range svcNames {
+		cfgStr, ok := g.SvcConfigs[svcName]
+		if !ok {
+			continue
+		}
+		envs = append(envs,
+			fmt.Sprintf(
+				"%s%s=%s",
+				serviceCfgEnvPrefix,
+				strings.ToUpper(svcName),
+				base64.RawURLEncoding.EncodeToString([]byte(cfgStr)),
+			),
+		)
+	}
+
+	return envs
+}
+
+// secretsUsedByServices returns the set of secrets that are accessible by the given services, using the metadata for access control.
+func secretsUsedByServices(md *meta.Data, svcNames ...string) (secretNames map[string]bool) {
+	svcNameSet := make(map[string]bool)
+	for _, name := range svcNames {
+		svcNameSet[name] = true
+	}
+
+	secretNames = make(map[string]bool)
+	for _, pkg := range md.Pkgs {
+		if len(pkg.Secrets) > 0 && (pkg.ServiceName == "" || svcNameSet[pkg.ServiceName]) {
+			for _, secret := range pkg.Secrets {
+				secretNames[secret] = true
+			}
+		}
+	}
+	return secretNames
+}
+
+// freeLocalhostAddress returns the first free port number on the system.
+func freeLocalhostAddress() (netip.AddrPort, error) {
+	l, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return netip.AddrPort{}, err
+	}
+	defer func() { _ = l.Close() }()
+
+	return l.Addr().(*net.TCPAddr).AddrPort(), nil
+}
+
+func encodeServiceConfigs(svcCfgs map[string]string) []string {
+	envs := make([]string, 0, len(svcCfgs))
+	for serviceName, cfgString := range svcCfgs {
+		envs = append(envs, "ENCORE_CFG_"+strings.ToUpper(serviceName)+"="+base64.RawURLEncoding.EncodeToString([]byte(cfgString)))
+	}
+	slices.Sort(envs)
+	return envs
+}
+
+func gzipBytes(data []byte) []byte {
+	var buf bytes.Buffer
+	w := gzip.NewWriter(&buf)
+	_, _ = w.Write(data)
+	_ = w.Close()
+	return buf.Bytes()
+}
+
+func reverseString(s string) string {
+	runes := []rune(s)
+	for i, j := 0, len(runes)-1; i < j; i, j = i+1, j-1 {
+		runes[i], runes[j] = runes[j], runes[i]
+	}
+	return string(runes)
+}
+
+// We lightly obfuscate the PK to trigger fewer of the tools that warn about
+// keys in source code.
+//
+// $ tail -r pk.pem | rev
+const dummyPrivateKeyReversed = `-----YEK ETAVIRP DNE-----
+=AOz3eEM5xAe/71Tfx3sQNkW
+4FXBCChkppSrCoQnR6pBeP31wu0S0UTTNDhNmSYcerdSFbRhyZOzNRnhF9o1h5D5
++gKkhRZkC33z5+0p8aWwOVWJY8MDycHwvEYvtwcXLNZBHI8L8++mhp0uFz5c5sNM
+pPRyurcUY36iDzx7hAJcAGoAvXJwVzTmzXBZtvFPs6Alc5gHti2W1l2bz2mwOV77
+BA9xAW4R6EHVTnqaoXvxvocW5Z9I0ecJzx0NPfkXBriW1lNclAnkoRAYqziasa6C
+WIxePQ2VRFbnLu7XR1M/xqg00GHFV0fTlNPo95lC6tl0PAdoupOX1lwjH3rQnTkB
+Y4BgBKQQJ8F0PPTSMAvyK1bcHP2Iob8UFxyHuPOm11aHYwM4VZvmHm8jX/8vz4eb
+6kbNbEkWzfJbbEen/EJLR1XtzvTdjs9bQnJvhQMZmPGzQalqHcVuilQX+PFV4ezM
+A23w1HCIq6vZqXLO8rXhe8S5hImwVSAKq6TK5dlYPOTIBp66lCQgBKwjkcQcX7tq
+mr44FuVB7hqBMfnCB0kKcs1SuYgmfUQE41JGInsqjdpaFOwzQi4Jcx7TK44p9vn2
+ik6i/hN7JSVA8kMImWIxtL18uVC/Rg0RpM2vcjd+pfgUDifZ1FVYCiL3WlEzDBlZ
+bSmYdd57T70mEEiuV8QmGiIRrk6kZAMP4CQgBKQ4mIYJX2RJQ1j0V+iXwY/bg+N5
+DPEWLB0w6ReZapNy4DSEMD1zm6IWUuo3rGfCsSKUD0xFR/YkauO5Q+GI2gKvmj5V
+MRiysBL/8PCBwKiFKo1MFjCUfbV/ks49/OJYSOi9WIJiXEg5Tm56BDTH6I8rNdU1
+lGIimbKIuzEBWUHsyDQgBKQQ8O/PDCI/SJSPYjkxw1fpX022hUvVW9pvtmd6v0vX
+M5kMBkT60IwTWhF0DoAx4Uyn4rlPiJy5TUwjC0po/aCRV+ug5C+wIRTCtVCpqRyz
+GeB4U/3WXHmSulzK5Dw4ADfbWSP0dAbNNOaFI4y6u+acEl5MFt3GN/jieITLsZNK
+X18B7zHj7LR2f5k3xiJJ/7uNFl8SCcnVquvEI1qslUSTLEPCNoiy5iX/VVTmVNwv
+dUi92s5oFMyJOFW5joggeeQ55BN6EsjQTnj/XetnpPe5wf5vvptHg5HOcUjJPmIJ
+vsGpMXoyCh3mzdQPMUJM9Ha8DKlACadqTjdid9ZsAAYLAEggCEAABMgAvulUiO2B
+FkdtezbN/f5vpPbr4knO22xylfkUp5Uw0W/HxtntXXobF42guEEiie49zki5fPHK
+vAMC7bOERRLV4v35Dd9QV/KFe0FxqEfm8bFDM6FoA4c0qnkDaKbMhdvxxs0wVFRm
+BukfBCLOt+W/XyFhZvUKkxgbcOjXV7HRFQGI+GZnrf00qbCRNOCdlYLoYX1kf3pQ
+eNY6o9ZCJxIDO+dUATCoP3tmP4hvonrjGfpek99D4Ye3+iDwg0AxDW+bt9qoRFew
+VdOuGmooPaDDxn95q5IghRhrvrEaHpkN/EZiNEAJWQkZa9wkxGye5T9hMZRBjUkt
+wGPTyf02fuGquCQABIoAAEgAjSggwcKBCSAAFEQAB0w9GikhqkgBNADABIQvEIIM
+-----YEK ETAVIRP NIGEB-----`
diff --git a/cli/daemon/run/testdata/echo/echo/echo.go b/cli/daemon/run/testdata/echo/echo/echo.go
deleted file mode 100644
index 1e79fd447a..0000000000
--- a/cli/daemon/run/testdata/echo/echo/echo.go
+++ /dev/null
@@ -1,13 +0,0 @@
-package echo
-
-import "context"
-
-type Data struct {
-	Message string
-}
-
-// Echo echoes back the request data.
-//encore:api public
-func Echo(ctx context.Context, params *Data) (*Data, error) {
-	return params, nil
-}
diff --git a/cli/daemon/run/testdata/echo/go.mod b/cli/daemon/run/testdata/echo/go.mod
deleted file mode 100644
index 6bd3a78c37..0000000000
--- a/cli/daemon/run/testdata/echo/go.mod
+++ /dev/null
@@ -1 +0,0 @@
-module encore.app
diff --git a/cli/daemon/run/tests.go b/cli/daemon/run/tests.go
index 7f67887d8c..52a56d9012 100644
--- a/cli/daemon/run/tests.go
+++ b/cli/daemon/run/tests.go
@@ -2,94 +2,229 @@ package run
 
 import (
 	"context"
+	"fmt"
 	"io"
-	"os"
-	"strconv"
+	"runtime"
+	"strings"
 
-	"encr.dev/cli/daemon/internal/appfile"
-	"encr.dev/cli/internal/env"
-	"encr.dev/compiler"
-	"encr.dev/parser"
+	"github.com/cockroachdb/errors"
+	"github.com/rs/xid"
+
+	"encore.dev/appruntime/exported/experiments"
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/run/infra"
+	"encr.dev/cli/daemon/secret"
+	"encr.dev/internal/optracker"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/builder/builderimpl"
+	"encr.dev/pkg/cueutil"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/pkg/vcs"
+	runtimev1 "encr.dev/proto/encore/runtime/v1"
 )
 
-// Check checks the app for errors.
-func (mgr *Manager) Check(ctx context.Context, appRoot, relwd string) error {
-	// TODO: We should check that all secret keys are defined as well.
-	cfg := &compiler.Config{
-		Version:           "", // not needed until we start storing trace metadata
-		WorkingDir:        relwd,
-		CgoEnabled:        true,
-		EncoreRuntimePath: env.EncoreRuntimePath(),
-		EncoreGoRoot:      env.EncoreGoRoot(),
+// TestParams groups the parameters for the Test method.
+type TestParams struct {
+	*TestSpecParams
+
+	// Stdout and Stderr are where "go test" output should be written.
+	Stdout, Stderr io.Writer
+}
+
+// Test runs the tests.
+func (mgr *Manager) Test(ctx context.Context, params TestParams) (err error) {
+	expSet, err := params.App.Experiments(params.Environ)
+	if err != nil {
+		return err
 	}
-	result, err := compiler.Build(appRoot, cfg)
-	if err == nil {
-		os.RemoveAll(result.Dir)
+	bld := builderimpl.Resolve(params.App.Lang(), expSet)
+	defer fns.CloseIgnore(bld)
+
+	spec, err := mgr.testSpec(ctx, bld, expSet, params.TestSpecParams)
+	if err != nil {
+		return err
 	}
-	return err
+
+	workingDir := paths.RootedFSPath(params.App.Root(), params.WorkingDir)
+	return bld.RunTests(ctx, builder.RunTestsParams{
+		Spec:       spec,
+		WorkingDir: workingDir,
+		Stdout:     params.Stdout,
+		Stderr:     params.Stderr,
+	})
 }
 
-// TestParams groups the parameters for the Test method.
-type TestParams struct {
-	// AppRoot is the application root.
-	AppRoot string
+// TestSpecParams are the parameters for computing a test spec.
+type TestSpecParams struct {
+	// App is the app to test.
+	App *apps.Instance
 
-	// AppID is the unique app id, as defined by the manifest.
-	AppID string
+	// NS is the namespace to use.
+	NS *namespace.Namespace
+
+	// Secrets are the secrets to use.
+	Secrets *secret.LoadResult
+
+	// Args are the arguments to pass to the test command.
+	Args []string
 
 	// WorkingDir is the working dir, for formatting
 	// error messages with relative paths.
 	WorkingDir string
 
-	// DBClusterID is the database cluster id to connect to.
-	DBClusterID string
+	// Environ are the environment variables to set when running the tests,
+	// in the same format as os.Environ().
+	Environ []string
 
-	// Parse is the parse result for the initial run of the app.
-	// If nil the app is parsed before starting.
-	Parse *parser.Result
-
-	// Args are the arguments to pass to "go test".
-	Args []string
+	// CodegenDebug, if true, specifies to keep the output
+	// around for codegen debugging purposes.
+	CodegenDebug bool
+}
 
-	// Stdout and Stderr are where "go test" output should be written.
-	Stdout, Stderr io.Writer
+type TestSpecResponse struct {
+	Command string
+	Args    []string
+	Environ []string
 }
 
-// Test runs the tests.
-func (mgr *Manager) Test(ctx context.Context, params TestParams) (err error) {
-	appSlug, err := appfile.Slug(params.AppRoot)
+// TestSpec returns how to run the tests.
+func (mgr *Manager) TestSpec(ctx context.Context, params TestSpecParams) (*TestSpecResponse, error) {
+	expSet, err := params.App.Experiments(params.Environ)
 	if err != nil {
-		return err
+		return nil, err
 	}
+	bld := builderimpl.Resolve(params.App.Lang(), expSet)
+	defer fns.CloseIgnore(bld)
 
+	spec, err := mgr.testSpec(ctx, bld, expSet, &params)
+	if err != nil {
+		return nil, err
+	}
+	return &TestSpecResponse{
+		Command: spec.Command,
+		Args:    spec.Args,
+		Environ: spec.Environ,
+	}, nil
+}
+
+// testSpec returns how to run the tests.
+func (mgr *Manager) testSpec(ctx context.Context, bld builder.Impl, expSet *experiments.Set, params *TestSpecParams) (*builder.TestSpecResult, error) {
 	var secrets map[string]string
-	if appSlug != "" {
-		data, err := mgr.Secret.Get(ctx, appSlug)
+	if params.Secrets != nil {
+		secretData, err := params.Secrets.Get(ctx, expSet)
 		if err != nil {
-			return err
+			return nil, err
+		}
+		secrets = secretData.Values
+		// remove db override secrets for tests
+		for k, _ := range secrets {
+			if strings.HasPrefix(k, "sqldb::") {
+				delete(secrets, k)
+			}
+		}
+	}
+
+	vcsRevision := vcs.GetRevision(params.App.Root())
+	buildInfo := builder.BuildInfo{
+		BuildTags:          builder.LocalBuildTags,
+		CgoEnabled:         true,
+		StaticLink:         false,
+		DebugMode:          builder.DebugModeDisabled,
+		Environ:            params.Environ,
+		GOOS:               runtime.GOOS,
+		GOARCH:             runtime.GOARCH,
+		KeepOutput:         params.CodegenDebug,
+		Revision:           vcsRevision.Revision,
+		UncommittedChanges: vcsRevision.Uncommitted,
+
+		// Use the local JS runtime if this is a development build.
+		UseLocalJSRuntime: version.Channel == version.DevBuild,
+	}
+
+	parse, err := bld.Parse(ctx, builder.ParseParams{
+		Build:       buildInfo,
+		App:         params.App,
+		Experiments: expSet,
+		WorkingDir:  params.WorkingDir,
+		ParseTests:  true,
+	})
+	if err != nil {
+		return nil, err
+	}
+	if err := params.App.CacheMetadata(parse.Meta); err != nil {
+		return nil, errors.Wrap(err, "cache metadata")
+	}
+
+	rm := infra.NewResourceManager(params.App, mgr.ClusterMgr, mgr.ObjectsMgr, mgr.PublicBuckets, params.NS, nil, mgr.DBProxyPort, true)
+
+	jobs := optracker.NewAsyncBuildJobs(ctx, params.App.PlatformOrLocalID(), nil)
+	rm.StartRequiredServices(jobs, parse.Meta)
+
+	// Note: jobs.Wait must be called before generateConfig.
+	if err := jobs.Wait(); err != nil {
+		return nil, err
+	}
+
+	gateways := make(map[string]GatewayConfig)
+	gatewayBaseURL := fmt.Sprintf("http://localhost:%d", mgr.RuntimePort)
+	for _, gw := range parse.Meta.Gateways {
+		gateways[gw.EncoreName] = GatewayConfig{
+			BaseURL:   gatewayBaseURL,
+			Hostnames: []string{"localhost"},
 		}
-		secrets = data.Values
 	}
 
-	cfg := &compiler.Config{
-		Version:           "", // not needed until we start storing trace metadata
-		WorkingDir:        params.WorkingDir,
-		CgoEnabled:        true,
-		EncoreRuntimePath: env.EncoreRuntimePath(),
-		EncoreGoRoot:      env.EncoreGoRoot(),
-		Test: &compiler.TestConfig{
-			Env: []string{
-				"ENCORE_ENV_ID=test",
-				"ENCORE_PROC_ID=test",
-				"ENCORE_RUNTIME_ADDRESS=localhost:" + strconv.Itoa(mgr.RuntimePort),
-				"ENCORE_SQLDB_ADDRESS=localhost:" + strconv.Itoa(mgr.DBProxyPort),
-				"ENCORE_SQLDB_PASSWORD=" + params.DBClusterID,
-				"ENCORE_SECRETS=" + encodeSecretsEnv(secrets),
-			},
-			Args:   params.Args,
-			Stdout: params.Stdout,
-			Stderr: params.Stderr,
+	cfg, err := bld.ServiceConfigs(ctx, builder.ServiceConfigsParams{
+		Parse: parse,
+		CueMeta: &cueutil.Meta{
+			APIBaseURL: gatewayBaseURL,
+			EnvName:    "local",
+			EnvType:    cueutil.EnvType_Test,
+			CloudType:  cueutil.CloudType_Local,
 		},
+	})
+	if err != nil {
+		return nil, err
 	}
-	return compiler.Test(ctx, params.AppRoot, cfg)
+
+	authKey := genAuthKey()
+	configGen := &RuntimeConfigGenerator{
+		app:            params.App,
+		infraManager:   rm,
+		md:             parse.Meta,
+		AppID:          option.Some(params.App.PlatformOrLocalID()),
+		EnvID:          option.Some("test"),
+		TraceEndpoint:  option.Some(fmt.Sprintf("http://localhost:%d/trace", mgr.RuntimePort)),
+		AuthKey:        authKey,
+		Gateways:       gateways,
+		DefinedSecrets: secrets,
+		SvcConfigs:     cfg.Configs,
+		EnvName:        option.Some("test"),
+		EnvType:        option.Some(runtimev1.Environment_TYPE_TEST),
+		DeployID:       option.Some(fmt.Sprintf("clitest_%s", xid.New().String())),
+		IncludeMetaEnv: bld.NeedsMeta(),
+	}
+
+	env, err := configGen.ForTests(bld.UseNewRuntimeConfig())
+	if err != nil {
+		return nil, err
+	}
+	env = append(env, encodeServiceConfigs(cfg.Configs)...)
+
+	return bld.TestSpec(ctx, builder.TestSpecParams{
+		Compile: builder.CompileParams{
+			Build:       buildInfo,
+			App:         params.App,
+			Parse:       parse,
+			OpTracker:   nil,
+			Experiments: expSet,
+			WorkingDir:  params.WorkingDir,
+		},
+		Env:  append(params.Environ, env...),
+		Args: params.Args,
+	})
 }
diff --git a/cli/daemon/run/watch.go b/cli/daemon/run/watch.go
index 7108495f9e..3b453d1194 100644
--- a/cli/daemon/run/watch.go
+++ b/cli/daemon/run/watch.go
@@ -2,57 +2,70 @@ package run
 
 import (
 	"path/filepath"
-	"time"
+	"strings"
 
-	"github.com/rjeczalik/notify"
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/pkg/watcher"
 )
 
 // watch watches the given app for changes, and reports
 // them on c.
 func (mgr *Manager) watch(run *Run) error {
-	evs := make(chan notify.EventInfo)
-	if err := notify.Watch(filepath.Join(run.Root, "..."), evs, notify.All); err != nil {
+	sub, err := run.App.Watch(func(i *apps.Instance, event []watcher.Event) {
+		if IgnoreEvents(event) {
+			return
+		}
+
+		mgr.RunStdout(run, []byte("Changes detected, recompiling...\n"))
+		if err := run.Reload(); err != nil {
+			if errList := AsErrorList(err); errList != nil {
+				mgr.RunError(run, errList)
+			} else {
+				errStr := err.Error()
+				if !strings.HasSuffix(errStr, "\n") {
+					errStr += "\n"
+				}
+				mgr.RunStderr(run, []byte(errStr))
+			}
+		} else {
+			mgr.RunStdout(run, []byte("Reloaded successfully.\n"))
+		}
+	})
+	if err != nil {
 		return err
 	}
 
 	go func() {
 		<-run.Done()
-		notify.Stop(evs)
+		run.App.Unwatch(sub)
 	}()
 
-	go func() {
-		for {
-			select {
-			case <-run.Done():
-				return
-			case ev := <-evs:
-				if ignoreEvent(run.Root, ev) {
-					continue
-				}
-				// We've seen that some editors like vim rename the .go files to another extension,
-				// which breaks our parser since it doesn't recognize the file as a .go file.
-				// This race is annoying, but in practice a 100ms delay is imperceptible since
-				// the user is busy working in their editor.
-				time.Sleep(100 * time.Millisecond)
-				mgr.runStdout(run, []byte("Changes detected, recompiling...\n"))
-				if _, err := run.Reload(); err != nil {
-					mgr.runStderr(run, []byte(err.Error()))
-				} else {
-					mgr.runStdout(run, []byte("Reloaded successfully.\n"))
-				}
-			}
-		}
-	}()
 	return nil
 }
 
-func ignoreEvent(appRoot string, ev notify.EventInfo) bool {
-	path := ev.Path()
+// IgnoreEvents will return true if _all_ events are on files that should be ignored
+// as the do not impact the running app, or are the result of Encore itself generating code.
+func IgnoreEvents(events []watcher.Event) bool {
+	for _, event := range events {
+		if !ignoreEvent(event) {
+			return false
+		}
+	}
+	return true
+}
+
+func ignoreEvent(ev watcher.Event) bool {
+	filename := filepath.Base(ev.Path)
+	if strings.HasPrefix(strings.ToLower(filename), "encore.gen.") {
+		// Ignore generated code
+		return true
+	}
 
-	// Ignore non-Go files
-	ext := filepath.Ext(path)
+	// Ignore files which wouldn't impact the running app
+	ext := filepath.Ext(ev.Path)
 	switch ext {
-	case ".go", ".sql", ".mod", ".sum", ".app":
+	case ".go", ".sql", ".mod", ".sum", ".work", ".app", ".cue",
+		".ts", ".js", ".tsx", ".jsx", ".mts", ".mjs", ".cjs", ".cts":
 		return false
 	default:
 		return true
diff --git a/cli/daemon/runtime/runtime.go b/cli/daemon/runtime/runtime.go
deleted file mode 100644
index c0d8ff04e5..0000000000
--- a/cli/daemon/runtime/runtime.go
+++ /dev/null
@@ -1,99 +0,0 @@
-package runtime
-
-import (
-	"encoding/base64"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"time"
-
-	"encr.dev/cli/daemon/run"
-	"encr.dev/cli/daemon/runtime/trace"
-	"encr.dev/proto/encore/server/remote"
-	"github.com/rs/zerolog/log"
-)
-
-type server struct {
-	runMgr *run.Manager
-	ts     *trace.Store
-	rc     remote.RemoteClient
-}
-
-func NewServer(runMgr *run.Manager, ts *trace.Store, rc remote.RemoteClient) http.Handler {
-	s := &server{runMgr: runMgr, ts: ts, rc: rc}
-	return s
-}
-
-// ServeHTTP implements http.Handler.
-func (s *server) ServeHTTP(w http.ResponseWriter, req *http.Request) {
-	switch req.URL.Path {
-	case "/trace":
-		s.RecordTrace(w, req)
-	default:
-		http.Error(w, "Not Found", http.StatusNotFound)
-	}
-}
-
-func (s *server) RecordTrace(w http.ResponseWriter, req *http.Request) {
-	pid := req.Header.Get("X-Encore-Proc-ID")
-	if pid == "" {
-		http.Error(w, "missing X-Encore-Proc-ID header", http.StatusBadRequest)
-		return
-	}
-	traceID, err := parseTraceID(req.Header.Get("X-Encore-Trace-ID"))
-	if err != nil {
-		http.Error(w, "invalid X-Encore-Trace-ID header: "+err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	proc := s.runMgr.FindProc(pid)
-	if proc == nil {
-		http.Error(w, "process "+pid+" not running", http.StatusBadRequest)
-		return
-	}
-
-	data, err := ioutil.ReadAll(req.Body)
-	if err != nil {
-		http.Error(w, err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	reqs, err := trace.Parse(traceID, data)
-	if err != nil {
-		log.Error().Err(err).Msg("runtime: could not parse trace")
-		http.Error(w, "could not parse trace: "+err.Error(), http.StatusBadRequest)
-		return
-	}
-
-	if len(reqs) == 0 {
-		// Probably a 401 Unauthorized; drop it for now
-		// since we can't visualize it nicely
-		return
-	}
-
-	tm := &trace.TraceMeta{
-		ID:    traceID,
-		Reqs:  reqs,
-		AppID: proc.Run.AppID,
-		Date:  time.Now(),
-		Meta:  proc.Meta,
-	}
-
-	err = s.ts.Store(req.Context(), tm)
-	if err != nil {
-		http.Error(w, "could not record trace:"+err.Error(), http.StatusInternalServerError)
-		return
-	}
-}
-
-func parseTraceID(s string) (id trace.ID, err error) {
-	parsedID, err := base64.RawURLEncoding.DecodeString(s)
-	if err != nil {
-		return id, err
-	}
-	if len(parsedID) != len(id) {
-		return id, fmt.Errorf("bad length")
-	}
-	copy(id[:], parsedID)
-	return id, nil
-}
diff --git a/cli/daemon/runtime/trace/trace.go b/cli/daemon/runtime/trace/trace.go
deleted file mode 100644
index 879781b8be..0000000000
--- a/cli/daemon/runtime/trace/trace.go
+++ /dev/null
@@ -1,699 +0,0 @@
-package trace
-
-import (
-	"context"
-	"encoding/binary"
-	"fmt"
-	"sync"
-	"time"
-
-	tracepb "encr.dev/proto/encore/engine/trace"
-	metapb "encr.dev/proto/encore/parser/meta/v1"
-	"github.com/rs/zerolog/log"
-)
-
-type ID [16]byte
-
-type TraceMeta struct {
-	ID    ID
-	Reqs  []*tracepb.Request
-	AppID string
-	EnvID string
-	Date  time.Time
-	Meta  *metapb.Data
-}
-
-// A Store stores traces received from running applications.
-type Store struct {
-	trmu   sync.Mutex
-	traces map[string][]*TraceMeta
-
-	lnmu sync.Mutex
-	ln   map[chan<- *TraceMeta]struct{}
-}
-
-func NewStore() *Store {
-	return &Store{
-		traces: make(map[string][]*TraceMeta),
-		ln:     make(map[chan<- *TraceMeta]struct{}),
-	}
-}
-
-func (st *Store) Listen(ch chan<- *TraceMeta) {
-	st.lnmu.Lock()
-	st.ln[ch] = struct{}{}
-	st.lnmu.Unlock()
-}
-
-func (st *Store) Store(ctx context.Context, tr *TraceMeta) error {
-	st.trmu.Lock()
-	st.traces[tr.AppID] = append(st.traces[tr.AppID], tr)
-	st.trmu.Unlock()
-
-	st.lnmu.Lock()
-	defer st.lnmu.Unlock()
-	for ch := range st.ln {
-		// Don't block trying to send
-		select {
-		case ch <- tr:
-		default:
-		}
-	}
-	return nil
-}
-
-func (st *Store) List(appID string) []*TraceMeta {
-	st.trmu.Lock()
-	tr := st.traces[appID]
-	st.trmu.Unlock()
-	return tr
-}
-
-func Parse(traceID ID, data []byte) ([]*tracepb.Request, error) {
-	id := &tracepb.TraceID{
-		Low:  bin.Uint64(traceID[:8]),
-		High: bin.Uint64(traceID[8:]),
-	}
-	tp := &traceParser{
-		traceReader: traceReader{buf: data},
-		traceID:     id,
-		reqMap:      make(map[uint64]*tracepb.Request),
-		txMap:       make(map[uint64]*tracepb.DBTransaction),
-		queryMap:    make(map[uint64]*tracepb.DBQuery),
-		callMap:     make(map[uint64]interface{}),
-		goMap:       make(map[goKey]*tracepb.Goroutine),
-		httpMap:     make(map[uint64]*tracepb.HTTPCall),
-	}
-	if err := tp.Parse(); err != nil {
-		return nil, err
-	}
-	return tp.reqs, nil
-}
-
-type goKey struct {
-	spanID uint64
-	goid   uint32
-}
-
-type traceParser struct {
-	traceReader
-	traceID  *tracepb.TraceID
-	reqs     []*tracepb.Request
-	reqMap   map[uint64]*tracepb.Request
-	txMap    map[uint64]*tracepb.DBTransaction
-	queryMap map[uint64]*tracepb.DBQuery
-	callMap  map[uint64]interface{} // *RPCCall or *AuthCall
-	httpMap  map[uint64]*tracepb.HTTPCall
-	goMap    map[goKey]*tracepb.Goroutine
-}
-
-func (tp *traceParser) Parse() error {
-	for i := 0; !tp.Done(); i++ {
-		ev := tp.Byte()
-		ts := tp.Uint64()
-		size := int(tp.Uint32())
-		startOff := tp.Offset()
-
-		var err error
-		switch ev {
-		case 0x01:
-			err = tp.requestStart(ts)
-		case 0x02:
-			err = tp.requestEnd(ts)
-		case 0x03:
-			err = tp.goroutineStart(ts)
-		case 0x04:
-			err = tp.goroutineEnd(ts)
-		case 0x05:
-			err = tp.goroutineClear(ts)
-		case 0x06:
-			err = tp.transactionStart(ts)
-		case 0x07:
-			err = tp.transactionEnd(ts)
-		case 0x08:
-			err = tp.queryStart(ts)
-		case 0x09:
-			err = tp.queryEnd(ts)
-		case 0x0A:
-			err = tp.callStart(ts)
-		case 0x0B:
-			err = tp.callEnd(ts)
-		case 0x0C, 0x0D:
-			// Skip these events for now
-			tp.Skip(size)
-
-		case 0x0E:
-			err = tp.httpStart(ts)
-		case 0x0F:
-			err = tp.httpEnd(ts)
-		case 0x10:
-			err = tp.httpBodyClosed(ts)
-
-		default:
-			log.Error().Int("idx", i).Hex("event", []byte{ev}).Msg("trace: unknown event type, skipping")
-			tp.Skip(size)
-			err = nil
-		}
-		if err != nil {
-			return fmt.Errorf("event #%d: parsing event=%x: %v", i, ev, err)
-		}
-
-		if tp.Overflow() {
-			return fmt.Errorf("event #%d: invalid trace format (reader overflow parsing event %x)", i, ev)
-		} else if off, want := tp.Offset(), startOff+size; off < want {
-			log.Error().Int("idx", i).Hex("event", []byte{ev}).Int("remainingBytes", want-off).Msg("trace: parser did not consume whole frame, skipping ahead")
-			tp.Skip(want - off)
-		} else if off > want {
-			return fmt.Errorf("event #%d: parser (event=%x) exceeded frame size by %d bytes", i, ev, off-want)
-		}
-	}
-
-	return nil
-}
-
-func (tp *traceParser) requestStart(ts uint64) error {
-	var typ tracepb.Request_Type
-	switch b := tp.Byte(); b {
-	case 0x01:
-		typ = tracepb.Request_RPC
-	case 0x02:
-		typ = tracepb.Request_AUTH
-	default:
-		return fmt.Errorf("unknown request type %x", b)
-	}
-
-	req := &tracepb.Request{
-		TraceId:      tp.traceID,
-		SpanId:       tp.Uint64(),
-		ParentSpanId: tp.Uint64(),
-		StartTime:    tp.Uint64(),
-		// EndTime not set yet
-		Goid:    uint32(tp.UVarint()),
-		CallLoc: int32(tp.UVarint()),
-		DefLoc:  int32(tp.UVarint()),
-		Uid:     tp.String(),
-		Type:    typ,
-	}
-	// We use event timestamps instead
-	req.StartTime = ts
-
-	for n, i := tp.UVarint(), uint64(0); i < n; i++ {
-		size := tp.UVarint()
-		if size > (10 << 20) {
-			return fmt.Errorf("input too large: %d bytes", size)
-		}
-		input := make([]byte, size)
-		tp.Bytes(input)
-		req.Inputs = append(req.Inputs, input)
-	}
-	tp.reqs = append(tp.reqs, req)
-	tp.reqMap[req.SpanId] = req
-	return nil
-}
-
-func (tp *traceParser) requestEnd(ts uint64) error {
-	spanID := tp.Uint64()
-	req, ok := tp.reqMap[spanID]
-	if !ok {
-		return fmt.Errorf("unknown request span: %v", spanID)
-	}
-	// dur := ts - rd.startTs
-	req.EndTime = ts
-
-	if tp.Byte() == 0 {
-		// No error
-		for n, i := tp.UVarint(), uint64(0); i < n; i++ {
-			size := tp.UVarint()
-			if size > (10 << 20) {
-				return fmt.Errorf("input too large: %d bytes", size)
-			}
-			output := make([]byte, size)
-			tp.Bytes(output)
-			req.Outputs = append(req.Outputs, output)
-		}
-	} else {
-		msg := tp.ByteString()
-		if len(msg) == 0 {
-			msg = []byte("unknown error")
-		}
-		req.Err = msg
-	}
-	return nil
-}
-
-func (tp *traceParser) goroutineStart(ts uint64) error {
-	spanID := tp.Uint64()
-	req, ok := tp.reqMap[spanID]
-	if !ok {
-		return fmt.Errorf("unknown request span id: %v", spanID)
-	}
-	goid := tp.Uint32()
-	g := &tracepb.Goroutine{
-		Goid:      goid,
-		CallLoc:   0, // not yet supported
-		StartTime: ts,
-	}
-	k := goKey{spanID: spanID, goid: goid}
-	req.Events = append(req.Events, &tracepb.Event{
-		Data: &tracepb.Event_Goroutine{Goroutine: g},
-	})
-	tp.goMap[k] = g
-	return nil
-}
-
-func (tp *traceParser) goroutineEnd(ts uint64) error {
-	spanID := tp.Uint64()
-	goid := tp.Uint32()
-	k := goKey{spanID: spanID, goid: goid}
-	g, ok := tp.goMap[k]
-	if !ok {
-		return fmt.Errorf("unknown goroutine id: %v", goid)
-	}
-	g.EndTime = ts
-	delete(tp.goMap, k)
-	return nil
-}
-
-func (tp *traceParser) goroutineClear(ts uint64) error {
-	spanID := tp.Uint64()
-	goid := tp.Uint32()
-	k := goKey{spanID: spanID, goid: goid}
-	g, ok := tp.goMap[k]
-	if !ok {
-		return fmt.Errorf("unknown goroutine id: %v/%v", spanID, goid)
-	}
-	g.EndTime = ts
-	delete(tp.goMap, k)
-	return nil
-}
-
-func (tp *traceParser) transactionStart(ts uint64) error {
-	txid := tp.UVarint()
-	spanID := tp.Uint64()
-	req, ok := tp.reqMap[spanID]
-	if !ok {
-		return fmt.Errorf("unknown request span: %v", spanID)
-	}
-	goid := uint32(tp.UVarint())
-	tx := &tracepb.DBTransaction{
-		Goid:      goid,
-		StartLoc:  int32(tp.UVarint()),
-		StartTime: ts,
-	}
-	tp.txMap[txid] = tx
-	req.Events = append(req.Events, &tracepb.Event{
-		Data: &tracepb.Event_Tx{Tx: tx},
-	})
-	return nil
-}
-
-func (tp *traceParser) transactionEnd(ts uint64) error {
-	txid := tp.UVarint()
-	_ = tp.Uint64() // spanID
-	tx, ok := tp.txMap[txid]
-	if !ok {
-		return fmt.Errorf("unknown transaction id: %v", txid)
-	}
-	_ = uint32(tp.UVarint()) // goid
-	compl := tp.Byte()
-	endLoc := int32(tp.UVarint())
-	errMsg := tp.ByteString()
-
-	// It's possible to get multiple transaction end events.
-	// Ignore them for now; we will expose this information later.
-	if tx.EndTime == 0 {
-		tx.EndTime = ts
-		tx.EndLoc = endLoc
-		tx.Err = errMsg
-		switch compl {
-		case 0:
-			tx.Completion = tracepb.DBTransaction_ROLLBACK
-		case 1:
-			tx.Completion = tracepb.DBTransaction_COMMIT
-		default:
-			return fmt.Errorf("unknown completion type: %x", compl)
-		}
-	}
-	return nil
-}
-
-func (tp *traceParser) queryStart(ts uint64) error {
-	qid := tp.UVarint()
-	spanID := tp.Uint64()
-	req, ok := tp.reqMap[spanID]
-	if !ok {
-		return fmt.Errorf("unknown request span: %v", spanID)
-	}
-	txid := tp.UVarint()
-	goid := uint32(tp.UVarint())
-	q := &tracepb.DBQuery{
-		Goid:      goid,
-		CallLoc:   int32(tp.UVarint()),
-		StartTime: ts,
-		Query:     tp.ByteString(),
-	}
-	tp.queryMap[qid] = q
-
-	if txid != 0 {
-		tx, ok := tp.txMap[txid]
-		if !ok {
-			return fmt.Errorf("unknown transaction id: %v", txid)
-		}
-		tx.Queries = append(tx.Queries, q)
-	} else {
-		req.Events = append(req.Events, &tracepb.Event{
-			Data: &tracepb.Event_Query{Query: q},
-		})
-	}
-
-	return nil
-}
-
-func (tp *traceParser) queryEnd(ts uint64) error {
-	qid := tp.UVarint()
-	q, ok := tp.queryMap[qid]
-	if !ok {
-		return fmt.Errorf("unknown query id: %v", qid)
-	}
-	q.EndTime = ts
-	q.Err = tp.ByteString()
-	return nil
-}
-
-func (tp *traceParser) callStart(ts uint64) error {
-	callID := tp.UVarint()
-	spanID := tp.Uint64()
-	childSpanID := tp.Uint64()
-	req, ok := tp.reqMap[spanID]
-	if !ok {
-		return fmt.Errorf("unknown request span: %v", spanID)
-	}
-	c := &tracepb.RPCCall{
-		SpanId:    childSpanID,
-		Goid:      uint32(tp.UVarint()),
-		CallLoc:   int32(tp.UVarint()),
-		DefLoc:    int32(tp.UVarint()),
-		StartTime: ts,
-	}
-	tp.callMap[callID] = c
-	req.Events = append(req.Events, &tracepb.Event{
-		Data: &tracepb.Event_Rpc{Rpc: c},
-	})
-	return nil
-}
-
-func (tp *traceParser) callEnd(ts uint64) error {
-	callID := tp.UVarint()
-	errMsg := tp.ByteString()
-	c, ok := tp.callMap[callID].(*tracepb.RPCCall)
-	if !ok {
-		return fmt.Errorf("unknown call: %v ", callID)
-	}
-	c.EndTime = ts
-	c.Err = errMsg
-	delete(tp.callMap, callID)
-	return nil
-}
-
-func (tp *traceParser) httpStart(ts uint64) error {
-	callID := tp.UVarint()
-	spanID := tp.Uint64()
-	childSpanID := tp.Uint64()
-	req, ok := tp.reqMap[spanID]
-	if !ok {
-		return fmt.Errorf("unknown request span: %v", spanID)
-	}
-	c := &tracepb.HTTPCall{
-		SpanId:    childSpanID,
-		Goid:      uint32(tp.UVarint()),
-		Method:    tp.String(),
-		Url:       tp.String(),
-		StartTime: ts,
-	}
-	tp.httpMap[callID] = c
-	req.Events = append(req.Events, &tracepb.Event{
-		Data: &tracepb.Event_Http{Http: c},
-	})
-	return nil
-}
-
-func (tp *traceParser) httpEnd(ts uint64) error {
-	callID := tp.UVarint()
-	errMsg := tp.ByteString()
-	status := tp.UVarint()
-	c, ok := tp.httpMap[callID]
-	if !ok {
-		return fmt.Errorf("unknown call: %v ", callID)
-	}
-	c.EndTime = ts
-	c.Err = errMsg
-	c.StatusCode = uint32(status)
-
-	numEvents := tp.UVarint()
-	c.Events = make([]*tracepb.HTTPTraceEvent, 0, numEvents)
-	for i := 0; i < int(numEvents); i++ {
-		ev, err := tp.httpEvent()
-		if err != nil {
-			return err
-		}
-		c.Events = append(c.Events, ev)
-	}
-
-	return nil
-}
-
-func (tp *traceParser) httpBodyClosed(ts uint64) error {
-	callID := tp.UVarint()
-	_ = tp.ByteString() // close error
-	c, ok := tp.httpMap[callID]
-	if !ok {
-		return fmt.Errorf("unknown call: %v ", callID)
-	}
-	c.BodyClosedTime = ts
-	delete(tp.httpMap, callID)
-	return nil
-}
-
-func (tp *traceParser) httpEvent() (*tracepb.HTTPTraceEvent, error) {
-	code := tracepb.HTTPTraceEventCode(tp.Byte())
-	ts := tp.Int64()
-	ev := &tracepb.HTTPTraceEvent{
-		Code: code,
-		Time: uint64(ts),
-	}
-
-	switch code {
-	case tracepb.HTTPTraceEventCode_GET_CONN:
-		ev.Data = &tracepb.HTTPTraceEvent_GetConn{
-			GetConn: &tracepb.HTTPGetConnData{
-				HostPort: tp.String(),
-			},
-		}
-
-	case tracepb.HTTPTraceEventCode_GOT_CONN:
-		ev.Data = &tracepb.HTTPTraceEvent_GotConn{
-			GotConn: &tracepb.HTTPGotConnData{
-				Reused:         tp.Bool(),
-				WasIdle:        tp.Bool(),
-				IdleDurationNs: tp.Int64(),
-			},
-		}
-
-	case tracepb.HTTPTraceEventCode_GOT_FIRST_RESPONSE_BYTE:
-		// no data
-
-	case tracepb.HTTPTraceEventCode_GOT_1XX_RESPONSE:
-		ev.Data = &tracepb.HTTPTraceEvent_Got_1XxResponse{
-			Got_1XxResponse: &tracepb.HTTPGot1XxResponseData{
-				Code: int32(tp.Varint()),
-			},
-		}
-
-	case tracepb.HTTPTraceEventCode_DNS_START:
-		ev.Data = &tracepb.HTTPTraceEvent_DnsStart{
-			DnsStart: &tracepb.HTTPDNSStartData{
-				Host: tp.String(),
-			},
-		}
-
-	case tracepb.HTTPTraceEventCode_DNS_DONE:
-		data := &tracepb.HTTPDNSDoneData{
-			Err: tp.ByteString(),
-		}
-		addrs := int(tp.UVarint())
-		for j := 0; j < addrs; j++ {
-			data.Addrs = append(data.Addrs, &tracepb.DNSAddr{
-				Ip: tp.ByteString(),
-			})
-		}
-		ev.Data = &tracepb.HTTPTraceEvent_DnsDone{DnsDone: data}
-
-	case tracepb.HTTPTraceEventCode_CONNECT_START:
-		ev.Data = &tracepb.HTTPTraceEvent_ConnectStart{
-			ConnectStart: &tracepb.HTTPConnectStartData{
-				Network: tp.String(),
-				Addr:    tp.String(),
-			},
-		}
-
-	case tracepb.HTTPTraceEventCode_CONNECT_DONE:
-		ev.Data = &tracepb.HTTPTraceEvent_ConnectDone{
-			ConnectDone: &tracepb.HTTPConnectDoneData{
-				Network: tp.String(),
-				Addr:    tp.String(),
-				Err:     tp.ByteString(),
-			},
-		}
-
-	case tracepb.HTTPTraceEventCode_TLS_HANDSHAKE_START:
-		// no data
-
-	case tracepb.HTTPTraceEventCode_TLS_HANDSHAKE_DONE:
-		ev.Data = &tracepb.HTTPTraceEvent_TlsHandshakeDone{
-			TlsHandshakeDone: &tracepb.HTTPTLSHandshakeDoneData{
-				Err:                tp.ByteString(),
-				TlsVersion:         tp.Uint32(),
-				CipherSuite:        tp.Uint32(),
-				ServerName:         tp.String(),
-				NegotiatedProtocol: tp.String(),
-			},
-		}
-
-	case tracepb.HTTPTraceEventCode_WROTE_HEADERS:
-		// no data
-
-	case tracepb.HTTPTraceEventCode_WROTE_REQUEST:
-		ev.Data = &tracepb.HTTPTraceEvent_WroteRequest{
-			WroteRequest: &tracepb.HTTPWroteRequestData{
-				Err: tp.ByteString(),
-			},
-		}
-
-	case tracepb.HTTPTraceEventCode_WAIT_100_CONTINUE:
-		// no data
-
-	default:
-		return nil, fmt.Errorf("unknown http event %v", code)
-	}
-	return ev, nil
-}
-
-var bin = binary.LittleEndian
-
-type traceReader struct {
-	buf []byte
-	off int
-	err bool
-}
-
-func (tr *traceReader) Offset() int {
-	return tr.off
-}
-
-func (tr *traceReader) Done() bool {
-	return tr.off >= len(tr.buf)
-}
-
-func (tr *traceReader) Overflow() bool {
-	return tr.err
-}
-
-func (tr *traceReader) Bytes(b []byte) {
-	n := copy(b, tr.buf[tr.off:])
-	tr.off += n
-	if len(b) > n {
-		tr.err = true
-	}
-}
-
-func (tr *traceReader) Skip(n int) {
-	tr.off += n
-	if tr.off > len(tr.buf) {
-		tr.off = len(tr.buf)
-		tr.err = true
-	}
-}
-
-func (tr *traceReader) Byte() byte {
-	var buf [1]byte
-	tr.Bytes(buf[:])
-	return buf[0]
-}
-
-func (tr *traceReader) Bool() bool {
-	return tr.Byte() != 0
-}
-
-func (tr *traceReader) String() string {
-	return string(tr.ByteString())
-}
-
-func (tr *traceReader) ByteString() []byte {
-	size := tr.UVarint()
-	b := make([]byte, int(size))
-	tr.Bytes(b)
-	return b
-}
-
-func (tr *traceReader) Time() time.Time {
-	ns := tr.Int64()
-	return time.Unix(0, ns)
-}
-
-func (tr *traceReader) Int32() int32 {
-	u := tr.Uint32()
-	var v int32
-	if u&1 == 0 {
-		v = int32(u >> 1)
-	} else {
-		v = ^int32(u >> 1)
-	}
-	return v
-}
-
-func (tr *traceReader) Uint32() uint32 {
-	var buf [4]byte
-	tr.Bytes(buf[:])
-	return bin.Uint32(buf[:])
-}
-
-func (tr *traceReader) Int64() int64 {
-	u := tr.Uint64()
-	var v int64
-	if u&1 == 0 {
-		v = int64(u >> 1)
-	} else {
-		v = ^int64(u >> 1)
-	}
-	return v
-}
-
-func (tr *traceReader) Uint64() uint64 {
-	var buf [8]byte
-	tr.Bytes(buf[:])
-	return bin.Uint64(buf[:])
-}
-
-func (tr *traceReader) Varint() int64 {
-	u := tr.UVarint()
-	var v int64
-	if u&1 == 0 {
-		v = int64(u >> 1)
-	} else {
-		v = ^int64(u >> 1)
-	}
-	return v
-}
-
-func (tr *traceReader) UVarint() uint64 {
-	var u uint64
-	for i := 0; tr.off < len(tr.buf); i += 7 {
-		b := tr.buf[tr.off]
-		u |= uint64(b&^0x80) << i
-		tr.off++
-		if b&0x80 == 0 {
-			break
-		}
-	}
-	return u
-}
diff --git a/cli/daemon/schema.go b/cli/daemon/schema.go
new file mode 100644
index 0000000000..42ccf8e3a7
--- /dev/null
+++ b/cli/daemon/schema.go
@@ -0,0 +1,170 @@
+package daemon
+
+import (
+	"fmt"
+	"time"
+
+	jsoniter "github.com/json-iterator/go"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+// genSchema generates a JSON payload to match the schema.
+func genSchema(meta *meta.Data, decl *schema.Type) []byte {
+	if decl == nil {
+		return nil
+	}
+	r := &schemaRenderer{
+		Stream:    jsoniter.NewStream(jsoniter.ConfigDefault, nil, 256),
+		meta:      meta,
+		seenDecls: make(map[uint32]*schema.Decl),
+	}
+	return r.Render(decl)
+}
+
+type schemaRenderer struct {
+	*jsoniter.Stream
+	meta      *meta.Data
+	seenDecls map[uint32]*schema.Decl
+	typeArgs  []*schema.Type
+}
+
+func (r *schemaRenderer) Render(d *schema.Type) []byte {
+	r.renderType(d)
+	return r.Buffer()
+}
+
+func (r *schemaRenderer) renderType(typ *schema.Type) {
+	switch typ := typ.Typ.(type) {
+	case *schema.Type_Struct:
+		r.renderStruct(typ.Struct)
+	case *schema.Type_Map:
+		r.renderMap(typ.Map)
+	case *schema.Type_List:
+		r.renderList(typ.List)
+	case *schema.Type_Builtin:
+		r.renderBuiltin(typ.Builtin)
+	case *schema.Type_Named:
+		r.renderNamed(typ.Named)
+	case *schema.Type_Pointer:
+		r.renderType(typ.Pointer.Base)
+	case *schema.Type_Union:
+		r.renderType(typ.Union.Types[0])
+	case *schema.Type_Literal:
+		switch v := typ.Literal.Value.(type) {
+		case *schema.Literal_Str:
+			r.WriteString(v.Str)
+		case *schema.Literal_Int:
+			r.WriteInt(int(v.Int))
+		case *schema.Literal_Float:
+			r.WriteFloat64(v.Float)
+		case *schema.Literal_Boolean:
+			r.WriteBool(v.Boolean)
+		case *schema.Literal_Null:
+			r.WriteNil()
+		default:
+			panic(fmt.Sprintf("unknown literal type %T", v))
+		}
+	case *schema.Type_TypeParameter:
+		if idx := typ.TypeParameter.ParamIdx; len(r.typeArgs) > int(idx) {
+			r.renderType(r.typeArgs[idx])
+		} else {
+			r.WriteNil()
+		}
+	case *schema.Type_Config:
+		// Config is invisible here
+		r.renderType(typ.Config.Elem)
+	default:
+		panic(fmt.Sprintf("unknown schema type %T", typ))
+	}
+}
+
+func (r *schemaRenderer) renderStruct(s *schema.Struct) {
+	r.WriteObjectStart()
+	written := false
+	for _, f := range s.Fields {
+		n := f.JsonName
+		if n == "-" {
+			continue
+		} else if n == "" {
+			n = f.Name
+		}
+
+		if written {
+			r.WriteMore()
+		}
+		r.WriteObjectField(n)
+		r.renderType(f.Typ)
+		written = true
+	}
+	r.WriteObjectEnd()
+}
+
+func (r *schemaRenderer) renderMap(m *schema.Map) {
+	r.WriteObjectStart()
+	r.renderType(m.Key)
+	r.WriteRaw(": ")
+	r.renderType(m.Value)
+	r.WriteObjectEnd()
+}
+
+func (r *schemaRenderer) renderList(l *schema.List) {
+	r.WriteArrayStart()
+	r.renderType(l.Elem)
+	r.WriteArrayEnd()
+}
+
+func (r *schemaRenderer) renderBuiltin(b schema.Builtin) {
+	switch b {
+	case schema.Builtin_ANY:
+		r.WriteString("<any data>")
+	case schema.Builtin_BOOL:
+		r.WriteBool(true)
+	case schema.Builtin_INT, schema.Builtin_INT8, schema.Builtin_INT16, schema.Builtin_INT32, schema.Builtin_INT64,
+		schema.Builtin_UINT, schema.Builtin_UINT8, schema.Builtin_UINT16, schema.Builtin_UINT32, schema.Builtin_UINT64:
+		r.WriteInt(1)
+	case schema.Builtin_FLOAT32, schema.Builtin_FLOAT64:
+		r.WriteRaw("2.3")
+	case schema.Builtin_STRING:
+		r.WriteString("hello")
+	case schema.Builtin_BYTES:
+		r.WriteString("YmFzZTY0Cg==") // "base64"
+	case schema.Builtin_TIME:
+		s, _ := time.Now().MarshalText()
+		r.WriteString(string(s))
+	case schema.Builtin_UUID:
+		r.WriteString("7d42f515-3517-4e76-be13-30880443546f")
+	case schema.Builtin_JSON:
+		r.WriteObjectStart()
+		r.WriteObjectField("some json data")
+		r.WriteBool(true)
+		r.WriteObjectEnd()
+	case schema.Builtin_USER_ID:
+		r.WriteString("userID")
+	default:
+		r.WriteString("<unknown>")
+	}
+}
+
+func (r *schemaRenderer) renderNamed(n *schema.Named) {
+	if _, ok := r.seenDecls[n.Id]; ok {
+		// Already seen this name before
+		r.WriteNil()
+		return
+	}
+
+	// Store type arguments in scope. Restore the previous
+	// type arguments when we're done.
+	prevTypeArgs := r.typeArgs
+	defer func() {
+		r.typeArgs = prevTypeArgs
+	}()
+	r.typeArgs = n.TypeArguments
+
+	// Avoid infinite recursion
+	decl := r.meta.Decls[n.Id]
+	r.seenDecls[n.Id] = decl
+	r.renderType(decl.Type)
+	delete(r.seenDecls, n.Id)
+}
diff --git a/cli/daemon/secret/secret.go b/cli/daemon/secret/secret.go
index 3844318b8f..e32bcaee1d 100644
--- a/cli/daemon/secret/secret.go
+++ b/cli/daemon/secret/secret.go
@@ -2,27 +2,37 @@
 package secret
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"sync"
 	"time"
 
-	"encr.dev/proto/encore/server/remote"
+	"cuelang.org/go/cue"
+	"cuelang.org/go/cue/cuecontext"
+	"cuelang.org/go/cue/load"
 	"github.com/rs/zerolog/log"
+	"go4.org/syncutil"
 	"golang.org/x/sync/singleflight"
+
+	"encore.dev/appruntime/exported/experiments"
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/pkg/xos"
 )
 
 // New returns a new manager.
-func New(rc remote.RemoteClient) *Manager {
-	return &Manager{rc: rc, cache: make(map[string]*Data)}
+func New() *Manager {
+	return &Manager{cache: make(map[string]*Data)}
 }
 
 // Manager manages the secrets cache for running Encore apps.
 type Manager struct {
-	rc       remote.RemoteClient
 	group    singleflight.Group
 	pollOnce sync.Once
 
@@ -32,116 +42,182 @@ type Manager struct {
 
 // Data is a snapshot of an Encore app's development secret values.
 type Data struct {
-	// Synced is when the values were last synced.
+	// Synced is when the values were last synced,
+	// or the zero value if no sync has taken place.
 	Synced time.Time
 	// Values is a key-value map of defined secrets.
 	Values map[string]string
 }
 
-// Get gets the secrets for the given app.
-func (f *Manager) Get(ctx context.Context, appSlug string) (*Data, error) {
-	f.pollOnce.Do(f.startPolling)
+type LoadResult struct {
+	mgr *Manager
+	app *apps.Instance
 
-	// Do we have the secrets in our cache?
-	f.mu.Lock()
-	data, ok := f.cache[appSlug]
-	f.mu.Unlock()
-	if ok {
-		return data, nil
+	once    syncutil.Once
+	ch      <-chan singleflight.Result
+	initial singleflight.Result
+
+	localSecretMu sync.Mutex
+}
+
+// Load loads the secrets for appSlug.
+// If appSlug is empty, (*LoadResult).Get resolves to empty secret data.
+func (mgr *Manager) Load(app *apps.Instance) *LoadResult {
+	mgr.pollOnce.Do(mgr.startPolling)
+
+	// Ignore cases when the app isn't linked.
+	if app.PlatformID() == "" {
+		return &LoadResult{mgr: mgr, app: app}
 	}
 
-	// Do we have them on disk?
-	if data, err := f.readFromDisk(appSlug); err == nil {
-		f.mu.Lock()
-		f.cache[appSlug] = data
-		f.mu.Unlock()
-		return data, nil
+	ch := mgr.fetch(app.PlatformID(), false)
+	return &LoadResult{mgr: mgr, app: app, ch: ch}
+}
+
+// Get returns the result of the prefetch.
+// It blocks until the initial fetch is ready or until ctx is cancelled.
+// For subsequent calls to Get (such as during live reload), it returns any
+// more recent data that has been subsequently cached.
+func (lr *LoadResult) Get(ctx context.Context, expSet *experiments.Set) (data *Data, err error) {
+	defer func() {
+		if err == nil {
+			// load.Instances in cue is not safe for concurrent access.
+			// https://github.com/cue-lang/cue/issues/1746
+			lr.localSecretMu.Lock()
+			defer lr.localSecretMu.Unlock()
+			// Return a new data object so we don't write the overrides to the cache.
+			data, err = applyLocalOverrides(lr.app, data)
+		}
+	}()
+
+	if lr == nil || lr.app.PlatformID() == "" {
+		return &Data{}, nil
+	}
+
+	// Fetch the initial result the first time.
+	err = lr.once.Do(func() error {
+		select {
+		case lr.initial = <-lr.ch:
+			// The fetch was successful so mark the Once as completed.
+			return nil
+		case <-ctx.Done():
+			// We timed out before the fetch completed.
+			return ctx.Err()
+		}
+	})
+	if err != nil {
+		return nil, err
 	}
 
-	return f.fetch(appSlug)
+	initial, _ := lr.initial.Val.(*Data)
+	haveInitial := lr.initial.Err == nil
+	cached, haveCache := lr.mgr.loadFromCache(lr.app.PlatformID())
+
+	switch {
+	case haveCache && haveInitial:
+		// Which is most recent?
+		if initial.Synced.After(cached.Synced) {
+			return initial, nil
+		} else {
+			return cached, nil
+		}
+
+	case haveCache:
+		return cached, nil
+
+	case haveInitial:
+		return initial, nil
+
+	default:
+		// We have a prefetch error; return it.
+		return nil, lr.initial.Err
+	}
 }
 
 // UpdateKey updates the cached secret key to the given value.
-func (f *Manager) UpdateKey(appSlug, key, value string) {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if data, ok := f.cache[appSlug]; ok {
+func (mgr *Manager) UpdateKey(appSlug, key, value string) {
+	mgr.mu.Lock()
+	defer mgr.mu.Unlock()
+	if data, ok := mgr.cache[appSlug]; ok {
 		vals := make(map[string]string)
 		for k, v := range data.Values {
 			vals[k] = v
 		}
 		vals[key] = value
-		f.cache[appSlug] = &Data{
+		mgr.cache[appSlug] = &Data{
 			Synced: time.Now(),
 			Values: vals,
 		}
-		if err := f.writeToDisk(appSlug, data); err != nil {
+		if err := mgr.writeToDisk(appSlug, data); err != nil {
 			log.Error().Err(err).Msg("failed to write secrets to disk cache")
 		}
 	}
 }
 
-// Prefetch fires off a background task to prefetch secrets for appSlug.
-func (f *Manager) Prefetch(appSlug string) {
-	// Ignore cases when the app isn't linked.
-	if appSlug != "" {
-		go f.fetch(appSlug)
-	}
-}
-
 // fetch fetches secrets from the server.
 // mu must not be held when running.
-func (f *Manager) fetch(appSlug string) (*Data, error) {
-	data, err, _ := f.group.Do(appSlug, func() (interface{}, error) {
+func (mgr *Manager) fetch(appSlug string, poll bool) <-chan singleflight.Result {
+	return mgr.group.DoChan(appSlug, func() (any, error) {
 		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
 		defer cancel()
-		resp, err := f.rc.GetSecrets(ctx, &remote.GetSecretsRequest{
-			AppSlug: appSlug,
-		})
+		secrets, err := platform.GetLocalSecretValues(ctx, appSlug, poll)
 		if err != nil {
 			return nil, fmt.Errorf("fetch secrets for %s: %v", appSlug, err)
 		}
 		data := &Data{
 			Synced: time.Now(),
-			Values: make(map[string]string),
-		}
-		for _, s := range resp.Secrets {
-			data.Values[s.Key] = s.Value
+			Values: secrets,
 		}
 
 		// Update our caches
-		f.mu.Lock()
-		f.cache[appSlug] = data
-		f.mu.Unlock()
-		if err := f.writeToDisk(appSlug, data); err != nil {
+		mgr.mu.Lock()
+		mgr.cache[appSlug] = data
+		mgr.mu.Unlock()
+		if err := mgr.writeToDisk(appSlug, data); err != nil {
 			log.Error().Err(err).Msg("failed to write secrets to disk cache")
 		}
 
 		return data, nil
 	})
-	if err != nil {
-		return nil, err
+}
+
+func (mgr *Manager) loadFromCache(appSlug string) (*Data, bool) {
+	// Do we have the secrets in our cache?
+	mgr.mu.Lock()
+	data, ok := mgr.cache[appSlug]
+	mgr.mu.Unlock()
+	if ok {
+		return data, true
 	}
-	return data.(*Data), nil
+
+	// Do we have them on disk?
+	if data, err := mgr.readFromDisk(appSlug); err == nil {
+		mgr.mu.Lock()
+		mgr.cache[appSlug] = data
+		mgr.mu.Unlock()
+		return data, true
+	}
+	return nil, false
 }
 
 // startPolling begins polling for secret updates every 5 minutes for the apps
 // that have been run.
-func (f *Manager) startPolling() {
+func (mgr *Manager) startPolling() {
 	go func() {
 		for range time.Tick(5 * time.Minute) {
 			var slugs []string
-			f.mu.Lock()
-			for s := range f.cache {
+			mgr.mu.Lock()
+			for s := range mgr.cache {
 				slugs = append(slugs, s)
 			}
-			f.mu.Unlock()
+			mgr.mu.Unlock()
 
 			for _, s := range slugs {
-				if _, err := f.fetch(s); err != nil {
-					log.Error().Err(err).Str("appID", s).Msg("failed to sync secrets")
+				res := <-mgr.fetch(s, true)
+				if res.Err != nil {
+					log.Error().Err(res.Err).Str("app_id", s).Msg("failed to sync secrets")
 				} else {
-					log.Info().Str("appID", s).Msg("successfully synced app secrets")
+					log.Info().Str("app_id", s).Msg("successfully synced app secrets")
 				}
 			}
 		}
@@ -150,14 +226,14 @@ func (f *Manager) startPolling() {
 
 // writeToDisk serializes the secret data and writes it to disk
 // readable only for the current user.
-func (f *Manager) writeToDisk(appSlug string, data *Data) (err error) {
+func (mgr *Manager) writeToDisk(appSlug string, data *Data) (err error) {
 	defer func() {
 		if err != nil {
 			err = fmt.Errorf("write secrets %s: %v", appSlug, err)
 		}
 	}()
 
-	path, err := f.secretsPath(appSlug)
+	path, err := mgr.secretsPath(appSlug)
 	if err != nil {
 		return err
 	}
@@ -174,18 +250,18 @@ func (f *Manager) writeToDisk(appSlug string, data *Data) (err error) {
 	if err != nil {
 		return err
 	}
-	return os.WriteFile(path, out, 0600)
+	return xos.WriteFile(path, out, 0600)
 }
 
 // readFromDisk reads the cached secrets from disk.
-func (f *Manager) readFromDisk(appSlug string) (data *Data, err error) {
+func (mgr *Manager) readFromDisk(appSlug string) (data *Data, err error) {
 	defer func() {
 		if err != nil {
 			err = fmt.Errorf("read secrets %s: %v", appSlug, err)
 		}
 	}()
 
-	path, err := f.secretsPath(appSlug)
+	path, err := mgr.secretsPath(appSlug)
 	if err != nil {
 		return nil, err
 	}
@@ -199,10 +275,62 @@ func (f *Manager) readFromDisk(appSlug string) (data *Data, err error) {
 }
 
 // secretsPath returns the file path to where the given app's secrets are stored on disk.
-func (f *Manager) secretsPath(appSlug string) (string, error) {
+func (mgr *Manager) secretsPath(appSlug string) (string, error) {
 	dir, err := os.UserCacheDir()
 	if err != nil {
 		return "", err
 	}
 	return filepath.Join(dir, "encore", "secrets", appSlug+".json"), nil
 }
+
+// applyLocalOverrides parses the local secrets override file, if any,
+// and returns a new Data object with the overrides applied.
+//
+// If there are no overrides src is returned directly.
+// The original src data object is never modified.
+func applyLocalOverrides(app *apps.Instance, src *Data) (*Data, error) {
+	const name = ".secrets.local.cue"
+	data, err := os.ReadFile(filepath.Join(app.Root(), name))
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return src, nil
+		}
+		return nil, err
+	}
+
+	updated := &Data{
+		Synced: src.Synced,
+		Values: make(map[string]string, len(src.Values)),
+	}
+	for k, v := range src.Values {
+		updated.Values[k] = v
+	}
+
+	ctx := cuecontext.New()
+	loadCfg := &load.Config{
+		Stdin: bytes.NewReader(data),
+	}
+
+	inst := load.Instances([]string{"-"}, loadCfg)[0]
+	if inst.Err != nil {
+		return nil, fmt.Errorf("parse local secrets: %v", inst.Err)
+	}
+	secrets := ctx.BuildInstance(inst)
+	if err := secrets.Err(); err != nil {
+		return nil, fmt.Errorf("parse local secrets: %v", err)
+	}
+
+	it, err := secrets.Fields(cue.Hidden(false), cue.Concrete(true))
+	if err != nil {
+		return nil, fmt.Errorf("parse local secrets: %v", err)
+	}
+	for it.Next() {
+		key := it.Selector().String()
+		val, err := it.Value().String()
+		if err != nil {
+			return nil, fmt.Errorf("parse local secrets: secret key %s is not a string", key)
+		}
+		updated.Values[key] = val
+	}
+	return updated, nil
+}
diff --git a/cli/daemon/sqldb/cluster.go b/cli/daemon/sqldb/cluster.go
index 014f68ec1f..94a3396f0b 100644
--- a/cli/daemon/sqldb/cluster.go
+++ b/cli/daemon/sqldb/cluster.go
@@ -1,44 +1,58 @@
 package sqldb
 
 import (
-	"bytes"
 	"context"
-	"encoding/json"
-	"errors"
 	"fmt"
-	"os/exec"
+	"net"
+	"strconv"
+	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
-	"encr.dev/cli/daemon/internal/runlog"
-	meta "encr.dev/proto/encore/parser/meta/v1"
+	"github.com/cockroachdb/errors"
+	"github.com/jackc/pgx/v5"
 	"github.com/rs/zerolog"
 	"go4.org/syncutil"
 	"golang.org/x/sync/errgroup"
 
+	"encr.dev/internal/optracker"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+
 	// stdlib registers the "pgx" driver to database/sql.
-	_ "github.com/jackc/pgx/v4/stdlib"
+	_ "github.com/jackc/pgx/v5/stdlib"
 )
 
 // Cluster represents a running database Cluster.
 type Cluster struct {
-	ID    string // cluster ID
-	Memfs bool   // use an an in-memory filesystem?
+	ID       ClusterID // cluster ID
+	Memfs    bool      // use an in-memory filesystem?
+	Password string    // randomly generated password for this cluster
 
-	HostPort string // available after Ready() is done
-
-	log zerolog.Logger
+	driver Driver
+	log    zerolog.Logger
 
 	startOnce syncutil.Once
 	// started is closed when the cluster has been successfully started.
 	started chan struct{}
 
+	// cachedStatus is the cached cluster status; it should be accessed
+	// via status().
+	cachedStatus atomic.Pointer[ClusterStatus]
+
+	Roles EncoreRoles // set by Start
+
 	// Ctx is canceled when the cluster is being torn down.
 	Ctx    context.Context
 	cancel func() // for canceling Ctx
 
-	mu  sync.Mutex
-	dbs map[string]*DB // name -> db
+	mu         sync.Mutex
+	dbs        map[string]*DB // name -> db
+	isExternal func(name string) bool
+}
+
+func (c *Cluster) Stop() {
+	// no-op
 }
 
 // Ready returns a channel that is closed when the cluster is up and running.
@@ -46,10 +60,11 @@ func (c *Cluster) Ready() <-chan struct{} {
 	return c.started
 }
 
-// Start creates the container if necessary and starts it.
+// Start creates the cluster if necessary and starts it.
 // If the cluster is already running it does nothing.
-func (c *Cluster) Start(log runlog.Log) error {
-	return c.startOnce.Do(func() (err error) {
+func (c *Cluster) Start(ctx context.Context, tracker *optracker.OpTracker) (*ClusterStatus, error) {
+	var status *ClusterStatus
+	err := c.startOnce.Do(func() (err error) {
 		c.log.Debug().Msg("starting cluster")
 		defer func() {
 			if err == nil {
@@ -60,162 +75,195 @@ func (c *Cluster) Start(log runlog.Log) error {
 			}
 		}()
 
-		// Ensure the docker image exists first.
-		if err := pullImage(log, dockerImage); err != nil {
-			return fmt.Errorf("pull docker image %s: %v", dockerImage, err)
+		st, err := c.driver.CreateCluster(ctx, &CreateParams{
+			ClusterID: c.ID,
+			Memfs:     c.Memfs,
+			Tracker:   tracker,
+		}, c.log)
+		if err != nil {
+			return errors.WithStack(err)
 		}
+		status = st
+		c.cachedStatus.Store(st)
+		go c.pollStatus()
 
-		ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
-		defer cancel()
+		// Setup the roles
+		c.Roles, err = c.setupRoles(ctx, st)
 
-		cname := containerName(c.ID)
-		status, err := c.Status(ctx)
-		if err != nil {
-			c.log.Error().Err(err).Msg("failed to get container status")
-			return err
-		}
+		return err
+	})
 
-		switch status.Status {
-		case Running:
-			c.HostPort = status.HostPort
-			c.log.Debug().Str("hostport", c.HostPort).Msg("cluster already running")
-			return nil
+	if err != nil {
+		return nil, errors.WithStack(err)
+	} else if status == nil {
+		// We've already set it up; query the current status
+		return c.Status(ctx)
+	}
+	return status, nil
+}
 
-		case Stopped:
-			c.log.Debug().Msg("cluster stopped, restarting")
-			if out, err := exec.CommandContext(ctx, "docker", "start", cname).CombinedOutput(); err != nil {
-				return fmt.Errorf("could not start sqldb container: %s (%v)", string(out), err)
-			}
-			// Grab the port
-			status, err = c.Status(ctx)
-			if err != nil {
-				return err
-			}
-			c.HostPort = status.HostPort
-			c.log.Debug().Str("hostport", c.HostPort).Msg("cluster started")
-			return nil
-
-		case NotFound:
-			c.log.Debug().Msg("cluster not found, creating")
-			args := []string{
-				"run",
-				"-d",
-				"-p", "5432",
-				"-e", "POSTGRES_USER=encore",
-				"-e", "POSTGRES_PASSWORD=" + c.ID,
-				"-e", "POSTGRES_DB=postgres",
-				"--name", cname,
-			}
-			if c.Memfs {
-				args = append(args,
-					"--mount", "type=tmpfs,destination=/var/lib/postgresql/data",
-					dockerImage,
-					"-c", "fsync=off",
-				)
-			} else {
-				args = append(args, dockerImage)
-			}
+// setupRoles ensures the necessary database roles exist
+// for admin/write/read access.
+func (c *Cluster) setupRoles(ctx context.Context, st *ClusterStatus) (EncoreRoles, error) {
+	uri := st.ConnURI(st.Config.RootDatabase, st.Config.Superuser)
+	conn, err := pgx.Connect(ctx, uri)
+	if err != nil {
+		return nil, fmt.Errorf("connect: %v", err)
+	}
+	defer conn.Close(context.Background())
 
-			cmd := exec.CommandContext(ctx, "docker", args...)
-			if out, err := cmd.CombinedOutput(); err != nil {
-				return fmt.Errorf("could not start sql database as docker container: %s: %v", out, err)
+	roles, err := c.determineRoles(ctx, st, conn)
+	if err != nil {
+		return nil, fmt.Errorf("determine roles: %v", err)
+	}
+
+	for _, role := range roles {
+		sanitizedUsername := (pgx.Identifier{role.Username}).Sanitize()
+		c.log.Debug().Str("role", role.Username).Msg("creating role")
+		_, err := conn.Exec(ctx, `
+			CREATE USER `+sanitizedUsername+`
+			WITH LOGIN ENCRYPTED PASSWORD `+quoteString(role.Password)+`
+		`)
+		if err != nil {
+			var exists bool
+			err2 := conn.QueryRow(context.Background(), `
+				SELECT COALESCE(MAX(oid), 0) > 0 AS exists
+				FROM pg_roles
+				WHERE rolname = $1
+			`, role.Username).Scan(&exists)
+			if err2 != nil {
+				c.log.Error().Err(err2).Str("role", role.Username).Msg("unable to lookup role")
+				return nil, fmt.Errorf("get role %q: %v", role.Username, err2)
+			} else if !exists {
+				c.log.Error().Err(err).Str("role", role.Username).Msg("unable to create role")
+				return nil, fmt.Errorf("create role %q: %v", role.Username, err)
 			}
+			c.log.Debug().Str("role", role.Username).Msg("role already exists")
+		}
 
-			// Now that the container is running, grab the host port.
-			status, err := c.Status(ctx)
+		// Add cluster-level permissions.
+		switch role.Type {
+		case RoleAdmin:
+			// Grant admins the ability to create databases.
+			_, err := conn.Exec(ctx, `
+				ALTER USER `+sanitizedUsername+` CREATEDB CREATEROLE
+			`)
 			if err != nil {
-				return err
+				c.log.Error().Err(err).Str("role", role.Username).Msg("unable to grant CREATEDB")
+				return nil, fmt.Errorf("grant CREATEDB to %q: %v", role.Username, err)
 			}
-			c.HostPort = status.HostPort
-			c.log.Debug().Str("hostport", c.HostPort).Msg("cluster created")
-			return nil
-
-		default:
-			return fmt.Errorf("unknown cluster status %q", status.Status)
 		}
-	})
+	}
+
+	return roles, nil
 }
 
-// initDBs adds the databases from md to the cluster's database map.
-// It does not create or migrate them.
-func (c *Cluster) initDBs(md *meta.Data, reinit bool) {
-	if md == nil {
-		return
-	}
+// determineRoles determines the roles to create based on the server version.
+func (c *Cluster) determineRoles(ctx context.Context, st *ClusterStatus, conn *pgx.Conn) (EncoreRoles, error) {
+	// We always support an admin role (PostgreSQL 11+)
+
+	// We support read/write roles on PostgreSQL 14+ only,
+	// as support for predefined roles was added then.
+	var supportsPredefinedRoles bool
+	{
+		var version string
+		if err := conn.QueryRow(ctx, "SHOW server_version").Scan(&version); err != nil {
+			return nil, fmt.Errorf("determine server version: %v", err)
+		}
+		c.log.Debug().Str("version", version).Msg("got postgres server version")
 
-	// Create the databases we need in our cluster map.
-	c.mu.Lock()
-	for _, svc := range md.Svcs {
-		if len(svc.Migrations) > 0 {
-			db, ok := c.dbs[svc.Name]
-			if ok && reinit {
-				db.CloseConns()
-			}
-			if !ok || reinit {
-				c.initDB(svc.Name)
-			}
+		major, _, _ := strings.Cut(version, ".")
+		if n, err := strconv.Atoi(major); err != nil {
+			return nil, fmt.Errorf("determine server version: %v", err)
+		} else if n >= 14 {
+			supportsPredefinedRoles = true
 		}
 	}
-	c.mu.Unlock()
+
+	// For legacy databases, just use the predefined admin role that we set up before.
+	roles := EncoreRoles{st.Config.Superuser}
+	if supportsPredefinedRoles {
+		// Otherwise if we support predefined roles, add more roles to use.
+		roles = append(roles,
+			Role{RoleAdmin, "encore-admin", "admin"},
+			Role{RoleWrite, "encore-write", "write"},
+			Role{RoleRead, "encore-read", "read"},
+		)
+	}
+	return roles, nil
 }
 
 // initDB initializes the database for svc and adds it to c.dbs.
 // The cluster mutex must be held.
-func (c *Cluster) initDB(name string) *DB {
+func (c *Cluster) initDB(encoreName string) *DB {
+	driverName := encoreName
+	if !c.driver.Meta().ClusterIsolation {
+		driverName += fmt.Sprintf("-%s-%s", c.ID.NS.App.PlatformOrLocalID(), c.ID.Type)
+
+		// Add the namespace id, as long as it's not the default namespace
+		// (for backwards compatibility).
+		if c.ID.NS.Name != "default" {
+			driverName += "-" + string(c.ID.NS.ID)
+		}
+	}
+
 	dbCtx, cancel := context.WithCancel(c.Ctx)
 	db := &DB{
-		Name:    name,
-		Cluster: c,
+		EncoreName: encoreName,
+		Cluster:    c,
+		driverName: driverName,
+
+		// Use a template database when running tests.
+		template: c.ID.Type == Test,
 
 		Ctx:    dbCtx,
 		cancel: cancel,
 
 		ready: make(chan struct{}),
-		log:   c.log.With().Str("db", name).Logger(),
+		log:   c.log.With().Str("db", encoreName).Logger(),
 	}
-	c.dbs[name] = db
+	c.dbs[encoreName] = db
 	return db
 }
 
-// Create creates the given databases.
-func (c *Cluster) Create(ctx context.Context, appRoot string, md *meta.Data) error {
+// Setup sets up the given databases.
+func (c *Cluster) Setup(ctx context.Context, appRoot string, md *meta.Data) error {
 	c.log.Debug().Msg("creating cluster")
 	g, ctx := errgroup.WithContext(ctx)
+	g.SetLimit(50)
 	c.mu.Lock()
-	for _, svc := range md.Svcs {
-		if len(svc.Migrations) == 0 {
+
+	for _, dbMeta := range md.SqlDatabases {
+		dbMeta := dbMeta
+		db, ok := c.dbs[dbMeta.Name]
+		if c.isExternal(dbMeta.Name) {
 			continue
 		}
-
-		svc := svc
-		db, ok := c.dbs[svc.Name]
 		if !ok {
-			c.mu.Unlock()
-			return fmt.Errorf("database %s not initialized", svc.Name)
+			db = c.initDB(dbMeta.Name)
 		}
-		g.Go(func() error { return db.Setup(ctx, appRoot, svc, false, false) })
+		g.Go(func() error { return db.Setup(ctx, appRoot, dbMeta, false, false) })
 	}
 	c.mu.Unlock()
 	return g.Wait()
 }
 
-// CreateAndMigrate creates and migrates the given databases.
-func (c *Cluster) CreateAndMigrate(ctx context.Context, appRoot string, md *meta.Data) error {
+// SetupAndMigrate creates and migrates the given databases.
+func (c *Cluster) SetupAndMigrate(ctx context.Context, appRoot string, dbs []*meta.SQLDatabase) error {
 	c.log.Debug().Msg("creating and migrating cluster")
 	g, ctx := errgroup.WithContext(ctx)
+	g.SetLimit(50)
 	c.mu.Lock()
-	for _, svc := range md.Svcs {
-		if len(svc.Migrations) == 0 {
+	for _, dbMeta := range dbs {
+		if c.IsExternalDB(dbMeta.Name) {
 			continue
 		}
-
-		svc := svc
-		db, ok := c.dbs[svc.Name]
+		dbMeta := dbMeta
+		db, ok := c.dbs[dbMeta.Name]
 		if !ok {
-			c.mu.Unlock()
-			return fmt.Errorf("database %s not initialized", svc.Name)
+			db = c.initDB(dbMeta.Name)
 		}
-		g.Go(func() error { return db.Setup(ctx, appRoot, svc, true, false) })
+		g.Go(func() error { return db.Setup(ctx, appRoot, dbMeta, true, false) })
 	}
 	c.mu.Unlock()
 	return g.Wait()
@@ -229,28 +277,43 @@ func (c *Cluster) GetDB(name string) (*DB, bool) {
 	return db, ok
 }
 
-// Recreate recreates the databases for the given services.
-// If services is the nil slice it recreates all databases.
-func (c *Cluster) Recreate(ctx context.Context, appRoot string, services []string, md *meta.Data) error {
+func (c *Cluster) IsExternalDB(name string) bool {
+	if c.isExternal == nil {
+		return false
+	}
+	return c.isExternal(name)
+}
+
+// Recreate recreates the databases for the given database names.
+// If databaseNames is the nil slice it recreates all databases.
+func (c *Cluster) Recreate(ctx context.Context, appRoot string, databaseNames []string, md *meta.Data) error {
 	c.log.Debug().Msg("recreating cluster")
 	var filter map[string]bool
-	if services != nil {
+	if databaseNames != nil {
 		filter = make(map[string]bool)
-		for _, svc := range services {
-			filter[svc] = true
+		for _, name := range databaseNames {
+			filter[name] = true
 		}
 	}
 
 	g, ctx := errgroup.WithContext(ctx)
+	g.SetLimit(50)
 	c.mu.Lock()
-	for _, svc := range md.Svcs {
-		svc := svc
-		if len(svc.Migrations) > 0 && (filter == nil || filter[svc.Name]) {
-			db, ok := c.dbs[svc.Name]
+	for _, dbMeta := range md.SqlDatabases {
+		dbMeta := dbMeta
+		if filter == nil || filter[dbMeta.Name] {
+			db, ok := c.dbs[dbMeta.Name]
+			if c.isExternal(dbMeta.Name) {
+				if filter[dbMeta.Name] {
+					c.mu.Unlock()
+					return fmt.Errorf("cannot reset %q: resetting external databases is disabled", dbMeta.Name)
+				}
+				continue
+			}
 			if !ok {
-				db = c.initDB(svc.Name)
+				db = c.initDB(dbMeta.Name)
 			}
-			g.Go(func() error { return db.Setup(ctx, appRoot, svc, true, true) })
+			g.Go(func() error { return db.Setup(ctx, appRoot, dbMeta, true, true) })
 		}
 	}
 	c.mu.Unlock()
@@ -259,85 +322,124 @@ func (c *Cluster) Recreate(ctx context.Context, appRoot string, services []strin
 	return err
 }
 
-// Status reports the status of the cluster.
+// Status reports the cluster's status.
 func (c *Cluster) Status(ctx context.Context) (*ClusterStatus, error) {
-	cname := containerName(c.ID)
-	out, err := exec.CommandContext(ctx, "docker", "container", "inspect", cname).CombinedOutput()
-	if err == exec.ErrNotFound {
-		return nil, errors.New("docker not found: is it installed and in your PATH?")
-	} else if err != nil {
-		// Docker returns a non-zero exit code if the container does not exist.
-		// Try to tell this apart from an error by parsing the output.
-		if bytes.Contains(out, []byte("No such container")) {
-			return &ClusterStatus{Status: NotFound}, nil
-		}
-		return nil, fmt.Errorf("docker container inspect failed: %s (%v)", out, err)
+	if st := c.cachedStatus.Load(); st != nil {
+		return st, nil
 	}
+	return c.updateStatusFromDriver(ctx)
+}
 
-	var resp []struct {
-		Name  string
-		State struct {
-			Running bool
-		}
-		NetworkSettings struct {
-			Ports map[string][]struct {
-				HostIP   string
-				HostPort string
-			}
+func (c *Cluster) updateStatusFromDriver(ctx context.Context) (*ClusterStatus, error) {
+	st, err := c.driver.ClusterStatus(ctx, c.ID)
+	if err == nil {
+		c.cachedStatus.Store(st)
+	}
+	return st, err
+}
+
+// pollStatus polls the driver for status changes.
+func (c *Cluster) pollStatus() {
+	ch := time.NewTicker(10 * time.Second)
+	defer ch.Stop()
+
+	for {
+		select {
+		case <-ch.C:
+			ctx, cancel := context.WithTimeout(c.Ctx, 5*time.Second)
+			_, _ = c.updateStatusFromDriver(ctx)
+			cancel()
+
+		case <-c.Ctx.Done():
+			return
 		}
 	}
-	if err := json.Unmarshal(out, &resp); err != nil {
-		return nil, fmt.Errorf("parse `docker container inspect` response: %v", err)
+}
+
+// Info reports information about a cluster.
+func (c *Cluster) Info(ctx context.Context) (*ClusterInfo, error) {
+	st, err := c.Start(ctx, nil)
+	if err != nil {
+		return nil, err
 	}
-	for _, c := range resp {
-		if c.Name == "/"+cname {
-			status := &ClusterStatus{Status: Stopped}
-			if c.State.Running {
-				status.Status = Running
-			}
-			ports := c.NetworkSettings.Ports["5432/tcp"]
-			if len(ports) > 0 {
-				status.HostPort = ports[0].HostIP + ":" + ports[0].HostPort
-			}
-			return status, nil
+
+	info := &ClusterInfo{ClusterStatus: st}
+	info.Encore = c.Roles
+	return info, nil
+}
+
+// ClusterInfo returns information about a cluster.
+type ClusterInfo struct {
+	*ClusterStatus
+
+	// Encore contains the roles to use to connect for an Encore app.
+	// It is set if and only if the cluster is running.
+	Encore EncoreRoles
+}
+
+// ConnURI reports the connection URI to connect to the given database
+// in the cluster, authenticating with the given role.
+func (s *ClusterStatus) ConnURI(database string, r Role) string {
+	uri := fmt.Sprintf("user=%s password=%s dbname=%s", r.Username, r.Password, database)
+
+	// Handle different ways of expressing the host
+	cfg := s.Config
+	if strings.HasPrefix(cfg.Host, "/") {
+		uri += " host=" + cfg.Host // unix socket
+	} else if host, port, err := net.SplitHostPort(cfg.Host); err == nil {
+		uri += fmt.Sprintf(" host=%s port=%s", host, port) // host:port
+	} else {
+		uri += " host=" + cfg.Host // hostname
+	}
+
+	return uri
+}
+
+// EncoreRoles describes the credentials to use when connecting
+// to the cluster as an Encore user.
+type EncoreRoles []Role
+
+func (roles EncoreRoles) Superuser() (Role, bool) { return roles.find(RoleSuperuser) }
+func (roles EncoreRoles) Admin() (Role, bool)     { return roles.find(RoleAdmin) }
+func (roles EncoreRoles) Write() (Role, bool)     { return roles.find(RoleWrite) }
+func (roles EncoreRoles) Read() (Role, bool)      { return roles.find(RoleRead) }
+
+func (roles EncoreRoles) First(typs ...RoleType) (Role, bool) {
+	for _, typ := range typs {
+		if r, ok := roles.find(typ); ok {
+			return r, true
+		}
+	}
+	return Role{}, false
+}
+
+func (roles EncoreRoles) find(typ RoleType) (Role, bool) {
+	for _, r := range roles {
+		if r.Type == typ {
+			return r, true
 		}
 	}
-	return &ClusterStatus{Status: NotFound}, nil
+	return Role{}, false
 }
 
-// ContainerStatus represents the status of a container.
-type ContainerStatus string
+type RoleType string
+
+func (r RoleType) String() string { return string(r) }
 
 const (
-	// Running indicates the cluster container is running.
-	Running ContainerStatus = "running"
-	// Stopped indicates the container cluster exists but is not running.
-	Stopped ContainerStatus = "stopped"
-	// NotFound indicates the container cluster does not exist.
-	NotFound ContainerStatus = "notfound"
+	RoleSuperuser RoleType = "superuser"
+	RoleAdmin     RoleType = "admin"
+	RoleWrite     RoleType = "write"
+	RoleRead      RoleType = "read"
 )
 
-// ClusterStatus rerepsents the status of a database cluster.
-type ClusterStatus struct {
-	// Status is the status of the underlying container.
-	Status ContainerStatus
-	// HostPort is the host and port for connecting to the database.
-	// It is only set when Status == Running.
-	HostPort string
+type Role struct {
+	Type     RoleType
+	Username string
+	Password string
 }
 
-// containerName computes the container name for a given clusterID.
-func containerName(clusterID string) string {
-	return "sqldb-" + clusterID
-}
-
-func pullImage(log runlog.Log, image string) error {
-	if err := exec.Command("docker", "image", "inspect", image).Run(); err == nil {
-		return nil
-	}
-	fmt.Fprintf(log.Stderr(), "Docker image %q does not exist locally, pulling...\n", image)
-	cmd := exec.Command("docker", "pull", image)
-	cmd.Stdout = log.Stdout()
-	cmd.Stderr = log.Stderr()
-	return cmd.Run()
+// quoteString quotes a string for use in SQL.
+func quoteString(str string) string {
+	return "'" + strings.ReplaceAll(str, "'", "''") + "'"
 }
diff --git a/cli/daemon/sqldb/cluster_test.go b/cli/daemon/sqldb/cluster_test.go
deleted file mode 100644
index a0ce243761..0000000000
--- a/cli/daemon/sqldb/cluster_test.go
+++ /dev/null
@@ -1,76 +0,0 @@
-package sqldb
-
-import (
-	"context"
-	"crypto/rand"
-	"encoding/base32"
-	"os/exec"
-	"testing"
-
-	"encr.dev/cli/daemon/internal/runlog"
-	qt "github.com/frankban/quicktest"
-)
-
-func TestClusterManager_StartDelete(t *testing.T) {
-	if testing.Short() {
-		t.Log("skipping cluster test when running in short mode")
-		t.SkipNow()
-	}
-	c := qt.New(t)
-	cm := NewClusterManager()
-	ctx := context.Background()
-	clusterID := genClusterID(c)
-	cl := cm.Init(ctx, &InitParams{ClusterID: clusterID})
-	err := cl.Start(runlog.OS())
-	c.Assert(err, qt.IsNil)
-	c.Assert(cl, qt.Not(qt.IsNil))
-
-	cname := containerName(clusterID)
-	err = exec.Command("docker", "container", "inspect", cname).Run()
-	c.Assert(err, qt.IsNil)
-
-	err = cm.Delete(ctx, clusterID)
-	c.Assert(err, qt.IsNil)
-	out, err := exec.Command("docker", "container", "inspect", cname).CombinedOutput()
-	c.Assert(err, qt.Not(qt.IsNil))
-	c.Assert(string(out), qt.Contains, "No such container")
-}
-
-func TestClusterManager_Get(t *testing.T) {
-	if testing.Short() {
-		t.Log("skipping cluster test when running in short mode")
-		t.SkipNow()
-	}
-
-	c := qt.New(t)
-	cm := NewClusterManager()
-	cl := testCluster(c, cm)
-	cluster, ok := cm.Get(cl.ID)
-	c.Assert(ok, qt.IsTrue)
-	c.Assert(cluster, qt.Equals, cl)
-	c.Assert(cluster, qt.Not(qt.IsNil))
-	c.Assert(cluster.ID, qt.Equals, cl.ID)
-}
-
-func testCluster(c *qt.C, cm *ClusterManager) *Cluster {
-	ctx := context.Background()
-	clusterID := genClusterID(c)
-	cl := cm.Init(ctx, &InitParams{ClusterID: clusterID})
-	err := cl.Start(runlog.OS())
-	c.Assert(err, qt.IsNil)
-	c.Assert(cl, qt.Not(qt.IsNil))
-	c.Cleanup(func() {
-		err := cm.Delete(context.Background(), clusterID)
-		c.Assert(err, qt.IsNil)
-	})
-	return cl
-}
-
-var encoding = base32.NewEncoding("23456789abcdefghikmnopqrstuvwxyz").WithPadding(base32.NoPadding)
-
-func genClusterID(c *qt.C) string {
-	var data [3]byte
-	_, err := rand.Read(data[:])
-	c.Assert(err, qt.IsNil)
-	return "sqldb-internal-test-" + encoding.EncodeToString(data[:])
-}
diff --git a/cli/daemon/sqldb/db.go b/cli/daemon/sqldb/db.go
index 392254c6f4..cf4b6e60e8 100644
--- a/cli/daemon/sqldb/db.go
+++ b/cli/daemon/sqldb/db.go
@@ -4,20 +4,30 @@ import (
 	"context"
 	"database/sql"
 	"fmt"
+	"io/fs"
+	"path/filepath"
 	"sync"
 	"time"
 
-	meta "encr.dev/proto/encore/parser/meta/v1"
+	"github.com/cockroachdb/errors"
 	"github.com/golang-migrate/migrate/v4"
+	"github.com/golang-migrate/migrate/v4/database"
 	"github.com/golang-migrate/migrate/v4/database/postgres"
-	"github.com/jackc/pgx/v4"
+	"github.com/golang-migrate/migrate/v4/source"
+	"github.com/jackc/pgx/v5"
 	"github.com/rs/zerolog"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	meta "encr.dev/proto/encore/parser/meta/v1"
 )
 
 // DB represents a single database instance within a cluster.
 type DB struct {
-	Name    string // database name
-	Cluster *Cluster
+	EncoreName string
+	Cluster    *Cluster
+
+	driverName string
 
 	// Ctx is canceled when the database is being torn down.
 	Ctx    context.Context
@@ -31,16 +41,32 @@ type DB struct {
 
 	migrated bool
 
+	// template indicates the database is backed by a template database.
+	template bool
+
 	log zerolog.Logger
 }
 
+// ApplicationCloudName reports the "cloud name" of the application-facing database.
+func (db *DB) ApplicationCloudName() string {
+	return db.driverName
+}
+
+// TemplateCloudName reports the "cloud name" of the template database, if any.
+func (db *DB) TemplateCloudName() option.Option[string] {
+	if db.template {
+		return option.Some(db.driverName + "_template")
+	}
+	return option.None[string]()
+}
+
 // Ready returns a channel that is closed when the database is up and running.
 func (db *DB) Ready() <-chan struct{} {
 	return db.ready
 }
 
 // Setup sets up the database, (re)creating it if necessary and running schema migrations.
-func (db *DB) Setup(ctx context.Context, appRoot string, svc *meta.Service, migrate, recreate bool) (err error) {
+func (db *DB) Setup(ctx context.Context, appRoot string, dbMeta *meta.SQLDatabase, migrate, recreate bool) (err error) {
 	db.log.Debug().Msg("setting up database")
 	db.setupMu.Lock()
 	defer db.setupMu.Unlock()
@@ -57,43 +83,89 @@ func (db *DB) Setup(ctx context.Context, appRoot string, svc *meta.Service, migr
 	}()
 
 	if recreate {
-		if err := db.Drop(ctx); err != nil {
-			return fmt.Errorf("drop db %s: %v", db.Name, err)
+		if err := db.drop(ctx); err != nil {
+			return err
 		}
 	}
-	if err := db.Create(ctx); err != nil {
-		return fmt.Errorf("create db %s: %v", db.Name, err)
-	}
-	if migrate || recreate || !db.migrated {
-		if err := db.Migrate(ctx, appRoot, svc); err != nil {
-			// Only report an error if we asked to migrate or recreate.
-			// Otherwise we might fail to open a database shell when there
-			// is a migration issue.
-			if migrate || recreate {
-				return fmt.Errorf("migrate db %s: %v", db.Name, err)
+
+	setupDB := func(cloudName string) error {
+		if err := db.doCreate(ctx, cloudName, option.None[string]()); err != nil {
+			return errors.Wrapf(err, "create db %s: %v", cloudName, err)
+		}
+
+		if err := db.ensureRoles(ctx, cloudName, db.Cluster.Roles...); err != nil {
+			return fmt.Errorf("ensure db roles %s: %v", cloudName, err)
+		}
+
+		if migrate || recreate || !db.migrated {
+			if err := db.doMigrate(ctx, cloudName, appRoot, dbMeta); err != nil {
+				// Only report an error if we asked to migrate or recreate.
+				// Otherwise we might fail to open a database shell when there
+				// is a migration issue.
+				if migrate || recreate {
+					return fmt.Errorf("migrate db %s: %v", cloudName, err)
+				}
 			}
 		}
+		return nil
+	}
+
+	// First set up the database with the application name.
+	if err := setupDB(db.ApplicationCloudName()); err != nil {
+		return err
 	}
+
+	if tmplName, ok := db.TemplateCloudName().Get(); ok {
+		// If we want a template database, rename the application database to the template name.
+		// We do it this way in case the migrations assume the database is named according to the application name.
+
+		// Terminate the connections to the template database to prevent "database is being accessed by other users" errors.
+		_ = db.terminateConnectionsToDB(ctx, db.ApplicationCloudName())
+		if err := db.renameDB(ctx, db.ApplicationCloudName(), tmplName); err != nil {
+			return fmt.Errorf("rename db %s to %s: %v", db.ApplicationCloudName(), tmplName, err)
+		}
+
+		// Then create the application database based on the template
+		if err := db.doCreate(ctx, db.ApplicationCloudName(), option.Some(tmplName)); err != nil {
+			return errors.Wrapf(err, "create db %s: %v", db.ApplicationCloudName(), err)
+		}
+
+		// Ensure the application database has the right roles, too.
+		if err := db.ensureRoles(ctx, db.ApplicationCloudName(), db.Cluster.Roles...); err != nil {
+			return fmt.Errorf("ensure db roles %s: %v", db.ApplicationCloudName(), err)
+		}
+	}
+
 	return nil
 }
 
-// Create creates the database in the cluster if it does not already exist.
-// It reports whether the database was initialized for the first time
-// in this process.
-func (db *DB) Create(ctx context.Context) error {
-	adm, err := db.connectAdminDB(ctx)
+func (db *DB) doCreate(ctx context.Context, cloudName string, template option.Option[string]) error {
+	adm, err := db.connectSuperuser(ctx)
 	if err != nil {
 		return err
 	}
-	defer adm.Close(context.Background())
+	defer func() { _ = adm.Close(context.Background()) }()
 
 	// Does it already exist?
 	var dummy int
-	err = adm.QueryRow(ctx, "SELECT 1 FROM pg_database WHERE datname = $1", db.Name).Scan(&dummy)
-	if err == pgx.ErrNoRows {
+	err = adm.QueryRow(ctx, "SELECT 1 FROM pg_database WHERE datname = $1", cloudName).Scan(&dummy)
+	owner, ok := db.Cluster.Roles.First(RoleAdmin, RoleSuperuser)
+	if !ok {
+		return errors.New("unable to find admin or superuser roles")
+	}
+
+	if errors.Is(err, pgx.ErrNoRows) {
 		db.log.Debug().Msg("creating database")
-		name := (pgx.Identifier{db.Name}).Sanitize() // sanitize database name, to be safe
-		_, err = adm.Exec(ctx, fmt.Sprintf("CREATE DATABASE %s OWNER encore;", name))
+		// Sanitize names since this query does not support query params
+		dbName := (pgx.Identifier{cloudName}).Sanitize()
+		ownerName := (pgx.Identifier{owner.Username}).Sanitize()
+
+		// Use the template if one is provided.
+		var tmplSnippet string
+		if tmplName, ok := template.Get(); ok {
+			tmplSnippet = fmt.Sprintf("WITH TEMPLATE %s", (pgx.Identifier{tmplName}).Sanitize())
+		}
+		_, err = adm.Exec(ctx, fmt.Sprintf("CREATE DATABASE %s %s OWNER %s;", dbName, tmplSnippet, ownerName))
 	}
 	if err != nil {
 		db.log.Error().Err(err).Msg("failed to create database")
@@ -101,8 +173,93 @@ func (db *DB) Create(ctx context.Context) error {
 	return err
 }
 
+func (db *DB) renameDB(ctx context.Context, from, to string) error {
+	adm, err := db.connectSuperuser(ctx)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = adm.Close(context.Background()) }()
+
+	_, err = adm.Exec(ctx, fmt.Sprintf("ALTER DATABASE %s RENAME TO %s",
+		(pgx.Identifier{from}).Sanitize(),
+		(pgx.Identifier{to}).Sanitize(),
+	))
+	return err
+}
+
+// ensureRoles ensures the roles have been granted access to this database.
+func (db *DB) ensureRoles(ctx context.Context, cloudName string, roles ...Role) error {
+	adm, err := db.connectSuperuser(ctx)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = adm.Close(context.Background()) }()
+
+	db.log.Debug().Msg("revoking public access")
+	safeDBName := (pgx.Identifier{cloudName}).Sanitize()
+	_, err = adm.Exec(ctx, "REVOKE ALL ON DATABASE "+safeDBName+" FROM public")
+	if err != nil {
+		return fmt.Errorf("revoke public: %v", err)
+	}
+
+	for _, role := range roles {
+		var stmt string
+		safeRoleName := (pgx.Identifier{role.Username}).Sanitize()
+		switch role.Type {
+		case RoleSuperuser:
+			// Already granted; nothing to do
+			continue
+		case RoleAdmin:
+			stmt = fmt.Sprintf("GRANT ALL ON DATABASE %s TO %s;", safeDBName, safeRoleName)
+		case RoleWrite:
+			stmt = fmt.Sprintf(`
+				GRANT TEMP, CONNECT ON DATABASE %s TO %s;
+				GRANT pg_read_all_data TO %s;
+				GRANT pg_write_all_data TO %s;
+			`, safeDBName, safeRoleName, safeRoleName, safeRoleName)
+		case RoleRead:
+			stmt = fmt.Sprintf(`
+				GRANT TEMP, CONNECT ON DATABASE %s TO %s;
+				GRANT pg_read_all_data TO %s;
+			`, safeDBName, safeRoleName, safeRoleName)
+		default:
+			return fmt.Errorf("unknown role type %q", role.Type)
+		}
+
+		db.log.Debug().Str("role", role.Username).Str("db", cloudName).Msg("granting access to role")
+
+		// We've observed race conditions in Postgres to grant access. Retry a few times.
+		{
+			var err error
+			for i := 0; i < 5; i++ {
+				_, err = adm.Exec(ctx, stmt)
+				if err == nil {
+					break
+				}
+				db.log.Debug().Str("role", role.Username).Str("db", cloudName).Err(err).Msg("error granting role, retrying")
+				time.Sleep(250 * time.Millisecond)
+			}
+			if err != nil {
+				return fmt.Errorf("grant %s role %s: %v", role.Type, role.Username, err)
+			}
+		}
+
+		db.log.Debug().Str("role", role.Username).Str("db", cloudName).Msg("successfully granted access")
+	}
+	return nil
+}
+
 // Migrate migrates the database.
-func (db *DB) Migrate(ctx context.Context, appRoot string, svc *meta.Service) (err error) {
+func (db *DB) doMigrate(ctx context.Context, cloudName, appRoot string, dbMeta *meta.SQLDatabase) (err error) {
+	if db.Cluster.ID.Type == Shadow {
+		db.log.Debug().Msg("not applying migrations to shadow cluster")
+		return nil
+	}
+	if len(dbMeta.Migrations) == 0 || dbMeta.MigrationRelPath == nil {
+		db.log.Debug().Msg("no database migrations to run, skipping")
+		return nil
+	}
+
 	db.log.Debug().Msg("running database migrations")
 	defer func() {
 		if err != nil {
@@ -113,55 +270,177 @@ func (db *DB) Migrate(ctx context.Context, appRoot string, svc *meta.Service) (e
 		}
 	}()
 
-	uri := fmt.Sprintf("postgresql://encore:%s@%s/%s?sslmode=disable", db.Cluster.ID, db.Cluster.HostPort, db.Name)
-	conn, err := sql.Open("pgx", uri)
+	info, err := db.Cluster.Info(ctx)
 	if err != nil {
 		return err
+	} else if info.Status != Running {
+		return errors.New("cluster not running")
 	}
-	defer conn.Close()
 
-	instance, err := postgres.WithInstance(conn, &postgres.Config{})
+	admin, ok := info.Encore.First(RoleAdmin, RoleSuperuser)
+	if !ok {
+		return errors.New("unable to find superuser or admin roles")
+	}
+	uri := info.ConnURI(cloudName, admin)
+	db.log.Debug().Str("uri", uri).Msg("running migrations")
+	pool, err := sql.Open("pgx", uri)
 	if err != nil {
 		return err
 	}
+	defer fns.CloseIgnore(pool)
 
-	s := &src{
-		appRoot:    appRoot,
-		svcRelPath: svc.RelPath,
-		migrations: svc.Migrations,
-	}
-	m, err := migrate.NewWithInstance("src", s, db.Name, instance)
+	path := filepath.Join(appRoot, *dbMeta.MigrationRelPath)
+	mdSrc := NewMetadataSource(NewOsMigrationReader(path), dbMeta.Migrations)
+	conn, err := pool.Conn(ctx)
 	if err != nil {
-		return err
+		return errors.Wrap(err, "failed to connect to postgres")
 	}
+	err = RunMigration(ctx, cloudName, dbMeta.AllowNonSequentialMigrations, conn, mdSrc)
 
-	if err := m.Up(); err == migrate.ErrNoChange {
-		db.log.Debug().Msg("database already up to date")
+	// If we have removed a migration that failed to apply we can get an ErrNoChange error
+	// after forcing the migration down to the previous version.
+	if errors.Is(err, migrate.ErrNoChange) {
+		db.log.Info().Msg("database already up to date")
 		return nil
 	} else if err != nil {
+		return fmt.Errorf("could not migrate database %s: %v", cloudName, err)
+	}
+	db.log.Info().Msg("migration completed")
+	return nil
+}
+
+func (db *DB) ListAppliedMigrations(ctx context.Context) (map[uint64]bool, error) {
+	conn, err := db.connectToDB(ctx)
+	if err != nil {
+		return nil, err
+	}
+	defer fns.CloseIgnore(conn)
+	return LoadAppliedVersions(ctx, conn, "public", "schema_migrations")
+}
+
+func RunMigration(ctx context.Context, dbName string, allowNonSeq bool, conn *sql.Conn, mdSrc *MetadataSource) (err error) {
+	var (
+		dbDriver  database.Driver
+		srcDriver source.Driver
+	)
+	if allowNonSeq {
+		dbDriver, srcDriver, err = NonSequentialMigrator(ctx, conn, mdSrc)
+		if err != nil {
+			return errors.Wrap(err, "failed to connect to postgres")
+		}
+	} else {
+		dbDriver, err = postgres.WithConnection(ctx, conn, &postgres.Config{})
+		if err != nil {
+			return errors.Wrap(err, "failed to connect to postgres")
+		}
+		srcDriver = mdSrc
+	}
+
+	curVersion, _, err := dbDriver.Version()
+	if err != nil {
+		return errors.Wrap(err, "failed to get current version")
+	} else if curVersion < -1 {
+		return errors.Newf("invalid current version (%d) for db %s", curVersion, dbName)
+	}
+
+	m, err := migrate.NewWithInstance("src", srcDriver, "postgres", dbDriver)
+	if err != nil {
+		return errors.Wrap(err, "failed to create migration instance")
+	}
+
+	err = m.Up()
+	if errors.Is(err, migrate.ErrNoChange) {
+		return err
+	}
+
+	// If we have a dirty migration, reset the dirty flag and try again.
+	// This is safe since all migrations run inside transactions.
+	var dirty migrate.ErrDirty
+	if errors.As(err, &dirty) {
+		// Find the version that preceded the dirty version so
+		// we can force the migration to that version and then
+		// re-apply the migration.
+		var prevVer uint
+		prevVer, err = srcDriver.Prev(uint(dirty.Version))
+		targetVer := int(prevVer)
+		if errors.Is(err, fs.ErrNotExist) {
+			// If Prev returns ErrNotExist, the original migration might
+			// have been deleted. In this case, we'll need to search for
+			// the version that is the closest lower version starting at the
+			// first version.
+			targetVer, err = findClosestLowerVersion(srcDriver.First, dirty.Version, srcDriver.Next)
+			if err != nil {
+				return errors.Wrapf(err, "could not automatically reset the schema_migrations "+
+					"dirty flag for database %s. Please reset it manually by connecting "+
+					"to the database modify the schema_migrations table", dbName)
+			}
+		} else if err != nil {
+			return errors.Wrap(err, "failed to find previous version")
+		}
+
+		if err = m.Force(targetVer); err == nil {
+			err = m.Up()
+		}
+	}
+	return errors.Wrap(err, "failed to migrate database")
+}
+
+func findClosestLowerVersion(first func() (uint, error), dirtyVer int, next func(i uint) (uint, error)) (int, error) {
+	firstVer, err := first()
+	// If the first version doesn't exist, we can't reset the dirty flag
+	// and we'll need to return an error.
+	if err != nil {
+		return 0, errors.Wrapf(err, "failed to find first version")
+	}
+	// otherwise we'll need to find the version that is the closest lower version
+	rtn := database.NilVersion
+	for nextVer := firstVer; err == nil && nextVer < uint(dirtyVer); nextVer, err = next(nextVer) {
+		rtn = int(nextVer)
+	}
+	return rtn, nil
+}
+
+func (db *DB) drop(ctx context.Context) error {
+	if err := db.doDrop(ctx, db.ApplicationCloudName()); err != nil {
+		return errors.Wrapf(err, "drop database %s", db.ApplicationCloudName())
+	}
+	if name, ok := db.TemplateCloudName().Get(); ok {
+		if err := db.doDrop(ctx, name); err != nil {
+			return errors.Wrapf(err, "drop database %s", name)
+		}
+	}
+	return nil
+}
+
+func (db *DB) terminateConnectionsToDB(ctx context.Context, cloudName string) error {
+	adm, err := db.connectSuperuser(ctx)
+	if err != nil {
 		return err
 	}
+	defer func() { _ = adm.Close(context.Background()) }()
+
+	// Drop all connections to prevent "database is being accessed by other users" errors.
+	_, _ = adm.Exec(ctx, "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = $1", cloudName)
 	return nil
 }
 
-// Drop drops the database in the cluster if it exists.
-func (db *DB) Drop(ctx context.Context) error {
-	adm, err := db.connectAdminDB(ctx)
+func (db *DB) doDrop(ctx context.Context, cloudName string) error {
+	adm, err := db.connectSuperuser(ctx)
 	if err != nil {
 		return err
 	}
-	defer adm.Close(context.Background())
+	defer func() { _ = adm.Close(context.Background()) }()
 
 	var dummy int
-	err = adm.QueryRow(ctx, "SELECT 1 FROM pg_database WHERE datname = $1", db.Name).Scan(&dummy)
+	err = adm.QueryRow(ctx, "SELECT 1 FROM pg_database WHERE datname = $1", cloudName).Scan(&dummy)
 	if err == nil {
 		// Drop all connections to prevent "database is being accessed by other users" errors.
-		adm.Exec(ctx, "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = $1", db.Name)
+		_, _ = adm.Exec(ctx, "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname = $1", cloudName)
 
-		name := (pgx.Identifier{db.Name}).Sanitize() // sanitize database name, to be safe
+		name := (pgx.Identifier{cloudName}).Sanitize() // sanitize database name, to be safe
 		_, err = adm.Exec(ctx, fmt.Sprintf("DROP DATABASE %s;", name))
 		db.log.Debug().Err(err).Msgf("dropped database")
-	} else if err == pgx.ErrNoRows {
+	} else if errors.Is(err, pgx.ErrNoRows) {
 		return nil
 	}
 
@@ -177,9 +456,9 @@ func (db *DB) CloseConns() {
 	db.cancel()
 }
 
-// connectAdminDB creates a connection to the admin database for the cluster.
+// connectSuperuser creates a superuser connection to the root database for the cluster.
 // On success the returned conn must be closed by the caller.
-func (db *DB) connectAdminDB(ctx context.Context) (*pgx.Conn, error) {
+func (db *DB) connectSuperuser(ctx context.Context) (*pgx.Conn, error) {
 	// Wait for the cluster to be setup
 	select {
 	case <-ctx.Done():
@@ -187,27 +466,52 @@ func (db *DB) connectAdminDB(ctx context.Context) (*pgx.Conn, error) {
 	case <-db.Cluster.started:
 	}
 
-	hostPort := db.Cluster.HostPort
-	if hostPort == "" {
-		return nil, fmt.Errorf("internal error: missing HostPort for cluster %s", db.Cluster.ID)
+	info, err := db.Cluster.Info(ctx)
+	if err != nil {
+		return nil, err
+	} else if info.Status != Running {
+		return nil, fmt.Errorf("cluster not running")
 	}
 
+	uri := info.ConnURI(info.Config.RootDatabase, info.Config.Superuser)
+
 	// Wait for the connection to be established; this might take a little bit
 	// when we're racing with spinning up a Docker container.
-	var err error
 	for i := 0; i < 40; i++ {
 		var conn *pgx.Conn
-		conn, err = pgx.Connect(ctx, "postgresql://encore:"+db.Cluster.ID+"@"+hostPort+"/postgres?sslmode=disable")
+		conn, err = pgx.Connect(ctx, uri)
 		if err == nil {
 			return conn, nil
 		} else if ctx.Err() != nil {
 			// We'll never succeed once the context has been canceled.
 			// Give up straight away.
-			db.log.Debug().Err(err).Msgf("failed to connect to admin db")
+			db.log.Debug().Err(err).Msgf("failed to connect to superuser db")
 			return nil, err
 		}
 		time.Sleep(250 * time.Millisecond)
 	}
 	db.log.Debug().Err(err).Msgf("failed to connect to admin db")
-	return nil, fmt.Errorf("failed to connect to admin database: %v", err)
+	return nil, fmt.Errorf("failed to connect to superuser database: %v", err)
+}
+
+// Connects as a superuser or admin to the database. Fails fast if the cluster
+// is not running yet.
+// On success the returned conn must be closed by the caller.
+func (db *DB) connectToDB(ctx context.Context) (*sql.Conn, error) {
+	info, err := db.Cluster.Info(ctx)
+	if err != nil {
+		return nil, err
+	}
+	uri := info.ConnURI(db.EncoreName, info.Config.Superuser)
+	pool, err := sql.Open("pgx", uri)
+	if err != nil {
+		return nil, err
+	}
+	defer fns.CloseIgnore(pool)
+
+	conn, err := pool.Conn(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return conn, nil
 }
diff --git a/cli/daemon/sqldb/db_test.go b/cli/daemon/sqldb/db_test.go
new file mode 100644
index 0000000000..4ed7449c72
--- /dev/null
+++ b/cli/daemon/sqldb/db_test.go
@@ -0,0 +1,73 @@
+package sqldb
+
+import (
+	"io/fs"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	_ "github.com/golang-migrate/migrate/v4/source/file" // for running migrations from the filesystem
+)
+
+func TestFindClosestVersion(t *testing.T) {
+	c := qt.New(t)
+	testCases := map[string]struct {
+		versions    []uint
+		dirty       int
+		expected    int
+		expectedErr bool
+	}{
+		"first": {
+			versions: []uint{1, 2, 3},
+			dirty:    1,
+			expected: -1,
+		},
+		"middle": {
+			versions: []uint{1, 2, 3},
+			dirty:    2,
+			expected: 1,
+		},
+		"last": {
+			versions: []uint{1, 2, 3},
+			dirty:    3,
+			expected: 2,
+		},
+		"deleted": {
+			versions: []uint{1, 2, 4},
+			dirty:    3,
+			expected: 2,
+		},
+		"deleted_first": {
+			versions: []uint{2, 3, 4},
+			dirty:    1,
+			expected: -1,
+		},
+		"empty": {
+			dirty:       5,
+			expectedErr: true,
+		},
+	}
+
+	for name, tc := range testCases {
+		c.Run(name, func(c *qt.C) {
+			result, err := findClosestLowerVersion(func() (uint, error) {
+				if len(tc.versions) == 0 {
+					return 0, fs.ErrNotExist
+				}
+				return tc.versions[0], nil
+			}, tc.dirty, func(version uint) (uint, error) {
+				for _, v := range tc.versions {
+					if v > version {
+						return v, nil
+					}
+				}
+				return 0, fs.ErrNotExist
+			})
+			if tc.expectedErr {
+				c.Assert(err, qt.IsNotNil)
+			} else {
+				c.Assert(err, qt.IsNil)
+				c.Assert(result, qt.Equals, tc.expected)
+			}
+		})
+	}
+}
diff --git a/cli/daemon/sqldb/docker/docker.go b/cli/daemon/sqldb/docker/docker.go
new file mode 100644
index 0000000000..2ffa8c56af
--- /dev/null
+++ b/cli/daemon/sqldb/docker/docker.go
@@ -0,0 +1,403 @@
+package docker
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/jackc/pgx/v5"
+	"github.com/rs/zerolog"
+
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/sqldb"
+	"encr.dev/pkg/idents"
+)
+
+type Driver struct{}
+
+var _ sqldb.Driver = (*Driver)(nil)
+
+const (
+	DefaultSuperuserUsername = "postgres"
+	DefaultSuperuserPassword = "postgres"
+	DefaultRootDatabase      = "postgres"
+	defaultDataDir           = "/var/lib/postgresql/data"
+)
+
+func (d *Driver) CreateCluster(ctx context.Context, p *sqldb.CreateParams, log zerolog.Logger) (status *sqldb.ClusterStatus, err error) {
+	// Ensure the docker image exists first.
+	{
+		checkExistsCtx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+		defer cancel()
+		if ok, err := ImageExists(checkExistsCtx); err != nil {
+			return nil, errors.Wrap(err, "check docker image")
+		} else if !ok {
+			log.Debug().Msg("PostgreSQL image does not exist, pulling")
+			pullOp := p.Tracker.Add("Pulling PostgreSQL docker image", time.Now())
+			if err := PullImage(context.Background()); err != nil {
+				log.Error().Err(err).Msg("failed to pull PostgreSQL image")
+				p.Tracker.Fail(pullOp, err)
+				return nil, errors.Wrap(err, "pull docker image")
+			} else {
+				p.Tracker.Done(pullOp, 0)
+				log.Info().Msg("successfully pulled sqldb image")
+			}
+		}
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+
+	// If we return with a connection, wait until we can connect.
+	defer func() {
+		if err != nil {
+			return
+		}
+		// Wait for the database to come up; this might take a little bit
+		// when we're racing with spinning up a Docker container.
+		uri := status.ConnURI(status.Config.RootDatabase, status.Config.Superuser)
+
+		const sleepTime = 250 * time.Millisecond
+		const maxLoops = (30 * time.Second) / sleepTime
+		for i := 0; i < int(maxLoops); i++ {
+			var conn *pgx.Conn
+			connCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+			conn, err = pgx.Connect(connCtx, uri)
+			cancel()
+
+			if err == nil {
+				_ = conn.Close(ctx)
+				return
+			} else if ctx.Err() != nil {
+				// We'll never succeed once the context has been canceled.
+				// Give up straight away.
+				log.Debug().Err(err).Msgf("failed to connect to db")
+				err = errors.Wrap(err, "database did not come up")
+			} else if errors.Is(err, io.ErrUnexpectedEOF) {
+				// This is a transient error that can happen when the database first initialises
+				err = errors.Wrap(err, "database is not ready yet")
+			} else {
+				err = errors.WithStack(err)
+			}
+			time.Sleep(250 * time.Millisecond)
+		}
+	}()
+
+	cid := p.ClusterID
+	cnames := containerNames(cid)
+	status, existingContainerName, err := d.clusterStatus(ctx, cid)
+	if err != nil {
+		log.Error().Err(err).Msg("failed to get container status")
+		return nil, errors.WithStack(err)
+	}
+
+	// waitForPort waits for the port to become available before returning.
+	waitForPort := func() (*sqldb.ClusterStatus, error) {
+		for i := 0; i < 20; i++ {
+			status, err = d.ClusterStatus(ctx, cid)
+			if err != nil {
+				return nil, errors.Wrap(err, "unable to wait for port")
+			}
+			if status.Config.Host != "" {
+				log.Debug().Str("hostport", status.Config.Host).Msg("cluster started")
+				return status, nil
+			}
+			time.Sleep(500 * time.Millisecond)
+		}
+		return nil, errors.New("timed out waiting for cluster to start")
+	}
+
+	switch status.Status {
+	case sqldb.Running:
+		log.Debug().Str("hostport", status.Config.Host).Msg("cluster already running")
+		return status, nil
+
+	case sqldb.Stopped:
+		log.Debug().Msg("cluster stopped, restarting")
+
+		if out, err := exec.CommandContext(ctx, "docker", "start", existingContainerName).CombinedOutput(); err != nil {
+			return nil, errors.Wrapf(err, "could not start sqldb container: %s", string(out))
+		}
+		return waitForPort()
+
+	case sqldb.NotFound:
+		log.Debug().Msg("cluster not found, creating")
+		args := []string{
+			"run",
+			"-d",
+			"-p", "5432",
+			"--shm-size=1gb",
+			"-e", "POSTGRES_USER=" + DefaultSuperuserUsername,
+			"-e", "POSTGRES_PASSWORD=" + DefaultSuperuserPassword,
+			"-e", "POSTGRES_DB=" + DefaultRootDatabase,
+			"-e", "PGDATA=" + defaultDataDir,
+			"--name", cnames[0],
+		}
+		if p.Memfs {
+			args = append(args,
+				"--mount", "type=tmpfs,destination="+defaultDataDir,
+				Image,
+				"-c", "fsync=off",
+			)
+		} else {
+			volumeName := clusterVolumeNames(p.ClusterID.NS)[0] // guaranteed to be non-empty
+			if err := d.createVolumeIfNeeded(ctx, volumeName); err != nil {
+				return nil, errors.Wrap(err, "create data volume")
+			}
+			args = append(args,
+				"-v", fmt.Sprintf("%s:%s", volumeName, defaultDataDir),
+				Image)
+		}
+
+		cmd := exec.CommandContext(ctx, "docker", args...)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			return nil, errors.Wrapf(err, "could not start sql database as docker container: %s", out)
+		}
+
+		log.Debug().Msg("cluster created")
+		return waitForPort()
+
+	default:
+		return nil, errors.Newf("unknown cluster status %q", status.Status)
+	}
+}
+
+func (d *Driver) ClusterStatus(ctx context.Context, id sqldb.ClusterID) (*sqldb.ClusterStatus, error) {
+	status, _, err := d.clusterStatus(ctx, id)
+	return status, errors.WithStack(err)
+}
+
+func (d *Driver) CheckRequirements(ctx context.Context) error {
+	if _, err := exec.LookPath("docker"); err != nil {
+		return errors.New("This application requires docker to run since it uses an SQL database. Install docker first.")
+	} else if !isDockerRunning(ctx) {
+		return errors.New("The docker daemon is not running. Start it first.")
+	}
+	return nil
+}
+
+// clusterStatus reports both the standard ClusterStatus but also the container name we actually resolved to.
+func (d *Driver) clusterStatus(ctx context.Context, id sqldb.ClusterID) (status *sqldb.ClusterStatus, containerName string, err error) {
+	var output []byte
+
+	// Try the candidate container names in order.
+	cnames := containerNames(id)
+	for _, cname := range cnames {
+		var err error
+		out, err := exec.CommandContext(ctx, "docker", "container", "inspect", cname).CombinedOutput()
+		if errors.Is(err, exec.ErrNotFound) {
+			return nil, "", errors.New("docker not found: is it installed and in your PATH?")
+		} else if err != nil {
+			// Docker returns a non-zero exit code if the container does not exist.
+			// Try to tell this apart from an error by parsing the output.
+			if bytes.Contains(out, []byte("No such container")) {
+				continue
+			}
+			// Podman has slightly different output when a container is not found.
+			if bytes.Contains(out, []byte("no such container")) {
+				continue
+			}
+			return nil, "", errors.Wrapf(err, "docker container inspect failed: %s", out)
+		} else {
+			// Found our container; use it.
+			output, containerName = out, cname
+			break
+		}
+	}
+	if output == nil {
+		return &sqldb.ClusterStatus{Status: sqldb.NotFound}, containerName, nil
+	}
+
+	var resp []struct {
+		Name  string
+		State struct {
+			Running bool
+		}
+		Config struct {
+			Env []string
+		}
+		NetworkSettings struct {
+			Ports map[string][]struct {
+				HostIP   string
+				HostPort string
+			}
+		}
+	}
+	if err := json.Unmarshal(output, &resp); err != nil {
+		return nil, "", errors.Wrap(err, "parse `docker container inspect` response")
+	}
+	for _, c := range resp {
+		// Docker prefixes `/` to the container name, Podman doesn't.
+		if c.Name == "/"+containerName || c.Name == containerName {
+			status := &sqldb.ClusterStatus{Status: sqldb.Stopped, Config: &sqldb.ConnConfig{
+				// Defaults if we don't find anything else configured.
+				Superuser: sqldb.Role{
+					Type:     sqldb.RoleSuperuser,
+					Username: DefaultSuperuserUsername,
+					Password: DefaultSuperuserPassword,
+				},
+				RootDatabase: DefaultRootDatabase,
+			}}
+			if c.State.Running {
+				status.Status = sqldb.Running
+			}
+			ports := c.NetworkSettings.Ports["5432/tcp"]
+			if len(ports) > 0 {
+				hostIP := ports[0].HostIP
+
+				// Podman can keep HostIP empty or 0.0.0.0.
+				// https://github.com/containers/podman/issues/17780
+				if hostIP == "" || hostIP == "0.0.0.0" {
+					hostIP = "127.0.0.1"
+				}
+
+				status.Config.Host = hostIP + ":" + ports[0].HostPort
+			}
+
+			// Read the Postgres config from the docker container's environment.
+			for _, env := range c.Config.Env {
+				if name, value, ok := strings.Cut(env, "="); ok {
+					switch name {
+					case "POSTGRES_USER":
+						status.Config.Superuser.Username = value
+					case "POSTGRES_PASSWORD":
+						status.Config.Superuser.Password = value
+					case "POSTGRES_DB":
+						status.Config.RootDatabase = value
+					}
+				}
+			}
+
+			return status, containerName, nil
+		}
+	}
+	return &sqldb.ClusterStatus{Status: sqldb.NotFound}, containerName, nil
+}
+
+func (d *Driver) CanDestroyCluster(ctx context.Context, id sqldb.ClusterID) error {
+	// Check that we can communicate with Docker.
+	if !isDockerRunning(ctx) {
+		return errors.New("cannot delete sql database: docker is not running")
+	}
+	return nil
+}
+
+func (d *Driver) DestroyCluster(ctx context.Context, id sqldb.ClusterID) error {
+	cnames := containerNames(id)
+	for _, cname := range cnames {
+		out, err := exec.CommandContext(ctx, "docker", "rm", "-f", cname).CombinedOutput()
+		if err != nil {
+			if bytes.Contains(out, []byte("No such container")) {
+				continue
+			}
+			return errors.Wrapf(err, "could not delete cluster: %s", out)
+		}
+	}
+	return nil
+}
+
+func (d *Driver) DestroyNamespaceData(ctx context.Context, ns *namespace.Namespace) error {
+	candidates := clusterVolumeNames(ns)
+	for _, c := range candidates {
+		if err := exec.CommandContext(ctx, "docker", "volume", "rm", "-f", c).Run(); err != nil {
+			if strings.Contains(strings.ToLower(err.Error()), "no such volume") {
+				continue
+			}
+			return errors.Wrapf(err, "could not delete volume %s", c)
+		}
+	}
+	return nil
+}
+
+func (d *Driver) createVolumeIfNeeded(ctx context.Context, name string) error {
+	if err := exec.CommandContext(ctx, "docker", "volume", "inspect", name).Run(); err == nil {
+		return nil
+	}
+	out, err := exec.CommandContext(ctx, "docker", "volume", "create", name).CombinedOutput()
+	return errors.Wrapf(err, "create volume %s: %s", name, out)
+}
+
+func (d *Driver) Meta() sqldb.DriverMeta {
+	return sqldb.DriverMeta{ClusterIsolation: true}
+}
+
+// containerNames computes the container name candidates for a given clusterID.
+func containerNames(id sqldb.ClusterID) []string {
+	// candidates returns possible candidate names for a given app id.
+	candidates := func(appID string) (names []string) {
+		base := "sqldb-" + appID
+
+		if id.Type != sqldb.Run {
+			base += "-" + string(id.Type)
+		}
+
+		// Convert the namespace to kebab case to remove invalid characters like ':'.
+		nsName := idents.Convert(string(id.NS.Name), idents.KebabCase)
+
+		names = []string{base + "-" + nsName + "-" + string(id.NS.ID)}
+		// If this is the default namespace look up the container without
+		// the namespace suffix as well, for backwards compatibility.
+		if id.NS.Name == "default" {
+			names = append(names, base)
+		}
+		return names
+	}
+
+	var names []string
+	if pid := id.NS.App.PlatformID(); pid != "" {
+		names = append(names, candidates(pid)...)
+	}
+	names = append(names, candidates(id.NS.App.LocalID())...)
+	return names
+}
+
+// ImageExists reports whether the docker image exists.
+func ImageExists(ctx context.Context) (ok bool, err error) {
+	out, err := exec.CommandContext(ctx, "docker", "image", "inspect", Image).CombinedOutput()
+	switch {
+	case err == nil:
+		return true, nil
+	case bytes.Contains(out, []byte("No such image")):
+		return false, nil
+	// Podman has a different error message.
+	case bytes.Contains(out, []byte("failed to find image")):
+		return false, nil
+	default:
+		return false, errors.WithStack(errors.Wrapf(err, "docker image inspect failed: %s", Image))
+	}
+}
+
+// PullImage pulls the image.
+func PullImage(ctx context.Context) error {
+	cmd := exec.CommandContext(ctx, "docker", "pull", Image)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
+
+const Image = "encoredotdev/postgres:15"
+
+func isDockerRunning(ctx context.Context) bool {
+	err := exec.CommandContext(ctx, "docker", "info").Run()
+	return err == nil
+}
+
+// clusterVolumeNames reports the candidate names for the docker volume.
+func clusterVolumeNames(ns *namespace.Namespace) (candidates []string) {
+	nsName := idents.Convert(string(ns.Name), idents.KebabCase)
+	suffix := fmt.Sprintf("%s-%s", ns.ID, nsName)
+
+	for _, id := range [...]string{ns.App.PlatformID(), ns.App.LocalID()} {
+		if id != "" {
+			candidates = append(candidates, fmt.Sprintf("sqldb-%s-%s", id, suffix))
+		}
+	}
+	return candidates
+}
diff --git a/cli/daemon/sqldb/driver.go b/cli/daemon/sqldb/driver.go
new file mode 100644
index 0000000000..0d06159806
--- /dev/null
+++ b/cli/daemon/sqldb/driver.go
@@ -0,0 +1,113 @@
+package sqldb
+
+import (
+	"context"
+	"errors"
+
+	"github.com/rs/zerolog"
+
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/internal/optracker"
+)
+
+var ErrUnsupported = errors.New("unsupported operation")
+
+// A Driver abstracts away how a cluster is actually operated.
+type Driver interface {
+	// CreateCluster creates (if necessary) and starts (if necessary) a new cluster using the driver,
+	// and returns its status.
+	// err is nil if and only if the cluster could not be started.
+	CreateCluster(ctx context.Context, p *CreateParams, log zerolog.Logger) (*ClusterStatus, error)
+
+	// CanDestroyCluster reports whether the cluster could be destroyed, if desired.
+	// If a Driver doesn't support destroying the cluster it reports ErrUnsupported.
+	CanDestroyCluster(ctx context.Context, id ClusterID) error
+
+	// DestroyCluster destroys a cluster with the given id.
+	// If a Driver doesn't support destroying the cluster it reports ErrUnsupported.
+	DestroyCluster(ctx context.Context, id ClusterID) error
+
+	// DestroyNamespaceData destroys the data associated with a namespace.
+	// If a Driver doesn't support destroying data it reports ErrUnsupported.
+	DestroyNamespaceData(ctx context.Context, ns *namespace.Namespace) error
+
+	// ClusterStatus reports the current status of a cluster.
+	ClusterStatus(ctx context.Context, id ClusterID) (*ClusterStatus, error)
+
+	// CheckRequirements checks whether all the requirements are met
+	// to use the driver.
+	CheckRequirements(ctx context.Context) error
+
+	// Meta reports driver metadata.
+	Meta() DriverMeta
+}
+
+type DriverMeta struct {
+	// ClusterIsolation reports whether clusters are isolated by the driver.
+	// If false, database names will be prefixed with the cluster id.
+	ClusterIsolation bool
+}
+
+type ConnConfig struct {
+	// Host is the host address to connect to the database.
+	// It is only set when Status == Running.
+	Host string
+
+	// Superuser is the role to use to connect as the superuser,
+	// for creating and managing Encore databases.
+	Superuser    Role
+	RootDatabase string // root database to connect to
+}
+
+type ClusterType string
+
+const (
+	Run    ClusterType = "run"
+	Shadow ClusterType = "shadow"
+	Test   ClusterType = "test"
+)
+
+func (ct ClusterType) Memfs() bool {
+	switch ct {
+	case Run:
+		return false
+	case Shadow, Test:
+		return true
+	default:
+		return false
+	}
+}
+
+// CreateParams are the params to (*ClusterManager).Create.
+type CreateParams struct {
+	ClusterID ClusterID
+
+	// Memfs, if true, configures the database container to use an
+	// in-memory filesystem as opposed to persisting the database to disk.
+	Memfs bool
+
+	// Tracker allows tracking the progress of the operation.
+	Tracker *optracker.OpTracker
+}
+
+// Status represents the status of a container.
+type Status string
+
+const (
+	// Running indicates the cluster is running.
+	Running Status = "running"
+	// Stopped indicates the container exists but is not running.
+	Stopped Status = "stopped"
+	// NotFound indicates the container does not exist.
+	NotFound Status = "notfound"
+)
+
+// ClusterStatus represents the status of a database cluster.
+type ClusterStatus struct {
+	// Status is the status of the underlying container.
+	Status Status
+
+	// Config is how to connect to the cluster.
+	// It is non-nil if Status == Running.
+	Config *ConnConfig
+}
diff --git a/cli/daemon/sqldb/external/external.go b/cli/daemon/sqldb/external/external.go
new file mode 100644
index 0000000000..47e95316b7
--- /dev/null
+++ b/cli/daemon/sqldb/external/external.go
@@ -0,0 +1,68 @@
+// Package external implements a cluster driver for an external cluster.
+package external
+
+import (
+	"context"
+
+	"github.com/rs/zerolog"
+
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/sqldb"
+)
+
+type Driver struct {
+	Host              string // "host", "host:port", "/path/to/unix.socket",
+	Database          string // database name
+	SuperuserUsername string
+	SuperuserPassword string
+}
+
+var _ sqldb.Driver = (*Driver)(nil)
+
+func (d *Driver) CreateCluster(ctx context.Context, p *sqldb.CreateParams, log zerolog.Logger) (*sqldb.ClusterStatus, error) {
+	// The external driver does not actually create the cluster; just return the status.
+	return d.ClusterStatus(ctx, p.ClusterID)
+}
+
+func (d *Driver) ClusterStatus(ctx context.Context, id sqldb.ClusterID) (*sqldb.ClusterStatus, error) {
+	st := &sqldb.ClusterStatus{
+		Status: sqldb.Running,
+		Config: &sqldb.ConnConfig{
+			Host: d.Host,
+			Superuser: sqldb.Role{
+				Type:     sqldb.RoleSuperuser,
+				Username: def(d.SuperuserUsername, "postgres"),
+				Password: def(d.SuperuserPassword, "postgres"),
+			},
+			RootDatabase: def(d.Database, "postgres"),
+		},
+	}
+	return st, nil
+}
+
+func (d *Driver) CanDestroyCluster(ctx context.Context, id sqldb.ClusterID) error {
+	return sqldb.ErrUnsupported
+}
+
+func (d *Driver) DestroyCluster(ctx context.Context, id sqldb.ClusterID) error {
+	return sqldb.ErrUnsupported
+}
+
+func (d *Driver) DestroyNamespaceData(ctx context.Context, ns *namespace.Namespace) error {
+	return sqldb.ErrUnsupported
+}
+
+func (d *Driver) CheckRequirements(ctx context.Context) error {
+	return nil
+}
+
+func (d *Driver) Meta() sqldb.DriverMeta {
+	return sqldb.DriverMeta{ClusterIsolation: false}
+}
+
+func def(val, orDefault string) string {
+	if val == "" {
+		val = orDefault
+	}
+	return val
+}
diff --git a/cli/daemon/sqldb/manager.go b/cli/daemon/sqldb/manager.go
index cf994e76cf..e447e85683 100644
--- a/cli/daemon/sqldb/manager.go
+++ b/cli/daemon/sqldb/manager.go
@@ -1,103 +1,204 @@
-// Package sqldb runs and manages connections for Encore applications.
 package sqldb
 
 import (
-	"bytes"
 	"context"
+	"crypto/rand"
+	"encoding/base64"
 	"fmt"
-	"os/exec"
 	"sync"
 
-	meta "encr.dev/proto/encore/parser/meta/v1"
+	"github.com/cockroachdb/errors"
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"golang.org/x/sync/singleflight"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/secret"
 )
 
 // NewClusterManager creates a new ClusterManager.
-func NewClusterManager() *ClusterManager {
+func NewClusterManager(driver Driver, apps *apps.Manager, ns *namespace.Manager, secretMgr *secret.Manager) *ClusterManager {
 	log := log.Logger
 	return &ClusterManager{
 		log:            log,
-		clusters:       make(map[string]*Cluster),
+		driver:         driver,
+		apps:           apps,
+		ns:             ns,
+		clusters:       make(map[clusterKey]*Cluster),
 		backendKeyData: make(map[uint32]*Cluster),
+		secretMgr:      secretMgr,
 	}
 }
 
 // A ClusterManager manages running local sqldb clusters.
 type ClusterManager struct {
 	log        zerolog.Logger
+	driver     Driver
+	apps       *apps.Manager
+	ns         *namespace.Manager
 	startGroup singleflight.Group
+	secretMgr  *secret.Manager
 
 	mu       sync.Mutex
-	clusters map[string]*Cluster // cluster id -> cluster
+	clusters map[clusterKey]*Cluster
 	// backendKeyData maps the secret data to a cluster,
 	// for forwarding cancel requests to the right cluster.
 	// Access is guarded by mu.
 	backendKeyData map[uint32]*Cluster
 }
 
-// InitParams are the params to (*ClusterManager).Init.
-type InitParams struct {
-	// ClusterID is the unique id of the cluster.
-	ClusterID string
+// ClusterID uniquely identifies a cluster.
+type ClusterID struct {
+	NS   *namespace.Namespace
+	Type ClusterType
+}
 
-	// Meta is the metadata used to initialize databases.
-	// If nil no databases are initialized.
-	Meta *meta.Data
+// clusterKey is the key to use to store a cluster in the cluster map.
+type clusterKey string
 
-	// Memfs, if true, configures the database container to use an
-	// in-memory filesystem as opposed to persisting the database to disk.
-	Memfs bool
+func (id ClusterID) clusterKey() clusterKey {
+	return clusterKey(fmt.Sprintf("%s-%s", id.NS.ID, id.Type))
+}
+
+func GetClusterID(app *apps.Instance, typ ClusterType, ns *namespace.Namespace) ClusterID {
+	return ClusterID{ns, typ}
+}
 
-	// Reinit forces all databases to be reinitialized, even if they already exist.
-	Reinit bool
+// Ready reports whether the cluster manager is ready and all requirements are met.
+func (cm *ClusterManager) Ready() error {
+	return cm.driver.CheckRequirements(context.Background())
 }
 
-// Init initializes a database cluster but does not start it.
+// Create creates a database cluster but does not start it.
 // If the cluster already exists it is returned.
 // It does not perform any database migrations.
-func (cm *ClusterManager) Init(ctx context.Context, params *InitParams) *Cluster {
-	cid := params.ClusterID
+func (cm *ClusterManager) Create(ctx context.Context, params *CreateParams) *Cluster {
 	cm.mu.Lock()
 	defer cm.mu.Unlock()
-	c, ok := cm.clusters[cid]
+
+	c, ok := cm.get(params.ClusterID)
+	if ok {
+		if status, err := c.Status(ctx); err != nil || status.Status != Running {
+			// The cluster is no longer running; recreate it to clear our cached state.
+			c.cancel()
+			ok = false
+		}
+	}
+
 	if !ok {
 		ctx, cancel := context.WithCancel(context.Background())
+		key := params.ClusterID.clusterKey()
+		passwd := genPassword()
+		secretLoader := cm.secretMgr.Load(params.ClusterID.NS.App)
+
 		c = &Cluster{
-			ID:      params.ClusterID,
-			Memfs:   params.Memfs,
-			Ctx:     ctx,
-			cancel:  cancel,
-			started: make(chan struct{}),
-			log:     cm.log.With().Str("cluster", params.ClusterID).Logger(),
-			dbs:     make(map[string]*DB),
+			ID:       params.ClusterID,
+			Memfs:    params.Memfs,
+			Password: passwd,
+			Ctx:      ctx,
+			driver:   cm.driver,
+			cancel:   cancel,
+			started:  make(chan struct{}),
+			log:      cm.log.With().Interface("cluster", params.ClusterID).Logger(),
+			dbs:      make(map[string]*DB),
+			isExternal: func(name string) bool {
+				// Don't use external databases for Memfs clusters (tests/shadows).
+				if params.Memfs {
+					return false
+				}
+				secrets, err := secretLoader.Get(ctx, nil)
+				if err != nil {
+					c.log.Error().Err(err).Msg("failed to load secrets for external database check")
+					return false
+				}
+				_, ok := secrets.Values["sqldb::"+name]
+				return ok
+			},
 		}
-		cm.clusters[cid] = c
+
+		cm.clusters[key] = c
 	}
-	c.initDBs(params.Meta, params.Reinit)
+
 	return c
 }
 
+// LookupPassword looks up a cluster based on its password.
+func (cm *ClusterManager) LookupPassword(password string) (*Cluster, bool) {
+	cm.mu.Lock()
+	defer cm.mu.Unlock()
+
+	for _, c := range cm.clusters {
+		if c.Password == password {
+			return c, true
+		}
+	}
+	return nil, false
+}
+
 // Get retrieves the cluster keyed by id.
-func (cm *ClusterManager) Get(clusterID string) (*Cluster, bool) {
+func (cm *ClusterManager) Get(id ClusterID) (*Cluster, bool) {
 	cm.mu.Lock()
-	c, ok := cm.clusters[clusterID]
-	cm.mu.Unlock()
+	defer cm.mu.Unlock()
+	return cm.get(id)
+}
+
+// get retrieves the cluster keyed by id.
+// cm.mu must be held.
+func (cm *ClusterManager) get(id ClusterID) (*Cluster, bool) {
+	c, ok := cm.clusters[id.clusterKey()]
 	return c, ok
 }
 
-// Delete forcibly deletes the cluster.
-func (cm *ClusterManager) Delete(ctx context.Context, clusterID string) error {
-	cname := containerName(clusterID)
-	out, err := exec.CommandContext(ctx, "docker", "rm", "-f", cname).CombinedOutput()
-	if err != nil {
-		if bytes.Contains(out, []byte("No such container")) {
-			return nil
-		}
-		return fmt.Errorf("could not delete cluster: %s (%v)", out, err)
+// CanDeleteNamespace implements namespace.DeletionHandler.
+func (cm *ClusterManager) CanDeleteNamespace(ctx context.Context, app *apps.Instance, ns *namespace.Namespace) error {
+	c, ok := cm.Get(GetClusterID(app, Run, ns))
+	if !ok {
+		return nil
+	}
+
+	err := c.driver.CanDestroyCluster(ctx, c.ID)
+	if errors.Is(err, ErrUnsupported) {
+		err = nil
 	}
 	return nil
 }
 
-const dockerImage = "postgres:11-alpine"
+// DeleteNamespace implements namespace.DeletionHandler.
+func (cm *ClusterManager) DeleteNamespace(ctx context.Context, app *apps.Instance, ns *namespace.Namespace) error {
+	// Find all clusters matching this namespace.
+	// Use a closure for the lock to avoid holding it while we destroy the clusters.
+	var clusters []*Cluster
+	(func() {
+		cm.mu.Lock()
+		defer cm.mu.Unlock()
+		for _, c := range cm.clusters {
+			if c.ID.NS.ID == ns.ID {
+				clusters = append(clusters, c)
+			}
+		}
+	})()
+
+	// Destroy the clusters.
+	for _, c := range clusters {
+		if err := c.driver.DestroyCluster(ctx, c.ID); err != nil && !errors.Is(err, ErrUnsupported) {
+			return errors.Wrapf(err, "destroy cluster %s", c.ID)
+		}
+		c.cancel()
+	}
+
+	// If that succeeded, destroy the namespace data.
+	err := cm.driver.DestroyNamespaceData(ctx, ns)
+	if errors.Is(err, ErrUnsupported) {
+		err = nil
+	}
+	return err
+}
+
+func genPassword() string {
+	var data [8]byte
+	if _, err := rand.Read(data[:]); err != nil {
+		log.Fatal().Err(err).Msg("unable to generate random data")
+	}
+	return base64.RawURLEncoding.EncodeToString(data[:])
+}
diff --git a/cli/daemon/sqldb/migrate.go b/cli/daemon/sqldb/migrate.go
index 2610b1db40..f0fdad4050 100644
--- a/cli/daemon/sqldb/migrate.go
+++ b/cli/daemon/sqldb/migrate.go
@@ -2,71 +2,346 @@ package sqldb
 
 import (
 	"bytes"
+	"context"
+	"database/sql"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
+	"slices"
+	"strings"
 
-	meta "encr.dev/proto/encore/parser/meta/v1"
+	"github.com/cockroachdb/errors"
+	"github.com/golang-migrate/migrate/v4/database"
+	"github.com/golang-migrate/migrate/v4/database/postgres"
 	"github.com/golang-migrate/migrate/v4/source"
+	"github.com/hashicorp/go-multierror"
+	"github.com/lib/pq"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
 )
 
-type src struct {
-	appRoot    string
-	svcRelPath string
+// MigrationReader is an interface for reading migration files. It has two main
+// implementations: OsMigrationReader and ZipFSMigrationReader.
+type MigrationReader interface {
+	Read(*meta.DBMigration) (r io.ReadCloser, err error)
+}
+
+// The OsMigrationReader reads migrations from the local filesystem.
+func NewOsMigrationReader(path string) *OsMigrationReader {
+	return &OsMigrationReader{path: path}
+}
+
+type OsMigrationReader struct {
+	path string
+}
+
+func (src *OsMigrationReader) Read(m *meta.DBMigration) (r io.ReadCloser, err error) {
+	fpath := filepath.Join(src.path, m.Filename)
+	data, err := os.ReadFile(fpath)
+	if err != nil {
+		return nil, err
+	}
+	return io.NopCloser(bytes.NewReader(data)), nil
+}
+
+// MultiReadCloser is a helper wrapper which extends the io.MultiReader to also
+// close the underlying closeable readers. It's used by the MetadataSource to
+// append a statement to mark a migration as successful.
+func MultiReadCloser(r ...io.Reader) io.ReadCloser {
+	return &multiReadCloser{
+		readers:     r,
+		multiReader: io.MultiReader(r...),
+	}
+}
+
+type multiReadCloser struct {
+	readers     []io.Reader
+	multiReader io.Reader
+}
+
+func (m multiReadCloser) Read(p []byte) (n int, err error) {
+	return m.multiReader.Read(p)
+}
+
+func (m multiReadCloser) Close() error {
+	var errs []error
+	for _, r := range m.readers {
+		if c, ok := r.(io.Closer); !ok {
+			continue
+		} else if err := c.Close(); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	return errors.Join(errs...)
+}
+
+var _ io.ReadCloser = (*multiReadCloser)(nil)
+
+// NewMetadataSource creates a new MetadataSource instance.
+func NewMetadataSource(reader MigrationReader, migrations []*meta.DBMigration) *MetadataSource {
+	src := &MetadataSource{
+		MigrationReader: reader,
+		migrations:      migrations,
+	}
+	src.validate()
+	return src
+}
+
+func (src *MetadataSource) validate() {
+	if src.err != nil {
+		return
+	}
+	seen := make(map[uint64]struct{})
+	for _, m := range src.migrations {
+		if _, ok := seen[m.Number]; ok {
+			src.err = fmt.Errorf("duplicate migration identifier %q", m.Filename)
+			return
+		}
+		seen[m.Number] = struct{}{}
+	}
+}
+
+// MetadataSource is a source.Driver implementation that keeps a list of migrations retrieved from
+// the Encore metadata. It relies on a MigrationReader to read the migration files.
+type MetadataSource struct {
+	MigrationReader
 	migrations []*meta.DBMigration
+	err        error
+}
+
+func (src *MetadataSource) ReadUp(version uint) (r io.ReadCloser, identifier string, err error) {
+	m, err := src.migration(version, 0)
+	if err != nil {
+		return nil, "", err
+	}
+	r, err = src.Read(m)
+	if err != nil {
+		return nil, "", err
+	}
+	// This is used to make sure that a migration is marked successful in the
+	// same statement as it's run. Otherwise we may end up with a finished migration
+	// which is marked dirty because the SetVersion is run as a separate statement.
+	statement := fmt.Sprintf(
+		";\ninsert into schema_migrations (version, dirty) values (%d, false) ON CONFLICT (version) DO UPDATE SET dirty = false;",
+		version)
+	return MultiReadCloser(
+		r,
+		strings.NewReader(statement),
+	), m.Description, nil
 }
 
-func (src *src) Open(url string) (source.Driver, error) {
+func (src *MetadataSource) Open(url string) (source.Driver, error) {
 	return nil, fmt.Errorf("driver.Open is not implemented")
 }
 
-func (src *src) Close() error {
+func (src *MetadataSource) Close() error {
 	return nil
 }
 
-func (src *src) First() (version uint, err error) {
+func (src *MetadataSource) First() (version uint, err error) {
 	if len(src.migrations) == 0 {
 		return 0, os.ErrNotExist
 	}
 	return uint(src.migrations[0].Number), nil
 }
 
-func (src *src) Prev(version uint) (prevVersion uint, err error) {
-	idx := src.verIdx(version, -1)
-	if idx < 0 || idx >= len(src.migrations) {
-		return 0, os.ErrNotExist
+func (src *MetadataSource) Prev(version uint) (prevVersion uint, err error) {
+	m, err := src.migration(version, -1)
+	if err != nil {
+		return 0, err
 	}
-	return uint(src.migrations[idx].Number), nil
+	return uint(m.Number), nil
 }
 
-func (src *src) Next(version uint) (nextVersion uint, err error) {
-	idx := src.verIdx(version, +1)
-	if idx >= len(src.migrations) {
-		return 0, os.ErrNotExist
+func (src *MetadataSource) Next(version uint) (nextVersion uint, err error) {
+	m, err := src.migration(version, +1)
+	if err != nil {
+		return 0, err
 	}
-	return uint(src.migrations[idx].Number), nil
+	return uint(m.Number), nil
+}
+
+func (src *MetadataSource) ReadDown(version uint) (r io.ReadCloser, identifier string, err error) {
+	return nil, "", os.ErrNotExist
 }
 
-func (src *src) ReadUp(version uint) (r io.ReadCloser, identifier string, err error) {
-	idx := src.verIdx(version, 0)
+func (src *MetadataSource) migration(version uint, offset int) (*meta.DBMigration, error) {
+	if src.err != nil {
+		return nil, src.err
+	}
+	idx := slices.IndexFunc(src.migrations, func(m *meta.DBMigration) bool {
+		return m.Number == uint64(version)
+	})
+	if idx < 0 {
+		return nil, os.ErrNotExist
+	}
+	idx += offset
 	if idx < 0 || idx >= len(src.migrations) {
-		return nil, "", os.ErrNotExist
+		return nil, os.ErrNotExist
 	}
-	m := src.migrations[idx]
-	filepath := filepath.Join(src.appRoot, src.svcRelPath, "migrations", m.Filename)
-	data, err := os.ReadFile(filepath)
+	return src.migrations[idx], nil
+}
+
+type nonSequentialDbDriver struct {
+	*postgres.Postgres
+	source          *nonSequentialSource
+	schemaName      string
+	migrationsTable string
+	conn            *sql.Conn
+	appliedVersions map[uint64]bool
+}
+
+type nonSequentialSource struct {
+	*MetadataSource
+	dbDriver *nonSequentialDbDriver
+}
+
+// NonSequentialMigrator creates a new migrator that doesn't require migrations to be sequential.
+// It does this by keeping track of applied migrations in a table and using that to determine the
+// current version and which migrations need to be applied. It's effectively extending the logic of
+// the go-migrate library to support non-sequential migrations and is semi-compatible since it's using the
+// same underlying table.
+func NonSequentialMigrator(ctx context.Context, conn *sql.Conn, mdSource *MetadataSource) (database.Driver, source.Driver, error) {
+	src := &nonSequentialSource{
+		MetadataSource: mdSource,
+	}
+	db := &nonSequentialDbDriver{
+		conn:            conn,
+		migrationsTable: "schema_migrations",
+		source:          src,
+	}
+	src.dbDriver = db
+	query := `SELECT CURRENT_SCHEMA()`
+	if err := conn.QueryRowContext(ctx, query).Scan(&db.schemaName); err != nil {
+		return nil, nil, &database.Error{OrigErr: err, Query: []byte(query)}
+	}
+
+	if len(db.schemaName) == 0 {
+		return nil, nil, postgres.ErrNoSchema
+	}
+
+	p, err := postgres.WithConnection(ctx, conn, &postgres.Config{
+		MigrationsTable: db.migrationsTable,
+		SchemaName:      db.schemaName,
+	})
 	if err != nil {
-		return nil, "", err
+		return nil, nil, errors.Wrap(err, "failed to create migration instance")
+	}
+	db.Postgres = p
+	if err := db.loadAppliedVersions(); err != nil {
+		return nil, nil, errors.Wrap(err, "failed to load applied versions")
 	}
-	return ioutil.NopCloser(bytes.NewReader(data)), m.Description, nil
+	return db, src, nil
 }
 
-func (src *src) ReadDown(version uint) (r io.ReadCloser, identifier string, err error) {
-	return nil, "", os.ErrNotExist
+func (p *nonSequentialDbDriver) Version() (version int, dirty bool, err error) {
+	if len(p.appliedVersions) == 0 {
+		return database.NilVersion, false, nil
+	}
+	var ok bool
+	prevVersion := database.NilVersion
+	for _, mg := range p.source.migrations {
+		dirty, ok = p.appliedVersions[mg.Number]
+		if !ok {
+			return prevVersion, false, nil
+		} else if dirty {
+			return int(mg.Number), true, nil
+		}
+		prevVersion = int(mg.Number)
+	}
+	return prevVersion, false, nil
+}
+
+func (p *nonSequentialDbDriver) SetVersion(version int, dirty bool) error {
+	// In PSQL, all migrations are applied within the same statement/transaction.
+	// If the migration fails to apply, it is automatically rolled back.
+	// Therefore, we don't need to worry about marking a migration as dirty.
+	if dirty {
+		return nil
+	}
+	tx, err := p.conn.BeginTx(context.Background(), &sql.TxOptions{})
+	if err != nil {
+		return &database.Error{OrigErr: err, Err: "transaction start failed"}
+	}
+
+	if version >= 0 {
+		query := `INSERT INTO ` + pq.QuoteIdentifier(p.schemaName) + `.` + pq.QuoteIdentifier(p.migrationsTable) + ` (version, dirty) VALUES ($1, $2) ON CONFLICT (version) DO UPDATE SET dirty = $2`
+		if _, err := tx.Exec(query, version, dirty); err != nil {
+			if errRollback := tx.Rollback(); errRollback != nil {
+				err = multierror.Append(err, errRollback)
+			}
+			return &database.Error{OrigErr: err, Query: []byte(query)}
+		}
+	}
+
+	if err := tx.Commit(); err != nil {
+		return &database.Error{OrigErr: err, Err: "transaction commit failed"}
+	}
+
+	return nil
+}
+
+func LoadAppliedVersions(ctx context.Context, conn *sql.Conn, schemaName, migrationsTable string) (map[uint64]bool, error) {
+	appliedVersions := map[uint64]bool{}
+
+	query := `SELECT version, dirty FROM ` + pq.QuoteIdentifier(schemaName) + `.` + pq.QuoteIdentifier(migrationsTable) + ` ORDER BY version`
+	rows, err := conn.QueryContext(context.Background(), query)
+	if err != nil {
+		if e, ok := err.(*pq.Error); ok {
+			if e.Code.Name() == "undefined_table" {
+				return appliedVersions, nil
+			}
+		}
+		return nil, &database.Error{OrigErr: err, Query: []byte(query)}
+	}
+	defer rows.Close()
+	var version uint64
+	var dirty bool
+	for rows.Next() {
+		err := rows.Scan(&version, &dirty)
+		if err != nil {
+			return nil, &database.Error{OrigErr: err, Query: []byte(query)}
+		}
+		appliedVersions[version] = dirty
+	}
+	return appliedVersions, nil
+}
+
+func (p *nonSequentialDbDriver) loadAppliedVersions() error {
+	if p.appliedVersions != nil {
+		return nil
+	}
+	applied, err := LoadAppliedVersions(context.Background(), p.conn, p.schemaName, p.migrationsTable)
+	if err != nil {
+		return err
+	}
+	p.appliedVersions = applied
+	return nil
+}
+
+func (src *nonSequentialSource) Prev(version uint) (prevVersion uint, err error) {
+	m, err := src.migration(version, -1)
+	if err != nil {
+		return 0, err
+	}
+	// If the migration is applied, return this version
+	if _, ok := src.dbDriver.appliedVersions[m.Number]; ok {
+		return uint(m.Number), nil
+	}
+	// Otherwise skip to the previous version
+	return src.Prev(uint(m.Number))
 }
 
-func (src) verIdx(version uint, offset int) int {
-	return int(version) - 1 + offset
+func (src *nonSequentialSource) Next(version uint) (nextVersion uint, err error) {
+	m, err := src.migration(version, +1)
+	if err != nil {
+		return 0, err
+	}
+	// If the migration is applied, return the next version
+	if _, ok := src.dbDriver.appliedVersions[m.Number]; ok {
+		return src.Next(uint(m.Number))
+	}
+	// Otherwise, return this version
+	return uint(m.Number), nil
 }
diff --git a/cli/daemon/sqldb/proxy.go b/cli/daemon/sqldb/proxy.go
index 63d7116f1a..3c0d957308 100644
--- a/cli/daemon/sqldb/proxy.go
+++ b/cli/daemon/sqldb/proxy.go
@@ -2,14 +2,19 @@ package sqldb
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
 	"io"
 	"net"
+	"strings"
 	"time"
 
-	"encr.dev/pkg/pgproxy"
 	"github.com/jackc/pgproto3/v2"
 	"github.com/rs/zerolog/log"
+
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/pgproxy"
 )
 
 // ServeProxy serves the database proxy using the given listener.
@@ -46,140 +51,270 @@ func (cm *ClusterManager) ServeProxy(ln net.Listener) error {
 // database cluster and database.
 // If waitForSetup is true, it will wait for initial setup to complete
 // before proxying the connection.
-func (cm *ClusterManager) ProxyConn(frontend net.Conn, waitForSetup bool) error {
-	defer frontend.Close()
-	var proxy pgproxy.Proxy
-
-	data, err := proxy.FrontendAuth(frontend, nil, true)
+func (cm *ClusterManager) ProxyConn(client net.Conn, waitForSetup bool) error {
+	defer fns.CloseIgnore(client)
+	cl, err := pgproxy.SetupClient(client, &pgproxy.ClientConfig{
+		TLS:          nil,
+		WantPassword: true,
+	})
 	if err != nil {
 		return err
 	}
 
-	if cancel, ok := data.Startup.(*pgproxy.CancelRequest); ok {
-		cm.cancelRequest(frontend, cancel)
+	if cancel, ok := cl.Hello.(*pgproxy.CancelData); ok {
+		cm.cancelRequest(client, cancel)
 		return nil
 	}
+	startup := cl.Hello.(*pgproxy.StartupData)
 
-	clusterID := data.Password
-	cluster, ok := cm.Get(clusterID)
-	if !ok {
-		cm.log.Error().Str("cluster", clusterID).Msg("dbproxy: could not find cluster")
-		writeMsg(frontend, &pgproto3.ErrorResponse{
-			Severity: "FATAL",
-			Code:     "08006",
-			Message:  "database cluster not running",
-		})
-		return nil
-	}
+	// If the username is "encore" we're connecting to a database cluster
+	// which may not be local
+	var cluster *Cluster
+	if startup.Username == "encore" {
+		password := startup.Password
+		found, ok := cm.LookupPassword(password)
+		if !ok {
+			cm.log.Error().Msg("dbproxy: could not find cluster")
+			_ = cl.Backend.Send(&pgproto3.ErrorResponse{
+				Severity: "FATAL",
+				Code:     "08006",
+				Message:  "database cluster not found or invalid connection string",
+			})
+			return nil
+		}
+		cluster = found
+	} else {
+		// The username is the app slug we want to connect to
+		app, err := cm.apps.FindLatestByPlatformOrLocalID(startup.Username)
+		if err != nil {
+			cm.log.Error().Err(err).Msg("dbproxy: could not find app")
+			_ = cl.Backend.Send(&pgproto3.ErrorResponse{
+				Severity: "FATAL",
+				Code:     "08006",
+				Message:  "unknown app ID",
+			})
+			return nil
+		}
 
-	db, ok := cluster.GetDB(data.Database)
-	if !ok {
-		writeMsg(frontend, &pgproto3.ErrorResponse{
-			Severity: "FATAL",
-			Code:     "08006",
-			Message:  "database not found",
+		ctx := context.Background()
+
+		clusterType, nsID, ok := strings.Cut(startup.Password, "-")
+
+		// Look up the namespace to use.
+		var ns *namespace.Namespace
+		if !ok {
+			ns, err = cm.ns.GetActive(ctx, app)
+		} else {
+			ns, err = cm.ns.GetByID(ctx, app, namespace.ID(nsID))
+		}
+		if err != nil {
+			cm.log.Error().Err(err).Msg("dbproxy: could not find infra namespace")
+			_ = cl.Backend.Send(&pgproto3.ErrorResponse{
+				Severity: "FATAL",
+				Code:     "08006",
+				Message:  "unknown active infra namespace",
+			})
+			return nil
+		}
+
+		// Resolve the cluster type.
+		var ct ClusterType
+		switch clusterType {
+		case "local":
+			ct = Run
+		case "test":
+			ct = Test
+		case "shadow":
+			ct = Shadow
+		default:
+			cm.log.Error().Str("password", startup.Password).Msg("dbproxy: invalid password for connection URI")
+			_ = cl.Backend.Send(&pgproto3.ErrorResponse{
+				Severity: "FATAL",
+				Code:     "28P01", // 28P01 = invalid password
+				Message:  "if connecting with an app slug as the username, the only accepted passwords are 'local' or 'test' to route to those instances on your local system",
+			})
+			return nil
+		}
+
+		// Create the cluster if it doesn't exist in memory yet
+		// This might be because the daemon is running, but the hasn't done anything
+		// with the app in question yet on this run
+		cluster = cm.Create(context.Background(), &CreateParams{
+			ClusterID: GetClusterID(app, ct, ns),
+			Memfs:     ct.Memfs(),
 		})
-		return nil
+
+		// Ensure the cluster is started
+		_, err = cluster.Start(context.Background(), nil)
+		if err != nil {
+			cm.log.Error().Err(err).Msg("dbproxy: could not start cluster")
+			_ = cl.Backend.Send(&pgproto3.ErrorResponse{
+				Severity: "FATAL",
+				Code:     "08006",
+				Message:  "could not start database cluster",
+			})
+			return nil
+		}
 	}
 
-	var ready <-chan struct{}
-	if waitForSetup {
-		ready = db.Ready()
-	} else {
-		s := make(chan struct{})
-		close(s)
-		ready = s
+	// If Encore knows about the database, check if it's ready
+	// however if the cluster doesn't know about the database, skip this part.
+	//
+	// This is because either:
+	//   1. The database exists and is connected to
+	//   2. The database does not exist, and the remote server will return a "database doesn't exist" error.
+	dbname := startup.Database
+	db, ok := cluster.GetDB(dbname)
+	if ok {
+		var ready <-chan struct{}
+		if waitForSetup {
+			ready = db.Ready()
+		} else {
+			s := make(chan struct{})
+			close(s)
+			ready = s
+		}
+
+		// Wait for up to 60s for the cluster and database to come online.
+		select {
+		case <-db.Ctx.Done():
+			_ = cl.Backend.Send(&pgproto3.ErrorResponse{
+				Severity: "FATAL",
+				Code:     "08006",
+				Message:  "db is shutting down",
+			})
+			return nil
+		case <-time.After(60 * time.Second):
+			cm.log.Error().Str("db", db.ApplicationCloudName()).Msg("dbproxy: timed out waiting for database to come online")
+			_ = cl.Backend.Send(&pgproto3.ErrorResponse{
+				Severity: "FATAL",
+				Code:     "08006",
+				Message:  "timed out waiting for db to complete setup",
+			})
+			return nil
+
+		case <-ready:
+			// Continue connecting to backend, below
+		}
 	}
 
-	// Wait for up to 60s for the cluster and database to come online.
-	select {
-	case <-db.Ctx.Done():
-		writeMsg(frontend, &pgproto3.ErrorResponse{
+	info, err := cluster.Info(context.Background())
+	if err != nil {
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
 			Severity: "FATAL",
 			Code:     "08006",
-			Message:  "db is shutting down",
+			Message:  "cluster not running: " + err.Error(),
 		})
 		return nil
-	case <-time.After(60 * time.Second):
-		cm.log.Error().Str("db", data.Database).Msg("dbproxy: timed out waiting for database to come online")
-		writeMsg(frontend, &pgproto3.ErrorResponse{
+	}
+
+	server, err := net.Dial("tcp", info.Config.Host)
+	if err != nil {
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
 			Severity: "FATAL",
 			Code:     "08006",
-			Message:  "timed out waiting for db to complete setup",
+			Message:  "database not running: " + err.Error(),
 		})
 		return nil
-
-	case <-ready:
-		// Continue connecting to backend, below
 	}
+	defer fns.CloseIgnore(server)
 
-	backend, err := net.Dial("tcp", cluster.HostPort)
+	// Send a modified startup message to the backend
+	admin, _ := info.Encore.First(RoleAdmin, RoleSuperuser)
+	startup.Username = admin.Username
+	startup.Password = admin.Password
+	if db == nil {
+		// We don't know about this database, we'll use the requested name
+		// in case it does actually exist within the cluster.
+		//
+		// If it doesn't the cluster will return an SQL error to the client.
+		startup.Database = dbname
+	} else {
+		startup.Database = db.ApplicationCloudName()
+	}
+	fe, err := pgproxy.SetupServer(server, &pgproxy.ServerConfig{
+		TLS:     nil,
+		Startup: startup,
+	})
 	if err != nil {
-		writeMsg(frontend, &pgproto3.ErrorResponse{
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
 			Severity: "FATAL",
 			Code:     "08006",
-			Message:  "database not running: " + err.Error(),
+			Message:  "could not connect: " + err.Error(),
 		})
 		return nil
 	}
-	defer backend.Close()
+	log.Trace().Msg("backend connection established, notifying client")
+
+	if err := pgproxy.AuthenticateClient(cl.Backend); err != nil {
+		return err
+	}
 
-	data.Username = "encore"
-	data.Password = clusterID
-	beData, err := proxy.BackendAuth(backend, nil, data)
+	keyData, err := pgproxy.FinalizeInitialHandshake(cl.Backend, fe)
 	if err != nil {
-		writeMsg(frontend, &pgproto3.ErrorResponse{
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
 			Severity: "FATAL",
 			Code:     "08006",
-			Message:  "could not connect: " + err.Error(),
+			Message:  "could not establish connection: " + err.Error(),
 		})
 		return nil
 	}
+	log.Trace().Msg("connection handshake completed, proxying steady-state data")
 
 	// Store the key data so we know where to route cancellation requests.
-	if key := beData.KeyData; key != nil {
+	if keyData != nil {
 		cm.mu.Lock()
-		cm.backendKeyData[key.SecretKey] = cluster
+		cm.backendKeyData[keyData.SecretKey] = cluster
 		cm.mu.Unlock()
 		defer func() {
 			cm.mu.Lock()
-			delete(cm.backendKeyData, key.SecretKey)
+			delete(cm.backendKeyData, keyData.SecretKey)
 			cm.mu.Unlock()
 		}()
 	}
 
-	return proxy.Data(db.Ctx)
+	return pgproxy.CopySteadyState(cl.Backend, fe)
 }
 
 // PreauthProxyConn is a pre-authenticated proxy conn directly specifically to the given cluster.
-func (cm *ClusterManager) PreauthProxyConn(frontend net.Conn, clusterID string) error {
-	defer frontend.Close()
-	var proxy pgproxy.Proxy
-
-	data, err := proxy.FrontendAuth(frontend, nil, false)
+func (cm *ClusterManager) PreauthProxyConn(client net.Conn, id ClusterID) error {
+	defer fns.CloseIgnore(client)
+	cl, err := pgproxy.SetupClient(client, &pgproxy.ClientConfig{
+		TLS: &tls.Config{MinVersion: tls.VersionTLS12},
+	})
 	if err != nil {
+		log.Error().Err(err).Msg("failed to setup client")
 		return err
 	}
 
-	if cancel, ok := data.Startup.(*pgproxy.CancelRequest); ok {
-		cm.cancelRequest(frontend, cancel)
+	if cancel, ok := cl.Hello.(*pgproxy.CancelData); ok {
+		cm.cancelRequest(client, cancel)
 		return nil
 	}
+	startup := cl.Hello.(*pgproxy.StartupData)
 
-	cluster, ok := cm.Get(clusterID)
+	cluster, ok := cm.Get(id)
 	if !ok {
-		cm.log.Error().Str("cluster", clusterID).Msg("dbproxy: could not find cluster")
-		writeMsg(frontend, &pgproto3.ErrorResponse{
+		cm.log.Error().Interface("cluster", id).Msg("dbproxy: could not find cluster")
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
 			Severity: "FATAL",
 			Code:     "08006",
 			Message:  "database cluster not running",
 		})
 		return nil
 	}
-
-	db, ok := cluster.GetDB(data.Database)
+	if cluster.IsExternalDB(startup.Database) {
+		cm.log.Error().Str("db", startup.Database).Msg("dbproxy: cannot proxy external database")
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
+			Severity: "FATAL",
+			Code:     "08006",
+			Message:  "proxy to external databases is disabled",
+		})
+		return nil
+	}
+	db, ok := cluster.GetDB(startup.Database)
 	if !ok {
-		writeMsg(frontend, &pgproto3.ErrorResponse{
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
 			Severity: "FATAL",
 			Code:     "08006",
 			Message:  "database not found",
@@ -190,15 +325,15 @@ func (cm *ClusterManager) PreauthProxyConn(frontend net.Conn, clusterID string)
 	// Wait for up to 60s for the cluster to come online.
 	select {
 	case <-db.Ctx.Done():
-		writeMsg(frontend, &pgproto3.ErrorResponse{
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
 			Severity: "FATAL",
 			Code:     "08006",
 			Message:  "db is shutting down",
 		})
 		return nil
 	case <-time.After(60 * time.Second):
-		cm.log.Error().Str("db", data.Database).Msg("dbproxy: timed out waiting for database to come online")
-		writeMsg(frontend, &pgproto3.ErrorResponse{
+		cm.log.Error().Str("db", startup.Database).Msg("dbproxy: timed out waiting for database to come online")
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
 			Severity: "FATAL",
 			Code:     "08006",
 			Message:  "timed out waiting for db to complete setup",
@@ -209,22 +344,37 @@ func (cm *ClusterManager) PreauthProxyConn(frontend net.Conn, clusterID string)
 		// Continue connecting to backend, below
 	}
 
-	backend, err := net.Dial("tcp", cluster.HostPort)
+	info, err := cluster.Info(context.Background())
 	if err != nil {
-		writeMsg(frontend, &pgproto3.ErrorResponse{
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
+			Severity: "FATAL",
+			Code:     "08006",
+			Message:  "cluster not running: " + err.Error(),
+		})
+		return nil
+	}
+
+	server, err := net.Dial("tcp", info.Config.Host)
+	if err != nil {
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
 			Severity: "FATAL",
 			Code:     "08006",
 			Message:  "database not running: " + err.Error(),
 		})
 		return nil
 	}
-	defer backend.Close()
+	defer fns.CloseIgnore(server)
 
-	data.Username = "encore"
-	data.Password = clusterID
-	beData, err := proxy.BackendAuth(backend, nil, data)
+	admin, _ := info.Encore.First(RoleAdmin, RoleSuperuser)
+	startup.Username = admin.Username
+	startup.Password = admin.Password
+	startup.Database = db.ApplicationCloudName()
+	fe, err := pgproxy.SetupServer(server, &pgproxy.ServerConfig{
+		TLS:     nil,
+		Startup: startup,
+	})
 	if err != nil {
-		writeMsg(frontend, &pgproto3.ErrorResponse{
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
 			Severity: "FATAL",
 			Code:     "08006",
 			Message:  "could not connect: " + err.Error(),
@@ -232,44 +382,77 @@ func (cm *ClusterManager) PreauthProxyConn(frontend net.Conn, clusterID string)
 		return nil
 	}
 
+	if err := pgproxy.AuthenticateClient(cl.Backend); err != nil {
+		return err
+	}
+
+	keyData, err := pgproxy.FinalizeInitialHandshake(cl.Backend, fe)
+	if err != nil {
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
+			Severity: "FATAL",
+			Code:     "08006",
+			Message:  "could not establish connection: " + err.Error(),
+		})
+		return nil
+	}
+
 	// Store the key data so we know where to route cancellation requests.
-	if key := beData.KeyData; key != nil {
+	if keyData != nil {
 		cm.mu.Lock()
-		cm.backendKeyData[key.SecretKey] = cluster
+		cm.backendKeyData[keyData.SecretKey] = cluster
 		cm.mu.Unlock()
 		defer func() {
 			cm.mu.Lock()
-			delete(cm.backendKeyData, key.SecretKey)
+			delete(cm.backendKeyData, keyData.SecretKey)
 			cm.mu.Unlock()
 		}()
 	}
 
-	return proxy.Data(db.Ctx)
+	log.Trace().Msg("successfully completed handshake, copying data back and forth")
+	return pgproxy.CopySteadyState(cl.Backend, fe)
 }
 
 // cancelRequest handles a cancel request.
-func (cm *ClusterManager) cancelRequest(frontend io.ReadWriter, req *pgproxy.CancelRequest) {
+func (cm *ClusterManager) cancelRequest(client io.Writer, req *pgproxy.CancelData) {
 	cm.mu.Lock()
-	cluster, ok := cm.backendKeyData[req.SecretKey]
+	cluster, ok := cm.backendKeyData[req.Raw.SecretKey]
 	cm.mu.Unlock()
 	if !ok {
 		return
 	}
 
-	backend, err := net.Dial("tcp", cluster.HostPort)
+	info, err := cluster.Info(context.Background())
 	if err != nil {
-		writeMsg(frontend, &pgproto3.ErrorResponse{
+		msg := &pgproto3.ErrorResponse{
 			Severity: "FATAL",
 			Code:     "08006",
 			Message:  "database cluster not running",
-		})
+		}
+		encode, _ := msg.Encode(nil)
+		_, _ = client.Write(encode)
 		return
 	}
-	writeMsg(backend, req)
-	backend.Close()
+
+	backend, err := net.Dial("tcp", info.Config.Host)
+	if err != nil {
+		msg := &pgproto3.ErrorResponse{
+			Severity: "FATAL",
+			Code:     "08006",
+			Message:  "database cluster not running",
+		}
+		encode, _ := msg.Encode(nil)
+		_, _ = client.Write(encode)
+		return
+	}
+	defer fns.CloseIgnore(backend)
+	_ = pgproxy.SendCancelRequest(backend, req.Raw)
 }
 
 func writeMsg(w io.Writer, msg pgproto3.Message) error {
-	_, err := w.Write(msg.Encode(nil))
+	encode, err := msg.Encode(nil)
+	if err != nil {
+		return err
+	}
+	_, err = w.Write(encode)
 	return err
 }
diff --git a/cli/daemon/sqldb/remote.go b/cli/daemon/sqldb/remote.go
index f416946766..7f6181b692 100644
--- a/cli/daemon/sqldb/remote.go
+++ b/cli/daemon/sqldb/remote.go
@@ -4,21 +4,22 @@ import (
 	"context"
 	"crypto/rand"
 	"encoding/base64"
+	"errors"
 	"fmt"
 	"net"
 	"time"
 
-	"encr.dev/pkg/pgproxy"
-	"encr.dev/proto/encore/server/remote"
-	"github.com/jackc/pgproto3/v2"
+	"github.com/gorilla/websocket"
 	"github.com/rs/zerolog/log"
-	"google.golang.org/grpc/metadata"
+
+	"encr.dev/cli/internal/platform"
+	"encr.dev/pkg/pgproxy"
 )
 
 // OneshotProxy listens on a random port for a single connection, and proxies that connection to a remote db.
 // It reports the one-time password and port to use.
 // Once a connection has been established, it stops listening.
-func OneshotProxy(rc remote.RemoteClient, appSlug, envSlug string) (port int, passwd string, err error) {
+func OneshotProxy(appSlug, envSlug string, role RoleType) (port int, passwd string, err error) {
 	ln, err := net.Listen("tcp", "localhost:0")
 	if err != nil {
 		return 0, "", err
@@ -29,147 +30,93 @@ func OneshotProxy(rc remote.RemoteClient, appSlug, envSlug string) (port int, pa
 	}
 	passwd = base64.RawURLEncoding.EncodeToString(passwdBytes[:])
 
-	go oneshotServer(context.Background(), rc, ln, passwd, appSlug, envSlug)
+	go oneshotServer(context.Background(), ln, passwd, appSlug, envSlug, role)
 	return ln.Addr().(*net.TCPAddr).Port, passwd, nil
 }
 
-func oneshotServer(ctx context.Context, rc remote.RemoteClient, ln net.Listener, passwd, appSlug, envSlug string) error {
-	defer ln.Close()
-
-	gotMainConn := make(chan struct{}) // closed when accepted
-	go func() {
-		// Wait for the first conn at most 60s before giving up
-		select {
-		case <-gotMainConn:
-		case <-time.After(60 * time.Second):
-			ln.Close()
-		case <-ctx.Done():
-			ln.Close()
-		}
-	}()
-
-	var tempDelay time.Duration // how long to sleep on accept failure
-	first := true
-	for {
-		frontend, e := ln.Accept()
-		if e != nil {
-			if ne, ok := e.(net.Error); ok && ne.Temporary() {
-				if tempDelay == 0 {
-					tempDelay = 5 * time.Millisecond
-				} else {
-					tempDelay *= 2
-				}
-				if max := 1 * time.Second; tempDelay > max {
-					tempDelay = max
+func oneshotServer(ctx context.Context, ln net.Listener, passwd, appSlug, envSlug string, role RoleType) error {
+	proxy := &pgproxy.SingleBackendProxy{
+		RequirePassword: passwd != "",
+		FrontendTLS:     nil,
+		DialBackend: func(ctx context.Context, startup *pgproxy.StartupData) (pgproxy.LogicalConn, error) {
+			if startup.Password != passwd {
+				return nil, fmt.Errorf("bad password")
+			}
+			startupData, err := startup.Raw.Encode(nil)
+			if err != nil {
+				return nil, err
+			}
+			ws, err := platform.DBConnect(ctx, appSlug, envSlug, startup.Database, role.String(), startupData)
+			if err != nil {
+				var e platform.Error
+				if errors.As(err, &e) && e.HTTPCode == 404 {
+					return nil, pgproxy.DatabaseNotFoundError{Database: startup.Database}
 				}
-				log.Printf("sqldb: accept error: %v; retrying in %v", e, tempDelay)
-				time.Sleep(tempDelay)
-				continue
+				return nil, err
 			}
-			return fmt.Errorf("sqldb: could not accept: %v", e)
-		}
-
-		tempDelay = 0
-
-		if first {
-			// If this is the first connection, treat it as the main connection
-			// and close the listener when it exits.
-			first = false
-			close(gotMainConn)
-			go ProxyRemoteConn(ctx, rc, frontend, passwd, appSlug, envSlug)
-		} else {
-			go ProxyRemoteConn(ctx, rc, frontend, passwd, appSlug, envSlug)
-		}
-	}
-}
-
-// ProxyRemoteConn proxies a frontend to the remote database pointed at by appSlug and envSlug.
-// The passwd is what we expect the frontend to provide to authenticate the connection.
-func ProxyRemoteConn(ctx context.Context, rc remote.RemoteClient, frontend net.Conn, passwd, appSlug, envSlug string) {
-	defer frontend.Close()
-	var proxy pgproxy.Proxy
-	data, err := proxy.FrontendAuth(frontend, nil, passwd != "")
-	if err != nil {
-		log.Printf("sqldb: proxy handshake error: %v", err)
-		return
-	}
-
-	// If we are setting up a real connection (as opposed to issuing a cancel request, which
-	// does not use password based auth), make sure the password matches.
-	if _, ok := data.Startup.(*pgproxy.StartupMessage); ok && data.Password != passwd {
-		writeMsg(frontend, &pgproto3.ErrorResponse{
-			Severity: "FATAL",
-			Code:     "08006",
-			Message:  "invalid password",
-		})
-		return
+			conn := &WebsocketLogicalConn{Conn: ws}
+			return conn, nil
+		},
 	}
 
-	ctx = metadata.AppendToOutgoingContext(ctx, "appSlug", appSlug, "envSlug", envSlug)
-	ctx, cancel := context.WithCancel(ctx)
-	defer cancel()
-	stream, err := rc.DBConnect(ctx)
-	if err != nil {
-		log.Printf("sqldb: proxy: could not connect to remote db: %v", err)
-		return
-	}
-
-	sw := dbConnectWriter{stream: stream}
-	sr := dbConnectReader{stream: stream}
-	backend := &struct {
-		dbConnectWriter
-		dbConnectReader
-	}{sw, sr}
-
-	data.Username = "encore"
-	data.Password = ""
-	if _, err := proxy.BackendAuth(backend, nil, data); err != nil {
-		log.Printf("sqldb: proxy: could not connect to remote db: %v", err)
-		writeMsg(frontend, &pgproto3.ErrorResponse{
-			Severity: "FATAL",
-			Code:     "08006",
-			Message:  "could not connect to remote db: " + err.Error(),
-		})
-		return
-	}
-
-	proxy.Data(ctx)
+	return proxy.Serve(ctx, ln)
 }
 
-type dbConnectWriter struct {
-	stream remote.Remote_DBConnectClient
+type WebsocketLogicalConn struct {
+	*websocket.Conn
+	buf []byte
 }
 
-func (w *dbConnectWriter) Write(p []byte) (int, error) {
-	err := w.stream.Send(&remote.Data{Data: p})
+var _ pgproxy.LogicalConn = (*WebsocketLogicalConn)(nil)
+
+func (c *WebsocketLogicalConn) Write(p []byte) (int, error) {
+	err := c.Conn.WriteMessage(websocket.BinaryMessage, p)
 	if err != nil {
 		return 0, err
 	}
 	return len(p), nil
 }
 
-type dbConnectReader struct {
-	stream remote.Remote_DBConnectClient
-	buf    []byte
-}
-
-func (r *dbConnectReader) Read(p []byte) (int, error) {
+func (c *WebsocketLogicalConn) Read(p []byte) (int, error) {
 	// If we have remaining data from the previous message we received
 	// from the stream, simply return that.
-	if len(r.buf) > 0 {
-		n := copy(p, r.buf)
-		r.buf = r.buf[n:]
+	if len(c.buf) > 0 {
+		n := copy(p, c.buf)
+		c.buf = c.buf[n:]
 		return n, nil
 	}
 
 	// No more buffered data, wait for a new message from the stream.
-	msg, err := r.stream.Recv()
+	for {
+		typ, data, err := c.Conn.ReadMessage()
+		if err != nil {
+			return 0, err
+		} else if typ != websocket.BinaryMessage {
+			continue
+		}
+
+		// Read as much data as possible directly to the waiting caller.
+		// Anything remaining beyond that gets buffered until the next Read call.
+		n := copy(p, data)
+		c.buf = data[n:]
+		return n, nil
+	}
+}
+
+func (c *WebsocketLogicalConn) Cancel(req *pgproxy.CancelData) error {
+	enc := base64.StdEncoding
+	data, err := req.Raw.Encode(nil)
 	if err != nil {
-		return 0, err
+		return err
 	}
-	// Read as much data as possible directly to the waiting caller.
-	// Anything remaining beyond that gets buffered until the next Read call.
-	n := copy(p, msg.Data)
-	r.buf = msg.Data[n:]
-	return n, nil
+	encoded := make([]byte, enc.EncodedLen(len(data)))
+	enc.Encode(encoded, data)
+	log.Info().Msgf("sending cancel request %x", data)
+	return c.Conn.WriteMessage(websocket.TextMessage, encoded)
+}
+
+func (c *WebsocketLogicalConn) SetDeadline(t time.Time) error {
+	_ = c.Conn.SetReadDeadline(t)
+	err := c.Conn.SetWriteDeadline(t)
+	return err
 }
diff --git a/cli/daemon/sqldb/utils.go b/cli/daemon/sqldb/utils.go
new file mode 100644
index 0000000000..331f63de87
--- /dev/null
+++ b/cli/daemon/sqldb/utils.go
@@ -0,0 +1,38 @@
+package sqldb
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+// WaitForConn waits for a successful connection to uri to be established.
+func WaitForConn(ctx context.Context, uri string) error {
+	var err error
+	for i := 0; i < 40; i++ {
+		var conn *pgx.Conn
+		conn, err = pgx.Connect(ctx, uri)
+		if err == nil {
+			err = conn.Ping(ctx)
+			_ = conn.Close(ctx)
+			if err == nil {
+				return nil
+			}
+		} else if ctx.Err() != nil {
+			// We'll never succeed once the context has been canceled.
+			// Give up straight away.
+			break
+		}
+		time.Sleep(250 * time.Millisecond)
+	}
+	return fmt.Errorf("database did not come up: %v", err)
+}
+
+// IsUsed reports whether the application uses SQL databases at all.
+func IsUsed(md *meta.Data) bool {
+	return len(md.SqlDatabases) > 0
+}
diff --git a/cli/daemon/telemetry.go b/cli/daemon/telemetry.go
new file mode 100644
index 0000000000..8b18134a0c
--- /dev/null
+++ b/cli/daemon/telemetry.go
@@ -0,0 +1,15 @@
+package daemon
+
+import (
+	"context"
+
+	"google.golang.org/protobuf/types/known/emptypb"
+
+	"encr.dev/cli/internal/telemetry"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+func (s *Server) Telemetry(ctx context.Context, req *daemonpb.TelemetryConfig) (*emptypb.Empty, error) {
+	telemetry.UpdateConfig(req.AnonId, req.Enabled, req.Debug)
+	return new(emptypb.Empty), nil
+}
diff --git a/cli/daemon/test.go b/cli/daemon/test.go
new file mode 100644
index 0000000000..628cfa6abd
--- /dev/null
+++ b/cli/daemon/test.go
@@ -0,0 +1,152 @@
+package daemon
+
+import (
+	"context"
+	"fmt"
+	"runtime/debug"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog/log"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"encr.dev/cli/daemon/run"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/fns"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+// Test runs tests.
+func (s *Server) Test(req *daemonpb.TestRequest, stream daemonpb.Daemon_TestServer) error {
+	ctx := stream.Context()
+	slog := &streamLog{stream: stream, buffered: false}
+	stderr := slog.Stderr(false)
+	sendErr := func(err error) {
+		stderr.Write([]byte(err.Error() + "\n"))
+		streamExit(stream, 1)
+	}
+
+	ctx, tracer, err := s.beginTracing(ctx, req.AppRoot, req.WorkingDir, req.TraceFile)
+	if err != nil {
+		sendErr(err)
+		return nil
+	}
+	defer tracer.Close()
+
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		sendErr(err)
+		return nil
+	}
+
+	ns, err := s.namespaceOrActive(ctx, app, nil /* tests don't support different namespaces */)
+	if err != nil {
+		sendErr(err)
+		return nil
+	}
+
+	secrets := s.sm.Load(app)
+
+	testCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+
+	testResults := make(chan error, 1)
+	go func() {
+		defer func() {
+			if recovered := recover(); recovered != nil {
+				var err error
+				switch recovered := recovered.(type) {
+				case error:
+					err = recovered
+				default:
+					err = fmt.Errorf("%+v", recovered)
+				}
+				stack := debug.Stack()
+				log.Err(err).Msgf("panic during test run:\n%s", stack)
+				testResults <- fmt.Errorf("panic occured within Encore during test run: %v\n%s\n", recovered, stack)
+			}
+		}()
+
+		testEnv := append([]string{"ENCORE_RUNTIME_LOG=error"}, req.Environ...)
+
+		tp := run.TestParams{
+			TestSpecParams: &run.TestSpecParams{
+				App:          app,
+				NS:           ns,
+				WorkingDir:   req.WorkingDir,
+				Environ:      testEnv,
+				Args:         req.Args,
+				Secrets:      secrets,
+				CodegenDebug: req.CodegenDebug,
+			},
+			Stdout: slog.Stdout(false),
+			Stderr: slog.Stderr(false),
+		}
+		testResults <- s.mgr.Test(testCtx, tp)
+	}()
+
+	if err := <-testResults; err != nil {
+		sendErr(err)
+	} else {
+		streamExit(stream, 0)
+	}
+	return nil
+}
+
+// TestSpec runs tests.
+func (s *Server) TestSpec(ctx context.Context, req *daemonpb.TestSpecRequest) (resp *daemonpb.TestSpecResponse, err error) {
+	ctx, tracer, err := s.beginTracing(ctx, req.AppRoot, req.WorkingDir, nil)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to begin tracing")
+	}
+	defer fns.CloseIgnore(tracer)
+
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to track app")
+	}
+
+	ns, err := s.namespaceOrActive(ctx, app, nil /* tests don't support different namespaces */)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to get namespace")
+	}
+
+	secrets := s.sm.Load(app)
+
+	defer func() {
+		if recovered := recover(); recovered != nil {
+			var panicErr error
+			switch recovered := recovered.(type) {
+			case error:
+				panicErr = recovered
+			default:
+				panicErr = fmt.Errorf("%+v", recovered)
+			}
+			stack := debug.Stack()
+			log.Err(panicErr).Msgf("panic during test run:\n%s", stack)
+			err = fmt.Errorf("panic during test run: %v", panicErr)
+		}
+	}()
+
+	testEnv := append([]string{"ENCORE_RUNTIME_LOG=error"}, req.Environ...)
+
+	spec, err := s.mgr.TestSpec(ctx, run.TestSpecParams{
+		App:        app,
+		NS:         ns,
+		WorkingDir: req.WorkingDir,
+		Environ:    testEnv,
+		Args:       req.Args,
+		Secrets:    secrets,
+	})
+	if errors.Is(err, builder.ErrNoTests) {
+		return nil, status.Error(codes.NotFound, "no tests defined")
+	} else if err != nil {
+		return nil, err
+	}
+
+	return &daemonpb.TestSpecResponse{
+		Command: spec.Command,
+		Args:    spec.Args,
+		Environ: spec.Environ,
+	}, nil
+}
diff --git a/cli/daemon/tracing.go b/cli/daemon/tracing.go
new file mode 100644
index 0000000000..6fd1334a3c
--- /dev/null
+++ b/cli/daemon/tracing.go
@@ -0,0 +1,22 @@
+package daemon
+
+import (
+	"context"
+	"path/filepath"
+
+	"encr.dev/internal/etrace"
+)
+
+func (s *Server) beginTracing(ctx context.Context, appRoot, workingDir string, traceFile *string) (context.Context, *etrace.Tracer, error) {
+	if traceFile == nil {
+		return ctx, nil, nil
+	}
+
+	var dst string
+	if filepath.IsAbs(*traceFile) {
+		dst = *traceFile
+	} else {
+		dst = filepath.Join(appRoot, workingDir, *traceFile)
+	}
+	return etrace.WithFileTracer(ctx, dst)
+}
diff --git a/cli/daemon/userfacing.go b/cli/daemon/userfacing.go
new file mode 100644
index 0000000000..35ca67d6b3
--- /dev/null
+++ b/cli/daemon/userfacing.go
@@ -0,0 +1,78 @@
+package daemon
+
+import (
+	"context"
+	"runtime"
+
+	"github.com/cockroachdb/errors"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/builder/builderimpl"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/vcs"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+// GenWrappers generates Encore wrappers.
+func (s *Server) GenWrappers(ctx context.Context, req *daemonpb.GenWrappersRequest) (*daemonpb.GenWrappersResponse, error) {
+	app, err := s.apps.Track(req.AppRoot)
+	if err != nil {
+		return nil, errors.Wrap(err, "resolve app")
+	}
+	if err := s.genUserFacing(ctx, app); err != nil {
+		return nil, err
+	}
+	return &daemonpb.GenWrappersResponse{}, nil
+}
+
+// genUserFacing generates user-facing wrappers.
+func (s *Server) genUserFacing(ctx context.Context, app *apps.Instance) error {
+	expSet, err := app.Experiments(nil)
+	if err != nil {
+		return errors.Wrap(err, "resolve experiments")
+	}
+
+	vcsRevision := vcs.GetRevision(app.Root())
+	buildInfo := builder.BuildInfo{
+		BuildTags:          builder.LocalBuildTags,
+		CgoEnabled:         true,
+		StaticLink:         false,
+		DebugMode:          builder.DebugModeDisabled,
+		Environ:            nil,
+		GOOS:               runtime.GOOS,
+		GOARCH:             runtime.GOARCH,
+		KeepOutput:         false,
+		Revision:           vcsRevision.Revision,
+		UncommittedChanges: vcsRevision.Uncommitted,
+
+		// Use the local JS runtime if this is a development build.
+		UseLocalJSRuntime: version.Channel == version.DevBuild,
+	}
+
+	bld := builderimpl.Resolve(app.Lang(), expSet)
+	defer fns.CloseIgnore(bld)
+
+	parse, err := bld.Parse(ctx, builder.ParseParams{
+		Build:       buildInfo,
+		App:         app,
+		Experiments: expSet,
+		WorkingDir:  ".",
+		ParseTests:  false,
+	})
+	if err != nil {
+		return errors.Wrap(err, "parse app")
+	}
+
+	if err := app.CacheMetadata(parse.Meta); err != nil {
+		return errors.Wrap(err, "cache metadata")
+	}
+
+	err = bld.GenUserFacing(ctx, builder.GenUserFacingParams{
+		Build: buildInfo,
+		App:   app,
+		Parse: parse,
+	})
+	return errors.Wrap(err, "generate wrappers")
+}
diff --git a/cli/daemon/watch.go b/cli/daemon/watch.go
new file mode 100644
index 0000000000..6f644f5da8
--- /dev/null
+++ b/cli/daemon/watch.go
@@ -0,0 +1,143 @@
+package daemon
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"github.com/bep/debounce"
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/run"
+	"encr.dev/pkg/watcher"
+	"encr.dev/pkg/xos"
+)
+
+func (s *Server) watchApps() {
+	if os.Getenv("ENCORE_DAEMON_WATCH") == "0" {
+		return
+	}
+	s.apps.RegisterAppListener(func(i *apps.Instance) {
+		s.regenerateUserCode(context.Background(), i)
+		if err := s.updateGitIgnore(i); err != nil {
+			log.Error().Err(err).Msg("unable to update app gitignore")
+		}
+	})
+	if err := s.apps.WatchAll(s.onWatchEvent); err != nil {
+		log.Error().Err(err).Msg("unable to set up app watchers")
+	} else {
+		log.Info().Msg("successfully set up file watchers")
+	}
+}
+
+func (s *Server) onWatchEvent(i *apps.Instance, events []watcher.Event) {
+	if run.IgnoreEvents(events) {
+		return
+	}
+
+	// Use debounce to avoid calling this on every single change.
+	s.appDebounceMu.Lock()
+	deb := s.appDebouncers[i]
+	if deb == nil {
+		deb = &regenerateCodeDebouncer{
+			debounce: debounce.New(100 * time.Millisecond),
+			doRun:    func() { s.regenerateUserCode(context.Background(), i) },
+		}
+		s.appDebouncers[i] = deb
+	}
+	s.appDebounceMu.Unlock()
+
+	deb.ChangeEvent()
+}
+
+type regenerateCodeDebouncer struct {
+	debounce func(func())
+	mu       sync.Mutex
+	running  bool
+	runAfter bool
+
+	doRun func()
+}
+
+func (g *regenerateCodeDebouncer) ChangeEvent() {
+	g.debounce(func() {
+		g.mu.Lock()
+
+		// If we're already running, mark to run again when complete.
+		if g.running {
+			g.runAfter = true
+			g.mu.Unlock()
+			return
+		}
+
+		// Otherwise, keep re-running for as long as change events come in.
+		g.running = true
+		g.runAfter = true // to start us off, at least once.
+		for g.runAfter {
+			g.runAfter = false // reset for next time
+			g.mu.Unlock()
+			g.doRun() // actually run
+			g.mu.Lock()
+		}
+
+		// If we get here g.runAfter nobody requested another run, so we can stop.
+		g.running = false
+
+		g.mu.Unlock()
+	})
+}
+
+func (s *Server) regenerateUserCode(ctx context.Context, app *apps.Instance) {
+	if err := s.genUserFacing(ctx, app); err != nil {
+		log.Error().Err(err).Str("app", app.PlatformOrLocalID()).Msg("failed to regenerate app")
+	} else {
+		log.Info().Str("app", app.PlatformOrLocalID()).Msg("successfully generated user code")
+	}
+}
+
+// updateGitIgnore updates the gitignore file to include Encore directives, if needed.
+func (s *Server) updateGitIgnore(i *apps.Instance) error {
+	dst := filepath.Join(i.Root(), ".gitignore")
+	data, err := os.ReadFile(dst)
+	if err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return errors.Wrap(err, "read .gitignore")
+	}
+
+	// Find which directives are already present
+	directives := []string{"encore.gen.go", "encore.gen.cue", "/.encore", "/encore.gen"}
+	found := make([]bool, len(directives))
+	scanner := bufio.NewScanner(bytes.NewReader(data))
+	for scanner.Scan() {
+		ln := scanner.Text()
+		for i, directive := range directives {
+			if ln == directive {
+				found[i] = true
+			}
+		}
+	}
+
+	// Add the ones that are missing
+	updated := false
+	for i, directive := range directives {
+		if !found[i] {
+			if len(data) > 0 && !bytes.HasSuffix(data, []byte("\n")) {
+				data = append(data, '\n')
+			}
+			data = append(data, directive+"\n"...)
+			updated = true
+		}
+	}
+
+	// Write the file back if there were any changes
+	if updated {
+		return xos.WriteFile(dst, data, 0644)
+	}
+	return nil
+}
diff --git a/cli/internal/browser/browser.go b/cli/internal/browser/browser.go
index 576e936e67..2091a690c8 100644
--- a/cli/internal/browser/browser.go
+++ b/cli/internal/browser/browser.go
@@ -42,6 +42,17 @@ func Commands() [][]string {
 	return cmds
 }
 
+// CanOpen reports whether it's likely that Open will succeed.
+func CanOpen() bool {
+	cmds := Commands()
+	for _, cmd := range cmds {
+		if _, err := exec.LookPath(cmd[0]); err == nil {
+			return true
+		}
+	}
+	return false
+}
+
 // Open tries to open url in a browser and reports whether it succeeded.
 func Open(url string) bool {
 	for _, args := range Commands() {
diff --git a/cli/internal/bubbles/checklist/checklist.go b/cli/internal/bubbles/checklist/checklist.go
new file mode 100644
index 0000000000..6035a7816b
--- /dev/null
+++ b/cli/internal/bubbles/checklist/checklist.go
@@ -0,0 +1,288 @@
+package checklist
+
+import (
+	"strconv"
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/mattn/go-runewidth"
+)
+
+type Item interface {
+	Render(selected, checked bool) string
+}
+
+type Model[I Item] struct {
+	Data    []I
+	PerPage int
+	Initial []bool
+
+	// init indicates whether the data model has completed initialization
+	init bool
+
+	checked []bool // len(checked) == len(pageData)
+
+	// index global real time index
+	index int
+	// maxIndex global max index
+	maxIndex int
+	// pageIndex real time index of current page
+	pageIndex int
+	// pageMaxIndex current page max index
+	pageMaxIndex int
+
+	// pageData data set rendered in real time on the current page
+	pageData []I
+}
+
+func (m Model[I]) Selected() (I, bool) {
+	idx := m.pageIndex
+	if idx >= 0 && idx < len(m.pageData) {
+		return m.pageData[idx], true
+	}
+	var zero I
+	return zero, false
+}
+
+func (m Model[I]) Checked() []I {
+	indices := m.CheckedIndices()
+	items := make([]I, len(indices))
+	for i, idx := range indices {
+		items[i] = m.pageData[idx]
+	}
+	return items
+}
+
+func (m Model[I]) CheckedIndices() []int {
+	var indices []int
+	for i, checked := range m.checked {
+		if checked {
+			indices = append(indices, i)
+		}
+	}
+	return indices
+}
+
+func (m Model[I]) View() string {
+	var out strings.Builder
+	cursor := "»" // TODO color etc
+	for i, obj := range m.pageData {
+		selected := i == m.pageIndex
+		checked := m.checked[i]
+		if selected {
+			out.WriteString(cursor)
+			out.WriteString(" ")
+		} else {
+			out.WriteString(strings.Repeat(" ", runewidth.StringWidth(cursor)+1))
+		}
+
+		if checked {
+			out.WriteString("[x] ")
+		} else {
+			out.WriteString("[ ] ")
+		}
+
+		out.WriteString(obj.Render(selected, checked))
+		out.WriteString("\n")
+	}
+
+	return out.String()
+}
+
+// Update method responds to various events and modifies the data model
+// according to the corresponding events
+func (m Model[I]) Update(msg tea.Msg) (Model[I], tea.Cmd) {
+	if !m.init {
+		m.initData()
+		return m, nil
+	}
+
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch strings.ToLower(msg.String()) {
+		case "down":
+			m.moveDown()
+		case "up":
+			m.moveUp()
+		case "right", "pgdown", "l", "k":
+			m.nextPage()
+		case "left", "pgup", "h", "j":
+			m.prePage()
+		case "1", "2", "3", "4", "5", "6", "7", "8", "9":
+			num, _ := strconv.Atoi(msg.String())
+			idx := num - 1
+			m.forward(idx)
+
+		case "x", " ":
+			m.toggle()
+		}
+	}
+	return m, nil
+}
+
+func (m *Model[I]) toggle() {
+	idx := m.pageIndex
+	if idx >= 0 && idx < len(m.pageData) {
+		m.checked[idx] = !m.checked[idx]
+	}
+}
+
+// moveDown executes the downward movement of the cursor,
+// while adjusting the internal index and refreshing the data area
+func (m *Model[I]) moveDown() {
+	// the page index has not reached the maximum value, and the page
+	// data area does not need to be updated
+	if m.pageIndex < m.pageMaxIndex {
+		m.pageIndex++
+		// check whether the global index reaches the maximum value before sliding
+		if m.index < m.maxIndex {
+			m.index++
+		}
+		return
+	}
+
+	// the page index reaches the maximum value, slide the page data area window,
+	// the page index maintains the maximum value
+	if m.pageIndex == m.pageMaxIndex {
+		// check whether the global index reaches the maximum value before sliding
+		if m.index < m.maxIndex {
+			// global index increment
+			m.index++
+			// window slide down one data
+			m.pageData = m.Data[m.index+1-m.PerPage : m.index+1]
+			return
+		}
+	}
+}
+
+// moveUp performs an upward movement of the cursor,
+// while adjusting the internal index and refreshing the data area
+func (m *Model[I]) moveUp() {
+	// the page index has not reached the minimum value, and the page
+	// data area does not need to be updated
+	if m.pageIndex > 0 {
+		m.pageIndex--
+		// check whether the global index reaches the minimum before sliding
+		if m.index > 0 {
+			m.index--
+		}
+		return
+	}
+
+	// the page index reaches the minimum value, slide the page data window,
+	// and the page index maintains the minimum value
+	if m.pageIndex == 0 {
+		// check whether the global index reaches the minimum before sliding
+		if m.index > 0 {
+			// window slide up one data
+			m.pageData = m.Data[m.index-1 : m.index-1+m.PerPage]
+			// global index decrement
+			m.index--
+			return
+		}
+	}
+}
+
+// nextPage triggers the page-down action, and does not change
+// the real-time page index(pageIndex)
+func (m *Model[I]) nextPage() {
+	// Get the start and end position of the page data area slice: m.Data[start:end]
+	//
+	// note: the slice is closed left and opened right: `[start,end)`
+	//       assuming that the global data area has unlimited length,
+	//       end should always be the actual page `length+1`,
+	//       the maximum value of end should be equal to `len(m.Data)`
+	//       under limited length
+	pageStart, pageEnd := m.pageIndexInfo()
+	// there are two cases when `end` does not reach the maximum value
+	if pageEnd < len(m.Data) {
+		// the `end` value is at least one page length away from the global maximum index
+		if len(m.Data)-pageEnd >= m.PerPage {
+			// slide back one page in the page data area
+			m.pageData = m.Data[pageStart+m.PerPage : pageEnd+m.PerPage]
+			// Global real-time index increases by one page length
+			m.index += m.PerPage
+		} else { // `end` is less than a page length from the global maximum index
+			// slide the page data area directly to the end
+			m.pageData = m.Data[len(m.Data)-m.PerPage : len(m.Data)]
+			// `sliding distance` = `position after sliding` - `position before sliding`
+			// the global real-time index should also synchronize the same sliding distance
+			m.index += len(m.Data) - pageEnd
+		}
+	}
+}
+
+// prePage triggers the page-up action, and does not change
+// the real-time page index(pageIndex)
+func (m *Model[I]) prePage() {
+	// Get the start and end position of the page data area slice: m.Data[start:end]
+	//
+	// note: the slice is closed left and opened right: `[start,end)`
+	//       assuming that the global data area has unlimited length,
+	//       end should always be the actual page `length+1`,
+	//       the maximum value of end should be equal to `len(m.Data)`
+	//       under limited length
+	pageStart, pageEnd := m.pageIndexInfo()
+	// there are two cases when `start` does not reach the minimum value
+	if pageStart > 0 {
+		// `start` is at least one page length from the minimum
+		if pageStart >= m.PerPage {
+			// slide the page data area forward one page
+			m.pageData = m.Data[pageStart-m.PerPage : pageEnd-m.PerPage]
+			// Global real-time index reduces the length of one page
+			m.index -= m.PerPage
+		} else { // `start` to the minimum value less than one page length
+			// slide the page data area directly to the start
+			m.pageData = m.Data[:m.PerPage]
+			// `sliding distance` = `position before sliding` - `minimum value(0)`
+			// the global real-time index should also synchronize the same sliding distance
+			m.index -= pageStart - 0
+		}
+	}
+}
+
+// forward triggers a fast jump action, if the pageIndex
+// is invalid, keep it as it is
+func (m *Model[I]) forward(pageIndex int) {
+	// pageIndex has exceeded the maximum index of the page, ignore
+	if pageIndex > m.pageMaxIndex {
+		return
+	}
+
+	// calculate the distance moved to pageIndex
+	l := pageIndex - m.pageIndex
+	// update the global real time index
+	m.index += l
+	// update the page real time index
+	m.pageIndex = pageIndex
+
+}
+
+// initData initialize the data model, set the default value and
+// fix the wrong parameter settings during initialization
+func (m *Model[I]) initData() {
+	if m.PerPage > len(m.Data) || m.PerPage < 1 {
+		m.PerPage = len(m.Data)
+		m.pageData = m.Data
+	} else {
+		m.pageData = m.Data[:m.PerPage]
+	}
+
+	m.pageIndex = 0
+	m.pageMaxIndex = m.PerPage - 1
+	m.index = 0
+	m.maxIndex = len(m.Data) - 1
+	m.checked = make([]bool, len(m.Data))
+	copy(m.checked, m.Initial)
+	m.init = true
+}
+
+// pageIndexInfo return the start and end positions of the slice of the
+// page data area corresponding to the global data area
+func (m *Model[I]) pageIndexInfo() (start, end int) {
+	// `Global real-time index` - `page real-time index` = `start index of page data area`
+	start = m.index - m.pageIndex
+	// `Page data area start index` + `single page size` = `page data area end index`
+	end = start + m.PerPage
+	return
+}
diff --git a/cli/internal/bubbles/selector/selector.go b/cli/internal/bubbles/selector/selector.go
new file mode 100644
index 0000000000..e7856071c8
--- /dev/null
+++ b/cli/internal/bubbles/selector/selector.go
@@ -0,0 +1,263 @@
+package selector
+
+import (
+	"strconv"
+	"strings"
+
+	tea "github.com/charmbracelet/bubbletea"
+	"github.com/mattn/go-runewidth"
+)
+
+type Item interface {
+	Render(selected bool) string
+}
+
+func New[I Item](data []I, perPage int) Model[I] {
+	m := Model[I]{data: data, perPage: perPage}
+	m.initData()
+	return m
+}
+
+type Model[I Item] struct {
+	data     []I
+	pageData []I
+	perPage  int
+
+	focused bool
+
+	// init indicates whether the data model has completed initialization
+	init bool
+	// index global real time index
+	index int
+	// maxIndex global max index
+	maxIndex int
+	// pageIndex real time index of current page
+	pageIndex int
+	// pageMaxIndex current page max index
+	pageMaxIndex int
+}
+
+func (m Model[I]) Selected() (I, bool) {
+	idx := m.index
+	if idx >= 0 && idx < len(m.data) {
+		return m.data[idx], true
+	}
+	var zero I
+	return zero, false
+}
+
+func (m Model[I]) View() string {
+	var out strings.Builder
+	cursor := "»" // TODO color etc
+	for i, obj := range m.pageData {
+		selected := i == m.pageIndex
+		if selected {
+			out.WriteString(cursor)
+			out.WriteString(" ")
+		} else {
+			out.WriteString(strings.Repeat(" ", runewidth.StringWidth(cursor)+1))
+		}
+		out.WriteString(obj.Render(selected))
+		out.WriteString("\n")
+	}
+
+	return out.String()
+}
+
+func (m *Model[I]) Focus() tea.Cmd {
+	m.focused = true
+	return nil
+}
+
+func (m *Model[I]) Blur() tea.Cmd {
+	m.focused = false
+	return nil
+}
+
+// Update method responds to various events and modifies the data model
+// according to the corresponding events
+func (m Model[I]) Update(msg tea.Msg) (Model[I], tea.Cmd) {
+	if !m.init {
+		m.initData()
+		return m, nil
+	} else if !m.focused {
+		return m, nil
+	}
+
+	switch msg := msg.(type) {
+	case tea.KeyMsg:
+		switch strings.ToLower(msg.String()) {
+		case "down":
+			m.moveDown()
+		case "up":
+			m.moveUp()
+		case "right", "pgdown", "l", "k":
+			m.nextPage()
+		case "left", "pgup", "h", "j":
+			m.prePage()
+		case "1", "2", "3", "4", "5", "6", "7", "8", "9":
+			num, _ := strconv.Atoi(msg.String())
+			idx := num - 1
+			m.forward(idx)
+		}
+	}
+	return m, nil
+}
+
+// moveDown executes the downward movement of the cursor,
+// while adjusting the internal index and refreshing the data area
+func (m *Model[I]) moveDown() {
+	// the page index has not reached the maximum value, and the page
+	// data area does not need to be updated
+	if m.pageIndex < m.pageMaxIndex {
+		m.pageIndex++
+		// check whether the global index reaches the maximum value before sliding
+		if m.index < m.maxIndex {
+			m.index++
+		}
+		return
+	}
+
+	// the page index reaches the maximum value, slide the page data area window,
+	// the page index maintains the maximum value
+	if m.pageIndex == m.pageMaxIndex {
+		// check whether the global index reaches the maximum value before sliding
+		if m.index < m.maxIndex {
+			// global index increment
+			m.index++
+			// window slide down one data
+			m.pageData = m.data[m.index+1-m.perPage : m.index+1]
+			return
+		}
+	}
+}
+
+// moveUp performs an upward movement of the cursor,
+// while adjusting the internal index and refreshing the data area
+func (m *Model[I]) moveUp() {
+	// the page index has not reached the minimum value, and the page
+	// data area does not need to be updated
+	if m.pageIndex > 0 {
+		m.pageIndex--
+		// check whether the global index reaches the minimum before sliding
+		if m.index > 0 {
+			m.index--
+		}
+		return
+	}
+
+	// the page index reaches the minimum value, slide the page data window,
+	// and the page index maintains the minimum value
+	if m.pageIndex == 0 {
+		// check whether the global index reaches the minimum before sliding
+		if m.index > 0 {
+			// window slide up one data
+			m.pageData = m.data[m.index-1 : m.index-1+m.perPage]
+			// global index decrement
+			m.index--
+			return
+		}
+	}
+}
+
+// nextPage triggers the page-down action, and does not change
+// the real-time page index(pageIndex)
+func (m *Model[I]) nextPage() {
+	// Get the start and end position of the page data area slice: m.Data[start:end]
+	//
+	// note: the slice is closed left and opened right: `[start,end)`
+	//       assuming that the global data area has unlimited length,
+	//       end should always be the actual page `length+1`,
+	//       the maximum value of end should be equal to `len(m.Data)`
+	//       under limited length
+	pageStart, pageEnd := m.pageIndexInfo()
+	// there are two cases when `end` does not reach the maximum value
+	if pageEnd < len(m.data) {
+		// the `end` value is at least one page length away from the global maximum index
+		if len(m.data)-pageEnd >= m.perPage {
+			// slide back one page in the page data area
+			m.pageData = m.data[pageStart+m.perPage : pageEnd+m.perPage]
+			// Global real-time index increases by one page length
+			m.index += m.perPage
+		} else { // `end` is less than a page length from the global maximum index
+			// slide the page data area directly to the end
+			m.pageData = m.data[len(m.data)-m.perPage : len(m.data)]
+			// `sliding distance` = `position after sliding` - `position before sliding`
+			// the global real-time index should also synchronize the same sliding distance
+			m.index += len(m.data) - pageEnd
+		}
+	}
+}
+
+// prePage triggers the page-up action, and does not change
+// the real-time page index(pageIndex)
+func (m *Model[I]) prePage() {
+	// Get the start and end position of the page data area slice: m.Data[start:end]
+	//
+	// note: the slice is closed left and opened right: `[start,end)`
+	//       assuming that the global data area has unlimited length,
+	//       end should always be the actual page `length+1`,
+	//       the maximum value of end should be equal to `len(m.Data)`
+	//       under limited length
+	pageStart, pageEnd := m.pageIndexInfo()
+	// there are two cases when `start` does not reach the minimum value
+	if pageStart > 0 {
+		// `start` is at least one page length from the minimum
+		if pageStart >= m.perPage {
+			// slide the page data area forward one page
+			m.pageData = m.data[pageStart-m.perPage : pageEnd-m.perPage]
+			// Global real-time index reduces the length of one page
+			m.index -= m.perPage
+		} else { // `start` to the minimum value less than one page length
+			// slide the page data area directly to the start
+			m.pageData = m.data[:m.perPage]
+			// `sliding distance` = `position before sliding` - `minimum value(0)`
+			// the global real-time index should also synchronize the same sliding distance
+			m.index -= pageStart - 0
+		}
+	}
+}
+
+// forward triggers a fast jump action, if the pageIndex
+// is invalid, keep it as it is
+func (m *Model[I]) forward(pageIndex int) {
+	// pageIndex has exceeded the maximum index of the page, ignore
+	if pageIndex > m.pageMaxIndex {
+		return
+	}
+
+	// calculate the distance moved to pageIndex
+	l := pageIndex - m.pageIndex
+	// update the global real time index
+	m.index += l
+	// update the page real time index
+	m.pageIndex = pageIndex
+
+}
+
+// initData initialize the data model, set the default value and
+// fix the wrong parameter settings during initialization
+func (m *Model[I]) initData() {
+	if m.perPage > len(m.data) || m.perPage < 1 {
+		m.perPage = len(m.data)
+		m.pageData = m.data
+	} else {
+		m.pageData = m.data[:m.perPage]
+	}
+
+	m.pageIndex = 0
+	m.pageMaxIndex = m.perPage - 1
+	m.index = 0
+	m.maxIndex = len(m.data) - 1
+	m.init = true
+}
+
+// pageIndexInfo return the start and end positions of the slice of the
+// page data area corresponding to the global data area
+func (m *Model[I]) pageIndexInfo() (start, end int) {
+	// `Global real-time index` - `page real-time index` = `start index of page data area`
+	start = m.index - m.pageIndex
+	// `Page data area start index` + `single page size` = `page data area end index`
+	end = start + m.perPage
+	return
+}
diff --git a/cli/internal/codegen/client.go b/cli/internal/codegen/client.go
deleted file mode 100644
index ece60a520e..0000000000
--- a/cli/internal/codegen/client.go
+++ /dev/null
@@ -1,62 +0,0 @@
-// Package codegen generates code for use with Encore apps.
-package codegen
-
-import (
-	"bytes"
-	"errors"
-	"fmt"
-	"path/filepath"
-	"strings"
-
-	meta "encr.dev/proto/encore/parser/meta/v1"
-)
-
-// Lang represents a programming language or dialect that we support generating code for.
-type Lang string
-
-// These constants represent supported languages.
-const (
-	Unknown    Lang = ""
-	TypeScript Lang = "typescript"
-)
-
-type generator interface {
-	Generate(buf *bytes.Buffer, appSlug string, md *meta.Data) error
-}
-
-// ErrUnknownLang is reported by Generate when the language is not known.
-var ErrUnknownLang = errors.New("unknown language")
-
-// Detect attempts to detect the language from the given filename.
-func Detect(path string) (lang Lang, ok bool) {
-	suffix := strings.ToLower(filepath.Ext(path))
-	switch suffix {
-	case ".ts":
-		return TypeScript, true
-	default:
-		return Unknown, false
-	}
-}
-
-// Client generates an API client based on the given app metadata.
-func Client(lang Lang, appSlug string, md *meta.Data) (code []byte, err error) {
-	defer func() {
-		if e := recover(); e != nil {
-			err = fmt.Errorf("codegen.Client %s %s panicked: %v", lang, appSlug, e)
-		}
-	}()
-
-	var gen generator
-	switch lang {
-	case TypeScript:
-		gen = &ts{}
-	default:
-		return nil, ErrUnknownLang
-	}
-
-	var buf bytes.Buffer
-	if err := gen.Generate(&buf, appSlug, md); err != nil {
-		return nil, fmt.Errorf("genclient.Generate %s %s: %v", lang, appSlug, err)
-	}
-	return buf.Bytes(), nil
-}
diff --git a/cli/internal/codegen/ts.go b/cli/internal/codegen/ts.go
deleted file mode 100644
index 8ed5ea8995..0000000000
--- a/cli/internal/codegen/ts.go
+++ /dev/null
@@ -1,437 +0,0 @@
-package codegen
-
-import (
-	"bufio"
-	"bytes"
-	"fmt"
-	"sort"
-	"strings"
-
-	meta "encr.dev/proto/encore/parser/meta/v1"
-	schema "encr.dev/proto/encore/parser/schema/v1"
-)
-
-/* The TypeScript generator generates code that looks like this:
-export namespace task {
-	export interface AddParams {
-		description: string
-	}
-
-	export class ServiceClient {
-		public Add(params: task_AddParams): Promise<task_AddResponse> {
-			// ...
-		}
-	}
-}
-
-*/
-
-type ts struct {
-	*bytes.Buffer
-	md       *meta.Data
-	appSlug  string
-	typs     *typeRegistry
-	currDecl *schema.Decl
-}
-
-func (ts *ts) Generate(buf *bytes.Buffer, appSlug string, md *meta.Data) (err error) {
-	defer ts.handleBailout(&err)
-
-	ts.Buffer = buf
-	ts.md = md
-	ts.appSlug = appSlug
-	ts.typs = getNamedTypes(md)
-
-	nss := ts.typs.Namespaces()
-	seenNs := make(map[string]bool)
-	ts.writeClient()
-	for _, svc := range md.Svcs {
-		ts.writeService(svc)
-		seenNs[svc.Name] = true
-	}
-	for _, ns := range nss {
-		if !seenNs[ns] {
-			ts.writeNamespace(ns)
-		}
-	}
-	ts.writeBaseClient()
-
-	return nil
-}
-
-func (ts *ts) hasPublicRPC(svc *meta.Service) bool {
-	for _, rpc := range svc.Rpcs {
-		if rpc.AccessType != meta.RPC_PRIVATE {
-			return true
-		}
-	}
-	return false
-}
-
-func (ts *ts) writeService(svc *meta.Service) {
-	// Determine if we have anything worth exposing.
-	// Either a public RPC or a named type.
-	publicRPC := ts.hasPublicRPC(svc)
-	decls := ts.typs.Decls(svc.Name)
-	if !publicRPC && len(decls) == 0 {
-		return
-	}
-
-	ns := svc.Name
-	fmt.Fprintf(ts, "export namespace %s {\n", ns)
-
-	sort.Slice(decls, func(i, j int) bool {
-		return decls[i].Name < decls[j].Name
-	})
-	for i, d := range decls {
-		if i > 0 {
-			ts.WriteString("\n")
-		}
-		ts.writeDeclDef(ns, d)
-	}
-
-	if !publicRPC {
-		ts.WriteString("}\n\n")
-		return
-	}
-	ts.WriteString("\n")
-
-	numIndent := 1
-	indent := func() {
-		ts.WriteString(strings.Repeat("    ", numIndent))
-	}
-
-	indent()
-	fmt.Fprint(ts, "export class ServiceClient {\n")
-	numIndent++
-
-	// Constructor
-	indent()
-	ts.WriteString("private baseClient: BaseClient\n\n")
-	indent()
-	ts.WriteString("constructor(baseClient: BaseClient) {\n")
-	numIndent++
-	indent()
-	ts.WriteString("this.baseClient = baseClient\n")
-	numIndent--
-	indent()
-	ts.WriteString("}\n")
-
-	// RPCs
-	for _, rpc := range svc.Rpcs {
-		if rpc.AccessType == meta.RPC_PRIVATE {
-			continue
-		}
-
-		ts.WriteByte('\n')
-
-		// Doc string
-		if rpc.Doc != "" {
-			scanner := bufio.NewScanner(strings.NewReader(rpc.Doc))
-			indent()
-			ts.WriteString("/**\n")
-			for scanner.Scan() {
-				indent()
-				ts.WriteString(" * ")
-				ts.WriteString(scanner.Text())
-				ts.WriteByte('\n')
-			}
-			indent()
-			ts.WriteString(" */\n")
-		}
-
-		// Signature
-		indent()
-		fmt.Fprintf(ts, "public %s(", rpc.Name)
-		if rpc.RequestSchema != nil {
-			ts.WriteString("params: ")
-			ts.writeDecl(ns, rpc.RequestSchema)
-		}
-
-		ts.WriteString("): Promise<")
-		if rpc.ResponseSchema != nil {
-			ts.writeDecl(ns, rpc.ResponseSchema)
-		} else {
-			ts.WriteString("void")
-		}
-		ts.WriteString("> {\n")
-
-		// Body
-		numIndent++
-		indent()
-		if rpc.ResponseSchema == nil {
-			fmt.Fprintf(ts, `return this.baseClient.doVoid("%s.%s"`, svc.Name, rpc.Name)
-		} else {
-			ts.WriteString("return this.baseClient.do<")
-			ts.writeDecl(svc.Name, rpc.ResponseSchema)
-			fmt.Fprintf(ts, `>("%s.%s"`, svc.Name, rpc.Name)
-		}
-		if rpc.RequestSchema != nil {
-			ts.WriteString(", params")
-		}
-		ts.WriteString(")\n")
-		numIndent--
-		indent()
-		ts.WriteString("}\n")
-	}
-	numIndent--
-	indent()
-	ts.WriteString("}\n}\n\n")
-}
-
-func (ts *ts) writeNamespace(ns string) {
-	decls := ts.typs.Decls(ns)
-	if len(decls) == 0 {
-		return
-	}
-
-	fmt.Fprintf(ts, "export namespace %s {\n", ns)
-	sort.Slice(decls, func(i, j int) bool {
-		return decls[i].Name < decls[j].Name
-	})
-	for i, d := range decls {
-		if i > 0 {
-			ts.WriteString("\n")
-		}
-		ts.writeDeclDef(ns, d)
-	}
-	ts.WriteString("}\n\n")
-}
-
-func (ts *ts) writeDeclDef(ns string, decl *schema.Decl) {
-	if decl.Doc != "" {
-		scanner := bufio.NewScanner(strings.NewReader(decl.Doc))
-		ts.WriteString("    /**\n")
-		for scanner.Scan() {
-			ts.WriteString("     * ")
-			ts.WriteString(scanner.Text())
-			ts.WriteByte('\n')
-		}
-		ts.WriteString("     */\n")
-	}
-
-	// If it's a struct type, expose it as an interface;
-	// other types should be type aliases.
-	if st := decl.Type.GetStruct(); st != nil {
-		fmt.Fprintf(ts, "    export interface %s ", decl.Name)
-	} else {
-		fmt.Fprintf(ts, "    export type %s = ", decl.Name)
-	}
-	ts.currDecl = decl
-	ts.writeTyp(ns, decl.Type, 1)
-	ts.WriteString("\n")
-}
-
-func (ts *ts) writeClient() {
-	ts.WriteString("export default class Client {\n")
-
-	numIndent := 1
-	indent := func() {
-		ts.WriteString(strings.Repeat("    ", numIndent))
-	}
-
-	for _, svc := range ts.md.Svcs {
-		if ts.hasPublicRPC(svc) {
-			indent()
-			fmt.Fprintf(ts, "%s: %s.ServiceClient\n", svc.Name, svc.Name)
-		}
-	}
-	ts.WriteByte('\n')
-
-	indent()
-	ts.WriteString("constructor(environment: string = \"production\", token?: string) {\n")
-	numIndent++
-
-	indent()
-	ts.WriteString("const base = new BaseClient(environment, token)\n")
-	for _, svc := range ts.md.Svcs {
-		if ts.hasPublicRPC(svc) {
-			indent()
-			fmt.Fprintf(ts, "this.%s = new %s.ServiceClient(base)\n", svc.Name, svc.Name)
-		}
-	}
-
-	numIndent--
-	indent()
-	fmt.Fprint(ts, "}\n}\n\n")
-}
-
-func (ts *ts) writeBaseClient() {
-	ts.WriteString(`class BaseClient {
-    baseURL: string
-    headers: {[key: string]: string}
-
-    constructor(environment: string, token?: string) {
-        this.headers = {"Content-Type": "application/json"}
-        if (token !== undefined) {
-            this.headers["Authorization"] = "Bearer " + token
-        }
-        if (environment === "local") {
-            this.baseURL = "http://localhost:4060/"
-        } else {
-            this.baseURL = ` + "`https://" + ts.appSlug + ".encoreapi.com/${environment}/`" + `
-        }
-    }
-
-    public async do<T>(endpoint: string, req?: any): Promise<T> {
-        let response = await fetch(this.baseURL + endpoint, {
-            method: "POST",
-            headers: this.headers,
-            body: JSON.stringify(req || {})
-        })
-        if (!response.ok) {
-            let body = await response.text()
-            throw new Error("request failed: " + body)
-        }
-        return <T>(await response.json())
-    }
-
-    public async doVoid(endpoint: string, req?: any): Promise<void> {
-        let response = await fetch(this.baseURL + endpoint, {
-            method: "POST",
-            headers: this.headers,
-            body: JSON.stringify(req || {})
-        })
-        if (!response.ok) {
-            let body = await response.text()
-            throw new Error("request failed: " + body)
-        }
-        await response.text()
-    }
-}
-`)
-}
-
-func (ts *ts) writeDecl(ns string, decl *schema.Decl) {
-	if decl.Loc.PkgName != ns {
-		ts.WriteString(decl.Loc.PkgName + ".")
-	}
-	ts.WriteString(decl.Name)
-}
-
-func (ts *ts) writeTyp(ns string, typ *schema.Type, numIndents int) {
-	switch typ := typ.Typ.(type) {
-	case *schema.Type_Named:
-		decl := ts.md.Decls[typ.Named.Id]
-		ts.writeDecl(ns, decl)
-	case *schema.Type_List:
-		elem := typ.List.Elem
-		ts.writeTyp(ns, elem, numIndents)
-		ts.WriteString("[]")
-
-	case *schema.Type_Map:
-		ts.WriteString("{ [key: ")
-		ts.writeTyp(ns, typ.Map.Key, numIndents)
-		ts.WriteString("]: ")
-		ts.writeTyp(ns, typ.Map.Value, numIndents)
-		ts.WriteString(" }")
-
-	case *schema.Type_Builtin:
-		t := ""
-		switch typ.Builtin {
-		case schema.Builtin_ANY:
-			t = "any"
-		case schema.Builtin_BOOL:
-			t = "boolean"
-		case schema.Builtin_INT8:
-			t = "number"
-		case schema.Builtin_INT16:
-			t = "number"
-		case schema.Builtin_INT32:
-			t = "number"
-		case schema.Builtin_INT64:
-			t = "number"
-		case schema.Builtin_UINT8:
-			t = "number"
-		case schema.Builtin_UINT16:
-			t = "number"
-		case schema.Builtin_UINT32:
-			t = "number"
-		case schema.Builtin_UINT64:
-			t = "number"
-		case schema.Builtin_FLOAT32:
-			t = "number"
-		case schema.Builtin_FLOAT64:
-			t = "number"
-		case schema.Builtin_STRING:
-			t = "string"
-		case schema.Builtin_BYTES:
-			t = "string" // TODO
-		case schema.Builtin_TIME:
-			t = "string" // TODO
-		case schema.Builtin_JSON:
-			t = "object"
-		case schema.Builtin_UUID:
-			t = "string"
-		case schema.Builtin_USER_ID:
-			t = "string"
-		default:
-			ts.errorf("unknown builtin type %v", typ.Builtin)
-		}
-		ts.WriteString(t)
-
-	case *schema.Type_Struct:
-		indent := func() {
-			ts.WriteString(strings.Repeat("    ", numIndents+1))
-		}
-		ts.WriteString("{\n")
-		for i, field := range typ.Struct.Fields {
-			if field.Doc != "" {
-				scanner := bufio.NewScanner(strings.NewReader(field.Doc))
-				indent()
-				ts.WriteString("/**\n")
-				for scanner.Scan() {
-					indent()
-					ts.WriteString(" * ")
-					ts.WriteString(scanner.Text())
-					ts.WriteByte('\n')
-				}
-				indent()
-				ts.WriteString(" */\n")
-			}
-
-			indent()
-			name := field.Name
-			if js := field.JsonName; js != "" {
-				name = js
-			}
-			ts.WriteString(name)
-
-			// Treat recursively seen types as if they are optional
-			recursiveType := false
-			if n := field.Typ.GetNamed(); n != nil {
-				recursiveType = ts.typs.IsRecursiveRef(ts.currDecl.Id, n.Id)
-			}
-			if field.Optional || recursiveType {
-				ts.WriteString("?")
-			}
-			ts.WriteString(": ")
-			ts.writeTyp(ns, field.Typ, numIndents+1)
-			ts.WriteString("\n")
-
-			// Add another empty line if we have a doc comment
-			// and this was not the last field.
-			if field.Doc != "" && i < len(typ.Struct.Fields)-1 {
-				ts.WriteByte('\n')
-			}
-		}
-		ts.WriteString(strings.Repeat("    ", numIndents))
-		ts.WriteByte('}')
-	}
-}
-
-type bailout struct{ err error }
-
-func (ts *ts) errorf(format string, args ...interface{}) {
-	panic(bailout{fmt.Errorf(format, args...)})
-}
-
-func (ts *ts) handleBailout(dst *error) {
-	if err := recover(); err != nil {
-		if bail, ok := err.(bailout); ok {
-			*dst = bail.err
-		} else {
-			panic(err)
-		}
-	}
-}
diff --git a/cli/internal/codegen/ts_test.go b/cli/internal/codegen/ts_test.go
deleted file mode 100644
index 2afae608ab..0000000000
--- a/cli/internal/codegen/ts_test.go
+++ /dev/null
@@ -1,129 +0,0 @@
-package codegen
-
-import (
-	"strings"
-	"testing"
-
-	"encr.dev/parser"
-	qt "github.com/frankban/quicktest"
-	"github.com/rogpeppe/go-internal/txtar"
-)
-
-func TestTypeScript(t *testing.T) {
-	c := qt.New(t)
-
-	const code = `
--- go.mod --
-module app
-
--- encore.app --
-{"id": ""}
-
--- svc/svc.go --
-package svc
-
-type Request struct {
-    Foo Foo
-}
-
-type Foo int
-
--- svc/api.go --
-package svc
-
-import "context"
-
-//encore:api public
-func DummyAPI(ctx context.Context, req *Request) error {
-    return nil
-}
-`
-
-	ar := txtar.Parse([]byte(code))
-	base := t.TempDir()
-	err := txtar.Write(ar, base)
-	c.Assert(err, qt.IsNil)
-
-	res, err := parser.Parse(&parser.Config{
-		AppRoot:    base,
-		ModulePath: "app",
-	})
-	c.Assert(err, qt.IsNil)
-
-	ts, err := Client(TypeScript, "app", res.Meta)
-	c.Assert(err, qt.IsNil)
-	expect := `export default class Client {
-    svc: svc.ServiceClient
-
-    constructor(environment: string = "production", token?: string) {
-        const base = new BaseClient(environment, token)
-        this.svc = new svc.ServiceClient(base)
-    }
-}
-
-export namespace svc {
-    export type Foo = number
-
-    export interface Request {
-        Foo: Foo
-    }
-
-    export class ServiceClient {
-        private baseClient: BaseClient
-
-        constructor(baseClient: BaseClient) {
-            this.baseClient = baseClient
-        }
-
-        public DummyAPI(params: Request): Promise<void> {
-            return this.baseClient.doVoid("svc.DummyAPI", params)
-        }
-    }
-}
-
-class BaseClient {
-    baseURL: string
-    headers: {[key: string]: string}
-
-    constructor(environment: string, token?: string) {
-        this.headers = {"Content-Type": "application/json"}
-        if (token !== undefined) {
-            this.headers["Authorization"] = "Bearer " + token
-        }
-        if (environment === "local") {
-            this.baseURL = "http://localhost:4060/"
-        } else {
-            this.baseURL = ` + "`" + `https://app.encoreapi.com/${environment}/` + "`" + `
-        }
-    }
-
-    public async do<T>(endpoint: string, req?: any): Promise<T> {
-        let response = await fetch(this.baseURL + endpoint, {
-            method: "POST",
-            headers: this.headers,
-            body: JSON.stringify(req || {})
-        })
-        if (!response.ok) {
-            let body = await response.text()
-            throw new Error("request failed: " + body)
-        }
-        return <T>(await response.json())
-    }
-
-    public async doVoid(endpoint: string, req?: any): Promise<void> {
-        let response = await fetch(this.baseURL + endpoint, {
-            method: "POST",
-            headers: this.headers,
-            body: JSON.stringify(req || {})
-        })
-        if (!response.ok) {
-            let body = await response.text()
-            throw new Error("request failed: " + body)
-        }
-        await response.text()
-    }
-}
-`
-
-	c.Assert(strings.Split(string(ts), "\n"), qt.DeepEquals, strings.Split(expect, "\n"))
-}
diff --git a/cli/internal/codegen/types.go b/cli/internal/codegen/types.go
deleted file mode 100644
index 3c0fe6557e..0000000000
--- a/cli/internal/codegen/types.go
+++ /dev/null
@@ -1,123 +0,0 @@
-package codegen
-
-import (
-	"fmt"
-	"sort"
-
-	meta "encr.dev/proto/encore/parser/meta/v1"
-	schema "encr.dev/proto/encore/parser/schema/v1"
-)
-
-func getNamedTypes(md *meta.Data) *typeRegistry {
-	r := &typeRegistry{
-		md:         md,
-		namespaces: make(map[string][]*schema.Decl),
-		seenDecls:  make(map[uint32]bool),
-		declRefs:   make(map[uint32]map[uint32]bool),
-	}
-	for _, svc := range md.Svcs {
-		for _, rpc := range svc.Rpcs {
-			if rpc.AccessType != meta.RPC_PRIVATE {
-				r.VisitDecl(rpc.RequestSchema)
-				r.VisitDecl(rpc.ResponseSchema)
-			}
-		}
-	}
-	return r
-}
-
-// typeRegistry computes the visible set of type declarations
-// and how to group them into namespaces.
-type typeRegistry struct {
-	md         *meta.Data
-	namespaces map[string][]*schema.Decl
-	seenDecls  map[uint32]bool
-	declRefs   map[uint32]map[uint32]bool // tracks which decls reference which other decls
-	currDecl   *schema.Decl               // may be nil
-}
-
-type namedType struct {
-	pkg  string
-	name string
-}
-
-func (v *typeRegistry) Decls(name string) []*schema.Decl {
-	return v.namespaces[name]
-}
-
-func (v *typeRegistry) Namespaces() []string {
-	nss := make([]string, 0, len(v.namespaces))
-	for ns := range v.namespaces {
-		nss = append(nss, ns)
-	}
-	sort.Strings(nss)
-	return nss
-}
-
-func (v *typeRegistry) Visit(typ *schema.Type) {
-	if typ == nil {
-		return
-	}
-	switch t := typ.Typ.(type) {
-	case *schema.Type_Named:
-		v.visitNamed(t.Named)
-	case *schema.Type_List:
-		v.Visit(t.List.Elem)
-	case *schema.Type_Map:
-		v.Visit(t.Map.Key)
-		v.Visit(t.Map.Value)
-	case *schema.Type_Struct:
-		for _, f := range t.Struct.Fields {
-			v.Visit(f.Typ)
-		}
-	case *schema.Type_Builtin:
-		// do nothing
-	default:
-		panic(fmt.Sprintf("unhandled type: %T", typ))
-	}
-}
-
-func (v *typeRegistry) VisitDecl(decl *schema.Decl) {
-	if decl == nil {
-		return
-	}
-
-	if !v.seenDecls[decl.Id] {
-		v.seenDecls[decl.Id] = true
-		ns := decl.Loc.PkgName
-		v.namespaces[ns] = append(v.namespaces[ns], decl)
-
-		// Set currDecl when processing this and then reset it
-		prev := v.currDecl
-		v.currDecl = decl
-		v.Visit(decl.Type)
-		v.currDecl = prev
-	}
-}
-
-func (v *typeRegistry) visitNamed(n *schema.Named) {
-	to := n.Id
-	curr := v.currDecl
-	if curr != nil {
-		from := curr.Id
-		if _, ok := v.declRefs[from]; !ok {
-			v.declRefs[from] = make(map[uint32]bool)
-		}
-		v.declRefs[from][to] = true
-	}
-
-	decl := v.md.Decls[to]
-	v.VisitDecl(decl)
-
-	// Add transitive refs
-	if curr != nil {
-		from := curr.Id
-		for to2 := range v.declRefs[to] {
-			v.declRefs[from][to2] = true
-		}
-	}
-}
-
-func (v *typeRegistry) IsRecursiveRef(from, to uint32) bool {
-	return v.declRefs[from][to] && v.declRefs[to][from]
-}
diff --git a/cli/internal/conf/conf.go b/cli/internal/conf/conf.go
deleted file mode 100644
index 41b0821264..0000000000
--- a/cli/internal/conf/conf.go
+++ /dev/null
@@ -1,142 +0,0 @@
-// Package conf writes and reads the Encore configuration file for the user.
-package conf
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"net/http"
-	"os"
-	"path/filepath"
-	"runtime"
-
-	"go4.org/syncutil"
-	"golang.org/x/oauth2"
-)
-
-// Config represents the stored Encore configuration.
-type Config struct {
-	oauth2.Token
-	Email     string `json:"email"`
-	WireGuard struct {
-		PublicKey  string `json:"pub,omitempty"`
-		PrivateKey string `json:"priv,omitempty"`
-	} `json:"wg,omitempty"`
-}
-
-// Write persists the configuration for the user.
-func Write(cfg *Config) (err error) {
-	defer func() {
-		if err != nil {
-			err = fmt.Errorf("conf.Write: %v", err)
-		}
-	}()
-
-	dir, err := os.UserConfigDir()
-	if err != nil {
-		return err
-	}
-	path := filepath.Join(dir, "encore", ".auth_token")
-	if data, err := json.Marshal(cfg); err != nil {
-		return err
-	} else if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
-		return err
-	} else if err := ioutil.WriteFile(path, data, 0600); err != nil {
-		return err
-	}
-	return nil
-}
-
-func Logout() error {
-	dir, err := os.UserConfigDir()
-	if err != nil {
-		return err
-	}
-	path := filepath.Join(dir, "encore", ".auth_token")
-	if err := os.Remove(path); err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	return nil
-}
-
-func CurrentUser() (*Config, error) {
-	dir, err := os.UserConfigDir()
-	if err != nil {
-		return nil, fmt.Errorf("conf.CurrentUser: %w", err)
-	}
-	conf, err := readConf(dir)
-	if err != nil {
-		return nil, fmt.Errorf("conf.CurrentUser: %w", err)
-	}
-	return conf, nil
-}
-
-func OriginalUser(configDir string) (cfg *Config, err error) {
-	if runtime.GOOS == "windows" {
-		// Windows does not have the notion of a root user, so just use CurrentUser
-		return CurrentUser()
-	}
-
-	if configDir == "" {
-		var err error
-		configDir, err = os.UserConfigDir()
-		if err != nil {
-			return nil, err
-		}
-	}
-
-	return readConf(configDir)
-}
-
-func readConf(configDir string) (*Config, error) {
-	path := filepath.Join(configDir, "encore", ".auth_token")
-	data, err := ioutil.ReadFile(path)
-	if err != nil {
-		return nil, err
-	}
-	var conf Config
-	if err := json.Unmarshal(data, &conf); err != nil {
-		return nil, err
-	}
-	return &conf, nil
-}
-
-// TokenSource implements oauth2.TokenSource by looking up the
-// current logged in user's API Token.
-// The zero value is ready to be used.
-type TokenSource struct {
-	setup syncutil.Once
-	ts    oauth2.TokenSource
-}
-
-// Token implements oauth2.TokenSource.
-func (ts *TokenSource) Token() (*oauth2.Token, error) {
-	err := ts.setup.Do(func() error {
-		cfg, err := CurrentUser()
-		if errors.Is(err, os.ErrNotExist) {
-			return fmt.Errorf("not logged in: run 'encore auth login' first")
-		} else if err != nil {
-			return fmt.Errorf("could not get Encore auth token: %v", err)
-		}
-
-		oauth2Cfg := &oauth2.Config{
-			Endpoint: oauth2.Endpoint{
-				TokenURL: "https://api.encore.dev/login/oauth:refresh-token",
-			},
-		}
-		ts.ts = oauth2Cfg.TokenSource(context.Background(), &cfg.Token)
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	return ts.ts.Token()
-}
-
-// AuthClient creates an *http.Client that authenticates requests
-// using the logged-in user.
-func AuthClient() *http.Client {
-	return oauth2.NewClient(nil, &TokenSource{})
-}
diff --git a/cli/internal/env/env.go b/cli/internal/env/env.go
deleted file mode 100644
index 470589b7bb..0000000000
--- a/cli/internal/env/env.go
+++ /dev/null
@@ -1,60 +0,0 @@
-// Package env answers where Encore tools and resources are located.
-package env
-
-import (
-	"fmt"
-	"os"
-	"path/filepath"
-)
-
-// EncoreRuntimePath reports the path to the Encore runtime.
-// It can be overridden by setting ENCORE_RUNTIME_PATH.
-func EncoreRuntimePath() string {
-	if p := os.Getenv("ENCORE_RUNTIME_PATH"); p != "" {
-		return p
-	}
-	root, ok := determineRoot()
-	if !ok {
-		fmt.Fprintln(os.Stderr, "fatal: could not determine Encore install root.\n"+
-			"You can specify the path to the Encore runtime manually by setting the ENCORE_RUNTIME_PATH environment variable.")
-		os.Exit(1)
-	}
-	return filepath.Join(root, "runtime")
-}
-
-// EncoreGoRoot reports the path to the Encore Go root.
-// It can be overridden by setting ENCORE_GOROOT.
-func EncoreGoRoot() string {
-	if p := os.Getenv("ENCORE_GOROOT"); p != "" {
-		return p
-	}
-	root, ok := determineRoot()
-	if !ok {
-		fmt.Fprintln(os.Stderr, "fatal: could not determine Encore install root.\n"+
-			"You can specify the path to the Encore GOROOT manually by setting the ENCORE_GOROOT environment variable.")
-		os.Exit(1)
-	}
-	return filepath.Join(root, "encore-go")
-}
-
-// determineRoot determines encore root by checking the location relative
-// to the executable, to enable relocatable installs.
-func determineRoot() (root string, ok bool) {
-	exe, err := os.Executable()
-	if err == nil {
-		// Homebrew uses a lot of symlinks, so we need to get back to the actual location
-		// to be able to use the heuristic below.
-		if sym, err := filepath.EvalSymlinks(exe); err == nil {
-			exe = sym
-		}
-
-		root := filepath.Dir(filepath.Dir(exe))
-		// Heuristic: check if "encore-go" and "runtime" dirs exist in this location.
-		_, err1 := os.Stat(filepath.Join(root, "encore-go"))
-		_, err2 := os.Stat(filepath.Join(root, "runtime"))
-		if err1 == nil && err2 == nil {
-			return root, true
-		}
-	}
-	return "", false
-}
diff --git a/cli/internal/gosym/pclntab.go b/cli/internal/gosym/pclntab.go
new file mode 100644
index 0000000000..fafad1c81a
--- /dev/null
+++ b/cli/internal/gosym/pclntab.go
@@ -0,0 +1,561 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+/*
+ * Line tables
+ */
+
+package gosym
+
+import (
+	"bytes"
+	"encoding/binary"
+	"sync"
+)
+
+// version of the pclntab
+type version int
+
+const (
+	verUnknown version = iota
+	ver11
+	ver12
+	ver116
+)
+
+// A LineTable is a data structure mapping program counters to line numbers.
+//
+// In Go 1.1 and earlier, each function (represented by a Func) had its own LineTable,
+// and the line number corresponded to a numbering of all source lines in the
+// program, across all files. That absolute line number would then have to be
+// converted separately to a file name and line number within the file.
+//
+// In Go 1.2, the format of the data changed so that there is a single LineTable
+// for the entire program, shared by all Funcs, and there are no absolute line
+// numbers, just line numbers within specific files.
+//
+// For the most part, LineTable's methods should be treated as an internal
+// detail of the package; callers should use the methods on Table instead.
+type LineTable struct {
+	Data []byte
+	PC   uint64
+	Line int
+
+	// This mutex is used to keep parsing of pclntab synchronous.
+	mu sync.Mutex
+
+	// Contains the version of the pclntab section.
+	version version
+
+	// Go 1.2/1.16 state
+	binary      binary.ByteOrder
+	quantum     uint32
+	ptrsize     uint32
+	funcnametab []byte
+	cutab       []byte
+	funcdata    []byte
+	functab     []byte
+	nfunctab    uint32
+	filetab     []byte
+	pctab       []byte // points to the pctables.
+	nfiletab    uint32
+	funcNames   map[uint32]string // cache the function names
+	strings     map[uint32]string // interned substrings of Data, keyed by offset
+	// fileMap varies depending on the version of the object file.
+	// For ver12, it maps the name to the index in the file table.
+	// For ver116, it maps the name to the offset in filetab.
+	fileMap map[string]uint32
+}
+
+// NOTE(rsc): This is wrong for GOARCH=arm, which uses a quantum of 4,
+// but we have no idea whether we're using arm or not. This only
+// matters in the old (pre-Go 1.2) symbol table format, so it's not worth
+// fixing.
+const oldQuantum = 1
+
+func (t *LineTable) parse(targetPC uint64, targetLine int) (b []byte, pc uint64, line int) {
+	// The PC/line table can be thought of as a sequence of
+	//  <pc update>* <line update>
+	// batches. Each update batch results in a (pc, line) pair,
+	// where line applies to every PC from pc up to but not
+	// including the pc of the next pair.
+	//
+	// Here we process each update individually, which simplifies
+	// the code, but makes the corner cases more confusing.
+	b, pc, line = t.Data, t.PC, t.Line
+	for pc <= targetPC && line != targetLine && len(b) > 0 {
+		code := b[0]
+		b = b[1:]
+		switch {
+		case code == 0:
+			if len(b) < 4 {
+				b = b[0:0]
+				break
+			}
+			val := binary.BigEndian.Uint32(b)
+			b = b[4:]
+			line += int(val)
+		case code <= 64:
+			line += int(code)
+		case code <= 128:
+			line -= int(code - 64)
+		default:
+			pc += oldQuantum * uint64(code-128)
+			continue
+		}
+		pc += oldQuantum
+	}
+	return b, pc, line
+}
+
+func (t *LineTable) slice(pc uint64) *LineTable {
+	data, pc, line := t.parse(pc, -1)
+	return &LineTable{Data: data, PC: pc, Line: line}
+}
+
+// PCToLine returns the line number for the given program counter.
+//
+// Deprecated: Use Table's PCToLine method instead.
+func (t *LineTable) PCToLine(pc uint64) int {
+	if t.isGo12() {
+		return t.go12PCToLine(pc, nil)
+	}
+	_, _, line := t.parse(pc, -1)
+	return line
+}
+
+// LineToPC returns the program counter for the given line number,
+// considering only program counters before maxpc.
+//
+// Deprecated: Use Table's LineToPC method instead.
+func (t *LineTable) LineToPC(line int, maxpc uint64) uint64 {
+	if t.isGo12() {
+		return 0
+	}
+	_, pc, line1 := t.parse(maxpc, line)
+	if line1 != line {
+		return 0
+	}
+	// Subtract quantum from PC to account for post-line increment
+	return pc - oldQuantum
+}
+
+// NewLineTable returns a new PC/line table
+// corresponding to the encoded data.
+// Text must be the start address of the
+// corresponding text segment.
+func NewLineTable(data []byte, text uint64) *LineTable {
+	return &LineTable{Data: data, PC: text, Line: 0, funcNames: make(map[uint32]string), strings: make(map[uint32]string)}
+}
+
+// Go 1.2 symbol table format.
+// See golang.org/s/go12symtab.
+//
+// A general note about the methods here: rather than try to avoid
+// index out of bounds errors, we trust Go to detect them, and then
+// we recover from the panics and treat them as indicative of a malformed
+// or incomplete table.
+//
+// The methods called by symtab.go, which begin with "go12" prefixes,
+// are expected to have that recovery logic.
+
+// isGo12 reports whether this is a Go 1.2 (or later) symbol table.
+func (t *LineTable) isGo12() bool {
+	t.parsePclnTab()
+	return t.version >= ver12
+}
+
+const go12magic = 0xfffffffb
+const go116magic = 0xfffffffa
+
+// uintptr returns the pointer-sized value encoded at b.
+// The pointer size is dictated by the table being read.
+func (t *LineTable) uintptr(b []byte) uint64 {
+	if t.ptrsize == 4 {
+		return uint64(t.binary.Uint32(b))
+	}
+	return t.binary.Uint64(b)
+}
+
+// parsePclnTab parses the pclntab, setting the version.
+func (t *LineTable) parsePclnTab() {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if t.version != verUnknown {
+		return
+	}
+
+	// Note that during this function, setting the version is the last thing we do.
+	// If we set the version too early, and parsing failed (likely as a panic on
+	// slice lookups), we'd have a mistaken version.
+	//
+	// Error paths through this code will default the version to 1.1.
+	t.version = ver11
+
+	defer func() {
+		// If we panic parsing, assume it's a Go 1.1 pclntab.
+		recover()
+	}()
+
+	// Check header: 4-byte magic, two zeros, pc quantum, pointer size.
+	if len(t.Data) < 16 || t.Data[4] != 0 || t.Data[5] != 0 ||
+		(t.Data[6] != 1 && t.Data[6] != 2 && t.Data[6] != 4) || // pc quantum
+		(t.Data[7] != 4 && t.Data[7] != 8) { // pointer size
+		return
+	}
+
+	var possibleVersion version
+	leMagic := binary.LittleEndian.Uint32(t.Data)
+	beMagic := binary.BigEndian.Uint32(t.Data)
+	switch {
+	case leMagic == go12magic:
+		t.binary, possibleVersion = binary.LittleEndian, ver12
+	case beMagic == go12magic:
+		t.binary, possibleVersion = binary.BigEndian, ver12
+	case leMagic == go116magic:
+		t.binary, possibleVersion = binary.LittleEndian, ver116
+	case beMagic == go116magic:
+		t.binary, possibleVersion = binary.BigEndian, ver116
+	default:
+		return
+	}
+
+	// quantum and ptrSize are the same between 1.2 and 1.16
+	t.quantum = uint32(t.Data[6])
+	t.ptrsize = uint32(t.Data[7])
+
+	switch possibleVersion {
+	case ver116:
+		t.nfunctab = uint32(t.uintptr(t.Data[8:]))
+		t.nfiletab = uint32(t.uintptr(t.Data[8+t.ptrsize:]))
+		offset := t.uintptr(t.Data[8+2*t.ptrsize:])
+		t.funcnametab = t.Data[offset:]
+		offset = t.uintptr(t.Data[8+3*t.ptrsize:])
+		t.cutab = t.Data[offset:]
+		offset = t.uintptr(t.Data[8+4*t.ptrsize:])
+		t.filetab = t.Data[offset:]
+		offset = t.uintptr(t.Data[8+5*t.ptrsize:])
+		t.pctab = t.Data[offset:]
+		offset = t.uintptr(t.Data[8+6*t.ptrsize:])
+		t.funcdata = t.Data[offset:]
+		t.functab = t.Data[offset:]
+		functabsize := t.nfunctab*2*t.ptrsize + t.ptrsize
+		t.functab = t.functab[:functabsize]
+	case ver12:
+		t.nfunctab = uint32(t.uintptr(t.Data[8:]))
+		t.funcdata = t.Data
+		t.funcnametab = t.Data
+		t.functab = t.Data[8+t.ptrsize:]
+		t.pctab = t.Data
+		functabsize := t.nfunctab*2*t.ptrsize + t.ptrsize
+		fileoff := t.binary.Uint32(t.functab[functabsize:])
+		t.functab = t.functab[:functabsize]
+		t.filetab = t.Data[fileoff:]
+		t.nfiletab = t.binary.Uint32(t.filetab)
+		t.filetab = t.filetab[:t.nfiletab*4]
+	default:
+		panic("unreachable")
+	}
+	t.version = possibleVersion
+}
+
+// go12Funcs returns a slice of Funcs derived from the Go 1.2 pcln table.
+func (t *LineTable) go12Funcs() []Func {
+	// Assume it is malformed and return nil on error.
+	defer func() {
+		recover()
+	}()
+
+	n := len(t.functab) / int(t.ptrsize) / 2
+	funcs := make([]Func, n)
+	for i := range funcs {
+		f := &funcs[i]
+		f.Entry = t.uintptr(t.functab[2*i*int(t.ptrsize):])
+		f.End = t.uintptr(t.functab[(2*i+2)*int(t.ptrsize):])
+		info := t.funcdata[t.uintptr(t.functab[(2*i+1)*int(t.ptrsize):]):]
+		f.LineTable = t
+		f.FrameSize = int(t.binary.Uint32(info[t.ptrsize+2*4:]))
+		f.Sym = &Sym{
+			Value:  f.Entry,
+			Type:   'T',
+			Name:   t.funcName(t.binary.Uint32(info[t.ptrsize:])),
+			GoType: 0,
+			Func:   f,
+		}
+	}
+	return funcs
+}
+
+// findFunc returns the func corresponding to the given program counter.
+func (t *LineTable) findFunc(pc uint64) []byte {
+	if pc < t.uintptr(t.functab) || pc >= t.uintptr(t.functab[len(t.functab)-int(t.ptrsize):]) {
+		return nil
+	}
+
+	// The function table is a list of 2*nfunctab+1 uintptrs,
+	// alternating program counters and offsets to func structures.
+	f := t.functab
+	nf := t.nfunctab
+	for nf > 0 {
+		m := nf / 2
+		fm := f[2*t.ptrsize*m:]
+		if t.uintptr(fm) <= pc && pc < t.uintptr(fm[2*t.ptrsize:]) {
+			return t.funcdata[t.uintptr(fm[t.ptrsize:]):]
+		} else if pc < t.uintptr(fm) {
+			nf = m
+		} else {
+			f = f[(m+1)*2*t.ptrsize:]
+			nf -= m + 1
+		}
+	}
+	return nil
+}
+
+// readvarint reads, removes, and returns a varint from *pp.
+func (t *LineTable) readvarint(pp *[]byte) uint32 {
+	var v, shift uint32
+	p := *pp
+	for shift = 0; ; shift += 7 {
+		b := p[0]
+		p = p[1:]
+		v |= (uint32(b) & 0x7F) << shift
+		if b&0x80 == 0 {
+			break
+		}
+	}
+	*pp = p
+	return v
+}
+
+// funcName returns the name of the function found at off.
+func (t *LineTable) funcName(off uint32) string {
+	if s, ok := t.funcNames[off]; ok {
+		return s
+	}
+	i := bytes.IndexByte(t.funcnametab[off:], 0)
+	s := string(t.funcnametab[off : off+uint32(i)])
+	t.funcNames[off] = s
+	return s
+}
+
+// stringFrom returns a Go string found at off from a position.
+func (t *LineTable) stringFrom(arr []byte, off uint32) string {
+	if s, ok := t.strings[off]; ok {
+		return s
+	}
+	i := bytes.IndexByte(arr[off:], 0)
+	s := string(arr[off : off+uint32(i)])
+	t.strings[off] = s
+	return s
+}
+
+// string returns a Go string found at off.
+func (t *LineTable) string(off uint32) string {
+	return t.stringFrom(t.funcdata, off)
+}
+
+// step advances to the next pc, value pair in the encoded table.
+func (t *LineTable) step(p *[]byte, pc *uint64, val *int32, first bool) bool {
+	uvdelta := t.readvarint(p)
+	if uvdelta == 0 && !first {
+		return false
+	}
+	pcdelta := t.readvarint(p) * t.quantum
+	*pc += uint64(pcdelta)
+	*val += int32(-(uvdelta & 1) ^ (uvdelta >> 1))
+	return true
+}
+
+// pcvalue reports the value associated with the target pc.
+// off is the offset to the beginning of the pc-value table,
+// and entry is the start PC for the corresponding function.
+func (t *LineTable) pcvalue(off uint32, entry, targetpc uint64, fn *Func) int32 {
+	p := t.pctab[off:]
+
+	val := int32(-1)
+	pc := entry
+	for t.step(&p, &pc, &val, pc == entry) {
+		if targetpc < pc {
+			return val
+		}
+	}
+	return -1
+}
+
+// findFileLine scans one function in the binary looking for a
+// program counter in the given file on the given line.
+// It does so by running the pc-value tables mapping program counter
+// to file number. Since most functions come from a single file, these
+// are usually short and quick to scan. If a file match is found, then the
+// code goes to the expense of looking for a simultaneous line number match.
+func (t *LineTable) findFileLine(entry uint64, filetab, linetab uint32, filenum, line int32, cutab []byte) uint64 {
+	if filetab == 0 || linetab == 0 {
+		return 0
+	}
+
+	fp := t.pctab[filetab:]
+	fl := t.pctab[linetab:]
+	fileVal := int32(-1)
+	filePC := entry
+	lineVal := int32(-1)
+	linePC := entry
+	fileStartPC := filePC
+	for t.step(&fp, &filePC, &fileVal, filePC == entry) {
+		fileIndex := fileVal
+		if t.version == ver116 {
+			fileIndex = int32(t.binary.Uint32(cutab[fileVal*4:]))
+		}
+		if fileIndex == filenum && fileStartPC < filePC {
+			// fileIndex is in effect starting at fileStartPC up to
+			// but not including filePC, and it's the file we want.
+			// Run the PC table looking for a matching line number
+			// or until we reach filePC.
+			lineStartPC := linePC
+			for linePC < filePC && t.step(&fl, &linePC, &lineVal, linePC == entry) {
+				// lineVal is in effect until linePC, and lineStartPC < filePC.
+				if lineVal == line {
+					if fileStartPC <= lineStartPC {
+						return lineStartPC
+					}
+					if fileStartPC < linePC {
+						return fileStartPC
+					}
+				}
+				lineStartPC = linePC
+			}
+		}
+		fileStartPC = filePC
+	}
+	return 0
+}
+
+// go12PCToLine maps program counter to line number for the Go 1.2 pcln table.
+func (t *LineTable) go12PCToLine(pc uint64, fn *Func) (line int) {
+	defer func() {
+		if recover() != nil {
+			line = -1
+		}
+	}()
+
+	f := t.findFunc(pc)
+	if f == nil {
+		return -1
+	}
+	entry := t.uintptr(f)
+	if pc > entry {
+		pc--
+	}
+	linetab := t.binary.Uint32(f[t.ptrsize+5*4:])
+	return int(t.pcvalue(linetab, entry, pc, fn))
+}
+
+// go12PCToFile maps program counter to file name for the Go 1.2 pcln table.
+func (t *LineTable) go12PCToFile(pc uint64, fn *Func) (file string) {
+	defer func() {
+		if recover() != nil {
+			file = ""
+		}
+	}()
+
+	f := t.findFunc(pc)
+	if f == nil {
+		return ""
+	}
+	entry := t.uintptr(f)
+	if pc > entry {
+		pc--
+	}
+	filetab := t.binary.Uint32(f[t.ptrsize+4*4:])
+	fno := t.pcvalue(filetab, entry, pc, fn)
+	if t.version == ver12 {
+		if fno <= 0 {
+			return ""
+		}
+		return t.string(t.binary.Uint32(t.filetab[4*fno:]))
+	}
+	// Go ≥ 1.16
+	if fno < 0 { // 0 is valid for ≥ 1.16
+		return ""
+	}
+	cuoff := t.binary.Uint32(f[t.ptrsize+7*4:])
+	if fnoff := t.binary.Uint32(t.cutab[(cuoff+uint32(fno))*4:]); fnoff != ^uint32(0) {
+		return t.stringFrom(t.filetab, fnoff)
+	}
+	return ""
+}
+
+// go12LineToPC maps a (file, line) pair to a program counter for the Go 1.2/1.16 pcln table.
+func (t *LineTable) go12LineToPC(file string, line int) (pc uint64) {
+	defer func() {
+		if recover() != nil {
+			pc = 0
+		}
+	}()
+
+	t.initFileMap()
+	filenum, ok := t.fileMap[file]
+	if !ok {
+		return 0
+	}
+
+	// Scan all functions.
+	// If this turns out to be a bottleneck, we could build a map[int32][]int32
+	// mapping file number to a list of functions with code from that file.
+	var cutab []byte
+	for i := uint32(0); i < t.nfunctab; i++ {
+		f := t.funcdata[t.uintptr(t.functab[2*t.ptrsize*i+t.ptrsize:]):]
+		entry := t.uintptr(f)
+		filetab := t.binary.Uint32(f[t.ptrsize+4*4:])
+		linetab := t.binary.Uint32(f[t.ptrsize+5*4:])
+		if t.version == ver116 {
+			cuoff := t.binary.Uint32(f[t.ptrsize+7*4:]) * 4
+			cutab = t.cutab[cuoff:]
+		}
+		pc := t.findFileLine(entry, filetab, linetab, int32(filenum), int32(line), cutab)
+		if pc != 0 {
+			return pc
+		}
+	}
+	return 0
+}
+
+// initFileMap initializes the map from file name to file number.
+func (t *LineTable) initFileMap() {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	if t.fileMap != nil {
+		return
+	}
+	m := make(map[string]uint32)
+
+	if t.version == ver12 {
+		for i := uint32(1); i < t.nfiletab; i++ {
+			s := t.string(t.binary.Uint32(t.filetab[4*i:]))
+			m[s] = i
+		}
+	} else {
+		var pos uint32
+		for i := uint32(0); i < t.nfiletab; i++ {
+			s := t.stringFrom(t.filetab, pos)
+			m[s] = pos
+			pos += uint32(len(s) + 1)
+		}
+	}
+	t.fileMap = m
+}
+
+// go12MapFiles adds to m a key for every file in the Go 1.2 LineTable.
+// Every key maps to obj. That's not a very interesting map, but it provides
+// a way for callers to obtain the list of files in the program.
+func (t *LineTable) go12MapFiles(m map[string]*Obj, obj *Obj) {
+	defer func() {
+		recover()
+	}()
+
+	t.initFileMap()
+	for file := range t.fileMap {
+		m[file] = obj
+	}
+}
diff --git a/cli/internal/gosym/symtab.go b/cli/internal/gosym/symtab.go
new file mode 100644
index 0000000000..e0d4a9b8dc
--- /dev/null
+++ b/cli/internal/gosym/symtab.go
@@ -0,0 +1,723 @@
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Package gosym implements access to the Go symbol
+// and line number tables embedded in Go binaries generated
+// by the gc compilers.
+package gosym
+
+import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"strconv"
+	"strings"
+)
+
+/*
+ * Symbols
+ */
+
+// A Sym represents a single symbol table entry.
+type Sym struct {
+	Value  uint64
+	Type   byte
+	Name   string
+	GoType uint64
+	// If this symbol is a function symbol, the corresponding Func
+	Func *Func
+}
+
+// Static reports whether this symbol is static (not visible outside its file).
+func (s *Sym) Static() bool { return s.Type >= 'a' }
+
+// PackageName returns the package part of the symbol name,
+// or the empty string if there is none.
+func (s *Sym) PackageName() string {
+	name := s.Name
+
+	// A prefix of "type." and "go." is a compiler-generated symbol that doesn't belong to any package.
+	// See variable reservedimports in cmd/compile/internal/gc/subr.go
+	if strings.HasPrefix(name, "go.") || strings.HasPrefix(name, "type.") {
+		return ""
+	}
+
+	pathend := strings.LastIndex(name, "/")
+	if pathend < 0 {
+		pathend = 0
+	}
+
+	if i := strings.Index(name[pathend:], "."); i != -1 {
+		return name[:pathend+i]
+	}
+	return ""
+}
+
+// ReceiverName returns the receiver type name of this symbol,
+// or the empty string if there is none.
+func (s *Sym) ReceiverName() string {
+	pathend := strings.LastIndex(s.Name, "/")
+	if pathend < 0 {
+		pathend = 0
+	}
+	l := strings.Index(s.Name[pathend:], ".")
+	r := strings.LastIndex(s.Name[pathend:], ".")
+	if l == -1 || r == -1 || l == r {
+		return ""
+	}
+	return s.Name[pathend+l+1 : pathend+r]
+}
+
+// BaseName returns the symbol name without the package or receiver name.
+func (s *Sym) BaseName() string {
+	if i := strings.LastIndex(s.Name, "."); i != -1 {
+		return s.Name[i+1:]
+	}
+	return s.Name
+}
+
+// A Func collects information about a single function.
+type Func struct {
+	Entry uint64
+	*Sym
+	End       uint64
+	Params    []*Sym // nil for Go 1.3 and later binaries
+	Locals    []*Sym // nil for Go 1.3 and later binaries
+	FrameSize int
+	LineTable *LineTable
+	Obj       *Obj
+}
+
+// An Obj represents a collection of functions in a symbol table.
+//
+// The exact method of division of a binary into separate Objs is an internal detail
+// of the symbol table format.
+//
+// In early versions of Go each source file became a different Obj.
+//
+// In Go 1 and Go 1.1, each package produced one Obj for all Go sources
+// and one Obj per C source file.
+//
+// In Go 1.2, there is a single Obj for the entire program.
+type Obj struct {
+	// Funcs is a list of functions in the Obj.
+	Funcs []Func
+
+	// In Go 1.1 and earlier, Paths is a list of symbols corresponding
+	// to the source file names that produced the Obj.
+	// In Go 1.2, Paths is nil.
+	// Use the keys of Table.Files to obtain a list of source files.
+	Paths []Sym // meta
+}
+
+/*
+ * Symbol tables
+ */
+
+// Table represents a Go symbol table. It stores all of the
+// symbols decoded from the program and provides methods to translate
+// between symbols, names, and addresses.
+type Table struct {
+	Syms  []Sym // nil for Go 1.3 and later binaries
+	Funcs []Func
+	Files map[string]*Obj // for Go 1.2 and later all files map to one Obj
+	Objs  []Obj           // for Go 1.2 and later only one Obj in slice
+
+	go12line *LineTable // Go 1.2 line number table
+}
+
+type sym struct {
+	value  uint64
+	gotype uint64
+	typ    byte
+	name   []byte
+}
+
+var (
+	littleEndianSymtab    = []byte{0xFD, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00}
+	bigEndianSymtab       = []byte{0xFF, 0xFF, 0xFF, 0xFD, 0x00, 0x00, 0x00}
+	oldLittleEndianSymtab = []byte{0xFE, 0xFF, 0xFF, 0xFF, 0x00, 0x00}
+)
+
+func walksymtab(data []byte, fn func(sym) error) error {
+	if len(data) == 0 { // missing symtab is okay
+		return nil
+	}
+	var order binary.ByteOrder = binary.BigEndian
+	newTable := false
+	switch {
+	case bytes.HasPrefix(data, oldLittleEndianSymtab):
+		// Same as Go 1.0, but little endian.
+		// Format was used during interim development between Go 1.0 and Go 1.1.
+		// Should not be widespread, but easy to support.
+		data = data[6:]
+		order = binary.LittleEndian
+	case bytes.HasPrefix(data, bigEndianSymtab):
+		newTable = true
+	case bytes.HasPrefix(data, littleEndianSymtab):
+		newTable = true
+		order = binary.LittleEndian
+	}
+	var ptrsz int
+	if newTable {
+		if len(data) < 8 {
+			return &DecodingError{len(data), "unexpected EOF", nil}
+		}
+		ptrsz = int(data[7])
+		if ptrsz != 4 && ptrsz != 8 {
+			return &DecodingError{7, "invalid pointer size", ptrsz}
+		}
+		data = data[8:]
+	}
+	var s sym
+	p := data
+	for len(p) >= 4 {
+		var typ byte
+		if newTable {
+			// Symbol type, value, Go type.
+			typ = p[0] & 0x3F
+			wideValue := p[0]&0x40 != 0
+			goType := p[0]&0x80 != 0
+			if typ < 26 {
+				typ += 'A'
+			} else {
+				typ += 'a' - 26
+			}
+			s.typ = typ
+			p = p[1:]
+			if wideValue {
+				if len(p) < ptrsz {
+					return &DecodingError{len(data), "unexpected EOF", nil}
+				}
+				// fixed-width value
+				if ptrsz == 8 {
+					s.value = order.Uint64(p[0:8])
+					p = p[8:]
+				} else {
+					s.value = uint64(order.Uint32(p[0:4]))
+					p = p[4:]
+				}
+			} else {
+				// varint value
+				s.value = 0
+				shift := uint(0)
+				for len(p) > 0 && p[0]&0x80 != 0 {
+					s.value |= uint64(p[0]&0x7F) << shift
+					shift += 7
+					p = p[1:]
+				}
+				if len(p) == 0 {
+					return &DecodingError{len(data), "unexpected EOF", nil}
+				}
+				s.value |= uint64(p[0]) << shift
+				p = p[1:]
+			}
+			if goType {
+				if len(p) < ptrsz {
+					return &DecodingError{len(data), "unexpected EOF", nil}
+				}
+				// fixed-width go type
+				if ptrsz == 8 {
+					s.gotype = order.Uint64(p[0:8])
+					p = p[8:]
+				} else {
+					s.gotype = uint64(order.Uint32(p[0:4]))
+					p = p[4:]
+				}
+			}
+		} else {
+			// Value, symbol type.
+			s.value = uint64(order.Uint32(p[0:4]))
+			if len(p) < 5 {
+				return &DecodingError{len(data), "unexpected EOF", nil}
+			}
+			typ = p[4]
+			if typ&0x80 == 0 {
+				return &DecodingError{len(data) - len(p) + 4, "bad symbol type", typ}
+			}
+			typ &^= 0x80
+			s.typ = typ
+			p = p[5:]
+		}
+
+		// Name.
+		var i int
+		var nnul int
+		for i = 0; i < len(p); i++ {
+			if p[i] == 0 {
+				nnul = 1
+				break
+			}
+		}
+		switch typ {
+		case 'z', 'Z':
+			p = p[i+nnul:]
+			for i = 0; i+2 <= len(p); i += 2 {
+				if p[i] == 0 && p[i+1] == 0 {
+					nnul = 2
+					break
+				}
+			}
+		}
+		if len(p) < i+nnul {
+			return &DecodingError{len(data), "unexpected EOF", nil}
+		}
+		s.name = p[0:i]
+		i += nnul
+		p = p[i:]
+
+		if !newTable {
+			if len(p) < 4 {
+				return &DecodingError{len(data), "unexpected EOF", nil}
+			}
+			// Go type.
+			s.gotype = uint64(order.Uint32(p[:4]))
+			p = p[4:]
+		}
+		fn(s)
+	}
+	return nil
+}
+
+// NewTable decodes the Go symbol table (the ".gosymtab" section in ELF),
+// returning an in-memory representation.
+// Starting with Go 1.3, the Go symbol table no longer includes symbol data.
+func NewTable(symtab []byte, pcln *LineTable) (*Table, error) {
+	var n int
+	err := walksymtab(symtab, func(s sym) error {
+		n++
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var t Table
+	if pcln.isGo12() {
+		t.go12line = pcln
+	}
+	fname := make(map[uint16]string)
+	t.Syms = make([]Sym, 0, n)
+	nf := 0
+	nz := 0
+	lasttyp := uint8(0)
+	err = walksymtab(symtab, func(s sym) error {
+		n := len(t.Syms)
+		t.Syms = t.Syms[0 : n+1]
+		ts := &t.Syms[n]
+		ts.Type = s.typ
+		ts.Value = s.value
+		ts.GoType = s.gotype
+		switch s.typ {
+		default:
+			// rewrite name to use . instead of · (c2 b7)
+			w := 0
+			b := s.name
+			for i := 0; i < len(b); i++ {
+				if b[i] == 0xc2 && i+1 < len(b) && b[i+1] == 0xb7 {
+					i++
+					b[i] = '.'
+				}
+				b[w] = b[i]
+				w++
+			}
+			ts.Name = string(s.name[0:w])
+		case 'z', 'Z':
+			if lasttyp != 'z' && lasttyp != 'Z' {
+				nz++
+			}
+			for i := 0; i < len(s.name); i += 2 {
+				eltIdx := binary.BigEndian.Uint16(s.name[i : i+2])
+				elt, ok := fname[eltIdx]
+				if !ok {
+					return &DecodingError{-1, "bad filename code", eltIdx}
+				}
+				if n := len(ts.Name); n > 0 && ts.Name[n-1] != '/' {
+					ts.Name += "/"
+				}
+				ts.Name += elt
+			}
+		}
+		switch s.typ {
+		case 'T', 't', 'L', 'l':
+			nf++
+		case 'f':
+			fname[uint16(s.value)] = ts.Name
+		}
+		lasttyp = s.typ
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	t.Funcs = make([]Func, 0, nf)
+	t.Files = make(map[string]*Obj)
+
+	var obj *Obj
+	if t.go12line != nil {
+		// Put all functions into one Obj.
+		t.Objs = make([]Obj, 1)
+		obj = &t.Objs[0]
+		t.go12line.go12MapFiles(t.Files, obj)
+	} else {
+		t.Objs = make([]Obj, 0, nz)
+	}
+
+	// Count text symbols and attach frame sizes, parameters, and
+	// locals to them. Also, find object file boundaries.
+	lastf := 0
+	for i := 0; i < len(t.Syms); i++ {
+		sym := &t.Syms[i]
+		switch sym.Type {
+		case 'Z', 'z': // path symbol
+			if t.go12line != nil {
+				// Go 1.2 binaries have the file information elsewhere. Ignore.
+				break
+			}
+			// Finish the current object
+			if obj != nil {
+				obj.Funcs = t.Funcs[lastf:]
+			}
+			lastf = len(t.Funcs)
+
+			// Start new object
+			n := len(t.Objs)
+			t.Objs = t.Objs[0 : n+1]
+			obj = &t.Objs[n]
+
+			// Count & copy path symbols
+			var end int
+			for end = i + 1; end < len(t.Syms); end++ {
+				if c := t.Syms[end].Type; c != 'Z' && c != 'z' {
+					break
+				}
+			}
+			obj.Paths = t.Syms[i:end]
+			i = end - 1 // loop will i++
+
+			// Record file names
+			depth := 0
+			for j := range obj.Paths {
+				s := &obj.Paths[j]
+				if s.Name == "" {
+					depth--
+				} else {
+					if depth == 0 {
+						t.Files[s.Name] = obj
+					}
+					depth++
+				}
+			}
+
+		case 'T', 't', 'L', 'l': // text symbol
+			if n := len(t.Funcs); n > 0 {
+				t.Funcs[n-1].End = sym.Value
+			}
+			if sym.Name == "runtime.etext" || sym.Name == "etext" {
+				continue
+			}
+
+			// Count parameter and local (auto) syms
+			var np, na int
+			var end int
+		countloop:
+			for end = i + 1; end < len(t.Syms); end++ {
+				switch t.Syms[end].Type {
+				case 'T', 't', 'L', 'l', 'Z', 'z':
+					break countloop
+				case 'p':
+					np++
+				case 'a':
+					na++
+				}
+			}
+
+			// Fill in the function symbol
+			n := len(t.Funcs)
+			t.Funcs = t.Funcs[0 : n+1]
+			fn := &t.Funcs[n]
+			sym.Func = fn
+			fn.Params = make([]*Sym, 0, np)
+			fn.Locals = make([]*Sym, 0, na)
+			fn.Sym = sym
+			fn.Entry = sym.Value
+			fn.Obj = obj
+			if t.go12line != nil {
+				// All functions share the same line table.
+				// It knows how to narrow down to a specific
+				// function quickly.
+				fn.LineTable = t.go12line
+			} else if pcln != nil {
+				fn.LineTable = pcln.slice(fn.Entry)
+				pcln = fn.LineTable
+			}
+			for j := i; j < end; j++ {
+				s := &t.Syms[j]
+				switch s.Type {
+				case 'm':
+					fn.FrameSize = int(s.Value)
+				case 'p':
+					n := len(fn.Params)
+					fn.Params = fn.Params[0 : n+1]
+					fn.Params[n] = s
+				case 'a':
+					n := len(fn.Locals)
+					fn.Locals = fn.Locals[0 : n+1]
+					fn.Locals[n] = s
+				}
+			}
+			i = end - 1 // loop will i++
+		}
+	}
+
+	if t.go12line != nil && nf == 0 {
+		t.Funcs = t.go12line.go12Funcs()
+	}
+	if obj != nil {
+		obj.Funcs = t.Funcs[lastf:]
+	}
+	return &t, nil
+}
+
+// PCToFunc returns the function containing the program counter pc,
+// or nil if there is no such function.
+func (t *Table) PCToFunc(pc uint64) *Func {
+	funcs := t.Funcs
+	for len(funcs) > 0 {
+		m := len(funcs) / 2
+		fn := &funcs[m]
+		switch {
+		case pc < fn.Entry:
+			funcs = funcs[0:m]
+		case fn.Entry <= pc && pc < fn.End:
+			return fn
+		default:
+			funcs = funcs[m+1:]
+		}
+	}
+	return nil
+}
+
+// PCToLine looks up line number information for a program counter.
+// If there is no information, it returns fn == nil.
+func (t *Table) PCToLine(pc uint64) (file string, line int, fn *Func) {
+	if fn = t.PCToFunc(pc); fn == nil {
+		return
+	}
+	if t.go12line != nil {
+		file = t.go12line.go12PCToFile(pc, fn)
+		line = t.go12line.go12PCToLine(pc, fn)
+	} else {
+		file, line = fn.Obj.lineFromAline(fn.LineTable.PCToLine(pc))
+	}
+	return
+}
+
+// LineToPC looks up the first program counter on the given line in
+// the named file. It returns UnknownPathError or UnknownLineError if
+// there is an error looking up this line.
+func (t *Table) LineToPC(file string, line int) (pc uint64, fn *Func, err error) {
+	obj, ok := t.Files[file]
+	if !ok {
+		return 0, nil, UnknownFileError(file)
+	}
+
+	if t.go12line != nil {
+		pc := t.go12line.go12LineToPC(file, line)
+		if pc == 0 {
+			return 0, nil, &UnknownLineError{file, line}
+		}
+		return pc, t.PCToFunc(pc), nil
+	}
+
+	abs, err := obj.alineFromLine(file, line)
+	if err != nil {
+		return
+	}
+	for i := range obj.Funcs {
+		f := &obj.Funcs[i]
+		pc := f.LineTable.LineToPC(abs, f.End)
+		if pc != 0 {
+			return pc, f, nil
+		}
+	}
+	return 0, nil, &UnknownLineError{file, line}
+}
+
+// LookupSym returns the text, data, or bss symbol with the given name,
+// or nil if no such symbol is found.
+func (t *Table) LookupSym(name string) *Sym {
+	// TODO(austin) Maybe make a map
+	for i := range t.Syms {
+		s := &t.Syms[i]
+		switch s.Type {
+		case 'T', 't', 'L', 'l', 'D', 'd', 'B', 'b':
+			if s.Name == name {
+				return s
+			}
+		}
+	}
+	return nil
+}
+
+// LookupFunc returns the text, data, or bss symbol with the given name,
+// or nil if no such symbol is found.
+func (t *Table) LookupFunc(name string) *Func {
+	for i := range t.Funcs {
+		f := &t.Funcs[i]
+		if f.Sym.Name == name {
+			return f
+		}
+	}
+	return nil
+}
+
+// SymByAddr returns the text, data, or bss symbol starting at the given address.
+func (t *Table) SymByAddr(addr uint64) *Sym {
+	for i := range t.Syms {
+		s := &t.Syms[i]
+		switch s.Type {
+		case 'T', 't', 'L', 'l', 'D', 'd', 'B', 'b':
+			if s.Value == addr {
+				return s
+			}
+		}
+	}
+	return nil
+}
+
+/*
+ * Object files
+ */
+
+// This is legacy code for Go 1.1 and earlier, which used the
+// Plan 9 format for pc-line tables. This code was never quite
+// correct. It's probably very close, and it's usually correct, but
+// we never quite found all the corner cases.
+//
+// Go 1.2 and later use a simpler format, documented at golang.org/s/go12symtab.
+
+func (o *Obj) lineFromAline(aline int) (string, int) {
+	type stackEnt struct {
+		path   string
+		start  int
+		offset int
+		prev   *stackEnt
+	}
+
+	noPath := &stackEnt{"", 0, 0, nil}
+	tos := noPath
+
+pathloop:
+	for _, s := range o.Paths {
+		val := int(s.Value)
+		switch {
+		case val > aline:
+			break pathloop
+
+		case val == 1:
+			// Start a new stack
+			tos = &stackEnt{s.Name, val, 0, noPath}
+
+		case s.Name == "":
+			// Pop
+			if tos == noPath {
+				return "<malformed symbol table>", 0
+			}
+			tos.prev.offset += val - tos.start
+			tos = tos.prev
+
+		default:
+			// Push
+			tos = &stackEnt{s.Name, val, 0, tos}
+		}
+	}
+
+	if tos == noPath {
+		return "", 0
+	}
+	return tos.path, aline - tos.start - tos.offset + 1
+}
+
+func (o *Obj) alineFromLine(path string, line int) (int, error) {
+	if line < 1 {
+		return 0, &UnknownLineError{path, line}
+	}
+
+	for i, s := range o.Paths {
+		// Find this path
+		if s.Name != path {
+			continue
+		}
+
+		// Find this line at this stack level
+		depth := 0
+		var incstart int
+		line += int(s.Value)
+	pathloop:
+		for _, s := range o.Paths[i:] {
+			val := int(s.Value)
+			switch {
+			case depth == 1 && val >= line:
+				return line - 1, nil
+
+			case s.Name == "":
+				depth--
+				if depth == 0 {
+					break pathloop
+				} else if depth == 1 {
+					line += val - incstart
+				}
+
+			default:
+				if depth == 1 {
+					incstart = val
+				}
+				depth++
+			}
+		}
+		return 0, &UnknownLineError{path, line}
+	}
+	return 0, UnknownFileError(path)
+}
+
+/*
+ * Errors
+ */
+
+// UnknownFileError represents a failure to find the specific file in
+// the symbol table.
+type UnknownFileError string
+
+func (e UnknownFileError) Error() string { return "unknown file: " + string(e) }
+
+// UnknownLineError represents a failure to map a line to a program
+// counter, either because the line is beyond the bounds of the file
+// or because there is no code on the given line.
+type UnknownLineError struct {
+	File string
+	Line int
+}
+
+func (e *UnknownLineError) Error() string {
+	return "no code at " + e.File + ":" + strconv.Itoa(e.Line)
+}
+
+// DecodingError represents an error during the decoding of
+// the symbol table.
+type DecodingError struct {
+	off int
+	msg string
+	val interface{}
+}
+
+func (e *DecodingError) Error() string {
+	msg := e.msg
+	if e.val != nil {
+		msg += fmt.Sprintf(" '%v'", e.val)
+	}
+	msg += fmt.Sprintf(" at byte %#x", e.off)
+	return msg
+}
diff --git a/cli/internal/gosym/symtab_test.go b/cli/internal/gosym/symtab_test.go
new file mode 100644
index 0000000000..b6ed8f554c
--- /dev/null
+++ b/cli/internal/gosym/symtab_test.go
@@ -0,0 +1,58 @@
+// Copyright 2016 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package gosym
+
+import (
+	"fmt"
+	"testing"
+)
+
+func assertString(t *testing.T, dsc, out, tgt string) {
+	if out != tgt {
+		t.Fatalf("Expected: %q Actual: %q for %s", tgt, out, dsc)
+	}
+}
+
+func TestStandardLibPackage(t *testing.T) {
+	s1 := Sym{Name: "io.(*LimitedReader).Read"}
+	s2 := Sym{Name: "io.NewSectionReader"}
+	assertString(t, fmt.Sprintf("package of %q", s1.Name), s1.PackageName(), "io")
+	assertString(t, fmt.Sprintf("package of %q", s2.Name), s2.PackageName(), "io")
+	assertString(t, fmt.Sprintf("receiver of %q", s1.Name), s1.ReceiverName(), "(*LimitedReader)")
+	assertString(t, fmt.Sprintf("receiver of %q", s2.Name), s2.ReceiverName(), "")
+}
+
+func TestStandardLibPathPackage(t *testing.T) {
+	s1 := Sym{Name: "debug/gosym.(*LineTable).PCToLine"}
+	s2 := Sym{Name: "debug/gosym.NewTable"}
+	assertString(t, fmt.Sprintf("package of %q", s1.Name), s1.PackageName(), "debug/gosym")
+	assertString(t, fmt.Sprintf("package of %q", s2.Name), s2.PackageName(), "debug/gosym")
+	assertString(t, fmt.Sprintf("receiver of %q", s1.Name), s1.ReceiverName(), "(*LineTable)")
+	assertString(t, fmt.Sprintf("receiver of %q", s2.Name), s2.ReceiverName(), "")
+}
+
+func TestRemotePackage(t *testing.T) {
+	s1 := Sym{Name: "github.com/docker/doc.ker/pkg/mflag.(*FlagSet).PrintDefaults"}
+	s2 := Sym{Name: "github.com/docker/doc.ker/pkg/mflag.PrintDefaults"}
+	assertString(t, fmt.Sprintf("package of %q", s1.Name), s1.PackageName(), "github.com/docker/doc.ker/pkg/mflag")
+	assertString(t, fmt.Sprintf("package of %q", s2.Name), s2.PackageName(), "github.com/docker/doc.ker/pkg/mflag")
+	assertString(t, fmt.Sprintf("receiver of %q", s1.Name), s1.ReceiverName(), "(*FlagSet)")
+	assertString(t, fmt.Sprintf("receiver of %q", s2.Name), s2.ReceiverName(), "")
+}
+
+func TestIssue29551(t *testing.T) {
+	symNames := []string{
+		"type..eq.[9]debug/elf.intName",
+		"type..hash.debug/elf.ProgHeader",
+		"type..eq.runtime._panic",
+		"type..hash.struct { runtime.gList; runtime.n int32 }",
+		"go.(*struct { sync.Mutex; math/big.table [64]math/big",
+	}
+
+	for _, symName := range symNames {
+		s := Sym{Name: symName}
+		assertString(t, fmt.Sprintf("package of %q", s.Name), s.PackageName(), "")
+	}
+}
diff --git a/cli/internal/gosym/testdata/main.go b/cli/internal/gosym/testdata/main.go
new file mode 100644
index 0000000000..b7702184cd
--- /dev/null
+++ b/cli/internal/gosym/testdata/main.go
@@ -0,0 +1,10 @@
+package main
+
+func linefrompc()
+func pcfromline()
+
+func main() {
+	// Prevent GC of our test symbols
+	linefrompc()
+	pcfromline()
+}
diff --git a/cli/internal/gosym/testdata/pclinetest.h b/cli/internal/gosym/testdata/pclinetest.h
new file mode 100644
index 0000000000..156c0b87b0
--- /dev/null
+++ b/cli/internal/gosym/testdata/pclinetest.h
@@ -0,0 +1,9 @@
+// +build ignore
+
+// Empty include file to generate z symbols
+
+
+
+
+
+// EOF
diff --git a/cli/internal/gosym/testdata/pclinetest.s b/cli/internal/gosym/testdata/pclinetest.s
new file mode 100644
index 0000000000..53461cdfc1
--- /dev/null
+++ b/cli/internal/gosym/testdata/pclinetest.s
@@ -0,0 +1,48 @@
+TEXT ·linefrompc(SB),4,$0	// Each byte stores its line delta
+BYTE $2;
+BYTE $1;
+BYTE $1; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1;
+BYTE $1;
+BYTE $1; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+BYTE $1; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+#include "pclinetest.h"
+BYTE $2;
+#include "pclinetest.h"
+BYTE $2;
+BYTE $255;
+
+TEXT ·pcfromline(SB),4,$0	// Each record stores its line delta, then n, then n more bytes
+BYTE $32; BYTE $0;
+BYTE $1; BYTE $1; BYTE $0;
+BYTE $1; BYTE $0;
+
+BYTE $2; BYTE $4; BYTE $0; BYTE $0; BYTE $0; BYTE $0;
+
+
+#include "pclinetest.h"
+BYTE $4; BYTE $0;
+
+
+BYTE $3; BYTE $3; BYTE $0; BYTE $0; BYTE $0;
+#include "pclinetest.h"
+
+
+BYTE $4; BYTE $3; BYTE $0; BYTE $0; BYTE $0;
+BYTE $255;
diff --git a/cli/internal/gosym/testdata/pcln115.gz b/cli/internal/gosym/testdata/pcln115.gz
new file mode 100644
index 0000000000..db5c3d48ad
Binary files /dev/null and b/cli/internal/gosym/testdata/pcln115.gz differ
diff --git a/cli/internal/jsonrpc2/wire.go b/cli/internal/jsonrpc2/wire.go
index d805f57937..0c985cad60 100644
--- a/cli/internal/jsonrpc2/wire.go
+++ b/cli/internal/jsonrpc2/wire.go
@@ -33,7 +33,7 @@ var (
 	ErrServerOverloaded = NewError(-32000, "JSON RPC overloaded")
 )
 
-// wireRequest is sent to a server to represent a Call or Notify operaton.
+// wireRequest is sent to a server to represent a Call or Notify operation.
 type wireRequest struct {
 	// VersionTag is always encoded as the string "2.0"
 	VersionTag wireVersionTag `json:"jsonrpc"`
@@ -137,9 +137,9 @@ func (id ID) Format(f fmt.State, r rune) {
 	}
 	switch {
 	case id.name != "":
-		fmt.Fprintf(f, strF, id.name)
+		_, _ = fmt.Fprintf(f, strF, id.name)
 	default:
-		fmt.Fprintf(f, numF, id.number)
+		_, _ = fmt.Fprintf(f, numF, id.number)
 	}
 }
 
diff --git a/cli/internal/login/deviceauth.go b/cli/internal/login/deviceauth.go
new file mode 100644
index 0000000000..a9ff68acf3
--- /dev/null
+++ b/cli/internal/login/deviceauth.go
@@ -0,0 +1,182 @@
+package login
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/briandowns/spinner"
+	"github.com/fatih/color"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/internal/browser"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/internal/conf"
+	"encr.dev/internal/env"
+)
+
+// DeviceAuth logs in the suser with the device auth flow.
+func DeviceAuth() (*conf.Config, error) {
+	// Generate PKCE challenge.
+	randData, err := genRandData()
+	if err != nil {
+		return nil, fmt.Errorf("could not generate random data: %v", err)
+	}
+	codeVerifier := base64.RawURLEncoding.EncodeToString([]byte(randData))
+	challengeHash := sha256.Sum256([]byte(codeVerifier))
+	codeChallenge := base64.RawURLEncoding.EncodeToString(challengeHash[:])
+
+	resp, err := platform.BeginDeviceAuthFlow(context.Background(), platform.BeginAuthorizationFlowParams{
+		CodeChallenge: codeChallenge,
+		ClientID:      "encore_cli",
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	var (
+		bold  = color.New(color.Bold)
+		faint = color.New(color.Faint)
+	)
+
+	fmt.Printf("Your pairing code is %s\n", bold.Sprint(resp.UserCode))
+	faint.Println("This pairing code verifies your authentication with Encore.")
+
+	inputCh := make(chan struct{}, 1)
+
+	spin := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
+	spin.Prefix = "Waiting for login confirmation..."
+
+	if !env.IsSSH() && browser.CanOpen() {
+		fmt.Fprintf(os.Stdout, "Press Enter to open the browser or visit %s (^C to quit)\n",
+			resp.VerificationURI)
+
+		// Asynchronously wait for input.
+		w := waitForEnterPress()
+		defer w.Stop()
+		go func() {
+			select {
+			case <-w.pressed:
+				inputCh <- struct{}{}
+			case <-w.quit:
+			}
+		}()
+
+	} else {
+		// On Windows we need a proper \r\n newline to ensure the URL detection doesn't extend to the next line.
+		// fmt.Fprintln and family prints just a simple \n, so don't use that.
+		fmt.Fprintf(os.Stdout, "To authenticate with Encore, please go to: %s%s", resp.VerificationURI, cmdutil.Newline)
+		spin.Start()
+	}
+
+	resultCh := make(chan deviceAuthResult, 1)
+	go pollForDeviceAuthResult(codeVerifier, resp, resultCh)
+
+	for {
+		select {
+		case <-inputCh:
+			// The user hit Enter; show a spinner and try to open the browser.
+			spin.Start()
+			if !browser.Open(resp.VerificationURI) {
+				spin.FinalMSG = fmt.Sprintf("Failed to open browser, please go to %s manually.", resp.VerificationURI)
+				spin.Stop()
+
+				// Create a new spinner so the message above stays around.
+				spin = spinner.New(spinner.CharSets[14], 100*time.Millisecond)
+				spin.Prefix = "Waiting for login confirmation..."
+				spin.Start()
+			}
+
+		case res := <-resultCh:
+			if res.err != nil {
+				spin.FinalMSG = fmt.Sprintf("Failed to log in: %v", res.err)
+				spin.Stop()
+				return nil, res.err
+			}
+
+			spin.Stop()
+			return res.cfg, nil
+		}
+	}
+}
+
+type deviceAuthResult struct {
+	cfg *conf.Config
+	err error
+}
+
+func pollForDeviceAuthResult(codeVerifier string, data *platform.BeginAuthorizationFlowResponse, resultCh chan<- deviceAuthResult) {
+PollLoop:
+	for {
+		interval := data.Interval
+		if interval <= 0 {
+			interval = 5
+		}
+		time.Sleep(time.Duration(interval) * time.Second)
+
+		resp, err := platform.PollDeviceAuthFlow(context.Background(), platform.PollDeviceAuthFlowParams{
+			DeviceCode:   data.DeviceCode,
+			CodeVerifier: codeVerifier,
+		})
+		if err != nil {
+			if e, ok := err.(platform.Error); ok {
+				switch e.Code {
+				case "auth_pending":
+					// Not yet authorized, continue polling.
+					continue PollLoop
+
+				case "rate_limited":
+					// Spurious error; sleep a bit extra before retrying to be safe.
+					time.Sleep(5 * time.Second)
+					continue PollLoop
+				}
+			}
+			resultCh <- deviceAuthResult{err: err}
+			return
+		}
+
+		cfg := &conf.Config{Token: *resp.Token, Actor: resp.Actor, Email: resp.Email, AppSlug: resp.AppSlug}
+		resultCh <- deviceAuthResult{cfg: cfg}
+		return
+	}
+}
+
+type enterPressWaiter struct {
+	quit    chan struct{} // close to abort the waiter
+	pressed chan struct{} // closed when enter has been pressed
+	runDone chan struct{} // closed when the run goroutine has exited
+}
+
+func waitForEnterPress() *enterPressWaiter {
+	w := &enterPressWaiter{
+		quit:    make(chan struct{}),
+		pressed: make(chan struct{}, 1),
+		runDone: make(chan struct{}),
+	}
+	go w.run()
+	return w
+}
+
+func (w *enterPressWaiter) run() {
+	defer close(w.runDone)
+	fmt.Fscanln(os.Stdin)
+	select {
+	case w.pressed <- struct{}{}:
+	case <-w.quit:
+	}
+}
+
+func (w *enterPressWaiter) Stop() {
+	close(w.quit)
+	os.Stdin.SetReadDeadline(time.Now()) // interrupt the pending read
+
+	// Asynchronously wait for the run goroutine to exit before
+	// we reset the read deadline.
+	go func() {
+		<-w.runDone
+		os.Stdin.SetReadDeadline(time.Time{}) // reset read deadline
+	}()
+}
diff --git a/cli/internal/login/interactive.go b/cli/internal/login/interactive.go
new file mode 100644
index 0000000000..7da93251bb
--- /dev/null
+++ b/cli/internal/login/interactive.go
@@ -0,0 +1,125 @@
+package login
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"net"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/briandowns/spinner"
+
+	"encr.dev/cli/cmd/encore/cmdutil"
+	"encr.dev/cli/internal/browser"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/internal/conf"
+	"encr.dev/internal/env"
+)
+
+// interactive keeps the state of an ongoing login flow.
+type interactive struct {
+	result chan *conf.Config // Successful logins are sent on this
+
+	state           string
+	challenge       string
+	pubKey, privKey string
+	srv             *http.Server
+	ln              net.Listener
+}
+
+// Interactive begins an interactive login attempt.
+func Interactive() (*conf.Config, error) {
+	// Generate initial request state
+	state, err1 := genRandData()
+	challenge, err2 := genRandData()
+	if err1 != nil || err2 != nil {
+		return nil, fmt.Errorf("could not generate random data: %v/%v", err1, err2)
+	}
+
+	challengeHash := sha256.Sum256([]byte(challenge))
+	encodedChallenge := base64.RawURLEncoding.EncodeToString(challengeHash[:])
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		return nil, err
+	}
+	defer ln.Close()
+	addr := ln.Addr().(*net.TCPAddr)
+	url := fmt.Sprintf("http://localhost:%d/oauth", addr.Port)
+
+	req := &platform.CreateOAuthSessionParams{
+		Challenge:   encodedChallenge,
+		State:       state,
+		RedirectURL: url,
+	}
+	authURL, err := platform.CreateOAuthSession(context.Background(), req)
+	if err != nil {
+		return nil, err
+	}
+
+	flow := &interactive{
+		result: make(chan *conf.Config),
+
+		state:     state,
+		challenge: challenge,
+	}
+	flow.srv = &http.Server{Handler: http.HandlerFunc(flow.oauthHandler)}
+	go flow.srv.Serve(ln)
+
+	spin := spinner.New(spinner.CharSets[14], 100*time.Millisecond)
+
+	if env.IsSSH() || !browser.Open(authURL) {
+		// On Windows we need a proper \r\n newline to ensure the URL detection doesn't extend to the next line.
+		// fmt.Fprintln and family prints just a simple \n, so don't use that.
+		fmt.Fprint(os.Stdout, "Log in to Encore using your browser here: ", authURL, cmdutil.Newline)
+	} else {
+		spin.Prefix = "Waiting for login to complete "
+		spin.Start()
+		defer spin.Stop()
+	}
+
+	select {
+	case res := <-flow.result:
+		return res, nil
+	case <-time.After(10 * time.Minute):
+		return nil, errors.New("Timed out waiting for login confirmation")
+	}
+}
+
+func (f *interactive) oauthHandler(w http.ResponseWriter, req *http.Request) {
+	if req.URL.Path != "/oauth" {
+		http.Error(w, "Not Found", http.StatusNotFound)
+		return
+	}
+	code := req.FormValue("code")
+	reqState := req.FormValue("state")
+	if code == "" || reqState != f.state {
+		http.Error(w, "Bad Request (bad code or state)", http.StatusBadRequest)
+		return
+	}
+
+	params := &platform.ExchangeOAuthTokenParams{
+		Challenge: f.challenge,
+		Code:      code,
+	}
+	resp, err := platform.ExchangeOAuthToken(req.Context(), params)
+	if err != nil {
+		http.Error(w, "Could not exchange token: "+err.Error(), http.StatusBadGateway)
+		return
+	} else if resp.Token == nil {
+		http.Error(w, "Invalid response: missing token", http.StatusBadGateway)
+		return
+	}
+
+	conf := &conf.Config{Token: *resp.Token, Actor: resp.Actor, Email: resp.Email, AppSlug: resp.AppSlug}
+	select {
+	case f.result <- conf:
+		http.Redirect(w, req, "https://www.encore.dev/auth/success", http.StatusFound)
+	default:
+		http.Error(w, "Unexpected request", http.StatusBadRequest)
+	}
+}
diff --git a/cli/internal/login/login.go b/cli/internal/login/login.go
index e110611a43..85a5c152d2 100644
--- a/cli/internal/login/login.go
+++ b/cli/internal/login/login.go
@@ -2,146 +2,39 @@
 package login
 
 import (
-	"bytes"
+	"context"
 	"crypto/rand"
-	"crypto/sha256"
 	"encoding/base64"
-	"encoding/json"
 	"fmt"
-	"io"
-	"net"
-	"net/http"
 
-	"encr.dev/cli/internal/conf"
-	"encr.dev/cli/internal/wgtunnel"
-	"golang.org/x/oauth2"
+	"encr.dev/cli/internal/browser"
+	"encr.dev/cli/internal/platform"
+	"encr.dev/internal/conf"
+	"encr.dev/internal/env"
 )
 
-// Flow keeps the state of an ongoing login flow.
-type Flow struct {
-	URL     string            // Local URL the flow is listening on
-	LoginCh chan *conf.Config // Successful logins are sent on this
-
-	state           string
-	challenge       string
-	pubKey, privKey string
-	srv             *http.Server
-	ln              net.Listener
+func DecideFlow() (*conf.Config, error) {
+	if env.IsSSH() || !browser.CanOpen() {
+		return DeviceAuth()
+	}
+	return Interactive()
 }
 
-// Begin begins a new login attempt.
-func Begin() (f *Flow, err error) {
-	// Generate initial request state
-	state, err1 := genRandData()
-	challenge, err2 := genRandData()
-	if err1 != nil || err2 != nil {
-		return nil, fmt.Errorf("could not generate random data: %v/%v", err1, err2)
+func WithAuthKey(authKey string) (*conf.Config, error) {
+	params := &platform.ExchangeAuthKeyParams{
+		AuthKey: authKey,
 	}
-
-	challengeHash := sha256.Sum256([]byte(challenge))
-	encodedChallenge := base64.RawURLEncoding.EncodeToString(challengeHash[:])
-
-	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	resp, err := platform.ExchangeAuthKey(context.Background(), params)
 	if err != nil {
 		return nil, err
-	}
-	defer func() {
-		if err != nil {
-			ln.Close()
-		}
-	}()
-	addr := ln.Addr().(*net.TCPAddr)
-	url := fmt.Sprintf("http://localhost:%d/oauth", addr.Port)
-
-	req := map[string]string{
-		"challenge":    encodedChallenge,
-		"state":        state,
-		"redirect_url": url,
-	}
-	var resp struct {
-		OK    bool
-		Error struct {
-			Code   string
-			Detail interface{}
-		}
-		Data struct {
-			AuthURL string `json:"auth_url"`
-		}
-	}
-	if err := apiReq("/login/oauth:create-session", req, &resp); err != nil {
-		return nil, fmt.Errorf("could not contact auth server: %v", err)
-	} else if !resp.OK {
-		return nil, fmt.Errorf("auth failure: code: %s", resp.Error.Code)
-	}
-
-	flow := &Flow{
-		URL:     resp.Data.AuthURL,
-		LoginCh: make(chan *conf.Config),
-
-		state:     state,
-		challenge: challenge,
-	}
-	flow.srv = &http.Server{Handler: http.HandlerFunc(flow.oauthHandler)}
-	go flow.srv.Serve(ln)
-	return flow, nil
-}
-
-// Close closes the login flow.
-func (f *Flow) Close() {
-	f.srv.Close()
-}
-
-func (f *Flow) oauthHandler(w http.ResponseWriter, req *http.Request) {
-	if req.URL.Path != "/oauth" {
-		http.Error(w, "Not Found", http.StatusNotFound)
-		return
-	}
-	code := req.FormValue("code")
-	reqState := req.FormValue("state")
-	if code == "" || reqState != f.state {
-		http.Error(w, "Bad Request (bad code or state)", http.StatusBadRequest)
-		return
+	} else if resp.Token == nil {
+		return nil, fmt.Errorf("invalid response: missing token")
 	}
 
-	reqData := map[string]string{
-		"challenge": f.challenge,
-		"code":      code,
-	}
-	var resp struct {
-		OK    bool
-		Error struct {
-			Code   string
-			Detail interface{}
-		}
-		Data struct {
-			Email string
-			Token *oauth2.Token
-		}
-	}
-	if err := apiReq("/login/oauth:exchange-token", reqData, &resp); err != nil {
-		http.Error(w, "Could not exchange token: "+err.Error(), http.StatusBadGateway)
-		return
-	} else if !resp.OK {
-		http.Error(w, "Could not exchange token: "+resp.Error.Code, http.StatusBadGateway)
-		return
-	} else if resp.Data.Token == nil {
-		http.Error(w, "Invalid response: missing token", http.StatusBadGateway)
-		return
-	}
+	tok := resp.Token
+	conf := &conf.Config{Token: *tok, Actor: resp.Actor, AppSlug: resp.AppSlug}
 
-	tok := resp.Data.Token
-	conf := &conf.Config{Token: *tok, Email: resp.Data.Email}
-	pub, priv, err := wgtunnel.GenKey()
-	if err == nil {
-		conf.WireGuard.PublicKey = pub.String()
-		conf.WireGuard.PrivateKey = priv.String()
-	}
-	select {
-	case f.LoginCh <- conf:
-		http.Redirect(w, req, "https://www.encore.dev/auth/success", http.StatusFound)
-	default:
-		http.Error(w, "Unexpected request", http.StatusBadRequest)
-	}
+	return conf, nil
 }
 
 func genRandData() (string, error) {
@@ -152,26 +45,3 @@ func genRandData() (string, error) {
 	}
 	return base64.RawURLEncoding.EncodeToString(data), nil
 }
-
-func apiReq(endpoint string, reqParams, respParams interface{}) error {
-	var body io.Reader
-	if reqParams != nil {
-		reqData, err := json.Marshal(reqParams)
-		if err != nil {
-			return err
-		}
-		body = bytes.NewReader(reqData)
-	}
-
-	resp, err := http.Post("https://api.encore.dev"+endpoint, "application/json", body)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	if respParams != nil {
-		err := json.NewDecoder(resp.Body).Decode(respParams)
-		return err
-	}
-	return nil
-}
diff --git a/cli/internal/manifest/manifest.go b/cli/internal/manifest/manifest.go
new file mode 100644
index 0000000000..9c52d81c5a
--- /dev/null
+++ b/cli/internal/manifest/manifest.go
@@ -0,0 +1,128 @@
+// Package manifest reads and writes Encore app manifests.
+package manifest
+
+import (
+	"crypto/rand"
+	"encoding/base32"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+
+	"encr.dev/pkg/xos"
+)
+
+// Manifest represents the persisted manifest for
+// an Encore application. It is not intended to be committed to
+// source control.
+type Manifest struct {
+	// AppID is a unique identifier for the app.
+	// It uses the encore.dev app slug if the app
+	// is linked, and is otherwise a randomly generated id.
+	AppID string `json:"appID,omitempty"`
+
+	// LocalID is a unique id for the app that's only used locally.
+	// It is randomly generated on first use.
+	LocalID string `json:"local_id"`
+
+	// Tutorial is set to the name of the tutorial the user is currently on or empty.
+	Tutorial string `json:"tutorial"`
+}
+
+// SetTutorial sets the tutorial field on the app manifest
+func SetTutorial(appRoot string, tutorial string) (err error) {
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("read/create manifest: %v", err)
+		}
+	}()
+
+	var man Manifest
+
+	// Use the existing manifest if we have one.
+	cfgPath := filepath.Join(appRoot, ".encore", "manifest.json")
+	if data, err := os.ReadFile(cfgPath); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return err
+	} else if err == nil {
+		err = json.Unmarshal(data, &man)
+		if err != nil {
+			return err
+		}
+	}
+
+	man.Tutorial = tutorial
+
+	// Write it back.
+	out, _ := json.Marshal(&man)
+	if err := os.MkdirAll(filepath.Dir(cfgPath), 0755); err != nil {
+		return err
+	} else if err := xos.WriteFile(cfgPath, out, 0644); err != nil {
+		return err
+	}
+	return nil
+}
+
+// ReadOrCreate reads the manifest for the app rooted at appRoot.
+// If it doesn't exist it creates it first.
+func ReadOrCreate(appRoot string) (mf *Manifest, err error) {
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("read/create manifest: %v", err)
+		}
+	}()
+
+	var man Manifest
+
+	// Use the existing manifest if we have one.
+	cfgPath := filepath.Join(appRoot, ".encore", "manifest.json")
+	if data, err := os.ReadFile(cfgPath); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return nil, err
+	} else if err == nil {
+		err = json.Unmarshal(data, &man)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Generate a local ID if we don't have one.
+	if man.LocalID == "" {
+		// If we have a legacy AppID, migrate that over to the local id.
+		if man.AppID != "" {
+			man.LocalID = man.AppID
+			man.AppID = ""
+		} else {
+			id, err := genID()
+			if err != nil {
+				return nil, err
+			}
+			man.LocalID = id
+		}
+	}
+
+	// Write it back.
+	out, _ := json.Marshal(&man)
+	if err := os.MkdirAll(filepath.Dir(cfgPath), 0755); err != nil {
+		return nil, err
+	} else if err := xos.WriteFile(cfgPath, out, 0644); err != nil {
+		return nil, err
+	}
+	return &man, nil
+}
+
+const encodeStr = "23456789abcdefghikmnopqrstuvwxyz"
+
+var encoding = base32.NewEncoding(encodeStr).WithPadding(base32.NoPadding)
+
+// genID generates a random id for a local ID
+//
+// Note: the fact this generates without a hyphen is expected and used
+// to identify a local ID vs a platform ID
+func genID() (string, error) {
+	var data [3]byte
+	if _, err := rand.Read(data[:]); err != nil {
+		return "", err
+	}
+	return encoding.EncodeToString(data[:]), nil
+}
diff --git a/cli/internal/onboarding/onboarding.go b/cli/internal/onboarding/onboarding.go
new file mode 100644
index 0000000000..46d0a8f0af
--- /dev/null
+++ b/cli/internal/onboarding/onboarding.go
@@ -0,0 +1,92 @@
+package onboarding
+
+import (
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"time"
+
+	"encr.dev/pkg/xos"
+)
+
+type Event struct {
+	time.Time
+}
+
+type State struct {
+	FirstRun   Event             `json:"first_run"`
+	DeployHint Event             `json:"deploy_hint"`
+	EventMap   map[string]*Event `json:"carousel"`
+}
+
+func (e *State) Property(prop string) *Event {
+	if e.EventMap == nil {
+		e.EventMap = map[string]*Event{}
+	}
+	_, ok := e.EventMap[prop]
+	if !ok {
+		e.EventMap[prop] = &Event{}
+	}
+	return e.EventMap[prop]
+}
+
+func (e *Event) IsSet() bool {
+	return !e.IsZero()
+}
+
+func (e *Event) Set() bool {
+	if !e.IsSet() {
+		e.Time = time.Now()
+		return true
+	}
+	return false
+}
+
+func Load() (*State, error) {
+	cfg := &State{EventMap: map[string]*Event{}}
+	path, err := configPath()
+	if err != nil {
+		return cfg, err
+	}
+
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			err = nil
+		}
+		return cfg, err
+	}
+	err = json.Unmarshal(data, &cfg)
+	if err != nil {
+		return cfg, err
+	}
+
+	if cfg.FirstRun.IsSet() && time.Since(cfg.FirstRun.Time) > 14*24*time.Hour {
+		cfg.Property("carousel").Set()
+	}
+	return cfg, err
+}
+
+func (cfg *State) Write() error {
+	path, err := configPath()
+	if err != nil {
+		return err
+	}
+	data, err := json.Marshal(cfg)
+	if err != nil {
+		return err
+	} else if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		return err
+	}
+	return xos.WriteFile(path, data, 0644)
+}
+
+func configPath() (string, error) {
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, "encore", "onboarding.json"), nil
+}
diff --git a/cli/internal/platform/api.go b/cli/internal/platform/api.go
new file mode 100644
index 0000000000..aa47fbd5cf
--- /dev/null
+++ b/cli/internal/platform/api.go
@@ -0,0 +1,180 @@
+package platform
+
+import (
+	"context"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"net/url"
+	"time"
+
+	"github.com/golang/protobuf/proto"
+	"github.com/gorilla/websocket"
+
+	"encr.dev/pkg/fns"
+	metav1 "encr.dev/proto/encore/parser/meta/v1"
+)
+
+type CreateAppParams struct {
+	Name           string
+	InitialSecrets map[string]string
+	AppRootDir     string
+}
+
+type App struct {
+	ID          string  `json:"eid"`
+	LegacyID    string  `json:"id"`
+	Slug        string  `json:"slug"`
+	Name        string  `json:"name"`
+	Description string  `json:"description"` // can be blank
+	MainBranch  *string `json:"main_branch"` // nil if not set
+}
+
+type Rollout struct {
+	ID      string `json:"id"`
+	EnvName string `json:"env_name"`
+}
+
+type Env struct {
+	ID    string `json:"id"`
+	Slug  string `json:"slug"`
+	Type  string `json:"type"`
+	Cloud string `json:"cloud"`
+}
+
+func CreateApp(ctx context.Context, p *CreateAppParams) (*App, error) {
+	var resp App
+	err := call(ctx, "POST", "/apps", p, &resp, true)
+	return &resp, err
+}
+
+func Deploy(ctx context.Context, appSlug, env, sha, branch string) (*Rollout, error) {
+	var resp Rollout
+	err := call(
+		ctx,
+		"POST",
+		fmt.Sprintf(
+			"/apps/%s/envs/%s/rollouts",
+			url.PathEscape(appSlug),
+			url.PathEscape(env),
+		), map[string]string{
+			"sha":    sha,
+			"branch": branch,
+		},
+		&resp,
+		true)
+	return &resp, err
+}
+
+func ListApps(ctx context.Context) ([]*App, error) {
+	var resp []*App
+	err := call(ctx, "GET", "/user/apps", nil, &resp, true)
+	return resp, err
+}
+
+func GetApp(ctx context.Context, appSlug string) (*App, error) {
+	var resp App
+	err := call(ctx, "GET", "/apps/"+url.PathEscape(appSlug), nil, &resp, true)
+	return &resp, err
+}
+
+func ListEnvs(ctx context.Context, appSlug string) ([]*Env, error) {
+	var resp []*Env
+	err := call(ctx, "GET", "/apps/"+url.PathEscape(appSlug)+"/envs", nil, &resp, true)
+	return resp, err
+}
+
+type SecretKind string
+
+const (
+	DevelopmentSecrets SecretKind = "development"
+	ProductionSecrets  SecretKind = "production"
+)
+
+func GetLocalSecretValues(ctx context.Context, appSlug string, poll bool) (secrets map[string]string, err error) {
+	url := "/apps/" + url.PathEscape(appSlug) + "/secrets:values?kind=development"
+	if poll {
+		url += "&poll=true"
+	}
+	err = call(ctx, "GET", url, nil, &secrets, true)
+	return secrets, err
+}
+
+type SecretVersion struct {
+	Number  int       `json:"number"`
+	Created time.Time `json:"created"`
+}
+
+func SetAppSecret(ctx context.Context, appSlug string, kind SecretKind, secretKey, value string) (*SecretVersion, error) {
+	params := struct {
+		Kind  SecretKind
+		Value string
+	}{Kind: kind, Value: value}
+	url := fmt.Sprintf("/apps/%s/secrets/%s/versions",
+		url.PathEscape(appSlug),
+		url.PathEscape(secretKey),
+	)
+	var resp SecretVersion
+	err := call(ctx, "POST", url, &params, &resp, true)
+	return &resp, err
+}
+
+func GetEnvMeta(ctx context.Context, appSlug, envName string) (*metav1.Data, error) {
+	url := "/apps/" + url.PathEscape(appSlug) + "/envs/" + url.PathEscape(envName) + "/meta"
+	body, err := rawCall(ctx, "GET", url, nil, true)
+	if err != nil {
+		return nil, err
+	}
+	defer fns.CloseIgnore(body)
+	data, err := io.ReadAll(body)
+	if err != nil {
+		return nil, fmt.Errorf("platform.GetEnvMeta: %v", err)
+	}
+	var md metav1.Data
+	if err := proto.Unmarshal(data, &md); err != nil {
+		return nil, fmt.Errorf("platform.GetEnvMeta: %v", err)
+	}
+	return &md, nil
+}
+
+func DBConnect(ctx context.Context, appSlug, envSlug, dbName, role string, startupData []byte) (*websocket.Conn, error) {
+	path := escapef("/apps/%s/envs/%s/sqldb-connect/%s", appSlug, envSlug, dbName)
+	if role != "" {
+		path += "?role=" + url.QueryEscape(role)
+	}
+	return wsDial(ctx, path, true, map[string]string{
+		"X-Startup-Message": base64.StdEncoding.EncodeToString(startupData),
+	})
+}
+
+func EnvLogs(ctx context.Context, appSlug, envSlug string) (*websocket.Conn, error) {
+	path := escapef("/apps/%s/envs/%s/log", appSlug, envSlug)
+	return wsDial(ctx, path, true, nil)
+}
+
+func KubernetesClusters(ctx context.Context, appSlug string, envName string) (string, string, []KubeCtlConfig, error) {
+	type K8SClusterConfigs struct {
+		AppSlug  string          `json:"app"`
+		EnvName  string          `json:"env"`
+		Clusters []KubeCtlConfig `json:"clusters"`
+	}
+
+	var resp K8SClusterConfigs
+	err := call(ctx, "GET", "/apps/"+url.PathEscape(appSlug)+"/envs/"+url.PathEscape(envName)+"/k8s-clusters", nil, &resp, true)
+	return resp.AppSlug, resp.EnvName, resp.Clusters, err
+}
+
+type KubeCtlConfig struct {
+	EnvID            string `json:"env_id"`              // The ID of the environment
+	ResID            string `json:"res_id"`              // The ID of the cluster
+	Name             string `json:"name"`                // The name of the cluster
+	DefaultNamespace string `json:"namespace,omitempty"` // The default namespace for the cluster (if any)
+}
+
+func escapef(format string, args ...string) string {
+	ifaces := make([]interface{}, len(args))
+	for i, arg := range args {
+		ifaces[i] = url.PathEscape(arg)
+	}
+	return fmt.Sprintf(format, ifaces...)
+}
diff --git a/cli/internal/platform/client.go b/cli/internal/platform/client.go
new file mode 100644
index 0000000000..6de6ee91b3
--- /dev/null
+++ b/cli/internal/platform/client.go
@@ -0,0 +1,270 @@
+package platform
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"runtime"
+
+	"github.com/gorilla/websocket"
+	jsoniter "github.com/json-iterator/go"
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/cli/internal/platform/gql"
+	"encr.dev/internal/conf"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/fns"
+)
+
+type Error struct {
+	HTTPStatus string `json:"-"`
+	HTTPCode   int    `json:"-"`
+	Code       string
+	Detail     json.RawMessage
+}
+
+type ValidationDetails struct {
+	Field string `json:"field"`
+	Type  string `json:"type"`
+}
+
+func (e Error) Error() string {
+	if len(e.Detail) > 0 {
+		return fmt.Sprintf("http %s: code=%s detail=%s", e.HTTPStatus, e.Code, e.Detail)
+	}
+	return fmt.Sprintf("http %s: code=%s", e.HTTPStatus, e.Code)
+}
+
+// call makes a call to the API endpoint given by method and path.
+// If reqParams and respParams are non-nil they are JSON-marshalled/unmarshalled.
+func call(ctx context.Context, method, path string, reqParams, respParams interface{}, auth bool) (err error) {
+	log.Trace().Interface("request", reqParams).Msgf("->     %s %s", method, path)
+	defer func() {
+		if err != nil {
+			log.Trace().Err(err).Msgf("<- ERR %s %s", method, path)
+		} else {
+			log.Trace().Interface("response", respParams).Msgf("<- OK  %s %s", method, path)
+		}
+	}()
+
+	resp, err := sendPlatformReq(ctx, method, path, reqParams, auth)
+	if err != nil {
+		return err
+	}
+	defer fns.CloseIgnore(resp.Body)
+
+	var respStruct struct {
+		OK    bool
+		Error Error
+		Data  json.RawMessage
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&respStruct); err != nil {
+		return fmt.Errorf("decode response: %v", err)
+	} else if !respStruct.OK {
+		e := respStruct.Error
+		e.HTTPCode = resp.StatusCode
+		e.HTTPStatus = resp.Status
+		return e
+	}
+
+	if respParams != nil {
+		if err := json.Unmarshal([]byte(respStruct.Data), respParams); err != nil {
+			return fmt.Errorf("decode response data: %v", err)
+		}
+	}
+	return nil
+}
+
+type graphqlRequest struct {
+	Query         string                 `json:"query"`
+	Variables     map[string]interface{} `json:"variables,omitempty"`
+	OperationName string                 `json:"operationName,omitempty"`
+	Extensions    map[string]interface{} `json:"extensions,omitempty"`
+}
+
+var graphqlDecoder = (func() jsoniter.API {
+	enc := jsoniter.Config{}.Froze()
+	enc.RegisterExtension(NewInterfaceCodecExtension())
+	return enc
+})()
+
+// graphqlCall makes a GraphQL request.
+func graphqlCall(ctx context.Context, req graphqlRequest, respData any, auth bool) (err error) {
+	log.Trace().Msgf("->     graphql %s: %+v", req.OperationName, req.Variables)
+	httpResp, err := sendPlatformReq(ctx, "POST", "/graphql", req, auth)
+	if err != nil {
+		return err
+	}
+	defer fns.CloseIgnore(httpResp.Body)
+
+	var respStruct struct {
+		Data       json.RawMessage
+		Errors     gql.ErrorList
+		Extensions map[string]interface{}
+	}
+	defer func() {
+		if err != nil {
+			log.Trace().Msgf("<- ERR graphql %s: %v", req.OperationName, err)
+		} else {
+			log.Trace().Msgf("<- OK  graphql %s: %s", req.OperationName, respStruct.Data)
+		}
+	}()
+
+	if err := json.NewDecoder(httpResp.Body).Decode(&respStruct); err != nil {
+		return fmt.Errorf("decode response: %v", err)
+	} else if len(respStruct.Errors) > 0 {
+		return fmt.Errorf("graphql request failed: %w", respStruct.Errors)
+	}
+	if respData != nil {
+		if err := graphqlDecoder.NewDecoder(bytes.NewReader(respStruct.Data)).Decode(respData); err != nil {
+			return fmt.Errorf("decode graphql data: %v", err)
+		}
+	}
+	return nil
+}
+
+// rawCall makes a call to the API endpoint given by method and path.
+// It returns the raw HTTP response body on success; it must be closed by the caller.
+func rawCall(ctx context.Context, method, path string, reqParams interface{}, auth bool) (respBody io.ReadCloser, err error) {
+	log.Trace().Msgf("->     %s %s: %+v", method, path, reqParams)
+	defer func() {
+		if err != nil {
+			log.Trace().Msgf("<- ERR %s %s: %v", method, path, err)
+		} else {
+			log.Trace().Msgf("<- OK  %s %s", method, path)
+		}
+	}()
+
+	resp, err := sendPlatformReq(ctx, method, path, reqParams, auth)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if err != nil {
+			_ = resp.Body.Close()
+		}
+	}()
+
+	if resp.StatusCode >= 400 {
+		return nil, decodeErrorResponse(resp)
+	}
+
+	return resp.Body, nil
+}
+
+func sendPlatformReq(ctx context.Context, method, path string, reqParams any, auth bool) (httpResp *http.Response, err error) {
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("%s %s: %w", method, path, err)
+		}
+	}()
+
+	var body io.Reader
+	if reqParams != nil {
+		reqData, err := json.Marshal(reqParams)
+		if err != nil {
+			return nil, fmt.Errorf("marshal request: %v", err)
+		}
+		body = bytes.NewReader(reqData)
+	}
+
+	req, err := http.NewRequestWithContext(ctx, method, conf.APIBaseURL+path, body)
+	if err != nil {
+		return nil, err
+	}
+	if reqParams != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+
+	return doPlatformReq(req, auth)
+}
+
+func doPlatformReq(req *http.Request, auth bool) (httpResp *http.Response, err error) {
+	// Add a very limited amount of information for diagnostics
+	req.Header.Set("User-Agent", "EncoreCLI/"+version.Version)
+	req.Header.Set("X-Encore-Version", version.Version)
+	req.Header.Set("X-Encore-GOOS", runtime.GOOS)
+	req.Header.Set("X-Encore-GOARCH", runtime.GOARCH)
+
+	client := http.DefaultClient
+	if auth {
+		client = conf.AuthClient
+	}
+	return client.Do(req)
+}
+
+// wsDial sets up a WebSocket connection to the API endpoint given by method and path.
+func wsDial(ctx context.Context, path string, auth bool, extraHeaders map[string]string) (ws *websocket.Conn, err error) {
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("WS %s: %w", path, err)
+		}
+	}()
+
+	// Add a very limited amount of information for diagnostics
+	header := make(http.Header)
+	header.Set("User-Agent", "EncoreCLI/"+version.Version)
+	header.Set("X-Encore-Version", version.Version)
+	header.Set("X-Encore-GOOS", runtime.GOOS)
+	header.Set("X-Encore-GOARCH", runtime.GOARCH)
+	header.Set("Origin", "http://encore-cli.local")
+	for k, v := range extraHeaders {
+		header.Set(k, v)
+	}
+
+	log.Trace().Msgf("->     %s %s: %+v", "WS", path, extraHeaders)
+	defer func() {
+		if err != nil {
+			log.Trace().Msgf("<- ERR %s %s: %v", "WS", path, err)
+		} else {
+			log.Trace().Msgf("<- OK  %s %s", "WS", path)
+		}
+	}()
+
+	if auth {
+		tok, err := conf.DefaultTokenSource.Token()
+		if err != nil {
+			return nil, err
+		}
+		header.Set("Authorization", "Bearer "+tok.AccessToken)
+	}
+
+	url := conf.WSBaseURL + path
+	log.Trace().Msgf("->     %s %s: connecting to %s", "WS", path, url)
+	ws, httpResp, err := websocket.DefaultDialer.DialContext(ctx, url, header)
+	if httpResp != nil && httpResp.StatusCode >= 400 {
+		var respStruct struct {
+			OK    bool
+			Error Error
+			Data  json.RawMessage
+		}
+		if err := json.NewDecoder(httpResp.Body).Decode(&respStruct); err != nil {
+			return nil, fmt.Errorf("decode response: %v", err)
+		} else if !respStruct.OK {
+			e := respStruct.Error
+			e.HTTPCode = httpResp.StatusCode
+			e.HTTPStatus = httpResp.Status
+			return nil, e
+		}
+	}
+
+	return ws, err
+}
+
+func decodeErrorResponse(resp *http.Response) error {
+	var respStruct struct {
+		OK    bool
+		Error Error
+		Data  json.RawMessage
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&respStruct); err != nil {
+		return fmt.Errorf("decode response: %v", err)
+	}
+	e := respStruct.Error
+	e.HTTPCode = resp.StatusCode
+	e.HTTPStatus = resp.Status
+	return e
+}
diff --git a/cli/internal/platform/gql/app.go b/cli/internal/platform/gql/app.go
new file mode 100644
index 0000000000..c41eae57df
--- /dev/null
+++ b/cli/internal/platform/gql/app.go
@@ -0,0 +1,32 @@
+package gql
+
+import (
+	"encoding/json"
+	"fmt"
+)
+
+type App struct {
+	ID   string
+	Slug string
+}
+
+type Error struct {
+	Message    string                     `json:"message"`
+	Path       []string                   `json:"path"`
+	Extensions map[string]json.RawMessage `json:"extensions"`
+}
+
+func (e *Error) Error() string {
+	return e.Message
+}
+
+type ErrorList []*Error
+
+func (err ErrorList) Error() string {
+	if len(err) == 0 {
+		return "no errors"
+	} else if len(err) == 1 {
+		return err[0].Error()
+	}
+	return fmt.Sprintf("%s (and %d more errors)", err[0].Error(), len(err)-1)
+}
diff --git a/cli/internal/platform/gql/env.go b/cli/internal/platform/gql/env.go
new file mode 100644
index 0000000000..1706bc4c34
--- /dev/null
+++ b/cli/internal/platform/gql/env.go
@@ -0,0 +1,7 @@
+package gql
+
+type Env struct {
+	ID   string
+	App  *App
+	Name string
+}
diff --git a/cli/internal/platform/gql/secrets.go b/cli/internal/platform/gql/secrets.go
new file mode 100644
index 0000000000..15bc0369cb
--- /dev/null
+++ b/cli/internal/platform/gql/secrets.go
@@ -0,0 +1,58 @@
+package gql
+
+import (
+	"time"
+
+	"github.com/modern-go/reflect2"
+)
+
+type Secret struct {
+	Key    string
+	Groups []*SecretGroup
+}
+
+type SecretGroup struct {
+	ID          string
+	Key         string
+	Selector    []SecretSelector
+	Description string
+	Etag        string
+	ArchivedAt  *time.Time
+}
+
+type SecretSelector interface {
+	secretSelector()
+	String() string
+}
+
+type SecretSelectorEnvType struct {
+	Kind string
+}
+
+func (SecretSelectorEnvType) secretSelector()   {}
+func (s *SecretSelectorEnvType) String() string { return "type:" + s.Kind }
+
+type SecretSelectorSpecificEnv struct {
+	Env *Env
+}
+
+func (s *SecretSelectorSpecificEnv) String() string { return "id:" + s.Env.ID }
+func (SecretSelectorSpecificEnv) secretSelector()   {}
+
+type ConflictError struct {
+	AppID     string
+	Key       string
+	Conflicts []GroupConflict
+}
+
+type GroupConflict struct {
+	GroupID   string
+	Conflicts []string
+}
+
+// TypeRegistry contains all the types that are used in the graphql schema,
+// in order to ensure they are not dead-code eliminated.
+var TypeRegistry = []reflect2.Type{
+	reflect2.TypeOf((*SecretSelectorEnvType)(nil)),
+	reflect2.TypeOf((*SecretSelectorSpecificEnv)(nil)),
+}
diff --git a/cli/internal/platform/jsoniter_ext.go b/cli/internal/platform/jsoniter_ext.go
new file mode 100644
index 0000000000..f881001831
--- /dev/null
+++ b/cli/internal/platform/jsoniter_ext.go
@@ -0,0 +1,75 @@
+package platform
+
+import (
+	"reflect"
+	"unsafe"
+
+	jsoniter "github.com/json-iterator/go"
+	"github.com/modern-go/reflect2"
+)
+
+// InterfaceCodecExtension is used to decode interface fields
+// it'll store the type of the values in a wrapper object
+type InterfaceCodecExtension struct {
+	jsoniter.DummyExtension
+}
+
+func NewInterfaceCodecExtension() *InterfaceCodecExtension {
+	return &InterfaceCodecExtension{}
+}
+
+func (e *InterfaceCodecExtension) DecorateDecoder(typ reflect2.Type, decoder jsoniter.ValDecoder) jsoniter.ValDecoder {
+	if typ.Kind() == reflect.Interface {
+		return &interfaceCodec{typ: typ, decoder: decoder}
+	}
+	return decoder
+}
+
+const gqlPackage = "encr.dev/cli/internal/platform/gql"
+
+type interfaceCodec struct {
+	typ     reflect2.Type
+	decoder jsoniter.ValDecoder
+}
+
+// Decode decodes an interface value from a iterator
+func (codec *interfaceCodec) Decode(ptr unsafe.Pointer, iter *jsoniter.Iterator) {
+	// if it's not an objectvalue, we don't need to bother
+	if iter.WhatIsNext() != jsoniter.ObjectValue {
+		codec.decoder.Decode(ptr, iter)
+		return
+	}
+
+	// if it is, we try to resolve the pkgPath, type and content
+	val := iter.ReadAny()
+	typeName := val.Get("__typename").ToString()
+	if typeName == "" {
+		iter.ReportError("InterfaceCodecExtension", "missing __typename field")
+		return
+	}
+
+	// try to instantiate the type
+	t := reflect2.TypeByPackageName(gqlPackage, typeName)
+	if t == nil {
+		iter.ReportError("InterfaceCodecExtension", "cannot find type "+typeName+" in package "+gqlPackage)
+		return
+	}
+
+	// Need to create a pointer to the pointer of the type to be able to be able
+	// to replace placeholder values with the actual values
+	item := reflect2.PtrTo(reflect2.PtrTo(t)).New()
+	val.ToVal(item)
+	if err := val.LastError(); err != nil {
+		iter.ReportError("decode", err.Error())
+		return
+	}
+
+	n := reflect.New(codec.typ.Type1())
+	n.Elem().Set(reflect.ValueOf(item).Elem().Elem())
+	codec.typ.UnsafeSet(ptr, n.UnsafePointer())
+}
+
+// IsEmpty checks if a ptr is empty/nil
+func (codec *interfaceCodec) IsEmpty(ptr unsafe.Pointer) bool {
+	return codec.typ.UnsafeIsNil(ptr)
+}
diff --git a/cli/internal/platform/jsoniter_ext_test.go b/cli/internal/platform/jsoniter_ext_test.go
new file mode 100644
index 0000000000..a851dfe3b5
--- /dev/null
+++ b/cli/internal/platform/jsoniter_ext_test.go
@@ -0,0 +1,35 @@
+package platform
+
+import (
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	jsoniter "github.com/json-iterator/go"
+
+	"encr.dev/cli/internal/platform/gql"
+)
+
+func TestInterfaceDecoder(t *testing.T) {
+	c := qt.New(t)
+	enc := jsoniter.Config{}.Froze()
+	enc.RegisterExtension(NewInterfaceCodecExtension())
+
+	data := []byte(`{
+	"key": "test",
+	"selector": [
+		{"__typename": "SecretSelectorEnvType", "kind": "type:production"},
+		{"__typename": "SecretSelectorSpecificEnv", "env": {"name": "test"}}
+	]
+}`)
+
+	var group *gql.SecretGroup
+	err := enc.Unmarshal(data, &group)
+	c.Assert(err, qt.IsNil)
+	c.Assert(group, qt.DeepEquals, &gql.SecretGroup{
+		Key: "test",
+		Selector: []gql.SecretSelector{
+			&gql.SecretSelectorEnvType{Kind: "type:production"},
+			&gql.SecretSelectorSpecificEnv{Env: &gql.Env{Name: "test"}},
+		},
+	})
+}
diff --git a/cli/internal/platform/login.go b/cli/internal/platform/login.go
new file mode 100644
index 0000000000..bae2a015da
--- /dev/null
+++ b/cli/internal/platform/login.go
@@ -0,0 +1,151 @@
+package platform
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"golang.org/x/oauth2"
+
+	"encr.dev/internal/conf"
+)
+
+type CreateOAuthSessionParams struct {
+	Challenge   string `json:"challenge"`
+	State       string `json:"state"`
+	RedirectURL string `json:"redirect_url"`
+}
+
+func CreateOAuthSession(ctx context.Context, p *CreateOAuthSessionParams) (authURL string, err error) {
+	var resp struct {
+		AuthURL string `json:"auth_url"`
+	}
+	err = call(ctx, "POST", "/login/oauth:create-session", p, &resp, false)
+	return resp.AuthURL, err
+}
+
+type BeginAuthorizationFlowParams struct {
+	CodeChallenge string
+	ClientID      string
+}
+
+type BeginAuthorizationFlowResponse struct {
+	// DeviceCode is the device verification code.
+	DeviceCode string `json:"device_code"`
+
+	// UserCode is the end-user verification code.
+	UserCode string `json:"user_code"`
+
+	// VerificationURI is the end-user URL to use to login.
+	VerificationURI string `json:"verification_uri"`
+
+	// ExpiresIn is the lifetime in seconds of the device code and user code.
+	ExpiresIn int `json:"expires_in"`
+
+	// Interval is the number of seconds to wait between polling requests.
+	// If not provided, defaults to 5.
+	Interval int `json:"interval,omitempty"`
+}
+
+func BeginDeviceAuthFlow(ctx context.Context, p BeginAuthorizationFlowParams) (*BeginAuthorizationFlowResponse, error) {
+	vals := url.Values{}
+	vals.Set("code_challenge", p.CodeChallenge)
+	vals.Set("client_id", p.ClientID)
+	body := strings.NewReader(vals.Encode())
+
+	req, err := http.NewRequestWithContext(ctx, "POST", conf.APIBaseURL+"/oauth/device-auth", body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := doPlatformReq(req, false)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return nil, decodeErrorResponse(resp)
+	}
+	var respData BeginAuthorizationFlowResponse
+	if err := json.NewDecoder(resp.Body).Decode(&respData); err != nil {
+		return nil, fmt.Errorf("decoding response body: %w", err)
+	}
+	return &respData, nil
+}
+
+type PollDeviceAuthFlowParams struct {
+	DeviceCode   string
+	CodeVerifier string
+}
+
+type OAuthToken struct {
+	*oauth2.Token
+	Actor   string `json:"actor,omitempty"` // The ID of the user or app that authorized the token.
+	Email   string `json:"email"`           // empty if logging in as an app
+	AppSlug string `json:"app_slug"`        // empty if logging in as a user
+}
+
+func PollDeviceAuthFlow(ctx context.Context, p PollDeviceAuthFlowParams) (*OAuthToken, error) {
+	vals := url.Values{}
+	vals.Set("grant_type", "urn:ietf:params:oauth:grant-type:device_code")
+	vals.Set("device_code", p.DeviceCode)
+	vals.Set("code_verifier", p.CodeVerifier)
+	body := strings.NewReader(vals.Encode())
+
+	req, err := http.NewRequestWithContext(ctx, "POST", conf.APIBaseURL+"/oauth/token", body)
+	if err != nil {
+		return nil, err
+	}
+
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := doPlatformReq(req, false)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return nil, decodeErrorResponse(resp)
+	}
+
+	var tok OAuthToken
+	if err := json.NewDecoder(resp.Body).Decode(&tok); err != nil {
+		return nil, fmt.Errorf("decoding response body: %w", err)
+	}
+	return &tok, nil
+}
+
+type ExchangeOAuthTokenParams struct {
+	Challenge string `json:"challenge"`
+	Code      string `json:"code"`
+}
+
+type OAuthData struct {
+	Token   *oauth2.Token `json:"token"`
+	Actor   string        `json:"actor,omitempty"` // The ID of the user or app that authorized the token.
+	Email   string        `json:"email"`           // empty if logging in as an app
+	AppSlug string        `json:"app_slug"`        // empty if logging in as a user
+}
+
+func ExchangeOAuthToken(ctx context.Context, p *ExchangeOAuthTokenParams) (*OAuthData, error) {
+	var resp OAuthData
+	err := call(ctx, "POST", "/login/oauth:exchange-token", p, &resp, false)
+	return &resp, err
+}
+
+type ExchangeAuthKeyParams struct {
+	AuthKey string `json:"auth_key"`
+}
+
+func ExchangeAuthKey(ctx context.Context, p *ExchangeAuthKeyParams) (*OAuthData, error) {
+	var resp OAuthData
+	err := call(ctx, "POST", "/login/auth-key", p, &resp, false)
+	return &resp, err
+}
diff --git a/cli/internal/platform/secrets.go b/cli/internal/platform/secrets.go
new file mode 100644
index 0000000000..5cb67dcdc1
--- /dev/null
+++ b/cli/internal/platform/secrets.go
@@ -0,0 +1,159 @@
+package platform
+
+import (
+	"context"
+
+	"github.com/cockroachdb/errors"
+
+	"encr.dev/cli/internal/platform/gql"
+)
+
+func ListSecretGroups(ctx context.Context, appSlug string, keys []string) ([]*gql.Secret, error) {
+	query := `
+query ListSecretGroups($appSlug: String!, $keys: [String!]) {
+	app(slug: $appSlug) {
+		secrets(keys: $keys) {
+			key
+			groups {
+				id, etag, description, archivedAt
+				selector {
+					__typename
+					...on SecretSelectorEnvType {
+						kind
+					}
+					...on SecretSelectorSpecificEnv {
+						env { id, name }
+					}
+				}
+				versions { id }
+			}
+		}
+	}
+}`
+	var out struct {
+		App struct {
+			*gql.App
+			Secrets []*gql.Secret
+		}
+	}
+
+	in := graphqlRequest{Query: query, Variables: map[string]any{"appSlug": appSlug, "keys": keys}}
+	if err := graphqlCall(ctx, in, &out, true); err != nil {
+		return nil, err
+	}
+	return out.App.Secrets, nil
+}
+
+type CreateSecretGroupParams struct {
+	AppID          string
+	Key            string
+	PlaintextValue string
+	Description    string
+	Selector       []gql.SecretSelector
+}
+
+func CreateSecretGroup(ctx context.Context, p CreateSecretGroupParams) error {
+	query := `
+mutation CreateSecretGroup($input: CreateSecretGroups!) {
+	createSecretGroups(input: $input) { id }
+}`
+	envTypes, envIDs, err := mapSecretSelector(p.Selector)
+	if err != nil {
+		return err
+	}
+
+	in := graphqlRequest{Query: query, Variables: map[string]any{"input": map[string]any{
+		"appID": p.AppID,
+		"key":   p.Key,
+		"entries": []map[string]any{
+			{
+				"plaintextValue": p.PlaintextValue,
+				"envTypes":       envTypes,
+				"envIDs":         envIDs,
+				"description":    p.Description,
+			},
+		},
+	}}}
+	if err := graphqlCall(ctx, in, nil, true); err != nil {
+		return errors.Wrap(err, "create secret group")
+	}
+	return nil
+}
+
+type CreateSecretVersionParams struct {
+	GroupID        string
+	PlaintextValue string
+	Etag           string
+}
+
+func CreateSecretVersion(ctx context.Context, p CreateSecretVersionParams) error {
+	query := `
+mutation CreateSecretVersion($input: CreateSecretVersion!) {
+	createSecretVersion(input: $input) { id }
+}`
+	in := graphqlRequest{Query: query, Variables: map[string]any{"input": map[string]any{
+		"groupID":        p.GroupID,
+		"plaintextValue": p.PlaintextValue,
+		"etag":           p.Etag,
+	}}}
+	if err := graphqlCall(ctx, in, nil, true); err != nil {
+		return errors.Wrap(err, "create secret version")
+	}
+	return nil
+}
+
+type UpdateSecretGroupParams struct {
+	ID   string
+	Etag *string
+
+	// Nil fore ach field here means it's kept unchanged.
+	Selector    []gql.SecretSelector // nil means no changes
+	Archived    *bool
+	Description *string
+}
+
+func UpdateSecretGroup(ctx context.Context, p UpdateSecretGroupParams) error {
+	query := `
+mutation UpdateSecretGroup($input: UpdateSecretGroup!) {
+	updateSecretGroup(input: $input) { id }
+}`
+
+	var selector map[string]any
+	if p.Selector != nil {
+		envTypes, envIDs, err := mapSecretSelector(p.Selector)
+		if err != nil {
+			return err
+		}
+		selector = map[string]any{
+			"envTypes": envTypes,
+			"envIDs":   envIDs,
+		}
+	}
+
+	in := graphqlRequest{Query: query, Variables: map[string]any{"input": map[string]any{
+		"id":          p.ID,
+		"etag":        p.Etag,
+		"selector":    selector,
+		"archived":    p.Archived,
+		"description": p.Description,
+	}}}
+	if err := graphqlCall(ctx, in, nil, true); err != nil {
+		return errors.Wrap(err, "update secret group")
+	}
+	return nil
+}
+
+func mapSecretSelector(selector []gql.SecretSelector) (envTypes, envIDs []string, err error) {
+	envTypes, envIDs = []string{}, []string{}
+	for _, sel := range selector {
+		switch s := sel.(type) {
+		case *gql.SecretSelectorEnvType:
+			envTypes = append(envTypes, s.Kind)
+		case *gql.SecretSelectorSpecificEnv:
+			envIDs = append(envIDs, s.Env.ID)
+		default:
+			return nil, nil, errors.Newf("unknown secret selector type %T", s)
+		}
+	}
+	return envTypes, envIDs, nil
+}
diff --git a/cli/internal/telemetry/telemetry.go b/cli/internal/telemetry/telemetry.go
new file mode 100644
index 0000000000..36d483878f
--- /dev/null
+++ b/cli/internal/telemetry/telemetry.go
@@ -0,0 +1,206 @@
+package telemetry
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"sync"
+
+	"github.com/hasura/go-graphql-client"
+	"github.com/rs/zerolog/log"
+
+	"encore.dev/types/uuid"
+	"encr.dev/internal/conf"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/xos"
+)
+
+var singleton = func() *telemetry {
+	t := &telemetry{
+		client: graphql.NewClient(conf.APIBaseURL+"/graphql", conf.DefaultClient),
+	}
+	path, err := configPath()
+	if err != nil {
+		return t
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			// If the file does not exist, telemetry is enabled by default
+			t.cfg.Enabled = true
+			t.cfg.AnonID = uuid.Must(uuid.NewV4()).String()
+			t.cfg.SentEvents = make(map[string]struct{})
+			_ = t.saveConfig()
+			err = nil
+		}
+		return t
+	}
+	err = json.Unmarshal(data, &t.cfg)
+	if err != nil {
+		log.Debug().Err(err).Msg("failed to unmarshal telemetry config")
+	}
+	return t
+}()
+
+type telemetry struct {
+	mu     sync.Mutex
+	cfg    telemetryCfg
+	client *graphql.Client
+}
+
+type telemetryCfg struct {
+	Enabled      bool                `json:"enabled"`
+	AnonID       string              `json:"anon_id"`
+	SentEvents   map[string]struct{} `json:"sent_events"`
+	ShownWarning bool                `json:"shown_warning"`
+	Debug        bool                `json:"debug"`
+}
+
+type TelemetryMessage struct {
+	Event       string         `json:"event"`
+	AnonymousId string         `json:"anonymousId"`
+	Properties  map[string]any `json:"properties,omitempty"`
+}
+
+func (t *telemetry) sendOnce(event string, props ...map[string]any) {
+	t.mu.Lock()
+	if _, ok := t.cfg.SentEvents[event]; ok {
+		t.mu.Unlock()
+		return
+	}
+	t.cfg.SentEvents[event] = struct{}{}
+	if err := t.saveConfig(); err != nil {
+		log.Debug().Err(err).Msg("failed to save telemetry config")
+	}
+	t.mu.Unlock()
+	if err := t.send(event, props...); err != nil {
+		log.Debug().Err(err).Msg("failed to send telemetry message")
+		t.mu.Lock()
+		delete(t.cfg.SentEvents, event)
+		t.mu.Unlock()
+	}
+}
+
+func (t *telemetry) send(event string, props ...map[string]any) error {
+	var m struct {
+		Result bool `graphql:"telemetry(msg: $msg)"`
+	}
+	message := TelemetryMessage{
+		Event:       event,
+		AnonymousId: t.cfg.AnonID,
+		Properties:  fns.MergeMaps(props...),
+	}
+	if t.cfg.Debug {
+		data, err := json.Marshal(message)
+		if err != nil {
+			log.Info().Msgf("[telemetry] failed to marshal message")
+		} else {
+			log.Info().Msgf("[telemetry] %s", string(data))
+		}
+	}
+	err := t.client.Mutate(context.Background(), &m, map[string]any{
+		"msg": message})
+	if !m.Result {
+		return errors.New("failed to send telemetry message")
+	}
+	return err
+}
+
+func (t *telemetry) trySend(event string, props ...map[string]any) {
+	if err := t.send(event, props...); err != nil {
+		log.Debug().Msg("failed to send telemetry message")
+	}
+}
+
+func (t *telemetry) saveConfig() error {
+	// Write the telemetry configuration to a file
+	path, err := configPath()
+	if err != nil {
+		return err
+	}
+	data, err := json.Marshal(t.cfg)
+	if err != nil {
+		return err
+	}
+	if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		return err
+	}
+	return xos.WriteFile(path, data, 0644)
+}
+
+func IsEnabled() bool {
+	return singleton.cfg.Enabled
+}
+
+func SetEnabled(enabled bool) bool {
+	return UpdateConfig(singleton.cfg.AnonID, enabled, singleton.cfg.Debug)
+}
+
+func SetDebug(debug bool) bool {
+	return UpdateConfig(singleton.cfg.AnonID, singleton.cfg.Enabled, debug)
+}
+
+func UpdateConfig(anonID string, enabled, debug bool) (changed bool) {
+	changed = singleton.cfg.Enabled != enabled ||
+		singleton.cfg.Debug != debug ||
+		singleton.cfg.AnonID != anonID
+	singleton.cfg.AnonID = anonID
+	singleton.cfg.Enabled = enabled
+	singleton.cfg.Debug = debug
+	return changed
+}
+
+func ShouldShowWarning() bool {
+	return !singleton.cfg.ShownWarning && IsEnabled()
+}
+
+func SetShownWarning() {
+	singleton.cfg.ShownWarning = true
+	if err := singleton.saveConfig(); err != nil {
+		log.Debug().Err(err).Msg("failed to save telemetry config")
+	}
+}
+
+func SaveConfig() error {
+	return singleton.saveConfig()
+}
+
+func SendOnce(event string, props ...map[string]any) {
+	if !IsEnabled() {
+		return
+	}
+	go singleton.sendOnce(event, props...)
+}
+
+func Send(event string, props ...map[string]any) {
+	if !IsEnabled() {
+		return
+	}
+	go singleton.trySend(event, props...)
+}
+
+func SendSync(event string, props ...map[string]any) {
+	if !IsEnabled() {
+		return
+	}
+	singleton.trySend(event, props...)
+}
+
+func configPath() (string, error) {
+	dir, err := os.UserConfigDir()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(dir, "encore", "telemetry.json"), nil
+}
+
+func GetAnonID() string {
+	return singleton.cfg.AnonID
+}
+
+func IsDebug() bool {
+	return singleton.cfg.Debug
+}
diff --git a/cli/internal/update/update.go b/cli/internal/update/update.go
new file mode 100644
index 0000000000..5630d4e100
--- /dev/null
+++ b/cli/internal/update/update.go
@@ -0,0 +1,287 @@
+package update
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strconv"
+	"strings"
+
+	"golang.org/x/mod/semver"
+
+	"encr.dev/internal/conf"
+	"encr.dev/internal/version"
+)
+
+var ErrUnknownVersion = errors.New("unknown version")
+
+// Check checks for the latest Encore version.
+// It reports ErrUnknownVersion if it cannot determine the version.
+func Check(ctx context.Context) (latestVersion *LatestVersion, err error) {
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("update.Check: %w", err)
+		}
+	}()
+
+	releaseAPI, err := url.Parse("https://encore.dev/api/releases")
+	if err != nil {
+		return nil, fmt.Errorf("parse release api url: %w", err)
+	}
+
+	// Filter the request down to the release for the current version.
+	qry := releaseAPI.Query()
+
+	// These three are used to determine the latest release for the given channel, os and arch
+	qry.Set("channel", string(version.Channel))
+	qry.Set("os", runtime.GOOS)
+	qry.Set("arch", runtime.GOARCH)
+
+	// This is used to determine if the returned release contains security updates not present
+	// in the currently running version of Encore, as well as if we need to force an upgrade
+	// on the user due to a critical security issue.
+	qry.Set("current", version.Version)
+
+	// For specific app ID's or user ID's we can provide pre-releases to them
+	// Mainly used if they've encountered a bug and we need to get them a fix asap for testing
+	if cfg, err := conf.CurrentUser(); err == nil && cfg != nil {
+		qry.Set("actor", cfg.Actor)
+	}
+
+	releaseAPI.RawQuery = qry.Encode()
+
+	// url := "https://encore.dev/api/releases"
+	req, err := http.NewRequestWithContext(ctx, "GET", releaseAPI.String(), nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return nil, fmt.Errorf("GET %s: responded with %s: %s", releaseAPI, resp.Status, body)
+	}
+
+	latestVersion = &LatestVersion{}
+	if err := json.NewDecoder(resp.Body).Decode(latestVersion); err != nil {
+		return nil, fmt.Errorf("GET %s: invalid json: %v", releaseAPI, err)
+	}
+
+	if !latestVersion.Supported && latestVersion.Channel != version.DevBuild {
+		return nil, ErrUnknownVersion
+	}
+
+	return latestVersion, nil
+}
+
+// LatestVersion contains the parsed response from the update server
+type LatestVersion struct {
+	// The channel the release is from
+	Channel version.ReleaseChannel `json:"channel"`
+
+	// Whether the requested target is supported or not
+	Supported bool `json:"supported"`
+
+	// The latest version available
+	// Access via Version() to ensure the version is prefixed with "v" for GA releases
+	RawVersion string `json:"version"`
+
+	// The URL for that version (if supported)
+	URL string `json:"url,omitempty"`
+
+	// Whether the version contains a security fix from the current version running
+	SecurityUpdate bool `json:"security_update"`
+
+	// Optional notes about what the security update fixes and why the user should install it
+	SecurityNotes string `json:"security_notes,omitempty"`
+
+	// If we need to force an upgrade. This is only used for security updates and only for
+	// the most urgent ones, i.e we should never use it unless the world is on fire.
+	ForceUpgrade bool `json:"force_upgrade,omitempty"`
+}
+
+// Version returns the version string referenced by the LatestVersion.
+// ensuring that it is prefixed with "v" for GA releases.
+func (lv *LatestVersion) Version() string {
+	// Server side doesn't include the "v" in nightly versions.
+	if lv.Channel == version.GA {
+		// Note: this trim prefix is future proofing in case we decide to start returning versions
+		// which include the "v" prefix
+		return "v" + strings.TrimPrefix(lv.RawVersion, "v")
+	}
+
+	return lv.RawVersion
+}
+
+// IsNewer returns true if LatestVersion is newer than current
+//
+// This is safe to call on a nil LatestVersion
+func (lv *LatestVersion) IsNewer(current string) bool {
+	if lv == nil {
+		return false
+	}
+
+	switch lv.Channel {
+	case version.GA:
+		return semver.Compare(lv.Version(), current) > 0
+	case version.Nightly:
+		return nightlyToNumber(lv.Version()) > nightlyToNumber(current)
+	}
+
+	return false
+}
+
+// DoUpgrade upgrades Encore.
+//
+// Adapted from flyctl: https://github.com/superfly/flyctl
+func (lv *LatestVersion) DoUpgrade(stdout, stderr io.Writer) error {
+	// What shell do we need to run?
+	arg := "-c"
+	shell, ok := os.LookupEnv("SHELL")
+	if !ok {
+		//goland:noinspection GoBoolExpressions
+		if runtime.GOOS == "windows" {
+			shell = "powershell.exe"
+			arg = "-Command"
+		} else {
+			shell = "/bin/bash"
+		}
+	}
+
+	// Base script for *nix systems
+	script := "curl -L \"https://encore.dev/install.sh\" | sh"
+
+	brewManaged := false
+
+	// Script overrides for windows and systems with homebrew installed
+	switch runtime.GOOS {
+	case "windows":
+		script = "iwr https://encore.dev/install.ps1 -useb | iex"
+	case "darwin", "linux":
+		// Upgrade via homebrew if we can
+		if wasInstalledViaHomebrew(shell, arg, lv.Channel) {
+			brewManaged = true
+			script = "brew upgrade encore --fetch-head"
+		}
+	}
+
+	// Sainty check we can perform the update
+	switch lv.Channel {
+	case version.GA:
+	// no-op
+	case version.Nightly:
+		if brewManaged {
+			script = "brew upgrade encore-nightly --fetch-head"
+		} else {
+			return errors.New("nightly can not be automatically updated without homebrew")
+		}
+	case version.Beta:
+		if brewManaged {
+			script = "brew upgrade encore-beta --fetch-head"
+		} else {
+			return errors.New("beta can not be automatically updated without homebrew")
+		}
+	case version.DevBuild:
+		return errors.New("dev builds can not be automatically updated")
+	default:
+		return fmt.Errorf("unknown release channel %s", lv.Channel)
+	}
+
+	fmt.Println("Running update [" + script + "]")
+
+	if brewManaged {
+		updateBrewTap(stdout, stderr)
+	}
+
+	// nosemgrep
+	cmd := exec.Command(shell, arg, script)
+
+	cmd.Stdout = stdout
+	cmd.Stderr = stderr
+	cmd.Stdin = os.Stdin
+	return cmd.Run()
+}
+
+func nightlyToNumber(version string) int64 {
+	// version looks like: nightly-20221010
+	if !strings.HasPrefix(version, "nightly-") || len(version) != 16 {
+		return 0
+	}
+
+	// slice(8) removes "nightly-"
+	date, err := strconv.ParseInt(version[8:], 10, 64)
+	if err != nil {
+		return 0
+	}
+
+	return date
+}
+
+func wasInstalledViaHomebrew(shell string, arg string, channel version.ReleaseChannel) bool {
+	if _, err := exec.LookPath("brew"); err != nil {
+		return false
+	}
+
+	formulaName := "encore"
+	if channel == version.Nightly {
+		formulaName = "encore-nightly"
+	} else if channel == version.Beta {
+		formulaName = "encore-beta"
+	}
+
+	buf := new(bytes.Buffer)
+	// nosemgrep
+	cmd := exec.Command(shell, arg, fmt.Sprintf("brew list %s -1", formulaName))
+	cmd.Stdout = buf
+	cmd.Stderr = buf
+	cmd.Stdin = os.Stdin
+
+	// No error means it was installed via homebrew, error means homebrew doesn't know about it
+	// or isn't installed
+	return cmd.Run() == nil
+}
+
+func updateBrewTap(stdout, stderr io.Writer) {
+	// Attempt to update the tap if it exists.
+	var outBuf bytes.Buffer
+	cmd := exec.Command("brew", "--prefix")
+	cmd.Stdout = &outBuf
+	if err := cmd.Run(); err == nil {
+		gitDir := filepath.Join(strings.TrimSpace(outBuf.String()), "Library", "Taps", "encoredev", "homebrew-tap")
+		if _, err := os.Stat(gitDir); err == nil {
+			// Get the current branch
+			branchName := "main"
+			{
+				outBuf.Reset()
+				cmd := exec.Command("git", "rev-parse", "--abbrev-ref", "HEAD")
+				cmd.Stdout = &outBuf
+				cmd.Stderr = stderr
+				cmd.Dir = gitDir
+				if err := cmd.Run(); err == nil {
+					branchName = strings.TrimSpace(outBuf.String())
+				}
+			}
+
+			// Only update if we're on the main branch.
+			if branchName == "main" {
+				cmd := exec.Command("git", "pull", "--rebase", "origin", "main")
+				cmd.Stdout = stdout
+				cmd.Stderr = stderr
+				cmd.Dir = gitDir
+				_ = cmd.Run()
+			}
+		}
+	}
+}
diff --git a/cli/internal/wgtunnel/wgtunnel.go b/cli/internal/wgtunnel/wgtunnel.go
deleted file mode 100644
index ef372918f7..0000000000
--- a/cli/internal/wgtunnel/wgtunnel.go
+++ /dev/null
@@ -1,184 +0,0 @@
-// Package wgtunnel sets up and configures Encore's WireGuard tunnel for
-// authenticating against private environments.
-package wgtunnel
-
-import (
-	"bytes"
-	"context"
-	"encoding/json"
-	"fmt"
-	"io/ioutil"
-	"net"
-	"net/http"
-	"time"
-
-	"encr.dev/cli/internal/conf"
-	"golang.org/x/oauth2"
-	"golang.zx2c4.com/wireguard/wgctrl"
-	"golang.zx2c4.com/wireguard/wgctrl/wgtypes"
-)
-
-// GenKey generates a public/private key pair for the WireGuard tunnel.
-func GenKey() (pub, priv wgtypes.Key, err error) {
-	priv, err = wgtypes.GeneratePrivateKey()
-	if err == nil {
-		pub = priv.PublicKey()
-	}
-	return
-}
-
-// RegisterDevice registers the public key with Encore
-// and returns the allocated IP address for use with WireGuard.
-func RegisterDevice(ctx context.Context, pubKey wgtypes.Key) (ip string, err error) {
-	defer func() {
-		if err != nil {
-			err = fmt.Errorf("wgtunnel.RegisterDevice: %v", err)
-		}
-	}()
-
-	reqData, _ := json.Marshal(map[string]string{"public_key": pubKey.String()})
-	url := "https://api.encore.dev/user/devices:register"
-	req, err := http.NewRequestWithContext(ctx, "POST", url, bytes.NewReader(reqData))
-	if err != nil {
-		return "", err
-	}
-	req.Header.Set("Content-Type", "application/json")
-
-	client := oauth2.NewClient(ctx, &conf.TokenSource{})
-	resp, err := client.Do(req)
-	if err != nil {
-		return "", err
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := ioutil.ReadAll(resp.Body)
-		return "", fmt.Errorf("request failed: %s: %s", resp.Status, body)
-	}
-
-	var respData struct {
-		OK   bool
-		Data struct {
-			IPAddress string `json:"ip_address"`
-		} `json:"data"`
-		Error struct {
-			Code string `json:"code"`
-		} `json:"error"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&respData); err != nil {
-		return "", err
-	} else if !respData.OK {
-		return "", fmt.Errorf("request failed with code: %v", respData.Error.Code)
-	}
-	return respData.Data.IPAddress, nil
-}
-
-// ClientConfig is the configuration necessary to setup WireGuard.
-type ClientConfig struct {
-	// Addr is our WireGuard address.
-	Addr string
-	// PrivKey is our private key.
-	PrivKey wgtypes.Key
-}
-
-// ServerPeer is the required configuration to configure a WireGuard peer.
-type ServerPeer struct {
-	// Endpoint is the WireGuard endpoint for the server.
-	Endpoint net.UDPAddr
-	// PublicKey is the server's public key.
-	PublicKey wgtypes.Key
-	// Subnets are the network subnet that should be routed
-	// through WireGuard.
-	Subnets []net.IPNet
-}
-
-// ServerConfig is the configuration to set up WireGuard peers.
-type ServerConfig struct {
-	Peers []ServerPeer
-}
-
-// DefaultServerConfig is the well-known default configuration of Encore's API Gateway.
-var DefaultServerConfig = &ServerConfig{
-	Peers: []ServerPeer{
-		{
-			Endpoint: net.UDPAddr{
-				IP:   net.ParseIP("159.65.210.129"),
-				Port: 51820,
-			},
-			PublicKey: mustParseKey("mQzDYCJufL+rNqbS1fBtxx3vxLX/4VaKKUDNS/yhQBs="),
-			Subnets: []net.IPNet{
-				{
-					IP:   net.ParseIP("100.26.25.109"),
-					Mask: net.IPv4Mask(255, 255, 255, 255),
-				},
-				{
-					IP:   net.ParseIP("18.214.237.181"),
-					Mask: net.IPv4Mask(255, 255, 255, 255),
-				},
-				{
-					IP:   net.ParseIP("54.170.142.107"),
-					Mask: net.IPv4Mask(255, 255, 255, 255),
-				},
-				{
-					IP:   net.ParseIP("54.74.172.84"),
-					Mask: net.IPv4Mask(255, 255, 255, 255),
-				},
-			},
-		},
-	},
-}
-
-// Start starts the WireGuard tunnel in the background.
-func Start(cc *ClientConfig, sc *ServerConfig) error {
-	if sc == nil {
-		sc = DefaultServerConfig
-	}
-	return start(cc, sc)
-}
-
-// Stop stops the WireGuard tunnel.
-func Stop() error {
-	return stop()
-}
-
-// Status reports whether the tunnel is running.
-func Status() (running bool, err error) {
-	return status()
-}
-
-func setConf(device string, cc *ClientConfig, sc *ServerConfig) error {
-	cfg := wgtypes.Config{
-		PrivateKey:   &cc.PrivKey,
-		ReplacePeers: true,
-	}
-	keepAlive := 25 * time.Second
-	for _, r := range sc.Peers {
-		cfg.Peers = append(cfg.Peers, wgtypes.PeerConfig{
-			PublicKey:                   r.PublicKey,
-			Endpoint:                    &r.Endpoint,
-			ReplaceAllowedIPs:           true,
-			AllowedIPs:                  r.Subnets,
-			PersistentKeepaliveInterval: &keepAlive,
-		})
-	}
-
-	cl, err := wgctrl.New()
-	if err != nil {
-		return err
-	}
-	defer cl.Close()
-	return cl.ConfigureDevice(device, cfg)
-}
-
-func mustParseKey(s string) wgtypes.Key {
-	k, err := wgtypes.ParseKey(s)
-	if err != nil {
-		panic(err)
-	}
-	return k
-}
-
-// Run synchronously runs the tunnel.
-func Run() error {
-	return run()
-}
diff --git a/cli/internal/wgtunnel/wgtunnel_darwin.go b/cli/internal/wgtunnel/wgtunnel_darwin.go
deleted file mode 100644
index 8f783e86c0..0000000000
--- a/cli/internal/wgtunnel/wgtunnel_darwin.go
+++ /dev/null
@@ -1,310 +0,0 @@
-// +build darwin
-
-package wgtunnel
-
-import (
-	"bytes"
-	"fmt"
-	"io/ioutil"
-	"net"
-	"os"
-	"os/exec"
-	"os/signal"
-	"path/filepath"
-	"regexp"
-	"strconv"
-	"syscall"
-	"time"
-
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/ipc"
-	"golang.zx2c4.com/wireguard/tun"
-)
-
-const (
-	basePath   = "/var/run/wireguard"
-	tunnelName = "encore"
-)
-
-type tunnel struct {
-	name   string
-	device string
-	cmd    *exec.Cmd
-	stop   func()
-
-	quit chan struct{}
-	err  error // can be read after quit is closed
-}
-
-func start(cc *ClientConfig, sc *ServerConfig) error {
-	iface, err := createIface()
-	if err != nil {
-		return err
-	}
-	if err := configure(iface, cc, sc); err != nil {
-		delIface(iface)
-		return err
-	}
-	return nil
-}
-
-func stop() error {
-	device, err := getIface()
-	if err != nil {
-		return err
-	} else if device != "" {
-		return delIface(device)
-	}
-	return nil
-}
-
-func status() (bool, error) {
-	device, err := getIface()
-	return device != "", err
-}
-
-func createIface() (device string, err error) {
-	if err := os.MkdirAll(basePath, 0755); err != nil {
-		return "", err
-	}
-	namePath := filepath.Join(basePath, tunnelName+".name")
-	exe, err := os.Executable()
-	if err != nil {
-		return "", err
-	}
-	cmd := exec.Command(exe, "vpn", "__run")
-	cmd.Env = append(os.Environ(), "WG_TUN_NAME_FILE="+namePath)
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
-
-	var output bytes.Buffer
-	cmd.Stdout = &output
-	cmd.Stderr = &output
-
-	if err := cmd.Start(); err != nil {
-		return "", err
-	}
-
-	tunnelErr := make(chan error, 1)
-	go func() {
-		err := cmd.Wait()
-		tunnelErr <- fmt.Errorf("%s: %s", err, output.String())
-	}()
-
-	// Wait for the file to get populated
-	ticker := time.NewTicker(100 * time.Millisecond)
-	timeout := time.After(5 * time.Second)
-	for {
-		select {
-		case <-ticker.C:
-			if iface, err := ioutil.ReadFile(namePath); err == nil {
-				device = string(bytes.TrimSpace(iface))
-				return device, nil
-			}
-		case <-timeout:
-			cmd.Process.Kill()
-			return "", fmt.Errorf("could not determine device name after 5s")
-		case err := <-tunnelErr:
-			return "", fmt.Errorf("wireguard exited: %v", err)
-		}
-	}
-}
-
-func getIface() (device string, err error) {
-	namePath := filepath.Join(basePath, tunnelName+".name")
-	data, err := ioutil.ReadFile(namePath)
-	if os.IsNotExist(err) {
-		return "", nil
-	} else if err != nil {
-		return "", err
-	}
-	deviceName := string(bytes.TrimSpace(data))
-	devicePath := filepath.Join(basePath, deviceName+".sock")
-
-	nm, err1 := os.Stat(namePath)
-	dev, err2 := os.Stat(devicePath)
-	if os.IsNotExist(err1) || os.IsNotExist(err2) {
-		return "", nil
-	} else if err1 != nil {
-		return "", err1
-	} else if err2 != nil {
-		return "", err2
-	}
-
-	diff := nm.ModTime().Sub(dev.ModTime())
-	if diff < 2*time.Second && diff > -2*time.Second {
-		return deviceName, nil
-	}
-	return "", nil
-}
-
-func delIface(device string) error {
-	namePath := filepath.Join(basePath, tunnelName+".name")
-	if err := os.Remove(namePath); err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	if device != "" {
-		devicePath := filepath.Join(basePath, device+".sock")
-		if err := os.Remove(devicePath); err != nil && !os.IsNotExist(err) {
-			return err
-		}
-	}
-	return nil
-}
-
-func configure(device string, cc *ClientConfig, sc *ServerConfig) error {
-	ops := []func(string, *ClientConfig, *ServerConfig) error{
-		setConf, addAddr, setMtus, enableIface, addPeers,
-	}
-	for _, op := range ops {
-		if err := op(device, cc, sc); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func addAddr(device string, cc *ClientConfig, sc *ServerConfig) error {
-	out, err := exec.Command("/sbin/ifconfig", device, "inet", cc.Addr, cc.Addr, "alias").CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("could not add route: %v: %s", err, out)
-	}
-	return nil
-}
-
-var (
-	routeRe = regexp.MustCompile(`(?m)interface: ([^ ]+)$`)
-	mtuRe   = regexp.MustCompile(`mtu ([0-9]+)`)
-)
-
-func addPeers(device string, cc *ClientConfig, sc *ServerConfig) error {
-	for _, r := range sc.Peers {
-		for _, s := range r.Subnets {
-			if err := addRoute(device, cc, s); err != nil {
-				return fmt.Errorf("adding route: %v", err)
-			}
-		}
-	}
-	return nil
-}
-
-func addRoute(device string, cc *ClientConfig, subnet net.IPNet) error {
-	// Determine if this is already routed via this interface
-	out, err := exec.Command("/sbin/route", "-n", "get", "-inet", subnet.String()).CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("could get route: %v: %s", err, out)
-	}
-	m := routeRe.FindSubmatch(out)
-	if m != nil && string(m[1]) == device {
-		return nil
-	}
-
-	out, err = exec.Command("/sbin/route", "-n", "add", "-inet", subnet.String(), "-interface", device).CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("could not add route: %v: %s", err, out)
-	}
-	return nil
-}
-
-func setMtus(device string, cc *ClientConfig, sc *ServerConfig) error {
-	for _, r := range sc.Peers {
-		if err := setMtu(device, cc, r); err != nil {
-			return fmt.Errorf("setting mtu: %v", err)
-		}
-	}
-	return nil
-}
-
-func setMtu(device string, cc *ClientConfig, r ServerPeer) error {
-	// Parse the underlying interface that will actually send the packets
-	// to our destination endpoint.
-	out, err := exec.Command("/sbin/route", "-n", "get", "-inet", r.Endpoint.IP.String()).CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("could get route: %v: %s", err, out)
-	}
-	m := routeRe.FindSubmatch(out)
-	if m == nil {
-		return fmt.Errorf("could not determine routing interface")
-	}
-	ifaceName := string(m[1])
-
-	out, err = exec.Command("/sbin/ifconfig", ifaceName).CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("could not get iface info: %v: %s", err, out)
-	}
-	m = mtuRe.FindSubmatch(out)
-	if m == nil {
-		return fmt.Errorf("could not determine MTU")
-	}
-	mtu, err := strconv.Atoi(string(m[1]))
-	if err != nil {
-		return fmt.Errorf("could not parse MTU: %v", err)
-	}
-	mtu = mtu - 80
-
-	out, err = exec.Command("/sbin/ifconfig", device, "mtu", strconv.Itoa(mtu)).CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("could not set MTU: %v: %s", err, out)
-	}
-	return nil
-}
-
-func enableIface(device string, cc *ClientConfig, sc *ServerConfig) error {
-	out, err := exec.Command("/sbin/ifconfig", device, "up").CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("could not enable device: %v: %s", err, out)
-	}
-	return nil
-}
-
-func run() error {
-	tun, err := tun.CreateTUN("utun", device.DefaultMTU)
-	if err != nil {
-		return err
-	}
-	name, err := tun.Name()
-	if err != nil {
-		return err
-	}
-	fileUAPI, err := ipc.UAPIOpen(name)
-	if err != nil {
-		return fmt.Errorf("uapi open: %v", err)
-	}
-	uapi, err := ipc.UAPIListen(name, fileUAPI)
-	if err != nil {
-		return fmt.Errorf("failed to listen on uapi socket: %v", err)
-	}
-
-	logger := device.NewLogger(
-		device.LogLevelError,
-		"vpn: ",
-	)
-
-	device := device.NewDevice(tun, logger)
-
-	term := make(chan os.Signal, 1)
-	errs := make(chan error)
-
-	signal.Notify(term, syscall.SIGTERM)
-	signal.Notify(term, os.Interrupt)
-
-	go func() {
-		for {
-			conn, err := uapi.Accept()
-			if err != nil {
-				errs <- err
-				return
-			}
-			go device.IpcHandle(conn)
-		}
-	}()
-
-	select {
-	case <-term:
-	case <-device.Wait():
-	case err = <-errs:
-	}
-
-	uapi.Close()
-	device.Close()
-	return err
-}
diff --git a/cli/internal/wgtunnel/wgtunnel_linux.go b/cli/internal/wgtunnel/wgtunnel_linux.go
deleted file mode 100644
index e53f2d53a3..0000000000
--- a/cli/internal/wgtunnel/wgtunnel_linux.go
+++ /dev/null
@@ -1,290 +0,0 @@
-// +build linux
-
-package wgtunnel
-
-import (
-	"bytes"
-	"fmt"
-	"net"
-	"os"
-	"os/exec"
-	"os/signal"
-	"path/filepath"
-	"regexp"
-	"strconv"
-	"syscall"
-	"time"
-
-	"golang.zx2c4.com/wireguard/device"
-	"golang.zx2c4.com/wireguard/ipc"
-	"golang.zx2c4.com/wireguard/tun"
-)
-
-const (
-	basePath = "/var/run/wireguard"
-	iface    = "encore"
-)
-
-type tunnel struct {
-	name   string
-	device string
-	cmd    *exec.Cmd
-	stop   func()
-
-	quit chan struct{}
-	err  error // can be read after quit is closed
-}
-
-func start(cc *ClientConfig, sc *ServerConfig) error {
-	if hasIface() {
-		if err := delIface(); err != nil {
-			return err
-		}
-	}
-
-	iface, err := createIface()
-	if err != nil {
-		return err
-	}
-
-	if err := configure(iface, cc, sc); err != nil {
-		delIface()
-		return err
-	}
-	return nil
-}
-
-func stop() error {
-	return delIface()
-}
-
-func status() (bool, error) {
-	return hasIface(), nil
-}
-
-func hasIface() bool {
-	out, _ := exec.Command("ip", "link", "show", "dev", iface).Output()
-	return len(out) != 0
-}
-
-func delIface() error {
-	out, err := exec.Command("ip", "link", "delete", "dev", iface).CombinedOutput()
-	if err == nil {
-		return nil
-	} else if bytes.Contains(out, []byte("Cannot find device")) {
-		return nil
-	}
-	return fmt.Errorf("could not delete device: %s", out)
-}
-
-func createIface() (device string, err error) {
-	if err := os.MkdirAll(basePath, 0755); err != nil {
-		return "", err
-	}
-
-	// Use the kernel module if possible
-	out, err := exec.Command("ip", "link", "add", iface, "type", "wireguard").CombinedOutput()
-	if err == nil {
-		return iface, nil
-	}
-	// Do we have the kernel module installed?
-	if _, err := os.Stat("/sys/module/wireguard"); err == nil {
-		return "", fmt.Errorf("could not setup WireGuard device: %s", out)
-	}
-	fmt.Println("encore: missing WireGuard kernel module. Falling back to slow userspace implementation.")
-	fmt.Println("encore: Install WireGuard kernel module to hide this message.")
-
-	namePath := filepath.Join(basePath, iface+".name")
-	exe, err := os.Executable()
-	if err != nil {
-		return "", err
-	}
-
-	cmd := exec.Command(exe, "vpn", "__run")
-	cmd.Env = append(os.Environ(), "WG_TUN_NAME_FILE="+namePath)
-	cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true}
-
-	var output bytes.Buffer
-	cmd.Stdout = &output
-	cmd.Stderr = &output
-
-	if err := cmd.Start(); err != nil {
-		return "", err
-	}
-
-	tunnelErr := make(chan error, 1)
-	go func() {
-		err := cmd.Wait()
-		tunnelErr <- fmt.Errorf("%s: %s", err, output.String())
-	}()
-
-	// Wait for the file to get populated
-	ticker := time.NewTicker(100 * time.Millisecond)
-	timeout := time.After(5 * time.Second)
-	for {
-		select {
-		case <-ticker.C:
-			if iface, err := os.ReadFile(namePath); err == nil {
-				device = string(bytes.TrimSpace(iface))
-				return device, nil
-			}
-		case <-timeout:
-			cmd.Process.Kill()
-			return "", fmt.Errorf("could not determine device name after 5s")
-		case err := <-tunnelErr:
-			return "", fmt.Errorf("wireguard exited: %v", err)
-		}
-	}
-}
-
-func configure(device string, cc *ClientConfig, sc *ServerConfig) error {
-	ops := []func(string, *ClientConfig, *ServerConfig) error{
-		setConf, addAddr, setMtus, addPeers,
-	}
-	for _, op := range ops {
-		if err := op(device, cc, sc); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func addAddr(device string, cc *ClientConfig, sc *ServerConfig) error {
-	out, err := exec.Command("ip", "-4", "address", "add", cc.Addr, "dev", device).CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("could not add address: %v: %s", err, out)
-	}
-	return nil
-}
-
-var (
-	routeRe = regexp.MustCompile(`(?m)interface: ([^ ]+)$`)
-	mtuRe   = regexp.MustCompile(`mtu ([0-9]+)`)
-	devRe   = regexp.MustCompile(`dev ([^ ]+)`)
-)
-
-func addPeers(device string, cc *ClientConfig, sc *ServerConfig) error {
-	for _, r := range sc.Peers {
-		for _, s := range r.Subnets {
-			if err := addRoute(device, cc, s); err != nil {
-				return fmt.Errorf("adding route for %s: %v", s, err)
-			}
-		}
-	}
-	return nil
-}
-
-func addRoute(device string, cc *ClientConfig, subnet net.IPNet) error {
-	// Determine if this is already routed via this interface
-	out, err := exec.Command("ip", "-4", "route", "show", "dev", device, "match", subnet.String()).Output()
-	if err == nil && len(out) > 0 {
-		// Already routed
-		return nil
-	}
-	out, err = exec.Command("ip", "-4", "route", "add", subnet.String(), "dev", device).CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("could not add route: %v: %s", err, out)
-	}
-	return nil
-}
-
-func setMtus(device string, cc *ClientConfig, sc *ServerConfig) error {
-	for _, r := range sc.Peers {
-		if err := setMtu(device, cc, r); err != nil {
-			return fmt.Errorf("setting mtu: %v", err)
-		}
-	}
-	return nil
-}
-
-func setMtu(device string, cc *ClientConfig, r ServerPeer) error {
-	var mtu int
-	if out, err := exec.Command("ip", "route", "get", r.Endpoint.IP.String()).CombinedOutput(); err == nil {
-		if m := mtuRe.FindSubmatch(out); m != nil {
-			mtu, _ = strconv.Atoi(string(m[1]))
-		}
-		if mtu == 0 {
-			// Try again by looking for the link device and looking up that
-			if d := devRe.FindSubmatch(out); d != nil {
-				if out, err := exec.Command("ip", "link", "show", "dev", string(d[1])).CombinedOutput(); err == nil {
-					if m := mtuRe.FindSubmatch(out); m != nil {
-						mtu, _ = strconv.Atoi(string(m[1]))
-					}
-				}
-			}
-		}
-	}
-
-	// If we still don't have an mtu, fall back to the default
-	if mtu == 0 {
-		if out, err := exec.Command("ip", "route", "show", "default").CombinedOutput(); err == nil {
-			if m := mtuRe.FindSubmatch(out); m != nil {
-				mtu, _ = strconv.Atoi(string(m[1]))
-			}
-		}
-	}
-
-	if mtu == 0 {
-		mtu = 1500
-	}
-	mtu = mtu - 80
-
-	out, err := exec.Command("ip", "link", "set", "mtu", strconv.Itoa(mtu), "up", "dev", device).CombinedOutput()
-	if err != nil {
-		return fmt.Errorf("could not set MTU: %v: %s", err, out)
-	}
-	return nil
-}
-
-func run() error {
-	tun, err := tun.CreateTUN("utun", device.DefaultMTU)
-	if err != nil {
-		return err
-	}
-	name, err := tun.Name()
-	if err != nil {
-		return err
-	}
-	fileUAPI, err := ipc.UAPIOpen(name)
-	if err != nil {
-		return fmt.Errorf("uapi open: %v", err)
-	}
-	uapi, err := ipc.UAPIListen(name, fileUAPI)
-	if err != nil {
-		return fmt.Errorf("failed to listen on uapi socket: %v", err)
-	}
-
-	logger := device.NewLogger(
-		device.LogLevelError,
-		"vpn: ",
-	)
-
-	device := device.NewDevice(tun, logger)
-
-	term := make(chan os.Signal, 1)
-	errs := make(chan error)
-
-	signal.Notify(term, syscall.SIGTERM)
-	signal.Notify(term, os.Interrupt)
-
-	go func() {
-		for {
-			conn, err := uapi.Accept()
-			if err != nil {
-				errs <- err
-				return
-			}
-			go device.IpcHandle(conn)
-		}
-	}()
-
-	select {
-	case <-term:
-	case <-device.Wait():
-	case err = <-errs:
-	}
-
-	uapi.Close()
-	device.Close()
-	return err
-}
diff --git a/cli/internal/wgtunnel/wgtunnel_windows.go b/cli/internal/wgtunnel/wgtunnel_windows.go
deleted file mode 100644
index 1cb9d866c5..0000000000
--- a/cli/internal/wgtunnel/wgtunnel_windows.go
+++ /dev/null
@@ -1,148 +0,0 @@
-// +build windows
-
-package wgtunnel
-
-import (
-	"fmt"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"strings"
-	"syscall"
-
-	"golang.org/x/sys/windows"
-	"golang.org/x/sys/windows/svc/mgr"
-	"golang.zx2c4.com/wireguard/windows/services"
-)
-
-const tunnelName = "encore-wg"
-
-func start(cc *ClientConfig, sc *ServerConfig) error {
-	configDir, err := os.UserConfigDir()
-	if err != nil {
-		return err
-	}
-	confPath := filepath.Join(configDir, "encore", tunnelName+".conf")
-	if err := os.MkdirAll(filepath.Dir(confPath), 0755); err != nil {
-		return err
-	} else if err := writeConf(confPath, cc, sc); err != nil {
-		return fmt.Errorf("cannot write WireGuard conf: %v", err)
-	}
-
-	err = installTunnel(confPath)
-	if err != nil {
-		return fmt.Errorf("could not install tunnel: %v", err)
-	}
-	return nil
-}
-
-func stop() error {
-	if running, err := status(); err != nil || running {
-		return uninstallTunnel(tunnelName)
-	}
-	return nil
-}
-
-func status() (bool, error) {
-	serviceName, err := services.ServiceNameOfTunnel(tunnelName)
-	if err != nil {
-		return false, err
-	}
-
-	h, err := windows.OpenSCManager(nil, nil, windows.SC_MANAGER_ENUMERATE_SERVICE)
-	if err != nil {
-		return false, err
-	}
-	m := &mgr.Mgr{Handle: h}
-	list, err := m.ListServices()
-	if err != nil {
-		return false, err
-	}
-	for _, svc := range list {
-		if svc == serviceName {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-func writeConf(confPath string, cc *ClientConfig, sc *ServerConfig) error {
-	var peers []string
-	for _, r := range sc.Peers {
-		var subnets []string
-		for _, s := range r.Subnets {
-			subnets = append(subnets, s.String())
-		}
-		peer := fmt.Sprintf(`[Peer]
-PublicKey = %s
-AllowedIPs = %s
-Endpoint = %s
-PersistentKeepalive = 25
-`, r.PublicKey, strings.Join(subnets, ", "), r.Endpoint)
-		peers = append(peers, peer)
-	}
-
-	cfg := fmt.Sprintf("[Interface]\nPrivateKey = %s\nAddress = %s\n\n", cc.PrivKey, cc.Addr) + strings.Join(peers, "\n\n")
-
-	err := ioutil.WriteFile(confPath, []byte(cfg), 0600)
-	if err != nil {
-		return err
-	}
-	return nil
-}
-
-func installTunnel(configPath string) error {
-	exe, err := os.Executable()
-	if err != nil {
-		return err
-	}
-	err = runElevatedShellCommand(exe, "vpn", "svc-install", configPath)
-	if err != nil {
-		return fmt.Errorf("could not install tunnel: %v", err)
-	}
-	return nil
-}
-
-func uninstallTunnel(name string) error {
-	exe, err := os.Executable()
-	if err != nil {
-		return err
-	}
-	err = runElevatedShellCommand(exe, "vpn", "svc-uninstall", name)
-	if err != nil {
-		return fmt.Errorf("could not uninstall tunnel: %v", err)
-	}
-	return nil
-}
-
-func runElevatedShellCommand(cmd string, args ...string) error {
-	verb := "runas"
-	cwd, err := os.Getwd()
-	if err != nil {
-		return err
-	}
-
-	// Escape args if they contain spaces or quotes
-	for i, arg := range args {
-		args[i] = shellEscape(arg)
-	}
-	argStr := strings.Join(args, " ")
-
-	verbPtr, _ := syscall.UTF16PtrFromString(verb)
-	exePtr, _ := syscall.UTF16PtrFromString(cmd)
-	cwdPtr, _ := syscall.UTF16PtrFromString(cwd)
-	argPtr, _ := syscall.UTF16PtrFromString(argStr)
-	var showCmd int32 = 0 // SW_NORMAL
-	return windows.ShellExecute(0, verbPtr, exePtr, argPtr, cwdPtr, showCmd)
-}
-
-func shellEscape(arg string) string {
-	if strings.ContainsAny(arg, `" `) {
-		arg = "\"" + strings.Replace(arg, "\"", "\"\"", -1) + "\""
-	}
-	return arg
-}
-
-func run() error {
-	return fmt.Errorf("Run() is not implemented on windows")
-}
diff --git a/cli/internal/winsvc/winsvc.go b/cli/internal/winsvc/winsvc.go
deleted file mode 100644
index 6fbf535415..0000000000
--- a/cli/internal/winsvc/winsvc.go
+++ /dev/null
@@ -1,150 +0,0 @@
-// +build windows
-
-package winsvc
-
-import (
-	"errors"
-	"os"
-	"strings"
-	"time"
-
-	"golang.org/x/sys/windows"
-	"golang.org/x/sys/windows/svc"
-	"golang.org/x/sys/windows/svc/mgr"
-	"golang.zx2c4.com/wireguard/windows/conf"
-	"golang.zx2c4.com/wireguard/windows/services"
-	"golang.zx2c4.com/wireguard/windows/tunnel"
-)
-
-var cachedServiceManager *mgr.Mgr
-
-func serviceManager() (*mgr.Mgr, error) {
-	if cachedServiceManager != nil {
-		return cachedServiceManager, nil
-	}
-	m, err := mgr.Connect()
-	if err != nil {
-		return nil, err
-	}
-	cachedServiceManager = m
-	return cachedServiceManager, nil
-}
-
-func Status(name string) (installed bool, err error) {
-	serviceName, err := services.ServiceNameOfTunnel(name)
-	if err != nil {
-		return false, err
-	}
-
-	h, err := windows.OpenSCManager(nil, nil, windows.SC_MANAGER_ENUMERATE_SERVICE)
-	if err != nil {
-		return false, err
-	}
-	m := &mgr.Mgr{Handle: h}
-	list, err := m.ListServices()
-	if err != nil {
-		return false, err
-	}
-	for _, svc := range list {
-		if svc == serviceName {
-			return true, nil
-		}
-	}
-	return false, nil
-}
-
-func Install(configPath string) error {
-	m, err := serviceManager()
-	if err != nil {
-		return err
-	}
-	path, err := os.Executable()
-	if err != nil {
-		return nil
-	}
-
-	name, err := conf.NameFromPath(configPath)
-	if err != nil {
-		return err
-	}
-
-	serviceName, err := services.ServiceNameOfTunnel(name)
-	if err != nil {
-		return err
-	}
-	service, err := m.OpenService(serviceName)
-	if err == nil {
-		status, err := service.Query()
-		if err != nil && err != windows.ERROR_SERVICE_MARKED_FOR_DELETE {
-			service.Close()
-			return err
-		}
-		if status.State != svc.Stopped && err != windows.ERROR_SERVICE_MARKED_FOR_DELETE {
-			service.Close()
-			return errors.New("Tunnel already installed and running")
-		}
-		err = service.Delete()
-		service.Close()
-		if err != nil && err != windows.ERROR_SERVICE_MARKED_FOR_DELETE {
-			return err
-		}
-		for {
-			service, err = m.OpenService(serviceName)
-			if err != nil && err != windows.ERROR_SERVICE_MARKED_FOR_DELETE {
-				break
-			}
-			service.Close()
-			time.Sleep(time.Second / 3)
-		}
-	}
-
-	config := mgr.Config{
-		ServiceType:  windows.SERVICE_WIN32_OWN_PROCESS,
-		StartType:    mgr.StartAutomatic,
-		ErrorControl: mgr.ErrorNormal,
-		Dependencies: []string{"Nsi"},
-		DisplayName:  "Encore WireGuard Tunnel: " + name,
-		SidType:      windows.SERVICE_SID_TYPE_UNRESTRICTED,
-	}
-	service, err = m.CreateService(serviceName, path, config, "vpn", "svc-run", configPath)
-	if err != nil {
-		return err
-	}
-
-	err = service.Start()
-	// go trackTunnelService(name, service) // Pass off reference to handle.
-	return err
-}
-
-func Uninstall(name string) error {
-	m, err := serviceManager()
-	if err != nil {
-		return err
-	}
-	serviceName, err := services.ServiceNameOfTunnel(name)
-	if err != nil {
-		return err
-	}
-	service, err := m.OpenService(serviceName)
-	if err != nil {
-		return err
-	}
-	service.Control(svc.Stop)
-	err = service.Delete()
-	err2 := service.Close()
-	if err != nil && err != windows.ERROR_SERVICE_MARKED_FOR_DELETE {
-		return err
-	}
-	return err2
-}
-
-func Run(confPath string) error {
-	return tunnel.Run(confPath)
-}
-
-func ShellEscape(arg string) string {
-	if strings.ContainsAny(arg, `" `) {
-		arg = "\"" + strings.Replace(arg, "\"", "\"\"", -1) + "\""
-	}
-	return arg
-}
diff --git a/cli/internal/winsvc/winsvc_test.go b/cli/internal/winsvc/winsvc_test.go
deleted file mode 100644
index 2e9ec17597..0000000000
--- a/cli/internal/winsvc/winsvc_test.go
+++ /dev/null
@@ -1,30 +0,0 @@
-// +build windows
-
-package winsvc
-
-import "testing"
-
-func TestShellEscape(t *testing.T) {
-	tests := []struct {
-		Arg      string
-		Expected string
-	}{
-		{
-			"foo",
-			"foo",
-		},
-		{
-			"foo bar",
-			`"foo bar"`,
-		},
-		{
-			`foo "bar" baz`,
-			`"foo ""bar"" baz"`,
-		},
-	}
-	for _, test := range tests {
-		if got, want := ShellEscape(test.Arg), test.Expected; got != want {
-			t.Errorf("ShellEscape(%q) = %q, want %q", test.Arg, got, want)
-		}
-	}
-}
diff --git a/cli/internal/xos/xos_unix.go b/cli/internal/xos/xos_unix.go
deleted file mode 100644
index ed1709c41b..0000000000
--- a/cli/internal/xos/xos_unix.go
+++ /dev/null
@@ -1,38 +0,0 @@
-// +build !windows
-
-// Package xos provides cross-platform helper functions.
-package xos
-
-import (
-	"os"
-	"os/exec"
-	"os/user"
-	"syscall"
-)
-
-func CreateNewProcessGroup() *syscall.SysProcAttr {
-	return &syscall.SysProcAttr{Setpgid: true}
-}
-
-func SocketStat(path string) (interface{}, error) {
-	return os.Stat(path)
-}
-
-func SameSocket(a, b interface{}) bool {
-	ai := a.(os.FileInfo)
-	bi := b.(os.FileInfo)
-	return os.SameFile(ai, bi)
-}
-
-func ArrangeExtraFiles(cmd *exec.Cmd, files ...*os.File) error {
-	cmd.ExtraFiles = files
-	return nil
-}
-
-func IsAdminUser() (bool, error) {
-	usr, err := user.Current()
-	if err != nil {
-		return false, err
-	}
-	return usr.Gid == "0", nil
-}
diff --git a/cli/internal/xos/xos_windows.go b/cli/internal/xos/xos_windows.go
deleted file mode 100644
index b9feca93b8..0000000000
--- a/cli/internal/xos/xos_windows.go
+++ /dev/null
@@ -1,65 +0,0 @@
-// +build windows
-
-package xos
-
-import (
-	"fmt"
-	"os"
-	"os/exec"
-	"strconv"
-	"strings"
-	"syscall"
-
-	"golang.org/x/sys/windows"
-)
-
-func CreateNewProcessGroup() *syscall.SysProcAttr {
-	return &syscall.SysProcAttr{
-		CreationFlags: windows.CREATE_NEW_PROCESS_GROUP,
-	}
-}
-
-func SocketStat(path string) (interface{}, error) {
-	fd, err := windows.CreateFile(windows.StringToUTF16Ptr(path), windows.GENERIC_READ, 0, nil, windows.OPEN_EXISTING, windows.FILE_FLAG_OPEN_REPARSE_POINT|windows.FILE_FLAG_BACKUP_SEMANTICS, 0)
-	if err != nil {
-		return nil, fmt.Errorf("CreateFile %s: %w", path, err)
-	}
-	defer windows.CloseHandle(fd)
-
-	var d syscall.ByHandleFileInformation
-	err = syscall.GetFileInformationByHandle(syscall.Handle(fd), &d)
-	if err != nil {
-		return nil, &os.PathError{"GetFileInformationByHandle", path, err}
-	}
-	return &d, nil
-}
-
-func SameSocket(a, b interface{}) bool {
-	ai := a.(*syscall.ByHandleFileInformation)
-	bi := b.(*syscall.ByHandleFileInformation)
-	return ai.VolumeSerialNumber == bi.VolumeSerialNumber && ai.FileIndexHigh == bi.FileIndexHigh && ai.FileIndexLow == bi.FileIndexLow
-}
-
-func ArrangeExtraFiles(cmd *exec.Cmd, files ...*os.File) error {
-	// Flag the files to bbe inherited by the child process
-	var fds []string
-	for _, f := range files {
-		fd := f.Fd()
-		fds = append(fds, strconv.FormatUint(uint64(fd), 10))
-		err := windows.SetHandleInformation(windows.Handle(fd), windows.HANDLE_FLAG_INHERIT, 1)
-		if err != nil {
-			return fmt.Errorf("xos.ArrangeExtraFiles: SetHandleInformation: %v", err)
-		}
-	}
-	// If the env hasn't been set, copy over this process' env so we preserve the cmd.Env semantics.
-	if cmd.Env == nil {
-		cmd.Env = os.Environ()
-	}
-	cmd.Env = append(cmd.Env, "ENCORE_EXTRA_FILES="+strings.Join(fds, ","))
-	return nil
-}
-
-func IsAdminUser() (bool, error) {
-	// For Windows we elevate permissions on demand, so pretend we are admin
-	return true, nil
-}
diff --git a/clippy.toml b/clippy.toml
new file mode 100644
index 0000000000..87fed5b0e3
--- /dev/null
+++ b/clippy.toml
@@ -0,0 +1,2 @@
+ignore-interior-mutability = ["bytes::Bytes", "http::header::HeaderName"]
+
diff --git a/compiler/ast.go b/compiler/ast.go
deleted file mode 100644
index aba6d6f917..0000000000
--- a/compiler/ast.go
+++ /dev/null
@@ -1,57 +0,0 @@
-package compiler
-
-import (
-	"go/ast"
-	"go/token"
-	"strconv"
-)
-
-func usesImport(f *ast.File, pkgName, path string, exceptions map[*ast.SelectorExpr]bool) bool {
-	// Find if the import has been given a different name
-	for _, s := range f.Imports {
-		if p, _ := strconv.Unquote(s.Path.Value); p == path {
-			if s.Name != nil {
-				pkgName = s.Name.Name
-			}
-			break
-		}
-	}
-
-	var used bool
-	ast.Walk(visitFn(func(n ast.Node) {
-		sel, ok := n.(*ast.SelectorExpr)
-		if ok && isTopName(sel.X, pkgName) && !exceptions[sel] {
-			used = true
-		}
-	}), f)
-	return used
-}
-
-func findImport(f *ast.File, path string) (*ast.ImportSpec, *ast.GenDecl, bool) {
-	for _, decl := range f.Decls {
-		gen, ok := decl.(*ast.GenDecl)
-		if !ok || gen.Tok != token.IMPORT {
-			continue
-		}
-		for _, spec := range gen.Specs {
-			impspec := spec.(*ast.ImportSpec)
-			if p, _ := strconv.Unquote(impspec.Path.Value); p == path {
-				return impspec, gen, true
-			}
-		}
-	}
-	return nil, nil, false
-}
-
-type visitFn func(node ast.Node)
-
-func (fn visitFn) Visit(node ast.Node) ast.Visitor {
-	fn(node)
-	return fn
-}
-
-// isTopName returns true if n is a top-level unresolved identifier with the given name.
-func isTopName(n ast.Expr, name string) bool {
-	id, ok := n.(*ast.Ident)
-	return ok && id.Name == name && id.Obj == nil
-}
diff --git a/compiler/build.go b/compiler/build.go
deleted file mode 100644
index 9b6f2c1466..0000000000
--- a/compiler/build.go
+++ /dev/null
@@ -1,353 +0,0 @@
-package compiler
-
-import (
-	"bytes"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io/ioutil"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"runtime"
-
-	"encr.dev/parser"
-	"golang.org/x/mod/modfile"
-	"golang.org/x/mod/semver"
-)
-
-type Config struct {
-	// Version specifies the app version to encode
-	// into the app metadata.
-	Version string
-
-	// WorkingDir is the path relative to the app root from which the user
-	// is running the build. It is used to resolve relative filenames.
-	// If empty it defaults to "." which resolves to the app root.
-	WorkingDir string
-
-	// GOOS sets the GOOS to build for, if nonempty.
-	GOOS string
-
-	// CgoEnabled decides whether to build with cgo enabled.
-	CgoEnabled bool
-
-	// Debug specifies whether to compile in debug mode.
-	Debug bool
-
-	// EncoreRuntimePath if set, causes builds to introduce a temporary replace directive
-	// that replaces the module path to the "encore.dev" module.
-	// This lets us replace the implementation for building.
-	EncoreRuntimePath string
-
-	// EncoreGoRoot is the path to the Encore GOROOT.
-	EncoreGoRoot string
-
-	// Test is the specific settings for running tests.
-	Test *TestConfig
-
-	// If Parse is set, the build will skip parsing the app again
-	// and use the information provided.
-	Parse *parser.Result
-}
-
-// Validate validates the config.
-func (cfg *Config) Validate() error {
-	if cfg.EncoreRuntimePath == "" {
-		return errors.New("empty EncoreRuntimePath")
-	} else if cfg.EncoreGoRoot == "" {
-		return errors.New("empty EncoreGoRoot")
-	}
-	return nil
-}
-
-// Result is the combined results of a build.
-type Result struct {
-	Dir   string // absolute path to build temp dir
-	Exe   string // absolute path to the build executable
-	Parse *parser.Result
-}
-
-// Build builds the application.
-//
-// On success, it is the caller's responsibility to delete the temp dir
-// returned in Result.Dir.
-func Build(appRoot string, cfg *Config) (*Result, error) {
-	if err := cfg.Validate(); err != nil {
-		return nil, err
-	} else if appRoot, err = filepath.Abs(appRoot); err != nil {
-		return nil, err
-	}
-
-	b := &builder{
-		cfg:     cfg,
-		appRoot: appRoot,
-	}
-	return b.Build()
-}
-
-type builder struct {
-	// inputs
-	cfg        *Config
-	appRoot    string
-	parseTests bool
-
-	workdir string
-	modfile *modfile.File
-	overlay map[string]string
-
-	res *parser.Result
-}
-
-func (b *builder) Build() (res *Result, err error) {
-	defer func() {
-		if e := recover(); e != nil {
-			if b, ok := e.(bailout); ok {
-				err = b.err
-			} else {
-				panic(e)
-			}
-		}
-	}()
-
-	b.workdir, err = ioutil.TempDir("", "encore-build")
-	if err != nil {
-		return nil, err
-	}
-	defer func() {
-		if err != nil {
-			os.RemoveAll(b.workdir)
-		}
-	}()
-
-	for _, fn := range []func() error{
-		b.parseApp,
-		b.writeModFile,
-		b.writeSumFile,
-		b.writePackages,
-		b.writeMainPkg,
-		b.buildMain,
-	} {
-		if err := fn(); err != nil {
-			return nil, err
-		}
-	}
-
-	return &Result{
-		Dir:   b.workdir,
-		Exe:   filepath.Join(b.workdir, binaryName+exe),
-		Parse: b.res,
-	}, nil
-}
-
-// parseApp parses the app situated at appRoot.
-func (b *builder) parseApp() error {
-	modPath := filepath.Join(b.appRoot, "go.mod")
-	modData, err := ioutil.ReadFile(modPath)
-	if err != nil {
-		return err
-	}
-	b.modfile, err = modfile.Parse(modPath, modData, nil)
-	if err != nil {
-		return err
-	}
-
-	if pc := b.cfg.Parse; pc != nil {
-		b.res = pc
-		return nil
-	}
-
-	cfg := &parser.Config{
-		AppRoot:    b.appRoot,
-		Version:    b.cfg.Version,
-		ModulePath: b.modfile.Module.Mod.Path,
-		WorkingDir: b.cfg.WorkingDir,
-		ParseTests: b.parseTests,
-	}
-	b.res, err = parser.Parse(cfg)
-	return err
-}
-
-func (b *builder) writeModFile() error {
-	newPath := b.cfg.EncoreRuntimePath
-	oldPath := "encore.dev"
-	if err := b.modfile.AddRequire("encore.dev", "v0.0.0"); err != nil {
-		return fmt.Errorf("could not add require encore.dev path: %v", err)
-	}
-	if err := b.modfile.AddReplace(oldPath, "", newPath, ""); err != nil {
-		return fmt.Errorf("could not replace encore.dev path: %v", err)
-	}
-	b.modfile.Cleanup()
-
-	runtimeModData, err := os.ReadFile(filepath.Join(newPath, "go.mod"))
-	if err != nil {
-		return err
-	}
-	runtimeModfile, err := modfile.Parse("encore-runtime/go.mod", runtimeModData, nil)
-	if err != nil {
-		return err
-	}
-	mergeModfiles(b.modfile, runtimeModfile)
-
-	modBytes := modfile.Format(b.modfile.Syntax)
-	dstGomod := filepath.Join(b.workdir, "go.mod")
-	return ioutil.WriteFile(dstGomod, modBytes, 0644)
-}
-
-func (b *builder) writeSumFile() error {
-	appSum, err := ioutil.ReadFile(filepath.Join(b.appRoot, "go.sum"))
-	if err != nil && !os.IsNotExist(err) {
-		return err
-	}
-	runtimeSum, err := ioutil.ReadFile(filepath.Join(b.cfg.EncoreRuntimePath, "go.sum"))
-	if err != nil {
-		return err
-	}
-	if !bytes.HasSuffix(appSum, []byte{'\n'}) {
-		appSum = append(appSum, '\n')
-	}
-	data := append(appSum, runtimeSum...)
-	dstGosum := filepath.Join(b.workdir, "go.sum")
-	return ioutil.WriteFile(dstGosum, data, 0644)
-}
-
-func (b *builder) writePackages() error {
-	// Copy all the packages into the workdir
-	for _, pkg := range b.res.App.Packages {
-		targetDir := filepath.Join(b.workdir, filepath.FromSlash(pkg.RelPath))
-		if err := os.MkdirAll(targetDir, 0755); err != nil {
-			return err
-		} else if err := b.rewritePkg(pkg, targetDir); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func (b *builder) buildMain() error {
-	overlayData, _ := json.Marshal(map[string]interface{}{"Replace": b.overlay})
-	overlayPath := filepath.Join(b.workdir, "overlay.json")
-	if err := ioutil.WriteFile(overlayPath, overlayData, 0644); err != nil {
-		return err
-	}
-
-	args := []string{
-		"build",
-		"-tags=encore",
-		"-overlay=" + overlayPath,
-		"-modfile=" + filepath.Join(b.workdir, "go.mod"),
-		"-mod=mod",
-		"-o=" + filepath.Join(b.workdir, "out"+exe),
-	}
-	args = append(args, "./"+mainPkgName)
-	cmd := exec.Command(filepath.Join(b.cfg.EncoreGoRoot, "bin", "go"+exe), args...)
-	env := []string{
-		"GO111MODULE=on",
-		"GOROOT=" + b.cfg.EncoreGoRoot,
-	}
-	if goos := b.cfg.GOOS; goos != "" {
-		env = append(env, "GOOS="+goos)
-	}
-	if !b.cfg.CgoEnabled {
-		env = append(env, "CGO_ENABLED=0")
-	}
-	cmd.Env = append(os.Environ(), env...)
-	cmd.Dir = b.appRoot
-	if out, err := cmd.CombinedOutput(); err != nil {
-		if len(out) == 0 {
-			out = []byte(err.Error())
-		}
-		out = makeErrsRelative(out, b.workdir, b.appRoot, b.cfg.WorkingDir)
-		return &Error{Output: out}
-	}
-	return nil
-}
-
-func (b *builder) addOverlay(src, dst string) {
-	if b.overlay == nil {
-		b.overlay = make(map[string]string)
-	}
-	b.overlay[src] = dst
-}
-
-// mergeModFiles merges two modfiles, adding the require statements from the latter to the former.
-// If both files have the same module requirement, it keeps the one with the greater semver version.
-func mergeModfiles(src, add *modfile.File) {
-	reqs := src.Require
-	for _, a := range add.Require {
-		found := false
-		for _, r := range src.Require {
-			if r.Mod.Path == a.Mod.Path {
-				found = true
-				// Update the version if the one to add is greater.
-				if semver.Compare(a.Mod.Version, r.Mod.Version) > 0 {
-					r.Mod.Version = a.Mod.Version
-				}
-			}
-		}
-		if !found {
-			reqs = append(reqs, a)
-		}
-	}
-	src.SetRequire(reqs)
-	src.Cleanup()
-}
-
-type Error struct {
-	Output []byte
-}
-
-func (err *Error) Error() string {
-	return string(err.Output)
-}
-
-type bailout struct {
-	err error
-}
-
-func (b *builder) err(msg string) {
-	panic(bailout{errors.New(msg)})
-}
-
-func (b *builder) errf(format string, args ...interface{}) {
-	b.err(fmt.Sprintf(format, args...))
-}
-
-const binaryName = "out"
-
-var exe string
-
-func init() {
-	if runtime.GOOS == "windows" {
-		exe = ".exe"
-	}
-}
-
-// makeErrsRelative goes through the errors and tweaks the filename to be relative
-// to the relwd.
-func makeErrsRelative(out []byte, workdir, appRoot, relwd string) []byte {
-	wdroot := filepath.Join(appRoot, relwd)
-	lines := bytes.Split(out, []byte{'\n'})
-	prefix := append([]byte(workdir), '/')
-	modified := false
-	for i, line := range lines {
-		if !bytes.HasPrefix(line, prefix) {
-			continue
-		}
-		idx := bytes.IndexByte(line, ':')
-		if idx == -1 || idx < len(prefix) {
-			continue
-		}
-		filename := line[:idx]
-		appPath := filepath.Join(appRoot, string(filename[len(prefix):]))
-		if rel, err := filepath.Rel(wdroot, appPath); err == nil {
-			lines[i] = append([]byte(rel), line[idx:]...)
-			modified = true
-		}
-	}
-
-	if !modified {
-		return out
-	}
-	return bytes.Join(lines, []byte{'\n'})
-}
diff --git a/compiler/build_test.go b/compiler/build_test.go
deleted file mode 100644
index 8f9614ed55..0000000000
--- a/compiler/build_test.go
+++ /dev/null
@@ -1,45 +0,0 @@
-package compiler
-
-import (
-	"testing"
-
-	qt "github.com/frankban/quicktest"
-	"golang.org/x/mod/modfile"
-)
-
-func TestMergeModfiles(t *testing.T) {
-	c := qt.New(t)
-	foo := `module foo
-
-require (
-	a v1.2.0
-	b v1.2.0
-	c v1.2.0
-)
-`
-	bar := `module bar
-
-require (
-	a v1.3.0
-	b v1.1.0
-	d v1.5.0
-)
-`
-	modFoo, err := modfile.Parse("foo", []byte(foo), nil)
-	c.Assert(err, qt.IsNil)
-	modBar, err := modfile.Parse("bar", []byte(bar), nil)
-	c.Assert(err, qt.IsNil)
-
-	mergeModfiles(modFoo, modBar)
-	out := modfile.Format(modFoo.Syntax)
-
-	c.Assert(string(out), qt.Equals, `module foo
-
-require (
-	a v1.3.0
-	b v1.2.0
-	c v1.2.0
-	d v1.5.0
-)
-`)
-}
diff --git a/compiler/internal/rewrite/rewrite.go b/compiler/internal/rewrite/rewrite.go
deleted file mode 100644
index 9fa38a69b5..0000000000
--- a/compiler/internal/rewrite/rewrite.go
+++ /dev/null
@@ -1,97 +0,0 @@
-package rewrite
-
-import (
-	"bytes"
-	"fmt"
-	"go/token"
-)
-
-func New(data []byte, base int) *Rewriter {
-	return &Rewriter{
-		base: 0,
-		segs: []segment{{
-			data:  data,
-			start: base,
-			end:   base + len(data),
-		}},
-	}
-}
-
-type Rewriter struct {
-	base int
-	segs []segment
-}
-
-func (r *Rewriter) Replace(start, end token.Pos, data []byte) {
-	si, so := r.seg(start)
-	ei, eo := r.seg(end)
-	r.replace(si, so, ei, eo, data)
-}
-
-func (r *Rewriter) Insert(start token.Pos, data []byte) {
-	si, so := r.seg(start)
-	r.replace(si, so, si, so, data)
-}
-
-func (r *Rewriter) Delete(start, end token.Pos) {
-	si, so := r.seg(start)
-	ei, eo := r.seg(end)
-	r.replace(si, so, ei, eo, nil)
-}
-
-func (r *Rewriter) Data() []byte {
-	var buf bytes.Buffer
-	for _, seg := range r.segs {
-		buf.Write(seg.data)
-	}
-	return buf.Bytes()
-}
-
-func (r *Rewriter) replace(si, so, ei, eo int, data []byte) {
-	if si == ei {
-		// Same segment; cut it into two
-		start := r.segs[si]
-		end := segment{
-			start: start.start + eo,
-			end:   start.end,
-			data:  start.data[eo:],
-		}
-		start.data = start.data[:so]
-		start.end = start.start + so
-		mid := segment{
-			start: start.end,
-			end:   end.start,
-			data:  data,
-		}
-		r.segs = append(r.segs[:si], append([]segment{start, mid, end}, r.segs[ei+1:]...)...)
-	} else {
-		// Already different segments; adjust start/end and replace segments in-between
-		start := r.segs[si]
-		end := r.segs[ei]
-		start.end = start.start + so
-		start.data = start.data[:so]
-		end.start += eo
-		end.data = end.data[eo:]
-		mid := segment{
-			start: start.end,
-			end:   end.start,
-			data:  data,
-		}
-		r.segs = append(r.segs[:si], append([]segment{start, mid, end}, r.segs[ei+1:]...)...)
-	}
-}
-
-func (r *Rewriter) seg(pos token.Pos) (idx int, offset int) {
-	p := int(pos)
-	for i, seg := range r.segs {
-		if seg.start <= p && p < seg.end {
-			return i, int(p - seg.start)
-		}
-	}
-	panic(fmt.Sprintf("original file does not contain pos %v", pos))
-}
-
-type segment struct {
-	start, end int
-	data       []byte
-}
diff --git a/compiler/internal/rewrite/rewrite_test.go b/compiler/internal/rewrite/rewrite_test.go
deleted file mode 100644
index c346914366..0000000000
--- a/compiler/internal/rewrite/rewrite_test.go
+++ /dev/null
@@ -1,45 +0,0 @@
-package rewrite
-
-import (
-	"bytes"
-	"testing"
-)
-
-func TestSplit(t *testing.T) {
-	rw := New([]byte("test"), 1)
-	rw.Replace(2, 4, []byte("ou"))  // "tout"
-	rw.Replace(1, 2, []byte("rea")) // "reaout"
-	rw.Insert(4, []byte("h"))       // "reaouht"
-	rw.Insert(4, []byte("a"))       // "reaouaht"
-	if got, want := rw.Data(), []byte("reaouhat"); !bytes.Equal(got, want) {
-		t.Errorf("got data %s, want %s", got, want)
-	}
-}
-
-func TestReplaceAcrossSegments(t *testing.T) {
-	rw := New([]byte("foo bar"), 1)
-	rw.Replace(5, 6, []byte("l"))  // "foo lar"
-	rw.Replace(2, 7, []byte("hi")) // "fhir"
-	if got, want := rw.Data(), []byte("fhir"); !bytes.Equal(got, want) {
-		t.Errorf("got data %s, want %s", got, want)
-	}
-}
-
-func TestReplaceTwice(t *testing.T) {
-	rw := New([]byte("foo bar"), 1)
-	rw.Replace(5, 6, []byte("l"))     // "foo lar"
-	rw.Replace(2, 7, []byte("hi"))    // "fhir"
-	rw.Replace(2, 7, []byte("hello")) // "fhellor"
-	if got, want := rw.Data(), []byte("fhellor"); !bytes.Equal(got, want) {
-		t.Errorf("got data %s, want %s", got, want)
-	}
-}
-
-func TestDelete(t *testing.T) {
-	rw := New([]byte("foo bar"), 1)
-	rw.Replace(5, 6, []byte("l")) // "foo lar"
-	rw.Delete(2, 7)
-	if got, want := rw.Data(), []byte("fr"); !bytes.Equal(got, want) {
-		t.Errorf("got data %s, want %s", got, want)
-	}
-}
diff --git a/compiler/rewrite.go b/compiler/rewrite.go
deleted file mode 100644
index f0f13de311..0000000000
--- a/compiler/rewrite.go
+++ /dev/null
@@ -1,144 +0,0 @@
-package compiler
-
-import (
-	"bytes"
-	"fmt"
-	"go/ast"
-	"io/ioutil"
-	"path/filepath"
-	"strconv"
-
-	"encr.dev/compiler/internal/rewrite"
-	"encr.dev/parser/est"
-	"golang.org/x/tools/go/ast/astutil"
-)
-
-// rewritePkg writes out modified files to targetDir.
-func (b *builder) rewritePkg(pkg *est.Package, targetDir string) error {
-	fset := b.res.FileSet
-	seenWrappers := make(map[string]bool)
-	var wrappers []*est.RPC
-	nodes := b.res.Nodes[pkg]
-	for _, file := range pkg.Files {
-		if len(file.References) == 0 {
-			// No references to other RPCs, we can skip it immediately
-			continue
-		}
-
-		rewrittenPkgs := make(map[*est.Package]bool)
-		rw := rewrite.New(file.Contents, file.Token.Base())
-
-		useExceptions := make(map[*ast.SelectorExpr]bool)
-		astutil.Apply(file.AST, func(c *astutil.Cursor) bool {
-			node := c.Node()
-			rewrite, ok := file.References[node]
-			if !ok {
-				return true
-			}
-
-			switch rewrite.Type {
-			case est.SQLDBNode:
-				call := c.Node().(*ast.CallExpr)
-				tx := nodes[call]
-				lp := fset.Position(call.Lparen)
-				rw.Insert(call.Lparen+1, []byte(fmt.Sprintf("%d, %s,/*line :%d:%d*/",
-					tx.Id, strconv.Quote(pkg.Service.Name), lp.Line, lp.Column+1)))
-				return true
-
-			case est.RLogNode:
-				call := c.Node().(*ast.CallExpr)
-				tx := nodes[call]
-				lp := fset.Position(call.Lparen)
-				rw.Insert(call.Lparen+1, []byte(fmt.Sprintf("%d,/*line :%d:%d*/",
-					tx.Id, lp.Line, lp.Column+1)))
-				return true
-
-			case est.RPCCallNode:
-				rpc := rewrite.RPC
-				wrapperName := "encore_" + rpc.Svc.Name + "_" + rpc.Name
-				call := c.Node().(*ast.CallExpr)
-
-				// Capture rewrites that should be ignored when computing if an import
-				// is still in use. The func is generally a SelectorExpr but if we call
-				// an API within the same package it's an ident, and can be safely ignored.
-				if sel, ok := call.Fun.(*ast.SelectorExpr); ok {
-					useExceptions[sel] = true
-				}
-
-				rw.Replace(call.Fun.Pos(), call.Fun.End(), []byte(wrapperName))
-				lp := fset.Position(call.Lparen)
-				callTx := nodes[call]
-				rpcTx := b.res.Nodes[rpc.Svc.Root][rpc.Func]
-				rw.Insert(call.Lparen+1, []byte(fmt.Sprintf("%d, %d,/*line :%d:%d*/",
-					callTx.Id, rpcTx.Id, lp.Line, lp.Column+1)))
-				rewrittenPkgs[rpc.Svc.Root] = true
-
-				if !seenWrappers[wrapperName] {
-					wrappers = append(wrappers, rpc)
-					seenWrappers[wrapperName] = true
-				}
-				return true
-
-			case est.RPCDefNode:
-				// Do nothing
-				return true
-
-			case est.SecretsNode:
-				spec := c.Node().(*ast.ValueSpec)
-
-				var buf bytes.Buffer
-				buf.WriteString("{\n")
-				for _, secret := range pkg.Secrets {
-					fmt.Fprintf(&buf, "\t%s: __encore_runtime.LoadSecret(%s),\n", secret, strconv.Quote(secret))
-				}
-				ep := fset.Position(spec.End())
-				fmt.Fprintf(&buf, "}/*line :%d:%d*/", ep.Line, ep.Column)
-
-				rw.Insert(spec.Type.Pos(), []byte("= "))
-				rw.Insert(spec.End(), buf.Bytes())
-
-				decl := file.AST.Decls[0]
-				ln := fset.Position(decl.Pos())
-				rw.Insert(decl.Pos(), []byte(fmt.Sprintf("import __encore_runtime %s\n/*line :%d:%d*/", strconv.Quote("encore.dev/runtime"), ln.Line, ln.Column)))
-				return true
-
-			default:
-				panic(fmt.Sprintf("unhandled rewrite type: %v", rewrite.Type))
-			}
-		}, nil)
-
-		// Determine if we have some imports that are now unused that we should remove.
-		for pkg := range rewrittenPkgs {
-			if !usesImport(file.AST, pkg.Name, pkg.ImportPath, useExceptions) {
-				spec, decl, ok := findImport(file.AST, pkg.ImportPath)
-				if ok {
-					// If the decl contains multiple imports, only delete the spec
-					if len(decl.Specs) > 1 {
-						rw.Delete(spec.Pos(), spec.End())
-					} else {
-						rw.Delete(decl.Pos(), decl.End())
-					}
-				}
-			}
-		}
-
-		// Write out the file
-		name := filepath.Base(file.Path)
-		dst := filepath.Join(targetDir, name)
-		if err := ioutil.WriteFile(dst, rw.Data(), 0644); err != nil {
-			return err
-		}
-		b.addOverlay(file.Path, dst)
-	}
-
-	if len(wrappers) > 0 {
-		name := "encore_rpc_wrappers.go"
-		wrapperPath := filepath.Join(targetDir, name)
-		if err := b.generateWrappers(pkg, wrappers, wrapperPath); err != nil {
-			return err
-		}
-		b.addOverlay(filepath.Join(pkg.Dir, name), wrapperPath)
-	}
-
-	return nil
-}
diff --git a/compiler/runtime/beta/auth/auth.go b/compiler/runtime/beta/auth/auth.go
deleted file mode 100644
index 053c7ce3c3..0000000000
--- a/compiler/runtime/beta/auth/auth.go
+++ /dev/null
@@ -1,34 +0,0 @@
-package auth
-
-import "encore.dev/runtime"
-
-// UID is a unique identifier representing a user (a user id).
-type UID = runtime.UID
-
-// UserID reports the uid of the user making the request.
-// The second result is true if there is a user and false
-// if the request was made without authentication details.
-func UserID() (UID, bool) {
-	req, _, ok := runtime.CurrentRequest()
-	if ok {
-		return req.UID, req.UID != ""
-	}
-	return "", false
-}
-
-// Data returns the structured auth data for the request.
-// It returns nil if the request was made without authentication details,
-// and the API endpoint does not require them.
-//
-// Expected usage is to immediately cast it to the registered auth data type:
-//
-//   usr, ok := auth.Data().(*user.Data)
-//   if !ok { /* ... */ }
-//
-func Data() interface{} {
-	req, _, ok := runtime.CurrentRequest()
-	if ok {
-		return req.AuthData
-	}
-	return nil
-}
diff --git a/compiler/runtime/go.mod b/compiler/runtime/go.mod
deleted file mode 100644
index 934beb8ffa..0000000000
--- a/compiler/runtime/go.mod
+++ /dev/null
@@ -1,11 +0,0 @@
-module encore.dev
-
-require (
-	github.com/felixge/httpsnoop v1.0.1
-	github.com/hashicorp/yamux v0.0.0-20200609203250-aecfd211c9ce
-	github.com/jackc/pgx/v4 v4.10.1
-	github.com/json-iterator/go v1.1.10
-	github.com/rs/zerolog v1.20.0
-)
-
-go 1.13
diff --git a/compiler/runtime/go.sum b/compiler/runtime/go.sum
deleted file mode 100644
index d104c40ff6..0000000000
--- a/compiler/runtime/go.sum
+++ /dev/null
@@ -1,182 +0,0 @@
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
-github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
-github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/felixge/httpsnoop v1.0.1 h1:lvB5Jl89CsZtGIWuTcDM1E/vkVs49/Ml7JJe07l8SPQ=
-github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
-github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
-github.com/gofrs/uuid v3.2.0+incompatible h1:y12jRkkFxsd7GpqdSZ+/KCs/fJbqpEXSGd4+jfEaewE=
-github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
-github.com/hashicorp/yamux v0.0.0-20200609203250-aecfd211c9ce h1:7UnVY3T/ZnHUrfviiAgIUjg2PXxsQfs5bphsG8F7Keo=
-github.com/hashicorp/yamux v0.0.0-20200609203250-aecfd211c9ce/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
-github.com/jackc/chunkreader v1.0.0 h1:4s39bBR8ByfqH+DKm8rQA3E1LHZWB9XWcrz8fqaZbe0=
-github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
-github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
-github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
-github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
-github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
-github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
-github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
-github.com/jackc/pgconn v1.4.0/go.mod h1:Y2O3ZDF0q4mMacyWV3AstPJpeHXWGEetiFttmq5lahk=
-github.com/jackc/pgconn v1.5.0/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
-github.com/jackc/pgconn v1.5.1-0.20200601181101-fa742c524853/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
-github.com/jackc/pgconn v1.8.0 h1:FmjZ0rOyXTr1wfWs45i4a9vjnjWUAGpMuQLD9OSs+lw=
-github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
-github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
-github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
-github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2 h1:JVX6jT/XfzNqIjye4717ITLaNwV9mWbJx0dLCpcRzdA=
-github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
-github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
-github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgproto3 v1.1.0 h1:FYYE4yRw+AgI8wXIinMlNjBbp/UitDJwfj5LqqewP1A=
-github.com/jackc/pgproto3 v1.1.0/go.mod h1:eR5FA3leWg7p9aeAqi37XOTgTIbkABlvcPB3E5rlc78=
-github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190420180111-c116219b62db/go.mod h1:bhq50y+xrl9n5mRYyCBFKkpRVTLYJVWeCc+mEAI3yXA=
-github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190609003834-432c2951c711/go.mod h1:uH0AWtUmuShn0bcesswc4aBTWGvw0cAxIJp+6OB//Wg=
-github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
-github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
-github.com/jackc/pgproto3/v2 v2.0.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.0.6 h1:b1105ZGEMFe7aCvrT1Cca3VoVb4ZFMaFJLJcg/3zD+8=
-github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgservicefile v0.0.0-20200307190119-3430c5407db8/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
-github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b h1:C8S2+VttkHFdOOCXJe+YGfa4vHYwlt4Zx+IVXQ97jYg=
-github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
-github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
-github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
-github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
-github.com/jackc/pgtype v1.2.0/go.mod h1:5m2OfMh1wTK7x+Fk952IDmI4nw3nPrvtQdM0ZT4WpC0=
-github.com/jackc/pgtype v1.3.1-0.20200510190516-8cd94a14c75a/go.mod h1:vaogEUkALtxZMCH411K+tKzNpwzCKU+AnPzBKZ+I+Po=
-github.com/jackc/pgtype v1.3.1-0.20200606141011-f6355165a91c/go.mod h1:cvk9Bgu/VzJ9/lxTO5R5sf80p0DiucVtN7ZxvaC4GmQ=
-github.com/jackc/pgtype v1.6.2 h1:b3pDeuhbbzBYcg5kwNmNDun4pFUD/0AAr1kLXZLeNt8=
-github.com/jackc/pgtype v1.6.2/go.mod h1:JCULISAZBFGrHaOXIIFiyfzW5VY0GRitRr8NeJsrdig=
-github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
-github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
-github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQnOEnf1dqHGpw7JmHqHc1NxDoalibchSk9/RWuDc=
-github.com/jackc/pgx/v4 v4.5.0/go.mod h1:EpAKPLdnTorwmPUUsqrPxy5fphV18j9q3wrfRXgo+kA=
-github.com/jackc/pgx/v4 v4.6.1-0.20200510190926-94ba730bb1e9/go.mod h1:t3/cdRQl6fOLDxqtlyhe9UWgfIi9R8+8v8GKV5TRA/o=
-github.com/jackc/pgx/v4 v4.6.1-0.20200606145419-4e5062306904/go.mod h1:ZDaNWkt9sW1JMiNn0kdYBaLelIhw7Pg4qd+Vk6tw7Hg=
-github.com/jackc/pgx/v4 v4.10.1 h1:/6Q3ye4myIj6AaplUm+eRcz4OhK9HAvFf4ePsG40LJY=
-github.com/jackc/pgx/v4 v4.10.1/go.mod h1:QlrWebbs3kqEZPHCTGyxecvzG6tvIsYu+A5b1raylkA=
-github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.1.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.1.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/jackc/puddle v1.1.3 h1:JnPg/5Q9xVJGfjsO5CPUOjnJps1JaRUm8I9FXVCFK94=
-github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
-github.com/json-iterator/go v1.1.10 h1:Kz6Cvnvv2wGdaG/V8yMvfkmNiXq9Ya2KUv4rouJJr68=
-github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
-github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
-github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
-github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
-github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
-github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.3.0 h1:/qkRGz8zljWiDcFvgpwUpwIAPu3r07TDvs3Rws+o/pU=
-github.com/lib/pq v1.3.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
-github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
-github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
-github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
-github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421 h1:ZqeYNhU3OHLH3mGKHDcjJRFFRrJa6eAM5H+CtDdOsPc=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742 h1:Esafd1046DLDQ0W1YjYsBW+p8U2u7vzgW2SQVmlNazg=
-github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
-github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
-github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
-github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
-github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
-github.com/rs/zerolog v1.20.0 h1:38k9hgtUBdxFwE34yS8rTHmHBa4eN16E4DJlv177LNs=
-github.com/rs/zerolog v1.20.0/go.mod h1:IzD0RJ65iWH0w97OQQebJEvTZYvsCUm9WVLWBQrJRjo=
-github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
-github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
-github.com/shopspring/decimal v0.0.0-20200227202807-02e2044944cc h1:jUIKcSPO9MoMJBbEoyE/RJoE8vz7Mb8AjvifMMwSyvY=
-github.com/shopspring/decimal v0.0.0-20200227202807-02e2044944cc/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
-github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
-github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
-github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
-github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
-go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
-go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
-go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
-go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
-go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
-go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
-go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
-golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9 h1:psW17arqaxU48Z5kZ0CQnkZWQJsqcURM6tKiBApRjXI=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
-golang.org/x/text v0.3.3 h1:cokOdA+Jmi5PJGXLlLllQSgYigAEfHXJAERHVMaCc2k=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
-golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190828213141-aed303cbaa74/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
-gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
-gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
diff --git a/compiler/runtime/internal/rlog/rlog.go b/compiler/runtime/internal/rlog/rlog.go
deleted file mode 100644
index 396ea96dec..0000000000
--- a/compiler/runtime/internal/rlog/rlog.go
+++ /dev/null
@@ -1,161 +0,0 @@
-package rlog
-
-import (
-	"encoding/binary"
-	"time"
-
-	"encore.dev/runtime"
-	"encore.dev/types/uuid"
-	"github.com/rs/zerolog"
-)
-
-type Ctx struct {
-	ctx zerolog.Context
-}
-
-func Debug(traceExpr int32, msg string, keysAndValues ...interface{}) {
-	log := runtime.Logger()
-	doLog(log.Debug(), msg, keysAndValues...)
-}
-
-func Info(traceExpr int32, msg string, keysAndValues ...interface{}) {
-	log := runtime.Logger()
-	doLog(log.Info(), msg, keysAndValues...)
-}
-
-func Error(traceExpr int32, msg string, keysAndValues ...interface{}) {
-	log := runtime.Logger()
-	doLog(log.Error(), msg, keysAndValues...)
-}
-
-func With(keysAndValues ...interface{}) Ctx {
-	ctx := runtime.Logger().With()
-	for i := 0; i < len(keysAndValues); i += 2 {
-		key := keysAndValues[i].(string)
-		val := keysAndValues[i+1]
-		ctx = addContext(ctx, key, val)
-	}
-	return Ctx{ctx: ctx}
-}
-
-func Debugc(traceExpr int32, ctx Ctx, msg string, keysAndValues ...interface{}) {
-	l := ctx.ctx.Logger()
-	doLog(l.Debug(), msg, keysAndValues...)
-}
-
-func Infoc(traceExpr int32, ctx Ctx, msg string, keysAndValues ...interface{}) {
-	l := ctx.ctx.Logger()
-	doLog(l.Info(), msg, keysAndValues...)
-}
-
-func Errorc(traceExpr int32, ctx Ctx, msg string, keysAndValues ...interface{}) {
-	l := ctx.ctx.Logger()
-	doLog(l.Error(), msg, keysAndValues...)
-}
-
-func doLog(ev *zerolog.Event, msg string, keysAndValues ...interface{}) {
-	for i := 0; i < len(keysAndValues); i += 2 {
-		key := keysAndValues[i].(string)
-		val := keysAndValues[i+1]
-		addEventEntry(ev, key, val)
-	}
-	ev.Msg(msg)
-}
-
-func addEventEntry(ev *zerolog.Event, key string, val interface{}) {
-	switch val := val.(type) {
-	case error:
-		ev.AnErr(key, val)
-	case string:
-		ev.Str(key, val)
-	case bool:
-		ev.Bool(key, val)
-
-	case time.Time:
-		ev.Time(key, val)
-	case time.Duration:
-		ev.Dur(key, val)
-	case uuid.UUID:
-		ev.Str(key, val.String())
-
-	default:
-		ev.Interface(key, val)
-
-	case int8:
-		ev.Int8(key, val)
-	case int16:
-		ev.Int16(key, val)
-	case int32:
-		ev.Int32(key, val)
-	case int64:
-		ev.Int64(key, val)
-	case int:
-		ev.Int(key, val)
-
-	case uint8:
-		ev.Uint8(key, val)
-	case uint16:
-		ev.Uint16(key, val)
-	case uint32:
-		ev.Uint32(key, val)
-	case uint64:
-		ev.Uint64(key, val)
-	case uint:
-		ev.Uint(key, val)
-
-	case float32:
-		ev.Float32(key, val)
-	case float64:
-		ev.Float64(key, val)
-	}
-}
-
-func addContext(ctx zerolog.Context, key string, val interface{}) zerolog.Context {
-	switch val := val.(type) {
-	case error:
-		return ctx.AnErr(key, val)
-	case string:
-		return ctx.Str(key, val)
-	case bool:
-		return ctx.Bool(key, val)
-
-	case time.Time:
-		return ctx.Time(key, val)
-	case time.Duration:
-		return ctx.Dur(key, val)
-	case uuid.UUID:
-		return ctx.Str(key, val.String())
-
-	default:
-		return ctx.Interface(key, val)
-
-	case int8:
-		return ctx.Int8(key, val)
-	case int16:
-		return ctx.Int16(key, val)
-	case int32:
-		return ctx.Int32(key, val)
-	case int64:
-		return ctx.Int64(key, val)
-	case int:
-		return ctx.Int(key, val)
-
-	case uint8:
-		return ctx.Uint8(key, val)
-	case uint16:
-		return ctx.Uint16(key, val)
-	case uint32:
-		return ctx.Uint32(key, val)
-	case uint64:
-		return ctx.Uint64(key, val)
-	case uint:
-		return ctx.Uint(key, val)
-
-	case float32:
-		return ctx.Float32(key, val)
-	case float64:
-		return ctx.Float64(key, val)
-	}
-}
-
-var bin = binary.BigEndian
diff --git a/compiler/runtime/rlog/rlog.go b/compiler/runtime/rlog/rlog.go
deleted file mode 100644
index 0ad5f8ba5d..0000000000
--- a/compiler/runtime/rlog/rlog.go
+++ /dev/null
@@ -1,35 +0,0 @@
-package rlog
-
-import (
-	"encore.dev/internal/rlog"
-)
-
-type Ctx = rlog.Ctx
-
-func Debug(traceExpr int32, msg string, keysAndValues ...interface{}) {
-	rlog.Debug(traceExpr, msg, keysAndValues...)
-}
-
-func Info(traceExpr int32, msg string, keysAndValues ...interface{}) {
-	rlog.Info(traceExpr, msg, keysAndValues...)
-}
-
-func Error(traceExpr int32, msg string, keysAndValues ...interface{}) {
-	rlog.Error(traceExpr, msg, keysAndValues...)
-}
-
-func With(keysAndValues ...interface{}) Ctx {
-	return rlog.With(keysAndValues...)
-}
-
-func Debugc(traceExpr int32, ctx Ctx, msg string, keysAndValues ...interface{}) {
-	rlog.Debugc(traceExpr, ctx, msg, keysAndValues...)
-}
-
-func Infoc(traceExpr int32, ctx Ctx, msg string, keysAndValues ...interface{}) {
-	rlog.Infoc(traceExpr, ctx, msg, keysAndValues...)
-}
-
-func Errorc(traceExpr int32, ctx Ctx, msg string, keysAndValues ...interface{}) {
-	rlog.Errorc(traceExpr, ctx, msg, keysAndValues...)
-}
diff --git a/compiler/runtime/runtime/config/config.go b/compiler/runtime/runtime/config/config.go
deleted file mode 100644
index 5769cd07ab..0000000000
--- a/compiler/runtime/runtime/config/config.go
+++ /dev/null
@@ -1,23 +0,0 @@
-package config
-
-import (
-	"net/http"
-)
-
-type ServerConfig struct {
-	Testing  bool
-	Services []*Service
-}
-
-type Service struct {
-	Name      string
-	RelPath   string // relative path to service pkg (from app root)
-	Endpoints []*Endpoint
-	SQLDB     bool // does the service use sqldb?
-}
-
-type Endpoint struct {
-	Name    string
-	Raw     bool
-	Handler func(w http.ResponseWriter, req *http.Request)
-}
diff --git a/compiler/runtime/runtime/http.go b/compiler/runtime/runtime/http.go
deleted file mode 100644
index 1f309a1066..0000000000
--- a/compiler/runtime/runtime/http.go
+++ /dev/null
@@ -1,359 +0,0 @@
-package runtime
-
-import (
-	"context"
-	"crypto/tls"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptrace"
-	"net/textproto"
-	"sync"
-	"sync/atomic"
-)
-
-var httpReqIDCtr uint64
-
-type httpRoundTrip struct {
-	ReqID  uint64
-	SpanID SpanID
-
-	mu     sync.Mutex
-	events []httpEvent
-}
-
-func (rt *httpRoundTrip) getConn(hostPort string) {
-	rt.addEvent(getConn, &getConnEvent{hostPort: hostPort})
-}
-
-func (rt *httpRoundTrip) gotConn(info httptrace.GotConnInfo) {
-	rt.addEvent(gotConn, &gotConnEvent{info: info})
-}
-
-func (rt *httpRoundTrip) gotFirstResponseByte() {
-	rt.addEvent(gotFirstResponseByte, nil)
-}
-
-func (rt *httpRoundTrip) got1xxResponse(code int, header textproto.MIMEHeader) error {
-	rt.addEvent(got1xxResponse, &got1xxResponseEvent{code: code, header: header})
-	return nil
-}
-
-func (rt *httpRoundTrip) dnsStart(info httptrace.DNSStartInfo) {
-	rt.addEvent(dnsStart, &dnsStartEvent{info: info})
-}
-
-func (rt *httpRoundTrip) dnsDone(info httptrace.DNSDoneInfo) {
-	rt.addEvent(dnsDone, &dnsDoneEvent{info: info})
-}
-
-func (rt *httpRoundTrip) connectStart(network, addr string) {
-	rt.addEvent(connectStart, &connectStartEvent{network: network, addr: addr})
-}
-
-func (rt *httpRoundTrip) connectDone(network, addr string, err error) {
-	rt.addEvent(connectDone, &connectDoneEvent{network: network, addr: addr, err: err})
-}
-
-func (rt *httpRoundTrip) tlsHandshakeStart() {
-	rt.addEvent(tlsHandshakeStart, nil)
-}
-
-func (rt *httpRoundTrip) tlsHandshakeDone(state tls.ConnectionState, err error) {
-	rt.addEvent(tlsHandshakeDone, &tlsHandshakeDoneEvent{info: state, err: err})
-}
-
-func (rt *httpRoundTrip) wroteHeaders() {
-	rt.addEvent(wroteHeaders, nil)
-}
-
-func (rt *httpRoundTrip) wroteRequest(info httptrace.WroteRequestInfo) {
-	rt.addEvent(wroteRequest, &wroteRequestEvent{info: info})
-}
-
-func (rt *httpRoundTrip) wait100Continue() {
-	rt.addEvent(wait100Continue, nil)
-}
-
-func (rt *httpRoundTrip) addEvent(code httpEventCode, data httpEventData) {
-	ts := nanotime()
-	rt.mu.Lock()
-	defer rt.mu.Unlock()
-
-	rt.events = append(rt.events, httpEvent{
-		code: code,
-		ts:   ts,
-		data: data,
-	})
-}
-
-func (rt *httpRoundTrip) encodeEvents(tb *TraceBuf) {
-	rt.mu.Lock()
-	n := len(rt.events)
-	evs := rt.events[:]
-	rt.mu.Unlock()
-
-	tb.UVarint(uint64(n))
-	for _, e := range evs {
-		tb.Bytes([]byte{byte(e.code)})
-		tb.Int64(e.ts)
-		if e.data != nil {
-			e.data.Encode(tb)
-		}
-	}
-}
-
-func httpBeginRoundTrip(req *http.Request) (context.Context, error) {
-	g := encoreGetG()
-	if g == nil || g.req == nil || !g.req.data.Traced {
-		return req.Context(), nil
-	} else if req.URL == nil {
-		return nil, fmt.Errorf("http: nil Request.URL")
-	}
-
-	spanID, err := genSpanID()
-	if err != nil {
-		return nil, err
-	}
-
-	reqID := atomic.AddUint64(&httpReqIDCtr, 1)
-
-	tb := NewTraceBuf(8 + 4 + 4 + 4 + len(req.Method) + 128)
-	tb.UVarint(reqID)
-	tb.Bytes(g.req.data.SpanID[:])
-	tb.Bytes(spanID[:])
-	tb.UVarint(uint64(g.goid))
-	tb.String(req.Method)
-	tb.String(req.URL.String())
-
-	encoreTraceEvent(HTTPCallStart, tb.Buf())
-
-	rt := &httpRoundTrip{
-		ReqID:  reqID,
-		SpanID: spanID,
-	}
-	ctx := context.WithValue(req.Context(), rtKey, rt)
-	tr := &httptrace.ClientTrace{
-		GetConn:              rt.getConn,
-		GotConn:              rt.gotConn,
-		GotFirstResponseByte: rt.gotFirstResponseByte,
-		Got1xxResponse:       rt.got1xxResponse,
-		DNSStart:             rt.dnsStart,
-		DNSDone:              rt.dnsDone,
-		ConnectStart:         rt.connectStart,
-		ConnectDone:          rt.connectDone,
-		TLSHandshakeStart:    rt.tlsHandshakeStart,
-		TLSHandshakeDone:     rt.tlsHandshakeDone,
-		WroteHeaders:         rt.wroteHeaders,
-		Wait100Continue:      rt.wait100Continue,
-		WroteRequest:         rt.wroteRequest,
-	}
-	return httptrace.WithClientTrace(ctx, tr), nil
-}
-
-func httpCompleteRoundTrip(req *http.Request, resp *http.Response, err error) {
-	rt, ok := req.Context().Value(rtKey).(*httpRoundTrip)
-	if !ok {
-		return
-	}
-
-	tb := NewTraceBuf(8 + 4 + 4 + 4)
-	tb.UVarint(rt.ReqID)
-	if err != nil {
-		msg := err.Error()
-		if msg == "" {
-			msg = "unknown error"
-		}
-		tb.String(msg)
-		tb.UVarint(0)
-	} else {
-		tb.String("")
-		tb.UVarint(uint64(resp.StatusCode))
-	}
-	rt.encodeEvents(&tb)
-	encoreTraceEvent(HTTPCallEnd, tb.Buf())
-
-	if req.Method != "HEAD" {
-		resp.Body = wrapRespBody(resp.Body, rt)
-	}
-}
-
-func (rt *httpRoundTrip) ClosedBody(err error) {
-	tb := NewTraceBuf(8 + 4)
-	tb.UVarint(rt.ReqID)
-	if err != nil {
-		msg := err.Error()
-		if msg == "" {
-			msg = "unknown error"
-		}
-		tb.String(msg)
-	} else {
-		tb.String("")
-	}
-	encoreTraceEvent(HTTPCallBodyClosed, tb.Buf())
-}
-
-func wrapRespBody(body io.ReadCloser, rt *httpRoundTrip) io.ReadCloser {
-	readWriteCloser, ok := body.(io.ReadWriteCloser)
-	if ok {
-		return writerCloseTracker{readWriteCloser, rt}
-	} else {
-		return closeTracker{body, rt}
-	}
-
-}
-
-type closeTracker struct {
-	io.ReadCloser
-	rt *httpRoundTrip
-}
-
-func (c closeTracker) Close() error {
-	err := c.ReadCloser.Close()
-	c.rt.ClosedBody(err)
-	return err
-}
-
-type writerCloseTracker struct {
-	io.ReadWriteCloser
-	rt *httpRoundTrip
-}
-
-func (c writerCloseTracker) Close() error {
-	err := c.ReadWriteCloser.Close()
-	c.rt.ClosedBody(err)
-	return err
-}
-
-type httpEvent struct {
-	code httpEventCode
-	ts   int64
-	data httpEventData // or nil
-}
-
-type httpEventData interface {
-	Encode(tb *TraceBuf)
-}
-
-type httpEventCode byte
-
-const (
-	getConn              = 0x01
-	gotConn              = 0x02
-	gotFirstResponseByte = 0x03
-	got1xxResponse       = 0x04
-	dnsStart             = 0x05
-	dnsDone              = 0x06
-	connectStart         = 0x07
-	connectDone          = 0x08
-	tlsHandshakeStart    = 0x09
-	tlsHandshakeDone     = 0x0A
-	wroteHeaders         = 0x0B
-	wroteRequest         = 0x0C
-	wait100Continue      = 0x0D
-)
-
-type getConnEvent struct {
-	hostPort string
-}
-
-func (e *getConnEvent) Encode(tb *TraceBuf) {
-	tb.String(e.hostPort)
-}
-
-type gotConnEvent struct {
-	info httptrace.GotConnInfo
-}
-
-func (e *gotConnEvent) Encode(tb *TraceBuf) {
-	tb.Bool(e.info.Reused)
-	tb.Bool(e.info.WasIdle)
-	tb.Int64(int64(e.info.IdleTime))
-}
-
-type got1xxResponseEvent struct {
-	code   int
-	header textproto.MIMEHeader
-}
-
-func (e *got1xxResponseEvent) Encode(tb *TraceBuf) {
-	tb.Varint(int64(e.code))
-	// TODO: write header as well?
-}
-
-type dnsStartEvent struct {
-	info httptrace.DNSStartInfo
-}
-
-func (e *dnsStartEvent) Encode(tb *TraceBuf) {
-	tb.String(e.info.Host)
-}
-
-type dnsDoneEvent struct {
-	info httptrace.DNSDoneInfo
-}
-
-func (e *dnsDoneEvent) Encode(tb *TraceBuf) {
-	if err := e.info.Err; err != nil {
-		msg := err.Error()
-		if msg == "" {
-			msg = "unknown error"
-		}
-		tb.String(msg)
-	} else {
-		tb.String("")
-	}
-	tb.UVarint(uint64(len(e.info.Addrs)))
-	for _, a := range e.info.Addrs {
-		tb.ByteString(a.IP)
-	}
-}
-
-type connectStartEvent struct {
-	network string
-	addr    string
-}
-
-func (e *connectStartEvent) Encode(tb *TraceBuf) {
-	tb.String(e.network)
-	tb.String(e.addr)
-}
-
-type connectDoneEvent struct {
-	network string
-	addr    string
-	err     error
-}
-
-func (e *connectDoneEvent) Encode(tb *TraceBuf) {
-	tb.String(e.network)
-	tb.String(e.addr)
-	tb.Err(e.err)
-}
-
-type tlsHandshakeDoneEvent struct {
-	info tls.ConnectionState
-	err  error
-}
-
-func (e *tlsHandshakeDoneEvent) Encode(tb *TraceBuf) {
-	tb.Err(e.err)
-	tb.Uint32(uint32(e.info.Version))
-	tb.Uint32(uint32(e.info.CipherSuite))
-	tb.String(e.info.ServerName)
-	tb.String(e.info.NegotiatedProtocol)
-}
-
-type wroteRequestEvent struct {
-	info httptrace.WroteRequestInfo
-}
-
-func (e *wroteRequestEvent) Encode(tb *TraceBuf) {
-	tb.Err(e.info.Err)
-}
-
-type contextKey int
-
-const (
-	rtKey contextKey = iota
-)
diff --git a/compiler/runtime/runtime/request.go b/compiler/runtime/runtime/request.go
deleted file mode 100644
index 027d788eb1..0000000000
--- a/compiler/runtime/runtime/request.go
+++ /dev/null
@@ -1,349 +0,0 @@
-package runtime
-
-import (
-	"fmt"
-	"sync/atomic"
-	"time"
-
-	"encore.dev/runtime/config"
-	jsoniter "github.com/json-iterator/go"
-	"github.com/rs/zerolog"
-
-	// These imports are used only by the generated wrappers in the compiler,
-	// but add them here so the 'go' command doesn't remove them from go.mod.
-	_ "github.com/felixge/httpsnoop"
-)
-
-var (
-	reqIDCtr  uint32
-	callIDCtr uint64
-)
-
-var (
-	RootLogger *zerolog.Logger
-	Config     *config.ServerConfig
-)
-
-var json = jsoniter.Config{
-	EscapeHTML:             false,
-	SortMapKeys:            false,
-	ValidateJsonRawMessage: true,
-}.Froze()
-
-type UID string
-
-func BeginOperation() {
-	encoreBeginOp(true /* always trace */)
-}
-
-func FinishOperation() {
-	encoreFinishOp()
-}
-
-type SpanID [8]byte
-
-type Type byte
-
-const (
-	RPCCall     Type = 0x01
-	AuthHandler Type = 0x02
-)
-
-type Request struct {
-	Type     Type
-	SpanID   SpanID
-	ParentID SpanID
-	UID      UID
-	AuthData interface{}
-
-	Service  string
-	Endpoint string
-	Start    time.Time
-	Logger   zerolog.Logger
-	Traced   bool
-}
-
-type RequestData struct {
-	Type            Type
-	Service         string
-	Endpoint        string
-	CallExprIdx     int32
-	EndpointExprIdx int32
-	Inputs          [][]byte
-	UID             UID
-	AuthData        interface{}
-}
-
-func BeginRequest(data RequestData) error {
-	spanID, err := genSpanID()
-	if err != nil {
-		return err
-	}
-	return beginReq(spanID, data)
-}
-
-func FinishRequest(status int, outputs [][]byte, err error) {
-	finishReq(status, outputs, err)
-}
-
-type Call struct {
-	CallID uint64
-	SpanID SpanID
-}
-
-type CallParams struct {
-	Service         string
-	Endpoint        string
-	CallExprIdx     int32
-	EndpointExprIdx int32
-}
-
-func BeginCall(params CallParams) (*Call, error) {
-	spanID, err := genSpanID()
-	if err != nil {
-		return nil, err
-	}
-
-	callID := atomic.AddUint64(&callIDCtr, 1)
-
-	if g := encoreGetG(); g != nil && g.req != nil && g.req.data.Traced {
-		tb := NewTraceBuf(8 + 4 + 4 + 4)
-		tb.UVarint(callID)
-		tb.Bytes(g.req.data.SpanID[:])
-		tb.Bytes(spanID[:])
-		tb.UVarint(uint64(g.goid))
-		tb.UVarint(uint64(params.CallExprIdx))
-		tb.UVarint(uint64(params.EndpointExprIdx))
-		encoreTraceEvent(CallStart, tb.Buf())
-	}
-
-	return &Call{
-		CallID: callID,
-		SpanID: spanID,
-	}, nil
-}
-
-func (c *Call) Finish(err error) {
-	if g := encoreGetG(); g != nil && g.req != nil && g.req.data.Traced {
-		tb := NewTraceBuf(8 + 4 + 4 + 4)
-		tb.UVarint(c.CallID)
-		if err != nil {
-			msg := err.Error()
-			if msg == "" {
-				msg = "unknown error"
-			}
-			tb.String(msg)
-		} else {
-			tb.String("")
-		}
-		encoreTraceEvent(CallEnd, tb.Buf())
-	}
-}
-
-func (c *Call) BeginReq(data RequestData) error {
-	return beginReq(c.SpanID, data)
-}
-
-func (c *Call) FinishReq(status int, outputs [][]byte, err error) {
-	finishReq(status, outputs, err)
-}
-
-type AuthCall struct {
-	SpanID SpanID
-	CallID uint64
-}
-
-func BeginAuth(authHandlerExprIdx int32, token string) (*AuthCall, error) {
-	spanID, err := genSpanID()
-	if err != nil {
-		return nil, fmt.Errorf("could not generate request id: %v", err)
-	}
-	callID := atomic.AddUint64(&callIDCtr, 1)
-
-	if g := encoreGetG(); g != nil && g.op.trace != nil {
-		tb := NewTraceBuf(8 + 4 + 4 + 4)
-		tb.UVarint(callID)
-		tb.Bytes(spanID[:])
-		tb.UVarint(uint64(g.goid))
-		tb.UVarint(uint64(authHandlerExprIdx))
-		encoreTraceEvent(AuthStart, tb.Buf())
-	}
-
-	return &AuthCall{
-		SpanID: spanID,
-		CallID: callID,
-	}, nil
-}
-
-func (ac *AuthCall) Finish(uid UID, err error) {
-	if g := encoreGetG(); g != nil && g.op.trace != nil {
-		tb := NewTraceBuf(64)
-		tb.UVarint(ac.CallID)
-		tb.String(string(uid))
-		if err != nil {
-			msg := err.Error()
-			if msg == "" {
-				msg = "unknown error"
-			}
-			tb.String(msg)
-		} else {
-			tb.String("")
-		}
-		encoreTraceEvent(AuthEnd, tb.Buf())
-	}
-}
-
-func (ac *AuthCall) BeginReq(data RequestData) error {
-	return beginReq(ac.SpanID, data)
-}
-
-func (ac *AuthCall) FinishReq(status int, outputs [][]byte, err error) {
-	finishReq(status, outputs, err)
-}
-
-func Logger() *zerolog.Logger {
-	if req, _, ok := CurrentRequest(); ok {
-		return &req.Logger
-	}
-	return RootLogger
-}
-
-func CurrentRequest() (*Request, uint32, bool) {
-	return currentReq()
-}
-
-func currentReq() (*Request, uint32, bool) {
-	if g := encoreGetG(); g != nil && g.req != nil {
-		return g.req.data, g.goid, true
-	}
-	return nil, 0, false
-}
-
-func TraceLog(event TraceEvent, data []byte) {
-	encoreTraceEvent(event, data)
-}
-
-func SerializeInputs(inputs ...interface{}) ([][]byte, error) {
-	var res [][]byte
-	for _, input := range inputs {
-		data, err := json.Marshal(input)
-		if err != nil {
-			return nil, fmt.Errorf("could not serialize input %v: %v", input, err)
-		}
-		res = append(res, data)
-	}
-	return res, nil
-}
-
-func CopyInputs(inputs [][]byte, outputs []interface{}) error {
-	if len(inputs) != len(outputs) {
-		panic(fmt.Sprintf("encore.dev/runtime.CopyInputs: len(inputs) != len(outputs): %v != %v",
-			len(inputs), len(outputs)))
-	}
-	for i, data := range inputs {
-		if err := json.Unmarshal(data, outputs[i]); err != nil {
-			return fmt.Errorf("could not serialize input #%d: %v", i, err)
-		}
-	}
-	return nil
-}
-
-func beginReq(spanID SpanID, data RequestData) error {
-	req := &Request{
-		Type:     data.Type,
-		SpanID:   spanID,
-		Service:  data.Service,
-		Endpoint: data.Endpoint,
-		Start:    time.Now(),
-		UID:      data.UID,
-		AuthData: data.AuthData,
-	}
-
-	if prev, _, ok := currentReq(); ok {
-		req.UID = prev.UID
-		req.AuthData = prev.AuthData
-		req.ParentID = prev.SpanID
-		encoreClearReq()
-	}
-
-	encoreBeginReq(spanID, req, true /* always trace */)
-
-	ctx := RootLogger.With().
-		Str("service", req.Service).
-		Str("endpoint", req.Endpoint)
-	if req.UID != "" {
-		ctx = ctx.Str("uid", string(req.UID))
-	}
-	req.Logger = ctx.Logger()
-
-	g := encoreGetG()
-	req.Traced = g.op.trace != nil
-	if req.Traced {
-		tb := NewTraceBuf(1 + 8 + 8 + 8 + 8 + 8 + 8 + 64)
-		tb.Bytes([]byte{byte(req.Type)})
-		tb.Bytes(req.SpanID[:])
-		tb.Bytes(req.ParentID[:])
-		tb.Now()
-		tb.UVarint(uint64(g.goid))
-		tb.UVarint(uint64(data.CallExprIdx))
-		tb.UVarint(uint64(data.EndpointExprIdx))
-		tb.String(string(req.UID))
-		tb.UVarint(uint64(len(data.Inputs)))
-		for _, input := range data.Inputs {
-			tb.UVarint(uint64(len(input)))
-			tb.Bytes(input)
-		}
-		encoreTraceEvent(RequestStart, tb.Buf())
-	}
-
-	switch data.Type {
-	case AuthHandler:
-		req.Logger.Info().Msg("running auth handler")
-	default:
-		req.Logger.Info().Msg("starting request")
-	}
-	return nil
-}
-
-func finishReq(status int, outputs [][]byte, err error) {
-	g := encoreGetG()
-	if g == nil || g.req == nil {
-		panic("encore: no current request running")
-	}
-
-	req := g.req.data
-	if err != nil {
-		switch req.Type {
-		case AuthHandler:
-			req.Logger.Error().Err(err).Msg("auth handler failed")
-		default:
-			req.Logger.Error().Err(err).Msg("request failed")
-		}
-	}
-
-	if req.Traced {
-		tb := NewTraceBuf(64)
-		tb.Bytes(req.SpanID[:])
-		if err == nil {
-			tb.Bytes([]byte{0}) // no error
-			tb.UVarint(uint64(len(outputs)))
-			for _, output := range outputs {
-				tb.UVarint(uint64(len(output)))
-				tb.Bytes(output)
-			}
-		} else {
-			tb.Bytes([]byte{1})
-			tb.String(err.Error())
-		}
-		encoreTraceEvent(RequestEnd, tb.Buf())
-	}
-
-	dur := time.Since(req.Start)
-	switch req.Type {
-	case AuthHandler:
-		req.Logger.Info().Dur("duration", dur).Msg("auth handler completed")
-	default:
-		req.Logger.Info().Dur("duration", dur).Int("status", status).Msg("request completed")
-	}
-	encoreCompleteReq()
-}
diff --git a/compiler/runtime/runtime/rtc.go b/compiler/runtime/runtime/rtc.go
deleted file mode 100644
index cb50e2aeb3..0000000000
--- a/compiler/runtime/runtime/rtc.go
+++ /dev/null
@@ -1,57 +0,0 @@
-package runtime
-
-import (
-	"bytes"
-	"context"
-	"encoding/base64"
-	"fmt"
-	"io/ioutil"
-	"log"
-	"net/http"
-	"os"
-)
-
-var (
-	runtimeAddr string
-	procID      string
-)
-
-func RecordTrace(ctx context.Context, traceID [16]byte, data []byte) error {
-	req, err := http.NewRequest("POST", runtimeAddr+"/trace", bytes.NewReader(data))
-	if err != nil {
-		return err
-	}
-	id := base64.RawURLEncoding.EncodeToString(traceID[:])
-	req.Header.Set("Content-Type", "application/vnd.google.protobuf")
-	req.Header.Set("X-Encore-Trace-Version", "v3")
-	req.Header.Set("X-Encore-Trace-ID", id)
-	req.Header.Set("X-Encore-Proc-ID", procID)
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		body, _ := ioutil.ReadAll(resp.Body)
-		return fmt.Errorf("could not record trace: HTTP %s: %s", resp.Status, body)
-	}
-	return nil
-}
-
-func init() {
-	envs := []string{
-		"ENCORE_RUNTIME_ADDRESS",
-		"ENCORE_PROC_ID",
-	}
-	var vals []string
-	for _, env := range envs {
-		val := os.Getenv(env)
-		if val == "" {
-			log.Fatalf("encore: internal error: %s not set", env)
-		}
-		vals = append(vals, val)
-	}
-
-	runtimeAddr = "http://" + vals[0]
-	procID = vals[1]
-}
diff --git a/compiler/runtime/runtime/runtime.go b/compiler/runtime/runtime/runtime.go
deleted file mode 100644
index 7d3bb05520..0000000000
--- a/compiler/runtime/runtime/runtime.go
+++ /dev/null
@@ -1,109 +0,0 @@
-package runtime
-
-import (
-	"context"
-	"net/http"
-	"unsafe"
-)
-
-// encoreG tracks per-goroutine Encore-specific data.
-// This must match the definition in the encore-go runtime.
-type encoreG struct {
-	// op is the current operation the goroutine is a part of.
-	op *encoreOp
-
-	// req is request-specific data defined in the Encore runtime.
-	req *encoreReq
-
-	// goid is the per-op goroutine id.
-	goid uint32
-}
-
-// encoreGetG gets the encore data for the current g, or nil.
-//go:linkname encoreGetG runtime.encoreGetG
-func encoreGetG() *encoreG
-
-// encoreOp represents an Encore operation.
-// This must match the definition in the encore-go runtime.
-type encoreOp struct {
-	// start is the start time of the operation
-	start int64 // start time of trace from nanotime()
-
-	// trace is the trace log; it is nil if the op is not traced.
-	trace unsafe.Pointer
-
-	// refs is the op refcount. It is 1 + number of requests
-	// that reference this op (see doc comment above).
-	// It is accessed atomically.
-	refs int32
-
-	// goidCtr is a per-operation goroutine counter, for telling
-	// apart goroutines participating in the operation.
-	goidCtr uint32
-}
-
-// encoreReq represents an Encore API request.
-type encoreReq struct {
-	// spanID is the request span id.
-	spanID SpanID
-	// data is request-specific data defined in the Encore runtime.
-	data *Request
-}
-
-// encoreBeginOp begins a new Encore operation.
-// The trace parameter determines whether tracing is enabled.
-//
-// It tags the current goroutine with the op.
-// It panics if the goroutine is already part of an op.
-//go:linkname encoreBeginOp runtime.encoreBeginOp
-func encoreBeginOp(trace bool) *encoreOp
-
-// encoreFinishOp marks an operation as finished.
-// It must be part of an operation.
-//go:linkname encoreFinishOp runtime.encoreFinishOp
-func encoreFinishOp()
-
-// encoreTraceEvent adds the event to the trace.
-// The g must already be part of an operation.
-//go:linkname encoreTraceEvent runtime.encoreTraceEvent
-func encoreTraceEvent(event TraceEvent, data []byte)
-
-// encoreBeginReq sets the request data for the current g,
-// and increases the ref count on the operation.
-// It must already be part of an operation.
-//go:linkname encoreBeginReq runtime.encoreBeginReq
-func encoreBeginReq(spanID SpanID, req *Request, trace bool)
-
-// encoreCompleteReq completes the request and decreases the
-// ref count on the operation.
-// The g must be processing a request.
-//go:linkname encoreCompleteReq runtime.encoreCompleteReq
-func encoreCompleteReq()
-
-// encoreClearReq clears request data from the running g
-// without decrementing the ref count.
-// The g must be processing a request.
-//go:linkname encoreClearReq runtime.encoreClearReq
-func encoreClearReq()
-
-// encoreTraceID represents an Encore trace id.
-type encoreTraceID [16]byte
-
-// encoreSendTrace is called by Encore's go runtime to send a trace.
-//go:linkname encoreSendTrace runtime.encoreSendTrace
-func encoreSendTrace(data []byte) {
-	go asyncSendTrace(data)
-}
-
-//go:linkname encoreBeginRoundTrip net/http.encoreBeginRoundTrip
-func encoreBeginRoundTrip(req *http.Request) (context.Context, error) {
-	return httpBeginRoundTrip(req)
-}
-
-//go:linkname encoreFinishRoundTrip net/http.encoreFinishRoundTrip
-func encoreFinishRoundTrip(req *http.Request, resp *http.Response, err error) {
-	httpCompleteRoundTrip(req, resp, err)
-}
-
-//go:linkname nanotime runtime.nanotime
-func nanotime() int64
diff --git a/compiler/runtime/runtime/secrets.go b/compiler/runtime/runtime/secrets.go
deleted file mode 100644
index e6c74ba877..0000000000
--- a/compiler/runtime/runtime/secrets.go
+++ /dev/null
@@ -1,47 +0,0 @@
-package runtime
-
-import (
-	"encoding/base64"
-	"fmt"
-	"os"
-	"strings"
-)
-
-func LoadSecret(key string) string {
-	val, ok := secrets[key]
-	if !ok {
-		fmt.Fprintln(os.Stderr, "encore: could not find secret", key)
-		os.Exit(2)
-	}
-	return val
-}
-
-var secrets = loadSecrets()
-
-func loadSecrets() map[string]string {
-	const env = "ENCORE_SECRETS"
-	encoded := os.Getenv(env)
-	os.Unsetenv(env)
-	if encoded == "" {
-		return nil
-	}
-
-	// Format is "key1=val1,key2=val2" where values are base64-encoded using RawStdEncoding.
-	secrets := make(map[string]string)
-	fields := strings.Split(encoded, ",")
-	for _, f := range fields {
-		eql := strings.IndexByte(f, '=')
-		if eql == -1 {
-			fmt.Fprintln(os.Stderr, "encore: internal error: invalid ENCORE_SECRETS format")
-			os.Exit(2)
-		}
-		key := f[:eql]
-		value, err := base64.RawStdEncoding.DecodeString(f[eql+1:])
-		if err != nil {
-			fmt.Fprintln(os.Stderr, "encore: internal error: invalid ENCORE_SECRETS format")
-			os.Exit(2)
-		}
-		secrets[key] = string(value)
-	}
-	return secrets
-}
diff --git a/compiler/runtime/runtime/setup.go b/compiler/runtime/runtime/setup.go
deleted file mode 100644
index 262054fefa..0000000000
--- a/compiler/runtime/runtime/setup.go
+++ /dev/null
@@ -1,107 +0,0 @@
-package runtime
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"runtime"
-	"strconv"
-	"strings"
-
-	"encore.dev/runtime/config"
-	"github.com/hashicorp/yamux"
-	"github.com/rs/zerolog"
-)
-
-type Server struct {
-	logger   zerolog.Logger
-	handlers map[string]*config.Endpoint
-}
-
-func (srv *Server) handleRPC(service string, endpoint *config.Endpoint) {
-	srv.logger.Info().Str("service", service).Str("endpoint", endpoint.Name).Msg("registered endpoint")
-	key := service + "." + endpoint.Name
-	srv.handlers[key] = endpoint
-}
-
-func (srv *Server) ListenAndServe() error {
-	rwc, err := srv.setupConn()
-	if err != nil {
-		return err
-	}
-	s, err := yamux.Server(rwc, yamux.DefaultConfig())
-	if err != nil {
-		return err
-	}
-	httpsrv := &http.Server{
-		Handler: http.HandlerFunc(srv.handler),
-	}
-	return httpsrv.Serve(s)
-}
-
-func (srv *Server) setupConn() (io.ReadWriteCloser, error) {
-	var in, out *os.File
-	if runtime.GOOS == "windows" {
-		extraFiles := os.Getenv("ENCORE_EXTRA_FILES")
-		fds := strings.Split(extraFiles, ",")
-		if len(fds) < 2 {
-			return nil, fmt.Errorf("could not get request/response file descriptors: %q", extraFiles)
-		}
-		infd, err1 := strconv.Atoi(fds[0])
-		outfd, err2 := strconv.Atoi(fds[1])
-		if err1 != nil || err2 != nil {
-			return nil, fmt.Errorf("could not parse request/response file descriptors: %q", extraFiles)
-		}
-		in = os.NewFile(uintptr(infd), "encore-stdin")
-		out = os.NewFile(uintptr(outfd), "encore-stdout")
-	} else {
-		in = os.NewFile(uintptr(3), "encore-stdin")
-		out = os.NewFile(uintptr(4), "encore-stdout")
-	}
-
-	rwc := struct {
-		io.Reader
-		io.WriteCloser
-	}{
-		Reader:      in,
-		WriteCloser: out,
-	}
-	return rwc, nil
-}
-
-func (srv *Server) handler(w http.ResponseWriter, req *http.Request) {
-	endpoint := srv.handlers[strings.TrimPrefix(req.URL.Path, "/")]
-	if endpoint == nil {
-		http.Error(w, "Endpoint Not Found", http.StatusNotFound)
-		return
-	}
-	endpoint.Handler(w, req)
-}
-
-func Setup(cfg *config.ServerConfig) *Server {
-	logger := zerolog.New(zerolog.ConsoleWriter{Out: os.Stderr}).With().Timestamp().Logger()
-	RootLogger = &logger
-	Config = cfg
-
-	srv := &Server{
-		logger:   logger,
-		handlers: make(map[string]*config.Endpoint),
-	}
-	for _, svc := range cfg.Services {
-		for _, endpoint := range svc.Endpoints {
-			srv.handleRPC(svc.Name, endpoint)
-		}
-	}
-	return srv
-}
-
-type dummyAddr struct{}
-
-func (dummyAddr) Network() string {
-	return "encore"
-}
-
-func (dummyAddr) String() string {
-	return "encore://localhost"
-}
diff --git a/compiler/runtime/runtime/tracebuf.go b/compiler/runtime/runtime/tracebuf.go
deleted file mode 100644
index 2fd6655095..0000000000
--- a/compiler/runtime/runtime/tracebuf.go
+++ /dev/null
@@ -1,179 +0,0 @@
-package runtime
-
-import (
-	"context"
-	"crypto/rand"
-	"fmt"
-	"os"
-	"time"
-
-	_ "unsafe" // for go:linkname
-)
-
-type TraceEvent byte
-
-const (
-	RequestStart       TraceEvent = 0x01
-	RequestEnd         TraceEvent = 0x02
-	GoStart            TraceEvent = 0x03
-	GoEnd              TraceEvent = 0x04
-	GoClear            TraceEvent = 0x05
-	TxStart            TraceEvent = 0x06
-	TxEnd              TraceEvent = 0x07
-	QueryStart         TraceEvent = 0x08
-	QueryEnd           TraceEvent = 0x09
-	CallStart          TraceEvent = 0x0A
-	CallEnd            TraceEvent = 0x0B
-	AuthStart          TraceEvent = 0x0C
-	AuthEnd            TraceEvent = 0x0D
-	HTTPCallStart      TraceEvent = 0x0E
-	HTTPCallEnd        TraceEvent = 0x0F
-	HTTPCallBodyClosed TraceEvent = 0x10
-)
-
-// genTraceID generates a new trace id and root span id.
-func genTraceID() ([16]byte, error) {
-	var traceID [16]byte
-	_, err := rand.Read(traceID[:])
-	return traceID, err
-}
-
-// genSpanID generates a span id.
-func genSpanID() (span SpanID, err error) {
-	_, err = rand.Read(span[:])
-	return
-}
-
-func asyncSendTrace(data []byte) {
-	if Config.Testing {
-		// Don't send traces when running tests
-		return
-	}
-
-	traceID, err := genTraceID()
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "encore: could not generate trace id:", err)
-		return
-	}
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	err = RecordTrace(ctx, traceID, data)
-	cancel()
-	if err != nil {
-		fmt.Fprintln(os.Stderr, "encore: could not record trace:", err)
-	}
-}
-
-type TraceBuf struct {
-	scratch [10]byte
-	buf     []byte
-}
-
-func NewTraceBuf(size int) TraceBuf {
-	return TraceBuf{buf: make([]byte, 0, size)}
-}
-
-func (tb *TraceBuf) Buf() []byte {
-	return tb.buf
-}
-
-func (tb *TraceBuf) Bytes(b []byte) {
-	tb.buf = append(tb.buf, b...)
-}
-
-func (tb *TraceBuf) String(s string) {
-	tb.UVarint(uint64(len(s)))
-	tb.Bytes([]byte(s))
-}
-
-func (tb *TraceBuf) ByteString(b []byte) {
-	tb.UVarint(uint64(len(b)))
-	tb.Bytes(b)
-}
-
-func (tb *TraceBuf) Now() {
-	now := time.Now().UnixNano()
-	tb.Int64(now)
-}
-
-func (tb *TraceBuf) Bool(b bool) {
-	if b {
-		tb.Bytes([]byte{1})
-	} else {
-		tb.Bytes([]byte{0})
-	}
-}
-
-func (tb *TraceBuf) Err(err error) {
-	msg := ""
-	if err != nil {
-		msg = err.Error()
-		if msg == "" {
-			msg = "unknown error"
-		}
-	}
-	tb.String(msg)
-}
-
-func (tb *TraceBuf) Int32(x int32) {
-	var u uint32
-	if x < 0 {
-		u = (^uint32(x) << 1) | 1 // complement i, bit 0 is 1
-	} else {
-		u = (uint32(x) << 1) // do not complement i, bit 0 is 0
-	}
-	tb.Uint32(u)
-}
-
-func (tb *TraceBuf) Uint32(x uint32) {
-	tb.buf = append(tb.buf,
-		byte(x),
-		byte(x>>8),
-		byte(x>>16),
-		byte(x>>24),
-	)
-}
-
-func (tb *TraceBuf) Int64(x int64) {
-	var u uint64
-	if x < 0 {
-		u = (^uint64(x) << 1) | 1 // complement i, bit 0 is 1
-	} else {
-		u = (uint64(x) << 1) // do not complement i, bit 0 is 0
-	}
-	tb.Uint64(u)
-}
-
-func (tb *TraceBuf) Uint64(x uint64) {
-	tb.buf = append(tb.buf,
-		byte(x),
-		byte(x>>8),
-		byte(x>>16),
-		byte(x>>24),
-		byte(x>>32),
-		byte(x>>40),
-		byte(x>>48),
-		byte(x>>56),
-	)
-}
-
-func (tb *TraceBuf) Varint(x int64) {
-	var u uint64
-	if x < 0 {
-		u = (^uint64(x) << 1) | 1 // complement i, bit 0 is 1
-	} else {
-		u = (uint64(x) << 1) // do not complement i, bit 0 is 0
-	}
-	tb.UVarint(u)
-}
-
-func (tb *TraceBuf) UVarint(u uint64) {
-	i := 0
-	for u >= 0x80 {
-		tb.scratch[i] = byte(u) | 0x80
-		u >>= 7
-		i++
-	}
-	tb.scratch[i] = byte(u)
-	i++
-	tb.Bytes(tb.scratch[:i])
-}
diff --git a/compiler/runtime/storage/sqldb/sqldb.go b/compiler/runtime/storage/sqldb/sqldb.go
deleted file mode 100644
index 3ed0416366..0000000000
--- a/compiler/runtime/storage/sqldb/sqldb.go
+++ /dev/null
@@ -1,380 +0,0 @@
-package sqldb
-
-import (
-	"context"
-	"database/sql"
-	"fmt"
-	"os"
-	"sync/atomic"
-
-	"encore.dev/runtime"
-	"encore.dev/runtime/config"
-	"github.com/jackc/pgx/v4"
-	"github.com/jackc/pgx/v4/pgxpool"
-)
-
-var (
-	txidCounter  uint64
-	queryCounter uint64
-)
-
-// ExecResult is the result of an Exec query.
-type ExecResult interface {
-	// RowsAffected returns the number of rows affected. If the result was not
-	// for a row affecting command (e.g. "CREATE TABLE") then it returns 0.
-	RowsAffected() int64
-}
-
-func Exec(traceExpr int32, svc string, ctx context.Context, query string, args ...interface{}) (ExecResult, error) {
-	qid := atomic.AddUint64(&queryCounter, 1)
-	req, goid, _ := runtime.CurrentRequest()
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		tb.Bytes(req.SpanID[:])
-		tb.UVarint(0) // no tx
-		tb.UVarint(uint64(goid))
-		tb.UVarint(uint64(traceExpr))
-		tb.String(query)
-		runtime.TraceLog(runtime.QueryStart, tb.Buf())
-	}
-
-	res, err := getDB(svc).Exec(ctx, query, args...)
-	err = convertErr(err)
-
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		if err != nil {
-			tb.String(err.Error())
-		} else {
-			tb.String("")
-		}
-		runtime.TraceLog(runtime.QueryEnd, tb.Buf())
-	}
-
-	return res, err
-}
-
-func Query(traceExpr int32, svc string, ctx context.Context, query string, args ...interface{}) (*Rows, error) {
-	qid := atomic.AddUint64(&queryCounter, 1)
-	req, goid, _ := runtime.CurrentRequest()
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		tb.Bytes(req.SpanID[:])
-		tb.UVarint(0) // no tx
-		tb.UVarint(uint64(goid))
-		tb.UVarint(uint64(traceExpr))
-		tb.String(query)
-		runtime.TraceLog(runtime.QueryStart, tb.Buf())
-	}
-
-	rows, err := getDB(svc).Query(ctx, query, args...)
-	err = convertErr(err)
-
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		if err != nil {
-			tb.String(err.Error())
-		} else {
-			tb.String("")
-		}
-		runtime.TraceLog(runtime.QueryEnd, tb.Buf())
-	}
-
-	if err != nil {
-		return nil, err
-	}
-	return &Rows{std: rows}, nil
-}
-
-func QueryRow(traceExpr int32, svc string, ctx context.Context, query string, args ...interface{}) *Row {
-	qid := atomic.AddUint64(&queryCounter, 1)
-	req, goid, _ := runtime.CurrentRequest()
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		tb.Bytes(req.SpanID[:])
-		tb.UVarint(0) // no tx
-		tb.UVarint(uint64(goid))
-		tb.UVarint(uint64(traceExpr))
-		tb.String(query)
-		runtime.TraceLog(runtime.QueryStart, tb.Buf())
-	}
-
-	rows, err := getDB(svc).Query(ctx, query, args...)
-	err = convertErr(err)
-	r := &Row{rows: rows, err: err}
-
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		if err := r.Err(); err != nil {
-			tb.String(err.Error())
-		} else {
-			tb.String("")
-		}
-		runtime.TraceLog(runtime.QueryEnd, tb.Buf())
-	}
-
-	return r
-}
-
-type Tx struct {
-	txid uint64
-	std  pgx.Tx
-}
-
-func Begin(traceExpr int32, svc string, ctx context.Context) (*Tx, error) {
-	tx, err := getDB(svc).Begin(ctx)
-	err = convertErr(err)
-	if err != nil {
-		return nil, err
-	}
-	txid := atomic.AddUint64(&txidCounter, 1)
-	req, goid, _ := runtime.CurrentRequest()
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(txid)
-		tb.Bytes(req.SpanID[:])
-		tb.UVarint(uint64(goid))
-		tb.UVarint(uint64(traceExpr))
-		runtime.TraceLog(runtime.TxStart, tb.Buf())
-	}
-
-	return &Tx{txid: txid, std: tx}, nil
-}
-
-func Commit(traceExpr int32, svc string, tx *Tx) error {
-	err := tx.std.Commit(context.Background())
-	err = convertErr(err)
-	req, goid, _ := runtime.CurrentRequest()
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(tx.txid)
-		tb.Bytes(req.SpanID[:])
-		tb.UVarint(uint64(goid))
-		tb.Bytes([]byte{1})
-		tb.UVarint(uint64(traceExpr))
-		if err != nil {
-			tb.String(err.Error())
-		} else {
-			tb.String("")
-		}
-		runtime.TraceLog(runtime.TxEnd, tb.Buf())
-	}
-	return err
-}
-
-func Rollback(traceExpr int32, svc string, tx *Tx) error {
-	err := tx.std.Rollback(context.Background())
-	err = convertErr(err)
-	req, goid, _ := runtime.CurrentRequest()
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(tx.txid)
-		tb.Bytes(req.SpanID[:])
-		tb.UVarint(uint64(goid))
-		tb.Bytes([]byte{0})
-		tb.UVarint(uint64(traceExpr))
-		if err != nil {
-			tb.String(err.Error())
-		} else {
-			tb.String("")
-		}
-		runtime.TraceLog(runtime.TxEnd, tb.Buf())
-	}
-	return err
-}
-
-func ExecTx(traceExpr int32, svc string, tx *Tx, ctx context.Context, query string, args ...interface{}) (ExecResult, error) {
-	qid := atomic.AddUint64(&queryCounter, 1)
-	req, goid, _ := runtime.CurrentRequest()
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		tb.Bytes(req.SpanID[:])
-		tb.UVarint(tx.txid)
-		tb.UVarint(uint64(goid))
-		tb.UVarint(uint64(traceExpr))
-		tb.String(query)
-		runtime.TraceLog(runtime.QueryStart, tb.Buf())
-	}
-
-	res, err := tx.std.Exec(ctx, query, args...)
-	err = convertErr(err)
-
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		if err != nil {
-			tb.String(err.Error())
-		} else {
-			tb.String("")
-		}
-		runtime.TraceLog(runtime.QueryEnd, tb.Buf())
-	}
-
-	return res, err
-}
-
-func QueryTx(traceExpr int32, svc string, tx *Tx, ctx context.Context, query string, args ...interface{}) (*Rows, error) {
-	qid := atomic.AddUint64(&queryCounter, 1)
-	req, goid, _ := runtime.CurrentRequest()
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		tb.Bytes(req.SpanID[:])
-		tb.UVarint(tx.txid)
-		tb.UVarint(uint64(goid))
-		tb.UVarint(uint64(traceExpr))
-		tb.String(query)
-		runtime.TraceLog(runtime.QueryStart, tb.Buf())
-	}
-
-	rows, err := tx.std.Query(ctx, query, args...)
-	err = convertErr(err)
-
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		if err != nil {
-			tb.String(err.Error())
-		} else {
-			tb.String("")
-		}
-		runtime.TraceLog(runtime.QueryEnd, tb.Buf())
-	}
-
-	if err != nil {
-		return nil, err
-	}
-	return &Rows{std: rows}, nil
-}
-
-func QueryRowTx(traceExpr int32, svc string, tx *Tx, ctx context.Context, query string, args ...interface{}) *Row {
-	qid := atomic.AddUint64(&queryCounter, 1)
-	req, goid, _ := runtime.CurrentRequest()
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		tb.Bytes(req.SpanID[:])
-		tb.UVarint(tx.txid)
-		tb.UVarint(uint64(goid))
-		tb.UVarint(uint64(traceExpr))
-		tb.String(query)
-		runtime.TraceLog(runtime.QueryStart, tb.Buf())
-	}
-
-	// pgx currently does not support .Err() on Row.
-	// Work around this by using Query.
-	rows, err := tx.std.Query(ctx, query, args...)
-	err = convertErr(err)
-	r := &Row{rows: rows, err: err}
-
-	if req != nil && req.Traced {
-		var tb runtime.TraceBuf
-		tb.UVarint(qid)
-		if err := r.Err(); err != nil {
-			tb.String(err.Error())
-		} else {
-			tb.String("")
-		}
-		runtime.TraceLog(runtime.QueryEnd, tb.Buf())
-	}
-
-	return r
-}
-
-type Rows struct {
-	std pgx.Rows
-}
-
-func (r *Rows) Close()                         { r.std.Close() }
-func (r *Rows) Scan(dest ...interface{}) error { return r.std.Scan(dest...) }
-func (r *Rows) Err() error                     { return r.std.Err() }
-func (r *Rows) Next() bool                     { return r.std.Next() }
-
-type Row struct {
-	rows pgx.Rows
-	err  error
-}
-
-func (r *Row) Scan(dest ...interface{}) error {
-	if r.err != nil {
-		return r.err
-	}
-	if !r.rows.Next() {
-		if err := r.rows.Err(); err != nil {
-			return convertErr(err)
-		}
-		return sql.ErrNoRows
-	}
-	r.rows.Scan(dest...)
-	r.rows.Close()
-	return convertErr(r.rows.Err())
-}
-
-func (r *Row) Err() error {
-	if r.err != nil {
-		return r.err
-	}
-	return convertErr(r.rows.Err())
-}
-
-var dbMap atomic.Value
-
-func setDBs(dbs map[string]*pgxpool.Pool) {
-	dbMap.Store(dbs)
-}
-
-func getDB(svc string) *pgxpool.Pool {
-	dbs, ok := dbMap.Load().(map[string]*pgxpool.Pool)
-	if !ok {
-		panic("sqldb: service not initialized: " + svc)
-	}
-	db, ok := dbs[svc]
-	if !ok {
-		panic("sqldb: could not find database for service " + svc)
-	}
-	return db
-}
-
-func Setup(cfg *config.ServerConfig) {
-	addr := os.Getenv("ENCORE_SQLDB_ADDRESS")
-	passwd := os.Getenv("ENCORE_SQLDB_PASSWORD")
-	dbs := make(map[string]*pgxpool.Pool)
-	for _, svc := range cfg.Services {
-		if svc.SQLDB {
-			if addr == "" {
-				panic("sqldb: ENCORE_SQLDB_ADDRESS not set")
-			}
-
-			uri := fmt.Sprintf("postgresql://encore:%s@%s/%s?sslmode=disable",
-				passwd, addr, svc.Name)
-			cfg, err := pgxpool.ParseConfig(uri)
-			if err != nil {
-				panic("sqldb: invalid database uri: " + err.Error())
-			}
-			cfg.LazyConnect = true
-			cfg.MaxConns = 30
-			pool, err := pgxpool.ConnectConfig(context.Background(), cfg)
-			if err != nil {
-				panic("sqldb: setup db: " + err.Error())
-			}
-			dbs[svc.Name] = pool
-		}
-	}
-	setDBs(dbs)
-}
-
-func convertErr(err error) error {
-	switch err {
-	case pgx.ErrNoRows:
-		return sql.ErrNoRows
-	default:
-		return err
-	}
-}
diff --git a/compiler/runtime/types/uuid/generator.go b/compiler/runtime/types/uuid/generator.go
deleted file mode 100644
index 00cf88e065..0000000000
--- a/compiler/runtime/types/uuid/generator.go
+++ /dev/null
@@ -1,162 +0,0 @@
-// Copyright (C) 2013-2018 by Maxim Bublis <b@codemonkey.ru>
-//
-// Permission is hereby granted, free of charge, to any person obtaining
-// a copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to
-// permit persons to whom the Software is furnished to do so, subject to
-// the following conditions:
-//
-// The above copyright notice and this permission notice shall be
-// included in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-package uuid
-
-import (
-	"crypto/md5"
-	"crypto/rand"
-	"crypto/sha1"
-	"encoding/binary"
-	"hash"
-	"io"
-	"os"
-	"sync"
-	"time"
-)
-
-// Difference in 100-nanosecond intervals between
-// UUID epoch (October 15, 1582) and Unix epoch (January 1, 1970).
-const epochStart = 122192928000000000
-
-type epochFunc func() time.Time
-
-var (
-	posixUID = uint32(os.Getuid())
-	posixGID = uint32(os.Getgid())
-)
-
-// NewV3 returns a UUID based on the MD5 hash of the namespace UUID and name.
-func NewV3(ns UUID, name string) UUID {
-	return g.NewV3(ns, name)
-}
-
-// NewV4 returns a randomly generated UUID.
-func NewV4() (UUID, error) {
-	return g.NewV4()
-}
-
-// NewV5 returns a UUID based on SHA-1 hash of the namespace UUID and name.
-func NewV5(ns UUID, name string) UUID {
-	return g.NewV5(ns, name)
-}
-
-// gen is a reference UUID generator based on the specifications laid out in
-// RFC-4122 and DCE 1.1: Authentication and Security Services. This type
-// satisfies the Generator interface as defined in this package.
-//
-// For consumers who are generating V1 UUIDs, but don't want to expose the MAC
-// address of the node generating the UUIDs, the NewGenWithHWAF() function has been
-// provided as a convenience. See the function's documentation for more info.
-//
-// The authors of this package do not feel that the majority of users will need
-// to obfuscate their MAC address, and so we recommend using NewGen() to create
-// a new generator.
-type gen struct {
-	clockSequenceOnce sync.Once
-	storageMutex      sync.Mutex
-
-	rand io.Reader
-
-	epochFunc     epochFunc
-	lastTime      uint64
-	clockSequence uint16
-}
-
-// newGen returns a new instance of gen with some default values set.
-var g = &gen{
-	epochFunc: time.Now,
-	rand:      rand.Reader,
-}
-
-// NewV3 returns a UUID based on the MD5 hash of the namespace UUID and name.
-func (g *gen) NewV3(ns UUID, name string) UUID {
-	u := newFromHash(md5.New(), ns, name)
-	u.SetVersion(V3)
-	u.setVariant(variantRFC4122)
-
-	return u
-}
-
-// NewV4 returns a randomly generated UUID.
-func (g *gen) NewV4() (UUID, error) {
-	u := UUID{}
-	if _, err := io.ReadFull(g.rand, u[:]); err != nil {
-		return Nil, err
-	}
-	u.SetVersion(V4)
-	u.setVariant(variantRFC4122)
-
-	return u, nil
-}
-
-// NewV5 returns a UUID based on SHA-1 hash of the namespace UUID and name.
-func (g *gen) NewV5(ns UUID, name string) UUID {
-	u := newFromHash(sha1.New(), ns, name)
-	u.SetVersion(V5)
-	u.setVariant(variantRFC4122)
-
-	return u
-}
-
-// Returns the epoch and clock sequence.
-func (g *gen) getClockSequence() (uint64, uint16, error) {
-	var err error
-	g.clockSequenceOnce.Do(func() {
-		buf := make([]byte, 2)
-		if _, err = io.ReadFull(g.rand, buf); err != nil {
-			return
-		}
-		g.clockSequence = binary.BigEndian.Uint16(buf)
-	})
-	if err != nil {
-		return 0, 0, err
-	}
-
-	g.storageMutex.Lock()
-	defer g.storageMutex.Unlock()
-
-	timeNow := g.getEpoch()
-	// Clock didn't change since last UUID generation.
-	// Should increase clock sequence.
-	if timeNow <= g.lastTime {
-		g.clockSequence++
-	}
-	g.lastTime = timeNow
-
-	return timeNow, g.clockSequence, nil
-}
-
-// Returns the difference between UUID epoch (October 15, 1582)
-// and current time in 100-nanosecond intervals.
-func (g *gen) getEpoch() uint64 {
-	return epochStart + uint64(g.epochFunc().UnixNano()/100)
-}
-
-// Returns the UUID based on the hashing of the namespace UUID and name.
-func newFromHash(h hash.Hash, ns UUID, name string) UUID {
-	u := UUID{}
-	h.Write(ns[:])
-	h.Write([]byte(name))
-	copy(u[:], h.Sum(nil))
-
-	return u
-}
diff --git a/compiler/runtime/types/uuid/generator_test.go b/compiler/runtime/types/uuid/generator_test.go
deleted file mode 100644
index 7d7b4c71be..0000000000
--- a/compiler/runtime/types/uuid/generator_test.go
+++ /dev/null
@@ -1,211 +0,0 @@
-// Copyright (C) 2013-2018 by Maxim Bublis <b@codemonkey.ru>
-//
-// Permission is hereby granted, free of charge, to any person obtaining
-// a copy of this software and associated documentation files (the
-// "Software"), to deal in the Software without restriction, including
-// without limitation the rights to use, copy, modify, merge, publish,
-// distribute, sublicense, and/or sell copies of the Software, and to
-// permit persons to whom the Software is furnished to do so, subject to
-// the following conditions:
-//
-// The above copyright notice and this permission notice shall be
-// included in all copies or substantial portions of the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-
-package uuid
-
-import (
-	"bytes"
-	"crypto/rand"
-	"fmt"
-	"testing"
-	"time"
-)
-
-func TestGenerator(t *testing.T) {
-	t.Run("NewV3", testNewV3)
-	t.Run("NewV4", testNewV4)
-	t.Run("NewV5", testNewV5)
-}
-
-func testNewV3(t *testing.T) {
-	t.Run("Basic", testNewV3Basic)
-	t.Run("EqualNames", testNewV3EqualNames)
-	t.Run("DifferentNamespaces", testNewV3DifferentNamespaces)
-}
-
-func testNewV3Basic(t *testing.T) {
-	ns := namespaceDNS
-	name := "www.example.com"
-	u := NewV3(ns, name)
-	if got, want := u.Version(), V3; got != want {
-		t.Errorf("NewV3(%v, %q): got version %d, want %d", ns, name, got, want)
-	}
-	if got, want := u.variant(), variantRFC4122; got != want {
-		t.Errorf("NewV3(%v, %q): got variant %d, want %d", ns, name, got, want)
-	}
-	want := "5df41881-3aed-3515-88a7-2f4a814cf09e"
-	if got := u.String(); got != want {
-		t.Errorf("NewV3(%v, %q) = %q, want %q", ns, name, got, want)
-	}
-}
-
-func testNewV3EqualNames(t *testing.T) {
-	ns := namespaceDNS
-	name := "example.com"
-	u1 := NewV3(ns, name)
-	u2 := NewV3(ns, name)
-	if u1 != u2 {
-		t.Errorf("NewV3(%v, %q) generated %v and %v across two calls", ns, name, u1, u2)
-	}
-}
-
-func testNewV3DifferentNamespaces(t *testing.T) {
-	name := "example.com"
-	ns1 := namespaceDNS
-	ns2 := namespaceURL
-	u1 := NewV3(ns1, name)
-	u2 := NewV3(ns2, name)
-	if u1 == u2 {
-		t.Errorf("NewV3(%v, %q) == NewV3(%d, %q) (%v)", ns1, name, ns2, name, u1)
-	}
-}
-
-func testNewV4(t *testing.T) {
-	t.Run("Basic", testNewV4Basic)
-	t.Run("DifferentAcrossCalls", testNewV4DifferentAcrossCalls)
-	t.Run("FaultyRand", testNewV4FaultyRand)
-	t.Run("ShortRandomRead", testNewV4ShortRandomRead)
-}
-
-func testNewV4Basic(t *testing.T) {
-	u, err := NewV4()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if got, want := u.Version(), V4; got != want {
-		t.Errorf("got version %d, want %d", got, want)
-	}
-	if got, want := u.variant(), variantRFC4122; got != want {
-		t.Errorf("got variant %d, want %d", got, want)
-	}
-}
-
-func testNewV4DifferentAcrossCalls(t *testing.T) {
-	u1, err := NewV4()
-	if err != nil {
-		t.Fatal(err)
-	}
-	u2, err := NewV4()
-	if err != nil {
-		t.Fatal(err)
-	}
-	if u1 == u2 {
-		t.Errorf("generated identical UUIDs across calls: %v", u1)
-	}
-}
-
-func testNewV4FaultyRand(t *testing.T) {
-	g := &gen{
-		epochFunc: time.Now,
-		rand: &faultyReader{
-			readToFail: 0, // fail immediately
-		},
-	}
-	u, err := g.NewV4()
-	if err == nil {
-		t.Errorf("got %v, nil error", u)
-	}
-}
-
-func testNewV4ShortRandomRead(t *testing.T) {
-	g := &gen{
-		epochFunc: time.Now,
-		rand:      bytes.NewReader([]byte{42}),
-	}
-	u, err := g.NewV4()
-	if err == nil {
-		t.Errorf("got %v, nil error", u)
-	}
-}
-
-func testNewV5(t *testing.T) {
-	t.Run("Basic", testNewV5Basic)
-	t.Run("EqualNames", testNewV5EqualNames)
-	t.Run("DifferentNamespaces", testNewV5DifferentNamespaces)
-}
-
-func testNewV5Basic(t *testing.T) {
-	ns := namespaceDNS
-	name := "www.example.com"
-	u := NewV5(ns, name)
-	if got, want := u.Version(), V5; got != want {
-		t.Errorf("NewV5(%v, %q): got version %d, want %d", ns, name, got, want)
-	}
-	if got, want := u.variant(), variantRFC4122; got != want {
-		t.Errorf("NewV5(%v, %q): got variant %d, want %d", ns, name, got, want)
-	}
-	want := "2ed6657d-e927-568b-95e1-2665a8aea6a2"
-	if got := u.String(); got != want {
-		t.Errorf("NewV5(%v, %q) = %q, want %q", ns, name, got, want)
-	}
-}
-
-func testNewV5EqualNames(t *testing.T) {
-	ns := namespaceDNS
-	name := "example.com"
-	u1 := NewV5(ns, name)
-	u2 := NewV5(ns, name)
-	if u1 != u2 {
-		t.Errorf("NewV5(%v, %q) generated %v and %v across two calls", ns, name, u1, u2)
-	}
-}
-
-func testNewV5DifferentNamespaces(t *testing.T) {
-	name := "example.com"
-	ns1 := namespaceDNS
-	ns2 := namespaceURL
-	u1 := NewV5(ns1, name)
-	u2 := NewV5(ns2, name)
-	if u1 == u2 {
-		t.Errorf("NewV5(%v, %q) == NewV5(%v, %q) (%v)", ns1, name, ns2, name, u1)
-	}
-}
-
-func BenchmarkGenerator(b *testing.B) {
-	b.Run("NewV3", func(b *testing.B) {
-		for i := 0; i < b.N; i++ {
-			NewV3(namespaceDNS, "www.example.com")
-		}
-	})
-	b.Run("NewV4", func(b *testing.B) {
-		for i := 0; i < b.N; i++ {
-			NewV4()
-		}
-	})
-	b.Run("NewV5", func(b *testing.B) {
-		for i := 0; i < b.N; i++ {
-			NewV5(namespaceDNS, "www.example.com")
-		}
-	})
-}
-
-type faultyReader struct {
-	callsNum   int
-	readToFail int // Read call number to fail
-}
-
-func (r *faultyReader) Read(dest []byte) (int, error) {
-	r.callsNum++
-	if (r.callsNum - 1) == r.readToFail {
-		return 0, fmt.Errorf("io: reader is faulty")
-	}
-	return rand.Read(dest)
-}
diff --git a/compiler/test.go b/compiler/test.go
deleted file mode 100644
index 5947041963..0000000000
--- a/compiler/test.go
+++ /dev/null
@@ -1,112 +0,0 @@
-package compiler
-
-import (
-	"context"
-	"encoding/json"
-	"io"
-	"io/ioutil"
-	"os"
-	"os/exec"
-	"path/filepath"
-)
-
-type TestConfig struct {
-	// Env sets environment variables for "go test".
-	Env []string
-
-	// Args sets extra arguments for "go test".
-	Args []string
-
-	// Stdout and Stderr are where to redirect "go test" output.
-	Stdout, Stderr io.Writer
-}
-
-// Test tests the application.
-//
-// On success, it is the caller's responsibility to delete the temp dir
-// returned in Result.Dir.
-func Test(ctx context.Context, appRoot string, cfg *Config) error {
-	if err := cfg.Validate(); err != nil {
-		return err
-	}
-
-	b := &builder{
-		cfg:        cfg,
-		appRoot:    appRoot,
-		parseTests: true,
-	}
-	return b.Test(ctx)
-}
-
-func (b *builder) Test(ctx context.Context) (err error) {
-	defer func() {
-		if e := recover(); e != nil {
-			if b, ok := e.(bailout); ok {
-				err = b.err
-			} else {
-				panic(e)
-			}
-		}
-	}()
-
-	b.workdir, err = ioutil.TempDir("", "encore-test")
-	if err != nil {
-		return err
-	}
-	defer os.RemoveAll(b.workdir)
-
-	for _, fn := range []func() error{
-		b.parseApp,
-		b.writeModFile,
-		b.writeSumFile,
-		b.writePackages,
-		b.writeTestMains,
-	} {
-		if err := fn(); err != nil {
-			return err
-		}
-	}
-	return b.runTests(ctx)
-}
-
-func (b *builder) writeTestMains() error {
-	for _, pkg := range b.res.App.Packages {
-		if err := b.generateTestMain(pkg); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// runTests runs "go test".
-func (b *builder) runTests(ctx context.Context) error {
-	overlayData, _ := json.Marshal(map[string]interface{}{"Replace": b.overlay})
-	overlayPath := filepath.Join(b.workdir, "overlay.json")
-	if err := ioutil.WriteFile(overlayPath, overlayData, 0644); err != nil {
-		return err
-	}
-
-	args := []string{
-		"test",
-		"-tags=encore",
-		"-overlay=" + overlayPath,
-		"-modfile=" + filepath.Join(b.workdir, "go.mod"),
-		"-mod=mod",
-		"-vet=off",
-	}
-	args = append(args, b.cfg.Test.Args...)
-	cmd := exec.CommandContext(ctx, filepath.Join(b.cfg.EncoreGoRoot, "bin", "go"+exe), args...)
-	env := []string{
-		"GO111MODULE=on",
-		"GOROOT=" + b.cfg.EncoreGoRoot,
-	}
-	if !b.cfg.CgoEnabled {
-		env = append(env, "CGO_ENABLED=0")
-	}
-	env = append(env, b.cfg.Test.Env...)
-	cmd.Env = append(os.Environ(), env...)
-	cmd.Dir = filepath.Join(b.appRoot, b.cfg.WorkingDir)
-	cmd.Stdout = b.cfg.Test.Stdout
-	cmd.Stderr = b.cfg.Test.Stderr
-	return cmd.Run()
-}
diff --git a/compiler/tmpl/main.go.tmpl b/compiler/tmpl/main.go.tmpl
deleted file mode 100644
index 0a0a4665e9..0000000000
--- a/compiler/tmpl/main.go.tmpl
+++ /dev/null
@@ -1,263 +0,0 @@
-package main
-
-import (
-	"context"
-	"fmt"
-	"io"
-	"io/ioutil"
-	"net/http"
-	"runtime/debug"
-	"strconv"
-	"strings"
-
-	{{if .AuthHandler}}"encore.dev/beta/auth"{{end}}
-	"encore.dev/runtime"
-	"encore.dev/runtime/config"
-	"encore.dev/storage/sqldb"
-	jsoniter "github.com/json-iterator/go"
-	"github.com/felixge/httpsnoop"
-
-	{{range .Imports -}}
-		{{if .Named}}{{.Name}} {{end}}"{{.Path}}"
-	{{end}}
-)
-
-// Prevent unused imports
-var (
-	_ = context.Background
-	_ = debug.Stack
-	_ = fmt.Errorf
-	_ = http.Error
-	_ = io.EOF
-	_ = ioutil.ReadAll
-	_ = strconv.Quote
-	_ = strings.HasPrefix
-	_ = httpsnoop.CaptureMetrics
-)
-
-var json = jsoniter.Config{
-	EscapeHTML: false,
-	SortMapKeys: true,
-	ValidateJsonRawMessage: true,
-}.Froze()
-
-{{range .Svcs}}
-{{- range .RPCs}}
-func encore_{{.Svc.Name}}_{{.Name}}(w http.ResponseWriter, req *http.Request) {
-	runtime.BeginOperation()
-	defer runtime.FinishOperation()
-	var err error
-{{- if $.AuthHandler}}
-
-	var (
-		uid      auth.UID
-		token    string
-		authData interface{}
-	)
-	if auth := req.Header.Get("Authorization"); strings.HasPrefix(auth, "Bearer ") {
-		token = auth[len("Bearer "):]
-		uid, authData, err = validateAuth(req.Context(), token)
-		if err != nil {
-			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-			return
-		}
-	}
-{{- if requiresAuth .}}
-	if uid == "" {
-		if token == "" {
-			runtime.Logger().Info().
-				Str("service", "{{.Svc.Name}}").
-				Str("endpoint", "{{.Name}}").
-				Msg("rejecting request due to missing auth token")
-		}
-		http.Error(w, "Unauthorized", http.StatusUnauthorized)
-		return
-	}
-{{- end}}
-{{- end}}
-
-{{- if .Raw}}
-	err = runtime.BeginRequest(runtime.RequestData{
-		Type:            runtime.RPCCall,
-		Service:         "{{.Svc.Name}}",
-		Endpoint:        "{{.Name}}",
-		CallExprIdx:     0,
-		EndpointExprIdx: {{traceExpr .}},
-		Inputs:          nil,
-{{- if $.AuthHandler}}
-		UID:             uid,
-		AuthData:        authData,
-{{- end}}
-	})
-	if err != nil {
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-		return
-	}
-
-	// Call the endpoint
-	m := httpsnoop.CaptureMetrics(http.HandlerFunc({{.Svc.Name}}.{{.Name}}), w, req)
-	if m.Code >= 400 {
-		err = fmt.Errorf("response status code %d", m.Code)
-	}
-	runtime.FinishRequest(m.Code, nil, err)
-{{- else }}
-{{- if .Request}}
-
-	payload, err := ioutil.ReadAll(req.Body)
-	if err != nil {
-		http.Error(w, "Bad Request", http.StatusBadRequest)
-		return
-	}
-	inputs := [][]byte{payload}
-{{- end}}
-	
-	err = runtime.BeginRequest(runtime.RequestData{
-		Type:            runtime.RPCCall,
-		Service:         "{{.Svc.Name}}",
-		Endpoint:        "{{.Name}}",
-		CallExprIdx:     0,
-		EndpointExprIdx: {{traceExpr .}},
-		Inputs:          {{if .Request}}inputs{{else}}nil{{end}},
-{{- if $.AuthHandler}}
-		UID:             uid,
-		AuthData:        authData,
-{{- end}}
-	})
-	if err != nil {
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-		return
-	}
-{{- if .Request}}
-
-	// Parse the request payload
-	var params {{typeName .Request}}
-	err = json.Unmarshal(payload, &params)
-	if err != nil {
-		if len(payload) == 0 {
-			err = fmt.Errorf("no request data given") // improve error message
-		}
-		runtime.FinishRequest(400, nil, fmt.Errorf("could not parse request: %v", err))
-		http.Error(w, "could not parse request: " + err.Error(), http.StatusBadRequest)
-		return
-	}
-{{- end}}
-
-	// Call the endpoint
-	defer func() {
-		// Catch handler panic
-		if err := recover(); err != nil {
-			runtime.FinishRequest(500, nil, fmt.Errorf("panic handling request: %v\n%s", err, debug.Stack()))
-			http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-		}
-	}()
-	{{if .Response}}resp, {{end}}respErr := {{pkgName .Svc.Root.ImportPath}}.{{.Name}}(req.Context(){{if .Request}}, params{{end}})
-	if respErr != nil {
-		runtime.FinishRequest(500, nil, respErr)
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-		return
-	}
-
-{{- if .Response}}
-
-	// Serialize the response
-	var respData []byte
-	respData, marshalErr := json.MarshalIndent(resp, "", "  ")
-	if marshalErr != nil {
-		runtime.FinishRequest(500, nil, marshalErr)
-		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
-		return
-	}
-	respData = append(respData, '\n')
-	output := [][]byte{respData}
-	runtime.FinishRequest(200, output, nil)
-	w.WriteHeader(200)
-	w.Write(respData)
-{{- else}}
-	runtime.FinishRequest(200, nil, nil)
-	w.WriteHeader(200)
-{{- end}}
-{{- end}}
-}
-{{end}}
-{{end}}
-
-{{- with .AuthHandler}}
-func validateAuth(ctx context.Context, token string) (uid auth.UID, authData interface{}, authErr error) {
-	if token == "" {
-		return "", nil, nil
-	}
-	done := make(chan struct{})
-	call, err := runtime.BeginAuth({{traceExpr .}}, token)
-	if err != nil {
-		return "", nil, err
-	}
-
-	go func() {
-		defer close(done)
-		authErr = call.BeginReq(runtime.RequestData{
-			Type:            runtime.AuthHandler,
-			Service:         "{{.Svc.Name}}",
-			Endpoint:        "{{.Name}}",
-			CallExprIdx:     0,
-			EndpointExprIdx: {{traceExpr .}},
-			Inputs:          [][]byte{[]byte(strconv.Quote(token))},
-		})
-		if authErr != nil {
-			return
-		}
-		defer func() {
-			if err2 := recover(); err2 != nil {
-				call.FinishReq(500, nil, fmt.Errorf("auth handler panicked: %v\n%s", err2, debug.Stack()))
-				authErr = fmt.Errorf("auth handler panicked: %v\n%s", err2, debug.Stack())
-			}
-		}()
-{{- if $.AuthHandler.AuthData}}
-		uid, authData, authErr = {{pkgName .Svc.Root.ImportPath}}.{{.Name}}(ctx, token)
-		serialized, _ := runtime.SerializeInputs(uid, authData)
-{{- else}}
-		uid, authErr = {{pkgName .Svc.Root.ImportPath}}.{{.Name}}(ctx, token)
-		serialized, _ := runtime.SerializeInputs(uid)
-{{- end}}
-		if authErr != nil {
-			call.FinishReq(500, nil, authErr)
-		} else {
-			call.FinishReq(200, serialized, nil)
-		}
-	}()
-	<-done
-	call.Finish(uid, authErr)
-	return uid, authData, authErr
-}
-{{- end}}
-
-var srv *runtime.Server
-
-func main() {
-	// Register the Encore services
-	services := []*config.Service{
-{{- range .Svcs}}
-		{
-			Name: "{{.Name}}",
-			RelPath: "{{.Root.RelPath}}",
-			SQLDB: {{usesSQLDB .}},
-			Endpoints: []*config.Endpoint{
-{{- range .RPCs}}
-				{
-					Name: "{{.Name}}",
-					Raw: {{.Raw}},
-					Handler: encore_{{.Svc.Name}}_{{.Name}},
-				},
-{{- end}}
-			},
-		},
-{{- end}}
-	}
-
-	cfg := &config.ServerConfig{
-		Services: services,
-		Testing: false,
-	}
-	srv = runtime.Setup(cfg)
-	sqldb.Setup(cfg)
-	srv.ListenAndServe()
-}
\ No newline at end of file
diff --git a/compiler/tmpl/pkg.go.tmpl b/compiler/tmpl/pkg.go.tmpl
deleted file mode 100644
index a0d3f28c09..0000000000
--- a/compiler/tmpl/pkg.go.tmpl
+++ /dev/null
@@ -1,98 +0,0 @@
-package {{.Pkg.Name}}
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"runtime/debug"
-
-	"encore.dev/runtime"
-	{{range .Imports -}}
-		{{if .Named}}{{.Name}} {{end}}"{{.Path}}"
-	{{end}}
-)
-
-{{range $rpcIdx, $rpc := .RPCs}}
-func encore_{{$rpc.Svc}}_{{$rpc.Name}}(callExprIdx, endpointExprIdx int32, ctx context.Context
-	{{- if $rpc.Req}}, req {{$rpc.Req}}{{end}}) (
-	{{- if $rpc.Resp}}resp {{$rpc.Resp}}, {{end}}err error) {
-{{- if $rpc.Req}}
-	inputs, err := runtime.SerializeInputs(req)
-	if err != nil {
-		return 
-	}
-{{- else}}
-	var inputs [][]byte
-{{- end}}
-	call, err := runtime.BeginCall(runtime.CallParams{
-		Service:  "{{$rpc.Svc}}",
-		Endpoint: "{{$rpc.Name}}",
-		CallExprIdx: callExprIdx,
-		EndpointExprIdx: endpointExprIdx,
-	})
-	if err != nil {
-		return
-	}
-
-	// Run the request in a different goroutine
-	var response struct {
-		data [][]byte
-		err error
-		panicked bool
-	}
-	done := make(chan struct{})
-	go func() {
-		defer close(done)
-		err := call.BeginReq(runtime.RequestData{
-			Type:            runtime.RPCCall,
-			Service:         "{{$rpc.Svc}}",
-			Endpoint:        "{{$rpc.Name}}",
-			CallExprIdx:     callExprIdx,
-			EndpointExprIdx: endpointExprIdx,
-			Inputs:          inputs,
-		})
-		if err != nil {
-			response.err = err
-			return
-		}
-		defer func() {
-			if err2 := recover(); err2 != nil {
-				call.FinishReq(500, nil, fmt.Errorf("{{$rpc.Svc}}.{{$rpc.Name}} panicked: %v\n%s", err2, debug.Stack()))
-				response.err = fmt.Errorf("panic handling request: %v", err2)
-				response.panicked = true
-			}
-		}()
-		
-{{- if $rpc.Req}}
-		var reqData {{$rpc.Req}}
-		if response.err = runtime.CopyInputs(inputs, []interface{}{&reqData}); response.err != nil {
-			call.FinishReq(500, nil, response.err)
-			return
-		}
-{{- end}}
-
-		{{if $rpc.Resp}}rpcResp, {{end}}rpcErr := {{$rpc.Func}}(ctx{{if $rpc.Req}}, req{{end}})
-{{- if $rpc.Resp}}
-		response.data, _ = runtime.SerializeInputs(rpcResp)
-{{- end}}
-		if rpcErr != nil {
-			call.FinishReq(500, nil, rpcErr)
-			response.err = errors.New(rpcErr.Error())
-		} else {
-			call.FinishReq(200, response.data, nil)
-		}
-	}()
-	<-done
-
-	call.Finish(response.err)
-{{- if $rpc.Resp}}
-	// If the handler panicked we won't have any response data.
-	if !response.panicked {
-		_ = runtime.CopyInputs(response.data, []interface{}{&resp})
-	}
-	return resp, response.err
-{{- else}}
-	return response.err
-{{- end}}
-}
-{{end}}
\ No newline at end of file
diff --git a/compiler/tmpl/testmain.go.tmpl b/compiler/tmpl/testmain.go.tmpl
deleted file mode 100644
index 279bb24f9a..0000000000
--- a/compiler/tmpl/testmain.go.tmpl
+++ /dev/null
@@ -1,33 +0,0 @@
-package {{.Pkg.Name}}
-
-import (
-	"os"
-	"testing"
-
-	"encore.dev/runtime"
-	"encore.dev/runtime/config"
-	"encore.dev/storage/sqldb"
-)
-
-func TestMain(m *testing.M) {
-	// Register the Encore services
-	services := []*config.Service{
-{{- range .Svcs}}
-		{
-			Name: "{{.Name}}",
-			RelPath: "{{.Root.RelPath}}",
-			SQLDB: {{usesSQLDB .}},
-			Endpoints: nil,
-		},
-{{- end}}
-	}
-
-	// Set up the Encore runtime
-	cfg := &config.ServerConfig{
-		Services: services,
-		Testing: true,
-	}
-	runtime.Setup(cfg)
-	sqldb.Setup(cfg)
-	os.Exit(m.Run())
-}
\ No newline at end of file
diff --git a/compiler/wrappers.go b/compiler/wrappers.go
deleted file mode 100644
index 72f7482887..0000000000
--- a/compiler/wrappers.go
+++ /dev/null
@@ -1,288 +0,0 @@
-package compiler
-
-import (
-	_ "embed" // for go:embed
-	"fmt"
-	"os"
-	"path/filepath"
-	"sort"
-	"strconv"
-	"text/template"
-
-	"encr.dev/parser/est"
-)
-
-var (
-	//go:embed tmpl/main.go.tmpl
-	mainTmpl string
-	//go:embed tmpl/pkg.go.tmpl
-	pkgTmpl string
-	//go:embed tmpl/testmain.go.tmpl
-	testMainTmpl string
-)
-
-const mainPkgName = "__encore_main"
-
-func (b *builder) writeMainPkg() error {
-	imp := new(importMap)
-
-	funcs := template.FuncMap{
-		"pkgName": func(path string) string {
-			return imp.Name(path)
-		},
-		"traceExpr": func(obj interface{}) int32 {
-			switch obj := obj.(type) {
-			case *est.RPC:
-				return b.res.Nodes[obj.Svc.Root][obj.Func].Id
-			case *est.AuthHandler:
-				return b.res.Nodes[obj.Svc.Root][obj.Func].Id
-			default:
-				panic(fmt.Sprintf("unexpected obj %T in traceExpr", obj))
-			}
-		},
-		"typeName": func(param *est.Param) string {
-			return b.typeName(param, imp)
-		},
-		"usesSQLDB": func(svc *est.Service) bool {
-			for _, s := range b.res.Meta.Svcs {
-				if s.Name == svc.Name {
-					return len(s.Migrations) > 0
-				}
-			}
-			return false
-		},
-		"requiresAuth": func(rpc *est.RPC) bool {
-			return rpc.Access == est.Auth
-		},
-	}
-	tmpl := template.Must(template.New("mainPkg").Funcs(funcs).Parse(mainTmpl))
-	// Write the file to disk
-	dir := filepath.Join(b.workdir, mainPkgName)
-	if err := os.Mkdir(dir, 0755); err != nil {
-		return err
-	}
-	mainPath := filepath.Join(dir, "main.go")
-	file, err := os.Create(mainPath)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		if err2 := file.Close(); err == nil {
-			err = err2
-		}
-	}()
-
-	for _, svc := range b.res.App.Services {
-		imp.Add(svc.Name, svc.Root.ImportPath)
-		for _, rpc := range svc.RPCs {
-			if r := rpc.Request; r != nil {
-				imp.Add(r.Decl.Loc.PkgName, r.Decl.Loc.PkgPath)
-			}
-			if r := rpc.Response; r != nil {
-				imp.Add(r.Decl.Loc.PkgName, r.Decl.Loc.PkgPath)
-			}
-		}
-	}
-	if h := b.res.App.AuthHandler; h != nil {
-		imp.Add(h.Svc.Name, h.Svc.Root.ImportPath)
-	}
-
-	tmplParams := struct {
-		Imports     []importName
-		Svcs        []*est.Service
-		AppVersion  string
-		AppRoot     string
-		AuthHandler *est.AuthHandler
-	}{
-		Svcs:        b.res.App.Services,
-		AppVersion:  b.cfg.Version,
-		AppRoot:     b.appRoot,
-		AuthHandler: b.res.App.AuthHandler,
-		Imports:     imp.Imports(),
-	}
-
-	b.addOverlay(filepath.Join(b.appRoot, mainPkgName, "main.go"), mainPath)
-	return tmpl.Execute(file, tmplParams)
-}
-
-func (b *builder) generateWrappers(pkg *est.Package, rpcs []*est.RPC, wrapperPath string) (err error) {
-	type rpcDesc struct {
-		Name string
-		Svc  string
-		Req  string
-		Resp string
-		Func string
-	}
-
-	tmpl := template.Must(template.New("pkg").Parse(pkgTmpl))
-
-	file, err := os.Create(wrapperPath)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		if err2 := file.Close(); err == nil {
-			err = err2
-		}
-	}()
-
-	var rpcDescs []*rpcDesc
-	imp := &importMap{from: pkg.ImportPath}
-	for _, rpc := range rpcs {
-		rpcPkg := rpc.Svc.Root
-		req := b.typeName(rpc.Request, imp)
-		resp := b.typeName(rpc.Response, imp)
-		fn := rpc.Name
-		if n := imp.Add(rpcPkg.Name, rpcPkg.ImportPath); n.Name != "" {
-			fn = n.Name + "." + fn
-		}
-		rpcDescs = append(rpcDescs, &rpcDesc{
-			Name: rpc.Name,
-			Svc:  rpc.Svc.Name,
-			Req:  req,
-			Resp: resp,
-			Func: fn,
-		})
-	}
-
-	tmplParams := struct {
-		Pkg     *est.Package
-		RPCs    []*rpcDesc
-		Imports []importName
-	}{
-		Pkg:     pkg,
-		RPCs:    rpcDescs,
-		Imports: imp.Imports(),
-	}
-
-	return tmpl.Execute(file, tmplParams)
-}
-
-func (b *builder) generateTestMain(pkg *est.Package) (err error) {
-	funcs := template.FuncMap{
-		"usesSQLDB": func(svc *est.Service) bool {
-			for _, s := range b.res.Meta.Svcs {
-				if s.Name == svc.Name {
-					return len(s.Migrations) > 0
-				}
-			}
-			return false
-		},
-	}
-
-	tmpl := template.Must(template.New("testmain").Funcs(funcs).Parse(testMainTmpl))
-
-	// Write the file to disk
-	testMainPath := filepath.Join(b.workdir, filepath.FromSlash(pkg.RelPath), "encore_testmain_test.go")
-	file, err := os.Create(testMainPath)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		if err2 := file.Close(); err == nil {
-			err = err2
-		}
-	}()
-
-	tmplParams := struct {
-		Pkg  *est.Package
-		Svcs []*est.Service
-	}{
-		Pkg:  pkg,
-		Svcs: b.res.App.Services,
-	}
-	b.addOverlay(filepath.Join(pkg.Dir, "encore_testmain_test.go"), testMainPath)
-	return tmpl.Execute(file, tmplParams)
-}
-
-// importMap manages imports for a given file, and ensures each import
-// is given a unique name even in the presence of name collisions.
-// The zero value is ready to be used.
-type importMap struct {
-	from  string // from is the import path the code is running in
-	names map[string]importName
-	paths map[string]importName
-}
-
-type importName struct {
-	Name  string
-	Path  string
-	Named bool
-}
-
-func (i *importMap) Add(name, path string) importName {
-	if path == i.from {
-		return importName{}
-	}
-
-	if i.names == nil {
-		i.names = make(map[string]importName)
-		i.paths = make(map[string]importName)
-	}
-
-	named := false
-	if p, ok := i.paths[path]; ok {
-		// Already imported
-		return p
-	} else if _, ok := i.names[name]; ok {
-		// Name collision; generate a unique name
-		for j := 2; ; j++ {
-			candidate := name + strconv.Itoa(j)
-			if _, ok := i.names[candidate]; !ok {
-				name = candidate
-				named = true
-				break
-			}
-		}
-	}
-
-	n := importName{
-		Name:  name,
-		Path:  path,
-		Named: named,
-	}
-	i.names[name] = n
-	i.paths[path] = n
-	return n
-}
-
-func (i *importMap) Imports() []importName {
-	var names []importName
-	for _, n := range i.paths {
-		names = append(names, n)
-	}
-	sort.Slice(names, func(i, j int) bool {
-		return names[i].Path < names[j].Path
-	})
-	return names
-}
-
-func (i *importMap) Name(path string) string {
-	name, ok := i.paths[path]
-	if !ok {
-		panic(fmt.Sprintf("internal error: no import found for %q", path))
-	}
-	return name.Name
-}
-
-// typeName computes the type name for a given param
-// from the perspective of from and if necessary
-// adds the import to the import map.
-//
-// If param is nil, it returns "".
-func (b *builder) typeName(param *est.Param, imp *importMap) string {
-	if param == nil {
-		return ""
-	}
-
-	decl := param.Decl
-	typName := decl.Name
-	n := imp.Add(decl.Loc.PkgName, decl.Loc.PkgPath)
-	if n.Name != "" {
-		typName = n.Name + "." + typName
-	}
-	if param.IsPtr {
-		return "*" + typName
-	}
-	return typName
-}
diff --git a/docs/go/cli/cli-reference.md b/docs/go/cli/cli-reference.md
new file mode 100644
index 0000000000..9912303411
--- /dev/null
+++ b/docs/go/cli/cli-reference.md
@@ -0,0 +1,345 @@
+---
+seotitle: Encore CLI Reference
+seodesc: The Encore CLI lets you run your local development environment, create apps, and much more. See all CLI commands in this reference guide.
+title: CLI Reference
+subtitle: The Encore CLI lets you run your local environment and much more.
+lang: go
+---
+
+## Running
+
+#### Run
+
+Runs your application.
+
+```shell
+$ encore run [--debug] [--watch=true] [--port NUMBER] [flags]
+```
+
+#### Test
+
+Tests your application
+
+Takes all the same flags as `go test`.
+
+```shell
+$ encore test ./... [go test flags]
+```
+
+#### Check
+
+Checks your application for compile-time errors using Encore's compiler.
+
+```shell
+$ encore check
+```
+
+#### Exec
+
+Runs executable scripts against the local Encore app.
+
+Compiles and runs a go script with the local Encore app environment setup.
+
+```
+$ encore exec <path/to/command> [...args]
+```
+
+The command directory should contain Go files with package main with a main function.
+
+The additional arguments are passed directly to the built binary.
+
+##### Example
+
+Run a database seed script
+
+```
+$ encore exec cmd/seed
+```
+
+## App
+
+Commands to create and link Encore apps
+
+#### Clone
+
+Clone an Encore app to your computer
+
+```shell
+$ encore app clone [app-id] [directory]
+```
+
+#### Create
+
+Create a new Encore app
+
+```shell
+$ encore app create [name]
+```
+
+### Init
+
+Create a new Encore app from an existing repository
+
+```shell
+$ encore app init [name]
+```
+
+#### Link
+
+Link an Encore app with the server
+
+```shell
+$ encore app link [app-id]
+```
+
+## Auth
+
+Commands to authenticate with Encore
+
+#### Login
+
+Log in to Encore
+
+```shell
+$ encore auth login
+```
+
+#### Logout
+
+Logs out the currently logged in user
+
+```shell
+$ encore auth logout
+```
+
+#### Signup
+
+Create a new Encore account
+
+```shell
+$ encore auth signup
+```
+
+#### Whoami
+
+Show the current logged in user
+
+```shell
+$ encore auth whoami
+```
+
+## Daemon
+
+Encore CLI daemon commands
+
+#### Restart
+
+If you experience unexpected behavior, try restarting the daemon using:
+
+```shell
+$ encore daemon
+```
+
+#### Env
+
+Outputs Encore environment information
+
+```shell
+$ encore daemon env
+```
+
+## Database Management
+
+Database management commands
+
+#### Connect to database via shell
+
+Connects to the database via psql shell
+
+Defaults to connecting to your local environment. Specify --env to connect to another environment.
+
+```shell
+$ encore db shell <database-name> [--env=<name>]
+```
+
+`encore db shell` defaults to read-only permissions. Use `--write`, `--admin` and `--superuser` flags to modify which permissions you connect with.
+
+#### Connection URI
+
+Outputs a database connection string for `<database-name>`. Defaults to connecting to your local environment. Specify --env to connect to another environment.
+
+```shell
+$ encore db conn-uri <database-name> [--env=<name>] [flags]
+```
+
+#### Proxy
+
+Sets up local proxy that forwards any incoming connection to the databases in the specified environment.
+
+```shell
+$ encore db proxy [--env=<name>] [flags]
+```
+
+#### Reset
+
+Resets the databases for the given services. Use --all to reset all databases.
+
+```shell
+$ encore db reset [service-names...] [flags]
+```
+
+## Code Generation
+
+Code generation commands
+
+#### Generate client
+
+Generates an API client for your app. For more information about the generated clients, see [this page](/docs/go/cli/client-generation).
+
+By default, `encore gen client` generates the client based on the version of your application currently running in your local environment.
+You can change this using the `--env` flag and specifying the environment name.
+
+Use `--lang=<lang>` to specify the language. Supported language codes are:
+
+- `go`: A Go client using the net/http package
+- `typescript`: A TypeScript client using the in-browser Fetch API
+- `javascript`: A JavaScript client using the in-browser Fetch API
+- `openapi`: An OpenAPI spec
+
+```shell
+$ encore gen client [<app-id>] [--env=<name>] [--services=foo,bar] [--excluded-services=baz,qux] [--lang=<lang>] [flags]
+```
+
+## Logs
+
+Streams logs from your application
+
+```shell
+$ encore logs [--env=prod] [--json]
+```
+
+## Kubernetes
+
+Kubernetes management commands
+
+#### Configure
+
+Updates your kubectl config to point to the Kubernetes cluster(s) for the specified environment
+
+```shell
+$ encore k8s configure --env=ENV_NAME
+```
+
+## Secrets Management
+
+Secret management commands
+
+#### Set
+
+Sets a secret value
+
+```shell
+$ encore secret set --type <types> <secret-name>
+```
+
+Where `<types>` defines which environment types the secret value applies to. Use a comma-separated list of `production`, `development`, `preview`, and `local`. Shorthands: `prod`, `dev`, `pr`.
+
+**Examples**
+
+Entering a secret directly in terminal:
+
+    $ encore secret set --type dev MySecret
+    Enter secret value: ...
+    Successfully created secret value for MySecret.
+
+Piping a secret from a file:
+
+    $ encore secret set --type dev,local MySecret < my-secret.txt
+    Successfully created secret value for MySecret.
+
+Note that this strips trailing newlines from the secret value.
+
+#### List
+
+Lists secrets, optionally for a specific key
+
+```shell
+$ encore secret list [keys...]
+```
+
+#### Archive
+
+Archives a secret value
+
+```shell
+$ encore secret archive <id>
+```
+
+#### Unarchive
+
+Unarchives a secret value
+
+```shell
+$  encore secret unarchive <id>
+```
+
+## Version
+
+Reports the current version of the encore application
+
+```shell
+$ encore version
+```
+
+#### Update
+
+Checks for an update of encore and, if one is available, runs the appropriate command to update it.
+
+```shell
+$ encore version update
+```
+
+## VPN
+
+VPN management commands
+
+#### Start
+
+Sets up a secure connection to private environments
+
+```shell
+$ encore vpn start
+```
+
+#### Status
+
+Determines the status of the VPN connection
+
+```shell
+$ encore vpn status
+```
+
+#### Stop
+
+Stops the VPN connection
+
+```shell
+$ encore vpn stop
+```
+
+## Build
+
+Generates an image for your app, which can be used to [self-host](/docs/go/self-host/docker-build) your app.
+
+#### Docker
+
+Builds a portable Docker image of your Encore application.
+
+```shell
+$ encore build docker
+```
+
+**Flags**
+
+`--base string` defines the base image to build from (default "scratch")
+`--push` pushes image to remote repository
diff --git a/docs/go/cli/client-generation.md b/docs/go/cli/client-generation.md
new file mode 100644
index 0000000000..e74bd09fd4
--- /dev/null
+++ b/docs/go/cli/client-generation.md
@@ -0,0 +1,199 @@
+---
+seotitle: Automatic API Client Generation
+seodesc: Learn how you can use automatic API client generation to get clients for your backend. See how to integrate with your frontend using a type-safe generated client.
+title: Client Library Generation
+subtitle: Stop writing the same types everywhere
+lang: go
+---
+
+Encore makes it simple to write scalable distributed backends by allowing you to make function calls that Encore translates into RPC calls. Encore also generates API clients with interfaces that look like the original Go functions, with the same parameters and response signature as the server.
+
+The generated clients are single files that use only the standard functionality of the target language, with full type safety. This allow anyone to look at the generated client and understand exactly how it works.
+
+The structure of the generated code varies by language, to ensure it's idiomatic and easy to use, but always includes all publicly accessible endpoints, data structures, and documentation strings.
+
+Encore currently supports generating the following clients:
+- **Go** - Using `net/http` for the underlying HTTP transport.
+- **TypeScript** - Using the browser `fetch` API for the underlying HTTP client.
+- **JavaScript** - Using the browser `fetch` API for the underlying HTTP client.
+- **OpenAPI** - Using the OpenAPI Specification's language-agnostic interface to HTTP APIs. (Experimental)
+
+If there's a language you think should be added, please submit a pull request or create a feature
+request on [GitHub](https://github.com/encoredev/encore/issues/new), or [reach out on Discord](/discord).
+
+<Callout type="important">
+
+If you ship the generated client to end customers, keep in mind that old clients will continue to be used after you make changes. To prevent issues with the generated clients, avoid making breaking changes in APIs that your clients access.
+
+</Callout>
+
+<br />
+
+## Generating a Client
+
+To generate a client, use the `encore gen client` command. It generates a type-safe client using the most recent API metadata
+running in a particular environment for the given Encore application. For example:
+
+```shell
+# Generate a TypeScript client for calling the hello-a8bc application based on the primary environment
+encore gen client hello-a8bc --output=./client.ts
+
+# Generate a Go client for the hello-a8bc application based on the locally running code
+encore gen client hello-a8bc --output=./client.go --env=local
+
+# Generate an OpenAPI client for the hello-a8bc application based on the primary environment
+encore gen client hello-a8bc --lang=openapi --output=./openapi.json
+```
+
+### Environment Selection
+
+By default, `encore gen client` generates the client based on the version of your application currently running in your local environment.
+You can change this using the `--env` flag and specifying the environment name.
+
+<Callout type="info">
+
+The generated client can be used with any environment, not just the one it was generated for. However, the APIs, data structures
+and marshalling logic will be based on whatever is present and running in that environment at the point in time the client is generated.
+
+</Callout>
+
+### Service filtering
+
+By default `encore gen client` outputs code for all services with at least one publicly accessible (or authenticated) API.
+You can narrow down this set of services by specifying the `--services` (or `-s`) flag. It takes a comma-separated list
+of service names.
+
+For example, to generate a typescript client for the `email` and `users` services, run:
+```shell
+encore gen client --services=email,users -o client.ts
+```
+
+### Output Mode
+
+By default the client's code will be output to stdout, allowing you to pipe it into your clipboard, or another tool. However,
+using `--output` you can specify a file location to write the client to. If output is specified, you do not need to specify
+the language as Encore will detect the language based on the file extension.
+
+
+### Example Script
+You could combine this into a `package.json` file for your Typescript frontend, to allow you to run `npm run gen` in that
+project to update the client to match the code running in your staging environment.
+```json
+{
+  "scripts": {
+    // ...
+    "gen": "encore gen client hello-a8bc --output=./client.ts --env=staging"
+    // ...
+  }
+}
+```
+
+## Using the Client
+
+The generated client has all the data structures required as parameters or returned as response values as needed by any
+of the public or authenticated API's of your Encore application. Each service is exposed as object on the client, with
+each public or authenticated API exposed as a function on those objects.
+
+For instance, if you had a service called `email` with a function `Send`, on the generated client you would call this
+using; `client.email.Send(...)`.
+
+For more tips and examples of using a generated JavaScript/Typescript client, see the [Integrate with a web frontend](/docs/how-to/integrate-frontend#generating-a-request-client) docs.
+
+### Creating an instance
+
+When constructing a client, you need to pass a `BaseURL` as the first parameter; this is the URL at which the API can
+be accessed. The client provides two helpers:
+
+- `Local` - This is a constant provided, which will always point at your locally running instance environment.
+- `Environment("name")` - This is a function which allows you to specify an environment by name
+
+However, BaseURL is a string, so if the two helpers do not provide enough flexibility you can pass any valid URL to be
+used as the BaseURL.
+
+### Authentication
+
+If your application has any API's which require [authentication](/docs/develop/auth), then additional options will generated
+into the client, which can be used when constructing the client. Just like with API's schemas, the data type required by
+your application's `auth handler` will be part of the client library, allowing you to set it in two ways:
+
+If your credentials won't change during the lifetime of the client, simply passing the authentication data to the client
+through the `WithAuth` (Go) or `auth` (TypeScript) options.
+
+However, if the authentication credentials can change, you can also pass a function which will be called before each request
+and can return a new instance of the authentication data structure or return the existing instance.
+
+
+### HTTP Client Override
+
+If required, you can override the underlying HTTP implementation with your own implementation. This is useful if you want
+to perform logging of the requests being made, or route the traffic over a secured tunnel such as a VPN.
+
+In Go this can be configured using the `WithHTTPClient` option. You are required to provide an implementation of the
+`HTTPDoer` interface, which the [http.Client](https://pkg.go.dev/net/http#Client) implements. For TypeScript clients,
+this can be configured using the `fetcher` option and must conform to the same prototype as the browsers inbuilt [fetch
+API](https://developer.mozilla.org/en-US/docs/Web/API/fetch).
+
+### Structured Errors
+
+Errors created or wrapped using Encore's [`errs package`](/docs/develop/errors) will be returned to the client and deserialized
+as an `APIError`, allowing the client to perform adaptive error handling based on the type of error returned. You can perform
+a type check on errors caused by calling an API to see if it is an `APIError`, and once cast as an `APIError` you can access
+the `Code`, `Message` and `Details` fields. For TypeScript Encore generates a `isAPIError` type guard which can be used.
+
+The `Code` field is an enum with all the possible values generated in the library, alone with description of when we
+would expect them to be returned by your API. See the [errors documentation](/docs/develop/errors#error-codes) for
+an online reference of this list.
+
+## Example CLI Tool
+
+For instance, we could build a simple CLI application to use our [url shortener](/docs/tutorials/rest-api), and handle
+any structured errors in a way which makes sense for that error code.
+
+```go
+package main
+
+import (
+    "context"
+    "fmt"
+    "os"
+    "time"
+
+    "shorten_cli/client"
+)
+
+func main() {
+    // Create a new client with the default BaseURL
+    client, err := client.New(
+        client.Environment("production"),
+        client.WithAuth(os.Getenv("SHORTEN_API_KEY")),
+    )
+    if err != nil {
+        panic(err)
+    }
+
+    // Timeout if the request takes more than 5 seconds
+    ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+    defer cancel()
+
+    // Call the Shorten function in the URL service
+    resp, err := client.Url.Shorten(
+        ctx,
+        client.UrlShortenParams{ URL: os.Args[1] },
+    )
+    if err != nil {
+        // Check the error returned
+        if err, ok := err.(*client.APIError); ok {
+            switch err.Code {
+            case client.ErrUnauthenticated:
+                fmt.Println("SHORTEN_API_KEY was invalid, please check your environment")
+                os.Exit(1)
+            case client.ErrAlreadyExists:
+                fmt.Println("The URL you provided was already shortened")
+                os.Exit(0)
+            }
+        }
+        panic(err) // if here then something has gone wrong in an unexpected way
+    }
+    fmt.Printf("https://short.encr.app/%s", resp.ID)
+}
+```
diff --git a/docs/go/cli/config-reference.md b/docs/go/cli/config-reference.md
new file mode 100644
index 0000000000..5f05dbdc96
--- /dev/null
+++ b/docs/go/cli/config-reference.md
@@ -0,0 +1,50 @@
+---
+seotitle: Encore CLI Configuration Options
+seodesc: Configuration options to customize the behavior of the Encore CLI.
+title: Configuration Reference
+subtitle: Configuration options to customize the behavior of the Encore CLI.
+lang: go
+---
+
+
+The Encore CLI has a number of configuration options to customize its behavior.
+
+Configuration options can be set both for individual Encore applications, as well as
+globally for the local user.
+
+Configuration options can be set using `encore config <key> <value>`,
+and options can similarly be read using `encore config <key>`.
+
+When running `encore config` within an Encore application, it automatically
+sets and gets configuration for that application.
+
+To set or get global configuration, use the `--global` flag.
+
+## Configuration files
+
+The configuration is stored in one ore more TOML files on the filesystem.
+
+The configuration is read from the following files, in order:
+
+### Global configuration
+* `$XDG_CONFIG_HOME/encore/config`
+* `$HOME/.config/encore/config`
+* `$HOME/.encoreconfig`
+
+### Application-specific configuration
+* `$APP_ROOT/.encore/config`
+
+Where `$APP_ROOT` is the directory containing the `encore.app` file.
+
+The files are read and merged, in the order defined above, with latter files taking precedence over earlier files.
+
+## Configuration options
+
+#### run.browser
+Type: string<br/>
+Default: auto<br/>
+Must be one of: always, never, or auto
+
+Whether to open the Local Development Dashboard in the browser on `encore run`.
+If set to "auto", the browser will be opened if the dashboard is not already open.
+
diff --git a/docs/go/cli/infra-namespaces.md b/docs/go/cli/infra-namespaces.md
new file mode 100644
index 0000000000..4f3b656832
--- /dev/null
+++ b/docs/go/cli/infra-namespaces.md
@@ -0,0 +1,63 @@
+---
+seotitle: Infrastructure Namespaces
+seodesc: Learn how Encore's infrastructure namespaces makes it easy to task switch. Stash your infrastructure state and switch to a different task with a single command.
+title: Infrastructure Namespaces
+subtitle: Task switching made easy
+lang: go
+---
+
+Encore's CLI allows you to create and switch between multiple, independent *infrastructure namespaces*.
+Infrastructure namespaces are isolated from each other, and each namespace contains its own independent data.
+
+This makes it trivial to switch tasks, confident your old state and data will be waiting for you when you return.
+
+If you've ever worked on a new feature that involves making changes to the database schema,
+only to context switch to reviewing a Pull Request and had to reset your database, you know the feeling.
+
+With Encore's infrastructure namespaces, this is a problem of the past.
+Run `encore namespace switch --create pr:123` (or `encore ns switch -c pr:123` for short) to create and switch to a new namespace.
+
+The next `encore run` will run in the new namespace, with a completely fresh database.
+When you're done, run `encore namespace switch -` to switch back to your previous namespace.
+
+## Usage
+
+Below are the commands for working with namespaces.
+Note that you can use `encore ns` as a short form for `encore namespace`.
+
+```shell
+# List your namespaces (* indicates the current namespace)
+$ encore namespace list
+
+# Create a new namespace
+$ encore namespace create my-ns
+
+# Switch to a namespace
+$ encore namespace switch my-ns
+
+# Switch to a namespace, creating it if it doesn't exist
+$ encore namespace switch --create my-ns
+
+# Switch to the previous namespace
+$ encore namespace switch -
+
+# Delete a namespace (and all associated data)
+$ encore namespace delete my-ns
+```
+
+Most other Encore commands that interact or use infrastructure take an optional
+`--namespace` (`-n` for short) that overrides the current namespace. If left unspecified,
+the current namespace is used.
+
+For example:
+
+```shell
+# Run the app using the "my-ns" namespace
+$ encore run --namespace my-ns
+
+# Open a database shell to the "my-ns" namespace
+$ encore db shell DATABASE_NAME --namespace my-ns
+
+# Reset all databases within the "my-ns" namespace
+$ encore db reset --all --namespace my-ns
+```
diff --git a/docs/go/cli/mcp.md b/docs/go/cli/mcp.md
new file mode 100644
index 0000000000..c5c03e156c
--- /dev/null
+++ b/docs/go/cli/mcp.md
@@ -0,0 +1,125 @@
+---
+seotitle: Encore MCP Server
+seodesc: Encore's Model Context Protocol (MCP) server provides deep introspection of your application to AI development tools.
+title: MCP Server
+subtitle: The Model Context Provider (MCP) exposes tools that provide application context to LLMs.
+lang: go
+---
+
+Encore provides an MCP server that implements the [Model Context Protocol](https://modelcontextprotocol.io/introduction), an open standard that enables large language models (LLMs) to access contextual information about your application. Think of MCP as a standardized interface—like a "USB-C port for AI applications"—that connects your Encore app's data and functionality to any LLM that supports the protocol.
+
+You can connect to Encore's MCP server from any MCP host (such as Claude Desktop, IDEs, or other AI tools) using either Server-Sent Events (SSE) or stdio transport. To set up this connection, simply run:
+
+```bash
+cd my-encore-app
+encore mcp start
+
+  MCP Service is running!
+
+  MCP SSE URL:        http://localhost:9900/sse?app=your-app-id
+  MCP stdio Command:  encore mcp run --app=your-app-id
+```
+
+Copy the appropriate URL or command to your MCP host's configuration, and you're ready to give your AI assistants rich context about your application.
+
+## Example: Integrating with Cursor
+
+[Cursor](https://cursor.com) is one of the most popular AI powered IDE's, and it's simple to use Encore's MCP server together with Cursor. 
+
+In order to add the Encore MCP server to Cursor, the fastest way is via the button below (make sure to update `your-app-id` in the configuration to your actual Encore app ID).
+
+<a href="https://cursor.com/en/install-mcp?name=encore-mcp&config=eyJjb21tYW5kIjoiZW5jb3JlIG1jcCBydW4gLS1hcHA9eW91ci1hcHAtaWQifQ%3D%3D"><img src="https://cursor.com/deeplink/mcp-install-dark.svg" alt="Add encore-mcp MCP server to Cursor" height="32" class="noshadow" /></a>
+
+If you prefer to configure it manually, create the file `.cursor/mcp.json` with the following settings:
+
+```json
+{
+    "mcpServers": {
+        "encore-mcp": {
+            "command": "encore",
+            "args": ["mcp", "run", "--app=your-app-id"]
+        }
+    }
+}
+```
+
+Learn more in [Cursor's MCP docs](https://docs.cursor.com/context/model-context-protocol)
+
+Now when using Cursor's Agent mode, you can ask it to do advanced actions, such as:
+
+"Add an endpoint that publishes to a pub/sub topic, call it and verify that the publish is in the traces"
+
+## Command Reference
+
+#### Start
+
+Starts an SSE-based MCP server and displays connection information.
+
+```shell
+$ encore mcp start [--app=<app-id>]
+```
+
+#### Run
+
+Establishes an stdio-based MCP session. This command is typically used by MCP hosts to communicate with the server through standard input/output streams.
+
+```shell
+$ encore mcp run [--app=<app-id>]
+```
+
+## Exposed Tools
+
+Encore's MCP server exposes the following tools that provide AI models with detailed context about your application. These tools enable LLMs to understand your application's structure, retrieve relevant information, and take actions within your system.
+
+#### Database Tools
+
+- **get_databases**: Retrieve metadata about all SQL databases defined in the application, including their schema, tables, and relationships.
+- **query_database**: Execute SQL queries against one or more databases in the application.
+
+#### API Tools
+
+- **call_endpoint**: Make HTTP requests to any API endpoint in the application.
+- **get_services**: Retrieve comprehensive information about all services and their endpoints in the application.
+- **get_middleware**: Retrieve detailed information about all middleware components in the application.
+- **get_auth_handlers**: Retrieve information about all authentication handlers in the application.
+
+#### Trace Tools
+
+- **get_traces**: Retrieve a list of request traces from the application, including their timing, status, and associated metadata.
+- **get_trace_spans**: Retrieve detailed information about one or more traces, including all spans, timing information, and associated metadata.
+
+#### Source Code Tools
+
+- **get_metadata**: Retrieve the complete application metadata, including service definitions, database schemas, API endpoints, and other infrastructure components.
+- **get_src_files**: Retrieve the contents of one or more source files from the application.
+
+#### PubSub Tools
+
+- **get_pubsub**: Retrieve detailed information about all PubSub topics and their subscriptions in the application.
+
+#### Storage Tools
+
+- **get_storage_buckets**: Retrieve comprehensive information about all storage buckets in the application.
+- **get_objects**: List and retrieve metadata about objects stored in one or more storage buckets.
+
+#### Cache Tools
+
+- **get_cache_keyspaces**: Retrieve comprehensive information about all cache keyspaces in the application.
+
+#### Metrics Tools
+
+- **get_metrics**: Retrieve comprehensive information about all metrics defined in the application.
+
+#### Cron Tools
+
+- **get_cronjobs**: Retrieve detailed information about all scheduled cron jobs in the application.
+
+#### Secret Tools
+
+- **get_secrets**: Retrieve metadata about all secrets used in the application.
+
+#### Documentation Tools
+
+- **search_docs**: Search the Encore documentation using Algolia's search engine.
+- **get_docs**: Retrieve the full content of specific documentation pages.
+
diff --git a/docs/go/cli/telemetry.md b/docs/go/cli/telemetry.md
new file mode 100644
index 0000000000..58001898b7
--- /dev/null
+++ b/docs/go/cli/telemetry.md
@@ -0,0 +1,97 @@
+---
+seotitle: Encore Telemetry
+seodesc: Encore collects telemetry data about app usage
+title: Telemetry
+lang: go
+---
+Telemetry helps us improve the Encore by collecting usage data. This data provides insights into how Encore is used, enabling us to make informed decisions to enhance performance, add new features, and fix bugs more efficiently.
+
+Encore only collects telemetry data in the local development tools and the Encore Cloud dashboard. It does **not** collect any telemetry data from your running applications or cloud services, ensuring complete privacy and security for your operations.
+
+## Why We Collect Data
+
+We collect telemetry data for several important reasons:
+
+1. **Improvement of Features**: Understanding which features are most used helps us prioritize improvements and new feature development.
+2. **Performance Monitoring**: Tracking performance metrics enables us to identify and resolve issues, ensuring a smoother user experience.
+3. **Bug Detection**: Telemetry data can help us detect and fix bugs faster by providing context on how and when issues occur.
+4. **User Experience**: Insights from telemetry data guide us in making Encore more intuitive and user-friendly.
+
+## How Data is Collected
+
+Encore collects data in a way that prioritizes user privacy and security. Here's how we do it:
+
+1. **User Identifiable Data**: The data collected includes identifiable information that helps us understand specific user interactions and contexts.
+2. **Types of Data**: We collect data on usage patterns, performance metrics, and error reports.
+3. **Secure Transmission**: All data is transmitted securely using industry-standard encryption protocols.
+4. **Minimal Impact**: Data collection is designed to have minimal impact on Encore's performance.
+
+### Example of Data Being Sent
+
+Here is an example of the type of data that is sent:
+
+```json
+{
+    "event": "app.create",
+    "anonymousId": "a-uuid-unique-for-the-installation",
+    "properties": {
+        "error": false,
+        "lang": "go",
+        "template": "graphql"
+    }
+}
+```
+
+## Data We Don't Collect
+
+At Encore, we prioritize your privacy and ensure that no sensitive data is collected through our telemetry. Specifically, we do not collect:
+
+1. **Environment Variables**: We do not collect any environment variables set in your development or production environments.
+2. **File Paths**: The specific paths of your files and directories are not collected.
+3. **Contents of Files**: We do not access or collect the contents of your code files or any other files in your projects.
+4. **Logs**: No log files from your application or development environment are collected.
+5. **Serialized Errors**: We do not collect serialized errors that may contain sensitive information.
+
+Our goal is to gather useful data that helps improve Encore while ensuring that your sensitive information remains private and secure.
+
+## Disabling Telemetry
+
+While telemetry helps us improve Encore, we understand that some users may prefer to opt out. Disabling telemetry is straightforward and can be done in two ways:
+
+1. **Using the CLI Command**: You can disable telemetry by executing a simple command in your terminal.
+
+   ```sh
+   encore telemetry disable
+   ```
+
+2. **Setting an Environment Variable**: Alternatively, you can disable telemetry by setting the `DISABLE_ENCORE_TELEMETRY` environment variable.
+
+   ```sh
+   export DISABLE_ENCORE_TELEMETRY=1
+   ```
+
+3. **Confirmation**: After disabling telemetry, either by the CLI command or environment variable, you will receive a confirmation message indicating that telemetry has been successfully disabled.
+
+4. **Re-enabling Telemetry**: If you decide to re-enable telemetry later, you can do so with the following CLI command:
+
+   ```sh
+   encore telemetry enable
+   ```
+
+## Debugging Telemetry
+
+For users who want more visibility into what telemetry data is being sent, you can enable debug mode:
+
+1. **Setting Debug Mode**: Enable debug mode by setting the `ENCORE_TELEMETRY_DEBUG` environment variable.
+
+   ```sh
+   export ENCORE_TELEMETRY_DEBUG=1
+   ```
+
+2. **Log Statements**: When debug mode is enabled, a log statement prepended by `[telemetry]` will be printed every time telemetry data is sent.
+
+## Conclusion
+
+Telemetry is a vital tool for improving Encore, but we respect your choice regarding data sharing. With easy-to-use commands and environment variables, you can manage your telemetry settings as you see fit. If you have any further questions or need assistance, please refer to our support documentation or contact our support team.
+
+Thank you for helping us make Encore better!
diff --git a/docs/go/community/contribute.md b/docs/go/community/contribute.md
new file mode 100644
index 0000000000..4bb7f7eebb
--- /dev/null
+++ b/docs/go/community/contribute.md
@@ -0,0 +1,36 @@
+---
+seotitle: How to contribute to Encore Open Source Project
+seodesc: Learn how to contribute to the Encore Open Source project by submitting pull requests, reporting bugs, or contributing documentation or example projects.
+title: Ways to contribute
+subtitle: Guidelines for contributing to Encore
+lang: go
+---
+
+We’re so excited that you are interested in contributing to Encore! All contributions are welcome, and there are several valuable ways to contribute.
+
+### Open Source Project
+
+If you want to contribute to the Encore Open Source project, you can submit a pull request on [GitHub](https://github.com/encoredev/encore/pulls).
+
+### Report issues
+
+If you have run into an issue or think you’ve found a bug, please report it via the [issue tracker](https://github.com/encoredev/encore/issues).
+
+### Add or update docs
+
+If there’s something you think would be helpful to add to the docs or if there’s something that seems out of date, we appreciate your input.
+You can view the docs and contribute fixes or improvements directly in [GitHub](https://github.com/encoredev/encore/tree/main/docs).
+
+You can also email your feedback to us at [hello@encore.dev](mailto:hello@encore.dev).
+
+### Blog posts
+
+If you’ve built something cool using Encore, we’d really like you to talk about it! We love it when developers share their projects on blogs and on Twitter.
+
+Use the hashtag **#builtwithencore** and we’ll have an easier time finding your work. – We might also showcase it on the [Encore Twitter account](https://twitter.com/encoredotdev)!
+
+### Meetups & Workshops
+
+Organizing a meetup or workshop is a great way to connect with other developers using Encore. It can also be a great first step in trying out Encore for development in your company or other professional organization.
+
+If you want help with organizing or planning an event, please don’t hesitate to reach out to us via email at [hello@encore.dev](mailto:hello@encore.dev).
diff --git a/docs/go/community/get-involved.md b/docs/go/community/get-involved.md
new file mode 100644
index 0000000000..52da16e252
--- /dev/null
+++ b/docs/go/community/get-involved.md
@@ -0,0 +1,61 @@
+---
+seotitle: Encore's Open Source Developer Community
+seodesc: Learn how to engage in the Open Source Developer Community supporting Encore.
+title: Community
+subtitle: Join the most pioneering developer community!
+lang: go
+---
+
+Developers building with Encore are forward-thinkers, who are working on exciting and innovative applications.
+
+We rely on this group's feedback, and contributions to the Open Source project, to improve Encore for developers everywhere.
+Getting involved is a fantastic way of finding support and inspiration among peers.
+
+Everyone is welcome in the Encore community, and we hope you to get involved too!
+
+## Get involved
+
+There are many ways to get involved. Here's where you can start straight away.
+
+<p className="flex items-center gap-x-2 lead-xsmall">
+     <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 16 16" fill="#111111" stroke="none">
+      <path fillRule="evenodd"
+            d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z" />
+    </svg>
+    <a href="https://github.com/encoredev/encore">Contribute on GitHub</a>
+</p>
+
+Use GitHub to report bugs, feedback on proposals, or contribute your ideas.
+
+<p className="flex items-center gap-x-2 lead-xsmall">
+   <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 -28.5 256 256">
+        <path fill="#111111"
+            d="M216.856339,16.5966031 C200.285002,8.84328665 182.566144,3.2084988 164.041564,0 C161.766523,4.11318106 159.108624,9.64549908 157.276099,14.0464379 C137.583995,11.0849896 118.072967,11.0849896 98.7430163,14.0464379 C96.9108417,9.64549908 94.1925838,4.11318106 91.8971895,0 C73.3526068,3.2084988 55.6133949,8.86399117 39.0420583,16.6376612 C5.61752293,67.146514 -3.4433191,116.400813 1.08711069,164.955721 C23.2560196,181.510915 44.7403634,191.567697 65.8621325,198.148576 C71.0772151,190.971126 75.7283628,183.341335 79.7352139,175.300261 C72.104019,172.400575 64.7949724,168.822202 57.8887866,164.667963 C59.7209612,163.310589 61.5131304,161.891452 63.2445898,160.431257 C105.36741,180.133187 151.134928,180.133187 192.754523,160.431257 C194.506336,161.891452 196.298154,163.310589 198.110326,164.667963 C191.183787,168.842556 183.854737,172.420929 176.223542,175.320965 C180.230393,183.341335 184.861538,190.991831 190.096624,198.16893 C211.238746,191.588051 232.743023,181.531619 254.911949,164.955721 C260.227747,108.668201 245.831087,59.8662432 216.856339,16.5966031 Z M85.4738752,135.09489 C72.8290281,135.09489 62.4592217,123.290155 62.4592217,108.914901 C62.4592217,94.5396472 72.607595,82.7145587 85.4738752,82.7145587 C98.3405064,82.7145587 108.709962,94.5189427 108.488529,108.914901 C108.508531,123.290155 98.3405064,135.09489 85.4738752,135.09489 Z M170.525237,135.09489 C157.88039,135.09489 147.510584,123.290155 147.510584,108.914901 C147.510584,94.5396472 157.658606,82.7145587 170.525237,82.7145587 C183.391518,82.7145587 193.761324,94.5189427 193.539891,108.914901 C193.539891,123.290155 183.391518,135.09489 170.525237,135.09489 Z" />
+    </svg>
+    <a href="https://encore.dev/discord">Join Discord</a>
+</p>
+
+Connect with fellow Encore developers, ask questions, or just hang out!
+
+<p className="flex items-center gap-x-2 lead-xsmall">
+    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="#111111" stroke="none">
+        <path d="M23 3a10.9 10.9 0 0 1-3.14 1.53 4.48 4.48 0 0 0-7.86 3v1A10.66 10.66 0 0 1 3 4s-4 9 5 13a11.64 11.64 0 0 1-7 2c9 5 20 0 20-11.5a4.5 4.5 0 0 0-.08-.83A7.72 7.72 0 0 0 23 3z" />
+    </svg>
+    <a href="https://twitter.com/encoredotdev">Follow on Twitter</a>
+</p>
+
+Follow Encore on Twitter to keep up with the latest. Share what you've built to help spread the word about the project.
+
+### Contribute to the project
+
+Want to make a contribution to Encore? Great, start by reading about the different [ways to contribute](/docs/go/community/contribute).
+
+### Feedback on the Roadmap
+
+[The Encore Roadmap](https://encore.dev/roadmap) is public. It's open to your comments, feature requests, and you can vote on existing entries.
+
+## Community Governance
+
+We recommend everyone read the [Community Principles](/docs/go/community/principles).
+
+If you need assistance, have concerns, or have questions for the Community team, please email us at [support@encore.dev](mailto:support@encore.dev).
diff --git a/docs/go/community/open-source.md b/docs/go/community/open-source.md
new file mode 100644
index 0000000000..8bb533a57c
--- /dev/null
+++ b/docs/go/community/open-source.md
@@ -0,0 +1,21 @@
+---
+seotitle: Encore is Open Source
+seodesc: We believe Open Source is key to a sustainable and prosperous technology community. Encore builds on Open Source software, and is itself Open Source.
+title: Open Source
+subtitle: Encore is Open Source Software
+lang: go
+---
+
+We believe Open Source is key to a long-term sustainable and prosperous technology community. Encore builds on Open Source software, and is largely Open Source itself.
+
+## License
+
+Encore's Backend Framework, parser, and compiler are Open Source under Mozilla Public License 2.0.
+
+> The MPL is a simple copyleft license. The MPL's "file-level" copyleft is designed to encourage contributors to share modifications they make to your code, while still allowing them to combine your code with code under other licenses (open or proprietary) with minimal restrictions.
+
+You can learn more about MPL 2.0 on [the official website](https://www.mozilla.org/en-US/MPL/2.0/FAQ/).
+
+## Contribute
+
+Contributions to improve Encore are very welcome. Contribute to Encore on [GitHub](https://github.com/encoredev/encore).
diff --git a/docs/go/community/principles.md b/docs/go/community/principles.md
new file mode 100644
index 0000000000..4039af88e4
--- /dev/null
+++ b/docs/go/community/principles.md
@@ -0,0 +1,15 @@
+---
+seotitle: Encore Community Principles
+seodesc: Everyone is welcome in the Encore community, and we want everyone to feel at home and free to contribute.
+title: Community principles
+subtitle: Everyone belongs in the Encore community
+lang: go
+---
+
+Everyone is welcome in the Encore community, and it is of utmost importance to us that everyone is able to feel at home and contribute.
+
+Therefore we as maintainers, and you as a contributor, must pledge to make participation in our community a harassment-free experience for everyone, regardless of: age, body size, disability, ethnicity, gender identity, level of experience, nationality, personal appearance, race, religion, or sexual identity.
+
+### Code of Conduct
+
+To this end, the Encore community is guided by the [Contributor Covenant 2.0 Code of Conduct](https://www.contributor-covenant.org/version/2/0/code_of_conduct/) to ensure everyone is welcome and able to participate. 
\ No newline at end of file
diff --git a/docs/go/community/submit-template.md b/docs/go/community/submit-template.md
new file mode 100644
index 0000000000..583372d7e0
--- /dev/null
+++ b/docs/go/community/submit-template.md
@@ -0,0 +1,49 @@
+---
+seotitle: Submit a Template to Encore's Templates repo
+seodesc: Learn how to contribute to Encore's Templates repository and get features in the Encore Templates marketplace.
+title: Submit a Template
+subtitle: Your contributions help other developers build
+lang: go
+---
+
+[Templates](/templates) help and inspire developers to build applications using Encore.
+
+You are welcome to contribute your own templates!
+
+Two types of templates that are especially useful:
+- **Starters:** Runnable Encore applications for others to use as is, or take inspiration from.
+- **Bits:** Re-usable code samples to solve common development patterns or integrate Encore applications with third-party APIs and services.
+
+## Submit your contribution
+
+Contribute a template by submitting a Pull Request to the [Open Source Examples Repo](https://github.com/encoredev/examples): `https://github.com/encoredev/examples`
+
+### Submitting Starters
+
+Follow these steps to submit a **Starter**:
+
+1. Fork the repo.
+2. Create a new folder in the root directory of the repo, this is where you will place your template. — Use a short folder name as your template will be installable via the CLI, like so: `encore app create APP-NAME --example=<TEMPLATE_FOLDER_NAME>`
+3. Include a `README.md` with instructions for how to use the template. We recommend following [this format](https://github.com/encoredev/examples/blob/8c7e33243f6bfb1b2654839e996e9a924dcd309e/uptime/README.md).
+
+Once your Pull Request has been approved, it may be featured on the [Templates page](/templates) on the Encore website.
+
+### Submitting Bits
+
+Follow these steps to submit your **Bits**:
+
+1. Fork the repo.
+2. Create a new folder inside the `bits` folder in the repo and place your template inside it. Use a short folder name as your template will soon be installable via the CLI.
+3. Include a `README.md` with instructions for how to use the template.
+
+Once your Pull Request has been approved, it may be featured on the [Templates page](/templates) on the Encore website.
+
+## Contribute from your own repo
+
+If you don't want to contribute code to the examples repo, but still want to be featured on the [Templates page](/templates), please contact us at [hello@encore.dev](mailto:hello@encore.dev).
+
+## Dynamic Encore AppID
+
+In most cases, you should avoid hardcoding an `AppID` in your template's source code. Instead, use the notation `{{ENCORE_APP_ID}}`.
+
+When a developer creates an app using the template, `{{ENCORE_APP_ID}}` will be dymically replaced with their new and unique `AppID`, meaning they will not need to make any manual code adjustments.
diff --git a/docs/go/concepts/application-model.md b/docs/go/concepts/application-model.md
new file mode 100644
index 0000000000..1071d60c78
--- /dev/null
+++ b/docs/go/concepts/application-model.md
@@ -0,0 +1,25 @@
+---
+seotitle: Encore Application Model
+seodesc: How Encore understands your application using static analysis
+title: Encore Application Model
+subtitle: How Encore understands your application
+lang: go
+---
+
+Encore works by using static analysis to understand your application. This is a fancy term for parsing and analyzing the code you write and creating a graph of how your application works. This graph closely represents your own mental model of the system: boxes and arrows that represent systems and services that communicate with other systems, pass data and connect to infrastructure. We call it the Encore Application Model.
+
+Because the Open Source framework, parser, and compiler, are all designed together, Encore can ensure 100% accuracy when creating the application model. Any deviation is caught as a compilation error.
+
+Using this model, Encore can provide tools to solve problems that normally would be up to the developer to do manually. From creating architecture diagrams and API documentation to provisioning cloud infrastructure.
+
+We're continuously expanding on Encore's capabilities and are building a new generation of developer tools that are enabled by Encore's understanding of your application.
+
+The framework, parser, and compiler that enable this are all [Open Source](https://github.com/encoredev/encore).
+
+<img src="/assets/docs/flow-diagram.png" title="Encore Application Model" className="mx-auto md:max-w-lg"/>
+
+## Standardization brings clarity
+
+Developers make dozens of decisions when creating a backend application. Deciding how to structure the codebase, defining API schemas, picking underlying infrastructure, etc. The decisions often come down to personal preferences, not technical rationale. This creates a huge problem in the form of fragmentation! When every stack looks different, all tools have to be general purpose.
+
+When you adopt Encore, many of these stylistic decisions are already made for you. The Encore framework ensures your application follows modern best practices. And when you run your application, Encore's Open Source parser and compiler check that you're sticking to the standard. This means you're free to focus your energy on what matters: writing your application's business logic.
\ No newline at end of file
diff --git a/docs/go/concepts/benefits.md b/docs/go/concepts/benefits.md
new file mode 100644
index 0000000000..6a7910affe
--- /dev/null
+++ b/docs/go/concepts/benefits.md
@@ -0,0 +1,29 @@
+---
+seotitle: Benefits of using Encore.go
+seodesc: See how Encore.go helps you build backends faster using Go.
+title: Encore.go Benefits
+subtitle: How Encore.go helps you build robust distributed systems, faster.
+lang: go
+---
+
+Using Encore.go to declare infrastructure in application code helps unlock several benefits:
+
+- **Local development with instant infrastructure**: Encore.go automatically sets up necessary infrastructure as you develop.
+- **Rapid feedback**: Catch issues early with type-safe infrastructure, avoiding slow deployment cycles.
+- **No manual configuration required**: No need for Infrastructure-as-Code. Your code is the single source of truth.
+- **Unified codebase**: One codebase for all environments; local, preview, and cloud.
+- **Cloud-agnostic by default**: Encore.go provides an abstraction layer on top of the cloud provider's APIs, so you avoid becoming locked in to a single cloud.
+- **Evolve infrastructure without code changes**: As requirements evolve, you can change the provisioned infrastructure without making code changes, you only need to change the infrastructure configuration which is separate from the application code.
+
+## No DevOps experience required
+
+Encore provides open source tools to help you integrate with your cloud infrastructure, enabling you to self-host your application anywhere to supports Docker containers.
+Learn more in the [self-host documentation](/docs/go/self-host/docker-build).
+
+You can also use [Encore Cloud](https://encore.dev/use-cases/devops-automation), which fully automates provisioning and managing infrastructure in your own cloud on AWS and GCP.
+
+This approach dramatically reduces the level of DevOps expertise required to use scalable, production-ready, cloud services like Kubernetes and Pub/Sub. And because your application code is the source of truth for infrastructure requirements, it ensures the infrastructure in all your environments are always in sync with the application's requirements.
+
+## Simplicity without giving up flexibility
+
+Encore.go provides integrations for common infrastructure primitives, but also allows for flexibility. You can always use any cloud infrastructure, even if it's not built into Encore.go. If you use Encore's [Cloud Platform](https://encore.dev/use-cases/devops-automation), it [automates infrastructure](/docs/platform/infrastructure/infra) using your own cloud account, so you always have full access to your services from the cloud provider's console.
diff --git a/docs/go/develop/api-docs.md b/docs/go/develop/api-docs.md
new file mode 100644
index 0000000000..9b2849106b
--- /dev/null
+++ b/docs/go/develop/api-docs.md
@@ -0,0 +1,16 @@
+---
+seotitle: Service Catalog & Generated API Docs
+seodesc: See how Encore automatically generates API documentation that always stays up to date and in sync.
+title: Service Catalog
+subtitle: Automatically get a Service Catalog and complete API docs
+---
+
+All developers agree API documentation is great to have, but the effort of maintaining it inevitably leads to docs becoming stale and out of date.
+
+To solve this, Encore uses the [Encore Application Model](/docs/go/concepts/application-model) to automatically generate a Service Catalog along with complete documentation for all APIs. This ensures docs are always up-to-date as your APIs evolve.
+
+The API docs are available both in your [Local Development Dashboard](/docs/go/observability/dev-dash) and for your whole team in the [Encore Cloud dashboard](https://app.encore.cloud).
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/servicecatalogvideo.mp4" className="w-full h-full" type="video/mp4" />
+</video>
diff --git a/docs/go/develop/auth.md b/docs/go/develop/auth.md
new file mode 100644
index 0000000000..5b2c93ff80
--- /dev/null
+++ b/docs/go/develop/auth.md
@@ -0,0 +1,221 @@
+---
+seotitle: Adding authentication to APIs to auth users
+seodesc: Learn how to add authentication to your APIs and make sure you know who's calling your backend APIs.
+title: Authenticating users
+subtitle: Knowing what's what and who's who
+infobox: {
+  title: "Authentication",
+  import: "encore.dev/beta/auth",
+}
+lang: go
+---
+Almost every application needs to know who's calling it, whether the user
+represents a person in a consumer-facing app or an organization in a B2B app.
+Encore supports both use cases in a simple yet powerful way.
+
+As described in the docs for [defining APIs](/docs/go/primitives/defining-apis), Encore offers three access levels
+for APIs:
+
+* `//encore:api public` &ndash; defines a public API that anybody on the internet can call.
+* `//encore:api private` &ndash; defines a private API that is never accessible to the outside world. It can only be called from other services in your app and via cron jobs.
+* `//encore:api auth` &ndash; defines a public API that anybody can call, but that requires valid authentication.
+
+When an API is defined with access level `auth`, outside calls to that API must specify
+an authorization header, in the form `Authorization: Bearer <token>`. The token is passed to
+a designated auth handler function and the API call is allowed to go through only if the
+auth handler determines the token is valid.
+
+For more advanced use cases you can also customize the authentication information you want.
+See the section on [accepting structured auth information](#accepting-structured-auth-information) below.
+
+
+<Callout type="info">
+
+You can optionally send in auth data to `public` and `private` APIs, in which case the auth handler will be used. When used for `private` APIs, they are still not accessible from the outside world.
+
+</Callout>
+
+## The auth handler
+
+Encore applications can designate a special function to handle authentication,
+by defining a function and annotating it with `//encore:authhandler`. This annotation
+tells Encore to run the function whenever an incoming API call contains authentication data.
+
+The auth handler is responsible for validating the incoming authentication data
+and returning an `auth.UID` (a string type representing a **user id**). The `auth.UID`
+can be whatever you wish, but in practice it usually maps directly to the primary key
+stored in a user table (either defined in the Encore service or in an external service like [Firebase](/docs/go/how-to/firebase-auth) or [Auth0](/docs/go/how-to/auth0-auth)).
+
+### With custom user data
+
+Oftentimes it's convenient for the rest of your application to easily be able to look up
+information about the authenticated user making the request. If that's the case,
+define the auth handler like so:
+
+```go
+import "encore.dev/beta/auth"
+
+// Data can be named whatever you prefer (but must be exported).
+type Data struct {
+    Username string
+    // ...
+}
+
+// AuthHandler can be named whatever you prefer (but must be exported).
+//encore:authhandler
+func AuthHandler(ctx context.Context, token string) (auth.UID, *Data, error) {
+    // Validate the token and look up the user id and user data,
+    // for example by calling Firebase Auth.
+}
+```
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/clerk" 
+    desc="Example application showing an auth handler implementation with Clerk." 
+/>
+
+<RelatedDocsLink paths={["/docs/go/how-to/auth0-auth", "/docs/go/how-to/clerk-auth", "/docs/go/how-to/firebase-auth"]} />
+
+### Without custom user data
+
+When you don't require custom user data and it's sufficient to use `auth.UID`,
+simply skip it in the return type:
+
+```go
+import "encore.dev/beta/auth"
+
+// AuthHandler can be named whatever you prefer (but must be exported).
+//encore:authhandler
+func AuthHandler(ctx context.Context, token string) (auth.UID, error) {
+    // Validate the token and look up the user id,
+    // for example by calling Firebase Auth.
+}
+```
+
+## Accepting structured auth information
+
+In the examples above the function accepts a `Bearer` token as a string argument.
+In that case Encore parses the `Authorization` HTTP header and passes the token to the auth handler.
+
+In cases where you have different or more complex authorization requirements, you can instead specify
+a data structure that specifies one or more fields to be parsed from the HTTP request. For example:
+
+```go
+type MyAuthParams struct {
+	// SessionCookie is set to the value of the "session" cookie.
+	// If the cookie is not set it's nil.
+	SessionCookie *http.Cookie `cookie:"session"`
+	
+	// ClientID is the unique id of the client, sourced from the URL query string.
+	ClientID string `query:"client_id"`
+	
+	// Authorization is the raw value of the "Authorization" header
+	// without any parsing.
+	Authorization string `header:"Authorization"`
+}
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, p *MyAuthParams) (auth.UID, error) {
+    // ...
+}
+```
+
+This example tells Encore that the application accepts authentication information via
+the `session` cookie, the `client_id` query string parameter, and the `Authorization` header.
+These fields are automatically filled in when the auth handler is called (if present in the request).
+
+You can of course combine auth params like this with custom user data (see the section above).
+
+<Callout type="info">
+
+Cookies are generally only used by browsers and are automatically added to requests made by browsers.
+As a result Encore does not include cookie fields in generated clients' authentication payloads
+or in the [Local Development Dashboard](/docs/go/observability/dev-dash).
+
+</Callout>
+
+## Handling auth errors
+
+When a token doesn't match your auth rules (for example if it's expired, the token has been revoked, or the token is invalid), you should return a non-nil error from the auth handler.
+
+Encore passes the error message on to the user when you use [Encore's built-in error package](/docs/go/primitives/api-errors), so we recommend using that with the error code `Unauthenticated` to communicate what happened. For example:
+
+```go
+import "encore.dev/beta/errs"
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, token string) (auth.UID, error) {
+    return "", &errs.Error{
+        Code: errs.Unauthenticated,
+        Message: "invalid token",
+    }
+}
+```
+
+<Callout type="important">
+
+Note that for security reasons you may not want to reveal too much information about why a request did not pass your auth checks. There are many subtle security considerations when dealing with authentication and we don't have time to go into all of them here.
+
+Whenever possible we recommend using a third-party auth provider instead of rolling your own authentication.
+
+</Callout>
+
+## Using auth data
+
+Once the user has been identified by the auth handler, the API handler is called
+as usual. If it wishes to inspect the authenticated user, it can use the
+`encore.dev/beta/auth` package:
+
+- `auth.Data()` returns the custom user data returned by the auth handler (if any)
+- `auth.UserID()` returns `(auth.UID, bool)` to get the authenticated user id (if any)
+
+For an incoming request from the outside to an API that uses the `auth` access level,
+these are guaranteed to be set since the API won't be called if the auth handler doesn't succeed.
+
+Encore automatically propagates the auth data when you make API calls to other Encore API endpoints.
+
+<Callout type="info">
+
+If an endpoint calls another endpoint during its processing, and the original
+does not have an authenticated user, the request will fail. This behavior
+preserves the guarantees that `auth` endpoints always have an authenticated user.
+
+</Callout>
+
+
+## Optional authentication
+
+While Encore always calls the auth handler for API endpoints marked as `auth`, you can also call `public` API endpoints with authentication data.
+
+This can be useful for APIs that support both a "logged in" and "logged out" experience.
+For example, a site like Reddit might have a `post.List` endpoint that returns the list of posts,
+but if you're logged in it also includes whether or not you have upvoted or downvoted each post.
+
+To support such use cases, Encore runs the auth handler for `public` API endpoints if (and only if) the request
+includes any authentication information (such as the `Authorization` header).
+
+In that case, the request processing behavior varies depending on the value of the `error` returned from the auth handler:
+
+* If the error is nil, the request is considered to be an authenticated request and `auth.UID()` and `auth.Data()` will include
+  the information the auth handler returned.
+* If the error is non-nil and the error code is `errs.Unauthenticated` (like shown above), the request continues as an unauthenticated request,
+  behaving exactly as if there was no authentication data provided at all.
+* If the error is non-nil and the error code is anything else, the request is aborted and Encore returns that error to the caller.
+
+To be able to determine if the request has an authenticated user, check the second return value from `auth.UserID()`.
+
+## Overriding auth information
+
+Encore supports overriding the auth information for an outgoing request using the
+[`auth.WithContext`](https://pkg.go.dev/encore.dev/beta/auth#WithContext) function.
+This function returns a new context with the auth information set to the specified values.
+
+Note that this only affects the auth information passed along with the request, and not the
+current request being processed (if any).
+
+This function is often useful when testing APIs that use authentication. For example:
+
+```go
+ctx := auth.WithContext(context.Background(), auth.UID("my-user-id"), &MyAuthData{Email: "hello@example.com"})
+// ... Make an API call using `ctx` to override the auth information for that API call.
+```
diff --git a/docs/go/develop/config.md b/docs/go/develop/config.md
new file mode 100644
index 0000000000..a6976ac57a
--- /dev/null
+++ b/docs/go/develop/config.md
@@ -0,0 +1,440 @@
+---
+seotitle: Configuration for environment specific changes
+seodesc: See how you can use configuration to define different behavior in each environment. Making it simpler to develop and test your backend application.
+title: Configuration
+subtitle: Define behavior in specific environments
+infobox: {
+  title: "Configuration",
+  import: "encore.dev/config",
+}
+lang: go
+---
+
+Configuration files let you define default behavior for your application, and override it for specific environments. This allows you to make changes without affecting deployments in other environments.
+
+Encore supports configuration files written in [CUE](https://cuelang.org/), which is a superset of JSON. It adds the following:
+- C-style comments
+- Quotes may be omitted from field names without special characters
+- Commas at the end of fields are optional
+- A comma after last element in list is allowed
+- The outer curly braces on the file are optional
+- [Expressions](https://cuelang.org/docs/tutorials/tour/expressions/) such as interpolation, comprehensions and conditionals
+  are supported.
+
+<Callout type="important">
+
+For sensitive data use Encore's [secrets management](/docs/go/primitives/secrets) functionality instead of configuration.
+
+</Callout>
+
+## Using Config
+
+Inside your service, you can call `config.Load[*SomeConfigType]()`
+to load the config. This must be done at the package level, and not inside a function. See more in the [package documentation](https://pkg.go.dev/encore.dev/config#Load).
+
+Here's an example implementation:
+
+```go
+package mysvc
+
+import (
+    "encore.dev/config"
+)
+
+type SomeConfigType struct {
+    ReadOnly config.Bool    // Put the system into read-only mode
+    Example  config.String
+}
+
+var cfg *SomeConfigType = config.Load[*SomeConfigType]()
+```
+
+The type you pass as a type parameter to this function will be used to generate a `encore.gen.cue` file in your services
+directory. This file will contain both the CUE definition for your configuration type, and some [metadata](#provided-meta-values) that Encore will
+provide to your service at runtime. This allows you to change the final value of your configuration based on the environment the
+application is running in.
+
+Any files ending with `.cue` in your service directory or sub-directories will be loaded by Encore and given to CUE to
+unify and compute a final configuration.
+
+<Toggle label="Example CUE files">
+
+```
+-- mysvc/encore.gen.cue --
+// Code generated by encore. DO NOT EDIT.
+package mysvc
+
+#Meta: {
+	APIBaseURL: string
+	Environment: {
+		Name:  string
+		Type:  "production" | "development" | "ephemeral" | "test"
+		Cloud: "aws" | "gcp" | "encore" | "local"
+	}
+}
+
+#Config: {
+	ReadOnly: bool   // Put the system into read-only mode
+    Example:  string
+}
+#Config
+-- mysvc/myconfig.cue --
+// Set example to "hello world"
+Example: "hello world"
+
+// By default we're not in read only mode
+ReadOnly: bool | *false
+
+// But on the old production environment, we're in read only mode
+if #Meta.Environment.Name == "old-prod" {
+    ReadOnly: true
+}
+```
+
+</Toggle>
+
+<Callout type="info">
+
+Loading configuration
+is only supported in services and the loaded data can not be referenced from packages outside that service.
+
+</Callout>
+
+### CUE tags in Go Structs
+
+You can use the `cue` tag in your Go to specify additional constraints on your configuration. For example:
+
+```go
+type FooBar {
+    A int `cue:">100"`
+    B int `cue:"A-50"` // If A is set, B can be inferred by CUE
+    C int `cue:"A+B"`  // Which then allows CUE to infer this too
+}
+
+var _ = config.Load[*FooBar]()
+```
+
+Will result in the following CUE type definition being generated:
+
+```cue
+#Config: {
+    A: int & >100
+    B: int & A-50 // If A is set, B can be inferred by CUE
+    C: int & A+B  // Which then allows CUE to infer this too
+}
+```
+
+## Config Wrappers
+
+Encore provides type wrappers for config in the form of `config.Value[T]` and `config.Values[T]` which expand into
+functions of type `T` and `[]T` respectively. These functions allow you to override the default value of your
+configuration in your CUE files inside tests, where only code run from that test will see the override.
+
+In the future we plan to support real-time updating of configuration values on running applications, thus using
+these wrappers in your configuration today will future proof your code and allow you to automatically take advantage of this feature when it is
+available.
+
+Any type supported in API requests and responses can be used as the type for a config wrapper. However for convenience, Encore ships with the following inbuilt aliases for the config wrappers:
+
+ - `config.String`, `config.Bool`, `config.Int`, `config.Uint`,
+ `config.Int8`, `config.Int16`, `config.Int32`, `config.In64`,
+ `config.Uint8`, `config.Uint16`, `config.Uint32`, `config.Uint64`,
+ `config.Float32`, `config.Float64`, `config.Bytes`, `config.Time`, `config.UUID`
+
+<Toggle label="Example Application using Wrappers">
+
+```go
+-- svc/svc.go --
+type mysvc
+
+import (
+    "encore.dev/config"
+)
+
+type Server struct {
+    // The config wrappers do not have to be in the top level struct
+    Enabled config.Bool
+    Port    config.Int
+}
+
+type SvcConfig struct {
+    GameServerPorts config.Values[Server]
+}
+
+var cfg = config.Load[*SvcConfig]()
+
+func startServers() {
+    for _, server := range cfg.GameServerPorts() {
+        if server.Enabled() {
+            go startServer(server.Port())
+        }
+    }
+}
+
+func startServer(port int) {
+  // ...
+}
+-- svc/servers.cue --
+GameServerPorts: [
+    {
+        Enabled: false
+        Port:    12345
+    },
+    {
+        Enabled: true
+        Port:    1337
+    },
+]
+```
+
+</Toggle>
+
+
+## Provided Meta Values
+
+When your application is running, Encore will provide information about that environment to your CUE files, which you
+can use to filter on. These fields can be found in the `encore.gen.cue` file which Encore will generate when you add a
+call to load config. Encore provides the following meta values:
+
+- **APIBaseURL**: The base URL of the Encore API, which can be used to make API calls to the application.
+- **Environment**: A struct containing information about the environment the application is running in.<br />
+  &nbsp;&nbsp; **Name**: The name of the environment<br />
+  &nbsp;&nbsp; **Type**: One of `production`, `development`, `ephemeral` or `test`.<br />
+  &nbsp;&nbsp; **Cloud**: The cloud the app is running on, which is one of `aws`, `gcp`, `encore` or `local`.<br />
+
+The following are useful conditionals you can use in your CUE files:
+
+```cue
+// An application running due to `encore run`
+if #Meta.Environment.Type == "development" && #Meta.Environment.Cloud == "local" {}
+
+// An application running in a development environment in the Cloud
+if #Meta.Environment.Type == "development" && #Meta.Environment.Cloud != "local" {}
+
+// An application running in a production environment
+if #Meta.Environment.Type == "production" {}
+
+// An application running in an environment that Encore has created
+// for an open Pull Request on Github
+if #Meta.Environment.Type == "ephemeral" {}
+```
+
+## Testing with Config
+
+Through the provided meta values, your applications configuration can have different values in tests, compared to
+when the application is running. This can be useful to prevent external side effects from your tests, such as emailing
+customers across all test.
+
+Sometimes however, you may want to test specific behaviors based on different configurations (such as disabling user signups),
+in this scenario using the Meta data does not give you fine enough control. To allow you to set a configuration value
+at a per test level, Encore provides the helper function [`et.SetCfg`](https://pkg.go.dev/encore.dev/et#SetCfg). You can
+use this function to set a new value only in the current test and any sub tests, while all other tests will
+continue to use the value defined in the CUE files.
+
+```go
+-- config.cue --
+// By default we want to send emails
+SendEmails: bool | *true
+
+// But in all tests we want to disable emails
+if #Meta.Environment.Type == "test" {
+    SendEmails: false
+}
+-- signup.go --
+import (
+    "context"
+
+    "encore.dev/config"
+)
+
+type Config struct {
+    SendEmails config.Bool
+}
+
+var cfg = config.Load[Config]()
+
+//encore:api public
+func Signup(ctx context.Context, p *SignupParams) error {
+    user := createUser(p)
+
+    if cfg.SendEmails() {
+        SendWelcomeEmail(user)
+    }
+
+    return nil
+}
+-- signup_test.go --
+import (
+    "errors"
+    "testing"
+
+    "encore.dev/et"
+)
+
+func TestSignup(t *testing.T) {
+    err := Signup(context.Background(), &SignupParams { ... })
+    if err != nil {
+        // We don't expect an error here
+        t.Fatal(err)
+    }
+
+    if emailWasSent() {
+        // We don't expect an email to be sent
+        // as it's disabled for all tests
+        t.Fatal("email was sent")
+    }
+}
+
+func TestSignup_TestEmails(t *testing.T) {
+    // For this test, we want to enable the welcome
+    // emails so we can test that they are sent
+    et.SetCfg(cfg.SendEmails, true)
+
+    err := Signup(context.Background(), &SignupParams { ... })
+    if err != nil {
+        // We don't expect an error here
+        t.Fatal(err)
+    }
+
+    // Check the email was sent
+    if !emailWasSent() {
+        t.Fatal("email was not sent")
+    }
+}
+```
+
+## Useful CUE Patterns
+
+If you're new to CUE, we'd recommend checking out the [CUE documentation](https://cuelang.org/docs/) and
+[cuetorials](https://cuetorials.com/), however to get you started, here are some useful patterns you can use in your
+CUE files.
+
+
+<Accordion>
+
+### Defaults
+
+CUE supports the concept of a default value, which it will use if no other concrete value is provided. This can be useful
+for when you normally want one value, but occasionally might want to provide an override in a certain scenario. A default
+value is specified by prefixing it with a `*`.
+
+```cue
+// ReadOnlyMode is a boolean and if we don't provide a value, it
+// will default to false.
+ReadOnlyMode: bool | *false
+
+if #Meta.Environment.Name == "old-prod" {
+    // On this environment, we want to set ReadOnlyMode to true
+    ReadOnlyMode: true
+}
+```
+
+</Accordion>
+
+<Accordion>
+
+### Validation within CUE
+
+Any field prefixed with an `_` will not be exported to the concrete configuration once evaluated by CUE and can be used
+to hold intermediate values. Because CUE allows you to define the same field as many times as you want, as long as the
+values unify, we can build complex validation logic.
+
+```cue
+import (
+    "list" // import CUE's list package
+)
+
+// Set some port numbers defaulting just to 8080
+// but in development including 8443
+portNumbers: [...int] | *[8080]
+if #Meta.Environment.Type == "development" {
+    portNumbers: [8080, 8443]
+}
+
+// Port numbers must be an array and all values
+// are integers 1024 or above.
+portNumbers: [...int & >= 1024]
+
+// The ports are considered valid if they contain the port number 8080.
+_portsAreValid: list.Contains(portNumbers, 8080)
+
+// Ensure that the ports are valid by constraining the value to be true.
+// CUE will report an error if the value is false (that is if the portNumbers list
+// does not contain the value 8080).
+_portsAreValid: true
+```
+
+</Accordion>
+
+<Accordion>
+
+### Switch Statements
+
+If statements in CUE do not have else branches, which can make it difficult to write complex conditionals, we however
+can use an array to emulate a switch statement, where the first value that matches the condition is returned. The following
+example will set `SendEmailsFrom` to a single string.
+
+```cue
+SendEmailsFrom: [
+	// These act as individual case statements
+    if #Meta.Environment.Type == "production" { "noreply@example.com" },
+    if #Meta.Environment.Name == "staging"    { "staging@example.com" },
+
+    // This last value without a condition acts as the default case
+    "dev-system@example.dev",
+][0] // Return the first value which matches the condition
+```
+
+</Accordion>
+
+<Accordion>
+
+### Using Map Keys as Values
+
+CUE allows us to extract map keys and use them as values to simplify the config we need to write and minimize duplication.
+
+```cue
+// Define the type we want to use
+#Server: {
+	server: string
+	port: int & > 1024
+	enabled: bool | *true
+}
+
+// Specify that servers is a map of strings to #Server
+// where they key we assign the variable Name
+servers: [Name=string]: #Server & {
+	// Then we union the key with the value of server
+	server: Name
+}
+
+servers: {
+	"Foo": {
+        port: 8080
+    },
+    "Bar": {
+        port:    8081
+        enabled: false
+    },
+}
+```
+
+This will result in the concrete configuration of:
+```json
+{
+    "servers": {
+        "Foo": {
+            "server":  "Foo",
+            "port":    8080,
+            "enabled": true
+        },
+        "Bar": {
+            "server":  "Bar",
+            "port":    8081,
+            "enabled": false
+        }
+    }
+}
+```
+
+</Accordion>
diff --git a/docs/go/develop/cors.md b/docs/go/develop/cors.md
new file mode 100644
index 0000000000..c93501bb9d
--- /dev/null
+++ b/docs/go/develop/cors.md
@@ -0,0 +1,81 @@
+---
+seotitle: Handling CORS (Cross-Origin Resource Sharing)
+seodesc: See how you can configure CORS for your Encore application.
+title: CORS
+subtitle: Configure CORS (Cross-Origin Resource Sharing) for your Encore application
+lang: go
+---
+
+CORS is a web security concept that defines which website origins are allowed to access your API.
+
+A deep-dive into CORS is out of scope for this documentation, but [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+provides a good overview. In short, CORS affects requests made by browsers to resources hosted on
+other origins (a combination of the scheme, domain, and port).
+
+## Configuring CORS
+
+Encore provides a default CORS configuration that is suitable for many APIs. You can override these settings
+by specifying the `global_cors` key in the `encore.app` file, which has the following
+structure:
+
+```cue
+{
+    // debug enables CORS debug logging.
+    "debug": true | false,
+
+    // allow_headers allows an app to specify additional headers that should be
+    // accepted by the app.
+    //
+    // If the list contains "*", then all headers are allowed.
+    "allow_headers": [...string],
+
+    // expose_headers allows an app to specify additional headers that should be
+    // exposed from the app, beyond the default set always recognized by Encore.
+    //
+    // If the list contains "*", then all headers are exposed.
+    "expose_headers": [...string],
+
+    // allow_origins_without_credentials specifies the allowed origins for requests
+    // that don't include credentials. If nil it defaults to allowing all domains
+    // (equivalent to ["*"]).
+    "allow_origins_without_credentials": [...string],
+
+    // allow_origins_with_credentials specifies the allowed origins for requests
+    // that include credentials. If a request is made from an Origin in this list
+    // Encore responds with Access-Control-Allow-Origin: <Origin>.
+    //
+    // The URLs in this list may include wildcards (e.g. "https://*.example.com"
+    // or "https://*-myapp.example.com").
+    "allow_origins_with_credentials": [...string],
+}
+```
+
+## Allowed origins
+
+The main CORS configuration is the list of allowed origins, meaning which websites are allowed
+to access your API (via browsers).
+
+For this purpose, CORS makes a distinction between requests that contain authentication information
+(cookies, HTTP authentication, or client certificates) and those that do not. CORS applies stricter
+rules to authenticated requests.
+
+By default, Encore allows unauthenticated requests from all origins but disallows requests that do
+include authorization information from other origins. This is a good default for many APIs.
+This can be changed by setting the `allow_origins_without_credentials` key (see above).
+For convenience Encore also allows all origins when developing locally.
+
+For security reasons it's necessary to explicitly specify which origins are allowed to make
+authenticated requests. This is done by setting the `allow_origins_with_credentials` key (see above).
+
+## Allowed headers and exposed headers
+
+CORS also lets you specify which headers are allowed to be sent by the client ("allowed headers"),
+and which headers are exposed to scripts running in the browser ("exposed headers").
+
+Encore automatically configures headers by parsing your program using static analysis.
+If your API defines a request or response type that contains a header field, Encore automatically adds the header to
+the list of exposed and allowed headers in request types respectively.
+
+To add additional headers to these lists, you can set the `allow_headers` and `expose_headers` keys (see above).
+This can be useful when your application relies on custom headers in e.g. raw endpoints that aren't seen by Encore's
+static analysis.
diff --git a/docs/go/develop/metadata.md b/docs/go/develop/metadata.md
new file mode 100644
index 0000000000..7dc1dae42a
--- /dev/null
+++ b/docs/go/develop/metadata.md
@@ -0,0 +1,110 @@
+---
+seotitle: Metadata API – Get data about apps, envs, and requests
+seodesc: See how to use Encore's Metadata API to get information about specific apps, environments, and requests.
+title: Metadata
+subtitle: Use the metadata API to get specifics about apps, environments, and requests
+infobox: {
+  title: "Metadata API",
+  import: "encore.dev",
+}
+lang: go
+---
+
+While Encore tries to provide a cloud-agnostic environment, sometimes it's helpful to know more about the environment
+your application is running in. For this reason Encore provides an API for accessing metadata about the
+[application](#application-metadata) and the environment it's running in, as well as information about the
+[current request](#current-request) as part of the `encore.dev` package.
+
+## Application Metadata
+
+Calling `encore.Meta()` will return an [encore.AppMetadata](https://pkg.go.dev/encore.dev/#AppMetadata) instance which
+contains information about the application, including:
+
+ - `AppID` - the application name.
+ - `APIBaseURL` - the URL the application API can be publicly accessed on.
+ - `Environment` - the [environment](/docs/platform/deploy/environments) the application is currently running in.
+ - `Build` - the revision information of the build from the version control system.
+ - `Deploy` - the deployment ID and when this version of the app was deployed.
+
+## Current Request
+
+`encore.CurrentRequest()` can be called from anywhere within your application and will return an
+[encore.Request](https://pkg.go.dev/encore.dev/#Request) instance which will provides information about why the current
+code is running.
+
+The [encore.Request](https://pkg.go.dev/encore.dev/#Request) type contains information about the running request, such as:
+ - The service and endpoint being called
+ - Path and path parameter information
+ - When the request started
+
+This works automatically as a result of Encore's request tracking, and works even in other goroutines that were spawned
+during request handling.  If no request is processed by the caller, which can happen if you call it during service
+initialization, the Type field returns None. If `CurrentRequest()` is called from a goroutine spawned during request
+processing it will continue to report the same request even if the request handler has already returned.
+
+This can be useful on [raw endpoints](/docs/go/primitives/raw-endpoints) with [path parameters](/docs/go/primitives/defining-apis#rest-apis)
+as the standard `http.Request` object passed into the raw endpoint does not provide access to the parsed path parameters,
+however by calling `encore.CurrentRequest().PathParams()` you can get access to the parsed path parameters.
+
+
+## Example Use Cases
+
+### Using Cloud Specific Services
+
+All the [clouds](/docs/platform/deploy/own-cloud) contain a large number of services, not all of which Encore natively supports.
+By using information about the [environment](/docs/platform/deploy/environments), you can define the implementation of these and
+use different services for each environment's provider. For instance if you are pushing audit logs into a data warehouse, when running on GCP you could use BigQuery, but when running on AWS you could use Redshift, when running locally you could
+simply write them to a file.
+
+```go
+package audit
+
+import (
+    "encore.dev"
+    "encore.dev/beta/auth"
+)
+
+func Audit(ctx context.Context, action message, user auth.UID) error {
+    switch encore.Meta().Environment.Cloud {
+    case encore.CloudAWS:
+        return writeIntoRedshift(ctx, action, user)
+    case encore.CloudGCP:
+        return writeIntoBigQuery(ctx, action, user)
+    case encore.CloudLocal:
+        return writeIntoFile(ctx, action, user)
+    default:
+        return fmt.Errorf("unknown cloud: %s", encore.Meta().Environment.Cloud)
+    }
+}
+```
+
+### Checking Environment type
+
+When implementing a signup system, you may want to skip email verification on user signups when developing the application.
+Using the `encore.Meta()` API, we can check the environment and decide whether to send an email or simply mark the user as
+verified upon signup.
+
+```go
+package user
+
+import "encore.dev"
+
+//encore:api public
+func Signup(ctx context.Context, params *SignupParams) (*SignupResponse, error) {
+    // ...
+
+    // If this is a testing environment, skip sending the verification email
+    switch encore.Meta().Environment.Type {
+    case encore.EnvTest, encore.EnvDevelopment:
+        if err := MarkEmailVerified(ctx, userID); err != nil {
+            return nil, err
+        }
+    default:
+        if err := SendVerificationEmail(ctx, userID); err != nil {
+            return nil, err
+        }
+    }
+
+    // ...
+}
+```
diff --git a/docs/go/develop/middleware.md b/docs/go/develop/middleware.md
new file mode 100644
index 0000000000..efd60ee4c6
--- /dev/null
+++ b/docs/go/develop/middleware.md
@@ -0,0 +1,141 @@
+---
+seotitle: Using Middleware in your backend application
+seodesc: See how you can use middleware in your backend application to handle cross-cutting generic functionality, like request logging, auth, or tracing.
+title: Middleware
+subtitle: Handling cross-cutting, generic functionality
+infobox: {
+  title: "Middleawre",
+  import: "encore.dev/middleware",
+}
+lang: go
+---
+
+Middleware is a way to write reusable code that runs before or after (or both)
+the handling of API requests, often across several (or all) API endpoints.
+
+It's commonly used to implement cross-cutting concerns like
+[request logging](/docs/go/observability/logging),
+[authentication](/docs/go/develop/auth),
+[tracing](/docs/go/observability/tracing),
+and so on. One of the benefits of Encore is that
+all of these use cases are already handled out-of-the-box, so there's no
+need to use middleware for those things.
+
+Nonetheless, there are several use cases where it can be useful to write
+reusable functionality that applies to multiple API endpoints, and middleware
+is a good solution in those cases.
+
+Encore provides built-in support for middleware by defining a function with the
+`//encore:middleware` directive. The middleware directive takes a `target`
+parameter that specifies which API endpoints it applies to.
+
+## Middleware functions
+
+A typical middleware implementation looks like this:
+
+```go
+import (
+    "encore.dev/beta/errs"
+    "encore.dev/middleware"
+)
+
+//encore:middleware global target=all
+func ValidationMiddleware(req middleware.Request, next middleware.Next) middleware.Response {
+    // If the payload has a Validate method, use it to validate the request.
+    payload := req.Data().Payload
+    if validator, ok := payload.(interface { Validate() error }); ok {
+        if err := validator.Validate(); err != nil {
+            // If the validation fails, return an InvalidArgument error.
+            err = errs.WrapCode(err, errs.InvalidArgument, "validation failed")
+            return middleware.Response{Err: err}
+        }
+    }
+    return next(req)
+}
+```
+
+Middleware forms a chain, allowing each middleware to introspect and process
+the incoming request before handing it off to the next middleware by calling the
+`next` function that's passed in as an argument. For the last middleware in the
+chain, calling `next` results in the actual API handler being called.
+
+The `req` parameter provides information about the incoming request
+(see [package docs](https://pkg.go.dev/encore.dev/middleware#Request)).
+
+The `next` function returns a [`middleware.Response`](https://pkg.go.dev/encore.dev/middleware#Response)
+object which contains the response from the API, describing whether there was an error, and on success
+the actual response payload.
+
+This enables middleware to also introspect and even
+modify the outgoing response, like this:
+
+```go
+//encore:middleware target=tag:cache
+func CachingMiddleware(req middleware.Request, next middleware.Next) middleware.Response {
+    data := req.Data()
+    // Check if we have the response cached. Use the request path as the cache key.
+    cacheKey := data.Path
+	if cached, err := loadFromCache(cacheKey, data.API.ResponseType); err == nil && cached != nil {
+	    return middleware.Response{Payload: cached}
+    }
+	// Otherwise forward the request to the handler
+	return next(req)
+}
+```
+
+This uses `target=tag:cache` to have the middleware only apply to APIs that have
+that tag. More on this below in [Targeting APIs](#targeting-apis).
+
+<Callout type="important">
+
+Middleware functions can also be defined as methods on a Dependency Injection
+struct declared with `//encore:service`. For example:
+
+```go
+//encore:service
+type Service struct{}
+
+//encore:middleware target=all
+func (s *Service) MyMiddleware(req middleware.Request, next middleware.Next) middleware.Response {
+	// ...
+}
+```
+
+See the [Dependency Injection](/docs/go/how-to/dependency-injection) docs for more information.
+
+</Callout>
+
+## Middleware ordering
+
+Middleware can either be defined inside a service, in which case it only runs
+for APIs within that service, or it can be defined as a `global` middleware,
+in which case it applies to all services. For global middleware the `target`
+directive still applies and enables you to easily match a subset of APIs.
+
+<Callout type="important">
+
+Global middleware always run before all service-specific middleware,
+and then run in the order they are defined in the source code based on
+file name lexicographic ordering.
+
+</Callout>
+
+To avoid surprises it's best to define all middleware in a file called
+`middleware.go` in each service, and to create a single top-level package
+to contain all global middleware.
+
+## Targeting APIs
+
+The `target` directive can either be provided as `target=all` (meaning it applies
+to all APIs) or a list of tags, in the form `target=tag:foo,tag:bar`. Note that
+these tags are evaluated with `OR`, meaning the middleware applies to an API if
+the API has at least one of those tags.
+
+APIs can be defined with tags by adding `tag:foo` at the end of the `//encore:api` directive:
+
+```go
+//encore:api public method=GET path=/user/:id tag:cache
+func GetUser(ctx context.Context, id string) (*User, error) {
+	// ...
+}
+```
diff --git a/docs/go/develop/mocking.md b/docs/go/develop/mocking.md
new file mode 100644
index 0000000000..73687dc1c8
--- /dev/null
+++ b/docs/go/develop/mocking.md
@@ -0,0 +1,147 @@
+---
+seotitle: Mocking out your APIs and services for testing
+seodesc: Learn how to mock out your APIs and services for testing, and how to use the built-in mocking support in Encore.
+title: Mocking
+subtitle: Testing your application in isolation
+infobox: {
+  title: "Testing",
+  import: "encore.dev/et",
+}
+lang: go
+---
+
+Encore comes with built-in support for mocking out APIs and services, which makes it easier to test your application in
+isolation.
+
+## Mocking Endpoints
+
+Let's say you have an endpoint that calls an external API in our `products` service:
+
+```go
+//encore:api private
+func GetPrice(ctx context.Context, p *PriceParams) (*PriceResponse, error) {
+    // Call external API to get the price
+}
+```
+
+When testing this function, you don't want to call the real external API since that would be slow and cause your tests
+to fail if the API is down. Instead, you want to mock out the API call and return a fake response.
+
+In Encore, you can do this by adding a mock implementation of the endpoint using the `et.MockEndpoint` function inside your test:
+
+```go
+package shoppingcart
+
+import (
+	"context"
+	"testing"
+	
+	"encore.dev/et" // Encore's test support package
+	
+	"your_app/products"
+)
+
+
+func Test_Something(t *testing.T) {
+	t.Parallel() // Run this test in parallel with other tests without the mock implementation interfering
+	
+	// Create a mock implementation of pricing API which will only impact this test and any sub-tests
+	et.MockEndpoint(products.GetPrice, func(ctx context.Context, p *products.PriceParams) (*products.PriceResponse, error) {
+		return &products.PriceResponse{Price: 100}, nil
+	})
+	
+	// ... the rest of your test code here ...
+} 
+```
+
+When any code within the test, or any sub-test calls the `GetPrice` API, the mock implementation will be called instead.
+The mock will not impact any other tests running in parallel. The function you pass to `et.MockEndpoint` must have the same
+signature as the real endpoint.
+
+If you want to mock out the API for all tests in the package, you can add the mock implementation to the `TestMain` function:
+
+```go
+package shoppingcart
+
+import (
+	"context"
+	"os"
+    "testing"
+    
+    "encore.dev/et"
+	
+	"your_app/products"
+)
+
+func TestMain(m *testing.M) {
+    // Create a mock implementation of pricing API which will impact all tests within this package
+    et.MockEndpoint(products.GetPrice, func(ctx context.Context, p *products.PriceParams) (*products.PriceResponse, error) {
+        return &products.PriceResponse{Price: 100}, nil
+    })
+    
+    // Now run the tests
+    os.Exit(m.Run())
+}
+```
+
+Mocks can be changed at any time, including removing them by setting the mock implementation to `nil`.
+
+## Mocking services
+
+As well as mocking individual APIs, you can also mock entire services. This can be useful if you want to inject a different
+set of dependencies into your service for testing, or a service that your code depends on. This can be done using the
+`et.MockService` function:
+
+```go
+package shoppingcart
+
+import (
+    "context"
+    "testing"
+    
+    "encore.dev/et" // Encore's test support package
+    
+    "your_app/products"
+)
+
+func Test_Something(t *testing.T) {
+    t.Parallel() // Run this test in parallel with other tests without the mock implementation interfering
+    
+    // Create a instance of the products service which will only impact this test and any sub-tests
+    et.MockService("products", &products.Service{
+		SomeField: "a testing value",
+	})
+    
+    // ... the rest of your test code here ...
+}
+```
+
+When any code within the test, or any sub-test calls the `products` service, the mock implementation will be called instead.
+Unlike `et.MockEndpoint`, the mock implementation does not need to have the same signature, and can be any object. The only requirement
+is that any of the services APIs that are called during the test must be implemented by as a receiver method on the mock object.
+(This also includes APIs that are defined as package level functions in the service, and are not necessarily defined as receiver methods
+on that services struct).
+
+To help with compile time safety on service mocking, for every service Encore will automatically generate an `Interface` interface
+which contains all the APIs defined in the service. This interface can be passed as a generic argument to `et.MockService` to ensure
+that the mock object implements all the APIs defined in the service:
+
+```go
+type myMockObject struct{}
+
+func (m *myMockObject) GetPrice(ctx context.Context, p *products.PriceParams) (*products.PriceResponse, error) {
+    return &products.PriceResponse{Price: 100}, nil
+}
+
+func Test_Something(t *testing.T) {
+    t.Parallel() // Run this test in parallel with other tests without the mock implementation interfering
+    
+    // This will cause a compile time error if myMockObject does not implement all the APIs defined in the products service
+    et.MockService[products.Interface]("products", &myMockObject{})
+}
+```
+
+### Automatic generation of mock objects
+
+Thanks to the generated `Interface` interface, it's possible to automatically generate mock objects for your services using
+either [Mockery](https://vektra.github.io/mockery/latest/) or [GoMock](https://github.com/uber-go/mock).
diff --git a/docs/go/develop/testing.md b/docs/go/develop/testing.md
new file mode 100644
index 0000000000..d65a14a653
--- /dev/null
+++ b/docs/go/develop/testing.md
@@ -0,0 +1,100 @@
+---
+seotitle: Automated testing for your backend application
+seodesc: Learn how create automated tests for your microservices backend application, and run them automatically on deploy using Go and Encore.
+title: Automated testing
+subtitle: Confidence at speed
+infobox: {
+  title: "Testing",
+  import: "encore.dev/et",
+}
+lang: go
+---
+
+Go comes with excellent built-in support for automated tests.
+Encore builds on top of this foundation, and lets you write tests in exactly the same way.
+We won't cover the basics of how to write tests here, see [the official Go docs](https://golang.org/pkg/testing/) for that.
+Let's instead focus on the difference between testing in Encore compared to a standard Go application.
+
+The main difference is that since Encore requires an extra compilation step,
+you must run your tests using `encore test` instead of `go test`. This is
+a wrapper that compiles the Encore app and then runs `go test`. It supports
+all the same flags that the `go test` command does.
+
+For example, use `encore test ./...` to run tests in all sub-directories,
+or just `encore test` for the current directory.
+
+## Test tracing
+
+Encore comes with built-in test tracing for local development.
+
+You only need to open Encore's local development dashboard at [localhost:9400](http://localhost:9400) to see traces for all your tests.
+This makes it very simple to understand the root cause for why a test is failing.
+
+<img className="w-full d:w-3/4 h-auto" src="/assets/docs/test_trace.png" title="Test tracing" />
+
+
+## Integration testing
+
+Since Encore removes almost all boilerplate, most of the code you write
+is business logic that involves databases and calling APIs between services.
+Such behavior is most easily tested with integration tests.
+
+When running tests, Encore automatically sets up the databases you need
+in a separate database cluster. They are additionally configured to skip `fsync`
+and to use an in-memory filesystem since durability is not a concern for automated tests.
+
+This drastically reduces the speed overhead of writing integration tests.
+
+In general, Encore applications tend to focus more on integration tests
+compared to traditional applications that are heavier on unit tests.
+This is nothing to worry about and is the recommended best practice.
+
+### Temporary databases
+
+When Encore runs tests, by default it reuses the same database for all tests,
+to improve performance. However, this means that you need to take care when writing tests
+to ensure tests don't interfere with each other.
+
+If you instead want to have a separate database for a given test, you can use
+[`et.NewTestDatabase`](https://pkg.go.dev/encore.dev/et#NewTestDatabase) to create a temporary database
+that only exists for the duration of the test.
+
+The temporary test database is a fully-migrated database. It does not include any data written by other tests.
+
+<Callout type="info">
+
+Under the hood, when you start running tests, Encore sets up a fresh "template database" and runs the database migrations
+against that database. When you later call `et.NewTestDatabase`, Encore creates a new database by cloning the template database.
+
+</Callout>
+
+### Service Structs
+
+In tests, [service structs](/docs/go/primitives/service-structs) are initialized on demand when the first
+API call is made to that service and then that instance of the service struct for all future tests. This means your tests
+can run faster as they don't have to each initialize all the service struct's each time a new test starts.
+
+However, in some situations you might be storing state in the service struct that would interfere with other tests. When
+you have a test you want to have its own instance of the service struct, you can use the `et.EnableServiceInstanceIsolation()` function within the test to enable this for just that test, while the rest of your tests will continue to use the shared instance.
+
+## Test-only infrastructure
+
+Encore allows tests to define infrastructure resources specifically for testing.
+This can be useful for testing library code that interacts with infrastructure.
+
+For example, the [x.encore.dev/pubsub/outbox](https://pkg.go.dev/x.encore.dev/infra/pubsub/outbox) package
+defines a test-only database that is used to do integration testing of the outbox functionality.
+
+## Testing from your IDE
+
+### GoLand / IntelliJ
+
+Encore has an officially supported plugin [available in the JetBrains marketplace](https://plugins.jetbrains.com/plugin/20010-encore).
+
+It lets you run unit tests directly from within your IDE with support for debug mode and breakpoints.
+
+### Visual Studio Code (VS Code)
+
+There's no official VS Code plugin available yet, but we are happy to include your contribution if you  build one. Reach out on [Discord](/discord) if you need help to get started.
+
+For advice on debugging when using VS Code, see the [Debugging docs](/docs/go/how-to/debug).
diff --git a/docs/go/develop/validation.md b/docs/go/develop/validation.md
new file mode 100644
index 0000000000..36885359a3
--- /dev/null
+++ b/docs/go/develop/validation.md
@@ -0,0 +1,26 @@
+---
+seotitle: Request validation in your backend application
+seodesc: Learn how request validation works, and see how you can use Encore's built-in middleware to validate incoming requests in your backend application.
+title: Validation
+subtitle: Making sure everything's right in the world
+lang: go
+---
+
+When receiving incoming requests it's best practice to validate the
+payload to make sure it meets your expectations, contains all the necessary
+fields, and so on.
+
+Encore provides an out-of-the-box middleware that automatically validates
+incoming requests if the request type implements the method `Validate() error`.
+
+If it does, Encore will call this method after deserializing the request payload,
+and only call your API handler (and other middleware) if the validation function
+returns `nil`.
+
+If the validation function returns an [`*errs.Error`](/docs/go/primitives/api-errors) that error
+is reported unmodified to the caller. Other errors are converted to an `*errs.Error`
+with code `InvalidArgument`, which results in a HTTP response with status code `400 Bad Request`.
+
+This design means that it's easy to use your validation library of choice.
+In the future we're looking to provide an out-of-the-box validation library
+for an even better developer experience.
diff --git a/docs/go/faq.md b/docs/go/faq.md
new file mode 100644
index 0000000000..9f346a52bb
--- /dev/null
+++ b/docs/go/faq.md
@@ -0,0 +1,61 @@
+---
+seotitle: Frequently Asked Questions
+seodesc: See quick answers to common questions about Encore
+title: FAQ
+subtitle: Quick answers to common questions
+lang: go
+---
+
+## About the project
+
+**Is Encore Open Source?**
+
+Yes, check out the project on [GitHub](https://github.com/encoredev/encore).
+
+**Is there a community?**
+
+Yes, you're welcome to join the developer community on [Discord](https://encore.dev/discord).
+
+## Can I use X with Encore?
+
+**Can I use Python with Encore?**
+
+Encore currently supports Go and TypeScript. Python support in on the [roadmap](https://encore.dev/roadmap) and will be available around Q1 2025.
+
+**Can mix TypeScript and Go in one application?**
+
+Support for mixing languages in coming. Currently, if you want to use both TypeScript and Go, you need to create a separate application per language and integrate using APIs.
+
+**Can I use Azure / Digital Ocean?**
+
+Encore Cloud currently supports automating deployments to AWS and GCP. Azure support in on the [roadmap](https://encore.dev/roadmap) and will be available in 2025.
+
+If you want to use other cloud providers like Azure or Digital Ocean, you can follow the [self-hosting instructions](/docs/go/self-host/docker-build).
+
+**Can I use MongoDB / MySQL with Encore?**
+
+Encore currently has built-in support for PostgreSQL. To use another type of database, like MongoDB and MySQL, you will need to set it up and integrate as you normally would when not using Encore.
+
+**Can I use AWS lambda with Encore?**
+
+Not right now. Encore currently supports AWS Fargate and EKS (along with CloudRun and GKE on Google Cloud Platform).
+
+## IDE Integrations
+
+**Is there an Encore plugin for Goland / IntelliJ?**
+
+Yes, Encore's official Goland plugin is available in the [JetBrains marketplace](https://plugins.jetbrains.com/plugin/20010-encore).
+
+**Is there an Encore plugin for VS Code?**
+
+Not yet, it's coming soon.
+
+## Troubleshooting
+
+**symlink creation error on Windows**
+
+Encore currently relies on symbolic links, which may be disabled by default. A common fix for this issue is to enable "developer mode" in the Windows settings (Settings > System > For developers > Developer mode).
+
+**`node` errors**
+
+You might need to restart the Encore daemon, e.g. if your PATH has changed since installing nvm. Restart the daemon by running `encore daemon`.
diff --git a/docs/go/how-to/assets/logto-api-resource.png b/docs/go/how-to/assets/logto-api-resource.png
new file mode 100644
index 0000000000..60aa6b98d1
Binary files /dev/null and b/docs/go/how-to/assets/logto-api-resource.png differ
diff --git a/docs/go/how-to/assets/logto-application-endpoints.png b/docs/go/how-to/assets/logto-application-endpoints.png
new file mode 100644
index 0000000000..85185a1b57
Binary files /dev/null and b/docs/go/how-to/assets/logto-application-endpoints.png differ
diff --git a/docs/go/how-to/atlas-gorm.md b/docs/go/how-to/atlas-gorm.md
new file mode 100644
index 0000000000..4eb400fbb4
--- /dev/null
+++ b/docs/go/how-to/atlas-gorm.md
@@ -0,0 +1,161 @@
+---
+seotitle: How to use Atlas + GORM for database migrations with Encore
+seodesc: See how you can use Atlas to manage your database migrations in your Encore application.
+title: Use Atlas + GORM for database migrations
+lang: go
+---
+
+[Atlas](https://atlasgo.io) is a popular tool for managing database migrations.
+[GORM](https://gorm.io/) is a popular ORM for Go.
+
+Encore provides excellent support for using them together to easily manage database schemas and migrations.
+Encore executes database migrations using [golang-migrate](https://github.com/golang-migrate/migrate),
+which Atlas supports out-of-the-box. This means that you can use Atlas to manage your Encore database migrations.
+
+The easiest way to use Atlas + GORM together is with Atlas's support for [external schemas](https://atlasgo.io/blog/2023/06/28/external-schemas-and-gorm-support).
+
+## Setting up GORM
+
+To set up your Encore application with GORM, start by installing the GORM package and associated Postgres driver:
+
+```shell
+go get -u gorm.io/gorm gorm.io/driver/postgres
+```
+
+Then, in the service that you want to use GORM for, add the `*gorm.DB` as a dependency
+in your service struct (create a service struct if you don't already have one).
+
+For example, if you had a service called `blog`:
+
+```go
+-- blog/blog.go --
+package blog
+
+import (
+	"encore.dev/storage/sqldb"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+)
+
+
+//encore:service
+type Service struct {
+	db *gorm.DB
+}
+
+var blogDB = sqldb.NewDatabase("blog", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+
+// initService initializes the site service.
+// It is automatically called by Encore on service startup.
+func initService() (*Service, error) {
+	db, err := gorm.Open(postgres.New(postgres.Config{
+		Conn: blogDB.Stdlib(),
+	}))
+	if err != nil {
+		return nil, err
+	}
+	return &Service{db: db}, nil
+}
+```
+
+Finally, create the `migrations` directory inside the `blog` directory if it doesn't already exist.
+This is where Atlas will put your database migrations.
+
+## Setting up Atlas
+
+First [install Atlas](https://atlasgo.io/getting-started).
+
+Then, add an `atlas.hcl` file inside the `blog` directory:
+
+```
+-- blog/atlas.hcl --
+data "external_schema" "gorm" {
+  program = ["env", "ENCORERUNTIME_NOPANIC=1", "go", "run", "./scripts/atlas-gorm-loader.go"]
+}
+
+env "local" {
+  src = data.external_schema.gorm.url
+
+  migration {
+    dir = "file://migrations"
+    format = golang-migrate
+  }
+
+  format {
+    migrate {
+      diff = "{{ sql . \"  \" }}"
+    }
+  }
+}
+```
+
+Next, we need to create the `atlas-gorm-loader` script referenced above.
+It will use the [atlas-provider-gorm](https://github.com/ariga/atlas-provider-gorm) library provided by Atlas.
+
+Create the file as follows:
+
+```
+-- blog/scripts/atlas-gorm-loader.go --
+package main
+
+import (
+    "fmt"
+    "io"
+    "os"
+
+    _ "ariga.io/atlas-go-sdk/recordriver"
+    "ariga.io/atlas-provider-gorm/gormschema"
+    "encore.app/blog"
+)
+
+// Define the models to generate migrations for.
+var models = []any{
+    &blog.Post{},
+    &blog.Comment{},
+}
+
+func main() {
+    stmts, err := gormschema.New("postgres").Load(models...)
+    if err != nil {
+        fmt.Fprintf(os.Stderr, "failed to load gorm schema: %v\n", err)
+        os.Exit(1)
+    }
+    io.WriteString(os.Stdout, stmts)
+}
+```
+
+## Creating migrations
+
+To wrap things up, let's create a script to automate the process of generating migrations:
+
+```
+-- blog/scripts/generate-migration --
+#!/bin/bash
+set -eu
+DB_NAME=blog
+MIGRATION_NAME=${1:-}
+
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+# Reset the shadow database
+encore db reset --shadow $DB_NAME
+
+# GORM executes Go code without initializing Encore when generating migrations,
+# so configure the Encore runtime to be aware that this is expected.
+export ENCORERUNTIME_NOPANIC=1
+
+# Generate the migration
+atlas migrate diff $MIGRATION_NAME --env local --dev-url "$(encore db conn-uri --shadow $DB_NAME)&search_path=public"
+```
+
+Finally let's make the script executable, and generate our first migration:
+
+```shell
+$ chmod +x blog/scripts/generate-migration
+$ cd blog && ./scripts/generate-migration init
+```
+
+This will generate a new migration file in the `blog/migrations` directory, which
+will be automatically applied when running `encore run`.
diff --git a/docs/go/how-to/auth0-auth.md b/docs/go/how-to/auth0-auth.md
new file mode 100644
index 0000000000..654a8e82b3
--- /dev/null
+++ b/docs/go/how-to/auth0-auth.md
@@ -0,0 +1,620 @@
+---
+seotitle: How to use Auth0 for your backend application
+seodesc: Learn how to use Auth0 for user authentication in your backend application. In this guide we show you how to integrate your Go backend with Auth0.
+title: Use Auth0 with your app
+lang: go
+---
+
+In this guide you will learn how to set up an Encore [auth handler](/docs/go/develop/auth#the-auth-handler) that makes use of
+[Auth0](https://auth0.com/) in order to add a seamless signup and login experience to your web app.
+
+For all the code and instructions of how to clone and run this example locally, see the [Auth0 Example](https://github.com/encoredev/examples/tree/main/auth0) in our examples repo.
+
+## Communicate with Auth0
+
+In your Encore app, install two modules:
+
+```shell
+$ go get github.com/coreos/go-oidc/v3/oidc golang.org/x/oauth2
+```
+
+Create a folder and naming it `auth`, this is where our authentication related backend code will live.
+
+Next, let's set up the Auth0 `Authenticator` that will be used by our auth handler. The `Authenticator` has a method to configure and return [OAuth2](https://pkg.go.dev/golang.org/x/oauth2?utm_source=godoc) and [oidc](https://pkg.go.dev/github.com/coreos/go-oidc?utm_source=godoc) clients, and another one to verify an ID Token. 
+
+Create `auth/authenticator.go` and paste the following:
+
+```go
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+	"encore.dev/config"
+	"errors"
+	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+)
+
+type Auth0Config struct {
+	ClientID    config.String
+	Domain      config.String
+	CallbackURL config.String
+	LogoutURL   config.String
+}
+
+var cfg = config.Load[*Auth0Config]()
+
+var secrets struct {
+	Auth0ClientSecret string
+}
+
+// Authenticator is used to authenticate our users.
+type Authenticator struct {
+	*oidc.Provider
+	oauth2.Config
+}
+
+// New instantiates the *Authenticator.
+func New() (*Authenticator, error) {
+	provider, err := oidc.NewProvider(
+		context.Background(),
+		"https://"+cfg.Domain()+"/",
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	conf := oauth2.Config{
+		ClientID:     cfg.ClientID(),
+		ClientSecret: secrets.Auth0ClientSecret,
+		RedirectURL:  cfg.CallbackURL(),
+		Endpoint:     provider.Endpoint(),
+		Scopes:       []string{oidc.ScopeOpenID, "profile", "email"},
+	}
+
+	return &Authenticator{
+		Provider: provider,
+		Config:   conf,
+	}, nil
+}
+
+// VerifyIDToken verifies that an *oauth2.Token is a valid *oidc.IDToken.
+func (a *Authenticator) VerifyIDToken(ctx context.Context, token *oauth2.Token) (*oidc.IDToken, error) {
+	rawIDToken, ok := token.Extra("id_token").(string)
+	if !ok {
+		return nil, errors.New("no id_token field in oauth2 token")
+	}
+
+	oidcConfig := &oidc.Config{
+		ClientID: a.ClientID,
+	}
+
+	return a.Verifier(oidcConfig).Verify(ctx, rawIDToken)
+}
+
+func generateRandomState() (string, error) {
+	b := make([]byte, 32)
+	_, err := rand.Read(b)
+	if err != nil {
+		return "", err
+	}
+
+	state := base64.StdEncoding.EncodeToString(b)
+
+	return state, nil
+}
+```
+
+## Set up the auth handler
+
+It's time to define your [auth handler](/docs/go/develop/auth) and the endpoints needed for the login and logout flow.
+
+Create the `auth/auth.go` file and paste the following:
+
+```go
+package auth
+
+import (
+	"context"
+	"net/url"
+
+	"encore.dev/beta/auth"
+	"encore.dev/beta/errs"
+	"github.com/coreos/go-oidc/v3/oidc"
+)
+
+// Service struct definition.
+// Learn more: encore.dev/docs/primitives/services-and-apis/service-structs
+//
+//encore:service
+type Service struct {
+	auth *Authenticator
+}
+
+// initService is automatically called by Encore when the service starts up.
+func initService() (*Service, error) {
+	authenticator, err := New()
+	if err != nil {
+		return nil, err
+	}
+	return &Service{auth: authenticator}, nil
+}
+
+type LoginResponse struct {
+	State       string `json:"state"`
+	AuthCodeURL string `json:"auth_code_url"`
+}
+
+//encore:api public method=POST path=/auth/login
+func (s *Service) Login(ctx context.Context) (*LoginResponse, error) {
+	state, err := generateRandomState()
+	if err != nil {
+		return nil, &errs.Error{
+			Code:    errs.Internal,
+			Message: err.Error(),
+		}
+	}
+
+	return &LoginResponse{
+		State: state,
+		// add the audience to the auth code url
+		AuthCodeURL: s.auth.AuthCodeURL(state),
+	}, nil
+}
+
+type CallbackRequest struct {
+	Code string `json:"code"`
+}
+
+type CallbackResponse struct {
+	Token string `json:"token"`
+}
+
+//encore:api public method=POST path=/auth/callback
+func (s *Service) Callback(
+	ctx context.Context,
+	req *CallbackRequest,
+) (*CallbackResponse, error) {
+
+	// Exchange an authorization code for a token.
+	token, err := s.auth.Exchange(ctx, req.Code)
+	if err != nil {
+		return nil, &errs.Error{
+			Code:    errs.PermissionDenied,
+			Message: "Failed to convert an authorization code into a token.",
+		}
+	}
+
+	idToken, err := s.auth.VerifyIDToken(ctx, token)
+	if err != nil {
+		return nil, &errs.Error{
+			Code:    errs.Internal,
+			Message: "Failed to verify ID Token.",
+		}
+	}
+
+	var profile map[string]interface{}
+	if err := idToken.Claims(&profile); err != nil {
+		return nil, &errs.Error{
+			Code:    errs.Internal,
+			Message: err.Error(),
+		}
+	}
+
+	return &CallbackResponse{
+		Token: token.Extra("id_token").(string),
+	}, nil
+}
+
+type LogoutResponse struct {
+	RedirectURL string `json:"redirect_url"`
+}
+
+//encore:api public method=GET path=/auth/logout
+func (s *Service) Logout(ctx context.Context) (*LogoutResponse, error) {
+	logoutUrl, err := url.Parse("https://" + cfg.Domain() + "/v2/logout")
+	if err != nil {
+		return nil, &errs.Error{
+			Code:    errs.Internal,
+			Message: err.Error(),
+		}
+	}
+
+	returnTo, err := url.Parse(cfg.LogoutURL())
+	if err != nil {
+		return nil, &errs.Error{
+			Code:    errs.Internal,
+			Message: err.Error(),
+		}
+	}
+
+	parameters := url.Values{}
+	parameters.Add("returnTo", returnTo.String())
+	parameters.Add("client_id", cfg.ClientID())
+	logoutUrl.RawQuery = parameters.Encode()
+
+	return &LogoutResponse{
+		RedirectURL: logoutUrl.String(),
+	}, nil
+}
+
+type ProfileData struct {
+	Email   string `json:"email"`
+	Picture string `json:"picture"`
+}
+
+// The `encore:authhandler` annotation tells Encore to run this function for all 
+// incoming API call that requires authentication.
+// Learn more: encore.dev/docs/develop/auth#the-auth-handler
+//
+//encore:authhandler
+func (s *Service) AuthHandler(
+	ctx context.Context,
+	token string,
+) (auth.UID, *ProfileData, error) {
+	oidcConfig := &oidc.Config{
+		ClientID: s.auth.ClientID,
+	}
+
+	t, err := s.auth.Verifier(oidcConfig).Verify(ctx, token)
+	if err != nil {
+		return "", nil, &errs.Error{
+			Code:    errs.Unauthenticated,
+			Message: "invalid token",
+		}
+	}
+
+	var profile map[string]interface{}
+	if err := t.Claims(&profile); err != nil {
+		return "", nil, &errs.Error{
+			Code:    errs.Internal,
+			Message: err.Error(),
+		}
+	}
+
+	// Extract profile data returned from the identity provider.
+	// auth0.com/docs/manage-users/user-accounts/user-profiles/user-profile-structure
+	profileData := &ProfileData{
+		Email:   profile["email"].(string),
+		Picture: profile["picture"].(string),
+	}
+
+	return auth.UID(profile["sub"].(string)), profileData, nil
+}
+
+// Endpoints annotated with `auth` are public and requires authentication
+// Learn more: encore.dev/docs/primitives/apis#access-controls
+//
+//encore:api auth method=GET path=/profile
+func GetProfile(ctx context.Context) (*ProfileData, error) {
+	return auth.Data().(*ProfileData), nil
+}
+```
+
+## Auth0 settings
+
+The `Authenticator` class requires some values that are specific your Auth0 application, namely the `ClientID`, `ClientSecret`, `Domain`, `CallbackURL` and `LogoutURL`.
+
+Create an Auth0 account if you haven't already. Then, in the Auth0 dashboard, create a new *Single Page Web Applications*.
+
+<img src="/assets/docs/auth0-create-app.png" title="Create Auth0 application"/>
+
+Next, go to the *Application Settings* section. There you will find the `Domain`, `Client ID`, and `Client Secret` that you need to communicate with Auth0. 
+Copy these values, we will need them shortly.
+
+<img src="/assets/docs/auth0-basic-info.png" title="Auth0 basic information"/>
+
+A callback URL is where Auth0 redirects the user after they have been authenticated. 
+Add `http://localhost:3000/callback` to the *Allowed Callback URLs*. 
+You will need to add more URLs to this list when you have a production or staging environments. 
+
+The same goes for the logout URL (were the user will get redirected after logout). Add `http://localhost:3000/` to the *Allowed Logout URLs*. 
+
+<img src="/assets/docs/auth0-app-uris.png" title="Auth0 application URIs"/>
+
+
+## Config and secrets
+
+Create a [configuration file](/docs/go/develop/config) in the `auth` service and name it `auth-config.cue`. Add the following:
+
+```cue
+ClientID: "<your client_id from above>"
+Domain: "<your domain from above>"
+
+// An application running locally
+if #Meta.Environment.Type == "development" && #Meta.Environment.Cloud == "local" {
+	CallbackURL: "http://localhost:3000/callback"
+	LogoutURL: "http://localhost:3000/"
+}
+```
+
+Replace the values for the `ClientID` and `Domain` that you got from the Auth0 dashboard.
+
+The `ClientSecret` is especially sensitive and should not be hardcoded in your code/config. Instead, you should store that as an [Encore secret](/docs/go/primitives/secrets).
+
+From your terminal (inside your Encore app directory), run:
+
+```shell
+$ encore secret set --prod Auth0ClientSecret
+```
+
+Now you should do the same for the development secret. The most secure way is to set up a different Auth0 application and use that for development.
+Depending on your security requirements you could also use the same secret for development and production.
+
+Once you have a client secret for development, set it similarly to before:
+
+```shell
+$ encore secret set --dev Auth0ClientSecret
+```
+
+That's it! Encore will run your auth handler and validate the token against Auth0.
+
+## Frontend
+
+Now that the backend is set up, we can create a frontend application that uses the login flow.
+
+Here's an example using [React](https://react.dev/) together with [React Router](https://reactrouter.com/). This example 
+also makes use of a Encores ability to [generate request clients](/docs/go/cli/client-generation) to make the communication 
+with our backend simple and typesafe.
+
+```tsx
+-- App.tsx --
+import { PropsWithChildren } from "react";
+import {
+  createBrowserRouter,
+  Link,
+  Outlet,
+  redirect,
+  RouterProvider,
+  useRouteError,
+} from "react-router-dom";
+import { Auth0Provider } from "./lib/auth";
+import AdminDashboard from "./components/AdminDashboard.tsx";
+
+import IndexPage from "./components/IndexPage.tsx";
+import "./App.css";
+import LoginStatus from "./components/LoginStatus.tsx";
+
+// Application routes
+const router = createBrowserRouter([
+  {
+    id: "root",
+    path: "/",
+    Component: Layout,
+    errorElement: (
+      <Layout>
+        <ErrorBoundary />
+      </Layout>
+    ),
+    children: [
+      {
+        Component: Outlet,
+        children: [
+          {
+            index: true,
+            Component: IndexPage,
+          },
+          {
+            // Login route
+            path: "login",
+            loader: async ({ request }) => {
+              const url = new URL(request.url);
+              const searchParams = new URLSearchParams(url.search);
+              const returnToURL = searchParams.get("returnTo") ?? "/";
+
+              if (Auth0Provider.isAuthenticated()) return redirect(returnToURL);
+
+              try {
+                const returnURL = await Auth0Provider.login(returnToURL);
+                return redirect(returnURL);
+              } catch (error) {
+                throw new Error("Login failed");
+              }
+            },
+          },
+          {
+            // Callback route, redirected to from Auth0 after login
+            path: "callback",
+            loader: async ({ request }) => {
+              const url = new URL(request.url);
+              const searchParams = new URLSearchParams(url.search);
+              const state = searchParams.get("state");
+              const code = searchParams.get("code");
+
+              if (!state || !code) throw new Error("Login failed");
+
+              try {
+                const redirectURL = await Auth0Provider.validate(state, code);
+                return redirect(redirectURL);
+              } catch (error) {
+                throw new Error("Login failed");
+              }
+            },
+          },
+          {
+            // Logout route
+            path: "logout",
+            loader: async () => {
+              try {
+                const redirectURL = await Auth0Provider.logout();
+                return redirect(redirectURL);
+              } catch (error) {
+                throw new Error("Logout failed");
+              }
+            },
+          },
+          {
+            element: <Outlet />,
+            // Redirect to /login if not authenticated
+            loader: async ({ request }) => {
+              if (!Auth0Provider.isAuthenticated()) {
+                const params = new URLSearchParams();
+                params.set("returnTo", new URL(request.url).pathname);
+                return redirect("/login?" + params.toString());
+              }
+              return null;
+            },
+            // Protected routes
+            children: [
+              {
+                path: "admin-dashboard",
+                Component: AdminDashboard,
+              },
+            ],
+          },
+        ],
+      },
+    ],
+  },
+]);
+
+export default function App() {
+  return <RouterProvider router={router} fallbackElement={<p>Loading...</p>} />;
+}
+
+function Layout({ children }: PropsWithChildren) {
+  return (
+    <div>
+      <header>
+        <nav className="nav">
+          <div className="navLinks">
+            <Link to="/">Home</Link>
+            <Link to="/admin-dashboard">Admin Dashboard</Link>
+          </div>
+
+          <LoginStatus />
+        </nav>
+      </header>
+
+      <main className="main">{children ?? <Outlet />}</main>
+    </div>
+  );
+}
+
+function ErrorBoundary() {
+  const error = useRouteError() as Error;
+  return (
+    <div>
+      <h1>Something went wrong</h1>
+      <p>{error.message || JSON.stringify(error)}</p>
+    </div>
+  );
+}
+-- lib/auth.ts --
+import Cookies from "js-cookie";
+import getRequestClient from "./getRequestClient.ts";
+
+type RedirectURL = string;
+
+/**
+ * Handles the backend communication for the authentication flow.
+ */
+export const Auth0Provider = {
+  client: getRequestClient(),
+  isAuthenticated: () => !!Cookies.get("auth-token"),
+
+  async login(returnTo: RedirectURL): Promise<RedirectURL> {
+    const response = await this.client.auth.Login();
+    Cookies.set("state", response.state);
+    sessionStorage.setItem(response.state, returnTo);
+    return response.auth_code_url;
+  },
+
+  async logout(): Promise<RedirectURL> {
+    const response = await this.client.auth.Logout();
+
+    Cookies.remove("auth-token");
+    Cookies.remove("state");
+
+    return response.redirect_url;
+  },
+
+  async validate(state: string, authCode: string): Promise<RedirectURL> {
+    if (state != Cookies.get("state")) throw new Error("Invalid state");
+
+    const response = await this.client.auth.Callback({ code: authCode });
+    Cookies.set("auth-token", response.token);
+    const returnURL = sessionStorage.getItem(state) ?? "/";
+    sessionStorage.removeItem(state);
+    return returnURL;
+  },
+};
+-- components/LoginStatus.tsx --
+import getRequestClient from "../lib/getRequestClient.ts";
+import { useFetcher } from "react-router-dom";
+import { useEffect, useState } from "react";
+import { auth } from "../lib/client.ts";
+import { Auth0Provider } from "../lib/auth.ts";
+
+/**
+ * Component displaying login/logout button and basic user information if logged in.
+ */
+function LoginStatus() {
+  const client = getRequestClient();
+  const fetcher = useFetcher();
+  const [profile, setProfile] = useState<auth.ProfileData>();
+  const [loading, setLoading] = useState(true);
+
+  // Fetch profile data if user is authenticated
+  useEffect(() => {
+    const getProfile = async () => {
+      setProfile(await client.auth.GetProfile());
+      setLoading(false);
+    };
+    if (Auth0Provider.isAuthenticated()) getProfile();
+    else setLoading(false);
+  }, []);
+
+  if (loading) return null;
+
+  if (profile) {
+    return (
+      <div className="authStatus">
+        <img src={profile.picture} />
+        <fetcher.Form method="GET" action="/logout">
+          <button type="submit">Sign out {profile.email}</button>
+        </fetcher.Form>
+      </div>
+    );
+  }
+
+  const params = new URLSearchParams();
+  params.set("returnTo", window.location.pathname);
+  return (
+    <div className="authStatus">
+      <fetcher.Form method="GET" action={"/login?" + params.toString()}>
+        <button type="submit">
+          {fetcher.state !== "idle" ? "Signing in..." : "Sign in"}
+        </button>
+      </fetcher.Form>
+    </div>
+  );
+}
+
+export default LoginStatus;
+-- lib/getRequestClient.ts --
+import Client, { Environment, Local } from "./client.ts";
+import Cookies from "js-cookie";
+
+/**
+ * Returns the generated Encore request client for either the local or staging environment.
+ * If we are running the frontend locally (development) we assume that our Encore
+ * backend is also running locally.
+ */
+const getRequestClient = () => {
+  const token = Cookies.get("auth-token");
+  const env = import.meta.env.DEV ? Local : Environment("staging");
+
+  return new Client(env, {
+    auth: token,
+  });
+};
+
+export default getRequestClient;
+```
+
+## Auth0 Social Identity Providers
+
+Auth0 supports multiple [social identity providers](https://auth0.com/docs/authenticate/identity-providers/social-identity-providers) (like Google and GitHub) for web applications out of the box.
diff --git a/docs/go/how-to/break-up-monolith.md b/docs/go/how-to/break-up-monolith.md
new file mode 100644
index 0000000000..01e05b1a32
--- /dev/null
+++ b/docs/go/how-to/break-up-monolith.md
@@ -0,0 +1,85 @@
+---
+seotitle: Break a monolith into microservices
+seodesc: Learn how to quickly break up your backend monolith into microservices using Encore, while avoiding the common pitfalls.
+title: Break a monolith into microservices
+subtitle: Evolving your architecture as needed
+lang: go
+---
+
+It's common to want to break out specific functionality into separate services. Perhaps you want to independently scale a specific service, or simply want to structure your codebase in smaller pieces.
+
+Encore makes it simple to evolve your system architecture over time, and enables you to deploy your application in multiple different ways without making code changes.
+
+## How to break out a service from a monolith
+
+As a (slightly silly) example, let's imagine we have a monolith `hello` with two API endpoints `H1` and `H2`. It looks like this:
+
+```go
+package hello
+
+import (
+	"context"
+)
+
+//encore:api public path=/hello/:name
+func H1(ctx context.Context, name string) (*Response, error) {
+	msg := "Hello, " + name + "!"
+	return &Response{Message: msg}, nil
+}
+
+//encore:api public path=/yo/:name
+func H2(ctx context.Context, name string) (*Response, error) {
+	msg := "Yo, " + name + "!"
+	return &Response{Message: msg}, nil
+}
+
+type Response struct {
+	Message string
+}
+```
+
+Now we're going to break out `H2` into its own separate service. Happily, all we need to do is create a new package, let's call it `yo`, and move the `H2` endpoint into it.
+
+Like so:
+```go
+package yo
+
+import (
+	"context"
+)
+
+//encore:api public path=/yo/:name
+func H2(ctx context.Context, name string) (*Response, error) {
+	msg := "Yo, " + name + "!"
+	return &Response{Message: msg}, nil
+}
+
+type Response struct {
+	Message string
+}
+```
+
+On disk we now have:
+```
+/my-app
+├── encore.app        // ... and other top-level project files
+│
+├── hello             // hello service (a Go package)
+│   └── hello.go      // hello service code
+│
+└── yo                // yo service (a Go package)
+    └── yo.go         // yo service code
+```
+
+Encore now understands these are separate services, and when you run your app you'll see that the [Service Catalog](/docs/go/observability/service-catalog) has been automatically updated accordingly.
+
+<img src="/assets/docs/microservices-service-catalog.png" title="Service Catalog - Microservices" />
+
+As well as the [Flow architecture diagram](/docs/go/observability/encore-flow).
+
+<img src="/assets/docs/microservices-flow.png" title="Encore Flow - Microservices" />
+
+## Sharing databases between services (or not)
+
+Deciding whether to share a database between multiple services depends on your specific situation. Encore supports both options. Learn more in the [database documentation](/docs/go/primitives/share-db-between-services).
+
diff --git a/docs/go/how-to/cgo.md b/docs/go/how-to/cgo.md
new file mode 100644
index 0000000000..870f160384
--- /dev/null
+++ b/docs/go/how-to/cgo.md
@@ -0,0 +1,36 @@
+---
+seotitle: Build Go applications with cgo using Encore
+seodesc: Learn how to build Go applications with cgo using Encore
+title: Build with cgo
+lang: go
+---
+
+Cgo is a feature of the Go compiler that enables Go programs to interface
+with libraries written in other languages using C bindings.
+
+By default, for improved portability Encore builds applications with cgo support disabled.
+
+To enable cgo for your application, add `"build": {"cgo_enabled": true}` to your `encore.app` file.
+
+For example:
+
+```json
+-- encore.app --
+{
+  "id": "my-app-id",
+  "build": {
+    "cgo_enabled": true
+  }
+}
+```
+
+With this setting Encore's build system will compile the application using an Ubuntu builder image
+with gcc pre-installed.
+
+## Static linking
+
+To keep the resulting Docker images as minimal as possible, Encore compiles applications with static linking.
+This happens even with cgo enabled. As a result the cgo libraries you use must support static linking.
+
+In some cases, you may need to add additional linker flags to properly work with static linking of cgo libraries.
+See the [official cgo docs](https://pkg.go.dev/cmd/cgo) for more information on how to do this.
diff --git a/docs/go/how-to/clerk-auth.md b/docs/go/how-to/clerk-auth.md
new file mode 100644
index 0000000000..0c51024af2
--- /dev/null
+++ b/docs/go/how-to/clerk-auth.md
@@ -0,0 +1,157 @@
+---
+seotitle: How to use Clerk to authenticate users in your backend application
+seodesc: Learn how to use Clerk for user authentication in your backend application. In this guide we show you how to integrate your Go backend with Clerk.
+title: Use Clerk with your app
+lang: go
+---
+
+In this guide you will learn how to set up an Encore [auth handler](/docs/go/develop/auth#the-auth-handler) that makes use of
+[Clerk](https://clerk.com/) in order to add an integrated signup and login experience to your web app.
+
+For all the code and instructions of how to clone and run this example locally, see the [Clerk Example](https://github.com/encoredev/examples/tree/main/clerk) in our examples repo.
+
+## Set up the auth handler
+
+In your Encore app, install the following module:
+
+```shell
+$ go get github.com/clerkinc/clerk-sdk-go/clerk
+```
+
+Create a folder and naming it `auth`, this is where our authentication related backend code will live.
+
+It's time to define your [auth handler](/docs/go/develop/auth). Create `auth/auth.go` and paste the following:
+
+```go
+package auth
+
+import (
+	"context"
+	"encore.dev/beta/auth"
+	"encore.dev/beta/errs"
+	"github.com/clerkinc/clerk-sdk-go/clerk"
+)
+
+var secrets struct {
+	ClientSecretKey string
+}
+
+// Service struct definition.
+// Learn more: encore.dev/docs/primitives/services-and-apis/service-structs
+//
+//encore:service
+type Service struct {
+	client clerk.Client
+}
+
+// initService is automatically called by Encore when the service starts up.
+func initService() (*Service, error) {
+	client, err := clerk.NewClient(secrets.ClientSecretKey)
+	if err != nil {
+		return nil, err
+	}
+	return &Service{client: client}, nil
+}
+
+type UserData struct {
+	ID                    string               `json:"id"`
+	Username              *string              `json:"username"`
+	FirstName             *string              `json:"first_name"`
+	LastName              *string              `json:"last_name"`
+	ProfileImageURL       string               `json:"profile_image_url"`
+	PrimaryEmailAddressID *string              `json:"primary_email_address_id"`
+	EmailAddresses        []clerk.EmailAddress `json:"email_addresses"`
+}
+
+// The `encore:authhandler` annotation tells Encore to run this function for all
+// incoming API call that requires authentication.
+// Learn more: encore.dev/docs/develop/auth#the-auth-handler
+//
+//encore:authhandler
+func (s *Service) AuthHandler(ctx context.Context, token string) (auth.UID, *UserData, error) {
+	// verify the session
+	sessClaims, err := s.client.VerifyToken(token)
+	if err != nil {
+		return "", nil, &errs.Error{
+			Code:    errs.Unauthenticated,
+			Message: "invalid token",
+		}
+	}
+
+	user, err := s.client.Users().Read(sessClaims.Claims.Subject)
+	if err != nil {
+		return "", nil, &errs.Error{
+			Code:    errs.Internal,
+			Message: err.Error(),
+		}
+	}
+
+	userData := &UserData{
+		ID:                    user.ID,
+		Username:              user.Username,
+		FirstName:             user.FirstName,
+		LastName:              user.LastName,
+		ProfileImageURL:       user.ProfileImageURL,
+		PrimaryEmailAddressID: user.PrimaryEmailAddressID,
+		EmailAddresses:        user.EmailAddresses,
+	}
+
+	return auth.UID(user.ID), userData, nil
+}
+```
+
+## Clerk credentials
+
+Create a Clerk account if you haven't already. Then, in the Clerk dashboard, create a new applications.
+
+Next, go to the *API Keys* page for your app. Copy one of the "Secret keys" (the "Publishable Key" will be used by your frontend).
+
+The `Secret key` is sensitive and should not be hardcoded in your code/config. Instead, you should store that as an [Encore secret](/docs/go/primitives/secrets).
+
+From your terminal (inside your Encore app directory), run:
+
+```shell
+$ encore secret set --prod ClientSecretKey
+```
+
+Now you should do the same for the development secret. The most secure way is to create another secret key (Clerk allows you to have multiple).
+Once you have a client secret for development, set it similarly to before:
+
+```shell
+$ encore secret set --dev ClientSecretKey
+```
+
+## Frontend
+
+Clerk offers a [React SDK](https://clerk.com/docs/references/react/overview) for the frontend which makes it really simple to integrate 
+a login/signup flow inside your web app as well as getting the token required to communicate with your Encore backend. 
+
+You can use the `useAuth` hook from `@clerk/clerk-react` to get the token and send it to your backend.
+
+```tsx
+import { useAuth } from '@clerk/clerk-react';
+ 
+export default function ExternalDataPage() {
+  const { getToken, isLoaded, isSignedIn } = useAuth();
+ 
+  if (!isLoaded) {
+    // Handle loading state however you like
+    return <div>Loading...</div>;
+  }
+ 
+  if (!isSignedIn) {
+    // Handle signed out state however you like
+    return <div>Sign in to view this page</div>;
+  }
+ 
+  const fetchDataFromExternalResource = async () => {
+    const token = await getToken();
+    // Use token to send to Encore backend when fetching data
+    return data;
+  }
+ 
+  return <div>...</div>;
+}
+```
+
+For a fully working backend + frontend example see the [Clerk Example](https://github.com/encoredev/examples/tree/main/clerk) in our examples repo.
diff --git a/docs/go/how-to/debug.md b/docs/go/how-to/debug.md
new file mode 100644
index 0000000000..70778d7ce5
--- /dev/null
+++ b/docs/go/how-to/debug.md
@@ -0,0 +1,118 @@
+---
+seotitle: How to debug your application with Delve
+seodesc: Learn how to debug your Go backend application using Delve and Encore.
+title: Debug with Delve
+lang: go
+---
+
+Encore makes it easy to debug your application using [Delve](https://github.com/go-delve/delve "Delve").
+
+First, make sure you have `dlv` installed by running (Go 1.16 and later):
+
+```shell
+$ go install github.com/go-delve/delve/cmd/dlv@latest
+```
+
+You have two debugger options, you can either debug by attaching to a running process or by starting the process in debug mode.
+
+## Debug by starting the process in debug mode
+Run your Encore application with `encore run --debug=break`. This will launch your encore application with a headless Delve server, which will pause your application until a debugger is attached.
+
+```shell
+$ encore run --debug=break
+API Base URL:      http://localhost:4000
+Dev Dashboard URL: http://localhost:9400/hello-world-cgu2
+
+API server listening at: 127.0.0.1:2345
+```
+
+Now it's time to attach the debugger. The instructions differ depending on how you would like to debug (in your terminal or in your editor). If instructions for your editor aren’t listed below, consult your editor for information on how to attach to a Delve server.
+
+### Terminal debugging
+To debug in your terminal, run `dlv attach :2345`. You should see:
+
+```shell
+$ dlv connect :2345
+Type 'help' for list of commands.
+(dlv)
+```
+How to use Delve’s terminal interface for debugging is out of scope for this guide, but there are great resources available. For a good introduction, see [](https://golang.cafe/blog/golang-debugging-with-delve.html "Debugging with Delve").
+
+### Visual Studio Code
+To debug with VS Code you must first add a debug configuration. Press `Run -> Add Configuration`, choose `Go -> Connect to server`. Input `127.0.0.1` as host and `2345` as port. The resulting configuration should look something like this:
+
+```json
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Connect to server",
+            "type": "go",
+            "request": "attach",
+            "mode": "remote",
+            "remotePath": "${workspaceFolder}",
+            "port": 2345,
+            "host": "127.0.0.1"
+        }
+    ]
+}
+```
+
+Next, open the **Run and Debug** menu in the toolbar on the left, select `Connect to server` (the configuration you just created), and then press the green arrow.
+
+That’s it! You should be able to set breakpoints and have the Encore application pause when they’re hit like you would expect.
+
+### Goland
+To debug with Goland, you must create a new Go Remote configuration. Press `Run | Edit Configurations`, click the `+` button, and choose `Go Remote`. Give it a name and hit `OK`. 
+
+Now select the configuration you just created and press the green bug.
+
+That's it. You should be able to set breakpoints and have the Encore application pause when they’re hit like you would expect.
+
+## Debug by attaching to a running process
+
+Run your Encore application with `encore run --debug`. This will cause Encore to print the Process ID to the terminal, which you will use to attach your debugger:
+
+```shell
+$ encore run --debug
+API Base URL:      http://localhost:4000
+Dev Dashboard URL: http://localhost:9400/hello-world-cgu2
+Process ID:        51894
+1:48PM INF registered endpoint path=/hello/:name service=hello endpoint=Hello
+```
+
+(Your process id will differ).
+
+When your Encore application is running, it’s time to attach the debugger. The instructions differ depending on how you would like to debug (in your terminal or in your editor). If instructions for your editor aren’t listed below, consult your editor for information on how to attach a debugger to a running process.
+
+### Terminal debugging
+To debug in your terminal, run `dlv attach $PID` (replace `$PID` with your Process ID from the previous step). You should see:
+
+```shell
+$ dlv attach 51894
+Type 'help' for list of commands.
+(dlv)
+```
+
+How to use Delve’s terminal interface for debugging is out of scope for this guide, but there are great resources available. For a good introduction, see [](https://golang.cafe/blog/golang-debugging-with-delve.html "Debugging with Delve").
+
+### Visual Studio Code
+To debug with VS Code you must first add a debug configuration. Press `Run -> Add Configuration`, choose `Go -> Attach to local process`. In the generated configuration, you should see `"processId": 0` as a field. Replace `0` with the process id from above.
+
+Next, open the **Run and Debug** menu in the toolbar on the left, select Attach to Process (the configuration you just created), and then press the green arrow.
+
+That’s it! You should be able to set breakpoints and have the Encore application pause when they’re hit like you would expect.
+
+### Goland
+To debug with Goland, you must first install the `gops` package. Open a terminal and run the following command
+
+```shell
+go get -t github.com/google/gops/
+```
+
+Then click `Run | Attach to Process`. If a notification window appears, click the `Invoke 'go get gops'` link. Once 
+it has completed, click `Run | Attach to Process` again. In the dialog that appears, select the process with the
+process ID from above.
+
+That's it. You should be able to set breakpoints and have the Encore application pause when they’re hit like you would expect.
+
diff --git a/docs/go/how-to/dependency-injection.md b/docs/go/how-to/dependency-injection.md
new file mode 100644
index 0000000000..a0d2866c3a
--- /dev/null
+++ b/docs/go/how-to/dependency-injection.md
@@ -0,0 +1,68 @@
+---
+seotitle: How to use dependency injection to test your microservices app
+seodesc: Learn how to use dependency injection in your Go based microservices backend application using Encore.
+title: Dependency Injection
+subtitle: Simplifying testing
+lang: go
+---
+
+Dependency Injection is a fancy name for a simple concept: when you depend on some
+functionality, add that dependency as a field on your struct and refer to it that way
+instead of directly calling it. By doing so it becomes easier to test your services
+by swapping out certain dependencies for other implementations (often with the use of
+interfaces).
+
+Encore provides built-in support for dependency injection in services through the use
+of the `//encore:service` directive and a **service struct**. See the [service structs docs](/docs/go/primitives/service-structs) more information on how to define service structs.
+
+As an example, consider an email service that has a SendGrid API client that is
+dependency injected. It might look like this:
+
+```go
+package email
+
+//encore:service
+type Service struct {
+	sendgridClient *sendgrid.Client
+}
+
+func initService() (*Service, error) {
+    client, err := sendgrid.NewClient()
+    if err != nil {
+        return nil, err
+    }
+    return &Service{sendgridClient: client}, nil
+}
+```
+
+You can then define APIs as methods on this struct:
+```go
+//encore:api private
+func (s *Service) Send(ctx context.Context, p *SendParams) error {
+	// ... use s.sendgridClient to send emails ...
+}
+```
+
+### Mocking dependencies
+
+If you wish to mock out the SendGrid client for testing purposes you can change the
+field to an interface:
+
+```go
+type sendgridClient interface {
+	SendEmail(...) // a hypothetical signature, for illustration purposes
+}
+
+//encore:service
+type Service struct {
+    sendgridClient sendgridClient
+}
+```
+
+Then during your tests you can instantiate the service object by hand:
+```go
+func TestFoo(t *testing.T) {
+    svc := &Service{sendgridClient: &myMockClient{}}
+    // ...
+}
+```
diff --git a/docs/go/how-to/entgo-orm.md b/docs/go/how-to/entgo-orm.md
new file mode 100644
index 0000000000..bc932c8771
--- /dev/null
+++ b/docs/go/how-to/entgo-orm.md
@@ -0,0 +1,185 @@
+---
+seotitle: Use ent + Atlas for database schema management with Encore.
+seodesc: See how you can use an ORM like ent with Atlas to handle your database schemas.
+title: Use ent ORM + Atlas for database schemas
+lang: go
+---
+
+Encore has all the tools needed to support ORMs and migration frameworks out-of-the-box through
+[named databases](/docs/go/primitives/share-db-between-services) and 
+[migration files](/docs/go/primitives/databases#defining-a-database-schema). Writing plain SQL might
+not work for your use case, or you may not want to use SQL in the first place. 
+
+ORMs like [ent](https://entgo.io/) and migration frameworks like [Atlas](https://atlasgo.io/) can
+be used with Encore by integrating their logic with a system's database. Encore is not restrictive,
+it uses plain SQL migration files for its migrations. 
+
+- If your ORM of choice can connect to any database using a [standard SQL driver](https://github.com/lib/pq), then it can be used with Encore.
+- If your migration framework can generate SQL migration files without any modifications, then it can be used with Encore.
+
+Let's take a look at how you can integrate ent with Encore, using Atlas for generating the migration files.
+
+## Add ent schemas to a service
+[Install ent](https://entgo.io/docs/tutorial-setup#installation), then initialize your first
+schema in the service where you want to use it. For example, if you had the following app structure:
+
+```
+/my-app
+├── encore.app
+└── user        // user service
+```
+
+You can then use this command to generate a user schema along with the ent directory that will contain
+that schema and all future generated files:
+
+```shell
+$ go run entgo.io/ent/cmd/ent@latest new --target user/ent/schema User
+```
+
+The `--target` option sets the schema directory within your Encore system. Each system
+should contain its own models and schemas, and its own migration files. Like you would when using
+plain SQL.
+
+Add the fields and edges for your new model in the generated file under `user/ent/schema/user.go`.
+
+Now, run the following command:
+
+```shell
+$ go run entgo.io/ent/cmd/ent@latest generate ./user/ent/schema
+```
+
+This generates the ent client files. Run this command again whenever you change the schemas.
+
+## Integrating ent with an Encore database
+
+Encore automates database provisioning, and automatically runs migrations in all environments.
+
+To integrate ent with Encore, we need to do three things:
+
+1. Create the Encore database
+2. Set up the ent client to use that database.
+3. Generate migration files for the ent schema, using Atlas.
+
+### Create the Encore database
+
+Create the database using [`sqldb.NewDatabase`](/docs/go/primitives/databases) in `user/user.go`:
+
+```
+-- user/user.go --
+package user
+
+import "encore.dev/storage/sqldb"
+
+var userDB = sqldb.NewDatabase("user", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+```
+
+Now, create the `migrations` directory, and leave it empty for now:
+
+```shell
+$ mkdir user/migrations
+```
+
+### Connect ent to the database
+
+Next, extend the user service with a [Service Struct](/docs/go/primitives/service-structs) that
+creates an ent client connected to the database.
+
+Replace the contents of the `user/user.go` file with:
+
+```
+-- user/user.go --
+package user
+
+import (
+    "encore.dev/storage/sqldb"
+	"entgo.io/ent/dialect"
+	entsql "entgo.io/ent/dialect/sql"
+	
+	"encore.app/user/ent"
+)
+
+var userDB = sqldb.NewDatabase("user", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+
+//encore:service
+type Service struct{
+    ent *ent.Client
+}
+
+func initService() (*Service, error) {
+    driver := entsql.OpenDB(dialect.Postgres, userDB.Stdlib())
+    entClient := ent.NewClient(ent.Driver(driver))
+    return &Service{ent: entClient}, nil
+}
+```
+
+Now ent is fully wired up to the Encore database, and can be used from the service struct in any API endpoint.
+
+## Using Atlas for database migrations
+
+Finally, we'll set up Atlas to generate database migrations for the ent schema.
+
+First, make sure you [have Atlas installed](https://atlasgo.io/getting-started).
+
+Then, create the file `user/atlas.hcl` containing the following:
+
+```
+-- user/atlas.hcl --
+env "local" {
+  src = "ent://ent/schema"
+
+  migration {
+    dir = "file://migrations"
+    format = golang-migrate
+  }
+
+  format {
+    migrate {
+      diff = "{{ sql . \"  \" }}"
+    }
+  }
+}
+```
+
+This tells Atlas to generate migrations for the ent schema, and to output them to the `migrations` directory.
+
+Atlas works by comparing the desired ent schema with the current database schema, and generating a migration
+to bring the database schema in line with the ent schema. This relies on a so-called "shadow database",
+which is an empty database that Atlas uses to compare the ent schema against.
+
+Fortunately for us, Encore has built-in support for shadow databases.
+
+Create the file `user/scripts/generate-migration` containing the following:
+
+```
+-- user/scripts/generate-migration --
+#!/bin/bash
+set -eu
+DB_NAME=user
+MIGRATION_NAME=${1:-}
+
+# Reset the shadow database
+encore db reset --shadow $DB_NAME
+
+# ent executes Go code without initializing Encore when generating migrations,
+# so configure the Encore runtime to be aware that this is expected.
+export ENCORERUNTIME_NOPANIC=1
+
+# Generate the migration
+atlas migrate diff $MIGRATION_NAME --env local --dev-url "$(encore db conn-uri --shadow $DB_NAME)&search_path=public"
+```
+
+Finally, make the script executable, and generate our first migration:
+
+```shell
+$ chmod +x user/scripts/generate-migration
+$ cd user && ./scripts/generate-migration init
+```
+
+You should see a new migration file being added to the `user/migrations` directory,
+containing the schema changes to create the ent models.
+
+You can now run the service with `encore run`, and everything should be ready to go!
diff --git a/docs/go/how-to/firebase-auth.md b/docs/go/how-to/firebase-auth.md
new file mode 100644
index 0000000000..69c977e459
--- /dev/null
+++ b/docs/go/how-to/firebase-auth.md
@@ -0,0 +1,163 @@
+---
+seotitle: How to use Firebase Auth for your backend application
+seodesc: Learn how to use Firebase Auth for user authentication in your backend application. In this guide we show you how to integrate your Go backend with Firebase Auth.
+title: Use Firebase Auth with your app
+lang: go
+---
+
+Encore's [authentication support](/docs/go/develop/auth) provides a simple yet powerful
+way of dealing with various authentication scenarios.
+
+<a href="https://firebase.google.com/docs/auth" target="_blank" rel="nofollow">Firebase Authentication</a>
+{" "}is a common solution for quickly setting up a user store and simplifying social logins.
+
+Encore makes it really easy to integrate with Firebase Authentication on the backend.
+
+For all the code and instructions of how to clone and run this example locally, see the [Firebase Auth Example](https://github.com/encoredev/examples/tree/main/firebase-auth) in our examples repo.
+
+## Set up auth handler
+
+First, install two modules:
+
+```shell
+$ go get firebase.google.com/go/v4 go4.org/syncutil
+```
+
+Next it's time to define your [authentication handler](/docs/go/develop/auth).
+It can live in whatever service you'd like, but it's usually easiest
+to create a designated `user` service.
+
+Create the `user/user.go` file and add the following skeleton code:
+
+```go
+package user
+
+import (
+	"context"
+	"strings"
+
+	"encore.dev/beta/auth"
+	firebase "firebase.google.com/go/v4"
+	fbauth "firebase.google.com/go/v4/auth"
+	"go4.org/syncutil"
+	"google.golang.org/api/option"
+)
+
+// Data represents the user's data stored in Firebase Auth.
+type Data struct {
+	// Email is the user's email.
+	Email string
+	// Name is the user's name.
+	Name string
+	// Picture is the user's picture URL.
+	Picture string
+}
+
+// ValidateToken validates an auth token against Firebase Auth.
+//encore:authhandler
+func ValidateToken(ctx context.Context, token string) (auth.UID, *Data, error) {
+    panic("Not Yet Implemented")
+}
+```
+
+## Initialize Firebase SDK
+
+Next, let's set up the Firebase Auth client. We'll use
+&nbsp;<a href="https://pkg.go.dev/go4.org/syncutil#Once" target="_blank" rel="nofollow">`syncutil.Once`</a>&nbsp;
+to do it lazily the first time we need it.
+
+Add to the bottom of our file:
+
+```go
+var (
+	fbAuth    *fbauth.Client
+	setupOnce syncutil.Once
+)
+
+// setupFB ensures Firebase Auth is setup.
+func setupFB() error {
+    return setupOnce.Do(func() error {
+        opt := option.WithCredentialsJSON([]byte(secrets.FirebasePrivateKey))
+        app, err := firebase.NewApp(context.Background(), nil, opt)
+        if err == nil {
+            fbAuth, err = app.Auth(context.Background())
+        }
+        return err
+    })
+}
+
+var secrets struct {
+	// FirebasePrivateKey is the JSON credentials for calling Firebase.
+	FirebasePrivateKey string
+}
+```
+
+## Validate token against Firebase
+
+Now that we have the code to initialize Firebase Auth, we can use it from our `ValidateToken` auth handler.
+Update the function to look like the following:
+
+```go
+func ValidateToken(ctx context.Context, token string) (auth.UID, *Data, error) {
+    if err := setupFB(); err != nil {
+		return "", nil, err
+	}
+	tok, err := fbAuth.VerifyIDToken(ctx, token)
+	if err != nil {
+		return "", nil, err
+	}
+
+	email, _ := tok.Claims["email"].(string)
+	name, _ := tok.Claims["name"].(string)
+	picture, _ := tok.Claims["picture"].(string)
+	uid := auth.UID(tok.UID)
+
+	usr := &Data{
+		Email:   email,
+		Name:    name,
+		Picture: picture,
+	}
+	return uid, usr, nil
+}
+```
+
+Great! We're done with the code. Now we just need to set up the secret.
+
+## Set Firebase secret credentials
+
+If you haven't already, set up a <a href="https://firebase.google.com" target="_blank" rel="nofollow">Firebase</a> project.
+
+Then, go to **Project settings** and navigate to **Service accounts**.
+Select `Go` as the language of choice and click `Generate new private key`.
+Download the generated key and take note where it is stored.
+
+Next, store the private key as your firebase secret.
+From your terminal (inside your Encore app directory), run:
+
+```shell
+$ encore secret set --type prod FirebasePrivateKey < /path/to/firebase-private-key.json
+Successfully updated production secret FirebasePrivateKey
+```
+
+Now you should do the same for the development secret. The most secure way is to
+set up a different Firebase project and use that for development.
+
+Depending on your security requirements you could also use the same Firebase project,
+but we recommend generating a new private key for development in that case.
+
+Once you have a private key for development, set it similarly to before:
+
+```shell
+$ encore secret set --type dev,local,pr FirebasePrivateKey < /path/to/firebase-private-key.json
+Successfully updated development secret FirebasePrivateKey
+```
+
+That's it! You can now call your Encore application and pass in Firebase tokens.
+Encore will run your auth handler and validate the token against Firebase Auth.
+
+## Frontend
+
+Firebase offers a [npm package](https://www.npmjs.com/package/firebase) for your web frontend which makes it really simple to create 
+a login/signup flow inside your web app as well as getting the token required to communicate with your Encore backend. 
+
+For a fully working backend + frontend example see the [Firebase Auth Example](https://github.com/encoredev/examples/tree/main/firebase-auth) in our examples repo.
diff --git a/docs/go/how-to/grpc-connect.md b/docs/go/how-to/grpc-connect.md
new file mode 100644
index 0000000000..89446eefd2
--- /dev/null
+++ b/docs/go/how-to/grpc-connect.md
@@ -0,0 +1,199 @@
+---
+seotitle: Use Connect for gRPC/protobuf-based APIs with Encore
+seodesc: See how you can use the Connect protocol for gRPC communication with Encore services
+title: Use Connect for incoming gRPC requests
+lang: go
+---
+
+The [Connect protocol](https://connectrpc.com/) is an HTTP/2-based protocol for RPC communication.
+It's conceptually similar to gRPC, but with better support for using from browsers and JavaScript clients.
+
+This guide shows how to use Encore for setting up a Connect service for external clients to use:
+
+1. First, we'll define a simple gRPC service using Protobuf and Connect.
+2. Then, we'll implement the service in Go, using [connect-go](https://connectrpc.com/docs/go/getting-started).
+3. Then, we'll mount the Connect service into Encore with a raw endpoint.
+4. Finally, we'll call the Connect service from cURL using its JSON mapping.
+
+## Define a Connect service
+
+We'll largely follow the connect-go [getting started guide](https://connectrpc.com/docs/go/getting-started)
+with some small tweaks.
+
+Start by installing the necessary tools:
+
+```shell
+$ go install github.com/bufbuild/buf/cmd/buf@latest
+$ go install github.com/fullstorydev/grpcurl/cmd/grpcurl@latest
+$ go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
+$ go install connectrpc.com/connect/cmd/protoc-gen-connect-go@latest
+```
+
+Next, inside your Encore application ([create one if you haven't already](/docs/go/quick-start))
+create a new file at `greet/v1/greet.proto` with the following contents:
+
+```
+-- greet/v1/greet.proto --
+syntax = "proto3";
+
+package greet.v1;
+
+option go_package = "encore.app/gen/greet/v1;greetv1";
+
+message GreetRequest {
+  string name = 1;
+}
+
+message GreetResponse {
+  string greeting = 1;
+}
+
+service GreetService {
+  rpc Greet(GreetRequest) returns (GreetResponse) {}
+}
+```
+
+Next, add a `buf.gen.yaml` in the repository root, containing:
+
+```
+-- buf.gen.yaml --
+version: v2
+plugins:
+  - local: protoc-gen-go
+    out: gen
+    opt: paths=source_relative
+  - local: protoc-gen-connect-go
+    out: gen
+    opt: paths=source_relative
+```
+
+Now it's time to generate the connect-go service code. Run:
+
+```shell
+$ buf lint
+$ buf generate
+```
+
+If all went well, you should see a new `gen` directory in the repository root containing some generated Go code:
+
+```
+gen
+└── greet
+    └── v1
+        ├── greet.pb.go
+        └── greetv1connect
+            └── greet.connect.go
+```
+
+## Implement the service
+
+Now that we have the service definition, we can implement the Connect service in Go.
+
+Add the file `greet/greet.go` with the following contents:
+
+```
+-- greet/greet.go --
+package greet
+
+import (
+	"context"
+	"fmt"
+	"log"
+
+	"connectrpc.com/connect"
+
+	greetv1 "encore.app/gen/greet/v1" // generated by protoc-gen-go
+)
+
+type GreetServer struct{}
+
+func (s *GreetServer) Greet(
+	ctx context.Context,
+	req *connect.Request[greetv1.GreetRequest],
+) (*connect.Response[greetv1.GreetResponse], error) {
+	log.Println("Request headers: ", req.Header())
+	res := connect.NewResponse(&greetv1.GreetResponse{
+		Greeting: fmt.Sprintf("Hello, %s!", req.Msg.Name),
+	})
+	res.Header().Set("Greet-Version", "v1")
+	return res, nil
+}
+```
+
+<Callout type="info">
+
+The sample code is straight from the [getting started guide](https://connectrpc.com/docs/go/getting-started);
+there are no Encore specific changes required here.
+
+</Callout>
+
+## Mount the service in Encore
+
+Now we'll create an Encore [service struct](/docs/go/primitives/service-structs)
+that initializes the Connect service, and a [raw endpoint](/docs/go/primitives/raw-endpoints)
+that forwards incoming requests to the Connect service.
+
+Add the file `greet/service.go` with the following contents:
+
+```
+-- greet/service.go --
+package greet
+
+import (
+	"net/http"
+
+	"encore.app/gen/greet/v1/greetv1connect"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/h2c"
+)
+
+//encore:service
+type Service struct {
+	routes http.Handler
+}
+
+//encore:api public raw path=/greet.v1.GreetService/*endpoint
+func (s *Service) GreetService(w http.ResponseWriter, req *http.Request) {
+	s.routes.ServeHTTP(w, req)
+}
+
+func initService() (*Service, error) {
+	greeter := &GreetServer{}
+	mux := http.NewServeMux()
+	path, handler := greetv1connect.NewGreetServiceHandler(greeter)
+	mux.Handle(path, handler)
+	return &Service{routes: mux}, nil
+}
+```
+
+That's it! We're ready to run the service and check that everything works.
+
+## Run the service
+
+Run the service with `encore run`:
+
+```shell
+$ encore run
+```
+
+Once it starts up, open a separate terminal and use `grpcurl` to call the service:
+
+```shell
+# Install grpcurl if you haven't already
+$ go install github.com/fullstorydev/grpcurl/cmd/grpcurl@latest
+
+# Call the service with grpcurl
+grpcurl \
+    -protoset <(buf build -o -) -plaintext \
+    -d '{"name": "Jane"}' \
+    localhost:4000 greet.v1.GreetService/Greet
+{"greeting": "Hello, Jane!"} 
+
+# Or call the service with curl
+$ curl -H "Content-Type: application/json" -d '{"name": "Jane"}' http://localhost:4000/greet.v1.GreetService/Greet
+{"greeting":"Hello, Jane!"}  # Expected response
+```
+
+If you see `{"greeting":"Hello, Jane!"}`, everything is working!
+
+What's more, Encore automatically traces the incoming requests, and adds request logging and captures request metrics.
diff --git a/docs/go/how-to/http-requests.md b/docs/go/how-to/http-requests.md
new file mode 100644
index 0000000000..341f881e7e
--- /dev/null
+++ b/docs/go/how-to/http-requests.md
@@ -0,0 +1,59 @@
+---
+seotitle: How to receive regular HTTP requests in your backend application
+seodesc: Learn how to receive regular HTTP requests in your Go based backend application using Encore.
+title: Receive regular HTTP requests
+subtitle: Dropping down in abstraction level
+lang: go
+---
+
+Encore makes it easy to define APIs and expose them, but it works best when you are in charge of the API schema.
+
+Sometimes you need more control over the underlying HTTP request, such as to accept incoming webhooks from other
+services, or to use WebSockets to stream data to/from the client.
+
+For these use cases Encore lets you define **raw endpoints**. Raw endpoints operate at a lower abstraction level,
+giving you access to the underlying HTTP request.
+
+## Defining raw endpoints
+
+To define a raw endpoint, change the `//encore:api` annotation and function signature like so:
+
+```go
+package service
+
+import "net/http"
+
+// Webhook receives incoming webhooks from Some Service That Sends Webhooks.
+//encore:api public raw method=POST path=/webhook
+func Webhook(w http.ResponseWriter, req *http.Request) {
+    // ... operate on the raw HTTP request ...
+}
+```
+
+If you're an experienced Go developer, this is just a regular Go HTTP handler.
+
+See the <a href="https://pkg.go.dev/net/http#Handler" target="_blank" rel="nofollow">net/http documentation</a>
+for more information on how Go HTTP handlers work.
+
+## Reading path parameters
+
+Sometimes webhooks have information in the path that you may be interested in retrieving or validating.
+
+To do so, define the path with a path parameter, and then use [`encore.CurrentRequest`](https://pkg.go.dev/encore.dev#CurrentRequest)
+to access the path parameters. For example:
+
+```go
+package service  
+  
+import (  
+   "net/http"  
+   
+   "encore.dev"
+ )
+
+//encore:api public raw method=POST path=/webhook/:id
+func Webhook(w http.ResponseWriter, req *http.Request) {  
+    id := encore.CurrentRequest().PathParams.Get("id")
+	// ... Do something with id
+ }
+```
diff --git a/docs/go/how-to/integrate-frontend.mdx b/docs/go/how-to/integrate-frontend.mdx
new file mode 100644
index 0000000000..4a9e2f4345
--- /dev/null
+++ b/docs/go/how-to/integrate-frontend.mdx
@@ -0,0 +1,271 @@
+---
+seotitle: Integrate your backend application with a frontend
+seodesc: Learn how to integrate your Go backend application with a frontend, using Encore's built-in frontend client generation feature.
+title: Integrate with a web frontend
+subtitle: Keep using your favorite frontend hosting provider
+lang: go
+---
+Encore is not opinionated about where you host your frontend, pick the platform that suits your situation best.
+
+If your frontend and backend use different domains, often the case when using PR preview environments for your frontend, you may need to [configure CORS](#handling-cors).
+
+Take a look at our [React starter template](https://encore.dev/templates/react) for an example of deploying a frontend to [Vercel](https://vercel.com/) or the [Meeting Notes tutorial](https://encore.dev/docs/go/tutorials/meeting-notes) deployed to [GitHub Pages](https://pages.github.com/).
+
+## Generating a request client
+Encore is able to generate frontend request clients (TypeScript or JavaScript). This lets you to keep the request/response types in sync without manual work and assists you in calling the APIs. Generate a client by running:
+
+```bash
+$ encore gen client <ENCORE-APP-ID> --output=./src/client.ts --env=<ENV_NAME>
+```
+
+Adding this as a script to your `package.json` is often a good idea to be able to run it whenever a change is made to your Encore API:
+
+```json
+{
+...
+"scripts": {
+    ...
+    "generate-client:staging": "encore gen client <ENCORE-APP-ID> --output=./src/client.ts --env=staging",
+    "generate-client:local": "encore gen client <ENCORE-APP-ID> --output=./src/client.ts --env=local"
+  }
+}
+```
+
+After that you are ready to use the request client in your code. Here is an example from the [Meeting Notes tutorial](https://encore.dev/docs/tutorials/meeting-notes) for calling the `GetNote` endpoint on the `note` service in order to retrieve a specific meeting note (which has the properties `id`, `cover_url` & `text`):
+
+```ts
+import Client, { Environment, Local } from "src/client.ts";
+
+// Making request to locally running backend...
+const client = new Client(Local);
+// or to a specific deployed environment
+const client = new Client(Environment("staging"));
+
+// Calling APIs as typesafe functions 🌟
+const response = await client.note.GetNote("note-uuid");
+console.log(response.id);
+console.log(response.cover_url);
+console.log(response.text);
+```
+
+See more in the [client generation docs](/docs/develop/client-generation).
+
+### Asynchronous state management
+
+When building something a bit more complex, you will likely need to deal with caching, refetching, and data going stale.
+[TanStack Query](https://tanstack.com/query/latest) is a popular library that was built to solve exactly these problems and works well with the Encore request client.
+
+Here is a simple example of using an Encore request client together with TanStack Query:
+
+```ts
+import {
+  useQuery,
+  useMutation,
+  useQueryClient,
+  QueryClient,
+  QueryClientProvider,
+} from '@tanstack/react-query'
+import Client, { todo } from '../encore-client'
+
+// Create a Encore client
+const encoreClient = new Client(window.location.origin);
+
+// Create a react-query client
+const queryClient = new QueryClient()
+
+function App() {
+  return (
+    // Provide the client to your App
+    <QueryClientProvider client={queryClient}>
+      <Todos />
+    </QueryClientProvider>
+  )
+}
+
+function Todos() {
+  // Access the client
+  const queryClient = useQueryClient()
+
+  // Queries
+  const query = useQuery({
+    queryKey: ['todos'],
+    queryFn: () => encoreClient.todo.List()
+  })
+
+  // Mutations
+  const mutation = useMutation({
+    mutationFn: (params: todo.AddParams) => encoreClient.todo.Add(params),
+    onSuccess: () => {
+      // Invalidate and refetch
+      queryClient.invalidateQueries({ queryKey: ['todos'] })
+    },
+  })
+
+  return (
+    <div>
+      <ul>
+        {query.data?.map((todo) => (
+          <li key={todo.id}>{todo.title}</li>
+        ))}
+      </ul>
+
+      <button
+        onClick={() => {
+          mutation.mutate({
+            id: Date.now(),
+            title: 'Do Laundry',
+          })
+        }}
+      >
+        Add Todo
+      </button>
+    </div>
+  )
+}
+
+render(<App />, document.getElementById('root'))
+```
+
+This example assumes that we have a `todo` service with a `List` and `Add` endpoint. When adding the new todo,
+TanStack Query will automatically invalidate the `todos` query and refetch it.
+
+For a real-world example, take a look at the [Uptime Monitoring](https://github.com/encoredev/examples/tree/main/uptime) app which also makes use of
+TanStack Query's `refetchInterval` option for polling the backend.
+
+### Testing
+When unit testing a component that interacts with your Encore API you can mock methods on the request client to
+return a value suitable for the test. This makes your test URL agnostic because you are not intercepting
+specific requests on the fetch layer. You also get type errors in your tests if the request client gets updated.
+
+Here is an example from the [Uptime Monitoring Starter](https://github.com/encoredev/examples/tree/main/uptime) where we are mocking a GET request method and spying on a POST request method:
+
+```ts
+import { render, waitForElementToBeRemoved } from "@testing-library/react";
+import App from "./App";
+import { site } from "./client";
+import { userEvent } from "@testing-library/user-event";
+
+describe("App", () => {
+  beforeEach(() => {
+    // Return mocked data from the List (GET) endpoint
+    jest
+      .spyOn(site.ServiceClient.prototype, "List")
+      .mockReturnValue(Promise.resolve({
+        sites: [{
+          id: 1,
+          url: "test.dev"
+        }]
+      }));
+
+    // Spy on the Add (POST) endpoint
+    jest.spyOn(site.ServiceClient.prototype, "Add");
+  });
+
+  it("render sites", async () => {
+    render(<App />);
+    await waitForElementToBeRemoved(() => screen.queryByText("Loading..."));
+
+    // Verify that the List endpoint has been called
+    expect(site.ServiceClient.prototype.List).toBeCalledTimes(1);
+
+    // Verify that the sites are rendered with our mocked data
+    screen.getAllByText("test.dev");
+  });
+
+  it("add site", async () => {
+    render(<App />);
+    await waitForElementToBeRemoved(() => screen.queryByText("Loading..."));
+
+    // Interact with the page and add 'another.com'
+    await userEvent.click(screen.getByText("Add website"));
+    await userEvent.type(
+      screen.getByPlaceholderText("google.com"),
+      "another.com",
+    );
+    await userEvent.click(screen.getByText("Save"));
+
+    // Verify that the Add endpoint has been called with the correct parameters
+    expect(site.ServiceClient.prototype.Add).toHaveBeenCalledWith({
+      url: "another.com",
+    });
+  });
+})
+```
+
+<Callout type="info">
+
+  In the example above we need to mock the `List` method on `site.ServiceClient.prototype` because the request client has not
+  yet been initialized when we're creating the mock. If you have access to the instance of the request client in your test
+  (which could be the case if you are passing the client around in your components) you can instead do `jest.spyOn(client.site, "List")`
+  and `expect(client.site.List).toHaveBeenCalled()` which would give you the same result.
+
+</Callout>
+
+More examples of tests can be found in the [Uptime Monitoring Starter repo](https://github.com/encoredev/examples/tree/main/uptime).
+
+## Monorepo or Multi repo
+Encore is not opinionated about where your frontend lives, pick the approach that fits your application best.
+
+If you use a monorepo then it is often a good idea to place your backend and frontend in separate folders. There are two approaches to moving your Encore backend to a subfolder:
+
+1. Place your microservices together with the `encore.app` file in a subfolder. When moving `encore.app` to a subfolder you will need to configure the "Root Directory" in app settings in the [Encore Cloud dashboard](https://app.encore.cloud).
+2. Place your microservices in a subfolder and keep the `encore.app` in the repo root directory. No configuration change is needed, but you will need to update the import paths if your services are calling each other.
+
+## REST vs. GraphQL
+Encore allows for building backends using both REST and GraphQL, you should pick the approach that suits your use case best.
+
+Take a look at the [GraphQL tutorial](/docs/go/tutorials/graphql) for an example of building a GraphQL backend with Encore.
+
+## Hosting a frontend on Encore for development
+Encore is primarily designed for backend development and does not (at the moment) support building or testing frontends in the deploy pipeline. For production use, we recommend that you deploy your frontend using Vercel, Netlify, or a similar service.
+
+For development purposes, you can create a `raw` endpoint that serves static frontend assets. It would look something like the example below (taken from the [Uptime Monitoring tutorial](https://encore.dev/docs/go/tutorials/uptime)), but keep in mind that you need to have the compiled frontend assets under version control (`dist` folder in the example below).
+
+```go
+package frontend
+
+import (
+	"embed"
+	"io/fs"
+	"net/http"
+)
+
+var (
+	//go:embed dist
+	dist embed.FS
+
+	assets, _ = fs.Sub(dist, "dist")
+	handler   = http.StripPrefix("/frontend/", http.FileServer(http.FS(assets)))
+)
+
+ //encore:api public raw path=/frontend/*path
+ func Serve(w http.ResponseWriter, req *http.Request) {
+	 handler.ServeHTTP(w, req)
+ }
+```
+
+## Handling CORS
+If you are running into CORS issues when calling your Encore API from your frontend you may need to specify which origins are allowed to access your API (via browsers). Do this by specifying the `global_cors` key in the `encore.app` file, which has the following structure:
+
+```json
+global_cors: {
+  // allow_origins_without_credentials specifies the allowed origins for requests
+  // that don't include credentials. If nil it defaults to allowing all domains
+  // (equivalent to ["*"]).
+  "allow_origins_without_credentials": [
+    "<ORIGIN-GOES-HERE>"
+  ],
+
+  // allow_origins_with_credentials specifies the allowed origins for requests
+  // that include credentials. If a request is made from an Origin in this list
+  // Encore responds with Access-Control-Allow-Origin: <Origin>.
+  //
+  // The URLs in this list may include wildcards (e.g. "https://*.example.com"
+  // or "https://*-myapp.example.com").
+  "allow_origins_with_credentials": [
+    "<DOMAIN-GOES-HERE>"
+  ]
+}
+```
+
+See more in the [CORS docs](/docs/go/develop/cors).
diff --git a/docs/go/how-to/logto-auth.md b/docs/go/how-to/logto-auth.md
new file mode 100644
index 0000000000..8d155e25ac
--- /dev/null
+++ b/docs/go/how-to/logto-auth.md
@@ -0,0 +1,324 @@
+---
+seotitle: How to use Logto for your backend application
+seodesc: Learn how to use Logto for user authentication in your backend application. In this guide we show you how to integrate your Go backend with Logto.
+title: Use Logto with your app
+lang: go
+---
+
+[Logto](https://logto.io) is a modern Auth0 alternative that helps you build the sign-in experience and user identity within minutes. It's particularly well-suited for protecting API services built with Encore.
+
+This guide will show you how to integrate Logto with your Encore application to add authentication and authorization capabilities. You can find the complete [Logto example](https://github.com/encoredev/examples/tree/main/logto-react-sdk) in our examples repo.
+
+## Logto settings
+
+Before we begin integrating with Encore, you'll need to set up a few things in Logto:
+
+1. Create an account at [Logto Cloud](https://cloud.logto.io) if you don't have one yet.
+
+2. Create an API Resource in Logto Console, this represents your Encore API service
+   - Go to "API Resources" in Logto Console and create a new API
+   - Set a name and API identifier (e.g., `https://api.encoreapp.com`)
+   - Note down the API identifier on the API resource details page as we'll need it later
+  
+  <img src="/assets/docs/logto-api-resource.png" title="Logto API Resource"/>
+
+3. Create an application for your frontend application
+  - Go to "Applications" in Logto Console
+  - Create a new application according to your frontend framework (We use React as an example, but you can create any Single-Page Application (SPA) or native app)
+  - (Optional, we'll cover this later) Integrate Logto with your frontend application according to the guide in the Logto Console.
+  - Note down the application ID and issuer URL on the Application details page as we'll need them later
+
+  <img src="/assets/docs/logto-application-endpoints.png" title="Logto application endpoints"/>
+
+## Setup the auth handler
+
+Now let's implement the authentication in your Encore application. We'll use Encore's built-in [auth handler](/docs/go/develop/auth) to validate Logto's JWT tokens.
+
+Add these two modules in your Encore application:
+
+```shell
+$ go get github.com/golang-jwt/jwt/v5
+$ go get github.com/MicahParks/keyfunc/v3
+```
+
+Create `auth/auth.go` and add the following code:
+
+```go
+package auth
+
+import (
+	"context"
+	"time"
+
+	"encore.dev/beta/auth"
+	"encore.dev/beta/errs"
+	"encore.dev/config"
+	"github.com/MicahParks/keyfunc/v3"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// Configuration variables for authentication
+type LogtoAuthConfig struct {
+	// The issuer URL
+	Issuer config.String
+	// URL to fetch JSON Web Key Set (JWKS)
+	JwksUri config.String
+	// Expected audience for the JWT
+	ApiResourceIndicator config.String
+	// Expected client ID in the token claims
+	ClientId config.String
+}
+
+var authConfig *LogtoAuthConfig = config.Load[*LogtoAuthConfig]()
+
+// RequiredClaims defines the expected structure of JWT claims
+// Extends the standard JWT claims with a custom ClientID field
+type RequiredClaims struct {
+	ClientID string `json:"client_id"`
+	jwt.RegisteredClaims
+}
+
+// AuthHandler validates JWT tokens and extracts the user ID
+// Implements Encore's authentication handler interface
+//
+//encore:authhandler
+func AuthHandler(ctx context.Context, token string) (auth.UID, error) {
+	// Fetch and parse the JWKS (JSON Web Key Set) from the identity provider
+	jwks, err := keyfunc.NewDefaultCtx(ctx, []string{authConfig.JwksUri()})
+	if err != nil {
+		return "", &errs.Error{
+			Code:    errs.Internal,
+			Message: "failed to fetch JWKS",
+		}
+	}
+
+	// Parse and validate the JWT token with required claims and validation options
+	parsedToken, err := jwt.ParseWithClaims(
+		token,
+		&RequiredClaims{},
+		jwks.Keyfunc,
+		// Expect the token to be intended for this API resource
+		jwt.WithAudience(authConfig.ApiResourceIndicator()),
+		// Expect the token to be issued by this issuer
+		jwt.WithIssuer(authConfig.Issuer()),
+		// Allow some leeway for clock skew
+		jwt.WithLeeway(time.Minute*10),
+	)
+
+	// Check if there were any errors during token parsing
+	if err != nil {
+		return "", &errs.Error{
+			Code:    errs.Unauthenticated,
+			Message: "invalid token",
+		}
+	}
+
+	// Verify that the client ID in the token matches the expected client ID
+	if parsedToken.Claims.(*RequiredClaims).ClientID != authConfig.ClientId() {
+		return "", &errs.Error{
+			Code:    errs.Unauthenticated,
+			Message: "invalid token",
+		}
+	}
+
+	// Extract the user ID (subject) from the token claims
+	userId, err := parsedToken.Claims.GetSubject()
+	if err != nil {
+		return "", &errs.Error{
+			Code:    errs.Unauthenticated,
+			Message: "invalid token",
+		}
+	}
+
+	// Return the user ID as an Encore auth.UID
+	return auth.UID(userId), nil
+}
+```
+
+Create a [configuration file](https://encore.dev/docs/go/develop/config) in the auth service and name it `auth-config.cue`. Add the following:
+
+```cue
+Issuer: "<your-logto-issuer-url>"
+JwksUri: "<your-logto-issuer-url>/jwks"
+ApiResourceIndicator: "<your-api-resource-indicator>"
+ClientId: "<your-client-id>"
+```
+
+Replace the values with the ones you noted down from your Logto settings:
+- `<your-logto-issuer-url>`: The issuer URL from your Logto application endpoints (e.g., `https://your-tenant.logto.app`)
+- `<your-api-resource-indicator>`: The API identifier you set when creating the API resource (e.g., `https://api.encoreapp.com`)
+- `<your-client-id>`: The application ID from your Logto application details page
+
+For example, your `auth-config.cue` might look like:
+
+```cue
+Issuer: "https://your-tenant.logto.app"
+JwksUri: "https://your-tenant.logto.app/jwks"
+ApiResourceIndicator: "https://api.encoreapp.com"
+ClientId: "2gadf3mp0zotlq8j1k5x"
+```
+
+And then, you can use this auth handler to protect your API endpoints:
+
+```go
+package api
+
+import (
+	"context"
+	"fmt"
+
+	"encore.dev/beta/auth"
+	"encore.dev/beta/errs"
+)
+
+//encore:api auth path=/api/hello
+func Api(ctx context.Context) (*Response, error) {
+	userId, hasUserId := auth.UserID()
+
+	if !hasUserId {
+		return nil, &errs.Error{
+			Code:    errs.Internal,
+			Message: "User ID not found",
+		}
+	}
+
+	msg := fmt.Sprintf("Hello, %s!", userId)
+
+	return &Response{Message: msg}, nil
+}
+
+type Response struct {
+	Message string
+}
+
+```
+
+## Frontend
+
+We've completed our work in the Encore API service. Now we need to integrate Logto with our frontend application.
+
+You can choose the framework you are using in the [Logto Quick start](https://docs.logto.io/quick-starts) page to integrate Logto with your frontend application. In this guide we use React as an example.
+
+Check out the [Add authentication to your React application](https://docs.logto.io/quick-starts/react) guide to learn how to integrate Logto with your React application. In this example, you only need to complete up to the Integration section. After that, we'll demonstrate how the frontend application can obtain an access token from Logto to access the Encore API.
+
+First, update your `LogtoConfig` by adding the API resource used in your Encore app to the `resources` field. This tells Logto that we will be requesting access tokens for this API resource (Encore API).
+
+```ts
+import { LogtoConfig } from '@logto/react';
+
+const config: LogtoConfig = {
+  // ...other configs
+  resources: ['<your-api-resource-indicator>'],
+};
+```
+
+After updating the `LogtoConfig`, if a user is already signed in, they need to sign out and sign in again for the new `LogtoConfig` settings to take effect.
+
+Once the user is logged in, you can use the `getAccessToken` method provided by the Logto React SDK to obtain an access token for accessing specific API resources. For example, to access the Encore API, we use `https://api.encoreapp.com` as the API resource identifier.
+
+Then, add this access token to the request headers as the `Authorization` field in subsequent requests.
+
+```ts
+const { getAccessToken } = useLogto();
+const accessToken = await getAccessToken('<your-api-resource-indicator>');
+
+// Add this access token to the request headers as the 'Authorization' field in subsequent requests
+fetch('<your-encore-api-endpoint>/hello', {
+  headers: {
+    Authorization: `Bearer ${accessToken}`,
+  },
+});
+```
+
+Here's the key frontend code:
+
+```tsx
+-- config/logto.tsx --
+import { LogtoConfig } from '@logto/react'
+
+export const config: LogtoConfig = {
+  endpoint: '<your-logto-endpoint>',
+  appId: '<your-app-id>',
+  resources: ['<your-api-resource-indicator>'],
+}
+
+export const appConfig = {
+  apiResourceIndicator: '<your-api-resource-indicator>',
+  signInRedirectUri: '<your-sign-in-redirect-uri>',
+  signOutRedirectUri: '<your-sign-out-redirect-uri>',
+}
+
+export const encoreApiEndpoint = '<your-encore-api-endpoint>'
+-- pages/ProtectedResource.tsx --
+import { useLogto } from "@logto/react";
+import { useState } from "react";
+import { Navigate } from "react-router-dom";
+import { appConfig, encoreApiEndpoint } from "../config/logto";
+
+export function ProtectedResource() {
+  const { isAuthenticated, getAccessToken } = useLogto();
+  const [message, setMessage] = useState("");
+  const [isLoading, setIsLoading] = useState(false);
+  const [error, setError] = useState("");
+
+  const fetchProtectedResource = async () => {
+    setIsLoading(true);
+    setError("");
+    try {
+      const accessToken = await getAccessToken(appConfig.apiResourceIndicator);
+      const response = await fetch(`${encoreApiEndpoint}/api/hello`, {
+        headers: {
+          Authorization: `Bearer ${accessToken}`,
+        },
+      });
+      if (!response.ok) {
+        throw new Error(`HTTP error! status: ${response.status}`);
+      }
+      const data = await response.json();
+      setMessage(JSON.stringify(data));
+    } catch (error) {
+      console.error("Error fetching protected resource:", error);
+      setError("Failed to fetch protected resource. Please try again.");
+    } finally {
+      setIsLoading(false);
+    }
+  };
+
+  if (!isAuthenticated) {
+    return <Navigate to="/" replace />;
+  }
+
+  return (
+    <div>
+      <h2>Protected Resource</h2>
+
+      {message && !error && (
+        <div>
+          <h3>Response from Protected API</h3>
+          <pre>{message}</pre>
+        </div>
+      )}
+
+      <button
+        onClick={fetchProtectedResource}
+        disabled={isLoading}
+      >
+        {isLoading ? "Loading..." : "Fetch protected resource"}
+      </button>
+
+      {error && <div>{error}</div>}
+    </div>
+  );
+}
+```
+
+That's it, you've successfully integrated Logto with your Encore application.
+
+You can find the complete example code [here](https://github.com/encoredev/examples/tree/main/logto-react-sdk).
+
+## Explore more
+
+If you want to use more Logto features, you can refer to the following links for more information:
+
+- Combine Logto's [Custom token claims](https://docs.logto.io/developers/custom-token-claims) to set [custom user data](/docs/go/develop/auth#with-custom-user-data) in the auth handler
+- Use [Logto RBAC features](https://docs.logto.io/authorization/role-based-access-control) to add authorization support to your application. The React integration tutorial also demonstrates how to add `scope` information to your Access token (note that you need to sign in again after updating Logto config)
diff --git a/docs/go/how-to/pubsub-outbox.md b/docs/go/how-to/pubsub-outbox.md
new file mode 100644
index 0000000000..e2a72f38c9
--- /dev/null
+++ b/docs/go/how-to/pubsub-outbox.md
@@ -0,0 +1,124 @@
+---
+seotitle: Using a transactional Pub/Sub outbox
+seodesc: Learn how you can use a transactional outbox with Pub/Sub to guarantee consistency between your database and Pub/Sub subscribers
+title: Transactional Pub/Sub outbox
+subtitle: Guarantee consistency between your database and Pub/Sub subscribers
+lang: go
+---
+
+One of the hardest parts of building an event-driven application is ensuring consistency between services.
+A common pattern is for each service to have its own database and use Pub/Sub to notify other systems of business events.
+Inevitably this leads to inconsistencies since the Pub/Sub publishing is not transactional with the database writes.
+
+While there are several approaches to solving this, it's important the solution doesn't add too much complexity
+to what is often an already complex architecture. Perhaps the best solution in this regard is the [transactional outbox pattern](https://softwaremill.com/microservices-101/).
+
+Encore provides support for the transactional outbox pattern in the [x.encore.dev/infra/pubsub/outbox](https://pkg.go.dev/x.encore.dev/infra/pubsub/outbox) package.
+
+The transactional outbox works by binding a Pub/Sub topic to a database transaction, translating all calls to `topic.Publish`
+into inserting a database row in an `outbox` table. If/when the transaction later commits, the messages are picked up by
+a [Relay](https://pkg.go.dev/x.encore.dev/infra/pubsub/outbox#Relay) that polls the `outbox` table and publishes the
+messages to the actual Pub/Sub topic.
+
+## Publishing messages to the outbox
+
+To publish messages to the outbox, a topic must first be bound to the outbox. This is done using
+[Pub/Sub topic references](/docs/go/primitives/pubsub#using-topic-references) which allows you to retain complete
+type safety and the same interface as regular Pub/Sub topics, allowing existing code to continue to work without changes.
+
+<Callout type="info">
+
+In regular (non-outbox) usage the message id returned by `topic.Publish` is the same as the message id the subscriber
+receives when processing the message. With the outbox, this message id is not available until the transaction commits,
+so `topic.Publish` returns an id referencing the outbox row instead.
+
+</Callout>
+
+
+The topic binding supports pluggable storage backends, enabling use of the outbox pattern with any
+transactional storage backend. Implementation are provided out-of-the-box for use with Encore's
+`encore.dev/storage/sqldb` package, as well as the standard library `database/sql` and `github.com/jackc/pgx/v5` drivers,
+but it's easy to write your own for other use cases.
+See the [Go package reference](https://pkg.go.dev/x.encore.dev/infra/pubsub/outbox#PersistFunc) for more information.
+
+For example, to use a transactional outbox to notify subscribers when a user is created:
+
+```go
+-- outbox.go --
+// Create a SignupsTopic somehow.
+var SignupsTopic = pubsub.NewTopic[*SignupEvent](/* ... */)
+
+// Create a topic ref with publisher permissions.
+ref := pubsub.TopicRef[pubsub.Publisher[*SignupEvent]](SignupsTopic)
+
+// Bind it to the transactional outbox
+import "x.encore.dev/infra/pubsub/outbox"
+var tx *sqldb.Tx // somehow get a transaction
+ref = outbox.Bind(ref, outbox.TxPersister(tx))
+
+// Calls to ref.Publish() will now insert a row in the outbox table.
+
+-- db_migration.sql --
+-- The database used must contain the below database table:
+-- See https://pkg.go.dev/x.encore.dev/infra/pubsub/outbox#SQLDBStore
+CREATE TABLE outbox (
+    id BIGSERIAL PRIMARY KEY,
+    topic TEXT NOT NULL,
+    data JSONB NOT NULL,
+    inserted_at TIMESTAMPTZ NOT NULL
+);
+CREATE INDEX outbox_topic_idx ON outbox (topic, id);
+```
+
+Once the transaction commits any published messages via `ref` above will be stored in the `outbox` table.
+
+## Consuming messages from the outbox
+
+Once committed, the messages are ready to be picked up and published to the actual Pub/Sub topic.
+
+That is done via the [Relay](https://pkg.go.dev/x.encore.dev/infra/pubsub/outbox#Relay).
+The relay continuously polls the `outbox` table and publishes any new messages to the actual Pub/Sub topic.
+
+The relay supports pluggable storage backends, enabling use of the outbox pattern with any
+transactional storage backend. An implementation is provided out-of-the-box that uses Encore's built-in
+[SQL database support](https://pkg.go.dev/x.encore.dev/infra/pubsub/outbox#SQLDBStore),
+but it's easy to write your own for other databases.
+
+The topics to poll must be registered with the relay, typically during service initialization. For example:
+
+```go
+-- user/service.go --
+package user
+
+import (
+	"context"
+	
+    "encore.dev/pubsub"
+    "encore.dev/storage/sqldb"
+    "x.encore.dev/infra/pubsub/outbox"
+)
+
+type Service struct {
+	signupsRef pubsub.Publisher[*SignupEvent]
+}
+
+// db is the database the outbox table is stored in
+var db = sqldb.NewDatabase(...)
+
+// Create the SignupsTopic somehow.
+var SignupsTopic = pubsub.NewTopic[*SignupEvent](/* ... */)
+
+func initService() (*Service, error) {
+    // Initialize the relay to poll from our database.
+	relay := outbox.NewRelay(outbox.SQLDBStore(db))
+	
+	// Register the SignupsTopic to be polled.
+    signupsRef := pubsub.TopicRef[pubsub.Publisher[*SignupEvent]](SignupsTopic)
+	outbox.RegisterTopic(relay, signupsRef)
+	
+	// Start polling.
+	go relay.PollForMessage(context.Background(), -1)
+	
+	return &Service{signupsRef: signupsRef}, nil
+}
+```
diff --git a/docs/go/how-to/temporal.md b/docs/go/how-to/temporal.md
new file mode 100644
index 0000000000..bc35667889
--- /dev/null
+++ b/docs/go/how-to/temporal.md
@@ -0,0 +1,221 @@
+---
+seotitle: How to use Temporal and Encore
+seodesc: Learn how to use Temporal for reliable workflow execution with Encore.
+title: Use Temporal with Encore
+lang: go
+---
+
+[Temporal](https://temporal.io) is a workflow orchestration system for building highly reliable systems.
+Encore works great with Temporal, and this guide shows you how to integrate Temporal into your Encore application.
+
+## Set up Temporal clusters
+You'll need at least two Temporal clusters: one for local development and one for cloud environments.
+
+We recommend using [Temporalite](https://github.com/temporalio/temporalite) for local development,
+and [Temporal Cloud](https://temporal.io/cloud) for cloud environments. 
+
+## Set up Temporal Workflow
+
+Next it's time to create a Temporal Workflow. We'll base this on the Temporal [Hello World](https://learn.temporal.io/getting_started/go/hello_world_in_go/)
+example.
+
+Create a new Encore service named `greeting`:
+
+```go
+-- greeting/greeting.go --
+package greeting
+
+import (
+	"context"
+	"fmt"
+
+	"go.temporal.io/sdk/client"
+	"go.temporal.io/sdk/worker"
+	"encore.dev"
+)
+
+// Use an environment-specific task queue so we can use the same
+// Temporal Cluster for all cloud environments.
+var (
+    envName = encore.Meta().Environment.Name
+    greetingTaskQueue = envName + "-greeting"
+)
+
+//encore:service
+type Service struct {
+	client client.Client
+	worker worker.Worker
+}
+
+func initService() (*Service, error) {
+	c, err := client.Dial(client.Options{})
+	if err != nil {
+		return nil, fmt.Errorf("create temporal client: %v", err)
+	}
+
+	w := worker.New(c, greetingTaskQueue, worker.Options{})
+
+	err = w.Start()
+	if err != nil {
+		c.Close()
+		return nil, fmt.Errorf("start temporal worker: %v", err)
+	}
+	return &Service{client: c, worker: w}, nil
+}
+
+func (s *Service) Shutdown(force context.Context) {
+	s.client.Close()
+	s.worker.Stop()
+}
+```
+
+Next it's time to define some workflows. These need to be in the same service,
+so add a new `workflow` package inside the `greeting` service, containing
+a workflow and activity definition in separate files:
+
+```go
+-- greeting/workflow/workflow.go --
+package workflow
+
+import (
+	"time"
+
+	"go.temporal.io/sdk/workflow"
+)
+
+func Greeting(ctx workflow.Context, name string) (string, error) {
+    options := workflow.ActivityOptions{
+        StartToCloseTimeout: time.Second * 5,
+    }
+
+    ctx = workflow.WithActivityOptions(ctx, options)
+
+    var result string
+    err := workflow.ExecuteActivity(ctx, ComposeGreeting, name).Get(ctx, &result)
+
+    return result, err
+}
+-- greeting/workflow/activity.go --
+package workflow
+
+import (
+	"context"
+	"fmt"
+)
+
+func ComposeGreeting(ctx context.Context, name string) (string, error) {
+    greeting := fmt.Sprintf("Hello %s!", name)
+    return greeting, nil
+}
+```
+
+Then, go back to the `greeting` service and register the workflow and activity:
+
+```go
+-- greeting/greeting.go --
+// Import the package at the top:
+import "encore.app/greeting/workflow"
+
+// Add these lines to `initService`, below the call to `worker.New`:
+w.RegisterWorkflow(workflow.Greeting)
+w.RegisterActivity(workflow.ComposeGreeting)
+```
+
+Now let's create an Encore API that triggers this workflow.
+
+Add a new file `greeting/greet.go`:
+
+```go
+-- greeting/greet.go --
+package greeting
+
+import (
+	"context"
+
+	"encore.app/greeting/workflow"
+	"encore.dev/rlog"
+	"go.temporal.io/sdk/client"
+)
+
+type GreetResponse struct {
+    Greeting string
+}
+
+//encore:api public path=/greet/:name
+func (s *Service) Greet(ctx context.Context, name string) (*GreetResponse, error) {
+    options := client.StartWorkflowOptions{
+        ID:        "greeting-workflow",
+        TaskQueue: greetingTaskQueue,
+    }
+    we, err := s.client.ExecuteWorkflow(ctx, options, workflow.Greeting, name)
+    if err != nil {
+        return nil, err
+    }
+    rlog.Info("started workflow", "id", we.GetID(), "run_id", we.GetRunID())
+
+    // Get the results
+    var greeting string
+    err = we.Get(ctx, &greeting)
+    if err != nil {
+        return nil, err
+    }
+    return &GreetResponse{Greeting: greeting}, nil
+}
+```
+
+## Run it locally
+
+Now we're ready to test it out. Start up `temporalite` and your Encore application (in separate terminals):
+
+```bash
+$ temporalite start --namespace default
+$ encore run
+```
+
+Now try calling it, either from the [Local Development Dashboard](/docs/go/observability/dev-dash) or using cURL:
+
+```bash
+$ curl 'http://localhost:4000/greeting/Temporal'
+{"Greeting": "Hello Temporal!"}
+```
+
+If you see this, it works!
+
+## Run in the cloud
+
+To run it in the cloud, you will need to use Temporal Cloud or your own, self-hosted Temporal cluster.
+The easiest way to automatically pick up the correct cluster address is to use Encore's [config functionality](/docs/go/develop/config).
+
+Add two new files:
+```
+-- greeting/config.go --
+package greeting
+
+import "encore.dev/config"
+
+type Config struct {
+    TemporalServer string
+}
+
+var cfg = config.Load[*Config]()
+-- greeting/config.cue --
+package greeting
+
+TemporalServer: [
+	// These act as individual case statements
+    if #Meta.Environment.Cloud == "local" { "localhost:7233" },
+
+    // TODO: configure this to match your own cluster address
+    "my.cluster.address:7233",
+][0] // Return the first value which matches the condition
+```
+
+Finally go back to `greeting/greeting.go` and update the `client.Dial` call to look like:
+
+```go
+-- greeting/greeting.go --
+client.Dial(client.Options{HostPort: cfg.TemporalServer})
+```
+
+With that, Encore will automatically connect to the correct Temporal cluster, using a local cluster
+for local development and your cloud-hosted cluster for everything else.
diff --git a/docs/go/install.md b/docs/go/install.md
new file mode 100644
index 0000000000..b0ae9d652c
--- /dev/null
+++ b/docs/go/install.md
@@ -0,0 +1,47 @@
+---
+seotitle: Install Encore to start building
+seodesc: See how you can install Encore on all platforms, and get started building your next backend application in minutes.
+title: Installation
+subtitle: Install the Encore CLI to get started with local development
+lang: go
+---
+
+If you are new to Encore, we recommend following the [quick start guide](/docs/go/quick-start).
+
+## Install the Encore CLI
+To develop locally with Encore, you first need to install the Encore CLI.
+This is what provisions your local development environment, and runs your Local Development Dashboard complete with logs, tracing, and API documentation.
+
+
+<InstallInstructions />
+
+<Callout type="info">
+
+To locally run Encore apps with databases, you also need to have [Docker](https://www.docker.com) installed and running.
+
+</Callout>
+
+### Optional: Add Encore LLM instructions
+
+To help LLM powered tools like Cursor and GitHub Copilot understand how to use Encore, you can add pre-made instructions to your app.
+
+Download the [go_llm_instructions.txt](https://github.com/encoredev/encore/blob/main/go_llm_instructions.txt) file.
+  
+  **How to use:**
+  - Cursor: Rename the file to `.cursorrules`.
+  - GitHub Copilot: Paste content in `.github/copilot-instructions.md`.
+  - For other tools, place the file in your app root.
+
+### Build from source
+If you prefer to build from source, [follow these instructions](https://github.com/encoredev/encore/blob/main/CONTRIBUTING.md).
+
+
+## Update to the latest version
+Check which version of Encore you have installed by running `encore version` in your terminal.
+It should print something like:
+```shell
+encore version v1.28.0
+```
+
+If you think you're on an older version of Encore, you can easily update to the latest version by running
+`encore version update` from your terminal.
diff --git a/docs/go/migration/migrate-away.md b/docs/go/migration/migrate-away.md
new file mode 100644
index 0000000000..654a70f3ab
--- /dev/null
+++ b/docs/go/migration/migrate-away.md
@@ -0,0 +1,57 @@
+---
+title: Migrate away from Encore
+subtitle: If you love someone, set them free.
+lang: go
+---
+
+_We realize most people read this page before even trying Encore, so we start with a perspective on how you might reason about adopting Encore. Read on to see what tools are available for migrating away._
+
+Picking technologies for your project is an important decision. It's tricky because you don't know what the requirements are going to look like in the future. This uncertainty makes many teams opt for maximum flexibility, often without acknowledging this has a significant negative effect on productivity.
+
+When designing Encore, we've leaned on standardization to provide a well-integrated and highly productive development workflow. The design is based on the core team's experience building scalable distributed systems at Spotify and Google, complemented with loads of invaluable input from the developer community. 
+
+In practise Encore is opinionated only in certain areas which are critical for enabling the static analysis used to create Encore's application model. This is fundamental to how Encore can provide its powerful features, like automatically instrumenting distributed tracing, and provisioning and managing cloud infrastructure.
+
+## Accommodating for your unique requirements
+
+Many software projects end up having a few novel requirements, which are highly specific to the problem domain. To accommodate for this, Encore is designed to let you go outside of the standardized Backend Framework when you need to, for example:
+- You can drop down in abstraction level in the API framework using [raw endpoints](/docs/go/primitives/defining-apis#raw-endpoints)
+- You can use tools like the [Terraform provider](/docs/platform/integrations/terraform) to integrate infrastructure that is not managed by Encore
+
+## Mitigating risk through Open Source and efficiency
+
+We believe that adopting Encore is a low-risk decision for several reasons:
+
+- There's no upfront investment needed to get the benefits
+- Encore apps are normal programs where less than 1% of the code is Encore-specific
+- All infrastructure and data is in your own cloud
+- It's simple to integrate with cloud services and systems not natively supported by Encore
+- Everything you need to develop your application is Open Source, including the [parser](https://github.com/encoredev/encore/tree/main/v2/parser), [compiler](https://github.com/encoredev/encore/tree/main/v2/compiler), [runtime](https://github.com/encoredev/encore/tree/main/runtimes)
+- Everything you need to self-host your application is [Open Source and documented](/docs/go/self-host/docker-build)
+
+## What to expect when migrating away
+
+If you want to migrate away, we want to ensure this is as smooth as possible! Here are some of the ways Encore is designed to keep your app portable, with minimized lock-in, and the tools provided to aid in migrating away.
+
+### Code changes
+
+Building with Encore doesn't require writing your entire application in an Encore-specific way. Encore applications are normal programs where only 1% of the code is specific to Encore's Open Source Backend Framework.
+
+This means that the changes required to stop using the Backend Framework is almost exactly the same work you would have needed to do if you hadn't used Encore in the first place, e.g. writing infrastructure boilerplate. There is no added migration cost.
+
+### Deployment
+
+If you are self-hosting your application, then you're already done.
+
+If you are using Encore Cloud Platform to manage deployments and want to migrate to your own solution, you can use the `encore build docker` command to produce a Docker image, containing the compiled application, using exactly the same code path as Encore's CI system to ensure compatibility.
+
+Learn more in the [self-hosting docs](/docs/go/self-host/docker-build).
+
+### Tell us what you need
+
+We're engineers ourselves and we understand the importance of not being constrained by a single technology.
+
+We're working every single day on making it even easier to start, <i>and stop</i>, using Encore.
+If you have specific concerns, questions, or requirements, we'd love to hear from you!
+
+Please reach out on [Discord](https://encore.dev/discord) or [send an email](mailto:hello@encore.dev) with your thoughts.
diff --git a/docs/go/observability/dev-dash.md b/docs/go/observability/dev-dash.md
new file mode 100644
index 0000000000..3081ce58d2
--- /dev/null
+++ b/docs/go/observability/dev-dash.md
@@ -0,0 +1,29 @@
+---
+seotitle: Development dashboard for local development
+seodesc: Encore's Local Development Dashboard comes with build-in distributed tracing, API docs, and real-time architecture diagrams.
+title: Local Development Dashboard
+subtitle: Built-in tools for simplicity and productivity
+lang: go
+---
+
+Encore provides an efficient local development workflow that automatically provisions [local infrastructure](/docs/platform/infrastructure/infra#local-development) and supports automated testing with dedicated test infrastructure.
+
+The local environment also comes with a built-in Local Development Dashboard to simplify development and improve productivity. It has several features to help you design, develop, and debug your application:
+
+* [Service Catalog](/docs/go/observability/service-catalog) with Automatic API Documentation
+* API Explorer to call your APIs
+* [Distributed Tracing](/docs/go/observability/tracing) for simple and powerful debugging
+* [Encore Flow](/docs/go/observability/encore-flow) for visualizing your microservices architecture
+
+All these features update in real-time as you make changes to your application.
+
+To access the dashboard, start your Encore application with `encore run` and it will open automatically. You can also follow the link in your terminal:
+
+```bash
+$ encore run
+API Base URL:      http://localhost:4000
+Dev Dashboard URL: http://localhost:9400/hello-world-cgu2
+```
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/localdashvideo.mp4" className="w-full h-full" type="video/mp4" />
+</video>
diff --git a/docs/go/observability/encore-flow.md b/docs/go/observability/encore-flow.md
new file mode 100644
index 0000000000..844d79be0e
--- /dev/null
+++ b/docs/go/observability/encore-flow.md
@@ -0,0 +1,50 @@
+---
+seotitle: Encore Flow automatic microservices architecture diagrams
+seodesc: Visualize your microservices architecture automatically using Encore Flow. Get real-time interactive architecture diagrams for your entire application.
+title: Flow Architecture Diagram
+subtitle: Visualize your cloud microservices architecture
+lang: go
+---
+
+Flow is a visual tool that gives you an always up-to-date view of your entire system, helping you reason about your
+microservices architecture and identify which services depend on each other and how they work together.
+
+## Birds-eye view
+
+Having access to a zoomed out representation of your system can be invaluable in pretty much all parts of the
+development cycle. Flow helps you:
+
+* Track down bottlenecks before they grow into big problems.
+* Get new team members onboarded much faster.
+* Pinpoint hot paths in your system, services that might need extra attention.
+
+Services and PubSub topics are represented as boxes, arrows indicate a dependency. In the example below
+the `login` service has dependencies on the `user` and `authentication` services. Dashed arrows shows publications or
+subscriptions to a topic. Here, `payment` publishes to the `payment-made` topic and `email` subscribe to it:
+
+<img src="/assets/docs/flow-diagram.png" title="Encore Flow - Highlight Dependencies" />
+
+## Highlight dependencies
+
+Hover over a service, or PubSub topic, to instantly reveal the nature and scale of its dependencies.
+
+Here the `login` service and its dependencies are highlighted. We can see that `login` makes queries to the
+database and requests to two of the endpoints from the `user` service as well as requests to one endpoint from
+the `authentication` service:
+
+<img src="/assets/docs/flow-highlight.png" title="Encore Flow - Highlight Dependencies" />
+
+## Real-time updates
+
+Flow is accessible in the [Local Development Dashboard](/docs/go/observability/dev-dash) and, when using Encore Cloud, in the [Encore Cloud dashboard](https://app.encore.cloud) for cloud environments.
+
+When developing locally, Flow will auto update in real-time to reflect your architecture as you
+make code changes. This helps you be mindful of important dependencies and makes it clear if you introduce new ones.
+
+For cloud environments, Flow auto-updates with each deploy.
+
+In the example below a new subscription on the topic `payment-made` is introduced and then removed in `user` service:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/flow-auto-update.mp4" className="w-full h-full" type="video/mp4" />
+</video>
diff --git a/docs/go/observability/logging.md b/docs/go/observability/logging.md
new file mode 100644
index 0000000000..5e32b8ec17
--- /dev/null
+++ b/docs/go/observability/logging.md
@@ -0,0 +1,45 @@
+---
+seotitle: Use structured logging to understand your application
+seodesc: Learn how to use structured logging, a combination of free-form log messages and type-safe key-value pairs, to understand your backend application's behavior.
+title: Logging
+subtitle: Structured logging helps you understand your application
+lang: go
+infobox: {
+  title: "Structured Logging",
+  import: "encore.dev/rlog",
+}
+---
+
+Encore offers built-in support for Structured Logging, which combines a free-form log message with structured and type-safe key-value pairs. This enables straightforward analysis of what your application is doing, in a way that is easy for a computer to parse, analyze, and index. This makes it simple to quickly filter and search through logs.
+
+Encore’s logging is integrated with the built-in [Distributed Tracing](/docs/go/observability/tracing) functionality, and all logs are automatically included in the active trace. This dramatically simplifies debugging of your application.
+
+## Usage
+First, import `encore.dev/rlog` in your package. Then simply call one of the package methods `Info`, `Error`, or `Debug`. For example:
+
+```go
+rlog.Info("log message",
+	"user_id", 12345,
+	"is_subscriber", true)
+rlog.Error("something went terribly wrong!",
+	"err", err)
+```
+
+The first parameter is the log message. After that follows zero or more key-value pairs for structured logging for context.
+
+If you’re logging many log messages with the same key-value pairs each time it can be a bit cumbersome. To help with that, use `rlog.With()` to group them into a context object, which then copies the key-value pairs into each log event:
+
+```go
+ctx := rlog.With("is_subscriber", true)
+ctx.Info("user logged in", "login_method", "oauth") // includes is_subscriber=true
+```
+
+For more information, see the [API Documentation](https://pkg.go.dev/encore.dev/rlog).
+
+## Live-streaming logs
+
+Encore also makes it simple to live-stream logs directly to your terminal, from any environment, by running:
+
+```
+$ encore logs --env=prod
+```
\ No newline at end of file
diff --git a/docs/go/observability/service-catalog.md b/docs/go/observability/service-catalog.md
new file mode 100644
index 0000000000..83347eafd3
--- /dev/null
+++ b/docs/go/observability/service-catalog.md
@@ -0,0 +1,17 @@
+---
+seotitle: Service Catalog & Generated API Docs
+seodesc: See how Encore automatically generates API documentation that always stays up to date and in sync.
+title: Service Catalog
+subtitle: Automatically get a Service Catalog and complete API docs
+lang: go
+---
+
+All developers agree API documentation is great to have, but the effort of maintaining it inevitably leads to docs becoming stale and out of date.
+
+To solve this, Encore uses the [Encore Application Model](/docs/go/concepts/application-model) to automatically generate a Service Catalog along with complete documentation for all APIs. This ensures docs are always up-to-date as your APIs evolve.
+
+The API docs are available both in your [Local Development Dashboard](/docs/go/observability/dev-dash) and for your whole team in the [Encore Cloud dashboard](https://app.encore.cloud).
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/servicecatalogvideo.mp4" className="w-full h-full" type="video/mp4" />
+</video>
diff --git a/docs/go/observability/tracing.md b/docs/go/observability/tracing.md
new file mode 100644
index 0000000000..d38b77a53f
--- /dev/null
+++ b/docs/go/observability/tracing.md
@@ -0,0 +1,39 @@
+---
+seotitle: Distributed Tracing helps you understand your app
+seodesc: See how to use distributed tracing in your backend application, across multiple services, using Encore.
+title: Distributed Tracing
+subtitle: Track requests across your application and infrastructure
+lang: go
+---
+
+Distributed systems often have many moving parts, making it difficult to understand what your code is doing and finding the root-cause to bugs. That’s where Tracing comes in. If you haven’t seen it before, it may just about change your life.
+
+Tracing is a revolutionary way to gain insight into what your applications are doing. It works by capturing the series of events as they occur during the execution of your code (a “trace”). This works by propagating a trace id between all individual systems, then correlating and joining the information together to present a unified picture of what happened end-to-end.
+
+As opposed to the labor intensive instrumentation you'd normally need to go through to use tracing, Encore automatically captures traces for your entire application – in all environments. Uniquely, this means you can use tracing even for local development to help debugging and speed up iterations.
+
+You view traces in the [Local Development Dashboard](/docs/go/observability/dev-dash) and, when using Encore Cloud, you can also see traces in the [ENcore Cloud dashboard](https://app.encore.cloud) for Production and other environments.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/tracingvideo.mp4" className="w-full h-full" type="video/mp4" />
+</video>
+
+## Encore's tracing is more comprehensive and more performant than all other tools
+
+Unlike other tracing solutions, Encore understands what each trace event is and captures unique insights about each one. This means you get access to more information than ever before:
+
+* Stack traces
+* Structured logging
+* HTTP requests
+* Network connection information
+* API calls
+* Database queries
+* etc.
+
+## Redacting sensitive data
+
+Encore's tracing automatically captures request and response payloads to simplify debugging.
+
+For cases where this is undesirable, such as for passwords or personally identifiable information (PII), Encore supports redacting fields marked as containing sensitive data.
+
+See the documentation on [API Schemas](/docs/go/primitives/defining-apis#sensitive-data) for more information.
diff --git a/docs/go/overview.md b/docs/go/overview.md
new file mode 100644
index 0000000000..637c353b05
--- /dev/null
+++ b/docs/go/overview.md
@@ -0,0 +1,97 @@
+---
+seotitle: Encore.go Introduction
+seodesc: Learn how Encore's Go Backend Framework works, and get to know the powerful features that help you build cloud backend applications faster.
+title: Encore.go
+subtitle: Use Encore.go to build robust backend applications and distributed systems
+toc: false
+lang: go
+---
+
+<div className="min-h-72 bg-blue p-8 relative overflow-hidden not-prose">
+    <img className="absolute left-[55%] -mt-8 top-0 right-0 bottom-0 noshadow" src="/assets/img/dithered-clouds.png" />
+    <div className="w-[75%] lg:w-[75%]">
+        <h2 className="text-white lead-medium">Quick Start Guide</h2>
+        <div className="body-small text-white mt-2">
+            Dive right in and build your first Encore application.
+        </div>
+        <a href="/docs/go/quick-start">
+            <Button className="mt-4" kind="primary" section="black">Get started</Button>
+        </a>
+    </div>
+</div>
+
+Encore.go is a backend framework for distributed systems that provides a declarative approach of working with essential backend primitives like APIs,microservices, databases, queues, caches, cron jobs, and storage buckets.
+
+Encore helps you build robust distributed systems and provides a smooth developer experience with a lot of built-in tooling:
+
+1. **Local Environment Management**: Automatically sets up and runs your local development environment and all local infrastructure.
+2. **Enhanced Observability**: Comes with tools like a [Local Development Dashboard](/docs/go/observability/dev-dash) and [tracing](/docs/go/observability/tracing) for monitoring application behavior.
+3. **Automatic Documentation**: Generates and maintains [up-to-date documentation](/docs/go/observability/service-catalog) for APIs and services, and created [architecture diagrams](/docs/go/observability/encore-flow) for your system.
+
+Optional: **DevOps Automation**: Encore provides an optional [Cloud Platform](/use-cases/devops-automation) for automating infrastructure provisioning and DevOps processes on AWS and GCP.
+
+<div className="mt-6 grid grid-cols-2 gap-6 mobile:grid-cols-1 not-prose">
+    <a className="block group relative no-brandient" target="_blank" href="https://www.youtube.com/watch?v=ipj1HdG4dWA">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Watch a demo video</h3>
+                <img className="-mt-2 h-16 w-16 noshadow" src="/assets/icons/features/preview-envs.png" />
+            </div>
+            <div className="mt-2">
+                See how to build an event-driven app with Encore.
+            </div>
+        </div>
+    </a>
+    <a className="block group relative no-brandient" target="_blank" href="https://github.com/encoredev/examples">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Example apps</h3>
+                <img className="-mt-2 h-16 w-16 noshadow" src="/assets/icons/features/flow.png" />
+            </div>
+            <div className="mt-2">
+                Ready-made starter apps to inspire your development.
+            </div>
+        </div>
+    </a>
+    <a className="block group relative no-brandient" href="/discord">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Join Discord</h3>
+                <div className="inline-flex w-16 h-16 items-center justify-center">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 -28.5 256 256">
+                        <path fill="#111111"
+                            d="M216.856339,16.5966031 C200.285002,8.84328665 182.566144,3.2084988 164.041564,0 C161.766523,4.11318106 159.108624,9.64549908 157.276099,14.0464379 C137.583995,11.0849896 118.072967,11.0849896 98.7430163,14.0464379 C96.9108417,9.64549908 94.1925838,4.11318106 91.8971895,0 C73.3526068,3.2084988 55.6133949,8.86399117 39.0420583,16.6376612 C5.61752293,67.146514 -3.4433191,116.400813 1.08711069,164.955721 C23.2560196,181.510915 44.7403634,191.567697 65.8621325,198.148576 C71.0772151,190.971126 75.7283628,183.341335 79.7352139,175.300261 C72.104019,172.400575 64.7949724,168.822202 57.8887866,164.667963 C59.7209612,163.310589 61.5131304,161.891452 63.2445898,160.431257 C105.36741,180.133187 151.134928,180.133187 192.754523,160.431257 C194.506336,161.891452 196.298154,163.310589 198.110326,164.667963 C191.183787,168.842556 183.854737,172.420929 176.223542,175.320965 C180.230393,183.341335 184.861538,190.991831 190.096624,198.16893 C211.238746,191.588051 232.743023,181.531619 254.911949,164.955721 C260.227747,108.668201 245.831087,59.8662432 216.856339,16.5966031 Z M85.4738752,135.09489 C72.8290281,135.09489 62.4592217,123.290155 62.4592217,108.914901 C62.4592217,94.5396472 72.607595,82.7145587 85.4738752,82.7145587 C98.3405064,82.7145587 108.709962,94.5189427 108.488529,108.914901 C108.508531,123.290155 98.3405064,135.09489 85.4738752,135.09489 Z M170.525237,135.09489 C157.88039,135.09489 147.510584,123.290155 147.510584,108.914901 C147.510584,94.5396472 157.658606,82.7145587 170.525237,82.7145587 C183.391518,82.7145587 193.761324,94.5189427 193.539891,108.914901 C193.539891,123.290155 183.391518,135.09489 170.525237,135.09489 Z" />
+                    </svg>
+                </div>
+            </div>
+            <div className="mt-2">
+                Find answers, ask questions, and chat with other Encore developers.
+            </div>
+        </div>
+    </a>
+    <a className="block group relative no-brandient" href="https://github.com/encoredev/encore">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Star on GitHub</h3>
+                <div className="inline-flex w-16 h-16 items-center justify-center">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 16 16" fill="#111111"
+                        stroke="none">
+                        <path fillRule="evenodd"
+                            d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z" />
+                    </svg>
+                </div>
+            </div>
+            <div className="mt-2">
+                Get involved and star Encore on GitHub.
+            </div>
+        </div>
+    </a>
+</div>
diff --git a/docs/go/primitives/api-calls.md b/docs/go/primitives/api-calls.md
new file mode 100644
index 0000000000..52b636389b
--- /dev/null
+++ b/docs/go/primitives/api-calls.md
@@ -0,0 +1,42 @@
+---
+seotitle: API Calls with Encore.go
+seodesc: Learn how to make type-safe API calls in Go with Encore.go
+title: API Calls
+subtitle: Making API calls is as simple as making function calls
+lang: go
+---
+
+Calling an API endpoint looks like a regular function call with Encore.go. To call an endpoint you first import the other service as a Go package using `import "encore.app/package-name"` and then call the API endpoint like a regular function. Encore will automatically generate the necessary boilerplate at compile-time.
+
+In the example below, we import the service package `hello` and call the `Ping` endpoint using a function call to `hello.Ping`.
+
+```go
+import "encore.app/hello" // import service
+
+//encore:api public
+func MyOtherAPI(ctx context.Context) error {
+    resp, err := hello.Ping(ctx, &hello.PingParams{Name: "World"})
+    if err == nil {
+        log.Println(resp.Message) // "Hello, World!"
+    }
+    return err
+}
+```
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/trello-clone" 
+    desc="Simple microservices example application with service-to-service API calls." 
+/>
+
+This means your development workflow is as simple as building a monolith, even if you use multiple services.
+You also get all the benefits of function calls, like compile-time checking of all the parameters and auto-completion in your editor, while still allowing the division of code into logical components, services, and systems.
+
+Then when building your application, Encore uses [static analysis](/docs/go/concepts/application-model) to parse all API calls and compiles them to proper API calls.
+
+## Current Request
+
+By using Encore's [current request API](https://pkg.go.dev/encore.dev/#Request) you can get meta-information about the
+current request. Including the type of request, the time the request started, the service and endpoint called and the path
+which was called on the service.
+
+For more information, see the [metadata documentation](/docs/go/develop/metadata).
diff --git a/docs/go/primitives/api-errors.md b/docs/go/primitives/api-errors.md
new file mode 100644
index 0000000000..27b300a3d2
--- /dev/null
+++ b/docs/go/primitives/api-errors.md
@@ -0,0 +1,172 @@
+---
+seotitle: API Errors – Types, Wrappers, and Codes
+seodesc: See how to return structured error information from your APIs using Encore's errs package, and how to build precise error messages for complex business logic.
+title: API Errors
+subtitle: Returning structured error information from your APIs
+infobox: {
+  title: "API Errors",
+  import: "encore.dev/beta/errs",
+}
+lang: go
+---
+
+Encore supports returning structured error information from your APIs using the [encore.dev/beta/errs](https://pkg.go.dev/encore.dev/beta/errs) package.
+
+Errors are propagated across the network to the [generated clients](/docs/go/cli/client-generation) and can be used within your front-ends without having to build any custom marshalling code.
+
+## The errs.Error type
+
+Structured errors are represented by the `errs.Error` type:
+
+```go
+type Error struct {
+	// Code is the error code to return.
+	Code ErrCode `json:"code"`
+	// Message is a descriptive message of the error.
+	Message string `json:"message"`
+	// Details are user-defined additional details.
+	Details ErrDetails `json:"details"`
+	// Meta are arbitrary key-value pairs for use within
+	// the Encore application. They are not exposed to external clients.
+	Meta Metadata `json:"-"`
+}
+```
+
+Returning an `*errs.Error` from an Encore API endpoint will result in Encore
+serializing this struct to JSON and returning it in the response. Additionally
+Encore will set the HTTP status code to match the error code (see the mapping table below).
+
+For example:
+```go
+return &errs.Error{
+	Code: errs.NotFound,
+	Message: "sprocket not found",
+}
+```
+
+Causes Encore to respond with a `HTTP 404` error with body:
+```json
+{
+    "code": "not_found",
+    "message": "sprocket not found",
+    "details": null
+}
+```
+
+## Error Wrapping
+
+Encore applications are encouraged to always use the `errs` package to
+manipulate errors. It supports wrapping errors to gradually add more error
+information, and lets you easily define both structured error details to return
+to external clients, as well as internal key-value metadata for debugging
+and error handling.
+
+```go
+func Wrap(err error, msg string, metaPairs ...interface{}) error
+```
+Use `errs.Wrap` to conveniently wrap an error, adding additional context and converting it to an `*errs.Error`.
+If `err` is nil it returns `nil`. If `err` is already an `*errs.Error` it copies the Code, Details, and Meta fields over.
+
+The variadic `metaPairs` parameter must be key-value pairs, where the key is always a `string` and the value can be
+any built-in type. Existing key-value pairs from the `err` are merged into the new `*Error`.
+
+```go
+func WrapCode(err error, code ErrCode, msg string, metaPairs ...interface{}) error
+```
+`errs.WrapCode` is like `errs.Wrap` but also sets the error code.
+
+```go
+func Convert(err error) error
+```
+`errs.Convert` converts an error to an `*errs.Error`. If the error is already an `*errs.Error` it returns it unmodified.
+If `err` is nil it returns nil.
+
+## Error Codes
+
+The `errs` package defines error codes for common error scenarios.
+They are identical to the codes defined by `gRPC` for interoperability.
+
+The table below summarizes the error codes.
+You can find additional documentation about when to use them in the
+[package documentation](https://pkg.go.dev/encore.dev/beta/errs#ErrCode).
+
+| Code                 | String                  | HTTP Status               |
+| -------------------- | ----------------------- | ------------------------- |
+| `OK`                 | `"ok"`                  | 200 OK                    |
+| `Canceled`           | `"canceled"`            | 499 Client Closed Request |
+| `Unknown`            | `"unknown"`             | 500 Internal Server Error |
+| `InvalidArgument`    | `"invalid_argument"`    | 400 Bad Request           |
+| `DeadlineExceeded`   | `"deadline_exceeded"`   | 504 Gateway Timeout       |
+| `NotFound`           | `"not_found"`           | 404 Not Found             |
+| `AlreadyExists`      | `"already_exists"`      | 409 Conflict              |
+| `PermissionDenied`   | `"permission_denied"`   | 403 Forbidden             |
+| `ResourceExhausted`  | `"resource_exhausted"`  | 429 Too Many Requests     |
+| `FailedPrecondition` | `"failed_precondition"` | 400 Bad Request           |
+| `Aborted`            | `"aborted"`             | 409 Conflict              |
+| `OutOfRange`         | `"out_of_range"`        | 400 Bad Request           |
+| `Unimplemented`      | `"unimplemented"`       | 501 Not Implemented       |
+| `Internal`           | `"internal"`            | 500 Internal Server Error |
+| `Unavailable`        | `"unavailable"`         | 503 Unavailable           |
+| `DataLoss`           | `"data_loss"`           | 500 Internal Server Error |
+| `Unauthenticated`    | `"unauthenticated"`     | 401 Unauthorized          |
+
+## Error Building
+
+In cases where you have complex business logic, or multiple error returns,
+it's convenient to gradually add metadata to your error.
+
+For this purpose Encore provides `errs.Builder`. The builder lets you
+gradually set aspects of the error, using a chaining API design.
+Use `errs.B()` to get a new builder that you can start chaining with directly.
+
+When you want to return the constructed error call the `.Err() `method.
+
+For example:
+
+```go
+func getBoard(ctx context.Context, boardID int64) (*Board, error) {
+    // Construct a new error builder with errs.B()
+	eb := errs.B().Meta("board_id", params.ID)
+
+	b := &Board{ID: params.ID}
+	err := sqldb.QueryRow(ctx, `
+		SELECT name, created
+		FROM board
+		WHERE id = $1
+	`, params.ID).Scan(&b.Name, &b.Created)
+	if errors.Is(err, sqldb.ErrNoRows) {
+        // Return a "board not found" error with code == NotFound
+		return nil, eb.Code(errs.NotFound).Msg("board not found").Err()
+	} else if err != nil {
+        // Return a general error
+		return nil, eb.Cause(err).Msg("could not get board").Err()
+	}
+    // ...
+}
+```
+
+## Inspecting API Errors
+
+When you call another API within Encore, the returned errors are always wrapped in `*errs.Error`.
+
+You can inspect the error information either by casting to `*errs.Error`, or using the below
+helper methods.
+
+```go
+func Code(err error) ErrCode
+```
+`errs.Code` returns the error code. If the error was not an `*errs.Error` it returns `errs.Unknown`.
+
+```go
+func Meta(err error) Metadata
+type Metadata map[string]interface{}
+```
+`errs.Meta` returns any structured metadata present in the error. If the error was not an `*errs.Error` it returns nil.
+Unlike when you return error information to external clients,
+all the metadata is sent to the calling service, making debugging even easier.
+
+```go
+func Details(err error) ErrDetails
+```
+`errs.Details` returns the structured error details. If the error was not an `*errs.Error` or the error lacked details,
+it returns nil.
diff --git a/docs/go/primitives/api-schemas.md b/docs/go/primitives/api-schemas.md
new file mode 100644
index 0000000000..5a146d26b6
--- /dev/null
+++ b/docs/go/primitives/api-schemas.md
@@ -0,0 +1,255 @@
+---
+seotitle: API Schemas – Path, Query, and Body parameters
+seodesc: See how to design API schemas for your Go based backend application using Encore.
+title: API Schemas
+subtitle: How to design schemas for your APIs
+lang: go
+---
+APIs in Encore are regular functions with request and response data types.
+These types are structs (or pointers to structs) with optional field tags, which Encore uses to encode API requests to HTTP messages. The same struct can be used for requests and responses, but the `query` tag is ignored when generating responses.
+
+All tags except `json` are ignored for nested tags, which means you can only define
+`header` and `query` parameters for root level fields.
+
+For example, this struct:
+```go
+type NestedRequestResponse struct {
+	Header string `header:"X-Header"`// this field will be read from the http header
+	Query  string `query:"query"`// this field will be read from the query string
+	Body1  string `json:"body1"`
+	Nested struct {
+	    Header2 string `header:"X-Header2"`// this field will be read from the body
+		Query2  string `query:"query2"`// this field will be read from the body
+		Body2   string `json:"body2"`
+    } `json:"nested"`
+}
+```
+
+Would be unmarshalled from this request:
+
+```output
+POST /example?query=a%20query HTTP/1.1
+Content-Type: application/json
+X-Header: A header
+
+{
+   "body1": "a body",
+   "nested": {
+      "Header2": "not a header",
+      "Query2": "not a query",
+      "body2": "a nested body"
+   }
+}
+
+```
+
+And marshalled to this response:
+
+```output
+HTTP/1.1 200 OK
+Content-Type: application/json
+X-Header: A header
+
+{
+   "Query": "not a query",
+   "body1": "a body",
+   "nested": {
+      "Header2": "not a header",
+      "Query2": "not a query",
+      "body2": "a nested body"
+   }
+}
+
+```
+
+## Path parameters
+
+Path parameters are specified by the `path` field in the `//encore:api` annotation.
+To specify a placeholder variable, use `:name` and add a function parameter with the same name to the function signature.
+Encore parses the incoming request URL and makes sure it matches the type of the parameter. The last segment of the path
+can be parsed as a wildcard parameter by using `*name` with a matching function parameter.
+
+```go
+// GetBlogPost retrieves a blog post by id.
+//encore:api public method=GET path=/blog/:id/*path
+func GetBlogPost(ctx context.Context, id int, path string) (*BlogPost, error) {
+    // Use id to query database...
+}
+```
+
+### Fallback routes
+
+Encore supports defining fallback routes that will be called if no other endpoint matches the request,
+using the syntax `path=/!fallback`.
+
+This is often useful when migrating an existing backend service over to Encore, as it allows you to gradually
+migrate endpoints over to Encore while routing the remaining endpoints to the existing HTTP router using
+a raw endpoint with a fallback route.
+
+For example:
+
+```go
+//encore:service
+type Service struct {
+	oldRouter *gin.Engine // existing HTTP router
+}
+
+// Route all requests to the existing HTTP router if no other endpoint matches.
+//encore:api public raw path=/!fallback
+func (s *Service) Fallback(w http.ResponseWriter, req *http.Request) {
+    s.oldRouter.ServeHTTP(w, req)
+}
+```
+
+## Headers
+
+Headers are defined by the `header` field tag, which can be used in both request and response data types. The tag name is used to translate between the struct field and http headers.
+In the example below, the `Language` field of `ListBlogPost` will be fetched from the
+`Accept-Language` HTTP header.
+
+```go
+type ListBlogPost struct {
+    Language string `header:"Accept-Language"`
+    Author      string // Not a header
+}
+```
+
+### Cookies
+
+Cookies can be set in the response by using the `header` tag with the `Set-Cookie` header name.
+
+```go
+type LoginResponse struct {
+    SessionID string `header:"Set-Cookie"`
+}
+
+//encore:api public method=POST path=/login
+func Login(ctx context.Context) (*LoginResponse, error) {
+    return &LoginResponse{SessionID: "session=123"}, nil
+}
+````
+
+The cookies can then be read using e.g. [structured auth data](/docs/go/develop/auth#accepting-structured-auth-information). 
+
+## Query parameters
+
+For `GET`, `HEAD` and `DELETE` requests, parameters are read from the query string by default.
+The query parameter name defaults to the [snake-case](https://en.wikipedia.org/wiki/Snake_case)
+encoded name of the corresponding struct field (e.g. BlogPost becomes blog_post).
+
+The `query` field tag can be used
+to parse a field from the query string for other HTTP methods (e.g. POST) and to override the default parameter name. 
+
+Query strings are not supported in HTTP responses and therefore `query` tags in response types are ignored.
+
+In the example below, the `PageLimit` field will be read from the `limit` query
+parameter, whereas the `Author` field will be parsed from the query string (as `author`) only if the method of
+the request is `GET`, `HEAD` or `DELETE`.
+
+```go
+type ListBlogPost struct {
+    PageLimit  int `query:"limit"` // always a query parameter
+    Author     string              // query if GET, HEAD or DELETE, otherwise body parameter
+}
+```
+
+## Body parameters
+
+Encore will default to reading request parameters from the body (as JSON) for all HTTP methods except `GET`, `HEAD` or
+`DELETE`. The name of the body parameter defaults to the field name, but can be overridden by the
+`json` tag. Response fields will be serialized as JSON in the HTTP body unless the `header` tag is set.
+
+There is no tag to force a field to be read from the body, as some infrastructure entities
+do not support body content in `GET`, `HEAD` or `DELETE` requests.
+
+```go
+type CreateBlogPost struct {
+    Subject    string `json:"limit"` // query if GET, HEAD or DELETE, otherwise body parameter
+    Author     string                // query if GET, HEAD or DELETE, otherwise body parameter
+}
+```
+
+## Supported types
+The table below lists the data types supported by each HTTP message location.
+
+| Type            | Header | Path | Query | Body |
+| --------------- | ------ | ---- | ----- | ---- |
+| bool            | X      | X    | X     | X    |
+| numeric         | X      | X    | X     | X    |
+| string          | X      | X    | X     | X    |
+| time.Time       | X      | X    | X     | X    |
+| uuid.UUID       | X      | X    | X     | X    |
+| json.RawMessage | X      | X    | X     | X    |
+| list            |        |      | X     | X    |
+| struct          |        |      |       | X    |
+| map             |        |      |       | X    |
+| pointer         |        |      |       | X    |
+
+## Raw endpoints
+
+In some cases you may need to fulfill an API schema that is defined by someone else, for instance when you want to accept webhooks.
+This often requires you to parse custom HTTP headers and do other low-level things that Encore usually lets you skip.
+
+For these circumstances Encore lets you define raw endpoints. Raw endpoints operate at a lower abstraction level, giving you access to the underlying HTTP request.
+
+Learn more in the [raw endpoints documentation](/docs/go/primitives/raw-endpoints).
+
+## Sensitive data
+
+Encore's built-in tracing functionality automatically captures request and response payloads
+to simplify debugging. That's not desirable if a request or response payload contains sensitive data, such
+as API keys or personally identifiable information (PII).
+
+For those use cases Encore supports marking a field as sensitive using the struct tag `encore:"sensitive"`.
+Encore's tracing system will automatically redact fields tagged as sensitive. This works for both individual
+values as well as nested fields.
+
+Note that inputs to [auth handlers](/docs/go/develop/auth) are automatically marked as sensitive and are always redacted.
+
+Raw endpoints lack a schema, which means there's no way to add a struct tag to mark certain data as sensitive.
+For this reason Encore supports tagging the whole API endpoint as sensitive by adding `sensitive` to the `//encore:api` annotation.
+This will cause the whole request and response payload to be redacted, including all request and response headers.
+
+<Callout type="info">
+
+The `encore:"sensitive"` tag is ignored for local development environments to make development and debugging with the Local Development Dashboard easier.
+
+</Callout>
+
+
+## Example
+
+```go
+package blog // service name
+import (
+	"time"
+	"encore.dev/types/uuid"
+)
+
+type Updates struct {
+	Author      string `json:"author,omitempty"`
+	PublishTime time.Time `json:"publish_time,omitempty"`
+}
+
+// BatchUpdateParams is the request data for the BatchUpdate endpoint.
+type BatchUpdateParams struct {
+	Requester     string    `header:"X-Requester"`
+	RequestTime   time.Time `header:"X-Request-Time"`
+	CurrentAuthor string    `query:"author"`
+	Updates       *Updates  `json:"updates"`
+	MySecretKey   string    `encore:"sensitive"`
+}
+
+// BatchUpdateResponse is the response data for the BatchUpdate endpoint.
+type BatchUpdateResponse struct {
+	ServedBy   string       `header:"X-Served-By"`
+	UpdatedIDs []uuid.UUID  `json:"updated_ids"`
+}
+
+//encore:api public method=POST path=/section/:sectionID/posts
+func BatchUpdate(ctx context.Context, sectionID string, params *BatchUpdateParams) (*BatchUpdateResponse, error) {
+	// Update blog posts for section
+	return &BatchUpdateResponse{ServedBy: hostname, UpdatedIDs: ids}, nil
+}
+
+```
diff --git a/docs/go/primitives/app-structure.md b/docs/go/primitives/app-structure.md
new file mode 100644
index 0000000000..ad1e9ec482
--- /dev/null
+++ b/docs/go/primitives/app-structure.md
@@ -0,0 +1,156 @@
+---
+seotitle: Structuring your microservices backend application
+seodesc: Learn how to structure your microservices backend application. See recommended app structures for monoliths, small microservices backends, and large scale microservices applications.
+title: App Structure
+subtitle: Structuring your Encore application
+lang: go
+---
+
+Encore uses a monorepo design and it's best to use one Encore app for your entire backend application. This lets Encore build an application model that spans your entire app, necessary to get the most value out of many
+features like [distributed tracing](/docs/go/observability/tracing) and [Encore Flow](/docs/go/observability/encore-flow).
+
+If you have a large application, see advice on how to [structure an app with several systems](/docs/go/primitives/app-structure#large-applications-with-several-systems). 
+
+It's simple to integrate Encore applications with pre-existing systems you might have, using APIs and built-in tools like [client generation](/docs/go/cli/client-generation).
+
+## Monolith or Microservices
+
+Encore is not opinionated about monoliths vs. microservices. It does however let you build microservices applications with a monolith-style developer experience. For example, you automatically get IDE auto-complete when making [API calls between services](/docs/go/primitives/api-calls), along with cross-service type-safety.
+
+When using Encore Cloud to create an environment on AWS/GCP, Encore enables you to configure if you want to combine multiple services into one process or keep them separate. This can be useful for improved efficiency at smaller scales, and for co-locating services for increased performance. Learn more in the [environments documentation](/docs/platform/deploy/environments#process-allocation).
+
+## Creating services
+
+To create an Encore service, you create a Go package and
+[define an API](/docs/go/primitives/defining-apis) within it. When using databases, you add database migrations in a subfolder `migrations` to define the structure of the database(s). Learn more in the [SQL databases docs](/docs/go/primitives/databases).
+
+On disk it might look like this:
+
+```
+/my-app
+├── encore.app                       // ... and other top-level project files
+│
+├── hello                            // hello service (a Go package)
+│   ├── migrations                   // hello service db migration (directory)
+│   │   └── 1_create_table.up.sql    // hello service db migration
+│   ├── hello.go                     // hello service code
+│   └── hello_test.go                // tests for hello service
+│
+└── world                            // world service (a Go package)
+    └── world.go                     // world service code
+```
+
+<RelatedDocsLink paths={["/docs/go/primitives/services", "/docs/go/primitives/defining-apis", "/docs/go/primitives/share-db-between-services"]} />
+
+## Structure services using sub-packages
+
+Within a service, it's possible to have multiple sub-packages. This is a good way to define components, helper
+functions, or other code for your functions, should you wish to do that. You can create as many sub-packages, in any kind of nested structure within your service, as you want.
+
+To create sub-packages, you create sub-directories within a service package. Sub-packages are internal to services,
+they are not themselves service packages. This means sub-packages within services cannot
+themselves define APIs.
+You can however define an API in a service package that calls a function within a sub-package.
+
+For example, rather than define the entire logic for an endpoint in that endpoint's function, you can call functions
+from sub-packages and divide the logic in any way you want.
+
+**`hello/hello.go`**
+
+```go
+package hello
+
+import (
+	"context"
+	
+	"encore.app/hello/foo"
+)
+
+//encore:api public path=/hello/:name
+func World(ctx context.Context, name string) (*Response, error) {
+	msg := foo.GenerateMessage(name)
+	return &Response{Message: msg}, nil
+}
+
+type Response struct {
+    Message string
+}
+```
+
+**`hello/foo/foo.go`**
+
+```go
+package foo
+
+import (
+	"fmt"
+)
+
+func GenerateMessage(name string) string {
+	return fmt.Sprintf("Hello %s!", name)
+}
+
+```
+
+On disk it might look like this:
+
+```
+/my-app
+├── encore.app                       // ... and other top-level project files
+│
+├── hello                            // hello service (a Go package)
+│   ├── migrations                   // hello service db migrations (directory)
+│   │   └── 1_create_table.up.sql    // hello service db migration
+│   ├── foo                          // sub-package foo (directory)
+│   │   └── foo.go                   // foo code (cannot define APIs)
+│   ├── hello.go                     // hello service code
+│   └── hello_test.go                // tests for hello service
+│
+└── world                            // world service (a Go package)
+    └── world.go                     // world service code
+```
+
+## Large applications with several systems
+
+If you have a large application with several logical domains, each consisting of multiple services, it can be practical
+to separate these into distinct systems.
+
+Systems are not a special construct in Encore, they only help you divide your application logically around common concerns and purposes. Encore only handles services, the compiler will read your
+systems and extract the services of your application. As applications grow, systems help you decompose your application
+without requiring any complex refactoring.
+
+To create systems, create a sub-directory for each system and put the relevant service packages within it.
+This is all you need to do, since with Encore each service consists of a Go package.
+
+As an example, a company building a Trello app might divide their application into three systems: the **Trello** system
+(for the end-user facing app with boards and cards), the **User** system (for user and organization management), and
+the **Premium** system (for handling payments and subscriptions).
+
+On disk it might look like this:
+
+```
+/my-trello-clone
+├── encore.app                  // ... and other top-level project files
+│
+├── trello                      // trello system (a directory)
+│   ├── board                   // board service (a Go package)
+│   │   └── board.go            // board service code
+│   └── card                    // card service (a Go package)
+│       └── card.go             // card service code
+│
+├── premium                     // premium system (a directory)
+│   ├── payment                 // payment service (a Go package)
+│   │   └── payment.go          // payment service code
+│   └── subscription            // subscription service (a Go package)
+│       └── subscription.go     // subscription service code
+│
+└── usr                         // usr system (a directory)
+    ├── org                     // org service (a Go package)
+    │   └── org.go              // org service code
+    └── user                    // user service (a Go package)
+        └── user.go             // user service code
+```
+
+The only refactoring needed to divide an existing Encore application into systems is to move services into their respective
+subfolders. This is a simple way to separate the specific concerns of each system. What matters for Encore are the packages containing services, and the division in systems or subsystems will not change the endpoints or
+architecture of your application.
diff --git a/docs/go/primitives/caching.md b/docs/go/primitives/caching.md
new file mode 100644
index 0000000000..a0f8e35344
--- /dev/null
+++ b/docs/go/primitives/caching.md
@@ -0,0 +1,176 @@
+---
+seotitle: Using caches in your microservices backend application
+seodesc: Learn how to implement caches to optimize response times and reduce cost in your microservices cloud backend.
+title: Caching
+subtitle: Optimize response times and reduce costs by avoiding re-work
+infobox: {
+  title: "Caching",
+  import: "encore.dev/storage/cache",
+}
+lang: go
+---
+
+A cache is a high-speed storage layer, commonly used in distributed systems to improve user experiences
+by reducing latency, improving system performance, and avoiding expensive computation.
+
+For scalable systems you typically want to deploy the cache as a separate
+infrastructure resource, allowing you to run multiple instances of your application concurrently.
+
+Encore's built-in Caching API lets you use high-performance caches (using [Redis](https://redis.io/)) in a cloud-agnostic declarative fashion. At deployment, Encore will automatically [provision the required infrastructure](/docs/platform/infrastructure/infra).
+
+## Cache clusters
+
+To use caching in Encore, you must first define a *cache cluster*.
+Each cache cluster defined in your application will be provisioned as a separate Redis instance
+by Encore.
+
+This gives you fine-grained control over which service(s) should use the same cache cluster
+and which should have a separate one.
+
+It looks like this:
+
+```go
+import "encore.dev/storage/cache"
+
+var MyCacheCluster = cache.NewCluster("my-cache-cluster", cache.ClusterConfig{
+    // EvictionPolicy tells Redis how to evict keys when the cache reaches
+    // its memory limit. For typical cache use cases, cache.AllKeysLRU is a good default.
+    EvictionPolicy: cache.AllKeysLRU,
+})
+```
+
+<Callout type="info">
+
+When starting out it's recommended to use a single cache cluster
+that's shared between your different services.
+
+</Callout>
+
+## Keyspaces
+
+When using a cache, each cached item is stored at a particular key, which is typically an arbitrary string.
+If you use a cache cluster to cache different sets of data, it's important that distinct data set have non-overlapping keys.
+
+Each value stored in the cache also has a specific type, and certain cache operations can only be performed on certain types. For example, a common cache operation is to increment an integer value that is stored in the cache. If you try to apply this operation on a value that is not an integer, an error is returned.
+
+Encore provides a simple, type-safe solution to these problems through Keyspaces.
+
+In order to begin storing data in your cache, you must first define a Keyspace.
+
+Each keyspace has a Key type and a Value type. The Key type is much like a map key, in that it tells Encore where in the cache
+the item is stored. The Key type is combined with the Key Pattern to produce a string that is the Redis cache key.
+
+The Value type is the type of the values stored in that keyspace. For many keyspaces this is specified in the name of the constructor.
+For example, `NewIntKeyspace` stores `int64` values.
+
+For example, if you want to rate limit the number of requests per user ID it looks like this:
+
+```go
+import (
+    "encore.dev/beta/auth"
+    "encore.dev/beta/errs"
+    "encore.dev/middleware"
+)
+
+// RequestsPerUser tracks the number of requests per user.
+// The cache items expire after 10 seconds without activity.
+var RequestsPerUser = cache.NewIntKeyspace[auth.UID](cluster, cache.KeyspaceConfig{
+	KeyPattern:    "requests/:key",
+	DefaultExpiry: cache.ExpireIn(10 * time.Second),
+})
+
+// RateLimitMiddleware is a global middleware that limits the number of authenticated requests
+// to 10 requests per 10 seconds.
+//encore:middleware target=all
+func RateLimitMiddleware(req middleware.Request, next middleware.Next) middleware.Response {
+	if userID, ok := auth.UserID(); ok {
+		val, err := RequestsPerUser.Increment(req.Context(), userID, 1)
+
+		// NOTE: this "fails open", meaning if we can't communicate with the cache
+		// we default to allowing the requests.
+		//
+		// Consider whether that's the correct behavior for your application,
+		// or if you want to return an error to the user in that case.
+		if err == nil && val > 10 {
+			return middleware.Response{
+				Err: &errs.Error{Code: errs.ResourceExhausted, Message: "rate limit exceeded"},
+			}
+		}
+	}
+	return next(req)
+}
+```
+
+As you can see, the `RequestsPerUser` defines a `KeyPattern` which is set to `"requests/:key"`.
+Here `:key` refers to the value of the Key type, which is the `auth.UID` value passed in.
+
+If you want the cache key to contain multiple values, you can define a struct type
+and pass that as the key. Then change the `KeyPattern` to specify the struct fields.
+
+For example:
+
+```go
+type MyKey struct {
+    UserID auth.UID
+    ResourcePath string // the resource being accessed
+}
+
+// ResourceRequestsPerUser tracks the number of requests per user and resource.
+// The cache items expire after 10 seconds without activity.
+var ResourceRequestsPerUser = cache.NewIntKeyspace[MyKey](cluster, cache.KeyspaceConfig{
+	KeyPattern:    "requests/:UserID/:ResourcePath",
+	DefaultExpiry: cache.ExpireIn(10 * time.Second),
+})
+
+// ... then:
+key := MyKey{UserID: "some-user-id", ResourcePath: "/foo"}
+ResourceRequestsPerUser.Increment(ctx, key, 1)
+```
+
+<Callout type="info">
+
+Encore ensures that all the struct fields are present in the `KeyPattern`,
+and that the placeholder values are all valid field names.
+
+That way the connection between the struct fields and the `KeyPattern`
+become compile-time type-safe as well.
+
+</Callout>
+
+Also note that Encore ensures there are no conflicting `KeyPattern` definitions across each cache cluster.
+Each keyspace must define its own, non-conflicting `KeyPattern`.
+This way, you can feel safe that there won't be any accidental overwrites of cache values, even with multiple services sharing the same cache cluster.
+
+## Keyspace operations
+
+Encore comes with a full suite of keyspace types, each with a wide variety of cache operations.
+
+Basic keyspace types include
+[strings](https://pkg.go.dev/encore.dev/storage/cache#NewStringKeyspace),
+[integers](https://pkg.go.dev/encore.dev/storage/cache#NewIntKeyspace),
+[floats](https://pkg.go.dev/encore.dev/storage/cache#NewFloatKeyspace),
+and [struct types](https://pkg.go.dev/encore.dev/storage/cache#NewStructKeyspace).
+These keyspaces all share the same set of methods (along with a few keyspace-specific ones).
+
+There are also more advanced keyspaces for storing [sets of basic types](https://pkg.go.dev/encore.dev/storage/cache#NewSetKeyspace)
+and [ordered lists of basic types](https://pkg.go.dev/encore.dev/storage/cache#NewListKeyspace).
+These keyspaces offer a different, specialized set of methods specific to set and list operations.
+
+For a list of the supported operations, see the [package documentation](https://pkg.go.dev/encore.dev/storage/cache).
+
+## Testing
+
+When running tests, Encore spins up an in-memory cache separately for each test.
+
+This way you don't have to think about clearing the cache between tests,
+or worrying about whether one test affects another.
+Each test is automatically fully isolated.
+
+## Local development
+
+For local development, Encore maintains a local, in-memory implementation of Redis.
+This implementation is designed to store a small amount of keys (currently 100).
+
+When the number of keys exceeds this value, keys are randomly purged to get below the limit.
+This is designed in order to simulate the ephemeral, transient nature of caches while also
+limiting memory use. The precise behavior for local development may change over time and should not be relied on.
diff --git a/docs/go/primitives/change-db-schema.md b/docs/go/primitives/change-db-schema.md
new file mode 100644
index 0000000000..c8665d6d75
--- /dev/null
+++ b/docs/go/primitives/change-db-schema.md
@@ -0,0 +1,52 @@
+---
+seotitle: How to change your SQL database schema
+seodesc: Learn how to change your SQL database schema for your Go backend application, using migration files and Encore's built-in schema migration functionality.
+title: Change SQL database schema
+lang: go
+---
+
+Encore database schemas are changed over time using *migration files*.
+
+Each migration file has a sequence number, and migration files are run
+in sequence when deploying. Encore tracks which migrations have already run
+and only runs new ones.
+
+To change your database schema, add a new migration file using the next
+available migration number.
+
+For example, if you have two migration files already,
+the next migration file should be named `3_something.up.sql` where
+`something` is a short description of what the migration does.
+
+<Callout type="warning">
+
+Database migrations are applied before the application is restarted
+with the new code. Always make sure the old application code works with
+the new database schema, so that things don't break while your new code
+is being rolled out.
+
+</Callout>
+
+## Example
+
+Let's say you have a single migration file that creates a `todo_item` table:
+
+**`todo/migrations/1_create_table.up.sql`**
+```sql
+CREATE TABLE todo_item (
+    id BIGSERIAL PRIMARY KEY,
+    title TEXT NOT NULL,
+    done BOOLEAN NOT NULL
+);
+```
+
+And now you want to add a `created` column to track when each todo was created.
+Add a new file:
+
+**`todo/migrations/2_add_created_col.up.sql`**
+```sql
+ALTER TABLE todo_item ADD created TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW();
+```
+
+The next deploy Encore will notice the new migration file and run it, adding
+a new column.
diff --git a/docs/go/primitives/code-snippets.md b/docs/go/primitives/code-snippets.md
new file mode 100644
index 0000000000..a186411dcd
--- /dev/null
+++ b/docs/go/primitives/code-snippets.md
@@ -0,0 +1,245 @@
+---
+seotitle: Code snippets for using the Backend Framework's building blocks in your backend application
+seodesc: Learn how to build cloud-agnostic backend applications using Encore's Backend Framework.
+title: Code snippets
+subtitle: Shortcuts for building with Encore
+lang: go
+---
+
+When you're familiar with how Encore works, you can simplify your development workflow by copy-pasting these examples. If you're looking for details on how Encore works, please refer to the relevant docs section.
+
+## APIs
+
+### Defining APIs
+
+```go
+package hello // service name
+
+//encore:api public
+func Ping(ctx context.Context, params *PingParams) (*PingResponse, error) {
+    msg := fmt.Sprintf("Hello, %s!", params.Name)
+    return &PingResponse{Message: msg}, nil
+}
+```
+
+### Defining Request and Response schemas
+
+```go
+// PingParams is the request data for the Ping endpoint.
+type PingParams struct {
+    Name string
+}
+
+// PingResponse is the response data for the Ping endpoint.
+type PingResponse struct {
+    Message string
+}
+```
+
+### Calling APIs
+
+```go
+import "encore.app/hello" // import service
+
+//encore:api public
+func MyOtherAPI(ctx context.Context) error {
+    resp, err := hello.Ping(ctx, &hello.PingParams{Name: "World"})
+    if err == nil {
+        log.Println(resp.Message) // "Hello, World!"
+    }
+    return err
+}
+```
+
+**Hint:** Import the service package and call the API endpoint using a regular function call.
+
+### Receive Webhooks
+
+```go
+import "net/http"
+
+// Webhook receives incoming webhooks from Some Service That Sends Webhooks.
+//encore:api public raw
+func Webhook(w http.ResponseWriter, req *http.Request) {
+    // ... operate on the raw HTTP request ...
+}
+```
+
+**Hint:** Like any other API endpoint, this will be exposed at:<br/>
+`https://<env>-<app-id>.encr.app/service.Webhook`
+
+## Databases
+
+### Creating a SQL database
+
+To create a database, import `encore.dev/storage/sqldb` and call `sqldb.NewDatabase`, assigning the result to a package-level variable.
+`sqldb.DatabaseConfig` specifies the directory containing the database migration files, which is how you define the database schema.
+
+```
+-- todo/db.go --
+package todo
+
+// Create the todo database and assign it to the "tododb" variable
+var tododb = sqldb.NewDatabase("todo", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+
+// Then, query the database using db.QueryRow, db.Exec, etc.
+-- todo/migrations/1_create_table.up.sql --
+CREATE TABLE todo_item (
+  id BIGSERIAL PRIMARY KEY,
+  title TEXT NOT NULL,
+  done BOOLEAN NOT NULL DEFAULT false
+  -- etc...
+);
+```
+
+### Inserting data into a database
+
+One way of inserting data is with a helper function that uses the package function `sqldb.Exec`:
+
+```go
+import "encore.dev/storage/sqldb"
+
+// insert inserts a todo item into the database.
+func insert(ctx context.Context, id, title string, done bool) error {
+	_, err := tododb.Exec(ctx, `
+		INSERT INTO todo_item (id, title, done)
+		VALUES ($1, $2, $3)
+	`, id, title, done)
+	return err
+}
+```
+
+### Querying a database
+
+To read a single todo item in the example schema above, we can use `sqldb.QueryRow`:
+
+```go
+import "encore.dev/storage/sqldb"
+
+var item struct {
+    ID int64
+    Title string
+    Done bool
+}
+err := tododb.QueryRow(ctx, `
+    SELECT id, title, done
+    FROM todo_item
+    LIMIT 1
+`).Scan(&item.ID, &item.Title, &item.Done)
+```
+
+**Hint:** If `sqldb.QueryRow` does not find a matching row, it reports an error that can be checked against
+by importing the standard library `errors` package and calling `errors.Is(err, sqldb.ErrNoRows)`.
+
+## Defining a Cron Job
+
+```go
+import "encore.dev/cron"
+
+var _ = cron.NewJob("welcome-email", cron.JobConfig{
+	Title:    "Send welcome emails",
+	Every:    2 * cron.Hour,
+	Endpoint: SendWelcomeEmail,
+})
+
+//encore:api private
+func SendWelcomeEmail(ctx context.Context) error {
+	// ...
+	return nil
+}
+```
+**Hint:** Cron Jobs do not run in your local development environment.
+
+## PubSub
+
+### Creating a PubSub topic
+
+```go
+import "encore.dev/pubsub"
+
+type SignupEvent struct { UserID int }
+var Signups = pubsub.NewTopic[*SignupEvent]("signups", pubsub.TopicConfig {
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+```
+
+**Hint:** Topics are declared as package level variables and cannot be created inside functions. Regardless of where you create a topic, it can be published and subscribed to from any service.
+
+### Publishing an Event (Pub)
+
+```go
+if _, err := Signups.Publish(ctx, &SignupEvent{UserID: id}); err != nil {
+    return err
+}
+
+if err := tx.Commit(); err != nil {
+    return err
+}
+```
+
+**Hint:** If you want to publish to the topic from another service, import the topic package variable (`Signups` in this example) and call publish on it from there.
+
+### Subscribing to Events (Sub)
+
+Create a Subscription as a package level variable by calling `pubsub.NewSubscription`.
+
+```go
+var _ = pubsub.NewSubscription(
+    user.Signups, "send-welcome-email",
+    pubsub.SubscriptionConfig[*SignupEvent] {
+        Handler: SendWelcomeEmail,
+    },
+)
+func SendWelcomeEmail(ctx context.Context, event *SignupEvent) error {
+    ... send email ...
+    return nil
+}
+```
+
+## Defining a Cache cluster
+
+```go
+import "encore.dev/storage/cache"
+
+var MyCacheCluster = cache.NewCluster("my-cache-cluster", cache.ClusterConfig{
+    // EvictionPolicy tells Redis how to evict keys when the cache reaches
+    // its memory limit. For typical cache use cases, cache.AllKeysLRU is a good default.
+    EvictionPolicy: cache.AllKeysLRU,
+})
+```
+
+## Secrets
+
+### Defining Secrets
+
+```go
+var secrets struct {
+    GitHubAPIToken string   // personal access token for deployments
+    SomeOtherSecret string  // some other secret
+}
+```
+
+**Hint:** The variable must be an unexported struct named `secrets`, and all the fields must be of type `string`.
+
+### Setting secret values
+
+```shell
+$ encore secret set --type <types...> <secret-name>
+```
+
+**Hint:** `<types>` defines which environment types the secret value applies to. Use a comma-separated list of `production`, `development`, `preview`, and `local`. For each Secret, there can only be one secret value for each environment type.
+
+### Using secrets
+
+```go
+func callGitHub(ctx context.Context) {
+    req, _ := http.NewRequestWithContext(ctx, "GET", "https:///api.github.com/user", nil)
+    req.Header.Add("Authorization", "token " + secrets.GitHubAPIToken)
+    resp, err := http.DefaultClient.Do(req)
+    // ... handle err and resp
+}
+```
+
+**Hint:** Secret keys are globally unique for your whole application; if multiple services use the same secret name they both receive the same secret value at runtime.
diff --git a/docs/go/primitives/connect-existing-db.md b/docs/go/primitives/connect-existing-db.md
new file mode 100644
index 0000000000..4c29223381
--- /dev/null
+++ b/docs/go/primitives/connect-existing-db.md
@@ -0,0 +1,83 @@
+---
+seotitle: How to integrate your Encore app with an existing database
+seodesc: Learn how to integrate your Encore Go backend application with an existing database, in any cloud you choose.
+title: Integrate with existing databases
+lang: go
+---
+
+Encore automatically provision the necessary infrastructure when you create a service and add a database. However, you may want to connect to an existing database for migration or prototyping purposes. It's simple to integrate your Encore app with an existing database in these cases.
+
+## Example
+
+Let's say you have an external database hosted by DigitalOcean that you would like to connect to.
+The simplest approach is to create a dedicated package that lazily instantiates a database connection pool.
+We can store the password using Encore's [secrets manager](/docs/go/primitives/secrets) to make it even easier.
+
+The connection string is something that looks like:
+
+```
+postgresql://user:password@externaldb-do-user-1234567-0.db.ondigitalocean.com:25010/externaldb?sslmode=require
+```
+
+So we write something like:
+
+**`pkg/externaldb/externaldb.go`**
+
+```go
+package externaldb
+
+import (
+    "context"
+    "fmt"
+
+    "github.com/jackc/pgx/v4/pgxpool"
+    "go4.org/syncutil"
+)
+
+// Get returns a database connection pool to the external database.
+// It is lazily created on first use.
+func Get(ctx context.Context) (*pgxpool.Pool, error) {
+    // Attempt to setup the database connection pool if it hasn't
+    // already been successfully setup.
+    err := once.Do(func() error {
+        var err error
+        pool, err = setup(ctx)
+        return err
+    })
+    return pool, err
+}
+
+var (
+    // once is like sync.Once except it re-arms itself on failure
+    once syncutil.Once
+    // pool is the successfully created database connection pool,
+    // or nil when no such pool has been setup yet.
+    pool *pgxpool.Pool
+)
+
+var secrets struct {
+    // ExternalDBPassword is the database password for authenticating
+    // with the external database hosted on DigitalOcean.
+    ExternalDBPassword string
+}
+
+// setup attempts to set up a database connection pool.
+func setup(ctx context.Context) (*pgxpool.Pool, error) {
+    connString := fmt.Sprintf("postgresql://%s:%s@externaldb-do-user-1234567-0.db.ondigitalocean.com:25010/externaldb?sslmode=require",
+        "user", secrets.ExternalDBPassword)
+    return pgxpool.Connect(ctx, connString)
+}
+```
+
+Before running, remember to use `encore secrets set` to store the `ExternalDBPassword` to use. (But don't worry, Encore will remind you if you forget.)
+
+## Other infrastructure
+
+The same pattern can easily be adapted to other infrastructure components that Encore doesn't yet provide built-in support for:
+
+- Horizontally scalable databases like Cassandra, DynamoDB, BigTable, and so on
+- Document or graph databases like MongoDB or Neo4j
+- Other cloud primitives like queues, object storage buckets, and more
+- Or really any cloud services or APIs you can think of
+
+In this way you can easily integrate Encore with anything you want.
diff --git a/docs/go/primitives/cron-jobs.md b/docs/go/primitives/cron-jobs.md
new file mode 100644
index 0000000000..02a64f12f1
--- /dev/null
+++ b/docs/go/primitives/cron-jobs.md
@@ -0,0 +1,104 @@
+---
+seotitle: Create recurring tasks with Encore's Cron Jobs API
+seodesc: Learn how to create periodic and recurring tasks in your backend application using Encore's Cron Jobs API.
+title: Cron Jobs
+subtitle: Run recurring and scheduled tasks
+infobox: {
+  title: "Cron Jobs",
+  import: "encore.dev/cron",
+  example_link: "/docs/tutorials/uptime"
+}
+lang: go
+---
+
+When you need to run periodic and recurring tasks, Encore.go provides a declarative way of using Cron Jobs.
+
+When a Cron Job is defined in your application, Encore automatically calls your specified API according to the defined schedule. This eliminates the need for infrastructure maintenance, as Encore manages scheduling, monitoring, and execution of Cron Jobs.
+
+<Callout type="info">
+
+Cron Jobs do not run when developing locally or in [Preview Environments](/docs/platform/deploy/preview-environments), but you can always call the API manually to test the behavior.
+
+</Callout>
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/uptime"
+    desc="Uptime Monitoring app that uses a Cron Job to periodically check the uptime of a website."
+/>
+
+## Defining a Cron Job
+
+To define a Cron Job, import the `encore.dev/cron` [package](https://pkg.go.dev/encore.dev/cron),
+and call the `cron.NewJob()` function and store it as a package-level variable.
+
+### Example
+
+```go
+import "encore.dev/cron"
+
+// Send a welcome email to everyone who signed up in the last two hours.
+var _ = cron.NewJob("welcome-email", cron.JobConfig{
+	Title:    "Send welcome emails",
+	Every:    2 * cron.Hour,
+	Endpoint: SendWelcomeEmail,
+})
+
+// SendWelcomeEmail emails everyone who signed up recently.
+// It's idempotent: it only sends a welcome email to each person once.
+//encore:api private
+func SendWelcomeEmail(ctx context.Context) error {
+	// ...
+	return nil
+}
+```
+
+The `"welcome-email"` argument to `cron.NewJob` is a unique ID you give to each Cron Job.
+If you later refactor the code and move the Cron Job definition to another package,
+we use this ID to keep track that it's the same Cron Job and not a different one.
+
+When this code gets deployed Encore will automatically register the Cron Job in Encore Cloud
+and begin calling the `SendWelcomeEmail` API every hour.
+
+The Encore Cloud dashboard provides a convenient user interface for monitoring and debugging
+Cron Job executions across all your environments via the `Cron Jobs` menu item:
+
+![Cron Jobs UI](/assets/docs/cron.png)
+
+## Keep in mind when using Cron Jobs
+
+- Cron Jobs do not execute during local development or in [Preview Environments](/docs/platform/deploy/preview-environments). However, you can manually invoke the API to test its behavior.
+- In Encore Cloud, Cron Job executions are limited to **once every hour**, with the exact minute randomized within that hour for users on the Free Tier. To enable more frequent executions or to specify the exact minute within the hour, consider [deploying to your own cloud](/docs/platform/deploy/own-cloud) or upgrading to the [Pro plan](/pricing).
+- Both public and private APIs are supported for Cron Jobs.
+- Ensure that the API endpoints used in Cron Jobs are idempotent, as they may be called multiple times under certain network conditions.
+- The API endpoints used in Cron Jobs must not take any request parameters. That is, their signatures must be `func(context.Context) error` or `func(context.Context) (*T, error)`.
+
+## Cron schedules
+
+Above we used the `Every` field, which executes the Cron Job on a periodic basis.
+It runs around the clock each day, starting at midnight (UTC).
+
+In order to ensure a consistent delay between each run, the interval used **must divide 24 hours evenly**.
+For example, `10 * cron.Minute` and `6 * cron.Hour` are both allowed (since 24 hours is evenly divisible by both),
+whereas `7 * cron.Hour` is not (since 24 is not evenly divisible by 7).
+The Encore compiler will catch this and give you a helpful error at compile-time if you try to use an invalid interval.
+
+### Cron expressions
+
+For more advanced use cases, such as running a Cron Job on a specific day of the month, or a specific week day, or similar,
+the `Every` field is not expressive enough.
+
+For these use cases, Encore provides full support for [Cron expressions](https://en.wikipedia.org/wiki/Cron) by using the `Schedule` field
+instead of the `Every` field.
+
+Cron expressions allow you to define precise schedules for your tasks, including specific days of the week, specific hours of the day, and more. Note that all times are expressed in UTC.
+
+For example:
+
+```go
+// Run the monthly accounting sync job at 4am (UTC) on the 15th day of each month.
+var _ = cron.NewJob("accounting-sync", cron.JobConfig{
+	Title:    "Cron Job Example",
+	Schedule: "0 4 15 * *",
+	Endpoint: AccountingSync,
+})
+```
diff --git a/docs/go/primitives/database-extensions.md b/docs/go/primitives/database-extensions.md
new file mode 100644
index 0000000000..384fd2d96e
--- /dev/null
+++ b/docs/go/primitives/database-extensions.md
@@ -0,0 +1,80 @@
+---
+seotitle: Pre-installed PostgreSQL extensions
+seodesc: See the list of pre-installed PostgreSQL extensions available when using Encore
+title: PostgreSQL Extensions
+subtitle: Pre-installed extensions
+infobox: {
+  title: "SQL Databases",
+  import: "encore.dev/storage/sqldb"
+}
+lang: go
+---
+
+Encore uses the [encoredotdev/postgres](https://github.com/encoredev/postgres-image) docker image for local development, CI/CD, and for databases hosted on Encore Cloud.
+
+The docker image ships with the following PostgreSQL extensions pre-installed and available for use (via `CREATE EXTENSION`):
+
+| Extension                      | Version | Description                                                                                                         |
+| ------------------------------ | ------- | ------------------------------------------------------------------------------------------------------------------- |
+| refint                         | 1.0     | functions for implementing referential integrity (obsolete)                                                         |
+| pg_buffercache                 | 1.3     | examine the shared buffer cache                                                                                     |
+| pg_freespacemap                | 1.2     | examine the free space map (FSM)                                                                                    |
+| plpgsql                        | 1.0     | PL/pgSQL procedural language                                                                                        |
+| citext                         | 1.6     | data type for case-insensitive character strings                                                                    |
+| adminpack                      | 2.1     | administrative functions for PostgreSQL                                                                             |
+| moddatetime                    | 1.0     | functions for tracking last modification time                                                                       |
+| amcheck                        | 1.3     | functions for verifying relation integrity                                                                          |
+| seg                            | 1.4     | data type for representing line segments or floating-point intervals                                                |
+| pg_stat_statements             | 1.10    | track planning and execution statistics of all SQL statements executed                                              |
+| pg_trgm                        | 1.6     | text similarity measurement and index searching based on trigrams                                                   |
+| isn                            | 1.2     | data types for international product numbering standards                                                            |
+| btree_gist                     | 1.7     | support for indexing common datatypes in GiST                                                                       |
+| intarray                       | 1.5     | functions, operators, and index support for 1-D arrays of integers                                                  |
+| pg_surgery                     | 1.0     | extension to perform surgery on a damaged relation                                                                  |
+| uuid-ossp                      | 1.1     | generate universally unique identifiers (UUIDs)                                                                     |
+| insert_username                | 1.0     | functions for tracking who changed a table                                                                          |
+| bloom                          | 1.0     | bloom access method - signature file based index                                                                    |
+| pgcrypto                       | 1.3     | cryptographic functions                                                                                             |
+| dblink                         | 1.2     | connect to other PostgreSQL databases from within a database                                                        |
+| tsm_system_rows                | 1.0     | TABLESAMPLE method which accepts number of rows as a limit                                                          |
+| pg_prewarm                     | 1.2     | prewarm relation data                                                                                               |
+| old_snapshot                   | 1.0     | utilities in support of old_snapshot_threshold                                                                      |
+| pageinspect                    | 1.11    | inspect the contents of database pages at a low level                                                               |
+| intagg                         | 1.1     | integer aggregator and enumerator (obsolete)                                                                        |
+| pg_visibility                  | 1.2     | examine the visibility map (VM) and page-level visibility info                                                      |
+| cube                           | 1.5     | data type for multidimensional cubes                                                                                |
+| tablefunc                      | 1.0     | functions that manipulate whole tables, including crosstab                                                          |
+| xml2                           | 1.1     | XPath querying and XSLT                                                                                             |
+| fuzzystrmatch                  | 1.1     | determine similarities and distance between strings                                                                 |
+| pg_walinspect                  | 1.0     | functions to inspect contents of PostgreSQL Write-Ahead Log                                                         |
+| btree_gin                      | 1.3     | support for indexing common datatypes in GIN                                                                        |
+| sslinfo                        | 1.2     | information about SSL certificates                                                                                  |
+| tcn                            | 1.0     | Triggered change notifications                                                                                      |
+| hstore                         | 1.8     | data type for storing sets of (key, value) pairs                                                                    |
+| dict_int                       | 1.0     | text search dictionary template for integers                                                                        |
+| earthdistance                  | 1.1     | calculate great-circle distances on the surface of the Earth                                                        |
+| file_fdw                       | 1.0     | foreign-data wrapper for flat file access                                                                           |
+| autoinc                        | 1.0     | functions for autoincrementing fields                                                                               |
+| ltree                          | 1.2     | data type for hierarchical tree-like structures                                                                     |
+| unaccent                       | 1.1     | text search dictionary that removes accents                                                                         |
+| pgrowlocks                     | 1.2     | show row-level locking information                                                                                  |
+| tsm_system_time                | 1.0     | TABLESAMPLE method which accepts time in milliseconds as a limit                                                    |
+| dict_xsyn                      | 1.0     | text search dictionary template for extended synonym processing                                                     |
+| pgstattuple                    | 1.5     | show tuple-level statistics                                                                                         |
+| postgres_fdw                   | 1.1     | foreign-data wrapper for remote PostgreSQL servers                                                                  |
+| lo                             | 1.1     | Large Object maintenance                                                                                            |
+| postgis_sfcgal-3               | 3.4.2   | PostGIS SFCGAL functions                                                                                            |
+| address_standardizer_data_us-3 | 3.4.2   | Address Standardizer US dataset example                                                                             |
+| address_standardizer-3         | 3.4.2   | Used to parse an address into constituent elements. Generally used to support geocoding address normalization step. |
+| postgis_topology-3             | 3.4.2   | PostGIS topology spatial types and functions                                                                        |
+| postgis-3                      | 3.4.2   | PostGIS geometry and geography spatial types and functions                                                          |
+| postgis_raster-3               | 3.4.2   | PostGIS raster types and functions                                                                                  |
+| postgis_tiger_geocoder-3       | 3.4.2   | PostGIS tiger geocoder and reverse geocoder                                                                         |
+| vector                         | 0.7.0   | vector data type and ivfflat and hnsw access methods                                                                |
+| postgis                        | 3.4.2   | PostGIS geometry and geography spatial types and functions                                                          |
+| address_standardizer           | 3.4.2   | Used to parse an address into constituent elements. Generally used to support geocoding address normalization step. |
+| postgis_topology               | 3.4.2   | PostGIS topology spatial types and functions                                                                        |
+| postgis_tiger_geocoder         | 3.4.2   | PostGIS tiger geocoder and reverse geocoder                                                                         |
+| address_standardizer_data_us   | 3.4.2   | Address Standardizer US dataset example                                                                             |
+| postgis_sfcgal                 | 3.4.2   | PostGIS SFCGAL functions                                                                                            |
+| postgis_raster                 | 3.4.2   | PostGIS raster types and functions                                                                                  |
diff --git a/docs/go/primitives/database-troubleshooting.md b/docs/go/primitives/database-troubleshooting.md
new file mode 100644
index 0000000000..2d2ea38696
--- /dev/null
+++ b/docs/go/primitives/database-troubleshooting.md
@@ -0,0 +1,52 @@
+---
+seotitle: Troubleshooting SQL databases
+seodesc: Advice on troubleshooting SQL databases in Encore.go
+title: Troubleshooting Databases
+subtitle: Advice on troubleshooting SQL databases in Encore.go
+infobox: {
+  title: "SQL Databases",
+  import: "encore.dev/storage/sqldb"
+}
+lang: go
+---
+
+When you run your application locally with `encore run`, Encore provisions local databases using [Docker](https://docker.com). If this fails with a database error, it can often be resolved by making sure you have Docker installed and running, or by restarting the Encore daemon using `encore daemon`.
+
+If this does not resolve the issue, here are steps to resolve common errors:
+
+** Error: sqldb: unknown database **
+
+This error is often caused by a problem with the initial migration file, such as incorrect naming or location.
+
+- Verify that you've [created the migration file](/docs/go/primitives/databases#defining-a-database-schema) correctly, then try `encore run` again.
+
+** Error: could not connect to the database **
+
+When you can't connect to the database in your local environment, there's likely an issue with Docker:
+
+- Make sure that you have [Docker](https://docker.com) installed and running, then try `encore run` again.
+- If this fails, restart the Encore daemon by running `encore daemon`, then try `encore run` again.
+
+** Error: Creating PostgreSQL database cluster Failed **
+
+This means Encore was not able to create the database. Often this is due to a problem with Docker.
+
+- Check if you have permission to access Docker by running `docker images`.
+- Set the correct permissions with `sudo usermod -aG docker $USER` (Learn more in the [Docker documentation](https://docs.docker.com/engine/install/linux-postinstall/))
+- Then log out and log back in so that your group membership is refreshed.
+
+** Error: unable to save docker image **
+
+This error is often caused by a problem with Docker.
+
+- Make sure that you have [Docker](https://docker.com) installed and running.
+- In Docker, open **Settings > Advanced** and make sure that the setting `Allow the default Docker socket to be used` is checked.
+- If it still fails, restart the Encore daemon by running `encore daemon`, then try `encore run` again.
+
+** Error: unable to add CA to cert pool **
+
+This error is commonly caused by the presence of the file `$HOME/.postgresql/root.crt` on the filesystem.
+When this file is present the PostgreSQL client library will assume the database server has that root certificate,
+which will cause the above error.
+
+- Remove or rename the file, then try `encore run` again.
diff --git a/docs/go/primitives/databases.md b/docs/go/primitives/databases.md
new file mode 100644
index 0000000000..3658a0db28
--- /dev/null
+++ b/docs/go/primitives/databases.md
@@ -0,0 +1,238 @@
+---
+seotitle: Using SQL databases for your backend application
+seodesc: Learn how to use SQL databases for your backend application. See how to provision, migrate, and query PostgreSQL databases using Go and Encore.
+title: Using SQL databases
+subtitle: Provisioning, migrating, querying
+infobox: {
+  title: "SQL Databases",
+  import: "encore.dev/storage/sqldb",
+  example_link: "/docs/tutorials/uptime"
+}
+lang: go
+---
+
+Encore treats SQL databases as logical resources and natively supports **PostgreSQL** databases.
+
+## Creating a database
+
+To create a database, import `encore.dev/storage/sqldb` and call `sqldb.NewDatabase`, assigning the result to a package-level variable.
+Databases must be created from within an [Encore service](/docs/go/primitives/services).
+
+For example:
+
+```
+-- todo/db.go --
+package todo
+
+// Create the todo database and assign it to the "tododb" variable
+var tododb = sqldb.NewDatabase("todo", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+
+// Then, query the database using db.QueryRow, db.Exec, etc.
+-- todo/migrations/1_create_table.up.sql --
+CREATE TABLE todo_item (
+  id BIGSERIAL PRIMARY KEY,
+  title TEXT NOT NULL,
+  done BOOLEAN NOT NULL DEFAULT false
+  -- etc...
+);
+```
+
+As seen above, the `sqldb.DatabaseConfig` specifies the directory containing the database migration files, which is how you define the database schema.
+See the [Defining the database schema](#defining-the-database-schema) section below for more details.
+
+With this code in place, Encore will automatically create the database using [Docker](https://docker.com) when you run the command `encore run` in your local environment. Make sure Docker is installed and running on your machine before running `encore run`.
+
+<Callout type="info">
+
+If your application is already running when you define a new database, you will need to stop and restart `encore run`. This is necessary for Encore to create the new database using Docker.
+
+</Callout>
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/sql-database"
+    desc="Simple PostgreSQL example application."
+/>
+
+## Database Migrations
+
+Encore automatically handles `up` migrations, while `down` migrations must be run manually. Each `up` migration runs sequentially, expressing changes in the database schema from the previous migration.
+
+### Naming Conventions
+
+**File Name Format:** Migration files must start with a number followed by an underscore (`_`), and must increase sequentially. Each file name must end with `.up.sql`.
+
+**Examples:**
+- `1_first_migration.up.sql`
+- `2_second_migration.up.sql`
+- `3_migration_name.up.sql`
+
+You can also prefix migration files with leading zeroes for better ordering in the editor (e.g., `0001_migration.up.sql`).
+
+### Defining the Database Schema
+
+The first migration typically defines the initial table structure. For instance, a `todo` service might create `todo/migrations/1_create_table.up.sql` with the following content:
+
+```sql
+CREATE TABLE todo_item (
+    id BIGSERIAL PRIMARY KEY,
+    title TEXT NOT NULL,
+    done BOOLEAN NOT NULL DEFAULT false
+);
+```
+
+### Migration File Structure
+
+Migration files are created in a `migrations` directory within an Encore service package. Each file is named `<number>_<name>.up.sql`, where `<number>` is a sequence number for ordering and `<name>` describes the migration.
+
+**Example Directory Structure:**
+
+```
+/my-app
+├── encore.app                       // ... and other top-level project files
+│
+└── todo                             // todo service (a Go package)
+    ├── migrations                   // todo service db migrations (directory)
+    │   ├── 1_create_table.up.sql    // todo service db migration
+    │   └── 2_add_field.up.sql       // todo service db migration
+    ├── todo.go                      // todo service code
+    └── todo_test.go                 // tests for todo service
+```
+
+## Inserting data into databases
+
+Once you have created the database using `var mydb = sqldb.NewDatabase(...)` you can start inserting data into the database
+by calling methods on the `mydb` variable.
+
+The interface is similar to that of the Go standard library's `database/sql` package.
+Learn more in the [package docs](https://pkg.go.dev/encore.dev/storage/sqldb).
+
+One way of inserting data is with a helper function that uses the package function `sqldb.Exec`.
+For example, to insert a single todo item using the example schema above, we can use the following helper function `insert`:
+
+```
+-- todo/insert.go --
+// insert inserts a todo item into the database.
+func insert(ctx context.Context, id, title string, done bool) error {
+	_, err := tododb.Exec(ctx, `
+		INSERT INTO todo_item (id, title, done)
+		VALUES ($1, $2, $3)
+	`, id, title, done)
+	return err
+}
+-- todo/db.go --
+package todo
+
+// Create the todo database and assign it to the "tododb" variable
+var tododb = sqldb.NewDatabase("todo", sqldb.DatabaseConfig{
+  Migrations: "./migrations",
+})
+
+// Then, query the database using db.QueryRow, db.Exec, etc.
+-- todo/migrations/1_create_table.up.sql --
+CREATE TABLE todo_item (
+  id BIGSERIAL PRIMARY KEY,
+  title TEXT NOT NULL,
+  done BOOLEAN NOT NULL DEFAULT false
+  -- etc...
+);
+```
+
+## Querying databases
+
+To query a database in your application, you similarly need to import `encore.dev/storage/sqldb` in your service package or sub-package.
+
+For example, to read a single todo item in the example schema above, we can use `sqldb.QueryRow`:
+
+```go
+var item struct {
+    ID int64
+    Title string
+    Done bool
+}
+err := tododb.QueryRow(ctx, `
+    SELECT id, title, done
+    FROM todo_item
+    LIMIT 1
+`).Scan(&item.ID, &item.Title, &item.Done)
+```
+
+If `QueryRow` does not find a matching row, it reports an error that can be checked against
+by importing the standard library `errors` package and calling `errors.Is(err, sqldb.ErrNoRows)`.
+
+Learn more in the [package docs](https://pkg.go.dev/encore.dev/storage/sqldb).
+
+## Provisioning databases
+
+Encore automatically provisions databases to match what your application requires.
+When you [define a database](#creating-a-database), Encore will provision the database at your next deployment.
+
+Encore provisions databases in an appropriate way depending on the environment.
+When running locally, Encore creates a database cluster using [Docker](https://www.docker.com/).
+In the cloud, it depends on the [environment type](/docs/platform/deploy/environments#environment-types):
+
+- In `production` environments, the database is provisioned through the Managed SQL Database
+  service offered by the chosen cloud provider.
+- In `development` environments, the database is provisioned as a Kubernetes deployment
+  with a persistent disk attached.
+
+See exactly what is provisioned for each cloud provider, and each environment type, in the [infrastructure documentation](/docs/platform/infrastructure/infra).
+
+## Connecting to databases
+
+It's often useful to be able to connect to the database from outside the backend application. For example for scripts, ad-hoc querying, or dumping data for analysis.
+
+Currently Encore does not expose user credentials for databases in the local environment or for environments on Encore Cloud. You can use a connection string to connect instead, see below.
+
+### Using the Encore CLI
+
+Encore's CLI comes with built-in support for connecting to databases:
+
+* `encore db shell <database-name> [--env=<name>]` opens a [psql](https://www.postgresql.org/docs/current/app-psql.html)
+  shell to the database named `<database-name>` in the given environment. Leaving out `--env` defaults to the local development environment. `encore db shell` defaults to read-only permissions. Use `--write`, `--admin` and `--superuser` flags to modify which permissions you connect with.
+
+* `encore db conn-uri <database-name> [--env=<name>]` outputs a connection string for the database named `<database-name>`.
+  When specifying a cloud environment, the connection string is temporary. Leaving out `--env` defaults to the local development environment.
+
+* `encore db proxy [--env=<name>]` sets up a local proxy that forwards any incoming connection
+  to the databases in the specified environment.
+  Leaving out `--env` defaults to the local development environment.
+
+See `encore help db` for more information on database management commands.
+
+### Using database user credentials
+
+For cloud environments on AWS/GCP you can view database user credentials (created by Encore when provisioning databases) via the Encore Cloud dashboard:
+
+* Open your app in the [Encore Cloud dashboard](https://app.encore.cloud), navigate to the **Infrastructure** page for the appropriate environment, and locate the `USERS` section within the relevant **Database Cluster**.
+
+## Handling migration errors
+
+When Encore applies database migrations, there's always a possibility the migrations don't apply cleanly.
+
+This can happen for many reasons:
+- There's a problem with the SQL syntax in the migration
+- You tried to add a `UNIQUE` constraint but the values in the table aren't actually unique
+- The existing database schema didn't look like you thought it did, so the database object you tried to change doesn't actually exist
+- ... and so on
+
+If that happens, Encore rolls back the migration. If it happens during a cloud deployment, the deployment is aborted.
+Once you fix the problem, re-run `encore run` (locally) or push the updated code (in the cloud) to try again.
+
+Encore tracks which migrations have been applied in the `schema_migrations` table:
+
+```sql
+database=# \d schema_migrations
+          Table "public.schema_migrations"
+ Column  |  Type   | Collation | Nullable | Default
+---------+---------+-----------+----------+---------
+ version | bigint  |           | not null |
+ dirty   | boolean |           | not null |
+Indexes:
+    "schema_migrations_pkey" PRIMARY KEY, btree (version)
+```
+
+The `version` column tracks which migration was last applied. If you wish to skip a migration or re-run a migration,
+change the value in this column. For example, to re-run the last migration, run `UPDATE schema_migrations SET version = version - 1;`.
+*Note that Encore does not use the `dirty` flag by default.*
diff --git a/docs/go/primitives/defining-apis.md b/docs/go/primitives/defining-apis.md
new file mode 100644
index 0000000000..dfdfbf5e40
--- /dev/null
+++ b/docs/go/primitives/defining-apis.md
@@ -0,0 +1,429 @@
+---
+seotitle: Defining type-safe APIs with Encore.go
+seodesc: Learn how to create APIs for your cloud backend application using Go and Encore.go
+title: Defining Type-Safe APIs
+subtitle: Simplifying type-safe API development
+lang: go
+---
+
+Encore.go enables you to create type-safe APIs from regular Go functions.
+
+To define an API, add the `//encore:api` annotation to a function in your code.
+This tells Encore that the function is an API endpoint and Encore will automatically generate the necessary boilerplate at compile-time.
+
+In the example below, we define the API endpoint `Ping`, in the `hello` service, which gets exposed as `hello.Ping`.
+
+```go
+package hello // service name
+
+//encore:api public
+func Ping(ctx context.Context, params *PingParams) (*PingResponse, error) {
+    msg := fmt.Sprintf("Hello, %s!", params.Name)
+    return &PingResponse{Message: msg}, nil
+}
+```
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/hello-world"
+    desc="Hello World REST API example application."
+/>
+
+## Access controls
+
+When you define an API, you have three options for how it can be accessed:
+
+* `//encore:api public` &ndash; defines a public API that anybody on the internet can call.
+* `//encore:api private` &ndash; defines a private API that is never accessible to the outside world. It can only be called from other services in your app and via cron jobs.
+* `//encore:api auth` &ndash; defines a public API that anybody can call, but requires valid authentication.
+
+You can optionally send in auth data to `public` and `private` APIs, in which case the auth handler will be used. When used for `private` APIs, they are still not accessible from the outside world.
+
+For more on defining APIs that require authentication, see the [authentication guide](/docs/go/develop/auth).
+
+## API Schemas
+
+### Request and response schemas
+
+In the example above we defined an API that uses request and response schemas. The request data is of type `PingParams` and the response data of type `PingResponse`. That means we need to define them like so:
+
+```go
+package hello // service name
+
+// PingParams is the request data for the Ping endpoint.
+type PingParams struct {
+    Name string
+}
+
+// PingResponse is the response data for the Ping endpoint.
+type PingResponse struct {
+    Message string
+}
+
+// Ping is an API endpoint that responds with a simple response.
+// This is exposed as "hello.Ping".
+//encore:api public
+func Ping(ctx context.Context, params *PingParams) (*PingResponse, error) {
+    msg := fmt.Sprintf("Hello, %s!", params.Name)
+    return &PingResponse{Message: msg}, nil
+}
+```
+Request and response schemas are both optional. There are four different ways of defining an API:
+
+**Using both request and response data:**<br/>
+`func Foo(ctx context.Context, p *Params) (*Response, error)`
+
+**Only returning a response:**<br/>
+`func Foo(ctx context.Context) (*Response, error)`
+
+**With only request data:**<br/>
+`func Foo(ctx context.Context, p *Params) error`
+
+**Without any request or response data:**<br/>
+`func Foo(ctx context.Context) error`
+
+As you can see, two parts are always present: the `ctx context.Context` parameter and the `error` return value.
+
+The `ctx` parameter is used for *cancellation*. It lets you detect when the caller is no longer interested in the result,
+and lets you abort the request processing and save resources that nobody needs.
+[Learn more about contexts on the Go blog](https://blog.golang.org/context).
+
+The `error` return type is always required because APIs can always fail from the caller's perspective.
+Therefore even though our simple `Ping` API endpoint above never fails in its implementation, from the perspective of the caller perhaps the service is crashing or the network is down and the service cannot be reached.
+
+This approach is simple but very powerful. It lets Encore use [static analysis](/docs/go/concepts/application-model)
+to understand the request and response schemas of all your APIs, which enables Encore to automatically generate API documentation, type-safe API clients, and much more.
+
+### Request and response data types
+
+Request and response data types are structs (or pointers to structs) with optional field tags, which Encore uses to encode API requests to HTTP messages. The same struct can be used for requests and responses, but the `query` tag is ignored when generating responses.
+
+All tags except `json` are ignored for nested tags, which means you can only define `header` and `query` parameters for root level fields.
+
+For example, this struct:
+```go
+type NestedRequestResponse struct {
+	Header string `header:"X-Header"`// this field will be read from the http header
+	Query  string `query:"query"`// this field will be read from the query string
+	Body1  string `json:"body1"`
+	Nested struct {
+	    Header2 string `header:"X-Header2"`// this field will be read from the body
+		Query2  string `query:"query2"`// this field will be read from the body
+		Body2   string `json:"body2"`
+    } `json:"nested"`
+}
+```
+
+Would be unmarshalled from this request:
+
+```output
+POST /example?query=a%20query HTTP/1.1
+Content-Type: application/json
+X-Header: A header
+
+{
+   "body1": "a body",
+   "nested": {
+      "Header2": "not a header",
+      "Query2": "not a query",
+      "body2": "a nested body"
+   }
+}
+
+```
+
+And marshalled to this response:
+
+```output
+HTTP/1.1 200 OK
+Content-Type: application/json
+X-Header: A header
+
+{
+   "Query": "not a query",
+   "body1": "a body",
+   "nested": {
+      "Header2": "not a header",
+      "Query2": "not a query",
+      "body2": "a nested body"
+   }
+}
+
+```
+
+### Path parameters
+
+Path parameters are specified by the `path` field in the `//encore:api` annotation.
+To specify a placeholder variable, use `:name` and add a function parameter with the same name to the function signature.
+Encore parses the incoming request URL and makes sure it matches the type of the parameter. The last segment of the path
+can be parsed as a wildcard parameter by using `*name` with a matching function parameter.
+
+```go
+// GetBlogPost retrieves a blog post by id.
+//encore:api public method=GET path=/blog/:id/*path
+func GetBlogPost(ctx context.Context, id int, path string) (*BlogPost, error) {
+    // Use id to query database...
+}
+```
+
+### Fallback routes
+
+Encore supports defining fallback routes that will be called if no other endpoint matches the request,
+using the syntax `path=/!fallback`.
+
+This is often useful when migrating an existing backend service over to Encore, as it allows you to gradually
+migrate endpoints over to Encore while routing the remaining endpoints to the existing HTTP router using
+a raw endpoint with a fallback route.
+
+For example:
+
+```go
+//encore:service
+type Service struct {
+	oldRouter *gin.Engine // existing HTTP router
+}
+
+// Route all requests to the existing HTTP router if no other endpoint matches.
+//encore:api public raw path=/!fallback
+func (s *Service) Fallback(w http.ResponseWriter, req *http.Request) {
+    s.oldRouter.ServeHTTP(w, req)
+}
+```
+
+### Headers
+
+Headers are defined by the `header` field tag, which can be used in both request and response data types. The tag name is used to translate between the struct field and http headers.
+In the example below, the `Language` field of `ListBlogPost` will be fetched from the
+`Accept-Language` HTTP header.
+
+```go
+type ListBlogPost struct {
+    Language string `header:"Accept-Language"`
+    Author      string // Not a header
+}
+```
+
+### Cookies
+
+Cookies can be set in the response by using the `header` tag with the `Set-Cookie` header name.
+
+```go
+type LoginResponse struct {
+    SessionID string `header:"Set-Cookie"`
+}
+
+//encore:api public method=POST path=/login
+func Login(ctx context.Context) (*LoginResponse, error) {
+    return &LoginResponse{SessionID: "session=123"}, nil
+}
+````
+
+The cookies can then be read using e.g. [structured auth data](/docs/go/develop/auth#accepting-structured-auth-information).
+
+### Query parameters
+
+For `GET`, `HEAD` and `DELETE` requests, parameters are read from the query string by default.
+The query parameter name defaults to the [snake-case](https://en.wikipedia.org/wiki/Snake_case)
+encoded name of the corresponding struct field (e.g. BlogPost becomes blog_post).
+
+The `query` field tag can be used to parse a field from the query string for other HTTP methods (e.g. POST) and to override the default parameter name.
+
+Query strings are not supported in HTTP responses and therefore `query` tags in response types are ignored.
+
+In the example below, the `PageLimit` field will be read from the `limit` query
+parameter, whereas the `Author` field will be parsed from the query string (as `author`) only if the method of
+the request is `GET`, `HEAD` or `DELETE`.
+
+```go
+type ListBlogPost struct {
+    PageLimit  int `query:"limit"` // always a query parameter
+    Author     string              // query if GET, HEAD or DELETE, otherwise body parameter
+}
+```
+
+When fetching data with `GET` endpoints, it's common to receive additional parameters for optional behavior, like filtering a list or changing the sort order.
+
+When you use a struct type as the last argument in the function signature,
+Encore automatically parses these fields from the HTTP query string (for the `GET`, `HEAD`, and `DELETE` methods).
+
+For example, if you want to have a `ListBlogPosts` endpoint:
+
+```go
+type ListParams struct {
+    Limit uint // number of blog posts to return
+    Offset uint // number of blog posts to skip, for pagination
+}
+
+type ListResponse struct {
+    Posts []*BlogPost
+}
+
+//encore:api public method=GET path=/blog
+func ListBlogPosts(ctx context.Context, opts *ListParams) (*ListResponse, error) {
+    // Use limit and offset to query database...
+}
+```
+
+This could then be queried as `/blog?limit=10&offset=20`.
+
+Query parameters are more limited than structured JSON data, and can only consist of basic types (`string`, `bool`, integer and floating point numbers), [Encore's UUID types](https://pkg.go.dev/encore.dev/types/uuid#UUID), and slices of those types.
+
+
+### Body parameters
+
+Encore will default to reading request parameters from the body (as JSON) for all HTTP methods except `GET`, `HEAD` or
+`DELETE`. The name of the body parameter defaults to the field name, but can be overridden by the
+`json` tag. Response fields will be serialized as JSON in the HTTP body unless the `header` tag is set.
+
+There is no tag to force a field to be read from the body, as some infrastructure entities
+do not support body content in `GET`, `HEAD` or `DELETE` requests.
+
+```go
+type CreateBlogPost struct {
+    Subject    string `json:"limit"` // query if GET, HEAD or DELETE, otherwise body parameter
+    Author     string                // query if GET, HEAD or DELETE, otherwise body parameter
+}
+```
+
+### Supported types
+The table below lists the data types supported by each HTTP message location.
+
+| Type            | Header | Path | Query | Body |
+| --------------- | ------ | ---- | ----- | ---- |
+| bool            | X      | X    | X     | X    |
+| numeric         | X      | X    | X     | X    |
+| string          | X      | X    | X     | X    |
+| time.Time       | X      | X    | X     | X    |
+| uuid.UUID       | X      | X    | X     | X    |
+| json.RawMessage | X      | X    | X     | X    |
+| list            |        |      | X     | X    |
+| struct          |        |      |       | X    |
+| map             |        |      |       | X    |
+| pointer         |        |      |       | X    |
+
+
+## Sensitive data
+
+Encore.go comes with built-in tracing functionality that automatically captures request and response payloads
+to simplify debugging. While helpful, that's not always desirable. For instance when a request or response payload contains sensitive data, such
+as API keys or personally identifiable information (PII).
+
+For those use cases Encore supports marking a field as sensitive using the struct tag `encore:"sensitive"`.
+Encore's tracing system will automatically redact fields tagged as sensitive. This works for both individual
+values as well as nested fields.
+
+Note that inputs to [auth handlers](/docs/go/develop/auth) are automatically marked as sensitive and are always redacted.
+
+Raw endpoints lack a schema, which means there's no way to add a struct tag to mark certain data as sensitive.
+For this reason Encore supports tagging the whole API endpoint as sensitive by adding `sensitive` to the `//encore:api` annotation.
+This will cause the whole request and response payload to be redacted, including all request and response headers.
+
+<Callout type="info">
+
+The `encore:"sensitive"` tag is ignored for local development environments to make development and debugging with the Local Development Dashboard easier.
+
+</Callout>
+
+
+### Example
+
+```go
+package blog // service name
+import (
+	"time"
+	"encore.dev/types/uuid"
+)
+
+type Updates struct {
+	Author      string `json:"author,omitempty"`
+	PublishTime time.Time `json:"publish_time,omitempty"`
+}
+
+// BatchUpdateParams is the request data for the BatchUpdate endpoint.
+type BatchUpdateParams struct {
+	Requester     string    `header:"X-Requester"`
+	RequestTime   time.Time `header:"X-Request-Time"`
+	CurrentAuthor string    `query:"author"`
+	Updates       *Updates  `json:"updates"`
+	MySecretKey   string    `encore:"sensitive"`
+}
+
+// BatchUpdateResponse is the response data for the BatchUpdate endpoint.
+type BatchUpdateResponse struct {
+	ServedBy   string       `header:"X-Served-By"`
+	UpdatedIDs []uuid.UUID  `json:"updated_ids"`
+}
+
+//encore:api public method=POST path=/section/:sectionID/posts
+func BatchUpdate(ctx context.Context, sectionID string, params *BatchUpdateParams) (*BatchUpdateResponse, error) {
+	// Update blog posts for section
+	return &BatchUpdateResponse{ServedBy: hostname, UpdatedIDs: ids}, nil
+}
+
+```
+
+## REST APIs
+Encore has support for RESTful APIs and lets you easily define resource-oriented API URLs, parse parameters out of them, and more.
+
+To create a REST API, start by defining an endpoint and specify the `method` and `path` fields in the `//encore:api` comment.
+
+To specify a placeholder variable, use `:name` and add a function parameter with the same name to the function signature. Encore parses the incoming request URL and makes sure it matches the type of the parameter.
+
+For example, if you want to have a `GetBlogPost` endpoint that takes a numeric id as a parameter:
+
+```go
+// GetBlogPost retrieves a blog post by id.
+//encore:api public method=GET path=/blog/:id
+func GetBlogPost(ctx context.Context, id int) (*BlogPost, error) {
+    // Use id to query database...
+}
+```
+
+You can also combine path parameters with body payloads. For example, if you want to have an `UpdateBlogPost` endpoint:
+
+```go
+// UpdateBlogPost updates an existing blog post by id.
+//encore:api public method=PUT path=/blog/:id
+func UpdateBlogPost(ctx context.Context, id int, post *BlogPost) error {
+    // Use `post` to update the blog post with the given id.
+}
+```
+
+<Callout type="important">
+
+You cannot define paths that conflict with each other, including paths
+where the static part can be mistaken for a parameter, e.g both `/blog` and `/blog/:id` would conflict with `/:username`.
+
+</Callout>
+
+As a rule of thumb, try to place path parameters at the end of the path and
+prefix them with the service name, e.g:
+
+```
+GET /blog/posts
+GET /blog/posts/:id
+GET /user/profile/:username
+GET /user/me
+```
+
+## Custom HTTP status codes
+
+By default, Encore automatically sets appropriate HTTP status codes for your API responses. We recommend using these default status codes, but there are situations where you might need to set a custom HTTP status code, such as when porting an existing API that clients depend on for specific status codes.
+
+To set a custom HTTP status code, use the `encore:"httpstatus"` struct tag on a field in your response type:
+
+```go
+type Response struct {
+    Message string `json:"message"`
+    Status  int    `encore:"httpstatus"`
+}
+
+//encore:api public method=GET path=/example
+func Example(ctx context.Context) (*Response, error) {
+    return &Response{
+        Message: "Hello",
+        Status:  201, // HTTP 201 Created
+    }, nil
+}
+```
+
+The field with the `encore:"httpstatus"` tag can be an integer type and should contain a valid HTTP status code value.
diff --git a/docs/go/primitives/insert-test-data-db.md b/docs/go/primitives/insert-test-data-db.md
new file mode 100644
index 0000000000..da4f14faf0
--- /dev/null
+++ b/docs/go/primitives/insert-test-data-db.md
@@ -0,0 +1,46 @@
+---
+seotitle: How to insert test data in a database
+seodesc: Learn how to populate your database with test data using Go and Encore, making testing your backend application much simpler.
+title: Insert test data in a database
+lang: go
+---
+
+When you're developing or testing, it's often useful to seed databases with test data.
+This can be done is several ways depending on your use case.
+
+## Using go:embed
+
+A straightforward way to insert test data is to conditionally insert it on startup using `go:embed` in combination with Encore's [metadata API](/docs/go/develop/metadata) control in which environments the data gets inserted. E.g. only in your local environment.
+
+### Example
+
+Create a file with your test data named `fixtures.sql`.
+Then, for the service where you want to insert test data, add the following to its `.go` file in order to run on startup.
+
+```
+import (
+    _ "embed"
+    "log"
+
+    "encore.dev"
+)
+
+//go:embed fixtures.sql
+var fixtures string
+
+func init() {
+    if encore.Meta().Environment.Cloud == encore.CloudLocal {
+        if _, err := sqldb.Exec(context.Background(), fixtures); err != nil {
+            log.Fatalln("unable to add fixtures:", err)
+        }
+    }
+}
+```
+
+Not included in the above example is preventing adding duplicate data. This is straightforward to do by making the fixtures idempotent, or by tracking it with a database table.
+
+## Populating databases in Encore Cloud's Preview Environments
+
+If you are using Encore Cloud's Preview Environment, it can sometimes be useful to populate new Preview Environments with test data to simplify testing. 
+
+The best way to do this depends a bit on your use case, but a common way to do this is by using Encore's [webhooks](/docs/platform/integrations/webhooks) functionality, which provides notifications for when a deployment is completed and includes information about the environment in question.
diff --git a/docs/go/primitives/object-storage.md b/docs/go/primitives/object-storage.md
new file mode 100644
index 0000000000..d18eb464a1
--- /dev/null
+++ b/docs/go/primitives/object-storage.md
@@ -0,0 +1,331 @@
+---
+seotitle: Using Object Storage in your backend application
+seodesc: Learn how you can use Object Storage to store files and unstructured data in your backend application.
+title: Object Storage
+subtitle: Simple and scalable storage APIs for files and unstructured data
+infobox: {
+  title: "Object Storage",
+  import: "encore.dev/storage/objects",
+}
+lang: go
+---
+
+Object Storage is a simple and scalable solution to store files and unstructured data in your backend application.
+
+The most common implementation is Amazon S3 ("Simple Storage Service") and its semantics are universally supported by every major cloud provider.
+
+Encore.go provides a cloud-agnostic API for working with Object Storage, allowing you to store and retrieve files with ease. It has support for Amazon S3, Google Cloud Storage, as well as any other S3-compatible implementation (such as DigitalOcean Spaces, MinIO, etc.).
+
+Additionally, when you use Encore's Object Storage API you also automatically get:
+
+* Automatic tracing and instrumentation of all Object Storage operations
+* Built-in local development support, storing objects on the local filesystem
+* Support for integration testing, using a local, in-memory storage backend
+
+## Creating a Bucket
+
+The core of Object Storage is the **Bucket**, which represents a collection of files.
+In Encore, buckets must be declared as package level variables, and cannot be created inside functions.
+Regardless of where you create a bucket, it can be accessed from any service by referencing the variable it's assigned to.
+
+When creating a bucket you can configure additional properties, like whether the objects in the bucket should be versioned.
+
+See the complete specification in the [package documentation](https://pkg.go.dev/encore.dev/storage/objects#NewBucket).
+
+For example, to create a bucket for storing profile pictures:
+
+```go
+package user
+
+import "encore.dev/storage/objects"
+
+var ProfilePictures = objects.NewBucket("profile-pictures", objects.BucketConfig{
+	Versioned: false,
+})
+```
+
+## Uploading files
+
+To upload a file to a bucket, use the `Upload` method on the bucket variable.
+It returns a writer that you can use to write the contents of the file.
+
+To complete the upload, call the `Close` method on the writer.
+To abort the upload, either cancel the context or call the `Abort` method on the writer.
+
+The `Upload` method additionally takes a set of options to configure the upload,
+like setting attributes (`objects.WithUploadAttrs`) or to reject the upload if the
+object already exists (`objects.WithPreconditions`).
+See the [package documentation](https://pkg.go.dev/encore.dev/storage/objects#Bucket.Upload) for more details.
+
+```go
+package user
+
+import (
+		"context"
+		"io"
+		"net/http"
+
+		"encore.dev/beta/auth"
+		"encore.dev/beta/errs"
+		"encore.dev/storage/objects"
+)
+
+var ProfilePictures = objects.NewBucket("profile-pictures", objects.BucketConfig{})
+
+//encore:api auth raw method=POST path=/upload-profile-picture
+func UploadProfilePicture(w http.ResponseWriter, req *http.Request) {
+	// Store the user's profile picture with their user id as the key.
+	userID, _ := auth.UserID()
+	key := string(userID) // We store the profile
+
+	writer := ProfilePictures.Upload(req.Context(), key)
+	_, err := io.Copy(writer, req.Body)
+	if err != nil {
+		// If something went wrong with copying data, abort the upload and return an error.
+		writer.Abort()
+		errs.HTTPError(w, err)
+		return
+	}
+
+	if err := writer.Close(); err != nil {
+		errs.HTTPError(w, err)
+		return
+	}
+
+	// All good! Return a 200 OK.
+	w.WriteHeader(http.StatusOK)
+}
+```
+
+## Downloading files
+
+To download a file from a bucket, use the `Download` method on the bucket variable.
+It returns a reader that you can use to read the contents of the file.
+
+The `Download` method additionally takes a set of options to configure the download,
+like downloading a specific version if the bucket is versioned (`objects.WithVersion`).
+See the [package documentation](https://pkg.go.dev/encore.dev/storage/objects#Bucket.Download) for more details.
+
+For example, to download the user's profile picture and serve it:
+
+```go
+package user
+
+import (
+		"context"
+		"io"
+		"net/http"
+
+		"encore.dev"
+		"encore.dev/beta/auth"
+		"encore.dev/beta/errs"
+		"encore.dev/storage/objects"
+)
+
+var ProfilePictures = objects.NewBucket("profile-pictures", objects.BucketConfig{})
+
+//encore:api public raw method=GET path=/profile-picture/:userID
+func ServeProfilePicture(w http.ResponseWriter, req *http.Request) {
+	userID := encore.CurrentRequest().PathParams.Get("userID")
+	reader := ProfilePictures.Download(req.Context(), userID)
+
+	// Did we encounter an error?
+	if err := reader.Err(); err != nil {
+		errs.HTTPError(w, err)
+		return
+	}
+
+	// Assuming all images are JPEGs.
+	w.Header().Set("Content-Type", "image/jpeg")
+	io.Copy(w, reader)
+}
+```
+
+## Listing objects
+
+To list objects in a bucket, use the `List` method on the bucket variable.
+
+It returns an iterator of `(error, *objects.ListEntry)` pairs that you can use
+to easily iterate over the objects in the bucket using a `range` loop.
+
+For example, to list all profile pictures:
+
+```go
+for err, entry := range ProfilePictures.List(ctx, &objects.Query{}) {
+	if err != nil {
+		// Handle error
+	}
+	// Do something with entry
+}
+```
+
+The `*objects.Query` type can be used to limit the number of objects returned,
+or to filter them to a specific key prefix.
+
+See the [package documentation](https://pkg.go.dev/encore.dev/storage/objects#Bucket.List) for more details.
+
+## Deleting objects
+
+To delete an object from a bucket, use the `Remove` method on the bucket variable.
+
+For example, to delete a profile picture:
+
+```go
+err := ProfilePictures.Remove(ctx, "my-user-id")
+if err != nil && !errors.Is(err, objects.ErrObjectNotFound) {
+	// Handle error
+}
+```
+
+## Retrieving object attributes
+
+You can retrieve information about an object using the `Attrs` method on the bucket variable.
+It returns the attributes of the object, like its size, content type, and ETag.
+
+For example, to get the attributes of a profile picture:
+
+```go
+attrs, err := ProfilePictures.Attrs(ctx, "my-user-id")
+if errors.Is(err, objects.ErrObjectNotFound) {
+	// Object not found
+} else if err != nil {
+	// Some other error
+}
+// Do something with attrs
+```
+
+For convenience there is also `Exists` which returns a boolean indicating whether the object exists.
+
+```go
+exists, err := ProfilePictures.Exists(ctx, "my-user-id")
+if err != nil {
+	// Handle error
+} else if !exists {
+	// Object does not exist
+}
+```
+
+## Using Public Buckets
+
+Encore supports creating public buckets where objects can be accessed directly via HTTP/HTTPS without authentication. This is useful for serving static assets like images, videos, or other public files.
+
+To create a public bucket, set `Public: true` in the `BucketConfig`:
+
+```go
+var PublicAssets = objects.NewBucket("public-assets", objects.BucketConfig{
+    Public: true,
+})
+```
+
+Once configured as public, you can get the public URL for any object using the `PublicURL` method:
+
+```go
+// Get the public URL for an object
+url := PublicAssets.PublicURL("path/to/image.jpg")
+
+// The URL can be used directly or shared publicly
+fmt.Println(url) // e.g. https://assets.example.com/path/to/image.jpg
+```
+When self-hosting, see how to configure public buckets in the [infrastructure configuration docs](/docs/ts/self-host/configure-infra).
+
+When deploying with Encore Cloud it will automatically configure the bucket to be publicly accessible and [configure CDN](/docs/platform/infrastructure/infra#production-infrastructure) for optimal content delivery.
+
+### Using bucket references
+
+Encore uses static analysis to determine which services are accessing each bucket,
+and what operations each service is performing.
+
+That information is used to provision infrastructure correctly,
+render architecture diagrams, and configure IAM permissions.
+
+This means that `*objects.Bucket` variables can't be passed around however you'd like,
+as it makes static analysis impossible in many cases. To work around these restrictions
+Encore allows you to get a "reference" to a bucket that can be passed around any way you want
+by calling `objects.BucketRef`.
+
+To ensure Encore still is aware of which permissions each service needs, the call to `objects.BucketRef`
+must be made from within a service. Additionally, it must pre-declare the permissions it needs;
+those permissions are then assumed to be used by the service.
+
+It looks like this (using the `ProfilePictures` topic above):
+
+```go
+ref := objects.BucketRef[objects.Downloader](ProfilePictures)
+
+// ref is of type objects.Downloader, which allows downloading.
+```
+
+Encore provides permission interfaces for each operation that can be performed on a bucket:
+
+* `objects.Downloader` for downloading objects
+* `objects.Uploader` for uploading objects
+* `objects.Lister` for listing objects
+* `objects.Attrser` for getting object attributes
+* `objects.Remover` for removing objects
+* `objects.SignedDownloader` for generating signed download URLs for objects
+* `objects.SignedUploader` for generating signed upload URLs for objects
+
+If you need multiple permissions they can be combined by creating an interface
+that embeds the permissions you need.
+
+```go
+type myPerms interface {
+  objects.Downloader
+  objects.Uploader
+}
+ref := objects.BucketRef[myPerms](ProfilePictures)
+```
+
+For convenience Encore provides an `objects.ReadWriter` interface that gives complete read-write access
+with all the permissions above.
+
+See the [package documentation](https://pkg.go.dev/encore.dev/storage/objects#BucketRef) for more details.
+
+## Signed Upload URLs
+
+You can use `SignedUploadURL` to create signed URLs to allow clients to upload content directly
+into the bucket over the internet. The URL is always restricted to one filename, and has a set
+expiration date. Anyone in possession of the URL can upload data under this filename without any
+additional authentication.
+
+```go
+url, err := ProfilePictures.SignedUploadURL(ctx, "my-user-id", objects.WithTTL(time.Duration(7200)*time.Second))
+// Pass url to client
+```
+
+The client can now `PUT` to this URL with the content as a binary payload.
+
+```bash
+curl -X PUT --data-binary @/home/me/dog-wizard.jpeg "https://storage.googleapis.com/profile-pictures/my-user-id/?x-goog-signature=b7a1<...>"
+```
+
+### Why signed upload URLs?
+
+Signed URLs are an alternative to accepting the content payload directly in your API. Content
+upload requests are sometimes inconvenient to handle well: they can be long running and very large.
+With signed URLs, the content flows directly into the storage bucket, and only object IDs and
+metadata go through your API service.
+
+The trade-off is that the upload flow becomes more complex from a client point of view.
+
+## Signed Download URLs
+
+You can use `SignedDownloadURL` to create signed URLs to allow clients to download content directly
+from the bucket, even if it's private. The URL is always restricted to one filename, and has a set
+expiration date. Anyone in possession of the URL can download the file without any additional
+authentication.
+
+```go
+url, err := Documents.SignedDownloadURL(ctx, "letter-1234", objects.WithTTL(time.Duration(7200)*time.Second))
+// Pass url to client
+```
+
+### Why signed download URLs?
+
+Similar to the upload case, signed download URLs is a way to avoid handing large files or bulk
+traffic through your API. With signed URLs, the content flows directly from the storage bucket,
+and only object IDs and metadata go through your API service.
+
+Note: unless the content is private, prefer serving urls with `PublicURL()` over signed URLs.
+Public URLs go over CDN, which is typically significantly more performant and cost effective.
+
diff --git a/docs/go/primitives/pubsub.md b/docs/go/primitives/pubsub.md
new file mode 100644
index 0000000000..708b9a3559
--- /dev/null
+++ b/docs/go/primitives/pubsub.md
@@ -0,0 +1,378 @@
+---
+seotitle: Using PubSub in your backend application
+seodesc: Learn how you can use PubSub as an asynchronous message queue in your backend application, a great approach for decoupling services for better reliability.
+title: Pub/Sub
+subtitle: Decoupling services and building asynchronous systems
+infobox: {
+  title: "Pub/Sub Messaging",
+  import: "encore.dev/pubsub",
+  example_link: "/docs/tutorials/uptime"
+}
+lang: go
+---
+
+Publishers & Subscribers (Pub/Sub) let you build systems that communicate by broadcasting events asynchronously. This is a great way to decouple services for better reliability and responsiveness.
+
+Encore's Backend Framework lets you use Pub/Sub in a cloud-agnostic declarative fashion. At deployment, Encore automatically [provisions the required infrastructure](/docs/platform/infrastructure/infra).
+
+## Creating a Topic
+
+The core of Pub/Sub is the **Topic**, a named channel on which you publish events.
+Topics must be declared as package level variables, and cannot be created inside functions.
+Regardless of where you create a topic, it can be published to from any service, and subscribed to from any service.
+
+When creating a topic, it must be given an event type, a unique name, and a configuration to define its behaviour. See the complete specification in the [package documentation](https://pkg.go.dev/encore.dev/pubsub#NewTopic).
+
+For example, to create a topic with events about user signups:
+
+```go
+package user
+
+import "encore.dev/pubsub"
+
+type SignupEvent struct{ UserID int }
+
+var Signups = pubsub.NewTopic[*SignupEvent]("signups", pubsub.TopicConfig{
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+```
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/uptime" 
+    desc="Event-driven example application using Pub/Sub." 
+/>
+
+### At-least-once delivery
+
+The above example configures the topic to ensure that, for each subscription, events will be delivered _at least once_.
+
+This means that if the topic believes the event was not processed, it will attempt to deliver the message again.
+**Therefore, all subscription handlers should be [idempotent](https://en.wikipedia.org/wiki/Idempotence#Computer_science_meaning).** This helps ensure that if the handler is called two or more times, from the outside there's no difference compared to calling it once.
+
+This can be achieved using a database to track if you have already performed the action that the event is meant to trigger,
+or ensuring that the action being performed is also idempotent in nature.
+
+### Exactly-once delivery
+
+Topics can also be configured to deliver events _exactly once_ by setting the `DeliveryGuarantee` field to
+`pubsub.ExactlyOnce`. This enables stronger guarantees on the infrastructure level to minimize the likelihood of
+message re-delivery.
+
+
+However, there are still some rare circumstances when a message might be redelivered.  For example, if a networking issue
+causes the acknowledgement of successful processing the message to be lost before the cloud provider receives it
+(the [Two Generals' Problem](https://en.wikipedia.org/wiki/Two_Generals%27_Problem)).  As such, if correctness is critical
+under all circumstances, it's still advisable to design your subscription handlers to be idempotent.
+
+By enabling exactly-once delivery on a topic the cloud provider enforces certain throughput limitations:
+- AWS: 300 messages per second for the topic (see [AWS SQS Quotas](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/quotas-messages.html)).
+- GCP: At least 3,000 messages per second across all topics in the region (can be higher on the region see [GCP PubSub Quotas](https://cloud.google.com/pubsub/quotas#quotas)).
+
+<Callout type="important">
+
+Exactly-once delivery does not perform message deduplication on the publishing side. If  `Publish` is called twice with
+the same message, the message will be delivered twice.
+
+</Callout>
+
+### Ordered Topics
+
+Topics are unordered by default, meaning that messages can be delivered in any order. This allows for better throughput on the topic as messages can be processed in parallel. However, in some cases, messages must be delivered in the order they were published for a given entity.
+
+To create an ordered topic, configure the topic's `OrderingAttribute` to match the `pubsub-attr` tag on one of the top-level fields of the event type. This field ensures that messages delivered to the same subscriber are delivered in the order of publishing for that specific field value. Messages with a different value on the ordering attribute are delivered in an unspecified order.
+
+To maintain topic order, messages with the same ordering key aren't delivered until the earliest message is processed or dead-lettered, potentially causing delays due to [head-of-line blocking](https://en.wikipedia.org/wiki/Head-of-line_blocking). Mitigate processing issues by ensuring robust logging and alerts, and appropriate subscription retry policies.
+
+<Callout type="info">
+
+The `OrderingAttribute` currently has no effect in local environments.
+
+</Callout>
+
+#### Throughput limitations
+
+Each cloud provider enforces certain throughput limitations for ordered topics:
+- **AWS:** 300 messages per second for the topic (see [AWS SQS Quotas](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/quotas-messages.html))
+- **GCP:** 1 MBps for each ordering key (See [GCP Pub/Sub Resource Limits](https://cloud.google.com/pubsub/quotas#resource_limits))
+
+#### Ordered topic example
+
+```go
+package example
+
+import (
+	"context"
+	"encore.dev/pubsub"
+)
+
+type CartEvent struct {
+	ShoppingCartID int `pubsub-attr:"cart_id"`
+	Event          string
+}
+
+var CartEvents = pubsub.NewTopic[*CartEvent]("cart-events", pubsub.TopicConfig{
+	DeliveryGuarantee: pubsub.AtLeastOnce,
+	OrderingAttribute: "cart_id",
+})
+
+func Example(ctx context.Context) error {
+	// These are delivered in order as they all have the same shopping cart ID
+	CartEvents.Publish(ctx, &CartEvent{ShoppingCartID: 1, Event: "item_added"})
+	CartEvents.Publish(ctx, &CartEvent{ShoppingCartID: 1, Event: "checkout_started"})
+	CartEvents.Publish(ctx, &CartEvent{ShoppingCartID: 1, Event: "checkout_completed"})
+
+	// This event may be delivered at any point as it has a different shopping cart ID
+	CartEvents.Publish(ctx, &CartEvent{ShoppingCartID: 2, Event: "item_added"})
+}
+```
+
+## Publishing events
+
+To publish an **Event**, call `Publish` on the topic passing in the event object (which is the type specified in the `pubsub.NewTopic[Type]` constructor).
+
+For example:
+
+```go
+messageID, err := Signups.Publish(ctx, &SignupEvent{UserID: id})
+if err != nil {
+    return err
+}
+
+// If we get here the event has been successfully published,
+// and all registered subscribers will receive the event.
+
+// The messageID variable contains the unique id of the message,
+// which is also provided to the subscribers when processing the event.
+```
+
+By defining the `Signups` topic variable as an exported variable
+you can also publish to the topic from other services in the same way.
+
+### Using topic references
+
+Encore uses static analysis to determine which services are publishing messages
+to what topics. That information is used to provision infrastructure correctly,
+render architecture diagrams, and configure IAM permissions.
+
+This means that `*pubsub.Topic` variables can't be passed around however you'd like,
+as it makes static analysis impossible in many cases. To work around these restrictions
+Encore allows you to get a reference to a topic that can be passed around any way you want.
+
+It looks like this (using the `Signups` topic above):
+
+```go
+signupRef := pubsub.TopicRef[pubsub.Publisher[*SignupEvent]](Signups)
+
+// signupRef is of type pubsub.Publisher[*SignupEvent], which allows publishing.
+```
+
+The difference between a **TopicRef** and a **Topic** is that topic references need to pre-declare
+what permissions are needed. Encore then assumes that all the permissions you declare are used.
+
+For example, if you declare a **TopicRef** with the `pubsub.Publisher` permission (as seen above)
+Encore assumes that the service will publish messages to the topic and provisions the infrastructure
+to support that.
+
+Note that a **TopicRef** must be declared _within a service_, but the reference itself
+can be freely passed around to library code, be dependency injected into [service structs](/docs/go/how-to/dependency-injection),
+and so on.
+
+## Subscribing to Events
+
+To **Subscribe** to events, you create a Subscription as a package level variable by calling the
+[`pubsub.NewSubscription`](https://pkg.go.dev/encore.dev/pubsub#NewSubscription) function.
+
+Each subscription needs:
+- the topic to subscribe to
+- a name which is unique for the topic
+- a configuration object with at least a `Handler` function to process the events
+- a configuration object
+
+Here's an example of how you create a subscription to a topic:
+
+```go
+package email
+
+import (
+    "encore.dev/pubsub"
+    "user"
+)
+
+var _ = pubsub.NewSubscription(
+    user.Signups, "send-welcome-email",
+    pubsub.SubscriptionConfig[*SignupEvent]{
+        Handler: SendWelcomeEmail,
+    },
+)
+func SendWelcomeEmail(ctx context.Context, event *SignupEvent) error {
+    // send email...
+    return nil
+}
+```
+
+Subscriptions can be in the same service as the topic is declared, or in any other service of your application. Each
+subscription to a single topic receives the events independently of any other subscriptions to the same topic. This means
+that if one subscription is running very slowly, it will grow a backlog of unprocessed events.
+However, any other subscriptions will still be processing events in real-time as they are published.
+
+The `ctx` passed to the handler function is cancelled when the `AckDeadline` for the subscription is reached.
+This is the time when the message is considered to have timed out and can be redelivered to another subscriber.
+The timeout defaults to 30 seconds if you don't explicitly configure `AckDeadline`.
+
+### Method-based handlers
+
+When using [service structs](/docs/go/primitives/service-structs) for dependency injection
+it's common to want to define the subscription handler as a method on the service struct, to be able to access the
+injected dependencies. The pubsub package provides the `pubsub.MethodHandler` function for this purpose:
+
+```go
+//encore:service
+type Service struct { /* ... */ }
+
+func (s *Service) SendWelcomeEmail(ctx context.Context, event *SignupEvent) error {
+	// ...
+}
+
+var _ = pubsub.NewSubscription(
+  user.Signups, "send-welcome-email",
+  pubsub.SubscriptionConfig[*SignupEvent]{
+    Handler: pubsub.MethodHandler((*Service).SendWelcomeEmail),
+  },
+)
+```
+
+Note that `pubsub.MethodHandler` only allows referencing methods on the service struct type, not any other type.
+
+### Subscription configuration
+
+When creating a subscription you can configure behavior such as message retention and retry policy, using the `SubscriptionConfig` type. See the [package documentation](https://pkg.go.dev/encore.dev/pubsub#SubscriptionConfig) for the complete configuration options.
+
+<Callout type="info">
+
+The `SubscriptionConfig` struct fields must be defined as compile-time constants, and cannot be defined in
+terms of function calls. This is necessary for Encore to understand the exact requirements of the subscription, in order to provision the correct infrastructure upon deployment.
+
+</Callout>
+
+### Error Handling
+
+If a subscription function returns an error, the event being processed will be retried, based on the retry policy
+[configured on that subscription](https://pkg.go.dev/encore.dev/pubsub#SubscriptionConfig). After the `MaxRetries` is hit,
+the event will be placed into a dead-letter queue (DLQ) for that subscriber. This allows the subscription to continue
+processing events until the bug which caused the event to fail can be fixed. Once fixed, the messages on the dead-letter queue can be manually released to be processed again by the subscriber.
+
+## Testing Pub/Sub
+
+Encore uses a special testing implementation of Pub/Sub topics. When running tests, topics are aware of which test
+is running. This gives you the following guarantees:
+- Your subscriptions will not be triggered by events published. This allows you to test the behaviour of publishers independently of side effects caused by subscribers.
+- Message ID's generated on publish are deterministic (based on the order of publishing), thus your assertions can make use of that fact.
+- Each test is isolated from other tests, meaning that events published in one test will not impact other tests (even if you use parallel testing).
+
+Encore provides a helper function, [`et.Topic`](https://pkg.go.dev/encore.dev/et#Topic), to access the testing topic. You
+can use this object to extract the events that have been published to it during a test.
+
+Here's an example implementation:
+
+```go
+package user
+
+import (
+    "testing"
+
+    "encore.dev/et"
+    "github.com/stretchr/testify/assert"
+)
+
+func Test_Register(t *testing.T) {
+    t.Parallel()
+
+    ... Call Register() and assert changes to the database ...
+
+    // Get all published messages on the Signups topic from this test.
+    msgs := et.Topic(Signups).PublishedMessages()
+    assert.Len(t, msgs, 1)
+}
+```
+
+## Ensuring consistency between services
+
+Ensuring consistency between services in event-driven applications can be challenging, especially when database writes and Pub/Sub publishing are not transactional. This can lead to inconsistencies between services.
+
+To address this issue without adding excessive complexity, consider using a transactional outbox pattern. For more information on implementing this pattern with Encore, see the [Pub/Sub Outbox guide](/docs/primitives/pubsub-outbox).
+
+## The benefits of Pub/Sub
+
+Pub/Sub is a powerful building block in a backend application. It can be used to improve app reliability by reducing the blast radius of faulty components and bottlenecks. It can also be used to increase the speed of response to the user, and even helps reduce cognitive overhead for developers by inverting the dependencies between services.
+
+For those not familiar with Pub/Sub, lets take a look at an example API in a user registration service.
+The behavior we want to implement is that upon registration, we send a welcome email to the user and create a record of the signup in our analytics system. Now let's see how we could implement this only using APIs, compared to how a Pub/Sub implementation might look.
+
+### An API only approach
+
+Using API calls between services, we might design a system which looks like this when the user registers:
+
+<div className="grid grid-cols-3 mobile:grid-cols-1 grid-flow-row">
+
+
+<img src="/assets/docs/pubsub-rpc-example.png" className="noshadow w-100" />
+
+<div className="col-span-2">
+
+1. The `user` service starts a database transaction and records the user in its database.
+2. The `user` service makes a call to the `email` service to send a welcome email.
+3. The `email` service then calls an email provider to actually send the email.
+4. Upon success, the `email` service replies to the `user` service that the request was processed.
+5. The `user` service then calls the `analytics` service to record the signup.
+6. The `analytics` service the writes to the data warehouse to record the information.
+7. The `analytics` service then replies to the `user` service that the request was processed.
+8. The `user` service commits the database transaction.
+9. The `user` service then can reply to the user to say the registration was successful.
+
+</div>
+
+</div>
+
+Notice how we have to wait for everything to complete before we can reply to the user to tell then we've registered them.
+This means that if our email provider takes 3 seconds to send the email, we've now taken 3 seconds to respond to the user,
+when in reality once the user was written to the database, we could have responded to the user instantly at that point to
+confirm the registration.
+
+Another downside to this approach is if our data warehouse is currently broken and reporting errors, our system will also
+report errors whenever anybody tries to signup! Given analytics is purely internal and doesn't impact users, why should
+the analytics system being down impact user signup?
+
+### A Pub/Sub approach
+
+A more ideal solution would be if we could decouple the behaviour of emailing the user and recording our analytics, such that
+the user service only has to record the user in its own database and let the user know they are registered - without worrying
+about the downstream impacts. Thankfully, this is exactly what [Pub/Sub topics](https://pkg.go.dev/encore.dev/pubsub#Topic) allow us to do.
+
+<div className="grid grid-cols-3 mobile:grid-cols-1 grid-flow-row">
+
+<div className="col-span-2">
+
+In this example, when a user registers we:
+
+1. The `user` service starts a database transaction and records the user in its database.
+2. Publish a signup event to the `signups` topic.
+3. Commit the transaction and reply to the user to say the registration was successful.
+
+At this point the user is free to continue interacting with the application and we've isolated the registration behaviour
+from the rest of the application.
+
+In parallel, the `email` and `analytics` services will receive the signup event from the `signups` topic and will then
+perform their respective tasks. If either service returns an error, the event will automatically be backed off and retried
+until the service is able to process the event successfully, or reaches the maximum number of attempts and is placed
+into the deadletter queue (DLQ).
+
+</div>
+
+<img src="/assets/docs/pubsub-topic-example.png" className="noshadow w-100" />
+
+</div>
+
+Notice how in this version, the processing time of the two other services did not impact the end user and in fact the `user`
+service is not even aware of the `email` and `analytics` services. This means that new systems which need to know about
+new users signing up can be added to the application, without the need to change the `user` service or impacting its
+performance.
diff --git a/docs/go/primitives/raw-endpoints.md b/docs/go/primitives/raw-endpoints.md
new file mode 100644
index 0000000000..4101bc43bb
--- /dev/null
+++ b/docs/go/primitives/raw-endpoints.md
@@ -0,0 +1,39 @@
+---
+seotitle: Raw Endpoints
+seodesc: Learn how to create raw API endpoints for your cloud backend application using Go and Encore.go
+title: Raw Endpoints
+subtitle: Drop down in abstraction to access the raw HTTP request
+lang: go
+---
+
+Sometimes you need to operate a lower abstraction than Encore.go normally provides.
+For example, you might want to access the underlying HTTP request, often useful for things like accepting webhooks.
+
+Encore.go has you covered using "raw endpoints".
+
+To define a raw endpoint, change the `//encore:api` annotation and function signature like so:
+
+```go
+package service
+
+import "net/http"
+
+// Webhook receives incoming webhooks from Some Service That Sends Webhooks.
+//encore:api public raw
+func Webhook(w http.ResponseWriter, req *http.Request) {
+    // ... operate on the raw HTTP request ...
+}
+```
+
+Like any other Encore API endpoint, once deployed this will be exposed at the URL: <br/>
+`https://<env>-<app-id>.encr.app/service.Webhook`. Just like regular endpoints, raw endpoints support the use of `:id` and `*wildcard` segments.
+
+Experienced Go developers will have already noted this is just a regular Go HTTP handler.
+(See the <a href="https://pkg.go.dev/net/http#Handler" target="_blank" rel="nofollow">net/http documentation</a> for how Go HTTP handlers work.)
+
+Learn more about receiving webhooks and using WebSockets in the [receiving regular HTTP requests guide](/docs/go/how-to/http-requests).
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/slack-bot" 
+    desc="Slack Bot example application that uses Raw endpoints to accept webhooks." 
+/>
diff --git a/docs/go/primitives/secrets.md b/docs/go/primitives/secrets.md
new file mode 100644
index 0000000000..90a64d8a43
--- /dev/null
+++ b/docs/go/primitives/secrets.md
@@ -0,0 +1,101 @@
+---
+seotitle: Securely storing API keys and secrets
+seodesc: Learn how to store API keys, and secrets, securely for your backend application. Encore's built in vault makes it simple to keep your app secure.
+title: Storing Secrets and API keys
+subtitle: Simply storing secrets securely
+lang: go
+---
+
+Wouldn't it be nice to store secret values like API keys, database passwords, and private keys directly in the source code?
+Of course, we can’t do that &ndash; it's horrifyingly insecure!
+(Unfortunately, it's also [very common](https://www.ndss-symposium.org/ndss-paper/how-bad-can-it-git-characterizing-secret-leakage-in-public-github-repositories/).)
+
+Encore's built-in secrets manager makes it simple to store secrets in a secure way and lets you use them in your program like regular variables.
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/slack-bot"
+    desc="Slack Bot example application using secrets to store a Slack key."
+/>
+
+## Using secrets in your application
+
+To use a secret in your application, first define it directly in your code by creating an unexported struct named `secrets`, where all fields are of type `string`. For example:
+
+```go
+var secrets struct {
+    SSHPrivateKey string    // ed25519 private key for SSH server
+    GitHubAPIToken string   // personal access token for deployments
+    // ...
+}
+```
+
+When you've defined secrets in your program, the Encore compiler will check that they are set before running or deploying your application. If a secret is not set, you will get a compilation error notifying you that a secret value is missing.
+
+Once you've provided values for all secrets, you can just use them in your application like a regular variable. For example:
+
+```go
+func callGitHub(ctx context.Context) {
+    req, _ := http.NewRequestWithContext(ctx, "GET", "https:///api.github.com/user", nil)
+    req.Header.Add("Authorization", "token " + secrets.GitHubAPIToken)
+    resp, err := http.DefaultClient.Do(req)
+    // ... handle err and resp
+}
+```
+
+<Callout type="info">
+
+Secret keys are globally unique for your whole application. If multiple services use the same secret name they both receive the same secret value at runtime.
+
+</Callout>
+
+## Storing secret values
+
+### Using the Encore Cloud dashboard
+
+The simplest way to set up secrets is with the Secrets Manager in the Encore Cloud dashboard. Open your app in [app.encore.cloud](https://app.encore.cloud), go to **Settings** in the main navigation, and then click on **Secrets** in the settings menu.
+
+From here you can create secrets, save secret values, and configure different values for different environments.
+
+<img src="/assets/docs/secrets.png" title="Encore's Secrets Manager"/>
+
+### Using the CLI
+
+If you prefer, you can also set up secrets from the CLI using:<br/> `encore secret set --type <types> <secret-name>`
+
+`<types>` defines which environment types the secret value applies to. Use a comma-separated list of `production`, `development`, `preview`, and `local`. Shorthands: `prod`, `dev`, `pr`.
+
+For example `encore secret set --type prod SSHPrivateKey` sets the secret value for production environments,<br/> and `encore secret set --type dev,preview,local GitHubAPIToken` sets the secret value for development, preview, and local environments.
+
+In some cases, it can be useful to define a secret for a specific environment instead of an environment type.
+You can do so with `encore secret set --env <env-name> <secret-name>`. Secret values for specific environments
+take precedence over values for environment types.
+
+### Environment settings
+
+Each secret can only have one secret value for each environment type. For example: If you have a secret value that's shared between `development`, `preview` and `local`, and you want to override the value for `local`, you must first edit the existing secret and remove `local` using the Secrets Manager in the [Encore Cloud dashboard](https://app.encore.cloud). You can then add a new secret value for `local`. The end result should look something like the picture below.
+
+<img src="/assets/docs/secretoverride.png" title="Overriding a secret in Encore's Secrets Manager"/>
+
+## How it works: Where secrets are stored
+
+When you store a secret Encore stores it encrypted using Google Cloud Platform's [Key Management Service](https://cloud.google.com/security-key-management) (KMS).
+
+- **Production / Your own cloud:** When you deploy to production using your own cloud account on GCP or AWS, Encore provisions a secrets manager in your account (using either KMS or AWS Secrets Manager) and replicates your secrets to it. The secrets are then injected into the container using secret environment variables.
+- **Local:** For local secrets Encore automatically replicates them to developers' machines when running `encore run`.
+- **Development / Encore Cloud:** Environments on Encore's development cloud (running on GCP under the hood) work the same as self-hosted GCP environments, using GCP Secrets Manager.
+
+### Overriding local secrets
+
+When setting secrets via the `encore secret set` command, they are automatically synced to all developers
+working on the same application, courtesy of Encore Cloud.
+
+In some cases, however, you want to override a secret only for your local machine.
+This can be done by creating a file named `.secrets.local.cue` in the root of your Encore application,
+next to the `encore.app` file.
+
+The file contains key-value pairs of secret names to secret values. For example:
+
+```cue
+GitHubAPIToken: "my-local-override-token"
+SSHPrivateKey: "custom-ssh-private-key"
+```
diff --git a/docs/go/primitives/service-structs.md b/docs/go/primitives/service-structs.md
new file mode 100644
index 0000000000..97bdd09c43
--- /dev/null
+++ b/docs/go/primitives/service-structs.md
@@ -0,0 +1,122 @@
+---
+seotitle: Service Structs
+seodesc: Learn how to use service structs to define APIs as methods.
+title: Service structs
+lang: go
+---
+
+Encore lets you define a type, called a service struct, to represent your running service. This lets you define an initialization function (similar to the `main` function in regular Go programs).
+
+You can also define API endpoints as methods on the service struct type, enabling you to use [dependency injection](/docs/go/how-to/dependency-injection) for testing purposes.
+
+It works by defining a struct type of your choice (typically called `Service`)
+and declaring it with `//encore:service`.
+Then, you can define a special function named `initService`
+(or `initWhatever` if you named the type `Whatever`)
+that gets called by Encore to initialize your service when it starts up.
+
+It looks like this:
+```go
+//encore:service
+type Service struct {
+	// Add your dependencies here
+}
+
+func initService() (*Service, error) {
+	// Write your service initialization code here.
+}
+
+//encore:api public
+func (s *Service) MyAPI(ctx context.Context) error {
+	// ...
+}
+```
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/uptime" 
+    desc="Event-driven example application using service structs." 
+/>
+
+## Calling APIs defined on service structs
+
+When using a service struct like above, Encore will create a file named `encore.gen.go`
+in your service directory. This file contains package-level functions for the APIs defined
+as methods on the service struct. In the example above, you would see:
+
+```go
+// Code generated by encore. DO NOT EDIT.
+
+package email
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+func Send(ctx context.Context, p *SendParams) error {
+	// The implementation is elided here, and generated at compile-time by Encore.
+	return nil
+}
+```
+
+These functions are generated in order to allow other services to keep calling your
+APIs as package-level functions, in the same way as before: `email.Send(...)`.
+This means other services do not need to care about whether you're using Dependency Injection
+internally. You must always use these generated package-level functions for making API calls.
+
+<Callout type="info">
+
+Encore will automatically generate these files and keep them up to date
+whenever your code changes. There is no need to manually invoke anything
+to regenerate this code.
+
+</Callout>
+
+Encore adds all `encore.gen.go` files to your `.gitignore` since you typically
+don't want to commit them to your repository; doing so ends up creating
+a lot of unnecessary merge conflicts.
+
+However, in some cases when running third-party linters in a CI/CD environment
+it can be helpful to generate these wrappers to make the linter happy.
+You can do that by invoking `encore gen wrappers`.
+
+## Graceful Shutdown
+
+When defining a service struct, Encore supports notifying
+your service when it's time to gracefully shut down. This works
+by having your service struct implement the method
+`func (s *Service) Shutdown(force context.Context)`.
+
+If that method exists, Encore will call it when it's time to begin
+gracefully shutting down. Initially the shutdown is in "graceful mode",
+which means that you have a few seconds to complete ongoing work.
+
+The provided `force` context is canceled when the graceful shutdown window
+is over, and it's time to forcefully shut down. How much time you have
+from when `Shutdown` is called to when forceful shutdown begins depends on the
+cloud provider and the underlying infrastructure. Typically it's in the range 5-30 seconds.
+
+<Callout type="info">
+
+Encore automatically handles graceful shutdown of all Encore-managed
+functionality, such as HTTP servers, database connection pools,
+Pub/Sub message receivers, distributed tracing recorders, and so on.
+
+The graceful shutdown functionality is provided if you have additional,
+non-Encore-related resources that need graceful shutdown.
+
+</Callout>
+
+Note that graceful shutdown in Encore is *cooperative*: Encore will wait indefinitely
+for your `Shutdown` method to return. If your `Shutdown` method does not return promptly
+after the `force` context is closed, the underlying infrastructure at your cloud provider
+will typically force-kill your service, which can lead to lingering connections and other
+such issues.
+
+In summary, when your `Shutdown(force context.Context)` function is called:
+
+- Immediately begin gracefully shutting down
+- When the `force` context is canceled, you should forcefully shut down
+  the resources that haven't yet completed their shutdown
+- Wait until the shutdown is complete before returning from the `Shutdown` function
diff --git a/docs/go/primitives/services.md b/docs/go/primitives/services.md
new file mode 100644
index 0000000000..82151e77de
--- /dev/null
+++ b/docs/go/primitives/services.md
@@ -0,0 +1,42 @@
+---
+seotitle: Defining services with Encore.go
+seodesc: Learn how to create microservices and define APIs for your cloud backend application using Go and Encore. The easiest way of building cloud backends.
+title: Defining Services
+subtitle: Simplifying (micro-)service development
+lang: go
+---
+
+Encore.go makes it simple to build applications with one or many services, without needing to manually handle the typical complexity of developing microservices.
+
+## Defining a service
+
+With Encore.go you define a service by [defining at least one API](/docs/go/primitives/defining-apis) within a regular Go package. Encore recognizes this as a service, and uses the package name as the service name.
+
+On disk it might look like this:
+
+```
+/my-app
+├── encore.app          // ... and other top-level project files
+│
+├── hello               // hello service (a Go package)
+│   ├── hello.go        // hello service code
+│   └── hello_test.go   // tests for hello service
+│
+└── world               // world service (a Go package)
+    └── world.go        // world service code
+```
+
+
+This means building a microservices architecture is as simple as creating multiple Go packages within your application.
+See the [app structure documentation](/docs/go/primitives/app-structure) for more details.
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/trello-clone" 
+    desc="Simple microservices example application." 
+/>
+
+## Service Initialization
+
+Under the hood Encore automatically generates a `main` function that initializes all your infrastructure resources when the application starts up. This means you don't write a `main` function for your Encore application.
+
+If you want to customize the initialization behavior of your service, you can define a service struct and define custom initialization logic with that. See the [service struct docs](/docs/go/primitives/service-structs) for more info.
diff --git a/docs/go/primitives/share-db-between-services.md b/docs/go/primitives/share-db-between-services.md
new file mode 100644
index 0000000000..fc1f5c0b33
--- /dev/null
+++ b/docs/go/primitives/share-db-between-services.md
@@ -0,0 +1,64 @@
+---
+seotitle: How to share SQL databases between services
+seodesc: Learn how to share a SQL database between multiple Go backend services using Encore.
+title: Share SQL databases between services
+lang: go
+---
+
+By default, each service in an Encore app has its own database. This approach has many benefits: 
+- Which database is used and how it works is abstracted away from other services
+- The database is more isolated, making changes to it smaller and safer
+- By making the services more independent your application becomes more reliable by being able to more gracefully handle partial outages, such as if your database is temporarily overloaded or offline.
+
+But like everything else in software engineering, there are trade-offs involved, and sometimes it's simpler and more reliable to use a single database that's accessed by multiple services. Encore makes this easy to do.
+
+Each database in Encore is defined within a service. That service's name becomes the name of the database. Other services can then access that database by creating a database reference with `sqldb.Named("dbname")`.
+
+## Example
+
+Let's say you have a simple `todo` service, with only one table:
+
+**`todo/migrations/1_create_table.up.sql`**
+
+```sql
+CREATE TABLE todo_item (
+    id BIGSERIAL PRIMARY KEY,
+    title TEXT NOT NULL,
+    done BOOLEAN NOT NULL DEFAULT FALSE
+);
+```
+
+You want to create a `report` service that produces various reports for internal business processes, but for simplicity you decide it makes sense to directly access the `todo` database. All that's needed is to define the `todoDB` variable like so:
+
+**`report/report.go`**
+
+```go
+package report
+
+import (
+	"context"
+
+	"encore.dev/storage/sqldb"
+)
+
+// todoDB connects to the "todo" service's database.
+var todoDB = sqldb.Named("todo")
+
+type ReportResponse struct {
+    Total int
+}
+
+// CountCompletedTodos generates a report with the number of completed todo items.
+//encore:api method=GET path=/report/todo
+func CountCompletedTodos(ctx context.Context) (*ReportResponse, error) {
+    var report ReportResponse
+    err := todoDB.QueryRow(ctx,`
+        SELECT COUNT(*)
+        FROM todo_item
+        WHERE completed = TRUE
+    `).Scan(&report.Total)
+    return &report, err
+}
+```
+
+With that, Encore understands that the `report` service depends on the `todo` service's database, and orchestrates the necessary connections to make that happen. And like everything else with Encore, it works exactly the same regardless of where it's running: for local development as well as in the cloud.
diff --git a/docs/go/quick-start.mdx b/docs/go/quick-start.mdx
new file mode 100644
index 0000000000..6e591a3b2a
--- /dev/null
+++ b/docs/go/quick-start.mdx
@@ -0,0 +1,227 @@
+---
+seotitle: Quick Start Guide – Learn how to build backends with Encore.go
+seodesc: See how you to build and ship a cloud based backend application using Go and Encore. Install Encore and build a REST API in just a few minutes.
+title: Quick Start Guide
+subtitle: Build your first Encore.go app in 5 minutes
+lang: go
+---
+
+In this short guide, you'll learn key concepts and experience the Encore workflow.
+It should only take about 5 minutes to complete and by the end you'll have an API running in Encore's free development Cloud (Encore Cloud).
+
+To make it easy to follow along, we've laid out a trail of croissants to guide your way.
+Whenever you see a 🥐 it means there's something for you to do.
+
+## 1. Install the Encore CLI
+To develop with Encore, you need the Encore CLI. It provisions your local environment, and runs your local
+development dashboard complete with tracing and API documentation.
+
+🥐 Install by running the appropriate command for your system:
+
+<InstallInstructions/>
+
+## 2. Create your app
+🥐 Create your app by running:
+```shell
+$ encore app create
+```
+If this is the first time you're using Encore, you'll be asked if you wish to create a free account.
+This is needed when you want Encore to manage functionality like secrets and handle cloud deployments (which we'll use later on in the tutorial).
+
+🥐 Continue by picking a name for your app and select the `Hello World` template.
+
+This will create an example application, with a simple REST API, in a new folder using the app name you picked.
+
+### Optional: Add Encore LLM instructions
+
+To help LLM powered tools like Cursor and GitHub Copilot understand how to use Encore, you can add pre-made instructions to your app.
+
+🥐 Download the [go_llm_instructions.txt](https://github.com/encoredev/encore/blob/main/go_llm_instructions.txt) file.
+  
+  **How to use:**
+  - Cursor: Rename the file to `.cursorrules`.
+  - GitHub Copilot: Paste content in `.github/copilot-instructions.md`.
+  - For other tools, place the file in your app root.
+
+### Let's take a look at the code
+
+Part of what makes Encore different is the simple developer experience when building distributed systems.
+Let's look at the code to better understand how to build applications with Encore.
+
+🥐 Open the `hello.go` file in your code editor. It's located in the folder: `your-app-name/hello/`.
+
+You should see this:
+
+```go
+-- hello/hello.go --
+// Service hello implements a simple hello world REST API.
+package hello
+
+import (
+	"context"
+)
+
+// This is a simple REST API that responds with a personalized greeting.
+//
+//encore:api public path=/hello/:name
+func World(ctx context.Context, name string) (*Response, error) {
+	msg := "Hello, " + name + "!"
+	return &Response{Message: msg}, nil
+}
+
+type Response struct {
+	Message string
+}
+```
+
+As you can see, it's all standard Go code except for a few lines specific to Encore's Backend Framework.
+
+One such element is the API annotation:
+
+```
+//encore:api public path=/hello/:name
+```
+
+This annotation is all that's needed for Encore to understand that the Go package `hello` is a service, and
+the `World` function is a public API endpoint.
+
+To create more services and endpoints, you simply create new Go packages and define endpoints using
+the `//encore:api` annotation. _If you're curious, you can read more about [defining APIs](/docs/go/primitives/defining-apis)._
+
+Encore.go provides several other declarative ways of using backend
+primitives, such as databases, Pub/Sub, and scheduled tasks. All defined in your application code.
+
+## 3. Start your app & Explore the Local Development Dashboard
+
+🥐 Run your app locally:
+
+```shell
+$ cd your-app-name # replace with the app name you picked
+$ encore run
+```
+
+You should see this:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/encorerun.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+That means your local development environment is up and running!
+Encore takes care of setting up all the necessary infrastructure for your applications, even including databases and Pub/Sub.
+
+### Open the Local Development Dashboard
+
+You can now start using your [Local Development Dashboard](/docs/go/observability/dev-dash).
+
+🥐 Open [http://localhost:9400](http://localhost:9400) in your browser to access it.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/localdashvideo.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+The Local Development Dashboard is a powerful tool to help you move faster when you're developing new features.
+
+It comes with an API explorer, a Service Catalog with automatically generated documentation, and powerful observability features
+like [distributed tracing](/docs/go/observability/tracing).
+
+Through the Local Development Dashboard you also have access to [Encore Flow](/docs/go/observability/encore-flow),
+a visual representation of your microservice architecture that updates in real-time as you develop your application.
+
+### Call your API
+
+🥐 While you keep the app running, call your API from the API Explorer:
+
+<img className="mx-auto w-full" src="/assets/docs/qs_call.png" title="Call API from Local Dashboard" />
+
+You can also open a separate terminal to call your API endpoint:
+
+```shell
+$ curl http://localhost:4000/hello/world
+{"Message": "Hello, world!"}
+```
+
+If you see this JSON response, you've successfully made an API call to your very first Encore application. Well done, you're on your way!
+
+### Review a trace of the request
+
+You can now take a look at the trace for the request you just made by clicking on it in the right column in the local dashboard.
+
+<img className="mx-auto w-full" src="/assets/docs/qs_trace.png" title="Tracing in the Local Dashboard" />
+
+With such a simple API, there's not much to it, just a simple request and response.
+
+However, just imagine how powerful it is to have tracing when you're developing a more complex system with multiple services, Pub/Sub, and databases.
+(Learn more about Encore's tracing capabilities in the [tracing docs](/docs/go/observability/tracing).)
+
+## 4. Make a code change
+
+Let's put our mark on this API and make our first code change.
+
+🥐 Head back to your code editor and look at the `hello.go` file again.
+If you can't come up a creative change yourself, why not simply change the "Hello" message to a more sassy "Howdy"?
+
+🥐 Once you've made your change, save the file.
+
+When you save, the daemon run by the Encore CLI instantly detects the change and automatically recompiles your application and reloads your local development environment.
+
+The output where you're running your app will look something like this:
+
+```output
+Changes detected, recompiling...
+Reloaded successfully.
+INF registered endpoint endpoint=World path=/hello/:name service=hello
+INF listening for incoming HTTP requests
+```
+
+🥐 Test your change by calling your API again.
+
+```shell
+$ curl http://localhost:4000/hello/world
+{"Message": "Howdy, world!"}
+```
+
+Great job, you made a change and your app was reloaded automatically.
+
+Now you're ready to head to the cloud!
+
+## 5. Deploy your app
+
+### Generating Docker image
+
+You can either deploy by generating a Docker image for you app using:
+```shell
+$ encore build docker MY-IMAGE:TAG
+````
+
+This will compile your application using the host machine and then produce a Docker image containing the compiled application.
+You can now deploy this anywhere you like. Learn more in the [self-host docs](/docs/go/self-host/docker-build).
+
+### Deploy using Encore Cloud
+Optionally, you can use [Encore Cloud](https://encore.dev/use-cases/devops-automation) to automatically deploy your application.
+It comes with built-in free development hosting, and for production offers fully automated deployment to your own cloud on AWS or GCP.
+
+🥐 To deploy, simply push your changes to Encore:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Encore Cloud will now build and test your app, provision the needed infrastructure, and deploy your application to a staging environment.
+
+After triggering the deployment, you will see a URL where you can view its progress in the Encore Cloud dashboard.
+It will look something like: `https://app.encore.cloud/$APP_ID/deploys/...`
+
+🥐 Open the URL to access the Encore Cloud dashboard and check the progress of your deployment.
+
+You can now use the Cloud Dashboard to view production [traces](/docs/go/observability/tracing), [connect your cloud account](/docs/platform/deploy/own-cloud), [integrate with GitHub](/docs/platform/integrations/github), and much more.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/webdashvideo.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+## What's next?
+
+- Check out the [REST API tutorial](/docs/go/tutorials/rest-api) to learn how to create endpoints, use databases, and more.
+- Join the friendly community on [Discord](/discord) to ask questions and meet other Encore developers.
diff --git a/docs/go/self-host/ci-cd.md b/docs/go/self-host/ci-cd.md
new file mode 100644
index 0000000000..f961e3ec5e
--- /dev/null
+++ b/docs/go/self-host/ci-cd.md
@@ -0,0 +1,85 @@
+---
+seotitle: Integrate with your CI/CD pipeline
+seodesc: Learn how to integrate Encore.go with your CI/CD pipeline.
+title: Integrate with your CI/CD pipeline
+lang: go
+---
+
+Encore seamlessly integrates with any CI/CD pipeline through its CLI tools. You can automate Docker image creation using the `encore build` command as part of your deployment workflow.
+
+## Integrating with CI/CD Platforms
+
+While every CI/CD pipeline is unique, integrating Encore follows a straightforward process. Here are the key steps:
+
+1. Install the Encore CLI in your CI environment
+2. Use `encore build docker` to create Docker images
+3. Push the images to your container registry
+4. Deploy to your infrastructure
+
+Refer to your CI/CD platform's documentation for more details on how to integrate CLI tools like `encore build`.
+
+### GitHub actions example
+
+This example shows how to build, push, and deploy an Encore Docker image to DigitalOcean using GitHub Actions.
+The DigitalOcean application is set up re-deploy the application every time an image with the tag `latest` is uploaded. 
+
+```yaml
+name: Build, Push and Deploy a Encore Docker Image to DigitalOcean
+
+on:
+  push:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-push-deploy-image:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download Encore CLI script
+        uses: sozo-design/curl@v1.0.2
+        with:
+          args: --output install.sh -L https://encore.dev/install.sh
+
+      - name: Install Encore CLI
+        run: bash install.sh
+
+      - name: Log in to DigitalOcean container registry
+        run: docker login registry.digitalocean.com -u my-email@gmail.com -p ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
+
+      - name: Build Docker image
+        run: /home/runner/.encore/bin/encore build docker myapp
+
+      - name: Tag Docker image
+        run: docker tag myapp registry.digitalocean.com/<YOUR_CONTAINER_REGISTRY_NAME>/<YOUR_IMAGE_REPOSITORY_NAME>:latest
+
+      - name: Push Docker image
+        run: docker push registry.digitalocean.com/<YOUR_CONTAINER_REGISTRY_NAME>/<YOUR_IMAGE_REPOSITORY_NAME>:latest
+```
+
+## Building Docker Images
+
+The `encore build docker` command provides several options to customize your builds:
+
+```bash
+# Build specific services and gateways
+encore build docker --services=service1,service2 --gateways=api-gateway MY-IMAGE:TAG
+
+# Customize the base image
+encore build docker --base=node:18-alpine MY-IMAGE:TAG
+```
+
+The image will default to run on port 8080, but you can customize it by setting the `PORT` environment variable when starting your image.
+
+```bash
+docker run -e PORT=8081 -p 8081:8081 MY-IMAGE:TAG
+```
+
+Learn more about the `encore build docker` command in the [build Docker images](/docs/go/self-host/docker-build) guide.
+
+Continue to learn how to [configure infrastructure](/docs/go/self-host/configure-infra).
diff --git a/docs/go/self-host/configure-infra.md b/docs/go/self-host/configure-infra.md
new file mode 100644
index 0000000000..454c2ce647
--- /dev/null
+++ b/docs/go/self-host/configure-infra.md
@@ -0,0 +1,546 @@
+---
+title: Configure Infrastructure
+seotitle: Configure Infrastructure
+seodesc: Learn how to configure infrastructure resources for your Encore app.
+lang: go
+---
+If you are using infrastructure resources, such as SQL databases, Pub/Sub, or metrics, you will need to configure your Docker image with the necessary configuration.
+The `build` command lets you provide this by specifying a path to a config file using the `--config` flag.
+
+```bash
+encore build docker --config path/to/infra-config.json MY-IMAGE:TAG
+```
+
+The configuration file should be a JSON file using the [Encore Infra Config](https://encore.dev/schemas/infra.schema.json) schema.
+
+This supports configuring things like:
+
+- How to access infrastructure resources (what provider to use, what credentials to use, etc.)
+- How to call other services over the network ("service discovery"),
+  most notably their base URLs.
+- Observability configuration (where to export metrics, etc.)
+- Metadata about the environment the application is running in, to power Encore's metadata APIs
+- The values for any application-defined secrets.
+
+This configuration is necessary for the application to behave correctly.
+
+## Example
+
+Here's an example configuration file you can use.
+
+```json
+{
+  "$schema": "https://encore.dev/schemas/infra.schema.json",
+  "metadata": {
+    "app_id": "my-app",
+    "env_name": "my-env",
+    "env_type": "production",
+    "cloud": "gcp",
+    "base_url": "https://my-app.com"
+  },
+  "sql_servers": [
+    {
+      "host": "my-db-host:5432",
+      "databases": {
+        "my-db": {
+          "username": "my-db-owner",
+          "password": {"$env": "DB_PASSWORD"}
+        }
+      }
+    }
+  ],
+  "service_discovery": {
+    "myservice": {
+      "base_url": "https://myservice:8044"
+    }
+  },
+  "redis": {
+    "my-redis": {
+      "database_index": 0,
+      "auth": {
+        "type": "acl",
+        "username": "encoreredis",
+        "password": {"$env": "REDIS_PASSWORD"}
+      },
+      "host": "my-redis-host",
+    }
+  },
+  "metrics": {
+    "type": "prometheus",
+    "remote_write_url": "https://my-remote-write-url"
+  },
+  "graceful_shutdown": {
+    "total": 30
+  },
+  "auth": [
+    {
+      "type": "key",
+      "id": 1,
+      "key": {"$env": "SVC_TO_SVC_KEY"}
+    }
+  ],
+  "secrets": {
+    "AppSecret": {"$env": "APP_SECRET"}
+  },
+  "pubsub": [
+    {
+      "type": "gcp_pubsub",
+      "project_id": "my-project",
+      "topics": {
+        "my-topic": {
+          "name": "gcp-topic-name",
+          "subscriptions": {
+            "encore-subscription": {
+              "name": "gcp-subscription-name"
+            }
+          }
+        }
+      }
+    }
+  ],
+  "object_storage": [
+    {
+      "type": "gcs",
+      "buckets": {
+          "my-gcs-bucket": {
+            "name": "my-gcs-bucket",
+          }
+        }
+    }
+  ]
+}
+```
+
+## Configuring Infrastructure
+To use infrastructure resources, additional configuration must be added so that Encore is aware of how to access each infrastructure resource.
+See below for examples of each type of infrastructure resource.
+
+### 1. Basic Environment Metadata Configuration
+
+```json
+{
+  "metadata": {
+    "app_id": "my-encore-app",
+    "env_name": "production",
+    "env_type": "production",
+    "cloud": "aws",
+    "base_url": "https://api.myencoreapp.com"
+  }
+}
+```
+
+- `app_id`: The ID of your Encore application.
+- `env_name`: The environment name, such as `production`, `staging`, or `development`.
+- `env_type`: Specifies the type of environment (`production`, `test`, `development`, or `ephemeral`).
+- `cloud`: The cloud provider hosting the infrastructure (e.g., `aws`, `gcp`, or `azure`).
+- `base_url`: The base URL for services in the environment.
+
+### 2. Graceful Shutdown Configuration
+
+```json
+{
+  "graceful_shutdown": {
+    "total": 30,
+    "shutdown_hooks": 10,
+    "handlers": 20
+  }
+}
+```
+
+- `total`: The total time allowed for the shutdown process in seconds.
+- `shutdown_hooks`: The time allowed for executing shutdown hooks.
+- `handlers`: The time allocated for processing request handlers during the shutdown.
+
+### 3. Authentication Methods Configuration
+Private endpoints will not require authentication if no authentication methods are specified. This is typically fine when services are deployed on a private network such as a VPC. But sometimes you might need to connect to other services over the public internet, in which case you'll want to ensure private endpoints are only accessible to other backend services. To do that you can configure authentication methods.
+Encore currently supports authentication through a shared key, which you can specify in your infrastructure configuration file.
+```json
+{
+  "auth": [
+    {
+      "type": "key",
+      "id": 1,
+      "key": {
+        "$env": "SERVICE_API_KEY"
+      }
+    }
+  ]
+}
+```
+
+- `type`: The authentication method type (e.g., `key`).
+- `id`: The ID associated with the authentication method.
+- `key`: The authentication key, which can be set using an environment variable reference.
+
+### 4. Service Discovery Configuration
+Service discovery is used to access other services over the network. You can configure service discovery in the infrastructure configuration file.
+If you export all services into the same docker image, you don't need to configure service discovery as it will be automatically
+configured when the services are started.
+
+```json
+{
+  "service_discovery": {
+    "myservice": {
+      "base_url": "https://myservice.myencoreapp.com",
+      "auth": [
+        {
+          "type": "key",
+          "id": 1,
+          "key": {
+            "$env": "MY_SERVICE_API_KEY"
+          }
+        }
+      ]
+    }
+  }
+}
+```
+- `myservice`: This is the name of the service as it is declared in your Encore app.
+- `base_url`: The base URL for the service.
+- `auth`: Authentication methods used for accessing the service. If no authentication methods are specified, the service will use the auth methods defined in the `auth` section.
+
+### 5. Metrics Configuration
+Similarly to cloud infrastructure resources, Encore supports configurable metrics exports:
+
+* Prometheus
+* DataDog
+* GCP Cloud Monitoring
+* AWS CloudWatch
+
+This is configured by setting the metrics field. Below are examples for each of the supported metrics providers:
+#### 5.1. Prometheus Configuration
+
+```json
+{
+  "metrics": {
+    "type": "prometheus",
+    "collection_interval": 15,
+    "remote_write_url": {
+      "$env": "PROMETHEUS_REMOTE_WRITE_URL"
+    }
+  }
+}
+```
+
+#### 5.2. Datadog Configuration
+
+```json
+{
+  "metrics": {
+    "type": "datadog",
+    "collection_interval": 30,
+    "site": "datadoghq.com",
+    "api_key": {
+      "$env": "DATADOG_API_KEY"
+    }
+  }
+}
+```
+
+#### 5.3. GCP Cloud Monitoring Configuration
+
+```json
+{
+  "metrics": {
+    "type": "gcp_cloud_monitoring",
+    "collection_interval": 60,
+    "project_id": "my-gcp-project",
+    "monitored_resource_type": "gce_instance",
+    "monitored_resource_labels": {
+      "instance_id": "1234567890",
+      "zone": "us-central1-a"
+    },
+    "metric_names": {
+      "cpu_usage": "compute.googleapis.com/instance/cpu/usage_time"
+    }
+  }
+}
+```
+
+#### 5.4. AWS CloudWatch Configuration
+
+```json
+{
+  "metrics": {
+    "type": "aws_cloudwatch",
+    "collection_interval": 60,
+    "namespace": "MyAppMetrics"
+  }
+}
+```
+
+### 6. SQL Database Configuration
+The SQL databases you've declared in your Encore app must be configured in the infrastructure configuration file.
+There must be exactly one database configuration for each declared database. You can configure multiple SQL servers if needed.
+
+```json
+{
+  "sql_servers": [
+    {
+      "host": "db.myencoreapp.com:5432",
+      "tls_config": {
+        "disabled": false,
+        "ca": "---BEGIN CERTIFICATE---\n...",
+        "disable_tls_hostname_verification": false,
+        "disable_ca_verification": false
+      },
+      "databases": {
+        "my-database": {
+          "name": "my-postgres-db-name",
+          "max_connections": 100,
+          "min_connections": 10,
+          "username": "db_user",
+          "password": {
+            "$env": "DB_PASSWORD"
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+- `my-database`: This is the name of the database as it is declared in your Encore app.
+- `name`: The name of the database on the database server. Defaults to the declared Encore name.
+- `host`: SQL server host, optionally including the port.
+- `tls_config`: TLS configuration for secure connections. If the server uses TLS with a non-system CA root, or requires a client certificate, specify the appropriate fields as PEM-encoded strings. Otherwise, they can be left empty.
+- `databases`: List of databases, each with connection settings.
+
+### 7. Secrets Configuration
+
+#### 7.1. Using Direct Secrets
+You can set the secret value directly in the configuration file, or use an environment variable reference to set the secret value.
+
+```json
+{
+  "secrets": {
+    "API_TOKEN": "embedded-secret-value",
+    "DB_PASSWORD": {
+      "$env": "DB_PASSWORD"
+    }
+  }
+}
+```
+
+- `API_TOKEN`: This is the name of a secret as it is declared in your Encore app.
+
+#### 7.2. Using Environment Reference
+As an alternative, you can use an environment variable reference to set the secret value. The env variable should be set in the environment where the application is running. The content
+of the environment variable should be a JSON string where each key is the secret name and the value is the secret value.
+
+```json
+{
+  "secrets": {
+    "$env": "SECRET_JSON"
+  }
+}
+```
+
+### 8. Redis Configuration
+
+```json
+{
+  "redis": {
+    "my-redis": {
+      "host": "redis.myencoreapp.com:6379",
+      "database_index": 0,
+      "auth": {
+        "type": "auth",
+        "auth_string": {
+          "$env": "REDIS_AUTH_STRING"
+        }
+      },
+      "max_connections": 50,
+      "min_connections": 5
+    }
+  }
+}
+```
+
+- `my-redis`: This is the name of the redis resource as it is declared in your Encore app.
+- `host`: Redis server host, optionally including the port.
+- `auth`: Authentication configuration for the Redis server.
+- `key_prefix`: Prefix applied to all keys.
+
+### 9. Pub/Sub Configuration
+Encore currently supports the following Pub/Sub providers:
+- `nsq` for [NSQ](https://nsq.io/)
+- `gcp` for [Google Cloud Pub/Sub](https://cloud.google.com/pubsub)
+- `aws` for AWS [SNS](https://aws.amazon.com/sns/) + [SQS](https://aws.amazon.com/sqs/)
+- `azure` for [Azure Service Bus](https://azure.microsoft.com/en-us/products/service-bus)
+
+The configuration for each provider is different. Below are examples for each provider.
+#### 9.1. GCP Pub/Sub
+
+```json
+{
+  "pubsub": [
+    {
+      "type": "gcp_pubsub",
+      "project_id": "my-gcp-project",
+      "topics": {
+        "my-topic": {
+          "name": "my-topic",
+          "project_id": "my-gcp-project",
+          "subscriptions": {
+            "my-subscription": {
+              "name": "my-subscription",
+              "push_config": {
+                "id": "my-push",
+                "service_account": "service-account@my-gcp-project.iam.gserviceaccount.com"
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+- `my-topic`: This is the name of the topic as it is declared in your Encore app.
+- `my-subscription`: This is the name of the subscription as it is declared in your Encore app.
+- `project_id`: The default GCP project ID. This can be overridden by setting the `project_id` field in the topic or subscription.
+- `name`: The name of the topic or subscription.
+- `push_config/id`: The id will be appended to `/__encore/pubsub/push/` to form the full push path of your service, e.g. `/__encore/pubsub/push/<id>`. This is the path your service expects to receive push messages on.
+- `push_config/service_account`: The service account configured for the push subscription.
+
+#### 9.2. AWS SNS/SQS
+
+```json
+{
+  "pubsub": [
+    {
+      "type": "aws_sns_sqs",
+      "topics": {
+        "my-topic": {
+          "arn": "arn:aws:sns:us-east-1:123456789012:my-topic",
+          "subscriptions": {
+            "my-queue": {
+              "arn": "arn:aws:sqs:us-east-1:123456789012:my-queue"
+            }
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+- `my-topic`: This is the name of the topic as it is declared in your Encore app.
+- `my-queue`: This is the name of the queue as it is declared in your Encore app.
+- `arn`: The ARN of the SNS topic or SQS queue.
+
+#### 9.3. NSQ Configuration
+
+```json
+{
+  "pubsub": [
+    {
+      "type": "nsq",
+      "hosts": "nsq.myencoreapp.com:4150",
+      "topics": {
+        "my-topic": {
+          "name": "my-topic",
+          "subscriptions": {
+            "my-subscription": {
+                "name": "my-subscription"
+            }
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+- `my-topic`: This is the name of the topic as it is declared in your Encore app.
+- `my-subscription`: This is the name of the subscription as it is declared in your Encore app.
+
+### 10. Object Storage Configuration
+Encore currently supports the following object storage providers:
+- `gcs` for [Google Cloud Storage](https://cloud.google.com/storage)
+- `s3` for [AWS S3](https://aws.amazon.com/s3/) or a custom S3-compatible provider
+
+#### 10.1. GCS Configuration
+
+```json
+{
+  "object_storage": [
+    {
+      "type": "gcs",
+      "buckets": {
+        "my-gcs-bucket": {
+          "name": "my-gcs-bucket",
+          "key_prefix": "my-optional-prefix/",
+          "public_base_url": "https://my-gcs-bucket-cdn.example.com/my-optional-prefix"
+        }
+      }
+    }
+  ]
+}
+```
+
+- `my-gcs-bucket`: This is the name of the bucket as it is declared in your Encore app.
+- `name`: The full name of the GCS bucket.
+- `key_prefix`: An optional prefix to apply to all keys in the bucket.
+- `public_base_url`: A URL to use for public access to the bucket. This field is required if you configure your bucket to be public. Encore will append the object key to this URL when generating public URLs. The optional prefix will not be appended.
+
+#### 10.2. S3 Configuration
+
+```json
+{
+  "object_storage": [
+    {
+      "type": "s3",
+      "region": "us-east-1",
+      "buckets": {
+        "my-s3-bucket": {
+          "name": "my-s3-bucket",
+          "key_prefix": "my-optional-prefix/",
+          "public_base_url": "https://my-gcs-bucket-cdn.example.com/my-optional-prefix"
+        }
+      }
+    }
+  ]
+}
+```
+
+- `my-s3-bucket`: This is the name of the bucket as it is declared in your Encore app.
+- `region`: The AWS region where the bucket is located.
+- `name`: The full name of the S3 bucket.
+- `key_prefix`: An optional prefix to apply to all keys in the bucket.
+- `public_base_url`: A URL to use for public access to the bucket. This field is required if you configure your bucket to be public. Encore will append the object key to this URL when generating public URLs. The optional prefix will not be appended.
+
+#### 10.3. Custom S3 Provider Configuration
+You can also configure a custom S3 provider by specifying the endpoint, access key id, and secret access key. Custom S3 providers are useful if you are using a S3-compatible storage provider such as [Cloudflare R2](https://developers.cloudflare.com/r2/).
+```json
+{
+  "object_storage": [
+    {
+      "type": "s3",
+      "region": "auto",
+      "endpoint": "https://...",
+      "access_key_id": "...",
+      "secret_access_key": {
+          "$env": "BUCKET_SECRET_ACCESS_KEY"
+      },
+      "buckets": {
+        "my-custom-bucket": {
+          "name": "my-custom-bucket",
+          "key_prefix": "my-optional-prefix/",
+          "public_base_url": "https://my-gcs-bucket-cdn.example.com/my-optional-prefix"          
+        }
+      }
+    }
+  ]
+}
+```
+
+- `my-custom-bucket`: This is the name of the bucket as it is declared in your Encore app.
+- `region`: The region where the bucket is located.
+- `name`: The full name of the bucket
+- `key_prefix`: An optional prefix to apply to all keys in the bucket.
+- `public_base_url`: A URL to use for public access to the bucket. This field is required if you configure your bucket to be public. Encore will append the object key to this URL when generating public URLs. The optional prefix will not be appended.
+
+This guide covers typical infrastructure configurations. Adjust according to your specific requirements to optimize your Encore app's infrastructure setup.
diff --git a/docs/go/self-host/deploy-to-digital-ocean-wip.md b/docs/go/self-host/deploy-to-digital-ocean-wip.md
new file mode 100644
index 0000000000..474ea39e3e
--- /dev/null
+++ b/docs/go/self-host/deploy-to-digital-ocean-wip.md
@@ -0,0 +1,197 @@
+---
+seotitle: How to deploy an Encore app to DigitalOcean
+seodesc: Learn how to deploy an Encore application to DigitalOcean's App Platform using Docker.
+title: Deploy to DigitalOcean
+lang: go
+---
+
+If you prefer manual deployment over the automation offered by Encore's Platform, Encore simplifies the process of deploying your app to the cloud provider of your choice. This guide will walk you through deploying an Encore app to DigitalOcean's App Platform using Docker.
+
+### Prerequisites
+1. **DigitalOcean Account**: Make sure you have a DigitalOcean account. If not, you can [sign up here](https://www.digitalocean.com/).
+2. **Docker Installed**: Ensure Docker is installed on your local machine. You can download it from the [Docker website](https://www.docker.com/get-started).
+3. **Encore CLI**: Install the Encore CLI if you haven’t already. You can follow the installation instructions from the [Encore documentation](https://encore.dev/docs/go/install).
+4. **DigitalOcean CLI (Optional)**: You can install the DigitalOcean CLI for more flexibility and automation, but it’s not necessary for this tutorial.
+
+### Step 1: Create an Encore App
+1. **Create a New Encore App**: 
+    - If you haven’t already, create a new Encore app using the Encore CLI.
+    - You can use the following command to create a new app:
+    ```bash
+    encore app create myapp
+    ``` 
+    - Select the `Hello World` template.
+    - Follow the prompts to create the app.
+
+2. **Build a Docker image**:
+    - Build the Encore app to generate the docker image for deployment:
+    ```bash
+    encore build docker myapp  
+    ```
+### Step 2: Push the Docker Image to a Container Registry
+To deploy your Docker image to DigitalOcean, you need to push it to a container registry. DigitalOcean supports
+its own container registry, but you can also use DockerHub or other registries. Here’s how to push the image to DigitalOcean’s registry:
+
+1. **Create a DigitalOcean Container Registry**:
+    - Go to the [DigitalOcean Control Panel](https://cloud.digitalocean.com/registries) and create a new container registry.
+    - Follow the instructions to set it up.
+
+2. **Login to DigitalOcean's registry**:
+   Use the login command provided by DigitalOcean, which will look something like this:
+   ```bash
+   doctl registry login
+   ```
+   You’ll need the DigitalOcean CLI for this, which can be installed from [DigitalOcean CLI documentation](https://docs.digitalocean.com/reference/doctl/how-to/install/).
+
+3. **Tag your Docker image**:
+   Tag your image to match the registry’s URL.
+   ```bash
+   docker tag myapp registry.digitalocean.com/YOUR_REGISTRY_NAME/myapp:latest
+   ```
+
+4. **Push your Docker image to the registry**:
+   ```bash
+   docker push registry.digitalocean.com/YOUR_REGISTRY_NAME/myapp:latest
+   ```
+
+### Step 3: Deploy the Docker Image to DigitalOcean App Platform
+1. **Navigate to the App Platform**:
+   Go to [DigitalOcean's App Platform](https://cloud.digitalocean.com/apps).
+
+2. **Create a New App**:
+    - Click on **"Create App"**.
+    - Choose the **"DigitalOcean Container Registry"** option.
+
+3. **Select the Docker Image Source**:
+    - Select the image you pushed earlier.
+
+4. **Configure the App Settings**:
+    - **Set up scaling options**: Configure the number of containers, CPU, and memory settings.
+    - **Environment variables**: Add any environment variables your application might need.
+    - **Choose the region**: Pick a region close to your users for better performance.
+
+5. **Deploy the App**:
+    - Click **"Next"**, review the settings, and click **"Create Resources"**.
+    - DigitalOcean will take care of provisioning the infrastructure, pulling the Docker image, and starting the application.
+
+### Step 4: Monitor and Manage the App
+1. **Access the Application**:
+    - Once deployed, you will get a public URL to access your application.
+    - Test the app to ensure it’s running as expected, e.g. 
+   ```bash
+      curl https://myapp.ondigitalocean.app/hello/world
+    ```
+
+2. **View Logs and Metrics**:
+    - Go to the **"Runtime Logs"** tab in the App Platform to view logs
+    - Go to the **"Insights"** tab to view performance metrics.
+
+3. **Manage Scaling and Deployment Settings**:
+    - You can change the app configuration, such as scaling settings, deployment region, or environment variables.
+
+### Step 5: Add a Database to Your App
+
+DigitalOcean’s App Platform provides managed databases, allowing you to add a database to your app easily. Here’s how to set up a managed database for your app:
+
+1. **Navigate to the DigitalOcean Control Panel**:
+   - Go to [DigitalOcean Control Panel](https://cloud.digitalocean.com/).
+   - Click on **"Databases"** in the left-hand sidebar.
+
+2. **Create a New Database Cluster**:
+   - Click **"Create Database Cluster"**.
+   - Choose **PostgreSQL**
+   - Select the **database version**, **data center region**, and **cluster configuration** (e.g., development or production settings based on your needs).
+   - **Name the database** and configure other settings if necessary, then click **"Create Database Cluster"**.
+
+3. **Configure the Database Settings**:
+   - Once the database is created, go to the **"Connection Details"** tab of the database dashboard.
+   - Copy the **connection string** or individual settings (host, port, username, password, database name). You will need these details to connect your app to the database.
+   - Download the **CA certificate**
+
+4. **Create a Database**
+   - Connect to the database using the connection string provided by DigitalOcean.
+   ```bash
+   psql -h mydb.db.ondigitalocean.com -U doadmin -d mydb -p 25060
+   ```
+   - Create a database
+   ```sql
+    CREATE DATABASE mydb;
+    ```
+   - Create a table
+   ```sql
+     CREATE TABLE users (
+        id SERIAL PRIMARY KEY,
+        name VARCHAR(50)
+     );
+     INSERT INTO users (name) VALUES ('Alice');
+   ```
+   
+5. **Declare a Database in your Encore app**:
+   - Open your Encore app’s codebase.
+   - Add `mydb` database to your app ([Encore Database Documentation](https://encore.dev/docs/ts/primitives/databases))
+   ```typescript
+      const mydb = new SQLDatabase("mydb", {
+         migrations: "./migrations",
+      });
+
+      export const getUser = api(
+        { expose: true, method: "GET", path: "/names/:id" },
+        async ({id}: {id:number}): Promise<{ id: number; name: string }> => {
+          return await mydb.queryRow`SELECT * FROM users WHERE id = ${id}` as { id: number; name: string };
+        }
+      );
+   ```
+
+6. **Create an Encore Infrastructure config**
+   - Create a file named `infra.config.json` in the root of your Encore app.
+   - Add the **CA certificate** and the connection details to the file:
+   ```json
+   {
+      "$schema": "https://encore.dev/schemas/infra.schema.json",
+      "sql_servers": [
+      {
+         "host": "mydb.db.ondigitalocean.com:25060",
+         "tls_config": {
+            "ca": "-----BEGIN CERTIFICATE-----\n..."
+         },
+         "databases": {
+            "mydb": {
+               "username": "doadmin",
+               "password": {"$env": "DB_PASSWORD"}
+             }
+         }
+      }]   
+   }
+   ```
+
+7. **Set Up Environment Variables (Optional)**:
+   - Go to the DigitalOcean App Platform dashboard.
+   - Select your app.
+   - In the **"Settings"** section, go to **"App-Level Environment Variables"**
+   - Add the database password as an encrypted environment variable called `DB_PASSWORD`.
+
+8. **Build and push the Docker image**:
+   - Build the Docker image with the updated configuration.
+   ```bash
+   encore build docker --config infra.config.json myapp
+   ```
+   - Tag and push the Docker image to the DigitalOcean container registry.
+   ```bash
+   docker tag myapp registry.digitalocean.com/YOUR_REGISTRY_NAME/myapp:latest
+   docker push registry.digitalocean.com/YOUR_REGISTRY_NAME/myapp:latest
+   ```
+
+9. **Test the Database Connection**:
+   - Redeploy the app on DigitalOcean to apply the changes.
+   - Test the database connection by calling the API
+   ```bash
+    curl https://myapp.ondigitalocean.app/names/1
+   ```
+
+### Troubleshooting Tips
+- **Deployment Failures**: Check the build logs for any errors. Make sure the Docker image is correctly tagged and pushed to the registry.
+- **App Not Accessible**: Verify that the correct port is exposed in the Dockerfile and the App Platform configuration.
+- **Database Connection Issues**: Ensure the database connection details are correct and the database is accessible from the app.
+
+### Conclusion
+That’s it! You’ve successfully deployed an Encore app to DigitalOcean’s App Platform using Docker. You can now scale your app, monitor its performance, and manage it easily through the DigitalOcean dashboard. If you encounter any issues, refer to the DigitalOcean documentation or the Encore community for help. Happy coding!
\ No newline at end of file
diff --git a/docs/go/self-host/self-host.md b/docs/go/self-host/self-host.md
new file mode 100644
index 0000000000..285c605dd4
--- /dev/null
+++ b/docs/go/self-host/self-host.md
@@ -0,0 +1,33 @@
+---
+seotitle: Build Docker Images
+seodesc: Learn how to build Docker images for your Encore application, which can be self-hosted on your own infrastructure.
+title: Build Docker Images
+lang: go
+---
+
+Encore supports building Docker images directly from the CLI, which can then be self-hosted on your own infrastructure of choice.
+
+This can be a good choice if Encore Cloud isn't a good fit for your use case, or if you want to [migrate away](/docs/go/migration/migrate-away).
+
+## Building your own Docker image
+
+To build your own Docker image, use `encore build docker MY-IMAGE:TAG` from the CLI.
+
+This will compile your application using the host machine and then produce a Docker image containing the compiled application. The base image defaults to `scratch` for GO apps and `node:slim` for TS, but can be customized with `--base`.
+
+This is exactly the same code path that Encore's CI system uses to build Docker images, ensuring compatibility.
+
+By default, all your services are included and started by the Docker image. If you want to specify specific services and gateways to include, you can use the `--services` and `--gateways` flags.
+
+```bash
+encore build docker --services=service1,service2 --gateways=api-gateway MY-IMAGE:TAG
+```
+
+The image will default to run on port 8080, but you can customize it by setting the `PORT` environment variable when starting your image.
+
+```bash
+docker run -e PORT=8081 -p 8081:8081 MY-IMAGE:TAG
+```
+
+Congratulations, you've built your own Docker image! 🎉
+Continue to learn how to [configure infrastructure](/docs/go/self-host/configure-infra).
\ No newline at end of file
diff --git a/docs/go/tutorials/booking-system.mdx b/docs/go/tutorials/booking-system.mdx
new file mode 100644
index 0000000000..cc2397f65c
--- /dev/null
+++ b/docs/go/tutorials/booking-system.mdx
@@ -0,0 +1,977 @@
+---
+title: Building a Booking System
+subtitle: Learn how to build your own appointment booking system with both user facing and admin functionality
+seotitle: How to build an Appointment Booking System in Go
+seodesc: Learn how to build an appointment booking tool using Go and Encore. Get your entire application running in the cloud in 30 minutes!
+lang: go
+---
+
+In this tutorial we'll build a booking system with a user facing UI (see available slots and book appointments) and an admin dashboard (manage scheduled appointments and set availability). You will learn how to:
+
+* Create API endpoints using Encore (both public and authenticated).
+* Working with PostgreSQL databases using [sqlc](https://sqlc.dev/) and [pgx](https://github.com/jackc/pgx).
+* Scrub sensitive user data from traces.
+* Work with dates and times in Go.
+* Authenticate requests using an auth handler.
+* Send emails using a SendGrid integration.
+
+[Demo version of the app](https://prod-booking-system-teti.encr.app/frontend)
+
+The final result will look like this:
+
+<img className="w-full h-auto" src="/assets/tutorials/booking-system/user-calendar.png" title="User calendar" />
+
+<img className="w-full h-auto" src="/assets/tutorials/booking-system/admin-dashboard.png" title="Admin dashboard" />
+
+If you want to skip ahead you can view the final project here: [https://github.com/encoredev/examples/tree/main/booking-system](https://github.com/encoredev/examples/tree/main/booking-system)
+
+## 1. Create your Encore application
+
+<Callout type="info">
+
+To make it easier to follow along, we've laid out a trail of croissants to guide your way.
+Whenever you see a 🥐 it means there's something for you to do.
+
+Make sure you have [Docker](https://docker.com) installed and running, it is used by Encore to run PostgreSQL databases locally.
+</Callout>
+
+🥐 Create a new Encore application, using this tutorial project's starting-point branch. This gives you a ready-to-go frontend to use.
+
+```shell
+$ encore app create booking-system --example=github.com/encoredev/example-booking-system/tree/starting-point
+```
+
+
+🥐 Check that your frontend works:
+
+```shell
+$ cd booking-system
+$ encore run
+```
+
+Then visit [http://localhost:4000/frontend/](http://localhost:4000/frontend/) to see the frontend.
+It won't function yet, since we haven't yet built the backend, so let's do just that!
+
+When we're done we'll have a backend with this [architecture](/docs/go/observability/encore-flow):
+
+<img className="w-full h-auto" src="/assets/tutorials/booking-system/booking-system-flow.png" title="Encore Flow" />
+
+## 2. Create booking service
+
+Let's start by creating the functionality to view bookable slots.
+
+With Encore you define a service by [defining one or more APIs](/docs/go/primitives/defining-apis) within a regular Go package. Encore recognizes this as a service, and uses the package name as the service name. When deploying, Encore will automatically [provision the required infrastructure](/docs/platform/infrastructure/infra) for each service.
+
+We already have a Go package named `booking`, let's turn that into an Encore service.
+
+🥐 Inside the `booking` folder, create a file named `slots.go`.
+
+```shell
+$ touch booking/slots.go
+```
+
+🥐 Add an Encore API endpoint named `GetBookableSlots` that takes a date as input. The endpoint will return a list of bookable slots from the supplied date and six days forward (so that we can show a week view calendar in the UI).
+
+```go
+-- booking/slots.go --
+// Service booking keeps track of bookable slots in the calendar.
+package booking
+
+import (
+	"context"
+	"github.com/jackc/pgx/v5/pgtype"
+	"time"
+)
+
+const DefaultBookingDuration = 1 * time.Hour
+
+type BookableSlot struct {
+	Start time.Time `json:"start"`
+	End   time.Time `json:"end"`
+}
+
+type SlotsParams struct{}
+
+type SlotsResponse struct{ Slots []BookableSlot }
+
+//encore:api public method=GET path=/slots/:from
+func GetBookableSlots(ctx context.Context, from string) (*SlotsResponse, error) {
+	fromDate, err := time.Parse("2006-01-02", from)
+	if err != nil {
+		return nil, err
+	}
+
+	const numDays = 7
+
+	var slots []BookableSlot
+	for i := 0; i < numDays; i++ {
+		date := fromDate.AddDate(0, 0, i)
+		daySlots, err := bookableSlotsForDay(date)
+		if err != nil {
+			return nil, err
+		}
+		slots = append(slots, daySlots...)
+	}
+
+	return &SlotsResponse{Slots: slots}, nil
+}
+
+func bookableSlotsForDay(date time.Time) ([]BookableSlot, error) {
+	// 09:00
+	availStartTime := pgtype.Time{
+		Valid:        true,
+		Microseconds: int64(9*3600) * 1e6,
+	}
+	// 17:00
+	availEndTime := pgtype.Time{
+		Valid:        true,
+		Microseconds: int64(17*3600) * 1e6,
+	}
+
+	availStart := date.Add(time.Duration(availStartTime.Microseconds) * time.Microsecond)
+	availEnd := date.Add(time.Duration(availEndTime.Microseconds) * time.Microsecond)
+
+	// Compute the bookable slots in this day, based on availability.
+	var slots []BookableSlot
+	start := availStart
+	for {
+		end := start.Add(DefaultBookingDuration)
+		if end.After(availEnd) {
+			break
+		}
+		slots = append(slots, BookableSlot{
+			Start: start,
+			End:   end,
+		})
+		start = end
+	}
+
+	return slots, nil
+}
+```
+
+The availability is currently hardcoded to be 09:00 - 17:00 for each day. Later we'll add the functionality to set it for each day of the week.
+We are also returning time slots that have already passed. Don't worry, we'll come back and fix it later on.
+
+🥐 Let's try it! Open up the Local Development Dashboard running at [http://localhost:9400](http://localhost:9400) and try calling
+the `booking.GetBookableSlots` endpoint, passing in `2024-12-01`.
+
+If you prefer to use the terminal instead run `curl http://localhost:4000/slots/2024-12-01` in
+a new terminal instead. Either way you should see the response:
+
+```json
+{
+  "Slots": [
+    {
+      "start": "2024-12-01T09:00:00Z",
+      "end": "2024-12-01T10:00:00Z"
+    },
+    {
+      "start": "2024-12-01T10:00:00Z",
+      "end": "2024-12-01T11:00:00Z"
+    },
+    {
+      "start": "2024-12-01T11:00:00Z",
+      "end": "2024-12-01T12:00:00Z"
+    },
+    ...
+  ]
+}
+```
+
+## 3. Book an appointment
+
+Next, we want to make it possible to book an appointment. We'll need a database to store the bookings in. Encore makes it really simple to [create and use databases](/docs/go/primitives/databases) (both for local and cloud environments), but for this example we will also make use of [sqlc](https://sqlc.dev/) that will compile our SQL queries into type-safe Go code that we can use in our application.
+
+🥐 Let's create a SQL database for our booking service and the required sqlc scaffolding. Create the following file structure:
+
+```
+/my-app
+└── booking                              // booking service (a Go package)
+    ├── db                               // (New) db related files (directory)
+    │   ├── migrations                   // (New) db migrations (directory)
+    │   │   └── 1_create_tables.up.sql   // (New) db migration schema
+    │   └── query.sql                    // (New) SQL queries
+    ├── sqlc.yaml                        // (New) sqlc config file
+    ├── slots.go                         // booking service code
+    └── helpers.go                       // booking service code
+```
+
+🥐 Naming of the database migration file is important, it must look something like: `1_<name>.up.sql`.
+
+Add the following contents to the migration file:
+
+```sql
+-- booking/db/migrations/1_create_tables.up.sql --
+CREATE TABLE booking (
+    id BIGSERIAL PRIMARY KEY,
+    start_time TIMESTAMP NOT NULL,
+    end_time TIMESTAMP NOT NULL,
+    email TEXT NOT NULL,
+    created_at TIMESTAMP NOT NULL DEFAULT NOW()
+);
+```
+
+🥐 Next, install the sqlc library:
+
+```shell
+$ go install github.com/sqlc-dev/sqlc/cmd/sqlc@latest
+```
+
+🥐 Next, we need to configure sqlc. Add the following contents to `sqlc.yaml`:
+
+```yaml
+-- booking/sqlc.yaml --
+version: "2"
+sql:
+  - engine: "postgresql"
+    queries: "db/query.sql"
+    schema: "./db/migrations"
+    gen:
+      go:
+        package: "db"
+        out: "db"
+        sql_package: "pgx/v5"
+```
+
+This instructs sqlc to generate Go code from the queries in `db/query.sql` and models from the schemas in the `db/migrations` folder.
+
+🥐 Let's create our first SQL queries. Add the following contents to `db/query.sql`:
+
+```sql
+-- name: InsertBooking :one
+INSERT INTO booking (start_time, end_time, email)
+VALUES ($1, $2, $3)
+RETURNING *;
+
+-- name: ListBookingsBetween :many
+SELECT * FROM booking
+WHERE start_time >= $1 AND end_time <= $2;
+
+-- name: ListBookings :many
+SELECT * FROM booking;
+
+-- name: DeleteBooking :exec
+DELETE FROM booking WHERE id = $1;
+
+```
+
+🥐 It's time for sqlc to shine! Run the following command in your terminal:
+
+```shell
+$ cd booking
+$ sqlc generate
+```
+
+Three files should now have been generated inside the `db` folder: `query.sql.go`, `db.go` and `models.go`. These files contain generated Go code and should not be manually edited. We will be adding more queries to `db/query.sql` later and then re-run `sqlc generate` to update the generated Go code.
+
+Now let's create an endpoint that makes use of one of these queries.
+
+🥐 Create `booking/booking.go` with the contents:
+
+```go
+-- booking/booking.go --
+package booking
+
+import (
+	"context"
+	"time"
+
+	"encore.app/booking/db"
+	"github.com/jackc/pgx/v5/pgtype"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"encore.dev/beta/errs"
+	"encore.dev/storage/sqldb"
+)
+
+var (
+	bookingDB = sqldb.NewDatabase("booking", sqldb.DatabaseConfig{
+		Migrations: "./db/migrations",
+	})
+
+	pgxdb = sqldb.Driver[*pgxpool.Pool](bookingDB)
+	query = db.New(pgxdb)
+)
+
+type Booking struct {
+	ID    int64     `json:"id"`
+	Start time.Time `json:"start"`
+	End   time.Time `json:"end"`
+	Email string    `encore:"sensitive"`
+}
+
+type BookParams struct {
+	Start time.Time `json:"start"`
+	Email string    `encore:"sensitive"`
+}
+
+//encore:api public method=POST path=/booking
+func Book(ctx context.Context, p *BookParams) error {
+	eb := errs.B()
+
+	now := time.Now()
+	if p.Start.Before(now) {
+		return eb.Code(errs.InvalidArgument).Msg("start time must be in the future").Err()
+	}
+
+	tx, err := pgxdb.Begin(ctx)
+	if err != nil {
+		return eb.Cause(err).Code(errs.Unavailable).Msg("failed to start transaction").Err()
+	}
+	defer tx.Rollback(context.Background()) // committed explicitly on success
+
+	_, err = query.InsertBooking(ctx, db.InsertBookingParams{
+		StartTime: pgtype.Timestamp{Time: p.Start, Valid: true},
+		EndTime:   pgtype.Timestamp{Time: p.Start.Add(DefaultBookingDuration), Valid: true},
+		Email:     p.Email,
+	})
+	if err != nil {
+		return eb.Cause(err).Code(errs.Unavailable).Msg("failed to insert booking").Err()
+	}
+
+	if err := tx.Commit(ctx); err != nil {
+		return eb.Cause(err).Code(errs.Unavailable).Msg("failed to commit transaction").Err()
+	}
+	return nil
+}
+```
+
+We are now using the generated type-safe `query.InsertBooking` function to make the database operation.
+
+Notice the `encore:"sensitive"` tag on the `Email` field. This tells Encore to scrub this field so that the data is not viewable in the traces for deployed environments. This is useful for fields that contain [sensitive data](/docs/go/primitives/defining-apis#sensitive-data) such as email addresses, passwords, etc.
+
+🥐 Restart `encore run` to cause the database to be created, and then call the `booking.Book` endpoint:
+
+```shell
+$ curl -X POST 'http://localhost:4000/booking' -d '{"start": "2024-12-11T09:00:00Z", "email": "test@example.com"}'
+```
+
+Congratulations, you have now booked your first appointment!
+
+## 4. Authentication
+
+To provide an admin dashboard for our booking system, we need to add authentication to our application so that we can have protected endpoints.
+
+Keep in mind, in this tutorial we'll only include a very basic implementation.
+
+🥐 Let's start by creating a new service named `user`:
+
+```shell
+$ mkdir user
+$ touch user/auth.go
+```
+
+🥐 Add the following contents to `user/auth.go`:
+
+```go
+-- user/auth.go --
+// Service user authenticates users.
+package user
+
+import (
+	"context"
+	"encore.dev/beta/auth"
+	"encore.dev/beta/errs"
+)
+
+type Data struct {
+	Email string
+}
+
+type AuthParams struct {
+	Authorization string `header:"Authorization"`
+}
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, p *AuthParams) (auth.UID, *Data, error) {
+	if p.Authorization != "" {
+		return "test", &Data{}, nil
+	}
+	return "", nil, errs.B().Code(errs.Unauthenticated).Msg("no auth header").Err()
+}
+
+```
+
+This function is our [auth handler](/docs/go/develop/auth#the-auth-handler). An Encore applications can designate a special function to handle authentication,
+by defining a function and annotating it with `//encore:authhandler`. This annotation tells Encore to run the function whenever an
+incoming API call contains authentication data.
+
+The auth handler is responsible for validating the incoming authentication data and returning an `auth.UID` (a string type representing a user id).
+The `auth.UID` can be whatever you wish, but in practice it usually maps directly to the primary key stored in a user table (either defined in the Encore service or in an external service like Firebase or Okta).
+
+In order to keep this example simple, we'll just approve any request containing a token that is not empty.
+
+Next we will implement some of our auth endpoints and make use of our newly created auth handler.
+
+## 5. Setting availability
+
+Right now the availability is hardcoded to 9:00 - 17:00. Let's add the functionality to let our admin users customize this.
+
+Let's start by adding another migration file, this time to create an `availability` table.
+
+🥐 Create a file called `2_add_availability.up.sql` inside the `booking/db/migrations` folder. Add the following contents to that file:
+
+```sql
+-- booking/db/migrations/2_add_availability.up.sql --
+CREATE TABLE availability (
+    weekday SMALLINT NOT NULL PRIMARY KEY, -- Sunday=0, Monday=1, etc.
+    start_time TIME NULL, -- null indicates not available
+    end_time TIME NULL -- null indicates not available
+);
+
+-- Add some placeholder availability to get started
+INSERT INTO availability (weekday, start_time, end_time) VALUES
+    (0, '09:30', '17:00'),
+    (1, '09:00', '17:00'),
+    (2, '09:00', '18:00'),
+    (3, '08:30', '18:00'),
+    (4, '09:00', '17:00'),
+    (5, '09:00', '17:00'),
+    (6, '09:30', '16:30');
+```
+
+🥐 We can now add two queries to `booking/db/query.sql` so that we can store and retrieve availability:
+
+```sql
+-- booking/db/query.sql --
+-- name: GetAvailability :many
+SELECT * FROM availability
+ORDER BY weekday;
+
+-- name: UpdateAvailability :exec
+INSERT INTO availability (weekday, start_time, end_time)
+VALUES (@weekday, @start_time, @end_time)
+ON CONFLICT (weekday) DO UPDATE
+SET start_time = @start_time, end_time = @end_time;
+```
+
+🥐 Run `sqlc generate` to update the generated Go code.
+
+🥐 Create a new file in the `booking` service named `availability.go`:
+
+```shell
+$ touch booking/availability.go
+```
+
+🥐 Add the following to that file:
+
+```go
+-- booking/availability.go --
+package booking
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"encore.app/booking/db"
+	"github.com/jackc/pgx/v5/pgtype"
+
+	"encore.dev/beta/errs"
+	"encore.dev/rlog"
+)
+
+type Availability struct {
+	Start *string `json:"start" encore:"optional"`
+	End   *string `json:"end" encore:"optional"`
+}
+
+type GetAvailabilityResponse struct {
+	Availability []Availability
+}
+
+//encore:api public method=GET path=/availability
+func GetAvailability(ctx context.Context) (*GetAvailabilityResponse, error) {
+	rows, err := query.GetAvailability(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	availability := make([]Availability, 7)
+	for _, row := range rows {
+		day := row.Weekday
+		if day < 0 || day > 6 {
+			rlog.Error("invalid week day in availability table", "row", row)
+			continue
+		}
+
+		// These never fail
+		start, _ := row.StartTime.TimeValue()
+		end, _ := row.EndTime.TimeValue()
+		availability[day] = Availability{
+			Start: timeToStr(start),
+			End:   timeToStr(end),
+		}
+	}
+
+	return &GetAvailabilityResponse{Availability: availability}, nil
+}
+
+type SetAvailabilityParams struct {
+	Availability []Availability
+}
+
+//encore:api auth method=POST path=/availability
+func SetAvailability(ctx context.Context, params SetAvailabilityParams) error {
+	eb := errs.B()
+	tx, err := pgxdb.Begin(ctx)
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback(context.Background()) // committed explicitly on success
+
+	qry := query.WithTx(tx)
+	for weekday, a := range params.Availability {
+		if weekday > 6 {
+			return eb.Code(errs.InvalidArgument).Msgf("invalid weekday %d", weekday).Err()
+		}
+
+		start, err1 := strToTime(a.Start)
+		end, err2 := strToTime(a.End)
+		if err := errors.Join(err1, err2); err != nil {
+			return eb.Cause(err).Code(errs.InvalidArgument).Msg("invalid start/end time").Err()
+		} else if start.Valid != end.Valid {
+			return eb.Code(errs.InvalidArgument).Msg("both start/stop must be set, or both null").Err()
+		} else if start.Valid && start.Microseconds > end.Microseconds {
+			return eb.Code(errs.InvalidArgument).Msg("start must be before end").Err()
+		}
+
+		err = qry.UpdateAvailability(ctx, db.UpdateAvailabilityParams{
+			Weekday:   int16(weekday),
+			StartTime: start,
+			EndTime:   end,
+		})
+		if err != nil {
+			return eb.Cause(err).Code(errs.Unavailable).Msg("failed to update availability").Err()
+		}
+	}
+
+	err = tx.Commit(ctx)
+	return errs.WrapCode(err, errs.Unavailable, "failed to commit transaction")
+}
+```
+
+This file contains two endpoints, a setter and a getter. The `SetAvailability` endpoint is protected by the `auth` middleware which means that the user must be authenticated in order to call it. The `GetAvailability` endpoint is public and can be called without authentication.
+
+🥐 Let's set the availability for each day of the week. Open the Development Dashboard at [http://localhost:9400](http://localhost:9400) and select the `booking.SetAvailability` endpoint in the API Explorer. For the request body, paste the following:
+
+```json
+{
+    "Availability": [{
+        "start": "09:30",
+        "end": "17:00"
+    },{
+        "start": "09:00",
+        "end": "17:00"
+    },{
+        "start": "09:00",
+        "end": "18:00"
+    },{
+        "start": "08:30",
+        "end": "18:00"
+    },{
+        "start": "09:00",
+        "end": "17:00"
+    },{
+        "start": "09:00",
+        "end": "17:00"
+    },{
+        "start": "09:30",
+        "end": "16:30"
+    }]
+}
+```
+
+<Callout type="info">
+
+Don't leave the auth token empty, it will cause the auth handler to reject the request. You can use any value for the auth token.
+
+</Callout>
+
+Now try retrieving the availability by calling the `booking.GetAvailability` endpoint through the API Explorer in the Development Dashboard.
+
+🥐 Add the following functions inside the `booking` package, and import the `slices` package:
+
+```go
+func listBookingsBetween(
+	ctx context.Context,
+	start, end time.Time,
+) ([]*Booking, error) {
+	rows, err := query.ListBookingsBetween(ctx, db.ListBookingsBetweenParams{
+		StartTime: pgtype.Timestamp{Time: start, Valid: true},
+		EndTime:   pgtype.Timestamp{Time: end, Valid: true},
+	})
+	if err != nil {
+		return nil, err
+	}
+	var bookings []*Booking
+	for _, row := range rows {
+		bookings = append(bookings, &Booking{
+			ID:    row.ID,
+			Start: row.StartTime.Time,
+			End:   row.EndTime.Time,
+			Email: row.Email,
+		})
+	}
+	return bookings, nil
+}
+
+func filterBookableSlots(
+	slots []BookableSlot,
+	now time.Time,
+	bookings []*Booking,
+) []BookableSlot {
+	// Remove slots for which the start time has already passed.
+	slots = slices.DeleteFunc(slots, func(s BookableSlot) bool {
+		// Has the slot already passed?
+		if s.Start.Before(now) {
+			return true
+		}
+
+		// Is there a booking that overlaps with this slot?
+		for _, b := range bookings {
+			if b.Start.Before(s.End) && b.End.After(s.Start) {
+				return true
+			}
+		}
+
+		return false
+	})
+	return slots
+}
+```
+
+We'll use these functions to figure out which slots are bookable, and which are not, to avoid double bookings.
+
+🥐 Now we can update the `Book` endpoint inside `booking.go` and make use of these new functions:
+
+```go
+HL booking/booking.go 15:27
+-- booking/booking.go --
+//encore:api public method=POST path=/booking
+func Book(ctx context.Context, p *BookParams) error {
+	eb := errs.B()
+
+	now := time.Now()
+	if p.Start.Before(now) {
+		return eb.Code(errs.InvalidArgument).Msg("start time must be in the future").Err()
+	}
+
+	tx, err := pgxdb.Begin(ctx)
+	if err != nil {
+		return eb.Cause(err).Code(errs.Unavailable).Msg("failed to start transaction").Err()
+	}
+	defer tx.Rollback(context.Background()) // committed explicitly on success
+
+	// Get the bookings for this day.
+	startOfDay := time.Date(p.Start.Year(), p.Start.Month(), p.Start.Day(), 0, 0, 0, 0, p.Start.Location())
+	bookings, err := listBookingsBetween(ctx, startOfDay, startOfDay.AddDate(0, 0, 1))
+	if err != nil {
+		return eb.Cause(err).Code(errs.Unavailable).Msg("failed to list bookings").Err()
+	}
+
+	// Is this slot bookable?
+	slot := BookableSlot{Start: p.Start, End: p.Start.Add(DefaultBookingDuration)}
+	if len(filterBookableSlots([]BookableSlot{slot}, now, bookings)) == 0 {
+		return eb.Code(errs.InvalidArgument).Msg("slot is unavailable").Err()
+	}
+
+	_, err = query.InsertBooking(ctx, db.InsertBookingParams{
+		StartTime: pgtype.Timestamp{Time: p.Start, Valid: true},
+		EndTime:   pgtype.Timestamp{Time: p.Start.Add(DefaultBookingDuration), Valid: true},
+		Email:     p.Email,
+	})
+	if err != nil {
+		return eb.Cause(err).Code(errs.Unavailable).Msg("failed to insert booking").Err()
+	}
+
+	if err := tx.Commit(ctx); err != nil {
+		return eb.Cause(err).Code(errs.Unavailable).Msg("failed to commit transaction").Err()
+	}
+	return nil
+}
+```
+
+🥐 Inside `slots.go`, update the `GetBookableSlots` endpoint and the `bookableSlotsForDay` functions to look like this:
+
+```go
+HL booking/slots.go 7:12
+HL booking/slots.go 18:23
+HL booking/slots.go 29:36
+HL booking/slots.go 39:48
+-- booking/slots.go --
+//encore:api public method=GET path=/slots/:from
+func GetBookableSlots(ctx context.Context, from string) (*SlotsResponse, error) {
+	fromDate, err := time.Parse("2006-01-02", from)
+	if err != nil {
+		return nil, err
+	}
+
+	availabilityResp, err := GetAvailability(ctx)
+	if err != nil {
+		return nil, err
+	}
+	availability := availabilityResp.Availability
+
+	const numDays = 7
+
+	var slots []BookableSlot
+	for i := 0; i < numDays; i++ {
+		date := fromDate.AddDate(0, 0, i)
+		weekday := int(date.Weekday())
+		if len(availability) <= weekday {
+			break
+		}
+		daySlots, err := bookableSlotsForDay(date, &availability[weekday])
+		if err != nil {
+			return nil, err
+		}
+		slots = append(slots, daySlots...)
+	}
+
+	// Get bookings for the next 7 days.
+	activeBookings, err := listBookingsBetween(ctx, fromDate, fromDate.AddDate(0, 0, numDays))
+	if err != nil {
+		return nil, err
+	}
+
+	slots = filterBookableSlots(slots, time.Now(), activeBookings)
+	return &SlotsResponse{Slots: slots}, nil
+}
+
+func bookableSlotsForDay(date time.Time, avail *Availability) ([]BookableSlot, error) {
+	if avail.Start == nil || avail.End == nil {
+		return nil, nil
+	}
+	availStartTime, err1 := strToTime(avail.Start)
+	availEndTime, err2 := strToTime(avail.End)
+	if err := errors.Join(err1, err2); err != nil {
+		return nil, err
+	}
+
+	availStart := date.Add(time.Duration(availStartTime.Microseconds) * time.Microsecond)
+	availEnd := date.Add(time.Duration(availEndTime.Microseconds) * time.Microsecond)
+
+	// Compute the bookable slots in this day, based on availability.
+	var slots []BookableSlot
+	start := availStart
+	for {
+		end := start.Add(DefaultBookingDuration)
+		if end.After(availEnd) {
+			break
+		}
+		slots = append(slots, BookableSlot{
+			Start: start,
+			End:   end,
+		})
+		start = end
+	}
+
+	return slots, nil
+}
+```
+
+## 6. Managing scheduled bookings
+
+To display the scheduled bookings in the admin dashboard, we need to add the functionality to list all bookings. While we're at it, we'll also make it possible to delete bookings.
+
+🥐 Add two new endpoints to `booking/booking.go`:
+
+```go
+-- booking/booking.go --
+type ListBookingsResponse struct {
+	Booking []*Booking `json:"bookings"`
+}
+
+//encore:api auth method=GET path=/booking
+func ListBookings(ctx context.Context) (*ListBookingsResponse, error) {
+	rows, err := query.ListBookings(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	var bookings []*Booking
+	for _, row := range rows {
+		bookings = append(bookings, &Booking{
+			ID:    row.ID,
+			Start: row.StartTime.Time,
+			End:   row.EndTime.Time,
+			Email: row.Email,
+		})
+	}
+	return &ListBookingsResponse{Booking: bookings}, nil
+}
+
+//encore:api auth method=DELETE path=/booking/:id
+func DeleteBooking(ctx context.Context, id int64) error {
+	return query.DeleteBooking(ctx, id)
+}
+```
+
+That's it! We now have all the backend endpoints in place to be able to supply the frontend with data. 🎉
+
+## 7. Running the React frontend
+
+The frontend should now be working as expected.
+
+🥐 Go to [http://localhost:4000/frontend/](http://localhost:4000/frontend/) and try out your new booking system.
+
+The frontend is built using [React](https://react.dev/) and [Tailwind CSS](https://tailwindcss.com/). It uses Encore's ability to generate type-safe [request clients](https://encore.dev/docs/go/cli/client-generation). This means you don't need to manually keep the request/response objects in sync on the frontend. To generate a client:
+
+```bash
+$ encore gen client <APP_NAME> --output=./src/client.ts --env=<ENV_NAME>
+```
+
+While you're developing, you are going to want to run this command quite often (whenever you make a change to your endpoints) so having it as an `npm` script is a good idea. Take a look at the scripts in the `package.json` file:
+
+```json
+{
+...
+"scripts": {
+    ...
+    "gen": "encore gen client <Encore App ID> --output=./src/lib/client.ts --env=staging",
+    "gen:local": "encore gen client <Encore App ID> --output=./src/lib/client.ts --env=local"
+  },
+}
+```
+
+For this frontend we use the request client together with [TanStack Query](https://tanstack.com/query/latest). When building something a bit more complex, you will likely need to deal with caching, refetching, and data going stale. [TanStack Query](https://tanstack.com/query/latest) is a popular library that was built to solve exactly these problems and works great with the Encore request client.
+
+See our the docs page about [integrating with a web frontend](/docs/how-to/integrate-frontend) to learn more.
+
+## 8. Deploy to Encore's development cloud
+
+Let's deploy the project to Encore's free development cloud.
+
+Encore comes with built-in CI/CD, and the deployment process is as simple as a `git push`.
+(You can also integrate with GitHub to activate per Pull Request Preview Environments, learn more in the [CI/CD docs](/docs/platform/deploy/deploying).)
+
+🥐 Now, let's deploy your app to Encore's free development cloud by running:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Encore will now build and test your app, provision the needed infrastructure, and deploy your application to the cloud.
+
+After triggering the deployment, you will see a URL where you can view its progress in the [Encore Cloud dashboard](https://app.encore.cloud). It will look something like: `https://app.encore.cloud/$APP_ID/deploys/...`
+
+From there you can also see metrics, traces, link your app to a GitHub repo to get automatic deploys on new commits, and connect your own AWS or GCP account to use for production deployment.
+
+🥐 When the deploy has finished, you can try out your booking system by going to `https://staging-$APP_ID.encr.app/frontend/`.
+
+*You now have an Appointment Booking System running in the cloud, well done!*
+
+## 8. Sending confirmation emails using SendGrid
+
+In order for the users to get a confirmation email when they book an appointment we need to add an email integration.
+
+Conveniently for us, there is a ready to use SendGrid integration as an [Encore Bit](https://github.com/encoredev/examples?tab=readme-ov-file#bits).
+
+🥐 [Follow the instructions](https://github.com/encoredev/examples/tree/main/bits/sendgrid) to add the SendGrid integration to your project.
+
+Next, we need to call our new `sendgrid` service when an appointment is booked.
+
+🥐 Add a call to `sendgrid.Send` in the `Book` endpoint:
+
+```go
+HL booking/booking.go 41:59
+-- booking/booking.go --
+//encore:api public method=POST path=/booking
+func Book(ctx context.Context, p *BookParams) error {
+	eb := errs.B()
+
+	now := time.Now()
+	if p.Start.Before(now) {
+		return eb.Code(errs.InvalidArgument).Msg("start time must be in the future").Err()
+	}
+
+	tx, err := pgxdb.Begin(ctx)
+	if err != nil {
+		return eb.Cause(err).Code(errs.Unavailable).Msg("failed to start transaction").Err()
+	}
+	defer tx.Rollback(context.Background()) // committed explicitly on success
+
+	// Get the bookings for this day.
+	startOfDay := time.Date(p.Start.Year(), p.Start.Month(), p.Start.Day(), 0, 0, 0, 0, p.Start.Location())
+	bookings, err := listBookingsBetween(ctx, startOfDay, startOfDay.AddDate(0, 0, 1))
+	if err != nil {
+		return eb.Cause(err).Code(errs.Unavailable).Msg("failed to list bookings").Err()
+	}
+
+	// Is this slot bookable?
+	slot := BookableSlot{Start: p.Start, End: p.Start.Add(DefaultBookingDuration)}
+	if len(filterBookableSlots([]BookableSlot{slot}, now, bookings)) == 0 {
+		return eb.Code(errs.InvalidArgument).Msg("slot is unavailable").Err()
+	}
+
+	_, err = query.InsertBooking(ctx, db.InsertBookingParams{
+		StartTime: pgtype.Timestamp{Time: p.Start, Valid: true},
+		EndTime:   pgtype.Timestamp{Time: p.Start.Add(DefaultBookingDuration), Valid: true},
+		Email:     p.Email,
+	})
+	if err != nil {
+		return eb.Cause(err).Code(errs.Unavailable).Msg("failed to insert booking").Err()
+	}
+
+	if err := tx.Commit(ctx); err != nil {
+		return eb.Cause(err).Code(errs.Unavailable).Msg("failed to commit transaction").Err()
+	}
+
+	// Send confirmation email using SendGrid
+	formattedTime := pgtype.Timestamp{Time: p.Start, Valid: true}.Time.Format("2006-01-02 15:04")
+	_, err = sendgrid.Send(ctx, &sendgrid.SendParams{
+		From: sendgrid.Address{
+			Name:  "<your name>",
+			Email: "<your email>",
+		},
+		To: sendgrid.Address{
+			Email: p.Email,
+		},
+		Subject: "Booking Confirmation",
+		Text:    "Thank you for your booking!\nWe look forward to seeing you soon at " + formattedTime,
+		Html:    "",
+	})
+
+	if err != nil {
+		return err
+	}
+
+	return nil
+}
+```
+
+<Callout type="info">
+
+The `From` email used when sending emails needs to go through the SendGrid verification process before it can be used. You can read more about it here: https://sendgrid.com/docs/ui/sending-email/sender-verification/
+
+The default behaviour of the SendGrid integration is to only send emails on production environments. You can create production environments through the Encore Cloud Dashboard.
+
+</Callout>
+
+## 9. Deploy your finished Booking System
+
+Now you're ready to deploy your finished Booking System, complete with a SendGrid integration.
+
+🥐 As before, deploying your app to the cloud is as simple as running:
+
+```shell
+$ git add -A .
+$ git commit -m 'Add sendgrid integration'
+$ git push encore
+```
+
+### Celebrate with fireworks
+
+Now that your app is running in the cloud, let's celebrate with some fireworks:
+
+🥐 In the Cloud Dashboard, open the Command Menu by pressing **Cmd + K** (Mac) or **Ctrl + K** (Windows/Linux).
+
+_From here you can easily access all Cloud Dashboard features and for example jump straight to specific services in the Service Catalog or view Traces for specific endpoints._
+
+🥐 Type `fireworks` in the Command Menu and press enter. Sit back and enjoy the show!
+
+![Fireworks](/assets/docs/fireworks.jpg)
diff --git a/docs/go/tutorials/graphql.mdx b/docs/go/tutorials/graphql.mdx
new file mode 100644
index 0000000000..674ffc666a
--- /dev/null
+++ b/docs/go/tutorials/graphql.mdx
@@ -0,0 +1,332 @@
+---
+title: Building a GraphQL API
+subtitle: Learn how to build a GraphQL API using Encore.go
+seotitle: How to build a GraphQL API using Encore.go
+seodesc: Learn how to build a microservices backend in Go, powered by GraphQL and Encore.
+lang: go
+---
+
+Encore has great support for GraphQL with its type-safe approach to building APIs.
+
+Encore's automatic tracing also makes it easy to find and fix
+performance issues that often arise in GraphQL APIs (like the [N+1 problem](https://hygraph.com/blog/graphql-n-1-problem)).
+
+The best way to use GraphQL with Encore is using [gqlgen](https://gqlgen.com/), which
+has similar goals as Encore (type-safe APIs, minimal boilerplate, code generation, etc).
+
+The final code will look like this:
+
+<div className="not-prose my-10">
+   <Editor projectName="graphql" />
+</div>
+
+## 1. Create your Encore application
+
+This tutorial uses the [REST API](/docs/go/tutorials/rest-api) tutorial as a starting point.
+
+You can either follow that tutorial first, or you can create a new Encore application
+using the `url-shortener` template by running:
+
+```shell
+$ encore app create --example=url-shortener
+```
+
+## 2. Initialize gqlgen
+
+To get started, initialize gqlgen by creating a `tools.go` file in the application root:
+
+```go
+-- tools.go --
+//go:build tools
+
+package tools
+
+import (
+    _ "github.com/99designs/gqlgen"
+    _ "github.com/99designs/gqlgen/graphql/introspection"
+)
+```
+
+Then run `go mod tidy` to download the dependencies.
+
+Next, create a `gqlgen.yml` file in the application root containing:
+
+```
+-- gqlgen.yml --
+# Where are all the schema files located? globs are supported eg  src/**/*.graphqls
+schema:
+  - graphql/*.graphqls
+
+# Where should the generated server code go?
+exec:
+  filename: graphql/generated/generated.go
+  package: generated
+
+# Where should any generated models go?
+model:
+  filename: graphql/model/models_gen.go
+  package: model
+
+# Where should the resolver implementations go?
+resolver:
+  layout: follow-schema
+  dir: graphql
+  package: graphql
+
+# gqlgen will search for any type names in the schema in these go packages
+# if they match it will use them, otherwise it will generate them.
+autobind:
+ - "encore.app/url"
+
+# This section declares type mapping between the GraphQL and go type systems
+#
+# The first line in each type will be used as defaults for resolver arguments and
+# modelgen, the others will be allowed when binding to fields. Configure them to
+# your liking
+models:
+  ID:
+    model:
+      - github.com/99designs/gqlgen/graphql.ID
+      - github.com/99designs/gqlgen/graphql.Int
+      - github.com/99designs/gqlgen/graphql.Int64
+      - github.com/99designs/gqlgen/graphql.Int32
+  Int:
+    model:
+      - github.com/99designs/gqlgen/graphql.Int
+      - github.com/99designs/gqlgen/graphql.Int64
+      - github.com/99designs/gqlgen/graphql.Int32
+```
+
+## 3. Create Encore service
+
+Now it's time to create our Encore service that will provide the GraphQL API.
+
+First generate the gqlgen boilerplate:
+
+```shell
+$ mkdir -p graphql/generated graphql/model
+$ echo "package model" > graphql/model/model.go
+$ go run github.com/99designs/gqlgen generate
+```
+
+This will create a bunch of files in the `graphql` directory.
+
+Next, create a `graphql/service.go` file containing:
+
+```go
+-- graphql/service.go --
+// Service graphql exposes a GraphQL API.
+package graphql
+
+import (
+    "net/http"
+
+    "encore.app/graphql/generated"
+    "encore.dev"
+    "github.com/99designs/gqlgen/graphql/handler"
+    "github.com/99designs/gqlgen/graphql/playground"
+)
+
+//go:generate go run github.com/99designs/gqlgen generate
+
+//encore:service
+type Service struct {
+    srv        *handler.Server
+    playground http.Handler
+}
+
+func initService() (*Service, error) {
+    srv := handler.NewDefaultServer(generated.NewExecutableSchema(generated.Config{Resolvers: &Resolver{}}))
+    pg := playground.Handler("GraphQL Playground", "/graphql")
+    return &Service{srv: srv, playground: pg}, nil
+}
+
+//encore:api public raw path=/graphql
+func (s *Service) Query(w http.ResponseWriter, req *http.Request) {
+    s.srv.ServeHTTP(w, req)
+}
+
+//encore:api public raw path=/graphql/playground
+func (s *Service) Playground(w http.ResponseWriter, req *http.Request) {
+	// Disable playground in production
+	if encore.Meta().Environment.Type == encore.EnvProduction {
+        http.Error(w, "Playground disabled", http.StatusNotFound)
+		return
+    }
+
+    s.playground.ServeHTTP(w, req)
+}
+```
+
+This creates an Encore service that exposes the `/graphql` and `/graphql/playground` endpoints.
+
+It also adds a `//go:generate` directive that lets you re-run the gqlgen code generation
+by running `go generate ./graphql`.
+
+## 4. Add GraphQL schema
+
+Now it's time to define the GraphQL schema. Create a `graphql/schema.graphqls` file containing:
+
+```
+-- graphql/url.graphqls --
+type Query {
+  urls: [URL!]!
+  get(id: ID!): URL!
+}
+
+type Mutation {
+  shorten(input: String!): URL!
+}
+
+type URL {
+  id:  ID!     # shortened id
+  url: String! # full URL
+}
+```
+
+Then, re-run the code generation to generate the resolver stubs:
+
+```shell
+$ go generate ./graphql
+```
+The stubs will be written to `graphql/url.resolvers.go` and will contain a bunch of unimplemented resolver methods
+that look something like this:
+
+```go
+// Shorten is the resolver for the shorten field.
+func (r *mutationResolver) Shorten(ctx context.Context, input string) (*url.URL, error) {
+	panic(fmt.Errorf("not implemented: Shorten - shorten"))
+}
+```
+
+## 5. Implement resolvers
+
+Now, modify the resolvers to call the `url` service. Since the GraphQL API uses the same types
+(thanks to the `autobind` directive in `gqlgen.yml`) as the Encore API exposes, we can just call the
+endpoints directly. Implement the resolvers in `graphql/url.resolvers.go` like this:
+
+```go
+-- graphql/url.resolvers.go --
+// Shorten is the resolver for the shorten field.
+func (r *mutationResolver) Shorten(ctx context.Context, input string) (*url.URL, error) {
+	return url.Shorten(ctx, &url.ShortenParams{URL: input})
+}
+
+// Urls is the resolver for the urls field.
+func (r *queryResolver) Urls(ctx context.Context) ([]*url.URL, error) {
+	resp, err := url.List(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return resp.URLs, nil
+}
+
+// Get is the resolver for the get field.
+func (r *queryResolver) Get(ctx context.Context, id string) (*url.URL, error) {
+	return url.Get(ctx, id)
+}
+```
+
+As you can see, the resolvers are just thin wrappers around the Encore API endpoints themselves.
+
+## 6. Trying it out
+
+With that, the GraphQL API is done! Try it out by running `encore run` and opening up [the playground](http://localhost:4000/graphql/playground).
+
+Enter the query:
+```graphql
+mutation {
+    shorten(input: "https://encore.dev") {
+        id
+    }
+}
+```
+
+You should get back an id like `MnTWA8Jo`. Pass the id you got (it will be something different) to a `get` query:
+
+```graphql
+query {
+    get(id: "<your-id-here>") {
+        url
+    }
+}
+```
+
+And you should get back `https://encore.dev`.
+
+
+## 7. Deploy
+
+<Accordion>
+
+### Self-hosting
+
+Encore supports building Docker images directly from the CLI, which can then be self-hosted on your own infrastructure of choice.
+
+If your app is using infrastructure resources, such as SQL databases, Pub/Sub, or metrics, you will need to supply a [runtime configuration](/docs/go/self-host/configure-infra) your Docker image.
+
+🥐 Build a Docker image by running `encore build docker graphql:v1.0`.
+
+This will compile your application using the host machine and then produce a Docker image containing the compiled application.
+
+🥐 Upload the Docker image to the cloud provider of your choice and run it.
+
+</Accordion>
+
+<Accordion>
+
+### Deploy to Encore Cloud
+
+Encore Cloud provides automated infrastructure and DevOps. Deploy to a free development environment or to your own cloud account on AWS or GCP.
+
+### Create account
+
+Before deploying with Encore Cloud, you need to have a free Encore Cloud account and link your app to the platform. If you already have an account, you can move on to the next step.
+
+If you don’t have an account, the simplest way to get set up is by running `encore app create` and selecting **Y** when prompted to create a new account. Once your account is set up, continue creating a new app, selecting the `empty app` template.
+
+After creating the app, copy your project files into the new app directory, ensuring that you do not replace the `encore.app` file (this file holds a unique id which links your app to the platform).
+
+### Commit changes
+
+The final step before you deploy is to commit all changes to the project repo.
+
+
+Push your changes and deploy your application to Encore's free development cloud by running:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Encore will now build and test your app, provision the needed infrastructure, and deploy your application to the cloud.
+
+After triggering the deployment, you will see a URL where you can view its progress in the [Encore Cloud dashboard](https://app.encore.cloud). It will look something like: `https://app.encore.cloud/$APP_ID/deploys/...`
+
+From there you can also see metrics, traces, link your app to a GitHub repo to get automatic deploys on new commits, and connect your own AWS or GCP account to use for production deployment.
+
+### Celebrate with fireworks
+
+Now that your app is running in the cloud, let's celebrate with some fireworks:
+
+🥐 In the Cloud Dashboard, open the Command Menu by pressing **Cmd + K** (Mac) or **Ctrl + K** (Windows/Linux).
+
+_From here you can easily access all Cloud Dashboard features and for example jump straight to specific services in the Service Catalog or view Traces for specific endpoints._
+
+🥐 Type `fireworks` in the Command Menu and press enter. Sit back and enjoy the show!
+
+![Fireworks](/assets/docs/fireworks.jpg)
+
+</Accordion>
+
+## Conclusion
+
+We've now built a GraphQL API gateway that forwards requests to the application's
+underlying Encore services in a type-safe way with minimal boilerplate.
+
+Note that the concepts discussed here are general and can be easily adapted to any GraphQL schema.
+
+Whenever you make a change to the schema or configuration, re-run `go generate ./graphql` to
+regenerate the GraphQL boilerplate. And for more information on how to use `gqlgen`,
+see the [gqlgen documentation](https://gqlgen.com/).
diff --git a/docs/go/tutorials/incident-management-tool.md b/docs/go/tutorials/incident-management-tool.md
new file mode 100644
index 0000000000..2c96f8daa8
--- /dev/null
+++ b/docs/go/tutorials/incident-management-tool.md
@@ -0,0 +1,854 @@
+---
+seotitle: How to build an Incident Management Tool with Go
+seodesc: Learn how to build an incident management tool like PagerDuty using Go and Encore. Get a working app running in the cloud in 30 minutes!
+title: Building an Incident Management Tool
+subtitle: Set up your own PagerDuty from zero-to-production in just 30 minutes
+social_card: /assets/docs/incident-og-image.png
+lang: go
+---
+
+In this tutorial, we're going to walk through together how to build our very own Incident Management Tool like [Incident.io](https://incident.io) or [PagerDuty](https://pagerduty.com). We can then have our own on call schedule that can be rotated between many users, and have incidents come and be assigned according to the schedule!
+
+![Slack Incident Management Tool](/assets/docs/incident-slack-example.png "Incident Management Tool")
+
+In about 30 minutes, your application will be able to support:
+
+- Creating users, as well as schedules for when users will be on call
+- Creating incidents, and reminders for unacknowledged incidents on Slack every 10 minutes
+- Auto-assign incidents which are unassigned (when the next user is on call)
+
+_ Sounds good? Let's dig in! _
+
+Or if you'd rather watch a video of this tutorial, you can do that below.
+
+<iframe width="360" height="202" src="https://www.youtube.com/embed/BR_ys_qR2kI?controls=0" title="Building an Incident Management Tool Video Tutorial" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>
+
+View full project on [GitHub](https://github.com/encoredev/example-app-oncall)
+
+<Callout type="info">
+
+To make it easier to follow along, we've laid out a trail of croissants to guide your way.
+Whenever you see a 🥐 it means there's something for you to do.
+
+</Callout>
+
+## 1. Create your Encore application
+
+🥐 Create a new Encore application by running `encore app create`, select `Empty app` as the template and name it `oncall-tutorial`.
+
+## 2. Integrate with Slack
+
+🥐 Follow [this guide to create your own Incoming Webhook](https://api.slack.com/messaging/webhooks) for your Slack workspace. Incoming webhooks cannot read messages, and can only post to a specific channel of your choice.
+
+<img src="/assets/docs/incident-slack-app-creation.png" alt="Creating a Slack app" width="400px" />
+
+🥐 Once you have your Webhook URL which starts with `https://hooks.slack.com/services/...` then copy and paste that and run the following commands to save these as secrets. We recommend having a different webhook/channel for development and production.
+
+```shell
+$ encore secret set --type dev,local,pr SlackWebhookURL
+$ encore secret set --type prod SlackWebhookURL
+```
+
+🥐 Next, let's create our `slack` service that contains the logic for calling the Webhook URL in order to post notifications to our Slack. To do this we need to implement our code in `slack/slack.go`:
+
+```go
+// Service slack calls a webhook to post notifications to Slack.
+package slack
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"encore.dev/beta/errs"
+	"io"
+	"net/http"
+)
+
+type NotifyParams struct {
+	Text string `json:"text"`
+}
+
+//encore:api private
+func Notify(ctx context.Context, p *NotifyParams) error {
+	eb := errs.B()
+	reqBody, err := json.Marshal(p)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, "POST", secrets.SlackWebhookURL, bytes.NewReader(reqBody))
+	if err != nil {
+		return err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		body, _ := io.ReadAll(resp.Body)
+		return eb.Code(errs.Unavailable).Msgf("notify slack: %s: %s", resp.Status, body).Err()
+	}
+	return nil
+}
+
+var secrets struct {
+	SlackWebhookURL string
+}
+```
+
+<Callout type="info">
+
+The `slack` service can be reused across any of your Encore apps. All you need is the `slack/slack.go` code and the `SlackWebhookURL` secret to be defined. Then you can call the following method signature anywhere in your app:
+
+```go
+slack.Notify(context, &slack.NotifyParams{ Text: "Send a Slack notification" })
+```
+
+</Callout>
+
+## 3. Create a service to manage users
+
+With an Incident Management Tool (or usually any tool, for that matter) we need a service for users.
+This will allow us to figure out who we should assign incoming incidents to!
+
+To get started, we need to create a `users` service with the following resources:
+
+| #   | Type                                 | Description / Filename                                                                   |
+| --- | ------------------------------------ | ---------------------------------------------------------------------------------------- |
+| #1  | SQL Migration                        | Our PostgreSQL schema for scheduling data <br/> `users/migrations/1_create_users.up.sql` |
+| #2  | HTTP Endpoint <br/> `POST /users`    | Create a new User <br/> `users/users.go`                                                 |
+| #3  | HTTP Endpoint <br/> `GET /users/:id` | Get an existing User <br/> `users/users.go`                                              |
+
+With #1, let's design our database schema for a User in our system. For now let's store a first and last name as well as a Slack handle in case we need to notify them about any incidents which may have been assigned to them or acknowledged by them.
+
+🥐 Let's create our migration file in `users/migrations/1_create_users.up.sql`:
+
+```sql
+CREATE TABLE users (
+    id           BIGSERIAL PRIMARY KEY,
+    first_name   VARCHAR(255) NOT NULL,
+    last_name    VARCHAR(255) NOT NULL,
+    slack_handle VARCHAR(255) NOT NULL
+);
+```
+
+🥐 Then, we need to write our code to implement the HTTP endpoints listed in #2 (for creating a user) and #3 (for listing a user) belonging in `users/users.go`. Let's split them out into three sections: our structs (i.e. data models) and methods.
+
+```go
+// Service users manages users and assigns incidents.
+package users
+
+import (
+	"context"
+	"encore.dev/storage/sqldb"
+)
+
+// This is a Go struct representing our PostgreSQL schema for `users`
+type User struct {
+	Id          int32
+	FirstName   string
+	LastName    string
+	SlackHandle string
+}
+
+// Define a database named 'users', using the database migrations
+// in the "./migrations" folder. Encore automatically provisions,
+// migrates, and connects to the database.
+var db = sqldb.NewDatabase("users", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+
+//encore:api public method=POST path=/users
+func Create(ctx context.Context, params CreateParams) (*User, error) {
+	user := User{}
+	err := db.QueryRow(ctx, `
+		INSERT INTO users (first_name, last_name, slack_handle)
+		VALUES ($1, $2, $3)
+		RETURNING id, first_name, last_name, slack_handle
+	`, params.FirstName, params.LastName, params.SlackHandle).Scan(&user.Id, &user.FirstName, &user.LastName, &user.SlackHandle)
+	if err != nil {
+		return nil, err
+	}
+	return &user, nil
+}
+
+// This is what JSON params our POST /users endpoint will accept
+type CreateParams struct {
+	FirstName   string
+	LastName    string
+	SlackHandle string
+}
+
+//encore:api public method=GET path=/users/:id
+func Get(ctx context.Context, id int32) (*User, error) {
+	user := User{}
+	err := db.QueryRow(ctx, `
+	  SELECT id, first_name, last_name, slack_handle
+		FROM users
+		WHERE id = $1
+	`, id).Scan(&user.Id, &user.FirstName, &user.LastName, &user.SlackHandle)
+	if err != nil {
+		return nil, err
+	}
+	return &user, nil
+}
+```
+
+🥐 Next, type `encore run` in your Terminal and in a separate window run the command under **cURL Request** (feel free to edit the values!) to create our first user:
+
+```bash
+curl -d '{
+  "FirstName":"Katy",
+  "LastName":"Smith",
+  "SlackHandle":"katy"
+}' http://localhost:4000/users
+
+# Example JSON response
+# {
+#   "Id":1,
+#   "FirstName":"Katy",
+#   "LastName":"Smith",
+#   "SlackHandle":"katy"
+# }
+```
+
+Fantastic, we now have a user system in our app! Next we need a list of start and end times of each scheduled rotation so we know who to assign incoming incidents to (as well as notify them on Slack!)
+
+## 4. Add scheduling
+
+A good incident management tool should be able to spread the workload of diagnosing and fixing incidents across multiple users in a team. Being able to know who the correct person to assign an incident to is very important; our incidents might not get resolved quickly otherwise!
+
+In order to achieve this, let's create a new service called `schedules`:
+
+| #   | Type                                            | Description / Filename                                                                     |
+| --- | ----------------------------------------------- | ------------------------------------------------------------------------------------------ |
+| #1  | SQL Migration                                   | Our PostgreSQL schema for user data <br/> `schedules/migrations/1_create_schedules.up.sql` |
+| #2  | HTTP Endpoint <br/> `GET /schedules`            | Get list of schedules between time range <br/> `schedules/schedules.go`                    |
+| #3  | HTTP Endpoint <br/> `POST /users/:id/schedules` | Create a new Schedule <br/> `schedules/schedules.go`                                       |
+| #4  | HTTP Endpoint <br/> `GET /scheduled/:timestamp` | Get Schedule at specific time <br/> `schedules/schedules.go`                               |
+
+
+For the SQL migration in #1, we need to create both a table and an index. For every rotation let's need a new entry containing the user who it is for as well as the start and end times of the scheduled rotation.
+
+🥐 Let's create our migration file in `schedules/migrations/1_create_schedules.up.sql`:
+
+```sql
+CREATE TABLE schedules
+(
+    id         BIGSERIAL PRIMARY KEY,
+    user_id    INTEGER   NOT NULL,
+    start_time TIMESTAMP NOT NULL,
+    end_time   TIMESTAMP NOT NULL
+);
+
+CREATE INDEX schedules_range_index ON schedules (start_time, end_time);
+```
+
+
+<Callout type="info">
+
+Table indexes are used to optimize lookups without having to search every row in the table. In this case, looking up rows against both `start_time` and `end_time` will be faster _with the index_ as the dataset grows. [Learn more about PostgreSQL indexes here](https://www.tutorialspoint.com/postgresql/postgresql_indexes.htm).
+
+</Callout>
+
+🥐 Next, let's implement the HTTP endpoints for #2 (listing schedules), #3 (creating a schedule) and #4 (getting the schedule/user at a specific time) in `schedules/schedules.go`:
+
+```go
+// Service schedules implements schedules to answer who should be assigned to an incident.
+package schedules
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"encore.app/users"
+	"encore.dev/beta/errs"
+	"encore.dev/storage/sqldb"
+)
+
+// Define a database named 'schedules', using the database migrations
+// in the "./migrations" folder. Encore automatically provisions,
+// migrates, and connects to the database.
+var db = sqldb.NewDatabase("schedules", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+
+// This struct holds multiple Schedule structs
+type Schedules struct {
+	Items []Schedule
+}
+
+// This is a Go struct representing our PostgreSQL schema for `schedules`
+type Schedule struct {
+	Id   int32
+	User users.User
+	Time TimeRange
+}
+
+// As we use time ranges in our schedule, we created a generic TimeRange struct
+type TimeRange struct {
+	Start time.Time
+	End   time.Time
+}
+
+//encore:api public method=POST path=/users/:userId/schedules
+func Create(ctx context.Context, userId int32, timeRange TimeRange) (*Schedule, error) {
+	eb := errs.B().Meta("userId", userId, "timeRange", timeRange)
+	// check for existing overlapping schedules
+	if schedule, err := ScheduledAt(ctx, timeRange.Start.String()); schedule != nil && err == nil {
+		return nil, eb.Code(errs.InvalidArgument).Cause(err).Msg("schedule already exists within this start timestamp").Err()
+	}
+	if schedule, err := ScheduledAt(ctx, timeRange.End.String()); schedule != nil && err == nil {
+		return nil, eb.Code(errs.InvalidArgument).Cause(err).Msg("schedule already exists within this end timestamp").Err()
+	}
+
+	// check user exists
+	user, err := users.Get(ctx, userId)
+	if err != nil {
+		return nil, eb.Code(errs.Unavailable).Cause(err).Msg("failed to get user").Err()
+	}
+
+	schedule := Schedule{User: *user, Time: TimeRange{}}
+	err = db.QueryRow(
+		ctx,
+		`INSERT INTO schedules (user_id, start_time, end_time) VALUES ($1, $2, $3) RETURNING id, start_time, end_time`,
+		userId, timeRange.Start, timeRange.End,
+	).Scan(&schedule.Id, &schedule.Time.Start, &schedule.Time.End)
+	if err != nil {
+		return nil, eb.Code(errs.Unavailable).Cause(err).Msg("failed to insert schedule").Err()
+	}
+
+	return &schedule, nil
+}
+
+//encore:api public method=GET path=/scheduled
+func ScheduledNow(ctx context.Context) (*Schedule, error) {
+	return scheduled(ctx, time.Now())
+}
+
+//encore:api public method=GET path=/scheduled/:timestamp
+func ScheduledAt(ctx context.Context, timestamp string) (*Schedule, error) {
+	eb := errs.B().Meta("timestamp", timestamp)
+	parsedtime, err := time.Parse(time.RFC3339, timestamp)
+	if err != nil {
+		return nil, eb.Code(errs.InvalidArgument).Msg("timestamp is not in a valid format").Err()
+	}
+
+	return scheduled(ctx, parsedtime)
+}
+
+func scheduled(ctx context.Context, timestamp time.Time) (*Schedule, error) {
+	eb := errs.B().Meta("timestamp", timestamp)
+	schedule, err := RowToSchedule(ctx, db.QueryRow(ctx, `
+		SELECT id, user_id, start_time, end_time
+		FROM schedules
+		WHERE start_time <= $1
+		  AND end_time >= $1
+	`, timestamp.UTC()))
+	if errors.Is(err, db.ErrNoRows) {
+		return nil, eb.Code(errs.NotFound).Msg("no schedule found").Err()
+	}
+	if err != nil {
+		return nil, err
+	}
+	return schedule, nil
+}
+
+//encore:api public method=GET path=/schedules
+func ListByTimeRange(ctx context.Context, timeRange TimeRange) (*Schedules, error) {
+	rows, err := db.Query(ctx, `
+		SELECT id, user_id, start_time, end_time
+		FROM schedules
+		WHERE start_time >= $1
+		AND end_time <= $2
+		ORDER BY start_time ASC
+	`, timeRange.Start, timeRange.End)
+	if err != nil {
+		return nil, err
+	}
+
+	defer rows.Close()
+
+	var schedules []Schedule
+	for rows.Next() {
+		schedule, err := RowToSchedule(ctx, rows)
+		if err != nil {
+			return nil, err
+		}
+		schedules = append(schedules, *schedule)
+	}
+
+	return &Schedules{Items: schedules}, nil
+}
+
+//encore:api public method=DELETE path=/schedules
+func DeleteByTimeRange(ctx context.Context, timeRange TimeRange) (*Schedules, error) {
+	schedules, err := ListByTimeRange(ctx, timeRange)
+	if err != nil {
+		return nil, err
+	}
+	_, err = db.Exec(ctx, `DELETE FROM schedules WHERE start_time >= $1 AND end_time <= $2`, timeRange.Start, timeRange.End)
+	if err != nil {
+		return nil, err
+	}
+
+	return schedules, err
+}
+
+// Helper function to convert a Row object to to Schedule
+func RowToSchedule(ctx context.Context, row interface {
+	Scan(dest ...interface{}) error
+}) (*Schedule, error) {
+	var schedule = &Schedule{Time: TimeRange{}}
+	var userId int32
+
+	err := row.Scan(&schedule.Id, &userId, &schedule.Time.Start, &schedule.Time.End)
+	if err != nil {
+		return nil, err
+	}
+
+	user, err := users.Get(ctx, userId)
+	if err != nil {
+		return nil, err
+	}
+
+	schedule.User = *user
+	return schedule, nil
+}
+```
+
+🥐 Next, type `encore run` in your Terminal and in a separate window run the command under **cURL Request** (also feel free to edit the values!) to create our first schedule against the user we created earlier:
+
+```bash
+curl -d '{
+  "Start":"2023-11-28T10:00:00Z",
+  "End":"2023-11-30T10:00:00Z"
+}' "http://localhost:4000/users/1/schedules"
+
+# Example JSON response
+# {
+#   "Id":1,
+#   "User":{
+#     "Id":1,
+#     "FirstName":"Katy",
+#     "LastName":"Smith",
+#     "SlackHandle":"katy"
+#   },
+#   "Time":{
+#     "Start":"2023-11-28T10:00:00Z",
+#     "End":"2023-11-30T10:00:00Z"
+#   }
+# }
+```
+
+## 5. Create a service to manage incidents
+
+So we have users, and we know who is available to be notified (or if nobody should be notified) at any given time with the introduction of the `schedules` service. The only thing we're missing is the ability to report, assign and acknowledge incidents!
+
+The flow we're going to implement is: an incoming incident will arrive, let's either unassign or auto-assign it based on the `schedules` service, and incidents have to be acknowledged. If they are not acknowledged, they will continue to be notified on Slack every 10 minutes until it has.
+
+To start with, we need to create a new `incidents` service with the following resources:
+
+
+| #   | Type                                                 | Description / Filename                                                                             |
+| --- | ---------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
+| #1  | SQL Migration                                        | Our PostgreSQL schema for storing incidents <br/> `incidents/migrations/1_create_incidents.up.sql` |
+| #2  | HTTP Endpoint <br/> `GET /incidents`                 | Get list of all unacknowledged incidents <br/> `incidents/incidents.go`                            |
+| #3  | HTTP Endpoint <br/> `PUT /incidents/:id/acknowledge` | Acknowledge an incident <br/> `incidents/incidents.go`                                             |
+| #4  | HTTP Endpoint <br/> `GET /scheduled/:timestamp`      | Get  <br/> `incidents/incidents.go`                                                                |
+
+For the SQL migration in #1, we need to create the table for our incidents. We need to have a one-to-many relationship between an user and an incident. That is, an incident can only be assigned to a single user but a single user can be assigned to many incidents.
+
+🥐 Let's create our migration file in `incidents/migrations/1_create_incidents.up.sql`:
+
+```sql
+CREATE TABLE incidents
+(
+    id               BIGSERIAL PRIMARY KEY,
+    assigned_user_id INTEGER,
+    body             TEXT      NOT NULL,
+    created_at       TIMESTAMP NOT NULL DEFAULT NOW(),
+    acknowledged_at  TIMESTAMP
+);
+```
+
+🥐 Next, our code belonging in `incidents/incidents.go` for being able to support incidents is below:
+
+```go
+// Service incidents reports, assigns and acknowledges incidents.
+package incidents
+
+import (
+	"context"
+	"encore.app/schedules"
+	"encore.app/slack"
+	"encore.app/users"
+	"encore.dev/beta/errs"
+	"encore.dev/storage/sqldb"
+	"fmt"
+	"time"
+)
+
+// Define a database named 'incidents', using the database migrations
+// in the "./migrations" folder. Encore automatically provisions,
+// migrates, and connects to the database.
+var db = sqldb.NewDatabase("incidents", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+
+// This struct holds multiple Incidents structs
+type Incidents struct {
+	Items []Incident
+}
+
+// This is a Go struct representing our PostgreSQL schema for `incidents`
+type Incident struct {
+	Id             int32
+	Body           string
+	CreatedAt      time.Time
+	Acknowledged   bool
+	AcknowledgedAt *time.Time
+	Assignee       *users.User
+}
+
+//encore:api public method=GET path=/incidents
+func List(ctx context.Context) (*Incidents, error) {
+	rows, err := db.Query(ctx, `
+		SELECT id, assigned_user_id, body, created_at, acknowledged_at
+		FROM incidents
+		WHERE acknowledged_at IS NULL
+	`)
+	if err != nil {
+		return nil, err
+	}
+	return RowsToIncidents(ctx, rows)
+}
+
+//encore:api public method=PUT path=/incidents/:id/acknowledge
+func Acknowledge(ctx context.Context, id int32) (*Incident, error) {
+	eb := errs.B().Meta("incidentId", id)
+	rows, err := db.Query(ctx, `
+		UPDATE incidents
+		SET acknowledged_at = NOW()
+		WHERE acknowledged_at IS NULL
+		  AND id = $1
+		RETURNING id, assigned_user_id, body, created_at, acknowledged_at
+	`, id)
+	if err != nil {
+		return nil, err
+	}
+
+	incidents, err := RowsToIncidents(ctx, rows)
+	if err != nil {
+		return nil, err
+	}
+	if incidents.Items == nil {
+		return nil, eb.Code(errs.NotFound).Msg("no incident found").Err()
+	}
+
+	incident := &incidents.Items[0]
+	_ = slack.Notify(ctx, &slack.NotifyParams{
+		Text: fmt.Sprintf("Incident #%d assigned to %s %s <@%s> has been acknowledged:\n%s", incident.Id, incident.Assignee.FirstName, incident.Assignee.LastName, incident.Assignee.SlackHandle, incident.Body),
+	})
+
+	return incident, err
+}
+
+//encore:api public method=POST path=/incidents
+func Create(ctx context.Context, params *CreateParams) (*Incident, error) {
+	// check who is on-call
+	schedule, err := schedules.ScheduledNow(ctx)
+
+	incident := Incident{}
+	if schedule != nil {
+		incident.Assignee = &schedule.User
+	}
+
+	var row *db.Row
+	if schedule != nil {
+		// Someone is on-call
+		row = db.QueryRow(ctx, `
+			INSERT INTO incidents (assigned_user_id, body)
+			VALUES ($1, $2)
+			RETURNING id, body, created_at
+		`, &schedule.User.Id, params.Body)
+	} else {
+		// Nobody is on-call
+		row = db.QueryRow(ctx, `
+			INSERT INTO incidents (body)
+			VALUES ($1)
+			RETURNING id, body, created_at
+		`, params.Body)
+	}
+
+	if err = row.Scan(&incident.Id, &incident.Body, &incident.CreatedAt); err != nil {
+		return nil, err
+	}
+
+	var text string
+	if incident.Assignee != nil {
+		text = fmt.Sprintf("Incident #%d created and assigned to %s %s <@%s>\n%s", incident.Id, incident.Assignee.FirstName, incident.Assignee.LastName, incident.Assignee.SlackHandle, incident.Body)
+	} else {
+		text = fmt.Sprintf("Incident #%d created and unassigned\n%s", incident.Id, incident.Body)
+	}
+	_ = slack.Notify(ctx, &slack.NotifyParams{Text: text})
+
+	return &incident, nil
+}
+
+type CreateParams struct {
+	Body string
+}
+
+// Helper to take a db.Rows instance and convert it into a list of Incidents
+func RowsToIncidents(ctx context.Context, rows *db.Rows) (*Incidents, error) {
+	eb := errs.B()
+
+	defer rows.Close()
+
+	var incidents []Incident
+	for rows.Next() {
+		var incident = Incident{}
+		var assignedUserId *int32
+		if err := rows.Scan(&incident.Id, &assignedUserId, &incident.Body, &incident.CreatedAt, &incident.AcknowledgedAt); err != nil {
+			return nil, eb.Code(errs.Unknown).Msgf("could not scan: %v", err).Err()
+		}
+		if assignedUserId != nil {
+			user, err := users.Get(ctx, *assignedUserId)
+			if err != nil {
+				return nil, eb.Code(errs.NotFound).Msgf("could not retrieve user for incident %v", assignedUserId).Err()
+			}
+			incident.Assignee = user
+		}
+		incident.Acknowledged = incident.AcknowledgedAt != nil
+		incidents = append(incidents, incident)
+	}
+
+	return &Incidents{Items: incidents}, nil
+}
+```
+
+Fantastic! We have an _almost_ working application. The main two things we're missing are:
+
+1. For unacknowledged incidents, we need to post a reminder on Slack every 10 minutes until they have been acknolwedged.
+2. Whenever a user is currently on call, we should assign all previously unassigned incidents to them.
+
+🥐 To achieve this, we'll need to create two [Cron Jobs](http://localhost:3000/docs/develop/cron-jobs) which thankfully Encore makes incredibly simple. So let's go ahead and create the first one for reminding us every 10 minutes of incidents we haven't acknowledged. Go ahead and add the code below to our `incidents/incidents.go` file:
+
+```go
+// Track unacknowledged incidents
+var _ = cron.NewJob("unacknowledged-incidents-reminder", cron.JobConfig{
+	Title:    "Notify on Slack about incidents which are not acknowledged",
+	Every:    10 * cron.Minute,
+	Endpoint: RemindUnacknowledgedIncidents,
+})
+
+//encore:api private
+func RemindUnacknowledgedIncidents(ctx context.Context) error {
+	incidents, err := List(ctx) // we never query for acknowledged incidents
+	if err != nil {
+		return err
+	}
+	if incidents == nil {
+		return nil
+	}
+
+	var items = []string{"These incidents have not been acknowledged yet. Please acknowledge them otherwise you will be reminded every 10 minutes:"}
+	for _, incident := range incidents.Items {
+		var assignee string
+		if incident.Assignee != nil {
+			assignee = fmt.Sprintf("%s %s (<@%s>)", incident.Assignee.FirstName, incident.Assignee.LastName, incident.Assignee.SlackHandle)
+		} else {
+			assignee = "Unassigned"
+		}
+
+		items = append(items, fmt.Sprintf("[%s] [#%d] %s", assignee, incident.Id, incident.Body))
+	}
+
+	if len(incidents.Items) > 0 {
+		_ = slack.Notify(ctx, &slack.NotifyParams{Text: strings.Join(items, "\n")})
+	}
+
+	return nil
+}
+```
+
+And for our second cronjob, when someone goes on call we need to automatically assign the previously unassigned incidents to them. We don't have a HTTP endpoint for assigning incidents so we need to implement a `PUT /incidents/:id/assign` endpoint.
+
+🥐 So let's also add that endpoint as well as the cronjob code to our `incidents/incidents.go` file:
+
+```go
+//encore:api public method=PUT path=/incidents/:id/assign
+func Assign(ctx context.Context, id int32, params *AssignParams) (*Incident, error) {
+	eb := errs.B().Meta("params", params)
+	rows, err := db.Query(ctx, `
+		UPDATE incidents
+		SET assigned_user_id = $1
+		WHERE acknowledged_at IS NULL
+		  AND id = $2
+		RETURNING id, assigned_user_id, body, created_at, acknowledged_at
+	`, params.UserId, id)
+	if err != nil {
+		return nil, err
+	}
+
+	incidents, err := RowsToIncidents(ctx, rows)
+	if err != nil {
+		return nil, err
+	}
+	if incidents.Items == nil {
+		return nil, eb.Code(errs.NotFound).Msg("no incident found").Err()
+	}
+
+	incident := &incidents.Items[0]
+	_ = slack.Notify(ctx, &slack.NotifyParams{
+		Text: fmt.Sprintf("Incident #%d is re-assigned to %s %s <@%s>\n%s", incident.Id, incident.Assignee.FirstName, incident.Assignee.LastName, incident.Assignee.SlackHandle, incident.Body),
+	})
+
+	return incident, err
+}
+
+type AssignParams struct {
+	UserId int32
+}
+
+var _ = cron.NewJob("assign-unassigned-incidents", cron.JobConfig{
+	Title:    "Assign unassigned incidents to user on-call",
+	Every:    1 * cron.Minute,
+	Endpoint: AssignUnassignedIncidents,
+})
+
+//encore:api private
+func AssignUnassignedIncidents(ctx context.Context) error {
+	// if this fails, we don't have anyone on call so let's skip this
+	schedule, err := schedules.ScheduledNow(ctx)
+	if err != nil {
+		return err
+	}
+
+	incidents, err := List(ctx) // we never query for acknowledged incidents
+	if err != nil {
+		return err
+	}
+
+	for _, incident := range incidents.Items {
+		if incident.Assignee != nil {
+			continue // this incident has already been assigned
+		}
+
+		_, err := Assign(ctx, incident.Id, &AssignParams{UserId: schedule.User.Id})
+		if err == nil {
+			rlog.Info("OK assigned unassigned incident", "incident", incident, "user", schedule.User)
+		} else {
+			rlog.Error("FAIL to assign unassigned incident", "incident", incident, "user", schedule.User, "err", err)
+			return err
+		}
+	}
+
+	return nil
+}
+```
+
+🥐 Next, call `encore run` in your Terminal and in a separate window run the command under **cURL Request** (also feel free to edit the values!) to trigger our first incident. Most likely we won't have an assigned user unless you have scheduled a time that overlaps with right now in the last cURL request for creating a schedule:
+
+```bash
+curl -d '{
+  "Body":"An unexpected error happened on example-website.com on line 38. It needs addressing now!"
+}' http://localhost:4000/incidents
+
+# Example JSON response
+# {
+#   "Id":1,
+#	  "Body":"An unexpected error happened on example-website.com on line 38. It needs addressing now!",
+#	  "CreatedAt":"2022-09-28T15:09:00Z",
+#	  "Acknowledged":false,
+#	  "AcknowledgedAt":null,
+#   "Assignee":null
+# }
+```
+
+## 6. Try your app and deploy
+
+Congratulations! Our application looks ready for others to try - we have our `users`, `schedules` `incidents` and `slack` services along with 3 database tables and 2 cronjobs. Even better that all of the deployment and maintenance is taken care by Encore!
+
+🥐 To try out your application, type `encore run` in your Terminal and run the following cURL commands:
+
+```bash
+# Step 1: Create a User and copy the User ID to your clipboard
+curl -d '{
+  "FirstName":"Katy",
+  "LastName":"Smith",
+  "SlackHandle":"katy"
+}' http://localhost:4000/users
+
+# Step 2: Create a schedule for the user we just created
+curl -d '{
+  "Start":"2022-09-28T10:00:00Z",
+  "End":"2022-09-29T10:00:00Z"
+}' "http://localhost:4000/users/1/schedules"
+
+# Step 3: Trigger an incident
+curl -d '{
+  "Body":"An unexpected error happened on example-website.com on line 38. It needs addressing now!"
+}' http://localhost:4000/incidents
+
+# Step 4: Acknowledge the Incident
+curl -X PUT "http://localhost:4000/incidents/1/acknowledge"
+```
+
+And if you don't acknowledge incoming incidents on Step 4, you will be reminded on Slack every 10 minutes:
+
+![Being reminded on Slack about unacknowledged incidents](/assets/docs/incident-slack-reminder-example.png)
+
+### Deploy to the cloud
+
+🥐 Push your changes and deploy your application to Encore's free development cloud by running:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Encore will now build and test your app, provision the needed infrastructure, and deploy your application to the cloud.
+
+After triggering the deployment, you will see a URL where you can view its progress in the [Encore Cloud dashboard](https://app.encore.cloud). It will look something like: `https://app.encore.cloud/$APP_ID/deploys/...`
+
+From there you can also see metrics, traces, link your app to a GitHub repo to get automatic deploys on new commits, and connect your own AWS or GCP account to use for production deployment.
+
+### Celebrate with fireworks
+
+Now that your app is running in the cloud, let's celebrate with some fireworks:
+
+🥐 In the Cloud Dashboard, open the Command Menu by pressing **Cmd + K** (Mac) or **Ctrl + K** (Windows/Linux).
+
+_From here you can easily access all Cloud Dashboard features and for example jump straight to specific services in the Service Catalog or view Traces for specific endpoints._
+
+🥐 Type `fireworks` in the Command Menu and press enter. Sit back and enjoy the show!
+
+![Fireworks](/assets/docs/fireworks.jpg)
+
+### Architecture Diagram
+
+Take a look at the [Encore Flow](/docs/go/observability/encore-flow) diagram that was automatically generated for our new application too!
+
+![Being reminded on Slack about unacknowledged incidents](/assets/docs/incident-flow-diagram.png)
+
+### GitHub Repository
+
+🥐 Check out the `example-app-oncall` repository on GitHub for this example which includes additional features and tests:
+[https://github.com/encoredev/example-app-oncall](https://github.com/encoredev/example-app-oncall)
+
+Alternatively, you can clone our example application by running this in your Terminal:
+
+```shell
+$ encore app create --example https://github.com/encoredev/example-app-oncall
+```
+
+### Feedback
+
+🥐 We'd love to hear your thoughts about this tutorial and learn about what you're building next.
+Let us know by [tweeting your experience](https://twitter.com/encoredotdev), blog about it, or talk to us about it on [Discord](https://encore.dev/discord).
diff --git a/docs/go/tutorials/meeting-notes.mdx b/docs/go/tutorials/meeting-notes.mdx
new file mode 100644
index 0000000000..6e2c8b0328
--- /dev/null
+++ b/docs/go/tutorials/meeting-notes.mdx
@@ -0,0 +1,361 @@
+---
+title: Building a Meeting Notes app
+subtitle: Learn how to set up a web app backend (with database) in less than 100 lines of code
+seotitle: How to build a Meeting Notes app in Go & React
+seodesc: Learn how to set up a free & production-ready web app backend in Go (with database) in less than 100 lines
+lang: go
+---
+
+In this tutorial, we will create a backend in less than 100 lines of code. The backend will:
+
+- Store data in a cloud SQL database
+- Make API calls to a third-party service
+- Deploy to the cloud and be publicly available
+
+The example app we will build is a markdown meeting notes app BUT it’s trivial to replace the specifics if you have another idea in mind (again, less than 100 lines of code).
+
+**[Demo version of the app](https://encoredev.github.io/meeting-notes)**
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source
+    src="/assets/docs/meeting-notes-demo.mp4"
+    className="w-full h-full"
+    type="video/mp4"
+  />
+</video>
+
+This is the end result:
+<div className="not-prose my-10">
+  <Editor projectName="meetingNotes" />
+</div>
+
+## Create your Encore application
+
+Create a new app from the meeting-notes example. This will start you off with everything described in this tutorial:
+
+```shell
+$ encore app create my-app --example=meeting-notes
+```
+
+<Callout type="info">
+
+Before running the project locally, make sure you have [Docker](https://www.docker.com/products/docker-desktop/) installed and running. Docker is needed for Encore to create databases for locally running projects. Also, if you want to try the photo search functionality then you will need an API key from [pexels.com/api/](https://www.pexels.com/api/) (more on that below)
+
+</Callout>
+
+To run the backend locally:
+
+```shell
+$ cd you-app-name # replace with the app name you picked
+$ encore run
+```
+
+You should see the following:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source
+    src="/assets/docs/encorerun.mp4"
+    className="w-full h-full"
+    type="video/mp4"
+  />
+</video>
+
+That means your local development backend is up and running! Encore takes care of setting up all the necessary infrastructure for your application, including databases. Encore also starts the local development dashboard which is a tool to help you move faster when you're developing new features.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source
+    src="/assets/docs/localdashvideo.mp4"
+    className="w-full h-full"
+    type="video/mp4"
+  />
+</video>
+
+To start the front-end, run the following commands in another terminal window:
+
+```shell
+$ cd you-app-name/frontend
+$ npm install
+$ npm run dev
+```
+
+You can now open http://localhost:5173/example-meeting-notes/ in your browser 🔥
+
+## Storing and retrieving from an SQL database
+
+Let's take a look at the backend code. There are essentially only three files of interest, let's start by looking at `note.go`. This file contains two endpoints and one interface, all standard Go code except for a few lines specific to Encore.
+
+The `Note` type represents our data structure:
+
+```go
+type Note struct {
+	ID       string `json:"id"`
+	Text     string `json:"text"`
+	CoverURL string `json:"cover_url"`
+}
+```
+
+Every note will have an `ID` (uuid that is created on the frontend), `Text` (Markdown text content), and `CoverURL` (background image URL).
+
+The `SaveNote` function handles storing a meeting note:
+
+```go
+//encore:api public method=POST path=/note
+func SaveNote(ctx context.Context, note *Note) (*Note, error) {
+	// Save the note to the database.
+	// If the note already exists (i.e. CONFLICT), we update the notes text and the cover URL.
+	_, err := sqldb.Exec(ctx, `
+		INSERT INTO note (id, text, cover_url) VALUES ($1, $2, $3)
+		ON CONFLICT (id) DO UPDATE SET text=$2, cover_url=$3
+	`, note.ID, note.Text, note.CoverURL)
+
+	// If there was an error saving to the database, then we return that error.
+	if err != nil {
+		return nil, err
+	}
+
+	// Otherwise, we return the note to indicate that the save was successful.
+	return note, nil
+}
+```
+
+The comment above the function tells Encore that this is a public endpoint that should be reachable by POST on `/note`. The second argument to the function (`Note`) is the POST body and the function returns a `Note` and an `error` (a `nil` error means a 200 response).
+
+The `GetNote` function takes care of fetching a meeting note from our database given an `id`:
+
+```go
+//encore:api public method=GET path=/note/:id
+func GetNote(ctx context.Context, id string) (*Note, error) {
+	note := &Note{ID: id}
+
+	// We use the note ID to query the database for the note's text and cover URL.
+	err := sqldb.QueryRow(ctx, `
+		SELECT text, cover_url FROM note
+		WHERE id = $1
+	`, id).Scan(&note.Text, &note.CoverURL)
+
+	// If the note doesn't exist, we return an error.
+	if err != nil {
+		return nil, err
+	}
+
+	// Otherwise, we return the note.
+	return note, nil
+}
+```
+
+Here we have a public GET endpoint with a dynamic path parameter which is the `id` of the meeting note to fetch. The second argument, in this case, is the dynamic path parameter, a request to this endpoint will look like `/note/123-abc` where `id` will be set to `123-abc`.
+
+Both `SaveNote` and `GetNote` makes use of a SQL database table named `note`, let's look at how that table is defined.
+
+## Defining a SQL database
+
+To create a SQL database using Encore we first create a folder named `migrations` and inside that folder a migration file named `1_create_tables.up.sql`. The file name is important (it must look something like `1_name.up.sql`). Our migration file is only five lines long and looks like this:
+
+```sql
+CREATE TABLE note (
+	id TEXT PRIMARY KEY,
+	text TEXT,
+	cover_url TEXT
+);
+```
+
+When recognizing this file, Encore will create a `note` table with three columns `id`, `text` and `cover_url`. The `id` is the primary key, used to identify specific meeting notes.
+
+## Making requests to a third-party API
+
+Let's look at how we can use an Encore endpoint to proxy requests to a third-party service (in this example photo service [pexels.com](http://www.pexels.com/) but the idea would be the same for any other third-party API).
+
+The file `pexels.go` only has one endpoint, `SearchPhoto`:
+
+```go
+//encore:api public method=GET path=/images/:query
+func SearchPhoto(ctx context.Context, query string) (*SearchResponse, error) {
+	// Create a new http client to proxy the request to the Pexels API.
+	URL := "https://api.pexels.com/v1/search?query=" + query
+	client := &http.Client{}
+	req, _ := http.NewRequest("GET", URL, nil)
+
+	// Add authorization header to the req with the API key.
+	req.Header.Set("Authorization", secrets.PexelsApiKey)
+
+	// Make the request, and close the response body when we're done.
+	res, err := client.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer res.Body.Close()
+
+	if res.StatusCode >= 400 {
+		return nil, fmt.Errorf("Pexels API error: %s", res.Status)
+	}
+
+	// Decode the data into the searchResponse struct.
+	var searchResponse *SearchResponse
+	err = json.NewDecoder(res.Body).Decode(&searchResponse)
+	if err != nil {
+		return nil, err
+	}
+
+	return searchResponse, nil
+}
+```
+
+Again a GET endpoint with a dynamic path parameter which this time represents the query text we want to send to the Pexels API.
+
+The type we use to decode the response from the Pexels API looks like this:
+
+```go
+type SearchResponse struct {
+	Photos []struct {
+		Id  int `json:"id"`
+		Src struct {
+			Medium    string `json:"medium"`
+			Landscape string `json:"landscape"`
+		} `json:"src"`
+		Alt string `json:"alt"`
+	} `json:"photos"`
+}
+```
+
+We get a lot more data from Pexels but here we only pick the fields that we want to propagate to our frontend.
+
+[Pexels API](https://www.pexels.com/api/) requires an API key, as most open APIs do. The API key is added as a header to the requests (from the `SearchPhoto` function above):
+
+```go
+req.Header.Set("Authorization", secrets.PexelsApiKey)
+```
+
+Here we could have hardcoded the API key but that would have made it readable for everyone with access to our repo. Instead, we made use of Encore's built-in [secrets management](https://encore.dev/docs/go/primitives/secrets). To set this secret, run the following command in your project folder and follow the prompt:
+
+```shell
+encore secret set --type dev,prod,local,pr PexelsApiKey
+```
+
+## Creating a request client
+
+Encore is able to generate frontend [request clients](https://encore.dev/docs/go/cli/client-generation) (TypeScript or JavaScript). This means that you do not need to manually keep the request/response objects in sync on the frontend, huge time saver. To generate a client run:
+
+```shell
+$ encore gen client <APP_NAME> --output=./src/client.ts --env=<ENV_NAME>
+```
+
+You are going to want to run this command quite often (whenever you make a change to your endpoints) so having it as an `npm` script is a good idea:
+
+```json
+{
+...
+"scripts": {
+    ...
+    "generate-client:staging": "encore gen client <Encore app id here> --output=./src/client.ts --env=staging",
+    "generate-client:local": "encore gen client <Encore app id here> --output=./src/client.ts --env=local"
+  },
+}
+```
+
+After that you are ready to use the request client in your code. Here is an example of calling the `GetNote` endpoint:
+
+```tsx
+import Client, { Environment, Local } from "src/client.ts";
+
+// Making request to locally running backend...
+const client = new Client(Local);
+// or to a specific deployed environment
+const client = new Client(Environment("staging"));
+
+// Calling APIs as typesafe functions 🌟
+const response = await client.note.GetNote("note-uuid");
+console.log(response.id);
+console.log(response.cover_url);
+console.log(response.text);
+```
+
+## Deploying the backend to the cloud
+
+It’s deploy time! To get your backend deployed in the cloud all you need to do is to commit your code and push it to the `encore` remote:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+When running `git push encore` you will get a link to the Encore Cloud dashboard where you can view the deploy for your app and after about a minute you have a backend running in the cloud ☁️
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source
+    src="/assets/docs/meeting-notes-git-push.mp4"
+    className="w-full h-full"
+    type="video/mp4"
+  />
+</video>
+
+## Hosting the frontend
+
+The frontend can be deployed to any static site hosting platform. The example project is pre-configured to deploy the frontend to [GitHub Pages](https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site). Take a look at `.github/workflows/node.yml` to see the GitHub actions workflow being triggered on new commits to the repo:
+
+```yaml
+name: Build and Deploy
+
+on: [push]
+
+permissions:
+  contents: write
+
+jobs:
+  build-and-deploy:
+    concurrency: ci-${{ github.ref }}
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: frontend
+
+    steps:
+      - name: Checkout 🛎️
+        uses: actions/checkout@v3
+
+      - name: Use Node.js
+        uses: actions/setup-node@v3
+        with:
+          node-version: "16.15.1"
+
+      - name: Install and Build 🔧
+        run: |
+          npm install
+          npm run build
+
+      - name: Deploy 🚀
+        uses: JamesIves/github-pages-deploy-action@v4.3.3
+        with:
+          branch: gh-pages
+          folder: frontend/dist
+```
+
+The interesting part is towards the bottom where we build the frontend code and make use of the [github-pages-deploy-action](https://github.com/JamesIves/github-pages-deploy-action) step to automatically make a new commit with the compiled frontend code to a `gh-pages` branch.
+
+**Steps to deploy to GitHub pages:**
+
+1. Create a repo on GitHub
+2. In the `vite.config.js` file, set the `base` property to the name of your repo:
+
+```yaml
+base: "/my-repo-name/",
+```
+
+1. Push your code to GitHub and wait for the GitHub actions workflow to finish.
+2. Go to _Settings_ → _Pages_ for your repo on GitHub and set _Branch_ to `gh-pages`.
+
+## Celebrate with fireworks
+
+Now that your app is running in the cloud, let's celebrate with some fireworks:
+
+🥐 In the Cloud Dashboard, open the Command Menu by pressing **Cmd + K** (Mac) or **Ctrl + K** (Windows/Linux).
+
+_From here you can easily access all Cloud Dashboard features and for example jump straight to specific services in the Service Catalog or view Traces for specific endpoints._
+
+🥐 Type `fireworks` in the Command Menu and press enter. Sit back and enjoy the show!
+
+![Fireworks](/assets/docs/fireworks.jpg)
+
+## Wrapping up
+
+You’ve learned how to build and deploy a Go backend using Encore, store data in an SQL database, and make API calls to an external service. All of this in under 100 lines of code.
diff --git a/docs/go/tutorials/rest-api.mdx b/docs/go/tutorials/rest-api.mdx
new file mode 100644
index 0000000000..28740e71f3
--- /dev/null
+++ b/docs/go/tutorials/rest-api.mdx
@@ -0,0 +1,413 @@
+---
+seotitle: How to build a REST API
+seodesc: Learn how to build and ship a REST API in just a few minutes, Encore.go. Go from zero to running API with this tutorial.
+title: Building a REST API
+subtitle: Learn how to build a URL shortener with a REST API and PostgreSQL database
+lang: go
+---
+
+In this tutorial you will create a REST API for a URL Shortener service. In a few short minutes, you'll learn how to:
+
+* Create REST APIs with Encore
+* Use PostgreSQL databases
+* Use the local development dashboard to test your app
+* Create and run tests
+
+This is the end result:
+<div className="not-prose mb-10">
+   <Editor projectName="urlShortener" />
+</div>
+
+<Callout type="info">
+
+To make it easier to follow along, we've laid out a trail of croissants to guide your way.
+Whenever you see a 🥐 it means there's something for you to do.
+
+</Callout>
+
+## 1. Create a service and endpoint
+
+If you haven't already, create a new application by running `encore app create` and select `Empty app` as the template.
+
+If this is the first time you're using Encore, you'll be asked if you wish to create a free account.
+This is needed when you want Encore to manage functionality like secrets and handle cloud deployments (which we'll use later on in the tutorial).
+
+Now let's create a new `url` service.
+
+🥐 In your application's root folder, create a new folder `url` and create a new file `url.go` that looks like this:
+
+```go
+-- url/url.go --
+// Service url takes URLs, generates random short IDs, and stores the URLs in a database.
+package url
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+)
+
+type URL struct {
+	ID  string // short-form URL id
+	URL string // complete URL, in long form
+}
+
+type ShortenParams struct {
+	URL string // the URL to shorten
+}
+
+// Shorten shortens a URL.
+//encore:api public method=POST path=/url
+func Shorten(ctx context.Context, p *ShortenParams) (*URL, error) {
+	id, err := generateID()
+	if err != nil {
+		return nil, err
+	}
+	return &URL{ID: id, URL: p.URL}, nil
+}
+
+// generateID generates a random short ID.
+func generateID() (string, error) {
+	var data [6]byte // 6 bytes of entropy
+	if _, err := rand.Read(data[:]); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(data[:]), nil
+}
+```
+
+This sets up the `POST /url` endpoint (see the `//encore:api` annotation on the `Shorten` function).
+
+🥐 Let’s see if it works! Start your app by running `encore run`.
+
+You should see this:
+
+```output
+Your API is running at:     http://localhost:4000
+Development Dashboard URL:  http://localhost:9400
+4:19PM INF registered endpoint path=/url service=url endpoint=Shorten
+```
+
+🥐 Next, call your endpoint from the Local Development Dashboard at [http://localhost:9400](http://localhost:9400) and view a trace of the response.
+It should look like this:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/rest_tut.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+You can also call it from the terminal:
+
+```shell
+$ curl http://localhost:4000/url -d '{"URL": "https://encore.dev"}'
+```
+
+And you should see this:
+
+```json
+{
+  "ID": "5cJpBVRp",
+  "URL": "https://encore.dev"
+}
+```
+
+It works! There’s just one problem...
+
+Right now, we’re not actually storing the URL anywhere. That means we can generate shortened IDs but there’s no way to get back to the original URL! We need to store a mapping from the short ID to the complete URL.
+
+## 2. Save URLs in a database
+Fortunately, Encore makes it really easy to set up a PostgreSQL database to store our data. To do so, we first define a **database schema**, in the form of a migration file.
+
+🥐 Create a new folder named `migrations` inside the `url` folder. Then, inside the `migrations` folder, create an initial database migration file named `1_create_tables.up.sql`. The file name format is important (it must start with `1_` and end in `.up.sql`).
+
+🥐 Add the following contents to the file:
+
+```sql
+-- url/migrations/1_create_tables.up.sql --
+CREATE TABLE url (
+	id TEXT PRIMARY KEY,
+	original_url TEXT NOT NULL
+);
+```
+
+🥐 Next, go back to the `url/url.go` file and import the `encore.dev/storage/sqldb` package by modifying the import statement to become:
+
+```go
+HL url/url.go 5:5
+-- url/url.go --
+import (
+	"context"
+	"crypto/rand"
+	"encoding/base64"
+
+	"encore.dev/storage/sqldb"
+)
+```
+
+🥐 Then let's define our database object by adding the following to `url/url.go`:
+
+```go
+-- url/url.go --
+// Define a database named 'url', using the database
+// migrations in the "./migrations" folder.
+
+var db = sqldb.NewDatabase("url", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+```
+
+🥐 Now, to insert data into our database, let’s create a helper function `insert`:
+
+```go
+-- url/url.go --
+// insert inserts a URL into the database.
+func insert(ctx context.Context, id, url string) error {
+	_, err := db.Exec(ctx, `
+        INSERT INTO url (id, original_url)
+        VALUES ($1, $2)
+    `, id, url)
+	return err
+}
+```
+
+🥐 Lastly, we can update our `Shorten` function to insert into the database:
+
+```go
+-- url/url.go --
+func Shorten(ctx context.Context, p *ShortenParams) (*URL, error) {
+	id, err := generateID()
+	if err != nil {
+		return nil, err
+	} else if err := insert(ctx, id, p.URL); err != nil {
+		return nil, err
+	}
+	return &URL{ID: id, URL: p.URL}, nil
+}
+```
+
+<Callout type="info">
+
+Before running your application, make sure you have [Docker](https://www.docker.com) installed and running. It's required to locally run Encore applications with databases.
+
+</Callout>
+
+🥐 Next, start the application again with `encore run` and Encore automatically sets up your database.
+
+(In case your application won't run, check the [databases troubleshooting guide](/docs/develop/databases#troubleshooting).)
+
+You can verify that the database was created by opening the **Infra** tab in the local development dashboard at [localhost:9400](http://localhost:9400), which should something like this:
+
+<img src="/assets/docs/infra_tab.png" alt="Infra tab in local development dashboard" className="w-full h-full" />
+
+🥐 Now let's call the API again from the local development dashboard, or from the terminal:
+
+```shell
+$ curl http://localhost:4000/url -d '{"URL": "https://encore.dev"}'
+```
+
+🥐 Finally, let's verify that it was saved in the database. You can do this by checking the trace in the local development dashboard, or you can run  `encore db shell url` from the app root directory and inputting `select * from url;`:
+
+```shell
+$ encore db shell url
+psql (13.1, server 11.12)
+Type "help" for help.
+
+url=# select * from url;
+    id    |    original_url
+----------+--------------------
+ zr6RmZc4 | https://encore.dev
+(1 row)
+```
+
+That was easy!
+
+## 3. Add endpoint to retrieve URLs
+To complete our URL shortener API, let’s add the endpoint to retrieve a URL given its short id.
+
+🥐 Add this endpoint to `url/url.go`:
+
+```go
+-- url/url.go --
+// Get retrieves the original URL for the id.
+//encore:api public method=GET path=/url/:id
+func Get(ctx context.Context, id string) (*URL, error) {
+	u := &URL{ID: id}
+	err := db.QueryRow(ctx, `
+        SELECT original_url FROM url
+        WHERE id = $1
+    `, id).Scan(&u.URL)
+	return u, err
+}
+```
+
+Encore uses the `path=/url/:id` syntax to represent a path with a parameter. The `id` name corresponds to the parameter name in the function signature. In this case it is of type `string`, but you can also use other built-in types like `int` or `bool` if you want to restrict the values.
+
+🥐 We can make sure it works by reviewing the endpoint in the Service Catalog in the local development dashboard, where we can call it using the `id` you got in the previous step:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/rest_tut_3.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+You can also call it directly from the terminal:
+
+```shell
+$ curl http://localhost:4000/url/zr6RmZc4
+```
+
+You should now see this:
+
+```json
+{
+  "ID": "zr6RmZc4",
+  "URL": "https://encore.dev"
+}
+```
+
+It works! That's how you build REST APIs and use PostgreSQL databases in Encore.
+
+## 4. Add a test
+
+Before deployment, it is good practice to have tests to assure that
+the service works properly. Such tests including database access
+are easy to write.
+
+We've prepared a test to check that the whole cycle of shortening
+the URL, storing and then retrieving the original URL works.
+
+🥐 Save this in a separate file `url/url_test.go`.
+
+```go
+-- url/url_test.go --
+package url
+
+import (
+	"context"
+	"testing"
+)
+
+// TestShortenAndRetrieve - test that the shortened URL is stored and retrieved from database.
+func TestShortenAndRetrieve(t *testing.T) {
+	testURL := "https://github.com/encoredev/encore"
+	sp := ShortenParams{URL: testURL}
+	resp, err := Shorten(context.Background(), &sp)
+	if err != nil {
+		t.Fatal(err)
+	}
+	wantURL := testURL
+	if resp.URL != wantURL {
+		t.Errorf("got %q, want %q", resp.URL, wantURL)
+	}
+
+	firstURL := resp
+	gotURL, err := Get(context.Background(), firstURL.ID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if *gotURL != *firstURL {
+		t.Errorf("got %v, want %v", *gotURL, *firstURL)
+	}
+}
+```
+
+🥐 Now run `encore test ./...` to verify that it's working.
+
+If you use the local development dashboard ([localhost:9400](http://localhost:9400)), you can even see traces for tests.
+
+## 5. Deploy
+
+<Accordion>
+
+### Self-hosting
+
+Encore supports building Docker images directly from the CLI, which can then be self-hosted on your own infrastructure of choice.
+
+If your app is using infrastructure resources, such as SQL databases, Pub/Sub, or metrics, you will need to configure your Docker image with the necessary configuration.
+Our URL shortener makes use of a PostgreSQL database, so we'll need to supply a [runtime configuration](/docs/go/self-host/configure-infra) so that our app knows how to connect to the database in the cloud.
+
+🥐 Create a new file `infra-config.json` in the root of your project with the following contents:
+
+```json
+{
+   "$schema": "https://encore.dev/schemas/infra.schema.json",
+   "sql_servers": [
+      {
+         "host": "my-db-host:5432",
+         "databases": {
+            "url": {
+               "username": "my-db-owner",
+                "password": {"$env": "DB_PASSWORD"}
+            }
+         }
+      }
+   ]
+}
+```
+
+The values in this configuration are just examples, you will need to replace them with the correct values for your database.
+
+🥐 Build a Docker image by running `encore build docker url-shortener:v1.0`.
+
+This will compile your application using the host machine and then produce a Docker image containing the compiled application.
+
+🥐 Upload the Docker image to the cloud provider of your choice and run it.
+
+</Accordion>
+
+<Accordion>
+
+### Encore Cloud (free)
+
+Encore Cloud provides automated infrastructure and DevOps. Deploy to a free development environment or to your own cloud account on AWS or GCP.
+
+### Create account
+
+Before deploying with Encore Cloud, you need to have a free Encore Cloud account and link your app to the platform. If you already have an account, you can move on to the next step.
+
+If you don’t have an account, the simplest way to get set up is by running `encore app create` and selecting **Y** when prompted to create a new account. Once your account is set up, continue creating a new app, selecting the `empty app` template.
+
+After creating the app, copy your project files into the new app directory, ensuring that you do not replace the `encore.app` file (this file holds a unique id which links your app to the platform).
+
+### Commit changes
+
+The final step before you deploy is to commit all changes to the project repo.
+
+🥐 Commit the new files to the project's git repo and trigger a deploy to Encore's free development cloud by running:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Encore will now build and test your app, provision the needed infrastructure, and deploy your application to the cloud.
+
+After triggering the deployment, you will see a URL where you can view its progress in the [Encore Cloud dashboard](https://app.encore.cloud). It will look something like: `https://app.encore.cloud/$APP_ID/deploys/...`
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/rest_tut_4.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+From there you can also see metrics, traces, and connect your own AWS or GCP account to use for production deployment.
+
+*Now you have a fully fledged backend running in the cloud, well done!*
+
+### Celebrate with fireworks
+
+Now that your app is running in the cloud, let's celebrate with some fireworks:
+
+🥐 In the Cloud Dashboard, open the Command Menu by pressing **Cmd + K** (Mac) or **Ctrl + K** (Windows/Linux).
+
+_From here you can easily access all Cloud Dashboard features and for example jump straight to specific services in the Service Catalog or view Traces for specific endpoints._
+
+🥐 Type `fireworks` in the Command Menu and press enter. Sit back and enjoy the show!
+
+![Fireworks](/assets/docs/fireworks.jpg)
+
+🥐 A great next step is to [integrate with GitHub](/docs/platform/integrations/github). Once you've linked with GitHub, Encore will automatically start building and running tests against your Pull Requests.
+
+</Accordion>
+
+## What's next
+
+Now that you know how to build a backend with a database, you're ready to let your creativity flow and begin building your next great idea!
+
+We're excited to hear what you're going to build with Encore, join the pioneering developer community on [Discord](/discord) and share your story.
diff --git a/docs/go/tutorials/slack-bot.md b/docs/go/tutorials/slack-bot.md
new file mode 100644
index 0000000000..fae54573af
--- /dev/null
+++ b/docs/go/tutorials/slack-bot.md
@@ -0,0 +1,312 @@
+---
+seotitle: Tutorial – How to build a Slack bot
+seodesc: Learn how to build a Slack bot with Enore.go, and get it running in the cloud in just a few minutes.
+title: Building a Slack bot
+subtitle: Learn how to build a Slack bot with an Encore backend
+lang: go
+---
+
+In this tutorial you will create a Slack bot that brings the greatness of the `cowsay` utility to Slack!
+
+![Slack Cowsay](https://encore.dev/assets/docs/cowsay.png "Slack bot")
+
+This is the end result:
+<div className="not-prose mb-10">
+   <Editor projectName="slackBot" />
+</div>
+
+<Callout type="info">
+
+To make it easier to follow along, we've laid out a trail of croissants to guide your way.
+Whenever you see a 🥐 it means there's something for you to do.
+
+</Callout>
+
+## 1. Create your Encore application
+
+🥐 Create a new Encore application by running `encore app create` and select `Empty app` as the template.
+**Take a note of your app id, we'll need it in the next step.**
+
+## 2. Create a Slack app
+
+🥐 The first step is to create a new Slack app:
+
+1. Head over to [Slack's API site](https://api.slack.com/apps) and create a new app.
+2. When prompted, choose to create the app **from an app manifest**.
+3. Choose a workspace to install the app in.
+
+🥐 Enter the following manifest (replace `$APP_ID` in the URL below with your app id from above):
+
+```yaml
+_metadata:
+  major_version: 1
+display_information:
+  name: Encore Bot
+  description: Cowsay for the cloud age.
+features:
+  slash_commands:
+    - command: /cowsay
+      # Replace $APP_ID below
+      url: https://staging-$APP_ID.encr.app/cowsay
+      description: Say things with a flair!
+      usage_hint: your message here
+      should_escape: false
+  bot_user:
+    display_name: encore-bot
+    always_online: true
+oauth_config:
+  scopes:
+    bot:
+      - commands
+      - chat:write
+      - chat:write.public
+settings:
+  org_deploy_enabled: false
+  socket_mode_enabled: false
+  token_rotation_enabled: false
+```
+
+Once created, we're ready to move on with implementing our Encore endpoint!
+
+## 3. Implement the Slack endpoint
+
+Since Slack sends custom HTTP headers that we need to pay attention to, we're going to
+use a raw endpoint in Encore. For more information on this check out Slack's documentation
+on [Enabling interactivity with Slash Commands](https://api.slack.com/interactivity/slash-commands).
+
+🥐 In your Encore app, create a new directory named `slack` and create a file `slack/slack.go` with the following contents:
+
+```go
+-- slack/slack.go --
+// Service slack implements a cowsaw Slack bot.
+package slack
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+)
+
+// cowart is the formatting string for printing the cow art.
+const cowart = "Moo! %s"
+
+//encore:api public raw path=/cowsay
+func Cowsay(w http.ResponseWriter, req *http.Request) {
+	text := req.FormValue("text")
+	data, _ := json.Marshal(map[string]string{
+		"response_type": "in_channel",
+		"text":          fmt.Sprintf(cowart, text),
+	})
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(200)
+	w.Write(data)
+}
+```
+
+Let's try it out locally.
+
+🥐 Start your app with `encore run` and then call it in another terminal:
+
+```shell
+$ curl http://localhost:4000/cowsay -d 'text=Eat your greens!'
+{"response_type":"in_channel","text":"Moo! Eat your greens!"}
+```
+
+Looks great!
+
+🥐 Next, let's deploy it to the cloud:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Once deployed, we're ready to try our Slack command!
+
+🥐 Head over to the workspace you installed the app in and run `/cowsay Hello there`.
+You should see something like this:
+
+![Cowsay](https://encore.dev/assets/docs/cowsay-wip.png "Cowsay (Work in Progress)")
+
+And just like that we have a fully working Slack integration.
+
+## 4. Secure the webhook endpoint
+
+In order to get up and running quickly we ignored one important aspect for a production-ready Slack app:
+verifying that the webhook requests are actually coming from Slack. Let's do that now!
+
+The Slack documentation covers this really well on the [Verifying requests from Slack](https://api.slack.com/authentication/verifying-requests-from-slack) page.
+
+In short, what we need to do is:
+
+1. Save a shared secret that Slack provides us
+2. Use the secret to verify that the request comes from Slack, using HMAC (Hash-based Message Authentication Code).
+
+### Save the shared secret
+
+Let's define a secret using Encore's secrets management functionality.
+
+🥐 Add this to your `slack.go` file:
+
+```go
+-- slack/slack.go --
+var secrets struct {
+	SlackSigningSecret string
+}
+```
+
+🥐 Head over to the configuration section for your Slack app (go to [Your Apps](https://api.slack.com/apps) &rarr; select your app &rarr; Basic Information).
+
+🥐 Copy the **Signing Secret** and then run `encore secret set --type prod SlackSigningSecret` and paste the secret.
+
+🥐 For development you will also want to set `encore secret set --type dev,local,pr SlackSigningSecret`.
+You can use the same secret value or a placeholder value.
+
+### Compute the HMAC
+
+Go makes computing HMAC very straightforward, but it's still a fair amount of code.
+
+🥐 Add a few more imports to your file, so that it reads:
+
+```go
+-- slack/slack.go --
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io/ioutil"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"encore.dev/beta/errs"
+	"encore.dev/rlog"
+)
+```
+
+🥐 Next, we'll add the `verifyRequest` function:
+
+```go
+-- slack/slack.go --
+// verifyRequest verifies that a request is coming from Slack.
+func verifyRequest(req *http.Request) (body []byte, err error) {
+	eb := errs.B().Code(errs.InvalidArgument)
+	body, err = ioutil.ReadAll(req.Body)
+	if err != nil {
+		return nil, eb.Cause(err).Err()
+	}
+
+	// Compare timestamps to prevent replay attack
+	ts := req.Header.Get("X-Slack-Request-Timestamp")
+	threshold := int64(5 * 60)
+	n, _ := strconv.ParseInt(ts, 10, 64)
+	if diff := time.Now().Unix() - n; diff > threshold || diff < -threshold {
+		return body, eb.Msg("message not recent").Err()
+	}
+
+	// Compare HMAC signature
+	sig := req.Header.Get("X-Slack-Signature")
+	prefix := "v0="
+	if !strings.HasPrefix(sig, prefix) {
+		return body, eb.Msg("invalid signature").Err()
+	}
+	gotMac, _ := hex.DecodeString(sig[len(prefix):])
+
+	mac := hmac.New(sha256.New, []byte(secrets.SlackSigningSecret))
+	fmt.Fprintf(mac, "v0:%s:", ts)
+	mac.Write(body)
+	expectedMac := mac.Sum(nil)
+	if !hmac.Equal(gotMac, expectedMac) {
+		return body, eb.Msg("bad mac").Err()
+	}
+	return body, nil
+}
+```
+
+<Callout type="info">
+
+As you can see, this function needs to consume the whole HTTP body in order to compute the HMAC.
+
+This breaks the use of `req.FormValue("text")` that we used earlier, since it relies on reading the HTTP body. That's the reason we're returning the body from `verifyRequest`, so that we can parse the form values from that directly instead.
+
+</Callout>
+
+We're now ready to verify the signature.
+
+🥐 Update the `Cowsay` function to look like this:
+
+```go
+-- slack/slack.go --
+//encore:api public raw path=/cowsay
+func Cowsay(w http.ResponseWriter, req *http.Request) {
+	body, err := verifyRequest(req)
+	if err != nil {
+		errs.HTTPError(w, err)
+		return
+	}
+	q, _ := url.ParseQuery(string(body))
+	text := q.Get("text")
+	data, _ := json.Marshal(map[string]string{
+		"response_type": "in_channel",
+		"text":          fmt.Sprintf(cowart, text),
+	})
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(200)
+	w.Write(data)
+}
+```
+
+## 5. Put it all together and deploy
+
+Finally we're ready to put it all together.
+
+🥐 Add the `cowart` like so:
+
+```go
+-- slack/slack.go --
+const cowart = `
+ ________________________________________
+< %- 38s >
+ ----------------------------------------
+        \   ^__^
+         \  (oo)\_______
+            (__)\       )\/\
+                ||----w |
+                ||     ||
+`
+```
+
+🥐 Finally, let's commit our changes and deploy it:
+
+```shell
+$ git add -A .
+$ git commit -m 'Verify webhook requests and improve art'
+$ git push encore
+```
+
+🥐 Once deployed, head back to Slack and run `/cowsay Hello there`.
+
+If everything is set up correctly, you should see:
+
+![Slack Cowsay](https://encore.dev/assets/docs/cowsay.png "Slack bot")
+
+And there we go, a production-ready Slack bot in less than 100 lines of code.
+
+Well done!
+
+### Celebrate with fireworks
+
+Now that your app is running in the cloud, let's celebrate with some fireworks:
+
+🥐 In the Cloud Dashboard, open the Command Menu by pressing **Cmd + K** (Mac) or **Ctrl + K** (Windows/Linux).
+
+_From here you can easily access all Cloud Dashboard features and for example jump straight to specific services in the Service Catalog or view Traces for specific endpoints._
+
+🥐 Type `fireworks` in the Command Menu and press enter. Sit back and enjoy the show!
+
+![Fireworks](/assets/docs/fireworks.jpg)
diff --git a/docs/go/tutorials/uptime.md b/docs/go/tutorials/uptime.md
new file mode 100644
index 0000000000..f4384479af
--- /dev/null
+++ b/docs/go/tutorials/uptime.md
@@ -0,0 +1,955 @@
+---
+title: Building an Uptime Monitor
+subtitle: Learn how to build an event-driven uptime monitoring system
+seotitle: How to build an event-driven Uptime Monitoring System using Encore.go
+seodesc: Learn how to build an event-driven uptime monitoring tool using Go and Encore. Get your application running in the cloud in 30 minutes!
+lang: go
+---
+
+Want to be notified when your website goes down so you can fix it before your users notice?
+
+You need an uptime monitoring system. Sounds daunting? Don't worry,
+we'll build it with Encore in 30 minutes!
+
+The app will use an event-driven architecture and the final result will look like this:
+
+<img className="w-full h-auto" src="/assets/tutorials/uptime/frontend.png" title="Frontend" />
+
+<div className="not-prose my-10">
+   <Editor projectName="uptime" />
+</div>
+
+## 1. Create your Encore application
+
+<Callout type="info">
+
+To make it easier to follow along, we've laid out a trail of croissants to guide your way.
+Whenever you see a 🥐 it means there's something for you to do.
+
+</Callout>
+
+🥐 Create a new Encore application, using this tutorial project's starting-point branch. This gives you a ready-to-go frontend to use.
+
+```shell
+$ encore app create uptime --example=github.com/encoredev/example-app-uptime/tree/starting-point
+```
+
+If this is the first time you're using Encore, you'll be asked if you wish to create a free account. This is needed when you want Encore to manage functionality like secrets and handle cloud deployments (which we'll use later on in the tutorial).
+
+When we're done we'll have a backend with an event-driven architecture, as seen below in the [automatically generated diagram](/docs/go/observability/encore-flow) where white boxes are services and black boxes are Pub/Sub topics:
+
+<img className="w-full h-auto" src="/assets/tutorials/uptime/encore-flow.png" title="Encore Flow" />
+
+## 2. Create monitor service
+
+Let's start by creating the functionality to check if a website is currently up or down.
+Later we'll store this result in a database so we can detect when the status changes and
+send alerts.
+
+🥐 Create an Encore service named `monitor` containing a file named `ping.go`.
+
+```shell
+$ mkdir monitor
+$ touch monitor/ping.go
+```
+
+🥐 Add an Encore API endpoint named `Ping` that takes a URL as input and returns a response
+indicating whether the site is up or down.
+
+```go
+-- monitor/ping.go --
+// Service monitor checks if a website is up or down.
+package monitor
+
+import (
+	"context"
+	"net/http"
+	"strings"
+)
+
+// PingResponse is the response from the Ping endpoint.
+type PingResponse struct {
+	Up bool `json:"up"`
+}
+
+// Ping pings a specific site and determines whether it's up or down right now.
+//
+//encore:api public path=/ping/*url
+func Ping(ctx context.Context, url string) (*PingResponse, error) {
+    // If the url does not start with "http:" or "https:", default to "https:".
+	if !strings.HasPrefix(url, "http:") && !strings.HasPrefix(url, "https:") {
+		url = "https://" + url
+	}
+
+    // Make an HTTP request to check if it's up.
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return &PingResponse{Up: false}, nil
+	}
+	resp.Body.Close()
+
+    // 2xx and 3xx status codes are considered up
+    up := resp.StatusCode < 400
+    return &PingResponse{Up: up}, nil
+}
+```
+
+🥐 Let's try it! Run `encore run` in your terminal and you should see the service start up.
+
+Then open up the Local Development Dashboard at [http://localhost:9400](http://localhost:9400) and try calling the `monitor.ping` endpoint from the API Explorer, passing in `google.com` as the URL.
+
+You can then see the response, logs, and view a trace of the request. It will look like this:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/uptime_tut_1.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+If you prefer to use the terminal instead run `curl http://localhost:4000/ping/google.com` in
+a new terminal instead. Either way you should see the response:
+
+```json
+{"up": true}
+```
+
+You can also try with `httpstat.us/400` and `some-non-existing-url.com` and it should respond with `{"up": false}`.
+(It's always a good idea to test the negative case as well.)
+
+### Add a test
+
+🥐 Let's write an automated test so we don't break this endpoint over time. Create the file `monitor/ping_test.go`
+with the content:
+
+```go
+-- monitor/ping_test.go --
+package monitor
+
+import (
+	"context"
+	"testing"
+)
+
+func TestPing(t *testing.T) {
+	ctx := context.Background()
+	tests := []struct {
+		URL string
+		Up  bool
+	}{
+		{"encore.dev", true},
+		{"google.com", true},
+        // Test both with and without "https://"
+		{"httpbin.org/status/200", true},
+		{"https://httpbin.org/status/200", true},
+
+        // 4xx and 5xx should considered down.
+		{"httpbin.org/status/400", false},
+		{"https://httpbin.org/status/500", false},
+        // Invalid URLs should be considered down.
+		{"invalid://scheme", false},
+	}
+
+	for _, test := range tests {
+		resp, err := Ping(ctx, test.URL)
+		if err != nil {
+			t.Errorf("url %s: unexpected error: %v", test.URL, err)
+		} else if resp.Up != test.Up {
+			t.Errorf("url %s: got up=%v, want %v", test.URL, resp.Up, test.Up)
+		}
+	}
+}
+```
+
+🥐 Run `encore test ./...` to check that it all works as expected. You should see something like:
+
+```shell
+$ encore test ./...
+9:38AM INF starting request endpoint=Ping service=monitor test=TestPing
+9:38AM INF request completed code=ok duration=71.861792 endpoint=Ping http_code=200 service=monitor test=TestPing
+[... lots more lines ...]
+PASS
+ok      encore.app/monitor      1.660
+```
+
+And if you open the local development dashboard at [localhost:9400](http://localhost:9400), you can also see traces for the tests.
+
+## 3. Create site service
+
+Next, we want to keep track of a list of websites to monitor.
+
+Since most of these APIs will be simple "CRUD" (Create/Read/Update/Delete) endpoints, let's build this service using [GORM](https://gorm.io/), an ORM
+library that makes building CRUD endpoints really simple.
+
+🥐 Let's create a new service named `site` with a SQL database. To do so, create a new directory `site` in the application root with `migrations` folder inside that folder:
+
+```shell
+$ mkdir site
+$ mkdir site/migrations
+```
+
+🥐  Add a database migration file inside that folder, named `1_create_tables.up.sql`.
+The file name is important (it must look something like `1_<name>.up.sql`).
+
+Add the following contents:
+
+```sql
+-- site/migrations/1_create_tables.up.sql --
+CREATE TABLE sites (
+    id BIGSERIAL PRIMARY KEY,
+    url TEXT NOT NULL
+);
+```
+
+🥐 Next, install the GORM library and PostgreSQL driver:
+
+```shell
+$ go get -u gorm.io/gorm gorm.io/driver/postgres
+```
+
+Now let's create the `site` service itself. To do this we'll use Encore's support for [dependency injection](https://encore.dev/docs/go/how-to/dependency-injection) to inject the GORM database connection.
+
+🥐 Create `site/service.go` with the contents:
+
+```go
+-- site/service.go --
+// Service site keeps track of which sites to monitor.
+package site
+
+import (
+	"encore.dev/storage/sqldb"
+	"gorm.io/driver/postgres"
+	"gorm.io/gorm"
+)
+
+//encore:service
+type Service struct {
+	db *gorm.DB
+}
+
+// Define a database named 'site', using the database migrations
+// in the "./migrations" folder. Encore automatically provisions,
+// migrates, and connects to the database.
+var db = sqldb.NewDatabase("site", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+
+// initService initializes the site service.
+// It is automatically called by Encore on service startup.
+func initService() (*Service, error) {
+	db, err := gorm.Open(postgres.New(postgres.Config{
+		Conn: db.Stdlib(),
+	}))
+	if err != nil {
+		return nil, err
+	}
+	return &Service{db: db}, nil
+}
+```
+
+🥐 With that, we're now ready to create our CRUD endpoints. Create the following files:
+
+```go
+-- site/get.go --
+package site
+
+import "context"
+
+// Site describes a monitored site.
+type Site struct {
+	// ID is a unique ID for the site.
+	ID int `json:"id"`
+	// URL is the site's URL.
+	URL string `json:"url"`
+}
+
+// Get gets a site by id.
+//
+//encore:api public method=GET path=/site/:siteID
+func (s *Service) Get(ctx context.Context, siteID int) (*Site, error) {
+	var site Site
+	if err := s.db.Where("id = $1", siteID).First(&site).Error; err != nil {
+		return nil, err
+	}
+	return &site, nil
+}
+-- site/add.go --
+package site
+
+import "context"
+
+// AddParams are the parameters for adding a site to be monitored.
+type AddParams struct {
+	// URL is the URL of the site. If it doesn't contain a scheme
+	// (like "http:" or "https:") it defaults to "https:".
+	URL string `json:"url"`
+}
+
+// Add adds a new site to the list of monitored websites.
+//
+//encore:api public method=POST path=/site
+func (s *Service) Add(ctx context.Context, p *AddParams) (*Site, error) {
+	site := &Site{URL: p.URL}
+	if err := s.db.Create(site).Error; err != nil {
+		return nil, err
+	}
+	return site, nil
+}
+-- site/list.go --
+package site
+
+import "context"
+
+type ListResponse struct {
+	// Sites is the list of monitored sites.
+	Sites []*Site `json:"sites"`
+}
+
+// List lists the monitored websites.
+//
+//encore:api public method=GET path=/site
+func (s *Service) List(ctx context.Context) (*ListResponse, error) {
+	var sites []*Site
+	if err := s.db.Find(&sites).Error; err != nil {
+		return nil, err
+	}
+	return &ListResponse{Sites: sites}, nil
+}
+-- site/delete.go --
+package site
+
+import "context"
+
+// Delete deletes a site by id.
+//
+//encore:api public method=DELETE path=/site/:siteID
+func (s *Service) Delete(ctx context.Context, siteID int) error {
+	return s.db.Delete(&Site{ID: siteID}).Error
+}
+```
+
+🥐 Now make sure you have [Docker](https://docker.com) installed and running, and then restart `encore run` to cause the `site` database to be created by Encore.
+
+You can verify that the database was created by looking at your application's Flow architecture diagram in the local development dashboard at [localhost:9400](http://localhost:9400), and then use the Service Catalog to call the `site.Add` endpoint:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/uptime_tut_2.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+Or you can call `site.Add` from the terminal:
+
+```shell
+$ curl -X POST 'http://localhost:4000/site' -d '{"url": "https://encore.dev"}'
+{
+  "id": 1,
+  "url": "https://encore.dev"
+}
+```
+
+## 4. Record uptime checks
+
+In order to notify when a website goes down or comes back up, we need to track the previous state it was in.
+
+🥐  To do so, let's add a database to the `monitor` service as well.
+Create the directory `monitor/migrations` and the file `monitor/migrations/1_create_tables.up.sql`:
+
+```sql
+-- monitor/migrations/1_create_tables.up.sql --
+CREATE TABLE checks (
+    id BIGSERIAL PRIMARY KEY,
+    site_id BIGINT NOT NULL,
+    up BOOLEAN NOT NULL,
+    checked_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
+```
+
+We'll insert a database row every time we check if a site is up.
+
+🥐 Add a new endpoint `Check` to the `monitor` service, that
+takes in a Site ID, pings the site, and inserts a database row
+in the `checks` table.
+
+For this service we'll use Encore's [`sqldb` package](https://encore.dev/docs/go/primitives/databases#querying-databases)
+instead of GORM (in order to showcase both approaches).
+
+```go
+-- monitor/check.go --
+package monitor
+
+import (
+	"context"
+
+	"encore.app/site"
+	"encore.dev/storage/sqldb"
+)
+
+// Check checks a single site.
+//
+//encore:api public method=POST path=/check/:siteID
+func Check(ctx context.Context, siteID int) error {
+	site, err := site.Get(ctx, siteID)
+	if err != nil {
+		return err
+	}
+	result, err := Ping(ctx, site.URL)
+	if err != nil {
+		return err
+	}
+	_, err = db.Exec(ctx, `
+		INSERT INTO checks (site_id, up, checked_at)
+		VALUES ($1, $2, NOW())
+	`, site.ID, result.Up)
+	return err
+}
+
+// Define a database named 'monitor', using the database migrations
+// in the "./migrations" folder. Encore automatically provisions,
+// migrates, and connects to the database.
+var db = sqldb.NewDatabase("monitor", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+```
+
+
+🥐 Restart `encore run` to cause the `monitor` database to be created.
+
+We can again verify that the database was created in the Flow diagram, and also see the dependency between the `monitor` service and the `site` service that we just added.
+
+We can then call the `monitor.Check` endpoint using the id `1` that we got in the last step, and view the trace where we see the database interactions.
+
+It will look something like this:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/uptime_tut_3.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+🥐 You can also inspect the database using `encore db shell <database-name>` to make sure everything worked:
+
+```shell
+$ encore db shell monitor
+psql (14.4, server 14.2)
+Type "help" for help.
+
+monitor=> SELECT * FROM checks;
+ id | site_id | up |          checked_at
+----+---------+----+-------------------------------
+  1 |       1 | t  | 2022-10-21 09:58:30.674265+00
+```
+
+If that's what you see, everything's working great!
+
+### Add a cron job to check all sites
+
+We now want to regularly check all the tracked sites so we can
+respond in case any of them go down.
+
+We'll create a new `CheckAll` API endpoint in the `monitor` service
+that will list all the tracked sites and check all of them.
+
+🥐 Let's extract some of the functionality we wrote for the
+`Check` endpoint into a separate function, like so:
+
+```go
+-- monitor/check.go --
+// Check checks a single site.
+//
+//encore:api public method=POST path=/check/:siteID
+func Check(ctx context.Context, siteID int) error {
+	site, err := site.Get(ctx, siteID)
+	if err != nil {
+		return err
+	}
+	return check(ctx, site)
+}
+
+func check(ctx context.Context, site *site.Site) error {
+	result, err := Ping(ctx, site.URL)
+	if err != nil {
+		return err
+	}
+	_, err = db.Exec(ctx, `
+		INSERT INTO checks (site_id, up, checked_at)
+		VALUES ($1, $2, NOW())
+	`, site.ID, result.Up)
+	return err
+}
+```
+
+Now we're ready to create our new `CheckAll` endpoint.
+
+🥐 Create the new `CheckAll` endpoint inside `monitor/check.go`:
+
+```go
+-- monitor/check.go --
+import "golang.org/x/sync/errgroup"
+
+// CheckAll checks all sites.
+//
+//encore:api public method=POST path=/checkall
+func CheckAll(ctx context.Context) error {
+	// Get all the tracked sites.
+	resp, err := site.List(ctx)
+	if err != nil {
+		return err
+	}
+
+	// Check up to 8 sites concurrently.
+	g, ctx := errgroup.WithContext(ctx)
+	g.SetLimit(8)
+	for _, site := range resp.Sites {
+		site := site // capture for closure
+		g.Go(func() error {
+			return check(ctx, site)
+		})
+	}
+	return g.Wait()
+}
+```
+
+This uses [an errgroup](https://pkg.go.dev/golang.org/x/sync/errgroup) to check up to 8 sites concurrently, aborting early if
+we encounter any error. (Note that a website being down is
+not treated as an error.)
+
+🥐 Run `go get golang.org/x/sync/errgroup` to install that dependency.
+
+🥐 Now that we have a `CheckAll` endpoint, define a [cron job](https://encore.dev/docs/go/primitives/cron-jobs) to automatically call it every 1 hour (since this is an example, we don't need to go too crazy and check every minute):
+
+```go
+-- monitor/check.go --
+import "encore.dev/cron"
+
+// Check all tracked sites every 1 hour.
+var _ = cron.NewJob("check-all", cron.JobConfig{
+	Title:    "Check all sites",
+	Endpoint: CheckAll,
+	Every:    1 * cron.Hour,
+})
+```
+
+<Callout type="info">
+
+Cron jobs are not triggered when running the application locally but work when deploying the application to a cloud environment.
+
+</Callout>
+
+The frontend needs a way to list all sites and display if they are up or down.
+
+🥐 Add a file in the `monitor` service and name it `status.go`. Add the following code:
+
+```go
+-- monitor/status.go --
+package monitor
+
+import (
+	"context"
+	"time"
+)
+
+// SiteStatus describes the current status of a site
+// and when it was last checked.
+type SiteStatus struct {
+	Up        bool      `json:"up"`
+	CheckedAt time.Time `json:"checked_at"`
+}
+
+// StatusResponse is the response type from the Status endpoint.
+type StatusResponse struct {
+	// Sites contains the current status of all sites,
+	// keyed by the site ID.
+	Sites map[int]SiteStatus `json:"sites"`
+}
+
+// Status checks the current up/down status of all monitored sites.
+//
+//encore:api public method=GET path=/status
+func Status(ctx context.Context) (*StatusResponse, error) {
+	rows, err := db.Query(ctx, `
+		SELECT DISTINCT ON (site_id) site_id, up, checked_at
+		FROM checks
+		ORDER BY site_id, checked_at DESC
+	`)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	result := make(map[int]SiteStatus)
+	for rows.Next() {
+		var siteID int
+		var status SiteStatus
+		if err := rows.Scan(&siteID, &status.Up, &status.CheckedAt); err != nil {
+			return nil, err
+		}
+		result[siteID] = status
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return &StatusResponse{Sites: result}, nil
+}
+```
+
+Now try visiting http://localhost:4000/frontend in your browser again. This time you should see a working frontend that lists all sites and their current status.
+
+## 5. Deploy
+
+To try out your uptime monitor for real, let's deploy it to the cloud.
+
+<Accordion>
+
+### Self-hosting
+
+Encore supports building Docker images directly from the CLI, which can then be self-hosted on your own infrastructure of choice.
+
+If your app is using infrastructure resources, such as SQL databases, Pub/Sub, or metrics, you will need to supply a [runtime configuration](/docs/go/self-host/configure-infra) your Docker image.
+
+🥐 Create a new file `infra-config.json` in the root of your project with the following contents:
+
+```json
+{
+   "$schema": "https://encore.dev/schemas/infra.schema.json",
+   "sql_servers": [
+      {
+         "host": "my-db-host:5432",
+         "databases": {
+            "monitor": {
+               "username": "my-db-owner",
+                "password": {"$env": "DB_PASSWORD"}
+            },
+            "site": {
+               "username": "my-db-owner",
+                "password": {"$env": "DB_PASSWORD"}
+            }
+         }
+      }
+   ]
+}
+```
+
+The values in this configuration are just examples, you will need to replace them with the correct values for your database.
+
+🥐 Build a Docker image by running `encore build docker uptime:v1.0`.
+
+This will compile your application using the host machine and then produce a Docker image containing the compiled application.
+
+🥐 Upload the Docker image to the cloud provider of your choice and run it.
+
+</Accordion>
+
+<Accordion>
+
+### Encore Cloud (free)
+
+Encore Cloud provides automated infrastructure and DevOps. Deploy to a free development environment or to your own cloud account on AWS or GCP.
+
+### Create account
+
+Before deploying with Encore Cloud, you need to have a free Encore Cloud account and link your app to the platform. If you already have an account, you can move on to the next step.
+
+If you don’t have an account, the simplest way to get set up is by running `encore app create` and selecting **Y** when prompted to create a new account. Once your account is set up, continue creating a new app, selecting the `empty app` template.
+
+After creating the app, copy your project files into the new app directory, ensuring that you do not replace the `encore.app` file (this file holds a unique id which links your app to the platform).
+
+### Commit changes
+
+Encore comes with built-in CI/CD, and the deployment process is as simple as a `git push`.
+(You can also integrate with GitHub to activate per Pull Request Preview Environments, learn more in the [CI/CD docs](/docs/platform/deploy/deploying).)
+
+🥐 Now, let's deploy your app to Encore's free development cloud by running:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Encore will now build and test your app, provision the needed infrastructure, and deploy your application to the cloud.
+
+After triggering the deployment, you will see a URL where you can view its progress in the [Encore Cloud dashboard](https://app.encore.cloud). It will look something like: `https://app.encore.cloud/$APP_ID/deploys/...`
+
+From the Cloud Dashboard you can also see metrics, trigger Cron Jobs, see traces, and later connect your own AWS or GCP account to use for deployment.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/uptime_tut_4.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+🥐 When the deploy has finished, you can try out your uptime monitor by going to `https://staging-$APP_ID.encr.app/frontend`.
+
+*You now have an Uptime Monitor running in the cloud, well done!*
+
+</Accordion>
+
+## 6. Publish Pub/Sub events when a site goes down
+
+Hold on, an uptime monitoring system isn't very useful if it doesn't
+actually notify you when a site goes down.
+
+To do so let's add a [Pub/Sub topic](https://encore.dev/docs/go/primitives/pubsub) on which we'll publish a message every time a site transitions from being up to being down, or vice versa.
+
+🥐 Define the topic using Encore's Pub/Sub package in a new file, `monitor/alerts.go`:
+
+```go
+-- monitor/alerts.go --
+package monitor
+
+import "encore.dev/pubsub"
+
+// TransitionEvent describes a transition of a monitored site
+// from up->down or from down->up.
+type TransitionEvent struct {
+	// Site is the monitored site in question.
+	Site *site.Site `json:"site"`
+	// Up specifies whether the site is now up or down (the new value).
+	Up bool `json:"up"`
+}
+
+// TransitionTopic is a pubsub topic with transition events for when a monitored site
+// transitions from up->down or from down->up.
+var TransitionTopic = pubsub.NewTopic[*TransitionEvent]("uptime-transition", pubsub.TopicConfig{
+	DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+```
+
+Now let's publish a message on the `TransitionTopic` if a site's up/down
+state differs from the previous measurement.
+
+🥐 Create a `getPreviousMeasurement` function to report the last up/down state:
+
+```go
+-- monitor/alerts.go --
+import (
+	"encore.dev/storage/sqldb"
+	"errors"
+	"context"
+)
+// getPreviousMeasurement reports whether the given site was
+// up or down in the previous measurement.
+func getPreviousMeasurement(ctx context.Context, siteID int) (up bool, err error) {
+	err = db.QueryRow(ctx, `
+		SELECT up FROM checks
+		WHERE site_id = $1
+		ORDER BY checked_at DESC
+		LIMIT 1
+	`, siteID).Scan(&up)
+
+	if errors.Is(err, sqldb.ErrNoRows) {
+		// There was no previous ping; treat this as if the site was up before
+		return true, nil
+	} else if err != nil {
+		return false, err
+	}
+	return up, nil
+}
+```
+
+🥐 Now add a function to conditionally publish a message if the up/down state differs:
+
+```go
+-- monitor/alerts.go --
+import "encore.app/site"
+
+func publishOnTransition(ctx context.Context, site *site.Site, isUp bool) error {
+	wasUp, err := getPreviousMeasurement(ctx, site.ID)
+	if err != nil {
+		return err
+	}
+	if isUp == wasUp {
+		// Nothing to do
+		return nil
+	}
+	_, err = TransitionTopic.Publish(ctx, &TransitionEvent{
+		Site: site,
+		Up:   isUp,
+	})
+	return err
+}
+```
+
+🥐 Finally modify the `check` function to call this function:
+
+```go
+-- monitor/check.go --
+func check(ctx context.Context, site *site.Site) error {
+	result, err := Ping(ctx, site.URL)
+	if err != nil {
+		return err
+	}
+
+	// Publish a Pub/Sub message if the site transitions
+	// from up->down or from down->up.
+	if err := publishOnTransition(ctx, site, result.Up); err != nil {
+		return err
+	}
+
+	_, err = db.Exec(ctx, `
+		INSERT INTO checks (site_id, up, checked_at)
+		VALUES ($1, $2, NOW())
+	`, site.ID, result.Up)
+	return err
+}
+```
+
+Now the monitoring system will publish messages on the `TransitionTopic`
+whenever a monitored site transitions from up->down or from down->up.
+It doesn't know or care who actually listens to these messages.
+
+The truth is right now nobody does. So let's fix that by adding
+a Pub/Sub subscriber that posts these events to Slack.
+
+## 7. Send Slack notifications when a site goes down
+
+🥐 Start by creating a Slack service containing the following:
+
+```go
+-- slack/slack.go --
+package slack
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+)
+
+type NotifyParams struct {
+	// Text is the Slack message text to send.
+	Text string `json:"text"`
+}
+
+// Notify sends a Slack message to a pre-configured channel using a
+// Slack Incoming Webhook (see https://api.slack.com/messaging/webhooks).
+//
+//encore:api private
+func Notify(ctx context.Context, p *NotifyParams) error {
+	reqBody, err := json.Marshal(p)
+	if err != nil {
+		return err
+	}
+	req, err := http.NewRequestWithContext(ctx, "POST", secrets.SlackWebhookURL, bytes.NewReader(reqBody))
+	if err != nil {
+		return err
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("notify slack: %s: %s", resp.Status, body)
+	}
+	return nil
+}
+
+var secrets struct {
+	// SlackWebhookURL defines the Slack webhook URL to send
+	// uptime notifications to.
+	SlackWebhookURL string
+}
+```
+
+🥐 Now go to a Slack community of your choice where you have the permission
+to create a new Incoming Webhook.
+
+🥐 Once you have the Webhook URL, set it as an Encore secret:
+
+```shell
+$ encore secret set --type dev,local,pr SlackWebhookURL
+Enter secret value: *****
+Successfully updated development secret SlackWebhookURL.
+```
+
+🥐 Test the `slack.Notify` endpoint by calling it via cURL:
+
+```shell
+$ curl 'http://localhost:4000/slack.Notify' -d '{"Text": "Testing Slack webhook"}'
+```
+You should see the *Testing Slack webhook* message appear in the Slack channel you designated for the webhook.
+
+🥐 When it works it's time to add a Pub/Sub subscriber to automatically notify Slack when a monitored site goes up or down. Add the following:
+
+```go
+-- slack/slack.go --
+import (
+	"encore.dev/pubsub"
+	"encore.app/monitor"
+)
+
+var _ = pubsub.NewSubscription(monitor.TransitionTopic, "slack-notification", pubsub.SubscriptionConfig[*monitor.TransitionEvent]{
+	Handler: func(ctx context.Context, event *monitor.TransitionEvent) error {
+		// Compose our message.
+		msg := fmt.Sprintf("*%s is down!*", event.Site.URL)
+		if event.Up {
+			msg = fmt.Sprintf("*%s is back up.*", event.Site.URL)
+		}
+
+		// Send the Slack notification.
+		return Notify(ctx, &NotifyParams{Text: msg})
+	},
+})
+```
+
+## 8. Deploy your finished Uptime Monitor
+
+Now you're ready to deploy your finished Uptime Monitor, complete with a Slack integration.
+
+<Accordion>
+
+### Self-hosting
+
+Because we have added more infrastructure to our app, we need to [update the configuration](/docs/go/self-host/configure-infra) in our `infra-config.json` to include the new Pub/Sub topic and subscription as well as how we should set the  `SlackWebhookURL` secret. 
+
+🥐 Update your `ìnfra-config.json` to reflect the new infrastructure.
+
+🥐 Build a Docker image by running `encore build docker uptime:v2.0`.
+
+🥐 Upload the Docker image to the cloud provider and run it.
+
+</Accordion>
+
+<Accordion>
+
+### Encore Cloud (free)
+
+🥐 As before, deploying your app to the cloud is as simple as running:
+
+```shell
+$ git add -A .
+$ git commit -m 'Add slack integration'
+$ git push encore
+```
+
+### Celebrate with fireworks
+
+Now that your app is running in the cloud, let's celebrate with some fireworks:
+
+🥐 In the Cloud Dashboard, open the Command Menu by pressing **Cmd + K** (Mac) or **Ctrl + K** (Windows/Linux).
+
+_From here you can easily access all Cloud Dashboard features and for example jump straight to specific services in the Service Catalog or view Traces for specific endpoints._
+
+🥐 Type `fireworks` in the Command Menu and press enter. Sit back and enjoy the show!
+
+![Fireworks](/assets/docs/fireworks.jpg)
+
+</Accordion>
+
+## Conclusion
+
+We've now built a fully functioning uptime monitoring system.
+
+If we may say so ourselves (and we may; it's our documentation after all)
+it's pretty remarkable how much we've accomplished in such little code:
+
+* We've built three different services (`site`, `monitor`, and `slack`)
+* We've added two databases (to the `site` and `monitor` services) for tracking monitored sites and the monitoring results
+* We've added a cron job for automatically checking the sites every hour
+* We've set up a Pub/Sub topic to decouple the monitoring system from the Slack notifications
+* We've added a Slack integration, using secrets to securely store the webhook URL, listening to a Pub/Sub subscription for up/down transition events
+
+All of this in just a bit over 300 lines of code. It's time to lean back
+and take a sip of your favorite beverage, safe in the knowledge you'll
+never be caught unaware of a website going down suddenly.
diff --git a/docs/menu.cue b/docs/menu.cue
new file mode 100644
index 0000000000..8ab16661ea
--- /dev/null
+++ b/docs/menu.cue
@@ -0,0 +1,1301 @@
+#Menu: #RootMenu | #SubMenu
+
+#RootMenu: {
+	kind: "rootmenu"
+	items: [...#MenuItem]
+}
+
+#SubMenu: {
+	kind: "submenu"
+	// Menu title to display when this submenu is active.
+	title: string
+
+	// ID for the submenu, used for tracking active menu in frontend.
+	id: string
+
+	// Additional presentation options for the menu item.
+	presentation?: #Presentation
+
+	back: {
+		// Text to display in the back button.
+		text: string
+
+		// Path to the page to navigate to when the back button is clicked.
+		path: string
+	}
+
+	items: [...#MenuItem]
+}
+
+// Represents an item in a menu.
+#MenuItem: #SectionMenuItem | #BasicMenuItem | #NavMenuItem | #AccordionMenuItem
+
+#SectionMenuItem: {
+	// Represents a menu section that can't be navigated to.
+	kind: "section"
+
+	// The text to display in the menu.
+	text: string
+
+	// Menu items to show for this section.
+	items: [...#MenuItem]
+}
+
+#BasicMenuItem: {
+	// Represents a basic page that can be navigated to.
+	kind: "basic"
+
+	// The text to display in the menu.
+	text: string
+
+	// The URL path to the page.
+	path: string
+
+	// The file to render when viewing this page.
+	file: string
+
+	// Inline menu to show when viewing this page.
+	inline_menu?: [...#MenuItem]
+
+	// hidden, if true, indicates the page exists but is hidden in the menu.
+	// It can be navigated to directly, and will be show as "next page"/"prev page"
+	// in the per-page navigation.
+	hidden?: true
+}
+
+#NavMenuItem: {
+	// Represents a page that can be navigated to, that has a menu
+	// that replaces the navigation when viewing this page.
+	kind: "nav"
+
+	// The text to display in the menu.
+	text: string
+
+	// The URL path to the page.
+	path: string
+
+	// The file to render when viewing this page.
+	file: string
+
+	// The items to display in the submenu.
+	submenu: #SubMenu
+
+	// Additional presentation options for the menu item.
+	presentation?: #Presentation
+}
+
+#Presentation: {
+	// Icon to display next to the menu item.
+	icon?: string
+	style: "card" | *"basic"
+}
+
+#AccordionMenuItem: {
+	kind: "accordion"
+	text: string
+	// If the accordion is open by default.
+	defaultExpanded: bool | *false
+
+	// The items to display in the accordion.
+	accordion: [...#MenuItem]
+}
+
+// The root object is a #RootMenu.
+#RootMenu
+{
+	items: [
+		{
+			kind:    "nav"
+			text:    "Encore.go"
+			path:    "/go"
+			file:    "go/overview"
+			submenu: #EncoreGO
+			presentation: {
+				icon:  "golang"
+				style: "card"
+			}
+		}, {
+			kind:    "nav"
+			text:    "Encore.ts"
+			path:    "/ts"
+			file:    "ts/overview"
+			submenu: #EncoreTS
+			presentation: {
+				icon:  "typescript"
+				style: "card"
+			}
+		}, {
+			kind:    "nav"
+			text:    "Encore Cloud"
+			path:    "/platform"
+			file:    "platform/overview"
+			submenu: #EncorePlatform
+			presentation: {
+				icon:  "typescript"
+				style: "card"
+			}
+		},
+	]
+}
+
+#EncoreGO: #SubMenu & {
+	title: "Encore.go"
+	id:    "go"
+	presentation: {
+		icon: "golang"
+	}
+	back: {
+		text: ""
+		path: ""
+	}
+	items: [
+		{
+			kind: "section"
+			text: "Get Started"
+			items: [{
+				kind: "basic"
+				text: "Installation"
+				path: "/go/install"
+				file: "go/install"
+			}, {
+				kind: "basic"
+				text: "Quick Start"
+				path: "/go/quick-start"
+				file: "go/quick-start"
+			}, {
+				kind: "basic"
+				text: "FAQ"
+				path: "/go/faq"
+				file: "go/faq"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Concepts"
+			items: [{
+				kind: "basic"
+				text: "Benefits"
+				path: "/go/concepts/benefits"
+				file: "go/concepts/benefits"
+			}, {
+				kind: "basic"
+				text: "Application Model"
+				path: "/go/concepts/application-model"
+				file: "go/concepts/application-model"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Tutorials"
+			items: [{
+				kind: "basic"
+				text: "Building a REST API"
+				path: "/go/tutorials/rest-api"
+				file: "go/tutorials/rest-api"
+			}, {
+				kind: "basic"
+				text: "Building an Uptime Monitor"
+				path: "/go/tutorials/uptime"
+				file: "go/tutorials/uptime"
+			}, {
+				kind: "basic"
+				text: "Building a GraphQL API"
+				path: "/go/tutorials/graphql"
+				file: "go/tutorials/graphql"
+			}, {
+				kind: "basic"
+				text: "Building a Slack bot"
+				path: "/go/tutorials/slack-bot"
+				file: "go/tutorials/slack-bot"
+			}, {
+				kind: "basic"
+				text: "Building a Meeting Notes app"
+				path: "/go/tutorials/meeting-notes"
+				file: "go/tutorials/meeting-notes"
+			}, {
+				kind: "basic"
+				text: "Building a Booking System"
+				path: "/go/tutorials/booking-system"
+				file: "go/tutorials/booking-system"
+			}, {
+				kind:   "basic"
+				text:   "Building an Incident Management tool"
+				path:   "/go/tutorials/incident-management-tool"
+				file:   "go/tutorials/incident-management-tool"
+				hidden: true
+			}]
+		},
+		{
+			kind: "section"
+			text: "Primitives"
+			items: [{
+				kind: "basic"
+				text: "App Structure"
+				path: "/go/primitives/app-structure"
+				file: "go/primitives/app-structure"
+			}, {
+				kind: "basic"
+				text: "Services"
+				path: "/go/primitives/services"
+				file: "go/primitives/services"
+			}, {
+				kind: "accordion"
+				text: "APIs"
+				accordion: [{
+					kind: "basic"
+					text: "Defining APIs"
+					path: "/go/primitives/defining-apis"
+					file: "go/primitives/defining-apis"
+				}, {
+					kind: "basic"
+					text: "API Calls"
+					path: "/go/primitives/api-calls"
+					file: "go/primitives/api-calls"
+				}, {
+					kind: "basic"
+					text: "Raw Endpoints"
+					path: "/go/primitives/raw-endpoints"
+					file: "go/primitives/raw-endpoints"
+				}, {
+					kind: "basic"
+					text: "Service Structs"
+					path: "/go/primitives/service-structs"
+					file: "go/primitives/service-structs"
+				}, {
+					kind: "basic"
+					text: "API Errors"
+					path: "/go/primitives/api-errors"
+					file: "go/primitives/api-errors"
+				}]
+			}, {
+				kind: "accordion"
+				text: "Databases"
+				accordion: [{
+					kind: "basic"
+					text: "Using SQL databases"
+					path: "/go/primitives/databases"
+					file: "go/primitives/databases"
+				}, {
+					kind: "basic"
+					text: "Change SQL database schema"
+					path: "/go/primitives/change-db-schema"
+					file: "go/primitives/change-db-schema"
+				}, {
+					kind: "basic"
+					text: "Integrate with existing databases"
+					path: "/go/primitives/connect-existing-db"
+					file: "go/primitives/connect-existing-db"
+				}, {
+					kind: "basic"
+					text: "Insert test data in a database"
+					path: "/go/primitives/insert-test-data-db"
+					file: "go/primitives/insert-test-data-db"
+				}, {
+					kind: "basic"
+					text: "Share databases between services"
+					path: "/go/primitives/share-db-between-services"
+					file: "go/primitives/share-db-between-services"
+				}, {
+					kind: "basic"
+					text: "PostgreSQL Extensions"
+					path: "/go/primitives/databases/extensions"
+					file: "go/primitives/database-extensions"
+				}, {
+					kind: "basic"
+					text: "Troubleshooting"
+					path: "/go/primitives/databases/troubleshooting"
+					file: "go/primitives/database-troubleshooting"
+				}]
+			}, {
+				kind: "basic"
+				text: "Object Storage"
+				path: "/go/primitives/object-storage"
+				file: "go/primitives/object-storage"
+			}, {
+				kind: "basic"
+				text: "Cron Jobs"
+				path: "/go/primitives/cron-jobs"
+				file: "go/primitives/cron-jobs"
+			}, {
+				kind: "basic"
+				text: "Pub/Sub"
+				path: "/go/primitives/pubsub"
+				file: "go/primitives/pubsub"
+			}, {
+				kind: "basic"
+				text: "Caching"
+				path: "/go/primitives/caching"
+				file: "go/primitives/caching"
+			}, {
+				kind: "basic"
+				text: "Secrets"
+				path: "/go/primitives/secrets"
+				file: "go/primitives/secrets"
+			}, {
+				kind: "basic"
+				text: "Code Snippets"
+				path: "/go/primitives/code-snippets"
+				file: "go/primitives/code-snippets"
+			}]
+		}, {
+			kind: "section"
+			text: "Development"
+			items: [{
+				kind: "basic"
+				text: "Authentication"
+				path: "/go/develop/auth"
+				file: "go/develop/auth"
+			}, {
+				kind: "basic"
+				text: "Configuration"
+				path: "/go/develop/config"
+				file: "go/develop/config"
+			}, {
+				kind: "basic"
+				text: "CORS"
+				path: "/go/develop/cors"
+				file: "go/develop/cors"
+			}, {
+				kind: "basic"
+				text: "Metadata"
+				path: "/go/develop/metadata"
+				file: "go/develop/metadata"
+			}, {
+				kind: "basic"
+				text: "Middleware"
+				path: "/go/develop/middleware"
+				file: "go/develop/middleware"
+			}, {
+				kind: "basic"
+				text: "Testing"
+				path: "/go/develop/testing"
+				file: "go/develop/testing"
+			}, {
+				kind: "basic"
+				text: "Mocking"
+				path: "/go/develop/testing/mocking"
+				file: "go/develop/mocking"
+			}, {
+				kind: "basic"
+				text: "Validation"
+				path: "/go/develop/validation"
+				file: "go/develop/validation"
+			}]
+		},
+		{
+			kind: "section"
+			text: "CLI"
+			items: [{
+				kind: "basic"
+				text: "CLI Reference"
+				path: "/go/cli/cli-reference"
+				file: "go/cli/cli-reference"
+			}, {
+				kind: "basic"
+				text: "Client Generation"
+				path: "/go/cli/client-generation"
+				file: "go/cli/client-generation"
+			}, {
+				kind: "basic"
+				text: "Infra Namespaces"
+				path: "/go/cli/infra-namespaces"
+				file: "go/cli/infra-namespaces"
+			}, {
+				kind: "basic"
+				text: "CLI Configuration"
+				path: "/go/cli/config-reference"
+				file: "go/cli/config-reference"
+			}, {
+				kind: "basic"
+				text: "Telemetry"
+				path: "/go/cli/telemetry"
+				file: "go/cli/telemetry"
+			}, {
+				kind: "basic"
+				text: "MCP"
+				path: "/go/cli/mcp"
+				file: "go/cli/mcp"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Observability"
+			items: [{
+				kind: "basic"
+				text: "Development Dashboard"
+				path: "/go/observability/dev-dash"
+				file: "go/observability/dev-dash"
+			}, {
+				kind: "basic"
+				text: "Distributed Tracing"
+				path: "/go/observability/tracing"
+				file: "go/observability/tracing"
+			}, {
+				kind: "basic"
+				text: "Flow Architecture Diagram"
+				path: "/go/observability/encore-flow"
+				file: "go/observability/encore-flow"
+			}, {
+				kind: "basic"
+				text: "Service Catalog"
+				path: "/go/observability/service-catalog"
+				file: "go/observability/service-catalog"
+			}, {
+				kind: "basic"
+				text: "Logging"
+				path: "/go/observability/logging"
+				file: "go/observability/logging"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Self Hosting"
+			items: [
+				{
+					kind: "basic"
+					text: "CI/CD"
+					path: "/go/self-host/ci-cd"
+					file: "go/self-host/ci-cd"
+				},
+				{
+					kind: "basic"
+					text: "Build Docker Images"
+					path: "/go/self-host/docker-build"
+					file: "go/self-host/self-host"
+				}, {
+					kind: "basic"
+					text: "Configure Infrastructure"
+					path: "/go/self-host/configure-infra"
+					file: "go/self-host/configure-infra"
+				}]
+		},
+		{
+			kind: "section"
+			text: "How to guides"
+			items: [{
+				kind: "basic"
+				text: "Break a monolith into microservices"
+				path: "/go/how-to/break-up-monolith"
+				file: "go/how-to/break-up-monolith"
+			}, {
+				kind: "basic"
+				text: "Integrate with a web frontend"
+				path: "/go/how-to/integrate-frontend"
+				file: "go/how-to/integrate-frontend"
+			}, {
+				kind: "basic"
+				text: "Use Temporal with Encore"
+				path: "/go/how-to/temporal"
+				file: "go/how-to/temporal"
+			}, {
+				kind: "basic"
+				text: "Build with cgo"
+				path: "/go/how-to/cgo"
+				file: "go/how-to/cgo"
+			}, {
+				kind: "basic"
+				text: "Debug with Delve"
+				path: "/go/how-to/debug"
+				file: "go/how-to/debug"
+			}, {
+				kind: "basic"
+				text: "Receive regular HTTP requests & Use websockets"
+				path: "/go/how-to/http-requests"
+				file: "go/how-to/http-requests"
+			}, {
+				kind: "basic"
+				text: "Use Atlas + GORM for database migrations"
+				path: "/go/how-to/atlas-gorm"
+				file: "go/how-to/atlas-gorm"
+			}, {
+				kind: "basic"
+				text: "Use the ent ORM for migrations"
+				path: "/go/how-to/entgo-orm"
+				file: "go/how-to/entgo-orm"
+			}, {
+				kind: "basic"
+				text: "Use Connect for gRPC communication"
+				path: "/go/how-to/grpc-connect"
+				file: "go/how-to/grpc-connect"
+			}, {
+				kind: "basic"
+				text: "Use a Pub/Sub Transactional Outbox"
+				path: "/go/how-to/pubsub-outbox"
+				file: "go/how-to/pubsub-outbox"
+			}, {
+				kind: "basic"
+				text: "Use Dependency Injection"
+				path: "/go/how-to/dependency-injection"
+				file: "go/how-to/dependency-injection"
+			}, {
+				kind: "basic"
+				text: "Use Auth0 Authentication"
+				path: "/go/how-to/auth0-auth"
+				file: "go/how-to/auth0-auth"
+			}, {
+				kind: "basic"
+				text: "Use Clerk Authentication"
+				path: "/go/how-to/clerk-auth"
+				file: "go/how-to/clerk-auth"
+			}, {
+				kind: "basic"
+				text: "Use Firebase Authentication"
+				path: "/go/how-to/firebase-auth"
+				file: "go/how-to/firebase-auth"
+			}, {
+				kind: "basic"
+				text: "Use Logto Authentication"
+				path: "/go/how-to/logto-auth"
+				file: "go/how-to/logto-auth"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Migration guides"
+			items: [{
+				kind: "basic"
+				text: "Migrate away from Encore"
+				path: "/go/migration/migrate-away"
+				file: "go/migration/migrate-away"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Community"
+			items: [{
+				kind: "basic"
+				text: "Get Involved"
+				path: "/go/community/get-involved"
+				file: "go/community/get-involved"
+			}, {
+				kind: "basic"
+				text: "Contribute"
+				path: "/go/community/contribute"
+				file: "go/community/contribute"
+			}, {
+				kind: "basic"
+				text: "Open Source"
+				path: "/go/community/open-source"
+				file: "go/community/open-source"
+			}, {
+				kind: "basic"
+				text: "Principles"
+				path: "/go/community/principles"
+				file: "go/community/principles"
+			}, {
+				kind: "basic"
+				text: "Submit Template"
+				path: "/go/community/submit-template"
+				file: "go/community/submit-template"
+			}]
+		},
+	]
+}
+
+#EncoreTS: #SubMenu & {
+	title: "Encore.ts"
+	id:    "ts"
+	presentation: {
+		icon: "typescript"
+	}
+	back: {
+		text: ""
+		path: ""
+	}
+	items: [
+		{
+			kind: "section"
+			text: "Get started"
+			items: [{
+				kind: "basic"
+				text: "Installation"
+				path: "/ts/install"
+				file: "ts/install"
+			}, {
+				kind: "basic"
+				text: "Quick Start"
+				path: "/ts/quick-start"
+				file: "ts/quick-start"
+			}, {
+				kind: "basic"
+				text: "FAQ"
+				path: "/ts/faq"
+				file: "ts/faq"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Concepts"
+			items: [{
+				kind: "basic"
+				text: "Benefits"
+				path: "/ts/concepts/benefits"
+				file: "ts/concepts/benefits"
+			}, {
+				kind: "basic"
+				text: "Application Model"
+				path: "/ts/concepts/application-model"
+				file: "ts/concepts/application-model"
+			}, {
+				kind: "basic"
+				text: "Hello World"
+				path: "/ts/concepts/hello-world"
+				file: "ts/concepts/hello-world"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Tutorials"
+			items: [{
+				kind: "basic"
+				text: "Building a REST API"
+				path: "/ts/tutorials/rest-api"
+				file: "ts/tutorials/rest-api"
+			}, {
+				kind: "basic"
+				text: "Building an Uptime Monitor"
+				path: "/ts/tutorials/uptime"
+				file: "ts/tutorials/uptime"
+			}, {
+				kind: "basic"
+				text: "Building a GraphQL API"
+				path: "/ts/tutorials/graphql"
+				file: "ts/tutorials/graphql"
+			}, {
+				kind: "basic"
+				text: "Building a Slack bot"
+				path: "/ts/tutorials/slack-bot"
+				file: "ts/tutorials/slack-bot"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Primitives"
+			items: [{
+				kind: "basic"
+				text: "App Structure"
+				path: "/ts/primitives/app-structure"
+				file: "ts/primitives/app-structure"
+			}, {
+				kind: "basic"
+				text: "Services"
+				path: "/ts/primitives/services"
+				file: "ts/primitives/services"
+			}, {
+				kind: "accordion"
+				text: "APIs"
+				accordion: [{
+					kind: "basic"
+					text: "Defining APIs"
+					path: "/ts/primitives/defining-apis"
+					file: "ts/primitives/defining-apis"
+				}, {
+					kind: "basic"
+					text: "Validation"
+					path: "/ts/primitives/validation"
+					file: "ts/primitives/validation"
+				}, {
+					kind: "basic"
+					text: "API Calls"
+					path: "/ts/primitives/api-calls"
+					file: "ts/primitives/api-calls"
+				}, {
+					kind: "basic"
+					text: "Raw Endpoints"
+					path: "/ts/primitives/raw-endpoints"
+					file: "ts/primitives/raw-endpoints"
+				}, {
+					kind: "basic"
+					text: "GraphQL"
+					path: "/ts/primitives/graphql"
+					file: "ts/primitives/graphql"
+				}, {
+					kind: "basic"
+					text: "Streaming APIs"
+					path: "/ts/primitives/streaming-apis"
+					file: "ts/primitives/streaming-apis"
+				}, {
+					kind: "basic"
+					text: "API Errors"
+					path: "/ts/primitives/errors"
+					file: "ts/primitives/errors"
+				}, {
+					kind: "basic"
+					text: "Static Assets"
+					path: "/ts/primitives/static-assets"
+					file: "ts/primitives/static-assets"
+				}, {
+					kind: "basic"
+					text: "Cookies"
+					path: "/ts/primitives/cookies"
+					file: "ts/primitives/cookies"
+				}]
+			}, {
+				kind: "basic"
+				text: "Databases"
+				path: "/ts/primitives/databases"
+				file: "ts/primitives/databases"
+			}, {
+				kind: "basic"
+				text: "PostgreSQL Extensions"
+				path: "/ts/primitives/databases-extensions"
+				file: "ts/primitives/database-extensions"
+			}, {
+				kind: "basic"
+				text: "Object Storage"
+				path: "/ts/primitives/object-storage"
+				file: "ts/primitives/object-storage"
+			}, {
+				kind: "basic"
+				text: "Cron Jobs"
+				path: "/ts/primitives/cron-jobs"
+				file: "ts/primitives/cron-jobs"
+			}, {
+				kind: "basic"
+				text: "Pub/Sub"
+				path: "/ts/primitives/pubsub"
+				file: "ts/primitives/pubsub"
+			}, {
+				kind: "basic"
+				text: "Secrets"
+				path: "/ts/primitives/secrets"
+				file: "ts/primitives/secrets"
+			}]
+		}, {
+			kind: "section"
+			text: "Development"
+			items: [{
+				kind: "basic"
+				text: "Authentication"
+				path: "/ts/develop/auth"
+				file: "ts/develop/auth"
+			}, {
+				kind: "accordion"
+				text: "ORMs"
+				accordion: [{
+					kind: "basic"
+					text: "Overview"
+					path: "/ts/develop/orms"
+					file: "ts/develop/orms/overview"
+				}, {
+					kind: "basic"
+					text: "Knex.js"
+					path: "/ts/develop/orms/knex"
+					file: "ts/develop/orms/knex"
+				}, {
+					kind: "basic"
+					text: "Prisma"
+					path: "/ts/develop/orms/prisma"
+					file: "ts/develop/orms/prisma"
+				}, {
+					kind: "basic"
+					text: "Drizzle"
+					path: "/ts/develop/orms/drizzle"
+					file: "ts/develop/orms/drizzle"
+				}, {
+					kind: "basic"
+					text: "Sequelize"
+					path: "/ts/develop/orms/sequelize"
+					file: "ts/develop/orms/sequelize"
+				}]
+			}, {
+				kind: "basic"
+				text: "Metadata"
+				path: "/ts/develop/metadata"
+				file: "ts/develop/metadata"
+			}, {
+				kind: "basic"
+				text: "Testing"
+				path: "/ts/develop/testing"
+				file: "ts/develop/testing"
+			}, {
+				kind: "basic"
+				text: "Debugging"
+				path: "/ts/develop/debug"
+				file: "ts/develop/debug"
+			}, {
+				kind: "basic"
+				text: "Middleware"
+				path: "/ts/develop/middleware"
+				file: "ts/develop/middleware"
+			}, {
+				kind: "basic"
+				text: "Multithreading"
+				path: "/ts/develop/multithreading"
+				file: "ts/develop/multithreading"
+			},{
+				kind: "basic"
+				text: "Running Scripts"
+				path: "/ts/develop/running-scripts"
+				file: "ts/develop/running-scripts"
+			}]
+		},
+		{
+			kind: "section"
+			text: "CLI"
+			items: [{
+				kind: "basic"
+				text: "CLI Reference"
+				path: "/ts/cli/cli-reference"
+				file: "ts/cli/cli-reference"
+			}, {
+				kind: "basic"
+				text: "Client Generation"
+				path: "/ts/cli/client-generation"
+				file: "ts/cli/client-generation"
+			}, {
+				kind: "basic"
+				text: "Infra Namespaces"
+				path: "/ts/cli/infra-namespaces"
+				file: "ts/cli/infra-namespaces"
+			}, {
+				kind: "basic"
+				text: "CLI Configuration"
+				path: "/ts/cli/config-reference"
+				file: "ts/cli/config-reference"
+			}, {
+				kind: "basic"
+				text: "Telemetry"
+				path: "/ts/cli/telemetry"
+				file: "ts/cli/telemetry"
+			}, {
+				kind: "basic"
+				text: "MCP"
+				path: "/ts/cli/mcp"
+				file: "ts/cli/mcp"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Frontend"
+			items: [{
+				kind: "basic"
+				text: "Hosting"
+				path: "/ts/frontend/hosting"
+				file: "ts/frontend/hosting"
+			}, {
+				kind: "basic"
+				text: "CORS"
+				path: "/ts/frontend/cors"
+				file: "ts/frontend/cors"
+			}, {
+				kind: "basic"
+				text: "Request Client"
+				path: "/ts/frontend/request-client"
+				file: "ts/frontend/request-client"
+			}, {
+				kind: "basic"
+				text: "Template Engine"
+				path: "/ts/frontend/template-engine"
+				file: "ts/frontend/template-engine"
+			}, {
+				kind: "basic"
+				text: "Mono vs Multi Repo"
+				path: "/ts/frontend/mono-vs-multi-repo"
+				file: "ts/frontend/mono-vs-multi-repo"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Observability"
+			items: [{
+				kind: "basic"
+				text: "Development Dashboard"
+				path: "/ts/observability/dev-dash"
+				file: "ts/observability/dev-dash"
+			}, {
+				kind: "basic"
+				text: "Logging"
+				path: "/ts/observability/logging"
+				file: "ts/observability/logging"
+			}, {
+				kind: "basic"
+				text: "Distributed Tracing"
+				path: "/ts/observability/tracing"
+				file: "ts/observability/tracing"
+			}, {
+				kind: "basic"
+				text: "Flow Architecture Diagram"
+				path: "/ts/observability/flow"
+				file: "ts/observability/flow"
+			}, {
+				kind: "basic"
+				text: "Service Catalog"
+				path: "/ts/observability/service-catalog"
+				file: "ts/observability/service-catalog"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Self Hosting"
+			items: [
+				{
+					kind: "basic"
+					text: "CI/CD"
+					path: "/ts/self-host/ci-cd"
+					file: "ts/self-host/ci-cd"
+				},
+				{
+					kind: "basic"
+					text: "Build Docker Images"
+					path: "/ts/self-host/build"
+					file: "ts/self-host/build"
+				}, {
+					kind: "basic"
+					text: "Configure Infrastructure"
+					path: "/ts/self-host/configure-infra"
+					file: "ts/self-host/configure-infra"
+				}, {
+					kind: "basic"
+					text: "Deploy to DigitalOcean"
+					path: "/ts/self-host/deploy-digitalocean"
+					file: "ts/self-host/deploy-to-digital-ocean"
+				}, {
+					kind: "basic"
+					text: "Deploy to Railway"
+					path: "/ts/self-host/deploy-railway"
+					file: "ts/self-host/deploy-to-railway"
+				}]
+		},
+		{
+			kind: "section"
+			text: "How to guides"
+			items: [{
+				kind: "basic"
+				text: "Handle file uploads"
+				path: "/ts/how-to/file-uploads"
+				file: "ts/how-to/file-uploads"
+			}, {
+				kind: "basic"
+				text: "Use NestJS with Encore"
+				path: "/ts/how-to/nestjs"
+				file: "ts/how-to/nestjs"
+			}]
+		}, {
+			kind: "section"
+			text: "Migration guides"
+			items: [{
+				kind: "basic"
+				text: "Migrate away from Encore"
+				path: "/ts/migration/migrate-away"
+				file: "ts/migration/migrate-away"
+			}, {
+				kind: "basic"
+				text: "Migrate from Express.js"
+				path: "/ts/migration/express-migration"
+				file: "ts/migration/express-migration"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Community"
+			items: [{
+				kind: "basic"
+				text: "Get Involved"
+				path: "/ts/community/get-involved"
+				file: "ts/community/get-involved"
+			}, {
+				kind: "basic"
+				text: "Contribute"
+				path: "/ts/community/contribute"
+				file: "ts/community/contribute"
+			}, {
+				kind: "basic"
+				text: "Open Source"
+				path: "/ts/community/open-source"
+				file: "ts/community/open-source"
+			}, {
+				kind: "basic"
+				text: "Principles"
+				path: "/ts/community/principles"
+				file: "ts/community/principles"
+			}, {
+				kind: "basic"
+				text: "Submit Template"
+				path: "/ts/community/submit-template"
+				file: "ts/community/submit-template"
+			}]
+		},
+	]
+}
+
+#EncorePlatform: #SubMenu & {
+	title: "Encore Cloud"
+	id:    "platform"
+	presentation: {
+		icon: ""
+	}
+	back: {
+		text: ""
+		path: ""
+	}
+	items: [
+		{
+			kind: "section"
+			text: "Concepts"
+			items: [{
+				kind: "basic"
+				text: "Introduction"
+				path: "/platform/introduction"
+				file: "platform/introduction"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Deployment"
+			items: [{
+				kind: "basic"
+				text: "Deploying & CI/CD"
+				path: "/platform/deploy/deploying"
+				file: "platform/deploy/deploying"
+			}, {
+				kind: "basic"
+				text: "Connect your cloud account"
+				path: "/platform/deploy/own-cloud"
+				file: "platform/deploy/own-cloud"
+			}, {
+				kind: "basic"
+				text: "Environments"
+				path: "/platform/deploy/environments"
+				file: "platform/deploy/environments"
+			}, {
+				kind: "basic"
+				text: "Preview Environments"
+				path: "/platform/deploy/preview-environments"
+				file: "platform/deploy/preview-environments"
+			}, {
+				kind: "basic"
+				text: "Application Security"
+				path: "/platform/deploy/security"
+				file: "platform/deploy/security"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Infrastructure"
+			items: [{
+				kind: "basic"
+				text: "Provisioning & Environments"
+				path: "/platform/infrastructure/infra"
+				file: "platform/infrastructure/infra"
+			}, {
+				kind: "basic"
+				text: "Infrastructure Configuration"
+				path: "/platform/infrastructure/configuration"
+				file: "platform/infrastructure/configuration"
+			},
+			{
+				kind: "accordion"
+				text: "GCP Infrastructure"
+				accordion: [{
+					kind: "basic"
+					text: "Overview"
+					path: "/platform/infrastructure/gcp"
+					file: "platform/infrastructure/gcp"
+				}, {
+					kind: "basic"
+					text: "Import Cloud SQL"
+					path: "/platform/infrastructure/gcp/import-cloud-sql"
+					file: "platform/infrastructure/import-cloud-sql"
+				}, {
+					kind: "basic"
+					text: "Import Project"
+					path: "/platform/infrastructure/gcp/import-project"
+					file: "platform/infrastructure/import-project"
+				}, {
+					kind: "basic"
+					text: "Configure Network"
+					path: "/platform/infrastructure/configure-network"
+					file: "platform/infrastructure/configure-network"
+				}]
+			}, {
+				kind: "accordion"
+				text: "AWS Infrastructure"
+				accordion: [{
+					kind: "basic"
+					text: "Overview"
+					path: "/platform/infrastructure/aws"
+					file: "platform/infrastructure/aws"
+				},{
+					kind: "basic"
+					text: "Import RDS Database"
+					path: "/platform/infrastructure/aws/import-rds"
+					file: "platform/infrastructure/import-rds"
+				}, {
+					kind: "basic"
+					text: "Configure Network"
+					path: "/platform/infrastructure/configure-network"
+					file: "platform/infrastructure/configure-network"
+				}]
+			}, {
+				kind: "accordion"
+				text: "Kubernetes deployment"
+				accordion: [{
+					kind: "basic"
+					text: "Deploying to a new cluster"
+					path: "/platform/infrastructure/kubernetes"
+					file: "platform/infrastructure/kubernetes"
+				}, {
+					kind: "basic"
+					text: "Import an existing cluster"
+					path: "/platform/infrastructure/import-kubernetes-cluster"
+					file: "platform/infrastructure/import-kubernetes-cluster"
+				}, {
+					kind: "basic"
+					text: "Configure kubectl"
+					path: "/platform/infrastructure/configure-kubectl"
+					file: "platform/infrastructure/configure-kubectl"
+				}]
+			}, {
+				kind: "basic"
+				text: "Neon Postgres"
+				path: "/platform/infrastructure/neon"
+				file: "platform/infrastructure/neon"
+			}, {
+				kind: "basic"
+				text: "Cloudflare R2"
+				path: "/platform/infrastructure/cloudflare"
+				file: "platform/infrastructure/cloudflare"
+			}, {
+				kind: "basic"
+				text: "Managing database users"
+				path: "/platform/infrastructure/manage-db-users"
+				file: "platform/infrastructure/manage-db-users"
+			}]
+		}, {
+			kind: "section"
+			text: "Observability"
+			items: [{
+				kind: "basic"
+				text: "Metrics"
+				path: "/platform/observability/metrics"
+				file: "platform/observability/metrics"
+			}, {
+				kind: "basic"
+				text: "Distributed Tracing"
+				path: "/platform/observability/tracing"
+				file: "platform/observability/tracing"
+			}, {
+				kind: "basic"
+				text: "Flow Architecture Diagram"
+				path: "/platform/observability/encore-flow"
+				file: "platform/observability/encore-flow"
+			}, {
+				kind: "basic"
+				text: "Service Catalog"
+				path: "/platform/observability/service-catalog"
+				file: "platform/observability/service-catalog"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Integrations"
+			items: [{
+				kind: "basic"
+				text: "GitHub"
+				path: "/platform/integrations/github"
+				file: "platform/integrations/github"
+			}, {
+				kind: "basic"
+				text: "Custom Domains"
+				path: "/platform/integrations/custom-domains"
+				file: "platform/integrations/custom-domains"
+			}, {
+				kind: "basic"
+				text: "Webhooks"
+				path: "/platform/integrations/webhooks"
+				file: "platform/integrations/webhooks"
+			}, {
+				kind: "basic"
+				text: "OAuth Clients"
+				path: "/platform/integrations/oauth-clients"
+				file: "platform/integrations/oauth-clients"
+			}, {
+				kind: "basic"
+				text: "Auth Keys"
+				path: "/platform/integrations/auth-keys"
+				file: "platform/integrations/auth-keys"
+			}, {
+				kind: "basic"
+				text: "API Reference"
+				path: "/platform/integrations/api-reference"
+				file: "platform/integrations/api-reference"
+			}, {
+				kind: "basic"
+				text: "Terraform"
+				path: "/platform/integrations/terraform"
+				file: "platform/integrations/terraform"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Migration guides"
+			items: [{
+				kind: "basic"
+				text: "Migrate to Encore"
+				path: "/platform/migration/migrate-to-encore"
+				file: "platform/migration/migrate-to-encore"
+			}, {
+				kind: "basic"
+				text: "Migrate away from Encore"
+				path: "/platform/migration/migrate-away"
+				file: "platform/migration/migrate-away"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Management & Billing"
+			items: [{
+				kind: "basic"
+				text: "Compliance & Security"
+				path: "/platform/management/compliance"
+				file: "platform/management/compliance"
+			}, {
+				kind: "basic"
+				text: "Plans & billing"
+				path: "/platform/management/billing"
+				file: "platform/management/billing"
+			}, {
+				kind: "basic"
+				text: "Telemetry"
+				path: "/platform/management/telemetry"
+				file: "platform/management/telemetry"
+			}, {
+				kind: "basic"
+				text: "Roles & Permissions"
+				path: "/platform/management/permissions"
+				file: "platform/management/permissions"
+			}, {
+				kind: "basic"
+				text: "Usage limits"
+				path: "/platform/management/usage"
+				file: "platform/management/usage"
+			}]
+		},
+		{
+			kind: "section"
+			text: "Other"
+			items: [
+				{
+					kind: "accordion"
+					text: "Product comparisons"
+					accordion: [{
+						kind: "basic"
+						text: "Encore vs. Heroku"
+						path: "/platform/other/vs-heroku"
+						file: "platform/other/vs-heroku"
+					}, {
+						kind: "basic"
+						text: "Encore vs. Supabase / Firebase"
+						path: "/platform/other/vs-supabase"
+						file: "platform/other/vs-supabase"
+					}, {
+						kind: "basic"
+						text: "Encore vs. Terraform / Pulumi"
+						path: "/platform/other/vs-terraform"
+						file: "platform/other/vs-terraform"
+					}]
+				}]
+		},
+	]
+}
diff --git a/docs/platform/deploy/deploying.md b/docs/platform/deploy/deploying.md
new file mode 100644
index 0000000000..57524ba5f9
--- /dev/null
+++ b/docs/platform/deploy/deploying.md
@@ -0,0 +1,153 @@
+---
+seotitle: Deploying your Encore application is as simple as git push
+seodesc: Learn how to deploy your backend application built with Encore with a single command, while Encore manages your entire CI/CD process.
+title: Deploying Applications with Encore Cloud
+subtitle: Encore Cloud automates the deployment and infrastructure provisioning process
+lang: platform
+---
+
+Encore Cloud simplifies deploying your application, making it as simple as pushing to a git repository, removing the need for manual steps.
+
+## Deploying your application
+
+### Step 1: Create account & application
+
+Before deploying, ensure that you have an **Encore Cloud account** and have created an **Encore application**.
+
+You can create both an account and an application by running the following command:
+
+```shell
+$ encore app create
+```
+
+You will be asked to create a free Encore Cloud account first, and then proceed to create a new Encore application.
+
+#### Already created an application locally?
+
+Follow these steps if you've already created an app and want to link it to an account on Encore Cloud:
+
+**1. Ensure you are logged in with the CLI**
+
+```bash
+encore auth signup # If you haven't created an Encore Cloud account
+encore auth login # If you've already created an Encore Cloud account
+```
+
+**2. Link your local app to Encore Cloud**
+
+Run this command from you application's root folder:
+
+```bash
+encore app init
+```
+
+**3. Set up Encore's git remote to enable pushing directly to Encore Cloud**
+
+Run this command from you application's root folder:
+
+```bash
+git remote add encore encore://<app-id>
+```
+
+
+### Step 2: Integrate with GitHub (Optional)
+
+When creating an Encore application, Encore will automatically create a new Encore managed git repository. If you are just trying out Encore Cloud, you can use this and skip the rest of this step.
+
+For production applications we recommend integrating with GitHub instead of using the built-in Encore managed git:
+
+#### **Connecting your GitHub account**
+
+Open your app in the **[Encore Cloud dashboard](https://app.encore.cloud/) > (Select your app) > App Settings > Integrations > GitHub**.
+Click the **Connect Account to GitHub** button, which will open GitHub where you can grant access either to the relevant repositorie(s).
+
+[See the full docs](/docs/platform/integrations/github) on integrating with GitHub to learn how to configure different repository structures.
+
+Once connected to GitHub, pushing code will trigger deployments automatically. Encore Cloud Pro users get [Preview Environments](/docs/platform/deploy/preview-environments) for each pull request.
+
+### Step 3: Connect your AWS / GCP account (Optional)
+
+Deploy to your own cloud on AWS or GCP by connecting your cloud account to Encore Cloud.
+
+If you're just trying out Encore Cloud, skip this step to deploy to a free development environment using Encore Cloud's hosting, subject to [fair use limits](/docs/platform/management/usage).
+
+#### **Connecting your cloud account**
+
+Open your app in the **[Encore Cloud dashboard](https://app.encore.cloud/) > (Select your app) > App Settings > Integrations > Connect Cloud**.
+
+Learn more in the [connecting your cloud docs](/docs/platform/deploy/own-cloud).
+
+### Step 4: Push to deploy
+
+Deploy your application by pushing your code to the connected Git repository.
+
+- **Using Encore Cloud's managed git**:
+
+```shell
+$ git add -A .
+$ git commit -m 'Commit message'
+$ git push encore
+```
+
+- **If you have connected your GitHub account:**
+
+```shell
+$ git add -A .
+$ git commit -m 'Commit message'
+$ git push origin
+```
+
+This will trigger Encore Cloud's deployment process, consisting of the following phases:
+* A build & test phase
+* An infrastructure provisioning phase
+* A deployment phase
+
+Once you've pushed your code, you can monitor the progress in the **[Encore Cloud dashboard](https://app.encore.cloud/) > (Select your app) > Deployments**.
+
+## Configuring deploy trigger
+
+When using GitHub, you can configure Encore Cloud to automatically trigger deploys when you push to a specific branch name.
+
+To configure which branch name is used to trigger deploys, open your app in the [Encore Cloud dashboard](https://app.encore.cloud) and go to the **Overview** page for your intended environment. Click on **Settings** and then in the section **Branch Push** configure the `Branch name`  and hit save.
+
+### Integrating using Encore Cloud's API
+
+You can trigger deployments using Encore Cloud's API, learn more in the [API reference](/docs/platform/integrations/api-reference).
+
+## Configuring custom build settings
+
+If you want, you can override certain aspects of the CI/CD process in the `encore.app` file:
+
+* The Docker base image to use when deploying
+* Whether to build with Cgo enabled
+* Whether to bundle the source code in the docker image (useful for [Sentry stack traces](https://docs.sentry.io/platforms/go/usage/serverless/))
+
+Below are the available build settings configurable in the `encore.app` file,
+with their default values:
+
+```cue
+{
+    "build": {
+        // Enables cgo when building the application and running tests
+        // in Encore's CI/CD system.
+        "cgo_enabled": false,
+
+        // Docker-related configuration
+        "docker": {
+        	// The Docker base image to use when deploying the application.
+        	// It must be a publicly accessible image, and defaults to "scratch".
+            "base_image": "scratch",
+
+            // Whether to bundle the source code in the docker image.
+            // The source code will be copied into /workspace as part
+            // of the build process. This is primarily useful for tools like
+            // Sentry that need access to the source code to generate stack traces.
+            "bundle_source": false,
+
+            // The working directory to start the docker image in.
+            // If empty it defaults to "/workspace" if the source code is bundled, and to "/" otherwise.
+            "working_dir": ""
+        }
+    }
+}
+```
diff --git a/docs/platform/deploy/environments.md b/docs/platform/deploy/environments.md
new file mode 100644
index 0000000000..6766044999
--- /dev/null
+++ b/docs/platform/deploy/environments.md
@@ -0,0 +1,77 @@
+---
+seotitle: Environments – Creating local, preview, and prod environments
+seodesc: Learn how to create all the environments you need for your backend application, local, preview, testing and production. Here's how you keep them in sync!
+title: Creating & configuring environments
+subtitle: Get the environments you need, without the work
+lang: platform
+---
+
+Encore automatically sets up and manages different environments for your application (local, preview, testing, and production). Each environment is:
+- Fully isolated
+- Automatically provisioned
+- Always in sync with your codebase
+- Configured with appropriate infrastructure for its purpose
+
+## Environment Types
+
+Encore has four types of environments:
+- `production`
+- `development`
+- `preview`
+- `local`
+
+Some environment types differ in how infrastructure is provisioned:
+- `local` is provisioned by Encore's Open Source CLI using local versions of infrastructure.
+- `preview` environments are provisioned in Encore Cloud hosting and are optimized to be cost-efficient and fast to provision.
+- `production` and `development` environments are provisioned by Encore Cloud, either in your [cloud account](/docs/platform/deploy/own-cloud) or using Encore Cloud's free development hosting. Both environment types offer the same infrastructure options when deployed using your own cloud account.
+  
+Environment type is also used for [Secrets management](/docs/ts/primitives/secrets), allowing you to configure different secrets for different environment types. Therefore, you can easily configure different secrets for your `production` and `development` environments.
+
+## Creating environments
+
+1. Open your app in the [Encore Cloud dashboard](https://app.encore.cloud)
+2. Go to **Environments** > **Create env**
+3. Configure your environment:
+   - Name your environment
+   - Choose type: **Production** or **Development** (see [Environment Types](#environment-types))
+   - Set deploy trigger: Git branch or manual
+   - Configure infrastructure approval: automatic or manual
+   - Select cloud provider
+   - Choose process allocation: single or separate processes
+
+![Creating an environment](/assets/docs/createenv.png "Creating an environment")
+
+### Configuring deploy trigger
+
+When using GitHub, you can configure Encore Cloud to automatically trigger deploys when you push to a specific branch name.
+
+To configure which branch name is used to trigger deploys, open your app in the [Encore Cloud dashboard](https://app.encore.cloud) and go to the **Overview** page for your intended environment. Click on **Settings** and then in the section **Branch Push** configure the `Branch name`  and hit save.
+
+### Configuring infrastructure approval
+
+For some environments you may want to enforce infrastructure approval before deploying. You can configure this in the **Settings** > **Infrastructure Approval** section for your environment.
+
+When infrastructure approval is enabled, an application **Admin** will need to manually approve the infrastructure changes before the deployment can proceed.
+
+### Configuring process allocation
+
+Encore Cloud offers flexible process allocation options:
+- **Single process**: All services run in one process (simpler, lower cost)
+- **Separate processes**: Each service runs independently (better isolation, independent scaling)
+
+Choose your preferred deployment model when creating each environment. You can use different models for production and development environments without changing any code.
+
+<img src="/assets/docs/microservices-process-allocation.png" title="Microservices - Process Allocation" />
+
+## Setting a Primary environment
+
+Every Encore app has a configurable Primary environment that serves as the default for:
+- App insights in the Encore Cloud dashboard
+- API documentation
+- CLI functionality (like API client generation)
+
+**Configuring your Primary environment:**
+1. Open your app in the [Encore Cloud dashboard](https://app.encore.cloud)
+2. Navigate to **Settings** > **General** > **Primary Environment**
+3. Select your desired environment from the dropdown
+4. Click **Update**
diff --git a/docs/platform/deploy/own-cloud.md b/docs/platform/deploy/own-cloud.md
new file mode 100644
index 0000000000..9928b009cf
--- /dev/null
+++ b/docs/platform/deploy/own-cloud.md
@@ -0,0 +1,75 @@
+---
+seotitle: Connect your cloud account to deploy to any cloud
+seodesc: Learn how to deploy your backend application to all the major cloud providers (AWS or GCP) using Encore.
+title: Connect your cloud account
+subtitle: Whatever cloud you prefer is fine by us
+lang: platform
+---
+
+Encore Cloud lets you deploy your application to any of the major cloud providers, using your own cloud account.
+This lets you use Encore to improve your experience and productivity, while keeping the reliability of a major cloud provider.
+
+Each [environment](/docs/platform/deploy/environments) can be configured to use a different cloud provider, and you can have as many environments as you wish.
+This also lets you easily deploy a hybrid or multi-cloud application, as you see fit.
+
+<Callout type="info">
+
+Encore Cloud will provision infrastructure in your cloud account, but for safety reasons Encore Cloud does not automatically destroy infrastructure once it's no longer required. To do this, you need to manually approve the deletion of the infrastructure in your Encore Cloud dashboard.
+
+This means if you disconnect your app from your cloud provider, or delete the environment
+within Encore, you need to explicitly approve the deletion of the infrastructure in your Encore Cloud dashboard.
+
+</Callout>
+
+## Google Cloud Platform (GCP)
+
+Encore Cloud provides a GCP Service Account for each Encore Cloud application, letting you grant Encore Cloud access to provision all the necessary infrastructure directly in your own GCP Organization account.
+
+To find your app's Service Account email and configure GCP deployments, head over to the Connect Cloud page by going to the **[Encore Cloud dashboard](https://app.encore.cloud/) > (Select your app) > App Settings > Integrations > Connect Cloud**.
+
+![Connect GCP account](/assets/docs/connectgcp.png "Connect GCP account")
+
+### Troubleshooting
+
+**I can't access/edit the `Policy for Domain restricted sharing` page**
+
+To edit Organization policies, you need to have the `Organization Policy Administrator` role. If you don't have this role, you can ask your GCP Organization Administrator to grant you the necessary permissions.
+If you're a GCP Organization Administrator, you can grant yourself the necessary permissions by following the steps below:
+
+1. Go to the [IAM & Admin page](https://console.cloud.google.com/iam-admin/iam) in the GCP Console.
+2. Find your user account in the list of members.
+3. Click the pencil icon to edit your user account.
+4. Add the `Organization Policy Administrator` role to your user account.
+5. Click Save.
+
+**I can't grant access to the Encore Cloud service account**
+
+If you're unable to grant access to the Encore Cloud service account, you may have failed to add Encore Cloud to your `Domain restricted sharing` policy.
+Make sure you've followed all the steps in the Connect Cloud page to add Encore Cloud to the policy.
+If you're using several GCP accounts, make sure you're logged in with the correct account and that the correct organization is selected in the GCP Console.
+
+**Encore Cloud returns "Could not find Organization ID"**
+
+If you see this error message, it means that Encore Cloud was unable to connect to your GCP Organization. Make sure you've followed all the steps in the Connect Cloud page to grant Encore Cloud access to your GCP Organization.
+If you're using several GCP accounts, make sure you're logged in with the correct account and that the correct organization is selected in the GCP Console.
+
+Still having issues? Drop us an email at [support@encore.dev](mailto:support@encore.dev) or chat with us in the [Encore Discord](https://encore.dev/discord.
+
+## Amazon Web Services (AWS)
+To configure your Encore Cloud app to deploy to your AWS account, head over to the Connect Cloud page by going to the
+**[Encore Cloud dashboard](https://app.encore.cloud/) > (Select your app) > App Settings > Integrations > Connect Cloud**.
+
+Follow the instructions to create an IAM Role, and then connect the role with Encore Cloud.
+[Learn more in the AWS docs](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user.html).
+
+![Connect AWS account](/assets/docs/connectaws.png "Connect AWS account")
+
+
+<Callout type="warning">
+
+For your security, make sure to check `Require external ID` and specify the
+external ID provided in the instructions.
+
+</Callout>
+
+After connecting your app to AWS, you will be asked to choose which region you want Encore Cloud to provision resources in. [Learn more about AWS regions here](https://aws.amazon.com/about-aws/global-infrastructure/regions_az/).
diff --git a/docs/platform/deploy/preview-environments.md b/docs/platform/deploy/preview-environments.md
new file mode 100644
index 0000000000..c21f6ead97
--- /dev/null
+++ b/docs/platform/deploy/preview-environments.md
@@ -0,0 +1,51 @@
+---
+seotitle: Preview Environments – Temporary dev environments per Pull Request
+seodesc: Learn how to use Encore to activate automatic Preview Environments for every Pull Request to simplify testing and collaborating.
+title: Preview Environments
+subtitle: Accelerate development with isolated test environments for each Pull Request
+lang: platform
+---
+
+When using [Encore Cloud Pro](https://encore.cloud/pricing), you automatically get ephemeral Preview Environments for each Pull Request.
+
+Preview Environments are free, fully-managed development environments that run on Encore Cloud. They let you test changes without managing infrastructure or incurring cost.
+
+See the [infra docs](/docs/platform/infrastructure/infra#preview-environments) if you're curious about exactly how Preview Environments are provisioned.
+
+## Using Preview Environments
+
+To use Preview Environments, you first need to [connect your application to GitHub](/docs/platform/integrations/github).
+
+Preview Environments are named after the pull request, for example PR #72 creates a Preview Environment named `pr:72` with the API base url `https://pr72-$APP_ID.encr.app`.
+
+You can also view the environment in the Encore Cloud dashboard, where the url will be `https://app.encore.cloud/$APP_ID/envs/pr:72`.
+
+![Preview environment linked in GitHub](/assets/docs/ghpreviewenv.png "Preview environment linked in GitHub")
+
+## Populate databases with test data automatically
+
+Preview Environments can automatically come with pre-populated test data thanks to Neon's database branching feature. Here's how it works:
+
+1. Your main database (typically in staging) contains your test data
+2. When a Preview Environment is created, it gets a fresh database that's an exact copy of your main database
+3. This happens automatically - no manual data copying needed!
+
+#### Setup instructions
+1. Go to [Encore Cloud dashboard](https://app.encore.cloud)
+2. Select your app > App Settings > Preview Environments
+3. Choose which environment's database to copy from (e.g., staging)
+4. Save your changes
+
+**Note:** This feature requires using Neon as your database provider, which is:
+- Default for Encore Cloud environments
+- Optional for AWS and GCP environments
+
+<img src="/assets/docs/pr-neon.png" title="Use Neon for PR environments" className="mx-auto"/>
+
+## Frontend Collaboration
+
+Preview Environments make it really easy to collaborate and test changes with your frontend. Just update your frontend API client to point to the `pr:#` environment.
+This is a one-line change since your API client always specifies the environment name, e.g. `https://<env>-<my-app>.encr.app/`.
+
+If your pull request makes changes to the API, you can [generate a new API client](/docs/ts/cli/client-generation)
+for the new backend API using `encore gen client --env=pr:72 --lang=typescript my-app`
diff --git a/docs/platform/deploy/security.md b/docs/platform/deploy/security.md
new file mode 100644
index 0000000000..3541a863bf
--- /dev/null
+++ b/docs/platform/deploy/security.md
@@ -0,0 +1,29 @@
+---
+seotitle: Security – How Encore keeps your backend application secure
+seodesc: Encore applications come with built-in security best practises. See how Encore keeps your application secure by default.
+title: Application Security
+subtitle: Encore Cloud makes strong security the default path
+lang: platform
+---
+
+## Built on industry experience
+
+The security practices in Encore Cloud are built on our team's decades of experience designing and operating sensitive systems at companies like Google, Spotify, and Monzo.
+
+## Security by Default
+
+Encore Cloud is designed to make security effortless rather than burdensome:
+
+- **Zero-config security**: Focus on building features while Encore Cloud automatically implements security best practices
+- **Built-in secrets management**: Safely handle sensitive data using the built-in [secrets management system](/docs/ts/primitives/secrets)
+- **Automated IAM management**: Encore Cloud automatically manages IAM policies based on the principle of least privilege
+
+## Security features
+
+When Encore Cloud deploys your application and infrastructure, it takes care of implementing security best practices:
+
+- **Strong encryption**: All communication uses mutual TLSv1.3
+- **Secure databases**: Database access is encrypted with certificate validation and strong security credentials
+- **Cloud security**: Automatic provisioning with security best practices specific to each cloud provider
+  - Learn more about [Google Cloud Platform (GCP)](/docs/platform/infrastructure/gcp)
+  - Learn more about [Amazon Web Services (AWS)](/docs/platform/infrastructure/aws)
diff --git a/docs/platform/infrastructure/aws.md b/docs/platform/infrastructure/aws.md
new file mode 100644
index 0000000000..7613fe608b
--- /dev/null
+++ b/docs/platform/infrastructure/aws.md
@@ -0,0 +1,141 @@
+---
+seotitle: AWS Infrastructure on Encore Cloud
+seodesc: A comprehensive guide to how Encore Cloud provisions and manages AWS infrastructure for your applications
+title: AWS Infrastructure
+subtitle: Understanding your application's AWS infrastructure
+lang: platform
+---
+Encore Cloud simplifies the process of deploying applications by automatically provisioning and managing the necessary AWS infrastructure. This guide provides a detailed look at the components involved and how they work together to support your applications.
+
+## Core Infrastructure Components
+
+### Networking Architecture
+
+Networking is a critical aspect of cloud infrastructure, ensuring secure and efficient communication between different parts of your application. Encore Cloud creates an isolated [Virtual Private Cloud (VPC)][aws-vpc] for each environment, which serves as a secure network boundary.
+
+The network architecture is designed with reliability and security in mind. Each VPC spans across two Availability Zones (AZs), providing redundancy and fault tolerance. If one AZ experiences issues, your application can continue running in the other AZ, significantly reducing the risk of downtime. This multi-AZ setup is crucial for maintaining high availability in production environments.
+
+Within the VPC, Encore Cloud implements a three-tier architecture that carefully separates different components of your application into distinct subnet layers. This separation of concerns enhances both security and performance by controlling traffic flow between layers and limiting potential attack vectors. Each tier is configured with specific security groups and network ACLs to enforce these boundaries, creating a robust and secure networking foundation for your application.
+
+#### Subnet Tiers
+
+1. **Public Subnet**
+   The public subnet contains several key components that manage external traffic flow. At the forefront is the Application Load Balancer (ALB), which serves as the entry point for all incoming traffic to your application. The ALB intelligently distributes requests across your application instances, ensuring optimal performance and reliability.
+
+   To enable outbound communication, the subnet includes an Internet Gateway that allows your application components to securely connect to external services and APIs. Working alongside it is a NAT Gateway, which provides a secure pathway for resources in private subnets (like your compute instances) to access the internet while remaining protected from direct external access. This NAT Gateway acts as an intermediary, translating private IP addresses to public ones for outbound traffic while maintaining the security of your internal resources.
+
+2. **Compute Subnet**
+   The compute subnet is where your application's containers run, regardless of whether you're using Fargate or EKS as your container orchestration platform. This subnet is carefully isolated and configured to only accept incoming traffic from the Application Load Balancer in the public subnet. This strict traffic control ensures that your application containers can only be accessed through proper channels, protecting them from unauthorized direct access while still allowing legitimate requests to flow through seamlessly.
+
+3. **Storage Subnet** (provisioned as needed)
+   The storage subnet is a dedicated network segment designed to host your application's databases and caching systems. To maintain the highest level of security, this subnet operates in complete isolation from the internet, with no direct inbound or outbound connectivity. Access to resources within the storage subnet is strictly limited to traffic originating from the compute subnet, creating a secure enclave for your data layer. This architecture ensures that your sensitive data remains protected while still being readily accessible to your application's services running in the compute tier.
+
+### Container Management
+
+Encore Cloud provisions an [Elastic Container Registry (ECR)][aws-ecr] to store your application's Docker images. The registry is seamlessly integrated with your chosen compute platform and provides robust security features. Access to images is tightly controlled through comprehensive access controls, ensuring only authorized users and services can pull or push container images. Additionally, ECR automatically scans all images for known security vulnerabilities as they are pushed to the registry, helping you maintain a secure application environment by identifying potential risks before deployment.
+
+### Secrets Management
+
+Managing sensitive information securely is crucial. Encore Cloud uses [AWS Secrets Manager][aws-secrets] to store and manage secrets, such as API keys and database credentials. Through deep integration with AWS Secrets Manager, Encore Cloud automatically injects secrets directly into your service's environment variables at runtime, making them easily accessible while maintaining strict security controls. All secrets are encrypted both at rest and in transit using industry-standard encryption algorithms, providing comprehensive protection for your sensitive data. The system implements fine-grained access controls, where each service is given precisely scoped permissions to access only the specific secrets it needs. This ensures that even if one service is compromised, the blast radius is contained and other secrets remain secure.
+
+## Compute Options
+
+Encore Cloud provisions one of two compute platforms for running your application containers, based on your choice:
+
+### AWS Fargate
+
+When using Fargate, Encore Cloud configures:
+
+- **Task Definitions**
+  Task definitions are meticulously configured to ensure optimal performance and reliability of your services. Each service's container settings are fine-tuned based on its specific requirements, including memory allocation, CPU utilization, and networking parameters. Comprehensive health check configurations monitor the service's status, enabling quick detection and recovery from any issues. Environment variables are securely injected from AWS Secrets Manager at runtime, providing your services with the credentials and configuration they need while maintaining security. The task definitions are also integrated with AWS Service Discovery, enabling automatic service registration and allowing for seamless service-to-service communication within your application.
+
+- **Fargate Services**
+  Fargate services are configured with sophisticated deployment strategies that ensure zero downtime during updates. When deploying new versions of your services, Encore Cloud orchestrates a rolling update process where new tasks are gradually introduced while old ones are removed, maintaining consistent availability throughout the deployment.
+
+  Each service is automatically integrated with Application Load Balancer target groups, enabling intelligent request routing and load distribution. The load balancer continuously monitors the health of your service instances and automatically routes traffic only to healthy targets.
+
+  To ensure smooth service startup, appropriate health check grace periods are configured. This gives your services adequate time to initialize and warm up before receiving traffic, preventing premature health check failures during deployment or scaling events.
+
+- **IAM Configuration**
+  Encore Cloud implements a comprehensive IAM security model by creating unique execution roles for each task definition. These roles are automatically configured with precisely scoped permissions that enable secure access to required AWS services. The execution roles allow containers to pull images from ECR and write operational logs to CloudWatch for monitoring and debugging. They also grant access to assigned AWS resources like S3 buckets and SQS queues that the service needs to interact with. Additionally, the roles are configured to securely retrieve secrets from AWS Secrets Manager at runtime, enabling safe storage and access of sensitive configuration data. This granular permission model follows security best practices by providing each service with the minimum privileges required for operation.
+
+- **Network Integration**
+Fargate tasks are strategically placed within private compute subnets, ensuring they remain isolated from direct internet access while maintaining the ability to communicate with other application components. The associated security groups are configured with precise rules that govern network traffic. These rules allow inbound traffic exclusively from the Application Load Balancer, ensuring that your services can only be accessed through the properly configured entry point. For outbound connectivity, the security groups permit traffic to flow to your databases and caching layers, enabling your services to interact with these essential backend resources while maintaining a secure network boundary.
+
+### Amazon EKS
+
+When using EKS, Encore Cloud configures:
+
+- **Cluster Setup**
+  Encore Cloud configures the core networking components required for cluster operation. The VPC CNI (Container Network Interface) is configured to enable pod networking within the cluster, allowing pods to communicate efficiently using the underlying AWS VPC networking capabilities. This includes setting up IP address management and network policy enforcement.
+
+  The cluster's internal DNS resolution is handled through CoreDNS, which is configured for optimal service discovery and name resolution within the cluster. CoreDNS settings are tuned to provide fast and reliable DNS lookups while maintaining reasonable cache sizes and query limits.
+
+
+- **Kubernetes Resources**
+  Encore Cloud automatically manages all necessary Kubernetes resources for your application. Each service in your application is deployed as a separate Kubernetes Deployment, allowing for independent scaling and lifecycle management. These deployments are configured with appropriate resource requests, limits, and health checks to ensure reliable operation.
+
+  For authentication and authorization, Encore Cloud implements IAM Roles for Service Accounts (IRSA), providing secure access to AWS services. Each service gets its own service account with precisely scoped IAM roles, following the principle of least privilege.
+
+  For sensitive data like API keys and credentials, Encore Cloud uses Kubernetes Secrets, which are encrypted at rest and only accessible to authorized services.
+
+  To enable network connectivity, Encore Cloud creates Kubernetes Service resources for each of your application's services, providing stable networking endpoints for inter-service communication. 
+
+- **Load Balancer Integration**
+  Encore Cloud manages the complete load balancer integration for your EKS cluster. The AWS Load Balancer Controller is automatically installed and configured to handle ingress traffic for your application. This controller works in conjunction with the Application Load Balancer (ALB) to provide intelligent traffic routing and SSL/TLS termination.
+
+  The ALB Ingress Controller is configured to automatically create and manage Application Load Balancers based on your application's needs. It handles the creation and configuration of target groups, ensuring traffic is properly distributed across your service pods. The controller also manages the lifecycle of these resources, automatically cleaning up unused resources to prevent waste.
+
+  Target group binding is automatically configured to map your Kubernetes services to the appropriate ALB target groups. This ensures that traffic is correctly routed to the right pods and that health checks are properly configured to maintain high availability.
+
+  For secure communication, Encore Cloud automatically manages SSL/TLS certificates through AWS Certificate Manager. These certificates are automatically provisioned, renewed, and attached to your load balancers, ensuring all external traffic to your application is encrypted. The system also handles certificate rotation and updates transparently, maintaining secure communication without manual intervention.
+
+- **Monitoring Setup**
+  Encore Cloud automatically aggregates and sends metrics to your configured metrics destination, providing you with real-time visibility into your application's performance.
+
+  In addition to metrics, Encore Cloud configures the CloudWatch Logs agent to capture and forward all container logs. The logs are structured and organized by service name, making it easy to search and analyze application behavior. Log streams are automatically created for each container, and log retention policies are configured to help manage storage costs while maintaining necessary historical data.
+
+- **Service Accounts**
+  Encore Cloud implements a comprehensive service account management system that ensures secure and controlled access to resources. Each service in your application receives its own dedicated Kubernetes service account, providing a unique identity for authentication and authorization purposes.
+
+  To enable secure interaction with AWS services, Encore Cloud maps each Kubernetes service account to a corresponding IAM role using IAM Roles for Service Accounts (IRSA). This mapping allows pods to securely authenticate with AWS services without storing long-lived credentials.
+
+  The IAM roles are automatically configured with the minimum required permissions for each service's needs. This includes access to service-specific S3 buckets for object storage operations, permissions to publish and subscribe to SQS queues and SNS topics, ability to retrieve secrets from AWS Secrets Manager, and secure access to assigned database instances. These permissions are continuously updated as your application evolves, ensuring services always have the access they need while maintaining strong security boundaries.
+
+All of these configurations are automatically maintained and updated by Encore Cloud as you develop your application, ensuring your infrastructure stays aligned with your application's needs.
+
+## Managed Services
+
+### Databases
+Encore Cloud provisions [Amazon RDS][aws-rds] for PostgreSQL databases, providing a robust and scalable database solution. Each database runs the latest PostgreSQL version to ensure compatibility with modern features while maintaining up-to-date security patches. The databases are provisioned on auto-scaling capable instances, starting with db.m5.large configurations that can seamlessly scale up as your application's needs grow.
+
+To protect your data, Encore Cloud configures automated daily backups with a 7-day retention period. Security is paramount, so databases are strategically placed within private subnets and protected by comprehensive access controls. This network isolation combined with strict security rules ensures your data remains secure while still being accessible to your application's services.
+
+#### Database Access
+Database access is managed through a comprehensive security model. At its core, Encore Cloud deploys [Emissary](https://github.com/encoredev/emissary), a secure socks proxy that enables safe database migrations while maintaining strict access controls. Each service in your application is assigned its own dedicated database role, providing granular control over data access and ensuring services can only interact with the data they need. For enhanced security, all databases are placed in private subnets, completely isolated from direct internet access. This multi-layered approach creates a secure foundation for your application's data access needs while maintaining operational flexibility.
+
+### Pub/Sub
+Encore Cloud implements a robust messaging system using [SQS][aws-sqs] and [SNS][aws-sns]. The system automatically configures dead-letter queues to capture failed messages, enabling thorough analysis and debugging of messaging issues. Each service in your application receives precisely scoped IAM permissions to publish and consume messages, ensuring secure communication between components. Encore Cloud fully manages the creation and configuration of subscriptions and topics, streamlining the setup and ongoing maintenance of your messaging infrastructure while maintaining optimal performance and reliability.
+
+### Object Storage
+Encore Cloud leverages [S3][aws-s3] for object storage, providing a comprehensive solution for your application's storage needs. When you declare storage requirements in your application, Encore Cloud automatically provisions dedicated S3 buckets with unique names to ensure global uniqueness across AWS. Each service in your application receives precisely scoped permissions to perform storage operations, following the principle of least privilege. For public buckets, Encore Cloud automatically integrates with CloudFront to create a global content delivery network, significantly improving access speeds for your users worldwide. Each bucket is assigned its own unique domain name, making it simple to manage and access stored content while maintaining a clear organizational structure.
+
+### Caching
+Encore Cloud uses [ElastiCache for Redis][aws-redis] to provide a high-performance caching solution. The service starts with cache.m6g.large instances that can automatically scale up as your application's needs grow. To ensure maximum reliability, caches are configured with Multi-AZ replication across availability zones, providing both high availability and fault tolerance. In the event of any failures, automatic failover capabilities ensure your application experiences no disruption in service.
+
+Security is maintained through Redis Access Control Lists (ACLs), which provide fine-grained control over who can access your cache and what operations they can perform. The entire system is configured for high availability, with monitoring and alerting in place to maintain optimal performance and uptime. This comprehensive setup ensures your application's caching layer remains fast, secure, and always available.
+
+### Cron Jobs
+Encore Cloud provides a streamlined approach to scheduled tasks that prioritizes security and simplicity. Each cron job is executed through authenticated API requests that are cryptographically signed to verify their authenticity. The system performs rigorous source verification to ensure all scheduled tasks originate exclusively from Encore Cloud's cron functionality, preventing unauthorized execution attempts. This elegant implementation requires no additional infrastructure components, making it both cost-effective and easy to maintain while ensuring your scheduled tasks run reliably and securely.
+
+[aws-vpc]: https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html
+[aws-fargate]: https://aws.amazon.com/fargate/
+[aws-eks]: https://aws.amazon.com/eks/
+[aws-secrets]: https://aws.amazon.com/secrets-manager/
+[aws-rds]: https://aws.amazon.com/rds/postgresql/
+[aws-sqs]: https://aws.amazon.com/sqs/
+[aws-sns]: https://aws.amazon.com/sns/
+[aws-s3]: https://aws.amazon.com/s3/
+[aws-redis]: https://aws.amazon.com/elasticache/redis/
+[aws-ecr]: https://aws.amazon.com/ecr/
+[aws-alb]: https://aws.amazon.com/elasticloadbalancing/application-load-balancer/
diff --git a/docs/platform/infrastructure/cloudflare.md b/docs/platform/infrastructure/cloudflare.md
new file mode 100644
index 0000000000..120fb41187
--- /dev/null
+++ b/docs/platform/infrastructure/cloudflare.md
@@ -0,0 +1,57 @@
+---
+seotitle: Cloudflare R2 Infrastructure on Encore Cloud
+seodesc: A comprehensive guide to how Encore Cloud provisions and manages Cloudflare R2 infrastructure for your applications
+title: Cloudflare R2 Buckets
+lang: platform
+---
+
+Encore Cloud simplifies the process of using Cloudflare R2 for object storage by automatically provisioning and managing the necessary infrastructure. This guide provides setup instructions and details on how Encore Cloud manages your Cloudflare R2 infrastructure.
+
+## Setup Process
+
+### 1. Cloudflare Account Connection
+
+To connect your Cloudflare account to Encore Cloud:
+
+1. Create a Cloudflare API token using the **Create Additional Tokens** button in the Cloudflare dashboard 
+
+2. Add the the following permissions:
+   - Zone > Zone: Read
+   - Zone > DNS: Edit
+   - Account > Workers R2 Storage: Edit
+
+3. Add the token in the Encore Cloud dashboard:
+   - Navigate to App Settings > Integrations > Cloudflare
+   - Click "Connect Account"
+   - Provide an account name and your API token
+
+### 2. Environment Configuration
+
+When creating a new environment:
+
+1. Select your preferred cloud provider
+2. Choose "Cloudflare R2" as the object storage provider
+3. Configure the following R2-specific settings:
+   - Token: Your Cloudflare API token
+   - Account: Your Cloudflare account
+   - Zone: The domain zone for public bucket URLs
+   - Region: Your preferred R2 storage region
+
+## Managed Features
+
+### Bucket Management
+
+Encore Cloud provides comprehensive bucket management capabilities that adapt to your application's needs. When you define storage requirements in your application, Encore Cloud automatically provisions the necessary R2 buckets with appropriate configurations. Each bucket is created with carefully configured policies and access controls to ensure secure yet efficient access to your stored objects. 
+
+### Public Access Configuration
+
+When working with public buckets, Encore Cloud handles all aspects of public access configuration automatically. Each bucket is assigned a unique subdomain that is automatically provisioned and configured in your DNS settings. The bucket is seamlessly integrated with Cloudflare's global CDN network, ensuring fast content delivery worldwide. Encore Cloud also configures optimal caching rules to maximize performance while maintaining appropriate cache invalidation policies. This comprehensive setup ensures your public content is served efficiently and securely through Cloudflare's infrastructure.
+
+### Security Controls
+
+Encore Cloud implements a comprehensive multi-layered security model to protect your R2 storage. At the bucket level, fine-grained access controls ensure that only authorized services can perform specific operations on each bucket. Each service in your application receives its own unique set of credentials, preventing any unauthorized cross-service access. These credentials are securely distributed to the appropriate services through Encore Cloud's built-in secrets management system, which handles the entire credential lifecycle.
+
+All these configurations are automatically maintained and updated by Encore Cloud as you develop your application, ensuring your infrastructure stays aligned with your application's needs.
+
+[cloudflare-r2]: https://developers.cloudflare.com/r2/
+[cloudflare-cdn]: https://developers.cloudflare.com/cdn/
\ No newline at end of file
diff --git a/docs/platform/infrastructure/configuration.md b/docs/platform/infrastructure/configuration.md
new file mode 100644
index 0000000000..d44eaefd3b
--- /dev/null
+++ b/docs/platform/infrastructure/configuration.md
@@ -0,0 +1,73 @@
+---
+seotitle: Infrastructure Configuration
+seodesc: Learn how you can configure infrastructure provisioned using Encore Cloud
+title: Infrastructure Configuration
+subtitle: How to configure infrastructure when using Encore Cloud
+lang: platform
+---
+
+Encore Cloud provides a powerful and flexible approach to infrastructure management, ensuring that your cloud resources are efficiently provisioned, according to enterprise best practices.
+
+Unlike traditional Infrastructure-as-Code (IaC) tools, when using Encore's declarative infrastructure framework, you do not define any cloud service specifics in code. This ensures your code is cloud-agnostic and portable across clouds, and can be deployed using different infrastructure for each environment according to your priorities (cost, performance, etc.).
+
+Infrastructure configuration is made in the Encore Cloud dashboard, which provides a controlled workflow, role-based access controls, and auditable history of changes.
+
+Encore Cloud provisions and manages infrastructure by using your cloud provider's APIs. Learn more in the [Infrastructure](/docs/platform/infrastructure/infra) documentation.
+
+## Infrastructure settings when creating a new environment
+
+When creating a new environment, you can decide the following:
+
+- Which cloud provider to use (AWS or GCP)
+- Which compute hardware to use (e.g. AWS Fargate, GCP Cloud Run, Kubernetes)
+- If using Kubernetes, should a new cluster be created or should an existing cluster be used?
+- Which Kubernetes provider to use (GKE or EKS)
+- Which database to use (e.g. AWS RDS, GCP CloudSQL, Neon Serverless Postgres)
+- Which process allocation strategy to use (more on this below)
+
+## Ongoing infrastructure configuration
+
+### Configuration UI in Encore Cloud
+
+After creating an environment, you can continue to configure the infrastructure via the Encore Cloud dashboard.
+
+The dashboard exposes the most common configuration options, and provides a controlled workflow for making changes, including audit logs and role-based access controls.
+
+<img src="/assets/docs/infra_config.png" title="Infra configuration UI"/>
+
+#### Process allocation configuration
+
+Encore provides a powerful configuration option called process allocation. This enables you to configure how microservices should be deployed on the compute hardware; either deploying all services in one process or one process per service. All without any code changes.
+
+It's often recommended to deploy all services in one process in order to reduce costs and minimize response times between services. (But it depends on your use case.)
+Deploying each service as its own process will improve scalability and decrease blast radius if things go wrong. This is only recommended for production environments.
+
+<img src="/assets/docs/microservices-process-allocation.png" title="Process allocation config"/>
+
+### Manual configuration in your cloud provider's console
+
+Manual configuration is relevant in cases where some configuration options are not yet available in the Encore Cloud dashboard, or you may want to make changes manually. Handily, you have full access to make changes directly in your cloud provider's console.
+
+Encore Cloud tries very hard to ensure that any manual changes made in the cloud provider's console are not overwritten.
+
+Therefore it only makes the minimum necessary modifications to infrastructure when deploying new changes, using the following strategies:
+
+- **PATCH-style updates:** Resources are updated using compare-and-set and similar techniques, modifying only the attributes that require changes.
+
+- **Avoid full syncs:** Unlike Terraform, Encore Cloud updates only the specific resources necessary to accomplish an infrastructure change rather than performing a complete infrastructure refresh.
+
+These behaviors ensure an efficient and predictable workflow, minimizing unintended changes and reducing deployment times, and means that you can safely use your cloud provider's console to modify the provisioned resources.
+
+This behavior also makes Encore Cloud well-suited for environments where infrastructure is partially managed outside of Encore Cloud, enabling you to deploy Encore applications alongside existing infrastructure (more on this below).
+
+## Working with Existing Infrastructure
+
+One of Encore Cloud’s strengths is its ability to work seamlessly with existing infrastructure. Since it does not enforce a full sync approach, it can:
+
+- Integrate with pre-existing cloud resources without overwriting manual changes
+
+- Deploy to existing Kubernetes clusters
+
+- Co-exist with other IaC tools like Terraform and CloudFormation.
+
+Encore Cloud also provides a Terraform Provider to simplify integration with existing Terraform-managed infrastructure. Learn more in the [Terraform Provider](/docs/platform/integrations/terraform) documentation.
diff --git a/docs/platform/infrastructure/configure-kubectl.md b/docs/platform/infrastructure/configure-kubectl.md
new file mode 100644
index 0000000000..ef0e9aa565
--- /dev/null
+++ b/docs/platform/infrastructure/configure-kubectl.md
@@ -0,0 +1,23 @@
+---
+seotitle: Configure kubectl to access your Encore Kubernetes cluster
+seodesc: Learn how to configure kubectl to access your Encore Kubernetes cluster.
+title: Configure kubectl
+lang: platform
+---
+
+Encore Cloud automatically provisions and manages Kubernetes clusters for you, but sometimes it's useful to manually inspect
+clusters using the [kubectl](https://kubernetes.io/docs/reference/kubectl/) cli. To do this, you need to configure `kubectl` to connect and authenticate through
+encore. You can do this by running the following command in your app directory:
+
+```shell
+encore kubernetes configure -e <environment>
+```
+
+Where `<environment>` is the name of the environment you want to configure `kubectl` for.
+
+This will configure `kubectl` to use `encore` to authenticate the cluster and proxy your traffic to the correct 
+cluster. You can now use `kubectl` as you normally would, for example:
+
+```shell
+kubectl get pods
+```
diff --git a/docs/platform/infrastructure/configure-network.md b/docs/platform/infrastructure/configure-network.md
new file mode 100644
index 0000000000..5d0061fd34
--- /dev/null
+++ b/docs/platform/infrastructure/configure-network.md
@@ -0,0 +1,35 @@
+---
+seotitle: How to configure custom network settings for your Encore environment
+seodesc: Learn how to configure IP ranges when connecting your Encore application to existing networks.
+title: Configure network settings
+subtitle: Customizing IP ranges for network peering
+lang: platform
+---
+
+# Overview
+
+When deploying applications with Encore Cloud, a network is automatically provisioned with default settings. However, if you plan to peer your Encore network with an existing network, you can manually configure the IP range for your environment.
+
+## Benefits
+
+Configuring custom network settings allows you to:
+- Connect your Encore application to existing networks via peering
+- Prevent IP range conflicts with other networks in your organization
+- Plan your network topology with predictable addressing
+
+## Configuring network settings
+
+Follow these steps to configure custom network settings:
+
+1. Navigate to **Create Environment** in the Encore Cloud dashboard
+2. Select the AWS or GCP cloud provider
+3. Expand the **Network** section
+4. Enter your desired IP range
+   - The range must be at least a /16 block to reserve enough IPs for your application to grow
+   - Choose a range that doesn't conflict with your existing networks
+
+Once configured, Encore will use your specified IP range instead of assigning a random private network.
+
+## Default network behavior
+
+By default, Encore will reserve a randomly assigned /16 block in one of the private IP ranges. This is suitable for most deployments that don't require network peering.
diff --git a/docs/platform/infrastructure/gcp.md b/docs/platform/infrastructure/gcp.md
new file mode 100644
index 0000000000..d52dcead6c
--- /dev/null
+++ b/docs/platform/infrastructure/gcp.md
@@ -0,0 +1,111 @@
+---
+seotitle: GCP Infrastructure on Encore Cloud
+seodesc: A comprehensive guide to how Encore Cloud provisions and manages GCP infrastructure for your applications
+title: GCP Infrastructure
+subtitle: Understanding your application's GCP infrastructure
+lang: platform
+---
+
+Encore Cloud simplifies the process of deploying applications by automatically provisioning and managing the necessary GCP infrastructure. This page provides an overview of the components involved and how they work together to support your applications.
+
+_Example of Encore project deployment alongside existing legacy systems on GCP:_
+
+<img src="/assets/docs/gcp-diagram.png" title="Migration options" className="noshadow"/>
+
+## Core Infrastructure Components
+
+### Networking Architecture
+
+To ensure maximum security and isolation, Encore Cloud provisions a dedicated GCP Project for each environment. This project isolation prevents any potential cross-environment access and enables granular control over resources and permissions. Within each project, all resources are deployed into a private network configuration, where they can only communicate with other resources inside the VPC. This private networking approach significantly reduces the attack surface by preventing direct access from the public internet, with traffic only flowing through designated ingress points.
+
+### Container Management
+
+Encore Cloud provisions a [Google Container Registry (GCR)][gcp-gcr] to store your application's Docker images.
+
+The registry implements comprehensive access controls to ensure only authorized users and services can access and manage container images. Through integration with GCP's Identity and Access Management (IAM), each service is granted the minimum required permissions needed to pull its container images.
+
+Additionally, GCR performs automated vulnerability scanning on all container images. As new images are pushed to the registry, they are automatically analyzed for known security vulnerabilities in the operating system and application dependencies. This proactive scanning helps identify potential security issues early in the deployment pipeline, allowing you to maintain a secure application environment.
+
+### Secrets Management
+
+Encore Cloud's integration with Secret Manager provides comprehensive security and seamless access to sensitive data. All secrets are automatically injected as environment variables into your services, eliminating the need for manual configuration while maintaining security. The secrets are protected using industry-standard encryption both when stored and during transmission between services. To ensure maximum security, Secret Manager implements strict access controls - each service can only access the specific secrets it needs, and all access attempts are logged and audited.
+
+## Compute Options
+
+Encore Cloud provisions one of two compute platforms for running your application containers, based on your choice:
+
+### Google Cloud Run
+
+When using Cloud Run, Encore Cloud configures:
+
+**Service Deployments**
+Each service is configured with optimized container settings and health check configurations to ensure reliable operation. Environment variables are automatically injected from Secret Manager to securely provide configuration values. Service discovery integration enables seamless communication between services.
+
+**Cloud Run Services**
+Cloud Run services are configured with zero-downtime deployment strategies, ensuring your application remains available during updates. Each service is integrated with a load balancer to distribute traffic efficiently across instances. Health check grace periods are configured to allow containers adequate time to start up before receiving traffic, preventing premature termination of healthy instances.
+
+**IAM Configuration**
+Each deployment receives its own dedicated service account to ensure proper isolation and security. These service accounts are automatically configured with the minimum required permissions needed for operation. This includes access to pull container images from Google Container Registry, write application logs to Cloud Logging, and interact with assigned GCP resources like Cloud Storage buckets and Pub/Sub topics. The service accounts are also granted permission to read secrets from Secret Manager, enabling secure access to sensitive configuration values. This automated permission management ensures your services have exactly the access they need while following security best practices.
+
+### Google Kubernetes Engine
+
+When using GKE, Encore Cloud configures:
+
+- **Cluster Setup**
+  Encore Cloud provisions either GKE Autopilot clusters or standard GKE clusters with managed node pools, both configured to run in private subnets for enhanced security. With Autopilot, GKE automatically manages the underlying infrastructure, while with standard clusters Encore Cloud configures and maintains optimized node pools based on your workload requirements. In both cases, the nodes are placed in private subnets to ensure they're not directly accessible from the internet, with all traffic flowing through the load balancer.
+
+- **Kubernetes Resources**
+  Encore Cloud automatically creates and manages all necessary Kubernetes resources for your application. Each Encore service is deployed as a Kubernetes Deployment, ensuring reliable operation and scaling capabilities. These deployments are backed by service accounts configured with appropriate IAM roles to access GCP resources securely. Sensitive configuration data is stored as Kubernetes Secrets and automatically mounted into the appropriate pods. To enable network connectivity, Encore Cloud provisions Kubernetes Service and Ingress resources that integrate with the Google Cloud Load Balancer, providing secure external access to your application endpoints.
+
+- **Load Balancer Integration**
+  Encore Cloud integrates with Google Cloud Load Balancer to provide secure and reliable access to your applications. The load balancer is configured to distribute traffic across your services while handling SSL/TLS termination. All traffic is automatically encrypted using managed SSL/TLS certificates that are provisioned and renewed automatically. This ensures your application endpoints remain secure and accessible through HTTPS without requiring manual certificate management.
+
+- **Monitoring Setup**
+  Encore Cloud sets up comprehensive monitoring for your GKE clusters by configuring both metrics collection and log management. Container metrics are automatically collected from each pod and exported to your configured monitoring service, providing detailed insights into resource usage, performance, and application behavior. Additionally, all container logs are seamlessly forwarded to Cloud Logging, enabling centralized log aggregation and analysis. This integrated monitoring approach gives you full visibility into your application's health and performance within the Google Cloud ecosystem.
+
+- **Service Accounts**
+  Encore Cloud implements a comprehensive service account management system that ensures secure and controlled access to GCP resources. Each service in your application receives its own dedicated service account, providing fine-grained access control and isolation between services.
+
+  These service accounts are automatically configured with IAM roles that map precisely to the GCP services your application needs to interact with. The permission configuration is handled dynamically based on your application's declared resource usage. For example, if your service needs to access a GCS bucket, Encore Cloud automatically grants the minimum required permissions for those specific storage operations. Similarly, when your service needs to publish or subscribe to Pub/Sub topics, connect to databases, or retrieve secrets, the appropriate IAM roles are configured automatically.
+
+  This automated permission management ensures that each service operates under the principle of least privilege, having access only to the resources it explicitly needs to function. This significantly enhances your application's security posture by minimizing the potential impact of any security breach.
+
+All of these configurations are automatically maintained and updated by Encore Cloud as you develop your application, ensuring your infrastructure stays aligned with your application's needs.
+
+## Managed Services
+
+### Databases
+
+Encore Cloud provisions [GCP Cloud SQL][gcp-cloudsql] for PostgreSQL databases, providing a robust and scalable database solution:
+
+Encore Cloud provisions Cloud SQL instances running the latest PostgreSQL version, ensuring you have access to the newest features and security updates. Each instance starts with the smallest available configuration to optimize costs, while maintaining the ability to automatically scale up resources as your application's needs grow.
+
+Data protection is a key priority, with automated daily backups retained for 7 days and point-in-time recovery capabilities. This allows you to restore your database to any moment within the retention period if needed.
+
+Security is enforced through strategic placement of databases in private subnets, isolating them from direct internet access. Strict access controls ensure that only authorized services and users can connect to the database instances.
+
+### Pub/Sub
+
+Encore Cloud implements a robust messaging system using [GCP Pub/Sub][gcp-pubsub]. The system is designed with reliability and security in mind, automatically configuring dead-letter topics to capture and preserve any failed messages for later analysis and debugging. Each service in your application receives precisely scoped IAM permissions for publishing and consuming messages, ensuring secure communication between components while maintaining the principle of least privilege. Encore Cloud fully manages all subscriptions and topics, handling the complex setup and ongoing maintenance of your messaging infrastructure, allowing you to focus on your application logic rather than infrastructure management.
+
+### Object Storage
+
+Encore Cloud leverages [Google Cloud Storage][gcp-gcs] for object storage needs. When you declare storage buckets in your application, Encore Cloud automatically provisions them with unique names in GCP. Each service that interacts with storage is configured with precisely scoped permissions, ensuring secure access to only the buckets and operations it requires. For public buckets, Encore Cloud integrates with Cloud CDN to optimize content delivery, with each bucket accessible through a unique URL. This comprehensive setup provides secure, efficient, and easily manageable object storage capabilities for your application.
+
+### Caching
+
+Encore Cloud uses [GCP Memorystore for Redis][gcp-redis] to provide a high-performance caching solution. Each Redis instance starts with the smallest available configuration to optimize costs while maintaining the ability to automatically scale up resources as your application's caching needs grow. The instances are configured in a high-availability setup to ensure your cache remains available and performant even during infrastructure updates or zone outages. Access to the cache is secured through Redis authentication, with credentials automatically managed and rotated by Encore Cloud to maintain a strong security posture.
+
+### Cron Jobs
+
+Encore Cloud provides a streamlined approach to scheduled task execution that prioritizes both simplicity and security. Each cron job is executed through authenticated API requests that are cryptographically signed, ensuring that only legitimate, verified requests can trigger your scheduled tasks. The system includes robust source verification that validates all requests originate from Encore Cloud's trusted cron infrastructure. This elegant implementation requires no additional infrastructure components, making it both cost-effective and easy to maintain while providing the reliability and security needed for production workloads.
+
+[gcp-vpc]: https://cloud.google.com/vpc
+[gcp-cloudrun]: https://cloud.google.com/run
+[gcp-gke]: https://cloud.google.com/kubernetes-engine
+[gcp-secrets]: https://cloud.google.com/secret-manager
+[gcp-pubsub]: https://cloud.google.com/pubsub
+[gcp-gcs]: https://cloud.google.com/storage
+[gcp-cloudsql]: https://cloud.google.com/sql
+[gcp-redis]: https://cloud.google.com/memorystore
+[gcp-gcr]: https://cloud.google.com/container-registry
diff --git a/docs/platform/infrastructure/import-cloud-sql.md b/docs/platform/infrastructure/import-cloud-sql.md
new file mode 100644
index 0000000000..125f6273fd
--- /dev/null
+++ b/docs/platform/infrastructure/import-cloud-sql.md
@@ -0,0 +1,58 @@
+---
+seotitle: How to deploy your Encore application with an existing Cloud SQL instance
+seodesc: Learn how to easily import your existing Cloud SQL instance and connect your Encore application to it.
+title: Import an existing Cloud SQL instance
+subtitle: Using your pre-existing database instead of provisioning a new one
+lang: platform
+---
+
+# Overview
+
+When deploying applications to your own cloud, Encore Cloud can provision all necessary infrastructure—including database instances. However, if you already have a Cloud SQL instance, you can connect your Encore application directly to this existing database.
+
+## Benefits
+
+Using an existing Cloud SQL instance allows you to:
+- Maintain data continuity with your existing systems
+- Preserve specific database configurations
+- Utilize familiar database setups without migration
+
+## Importing a Cloud SQL instance
+
+Follow these steps to import your existing Cloud SQL instance:
+
+1. Navigate to **Create Environment** in the [Encore Cloud dashboard](https://app.encore.cloud)
+2. Select the GCP cloud provider
+3. Choose **Import Existing Cloud SQL Instance**
+4. Add permissions for the Encore Service Account:
+   - Copy the `Encore GCP Service Account` from the cloud dashboard
+   - Go to your project's IAM page in the GCP Console
+   - Grant the `Owner` role to the `Encore GCP Service Account`
+5. Return to the Encore Cloud dashboard
+6. Specify your database's `GCP Project ID` and `Cloud SQL Instance Name`
+7. Click the `Resolve` button to validate the instance
+
+Once validated, you can create the environment. When you deploy to this environment, Encore Cloud will automatically connect your application to your imported Cloud SQL instance rather than provisioning a new database.
+
+## Mapping existing databases to your Encore app
+To access an existing database in your Encore application, you need to specify the name of the existing database when you declare the database in your app. For example, if you have an existing database called `mydb` you can create a reference to it like so:
+
+```typescript
+const db = new SQLDatabase("mydb");
+```
+
+```go
+sqldb.NewDatabase("mydb", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+```
+
+## Applying migrations to existing databases
+Encore uses a table called `schema_migrations` in the public namespace to keep track of which migrations have been applied. If you import an existing database without that table, Encore will create it for you and apply your migrations in order. If the table already exists, Encore expects it to contain exactly two columns:
+
+```
+version bigint
+dirty boolean
+```
+
+If the table exists but has a different schema, you will not be able to import it with Encore at this time. If the table exists with an existing entry, Encore will apply all higher versions in your `migrations` directory to the database.
diff --git a/docs/platform/infrastructure/import-kubernetes-cluster.md b/docs/platform/infrastructure/import-kubernetes-cluster.md
new file mode 100644
index 0000000000..93b01ccd5c
--- /dev/null
+++ b/docs/platform/infrastructure/import-kubernetes-cluster.md
@@ -0,0 +1,21 @@
+---
+seotitle: How to deploy your Encore application to an existing Kubernetes cluster
+seodesc: Learn how to easily import your existing Kubernetes cluster and deploy your Encore application into it.
+title: Import an existing Kubernetes cluster
+subtitle: Deploying to your pre-existing cluster instead of provisioning a new one
+lang: platform
+---
+
+When you deploy your application to your own cloud, Encore Cloud can provision infrastructure for it in many different ways – including setting up a Kubernetes cluster.
+
+If you already have a Kubernetes cluster, Encore Cloud can deploy your Encore application into this pre-existing cluster. This is often useful if you want to integrate your Encore application with other parts of your system that are not built using Encore.
+
+Kubernetes imports are supported on GCP, AWS support is coming soon.
+
+## Importing a cluster
+
+To import your cluster, go to **Create Environment** in the [Encore Cloud dashboard](https://app.encore.cloud), select **Kubernetes: Existing GKE Cluster** as the compute platform, and then specify your cluster's `Project ID`, `Region`, and `Cluster Name`.
+
+When you deploy to this environment, Encore Cloud will use your imported cluster as the compute instance.
+
+<img src="/assets/docs/import-k8s.png" title="Import your existing Kubernetes cluster" className="mx-auto"/>
diff --git a/docs/platform/infrastructure/import-project.md b/docs/platform/infrastructure/import-project.md
new file mode 100644
index 0000000000..6c1badb7a0
--- /dev/null
+++ b/docs/platform/infrastructure/import-project.md
@@ -0,0 +1,36 @@
+---
+seotitle: How to deploy your Encore application to an existing GCP project
+seodesc: Learn how to easily import your existing GCP project and connect your Encore application to it.
+title: Import an existing GCP project
+subtitle: Using your pre-existing GCP project instead of provisioning a new one
+lang: platform
+---
+
+# Overview
+
+When deploying applications to your own cloud, Encore Cloud can provision all necessary infrastructure—including new GCP projects. However, if you already have a GCP project, you can deploy your Encore application directly to this existing project.
+
+## Benefits
+
+Using an existing GCP project allows you to:
+- Keep all your infrastructure in a single project
+- Maintain existing IAM policies and permissions
+- Utilize existing billing settings and quotas
+- Consolidate resources for easier management
+
+## Importing a GCP project
+
+Follow these steps to import your existing GCP project:
+
+1. Navigate to **Create Environment** in the [Encore Cloud dashboard](https://app.encore.cloud)
+2. Select the GCP cloud provider
+3. Choose **Import Project**
+4. Add permissions for the Encore Service Account:
+   - Copy the `Encore GCP Service Account` from the cloud dashboard
+   - Go to your project's IAM page in the GCP Console
+   - Grant the `Owner` role to the `Encore GCP Service Account`
+5. Return to the Encore Cloud dashboard
+6. Enter your `Project ID` 
+7. Click the `Resolve` button to validate the project
+
+Once validated, you can create the environment. When you deploy to this environment, Encore Cloud will automatically deploy your application to your imported GCP project rather than provisioning a new one. 
\ No newline at end of file
diff --git a/docs/platform/infrastructure/import-rds.md b/docs/platform/infrastructure/import-rds.md
new file mode 100644
index 0000000000..7f871a8170
--- /dev/null
+++ b/docs/platform/infrastructure/import-rds.md
@@ -0,0 +1,54 @@
+---
+seotitle: How to deploy your Encore application with an existing AWS RDS instance
+seodesc: Learn how to easily import your existing AWS RDS instance and connect your Encore application to it.
+title: Import an existing AWS RDS instance
+subtitle: Using your pre-existing database instead of provisioning a new one
+lang: platform
+---
+
+# Overview
+
+When deploying applications to your own cloud, Encore Cloud can provision all necessary infrastructure—including database instances. However, if you already have an AWS RDS instance, you can connect your Encore application directly to this existing database.
+
+## Benefits
+
+Using an existing AWS RDS instance allows you to:
+- Maintain data continuity with your existing systems
+- Preserve specific database configurations
+- Utilize familiar database setups without migration
+
+## Importing an AWS RDS instance
+
+Follow these steps to import your existing AWS RDS instance:
+
+1. Navigate to **Create Environment** in the [Encore Cloud dashboard](https://app.encore.cloud)
+2. Select the AWS cloud provider
+3. Pick the `AWS Region` your database resides in
+3. Choose **Import Existing RDS Instance**
+4. Specify your database's `RDS Instance Name`
+5. Click the `Resolve` button to validate the instance
+
+Once validated, you can create the environment. When you deploy to this environment, Encore Cloud will automatically connect your application to your imported AWS RDS instance rather than provisioning a new database.
+
+## Mapping existing databases to your Encore app
+To access an existing database in your Encore application, you need to specify the name of the existing database when you declare the database in your app. For example, if you have an existing database called `mydb` you can create a reference to it like so:
+
+```typescript
+const db = new SQLDatabase("mydb");
+```
+
+```go
+sqldb.NewDatabase("mydb", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+```
+
+## Applying migrations to existing databases
+Encore uses a table called `schema_migrations` in the public namespace to keep track of which migrations have been applied. If you import an existing database without that table, Encore will create it for you and apply your migrations in order. If the table already exists, Encore expects it to contain exactly two columns:
+
+```
+version bigint
+dirty boolean
+```
+
+If the table exists but has a different schema, you will not be able to import it with Encore at this time. If the table exists with an existing entry, Encore will apply all higher versions in your `migrations` directory to the database.
diff --git a/docs/platform/infrastructure/infra.md b/docs/platform/infrastructure/infra.md
new file mode 100644
index 0000000000..607512366b
--- /dev/null
+++ b/docs/platform/infrastructure/infra.md
@@ -0,0 +1,108 @@
+---
+seotitle: Cloud Infrastructure Provisioning
+seodesc: Learn how to provision appropriate cloud infrastructure depending on the environment type for AWS and GCP.
+title: Infrastructure provisioning & Environments
+subtitle: How Encore Cloud provisions infrastructure for your application
+lang: platform
+---
+
+Encore Cloud automatically provisions all necessary infrastructure, in all environments and across all major cloud providers, without requiring application code changes. You simply [connect your cloud account](/docs/platform/deploy/own-cloud) and create an environment.
+
+<img src="/assets/docs/encore_overview.png" title="Infrastructure Overview" className="noshadow"/>
+
+## How it works
+
+This is powered by Encore's open source [backend framework](/docs/ts), which lets you declare infrastructure resources (databases, caches, queues, scheduled jobs, etc.) as type-safe objects in application code.
+
+At compile time, Encore parses the application code to generate an [Application Model](/docs/ts/concepts/application-model), and Encore Cloud uses this meta data to create an infrastructure graph with a high-resolution definition of the infrastructure your application requires.
+
+Encore Cloud then uses this graph to provision and manage the necessary infrastructure in your cloud account (using AWS and GCP APIs), and in development and preview environments hosted by Encore Cloud.
+
+<img src="/assets/docs/howitworks.png" title="Infrastructure Provisioning"/>
+
+
+The approach removes the need for infrastructure configuration files and avoids creating cloud-specific dependencies in your application.
+
+Having an end-to-end integration between application code and infrastructure also enables Encore Cloud to keep environments in sync and track cloud infrastructure, giving you an up-to-date view of your infrastructure to avoid unnecessary cloud costs.
+
+<img src="/assets/docs/infra_config_new.png" title="Infrastructure Tracking"/>
+
+## Environment types
+
+By default, Encore Cloud provisions infrastructure using contextually appropriate objectives for each environment type. You retain control over the infrastructure in your cloud account, and can configure it directly both via the Encore Cloud dashboard and your cloud provider's console. Encore Cloud takes care of syncing your changes.
+
+|                        | Local              | Encore Cloud Hosting       | GCP / AWS                          |
+| ---------------------- | ------------------ | -------------------------- | ---------------------------------- |
+| **Environment types:** | Development        | Preview, Development       | Development, Production            |
+| **Objectives:**        | Provisioning speed | Provisioning speed, Cost\* | Reliability, Security, Scalability |
+
+\*Encore Cloud Hosting is free to use, subject to Fair Use guidelines and usage limits. [Learn more](/docs/platform/management/usage)
+
+## Development Infrastructure
+
+Encore Cloud provisions infrastructure resources differently for each type of development environment.
+
+|                     | Local                             | Preview / Development (Encore Cloud Hosting)                 | GCP / AWS                                                      |
+| ------------------- | --------------------------------- | ------------------------------------------------------------ | -------------------------------------------------------------- |
+| **SQL Databases:**  | Docker                            | Encore Cloud Managed (Kubernetes), [Neon](/docs/deploy/neon) | [See production](/docs/deploy/infra#production-infrastructure) |
+| **Pub/Sub:**        | In-memory ([NSQ](https://nsq.io)) | GCP Pub/Sub                                                  | [See production](/docs/deploy/infra#production-infrastructure) |
+| **Caches:**         | In-memory (Redis)                 | In-memory (Redis)                                            | [See production](/docs/deploy/infra#production-infrastructure) |
+| **Cron Jobs:**      | Disabled                          | [Encore Cloud Managed](/docs/primitives/cron-jobs)           | [See production](/docs/deploy/infra#production-infrastructure) |
+| **Object Storage:** | Local Disk                        | Encore Cloud Managed                                         | [See production](/docs/deploy/infra#production-infrastructure) |
+
+
+### Local Development
+
+For local development Encore Cloud provisions a combination of Docker and in-memory infrastructure components.
+SQL Databases are provisioned using [Docker](https://docker.com). For Pub/Sub
+and Caching the infrastructure is run in-memory.
+
+When running tests, a separate SQL Database cluster is provisioned that is optimized for high performance
+(using an in-memory filesystem and fsync disabled) at the expense of reduced reliability.
+
+To avoid surprises during development, Cron Jobs are not triggered in local environments.
+They can always be triggered manually by calling the API directly from the [development dashboard](/docs/ts/observability/dev-dash).
+
+The application code itself is compiled and run natively on your machine (without Docker).
+
+### Preview Environments
+
+When you've [connected your application to GitHub](/docs/platform/integrations/github), Encore Cloud automatically provisions a temporary [Preview Environment](/docs/platform/deploy/preview-environments) for each Pull Request.
+
+Preview Environments are created in Encore Cloud Hosting, and are optimized for provisioning speed and cost-effectiveness.
+The Preview Environment is automatically destroyed when the Pull Request is merged or closed.
+
+Preview Environments are named after the pull request, so PR #72 will create an environment named `pr:72`.
+
+### Encore Cloud Hosting
+
+Encore Cloud Hosting is a simple, zero-configuration hosting solution provided by Encore.
+It's perfect for development environments and small-scale use that do not require any specific SLAs.
+It's also a great way to evaluate Encore Cloud without needing to connect your cloud account.
+
+Encore Cloud Hosting is not designed for business-critical use and does not offer reliability guarantees for persistent storage
+like SQL Databases. Other infrastructure primitives like Pub/Sub and Caching
+are provisioned with small-scale use in mind.
+
+[Learn more about the usage limitations](/docs/platform/management/usage)
+
+## Production Infrastructure
+
+Encore Cloud provisions production infrastructure resources using best-practice guidelines and services for each respective cloud provider.
+
+|                     | GCP                                                                                                                                | AWS                                                                                                            |
+| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
+| **Networking:**     | [VPC](/docs/platform/infrastructure/gcp#networking-architecture)                                                                   | [VPC](/docs/platform/infrastructure/aws#networking-architecture)                                               |
+| **Compute:**        | [Cloud Run](/docs/platform/infrastructure/gcp#google-cloud-run), [GKE](/docs/platform/infrastructure/gcp#google-kubernetes-engine) | [Fargate ECS](/docs/platform/infrastructure/aws#aws-fargate), [EKS](/docs/platform/infrastructure/aws#aws-eks) |
+| **SQL Databases:**  | [GCP Cloud SQL](/docs/platform/infrastructure/gcp#databases), [Neon](/docs/platform/infrastructure/neon)                           | [Amazon RDS](/docs/platform/infrastructure/aws#databases), [Neon](/docs/platform/infrastructure/neon)          |
+| **Pub/Sub:**        | [GCP Pub/Sub](/docs/platform/infrastructure/gcp#pubsub)                                                                            | [Amazon SQS & Amazon SNS](/docs/platform/infrastructure/aws#pubsub)                                            |
+| **Object Storage:** | [GCS/Cloud CDN](/docs/platform/infrastructure/gcp#object-storage)                                                                  | [Amazon S3/CloudFront](/docs/platform/infrastructure/aws#object-storage)                                       |
+| **Caches:**         | [GCP Memorystore (Redis)](/docs/platform/infrastructure/gcp#caching)                                                               | [Amazon ElastiCache (Redis)](/docs/platform/infrastructure/aws#caching)                                        |
+| **Cron Jobs:**      | Encore Cloud Managed                                                                                                               | Encore Cloud Managed                                                                                           | Encore Cloud Managed |
+| **Secrets:**        | [Secret Manager](/docs/platform/infrastructure/gcp#secrets-management)                                                             | [AWS Secrets Manager](/docs/platform/infrastructure/aws#se)                                                    |
+
+### Configuration
+
+With Encore you do not define any cloud service specifics in the application code. This means that after deploying, you can safely use your cloud provider's console to modify the provisioned resources, or use the built-in configuration UI in the Encore Cloud dashboard.
+
+Learn more in the [Infrastructure Configuration](/docs/platform/infrastructure/configuration) documentation.
\ No newline at end of file
diff --git a/docs/platform/infrastructure/kubernetes.md b/docs/platform/infrastructure/kubernetes.md
new file mode 100644
index 0000000000..db6c5f71d4
--- /dev/null
+++ b/docs/platform/infrastructure/kubernetes.md
@@ -0,0 +1,71 @@
+---
+seotitle: How to deploy your Encore application to a new Kubernetes cluster
+seodesc: Learn how to automatically deploy your Encore application to a new Kubernetes cluster.
+title: Kubernetes deployment
+subtitle: Deploying your app to a new Kubernetes cluster
+lang: platform
+---
+
+# Deploying Encore Apps to Kubernetes
+
+Encore Cloud gives you flexibility in where you run your applications. You have two options for Kubernetes deployments:
+
+1. **Deploy to a new cluster**: Encore Cloud can automatically provision and manage a new Kubernetes cluster in your cloud account on AWS or GCP.
+2. **Use an existing cluster**: Deploy to your pre-existing Kubernetes cluster ([see instructions here](/docs/platform/infrastructure/import-kubernetes-cluster))
+
+All infrastructure provisioning is automated, and configuration is managed through the [Encore Cloud Dashboard](https://app.encore.cloud), keeping your application code clean and infrastructure-agnostic.
+
+## Deploying to a new Kubernetes cluster
+
+**1. Connect your cloud account:** Ensure your cloud account (Google Cloud Platform or AWS) is connected to Encore Cloud. ([See docs](/docs/platform/deploy/own-cloud))
+
+**2. Create environment:** Open your app in the [Encore Cloud dashboard](https://app.encore.cloud) and go to **Environments**, then click on **Create Environment**.
+
+Next, select your cloud (AWS or GCP) and then specify Kubernetes as the compute platform. Encore Cloud supports deploying to GKE on GCP, and EKS Fargate on AWS.
+
+You can also configure if you want to allocate all services in one process or run one process per service.
+
+<img src="/assets/docs/k8s-config.jpg" title="Environment Settings" className="mx-auto"/>
+
+**3. Push your code:** To deploy, commit and push your code to the branch you configured as the deployment trigger. You can also trigger a manual deploy from the Cloud Dashboard by going to the **Environment Overview** page and clicking on **Deploy**.
+
+**4. Automatic deployment by Encore Cloud:** Once you've triggered the deploy, Encore Cloud will automatically provision and deploy the necessary infrastructure on Kubernetes, per your environment configuration in the Cloud Dashboard. You can monitor the status of your deploy and view your environment's details through the Encore Cloud Dashboard.
+
+**5. Accessing your cluster with kubectl:** You can access your cluster using the `kubectl` CLI tool. [See the docs](/docs/platform/infrastructure/configure-kubectl) for how to do this.
+
+## Infrastructure Overview
+
+Encore Cloud simplifies the process of deploying applications by automatically provisioning and managing the necessary Kubernetes components. Here's an overview of the components Encore Cloud manages and how they work together to support your applications.
+
+### Namespace Management
+
+Encore Cloud creates a unique namespace for each environment deployed to your Kubernetes cluster, ensuring complete isolation between different environments of your application.
+
+### Secrets Management
+
+Encore Cloud provides comprehensive secrets management through deep integration with Kubernetes Secrets. Application secrets that you configure in Encore Cloud are automatically stored as Kubernetes Secrets and made available to your services at runtime. This includes both application-specific secrets that you define, as well as infrastructure secrets like database credentials that Encore Cloud manages automatically.
+
+Service accounts are automatically bound to the appropriate secrets they need access to, ensuring each service can only access the secrets it requires. This follows the principle of least privilege and helps maintain a strong security posture.
+
+### Ingress Configuration
+
+Encore Cloud provisions and manages ingress for your applications through a cloud provider-specific ingress controller. The ingress controller is automatically configured to handle incoming traffic and route it securely to your application's Encore Gateway service. It manages TLS certificates automatically to ensure all traffic is encrypted, and provides fine-grained control over which services are accessible from the public internet. The controller configuration is optimized for your specific cloud provider to ensure the best possible performance and reliability.
+
+## Service Management
+
+### Deployments
+Encore Cloud manages the deployment configuration for each service in your application. Each service is deployed as a separate Kubernetes deployment, allowing for independent scaling and management. The deployment configurations are automatically generated and optimized based on your service's requirements.
+
+For each service, Encore Cloud configures the pod specifications with appropriate resource requests and limits, health checks, and container settings. Runtime configurations like environment variables and command arguments are automatically set based on your application's needs. The container orchestration is handled seamlessly, with Encore Cloud managing pod scheduling, updates, and scaling to ensure your services run reliably and efficiently.
+
+### Network Configuration
+
+Encore Cloud provides a comprehensive networking setup through Kubernetes Service resources. Each service in your application gets assigned a unique cluster IP address, enabling reliable internal communication between services. This IP allocation works in conjunction with Kubernetes' built-in service discovery mechanism, allowing services to locate and communicate with each other using consistent internal DNS names. The internal service routing ensures that requests are efficiently distributed across all available pods for each service, providing automatic load balancing and failover capabilities.
+
+### Identity and Access
+
+Encore Cloud provides comprehensive service identity management through Kubernetes service accounts. Each pod is assigned its own dedicated service account, which handles authentication with the Kubernetes API and enables secure access to resources. These service accounts are automatically bound to the specific secrets and permissions required by each service.
+
+For cloud provider integration, Encore Cloud maps the service accounts to appropriate IAM roles, enabling secure access to cloud resources like databases and object storage. Following the principle of least privilege, Encore Cloud configures the minimum required permissions for each service account, ensuring services can only access the resources they explicitly need.
+
+All these configurations are automatically maintained and updated by Encore Cloud as you develop your application, ensuring your infrastructure stays aligned with your application's needs.
\ No newline at end of file
diff --git a/docs/platform/infrastructure/manage-db-users.md b/docs/platform/infrastructure/manage-db-users.md
new file mode 100644
index 0000000000..34eb453bae
--- /dev/null
+++ b/docs/platform/infrastructure/manage-db-users.md
@@ -0,0 +1,25 @@
+---
+seotitle: Managing database user credentials
+seodesc: Learn how to manage user credentials for databases created by Encore.
+title: Managing database user credentials
+lang: platform
+---
+
+Encore Cloud provisions your databases automatically, meaning you don't need to manually create database users. However, in some use cases you need access to the database user credentials, so Encore Cloud makes it simple to view them.
+
+As an application **Admin**, open the [Encore Cloud dashboard](https://app.encore.cloud) and go to the **Infrastructure** page for the relevant environment.
+
+In the section for the relevant **Database Cluster**, you will find a **Users** sub-section which lists your database users. Click on the "eye" icon next to each username to decrypt the password.
+
+Note that databases hosted in [Encore Cloud](/docs/platform/infrastructure/infra#encore-cloud) currently do not expose usernames and passwords.
+To connect to an Encore Cloud-hosted database, use [`encore db shell`](/docs/ts/primitives/databases#connecting-to-databases).
+
+`encore db shell` defaults to read-only permissions. Use `--write`, `--admin` and `--superuser` flags to modify which permissions you connect with.
+
+<img src="/assets/docs/db-user.png" title="View Database User Credentials"/>
+
+<Callout type="important">
+
+Do not change or remove the database users created by Encore, as this will prevent Encore Cloud from maintaining and handling connections to the databases in your application.
+
+</Callout>
diff --git a/docs/platform/infrastructure/neon.md b/docs/platform/infrastructure/neon.md
new file mode 100644
index 0000000000..81369da328
--- /dev/null
+++ b/docs/platform/infrastructure/neon.md
@@ -0,0 +1,151 @@
+---
+seotitle: Neon Postgres Database
+seodesc: Learn how to configure your environment to provision a Neon Postgres database.
+title: Use Neon Postgres
+lang: platform
+---
+
+[Neon](https://neon.tech/) is a serverless database provider that offers a fully managed and autoscalable
+Postgres database.
+
+You can configure Encore Cloud to provision a Neon Postgres database instead of the default offering for all supported cloud providers.
+
+## Connect your Neon account
+To start using Neon with Encore Cloud, you need to add your Neon API key to your Encore Cloud application. You can sign up for
+a Neon account at [neon.tech](https://neon.tech/). Once you have an account, you can find your API key in the
+[Neon Console](https://neon.tech/docs/manage/api-keys)
+
+Then, head over to the Neon settings page by going to the
+[Encore Cloud dashboard](https://app.encore.cloud) > (Select your app) > App Settings > Integrations > Neon.
+
+Click the "Connect Account" button, give it a name, and enter your API key.
+
+<img src="/assets/docs/connect-neon.png" title="Connect Neon Account" className="mx-auto"/>
+
+## Creating environments using Neon
+Neon organizes databases in projects. A project consist of a main branch and any number of feature branches.
+[Branches](https://neon.tech/docs/introduction/branching) in Neon are similar to branches in git, letting you to create a new branch for each feature or bug fix, to test your changes in isolation.
+
+When configuring your Encore Cloud environment to use Neon, you can choose which project and branch to use. To get started,
+head to the [Encore Cloud dashboard](https://app.encore.cloud) > (Select your app) > Environments > Create Environment. In the Database section, select
+`Neon database`.
+
+<img src="/assets/docs/create-neon.png" title="Create Neon Environment" className="mx-auto"/>
+
+### Create a new Neon project and branch
+If you're starting off a blank slate, you can let Encore Cloud create a new Neon project and branch for you.
+Select `New Neon project` and choose a Neon account and region. We recommend picking a region close to your compute and
+that you use the suggested project and branch names, but you're free to choose any configuration you like.
+
+### Branch from an existing Encore Cloud environment
+If you already have an Encore Cloud environment with Neon, you can branch your database from that environment.
+Simply select `Branch from Encore environment` and choose the environment you want to branch from. This option will
+be disabled if you don't have any environments using Neon.
+
+### Branch from an existing Neon branch
+You can also choose to manually select a Neon branch to branch from. This is useful if you have an existing Neon project,
+but it's not currently being used by any Encore Cloud environments. Select `Branch from Neon project`,
+then choose the account, project and branch you want to use.
+
+### Import an existing Neon branch
+The final option is to import an existing Neon branch. This is useful if you have an existing database you want to use.
+Be wary that this option will not create a new branch but operate on the existing data. Select `Import Neon branch`,
+then choose the account, project and branch you want to use.
+
+**Note:** You may need to manually adjust the roles, commonly you need to change the database owner to the `db_<db_name>_admin` role to enable execution of migrations.
+See more in the [Roles](#roles) section below.
+
+## Edit your Neon environment
+Once the environment is created, you can edit the Neon settings by going to the [Encore Cloud dashboard](https://app.encore.cloud) > (Select your app) > Environments > (Select your environment) > Infrastructure.
+Here you can view and edit your Neon account resources. As a safety precaution, we've disabled editing of imported
+resources to prevent accidental changes to shared data.
+
+<img src="/assets/docs/edit-neon.png" title="Edit Neon Environment" className="mx-auto"/>
+
+### Neon project
+The retention history specifies how long Neon will keep changes to your data. The default is 1 day, but depending on your
+Neon plan, you can increase this to up to 30 days.
+
+### Neon endpoint
+Each branch is assigned a unique endpoint which essentially is the serverless compute handling your database.
+You can edit the endpoint to set the CPU limits and the suspend timeout. The suspend timeout is the time Neon will wait
+before suspending the compute when it's not in use. The default is 5 minutes, but you can increase this to up to a week
+(depending on your Neon plan).
+
+## Use Neon for Preview Environments
+Neon is a great choice for [Preview Environments](/docs/platform/deploy/preview-environments) as it allows you to branch off a populated
+database and test your changes in isolation.
+
+To configure which branch to use for Preview Environments, head to the
+[Encore Cloud dashboard](https://app.encore.cloud) > (Select your app) > App Settings > Preview Environments
+and select the environment with the database you want to branch from. Hit save and you're all done.
+
+Keep in mind that you can only branch from environments that use Neon as the database provider; this is the default for Encore Cloud environments, but is a configurable option when creating AWS and GCP environments.
+
+<img src="/assets/docs/pr-neon.png" title="Use Neon for Preview Environments" className="mx-auto"/>
+
+## Roles
+
+Encore Cloud automatically implements a structured role hierarchy that ensures a secure, scalable, and efficient management of databases.
+Below is an explanation of how roles are created, utilized, and managed.
+
+### Role hierarchy
+
+#### 1. Initial Superuser Role
+- **Role Name:** `encore_platform`
+  - **Access level:** This role has full privileges and is the foundational user for setting up the role hierarchy.
+  - **Purpose:** The role creates and configures the subsequent roles and then steps back from day-to-day operations.
+
+#### 2. Global Roles
+Three core roles are created to define access levels across all databases:
+
+- `encore_reader`
+  - **Access level:** Provides read-only access.
+  - **Use Case:** Reading data without modifying it.
+- `encore_writer`
+  - **Access level:** Allows read and write access.
+  - **Use Case:** Performing data manipulations and inserts.
+- `encore_admin`
+  - **Access level:** Grants administrative privileges for global database operations.
+  - **Use Case:** Overseeing configurations, managing schemas, and handling elevated tasks.
+
+These global roles are used by Encore's CLI when using the `encore db shell` command.
+Learn more in the [CLI docs](/docs/ts/primitives/databases#using-the-encore-cli).
+
+#### 3. Database-Specific Roles
+For each database within the Neon integration, specific roles are created to provide fine-grained control:
+   - `db_<db_name>_reader`: Read-only access to the main database.
+   - `db_<db_name>_writer`: Read and write access to the main database.
+   - `db_<db_name>_admin`: Administrative privileges specific to the main database.
+
+#### 4. Service-Specific Roles
+For each service in your application, a dedicated role is generated in the format `svc_<name>`. This role is granted the necessary `db_<db_name>_writer` role for each database the service accesses.
+
+This ensures that each service has the appropriate level of access to perform its operations while maintaining security and separation of concerns.
+
+**Example:** A service named `orders` that writes to the `main` database is assigned the `svc_orders` role, which is granted the `db_main_writer` role.
+
+### Role Setup Workflow
+
+- **1. Superuser Creation:** the `encore_platform` superuser role is created upon integration setup.
+- **2. Global Role Creation:** The `encore_reader`, `encore_writer`, and `encore_admin` roles are established to provide general access control.
+- **3. Database-Specific Roles:** For each database, roles are created in the format `db_<db_name>_<access_level>` to manage access specific to that database.
+- **4. Service-Specific Roles:** For each service, roles are created in the format `svc_<name>` and are granted the necessary writer roles for the databases used by each service.
+
+### Viewing credentials
+
+To view database credentials, open your app in the [Encore Cloud dashboard](https://app.encore.cloud), navigate to the **Infrastructure page** for the appropriate **Environment**, and locate the **USERS** section within the relevant **Database Cluster**.
+
+
+### Best Practices
+
+Encore Cloud automatically manages roles according to these security best practices:
+
+- **Role Ownership:** Ensures critical operations, such as migrations, are executed by roles with appropriate permissions (e.g., `db_<db_name>_admin`).
+- **Access Control:** Assigns the least privilege necessary for each task. Uses specific database roles (e.g., `db_<db_name>_reader`) to restrict access.
+- **Consistency:** Maintains consistent naming conventions (`db_<db_name>_<access_level>`) for ease of management and troubleshooting.
+
+### Integrating with existing Neon databases
+
+If you are integrating with an existing Neon database, you may need to manually adjust the roles to work with Encore Cloud's role structure.
+Commonly, the adjustment needed is changing the database owner to the `db_<db_name>_admin` role to enable execution of migrations.
diff --git a/docs/platform/integrations/api-reference.md b/docs/platform/integrations/api-reference.md
new file mode 100644
index 0000000000..3b37d27330
--- /dev/null
+++ b/docs/platform/integrations/api-reference.md
@@ -0,0 +1,300 @@
+---
+seotitle: Encore Cloud API Reference
+seodesc: Learn how to use the Encore Cloud API.
+title: Encore Cloud API Reference
+lang: platform
+---
+
+Encore Cloud provides an API for programmatic access to control certain parts of the platform.
+
+We're working on expanding the set of features available over the API.
+Please reach out to us [on Discord](https://encore.dev/discord) if you have use cases where additional API functionality would be useful.
+
+The Base URL for the Encore Cloud API is `https://api.encore.cloud`.
+
+## Authentication
+
+All API calls require valid authentication, which is provided by sending an access token in the `Authorization` header,
+in the format `Authorization: Bearer ${ACCESS_TOKEN}`.
+
+You can retrieve an API access token from the OAuth Token endpoint, using an OAuth Client.
+An API access token expires after one hour. For continuous access, shortly before an API access token expires, request a new API access token from Encore Cloud's OAuth token endpoint.
+
+OAuth client libraries in popular programming languages can handle the API access token generation and renewal.
+
+See the [OAuth Clients](/docs/platform/integrations/oauth-clients) for more information on creating OAuth Clients.
+
+## OAuth
+
+**Method**: `POST` <br/>
+**Path**: `/api/oauth/token`
+
+#### Query Parameters
+
+| Parameter         | Description                                                    |
+| ----------------- | -------------------------------------------------------------- |
+| **client_id**     | The client id of the OAuth Client to generate a token for.     |
+| **client_secret** | The client secret of the OAuth Client to generate a token for. |
+
+#### Response
+
+The API responds with a 2xx status code on successful creation of an API access token.
+
+```typescript
+type Token = {
+  // The access token itself.
+  "access_token": string;
+
+  // The access token expires after 1 hour (3600 seconds).
+  "expires_in": 3600;
+
+  // The actor the token belongs to, in this case the OAuth2 client id.
+  actor: string;
+
+
+  // Indicates the access token should be passed as a "Bearer" token in the Authorization header.
+  "token_type": "Bearer";
+}
+```
+
+## Rollouts
+
+Encore Cloud's deployment system consists of several phases:
+
+* A build phase
+* An infrastructure provisioning phase
+* A deployment phase
+
+These phases are combined into a unified entity called a *Rollout*.
+A rollout represents the coordinated process of rolling out a specific version of an Encore application.
+
+We use the term *rollout* to disambiguate from the *deployment phase*, which specifically
+refers to the last phase of the rollout process (where the version is being deployed onto the provisioned infrastructure).
+
+### The Rollout Object
+
+The Rollout object represents the state of a rollout.
+
+```typescript
+// The representation of a rollout.
+type Rollout = {
+  // Unique id of the rollout.
+  id: string;
+
+  // The current status of the rollout.
+  status: "pending" | "queued" | "running" | "completed";
+
+  // What the conclusion was of the rollout (when status is "completed").
+  // If the status is not "completed" the conclusion is "pending".
+  conclusion: "pending" | "canceled" | "failure" | "success";
+
+  // When the rollout was queued, started, and completed.
+  queued_at: Date | null;
+  started_at: Date | null;
+  completed_at: Date | null;
+
+  // Information about the various rollout phases.
+  // See type definitions below.
+  build: RolloutPhase<BuildStatus, BuildConclusion>;
+  infra: RolloutPhase<InfraStatus, InfraConclusion>;
+  deploy: RolloutPhase<DeployStatus, DeployConclusion>;
+}
+
+// Common structure of the various rollout phases.
+type RolloutPhase<Status, Conclusion> = {
+  // Unique id of the phase.
+  id: string;
+
+  // The current status of the rollout phase.
+  status: Status;
+
+  // What the conclusion was of the phase.
+  conclusion: Conclusion;
+
+  // When the phase was queued, started, and completed.
+  queued_at: Date | null;
+  started_at: Date | null;
+  completed_at: Date | null;
+}
+
+// The current status and conclusion of a build.
+// If the status is not "completed" the conclusion is "unknown".
+type BuildStatus = "queued" | "running" | "completed";
+type BuildConclusion = "unknown" | "canceled" | "failure" | "success";
+
+// The current status and conclusion of an infra change.
+// The "proposed" status means the change is awaiting human approval.
+// The "rejected" conclusion means a human rejected the proposed infra change.
+type InfraStatus = "pending" | "proposed" | "queued" | "running" | "completed";
+type InfraConclusion = "unknown" | "canceled" | "failure" | "rejected" | "success";
+
+// The current status and conclusion of a deploy.
+// If the status is not "completed" the conclusion is "unknown".
+type DeployStatus = "queued" | "running" | "completed";
+type DeployConclusion = "unknown" | "canceled" | "failure" | "success";
+```
+
+### Triggering a rollout
+
+**Method**: `POST` <br/>
+**Path**: `/api/apps/${APP_ID}/envs/${ENV_NAME}/rollouts`
+
+#### Path Parameters
+
+| Parameter    | Description                                                |
+| ------------ | ---------------------------------------------------------- |
+| **APP_ID**   | The id of the Encore application to trigger a rollout for. |
+| **ENV_NAME** | The name of the environment to trigger a rollout for.      |
+
+#### JSON Request Body
+A rollout can be triggered either with a commit sha or the name of a branch,
+depending on the JSON field passed in. Exactly one of these must be provided.
+
+```typescript
+{
+  // The commit hash to trigger a deploy for.
+  "sha": string;
+} | {
+  // Name of the branch to trigger a deploy from.
+  "branch": string;
+}
+```
+
+#### Response
+
+The API responds with a 2xx status code on successful creation of a new rollout.
+
+On success it returns a **Rollout** object as its JSON response payload,
+representing the current state of the newly created rollout.
+
+## Member Management
+
+Encore Cloud provides APIs for managing application members, including inviting users, listing members, and updating member roles.
+
+### Member Object
+
+```typescript
+type Member = {
+  // The user's email address
+  email: string;
+
+  // The member's role in the application
+  role: "owner" | "reader" | "writer" | "none";
+
+  // When the member was invited to the application
+  invited: timestamp;
+
+  // When the member accepted the invitation
+  accepted: timestamp;
+
+  // When the membership expires
+  expires: timestamp;
+
+  // The member's username
+  username: string;
+
+  // The member's full name
+  full_name: string;
+
+  // The member's picture URL
+  picture_url: string;
+}
+```
+
+### Available Roles
+
+- **owner**: Full control over the application
+- **writer**: Can write application resources
+- **reader**: Can read application resources
+- **none**: Used to revoke access to an application
+
+### Invite Member
+
+Invite a new member to an Encore application.
+
+**Method**: `POST` <br/>
+**Path**: `/api/apps/${APP_ID}/member`
+
+#### Path Parameters
+
+| Parameter  | Description                                    |
+| ---------- | ---------------------------------------------- |
+| **APP_ID** | The id of the Encore application.             |
+
+#### JSON Request Body
+
+```typescript
+{
+  // The email address of the user to invite
+  "email": string;
+
+  // The role to assign to the invited member
+  "role": "owner" | "reader" | "writer" | "none";
+}
+```
+
+#### Response
+
+The API responds with a 2xx status code on successful invitation.
+
+On success it returns a **Member** object as its JSON response payload,
+representing the newly invited member.
+
+### List Members
+
+Retrieve a list of all members for an Encore application.
+
+**Method**: `GET` <br/>
+**Path**: `/api/apps/${APP_ID}/members`
+
+#### Path Parameters
+
+| Parameter  | Description                                    |
+| ---------- | ---------------------------------------------- |
+| **APP_ID** | The id of the Encore application.             |
+
+#### Response
+
+The API responds with a 2xx status code on success.
+
+On success it returns an array of **Member** objects as its JSON response payload,
+representing all current members and pending invites for the application.
+
+```typescript
+type Response = Member[];
+```
+
+### Update Member Role
+
+Update the role of an existing member.
+
+**Method**: `PUT` <br/>
+**Path**: `/api/apps/${APP_ID}/members`
+
+#### Path Parameters
+
+| Parameter  | Description                                    |
+| ---------- | ---------------------------------------------- |
+| **APP_ID** | The id of the Encore application.             |
+
+#### JSON Request Body
+
+```typescript
+{
+  // The email address of the member to update
+  "email": string;
+
+  // The new role to assign to the member
+  "role": "owner" | "reader" | "writer" | "none";
+}
+```
+
+#### Response
+
+The API responds with a 2xx status code on successful update.
+
+#### Error Cases
+
+- **403 Forbidden**: Insufficient permissions to manage members
+- **409 Conflict**: Attempting to remove the last owner (error detail: "last_owner")
+- **404 Not Found**: Member not found
diff --git a/docs/platform/integrations/auth-keys.md b/docs/platform/integrations/auth-keys.md
new file mode 100644
index 0000000000..c9ec322eb2
--- /dev/null
+++ b/docs/platform/integrations/auth-keys.md
@@ -0,0 +1,56 @@
+---
+seotitle: Auth Keys let you authenticate without a browser
+seodesc: Learn how to use pre-authentication keys to authenticate without needing to sign in via a web browser. See how to setup reusable and ephemeral auth keys.
+title: Generating Auth Keys
+lang: platform
+---
+
+Pre-authentication keys (“auth keys” for short) let you authenticate the Encore CLI without needing to sign in via a web browser. This is most useful when setting up CI/CD pipelines.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/authkeys.mp4" className="w-full h-full" type="video/mp4" />
+</video>
+
+## Types of auth keys
+
+- **Reusable Keys** for authenticating more than one machine.
+
+- **Ephemeral Keys** - Machines authenticated by this key will be automatically logged out after one hour.
+
+<Callout type="important">
+
+**Be very careful with reusable keys!** These can be very dangerous if stolen. They're best kept in a key vault product (eg. 1Password, LastPass) specifically designed for the purpose.
+
+</Callout>
+
+## Authentication
+
+**Auth keys** authenticate a machine as the Encore app for which the key was generated. If Ada generates an auth key, and uses it to set up her CI/CD pipeline, then that machine is authenticated as Ada's Encore app.
+
+## Generating a key
+
+### Step 1: Generate an auth key
+
+As an Encore user, visit the auth key page by going to **[Your apps](https://app.encore.cloud/) > (Select your app) > App Settings > Auth Keys**.
+
+A key can be both **reusable** and **ephemeral** at the same time (you can decide the combination based on your particular use case).
+
+<Callout type="important">
+
+**Don't forget to store your key!** Once generated, you will need to copy and store your key in a vault product (eg. 1Password, LastPass). We do not display the full contents of a key in our dashboard for security reasons.
+
+</Callout>
+
+This page also gives you the ability to revoke existing keys.
+
+### Step 2: Authenticate with the auth key
+
+Using the Encore CLI, you can authenticate with your newly generated key:
+
+```shell
+$ encore auth login --auth-key=ena_nEQIkfeM43t7oxpleMsIULbhbtLAbYnnLf1D
+```
+
+## Revoking a key
+
+You can revoke a key simply by pressing the **Delete** button next to it. This will prevent any machines currently using it to authenticate to Encore Cloud (regardless of the key type).
diff --git a/docs/platform/integrations/custom-domains.md b/docs/platform/integrations/custom-domains.md
new file mode 100644
index 0000000000..072e81251d
--- /dev/null
+++ b/docs/platform/integrations/custom-domains.md
@@ -0,0 +1,58 @@
+---
+seotitle: Custom Domains for all your environments
+seodesc: Learn how to setup a custom domain for your cloud environments, to use your own domain to access your backend application built with Encore.
+title: Custom Domains
+subtitle: Expose APIs from your own domain
+lang: platform
+---
+
+By default, all application [environments](/docs/platform/deploy/environments) are accessible as subdomains of the shared Encore domain `encr.app`. When exposing APIs publicly, you often want to provide a URL endpoint branded with your own domain.
+
+Follow these instructions to serve your backend using your own custom domain name. This also has the benefit of providing a built-in Web Application Firewall (WAF) using [Cloudflare WAF](https://www.cloudflare.com/en-gb/application-services/products/waf/).
+
+## Adding a domain
+
+Modify the DNS records for your domain, adding a CNAME record pointing at:
+`custom-domain.encr.app` It's recommended to set a TTL (Time-To-Live) of 30 minutes for the CNAME record.
+
+
+<Callout type="important">
+
+Encore requires that you add a CNAME record for each domain you wish to serve traffic from.
+CNAME record using wildcards, e.g. `*.example.com`, are not currently supported.
+
+</Callout>
+
+Once you've added the CNAME record, go to the Custom Domains settings page by opening
+**[Your apps](https://app.encore.cloud/) > (Select your app) > Settings > Custom Domains**. Click on `Add Domain`
+on the top right of the page.
+
+Enter the domain name you configured the CNAME on and select which [environment](/docs/platform/deploy/environments) you wish to
+serve on that domain, then click `Add`.
+
+Encore will now set up your domain and issue SSL certificates to serve traffic through.
+
+<img src="/assets/docs/customdomain.png" title="Custom Domain Settings" className="noshadow"/>
+
+<Callout type="info">
+
+If you configure multiple domains against a single environment, Encore will serve traffic through all
+configured domains. The `encr.app` subdomain which was created when you originally created an environment will always be
+configured to serve traffic to that environment.
+
+This allows you to migrate to a custom domain safely without risking
+cutting traffic off to older clients which may be hard coded to access your applications via the default subdomain.
+
+</Callout>
+
+## Domain statuses
+
+On the Custom Domains settings page, you can see the various statuses throughout the lifecycle of a custom domain.
+
+| Status                     | Description                                                                                                                                                                       |
+| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `Pending`                  | The domain is currently queued to be provisioned by Encore.                                                                                                                       |
+| `Waiting for CNAME`        | Encore is waiting for the CNAME to become active and for the SSL certificate to be issued for the domain.                                                                         |
+| `Configuring Edge Routers` | The SSL certificate has been issued and the Encore edge routers are being configured to route traffic on the domain.                                                              |
+| `Active`                   | The domain is serving traffic to your Encore application.                                                                                                                         |
+| `Not Working`              | A non-recoverable problem has occurred. This could be a result of the CNAME record being removed or pointed elsewhere. If you see this error, please [contact support](/contact). |
diff --git a/docs/platform/integrations/github.md b/docs/platform/integrations/github.md
new file mode 100644
index 0000000000..9b12e97f39
--- /dev/null
+++ b/docs/platform/integrations/github.md
@@ -0,0 +1,52 @@
+---
+seotitle: Integrate your Encore application with GitHub
+seodesc: Learn how to integrate your backend application with GitHub to get automatic Preview Environments for each Pull Request using Encore.
+title: Integrate with GitHub
+lang: platform
+---
+
+Encore applications are easy to integrate with GitHub for source code hosting.
+
+To link your application to GitHub, open your application in the [Encore Cloud dashboard](https://app.encore.cloud), and click on **Settings** in the main navigation.
+Then select **GitHub** in the settings menu.
+
+Next, connect your account to GitHub by clicking the **Connect Account to GitHub** button. This will open GitHub where you can grant access either to all repositories or only the specific one(s) you want to link with Encore.
+
+<img class="max-w-lg w-full mx-auto" src="/assets/img/git-connect.png" />
+
+When you come back to Encore, click the **Link App to GitHub** button:
+
+<img class="max-w-lg w-full mx-auto" src="/assets/img/git-begin.png" />
+
+In the popup, select the repository you would like to link your app with:
+
+<img class="max-w-lg w-full mx-auto" src="/assets/img/git-modal.png" />
+
+Click **Link** and you're done! Encore will now automatically start building and running tests against
+your Pull Requests, and provision Preview Environments for each Pull Request.
+
+<img class="max-w-lg w-full mx-auto" src="/assets/img/git-linked.png" />
+
+## Placing your Encore app in a monorepo sub-folder
+
+If you already have a monorepo and want to place your Encore application in a sub-folder, you need to tell Encore which folder the `encore.app` file is in.
+
+Do this by opening your app in the [Encore Cloud dashboard](https://app.encore.cloud) and go to **Settings** > **General**. Then in the **Root Directory** section, you specify the directory within your Git repository in which your `encore.app` file is located.
+
+## Configure deploy trigger
+
+When using GitHub, you can configure Encore to automatically trigger deploys when you push to a specific branch name.
+To configure which branch name is used to trigger deploys, open your app in the [Encore Cloud dashboard](https://app.encore.cloud) and go to the **Overview** page for your intended environment. Click on **Settings** and then in the section **Branch Push** configure the `Branch name`  and hit save.
+
+## Preview Environments for each Pull Request
+
+Once you've linked your app with GitHub, Encore will automatically start building and running tests against
+your Pull Requests.
+
+Encore will also provision a dedicated Preview Environment for each pull request.
+This environment works just like a regular development environment, and lets you test your changes
+before merging.
+
+Learn more in the [Preview Environments documentation](/docs/platform/deploy/preview-environments).
+
+![Preview environment linked in GitHub](/assets/docs/ghpreviewenv.png "Preview environment linked in GitHub")
diff --git a/docs/platform/integrations/oauth-clients.md b/docs/platform/integrations/oauth-clients.md
new file mode 100644
index 0000000000..f49ab4040d
--- /dev/null
+++ b/docs/platform/integrations/oauth-clients.md
@@ -0,0 +1,117 @@
+---
+seotitle: Encore Cloud OAuth Clients
+seodesc: Learn how to use OAuth Clients for access to the Encore Cloud API
+title: OAuth Clients
+lang: platform
+---
+
+OAuth clients provide a framework for delegated and scoped access to the Encore Cloud API. An OAuth client creates short-lived access tokens on demand, and supports the principle of least privilege by allowing fine-grained control on the access granted to the client using scopes.
+
+## How it works
+You create an OAuth client that defines the scopes to allow when your client application uses the Encore Cloud API.
+
+Scopes are currently grouped into "roles", which include a set of permissions.
+For example, the `deployer` role grants access to the triggering deployments.
+
+An OAuth client consists of a client ID and a client secret. When you create an OAuth client, Encore Cloud creates these for you. Within your client application, use the client ID and client secret to request an API access token from the Encore Cloud's OAuth token endpoint. You use the access token to make calls to the Encore Cloud API. The access token grants permission only for the scopes that were defined when you created the OAuth client.
+
+An API access token expires after one hour. For continuous access, shortly before an API access token expires, request a new API access token from Encore Cloud's OAuth token endpoint.
+
+OAuth client libraries in popular programming languages can handle the API access token generation and renewal.
+
+Encore Cloud's OAuth implementation is based on the [OAuth 2.0 protocol](https://www.rfc-editor.org/rfc/rfc6749).
+
+## Prerequisites
+You need to be an Owner of the Encore application in order to create or revoke OAuth clients.
+
+### Setting up an OAuth client
+Open the OAuth clients page in the application settings page.
+
+In the Generate OAuth client dialog, select the set of operations that can be performed with tokens created by the new OAuth client.
+
+After generating the client, you can see the new OAuth client's ID and secret. Copy both the client ID and secret, as you need them for your client code.
+Note that after you close the Generated new OAuth client dialog, you won't be able to copy the secret again.
+**Store the client secret securely.**
+
+Your OAuth client is now configured. Use the client ID and secret when you configure your OAuth client application. Note that the provided client secrets are case-sensitive.
+
+If an OAuth client is created by a user who is later removed from your application, the OAuth client will continue to function and generate API access tokens.
+Application owners can see all configured OAuth clients in the OAuth clients page of the application settings.
+
+### Roles
+Roles define which operations are permitted in API access tokens that are created by your client application.
+
+Currently there is a single supported role: **Deployer**. The deployer role
+allows for programatically triggering deployments.
+
+When new Encore Cloud functionality is provided, we will add it to existing roles where applicable.
+That means a role is not restricted to only access of APIs that existed at the time the client was initially authorized &mdash; a role will contain additional access where it makes sense for new or updated functionality.
+
+### Revoking an OAuth client
+Open the OAuth clients page of the application settings page.
+
+Find the OAuth client that you want to delete and select Revoke.
+
+Select Revoke OAuth client to confirm you want to revoke the OAuth client.
+
+When you revoke an OAuth client, any active API access tokens that were created by the client are also revoked.
+
+### Encore Cloud OAuth token endpoint
+Encore Cloud's OAuth token endpoint is https://api.encore.cloud/api/oauth/token.
+See the [Encore Cloud API Reference](/docs/platform/integrations/api-reference) documentation for more information.
+
+Make requests to the OAuth token endpoint when you need an API access token. The OAuth token endpoint accepts requests that conform to the OAuth 2.0 client credentials grant request format, and returns responses that conform to the OAuth 2.0 client credentials grant response format.
+
+## OAuth client libraries
+Popular programming languages provide OAuth client libraries to simplify your use of OAuth clients.
+
+For example, the following Go code shows how to create an OAuth client object that uses your client ID and client secret to generate an API access token for calls to the Encore Cloud API.
+Similar libraries exist for other popular programming languages.
+
+```go
+package main
+
+import (
+    "context"
+    "os"
+
+    "golang.org/x/oauth2/clientcredentials"
+)
+
+func main() {
+    oauthConfig := &clientcredentials.Config{
+        ClientID:     os.Getenv("OAUTH_CLIENT_ID"),
+        ClientSecret: os.Getenv("OAUTH_CLIENT_SECRET"),
+        TokenURL:     "https://api.encore.cloud/api/oauth/token",
+    }
+
+    client := oauthConfig.Client(context.Background())
+
+    // Make API calls using `client.Get` etc.
+    resp, err := client.Get("https://api.encore.cloud.com/api/...")
+    // ...
+}
+```
+
+The example requires that you define environment variables `OAUTH_CLIENT_ID` and `OAUTH_CLIENT_SECRET`, with their values set to the client ID and client secret that are created when you set up an OAuth client.
+
+### Verifying you can generate API access tokens
+After you set up an OAuth client, an easy way to confirm that you can generate API access tokens is to make a curl request to the Encore Cloud OAuth token endpoint.
+
+
+```bash
+curl -d "client_id=${OAUTH_CLIENT_ID}" -d "client_secret=${OAUTH_CLIENT_SECRET}" \
+     -d "grant_type=client_credentials" "https://api.encore.cloud/api/oauth/token"
+```
+
+The example requires that you define environment variables OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET, with their values set to your client ID and client secret.
+
+Here's an example response showing the API access token:
+
+```json
+{"access_token":"MTcyODQ3NTg3NXww...GDxfmxnuq9zDEAmHmP5D44=","token_type":"Bearer","expires_in":3600, "actor": "o2c_my_key_id"}
+```
+
+## Limitations
+
+An OAuth access token expires after 1 hour &mdash; this duration cannot be modified.
diff --git a/docs/platform/integrations/terraform.md b/docs/platform/integrations/terraform.md
new file mode 100644
index 0000000000..17d969aaab
--- /dev/null
+++ b/docs/platform/integrations/terraform.md
@@ -0,0 +1,75 @@
+---
+seotitle: Integrate Encore with existing infrastructure
+seodesc: The Encore Terraform Provider lets you integrate your Encore deployment with existing infrastructure
+title: Terraform Provider
+subtitle: Integrate Encore with existing infrastructure
+infobox: {
+  title: "Terraform Provider",
+  import: "https://registry.terraform.io/providers/encoredev/encore",
+}
+lang: platform
+---
+Encore makes it simple to deploy and manage cloud applications. When you're dealing with a large and complex system, you may want to integrate Encore-provisioned resources with an existing infrastructure landscape. For this purpose, Encore maintains a Terraform Provider with data sources for all Encore-provisioned resources.
+
+## Understanding Encore Terraform Data Sources
+
+Encore Terraform data sources act as read-only references to resources Encore has already provisioned on your behalf.
+Unlike Terraform resources (which create or modify infrastructure), data sources only retrieve information. The Encore
+data sources let's you retrieve cloud identifiers for resources managed by Encore, such as databases, caches, and more.
+To do this, you only need to provide the name of the resource and the environment it's in.
+
+## Configuring the Encore Terraform Provider
+
+To use Encore data sources, you need to declare the Encore Terraform provider in the `required_providers` of
+your Terraform configuration file. Here's an example of how to declare the provider:
+
+```
+terraform {
+  required_providers {
+    encore = {
+      source = "registry.terraform.io/encoredev/encore"
+    }
+  }
+}
+```
+
+Once you've declared the provider, Terraform will automatically download the provider plugin when initializing the
+working directory using `terraform init`.
+
+To authenticate with the Encore API, the provider need an Encore Auth Key. You can generate an auth key from
+Encore's [Cloud Dashboard](https://encore.dev/docs/platform/integrations/auth-keys). Once you have the auth key, you can configure the
+provider in your Terraform configuration file like this:
+
+```
+provider "encore" {
+    env = "your-env"
+    auth_key = "your-auth-key"
+}
+```
+You can also set the `ENCORE_AUTH_KEY` environment variable to avoid hardcoding the auth key in your configuration file.
+
+## Using Encore Terraform Data Sources
+
+Once you have the provider configured, you can use the Encore data sources to retrieve information about resources.
+There are several data sources available, such as `encore_database`, `encore_cache`, and `encore_pubsub_topic`. Each data
+source has its own set of attributes that you can use to retrieve information about the resource. The full documentation
+for each data source is available in the [Terraform Registry](https://registry.terraform.io/providers/encoredev/encore).
+
+Here's an example of how to use the `encore_pubsub_topic` data source to connect AWS IOT Core to an Encore PubSub topic:
+
+```
+data "encore_pubsub_topic" "topic" {
+  name = "my-topic"
+  env  = "my-env"
+}
+
+resource "aws_iot_topic_rule" "rule" {
+  name = "my-rule"
+  sql  = "SELECT * FROM 'my-topic'"
+  sns {
+    message_format = "RAW"
+    role_arn       = aws_iam_role.role.arn
+    target_arn     = data.encore_pubsub_topic.topic.aws_sns.arn
+  }
+}
+```
diff --git a/docs/platform/integrations/webhooks.md b/docs/platform/integrations/webhooks.md
new file mode 100644
index 0000000000..6e4742a0f7
--- /dev/null
+++ b/docs/platform/integrations/webhooks.md
@@ -0,0 +1,167 @@
+---
+seotitle: Subscribe to Encore Cloud webhooks and events
+seodesc: Encore Cloud lets you define webhooks to react to events in your application, enabling you to build powerful integrations.
+title: Webhooks & Events
+subtitle: Set up webhooks to react to Encore events
+infobox: {
+  title: "Webhooks",
+  import: "go.encore.dev/webhooks",
+}
+lang: platform
+---
+
+Webhooks provide a way for notifications to be delivered to an HTTP endpoint of your choice whenever certain events happen within Encore.
+For example, you can set up a webhook to be notified whenever a deployment starts or finishes.
+
+Webhooks are defined on a per-application basis, and are configured under Settings -> Webhooks in the [Encore Cloud dashboard](https://app.encore.cloud).
+
+To simplify using webhooks, Encore.go provides a Go module, [go.encore.dev/webhooks](https://pkg.go.dev/go.encore.dev/webhooks), that provides
+type definitions and documentation of all supported webhook events. This module is kept up to date as new events are added.
+
+## Webhook Deliveries
+
+Each time an event occurs that matches one of your defined webhooks,
+Encore will send a HTTP POST request to the webhook's configured URL with information about the event.
+
+If the HTTP request fails, the delivery is marked as failed and won't be retried.
+
+Each event is given a unique event id, which is shared across all webhooks.
+
+Within each webhook, each event is given a sequence number, which is incremented for each event
+that matches that webhook. The sequence number allows for a linear ordering of events within a webhook,
+making it easy to determine if an event was missed.
+
+These are provided in the `X-Encore-Event-Id` and `X-Encore-Sequence-Id` headers respectively,
+and are also part of the event payload itself.
+
+## Parsing webhook events
+
+To parse a webhook event, use the [`webhooks.ParseEvent`](https://pkg.go.dev/go.encore.dev/webhooks#ParseEvent) function.
+
+As you'll see in the example below, to parse the webhook event you'll need access to the webhook secret.
+This is a secret value that is generated by Encore and is used to sign each webhook request. More about this
+in the next section.
+
+For example, to process rollout started and completed webhook events,
+you could do something like this:
+
+```go
+package service
+
+import (
+    "net/http"
+
+    "go.encore.dev/webhooks"
+)
+
+var secrets struct {
+	EncoreWebhookSecret string
+}
+
+//encore:api public raw
+func Webhook(w http.ResponseWriter, req *http.Request) {
+	payload, err := io.ReadAll(req.Body)
+	if err != nil {
+		// ... handle error
+    }
+    event, err := webhooks.ParseEvent(payload, req.Header.Get("X-Encore-Signature"), secrets.EncoreWebhookSecret)
+    if err != nil {
+        // ... handle error
+    }
+
+    switch data := event.Data.(type) {
+    case *webhooks.RolloutCreatedEvent:
+        // ... handle rollout created event
+    case *webhooks.RolloutCompletedEvent:
+        // ... handle rollout completed event
+    }
+}
+```
+
+<Callout type="info">
+
+Note that the example above is written as an Encore API endpoint, but that's not required.
+The same code works in any Go HTTP server, and the `go.encore.dev/webhooks` library does not depend on
+any Encore-specific functionality.
+
+</Callout>
+
+## Checking webhook signatures
+
+Since the webhook endpoint is publicly accessible, it is important to validate that the request is coming from Encore.
+To do so, Encore generates a secret for each webhook, which is used to sign each request.
+
+The webhook secret can be found on the webhook details page by admins.
+
+If you use the [go.encore.dev/webhooks](https://pkg.go.dev/go.encore.dev/webhooks) library then signature validation
+is handled automatically, but it's also possible to verify the signature manually (see below).
+
+### Preventing replay attacks
+
+A [replay attack](https://en.wikipedia.org/wiki/Replay_attack) occurs when an attacker intercepts a valid request,
+including the payload and signature, and re-transmits it one or more times, causing unintended side effects.
+
+To mitigate such attacks, Encore includes a timestamp in the `X-Encore-Signature` header.
+This timestamp is part of the signed payload, which means that it can't be changed by the attacker
+without invalidating the signature. This makes it possible to mitigate replay attacks by ensuring the
+timestamp isn't older than a certain threshold (the `go.encore.dev/webhooks` library defaults to 5 minutes).
+
+### Verifying signatures manually
+
+The `X-Encore-Signature` header included in each webhook event contains a timestamp and one or more *schemes*.
+The timestamp is prefixed with `t=`, and each *scheme* is prefixed by a `v` and a version number.
+Currently only the `v1` *scheme* is supported.
+
+For example, a valid signature header might look like this:
+```
+X-Encore-Signature: t=1623345600,v1=0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b
+```
+
+The `v1` scheme is using a hash-based message authentication code ([HMAC](https://en.wikipedia.org/wiki/HMAC))
+with [SHA-256](https://en.wikipedia.org/wiki/SHA-2). To prevent downgrade attacks, ignore all schemes that are not `v1`.
+
+It's possible the signature contains multiple signatures, for example if the webhook secret has been rotated recently.
+
+When rotating the webhook secret, Encore lets you define for how long the old secret should continue to be valid for.
+During that window, each webhook event will be signed with the new and the old secret.
+
+To validate the webhook signature, follow the algorithm below:
+
+**Step 1: Extract the timestamp and signatures from the header**
+Split the header on `,` to get a list of fields, then split each field on `=` to get the key and value.
+
+The value of the `t` key is the timestamp, and represents the UNIX timestamp (in seconds) when the signature was created.
+The fields with the `v1` key (possibly several, in case of secret rotation) are the signatures.
+
+Discard any other fields.
+
+**Step 2: Prepare the payload to sign**
+Create the payload to sign by concatenating the timestamp (as a string) and the request body, separated by `.` like so:
+
+```go
+payloadToSign := timestamp + "." + string(payload)
+```
+
+**Step 3: Compute the expected signature**
+Compute the HMAC with the SHA256 hash function, using the webhook secret as the key and the `payloadToSign` as the message.
+
+Then, encode the resulting HMAC using the base64 URL encoding, and trim any trailing `=` characters.
+In Go, this can be done like so:
+
+```go
+h := hmac.New(sha256.New, []byte(webhookSecret))
+h.Write([]byte(payloadToSign))
+digest := h.Sum(nil)
+expectedSignature := base64.RawURLEncoding.EncodeToString(digest)
+```
+
+**Step 4: Compare the signatures**
+Compare each signature with the `v1` field in the header with the expected signature.
+To protect against timing attacks, use a constant-time comparison function (like `crypto/hmac.Equal` in Go).
+
+If none of the signatures match, reject the request.
+
+If a match is found, compare the timestamp with the current time. If the difference is greater
+than the allowed threshold (5 minutes is a reasonable default), reject the request.
+
+Otherwise, accept the request.
diff --git a/docs/platform/introduction.md b/docs/platform/introduction.md
new file mode 100644
index 0000000000..38d3211a98
--- /dev/null
+++ b/docs/platform/introduction.md
@@ -0,0 +1,122 @@
+---
+seotitle: Introduction to Encore Cloud
+seodesc: Learn how Encore Cloud works and how it helps backend developers build cloud-based backend applications without manually dealing with infrastructure.
+title: Encore Cloud
+subtitle: End-to-end development platform for building robust distributed systems
+lang: platform
+---
+
+While cloud services enable us to build powerful applications, they come with significant complexity.
+
+Developers spend countless hours managing infrastructure, writing boilerplate code, and dealing with complex deployment processes instead of building features that matter to users.
+
+Launching a new app, migrating to the cloud, or breaking apart a monolith into microservices, can therefore be a daunting task.
+Encore Cloud is purpose-built to solve this problem and removes the need to build your own developer platform.
+
+It provides a complete platform for building, testing, and deploying your application. In the Encore Developer Survey 2025, the average impact reported by our users was:
+- 137% improvement in delivery speed
+- 93% reduction in time spent on DevOps tasks
+- 81% reduction in developer onboarding time
+
+## A simplified cloud backend development workflow
+
+Encore Cloud provides a complete toolset for backend development: from local development, testing, and observability, to cloud infrastructure and DevOps automation.
+
+<img className="noshadow mx-auto d:w-3/4" src="/assets/docs/arch_full.png" title="Encore Overview" />
+
+Encore Cloud's core functionality is enabled by Encore's open source backend frameworks, [Encore.ts](/docs/ts) and [Encore.go](/docs/go). These frameworks let you define essential backend resources – like APIs, microservices, databases, cron jobs, and Pub/Sub – as type-safe objects in your code using simple, declarative syntax.
+
+The frameworks have a minimal footprint, where one line of code is enough to define a backend resource, and are designed to be unobtrusive, so that you can focus on building your product without being distracted by the underlying infrastructure.
+
+With the backend frameworks you only define **infrastructure semantics** — _the things that matter to your application's behavior_ — not configuration for _specific_ cloud services. Encore Cloud then automatically generates boilerplate and orchestrates the relevant infrastructure for each environment using your cloud provider's API or directly through Encore Cloud's built-in cloud hosting for development.
+
+<img className="noshadow mx-auto d:w-3/4" src="/assets/docs/howitworks.png" title="Encore's infrastructure orchestration" />
+
+This means that, with Encore Cloud, your application code can be used to run locally, test in preview environments, and provision and deploy to cloud environments on AWS and GCP.
+
+When your application is deployed to your cloud, there are **no runtime dependencies on Encore Cloud** and there is **no proprietary code running in your cloud**.
+
+## Local Development
+
+<img className="noshadow mx-auto d:w-3/4" src="/assets/docs/arch_local.png" title="Encore's Local Development Workflow" />
+
+The local development tooling is fully open source. When you run your app locally using the [Encore CLI](/docs/ts/install), it parses your code and automatically sets up the necessary local infrastructure on the fly. _No more messing around with Docker Compose!_
+
+Aside from managing infrastructure, Encore's local development workflow comes with a lot of tools to make building distributed systems easier:
+
+- **Local environment matches cloud:** Encore automatically handles the semantics of service communication and interfacing with different types of infrastructure services, so that the local environment is a 1:1 representation of your cloud environment.
+- **Cross-service type-safety:** When building microservices applications with Encore, you get type-safety and auto-complete in your IDE when making cross-service API calls.
+- **Type-aware infrastructure:** With Encore, infrastructure like Pub/Sub queues are type-aware objects in your program. This enables full end-to-end type-safety when building event-driven applications.
+- **Tracing:** The [local development dashboard](/docs/ts/observability/dev-dash) provides local tracing to help understand application behavior and find bugs.
+- **Automatic API docs & clients:** Encore generates [API docs](/docs/ts/observability/service-catalog) and [API clients](/docs/ts/cli/client-generation) in Go, TypeScript, JavaScript, and OpenAPI specification.
+
+## Testing
+
+<img className="noshadow mx-auto d:w-3/4" src="/assets/docs/arch_testing.png" title="Encore's Testing Workflow" />
+
+Encore's open source framework comes with several built-in tools to help with testing:
+
+- **Built-in service/API mocking:** Encore provides built-in support for [mocking API calls](/docs/go/develop/testing/mocking), and interfaces for automatically generating mock objects for your services.
+- **Local test infra:** When running tests locally, Encore automatically provides dedicated [test infrastructure](/docs/go/develop/testing#test-only-infrastructure) to isolate individual tests.
+- **Local test tracing:** The [Local Development Dashboard](/docs/go/observability/dev-dash) provides distributed tracing for tests, providing great visibility into what's happening and making it easier to understand why a test failed.
+
+Encore Cloud adds to this tool-set with:
+- **Preview Environments:** Encore automatically provisions a [Preview Environment](/docs/platform/deploy/preview-environments) for each Pull Request, an effective tool when doing end-to-end testing.
+
+## Infrastructure & DevOps automation
+
+<img className="noshadow mx-auto d:w-3/4" src="/assets/docs/arch_devops.png" title="Encore's DevOps Workflow" />
+
+### Infrastructure Management
+- **Zero-config deployment:** Connect your repo and cloud account, then deploy and Encore Cloud orchestrates your cloud resources by integrating with your cloud provider's API.
+- **Automatic infrastructure:** Use battle-tested AWS/GCP services (Cloud Run/Fargate, GKE/EKS, CloudSQL/RDS, Pub/Sub / SQS/SNS, etc.) without any manual setup or configuration.
+- **No IaC required:** Say goodbye to Terraform and YAML - your code is the single source of truth.
+
+### Security & Governance
+- **Automated IAM:** Least-privilege security permissions generated from parsing your code
+- **Infrastructure tracking:** Complete visibility of all provisioned resources
+- **Change management:** Built-in approval workflow for infrastructure changes
+- **Configuration management:** Simple UI for config changes that automatically 2-way syncs to your cloud
+
+### Monitoring & Observability
+- **Cost monitoring:** Track infrastructure costs across your cloud resources (currently for GCP, AWS coming soon)
+- **Integrated observability:** Built-in logging, metrics, and tracing
+- **Third-party integration:** Works with Datadog, Grafana, and other tools
+- **Auto-generated documentation:**
+  - Service catalog with complete API docs
+  - Live architecture diagrams showing infrastructure dependencies
+
+## Why choose Encore Cloud?
+
+Encore Cloud's end-to-end workflow is an unfair advantage for teams that need to move quickly without sacrificing quality and scalability.
+By automating over 90% of the normal day-to-day DevOps work, you can focus on building your product instead of building your own developer platform.
+
+The benefits of Encore Cloud are:
+
+- **Faster Development**: Encore Cloud enables 2-3x faster iterations thanks to the streamlined the development process with its clear abstractions and built-in development tools.
+- **Reduced Costs**: Encore Cloud's infrastructure management minimizes wasteful cloud expenses and reduces DevOps workload by 90%.
+- **Scalability & Performance**: Encore Cloud simplifies building microservices applications that can handle growing user bases and demands, without the normal boilerplate and complexity.
+- **Control & Standardization**: Encore Cloud enforces standardization and provisions infrastructure consistently according to best practices for each cloud provider.
+- **Quality through understandability:** Built-in tools like automated architecture diagrams, generated API docs, and distributed tracing make it simple for teams to get an overview of their system and ensure the correct behavior.
+- **Security**: Encore Cloud makes your application secure by automatically implementing security best practices for each cloud provider.
+
+## Common use cases
+
+Encore Cloud is designed to give teams a productive and less complex experience when solving most common backend use cases.
+Many teams use Encore Cloud to build things like:
+
+-   Consumer apps
+-   High-performance B2B Platforms
+-   Fintech & Crypto applications
+-   Global E-commerce marketplaces
+-   Microservices backends and event-driven systems for scalable SaaS applications
+-   And much more...
+
+Check out the [showcase](https://encore.cloud/showcase) section for some examples of real-world products being built with Encore.
+
+## Getting started
+
+- [Follow the Quick Start Guide](/docs/ts/quick-start)
+- [Join Discord](https://encore.dev/discord) to ask questions and meet other Encore developers
+- Follow and star the project on [GitHub](https://github.com/encoredev/encore) to stay up to date
+- [Book a demo](https://encore.dev/book) to speak to one of our founders about if Encore Cloud is a good fit for your team
diff --git a/docs/platform/management/billing.md b/docs/platform/management/billing.md
new file mode 100644
index 0000000000..48e92ce6b4
--- /dev/null
+++ b/docs/platform/management/billing.md
@@ -0,0 +1,59 @@
+---
+seotitle: Plans & Billing
+seodesc: Encore is free to use for many projects, and comes with paid plans for teams who want to move quickly. Learn more!
+title: Plans & Billing
+subtitle: 
+lang: platform
+---
+
+Encore offers a **Free** plan for teams that want a simple development workflow and collaboration features.
+If you want access to all features and want to use Encore's DevOps automation tools for AWS & GCP, there's a paid **Pro** plan available at $39 per member / month.
+
+See the [pricing page](https://encore.dev/pricing) for a feature comparison between each plan and more information.
+
+## When do I need to upgrade to a paid plan?
+
+The Free plan comes with certain limitations, and should your needs exceed one or more of them, you may wish to upgrade to a paid plan:
+
+- When you need more than 2 cloud environments
+- When you want to [automate DevOps in your cloud on AWS/GCP](/docs/platform/infrastructure/infra)
+- When you want [Preview Environments](/docs/platform/deploy/preview-environments) for each Pull Request
+- When you want to use a Custom Domain
+- When you need multiple concurrent builds
+- When you need guaranteed logs & tracing retention
+- When you want access to private support & onboarding assistance
+- When you want custom configuration for environments hosted on Encore Cloud
+
+There is a free 14-day trial of the Pro plan, available to all new Encore users. It's a great way to try out all the features and learn if the Pro plan suits your needs.
+You can activate your trial from the [pricing page](https://encore.dev/pricing).
+
+## Do I need to pay for hosting?
+
+All plans come with free use of Encore Cloud, subject to [Fair Use limits](/docs/platform/management/usage).
+Encore Cloud is intended for development environments and limited scale professional use that does not require specific SLAs.
+
+For production use, you can [connect your own cloud account on AWS/GCP](/docs/platform/deploy/own-cloud) and use Encore to deploy there, including provisioning infrastructure and managing IAM. When you connect your own cloud account, you pay for usage directly to your cloud provider.
+
+If you prefer to manage deployment yourself, you can export your application as a standalone Docker image and deploy in any way you prefer. ([Learn more](/docs/ts/self-host/build))
+
+## Payments & Billing FAQ
+
+### What is the price of the paid plan?
+
+The **Pro** plan is $39/month per member. If you use Encore for DevOps automation in your cloud, the price is $99/month per environment on AWS/GCP + $1.7/month per resource in each AWS/GCP environment. _Resources are your app's services, databases, Pub/Sub topics and subscriptions, cron jobs, caches, and secrets, in each environment._
+
+ ([Learn more](https://encore.dev/pricing))
+
+See the [pricing page](https://encore.dev/pricing) for more details.
+
+If you are a large organization with specific needs, please [email us](mailto:hello@encore.dev) or [book a 1:1](/book) to discuss your needs and get a custom price quote.
+
+### Can I pay with a credit card?
+
+Yes, we offer payments via Stripe using all major credit cards. You can upgrade your account via the [pricing page](/pricing).
+
+### What happens if my payment fails?
+
+If your payment fails, everything will keep working as normal!
+We will reach out to you with instructions on how to update your payment information so that we can try to process your payment again.
+We will not downgrade your account without prior notice.
diff --git a/docs/platform/management/compliance.md b/docs/platform/management/compliance.md
new file mode 100644
index 0000000000..291f4b3eac
--- /dev/null
+++ b/docs/platform/management/compliance.md
@@ -0,0 +1,199 @@
+---
+seotitle: Compliance & Security
+seodesc: Encore is designed to help you build secure, scalable applications. We take the security and reliability of your application very seriously.
+title: Compliance & Security
+subtitle: Encore SOC 2 Self-assessment
+lang: platform
+---
+
+_Last updated: 17 April, 2025_
+
+As an organization or engineer who creates applications, your applications, code, and data are among your most important assets. Encore highly prioritizes the security of these assets, allowing you to concentrate on your goal: designing exceptional applications.
+
+We are currently preparing for an external review of our security measures in connection with a SOC 2 Type 1 audit. This document provides a summary of our self-evaluation regarding the current implementation of the SOC 2 trust service criteria at Encore.
+
+## SOC 2
+
+SOC is short for "System and Organization Controls" – it is the de facto industry standard for software security and privacy. During the SOC 2 audit, an external auditor will carry out an extensive review of our processes (e.g. employee onboarding and offboarding, access review, various policies, disaster recovery exercises, software architecture, physical access, etc.) and ensure that they meet the mark.
+
+The Type 1 audit is a point-in-time audit where the auditor verifies that the controls are satisfied at a specific point in time. After the initial Type 1 audit, we are planning to proceed to Type 2 which is based on continuous monitoring during time periods of varying lengths.
+
+### Trust Service Criteria
+
+The five SOC 2 trust service criteria are: security, availability, confidentiality, processing integrity, and privacy.
+
+**1\. Security**
+
+Protecting systems against unauthorized access.
+
+**2\. Availability**
+
+Ensuring that the system remains functional and usable.
+
+**3\. Confidentiality**
+
+Restricting the access of data to a specified set of persons or organizations. Ensuring that network communication is encrypted and cannot be intercepted by unauthorized personnel.
+
+**4\. Processing integrity**
+
+Ensuring that a system fulfills its purpose and delivers correct data.
+
+**5\. Privacy**
+
+Minimal processing and use of personal data in accordance with the law.
+
+The following sections describe in detail how Encore implements each trust service principle.
+
+## Security
+
+Encore believes that the best way to achieve a secure system is to follow best practices and industry standards, and not with obscurity (i.e. attempting to "secure" a system only by making it "difficult to understand") or homegrown technology (e.g. custom encryption algorithms).
+
+We have a designated individual (Security Officer) responsible for all aspects of security, such as infrastructure, software, and data.
+
+### Infrastructure security
+
+Encore's core production infrastructure is hosted on GCP (Google Cloud Platform), an ISO27001/SOC 2 compliant vendor. Auxiliary services are provided by Hetzner, an ISO27001 compliant vendor. Tailscale, a SOC 2 compliant vendor, provides VPN (Virtual Private Network) services used to secure communication between all servers.
+
+All core data processing is carried out in the US East region (us-east-1), and backups are kept in multiple separate regions in the US. Each region is composed of at least three "availability zones" (AZs) which are isolated locations, designed to take over in case of a catastrophic failure at one location. AZs are separated by a significant distance such that it is unlikely that they are affected by the same issues such as power outages, earthquakes, etc. Physical access to GCP is restricted by GCP's security controls. Furthermore, GCP monitors and immediately responds to power, temperature, fire, water leaks, etc.
+
+Access to Encore's production infrastructure is restricted to Encore employees. All systems have access controls and only a limited number of employees have privileged access. Access is only possible through a VPN over Tailscale.
+
+The production environment is separated from testing environments, using separate accounts and VPCs (Virtual Private Cloud) in GCP. This ensures that any defect in a test environment cannot impact the production system. The connection to the internet is controlled by dedicated gateways.
+
+### Organizational security
+
+Since an organization is only as good as its people, Encore takes great care when selecting and training its staff. All employees undergo a thorough selection process that has been designed to identify the best talent in the world for the job. Many of Encore's employees have extensive experience working in regulated environments such as Online Banking and large-scale Online Payments.
+
+Individual performance monitoring is carried out by managers on a bi-weekly cadence. Overall organizational performance is tracked continuously and reviewed by management on a monthly cadence using Key Performance Indicators determined by management.
+
+Employees are required to complete yearly security awareness training. The training is designed to increase sensitivity to physical security (hardware and media handling, office access control, etc.), digital security (e.g. secure passwords, two-factor authentication), social engineering attacks ("phishing"), and other security-related topics.
+
+Encore employment policy mandates that all hard drives must be encrypted.
+
+### Product security
+
+Encore is aware of how important it is for its customers that all data is handled securely. Therefore, several layers of protection ensure that the data is not accessible to unauthorized persons.
+
+An essential part of software security is "defense in depth" which means that there are multiple layers of protection. In case one layer is breached, the next layer helps to contain the breach and mitigate its consequences. This can be achieved by isolating software components from each other, such that the breach of one component does not affect adjacent software.
+
+Encore's service-based architecture provides natural isolation between components, and we have adopted a zero-trust security model with the use of Tailscale. All server-to-server communication is authenticated and end-to-end encrypted with WireGuard. GCP's VPC (Virtual Private Cloud) provides another layer of isolation from the internet on the network level. None of Encore's servers are publicly accessible on the internet.
+
+As a general principle, all of Encore's data is encrypted while being transported across networks and when stored ("in transit and at rest"). In case of unauthorized access to the data, an attacker would only see undecipherable garbage which cannot be decrypted without the corresponding keys. The encryption methods employed by Encore are industry standard and deemed unbreakable by contemporary standards. Data at rest (virtual filesystems, relational databases, and object storage) is encrypted using GCP's industry-standard AES-256, while data in transit is encrypted with TLS ≥ 1.2 (for Encore's REST API) or WireGuard (for internal communication).
+
+All customer secret information is further encrypted using GCP's Key Management Service (KMS). Any access to encrypted data by Encore employees requires elevated access and approval by multiple parties, and all such activity is audited.
+
+User account authentication is provided by _Clerk_, a SOC 2 compliant vendor.
+
+There are two ways for a user to log in to Encore: Single sign-on (SSO) and username plus password. Single sign-on can be used by organizations to fully manage access to Encore and, for example, ensure that former employees no longer have access after the offboarding period. Encore supports Google and GitHub SSO using OAuth.
+
+If no SSO is used, the default login method is passwordless login using email and "magic link", also handled by _Clerk_. Encore does not store or in any way handle passwords, neither in plaintext nor cryptographic hash form. This means that Encore does not know the passwords of any users, and no passwords can be reconstructed from our databases.
+
+Encore offers bug bounty incentives to individuals who discover any security discrepancies. The objective of offering bug bounty incentives is to receive security-related bug reports from trusted "white hat hackers" before the vulnerability is actively exploited in a malicious way. This contributes to maintaining Encore's product security.
+
+All security issues undergo a triaging process by Encore's designated Security Officer and are escalated based on their criticality.
+
+Encore uses automated scans to detect software vulnerabilities. All teams are continuously monitoring their services for vulnerabilities and are committed to pro-actively reducing them. The progress is supervised by the Security Officer.
+
+### Access control
+
+We regularly keep track of and review the list of employees who have access to which systems and remove access where applicable to ensure least access principles apply.
+
+Offboarding processes ensure that former employees cannot access internal systems anymore after the termination of their contract. Thanks to the VPN, Encore can centrally restrict access to internal networks.
+
+#### MFA
+
+Multi-factor authentication (MFA) adds another layer of security on top of classic password authentication. In addition to username and password, the user requires another individual token of access.
+
+Stealing or guessing the password is not enough for an attacker to gain access to a system, because the second factor would also need to be stolen.
+
+Usually, the second factor is a physical device, such as a mobile phone which has been paired with the authentication system. Encore employs MFA to protect access to the infrastructure provider (GCP) and the version control systems (GitHub), among other systems.
+
+## Availability
+
+Hosted on a cloud infrastructure, Encore implements a service-based architecture where many dedicated software components operate isolated from one another, but in a coordinated way, much like a complex machine where individual parts can be replaced independently from one another.
+
+During the release of a new version of Encore services, Encore's engineers take great care during the preparation of the update so that in case of an unexpected problem, the system can be restored to the previous state in a manner that minimizes user impact.
+
+### Performance monitoring
+
+Encore uses a number of performance monitoring systems, such as Sentry, Cronitor, Grafana, and Google Cloud Monitoring (all being SOC 2 compliant vendors). Grafana is used to monitor application performance, such as server response times and user interface speed. Grafana also collects server-side metrics like CPU and RAM usage. Additionally, Encore monitors the performance of databases with GCP tooling.
+
+Slack, a SOC 2 compliant vendor, is used as the alerting channel to notify the developers in case the performance of the system has regressed, for example, due to increased response times, or increased error rates. To enable root cause analysis of bugs, Encore collects system logs from all parts of the system. These logs can only be accessed by authorized users.
+
+Encore offers a public "Status page" where users and customers can find the current status of Encore systems. It is available at: [https://status.encore.dev/](https://status.encore.dev/).
+
+### Backups and disaster recovery
+
+To reduce the risk of simultaneous failure, Encore backs up data to multiple US regions in GCP, with very limited access. Relational databases are backed up on a daily schedule.
+
+Encore is currently planning a rehearsal of disaster recovery in Q4 of 2025. In this exercise, a clone of the production environment will be recovered from scratch using backups and tested for soundness.
+
+### Incident handling
+
+Whenever an incident occurs, Encore's designated on-call engineer initiates an investigation and escalates to the broader engineering team as necessary based on severity. For issues deemed critical, they follow an iterative response process to identify and contain errors, recover systems and services, and remediate vulnerabilities.
+
+Customers and users can report outages via regular support channels (for example via email, or using the [Discord](https://encore.dev/discord) chat group). Encore's internal communication systems have dedicated channels for incident escalation.
+
+## Confidentiality
+
+When you use Encore, other users won't be able to see your content, unless you grant access explicitly by inviting them to your application. Encore engineers may use your data to provide support and when necessary to fix bugs.
+
+### Access controls
+
+All employees and contractors are contractually bound to confidentiality, which persists after the termination of the work contract.
+
+As part of a "clean screen" policy, all computers used by Encore staff must be set to automatically lock the screen after 1 minute of inactivity.
+
+All systems access is subject to the "principle of least privilege", meaning that every employee only has access to the systems necessary to perform their official duties.
+
+### Deletion
+
+User data will be stored by Encore after the termination of a subscription term, according to [Encore's Terms of Service](https://encore.cloud/legal/terms). When a user requests the deletion of data, the data is made inaccessible or physically deleted, depending on the data type and storage location.  For technical reasons, data may remain in backups after this point.
+
+## Processing integrity
+
+### Quality assurance
+
+Product quality is very important to Encore. There are many different facets, including:
+
+-   Accuracy and usability of services provided
+
+-   High performance of the user interface and Encore services
+
+-   Almost zero downtime
+
+Several measures are put into place in order to keep product quality high:
+
+-   Code review: Code changes are reviewed by a peer of the developer before it is accepted into the main code branch (for critical systems) or in a weekly post-hoc review process (for auxiliary systems). For critical systems code can only be merged if the reviewer agrees. For auxiliary systems any requested changes by reviewers are made as part of the review process. It is often necessary to add a test alongside, and the code review process ensures that this has been done as well.
+
+-   Continuous integration: Before code is accepted, it is built by our continuous integration environment and tests are executed. If the build fails, the developer is notified immediately and a fix is required before the code can be merged.
+
+-   Manual testing: Once the code has been merged, the change is deployed and in most cases tested manually post-release to verify quality in the production environment.
+
+-   Automated integration testing: A large battery of automated tests is executed against the local and production environments and checks many common workflows for regressions of any kind. In case the tests fail, the engineer will address the issues before proceeding with attempting to merge again.
+
+-   Testing of Open-Source libraries: Encore uses Open-Source libraries to provide certain functionality. Overnight tests run daily to discover potential issues, and manual testing is performed when any Open-Source libraries are version updated.
+
+Any code change is released only if all these steps succeed. Furthermore, access to the code base is protected via multi-factor authentication (MFA), which poses another layer of defense against the malicious injection of code.
+
+Since Encore depends on third-party software, we regularly contribute to the quality assurance of our suppliers. Whenever Encore becomes aware of regressions or bugs, they are reported upstream. In this way, Encore is contributing to the quality, stability, and accuracy of other software in the space.
+
+### Process monitoring
+
+Where possible, Encore uses software to enforce processes. For example, code review and having tests passed are enforced by the source control management tool GitHub.
+
+Regular reviews on different levels (individual, team, company) foster alignment between all individuals and the company objectives.
+
+### Privacy
+
+Encore takes data privacy very seriously and complies with the rules of the European Union's GDPR (General Data Protection Regulation). GDPR grants a wide range of rights to Encore's users, such as the right to be informed, the right to access, the right to rectification, the right to erasure, and others.
+
+One fundamental rule of the GDPR is the principle of "data minimization", which ensures that we are not processing more personal data than necessary. As a result, Encore Cloud uses only minimal personal data for user authentication and essential communication (which is a name, contact email, and a password hash).
+
+### Privacy policy
+
+We are aware that confidential handling of your data is essential to establishing trust. Therefore, [Encore's Privacy Policy](https://encore.cloud/legal/privacy) ensures that the data of our users is protected according to the high standards of GDPR.
+
+## Questions and clarifications
+
+If you have any questions regarding Encore's security or compliance strategy, please feel free to contact us [via email](mailto:hello@encore.dev) (hello@encore.dev).
diff --git a/docs/platform/management/permissions.md b/docs/platform/management/permissions.md
new file mode 100644
index 0000000000..5e16fcc2f1
--- /dev/null
+++ b/docs/platform/management/permissions.md
@@ -0,0 +1,47 @@
+---
+seotitle: Roles & Permissions
+seodesc: Encore helps your whole team build applications and collaborate across backend and frontend teams.
+title: Roles & Permissions
+subtitle: For teams building applications together
+lang: platform
+---
+
+Encore applications have three membership roles with different permissions: **Admins**, **Members**, and **Viewers**.
+Here is a breakdown of the key differences between each role:
+
+|                                     | Admins | Members | Viewers |
+| ----------------------------------- | ------ | ------- | ------- |
+| Manage team members                 | Y      | N       | N       |
+| Connect/Disconnect cloud accounts   | Y      | N       | N       |
+| Integrate with GitHub               | Y      | N       | N       |
+| Configure custom domains            | Y      | N       | N       |
+| Manage environments                 | Y      | N       | N       |
+| Create auth keys                    | Y      | N       | N       |
+| Approve infrastructure provisioning | Y      | N       | N       |
+| Delete applications                 | Y      | N       | N       |
+| Push code changes                   | Y      | Y       | N       |
+| Create builds & deployments         | Y      | Y       | N       |
+| Configure secrets                   | Y      | Y       | N       |
+| Pull secrets                        | Y      | Y       | Y       |
+| Run locally                         | Y      | Y       | Y       |
+| View API documentation              | Y      | Y       | Y       |
+| View Encore Flow                    | Y      | Y       | Y       |
+
+
+### Admins
+
+Admins have full privileges and can administer your entire application.
+
+### Members
+
+Members are active contributors to your applications. They are able to do everything that is not limited to Admins.
+  
+### Viewers
+
+Viewers are read-only members. They can view the Cloud Dashboard and run your application locally.
+
+This role is intended for any team members not contributing directly to your Encore application, but who still get value from certain access. In a bigger team, this role is often appropriate for e.g. Frontend developers and Product Managers.
+
+### Custom roles & permissions
+
+Custom roles & permissions is an optional add-on to the [Pro plan](/pricing), please [contact us](mailto:hello@encore.dev) to discuss your requirements.
diff --git a/docs/platform/management/telemetry.md b/docs/platform/management/telemetry.md
new file mode 100644
index 0000000000..a352f7f8bf
--- /dev/null
+++ b/docs/platform/management/telemetry.md
@@ -0,0 +1,97 @@
+---
+seotitle: Encore Telemetry
+seodesc: Encore collects telemetry data about app usage
+title: Telemetry
+lang: platform
+---
+Telemetry helps us improve the Encore by collecting usage data. This data provides insights into how Encore is used, enabling us to make informed decisions to enhance performance, add new features, and fix bugs more efficiently.
+
+Encore only collects telemetry data in the local development tools and in the Encore Cloud dashboard. It does **not** collect any telemetry data from your running applications or cloud services, ensuring complete privacy and security for your operations.
+
+## Why We Collect Data
+
+We collect telemetry data for several important reasons:
+
+1. **Improvement of Features**: Understanding which features are most used helps us prioritize improvements and new feature development.
+2. **Performance Monitoring**: Tracking performance metrics enables us to identify and resolve issues, ensuring a smoother user experience.
+3. **Bug Detection**: Telemetry data can help us detect and fix bugs faster by providing context on how and when issues occur.
+4. **User Experience**: Insights from telemetry data guide us in making Encore more intuitive and user-friendly.
+
+## How Data is Collected
+
+Encore collects data in a way that prioritizes user privacy and security. Here's how we do it:
+
+1. **User Identifiable Data**: The data collected includes identifiable information that helps us understand specific user interactions and contexts.
+2. **Types of Data**: We collect data on usage patterns, performance metrics, and error reports.
+3. **Secure Transmission**: All data is transmitted securely using industry-standard encryption protocols.
+4. **Minimal Impact**: Data collection is designed to have minimal impact on Encore's performance.
+
+### Example of Data Being Sent
+
+Here is an example of the type of data that is sent:
+
+```json
+{
+    "event": "app.create",
+    "anonymousId": "a-uuid-unique-for-the-installation",
+    "properties": {
+        "error": false,
+        "lang": "go",
+        "template": "graphql"
+    }
+}
+```
+
+## Data We Don't Collect
+
+At Encore, we prioritize your privacy and ensure that no sensitive data is collected through our telemetry. Specifically, we do not collect:
+
+1. **Environment Variables**: We do not collect any environment variables set in your development or production environments.
+2. **File Paths**: The specific paths of your files and directories are not collected.
+3. **Contents of Files**: We do not access or collect the contents of your code files or any other files in your projects.
+4. **Logs**: No log files from your application or development environment are collected.
+5. **Serialized Errors**: We do not collect serialized errors that may contain sensitive information.
+
+Our goal is to gather useful data that helps improve Encore while ensuring that your sensitive information remains private and secure.
+
+## Disabling Telemetry
+
+While telemetry helps us improve Encore, we understand that some users may prefer to opt out. Disabling telemetry is straightforward and can be done in two ways:
+
+1. **Using the CLI Command**: You can disable telemetry by executing a simple command in your terminal.
+
+   ```sh
+   encore telemetry disable
+   ```
+
+2. **Setting an Environment Variable**: Alternatively, you can disable telemetry by setting the `DISABLE_ENCORE_TELEMETRY` environment variable.
+
+   ```sh
+   export DISABLE_ENCORE_TELEMETRY=1
+   ```
+
+3. **Confirmation**: After disabling telemetry, either by the CLI command or environment variable, you will receive a confirmation message indicating that telemetry has been successfully disabled.
+
+4. **Re-enabling Telemetry**: If you decide to re-enable telemetry later, you can do so with the following CLI command:
+
+   ```sh
+   encore telemetry enable
+   ```
+
+## Debugging Telemetry
+
+For users who want more visibility into what telemetry data is being sent, you can enable debug mode:
+
+1. **Setting Debug Mode**: Enable debug mode by setting the `ENCORE_TELEMETRY_DEBUG` environment variable.
+
+   ```sh
+   export ENCORE_TELEMETRY_DEBUG=1
+   ```
+
+2. **Log Statements**: When debug mode is enabled, a log statement prepended by `[telemetry]` will be printed every time telemetry data is sent.
+
+## Conclusion
+
+Telemetry is a vital tool for improving Encore, but we respect your choice regarding data sharing. With easy-to-use commands and environment variables, you can manage your telemetry settings as you see fit. If you have any further questions or need assistance, please refer to our support documentation or contact our support team.
+
+Thank you for helping us make Encore better!
diff --git a/docs/platform/management/usage.md b/docs/platform/management/usage.md
new file mode 100644
index 0000000000..e6c602cf9a
--- /dev/null
+++ b/docs/platform/management/usage.md
@@ -0,0 +1,54 @@
+---
+seotitle: Usage limits and Fair Use guidelines
+seodesc: Encore comes with a built-in development cloud with generous Fair Use limits. This makes it easy to get started building your next backend application without requiring a cloud account.
+title: Usage limits
+subtitle: Encore Cloud limits and Fair Use guidelines
+lang: platform
+---
+
+Encore comes with a built-in development cloud, Encore Cloud, that is free to use for development and limited scale commercial projects without any specific SLA requirements.
+Encore Cloud is subject to Fair Use guidelines and comes without warranty, as it's not intended for large-scale business-critical use cases.
+
+For production use cases, Encore is designed to be used together with your cloud on the major cloud providers (AWS/GCP), and provides full DevOps automation for deployments to your own cloud account. This means Encore has no incentive to increase your usage – rather we can focus on building tools to help you minimize your cloud spending! (Should you wish to use Encore Cloud instead of your own cloud account, please [contact us](/book).)
+
+When you use Encore together with AWS/GCP, you can still use Encore Cloud to host Preview Environments and development environments.
+
+### Examples of Fair Use
+
+- Prototyping & development
+- Hobby projects
+- Commercial use cases that have limited load and do not require any SLAs
+
+### Never Fair Use
+
+- Proxies and VPNs
+- Media hosting for hot-linking
+- Scrapers
+- Crypto Mining
+- CPU-intensive APIs (e.g.: Machine Learning)
+- Load Testing
+
+## Usage guidelines
+
+We expect most users to fall within the usage limits below.
+We want to be as flexible and permissive as possible, and will wherever possible reach out and work with you
+to find a good solution should we notice that you are exceeding these limits.
+
+For users on a [paid plan](/pricing), we can change these limits to support your needs. If you have significantly higher requirements,
+this may come with an additional charge (at cost) to cover the extra capacity. Please [contact us](/book) for more information.
+
+**We will never charge you for usage of Encore Cloud unless expressly agreed in advance.**
+
+### Usage limits
+
+|                  | Per application |
+| ---------------- | --------------- |
+| Requests         | 100,000 / day   |
+| Database Storage | 1 GB            |
+| PubSub Messages  | 100,000 / day   |
+| Cron Jobs        | Once every hour |
+| Object Storage   | 1 GB            |
+
+### What happens if I reach a usage limit?
+
+If your application reaches a usage limit, we will **not** automatically stop it. Our team will reach out to you, and work with you to find a solution that does not cause any undue disruption to your application.
\ No newline at end of file
diff --git a/docs/platform/migration/migrate-away.md b/docs/platform/migration/migrate-away.md
new file mode 100644
index 0000000000..e202208cc7
--- /dev/null
+++ b/docs/platform/migration/migrate-away.md
@@ -0,0 +1,57 @@
+---
+title: Migrate away from Encore
+subtitle: If you love someone, set them free.
+lang: platform
+---
+
+_We realize most people read this page before even trying Encore, so we start with a perspective on how you might reason about adopting Encore. Read on to see what tools are available for migrating away._
+
+Picking technologies for your project is an important decision. It's tricky because you don't know what the requirements are going to look like in the future. This uncertainty makes many teams opt for maximum flexibility, often without acknowledging this has a significant negative effect on productivity.
+
+When designing Encore, we've leaned on standardization to provide a well-integrated and highly productive development workflow. The design is based on the core team's experience building scalable distributed systems at Spotify and Google, complemented with loads of invaluable input from the developer community. 
+
+In practise Encore is opinionated only in certain areas which are critical for enabling the static analysis used to create Encore's application model. This is fundamental to how Encore can provide its powerful features, like automatically instrumenting distributed tracing, and provisioning and managing cloud infrastructure.
+
+## Accommodating for your unique requirements
+
+Many software projects end up having a few novel requirements, which are highly specific to the problem domain. To accommodate for this, Encore is designed to let you go outside of the standardized Backend Framework when you need to, for example:
+- You can drop down in abstraction level in the API framework using [raw endpoints](/docs/ts/primitives/defining-apis#raw-endpoints)
+- You can use tools like the [Terraform provider](/docs/platform/integrations/terraform) to integrate infrastructure that is not managed by Encore
+
+## Mitigating risk through Open Source and efficiency
+
+We believe that adopting Encore is a low-risk decision for several reasons:
+
+- There's no upfront investment needed to get the benefits
+- Encore apps are normal programs where less than 1% of the code is Encore-specific
+- All infrastructure and data is in your own cloud
+- It's simple to integrate with cloud services and systems not natively supported by Encore
+- Everything you need to develop your application is Open Source, including the [parser](https://github.com/encoredev/encore/tree/main/v2/parser), [compiler](https://github.com/encoredev/encore/tree/main/v2/compiler), [runtime](https://github.com/encoredev/encore/tree/main/runtimes)
+- Everything you need to self-host your application is [Open Source and documented](/docs/ts/self-host/build)
+
+## What to expect when migrating away
+
+If you want to migrate away, we want to ensure this is as smooth as possible! Here are some of the ways Encore is designed to keep your app portable, with minimized lock-in, and the tools provided to aid in migrating away.
+
+### Code changes
+
+Building with Encore doesn't require writing your entire application in an Encore-specific way. Encore applications are normal programs where only 1% of the code is specific to Encore's Open Source Backend Framework.
+
+This means that the changes required to stop using the Backend Framework is almost exactly the same work you would have needed to do if you hadn't used Encore in the first place, e.g. writing infrastructure boilerplate. There is no added migration cost.
+
+### Deployment
+
+If you are self-hosting your application, then you're already done.
+
+If you are using Encore Cloud to manage deployments and want to migrate to your own solution, you can use the `encore build docker` command to produce a Docker image, containing the compiled application, using exactly the same code path as Encore's CI system to ensure compatibility.
+
+Learn more in the [self-hosting docs](/docs/ts/self-host/build).
+
+### Tell us what you need
+
+We're engineers ourselves and we understand the importance of not being constrained by a single technology.
+
+We're working every single day on making it even easier to start, <i>and stop</i>, using Encore.
+If you have specific concerns, questions, or requirements, we'd love to hear from you!
+
+Please reach out on [Discord](https://encore.dev/discord) or [send an email](mailto:hello@encore.dev) with your thoughts.
diff --git a/docs/platform/migration/migrate-to-encore.md b/docs/platform/migration/migrate-to-encore.md
new file mode 100644
index 0000000000..9904418558
--- /dev/null
+++ b/docs/platform/migration/migrate-to-encore.md
@@ -0,0 +1,231 @@
+---
+title: Migrating an existing system to Encore
+subtitle: Approaches for adopting Encore
+seotitle: How to migrate your existing system to Encore
+seodesc: Learn how to migrate your application to Encore incrementally, and unlock Encore's powerful set of development tools for your team.
+lang: platform
+---
+
+By building your application with the Encore open-source framework, you unlock powerful features such as the [local development tools](/docs/ts/observability/dev-dash), [automatic infrastructure provisioning](/docs/platform/infrastructure/infra), [distributed tracing](/docs/ts/observability/tracing), and [service catalog](/docs/ts/observability/service-catalog).
+
+**The good news: you don't need a complete rewrite.** This guide shows you how to adopt Encore incrementally, so you can start benefiting immediately while gradually migrating your existing system.
+
+## Why incremental migration?
+
+Incremental migration is more reliable than a complete rewrite. Here's why:
+
+- **Immediate value** - Start benefiting from Encore's features when developing your next new service.
+- **Lower risk** - Small, controlled changes instead of a single high-stakes big-bang launch.
+- **Ship faster** - Deliver improvements incrementally rather than waiting for a complete rewrite.
+
+## Choose your migration strategy
+
+We recommend two approaches:
+
+1. **Service by service** (Recommended) - Migrate services one at a time. Run Encore alongside your legacy system, integrated via APIs.
+2. **Forklift migration** - Move your entire application in one shot using a catch-all handler, then refactor incrementally.
+
+<img src="/assets/docs/migration-diagram.png" title="Migration options" className="noshadow"/>
+
+### Need help?
+
+We've helped 100+ teams adopt Encore and we're happy to answer your questions and provide advice to help you with your migration.
+
+[Email us](mailto:hello@encore.dev) to ask questions, or [book a 1:1 call](https://encore.dev/book) to discuss your specific situation.
+
+**Enterprise customers**: Encore Cloud can adapt to your unique infrastructure—Kubernetes clusters, VPCs, security policies, and compliance needs—typically within days. [Contact us](https://encore.dev/book) to discuss your requirements.
+
+## Service by service migration (Recommended)
+
+Migrate services one at a time while your Encore application runs alongside your legacy system, integrated through APIs.
+
+### Key benefits
+
+- **Full Encore features immediately** - Get automatic infrastructure provisioning, distributed tracing, and architecture diagrams for each migrated service.
+- **Independent services** - Each service is self-contained with no cross-application dependencies.
+- **Simple integration** - Services communicate via APIs.
+- **Flexible deployment** - Deploy to your existing Kubernetes cluster, or let Encore Cloud set up a new project in your cloud (AWS/GCP).
+- **Better developer experience** - Start building with modern tooling right away.
+
+### Deployment options
+
+Choose how to deploy your Encore application:
+
+- **Your Kubernetes cluster** - Deploy directly to your existing Kubernetes infrastructure. Run Encore alongside legacy systems securely in the same environment.
+- **Encore-managed in your cloud account** - Let Encore handle all infrastructure provisioning and management in your AWS or GCP account, and deploy within your existing VPC and security setup.
+
+**Enterprise**: We can adapt to your specific network topology, security policies, and compliance requirements — typically within days. [Contact us](https://encore.dev/book) to discuss your requirements.
+
+_Google Cloud example architecture:_
+
+<img src="/assets/docs/gcp-diagram.png" title="Migration options" className="noshadow"/>
+
+### Which services to migrate first?
+
+Start small and build confidence:
+
+- **Low-risk, high-value** - Validate the approach before tackling complex systems.
+- **Frequently changed** - Get immediate developer experience benefits where it matters most.
+- **Clear boundaries** - Services with well-defined APIs are easier to migrate.
+- **Fewer dependencies** - Less connected to legacy infrastructure means simpler migration.
+
+### Practical steps
+
+#### 1. Create an Encore app and integrate with GitHub
+
+The first step in any project is to create an Encore app. If you've not tried Encore before, we recommend starting by following the [Quick Start Guide](/docs/ts/quick-start).
+
+Once you've created you app, [integrate it with your GitHub repository](/docs/platform/integrations/github) and you'll get automatic [Preview Environments](/docs/platform/deploy/preview-environments) for every Pull Request.
+
+#### 2. Build your services and APIs
+
+Since Encore is designed to build distributed systems, it should be straightforward to build a new system that integrates with your existing backend through APIs. See the [defining APIs documentation](/docs/ts/primitives/defining-apis) for more details.
+
+Should you want to accept webhooks, that's simple to do using Encore's [Raw endpoints](/docs/ts/primitives/raw-endpoints).
+
+You can also generate API clients in several languages, which makes it simple to integrate with frontends or other systems. See the [Client Generation documentation](/docs/ts/cli/client-generation) for more details.
+
+#### 3. Deploy alongside your existing backend
+
+**Deploy to Kubernetes**
+
+Encore Cloud can deploy directly to your existing Kubernetes cluster:
+
+- Run in the same secure environment as your legacy systems
+- Services communicate within your existing VPC
+- Gradually shift traffic using your load balancer or service mesh
+- Use your current cost management and billing
+- Maintain compliance with your governance policies
+
+[Contact us](https://encore.dev/book) to discuss Kubernetes deployment.
+
+**Deploy to new Encore-managed infrastructure in your cloud**
+
+[Connect your AWS or GCP account](/docs/platform/deploy/own-cloud) to deploy in your existing environment:
+
+- Same VPC as your legacy backend (or a new one)
+- Your current cost management and billing
+- Maintain compliance with your governance policies
+
+See [infrastructure docs](/docs/platform/infrastructure/infra#production-infrastructure) for details.
+
+#### Integration patterns
+
+Your Encore and legacy systems communicate through APIs:
+
+- **Legacy → Encore**: Use Encore-generated API clients
+- **Encore → Legacy**: Use your existing API communication protocol (Encore is not opinionated)
+- **Authentication**: Choose to deploy an authentication gateway in front of Encore or implement authentication directly in your Encore app
+- **Events**: Use Encore's built-in Pub/Sub support for loose coupling
+
+#### 4. Expand your migration
+
+Continue migrating services incrementally. Strategies to consider:
+
+- **Related services**: Migrate services that interact frequently to maximize tracing benefits
+- **High-churn areas**: Move frequently changed services first
+- **New features**: Build new functionality in Encore from the start
+- **Critical paths**: Once confident, migrate business-critical services
+
+## Forklift migration using a catch-all handler
+
+Should you prefer, you can use a forklift migration strategy to move your entire application to Encore in one step by wrapping your existing HTTP router in a catch-all handler.
+
+### When to consider this approach
+
+This strategy works well when:
+
+- Your existing system is a monolith or smaller distributed system
+- The codebase relies primarily on infrastructure primitives supported by Encore (microservices, databases, pub/sub, caching, object storage, cron jobs, and secrets)
+- You want to quickly consolidate everything in one place
+- You're prepared to incrementally refactor to unlock full Encore features like tracing and automatic API documentation
+
+### Trade-offs
+
+**Benefits:**
+
+- **Quick consolidation**: Get everything in one place from the start.
+- **Immediate access to core features**: Quickly use Encore's CI/CD system, secrets manager, and deployment capabilities.
+- **Single codebase**: Simplified development and deployment workflow.
+
+**Limitations:**
+
+- **Limited initial visibility**: Advanced features like [distributed tracing](/docs/ts/observability/tracing) and [architecture diagrams](/docs/ts/observability/encore-flow) require the [Encore application model](/docs/ts/concepts/application-model) and won't work immediately.
+- **Requires refactoring**: You'll need to incrementally break out endpoints to unlock full Encore capabilities.
+- **All-at-once risk**: Unlike service-by-service migration, this is a bigger initial change.
+
+### Practical steps
+
+Here follows a quick summary of the high-level steps of a forklift migration. Find more in-depth instructions in the full [forklift migration guide](/docs/ts/migration/express-migration#forklift-migration-quick-start).
+
+#### 1. Create an app and structure your code
+
+To start, create an Encore application and copy over the code from your existing repository. In order to run your application with Encore, it needs to follow the expected [application structure](/docs/ts/primitives/app-structure), which involves placing the `encore.app` and `package.json` files in the repository root. This should be straightforward to do with minor modifications.
+
+As an example, a single service application might look like this on disk:
+
+```
+/my-app
+├── package.json
+├── encore.app
+├──  // ... other project files
+│
+├── encore.service.ts    // defines your service root
+├── api.ts               // API endpoints
+├── db.ts                // Database definition
+```
+
+You can also have services nested inside a `backend` folder if you prefer.
+
+#### 2. Create a catch-all handler for your HTTP router
+
+Now let's mount your existing HTTP router under a [Raw endpoint](/docs/ts/primitives/raw-endpoints), which is an Encore API endpoint type that gives you access to the underlying HTTP request.
+
+Here's a basic code example:
+
+```ts
+import { api } from "encore.dev/api";
+
+export const migrationHandler = api.raw(
+  { expose: true, method: "*", path: "/api/*path" },
+  async (req, resp) => {
+    // pass request to existing router
+  }
+);
+```
+
+By mounting your existing HTTP router in this way, it will work as a catch-all handler for all HTTP requests and responses. This should make your application deployable through Encore with little refactoring.
+
+#### 3. Iteratively fix remaining compilation errors
+
+Exactly what remains to make your application deployable with Encore will depend on your specific app.
+As you run your app locally, using `encore run`, Encore will parse and compile it, and give you compilation errors to inform what needs to be adjusted.
+
+By iteratively making adjustments, you should relatively quickly be able to get your application up and running with Encore.
+
+#### 4. Refactor incrementally to unlock Encore features
+
+Once your application is deployed, gradually break out specific endpoints using Encore's [API declarations](/docs/ts/primitives/defining-apis) and introduce infrastructure declarations using the Encore backend frameworks. This incremental refactoring will:
+
+- Enable Encore to understand your application structure
+- Unlock powerful features like distributed tracing and architecture diagrams
+- Improve observability and debugging capabilities
+- Make your codebase more maintainable and easier to evolve
+
+Start with the most frequently modified endpoints or the most critical user flows to maximize the value of refactoring efforts.
+
+## Conclusion
+
+Incremental migration lets you adopt Encore without the risk of a complete rewrite.
+
+**Service by service migration** is the recommended approach—it gives you Encore's full feature set immediately while running safely alongside your existing systems.
+
+**Enterprise customers** benefit from flexible deployment options, including Kubernetes integration and customization that typically takes just days to set up.
+
+### Have questions?
+
+We've helped 100+ teams adopt Encore and we're happy to answer your questions and provide advice to help you with your migration.
+
+- [Book a call](/book) to get 1:1 assistance
+- [Email us](mail:hello@encore.dev) to ask questions
+- [Join Discord](https://encore.dev/discord) to discuss with other developers using Encore
diff --git a/docs/platform/migration/try-encore.md b/docs/platform/migration/try-encore.md
new file mode 100644
index 0000000000..ea9d83a210
--- /dev/null
+++ b/docs/platform/migration/try-encore.md
@@ -0,0 +1,80 @@
+---
+title: Trying Encore for an existing project
+subtitle: Extending, Refactoring, and Rebuilding
+seotitle: Trying Encore for an existing project
+seodesc: Learn how to try Encore for your existing backend application using Extending, Refactoring, or Rebuilding, depending on your situation and priorities.
+lang: platform
+---
+
+Making changes to your backend requires a thoughtful approach and how you best evaluate a new tool, like Encore, depends on your situation and priorities. Here we’ll explore three approaches and introduce the common scenarios and procedures for each:
+- **Extend:** Using Encore to speed up building an independent new system or creating a proof of concept.
+- **Refactor:** Using Encore when refactoring an existing backend to unlock productivity benefits and remove complexity.
+- **Rebuild:** Using Encore when rebuilding an existing application from the ground up, ensuring modern best practices and cloud-portability.
+
+## Extend
+Extending your existing backend best suits teams who are mostly satisfied with their current setup, but are on the lookout for more efficient workflows to cut down delivery times for new projects, or wish to improve the developer experience for ongoing development.
+
+### Use cases
+- Extending an existing application with a new service or system, integrated using APIs.
+- Reducing effort when building a new system in an isolated domain, such as a new product experiment.
+- Tackling an independent project that demands fast delivery times.
+
+### When to consider Encore
+If your existing setup feels right but you’re curious about Encore, evaluating it in an independent project is the right move.
+For example when:
+- You want to create a new service or system and deploy it to your cloud in **AWS** or **GCP**, without manual infrastructure setup.
+- You want to try out development tools like [preview environments](/docs/platform/deploy/preview-environments), and [local tracing](/docs/ts/observability/dev-dash), without any manual instrumentation.
+- You want to validate Encore’s workflow and reliability without making changes to existing systems.
+
+### How to adopt Encore when Extending
+- **1. Identify Extension Points:** Decide on an upcoming project or proof of concept, that is relatively independent of your existing application and is appropriate for building as a new service or system.
+- **2. Create New Services:** Develop new services or systems using [Encore.ts](/docs/ts) or [Encore.go](/docs/go) to get off the ground quickly. This lets you try out all Encore features and enables you to design your new system with Encore’s [automatic architecture diagrams](/docs/ts/observability/encore-flow).
+- **3. Integrate via APIs:**  Where relevant, integrate your new system with your existing backend application using APIs. This can be made simpler by using Encore’s [generated API clients](/docs/ts/cli/client-generation).
+- **4. Validate & Iterate:** Deploy the new services to a [cloud environment](/docs/platform/infrastructure/infra), automatically provisioned by Encore, and validate their performance and interoperability. Use Encore’s [distributed tracing](/docs/ts/observability/tracing) to find bugs or performance issues.
+- **5. Connect cloud and Deploy:** When you are satisfied that your application is working as expected, [connect your cloud account](/docs/platform/deploy/own-cloud) (AWS or GCP) and create a production environment for your application. Encore automatically provisions the infrastructure needed using each cloud’s native services, or you can deploy your application into an [existing Kubernetes cluster](/docs/platform/infrastructure/import-kubernetes-cluster).
+
+## Refactor
+Refactoring can serve as a breath of fresh air for your existing code, revitalizing it by optimizing existing structures. In this approach, your goal is to improve on your existing backend application, often focusing on shedding unnecessary complexity and enabling new opportunities.
+
+### Use cases
+- Transforming a **monolith** into **microservices**.
+- Changing system architecture, e.g. moving to an [event-driven architecture](/blog/event-driven-architecture).
+- Cloud migration, e.g. from **AWS** to **GCP**.
+- Changing foundational infrastructure, e.g. migrating to **Kubernetes**.
+- Removing unwanted complexity that’s become engrained as you’ve scaled up quickly.
+
+### When to consider Encore
+Your application is already built using a supported programming language like **Go** or **TypeScript**. and you want to unlock modern development tools like [infrastructure automation](/docs/platform/infrastructure/infra), [preview environments](/docs/platform/deploy/preview-environments), and [distributed tracing](/docs/ts/observability/tracing), with minimal adjustments to your existing backend and no manual setup.
+
+### How to adopt Encore in a Refactor
+- **1. Assess Your Goal:** Start by evaluating what changes you want to make to your existing application, and look for unnecessary complexities and bottlenecks that can be eliminated. Depending on your goal, you can decide if you want to fully implement Encore’s [API declarations](/docs/ts/primitives/defining-apis) or if you prefer to minimize changes by using a catch-all handler on your current router. Keep in mind that in order to use features like the [Service Catalog](/docs/ts/observability/service-catalog), you need to use the API declarations defined in [Encore.ts](/docs/ts) or [Encore.go](/docs/go).
+- **2. Implement Backend Framework:** Start using [Encore.ts](/docs/ts) or [Encore.go](/docs/go) in your application by replacing existing infrastructure configuration and boilerplate. This enables you to use Encore's infrastructure automation and removes the hassle of manual infrastructure setup. **Tip:** [Existing databases can be integrated](/docs/go/primitives/connect-existing-db) so you don’t need to migrate existing data.
+- **3. Resolve compile-time errors:** Encore comes with a parser and compiler that ensures your application correctly implements the Backend Framework. This lets you discover problems at compile time and provides insightful error messages to help you quickly resolve any errors.
+- **4. Test & Iterate:** Test the refactored application to ensure stability and reliability using Encore’s automatically provisioned cloud [environments](/docs/platform/deploy/environments) and [distributed tracing](/docs/ts/observability/tracing) for fast debugging and iteration. If relevant, you can use a [generated client](/docs/ts/cli/client-generation) to integrate with your existing application frontend.
+- **5. Connect cloud and Deploy:** When you are satisfied that your application is working as expected, [connect your cloud account](/docs/platform/deploy/own-cloud) (AWS or GCP) and create a production environment for your application. Encore automatically provisions the infrastructure needed using each cloud’s native services, or you can deploy your application into an [existing Kubernetes cluster](/docs/platform/infrastructure/import-kubernetes-cluster).
+
+## Rebuild
+The Rebuild strategy is for those who want a fresh start by recreating an application from the ground up. It’s particularly relevant for companies looking to make a bigger change like changing programming language or migrating from legacy self-hosted infrastructure. A full rebuild, although potentially labor-intensive, opens up opportunities to harness the latest cloud services and developer tools like Encore.
+
+### Use cases
+- Changing programming languages to adopt more performant or modern ones for your project.
+- Migrating from legacy self-hosted solutions to scalable cloud providers like **AWS** or **GCP**.
+- Starting fresh by recreating an app from the ground up.
+
+### When to consider Encore
+- You’re intending to use a supported programming language like **Go** or **TypeScript**.
+- You want to leverage the scalability and services of cloud providers like **AWS** or **GCP**, but don’t want to become locked-in to one specific provider. (Encore applications are cloud-portable by default.)
+- You want modern development tools like [infrastructure automation](/docs/platform/infrastructure/infra), [preview environments](/docs/platform/deploy/preview-environments), and [distributed tracing](/docs/ts/observability/tracing), without manual setup or instrumentation.
+
+### How to adopt Encore in a Rebuild
+- **1. Plan & Design:** Start by creating a design, considering the application's core requirements and architecture. Decide on the programming language, keeping in mind Encore's supported languages.
+- **2. Develop from Scratch:** Develop your new application using Encore [Encore.ts](/docs/ts) or [Encore.go](/docs/go) to get up and running quickly in a shared environment using Encore’s built-in development cloud.
+- **3. Test & Iterate:** Test your new application to ensure reliability using Encore’s [distributed tracing](/docs/ts/observability/tracing) for fast debugging and iteration. Use the [generated API clients](/docs/ts/cli/client-generation) to integrate with your application frontend.
+- **4. Connect cloud and Deploy:** When you are satisfied that your application is working as expected, [connect your cloud account](/docs/platform/deploy/own-cloud) (AWS or GCP) and create a production environment for your application. Encore automatically provisions the infrastructure needed using each cloud’s native services, or you can deploy your application into an [existing Kubernetes cluster](/docs/platform/infrastructure/import-kubernetes-cluster).
+
+## Get support adopting Encore
+Each approach has different benefits and is relevant in different scenarios. Which one is right for your team depends on your priorities and existing setup.
+
+Whether it’s expanding your horizons with **Extend**, revitalizing existing structures through **Refactor**, or starting afresh with **Rebuild**, we’re available to support as you explore Encore to unlock improved productivity and developer experience.
+
+If you'd like to ask questions or get advice about how to get started, we're happy to talk through your project. You can [join Discord](https://encore.dev/discord) to ask questions and meet other Encore developers, or you can also [book a 1:1](/book) with a member of our core team.
diff --git a/docs/platform/observability/encore-flow.md b/docs/platform/observability/encore-flow.md
new file mode 100644
index 0000000000..65b04673f6
--- /dev/null
+++ b/docs/platform/observability/encore-flow.md
@@ -0,0 +1,50 @@
+---
+seotitle: Encore Flow automatic microservices architecture diagrams
+seodesc: Visualize your microservices architecture automatically using Encore Flow. Get real-time interactive architecture diagrams for your entire application.
+title: Flow Architecture Diagram
+subtitle: Visualize your cloud microservices architecture
+lang: platform
+---
+
+Flow is a visual tool that gives you an always up-to-date view of your entire system, helping you reason about your
+microservices architecture and identify which services depend on each other and how they work together.
+
+## Birds-eye view
+
+Having access to a zoomed out representation of your system can be invaluable in pretty much all parts of the
+development cycle. Flow helps you:
+
+* Track down bottlenecks before they grow into big problems.
+* Get new team members onboarded much faster.
+* Pinpoint hot paths in your system, services that might need extra attention.
+
+Services and PubSub topics are represented as boxes, arrows indicate a dependency. In the example below
+the `login` service has dependencies on the `user` and `authentication` services. Dashed arrows shows publications or
+subscriptions to a topic. Here, `payment` publishes to the `payment-made` topic and `email` subscribe to it:
+
+<img src="/assets/docs/flow-diagram.png" title="Encore Flow - Highlight Dependencies" />
+
+## Highlight dependencies
+
+Hover over a service, or PubSub topic, to instantly reveal the nature and scale of its dependencies.
+
+Here the `login` service and its dependencies are highlighted. We can see that `login` makes queries to the
+database and requests to two of the endpoints from the `user` service as well as requests to one endpoint from
+the `authentication` service:
+
+<img src="/assets/docs/flow-highlight.png" title="Encore Flow - Highlight Dependencies" />
+
+## Real-time updates
+
+Flow is accessible in the [Local Development Dashboard](/docs/ts/observability/dev-dash) and the [Encore Cloud dashboard](https://app.encore.cloud) for cloud environments.
+
+When developing locally, Flow will auto update in real-time to reflect your architecture as you
+make code changes. This helps you be mindful of important dependencies and makes it clear if you introduce new ones.
+
+For cloud environments, Flow auto-updates with each deploy.
+
+In the example below a new subscription on the topic `payment-made` is introduced and then removed in `user` service:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/flow-auto-update.mp4" className="w-full h-full" type="video/mp4" />
+</video>
diff --git a/docs/platform/observability/metrics.md b/docs/platform/observability/metrics.md
new file mode 100644
index 0000000000..4028a9f9d8
--- /dev/null
+++ b/docs/platform/observability/metrics.md
@@ -0,0 +1,120 @@
+---
+seotitle: Monitoring your backend application with custom metrics
+seodesc: See how you can monitor your backend application using Encore.
+title: Metrics
+subtitle: Built-in support for keeping track of key metrics
+infobox: {
+  title: "Metrics",
+  import: "encore.dev/metrics",
+}
+lang: platform
+---
+
+Having easy access to key metrics is a critical part of application observability.
+Encore solves this by providing automatic dashboards of common application-level
+metrics for each service.
+
+Encore also makes it easy to define custom metrics for your application. Once defined, custom metrics are automatically displayed on metrics page in the Cloud Dashboard.
+
+By default, Encore also exports metrics data to your cloud provider's built-in monitoring service.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/metricsvideo.mp4" className="w-full h-full" type="video/mp4" />
+</video>
+
+## Defining custom metrics
+
+Define custom metrics by importing the [`encore.dev/metrics`](https://pkg.go.dev/encore.dev/metrics) package and
+create a new metric using one of the `metrics.NewCounter` or `metrics.NewGauge` functions.
+
+For example, to count the number of orders processed:
+
+```go
+import "encore.dev/metrics"
+
+var OrdersProcessed = metrics.NewCounter[uint64]("orders_processed", metrics.CounterConfig{})
+
+func process(order *Order) {
+    // ...
+    OrdersProcessed.Increment()
+}
+```
+
+### Metric types
+
+Encore currently supports two metric types: counters and gauges.
+
+Counters, like the name suggests, measure the count of something. A counter's value must always
+increase, never decrease. (Note that the value gets reset to 0 when the application restarts.)
+Typical use cases include counting the number of requests, the amount of data processed, and so on.
+
+Gauges measure the current value of something. Unlike counters, a gauge's value can fluctuate up and down. Typical use
+cases include measuring CPU usage, the number of active instances running of a process, and so on.
+
+For information about their respective APIs, see the API documentation
+for [Counter](https://pkg.go.dev/encore.dev/metrics#Counter) and [Gauge](https://pkg.go.dev/encore.dev/metrics#Gauge).
+
+### Defining labels
+
+Encore's metrics package provides a type-safe way of attaching labels to metrics.
+To define labels, create a struct type representing the labels and then use `metrics.NewCounterGroup`
+or `metrics.NewGaugeGroup`:
+
+```go
+type Labels struct {
+    Success bool
+}
+
+var OrdersProcessed = metrics.NewCounterGroup[Labels, uint64]("orders_processed", metrics.CounterConfig{})
+
+func process(order *Order) {
+    var success bool
+    // ... populate success with true/false ...
+    OrdersProcessed.With(Labels{Success: success}).Increment()
+}
+```
+
+<Callout type="important">
+
+Each combination of label values creates a unique time series tracked in memory and stored by the monitoring system.
+Using numerous labels can lead to a combinatorial explosion, causing high cloud expenses and degraded performance.
+
+As a general rule, limit the unique time series to tens or hundreds at most, rather than thousands.
+
+</Callout>
+
+## Integrations with third party observability services
+
+To make it easy to use a third party service for monitoring, we're adding direct integrations between Encore and popular observability services. This means you can send your metrics directly to these third party services instead of your cloud provider's monitoring service.
+
+### Grafana Cloud
+
+To send metrics data to Grafana Cloud, you first need to Add a Grafana Cloud Stack to your application.
+
+Open your application in the [Encore Cloud dashboard](https://app.encore.cloud), and click on **Settings** in the main navigation.
+Then select **Grafana Cloud** in the settings menu and click on **Add Stack**.
+
+<img width="60%" src="/assets/docs/grafanastack.png" title="Add a Grafana Stack"/>
+
+Next, open the environment **Overview** for the environment you wish to sent metrics from and click on **Settings**.
+Then in the **Sending metrics data** section, select your Grafana Cloud Stack from the drop-down and save.
+
+<img width="60%" src="/assets/docs/configstack.png" title="Select Grafana Stack"/>
+
+That's it! After your next deploy, Encore will start sending metrics data to your Grafana Cloud Stack.
+
+### Datadog
+
+To send metrics data to Datadog, you first need to add a Datadog Account to your application.
+
+Open your application in the [Encore Cloud dashboard](https://app.encore.cloud), and click on **Settings** in the main navigation.
+Then select **Datadog** in the settings menu and click on **Add Account**.
+
+<img width="60%" src="/assets/docs/datadogaccount.png" title="Add a Datadog account"/>
+
+Next, open the environment **Overview** for the environment you wish to sent metrics from and click on **Settings**.
+Then in the **Sending metrics data** section, select your Datadog Account from the drop-down and save.
+
+<img width="60%" src="/assets/docs/configstack.png" title="Select Datadog Account"/>
+
+That's it! After your next deploy, Encore will start sending metrics data to your Datadog Account.
diff --git a/docs/platform/observability/service-catalog.md b/docs/platform/observability/service-catalog.md
new file mode 100644
index 0000000000..3c7623e7bf
--- /dev/null
+++ b/docs/platform/observability/service-catalog.md
@@ -0,0 +1,17 @@
+---
+seotitle: Service Catalog & Generated API Docs
+seodesc: See how Encore automatically generates API documentation that always stays up to date and in sync.
+title: Service Catalog
+subtitle: Automatically get a Service Catalog and complete API docs
+lang: platform
+---
+
+All developers agree API documentation is great to have, but the effort of maintaining it inevitably leads to docs becoming stale and out of date.
+
+To solve this, Encore uses the [Encore Application Model](/docs/ts/concepts/application-model) to automatically generate a Service Catalog along with complete documentation for all APIs. This ensures docs are always up-to-date as your APIs evolve.
+
+The API docs are available both in your [Local Development Dashboard](/docs/ts/observability/dev-dash) and for your whole team in the [Encore Cloud dashboard](https://app.encore.cloud).
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/servicecatalogvideo.mp4" className="w-full h-full" type="video/mp4" />
+</video>
diff --git a/docs/platform/observability/tracing.md b/docs/platform/observability/tracing.md
new file mode 100644
index 0000000000..4ece1aa44a
--- /dev/null
+++ b/docs/platform/observability/tracing.md
@@ -0,0 +1,39 @@
+---
+seotitle: Distributed Tracing helps you understand your app
+seodesc: See how to use distributed tracing in your backend application, across multiple services, using Encore.
+title: Distributed Tracing
+subtitle: Track requests across your application and infrastructure
+lang: platform
+---
+
+Distributed systems often have many moving parts, making it difficult to understand what your code is doing and finding the root-cause to bugs. That’s where Tracing comes in. If you haven’t seen it before, it may just about change your life.
+
+Tracing is a revolutionary way to gain insight into what your applications are doing. It works by capturing the series of events as they occur during the execution of your code (a “trace”). This works by propagating a trace id between all individual systems, then correlating and joining the information together to present a unified picture of what happened end-to-end.
+
+As opposed to the labor intensive instrumentation you'd normally need to go through to use tracing, Encore automatically captures traces for your entire application – in all environments. Uniquely, this means you can use tracing even for local development to help debugging and speed up iterations.
+
+You view traces in the [Local Development Dashboard](/docs/ts/observability/dev-dash) and in the [Encore Cloud dashboard](https://app.encore.cloud) for Production and other environments.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/tracingvideo.mp4" className="w-full h-full" type="video/mp4" />
+</video>
+
+## Encore's tracing is more comprehensive and more performant than all other tools
+
+Unlike other tracing solutions, Encore understands what each trace event is and captures unique insights about each one. This means you get access to more information than ever before:
+
+* Stack traces
+* Structured logging
+* HTTP requests
+* Network connection information
+* API calls
+* Database queries
+* etc.
+
+## Redacting sensitive data
+
+Encore's tracing automatically captures request and response payloads to simplify debugging.
+
+For cases where this is undesirable, such as for passwords or personally identifiable information (PII), Encore supports redacting fields marked as containing sensitive data.
+
+See the documentation on [API Schemas](/docs/ts/primitives/defining-apis#sensitive-data) for more information.
diff --git a/docs/platform/other/vs-heroku.md b/docs/platform/other/vs-heroku.md
new file mode 100644
index 0000000000..820fc5511c
--- /dev/null
+++ b/docs/platform/other/vs-heroku.md
@@ -0,0 +1,71 @@
+---
+seotitle: Encore compared to Heroku
+seodesc: See how the Encore Backend Development Platform lets you avoid the lock-in problems of using Heroku.
+title: Encore compared to Heroku
+subtitle: Get the convenience you want — without limitations and lock-in
+lang: platform
+---
+
+In the early days of the cloud, Heroku was seen as an innovative platform that made deployments and infrastructure management very simple using a Platform as a Service (PaaS) approach. Ultimately, Heroku lost momentum and, as cloud services rapidly evolved in the past decade, the platform didn't manage to provide enough flexibility to support users' needs.
+
+Fans of Heroku will recognize much of the same simplicity in Encore's **push to deploy** workflow — the big difference is that **Encore deploys to your own cloud on AWS/GCP**. This means you keep full flexibility to scale your application using battle-tested services from the major cloud providers, and can leverage their full arsenal of thousands of different services.
+
+Let's take a look at how Encore compares to PaaS tools like Heroku:
+
+|                                                      | Encore                   | Heroku                |
+| ---------------------------------------------------- | ------------------------ | --------------------- |
+| **Infrastructure approach?**                         | Infrastructure from Code | Platform as a Service |
+| **Built-in CI/CD?**                                  | ✅︎ Yes                    | ✅︎ Yes                 |
+| **Built-in Preview Environments?**                   | ✅︎ Yes                    | ✅︎ Yes                 |
+| **Built-in local dev environment?**                  | ✅︎ Yes                    | ❌ No                  |
+| **Built-in Distributed Tracing?**                    | ✅︎ Yes                    | ❌ No                  |
+| **Deploys to major cloud providers like AWS & GCP?** | ✅︎ Yes                    | ❌ No                  |
+| **Avoids cloud lock-in?**                            | ✅︎ Yes                    | ❌ No                  |
+| **Supports Kubernetes and custom infra?**            | ✅︎ Yes                    | ❌ No                  |
+| **Infrastructure is Type-Safe?**                     | ✅︎ Yes                    | ❌ No                  |
+| **Charges for hosting?**                             | No                       | Yes                   |
+
+## Encore is the simplest way of accessing the full power and flexibility of the major cloud providers
+
+With Encore you don't need to be a cloud expert to make full use of the services offered by major cloud providers like AWS and GCP.
+
+You simply use [Encore.ts](/docs/ts) or [Encore.go](/docs/go) to **declare the infrastructure semantics directly in your application code**, and Encore then [automatically provisions the necessary infrastructure](/docs/platform/infrastructure/infra) in your cloud, and provides a local development environment that matches your cloud environment.
+
+You get the same, easy to use, "push to deploy" workflow that many developers appreciate with Heroku, while still being able to build large-scale distributed systems and event-driven applications deployed to AWS and GCP.
+
+## Encore's local development workflow lets application developers focus
+
+When using a PaaS service like Heroku to deploy your application, you're not at all solving for an efficient local development workflow.
+
+This means, with Heroku, developers need to manually set up and maintain their local environment and observability tools, in order to facilitate local development and testing.
+
+This can be a major distraction for application developers, because it forces them to spend time learning how to setup and maintain various local versions of cloud infrastructure, e.g. by using Docker Compose. This work is a continuous effort as the system evolves, and becomes more and more complex as the service and infrastructure footprint grows.
+
+All this effort takes time away from product development and slows down onboarding time for new developers.
+
+**When using Encore, your local and cloud environments are both defined by the same code base: your application code.** This means developers only need to use `encore run` to start their local dev environments. Encore's Open Source CLI takes care of setting up local version of all infrastructure and provides a [local development dashboard](/docs/ts/observability/dev-dash) with built-in observability tools.
+
+This greatly speeds up development iterations as developers can start using new infrastructure immediately, which makes building new services and event-driven systems extremely efficient.
+
+## Encore provides an end-to-end purpose-built workflow for cloud backend development
+
+Encore does a lot more than just automate infrastructure provisioning and configuration. It's designed as a purpose-built tool for cloud backend development and comes with out-of-the-box tooling for both development and DevOps.
+
+### Encore's built-in developer tools
+- Cross-service type-safety with IDE auto-complete
+- Distributed Tracing
+- Test Tracing
+- Automatic API Documentation
+- Automatic Architecture Diagrams
+- API Client Generation
+- Secrets Management
+- Service/API mocking
+
+### Encore's built-in DevOps tools
+- Automatic Infrastructure provisioning on AWS/GCP
+- Infrastructure Tracking & Approvals workflow
+- Cloud Configuration 2-way sync between Encore and AWS/GCP
+- Automatic least privilege IAM
+- Preview Environments per Pull Request
+- Cost Analytics Dashboard
+- Encore Terraform provider for extending Encore with infrastructure that is not currently part of Encore's Backend Framework
diff --git a/docs/platform/other/vs-supabase.md b/docs/platform/other/vs-supabase.md
new file mode 100644
index 0000000000..ddddcf9851
--- /dev/null
+++ b/docs/platform/other/vs-supabase.md
@@ -0,0 +1,119 @@
+---
+seotitle: Encore compared to Supabase / Firebase
+seodesc: See how Encore's Backend Development Platform lets you unlock the simplicity of tools like Supabase and Firebase, while maintaining the control and flexibility of building a real backend application.
+title: Encore compared to Supabase + Firebase
+subtitle: Get the simplicity you want — with flexibility and scalability
+lang: platform
+---
+
+Supabase and Firebase are two popular _Backend as a Service_ providers, that provide developers with an easy way to get a database up and running for their applications. They also bundle some built-in services for common use cases like authentication. 
+
+This can be a great way of getting off the ground quickly. But as many developers have come to learn, you risk finding yourself boxed into a corner if you're not in full control of your own backend when new use cases arise.
+
+**Encore is not a _Backend as a Service_, it's a platform _for_ backend development**. It gives you many of the same benefits that Supabase and Firebase offer, like not needing to manually provision your [databases](/docs/ts/primitives/databases) (or any other infrastructure for that matter). The key difference is, **Encore provisions your infrastructure in your own cloud account on AWS/GCP.** This also lets you easily use any cloud service offered by the major cloud providers, and you don't risk being limited by the platform and having to start over from scratch.
+
+Let's take a look at how Encore compares to BaaS platforms like Supabase and Firebase:
+
+|                                                     | Encore                       | Supabase             | Firebase             |
+| --------------------------------------------------- | ---------------------------- | -------------------- | -------------------- |
+| **Approach?**                                       | Backend Development Platform | Backend as a Service | Backend as a Service |
+| **Native PostgreSQL support?**                      | ✅︎ Yes                        | ✅︎ Yes                | ❌ No                 |
+| **Support pgvector for AI use cases?**              | ✅︎ Yes                        | ✅︎ Yes                | ❌ No                 |
+| **Supports major cloud providers like AWS/GCP?**    | ✅︎ Yes                        | ❌ No                 | ✅︎ Yes (GCP only)     |
+| **Supports Microservices?**                         | ✅︎ Yes                        | ❌ No                 | ❌ No                 |
+| **Supports Event-Driven systems?**                  | ✅︎ Yes                        | ❌ No                 | ❌ No                 |
+| **Supports Kubernetes and custom infra?**           | ✅︎ Yes                        | ❌ No                 | ❌ No                 |
+| **Infrastructure is Type-Safe?**                    | ✅︎ Yes                        | ❌ No                 | ❌ No                 |
+| **Built-in local dev environment?**                 | ✅︎ Yes                        | ❌ No                 | ❌ No                 |
+| **Built-in Preview Environments per Pull Request?** | ✅︎ Yes                        | ❌ No                 | ❌ No                 |
+| **Built-in Distributed Tracing?**                   | ✅︎ Yes                        | ❌ No                 | ❌ No                 |
+| **Charges for hosting?**                            | No                           | Yes                  | Yes                  |
+
+## Encore is the simplest way of accessing the full power and flexibility of the major cloud providers
+
+With Encore you don't need to be a cloud expert to make full use of the services offered by major cloud providers like AWS and GCP.
+
+You simply use [Encore.ts](/docs/ts) or [Encore.go](/docs/go) to **declare the infrastructure semantics directly in your application code**, and Encore then [automatically provisions the necessary infrastructure](/docs/platform/infrastructure/infra) in your cloud, and provides a local development environment that matches your cloud environment.
+
+### Example: Using PostgreSQL with Encore
+
+Here's an example of how to use [Encore.ts](/docs/ts) or [Encore.go](/docs/go) to define a PostgreSQL database (Go is used in the example, TypeScript support is also available):
+
+To create a database, import `encore.dev/storage/sqldb` and call `sqldb.NewDatabase`, assigning the result to a package-level variable.
+Databases must be created from within an [Encore service](/docs/go/primitives/services).
+
+For example:
+
+```
+-- todo/db.go --
+package todo
+
+// Create the todo database and assign it to the "tododb" variable
+var tododb = sqldb.NewDatabase("todo", sqldb.DatabaseConfig{
+	Migrations: "./migrations",
+})
+
+// Then, query the database using db.QueryRow, db.Exec, etc.
+-- todo/migrations/1_create_table.up.sql --
+CREATE TABLE todo_item (
+  id BIGSERIAL PRIMARY KEY,
+  title TEXT NOT NULL,
+  done BOOLEAN NOT NULL DEFAULT false
+  -- etc...
+);
+```
+
+As seen above, the `sqldb.DatabaseConfig` specifies the directory containing the database migration files,
+which is how you define the database schema.
+
+With this code in place Encore will automatically create the database when starting `encore run` (locally)
+or on the next deployment (in the cloud). Encore automatically injects the appropriate configuration to authenticate
+and connect to the database, so once the application starts up the database is ready to be used.
+
+[Learn more about using databases with Encore](/docs/go/primitives/databases)
+
+## Encore makes it simple to build type-safe event-driven systems
+
+Unlike BaaS platforms like Supabase and Firebase, Encore has extensive support for building microservices backends and event-driven systems.
+
+For example, Encore lets you [define APIs](/docs/ts/primitives/apis) using regular functions and enables cross-service type-safety with IDE auto-complete when making API calls between services.
+
+With [Encore.ts](/docs/ts) and [Encore.go](/docs/go), you can build event-driven systems by defining Pub/Sub topics and subscriptions as type-safe objects in your application.
+This gives you type-safety for Pub/Sub with compilation errors for any type-errors.
+
+## Encore's local development workflow lets application developers focus
+
+When using a BaaS service like Supabase to handle your infrastructure, you're not at all solving for local development.
+
+This means, with Supabase, developers need to manually set up and maintain their local environment in order to facilitate local development and testing.
+
+This can be a major distraction for application developers, because it forces them to spend time learning how to setup and maintain various local versions of cloud infrastructure, e.g. by using Docker Compose. This work is a continuous effort as the system evolves, and becomes more and more complex as the service and infrastructure footprint grows.
+
+All this effort takes time away from product development and slows down onboarding time for new developers.
+
+**When using Encore, your local and cloud environments are both defined by the same code base: your application code.** This means developers only need to use `encore run` to start their local dev environments. Encore's Open Source CLI takes care of setting up local version of all infrastructure and provides a [local development dashboard](/docs/ts/observability/dev-dash) with built-in observability tools.
+
+This greatly speeds up development iterations as developers can start using new infrastructure immediately, which makes building new services and event-driven systems extremely efficient.
+
+## Encore provides an end-to-end purpose-built workflow for cloud backend development
+
+Encore does a lot more than just automate infrastructure provisioning and configuration. It's designed as a purpose-built tool for cloud backend development and comes with out-of-the-box tooling for both development and DevOps.
+
+### Encore's built-in developer tools
+- Cross-service type-safety with IDE auto-complete
+- Distributed Tracing
+- Test Tracing
+- Automatic API Documentation
+- Automatic Architecture Diagrams
+- API Client Generation
+- Secrets Management
+- Service/API mocking
+
+### Encore's built-in DevOps tools
+- Automatic Infrastructure provisioning on AWS/GCP
+- Infrastructure Tracking & Approvals workflow
+- Cloud Configuration 2-way sync between Encore and AWS/GCP
+- Automatic least privilege IAM
+- Preview Environments per Pull Request
+- Cost Analytics Dashboard
+- Encore Terraform provider for extending Encore with infrastructure that is not currently part of Encore's Backend Framework
diff --git a/docs/platform/other/vs-terraform.md b/docs/platform/other/vs-terraform.md
new file mode 100644
index 0000000000..d8dc5fe116
--- /dev/null
+++ b/docs/platform/other/vs-terraform.md
@@ -0,0 +1,78 @@
+---
+seotitle: Encore compared to Terraform and Pulumi
+seodesc: See how Encore's infrastructure from code approach lets you avoid the common pitfalls of infrastructure as code solutions like Terraform and Pulumi.
+title: Encore compared to Terraform & Pulumi
+subtitle: How Encore is different from Infrastructure as Code tools
+lang: platform
+---
+
+There are many tools designed to overcome the challenges of cloud infrastructure complexity. Terraform and Pulumi are _Infrastructure as Code_ tools that help you provision infrastructure by writing infrastructure configuration files. **Encore uses a fundamentally different approach that lets you declare infrastructure as type-safe objects in your application**.
+
+Let's take a look at how Encore compares to IaC tools like Terraform and Pulumi:
+
+|                                                                     | Encore                   | Terraform              | Pulumi                 |
+| ------------------------------------------------------------------- | ------------------------ | ---------------------- | ---------------------- |
+| **Approach?**                                                       | Infrastructure from Code | Infrastructure as Code | Infrastructure as Code |
+| **Supports major cloud providers like AWS/GCP?**                    | ✅︎ Yes                    | ✅︎ Yes                  | ✅︎ Yes                  |
+| **Supports Kubernetes and custom infra configuration?**             | ✅︎ Yes                    | ✅︎ Yes                  | ✅︎ Yes                  |
+| **Avoid learning a DSL?**                                           | ✅︎ Yes                    | ❌ No                   | ✅︎ Yes                  |
+| **Infrastructure is Type-Safe?**                                    | ✅︎ Yes                    | ❌ No                   | ❌ No                   |
+| **Built-in local dev environment?**                                 | ✅︎ Yes                    | ❌ No                   | ❌ No                   |
+| **Built-in Preview Environments per Pull Request?**                 | ✅︎ Yes                    | ❌ No                   | ❌ No                   |
+| **Built-in Distributed Tracing?**                                   | ✅︎ Yes                    | ❌ No                   | ❌ No                   |
+| **Avoid manually writing infra config files?**                      | ✅︎ Yes                    | ❌ No                   | ❌ No                   |
+| **Avoid manual maintenance of separate codebase for infra config?** | ✅︎ Yes                    | ❌ No                   | ❌ No                   |
+| **Avoid manual effort to keep environments in sync?**               | ✅︎ Yes                    | ❌ No                   | ❌ No                   |
+
+## Encore removes manual effort and maintenance required with IaC
+
+A common challenge with Infrastructure as Code (IaC) is that it takes a lot of manual effort to write. What's worse is, you need to repeat the effort for each new environment, or take a short cut by duplicating your prod environment and creating costly over-provisioned test or staging environments.
+
+When you use IaC you also end up with a separate codebase to maintain and keep in sync with your application's actual requirements. The complexity and scope of this problem grows as you introduce more infrastructure and more environments. That means as your system grows, with IaC, you will need to spend more and more time to maintain your infrastructure configuration.
+
+**Encore's _infrastructure from code_ approach means there are no configuration files to maintain**, nor any refactoring to do when changing the underlying infrastructure. Your application code is the source of truth for the semantic infrastructure requirements.
+
+In practise, you use [Encore.ts](/docs/ts) and [Encore.go](/docs/go) to declare infrastructure as type-safe objects in your application code, and **Encore [automatically provisions the necessary infrastructure](/docs/platform/infrastructure/infra) in all environments.** Including in your own cloud, with support for major cloud providers like AWS/GCP. (This also means your application is cloud-agnostic by default and **you avoid cloud lock-in**.)
+
+## Encore's local development workflow lets application developers focus
+
+When using IaC to provision cloud environments, you're not at all solving for local development.
+
+This means, with Terraform, developers need to manually set up and maintain their local environment to mimic what's running in the cloud, in order to facilitate local development and testing.
+
+This can be a major distraction for application developers, because it forces them to spend time learning how to setup and maintain various local versions of cloud infrastructure, e.g. by using Docker Compose and NSQ. This work is a continuous effort as the system evolves, and becomes more and more complex as the footprint grows.
+
+All this effort takes time away from product development and slows down onboarding time for new developers.
+
+**When using Encore, your local and cloud environments are both defined by the same code base: your application code.** This means developers only need to use `encore run` to start their local dev environments. Encore's Open Source CLI takes care of setting up local version of all infrastructure and provides a [local development dashboard](/docs/ts/observability/dev-dash) with built-in observability tools.
+
+This greatly speeds up development iterations as developers can start using new infrastructure immediately, which makes building new services and event-driven systems extremely efficient.
+
+## Encore ensures your cloud environments are secure by automating IAM
+
+When using IaC tools like Terraform, you must always assign explicit permissions using IAM identities and IAM policies. This can be very time consuming when developing a large-scale distributed systems, and when you get it wrong it can lead to glaring security holes or unexpected system behavior.
+
+When using Encore, IAM identities and policies are automatically defined according to best practices for least privilege security. This is possible because Encore parses your source code and builds a graph of the logical architecture, it then uses this to define the infrastructure needs. This means Encore knows exactly which services needs access to which infrastructure for your application to function as expected.
+
+## Encore provides an end-to-end purpose-built workflow for cloud backend development
+
+Encore does a lot more than just automate infrastructure provisioning and configuration. It's designed as a purpose-built tool for cloud backend development and comes with out-of-the-box tooling for both development and DevOps.
+
+### Encore's built-in developer tools
+- Cross-service type-safety with IDE auto-complete
+- Distributed Tracing
+- Test Tracing
+- Automatic API Documentation
+- Automatic Architecture Diagrams
+- API Client Generation
+- Secrets Management
+- Service/API mocking
+
+### Encore's built-in DevOps tools
+- Automatic Infrastructure provisioning on AWS/GCP
+- Infrastructure Tracking & Approvals workflow
+- Cloud Configuration 2-way sync between Encore and AWS/GCP
+- Automatic least privilege IAM
+- Preview Environments per Pull Request
+- Cost Analytics Dashboard
+- Encore Terraform provider for extending Encore with infrastructure that is not currently part of Encore's Backend Framework
diff --git a/docs/platform/overview.md b/docs/platform/overview.md
new file mode 100644
index 0000000000..c501ce6c0c
--- /dev/null
+++ b/docs/platform/overview.md
@@ -0,0 +1,90 @@
+---
+seotitle: Encore Cloud Docs
+seodesc: How Encore Cloud Platform helps you reduce DevOps work by 90% by automating infra in your cloud on AWS/GCP.
+title: Encore Cloud
+subtitle: The easiest way to develop and deploy your application to AWS/GCP
+toc: false
+lang: platform
+---
+
+Encore Cloud automates DevOps and infrastructure on AWS and GCP — trusted by fast-moving teams to **2x** their development speed and reduce DevOps work by **93%**.
+
+**If you're new, learn all about how Encore works in the [introduction](/docs/platform/introduction).**
+
+<div className="min-h-72 bg-black p-8 relative overflow-hidden not-prose">
+    <div className="w-[75%] lg:w-[85%]">
+        <h2 className="text-white lead-medium">Get Started</h2>
+        <div className="body-small text-white mt-2">
+            Sign up and take a tour of the Encore Cloud dashboard.
+        </div>
+        <a href="/signup">
+            <Button className="mt-4" kind="primary" section="black">Sign up</Button>
+        </a>
+    </div>
+</div>
+
+<div className="mt-6 grid grid-cols-2 gap-6 mobile:grid-cols-1 not-prose">
+<a className="block group relative no-brandient" href="/docs/platform/introduction">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2 relative">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Introduction</h3>
+                <img className="-mt-2 h-16 w-16 p-3 noshadow" src="/assets/icons/features/higher.png" />
+            </div>
+            <div className="mt-2">
+                Learn about the problems Encore Cloud solves and the philosophy behind it.
+            </div>
+        </div>
+    </a>
+    <a className="block group relative no-brandient" target="_blank" href="/book">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Book a call</h3>
+                <img className="-mt-2 h-16 w-16 noshadow" src="/assets/icons/features/meet.png" />
+            </div>
+            <div className="mt-2">
+                Speak to one of our experts to figure out if Encore Cloud will work for your project.
+            </div>
+        </div>
+    </a>
+    <a className="block group relative no-brandient" href="/discord">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Join Discord</h3>
+                <div className="inline-flex w-16 h-16 items-center justify-center">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 -28.5 256 256">
+                        <path fill="#111111"
+                            d="M216.856339,16.5966031 C200.285002,8.84328665 182.566144,3.2084988 164.041564,0 C161.766523,4.11318106 159.108624,9.64549908 157.276099,14.0464379 C137.583995,11.0849896 118.072967,11.0849896 98.7430163,14.0464379 C96.9108417,9.64549908 94.1925838,4.11318106 91.8971895,0 C73.3526068,3.2084988 55.6133949,8.86399117 39.0420583,16.6376612 C5.61752293,67.146514 -3.4433191,116.400813 1.08711069,164.955721 C23.2560196,181.510915 44.7403634,191.567697 65.8621325,198.148576 C71.0772151,190.971126 75.7283628,183.341335 79.7352139,175.300261 C72.104019,172.400575 64.7949724,168.822202 57.8887866,164.667963 C59.7209612,163.310589 61.5131304,161.891452 63.2445898,160.431257 C105.36741,180.133187 151.134928,180.133187 192.754523,160.431257 C194.506336,161.891452 196.298154,163.310589 198.110326,164.667963 C191.183787,168.842556 183.854737,172.420929 176.223542,175.320965 C180.230393,183.341335 184.861538,190.991831 190.096624,198.16893 C211.238746,191.588051 232.743023,181.531619 254.911949,164.955721 C260.227747,108.668201 245.831087,59.8662432 216.856339,16.5966031 Z M85.4738752,135.09489 C72.8290281,135.09489 62.4592217,123.290155 62.4592217,108.914901 C62.4592217,94.5396472 72.607595,82.7145587 85.4738752,82.7145587 C98.3405064,82.7145587 108.709962,94.5189427 108.488529,108.914901 C108.508531,123.290155 98.3405064,135.09489 85.4738752,135.09489 Z M170.525237,135.09489 C157.88039,135.09489 147.510584,123.290155 147.510584,108.914901 C147.510584,94.5396472 157.658606,82.7145587 170.525237,82.7145587 C183.391518,82.7145587 193.761324,94.5189427 193.539891,108.914901 C193.539891,123.290155 183.391518,135.09489 170.525237,135.09489 Z" />
+                    </svg>
+                </div>
+            </div>
+            <div className="mt-2">
+                Ask questions and get help on Discord.
+            </div>
+        </div>
+    </a>
+    <a className="block group relative no-brandient" href="https://github.com/encoredev/encore">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Star on GitHub</h3>
+                <div className="inline-flex w-16 h-16 items-center justify-center">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 16 16" fill="#111111"
+                        stroke="none">
+                        <path fillRule="evenodd"
+                            d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z" />
+                    </svg>
+                </div>
+            </div>
+            <div className="mt-2">
+                Get involved and star Encore on GitHub.
+            </div>
+        </div>
+    </a>
+</div>
\ No newline at end of file
diff --git a/docs/ts/cli/cli-reference.md b/docs/ts/cli/cli-reference.md
new file mode 100644
index 0000000000..efeddb4906
--- /dev/null
+++ b/docs/ts/cli/cli-reference.md
@@ -0,0 +1,342 @@
+---
+seotitle: Encore CLI Reference
+seodesc: The Encore CLI lets you run your local development environment, create apps, and much more. See all CLI commands in this reference guide.
+title: CLI Reference
+subtitle: The Encore CLI lets you run your local environment and much more.
+lang: ts
+---
+
+## Running
+
+#### Run
+
+Runs your application.
+
+```shell
+$ encore run [--debug] [--watch=true] [--port NUMBER] [flags]
+```
+
+#### Test
+
+Tests your application
+
+Takes all the same flags as `go test`.
+
+```shell
+$ encore test ./... [go test flags]
+```
+
+#### Check
+
+Checks your application for compile-time errors using Encore's compiler.
+
+```shell
+$ encore check
+```
+
+#### Exec
+
+Runs executable scripts against the local Encore app.
+
+Takes a command that it will execute with the local Encore app environment setup.
+
+```
+$ encore exec -- <command>
+```
+
+##### Example
+
+Run a database seed script
+
+```
+$ encore exec -- npx tsx ./seed.ts
+```
+
+## App
+
+Commands to create and link Encore apps
+
+#### Clone
+
+Clone an Encore app to your computer
+
+```shell
+$ encore app clone [app-id] [directory]
+```
+
+#### Create
+
+Create a new Encore app
+
+```shell
+$ encore app create [name]
+```
+
+### Init
+
+Create a new Encore app from an existing repository
+
+```shell
+$ encore app init [name]
+```
+
+#### Link
+
+Link an Encore app with the server
+
+```shell
+$ encore app link [app-id]
+```
+
+## Auth
+
+Commands to authenticate with Encore
+
+#### Login
+
+Log in to Encore
+
+```shell
+$ encore auth login
+```
+
+#### Logout
+
+Logs out the currently logged in user
+
+```shell
+$ encore auth logout
+```
+
+#### Signup
+
+Create a new Encore account
+
+```shell
+$ encore auth signup
+```
+
+#### Whoami
+
+Show the current logged in user
+
+```shell
+$ encore auth whoami
+```
+
+## Daemon
+
+Encore CLI daemon commands
+
+#### Restart
+
+If you experience unexpected behavior, try restarting the daemon using:
+
+```shell
+$ encore daemon
+```
+
+#### Env
+
+Outputs Encore environment information
+
+```shell
+$ encore daemon env
+```
+
+## Database Management
+
+Database management commands
+
+#### Connect to database via shell
+
+Connects to the database via psql shell
+
+Defaults to connecting to your local environment. Specify --env to connect to another environment.
+
+```shell
+$ encore db shell <database-name> [--env=<name>]
+```
+
+`encore db shell` defaults to read-only permissions. Use `--write`, `--admin` and `--superuser` flags to modify which permissions you connect with.
+
+#### Connection URI
+
+Outputs a database connection string for `<database-name>`. Defaults to connecting to your local environment. Specify --env to connect to another environment.
+
+```shell
+$ encore db conn-uri <database-name> [--env=<name>] [flags]
+```
+
+#### Proxy
+
+Sets up local proxy that forwards any incoming connection to the databases in the specified environment.
+
+```shell
+$ encore db proxy [--env=<name>] [flags]
+```
+
+#### Reset
+
+Resets the databases for the given services. Use --all to reset all databases.
+
+```shell
+$ encore db reset [service-names...] [flags]
+```
+
+## Code Generation
+
+Code generation commands
+
+#### Generate client
+
+Generates an API client for your app. For more information about the generated clients, see [this page](/docs/ts/cli/client-generation).
+
+By default, `encore gen client` generates the client based on the version of your application currently running in your local environment.
+You can change this using the `--env` flag and specifying the environment name.
+
+Use `--lang=<lang>` to specify the language. Supported language codes are:
+- `go`: A Go client using the net/http package
+- `typescript`: A TypeScript client using the in-browser Fetch API
+- `javascript`: A JavaScript client using the in-browser Fetch API
+- `openapi`: An OpenAPI spec
+
+
+```shell
+$ encore gen client [<app-id>] [--env=<name>] [--services=foo,bar] [--excluded-services=baz,qux] [--lang=<lang>] [flags]
+```
+
+## Logs
+
+Streams logs from your application
+
+```shell
+$ encore logs [--env=prod] [--json]
+```
+
+## Kubernetes
+
+Kubernetes management commands
+
+#### Configure
+
+Updates your kubectl config to point to the Kubernetes cluster(s) for the specified environment
+
+```shell
+$ encore k8s configure --env=ENV_NAME
+```
+
+## Secrets Management
+
+Secret management commands
+
+#### Set
+
+Sets a secret value
+
+```shell
+$ encore secret set --type <types> <secret-name>
+```
+
+Where `<types>` defines which environment types the secret value applies to. Use a comma-separated list of `production`, `development`, `preview`, and `local`. Shorthands: `prod`, `dev`, `pr`.
+
+**Examples**
+
+
+Entering a secret directly in terminal:
+
+	$ encore secret set --type dev MySecret
+	Enter secret value: ...
+	Successfully created secret value for MySecret.
+
+Piping a secret from a file:
+
+	$ encore secret set --type dev,local MySecret < my-secret.txt
+	Successfully created secret value for MySecret.
+
+Note that this strips trailing newlines from the secret value.
+
+#### List
+
+Lists secrets, optionally for a specific key
+
+```shell 
+$ encore secret list [keys...]
+```
+
+#### Archive
+
+Archives a secret value
+
+```shell
+$ encore secret archive <id>
+```
+
+#### Unarchive
+
+Unarchives a secret value
+
+```shell
+$  encore secret unarchive <id>
+```
+
+
+## Version
+
+Reports the current version of the encore application
+
+```shell
+$ encore version
+```
+
+#### Update
+
+Checks for an update of encore and, if one is available, runs the appropriate command to update it.
+
+```shell
+$ encore version update
+```
+
+## VPN
+
+VPN management commands
+
+#### Start
+
+Sets up a secure connection to private environments
+
+```shell
+$ encore vpn start
+```
+
+#### Status
+
+Determines the status of the VPN connection
+
+```shell
+$ encore vpn status
+```
+
+#### Stop
+
+Stops the VPN connection
+
+```shell
+$ encore vpn stop
+```
+## Build
+
+Generates an image for your app, which can be used to [self-host](/docs/ts/self-host/build) your app.
+
+#### Docker
+
+Builds a portable Docker image of your Encore application.
+
+```shell
+$ encore build docker
+```
+
+**Flags**
+
+`--base string` defines the base image to build from (default "scratch")
+`--push` pushes image to remote repository
diff --git a/docs/ts/cli/client-generation.md b/docs/ts/cli/client-generation.md
new file mode 100644
index 0000000000..1d38994dba
--- /dev/null
+++ b/docs/ts/cli/client-generation.md
@@ -0,0 +1,143 @@
+---
+seotitle: Automatic API Client Generation
+seodesc: Learn how you can use automatic API client generation to get clients for your backend. See how to integrate with your frontend using a type-safe generated client.
+title: Client Library Generation
+subtitle: Stop writing the same types everywhere
+lang: ts
+---
+
+Encore makes it simple to write scalable distributed backends by allowing you to make function calls that Encore translates into RPC calls. Encore also generates API clients with interfaces that look like the original Go functions, with the same parameters and response signature as the server.
+
+The generated clients are single files that use only the standard functionality of the target language, with full type safety. This allow anyone to look at the generated client and understand exactly how it works.
+
+The structure of the generated code varies by language, to ensure it's idiomatic and easy to use, but always includes all publicly accessible endpoints, data structures, and documentation strings.
+
+Encore currently supports generating the following clients:
+- **Go** - Using `net/http` for the underlying HTTP transport.
+- **TypeScript** - Using the browser `fetch` API for the underlying HTTP client.
+- **JavaScript** - Using the browser `fetch` API for the underlying HTTP client.
+- **OpenAPI** - Using the OpenAPI Specification's language-agnostic interface to HTTP APIs. (Experimental)
+
+If there's a language you think should be added, please submit a pull request or create a feature
+request on [GitHub](https://github.com/encoredev/encore/issues/new), or [reach out on Discord](/discord).
+
+<Callout type="important">
+
+If you ship the generated client to end customers, keep in mind that old clients will continue to be used after you make changes. To prevent issues with the generated clients, avoid making breaking changes in APIs that your clients access.
+
+</Callout>
+
+<br />
+
+## Generating a Client
+
+To generate a client, use the `encore gen client` command. It generates a type-safe client using the most recent API metadata
+running in a particular environment for the given Encore application. For example:
+
+```shell
+# Generate a TypeScript client for calling the hello-a8bc application based on the primary environment
+encore gen client hello-a8bc --output=./client.ts
+
+# Generate a Go client for the hello-a8bc application based on the locally running code
+encore gen client hello-a8bc --output=./client.go --env=local
+
+# Generate an OpenAPI client for the hello-a8bc application based on the primary environment
+encore gen client hello-a8bc --lang=openapi --output=./openapi.json
+```
+
+### Environment Selection
+
+By default, `encore gen client` generates the client based on the version of your application currently running in your local environment.
+You can change this using the `--env` flag and specifying the environment name.
+
+<Callout type="info">
+
+The generated client can be used with any environment, not just the one it was generated for. However, the APIs, data structures
+and marshalling logic will be based on whatever is present and running in that environment at the point in time the client is generated.
+
+</Callout>
+
+### Service filtering
+
+By default `encore gen client` outputs code for all services with at least one publicly accessible (or authenticated) API.
+You can narrow down this set of services by specifying the `--services` (or `-s`) flag. It takes a comma-separated list
+of service names.
+
+For example, to generate a typescript client for the `email` and `users` services, run:
+```shell
+encore gen client --services=email,users -o client.ts
+```
+
+### Output Mode
+
+By default the client's code will be output to stdout, allowing you to pipe it into your clipboard, or another tool. However,
+using `--output` you can specify a file location to write the client to. If output is specified, you do not need to specify
+the language as Encore will detect the language based on the file extension.
+
+
+### Example Script
+You could combine this into a `package.json` file for your Typescript frontend, to allow you to run `npm run gen` in that
+project to update the client to match the code running in your staging environment.
+```json
+{
+  "scripts": {
+    // ...
+    "gen": "encore gen client hello-a8bc --output=./client.ts --env=staging"
+    // ...
+  }
+}
+```
+
+## Using the Client
+
+The generated client has all the data structures required as parameters or returned as response values as needed by any
+of the public or authenticated API's of your Encore application. Each service is exposed as object on the client, with
+each public or authenticated API exposed as a function on those objects.
+
+For instance, if you had a service called `email` with a function `Send`, on the generated client you would call this
+using; `client.email.Send(...)`.
+
+### Creating an instance
+
+When constructing a client, you need to pass a `BaseURL` as the first parameter; this is the URL at which the API can
+be accessed. The client provides two helpers:
+
+- `Local` - This is a constant provided, which will always point at your locally running instance environment.
+- `Environment("name")` - This is a function which allows you to specify an environment by name
+
+However, BaseURL is a string, so if the two helpers do not provide enough flexibility you can pass any valid URL to be
+used as the BaseURL.
+
+### Authentication
+
+If your application has any API's which require [authentication](/docs/ts/develop/auth), then additional options will generated
+into the client, which can be used when constructing the client. Just like with API's schemas, the data type required by
+your application's `auth handler` will be part of the client library, allowing you to set it in two ways:
+
+If your credentials won't change during the lifetime of the client, simply passing the authentication data to the client
+through the `WithAuth` (Go) or `auth` (TypeScript) options.
+
+However, if the authentication credentials can change, you can also pass a function which will be called before each request
+and can return a new instance of the authentication data structure or return the existing instance.
+
+
+### HTTP Client Override
+
+If required, you can override the underlying HTTP implementation with your own implementation. This is useful if you want
+to perform logging of the requests being made, or route the traffic over a secured tunnel such as a VPN.
+
+In Go this can be configured using the `WithHTTPClient` option. You are required to provide an implementation of the
+`HTTPDoer` interface, which the [http.Client](https://pkg.go.dev/net/http#Client) implements. For TypeScript clients,
+this can be configured using the `fetcher` option and must conform to the same prototype as the browsers inbuilt [fetch
+API](https://developer.mozilla.org/en-US/docs/Web/API/fetch).
+
+### Structured Errors
+
+Errors created or wrapped using Encore's [`errs package`](/docs/ts/primitives/errors) will be returned to the client and deserialized
+as an `APIError`, allowing the client to perform adaptive error handling based on the type of error returned. You can perform
+a type check on errors caused by calling an API to see if it is an `APIError`, and once cast as an `APIError` you can access
+the `Code`, `Message` and `Details` fields. For TypeScript Encore generates a `isAPIError` type guard which can be used.
+
+The `Code` field is an enum with all the possible values generated in the library, alone with description of when we
+would expect them to be returned by your API. See the [errors documentation](/docs/ts/primitives/errors#error-codes) for
+an online reference of this list.
diff --git a/docs/ts/cli/config-reference.md b/docs/ts/cli/config-reference.md
new file mode 100644
index 0000000000..cb4dc5e965
--- /dev/null
+++ b/docs/ts/cli/config-reference.md
@@ -0,0 +1,50 @@
+---
+seotitle: Encore CLI Configuration Options
+seodesc: Configuration options to customize the behavior of the Encore CLI.
+title: Configuration Reference
+subtitle: Configuration options to customize the behavior of the Encore CLI.
+lang: ts
+---
+
+
+The Encore CLI has a number of configuration options to customize its behavior.
+
+Configuration options can be set both for individual Encore applications, as well as
+globally for the local user.
+
+Configuration options can be set using `encore config <key> <value>`,
+and options can similarly be read using `encore config <key>`.
+
+When running `encore config` within an Encore application, it automatically
+sets and gets configuration for that application.
+
+To set or get global configuration, use the `--global` flag.
+
+## Configuration files
+
+The configuration is stored in one ore more TOML files on the filesystem.
+
+The configuration is read from the following files, in order:
+
+### Global configuration
+* `$XDG_CONFIG_HOME/encore/config`
+* `$HOME/.config/encore/config`
+* `$HOME/.encoreconfig`
+
+### Application-specific configuration
+* `$APP_ROOT/.encore/config`
+
+Where `$APP_ROOT` is the directory containing the `encore.app` file.
+
+The files are read and merged, in the order defined above, with latter files taking precedence over earlier files.
+
+## Configuration options
+
+#### run.browser
+Type: string<br/>
+Default: auto<br/>
+Must be one of: always, never, or auto
+
+Whether to open the Local Development Dashboard in the browser on `encore run`.
+If set to "auto", the browser will be opened if the dashboard is not already open.
+
diff --git a/docs/ts/cli/infra-namespaces.md b/docs/ts/cli/infra-namespaces.md
new file mode 100644
index 0000000000..0379c47bfc
--- /dev/null
+++ b/docs/ts/cli/infra-namespaces.md
@@ -0,0 +1,63 @@
+---
+seotitle: Infrastructure Namespaces
+seodesc: Learn how Encore's infrastructure namespaces makes it easy to task switch. Stash your infrastructure state and switch to a different task with a single command.
+title: Infrastructure Namespaces
+subtitle: Task switching made easy
+lang: ts
+---
+
+Encore's CLI allows you to create and switch between multiple, independent *infrastructure namespaces*.
+Infrastructure namespaces are isolated from each other, and each namespace contains its own independent data.
+
+This makes it trivial to switch tasks, confident your old state and data will be waiting for you when you return.
+
+If you've ever worked on a new feature that involves making changes to the database schema,
+only to context switch to reviewing a Pull Request and had to reset your database, you know the feeling.
+
+With Encore's infrastructure namespaces, this is a problem of the past.
+Run `encore namespace switch --create pr:123` (or `encore ns switch -c pr:123` for short) to create and switch to a new namespace.
+
+The next `encore run` will run in the new namespace, with a completely fresh database.
+When you're done, run `encore namespace switch -` to switch back to your previous namespace.
+
+## Usage
+
+Below are the commands for working with namespaces.
+Note that you can use `encore ns` as a short form for `encore namespace`.
+
+```shell
+# List your namespaces (* indicates the current namespace)
+$ encore namespace list
+
+# Create a new namespace
+$ encore namespace create my-ns
+
+# Switch to a namespace
+$ encore namespace switch my-ns
+
+# Switch to a namespace, creating it if it doesn't exist
+$ encore namespace switch --create my-ns
+
+# Switch to the previous namespace
+$ encore namespace switch -
+
+# Delete a namespace (and all associated data)
+$ encore namespace delete my-ns
+```
+
+Most other Encore commands that interact or use infrastructure take an optional
+`--namespace` (`-n` for short) that overrides the current namespace. If left unspecified,
+the current namespace is used.
+
+For example:
+
+```shell
+# Run the app using the "my-ns" namespace
+$ encore run --namespace my-ns
+
+# Open a database shell to the "my-ns" namespace
+$ encore db shell DATABASE_NAME --namespace my-ns
+
+# Reset all databases within the "my-ns" namespace
+$ encore db reset --all --namespace my-ns
+```
diff --git a/docs/ts/cli/mcp.md b/docs/ts/cli/mcp.md
new file mode 100644
index 0000000000..7df6bd7eb5
--- /dev/null
+++ b/docs/ts/cli/mcp.md
@@ -0,0 +1,125 @@
+---
+seotitle: Encore MCP Server
+seodesc: Encore's Model Context Protocol (MCP) server provides deep introspection of your application to AI development tools.
+title: MCP Server
+subtitle: The Model Context Protocol (MCP) exposes tools that provide application context to LLMs.
+lang: ts
+---
+
+Encore provides an MCP server that implements the [Model Context Protocol](https://modelcontextprotocol.io/introduction), an open standard that enables large language models (LLMs) to access contextual information about your application. Think of MCP as a standardized interface—like a "USB-C port for AI applications"—that connects your Encore app's data and functionality to any LLM that supports the protocol.
+
+You can connect to Encore's MCP server from any MCP host (such as Claude Desktop, IDEs, or other AI tools) using either Server-Sent Events (SSE) or stdio transport. To set up this connection, simply run:
+
+```bash
+cd my-encore-app
+encore mcp start
+
+  MCP Service is running!
+
+  MCP SSE URL:        http://localhost:9900/sse?app=your-app-id
+  MCP stdio Command:  encore mcp run --app=your-app-id
+```
+
+Copy the appropriate URL or command to your MCP host's configuration, and you're ready to give your AI assistants rich context about your application.
+
+## Example: Integrating with Cursor
+
+[Cursor](https://cursor.com) is one of the most popular AI powered IDE's, and it's simple to use Encore's MCP server together with Cursor. 
+
+In order to add the Encore MCP server to Cursor, the fastest way is via the button below (make sure to update `your-app-id` in the configuration to your actual Encore app ID).
+
+<a href="https://cursor.com/en/install-mcp?name=encore-mcp&config=eyJjb21tYW5kIjoiZW5jb3JlIG1jcCBydW4gLS1hcHA9eW91ci1hcHAtaWQifQ%3D%3D"><img src="https://cursor.com/deeplink/mcp-install-dark.svg" alt="Add encore-mcp MCP server to Cursor" height="32" class="noshadow" /></a>
+
+If you prefer to configure it manually, create the file `.cursor/mcp.json` with the following settings:
+
+```json
+{
+    "mcpServers": {
+        "encore-mcp": {
+             "command": "encore",
+             "args": ["mcp", "run", "--app=your-app-id"]
+        }
+    }
+}
+```
+
+Learn more in [Cursor's MCP docs](https://docs.cursor.com/context/model-context-protocol)
+
+Now when using Cursor's Agent mode, you can ask it to do advanced actions, such as:
+
+"Add an endpoint that publishes to a pub/sub topic, call it and verify that the publish is in the traces"
+
+## Command Reference
+
+#### Start
+
+Starts an SSE-based MCP server and displays connection information.
+
+```shell
+$ encore mcp start [--app=<app-id>]
+```
+
+#### Run
+
+Establishes an stdio-based MCP session. This command is typically used by MCP hosts to communicate with the server through standard input/output streams.
+
+```shell
+$ encore mcp run [--app=<app-id>]
+```
+
+## Exposed Tools
+
+Encore's MCP server exposes the following tools that provide AI models with detailed context about your application. These tools enable LLMs to understand your application's structure, retrieve relevant information, and take actions within your system.
+
+#### Database Tools
+
+- **get_databases**: Retrieve metadata about all SQL databases defined in the application, including their schema, tables, and relationships.
+- **query_database**: Execute SQL queries against one or more databases in the application.
+
+#### API Tools
+
+- **call_endpoint**: Make HTTP requests to any API endpoint in the application.
+- **get_services**: Retrieve comprehensive information about all services and their endpoints in the application.
+- **get_middleware**: Retrieve detailed information about all middleware components in the application.
+- **get_auth_handlers**: Retrieve information about all authentication handlers in the application.
+
+#### Trace Tools
+
+- **get_traces**: Retrieve a list of request traces from the application, including their timing, status, and associated metadata.
+- **get_trace_spans**: Retrieve detailed information about one or more traces, including all spans, timing information, and associated metadata.
+
+#### Source Code Tools
+
+- **get_metadata**: Retrieve the complete application metadata, including service definitions, database schemas, API endpoints, and other infrastructure components.
+- **get_src_files**: Retrieve the contents of one or more source files from the application.
+
+#### PubSub Tools
+
+- **get_pubsub**: Retrieve detailed information about all PubSub topics and their subscriptions in the application.
+
+#### Storage Tools
+
+- **get_storage_buckets**: Retrieve comprehensive information about all storage buckets in the application.
+- **get_objects**: List and retrieve metadata about objects stored in one or more storage buckets.
+
+#### Cache Tools
+
+- **get_cache_keyspaces**: Retrieve comprehensive information about all cache keyspaces in the application.
+
+#### Metrics Tools
+
+- **get_metrics**: Retrieve comprehensive information about all metrics defined in the application.
+
+#### Cron Tools
+
+- **get_cronjobs**: Retrieve detailed information about all scheduled cron jobs in the application.
+
+#### Secret Tools
+
+- **get_secrets**: Retrieve metadata about all secrets used in the application.
+
+#### Documentation Tools
+
+- **search_docs**: Search the Encore documentation using Algolia's search engine.
+- **get_docs**: Retrieve the full content of specific documentation pages.
+
diff --git a/docs/ts/cli/telemetry.md b/docs/ts/cli/telemetry.md
new file mode 100644
index 0000000000..a7b5ed2b6f
--- /dev/null
+++ b/docs/ts/cli/telemetry.md
@@ -0,0 +1,97 @@
+---
+seotitle: Encore Telemetry
+seodesc: Encore collects telemetry data about app usage
+title: Telemetry
+lang: ts
+---
+Telemetry helps us improve the Encore by collecting usage data. This data provides insights into how Encore is used, enabling us to make informed decisions to enhance performance, add new features, and fix bugs more efficiently.
+
+Encore only collects telemetry data in the local development tools and the Encore Cloud dashboard. It does **not** collect any telemetry data from your running applications or cloud services, ensuring complete privacy and security for your operations.
+
+## Why We Collect Data
+
+We collect telemetry data for several important reasons:
+
+1. **Improvement of Features**: Understanding which features are most used helps us prioritize improvements and new feature development.
+2. **Performance Monitoring**: Tracking performance metrics enables us to identify and resolve issues, ensuring a smoother user experience.
+3. **Bug Detection**: Telemetry data can help us detect and fix bugs faster by providing context on how and when issues occur.
+4. **User Experience**: Insights from telemetry data guide us in making Encore more intuitive and user-friendly.
+
+## How Data is Collected
+
+Encore collects data in a way that prioritizes user privacy and security. Here's how we do it:
+
+1. **User Identifiable Data**: The data collected includes identifiable information that helps us understand specific user interactions and contexts.
+2. **Types of Data**: We collect data on usage patterns, performance metrics, and error reports.
+3. **Secure Transmission**: All data is transmitted securely using industry-standard encryption protocols.
+4. **Minimal Impact**: Data collection is designed to have minimal impact on Encore's performance.
+
+### Example of Data Being Sent
+
+Here is an example of the type of data that is sent:
+
+```json
+{
+    "event": "app.create",
+    "anonymousId": "a-uuid-unique-for-the-installation",
+    "properties": {
+        "error": false,
+        "lang": "go",
+        "template": "graphql"
+    }
+}
+```
+
+## Data We Don't Collect
+
+At Encore, we prioritize your privacy and ensure that no sensitive data is collected through our telemetry. Specifically, we do not collect:
+
+1. **Environment Variables**: We do not collect any environment variables set in your development or production environments.
+2. **File Paths**: The specific paths of your files and directories are not collected.
+3. **Contents of Files**: We do not access or collect the contents of your code files or any other files in your projects.
+4. **Logs**: No log files from your application or development environment are collected.
+5. **Serialized Errors**: We do not collect serialized errors that may contain sensitive information.
+
+Our goal is to gather useful data that helps improve Encore while ensuring that your sensitive information remains private and secure.
+
+## Disabling Telemetry
+
+While telemetry helps us improve Encore, we understand that some users may prefer to opt out. Disabling telemetry is straightforward and can be done in two ways:
+
+1. **Using the CLI Command**: You can disable telemetry by executing a simple command in your terminal.
+
+   ```sh
+   encore telemetry disable
+   ```
+
+2. **Setting an Environment Variable**: Alternatively, you can disable telemetry by setting the `DISABLE_ENCORE_TELEMETRY` environment variable.
+
+   ```sh
+   export DISABLE_ENCORE_TELEMETRY=1
+   ```
+
+3. **Confirmation**: After disabling telemetry, either by the CLI command or environment variable, you will receive a confirmation message indicating that telemetry has been successfully disabled.
+
+4. **Re-enabling Telemetry**: If you decide to re-enable telemetry later, you can do so with the following CLI command:
+
+   ```sh
+   encore telemetry enable
+   ```
+
+## Debugging Telemetry
+
+For users who want more visibility into what telemetry data is being sent, you can enable debug mode:
+
+1. **Setting Debug Mode**: Enable debug mode by setting the `ENCORE_TELEMETRY_DEBUG` environment variable.
+
+   ```sh
+   export ENCORE_TELEMETRY_DEBUG=1
+   ```
+
+2. **Log Statements**: When debug mode is enabled, a log statement prepended by `[telemetry]` will be printed every time telemetry data is sent.
+
+## Conclusion
+
+Telemetry is a vital tool for improving Encore, but we respect your choice regarding data sharing. With easy-to-use commands and environment variables, you can manage your telemetry settings as you see fit. If you have any further questions or need assistance, please refer to our support documentation or contact our support team.
+
+Thank you for helping us make Encore better!
diff --git a/docs/ts/community/contribute.md b/docs/ts/community/contribute.md
new file mode 100644
index 0000000000..dfaaea0877
--- /dev/null
+++ b/docs/ts/community/contribute.md
@@ -0,0 +1,36 @@
+---
+seotitle: How to contribute to Encore Open Source Project
+seodesc: Learn how to contribute to the Encore Open Source project by submitting pull requests, reporting bugs, or contributing documentation or example projects.
+title: Ways to contribute
+subtitle: Guidelines for contributing to Encore
+lang: ts
+---
+
+We’re so excited that you are interested in contributing to Encore! All contributions are welcome, and there are several valuable ways to contribute.
+
+### Open Source Project
+
+If you want to contribute to the Encore Open Source project, you can submit a pull request on [GitHub](https://github.com/encoredev/encore/pulls).
+
+### Report issues
+
+If you have run into an issue or think you’ve found a bug, please report it via the [issue tracker](https://github.com/encoredev/encore/issues).
+
+### Add or update docs
+
+If there’s something you think would be helpful to add to the docs or if there’s something that seems out of date, we appreciate your input.
+You can view the docs and contribute fixes or improvements directly in [GitHub](https://github.com/encoredev/encore/tree/main/docs).
+
+You can also email your feedback to us at [hello@encore.dev](mailto:hello@encore.dev).
+
+### Blog posts
+
+If you’ve built something cool using Encore, we’d really like you to talk about it! We love it when developers share their projects on blogs and on Twitter.
+
+Use the hashtag **#builtwithencore** and we’ll have an easier time finding your work. – We might also showcase it on the [Encore Twitter account](https://twitter.com/encoredotdev)!
+
+### Meetups & Workshops
+
+Organizing a meetup or workshop is a great way to connect with other developers using Encore. It can also be a great first step in trying out Encore for development in your company or other professional organization.
+
+If you want help with organizing or planning an event, please don’t hesitate to reach out to us via email at [hello@encore.dev](mailto:hello@encore.dev).
diff --git a/docs/ts/community/get-involved.md b/docs/ts/community/get-involved.md
new file mode 100644
index 0000000000..8bb93498e4
--- /dev/null
+++ b/docs/ts/community/get-involved.md
@@ -0,0 +1,61 @@
+---
+seotitle: Encore's Open Source Developer Community
+seodesc: Learn how to engage in the Open Source Developer Community supporting Encore.
+title: Community
+subtitle: Join the most pioneering developer community!
+lang: ts
+---
+
+Developers building with Encore are forward-thinkers, who are working on exciting and innovative applications.
+
+We rely on this group's feedback, and contributions to the Open Source project, to improve Encore for developers everywhere.
+Getting involved is a fantastic way of finding support and inspiration among peers.
+
+Everyone is welcome in the Encore community, and we hope you to get involved too!
+
+## Get involved
+
+There are many ways to get involved. Here's where you can start straight away.
+
+<p className="flex items-center gap-x-2 lead-xsmall">
+     <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 16 16" fill="#111111" stroke="none">
+      <path fillRule="evenodd"
+            d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z" />
+    </svg>
+    <a href="https://github.com/encoredev/encore">Contribute on GitHub</a>
+</p>
+
+Use GitHub to report bugs, feedback on proposals, or contribute your ideas.
+
+<p className="flex items-center gap-x-2 lead-xsmall">
+   <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 -28.5 256 256">
+        <path fill="#111111"
+            d="M216.856339,16.5966031 C200.285002,8.84328665 182.566144,3.2084988 164.041564,0 C161.766523,4.11318106 159.108624,9.64549908 157.276099,14.0464379 C137.583995,11.0849896 118.072967,11.0849896 98.7430163,14.0464379 C96.9108417,9.64549908 94.1925838,4.11318106 91.8971895,0 C73.3526068,3.2084988 55.6133949,8.86399117 39.0420583,16.6376612 C5.61752293,67.146514 -3.4433191,116.400813 1.08711069,164.955721 C23.2560196,181.510915 44.7403634,191.567697 65.8621325,198.148576 C71.0772151,190.971126 75.7283628,183.341335 79.7352139,175.300261 C72.104019,172.400575 64.7949724,168.822202 57.8887866,164.667963 C59.7209612,163.310589 61.5131304,161.891452 63.2445898,160.431257 C105.36741,180.133187 151.134928,180.133187 192.754523,160.431257 C194.506336,161.891452 196.298154,163.310589 198.110326,164.667963 C191.183787,168.842556 183.854737,172.420929 176.223542,175.320965 C180.230393,183.341335 184.861538,190.991831 190.096624,198.16893 C211.238746,191.588051 232.743023,181.531619 254.911949,164.955721 C260.227747,108.668201 245.831087,59.8662432 216.856339,16.5966031 Z M85.4738752,135.09489 C72.8290281,135.09489 62.4592217,123.290155 62.4592217,108.914901 C62.4592217,94.5396472 72.607595,82.7145587 85.4738752,82.7145587 C98.3405064,82.7145587 108.709962,94.5189427 108.488529,108.914901 C108.508531,123.290155 98.3405064,135.09489 85.4738752,135.09489 Z M170.525237,135.09489 C157.88039,135.09489 147.510584,123.290155 147.510584,108.914901 C147.510584,94.5396472 157.658606,82.7145587 170.525237,82.7145587 C183.391518,82.7145587 193.761324,94.5189427 193.539891,108.914901 C193.539891,123.290155 183.391518,135.09489 170.525237,135.09489 Z" />
+    </svg>
+    <a href="https://encore.dev/discord">Join Discord</a>
+</p>
+
+Connect with fellow Encore developers, ask questions, or just hang out!
+
+<p className="flex items-center gap-x-2 lead-xsmall">
+    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="#111111" stroke="none">
+        <path d="M23 3a10.9 10.9 0 0 1-3.14 1.53 4.48 4.48 0 0 0-7.86 3v1A10.66 10.66 0 0 1 3 4s-4 9 5 13a11.64 11.64 0 0 1-7 2c9 5 20 0 20-11.5a4.5 4.5 0 0 0-.08-.83A7.72 7.72 0 0 0 23 3z" />
+    </svg>
+    <a href="https://twitter.com/encoredotdev">Follow on Twitter</a>
+</p>
+
+Follow Encore on Twitter to keep up with the latest. Share what you've built to help spread the word about the project.
+
+### Contribute to the project
+
+Want to make a contribution to Encore? Great, start by reading about the different [ways to contribute](/docs/ts/community/contribute).
+
+### Feedback on the Roadmap
+
+[The Encore Roadmap](https://encore.dev/roadmap) is public. It's open to your comments, feature requests, and you can vote on existing entries.
+
+## Community Governance
+
+We recommend everyone read the [Community Principles](/docs/ts/community/principles).
+
+If you need assistance, have concerns, or have questions for the Community team, please email us at [support@encore.dev](mailto:support@encore.dev).
diff --git a/docs/ts/community/open-source.md b/docs/ts/community/open-source.md
new file mode 100644
index 0000000000..211d3ed362
--- /dev/null
+++ b/docs/ts/community/open-source.md
@@ -0,0 +1,21 @@
+---
+seotitle: Encore is Open Source
+seodesc: We believe Open Source is key to a sustainable and prosperous technology community. Encore builds on Open Source software, and is itself Open Source.
+title: Open Source
+subtitle: Encore is Open Source Software
+lang: ts
+---
+
+We believe Open Source is key to a long-term sustainable and prosperous technology community. Encore builds on Open Source software, and is largely Open Source itself.
+
+## License
+
+Encore's Backend Framework, parser, and compiler are Open Source under Mozilla Public License 2.0.
+
+> The MPL is a simple copyleft license. The MPL's "file-level" copyleft is designed to encourage contributors to share modifications they make to your code, while still allowing them to combine your code with code under other licenses (open or proprietary) with minimal restrictions.
+
+You can learn more about MPL 2.0 on [the official website](https://www.mozilla.org/en-US/MPL/2.0/FAQ/).
+
+## Contribute
+
+Contributions to improve Encore are very welcome. Contribute to Encore on [GitHub](https://github.com/encoredev/encore).
diff --git a/docs/ts/community/principles.md b/docs/ts/community/principles.md
new file mode 100644
index 0000000000..88510cd670
--- /dev/null
+++ b/docs/ts/community/principles.md
@@ -0,0 +1,15 @@
+---
+seotitle: Encore Community Principles
+seodesc: Everyone is welcome in the Encore community, and we want everyone to feel at home and free to contribute.
+title: Community principles
+subtitle: Everyone belongs in the Encore community
+lang: ts
+---
+
+Everyone is welcome in the Encore community, and it is of utmost importance to us that everyone is able to feel at home and contribute.
+
+Therefore we as maintainers, and you as a contributor, must pledge to make participation in our community a harassment-free experience for everyone, regardless of: age, body size, disability, ethnicity, gender identity, level of experience, nationality, personal appearance, race, religion, or sexual identity.
+
+### Code of Conduct
+
+To this end, the Encore community is guided by the [Contributor Covenant 2.0 Code of Conduct](https://www.contributor-covenant.org/version/2/0/code_of_conduct/) to ensure everyone is welcome and able to participate. 
\ No newline at end of file
diff --git a/docs/ts/community/submit-template.md b/docs/ts/community/submit-template.md
new file mode 100644
index 0000000000..d54fd11325
--- /dev/null
+++ b/docs/ts/community/submit-template.md
@@ -0,0 +1,49 @@
+---
+seotitle: Submit a Template to Encore's Templates repo
+seodesc: Learn how to contribute to Encore's Templates repository and get features in the Encore Templates marketplace.
+title: Submit a Template
+subtitle: Your contributions help other developers build
+lang: ts
+---
+
+[Templates](/templates) help and inspire developers to build applications using Encore.
+
+You are welcome to contribute your own templates!
+
+Two types of templates that are especially useful:
+- **Starters:** Runnable Encore applications for others to use as is, or take inspiration from.
+- **Bits:** Re-usable code samples to solve common development patterns or integrate Encore applications with third-party APIs and services.
+
+## Submit your contribution
+
+Contribute a template by submitting a Pull Request to the [Open Source Examples Repo](https://github.com/encoredev/examples): `https://github.com/encoredev/examples`
+
+### Submitting Starters
+
+Follow these steps to submit a **Starter**:
+
+1. Fork the repo.
+2. Create a new folder in the root directory of the repo, this is where you will place your template. — Use a short folder name as your template will be installable via the CLI, like so: `encore app create APP-NAME --example=<TEMPLATE_FOLDER_NAME>`
+3. Include a `README.md` with instructions for how to use the template. We recommend following [this format](https://github.com/encoredev/examples/blob/8c7e33243f6bfb1b2654839e996e9a924dcd309e/uptime/README.md).
+
+Once your Pull Request has been approved, it may be featured on the [Templates page](/templates) on the Encore website.
+
+### Submitting Bits
+
+Follow these steps to submit your **Bits**:
+
+1. Fork the repo.
+2. Create a new folder inside the `bits` folder in the repo and place your template inside it. Use a short folder name as your template will soon be installable via the CLI.
+3. Include a `README.md` with instructions for how to use the template.
+
+Once your Pull Request has been approved, it may be featured on the [Templates page](/templates) on the Encore website.
+
+## Contribute from your own repo
+
+If you don't want to contribute code to the examples repo, but still want to be featured on the [Templates page](/templates), please contact us at [hello@encore.dev](mailto:hello@encore.dev).
+
+## Dynamic Encore AppID
+
+In most cases, you should avoid hardcoding an `AppID` in your template's source code. Instead, use the notation `{{ENCORE_APP_ID}}`.
+
+When a developer creates an app using the template, `{{ENCORE_APP_ID}}` will be dymically replaced with their new and unique `AppID`, meaning they will not need to make any manual code adjustments.
diff --git a/docs/ts/concepts/application-model.md b/docs/ts/concepts/application-model.md
new file mode 100644
index 0000000000..8a417e444d
--- /dev/null
+++ b/docs/ts/concepts/application-model.md
@@ -0,0 +1,25 @@
+---
+seotitle: Encore Application Model
+seodesc: How Encore understands your application using static analysis
+title: Encore Application Model
+subtitle: How Encore understands your application
+lang: ts
+---
+
+Encore works by using static analysis to understand your application. This is a fancy term for parsing and analyzing the code you write and creating a graph of how your application works. This graph closely represents your own mental model of the system: boxes and arrows that represent systems and services that communicate with other systems, pass data and connect to infrastructure. We call it the Encore Application Model.
+
+Because the Open Source framework, parser, and compiler, are all designed together, Encore can ensure 100% accuracy when creating the application model. Any deviation is caught as a compilation error.
+
+Using this model, Encore can provide tools to solve problems that normally would be up to the developer to do manually. From creating architecture diagrams and API documentation to provisioning cloud infrastructure.
+
+We're continuously expanding on Encore's capabilities and are building a new generation of developer tools that are enabled by Encore's understanding of your application.
+
+The framework, parser, and compiler that enable this are all [Open Source](https://github.com/encoredev/encore).
+
+<img src="/assets/docs/flow-diagram.png" title="Encore Application Model" className="mx-auto md:max-w-lg"/>
+
+## Standardization brings clarity
+
+Developers make dozens of decisions when creating a backend application. Deciding how to structure the codebase, defining API schemas, picking underlying infrastructure, etc. The decisions often come down to personal preferences, not technical rationale. This creates a huge problem in the form of fragmentation! When every stack looks different, all tools have to be general purpose.
+
+When you adopt Encore, many of these stylistic decisions are already made for you. The Encore framework ensures your application follows modern best practices. And when you run your application, Encore's Open Source parser and compiler check that you're sticking to the standard. This means you're free to focus your energy on what matters: writing your application's business logic.
\ No newline at end of file
diff --git a/docs/ts/concepts/benefits.md b/docs/ts/concepts/benefits.md
new file mode 100644
index 0000000000..292639993f
--- /dev/null
+++ b/docs/ts/concepts/benefits.md
@@ -0,0 +1,67 @@
+---
+seotitle: Benefits of using Encore.ts
+seodesc: Get to know the benefits of using Encore's Backend Framework for TypeScript to build cloud-native backend applications.
+title: Benefits of using Encore.ts
+lang: ts
+---
+
+## Integrated developer experience for enhanced productivity
+
+- **Local development with instant infrastructure**: Encore automatically sets up necessary infrastructure as you develop.
+- **Rapid feedback**: Catch issues early with type-safe infrastructure, avoiding slow deployment cycles.
+- **No manual configuration required**: No need for Infrastructure-as-Code. Your code is the single source of truth.
+- **Unified codebase**: One codebase for all environments; local, preview, and cloud.
+- **Cloud-agnostic by default**: Encore.ts provides an abstraction layer on top of the cloud provider's APIs, so you avoid becoming locked in to a single cloud.
+- **Evolve infrastructure without code changes**: As requirements evolve, you can change the provisioned infrastructure without needing application code changes. Either using the Open Source [self-hosting tools](/docs/ts/self-host/build) or with the optional [Cloud Platform](https://encore.dev/use-cases/devops-automation), which fully-automates infrastructure management in your own AWS/GCP account.
+
+## High-performance Rust runtime
+
+To enable Encore's functionality in TypeScript, we’ve created a high-performance distributed systems runtime in Rust.
+It integrates with the standard Node.js runtime for executing JavaScript code, ensuring **100% compatibility with the Node.js ecosystem**.
+
+It provides a number of benefits over standard Node.js:
+- **Handles requests validation, provides API type-safety, has built-in observability, and integrates with databases, Pub/Sub, and more**
+- **9x increased throughput and 85% reduced latency** compared to standard Node.js/Express.js [See benchmarks](https://encore.dev/blog/event-loops)
+- **Zero NPM dependencies** for improved security and faster builds
+
+### How it works
+
+Encore.ts is designed to let the Node.js event loop — which is single-threaded — focus on executing your business logic, while everything else happens in Encore’s multi-threaded Rust runtime. Here's a high-level overview of how this works:
+
+**1. Node.js starts up and initializes the Encore Rust runtime. The Rust runtime then:**
+   - Begins accepting incoming requests
+   - Parses and validates these requests against the API schema
+
+**2. For each request, the Encore Runtime:**
+   - Passes the request to your application code
+   - Waits for your code to process the request
+   - Sends the response back to the client
+
+**3. When your application needs to interact with infrastructure (like databases or PubSub):**
+   - It delegates these tasks to the Rust runtime
+   - The Rust runtime handles these operations more efficiently than Node.js would, providing faster execution and lower latency
+
+## Enhanced type-safety for distributed systems
+
+Encore leverages static code analysis to parse the API schema and TypeScript types you define. This enables a number of features:
+- Built-in [local development dashboard](/docs/ts/observability/dev-dash)
+- API Explorer, automatic documentation, and local tracing
+- Runtime type-safety, automatically validating incoming requests against the API schema
+- Eliminating runtime errors due to missing required fields
+
+## No DevOps experience required
+
+Encore provides open source tools to help you integrate with your cloud infrastructure, enabling you to self-host your application anywhere that supports Docker containers.
+Learn more in the [self-host documentation](/docs/ts/self-host/build).
+
+You can also use [Encore Cloud](https://encore.dev/use-cases/devops-automation), which fully automates provisioning and managing infrastructure in your own cloud on AWS and GCP.
+
+This approach dramatically reduces the level of DevOps expertise required to use scalable, production-ready, cloud services like Kubernetes and Pub/Sub. And because your application code is the source of truth for infrastructure requirements, it ensures the infrastructure in all environments is always in sync with the application's current requirements.
+
+## Simplicity without giving up flexibility
+
+Encore.ts provides integrations for common infrastructure primitives, but also allows for flexibility.
+
+For example, you can always use any cloud infrastructure, even if it's not built into the Encore.ts framework. You can use any database, message broker, or other service that your application needs, just set up the infrastructure and then reference it in your code as you would do traditionally.
+
+If you use [Encore Cloud](https://encore.dev/use-cases/devops-automation), it will [automate infrastructure](/docs/platform/infrastructure/infra) using your own cloud account, so you always have full access to your services from the cloud provider's console.
diff --git a/docs/ts/concepts/hello-world.md b/docs/ts/concepts/hello-world.md
new file mode 100644
index 0000000000..6c4856329c
--- /dev/null
+++ b/docs/ts/concepts/hello-world.md
@@ -0,0 +1,54 @@
+---
+seotitle: Hello World in Encore.ts
+seodesc: Get to know Encore.ts with this simple Hello World example.
+title: Hello World
+subtitle: Get to know the basics
+toc: false
+lang: ts
+---
+
+Encore lets you easily define type-safe, idiomatic TypeScript API endpoints.
+It's done in a fully declarative way, enabling Encore to automatically parse and validate the incoming request and ensure it matches the schema, with zero boilerplate.
+
+To define an API, use the `api` function from the `encore.dev/api` module to wrap a regular TypeScript async function that receives the request data as input and returns response data. This tells Encore that the function is an API endpoint. Encore will then automatically generate the necessary boilerplate at compile-time.
+
+This means you need less than 10 lines of code to define a production-ready deployable service and API endpoint:
+
+```TypeScript
+import { api } from "encore.dev/api";
+
+export const get = api(
+  { expose: true, method: "GET", path: "/hello/:name" },
+  async ({ name }: { name: string }): Promise<Response> => {
+    const msg = `Hello ${name}!`;
+    return { message: msg };
+  }
+);
+
+interface Response {
+  message: string;
+}
+```
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/ts/hello-world" 
+    desc="Hello World REST API example application." 
+/>
+
+## Getting started video
+
+Get to know the basics of Encore.ts in this getting started video.
+
+<iframe width="360" height="202" src="https://www.youtube.com/embed/wiLDz-JUuqY?si=BxmW0BV1hx2LIvtO" title="Getting Started with Encore.ts" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
+
+## Using databases, Pub/Sub, and other primitives
+
+Encore's Backend Framework makes it simple to add more primitives, such as additional microservices, databases, Pub/Sub, etc.
+See how to use each primitive:
+
+- [Services](/docs/ts/primitives/services)
+- [APIs](/docs/ts/primitives/defining-apis)
+- [Databases](/docs/ts/primitives/databases)
+- [Cron Jobs](/docs/ts/primitives/cron-jobs)
+- [Pub/Sub & Queues](/docs/ts/primitives/pubsub)
+- [Secrets](/docs/ts/primitives/secrets)
diff --git a/docs/ts/develop/auth.md b/docs/ts/develop/auth.md
new file mode 100644
index 0000000000..0ba11e7b08
--- /dev/null
+++ b/docs/ts/develop/auth.md
@@ -0,0 +1,195 @@
+---
+seotitle: Adding authentication to APIs to auth users
+seodesc: Learn how to add authentication to your APIs and make sure you know who's calling your backend APIs.
+title: Authenticating users
+subtitle: Knowing what's what and who's who
+infobox: {
+  title: "Authentication",
+  import: "encore.dev/auth",
+}
+lang: ts
+---
+Almost every application needs to know who's calling it, whether the user
+represents a person in a consumer-facing app or an organization in a B2B app.
+Encore supports both use cases in a simple yet powerful way.
+
+As described in the docs for [defining APIs](/docs/ts/primitives/defining-apis),
+each API endpoint can be marked as requiring authentication, using the option `auth: true`
+when defining the endpoint.
+
+
+## Authentication Handlers
+
+When an API is defined with `auth: true`, you must define an authentication handler
+in your application. The authentication handler is responsible for inspecting incoming
+requests to determine what user is authenticated (if any), and computing any other associated
+authentication information.
+
+The authentication handler is defined similarly to API endpoints, using the `authHandler`
+function imported from `encore.dev/auth`.
+
+Like API endpoints, the authentication handler defines what request information it's interested in,
+in the form of HTTP headers, query strings, or cookies.
+
+A simple authentication handler that inspects the `Authorization` header might look like this:
+
+```ts
+import { Header, Gateway } from "encore.dev/api";
+import { authHandler } from "encore.dev/auth";
+
+// AuthParams specifies the incoming request information
+// the auth handler is interested in. In this case it only
+// cares about requests that contain the `Authorization` header.
+interface AuthParams {
+    authorization: Header<"Authorization">;
+}
+
+// The AuthData specifies the information about the authenticated user
+// that the auth handler makes available.
+interface AuthData {
+    userID: string;
+}
+
+// The auth handler itself.
+export const auth = authHandler<AuthParams, AuthData>(
+    async (params) => {
+        // TODO: Look up information about the user based on the authorization header.
+        return {userID: "my-user-id"};
+    }
+)
+
+// Define the API Gateway that will execute the auth handler:
+export const gateway = new Gateway({
+    authHandler: auth,
+})
+```
+
+With this in place, Encore will provision an API Gateway that will process
+incoming requests to your application, and whenever a request contains
+an `Authorization` header it will first call the authentication handler to
+resolve information about the user.
+
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/clerk"
+    desc="Example application showing an auth handler implementation using Clerk."
+/>
+
+### Rejecting authentication
+
+If the auth handler returns an `AuthData` object, Encore will consider the request
+authenticated. To instead _reject_ the request, throw an exception. To signal that
+the credentials are not valid, throw an `APIError` with code `Unauthenticated`.
+
+For example:
+
+```ts
+import { APIError } from "encore.dev/api";
+
+export const auth = authHandler<AuthParams, AuthData>(
+    async (params) => {
+        throw APIError.unauthenticated("bad credentials");
+    }
+)
+```
+
+## Understanding the Authentication Process
+
+Encore's authentication process proceeds in two steps:
+
+1. Determine if the request is authenticated
+2. Call the endpoint, if permissible
+
+#### Step 1: Determining if the request is authenticated
+
+Whenever an incoming request contains any of the authentication parameters (defined by the auth handler),
+Encore's API Gateway calls the auth handler to resolve the authentication data.
+
+This happens regardless of the endpoint the request is for. Importantly, it happens even
+when calling an endpoint that does not require authentication.
+
+There are three possible outcomes from calling the auth handler:
+
+1. If the auth handler succeeds, by returning `AuthData`, the request is considered authenticated.
+
+2. If the auth handler throws an `APIError` with code `Unauthenticated`, the request is considered unauthenticated,
+   exactly as if there was no authentication parameters in the request to begin with.
+
+3. If the auth handler throws any other exception, the API Gateway aborts the request and returns the error to the caller.
+
+Finally, if the request does not contain authentication data, the request is considered unauthenticated.
+
+#### Step 2: Calling the endpoint, if permissible
+
+Once the API Gateway has determined whether the request is authenticated, it checks whether the API Endpoint
+being called requires authentication data.
+
+If it does require authentication, and the request is not authenticated,
+the API Gateway aborts the request and returns an "unauthenticated" error to the caller.
+
+In all other situations, the API Gateway proceeds by calling the target endpoint.
+
+If the request was successfully authenticated, the authentication data is passed along to the endpoint,
+regardless of whether the endpoint requires authentication or not.
+
+## Using auth data
+
+If a request has been successfully authenticated, the API Gateway forwards the authentication data
+to the target endpoint. The endpoint can query the available auth data from the `getAuthData` function,
+available from the `~encore/auth` module.
+
+This module is dynamically generated by Encore to enable type-safe resolution of the auth data.
+
+### Propagating auth data
+
+Encore automatically propagates the auth data when you make API calls to other Encore API endpoints
+using the generated `~encore/clients` package.
+
+<Callout type="info">
+
+If an endpoint calls another endpoint during its processing, and the target endpoint
+requires authentication while the original request does not have any authentication data,
+the API call will fail with error code `Unauthenticated`.
+
+This behavior preserves the guarantee that endpoints that
+require authentication always have valid authentication data present.
+
+</Callout>
+
+## Overriding auth information
+
+You can override the auth data for a specific endpoint when calling it via `~encore/clients` by passing `CallOpts`. Example:
+
+```ts
+import { svc } from "~encore/clients";
+
+const resp = await svc.endpoint(params, { authData: { userID: "...", userEmail: "..." } });
+```
+
+<Callout type="info">
+
+Overriding auth data is useful for testing endpoints that require authentication without having to
+authenticate the request manually.
+
+</Callout>
+
+## Mocking auth
+
+You can mock `getAuthData` with vitest. Example:
+
+```ts
+import { describe, expect, test, vi } from "vitest";
+import * as auth from "~encore/auth";
+import { get } from "./hello";
+
+
+describe("get", () => {
+  test("should combine string with parameter value", async () => {
+    const spy = vi.spyOn(auth, 'getAuthData');
+    spy.mockImplementation(() => ({ userEmail: "user@email.com" }))
+
+    const resp = await get({ name: "world" });
+    expect(resp.message).toBe("Hello world! You are authenticated with user@email.com");
+  });
+});
+```
diff --git a/docs/ts/develop/debug.md b/docs/ts/develop/debug.md
new file mode 100644
index 0000000000..c2e907c6b1
--- /dev/null
+++ b/docs/ts/develop/debug.md
@@ -0,0 +1,58 @@
+---
+seotitle: How to debug your TS backend application
+seodesc: Learn how to debug your TS backend application using Encore.
+title: Debug with your IDE
+lang: ts
+---
+
+Encore makes it easy to debug your application using your favorite IDE. 
+
+## Enable debugging mode
+Next, run your Encore application with `encore run --debug=break`. This will cause Encore to run your app with the `--inspect-brk` flag, which will pause your application until a debugger is attached. Encore will print the URL to the terminal, which you will use to attach your debugger:
+
+```shell
+$ encore run --debug=break
+  Your API is running at:     http://127.0.0.1:4000
+  Development Dashboard URL:  http://localhost:9400/ai-chat-ts-qhwi
+  Process ID:                 38965
+
+Debugger listening on ws://127.0.0.1:9229/473dd95f-e71e-4bf2-9eda-6132dd0d6ae3
+```
+
+(Your process id and url will differ).
+
+If you don't want the application to pause on startup, you can use `encore run --debug` instead. This will start the application and wait for a debugger to attach, but it won't pause the application until the debugger is attached.
+
+## Attach your debugger
+When your Encore application is running, it’s time to attach the debugger. The instructions differ depending on how you would like to debug. If instructions for your editor aren’t listed below, consult your editor for information on how to attach a debugger to a running process.
+
+### Visual Studio Code
+To debug with VS Code you must first add a debug configuration. Press `Run -> Add Configuration`, choose `Node.js -> Attach`. The generated config should look something like this:
+
+```json
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "name": "Attach",
+      "port": 9229,
+      "request": "attach",
+      "skipFiles": [
+        "<node_internals>/**"
+      ],
+      "type": "node"
+    }
+  ]
+}
+```
+
+Next, open the **Run and Debug** menu in the toolbar on the left, select Attach (the configuration you just created), and then press the green arrow.
+
+That’s it! You should be able to set breakpoints and have the Encore application pause when they’re hit like you would expect.
+
+## WebStorm
+To debug with WebStorm (or any other JetBrains IDE), you must first configure a Node.js Attach configuration. Press `Run -> Edit Configurations`, click the `+` button, and choose `Attach to Node.js/Chrome`. Give it a name and hit `OK`. 
+Now select the configuration you just created and press the green bug.
+
+That's it. You should be able to set breakpoints and have the Encore application pause when they’re hit like you would expect.
+
diff --git a/docs/ts/develop/metadata.md b/docs/ts/develop/metadata.md
new file mode 100644
index 0000000000..0f0b73ee95
--- /dev/null
+++ b/docs/ts/develop/metadata.md
@@ -0,0 +1,182 @@
+---
+seotitle: Metadata API – Get data about the app and environment
+seodesc: See how to use Encore's Metadata API to get information about the app and the environment it's running in.
+title: Metadata
+subtitle: Use the metadata API to get information about the app and the environment it's running in
+infobox: { title: "Metadata API", import: "encore.dev" }
+lang: ts
+---
+
+While Encore tries to provide a cloud-agnostic environment, sometimes it's helpful to know more about the environment
+your application is running in. For this reason Encore provides an API for accessing metadata about the
+[application](#application-metadata) and the environment it's running in as
+part of the `encore.dev` package.
+
+## Application Metadata
+
+Calling `appMeta()` from the `encore.dev` package returns an object that
+contains information about the application, including:
+
+- `appId` - the application name.
+- `apiBaseUrl` - the URL the application API can be publicly accessed on.
+- `environment` - the [environment](/docs/platform/deploy/environments) the application is currently running in.
+- `build` - the revision information of the build from the version control system.
+- `deploy` - the deployment ID and when this version of the app was deployed.
+
+## Current Request
+
+The `currentRequest()` function, also provided by the `encore.dev` module, can be called from anywhere within your application and returns a
+`Request` object that contains information the current request being processed.
+
+The object contains different fields depending on whether the
+current request is an API call or a Pub/Sub message being processed.
+
+```typescript
+-- API Call --
+/** Describes an API call being processed. */
+export interface APICallMeta {
+  /** Specifies that the request is an API call. */
+  type: "api-call";
+
+  /** Describes the API Endpoint being called. */
+  api: APIDesc;
+
+  /** The HTTP method used in the API call. */
+  method: Method;
+
+  /**
+   * The request URL path used in the API call,
+   * excluding any query string parameters.
+   * For example "/path/to/endpoint".
+   */
+  path: string;
+
+  /**
+   * The request URL path used in the API call,
+   * including any query string parameters.
+   * For example "/path/to/endpoint?with=querystring".
+   */
+  pathAndQuery: string;
+
+  /**
+   * The parsed path parameters for the API endpoint.
+   * The keys are the names of the path parameters,
+   * from the API definition.
+   *
+   * For example {id: 5}.
+   */
+  pathParams: Record<string, any>;
+
+  /**
+   * The request headers from the HTTP request.
+   * The values are arrays if the header contains multiple values,
+   * either separated by ";" or when the header key appears more than once.
+   */
+  headers: Record<string, string | string[]>;
+
+  /**
+   * The parsed request payload, as expected by the application code.
+   * Not provided for raw endpoints or when the API endpoint expects no
+   * request data.
+   */
+  parsedPayload?: Record<string, any>;
+}
+
+-- Pub/Sub Message --
+/** Describes a Pub/Sub message being processed. */
+export interface PubSubMessageMeta {
+  /** Specifies that the request is a Pub/Sub message. */
+  type: "pubsub-message";
+
+  /** The service processing the message. */
+  service: string;
+
+  /** The name of the Pub/Sub topic. */
+  topic: string;
+
+  /** The name of the Pub/Sub subscription. */
+  subscription: string;
+
+  /**
+   * The unique id of the Pub/Sub message.
+   * It is the same id returned by `topic.publish()`.
+   * The message id stays the same across delivery attempts.
+   */
+  messageId: string;
+
+  /**
+   * The delivery attempt. The first attempt starts at 1,
+   * and increases by 1 for each retry.
+   */
+  deliveryAttempt: number;
+
+  /**
+   * The parsed request payload, as expected by the application code.
+   */
+  parsedPayload?: Record<string, any>;
+}
+```
+
+This works automatically as a result of Encore's request tracking.
+If no request is processed by the caller, which can happen if you call it during service
+initialization, `currentRequest()` returns `undefined`.
+
+
+## Example Use Cases
+
+### Using Cloud Specific Services
+
+All the [clouds](/docs/platform/deploy/own-cloud) contain a large number of services, not all of which Encore natively supports.
+
+By using information about the [environment](/docs/platform/deploy/environments), you can define the implementation of these and use different services for each environment's provider.
+
+For instance if you are pushing audit logs into a data warehouse, when running on GCP you could use BigQuery, but when running on AWS you could use Redshift, when running locally you could simply write them to a file.
+
+```ts
+import { appMeta } from "encore.dev";
+
+// Emit an audit event.
+async function audit(userID: string, event: Record<string, any>) {
+  const cloud = appMeta().environment.cloud;
+  switch (cloud) {
+    case "aws":
+      return writeIntoRedshift(userID, event);
+    case "gcp":
+      return writeIntoBigQuery(userID, event);
+    case "local":
+      return writeIntoFile(userID, event);
+    default:
+      throw new Error(`unknown cloud: ${cloud}`);
+  }
+}
+```
+
+### Checking Environment type
+
+When implementing a signup system, you may want to skip email verification on user signups when developing the application.
+Using the `appMeta` API, we can check the environment and decide whether to send an email or simply mark the user as
+verified upon signup.
+
+```ts
+import { appMeta } from "encore.dev";
+
+export const signup = api(
+  { expose: true },
+  async (params: SignupParams): Promise<SignupResponse> => {
+    // more code...
+
+    // If this is a testing environment, skip sending the verification email.
+    switch (appMeta().environment.type) {
+      case "test":
+      case "development":
+        await markEmailVerified(userID);
+        break;
+      default:
+        await sendVerificationEmail(userID);
+        break;
+    }
+
+    // more code...
+  },
+);
+```
diff --git a/docs/ts/develop/middleware.md b/docs/ts/develop/middleware.md
new file mode 100644
index 0000000000..6ac2c72da0
--- /dev/null
+++ b/docs/ts/develop/middleware.md
@@ -0,0 +1,130 @@
+---
+seotitle: Using Middleware in your Encore.ts application
+seodesc: See how you can use middleware in your Encore.ts application to handle cross-cutting generic functionality, like request logging, auth, or tracing.
+title: Middleware
+subtitle: Handling cross-cutting, generic functionality
+lang: ts
+---
+
+Middleware is a way to write reusable code that runs before, after, or both before and after
+the handling of API requests, often across several (or all) API endpoints.
+
+Middleware is commonly used to implement cross-cutting concerns like
+[request logging](/docs/ts/observability/logging),
+[authentication](/docs/ts/develop/auth),
+[tracing](/docs/ts/observability/tracing),
+and so on. One of the benefits of Encore.ts is that
+it handles these common use cases out-of-the-box, so there's no
+need to write your own middleware.
+
+However, when developing applications there's often some use cases where it can be useful to write
+reusable functionality that applies to multiple API endpoints, and middleware
+is a good solution for this.
+
+Encore provides built-in support for middleware by adding functions to the
+[Service definitions](/docs/ts/primitives/services) configuration.
+Each middleware can be configured with a `target` option to specify what
+API endpoints it applies to.
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/middleware"
+    desc="Example app with two middleware; a rate limiter and one for user authorization."
+/>
+
+## Middleware functions
+
+The simplest way to create a middleware is to use the `middleware` helper in `encore.dev/api`,
+here is an example of a middleware that will run for endpoints that require auth:
+
+```ts
+import { middleware } from "encore.dev/api";
+
+export default new Service("myService", {
+    middlewares: [
+        middleware({ target: { auth: true } }, async (req, next) => {
+            // do something before the api handler
+            const resp = await next(req);
+            // do something after the api handler
+            return resp
+        })
+    ]
+});
+
+```
+
+Middleware forms a chain, allowing each middleware to introspect and process
+the incoming request before handing it off to the next middleware by calling the
+`next` function that's passed in as an argument. For the last middleware in the
+chain, calling `next` results in the actual API handler being called.
+
+The `req` parameter provides information about the incoming request, it has different fields
+depending on what kind of handler it is.
+
+You can get information about the current request via `req.requestMeta` if the endpoint is a
+[typed API endpoint](/docs/ts/primitives/defining-apis) or a
+[Streaming API endpoint](/docs/ts/primitives/streaming-apis).
+
+For [Streaming API endpoints](/docs/ts/primitives/streaming-apis) you can also access the stream
+via `req.stream` method.
+
+For [Raw Endpoints](/docs/ts/primitives/raw-endpoints) you can access the raw request and the
+raw response via `req.rawRequest` and `req.rawResponse`.
+
+The `next` function returns a `HandlerResponse` object which contains the response from the API.
+Extra response headers can be added using `resp.header.set(key, value)` or `resp.header.add(key, value)`,
+if the endpoint is a [typed API endpoint](/docs/ts/primitives/defining-apis).
+
+To pass data from middleware to an API handler, you can assign values to `req.data` within the middleware. These values can then be accessed in the handler using `currentRequest()`.
+
+Here’s an example:
+
+```ts
+const mw = middleware(async (req, next) => {
+  // Assign a value to the request
+  req.data.myMiddlewareData = { some: "data" };
+
+  return await next(req);
+});
+
+export const ep = api(
+  { expose: true, method: "GET", path: "/endpoint" },
+  async () => {
+    const callMeta = currentRequest() as APICallMeta;
+
+    // Access the value in the API handler
+    const myData = callMeta.middlewareData?.myMiddlewareData;
+    // Use the data as needed
+  },
+);
+```
+
+## Middleware ordering
+
+Middleware runs in the order they are defined in the [Service definitions](/docs/ts/primitives/services)
+configuration, i.e:
+
+```ts
+export default new Service("myService", {
+    middlewares: [
+        first,
+        second,
+        third
+    ],
+});
+
+```
+
+## Targeting APIs
+
+The `target` option specifies which endpoints within the service the middleware should run on. If not set, the middleware will run for all endpoints by default.
+
+For better performance, use the `target` option instead of filtering within the middleware function. This allows the applicable middleware to be determined per endpoint during startup, reducing runtime overhead.
+
+The following options are available for targeting endpoints:
+
+- `tags`: A list of tags evaluated with `OR`, meaning the middleware applies to an endpoint if the endpoint has at least one of these tags.
+- `expose`: A boolean indicating whether the middleware should be applied to endpoints that are exposed or not exposed.
+- `auth`: A boolean indicating whether the middleware should be applied to endpoints that require authentication or not.
+- `isRaw`: A boolean indicating whether the middleware should be applied to raw endpoints.
+- `isStream`: A boolean indicating whether the middleware should be applied to stream endpoints.
+
diff --git a/docs/ts/develop/multithreading.md b/docs/ts/develop/multithreading.md
new file mode 100644
index 0000000000..d2c091d93d
--- /dev/null
+++ b/docs/ts/develop/multithreading.md
@@ -0,0 +1,40 @@
+---
+seotitle: Multithreading in Encore.ts
+seodesc: See how Encore.ts provides true multithreading for JavaScript applications, and how to enable Worker Pooling for CPU-intensive workloads.
+title: Multithreading
+subtitle: True multithreading for JavaScript applications
+lang: ts
+---
+
+Encore.ts runs using a high-performance Rust runtime that uses multiple threads to handle incoming requests.
+The Encore.ts Rust runtime handles virtually everything outside of your core business logic:
+
+* Parsing and validating incoming requests
+* Making API calls to other services
+* Serializing and writing API responses
+* Observability integrations like distributed tracing
+* Infrastructure integrations, like executing database queries, reading and writing from object storage, publishing and consuming messages from Pub/Sub, and more
+
+This architecture allows for much higher performance and scalability compared to traditional JavaScript frameworks.
+By offloading most of this to multithreaded Rust, the single-threaded JavaScript event loop becomes free to focus on executing your core business logic.
+
+But for more CPU-intensive workloads, the single-threaded JavaScript event loop can still become a performance bottleneck.
+For these use cases Encore.ts offers Worker Pooling. With Worker Pooling enabled, Encore.ts starts up multiple NodeJS event loops
+and load-balances incoming requests across them. This can provide a significant performance boost for CPU-intensive workloads.
+
+<img src="https://encore.dev/assets/blog/worker-pooling/encore-pooling.png" />
+
+## Enabling Worker Pooling
+
+To enable Worker Pooling, add `"build": {"worker_pooling": true}` to your `encore.app` file.
+
+## Designing your application to work with Worker Pooling
+
+Most application code will work with Worker Pooling without any changes. However, it's important to understand
+the implications of running in a multi-threaded environment.
+
+When utilizing Worker Pooling, Encore.ts will automatically spin up multiple NodeJS isolates (one per CPU) to handle incoming requests.
+Each NodeJS isolate is a separate JavaScript runtime, with its own event loop and memory space.
+
+This means that you cannot rely on global shared state that is shared across all incoming requests,
+since each request may be handled by a different NodeJS isolate.
diff --git a/docs/ts/develop/orms/drizzle.md b/docs/ts/develop/orms/drizzle.md
new file mode 100644
index 0000000000..39cbc26eca
--- /dev/null
+++ b/docs/ts/develop/orms/drizzle.md
@@ -0,0 +1,78 @@
+---
+seotitle: Using Drizzle with Encore
+seodesc: Learn how to use Drizzle with Encore to interact with SQL databases.
+title: Using Drizzle ORM with Encore
+lang: ts
+---
+Encore.ts supports integrating [Drizzle](https://orm.drizzle.team/), a TypeScript ORM for Node.js and the browser. To use Drizzle with Encore, start by creating a `SQLDatabase` instance and providing the connection string to Drizzle.
+ 
+<GitHubLink href="https://github.com/encoredev/examples/tree/main/ts/drizzle" desc="Using Drizzle ORM with Encore.ts" />
+
+## 1. Setting Up the Database Connection
+
+In `database.ts`, initialize the `SQLDatabase` and configure Drizzle:
+
+```typescript
+// database.ts
+import { api } from "encore.dev/api";
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { users } from "./schema";
+
+// Create SQLDatabase instance with migrations configuration
+const db = new SQLDatabase("test", {
+  migrations: {
+    path: "migrations",
+    source: "drizzle",
+  },
+});
+
+// Initialize Drizzle ORM with the connection string
+const orm = drizzle(db.connectionString);
+
+// Query all users
+await orm.select().from(users);
+```
+
+## 2. Configuring Drizzle
+
+Create a Drizzle configuration file `drizzle.config.ts` to specify settings like migration output, schema, and database dialect:
+
+```typescript
+// drizzle.config.ts
+import 'dotenv/config';
+import { defineConfig } from 'drizzle-kit';
+
+export default defineConfig({
+  out: 'migrations',
+  schema: 'schema.ts',
+  dialect: 'postgresql',
+});
+```
+
+## 3. Defining the Database Schema
+
+Define your database tables in `schema.ts` using Drizzle's `pg-core` module:
+
+```typescript
+// schema.ts
+import * as p from "drizzle-orm/pg-core";
+
+export const users = p.pgTable("users", {
+  id: p.serial().primaryKey(),
+  name: p.text(),
+  email: p.text().unique(),
+});
+```
+
+## 4. Generating Migrations
+
+Run the following command in the directory containing `drizzle.config.ts` to generate migrations:
+
+```bash
+drizzle-kit generate
+```
+
+## 5. Applying Migrations
+
+Migrations are automatically applied when you run your Encore application, so you don’t need to run `drizzle-kit migrate` or any similar commands manually.
diff --git a/docs/ts/develop/orms/knex.md b/docs/ts/develop/orms/knex.md
new file mode 100644
index 0000000000..bebf72058b
--- /dev/null
+++ b/docs/ts/develop/orms/knex.md
@@ -0,0 +1,70 @@
+---
+seotitle: Using Knex.js with Encore
+seodesc: Learn how to use Knex.js with Encore to interact with SQL databases.
+title: Using Knex.js with Encore
+lang: ts
+---
+Encore.ts supports integrating [Knex.js](http://knexjs.org/), a SQL query builder for Node.js. To use Knex.js with Encore.ts, start by creating an `SQLDatabase` instance and provide its connection string to Knex.js.
+
+## 1. Setting Up the Database Connection
+
+In `site.ts`, initialize the `SQLDatabase` and configure Knex.js:
+
+```typescript
+// site.ts
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+import knex from "knex";
+
+// Create SQLDatabase instance with migrations configuration
+const SiteDB = new SQLDatabase("siteDB", {
+  migrations: "./migrations",
+});
+
+// Initialize Knex with the database connection string
+const orm = knex({
+  client: "pg",
+  connection: SiteDB.connectionString,
+});
+
+// Define the Site interface
+export interface Site {
+  id: number;
+  url: string;
+}
+
+// Query builder for the "site" table
+const Sites = () => orm<Site>("site");
+
+// Example queries
+
+// Query all sites
+await Sites().select();
+
+// Query a site by id
+await Sites().where("id", id).first();
+
+// Insert a new site
+await Sites().insert({ url: params.url });
+```
+
+## 2. Creating Migrations
+
+Currently, Encore does not support JavaScript migration files generated by `knex migrate:make`. Instead, you can create and maintain [migration files](/docs/ts/primitives/databases#database-migrations) in SQL format.
+
+Example migration file to create the `site` table:
+
+```sql
+-- migrations/1_create_table.up.sql --
+CREATE TABLE site (
+    id SERIAL PRIMARY KEY,
+    url TEXT NOT NULL UNIQUE
+);
+```
+
+## 3. Applying Migrations
+
+Encore automatically applies migrations when you run your application. You do not need to run `knex migrate:latest` or similar commands manually.
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/ts/knex" 
+    desc="Example implementation showing how to use Knex ORM with Encore.ts" />
\ No newline at end of file
diff --git a/docs/ts/develop/orms/overview.md b/docs/ts/develop/orms/overview.md
new file mode 100644
index 0000000000..d6b40e8906
--- /dev/null
+++ b/docs/ts/develop/orms/overview.md
@@ -0,0 +1,43 @@
+---
+seotitle: Using ORMs with Encore.ts
+seodesc: Learn how to use ORMs with Encore.ts to seamlessly interact with SQL databases from your TypeScript / Node.js backend.
+title: Using ORMs and Migration Frameworks with Encore.ts
+lang: ts
+---
+Encore provides built-in support for ORMs and migration frameworks by offering named databases and SQL-based migration files. For developers who prefer not to write raw SQL, Encore allows seamless integration with popular ORMs and migration tools.
+
+## Overview
+
+Encore’s approach to database management is flexible. It uses standard SQL migration files, allowing integration with ORMs like [Sequelize](https://sequelize.org/) and migration tools like [Atlas](https://atlasgo.io/).
+
+- **ORM Compatibility:** If your ORM can connect to a database via a standard SQL driver, it will work with Encore.
+- **Migration Tool Compatibility:** If your migration tool generates SQL migration files without additional customization, it can be used with Encore.
+
+## Connecting to a Database
+
+Encore provides the `SQLDatabase` class, which allows you to create a named database and retrieve its connection string. This connection string can be used by your chosen ORM or migration framework to establish a database connection.
+
+Example setup:
+
+```typescript
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+
+// Initialize a named database with migration directory
+const SiteDB = new SQLDatabase("siteDB", {
+  migrations: "./migrations",
+});
+
+// Retrieve the connection string for ORM use
+const connStr = SiteDB.connectionString;
+```
+
+## Example ORM implementations
+
+Here are some guides to using different ORMs with Encore:
+
+- [Using Knex.js with Encore](/docs/ts/develop/orms/knex)
+- [Using Sequelize with Encore](/docs/ts/develop/orms/sequelize)
+- [Using Drizzle with Encore](/docs/ts/develop/orms/drizzle)
+- [Using Prisma with Encore](/docs/ts/develop/orms/prisma)
+
+This setup enables Encore to support a wide variety of ORMs and migration frameworks, making database management both flexible and straightforward.
\ No newline at end of file
diff --git a/docs/ts/develop/orms/prisma.md b/docs/ts/develop/orms/prisma.md
new file mode 100644
index 0000000000..de263baee5
--- /dev/null
+++ b/docs/ts/develop/orms/prisma.md
@@ -0,0 +1,353 @@
+---
+seotitle: Using Prisma with Encore.ts
+seodesc: Learn how to use Prisma with Encore to interact with SQL databases.
+title: Using Prisma with Encore.ts
+lang: ts
+---
+
+[Prisma](https://prisma.io/) is a modern TypeScript ORM that provides type-safe database access and migrations. With Prisma, you define your database schema in a `schema.prisma` file and use Prisma's CLI to generate SQL migrations and a TypeScript client.
+
+This guide explains how to integrate Prisma with Encore.ts, leveraging Encore's built-in database management while using Prisma's powerful ORM features.
+
+## How Prisma works with Encore
+
+Encore and Prisma work together seamlessly:
+- **Prisma** generates the migration files and TypeScript client
+- **Encore** manages database creation, connections, and applies migrations
+- You use Encore's `SQLDatabase` to provide connection strings to Prisma
+
+The key to this integration is configuring Prisma to use Encore's shadow database for its operations, preventing any conflicts between the two systems.
+
+## Quick Example
+
+Here's a complete example of using Prisma with Encore.ts:
+
+```ts
+-- users/database.ts --
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+
+// Define a database named 'users', using the database migrations
+// in the "./prisma/migrations" folder (generated by Prisma).
+export const DB = new SQLDatabase("users", {
+  migrations: {
+    path: "./prisma/migrations",
+    source: "prisma",
+  },
+});
+
+-- users/prisma/schema.prisma --
+generator client {
+  provider        = "prisma-client"
+  output          = "./generated"
+  previewFeatures = ["queryCompiler", "driverAdapters"]
+}
+
+datasource db {
+  provider = "postgresql"
+  // Connect Prisma CLI to Encore's shadow database
+  // This prevents interference with Encore's migration system
+  url      = env("SHADOW_DB_URL")
+}
+
+model User {
+  id        Int      @id @default(autoincrement())
+  email     String   @unique
+  name      String
+  createdAt DateTime @default(now())
+}
+
+-- users/prisma/client.ts --
+import { PrismaClient } from "./generated/client";
+import { PrismaPg } from "@prisma/adapter-pg";
+import { DB } from "../database";
+
+// Create and export the Prisma client instance
+export const prisma = new PrismaClient({
+  adapter: new PrismaPg({ connectionString: DB.connectionString }),
+});
+
+// Re-export types from the generated client
+export * from "./generated/client";
+
+-- users/api.ts --
+import { api } from "encore.dev/api";
+import { prisma } from "./prisma/client";
+
+interface CreateUserRequest {
+  email: string;
+  name: string;
+}
+
+// Example API endpoint using Prisma
+export const createUser = api(
+  { method: "POST", path: "/users", expose: true },
+  async (req: CreateUserRequest) => {
+    const user = await prisma.user.create({
+      data: req,
+    });
+    return user;
+  }
+);
+```
+
+<GitHubLink
+href="https://github.com/encoredev/examples/tree/main/ts/prisma"
+desc="Complete Prisma + Encore.ts example"
+/>
+
+## Step-by-Step Setup
+
+### 1. Install Dependencies
+
+First, install Prisma and its required dependencies:
+
+```bash
+npm install prisma --save-dev
+npm install @prisma/client @prisma/adapter-pg dotenv --save
+```
+
+### 2. Create Project Structure
+
+Create the following directory structure for your service:
+
+```
+my-service/
+├── database.ts
+├── prisma/
+│   ├── schema.prisma
+│   ├── migrations/
+│   ├── generated/     (will be created by Prisma)
+│   └── client.ts
+└── api.ts
+```
+
+### 3. Set Up the Database
+
+Create `database.ts` to define your Encore database:
+
+```ts
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+
+// Export the database so it can be used in the Prisma client
+export const DB = new SQLDatabase("myapp", {
+  migrations: {
+    path: "./prisma/migrations",
+    source: "prisma",
+  },
+});
+```
+
+Run `encore run` to create the database (make sure the migrations folder has been created first).
+
+### 4. Configure Database Connections
+
+Prisma needs to connect to Encore's shadow database for migration operations. The shadow database is a temporary database that Prisma uses to detect schema drift and generate migrations without affecting your main database.
+
+Get the connection strings:
+
+```bash
+# Main database connection (for Prisma Studio)
+encore db conn-uri myapp
+
+# Shadow database connection (for Prisma CLI operations)
+encore db conn-uri myapp --shadow
+```
+
+Create a `.env` file in your project root:
+
+```
+# Connection strings for local development
+DB_URL=<main-database-connection-string>
+SHADOW_DB_URL=<shadow-database-connection-string>
+```
+
+### 5. Create Prisma Configuration
+
+Create `prisma.config.ts` in your project root:
+
+```ts
+import "dotenv/config";
+import type { PrismaConfig } from "prisma";
+import { PrismaPg } from "@prisma/adapter-pg";
+
+type Env = {
+  DB_URL: string;
+};
+
+export default {
+  earlyAccess: true,
+  schema: "./my-service/prisma/schema.prisma",
+  studio: {
+    adapter: async (env: Env) => {
+      // Connect Prisma Studio to the main Encore database
+      return new PrismaPg({ connectionString: env.DB_URL });
+    },
+  },
+} satisfies PrismaConfig<Env>;
+```
+
+### 6. Create Your Prisma Schema
+
+Create `my-service/prisma/schema.prisma`:
+
+```
+generator client {
+  provider        = "prisma-client"
+  output          = "./generated"
+  previewFeatures = ["queryCompiler", "driverAdapters"]
+}
+
+datasource db {
+  provider = "postgresql"
+  // IMPORTANT: Use shadow database URL for Prisma CLI operations
+  url      = env("SHADOW_DB_URL")
+}
+
+// Define your models here
+model User {
+  id        Int      @id @default(autoincrement())
+  email     String   @unique
+  name      String
+}
+```
+
+### 7. Create the Prisma Client Wrapper
+
+Create `my-service/prisma/client.ts`:
+
+```ts
+import { PrismaClient } from "./generated/client";
+import { PrismaPg } from "@prisma/adapter-pg";
+import { DB } from "../database";
+
+// Create and export the Prisma client instance
+export const prismaClient = new PrismaClient({
+  adapter: new PrismaPg({ connectionString: DB.connectionString }),
+});
+
+// Re-export types from the generated client
+export * from "./generated/client";
+```
+
+### 8. Generate Initial Migration
+
+Generate and apply your first migration:
+
+```bash
+npx prisma migrate dev --name init
+encore run
+```
+
+This will:
+1. Create the `prisma/migrations` directory
+2. Generate SQL migration files
+3. Generate the Prisma client in `prisma/generated`
+4. Apply the migration to your development database
+
+### 9. Use Prisma in Your Code
+
+Now you can use Prisma in your API endpoints:
+
+```ts
+import { api, APIError } from "encore.dev/api";
+import { prismaClient, Prisma } from "./prisma/client";
+
+interface CreateUserRequest {
+  email: string;
+  name: string;
+}
+
+export const createUser = api(
+  { method: "POST", path: "/users", expose: true },
+  async (req: CreateUserRequest) => {
+    try {
+      const user = await prismaClient.user.create({
+        data: req,
+      });
+      return user;
+    } catch (error) {
+      if (error instanceof Prisma.PrismaClientKnownRequestError) {
+        if (error.code === "P2002") {
+          throw APIError.alreadyExists("User with this email already exists");
+        }
+      }
+      throw error;
+    }
+  },
+);
+
+export const getUsers = api(
+  { method: "GET", path: "/users", expose: true },
+  async (): Promise<{
+    users: { name: string; email: string; id: number }[];
+  }> => {
+    return { users: await prismaClient.user.findMany() };
+  },
+);
+```
+
+## Working with Migrations
+
+### Generate New Migrations
+
+When you make changes to your `schema.prisma` file:
+
+```bash
+npx prisma migrate dev --name describe-your-change
+```
+
+Example:
+```bash
+npx prisma migrate dev --name add-user-role
+```
+
+### How Migrations Work
+
+1. **Prisma generates** SQL migration files based on your schema changes
+2. **Encore applies** these migrations automatically:
+   - Locally when you run `encore run`
+   - In cloud environments during deployment
+   - During tests when using `encore test`
+
+## Deployment
+
+### Generate Client During Build
+
+For Encore Cloud deployments, add to your `package.json`:
+
+```json
+{
+  "scripts": {
+    "postinstall": "npx prisma generate"
+  }
+}
+```
+
+This ensures the Prisma client is generated during deployment.
+
+### Production Considerations
+
+- Encore automatically provides database connection strings in production
+- No environment variables need to be configured for production
+- Migrations are applied automatically during deployment
+
+## Using Prisma Studio
+
+Prisma Studio provides a GUI for your database:
+
+```bash
+npx prisma studio
+```
+
+Opens at `http://localhost:5555` where you can:
+- Browse and filter data
+- Create, update, and delete records
+- Explore relationships
+
+## Troubleshooting
+
+### Connection Issues
+
+If Prisma or Prisma Studio can't connect:
+1. Verify connection strings in `.env`
+2. Restart Encore (`encore run`)
diff --git a/docs/ts/develop/orms/sequelize.md b/docs/ts/develop/orms/sequelize.md
new file mode 100644
index 0000000000..3bd629ecad
--- /dev/null
+++ b/docs/ts/develop/orms/sequelize.md
@@ -0,0 +1,66 @@
+---
+seotitle: Using Sequelize with Encore.ts
+seodesc: Learn how to use Sequelize with Encore to interact with SQL databases.
+title: Using Sequelize with Encore.ts
+lang: ts
+---
+Encore.ts supports integrating [Sequelize](https://sequelize.org/), a promise-based Node.js ORM. To set up Sequelize with Encore, start by creating a `SQLDatabase` instance and providing the connection string to Sequelize.
+
+## 1. Setting Up the Database Connection
+
+In `database.ts`, initialize the `SQLDatabase` and configure Sequelize:
+
+```typescript
+// database.ts
+import {
+  Model,
+  InferAttributes,
+  InferCreationAttributes,
+  CreationOptional,
+  DataTypes,
+  Sequelize,
+} from "sequelize";
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+
+// Create SQLDatabase instance with migrations configuration
+const DB = new SQLDatabase("encore_sequelize_test", {
+  migrations: "./migrations",
+});
+
+// Initialize Sequelize with the connection string
+const sequelize = new Sequelize(DB.connectionString);
+
+// Define the User model
+class User extends Model<InferAttributes<User>, InferCreationAttributes<User>> {
+  declare id: CreationOptional<number>;
+  declare name: string;
+  declare surname: string;
+}
+
+// Example usage: Count all users
+const count = await User.count();
+```
+
+## 2. Creating Migrations
+
+Encore does not currently support JavaScript migration files generated by tools like `sequelize-cli model:generate`. Instead, create and manage your own [migration files](/docs/ts/primitives/databases#database-migrations) in SQL format.
+
+Example migration file for creating the `user` table:
+
+```sql
+-- migrations/1_create_user.up.sql --
+CREATE TABLE "user" (
+  id SERIAL PRIMARY KEY,
+  name TEXT NOT NULL,
+  surname TEXT NOT NULL
+);
+```
+
+## 3. Applying Migrations
+
+Migrations are automatically applied when you run your Encore application, so you don’t need to run `sequelize db:migrate` or similar commands manually.
+
+--- 
+
+For more information, see the example on GitHub:  
+<GitHubLink href="https://github.com/encoredev/examples/tree/main/ts/sequelize" desc="Using Sequelize ORM with Encore.ts" />
\ No newline at end of file
diff --git a/docs/ts/develop/running-scripts.md b/docs/ts/develop/running-scripts.md
new file mode 100644
index 0000000000..0450167bbe
--- /dev/null
+++ b/docs/ts/develop/running-scripts.md
@@ -0,0 +1,50 @@
+---
+seotitle: How to use `encore exec` for running scripts
+seodesc: Learn how to use the `encore exec` command to run scripts like database seeding in your Encore app.
+title: Running Scripts
+subtitle: Run scripts with your application's infrastructure and runtime configured and initialized
+lang: ts
+---
+In local development, you may need to run scripts or commands, such as seeding a database with initial data.
+For that to work the database needs to be started, and the Encore runtime needs to be configured and initialized.
+
+## Using `encore exec`
+
+The `encore exec` command allows you to execute custom commands while leveraging Encore's infrastructure setup. This is particularly useful for tasks like database seeding, running scripts, or other one-off commands that require the app's environment to be initialized.
+
+### How it works
+
+The `encore exec` command initializes the required infrastructure for your Encore app and executes the specified command.
+This ensures that your commands run in the correct context with all dependencies properly configured.
+
+### Example: Database Seeding
+
+In this example, `npx tsx ./seed.ts` runs a TypeScript script (`seed.ts`) to populate the database with initial data
+
+```bash
+encore exec -- npx tsx ./seed.ts
+```
+
+Here’s what happens:
+1. Encore initializes the app infrastructure.
+2. The `npx tsx ./seed.ts` command is executed in the context of the initialized app.
+
+### General Syntax
+
+```bash
+encore exec -- <your-command>
+```
+
+Substitute `<your-command>` with the specific command you wish to run.
+
+### Use Cases
+
+- **Database Seeding**: Populate your database with initial data using a script.
+- **Client Generation**: Generate a client for interacting with an external dependency.
+- **Custom Scripts**: Run any script that depends on the app's initialized environment.
+
+### Notes
+
+- Ensure that the command you provide is executable in your environment.
+- Use `--` to separate `encore exec` options from the command you want to run.
+
diff --git a/docs/ts/develop/testing.md b/docs/ts/develop/testing.md
new file mode 100644
index 0000000000..c98cc76de1
--- /dev/null
+++ b/docs/ts/develop/testing.md
@@ -0,0 +1,122 @@
+---
+seotitle: Automated testing for your backend application
+seodesc: Learn how create automated tests for your microservices backend application, and run them automatically on deploy using Go and Encore.
+title: Automated testing
+subtitle: Confidence at speed
+lang: ts
+---
+
+Encore provides built-in testing tools that make it simple to test your application using a variety of test runners.
+
+To run tests with Encore:
+
+1. Configure the `test` command in your `package.json` to use the test runner of your choice.
+2. Configure your test runner.
+3. Run `encore test` from the CLI.
+
+The `encore test` command automatically sets up all necessary infrastructure in test mode before running your tests.
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/ts/uptime" 
+    desc="Uptime monitoring app with API endpoint unit tests written in Vitest." 
+/>
+
+## Recommended Setup: Vitest
+
+We recommend [Vitest](https://vitest.dev) as your test runner because it offers:
+- Fast execution
+- Native ESM and TypeScript support
+- Jest API compatibility
+
+### Setting up Vitest
+
+1. Create `vite.config.ts` in your application's root directory:
+
+```ts
+/// <reference types="vitest" />
+import { defineConfig } from "vite";
+import path from "path";
+
+export default defineConfig({
+  resolve: {
+    alias: {
+      "~encore": path.resolve(__dirname, "./encore.gen"),
+    },
+  },
+});
+```
+
+2. Update your `package.json` to include:
+
+```json
+{
+  "scripts": {
+    "test": "vitest"
+  }
+}
+```
+
+You're done! Now you can run your tests with `encore test`.
+
+### Optional: IDE Integration
+
+#### VS Code Setup
+
+If using Vitest, follow these steps:
+1. Install the official Vitest VS Code extension
+2. Add to `.vscode/settings.json`:
+
+```json
+{
+  "vitest.commandLine": "encore test"
+}
+```
+
+As of Vitest plugin version 0.5 ([issue](https://github.com/vitest-dev/vscode/issues/306)), environment configuration requires an updated approach. The following configuration is required to ensure proper functionality:
+
+Update `settings.json` to include:
+
+```json
+"vitest.nodeEnv": {
+    // generated with `encore daemon env | grep ENCORE_RUNTIME_LIB | cut -d'=' -f2`
+    "ENCORE_RUNTIME_LIB": "/opt/homebrew/Cellar/encore/1.44.5/libexec/runtimes/js/encore-runtime.node"
+}
+```
+
+When running tests within VSCode, file-level parallel execution must be disabled. Update your `vite.config.ts` as follows:
+
+```typescript
+// File vite.config.ts
+export default defineConfig({
+  resolve: {
+    alias: {
+      "~encore": path.resolve(__dirname, "./encore.gen"),
+    },
+  },
+  test: {
+    fileParallelism: false,
+  },
+});
+```
+
+To improve the performance in CI, you can re-enable the parallel execution by overwriting the config in cli `encore test --fileParallelism=true`.
+
+## Integration Testing Best Practices
+
+Encore applications typically focus on integration tests rather than unit tests because:
+
+- Encore eliminates most boilerplate code
+- Your code primarily consists of business logic involving databases and inter-service API calls
+- Integration tests better verify this type of functionality
+
+### Test Environment Benefits
+
+When running tests, Encore automatically:
+- Sets up separate test databases
+- Configures databases for optimal test performance by:
+  - Skipping `fsync`
+  - Using in-memory filesystems
+  - Removing durability overhead
+
+These optimizations make integration tests nearly as fast as unit tests.
+
diff --git a/docs/ts/faq.md b/docs/ts/faq.md
new file mode 100644
index 0000000000..26788f47c2
--- /dev/null
+++ b/docs/ts/faq.md
@@ -0,0 +1,67 @@
+---
+seotitle: Frequently Asked Questions
+seodesc: See quick answers to common questions about Encore
+title: FAQ
+subtitle: Quick answers to common questions
+lang: ts
+---
+
+## About the project
+
+**Is Encore Open Source?**
+
+Yes, check out the project on [GitHub](https://github.com/encoredev/encore).
+
+**Is there a community?**
+
+Yes, you're welcome to join the developer community on [Discord](https://encore.dev/discord).
+
+## Can I use X with Encore?
+
+**Can I use Python with Encore?**
+
+Encore currently supports Go and TypeScript. Python support in on the [roadmap](https://encore.dev/roadmap) and will be available around Q1 2025.
+
+**Can mix TypeScript and Go in one application?**
+
+Support for mixing languages in coming. Currently, if you want to use both TypeScript and Go, you need to create a separate application per language and integrate using APIs.
+
+**Can I use Azure / Digital Ocean?**
+
+Encore Cloud currently supports automating deployments to AWS and GCP. Azure support in on the [roadmap](https://encore.dev/roadmap) and will be available in 2025.
+
+If you want to use other cloud providers like Azure or Digital Ocean, you can follow the [self-hosting instructions](/docs/how-to/self-host).
+
+**Can I use MongoDB / MySQL with Encore?**
+
+Encore currently has built-in support for PostgreSQL. To use another type of database, like MongoDB and MySQL, you will need to set it up and integrate as you normally would when not using Encore.
+
+**Can I use AWS lambda with Encore?**
+
+Not right now. Encore currently supports AWS Fargate and EKS (along with CloudRun and GKE on Google Cloud Platform).
+
+**Can I use Bun / Deno with Encore.ts?**
+
+Right now Encore.ts officially supports Node and has experimental support for Bun. Deno support is on the way. Note that Encore.ts already provides performance improvements thanks to its Rust-based runtime. [Learn more](https://encore.dev/blog/event-loops).
+
+To enable the Bun experiment, add `"experiments": ["bun-runtime"]` to your `encore.app` file.
+
+## IDE Integrations
+
+**Is there an Encore plugin for Goland / IntelliJ?**
+
+Yes, Encore's official Goland plugin is available in the [JetBrains marketplace](https://plugins.jetbrains.com/plugin/20010-encore).
+
+**Is there an Encore plugin for VS Code?**
+
+Not yet, it's coming soon.
+
+## Troubleshooting
+
+**symlink creation error on Windows**
+
+Encore currently relies on symbolic links, which may be disabled by default. A common fix for this issue is to enable "developer mode" in the Windows settings (Settings > System > For developers > Developer mode).
+
+**`node` errors**
+
+You might need to restart the Encore daemon, e.g. if your PATH has changed since installing nvm. Restart the daemon by running `encore daemon`.
diff --git a/docs/ts/frontend/cors.md b/docs/ts/frontend/cors.md
new file mode 100644
index 0000000000..441bef6b1f
--- /dev/null
+++ b/docs/ts/frontend/cors.md
@@ -0,0 +1,81 @@
+---
+seotitle: Handling CORS (Cross-Origin Resource Sharing)
+seodesc: See how you can configure CORS for your Encore application.
+title: CORS
+subtitle: Configure CORS (Cross-Origin Resource Sharing) for your Encore application
+lang: ts
+---
+
+CORS is a web security concept that defines which website origins are allowed to access your API.
+
+A deep-dive into CORS is out of scope for this documentation, but [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS)
+provides a good overview. In short, CORS affects requests made by browsers to resources hosted on
+other origins (a combination of the scheme, domain, and port).
+
+## Configuring CORS
+
+Encore provides a default CORS configuration that is suitable for many APIs. You can override these settings
+by specifying the `global_cors` key in the `encore.app` file, which has the following
+structure:
+
+```cue
+{
+    // debug enables CORS debug logging.
+    "debug": true | false,
+
+    // allow_headers allows an app to specify additional headers that should be
+    // accepted by the app.
+    //
+    // If the list contains "*", then all headers are allowed.
+    "allow_headers": [...string],
+
+    // expose_headers allows an app to specify additional headers that should be
+    // exposed from the app, beyond the default set always recognized by Encore.
+    //
+    // If the list contains "*", then all headers are exposed.
+    "expose_headers": [...string],
+
+    // allow_origins_without_credentials specifies the allowed origins for requests
+    // that don't include credentials. If nil it defaults to allowing all domains
+    // (equivalent to ["*"]).
+    "allow_origins_without_credentials": [...string],
+
+    // allow_origins_with_credentials specifies the allowed origins for requests
+    // that include credentials. If a request is made from an Origin in this list
+    // Encore responds with Access-Control-Allow-Origin: <Origin>.
+    //
+    // The URLs in this list may include wildcards (e.g. "https://*.example.com"
+    // or "https://*-myapp.example.com").
+    "allow_origins_with_credentials": [...string],
+}
+```
+
+## Allowed origins
+
+The main CORS configuration is the list of allowed origins, meaning which websites are allowed
+to access your API (via browsers).
+
+For this purpose, CORS makes a distinction between requests that contain authentication information
+(cookies, HTTP authentication, or client certificates) and those that do not. CORS applies stricter
+rules to authenticated requests.
+
+By default, Encore allows unauthenticated requests from all origins but disallows requests that do
+include authorization information from other origins. This is a good default for many APIs.
+This can be changed by setting the `allow_origins_without_credentials` key (see above).
+For convenience Encore also allows all origins when developing locally.
+
+For security reasons it's necessary to explicitly specify which origins are allowed to make
+authenticated requests. This is done by setting the `allow_origins_with_credentials` key (see above).
+
+## Allowed headers and exposed headers
+
+CORS also lets you specify which headers are allowed to be sent by the client ("allowed headers"),
+and which headers are exposed to scripts running in the browser ("exposed headers").
+
+Encore automatically configures headers by parsing your program using static analysis.
+If your API defines a request or response type that contains a header field, Encore automatically adds the header to
+the list of exposed and allowed headers in request types respectively.
+
+To add additional headers to these lists, you can set the `allow_headers` and `expose_headers` keys (see above).
+This can be useful when your application relies on custom headers in e.g. raw endpoints that aren't seen by Encore's
+static analysis.
diff --git a/docs/ts/frontend/hosting.mdx b/docs/ts/frontend/hosting.mdx
new file mode 100644
index 0000000000..dcd02469ef
--- /dev/null
+++ b/docs/ts/frontend/hosting.mdx
@@ -0,0 +1,47 @@
+---
+seotitle: Integrate your backend application with a frontend
+seodesc: Learn how to host your frontend when having a Encore.ts backend application.
+title: Hosting a frontend
+subtitle: Keep using your favorite frontend hosting provider
+lang: ts
+---
+
+Encore is not opinionated about where you host your frontend, pick the platform that suits your situation best.
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/nextjs-starter"
+    desc="Next.js + Encore TS Web App Starter. Frontend hosted on Vercel, backend on Encore."
+/>
+
+## Hosting a frontend using Encore
+Encore is primarily designed for backend development. It is possible to serve a frontend using Encore but for production we recommend that you deploy your frontend using Vercel, Netlify, or a similar service.
+
+### Template engines
+
+You can make use of template engines like Handlebars, Pug, or EJS to render HTML files on the server. Learn more about in the [Template Engine](/docs/ts/frontend/template-engine) docs.
+
+### Serving static assets
+
+You can create a `api.static` endpoint that serves static frontend assets, including HTML files.
+
+```ts
+import { api } from "encore.dev/api";
+
+// Using fallback route to serve all files in the ./assets directory under the root path.
+export const rootAssets = api.static({
+  expose: true,
+  path: "/!path",
+  dir: "./assets",
+  // When a file matching the request isn't found, Encore automatically serves a 404 Not Found response.
+  // You can customize the response by setting the notFound option to specify a file that should be served instead:
+  notFound: "./assets/not_found.html",
+});
+
+```
+
+Keep in mind that this approach will not work if you have a Single-Page Application (SPA) that uses client-side routing.
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/static-files"
+    desc="Static files example, sercing HTML files from a directory."
+/>
diff --git a/docs/ts/frontend/mono-vs-multi-repo.mdx b/docs/ts/frontend/mono-vs-multi-repo.mdx
new file mode 100644
index 0000000000..1affee36f5
--- /dev/null
+++ b/docs/ts/frontend/mono-vs-multi-repo.mdx
@@ -0,0 +1,38 @@
+---
+seotitle: Integrate your backend application with a frontend
+seodesc: Learn how to structure your application, using a Monorepo or a Multi-repo approach.
+title: Mono vs Multi Repo
+subtitle: How to structure your frontend and backend
+lang: ts
+---
+
+Encore is not opinionated about if you have your backend and frontend code in the same repo or not. Pick the approach that fits your application best.
+
+## Monorepo
+
+If you use a monorepo then it is often a good idea to place your backend and frontend in separate folders in the root of your repo, like so:
+
+```
+/my-app
+├── backend
+│   ├── encore.app
+│   ├── package.json // Backend dependencies
+│   └── ...
+└── frontend
+    ├── package.json // Frontend dependencies
+    └── ...
+```
+
+This way, you can keep your frontend and backend dependencies separate, while still having the codebases in the same repository. If you are using Encore Cloud for deployment, remember to configure the "Root Directory" in app settings in the [Encore Cloud dashboard](https://app.encore.cloud) to point to where you have your `encore.app` file.
+
+<GitHubLink
+    href="https://github.com/encoredev/nextjs-starter"
+    desc="Next.js + Encore Starter, separated into frontend and backend folders."
+/>
+
+You can also have a monorepo where the `encore.app` file is in the root of the repo, the frontend code will then be inside your Encore app. If you go this route you will most likely need two different `tsconfig.json` files, one for the frontend and one for the backend.
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/react-starter"
+    desc="React + Encore Starter, frontend code inside the Encore app."
+/>
diff --git a/docs/ts/frontend/request-client.mdx b/docs/ts/frontend/request-client.mdx
new file mode 100644
index 0000000000..d5f13e8245
--- /dev/null
+++ b/docs/ts/frontend/request-client.mdx
@@ -0,0 +1,207 @@
+---
+seotitle: Get type-safe requests between your backend and frontend
+seodesc: Learn how to use Encore's built-in client generation to get type-safety between your backend and frontend.
+title: Request client for the frontend
+subtitle: Get type-safety between your backend and frontend
+lang: ts
+---
+
+Encore is able to generate frontend request clients (TypeScript or JavaScript). This lets you to keep the request/response types in sync without manual work and assists you in calling the APIs. Generate a client by running:
+
+```bash
+$ encore gen client <ENCORE-APP-ID> --output=./src/client.ts --env=<ENV_NAME>
+```
+
+Adding this as a script to your `package.json` is often a good idea to be able to run it whenever a change is made to your Encore API:
+
+```json
+{
+...
+"scripts": {
+    ...
+    "generate-client:staging": "encore gen client <ENCORE-APP-ID> --output=./src/client.ts --env=staging",
+    "generate-client:local": "encore gen client <ENCORE-APP-ID> --output=./src/client.ts --env=local"
+  }
+}
+```
+
+After that you are ready to use the request client in your code. In this example, the frontend is calling the `GetNote` endpoint on the `note` service in order to retrieve a specific meeting note (which has the properties `id`, `cover_url` & `text`):
+
+```ts
+import Client, { Environment, Local } from "src/client.ts";
+
+// Making request to locally running backend...
+const client = new Client(Local);
+// or to a specific deployed environment
+// const client = new Client(Environment("staging"));
+
+// Calling APIs as typesafe functions 🌟
+const response = await client.note.GetNote("note-uuid");
+console.log(response.id);
+console.log(response.cover_url);
+console.log(response.text);
+```
+
+See more in the [client generation docs](/docs/ts/cli/client-generation).
+
+### Asynchronous state management
+
+When building something a bit more complex, you will likely need to deal with caching, refetching, and data going stale.
+[TanStack Query](https://tanstack.com/query/latest) is a popular library that was built to solve exactly these problems and works well with the Encore request client.
+
+Here is a simple example of using an Encore request client together with TanStack Query:
+
+```ts
+import {
+  useQuery,
+  useMutation,
+  useQueryClient,
+  QueryClient,
+  QueryClientProvider,
+} from '@tanstack/react-query'
+import Client, { todo } from '../encore-client'
+
+// Create a Encore client
+const encoreClient = new Client(window.location.origin);
+
+// Create a react-query client
+const queryClient = new QueryClient()
+
+function App() {
+  return (
+    // Provide the client to your App
+    <QueryClientProvider client={queryClient}>
+      <Todos />
+    </QueryClientProvider>
+  )
+}
+
+function Todos() {
+  // Access the client
+  const queryClient = useQueryClient()
+
+  // Queries
+  const query = useQuery({
+    queryKey: ['todos'],
+    queryFn: () => encoreClient.todo.List()
+  })
+
+  // Mutations
+  const mutation = useMutation({
+    mutationFn: (params: todo.AddParams) => encoreClient.todo.Add(params),
+    onSuccess: () => {
+      // Invalidate and refetch
+      queryClient.invalidateQueries({ queryKey: ['todos'] })
+    },
+  })
+
+  return (
+    <div>
+      <ul>
+        {query.data?.map((todo) => (
+          <li key={todo.id}>{todo.title}</li>
+        ))}
+      </ul>
+
+      <button
+        onClick={() => {
+          mutation.mutate({
+            id: Date.now(),
+            title: 'Do Laundry',
+          })
+        }}
+      >
+        Add Todo
+      </button>
+    </div>
+  )
+}
+
+render(<App />, document.getElementById('root'))
+```
+
+This example assumes that we have a `todo` service with a `List` and `Add` endpoint. When adding the new todo,
+TanStack Query will automatically invalidate the `todos` query and refetch it.
+
+For a real-world example, take a look at the [Uptime Monitoring](https://github.com/encoredev/examples/tree/main/uptime) app which also makes use of
+TanStack Query's `refetchInterval` option for polling the backend.
+
+### Testing
+When unit testing a component that interacts with your Encore API you can mock methods on the request client to
+return a value suitable for the test. This makes your test URL agnostic because you are not intercepting
+specific requests on the fetch layer. You also get type errors in your tests if the request client gets updated.
+
+Here is an example from the [Uptime Monitoring Starter](https://github.com/encoredev/examples/tree/main/uptime) where we are mocking a GET request method and spying on a POST request method:
+
+```ts
+import { render, waitForElementToBeRemoved } from "@testing-library/react";
+import App from "./App";
+import { site } from "./client";
+import { userEvent } from "@testing-library/user-event";
+
+describe("App", () => {
+  beforeEach(() => {
+    // Return mocked data from the List (GET) endpoint
+    jest
+      .spyOn(site.ServiceClient.prototype, "List")
+      .mockReturnValue(Promise.resolve({
+        sites: [{
+          id: 1,
+          url: "test.dev"
+        }]
+      }));
+
+    // Spy on the Add (POST) endpoint
+    jest.spyOn(site.ServiceClient.prototype, "Add");
+  });
+
+  it("render sites", async () => {
+    render(<App />);
+    await waitForElementToBeRemoved(() => screen.queryByText("Loading..."));
+
+    // Verify that the List endpoint has been called
+    expect(site.ServiceClient.prototype.List).toBeCalledTimes(1);
+
+    // Verify that the sites are rendered with our mocked data
+    screen.getAllByText("test.dev");
+  });
+
+  it("add site", async () => {
+    render(<App />);
+    await waitForElementToBeRemoved(() => screen.queryByText("Loading..."));
+
+    // Interact with the page and add 'another.com'
+    await userEvent.click(screen.getByText("Add website"));
+    await userEvent.type(
+      screen.getByPlaceholderText("google.com"),
+      "another.com",
+    );
+    await userEvent.click(screen.getByText("Save"));
+
+    // Verify that the Add endpoint has been called with the correct parameters
+    expect(site.ServiceClient.prototype.Add).toHaveBeenCalledWith({
+      url: "another.com",
+    });
+  });
+})
+```
+
+<Callout type="info">
+
+  In the example above we need to mock the `List` method on `site.ServiceClient.prototype` because the request client has not
+  yet been initialized when we're creating the mock. If you have access to the instance of the request client in your test
+  (which could be the case if you are passing the client around in your components) you can instead do `jest.spyOn(client.site, "List")`
+  and `expect(client.site.List).toHaveBeenCalled()` which would give you the same result.
+
+</Callout>
+
+## REST vs. GraphQL
+Encore allows for building backends using both REST and GraphQL, you should pick the approach that suits your use case best. Encore's request client only works for REST APIs so if you choose to build a GraphQL backend you will need to use another request library for your frontend.
+
+Take a look at the [GraphQL tutorial](/docs/ts/tutorials/graphql) for an example of building a GraphQL backend with Encore.
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/graphql"
+    desc="Example of how to build an Apollo GraphQL server with Encore.ts, implementing a basic book CRUD service."
+/>
+
diff --git a/docs/ts/frontend/template-engine.md b/docs/ts/frontend/template-engine.md
new file mode 100644
index 0000000000..a6d3dd6e28
--- /dev/null
+++ b/docs/ts/frontend/template-engine.md
@@ -0,0 +1,119 @@
+---
+seotitle: How to use a template engine in you Encore.ts application
+seodesc: Learn how to use a template engine to create server-rendered HTML with dynamic data.
+title: Use a template engine
+lang: ts
+---
+
+In this guide you will learn how to use a template engine, like [EJS](https://ejs.co) and [Handlebars](https://handlebarsjs.com), to create server-rendered HTML views.
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/ts/template-engine" 
+    desc="Using EJS as a template engine with Encore.ts" 
+/>
+
+## Serving a specific template file
+
+Breakdown of the example:
+* We import a NPM package for rendering templates, in this case [EJS](https://ejs.co/).
+* We have a [Raw Endpoint](/docs/ts/primitives/raw-endpoints) to handle template rendering, in this case we are serving a specific template file (`person.html`) under `/person`. 
+* We make use of the EJS to render the template with the given data.
+* We set the `content-type` header to `text-html` and then respond with the generated HTML.
+
+```ts
+-- template/template.ts --
+import { api } from "encore.dev/api";
+import ejs, { Options } from "ejs";
+
+const BASE_PATH = "./template/views";
+const ejsOptions: Options = { views: [BASE_PATH] };
+
+export const serveSpecificTemplate = api.raw(
+  { expose: true, path: "/person", method: "GET" },
+  async (req, resp) => {
+    const viewPath = `${BASE_PATH}/person.html`;
+    const html = await ejs.renderFile(
+      viewPath,
+      // Supplying data to the view
+      { name: "Simon" },
+      ejsOptions,
+    );
+    resp.setHeader("content-type", "text/html");
+    resp.end(html);
+  },
+);
+-- template/views/person.html --
+<h1>Person Page</h1>
+<p>Name: <%= name %></p>
+```
+
+## Serving from a dynamic path
+
+This example is similar to the one above, but in this case we use a fallback path to serve a template file based on the path. We use the `currentRequest` function to get the `path` and then render the template file based on the `path`. If no path is provided, we default to `index.html`.
+
+```ts
+import { api } from "encore.dev/api";
+import { APICallMeta, currentRequest } from "encore.dev";
+import ejs, { Options } from "ejs";
+
+const BASE_PATH = "./template/views";
+const ejsOptions: Options = { views: [BASE_PATH] };
+
+export const servePathTemplate = api.raw(
+  { expose: true, path: "/!path", method: "GET" },
+  async (req, resp) => {
+    const { path } = (currentRequest() as APICallMeta).pathParams;
+    const viewPath = `${BASE_PATH}/${path ?? "index"}.html`;
+    const html = await ejs.renderFile(viewPath, ejsOptions);
+    resp.setHeader("content-type", "text/html");
+    resp.end(html);
+  },
+);
+```
+
+## Serving inline HTML
+
+In this example we are serving inline HTML with EJS. We use the `ejs.render` function to render the inline HTML with the given data.
+
+```ts
+import { api } from "encore.dev/api";
+import ejs, { Options } from "ejs";
+
+const inlineHTML = `
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8" />
+    <link rel="stylesheet" href="/public/styles.css" >
+  </head>
+  <body>
+    <h1>Static Inline HTML Example</h1>
+    <h1>Name: <%= name %>!</h1>
+  </body>
+</html>
+`;
+
+export const serveInlineHTML = api.raw(
+  { expose: true, path: "/html", method: "GET" },
+  async (req, resp) => {
+    const html = ejs.render(inlineHTML, { name: "Simon" });
+    resp.setHeader("Content-Type", "text/html");
+    resp.end(html);
+  },
+);
+```
+
+## Static files
+
+In the above example we are fetching a stylesheet from the `/public` path. We can use the `api.static` function to serve all files in the `./assets` directory under the `/public` path prefix:
+
+```ts
+// Serve all files in the ./assets directory under the /public path prefix.
+export const assets = api.static({
+  expose: true,
+  path: "/public/*path",
+  dir: "./assets",
+});
+```
+
+Learn more about serving static files in the [Static Files](/docs/ts/primitives/static-assets) guide.
diff --git a/docs/ts/how-to/file-uploads.md b/docs/ts/how-to/file-uploads.md
new file mode 100644
index 0000000000..0a73f4ee84
--- /dev/null
+++ b/docs/ts/how-to/file-uploads.md
@@ -0,0 +1,221 @@
+---
+seotitle: How to handle file uploads in you Encore.ts application
+seodesc: Learn how to store file uploads as bytes in a database and serving them back to the client.
+title: Handling file uploads
+lang: ts
+---
+
+In this guide you will learn how to handle file uploads from a client in your Encore.ts backend.
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/ts/file-upload" 
+    desc="Handling file uploads and storing file data in a database" 
+/>
+
+## Storing a single file in a database
+
+Breakdown of the example:
+* We have a [PostgreSQL database](/docs/ts/primitives/databases) table named `files` with columns `name` and `data` to store the file name and the file data.
+* We have a [Raw Endpoint](/docs/ts/primitives/raw-endpoints) to handle file uploads. The endpoint has a `bodyLimit` set to `null` to allow for unlimited file size. 
+* We make use of the [busboy](https://www.npmjs.com/package/busboy) library to help with the file handling.
+* We convert the file data to a `Buffer` and store the file as a `BYTEA` in the database.
+
+```ts
+-- upload.ts --
+import { api } from "encore.dev/api";
+import log from "encore.dev/log";
+import busboy from "busboy";
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+
+// Define a database named 'files', using the database migrations
+// in the "./migrations" folder. Encore automatically provisions,
+// migrates, and connects to the database.
+export const DB = new SQLDatabase("files", {
+  migrations: "./migrations",
+});
+
+type FileEntry = { data: any[]; filename: string };
+
+/**
+ * Raw endpoint for storing a single file to the database.
+ * Setting bodyLimit to null allows for unlimited file size.
+ */
+export const save = api.raw(
+  { expose: true, method: "POST", path: "/upload", bodyLimit: null },
+  async (req, res) => {
+    const bb = busboy({
+      headers: req.headers,
+      limits: { files: 1 },
+    });
+    const entry: FileEntry = { filename: "", data: [] };
+
+    bb.on("file", (_, file, info) => {
+      entry.filename = info.filename;
+      file
+        .on("data", (data) => {
+          entry.data.push(data);
+        })
+        .on("close", () => {
+          log.info(`File ${entry.filename} uploaded`);
+        })
+        .on("error", (err) => {
+          bb.emit("error", err);
+        });
+    });
+
+    bb.on("close", async () => {
+      try {
+        const buf = Buffer.concat(entry.data);
+        await DB.exec`
+            INSERT INTO files (name, data)
+            VALUES (${entry.filename}, ${buf})
+            ON CONFLICT (name) DO UPDATE
+                SET data = ${buf}
+        `;
+        log.info(`File ${entry.filename} saved`);
+
+        // Redirect to the root page
+        res.writeHead(303, { Connection: "close", Location: "/" });
+        res.end();
+      } catch (err) {
+        bb.emit("error", err);
+      }
+    });
+
+    bb.on("error", async (err) => {
+      res.writeHead(500, { Connection: "close" });
+      res.end(`Error: ${(err as Error).message}`);
+    });
+
+    req.pipe(bb);
+    return;
+  },
+);
+-- migrations/1_create_tables.up.sql --
+CREATE TABLE files (
+    name TEXT PRIMARY KEY,
+    data BYTEA NOT NULL
+);
+```
+
+### Frontend
+
+```html
+<form method="POST" enctype="multipart/form-data" action="/upload">
+    <label for="filefield">Single file upload:</label><br>
+    <input type="file" name="filefield">
+    <input type="submit">
+</form>
+```
+
+## Handling multiple file uploads
+
+When handling multiple file uploads, we can use the same approach as above, but we need to handle multiple files in the busboy event listeners. When storing the files in the database, we loop through the files and save them one by one.
+
+```ts
+export const saveMultiple = api.raw(
+  { expose: true, method: "POST", path: "/upload-multiple", bodyLimit: null },
+  async (req, res) => {
+    const bb = busboy({ headers: req.headers });
+    const entries: FileEntry[] = [];
+
+    bb.on("file", (_, file, info) => {
+      const entry: FileEntry = { filename: info.filename, data: [] };
+
+      file
+        .on("data", (data) => {
+          entry.data.push(data);
+        })
+        .on("close", () => {
+          entries.push(entry);
+        })
+        .on("error", (err) => {
+          bb.emit("error", err);
+        });
+    });
+
+    bb.on("close", async () => {
+      try {
+        for (const entry of entries) {
+          const buf = Buffer.concat(entry.data);
+          await DB.exec`
+              INSERT INTO files (name, data)
+              VALUES (${entry.filename}, ${buf})
+              ON CONFLICT (name) DO UPDATE
+                  SET data = ${buf}
+          `;
+          log.info(`File ${entry.filename} saved`);
+        }
+
+        // Redirect to the root page
+        res.writeHead(303, { Connection: "close", Location: "/" });
+        res.end();
+      } catch (err) {
+        bb.emit("error", err);
+      }
+    });
+
+    bb.on("error", async (err) => {
+      res.writeHead(500, { Connection: "close" });
+      res.end(`Error: ${(err as Error).message}`);
+    });
+
+    req.pipe(bb);
+    return;
+  },
+);
+```
+
+### Frontend
+
+```html
+<form method="POST" enctype="multipart/form-data" action="/upload-multiple">
+    <label for="filefield">Multiple files upload:</label><br>
+    <input type="file" name="filefield" multiple>
+    <input type="submit">
+</form>
+```
+
+## Handling large files
+
+In order to not run into a **Maximum request length exceeded**-error when uploading large files you might need to adjust the endpoints `bodyLimit`. You can also set the `bodyLimit` to `null` to allow for unlimited file size uploads. If unset it defaults to 2MiB.
+
+## Retrieving files from the database
+
+When retrieving files from the database, we can use a GET endpoint to fetch the file data by its name. We can then serve the file back to the client by creating a `Buffer` from the file data and sending it in the response. 
+
+```ts
+import { api } from "encore.dev/api";
+import { APICallMeta, currentRequest } from "encore.dev"; 
+
+export const DB = new SQLDatabase("files", {
+  migrations: "./migrations",
+});
+
+export const get = api.raw(
+  { expose: true, method: "GET", path: "/files/:name" },
+  async (req, resp) => {
+    try {
+      const { name } = (currentRequest() as APICallMeta).pathParams;
+      const row = await DB.queryRow`
+          SELECT data
+          FROM files
+          WHERE name = ${name}`;
+      if (!row) {
+        resp.writeHead(404);
+        resp.end("File not found");
+        return;
+      }
+
+      const chunk = Buffer.from(row.data);
+      resp.writeHead(200, { Connection: "close" });
+      resp.end(chunk);
+    } catch (err) {
+      resp.writeHead(500);
+      resp.end((err as Error).message);
+    }
+  },
+);
+```
+
+You should now be able to retrieve a file from the database by making a GET request to `http://localhost:4000/files/name-of-file.ext`. 
diff --git a/docs/ts/how-to/nestjs.md b/docs/ts/how-to/nestjs.md
new file mode 100644
index 0000000000..ca54b8c618
--- /dev/null
+++ b/docs/ts/how-to/nestjs.md
@@ -0,0 +1,197 @@
+---
+seotitle: Use Encore together with NestJS
+seodesc: Learn how to use NestJS to structure your business logic and Encore for creating infrastructure resources.
+title: Use NestJS with Encore
+lang: ts
+---
+
+[Nest](https://docs.nestjs.com/) (NestJS) is a framework for building efficient, scalable TypeScript server-side
+applications. Nest aims to provide
+an application architecture out of the box which allows for effortless creation of highly testable, scalable, and
+loosely coupled and easily maintainable applications.
+
+Encore is not opinionated when it comes to application architecture, so you can use it together with NestJS to structure
+your business logic and Encore for creating backend primitives like APIs, Databases, and Cron Jobs.
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/ts/nestjs" 
+    desc="Encore.ts + NestJS example" 
+/>
+
+## Adding Encore to a NestJS project
+
+If you already have a NestJS project, you can add Encore to it by following these steps:
+
+1. Run `encore app init` in the root of your project to create a new Encore application.
+2. Add `encore.dev` as a dependency by running `npm install encore.dev`.
+3. Add the following `paths` to your `tsconfig.json`:
+
+```json
+-- tsconfig.json --
+{
+   "compilerOptions": {
+      "paths": {
+         "~encore/*": [
+            "./encore.gen/*"
+         ]
+      }
+   }
+}
+```
+
+## Standalone Nest application
+
+In order for Encore to be able to provision infrastructure resources, generate API documentation etc. we need to run our
+application using Encore. This means that we need to replace the ordinary Nest bootstrapping and instead run our Nest
+app as
+a [standalone application](https://docs.nestjs.com/standalone-applications). We do this by
+calling `NestFactory.createApplicationContext(AppModule)` and then selecting the modules/services we need:
+
+```ts
+-- applicationContext.ts --
+const applicationContext: Promise<{ catsService: CatsService }> =
+  NestFactory.createApplicationContext(AppModule).then((app) => {
+    return {
+      catsService: app.select(CatsModule).get(CatsService, {strict: true}),
+      // other services...
+    };
+  });
+
+export default applicationContext;
+```
+
+The `applicationContext` variable can then be used to access your Nest modules/services from your Encore your APIs.
+
+## Defining an Encore service
+
+When running an app using Encore you need at least
+one [Encore service](/docs/ts/primitives/services#defining-a-service). You can define a
+service
+in two ways:
+
+1. Create a folder and inside that folder defining one or more APIs. Encore recognizes this as a service, and uses the
+   folder name as the service name.
+2. Add a file named `encore.service.ts` in a directory. The file must export a service instance, by
+   calling `new Service`, imported from `encore.dev/service`:
+
+```ts
+import {Service} from "encore.dev/service";
+
+export default new Service("my-service");
+```
+
+Encore will consider this directory and all its subdirectories as part of the service.
+
+If you already have a Nest app then the easiest way to get going is to go with the second approach and add
+a `encore.service.ts` in the root of your app, then you do not need to change your existing folder structure. 
+
+## Replacing Nest controllers with Encore APIs
+
+If you already have a Nest app then you can keep most of your business logic (modules, services and providers) as is but
+in order for Encore to be able to manage your APIs, you need to replace your Nest controllers with Encore APIs.
+
+Let's assume you have a `cats/cats.controller.ts` in your Nest app that looks like this:
+
+```ts
+-- cats/cats.controller.ts --
+
+@Controller('cats')
+export class CatsController {
+  constructor(private readonly catsService: CatsService) {
+  }
+
+  @Post()
+  @Roles(['admin'])
+  async create(@Body() createCatDto: CreateCatDto) {
+    this.catsService.create(createCatDto);
+  }
+
+  @Get()
+  async findAll(): Promise<Cat[]> {
+    return this.catsService.findAll();
+  }
+
+  @Get(':id')
+  findOne(
+    @Param('id', new ParseIntPipe())
+      id: number,
+  ) {
+    return this.catsService.get(id);
+  }
+}
+```
+
+When converting this to using Encore it would look like this:
+
+```ts
+-- cats/cats.controller.ts --
+export const findAll = api(
+  {expose: true, method: 'GET', path: '/cats'},
+  async (): Promise<{ cats: Cat[] }> => {
+    const {catsService} = await applicationContext;
+    return {cats: await catsService.findAll()};
+  },
+);
+
+export const get = api(
+  {expose: true, method: 'GET', path: '/cats/:id'},
+  async ({id}: { id: number }): Promise<{ cat: Cat }> => {
+    const {catsService} = await applicationContext;
+    return {cat: await catsService.get(id)};
+  },
+);
+
+export const create = api(
+  {expose: true, auth: true, method: 'POST', path: '/cats'},
+  async (dto: CreateCatDto): Promise<void> => {
+    const {catsService} = await applicationContext;
+    catsService.create(dto);
+  },
+);
+```
+
+We use the `applicationContext` (that we defined above) to access our `catsService` and pass in the necessary
+parameters.
+
+Both Encore and Nest use the concept of a `service`. With Encore you define a service by creating a folder and inside
+that folder defining one or more APIs. Encore recognizes this as a service, and uses the folder name as the service
+name. When deploying, Encore will automatically provision the required infrastructure for each service. So in the
+example
+above we have a `cats` service with three APIs because `cats.controller.ts` is placed inside a folder named `cats`.
+
+## Making use of other Encore features
+
+Encore also allows you to easily make use of other backend primitives in your Nest app,
+like [Databases](/docs/ts/primitives/databases), [Cron Jobs](/docs/ts/primitives/cron-jobs), [Pub/Sub & Queues](/docs/ts/primitives/pubsub)
+and [Secrets](/docs/ts/primitives/secrets).
+
+Take a look at our [Encore + NestJS example](https://github.com/encoredev/examples/tree/main/ts/nestjs) which uses both
+a PostgreSQL Database and an [Auth Handler](/docs/ts/develop/auth) to authenticate incoming requests.
+
+## Running your Encore app
+
+After those steps we are ready to run our app locally:
+
+```shell
+$ encore run
+```
+
+You should see log messages about both Encore and Nest staring up. That means your local development environment is up
+and
+running and ready to take some requests!
+
+### Open the Local Development Dashboard
+
+You can now start using your [Local Development Dashboard](/docs/ts/observability/dev-dash).
+
+Open [http://localhost:9400](http://localhost:9400) in your browser to access it.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/localdashvideo.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+The Local Development Dashboard is a powerful tool to help you move faster when you're developing new features.
+
+It comes with an API explorer, a Service Catalog with automatically generated documentation, and powerful
+observability features
+like [distributed tracing](/docs/ts/observability/tracing).
diff --git a/docs/ts/install.md b/docs/ts/install.md
new file mode 100644
index 0000000000..502c37be3b
--- /dev/null
+++ b/docs/ts/install.md
@@ -0,0 +1,46 @@
+---
+seotitle: Install Encore to start building
+seodesc: See how you can install Encore on all platforms, and get started building your next backend application in minutes.
+title: Installation
+subtitle: Install the Encore CLI to get started with local development
+lang: ts
+---
+
+If you are new to Encore, we recommend following the [quick start guide](/docs/ts/quick-start).
+
+## Install the Encore CLI
+To develop locally with Encore, you first need to install the Encore CLI.
+This is what provisions your local development environment, and runs your Local Development Dashboard complete with logs, tracing, and API documentation.
+
+
+<InstallInstructions />
+
+### Prerequisites
+
+- [Node.js](https://nodejs.org/en/download/) is required to run Encore.ts apps.
+- [Docker](https://www.docker.com) is required for Encore to set up local databases.
+
+### Optional: Add Encore LLM instructions
+
+To help LLM powered tools like Cursor and GitHub Copilot understand how to use Encore, you can add pre-made instructions to your app.
+
+Download the [ts_llm_instructions.txt](https://github.com/encoredev/encore/blob/main/ts_llm_instructions.txt) file.
+  
+  **How to use:**
+  - Cursor: Rename the file to `.cursorrules`.
+  - GitHub Copilot: Paste content in `.github/copilot-instructions.md`.
+  - For other tools, place the file in your app root.
+
+### Build from source
+If you prefer to build from source, [follow these instructions](https://github.com/encoredev/encore/blob/main/CONTRIBUTING.md).
+
+
+## Update to the latest version
+Check which version of Encore you have installed by running `encore version` in your terminal.
+It should print something like:
+```shell
+encore version v1.28.0
+```
+
+If you think you're on an older version of Encore, you can easily update to the latest version by running
+`encore version update` from your terminal.
diff --git a/docs/ts/migration/express-migration.md b/docs/ts/migration/express-migration.md
new file mode 100644
index 0000000000..69dfa5b2b3
--- /dev/null
+++ b/docs/ts/migration/express-migration.md
@@ -0,0 +1,947 @@
+---
+seotitle: Migrate from Express to Encore.ts
+seodesc: Learn how migrate your Express.js app over to use Encore.ts for better performance and improved development tools.
+title: Migrating from Express.js
+lang: ts
+---
+
+If you have an existing app using [Express.js](https://expressjs.com/) and want to migrate it to Encore.ts, this guide is
+for you. This guide can also serve as a comparison between the two frameworks.
+
+<iframe width="560" height="315" class="aspect-video" src="https://www.youtube.com/embed/hA9syK_FtZw?si=EScQ-x3qOLdImrMb" title="Express.js vs Encore.ts" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
+
+## Why migrate to Encore.ts?
+
+Express.js is a great choice for building simple APIs, but as your application grows you will likely run into limitations. There is a large community around Express.js, providing many plugins and middleware to work around these limitations. However relying heavily on plugins can make it hard to find the right tools for your use case. It also means that you will need to maintain a lot of dependencies.
+
+Encore.ts is a framework that aims to make it easier to build robust and type-safe backends with
+TypeScript. Encore.ts has 0 npm dependencies, is built with performance in mind, and has a lot of built-in features for building production ready backends. You can deploy an Encore.ts app to any hosting service that accepts Docker containers, or use [Encore Cloud](/use-cases/devops-automation) to fully automate your DevOps and infrastructure.
+
+### Performance
+
+Unlike a lot of other Node.js frameworks, Encore.ts is not built on top of Express.js. Instead, Encore.ts has its own
+high-performance runtime, with a multi-threaded, asynchronous event loop written in Rust. The Encore Runtime handles all I/O like accepting and processing incoming HTTP requests. This runs as a completely independent event loop that utilizes as many threads as the underlying hardware supports. The result of this is that Encore.ts performs
+**9x faster** than Express.js. Learn more about the [Encore.ts Runtime](/blog/event-loops).
+
+### Built-in benefits
+
+When using Encore.ts you get a lot of built-in features without having to install any additional dependencies:
+
+| Built-in benefits                                      |                       <!-- -->                       |                                                       <!-- --> |
+| :----------------------------------------------------- | :--------------------------------------------------: | -------------------------------------------------------------: |
+| [Pub/Sub integrations](/docs/ts/primitives/pubsub)     |  [Type-safe API schemas](/docs/ts/primitives/apis)   |        [API Client generation](/docs/ts/cli/client-generation) |
+| [Secrets management](/docs/ts/primitives/secrets)      |        [CORS handling](/docs/ts/develop/cors)        | [Local Development Dashboard](/docs/ts/observability/dev-dash) |
+| [Database integrations](/docs/ts/primitives/databases) | [Architecture Diagrams](/docs/ts/observability/flow) |      [Service Catalog](/docs/ts/observability/service-catalog) |
+| [Request validation](/blog/event-loops)                |      [Cron Jobs](/docs/ts/primitives/cron-jobs)      |                [Local tracing](/docs/ts/observability/tracing) |
+
+## Migration guide
+
+Below we've outlined two main strategies you can use to migrate your existing Express.js application to Encore.ts. Pick the strategy that best suits your situation and application.
+
+<GitHubLink
+href="https://github.com/encoredev/examples/tree/main/ts/expressjs-migration"
+desc="Code examples for migrating an Express.js app to Encore.ts"
+/>
+
+<Accordion>
+
+### Forklift migration (quick start)
+
+When you quickly want to migrate to Encore.ts and don't need all the functionality to begin with, you can use a forklift migration strategy. This approach moves the entire application over to Encore.ts in one shot, by wrapping your existing HTTP router in a catch-all handler.
+
+**Approach benefits**
+
+- You can get your application up and running with Encore.ts quickly and start moving features over to Encore.ts while the rest of the application is still untouched.
+- You will see a partial performance boost right away because the HTTP layer is now running on the Encore Rust runtime. But to get the full performance benefits, you will need to start using Encore's [API declarations](/docs/ts/primitives/defining-apis) and [infrastructure declarations](/docs/ts#explore-how-to-use-each-backend-primitive).
+
+**Approach drawbacks**
+
+- Because all requests will be proxied through the catch-all handler, you will not be able to get all the benefits from the [distributed tracing](/docs/ts/observability/tracing), which rely on the [Encore application model](/docs/ts/concepts/application-model).
+- [Encore Flow](/docs/ts/observability/flow) and the [Service Catalog](/docs/ts/observability/service-catalog) will not be able to show you the full picture of your application until you start moving services and APIs over to Encore.ts.
+- You will not be able to use the [API Client generation](/docs/ts/cli/client-generation) feature until you start defining APIs in Encore.ts.
+
+#### 1. Install Encore
+
+If this is the first time you're using Encore, you first need to install the CLI that runs the local development
+environment. Use the appropriate command for your system:
+
+- **macOS:** `brew install encoredev/tap/encore`
+- **Linux:** `curl -L https://encore.dev/install.sh | bash`
+- **Windows:** `iwr https://encore.dev/install.ps1 | iex`
+
+[Installation docs](https://encore.dev/docs/install)
+
+#### 2. Add Encore.ts to your project
+
+```bash
+npm i encore.dev
+```
+
+#### 3. Initialize an Encore app
+
+Inside your project directory, run the following command to create an Encore app:
+
+```bash
+encore app init
+```
+
+This will create an `encore.app` file in the root of your project.
+
+#### 4. Configure your tsconfig.json
+
+To the `tsconfig.json` file in the root of your project, add the following:
+
+```json
+-- tsconfig.json --
+{
+  "compilerOptions": {
+    "paths": {
+      "~encore/*": [
+        "./encore.gen/*"
+      ]
+    }
+  }
+}
+```
+
+When Encore.ts is parsing your code it will specifically look for `~encore/*` imports.
+
+#### 5. Define an Encore.ts service
+
+When running an app using Encore.ts you need at least one [Encore service](/docs/ts/primitives/services). Apart from that, Encore.ts in not opinionated in how you structure your code, you are free to go with a monolith or microservice approach. Learn more in our [App Structure docs](/docs/ts/primitives/app-structure).
+
+In the root of your App, add a file named `encore.service.ts`. The file must export a service instance, by calling
+`new Service`, imported from `encore.dev/service`:
+
+```ts
+import {Service} from "encore.dev/service";
+
+export default new Service("my-service");
+```
+
+Encore will consider this directory and all its subdirectories as part of the service.
+
+#### 6. Create a catch-all handler for your HTTP router
+
+Now let's mount your existing app router under a [Raw endpoint](/docs/ts/primitives/raw-endpoints), which is an Encore API endpoint type that gives you access to the underlying HTTP request.
+
+Here's a basic code example:
+
+```typescript
+import { api, RawRequest, RawResponse } from "encore.dev/api";
+import express, { request, response } from "express";
+
+Object.setPrototypeOf(request, RawRequest.prototype);
+Object.setPrototypeOf(response, RawResponse.prototype);
+
+const app = express();
+
+app.get('/foo', (req: any, res) => {
+  res.send('Hello World!')
+})
+
+export const expressApp = api.raw(
+  { expose: true, method: "*", path: "/!rest" },
+  app,
+);
+```
+
+By mounting your existing app router in this way, it will work as a catch-all handler for all HTTP requests and responses.
+
+#### 7. Run you app locally
+
+You will now be able to run your Express.js app locally using the `encore run` command.
+
+#### Next steps: Incrementally move over Encore.ts to get all the benefits
+
+You can now gradually break out specific endpoints using the Encore's [API declarations](#apis) and introduce infrastructure declarations for databases and cron jobs etc. This will let Encore.ts understand your application and unlock all Encore.ts features. See the [Feature-by-feature migration](#feature-by-feature-migration) section for more details. You will eventually be able to remove Express.js as a dependency and run your app entirely on Encore.ts.
+
+You can also [join Discord](https://encore.dev/discord) to ask questions and meet fellow Encore developers.
+
+#### Forklift example
+
+<div className="not-prose my-10">
+   <Editor projectName="expressForklift" />
+</div>
+
+
+</Accordion>
+
+
+<Accordion>
+
+### Full migration
+
+This approach aims to fully replace your applications dependency on Express.js with Encore.ts, unlocking all the features and performance of Encore.ts.
+
+Below are two examples that you can use to identify the refactoring you will need to do. In the next section you will find a [Feature-by-feature migration](#feature-by-feature-migration) guide to help you with the refactoring details.
+
+**Approach benefits**
+
+- Get all the advantages of Encore.ts, like [distributed tracing](/docs/ts/observability/tracing) and [architecture diagrams](/docs/ts/observability/flow), which rely on the [Encore application model](/docs/ts/concepts/application-model).
+- Get the [full performance benefit](https://encore.dev/blog/event-loops) of Encore.ts - **9x faster** than Express.js.
+
+**Approach drawbacks**
+
+- This approach may require more time and effort up front compared to the [Incremental migration strategy](#incremental-migration-strategy).
+
+#### App comparison
+
+Here is a side-by-side comparison of an Express.js app and an Encore.ts app. The examples show how to create APIs, handle request validation, error handling, serving static files, and rendering templates.
+
+**Express.js**
+
+<div className="not-prose my-10">
+   <Editor projectName="expressVsEncore" />
+</div>
+
+**Encore.ts**
+
+<div className="not-prose my-10">
+   <Editor projectName="encoreVsExpress" />
+</div>
+
+</Accordion>
+
+## Feature-by-feature migration
+
+Check out our [Express.js compared to Encore.ts example](https://github.com/encoredev/examples/tree/main/ts/expressjs-migration) on GitHub for all of the code snippets in this feature comparison.
+
+<Accordion>
+
+### APIs
+
+With Express.js, you create APIs using the `app.get`, `app.post`, `app.put`, `app.delete` functions. These functions
+take a path and a callback function. You then use the `req` and `res` objects to handle the request and response.
+
+With Encore.ts, you create APIs using the `api` function. This function takes an options object and a callback function.
+The main difference compared to Express.js is that Encore.ts is type-safe, meaning you define the request and response
+schemas in the callback function. You then return an object matching the response schema. In case you need to operate at
+a lower abstraction level, Encore supports defining raw endpoints that let you access the underlying HTTP request.
+Learn more in the [API Schemas docs](/docs/ts/primitives/defining-apis#api-schemas).
+
+**Express.js**
+
+```typescript
+import express, {Request, Response} from "express";
+
+const app: Express = express();
+
+// GET request with dynamic path parameter
+app.get("/hello/:name", (req: Request, res: Response) => {
+  const msg = `Hello ${req.params.name}!`;
+  res.json({message: msg});
+})
+
+// GET request with query string parameter
+app.get("/hello", (req: Request, res: Response) => {
+  const msg = `Hello ${req.query.name}!`;
+  res.json({message: msg});
+});
+
+// POST request example with JSON body
+app.post("/order", (req: Request, res: Response) => {
+  const price = req.body.price;
+  const orderId = req.body.orderId;
+  // Handle order logic
+  res.json({message: "Order has been placed"});
+});
+```
+
+**Encore.ts**
+
+```typescript
+import {api, Query} from "encore.dev/api";
+
+// Dynamic path parameter :name
+export const dynamicPathParamExample = api(
+  {expose: true, method: "GET", path: "/hello/:name"},
+  async ({name}: { name: string }): Promise<{ message: string }> => {
+    const msg = `Hello ${name}!`;
+    return {message: msg};
+  },
+);
+
+interface RequestParams {
+  // Encore will now automatically parse the query string parameter
+  name?: Query<string>;
+}
+
+// Query string parameter ?name
+export const queryStringExample = api(
+  {expose: true, method: "GET", path: "/hello"},
+  async ({name}: RequestParams): Promise<{ message: string }> => {
+    const msg = `Hello ${name}!`;
+    return {message: msg};
+  },
+);
+
+interface OrderRequest {
+  price: string;
+  orderId: number;
+}
+
+// POST request example with JSON body
+export const order = api(
+  {expose: true, method: "POST", path: "/order"},
+  async ({price, orderId}: OrderRequest): Promise<{ message: string }> => {
+    // Handle order logic
+    console.log(price, orderId)
+
+    return {message: "Order has been placed"};
+  },
+);
+
+// Raw endpoint
+export const myRawEndpoint = api.raw(
+  {expose: true, path: "/raw", method: "GET"},
+  async (req, resp) => {
+    resp.writeHead(200, {"Content-Type": "text/plain"});
+    resp.end("Hello, raw world!");
+  },
+);
+```
+
+</Accordion>
+
+<Accordion>
+
+### Microservices communication
+
+Express.js does not have built-in support for creating microservices or for service-to-service communication. You will most likely use
+`fetch` or something equivalent to call another service.
+
+With Encore.ts, calling another service is just like calling a local function, with complete type-safety. Under the hood, Encore.ts will translate this function call into an actual service-to-service HTTP call, resulting in trace data being generated for each call.
+Learn more in our [Service-to-Service Communication docs](/docs/ts/primitives/app-structure#multi-service-application-distributed-system).
+
+**Express.js**
+
+```typescript
+import express, {Request, Response} from "express";
+
+const app: Express = express();
+
+app.get("/save-post", async (req: Request, res: Response) => {
+  try {
+    // Calling another service using fetch
+    const resp = await fetch("https://another-service/posts", {
+      method: "POST",
+      headers: {"Content-Type": "application/json"},
+      body: JSON.stringify({
+        title: req.query.title,
+        content: req.query.content,
+      }),
+    });
+    res.json(await resp.json());
+  } catch (e) {
+    res.status(500).json({error: "Could not save post"});
+  }
+});
+```
+
+**Encore.ts**
+
+```typescript
+import {api} from "encore.dev/api";
+import {anotherService} from "~encore/clients";
+
+export const microserviceCommunication = api(
+  {expose: true, method: "GET", path: "/call"},
+  async (): Promise<{ message: string }> => {
+    // Calling the foo endpoint in anotherService
+    const fooResponse = await anotherService.foo();
+
+    const msg = `Data from another service ${fooResponse.data}!`;
+    return {message: msg};
+  },
+);
+
+```
+
+</Accordion>
+
+
+<Accordion>
+
+### Authentication
+
+In Express.js you can create a middleware function that checks if the user is authenticated. You can then use this
+middleware function in your routes to protect them. You will have to specify the middleware function for each route that
+requires authentication.
+
+With Encore.ts, when an API is defined with `auth: true`, you must define an authentication handler in your application.
+The authentication handler is responsible for inspecting incoming requests to determine what user is authenticated.
+
+The authentication handler is defined similarly to API endpoints, using the `authHandler` function imported from
+`encore.dev/auth`. Like API endpoints, the authentication handler defines what request information it's interested in,
+in the form of HTTP headers, query strings, or cookies.
+
+If a request has been successfully authenticated, the API Gateway forwards the authentication data to the target
+endpoint. The endpoint can query the available auth data from the `getAuthData` function, available from the
+`~encore/auth`
+module.
+
+Learn more in our [Auth Handler docs](/docs/ts/develop/auth)
+
+**Express.js**
+
+```typescript
+import express, {NextFunction, Request, Response} from "express";
+
+const app: Express = express();
+
+// Auth middleware
+function authMiddleware(req: Request, res: Response, next: NextFunction) {
+  // TODO: Validate up auth token and verify that this is an authenticated user
+  const isInvalidUser = req.headers["authorization"] === undefined;
+
+  if (isInvalidUser) {
+    res.status(401).json({error: "invalid request"});
+  } else {
+    next();
+  }
+}
+
+// Endpoint that requires auth
+app.get("/dashboard", authMiddleware, (_, res: Response) => {
+  res.json({message: "Secret dashboard message"});
+});
+```
+
+**Encore.ts**
+
+```typescript
+import { api, APIError, Gateway, Header } from "encore.dev/api";
+import { authHandler } from "encore.dev/auth";
+import { getAuthData } from "~encore/auth";
+
+interface AuthParams {
+  authorization: Header<"Authorization">;
+}
+
+// The function passed to authHandler will be called for all incoming API call that requires authentication.
+export const myAuthHandler = authHandler(
+  async (params: AuthParams): Promise<{ userID: string }> => {
+    // TODO: Validate up auth token and verify that this is an authenticated user
+    const isInvalidUser = params.authorization === undefined;
+
+    if (isInvalidUser) {
+      throw APIError.unauthenticated("Invalid user ID");
+    }
+
+    return { userID: "user123" };
+  },
+);
+
+export const gateway = new Gateway({ authHandler: myAuthHandler });
+
+// Auth endpoint example
+export const dashboardEndpoint = api(
+  // Setting auth to true will require the user to be authenticated
+  { auth: true, method: "GET", path: "/dashboard" },
+  async (): Promise<{ message: string; userID: string }> => {
+    return {
+      message: "Secret dashboard message",
+      userID: getAuthData()!.userID,
+    };
+  },
+);
+```
+
+</Accordion>
+
+<Accordion>
+
+### Request validation
+
+Express.js does not have built-in request validation. You have to use a library
+like [Zod](https://github.com/colinhacks/zod).
+
+With Encore.ts, request validation for headers, query params and body is. You supply a schema for the request object and
+in the request payload does not match the schema the API will return a 400 error.
+Learn more in the [API Schemas docs](/docs/ts/primitives/defining-apis#api-schemas).
+
+**Express.js**
+
+```typescript
+import express, {NextFunction, Request, Response} from "express";
+import {z, ZodError} from "zod";
+
+const app: Express = express();
+
+// Request validation middleware
+function validateData(schemas: {
+  body: z.ZodObject<any, any>;
+  query: z.ZodObject<any, any>;
+  headers: z.ZodObject<any, any>;
+}) {
+  return (req: Request, res: Response, next: NextFunction) => {
+    try {
+      // Validate headers
+      schemas.headers.parse(req.headers);
+
+      // Validate request body
+      schemas.body.parse(req.body);
+
+      // Validate query params
+      schemas.query.parse(req.query);
+
+      next();
+    } catch (error) {
+      if (error instanceof ZodError) {
+        const errorMessages = error.errors.map((issue: any) => ({
+          message: `${issue.path.join(".")} is ${issue.message}`,
+        }));
+        res.status(400).json({error: "Invalid data", details: errorMessages});
+      } else {
+        res.status(500).json({error: "Internal Server Error"});
+      }
+    }
+  };
+}
+
+// Request body validation schemas
+const bodySchema = z.object({
+  someKey: z.string().optional(),
+  someOtherKey: z.number().optional(),
+  requiredKey: z.array(z.number()),
+  nullableKey: z.number().nullable().optional(),
+  multipleTypesKey: z.union([z.boolean(), z.number()]).optional(),
+  enumKey: z.enum(["John", "Foo"]).optional(),
+});
+
+// Query string validation schemas
+const queryStringSchema = z.object({
+  name: z.string().optional(),
+});
+
+// Headers validation schemas
+const headersSchema = z.object({
+  "x-foo": z.string().optional(),
+});
+
+// Request validation example using Zod
+app.post(
+  "/validate",
+  validateData({
+    headers: headersSchema,
+    body: bodySchema,
+    query: queryStringSchema,
+  }),
+  (_: Request, res: Response) => {
+    res.json({message: "Validation succeeded"});
+  },
+);
+```
+
+**Encore.ts**
+
+```typescript
+import {api, Header, Query} from "encore.dev/api";
+
+enum EnumType {
+  FOO = "foo",
+  BAR = "bar",
+}
+
+// Encore.ts automatically validates the request schema and returns and error
+// if the request does not match the schema.
+interface RequestSchema {
+  foo: Header<"x-foo">;
+  name?: Query<string>;
+
+  someKey?: string;
+  someOtherKey?: number;
+  requiredKey: number[];
+  nullableKey?: number | null;
+  multipleTypesKey?: boolean | number;
+  enumKey?: EnumType;
+}
+
+// Validate a request
+export const schema = api(
+  {expose: true, method: "POST", path: "/validate"},
+  (data: RequestSchema): { message: string } => {
+    console.log(data);
+    return {message: "Validation succeeded"};
+  },
+);
+```
+
+</Accordion>
+
+<Accordion>
+
+### Error handling
+
+In Express.js you either throw an error (which results in a 500 response) or use the `status` function to set the status
+code of the response.
+
+In Encore.ts throwing an error will result in a 500 response. You can also use the `APIError` class to return specific
+error codes. Learn more in our [API Errors docs](/docs/ts/primitives/errors).
+
+**Express.js**
+
+```typescript
+import express, {Request, Response} from "express";
+
+const app: Express = express();
+
+// Default error handler
+app.get("/broken", (req, res) => {
+  throw new Error("BROKEN"); // This will result in a 500 error
+});
+
+// Returning specific error code
+app.get("/get-user", (req: Request, res: Response) => {
+  const id = req.query.id || "";
+  if (id.length !== 3) {
+    res.status(400).json({error: "invalid id format"});
+  }
+  // TODO: Fetch something from the DB
+  res.json({user: "Simon"});
+});
+```
+
+**Encore.ts**
+
+```typescript
+import {api, APIError} from "encore.dev/api"; // Default error handler
+
+// Default error handler
+export const broken = api(
+  {expose: true, method: "GET", path: "/broken"},
+  async (): Promise<void> => {
+    throw new Error("This is a broken endpoint"); // This will result in a 500 error
+  },
+);
+
+// Returning specific error code
+export const brokenWithErrorCode = api(
+  {expose: true, method: "GET", path: "/broken/:id"},
+  async ({id}: { id: string }): Promise<{ user: string }> => {
+    if (id.length !== 3) {
+      throw APIError.invalidArgument("invalid id format");
+    }
+    // TODO: Fetch something from the DB
+    return {user: "Simon"};
+  },
+);
+```
+
+</Accordion>
+
+<Accordion>
+
+### Serving static files
+
+Express.js has a built-in middleware function to serve static files. You can use the `express.static` function to serve
+files from a specific directory.
+
+Encore.ts also has built-in support for static file serving with the
+`api.static` method. The files are served directly from the Encore.ts Rust Runtime. This means that zero JavaScript code is executed to serve the files, freeing up the Node.js runtime to focus on executing business logic. This dramatically speeds up both the static file serving, as well as improving the latency of your API endpoints. Learn more in our [Static Assets docs](/docs/ts/primitives/static-assets).
+
+**Express.js**
+
+```typescript
+import express from "express";
+
+const app: Express = express();
+
+app.use("/assets", express.static("assets"));
+```
+
+**Encore.ts**
+
+```typescript
+import { api } from "encore.dev/api";
+
+export const assets = api.static(
+  { expose: true, path: "/assets/*path", dir: "./assets" },
+);
+```
+
+</Accordion>
+
+<Accordion>
+
+### Template rendering
+
+Express.js has a built-in support for rendering templates.
+
+With Encore.ts you can use the `api.raw` function to serve HTML templates, in this example we are using Handlebars.js
+but you can use whichever templating engine you prefer. Learn more in
+our [Raw Endpoints docs](/docs/ts/primitives/raw-endpoints)
+
+**Express.js**
+
+```typescript
+import express, {Request, Response} from "express";
+
+const app: Express = express();
+
+app.set("view engine", "pug"); // Set view engine to Pug
+
+// Template engine example. This will render the index.pug file in the views directory
+app.get("/html", (_, res) => {
+  res.render("index", {title: "Hey", message: "Hello there!"});
+});
+```
+
+**Encore.ts**
+
+```typescript
+import {api} from "encore.dev/api";
+import Handlebars from "handlebars";
+
+const html = `
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8"/>
+  <link rel="stylesheet" href="/assets/styles.css">
+</head>
+<body>
+<h1>Hello {{name}}!</h1>
+</body>
+</html>
+`;
+
+// Making use of raw endpoints to serve dynamic templates.
+// https://encore.dev/docs/ts/primitives/raw-endpoints
+export const serveHTML = api.raw(
+  {expose: true, path: "/html", method: "GET"},
+  async (req, resp) => {
+    const template = Handlebars.compile(html);
+
+    resp.setHeader("Content-Type", "text/html");
+    resp.end(template({name: "Simon"}));
+  },
+);
+```
+
+</Accordion>
+
+<Accordion>
+
+### Testing
+
+Express.js does not have built-in testing support. You can use libraries like [Vitest](https://vitest.dev/) and
+[Supertest](https://www.npmjs.com/package/supertest).
+
+With Encore.ts you are able to call the API endpoints directly in your tests, just like any other function. You then run
+the tests using the `encore test` command. Learn more in our [Testing docs](/docs/ts/develop/testing).
+
+**Express.js**
+
+```typescript
+import {describe, expect, test} from "vitest";
+import request from "supertest";
+import express from "express";
+import getRequestExample from "../get-request-example";
+
+/**
+ * We need to add the supertest library to make fake HTTP requests to the Express.js app without having to
+ * start the server. We also use the vitest library to write tests.
+ */
+describe("Express App", () => {
+  const app = express();
+  app.use("/", getRequestExample);
+
+  test("should respond with a greeting message", async () => {
+    const response = await request(app).get("/hello/John");
+    expect(response.status).to.equal(200);
+    expect(response.body).to.have.property("message");
+    expect(response.body.message).to.equal("Hello John!");
+  });
+});
+```
+
+**Encore.ts**
+
+```typescript
+import {describe, expect, test} from "vitest";
+import {dynamicPathParamExample} from "../get-request-example";
+
+// This test suite demonstrates how to test an Encore route.
+// Run tests using the `encore test` command.
+describe("Encore app", () => {
+  test("should respond with a greeting message", async () => {
+    // You can call the Encore.ts endpoint directly in your tests,
+    // just like any other function.
+    const resp = await dynamicPathParamExample({name: "world"});
+    expect(resp.message).toBe("Hello world!");
+  });
+});
+
+```
+
+</Accordion>
+
+<Accordion>
+
+### Database
+
+Express.js does not have built-in database support. You can use libraries like [pg-promise](https://www.npmjs.com/package/pg-promise) to connect to a
+PostgreSQL database but you also have to manage Docker Compose files for different environments.
+
+With Encore.ts, you create a database by importing `encore.dev/storage/sqldb` and calling
+`new SQLDatabase`, assigning the result to a top-level variable.
+
+Database schemas are defined by creating migration files. Each migration runs in order and expresses the change in the database schema from the previous migration.
+
+Encore.ts automatically provisions databases to match what your application requires. Encore.ts provisions databases in an appropriate way depending on the environment. When running locally, Encore creates a database cluster using Docker. In the cloud, it depends on the environment type:
+
+To query data, use the `.query` or
+`.queryRow` methods. To insert data, or to make database queryies that don't return any rows, use `.exec`.
+
+Learn more in our [Database docs](/docs/ts/primitives/databases).
+
+**Express.js**
+
+```typescript
+-- db.ts --
+import express, {Request, Response} from "express";
+import pgPromise from "pg-promise";
+
+const app: Express = express();
+
+// Connect to the DB with the credentials from docker-compose.yml
+const db = pgPromise()({
+  host: "localhost",
+  port: 5432,
+  database: "database",
+  user: "user1",
+  password: "user1@123",
+});
+
+interface User {
+  name: string;
+  id: number;
+}
+
+// Get one User from DB
+app.get("/user/:id", async (req: Request, res: Response) => {
+  const user = await db.oneOrNone<User>(
+    `
+        SELECT *
+        FROM users
+        WHERE id = $1
+    `,
+    req.params.id,
+  );
+
+  res.json({user});
+});
+-- docker-compose.yml --
+version: '3.8'
+
+services:
+  db:
+    build:
+      context: .
+      dockerfile: Dockerfile.postgis  # Use custom Dockerfile
+    restart: always
+    environment:
+      POSTGRES_USER: user1
+      POSTGRES_PASSWORD: user1@123
+      POSTGRES_DB: database
+    healthcheck:
+      # This command checks if the database is ready, right on the source db server
+      test: [ "CMD-SHELL", "pg_isready" ]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    ports:
+      - "5432:5432"
+    volumes:
+      - postgres_data_v:/var/lib/postgresql/data
+volumes:
+  postgres_data_v:
+-- Dockerfile.postgis --
+FROM postgres:latest
+
+# Install PostGIS extension
+RUN apt-get update \
+    && apt-get install -y postgis postgresql-12-postgis-3 \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# To execute some initial queries, we can write queries in init.sql
+COPY init.sql /docker-entrypoint-initdb.d/
+
+# Enable PostGIS extension
+RUN echo "CREATE EXTENSION IF NOT EXISTS postgis;" >> /docker-entrypoint-initdb.d/init.sqld
+```
+
+**Encore.ts**
+
+```typescript
+-- db.ts --
+import {api} from "encore.dev/api";
+import {SQLDatabase} from "encore.dev/storage/sqldb";
+
+// Define a database named 'users', using the database migrations in the "./migrations" folder.
+// Encore automatically provisions, migrates, and connects to the database.
+export const DB = new SQLDatabase("users", {
+  migrations: "./migrations",
+});
+
+interface User {
+  name: string;
+  id: number;
+}
+
+// Get one User from DB
+export const getUser = api(
+  {expose: true, method: "GET", path: "/user/:id"},
+  async ({id}: { id: number }): Promise<{ user: User | null }> => {
+    const user = await DB.queryRow<User>`
+        SELECT name
+        FROM users
+        WHERE id = ${id}
+    `;
+
+    return {user};
+  },
+);
+
+// Add User from DB
+export const addUser = api(
+  { expose: true, method: "POST", path: "/user" },
+  async ({ name }: { name: string }): Promise<void> => {
+    await DB.exec`
+        INSERT INTO users (name)
+        VALUES (${name})
+    `;
+    return;
+  },
+);
+-- migrations/1_create_tables.up.sql --
+CREATE TABLE users (
+    id SERIAL PRIMARY KEY,
+    name TEXT NOT NULL UNIQUE
+);
+```
+
+</Accordion>
+
+<Accordion>
+
+### Logging
+
+Express.js does not have built-in support for logging. You can use libraries like [Winston](https://www.npmjs.com/package/winston) to log messages.
+
+Encore.ts offers built-in support for Structured Logging, which combines a free-form log message with structured and type-safe key-value pairs. Logging is integrated with the built-in [Distributed Tracing](/docs/ts/observability/tracing) functionality, and all logs are automatically included in the active trace.
+
+**Encore.ts**
+
+```typescript
+import log from "encore.dev/log";
+
+log.error(err, "something went terribly wrong!");
+log.info("log message", {is_subscriber: true});
+```
+
+</Accordion>
+
diff --git a/docs/ts/migration/migrate-away.md b/docs/ts/migration/migrate-away.md
new file mode 100644
index 0000000000..7bbc76b8f7
--- /dev/null
+++ b/docs/ts/migration/migrate-away.md
@@ -0,0 +1,57 @@
+---
+title: Migrate away from Encore
+subtitle: If you love someone, set them free.
+lang: ts
+---
+
+_We realize most people read this page before even trying Encore, so we start with a perspective on how you might reason about adopting Encore. Read on to see what tools are available for migrating away._
+
+Picking technologies for your project is an important decision. It's tricky because you don't know what the requirements are going to look like in the future. This uncertainty makes many teams opt for maximum flexibility, often without acknowledging this has a significant negative effect on productivity.
+
+When designing Encore, we've leaned on standardization to provide a well-integrated and highly productive development workflow. The design is based on the core team's experience building scalable distributed systems at Spotify and Google, complemented with loads of invaluable input from the developer community. 
+
+In practise Encore is opinionated only in certain areas which are critical for enabling the static analysis used to create Encore's application model. This is fundamental to how Encore can provide its powerful features, like automatically instrumenting distributed tracing, and provisioning and managing cloud infrastructure.
+
+## Accommodating for your unique requirements
+
+Many software projects end up having a few novel requirements, which are highly specific to the problem domain. To accommodate for this, Encore is designed to let you go outside of the standardized Backend Framework when you need to, for example:
+- You can drop down in abstraction level in the API framework using [raw endpoints](/docs/ts/primitives/defining-apis#raw-endpoints)
+- You can use tools like the [Terraform provider](/docs/platform/integrations/terraform) to integrate infrastructure that is not managed by Encore
+
+## Mitigating risk through Open Source and efficiency
+
+We believe that adopting Encore is a low-risk decision for several reasons:
+
+- There's no upfront investment needed to get the benefits
+- Encore apps are normal programs where less than 1% of the code is Encore-specific
+- All infrastructure and data is in your own cloud
+- It's simple to integrate with cloud services and systems not natively supported by Encore
+- Everything you need to develop your application is Open Source, including the [parser](https://github.com/encoredev/encore/tree/main/v2/parser), [compiler](https://github.com/encoredev/encore/tree/main/v2/compiler), [runtime](https://github.com/encoredev/encore/tree/main/runtimes)
+- Everything you need to self-host your application is [Open Source and documented](/docs/ts/self-host/build)
+
+## What to expect when migrating away
+
+If you want to migrate away, we want to ensure this is as smooth as possible! Here are some of the ways Encore is designed to keep your app portable, with minimized lock-in, and the tools provided to aid in migrating away.
+
+### Code changes
+
+Building with Encore doesn't require writing your entire application in an Encore-specific way. Encore applications are normal programs where only 1% of the code is specific to Encore's Open Source Backend Framework.
+
+This means that the changes required to stop using the Backend Framework is almost exactly the same work you would have needed to do if you hadn't used Encore in the first place, e.g. writing infrastructure boilerplate. There is no added migration cost.
+
+### Deployment
+
+If you are self-hosting your application, then you're already done.
+
+If you are using Encore Cloud to manage deployments and want to migrate to your own solution, you can use the [self-hosting instructions](/docs/ts/self-host/build) and Open Source CLI tooling. The `encore build docker` command produces a Docker image, containing the compiled application, using exactly the same code path as Encore's CI system to ensure compatibility.
+
+Learn more in the [self-hosting docs](/docs/ts/self-host/build).
+
+### Tell us what you need
+
+We're engineers ourselves and we understand the importance of not being constrained by a single technology.
+
+We're working every single day on making it even easier to start, <i>and stop</i>, using Encore.
+If you have specific concerns, questions, or requirements, we'd love to hear from you!
+
+Please reach out on [Discord](https://encore.dev/discord) or [send an email](mailto:hello@encore.dev) with your thoughts.
diff --git a/docs/ts/observability/dev-dash.md b/docs/ts/observability/dev-dash.md
new file mode 100644
index 0000000000..bae3fbc0be
--- /dev/null
+++ b/docs/ts/observability/dev-dash.md
@@ -0,0 +1,29 @@
+---
+seotitle: Development dashboard for local development
+seodesc: Encore's Local Development Dashboard comes with build-in distributed tracing, API docs, and real-time architecture diagrams.
+title: Local Development Dashboard
+subtitle: Built-in tools for simplicity and productivity
+lang: ts
+---
+
+Encore provides an efficient local development workflow that automatically provisions [local infrastructure](/docs/platform/infrastructure/infra#local-development) and supports automated testing with dedicated test infrastructure.
+
+The local environment also comes with a built-in Local Development Dashboard to simplify development and improve productivity. It has several features to help you design, develop, and debug your application:
+
+* [Service Catalog](/docs/ts/observability/service-catalog) with Automatic API Documentation
+* API Explorer to call your APIs
+* [Distributed Tracing](/docs/ts/observability/tracing) for simple and powerful debugging
+* [Encore Flow](/docs/develop/encore-flow) for visualizing your microservices architecture
+
+All these features update in real-time as you make changes to your application.
+
+To access the dashboard, start your Encore application with `encore run` and it will open automatically. You can also follow the link in your terminal:
+
+```bash
+$ encore run
+API Base URL:      http://localhost:4000
+Dev Dashboard URL: http://localhost:9400/hello-world-cgu2
+```
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/localdashvideo.mp4" className="w-full h-full" type="video/mp4" />
+</video>
diff --git a/docs/ts/observability/flow.md b/docs/ts/observability/flow.md
new file mode 100644
index 0000000000..50e9067185
--- /dev/null
+++ b/docs/ts/observability/flow.md
@@ -0,0 +1,50 @@
+---
+seotitle: Encore Flow automatic microservices architecture diagrams
+seodesc: Visualize your microservices architecture automatically using Encore Flow. Get real-time interactive architecture diagrams for your entire application.
+title: Flow Architecture Diagram
+subtitle: Visualize your cloud microservices architecture
+lang: ts
+---
+
+Flow is a visual tool that gives you an always up-to-date view of your entire system, helping you reason about your
+microservices architecture and identify which services depend on each other and how they work together.
+
+## Birds-eye view
+
+Having access to a zoomed out representation of your system can be invaluable in pretty much all parts of the
+development cycle. Flow helps you:
+
+* Track down bottlenecks before they grow into big problems.
+* Get new team members onboarded much faster.
+* Pinpoint hot paths in your system, services that might need extra attention.
+
+Services and PubSub topics are represented as boxes, arrows indicate a dependency. In the example below
+the `login` service has dependencies on the `user` and `authentication` services. Dashed arrows shows publications or
+subscriptions to a topic. Here, `payment` publishes to the `payment-made` topic and `email` subscribe to it:
+
+<img src="/assets/docs/flow-diagram.png" title="Encore Flow - Highlight Dependencies" />
+
+## Highlight dependencies
+
+Hover over a service, or PubSub topic, to instantly reveal the nature and scale of its dependencies.
+
+Here the `login` service and its dependencies are highlighted. We can see that `login` makes queries to the
+database and requests to two of the endpoints from the `user` service as well as requests to one endpoint from
+the `authentication` service:
+
+<img src="/assets/docs/flow-highlight.png" title="Encore Flow - Highlight Dependencies" />
+
+## Real-time updates
+
+Flow is accessible in the [Local Development Dashboard](/docs/ts/observability/dev-dash) and the [Encore Cloud dashboard](https://app.encore.cloud) for cloud environments.
+
+When developing locally, Flow will auto update in real-time to reflect your architecture as you
+make code changes. This helps you be mindful of important dependencies and makes it clear if you introduce new ones.
+
+For cloud environments, Flow auto-updates with each deploy.
+
+In the example below a new subscription on the topic `payment-made` is introduced and then removed in `user` service:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/flow-auto-update.mp4" className="w-full h-full" type="video/mp4" />
+</video>
diff --git a/docs/ts/observability/logging.md b/docs/ts/observability/logging.md
new file mode 100644
index 0000000000..624170436b
--- /dev/null
+++ b/docs/ts/observability/logging.md
@@ -0,0 +1,40 @@
+---
+seotitle: Use structured logging to understand your application
+seodesc: Learn how to use structured logging, a combination of free-form log messages and type-safe key-value pairs, to understand your backend application's behavior.
+title: Logging
+subtitle: Structured logging helps you understand your application
+lang: ts
+infobox: {
+  title: "Structured Logging",
+  import: "encore.dev/log",
+}
+---
+
+Encore offers built-in support for Structured Logging, which combines a free-form log message with structured and type-safe key-value pairs. This enables straightforward analysis of what your application is doing, in a way that is easy for a computer to parse, analyze, and index. This makes it simple to quickly filter and search through logs.
+
+Encore’s logging is integrated with the built-in [Distributed Tracing](/docs/ts/observability/tracing) functionality, and all logs are automatically included in the active trace. This dramatically simplifies debugging of your application.
+
+## Usage
+First, add `import log  from "encore.dev/log";` to your module. Then call one of the logging functions `error`, `warn`, `info`, `debug`, or `trace` to emit a log message. For example:
+
+```ts
+log.info("log message", {is_subscriber: true})
+log.error(err, "something went terribly wrong!")
+```
+
+The first parameter is the log message (or optionally an error for the error function) . After that follows a single object with key-value pairs for structured logging.
+
+If you’re logging many log messages with the same key-value pairs each time it can be a bit cumbersome. To help with that, use `log.with()` to group them into a Logger object, which then copies the key-value pairs into each log event:
+
+```ts
+const logger = log.with({is_subscriber: true})
+logger.info("user logged in", {login_method: "oauth"}) // includes is_subscriber=true
+```
+
+## Live-streaming logs
+
+Encore also makes it simple to live-stream logs directly to your terminal, from any environment, by running:
+
+```
+$ encore logs --env=prod
+```
diff --git a/docs/ts/observability/service-catalog.md b/docs/ts/observability/service-catalog.md
new file mode 100644
index 0000000000..3b61a7d471
--- /dev/null
+++ b/docs/ts/observability/service-catalog.md
@@ -0,0 +1,17 @@
+---
+seotitle: Service Catalog & Generated API Docs
+seodesc: See how Encore automatically generates API documentation that always stays up to date and in sync.
+title: Service Catalog
+subtitle: Automatically get a Service Catalog and complete API docs
+lang: ts
+---
+
+All developers agree API documentation is great to have, but the effort of maintaining it inevitably leads to docs becoming stale and out of date.
+
+To solve this, Encore uses the [Encore Application Model](/docs/ts/concepts/application-model) to automatically generate a Service Catalog along with complete documentation for all APIs. This ensures docs are always up-to-date as your APIs evolve.
+
+The API docs are available both in your [Local Development Dashboard](/docs/ts/observability/dev-dash) and for your whole team in the [Encore Cloud dashboard](https://app.encore.cloud).
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/servicecatalogvideo.mp4" className="w-full h-full" type="video/mp4" />
+</video>
diff --git a/docs/ts/observability/tracing.md b/docs/ts/observability/tracing.md
new file mode 100644
index 0000000000..2bb10cef16
--- /dev/null
+++ b/docs/ts/observability/tracing.md
@@ -0,0 +1,39 @@
+---
+seotitle: Distributed Tracing helps you understand your app
+seodesc: See how to use distributed tracing in your backend application, across multiple services, using Encore.
+title: Distributed Tracing
+subtitle: Track requests across your application and infrastructure
+lang: ts
+---
+
+Distributed systems often have many moving parts, making it difficult to understand what your code is doing and finding the root-cause to bugs. That’s where Tracing comes in. If you haven’t seen it before, it may just about change your life.
+
+Tracing is a revolutionary way to gain insight into what your applications are doing. It works by capturing the series of events as they occur during the execution of your code (a “trace”). This works by propagating a trace id between all individual systems, then correlating and joining the information together to present a unified picture of what happened end-to-end.
+
+As opposed to the labor intensive instrumentation you'd normally need to go through to use tracing, Encore automatically captures traces for your entire application – in all environments. Uniquely, this means you can use tracing even for local development to help debugging and speed up iterations.
+
+You view traces in the [Local Development Dashboard](/docs/ts/observability/dev-dash) and in the [Encore Cloud dashboard](https://app.encore.cloud) for Production and other environments.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+	<source src="/assets/docs/tracingvideo.mp4" className="w-full h-full" type="video/mp4" />
+</video>
+
+## Encore's tracing is more comprehensive and more performant than all other tools
+
+Unlike other tracing solutions, Encore understands what each trace event is and captures unique insights about each one. This means you get access to more information than ever before:
+
+* Stack traces
+* Structured logging
+* HTTP requests
+* Network connection information
+* API calls
+* Database queries
+* etc.
+
+## Redacting sensitive data
+
+Encore's tracing automatically captures request and response payloads to simplify debugging.
+
+For cases where this is undesirable, such as for passwords or personally identifiable information (PII), Encore supports marking endpoints as sensitive. When an endpoint is marked as sensitive, the request and response details from that endpoint will be automatically redacted from the traces it produces.
+
+See the documentation on [API Schemas](/docs/ts/primitives/defining-apis#sensitive-data) for more information.
diff --git a/docs/ts/overview.md b/docs/ts/overview.md
new file mode 100644
index 0000000000..4a09f7d90a
--- /dev/null
+++ b/docs/ts/overview.md
@@ -0,0 +1,97 @@
+---
+seotitle: Start building backends using Encore.ts
+seodesc: Learn how Encore.ts works, and get to know the powerful features that help you build cloud backend applications easier than ever before.
+title: Encore.ts
+subtitle: Use Encore.ts to build production-ready backend applications and distributed systems
+toc: false
+lang: ts
+---
+
+<div className="min-h-72 bg-blue p-8 relative overflow-hidden not-prose">
+    <img className="absolute left-[55%] -mt-8 top-0 right-0 bottom-0 noshadow" src="/assets/img/dithered-clouds.png" />
+    <div className="w-[75%] lg:w-[75%]">
+        <h2 className="text-white lead-medium">Quick Start Guide</h2>
+        <div className="body-small text-white mt-2">
+            Dive right in and build your first Encore.ts application.
+        </div>
+        <a href="/docs/ts/quick-start">
+            <Button className="mt-4" kind="primary" section="black">Get started</Button>
+        </a>
+    </div>
+</div>
+
+Encore.ts is a high-performance API framework that helps you build robust, type-safe applications. It provides a declarative approach to working with essential backend infrastructure like microservices, databases, queues, caches, cron jobs, and storage buckets.
+
+The framework comes with a lot of built-in tooling for a smooth developer experience:
+
+1. **Local Environment Management**: Automatically sets up and runs your local development environment and all local infrastructure.
+2. **Enhanced Observability**: Comes with tools like a [Local Development Dashboard](/docs/ts/observability/dev-dash) and [tracing](/docs/ts/observability/tracing) for monitoring application behavior.
+3. **Automatic Documentation**: Generates and maintains [up-to-date documentation](/docs/ts/observability/service-catalog) for APIs and services, and created [architecture diagrams](/docs/ts/observability/flow) for your system.
+
+Optional: **DevOps Automation**: Encore provides an optional [Cloud Platform](/use-cases/devops-automation) for automating infrastructure provisioning and DevOps processes on AWS and GCP.
+
+<div className="mt-6 grid grid-cols-2 gap-6 mobile:grid-cols-1 not-prose">
+    <a className="block group relative no-brandient" target="_blank" href="https://www.youtube.com/watch?v=vvqTGfoXVsw">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Watch an intro video</h3>
+                <img className="-mt-2 h-16 w-16 noshadow" src="/assets/icons/features/preview-envs.png" />
+            </div>
+            <div className="mt-2">
+                Get to know the core concepts of Encore in this short video.
+            </div>
+        </div>
+    </a>
+    <a className="block group relative no-brandient" target="_blank" href="https://github.com/encoredev/examples">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Example apps</h3>
+                <img className="-mt-2 h-16 w-16 noshadow" src="/assets/icons/features/flow.png" />
+            </div>
+            <div className="mt-2">
+                Ready-made starter apps to inspire your development.
+            </div>
+        </div>
+    </a>
+    <a className="block group relative no-brandient" href="/discord">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Join Discord</h3>
+                <div className="inline-flex w-16 h-16 items-center justify-center">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 -28.5 256 256">
+                        <path fill="#111111"
+                            d="M216.856339,16.5966031 C200.285002,8.84328665 182.566144,3.2084988 164.041564,0 C161.766523,4.11318106 159.108624,9.64549908 157.276099,14.0464379 C137.583995,11.0849896 118.072967,11.0849896 98.7430163,14.0464379 C96.9108417,9.64549908 94.1925838,4.11318106 91.8971895,0 C73.3526068,3.2084988 55.6133949,8.86399117 39.0420583,16.6376612 C5.61752293,67.146514 -3.4433191,116.400813 1.08711069,164.955721 C23.2560196,181.510915 44.7403634,191.567697 65.8621325,198.148576 C71.0772151,190.971126 75.7283628,183.341335 79.7352139,175.300261 C72.104019,172.400575 64.7949724,168.822202 57.8887866,164.667963 C59.7209612,163.310589 61.5131304,161.891452 63.2445898,160.431257 C105.36741,180.133187 151.134928,180.133187 192.754523,160.431257 C194.506336,161.891452 196.298154,163.310589 198.110326,164.667963 C191.183787,168.842556 183.854737,172.420929 176.223542,175.320965 C180.230393,183.341335 184.861538,190.991831 190.096624,198.16893 C211.238746,191.588051 232.743023,181.531619 254.911949,164.955721 C260.227747,108.668201 245.831087,59.8662432 216.856339,16.5966031 Z M85.4738752,135.09489 C72.8290281,135.09489 62.4592217,123.290155 62.4592217,108.914901 C62.4592217,94.5396472 72.607595,82.7145587 85.4738752,82.7145587 C98.3405064,82.7145587 108.709962,94.5189427 108.488529,108.914901 C108.508531,123.290155 98.3405064,135.09489 85.4738752,135.09489 Z M170.525237,135.09489 C157.88039,135.09489 147.510584,123.290155 147.510584,108.914901 C147.510584,94.5396472 157.658606,82.7145587 170.525237,82.7145587 C183.391518,82.7145587 193.761324,94.5189427 193.539891,108.914901 C193.539891,123.290155 183.391518,135.09489 170.525237,135.09489 Z" />
+                    </svg>
+                </div>
+            </div>
+            <div className="mt-2">
+                Find answers, ask questions, and chat with other Encore developers.
+            </div>
+        </div>
+    </a>
+    <a className="block group relative no-brandient" href="https://github.com/encoredev/encore">
+        <div className="absolute inset-0 bg-black dark:bg-white -z-10" />
+        <div
+            className="min-h-full border border-black dark:border-white p-8 mobile:p-4 bg-white dark:bg-black transition-transform duration-100 ease-in-out group-active:-translate-x-2 group-active:-translate-y-2 group-hover:-translate-x-2 group-hover:-translate-y-2">
+            <div className="flex items-center justify-between">
+                <h3 className="body-small">Star on GitHub</h3>
+                <div className="inline-flex w-16 h-16 items-center justify-center">
+                    <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 16 16" fill="#111111"
+                        stroke="none">
+                        <path fillRule="evenodd"
+                            d="M8 0C3.58 0 0 3.58 0 8c0 3.54 2.29 6.53 5.47 7.59.4.07.55-.17.55-.38 0-.19-.01-.82-.01-1.49-2.01.37-2.53-.49-2.69-.94-.09-.23-.48-.94-.82-1.13-.28-.15-.68-.52-.01-.53.63-.01 1.08.58 1.23.82.72 1.21 1.87.87 2.33.66.07-.52.28-.87.51-1.07-1.78-.2-3.64-.89-3.64-3.95 0-.87.31-1.59.82-2.15-.08-.2-.36-1.02.08-2.12 0 0 .67-.21 2.2.82.64-.18 1.32-.27 2-.27.68 0 1.36.09 2 .27 1.53-1.04 2.2-.82 2.2-.82.44 1.1.16 1.92.08 2.12.51.56.82 1.27.82 2.15 0 3.07-1.87 3.75-3.65 3.95.29.25.54.73.54 1.48 0 1.07-.01 1.93-.01 2.2 0 .21.15.46.55.38A8.013 8.013 0 0016 8c0-4.42-3.58-8-8-8z" />
+                    </svg>
+                </div>
+            </div>
+            <div className="mt-2">
+                Get involved and star Encore on GitHub.
+            </div>
+        </div>
+    </a>
+</div>
diff --git a/docs/ts/primitives/api-calls.mdx b/docs/ts/primitives/api-calls.mdx
new file mode 100644
index 0000000000..ce3c7a05b7
--- /dev/null
+++ b/docs/ts/primitives/api-calls.mdx
@@ -0,0 +1,31 @@
+---
+seotitle: API Calls with Encore.ts
+seodesc: Learn how to make type-safe API calls in TypeScript with Encore.ts
+title: API Calls
+subtitle: Making API calls is as simple as making function calls
+lang: ts
+---
+
+Calling API endpoints between services, i.e. service-to-service calls, looks like regular function calls with Encore.ts. This gives you a simple monolith-like developer experience, even when you use multiple services.
+The only thing you need to do is import the service you want to call from `~encore/clients` and then call its API endpoints like functions.
+
+This works because, when compiling your application, Encore uses [static analysis](/docs/ts/concepts/application-model) to parse all APIs and make them available through the `~encore/clients` module for internal calls.
+You get all the benefits of function calls, like compile-time checking of all the parameters and auto-completion in your editor, while still allowing the division of code into logical components, services, and systems.
+
+### Example
+
+In the example below, we import the service `hello` and call the `ping` endpoint using a function call to `hello.ping`.
+
+```typescript
+import { hello } from "~encore/clients"; // import 'hello' service
+
+export const myOtherAPI = api({}, async (): Promise<void> => {
+  const resp = await hello.ping({ name: "World" });
+  console.log(resp.message); // "Hello World!"
+});
+```
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/simple-event-driven"
+    desc="Simple microservices example application with service-to-service API calls."
+/>
diff --git a/docs/ts/primitives/app-structure.md b/docs/ts/primitives/app-structure.md
new file mode 100644
index 0000000000..3674592710
--- /dev/null
+++ b/docs/ts/primitives/app-structure.md
@@ -0,0 +1,178 @@
+---
+seotitle: Structuring your microservices backend application
+seodesc: Learn how to structure your microservices backend application. See recommended app structures for monoliths, small microservices backends, and large scale microservices applications.
+title: App Structure
+subtitle: Structuring your Encore application
+lang: ts
+---
+
+Encore uses a monorepo design and it's best to use one Encore app for your entire backend application. This lets Encore build an application model that spans your entire app, necessary to get the most value out of many
+features like [distributed tracing](/docs/ts/observability/tracing) and [Encore Flow](/docs/ts/observability/flow).
+
+If you have a large application, see advice on how to [structure an app with several systems](#large-applications-with-several-systems).
+
+It's simple to integrate Encore applications with pre-existing systems you might have, using APIs and built-in tools like [client generation](/docs/ts/cli/client-generation). See more on how to approach building new functionality incrementally with Encore in the [migrating to Encore](/docs/platform/migration/migrate-to-encore) documentation.
+
+## Monolith or Microservices
+
+Encore is not opinionated about monoliths vs. microservices. It does however let you build microservices applications with a monolith-style developer experience. For example, you automatically get IDE auto-complete when making [API calls between services](/docs/ts/primitives/api-calls), along with cross-service type-safety.
+
+When creating a cloud environment on AWS/GCP, Encore enables you to configure if you want to combine multiple services into one process or keep them separate. This can be useful for improved efficiency at smaller scales, and for co-locating services for increased performance. Learn more in the [environments documentation](/docs/platform/deploy/environments).
+
+## Defining services
+
+To create an Encore service, add a file named `encore.service.ts` in a directory.
+
+The file must export a service instance, by calling `new Service`, imported from `encore.dev/service`.
+
+For example:
+
+```ts
+
+import { Service } from "encore.dev/service";
+
+export default new Service("my-service");
+```
+
+That's it! Encore will consider this directory and all its subdirectories as part of the service.
+
+Within the service, you can then [define APIs](/docs/ts/primitives/defining-apis) and use infrastructure resources like querying databases.
+
+<RelatedDocsLink paths={["/docs/ts/primitives/services", "/docs/ts/primitives/defining-apis"]} />
+
+## Examples
+
+Let's take a look at a few different approaches to structuring your Encore application, depending on the size and complexity of your application.
+
+### Single-service application
+
+The best place to start, especially if you're new to Encore, is by having
+a single service in your application. Once you've familiarized yourself with
+the Encore development model, it's easy to break it up into multiple services.
+
+The best way to do this is by defining the `encore.service.ts` in the root
+of your project, next to the `package.json` file.
+
+On disk it might look like this (but feel free to change as you see fit):
+
+```
+/my-app
+├── package.json
+├── encore.app
+├──  // ... other project files
+│
+├── encore.service.ts    // defines your service root
+├── api.ts               // API endpoints
+├── db.ts                // Database definition
+```
+
+Services can have subdirectories, so as the complexity of your service grows
+you can add subdirectories as you see fit, to better organize the code base.
+
+### Multi-service application (Distributed System)
+
+For larger applications it's often useful to break it apart into multiple
+services. This helps improve reliability, scalability, and lead to clearer
+code organization.
+
+Encore makes it easy to structure your application as multiple services.
+
+Just like before, you add an `encore.service.ts` file to mark a directory
+(and its subdirectories) as a service.
+
+
+<Callout type="info">
+Note that services cannot be nested: each must be defined in its own directory,
+and cannot live in a subdirectory of another service.
+
+If you have a single-service project with a `encore.service.ts` file at the top-level directory of your project, and you want to break it apart, start by moving that service code into a subdirectory.
+</Callout>
+
+On disk it might look like this:
+
+```
+/my-app
+├── encore.app                       // ... and other top-level project files
+│
+├── hello                            // hello service (directory)
+│   ├── migrations                   // hello service db migrations (directory)
+│   │   └── 1_create_table.up.sql    // hello service db migration
+│   ├── encore.service.ts            // hello service definition
+│   ├── hello.ts                     // hello service APIs
+│   └── hello_test.ts                // tests for hello service
+│
+└── world                            // world service (directory)
+│   ├── encore.service.ts            // world service definition
+    └── world.ts                     // world service APIs
+```
+
+### Large applications with several systems
+
+If you have a large application with several logical domains, each consisting of multiple services, it can be practical
+to separate these into distinct systems.
+
+Systems are not a special construct in Encore, they only help you divide your application logically around common concerns and purposes. Encore only handles services, the compiler will read your
+systems and extract the services of your application. As applications grow, systems help you decompose your application
+without requiring any complex refactoring.
+
+To create systems, simply create a sub-directory for each system and put the relevant service packages within it.
+
+As an example, a company building a Trello app might divide their application into three systems: the **Trello** system
+(for the end-user facing app with boards and cards), the **User** system (for user and organization management), and
+the **Premium** system (for handling payments and subscriptions).
+
+On disk it might look like this:
+
+```
+/my-trello-clone
+├── encore.app
+├── package.json                // ... and other top-level project files
+│
+├── trello                      // trello system (a directory)
+│   ├── board                   // board service (a directory)
+│   │   ├── encore.service.ts   // service definition
+│   │   └── board.ts            // service code
+│   │
+│   └── card                    // card service (a directory)
+│       ├── encore.service.ts   // service definition
+│       └── card.ts             // service code
+│
+├── premium                     // premium system (a directory)
+│   ├── payment                 // payment service (a directory)
+│   │   ├── encore.service.ts   // service definition
+│   │   └── payment.ts          // service code
+│   │
+│   └── subscription            // subscription service (a directory)
+│       ├── encore.service.ts   // service definition
+│       └── subscription.ts     // service code
+│
+└── usr                         // usr system (a directory)
+    ├── org                     // org service (a directory)
+    │   ├── encore.service.ts   // service definition
+    │   └── org.ts              // service code
+    │
+    └── user                    // user service (a directory)
+        ├── encore.service.ts   // service definition
+        └── user.ts             // service code
+```
+
+The only refactoring needed to divide an existing Encore application into systems is to move services into their respective
+subfolders. This is a simple way to separate the specific concerns of each system. What matters for Encore are the packages containing services, and the division in systems or subsystems will not change the endpoints or
+architecture of your application.
+
+## Package Management
+
+For Encore.ts projects, using a single root-level `package.json` file (monorepo approach) is the recommended practice.
+It has several benefits:
+
+- Ensures consistent dependency versions across your services
+- Simplifies TypeScript configuration management
+- Makes it easier to share common types and utilities
+- Reduces npm install overhead
+- Works seamlessly with TypeScript's project references
+
+Encore.ts also supports separate `package.json` files in sub-packages, with the following limitations:
+- The Encore.ts application must use one package with a single `package.json` file
+- Other separate packages must be pre-transpiled to JavaScript
+
+Further package management options are planned for the future, particularly for supporting automatically transpiling and bundling workspace packages.
diff --git a/docs/ts/primitives/cookies.mdx b/docs/ts/primitives/cookies.mdx
new file mode 100644
index 0000000000..ae063e6b61
--- /dev/null
+++ b/docs/ts/primitives/cookies.mdx
@@ -0,0 +1,188 @@
+---
+seotitle: Using Cookies in Encore.ts API Endpoints
+seodesc: Learn how to work with cookies in your TypeScript backend applications built with Encore.ts
+title: Working with Cookies
+subtitle: Type-safe cookie handling for web applications
+lang: ts
+---
+
+Encore.ts provides type-safe cookie handling for your API endpoints. Cookies are commonly used for session management, personalization, and tracking. This guide explains how to use cookies in different contexts within your Encore.ts application.
+
+## Where Cookies Can Be Used
+
+Cookies can be utilized in three main contexts within Encore.ts:
+
+1. **Auth handler parameters**: Access cookies during authentication
+2. **Response cookies**: Set cookies to be sent back to clients
+3. **Request cookies**: Access cookies sent by clients
+
+## Using Cookies in Auth Handlers
+
+Cookies can be used in authentication handlers:
+
+```ts
+import { Cookie, Gateway } from "encore.dev/api";
+import { authHandler } from "encore.dev/auth";
+
+// Define auth parameters with cookies
+interface AuthParams {
+  sessionId: Cookie<"sessionId">;
+}
+
+// Auth handler that uses cookies
+const auth = authHandler<AuthParams, User>(async ({ sessionId }) => {
+  return validateAndGetUser(sessionId.value);
+});
+
+// Configure the gateway with the auth handler
+export const gateway = new Gateway({
+  authHandler: auth,
+});
+```
+
+## Setting Cookies in Responses
+
+You can set cookies in your API responses by including them in your response type:
+
+```ts
+import { api, Cookie } from "encore.dev/api";
+
+// Define a response type with a cookie
+interface LoginResponse {
+  user: UserData;
+  sessionId: Cookie<"sessionId">;
+}
+
+// Create an API endpoint that sets a cookie
+export const login = api<LoginParams, LoginResponse>({
+  method: "POST",
+  path: "/login",
+  expose: true,
+}, async (params): Promise<LoginResponse> => {
+  // Authenticate user
+  const user = await authenticateUser(params.username, params.password);
+  const sessionId = generateSessionId();
+
+  // Store session
+  await storeSession(sessionId, user.id);
+
+  // Return response with cookie
+  return {
+    user,
+    sessionId: {
+      value: sessionId,
+      httpOnly: true,
+      secure: true,
+      sameSite: "Strict",
+      maxAge: 60 * 60 * 24 * 7, // 7 days
+    }
+  };
+});
+```
+
+## Using Cookies in Requests
+
+When creating API endpoints, you can access cookies sent by the client by defining them in your parameter type:
+
+```ts
+import { api } from "encore.dev/api";
+
+// Define a request type with a cookie
+interface Params {
+  language?: Cookie<"language">;
+}
+
+// Create an API endpoint that uses the cookie
+export const get = api<Params, { msg: string }>(
+  {
+    method: "GET",
+    path: "/user/profile",
+    expose: true,
+  },
+  async ({ language }) => {
+    // Access the cookie value
+    const lang = language?.value ?? "en";
+    return { msg: `your language: ${lang}` };
+  },
+);
+```
+
+## Typed Cookie Values
+
+Encore.ts allows you to specify the type of cookie values for improved type safety. By default, cookie values are strings, but you can define cookies with different data types. If you omit the type parameter, Encore.ts will automatically use `string` as the type.
+
+### Available Cookie Types
+
+You can use the following types for cookie values:
+
+- `string`: Text data (default when generic parameter is omitted)
+- `number`: Numeric values
+- `boolean`: True/false values
+- `Date`: Date objects
+
+### How to Specify Cookie Types
+
+When defining cookies, you can specify the type using the generic parameter:
+
+```ts
+interface UserPreferences {
+  // Cookies with different types
+  userId: Cookie<number, "userId">;
+  darkMode: Cookie<boolean, "darkMode">;
+  lastVisit: Cookie<Date, "lastVisit">;
+  language: Cookie<string, "language">;
+  // Using omitted type parameter (implicitly string)
+  theme: Cookie<"theme">;
+}
+
+export const savePreferences = api<UserPreferences, void>({
+  method: "POST",
+  path: "/user/preferences",
+  expose: true,
+}, async (params) => {
+  // Type-safe access to cookie values
+  const userId = params.userId.value; // number
+  const isDarkMode = params.darkMode.value; // boolean
+  const lastVisit = params.lastVisit.value; // Date
+  const language = params.language.value; // string
+  const theme = params.theme.value; // string (implicitly typed)
+
+  // Save preferences...
+});
+```
+
+## Cookie Options
+
+When setting cookies, you can configure various options:
+
+- **expires**: Sets an expiration date
+- **maxAge**: Sets the cookie lifetime in seconds
+- **domain**: Specifies which domains can receive the cookie
+- **path**: Limits the cookie to a specific path
+- **secure**: Only sends the cookie over HTTPS
+- **httpOnly**: Makes the cookie inaccessible to JavaScript
+- **sameSite**: Controls when cookies are sent with cross-site requests
+  - `"Strict"`: Only sent in same-site requests
+  - `"Lax"`: Sent with same-site requests and top-level navigations
+  - `"None"`: Sent with all requests (requires `secure: true`)
+- **partitioned**: Creates a partitioned cookie using the CHIPS model
+
+## Generated client
+
+The generated Encore.ts client does not explicitly handle cookies. Instead, it relies on the browser's built-in cookie handling. When using the client in browser environments, cookies will be automatically included in requests and stored from responses.
+
+For cross-site requests, you need to configure the client to include credentials:
+
+```ts
+// Create a client that includes credentials (cookies) for cross-site requests
+const client = new Client(Local, { requestInit: { credentials: "include" } });
+```
+
+## Best Practices
+
+1. Use `httpOnly: true` for cookies containing sensitive data
+2. Set `secure: true` for production environments
+3. Configure appropriate `sameSite` settings based on your requirements
+4. Use the `maxAge` or `expires` options to limit cookie lifetime
+
+By following these guidelines, you can effectively leverage cookies in your Encore.ts applications while maintaining security and type safety.
diff --git a/docs/ts/primitives/cron-jobs.md b/docs/ts/primitives/cron-jobs.md
new file mode 100644
index 0000000000..6574fadb54
--- /dev/null
+++ b/docs/ts/primitives/cron-jobs.md
@@ -0,0 +1,100 @@
+---
+seotitle: Create recurring tasks with Encore's Cron Jobs API
+seodesc: Learn how to create periodic and recurring tasks in your backend application using Encore's Cron Jobs API.
+title: Cron Jobs
+subtitle: Run recurring and scheduled tasks
+infobox: {
+  title: "Cron Jobs",
+  import: "encore.dev/cron",
+  example_link: "/docs/tutorials/uptime"
+}
+lang: ts
+---
+
+When you need to run periodic and recurring tasks, Encore.ts provides a declarative way of using Cron Jobs.
+
+When a Cron Job is defined in your application, Encore automatically calls your specified API according to the defined schedule. This eliminates the need for infrastructure maintenance, as Encore manages scheduling, monitoring, and execution of Cron Jobs.
+
+<Callout type="info">
+
+Cron Jobs do not run when developing locally or in [Preview Environments](/docs/platform/deploy/preview-environments), but you can always call the API manually to test the behavior.
+
+</Callout>
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/uptime"
+    desc="Uptime Monitoring app that uses a Cron Job to periodically check the uptime of a website."
+/>
+
+## Defining a Cron Job
+
+To define a Cron Job, import `encore.dev/cron` and call `new CronJob`, assigning the result to a top-level variable.
+
+### Example
+
+```ts
+import { CronJob } from "encore.dev/cron";
+import { api } from "encore.dev/api";
+
+// Send a welcome email to everyone who signed up in the last two hours.
+const _ = new CronJob("welcome-email", {
+	title: "Send welcome emails",
+	every: "2h",
+	endpoint: sendWelcomeEmail,
+})
+
+// Emails everyone who signed up recently.
+// It's idempotent: it only sends a welcome email to each person once.
+export const sendWelcomeEmail = api({}, async () => {
+	// Send welcome emails...
+});
+```
+
+The `"welcome-email"` argument to `new CronJob` is a unique ID you give to each Cron Job.
+If you later refactor the code and move the Cron Job definition to another package,
+Encore uses this ID to keep track that it's the same Cron Job and not a different one.
+
+When this code gets deployed Encore will automatically register the Cron Job in Encore Cloud
+and begin calling the `sendWelcomeEmail` API every two hours.
+
+The Encore Cloud dashboard provides a convenient user interface for monitoring and debugging
+Cron Job executions across all your environments via the `Cron Jobs` menu item:
+
+![Cron Jobs UI](/assets/docs/cron.png)
+
+## Keep in mind when using Cron Jobs
+
+- Cron Jobs do not execute during local development or in [Preview Environments](/docs/platform/deploy/preview-environments). However, you can manually invoke the API to test its behavior.
+- In Encore Cloud, Cron Job executions are limited to **once every hour**, with the exact minute randomized within that hour for users on the Free Tier. To enable more frequent executions or to specify the exact minute within the hour, consider [deploying to your own cloud](/docs/platform/deploy/own-cloud) or upgrading to the [Pro plan](/pricing).
+- Both public and private APIs are supported for Cron Jobs.
+- Ensure that the API endpoints used in Cron Jobs are idempotent, as they may be called multiple times under certain network conditions.
+- API endpoints utilized in Cron Jobs must not accept any request parameters.
+
+## Cron schedules
+
+Above we used the `every` field, which executes the Cron Job on a periodic basis.
+It runs around the clock each day, starting at midnight (UTC).
+
+In order to ensure a consistent delay between each run, the interval used **must divide 24 hours evenly**.
+For example, `10m` and `6h` are both allowed (since 24 hours is evenly divisible by both),
+whereas `7h` is not (since 24 is not evenly divisible by 7).
+The Encore compiler will catch this and give you a helpful error at compile-time if you try to use an invalid interval.
+
+### Cron expressions
+
+For more advanced use cases, such as running a Cron Job on a specific day of the month, or a specific week day, or similar,
+the `every` field is not expressive enough.
+
+For these use cases, Encore provides full support for [Cron expressions](https://en.wikipedia.org/wiki/Cron) by using the `schedule` field
+instead of the `every` field.
+
+For example:
+
+```ts
+// Run the monthly accounting sync job at 4am (UTC) on the 15th day of each month.
+const _ = new CronJob("accounting-sync", {
+	title:    "Cron Job Example",
+	schedule: "0 4 15 * *",
+	endpoint: accountingSync,
+})
+```
diff --git a/docs/ts/primitives/database-extensions.md b/docs/ts/primitives/database-extensions.md
new file mode 100644
index 0000000000..384fd2d96e
--- /dev/null
+++ b/docs/ts/primitives/database-extensions.md
@@ -0,0 +1,80 @@
+---
+seotitle: Pre-installed PostgreSQL extensions
+seodesc: See the list of pre-installed PostgreSQL extensions available when using Encore
+title: PostgreSQL Extensions
+subtitle: Pre-installed extensions
+infobox: {
+  title: "SQL Databases",
+  import: "encore.dev/storage/sqldb"
+}
+lang: go
+---
+
+Encore uses the [encoredotdev/postgres](https://github.com/encoredev/postgres-image) docker image for local development, CI/CD, and for databases hosted on Encore Cloud.
+
+The docker image ships with the following PostgreSQL extensions pre-installed and available for use (via `CREATE EXTENSION`):
+
+| Extension                      | Version | Description                                                                                                         |
+| ------------------------------ | ------- | ------------------------------------------------------------------------------------------------------------------- |
+| refint                         | 1.0     | functions for implementing referential integrity (obsolete)                                                         |
+| pg_buffercache                 | 1.3     | examine the shared buffer cache                                                                                     |
+| pg_freespacemap                | 1.2     | examine the free space map (FSM)                                                                                    |
+| plpgsql                        | 1.0     | PL/pgSQL procedural language                                                                                        |
+| citext                         | 1.6     | data type for case-insensitive character strings                                                                    |
+| adminpack                      | 2.1     | administrative functions for PostgreSQL                                                                             |
+| moddatetime                    | 1.0     | functions for tracking last modification time                                                                       |
+| amcheck                        | 1.3     | functions for verifying relation integrity                                                                          |
+| seg                            | 1.4     | data type for representing line segments or floating-point intervals                                                |
+| pg_stat_statements             | 1.10    | track planning and execution statistics of all SQL statements executed                                              |
+| pg_trgm                        | 1.6     | text similarity measurement and index searching based on trigrams                                                   |
+| isn                            | 1.2     | data types for international product numbering standards                                                            |
+| btree_gist                     | 1.7     | support for indexing common datatypes in GiST                                                                       |
+| intarray                       | 1.5     | functions, operators, and index support for 1-D arrays of integers                                                  |
+| pg_surgery                     | 1.0     | extension to perform surgery on a damaged relation                                                                  |
+| uuid-ossp                      | 1.1     | generate universally unique identifiers (UUIDs)                                                                     |
+| insert_username                | 1.0     | functions for tracking who changed a table                                                                          |
+| bloom                          | 1.0     | bloom access method - signature file based index                                                                    |
+| pgcrypto                       | 1.3     | cryptographic functions                                                                                             |
+| dblink                         | 1.2     | connect to other PostgreSQL databases from within a database                                                        |
+| tsm_system_rows                | 1.0     | TABLESAMPLE method which accepts number of rows as a limit                                                          |
+| pg_prewarm                     | 1.2     | prewarm relation data                                                                                               |
+| old_snapshot                   | 1.0     | utilities in support of old_snapshot_threshold                                                                      |
+| pageinspect                    | 1.11    | inspect the contents of database pages at a low level                                                               |
+| intagg                         | 1.1     | integer aggregator and enumerator (obsolete)                                                                        |
+| pg_visibility                  | 1.2     | examine the visibility map (VM) and page-level visibility info                                                      |
+| cube                           | 1.5     | data type for multidimensional cubes                                                                                |
+| tablefunc                      | 1.0     | functions that manipulate whole tables, including crosstab                                                          |
+| xml2                           | 1.1     | XPath querying and XSLT                                                                                             |
+| fuzzystrmatch                  | 1.1     | determine similarities and distance between strings                                                                 |
+| pg_walinspect                  | 1.0     | functions to inspect contents of PostgreSQL Write-Ahead Log                                                         |
+| btree_gin                      | 1.3     | support for indexing common datatypes in GIN                                                                        |
+| sslinfo                        | 1.2     | information about SSL certificates                                                                                  |
+| tcn                            | 1.0     | Triggered change notifications                                                                                      |
+| hstore                         | 1.8     | data type for storing sets of (key, value) pairs                                                                    |
+| dict_int                       | 1.0     | text search dictionary template for integers                                                                        |
+| earthdistance                  | 1.1     | calculate great-circle distances on the surface of the Earth                                                        |
+| file_fdw                       | 1.0     | foreign-data wrapper for flat file access                                                                           |
+| autoinc                        | 1.0     | functions for autoincrementing fields                                                                               |
+| ltree                          | 1.2     | data type for hierarchical tree-like structures                                                                     |
+| unaccent                       | 1.1     | text search dictionary that removes accents                                                                         |
+| pgrowlocks                     | 1.2     | show row-level locking information                                                                                  |
+| tsm_system_time                | 1.0     | TABLESAMPLE method which accepts time in milliseconds as a limit                                                    |
+| dict_xsyn                      | 1.0     | text search dictionary template for extended synonym processing                                                     |
+| pgstattuple                    | 1.5     | show tuple-level statistics                                                                                         |
+| postgres_fdw                   | 1.1     | foreign-data wrapper for remote PostgreSQL servers                                                                  |
+| lo                             | 1.1     | Large Object maintenance                                                                                            |
+| postgis_sfcgal-3               | 3.4.2   | PostGIS SFCGAL functions                                                                                            |
+| address_standardizer_data_us-3 | 3.4.2   | Address Standardizer US dataset example                                                                             |
+| address_standardizer-3         | 3.4.2   | Used to parse an address into constituent elements. Generally used to support geocoding address normalization step. |
+| postgis_topology-3             | 3.4.2   | PostGIS topology spatial types and functions                                                                        |
+| postgis-3                      | 3.4.2   | PostGIS geometry and geography spatial types and functions                                                          |
+| postgis_raster-3               | 3.4.2   | PostGIS raster types and functions                                                                                  |
+| postgis_tiger_geocoder-3       | 3.4.2   | PostGIS tiger geocoder and reverse geocoder                                                                         |
+| vector                         | 0.7.0   | vector data type and ivfflat and hnsw access methods                                                                |
+| postgis                        | 3.4.2   | PostGIS geometry and geography spatial types and functions                                                          |
+| address_standardizer           | 3.4.2   | Used to parse an address into constituent elements. Generally used to support geocoding address normalization step. |
+| postgis_topology               | 3.4.2   | PostGIS topology spatial types and functions                                                                        |
+| postgis_tiger_geocoder         | 3.4.2   | PostGIS tiger geocoder and reverse geocoder                                                                         |
+| address_standardizer_data_us   | 3.4.2   | Address Standardizer US dataset example                                                                             |
+| postgis_sfcgal                 | 3.4.2   | PostGIS SFCGAL functions                                                                                            |
+| postgis_raster                 | 3.4.2   | PostGIS raster types and functions                                                                                  |
diff --git a/docs/ts/primitives/databases.md b/docs/ts/primitives/databases.md
new file mode 100644
index 0000000000..8ae10142f1
--- /dev/null
+++ b/docs/ts/primitives/databases.md
@@ -0,0 +1,330 @@
+---
+seotitle: Using SQL databases for your backend application
+seodesc: Learn how to use SQL databases for your backend application. See how to provision, migrate, and query PostgreSQL databases using Go and Encore.
+title: Using SQL databases
+subtitle: Provisioning, migrating, querying
+infobox: {
+  title: "SQL Databases",
+  import: "encore.dev/storage/sqldb",
+  example_link: "/docs/tutorials/rest-api"
+}
+lang: ts
+---
+
+Encore treats SQL databases as logical resources and natively supports **PostgreSQL** databases.
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/url-shortener"
+    desc="URL Shortener example that uses a PostgreSQL database."
+/>
+
+## Creating a database
+
+To create a database, import `encore.dev/storage/sqldb` and call `new SQLDatabase`, assigning the result to a top-level variable.
+Use a migration file in a directory `migrations` to define the database schema.
+
+For example:
+
+```typescript
+-- todo/todo.ts --
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+
+// Create the todo database and assign it to the "db" variable
+const db = new SQLDatabase("todo", {
+  migrations: "./migrations",
+});
+
+// Then, query the database using db.query, db.exec, etc.
+-- todo/migrations/1_create_table.up.sql --
+CREATE TABLE todo_item (
+  id BIGSERIAL PRIMARY KEY,
+  title TEXT NOT NULL,
+  done BOOLEAN NOT NULL DEFAULT false
+  -- etc...
+);
+```
+
+As seen above, the `new SQLDatabase()` call takes two parameters: the name of the database, and a configuration object.
+The configuration object specifies the directory containing the database migration files, which is how you define the database schema.
+
+See the [Defining the database schema](#defining-the-database-schema) section below for more details.
+
+With this code in place, Encore will automatically create the database using [Docker](https://docker.com) when you run the command `encore run` in your local environment. Make sure Docker is installed and running on your machine before running `encore run`.
+
+<Callout type="info">
+
+If your application is already running when you define a new database, you will need to stop and restart `encore run`. This is necessary for Encore to create the new database using Docker.
+
+</Callout>
+
+
+In cloud environments, Encore automatically injects the appropriate configuration to authenticate and connect to the database, so once the application starts up the database is ready to be used.
+
+## Database Migrations
+
+Encore automatically handles `up` migrations, while `down` migrations must be run manually. Each `up` migration runs sequentially, expressing changes in the database schema from the previous migration.
+
+### Naming Conventions
+
+**File Name Format:** Migration files must start with a number followed by an underscore (`_`), and must increase sequentially. Each file name must end with `.up.sql`.
+
+**Examples:**
+- `1_first_migration.up.sql`
+- `2_second_migration.up.sql`
+- `3_migration_name.up.sql`
+
+You can also prefix migration files with leading zeroes for better ordering in the editor (e.g., `0001_migration.up.sql`).
+
+### Defining the Database Schema
+
+The first migration typically defines the initial table structure. For instance, a `todo` service might create `todo/migrations/1_create_table.up.sql` with the following content:
+
+```sql
+CREATE TABLE todo_item (
+    id BIGSERIAL PRIMARY KEY,
+    title TEXT NOT NULL,
+    done BOOLEAN NOT NULL DEFAULT false
+);
+```
+
+### Migration File Structure
+
+Migration files are created in a `migrations` directory within an Encore service. Each file is named `<number>_<name>.up.sql`, where `<number>` is a sequence number for ordering and `<name>` describes the migration.
+
+**Example Directory Structure:**
+```
+/my-app
+├── encore.app                       // ... other top-level project files
+│
+└── todo                             // todo service
+    ├── migrations                   // database migrations (directory)
+    │   ├── 1_create_table.up.sql    // first migration file
+    │   └── 2_add_field.up.sql       // second migration file
+    ├── todo.ts                      // todo service code
+    └── todo.test.ts                 // tests for todo service
+```
+
+## Using databases
+
+Once you have created the database using `const db = new SQLDatabase(...)` you can start querying and inserting data into the database by calling methods on the `db` variable.
+
+### Querying data
+
+To query data, use the following methods:
+
+- `db.query`: Returns an asynchronous iterator, yielding rows one by one.
+- `db.queryRow`: Returns a single row, or `null` if no rows are found.
+- `db.queryAll`: Returns an array of all rows.
+- `db.rawQuery`: Similar to `db.query`, but takes a raw SQL string and parameters.
+- `db.rawQueryRow`: Similar to `db.queryRow`, but takes a raw SQL string and parameters.
+- `db.rawQueryAll`: Similar to `db.queryAll`, but takes a raw SQL string and parameters.
+
+
+Typical usage looks like this:
+
+```ts
+const allTodos = await db.query`SELECT * FROM todo_item`;
+for await (const todo of allTodos) {
+  // Process each todo
+}
+```
+
+Or to query a single todo item by id:
+
+```ts
+async function getTodoTitle(id: number): string | undefined {
+  const row = await db.queryRow`SELECT title FROM todo_item WHERE id = ${id}`;
+  return row?.title;
+}
+```
+
+Or to query using raw SQL and parameters:
+
+```ts
+async function getTodoTitle(id: number): string | undefined {
+  const row = await db.rawQueryRow("SELECT title FROM todo_item WHERE id = $1", id);
+  return row?.title;
+}
+```
+
+
+### Inserting data
+
+To insert data, or to make database queries that don't return any rows, use `db.exec` or `db.rawExec`.
+
+For example:
+
+```ts
+await db.exec`
+  INSERT INTO todo_item (title, done)
+  VALUES (${title}, false)
+`;
+```
+
+Or using raw SQL and parameters:
+
+```ts
+await db.rawExec(
+  "INSERT INTO todo_item (title, done) VALUES ($1, $2)",
+  title,
+  false
+);
+```
+
+### Transactions
+
+Transactions allow you to group multiple database operations into a single unit of work. If any operation within the transaction fails, the entire transaction is rolled back, ensuring data consistency.
+
+The transaction type implements `AsyncDisposable`, which automatically rolls back the transaction if it is not explicitly committed or rolled back. This ensures that no open transactions are left accidentally.
+
+For example:
+
+```ts
+await using tx = await db.begin();
+
+await db.exec`
+  INSERT INTO todo_item (title, done)
+  VALUES (${title1}, false)
+`;
+
+await db.exec`
+  INSERT INTO todo_item (title, done)
+  VALUES (${title2}, false)
+`;
+
+await tx.commit();
+```
+
+
+## Connecting to databases
+
+It's often useful to be able to connect to the database from outside the backend application. For example for scripts, ad-hoc querying, or dumping data for analysis.
+
+Currently Encore does not expose user credentials for databases in the local environment or for environments on Encore Cloud. You can use a connection string to connect instead, see below.
+
+### Using the Encore CLI
+
+Encore's CLI comes with built-in support for connecting to databases:
+
+* `encore db shell <database-name> [--env=<name>]` opens a [psql](https://www.postgresql.org/docs/current/app-psql.html)
+  shell to the database named `<database-name>` in the given environment. Leaving out `--env` defaults to the local development environment. `encore db shell` defaults to read-only permissions. Use `--write`, `--admin` and `--superuser` flags to modify which permissions you connect with.
+
+* `encore db conn-uri <database-name> [--env=<name>]` outputs a connection string for the database named `<database-name>`.
+  When specifying a cloud environment, the connection string is temporary. Leaving out `--env` defaults to the local development environment.
+
+* `encore db proxy [--env=<name>]` sets up a local proxy that forwards any incoming connection
+  to the databases in the specified environment.
+  Leaving out `--env` defaults to the local development environment.
+
+See `encore help db` for more information on database management commands.
+
+### Using database user credentials
+
+For cloud environments on AWS/GCP you can view database user credentials (created by Encore when provisioning databases) via the Cloud Dashboard:
+
+* Open your app in the [Encore Cloud dashboard](https://app.encore.cloud), navigate to the **Infrastructure** page for the appropriate environment, and locate the `USERS` section within the relevant **Database Cluster**.
+
+## Handling migration errors
+
+When Encore applies database migrations, there's always a possibility the migrations don't apply cleanly.
+
+This can happen for many reasons:
+- There's a problem with the SQL syntax in the migration
+- You tried to add a `UNIQUE` constraint but the values in the table aren't actually unique
+- The existing database schema didn't look like you thought it did, so the database object you tried to change doesn't actually exist
+- ... and so on
+
+If that happens, Encore rolls back the migration. If it happens during a cloud deployment, the deployment is aborted.
+Once you fix the problem, re-run `encore run` (locally) or push the updated code (in the cloud) to try again.
+
+Encore tracks which migrations have been applied in the `schema_migrations` table:
+
+```sql
+database=# \d schema_migrations
+          Table "public.schema_migrations"
+ Column  |  Type   | Collation | Nullable | Default
+---------+---------+-----------+----------+---------
+ version | bigint  |           | not null |
+ dirty   | boolean |           | not null |
+Indexes:
+    "schema_migrations_pkey" PRIMARY KEY, btree (version)
+```
+
+The `version` column tracks which migration was last applied. If you wish to skip a migration or re-run a migration,
+change the value in this column. For example, to re-run the last migration, run `UPDATE schema_migrations SET version = version - 1;`.
+*Note that Encore does not use the `dirty` flag by default.*
+
+## Using an ORM
+
+Encore has all the tools needed to support ORMs and migration frameworks out-of-the-box through named databases and migration files. Writing plain SQL might not work for your use case, or you may not want to use SQL in the first place.
+
+ORMs like [Prisma](/docs/ts/develop/orms/prisma) and [Drizzle](/docs/ts/develop/orms/drizzle) can be used with Encore by integrating their logic with a system's database. Encore is not restrictive, it uses plain SQL migration files for its migrations.
+
+* If your ORM of choice can connect to any database using a standard SQL driver, then it can be used with Encore.
+* If your migration framework can generate SQL migration files without any modifications, then it can be used with Encore.
+
+For more information on using ORMs with Encore, see the [ORMs](/docs/ts/develop/orms) page.
+
+## Sharing databases between services
+
+There are two primary ways of sharing a database between services:
+
+- You can define the `SQLDatabase` object in a shared module as an exported variable, and reference this object
+from every service that needs to access the database.
+- You can define the `SQLDatabase` object in one service using `new SQLDatabase("name", ...)`, and have other services access it by creating a reference using `SQLDatabase.named("name")`.
+
+Both approaches have the same effect, but the latter is more explicit.
+
+## PostgreSQL Extensions
+
+Encore uses the [encoredotdev/postgres](https://github.com/encoredev/postgres-image) docker image for local development,
+CI/CD, and for databases hosted on Encore Cloud.
+
+This docker image ships with many popular PostgreSQL extensions pre-installed.
+In particular, [pgvector](https://github.com/pgvector/pgvector) and [PostGIS](https://postgis.net) are available.
+
+See [the full list of available extensions](/docs/ts/primitives/databases-extensions).
+
+## Troubleshooting
+
+When you run your application locally with `encore run`, Encore will provision local databases using Docker.
+If this fails with a database error, it can often be resolved if you restart the Encore daemon using `encore daemon` and then try `encore run` again.
+
+If this does not resolve the issue, here are steps to resolve common errors:
+
+** Error: sqldb: unknown database **
+
+This error is often caused by a problem with the initial migration file, such as incorrect naming or location.
+
+- Verify that you've [created the migration file](#defining-the-database-schema) correctly, then try `encore run` again.
+
+** Error: could not connect to the database **
+
+When you can't connect to the database in your local environment, there's likely an issue with Docker:
+
+- Make sure that you have [Docker](https://docker.com) installed and running, then try `encore run` again.
+- If this fails, restart the Encore daemon by running `encore daemon`, then try `encore run` again.
+
+** Error: Creating PostgreSQL database cluster Failed **
+
+This means Encore was not able to create the database. Often this is due to a problem with Docker.
+
+- Check if you have permission to access Docker by running `docker images`.
+- Set the correct permissions with `sudo usermod -aG docker $USER` (Learn more in the [Docker documentation](https://docs.docker.com/engine/install/linux-postinstall/))
+- Then log out and log back in so that your group membership is refreshed.
+
+** Error: unable to save docker image **
+
+This error is often caused by a problem with Docker.
+
+- Make sure that you have [Docker](https://docker.com) installed and running.
+- In Docker, open **Settings > Advanced** and make sure that the setting `Allow the default Docker socket to be used` is checked.
+- If it still fails, restart the Encore daemon by running `encore daemon`, then try `encore run` again.
+
+** Error: unable to add CA to cert pool **
+
+This error is commonly caused by the presence of the file `$HOME/.postgresql/root.crt` on the filesystem.
+When this file is present the PostgreSQL client library will assume the database server has that root certificate,
+which will cause the above error.
+
+- Remove or rename the file, then try `encore run` again.
diff --git a/docs/ts/primitives/defining-apis.mdx b/docs/ts/primitives/defining-apis.mdx
new file mode 100644
index 0000000000..7e3b3277c1
--- /dev/null
+++ b/docs/ts/primitives/defining-apis.mdx
@@ -0,0 +1,263 @@
+---
+seotitle: Defining type-safe TypeScript APIs with Encore.ts
+seodesc: Learn how to create APIs for your cloud backend application using TypeScript and Encore.ts
+title: Defining Type-Safe APIs
+subtitle: Simplifying type-safe API development
+lang: ts
+---
+
+Encore.ts simplifies creating type-safe, idiomatic TypeScript API endpoints and provides built-in validation for incoming requests.
+
+At their core, APIs in Encore.ts are normal `async` functions with request and response data types defined as TypeScript interfaces, which Encore.ts uses to encode API requests to HTTP messages.
+
+Encore.ts also parses your source code to understand the request and response schema of each endpoint, automatically handling validation of incoming requests against your schema.
+
+## Defining API endpoints
+
+To define an API endpoint, use the `api` function from the `encore.dev/api` module. This function wraps a regular TypeScript async function, designating it as an API endpoint. Encore.ts then generates the necessary boilerplate at compile-time.
+
+In the example below, we define the API endpoint `ping` which accepts `POST` requests and is exposed as `hello.ping` (because our service name is `hello`).
+
+```typescript
+// inside the hello.ts file
+import { api } from "encore.dev/api";
+
+export const ping = api(
+  { method: "POST" },
+  async (p: PingParams): Promise<PingResponse> => {
+    return { message: `Hello ${p.name}!` };
+  },
+);
+```
+
+### Exposing API endpoints to the outside world
+
+When you define an API, by default it is not exposed to the outside world, and it can only be called
+by other APIs within the same Encore application.
+
+To expose an API to the internet, add the `expose: true` field to the options object passed in
+as the first argument to `api`.
+
+- `{ expose: false }` &ndash; defines a private API that is never accessible to the outside world. It can only be called from other services in your app and via cron jobs. This is default value if the `expose` field isn't set.
+- `{ expose: true }` &ndash; defines a public API that anybody on the internet can call
+
+### Requiring authentication data
+
+To require authentication for an API endpoint, add `auth: true` to the API options.
+With this option, Encore will first call the authentication handler you've defined to validate the authentication of incoming requests.
+
+Setting `auth: true` can also be useful for internal APIs that aren't exposed to the internet.
+In that case, it means that the internal caller must have valid authentication data associated with its request.
+
+Finally, even if an API endpoint does not specify `auth: true`, it will still receive any authentication data that was provided.
+
+For more information on defining APIs that require authentication, see the [authentication guide](/docs/ts/develop/auth).
+
+## API Schemas
+
+### Request and response schemas
+
+In the example above we defined an API that uses request and response schemas, where the request data is of type `Params` and the response data of type `Response`.
+That means we need to define them like so:
+
+```typescript
+-- hello.ts --
+import { api } from "encore.dev/api";
+
+// PingParams is the request data for the Ping endpoint.
+interface PingParams {
+  name: string;
+}
+
+// PingResponse is the response data for the Ping endpoint.
+interface PingResponse {
+  message: string;
+}
+
+// hello is an API endpoint that responds with a simple response.
+export const hello = api(
+  { method: "POST", path: "/hello" },
+  async (p: PingParams): Promise<PingResponse> => {
+    return { message: `Hello ${p.name}!` };
+  },
+);
+```
+
+Request and response schemas are both optional. There are four different ways of defining an API:
+
+**Using both request and response data:**<br/>
+`api({ ... }, async (params: Params): Promise<Response> => {});`
+
+**Only returning a response:**<br/>
+`api({ ... }, async (): Promise<Response> => {});`
+
+**With only request data:**<br/>
+`api({ ... }, async (params: Params): Promise<void> => {});`
+
+**Without any request or response data:**<br/>
+`api({ ... }, async (): Promise<void> => {});`
+
+Alternatively, you can express these using type parameters, since `api` is a generic function:
+
+**Using both request and response data:**<br/>
+`api<Params, Response>({ ... }, async (params) => {});`
+
+**Only returning a response:**<br/>
+`api<void, Response>({ ... }, async () => {});`
+
+**With only request data:**<br/>
+`api<Params, void>({ ... }, async (params) => {});`
+
+**Without any request or response data:**<br/>
+`api<void, void>({ ... }, async () => {});`
+
+### Customizing request and response encoding
+Encore parses the source code to understand the request and response schema of each endpoint.
+By default, the data is parsed as a JSON body for incoming requests, and written back as JSON responses.
+
+This can be customized on a per-field basis, allowing individual fields to be parsed from query strings
+and HTTP headers with ease.
+
+This is done by using the `Header` and `Query` types defined in the `encore.dev/api` module.
+
+### Headers
+
+Headers are defined by setting the field type to `Header<"Name-Of-Header">`. It can be used in both request and response data types.
+
+In the example below, the `language` field will be fetched from the
+`Accept-Language` HTTP header.
+
+```ts
+import { Header } from "encore.dev/api";
+
+interface Params {
+  language: Header<"Accept-Language">; // parsed from header
+  author: string; // not a header
+}
+```
+
+### Query parameters
+
+For `GET`, `HEAD` and `DELETE` requests, parameters are read from the query string by default, since those HTTP methods
+do not support request bodies.
+
+For other HTTP methods (that do support request bodies), parameters are by default read from the HTTP request body as JSON.
+In those cases, the `Query` type can be used to specify that a field should be parsed from the query string instead.
+
+Query strings are not supported in HTTP responses, and are treated as being part of the HTTP response body in JSON.
+
+In the example below, the `limit` field will be read from the `limit` query parameter for all HTTP methods,
+whereas the `author` field will be parsed from the query string only if the method of
+the request is `GET`, `HEAD` or `DELETE` (and otherwise from the HTTP request body as JSON).
+
+```ts
+interface Params {
+  limit: Query<number>; // always a query parameter
+  author: string; // query if GET, HEAD or DELETE, otherwise body parameter
+}
+```
+
+### Path parameters
+
+Path parameters are specified by the `path` field in the API Options in `api` call.
+To specify a placeholder variable, use `:name` and add a function parameter with the same name to the function signature.
+Encore parses the incoming request URL and makes sure it matches the type of the parameter. The last segment of the path
+can be parsed as a wildcard parameter by using `*name` with a matching function parameter.
+
+Each path parameter (whether a single segment like `:name` or a wildcard parameter like `*name`) must have
+a matching field in the request data type.
+
+For example:
+
+```ts
+// Retrieves a blog post by its id.
+export const getBlogPost = api(
+    { method: "GET", path: "/blog/:id/*path" },
+    async (params: {id: number; path: string}): Promise<BlogPost> {
+        // Use id and path to query database...
+    }
+)
+```
+
+### Cookie parameters
+
+Cookies are defined by setting the field type to `Cookie<"Name-Of-Cookie">`. It can be used in both request and response data types.
+
+In the example below we define an optional field that will be parsed from the cookie header.
+
+```ts
+import { Cookie } from "encore.dev/api";
+
+interface Params {
+  settings?: Cookie<"settings">; // parsed from cookie header
+}
+```
+
+Read more about cookies [here](/docs/ts/primitives/cookies)
+
+### Fallback routes
+
+Encore supports defining fallback routes that will be called if no other endpoint matches the request,
+using the syntax `path: "/!fallback"`.
+
+This is often useful when migrating an existing backend service over to Encore, as it allows you to gradually
+migrate endpoints over to Encore while routing the remaining endpoints to the existing HTTP router using
+a raw endpoint with a fallback route.
+
+For example:
+
+```ts
+// Route all requests to the existing HTTP router if no other endpoint matches.
+export const fallback = api.raw(
+    { expose: true, method: "*", path: "/!path" },
+    async (req, resp) {
+        // Call old router
+    }
+)
+```
+
+## Custom HTTP status codes
+
+By default, Encore automatically sets appropriate HTTP status codes for your API responses. We recommend using these default status codes, but there are situations where you might need to set a custom HTTP status code, such as when porting an existing API that clients depend on for specific status codes.
+
+To set a custom HTTP status code, include an `HttpStatus` field in your response interface:
+
+```ts
+import { api, HttpStatus } from "encore.dev/api";
+
+interface Response {
+  msg: string;
+  status: HttpStatus;
+}
+
+export const endpoint = api(
+  { expose: true, method: "GET", path: "/path" },
+  async (): Promise<Response> => {
+    return { msg: "Hello", status: HttpStatus.Created };
+  }
+);
+```
+
+The `HttpStatus` enum includes all standard HTTP status codes like `HttpStatus.OK`, `HttpStatus.Created`, `HttpStatus.BadRequest`, etc.
+
+## Raw endpoints
+
+In case you need to operate at a lower abstraction level, Encore supports defining raw endpoints that let you access the underlying HTTP request. This is often useful for things like accepting webhooks.
+Learn more in the [raw endpoints guide](/docs/ts/primitives/raw-endpoints).
+
+## Sensitive data
+
+When handling sensitive information like API keys, passwords, or personally identifiable information (PII), you may want to prevent these details from appearing in traces. Encore provides the `sensitive` option for API endpoints for this purpose.
+
+To mark an endpoint as sensitive, add `sensitive: true` to the API options:
+
+```typescript
+export const processPayment = api(
+  { expose: true, method: "POST", path: "/payments", sensitive: true },
+  async (params: PaymentParams): Promise<PaymentResponse> => {
+    return { /* ... */ };
+  }
+);
+```
+
+When `sensitive: true` is set, Encore automatically redacts all request and response payloads and excludes HTTP headers from traces.
diff --git a/docs/ts/primitives/errors.md b/docs/ts/primitives/errors.md
new file mode 100644
index 0000000000..b43c513a23
--- /dev/null
+++ b/docs/ts/primitives/errors.md
@@ -0,0 +1,69 @@
+---
+seotitle: API Errors – Types, Wrappers, and Codes
+seodesc: See how to return structured error information from your APIs using Encore's errs package, and how to build precise error messages for complex business logic.
+title: API Errors
+subtitle: Returning structured error information from your APIs
+infobox: {
+  title: "API Errors",
+  import: "encore.dev/api",
+}
+lang: ts
+---
+
+Encore provides a standardized format of returning errors from API endpoints.
+
+It looks like this:
+
+```json
+// HTTP 404 Not Found
+{
+    "code": "not_found",
+    "message": "sprocket not found",
+    "details": null
+}
+```
+
+To return this, throw the `APIError` exception that Encore provides in the `encore.dev/api` module, with the appropriate error code:
+
+```typescript
+import { APIError, ErrCode } from "encore.dev/api";
+
+throw new APIError(ErrCode.NotFound, "sprocket not found");
+
+// or as a shorthand you can also write:
+throw APIError.notFound("sprocket not found");
+```
+
+
+## Error Codes
+
+The `ErrCode` type in the `encore.dev/api` module defines error codes for common error scenarios.
+They are identical to the codes defined by `gRPC` for interoperability.
+
+The table below summarizes the error codes.
+
+| Code                  | String                  | HTTP Status               |
+|-----------------------|-------------------------|---------------------------|
+| `OK`                  | `"ok"`                  | 200 OK                    |
+| `Canceled`            | `"canceled"`            | 499 Client Closed Request |
+| `Unknown`             | `"unknown"`             | 500 Internal Server Error |
+| `InvalidArgument`     | `"invalid_argument"`    | 400 Bad Request           |
+| `DeadlineExceeded`    | `"deadline_exceeded"`   | 504 Gateway Timeout       |
+| `NotFound`            | `"not_found"`           | 404 Not Found             |
+| `AlreadyExists`       | `"already_exists"`      | 409 Conflict              |
+| `PermissionDenied`    | `"permission_denied"`   | 403 Forbidden             |
+| `ResourceExhausted`   | `"resource_exhausted"`  | 429 Too Many Requests     |
+| `FailedPrecondition`  | `"failed_precondition"` | 400 Bad Request           |
+| `Aborted`             | `"aborted"`             | 409 Conflict              |
+| `OutOfRange`          | `"out_of_range"`        | 400 Bad Request           |
+| `Unimplemented`       | `"unimplemented"`       | 501 Not Implemented       |
+| `Internal`            | `"internal"`            | 500 Internal Server Error |
+| `Unavailable`         | `"unavailable"`         | 503 Unavailable           |
+| `DataLoss`            | `"data_loss"`           | 500 Internal Server Error |
+| `Unauthenticated`     | `"unauthenticated"`     | 401 Unauthorized          |
+
+
+## Additional details
+
+To attach additional structured details to errors, use the `withDetails` method on an `APIError`. The details will be returned with the error to external clients.
+
diff --git a/docs/ts/primitives/graphql.mdx b/docs/ts/primitives/graphql.mdx
new file mode 100644
index 0000000000..4defb2db03
--- /dev/null
+++ b/docs/ts/primitives/graphql.mdx
@@ -0,0 +1,167 @@
+---
+seotitle: GraphQL API
+seodesc: Learn how to create a GraphQL API for your cloud backend application using TypeScript and Encore.ts
+title: GraphQL
+subtitle: Serve a GraphQL API under a Raw endpoint
+lang: ts
+---
+
+Encore.ts has great support for GraphQL with its type-safe approach to building APIs.
+
+Encore's automatic tracing also makes it easy to find and fix performance issues that often arise in GraphQL APIs (like the [N+1 problem](https://hygraph.com/blog/graphql-n-1-problem)).
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/graphql"
+    desc="Using Apollo GraphQL together with Encore.ts."
+/>
+
+## Concept
+
+To serve a GraphQL API, you can leverage [Raw endpoints](/docs/ts/primitives/raw-endpoints). Raw endpoints provide direct access to the underlying HTTP request and response objects, enabling integration with a GraphQL library. Below is an outline of the high-level steps required for setup:
+
+1. Take client requests with a Raw endpoint.
+2. Pass along the request object (body, headers, query params, etc.) to the GraphQL library.
+3. Use the GraphQL library to handle the queries and mutations.
+4. Return the GraphQL response from the Raw endpoint.
+
+Which GraphQL library you choose is up to you. It should work any GraphQL library that allows you to pass along the request object and get a GraphQL response object back without having to start a new HTTP server.
+
+## Example
+
+Here's an example using [Apollo](https://www.apollographql.com/docs/apollo-server/) to create a GraphQL API:
+
+```ts
+import { HeaderMap } from "@apollo/server";
+import { api } from "encore.dev/api";
+const { ApolloServer, gql } = require("apollo-server");
+import { json } from "node:stream/consumers";
+
+// Type definition schema
+const typeDefs = gql`
+  ...
+`;
+
+// Resolver functions
+const resolvers = {
+  // ...
+};
+
+const server = new ApolloServer({ typeDefs, resolvers });
+
+await server.start();
+
+export const graphqlAPI = api.raw(
+  { expose: true, path: "/graphql", method: "*" },
+  async (req, res) => {
+    // Make sure the Apollo server is started
+    server.assertStarted("/graphql");
+
+    // Extract headers in a format that Apollo understands
+    const headers = new HeaderMap();
+    for (const [key, value] of Object.entries(req.headers)) {
+      if (value !== undefined) {
+        headers.set(key, Array.isArray(value) ? value.join(", ") : value);
+      }
+    }
+
+    // Get response from Apollo server
+    const httpGraphQLResponse = await server.executeHTTPGraphQLRequest({
+      httpGraphQLRequest: {
+        headers,
+        method: req.method!.toUpperCase(),
+        body: await json(req),
+        search: new URLSearchParams(req.url ?? "").toString(),
+      },
+      context: async () => {
+        return { req, res };
+      },
+    });
+
+    // Set headers
+    for (const [key, value] of httpGraphQLResponse.headers) {
+      res.setHeader(key, value);
+    }
+
+    // Set status code
+    res.statusCode = httpGraphQLResponse.status || 200;
+
+    // Write response if it's complete
+    if (httpGraphQLResponse.body.kind === "complete") {
+      res.end(httpGraphQLResponse.body.string);
+      return;
+    }
+
+    // Write response in chunks if it's async
+    for await (const chunk of httpGraphQLResponse.body.asyncIterator) {
+      res.write(chunk);
+    }
+    res.end();
+  },
+);
+```
+
+<RelatedDocsLink paths={["/docs/ts/tutorials/graphql"]} />
+
+## Call REST APIs in resolvers
+
+It's often a good idea to create REST endpoints for your business logic and let your resolvers forward requests to those endpoints. This has a few benefits:
+
+1. **Getting traces** - Calls to Encore endpoints results in traces being created, even for internal API calls. Having traces makes it easy to find and fix performance issues that often arise in GraphQL APIs (like the [N+1 problem](https://hygraph.com/blog/graphql-n-1-problem)).
+2. **Thin resolvers** - By making your REST request/response objects extend the generated GraphQL types, your resolvers will just be thin wrappers around your REST endpoints.
+3. **Testing** - You can easily test your resolvers by mocking the API calls.
+4. **REST & GraphQL** - You will have both a REST and GraphQL API.
+
+Here's an example of how it might look like if you can call a REST API from a resolver:
+
+```graphql
+-- schema.graphql --
+type Query {
+  books: [Book]
+}
+
+type Book {
+  title: String!
+  author: String!
+}
+```
+
+```ts
+-- resolver.ts --
+// Import the book service from the generated service clients
+import { book } from "~encore/clients";
+import { QueryResolvers } from "../__generated__/resolvers-types";
+
+const queries: QueryResolvers = {
+  books: async () => {
+    // Call book.list to get the list of books
+    const { books } = await book.list();
+    return books;
+  },
+};
+
+export default queries;
+```
+
+```ts
+-- book.ts --
+import { api } from "encore.dev/api";
+// Import Book type the generated schema types
+import { Book } from "../__generated__/resolvers-types";
+
+const db: Book[] = [
+  {
+    title: "To Kill a Mockingbird",
+    author: "Harper Lee",
+  },
+  // ...
+];
+
+// REST endpoint to get the list of books
+export const list = api(
+  { expose: true, method: "GET", path: "/books" },
+  async (): Promise<{ books: Book[] }> => {
+    return { books: db };
+  },
+);
+```
+
diff --git a/docs/ts/primitives/object-storage.md b/docs/ts/primitives/object-storage.md
new file mode 100644
index 0000000000..0fc3701231
--- /dev/null
+++ b/docs/ts/primitives/object-storage.md
@@ -0,0 +1,255 @@
+---
+seotitle: Using Object Storage in your backend application
+seodesc: Learn how you can use Object Storage to store files and unstructured data in your backend application.
+title: Object Storage
+subtitle: Simple and scalable storage APIs for files and unstructured data
+infobox: {
+  title: "Object Storage",
+  import: "encore.dev/storage/objects",
+}
+lang: ts
+---
+
+Object Storage is a simple and scalable solution to store files and unstructured data in your backend application.
+
+The most common implementation is Amazon S3 ("Simple Storage Service") and its semantics are universally supported by every major cloud provider.
+
+Encore.ts provides a cloud-agnostic API for working with Object Storage, allowing you to store and retrieve files with ease. It has support for Amazon S3, Google Cloud Storage, as well as any other S3-compatible implementation (such as DigitalOcean Spaces, MinIO, etc.).
+
+
+Additionally, when you use Encore's Object Storage API you also automatically get:
+
+* Automatic tracing and instrumentation of all Object Storage operations
+* Built-in local development support, storing objects on the local filesystem
+* Support for integration testing, using a local, in-memory storage backend
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/ts/file-upload" 
+    desc="Handling file uploads and storing file data in a bucket and in a database" 
+/>
+
+## Creating a Bucket
+
+The core of Object Storage is the **Bucket**, which represents a collection of files.
+In Encore, buckets must be declared as package level variables, and cannot be created inside functions.
+Regardless of where you create a bucket, it can be accessed from any service by referencing the variable it's assigned to.
+
+When creating a bucket you can configure additional properties, like whether the objects in the bucket should be versioned.
+
+For example, to create a bucket for storing profile pictures:
+
+```ts
+import { Bucket } from "encore.dev/storage/objects";
+
+export const profilePictures = new Bucket("profile-pictures", {
+  versioned: false
+});
+```
+
+## Uploading files
+
+To upload a file to a bucket, use the `upload` method on the bucket variable.
+
+```ts
+const data = Buffer.from(...); // image data
+const attributes = await profilePictures.upload("my-image.jpeg", data, {
+  contentType: "image/jpeg",
+});
+```
+
+The `upload` method additionally takes an optional `UploadOptions` parameter
+for configuring additinal options, like setting the content type (see above),
+or to reject the upload if the object already exists.
+
+
+## Downloading files
+
+To download a file from a bucket, use the `download` method on the bucket variable:
+
+```ts
+const data = await profilePictures.download("my-image.jpeg");
+```
+
+The `download` method additionally takes a set of options to configure the download,
+like downloading a specific version if the bucket is versioned.
+
+## Listing objects
+
+To list objects in a bucket, use the `list` method on the bucket variable.
+
+It returns an async iterator of `ListEntry` objects that you can use to easily
+iterate over the objects in the bucket using a `for await` loop.
+
+For example, to list all profile pictures:
+
+```ts
+for await (const entry of profilePictures.list({})) {
+  // Do something with entry
+}
+```
+
+The `ListOptions` type can be used to limit the number of objects returned,
+or to filter them to a specific key prefix.
+
+## Deleting objects
+
+To delete an object from a bucket, use the `remove` method on the bucket variable.
+
+For example, to delete a profile picture:
+
+```ts
+await profilePictures.remove("my-image.jpeg");
+```
+
+## Retrieving object attributes
+
+You can retrieve information about an object using the `attrs` method on the bucket variable.
+It returns the attributes of the object, like its size, content type, and ETag.
+
+For example, to get the attributes of a profile picture:
+
+```ts
+const attrs = await profilePictures.attrs("my-image.jpeg");
+```
+
+For convenience there is also `exists` which returns a boolean indicating whether the object exists.
+
+```ts
+const exists = await profilePictures.exists("my-image.jpeg");
+```
+
+## Configuring Public Buckets
+
+To configure a bucket to be publicly accessible, set the `public` property to `true` when creating the bucket. This allows objects in the bucket to be accessed via a public URL.
+
+For example, to create a public bucket for storing profile pictures:
+
+```ts
+export const publicProfilePictures = new Bucket("public-profile-pictures", {
+  public: true,
+  versioned: false
+});
+```
+
+When self-hosting, see how to configure public buckets in the [infrastructure configuration docs](/docs/go/self-host/configure-infra).
+
+When deploying with Encore Cloud it will automatically configure the bucket to be publicly accessible and [configure CDN](/docs/platform/infrastructure/infra#production-infrastructure) for optimal content delivery.
+
+### Accessing Public Objects
+
+Once a bucket is configured as public, you can access its objects using the `publicUrl` method. This method returns the public URL for the specified object.
+
+For example, to get the public URL of a profile picture:
+
+```ts
+const url = publicProfilePictures.publicUrl("my-image.jpeg");
+console.log(`Public URL: ${url}`);
+```
+
+
+## Error handling
+
+The methods throw exceptions if something goes wrong, like if the object doesn't exist or the operation fails.
+
+If an object does not exist, it throws an `ObjectNotFound` error.
+
+If an upload fails due to a precondition not being met (like if the object already exists
+and the `notExists: true` option is set), it throws a `PreconditionFailed` error.
+
+Other errors are returned as `ObjectsError` errors (which the above errors also extend).
+
+## Bucket references
+
+Encore uses static analysis to determine which services are accessing each bucket,
+and what operations each service is performing.
+
+That information is used for features such as rendering architecture diagrams, and is used by Encore Cloud to provision infrastructure correctly and configure IAM permissions.
+
+This means `Bucket` objects can't be passed around however you like,
+as it makes static analysis impossible in many cases. To simplify your workflow, given these restrictions,
+Encore supports defining a "reference" to a bucket that can be passed around any way you want.
+
+### Using bucket references
+
+Define a bucket reference by calling `bucket.ref<DesiredPermissions>()` from within a service, where `DesiredPermissions` is one of the pre-defined permission types defined in the `encore.dev/storage/objects` module.
+
+This means you're effectively pre-declaring the permissions you need, and only the methods that
+are allowed by those permissions are available on the returned reference object.
+
+For example, to get a reference to a bucket that can only download objects:
+
+```typescript
+import { Uploader } from "encore.dev/storage/objects";
+const ref = profilePictures.ref<Uploader>();
+
+// You can now freely pass around `ref`, and you can use
+// `ref.upload()` just like you would `profilePictures.upload()`.
+```
+
+To ensure Encore still is aware of which permissions each service needs, the call to `bucket.ref`
+must be made from within a service, so that Encore knows which service to associate the permissions with.
+
+Encore provides permission interfaces for each operation that can be performed on a bucket:
+
+* `Downloader` for downloading objects
+* `Uploader` for uploading objects
+* `Lister` for listing objects
+* `Attrser` for getting object attributes
+* `Remover` for removing objects
+* `SignedDownloader` for generating signed download URLs for objects
+* `SignedUploader` for generating signed upload URLs for objects
+
+If you need multiple permissions you can combine them using `&`.
+For example, `profilePictures.ref<Downloader & Uploader>` gives you a reference
+that allows calling both `download` and `upload`.
+
+For convenience Encore also provides a `ReadWriter` permission that gives complete read-write access
+to the bucket, granting all the permissions above. It is equivalent to `Downloader & Uploader & Lister & Attrser & Remover`.
+
+## Signed Upload URLs
+
+You can use `signedUploadUrl` to create signed URLs to allow clients to upload content directly
+into the bucket over the internet. The URL is always restricted to one filename, and has a set
+expiration date. Anyone in possession of the URL can upload data under this filename without any
+additional authentication.
+
+```typescript
+const uploadUrl = await profilePictures.signedUploadUrl("my-user-id", {ttl: 7200})
+// Pass url to client
+```
+
+The client can now `PUT` to this URL with the content as a binary payload.
+
+```bash
+curl -X PUT --data-binary @/home/me/dog-wizard.jpeg "https://storage.googleapis.com/profile-pictures/my-user-id/?x-goog-signature=b7a1<...>"
+```
+
+### Why signed upload URLs?
+
+Signed URLs are an alternative to accepting the content payload directly in your API. Content
+upload requests are sometimes inconvenient to handle well: they can be long running and very
+large. With signed URLs, the content flows directly into the storage bucket, and only object IDs
+and metadata go through your API service.
+
+The trade-off is that the upload flow becomes more complex from a client point of view.
+
+## Signed Download URLs
+
+You can use `signedDownloadUrl` to create signed URLs to allow clients to download content directly
+from the bucket, even if it's private. The URL is always restricted to one filename, and has a set
+expiration date. Anyone in possession of the URL can download the file without any additional
+authentication.
+
+```typescript
+const url = await documents.signedDownloadUrl("letter-1234", {ttl: 7200})
+// Pass url to client
+```
+
+### Why signed download URLs?
+
+Similar to the upload case, signed download URLs is a way to avoid handing large files or bulk
+traffic through your API. With signed URLs, the content flows directly from the storage bucket,
+and only object IDs and metadata go through your API service.
+
+Note: unless the content is private, prefer serving urls with `publicUrl()` over signed URLs.
+Public URLs go over CDN, which is typically significantly more performant and cost effective.
diff --git a/docs/ts/primitives/pubsub.md b/docs/ts/primitives/pubsub.md
new file mode 100644
index 0000000000..b2d54b8e62
--- /dev/null
+++ b/docs/ts/primitives/pubsub.md
@@ -0,0 +1,204 @@
+---
+seotitle: Using PubSub in your backend application
+seodesc: Learn how you can use PubSub as an asynchronous message queue in your backend application, a great approach for decoupling services for better reliability.
+title: Pub/Sub
+subtitle: Decoupling services and building asynchronous systems
+infobox: {
+  title: "Pub/Sub Messaging",
+  import: "encore.dev/pubsub",
+  example_link: "/docs/ts/tutorials/uptime"
+}
+lang: ts
+---
+
+Publishers & Subscribers (Pub/Sub) let you build systems that communicate by broadcasting events asynchronously. This is a great way to decouple services for better reliability and responsiveness.
+
+Encore's Backend Framework lets you use Pub/Sub in a cloud-agnostic declarative fashion. At deployment, Encore automatically [provisions the required infrastructure](/docs/platform/infrastructure/infra).
+
+<GitHubLink 
+    href="https://github.com/encoredev/examples/tree/main/ts/simple-event-driven" 
+    desc="Simple example app with an event-driven architecture using Pub/Sub." 
+/>
+
+## Creating a Topic
+
+The core of Pub/Sub is the **Topic**, a named channel on which you publish events.
+Topics must be declared as package level variables, and cannot be created inside functions.
+Regardless of where you create a topic, it can be published to from any service, and subscribed to from any service.
+
+When creating a topic, it must be given an event type, a unique name, and a configuration to define its behaviour.
+
+For example, to create a topic with events about user signups:
+
+```ts
+import { Topic } from "encore.dev/pubsub"
+
+export interface SignupEvent {
+    userID: string;
+}
+
+export const signups = new Topic<SignupEvent>("signups", {
+    deliveryGuarantee: "at-least-once",
+});
+```
+
+## Publishing events
+
+To publish an **Event**, call `publish` on the topic passing in the event object (which is the type specified in the `new Topic<Type>` constructor).
+
+For example:
+
+```ts
+const messageID = await signups.publish({userID: id});
+
+// If we get here the event has been successfully published,
+// and all registered subscribers will receive the event.
+
+// The messageID variable contains the unique id of the message,
+// which is also provided to the subscribers when processing the event.
+```
+
+By defining the `signups` topic variable as an exported variable
+you can also publish to the topic from other services in the same way.
+
+## Subscribing to Events
+
+To **Subscribe** to events, you create a Subscription as a top-level variable, by calling the
+`new Subscription` constructor.
+
+Each subscription needs:
+- the topic to subscribe to
+- a name which is unique for the topic
+- a configuration object with at least a `handler` function to process the events
+- a configuration object
+
+For example, to create a subscription to the `signups` topic from earlier:
+
+```ts
+import { Subscription } from "encore.dev/pubsub";
+
+const _ = new Subscription(signups, "send-welcome-email", {
+    handler: async (event) => {
+        // Send a welcome email using the event.
+    },
+});
+```
+
+Subscriptions can be defined in the same service as the topic is declared, or in any other service of your application. Each
+subscription to a single topic receives the events independently of any other subscriptions to the same topic. This means
+that if one subscription is running very slowly, it will grow a backlog of unprocessed events.
+However, any other subscriptions will still be processing events in real-time as they are published.
+
+### Error Handling
+
+If a subscription function returns an error, the event being processed will be retried, based on the retry policy
+configured on that subscription.
+
+After the max number of retries is reached,the event will be placed into a dead-letter queue (DLQ) for that subscriber.
+This allows the subscription to continue processing events until the bug which caused the event to fail can be fixed.
+Once fixed, the messages on the dead-letter queue can be manually released to be processed again by the subscriber.
+
+## Customizing message delivery
+
+### At-least-once delivery
+
+The above examples configure the topic to ensure that, for each subscription, events will be delivered _at least once_.
+
+This means that if the topic believes the event was not processed, it will attempt to deliver the message again.
+**Therefore, all subscription handlers should be [idempotent](https://en.wikipedia.org/wiki/Idempotence#Computer_science_meaning).** This helps ensure that if the handler is called two or more times, from the outside there's no difference compared to calling it once.
+
+This can be achieved using a database to track if you have already performed the action that the event is meant to trigger,
+or ensuring that the action being performed is also idempotent in nature.
+
+### Exactly-once delivery
+
+Topics can also be configured to deliver events _exactly once_ by setting the `deliveryGuarantee` field to
+`"exactly-once"`. This enables stronger guarantees on the infrastructure level to minimize the likelihood of
+message re-delivery.
+
+However, there are still some rare circumstances when a message might be redelivered.  For example, if a networking issue
+causes the acknowledgement of successful processing the message to be lost before the cloud provider receives it
+(the [Two Generals' Problem](https://en.wikipedia.org/wiki/Two_Generals%27_Problem)).  As such, if correctness is critical
+under all circumstances, it's still advisable to design your subscription handlers to be idempotent.
+
+By enabling exactly-once delivery on a topic the cloud provider enforces certain throughput limitations:
+- AWS: 300 messages per second for the topic (see [AWS SQS Quotas](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/quotas-messages.html)).
+- GCP: At least 3,000 messages per second across all topics in the region (can be higher on the region see [GCP PubSub Quotas](https://cloud.google.com/pubsub/quotas#quotas)).
+
+<Callout type="important">
+
+Exactly-once delivery does not perform message deduplication on the publishing side.
+If `publish` is called twice with the same message, the message will be delivered twice.
+
+</Callout>
+
+### Message Attributes
+
+By default, each field in the event type is encoded as JSON and sent as part of the Pub/Sub message payload.
+
+Pub/Sub topics also support sending data as "attributes", which are key-value
+pairs that enable other behavior like subscriptions that filter messages
+or ensuring message ordering.
+
+To define that a field should be sent as an attribute, define it with the `Attribute` type.
+
+For example, to add an attribute named `source`:
+
+```ts
+import { Topic, Attribute } from "encore.dev/pubsub";
+
+export interface SignupEvent {
+    userID: string;
+    source: Attribute<string>;
+}
+
+export const signups = new Topic<SignupEvent>("signups", {
+    deliveryGuarantee: "at-least-once",
+});
+```
+
+### Ordered Topics
+
+Topics are unordered by default, meaning that messages can be delivered in any order. This allows for better throughput on the topic as messages can be processed in parallel. However, in some cases, messages must be delivered in the order they were published for a given entity.
+
+To create an ordered topic, configure the topic's `orderingAttribute` to match the name of a top-level `Attribute` field in the event type. This field ensures that messages delivered to the same subscriber are delivered in the order of publishing for that specific field value. Messages with a different value on the ordering attribute are delivered in an unspecified order.
+
+To maintain topic order, messages with the same ordering key aren't delivered until the earliest message is processed or dead-lettered, potentially causing delays due to [head-of-line blocking](https://en.wikipedia.org/wiki/Head-of-line_blocking). Mitigate processing issues by ensuring robust logging and alerts, and appropriate subscription retry policies.
+
+<Callout type="info">
+
+The `orderingAttribute` currently has no effect in local environments.
+
+</Callout>
+
+#### Throughput limitations
+
+Each cloud provider enforces certain throughput limitations for ordered topics:
+- **AWS:** 300 messages per second for the topic (see [AWS SQS Quotas](https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/quotas-messages.html))
+- **GCP:** 1 MBps for each ordering key (See [GCP Pub/Sub Resource Limits](https://cloud.google.com/pubsub/quotas#resource_limits))
+
+#### Ordered topic example
+
+```ts
+import { Topic, Attribute } from "encore.dev/pubsub";
+
+export interface CartEvent {
+	shoppingCartID: Attribute<number>;
+	event: string;
+}
+
+export const cartEvents = new Topic<CartEvent>("cart-events", {
+	deliveryGuarantee: "at-least-once",
+	orderingAttribute: "shoppingCartID",
+})
+
+async function example() {
+	// These are delivered in order as they all have the same shopping cart ID
+	await cartEvents.publish({shoppingCartID: 1, event: "item_added"});
+	await cartEvents.publish({shoppingCartID: 1, event: "checkout_started"});
+	await cartEvents.publish({shoppingCartID: 1, event: "checkout_completed"});
+
+	// This may be delivered at any point as it has a different shopping cart ID.
+	await cartEvents.publish({shoppingCartID: 2, event: "item_added"});
+}
+```
diff --git a/docs/ts/primitives/raw-endpoints.mdx b/docs/ts/primitives/raw-endpoints.mdx
new file mode 100644
index 0000000000..0e34fbaa6f
--- /dev/null
+++ b/docs/ts/primitives/raw-endpoints.mdx
@@ -0,0 +1,45 @@
+---
+seotitle: Raw Endpoints
+seodesc: Learn how to create raw API endpoints for your cloud backend application using TypeScript and Encore.ts
+title: Defining Raw Endpoints
+subtitle: Drop down in abstraction to access the raw HTTP request
+lang: ts
+---
+
+Sometimes you need to operate a lower abstraction than Encore.ts normally provides.
+For example, you might want to access the underlying HTTP request, often useful for things like accepting webhooks.
+
+Encore.ts has you covered using "raw endpoints".
+
+To define a raw endpoint, use the `api.raw` function. It works similarly to
+`api`, but does not accept a request and response schema. Instead, it works like
+the Node.js `http` module and `Express.js`, where the function receives two
+parameters: a request object and a response writer.
+
+It looks like this:
+
+```ts
+import { api } from "encore.dev/api";
+
+export const myRawEndpoint = api.raw(
+  { expose: true, path: "/raw", method: "GET" },
+  async (req, resp) => {
+    resp.writeHead(200, { "Content-Type": "text/plain" });
+    resp.end("Hello, raw world!");
+  },
+);
+```
+
+It can be called like so:
+
+```shell
+$ curl http://localhost:4000/raw
+Hello, raw world!
+```
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/slack-bot"
+    desc="Slack Bot example application that uses Raw endpoints to accept webhooks."
+/>
+
+<RelatedDocsLink paths={["/docs/ts/how-to/file-uploads"]} />
diff --git a/docs/ts/primitives/secrets.md b/docs/ts/primitives/secrets.md
new file mode 100644
index 0000000000..381578a0fb
--- /dev/null
+++ b/docs/ts/primitives/secrets.md
@@ -0,0 +1,112 @@
+---
+seotitle: Securely storing API keys and secrets
+seodesc: Learn how to store API keys, and secrets, securely for your backend application. Encore's built in vault makes it simple to keep your app secure.
+title: Storing Secrets and API keys
+subtitle: Simply storing secrets securely
+lang: ts
+---
+
+Wouldn't it be nice to store secret values like API keys, database passwords, and private keys directly in the source code?
+Of course, we can’t do that &ndash; it's horrifyingly insecure!
+(Unfortunately, it's also [very common](https://www.ndss-symposium.org/ndss-paper/how-bad-can-it-git-characterizing-secret-leakage-in-public-github-repositories/).)
+
+Encore's built-in secrets manager makes it simple to store secrets in a secure way and lets you use them in your program like regular variables.
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/simple-event-driven"
+    desc="Simple event driven example that uses secrets to store an API key"
+/>
+
+## Using secrets in your application
+
+To use a secret in your application, define a top-level variable directly in your code by calling the `secret` function from `encore.dev/config`.
+
+For example:
+
+```ts
+import { secret } from "encore.dev/config";
+
+// Personal access token for deployments
+const githubToken = secret("GitHubAPIToken");
+
+// Then, resolve the secret value by calling `githubToken()`.
+```
+
+When you've defined a secret in your program, the Encore compiler will check that they are set before running or deploying your application.
+
+When running your application locally, if a secret is not set, you will get a warning notifying you that a secret value is missing.
+
+When deploying to a cloud environment, all secrets must be defined, otherwise the deploy will fail.
+
+Once you've provided values for all secrets, call the secret as a function.
+For example:
+
+```ts
+async function callGitHub() {
+  const resp = await fetch("https:///api.github.com/user", {
+    credentials: "include",
+    headers: {
+      Authorization: `token ${githubToken()}`,
+    },
+  });
+  // ... handle resp
+}
+```
+
+<Callout type="info">
+
+Secret keys are globally unique for your whole application. If multiple services use the same secret name they both receive the same secret value at runtime.
+
+</Callout>
+
+## Storing secret values
+
+### Using the Encore Cloud dashboard
+
+The simplest way to set up secrets is with the Secrets Manager in the Encore Cloud Dashboard. Open your app in the [Encore Cloud dashboard](https://app.encore.cloud), go to **Settings** in the main navigation, and then click on **Secrets** in the settings menu.
+
+From here you can create secrets, save secret values, and configure different values for different environments.
+
+<img src="/assets/docs/secrets.png" title="Encore's Secrets Manager"/>
+
+### Using the CLI
+
+If you prefer, you can also set up secrets from the CLI using:<br/> `encore secret set --type <types> <secret-name>`
+
+`<types>` defines which environment types the secret value applies to. Use a comma-separated list of `production`, `development`, `preview`, and `local`. Shorthands: `prod`, `dev`, `pr`.
+
+For example `encore secret set --type prod SSHPrivateKey` sets the secret value for production environments,<br/> and `encore secret set --type dev,preview,local GitHubAPIToken` sets the secret value for development, preview, and local environments.
+
+In some cases, it can be useful to define a secret for a specific environment instead of an environment type.
+You can do so with `encore secret set --env <env-name> <secret-name>`. Secret values for specific environments
+take precedence over values for environment types.
+
+### Environment settings
+
+Each secret can only have one secret value for each environment type. For example: If you have a secret value that's shared between `development`, `preview` and `local`, and you want to override the value for `local`, you must first edit the existing secret and remove `local` using the Secrets Manager in the [Encore Cloud dashboard](https://app.encore.cloud). You can then add a new secret value for `local`. The end result should look something like the picture below.
+
+<img src="/assets/docs/secretoverride.png" title="Overriding a secret in Encore's Secrets Manager"/>
+
+### Overriding local secrets
+
+When setting secrets via the `encore secret set` command, they are automatically synced to all developers
+working on the same application, courtesy of the Encore Platform.
+
+In some cases, however, you want to override a secret only for your local machine.
+This can be done by creating a file named `.secrets.local.cue` in the root of your Encore application,
+next to the `encore.app` file.
+
+The file contains key-value pairs of secret names to secret values. For example:
+
+```cue
+GitHubAPIToken: "my-local-override-token"
+SSHPrivateKey: "custom-ssh-private-key"
+```
+
+## How it works: Where secrets are stored
+
+When you store a secret Encore stores it encrypted using Google Cloud Platform's [Key Management Service](https://cloud.google.com/security-key-management) (KMS).
+
+- **Production / Your own cloud:** When you deploy to production using your own cloud account on GCP or AWS, Encore provisions a secrets manager in your account (using either KMS or AWS Secrets Manager) and replicates your secrets to it. The secrets are then injected into the container using secret environment variables.
+- **Local:** For local secrets Encore automatically replicates them to developers' machines when running `encore run`.
+- **Development / Encore Cloud:** Environments on Encore's development cloud (running on GCP under the hood) work the same as self-hosted GCP environments, using GCP Secrets Manager.
diff --git a/docs/ts/primitives/services.mdx b/docs/ts/primitives/services.mdx
new file mode 100644
index 0000000000..817c1c78ad
--- /dev/null
+++ b/docs/ts/primitives/services.mdx
@@ -0,0 +1,28 @@
+---
+seotitle: Defining Services with Encore.ts
+seodesc: Learn how to create microservices and define APIs for your cloud backend application using TypeScript and Encore. The easiest way of building cloud backends.
+title: Defining Services
+subtitle: Simplifying (micro-)service development
+lang: ts
+---
+
+Encore.ts makes it simple to build applications with one or many services, without needing to manually handle the typical complexity of developing microservices.
+
+## Defining services
+
+To create an Encore service, add a file named `encore.service.ts` in a directory.
+
+The file must export a service instance, by calling `new Service`, imported from `encore.dev/service`.
+
+For example:
+
+```ts
+
+import { Service } from "encore.dev/service";
+
+export default new Service("my-service");
+```
+
+That's it! Encore will consider this directory and all its subdirectories as part of the service.
+
+For more on how to structure your application, see the [app structure guide](/docs/ts/primitives/app-structure).
diff --git a/docs/ts/primitives/static-assets.mdx b/docs/ts/primitives/static-assets.mdx
new file mode 100644
index 0000000000..1e02768db6
--- /dev/null
+++ b/docs/ts/primitives/static-assets.mdx
@@ -0,0 +1,79 @@
+---
+seotitle: Serve static assets
+seodesc: Learn how to serve static assets with Encore.ts
+title: Static Assets
+subtitle: How to serve static assets
+lang: ts
+---
+
+Encore.ts has built-in support for serving static assets (such as images, HTML and CSS files, and JavaScript files).
+
+This is particularly useful when you want to serve a static website or a single-page application (SPA) that has
+been pre-compiled into static files.
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/static-files"
+    desc="Example of how to use api.static in to serve static files."
+/>
+
+
+## API Reference
+
+Serving static files in Encore.ts works similarly to regular API endpoints, but using the `api.static` function instead.
+
+```typescript
+import { api } from "encore.dev/api";
+
+export const assets = api.static(
+  { expose: true, path: "/frontend/*path", dir: "./assets" },
+);
+```
+
+This will serve all files in the `./assets` directory under the `/frontend` path prefix.
+
+Encore automatically serves `index.html` files at the root of a directory. In the case above,
+that means that requesting the URL `/frontend` will serve the file `./assets/index.html`,
+and `/frontend/hello` will serve the file `./assets/hello` or `./assets/hello/index.html` (whichever exists).
+
+### Serving static files at the root
+
+By default, Encore requires that API endpoint paths don't conflict with other API endpoints.
+This can cause problems when you want to serve static files at the root of your domain (such as by setting `path: "/*path"`),
+since that would conflict with all other paths.
+
+To support this use case, Encore allows defining a route as a "fallback route", that gets called only when no other API endpoint matches.
+
+Fallback routes use the syntax `!path` instead of `*path`.
+
+It looks like this:
+
+```typescript
+import { api } from "encore.dev/api";
+
+export const assets = api.static(
+  { expose: true, path: "/!path", dir: "./assets" },
+);
+```
+
+### Configuring the 404 response
+
+When a file matching the request isn't found, Encore automatically serves a 404 Not Found response.
+
+You can customize the response by setting the `notFound` option to specify a file that should be served instead:
+
+```typescript
+import { api } from "encore.dev/api";
+
+export const assets = api.static(
+  { expose: true, path: "/!path", dir: "./assets", notFound: "./not_found.html" },
+);
+```
+
+## Performance
+
+When defining static files, the files are served directly from the Encore.ts Rust Runtime.
+This means that zero JavaScript code is executed to serve the files, freeing up the Node.js
+runtime to focus on executing business logic.
+
+This dramatically speeds up both the static file serving,
+as well as improving the latency of your API endpoints.
diff --git a/docs/ts/primitives/streaming-apis.mdx b/docs/ts/primitives/streaming-apis.mdx
new file mode 100644
index 0000000000..5e2d84d76e
--- /dev/null
+++ b/docs/ts/primitives/streaming-apis.mdx
@@ -0,0 +1,326 @@
+---
+seotitle: Developing Streaming APIs
+seodesc: Learn how to create services that stream data.
+title: Streaming APIs
+subtitle: How to create APIs that stream data
+lang: ts
+---
+
+Encore makes it easy to create API endpoints that can stream data to and from your applications.
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/streaming-chat"
+    desc="Simple chat app using the Streaming API create a WebSocket stream from a web frontend."
+/>
+
+## Different kinds of stream
+
+Encore supports three types of streams, each designed for a specific data flow direction:
+- [**StreamIn**](#streamin): When you need to stream data into your service.
+- [**StreamOut**](#streamout): When you need to stream data out from your service.
+- [**StreamInOut**](#streaminout): When you need to stream data into and out of your service.
+
+## How it works
+
+When you connect to a streaming API endpoint, the client and server will do a handshake in the form of a HTTP request. If the server accepts the handshake request, a stream is returned to the client and to the API handler. Under the hood the stream is a WebSocket that can be used to send and receive messages over.
+
+Path parameters, query parameters and headers can be passed via the handshake request. The stream returned to the client and to the API handler are typed with the incoming and outgoing message types that you specify in your API.
+
+## Defining streaming APIs
+
+Similar to how you can define [RESTful API endpoints](/docs/ts/primitives/defining-apis) with Encore, you can also easily define type-safe streaming API endpoints. They accept a handshake type, an incoming and an outgoing message type (depending on your choice of stream direction). The type parameters are required for Encore to understand your API.
+
+If you don't need any data from the handshake, you can ignore that type, and only specify the incoming and outgoing message types.
+
+<GitHubLink
+    href="https://github.com/encoredev/examples/tree/main/ts/streaming"
+    desc="Example showcases the all different streaming APIs: api.streamIn, api.streamOut, and api.streamInOut"
+/>
+
+### StreamIn
+
+Use `api.streamIn` when you want to have a stream from client to server, for example if you are uploading something from the client to the server:
+
+```typescript
+import { api } from "encore.dev/api";
+import log from "encore.dev/log";
+
+// Used to pass initial data, optional.
+interface Handshake {
+  user: string;
+}
+
+// What the clients sends over the stream.
+interface Message {
+  data: string;
+  done: boolean;
+}
+
+// Returned when the stream is done, optional.
+interface Response {
+  success: boolean;
+}
+
+export const uploadStream = api.streamIn<Handshake, Message, Response>(
+  { path: "/upload", expose: true },
+  async (handshake, stream) => {
+    const chunks: string[] = [];
+    try {
+      // The stream object is an AsyncIterator that yields incoming messages.
+      for await (const data of stream) {
+        chunks.push(data.data);
+        // Stop the stream if the client sends a "done" message
+        if (data.done) break;
+      }
+    } catch (err) {
+      log.error(`Upload error by ${handshake.user}:`, err);
+      return { success: false };
+    }
+    log.info(`Upload complete by ${handshake.user}`);
+    return { success: true };
+  },
+);
+```
+
+For `api.streamIn` you need to specify the incoming message type, the handshake type is optional. You can also specify a optional outgoing type if your API handler responds with some data when it is done with the incoming stream.
+
+```ts
+api.streamIn<Handshake, Incoming, Outgoing>(
+  {...}, async (handshake, stream): Promise<Outgoing> => {...})
+```
+
+```ts
+api.streamIn<Handshake, Incoming>(
+  {...}, async (handshake, stream) => {...})
+```
+
+```ts
+api.streamIn<Incoming, Outgoing>(
+  {...}, async (stream): Promise<Outgoing> => {...})
+```
+
+```ts
+api.streamIn<Incoming>(
+  {...}, async (stream) => {...})
+```
+
+### StreamOut
+
+Use `api.streamOut` if you want to have a stream of messages from the server to client, for example if you are streaming logs from the server:
+
+```typescript
+import { api, StreamOut } from "encore.dev/api";
+import log from "encore.dev/log";
+
+// Used to pass initial data, optional.
+interface Handshake {
+  rows: number;
+}
+
+// What the server sends over the stream.
+interface Message {
+  row: string;
+}
+
+export const logStream = api.streamOut<Handshake, Message>(
+  { path: "/logs", expose: true },
+  async (handshake, stream) => {
+    try {
+      for await (const row of mockedLogs(handshake.rows, stream)) {
+        // Send the message to the client
+        await stream.send({ row });
+      }
+    } catch (err) {
+      log.error("Upload error:", err);
+    }
+  },
+);
+
+// This function generates an async iterator that yields mocked log rows
+async function* mockedLogs(rows: number, stream: StreamOut<Message>) {
+  for (let i = 0; i < rows; i++) {
+    yield new Promise<string>((resolve) => {
+      setTimeout(() => {
+        resolve(`Log row ${i + 1}`);
+      }, 500);
+    });
+  }
+
+  // Close the stream when all logs have been sent
+  await stream.close();
+}
+```
+
+For `api.streamOut` you need to specify the outgoing message type, the handshake type is optional.
+
+```ts
+api.streamOut<Handshake, Outgoing>(
+  {...}, async (handshake, stream) => {...})
+```
+
+```ts
+api.streamOut<Outgoing>(
+  {...}, async (stream) => {...})
+```
+
+### StreamInOut
+
+Use `api.streamInOut` when you want to stream messages in both directions, for example if you are building a chat application:
+
+```typescript
+import { api } from "encore.dev/api";
+
+interface InMessage {
+  // ...
+}
+
+interface OutMessage {
+  // ...
+}
+
+export const ChatStream = api.streamInOut<InMessage, OutMessage>(
+  { path: "/chat", expose: true },
+  async (stream) => {
+    for await (const chatMessage of stream) {
+      // Respond to the message by sending something back
+      await stream.send({ /* ... */ })
+    }
+  }
+);
+```
+
+For `api.streamInOut` you need to specify both the incoming and outgoing message types, the handshake type is optional.
+
+```ts
+api.streamInOut<Handshake, Incoming, Outgoing>(
+  {...}, async (handshake, stream) => {...})
+```
+
+```ts
+api.streamInOut<Incoming, Outgoing>(
+  {...}, async (stream) => {...})
+```
+
+
+## Handshake
+
+When you connect to a streaming API endpoint, the client and server will do a handshake in the form of a HTTP request. For all stream types the handshake type is optional, and only needs to be used whenever you need data from the initial request, such as path parameters, query parameters or headers.
+
+Note that if you add a handshake data type you also get two arguments to your handler, one for the handshake data and one for the stream, and if you omit the handshake type you only get the stream.
+
+## Requiring authentication
+
+You can use your `authHandler` in the same way as for regular endpoints, just specify `auth: true` in your endpoint options. The auth data will be passed from the client to the server via query parameters or headers in the initial handshake request.
+
+After a request has been successfully authenticated, you can access authentication data passed from the `authHandler` by calling `getAuthData()`. See more details in the [auth handler docs](/docs/ts/develop/auth#authentication-handlers).
+
+## Broadcasting messages
+
+To broadcast messages to all connected clients, you can store the streams in a map and iterate over them when a new message is received. If a client disconnects, you can remove the stream from the map.
+
+```ts
+import { api, StreamInOut } from "encore.dev/api";
+
+// Map to hold all connected streams
+const connectedStreams: Map<
+  string,
+  StreamInOut<ChatMessage, ChatMessage>
+> = new Map();
+
+// Object sent from the client to the server when establishing a connection
+interface HandshakeRequest {
+  id: string;
+}
+
+// Object by both server and client
+interface ChatMessage {
+  username: string;
+  msg: string;
+}
+
+export const chat = api.streamInOut<HandshakeRequest, ChatMessage, ChatMessage>(
+  { expose: true, auth: false, path: "/chat" },
+  async (handshake, stream) => {
+    connectedStreams.set(handshake.id, stream);
+
+    try {
+      // The stream object is an AsyncIterator that yields incoming messages.
+      // The loop will continue as long as the client keeps the connection open.
+      for await (const chatMessage of stream) {
+        for (const [key, val] of connectedStreams) {
+          try {
+            // Send the users message to all connected clients.
+            await val.send(chatMessage);
+          } catch (err) {
+            // If there is an error sending the message, remove the client from the map.
+            connectedStreams.delete(key);
+          }
+        }
+      }
+    } catch (err) {
+      // If there is an error reading from the stream, remove the client from the map.
+      connectedStreams.delete(handshake.id);
+    }
+
+    // When the client disconnects, remove them from the map.
+    connectedStreams.delete(handshake.id);
+  },
+);
+```
+
+## Connecting with the client
+
+Using the [generated client](/docs/ts/cli/client-generation), you can connect to a streaming API endpoint that have `expose` set to `true`. The client stream acts as an async iterator, allowing you to retrieve messages by simply iterating over it:
+
+```typescript
+const stream = client.serviceName.endpointName();
+for await (const msg of stream) {
+  // Do something with each message
+}
+
+```
+
+To send messages to the service, use the async `send` method:
+
+```typescript
+const stream = client.serviceName.endpointName();
+await stream.send({ ... });
+```
+
+To handle network errors or do some cleanup after the connection is closed, you can attach event listeners on the underlying socket:
+
+```typescript
+const stream = client.serviceName.endpointName();
+
+stream.socket.on("error", (event) => {
+  // An error occurred
+});
+
+stream.socket.on("close", (event) => {
+  // Connection was closed
+});
+
+```
+
+## Service to service streaming
+
+Like with [other endpoint types](/docs/ts/primitives/api-calls) you can easily use streaming between services by importing `~encore/clients`.
+If you want the stream to only be reachable by other services (and not from the public internet), set the `expose` option to false.
+
+Example of using a stream endpoint from a regular api endpoint:
+
+```typescript
+import { chat } from "~encore/clients"; // import 'chat' service
+
+export const myOtherAPI = api({}, async (): Promise<void> => {
+  const stream = await chat.myStreamingEndpoint();
+
+  // send a message to the chat service over the stream
+  await stream.send({ msg: "data" });
+
+  for await (const msg of stream) {
+    // handle incoming message
+  }
+});
+```
+
diff --git a/docs/ts/primitives/validation.mdx b/docs/ts/primitives/validation.mdx
new file mode 100644
index 0000000000..5bdd1dd9dc
--- /dev/null
+++ b/docs/ts/primitives/validation.mdx
@@ -0,0 +1,512 @@
+---
+seotitle: Request validation with Encore.ts
+seodesc: Learn how to validation incoming requests with Encore.ts
+title: Validation
+subtitle: Validate incoming requests
+lang: ts
+---
+
+When receiving incoming requests it's best practice to validate the payload to ensure it meets your expectations and includes all required fields.
+
+Encore.ts has request validation built in, designed to work seamlessly with TypeScript. It uses the natural TypeScript types directly to validate incoming requests, so you get the best of both worlds: the clean, concise TypeScript syntax, and runtime schema validation. This means your APIs are type-safe during both runtime and compile-time.
+
+Encore.ts makes it easy to define API endpoints that combine data from different sources: some fields from the request body, others from the query parameters, and yet others from the HTTP headers. It looks like this:
+
+```ts
+import { Header, Query, api } from "encore.dev/api";
+
+interface Request {
+  // Optional query parameter. Parsed from the request URL.
+  limit?: Query<number>;
+
+  // Custom header that must be set. Parsed from the HTTP headers.
+  myHeader: Header<"X-My-Header">;
+
+  // Required enum. Parsed from the request body.
+  type: "sprocket" | "widget";
+}
+
+export const myEndpoint = api<Request, Response>(
+  { expose: true, method: "POST", path: "/api" },
+  async ({ limit, myHeader, type }) => {
+    // ...
+  },
+);
+```
+
+In the above example, if a request to the endpoint is missing the `X-My-Header` HTTP header or the `type` field in the request body, Encore will return a `400` Bad Request response. The `limit` query parameter is optional and will be either a number or `undefined` in the endpoint handler function.
+
+## Supported validation types
+
+### String fields
+
+```ts
+interface Schema {
+  name:  string;
+}
+```
+
+### Number fields
+
+The `number` type will accept both int and float values:
+
+```ts
+interface Schema {
+  age:  number;
+}
+```
+
+### Boolean fields
+
+```ts
+interface Schema {
+  isHuman:  boolean;
+}
+```
+
+### Array fields
+
+You can define fields wit array values of `string`, `number`, `boolean`, `null`:
+
+```ts
+interface Schema {
+  strings:  string[];
+  numbers:  number[];
+  booleans:  boolean[];
+  nulls: null[];
+}
+```
+
+You can have an array of objects:
+
+```ts
+interface Schema {
+  users:  { name: string; age: number }[];
+}
+```
+
+It is also possible to have arrays of multiple types:
+
+```ts
+interface Schema {
+  values:  (string | number)[];
+}
+```
+
+### Enum fields
+
+String enums can be used in the request schema to validate that a field is one of a set of predefined values. For example:
+
+```ts
+interface Schema {
+  type:  "BLOG_POST" | "COMMENT"
+}
+```
+
+You can also use TypeScript enums:
+
+```ts
+enum PostType {
+  BlogPost = "BLOG_POST",
+  Comment = "COMMENT"
+}
+
+interface Schema {
+  type: PostType,
+}
+```
+
+The two above examples are equivalent.
+
+### Optional fields
+
+You can make a field optional by adding a `?` after the field name:
+
+```ts
+interface Request {
+  name?: string;
+}
+
+export const myEndpoint = api(
+  { expose: true, method: "POST", path: "/body" },
+  async (req: Request) => {
+    // req.name is a string or undefined
+  },
+);
+```
+
+Request will reach the endpoint handler even if the `name` field is missing. If the field is missing, the value will be `undefined`.
+
+### Nullable fields
+
+You can make a field nullable by using the `| null` type:
+
+```ts
+interface Request {
+  name: string | null;
+}
+
+export const myEndpoint = api(
+  { expose: true, method: "POST", path: "/body" },
+  async (req: Request) => {
+    // req.name is a string or null
+  },
+);
+```
+
+### Union fields
+
+You can define a field that can be one of several types by using a union type:
+
+```ts
+interface Request {
+  value: string | number | boolean;
+}
+
+export const myEndpoint = api(
+  { expose: true, method: "POST", path: "/body" },
+  async (req: Request) => {
+    // req.value is a string, number, or boolean
+  },
+);
+```
+
+### Reference schema
+
+```ts
+interface Schema {
+  str: string; // String
+  int: number; // Number
+  list: number[]; // Array of numbers
+  listOfTypes: (number | string )[]; // Array multiple types
+  nullable: number | null; // Nullable
+  maybe?: string; // Optional
+  multiple: boolean | number | string | { name: string }; // Union
+  enum: "John" | "Foo"; // Enum
+}
+```
+
+## Value based validation rules
+
+Use Encore.ts's composable value based validation for use cases like checking the format of an email address or the length of a string.
+It uses TypeScript's type system and allows you to define validation rules directly in your type definitions.
+
+### Built-in validation Rules
+- `Min<N>` / `Max<N>`: Validate minimum/maximum values for numbers
+- `MinLen<N>` / `MaxLen<N>`: Validate minimum/maximum lengths for strings and arrays
+- `IsURL` / `IsEmail`: Validate that a string is a URL or email address
+- `StartsWith` / `EndsWith` / `MatchesRegexp`: Validate that a string matches a specific pattern
+
+
+### Examples
+
+Import validation rules from the `encore.dev/validate` package:
+
+```ts
+import { Min, Max, MinLen, MaxLen, IsEmail, IsURL } from "encore.dev/validate";
+
+interface Schema {
+  // Number between 3 and 1000 (inclusive)
+  count: number & (Min<3> & Max<1000>);
+
+  // String between 5 and 20 characters
+  username: string & (MinLen<5> & MaxLen<20>);
+
+  // Must be either a valid URL or email address
+  contact: string & (IsURL | IsEmail);
+
+  // Array of up to 10 email addresses
+  recipients: Array<string & IsEmail> & MaxLen<10>;
+}
+```
+
+### Combining Rules
+
+You can combine multiple validation rules using:
+- `&` (and) to require all rules to pass
+- `|` (or) to require at least one rule to pass
+
+```ts
+interface Schema {
+  // Must be both >= 3 and <= 1000
+  count: number & (Min<3> & Max<1000>);
+
+  // Must be either a URL or an email
+  contact: string & (IsURL | IsEmail);
+}
+```
+
+### Performance
+
+These validation rules are executed directly in Rust at runtime, before the request reaches your JavaScript code. This provides excellent performance while maintaining type safety at both compile-time and runtime.
+
+## Body
+
+By default, the data is parsed as a JSON body for incoming requests:
+
+```ts
+interface Request {
+  name: string; // Parsed from the JSON body
+}
+
+export const myEndpoint = api<Request, Response>(
+  { expose: true, method: "POST", path: "/body" },
+  async (req) => {
+    // req.name is a string
+  },
+);
+```
+
+Here, `name` is a required field in the request body. If the request body is missing the `name` field, Encore will return a `400` Bad Request response.
+
+## Query
+
+For HTTP methods that support request bodies, parameters are by default read from the HTTP request body as JSON. In those cases, the `Query` type can be used to specify that a field should be parsed from the query string instead.
+
+```typescript
+import { api, Query } from "encore.dev/api";
+
+interface Schema {
+  query: Query<string>; // this will be parsed from the '?query=...' parameter in the request url
+}
+// A simple API endpoint that echoes the data back.
+export const echo = api(
+  { method: "POST", path: "/example" },
+  async (params: Schema) => {
+    // params.query is a string
+  },
+);
+```
+
+This API endpoint expects incoming requests to look like this:
+```output
+POST /example?query=hello HTTP/1.1
+Content-Type: application/json
+```
+
+For `GET`, `HEAD` and `DELETE` requests, parameters are read and validated from the query string by default, since those HTTP methods do not support request bodies. For those methods, the `Query` type is not necessary:
+
+```typescript
+import { Query } from "encore.dev/api";
+
+interface Schema {
+  limit: Query<number>; // always a query parameter
+  author: string; // query if GET, HEAD or DELETE, otherwise body parameter
+}
+```
+
+### Nested query fields
+
+Using the `Query` type as a nested fields has no effect:
+
+```typescript
+import { api, Query } from "encore.dev/api";
+
+interface Data {
+  query: Query<string>; // this will be parsed from the '?query=...' parameter in the request url
+  nested: {
+    query2: Query<string>; // Query has no effect inside nested fields
+  };
+}
+
+export const echo = api(
+  { method: "POST", path: "/nested" },
+  async (params: Data) => {
+    // ...
+  },
+);
+```
+
+Nested query params will be sent as part of the JSON body. The above endpoint expects incoming requests to look like this:
+
+```output
+POST /nested HTTP/1.1
+Content-Type: application/json
+{
+   "nested": {
+      "query2": "not a query string"
+   }
+}
+```
+
+## Headers
+
+Request headers are defined and validated by setting the field type to `Header<"Name-Of-Header">`. It can be used in both request and response data types.
+
+In the example below, the `language` field will be fetched from the `Accept-Language` HTTP header. If the request is missing the `Accept-Language` header, Encore will return a `400` Bad Request response.
+
+```ts
+import { Header } from "encore.dev/api";
+
+interface Params {
+  language: Header<"Accept-Language">; // parsed from header
+  author: string; // not a header
+}
+```
+
+### Nested header fields
+
+Using the `Header` type as a nested fields has no effect:
+
+```typescript
+import { api, Header } from "encore.dev/api";
+
+interface Data {
+  header: Header<"X-Header">; // this field will be read from the http header
+  nested: {
+    header2: Header<"X-Other-Header">; // Header has no effect inside nested fields
+  };
+}
+
+// A simple API endpoint that echoes the data back.
+export const echo = api(
+  { method: "POST", path: "/nested" },
+  async (params: Data) => {
+    // ...
+  },
+);
+```
+
+Nested headers will be sent as part of the JSON body. The above endpoint expects incoming requests to look like this:
+
+```output
+POST /nested HTTP/1.1
+Content-Type: application/json
+X-Header: this is a header
+{
+   "nested": {
+      "header2": "not a header",
+   }
+}
+```
+
+## Params
+
+Dynamic path parameters are also defined in the request schema. The parameter will be parsed from the request URL and made available in the request object:
+
+```ts
+import { api } from "encore.dev/api";
+
+interface Request {
+  // Required path parameter. Parsed from the request URL.
+  id: string;
+}
+
+export const myEndpoint = api(
+  { expose: true, method: "POST", path: "/user/:id" },
+  async ({ id }: Request) => {
+    // ...
+  },
+);
+```
+
+You can also use the `number` type for path parameters:
+
+```ts
+interface Request {
+  id: number;
+}
+```
+
+Encore.ts will then try to parse the path parameter as a number. If the path parameter is not a valid number, Encore will return a `400` Bad Request response.
+
+## Combining sources
+
+You can combine data from different sources in the same request schema. For example, you can have fields that are parsed from the request body, others from the query parameters, and yet others from the HTTP headers. It looks like this:
+
+```ts
+import { Header, Query, api } from "encore.dev/api";
+
+interface Request {
+  // Required path parameter. Parsed from the request URL.
+  id: number;
+
+  // Optional query parameter. Parsed from the request URL.
+  limit?: Query<number>;
+
+  // Custom header that must be set. Parsed from the HTTP headers.
+  myHeader: Header<"X-My-Header">;
+
+  // Required enum. Parsed from the request body.
+  type: "sprocket" | "widget";
+}
+
+export const myEndpoint = api(
+  { expose: true, method: "POST", path: "/user/:id" },
+  async ({ id, limit, myHeader, type }: Request) => {
+    // ...
+  },
+);
+```
+
+## Errors
+
+If the validation is not successful, Encore will return a `400` Bad Request response with a JSON body that contains the error message:
+
+```output
+HTTP/1.1 400 Bad Request
+
+{
+  "code": "invalid_argument",
+  "message": "unable to decode request body",
+  "internal_message": "Error(\"missing field name\", line: 1, column: 18)"
+}
+```
+
+
+## Response
+
+Encore.ts will not perform runtime validation for response data, but you will get compilation errors if you try to return a value that does not match the expected response type.
+
+### Reusing the request type as the response type
+You often want to return the same data type that you received in a request. In this case, you can reuse the request type as the response type:
+
+```typescript
+import { api, Header, Query } from "encore.dev/api";
+
+interface Data {
+  header: Header<"X-Header">; // this field will be read from the http header
+  query: Query<string>; // this will be parsed from the '?query=...' parameter in the request url
+  body: string; // this will be sent as part of the JSON body
+}
+// A simple API endpoint that echoes the data back.
+export const echo = api(
+  { method: "POST", path: "/echo" },
+  async (params: Data): Promise<Data> => {
+    return params; // echo the data back
+  },
+);
+```
+
+This API endpoint expects incoming requests to look like this:
+```output
+POST /echo?query=hello HTTP/1.1
+Content-Type: application/json
+X-Header: this is a header
+{
+   "body": "a body",
+}
+```
+
+For HTTP responses the `Query<string>` type is considered to be part of the JSON response body, since query strings only make sense for incoming requests.
+Responses returned from this endpoint will be serialized as a HTTP response to looks like this:
+
+```output
+HTTP/1.1 200 OK
+Content-Type: application/json
+X-Header: this is a header
+{
+   "query": "hello",
+   "body": "a body",
+}
+```
+
+## Under the hood
+
+Encore.ts parses your source code to understand the request and response schema that each API endpoint expects, including things like HTTP headers, query parameters, and so on. The schemas are then processed, optimized, and stored as a Protobuf file.
+
+When the Encore.ts Rust runtime starts up, it reads the Protobuf file and pre-computes a request decoder and response encoder, optimized for each API endpoint, using the exact type definition each API endpoint expects. In fact, Encore.ts even handles request validation directly in Rust, ensuring invalid requests never have to even touch the JavaScript layer, mitigating many denial of service attacks.
+
+Encore’s understanding of the request schema also improves performance. JavaScript runtimes like Deno and Bun use a similar architecture (in fact, Deno also uses Rust+Tokio+Hyper), but lack Encore’s understanding of the request schema. As a result, they need to hand over the un-processed HTTP requests to the single-threaded JavaScript engine for execution.
+
+Encore.ts, on the other hand, handles much more of the request processing inside Rust, and only hands over the decoded request objects. By handling much more of the request life-cycle in multi-threaded Rust, the JavaScript event-loop is freed up to focus on executing application business logic instead of parsing HTTP requests, resulting in a significant performance improvement.
diff --git a/docs/ts/quick-start.mdx b/docs/ts/quick-start.mdx
new file mode 100644
index 0000000000..7c96a7c5f6
--- /dev/null
+++ b/docs/ts/quick-start.mdx
@@ -0,0 +1,229 @@
+---
+seotitle: Quick Start Guide – Learn how to build backends with Encore.ts
+seodesc: See how you to build and ship a cloud based backend application using Go and Encore. Install Encore and build a REST API in just a few minutes.
+title: Quick Start Guide
+subtitle: Build your first Encore.ts app in 5 minutes
+lang: ts
+---
+
+Follow the steps below or use [Leap](https://leap.new) to get started.
+
+<TryWithLeap />
+
+In this short guide, you'll learn key concepts and experience the Encore workflow.
+It should only take about 5 minutes to complete and by the end you'll have an API running in Encore's free development Cloud (Encore Cloud).
+
+To make it easy to follow along, we've laid out a trail of croissants to guide your way.
+Whenever you see a 🥐 it means there's something for you to do.
+
+## 1. Install the Encore CLI
+To develop with Encore, you need the Encore CLI. It provisions your local environment, and runs your local development dashboard complete with tracing and API documentation.
+
+🥐 Install by running the appropriate command for your system:
+
+<InstallInstructions/>
+
+### Prerequisites
+
+- [Node.js](https://nodejs.org/en/download/) is required to run Encore.ts apps.
+- [Docker](https://www.docker.com) is required for Encore to set up local databases.
+
+## 2. Create your app
+🥐 Create your app by running:
+
+```shell
+$ encore app create
+```
+
+🥐 Continue by picking a name for your app and select the Hello World template.
+
+If this is the first time you're using Encore, you'll be asked if you wish to create a free account.
+This is needed when you want Encore to manage functionality like secrets and handle cloud deployments (which we'll use later on in the tutorial).
+
+### Optional: Add Encore LLM instructions
+
+To help LLM powered tools like Cursor and GitHub Copilot understand how to use Encore, you can add pre-made instructions to your app.
+
+🥐 Download the [ts_llm_instructions.txt](https://github.com/encoredev/encore/blob/main/ts_llm_instructions.txt) file.
+  
+  **How to use:**
+  - Cursor: Rename the file to `.cursorrules`.
+  - GitHub Copilot: Paste content in `.github/copilot-instructions.md`.
+  - For other tools, place the file in your app root.
+
+### Let's take a look at the code
+
+Part of what makes Encore different is the simple developer experience when building distributed systems.
+Let's look at the code to better understand how to build applications with Encore.
+
+🥐 Open the `hello.ts` file in your code editor. It's located in the folder: `your-app-name/hello/`.
+
+You should see this:
+
+```ts
+-- hello/hello.ts --
+import { api } from "encore.dev/api";
+
+export const world = api(
+  { method: "GET", path: "/hello/:name", expose: true },
+  async ({ name }: { name: string }): Promise<Response> => {
+    return { message: `Hello ${name}!` };
+  },
+);
+
+interface Response {
+  message: string;
+}
+```
+
+As you can see, it's all standard TypeScript.
+
+You define an API endpoint by wrapping a regular async function in a call to `api`. Doing this makes Encore identify the `world` function as a public API endpoint. Encore automatically handles authentication, HTTP routing, request validation, error handling, observability, API documentation, and more.
+
+The `world` endpoint is part of the `hello` service because in the same folder you will also find a file named `encore.service.ts` which looks like this:
+
+```ts
+-- hello/encore.service.ts --
+import { Service } from "encore.dev/service";
+
+export default new Service("hello");
+```
+
+This is how you define services with Encore. Encore will now consider files in the `hello` directory and all its subdirectories as part of the `hello` service. If you want to create more services, simply create a new folders, add a `encore.service.ts` file that is exporting a new `Service`. _If you're curious, you can read more about defining [services](/docs/ts/primitives/services) and [APIs](/docs/ts/primitives/apis)._
+
+The Encore.ts [Backend Framework](/docs/ts) provides several declarative ways of using backend primitives like databases, Pub/Sub, and scheduled tasks by simply writing code.
+
+## 3. Start your app & Explore Local Development Dashboard
+
+🥐 Now let's run your app locally:
+
+```shell
+$ cd your-app-name # replace with the app name you picked
+$ encore run
+```
+
+You should see this:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/encorerun.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+That means your local development environment is up and running!
+Encore takes care of setting up all the necessary infrastructure for your applications, even including databases and Pub/Sub.
+
+### Open the Local Development Dashboard
+
+You can now start using your [Local Development Dashboard](/docs/ts/observability/dev-dash).
+
+🥐 Open [http://localhost:9400](http://localhost:9400) in your browser to access it.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/localdashvideo.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+The Local Development Dashboard is a powerful tool to help you move faster when you're developing new features.
+
+It comes with an API explorer, a Service Catalog with automatically generated documentation, and powerful observability features
+like [distributed tracing](/docs/ts/observability/tracing).
+
+Through the Local Development Dashboard you also have access to [Encore Flow](/docs/ts/observability/encore-flow),
+a visual representation of your microservice architecture that updates in real-time as you develop your application.
+
+### Call your API
+
+🥐 While you keep the app running, call your API from the API Explorer:
+
+<img className="mx-auto w-full" src="/assets/docs/qs_call.png" title="Call API from Local Dashboard" />
+
+You can also open a separate terminal to call your API endpoint:
+
+```shell
+$ curl http://localhost:4000/hello/world
+{"Message": "Hello, world!"}
+```
+
+If you see this JSON response, you've successfully made an API call to your very first Encore application. Well done, you're on your way!
+
+### Review a trace of the request
+
+You can now take a look at the trace for the request you just made by clicking on it in the right column in the local dashboard.
+
+<img className="mx-auto w-full" src="/assets/docs/qs_trace.png" title="Tracing in the Local Dashboard" />
+
+With such a simple API, there's not much to it, just a simple request and response.
+
+However, just imagine how powerful it is to have tracing when you're developing a more complex system with multiple services, Pub/Sub, and databases.
+(Learn more about Encore's tracing capabilities in the [tracing docs](/docs/ts/observability/tracing).)
+
+## 4. Make a code change
+
+Let's put our mark on this API and make our first code change.
+
+🥐 Head back to your code editor and look at the `hello.ts` file again.
+If you can't come up a creative change yourself, why not simply change the "Hello" message to a more sassy "Howdy"?
+
+🥐 Once you've made your change, save the file.
+
+When you save, the daemon run by the Encore CLI instantly detects the change and automatically recompiles your application and reloads your local development environment.
+
+The output where you're running your app will look something like this:
+
+```output
+Changes detected, recompiling...
+Reloaded successfully.
+INF registered endpoint endpoint=World path=/hello/:name service=hello
+INF listening for incoming HTTP requests
+```
+
+🥐 Test your change by calling your API again.
+
+```shell
+$ curl http://localhost:4000/hello/world
+{"Message": "Howdy, world!"}
+```
+
+Great job, you made a change and your app was reloaded automatically.
+
+Now you're ready to head to the cloud!
+
+## 5. Deploy your app
+
+### Generating Docker image
+
+You can either deploy by generating a Docker image for your app using:
+```shell
+$ encore build docker MY-IMAGE:TAG
+````
+
+This will compile your application using the host machine and then produce a Docker image containing the compiled application.
+You can now deploy this anywhere you like. Learn more in the [self-host docs](/docs/ts/self-host/build).
+
+### Deploy using Encore Cloud
+Optionally, you can use [Encore Cloud](https://encore.dev/use-cases/devops-automation) to automatically deploy your application.
+It comes with built-in free development hosting, and for production offers fully automated deployment to your own cloud on AWS or GCP.
+
+🥐 To deploy, simply push your changes to Encore:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Encore Cloud will now build and test your app, provision the needed infrastructure, and deploy your application to a staging environment.
+
+After triggering the deployment, you will see a URL where you can view its progress in the Encore Cloud dashboard.
+It will look something like: `https://app.encore.cloud/$APP_ID/deploys/...`
+
+🥐 Open the URL to access the Cloud Dashboard and check the progress of your deployment.
+
+You can now use the Cloud Dashboard to view production [traces](/docs/ts/observability/tracing), [connect your cloud account](/docs/platform/deploy/own-cloud), [integrate with GitHub](/docs/platform/integrations/github), and much more.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/webdashvideo.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+## What's next?
+
+- Check out the [REST API tutorial](/docs/ts/tutorials/rest-api) to learn how to create endpoints, use databases, and more.
+- Join the friendly community on [Discord](/discord) to ask questions and meet other Encore developers.
diff --git a/docs/ts/self-host/build.md b/docs/ts/self-host/build.md
new file mode 100644
index 0000000000..071b7fedd0
--- /dev/null
+++ b/docs/ts/self-host/build.md
@@ -0,0 +1,33 @@
+---
+seotitle: Build Docker Images
+seodesc: Learn how to build Docker images for your Encore application, which can be self-hosted on your own infrastructure.
+title: Build Docker Images
+lang: ts
+---
+
+Encore supports building Docker images directly from the CLI, which can then be self-hosted on your own infrastructure of choice.
+
+This can be a good choice if [Encore Cloud](/docs/platform) isn't a good fit for your use case, or if you want to [migrate away](/docs/ts/migration/migrate-away).
+
+## Building your own Docker image
+
+To build your own Docker image, use `encore build docker MY-IMAGE:TAG` from the CLI.
+
+This will compile your application using the host machine and then produce a Docker image containing the compiled application. The base image defaults to `scratch` for GO apps and `node:slim` for TS, but can be customized with `--base`.
+
+This is exactly the same code path that Encore's CI system uses to build Docker images, ensuring compatibility.
+
+By default, all your services are included and started by the Docker image. If you want to specify specific services and gateways to include, you can use the `--services` and `--gateways` flags.
+
+```bash
+encore build docker --services=service1,service2 --gateways=api-gateway MY-IMAGE:TAG
+```
+
+The image will default to run on port 8080, but you can customize it by setting the `PORT` environment variable when starting your image.
+
+```bash
+docker run -e PORT=8081 -p 8081:8081 MY-IMAGE:TAG
+```
+
+Congratulations, you've built your own Docker image! 🎉
+Continue to learn how to [configure infrastructure](/docs/ts/self-host/configure-infra).
diff --git a/docs/ts/self-host/ci-cd.md b/docs/ts/self-host/ci-cd.md
new file mode 100644
index 0000000000..9b1e459a66
--- /dev/null
+++ b/docs/ts/self-host/ci-cd.md
@@ -0,0 +1,85 @@
+---
+seotitle: Integrate with your CI/CD pipeline
+seodesc: Learn how to integrate Encore.ts with your CI/CD pipeline.
+title: Integrate with your CI/CD pipeline
+lang: ts
+---
+
+Encore seamlessly integrates with any CI/CD pipeline through its CLI tools. You can automate Docker image creation using the `encore build` command as part of your deployment workflow.
+
+## Integrating with CI/CD Platforms
+
+While every CI/CD pipeline is unique, integrating Encore follows a straightforward process. Here are the key steps:
+
+1. Install the Encore CLI in your CI environment
+2. Use `encore build docker` to create Docker images
+3. Push the images to your container registry
+4. Deploy to your infrastructure
+
+Refer to your CI/CD platform's documentation for more details on how to integrate CLI tools like `encore build`.
+
+### GitHub actions example
+
+This example shows how to build, push, and deploy an Encore Docker image to DigitalOcean using GitHub Actions.
+The DigitalOcean application is set up re-deploy the application every time an image with the tag `latest` is uploaded. 
+
+```yaml
+name: Build, Push and Deploy a Encore Docker Image to DigitalOcean
+
+on:
+  push:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-push-deploy-image:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download Encore CLI script
+        uses: sozo-design/curl@v1.0.2
+        with:
+          args: --output install.sh -L https://encore.dev/install.sh
+
+      - name: Install Encore CLI
+        run: bash install.sh
+
+      - name: Log in to DigitalOcean container registry
+        run: docker login registry.digitalocean.com -u my-email@gmail.com -p ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
+
+      - name: Build Docker image
+        run: /home/runner/.encore/bin/encore build docker myapp
+
+      - name: Tag Docker image
+        run: docker tag myapp registry.digitalocean.com/<YOUR_CONTAINER_REGISTRY_NAME>/<YOUR_IMAGE_REPOSITORY_NAME>:latest
+
+      - name: Push Docker image
+        run: docker push registry.digitalocean.com/<YOUR_CONTAINER_REGISTRY_NAME>/<YOUR_IMAGE_REPOSITORY_NAME>:latest
+```
+
+## Building Docker Images
+
+The `encore build docker` command provides several options to customize your builds:
+
+```bash
+# Build specific services and gateways
+encore build docker --services=service1,service2 --gateways=api-gateway MY-IMAGE:TAG
+
+# Customize the base image
+encore build docker --base=node:18-alpine MY-IMAGE:TAG
+```
+
+The image will default to run on port 8080, but you can customize it by setting the `PORT` environment variable when starting your image.
+
+```bash
+docker run -e PORT=8081 -p 8081:8081 MY-IMAGE:TAG
+```
+
+Learn more about the `encore build docker` command in the [build Docker images](/docs/ts/self-host/build) guide.
+
+Continue to learn how to [configure infrastructure](/docs/ts/self-host/configure-infra).
diff --git a/docs/ts/self-host/configure-infra.md b/docs/ts/self-host/configure-infra.md
new file mode 100644
index 0000000000..955ac31edf
--- /dev/null
+++ b/docs/ts/self-host/configure-infra.md
@@ -0,0 +1,523 @@
+---
+title: Configure Infrastructure
+seotitle: Configure Infrastructure
+seodesc: Learn how to configure infrastructure resources for your Encore app.
+lang: ts
+---
+
+If you are using infrastructure resources, such as SQL databases, Pub/Sub, or metrics, you will need to configure your Docker image with the necessary configuration.
+The `build` command lets you provide this by specifying a path to a config file using the `--config` flag.
+
+```bash
+encore build docker --config path/to/infra-config.json MY-IMAGE:TAG
+```
+
+The configuration file should be a JSON file using the [Encore Infra Config](https://encore.dev/schemas/infra.schema.json) schema.
+
+This supports configuring things like:
+
+- How to access infrastructure resources (what provider to use, what credentials to use, etc.)
+- How to call other services over the network ("service discovery"),
+  most notably their base URLs.
+- Observability configuration (where to export metrics, etc.)
+- Metadata about the environment the application is running in, to power Encore's metadata APIs.
+- The values for any application-defined secrets.
+
+This configuration is necessary for the application to behave correctly.
+
+## Example
+
+Here's an example configuration file you can use.
+
+```json
+{
+  "$schema": "https://encore.dev/schemas/infra.schema.json",
+  "metadata": {
+    "app_id": "my-app",
+    "env_name": "my-env",
+    "env_type": "production",
+    "cloud": "gcp",
+    "base_url": "https://my-app.com"
+  },
+  "sql_servers": [
+    {
+      "host": "my-db-host:5432",
+      "databases": {
+        "my-db": {
+          "username": "my-db-owner",
+          "password": {"$env": "DB_PASSWORD"}
+        }
+      }
+    }
+  ],
+  "service_discovery": {
+    "myservice": {
+      "base_url": "https://myservice:8044"
+    }
+  },
+  "redis": {
+    "encoreredis": {
+      "database_index": 0,
+      "auth": {
+        "type": "acl",
+        "username": "encoreredis",
+        "password": {"$env": "REDIS_PASSWORD"}
+      },
+      "host": "my-redis-host",
+    }
+  },
+  "metrics": {
+    "type": "prometheus",
+    "remote_write_url": "https://my-remote-write-url"
+  },
+  "graceful_shutdown": {
+    "total": 30
+  },
+  "auth": [
+    {
+      "type": "key",
+      "id": 1,
+      "key": {"$env": "SVC_TO_SVC_KEY"}
+    }
+  ],
+  "secrets": {
+    "AppSecret": {"$env": "APP_SECRET"}
+  },
+  "pubsub": [
+    {
+      "type": "gcp_pubsub",
+      "project_id": "my-project",
+      "topics": {
+        "encore-topic": {
+          "name": "gcp-topic-name",
+          "subscriptions": {
+            "encore-subscription": {
+              "name": "gcp-subscription-name"
+            }
+          }
+        }
+      }
+    }
+  ],
+  "object_storage": [
+    {
+      "type": "gcs",
+      "buckets": {
+          "my-gcs-bucket": {
+            "name": "my-gcs-bucket",
+          }
+        }
+    }
+  ]
+}
+```
+
+## Configuring Infrastructure
+To use infrastructure resources, additional configuration must be added so that Encore is aware of how to access each infrastructure resource.
+See below for examples of each type of infrastructure resource.
+
+### 1. Basic Environment Metadata Configuration
+
+```json
+{
+  "metadata": {
+    "app_id": "my-encore-app",
+    "env_name": "production",
+    "env_type": "production",
+    "cloud": "aws",
+    "base_url": "https://api.myencoreapp.com"
+  }
+}
+```
+
+- `app_id`: The ID of your Encore application.
+- `env_name`: The environment name, such as `production`, `staging`, or `development`.
+- `env_type`: Specifies the type of environment (`production`, `test`, `development`, or `ephemeral`).
+- `cloud`: The cloud provider hosting the infrastructure (e.g., `aws`, `gcp`, or `azure`).
+- `base_url`: The base URL for services in the environment.
+
+### 2. Graceful Shutdown Configuration
+
+```json
+{
+  "graceful_shutdown": {
+    "total": 30,
+    "shutdown_hooks": 10,
+    "handlers": 20
+  }
+}
+```
+
+- `total`: The total time allowed for the shutdown process in seconds.
+- `shutdown_hooks`: The time allowed for executing shutdown hooks.
+- `handlers`: The time allocated for processing request handlers during the shutdown.
+
+### 3. Authentication Methods Configuration
+Private endpoints will not require authentication if no authentication methods are specified. This is typically fine when services are deployed on a private network such as a VPC. But sometimes you might need to connect to other services over the public internet, in which case you'll want to ensure private endpoints are only accessible to other backend services. To do that you can configure authentication methods.
+Encore currently supports authentication through a shared key, which you can specify in your infrastructure configuration file.
+```json
+{
+  "auth": [
+    {
+      "type": "key",
+      "id": 1,
+      "key": {
+        "$env": "SERVICE_API_KEY"
+      }
+    }
+  ]
+}
+```
+
+- `type`: The authentication method type (e.g., `key`).
+- `id`: The ID associated with the authentication method.
+- `key`: The authentication key, which can be set using an environment variable reference.
+
+### 4. Service Discovery Configuration
+Service discovery is used to access other services over the network. You can configure service discovery in the infrastructure configuration file.
+If you export all services into the same docker image, you don't need to configure service discovery as it will be automatically
+configured when the services are started.
+
+```json
+{
+  "service_discovery": {
+    "user-service": {
+      "base_url": "https://user.myencoreapp.com",
+      "auth": [
+        {
+          "type": "key",
+          "id": 1,
+          "key": {
+            "$env": "USER_SERVICE_API_KEY"
+          }
+        }
+      ]
+    }
+  }
+}
+```
+
+- `user-service`: Configuration for a service named `user-service`.
+- `base_url`: The base URL for the service.
+- `auth`: Authentication methods used for accessing the service. If no authentication methods are specified, the service will use the auth methods defined in the `auth` section.
+
+### 5. Metrics Configuration
+Similarly to cloud infrastructure resources, Encore supports configurable metrics exports:
+
+* Prometheus
+* DataDog
+* GCP Cloud Monitoring
+* AWS CloudWatch
+
+This is configured by setting the metrics field. Below are examples for each of the supported metrics providers:
+#### 5.1. Prometheus Configuration
+
+```json
+{
+  "metrics": {
+    "type": "prometheus",
+    "collection_interval": 15,
+    "remote_write_url": {
+      "$env": "PROMETHEUS_REMOTE_WRITE_URL"
+    }
+  }
+}
+```
+
+#### 5.2. Datadog Configuration
+
+```json
+{
+  "metrics": {
+    "type": "datadog",
+    "collection_interval": 30,
+    "site": "datadoghq.com",
+    "api_key": {
+      "$env": "DATADOG_API_KEY"
+    }
+  }
+}
+```
+
+#### 5.3. GCP Cloud Monitoring Configuration
+
+```json
+{
+  "metrics": {
+    "type": "gcp_cloud_monitoring",
+    "collection_interval": 60,
+    "project_id": "my-gcp-project",
+    "monitored_resource_type": "gce_instance",
+    "monitored_resource_labels": {
+      "instance_id": "1234567890",
+      "zone": "us-central1-a"
+    },
+    "metric_names": {
+      "cpu_usage": "compute.googleapis.com/instance/cpu/usage_time"
+    }
+  }
+}
+```
+
+#### 5.4. AWS CloudWatch Configuration
+
+```json
+{
+  "metrics": {
+    "type": "aws_cloudwatch",
+    "collection_interval": 60,
+    "namespace": "MyAppMetrics"
+  }
+}
+```
+
+### 6. SQL Database Configuration
+The SQL databases you've declared in your Encore app must be configured in the infrastructure configuration file.
+There must be exactly one database configuration for each declared database. You can configure multiple SQL servers if needed.
+
+```json
+{
+  "sql_servers": [
+    {
+      "host": "db.myencoreapp.com:5432",
+      "tls_config": {
+        "disabled": false,
+        "ca": "---BEGIN CERTIFICATE---\n..."
+      },
+      "databases": {
+        "main_db": {
+          "max_connections": 100,
+          "min_connections": 10,
+          "username": "db_user",
+          "password": {
+            "$env": "DB_PASSWORD"
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+- `host`: SQL server host, optionally including the port.
+- `tls_config`: TLS configuration for secure connections. If the server uses TLS with a non-system CA root, or requires a client certificate, specify the appropriate fields as PEM-encoded strings. Otherwise, they can be left empty.
+- `databases`: List of databases, each with connection settings.
+
+### 7. Secrets Configuration
+
+#### 7.1. Using Direct Secrets
+You can set the secret value directly in the configuration file, or use an environment variable reference to set the secret value.
+
+```json
+{
+  "secrets": {
+    "API_TOKEN": "embedded-secret-value",
+    "DB_PASSWORD": {
+      "$env": "DB_PASSWORD"
+    }
+  }
+}
+```
+
+#### 7.2. Using Environment Reference
+As an alternative, you can use an environment variable reference to set the secret value. The env variable should be set in the environment where the application is running. The content
+of the environment variable should be a JSON string where each key is the secret name and the value is the secret value.
+
+```json
+{
+  "secrets": {
+    "$env": "SECRET_JSON"
+  }
+}
+```
+
+### 8. Redis Configuration
+
+```json
+{
+  "redis": {
+    "cache": {
+      "host": "redis.myencoreapp.com:6379",
+      "database_index": 0,
+      "auth": {
+        "type": "auth",
+        "auth_string": {
+          "$env": "REDIS_AUTH_STRING"
+        }
+      },
+      "max_connections": 50,
+      "min_connections": 5
+    }
+  }
+}
+```
+
+- `host`: Redis server host, optionally including the port.
+- `auth`: Authentication configuration for the Redis server.
+- `key_prefix`: Prefix applied to all keys.
+
+### 9. Pub/Sub Configuration
+Encore currently supports the following Pub/Sub providers:
+- `nsq` for [NSQ](https://nsq.io/)
+- `gcp` for [Google Cloud Pub/Sub](https://cloud.google.com/pubsub)
+- `aws` for AWS [SNS](https://aws.amazon.com/sns/) + [SQS](https://aws.amazon.com/sqs/)
+- `azure` for [Azure Service Bus](https://azure.microsoft.com/en-us/products/service-bus)
+
+The configuration for each provider is different. Below are examples for each provider.
+#### 9.1. GCP Pub/Sub
+
+```json
+{
+  "pubsub": [
+    {
+      "type": "gcp_pubsub",
+      "project_id": "my-gcp-project",
+      "topics": {
+        "user-events": {
+          "name": "user-events-topic",
+          "project_id": "my-gcp-project",
+          "subscriptions": {
+            "user-notification": {
+              "name": "user-notification-subscription",
+              "push_config": {
+                "id": "user-push",
+                "service_account": "service-account@my-gcp-project.iam.gserviceaccount.com"
+              }
+            }
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+#### 9.2. AWS SNS/SQS
+
+```json
+{
+  "pubsub": [
+    {
+      "type": "aws_sns_sqs",
+      "topics": {
+        "user-notifications": {
+          "arn": "arn:aws:sns:us-east-1:123456789012:user-notifications",
+          "subscriptions": {
+            "user-queue": {
+              "arn": "arn:aws:sqs:us-east-1:123456789012:user-queue"
+            }
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+#### 9.3. NSQ Configuration
+
+```json
+{
+  "pubsub": [
+    {
+      "type": "nsq",
+      "hosts": "nsq.myencoreapp.com:4150",
+      "topics": {
+        "order-events": {
+          "name": "order-events-topic",
+          "subscriptions": {
+            "order-processor": {
+              "name": "order-processor-subscription"
+            }
+          }
+        }
+      }
+    }
+  ]
+}
+```
+
+### 10. Object Storage Configuration
+Encore currently supports the following object storage providers:
+- `gcs` for [Google Cloud Storage](https://cloud.google.com/storage)
+- `s3` for [AWS S3](https://aws.amazon.com/s3/) or a custom S3-compatible provider
+
+#### 10.1. GCS Configuration
+
+```json
+{
+  "object_storage": [
+    {
+      "type": "gcs",
+      "buckets": {
+        "my-gcs-bucket": {
+          "name": "my-gcs-bucket",
+          "key_prefix": "my-optional-prefix/",
+          "public_base_url": "https://my-gcs-bucket-cdn.example.com/my-optional-prefix"
+        }
+      }
+    }
+  ]
+}
+```
+
+- `name`: The full name of the GCS bucket.
+- `key_prefix`: An optional prefix to apply to all keys in the bucket.
+- `public_base_url`: A URL to use for public access to the bucket. This field is required if you configure your bucket to be public. Encore will append the object key to this URL when generating public URLs. The optional prefix will not be appended.
+
+#### 10.2. S3 Configuration
+
+```json
+{
+  "object_storage": [
+    {
+      "type": "s3",
+      "region": "us-east-1",
+      "buckets": {
+        "my-s3-bucket": {
+          "name": "my-s3-bucket",
+          "key_prefix": "my-optional-prefix/",
+          "public_base_url": "https://my-gcs-bucket-cdn.example.com/my-optional-prefix"
+        }
+      }
+    }
+  ]
+}
+```
+
+- `region`: The AWS region where the bucket is located.
+- `name`: The full name of the S3 bucket.
+- `key_prefix`: An optional prefix to apply to all keys in the bucket.
+- `public_base_url`: A URL to use for public access to the bucket. This field is required if you configure your bucket to be public. Encore will append the object key to this URL when generating public URLs. The optional prefix will not be appended.
+
+#### 10.3. Custom S3 Provider Configuration
+You can also configure a custom S3 provider by specifying the endpoint, access key id, and secret access key. Custom S3 providers are useful if you are using a S3-compatible storage provider such as [Cloudflare R2](https://developers.cloudflare.com/r2/).
+```json
+{
+  "object_storage": [
+    {
+      "type": "s3",
+      "region": "auto",
+      "endpoint": "https://...",
+      "access_key_id": "...",
+      "secret_access_key": {
+          "$env": "BUCKET_SECRET_ACCESS_KEY"
+      },
+      "buckets": {
+        "my-s3-bucket": {
+          "name": "my-s3-bucket",
+          "key_prefix": "my-optional-prefix/",
+          "public_base_url": "https://my-gcs-bucket-cdn.example.com/my-optional-prefix"          
+        }
+      }
+    }
+  ]
+}
+```
+
+- `region`: The region where the bucket is located.
+- `name`: The full name of the bucket
+- `key_prefix`: An optional prefix to apply to all keys in the bucket.
+- `public_base_url`: A URL to use for public access to the bucket. This field is required if you configure your bucket to be public. Encore will append the object key to this URL when generating public URLs. The optional prefix will not be appended.
+
+This guide covers typical infrastructure configurations. Adjust according to your specific requirements to optimize your Encore app's infrastructure setup.
diff --git a/docs/ts/self-host/deploy-to-digital-ocean.md b/docs/ts/self-host/deploy-to-digital-ocean.md
new file mode 100644
index 0000000000..9e5164ae2b
--- /dev/null
+++ b/docs/ts/self-host/deploy-to-digital-ocean.md
@@ -0,0 +1,201 @@
+---
+seotitle: How to deploy an Encore app to DigitalOcean
+seodesc: Learn how to deploy an Encore application to DigitalOcean's App Platform using Docker.
+title: Deploy to DigitalOcean
+lang: ts
+---
+
+If you prefer manual deployment over the automation offered by Encore's Platform, Encore simplifies the process of deploying your app to the cloud provider of your choice. This guide will walk you through deploying an Encore app to DigitalOcean's App Platform using Docker.
+
+### Video tutorial
+<iframe width="560" height="315" src="https://www.youtube.com/embed/D3SjuCK_5qE?si=zLxEzG7dgTBlPkwU" title="Deploying a TypeScript backend to DigitalOcean using Docker & GitHub Actions" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe>
+
+### Prerequisites
+1. **DigitalOcean Account**: Make sure you have a DigitalOcean account. If not, you can [sign up here](https://www.digitalocean.com/).
+2. **Docker Installed**: Ensure Docker is installed on your local machine. You can download it from the [Docker website](https://www.docker.com/get-started).
+3. **Encore CLI**: Install the Encore CLI if you haven’t already. You can follow the installation instructions from the [Encore documentation](https://encore.dev/docs/ts/install).
+4. **DigitalOcean CLI (Optional)**: You can install the DigitalOcean CLI for more flexibility and automation, but it’s not necessary for this tutorial.
+
+### Step 1: Create an Encore App
+1. **Create a New Encore App**: 
+    - If you haven’t already, create a new Encore app using the Encore CLI.
+    - You can use the following command to create a new app:
+    ```bash
+    encore app create myapp
+    ``` 
+    - Select the `Hello World` template.
+    - Follow the prompts to create the app.
+
+2. **Build a Docker image**:
+    - Build the Encore app to generate the docker image for deployment:
+    ```bash
+    encore build docker myapp  
+    ```
+### Step 2: Push the Docker Image to a Container Registry
+To deploy your Docker image to DigitalOcean, you need to push it to a container registry. DigitalOcean supports
+its own container registry, but you can also use DockerHub or other registries. Here’s how to push the image to DigitalOcean’s registry:
+
+1. **Create a DigitalOcean Container Registry**:
+    - Go to the [DigitalOcean Control Panel](https://cloud.digitalocean.com/registries) and create a new container registry.
+    - Follow the instructions to set it up.
+
+2. **Login to DigitalOcean's registry**:
+   Use the login command provided by DigitalOcean, which will look something like this:
+   ```bash
+   doctl registry login
+   ```
+   You’ll need the DigitalOcean CLI for this, which can be installed from [DigitalOcean CLI documentation](https://docs.digitalocean.com/reference/doctl/how-to/install/).
+
+3. **Tag your Docker image**:
+   Tag your image to match the registry’s URL.
+   ```bash
+   docker tag myapp registry.digitalocean.com/YOUR_REGISTRY_NAME/myapp:latest
+   ```
+
+4. **Push your Docker image to the registry**:
+   ```bash
+   docker push registry.digitalocean.com/YOUR_REGISTRY_NAME/myapp:latest
+   ```
+
+### Step 3: Deploy the Docker Image to DigitalOcean App Platform
+1. **Navigate to the App Platform**:
+   Go to [DigitalOcean's App Platform](https://cloud.digitalocean.com/apps).
+
+2. **Create a New App**:
+    - Click on **"Create App"**.
+    - Choose the **"DigitalOcean Container Registry"** option.
+
+3. **Select the Docker Image Source**:
+    - Select the image you pushed earlier.
+
+4. **Configure the App Settings**:
+    - **Set up scaling options**: Configure the number of containers, CPU, and memory settings.
+    - **Environment variables**: Add any environment variables your application might need.
+    - **Choose the region**: Pick a region close to your users for better performance.
+
+5. **Deploy the App**:
+    - Click **"Next"**, review the settings, and click **"Create Resources"**.
+    - DigitalOcean will take care of provisioning the infrastructure, pulling the Docker image, and starting the application.
+
+### Step 4: Monitor and Manage the App
+1. **Access the Application**:
+    - Once deployed, you will get a public URL to access your application.
+    - Test the app to ensure it’s running as expected, e.g. 
+   ```bash
+      curl https://myapp.ondigitalocean.app/hello/world
+    ```
+
+2. **View Logs and Metrics**:
+    - Go to the **"Runtime Logs"** tab in the App Platform to view logs
+    - Go to the **"Insights"** tab to view performance metrics.
+
+3. **Manage Scaling and Deployment Settings**:
+    - You can change the app configuration, such as scaling settings, deployment region, or environment variables.
+
+### Step 5: Add a Database to Your App
+
+DigitalOcean’s App Platform provides managed databases, allowing you to add a database to your app easily. Here’s how to set up a managed database for your app:
+
+1. **Navigate to the DigitalOcean Control Panel**:
+   - Go to [DigitalOcean Control Panel](https://cloud.digitalocean.com/).
+   - Click on **"Databases"** in the left-hand sidebar.
+
+2. **Create a New Database Cluster**:
+   - Click **"Create Database Cluster"**.
+   - Choose **PostgreSQL**
+   - Select the **database version**, **data center region**, and **cluster configuration** (e.g., development or production settings based on your needs).
+   - **Name the database** and configure other settings if necessary, then click **"Create Database Cluster"**.
+
+3. **Configure the Database Settings**:
+   - Once the database is created, go to the **"Connection Details"** tab of the database dashboard.
+   - Copy the **connection string** or individual settings (host, port, username, password, database name). You will need these details to connect your app to the database.
+   - Download the **CA certificate**
+
+4. **Create a Database**
+   - Connect to the database using the connection string provided by DigitalOcean.
+   ```bash
+   psql -h mydb.db.ondigitalocean.com -U doadmin -d mydb -p 25060
+   ```
+   - Create a database
+   ```sql
+    CREATE DATABASE mydb;
+    ```
+   - Create a table
+   ```sql
+     CREATE TABLE users (
+        id SERIAL PRIMARY KEY,
+        name VARCHAR(50)
+     );
+     INSERT INTO users (name) VALUES ('Alice');
+   ```
+   
+5. **Declare a Database in your Encore app**:
+   - Open your Encore app’s codebase.
+   - Add `mydb` database to your app ([Encore Database Documentation](https://encore.dev/docs/ts/primitives/databases))
+   ```typescript
+      const mydb = new SQLDatabase("mydb", {
+         migrations: "./migrations",
+      });
+
+      export const getUser = api(
+        { expose: true, method: "GET", path: "/names/:id" },
+        async ({id}: {id:number}): Promise<{ id: number; name: string }> => {
+          return await mydb.queryRow`SELECT * FROM users WHERE id = ${id}` as { id: number; name: string };
+        }
+      );
+   ```
+
+6. **Create an Encore Infrastructure config**
+   - Create a file named `infra.config.json` in the root of your Encore app.
+   - Add the **CA certificate** and the connection details to the file:
+   ```json
+   {
+      "$schema": "https://encore.dev/schemas/infra.schema.json",
+      "sql_servers": [
+      {
+         "host": "mydb.db.ondigitalocean.com:25060",
+         "tls_config": {
+            "ca": "-----BEGIN CERTIFICATE-----\n..."
+         },
+         "databases": {
+            "mydb": {
+               "name": "mydb",
+               "username": "doadmin",
+               "password": {"$env": "DB_PASSWORD"}
+             }
+         }
+      }]   
+   }
+   ```
+
+7. **Set Up Environment Variables (Optional)**:
+   - Go to the DigitalOcean App Platform dashboard.
+   - Select your app.
+   - In the **"Settings"** section, go to **"App-Level Environment Variables"**
+   - Add the database password as an encrypted environment variable called `DB_PASSWORD`.
+
+8. **Build and push the Docker image**:
+   - Build the Docker image with the updated configuration.
+   ```bash
+   encore build docker --config infra.config.json myapp
+   ```
+   - Tag and push the Docker image to the DigitalOcean container registry.
+   ```bash
+   docker tag myapp registry.digitalocean.com/YOUR_REGISTRY_NAME/myapp:latest
+   docker push registry.digitalocean.com/YOUR_REGISTRY_NAME/myapp:latest
+   ```
+
+9. **Test the Database Connection**:
+   - Redeploy the app on DigitalOcean to apply the changes.
+   - Test the database connection by calling the API
+   ```bash
+    curl https://myapp.ondigitalocean.app/names/1
+   ```
+
+### Troubleshooting Tips
+- **Deployment Failures**: Check the build logs for any errors. Make sure the Docker image is correctly tagged and pushed to the registry.
+- **App Not Accessible**: Verify that the correct port is exposed in the Dockerfile and the App Platform configuration.
+- **Database Connection Issues**: Ensure the database connection details are correct and the database is accessible from the app.
+
+### Conclusion
+That’s it! You’ve successfully deployed an Encore app to DigitalOcean’s App Platform using Docker. You can now scale your app, monitor its performance, and manage it easily through the DigitalOcean dashboard. If you encounter any issues, refer to the DigitalOcean documentation or the Encore community for help. Happy coding!
diff --git a/docs/ts/self-host/deploy-to-railway.md b/docs/ts/self-host/deploy-to-railway.md
new file mode 100644
index 0000000000..1479957d8a
--- /dev/null
+++ b/docs/ts/self-host/deploy-to-railway.md
@@ -0,0 +1,259 @@
+---
+seotitle: How to deploy an Encore app to Railway
+seodesc: Learn how to deploy an Encore application to Railway using Docker and GitHub Actions.
+title: Deploy to Railway
+lang: ts
+---
+
+If you prefer manual deployment over the automation offered by Encore's Platform, Encore simplifies the process of deploying your app to the cloud provider of your choice. This guide will walk you through deploying an Encore app to Railway using Docker through GitHub Actions.
+
+### Prerequisites
+1. **Railway Account**: Make sure you have a Railway account. If not, you can [sign up here](https://railway.com/).
+2. **Docker Installed**: Ensure Docker is installed on your local machine, Docker is used by Encore to run databases locally. You can download it from the [Docker website](https://www.docker.com/get-started).
+3. **Encore CLI**: Install the Encore CLI if you haven’t already. You can follow the installation instructions from the [Encore documentation](https://encore.dev/docs/ts/install).
+
+### Step 1: Create an Encore App and a GitHub repository
+1. **Create a New Encore App**: 
+    - Create a new Encore app using the Encore CLI by running the following command:
+    ```bash
+    encore app create
+    ``` 
+    - Select the `Hello World` template.
+    - Follow the prompts to create the app.
+
+2. **Push the code to a GitHub repo**:
+    - Create a new repo (public or private) on GitHub and push the code to it.
+   
+### Step 2: Push the Docker Image to GitHub's Container Registry
+To deploy your Docker image to Railway, you first need to push it to a container registry. We will be using GitHub's container registry, but you can also use DockerHub or other registries. 
+Instead of pushing the image manually we will be using GitHub actions to automate the process.
+
+1. **Create a GitHub Actions YAML file**:
+   - In your repo, create a `.github/workflows/deploy-image-yaml` file with the following contents:
+   
+```yaml
+name: Build, Push and Deploy a Docker Image to Railway
+
+on:
+  push:
+    branches: [ main ]
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build-push-deploy-image:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3.3.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Download Encore CLI script
+        uses: sozo-design/curl@v1.0.2
+        with:
+          args: --output install.sh -L https://encore.dev/install.sh
+
+      - name: Install Encore CLI
+        run: bash install.sh
+
+      - name: Build Docker image
+        run: /home/runner/.encore/bin/encore build --config railway-infra.config.json docker myapp
+
+      - name: Tag Docker image
+        run: docker tag myapp ghcr.io/${{ github.repository }}:latest
+
+      - name: Push Docker image
+        run: docker push ghcr.io/${{ github.repository }}:latest
+```
+
+This will install the Encore CLI, build the Docker image, tag it, and push it to GitHub's container registry everytime you push to the `main` branch.
+The dynamic values like `${{ github.repository }}` will be filled in automatically by GitHub, you should not need to do anything.
+
+2. **Add, commit and push the changes**:
+   - Push the changes to your GitHub repository to trigger the GitHub action.
+
+### Step 3: Deploy the Docker Image to Railway
+
+1. **Create a new Project on Railway**:
+    - Log in to Railway and go to your dashboard. 
+    - Click on **"New"**.
+    - Choose the **"Empty project"** option.
+
+2. **Create a new service inside your new project**:
+    - Click on **"Create"**. 
+    - Select the "Docker Image" option.
+    - Enter the Docker Image URI, should be something like `ghcr.io/username/repo:latest`. You can should be able to find the Docker Image under **Packages** in your GitHub repo.
+    - Deploy the service.
+
+3. **Expose the service**:
+    - Click on the tne newly created service.
+    - Go to the **"Settings"** tab.
+    - Click on **"Generate Domain"**.
+    - Select `8080` as the port.
+    - Click on **"Generate"**.
+
+4. **Access the application**:
+    - Once deployed, and exposed you will get a public URL to access your application. It should look something like this: `https://repo-name-production.up.railway.app/`.
+    - Test the app to ensure it's running as expected, e.g. 
+   ```bash
+      curl https://repo-name-production.up.railway.app/hello/world
+    ```
+
+### Step 4: Automate the Deployment Process
+Railway has no way of knowing that you've pushed a new image to the container registry, but we can use Railway's GraphQL API to trigger a new deployment whenever a new image is pushed to the registry.
+
+1. **Generate a Railway API Token**:
+   - Go to your Railway dashboard.
+   - Click on your profile icon in the top right corner.
+   - Go to **"Account Settings"**.
+   - Click on **"Tokens"**.
+   - Give the token a name and click on **"Create"**.
+   - Copy the generated token.
+
+2. **Add the Railway API Token to GitHub Secrets**:
+   - Go to your GitHub repository.
+   - Go to **"Settings"**.
+   - Click on **"Secrets and variables" → "Actions"**.
+   - Click on **"New repository secret"**.
+   - Add a new secret called `RAILWAY_API_TOKEN` and paste the token you copied earlier.
+
+3. **Add a JavaScript script to your repo**:
+   - Create a new file in your repo named `script.js` with the following contents:
+```javascript
+const TOKEN = process.argv.slice(2)[0];
+const ENVIRONMENT_ID = "<your environment id>"
+const SERVICE_ID = "<your service id>"
+
+const resp = await fetch('https://backboard.railway.com/graphql/v2', {
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'authorization': `Bearer ${TOKEN}`,
+  },
+  body: JSON.stringify({
+    query: `
+      mutation ServiceInstanceRedeploy {
+          serviceInstanceRedeploy(
+              environmentId: "${ENVIRONMENT_ID}"
+              serviceId: "${SERVICE_ID}"
+          )
+      }`
+  }),
+})
+
+const data = await resp.json()
+
+if (data.errors) {
+  console.error(data.errors)
+  throw new Error('Failed to redeploy service')
+}
+
+console.log(data)
+ ```
+   - Replace `<your environment id>` and `<your service id>` with the actual values. You can find these values in the Railway dashboard URL when you're on the service page.
+
+4. **Add new steps to the GitHub Actions YAML file**:
+   - At the bottom of the existing file, add the following steps to call the script:
+```yaml
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+
+      - name: Trigger Railway deployment
+        run: node script.js ${{ secrets.RAILWAY_API_TOKEN }}
+```
+
+Whenever you push a new Docker Image to the container registry, the GitHub action will trigger a new deployment on Railway.
+
+### Step 5: Add a Database to Your App
+
+Railway provides managed databases, allowing you to add a database to your app easily. Here’s how to set up a database for your app:
+
+1. **Create a database for your app on Railway**:
+   - Navigate to your Railway app.
+   - Click on **"Create"** → **"Database""** → **"Add PostgreSQL""**
+
+2. **Copy the connection details**:
+   - Click on the database you just created.
+   - Click the **"Data"** → **"Connect"** → **"Public Network"**.
+   - Copy the raw `psql` command connection details. 
+   
+3. **Create a database table**:
+   - Connect to the database using the `psql` command:
+   ```bash
+   PGPASSWORD=<password> psql -h <hostname>.rlwy.net -U postgres -p 39684 -d railway
+   ```
+   - Create a table
+   ```sql
+     CREATE TABLE users (
+        id SERIAL PRIMARY KEY,
+        name TEXT
+     );
+     INSERT INTO users (name) VALUES ('Alice');
+   ```
+   
+4. **Declare a Database in your Encore app**:
+   - Open your Encore app’s codebase.
+   - Add `mydb` database to your app ([Encore Database Documentation](https://encore.dev/docs/ts/primitives/databases))
+   ```typescript
+      const mydb = new SQLDatabase("mydb", {
+         migrations: "./migrations",
+      });
+
+      export const getUser = api(
+        { expose: true, method: "GET", path: "/names/:id" },
+        async ({id}: {id:number}): Promise<{ id: number; name: string }> => {
+          return await mydb.queryRow`SELECT * FROM users WHERE id = ${id}` as { id: number; name: string };
+        }
+      );
+   ```
+
+5. **Create an Encore Infrastructure config**
+   - Create a file named `infra.config.json` in the root of your Encore app.
+   - Add the connection details to the file:
+   ```json
+   {
+      "$schema": "https://encore.dev/schemas/infra.schema.json",
+      "sql_servers": [
+      {
+         "host": "<hostname>.rlwy.net:39684",
+         "tls_config": {
+            "disable_ca_validation": true
+         },
+         "databases": {
+            "mydb": {
+               "name": "railway",
+               "username": "postgres",
+               "password": {"$env": "DB_PASSWORD"}
+             }
+         }
+      }]   
+   }
+   ```
+   Railway does not allow for downloading the CA certificate for the database, so we disable the CA validation.
+
+7. **Set Up Environment Variables (Optional)**:
+   - Click on the deployed image in your app view on Railway.
+   - Click **"Variables"**.
+   - Add the database password as an environment variable called `DB_PASSWORD`.
+
+8. **Make a new deployment**:
+   - Add commit and push the changes to your GitHub repository, this will trigger a new deploy on Railway.
+
+9. **Test the Database Connection**:
+   - Test the database connection by calling the API
+   ```bash
+    curl https://myapp.railway.app/names/1
+   ```
+
+### Conclusion
+That’s it! You’ve successfully deployed an Encore app to Railway using Docker. You can now scale your app, monitor its performance, and manage it easily through the Railway dashboard. If you encounter any issues, refer to the Railway documentation or the Encore community for help. Happy coding!
diff --git a/docs/ts/tutorials/graphql.mdx b/docs/ts/tutorials/graphql.mdx
new file mode 100644
index 0000000000..23cbdc3f17
--- /dev/null
+++ b/docs/ts/tutorials/graphql.mdx
@@ -0,0 +1,448 @@
+---
+title: Building a GraphQL API
+subtitle: Learn how to build a GraphQL API using Encore
+seotitle: How to build a GraphQL API using Encore.ts
+seodesc: Learn how to build a microservices backend in TypeScript, powered by GraphQL and Encore.ts
+lang: ts
+---
+
+Encore has great support for GraphQL with its type-safe approach to building APIs.
+
+Encore's automatic tracing also makes it easy to find and fix
+performance issues that often arise in GraphQL APIs (like the [N+1 problem](https://hygraph.com/blog/graphql-n-1-problem)).
+
+In this tutorial we will build a GraphQL API using [Apollo](https://www.apollographql.com/docs/apollo-server/) and Encore.ts.
+
+The final code will look like this:
+
+<div className="not-prose my-10">
+ <Editor projectName="graphqlTS" />
+</div>
+
+<Callout type="info">
+
+To make it easier to follow along, we've laid out a trail of croissants to guide your way.
+Whenever you see a 🥐 it means there's something for you to do.
+
+</Callout>
+
+## 1. Create your Encore application
+
+🥐 Create a new application by running `encore app create` and select `Empty app` as the template.
+
+If this is the first time you're using Encore, you'll be asked if you wish to create a free account. This is optional, but is needed when you want Encore to manage functionality like secrets and handle cloud deployments (which we'll use later on in the tutorial).
+
+## 2. GraphQL setup
+
+First, we need to install the necessary dependencies:
+
+🥐 Update your `package.json` file to look like this:
+
+```json
+-- package.json --
+{
+  "name": "encore-graphql",
+  "private": true,
+  "version": "0.0.1",
+  "license": "MPL-2.0",
+  "type": "module",
+  "scripts": {
+    "generate": "graphql-codegen --config codegen.yml"
+  },
+  "devDependencies": {
+    "@types/node": "^20.5.7",
+    "typescript": "^5.2.2",
+    "@graphql-codegen/cli": "2.16.5",
+    "@graphql-codegen/typescript": "2.8.8",
+    "@graphql-codegen/typescript-resolvers": "2.7.13"
+  },
+  "dependencies": {
+    "@apollo/server": "^4.11.0",
+    "encore.dev": "^1.35.3",
+    "graphql": "^16.9.0",
+    "graphql-tag": "^2.12.6"
+  }
+}
+```
+
+🥐 Run `npm install` to install the dependencies.
+
+🥐 Next, create a `codegen.yml` file in the application root containing:
+
+```
+-- codegen.yml --
+# This configuration file tells GraphQL Code Generator how to generate types based on our schema.
+schema: './schema.graphql'
+generates:
+  # Specify where our generated types should live.
+  ./graphql/__generated__/resolvers-types.ts:
+    plugins:
+      - 'typescript'
+      - 'typescript-resolvers'
+    config:
+      useIndexSignature: true
+```
+
+## 3. Add GraphQL schema
+
+Now it's time to define the GraphQL schema.
+
+🥐 Create a `schema.graphql` file in the application root containing:
+
+```
+-- schema.graphql --
+type Query {
+  books: [Book]
+}
+
+type Book {
+  title: String!
+  author: String!
+}
+
+type AddBookMutationResponse {
+  code: String!
+  success: Boolean!
+  message: String!
+  book: Book
+}
+
+type Mutation {
+  addBook(title: String!, author: String!): AddBookMutationResponse
+}
+```
+
+🥐 Run the code generation script to generate the resolver types:
+
+```shell
+$ npm run generate
+```
+The types will be written to `graphql/__generated__/resolvers-types.ts` and will contain a bunch of types that we can use when implementing the resolvers.
+
+## 4. Create a Book service
+
+Let's create a simple book service that we can later query using GraphQL. It's a good idea to to make the GraphQL library query Encore endpoints because that will result in traces being created for each called endpoint. Having tracing makes it easy to find and fix performance issues that often arise in GraphQL APIs.
+
+🥐 In your application's root folder, create a directory named `book` containing a file named `encore.service.ts`.
+
+```shell
+$ mkdir book
+$ touch book/encore.service.ts
+```
+
+🥐 Add the following code to `book/encore.service.ts`:
+
+```ts
+-- book/encore.service.ts --
+import { Service } from "encore.dev/service";
+
+export default new Service("book");
+```
+
+This is how you define a service with Encore. Encore will now consider files in the `book` directory and all its subdirectories as part of the `book` service.
+
+🥐 Next, create a `book/book.ts` file containing:
+
+```ts
+import { api, APIError } from "encore.dev/api";
+import { Book } from "../graphql/__generated__/resolvers-types";
+
+const db: Book[] = [
+  {
+    title: "To Kill a Mockingbird",
+    author: "Harper Lee",
+  },
+  {
+    title: "1984",
+    author: "George Orwell",
+  },
+  {
+    title: "The Great Gatsby",
+    author: "F. Scott Fitzgerald",
+  },
+  {
+    title: "Moby-Dick",
+    author: "Herman Melville",
+  },
+  {
+    title: "Pride and Prejudice",
+    author: "Jane Austen",
+  },
+];
+
+export const list = api(
+  { expose: true, method: "GET", path: "/books" },
+  async (): Promise<{ books: Book[] }> => {
+    return { books: db };
+  },
+);
+
+// Omit the "__typename" field from the request
+type AddRequest = Omit<Required<Book>, "__typename">;
+
+export const add = api(
+  { expose: true, method: "POST", path: "/book" },
+  async (book: AddRequest): Promise<{ book: Book }> => {
+    if (db.some((b) => b.title === book.title)) {
+      throw APIError.alreadyExists(
+        `Book "${book.title}" is already in database`,
+      );
+    }
+    db.push(book);
+    return { book };
+  },
+);
+```
+
+The `book` service contains two endpoint, one for listing all books and another to add a new book to the database. Our "database" is hardcoded just to limit the scope of this example. Take a look at the [Using SQL databases](/docs/ts/primitives/databases) docs to learn how to set up and use a database.
+
+We get the `Book` type from the generated resolver types. This will make it easier later when we create the resolver functions.
+
+## 5. Create the GraphQL service
+
+Now it's time to create our Encore service that will provide the GraphQL API.
+
+🥐 In the `graphql` directory, add a `encore.service.ts` file with the following content:
+
+```ts
+-- graphql/encore.service.ts --
+import { Service } from "encore.dev/service";
+
+export default new Service("graphql");
+```
+
+  Now, we need to create resolvers that call the `book` service. Since the GraphQL API uses the same types as the Encore API exposes (we import types form `resolvers-types.ts` in `book.ts`), our resolver can just be thin wrapper around out API endpoints.
+
+🥐 Create the directory `resolvers` in the `graphql` directory. In the resolvers directory we want to place three files: `index.ts`, `queries.ts` and `mutations.ts`:
+
+```ts
+-- resolvers/index.ts --
+import { Resolvers } from "../__generated__/resolvers-types";
+import Query from "./queries.js";
+import Mutation from "./mutations.js";
+
+const resolvers: Resolvers = { Query, Mutation };
+
+export default resolvers;
+-- resolvers/queries.ts --
+import { book } from "~encore/clients";
+import { QueryResolvers } from "../__generated__/resolvers-types";
+
+// Use the generated `QueryResolvers` type to type check our queries!
+const queries: QueryResolvers = {
+  books: async () => {
+    const { books } = await book.list();
+    return books;
+  },
+};
+
+export default queries;
+-- resolvers/mutations.ts --
+import { book } from "~encore/clients";
+import { MutationResolvers } from "../__generated__/resolvers-types";
+import { APIError } from "encore.dev/api";
+
+// Use the generated `MutationResolvers` type to type check our mutations
+const mutations: MutationResolvers = {
+  addBook: async (_, { title, author }) => {
+    try {
+      const resp = await book.add({ title, author });
+      return {
+        book: resp.book,
+        success: true,
+        code: "ok",
+        message: "New book added",
+      };
+    } catch (err) {
+      const apiError = err as APIError;
+
+      return {
+        book: null,
+        success: false,
+        code: apiError.code,
+        message: apiError.message,
+      };
+    }
+  },
+};
+
+export default mutations;
+```
+
+Now we are ready can create the ApolloServer that makes use of our resolvers and to expose our GraphQL endpoint.
+
+🥐 Still in the `graphql` directory, create a `graphql.ts` file containing:
+
+```ts
+-- graphql/graphql.ts --
+import { api } from "encore.dev/api";
+import { ApolloServer, HeaderMap } from "@apollo/server";
+import { readFileSync } from "node:fs";
+import resolvers from "./resolvers";
+import { json } from "node:stream/consumers";
+
+const typeDefs = readFileSync("./schema.graphql", { encoding: "utf-8" });
+
+const server = new ApolloServer({
+  typeDefs,
+  resolvers,
+});
+
+await server.start();
+
+export const graphqlAPI = api.raw(
+  { expose: true, path: "/graphql", method: "*" },
+  async (req, res) => {
+    server.assertStarted("/graphql");
+
+    const headers = new HeaderMap();
+    for (const [key, value] of Object.entries(req.headers)) {
+      if (value !== undefined) {
+        headers.set(key, Array.isArray(value) ? value.join(", ") : value);
+      }
+    }
+
+    // More on how to use executeHTTPGraphQLRequest: https://www.apollographql.com/docs/apollo-server/integrations/building-integrations/
+    const httpGraphQLResponse = await server.executeHTTPGraphQLRequest({
+      httpGraphQLRequest: {
+        headers,
+        method: req.method!.toUpperCase(),
+        body: await json(req),
+        search: new URLSearchParams(req.url ?? "").toString(),
+      },
+      context: async () => {
+        return { req, res };
+      },
+    });
+
+    for (const [key, value] of httpGraphQLResponse.headers) {
+      res.setHeader(key, value);
+    }
+    res.statusCode = httpGraphQLResponse.status || 200;
+
+    if (httpGraphQLResponse.body.kind === "complete") {
+      res.end(httpGraphQLResponse.body.string);
+      return;
+    }
+
+    for await (const chunk of httpGraphQLResponse.body.asyncIterator) {
+      res.write(chunk);
+    }
+    res.end();
+  },
+);
+```
+
+This creates an [Raw API endpoint](https://encore.dev/docs/ts/primitives/raw-endpoints) available on `/graphql`. In the endpoint we use ApolloServer to handle the GraphQL queries and mutations. We then return the response to the client.
+
+If we were to use another GraphQL library other than Apollo, the concept would still be the same:
+1. Take client requests with a Raw endpoint.
+2. Pass along the request and response objects to the GraphQL library of your choice.
+3. Use the library to handle the GraphQL queries and mutations.
+4. Return the GraphQL response from the Raw endpoint.
+
+## 6. Trying it out
+
+With that, the GraphQL API is done!
+
+🥐Try it out by running `encore run` and opening [https://studio.apollographql.com/sandbox](https://studio.apollographql.com/sandbox) in your browser. Set http://localhost:4000/graphql as your endpoint URL. You should now be able to read the schema and execute queries.
+
+Enter the query:
+```graphql
+mutation AddBook {
+  addBook(author: "J.R.R. Tolkien", title: "The Hobbit") {
+    success
+    message
+    code
+  }
+}
+```
+
+Now try the GetBooks query:
+
+```graphql
+query GetBooks {
+  books {
+    author
+    title
+  }
+}
+```
+
+And you should now see the "The Hobbit" in the list of books.
+
+🥐 Try opening the Local Development Dashboard at [http://localhost:9400](http://localhost:9400) and view the traces that were generated when calling your GraphQL API.
+
+
+## 7. Deploy
+
+<Accordion>
+
+### Self-hosting
+
+Encore supports building Docker images directly from the CLI, which can then be self-hosted on your own infrastructure of choice.
+
+If your app is using infrastructure resources, such as SQL databases, Pub/Sub, or metrics, you will need to supply a [runtime configuration](/docs/ts/self-host/configure-infra) your Docker image.
+
+🥐 Build a Docker image by running `encore build docker graphql:v1.0`.
+
+This will compile your application using the host machine and then produce a Docker image containing the compiled application.
+
+🥐 Upload the Docker image to the cloud provider of your choice and run it.
+
+</Accordion>
+
+<Accordion>
+
+### Encore Cloud (free)
+
+Encore Cloud provides automated infrastructure and DevOps. Deploy to a free development environment or to your own cloud account on AWS or GCP.
+
+### Create account
+
+Before deploying with Encore Cloud, you need to have a free Encore Cloud account and link your app to the platform. If you already have an account, you can move on to the next step.
+
+If you don’t have an account, the simplest way to get set up is by running `encore app create` and selecting **Y** when prompted to create a new account. Once your account is set up, continue creating a new app, selecting the `empty app` template.
+
+After creating the app, copy your project files into the new app directory, ensuring that you do not replace the `encore.app` file (this file holds a unique id which links your app to the platform).
+
+### Commit changes
+
+The final step before you deploy is to commit all changes to the project repo.
+
+🥐 Push your changes and deploy your application to Encore's free development cloud by running:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Encore will now build and test your app, provision the needed infrastructure, and deploy your application to the cloud.
+
+After triggering the deployment, you will see a URL where you can view its progress in the [Encore Cloud dashboard](https://app.encore.cloud). It will look something like: `https://app.encore.cloud/$APP_ID/deploys/...`
+
+From there you can also see metrics, traces, link your app to a GitHub repo to get automatic deploys on new commits, and connect your own AWS or GCP account to use for production deployment.
+
+### Celebrate with fireworks
+
+Now that your app is running in the cloud, let's celebrate with some fireworks:
+
+🥐 In the Cloud Dashboard, open the Command Menu by pressing **Cmd + K** (Mac) or **Ctrl + K** (Windows/Linux).
+
+_From here you can easily access all Cloud Dashboard features and for example jump straight to specific services in the Service Catalog or view Traces for specific endpoints._
+
+🥐 Type `fireworks` in the Command Menu and press enter. Sit back and enjoy the show!
+
+![Fireworks](/assets/docs/fireworks.jpg)
+
+</Accordion>
+
+## Conclusion
+
+We've now built a GraphQL API gateway that forwards requests to the application's underlying Encore services in a type-safe way with minimal boilerplate.
+
+Note that the concepts discussed here are general and can be easily adapted to any GraphQL schema.
+
+Whenever you make a change to the schema or configuration, re-run `npm run generate` to
+regenerate the resolver types.
diff --git a/docs/ts/tutorials/rest-api.mdx b/docs/ts/tutorials/rest-api.mdx
new file mode 100644
index 0000000000..641efcaeb7
--- /dev/null
+++ b/docs/ts/tutorials/rest-api.mdx
@@ -0,0 +1,481 @@
+---
+seotitle: How to build a REST API
+seodesc: Learn how to build and ship a REST API in just a few minutes using Encore.ts, go from zero to running API with this tutorial.
+title: Building a REST API
+subtitle: Learn how to build a URL shortener with a REST API and PostgreSQL database
+lang: ts
+---
+
+In this tutorial you will create a REST API for a URL Shortener service. In a few short minutes, you'll learn how to:
+
+* Create REST APIs with Encore
+* Use PostgreSQL databases
+* Use the local development dashboard to test your app
+* Create and run tests
+
+This is the end result:
+<div className="not-prose mb-10">
+   <Editor projectName="urlShortenerTS" />
+</div>
+
+<Callout type="info">
+
+To make it easier to follow along, we've laid out a trail of croissants to guide your way.
+Whenever you see a 🥐 it means there's something for you to do.
+
+</Callout>
+
+## 1. Create a service and endpoint
+
+Create a new application by running `encore app create` and select `Empty app` as the template.
+
+If this is the first time you're using Encore, you'll be asked if you wish to create a free account.
+This is needed when you want Encore to manage functionality like secrets and handle cloud deployments (which we'll use later on in the tutorial).
+
+Now let's create a new `url` service.
+
+🥐 In your application's root folder, create a directory named `url` containing a file named `encore.service.ts`.
+
+```shell
+$ mkdir url
+$ touch url/encore.service.ts
+```
+
+🥐 Add the following code to `url/encore.service.ts`:
+
+```ts
+-- url/encore.service.ts --
+import { Service } from "encore.dev/service";
+
+export default new Service("url");
+```
+
+This is how you define a service with Encore. Encore will now consider files in the `url` directory and all its subdirectories as part of the `url` service.
+
+
+🥐 Create a new file `url.ts` in the `url` directory:
+
+```shell
+$ touch url/url.ts
+```
+
+🥐 Add the following code to `url/url.ts`:
+
+```ts
+-- url/url.ts --
+import { api } from "encore.dev/api";
+import { randomBytes } from "node:crypto";
+
+interface URL {
+  id: string; // short-form URL id
+  url: string; // complete URL, in long form
+}
+
+interface ShortenParams {
+  url: string; // the URL to shorten
+}
+
+// Shortens a URL.
+export const shorten = api(
+  { method: "POST", path: "/url", expose: true },
+  async ({ url }: ShortenParams): Promise<URL> => {
+    const id = randomBytes(6).toString("base64url");
+    return { id, url };
+  },
+);
+```
+
+This sets up the `POST /url` endpoint.
+
+🥐 Let’s see if it works! Start your app by running the following command from your app's root directory:
+
+```shell
+$ encore run
+```
+
+You should see this:
+
+```output
+Encore development server running!
+
+Your API is running at:     http://127.0.0.1:4000
+Development Dashboard URL:  http://localhost:9400/5g288
+3:50PM INF registered API endpoint endpoint=shorten path=/url service=url
+```
+
+🥐 Next, call your endpoint from the Local Development Dashboard at [http://localhost:9400](http://localhost:9400) and view a trace of the response.
+It should look like this:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/rest_tut.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+You can also call it from the terminal:
+
+```shell
+$ curl http://localhost:4000/url -d '{"url": "https://encore.dev"}'
+```
+
+You should see this:
+
+```output
+{
+  "id": "5cJpBVRp",
+  "url": "https://encore.dev"
+}
+```
+
+It works! There’s just one problem...
+
+Right now, we’re not actually storing the URL anywhere. That means we can generate shortened IDs but there’s no way to get back to the original URL! We need to store a mapping from the short ID to the complete URL.
+
+## 2. Save URLs in a database
+Fortunately, Encore makes it really easy to set up a PostgreSQL database to store our data. To do so, we first define a **database schema**, in the form of a migration file.
+
+🥐 Create a new folder named `migrations` inside the `url` folder. Then, inside the `migrations` folder, create an initial database migration file named `001_create_tables.up.sql`. The file name format is important (it must start with `001_` and end in `.up.sql`).
+
+```shell
+$ mkdir url/migrations
+$ touch url/migrations/001_create_tables.up.sql
+```
+
+🥐 Add the following contents to the file:
+
+```sql
+-- url/migrations/001_create_tables.up.sql --
+CREATE TABLE url (
+	id TEXT PRIMARY KEY,
+	original_url TEXT NOT NULL
+);
+```
+
+🥐 Next, go back to the `url/url.ts` file and import the `SQLDatabase` class from `encore.dev/storage/sqldb` module by modifying the imports to look like this:
+
+```ts
+-- url/url.ts --
+import { api } from "encore.dev/api";
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+import { randomBytes } from "node:crypto";
+```
+
+🥐 Now, to define the database, create an instance of the `SQLDatabase` class in the `url` service:
+
+```ts
+HL url/url.ts 4:6
+-- url/url.ts --
+import { api } from "encore.dev/api";
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+import { randomBytes } from "node:crypto";
+
+// 'url' database is used to store the URLs that are being shortened.
+const db = new SQLDatabase("url", { migrations: "./migrations" });
+
+interface URL {
+    id: string; // short-form URL id
+    url: string; // complete URL, in long form
+}
+
+interface ShortenParams {
+    url: string; // the URL to shorten
+}
+
+// Shortens a URL.
+export const shorten = api(
+    { method: "POST", path: "/url", expose: true },
+    async ({ url }: ShortenParams): Promise<URL> => {
+        const id = randomBytes(6).toString("base64url");
+        return { id, url };
+    },
+);
+```
+
+🥐 Lastly, update the `shorten` function to insert data into the database:
+
+```ts
+HL url/url.ts 21:26
+-- url/url.ts --
+import { api } from "encore.dev/api";
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+import { randomBytes } from "node:crypto";
+
+// 'url' database is used to store the URLs that are being shortened.
+const db = new SQLDatabase("url", { migrations: "./migrations" });
+
+interface URL {
+    id: string; // short-form URL id
+    url: string; // complete URL, in long form
+}
+
+interface ShortenParams {
+    url: string; // the URL to shorten
+}
+
+// Shortens a URL.
+export const shorten = api(
+    { method: "POST", path: "/url", expose: true },
+    async ({ url }: ShortenParams): Promise<URL> => {
+      const id = randomBytes(6).toString("base64url");
+      await db.exec`
+        INSERT INTO url (id, original_url)
+        VALUES (${id}, ${url})
+      `;
+      return { id, url };
+    },
+  );
+```
+
+<Callout type="info">
+
+Before running your application, make sure you have [Docker](https://www.docker.com) installed and running. It's required to locally run Encore applications with databases.
+
+</Callout>
+
+🥐 Next, start the application again with `encore run` and Encore automatically sets up your database.
+
+(In case your application won't run, check the [databases troubleshooting guide](/docs/ts/primitives/databases#troubleshooting).)
+
+You can verify that the database was created by looking at the **Infra** tab in the local development dashboard at [localhost:9400](http://localhost:9400), which should look like this:
+
+<img src="/assets/docs/infra_tab.png" alt="Infra tab in local development dashboard" className="w-full h-full" />
+
+🥐 Now let's call the API again from the local development dashboard, or from the terminal:
+
+```shell
+$ curl http://localhost:4000/url -d '{"url": "https://encore.dev"}'
+```
+
+🥐 Finally, let's verify that it was saved in the database. You can do this by checking the trace in the local development dashboard, or you can run  `encore db shell url` from the app root directory and inputting `select * from url;`:
+
+```shell
+$ encore db shell url
+psql (13.1, server 11.12)
+Type "help" for help.
+
+url=# select * from url;
+    id    |    original_url
+----------+--------------------
+ zr6RmZc4 | https://encore.dev
+(1 row)
+```
+
+That was easy!
+
+## 3. Add endpoint to retrieve URLs
+To complete our URL shortener API, let’s add the endpoint to retrieve a URL given its short id.
+
+🥐 Add this endpoint to `url/url.ts`:
+
+```ts
+HL url/url.ts 0:1
+HL url/url.ts 29:40
+-- url/url.ts --
+import { api, APIError } from "encore.dev/api";
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+import { randomBytes } from "node:crypto";
+
+// 'url' database is used to store the URLs that are being shortened.
+const db = new SQLDatabase("url", { migrations: "./migrations" });
+
+interface URL {
+    id: string; // short-form URL id
+    url: string; // complete URL, in long form
+}
+
+interface ShortenParams {
+    url: string; // the URL to shorten
+}
+
+// Shortens a URL.
+export const shorten = api(
+    { method: "POST", path: "/url", expose: true },
+    async ({ url }: ShortenParams): Promise<URL> => {
+      const id = randomBytes(6).toString("base64url");
+      await db.exec`
+        INSERT INTO url (id, original_url)
+        VALUES (${id}, ${url})
+      `;
+      return { id, url };
+    },
+  );
+
+  // Get retrieves the original URL for the id.
+export const get = api(
+    { expose: true, auth: false, method: "GET", path: "/url/:id" },
+    async ({ id }: { id: string }): Promise<URL> => {
+      const row = await db.queryRow`
+          SELECT original_url FROM url WHERE id = ${id}
+      `;
+      if (!row) throw APIError.notFound("url not found");
+      return { id, url: row.original_url };
+    }
+  );
+```
+
+Encore uses the `/url/:id` syntax to represent a path with a parameter. The `id` name corresponds to the parameter name in the function signature. In this case it is of type `string`, but you can also use other built-in types like `number` or `boolean` if you want to restrict the values.
+
+🥐 We can make sure it works by reviewing the endpoint in the [Service Catalog](/docs/ts/observability/service-catalog) in the local development dashboard, where we can call it using the `id` you got in the previous step:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/rest_tut_3.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+You can also call it directly from the terminal:
+
+```shell
+$ curl http://localhost:4000/url/your-id-from-the-previous-step
+```
+
+You should now see this:
+
+```json
+{
+  "id": "your-id-from-the-previous-step",
+  "url": "https://encore.dev"
+}
+```
+
+It works! That's how you build REST APIs and use PostgreSQL databases in Encore.
+
+## 4. Add a test
+
+Before deployment, it is good practice to have tests to assure that the service works properly. Such tests including database access are easy to write.
+
+🥐 Let's start by adding the `vitest` package to your project:
+
+```shell
+$ npm i --save-dev vitest
+```
+
+[Vitest](https://vitest.dev/) is a testing framework that works great with Encore but you can use another TypeScript testing framework if you like.
+
+🥐 Next we need to add a test script to our `package.json`:
+
+```json
+-- package.json --
+"scripts": {
+  "test": "vitest"
+},
+```
+
+We've prepared a test to check that the whole cycle of shortening the URL, storing and then retrieving the original URL works.
+
+🥐 Save this in a separate file `url/url.test.ts`.
+
+```ts
+-- url/url.test.ts --
+import { describe, expect, test } from "vitest";
+import { get, shorten } from "./url";
+
+describe("shorten", () => {
+  test("getting a shortened url should give back the original", async () => {
+    const resp = await shorten({ url: "https://example.com" });
+    const url = await get({ id: resp.id });
+    expect(url.url).toBe("https://example.com");
+  });
+});
+```
+
+🥐 Now run `encore test` to verify that it's working.
+
+If you use the local development dashboard ([localhost:9400](http://localhost:9400)), you can even see traces for tests.
+
+## 5. Deploy
+
+<Accordion>
+
+### Self-hosting
+
+Encore supports building Docker images directly from the CLI, which can then be self-hosted on your own infrastructure of choice.
+
+If your app is using infrastructure resources, such as SQL databases, Pub/Sub, or metrics, you will need to configure your Docker image with the necessary configuration.
+Our URL shortener makes use of a PostgreSQL database, so we'll need to supply a runtime configuration so that our app knows how to connect to the database in the cloud.
+
+🥐 Create a new file `infra-config.json` in the root of your project with the following contents:
+
+```json
+{
+   "$schema": "https://encore.dev/schemas/infra.schema.json",
+   "sql_servers": [
+      {
+         "host": "my-db-host:5432",
+         "databases": {
+            "url": {
+               "username": "my-db-owner",
+                "password": {"$env": "DB_PASSWORD"}
+            }
+         }
+      }
+   ]
+}
+```
+
+The values in this configuration are just examples, you will need to replace them with the correct values for your database.
+Take a look at our guide for [deploying an Encore app with a PostgreSQL database to Digital Ocean](/docs/ts/self-host/deploy-digitalocean) for more information.
+
+🥐 Build a Docker image by running `encore build docker url-shortener:v1.0`.
+
+This will compile your application using the host machine and then produce a Docker image containing the compiled application.
+
+🥐 Upload the Docker image to the cloud provider of your choice and run it.
+
+</Accordion>
+
+<Accordion>
+
+### Encore Cloud (free)
+
+Encore Cloud provides automated infrastructure and DevOps. Deploy to a free development environment or to your own cloud account on AWS or GCP.
+
+### Create account
+
+Before deploying with Encore Cloud, you need to have a free Encore Cloud account and link your app to the platform. If you already have an account, you can move on to the next step.
+
+If you don’t have an account, the simplest way to get set up is by running `encore app create` and selecting **Y** when prompted to create a new account. Once your account is set up, continue creating a new app, selecting the `empty app` template.
+
+After creating the app, copy your project files into the new app directory, ensuring that you do not replace the `encore.app` file (this file holds a unique id which links your app to the platform).
+
+### Commit changes
+
+The final step before you deploy is to commit all changes to the project repo.
+
+🥐 Commit the new files to the project's git repo and trigger a deploy to Encore's free development cloud by running:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Encore will now build and test your app, provision the needed infrastructure, and deploy your application to the cloud.
+
+After triggering the deployment, you will see a URL where you can view its progress in the [Encore Cloud dashboard](https://app.encore.cloud). It will look something like: `https://app.encore.cloud/$APP_ID/deploys/...`
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/rest_tut_4.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+From there you can also see metrics, traces, and connect your own AWS or GCP account to use for production deployment.
+
+*Now you have a fully fledged backend running in the cloud, well done!*
+
+### Celebrate with fireworks
+
+Now that your app is running in the cloud, let's celebrate with some fireworks:
+
+🥐 In the Cloud Dashboard, open the Command Menu by pressing **Cmd + K** (Mac) or **Ctrl + K** (Windows/Linux).
+
+_From here you can easily access all Cloud Dashboard features and for example jump straight to specific services in the Service Catalog or view Traces for specific endpoints._
+
+🥐 Type `fireworks` in the Command Menu and press enter. Sit back and enjoy the show!
+
+![Fireworks](/assets/docs/fireworks.jpg)
+
+🥐 A great next step is to [integrate with GitHub](/docs/platform/integrations/github). Once you've linked with GitHub, Encore will automatically start building and running tests against your Pull Requests.
+
+</Accordion>
+
+## What's next
+
+Now that you know how to build a backend with a database, you're ready to let your creativity flow and begin building your next great idea!
+
+We're excited to hear what you're going to build with Encore, join the pioneering developer community on [Discord](/discord) and share your story.
diff --git a/docs/ts/tutorials/slack-bot.md b/docs/ts/tutorials/slack-bot.md
new file mode 100644
index 0000000000..9b0026a8b6
--- /dev/null
+++ b/docs/ts/tutorials/slack-bot.md
@@ -0,0 +1,343 @@
+---
+seotitle: Tutorial – How to build a Slack bot
+seodesc: Learn how to build a Slack bot with an Encore.ts backend, and get it running in the cloud in just a few minutes.
+title: Building a Slack bot
+subtitle: Learn how to build a Slack bot with an Encore backend
+lang: ts
+---
+
+In this tutorial you will create a Slack bot that brings the greatness of the `cowsay` utility to Slack!
+
+![Slack Cowsay](https://encore.dev/assets/docs/cowsay.png "Slack bot")
+
+This is the end result:
+<div className="not-prose mb-10">
+   <Editor projectName="slackBotTS" />
+</div>
+
+<Callout type="info">
+
+To make it easier to follow along, we've laid out a trail of croissants to guide your way.
+Whenever you see a 🥐 it means there's something for you to do.
+
+</Callout>
+
+## 1. Create your Encore application
+
+🥐 Create a new Encore application by running `encore app create` and select `Empty app` as the template.
+**Take a note of your app id, we'll need it in the next step.**
+
+## 2. Create a Slack app
+
+🥐 The first step is to create a new Slack app:
+
+1. Head over to [Slack's API site](https://api.slack.com/apps) and create a new app.
+2. When prompted, choose to create the app **from an app manifest**.
+3. Choose a workspace to install the app in.
+
+🥐 Enter the following manifest (replace `$APP_ID` in the URL below with your app id from above):
+
+```yaml
+_metadata:
+  major_version: 1
+display_information:
+  name: Encore Bot
+  description: Cowsay for the cloud age.
+features:
+  slash_commands:
+    - command: /cowsay
+      # Replace $APP_ID below
+      url: https://staging-$APP_ID.encr.app/cowsay
+      description: Say things with a flair!
+      usage_hint: your message here
+      should_escape: false
+  bot_user:
+    display_name: encore-bot
+    always_online: true
+oauth_config:
+  scopes:
+    bot:
+      - commands
+      - chat:write
+      - chat:write.public
+settings:
+  org_deploy_enabled: false
+  socket_mode_enabled: false
+  token_rotation_enabled: false
+```
+
+Once created, we're ready to move on with implementing our Encore endpoint!
+
+## 3. Implement the Slack endpoint
+
+Since Slack sends custom HTTP headers that we need to pay attention to, we're going to
+use a raw endpoint in Encore. For more information on this check out Slack's documentation
+on [Enabling interactivity with Slash Commands](https://api.slack.com/interactivity/slash-commands).
+
+🥐 In your Encore app, create a directory named `slack` containing a file named `encore.service.ts`.
+
+```shell
+$ mkdir slack
+$ touch slack/encore.service.ts
+```
+
+🥐 Add the following code to `slack/encore.service.ts`:
+
+```ts
+-- slack/encore.service.ts --
+import { Service } from "encore.dev/service";
+
+export default new Service("slack");
+```
+
+This is how you create define services with Encore. Encore will now consider files in the `slack` directory and all its subdirectories as part of the `slack` service.
+
+🥐 Create a file `slack/slack.ts` with the following contents:
+
+```ts
+-- slack/slack.ts --
+import { api } from "encore.dev/api";
+import type { IncomingMessage } from "node:http";
+
+// cowart is the formatting string for printing the cow art.
+const cowart = (msg: string) => `Moo! ${msg}
+`;
+
+export const cowsay = api.raw(
+  { expose: true, path: "/cowsay", method: "*" },
+  async (req, resp) => {
+    const body = await getBody(req);
+
+    const text = new URLSearchParams(body).get("text");
+    const msg = cowart(text || "Moo!");
+    resp.setHeader("Content-Type", "application/json");
+    resp.end(JSON.stringify({ response_type: "in_channel", text: msg }));
+  },
+);
+
+// Extract the body from an incoming request.
+function getBody(req: IncomingMessage): Promise<string> {
+  return new Promise((resolve) => {
+    const bodyParts: any[] = [];
+    req
+      .on("data", (chunk) => {
+        bodyParts.push(chunk);
+      })
+      .on("end", () => {
+        resolve(Buffer.concat(bodyParts).toString());
+      });
+  });
+}
+```
+
+Let's try it out locally.
+
+🥐 Start your app with `encore run` and then call it in another terminal:
+
+```shell
+$ curl http://localhost:4000/cowsay -d 'text=Eat your greens!'
+{"response_type":"in_channel","text":"Moo! Eat your greens!"}
+```
+
+Looks great!
+
+🥐 Next, let's deploy it to the cloud:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Once deployed, we're ready to try our Slack command!
+
+🥐 Head over to the workspace you installed the app in and run `/cowsay Hello there`.
+You should see something like this:
+
+![Cowsay](https://encore.dev/assets/docs/cowsay-wip.png "Cowsay (Work in Progress)")
+
+And just like that we have a fully working Slack integration.
+
+## 4. Secure the webhook endpoint
+
+In order to get up and running quickly we ignored one important aspect for a production-ready Slack app:
+verifying that the webhook requests are actually coming from Slack. Let's do that now!
+
+The Slack documentation covers this really well on the [Verifying requests from Slack](https://api.slack.com/authentication/verifying-requests-from-slack) page.
+
+In short, what we need to do is:
+
+1. Save a shared secret that Slack provides us
+2. Use the secret to verify that the request comes from Slack, using HMAC (Hash-based Message Authentication Code).
+
+### Save the shared secret
+
+Let's define a secret using Encore's secrets management functionality.
+
+🥐 Add this to your `slack.ts` file:
+
+```ts
+HL slack/slack.ts 0:0
+HL slack/slack.ts 2:2
+-- slack/slack.ts --
+import { secret } from "encore.dev/config";
+
+const slackSigningSecret = secret("SlackSigningSecret");
+```
+
+🥐 Head over to the configuration section for your Slack app (go to [Your Apps](https://api.slack.com/apps) &rarr; select your app &rarr; Basic Information).
+
+🥐 Copy the **Signing Secret** and then run `encore secret set --type prod SlackSigningSecret` and paste the secret.
+
+🥐 For development you will also want to set `encore secret set --type dev,local,pr SlackSigningSecret`.
+You can use the same secret value or a placeholder value.
+
+### Compute the HMAC
+
+TypeScript makes computing HMAC very straightforward, but it's still a fair amount of code.
+
+🥐 Add a few more imports to your file, so that it reads:
+```ts
+-- slack/slack.ts --
+import { createHmac, timingSafeEqual } from "node:crypto";
+import type { IncomingHttpHeaders } from "http";
+```
+
+🥐 Next, we'll add the `verifySignature` function:
+
+```ts
+-- slack/slack.ts --
+// Verifies the signature of an incoming request from Slack.
+const verifySignature = async function (
+  body: string,
+  headers: IncomingHttpHeaders,
+) {
+  const requestTimestampSec = parseInt(
+    headers["x-slack-request-timestamp"] as string,
+  );
+  const signature = headers["x-slack-signature"] as string;
+  if (Number.isNaN(requestTimestampSec)) {
+    throw new Error(
+      `Failed to verify authenticity: header x-slack-request-timestamp did not have the expected type (${requestTimestampSec})`,
+    );
+  }
+
+  // Calculate time-dependent values
+  const nowMs = Date.now();
+  const requestTimestampMaxDeltaMin = 5;
+  const fiveMinutesAgoSec =
+    Math.floor(nowMs / 1000) - 60 * requestTimestampMaxDeltaMin;
+
+  // Enforce verification rules
+
+  // Rule 1: Check staleness
+  if (requestTimestampSec < fiveMinutesAgoSec) {
+    throw new Error(
+      `Failed to verify authenticity: x-slack-request-timestamp must differ from system time by no more than ${requestTimestampMaxDeltaMin} minutes or request is stale`,
+    );
+  }
+
+  // Rule 2: Check signature
+  // Separate parts of signature
+  const [signatureVersion, signatureHash] = signature.split("=");
+  // Only handle known versions
+  if (signatureVersion !== "v0") {
+    throw new Error(`Failed to verify authenticity: unknown signature version`);
+  }
+  // Compute our own signature hash
+  const hmac = createHmac("sha256", slackSigningSecret());
+  hmac.update(`${signatureVersion}:${requestTimestampSec}:${body}`);
+  const ourSignatureHash = hmac.digest("hex");
+  if (
+    !signatureHash ||
+    !timingSafeEqual(
+      Buffer.from(signatureHash, "utf8"),
+      Buffer.from(ourSignatureHash, "utf8"),
+    )
+  ) {
+    throw new Error(`Failed to verify authenticity: signature mismatch`);
+  }
+};
+```
+
+We're now ready to verify the signature.
+
+🥐 Update the `cowsay` function to look like this:
+
+```ts
+HL slack/slack.ts 5:12
+-- slack/slack.ts --
+export const cowsay = api.raw(
+  { expose: true, path: "/cowsay", method: "*" },
+  async (req, resp) => {
+    const body = await getBody(req);
+
+    try {
+      await verifySignature(body, req.headers);
+    } catch (err) {
+      const e = err as Error;
+      resp.statusCode = 500;
+      resp.end(e.message);
+      return;
+    }
+
+    const text = new URLSearchParams(body).get("text");
+    const msg = cowart(text || "Moo!");
+    resp.setHeader("Content-Type", "application/json");
+    resp.end(JSON.stringify({ response_type: "in_channel", text: msg }));
+  },
+);
+```
+
+## 5. Put it all together and deploy
+
+Finally we're ready to put it all together.
+
+🥐 Add the `cowart` in `slack.ts` like so:
+
+```ts
+-- slack/slack.ts --
+const cowart = (msg: string) => `
+\`\`\`
++-${"-".repeat(msg.length)}-+
+| ${msg} |
++-${"-".repeat(msg.length)}-+
+      \\  __n__n__
+  .------\`-\\00/-'
+ /  ##  ## (oo)
+/ \\## __   ./
+   |//YY \\|/
+   |||   |||
+\`\`\`
+`;
+```
+
+🥐 Finally, let's commit our changes and deploy it:
+
+```shell
+$ git add -A .
+$ git commit -m 'Verify webhook requests and improve art'
+$ git push encore
+```
+
+🥐 Once deployed, head back to Slack and run `/cowsay Hello there`.
+
+If everything is set up correctly, you should see:
+
+![Slack Cowsay](https://encore.dev/assets/docs/cowsay.png "Slack bot")
+
+And there we go, a production-ready Slack bot in less than 100 lines of code.
+
+Well done!
+
+### Celebrate with fireworks
+
+Now that your app is running in the cloud, let's celebrate with some fireworks:
+
+🥐 In the Cloud Dashboard, open the Command Menu by pressing **Cmd + K** (Mac) or **Ctrl + K** (Windows/Linux).
+
+_From here you can easily access all Cloud Dashboard features and for example jump straight to specific services in the Service Catalog or view Traces for specific endpoints._
+
+🥐 Type `fireworks` in the Command Menu and press enter. Sit back and enjoy the show!
+
+![Fireworks](/assets/docs/fireworks.jpg)
diff --git a/docs/ts/tutorials/uptime.md b/docs/ts/tutorials/uptime.md
new file mode 100644
index 0000000000..53f14e1754
--- /dev/null
+++ b/docs/ts/tutorials/uptime.md
@@ -0,0 +1,831 @@
+---
+title: Building an Uptime Monitor
+subtitle: Learn how to build an event-driven uptime monitoring system
+seotitle: How to build an event-driven Uptime Monitoring System using Encore.ts
+seodesc: Learn how to build an event-driven uptime monitoring tool using TypeScript and Encore. Get your application running in the cloud in 30 minutes!
+lang: ts
+---
+
+Want to be notified when your website goes down so you can fix it before your users notice?
+
+You need an uptime monitoring system. Sounds daunting? Don't worry,
+we'll build it with Encore in 30 minutes!
+
+The app will use an event-driven architecture and the final result will look like this:
+
+<img className="w-full h-auto" src="/assets/tutorials/uptime/frontend.png" title="Frontend" />
+
+<div className="not-prose my-10">
+   <Editor projectName="uptimeTS" />
+</div>
+
+## 1. Create your Encore application
+
+<Callout type="info">
+
+To make it easier to follow along, we've laid out a trail of croissants to guide your way.
+Whenever you see a 🥐 it means there's something for you to do.
+
+</Callout>
+
+🥐 Create a new Encore application, using this tutorial project's starting-point branch. This gives you a ready-to-go frontend to use.
+
+```shell
+$ encore app create uptime --example=github.com/encoredev/example-app-uptime/tree/starting-point-ts
+```
+
+If this is the first time you're using Encore, you'll be asked if you wish to create a free account. This is needed when you want Encore to manage functionality like secrets and handle cloud deployments (which we'll use later on in the tutorial).
+
+When we're done we'll have a backend with an event-driven architecture, as seen below in the [automatically generated diagram](/docs/ts/observability/encore-flow) where white boxes are services and black boxes are Pub/Sub topics:
+
+<img className="w-full h-auto" src="/assets/tutorials/uptime/encore-flow.png" title="Encore Flow" />
+
+## 2. Create monitor service
+
+Let's start by creating the functionality to check if a website is currently up or down.
+Later we'll store this result in a database so we can detect when the status changes and
+send alerts.
+
+🥐 Create a directory named `monitor` containing a file named `encore.service.ts`.
+
+```shell
+$ mkdir monitor
+$ touch monitor/encore.service.ts
+```
+
+🥐 Add the following code to `monitor/encore.service.ts`:
+
+```ts
+-- monitor/encore.service.ts --
+import { Service } from "encore.dev/service";
+
+export default new Service("monitor");
+```
+
+This is how you create define services with Encore. Encore will now consider files in the `monitor` directory and all its subdirectories as part of the `monitor` service.
+
+🥐 In the `monitor` directory, create a file named `ping.ts`.
+
+🥐 Add an Encore API endpoint named `ping` that takes a URL as input and returns a response
+indicating whether the site is up or down.
+
+```ts
+-- monitor/ping.ts --
+// Service monitor checks if a website is up or down.
+import { api } from "encore.dev/api";
+
+export interface PingParams {
+  url: string;
+}
+
+export interface PingResponse {
+  up: boolean;
+}
+
+// Ping pings a specific site and determines whether it's up or down right now.
+export const ping = api<PingParams, PingResponse>(
+  { expose: true, path: "/ping/:url", method: "GET" },
+  async ({ url }) => {
+    // If the url does not start with "http:" or "https:", default to "https:".
+    if (!url.startsWith("http:") && !url.startsWith("https:")) {
+      url = "https://" + url;
+    }
+
+    try {
+      // Make an HTTP request to check if it's up.
+      const resp = await fetch(url, { method: "GET" });
+      // 2xx and 3xx status codes are considered up
+      const up = resp.status >= 200 && resp.status < 300;
+      return { up };
+    } catch (err) {
+      return { up: false };
+    }
+  }
+);
+```
+
+🥐 Let's try it! Run `encore run` in your terminal and you should see the service start up.
+
+Then open up the Local Development Dashboard at [http://localhost:9400](http://localhost:9400) and try calling the `monitor.ping` endpoint from the API Explorer, passing in `google.com` as the URL.
+
+You can then see the response, logs, and view a trace of the request. It will look like this:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/uptime_tut_1.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+If you prefer to use the terminal instead run `curl http://localhost:4000/ping/google.com` in a new terminal instead. Either way you should see the response:
+
+```json
+{"up": true}
+```
+
+You can also try with `httpstat.us/400` and `some-non-existing-url.com` and it should respond with `{"up": false}`.
+(It's always a good idea to test the negative case as well.)
+
+### Add a test
+
+🥐 Let's write an automated test so we don't break this endpoint over time. Create the file `monitor/ping.test.ts`
+with the content:
+
+```ts
+-- monitor/ping.test.ts --
+import { describe, expect, test } from "vitest";
+import { ping } from "./ping";
+
+describe("ping", () => {
+  test.each([
+    // Test both with and without "https://"
+    { site: "google.com", expected: true },
+    { site: "https://encore.dev", expected: true },
+
+    // 4xx and 5xx should considered down.
+    { site: "https://not-a-real-site.xyz", expected: false },
+    // Invalid URLs should be considered down.
+    { site: "invalid://scheme", expected: false },
+  ])(
+    `should verify that $site is ${"$expected" ? "up" : "down"}`,
+    async ({ site, expected }) => {
+      const resp = await ping({ url: site });
+      expect(resp.up).toBe(expected);
+    },
+  );
+});
+```
+
+🥐 Run `encore test` to check that it all works as expected. You should see something like:
+
+```shell
+$ encore test
+
+DEV  v1.3.0
+
+✓ monitor/ping.test.ts (4)
+  ✓ ping (4)
+    ✓ should verify that 'google.com' is up
+    ✓ should verify that 'https://encore.dev' is up
+    ✓ should verify that 'https://not-a-real-site.xyz' is down
+    ✓ should verify that 'invalid://scheme' is down
+
+Test Files  1 passed (1)
+     Tests  4 passed (4)
+  Start at  12:31:03
+  Duration  460ms (transform 43ms, setup 0ms, collect 59ms, tests 272ms, environment 0ms, prepare 47ms)
+
+PASS  Waiting for file changes...
+```
+
+## 3. Create site service
+
+Next, we want to keep track of a list of websites to monitor.
+
+Since most of these APIs will be simple "CRUD" (Create/Read/Update/Delete) endpoints, let's build this service using [Knex.js](https://knexjs.org/), an ORM library that makes building CRUD endpoints really simple.
+
+🥐 Let's start with creating a new service named `site`:
+
+```shell
+$ mkdir site # Create a new directory in the application root
+$ touch site/encore.service.ts
+```
+
+```ts
+-- site/encore.service.ts --
+import { Service } from "encore.dev/service";
+
+export default new Service("site");
+```
+
+🥐 Now we want to add a SQL database to the `site` service. To do so, create a new directory named `migrations` folder inside the `site` folder:
+
+```shell
+$ mkdir site/migrations
+```
+
+🥐  Add a database migration file inside that folder, named `1_create_tables.up.sql`.
+The file name is important (it must look something like `1_<name>.up.sql`).
+
+Add the following contents:
+
+```sql
+-- site/migrations/1_create_tables.up.sql --
+CREATE TABLE site (
+    id SERIAL PRIMARY KEY,
+    url TEXT NOT NULL UNIQUE
+);
+```
+
+🥐 Next, install the Knex.js library and PostgreSQL client:
+
+```shell
+$ npm i knex pg
+```
+
+Now let's create the `site` service itself with our CRUD endpoints.
+
+🥐 Create `site/site.ts` with the contents:
+
+```ts
+-- site/site.ts --
+import { api } from "encore.dev/api";
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+import knex from "knex";
+
+// Site describes a monitored site.
+export interface Site {
+  id: number; // ID is a unique ID for the site.
+  url: string; // URL is the site's URL.
+}
+
+// AddParams are the parameters for adding a site to be monitored.
+export interface AddParams {
+  // URL is the URL of the site. If it doesn't contain a scheme
+  // (like "http:" or "https:") it defaults to "https:".
+  url: string;
+}
+
+// Add a new site to the list of monitored websites.
+export const add = api(
+  { expose: true, method: "POST", path: "/site" },
+  async (params: AddParams): Promise<Site> => {
+    const site = (await Sites().insert({ url: params.url }, "*"))[0];
+    return site;
+  },
+);
+
+// Get a site by id.
+export const get = api(
+  { expose: true, method: "GET", path: "/site/:id", auth: false },
+  async ({ id }: { id: number }): Promise<Site> => {
+    const site = await Sites().where("id", id).first();
+    return site ?? Promise.reject(new Error("site not found"));
+  },
+);
+
+// Delete a site by id.
+export const del = api(
+  { expose: true, method: "DELETE", path: "/site/:id" },
+  async ({ id }: { id: number }): Promise<void> => {
+    await Sites().where("id", id).delete();
+  },
+);
+
+export interface ListResponse {
+  sites: Site[]; // Sites is the list of monitored sites
+}
+
+// Lists the monitored websites.
+export const list = api(
+  { expose: true, method: "GET", path: "/site" },
+  async (): Promise<ListResponse> => {
+    const sites = await Sites().select();
+    return { sites };
+  },
+);
+
+// Define a database named 'site', using the database migrations
+// in the "./migrations" folder. Encore automatically provisions,
+// migrates, and connects to the database.
+const SiteDB = new SQLDatabase("site", {
+  migrations: "./migrations",
+});
+
+const orm = knex({
+  client: "pg",
+  connection: SiteDB.connectionString,
+});
+
+const Sites = () => orm<Site>("site");
+```
+
+🥐 Now make sure you have [Docker](https://docker.com) installed and running, and then restart `encore run` to cause the `site` database to be created by Encore.
+
+You can verify that the database was created by looking at your application's Flow architecture diagram in the local development dashboard at [localhost:9400](http://localhost:9400), and then use the Service Catalog to call the `site.add` endpoint:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/uptime_tut_2.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+You can also call the `site.add` endpoint from the terminal:
+
+```shell
+$ curl -X POST 'http://localhost:4000/site' -d '{"url": "https://encore.dev"}'
+{
+  "id": 1,
+  "url": "https://encore.dev"
+}
+```
+
+## 4. Record uptime checks
+
+In order to notify when a website goes down or comes back up, we need to track the previous state it was in.
+
+🥐  To do so, let's add a database to the `monitor` service as well.
+Create the directory `monitor/migrations` and the file `monitor/migrations/1_create_tables.up.sql`:
+
+```sql
+-- monitor/migrations/1_create_tables.up.sql --
+CREATE TABLE checks (
+    id BIGSERIAL PRIMARY KEY,
+    site_id BIGINT NOT NULL,
+    up BOOLEAN NOT NULL,
+    checked_at TIMESTAMP WITH TIME ZONE NOT NULL
+);
+```
+
+We'll insert a database row every time we check if a site is up.
+
+🥐 Add a new endpoint `check` to the `monitor` service, that
+takes in a Site ID, pings the site, and inserts a database row
+in the `checks` table.
+
+For this service we'll use Encore's [`SQLDatabase` class](https://encore.dev/docs/ts/primitives/databases#querying-data) instead of Knex (in order to showcase both approaches).
+
+Add the following to `monitor/check.ts`:
+
+```ts
+-- monitor/check.ts --
+import { api } from "encore.dev/api";
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+import { ping } from "./ping";
+import { site } from "~encore/clients";
+
+// Check checks a single site.
+export const check = api(
+  { expose: true, method: "POST", path: "/check/:siteID" },
+  async (p: { siteID: number }): Promise<{ up: boolean }> => {
+    const s = await site.get({ id: p.siteID });
+    const { up } = await ping({ url: s.url });
+    await MonitorDB.exec`
+        INSERT INTO checks (site_id, up, checked_at)
+        VALUES (${s.id}, ${up}, NOW())
+    `;
+    return { up };
+  },
+);
+
+// Define a database named 'monitor', using the database migrations
+// in the "./migrations" folder. Encore automatically provisions,
+// migrates, and connects to the database.
+export const MonitorDB = new SQLDatabase("monitor", {
+  migrations: "./migrations",
+});
+```
+
+🥐 Restart `encore run` to cause the `monitor` database to be created.
+
+We can again verify that the database was created in the Flow diagram, and also see the dependency between the `monitor` service and the `site` service that we just added.
+
+We can then call the `monitor.check` endpoint using the id `1` that we got in the last step, and view the trace where we see the database interactions.
+
+It will look something like this:
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/uptime_tut_3.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+You can also also inspect the database using `encore db shell <database-name>`:
+
+```shell
+$ encore db shell monitor
+psql (14.4, server 14.2)
+Type "help" for help.
+
+monitor=> SELECT * FROM checks;
+ id | site_id | up |          checked_at
+----+---------+----+-------------------------------
+  1 |       1 | t  | 2022-10-21 09:58:30.674265+00
+```
+
+If that's what you see, everything's working perfectly!
+
+### Add a cron job to check all sites
+
+We now want to regularly check all the tracked sites so we can
+respond in case any of them go down.
+
+We'll create a new `checkAll` API endpoint in the `monitor` service
+that will list all the tracked sites and check all of them.
+
+🥐 Let's extract some of the functionality we wrote for the
+`check` endpoint into a separate function, like so:
+
+```ts
+-- monitor/check.ts --
+import {Site} from "../site/site";
+
+// Check checks a single site.
+export const check = api(
+  { expose: true, method: "POST", path: "/check/:siteID" },
+  async (p: { siteID: number }): Promise<{ up: boolean }> => {
+    const s = await site.get({ id: p.siteID });
+    return doCheck(s);
+  },
+);
+
+async function doCheck(site: Site): Promise<{ up: boolean }> {
+  const { up } = await ping({ url: site.url });
+  await MonitorDB.exec`
+      INSERT INTO checks (site_id, up, checked_at)
+      VALUES (${site.id}, ${up}, NOW())
+  `;
+  return { up };
+}
+```
+
+Now we're ready to create our new `checkAll` endpoint.
+
+🥐 Create the new `checkAll` endpoint inside `monitor/check.ts`:
+
+```ts
+-- monitor/check.ts --
+// CheckAll checks all sites.
+export const checkAll = api(
+  { expose: true, method: "POST", path: "/check-all" },
+  async (): Promise<void> => {
+    const sites = await site.list();
+    await Promise.all(sites.sites.map(doCheck));
+  },
+);
+```
+
+🥐 Now that we have a `checkAll` endpoint, define a [cron job](https://encore.dev/docs/ts/primitives/cron-jobs) to automatically call it every 1 hour (since this is an example, we don't need to go too crazy and check every minute):
+
+```ts
+-- monitor/check.ts --
+import { CronJob } from "encore.dev/cron";
+
+// Check all tracked sites every 1 hour.
+const cronJob = new CronJob("check-all", {
+  title: "Check all sites",
+  every: "1h",
+  endpoint: checkAll,
+});
+```
+
+<Callout type="info">
+
+To avoid confusion while developing, cron jobs are not triggered when running the application locally but work when deploying the application to a cloud environment.
+
+</Callout>
+
+The frontend needs a way to list all sites and display if they are up or down.
+
+🥐 Add a file `monitor/status.ts` with the following code:
+
+```ts
+import { api } from "encore.dev/api";
+import { MonitorDB } from "./check";
+
+interface SiteStatus {
+  id: number;
+  up: boolean;
+  checkedAt: string;
+}
+
+// StatusResponse is the response type from the Status endpoint.
+interface StatusResponse {
+  // Sites contains the current status of all sites,
+  // keyed by the site ID.
+  sites: SiteStatus[];
+}
+
+// status checks the current up/down status of all monitored sites.
+export const status = api(
+  { expose: true, path: "/status", method: "GET" },
+  async (): Promise<StatusResponse> => {
+    const rows = await MonitorDB.query`
+      SELECT DISTINCT ON (site_id) site_id, up, checked_at
+      FROM checks
+      ORDER BY site_id, checked_at DESC
+    `;
+    const results: SiteStatus[] = [];
+    for await (const row of rows) {
+      results.push({
+        id: row.site_id,
+        up: row.up,
+        checkedAt: row.checked_at,
+      });
+    }
+    return { sites: results };
+  },
+);
+```
+
+Now that the backend is working, let's open [http://localhost:4000/](http://localhost:4000/) in the browser to see the frontend of our application.
+
+<img className="w-full h-auto" src="/assets/tutorials/uptime/frontend.png" title="Frontend" />
+
+## 5. Deploy
+
+To try out your uptime monitor for real, let's deploy it to the cloud.
+
+<Accordion>
+
+### Self-hosting
+
+Encore supports building Docker images directly from the CLI, which can then be self-hosted on your own infrastructure of choice.
+
+If your app is using infrastructure resources, such as SQL databases, Pub/Sub, or metrics, you will need to supply a [runtime configuration](/docs/ts/self-host/configure-infra) your Docker image.
+
+🥐 Create a new file `infra-config.json` in the root of your project with the following contents:
+
+```json
+{
+   "$schema": "https://encore.dev/schemas/infra.schema.json",
+   "sql_servers": [
+      {
+         "host": "my-db-host:5432",
+         "databases": {
+            "monitor": {
+               "username": "my-db-owner",
+                "password": {"$env": "DB_PASSWORD"}
+            },
+            "site": {
+               "username": "my-db-owner",
+                "password": {"$env": "DB_PASSWORD"}
+            }
+         }
+      }
+   ]
+}
+```
+
+The values in this configuration are just examples, you will need to replace them with the correct values for your database.
+Take a look at our guide for [deploying an Encore app with a PostgreSQL database to Digital Ocean](/docs/ts/self-host/deploy-digitalocean) for more information.
+
+🥐 Build a Docker image by running `encore build docker uptime:v1.0`.
+
+This will compile your application using the host machine and then produce a Docker image containing the compiled application.
+
+🥐 Upload the Docker image to the cloud provider of your choice and run it.
+
+</Accordion>
+
+<Accordion>
+
+### Encore Cloud (free)
+
+Encore Cloud provides automated infrastructure and DevOps. Deploy to a free development environment or to your own cloud account on AWS or GCP.
+
+### Create account
+
+Before deploying with Encore Cloud, you need to have a free Encore Cloud account and link your app to the platform. If you already have an account, you can move on to the next step.
+
+If you don’t have an account, the simplest way to get set up is by running `encore app create` and selecting **Y** when prompted to create a new account. Once your account is set up, continue creating a new app, selecting the `empty app` template.
+
+After creating the app, copy your project files into the new app directory, ensuring that you do not replace the `encore.app` file (this file holds a unique id which links your app to the platform).
+
+### Commit changes
+
+Encore comes with built-in CI/CD, and the deployment process is as simple as a `git push`. (You can also integrate with GitHub, learn more in the [CI/CD docs](/docs/platform/deploy/deploying).)
+
+🥐 Let's deploy your app to Encore's free development cloud by running:
+
+```shell
+$ git add -A .
+$ git commit -m 'Initial commit'
+$ git push encore
+```
+
+Encore will now build and test your app, provision the needed infrastructure, and deploy your application to the cloud.
+
+After triggering the deployment, you will see a URL where you can view its progress in the [Encore Cloud dashboard](https://app.encore.cloud). It will look something like: `https://app.encore.cloud/$APP_ID/deploys/...`
+
+From the Cloud Dashboard you can also see metrics, trigger Cron Jobs, see traces, and later connect your own AWS or GCP account to use for deployment.
+
+<video autoPlay playsInline loop controls muted className="w-full h-full">
+  <source src="/assets/docs/uptime_tut_4.mp4" className="w-full h-full" type="video/mp4"/>
+</video>
+
+🥐 When the deploy has finished, you can try out your uptime monitor by going to `https://staging-$APP_ID.encr.app`.
+
+*You now have an app running in the cloud, well done!*
+
+</Accordion>
+
+## 6. Publish Pub/Sub events when a site goes down
+
+Hold on, an uptime monitoring system isn't very useful if it doesn't actually notify you when a site goes down.
+
+To do so let's add a [Pub/Sub topic](https://encore.dev/docs/ts/primitives/pubsub) on which we'll publish a message every time a site transitions from being up to being down, or vice versa.
+
+🥐 Define the topic using Encore's Pub/Sub module in `monitor/check.ts`:
+
+```ts
+-- monitor/check.ts --
+import { Subscription, Topic } from "encore.dev/pubsub";
+
+// TransitionEvent describes a transition of a monitored site
+// from up->down or from down->up.
+export interface TransitionEvent {
+  site: Site; // Site is the monitored site in question.
+  up: boolean; // Up specifies whether the site is now up or down (the new value).
+}
+
+// TransitionTopic is a pubsub topic with transition events for when a monitored site
+// transitions from up->down or from down->up.
+export const TransitionTopic = new Topic<TransitionEvent>("uptime-transition", {
+  deliveryGuarantee: "at-least-once",
+});
+```
+
+Now let's publish a message on the `TransitionTopic` if a site's up/down
+state differs from the previous measurement.
+
+🥐 Create a `getPreviousMeasurement` function to report the last up/down state:
+
+```ts
+-- monitor/check.ts --
+// getPreviousMeasurement reports whether the given site was
+// up or down in the previous measurement.
+async function getPreviousMeasurement(siteID: number): Promise<boolean> {
+  const row = await MonitorDB.queryRow`
+      SELECT up
+      FROM checks
+      WHERE site_id = ${siteID}
+      ORDER BY checked_at DESC
+      LIMIT 1
+  `;
+  return row?.up ?? true;
+}
+```
+
+🥐 Now add a function to conditionally publish a message if the up/down state differs by modifying the `doCheck` function:
+
+```ts
+-- monitor/check.ts --
+async function doCheck(site: Site): Promise<{ up: boolean }> {
+  const { up } = await ping({ url: site.url });
+
+  // Publish a Pub/Sub message if the site transitions
+  // from up->down or from down->up.
+  const wasUp = await getPreviousMeasurement(site.id);
+  if (up !== wasUp) {
+    await TransitionTopic.publish({ site, up });
+  }
+
+  await MonitorDB.exec`
+      INSERT INTO checks (site_id, up, checked_at)
+      VALUES (${site.id}, ${up}, NOW())
+  `;
+  return { up };
+}
+```
+
+🥐 Start your app again using `encore run` and open the Flow architecture diagram in the local development dashboard. Now you'll see the Pub/Sub topic as a black box, it should look like this:
+
+<img className="w-full h-auto" src="/assets/docs/uptime_tut_flow_2.png" title="Architecture diagram" />
+
+Now the monitoring system will publish messages on the `TransitionTopic`
+whenever a monitored site transitions from up->down or from down->up.
+It doesn't know or care who actually listens to these messages.
+
+The truth is right now nobody does. So let's fix that by adding
+a Pub/Sub subscriber that posts these events to Slack.
+
+## 7. Send Slack notifications when a site goes down
+
+🥐 Start by creating a new service named `slack`:
+
+```shell
+$ mkdir slack # Create a new directory in the application root
+$ touch slack/encore.service.ts
+```
+
+```ts
+-- slack/encore.service.ts --
+import { Service } from "encore.dev/service";
+
+export default new Service("slack");
+```
+
+🥐 Add a `slack.ts` file containing the following:
+
+```ts
+-- slack/slack.ts --
+import { api } from "encore.dev/api";
+import { secret } from "encore.dev/config";
+import log from "encore.dev/log";
+
+export interface NotifyParams {
+  text: string; // the slack message to send
+}
+
+// Sends a Slack message to a pre-configured channel using a
+// Slack Incoming Webhook (see https://api.slack.com/messaging/webhooks).
+export const notify = api<NotifyParams>({}, async ({ text }) => {
+  const url = webhookURL();
+  if (!url) {
+    log.info("no slack webhook url defined, skipping slack notification");
+    return;
+  }
+
+  const resp = await fetch(url, {
+    method: "POST",
+    headers: {
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ content: text }),
+  });
+  if (resp.status >= 400) {
+    const body = await resp.text();
+    throw new Error(`slack notification failed: ${resp.status}: ${body}`);
+  }
+});
+
+// SlackWebhookURL defines the Slack webhook URL to send uptime notifications to.
+const webhookURL = secret("SlackWebhookURL");
+```
+
+🥐 Now go to a Slack community of your choice where you have the permission to create a new Incoming Webhook.
+
+🥐 Once you have the Webhook URL, set it as an Encore secret:
+
+```shell
+$ encore secret set --type dev,local,pr SlackWebhookURL
+Enter secret value: *****
+Successfully updated development secret SlackWebhookURL.
+```
+
+🥐 Test the `slack.notify` endpoint by calling it via cURL:
+
+```shell
+$ curl 'http://localhost:4000/slack.notify' -d '{"text": "Testing Slack webhook"}'
+```
+You should see the *Testing Slack webhook* message appear in the Slack channel you designated for the webhook.
+
+🥐 When it works it's time to add a Pub/Sub subscriber to automatically notify Slack when a monitored site goes up or down. Add the following:
+
+```ts
+-- slack/slack.ts --
+import { Subscription } from "encore.dev/pubsub";
+import { TransitionTopic } from "../monitor/check";
+
+const _ = new Subscription(TransitionTopic, "slack-notification", {
+  handler: async (event) => {
+    const text = `*${event.site.url} is ${event.up ? "back up." : "down!"}*`;
+    await notify({ text });
+  },
+});
+```
+
+## 8. Deploy your finished Uptime Monitor
+
+Now you're ready to deploy your finished Uptime Monitor, complete with a Slack integration.
+
+<Accordion>
+
+### Self-hosting
+
+Because we have added more infrastructure to our app, we need to [update the configuration](/docs/ts/self-host/configure-infra) in our `infra-config.json` to include the new Pub/Sub topic and subscription as well as how we should set the  `SlackWebhookURL` secret. 
+
+🥐 Update your `ìnfra-config.json` to reflect the new infrastructure.
+
+🥐 Build a Docker image by running `encore build docker uptime:v2.0`.
+
+🥐 Upload the Docker image to the cloud provider and run it.
+
+</Accordion>
+
+<Accordion>
+
+### Encore Cloud (free)
+
+🥐 As before, deploying your app to the cloud is as simple as running:
+
+```shell
+$ git add -A .
+$ git commit -m 'Add slack integration'
+$ git push encore
+```
+
+### Celebrate with fireworks
+
+Now that your app is running in the cloud, let's celebrate with some fireworks:
+
+🥐 In the Cloud Dashboard, open the Command Menu by pressing **Cmd + K** (Mac) or **Ctrl + K** (Windows/Linux).
+
+_From here you can easily access all Cloud Dashboard features and for example jump straight to specific services in the Service Catalog or view Traces for specific endpoints._
+
+🥐 Type `fireworks` in the Command Menu and press enter. Sit back and enjoy the show!
+
+![Fireworks](/assets/docs/fireworks.jpg)
+
+</Accordion>
+
+## Conclusion
+
+We've now built a fully functioning uptime monitoring system.
+
+If we may say so ourselves (and we may; it's our documentation after all)
+it's pretty remarkable how much we've accomplished in such little code:
+
+* We've built three different services (`site`, `monitor`, and `slack`)
+* We've added two databases (to the `site` and `monitor` services) for tracking monitored sites and the monitoring results
+* We've added a cron job for automatically checking the sites every hour
+* We've set up a Pub/Sub topic to decouple the monitoring system from the Slack notifications
+* We've added a Slack integration, using secrets to securely store the webhook URL, listening to a Pub/Sub subscription for up/down transition events
+
+All of this in just a bit over 300 lines of code. It's time to lean back
+and take a sip of your favorite beverage, safe in the knowledge you'll
+never be caught unaware of a website going down suddenly.
diff --git a/e2e-tests/README.md b/e2e-tests/README.md
new file mode 100644
index 0000000000..b33e3c03d6
--- /dev/null
+++ b/e2e-tests/README.md
@@ -0,0 +1,11 @@
+# End to End Tests
+
+This folder contains end to end tests for Encore, which test everything in Encore
+as an end user would use it.
+
+The tests will:
+1. Effectively run `encore run` on the [echo test app](./testdata/echo)
+2. Perform some basic requests against the running app to verify behaviour
+3. Generate the front end clients for the app
+4. Run tests against using generated clients against the running app
+5. Shutdown the running app
diff --git a/e2e-tests/app_test.go b/e2e-tests/app_test.go
new file mode 100644
index 0000000000..1f5771f20a
--- /dev/null
+++ b/e2e-tests/app_test.go
@@ -0,0 +1,330 @@
+//go:build e2e
+
+package tests
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+	"github.com/gofrs/uuid"
+	"github.com/rs/zerolog/log"
+
+	"encore.dev/appruntime/exported/experiments"
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/namespace"
+	"encr.dev/cli/daemon/pubsub"
+	"encr.dev/cli/daemon/redis"
+	. "encr.dev/cli/daemon/run"
+	"encr.dev/cli/daemon/run/infra"
+	"encr.dev/cli/daemon/secret"
+	. "encr.dev/internal/optracker"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/appfile"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/builder/builderimpl"
+	"encr.dev/pkg/cueutil"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/svcproxy"
+	"encr.dev/pkg/vcs"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+type RunAppData struct {
+	Addr  string
+	Run   *Run
+	Meta  *meta.Data
+	NSQ   *pubsub.NSQDaemon
+	Redis *redis.Server
+	Env   []string
+
+	Values map[string]any // arbitrary values for use in testscripts
+}
+
+func RunApp(c testing.TB, appRoot string, logger RunLogger, env []string) *RunAppData {
+	assertNil := func(err error) {
+		if err != nil {
+			c.Fatal(err)
+		}
+	}
+
+	ln, err := net.Listen("tcp", "localhost:0")
+	assertNil(err)
+	c.Cleanup(func() { _ = ln.Close() })
+
+	ctx, cancel := context.WithCancel(context.Background())
+	c.Cleanup(cancel)
+
+	svcProxy, err := svcproxy.New(ctx, log.Logger)
+	assertNil(err)
+
+	// Use a randomly generated app id to avoid tests trampling on each other
+	// since we use a persistent working directory based on the app id.
+	app := apps.NewInstance(appRoot, uuid.Must(uuid.NewV4()).String(), "")
+	bld := builderimpl.Resolve(app.Lang(), nil)
+
+	mgr := &Manager{}
+	ns := &namespace.Namespace{ID: "some-id", Name: "default"}
+	rm := infra.NewResourceManager(app, mgr.ClusterMgr, mgr.ObjectsMgr, mgr.PublicBuckets, ns, nil, 0, false)
+	run := &Run{
+		ID:              GenID(),
+		ListenAddr:      ln.Addr().String(),
+		SvcProxy:        svcProxy,
+		App:             app,
+		ResourceManager: rm,
+		Mgr:             mgr,
+		Builder:         bld,
+	}
+
+	parse, build, configs := testBuild(c, appRoot, env)
+
+	jobs := NewAsyncBuildJobs(ctx, app.PlatformOrLocalID(), nil)
+	run.ResourceManager.StartRequiredServices(jobs, parse.Meta)
+	c.Cleanup(rm.StopAll)
+
+	assertNil(jobs.Wait())
+
+	env = append(env, "FOO=bar", "BAR=baz")
+
+	if logger == nil {
+		logger = testRunLogger{c}
+	}
+
+	expSet, err := experiments.FromAppFileAndEnviron(nil, env)
+	assertNil(err)
+
+	secrets := secret.New()
+	secretData, err := secrets.Load(app).Get(ctx, expSet)
+	assertNil(err)
+
+	p, err := run.StartProcGroup(&StartProcGroupParams{
+		Ctx:            ctx,
+		Outputs:        build.Outputs,
+		Meta:           parse.Meta,
+		Logger:         logger,
+		Environ:        env,
+		ServiceConfigs: configs.Configs,
+		Experiments:    expSet,
+		Secrets:        secretData.Values,
+	})
+	assertNil(err)
+	c.Cleanup(p.Close)
+	run.StoreProc(p)
+	for serviceName, config := range configs.Configs {
+		env = append(env, fmt.Sprintf("%s=%s", fmt.Sprintf("ENCORE_CFG_%s", strings.ToUpper(serviceName)), base64.RawURLEncoding.EncodeToString([]byte(config))))
+	}
+
+	// start proxying TCP requests to the running application
+	startProxy(ctx, ln, http.HandlerFunc(p.ProxyReq))
+
+	// wait for the service to come up
+	b := backoff.NewExponentialBackOff()
+	b.MaxElapsedTime = 10 * time.Second
+	err = backoff.Retry(func() error {
+		w := httptest.NewRecorder()
+		req, err := http.NewRequestWithContext(ctx, "GET", "http://localhost/__encore/healthz", nil)
+		assertNil(err)
+
+		p.ProxyReq(w, req)
+
+		if w.Result().StatusCode != http.StatusOK {
+			return fmt.Errorf("unexpected status: %s", w.Result().Status)
+		}
+
+		return nil
+	}, b)
+	assertNil(err)
+
+	return &RunAppData{
+		Addr:   ln.Addr().String(),
+		Run:    run,
+		Meta:   parse.Meta,
+		NSQ:    rm.GetPubSub(),
+		Redis:  rm.GetRedis(),
+		Env:    env,
+		Values: make(map[string]any),
+	}
+}
+
+func RunTests(c testing.TB, appRoot string, stdout, stderr io.Writer, environ []string) error {
+	mgr := &Manager{
+		Secret:     secret.New(),
+		ClusterMgr: nil,
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	c.Cleanup(cancel)
+
+	// Use a randomly generated app id to avoid tests trampling on each other
+	// since we use a persistent working directory based on the app id.
+	app := apps.NewInstance(appRoot, uuid.Must(uuid.NewV4()).String(), "")
+
+	var args []string
+	switch app.Lang() {
+	case appfile.LangTS:
+		args = []string{}
+	case appfile.LangGo:
+		fallthrough
+	default:
+		args = []string{"./..."}
+	}
+
+	if app.Lang() == appfile.LangTS {
+		args = []string{}
+	}
+	err := mgr.Test(ctx, TestParams{
+		TestSpecParams: &TestSpecParams{
+			App:        app,
+			WorkingDir: ".",
+			Args:       args,
+			Environ:    environ,
+		},
+		Stdout: stdout,
+		Stderr: stderr,
+	})
+	return err
+}
+
+func getNodeJSPath() option.Option[string] {
+	path, err := exec.LookPath("node")
+	if err != nil {
+		return option.None[string]()
+	}
+	return option.Some(filepath.Dir(path))
+}
+
+// testRunLogger implements runLogger by calling t.Log.
+type testRunLogger struct {
+	log interface{ Log(args ...any) }
+}
+
+func (l testRunLogger) RunStdout(r *Run, line []byte) {
+	line = bytes.TrimSuffix(line, []byte{'\n'})
+	l.log.Log(string(line))
+}
+
+func (l testRunLogger) RunStderr(r *Run, line []byte) {
+	line = bytes.TrimSuffix(line, []byte{'\n'})
+	l.log.Log(string(line))
+}
+
+func startProxy(ctx context.Context, ln net.Listener, proxyHandler http.Handler) {
+	srv := &http.Server{Handler: proxyHandler}
+	go func() {
+		<-ctx.Done()
+		_ = srv.Close()
+	}()
+
+	go func() { _ = srv.Serve(ln) }()
+}
+
+// testBuild is a helper that compiles the app situated at appRoot
+// and cleans up the build dir during test cleanup.
+func testBuild(t testing.TB, appRoot string, env []string) (*builder.ParseResult, *builder.CompileResult, *builder.ServiceConfigsResult) {
+	expSet, err := experiments.FromAppFileAndEnviron(nil, env)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Use a randomly generated app id to avoid tests trampling on each other
+	// since we use a persistent working directory based on the app id.
+	app := apps.NewInstance(appRoot, uuid.Must(uuid.NewV4()).String(), "")
+
+	bld := builderimpl.Resolve(app.Lang(), expSet)
+	defer fns.CloseIgnore(bld)
+	ctx := context.Background()
+
+	vcsRevision := vcs.GetRevision(app.Root())
+	buildInfo := builder.BuildInfo{
+		BuildTags:          builder.LocalBuildTags,
+		CgoEnabled:         true,
+		StaticLink:         false,
+		DebugMode:          builder.DebugModeDisabled,
+		GOOS:               runtime.GOOS,
+		GOARCH:             runtime.GOARCH,
+		KeepOutput:         false,
+		Revision:           vcsRevision.Revision,
+		UncommittedChanges: vcsRevision.Uncommitted,
+
+		// Use the local JS runtime if this is a development build.
+		UseLocalJSRuntime: version.Channel == version.DevBuild,
+	}
+
+	parse, err := bld.Parse(ctx, builder.ParseParams{
+		Build:       buildInfo,
+		App:         app,
+		Experiments: expSet,
+		WorkingDir:  ".",
+		ParseTests:  false,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = bld.GenUserFacing(ctx, builder.GenUserFacingParams{
+		Build: buildInfo,
+		App:   app,
+		Parse: parse,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	configs, err := bld.ServiceConfigs(ctx, builder.ServiceConfigsParams{
+		Parse: parse,
+		CueMeta: &cueutil.Meta{
+			APIBaseURL: "http://what?",
+			EnvName:    "end_to_end_test",
+			EnvType:    cueutil.EnvType_Development,
+			CloudType:  cueutil.CloudType_Local,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	build, err := bld.Compile(ctx, builder.CompileParams{
+		Build:       buildInfo,
+		App:         app,
+		Parse:       parse,
+		OpTracker:   nil,
+		Experiments: expSet,
+		WorkingDir:  ".",
+	})
+
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	t.Cleanup(func() {
+		for _, output := range build.Outputs {
+			_ = os.RemoveAll(output.GetArtifactDir().ToIO())
+		}
+	})
+	return parse, build, configs
+}
+
+func runGoModTidy(dir string) error {
+	cmd := exec.Command("go", "mod", "tidy")
+	cmd.Dir = dir
+	cmd.Env = append(os.Environ(), "GO111MODULE=on")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("go mod tidy failed: %s", out)
+	}
+	return nil
+}
diff --git a/e2e-tests/echo_app_test.go b/e2e-tests/echo_app_test.go
new file mode 100644
index 0000000000..5a76a540f2
--- /dev/null
+++ b/e2e-tests/echo_app_test.go
@@ -0,0 +1,613 @@
+//go:build e2e
+
+package tests
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/rs/zerolog/log"
+	"go.uber.org/goleak"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/cli/daemon/namespace"
+	. "encr.dev/cli/daemon/run"
+	"encr.dev/cli/daemon/run/infra"
+	. "encr.dev/internal/optracker"
+	"encr.dev/pkg/clientgen"
+	"encr.dev/pkg/clientgen/clientgentypes"
+	"encr.dev/pkg/golden"
+	"encr.dev/pkg/svcproxy"
+	"encr.dev/v2/v2builder"
+)
+
+type Data[K any, V any] struct {
+	Key   K
+	Value V
+}
+
+type NonBasicRequest struct {
+	Struct        Data[*Data[string, string], int]
+	StructPtr     *Data[int, uint16]
+	StructSlice   []*Data[string, string]
+	StructMap     map[string]*Data[string, float32]
+	StructMapPtr  *map[string]*Data[string, string]
+	AnonStruct    struct{ AnonBird string }
+	NamedStruct   *Data[string, float64] `json:"formatted_nest"`
+	RawStruct     Data[[]string, []byte]
+	UnusedRequest *NonBasicRequest
+}
+
+type NonBasicResponse struct {
+	// Body
+	Struct       Data[*Data[string, string], int]
+	StructPtr    *Data[int, uint16]
+	StructSlice  []*Data[string, string]
+	StructMap    map[string]*Data[string, float32]
+	StructMapPtr *map[string]*Data[string, string]
+	AnonStruct   struct{ AnonBird string }
+	NamedStruct  *Data[string, float64] `json:"formatted_nest"`
+	RawStruct    json.RawMessage
+
+	// Query
+	QueryString    string
+	QueryNumber    int
+	OptQueryString string
+	OptQueryNumber int
+
+	// Path
+	PathString string
+	PathInt    int
+	PathWild   string
+
+	// Auth
+	AuthHeader string
+	AuthQuery  []int
+}
+
+// TestEndToEndWithApp tests that (*app).startProc correctly starts Encore processes
+// for sending requests.
+func TestEndToEndWithApp(t *testing.T) {
+	doTestEndToEndWithApp(t, nil)
+}
+
+func doTestEndToEndWithApp(t *testing.T, env []string) {
+	c := qt.New(t)
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	appRoot := filepath.Join(wd, "testdata", "echo")
+	app := RunApp(c, appRoot, nil, env)
+	run := app.Run
+
+	// Use golden to test that the generated clients are as expected for the echo test app
+	for lang, path := range map[clientgen.Lang]string{
+		clientgen.LangGo:         "golang/client/goclient.go",
+		clientgen.LangTypeScript: "ts/client.ts",
+		clientgen.LangJavascript: "js/client.js",
+	} {
+		services := clientgentypes.AllServices(app.Meta)
+		client, err := clientgen.Client(lang, "slug", app.Meta, services, clientgentypes.TagSet{}, clientgentypes.Options{})
+		if err != nil {
+			fmt.Println(err.Error())
+			c.FailNow()
+		}
+		c.Assert(err, qt.IsNil, qt.Commentf("Got an error generating the client for: %s", lang))
+
+		golden.TestAgainst(c, filepath.Join("echo_client", path), string(client))
+	}
+
+	c.Run("basic requests", func(c *qt.C) {
+		// Send a simple request
+		c.Run("Send a simple request", func(c *qt.C) {
+			input := Data[string, int]{"hello", 1}
+			body, err := json.Marshal(&input)
+			c.Assert(err, qt.IsNil)
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("POST", "/echo.Echo", bytes.NewReader(body))
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+			c.Assert(w.Body.Bytes(), qt.JSONEquals, input)
+		})
+
+		// Send a pubsub
+		c.Run("send a pubsub", func(c *qt.C) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("POST", "/echo.Publish", nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+
+			// Wait a bit to allow the message to be consumed.
+			time.Sleep(100 * time.Millisecond)
+
+			stats, err := app.NSQ.Stats()
+			c.Assert(err, qt.IsNil)
+			c.Assert(len(stats.Producers), qt.Equals, 1)
+			c.Assert(len(stats.Topics), qt.Equals, 1)
+			c.Assert(stats.Topics[0].TopicName, qt.Equals, "test")
+			c.Assert(len(stats.Topics[0].Channels), qt.Equals, 1)
+			c.Assert(stats.Topics[0].Channels[0].RequeueCount == 0, qt.IsTrue)
+			c.Assert(stats.Topics[0].Channels[0].Depth == 0, qt.IsTrue)
+		})
+
+		// Call an endpoint using an unsupported HTTP Method
+		c.Run("unsupported HTTP Method", func(c *qt.C) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.Echo", nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 404)
+		})
+
+		// Send an empty request
+		c.Run("empty request", func(c *qt.C) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("POST", "/echo.EmptyEcho", bytes.NewReader([]byte("{}")))
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+			c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]any{
+				"NullPtr": nil,
+				"Zero":    Data[string, string]{},
+			})
+		})
+
+		// Send a non-basic type request with path params, headers, query string and body
+		c.Run("non-basic type request", func(c *qt.C) {
+			input := NonBasicRequest{
+				Struct:      Data[*Data[string, string], int]{&Data[string, string]{"peacock", "duck"}, 1},
+				StructPtr:   &Data[int, uint16]{2, 3},
+				StructSlice: []*Data[string, string]{{"seagull", "penguin"}, {"penguin", "seagull"}},
+				StructMap: map[string]*Data[string, float32]{
+					"hawk":      {"hummingbird", 18.5},
+					"albatross": {"magpie", 13.2},
+				},
+				StructMapPtr: &map[string]*Data[string, string]{
+					"hornbill": {"bird-of-paradise", "cuckoo"},
+					"turkey":   {"owl", "waxbill"},
+				},
+				AnonStruct:    struct{ AnonBird string }{AnonBird: "dove"},
+				NamedStruct:   &Data[string, float64]{"pigeon", 34.2},
+				UnusedRequest: &NonBasicRequest{StructPtr: &Data[int, uint16]{43, 9}},
+				RawStruct:     Data[[]string, []byte]{[]string{"emu", "ostrich"}, []byte{4, 4, 5}},
+			}
+
+			output := NonBasicResponse{
+				Struct:       input.Struct,
+				StructPtr:    input.StructPtr,
+				StructSlice:  input.StructSlice,
+				StructMap:    input.StructMap,
+				StructMapPtr: input.StructMapPtr,
+				AnonStruct:   input.AnonStruct,
+				NamedStruct:  input.NamedStruct,
+				QueryString:  "robin",
+				QueryNumber:  33,
+				RawStruct:    json.RawMessage(`{"Key": ["emu", "ostrich"], "Value": "BAQF"}`),
+				PathString:   "shoebill",
+				PathInt:      55,
+				PathWild:     "toucan/crane/vulture/78/",
+				AuthHeader:   "header",
+				AuthQuery:    []int{5, 6},
+			}
+			body, err := json.Marshal(&input)
+			c.Assert(err, qt.IsNil)
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("POST", "/NonBasicEcho/shoebill/55/toucan/crane/vulture/78/?string=robin&no=33&query=5&query=6", bytes.NewReader(body))
+			req.Header.Add("X-Header", "header")
+			req.Header.Add("X-Header-String", "starling")
+			req.Header.Add("X-Header-Number", "10")
+			req.Header.Add("Authorization", "Bearer tokendata")
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+			c.Assert(w.Header().Get("X-Header-String"), qt.Equals, "starling")
+			c.Assert(w.Header().Get("X-Header-Number"), qt.Equals, "10")
+			c.Assert(w.Body.Bytes(), qt.JSONEquals, output)
+		})
+
+		// Send a request with only header parameters
+		c.Run("only headers", func(c *qt.C) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.HeadersEcho", nil)
+			req.Header.Add("x-int", "1")
+			req.Header.Add("x-string", "nightingale")
+			req.Header.Add("X-StringSlice", "mynah, quail, weaver")
+			req.Header.Add("X-StringSlice", "pewit")
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+			c.Assert(w.Header().Get("X-Int"), qt.Equals, "1")
+			c.Assert(w.Header().Get("X-String"), qt.Equals, "nightingale")
+		})
+
+		// Send POST and GET requests to the same endpoint with an assortment of basic types
+		c.Run("POST and GET", func(c *qt.C) {
+			input := map[string]any{
+				"string":       "string",
+				"uint":         1,
+				"int":          2,
+				"int8":         -3,
+				"int64":        4,
+				"float32":      5,
+				"float64":      6,
+				"string_slice": []any{"slice1", "slice2"},
+				"int_slice":    []any{1, 2, 3},
+				"time":         "2016-01-02T15:04:05+07:00",
+			}
+			output := map[string]any{
+				"String":      "string",
+				"Uint":        1,
+				"Int":         2,
+				"Int8":        -3,
+				"Int64":       4,
+				"Float32":     5,
+				"Float64":     6,
+				"StringSlice": []any{"slice1", "slice2"},
+				"IntSlice":    []any{1, 2, 3},
+				"Time":        "2016-01-02T15:04:05+07:00",
+			}
+			qs := ""
+			for k, av := range input {
+				vs := []any{av}
+				switch av.(type) {
+				case []any:
+					vs = av.([]any)
+				}
+				for _, v := range vs {
+					if len(qs) > 0 {
+						qs += "&"
+					}
+					value := url.QueryEscape(fmt.Sprintf("%v", v))
+					qs += fmt.Sprintf("%s=%v", strings.ToLower(k), value)
+				}
+			}
+			body, err := json.Marshal(&output)
+			c.Assert(err, qt.IsNil)
+			w := httptest.NewRecorder()
+			w2 := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.BasicEcho?"+qs, nil)
+			req2 := httptest.NewRequest("POST", "/echo.BasicEcho", bytes.NewReader(body))
+			run.ServeHTTP(w, req)
+			run.ServeHTTP(w2, req2)
+			c.Assert(w.Code, qt.Equals, 200)
+			c.Assert(w.Body.Bytes(), qt.JSONEquals, output)
+			c.Assert(w2.Body.Bytes(), qt.DeepEquals, w.Body.Bytes())
+		})
+
+		// Call an endpoint without request parameters, returning nil
+		c.Run("without request", func(c *qt.C) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.NilResponse", nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+		})
+
+		// Call an endpoint with an invalid auth parameter
+		c.Run("invalid parameter", func(c *qt.C) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.NilResponse", nil)
+			req.Header.Add("x-auth-int", "invalid")
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 400)
+			c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]any{
+				"code":    "invalid_argument",
+				"details": nil,
+				"message": "invalid auth param: x-auth-int: invalid parameter: strconv.ParseInt: parsing \"invalid\": invalid syntax",
+			})
+		})
+
+		// Call an endpoint without request parameters and response value
+		c.Run("without response", func(c *qt.C) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.Noop", nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+		})
+
+		// Call an endpoint with request parameters but no response value
+		c.Run("only request", func(c *qt.C) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.MuteEcho?key=pelican&value=cocabura", nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+		})
+
+		// Call an endpoint with a response value but no request parameters
+		c.Run("no request, response", func(c *qt.C) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.Pong", nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+			c.Assert(w.Body.Bytes(), qt.JSONEquals, Data[string, string]{"woodpecker", "kingfisher"})
+		})
+
+		// Call endpoint with custom http status in response
+		c.Run("custom http status response", func(c *qt.C) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.CustomHTTPStatus", nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 201)
+		})
+
+		// Call the env endpoint and make sure we get our env variables back
+		{
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.Env", nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+
+			filteredEnv := make([]string, 0, len(app.Env))
+			for _, env := range app.Env {
+				if !strings.HasPrefix(env, "ENCORE_") {
+					filteredEnv = append(filteredEnv, env)
+				}
+			}
+			c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string][]string{"Env": filteredEnv})
+		}
+
+		// Call the app metadata endpoint and make sure we get correct data back
+		c.Run("app metadata", func(c *qt.C) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.AppMeta", nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+
+			// we need to extract the API Base URL as it will change due to the `RuntimePort: 0` above
+			bytes := w.Body.Bytes()
+			got := make(map[string]string)
+			_ = json.Unmarshal(bytes, &got)
+
+			c.Assert(strings.HasPrefix(got["APIBaseURL"], "http://"), qt.IsTrue)
+			c.Assert(bytes, qt.JSONEquals, map[string]interface{}{
+				"AppID":      "",
+				"APIBaseURL": got["APIBaseURL"],
+				"EnvName":    "local",
+				"EnvType":    "development",
+			})
+		})
+
+		// Try the dependency injection services
+		c.Run("dependency_injection", func(c *qt.C) {
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("GET", "/di/one", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.HasLen, 0)
+			}
+
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("GET", "/di/two", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]string{"Msg": "Hello World"})
+			}
+
+		})
+
+		c.Run("cache", func(c *qt.C) {
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("GET", "/cache/incr/one", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]any{"Val": 1})
+			}
+
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("GET", "/cache/incr/one", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]any{"Val": 2})
+			}
+
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("GET", "/cache/incr/two", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]any{"Val": 1})
+			}
+
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("POST", "/cache/struct/1/foo", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.HasLen, 0)
+			}
+
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("GET", "/cache/struct/1", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]any{"Val": "foo"})
+			}
+
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("GET", "/cache/list/1", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]any{"Vals": []string{}})
+			}
+
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("POST", "/cache/list/1/foo", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.HasLen, 0)
+			}
+
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("GET", "/cache/list/1", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]any{"Vals": []string{"foo"}})
+			}
+
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("POST", "/cache/list/1/bar", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.HasLen, 0)
+			}
+
+			{
+				w := httptest.NewRecorder()
+				req := httptest.NewRequest("GET", "/cache/list/1", nil)
+				run.ServeHTTP(w, req)
+				c.Assert(w.Code, qt.Equals, 200)
+				c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]any{"Vals": []string{"foo", "bar"}})
+			}
+
+			keys := app.Redis.Miniredis().Keys()
+			c.Assert(keys, qt.DeepEquals, []string{
+				"int/one",
+				"int/two",
+				"list/1/foo/1",
+				"struct/1/dummy/x",
+			})
+		})
+	})
+
+	c.Run("generated_wrappers_for_intra_service_calls", func(c *qt.C) {
+		// Send a simple request
+		{
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/generated-wrappers-end-to-end-test", nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+		}
+	})
+
+	c.Run("config_test", func(c *qt.C) {
+		{
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/echo.ConfigValues", nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 200)
+			c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]any{
+				"ReadOnlyMode": true,
+				"PublicKey":    "aGVsbG8gd29ybGQK",
+				"AdminUsers":   []string{"foo", "bar"},
+				"SubKeyCount":  2,
+			})
+		}
+	})
+
+	c.Run("go_generated_client", func(c *qt.C) {
+		encoreGoroot := os.Getenv("ENCORE_GOROOT")
+		c.Assert(encoreGoroot, qt.Not(qt.Equals), "")
+		goPath := filepath.Join(encoreGoroot, "bin", "go")
+		cmd := exec.Command(goPath, "run", ".", app.Addr)
+		cmd.Dir = filepath.Join("testdata", "echo_client")
+		cmd.Env = append(os.Environ(),
+			"GOROOT="+encoreGoroot,
+			"PATH="+fmt.Sprintf("%s%s%s", filepath.Join(encoreGoroot, "/bin"), string(filepath.ListSeparator), os.Getenv("PATH")),
+		)
+
+		out, err := cmd.CombinedOutput()
+		c.Assert(err, qt.IsNil, qt.Commentf("Got error running generated Go client: %s", out))
+	})
+
+	c.Run("typescript_generated_client", func(c *qt.C) {
+		npmCommandsToRun := [][]string{
+			{"install", "--prefer-offline", "--no-audit"},
+			{"run", "lint"},
+			{"run", "test", "--", app.Addr},
+		}
+
+		for _, args := range npmCommandsToRun {
+			cmd := exec.Command("npm", args...)
+			cmd.Dir = filepath.Join("testdata", "echo_client")
+
+			out, err := cmd.CombinedOutput()
+			c.Assert(err, qt.IsNil, qt.Commentf("Got error running generated Typescript client: %s", out))
+		}
+	})
+
+	c.Run("javascript_generated_client", func(c *qt.C) {
+		npmCommandsToRun := [][]string{
+			{"install", "--prefer-offline", "--no-audit"},
+			{"run", "lint"},
+			{"run", "test:js", "--", app.Addr},
+		}
+
+		for _, args := range npmCommandsToRun {
+			cmd := exec.Command("npm", args...)
+			cmd.Stdout = os.Stdout
+			cmd.Stderr = os.Stderr
+			cmd.Stdin = os.Stdin
+			cmd.Dir = filepath.Join("testdata", "echo_client")
+
+			c.Assert(cmd.Run(), qt.IsNil, qt.Commentf("Got error running generated JavaScript client"))
+		}
+	})
+}
+
+// TestProcClosedOnCtxCancel tests that the proc is closed when
+// the given ctx is cancelled.
+func TestProcClosedOnCtxCancel(t *testing.T) {
+	defer goleak.VerifyNone(t, goleak.IgnoreCurrent())
+
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	appRoot := filepath.Join(wd, "testdata", "echo")
+
+	app := apps.NewInstance(appRoot, "local_id", "platform_id")
+
+	c := qt.New(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	svcProxy, err := svcproxy.New(ctx, log.Logger)
+	c.Assert(err, qt.IsNil)
+
+	mgr := &Manager{}
+	ns := &namespace.Namespace{ID: "some-id", Name: "default"}
+	rm := infra.NewResourceManager(app, nil, nil, nil, ns, nil, 0, false)
+	run := &Run{
+		ID:              GenID(),
+		App:             app,
+		Mgr:             mgr,
+		ResourceManager: rm,
+		ListenAddr:      "127.0.0.1:34212",
+		SvcProxy:        svcProxy,
+		Builder:         v2builder.BuilderImpl{},
+	}
+
+	parse, build, _ := testBuild(c, appRoot, append(os.Environ(), "ENCORE_EXPERIMENT=v2"))
+	jobs := NewAsyncBuildJobs(ctx, app.PlatformOrLocalID(), nil)
+	run.ResourceManager.StartRequiredServices(jobs, parse.Meta)
+	defer run.Close()
+
+	c.Assert(jobs.Wait(), qt.IsNil)
+
+	p, err := run.StartProcGroup(&StartProcGroupParams{
+		Ctx:     ctx,
+		Outputs: build.Outputs,
+		Meta:    parse.Meta,
+		Logger:  testRunLogger{t},
+		Environ: os.Environ(),
+	})
+	c.Assert(err, qt.IsNil)
+	cancel()
+	<-p.Done()
+}
diff --git a/e2e-tests/testdata/echo/.gitignore b/e2e-tests/testdata/echo/.gitignore
new file mode 100644
index 0000000000..a10cfaa4b5
--- /dev/null
+++ b/e2e-tests/testdata/echo/.gitignore
@@ -0,0 +1,4 @@
+encore.gen.go
+/.encore
+encore.gen.cue
+/encore.gen
diff --git a/e2e-tests/testdata/echo/cache/cache.go b/e2e-tests/testdata/echo/cache/cache.go
new file mode 100644
index 0000000000..8b8229afe6
--- /dev/null
+++ b/e2e-tests/testdata/echo/cache/cache.go
@@ -0,0 +1,76 @@
+package cache
+
+import (
+	"context"
+
+	"encore.dev/beta/errs"
+	"encore.dev/storage/cache"
+)
+
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{
+	EvictionPolicy: cache.AllKeysLFU,
+})
+
+var ints = cache.NewIntKeyspace[string](cluster, cache.KeyspaceConfig{
+	KeyPattern: "int/:key",
+})
+
+type IncrResponse struct {
+	Val int64
+}
+
+//encore:api public path=/cache/incr/:key
+func Incr(ctx context.Context, key string) (*IncrResponse, error) {
+	val, err := ints.Increment(ctx, key, 1)
+	return &IncrResponse{Val: val}, err
+}
+
+type StructKey struct {
+	Key   int
+	Dummy string
+}
+
+type StructVal struct {
+	Val string
+}
+
+var structs = cache.NewStructKeyspace[StructKey, StructVal](cluster, cache.KeyspaceConfig{
+	KeyPattern: "struct/:Key/dummy/:Dummy",
+})
+
+//encore:api public method=POST path=/cache/struct/:key/:val
+func PostStruct(ctx context.Context, key int, val string) error {
+	err := structs.Set(ctx, StructKey{Key: key, Dummy: "x"}, StructVal{Val: val})
+	return err
+}
+
+//encore:api public method=GET path=/cache/struct/:key
+func GetStruct(ctx context.Context, key int) (StructVal, error) {
+	val, err := structs.Get(ctx, StructKey{Key: key, Dummy: "x"})
+	if err == cache.Miss {
+		return StructVal{}, &errs.Error{Code: errs.NotFound}
+	} else if err != nil {
+		return StructVal{}, err
+	}
+	return val, nil
+}
+
+var lists = cache.NewListKeyspace[int, string](cluster, cache.KeyspaceConfig{
+	KeyPattern: "list/:key/foo/:key",
+})
+
+//encore:api public method=POST path=/cache/list/:key/:val
+func PostList(ctx context.Context, key int, val string) error {
+	_, err := lists.PushRight(ctx, key, val)
+	return err
+}
+
+type ListResponse struct {
+	Vals []string
+}
+
+//encore:api public method=GET path=/cache/list/:key
+func GetList(ctx context.Context, key int) (ListResponse, error) {
+	vals, err := lists.Items(ctx, key)
+	return ListResponse{vals}, err
+}
diff --git a/e2e-tests/testdata/echo/di/di.go b/e2e-tests/testdata/echo/di/di.go
new file mode 100644
index 0000000000..7688cbcbcc
--- /dev/null
+++ b/e2e-tests/testdata/echo/di/di.go
@@ -0,0 +1,52 @@
+package di
+
+import (
+	"archive/zip"
+	"context"
+	"database/sql"
+	"io"
+	"net/http"
+	"sync"
+
+	"encore.dev/cron"
+)
+
+type TwoResponse struct {
+	Msg string
+}
+
+var _ = cron.NewJob("repeating-one", cron.JobConfig{
+	Title:    "Call One every 2 hours",
+	Every:    2 * cron.Hour,
+	Endpoint: One,
+})
+
+//encore:service
+type Service struct {
+	Msg string
+
+	// Include various types to make sure the parser doesn't complain.
+	mu   sync.Mutex
+	once *sync.Once
+	db   *sql.DB
+	fn   func() *zip.Writer
+}
+
+//encore:api public path=/di/one
+func (s *Service) One(ctx context.Context) error {
+	return nil
+}
+
+//encore:api public path=/di/two
+func (s *Service) Two(ctx context.Context) (*TwoResponse, error) {
+	return &TwoResponse{Msg: s.Msg}, nil
+}
+
+//encore:api public raw path=/di/raw
+func (s *Service) Three(w http.ResponseWriter, req *http.Request) {
+	io.Copy(w, req.Body)
+}
+
+func initService() (*Service, error) {
+	return &Service{Msg: "Hello World"}, nil
+}
diff --git a/e2e-tests/testdata/echo/echo/config.cue b/e2e-tests/testdata/echo/echo/config.cue
new file mode 100644
index 0000000000..9f8678da6b
--- /dev/null
+++ b/e2e-tests/testdata/echo/echo/config.cue
@@ -0,0 +1,15 @@
+import "encoding/base64"
+
+ReadOnlyMode: true
+PublicKey: base64.Decode(null, "aGVsbG8gd29ybGQK") // "hello world" in Base64
+
+SubConfig: SubKey: MaxCount: [
+	if #Meta.Environment.Type  == "test"  { 3 },
+	if #Meta.Environment.Cloud == "local" { 2 },
+	1
+][0]
+
+AdminUsers: [
+	"foo",
+	"bar",
+]
diff --git a/e2e-tests/testdata/echo/echo/config.go b/e2e-tests/testdata/echo/echo/config.go
new file mode 100644
index 0000000000..0324203c63
--- /dev/null
+++ b/e2e-tests/testdata/echo/echo/config.go
@@ -0,0 +1,50 @@
+package echo
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type CfgType[T any] struct {
+	ReadOnlyMode config.Bool
+	PublicKey    config.Bytes
+	AdminUsers   config.Values[string]
+
+	SubConfig config.Value[struct {
+		SubKey *SubCfgType[T]
+	}]
+
+	Currencies map[string]struct {
+		Name    config.String
+		Code    config.String
+		Aliases config.Values[string]
+	}
+
+	AnotherList config.Values[struct {
+		Name config.String
+	}]
+}
+
+type SubCfgType[T any] struct {
+	MaxCount T
+}
+
+var cfg = config.Load[*CfgType[uint]]()
+
+type ConfigResponse struct {
+	ReadOnlyMode bool
+	PublicKey    []byte
+	SubKeyCount  uint
+	AdminUsers   []string
+}
+
+//encore:api public
+func ConfigValues(ctx context.Context) (ConfigResponse, error) {
+	return ConfigResponse{
+		ReadOnlyMode: cfg.ReadOnlyMode(),
+		PublicKey:    cfg.PublicKey(),
+		AdminUsers:   cfg.AdminUsers(),
+		SubKeyCount:  cfg.SubConfig().SubKey.MaxCount,
+	}, nil
+}
diff --git a/e2e-tests/testdata/echo/echo/config_test.go b/e2e-tests/testdata/echo/echo/config_test.go
new file mode 100644
index 0000000000..a85112c8ac
--- /dev/null
+++ b/e2e-tests/testdata/echo/echo/config_test.go
@@ -0,0 +1,17 @@
+package echo
+
+import (
+	"context"
+	"testing"
+)
+
+func TestConfigValues(t *testing.T) {
+	values, err := ConfigValues(context.Background())
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if values.SubKeyCount != 3 {
+		t.Fatalf("expected 1, got %d", values.SubKeyCount)
+	}
+}
diff --git a/e2e-tests/testdata/echo/echo/echo.go b/e2e-tests/testdata/echo/echo/echo.go
new file mode 100644
index 0000000000..54666ba108
--- /dev/null
+++ b/e2e-tests/testdata/echo/echo/echo.go
@@ -0,0 +1,290 @@
+package echo
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"os"
+	"reflect"
+	"strconv"
+	"time"
+
+	encore "encore.dev"
+	"encore.dev/beta/auth"
+	"encore.dev/beta/errs"
+	"encore.dev/pubsub"
+)
+
+type Message struct {
+	Attr    string `pubsub-attr:"attr"`
+	Subject string
+	Body    string
+}
+
+var Topic = pubsub.NewTopic[*Message](
+	"test",
+	pubsub.TopicConfig{
+		DeliveryGuarantee: pubsub.AtLeastOnce,
+	},
+)
+
+var _ = pubsub.NewSubscription(
+	Topic, "test",
+	pubsub.SubscriptionConfig[*Message]{
+		Handler: Consumer,
+	},
+)
+
+type Data[K any, V any] struct {
+	Key   K
+	Value V
+}
+
+type NonBasicData struct {
+	// Header
+	HeaderString string `header:"X-Header-String"`
+	HeaderNumber int    `header:"X-Header-Number"`
+
+	// Body
+	Struct       Data[*Data[string, string], int]
+	StructPtr    *Data[int, uint16]
+	StructSlice  []*Data[string, string]
+	StructMap    map[string]*Data[string, float32]
+	StructMapPtr *map[string]*Data[string, string]
+	AnonStruct   struct{ AnonBird string }
+	NamedStruct  *Data[string, float64] `json:"formatted_nest"`
+	RawStruct    json.RawMessage
+
+	// Query
+	QueryString    string `query:"string"`
+	QueryNumber    int    `query:"no"`
+	OptQueryNumber int    `query:"optnum" encore:"optional"`
+	OptQueryString string `query:"optstr" encore:"optional"`
+
+	// Path Parameters
+	PathString string
+	PathInt    int
+	PathWild   string
+
+	// Auth Parameters
+	AuthHeader string
+	AuthQuery  []int
+
+	// Unexported fields
+	unexported string
+}
+
+type EmptyData struct {
+	OmitEmpty Data[string, string] `json:"OmitEmpty,omitempty"`
+	NullPtr   *string
+	Zero      Data[string, string]
+}
+
+type BasicData struct {
+	String      string
+	Uint        uint
+	Int         int
+	Int8        int8
+	Int64       int64
+	Float32     float32
+	Float64     float64
+	StringSlice []string
+	IntSlice    []int
+	Time        time.Time
+}
+
+type HeadersData struct {
+	Int    int    `header:"X-Int"`
+	String string `header:"X-String"`
+}
+
+// Publish publishes a request on a topic
+//
+//encore:api public
+func Publish(ctx context.Context) error {
+	id, err := Topic.Publish(ctx, &Message{
+		Attr:    "Attr",
+		Subject: "subject",
+		Body:    "body",
+	})
+	if err != nil {
+		return err
+	}
+	fmt.Printf("Published: %s\n", id)
+	return nil
+}
+
+//encore:api private
+func Consumer(ctx context.Context, msg *Message) error {
+	if msg.Attr != "Attr" {
+		return errors.New("incorrect Attr value")
+	}
+	if msg.Subject != "subject" {
+		return errors.New("incorrect Subject value")
+	}
+	if msg.Body != "body" {
+		return errors.New("incorrect Body value")
+	}
+	return nil
+}
+
+// Echo echoes back the request data.
+//
+//encore:api public
+func Echo(ctx context.Context, params *Data[string, int]) (*Data[string, int], error) {
+	return params, nil
+}
+
+// EmptyEcho echoes back the request data.
+//
+//encore:api public
+func EmptyEcho(ctx context.Context, params EmptyData) (EmptyData, error) {
+	return params, nil
+}
+
+// NonBasicEcho echoes back the request data.
+//
+//encore:api auth path=/NonBasicEcho/:pathString/:pathInt/*pathWild
+func NonBasicEcho(ctx context.Context, pathString string, pathInt int, pathWild string, params *NonBasicData) (*NonBasicData, error) {
+	data := auth.Data().(*AuthParams)
+	params.PathString = pathString
+	params.PathInt = pathInt
+	params.PathWild = pathWild
+	params.AuthQuery = data.Query
+	params.AuthHeader = data.Header
+	return params, nil
+}
+
+// BasicEcho echoes back the request data.
+//
+//encore:api public method=GET,POST
+func BasicEcho(ctx context.Context, params *BasicData) (*BasicData, error) {
+	return params, nil
+}
+
+// HeadersEcho echoes back the request headers
+//
+//encore:api public method=GET,POST
+func HeadersEcho(ctx context.Context, params *HeadersData) (*HeadersData, error) {
+	return params, nil
+}
+
+// Noop does nothing
+//
+//encore:api public method=GET
+func Noop(ctx context.Context) error {
+	return nil
+}
+
+// NilResponse returns a nil response and nil error
+//
+//encore:api public method=GET,POST
+func NilResponse(ctx context.Context) (*BasicData, error) {
+	return nil, nil
+}
+
+// MuteEcho absorbs a request
+//
+//encore:api public method=GET
+func MuteEcho(ctx context.Context, params Data[string, string]) error {
+	log.Printf("Absorbing %v\n", params)
+	return nil
+}
+
+// Pong returns a bird tuple
+//
+//encore:api public method=GET
+func Pong(ctx context.Context) (Data[string, string], error) {
+	return Data[string, string]{"woodpecker", "kingfisher"}, nil
+}
+
+// HTTPStatusResponse demonstrates encore:"httpstatus" tag functionality
+type HTTPStatusResponse struct {
+	Message string `json:"message"`
+	Status  int    `encore:"httpstatus"`
+}
+
+// CustomHTTPStatus allows testing of custom HTTP status codes via encore:"httpstatus" tag
+//
+//encore:api public
+func CustomHTTPStatus(ctx context.Context) (*HTTPStatusResponse, error) {
+	return &HTTPStatusResponse{
+		Message: "Created successfully",
+		Status:  201, // HTTP 201 Created
+	}, nil
+}
+
+type EnvResponse struct {
+	Env []string
+}
+
+// Env returns the environment.
+//
+//encore:api public
+func Env(ctx context.Context) (*EnvResponse, error) {
+	return &EnvResponse{Env: os.Environ()}, nil
+}
+
+type AppMetadata struct {
+	AppID      string
+	APIBaseURL string
+	EnvName    string
+	EnvType    string
+}
+
+// AppMeta returns app metadata.
+//
+//encore:api public
+func AppMeta(ctx context.Context) (*AppMetadata, error) {
+	md := encore.Meta()
+	return &AppMetadata{
+		AppID:      md.AppID,
+		APIBaseURL: md.APIBaseURL.String(),
+		EnvName:    md.Environment.Name,
+		EnvType:    string(md.Environment.Type),
+	}, nil
+}
+
+type AuthParams struct {
+	Header        string `header:"X-Header"`
+	AuthInt       int    `header:"X-Auth-Int"`
+	Authorization string `header:"Authorization"`
+	Query         []int  `query:"query"`
+	NewAuth       bool   `query:"new-auth"`
+}
+
+func (p *AuthParams) Validate() error {
+	if p.Header == "fail-validation" {
+		return errors.New("auth validation fail")
+	}
+	return nil
+}
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, params *AuthParams) (auth.UID, *AuthParams, error) {
+	if reflect.ValueOf(params).Elem().IsZero() {
+		panic("zero value auth params should skip authhandler")
+	}
+	if params.Authorization == "Bearer tokendata" && params.NewAuth == false {
+		return "user", params, nil
+	}
+
+	// Check headers and query strings work by adding them together to calculate the answer in the header field
+	if params.Header != "" && params.NewAuth {
+		ans := 0
+		for _, v := range params.Query {
+			ans += v
+		}
+
+		if strconv.FormatInt(int64(ans), 10) == params.Header {
+			return "second_user", params, nil
+		}
+	}
+
+	return "", nil, &errs.Error{
+		Code:    errs.Unauthenticated,
+		Message: "invalid token",
+	}
+}
diff --git a/e2e-tests/testdata/echo/echo/echo_test.go b/e2e-tests/testdata/echo/echo/echo_test.go
new file mode 100644
index 0000000000..7ac975cb3b
--- /dev/null
+++ b/e2e-tests/testdata/echo/echo/echo_test.go
@@ -0,0 +1,24 @@
+package echo
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+// TestEnvsProvided tests that 'go test' was invoked with the envs we expect.
+func TestEnvsProvided(t *testing.T) {
+	envs := os.Environ()
+	want := map[string]string{
+		"FOO": "bar",
+		"BAR": "baz",
+	}
+	for _, env := range envs {
+		key, val, _ := strings.Cut(env, "=")
+		if wantVal, ok := want[key]; ok {
+			if val != wantVal {
+				t.Errorf("got env %s=%s, want value %s", key, val, wantVal)
+			}
+		}
+	}
+}
diff --git a/e2e-tests/testdata/echo/echo/encore.gen.cue b/e2e-tests/testdata/echo/echo/encore.gen.cue
new file mode 100644
index 0000000000..077295b7e2
--- /dev/null
+++ b/e2e-tests/testdata/echo/echo/encore.gen.cue
@@ -0,0 +1,44 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package echo
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	ReadOnlyMode: bool
+	PublicKey:    bytes
+	AdminUsers: [...string]
+	SubConfig: SubKey: MaxCount: uint
+	Currencies: [string]: {
+		Name: string
+		Code: string
+		Aliases: [...string]
+	}
+	AnotherList: [...{
+		Name: string
+	}]
+}
+#Config
\ No newline at end of file
diff --git a/e2e-tests/testdata/echo/empty_cfg/service.go b/e2e-tests/testdata/echo/empty_cfg/service.go
new file mode 100644
index 0000000000..0a2c487fcb
--- /dev/null
+++ b/e2e-tests/testdata/echo/empty_cfg/service.go
@@ -0,0 +1,18 @@
+package emptycfg
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type cfg struct {
+
+}
+
+var Config = config.Load[*cfg]()
+
+//encore:api public
+func AnAPI(ctx context.Context) error {
+	return nil
+}
diff --git a/cli/daemon/run/testdata/echo/encore.app b/e2e-tests/testdata/echo/encore.app
similarity index 100%
rename from cli/daemon/run/testdata/echo/encore.app
rename to e2e-tests/testdata/echo/encore.app
diff --git a/e2e-tests/testdata/echo/endtoend/endtoend.go b/e2e-tests/testdata/echo/endtoend/endtoend.go
new file mode 100644
index 0000000000..8cf4fd2438
--- /dev/null
+++ b/e2e-tests/testdata/echo/endtoend/endtoend.go
@@ -0,0 +1,200 @@
+package endtoend
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"math/rand"
+	// "net/http"
+	// "net/http/httptest"
+	"os"
+	"reflect"
+	// "strings"
+	"time"
+
+	"encore.app/test"
+	"encore.dev/beta/errs"
+	"encore.dev/rlog"
+	"encore.dev/types/uuid"
+)
+
+var assertNumber = 0
+
+//encore:api public method=GET path=/generated-wrappers-end-to-end-test
+func GeneratedWrappersEndToEndTest(ctx context.Context) (err error) {
+	rlog.Info("Starting end-to-end test of generated wrappers")
+	defer func() {
+		if r := recover(); r != nil {
+			rlog.Error("Panic occured during end to end test", "err", r)
+			err = fmt.Errorf("%v", r)
+		}
+	}()
+
+	// Even on a slow machine, the client should be able to connect and run this test script in 30 seconds
+	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+	defer cancel()
+
+	// Test a simple no-op
+	err = test.Noop(ctx)
+	assert(err, nil, "Wanted no error from noop")
+
+	// Test we get back the right structured error
+	err = test.NoopWithError(ctx)
+	assertStructuredError(err, errs.Unimplemented, "totally not implemented yet")
+
+	// Test a simple echo
+	echoRsp, err := test.SimpleBodyEcho(ctx, &test.BodyEcho{Message: "hello world"})
+	assert(err, nil, "Wanted no error from simple body echo")
+	assert(echoRsp.Message, "hello world", "Wanted body to be 'hello world'")
+
+	// Check our UpdateMessage and GetMessage API's
+	getRsp, err := test.GetMessage(ctx, "intra-service wrapper")
+	assert(err, nil, "Wanted no error from get message")
+	assert(getRsp.Message, "", "Expected no message on first request")
+
+	err = test.UpdateMessage(ctx, "intra-service wrapper", &test.BodyEcho{Message: "updating now"})
+	assert(err, nil, "Wanted no error from update message")
+
+	getRsp, err = test.GetMessage(ctx, "intra-service wrapper")
+	assert(err, nil, "Wanted no error from get message")
+	assert(getRsp.Message, "updating now", "Expected data from Update request")
+
+	// Test the rest API which uses all input types (query string, json body and header fields)
+	// as well as nested structs and path segments in the URL
+	restRsp, err := test.RestStyleAPI(ctx, 5, "hello", &test.RestParams{
+		HeaderValue: "this is the header field",
+		QueryValue:  "this is a query string field",
+		BodyValue:   "this is the body field",
+		Nested: struct {
+			Key   string `json:"Alice"`
+			Value int    `json:"bOb"`
+			Ok    bool   `json:"charile"`
+		}{
+			Key:   "the nested key",
+			Value: 8,
+			Ok:    true,
+		},
+	})
+	assert(err, nil, "Wanted no error from rest style api")
+	assert(restRsp.HeaderValue, "this is the header field", "expected header value")
+	assert(restRsp.QueryValue, "this is a query string field", "expected query value")
+	assert(restRsp.BodyValue, "this is the body field", "expected body value")
+	assert(restRsp.Nested.Key, "hello + the nested key", "expected nested key")
+	assert(restRsp.Nested.Value, 5+8, "expected nested value")
+	assert(restRsp.Nested.Ok, true, "expected nested ok")
+
+	// Full marshalling test with randomised payloads
+	r := rand.New(rand.NewSource(time.Now().UnixNano()))
+	headerBytes := make([]byte, r.Intn(128))
+	queryBytes := make([]byte, r.Intn(128))
+	bodyBytes := make([]byte, r.Intn(128))
+	r.Read(headerBytes)
+	r.Read(queryBytes)
+	r.Read(bodyBytes)
+	params := &test.MarshallerTest[int]{
+		HeaderBoolean: r.Float32() > 0.5,
+		HeaderInt:     r.Int(),
+		HeaderFloat:   r.Float64(),
+		HeaderString:  "header string",
+		HeaderBytes:   headerBytes,
+		HeaderTime:    time.Now().Truncate(time.Second),
+		HeaderJson:    json.RawMessage("{\"hello\":\"world\"}"),
+		HeaderUUID:    newUUID(),
+		HeaderUserID:  "432",
+		QueryBoolean:  r.Float32() > 0.5,
+		QueryInt:      r.Int(),
+		QueryFloat:    r.Float64(),
+		QueryString:   "query string",
+		QueryBytes:    headerBytes,
+		QueryTime:     time.Now().Add(time.Duration(rand.Intn(1024)) * time.Hour).Truncate(time.Second),
+		QueryJson:     json.RawMessage("true"),
+		QueryUUID:     newUUID(),
+		QueryUserID:   "9udfa",
+		QuerySlice:    []int{r.Int(), r.Int(), r.Int(), r.Int()},
+		BodyBoolean:   r.Float32() > 0.5,
+		BodyInt:       r.Int(),
+		BodyFloat:     r.Float64(),
+		BodyString:    "body string",
+		BodyBytes:     bodyBytes,
+		BodyTime:      time.Now().Add(time.Duration(rand.Intn(1024)) * time.Hour).Truncate(time.Second),
+		BodyJson:      json.RawMessage("null"),
+		BodyUUID:      newUUID(),
+		BodyUserID:    "✉️",
+		BodySlice:     []int{r.Int(), r.Int(), r.Int(), r.Int(), r.Int(), r.Int()},
+	}
+	mResp, err := test.MarshallerTestHandler(ctx, params)
+	assert(err, nil, "Expected no error from the marshaller test")
+
+	// We're marshalling as JSON, so we can just compare the JSON strings
+	respAsJSON, err := json.Marshal(mResp)
+	assert(err, nil, "unable to marshal response to JSON")
+	reqAsJSON, err := json.Marshal(params)
+	assert(err, nil, "unable to marshal response to JSON")
+	assert(respAsJSON, reqAsJSON, "Expected the same response from the marshaller test")
+
+	// Test the raw endpoint (Unsupported currently in service to service calls)
+	// {
+	// 	req, err := http.NewRequest("PUT", "?foo=bar", strings.NewReader("this is a test body"))
+	// 	assert(err, nil, "unable to create request for raw endpoint")
+	// 	req.Header.Add("X-Test-Header", "test")
+	//
+	// 	w := httptest.NewRecorder()
+	// 	err = test.RawEndpoint(w, req)
+	// 	assert(err, nil, "expected no error from the raw socket")
+	//
+	// 	assert(w.Code, http.StatusCreated, "expected the status code to be 201")
+	//
+	// 	type responseType struct {
+	// 		Body        string
+	// 		Header      string
+	// 		PathParam   string
+	// 		QueryString string
+	// 	}
+	// 	response := &responseType{}
+	//
+	// 	err = json.Unmarshal(w.Body.Bytes(), response)
+	// 	assert(err, nil, "expected no error when unmarshalling the response body")
+	//
+	// 	assert(response, &responseType{"this is a test body", "test", "hello", "bar"}, "expected the response to match")
+	//
+	// }
+
+	rlog.Info("End to end wrappers test completed without error")
+	return nil
+}
+
+func assert(got, want any, message string) {
+	assertNumber++
+
+	if !reflect.DeepEqual(got, want) {
+		panic(fmt.Sprintf("Assertion Failure %d: %s\n\n%+v != %+v\n", assertNumber, message, got, want))
+	}
+}
+
+func assertNotNil(got any, message string) {
+	assertNumber++
+	if got == nil {
+		panic(fmt.Sprintf("Assertion Failure %d: got nil: %s", assertNumber, message))
+	}
+}
+
+func assertStructuredError(err error, code errs.ErrCode, message string) {
+	assertNotNil(err, "want an error")
+
+	assertNumber++
+	if apiError, ok := err.(*errs.Error); !ok {
+		panic(fmt.Sprintf("Assertion Failure %d: expected *errs.Error; got %+v\n", assertNumber, reflect.TypeOf(err)))
+		os.Exit(assertNumber)
+	} else {
+		assert(apiError.Code, code, "unexpected error code")
+		assert(apiError.Message, message, "expected error message")
+	}
+}
+
+func newUUID() uuid.UUID {
+	id, err := uuid.NewV4()
+	if err != nil {
+		panic(err)
+	}
+	return id
+}
diff --git a/e2e-tests/testdata/echo/go.mod b/e2e-tests/testdata/echo/go.mod
new file mode 100644
index 0000000000..bc687ddbae
--- /dev/null
+++ b/e2e-tests/testdata/echo/go.mod
@@ -0,0 +1,5 @@
+module encore.app
+
+go 1.21.0
+
+require encore.dev v1.9.3
diff --git a/e2e-tests/testdata/echo/go.sum b/e2e-tests/testdata/echo/go.sum
new file mode 100644
index 0000000000..d9feb14948
--- /dev/null
+++ b/e2e-tests/testdata/echo/go.sum
@@ -0,0 +1,2 @@
+encore.dev v1.9.3 h1:EyAw58b7lBRQipL/p27gRXKwyopwyGsUuIpqZpTIOzw=
+encore.dev v1.9.3/go.mod h1:AyQpBJoalNCFScvYfjzLtOJh/KEYue/pNljoz/aA6UQ=
diff --git a/e2e-tests/testdata/echo/middleware/middleware.go b/e2e-tests/testdata/echo/middleware/middleware.go
new file mode 100644
index 0000000000..92eb358a6e
--- /dev/null
+++ b/e2e-tests/testdata/echo/middleware/middleware.go
@@ -0,0 +1,58 @@
+package middleware
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"reflect"
+
+	"encore.dev/beta/errs"
+	"encore.dev/middleware"
+)
+
+//encore:middleware target=tag:error
+func ErroringMiddleware(req middleware.Request, next middleware.Next) middleware.Response {
+	return middleware.Response{
+		Err: errs.B().Code(errs.Internal).Msg("middleware error").Err(),
+	}
+}
+
+//encore:middleware target=tag:resp-rewrite
+func ResponseRewritingMiddleware(req middleware.Request, next middleware.Next) middleware.Response {
+	resp := next(req)
+	reqPayload := req.Data().Payload.(*Payload)
+	respPayload := resp.Payload.(*Payload)
+
+	respPayload.Msg = fmt.Sprintf("middleware(req=%s, resp=%s)",
+		reqPayload.Msg, respPayload.Msg)
+	return resp
+}
+
+//encore:middleware target=tag:resp-gen
+func ResponseGeneratingMiddleware(req middleware.Request, next middleware.Next) middleware.Response {
+	responseData := `{"Msg": "middleware generated"}`
+	payload := reflect.New(req.Data().API.ResponseType)
+	if err := json.Unmarshal([]byte(responseData), payload.Interface()); err != nil {
+		return middleware.Response{Err: err}
+	}
+	return middleware.Response{Payload: payload.Elem().Interface()}
+}
+
+type Payload struct {
+	Msg string
+}
+
+//encore:api public tag:error
+func Error(ctx context.Context) error {
+	return nil
+}
+
+//encore:api public tag:resp-rewrite
+func ResponseRewrite(ctx context.Context, req *Payload) (*Payload, error) {
+	return &Payload{Msg: fmt.Sprintf("handler(%s)", req.Msg)}, nil
+}
+
+//encore:api public tag:resp-gen
+func ResponseGen(ctx context.Context, msg *Payload) (*Payload, error) {
+	return nil, nil
+}
diff --git a/e2e-tests/testdata/echo/middleware/middleware_test.go b/e2e-tests/testdata/echo/middleware/middleware_test.go
new file mode 100644
index 0000000000..9c4ccdd1e7
--- /dev/null
+++ b/e2e-tests/testdata/echo/middleware/middleware_test.go
@@ -0,0 +1,36 @@
+package middleware
+
+import (
+	"context"
+	"testing"
+
+	"encore.dev/beta/errs"
+)
+
+// TestMiddleware tests that middleware is executed during tests.
+func TestMiddleware(t *testing.T) {
+	ctx := context.Background()
+	if err := Error(ctx); err == nil {
+		t.Error("Error(): want non-nil error, got nil")
+	} else if ee, ok := err.(*errs.Error); !ok {
+		t.Errorf("Error(): want *errs.Error, got %T", err)
+	} else if ee.Code != errs.Internal {
+		t.Errorf("Error(): want code=Internal, got %v", ee.Code)
+	} else if ee.Message != "middleware error" {
+		t.Errorf("Error(): want msg=\"middleware error\", got %q", ee.Message)
+	}
+
+	resp, err := ResponseRewrite(ctx, &Payload{Msg: "foo"})
+	if err != nil {
+		t.Errorf("ResponseRewrite(): got non-nil error: %v", err)
+	} else if want := "middleware(req=foo, resp=handler(foo))"; resp.Msg != want {
+		t.Errorf("ResponseRewrite(): got %q, want %q", resp.Msg, want)
+	}
+
+	resp, err = ResponseGen(ctx, &Payload{Msg: "foo"})
+	if err != nil {
+		t.Errorf("ResponseGen(): got non-nil error: %v", err)
+	} else if want := "middleware generated"; resp.Msg != want {
+		t.Errorf("ResponseGen(): got %q, want %q", resp.Msg, want)
+	}
+}
diff --git a/e2e-tests/testdata/echo/test/endpoints.go b/e2e-tests/testdata/echo/test/endpoints.go
new file mode 100644
index 0000000000..0e52ae70c7
--- /dev/null
+++ b/e2e-tests/testdata/echo/test/endpoints.go
@@ -0,0 +1,202 @@
+package test
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strconv"
+	"time"
+
+	encore "encore.dev"
+	"encore.dev/beta/auth"
+	"encore.dev/beta/errs"
+	"encore.dev/types/uuid"
+)
+
+// Noop allows us to test if a simple HTTP request can be made
+//
+//encore:api public
+func Noop(ctx context.Context) error {
+	return nil
+}
+
+// NoopWithError allows us to test if the structured errors are returned
+//
+//encore:api public
+func NoopWithError(ctx context.Context) error {
+	return &errs.Error{
+		Code:    errs.Unimplemented,
+		Message: "totally not implemented yet",
+	}
+}
+
+type BodyEcho struct {
+	Message string
+}
+
+// SimpleBodyEcho allows us to exercise the body marshalling from JSON
+// and being returned purely as a body
+//
+//encore:api public
+func SimpleBodyEcho(ctx context.Context, body *BodyEcho) (*BodyEcho, error) {
+	return body, nil
+}
+
+var lastMessage = make(map[string]string)
+
+// UpdateMessage allows us to test an API which takes parameters,
+// but doesn't return anything
+//
+//encore:api public method=PUT path=/last_message/:clientID
+func UpdateMessage(ctx context.Context, clientID string, message *BodyEcho) error {
+	lastMessage[clientID] = message.Message
+	return nil
+}
+
+// GetMessage allows us to test an API which takes no parameters,
+// but returns data. It also tests two API's on the same path with different HTTP methods
+//
+//encore:api public method=GET path=/last_message/:clientID
+func GetMessage(ctx context.Context, clientID string) (*BodyEcho, error) {
+	return &BodyEcho{
+		Message: lastMessage[clientID],
+	}, nil
+}
+
+type RestParams struct {
+	HeaderValue string `header:"Some-Key"`
+	QueryValue  string `query:"Some-Key"`
+	BodyValue   string `json:"Some-Key"`
+
+	Nested struct {
+		Key   string `json:"Alice"`
+		Value int    `json:"bOb"`
+		Ok    bool   `json:"charile"`
+	}
+}
+
+// RestStyleAPI tests all the ways we can get data into and out of the application
+// using Encore request handlers
+//
+//encore:api public method=PUT path=/rest/object/:objType/:name
+func RestStyleAPI(ctx context.Context, objType int, name string, params *RestParams) (*RestParams, error) {
+	return &RestParams{
+		HeaderValue: params.HeaderValue,
+		QueryValue:  params.QueryValue,
+		BodyValue:   params.BodyValue,
+		Nested: struct {
+			Key   string `json:"Alice"`
+			Value int    `json:"bOb"`
+			Ok    bool   `json:"charile"`
+		}{
+			Key:   name + " + " + params.Nested.Key,
+			Value: objType + params.Nested.Value,
+			Ok:    params.Nested.Ok,
+		},
+	}, nil
+}
+
+type MarshallerTest[A any] struct {
+	HeaderBoolean bool            `header:"x-boolean"`
+	HeaderInt     int             `header:"x-int"`
+	HeaderFloat   float64         `header:"x-float"`
+	HeaderString  string          `header:"x-string"`
+	HeaderBytes   []byte          `header:"x-bytes"`
+	HeaderTime    time.Time       `header:"x-time"`
+	HeaderJson    json.RawMessage `header:"x-json"`
+	HeaderUUID    uuid.UUID       `header:"x-uuid"`
+	HeaderUserID  auth.UID        `header:"x-user-id"`
+	QueryBoolean  bool            `qs:"boolean"`
+	QueryInt      int             `qs:"int"`
+	QueryFloat    float64         `qs:"float"`
+	QueryString   string          `qs:"string"`
+	QueryBytes    []byte          `qs:"bytes"`
+	QueryTime     time.Time       `qs:"time"`
+	QueryJson     json.RawMessage `qs:"json"`
+	QueryUUID     uuid.UUID       `qs:"uuid"`
+	QueryUserID   auth.UID        `qs:"user-id"`
+	QuerySlice    []A             `qs:"slice"`
+	BodyBoolean   bool            `json:"boolean"`
+	BodyInt       int             `json:"int"`
+	BodyFloat     float64         `json:"float"`
+	BodyString    string          `json:"string"`
+	BodyBytes     []byte          `json:"bytes"`
+	BodyTime      time.Time       `json:"time"`
+	BodyJson      json.RawMessage `json:"json"`
+	BodyUUID      uuid.UUID       `json:"uuid"`
+	BodyUserID    auth.UID        `json:"user-id"`
+	BodySlice     []A             `json:"slice"`
+}
+
+// MarshallerTestHandler allows us to test marshalling of all the inbuilt types in all
+// the field types. It simply echos all the responses back to the client
+//
+//encore:api public
+func MarshallerTestHandler(ctx context.Context, params *MarshallerTest[int]) (*MarshallerTest[int], error) {
+	return params, nil
+}
+
+// TestAuthHandler allows us to test the clients ability to add tokens to requests
+//
+//encore:api auth
+func TestAuthHandler(ctx context.Context) (*BodyEcho, error) {
+	userID, ok := auth.UserID()
+
+	return &BodyEcho{
+		Message: string(userID) + "::" + strconv.FormatBool(ok),
+	}, nil
+}
+
+type response struct {
+	Body        string
+	Header      string
+	PathParam   string
+	QueryString string
+}
+
+// RawEndpoint allows us to test the clients' ability to send raw requests
+// under auth
+//
+//encore:api public raw method=PUT,POST,DELETE,GET path=/raw/blah/*id
+func RawEndpoint(w http.ResponseWriter, req *http.Request) {
+	w.WriteHeader(http.StatusCreated)
+
+	bytes, err := io.ReadAll(req.Body)
+	if err != nil {
+		panic(err)
+	}
+	req.Body.Close()
+
+	b, err := json.Marshal(&response{
+		Body:        string(bytes),
+		Header:      req.Header.Get("X-Test-Header"),
+		PathParam:   encore.CurrentRequest().PathParams.Get("id"),
+		QueryString: req.URL.Query().Get("foo"),
+	})
+	if err != nil {
+		panic(err)
+	}
+	w.Write(b)
+}
+
+type MultiPathSegment struct {
+	Boolean  bool
+	Int      int
+	String   string
+	UUID     uuid.UUID
+	Wildcard string
+}
+
+// PathMultiSegments allows us to wildcard segments and segment URI encoding
+//
+//encore:api public path=/multi/:bool/:int/:string/:uuid/*wildcard
+func PathMultiSegments(ctx context.Context, bool bool, int int, string string, uuid uuid.UUID, wildcard string) (*MultiPathSegment, error) {
+	return &MultiPathSegment{
+		Boolean:  bool,
+		Int:      int,
+		String:   string,
+		UUID:     uuid,
+		Wildcard: wildcard,
+	}, nil
+}
diff --git a/e2e-tests/testdata/echo/validation/validation.go b/e2e-tests/testdata/echo/validation/validation.go
new file mode 100644
index 0000000000..4be76d2084
--- /dev/null
+++ b/e2e-tests/testdata/echo/validation/validation.go
@@ -0,0 +1,22 @@
+package validation
+
+import (
+	"context"
+	"errors"
+)
+
+type Request struct {
+	Msg string
+}
+
+func (req *Request) Validate() error {
+	if req.Msg == "fail" {
+		return errors.New("bad message")
+	}
+	return nil
+}
+
+//encore:api public
+func TestOne(ctx context.Context, msg *Request) error {
+	return nil
+}
diff --git a/e2e-tests/testdata/echo_client/.eslintrc.cjs b/e2e-tests/testdata/echo_client/.eslintrc.cjs
new file mode 100644
index 0000000000..f42a992279
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/.eslintrc.cjs
@@ -0,0 +1,19 @@
+/* .eslintrc.js */
+module.exports = {
+    root: true,
+    parser: '@typescript-eslint/parser',
+    plugins: [
+        '@typescript-eslint',
+    ],
+    env: {
+        browser: true,
+        es6: true,
+        node: true,
+        commonjs: true
+    },
+    extends: [
+        'eslint:recommended',
+        'plugin:@typescript-eslint/eslint-recommended',
+        'plugin:@typescript-eslint/recommended',
+    ],
+}
diff --git a/e2e-tests/testdata/echo_client/.gitignore b/e2e-tests/testdata/echo_client/.gitignore
new file mode 100644
index 0000000000..c2658d7d1b
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/.gitignore
@@ -0,0 +1 @@
+node_modules/
diff --git a/e2e-tests/testdata/echo_client/go.mod b/e2e-tests/testdata/echo_client/go.mod
new file mode 100644
index 0000000000..90e45e0cdc
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/go.mod
@@ -0,0 +1,3 @@
+module echo_client
+
+go 1.18
diff --git a/e2e-tests/testdata/echo_client/golang/client/goclient.go b/e2e-tests/testdata/echo_client/golang/client/goclient.go
new file mode 100644
index 0000000000..7320e43dcd
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/golang/client/goclient.go
@@ -0,0 +1,1654 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Client is an API client for the slug Encore application.
+type Client struct {
+	Cache      CacheClient
+	Di         DiClient
+	Echo       EchoClient
+	Emptycfg   EmptycfgClient
+	Endtoend   EndtoendClient
+	Middleware MiddlewareClient
+	Test       TestClient
+	Validation ValidationClient
+}
+
+// BaseURL is the base URL for calling the Encore application's API.
+type BaseURL string
+
+const Local BaseURL = "http://localhost:4000"
+
+// Environment returns a BaseURL for calling the cloud environment with the given name.
+func Environment(name string) BaseURL {
+	return BaseURL(fmt.Sprintf("https://%s-slug.encr.app", name))
+}
+
+// PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+func PreviewEnv(pr int) BaseURL {
+	return Environment(fmt.Sprintf("pr%d", pr))
+}
+
+// Option allows you to customise the baseClient used by the Client
+type Option = func(client *baseClient) error
+
+// New returns a Client for calling the public and authenticated APIs of your Encore application.
+// You can customize the behaviour of the client using the given Option functions, such as WithHTTPClient or WithAuthFunc.
+func New(target BaseURL, options ...Option) (*Client, error) {
+	// Parse the base URL where the Encore application is being hosted
+	baseURL, err := url.Parse(string(target))
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse base url: %w", err)
+	}
+
+	// Create a client with sensible defaults
+	base := &baseClient{
+		baseURL:    baseURL,
+		httpClient: http.DefaultClient,
+		userAgent:  "slug-Generated-Go-Client (Encore/v0.0.0-develop)",
+	}
+
+	// Apply any given options
+	for _, option := range options {
+		if err := option(base); err != nil {
+			return nil, fmt.Errorf("unable to apply client option: %w", err)
+		}
+	}
+
+	return &Client{
+		Cache:      &cacheClient{base},
+		Di:         &diClient{base},
+		Echo:       &echoClient{base},
+		Emptycfg:   &emptycfgClient{base},
+		Endtoend:   &endtoendClient{base},
+		Middleware: &middlewareClient{base},
+		Test:       &testClient{base},
+		Validation: &validationClient{base},
+	}, nil
+}
+
+// WithHTTPClient can be used to configure the underlying HTTP client used when making API calls.
+//
+// Defaults to http.DefaultClient
+func WithHTTPClient(client HTTPDoer) Option {
+	return func(base *baseClient) error {
+		base.httpClient = client
+		return nil
+	}
+}
+
+// WithAuth allows you to set the authentication data to be used with each request
+func WithAuth(auth EchoAuthParams) Option {
+	return func(base *baseClient) error {
+		base.authGenerator = func(_ context.Context) (EchoAuthParams, error) {
+			return auth, nil
+		}
+		return nil
+	}
+}
+
+// WithAuthFunc allows you to pass a function which is called for each request to return the authentication data to be used with each request
+func WithAuthFunc(authGenerator func(ctx context.Context) (EchoAuthParams, error)) Option {
+	return func(base *baseClient) error {
+		base.authGenerator = authGenerator
+		return nil
+	}
+}
+
+type CacheIncrResponse struct {
+	Val int64
+}
+
+type CacheListResponse struct {
+	Vals []string
+}
+
+type CacheStructVal struct {
+	Val string
+}
+
+// CacheClient Provides you access to call public and authenticated APIs on cache. The concrete implementation is cacheClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type CacheClient interface {
+	GetList(ctx context.Context, key int) (CacheListResponse, error)
+	GetStruct(ctx context.Context, key int) (CacheStructVal, error)
+	Incr(ctx context.Context, key string) (CacheIncrResponse, error)
+	PostList(ctx context.Context, key int, val string) error
+	PostStruct(ctx context.Context, key int, val string) error
+}
+
+type cacheClient struct {
+	base *baseClient
+}
+
+var _ CacheClient = (*cacheClient)(nil)
+
+func (c *cacheClient) GetList(ctx context.Context, key int) (resp CacheListResponse, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "GET", fmt.Sprintf("/cache/list/%d", key), nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *cacheClient) GetStruct(ctx context.Context, key int) (resp CacheStructVal, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "GET", fmt.Sprintf("/cache/struct/%d", key), nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *cacheClient) Incr(ctx context.Context, key string) (resp CacheIncrResponse, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", fmt.Sprintf("/cache/incr/%s", url.PathEscape(key)), nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *cacheClient) PostList(ctx context.Context, key int, val string) error {
+	_, err := callAPI(ctx, c.base, "POST", fmt.Sprintf("/cache/list/%d/%s", key, url.PathEscape(val)), nil, nil, nil)
+	return err
+}
+
+func (c *cacheClient) PostStruct(ctx context.Context, key int, val string) error {
+	_, err := callAPI(ctx, c.base, "POST", fmt.Sprintf("/cache/struct/%d/%s", key, url.PathEscape(val)), nil, nil, nil)
+	return err
+}
+
+type DiTwoResponse struct {
+	Msg string
+}
+
+// DiClient Provides you access to call public and authenticated APIs on di. The concrete implementation is diClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type DiClient interface {
+	One(ctx context.Context) error
+	Three(ctx context.Context, request *http.Request) (*http.Response, error)
+	Two(ctx context.Context) (DiTwoResponse, error)
+}
+
+type diClient struct {
+	base *baseClient
+}
+
+var _ DiClient = (*diClient)(nil)
+
+func (c *diClient) One(ctx context.Context) error {
+	_, err := callAPI(ctx, c.base, "POST", "/di/one", nil, nil, nil)
+	return err
+}
+
+func (c *diClient) Three(ctx context.Context, request *http.Request) (*http.Response, error) {
+	request = request.WithContext(ctx)
+
+	// Check the request has the method set, as we can't guess what method is required
+	if request.Method == "" {
+		return nil, errors.New("request.Method must be set")
+	}
+
+	// Set the relative URL for the API call
+	path, err := url.Parse("/di/raw")
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse api url: %w", err)
+	}
+	if request.URL != nil {
+		// If the request already has a URL associated, we'll keep any fields set inside it, and just override the schema,
+		// host and path to ensure the final URL which hit the right BaseURL
+		request.URL.Scheme = path.Scheme
+		request.URL.Host = path.Host
+		request.URL.Path = path.Path
+	} else {
+		request.URL = path
+	}
+
+	return c.base.Do(request)
+}
+
+func (c *diClient) Two(ctx context.Context) (resp DiTwoResponse, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/di/two", nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+type EchoAppMetadata struct {
+	AppID      string
+	APIBaseURL string
+	EnvName    string
+	EnvType    string
+}
+
+type EchoAuthParams struct {
+	Header        string `header:"X-Header"`
+	AuthInt       int    `header:"X-Auth-Int"`
+	Authorization string `header:"Authorization"`
+	Query         []int  `query:"query"`
+	NewAuth       bool   `query:"new-auth"`
+}
+
+type EchoBasicData struct {
+	String      string
+	Uint        uint
+	Int         int
+	Int8        int8
+	Int64       int64
+	Float32     float32
+	Float64     float64
+	StringSlice []string
+	IntSlice    []int
+	Time        time.Time
+}
+
+type EchoConfigResponse struct {
+	ReadOnlyMode bool
+	PublicKey    []byte
+	SubKeyCount  uint
+	AdminUsers   []string
+}
+
+type EchoData[K any, V any] struct {
+	Key   K
+	Value V
+}
+
+type EchoEmptyData struct {
+	OmitEmpty EchoData[string, string] `json:"OmitEmpty,omitempty"`
+	NullPtr   *string
+	Zero      EchoData[string, string]
+}
+
+type EchoEnvResponse struct {
+	Env []string
+}
+
+// HTTPStatusResponse demonstrates encore:"httpstatus" tag functionality
+type EchoHTTPStatusResponse struct {
+	Message string `json:"message"`
+}
+
+type EchoHeadersData struct {
+	Int    int    `header:"X-Int"`
+	String string `header:"X-String"`
+}
+
+type EchoNonBasicData struct {
+	HeaderString string                                   `header:"X-Header-String"` // Header
+	HeaderNumber int                                      `header:"X-Header-Number"`
+	Struct       EchoData[*EchoData[string, string], int] // Body
+	StructPtr    *EchoData[int, uint16]
+	StructSlice  []*EchoData[string, string]
+	StructMap    map[string]*EchoData[string, float32]
+	StructMapPtr *map[string]*EchoData[string, string]
+	AnonStruct   struct {
+		AnonBird string
+	}
+	NamedStruct    *EchoData[string, float64] `json:"formatted_nest"`
+	RawStruct      json.RawMessage
+	QueryString    string `query:"string"` // Query
+	QueryNumber    int    `query:"no"`
+	OptQueryNumber int    `encore:"optional" query:"optnum"`
+	OptQueryString string `encore:"optional" query:"optstr"`
+	PathString     string // Path Parameters
+	PathInt        int
+	PathWild       string
+	AuthHeader     string // Auth Parameters
+	AuthQuery      []int
+}
+
+// EchoClient Provides you access to call public and authenticated APIs on echo. The concrete implementation is echoClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type EchoClient interface {
+	// AppMeta returns app metadata.
+	AppMeta(ctx context.Context) (EchoAppMetadata, error)
+
+	// BasicEcho echoes back the request data.
+	BasicEcho(ctx context.Context, params EchoBasicData) (EchoBasicData, error)
+	ConfigValues(ctx context.Context) (EchoConfigResponse, error)
+
+	// CustomHTTPStatus allows testing of custom HTTP status codes via encore:"httpstatus" tag
+	CustomHTTPStatus(ctx context.Context) (EchoHTTPStatusResponse, error)
+
+	// Echo echoes back the request data.
+	Echo(ctx context.Context, params EchoData[string, int]) (EchoData[string, int], error)
+
+	// EmptyEcho echoes back the request data.
+	EmptyEcho(ctx context.Context, params EchoEmptyData) (EchoEmptyData, error)
+
+	// Env returns the environment.
+	Env(ctx context.Context) (EchoEnvResponse, error)
+
+	// HeadersEcho echoes back the request headers
+	HeadersEcho(ctx context.Context, params EchoHeadersData) (EchoHeadersData, error)
+
+	// MuteEcho absorbs a request
+	MuteEcho(ctx context.Context, params EchoData[string, string]) error
+
+	// NilResponse returns a nil response and nil error
+	NilResponse(ctx context.Context) (EchoBasicData, error)
+
+	// NonBasicEcho echoes back the request data.
+	NonBasicEcho(ctx context.Context, pathString string, pathInt int, pathWild []string, params EchoNonBasicData) (EchoNonBasicData, error)
+
+	// Noop does nothing
+	Noop(ctx context.Context) error
+
+	// Pong returns a bird tuple
+	Pong(ctx context.Context) (EchoData[string, string], error)
+
+	// Publish publishes a request on a topic
+	Publish(ctx context.Context) error
+}
+
+type echoClient struct {
+	base *baseClient
+}
+
+var _ EchoClient = (*echoClient)(nil)
+
+// AppMeta returns app metadata.
+func (c *echoClient) AppMeta(ctx context.Context) (resp EchoAppMetadata, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/echo.AppMeta", nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// BasicEcho echoes back the request data.
+func (c *echoClient) BasicEcho(ctx context.Context, params EchoBasicData) (resp EchoBasicData, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/echo.BasicEcho", nil, params, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *echoClient) ConfigValues(ctx context.Context) (resp EchoConfigResponse, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/echo.ConfigValues", nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// CustomHTTPStatus allows testing of custom HTTP status codes via encore:"httpstatus" tag
+func (c *echoClient) CustomHTTPStatus(ctx context.Context) (resp EchoHTTPStatusResponse, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/echo.CustomHTTPStatus", nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// Echo echoes back the request data.
+func (c *echoClient) Echo(ctx context.Context, params EchoData[string, int]) (resp EchoData[string, int], err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/echo.Echo", nil, params, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// EmptyEcho echoes back the request data.
+func (c *echoClient) EmptyEcho(ctx context.Context, params EchoEmptyData) (resp EchoEmptyData, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/echo.EmptyEcho", nil, params, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// Env returns the environment.
+func (c *echoClient) Env(ctx context.Context) (resp EchoEnvResponse, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/echo.Env", nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// HeadersEcho echoes back the request headers
+func (c *echoClient) HeadersEcho(ctx context.Context, params EchoHeadersData) (resp EchoHeadersData, err error) {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{
+		"x-int":    {reqEncoder.FromInt(params.Int)},
+		"x-string": {reqEncoder.FromString(params.String)},
+	}
+
+	if reqEncoder.LastError != nil {
+		err = fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+		return
+	}
+
+	// Now make the actual call to the API
+	var respHeaders http.Header
+	respHeaders, err = callAPI(ctx, c.base, "POST", "/echo.HeadersEcho", headers, nil, nil)
+	if err != nil {
+		return
+	}
+
+	// Copy the unmarshalled response body into our response struct
+	respDecoder := &serde{}
+
+	resp.Int = respDecoder.ToInt("Int", respHeaders.Get("x-int"), true)
+	resp.String = respDecoder.ToString("String", respHeaders.Get("x-string"), true)
+
+	if respDecoder.LastError != nil {
+		err = fmt.Errorf("unable to unmarshal headers: %w", respDecoder.LastError)
+		return
+	}
+
+	return
+}
+
+// MuteEcho absorbs a request
+func (c *echoClient) MuteEcho(ctx context.Context, params EchoData[string, string]) error {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	queryString := url.Values{
+		"key":   {reqEncoder.FromString(params.Key)},
+		"value": {reqEncoder.FromString(params.Value)},
+	}
+
+	if reqEncoder.LastError != nil {
+		return fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+	}
+
+	_, err := callAPI(ctx, c.base, "GET", fmt.Sprintf("/echo.MuteEcho?%s", queryString.Encode()), nil, nil, nil)
+	return err
+}
+
+// NilResponse returns a nil response and nil error
+func (c *echoClient) NilResponse(ctx context.Context) (resp EchoBasicData, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/echo.NilResponse", nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// NonBasicEcho echoes back the request data.
+func (c *echoClient) NonBasicEcho(ctx context.Context, pathString string, pathInt int, pathWild []string, params EchoNonBasicData) (resp EchoNonBasicData, err error) {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{
+		"x-header-number": {reqEncoder.FromInt(params.HeaderNumber)},
+		"x-header-string": {reqEncoder.FromString(params.HeaderString)},
+	}
+
+	queryString := url.Values{
+		"no":     {reqEncoder.FromInt(params.QueryNumber)},
+		"optnum": {reqEncoder.FromInt(params.OptQueryNumber)},
+		"optstr": {reqEncoder.FromString(params.OptQueryString)},
+		"string": {reqEncoder.FromString(params.QueryString)},
+	}
+
+	if reqEncoder.LastError != nil {
+		err = fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+		return
+	}
+
+	// Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+	body := struct {
+		Struct       EchoData[*EchoData[string, string], int] `json:"Struct"`
+		StructPtr    *EchoData[int, uint16]                   `json:"StructPtr"`
+		StructSlice  []*EchoData[string, string]              `json:"StructSlice"`
+		StructMap    map[string]*EchoData[string, float32]    `json:"StructMap"`
+		StructMapPtr *map[string]*EchoData[string, string]    `json:"StructMapPtr"`
+		AnonStruct   struct {
+			AnonBird string
+		} `json:"AnonStruct"`
+		NamedStruct *EchoData[string, float64] `json:"formatted_nest"`
+		RawStruct   json.RawMessage            `json:"RawStruct"`
+		PathString  string                     `json:"PathString"`
+		PathInt     int                        `json:"PathInt"`
+		PathWild    string                     `json:"PathWild"`
+		AuthHeader  string                     `json:"AuthHeader"`
+		AuthQuery   []int                      `json:"AuthQuery"`
+	}{
+		AnonStruct:   params.AnonStruct,
+		AuthHeader:   params.AuthHeader,
+		AuthQuery:    params.AuthQuery,
+		NamedStruct:  params.NamedStruct,
+		PathInt:      params.PathInt,
+		PathString:   params.PathString,
+		PathWild:     params.PathWild,
+		RawStruct:    params.RawStruct,
+		Struct:       params.Struct,
+		StructMap:    params.StructMap,
+		StructMapPtr: params.StructMapPtr,
+		StructPtr:    params.StructPtr,
+		StructSlice:  params.StructSlice,
+	}
+
+	// We only want the response body to marshal into these fields and none of the header fields,
+	// so we'll construct a new struct with only those fields.
+	respBody := struct {
+		Struct       EchoData[*EchoData[string, string], int] `json:"Struct"`
+		StructPtr    *EchoData[int, uint16]                   `json:"StructPtr"`
+		StructSlice  []*EchoData[string, string]              `json:"StructSlice"`
+		StructMap    map[string]*EchoData[string, float32]    `json:"StructMap"`
+		StructMapPtr *map[string]*EchoData[string, string]    `json:"StructMapPtr"`
+		AnonStruct   struct {
+			AnonBird string
+		} `json:"AnonStruct"`
+		NamedStruct    *EchoData[string, float64] `json:"formatted_nest"`
+		RawStruct      json.RawMessage            `json:"RawStruct"`
+		QueryString    string                     `json:"QueryString"`
+		QueryNumber    int                        `json:"QueryNumber"`
+		OptQueryNumber int                        `json:"OptQueryNumber"`
+		OptQueryString string                     `json:"OptQueryString"`
+		PathString     string                     `json:"PathString"`
+		PathInt        int                        `json:"PathInt"`
+		PathWild       string                     `json:"PathWild"`
+		AuthHeader     string                     `json:"AuthHeader"`
+		AuthQuery      []int                      `json:"AuthQuery"`
+	}{}
+
+	// Now make the actual call to the API
+	var respHeaders http.Header
+	respHeaders, err = callAPI(ctx, c.base, "POST", fmt.Sprintf("/NonBasicEcho/%s/%d/%s?%s", url.PathEscape(pathString), pathInt, pathEscapeSlice(pathWild), queryString.Encode()), headers, body, &respBody)
+	if err != nil {
+		return
+	}
+
+	// Copy the unmarshalled response body into our response struct
+	respDecoder := &serde{}
+
+	resp.HeaderString = respDecoder.ToString("HeaderString", respHeaders.Get("x-header-string"), true)
+	resp.HeaderNumber = respDecoder.ToInt("HeaderNumber", respHeaders.Get("x-header-number"), true)
+	resp.Struct = respBody.Struct
+	resp.StructPtr = respBody.StructPtr
+	resp.StructSlice = respBody.StructSlice
+	resp.StructMap = respBody.StructMap
+	resp.StructMapPtr = respBody.StructMapPtr
+	resp.AnonStruct = respBody.AnonStruct
+	resp.NamedStruct = respBody.NamedStruct
+	resp.RawStruct = respBody.RawStruct
+	resp.QueryString = respBody.QueryString
+	resp.QueryNumber = respBody.QueryNumber
+	resp.OptQueryNumber = respBody.OptQueryNumber
+	resp.OptQueryString = respBody.OptQueryString
+	resp.PathString = respBody.PathString
+	resp.PathInt = respBody.PathInt
+	resp.PathWild = respBody.PathWild
+	resp.AuthHeader = respBody.AuthHeader
+	resp.AuthQuery = respBody.AuthQuery
+
+	if respDecoder.LastError != nil {
+		err = fmt.Errorf("unable to unmarshal headers: %w", respDecoder.LastError)
+		return
+	}
+
+	return
+}
+
+// Noop does nothing
+func (c *echoClient) Noop(ctx context.Context) error {
+	_, err := callAPI(ctx, c.base, "GET", "/echo.Noop", nil, nil, nil)
+	return err
+}
+
+// Pong returns a bird tuple
+func (c *echoClient) Pong(ctx context.Context) (resp EchoData[string, string], err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "GET", "/echo.Pong", nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// Publish publishes a request on a topic
+func (c *echoClient) Publish(ctx context.Context) error {
+	_, err := callAPI(ctx, c.base, "POST", "/echo.Publish", nil, nil, nil)
+	return err
+}
+
+// EmptycfgClient Provides you access to call public and authenticated APIs on emptycfg. The concrete implementation is emptycfgClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type EmptycfgClient interface {
+	AnAPI(ctx context.Context) error
+}
+
+type emptycfgClient struct {
+	base *baseClient
+}
+
+var _ EmptycfgClient = (*emptycfgClient)(nil)
+
+func (c *emptycfgClient) AnAPI(ctx context.Context) error {
+	_, err := callAPI(ctx, c.base, "POST", "/emptycfg.AnAPI", nil, nil, nil)
+	return err
+}
+
+// EndtoendClient Provides you access to call public and authenticated APIs on endtoend. The concrete implementation is endtoendClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type EndtoendClient interface {
+	GeneratedWrappersEndToEndTest(ctx context.Context) error
+}
+
+type endtoendClient struct {
+	base *baseClient
+}
+
+var _ EndtoendClient = (*endtoendClient)(nil)
+
+func (c *endtoendClient) GeneratedWrappersEndToEndTest(ctx context.Context) error {
+	_, err := callAPI(ctx, c.base, "GET", "/generated-wrappers-end-to-end-test", nil, nil, nil)
+	return err
+}
+
+type MiddlewarePayload struct {
+	Msg string
+}
+
+// MiddlewareClient Provides you access to call public and authenticated APIs on middleware. The concrete implementation is middlewareClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type MiddlewareClient interface {
+	Error(ctx context.Context) error
+	ResponseGen(ctx context.Context, params MiddlewarePayload) (MiddlewarePayload, error)
+	ResponseRewrite(ctx context.Context, params MiddlewarePayload) (MiddlewarePayload, error)
+}
+
+type middlewareClient struct {
+	base *baseClient
+}
+
+var _ MiddlewareClient = (*middlewareClient)(nil)
+
+func (c *middlewareClient) Error(ctx context.Context) error {
+	_, err := callAPI(ctx, c.base, "POST", "/middleware.Error", nil, nil, nil)
+	return err
+}
+
+func (c *middlewareClient) ResponseGen(ctx context.Context, params MiddlewarePayload) (resp MiddlewarePayload, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/middleware.ResponseGen", nil, params, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *middlewareClient) ResponseRewrite(ctx context.Context, params MiddlewarePayload) (resp MiddlewarePayload, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/middleware.ResponseRewrite", nil, params, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+type TestBodyEcho struct {
+	Message string
+}
+
+type TestMarshallerTest[A any] struct {
+	HeaderBoolean bool            `header:"x-boolean"`
+	HeaderInt     int             `header:"x-int"`
+	HeaderFloat   float64         `header:"x-float"`
+	HeaderString  string          `header:"x-string"`
+	HeaderBytes   []byte          `header:"x-bytes"`
+	HeaderTime    time.Time       `header:"x-time"`
+	HeaderJson    json.RawMessage `header:"x-json"`
+	HeaderUUID    string          `header:"x-uuid"`
+	HeaderUserID  string          `header:"x-user-id"`
+	QueryBoolean  bool            `qs:"boolean"`
+	QueryInt      int             `qs:"int"`
+	QueryFloat    float64         `qs:"float"`
+	QueryString   string          `qs:"string"`
+	QueryBytes    []byte          `qs:"bytes"`
+	QueryTime     time.Time       `qs:"time"`
+	QueryJson     json.RawMessage `qs:"json"`
+	QueryUUID     string          `qs:"uuid"`
+	QueryUserID   string          `qs:"user-id"`
+	QuerySlice    []A             `qs:"slice"`
+	BodyBoolean   bool            `json:"boolean"`
+	BodyInt       int             `json:"int"`
+	BodyFloat     float64         `json:"float"`
+	BodyString    string          `json:"string"`
+	BodyBytes     []byte          `json:"bytes"`
+	BodyTime      time.Time       `json:"time"`
+	BodyJson      json.RawMessage `json:"json"`
+	BodyUUID      string          `json:"uuid"`
+	BodyUserID    string          `json:"user-id"`
+	BodySlice     []A             `json:"slice"`
+}
+
+type TestMultiPathSegment struct {
+	Boolean  bool
+	Int      int
+	String   string
+	UUID     string
+	Wildcard string
+}
+
+type TestRestParams struct {
+	HeaderValue string `header:"Some-Key"`
+	QueryValue  string `query:"Some-Key"`
+	BodyValue   string `json:"Some-Key"`
+	Nested      struct {
+		Key   string `json:"Alice"`
+		Value int    `json:"bOb"`
+		Ok    bool   `json:"charile"`
+	}
+}
+
+// TestClient Provides you access to call public and authenticated APIs on test. The concrete implementation is testClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type TestClient interface {
+	// GetMessage allows us to test an API which takes no parameters,
+	// but returns data. It also tests two API's on the same path with different HTTP methods
+	GetMessage(ctx context.Context, clientID string) (TestBodyEcho, error)
+
+	// MarshallerTestHandler allows us to test marshalling of all the inbuilt types in all
+	// the field types. It simply echos all the responses back to the client
+	MarshallerTestHandler(ctx context.Context, params TestMarshallerTest[int]) (TestMarshallerTest[int], error)
+
+	// Noop allows us to test if a simple HTTP request can be made
+	Noop(ctx context.Context) error
+
+	// NoopWithError allows us to test if the structured errors are returned
+	NoopWithError(ctx context.Context) error
+
+	// PathMultiSegments allows us to wildcard segments and segment URI encoding
+	PathMultiSegments(ctx context.Context, _bool bool, _int int, _string string, uuid string, wildcard []string) (TestMultiPathSegment, error)
+
+	// RawEndpoint allows us to test the clients' ability to send raw requests
+	// under auth
+	RawEndpoint(ctx context.Context, id []string, request *http.Request) (*http.Response, error)
+
+	// RestStyleAPI tests all the ways we can get data into and out of the application
+	// using Encore request handlers
+	RestStyleAPI(ctx context.Context, objType int, name string, params TestRestParams) (TestRestParams, error)
+
+	// SimpleBodyEcho allows us to exercise the body marshalling from JSON
+	// and being returned purely as a body
+	SimpleBodyEcho(ctx context.Context, params TestBodyEcho) (TestBodyEcho, error)
+
+	// TestAuthHandler allows us to test the clients ability to add tokens to requests
+	TestAuthHandler(ctx context.Context) (TestBodyEcho, error)
+
+	// UpdateMessage allows us to test an API which takes parameters,
+	// but doesn't return anything
+	UpdateMessage(ctx context.Context, clientID string, params TestBodyEcho) error
+}
+
+type testClient struct {
+	base *baseClient
+}
+
+var _ TestClient = (*testClient)(nil)
+
+// GetMessage allows us to test an API which takes no parameters,
+// but returns data. It also tests two API's on the same path with different HTTP methods
+func (c *testClient) GetMessage(ctx context.Context, clientID string) (resp TestBodyEcho, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "GET", fmt.Sprintf("/last_message/%s", url.PathEscape(clientID)), nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// MarshallerTestHandler allows us to test marshalling of all the inbuilt types in all
+// the field types. It simply echos all the responses back to the client
+func (c *testClient) MarshallerTestHandler(ctx context.Context, params TestMarshallerTest[int]) (resp TestMarshallerTest[int], err error) {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{
+		"x-boolean": {reqEncoder.FromBool(params.HeaderBoolean)},
+		"x-bytes":   {reqEncoder.FromBytes(params.HeaderBytes)},
+		"x-float":   {reqEncoder.FromFloat64(params.HeaderFloat)},
+		"x-int":     {reqEncoder.FromInt(params.HeaderInt)},
+		"x-json":    {reqEncoder.FromJSON(params.HeaderJson)},
+		"x-string":  {reqEncoder.FromString(params.HeaderString)},
+		"x-time":    {reqEncoder.FromTime(params.HeaderTime)},
+		"x-user-id": {reqEncoder.FromString(params.HeaderUserID)},
+		"x-uuid":    {reqEncoder.FromString(params.HeaderUUID)},
+	}
+
+	queryString := url.Values{
+		"boolean": {reqEncoder.FromBool(params.QueryBoolean)},
+		"bytes":   {reqEncoder.FromBytes(params.QueryBytes)},
+		"float":   {reqEncoder.FromFloat64(params.QueryFloat)},
+		"int":     {reqEncoder.FromInt(params.QueryInt)},
+		"json":    {reqEncoder.FromJSON(params.QueryJson)},
+		"slice":   reqEncoder.FromIntList(params.QuerySlice),
+		"string":  {reqEncoder.FromString(params.QueryString)},
+		"time":    {reqEncoder.FromTime(params.QueryTime)},
+		"user-id": {reqEncoder.FromString(params.QueryUserID)},
+		"uuid":    {reqEncoder.FromString(params.QueryUUID)},
+	}
+
+	if reqEncoder.LastError != nil {
+		err = fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+		return
+	}
+
+	// Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+	body := struct {
+		BodyBoolean bool            `json:"boolean"`
+		BodyInt     int             `json:"int"`
+		BodyFloat   float64         `json:"float"`
+		BodyString  string          `json:"string"`
+		BodyBytes   []byte          `json:"bytes"`
+		BodyTime    time.Time       `json:"time"`
+		BodyJson    json.RawMessage `json:"json"`
+		BodyUUID    string          `json:"uuid"`
+		BodyUserID  string          `json:"user-id"`
+		BodySlice   []int           `json:"slice"`
+	}{
+		BodyBoolean: params.BodyBoolean,
+		BodyBytes:   params.BodyBytes,
+		BodyFloat:   params.BodyFloat,
+		BodyInt:     params.BodyInt,
+		BodyJson:    params.BodyJson,
+		BodySlice:   params.BodySlice,
+		BodyString:  params.BodyString,
+		BodyTime:    params.BodyTime,
+		BodyUUID:    params.BodyUUID,
+		BodyUserID:  params.BodyUserID,
+	}
+
+	// We only want the response body to marshal into these fields and none of the header fields,
+	// so we'll construct a new struct with only those fields.
+	respBody := struct {
+		QueryBoolean bool            `json:"QueryBoolean"`
+		QueryInt     int             `json:"QueryInt"`
+		QueryFloat   float64         `json:"QueryFloat"`
+		QueryString  string          `json:"QueryString"`
+		QueryBytes   []byte          `json:"QueryBytes"`
+		QueryTime    time.Time       `json:"QueryTime"`
+		QueryJson    json.RawMessage `json:"QueryJson"`
+		QueryUUID    string          `json:"QueryUUID"`
+		QueryUserID  string          `json:"QueryUserID"`
+		QuerySlice   []int           `json:"QuerySlice"`
+		BodyBoolean  bool            `json:"boolean"`
+		BodyInt      int             `json:"int"`
+		BodyFloat    float64         `json:"float"`
+		BodyString   string          `json:"string"`
+		BodyBytes    []byte          `json:"bytes"`
+		BodyTime     time.Time       `json:"time"`
+		BodyJson     json.RawMessage `json:"json"`
+		BodyUUID     string          `json:"uuid"`
+		BodyUserID   string          `json:"user-id"`
+		BodySlice    []int           `json:"slice"`
+	}{}
+
+	// Now make the actual call to the API
+	var respHeaders http.Header
+	respHeaders, err = callAPI(ctx, c.base, "POST", fmt.Sprintf("/test.MarshallerTestHandler?%s", queryString.Encode()), headers, body, &respBody)
+	if err != nil {
+		return
+	}
+
+	// Copy the unmarshalled response body into our response struct
+	respDecoder := &serde{}
+
+	resp.HeaderBoolean = respDecoder.ToBool("HeaderBoolean", respHeaders.Get("x-boolean"), true)
+	resp.HeaderInt = respDecoder.ToInt("HeaderInt", respHeaders.Get("x-int"), true)
+	resp.HeaderFloat = respDecoder.ToFloat64("HeaderFloat", respHeaders.Get("x-float"), true)
+	resp.HeaderString = respDecoder.ToString("HeaderString", respHeaders.Get("x-string"), true)
+	resp.HeaderBytes = respDecoder.ToBytes("HeaderBytes", respHeaders.Get("x-bytes"), true)
+	resp.HeaderTime = respDecoder.ToTime("HeaderTime", respHeaders.Get("x-time"), true)
+	resp.HeaderJson = respDecoder.ToJSON("HeaderJson", respHeaders.Get("x-json"), true)
+	resp.HeaderUUID = respDecoder.ToString("HeaderUUID", respHeaders.Get("x-uuid"), true)
+	resp.HeaderUserID = respDecoder.ToString("HeaderUserID", respHeaders.Get("x-user-id"), true)
+	resp.QueryBoolean = respBody.QueryBoolean
+	resp.QueryInt = respBody.QueryInt
+	resp.QueryFloat = respBody.QueryFloat
+	resp.QueryString = respBody.QueryString
+	resp.QueryBytes = respBody.QueryBytes
+	resp.QueryTime = respBody.QueryTime
+	resp.QueryJson = respBody.QueryJson
+	resp.QueryUUID = respBody.QueryUUID
+	resp.QueryUserID = respBody.QueryUserID
+	resp.QuerySlice = respBody.QuerySlice
+	resp.BodyBoolean = respBody.BodyBoolean
+	resp.BodyInt = respBody.BodyInt
+	resp.BodyFloat = respBody.BodyFloat
+	resp.BodyString = respBody.BodyString
+	resp.BodyBytes = respBody.BodyBytes
+	resp.BodyTime = respBody.BodyTime
+	resp.BodyJson = respBody.BodyJson
+	resp.BodyUUID = respBody.BodyUUID
+	resp.BodyUserID = respBody.BodyUserID
+	resp.BodySlice = respBody.BodySlice
+
+	if respDecoder.LastError != nil {
+		err = fmt.Errorf("unable to unmarshal headers: %w", respDecoder.LastError)
+		return
+	}
+
+	return
+}
+
+// Noop allows us to test if a simple HTTP request can be made
+func (c *testClient) Noop(ctx context.Context) error {
+	_, err := callAPI(ctx, c.base, "POST", "/test.Noop", nil, nil, nil)
+	return err
+}
+
+// NoopWithError allows us to test if the structured errors are returned
+func (c *testClient) NoopWithError(ctx context.Context) error {
+	_, err := callAPI(ctx, c.base, "POST", "/test.NoopWithError", nil, nil, nil)
+	return err
+}
+
+// PathMultiSegments allows us to wildcard segments and segment URI encoding
+func (c *testClient) PathMultiSegments(ctx context.Context, _bool bool, _int int, _string string, uuid string, wildcard []string) (resp TestMultiPathSegment, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", fmt.Sprintf("/multi/%t/%d/%s/%s/%s", _bool, _int, url.PathEscape(_string), url.PathEscape(uuid), pathEscapeSlice(wildcard)), nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// RawEndpoint allows us to test the clients' ability to send raw requests
+// under auth
+func (c *testClient) RawEndpoint(ctx context.Context, id []string, request *http.Request) (*http.Response, error) {
+	request = request.WithContext(ctx)
+
+	// Check the request has the method set, as we can't guess what method is required
+	if request.Method == "" {
+		return nil, errors.New("request.Method must be set")
+	}
+
+	// Set the relative URL for the API call
+	path, err := url.Parse(fmt.Sprintf("/raw/blah/%s", pathEscapeSlice(id)))
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse api url: %w", err)
+	}
+	if request.URL != nil {
+		// If the request already has a URL associated, we'll keep any fields set inside it, and just override the schema,
+		// host and path to ensure the final URL which hit the right BaseURL
+		request.URL.Scheme = path.Scheme
+		request.URL.Host = path.Host
+		request.URL.Path = path.Path
+	} else {
+		request.URL = path
+	}
+
+	return c.base.Do(request)
+}
+
+// RestStyleAPI tests all the ways we can get data into and out of the application
+// using Encore request handlers
+func (c *testClient) RestStyleAPI(ctx context.Context, objType int, name string, params TestRestParams) (resp TestRestParams, err error) {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{"some-key": {reqEncoder.FromString(params.HeaderValue)}}
+
+	queryString := url.Values{"Some-Key": {reqEncoder.FromString(params.QueryValue)}}
+
+	if reqEncoder.LastError != nil {
+		err = fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+		return
+	}
+
+	// Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+	body := struct {
+		BodyValue string `json:"Some-Key"`
+		Nested    struct {
+			Key   string `json:"Alice"`
+			Value int    `json:"bOb"`
+			Ok    bool   `json:"charile"`
+		} `json:"Nested"`
+	}{
+		BodyValue: params.BodyValue,
+		Nested:    params.Nested,
+	}
+
+	// We only want the response body to marshal into these fields and none of the header fields,
+	// so we'll construct a new struct with only those fields.
+	respBody := struct {
+		QueryValue string `json:"QueryValue"`
+		BodyValue  string `json:"Some-Key"`
+		Nested     struct {
+			Key   string `json:"Alice"`
+			Value int    `json:"bOb"`
+			Ok    bool   `json:"charile"`
+		} `json:"Nested"`
+	}{}
+
+	// Now make the actual call to the API
+	var respHeaders http.Header
+	respHeaders, err = callAPI(ctx, c.base, "PUT", fmt.Sprintf("/rest/object/%d/%s?%s", objType, url.PathEscape(name), queryString.Encode()), headers, body, &respBody)
+	if err != nil {
+		return
+	}
+
+	// Copy the unmarshalled response body into our response struct
+	respDecoder := &serde{}
+
+	resp.HeaderValue = respDecoder.ToString("HeaderValue", respHeaders.Get("some-key"), true)
+	resp.QueryValue = respBody.QueryValue
+	resp.BodyValue = respBody.BodyValue
+	resp.Nested = respBody.Nested
+
+	if respDecoder.LastError != nil {
+		err = fmt.Errorf("unable to unmarshal headers: %w", respDecoder.LastError)
+		return
+	}
+
+	return
+}
+
+// SimpleBodyEcho allows us to exercise the body marshalling from JSON
+// and being returned purely as a body
+func (c *testClient) SimpleBodyEcho(ctx context.Context, params TestBodyEcho) (resp TestBodyEcho, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/test.SimpleBodyEcho", nil, params, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// TestAuthHandler allows us to test the clients ability to add tokens to requests
+func (c *testClient) TestAuthHandler(ctx context.Context) (resp TestBodyEcho, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/test.TestAuthHandler", nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// UpdateMessage allows us to test an API which takes parameters,
+// but doesn't return anything
+func (c *testClient) UpdateMessage(ctx context.Context, clientID string, params TestBodyEcho) error {
+	_, err := callAPI(ctx, c.base, "PUT", fmt.Sprintf("/last_message/%s", url.PathEscape(clientID)), nil, params, nil)
+	return err
+}
+
+type ValidationRequest struct {
+	Msg string
+}
+
+// ValidationClient Provides you access to call public and authenticated APIs on validation. The concrete implementation is validationClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type ValidationClient interface {
+	TestOne(ctx context.Context, params ValidationRequest) error
+}
+
+type validationClient struct {
+	base *baseClient
+}
+
+var _ ValidationClient = (*validationClient)(nil)
+
+func (c *validationClient) TestOne(ctx context.Context, params ValidationRequest) error {
+	_, err := callAPI(ctx, c.base, "POST", "/validation.TestOne", nil, params, nil)
+	return err
+}
+
+// HTTPDoer is an interface which can be used to swap out the default
+// HTTP client (http.DefaultClient) with your own custom implementation.
+// This can be used to inject middleware or mock responses during unit tests.
+type HTTPDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// baseClient holds all the information we need to make requests to an Encore application
+type baseClient struct {
+	authGenerator func(ctx context.Context) (EchoAuthParams, error) // The function which will add the authentication data to the requests
+	httpClient    HTTPDoer                                          // The HTTP client which will be used for all API requests
+	baseURL       *url.URL                                          // The base URL which API requests will be made against
+	userAgent     string                                            // What user agent we will use in the API requests
+}
+
+// Do sends the req to the Encore application adding the authorization token as required.
+func (b *baseClient) Do(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", b.userAgent)
+
+	// If a authorization data generator is present, call it and add the returned token to the request
+	if b.authGenerator != nil {
+		if authData, err := b.authGenerator(req.Context()); err != nil {
+			return nil, fmt.Errorf("unable to create authorization token for api request: %w", err)
+		} else {
+			authEncoder := &serde{}
+
+			// Add the auth fields to the query string
+			query := req.URL.Query()
+			for _, v := range authEncoder.FromIntList(authData.Query) {
+				query.Add("query", v)
+			}
+			query.Set("new-auth", authEncoder.FromBool(authData.NewAuth))
+			req.URL.RawQuery = query.Encode()
+
+			// Add the auth fields to the headers
+			req.Header.Set("x-header", authEncoder.FromString(authData.Header))
+			req.Header.Set("x-auth-int", authEncoder.FromInt(authData.AuthInt))
+			req.Header.Set("authorization", authEncoder.FromString(authData.Authorization))
+
+			if authEncoder.LastError != nil {
+				return nil, fmt.Errorf("unable to marshal authentication data: %w", authEncoder.LastError)
+			}
+
+		}
+	}
+
+	// Merge the base URL and the API URL
+	req.URL = b.baseURL.ResolveReference(req.URL)
+	req.Host = req.URL.Host
+
+	// Finally, make the request via the configured HTTP Client
+	return b.httpClient.Do(req)
+}
+
+// callAPI is used by each generated API method to actually make request and decode the responses
+func callAPI(ctx context.Context, client *baseClient, method, path string, headers http.Header, body, resp any) (http.Header, error) {
+	// Encode the API body
+	var bodyReader io.Reader
+	if body != nil {
+		bodyBytes, err := json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("marshal request: %w", err)
+		}
+		bodyReader = bytes.NewReader(bodyBytes)
+	}
+
+	// Create the request
+	req, err := http.NewRequestWithContext(ctx, method, path, bodyReader)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	// Add any headers to the request
+	for header, values := range headers {
+		for _, value := range values {
+			req.Header.Add(header, value)
+		}
+	}
+
+	// Make the request via the base client
+	rawResponse, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer func() {
+		_ = rawResponse.Body.Close()
+	}()
+	if rawResponse.StatusCode >= 400 {
+		// Read the full body sent back
+		body, err := io.ReadAll(rawResponse.Body)
+		if err != nil {
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response without readable body: %s", rawResponse.Status),
+			}
+		}
+
+		// Attempt to decode the error response as a structured APIError
+		apiError := &APIError{}
+		if err := json.Unmarshal(body, apiError); err != nil {
+			// If the error is not a parsable as an APIError, then return an error with the raw body
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response: %s", string(body)),
+			}
+		}
+		return nil, apiError
+	}
+
+	// Decode the response
+	if resp != nil {
+		if err := json.NewDecoder(rawResponse.Body).Decode(resp); err != nil {
+			return nil, fmt.Errorf("decode response: %w", err)
+		}
+	}
+	return rawResponse.Header, nil
+}
+
+// pathEscapeSlice escapes a slice of strings and then joins them into a single string
+func pathEscapeSlice(paths []string) string {
+	var escapedPaths strings.Builder
+	for i, path := range paths {
+		if i > 0 {
+			escapedPaths.WriteString("/")
+		}
+		escapedPaths.WriteString(url.PathEscape(path))
+	}
+	return escapedPaths.String()
+}
+
+// APIError is the error type returned by the API
+type APIError struct {
+	Code    ErrCode `json:"code"`
+	Message string  `json:"message"`
+	Details any     `json:"details"`
+}
+
+func (e *APIError) Error() string {
+	return fmt.Sprintf("%s: %s", e.Code, e.Message)
+}
+
+type ErrCode int
+
+const (
+	// ErrOK indicates the operation was successful.
+	ErrOK ErrCode = 0
+
+	// ErrCanceled indicates the operation was canceled (typically by the caller).
+	//
+	// Encore will generate this error code when cancellation is requested.
+	ErrCanceled ErrCode = 1
+
+	// ErrUnknown error. An example of where this error may be returned is
+	// if a Status value received from another address space belongs to
+	// an error-space that is not known in this address space. Also
+	// errors raised by APIs that do not return enough error information
+	// may be converted to this error.
+	//
+	// Encore will generate this error code in the above two mentioned cases.
+	ErrUnknown ErrCode = 2
+
+	// ErrInvalidArgument indicates client specified an invalid argument.
+	// Note that this differs from FailedPrecondition. It indicates arguments
+	// that are problematic regardless of the state of the system
+	// (e.g., a malformed file name).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInvalidArgument ErrCode = 3
+
+	// ErrDeadlineExceeded means operation expired before completion.
+	// For operations that change the state of the system, this error may be
+	// returned even if the operation has completed successfully. For
+	// example, a successful response from a server could have been delayed
+	// long enough for the deadline to expire.
+	//
+	// The gRPC framework will generate this error code when the deadline is
+	// exceeded.
+	ErrDeadlineExceeded ErrCode = 4
+
+	// ErrNotFound means some requested entity (e.g., file or directory) was
+	// not found.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrNotFound ErrCode = 5
+
+	// ErrAlreadyExists means an attempt to create an entity failed because one
+	// already exists.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrAlreadyExists ErrCode = 6
+
+	// ErrPermissionDenied indicates the caller does not have permission to
+	// execute the specified operation. It must not be used for rejections
+	// caused by exhausting some resource (use ResourceExhausted
+	// instead for those errors). It must not be
+	// used if the caller cannot be identified (use Unauthenticated
+	// instead for those errors).
+	//
+	// This error code will not be generated by the gRPC core framework,
+	// but expect authentication middleware to use it.
+	ErrPermissionDenied ErrCode = 7
+
+	// ErrResourceExhausted indicates some resource has been exhausted, perhaps
+	// a per-user quota, or perhaps the entire file system is out of space.
+	//
+	// This error code will be generated by the gRPC framework in
+	// out-of-memory and server overload situations, or when a message is
+	// larger than the configured maximum size.
+	ErrResourceExhausted ErrCode = 8
+
+	// ErrFailedPrecondition indicates operation was rejected because the
+	// system is not in a state required for the operation's execution.
+	// For example, directory to be deleted may be non-empty, an rmdir
+	// operation is applied to a non-directory, etc.
+	//
+	// A litmus test that may help a service implementor in deciding
+	// between FailedPrecondition, Aborted, and Unavailable:
+	//
+	//	(a) Use Unavailable if the client can retry just the failing call.
+	//	(b) Use Aborted if the client should retry at a higher-level
+	//	    (e.g., restarting a read-modify-write sequence).
+	//	(c) Use FailedPrecondition if the client should not retry until
+	//	    the system state has been explicitly fixed. E.g., if an "rmdir"
+	//	    fails because the directory is non-empty, FailedPrecondition
+	//	    should be returned since the client should not retry unless
+	//	    they have first fixed up the directory by deleting files from it.
+	//	(d) Use FailedPrecondition if the client performs conditional
+	//	    REST Get/Update/Delete on a resource and the resource on the
+	//	    server does not match the condition. E.g., conflicting
+	//	    read-modify-write on the same resource.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrFailedPrecondition ErrCode = 9
+
+	// ErrAborted indicates the operation was aborted, typically due to a
+	// concurrency issue like sequencer check failures, transaction aborts,
+	// etc.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// ErrAborted, and Unavailable.
+	ErrAborted ErrCode = 10
+
+	// ErrOutOfRange means operation was attempted past the valid range.
+	// E.g., seeking or reading past end of file.
+	//
+	// Unlike InvalidArgument, this error indicates a problem that may
+	// be fixed if the system state changes. For example, a 32-bit file
+	// may be rotated to a 64-bit file without error.
+	//
+	// There is a fair bit of overlap between FailedPrecondition and
+	// ErrOutOfRange. We recommend using OutOfRange (the more specific
+	// error) when it applies so that callers who are iterating through
+	// a space can easily look for an OutOfRange error to detect when
+	// they are done.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrOutOfRange ErrCode = 11
+
+	// ErrUnimplemented indicates operation is not implemented or not
+	// supported/enabled in this service.
+	//
+	// This is not an error, but a feature not available.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrUnimplemented ErrCode = 12
+
+	// ErrInternal means some invariant expected by the underlying system has
+	// been broken. This is not a per-message error, it is a global
+	// conditions check.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInternal ErrCode = 13
+
+	// ErrUnavailable indicates the service is currently unavailable.
+	// This is most likely a transient condition, which can be corrected by
+	// retrying with a backoff.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	ErrUnavailable ErrCode = 14
+
+	// ErrDataLoss indicates unrecoverable data loss or corruption.
+	//
+	// This error code is only defined in the gRPC library, and only for
+	// unrecoverable data loss (i.e., data loss resulting from errors
+	// like hard disk corruption or bandwidth exceeded).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrDataLoss ErrCode = 15
+
+	// ErrUnauthenticated indicates the request does not have valid
+	// authentication credentials for the operation.
+	//
+	// The gRPC framework will generate this error code when the
+	// authentication metadata is invalid or a Credentials callback fails,
+	// but also expect authentication middleware to generate it.
+	ErrUnauthenticated ErrCode = 16
+)
+
+// String returns the string representation of the error code
+func (c ErrCode) String() string {
+	switch c {
+	case ErrOK:
+		return "ok"
+	case ErrCanceled:
+		return "canceled"
+	case ErrUnknown:
+		return "unknown"
+	case ErrInvalidArgument:
+		return "invalid_argument"
+	case ErrDeadlineExceeded:
+		return "deadline_exceeded"
+	case ErrNotFound:
+		return "not_found"
+	case ErrAlreadyExists:
+		return "already_exists"
+	case ErrPermissionDenied:
+		return "permission_denied"
+	case ErrResourceExhausted:
+		return "resource_exhausted"
+	case ErrFailedPrecondition:
+		return "failed_precondition"
+	case ErrAborted:
+		return "aborted"
+	case ErrOutOfRange:
+		return "out_of_range"
+	case ErrUnimplemented:
+		return "unimplemented"
+	case ErrInternal:
+		return "internal"
+	case ErrUnavailable:
+		return "unavailable"
+	case ErrDataLoss:
+		return "data_loss"
+	case ErrUnauthenticated:
+		return "unauthenticated"
+	default:
+		return "unknown"
+	}
+}
+
+// MarshalJSON converts the error code to a human-readable string
+func (c ErrCode) MarshalJSON() ([]byte, error) {
+	return []byte(fmt.Sprintf("\"%s\"", c)), nil
+}
+
+// UnmarshalJSON converts the human-readable string to an error code
+func (c *ErrCode) UnmarshalJSON(b []byte) error {
+	switch string(b) {
+	case "\"ok\"":
+		*c = ErrOK
+	case "\"canceled\"":
+		*c = ErrCanceled
+	case "\"unknown\"":
+		*c = ErrUnknown
+	case "\"invalid_argument\"":
+		*c = ErrInvalidArgument
+	case "\"deadline_exceeded\"":
+		*c = ErrDeadlineExceeded
+	case "\"not_found\"":
+		*c = ErrNotFound
+	case "\"already_exists\"":
+		*c = ErrAlreadyExists
+	case "\"permission_denied\"":
+		*c = ErrPermissionDenied
+	case "\"resource_exhausted\"":
+		*c = ErrResourceExhausted
+	case "\"failed_precondition\"":
+		*c = ErrFailedPrecondition
+	case "\"aborted\"":
+		*c = ErrAborted
+	case "\"out_of_range\"":
+		*c = ErrOutOfRange
+	case "\"unimplemented\"":
+		*c = ErrUnimplemented
+	case "\"internal\"":
+		*c = ErrInternal
+	case "\"unavailable\"":
+		*c = ErrUnavailable
+	case "\"data_loss\"":
+		*c = ErrDataLoss
+	case "\"unauthenticated\"":
+		*c = ErrUnauthenticated
+	default:
+		*c = ErrUnknown
+	}
+	return nil
+}
+
+// serde is used to serialize request data into strings and deserialize response data from strings
+type serde struct {
+	LastError      error // The last error that occurred
+	NonEmptyValues int   // The number of values this decoder has decoded
+}
+
+func (e *serde) FromInt(s int) (v string) {
+	e.NonEmptyValues++
+	return strconv.FormatInt(int64(s), 10)
+}
+
+func (e *serde) FromString(s string) (v string) {
+	e.NonEmptyValues++
+	return s
+}
+
+func (e *serde) ToInt(field string, s string, required bool) (v int) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	x, err := strconv.ParseInt(s, 10, 64)
+	e.setErr("invalid parameter", field, err)
+	return int(x)
+}
+
+func (e *serde) ToString(field string, s string, required bool) (v string) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	return s
+}
+
+func (e *serde) FromBool(s bool) (v string) {
+	e.NonEmptyValues++
+	return strconv.FormatBool(s)
+}
+
+func (e *serde) FromFloat64(s float64) (v string) {
+	e.NonEmptyValues++
+	return strconv.FormatFloat(s, uint8(0x66), -1, 64)
+}
+
+func (e *serde) FromBytes(s []byte) (v string) {
+	e.NonEmptyValues++
+	return base64.URLEncoding.EncodeToString(s)
+}
+
+func (e *serde) FromTime(s time.Time) (v string) {
+	e.NonEmptyValues++
+	return s.Format(time.RFC3339)
+}
+
+func (e *serde) FromJSON(s json.RawMessage) (v string) {
+	e.NonEmptyValues++
+	return string(s)
+}
+
+func (e *serde) FromIntList(s []int) (v []string) {
+	e.NonEmptyValues++
+	for _, x := range s {
+		v = append(v, e.FromInt(x))
+	}
+	return v
+}
+
+func (e *serde) ToBool(field string, s string, required bool) (v bool) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	v, err := strconv.ParseBool(s)
+	e.setErr("invalid parameter", field, err)
+	return v
+}
+
+func (e *serde) ToFloat64(field string, s string, required bool) (v float64) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	x, err := strconv.ParseFloat(s, 64)
+	e.setErr("invalid parameter", field, err)
+	return x
+}
+
+func (e *serde) ToBytes(field string, s string, required bool) (v []byte) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	v, err := base64.URLEncoding.DecodeString(s)
+	e.setErr("invalid parameter", field, err)
+	return v
+}
+
+func (e *serde) ToTime(field string, s string, required bool) (v time.Time) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	v, err := time.Parse(time.RFC3339, s)
+	e.setErr("invalid parameter", field, err)
+	return v
+}
+
+func (e *serde) ToJSON(field string, s string, required bool) (v json.RawMessage) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	return json.RawMessage(s)
+}
+
+// setErr sets the last error within the object if one is not already set
+func (e *serde) setErr(msg, field string, err error) {
+	if err != nil && e.LastError == nil {
+		e.LastError = fmt.Errorf("%s: %s: %w", field, msg, err)
+	}
+}
diff --git a/e2e-tests/testdata/echo_client/js/client.js b/e2e-tests/testdata/echo_client/js/client.js
new file mode 100644
index 0000000000..ba4dee1613
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/js/client.js
@@ -0,0 +1,1223 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * Local is the base URL for calling the Encore application's API.
+ */
+export const Local = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name) {
+    return `https://${name}-slug.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr) {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the slug Encore application.
+ */
+export default class Client {
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target = "prod", options = undefined) {
+        const base = new BaseClient(target, options ?? {})
+        this.cache = new cache.ServiceClient(base)
+        this.di = new di.ServiceClient(base)
+        this.echo = new echo.ServiceClient(base)
+        this.emptycfg = new emptycfg.ServiceClient(base)
+        this.endtoend = new endtoend.ServiceClient(base)
+        this.middleware = new middleware.ServiceClient(base)
+        this.test = new test.ServiceClient(base)
+        this.validation = new validation.ServiceClient(base)
+    }
+}
+
+class CacheServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.GetList = this.GetList.bind(this)
+        this.GetStruct = this.GetStruct.bind(this)
+        this.Incr = this.Incr.bind(this)
+        this.PostList = this.PostList.bind(this)
+        this.PostStruct = this.PostStruct.bind(this)
+    }
+
+    async GetList(key) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("GET", `/cache/list/${encodeURIComponent(key)}`)
+        return await resp.json()
+    }
+
+    async GetStruct(key) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("GET", `/cache/struct/${encodeURIComponent(key)}`)
+        return await resp.json()
+    }
+
+    async Incr(key) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/cache/incr/${encodeURIComponent(key)}`)
+        return await resp.json()
+    }
+
+    async PostList(key, val) {
+        await this.baseClient.callTypedAPI("POST", `/cache/list/${encodeURIComponent(key)}/${encodeURIComponent(val)}`)
+    }
+
+    async PostStruct(key, val) {
+        await this.baseClient.callTypedAPI("POST", `/cache/struct/${encodeURIComponent(key)}/${encodeURIComponent(val)}`)
+    }
+}
+
+export const cache = {
+    ServiceClient: CacheServiceClient
+}
+
+class DiServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.One = this.One.bind(this)
+        this.Three = this.Three.bind(this)
+        this.Two = this.Two.bind(this)
+    }
+
+    async One() {
+        await this.baseClient.callTypedAPI("POST", `/di/one`)
+    }
+
+    async Three(method, body, options) {
+        return this.baseClient.callAPI(method, `/di/raw`, body, options)
+    }
+
+    async Two() {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/di/two`)
+        return await resp.json()
+    }
+}
+
+export const di = {
+    ServiceClient: DiServiceClient
+}
+
+class EchoServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.AppMeta = this.AppMeta.bind(this)
+        this.BasicEcho = this.BasicEcho.bind(this)
+        this.ConfigValues = this.ConfigValues.bind(this)
+        this.CustomHTTPStatus = this.CustomHTTPStatus.bind(this)
+        this.Echo = this.Echo.bind(this)
+        this.EmptyEcho = this.EmptyEcho.bind(this)
+        this.Env = this.Env.bind(this)
+        this.HeadersEcho = this.HeadersEcho.bind(this)
+        this.MuteEcho = this.MuteEcho.bind(this)
+        this.NilResponse = this.NilResponse.bind(this)
+        this.NonBasicEcho = this.NonBasicEcho.bind(this)
+        this.Noop = this.Noop.bind(this)
+        this.Pong = this.Pong.bind(this)
+        this.Publish = this.Publish.bind(this)
+    }
+
+    /**
+     * AppMeta returns app metadata.
+     */
+    async AppMeta() {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/echo.AppMeta`)
+        return await resp.json()
+    }
+
+    /**
+     * BasicEcho echoes back the request data.
+     */
+    async BasicEcho(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/echo.BasicEcho`, JSON.stringify(params))
+        return await resp.json()
+    }
+
+    async ConfigValues() {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/echo.ConfigValues`)
+        return await resp.json()
+    }
+
+    /**
+     * CustomHTTPStatus allows testing of custom HTTP status codes via encore:"httpstatus" tag
+     */
+    async CustomHTTPStatus() {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/echo.CustomHTTPStatus`)
+        return await resp.json()
+    }
+
+    /**
+     * Echo echoes back the request data.
+     */
+    async Echo(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/echo.Echo`, JSON.stringify(params))
+        return await resp.json()
+    }
+
+    /**
+     * EmptyEcho echoes back the request data.
+     */
+    async EmptyEcho(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/echo.EmptyEcho`, JSON.stringify(params))
+        return await resp.json()
+    }
+
+    /**
+     * Env returns the environment.
+     */
+    async Env() {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/echo.Env`)
+        return await resp.json()
+    }
+
+    /**
+     * HeadersEcho echoes back the request headers
+     */
+    async HeadersEcho(params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "x-int":    String(params.Int),
+            "x-string": params.String,
+        })
+
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/echo.HeadersEcho`, undefined, {headers})
+
+        //Populate the return object from the JSON body and received headers
+        const rtn = await resp.json()
+        rtn.Int = parseInt(mustBeSet("Header `x-int`", resp.headers.get("x-int")), 10)
+        rtn.String = mustBeSet("Header `x-string`", resp.headers.get("x-string"))
+        return rtn
+    }
+
+    /**
+     * MuteEcho absorbs a request
+     */
+    async MuteEcho(params) {
+        // Convert our params into the objects we need for the request
+        const query = makeRecord({
+            key:   params.Key,
+            value: params.Value,
+        })
+
+        await this.baseClient.callTypedAPI("GET", `/echo.MuteEcho`, undefined, {query})
+    }
+
+    /**
+     * NilResponse returns a nil response and nil error
+     */
+    async NilResponse() {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/echo.NilResponse`)
+        return await resp.json()
+    }
+
+    /**
+     * NonBasicEcho echoes back the request data.
+     */
+    async NonBasicEcho(pathString, pathInt, pathWild, params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "x-header-number": String(params.HeaderNumber),
+            "x-header-string": params.HeaderString,
+        })
+
+        const query = makeRecord({
+            no:     String(params.QueryNumber),
+            optnum: params.OptQueryNumber === undefined ? undefined : String(params.OptQueryNumber),
+            optstr: params.OptQueryString,
+            string: params.QueryString,
+        })
+
+        // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+        const body = {
+            AnonStruct:       params.AnonStruct,
+            AuthHeader:       params.AuthHeader,
+            AuthQuery:        params.AuthQuery,
+            PathInt:          params.PathInt,
+            PathString:       params.PathString,
+            PathWild:         params.PathWild,
+            RawStruct:        params.RawStruct,
+            Struct:           params.Struct,
+            StructMap:        params.StructMap,
+            StructMapPtr:     params.StructMapPtr,
+            StructPtr:        params.StructPtr,
+            StructSlice:      params.StructSlice,
+            "formatted_nest": params["formatted_nest"],
+        }
+
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/NonBasicEcho/${encodeURIComponent(pathString)}/${encodeURIComponent(pathInt)}/${pathWild.map(encodeURIComponent).join("/")}`, JSON.stringify(body), {headers, query})
+
+        //Populate the return object from the JSON body and received headers
+        const rtn = await resp.json()
+        rtn.HeaderString = mustBeSet("Header `x-header-string`", resp.headers.get("x-header-string"))
+        rtn.HeaderNumber = parseInt(mustBeSet("Header `x-header-number`", resp.headers.get("x-header-number")), 10)
+        return rtn
+    }
+
+    /**
+     * Noop does nothing
+     */
+    async Noop() {
+        await this.baseClient.callTypedAPI("GET", `/echo.Noop`)
+    }
+
+    /**
+     * Pong returns a bird tuple
+     */
+    async Pong() {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("GET", `/echo.Pong`)
+        return await resp.json()
+    }
+
+    /**
+     * Publish publishes a request on a topic
+     */
+    async Publish() {
+        await this.baseClient.callTypedAPI("POST", `/echo.Publish`)
+    }
+}
+
+export const echo = {
+    ServiceClient: EchoServiceClient
+}
+
+class EmptycfgServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.AnAPI = this.AnAPI.bind(this)
+    }
+
+    async AnAPI() {
+        await this.baseClient.callTypedAPI("POST", `/emptycfg.AnAPI`)
+    }
+}
+
+export const emptycfg = {
+    ServiceClient: EmptycfgServiceClient
+}
+
+class EndtoendServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.GeneratedWrappersEndToEndTest = this.GeneratedWrappersEndToEndTest.bind(this)
+    }
+
+    async GeneratedWrappersEndToEndTest() {
+        await this.baseClient.callTypedAPI("GET", `/generated-wrappers-end-to-end-test`)
+    }
+}
+
+export const endtoend = {
+    ServiceClient: EndtoendServiceClient
+}
+
+class MiddlewareServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.Error = this.Error.bind(this)
+        this.ResponseGen = this.ResponseGen.bind(this)
+        this.ResponseRewrite = this.ResponseRewrite.bind(this)
+    }
+
+    async Error() {
+        await this.baseClient.callTypedAPI("POST", `/middleware.Error`)
+    }
+
+    async ResponseGen(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/middleware.ResponseGen`, JSON.stringify(params))
+        return await resp.json()
+    }
+
+    async ResponseRewrite(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/middleware.ResponseRewrite`, JSON.stringify(params))
+        return await resp.json()
+    }
+}
+
+export const middleware = {
+    ServiceClient: MiddlewareServiceClient
+}
+
+class TestServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.GetMessage = this.GetMessage.bind(this)
+        this.MarshallerTestHandler = this.MarshallerTestHandler.bind(this)
+        this.Noop = this.Noop.bind(this)
+        this.NoopWithError = this.NoopWithError.bind(this)
+        this.PathMultiSegments = this.PathMultiSegments.bind(this)
+        this.RawEndpoint = this.RawEndpoint.bind(this)
+        this.RestStyleAPI = this.RestStyleAPI.bind(this)
+        this.SimpleBodyEcho = this.SimpleBodyEcho.bind(this)
+        this.TestAuthHandler = this.TestAuthHandler.bind(this)
+        this.UpdateMessage = this.UpdateMessage.bind(this)
+    }
+
+    /**
+     * GetMessage allows us to test an API which takes no parameters,
+     * but returns data. It also tests two API's on the same path with different HTTP methods
+     */
+    async GetMessage(clientID) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("GET", `/last_message/${encodeURIComponent(clientID)}`)
+        return await resp.json()
+    }
+
+    /**
+     * MarshallerTestHandler allows us to test marshalling of all the inbuilt types in all
+     * the field types. It simply echos all the responses back to the client
+     */
+    async MarshallerTestHandler(params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "x-boolean": String(params.HeaderBoolean),
+            "x-bytes":   String(params.HeaderBytes),
+            "x-float":   String(params.HeaderFloat),
+            "x-int":     String(params.HeaderInt),
+            "x-json":    JSON.stringify(params.HeaderJson),
+            "x-string":  params.HeaderString,
+            "x-time":    String(params.HeaderTime),
+            "x-user-id": String(params.HeaderUserID),
+            "x-uuid":    String(params.HeaderUUID),
+        })
+
+        const query = makeRecord({
+            boolean:   String(params.QueryBoolean),
+            bytes:     String(params.QueryBytes),
+            float:     String(params.QueryFloat),
+            int:       String(params.QueryInt),
+            json:      JSON.stringify(params.QueryJson),
+            slice:     params.QuerySlice.map((v) => String(v)),
+            string:    params.QueryString,
+            time:      String(params.QueryTime),
+            "user-id": String(params.QueryUserID),
+            uuid:      String(params.QueryUUID),
+        })
+
+        // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+        const body = {
+            boolean:   params.boolean,
+            bytes:     params.bytes,
+            float:     params.float,
+            int:       params.int,
+            json:      params.json,
+            slice:     params.slice,
+            string:    params.string,
+            time:      params.time,
+            "user-id": params["user-id"],
+            uuid:      params.uuid,
+        }
+
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/test.MarshallerTestHandler`, JSON.stringify(body), {headers, query})
+
+        //Populate the return object from the JSON body and received headers
+        const rtn = await resp.json()
+        rtn.HeaderBoolean = mustBeSet("Header `x-boolean`", resp.headers.get("x-boolean")).toLowerCase() === "true"
+        rtn.HeaderInt = parseInt(mustBeSet("Header `x-int`", resp.headers.get("x-int")), 10)
+        rtn.HeaderFloat = Number(mustBeSet("Header `x-float`", resp.headers.get("x-float")))
+        rtn.HeaderString = mustBeSet("Header `x-string`", resp.headers.get("x-string"))
+        rtn.HeaderBytes = mustBeSet("Header `x-bytes`", resp.headers.get("x-bytes"))
+        rtn.HeaderTime = mustBeSet("Header `x-time`", resp.headers.get("x-time"))
+        rtn.HeaderJson = JSON.parse(mustBeSet("Header `x-json`", resp.headers.get("x-json")))
+        rtn.HeaderUUID = mustBeSet("Header `x-uuid`", resp.headers.get("x-uuid"))
+        rtn.HeaderUserID = mustBeSet("Header `x-user-id`", resp.headers.get("x-user-id"))
+        return rtn
+    }
+
+    /**
+     * Noop allows us to test if a simple HTTP request can be made
+     */
+    async Noop() {
+        await this.baseClient.callTypedAPI("POST", `/test.Noop`)
+    }
+
+    /**
+     * NoopWithError allows us to test if the structured errors are returned
+     */
+    async NoopWithError() {
+        await this.baseClient.callTypedAPI("POST", `/test.NoopWithError`)
+    }
+
+    /**
+     * PathMultiSegments allows us to wildcard segments and segment URI encoding
+     */
+    async PathMultiSegments(bool, _int, string, uuid, wildcard) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/multi/${encodeURIComponent(bool)}/${encodeURIComponent(_int)}/${encodeURIComponent(string)}/${encodeURIComponent(uuid)}/${wildcard.map(encodeURIComponent).join("/")}`)
+        return await resp.json()
+    }
+
+    /**
+     * RawEndpoint allows us to test the clients' ability to send raw requests
+     * under auth
+     */
+    async RawEndpoint(method, id, body, options) {
+        return this.baseClient.callAPI(method, `/raw/blah/${id.map(encodeURIComponent).join("/")}`, body, options)
+    }
+
+    /**
+     * RestStyleAPI tests all the ways we can get data into and out of the application
+     * using Encore request handlers
+     */
+    async RestStyleAPI(objType, name, params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "some-key": params.HeaderValue,
+        })
+
+        const query = makeRecord({
+            "Some-Key": params.QueryValue,
+        })
+
+        // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+        const body = {
+            Nested:     params.Nested,
+            "Some-Key": params["Some-Key"],
+        }
+
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("PUT", `/rest/object/${encodeURIComponent(objType)}/${encodeURIComponent(name)}`, JSON.stringify(body), {headers, query})
+
+        //Populate the return object from the JSON body and received headers
+        const rtn = await resp.json()
+        rtn.HeaderValue = mustBeSet("Header `some-key`", resp.headers.get("some-key"))
+        return rtn
+    }
+
+    /**
+     * SimpleBodyEcho allows us to exercise the body marshalling from JSON
+     * and being returned purely as a body
+     */
+    async SimpleBodyEcho(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/test.SimpleBodyEcho`, JSON.stringify(params))
+        return await resp.json()
+    }
+
+    /**
+     * TestAuthHandler allows us to test the clients ability to add tokens to requests
+     */
+    async TestAuthHandler() {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/test.TestAuthHandler`)
+        return await resp.json()
+    }
+
+    /**
+     * UpdateMessage allows us to test an API which takes parameters,
+     * but doesn't return anything
+     */
+    async UpdateMessage(clientID, params) {
+        await this.baseClient.callTypedAPI("PUT", `/last_message/${encodeURIComponent(clientID)}`, JSON.stringify(params))
+    }
+}
+
+export const test = {
+    ServiceClient: TestServiceClient
+}
+
+class ValidationServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.TestOne = this.TestOne.bind(this)
+    }
+
+    async TestOne(params) {
+        await this.baseClient.callTypedAPI("POST", `/validation.TestOne`, JSON.stringify(params))
+    }
+}
+
+export const validation = {
+    ServiceClient: ValidationServiceClient
+}
+
+
+function encodeQuery(parts) {
+    const pairs = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]])
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+function makeRecord(record) {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record
+}
+
+// mustBeSet will throw an APIError with the Data Loss code if value is null or undefined
+function mustBeSet(field, value) {
+    if (value === null || value === undefined) {
+        throw new APIError(
+            500,
+            {
+                code: ErrCode.DataLoss,
+                message: `${field} was unexpectedly ${value}`, // ${value} will create the string "null" or "undefined"
+            },
+        )
+    }
+    return value
+}
+
+
+function encodeWebSocketHeaders(headers) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    hasUpdateHandlers = [];
+
+    constructor(url, headers) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers));
+        }
+
+        this.ws = new WebSocket(url, protocols);
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type, handler) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type, handler) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut {
+    constructor(url, headers) {
+        let responseResolver;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response() {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+
+const boundFetch = fetch.bind(this)
+
+class BaseClient {
+    constructor(baseURL, options) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "slug-Generated-JS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {}
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+
+        // Setup an authentication data generator using the auth data token option
+        if (options.auth !== undefined) {
+            const auth = options.auth
+            if (typeof auth === "function") {
+                this.authGenerator = auth
+            } else {
+                this.authGenerator = () => auth
+            }
+        }
+
+    }
+
+    async getAuthData() {
+        let authData;
+
+        // If authorization data generator is present, call it and add the returned data to the request
+        if (this.authGenerator) {
+            const mayBePromise = this.authGenerator();
+            if (mayBePromise instanceof Promise) {
+                authData = await mayBePromise;
+            } else {
+                authData = mayBePromise;
+            }
+        }
+
+        if (authData) {
+            const data = {};
+
+            data.query = makeRecord({
+                "new-auth": String(authData.NewAuth),
+                query:      authData.Query.map((v) => String(v)),
+            });
+            data.headers = makeRecord({
+                authorization: authData.Authorization,
+                "x-auth-int":  String(authData.AuthInt),
+                "x-header":    authData.Header,
+            })
+
+            return data;
+        }
+
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : '';
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    async callTypedAPI(method, path, body, params) {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    async callAPI(method, path, body, params) {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+function isAPIErrorResponse(err) {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code) {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    constructor(status, response) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if (Object.setPrototypeOf == undefined) {
+            this.__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if (Error.captureStackTrace !== undefined) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+
+        /**
+         * The HTTP status code associated with the error.
+         */
+        this.status = status
+
+        /**
+         * The Encore error code
+         */
+        this.code = response.code
+
+        /**
+         * The error details
+         */
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err) {
+    return err instanceof APIError;
+}
+
+export const ErrCode = {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK: "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled: "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown: "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument: "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded: "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound: "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists: "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied: "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted: "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition: "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted: "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange: "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented: "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal: "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable: "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss: "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated: "unauthenticated"
+}
diff --git a/e2e-tests/testdata/echo_client/js/main.js b/e2e-tests/testdata/echo_client/js/main.js
new file mode 100644
index 0000000000..71d8d2dd14
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/js/main.js
@@ -0,0 +1,260 @@
+import "isomorphic-fetch"
+import {deepEqual} from "assert"
+
+import Client, {ErrCode, isAPIError} from "./client.js"
+
+if (process.argv.length < 3) {
+  console.error("Usage: npm run test -- <host:port>")
+  console.log(`Got ${process.argv.length} arguments`)
+  process.exit(1)
+}
+
+// Create the client
+const api = new Client("http://" + process.argv[2])
+
+// Test a simple no-op
+await api.test.Noop()
+
+// Test we get back the right structured error
+await assertStructuredError(api.test.NoopWithError(), ErrCode.Unimplemented, "totally not implemented yet")
+
+// Test a simple echo
+const echoRsp = await api.test.SimpleBodyEcho({Message: "hello world"})
+deepEqual(echoRsp.Message, "hello world", "Wanted body to be 'hello world'")
+
+// Check our UpdateMessage and GetMessage API's
+let getRsp = await api.test.GetMessage("javascript")
+deepEqual(getRsp.Message, "", "Expected no message on first request")
+
+await api.test.UpdateMessage("javascript", {Message: "updating now"})
+
+getRsp = await api.test.GetMessage("javascript")
+deepEqual(getRsp.Message, "updating now", "Expected data from Update request")
+
+// Test the rest API which uses all input types (query string, json body and header fields)
+// as well as nested structs and path segments in the URL
+const restRsp = await api.test.RestStyleAPI(5, "hello", {
+  HeaderValue: "this is the header field",
+  QueryValue:  "this is a query string field",
+  "Some-Key":  "this is the body field",
+  Nested:      {
+    Alice:   "the nested key",
+    bOb:     8,
+    charile: true,
+  },
+})
+deepEqual(restRsp.HeaderValue, "this is the header field", "expected header value")
+deepEqual(restRsp.QueryValue, "this is a query string field", "expected query value")
+deepEqual(restRsp["Some-Key"], "this is the body field", "expected body value")
+deepEqual(restRsp.Nested.Alice, "hello + the nested key", "expected nested key")
+deepEqual(restRsp.Nested.bOb, 5 + 8, "expected nested value")
+deepEqual(restRsp.Nested.charile, true, "expected nested ok")
+
+// Full marshalling test with randomised payloads
+function rInt() {
+  return Math.floor(Math.random() * 10000000)
+}
+
+const params = {
+  HeaderBoolean: Math.random() > 0.5,
+  HeaderInt:     rInt(),
+  HeaderFloat:   Math.random(),
+  HeaderString:  "header string",
+  HeaderBytes:   "aGVsbG8K",
+  HeaderTime:    (new Date(Math.floor(Date.now() / 1000) * 1000)).toISOString().replace(".000Z", "Z"),
+  HeaderJson:    {"hello": "world"},
+  HeaderUUID:    "2553e3a4-5d9f-4716-82a2-b9bdc20a3263",
+  HeaderUserID:  "432",
+  QueryBoolean:  Math.random() > 0.5,
+  QueryInt:      rInt(),
+  QueryFloat:    Math.random(),
+  QueryString:   "query string",
+  QueryBytes:    "d29ybGQK",
+  QueryTime:     (new Date(Math.floor(Date.now() / 1000) * 1000)).toISOString().replace(".000Z", "Z"),
+  QueryJson:     {value: true},
+  QueryUUID:     "84b7463d-6000-4678-9d94-1d526bb5217c",
+  QueryUserID:   "9udfa",
+  QuerySlice:    [rInt(), rInt(), rInt(), rInt()],
+  boolean:       Math.random() > 0.5,
+  int:           Math.floor(Math.random() * 10000000),
+  float:         Math.random(),
+  string:        "body string",
+  bytes:         "aXMgaXQgbWUgeW91IGFyZSBsb29raW5nIGZvcj8K",
+  time:          (new Date(Math.floor(Date.now() / 1000) * 1000)).toISOString().replace(".000Z", "Z"),
+  json:          {json_value: 4321},
+  uuid:          "c227acf4-1902-4c85-8027-623d47ef4c8a",
+  "user-id":     "✉️",
+  slice:         [rInt(), rInt(), rInt(), rInt(), rInt(), rInt()],
+}
+const mResp = await api.test.MarshallerTestHandler(params)
+deepEqual(mResp, params, "Expected the same response from the marshaller test")
+
+// Test auth handlers
+await assertStructuredError(api.test.TestAuthHandler(), ErrCode.Unauthenticated, "missing auth param")
+
+// Test with static auth data
+{
+  const api = new Client(
+      "http://" + process.argv[2],
+      {
+        auth: {
+          AuthInt:        34,
+          Authorization: "Bearer tokendata",
+          NewAuth:        false,
+          Header:        "",
+          Query:         [],
+        },
+      },
+  )
+
+  const resp = await api.test.TestAuthHandler()
+  deepEqual(resp.Message, "user::true", "expected the user ID back")
+}
+
+// Test with auth data generator function
+{
+  let tokenToReturn = "tokendata"
+  const api = new Client(
+      "http://" + process.argv[2],
+      {
+        auth: () => {
+          return {
+            Authorization: "Bearer " + tokenToReturn,
+            AuthInt:        34,
+            NewAuth:        false,
+            Header:        "",
+            Query:         [],
+          }
+        },
+      },
+  )
+
+  // With a valid token
+  const resp = await api.test.TestAuthHandler()
+  deepEqual(resp.Message, "user::true", "expected the user ID back")
+
+  // With an invalid token
+  tokenToReturn = "invalid-token-value"
+  await assertStructuredError(api.test.TestAuthHandler(), ErrCode.Unauthenticated, "invalid token")
+}
+
+// Test with headers and query string auth data
+{
+  const api = new Client(
+      "http://" + process.argv[2],
+      {
+        auth: {
+          Authorization: "",
+          AuthInt:        34,
+          NewAuth:        true,
+          Header:        "102",
+          Query:         [42, 100, -50, 10],
+        },
+      },
+  )
+
+  const resp = await api.test.TestAuthHandler()
+  deepEqual(resp.Message, "second_user::true", "expected the user ID back")
+}
+
+// Test the raw endpoint
+{
+  const api = new Client(
+      "http://" + process.argv[2],
+      {
+        auth: {
+          AuthInt:        34,
+          Authorization: "Bearer tokendata",
+          NewAuth:        false,
+          Header:        "",
+          Query:         [],
+        },
+      },
+  )
+
+  const resp = await api.test.RawEndpoint(
+      "PUT",
+      ["hello"],
+      "this is a test body",
+      {
+        headers: {"X-Test-Header": "test"},
+        query:   {"foo": "bar"},
+      },
+  )
+
+  deepEqual(resp.status, 201, "expected the status code to be 201")
+
+  const response = await resp.json()
+
+  deepEqual(response, {
+    Body:        "this is a test body",
+    Header:      "test",
+    PathParam:   "hello",
+    QueryString: "bar",
+  }, "expected the response to match")
+}
+
+// Test path encoding
+const resp = await api.test.PathMultiSegments(true, 342, "foo/blah/should/get/escaped", "503f4487-1e15-4c37-9a80-7b70f86387bb", ["foo/bar", "blah", "seperate/segments = great success"])
+deepEqual(resp.Boolean, true, "expected the boolean to be true")
+deepEqual(resp.Int, 342, "expected the int to be 342")
+deepEqual(resp.String, "foo/blah/should/get/escaped", "invalid string field returned")
+deepEqual(resp.UUID, "503f4487-1e15-4c37-9a80-7b70f86387bb", "invalid UUID returned")
+deepEqual(resp.Wildcard, "foo/bar/blah/seperate/segments = great success", "invalid wildcard field returned")
+
+// Test validation
+{
+  await api.validation.TestOne({
+    Msg: "pass",
+  })
+  await assertStructuredError(api.validation.TestOne({Msg: "fail"}), ErrCode.InvalidArgument, "validation failed: bad message")
+  const client = new Client(
+      "http://" + process.argv[2],
+      {
+        auth: {
+          AuthInt:        0,
+          Authorization: "",
+          NewAuth:       false,
+          Header:        "fail-validation",
+          Query:         [],
+        },
+      },
+  )
+  await assertStructuredError(client.test.Noop(), ErrCode.InvalidArgument, "validation failed: auth validation fail")
+}
+
+// Test middleware
+{
+  await assertStructuredError(api.middleware.Error(), ErrCode.Internal, "middleware error")
+  const resp1 = await api.middleware.ResponseRewrite({Msg: "foo"})
+  deepEqual(resp1.Msg, "middleware(req=foo, resp=handler(foo))")
+
+  const resp2 = await api.middleware.ResponseGen({Msg: "foo"})
+  deepEqual(resp2.Msg, "middleware generated")
+}
+
+// Client test completed
+process.exit(0)
+
+async function assertStructuredError(promise, code, message) {
+  let errorOccurred = false
+  try {
+    await promise
+  } catch (err) {
+    errorOccurred = true
+    if (isAPIError(err)) {
+      if (err.code !== code) {
+        throw new Error(`Expected error code ${code}, got ${err.code} with message "${err.message}"`)
+      }
+      if (err.message !== message) {
+        throw new Error(`Expected error message "${message}", got "${err.message}"`)
+      }
+    } else {
+      throw new Error(`Expected APIError, got ${err}`)
+    }
+  }
+
+  if (!errorOccurred) {
+    throw new Error("No error was thrown during call to NoopWithError")
+  }
+}
diff --git a/e2e-tests/testdata/echo_client/main.go b/e2e-tests/testdata/echo_client/main.go
new file mode 100644
index 0000000000..57b7bbbc48
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/main.go
@@ -0,0 +1,316 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"math/rand"
+	"net/http"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"time"
+
+	"echo_client/golang/client"
+)
+
+var assertNumber = 1
+
+func main() {
+	// Even on a slow machine, the client should be able to connect and run this test script in 30 seconds
+	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+	defer cancel()
+
+	// Check we where given the host:port of the running echo app
+	if len(os.Args) != 2 {
+		fmt.Println("Usage:", filepath.Base(os.Args[0]), "<host:port>")
+		fmt.Println("Got", len(os.Args), "arguments")
+		os.Exit(1)
+	}
+
+	// Create the client
+	api, err := client.New(
+		client.BaseURL(fmt.Sprintf("http://%s", os.Args[1])),
+	)
+	assert(err, nil, "Wanted no error from client creation")
+
+	// Test a simple no-op
+	err = api.Test.Noop(ctx)
+	assert(err, nil, "Wanted no error from noop")
+
+	// Test we get back the right structured error
+	err = api.Test.NoopWithError(ctx)
+	assertStructuredError(err, client.ErrUnimplemented, "totally not implemented yet")
+
+	// Test a simple echo
+	echoRsp, err := api.Test.SimpleBodyEcho(ctx, client.TestBodyEcho{"hello world"})
+	assert(err, nil, "Wanted no error from simple body echo")
+	assert(echoRsp.Message, "hello world", "Wanted body to be 'hello world'")
+
+	// Check our UpdateMessage and GetMessage API's
+	getRsp, err := api.Test.GetMessage(ctx, "go")
+	assert(err, nil, "Wanted no error from get message")
+	assert(getRsp.Message, "", "Expected no message on first request")
+
+	err = api.Test.UpdateMessage(ctx, "go", client.TestBodyEcho{"updating now"})
+	assert(err, nil, "Wanted no error from update message")
+
+	getRsp, err = api.Test.GetMessage(ctx, "go")
+	assert(err, nil, "Wanted no error from get message")
+	assert(getRsp.Message, "updating now", "Expected data from Update request")
+
+	// Test the rest API which uses all input types (query string, json body and header fields)
+	// as well as nested structs and path segments in the URL
+	restRsp, err := api.Test.RestStyleAPI(ctx, 5, "hello", client.TestRestParams{
+		HeaderValue: "this is the header field",
+		QueryValue:  "this is a query string field",
+		BodyValue:   "this is the body field",
+		Nested: struct {
+			Key   string `json:"Alice"`
+			Value int    `json:"bOb"`
+			Ok    bool   `json:"charile"`
+		}{
+			Key:   "the nested key",
+			Value: 8,
+			Ok:    true,
+		},
+	})
+	assert(err, nil, "Wanted no error from rest style api")
+	assert(restRsp.HeaderValue, "this is the header field", "expected header value")
+	assert(restRsp.QueryValue, "this is a query string field", "expected query value")
+	assert(restRsp.BodyValue, "this is the body field", "expected body value")
+	assert(restRsp.Nested.Key, "hello + the nested key", "expected nested key")
+	assert(restRsp.Nested.Value, 5+8, "expected nested value")
+	assert(restRsp.Nested.Ok, true, "expected nested ok")
+
+	// Full marshalling test with randomised payloads
+	r := rand.New(rand.NewSource(time.Now().UnixNano()))
+	headerBytes := make([]byte, 1+r.Intn(128))
+	queryBytes := make([]byte, 1+r.Intn(128))
+	bodyBytes := make([]byte, 1+r.Intn(128))
+	r.Read(headerBytes)
+	r.Read(queryBytes)
+	r.Read(bodyBytes)
+	params := client.TestMarshallerTest[int]{
+		HeaderBoolean: r.Float32() > 0.5,
+		HeaderInt:     r.Int(),
+		HeaderFloat:   r.Float64(),
+		HeaderString:  "header string",
+		HeaderBytes:   headerBytes,
+		HeaderTime:    time.Now().Truncate(time.Second),
+		HeaderJson:    json.RawMessage("{\"hello\":\"world\"}"),
+		HeaderUUID:    "2553e3a4-5d9f-4716-82a2-b9bdc20a3263",
+		HeaderUserID:  "432",
+		QueryBoolean:  r.Float32() > 0.5,
+		QueryInt:      r.Int(),
+		QueryFloat:    r.Float64(),
+		QueryString:   "query string",
+		QueryBytes:    headerBytes,
+		QueryTime:     time.Now().Add(time.Duration(rand.Intn(1024)) * time.Hour).Truncate(time.Second),
+		QueryJson:     json.RawMessage("true"),
+		QueryUUID:     "84b7463d-6000-4678-9d94-1d526bb5217c",
+		QueryUserID:   "9udfa",
+		QuerySlice:    []int{r.Int(), r.Int(), r.Int(), r.Int()},
+		BodyBoolean:   r.Float32() > 0.5,
+		BodyInt:       r.Int(),
+		BodyFloat:     r.Float64(),
+		BodyString:    "body string",
+		BodyBytes:     bodyBytes,
+		BodyTime:      time.Now().Add(time.Duration(rand.Intn(1024)) * time.Hour).Truncate(time.Second),
+		BodyJson:      json.RawMessage("null"),
+		BodyUUID:      "c227acf4-1902-4c85-8027-623d47ef4c8a",
+		BodyUserID:    "✉️",
+		BodySlice:     []int{r.Int(), r.Int(), r.Int(), r.Int(), r.Int(), r.Int()},
+	}
+	mResp, err := api.Test.MarshallerTestHandler(ctx, params)
+	assert(err, nil, "Expected no error from the marshaller test")
+
+	// We're marshalling as JSON, so we can just compare the JSON strings
+	respAsJSON, err := json.Marshal(mResp)
+	assert(err, nil, "unable to marshal response to JSON")
+	reqAsJSON, err := json.Marshal(params)
+	assert(err, nil, "unable to marshal response to JSON")
+	assert(string(respAsJSON), string(reqAsJSON), "Expected the same response from the marshaller test")
+
+	// Test auth handlers
+	_, err = api.Test.TestAuthHandler(ctx)
+	assertStructuredError(err, client.ErrUnauthenticated, "missing auth param")
+
+	// Test with static auth data
+	{
+		api, err := client.New(
+			client.BaseURL(fmt.Sprintf("http://%s", os.Args[1])),
+			client.WithAuth(client.EchoAuthParams{
+				Authorization: "Bearer tokendata",
+			}),
+		)
+		assert(err, nil, "Wanted no error from client creation")
+
+		resp, err := api.Test.TestAuthHandler(ctx)
+		assert(err, nil, "Expected no error from second auth")
+		assert(resp.Message, "user::true", "expected the user ID back")
+	}
+
+	// Test with auth data generator function
+	{
+		tokenToReturn := "tokendata"
+		api, err := client.New(
+			client.BaseURL(fmt.Sprintf("http://%s", os.Args[1])),
+			client.WithAuthFunc(func(ctx context.Context) (client.EchoAuthParams, error) {
+				return client.EchoAuthParams{
+					Authorization: "Bearer " + tokenToReturn,
+				}, nil
+			}),
+		)
+		assert(err, nil, "Wanted no error from client creation")
+
+		// With a valid token
+		resp, err := api.Test.TestAuthHandler(ctx)
+		assert(err, nil, "Expected no error from second auth")
+		assert(resp.Message, "user::true", "expected the user ID back")
+
+		// With an invalid token
+		tokenToReturn = "invalid-token-value"
+		_, err = api.Test.TestAuthHandler(ctx)
+		assertStructuredError(err, client.ErrUnauthenticated, "invalid token")
+	}
+
+	// Test with headers and query string auth data
+	{
+		api, err := client.New(
+			client.BaseURL(fmt.Sprintf("http://%s", os.Args[1])),
+			client.WithAuth(client.EchoAuthParams{
+				NewAuth: true,
+				Header:  "102",
+				Query:   []int{42, 100, -50, 10},
+			}),
+		)
+		assert(err, nil, "Wanted no error from client creation")
+
+		resp, err := api.Test.TestAuthHandler(ctx)
+		assert(err, nil, "Expected no error from second auth")
+		assert(resp.Message, "second_user::true", "expected the user ID back")
+	}
+
+	// Test the raw endpoint
+	{
+		api, err := client.New(
+			client.BaseURL(fmt.Sprintf("http://%s", os.Args[1])),
+			client.WithAuth(client.EchoAuthParams{
+				Authorization: "Bearer tokendata",
+			}),
+		)
+		assert(err, nil, "Wanted no error from client creation")
+
+		req, err := http.NewRequest("PUT", "?foo=bar", strings.NewReader("this is a test body"))
+		assert(err, nil, "unable to create request for raw endpoint")
+		req.Header.Add("X-Test-Header", "test")
+
+		rsp, err := api.Test.RawEndpoint(ctx, []string{"hello"}, req)
+		assert(err, nil, "expected no error from the raw socket")
+		defer rsp.Body.Close()
+
+		assert(rsp.StatusCode, http.StatusCreated, "expected the status code to be 201")
+
+		type responseType struct {
+			Body        string
+			Header      string
+			PathParam   string
+			QueryString string
+		}
+		response := &responseType{}
+
+		bytes, err := io.ReadAll(rsp.Body)
+		assert(err, nil, "expected no error from reading the response body")
+
+		err = json.Unmarshal(bytes, response)
+		assert(err, nil, "expected no error when unmarshalling the response body")
+
+		assert(response, &responseType{"this is a test body", "test", "hello", "bar"}, "expected the response to match")
+	}
+
+	{
+		bodyStr := "test body"
+		req, err := http.NewRequest("GET", "?foo=bar", strings.NewReader(bodyStr))
+		assert(err, nil, "expected no error creating request")
+		resp, err := api.Di.Three(ctx, req)
+		assert(err, nil, "expected no error from DI raw endpoint")
+		body, err := io.ReadAll(resp.Body)
+		resp.Body.Close()
+		assert(string(body), bodyStr, "expected response body to echo incoming request body")
+
+	}
+
+	// Test path encoding
+	resp, err := api.Test.PathMultiSegments(ctx, true, 342, "foo/blah/should/get/escaped", "503f4487-1e15-4c37-9a80-7b70f86387bb", []string{"foo/bar", "blah", "seperate/segments = great success"})
+	assert(err, nil, "expected no error from the path multi segments endpoint")
+	assert(resp.Boolean, true, "expected the boolean to be true")
+	assert(resp.Int, 342, "expected the int to be 342")
+	assert(resp.String, "foo/blah/should/get/escaped", "invalid string field returned")
+	assert(resp.UUID, "503f4487-1e15-4c37-9a80-7b70f86387bb", "invalid UUID returned")
+	assert(resp.Wildcard, "foo/bar/blah/seperate/segments = great success", "invalid wildcard field returned")
+
+	// Test validation
+	err = api.Validation.TestOne(ctx, client.ValidationRequest{Msg: "pass"})
+	assert(err, nil, "expected no error from validation")
+	err = api.Validation.TestOne(ctx, client.ValidationRequest{Msg: "fail"})
+	assertStructuredError(err, client.ErrInvalidArgument, "validation failed: bad message")
+	{
+		api, err := client.New(
+			client.BaseURL(fmt.Sprintf("http://%s", os.Args[1])),
+			client.WithAuth(client.EchoAuthParams{
+				Header: "fail-validation",
+			}),
+		)
+		assert(err, nil, "expected no error from client init")
+		err = api.Test.Noop(ctx)
+		assertStructuredError(err, client.ErrInvalidArgument, "validation failed: auth validation fail")
+	}
+
+	// Test middleware
+	{
+		err = api.Middleware.Error(ctx)
+		assertStructuredError(err, client.ErrInternal, "middleware error")
+		resp, err := api.Middleware.ResponseRewrite(ctx, client.MiddlewarePayload{Msg: "foo"})
+		assert(err, nil, "expected no error")
+		assert(resp.Msg, "middleware(req=foo, resp=handler(foo))", "unexpected response")
+
+		resp, err = api.Middleware.ResponseGen(ctx, client.MiddlewarePayload{Msg: "foo"})
+		assert(resp.Msg, "middleware generated", "unexpected response")
+	}
+
+	// Client test completed
+	os.Exit(0)
+}
+
+func assert(got, want any, message string) {
+	assertNumber++
+
+	if !reflect.DeepEqual(got, want) {
+		fmt.Printf("Assertion Failure %d: %s\n\n%+v != %+v\n", assertNumber, message, got, want)
+		os.Exit(assertNumber)
+	}
+}
+
+func assertNotNil(got any, message string) {
+	assertNumber++
+	if got == nil {
+		fmt.Printf("Assertion Failure %d: got nil: %s", assertNumber, message)
+		os.Exit(assertNumber)
+	}
+}
+
+func assertStructuredError(err error, code client.ErrCode, message string) {
+	assertNotNil(err, "want an error")
+
+	assertNumber++
+	if apiError, ok := err.(*client.APIError); !ok {
+		fmt.Printf("Assertion Failure %d: expected *client.APIError; got %+v\n", assertNumber, reflect.TypeOf(err))
+		os.Exit(assertNumber)
+	} else {
+		assert(apiError.Code, code, "unexpected error code")
+		assert(apiError.Message, message, "expected error message")
+	}
+}
diff --git a/e2e-tests/testdata/echo_client/package-lock.json b/e2e-tests/testdata/echo_client/package-lock.json
new file mode 100644
index 0000000000..f639eda8de
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/package-lock.json
@@ -0,0 +1,2884 @@
+{
+  "name": "echo_client",
+  "version": "1.0.0",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "dependencies": {
+        "isomorphic-fetch": "^3.0.0"
+      },
+      "devDependencies": {
+        "@types/node": "^17.0.35",
+        "@typescript-eslint/eslint-plugin": "^5.26.0",
+        "@typescript-eslint/parser": "^5.26.0",
+        "eslint": "^8.16.0",
+        "ts-node": "^10.8.0",
+        "typescript": "^4.6.4"
+      }
+    },
+    "node_modules/@cspotcode/source-map-support": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@cspotcode/source-map-support/-/source-map-support-0.8.1.tgz",
+      "integrity": "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/trace-mapping": "0.3.9"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/@eslint/eslintrc": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-1.3.0.tgz",
+      "integrity": "sha512-UWW0TMTmk2d7hLcWD1/e2g5HDM/HQ3csaLSqXCfqwh4uNDuNqlaKWXmEsL4Cs41Z0KnILNvwbHAah3C2yt06kw==",
+      "dev": true,
+      "dependencies": {
+        "ajv": "^6.12.4",
+        "debug": "^4.3.2",
+        "espree": "^9.3.2",
+        "globals": "^13.15.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.2.1",
+        "js-yaml": "^4.1.0",
+        "minimatch": "^3.1.2",
+        "strip-json-comments": "^3.1.1"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/@humanwhocodes/config-array": {
+      "version": "0.9.5",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.9.5.tgz",
+      "integrity": "sha512-ObyMyWxZiCu/yTisA7uzx81s40xR2fD5Cg/2Kq7G02ajkNubJf6BopgDTmDyc3U7sXpNKM8cYOw7s7Tyr+DnCw==",
+      "dev": true,
+      "dependencies": {
+        "@humanwhocodes/object-schema": "^1.2.1",
+        "debug": "^4.1.1",
+        "minimatch": "^3.0.4"
+      },
+      "engines": {
+        "node": ">=10.10.0"
+      }
+    },
+    "node_modules/@humanwhocodes/object-schema": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-1.2.1.tgz",
+      "integrity": "sha512-ZnQMnLV4e7hDlUvw8H+U8ASL02SS2Gn6+9Ac3wGGLIe7+je2AeAOxPY+izIPJDfFDb7eDjev0Us8MO1iFRN8hA==",
+      "dev": true
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.0.7.tgz",
+      "integrity": "sha512-8cXDaBBHOr2pQ7j77Y6Vp5VDT2sIqWyWQ56TjEq4ih/a4iST3dItRe8Q9fp0rrIl9DoKhWQtUQz/YpOxLkXbNA==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.4.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.13.tgz",
+      "integrity": "sha512-GryiOJmNcWbovBxTfZSF71V/mXbgcV3MewDe3kIMCLyIh5e7SKAeUZs+rMnJ8jkMolZ/4/VsdBmMrw3l+VdZ3w==",
+      "dev": true
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.9",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.9.tgz",
+      "integrity": "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/resolve-uri": "^3.0.3",
+        "@jridgewell/sourcemap-codec": "^1.4.10"
+      }
+    },
+    "node_modules/@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "dev": true,
+      "dependencies": {
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+      "dev": true,
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+      "dev": true,
+      "dependencies": {
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@tsconfig/node10": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@tsconfig/node10/-/node10-1.0.8.tgz",
+      "integrity": "sha512-6XFfSQmMgq0CFLY1MslA/CPUfhIL919M1rMsa5lP2P097N2Wd1sSX0tx1u4olM16fLNhtHZpRhedZJphNJqmZg==",
+      "dev": true
+    },
+    "node_modules/@tsconfig/node12": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@tsconfig/node12/-/node12-1.0.9.tgz",
+      "integrity": "sha512-/yBMcem+fbvhSREH+s14YJi18sp7J9jpuhYByADT2rypfajMZZN4WQ6zBGgBKp53NKmqI36wFYDb3yaMPurITw==",
+      "dev": true
+    },
+    "node_modules/@tsconfig/node14": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@tsconfig/node14/-/node14-1.0.1.tgz",
+      "integrity": "sha512-509r2+yARFfHHE7T6Puu2jjkoycftovhXRqW328PDXTVGKihlb1P8Z9mMZH04ebyajfRY7dedfGynlrFHJUQCg==",
+      "dev": true
+    },
+    "node_modules/@tsconfig/node16": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@tsconfig/node16/-/node16-1.0.2.tgz",
+      "integrity": "sha512-eZxlbI8GZscaGS7kkc/trHTT5xgrjH3/1n2JDwusC9iahPKWMRvRjJSAN5mCXviuTGQ/lHnhvv8Q1YTpnfz9gA==",
+      "dev": true
+    },
+    "node_modules/@types/json-schema": {
+      "version": "7.0.11",
+      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.11.tgz",
+      "integrity": "sha512-wOuvG1SN4Us4rez+tylwwwCV1psiNVOkJeM3AUWUNWg/jDQY2+HE/444y5gc+jBmRqASOm2Oeh5c1axHobwRKQ==",
+      "dev": true
+    },
+    "node_modules/@types/node": {
+      "version": "17.0.35",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-17.0.35.tgz",
+      "integrity": "sha512-vu1SrqBjbbZ3J6vwY17jBs8Sr/BKA+/a/WtjRG+whKg1iuLFOosq872EXS0eXWILdO36DHQQeku/ZcL6hz2fpg==",
+      "dev": true
+    },
+    "node_modules/@typescript-eslint/eslint-plugin": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-5.26.0.tgz",
+      "integrity": "sha512-oGCmo0PqnRZZndr+KwvvAUvD3kNE4AfyoGCwOZpoCncSh4MVD06JTE8XQa2u9u+NX5CsyZMBTEc2C72zx38eYA==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/scope-manager": "5.26.0",
+        "@typescript-eslint/type-utils": "5.26.0",
+        "@typescript-eslint/utils": "5.26.0",
+        "debug": "^4.3.4",
+        "functional-red-black-tree": "^1.0.1",
+        "ignore": "^5.2.0",
+        "regexpp": "^3.2.0",
+        "semver": "^7.3.7",
+        "tsutils": "^3.21.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "@typescript-eslint/parser": "^5.0.0",
+        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/parser": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-5.26.0.tgz",
+      "integrity": "sha512-n/IzU87ttzIdnAH5vQ4BBDnLPly7rC5VnjN3m0xBG82HK6rhRxnCb3w/GyWbNDghPd+NktJqB/wl6+YkzZ5T5Q==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/scope-manager": "5.26.0",
+        "@typescript-eslint/types": "5.26.0",
+        "@typescript-eslint/typescript-estree": "5.26.0",
+        "debug": "^4.3.4"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/scope-manager": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-5.26.0.tgz",
+      "integrity": "sha512-gVzTJUESuTwiju/7NiTb4c5oqod8xt5GhMbExKsCTp6adU3mya6AGJ4Pl9xC7x2DX9UYFsjImC0mA62BCY22Iw==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "5.26.0",
+        "@typescript-eslint/visitor-keys": "5.26.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/type-utils": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-5.26.0.tgz",
+      "integrity": "sha512-7ccbUVWGLmcRDSA1+ADkDBl5fP87EJt0fnijsMFTVHXKGduYMgienC/i3QwoVhDADUAPoytgjbZbCOMj4TY55A==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/utils": "5.26.0",
+        "debug": "^4.3.4",
+        "tsutils": "^3.21.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "*"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/types": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-5.26.0.tgz",
+      "integrity": "sha512-8794JZFE1RN4XaExLWLI2oSXsVImNkl79PzTOOWt9h0UHROwJedNOD2IJyfL0NbddFllcktGIO2aOu10avQQyA==",
+      "dev": true,
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/@typescript-eslint/typescript-estree": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-5.26.0.tgz",
+      "integrity": "sha512-EyGpw6eQDsfD6jIqmXP3rU5oHScZ51tL/cZgFbFBvWuCwrIptl+oueUZzSmLtxFuSOQ9vDcJIs+279gnJkfd1w==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "5.26.0",
+        "@typescript-eslint/visitor-keys": "5.26.0",
+        "debug": "^4.3.4",
+        "globby": "^11.1.0",
+        "is-glob": "^4.0.3",
+        "semver": "^7.3.7",
+        "tsutils": "^3.21.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependenciesMeta": {
+        "typescript": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@typescript-eslint/utils": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-5.26.0.tgz",
+      "integrity": "sha512-PJFwcTq2Pt4AMOKfe3zQOdez6InIDOjUJJD3v3LyEtxHGVVRK3Vo7Dd923t/4M9hSH2q2CLvcTdxlLPjcIk3eg==",
+      "dev": true,
+      "dependencies": {
+        "@types/json-schema": "^7.0.9",
+        "@typescript-eslint/scope-manager": "5.26.0",
+        "@typescript-eslint/types": "5.26.0",
+        "@typescript-eslint/typescript-estree": "5.26.0",
+        "eslint-scope": "^5.1.1",
+        "eslint-utils": "^3.0.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      },
+      "peerDependencies": {
+        "eslint": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/@typescript-eslint/visitor-keys": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-5.26.0.tgz",
+      "integrity": "sha512-wei+ffqHanYDOQgg/fS6Hcar6wAWv0CUPQ3TZzOWd2BLfgP539rb49bwua8WRAs7R6kOSLn82rfEu2ro6Llt8Q==",
+      "dev": true,
+      "dependencies": {
+        "@typescript-eslint/types": "5.26.0",
+        "eslint-visitor-keys": "^3.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/typescript-eslint"
+      }
+    },
+    "node_modules/acorn": {
+      "version": "8.7.1",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.7.1.tgz",
+      "integrity": "sha512-Xx54uLJQZ19lKygFXOWsscKUbsBZW0CPykPhVQdhIeIwrbPmJzqeASDInc8nKBnp/JT6igTs82qPXz069H8I/A==",
+      "dev": true,
+      "bin": {
+        "acorn": "bin/acorn"
+      },
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/acorn-jsx": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+      "dev": true,
+      "peerDependencies": {
+        "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
+      }
+    },
+    "node_modules/acorn-walk": {
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.2.0.tgz",
+      "integrity": "sha512-k+iyHEuPgSw6SbuDpGQM+06HQUa04DZ3o+F6CSzXMvvI5KMvnaEqXe+YVe555R9nn6GPt404fos4wcgpw12SDA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
+    "node_modules/ajv": {
+      "version": "6.12.6",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
+      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "dev": true,
+      "dependencies": {
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/epoberezkin"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/arg": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/arg/-/arg-4.1.3.tgz",
+      "integrity": "sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==",
+      "dev": true
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true
+    },
+    "node_modules/array-union": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz",
+      "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dev": true,
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/braces": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
+      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
+      "dev": true,
+      "dependencies": {
+        "fill-range": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/callsites": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
+      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=",
+      "dev": true
+    },
+    "node_modules/create-require": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/create-require/-/create-require-1.1.1.tgz",
+      "integrity": "sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==",
+      "dev": true
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.3.4",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
+      "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+      "dev": true,
+      "dependencies": {
+        "ms": "2.1.2"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/deep-is": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+      "dev": true
+    },
+    "node_modules/diff": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.2.tgz",
+      "integrity": "sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.3.1"
+      }
+    },
+    "node_modules/dir-glob": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz",
+      "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==",
+      "dev": true,
+      "dependencies": {
+        "path-type": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/doctrine": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
+      "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==",
+      "dev": true,
+      "dependencies": {
+        "esutils": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/eslint": {
+      "version": "8.16.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.16.0.tgz",
+      "integrity": "sha512-MBndsoXY/PeVTDJeWsYj7kLZ5hQpJOfMYLsF6LicLHQWbRDG19lK5jOix4DPl8yY4SUFcE3txy86OzFLWT+yoA==",
+      "dev": true,
+      "dependencies": {
+        "@eslint/eslintrc": "^1.3.0",
+        "@humanwhocodes/config-array": "^0.9.2",
+        "ajv": "^6.10.0",
+        "chalk": "^4.0.0",
+        "cross-spawn": "^7.0.2",
+        "debug": "^4.3.2",
+        "doctrine": "^3.0.0",
+        "escape-string-regexp": "^4.0.0",
+        "eslint-scope": "^7.1.1",
+        "eslint-utils": "^3.0.0",
+        "eslint-visitor-keys": "^3.3.0",
+        "espree": "^9.3.2",
+        "esquery": "^1.4.0",
+        "esutils": "^2.0.2",
+        "fast-deep-equal": "^3.1.3",
+        "file-entry-cache": "^6.0.1",
+        "functional-red-black-tree": "^1.0.1",
+        "glob-parent": "^6.0.1",
+        "globals": "^13.15.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.0.0",
+        "imurmurhash": "^0.1.4",
+        "is-glob": "^4.0.0",
+        "js-yaml": "^4.1.0",
+        "json-stable-stringify-without-jsonify": "^1.0.1",
+        "levn": "^0.4.1",
+        "lodash.merge": "^4.6.2",
+        "minimatch": "^3.1.2",
+        "natural-compare": "^1.4.0",
+        "optionator": "^0.9.1",
+        "regexpp": "^3.2.0",
+        "strip-ansi": "^6.0.1",
+        "strip-json-comments": "^3.1.0",
+        "text-table": "^0.2.0",
+        "v8-compile-cache": "^2.0.3"
+      },
+      "bin": {
+        "eslint": "bin/eslint.js"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/eslint"
+      }
+    },
+    "node_modules/eslint-scope": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
+      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
+      "dev": true,
+      "dependencies": {
+        "esrecurse": "^4.3.0",
+        "estraverse": "^4.1.1"
+      },
+      "engines": {
+        "node": ">=8.0.0"
+      }
+    },
+    "node_modules/eslint-utils": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-3.0.0.tgz",
+      "integrity": "sha512-uuQC43IGctw68pJA1RgbQS8/NP7rch6Cwd4j3ZBtgo4/8Flj4eGE7ZYSZRN3iq5pVUv6GPdW5Z1RFleo84uLDA==",
+      "dev": true,
+      "dependencies": {
+        "eslint-visitor-keys": "^2.0.0"
+      },
+      "engines": {
+        "node": "^10.0.0 || ^12.0.0 || >= 14.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/mysticatea"
+      },
+      "peerDependencies": {
+        "eslint": ">=5"
+      }
+    },
+    "node_modules/eslint-utils/node_modules/eslint-visitor-keys": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
+      "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/eslint-visitor-keys": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.3.0.tgz",
+      "integrity": "sha512-mQ+suqKJVyeuwGYHAdjMFqjCyfl8+Ldnxuyp3ldiMBFKkvytrXUZWaiPCEav8qDHKty44bD+qV1IP4T+w+xXRA==",
+      "dev": true,
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/eslint/node_modules/eslint-scope": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.1.1.tgz",
+      "integrity": "sha512-QKQM/UXpIiHcLqJ5AOyIW7XZmzjkzQXYE54n1++wb0u9V/abW3l9uQnxX8Z5Xd18xyKIMTUAyQ0k1e8pz6LUrw==",
+      "dev": true,
+      "dependencies": {
+        "esrecurse": "^4.3.0",
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/eslint/node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/espree": {
+      "version": "9.3.2",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-9.3.2.tgz",
+      "integrity": "sha512-D211tC7ZwouTIuY5x9XnS0E9sWNChB7IYKX/Xp5eQj3nFXhqmiUDB9q27y76oFl8jTg3pXcQx/bpxMfs3CIZbA==",
+      "dev": true,
+      "dependencies": {
+        "acorn": "^8.7.1",
+        "acorn-jsx": "^5.3.2",
+        "eslint-visitor-keys": "^3.3.0"
+      },
+      "engines": {
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+      }
+    },
+    "node_modules/esquery": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.4.0.tgz",
+      "integrity": "sha512-cCDispWt5vHHtwMY2YrAQ4ibFkAL8RbH5YGBnZBc90MolvvfkkQcJro/aZiAQUlQ3qgrYS6D6v8Gc5G5CQsc9w==",
+      "dev": true,
+      "dependencies": {
+        "estraverse": "^5.1.0"
+      },
+      "engines": {
+        "node": ">=0.10"
+      }
+    },
+    "node_modules/esquery/node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/esrecurse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "dev": true,
+      "dependencies": {
+        "estraverse": "^5.2.0"
+      },
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/esrecurse/node_modules/estraverse": {
+      "version": "5.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+      "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/estraverse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
+      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.0"
+      }
+    },
+    "node_modules/esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true
+    },
+    "node_modules/fast-glob": {
+      "version": "3.2.11",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.2.11.tgz",
+      "integrity": "sha512-xrO3+1bxSo3ZVHAnqzyuewYT6aMFHRAd4Kcs92MAonjwQZLsK9d0SF1IyQ3k5PoirxTW0Oe/RqFgMQ6TcNE5Ew==",
+      "dev": true,
+      "dependencies": {
+        "@nodelib/fs.stat": "^2.0.2",
+        "@nodelib/fs.walk": "^1.2.3",
+        "glob-parent": "^5.1.2",
+        "merge2": "^1.3.0",
+        "micromatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=8.6.0"
+      }
+    },
+    "node_modules/fast-glob/node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/fast-json-stable-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+      "dev": true
+    },
+    "node_modules/fast-levenshtein": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
+      "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
+      "dev": true
+    },
+    "node_modules/fastq": {
+      "version": "1.13.0",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.13.0.tgz",
+      "integrity": "sha512-YpkpUnK8od0o1hmeSc7UUs/eB/vIPWJYjKck2QKIzAf71Vm1AAQ3EbuZB3g2JIy+pg+ERD0vqI79KyZiB2e2Nw==",
+      "dev": true,
+      "dependencies": {
+        "reusify": "^1.0.4"
+      }
+    },
+    "node_modules/file-entry-cache": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
+      "integrity": "sha512-7Gps/XWymbLk2QLYK4NzpMOrYjMhdIxXuIvy2QBsLE6ljuodKvdkWs/cpyJJ3CVIVpH0Oi1Hvg1ovbMzLdFBBg==",
+      "dev": true,
+      "dependencies": {
+        "flat-cache": "^3.0.4"
+      },
+      "engines": {
+        "node": "^10.12.0 || >=12.0.0"
+      }
+    },
+    "node_modules/fill-range": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
+      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
+      "dev": true,
+      "dependencies": {
+        "to-regex-range": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/flat-cache": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-3.0.4.tgz",
+      "integrity": "sha512-dm9s5Pw7Jc0GvMYbshN6zchCA9RgQlzzEZX3vylR9IqFfS8XciblUXOKfW6SiuJ0e13eDYZoZV5wdrev7P3Nwg==",
+      "dev": true,
+      "dependencies": {
+        "flatted": "^3.1.0",
+        "rimraf": "^3.0.2"
+      },
+      "engines": {
+        "node": "^10.12.0 || >=12.0.0"
+      }
+    },
+    "node_modules/flatted": {
+      "version": "3.2.5",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.5.tgz",
+      "integrity": "sha512-WIWGi2L3DyTUvUrwRKgGi9TwxQMUEqPOPQBVi71R96jZXJdFskXEmf54BoZaS1kknGODoIGASGEzBUYdyMCBJg==",
+      "dev": true
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8=",
+      "dev": true
+    },
+    "node_modules/functional-red-black-tree": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/functional-red-black-tree/-/functional-red-black-tree-1.0.1.tgz",
+      "integrity": "sha1-GwqzvVU7Kg1jmdKcDj6gslIHgyc=",
+      "dev": true
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "dev": true,
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/glob-parent": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
+      "dev": true,
+      "dependencies": {
+        "is-glob": "^4.0.3"
+      },
+      "engines": {
+        "node": ">=10.13.0"
+      }
+    },
+    "node_modules/globals": {
+      "version": "13.15.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-13.15.0.tgz",
+      "integrity": "sha512-bpzcOlgDhMG070Av0Vy5Owklpv1I6+j96GhUI7Rh7IzDCKLzboflLrrfqMu8NquDbiR4EOQk7XzJwqVJxicxog==",
+      "dev": true,
+      "dependencies": {
+        "type-fest": "^0.20.2"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/globby": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/globby/-/globby-11.1.0.tgz",
+      "integrity": "sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==",
+      "dev": true,
+      "dependencies": {
+        "array-union": "^2.1.0",
+        "dir-glob": "^3.0.1",
+        "fast-glob": "^3.2.9",
+        "ignore": "^5.2.0",
+        "merge2": "^1.4.1",
+        "slash": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ignore": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.2.0.tgz",
+      "integrity": "sha512-CmxgYGiEPCLhfLnpPp1MoRmifwEIOgjcHXxOBjv7mY96c+eWScsOP9c112ZyLdWHi0FxHjI+4uVhKYp/gcdRmQ==",
+      "dev": true,
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/import-fresh": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.0.tgz",
+      "integrity": "sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==",
+      "dev": true,
+      "dependencies": {
+        "parent-module": "^1.0.0",
+        "resolve-from": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha1-khi5srkoojixPcT7a21XbyMUU+o=",
+      "dev": true,
+      "engines": {
+        "node": ">=0.8.19"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
+      "dev": true,
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "dev": true
+    },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA=",
+      "dev": true
+    },
+    "node_modules/isomorphic-fetch": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/isomorphic-fetch/-/isomorphic-fetch-3.0.0.tgz",
+      "integrity": "sha512-qvUtwJ3j6qwsF3jLxkZ72qCgjMysPzDfeV240JHiGZsANBYd+EEuu35v7dfrJ9Up0Ak07D7GGSkGhCHTqg/5wA==",
+      "dependencies": {
+        "node-fetch": "^2.6.1",
+        "whatwg-fetch": "^3.4.1"
+      }
+    },
+    "node_modules/js-yaml": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "dev": true,
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true
+    },
+    "node_modules/json-stable-stringify-without-jsonify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
+      "integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
+      "dev": true
+    },
+    "node_modules/levn": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
+      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
+      "dev": true,
+      "dependencies": {
+        "prelude-ls": "^1.2.1",
+        "type-check": "~0.4.0"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/lodash.merge": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
+      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
+      "dev": true
+    },
+    "node_modules/lru-cache": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
+      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
+      "dev": true,
+      "dependencies": {
+        "yallist": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/make-error": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
+      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==",
+      "dev": true
+    },
+    "node_modules/merge2": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/micromatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz",
+      "integrity": "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==",
+      "dev": true,
+      "dependencies": {
+        "braces": "^3.0.2",
+        "picomatch": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=8.6"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dev": true,
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+      "dev": true
+    },
+    "node_modules/natural-compare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
+      "integrity": "sha1-Sr6/7tdUHywnrPspvbvRXI1bpPc=",
+      "dev": true
+    },
+    "node_modules/node-fetch": {
+      "version": "2.6.7",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz",
+      "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==",
+      "dependencies": {
+        "whatwg-url": "^5.0.0"
+      },
+      "engines": {
+        "node": "4.x || >=6.0.0"
+      },
+      "peerDependencies": {
+        "encoding": "^0.1.0"
+      },
+      "peerDependenciesMeta": {
+        "encoding": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
+      "dev": true,
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/optionator": {
+      "version": "0.9.1",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.1.tgz",
+      "integrity": "sha512-74RlY5FCnhq4jRxVUPKDaRwrVNXMqsGsiW6AJw4XK8hmtm10wC0ypZBLw5IIp85NZMr91+qd1RvvENwg7jjRFw==",
+      "dev": true,
+      "dependencies": {
+        "deep-is": "^0.1.3",
+        "fast-levenshtein": "^2.0.6",
+        "levn": "^0.4.1",
+        "prelude-ls": "^1.2.1",
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.3"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/parent-module": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
+      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
+      "dev": true,
+      "dependencies": {
+        "callsites": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18=",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-type": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
+      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/picomatch": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "dev": true,
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/prelude-ls": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
+      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/punycode": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz",
+      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/regexpp": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/regexpp/-/regexpp-3.2.0.tgz",
+      "integrity": "sha512-pq2bWo9mVD43nbts2wGv17XLiNLya+GklZ8kaDLV2Z08gDCsGpnKn9BFMepvWuHCbyVvY7J5o5+BVvoQbmlJLg==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/mysticatea"
+      }
+    },
+    "node_modules/resolve-from": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
+      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/reusify": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz",
+      "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==",
+      "dev": true,
+      "engines": {
+        "iojs": ">=1.0.0",
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/rimraf": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
+      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
+      "dev": true,
+      "dependencies": {
+        "glob": "^7.1.3"
+      },
+      "bin": {
+        "rimraf": "bin.js"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "dependencies": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
+    "node_modules/semver": {
+      "version": "7.3.7",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.7.tgz",
+      "integrity": "sha512-QlYTucUYOews+WeEujDoEGziz4K6c47V/Bd+LjSSYcA94p+DmINdf7ncaUinThfvZyu13lN9OY1XDxt8C0Tw0g==",
+      "dev": true,
+      "dependencies": {
+        "lru-cache": "^6.0.0"
+      },
+      "bin": {
+        "semver": "bin/semver.js"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/slash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
+      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/text-table": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
+      "integrity": "sha1-f17oI66AUgfACvLfSoTsP8+lcLQ=",
+      "dev": true
+    },
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
+    "node_modules/tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha1-gYT9NH2snNwYWZLzpmIuFLnZq2o="
+    },
+    "node_modules/ts-node": {
+      "version": "10.8.0",
+      "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-10.8.0.tgz",
+      "integrity": "sha512-/fNd5Qh+zTt8Vt1KbYZjRHCE9sI5i7nqfD/dzBBRDeVXZXS6kToW6R7tTU6Nd4XavFs0mAVCg29Q//ML7WsZYA==",
+      "dev": true,
+      "dependencies": {
+        "@cspotcode/source-map-support": "^0.8.0",
+        "@tsconfig/node10": "^1.0.7",
+        "@tsconfig/node12": "^1.0.7",
+        "@tsconfig/node14": "^1.0.0",
+        "@tsconfig/node16": "^1.0.2",
+        "acorn": "^8.4.1",
+        "acorn-walk": "^8.1.1",
+        "arg": "^4.1.0",
+        "create-require": "^1.1.0",
+        "diff": "^4.0.1",
+        "make-error": "^1.1.1",
+        "v8-compile-cache-lib": "^3.0.1",
+        "yn": "3.1.1"
+      },
+      "bin": {
+        "ts-node": "dist/bin.js",
+        "ts-node-cwd": "dist/bin-cwd.js",
+        "ts-node-esm": "dist/bin-esm.js",
+        "ts-node-script": "dist/bin-script.js",
+        "ts-node-transpile-only": "dist/bin-transpile.js",
+        "ts-script": "dist/bin-script-deprecated.js"
+      },
+      "peerDependencies": {
+        "@swc/core": ">=1.2.50",
+        "@swc/wasm": ">=1.2.50",
+        "@types/node": "*",
+        "typescript": ">=2.7"
+      },
+      "peerDependenciesMeta": {
+        "@swc/core": {
+          "optional": true
+        },
+        "@swc/wasm": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/tslib": {
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+      "dev": true
+    },
+    "node_modules/tsutils": {
+      "version": "3.21.0",
+      "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-3.21.0.tgz",
+      "integrity": "sha512-mHKK3iUXL+3UF6xL5k0PEhKRUBKPBCv/+RkEOpjRWxxx27KKRBmmA60A9pgOUvMi8GKhRMPEmjBRPzs2W7O1OA==",
+      "dev": true,
+      "dependencies": {
+        "tslib": "^1.8.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      },
+      "peerDependencies": {
+        "typescript": ">=2.8.0 || >= 3.2.0-dev || >= 3.3.0-dev || >= 3.4.0-dev || >= 3.5.0-dev || >= 3.6.0-dev || >= 3.6.0-beta || >= 3.7.0-dev || >= 3.7.0-beta"
+      }
+    },
+    "node_modules/type-check": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
+      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
+      "dev": true,
+      "dependencies": {
+        "prelude-ls": "^1.2.1"
+      },
+      "engines": {
+        "node": ">= 0.8.0"
+      }
+    },
+    "node_modules/type-fest": {
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "4.6.4",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.6.4.tgz",
+      "integrity": "sha512-9ia/jWHIEbo49HfjrLGfKbZSuWo9iTMwXO+Ca3pRsSpbsMbc7/IU8NKdCZVRRBafVPGnoJeFL76ZOAA84I9fEg==",
+      "dev": true,
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=4.2.0"
+      }
+    },
+    "node_modules/uri-js": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+      "dev": true,
+      "dependencies": {
+        "punycode": "^2.1.0"
+      }
+    },
+    "node_modules/v8-compile-cache": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/v8-compile-cache/-/v8-compile-cache-2.3.0.tgz",
+      "integrity": "sha512-l8lCEmLcLYZh4nbunNZvQCJc5pv7+RCwa8q/LdUx8u7lsWvPDKmpodJAJNwkAhJC//dFY48KuIEmjtd4RViDrA==",
+      "dev": true
+    },
+    "node_modules/v8-compile-cache-lib": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/v8-compile-cache-lib/-/v8-compile-cache-lib-3.0.1.tgz",
+      "integrity": "sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==",
+      "dev": true
+    },
+    "node_modules/webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha1-JFNCdeKnvGvnvIZhHMFq4KVlSHE="
+    },
+    "node_modules/whatwg-fetch": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/whatwg-fetch/-/whatwg-fetch-3.6.2.tgz",
+      "integrity": "sha512-bJlen0FcuU/0EMLrdbJ7zOnW6ITZLrZMIarMUVmdKtsGvZna8vxKYaexICWPfZ8qwf9fzNq+UEIZrnSaApt6RA=="
+    },
+    "node_modules/whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha1-lmRU6HZUYuN2RNNib2dCzotwll0=",
+      "dependencies": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/word-wrap": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz",
+      "integrity": "sha512-Hz/mrNwitNRh/HUAtM/VT/5VH+ygD6DV7mYKZAtHOrbs8U7lvPS6xf7EJKMF0uW1KJCl0H701g3ZGus+muE5vQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
+      "dev": true
+    },
+    "node_modules/yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "dev": true
+    },
+    "node_modules/yn": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yn/-/yn-3.1.1.tgz",
+      "integrity": "sha512-Ux4ygGWsu2c7isFWe8Yu1YluJmqVhxqK2cLXNQA5AcC3QfbGNpM7fu0Y8b/z16pXLnFxZYvWhd3fhBY9DLmC6Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    }
+  },
+  "dependencies": {
+    "@cspotcode/source-map-support": {
+      "version": "0.8.1",
+      "resolved": "https://registry.npmjs.org/@cspotcode/source-map-support/-/source-map-support-0.8.1.tgz",
+      "integrity": "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==",
+      "dev": true,
+      "requires": {
+        "@jridgewell/trace-mapping": "0.3.9"
+      }
+    },
+    "@eslint/eslintrc": {
+      "version": "1.3.0",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-1.3.0.tgz",
+      "integrity": "sha512-UWW0TMTmk2d7hLcWD1/e2g5HDM/HQ3csaLSqXCfqwh4uNDuNqlaKWXmEsL4Cs41Z0KnILNvwbHAah3C2yt06kw==",
+      "dev": true,
+      "requires": {
+        "ajv": "^6.12.4",
+        "debug": "^4.3.2",
+        "espree": "^9.3.2",
+        "globals": "^13.15.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.2.1",
+        "js-yaml": "^4.1.0",
+        "minimatch": "^3.1.2",
+        "strip-json-comments": "^3.1.1"
+      }
+    },
+    "@humanwhocodes/config-array": {
+      "version": "0.9.5",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.9.5.tgz",
+      "integrity": "sha512-ObyMyWxZiCu/yTisA7uzx81s40xR2fD5Cg/2Kq7G02ajkNubJf6BopgDTmDyc3U7sXpNKM8cYOw7s7Tyr+DnCw==",
+      "dev": true,
+      "requires": {
+        "@humanwhocodes/object-schema": "^1.2.1",
+        "debug": "^4.1.1",
+        "minimatch": "^3.0.4"
+      }
+    },
+    "@humanwhocodes/object-schema": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-1.2.1.tgz",
+      "integrity": "sha512-ZnQMnLV4e7hDlUvw8H+U8ASL02SS2Gn6+9Ac3wGGLIe7+je2AeAOxPY+izIPJDfFDb7eDjev0Us8MO1iFRN8hA==",
+      "dev": true
+    },
+    "@jridgewell/resolve-uri": {
+      "version": "3.0.7",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.0.7.tgz",
+      "integrity": "sha512-8cXDaBBHOr2pQ7j77Y6Vp5VDT2sIqWyWQ56TjEq4ih/a4iST3dItRe8Q9fp0rrIl9DoKhWQtUQz/YpOxLkXbNA==",
+      "dev": true
+    },
+    "@jridgewell/sourcemap-codec": {
+      "version": "1.4.13",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.13.tgz",
+      "integrity": "sha512-GryiOJmNcWbovBxTfZSF71V/mXbgcV3MewDe3kIMCLyIh5e7SKAeUZs+rMnJ8jkMolZ/4/VsdBmMrw3l+VdZ3w==",
+      "dev": true
+    },
+    "@jridgewell/trace-mapping": {
+      "version": "0.3.9",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.9.tgz",
+      "integrity": "sha512-3Belt6tdc8bPgAtbcmdtNJlirVoTmEb5e2gC94PnkwEW9jI6CAHUeoG85tjWP5WquqfavoMtMwiG4P926ZKKuQ==",
+      "dev": true,
+      "requires": {
+        "@jridgewell/resolve-uri": "^3.0.3",
+        "@jridgewell/sourcemap-codec": "^1.4.10"
+      }
+    },
+    "@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "dev": true,
+      "requires": {
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
+      }
+    },
+    "@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+      "dev": true
+    },
+    "@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+      "dev": true,
+      "requires": {
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
+      }
+    },
+    "@tsconfig/node10": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@tsconfig/node10/-/node10-1.0.8.tgz",
+      "integrity": "sha512-6XFfSQmMgq0CFLY1MslA/CPUfhIL919M1rMsa5lP2P097N2Wd1sSX0tx1u4olM16fLNhtHZpRhedZJphNJqmZg==",
+      "dev": true
+    },
+    "@tsconfig/node12": {
+      "version": "1.0.9",
+      "resolved": "https://registry.npmjs.org/@tsconfig/node12/-/node12-1.0.9.tgz",
+      "integrity": "sha512-/yBMcem+fbvhSREH+s14YJi18sp7J9jpuhYByADT2rypfajMZZN4WQ6zBGgBKp53NKmqI36wFYDb3yaMPurITw==",
+      "dev": true
+    },
+    "@tsconfig/node14": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/@tsconfig/node14/-/node14-1.0.1.tgz",
+      "integrity": "sha512-509r2+yARFfHHE7T6Puu2jjkoycftovhXRqW328PDXTVGKihlb1P8Z9mMZH04ebyajfRY7dedfGynlrFHJUQCg==",
+      "dev": true
+    },
+    "@tsconfig/node16": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/@tsconfig/node16/-/node16-1.0.2.tgz",
+      "integrity": "sha512-eZxlbI8GZscaGS7kkc/trHTT5xgrjH3/1n2JDwusC9iahPKWMRvRjJSAN5mCXviuTGQ/lHnhvv8Q1YTpnfz9gA==",
+      "dev": true
+    },
+    "@types/json-schema": {
+      "version": "7.0.11",
+      "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.11.tgz",
+      "integrity": "sha512-wOuvG1SN4Us4rez+tylwwwCV1psiNVOkJeM3AUWUNWg/jDQY2+HE/444y5gc+jBmRqASOm2Oeh5c1axHobwRKQ==",
+      "dev": true
+    },
+    "@types/node": {
+      "version": "17.0.35",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-17.0.35.tgz",
+      "integrity": "sha512-vu1SrqBjbbZ3J6vwY17jBs8Sr/BKA+/a/WtjRG+whKg1iuLFOosq872EXS0eXWILdO36DHQQeku/ZcL6hz2fpg==",
+      "dev": true
+    },
+    "@typescript-eslint/eslint-plugin": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-5.26.0.tgz",
+      "integrity": "sha512-oGCmo0PqnRZZndr+KwvvAUvD3kNE4AfyoGCwOZpoCncSh4MVD06JTE8XQa2u9u+NX5CsyZMBTEc2C72zx38eYA==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/scope-manager": "5.26.0",
+        "@typescript-eslint/type-utils": "5.26.0",
+        "@typescript-eslint/utils": "5.26.0",
+        "debug": "^4.3.4",
+        "functional-red-black-tree": "^1.0.1",
+        "ignore": "^5.2.0",
+        "regexpp": "^3.2.0",
+        "semver": "^7.3.7",
+        "tsutils": "^3.21.0"
+      }
+    },
+    "@typescript-eslint/parser": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-5.26.0.tgz",
+      "integrity": "sha512-n/IzU87ttzIdnAH5vQ4BBDnLPly7rC5VnjN3m0xBG82HK6rhRxnCb3w/GyWbNDghPd+NktJqB/wl6+YkzZ5T5Q==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/scope-manager": "5.26.0",
+        "@typescript-eslint/types": "5.26.0",
+        "@typescript-eslint/typescript-estree": "5.26.0",
+        "debug": "^4.3.4"
+      }
+    },
+    "@typescript-eslint/scope-manager": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-5.26.0.tgz",
+      "integrity": "sha512-gVzTJUESuTwiju/7NiTb4c5oqod8xt5GhMbExKsCTp6adU3mya6AGJ4Pl9xC7x2DX9UYFsjImC0mA62BCY22Iw==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/types": "5.26.0",
+        "@typescript-eslint/visitor-keys": "5.26.0"
+      }
+    },
+    "@typescript-eslint/type-utils": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-5.26.0.tgz",
+      "integrity": "sha512-7ccbUVWGLmcRDSA1+ADkDBl5fP87EJt0fnijsMFTVHXKGduYMgienC/i3QwoVhDADUAPoytgjbZbCOMj4TY55A==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/utils": "5.26.0",
+        "debug": "^4.3.4",
+        "tsutils": "^3.21.0"
+      }
+    },
+    "@typescript-eslint/types": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-5.26.0.tgz",
+      "integrity": "sha512-8794JZFE1RN4XaExLWLI2oSXsVImNkl79PzTOOWt9h0UHROwJedNOD2IJyfL0NbddFllcktGIO2aOu10avQQyA==",
+      "dev": true
+    },
+    "@typescript-eslint/typescript-estree": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-5.26.0.tgz",
+      "integrity": "sha512-EyGpw6eQDsfD6jIqmXP3rU5oHScZ51tL/cZgFbFBvWuCwrIptl+oueUZzSmLtxFuSOQ9vDcJIs+279gnJkfd1w==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/types": "5.26.0",
+        "@typescript-eslint/visitor-keys": "5.26.0",
+        "debug": "^4.3.4",
+        "globby": "^11.1.0",
+        "is-glob": "^4.0.3",
+        "semver": "^7.3.7",
+        "tsutils": "^3.21.0"
+      }
+    },
+    "@typescript-eslint/utils": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-5.26.0.tgz",
+      "integrity": "sha512-PJFwcTq2Pt4AMOKfe3zQOdez6InIDOjUJJD3v3LyEtxHGVVRK3Vo7Dd923t/4M9hSH2q2CLvcTdxlLPjcIk3eg==",
+      "dev": true,
+      "requires": {
+        "@types/json-schema": "^7.0.9",
+        "@typescript-eslint/scope-manager": "5.26.0",
+        "@typescript-eslint/types": "5.26.0",
+        "@typescript-eslint/typescript-estree": "5.26.0",
+        "eslint-scope": "^5.1.1",
+        "eslint-utils": "^3.0.0"
+      }
+    },
+    "@typescript-eslint/visitor-keys": {
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-5.26.0.tgz",
+      "integrity": "sha512-wei+ffqHanYDOQgg/fS6Hcar6wAWv0CUPQ3TZzOWd2BLfgP539rb49bwua8WRAs7R6kOSLn82rfEu2ro6Llt8Q==",
+      "dev": true,
+      "requires": {
+        "@typescript-eslint/types": "5.26.0",
+        "eslint-visitor-keys": "^3.3.0"
+      }
+    },
+    "acorn": {
+      "version": "8.7.1",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.7.1.tgz",
+      "integrity": "sha512-Xx54uLJQZ19lKygFXOWsscKUbsBZW0CPykPhVQdhIeIwrbPmJzqeASDInc8nKBnp/JT6igTs82qPXz069H8I/A==",
+      "dev": true
+    },
+    "acorn-jsx": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+      "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+      "dev": true,
+      "requires": {}
+    },
+    "acorn-walk": {
+      "version": "8.2.0",
+      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.2.0.tgz",
+      "integrity": "sha512-k+iyHEuPgSw6SbuDpGQM+06HQUa04DZ3o+F6CSzXMvvI5KMvnaEqXe+YVe555R9nn6GPt404fos4wcgpw12SDA==",
+      "dev": true
+    },
+    "ajv": {
+      "version": "6.12.6",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
+      "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+      "dev": true,
+      "requires": {
+        "fast-deep-equal": "^3.1.1",
+        "fast-json-stable-stringify": "^2.0.0",
+        "json-schema-traverse": "^0.4.1",
+        "uri-js": "^4.2.2"
+      }
+    },
+    "ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true
+    },
+    "ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "requires": {
+        "color-convert": "^2.0.1"
+      }
+    },
+    "arg": {
+      "version": "4.1.3",
+      "resolved": "https://registry.npmjs.org/arg/-/arg-4.1.3.tgz",
+      "integrity": "sha512-58S9QDqG0Xx27YwPSt9fJxivjYl432YCwfDMfZ+71RAqUrZef7LrKQZ3LHLOwCS4FLNBplP533Zx895SeOCHvA==",
+      "dev": true
+    },
+    "argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true
+    },
+    "array-union": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/array-union/-/array-union-2.1.0.tgz",
+      "integrity": "sha512-HGyxoOTYUyCM6stUe6EJgnd4EoewAI7zMdfqO+kGjnlZmBDz/cR5pf8r/cR4Wq60sL/p0IkcjUEEPwS3GFrIyw==",
+      "dev": true
+    },
+    "balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true
+    },
+    "brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dev": true,
+      "requires": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "braces": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
+      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
+      "dev": true,
+      "requires": {
+        "fill-range": "^7.0.1"
+      }
+    },
+    "callsites": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/callsites/-/callsites-3.1.0.tgz",
+      "integrity": "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ==",
+      "dev": true
+    },
+    "chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "requires": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      }
+    },
+    "color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "requires": {
+        "color-name": "~1.1.4"
+      }
+    },
+    "color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha1-2Klr13/Wjfd5OnMDajug1UBdR3s=",
+      "dev": true
+    },
+    "create-require": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/create-require/-/create-require-1.1.1.tgz",
+      "integrity": "sha512-dcKFX3jn0MpIaXjisoRvexIJVEKzaq7z2rZKxf+MSr9TkdmHmsU4m2lcLojrj/FHl8mk5VxMmYA+ftRkP/3oKQ==",
+      "dev": true
+    },
+    "cross-spawn": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "dev": true,
+      "requires": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      }
+    },
+    "debug": {
+      "version": "4.3.4",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
+      "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+      "dev": true,
+      "requires": {
+        "ms": "2.1.2"
+      }
+    },
+    "deep-is": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/deep-is/-/deep-is-0.1.4.tgz",
+      "integrity": "sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==",
+      "dev": true
+    },
+    "diff": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.2.tgz",
+      "integrity": "sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==",
+      "dev": true
+    },
+    "dir-glob": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz",
+      "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==",
+      "dev": true,
+      "requires": {
+        "path-type": "^4.0.0"
+      }
+    },
+    "doctrine": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/doctrine/-/doctrine-3.0.0.tgz",
+      "integrity": "sha512-yS+Q5i3hBf7GBkd4KG8a7eBNNWNGLTaEwwYWUijIYM7zrlYDM0BFXHjjPWlWZ1Rg7UaddZeIDmi9jF3HmqiQ2w==",
+      "dev": true,
+      "requires": {
+        "esutils": "^2.0.2"
+      }
+    },
+    "escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "dev": true
+    },
+    "eslint": {
+      "version": "8.16.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.16.0.tgz",
+      "integrity": "sha512-MBndsoXY/PeVTDJeWsYj7kLZ5hQpJOfMYLsF6LicLHQWbRDG19lK5jOix4DPl8yY4SUFcE3txy86OzFLWT+yoA==",
+      "dev": true,
+      "requires": {
+        "@eslint/eslintrc": "^1.3.0",
+        "@humanwhocodes/config-array": "^0.9.2",
+        "ajv": "^6.10.0",
+        "chalk": "^4.0.0",
+        "cross-spawn": "^7.0.2",
+        "debug": "^4.3.2",
+        "doctrine": "^3.0.0",
+        "escape-string-regexp": "^4.0.0",
+        "eslint-scope": "^7.1.1",
+        "eslint-utils": "^3.0.0",
+        "eslint-visitor-keys": "^3.3.0",
+        "espree": "^9.3.2",
+        "esquery": "^1.4.0",
+        "esutils": "^2.0.2",
+        "fast-deep-equal": "^3.1.3",
+        "file-entry-cache": "^6.0.1",
+        "functional-red-black-tree": "^1.0.1",
+        "glob-parent": "^6.0.1",
+        "globals": "^13.15.0",
+        "ignore": "^5.2.0",
+        "import-fresh": "^3.0.0",
+        "imurmurhash": "^0.1.4",
+        "is-glob": "^4.0.0",
+        "js-yaml": "^4.1.0",
+        "json-stable-stringify-without-jsonify": "^1.0.1",
+        "levn": "^0.4.1",
+        "lodash.merge": "^4.6.2",
+        "minimatch": "^3.1.2",
+        "natural-compare": "^1.4.0",
+        "optionator": "^0.9.1",
+        "regexpp": "^3.2.0",
+        "strip-ansi": "^6.0.1",
+        "strip-json-comments": "^3.1.0",
+        "text-table": "^0.2.0",
+        "v8-compile-cache": "^2.0.3"
+      },
+      "dependencies": {
+        "eslint-scope": {
+          "version": "7.1.1",
+          "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-7.1.1.tgz",
+          "integrity": "sha512-QKQM/UXpIiHcLqJ5AOyIW7XZmzjkzQXYE54n1++wb0u9V/abW3l9uQnxX8Z5Xd18xyKIMTUAyQ0k1e8pz6LUrw==",
+          "dev": true,
+          "requires": {
+            "esrecurse": "^4.3.0",
+            "estraverse": "^5.2.0"
+          }
+        },
+        "estraverse": {
+          "version": "5.3.0",
+          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+          "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+          "dev": true
+        }
+      }
+    },
+    "eslint-scope": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-5.1.1.tgz",
+      "integrity": "sha512-2NxwbF/hZ0KpepYN0cNbo+FN6XoK7GaHlQhgx/hIZl6Va0bF45RQOOwhLIy8lQDbuCiadSLCBnH2CFYquit5bw==",
+      "dev": true,
+      "requires": {
+        "esrecurse": "^4.3.0",
+        "estraverse": "^4.1.1"
+      }
+    },
+    "eslint-utils": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/eslint-utils/-/eslint-utils-3.0.0.tgz",
+      "integrity": "sha512-uuQC43IGctw68pJA1RgbQS8/NP7rch6Cwd4j3ZBtgo4/8Flj4eGE7ZYSZRN3iq5pVUv6GPdW5Z1RFleo84uLDA==",
+      "dev": true,
+      "requires": {
+        "eslint-visitor-keys": "^2.0.0"
+      },
+      "dependencies": {
+        "eslint-visitor-keys": {
+          "version": "2.1.0",
+          "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-2.1.0.tgz",
+          "integrity": "sha512-0rSmRBzXgDzIsD6mGdJgevzgezI534Cer5L/vyMX0kHzT/jiB43jRhd9YUlMGYLQy2zprNmoT8qasCGtY+QaKw==",
+          "dev": true
+        }
+      }
+    },
+    "eslint-visitor-keys": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.3.0.tgz",
+      "integrity": "sha512-mQ+suqKJVyeuwGYHAdjMFqjCyfl8+Ldnxuyp3ldiMBFKkvytrXUZWaiPCEav8qDHKty44bD+qV1IP4T+w+xXRA==",
+      "dev": true
+    },
+    "espree": {
+      "version": "9.3.2",
+      "resolved": "https://registry.npmjs.org/espree/-/espree-9.3.2.tgz",
+      "integrity": "sha512-D211tC7ZwouTIuY5x9XnS0E9sWNChB7IYKX/Xp5eQj3nFXhqmiUDB9q27y76oFl8jTg3pXcQx/bpxMfs3CIZbA==",
+      "dev": true,
+      "requires": {
+        "acorn": "^8.7.1",
+        "acorn-jsx": "^5.3.2",
+        "eslint-visitor-keys": "^3.3.0"
+      }
+    },
+    "esquery": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/esquery/-/esquery-1.4.0.tgz",
+      "integrity": "sha512-cCDispWt5vHHtwMY2YrAQ4ibFkAL8RbH5YGBnZBc90MolvvfkkQcJro/aZiAQUlQ3qgrYS6D6v8Gc5G5CQsc9w==",
+      "dev": true,
+      "requires": {
+        "estraverse": "^5.1.0"
+      },
+      "dependencies": {
+        "estraverse": {
+          "version": "5.3.0",
+          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+          "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+          "dev": true
+        }
+      }
+    },
+    "esrecurse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+      "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "dev": true,
+      "requires": {
+        "estraverse": "^5.2.0"
+      },
+      "dependencies": {
+        "estraverse": {
+          "version": "5.3.0",
+          "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+          "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+          "dev": true
+        }
+      }
+    },
+    "estraverse": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
+      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+      "dev": true
+    },
+    "esutils": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/esutils/-/esutils-2.0.3.tgz",
+      "integrity": "sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==",
+      "dev": true
+    },
+    "fast-deep-equal": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+      "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q==",
+      "dev": true
+    },
+    "fast-glob": {
+      "version": "3.2.11",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.2.11.tgz",
+      "integrity": "sha512-xrO3+1bxSo3ZVHAnqzyuewYT6aMFHRAd4Kcs92MAonjwQZLsK9d0SF1IyQ3k5PoirxTW0Oe/RqFgMQ6TcNE5Ew==",
+      "dev": true,
+      "requires": {
+        "@nodelib/fs.stat": "^2.0.2",
+        "@nodelib/fs.walk": "^1.2.3",
+        "glob-parent": "^5.1.2",
+        "merge2": "^1.3.0",
+        "micromatch": "^4.0.4"
+      },
+      "dependencies": {
+        "glob-parent": {
+          "version": "5.1.2",
+          "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+          "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+          "dev": true,
+          "requires": {
+            "is-glob": "^4.0.1"
+          }
+        }
+      }
+    },
+    "fast-json-stable-stringify": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+      "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==",
+      "dev": true
+    },
+    "fast-levenshtein": {
+      "version": "2.0.6",
+      "resolved": "https://registry.npmjs.org/fast-levenshtein/-/fast-levenshtein-2.0.6.tgz",
+      "integrity": "sha1-PYpcZog6FqMMqGQ+hR8Zuqd5eRc=",
+      "dev": true
+    },
+    "fastq": {
+      "version": "1.13.0",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.13.0.tgz",
+      "integrity": "sha512-YpkpUnK8od0o1hmeSc7UUs/eB/vIPWJYjKck2QKIzAf71Vm1AAQ3EbuZB3g2JIy+pg+ERD0vqI79KyZiB2e2Nw==",
+      "dev": true,
+      "requires": {
+        "reusify": "^1.0.4"
+      }
+    },
+    "file-entry-cache": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-6.0.1.tgz",
+      "integrity": "sha512-7Gps/XWymbLk2QLYK4NzpMOrYjMhdIxXuIvy2QBsLE6ljuodKvdkWs/cpyJJ3CVIVpH0Oi1Hvg1ovbMzLdFBBg==",
+      "dev": true,
+      "requires": {
+        "flat-cache": "^3.0.4"
+      }
+    },
+    "fill-range": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
+      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
+      "dev": true,
+      "requires": {
+        "to-regex-range": "^5.0.1"
+      }
+    },
+    "flat-cache": {
+      "version": "3.0.4",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-3.0.4.tgz",
+      "integrity": "sha512-dm9s5Pw7Jc0GvMYbshN6zchCA9RgQlzzEZX3vylR9IqFfS8XciblUXOKfW6SiuJ0e13eDYZoZV5wdrev7P3Nwg==",
+      "dev": true,
+      "requires": {
+        "flatted": "^3.1.0",
+        "rimraf": "^3.0.2"
+      }
+    },
+    "flatted": {
+      "version": "3.2.5",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.2.5.tgz",
+      "integrity": "sha512-WIWGi2L3DyTUvUrwRKgGi9TwxQMUEqPOPQBVi71R96jZXJdFskXEmf54BoZaS1kknGODoIGASGEzBUYdyMCBJg==",
+      "dev": true
+    },
+    "fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha1-FQStJSMVjKpA20onh8sBQRmU6k8=",
+      "dev": true
+    },
+    "functional-red-black-tree": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/functional-red-black-tree/-/functional-red-black-tree-1.0.1.tgz",
+      "integrity": "sha1-GwqzvVU7Kg1jmdKcDj6gslIHgyc=",
+      "dev": true
+    },
+    "glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "dev": true,
+      "requires": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      }
+    },
+    "glob-parent": {
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.2.tgz",
+      "integrity": "sha512-XxwI8EOhVQgWp6iDL+3b0r86f4d6AX6zSU55HfB4ydCEuXLXc5FcYeOu+nnGftS4TEju/11rt4KJPTMgbfmv4A==",
+      "dev": true,
+      "requires": {
+        "is-glob": "^4.0.3"
+      }
+    },
+    "globals": {
+      "version": "13.15.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-13.15.0.tgz",
+      "integrity": "sha512-bpzcOlgDhMG070Av0Vy5Owklpv1I6+j96GhUI7Rh7IzDCKLzboflLrrfqMu8NquDbiR4EOQk7XzJwqVJxicxog==",
+      "dev": true,
+      "requires": {
+        "type-fest": "^0.20.2"
+      }
+    },
+    "globby": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/globby/-/globby-11.1.0.tgz",
+      "integrity": "sha512-jhIXaOzy1sb8IyocaruWSn1TjmnBVs8Ayhcy83rmxNJ8q2uWKCAj3CnJY+KpGSXCueAPc0i05kVvVKtP1t9S3g==",
+      "dev": true,
+      "requires": {
+        "array-union": "^2.1.0",
+        "dir-glob": "^3.0.1",
+        "fast-glob": "^3.2.9",
+        "ignore": "^5.2.0",
+        "merge2": "^1.4.1",
+        "slash": "^3.0.0"
+      }
+    },
+    "has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true
+    },
+    "ignore": {
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.2.0.tgz",
+      "integrity": "sha512-CmxgYGiEPCLhfLnpPp1MoRmifwEIOgjcHXxOBjv7mY96c+eWScsOP9c112ZyLdWHi0FxHjI+4uVhKYp/gcdRmQ==",
+      "dev": true
+    },
+    "import-fresh": {
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/import-fresh/-/import-fresh-3.3.0.tgz",
+      "integrity": "sha512-veYYhQa+D1QBKznvhUHxb8faxlrwUnxseDAbAp457E0wLNio2bOSKnjYDhMj+YiAq61xrMGhQk9iXVk5FzgQMw==",
+      "dev": true,
+      "requires": {
+        "parent-module": "^1.0.0",
+        "resolve-from": "^4.0.0"
+      }
+    },
+    "imurmurhash": {
+      "version": "0.1.4",
+      "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+      "integrity": "sha1-khi5srkoojixPcT7a21XbyMUU+o=",
+      "dev": true
+    },
+    "inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha1-Sb1jMdfQLQwJvJEKEHW6gWW1bfk=",
+      "dev": true,
+      "requires": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "dev": true
+    },
+    "is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha1-qIwCU1eR8C7TfHahueqXc8gz+MI=",
+      "dev": true
+    },
+    "is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "requires": {
+        "is-extglob": "^2.1.1"
+      }
+    },
+    "is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "dev": true
+    },
+    "isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha1-6PvzdNxVb/iUehDcsFctYz8s+hA=",
+      "dev": true
+    },
+    "isomorphic-fetch": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/isomorphic-fetch/-/isomorphic-fetch-3.0.0.tgz",
+      "integrity": "sha512-qvUtwJ3j6qwsF3jLxkZ72qCgjMysPzDfeV240JHiGZsANBYd+EEuu35v7dfrJ9Up0Ak07D7GGSkGhCHTqg/5wA==",
+      "requires": {
+        "node-fetch": "^2.6.1",
+        "whatwg-fetch": "^3.4.1"
+      }
+    },
+    "js-yaml": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "dev": true,
+      "requires": {
+        "argparse": "^2.0.1"
+      }
+    },
+    "json-schema-traverse": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+      "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg==",
+      "dev": true
+    },
+    "json-stable-stringify-without-jsonify": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/json-stable-stringify-without-jsonify/-/json-stable-stringify-without-jsonify-1.0.1.tgz",
+      "integrity": "sha1-nbe1lJatPzz+8wp1FC0tkwrXJlE=",
+      "dev": true
+    },
+    "levn": {
+      "version": "0.4.1",
+      "resolved": "https://registry.npmjs.org/levn/-/levn-0.4.1.tgz",
+      "integrity": "sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==",
+      "dev": true,
+      "requires": {
+        "prelude-ls": "^1.2.1",
+        "type-check": "~0.4.0"
+      }
+    },
+    "lodash.merge": {
+      "version": "4.6.2",
+      "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
+      "integrity": "sha512-0KpjqXRVvrYyCsX1swR/XTK0va6VQkQM6MNo7PqW77ByjAhoARA8EfrP1N4+KlKj8YS0ZUCtRT/YUuhyYDujIQ==",
+      "dev": true
+    },
+    "lru-cache": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
+      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
+      "dev": true,
+      "requires": {
+        "yallist": "^4.0.0"
+      }
+    },
+    "make-error": {
+      "version": "1.3.6",
+      "resolved": "https://registry.npmjs.org/make-error/-/make-error-1.3.6.tgz",
+      "integrity": "sha512-s8UhlNe7vPKomQhC1qFelMokr/Sc3AgNbso3n74mVPA5LTZwkB9NlXf4XPamLxJE8h0gh73rM94xvwRT2CVInw==",
+      "dev": true
+    },
+    "merge2": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "dev": true
+    },
+    "micromatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz",
+      "integrity": "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==",
+      "dev": true,
+      "requires": {
+        "braces": "^3.0.2",
+        "picomatch": "^2.3.1"
+      }
+    },
+    "minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dev": true,
+      "requires": {
+        "brace-expansion": "^1.1.7"
+      }
+    },
+    "ms": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+      "dev": true
+    },
+    "natural-compare": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
+      "integrity": "sha1-Sr6/7tdUHywnrPspvbvRXI1bpPc=",
+      "dev": true
+    },
+    "node-fetch": {
+      "version": "2.6.7",
+      "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.7.tgz",
+      "integrity": "sha512-ZjMPFEfVx5j+y2yF35Kzx5sF7kDzxuDj6ziH4FFbOp87zKDZNx8yExJIb05OGF4Nlt9IHFIMBkRl41VdvcNdbQ==",
+      "requires": {
+        "whatwg-url": "^5.0.0"
+      }
+    },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha1-WDsap3WWHUsROsF9nFC6753Xa9E=",
+      "dev": true,
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "optionator": {
+      "version": "0.9.1",
+      "resolved": "https://registry.npmjs.org/optionator/-/optionator-0.9.1.tgz",
+      "integrity": "sha512-74RlY5FCnhq4jRxVUPKDaRwrVNXMqsGsiW6AJw4XK8hmtm10wC0ypZBLw5IIp85NZMr91+qd1RvvENwg7jjRFw==",
+      "dev": true,
+      "requires": {
+        "deep-is": "^0.1.3",
+        "fast-levenshtein": "^2.0.6",
+        "levn": "^0.4.1",
+        "prelude-ls": "^1.2.1",
+        "type-check": "^0.4.0",
+        "word-wrap": "^1.2.3"
+      }
+    },
+    "parent-module": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/parent-module/-/parent-module-1.0.1.tgz",
+      "integrity": "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g==",
+      "dev": true,
+      "requires": {
+        "callsites": "^3.0.0"
+      }
+    },
+    "path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha1-F0uSaHNVNP+8es5r9TpanhtcX18=",
+      "dev": true
+    },
+    "path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true
+    },
+    "path-type": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
+      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
+      "dev": true
+    },
+    "picomatch": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "dev": true
+    },
+    "prelude-ls": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/prelude-ls/-/prelude-ls-1.2.1.tgz",
+      "integrity": "sha512-vkcDPrRZo1QZLbn5RLGPpg/WmIQ65qoWWhcGKf/b5eplkkarX0m9z8ppCat4mlOqUsWpyNuYgO3VRyrYHSzX5g==",
+      "dev": true
+    },
+    "punycode": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.1.1.tgz",
+      "integrity": "sha512-XRsRjdf+j5ml+y/6GKHPZbrF/8p2Yga0JPtdqTIY2Xe5ohJPD9saDJJLPvp9+NSBprVvevdXZybnj2cv8OEd0A==",
+      "dev": true
+    },
+    "queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "dev": true
+    },
+    "regexpp": {
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/regexpp/-/regexpp-3.2.0.tgz",
+      "integrity": "sha512-pq2bWo9mVD43nbts2wGv17XLiNLya+GklZ8kaDLV2Z08gDCsGpnKn9BFMepvWuHCbyVvY7J5o5+BVvoQbmlJLg==",
+      "dev": true
+    },
+    "resolve-from": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-4.0.0.tgz",
+      "integrity": "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g==",
+      "dev": true
+    },
+    "reusify": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz",
+      "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==",
+      "dev": true
+    },
+    "rimraf": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-3.0.2.tgz",
+      "integrity": "sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA==",
+      "dev": true,
+      "requires": {
+        "glob": "^7.1.3"
+      }
+    },
+    "run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "dev": true,
+      "requires": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
+    "semver": {
+      "version": "7.3.7",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.7.tgz",
+      "integrity": "sha512-QlYTucUYOews+WeEujDoEGziz4K6c47V/Bd+LjSSYcA94p+DmINdf7ncaUinThfvZyu13lN9OY1XDxt8C0Tw0g==",
+      "dev": true,
+      "requires": {
+        "lru-cache": "^6.0.0"
+      }
+    },
+    "shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "requires": {
+        "shebang-regex": "^3.0.0"
+      }
+    },
+    "shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true
+    },
+    "slash": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-3.0.0.tgz",
+      "integrity": "sha512-g9Q1haeby36OSStwb4ntCGGGaKsaVSjQ68fBxoQcutl5fS1vuY18H3wSt3jFyFtrkx+Kz0V1G85A4MyAdDMi2Q==",
+      "dev": true
+    },
+    "strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "requires": {
+        "ansi-regex": "^5.0.1"
+      }
+    },
+    "strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true
+    },
+    "supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "requires": {
+        "has-flag": "^4.0.0"
+      }
+    },
+    "text-table": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/text-table/-/text-table-0.2.0.tgz",
+      "integrity": "sha1-f17oI66AUgfACvLfSoTsP8+lcLQ=",
+      "dev": true
+    },
+    "to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
+      "requires": {
+        "is-number": "^7.0.0"
+      }
+    },
+    "tr46": {
+      "version": "0.0.3",
+      "resolved": "https://registry.npmjs.org/tr46/-/tr46-0.0.3.tgz",
+      "integrity": "sha1-gYT9NH2snNwYWZLzpmIuFLnZq2o="
+    },
+    "ts-node": {
+      "version": "10.8.0",
+      "resolved": "https://registry.npmjs.org/ts-node/-/ts-node-10.8.0.tgz",
+      "integrity": "sha512-/fNd5Qh+zTt8Vt1KbYZjRHCE9sI5i7nqfD/dzBBRDeVXZXS6kToW6R7tTU6Nd4XavFs0mAVCg29Q//ML7WsZYA==",
+      "dev": true,
+      "requires": {
+        "@cspotcode/source-map-support": "^0.8.0",
+        "@tsconfig/node10": "^1.0.7",
+        "@tsconfig/node12": "^1.0.7",
+        "@tsconfig/node14": "^1.0.0",
+        "@tsconfig/node16": "^1.0.2",
+        "acorn": "^8.4.1",
+        "acorn-walk": "^8.1.1",
+        "arg": "^4.1.0",
+        "create-require": "^1.1.0",
+        "diff": "^4.0.1",
+        "make-error": "^1.1.1",
+        "v8-compile-cache-lib": "^3.0.1",
+        "yn": "3.1.1"
+      }
+    },
+    "tslib": {
+      "version": "1.14.1",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz",
+      "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==",
+      "dev": true
+    },
+    "tsutils": {
+      "version": "3.21.0",
+      "resolved": "https://registry.npmjs.org/tsutils/-/tsutils-3.21.0.tgz",
+      "integrity": "sha512-mHKK3iUXL+3UF6xL5k0PEhKRUBKPBCv/+RkEOpjRWxxx27KKRBmmA60A9pgOUvMi8GKhRMPEmjBRPzs2W7O1OA==",
+      "dev": true,
+      "requires": {
+        "tslib": "^1.8.1"
+      }
+    },
+    "type-check": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/type-check/-/type-check-0.4.0.tgz",
+      "integrity": "sha512-XleUoc9uwGXqjWwXaUTZAmzMcFZ5858QA2vvx1Ur5xIcixXIP+8LnFDgRplU30us6teqdlskFfu+ae4K79Ooew==",
+      "dev": true,
+      "requires": {
+        "prelude-ls": "^1.2.1"
+      }
+    },
+    "type-fest": {
+      "version": "0.20.2",
+      "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-0.20.2.tgz",
+      "integrity": "sha512-Ne+eE4r0/iWnpAxD852z3A+N0Bt5RN//NjJwRd2VFHEmrywxf5vsZlh4R6lixl6B+wz/8d+maTSAkN1FIkI3LQ==",
+      "dev": true
+    },
+    "typescript": {
+      "version": "4.6.4",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.6.4.tgz",
+      "integrity": "sha512-9ia/jWHIEbo49HfjrLGfKbZSuWo9iTMwXO+Ca3pRsSpbsMbc7/IU8NKdCZVRRBafVPGnoJeFL76ZOAA84I9fEg==",
+      "dev": true
+    },
+    "uri-js": {
+      "version": "4.4.1",
+      "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+      "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+      "dev": true,
+      "requires": {
+        "punycode": "^2.1.0"
+      }
+    },
+    "v8-compile-cache": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/v8-compile-cache/-/v8-compile-cache-2.3.0.tgz",
+      "integrity": "sha512-l8lCEmLcLYZh4nbunNZvQCJc5pv7+RCwa8q/LdUx8u7lsWvPDKmpodJAJNwkAhJC//dFY48KuIEmjtd4RViDrA==",
+      "dev": true
+    },
+    "v8-compile-cache-lib": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/v8-compile-cache-lib/-/v8-compile-cache-lib-3.0.1.tgz",
+      "integrity": "sha512-wa7YjyUGfNZngI/vtK0UHAN+lgDCxBPCylVXGp0zu59Fz5aiGtNXaq3DhIov063MorB+VfufLh3JlF2KdTK3xg==",
+      "dev": true
+    },
+    "webidl-conversions": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
+      "integrity": "sha1-JFNCdeKnvGvnvIZhHMFq4KVlSHE="
+    },
+    "whatwg-fetch": {
+      "version": "3.6.2",
+      "resolved": "https://registry.npmjs.org/whatwg-fetch/-/whatwg-fetch-3.6.2.tgz",
+      "integrity": "sha512-bJlen0FcuU/0EMLrdbJ7zOnW6ITZLrZMIarMUVmdKtsGvZna8vxKYaexICWPfZ8qwf9fzNq+UEIZrnSaApt6RA=="
+    },
+    "whatwg-url": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/whatwg-url/-/whatwg-url-5.0.0.tgz",
+      "integrity": "sha1-lmRU6HZUYuN2RNNib2dCzotwll0=",
+      "requires": {
+        "tr46": "~0.0.3",
+        "webidl-conversions": "^3.0.0"
+      }
+    },
+    "which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "requires": {
+        "isexe": "^2.0.0"
+      }
+    },
+    "word-wrap": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz",
+      "integrity": "sha512-Hz/mrNwitNRh/HUAtM/VT/5VH+ygD6DV7mYKZAtHOrbs8U7lvPS6xf7EJKMF0uW1KJCl0H701g3ZGus+muE5vQ==",
+      "dev": true
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha1-tSQ9jz7BqjXxNkYFvA0QNuMKtp8=",
+      "dev": true
+    },
+    "yallist": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
+      "dev": true
+    },
+    "yn": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yn/-/yn-3.1.1.tgz",
+      "integrity": "sha512-Ux4ygGWsu2c7isFWe8Yu1YluJmqVhxqK2cLXNQA5AcC3QfbGNpM7fu0Y8b/z16pXLnFxZYvWhd3fhBY9DLmC6Q==",
+      "dev": true
+    }
+  }
+}
diff --git a/e2e-tests/testdata/echo_client/package.json b/e2e-tests/testdata/echo_client/package.json
new file mode 100644
index 0000000000..1624a69c7b
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/package.json
@@ -0,0 +1,20 @@
+{
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "test": "node --trace-warnings --experimental-specifier-resolution=node --loader ts-node/esm ./ts/main.ts",
+    "test:js": "node --trace-warnings --experimental-specifier-resolution=node ./js/main.js",
+    "lint": "tsc --noEmit && eslint \"**/*.{ts,js}\""
+  },
+  "devDependencies": {
+    "@types/node": "^17.0.35",
+    "@typescript-eslint/eslint-plugin": "^5.26.0",
+    "@typescript-eslint/parser": "^5.26.0",
+    "eslint": "^8.16.0",
+    "ts-node": "^10.8.0",
+    "typescript": "^4.6.4"
+  },
+  "dependencies": {
+    "isomorphic-fetch": "^3.0.0"
+  }
+}
diff --git a/e2e-tests/testdata/echo_client/ts/client.ts b/e2e-tests/testdata/echo_client/ts/client.ts
new file mode 100644
index 0000000000..a283321f6f
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/ts/client.ts
@@ -0,0 +1,1507 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-slug.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the slug Encore application.
+ */
+export default class Client {
+    public readonly cache: cache.ServiceClient
+    public readonly di: di.ServiceClient
+    public readonly echo: echo.ServiceClient
+    public readonly emptycfg: emptycfg.ServiceClient
+    public readonly endtoend: endtoend.ServiceClient
+    public readonly middleware: middleware.ServiceClient
+    public readonly test: test.ServiceClient
+    public readonly validation: validation.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.cache = new cache.ServiceClient(base)
+        this.di = new di.ServiceClient(base)
+        this.echo = new echo.ServiceClient(base)
+        this.emptycfg = new emptycfg.ServiceClient(base)
+        this.endtoend = new endtoend.ServiceClient(base)
+        this.middleware = new middleware.ServiceClient(base)
+        this.test = new test.ServiceClient(base)
+        this.validation = new validation.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    /**
+     * Allows you to set the authentication data to be used for each
+     * request either by passing in a static object or by passing in
+     * a function which returns a new object for each request.
+     */
+    auth?: echo.AuthParams | AuthDataGenerator
+}
+
+export namespace cache {
+    export interface IncrResponse {
+        Val: number
+    }
+
+    export interface ListResponse {
+        Vals: string[]
+    }
+
+    export interface StructVal {
+        Val: string
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.GetList = this.GetList.bind(this)
+            this.GetStruct = this.GetStruct.bind(this)
+            this.Incr = this.Incr.bind(this)
+            this.PostList = this.PostList.bind(this)
+            this.PostStruct = this.PostStruct.bind(this)
+        }
+
+        public async GetList(key: number): Promise<ListResponse> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("GET", `/cache/list/${encodeURIComponent(key)}`)
+            return await resp.json() as ListResponse
+        }
+
+        public async GetStruct(key: number): Promise<StructVal> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("GET", `/cache/struct/${encodeURIComponent(key)}`)
+            return await resp.json() as StructVal
+        }
+
+        public async Incr(key: string): Promise<IncrResponse> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/cache/incr/${encodeURIComponent(key)}`)
+            return await resp.json() as IncrResponse
+        }
+
+        public async PostList(key: number, val: string): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/cache/list/${encodeURIComponent(key)}/${encodeURIComponent(val)}`)
+        }
+
+        public async PostStruct(key: number, val: string): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/cache/struct/${encodeURIComponent(key)}/${encodeURIComponent(val)}`)
+        }
+    }
+}
+
+export namespace di {
+    export interface TwoResponse {
+        Msg: string
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.One = this.One.bind(this)
+            this.Three = this.Three.bind(this)
+            this.Two = this.Two.bind(this)
+        }
+
+        public async One(): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/di/one`)
+        }
+
+        public async Three(method: string, body?: RequestInit["body"], options?: CallParameters): Promise<globalThis.Response> {
+            return this.baseClient.callAPI(method, `/di/raw`, body, options)
+        }
+
+        public async Two(): Promise<TwoResponse> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/di/two`)
+            return await resp.json() as TwoResponse
+        }
+    }
+}
+
+export namespace echo {
+    export interface AppMetadata {
+        AppID: string
+        APIBaseURL: string
+        EnvName: string
+        EnvType: string
+    }
+
+    export interface AuthParams {
+        Header: string
+        AuthInt: number
+        Authorization: string
+        Query: number[]
+        NewAuth: boolean
+    }
+
+    export interface BasicData {
+        String: string
+        Uint: number
+        Int: number
+        Int8: number
+        Int64: number
+        Float32: number
+        Float64: number
+        StringSlice: string[]
+        IntSlice: number[]
+        Time: string
+    }
+
+    export interface ConfigResponse {
+        ReadOnlyMode: boolean
+        PublicKey: string
+        SubKeyCount: number
+        AdminUsers: string[]
+    }
+
+    export interface Data<K, V> {
+        Key: K
+        Value: V
+    }
+
+    export interface EmptyData {
+        OmitEmpty: Data<string, string>
+        NullPtr: string
+        Zero: Data<string, string>
+    }
+
+    export interface EnvResponse {
+        Env: string[]
+    }
+
+    /**
+     * HTTPStatusResponse demonstrates encore:"httpstatus" tag functionality
+     */
+    export interface HTTPStatusResponse {
+        message: string
+    }
+
+    export interface HeadersData {
+        Int: number
+        String: string
+    }
+
+    export interface NonBasicData {
+        /**
+         * Header
+         */
+        HeaderString: string
+
+        HeaderNumber: number
+        /**
+         * Body
+         */
+        Struct: Data<Data<string, string>, number>
+
+        StructPtr: Data<number, number>
+        StructSlice: Data<string, string>[]
+        StructMap: { [key: string]: Data<string, number> }
+        StructMapPtr: { [key: string]: Data<string, string> }
+        AnonStruct: {
+            AnonBird: string
+        }
+        "formatted_nest": Data<string, number>
+        RawStruct: JSONValue
+        /**
+         * Query
+         */
+        QueryString: string
+
+        QueryNumber: number
+        OptQueryNumber?: number
+        OptQueryString?: string
+        /**
+         * Path Parameters
+         */
+        PathString: string
+
+        PathInt: number
+        PathWild: string
+        /**
+         * Auth Parameters
+         */
+        AuthHeader: string
+
+        AuthQuery: number[]
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.AppMeta = this.AppMeta.bind(this)
+            this.BasicEcho = this.BasicEcho.bind(this)
+            this.ConfigValues = this.ConfigValues.bind(this)
+            this.CustomHTTPStatus = this.CustomHTTPStatus.bind(this)
+            this.Echo = this.Echo.bind(this)
+            this.EmptyEcho = this.EmptyEcho.bind(this)
+            this.Env = this.Env.bind(this)
+            this.HeadersEcho = this.HeadersEcho.bind(this)
+            this.MuteEcho = this.MuteEcho.bind(this)
+            this.NilResponse = this.NilResponse.bind(this)
+            this.NonBasicEcho = this.NonBasicEcho.bind(this)
+            this.Noop = this.Noop.bind(this)
+            this.Pong = this.Pong.bind(this)
+            this.Publish = this.Publish.bind(this)
+        }
+
+        /**
+         * AppMeta returns app metadata.
+         */
+        public async AppMeta(): Promise<AppMetadata> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/echo.AppMeta`)
+            return await resp.json() as AppMetadata
+        }
+
+        /**
+         * BasicEcho echoes back the request data.
+         */
+        public async BasicEcho(params: BasicData): Promise<BasicData> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/echo.BasicEcho`, JSON.stringify(params))
+            return await resp.json() as BasicData
+        }
+
+        public async ConfigValues(): Promise<ConfigResponse> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/echo.ConfigValues`)
+            return await resp.json() as ConfigResponse
+        }
+
+        /**
+         * CustomHTTPStatus allows testing of custom HTTP status codes via encore:"httpstatus" tag
+         */
+        public async CustomHTTPStatus(): Promise<HTTPStatusResponse> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/echo.CustomHTTPStatus`)
+            return await resp.json() as HTTPStatusResponse
+        }
+
+        /**
+         * Echo echoes back the request data.
+         */
+        public async Echo(params: Data<string, number>): Promise<Data<string, number>> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/echo.Echo`, JSON.stringify(params))
+            return await resp.json() as Data<string, number>
+        }
+
+        /**
+         * EmptyEcho echoes back the request data.
+         */
+        public async EmptyEcho(params: EmptyData): Promise<EmptyData> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/echo.EmptyEcho`, JSON.stringify(params))
+            return await resp.json() as EmptyData
+        }
+
+        /**
+         * Env returns the environment.
+         */
+        public async Env(): Promise<EnvResponse> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/echo.Env`)
+            return await resp.json() as EnvResponse
+        }
+
+        /**
+         * HeadersEcho echoes back the request headers
+         */
+        public async HeadersEcho(params: HeadersData): Promise<HeadersData> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "x-int":    String(params.Int),
+                "x-string": params.String,
+            })
+
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/echo.HeadersEcho`, undefined, {headers})
+
+            //Populate the return object from the JSON body and received headers
+            const rtn = await resp.json() as HeadersData
+            rtn.Int = parseInt(mustBeSet("Header `x-int`", resp.headers.get("x-int")), 10)
+            rtn.String = mustBeSet("Header `x-string`", resp.headers.get("x-string"))
+            return rtn
+        }
+
+        /**
+         * MuteEcho absorbs a request
+         */
+        public async MuteEcho(params: Data<string, string>): Promise<void> {
+            // Convert our params into the objects we need for the request
+            const query = makeRecord<string, string | string[]>({
+                key:   params.Key,
+                value: params.Value,
+            })
+
+            await this.baseClient.callTypedAPI("GET", `/echo.MuteEcho`, undefined, {query})
+        }
+
+        /**
+         * NilResponse returns a nil response and nil error
+         */
+        public async NilResponse(): Promise<BasicData> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/echo.NilResponse`)
+            return await resp.json() as BasicData
+        }
+
+        /**
+         * NonBasicEcho echoes back the request data.
+         */
+        public async NonBasicEcho(pathString: string, pathInt: number, pathWild: string[], params: NonBasicData): Promise<NonBasicData> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "x-header-number": String(params.HeaderNumber),
+                "x-header-string": params.HeaderString,
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                no:     String(params.QueryNumber),
+                optnum: params.OptQueryNumber === undefined ? undefined : String(params.OptQueryNumber),
+                optstr: params.OptQueryString,
+                string: params.QueryString,
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                AnonStruct:       params.AnonStruct,
+                AuthHeader:       params.AuthHeader,
+                AuthQuery:        params.AuthQuery,
+                PathInt:          params.PathInt,
+                PathString:       params.PathString,
+                PathWild:         params.PathWild,
+                RawStruct:        params.RawStruct,
+                Struct:           params.Struct,
+                StructMap:        params.StructMap,
+                StructMapPtr:     params.StructMapPtr,
+                StructPtr:        params.StructPtr,
+                StructSlice:      params.StructSlice,
+                "formatted_nest": params["formatted_nest"],
+            }
+
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/NonBasicEcho/${encodeURIComponent(pathString)}/${encodeURIComponent(pathInt)}/${pathWild.map(encodeURIComponent).join("/")}`, JSON.stringify(body), {headers, query})
+
+            //Populate the return object from the JSON body and received headers
+            const rtn = await resp.json() as NonBasicData
+            rtn.HeaderString = mustBeSet("Header `x-header-string`", resp.headers.get("x-header-string"))
+            rtn.HeaderNumber = parseInt(mustBeSet("Header `x-header-number`", resp.headers.get("x-header-number")), 10)
+            return rtn
+        }
+
+        /**
+         * Noop does nothing
+         */
+        public async Noop(): Promise<void> {
+            await this.baseClient.callTypedAPI("GET", `/echo.Noop`)
+        }
+
+        /**
+         * Pong returns a bird tuple
+         */
+        public async Pong(): Promise<Data<string, string>> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("GET", `/echo.Pong`)
+            return await resp.json() as Data<string, string>
+        }
+
+        /**
+         * Publish publishes a request on a topic
+         */
+        public async Publish(): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/echo.Publish`)
+        }
+    }
+}
+
+export namespace emptycfg {
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.AnAPI = this.AnAPI.bind(this)
+        }
+
+        public async AnAPI(): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/emptycfg.AnAPI`)
+        }
+    }
+}
+
+export namespace endtoend {
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.GeneratedWrappersEndToEndTest = this.GeneratedWrappersEndToEndTest.bind(this)
+        }
+
+        public async GeneratedWrappersEndToEndTest(): Promise<void> {
+            await this.baseClient.callTypedAPI("GET", `/generated-wrappers-end-to-end-test`)
+        }
+    }
+}
+
+export namespace middleware {
+    export interface Payload {
+        Msg: string
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.Error = this.Error.bind(this)
+            this.ResponseGen = this.ResponseGen.bind(this)
+            this.ResponseRewrite = this.ResponseRewrite.bind(this)
+        }
+
+        public async Error(): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/middleware.Error`)
+        }
+
+        public async ResponseGen(params: Payload): Promise<Payload> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/middleware.ResponseGen`, JSON.stringify(params))
+            return await resp.json() as Payload
+        }
+
+        public async ResponseRewrite(params: Payload): Promise<Payload> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/middleware.ResponseRewrite`, JSON.stringify(params))
+            return await resp.json() as Payload
+        }
+    }
+}
+
+export namespace test {
+    export interface BodyEcho {
+        Message: string
+    }
+
+    export interface MarshallerTest<A> {
+        HeaderBoolean: boolean
+        HeaderInt: number
+        HeaderFloat: number
+        HeaderString: string
+        HeaderBytes: string
+        HeaderTime: string
+        HeaderJson: JSONValue
+        HeaderUUID: string
+        HeaderUserID: string
+        QueryBoolean: boolean
+        QueryInt: number
+        QueryFloat: number
+        QueryString: string
+        QueryBytes: string
+        QueryTime: string
+        QueryJson: JSONValue
+        QueryUUID: string
+        QueryUserID: string
+        QuerySlice: A[]
+        boolean: boolean
+        int: number
+        float: number
+        string: string
+        bytes: string
+        time: string
+        json: JSONValue
+        uuid: string
+        "user-id": string
+        slice: A[]
+    }
+
+    export interface MultiPathSegment {
+        Boolean: boolean
+        Int: number
+        String: string
+        UUID: string
+        Wildcard: string
+    }
+
+    export interface RestParams {
+        HeaderValue: string
+        QueryValue: string
+        "Some-Key": string
+        Nested: {
+            Alice: string
+            bOb: number
+            charile: boolean
+        }
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.GetMessage = this.GetMessage.bind(this)
+            this.MarshallerTestHandler = this.MarshallerTestHandler.bind(this)
+            this.Noop = this.Noop.bind(this)
+            this.NoopWithError = this.NoopWithError.bind(this)
+            this.PathMultiSegments = this.PathMultiSegments.bind(this)
+            this.RawEndpoint = this.RawEndpoint.bind(this)
+            this.RestStyleAPI = this.RestStyleAPI.bind(this)
+            this.SimpleBodyEcho = this.SimpleBodyEcho.bind(this)
+            this.TestAuthHandler = this.TestAuthHandler.bind(this)
+            this.UpdateMessage = this.UpdateMessage.bind(this)
+        }
+
+        /**
+         * GetMessage allows us to test an API which takes no parameters,
+         * but returns data. It also tests two API's on the same path with different HTTP methods
+         */
+        public async GetMessage(clientID: string): Promise<BodyEcho> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("GET", `/last_message/${encodeURIComponent(clientID)}`)
+            return await resp.json() as BodyEcho
+        }
+
+        /**
+         * MarshallerTestHandler allows us to test marshalling of all the inbuilt types in all
+         * the field types. It simply echos all the responses back to the client
+         */
+        public async MarshallerTestHandler(params: MarshallerTest<number>): Promise<MarshallerTest<number>> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "x-boolean": String(params.HeaderBoolean),
+                "x-bytes":   String(params.HeaderBytes),
+                "x-float":   String(params.HeaderFloat),
+                "x-int":     String(params.HeaderInt),
+                "x-json":    JSON.stringify(params.HeaderJson),
+                "x-string":  params.HeaderString,
+                "x-time":    String(params.HeaderTime),
+                "x-user-id": String(params.HeaderUserID),
+                "x-uuid":    String(params.HeaderUUID),
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                boolean:   String(params.QueryBoolean),
+                bytes:     String(params.QueryBytes),
+                float:     String(params.QueryFloat),
+                int:       String(params.QueryInt),
+                json:      JSON.stringify(params.QueryJson),
+                slice:     params.QuerySlice.map((v) => String(v)),
+                string:    params.QueryString,
+                time:      String(params.QueryTime),
+                "user-id": String(params.QueryUserID),
+                uuid:      String(params.QueryUUID),
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                boolean:   params.boolean,
+                bytes:     params.bytes,
+                float:     params.float,
+                int:       params.int,
+                json:      params.json,
+                slice:     params.slice,
+                string:    params.string,
+                time:      params.time,
+                "user-id": params["user-id"],
+                uuid:      params.uuid,
+            }
+
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/test.MarshallerTestHandler`, JSON.stringify(body), {headers, query})
+
+            //Populate the return object from the JSON body and received headers
+            const rtn = await resp.json() as MarshallerTest<number>
+            rtn.HeaderBoolean = mustBeSet("Header `x-boolean`", resp.headers.get("x-boolean")).toLowerCase() === "true"
+            rtn.HeaderInt = parseInt(mustBeSet("Header `x-int`", resp.headers.get("x-int")), 10)
+            rtn.HeaderFloat = Number(mustBeSet("Header `x-float`", resp.headers.get("x-float")))
+            rtn.HeaderString = mustBeSet("Header `x-string`", resp.headers.get("x-string"))
+            rtn.HeaderBytes = mustBeSet("Header `x-bytes`", resp.headers.get("x-bytes"))
+            rtn.HeaderTime = mustBeSet("Header `x-time`", resp.headers.get("x-time"))
+            rtn.HeaderJson = JSON.parse(mustBeSet("Header `x-json`", resp.headers.get("x-json")))
+            rtn.HeaderUUID = mustBeSet("Header `x-uuid`", resp.headers.get("x-uuid"))
+            rtn.HeaderUserID = mustBeSet("Header `x-user-id`", resp.headers.get("x-user-id"))
+            return rtn
+        }
+
+        /**
+         * Noop allows us to test if a simple HTTP request can be made
+         */
+        public async Noop(): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/test.Noop`)
+        }
+
+        /**
+         * NoopWithError allows us to test if the structured errors are returned
+         */
+        public async NoopWithError(): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/test.NoopWithError`)
+        }
+
+        /**
+         * PathMultiSegments allows us to wildcard segments and segment URI encoding
+         */
+        public async PathMultiSegments(bool: boolean, int: number, _string: string, uuid: string, wildcard: string[]): Promise<MultiPathSegment> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/multi/${encodeURIComponent(bool)}/${encodeURIComponent(int)}/${encodeURIComponent(_string)}/${encodeURIComponent(uuid)}/${wildcard.map(encodeURIComponent).join("/")}`)
+            return await resp.json() as MultiPathSegment
+        }
+
+        /**
+         * RawEndpoint allows us to test the clients' ability to send raw requests
+         * under auth
+         */
+        public async RawEndpoint(method: "PUT" | "POST" | "DELETE" | "GET", id: string[], body?: RequestInit["body"], options?: CallParameters): Promise<globalThis.Response> {
+            return this.baseClient.callAPI(method, `/raw/blah/${id.map(encodeURIComponent).join("/")}`, body, options)
+        }
+
+        /**
+         * RestStyleAPI tests all the ways we can get data into and out of the application
+         * using Encore request handlers
+         */
+        public async RestStyleAPI(objType: number, name: string, params: RestParams): Promise<RestParams> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "some-key": params.HeaderValue,
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                "Some-Key": params.QueryValue,
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                Nested:     params.Nested,
+                "Some-Key": params["Some-Key"],
+            }
+
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("PUT", `/rest/object/${encodeURIComponent(objType)}/${encodeURIComponent(name)}`, JSON.stringify(body), {headers, query})
+
+            //Populate the return object from the JSON body and received headers
+            const rtn = await resp.json() as RestParams
+            rtn.HeaderValue = mustBeSet("Header `some-key`", resp.headers.get("some-key"))
+            return rtn
+        }
+
+        /**
+         * SimpleBodyEcho allows us to exercise the body marshalling from JSON
+         * and being returned purely as a body
+         */
+        public async SimpleBodyEcho(params: BodyEcho): Promise<BodyEcho> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/test.SimpleBodyEcho`, JSON.stringify(params))
+            return await resp.json() as BodyEcho
+        }
+
+        /**
+         * TestAuthHandler allows us to test the clients ability to add tokens to requests
+         */
+        public async TestAuthHandler(): Promise<BodyEcho> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/test.TestAuthHandler`)
+            return await resp.json() as BodyEcho
+        }
+
+        /**
+         * UpdateMessage allows us to test an API which takes parameters,
+         * but doesn't return anything
+         */
+        public async UpdateMessage(clientID: string, params: BodyEcho): Promise<void> {
+            await this.baseClient.callTypedAPI("PUT", `/last_message/${encodeURIComponent(clientID)}`, JSON.stringify(params))
+        }
+    }
+}
+
+export namespace validation {
+    export interface Request {
+        Msg: string
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.TestOne = this.TestOne.bind(this)
+        }
+
+        public async TestOne(params: Request): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/validation.TestOne`, JSON.stringify(params))
+        }
+    }
+}
+
+// JSONValue represents an arbitrary JSON value.
+export type JSONValue = string | number | boolean | null | JSONValue[] | {[key: string]: JSONValue}
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+
+// mustBeSet will throw an APIError with the Data Loss code if value is null or undefined
+function mustBeSet<A>(field: string, value: A | null | undefined): A {
+    if (value === null || value === undefined) {
+        throw new APIError(
+            500,
+            {
+                code: ErrCode.DataLoss,
+                message: `${field} was unexpectedly ${value}`, // ${value} will create the string "null" or "undefined"
+            },
+        )
+    }
+    return value
+}
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "method" | "body" | "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+// AuthDataGenerator is a function that returns a new instance of the authentication data required by this API
+export type AuthDataGenerator = () =>
+  | echo.AuthParams
+  | Promise<echo.AuthParams | undefined>
+  | undefined;
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+    readonly authGenerator?: AuthDataGenerator
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "slug-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+
+        // Setup an authentication data generator using the auth data token option
+        if (options.auth !== undefined) {
+            const auth = options.auth
+            if (typeof auth === "function") {
+                this.authGenerator = auth
+            } else {
+                this.authGenerator = () => auth
+            }
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        let authData: echo.AuthParams | undefined;
+
+        // If authorization data generator is present, call it and add the returned data to the request
+        if (this.authGenerator) {
+            const mayBePromise = this.authGenerator();
+            if (mayBePromise instanceof Promise) {
+                authData = await mayBePromise;
+            } else {
+                authData = mayBePromise;
+            }
+        }
+
+        if (authData) {
+            const data: CallParameters = {};
+
+            data.query = makeRecord<string, string | string[]>({
+                "new-auth": String(authData.NewAuth),
+                query:      authData.Query.map((v) => String(v)),
+            });
+            data.headers = makeRecord<string, string>({
+                authorization: authData.Authorization,
+                "x-auth-int":  String(authData.AuthInt),
+                "x-header":    authData.Header,
+            });
+
+            return data;
+        }
+
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/e2e-tests/testdata/echo_client/ts/main.ts b/e2e-tests/testdata/echo_client/ts/main.ts
new file mode 100644
index 0000000000..5b130cd64e
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/ts/main.ts
@@ -0,0 +1,263 @@
+/* eslint-disable @typescript-eslint/no-explicit-any */
+
+import "isomorphic-fetch"
+import {deepEqual} from "assert"
+
+import Client, {BaseURL, echo, ErrCode, isAPIError, test} from "./client"
+import MarshallerTest = test.MarshallerTest
+
+if (process.argv.length < 3) {
+  console.error("Usage: npm run test -- <host:port>")
+  console.log(`Got ${process.argv.length} arguments`)
+  process.exit(1)
+}
+
+// Create the client
+const api = new Client("http://" + process.argv[2] as BaseURL)
+
+// Test a simple no-op
+await api.test.Noop()
+
+// Test we get back the right structured error
+await assertStructuredError(api.test.NoopWithError(), ErrCode.Unimplemented, "totally not implemented yet")
+
+// Test a simple echo
+const echoRsp = await api.test.SimpleBodyEcho({Message: "hello world"})
+deepEqual(echoRsp.Message, "hello world", "Wanted body to be 'hello world'")
+
+// Check our UpdateMessage and GetMessage API's
+let getRsp = await api.test.GetMessage("typescript")
+deepEqual(getRsp.Message, "", "Expected no message on first request")
+
+await api.test.UpdateMessage("typescript", {Message: "updating now"})
+
+getRsp = await api.test.GetMessage("typescript")
+deepEqual(getRsp.Message, "updating now", "Expected data from Update request")
+
+// Test the rest API which uses all input types (query string, json body and header fields)
+// as well as nested structs and path segments in the URL
+const restRsp = await api.test.RestStyleAPI(5, "hello", {
+  HeaderValue: "this is the header field",
+  QueryValue:  "this is a query string field",
+  "Some-Key":  "this is the body field",
+  Nested:      {
+    Alice:   "the nested key",
+    bOb:     8,
+    charile: true,
+  },
+})
+deepEqual(restRsp.HeaderValue, "this is the header field", "expected header value")
+deepEqual(restRsp.QueryValue, "this is a query string field", "expected query value")
+deepEqual(restRsp["Some-Key"], "this is the body field", "expected body value")
+deepEqual(restRsp.Nested.Alice, "hello + the nested key", "expected nested key")
+deepEqual(restRsp.Nested.bOb, 5 + 8, "expected nested value")
+deepEqual(restRsp.Nested.charile, true, "expected nested ok")
+
+// Full marshalling test with randomised payloads
+function rInt(): number {
+  return Math.floor(Math.random() * 10000000)
+}
+
+const params: MarshallerTest<number> = {
+  HeaderBoolean: Math.random() > 0.5,
+  HeaderInt:     rInt(),
+  HeaderFloat:   Math.random(),
+  HeaderString:  "header string",
+  HeaderBytes:   "aGVsbG8K",
+  HeaderTime:    (new Date(Math.floor(Date.now() / 1000) * 1000)).toISOString().replace(".000Z", "Z"),
+  HeaderJson:    {"hello": "world"},
+  HeaderUUID:    "2553e3a4-5d9f-4716-82a2-b9bdc20a3263",
+  HeaderUserID:  "432",
+  QueryBoolean:  Math.random() > 0.5,
+  QueryInt:      rInt(),
+  QueryFloat:    Math.random(),
+  QueryString:   "query string",
+  QueryBytes:    "d29ybGQK",
+  QueryTime:     (new Date(Math.floor(Date.now() / 1000) * 1000)).toISOString().replace(".000Z", "Z"),
+  QueryJson:     {value: true},
+  QueryUUID:     "84b7463d-6000-4678-9d94-1d526bb5217c",
+  QueryUserID:   "9udfa",
+  QuerySlice:    [rInt(), rInt(), rInt(), rInt()],
+  boolean:       Math.random() > 0.5,
+  int:           Math.floor(Math.random() * 10000000),
+  float:         Math.random(),
+  string:        "body string",
+  bytes:         "aXMgaXQgbWUgeW91IGFyZSBsb29raW5nIGZvcj8K",
+  time:          (new Date(Math.floor(Date.now() / 1000) * 1000)).toISOString().replace(".000Z", "Z"),
+  json:          {json_value: 4321},
+  uuid:          "c227acf4-1902-4c85-8027-623d47ef4c8a",
+  "user-id":     "✉️",
+  slice:         [rInt(), rInt(), rInt(), rInt(), rInt(), rInt()],
+}
+const mResp = await api.test.MarshallerTestHandler(params)
+deepEqual(mResp, params, "Expected the same response from the marshaller test")
+
+// Test auth handlers
+await assertStructuredError(api.test.TestAuthHandler(), ErrCode.Unauthenticated, "missing auth param")
+
+// Test with static auth data
+{
+  const api = new Client(
+    "http://" + process.argv[2] as BaseURL,
+    {
+      auth: {
+        AuthInt:        34,
+        Authorization: "Bearer tokendata",
+        NewAuth:        false,
+        Header:        "",
+        Query:         [],
+      },
+    },
+  )
+
+  const resp = await api.test.TestAuthHandler()
+  deepEqual(resp.Message, "user::true", "expected the user ID back")
+}
+
+// Test with auth data generator function
+{
+  let tokenToReturn = "tokendata"
+  const api = new Client(
+    "http://" + process.argv[2] as BaseURL,
+    {
+      auth: (): echo.AuthParams => {
+        return {
+          Authorization: "Bearer " + tokenToReturn,
+          AuthInt:        34,
+          NewAuth:        false,
+          Header:        "",
+          Query:         [],
+        }
+      },
+    },
+  )
+
+  // With a valid token
+  const resp = await api.test.TestAuthHandler()
+  deepEqual(resp.Message, "user::true", "expected the user ID back")
+
+  // With an invalid token
+  tokenToReturn = "invalid-token-value"
+  await assertStructuredError(api.test.TestAuthHandler(), ErrCode.Unauthenticated, "invalid token")
+}
+
+// Test with headers and query string auth data
+{
+  const api = new Client(
+    "http://" + process.argv[2] as BaseURL,
+    {
+      auth: {
+        Authorization: "",
+        AuthInt:        34,
+        NewAuth:        true,
+        Header:        "102",
+        Query:         [42, 100, -50, 10],
+      },
+    },
+  )
+
+  const resp = await api.test.TestAuthHandler()
+  deepEqual(resp.Message, "second_user::true", "expected the user ID back")
+}
+
+// Test the raw endpoint
+{
+  const api = new Client(
+    "http://" + process.argv[2] as BaseURL,
+    {
+      auth: {
+        AuthInt:        34,
+        Authorization: "Bearer tokendata",
+        NewAuth:        false,
+        Header:        "",
+        Query:         [],
+      },
+    },
+  )
+
+  const resp = await api.test.RawEndpoint(
+    "PUT",
+    ["hello"],
+    "this is a test body",
+    {
+      headers: {"X-Test-Header": "test"},
+      query:   {"foo": "bar"},
+    },
+  )
+
+  deepEqual(resp.status, 201, "expected the status code to be 201")
+
+  const response = await resp.json()
+
+  deepEqual(response, {
+    Body:        "this is a test body",
+    Header:      "test",
+    PathParam:   "hello",
+    QueryString: "bar",
+  }, "expected the response to match")
+}
+
+// Test path encoding
+const resp = await api.test.PathMultiSegments(true, 342, "foo/blah/should/get/escaped", "503f4487-1e15-4c37-9a80-7b70f86387bb", ["foo/bar", "blah", "seperate/segments = great success"])
+deepEqual(resp.Boolean, true, "expected the boolean to be true")
+deepEqual(resp.Int, 342, "expected the int to be 342")
+deepEqual(resp.String, "foo/blah/should/get/escaped", "invalid string field returned")
+deepEqual(resp.UUID, "503f4487-1e15-4c37-9a80-7b70f86387bb", "invalid UUID returned")
+deepEqual(resp.Wildcard, "foo/bar/blah/seperate/segments = great success", "invalid wildcard field returned")
+
+// Test validation
+{
+  await api.validation.TestOne({
+    Msg: "pass",
+  })
+  await assertStructuredError(api.validation.TestOne({Msg: "fail"}), ErrCode.InvalidArgument, "validation failed: bad message")
+  const client = new Client(
+      "http://" + process.argv[2] as BaseURL,
+      {
+        auth: {
+          AuthInt:        0,
+          Authorization: "",
+          NewAuth:       false,
+          Header:        "fail-validation",
+          Query:         [],
+        },
+      },
+  )
+  await assertStructuredError(client.test.Noop(), ErrCode.InvalidArgument, "validation failed: auth validation fail")
+}
+
+// Test middleware
+{
+  await assertStructuredError(api.middleware.Error(), ErrCode.Internal, "middleware error")
+  const resp1 = await api.middleware.ResponseRewrite({Msg: "foo"})
+  deepEqual(resp1.Msg, "middleware(req=foo, resp=handler(foo))")
+
+  const resp2 = await api.middleware.ResponseGen({Msg: "foo"})
+  deepEqual(resp2.Msg, "middleware generated")
+}
+
+// Client test completed
+process.exit(0)
+
+async function assertStructuredError(promise: Promise<any>, code: ErrCode, message: string) {
+  let errorOccurred = false
+  try {
+    await promise
+  } catch (err: any) {
+    errorOccurred = true
+    if (isAPIError(err)) {
+      if (err.code !== code) {
+        throw new Error(`Expected error code ${code}, got ${err.code} with message "${err.message}"`)
+      }
+      if (err.message !== message) {
+        throw new Error(`Expected error message "${message}", got "${err.message}"`)
+      }
+    } else {
+      throw new Error(`Expected APIError, got ${err}`)
+    }
+  }
+
+  if (!errorOccurred) {
+    throw new Error("No error was thrown during call to NoopWithError")
+  }
+}
diff --git a/e2e-tests/testdata/echo_client/tsconfig.json b/e2e-tests/testdata/echo_client/tsconfig.json
new file mode 100644
index 0000000000..ca6093faf9
--- /dev/null
+++ b/e2e-tests/testdata/echo_client/tsconfig.json
@@ -0,0 +1,107 @@
+{
+  "compilerOptions": {
+    /* Visit https://aka.ms/tsconfig.json to read more about this file */
+
+    /* Projects */
+    // "incremental": true,                              /* Enable incremental compilation */
+    // "composite": true,                                /* Enable constraints that allow a TypeScript project to be used with project references. */
+    // "tsBuildInfoFile": "./",                          /* Specify the folder for .tsbuildinfo incremental compilation files. */
+    // "disableSourceOfProjectReferenceRedirect": true,  /* Disable preferring source files instead of declaration files when referencing composite projects */
+    // "disableSolutionSearching": true,                 /* Opt a project out of multi-project reference checking when editing. */
+    // "disableReferencedProjectLoad": true,             /* Reduce the number of projects loaded automatically by TypeScript. */
+
+    /* Language and Environment */
+    "target": "ESNext",                                  /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */
+    "lib": [ "ES6", "DOM", "ES2021.String" ],            /* Specify a set of bundled library declaration files that describe the target runtime environment. */
+    // "jsx": "preserve",                                /* Specify what JSX code is generated. */
+    // "experimentalDecorators": true,                   /* Enable experimental support for TC39 stage 2 draft decorators. */
+    // "emitDecoratorMetadata": true,                    /* Emit design-type metadata for decorated declarations in source files. */
+    // "jsxFactory": "",                                 /* Specify the JSX factory function used when targeting React JSX emit, e.g. 'React.createElement' or 'h' */
+    // "jsxFragmentFactory": "",                         /* Specify the JSX Fragment reference used for fragments when targeting React JSX emit e.g. 'React.Fragment' or 'Fragment'. */
+    // "jsxImportSource": "",                            /* Specify module specifier used to import the JSX factory functions when using `jsx: react-jsx*`.` */
+    // "reactNamespace": "",                             /* Specify the object invoked for `createElement`. This only applies when targeting `react` JSX emit. */
+    // "noLib": true,                                    /* Disable including any library files, including the default lib.d.ts. */
+    // "useDefineForClassFields": true,                  /* Emit ECMAScript-standard-compliant class fields. */
+
+    /* Modules */
+    "module": "ESNext",                                  /* Specify what module code is generated. */
+    // "rootDir": "./",                                  /* Specify the root folder within your source files. */
+    "moduleResolution": "Node",                          /* Specify how TypeScript looks up a file from a given module specifier. */
+    // "baseUrl": "./",                                  /* Specify the base directory to resolve non-relative module names. */
+    // "paths": {},                                      /* Specify a set of entries that re-map imports to additional lookup locations. */
+    // "rootDirs": [],                                   /* Allow multiple folders to be treated as one when resolving modules. */
+    // "typeRoots": [],                                  /* Specify multiple folders that act like `./node_modules/@types`. */
+    // "types": [],                                      /* Specify type package names to be included without being referenced in a source file. */
+    // "allowUmdGlobalAccess": true,                     /* Allow accessing UMD globals from modules. */
+    // "resolveJsonModule": true,                        /* Enable importing .json files */
+    // "noResolve": true,                                /* Disallow `import`s, `require`s or `<reference>`s from expanding the number of files TypeScript should add to a project. */
+
+    /* JavaScript Support */
+    // "allowJs": true,                                  /* Allow JavaScript files to be a part of your program. Use the `checkJS` option to get errors from these files. */
+    // "checkJs": true,                                  /* Enable error reporting in type-checked JavaScript files. */
+    // "maxNodeModuleJsDepth": 1,                        /* Specify the maximum folder depth used for checking JavaScript files from `node_modules`. Only applicable with `allowJs`. */
+
+    /* Emit */
+    // "declaration": true,                              /* Generate .d.ts files from TypeScript and JavaScript files in your project. */
+    // "declarationMap": true,                           /* Create sourcemaps for d.ts files. */
+    // "emitDeclarationOnly": true,                      /* Only output d.ts files and not JavaScript files. */
+    // "sourceMap": true,                                /* Create source map files for emitted JavaScript files. */
+    // "outFile": "./",                                  /* Specify a file that bundles all outputs into one JavaScript file. If `declaration` is true, also designates a file that bundles all .d.ts output. */
+    // "outDir": "./",                                   /* Specify an output folder for all emitted files. */
+    // "removeComments": true,                           /* Disable emitting comments. */
+    // "noEmit": true,                                   /* Disable emitting files from a compilation. */
+    // "importHelpers": true,                            /* Allow importing helper functions from tslib once per project, instead of including them per-file. */
+    // "importsNotUsedAsValues": "remove",               /* Specify emit/checking behavior for imports that are only used for types */
+    // "downlevelIteration": true,                       /* Emit more compliant, but verbose and less performant JavaScript for iteration. */
+    // "sourceRoot": "",                                 /* Specify the root path for debuggers to find the reference source code. */
+    // "mapRoot": "",                                    /* Specify the location where debugger should locate map files instead of generated locations. */
+    // "inlineSourceMap": true,                          /* Include sourcemap files inside the emitted JavaScript. */
+    // "inlineSources": true,                            /* Include source code in the sourcemaps inside the emitted JavaScript. */
+    // "emitBOM": true,                                  /* Emit a UTF-8 Byte Order Mark (BOM) in the beginning of output files. */
+    // "newLine": "crlf",                                /* Set the newline character for emitting files. */
+    // "stripInternal": true,                            /* Disable emitting declarations that have `@internal` in their JSDoc comments. */
+    // "noEmitHelpers": true,                            /* Disable generating custom helper functions like `__extends` in compiled output. */
+    "noEmitOnError": true,                               /* Disable emitting files if any type checking errors are reported. */
+    // "preserveConstEnums": true,                       /* Disable erasing `const enum` declarations in generated code. */
+    // "declarationDir": "./",                           /* Specify the output directory for generated declaration files. */
+    // "preserveValueImports": true,                     /* Preserve unused imported values in the JavaScript output that would otherwise be removed. */
+
+    /* Interop Constraints */
+    // "isolatedModules": true,                          /* Ensure that each file can be safely transpiled without relying on other imports. */
+    // "allowSyntheticDefaultImports": true,             /* Allow 'import x from y' when a module doesn't have a default export. */
+    "esModuleInterop": true,                             /* Emit additional JavaScript to ease support for importing CommonJS modules. This enables `allowSyntheticDefaultImports` for type compatibility. */
+    // "preserveSymlinks": true,                         /* Disable resolving symlinks to their realpath. This correlates to the same flag in node. */
+    "forceConsistentCasingInFileNames": true,            /* Ensure that casing is correct in imports. */
+
+    /* Type Checking */
+    "strict": true,                                      /* Enable all strict type-checking options. */
+    "noImplicitAny": true,                               /* Enable error reporting for expressions and declarations with an implied `any` type.. */
+    "strictNullChecks": true,                            /* When type checking, take into account `null` and `undefined`. */
+    "strictFunctionTypes": true,                         /* When assigning functions, check to ensure parameters and the return values are subtype-compatible. */
+    "strictBindCallApply": true,                         /* Check that the arguments for `bind`, `call`, and `apply` methods match the original function. */
+    "strictPropertyInitialization": true,                /* Check for class properties that are declared but not set in the constructor. */
+    "noImplicitThis": true,                              /* Enable error reporting when `this` is given the type `any`. */
+    "useUnknownInCatchVariables": true,                  /* Type catch clause variables as 'unknown' instead of 'any'. */
+    "alwaysStrict": true,                                /* Ensure 'use strict' is always emitted. */
+    "noUnusedLocals": true,                              /* Enable error reporting when a local variables aren't read. */
+    "noUnusedParameters": true,                          /* Raise an error when a function parameter isn't read */
+    "exactOptionalPropertyTypes": true,                  /* Interpret optional property types as written, rather than adding 'undefined'. */
+    "noImplicitReturns": true,                           /* Enable error reporting for codepaths that do not explicitly return in a function. */
+    "noFallthroughCasesInSwitch": true,                  /* Enable error reporting for fallthrough cases in switch statements. */
+    "noUncheckedIndexedAccess": true,                    /* Include 'undefined' in index signature results */
+    "noImplicitOverride": true,                          /* Ensure overriding members in derived classes are marked with an override modifier. */
+    "noPropertyAccessFromIndexSignature": true,          /* Enforces using indexed accessors for keys declared using an indexed type */
+    "allowUnusedLabels": false,                          /* Disable error reporting for unused labels. */
+    "allowUnreachableCode": false,                       /* Disable error reporting for unreachable code. */
+
+    /* Completeness */
+    // "skipDefaultLibCheck": true,                      /* Skip type checking .d.ts files that are included with TypeScript. */
+    "skipLibCheck": true                                 /* Skip type checking all .d.ts files. */
+  },
+  "ts-node": {
+    "esm": true
+  },
+  "lib": [
+    "esnext"
+  ]
+}
diff --git a/e2e-tests/testdata/testscript/encore_currentrequest.txt b/e2e-tests/testdata/testscript/encore_currentrequest.txt
new file mode 100644
index 0000000000..d3e9e1db73
--- /dev/null
+++ b/e2e-tests/testdata/testscript/encore_currentrequest.txt
@@ -0,0 +1,59 @@
+run
+publish topic '{"Data": "test"}'
+checklog '{"topic": "topic", "subscription": "sub", "type": "pubsub-message", "msg": {"Service": "svc", "Topic": "topic", "Subscription": "sub", "ID": "1", "DeliveryAttempt": 1}, "message": "pubsub event"}'
+
+# Authenticated requests should return the execution id
+call GET X-Encore-Cron-Execution=foo /svc.CurrentRequest ''
+checkresp '{"Path": "/svc.CurrentRequest", "IdempotencyKey": "foo"}'
+
+# Unauthenticated requests should return the empty string
+call GET X-Encore-Cron-Execution=foo /svc.CurrentRequest '' no-platform-auth
+checkresp '{"Path": "/svc.CurrentRequest", "IdempotencyKey": ""}'
+
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev"
+    "encore.dev/rlog"
+    "encore.dev/pubsub"
+)
+
+type MyData struct {
+    Name string
+}
+
+type Event struct {
+    Data string
+}
+
+type RequestData struct {
+    Path string
+    IdempotencyKey string
+}
+
+//encore:api public
+func CurrentRequest(ctx context.Context) (*RequestData, error) {
+    req := encore.CurrentRequest()
+    return &RequestData{
+        Path: req.Path,
+        IdempotencyKey: req.CronIdempotencyKey,
+    }, nil
+}
+
+var topic = pubsub.NewTopic[*Event]("topic", pubsub.TopicConfig{
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+
+var _ = pubsub.NewSubscription(topic, "sub", pubsub.SubscriptionConfig[*Event]{
+    Handler: func(ctx context.Context, event *Event) error {
+        req := encore.CurrentRequest()
+        rlog.Info("pubsub event",
+            "type", req.Type,
+            "msg", req.Message,
+        )
+        return nil
+    },
+})
diff --git a/e2e-tests/testdata/testscript/et_mocking.txt b/e2e-tests/testdata/testscript/et_mocking.txt
new file mode 100644
index 0000000000..aaac881be8
--- /dev/null
+++ b/e2e-tests/testdata/testscript/et_mocking.txt
@@ -0,0 +1,196 @@
+test
+
+-- products/price.go --
+package products
+
+import (
+    "context"
+)
+
+type PriceParams struct {
+    Quantity int
+}
+
+type PriceResult struct {
+    Total float64
+}
+
+//encore:api public method=GET path=/products/:productID/price
+func GetPrice(ctx context.Context, productID int, p *PriceParams) (*PriceResult, error) {
+    return &PriceResult{ Total: 99.99 * float64(p.Quantity) }, nil
+}
+
+-- shoppingcart/cart.go --
+package shoppingcart
+
+import (
+    "context"
+
+    "test/products"
+)
+
+type CartItem struct {
+    ProductID int
+    Quantity int
+}
+
+//encore:service
+type Service struct {
+    Items []CartItem
+}
+
+func initService() (*Service, error) {
+    return &Service{
+        Items: []CartItem{
+            { ProductID: 1, Quantity: 2 },
+            { ProductID: 2, Quantity: 1 },
+        },
+    }, nil
+}
+
+type TotalResult struct {
+    Total float64
+}
+
+//encore:api public method=GET path=/cart/total
+func (s *Service) Total(ctx context.Context) (*TotalResult, error) {
+    var total float64
+
+    for _, item := range s.Items {
+        price, err := products.GetPrice(ctx, item.ProductID, &products.PriceParams{ Quantity: item.Quantity })
+        if err != nil {
+            return nil, err
+        }
+
+        total += price.Total
+    }
+
+    return &TotalResult{ Total: total }, nil
+}
+
+//encore:api private
+func (s *Service) Empty(ctx context.Context) error {
+    s.Items = []CartItem{}
+    return nil
+}
+
+-- shoppingcart/cart_test.go --
+package shoppingcart
+
+import (
+    "context"
+    "math"
+    "testing"
+
+    "encore.dev/et"
+
+    "test/products"
+)
+
+func callAndExpect(t *testing.T, total float64) {
+    resp, err := Total(context.Background())
+    if err != nil {
+        t.Fatal(err)
+    }
+
+    if math.Abs(resp.Total - total) > 0.001 {
+        t.Fatalf("expected total to be %f, got %f", total, resp.Total)
+    }
+}
+
+func TestTotal_NoMocking(t *testing.T) {
+    t.Parallel()
+
+    callAndExpect(t, 299.97)
+}
+
+func TestTotal_WithMockingOfProductsEndpoint(t *testing.T) {
+    t.Parallel()
+
+    et.MockEndpoint(products.GetPrice, func(ctx context.Context, productID int, p *products.PriceParams) (*products.PriceResult, error) {
+       return &products.PriceResult{ Total: 20 * float64(p.Quantity) }, nil
+    })
+
+    callAndExpect(t, 60.0)
+}
+
+func TestTotal_WithMockingOfServiceMethod(t *testing.T) {
+    t.Parallel()
+
+    et.MockEndpoint(Total, func(ctx context.Context) (*TotalResult, error) {
+        return &TotalResult{ Total: 100.0 }, nil
+    })
+
+    callAndExpect(t, 100.0)
+}
+
+func TestTotal_WithMockingOfServiceObjectWithDifferentInstance(t *testing.T) {
+    t.Parallel()
+
+    et.MockService("shoppingcart", &Service{
+        Items: []CartItem{
+            { ProductID: 1, Quantity: 5 },
+        },
+    })
+
+    callAndExpect(t, 499.95)
+}
+
+func TestTotal_WithMockingOfServiceWithMockObject(t *testing.T) {
+    t.Parallel()
+
+    et.MockService[products.Interface]("products", &mockProducts{})
+
+    callAndExpect(t, 303.0)
+}
+
+type mockProducts struct{}
+
+func (m *mockProducts) GetPrice(ctx context.Context, productID int, p *products.PriceParams) (*products.PriceResult, error) {
+    return &products.PriceResult{ Total: float64(productID) + float64(p.Quantity * 100) }, nil
+}
+
+func TestTotal_UsingServiceIsolation(t *testing.T) {
+    t.Parallel()
+
+    callAndExpect(t, 299.97)
+
+    // These don't run with parallel so we can test the isolation
+    t.Run("emptied in isolation", func(t *testing.T) {
+        et.EnableServiceInstanceIsolation()
+        Empty(context.Background())
+        callAndExpect(t, 0.0)
+    })
+
+    t.Run("non isolated still has items", func(t *testing.T) {
+        callAndExpect(t, 299.97)
+    })
+}
+
+func TestTotal_RemovingMockServices(t *testing.T) {
+    t.Parallel()
+
+    et.MockService[products.Interface]("products", &mockProducts{})
+
+    t.Run("remove mock", func(t *testing.T) {
+        et.MockService[products.Interface]("products", nil)
+        callAndExpect(t, 299.97)
+    })
+
+    callAndExpect(t, 303.0)
+}
+
+func TestTotal_RemovingMockEndpoints(t *testing.T) {
+    t.Parallel()
+
+    et.MockEndpoint(products.GetPrice, func(ctx context.Context, productID int, p *products.PriceParams) (*products.PriceResult, error) {
+       return &products.PriceResult{ Total: 20 * float64(p.Quantity) }, nil
+    })
+
+    t.Run("remove mock", func(t *testing.T) {
+        et.MockEndpoint(products.GetPrice, nil)
+        callAndExpect(t, 299.97)
+    })
+
+    callAndExpect(t, 60.0)
+}
diff --git a/e2e-tests/testdata/testscript/et_override_user.txt b/e2e-tests/testdata/testscript/et_override_user.txt
new file mode 100644
index 0000000000..a0c34cfde1
--- /dev/null
+++ b/e2e-tests/testdata/testscript/et_override_user.txt
@@ -0,0 +1,80 @@
+test
+
+-- svc/svc_test.go --
+package svc
+
+import (
+    "context"
+    "testing"
+    "encore.dev/beta/auth"
+    "encore.dev/et"
+)
+
+func TestOverrideAuthInfo(t *testing.T) {
+    curr, _ := auth.UserID()
+    if curr != "" {
+        t.Fatalf("got uid %q, want %q", curr, "")
+    }
+
+    et.OverrideAuthInfo("foo", nil)
+
+    curr, _ = auth.UserID()
+    if curr != "foo" {
+        t.Fatalf("got uid %q, want %q", curr, "foo")
+    }
+}
+
+func TestOverrideAuthInfo_ResetBetweenTests(t *testing.T) {
+    curr, _ := auth.UserID()
+    if curr != "" {
+        t.Fatalf("got uid %q, want %q", curr, "")
+    }
+}
+
+func TestOverrideAuthInfo_PropagatesToAPICalls(t *testing.T) {
+    resp, err := GetUser(context.Background())
+    if err != nil {
+        t.Fatal(err)
+    } else if resp.UserID != "" {
+        t.Fatalf("got uid %q, want %q", resp.UserID, "")
+    }
+
+    et.OverrideAuthInfo("foo", nil)
+
+    resp, err = GetUser(context.Background())
+    if err != nil {
+        t.Fatal(err)
+    } else if resp.UserID != "foo" {
+        t.Fatalf("got uid %q, want %q", resp.UserID, "foo")
+    }
+}
+
+func TestOverrideAuthInfo_APICallOptsOverride(t *testing.T) {
+    et.OverrideAuthInfo("foo", nil)
+
+    ctx := auth.WithContext(context.Background(), "bar", nil)
+    resp, err := GetUser(ctx)
+    if err != nil {
+        t.Fatal(err)
+    } else if resp.UserID != "bar" {
+        t.Fatalf("got uid %q, want %q", resp.UserID, "bar")
+    }
+}
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/beta/auth"
+)
+
+type Response struct {
+    UserID auth.UID
+}
+
+//encore:api public
+func GetUser(ctx context.Context) (*Response, error) {
+    uid, _ := auth.UserID()
+    return &Response{UserID: uid}, nil
+}
diff --git a/e2e-tests/testdata/testscript/et_override_user_authdata.txt b/e2e-tests/testdata/testscript/et_override_user_authdata.txt
new file mode 100644
index 0000000000..886f07efe0
--- /dev/null
+++ b/e2e-tests/testdata/testscript/et_override_user_authdata.txt
@@ -0,0 +1,91 @@
+test
+
+-- svc/svc_test.go --
+package svc
+
+import (
+    "context"
+    "testing"
+    "encore.dev/beta/auth"
+    "encore.dev/et"
+)
+
+func TestOverrideAuthInfo(t *testing.T) {
+    curr, _ := auth.Data().(*AuthData)
+    if curr != nil {
+        t.Fatalf("got data %+v, want nil", curr)
+    }
+
+    et.OverrideAuthInfo("foo", &AuthData{"email"})
+
+    curr = auth.Data().(*AuthData)
+    if curr == nil || curr.Email != "email" {
+        t.Fatalf("got data %+v, want %q", curr, &AuthData{"email"})
+    }
+}
+
+func TestOverrideAuthInfo_ResetBetweenTests(t *testing.T) {
+    curr  := auth.Data()
+    if curr != nil {
+        t.Fatalf("got data %+v, want nil", curr)
+    }
+}
+
+func TestOverrideAuthInfo_PropagatesToAPICalls(t *testing.T) {
+    resp, err := GetUser(context.Background())
+    if err != nil {
+        t.Fatal(err)
+    } else if resp.Data != nil {
+        t.Fatalf("got data %+v, want nil", resp.Data)
+    }
+
+    et.OverrideAuthInfo("foo", &AuthData{"email"})
+
+    resp, err = GetUser(context.Background())
+    if err != nil {
+        t.Fatal(err)
+    } else if resp.Data == nil || resp.Data.Email != "email" {
+        t.Fatalf("got data %+v, want %+v", resp.Data, &AuthData{"email"})
+    }
+}
+
+func TestOverrideAuthInfo_APICallOptsOverride(t *testing.T) {
+    et.OverrideAuthInfo("foo", &AuthData{"email"})
+
+    ctx := auth.WithContext(context.Background(), "bar", &AuthData{"email2"})
+    resp, err := GetUser(ctx)
+    if err != nil {
+        t.Fatal(err)
+    } else if resp.Data == nil || resp.Data.Email != "email2" {
+        t.Fatalf("got data %+v, want %+v", resp.Data, &AuthData{"email2"})
+    }
+}
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/beta/auth"
+)
+
+type Response struct {
+    UserID auth.UID
+    Data *AuthData
+}
+
+//encore:api public
+func GetUser(ctx context.Context) (*Response, error) {
+    uid, _ := auth.UserID()
+    data, _ := auth.Data().(*AuthData)
+    return &Response{UserID: uid, Data: data}, nil
+}
+
+type AuthData struct {
+    Email string
+}
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, token string) (auth.UID, *AuthData, error) {
+    return "hello", &AuthData{Email: "hello@example.org"}, nil
+}
diff --git a/e2e-tests/testdata/testscript/experiment_local_secrets_override.txtar b/e2e-tests/testdata/testscript/experiment_local_secrets_override.txtar
new file mode 100644
index 0000000000..bf9a4f6917
--- /dev/null
+++ b/e2e-tests/testdata/testscript/experiment_local_secrets_override.txtar
@@ -0,0 +1,25 @@
+env ENCORE_EXPERIMENT=local-secrets-override
+run
+call GET /svc.GetFoo
+checkresp '{"Data": "bar"}'
+
+-- svc/svc.go --
+package svc
+
+import "context"
+
+type Resp struct {
+	Data string
+}
+
+var secrets struct {
+	Foo string
+}
+
+//encore:api public
+func GetFoo(ctx context.Context) (*Resp, error) {
+	return &Resp{Data: secrets.Foo}, nil
+}
+
+-- .secrets.local.cue --
+Foo: "bar"
diff --git a/e2e-tests/testdata/testscript/fallback_routes.txt b/e2e-tests/testdata/testscript/fallback_routes.txt
new file mode 100644
index 0000000000..82a799e0f0
--- /dev/null
+++ b/e2e-tests/testdata/testscript/fallback_routes.txt
@@ -0,0 +1,33 @@
+run
+call GET /v1/regular ''
+checkresp '{"Message":"Hello, Encore world!"}'
+call GET /v1/regular/foo ''
+checkresp '{"fallback": true}'
+call POST /v1/regular ''
+checkresp '{"fallback": true}'
+call GET /v2/regular ''
+checkresp '{"fallback": true}'
+call GET / ''
+checkresp '{"fallback": true}'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "net/http"
+)
+
+//encore:api public raw path=/!fallback
+func Fallback(w http.ResponseWriter, req *http.Request) {
+    w.Write([]byte(`{"fallback": true}`))
+}
+
+type Response struct {
+    Message string
+}
+
+//encore:api public method=GET path=/v1/regular
+func Regular(ctx context.Context) (*Response, error) {
+    return &Response{Message: "Hello, Encore world!"}, nil
+}
diff --git a/e2e-tests/testdata/testscript/graceful_shutdown.txt b/e2e-tests/testdata/testscript/graceful_shutdown.txt
new file mode 100644
index 0000000000..3a5d7a791d
--- /dev/null
+++ b/e2e-tests/testdata/testscript/graceful_shutdown.txt
@@ -0,0 +1,19 @@
+run
+shutdown
+checklog '{"message": "shutting down"}'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "encore.dev/shutdown"
+    "encore.dev/rlog"
+)
+
+//encore:service
+type Service struct{}
+
+func (s *Service) Shutdown(p shutdown.Progress) error {
+    rlog.Info("shutting down")
+    return nil
+}
diff --git a/e2e-tests/testdata/testscript/pubsub_method_handler.txt b/e2e-tests/testdata/testscript/pubsub_method_handler.txt
new file mode 100644
index 0000000000..3aaea34ac0
--- /dev/null
+++ b/e2e-tests/testdata/testscript/pubsub_method_handler.txt
@@ -0,0 +1,52 @@
+run
+publish pointer '{"Data": "test"}'
+publish non-pointer '{"Data": "test"}'
+checklog '{"topic": "pointer", "subscription": "pointer", "event": {"Data": "test"}, "message": "pointer method"}'
+checklog '{"topic": "non-pointer", "subscription": "non-pointer", "event": {"Data": "test"}, "message": "non-pointer method"}'
+
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/rlog"
+    "encore.dev/pubsub"
+)
+
+//encore:service
+type Service struct{}
+
+func (s *Service) PointerMethod(ctx context.Context, event *Event) error {
+    rlog.Info("pointer method", "event", event)
+    return nil
+}
+
+func (s Service) NonPointerMethod(ctx context.Context, event *Event) error {
+    rlog.Info("non-pointer method", "event", event)
+    return nil
+}
+
+type Event struct {
+    Data string
+}
+
+var Pointer = pubsub.NewTopic[*Event]("pointer", pubsub.TopicConfig{
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+
+var NonPointer = pubsub.NewTopic[*Event]("non-pointer", pubsub.TopicConfig{
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+
+var _ = pubsub.NewSubscription(Pointer, "pointer",
+    pubsub.SubscriptionConfig[*Event]{
+        Handler: pubsub.MethodHandler((*Service).PointerMethod),
+    },
+)
+
+var _ = pubsub.NewSubscription(NonPointer, "non-pointer",
+    pubsub.SubscriptionConfig[*Event]{
+        Handler: pubsub.MethodHandler(Service.NonPointerMethod),
+    },
+)
diff --git a/e2e-tests/testdata/testscript/pubsub_ref.txt b/e2e-tests/testdata/testscript/pubsub_ref.txt
new file mode 100644
index 0000000000..a7221b5eeb
--- /dev/null
+++ b/e2e-tests/testdata/testscript/pubsub_ref.txt
@@ -0,0 +1,47 @@
+test
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/pubsub"
+)
+
+type Msg struct{Message string}
+
+var Topic = pubsub.NewTopic[Msg]("topic", pubsub.TopicConfig{DeliveryGuarantee: pubsub.AtLeastOnce})
+
+//encore:api
+func Dummy(context.Context) error { return nil }
+
+-- svc/svc_test.go --
+package svc
+
+import (
+    "context"
+    "testing"
+    "encore.dev/et"
+    "encore.dev/pubsub"
+)
+
+func TestRefPublish(t *testing.T) {
+    ref := pubsub.TopicRef[pubsub.Publisher[Msg]](Topic)
+    ref.Publish(context.Background(), Msg{Message: "test"})
+
+    msgs := et.Topic(Topic).PublishedMessages()
+    if len(msgs) != 1 || msgs[0].Message != "test" {
+        t.Fatalf("got %v, want %v", msgs, []Msg{{Message: "test"}})
+    }
+
+    meta := ref.Meta()
+    want := pubsub.TopicMeta{
+        Name: "topic",
+        Config: pubsub.TopicConfig{
+            DeliveryGuarantee: pubsub.AtLeastOnce,
+        },
+    }
+    if meta != want {
+        t.Fatalf("got meta %v, want %v", meta, want)
+    }
+}
diff --git a/e2e-tests/testdata/testscript/ts_hello.txt b/e2e-tests/testdata/testscript/ts_hello.txt
new file mode 100644
index 0000000000..d89e8dcf39
--- /dev/null
+++ b/e2e-tests/testdata/testscript/ts_hello.txt
@@ -0,0 +1,69 @@
+run
+call GET /hello/world ''
+checkresp '{"message": "Hello world"}'
+shutdown
+
+-- encore.app --
+{"lang": "typescript"}
+
+-- package.json --
+{
+  "name": "encore-ts-testapp",
+  "private": true,
+  "version": "0.0.1",
+  "description": "Encore Typescript Test app",
+  "license": "MPL-2.0",
+  "type": "module",
+  "scripts": {
+    "test": "vitest"
+  },
+  "devDependencies": {
+    "@types/node": "^22.5.7",
+    "typescript": "^5.4",
+    "vitest": "^3.1.3"
+  },
+  "dependencies": {
+    "encore.dev": "1.50.0"
+  },
+  "optionalDependencies": {
+    "@rollup/rollup-linux-x64-gnu": "^4.13.0"
+  }
+}
+
+-- tsconfig.json --
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "compilerOptions": {
+    "lib": ["ES2022"],
+    "target": "ES2022",
+    "module": "ES2022",
+    "types": ["node"],
+    "paths": {
+      "~encore/*": ["./encore.gen/*"]
+    },
+    "composite": true,
+    "strict": true,
+    "moduleResolution": "bundler",
+    "allowSyntheticDefaultImports": true,
+    "isolatedModules": true,
+    "sourceMap": true,
+    "declaration": true,
+    "forceConsistentCasingInFileNames": true,
+    "skipLibCheck": true
+  }
+}
+
+-- myservice/encore.service.ts --
+import { Service } from "encore.dev/service";
+
+export default new Service("myservice");
+
+-- myservice/api.ts --
+import { api } from "encore.dev/api";
+
+export const hello = api(
+  { expose: true, method: "GET", path: "/hello/:name" },
+  async ({ name }: { name: string }): Promise<{ message: string }> => {
+    return { message: `Hello ${name}` };
+  }
+);
diff --git a/e2e-tests/testdata/testscript/ts_worker_pooling.txt b/e2e-tests/testdata/testscript/ts_worker_pooling.txt
new file mode 100644
index 0000000000..7e413ad18a
--- /dev/null
+++ b/e2e-tests/testdata/testscript/ts_worker_pooling.txt
@@ -0,0 +1,74 @@
+run
+call GET /hello/world ''
+checkresp '{"message": "Hello world"}'
+shutdown
+
+-- encore.app --
+{
+  "lang": "typescript",
+  "build": {
+    "worker_pooling": true
+  }
+}
+
+-- package.json --
+{
+  "name": "encore-ts-testapp",
+  "private": true,
+  "version": "0.0.1",
+  "description": "Encore Typescript Test app",
+  "license": "MPL-2.0",
+  "type": "module",
+  "scripts": {
+    "test": "vitest"
+  },
+  "devDependencies": {
+    "@types/node": "^22.5.7",
+    "typescript": "^5.4",
+    "vitest": "^3.1.3"
+  },
+  "dependencies": {
+    "encore.dev": "1.50.0"
+  },
+  "optionalDependencies": {
+    "@rollup/rollup-linux-x64-gnu": "^4.13.0"
+  }
+}
+
+-- tsconfig.json --
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "compilerOptions": {
+    "lib": ["ES2022"],
+    "target": "ES2022",
+    "module": "ES2022",
+    "types": ["node"],
+    "paths": {
+      "~encore/*": ["./encore.gen/*"]
+    },
+    "composite": true,
+    "strict": true,
+    "moduleResolution": "bundler",
+    "allowSyntheticDefaultImports": true,
+    "isolatedModules": true,
+    "sourceMap": true,
+    "declaration": true,
+    "forceConsistentCasingInFileNames": true,
+    "skipLibCheck": true
+  }
+}
+
+-- myservice/encore.service.ts --
+import { Service } from "encore.dev/service";
+
+export default new Service("myservice");
+
+-- myservice/api.ts --
+import { api } from "encore.dev/api";
+
+export const hello = api(
+  { expose: true, method: "GET", path: "/hello/:name" },
+  async ({ name }: { name: string }): Promise<{ message: string }> => {
+    return { message: `Hello ${name}` };
+  }
+);
diff --git a/e2e-tests/testdata/tsapp/.gitignore b/e2e-tests/testdata/tsapp/.gitignore
new file mode 100644
index 0000000000..be690cafe2
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/.gitignore
@@ -0,0 +1,5 @@
+encore.gen.go
+encore.gen.cue
+/.encore
+/encore.gen
+node_modules
diff --git a/e2e-tests/testdata/tsapp/encore.app b/e2e-tests/testdata/tsapp/encore.app
new file mode 100644
index 0000000000..513f0ce406
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/encore.app
@@ -0,0 +1 @@
+{"lang": "typescript"}
diff --git a/e2e-tests/testdata/tsapp/package-lock.json b/e2e-tests/testdata/tsapp/package-lock.json
new file mode 100644
index 0000000000..a29faa9d7a
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/package-lock.json
@@ -0,0 +1,1594 @@
+{
+  "name": "encore-ts-testapp",
+  "version": "0.0.1",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "encore-ts-testapp",
+      "version": "0.0.1",
+      "license": "MPL-2.0",
+      "dependencies": {
+        "encore.dev": "file:/home/fredr/projects/encoredev/encore/runtimes/js/encore.dev"
+      },
+      "devDependencies": {
+        "@types/node": "^22.5.7",
+        "typescript": "^5.4",
+        "vitest": "^3.1.3"
+      },
+      "optionalDependencies": {
+        "@rollup/rollup-linux-x64-gnu": "^4.13.0"
+      }
+    },
+    "../../../runtimes/js/encore.dev": {
+      "version": "0.0.0-devel.202311141645",
+      "license": "MPL-2.0",
+      "devDependencies": {
+        "@types/node": "^20.11.19",
+        "tsc-esm-fix": "^2.20.26",
+        "typescript": "^5.3.3"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@esbuild/aix-ppc64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.10.tgz",
+      "integrity": "sha512-0NFWnA+7l41irNuaSVlLfgNT12caWJVLzp5eAVhZ0z1qpxbockccEt3s+149rE64VUI3Ml2zt8Nv5JVc4QXTsw==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "aix"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.10.tgz",
+      "integrity": "sha512-dQAxF1dW1C3zpeCDc5KqIYuZ1tgAdRXNoZP7vkBIRtKZPYe2xVr/d3SkirklCHudW1B45tGiUlz2pUWDfbDD4w==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-arm64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.10.tgz",
+      "integrity": "sha512-LSQa7eDahypv/VO6WKohZGPSJDq5OVOo3UoFR1E4t4Gj1W7zEQMUhI+lo81H+DtB+kP+tDgBp+M4oNCwp6kffg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/android-x64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.10.tgz",
+      "integrity": "sha512-MiC9CWdPrfhibcXwr39p9ha1x0lZJ9KaVfvzA0Wxwz9ETX4v5CHfF09bx935nHlhi+MxhA63dKRRQLiVgSUtEg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-arm64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.10.tgz",
+      "integrity": "sha512-JC74bdXcQEpW9KkV326WpZZjLguSZ3DfS8wrrvPMHgQOIEIG/sPXEN/V8IssoJhbefLRcRqw6RQH2NnpdprtMA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/darwin-x64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.10.tgz",
+      "integrity": "sha512-tguWg1olF6DGqzws97pKZ8G2L7Ig1vjDmGTwcTuYHbuU6TTjJe5FXbgs5C1BBzHbJ2bo1m3WkQDbWO2PvamRcg==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-arm64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.10.tgz",
+      "integrity": "sha512-3ZioSQSg1HT2N05YxeJWYR+Libe3bREVSdWhEEgExWaDtyFbbXWb49QgPvFH8u03vUPX10JhJPcz7s9t9+boWg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/freebsd-x64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.10.tgz",
+      "integrity": "sha512-LLgJfHJk014Aa4anGDbh8bmI5Lk+QidDmGzuC2D+vP7mv/GeSN+H39zOf7pN5N8p059FcOfs2bVlrRr4SK9WxA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.10.tgz",
+      "integrity": "sha512-oR31GtBTFYCqEBALI9r6WxoU/ZofZl962pouZRTEYECvNF/dtXKku8YXcJkhgK/beU+zedXfIzHijSRapJY3vg==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-arm64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.10.tgz",
+      "integrity": "sha512-5luJWN6YKBsawd5f9i4+c+geYiVEw20FVW5x0v1kEMWNq8UctFjDiMATBxLvmmHA4bf7F6hTRaJgtghFr9iziQ==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ia32": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.10.tgz",
+      "integrity": "sha512-NrSCx2Kim3EnnWgS4Txn0QGt0Xipoumb6z6sUtl5bOEZIVKhzfyp/Lyw4C1DIYvzeW/5mWYPBFJU3a/8Yr75DQ==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-loong64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.10.tgz",
+      "integrity": "sha512-xoSphrd4AZda8+rUDDfD9J6FUMjrkTz8itpTITM4/xgerAZZcFW7Dv+sun7333IfKxGG8gAq+3NbfEMJfiY+Eg==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-mips64el": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.10.tgz",
+      "integrity": "sha512-ab6eiuCwoMmYDyTnyptoKkVS3k8fy/1Uvq7Dj5czXI6DF2GqD2ToInBI0SHOp5/X1BdZ26RKc5+qjQNGRBelRA==",
+      "cpu": [
+        "mips64el"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-ppc64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.10.tgz",
+      "integrity": "sha512-NLinzzOgZQsGpsTkEbdJTCanwA5/wozN9dSgEl12haXJBzMTpssebuXR42bthOF3z7zXFWH1AmvWunUCkBE4EA==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-riscv64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.10.tgz",
+      "integrity": "sha512-FE557XdZDrtX8NMIeA8LBJX3dC2M8VGXwfrQWU7LB5SLOajfJIxmSdyL/gU1m64Zs9CBKvm4UAuBp5aJ8OgnrA==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-s390x": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.10.tgz",
+      "integrity": "sha512-3BBSbgzuB9ajLoVZk0mGu+EHlBwkusRmeNYdqmznmMc9zGASFjSsxgkNsqmXugpPk00gJ0JNKh/97nxmjctdew==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/linux-x64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.10.tgz",
+      "integrity": "sha512-QSX81KhFoZGwenVyPoberggdW1nrQZSvfVDAIUXr3WqLRZGZqWk/P4T8p2SP+de2Sr5HPcvjhcJzEiulKgnxtA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-arm64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.10.tgz",
+      "integrity": "sha512-AKQM3gfYfSW8XRk8DdMCzaLUFB15dTrZfnX8WXQoOUpUBQ+NaAFCP1kPS/ykbbGYz7rxn0WS48/81l9hFl3u4A==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/netbsd-x64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.10.tgz",
+      "integrity": "sha512-7RTytDPGU6fek/hWuN9qQpeGPBZFfB4zZgcz2VK2Z5VpdUxEI8JKYsg3JfO0n/Z1E/6l05n0unDCNc4HnhQGig==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "netbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-arm64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.10.tgz",
+      "integrity": "sha512-5Se0VM9Wtq797YFn+dLimf2Zx6McttsH2olUBsDml+lm0GOCRVebRWUvDtkY4BWYv/3NgzS8b/UM3jQNh5hYyw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openbsd-x64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.10.tgz",
+      "integrity": "sha512-XkA4frq1TLj4bEMB+2HnI0+4RnjbuGZfet2gs/LNs5Hc7D89ZQBHQ0gL2ND6Lzu1+QVkjp3x1gIcPKzRNP8bXw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openbsd"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/openharmony-arm64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.10.tgz",
+      "integrity": "sha512-AVTSBhTX8Y/Fz6OmIVBip9tJzZEUcY8WLh7I59+upa5/GPhh2/aM6bvOMQySspnCCHvFi79kMtdJS1w0DXAeag==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/sunos-x64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.10.tgz",
+      "integrity": "sha512-fswk3XT0Uf2pGJmOpDB7yknqhVkJQkAQOcW/ccVOtfx05LkbWOaRAtn5SaqXypeKQra1QaEa841PgrSL9ubSPQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "sunos"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-arm64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.10.tgz",
+      "integrity": "sha512-ah+9b59KDTSfpaCg6VdJoOQvKjI33nTaQr4UluQwW7aEwZQsbMCfTmfEO4VyewOxx4RaDT/xCy9ra2GPWmO7Kw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-ia32": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.10.tgz",
+      "integrity": "sha512-QHPDbKkrGO8/cz9LKVnJU22HOi4pxZnZhhA2HYHez5Pz4JeffhDjf85E57Oyco163GnzNCVkZK0b/n4Y0UHcSw==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@esbuild/win32-x64": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.10.tgz",
+      "integrity": "sha512-9KpxSVFCu0iK1owoez6aC/s/EdUQLDN3adTxGCqxMVhrPDj6bt5dbrHDXUuq+Bs2vATFBBrQS5vdQ/Ed2P+nbw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ],
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.5.5",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+      "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@rollup/rollup-android-arm-eabi": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.52.2.tgz",
+      "integrity": "sha512-o3pcKzJgSGt4d74lSZ+OCnHwkKBeAbFDmbEm5gg70eA8VkyCuC/zV9TwBnmw6VjDlRdF4Pshfb+WE9E6XY1PoQ==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-android-arm64": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.52.2.tgz",
+      "integrity": "sha512-cqFSWO5tX2vhC9hJTK8WAiPIm4Q8q/cU8j2HQA0L3E1uXvBYbOZMhE2oFL8n2pKB5sOCHY6bBuHaRwG7TkfJyw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "android"
+      ]
+    },
+    "node_modules/@rollup/rollup-darwin-arm64": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.52.2.tgz",
+      "integrity": "sha512-vngduywkkv8Fkh3wIZf5nFPXzWsNsVu1kvtLETWxTFf/5opZmflgVSeLgdHR56RQh71xhPhWoOkEBvbehwTlVA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-darwin-x64": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.52.2.tgz",
+      "integrity": "sha512-h11KikYrUCYTrDj6h939hhMNlqU2fo/X4NB0OZcys3fya49o1hmFaczAiJWVAFgrM1NCP6RrO7lQKeVYSKBPSQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ]
+    },
+    "node_modules/@rollup/rollup-freebsd-arm64": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.52.2.tgz",
+      "integrity": "sha512-/eg4CI61ZUkLXxMHyVlmlGrSQZ34xqWlZNW43IAU4RmdzWEx0mQJ2mN/Cx4IHLVZFL6UBGAh+/GXhgvGb+nVxw==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-freebsd-x64": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.52.2.tgz",
+      "integrity": "sha512-QOWgFH5X9+p+S1NAfOqc0z8qEpJIoUHf7OWjNUGOeW18Mx22lAUOiA9b6r2/vpzLdfxi/f+VWsYjUOMCcYh0Ng==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "freebsd"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.52.2.tgz",
+      "integrity": "sha512-kDWSPafToDd8LcBYd1t5jw7bD5Ojcu12S3uT372e5HKPzQt532vW+rGFFOaiR0opxePyUkHrwz8iWYEyH1IIQA==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.52.2.tgz",
+      "integrity": "sha512-gKm7Mk9wCv6/rkzwCiUC4KnevYhlf8ztBrDRT9g/u//1fZLapSRc+eDZj2Eu2wpJ+0RzUKgtNijnVIB4ZxyL+w==",
+      "cpu": [
+        "arm"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm64-gnu": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.52.2.tgz",
+      "integrity": "sha512-66lA8vnj5mB/rtDNwPgrrKUOtCLVQypkyDa2gMfOefXK6rcZAxKLO9Fy3GkW8VkPnENv9hBkNOFfGLf6rNKGUg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-arm64-musl": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.52.2.tgz",
+      "integrity": "sha512-s+OPucLNdJHvuZHuIz2WwncJ+SfWHFEmlC5nKMUgAelUeBUnlB4wt7rXWiyG4Zn07uY2Dd+SGyVa9oyLkVGOjA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-loong64-gnu": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.52.2.tgz",
+      "integrity": "sha512-8wTRM3+gVMDLLDdaT6tKmOE3lJyRy9NpJUS/ZRWmLCmOPIJhVyXwjBo+XbrrwtV33Em1/eCTd5TuGJm4+DmYjw==",
+      "cpu": [
+        "loong64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-ppc64-gnu": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.52.2.tgz",
+      "integrity": "sha512-6yqEfgJ1anIeuP2P/zhtfBlDpXUb80t8DpbYwXQ3bQd95JMvUaqiX+fKqYqUwZXqdJDd8xdilNtsHM2N0cFm6A==",
+      "cpu": [
+        "ppc64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.52.2.tgz",
+      "integrity": "sha512-sshYUiYVSEI2B6dp4jMncwxbrUqRdNApF2c3bhtLAU0qA8Lrri0p0NauOsTWh3yCCCDyBOjESHMExonp7Nzc0w==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-riscv64-musl": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.52.2.tgz",
+      "integrity": "sha512-duBLgd+3pqC4MMwBrKkFxaZerUxZcYApQVC5SdbF5/e/589GwVvlRUnyqMFbM8iUSb1BaoX/3fRL7hB9m2Pj8Q==",
+      "cpu": [
+        "riscv64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-s390x-gnu": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.52.2.tgz",
+      "integrity": "sha512-tzhYJJidDUVGMgVyE+PmxENPHlvvqm1KILjjZhB8/xHYqAGeizh3GBGf9u6WdJpZrz1aCpIIHG0LgJgH9rVjHQ==",
+      "cpu": [
+        "s390x"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-gnu": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.52.2.tgz",
+      "integrity": "sha512-opH8GSUuVcCSSyHHcl5hELrmnk4waZoVpgn/4FDao9iyE4WpQhyWJ5ryl5M3ocp4qkRuHfyXnGqg8M9oKCEKRA==",
+      "cpu": [
+        "x64"
+      ],
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-linux-x64-musl": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.52.2.tgz",
+      "integrity": "sha512-LSeBHnGli1pPKVJ79ZVJgeZWWZXkEe/5o8kcn23M8eMKCUANejchJbF/JqzM4RRjOJfNRhKJk8FuqL1GKjF5oQ==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "linux"
+      ]
+    },
+    "node_modules/@rollup/rollup-openharmony-arm64": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.52.2.tgz",
+      "integrity": "sha512-uPj7MQ6/s+/GOpolavm6BPo+6CbhbKYyZHUDvZ/SmJM7pfDBgdGisFX3bY/CBDMg2ZO4utfhlApkSfZ92yXw7Q==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "openharmony"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-arm64-msvc": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.52.2.tgz",
+      "integrity": "sha512-Z9MUCrSgIaUeeHAiNkm3cQyst2UhzjPraR3gYYfOjAuZI7tcFRTOD+4cHLPoS/3qinchth+V56vtqz1Tv+6KPA==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-ia32-msvc": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.52.2.tgz",
+      "integrity": "sha512-+GnYBmpjldD3XQd+HMejo+0gJGwYIOfFeoBQv32xF/RUIvccUz20/V6Otdv+57NE70D5pa8W/jVGDoGq0oON4A==",
+      "cpu": [
+        "ia32"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-x64-gnu": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.52.2.tgz",
+      "integrity": "sha512-ApXFKluSB6kDQkAqZOKXBjiaqdF1BlKi+/eqnYe9Ee7U2K3pUDKsIyr8EYm/QDHTJIM+4X+lI0gJc3TTRhd+dA==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@rollup/rollup-win32-x64-msvc": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.52.2.tgz",
+      "integrity": "sha512-ARz+Bs8kY6FtitYM96PqPEVvPXqEZmPZsSkXvyX19YzDqkCaIlhCieLLMI5hxO9SRZ2XtCtm8wxhy0iJ2jxNfw==",
+      "cpu": [
+        "x64"
+      ],
+      "dev": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "win32"
+      ]
+    },
+    "node_modules/@types/chai": {
+      "version": "5.2.2",
+      "resolved": "https://registry.npmjs.org/@types/chai/-/chai-5.2.2.tgz",
+      "integrity": "sha512-8kB30R7Hwqf40JPiKhVzodJs2Qc1ZJ5zuT3uzw5Hq/dhNCl3G3l83jfpdI1e20BP348+fV7VIL/+FxaXkqBmWg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/deep-eql": "*"
+      }
+    },
+    "node_modules/@types/deep-eql": {
+      "version": "4.0.2",
+      "resolved": "https://registry.npmjs.org/@types/deep-eql/-/deep-eql-4.0.2.tgz",
+      "integrity": "sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/estree": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
+      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/@types/node": {
+      "version": "22.18.6",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.18.6.tgz",
+      "integrity": "sha512-r8uszLPpeIWbNKtvWRt/DbVi5zbqZyj1PTmhRMqBMvDnaz1QpmSKujUtJLrqGZeoM8v72MfYggDceY4K1itzWQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/@vitest/expect": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/@vitest/expect/-/expect-3.2.4.tgz",
+      "integrity": "sha512-Io0yyORnB6sikFlt8QW5K7slY4OjqNX9jmJQ02QDda8lyM6B5oNgVWoSoKPac8/kgnCUzuHQKrSLtu/uOqqrig==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/chai": "^5.2.2",
+        "@vitest/spy": "3.2.4",
+        "@vitest/utils": "3.2.4",
+        "chai": "^5.2.0",
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/mocker": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/@vitest/mocker/-/mocker-3.2.4.tgz",
+      "integrity": "sha512-46ryTE9RZO/rfDd7pEqFl7etuyzekzEhUbTW3BvmeO/BcCMEgq59BKhek3dXDWgAj4oMK6OZi+vRr1wPW6qjEQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/spy": "3.2.4",
+        "estree-walker": "^3.0.3",
+        "magic-string": "^0.30.17"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "msw": "^2.4.9",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0"
+      },
+      "peerDependenciesMeta": {
+        "msw": {
+          "optional": true
+        },
+        "vite": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/@vitest/pretty-format": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/@vitest/pretty-format/-/pretty-format-3.2.4.tgz",
+      "integrity": "sha512-IVNZik8IVRJRTr9fxlitMKeJeXFFFN0JaB9PHPGQ8NKQbGpfjlTx9zO4RefN8gp7eqjNy8nyK3NZmBzOPeIxtA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/runner": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/@vitest/runner/-/runner-3.2.4.tgz",
+      "integrity": "sha512-oukfKT9Mk41LreEW09vt45f8wx7DordoWUZMYdY/cyAk7w5TWkTRCNZYF7sX7n2wB7jyGAl74OxgwhPgKaqDMQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/utils": "3.2.4",
+        "pathe": "^2.0.3",
+        "strip-literal": "^3.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/snapshot": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/@vitest/snapshot/-/snapshot-3.2.4.tgz",
+      "integrity": "sha512-dEYtS7qQP2CjU27QBC5oUOxLE/v5eLkGqPE0ZKEIDGMs4vKWe7IjgLOeauHsR0D5YuuycGRO5oSRXnwnmA78fQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "3.2.4",
+        "magic-string": "^0.30.17",
+        "pathe": "^2.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/spy": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/@vitest/spy/-/spy-3.2.4.tgz",
+      "integrity": "sha512-vAfasCOe6AIK70iP5UD11Ac4siNUNJ9i/9PZ3NKx07sG6sUxeag1LWdNrMWeKKYBLlzuK+Gn65Yd5nyL6ds+nw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "tinyspy": "^4.0.3"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/@vitest/utils": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/@vitest/utils/-/utils-3.2.4.tgz",
+      "integrity": "sha512-fB2V0JFrQSMsCo9HiSq3Ezpdv4iYaXRG1Sx8edX3MwxfyNn83mKiGzOcH+Fkxt4MHxr3y42fQi1oeAInqgX2QA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@vitest/pretty-format": "3.2.4",
+        "loupe": "^3.1.4",
+        "tinyrainbow": "^2.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/assertion-error": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/assertion-error/-/assertion-error-2.0.1.tgz",
+      "integrity": "sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      }
+    },
+    "node_modules/cac": {
+      "version": "6.7.14",
+      "resolved": "https://registry.npmjs.org/cac/-/cac-6.7.14.tgz",
+      "integrity": "sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/chai": {
+      "version": "5.3.3",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-5.3.3.tgz",
+      "integrity": "sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "assertion-error": "^2.0.1",
+        "check-error": "^2.1.1",
+        "deep-eql": "^5.0.1",
+        "loupe": "^3.1.0",
+        "pathval": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=18"
+      }
+    },
+    "node_modules/check-error": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/check-error/-/check-error-2.1.1.tgz",
+      "integrity": "sha512-OAlb+T7V4Op9OwdkjmguYRqncdlx5JiofwOAUkmTF+jNdHwzTaTs4sRAGpzLF3oOz5xAyDGrPgeIDFQmDOTiJw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 16"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.4.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+      "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "ms": "^2.1.3"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/deep-eql": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/deep-eql/-/deep-eql-5.0.2.tgz",
+      "integrity": "sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/encore.dev": {
+      "resolved": "../../../runtimes/js/encore.dev",
+      "link": true
+    },
+    "node_modules/es-module-lexer": {
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-1.7.0.tgz",
+      "integrity": "sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/esbuild": {
+      "version": "0.25.10",
+      "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.10.tgz",
+      "integrity": "sha512-9RiGKvCwaqxO2owP61uQ4BgNborAQskMR6QusfWzQqv7AZOg5oGehdY2pRJMTKuwxd1IDBP4rSbI5lHzU7SMsQ==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "bin": {
+        "esbuild": "bin/esbuild"
+      },
+      "engines": {
+        "node": ">=18"
+      },
+      "optionalDependencies": {
+        "@esbuild/aix-ppc64": "0.25.10",
+        "@esbuild/android-arm": "0.25.10",
+        "@esbuild/android-arm64": "0.25.10",
+        "@esbuild/android-x64": "0.25.10",
+        "@esbuild/darwin-arm64": "0.25.10",
+        "@esbuild/darwin-x64": "0.25.10",
+        "@esbuild/freebsd-arm64": "0.25.10",
+        "@esbuild/freebsd-x64": "0.25.10",
+        "@esbuild/linux-arm": "0.25.10",
+        "@esbuild/linux-arm64": "0.25.10",
+        "@esbuild/linux-ia32": "0.25.10",
+        "@esbuild/linux-loong64": "0.25.10",
+        "@esbuild/linux-mips64el": "0.25.10",
+        "@esbuild/linux-ppc64": "0.25.10",
+        "@esbuild/linux-riscv64": "0.25.10",
+        "@esbuild/linux-s390x": "0.25.10",
+        "@esbuild/linux-x64": "0.25.10",
+        "@esbuild/netbsd-arm64": "0.25.10",
+        "@esbuild/netbsd-x64": "0.25.10",
+        "@esbuild/openbsd-arm64": "0.25.10",
+        "@esbuild/openbsd-x64": "0.25.10",
+        "@esbuild/openharmony-arm64": "0.25.10",
+        "@esbuild/sunos-x64": "0.25.10",
+        "@esbuild/win32-arm64": "0.25.10",
+        "@esbuild/win32-ia32": "0.25.10",
+        "@esbuild/win32-x64": "0.25.10"
+      }
+    },
+    "node_modules/estree-walker": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/estree-walker/-/estree-walker-3.0.3.tgz",
+      "integrity": "sha512-7RUKfXgSMMkzt6ZuXmqapOurLGPPfgj6l9uRZ7lRGolvk0y2yocc35LdcxKC5PQZdn2DMqioAQ2NoWcrTKmm6g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "^1.0.0"
+      }
+    },
+    "node_modules/expect-type": {
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/expect-type/-/expect-type-1.2.2.tgz",
+      "integrity": "sha512-JhFGDVJ7tmDJItKhYgJCGLOWjuK9vPxiXoUFLwLDc99NlmklilbiQJwoctZtt13+xMw91MCk/REan6MWHqDjyA==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=12.0.0"
+      }
+    },
+    "node_modules/fdir": {
+      "version": "6.5.0",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
+      "integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "peerDependencies": {
+        "picomatch": "^3 || ^4"
+      },
+      "peerDependenciesMeta": {
+        "picomatch": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.3",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
+      "integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
+      "dev": true,
+      "hasInstallScript": true,
+      "license": "MIT",
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/js-tokens": {
+      "version": "9.0.1",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-9.0.1.tgz",
+      "integrity": "sha512-mxa9E9ITFOt0ban3j6L5MpjwegGz6lBQmM1IJkWeBZGcMxto50+eWdjC/52xDbS2vy0k7vIMK0Fe2wfL9OQSpQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/loupe": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/loupe/-/loupe-3.2.1.tgz",
+      "integrity": "sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/magic-string": {
+      "version": "0.30.19",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.19.tgz",
+      "integrity": "sha512-2N21sPY9Ws53PZvsEpVtNuSW+ScYbQdp4b9qUaL+9QkHUrGFKo56Lg9Emg5s9V/qrtNBmiR01sYhUOwu3H+VOw==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.11",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
+      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/pathe": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/pathe/-/pathe-2.0.3.tgz",
+      "integrity": "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/pathval": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/pathval/-/pathval-2.0.1.tgz",
+      "integrity": "sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">= 14.16"
+      }
+    },
+    "node_modules/picocolors": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+      "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/picomatch": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz",
+      "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/postcss": {
+      "version": "8.5.6",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz",
+      "integrity": "sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/postcss/"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/postcss"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "nanoid": "^3.3.11",
+        "picocolors": "^1.1.1",
+        "source-map-js": "^1.2.1"
+      },
+      "engines": {
+        "node": "^10 || ^12 || >=14"
+      }
+    },
+    "node_modules/rollup": {
+      "version": "4.52.2",
+      "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.52.2.tgz",
+      "integrity": "sha512-I25/2QgoROE1vYV+NQ1En9T9UFB9Cmfm2CJ83zZOlaDpvz29wGQSZXWKw7MiNXau7wYgB/T9fVIdIuEQ+KbiiA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/estree": "1.0.8"
+      },
+      "bin": {
+        "rollup": "dist/bin/rollup"
+      },
+      "engines": {
+        "node": ">=18.0.0",
+        "npm": ">=8.0.0"
+      },
+      "optionalDependencies": {
+        "@rollup/rollup-android-arm-eabi": "4.52.2",
+        "@rollup/rollup-android-arm64": "4.52.2",
+        "@rollup/rollup-darwin-arm64": "4.52.2",
+        "@rollup/rollup-darwin-x64": "4.52.2",
+        "@rollup/rollup-freebsd-arm64": "4.52.2",
+        "@rollup/rollup-freebsd-x64": "4.52.2",
+        "@rollup/rollup-linux-arm-gnueabihf": "4.52.2",
+        "@rollup/rollup-linux-arm-musleabihf": "4.52.2",
+        "@rollup/rollup-linux-arm64-gnu": "4.52.2",
+        "@rollup/rollup-linux-arm64-musl": "4.52.2",
+        "@rollup/rollup-linux-loong64-gnu": "4.52.2",
+        "@rollup/rollup-linux-ppc64-gnu": "4.52.2",
+        "@rollup/rollup-linux-riscv64-gnu": "4.52.2",
+        "@rollup/rollup-linux-riscv64-musl": "4.52.2",
+        "@rollup/rollup-linux-s390x-gnu": "4.52.2",
+        "@rollup/rollup-linux-x64-gnu": "4.52.2",
+        "@rollup/rollup-linux-x64-musl": "4.52.2",
+        "@rollup/rollup-openharmony-arm64": "4.52.2",
+        "@rollup/rollup-win32-arm64-msvc": "4.52.2",
+        "@rollup/rollup-win32-ia32-msvc": "4.52.2",
+        "@rollup/rollup-win32-x64-gnu": "4.52.2",
+        "@rollup/rollup-win32-x64-msvc": "4.52.2",
+        "fsevents": "~2.3.2"
+      }
+    },
+    "node_modules/siginfo": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/siginfo/-/siginfo-2.0.0.tgz",
+      "integrity": "sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==",
+      "dev": true,
+      "license": "ISC"
+    },
+    "node_modules/source-map-js": {
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/stackback": {
+      "version": "0.0.2",
+      "resolved": "https://registry.npmjs.org/stackback/-/stackback-0.0.2.tgz",
+      "integrity": "sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/std-env": {
+      "version": "3.9.0",
+      "resolved": "https://registry.npmjs.org/std-env/-/std-env-3.9.0.tgz",
+      "integrity": "sha512-UGvjygr6F6tpH7o2qyqR6QYpwraIjKSdtzyBdyytFOHmPZY917kwdwLG0RbOjWOnKmnm3PeHjaoLLMie7kPLQw==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/strip-literal": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/strip-literal/-/strip-literal-3.0.0.tgz",
+      "integrity": "sha512-TcccoMhJOM3OebGhSBEmp3UZ2SfDMZUEBdRA/9ynfLi8yYajyWX3JiXArcJt4Umh4vISpspkQIY8ZZoCqjbviA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "js-tokens": "^9.0.1"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/antfu"
+      }
+    },
+    "node_modules/tinybench": {
+      "version": "2.9.0",
+      "resolved": "https://registry.npmjs.org/tinybench/-/tinybench-2.9.0.tgz",
+      "integrity": "sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tinyexec": {
+      "version": "0.3.2",
+      "resolved": "https://registry.npmjs.org/tinyexec/-/tinyexec-0.3.2.tgz",
+      "integrity": "sha512-KQQR9yN7R5+OSwaK0XQoj22pwHoTlgYqmUscPYoknOoWCWfj/5/ABTMRi69FrKU5ffPVh5QcFikpWJI/P1ocHA==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/tinyglobby": {
+      "version": "0.2.15",
+      "resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.15.tgz",
+      "integrity": "sha512-j2Zq4NyQYG5XMST4cbs02Ak8iJUdxRM0XI5QyxXuZOzKOINmWurp3smXu3y5wDcJrptwpSjgXHzIQxR0omXljQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.3"
+      },
+      "engines": {
+        "node": ">=12.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/SuperchupuDev"
+      }
+    },
+    "node_modules/tinypool": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/tinypool/-/tinypool-1.1.1.tgz",
+      "integrity": "sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "^18.0.0 || >=20.0.0"
+      }
+    },
+    "node_modules/tinyrainbow": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/tinyrainbow/-/tinyrainbow-2.0.0.tgz",
+      "integrity": "sha512-op4nsTR47R6p0vMUUoYl/a+ljLFVtlfaXkLQmqfLR1qHma1h/ysYk4hEXZ880bf2CYgTskvTa/e196Vd5dDQXw==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/tinyspy": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/tinyspy/-/tinyspy-4.0.4.tgz",
+      "integrity": "sha512-azl+t0z7pw/z958Gy9svOTuzqIk6xq+NSheJzn5MMWtWTFywIacg2wUlzKFGtt3cthx0r2SxMK0yzJOR0IES7Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/typescript": {
+      "version": "5.9.2",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.2.tgz",
+      "integrity": "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "dev": true,
+      "license": "MIT"
+    },
+    "node_modules/vite": {
+      "version": "7.1.7",
+      "resolved": "https://registry.npmjs.org/vite/-/vite-7.1.7.tgz",
+      "integrity": "sha512-VbA8ScMvAISJNJVbRDTJdCwqQoAareR/wutevKanhR2/1EkoXVZVkkORaYm/tNVCjP/UDTKtcw3bAkwOUdedmA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "esbuild": "^0.25.0",
+        "fdir": "^6.5.0",
+        "picomatch": "^4.0.3",
+        "postcss": "^8.5.6",
+        "rollup": "^4.43.0",
+        "tinyglobby": "^0.2.15"
+      },
+      "bin": {
+        "vite": "bin/vite.js"
+      },
+      "engines": {
+        "node": "^20.19.0 || >=22.12.0"
+      },
+      "funding": {
+        "url": "https://github.com/vitejs/vite?sponsor=1"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.3"
+      },
+      "peerDependencies": {
+        "@types/node": "^20.19.0 || >=22.12.0",
+        "jiti": ">=1.21.0",
+        "less": "^4.0.0",
+        "lightningcss": "^1.21.0",
+        "sass": "^1.70.0",
+        "sass-embedded": "^1.70.0",
+        "stylus": ">=0.54.8",
+        "sugarss": "^5.0.0",
+        "terser": "^5.16.0",
+        "tsx": "^4.8.1",
+        "yaml": "^2.4.2"
+      },
+      "peerDependenciesMeta": {
+        "@types/node": {
+          "optional": true
+        },
+        "jiti": {
+          "optional": true
+        },
+        "less": {
+          "optional": true
+        },
+        "lightningcss": {
+          "optional": true
+        },
+        "sass": {
+          "optional": true
+        },
+        "sass-embedded": {
+          "optional": true
+        },
+        "stylus": {
+          "optional": true
+        },
+        "sugarss": {
+          "optional": true
+        },
+        "terser": {
+          "optional": true
+        },
+        "tsx": {
+          "optional": true
+        },
+        "yaml": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/vite-node": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/vite-node/-/vite-node-3.2.4.tgz",
+      "integrity": "sha512-EbKSKh+bh1E1IFxeO0pg1n4dvoOTt0UDiXMd/qn++r98+jPO1xtJilvXldeuQ8giIB5IkpjCgMleHMNEsGH6pg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "cac": "^6.7.14",
+        "debug": "^4.4.1",
+        "es-module-lexer": "^1.7.0",
+        "pathe": "^2.0.3",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0"
+      },
+      "bin": {
+        "vite-node": "vite-node.mjs"
+      },
+      "engines": {
+        "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      }
+    },
+    "node_modules/vitest": {
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/vitest/-/vitest-3.2.4.tgz",
+      "integrity": "sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@types/chai": "^5.2.2",
+        "@vitest/expect": "3.2.4",
+        "@vitest/mocker": "3.2.4",
+        "@vitest/pretty-format": "^3.2.4",
+        "@vitest/runner": "3.2.4",
+        "@vitest/snapshot": "3.2.4",
+        "@vitest/spy": "3.2.4",
+        "@vitest/utils": "3.2.4",
+        "chai": "^5.2.0",
+        "debug": "^4.4.1",
+        "expect-type": "^1.2.1",
+        "magic-string": "^0.30.17",
+        "pathe": "^2.0.3",
+        "picomatch": "^4.0.2",
+        "std-env": "^3.9.0",
+        "tinybench": "^2.9.0",
+        "tinyexec": "^0.3.2",
+        "tinyglobby": "^0.2.14",
+        "tinypool": "^1.1.1",
+        "tinyrainbow": "^2.0.0",
+        "vite": "^5.0.0 || ^6.0.0 || ^7.0.0-0",
+        "vite-node": "3.2.4",
+        "why-is-node-running": "^2.3.0"
+      },
+      "bin": {
+        "vitest": "vitest.mjs"
+      },
+      "engines": {
+        "node": "^18.0.0 || ^20.0.0 || >=22.0.0"
+      },
+      "funding": {
+        "url": "https://opencollective.com/vitest"
+      },
+      "peerDependencies": {
+        "@edge-runtime/vm": "*",
+        "@types/debug": "^4.1.12",
+        "@types/node": "^18.0.0 || ^20.0.0 || >=22.0.0",
+        "@vitest/browser": "3.2.4",
+        "@vitest/ui": "3.2.4",
+        "happy-dom": "*",
+        "jsdom": "*"
+      },
+      "peerDependenciesMeta": {
+        "@edge-runtime/vm": {
+          "optional": true
+        },
+        "@types/debug": {
+          "optional": true
+        },
+        "@types/node": {
+          "optional": true
+        },
+        "@vitest/browser": {
+          "optional": true
+        },
+        "@vitest/ui": {
+          "optional": true
+        },
+        "happy-dom": {
+          "optional": true
+        },
+        "jsdom": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/why-is-node-running": {
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/why-is-node-running/-/why-is-node-running-2.3.0.tgz",
+      "integrity": "sha512-hUrmaWBdVDcxvYqnyh09zunKzROWjbZTiNy8dBEjkS7ehEDQibXJ7XvlmtbwuTclUiIyN+CyXQD4Vmko8fNm8w==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "siginfo": "^2.0.0",
+        "stackback": "0.0.2"
+      },
+      "bin": {
+        "why-is-node-running": "cli.js"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    }
+  }
+}
diff --git a/e2e-tests/testdata/tsapp/package.json b/e2e-tests/testdata/tsapp/package.json
new file mode 100644
index 0000000000..064379d0e2
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/package.json
@@ -0,0 +1,22 @@
+{
+  "name": "encore-ts-testapp",
+  "private": true,
+  "version": "0.0.1",
+  "description": "Encore Typescript Test app",
+  "license": "MPL-2.0",
+  "type": "module",
+  "scripts": {
+    "test": "vitest"
+  },
+  "devDependencies": {
+    "@types/node": "^22.5.7",
+    "typescript": "^5.4",
+    "vitest": "^3.1.3"
+  },
+  "dependencies": {
+    "encore.dev": "1.50.0"
+  },
+  "optionalDependencies": {
+    "@rollup/rollup-linux-x64-gnu": "^4.13.0"
+  }
+}
diff --git a/e2e-tests/testdata/tsapp/service1/api.test.ts b/e2e-tests/testdata/tsapp/service1/api.test.ts
new file mode 100644
index 0000000000..3ca809fae6
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/service1/api.test.ts
@@ -0,0 +1,9 @@
+import { describe, expect, it } from "vitest";
+import { hello } from "./api";
+
+describe("get", () => {
+  it("should combine string with parameter value", async () => {
+    const resp = await hello({ name: "world" });
+    expect(resp.message).toBe("Hello world");
+  });
+});
diff --git a/e2e-tests/testdata/tsapp/service1/api.ts b/e2e-tests/testdata/tsapp/service1/api.ts
new file mode 100644
index 0000000000..63e2ed45ef
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/service1/api.ts
@@ -0,0 +1,70 @@
+import { api, HttpStatus } from "encore.dev/api";
+import { APICallMeta, currentRequest } from "encore.dev";
+import { service2 } from "~encore/clients";
+import log from "encore.dev/log";
+
+export const hello = api(
+  { expose: true, method: "GET", path: "/hello/:name" },
+  async ({ name }: { name: string }): Promise<{ message: string }> => {
+    return { message: `Hello ${name}` };
+  }
+);
+
+// Endpoint that demonstrates middleware data access
+export const middlewareDemo = api(
+  { expose: true, method: "GET", path: "/middleware-test", tags: ["mwtest"] },
+  async (): Promise<{
+    message: string;
+    middlewareMsg: string;
+  }> => {
+    const req = currentRequest() as APICallMeta;
+
+    return {
+      message: "Hello",
+      middlewareMsg: req.middlewareData?.customMsg || "Not set"
+    };
+  }
+);
+
+// Service-to-service call: Get greeting from service2
+export const getGreetingViaService2 = api(
+  { expose: true, method: "POST", path: "/get-greeting" },
+  async (req: {
+    name: string;
+    style?: "formal" | "casual" | "excited";
+  }): Promise<{
+    message: string;
+    greeting: string;
+  }> => {
+    try {
+      const result = await service2.greet({
+        name: req.name,
+        style: req.style || "formal"
+      });
+
+      return {
+        message: "Greeting retrieved successfully via service-to-service call",
+        greeting: result.greeting
+      };
+    } catch (error) {
+      log.error("Failed to get greeting via service call", { error });
+      throw new Error(
+        "Service-to-service call failed: " + (error as Error).message
+      );
+    }
+  }
+);
+
+// Endpoint with custom HTTP status
+export const customStatus = api(
+  { expose: true, method: "GET", path: "/test-custom-status" },
+  async (): Promise<{
+    message: string;
+    status: HttpStatus;
+  }> => {
+    return {
+      message: "I accept!",
+      status: 202
+    };
+  }
+);
diff --git a/e2e-tests/testdata/tsapp/service1/encore.service.ts b/e2e-tests/testdata/tsapp/service1/encore.service.ts
new file mode 100644
index 0000000000..b6fc963be1
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/service1/encore.service.ts
@@ -0,0 +1,19 @@
+import { Service } from "encore.dev/service";
+import { middleware } from "encore.dev/api";
+
+// Middleware to add custom data to request
+const dataEnricher = middleware(async (req, next) => {
+  // Add custom data that endpoints can access
+  req.data.customMsg = "Hello from middleware!";
+
+  const resp = await next(req);
+
+  resp.status = 201;
+  resp.header.add("x-test-header", "hello");
+
+  return resp;
+});
+
+export default new Service("service1", {
+  middlewares: [middleware({ target: { tags: ["mwtest"] } }, dataEnricher)]
+});
diff --git a/e2e-tests/testdata/tsapp/service2/api.test.ts b/e2e-tests/testdata/tsapp/service2/api.test.ts
new file mode 100644
index 0000000000..e0870cf162
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/service2/api.test.ts
@@ -0,0 +1,60 @@
+import { describe, expect, it } from "vitest";
+import { testApiError } from "./api";
+
+describe("errors", () => {
+  it("api error with no details with cause", async () => {
+    await expect(
+      testApiError({ variant: "no-details-with-cause" })
+    ).rejects.toThrow(
+      expect.objectContaining({
+        message: "the error",
+        details: undefined,
+        code: "canceled",
+        cause: expect.objectContaining({
+          message: "this is the cause"
+        })
+      })
+    );
+  });
+
+  it("api error with no details no cause", async () => {
+    await expect(
+      testApiError({ variant: "no-details-no-cause" })
+    ).rejects.toThrow(
+      expect.objectContaining({
+        message: "the error",
+        details: undefined,
+        code: "canceled",
+        cause: undefined
+      })
+    );
+  });
+
+  it("api error with details no cause", async () => {
+    await expect(
+      testApiError({ variant: "with-details-no-cause" })
+    ).rejects.toThrow(
+      expect.objectContaining({
+        message: "the error",
+        details: { a: "detail" },
+        code: "canceled",
+        cause: undefined
+      })
+    );
+  });
+
+  it("api error with details with cause", async () => {
+    await expect(
+      testApiError({ variant: "with-details-with-cause" })
+    ).rejects.toThrow(
+      expect.objectContaining({
+        message: "the error",
+        details: { a: "detail" },
+        code: "canceled",
+        cause: expect.objectContaining({
+          message: "this is the cause"
+        })
+      })
+    );
+  });
+});
diff --git a/e2e-tests/testdata/tsapp/service2/api.ts b/e2e-tests/testdata/tsapp/service2/api.ts
new file mode 100644
index 0000000000..67a55e36ea
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/service2/api.ts
@@ -0,0 +1,71 @@
+import { api, HttpStatus } from "encore.dev/api";
+import { IsEmail, MaxLen, MinLen } from "encore.dev/validate";
+import log from "encore.dev/log";
+import { APIError } from "encore.dev/api";
+
+interface GreetingRequest {
+  name: string;
+}
+
+interface GreetingResponse {
+  greeting: string;
+  timestamp: Date;
+}
+
+interface MessageRequest {
+  message: string & MinLen<3> & MaxLen<1000>;
+  recipient?: string & IsEmail;
+}
+
+interface MessageResponse {
+  message: string;
+}
+
+// Generate different greeting styles
+export const greet = api(
+  { expose: true, method: "POST", path: "/greet" },
+  async (req: GreetingRequest): Promise<GreetingResponse> => {
+    let greeting = `Hey ${req.name}! How's it going?`;
+    return {
+      greeting,
+      timestamp: new Date()
+    };
+  }
+);
+
+export const testInputValidation = api(
+  { expose: true, method: "POST", path: "/test-validation" },
+  async (req: MessageRequest): Promise<MessageResponse> => {
+    return {
+      message: `Message processed`
+    };
+  }
+);
+
+export const testApiError = api(
+  { expose: true, method: "GET", path: "/test-api-error/:variant" },
+  async ({ variant }: { variant: string }): Promise<{ message: string }> => {
+    switch (variant) {
+      case "no-details-no-cause":
+        throw APIError.canceled("the error");
+      case "with-details-no-cause":
+        throw APIError.canceled("the error").withDetails({ a: "detail" });
+      case "no-details-with-cause":
+        throw APIError.canceled("the error", new Error("this is the cause"));
+      case "with-details-with-cause":
+        throw APIError.canceled(
+          "the error",
+          new Error("this is the cause")
+        ).withDetails({ a: "detail" });
+      default:
+        return { message: "Hello there" };
+    }
+  }
+);
+
+export const testOtherError = api(
+  { expose: true, method: "GET", path: "/test-other-error" },
+  async (): Promise<{ message: string }> => {
+    throw new Error("This is a test error");
+  }
+);
diff --git a/e2e-tests/testdata/tsapp/service2/encore.service.ts b/e2e-tests/testdata/tsapp/service2/encore.service.ts
new file mode 100644
index 0000000000..c9fc0e5859
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/service2/encore.service.ts
@@ -0,0 +1,3 @@
+import { Service } from "encore.dev/service";
+
+export default new Service("service2");
diff --git a/e2e-tests/testdata/tsapp/tsconfig.json b/e2e-tests/testdata/tsapp/tsconfig.json
new file mode 100644
index 0000000000..a572ce46dc
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/tsconfig.json
@@ -0,0 +1,31 @@
+{
+    "$schema": "https://json.schemastore.org/tsconfig",
+    "compilerOptions": {
+        /* Basic Options */
+        "lib": ["ES2022"],
+        "target": "ES2022",
+        "module": "ES2022",
+        "types": ["node"],
+        "paths": {
+            "~encore/*": ["./encore.gen/*"]
+        },
+
+        /* Workspace Settings */
+        "composite": true,
+
+        /* Strict Type-Checking Options */
+        "strict": true,
+
+        /* Module Resolution Options */
+        "moduleResolution": "bundler",
+        "allowSyntheticDefaultImports": true,
+        "isolatedModules": true,
+        "sourceMap": true,
+
+        "declaration": true,
+
+        /* Advanced Options */
+        "forceConsistentCasingInFileNames": true,
+        "skipLibCheck": true
+    }
+}
diff --git a/e2e-tests/testdata/tsapp/vite.config.ts b/e2e-tests/testdata/tsapp/vite.config.ts
new file mode 100644
index 0000000000..c312369805
--- /dev/null
+++ b/e2e-tests/testdata/tsapp/vite.config.ts
@@ -0,0 +1,11 @@
+/// <reference types="vitest" />
+import { defineConfig } from "vite";
+import path from "path";
+
+export default defineConfig({
+  resolve: {
+    alias: {
+      "~encore": path.resolve(__dirname, "./encore.gen")
+    }
+  }
+});
diff --git a/e2e-tests/testscript_test.go b/e2e-tests/testscript_test.go
new file mode 100644
index 0000000000..5a2f7cb2fc
--- /dev/null
+++ b/e2e-tests/testscript_test.go
@@ -0,0 +1,378 @@
+//go:build e2e
+
+package tests
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/nsqio/go-nsq"
+	ts "github.com/rogpeppe/go-internal/testscript"
+
+	"encr.dev/cli/daemon/run"
+	"encr.dev/pkg/golden"
+)
+
+// headerRe matches valid headers in the form "Header=value".
+var headerRe = regexp.MustCompile(`^([A-Z][A-Za-z0-9-]*)=([^ ]*)$`)
+
+func TestRun(t *testing.T) {
+	doRun(t, nil)
+}
+
+func doRun(t *testing.T, experiments []string) {
+	runtimePath := os.Getenv("ENCORE_RUNTIMES_PATH")
+	goroot := os.Getenv("ENCORE_GOROOT")
+	if testing.Short() {
+		t.Skip("skipping in short mode")
+	} else if runtimePath == "" || goroot == "" {
+		t.Skipf("skipping due to missing ENCORE_RUNTIMES_PATH=%q or ENCORE_GOROOT=%q", runtimePath, goroot)
+	}
+
+	home := t.TempDir()
+
+	ts.Run(t, ts.Params{
+		Dir: "testdata/testscript",
+		Setup: func(e *ts.Env) error {
+			e.Setenv("ENCORE_RUNTIMES_PATH", runtimePath)
+			e.Setenv("ENCORE_GOROOT", goroot)
+			e.Setenv("EXTRA_EXPERIMENTS", strings.Join(experiments, ","))
+			e.Setenv("HOME", home)
+			e.Setenv("GOFLAGS", "-modcacherw")
+			gomod := []byte("module test\n\ngo 1.21.0\n\nrequire encore.dev v1.13.4")
+			if err := os.WriteFile(filepath.Join(e.WorkDir, "go.mod"), gomod, 0755); err != nil {
+				return err
+			}
+
+			if err := runGoModTidy(e.WorkDir); err != nil {
+				return err
+			}
+
+			initVals(e)
+			return nil
+		},
+		Cmds: map[string]func(ts *ts.TestScript, neg bool, args []string){
+			"run": func(ts *ts.TestScript, neg bool, args []string) {
+				log := &testscriptLogger{ts: ts}
+				exp := ts.Getenv("ENCORE_EXPERIMENT")
+				if extra := ts.Getenv("EXTRA_EXPERIMENTS"); extra != "" {
+					if exp != "" {
+						exp += ","
+					}
+					exp += extra
+				}
+
+				env := []string{"ENCORE_EXPERIMENT=" + exp}
+				if nodePath, ok := getNodeJSPath().Get(); ok {
+					env = append(env, "PATH="+nodePath)
+				}
+
+				app := RunApp(getTB(ts), getWorkdir(ts), log, env)
+				setVal(ts, "app", app)
+				setVal(ts, "log", log)
+			},
+			"shutdown": func(ts *ts.TestScript, neg bool, args []string) {
+				app := getVal[*RunAppData](ts, "app")
+				app.Run.ProcGroup().Close()
+			},
+			"test": func(ts *ts.TestScript, neg bool, args []string) {
+				log := &testscriptLogger{ts: ts}
+				exp := ts.Getenv("ENCORE_EXPERIMENT")
+				if extra := ts.Getenv("EXTRA_EXPERIMENTS"); extra != "" {
+					if exp != "" {
+						exp += ","
+					}
+					exp += extra
+				}
+
+				err := RunTests(getTB(ts), getWorkdir(ts), &log.stdout, &log.stderr, []string{"ENCORE_EXPERIMENT=" + exp})
+				_, _ = os.Stdout.Write(log.stdout.Bytes())
+				_, _ = os.Stderr.Write(log.stderr.Bytes())
+				if !neg && err != nil {
+					ts.Fatalf("tests failed: %v", err)
+				} else if neg && err == nil {
+					ts.Fatalf("tests unexpectedly passed: %v", err)
+				}
+				setVal(ts, "log", log)
+			},
+			"call": func(ts *ts.TestScript, neg bool, args []string) {
+				usage := func() {
+					ts.Fatalf("usage: call <method> [Header=value...] <url> [data] [platform-auth]")
+				}
+				if len(args) < 2 {
+					usage()
+				}
+
+				method := args[0]
+				args = args[1:]
+				headers := make(map[string]string)
+				for i, arg := range args {
+					m := headerRe.FindStringSubmatch(arg)
+					if m != nil {
+						headers[m[1]] = m[2]
+					} else {
+						args = args[i:]
+						break
+					}
+				}
+
+				if len(args) == 0 {
+					usage()
+				}
+				app := getVal[*RunAppData](ts, "app")
+				url := "http://" + app.Addr + args[0]
+
+				disablePlatformAuth := false
+
+				var body io.Reader
+				if n := len(args); n > 1 {
+					val := args[1]
+					if val == "no-platform-auth" {
+						disablePlatformAuth = true
+					} else {
+						body = strings.NewReader(val)
+						if n > 2 {
+							if args[2] == "no-platform-auth" {
+								disablePlatformAuth = true
+							} else {
+								ts.Fatalf("unexpected argument %q", args[2])
+							}
+						}
+					}
+				}
+
+				req := httptest.NewRequest(method, url, body)
+				for k, v := range headers {
+					ts.Logf("setting %s=%v", k, v)
+					req.Header.Set(k, v)
+				}
+
+				if disablePlatformAuth {
+					req.Header.Set(run.TestHeaderDisablePlatformAuth, "true")
+				}
+
+				w := httptest.NewRecorder()
+				app.Run.ServeHTTP(w, req)
+				respBody := w.Body.Bytes()
+				_, _ = os.Stdout.Write(respBody)
+
+				if w.Code != http.StatusOK && !neg {
+					ts.Fatalf("unexpected status code: %v: %s", w.Code, respBody)
+				} else if w.Code == http.StatusOK && neg {
+					ts.Fatalf("unexpected status code: %v: %s", w.Code, respBody)
+				}
+				app.Values["call_resp"] = respBody
+			},
+			"publish": func(ts *ts.TestScript, neg bool, args []string) {
+				if len(args) != 2 {
+					ts.Fatalf("usage: publish <topic> <data>")
+				}
+				topicName := args[0]
+				data := args[1]
+
+				app := getVal[*RunAppData](ts, "app")
+				id, _ := app.Values["publish_id"].(int)
+				id++
+
+				app.Values["publish_id"] = id
+				msgData, _ := json.Marshal(messageWrapper{
+					ID:         strconv.Itoa(id),
+					Attributes: nil,
+					Data:       json.RawMessage(data),
+				})
+
+				prod, err := nsq.NewProducer(app.NSQ.Addr(), nsq.NewConfig())
+				if err != nil {
+					ts.Fatalf("unable to create producer: %v", err)
+				}
+				prod.SetLoggerLevel(nsq.LogLevelMax)
+				if err := prod.Publish(topicName, msgData); err != nil {
+					ts.Fatalf("unable to publish: %v", err)
+				}
+
+				// Wait for the message to get processed
+				for i := 0; i < 100; i++ {
+					stats, err := app.NSQ.Stats()
+					if err != nil {
+						ts.Fatalf("unable to get nsq stats: %v", err)
+					}
+					for _, topic := range stats.Topics {
+						if topic.TopicName == topicName {
+							if topic.Depth == 0 {
+								break
+							}
+							ts.Logf("waiting for %q queue to be processed, depth: %d", topic.TopicName, topic.Depth)
+							time.Sleep(100 * time.Millisecond)
+						}
+					}
+				}
+			},
+			"checklog": func(ts *ts.TestScript, neg bool, args []string) {
+				if len(args) != 1 {
+					ts.Fatalf("usage: checklog <pattern|file>")
+				}
+
+				time.Sleep(100 * time.Millisecond)
+
+				var want []jsonObj
+				var pattern jsonObj
+				err := json.Unmarshal([]byte(args[0]), &pattern)
+				if err != nil {
+					if strings.Contains(args[0], "{") {
+						ts.Fatalf("checklog pattern not valid log line: %v", err)
+					}
+
+					fn := ts.ReadFile(args[0])
+					scanner := bufio.NewScanner(strings.NewReader(fn))
+					for scanner.Scan() {
+						var ln jsonObj
+						if err := json.Unmarshal(scanner.Bytes(), &ln); err != nil {
+							ts.Fatalf("invalid log line in checklog script: %s: %v", scanner.Bytes(), err)
+						}
+						want = append(want, ln)
+					}
+				} else {
+					want = []jsonObj{pattern}
+				}
+
+				log := getVal[*testscriptLogger](ts, "log")
+				stderr := log.stderr.String()
+				scanner := bufio.NewScanner(strings.NewReader(stderr))
+
+				seen := make([]bool, len(want))
+				for scanner.Scan() {
+					var got jsonObj
+					if err := json.Unmarshal(scanner.Bytes(), &got); err == nil {
+						for i, ln := range want {
+							if !seen[i] && gotLogLine(got, ln) {
+								seen[i] = true
+							}
+						}
+					}
+				}
+
+				for i, ln := range want {
+					if !neg && !seen[i] {
+						ts.Fatalf("unable to find log line: %v", ln)
+					} else if neg && seen[i] {
+						ts.Fatalf("found log line: %v", ln)
+					}
+				}
+			},
+			"checkresp": func(ts *ts.TestScript, neg bool, args []string) {
+				if len(args) != 1 {
+					ts.Fatalf("usage: checkresp <pattern|file>")
+				}
+
+				var want jsonObj
+				err := json.Unmarshal([]byte(args[0]), &want)
+				if err != nil {
+					if strings.Contains(args[0], "{") {
+						ts.Fatalf("checkresp pattern not valid log line: %v", err)
+					}
+					fn := ts.ReadFile(args[0])
+					if err := json.Unmarshal([]byte(fn), &want); err != nil {
+						ts.Fatalf("invalid json object in checkresp script: %s: %v", fn, err)
+					}
+				}
+
+				app := getVal[*RunAppData](ts, "app")
+
+				var got jsonObj
+				if err := json.Unmarshal(app.Values["call_resp"].([]byte), &got); err != nil {
+					ts.Fatalf("unable to parse response: %v", err)
+				}
+
+				match := gotLogLine(got, want)
+				if !neg && !match {
+					ts.Fatalf("response does not match: got %s, want %s", got, want)
+				} else if neg && match {
+					ts.Fatalf("log line unexpectedly matched")
+				}
+			},
+		},
+	})
+}
+
+func TestMain(m *testing.M) {
+	golden.Setup()
+
+	os.Exit(ts.RunMain(m, nil))
+}
+
+// messageWrapper is the data structure for an NSQ message.
+// It must be synchronized with the nsq/topic.go file in the runtime.
+type messageWrapper struct {
+	ID         string
+	Attributes map[string]string
+	Data       json.RawMessage
+}
+
+type jsonObj = map[string]any
+
+func gotLogLine(got, want any) bool {
+	switch want := want.(type) {
+	case map[string]any:
+		got, ok := got.(map[string]any)
+		if !ok {
+			return false
+		}
+		for k, v := range want {
+			if !gotLogLine(got[k], v) {
+				return false
+			}
+		}
+		return true
+	default:
+		return got == want
+	}
+}
+
+type testscriptLogger struct {
+	ts             *ts.TestScript
+	stdout, stderr bytes.Buffer
+}
+
+func (l *testscriptLogger) RunStdout(r *run.Run, line []byte) {
+	l.ts.Logf("%s", line)
+	l.stdout.Write(line)
+}
+
+func (l *testscriptLogger) RunStderr(r *run.Run, line []byte) {
+	l.ts.Logf("%s", line)
+	l.stderr.Write(line)
+}
+
+func initVals(e *ts.Env) {
+	e.Values["vars"] = map[string]any{
+		"tb": e.T().(testing.TB),
+		"wd": e.WorkDir,
+	}
+}
+
+func getTB(ts *ts.TestScript) testing.TB {
+	return getVal[testing.TB](ts, "tb")
+}
+
+func getWorkdir(ts *ts.TestScript) string {
+	return getVal[string](ts, "wd")
+}
+
+func setVal(ts *ts.TestScript, key string, val any) {
+	ts.Value("vars").(map[string]any)[key] = val
+}
+
+func getVal[T any](ts *ts.TestScript, key string) T {
+	return ts.Value("vars").(map[string]any)[key].(T)
+}
diff --git a/e2e-tests/ts_app_test.go b/e2e-tests/ts_app_test.go
new file mode 100644
index 0000000000..267dd04623
--- /dev/null
+++ b/e2e-tests/ts_app_test.go
@@ -0,0 +1,237 @@
+//go:build e2e
+
+package tests
+
+import (
+	"encoding/json"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+)
+
+func TestTSEndToEndWithApp(t *testing.T) {
+	c := qt.New(t)
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	nodePath, ok := getNodeJSPath().Get()
+	if !ok {
+		c.Fatal("Could not find nodejs binary, it is needed to run typescript apps")
+	}
+
+	appRoot := filepath.Join(wd, "testdata", "tsapp")
+	app := RunApp(c, appRoot, nil, []string{"PATH=" + nodePath})
+	run := app.Run
+
+	// Test basic hello endpoint
+	c.Run("typescript hello endpoint", func(c *qt.C) {
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", "/hello/world", nil)
+		run.ServeHTTP(w, req)
+		c.Assert(w.Code, qt.Equals, 200)
+		c.Assert(w.Body.Bytes(), qt.JSONEquals, map[string]string{
+			"message": "Hello world",
+		})
+	})
+
+	// Test middleware functionality
+	c.Run("middleware demo endpoint", func(c *qt.C) {
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", "/middleware-test", nil)
+		run.ServeHTTP(w, req)
+
+		// status modified by mw
+		c.Assert(w.Code, qt.Equals, 201)
+
+		// header set by mw
+		c.Assert(w.Header().Get("X-Test-Header"), qt.Equals, "hello")
+
+		var response map[string]interface{}
+		err := json.Unmarshal(w.Body.Bytes(), &response)
+		c.Assert(err, qt.IsNil)
+
+		// Verify middleware data is present
+		c.Assert(response["message"], qt.Equals, "Hello")
+		c.Assert(response["middlewareMsg"], qt.Equals, "Hello from middleware!")
+	})
+
+	// Test custom HTTP status - 404 Not Found
+	c.Run("custom HTTP status", func(c *qt.C) {
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", "/test-custom-status", nil)
+		run.ServeHTTP(w, req)
+		c.Assert(w.Code, qt.Equals, 202)
+
+		var response map[string]interface{}
+		err := json.Unmarshal(w.Body.Bytes(), &response)
+		c.Assert(err, qt.IsNil)
+
+		c.Assert(response["message"], qt.Equals, "I accept!")
+	})
+
+	c.Run("service2 greeting endpoint", func(c *qt.C) {
+		requestBody := `{"name": "Bob"}`
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest("POST", "/greet", strings.NewReader(requestBody))
+		req.Header.Set("Content-Type", "application/json")
+		run.ServeHTTP(w, req)
+
+		c.Assert(w.Code, qt.Equals, 200)
+
+		var response map[string]interface{}
+		err := json.Unmarshal(w.Body.Bytes(), &response)
+		c.Assert(err, qt.IsNil)
+
+		c.Assert(response["greeting"], qt.Equals, "Hey Bob! How's it going?")
+	})
+
+	c.Run("service-to-service greeting call", func(c *qt.C) {
+		requestBody := `{"name": "Charlie"}`
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest("POST", "/get-greeting", strings.NewReader(requestBody))
+		req.Header.Set("Content-Type", "application/json")
+		run.ServeHTTP(w, req)
+
+		c.Assert(w.Code, qt.Equals, 200)
+
+		var response map[string]interface{}
+		err := json.Unmarshal(w.Body.Bytes(), &response)
+		c.Assert(err, qt.IsNil)
+
+		c.Assert(response["message"], qt.Equals, "Greeting retrieved successfully via service-to-service call")
+		c.Assert(response["greeting"], qt.Equals, "Hey Charlie! How's it going?")
+	})
+
+	c.Run("service2 input validation - valid", func(c *qt.C) {
+		requestBody := `{"message": "Hello world", "recipient": "test@example.com"}`
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest("POST", "/test-validation", strings.NewReader(requestBody))
+		req.Header.Set("Content-Type", "application/json")
+		run.ServeHTTP(w, req)
+
+		c.Assert(w.Code, qt.Equals, 200)
+
+		var response map[string]interface{}
+		err := json.Unmarshal(w.Body.Bytes(), &response)
+		c.Assert(err, qt.IsNil)
+
+		c.Assert(response["message"], qt.Equals, "Message processed")
+	})
+
+	c.Run("service2 input validation - to short", func(c *qt.C) {
+		requestBody := `{"message": "Hi"}`
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest("POST", "/test-validation", strings.NewReader(requestBody))
+		req.Header.Set("Content-Type", "application/json")
+		run.ServeHTTP(w, req)
+
+		var response map[string]interface{}
+		err := json.Unmarshal(w.Body.Bytes(), &response)
+		c.Assert(err, qt.IsNil)
+
+		c.Assert(response["message"], qt.Contains, "message: length too short")
+
+		// Should return validation error
+		c.Assert(w.Code, qt.Equals, 400)
+	})
+
+	c.Run("service2 input validation - invalid email", func(c *qt.C) {
+		requestBody := `{"message": "Valid message", "recipient": "not-an-email"}`
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest("POST", "/test-validation", strings.NewReader(requestBody))
+		req.Header.Set("Content-Type", "application/json")
+		run.ServeHTTP(w, req)
+
+		var response map[string]interface{}
+		err := json.Unmarshal(w.Body.Bytes(), &response)
+		c.Assert(err, qt.IsNil)
+
+		c.Assert(response["message"], qt.Contains, "value is not an email")
+
+		// Should return validation error
+		c.Assert(w.Code, qt.Equals, 400)
+	})
+
+	// Test error handling
+	c.Run("service2 api errors", func(c *qt.C) {
+		expected := map[string]map[string]interface{}{
+			"no-details-no-cause": {
+				"code":             "canceled",
+				"details":          nil,
+				"internal_message": nil,
+				"message":          "the error",
+			},
+			"with-details-no-cause": {
+				"code": "canceled",
+				"details": map[string]interface{}{
+					"a": "detail",
+				},
+				"internal_message": nil,
+				"message":          "the error",
+			},
+			"no-details-with-cause": {
+				"code":             "canceled",
+				"details":          nil,
+				"internal_message": nil,
+				"message":          "the error: this is the cause",
+			},
+			"with-details-with-cause": {
+				"code": "canceled",
+				"details": map[string]interface{}{
+					"a": "detail",
+				},
+				"internal_message": nil,
+				"message":          "the error: this is the cause",
+			},
+		}
+
+		for path, expected := range expected {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("GET", "/test-api-error/"+path, nil)
+			run.ServeHTTP(w, req)
+			c.Assert(w.Code, qt.Equals, 499)
+
+			var response map[string]interface{}
+			err := json.Unmarshal(w.Body.Bytes(), &response)
+			c.Assert(err, qt.IsNil)
+
+			c.Assert(response["code"], qt.Equals, expected["code"])
+			if expected["details"] == nil {
+				c.Assert(response["details"], qt.IsNil)
+			} else {
+				c.Assert(response["details"], qt.DeepEquals, expected["details"])
+			}
+			c.Assert(response["internal_message"], qt.Equals, expected["internal_message"])
+			c.Assert(response["message"], qt.Equals, expected["message"])
+		}
+
+	})
+
+	c.Run("service2 other errors", func(c *qt.C) {
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest("GET", "/test-other-error/", nil)
+		run.ServeHTTP(w, req)
+		c.Assert(w.Code, qt.Equals, 500)
+
+		var response map[string]interface{}
+		err := json.Unmarshal(w.Body.Bytes(), &response)
+		c.Assert(err, qt.IsNil)
+
+		c.Assert(response["code"], qt.Equals, "internal")
+		c.Assert(response["details"], qt.IsNil)
+		c.Assert(response["internal_message"], qt.Equals, "This is a test error")
+		c.Assert(response["message"], qt.Equals, "an internal error occurred")
+	})
+
+	// Run TypeScript tests
+	c.Run("run TypeScript tests", func(c *qt.C) {
+		err := RunTests(c.TB, appRoot, os.Stdout, os.Stderr, nil)
+		c.Assert(err, qt.IsNil)
+	})
+}
diff --git a/go.mod b/go.mod
index 3ff0b25a4b..af3e3f6265 100644
--- a/go.mod
+++ b/go.mod
@@ -1,39 +1,233 @@
 module encr.dev
 
-go 1.16
+go 1.23.0
+
+toolchain go1.23.3
 
 require (
-	github.com/AlecAivazis/survey/v2 v2.2.8
-	github.com/alecthomas/chroma v0.8.2
-	github.com/briandowns/spinner v1.12.0
-	github.com/fatih/color v1.10.0
+	cloud.google.com/go/storage v1.43.0
+	cuelang.org/go v0.4.3
+	encore.dev v1.1.0
+	github.com/agnivade/levenshtein v1.1.1
+	github.com/alecthomas/chroma v0.10.0
+	github.com/alicebob/miniredis/v2 v2.23.0
+	github.com/bep/debounce v1.2.1
+	github.com/bluele/gcache v0.0.2
+	github.com/briandowns/spinner v1.19.0
+	github.com/cenkalti/backoff/v4 v4.2.1
+	github.com/charmbracelet/bubbles v0.16.1
+	github.com/charmbracelet/bubbletea v0.24.2
+	github.com/charmbracelet/lipgloss v0.7.1
+	github.com/cockroachdb/errors v1.11.1
+	github.com/containerd/stargz-snapshotter/estargz v0.14.3
+	github.com/dave/jennifer v1.7.0
+	github.com/evanw/esbuild v0.19.8
+	github.com/fatih/color v1.15.0
 	github.com/fatih/structtag v1.2.0
-	github.com/frankban/quicktest v1.11.2
-	github.com/gofrs/uuid v4.0.0+incompatible
-	github.com/golang-migrate/migrate/v4 v4.14.1
-	github.com/golang/protobuf v1.4.3
-	github.com/gorilla/websocket v1.4.2
-	github.com/hashicorp/yamux v0.0.0-20200609203250-aecfd211c9ce
-	github.com/jackc/pgproto3/v2 v2.0.7
-	github.com/jackc/pgx/v4 v4.10.1
-	github.com/rjeczalik/notify v0.9.2
-	github.com/rogpeppe/go-internal v1.6.2
-	github.com/rs/zerolog v1.20.0
-	github.com/spf13/cobra v1.1.3
-	github.com/tailscale/hujson v0.0.0-20200924210142-dde312d0d6a2
-	go.uber.org/goleak v1.1.10
-	go4.org v0.0.0-20201209231011-d4a079459e60
-	golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83
-	golang.org/x/mod v0.3.0
-	golang.org/x/net v0.0.0-20210226172049-e18ecbb05110 // indirect
-	golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d
-	golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208
-	golang.org/x/sys v0.0.0-20210303074136-134d130e1a04
-	golang.org/x/tools v0.0.0-20200825202427-b303f430e36d
-	golang.zx2c4.com/wireguard v0.0.20201118
-	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20200609130330-bd2cb7843e1b
-	golang.zx2c4.com/wireguard/windows v0.3.1
-	google.golang.org/genproto v0.0.0-20201030142918-24207fddd1c3
-	google.golang.org/grpc v1.33.2
-	google.golang.org/protobuf v1.25.0
+	github.com/fmstephe/unsafeutil v1.0.0
+	github.com/frankban/quicktest v1.14.6
+	github.com/fsnotify/fsnotify v1.8.0
+	github.com/getkin/kin-openapi v0.115.0
+	github.com/gofrs/uuid v4.4.0+incompatible
+	github.com/golang-migrate/migrate/v4 v4.15.2
+	github.com/golang/protobuf v1.5.4
+	github.com/google/btree v1.1.3
+	github.com/google/go-cmp v0.7.0
+	github.com/google/go-containerregistry v0.20.2
+	github.com/google/renameio/v2 v2.0.0
+	github.com/gorilla/mux v1.8.1
+	github.com/gorilla/websocket v1.5.0
+	github.com/hashicorp/go-multierror v1.1.1
+	github.com/hasura/go-graphql-client v0.12.1
+	github.com/jackc/pgconn v1.14.3
+	github.com/jackc/pgproto3/v2 v2.3.3
+	github.com/jackc/pgx/v5 v5.7.4
+	github.com/json-iterator/go v1.1.12
+	github.com/julienschmidt/httprouter v1.3.0
+	github.com/jwalton/go-supportscolor v1.1.0
+	github.com/knadh/koanf/parsers/toml/v2 v2.1.0
+	github.com/knadh/koanf/providers/file v1.1.2
+	github.com/knadh/koanf/providers/rawbytes v0.1.0
+	github.com/knadh/koanf/v2 v2.1.2
+	github.com/lib/pq v1.10.9
+	github.com/logrusorgru/aurora v2.0.3+incompatible
+	github.com/logrusorgru/aurora/v3 v3.0.0
+	github.com/mattn/go-runewidth v0.0.15
+	github.com/mattn/go-sqlite3 v1.14.18
+	github.com/modern-go/reflect2 v1.0.2
+	github.com/nsqio/go-nsq v1.1.0
+	github.com/nsqio/nsq v1.2.1
+	github.com/pelletier/go-toml v1.9.5
+	github.com/peterbourgon/diskv v2.0.1+incompatible
+	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8
+	github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e
+	github.com/pkg/errors v0.9.1
+	github.com/robfig/cron/v3 v3.0.1
+	github.com/rogpeppe/go-internal v1.13.1
+	github.com/rs/xid v1.6.0
+	github.com/rs/zerolog v1.34.0
+	github.com/spf13/cobra v1.9.1
+	github.com/spf13/pflag v1.0.6
+	github.com/sqlc-dev/sqlc v1.29.0
+	github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a
+	go.encore.dev/platform-sdk v1.1.0
+	go.uber.org/goleak v1.3.0
+	go4.org v0.0.0-20230225012048-214862532bf5
+	golang.org/x/crypto v0.36.0
+	golang.org/x/exp v0.0.0-20250305212735-054e65f0b394
+	golang.org/x/mod v0.24.0
+	golang.org/x/net v0.38.0
+	golang.org/x/oauth2 v0.25.0
+	golang.org/x/sync v0.13.0
+	golang.org/x/sys v0.31.0
+	golang.org/x/term v0.30.0
+	golang.org/x/text v0.23.0
+	golang.org/x/tools v0.31.0
+	google.golang.org/api v0.200.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f
+	google.golang.org/grpc v1.71.1
+	google.golang.org/protobuf v1.36.6
+	gotest.tools/v3 v3.5.1
+	sigs.k8s.io/yaml v1.3.0
+)
+
+require (
+	cel.dev/expr v0.19.1 // indirect
+	filippo.io/edwards25519 v1.1.0 // indirect
+	github.com/ncruces/go-strftime v0.1.9 // indirect
+	github.com/pganalyze/pg_query_go/v6 v6.1.0 // indirect
+	github.com/spf13/cast v1.7.1 // indirect
+	github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52 // indirect
+	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
 )
+
+require (
+	cloud.google.com/go v0.115.1 // indirect
+	cloud.google.com/go/auth v0.9.8 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.4 // indirect
+	cloud.google.com/go/compute/metadata v0.6.0 // indirect
+	cloud.google.com/go/iam v1.2.1 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
+	github.com/Microsoft/go-winio v0.6.1 // indirect
+	github.com/algolia/algoliasearch-client-go/v3 v3.31.4
+	github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
+	github.com/atotto/clipboard v0.1.4 // indirect
+	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
+	github.com/benbjohnson/clock v1.3.5 // indirect
+	github.com/blang/semver v3.5.1+incompatible // indirect
+	github.com/bmizerany/perks v0.0.0-20141205001514-d9a9656a3a4b // indirect
+	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/cockroachdb/apd/v2 v2.0.2 // indirect
+	github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b // indirect
+	github.com/cockroachdb/redact v1.1.5 // indirect
+	github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 // indirect
+	github.com/cubicdaiya/gonp v1.0.4 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/dlclark/regexp2 v1.7.0 // indirect
+	github.com/docker/cli v27.1.1+incompatible // indirect
+	github.com/docker/distribution v2.8.2+incompatible // indirect
+	github.com/docker/docker v24.0.7+incompatible // indirect
+	github.com/docker/docker-credential-helpers v0.8.0 // indirect
+	github.com/docker/go-connections v0.4.0 // indirect
+	github.com/docker/go-units v0.5.0 // indirect
+	github.com/dustin/go-humanize v1.0.1 // indirect
+	github.com/emicklei/proto v1.9.2 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
+	github.com/getsentry/sentry-go v0.25.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/go-openapi/jsonpointer v0.20.0 // indirect
+	github.com/go-openapi/swag v0.22.4 // indirect
+	github.com/go-redis/redis/v8 v8.11.5 // indirect
+	github.com/go-sql-driver/mysql v1.9.2 // indirect
+	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
+	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/golang/glog v1.2.4 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/snappy v0.0.4 // indirect
+	github.com/google/cel-go v0.24.1 // indirect
+	github.com/google/s2a-go v0.1.8 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.4 // indirect
+	github.com/googleapis/gax-go/v2 v2.13.0 // indirect
+	github.com/hashicorp/errwrap v1.1.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/invopop/yaml v0.1.0 // indirect
+	github.com/jackc/chunkreader/v2 v2.0.1 // indirect
+	github.com/jackc/pgio v1.0.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
+	github.com/jackc/puddle/v2 v2.2.2 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/josharian/intern v1.0.0 // indirect
+	github.com/klauspost/compress v1.17.2 // indirect
+	github.com/knadh/koanf/maps v0.1.1 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mark3labs/mcp-go v0.27.0
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-localereader v0.0.1 // indirect
+	github.com/mitchellh/copystructure v1.2.0 // indirect
+	github.com/mitchellh/go-homedir v1.1.0 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
+	github.com/mitchellh/reflectwalk v1.0.2 // indirect
+	github.com/moby/term v0.5.0 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
+	github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de // indirect
+	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
+	github.com/muesli/cancelreader v0.2.2 // indirect
+	github.com/muesli/reflow v0.3.0 // indirect
+	github.com/muesli/termenv v0.15.2 // indirect
+	github.com/nsqio/go-diskqueue v1.1.0 // indirect
+	github.com/opencontainers/go-digest v1.0.0 // indirect
+	github.com/opencontainers/image-spec v1.1.0-rc5 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/perimeterx/marshmallow v1.1.4 // indirect
+	github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb // indirect
+	github.com/pingcap/failpoint v0.0.0-20240528011301-b51a646c7c86 // indirect
+	github.com/pingcap/log v1.1.0 // indirect
+	github.com/pingcap/tidb/pkg/parser v0.0.0-20250324122243-d51e00e5bbf0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/protocolbuffers/txtpbfmt v0.0.0-20220131092820-39736dd543b4 // indirect
+	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
+	github.com/rivo/uniseg v0.4.4 // indirect
+	github.com/riza-io/grpc-go v0.2.0 // indirect
+	github.com/sahilm/fuzzy v0.1.0 // indirect
+	github.com/sirupsen/logrus v1.9.3 // indirect
+	github.com/stoewer/go-strcase v1.2.0 // indirect
+	github.com/tetratelabs/wazero v1.9.0 // indirect
+	github.com/vbatts/tar-split v0.11.5 // indirect
+	github.com/wasilibs/go-pgquery v0.0.0-20250409022910-10ac41983c07 // indirect
+	github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 // indirect
+	go.opentelemetry.io/otel v1.34.0 // indirect
+	go.opentelemetry.io/otel/metric v1.34.0 // indirect
+	go.opentelemetry.io/otel/trace v1.34.0 // indirect
+	go.uber.org/atomic v1.11.0 // indirect
+	go.uber.org/multierr v1.11.0 // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/time v0.7.0 // indirect
+	google.golang.org/genproto v0.0.0-20241007155032-5fefd90f89a9 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 // indirect
+	gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	modernc.org/libc v1.62.1 // indirect
+	modernc.org/mathutil v1.7.1 // indirect
+	modernc.org/memory v1.9.1 // indirect
+	modernc.org/sqlite v1.37.0 // indirect
+	nhooyr.io/websocket v1.8.10 // indirect
+)
+
+// The implementation of the `encore.dev` runtime, is in this repo
+// along side the Encore CLI
+replace encore.dev => ./runtimes/go
diff --git a/go.sum b/go.sum
index d0da7a27ad..63c2bfdff3 100644
--- a/go.sum
+++ b/go.sum
@@ -1,3 +1,7 @@
+bazil.org/fuse v0.0.0-20160811212531-371fbbdaa898/go.mod h1:Xbm+BRKSBEpa4q4hTSxohYNQpsxXPbPry4JJWOB3LB8=
+bazil.org/fuse v0.0.0-20200407214033-5883e5a4b512/go.mod h1:FbcW6z/2VytnFDhZfumh8Ss8zxHE6qpMP5sHTRe0EaM=
+cel.dev/expr v0.19.1 h1:NciYrtDRIR0lNCnH1LFJegdjspNx9fI59O7TWcua/W4=
+cel.dev/expr v0.19.1/go.mod h1:MrpN08Q+lEBs+bGYdLxxHkZoUSsCp0nSKTs0nTymJgw=
 cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
 cloud.google.com/go v0.38.0/go.mod h1:990N+gfupTy94rShfmMCWGDn0LpTmnzTp2qbd1dvSRU=
@@ -12,152 +16,634 @@ cloud.google.com/go v0.54.0/go.mod h1:1rq2OEkV3YMf6n/9ZvGWI3GWw0VoqH/1x2nd8Is/bP
 cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKVk=
 cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
 cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
-cloud.google.com/go v0.63.0/go.mod h1:GmezbQc7T2snqkEXWfZ0sy0VfkB/ivI2DdtJL2DEmlg=
-cloud.google.com/go v0.64.0 h1:xVP3LPvMjGT4J0a55y02Gw5y/dkY/rxGz58sfK1jqIo=
-cloud.google.com/go v0.64.0/go.mod h1:xfORb36jGvE+6EexW71nMEtL025s3x6xvuYUKM4JLv4=
+cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
+cloud.google.com/go v0.72.0/go.mod h1:M+5Vjvlc2wnp6tjzE102Dw08nGShTscUx2nZMufOKPI=
+cloud.google.com/go v0.74.0/go.mod h1:VV1xSbzvo+9QJOxLDaJfTjx5e+MePCpCWwvftOeQmWk=
+cloud.google.com/go v0.78.0/go.mod h1:QjdrLG0uq+YwhjoVOLsS1t7TW8fs36kLs4XO5R5ECHg=
+cloud.google.com/go v0.79.0/go.mod h1:3bzgcEeQlzbuEAYu4mrWhKqWjmpprinYgKJLgKHnbb8=
+cloud.google.com/go v0.81.0/go.mod h1:mk/AM35KwGk/Nm2YSeZbxXdrNK3KZOYHmLkOqC2V6E0=
+cloud.google.com/go v0.83.0/go.mod h1:Z7MJUsANfY0pYPdw0lbnivPx4/vhy/e2FEkSkF7vAVY=
+cloud.google.com/go v0.84.0/go.mod h1:RazrYuxIK6Kb7YrzzhPoLmCVzl7Sup4NrbKPg8KHSUM=
+cloud.google.com/go v0.87.0/go.mod h1:TpDYlFy7vuLzZMMZ+B6iRiELaY7z/gJPaqbMx6mlWcY=
+cloud.google.com/go v0.90.0/go.mod h1:kRX0mNRHe0e2rC6oNakvwQqzyDmg57xJ+SZU1eT2aDQ=
+cloud.google.com/go v0.93.3/go.mod h1:8utlLll2EF5XMAV15woO4lSbWQlk8rer9aLOfLh7+YI=
+cloud.google.com/go v0.94.1/go.mod h1:qAlAugsXlC+JWO+Bke5vCtc9ONxjQT3drlTTnAplMW4=
+cloud.google.com/go v0.97.0/go.mod h1:GF7l59pYBVlXQIBLx3a761cZ41F9bBH3JUlihCt2Udc=
+cloud.google.com/go v0.98.0/go.mod h1:ua6Ush4NALrHk5QXDWnjvZHN93OuF0HfuEPq9I1X0cM=
+cloud.google.com/go v0.99.0/go.mod h1:w0Xx2nLzqWJPuozYQX+hFfCSI8WioryfRDzkoI/Y2ZA=
+cloud.google.com/go v0.115.1 h1:Jo0SM9cQnSkYfp44+v+NQXHpcHqlnRJk2qxh6yvxxxQ=
+cloud.google.com/go v0.115.1/go.mod h1:DuujITeaufu3gL68/lOFIirVNJwQeyf5UXyi+Wbgknc=
+cloud.google.com/go/auth v0.9.8 h1:+CSJ0Gw9iVeSENVCKJoLHhdUykDgXSc4Qn+gu2BRtR8=
+cloud.google.com/go/auth v0.9.8/go.mod h1:xxA5AqpDrvS+Gkmo9RqrGGRh6WSNKKOXhY3zNOr38tI=
+cloud.google.com/go/auth/oauth2adapt v0.2.4 h1:0GWE/FUsXhf6C+jAkWgYm7X9tK8cuEIfy19DBn6B6bY=
+cloud.google.com/go/auth/oauth2adapt v0.2.4/go.mod h1:jC/jOpwFP6JBxhB3P5Rr0a9HLMC/Pe3eaL4NmdvqPtc=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
 cloud.google.com/go/bigquery v1.3.0/go.mod h1:PjpwJnslEMmckchkHFfq+HTD2DmtT67aNFKH1/VBDHE=
 cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvftPBK2Dvzc=
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
+cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
+cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/firestore v1.1.0/go.mod h1:ulACoGHTpvq5r8rxGJ4ddJZBZqakUQqClKRT5SZwBmk=
+cloud.google.com/go/iam v1.2.1 h1:QFct02HRb7H12J/3utj0qf5tobFh9V4vR6h9eX5EBRU=
+cloud.google.com/go/iam v1.2.1/go.mod h1:3VUIJDPpwT6p/amXRC5GY8fCCh70lxPygguVtI0Z4/g=
+cloud.google.com/go/longrunning v0.6.1 h1:lOLTFxYpr8hcRtcwWir5ITh1PAKUD/sG2lKrTSYjyMc=
+cloud.google.com/go/longrunning v0.6.1/go.mod h1:nHISoOZpBcmlwbJmiVk5oDRz0qG/ZxPynEGs1iZ79s0=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
 cloud.google.com/go/pubsub v1.3.1/go.mod h1:i+ucay31+CNRpDW4Lu78I4xXG+O1r/MAHgjpRVR+TSU=
-cloud.google.com/go/spanner v1.9.0/go.mod h1:xvlEn0NZ5v1iJPYsBnUVRDNvccDxsBTEi16pJRKQVws=
+cloud.google.com/go/spanner v1.28.0/go.mod h1:7m6mtQZn/hMbMfx62ct5EWrGND4DNqkXyrmBPRS+OJo=
 cloud.google.com/go/storage v1.0.0/go.mod h1:IhtSnM/ZTZV8YYJWCY8RULGVqBDmpoyjwiyrjsg+URw=
 cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0ZeosJ0Rtdos=
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
+cloud.google.com/go/storage v1.43.0 h1:CcxnSohZwizt4LCzQHWvBf1/kvtHUn7gk9QERXPyXFs=
+cloud.google.com/go/storage v1.43.0/go.mod h1:ajvxEa7WmZS1PxvKRq4bq0tFT3vMd502JwstCcYv0Q0=
+cuelang.org/go v0.4.3 h1:W3oBBjDTm7+IZfCKZAmC8uDG0eYfJL4Pp/xbbCMKaVo=
+cuelang.org/go v0.4.3/go.mod h1:7805vR9H+VoBNdWFdI7jyDR3QLUPp4+naHfbcgp55HI=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
-github.com/AlecAivazis/survey/v2 v2.2.8 h1:TgxCwybKdBckmC+/P9/5h49rw/nAHe/itZL0dgHs+Q0=
-github.com/AlecAivazis/survey/v2 v2.2.8/go.mod h1:9DYvHgXtiXm6nCn+jXnOXLKbH+Yo9u8fAS/SduGdoPk=
-github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78 h1:w+iIsaOQNcT7OZ575w+acHgRric5iCyQh+xv+KJ4HB8=
+filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA=
+filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4=
+gioui.org v0.0.0-20210308172011-57750fc8a0a6/go.mod h1:RSH6KIUZ0p2xy5zHDxgAM4zumjgTw83q2ge/PI+yyw8=
+github.com/AdaLogics/go-fuzz-headers v0.0.0-20210715213245-6c3934b029d8/go.mod h1:CzsSbkDixRphAF5hS6wbMKq0eI6ccJRb7/A0M6JBnwg=
+github.com/Azure/azure-pipeline-go v0.2.3/go.mod h1:x841ezTBIMG6O3lAcl8ATHnsOPVl2bqk7S3ta6S6u4k=
+github.com/Azure/azure-sdk-for-go v16.2.1+incompatible/go.mod h1:9XXNKU+eRnpl9moKnB4QOLf1HestfXbmab5FXxiDBjc=
+github.com/Azure/azure-storage-blob-go v0.14.0/go.mod h1:SMqIBi+SuiQH32bvyjngEewEeXoPfKMgWlBDaYf6fck=
 github.com/Azure/go-ansiterm v0.0.0-20170929234023-d6e3b3328b78/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
+github.com/Azure/go-ansiterm v0.0.0-20210608223527-2377c96fe795/go.mod h1:LmzpDX56iTiv29bbRTIsUNlaFfuhWRQBWjQdVyAevI8=
+github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
+github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
+github.com/Azure/go-autorest v10.8.1+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
+github.com/Azure/go-autorest v14.2.0+incompatible/go.mod h1:r+4oMnoxhatjLLJ6zxSWATqVooLgysK6ZNox3g/xq24=
+github.com/Azure/go-autorest/autorest v0.11.1/go.mod h1:JFgpikqFJ/MleTTxwepExTKnFUKKszPS8UavbQYUMuw=
+github.com/Azure/go-autorest/autorest v0.11.18/go.mod h1:dSiJPy22c3u0OtOKDNttNgqpNFY/GeWa7GH/Pz56QRA=
+github.com/Azure/go-autorest/autorest/adal v0.9.0/go.mod h1:/c022QCutn2P7uY+/oQWWNcK9YU+MH96NgK+jErpbcg=
+github.com/Azure/go-autorest/autorest/adal v0.9.5/go.mod h1:B7KF7jKIeC9Mct5spmyCB/A8CG/sEz1vwIRGv/bbw7A=
+github.com/Azure/go-autorest/autorest/adal v0.9.13/go.mod h1:W/MM4U6nLxnIskrw4UwWzlHfGjwUS50aOsc/I3yuU8M=
+github.com/Azure/go-autorest/autorest/adal v0.9.16/go.mod h1:tGMin8I49Yij6AQ+rvV+Xa/zwxYQB5hmsd6DkfAx2+A=
+github.com/Azure/go-autorest/autorest/date v0.3.0/go.mod h1:BI0uouVdmngYNUzGWeSYnokU+TrmwEsOqdt8Y6sso74=
+github.com/Azure/go-autorest/autorest/mocks v0.4.0/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
+github.com/Azure/go-autorest/autorest/mocks v0.4.1/go.mod h1:LTp+uSrOhSkaKrUy935gNZuuIPPVsHlr9DSOxSayd+k=
+github.com/Azure/go-autorest/logger v0.2.0/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
+github.com/Azure/go-autorest/logger v0.2.1/go.mod h1:T9E3cAhj2VqvPOtCYAvby9aBXkZmbF5NWuPV8+WeEW8=
+github.com/Azure/go-autorest/tracing v0.6.0/go.mod h1:+vhtPC754Xsa23ID7GlGsrdKBpUA79WCAKPPZVC2DeU=
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym/WlBOVXweHU+Q+/VP0lqqI8lqeDx9IjBqo=
-github.com/ClickHouse/clickhouse-go v1.3.12/go.mod h1:EaI/sW7Azgz9UATzd5ZdZHRUhHgv5+JMS9NSr2smCJI=
-github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5 h1:ygIc8M6trr62pF5DucadTWGdEB4mEyvzi0e2nbcmcyA=
+github.com/ClickHouse/clickhouse-go v1.4.3/go.mod h1:EaI/sW7Azgz9UATzd5ZdZHRUhHgv5+JMS9NSr2smCJI=
+github.com/Microsoft/go-winio v0.4.11/go.mod h1:VhR8bwka0BXejwEJY73c50VrPtXAaKcyvVC4A4RozmA=
+github.com/Microsoft/go-winio v0.4.14/go.mod h1:qXqCSQ3Xa7+6tgxaGTIe4Kpcdsi+P8jBhyzoq1bpyYA=
 github.com/Microsoft/go-winio v0.4.15-0.20190919025122-fc70bd9a86b5/go.mod h1:tTuCMEN+UleMWgg9dVx4Hu52b1bJo+59jBh3ajtinzw=
-github.com/Netflix/go-expect v0.0.0-20180615182759-c93bf25de8e8 h1:xzYJEypr/85nBpB11F9br+3HUrpgb+fcm5iADzXXYEw=
-github.com/Netflix/go-expect v0.0.0-20180615182759-c93bf25de8e8/go.mod h1:oX5x61PbNXchhh0oikYAH+4Pcfw5LKv21+Jnpr6r6Pc=
+github.com/Microsoft/go-winio v0.4.16-0.20201130162521-d1ffc52c7331/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
+github.com/Microsoft/go-winio v0.4.16/go.mod h1:XB6nPKklQyQ7GC9LdcBEcBl8PF76WugXOPRXwdLnMv0=
+github.com/Microsoft/go-winio v0.4.17-0.20210211115548-6eac466e5fa3/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Microsoft/go-winio v0.4.17-0.20210324224401-5516f17a5958/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Microsoft/go-winio v0.4.17/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Microsoft/go-winio v0.5.1/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
+github.com/Microsoft/go-winio v0.5.2/go.mod h1:WpS1mjBmmwHBEWmogvA2mj8546UReBk4v8QkMxJ6pZY=
+github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
+github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
+github.com/Microsoft/hcsshim v0.8.6/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
+github.com/Microsoft/hcsshim v0.8.7-0.20190325164909-8abdbb8205e4/go.mod h1:Op3hHsoHPAvb6lceZHDtd9OkTew38wNoXnJs8iY7rUg=
+github.com/Microsoft/hcsshim v0.8.7/go.mod h1:OHd7sQqRFrYd3RmSgbgji+ctCwkbq2wbEYNSzOYtcBQ=
+github.com/Microsoft/hcsshim v0.8.9/go.mod h1:5692vkUqntj1idxauYlpoINNKeqCiG6Sg38RRsjT5y8=
+github.com/Microsoft/hcsshim v0.8.14/go.mod h1:NtVKoYxQuTLx6gEq0L96c9Ju4JbRJ4nY2ow3VK6a9Lg=
+github.com/Microsoft/hcsshim v0.8.15/go.mod h1:x38A4YbHbdxJtc0sF6oIz+RG0npwSCAvn69iY6URG00=
+github.com/Microsoft/hcsshim v0.8.16/go.mod h1:o5/SZqmR7x9JNKsW3pu+nqHm0MF8vbA+VxGOoXdC600=
+github.com/Microsoft/hcsshim v0.8.20/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
+github.com/Microsoft/hcsshim v0.8.21/go.mod h1:+w2gRZ5ReXQhFOrvSQeNfhrYB/dg3oDwTOcER2fw4I4=
+github.com/Microsoft/hcsshim v0.8.23/go.mod h1:4zegtUJth7lAvFyc6cH2gGQ5B3OFQim01nnU2M8jKDg=
+github.com/Microsoft/hcsshim v0.9.2/go.mod h1:7pLA8lDk46WKDWlVsENo92gC0XFa8rbKfyFRBqxEbCc=
+github.com/Microsoft/hcsshim/test v0.0.0-20201218223536-d3e5debf77da/go.mod h1:5hlzMzRKMLyo42nCZ9oml8AdTlq/0cvIaBv6tK1RehU=
+github.com/Microsoft/hcsshim/test v0.0.0-20210227013316-43a75bb4edd3/go.mod h1:mw7qgWloBUl75W/gVH3cQszUg1+gUITj7D6NY7ywVnY=
+github.com/NYTimes/gziphandler v0.0.0-20170623195520-56545f4a5d46/go.mod h1:3wb06e3pkSAbeQ52E9H9iFoQsEEwGN64994WTCIhntQ=
+github.com/NYTimes/gziphandler v1.1.1/go.mod h1:n/CVRwUEOgIxrgPvAQhUUr9oeUtvrhMomdKFjzJNB0c=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38 h1:smF2tmSOzy2Mm+0dGI2AIUHY+w0BUc+4tn40djz7+6U=
-github.com/alecthomas/assert v0.0.0-20170929043011-405dbfeb8e38/go.mod h1:r7bzyVFMNntcxPZXK3/+KdruV1H5KSlyVY0gc+NgInI=
-github.com/alecthomas/chroma v0.8.2 h1:x3zkuE2lUk/RIekyAJ3XRqSCP4zwWDfcw/YJCuCAACg=
-github.com/alecthomas/chroma v0.8.2/go.mod h1:sko8vR34/90zvl5QdcUdvzL3J8NKjAUx9va9jPuFNoM=
-github.com/alecthomas/colour v0.0.0-20160524082231-60882d9e2721 h1:JHZL0hZKJ1VENNfmXvHbgYlbUOvpzYzvy2aZU5gXVeo=
-github.com/alecthomas/colour v0.0.0-20160524082231-60882d9e2721/go.mod h1:QO9JBoKquHd+jz9nshCh40fOfO+JzsoXy8qTHF68zU0=
-github.com/alecthomas/kong v0.2.4/go.mod h1:kQOmtJgV+Lb4aj+I2LEn40cbtawdWJ9Y8QLq+lElKxE=
-github.com/alecthomas/repr v0.0.0-20180818092828-117648cd9897 h1:p9Sln00KOTlrYkxI1zYWl1QLnEqAqEARBEYa8FQnQcY=
-github.com/alecthomas/repr v0.0.0-20180818092828-117648cd9897/go.mod h1:xTS7Pm1pD1mvyM075QCDSRqH6qRLXylzS24ZTpRiSzQ=
+github.com/PuerkitoBio/purell v1.0.0/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/purell v1.1.1/go.mod h1:c11w/QuzBsJSee3cPx9rAFu61PvFxuPbtSwDGJws/X0=
+github.com/PuerkitoBio/urlesc v0.0.0-20160726150825-5bd2802263f2/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578/go.mod h1:uGdkoq3SwY9Y+13GIhn11/XLaGBb4BfwItxLd5jeuXE=
+github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ=
+github.com/agnivade/levenshtein v1.1.1 h1:QY8M92nrzkmr798gCo3kmMyqXFzdQVpxLlGPRBij0P8=
+github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVbJomOvKkmgYbo=
+github.com/ajstarks/svgo v0.0.0-20180226025133-644b8db467af/go.mod h1:K08gAheRH3/J6wwsYMMT4xOr94bZjxIelGM0+d/wbFw=
+github.com/alecthomas/chroma v0.10.0 h1:7XDcGkCQopCNKjZHfYrNLraA+M7e0fMiJ/Mfikbfjek=
+github.com/alecthomas/chroma v0.10.0/go.mod h1:jtJATyUxlIORhUOFNA9NZDWGAQ8wpxQQqNSB4rjA/1s=
 github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
+github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
 github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/apache/arrow/go/arrow v0.0.0-20200601151325-b2287a20f230/go.mod h1:QNYViu/X0HXDHw7m3KXzWSVXIbfUvJqBFe6Gj8/pYA0=
+github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
+github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
+github.com/alexflint/go-filemutex v0.0.0-20171022225611-72bdc8eae2ae/go.mod h1:CgnQgUtFrFz9mxFNtED3jI5tLDjKlOM+oUF/sTk6ps0=
+github.com/alexflint/go-filemutex v1.1.0/go.mod h1:7P4iRhttt/nUvUOrYIhcpMzv2G6CY9UnI16Z+UJqRyk=
+github.com/algolia/algoliasearch-client-go/v3 v3.31.4 h1:UJhx6AhZCYf0qZygDz2c1x1+1q2q2sfzsRaQM6yswWk=
+github.com/algolia/algoliasearch-client-go/v3 v3.31.4/go.mod h1:i7tLoP7TYDmHX3Q7vkIOL4syVse/k5VJ+k0i8WqFiJk=
+github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a h1:HbKu58rmZpUGpz5+4FfNmIU+FmZg2P3Xaj2v2bfNWmk=
+github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
+github.com/alicebob/miniredis/v2 v2.23.0 h1:+lwAJYjvvdIVg6doFHuotFjueJ/7KY10xo/vm3X3Scw=
+github.com/alicebob/miniredis/v2 v2.23.0/go.mod h1:XNqvJdQJv5mSuVMc0ynneafpnL/zv52acZ6kqeS0t88=
+github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
+github.com/antlr4-go/antlr/v4 v4.13.1 h1:SqQKkuVZ+zWkMMNkjy5FZe5mr5WURWnlpmOuzYWrPrQ=
+github.com/antlr4-go/antlr/v4 v4.13.1/go.mod h1:GKmUxMtwp6ZgGwZSva4eWPC5mS6vUAmOABFgjdkM7Nw=
+github.com/apache/arrow/go/arrow v0.0.0-20210818145353-234c94e4ce64/go.mod h1:2qMFB56yOP3KzkB3PbYZ4AlUFg3a88F67TIx5lB/WwY=
+github.com/apache/arrow/go/arrow v0.0.0-20211013220434-5962184e7a30/go.mod h1:Q7yQnSMnLvcXlZ8RV+jwz/6y1rQTqbX6C82SndT52Zs=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0 h1:jfIu9sQUG6Ig+0+Ap1h4unLjW6YQJpKZVmUzxsD4E/Q=
+github.com/arbovm/levenshtein v0.0.0-20160628152529-48b4e1c0c4d0/go.mod h1:t2tdKJDJF9BV14lnkjHmOQgcvEKgtqs5a1N3LNdJhGE=
 github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e/go.mod h1:3U/XgcO3hCbHZ8TKRvWD2dDTCfh9M9ya+I9JpbB7O8o=
+github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6/go.mod h1:grANhF5doyWs3UAsr3K4I6qtAmlQcZDesFNEHPZAzj8=
 github.com/armon/go-metrics v0.0.0-20180917152333-f0300d1749da/go.mod h1:Q73ZrmVTwzkszR9V5SSuryQ31EELlFMUz1kKyl939pY=
 github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
+github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
+github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
+github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
+github.com/aws/aws-sdk-go v1.15.11/go.mod h1:mFuSZ37Z9YOHbQEwBWztmVzqXrEkub65tZoCYDt7FT0=
 github.com/aws/aws-sdk-go v1.17.7/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
+github.com/aws/aws-sdk-go-v2 v1.8.0/go.mod h1:xEFuWz+3TYdlPRuo+CqATbeDWIWyaT5uAPwPaWtgse0=
+github.com/aws/aws-sdk-go-v2 v1.9.2/go.mod h1:cK/D0BBs0b/oWPIcX/Z/obahJK1TT7IPVjy53i/mX/4=
+github.com/aws/aws-sdk-go-v2/config v1.6.0/go.mod h1:TNtBVmka80lRPk5+S9ZqVfFszOQAGJJ9KbT3EM3CHNU=
+github.com/aws/aws-sdk-go-v2/config v1.8.3/go.mod h1:4AEiLtAb8kLs7vgw2ZV3p2VZ1+hBavOc84hqxVNpCyw=
+github.com/aws/aws-sdk-go-v2/credentials v1.3.2/go.mod h1:PACKuTJdt6AlXvEq8rFI4eDmoqDFC5DpVKQbWysaDgM=
+github.com/aws/aws-sdk-go-v2/credentials v1.4.3/go.mod h1:FNNC6nQZQUuyhq5aE5c7ata8o9e4ECGmS4lAXC7o1mQ=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.4.0/go.mod h1:Mj/U8OpDbcVcoctrYwA2bak8k/HFPdcLzI/vaiXMwuM=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.6.0/go.mod h1:gqlclDEZp4aqJOancXK6TN24aKhT0W0Ae9MHk3wzTMM=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.4.0/go.mod h1:eHwXu2+uE/T6gpnYWwBwqoeqRf9IXyCcolyOWDRAErQ=
+github.com/aws/aws-sdk-go-v2/feature/s3/manager v1.5.4/go.mod h1:Ex7XQmbFmgFHrjUX6TN3mApKW5Hglyga+F7wZHTtYhA=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.2.0/go.mod h1:Q5jATQc+f1MfZp3PDMhn6ry18hGvE0i8yvbXoKbnZaE=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.2.4/go.mod h1:ZcBrrI3zBKlhGFNYWvju0I3TR93I7YIgAfy82Fh4lcQ=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.2.2/go.mod h1:EASdTcM1lGhUe1/p4gkojHwlGJkeoRjjr1sRCzup3Is=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.3.0/go.mod h1:v8ygadNyATSm6elwJ/4gzJwcFhri9RqS8skgHKiwXPU=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.2.2/go.mod h1:NXmNI41bdEsJMrD0v9rUvbGCB5GwdBEpKvUvIY3vTFg=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.3.2/go.mod h1:72HRZDLMtmVQiLG2tLfQcaWLCssELvGl+Zf2WVxMmR8=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.5.2/go.mod h1:QuL2Ym8BkrLmN4lUofXYq6000/i5jPjosCNK//t6gak=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.7.2/go.mod h1:np7TMuJNT83O0oDOSF8i4dF3dvGqA6hPYYo6YYkzgRA=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.12.0/go.mod h1:6J++A5xpo7QDsIeSqPK4UHqMSyPOCopa+zKtqAMhqVQ=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.16.1/go.mod h1:CQe/KvWV1AqRc65KqeJjrLzr5X2ijnFTTVzJW0VBRCI=
+github.com/aws/aws-sdk-go-v2/service/sso v1.3.2/go.mod h1:J21I6kF+d/6XHVk7kp/cx9YVD2TMD2TbLwtRGVcinXo=
+github.com/aws/aws-sdk-go-v2/service/sso v1.4.2/go.mod h1:NBvT9R1MEF+Ud6ApJKM0G+IkPchKS7p7c2YPKwHmBOk=
+github.com/aws/aws-sdk-go-v2/service/sts v1.6.1/go.mod h1:hLZ/AnkIKHLuPGjEiyghNEdvJ2PP0MgOxcmv9EBJ4xs=
+github.com/aws/aws-sdk-go-v2/service/sts v1.7.2/go.mod h1:8EzeIqfWt2wWT4rJVu3f21TfrhJ8AEMzVybRNSb/b4g=
+github.com/aws/smithy-go v1.7.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
+github.com/aws/smithy-go v1.8.0/go.mod h1:SObp3lf9smib00L/v3U2eAKG8FyQ7iLrJnQiAmR5n+E=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
+github.com/aymanbagabas/go-osc52/v2 v2.0.1/go.mod h1:uYgXzlJ7ZpABp8OJ+exZzJJhRNQ2ASbcXHWsFqH8hp8=
+github.com/benbjohnson/clock v1.0.3/go.mod h1:bGMdMPoPVvcYyt1gHDf4J2KE153Yf9BuiUKYMaxlTDM=
+github.com/benbjohnson/clock v1.1.0/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/benbjohnson/clock v1.3.5 h1:VvXlSJBzZpA/zum6Sj74hxwYI2DIxRWuNIoXAzHZz5o=
+github.com/benbjohnson/clock v1.3.5/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/beorn7/perks v0.0.0-20160804104726-4c0e84591b9a/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
+github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
+github.com/bep/debounce v1.2.1 h1:v67fRdBA9UQu2NhLFXrSg0Brw7CexQekrBwDMM8bzeY=
+github.com/bep/debounce v1.2.1/go.mod h1:H8yggRPQKLUhUoqrJC1bO2xNya7vanpDl7xR3ISbCJ0=
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bitly/go-hostpool v0.0.0-20171023180738-a3a6125de932/go.mod h1:NOuUCSz6Q9T7+igc/hlvDOUdtWKryOrtFyIVABv/p7k=
+github.com/bitly/go-hostpool v0.1.0/go.mod h1:4gOCgp6+NZnVqlKyZ/iBZFTAJKembaVENUpMkpg42fw=
+github.com/bitly/go-simplejson v0.5.0/go.mod h1:cXHtHw4XUPsvGaxgjIAn8PhEWG9NfngEKAMDJEczWVA=
+github.com/bitly/timer_metrics v1.0.0/go.mod h1:87z4/LSg3f++tMqZwZlsLwPuJu6xloyJ7Qm40NyEkLs=
+github.com/bits-and-blooms/bitset v1.2.0/go.mod h1:gIdJ4wp64HaoK2YrL1Q5/N7Y16edYb8uY+O0FJTyyDA=
 github.com/bkaradzic/go-lz4 v1.0.0/go.mod h1:0YdlkowM3VswSROI7qDxhRvJ3sLhlFrRRwjwegp5jy4=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
+github.com/blang/semver v3.1.0+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/blang/semver v3.5.1+incompatible h1:cQNTCjp13qL8KC3Nbxr/y2Bqb63oX6wdnnjpJbkM4JQ=
+github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnwebNt5EWlYSAyrTnjyyk=
+github.com/bluele/gcache v0.0.2 h1:WcbfdXICg7G/DGBh1PFfcirkWOQV+v077yF1pSy3DGw=
+github.com/bluele/gcache v0.0.2/go.mod h1:m15KV+ECjptwSPxKhOhQoAFQVtUFjTVkc3H8o0t/fp0=
 github.com/bmizerany/assert v0.0.0-20160611221934-b7ed37b82869/go.mod h1:Ekp36dRnpXw/yCqJaO+ZrUyxD+3VXMFFr56k5XYrpB4=
-github.com/briandowns/spinner v1.12.0 h1:72O0PzqGJb6G3KgrcIOtL/JAGGZ5ptOMCn9cUHmqsmw=
-github.com/briandowns/spinner v1.12.0/go.mod h1:QOuQk7x+EaDASo80FEXwlwiA+j/PPIcX3FScO+3/ZPQ=
-github.com/cenkalti/backoff/v4 v4.0.2/go.mod h1:eEew/i+1Q6OrCDZh3WiXYv3+nJwBASZ8Bog/87DQnVg=
+github.com/bmizerany/perks v0.0.0-20141205001514-d9a9656a3a4b h1:AP/Y7sqYicnjGDfD5VcY4CIfh1hRXBUavxrvELjTiOE=
+github.com/bmizerany/perks v0.0.0-20141205001514-d9a9656a3a4b/go.mod h1:ac9efd0D1fsDb3EJvhqgXRbFx7bs2wqZ10HQPeU8U/Q=
+github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/briandowns/spinner v1.19.0 h1:s8aq38H+Qju89yhp89b4iIiMzMm8YN3p6vGpwyh/a8E=
+github.com/briandowns/spinner v1.19.0/go.mod h1:mQak9GHqbspjC/5iUx3qMlIho8xBS/ppAL/hX5SmPJU=
+github.com/bshuster-repo/logrus-logstash-hook v0.4.1/go.mod h1:zsTqEiSzDgAa/8GZR7E1qaXrhYNDKBYy5/dWPTIflbk=
+github.com/buger/jsonparser v0.0.0-20180808090653-f4dd9f5a6b44/go.mod h1:bbYlZJ7hK1yFx9hf58LP0zeX7UjIGs20ufpu3evjr+s=
+github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
+github.com/bugsnag/bugsnag-go v0.0.0-20141110184014-b1d153021fcd/go.mod h1:2oa8nejYd4cQ/b0hMIopN0lCRxU0bueqREvZLWFrtK8=
+github.com/bugsnag/osext v0.0.0-20130617224835-0dd3f918b21b/go.mod h1:obH5gd0BsqsP2LwDJ9aOkm/6J86V6lyAXCoQWGw3K50=
+github.com/bugsnag/panicwrap v0.0.0-20151223152923-e2c28503fcd0/go.mod h1:D/8v3kj0zr8ZAKg1AQ6crr+5VwKN5eIywRkfhyM/+dE=
+github.com/cenkalti/backoff/v4 v4.1.1/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
+github.com/cenkalti/backoff/v4 v4.1.2/go.mod h1:scbssz8iZGpm3xbr14ovlUdkxfGXNInqkPWOWmG2CLw=
+github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
+github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/certifi/gocertifi v0.0.0-20191021191039-0944d244cd40/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
+github.com/certifi/gocertifi v0.0.0-20200922220541-2c3bb06c6054/go.mod h1:sGbDF6GwGcLpkNXPUTkMRoywsNa/ol15pxFe6ERfguA=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
+github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
+github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/charmbracelet/bubbles v0.16.1 h1:6uzpAAaT9ZqKssntbvZMlksWHruQLNxg49H5WdeuYSY=
+github.com/charmbracelet/bubbles v0.16.1/go.mod h1:2QCp9LFlEsBQMvIYERr7Ww2H2bA7xen1idUDIzm/+Xc=
+github.com/charmbracelet/bubbletea v0.24.2 h1:uaQIKx9Ai6Gdh5zpTbGiWpytMU+CfsPp06RaW2cx/SY=
+github.com/charmbracelet/bubbletea v0.24.2/go.mod h1:XdrNrV4J8GiyshTtx3DNuYkR1FDaJmO3l2nejekbsgg=
+github.com/charmbracelet/lipgloss v0.7.1 h1:17WMwi7N1b1rVWOjMT+rCh7sQkvDU75B2hbZpc5Kc1E=
+github.com/charmbracelet/lipgloss v0.7.1/go.mod h1:yG0k3giv8Qj8edTCbbg6AlQ5e8KNWpFujkNawKNhE2c=
+github.com/checkpoint-restore/go-criu/v4 v4.1.0/go.mod h1:xUQBLp4RLc5zJtWY++yjOoMoB5lihDt7fai+75m+rGw=
+github.com/checkpoint-restore/go-criu/v5 v5.0.0/go.mod h1:cfwC0EG7HMUenopBsUf9d89JlCLQIfgVcNsNN0t6T2M=
+github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
 github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
 github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/cilium/ebpf v0.0.0-20200110133405-4032b1d8aae3/go.mod h1:MA5e5Lr8slmEg9bt0VpxxWqJlO4iwu3FBdHUzV7wQVg=
+github.com/cilium/ebpf v0.0.0-20200702112145-1c8d4c9ef775/go.mod h1:7cR51M8ViRLIdUjrmSXlK9pkrsDlLHbO8jiB8X8JnOc=
+github.com/cilium/ebpf v0.2.0/go.mod h1:To2CFviqOWL/M0gIMsvSMlqe7em/l1ALkX1PyjrX2Qs=
+github.com/cilium/ebpf v0.4.0/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
+github.com/cilium/ebpf v0.6.2/go.mod h1:4tRaxcgiL706VnOzHOdBlY8IEAIdxINsQBcU4xJJXRs=
+github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/cloudflare/golz4 v0.0.0-20150217214814-ef862a3cdc58/go.mod h1:EOBUe0h4xcZ5GoxqC5SDxFQ8gwyZPKQoEzownBlhI80=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
+github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
+github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
+github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
+github.com/cncf/xds/go v0.0.0-20211130200136-a8f946100490/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cockroachdb/apd v1.1.0/go.mod h1:8Sl8LxpKi29FqWXR16WEFZRNSz3SoPzUzeMeY4+DwBQ=
-github.com/cockroachdb/cockroach-go v0.0.0-20190925194419-606b3d062051/go.mod h1:XGLbWH/ujMcbPbhZq52Nv6UrCghb1yGn//133kEsvDk=
-github.com/containerd/containerd v1.4.0/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
-github.com/containerd/containerd v1.4.1 h1:pASeJT3R3YyVn+94qEPk0SnU1OQ20Jd/T+SPKy9xehY=
+github.com/cockroachdb/apd/v2 v2.0.2 h1:weh8u7Cneje73dDh+2tEVLUvyBc89iwepWCD8b8034E=
+github.com/cockroachdb/apd/v2 v2.0.2/go.mod h1:DDxRlzC2lo3/vSlmSoS7JkqbbrARPuFOGr0B9pvN3Gw=
+github.com/cockroachdb/cockroach-go/v2 v2.1.1/go.mod h1:7NtUnP6eK+l6k483WSYNrq3Kb23bWV10IRV1TyeSpwM=
+github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa/go.mod h1:zn76sxSg3SzpJ0PPJaLDCu+Bu0Lg3sKTORVIj19EIF8=
+github.com/cockroachdb/datadriven v0.0.0-20200714090401-bf6692d28da5/go.mod h1:h6jFvWxBdQXxjopDMZyH2UVceIRfR84bdzbkoKrsWNo=
+github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoCr5oaCLELYA=
+github.com/cockroachdb/errors v1.11.1 h1:xSEW75zKaKCWzR3OfxXUxgrk/NtT4G1MiOv5lWZazG8=
+github.com/cockroachdb/errors v1.11.1/go.mod h1:8MUxA3Gi6b25tYlFEBGLf+D8aISL+M4MIpiWMSNRfxw=
+github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI=
+github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b h1:r6VH0faHjZeQy818SGhaone5OnYfxFR/+AzdY3sf5aE=
+github.com/cockroachdb/logtags v0.0.0-20230118201751-21c54148d20b/go.mod h1:Vz9DsVWQQhf3vs21MhPMZpMGSht7O/2vFW2xusFUVOs=
+github.com/cockroachdb/redact v1.1.5 h1:u1PMllDkdFfPWaNGMyLD1+so+aq3uUItthCFqzwPJ30=
+github.com/cockroachdb/redact v1.1.5/go.mod h1:BVNblN9mBWFyMyqK1k3AAiSxhvhfK2oOZZ2lK+dpvRg=
+github.com/containerd/aufs v0.0.0-20200908144142-dab0cbea06f4/go.mod h1:nukgQABAEopAHvB6j7cnP5zJ+/3aVcE7hCYqvIwAHyE=
+github.com/containerd/aufs v0.0.0-20201003224125-76a6863f2989/go.mod h1:AkGGQs9NM2vtYHaUen+NljV0/baGCAPELGm2q9ZXpWU=
+github.com/containerd/aufs v0.0.0-20210316121734-20793ff83c97/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
+github.com/containerd/aufs v1.0.0/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
+github.com/containerd/btrfs v0.0.0-20201111183144-404b9149801e/go.mod h1:jg2QkJcsabfHugurUvvPhS3E08Oxiuh5W/g1ybB4e0E=
+github.com/containerd/btrfs v0.0.0-20210316141732-918d888fb676/go.mod h1:zMcX3qkXTAi9GI50+0HOeuV8LU2ryCE/V2vG/ZBiTss=
+github.com/containerd/btrfs v1.0.0/go.mod h1:zMcX3qkXTAi9GI50+0HOeuV8LU2ryCE/V2vG/ZBiTss=
+github.com/containerd/cgroups v0.0.0-20190717030353-c4b9ac5c7601/go.mod h1:X9rLEHIqSf/wfK8NsPqxJmeZgW4pcfzdXITDrUSJ6uI=
+github.com/containerd/cgroups v0.0.0-20190919134610-bf292b21730f/go.mod h1:OApqhQ4XNSNC13gXIwDjhOQxjWa/NxkwZXJ1EvqT0ko=
+github.com/containerd/cgroups v0.0.0-20200531161412-0dbf7f05ba59/go.mod h1:pA0z1pT8KYB3TCXK/ocprsh7MAkoW8bZVzPdih9snmM=
+github.com/containerd/cgroups v0.0.0-20200710171044-318312a37340/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
+github.com/containerd/cgroups v0.0.0-20200824123100-0b889c03f102/go.mod h1:s5q4SojHctfxANBDvMeIaIovkq29IP48TKAxnhYRxvo=
+github.com/containerd/cgroups v0.0.0-20210114181951-8a68de567b68/go.mod h1:ZJeTFisyysqgcCdecO57Dj79RfL0LNeGiFUqLYQRYLE=
+github.com/containerd/cgroups v1.0.1/go.mod h1:0SJrPIenamHDcZhEcJMNBB85rHcUsw4f25ZfBiPYRkU=
+github.com/containerd/cgroups v1.0.3/go.mod h1:/ofk34relqNjSGyqPrmEULrO4Sc8LJhvJmWbUCUKqj8=
+github.com/containerd/console v0.0.0-20180822173158-c12b1e7919c1/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
+github.com/containerd/console v0.0.0-20181022165439-0650fd9eeb50/go.mod h1:Tj/on1eG8kiEhd0+fhSDzsPAFESxzBBvdyEgyryXffw=
+github.com/containerd/console v0.0.0-20191206165004-02ecf6a7291e/go.mod h1:8Pf4gM6VEbTNRIT26AyyU7hxdQU3MvAvxVI0sc00XBE=
+github.com/containerd/console v1.0.1/go.mod h1:XUsP6YE/mKtz6bxc+I8UiKKTP04qjQL4qcS3XoQ5xkw=
+github.com/containerd/console v1.0.2/go.mod h1:ytZPjGgY2oeTkAONYafi2kSj0aYggsf8acV1PGKCbzQ=
+github.com/containerd/console v1.0.3/go.mod h1:7LqA/THxQ86k76b8c/EMSiaJ3h1eZkMkXar0TQ1gf3U=
+github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 h1:q2hJAaP1k2wIvVRd/hEHD7lacgqrCPS+k8g1MndzfWY=
+github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
+github.com/containerd/containerd v1.2.10/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/containerd/containerd v1.3.0-beta.2.0.20190828155532-0293cbd26c69/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/containerd/containerd v1.3.0/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/containerd/containerd v1.3.1-0.20191213020239-082f7e3aed57/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/containerd/containerd v1.3.2/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/containerd/containerd v1.4.0-beta.2.0.20200729163537-40b22ef07410/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
 github.com/containerd/containerd v1.4.1/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/containerd/containerd v1.4.3/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/containerd/containerd v1.4.9/go.mod h1:bC6axHOhabU15QhwfG7w5PipXdVtMXFTttgp+kVtyUA=
+github.com/containerd/containerd v1.5.0-beta.1/go.mod h1:5HfvG1V2FsKesEGQ17k5/T7V960Tmcumvqn8Mc+pCYQ=
+github.com/containerd/containerd v1.5.0-beta.3/go.mod h1:/wr9AVtEM7x9c+n0+stptlo/uBBoBORwEx6ardVcmKU=
+github.com/containerd/containerd v1.5.0-beta.4/go.mod h1:GmdgZd2zA2GYIBZ0w09ZvgqEq8EfBp/m3lcVZIvPHhI=
+github.com/containerd/containerd v1.5.0-rc.0/go.mod h1:V/IXoMqNGgBlabz3tHD2TWDoTJseu1FGOKuoA4nNb2s=
+github.com/containerd/containerd v1.5.1/go.mod h1:0DOxVqwDy2iZvrZp2JUx/E+hS0UNTVn7dJnIOwtYR4g=
+github.com/containerd/containerd v1.5.7/go.mod h1:gyvv6+ugqY25TiXxcZC3L5yOeYgEw0QMhscqVp1AR9c=
+github.com/containerd/containerd v1.5.8/go.mod h1:YdFSv5bTFLpG2HIYmfqDpSYYTDX+mc5qtSuYx1YUb/s=
+github.com/containerd/containerd v1.6.1/go.mod h1:1nJz5xCZPusx6jJU8Frfct988y0NpumIq9ODB0kLtoE=
+github.com/containerd/continuity v0.0.0-20190426062206-aaeac12a7ffc/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
+github.com/containerd/continuity v0.0.0-20190815185530-f2a389ac0a02/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
+github.com/containerd/continuity v0.0.0-20191127005431-f65d91d395eb/go.mod h1:GL3xCUCBDV3CZiTSEKksMWbLE66hEyuu9qyDOOqM47Y=
+github.com/containerd/continuity v0.0.0-20200710164510-efbc4488d8fe/go.mod h1:cECdGN1O8G9bgKTlLhuPJimka6Xb/Gg7vYzCTNVxhvo=
+github.com/containerd/continuity v0.0.0-20201208142359-180525291bb7/go.mod h1:kR3BEg7bDFaEddKm54WSmrol1fKWDU1nKYkgrcgZT7Y=
+github.com/containerd/continuity v0.0.0-20210208174643-50096c924a4e/go.mod h1:EXlVlkqNba9rJe3j7w3Xa924itAMLgZH4UD/Q4PExuQ=
+github.com/containerd/continuity v0.1.0/go.mod h1:ICJu0PwR54nI0yPEnJ6jcS+J7CZAUXrLh8lPo2knzsM=
+github.com/containerd/continuity v0.2.2/go.mod h1:pWygW9u7LtS1o4N/Tn0FoCFDIXZ7rxcMX7HX1Dmibvk=
+github.com/containerd/fifo v0.0.0-20180307165137-3d5202aec260/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
+github.com/containerd/fifo v0.0.0-20190226154929-a9fb20d87448/go.mod h1:ODA38xgv3Kuk8dQz2ZQXpnv/UZZUHUCL7pnLehbXgQI=
+github.com/containerd/fifo v0.0.0-20200410184934-f15a3290365b/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
+github.com/containerd/fifo v0.0.0-20201026212402-0724c46b320c/go.mod h1:jPQ2IAeZRCYxpS/Cm1495vGFww6ecHmMk1YJH2Q5ln0=
+github.com/containerd/fifo v0.0.0-20210316144830-115abcc95a1d/go.mod h1:ocF/ME1SX5b1AOlWi9r677YJmCPSwwWnQ9O123vzpE4=
+github.com/containerd/fifo v1.0.0/go.mod h1:ocF/ME1SX5b1AOlWi9r677YJmCPSwwWnQ9O123vzpE4=
+github.com/containerd/go-cni v1.0.1/go.mod h1:+vUpYxKvAF72G9i1WoDOiPGRtQpqsNW/ZHtSlv++smU=
+github.com/containerd/go-cni v1.0.2/go.mod h1:nrNABBHzu0ZwCug9Ije8hL2xBCYh/pjfMb1aZGrrohk=
+github.com/containerd/go-cni v1.1.0/go.mod h1:Rflh2EJ/++BA2/vY5ao3K6WJRR/bZKsX123aPk+kUtA=
+github.com/containerd/go-cni v1.1.3/go.mod h1:Rflh2EJ/++BA2/vY5ao3K6WJRR/bZKsX123aPk+kUtA=
+github.com/containerd/go-runc v0.0.0-20180907222934-5a6d9f37cfa3/go.mod h1:IV7qH3hrUgRmyYrtgEeGWJfWbgcHL9CSRruz2Vqcph0=
+github.com/containerd/go-runc v0.0.0-20190911050354-e029b79d8cda/go.mod h1:IV7qH3hrUgRmyYrtgEeGWJfWbgcHL9CSRruz2Vqcph0=
+github.com/containerd/go-runc v0.0.0-20200220073739-7016d3ce2328/go.mod h1:PpyHrqVs8FTi9vpyHwPwiNEGaACDxT/N/pLcvMSRA9g=
+github.com/containerd/go-runc v0.0.0-20201020171139-16b287bc67d0/go.mod h1:cNU0ZbCgCQVZK4lgG3P+9tn9/PaJNmoDXPpoJhDR+Ok=
+github.com/containerd/go-runc v1.0.0/go.mod h1:cNU0ZbCgCQVZK4lgG3P+9tn9/PaJNmoDXPpoJhDR+Ok=
+github.com/containerd/imgcrypt v1.0.1/go.mod h1:mdd8cEPW7TPgNG4FpuP3sGBiQ7Yi/zak9TYCG3juvb0=
+github.com/containerd/imgcrypt v1.0.4-0.20210301171431-0ae5c75f59ba/go.mod h1:6TNsg0ctmizkrOgXRNQjAPFWpMYRWuiB6dSF4Pfa5SA=
+github.com/containerd/imgcrypt v1.1.1-0.20210312161619-7ed62a527887/go.mod h1:5AZJNI6sLHJljKuI9IHnw1pWqo/F0nGDOuR9zgTs7ow=
+github.com/containerd/imgcrypt v1.1.1/go.mod h1:xpLnwiQmEUJPvQoAapeb2SNCxz7Xr6PJrXQb0Dpc4ms=
+github.com/containerd/imgcrypt v1.1.3/go.mod h1:/TPA1GIDXMzbj01yd8pIbQiLdQxed5ue1wb8bP7PQu4=
+github.com/containerd/nri v0.0.0-20201007170849-eb1350a75164/go.mod h1:+2wGSDGFYfE5+So4M5syatU0N0f0LbWpuqyMi4/BE8c=
+github.com/containerd/nri v0.0.0-20210316161719-dbaa18c31c14/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
+github.com/containerd/nri v0.1.0/go.mod h1:lmxnXF6oMkbqs39FiCt1s0R2HSMhcLel9vNL3m4AaeY=
+github.com/containerd/stargz-snapshotter/estargz v0.4.1/go.mod h1:x7Q9dg9QYb4+ELgxmo4gBUeJB0tl5dqH1Sdz0nJU1QM=
+github.com/containerd/stargz-snapshotter/estargz v0.14.3 h1:OqlDCK3ZVUO6C3B/5FSkDwbkEETK84kQgEeFwDC+62k=
+github.com/containerd/stargz-snapshotter/estargz v0.14.3/go.mod h1:KY//uOCIkSuNAHhJogcZtrNHdKrA99/FCCRjE3HD36o=
+github.com/containerd/ttrpc v0.0.0-20190828154514-0e0f228740de/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=
+github.com/containerd/ttrpc v0.0.0-20190828172938-92c8520ef9f8/go.mod h1:PvCDdDGpgqzQIzDW1TphrGLssLDZp2GuS+X5DkEJB8o=
+github.com/containerd/ttrpc v0.0.0-20191028202541-4f1b8fe65a5c/go.mod h1:LPm1u0xBw8r8NOKoOdNMeVHSawSsltak+Ihv+etqsE8=
+github.com/containerd/ttrpc v1.0.1/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
+github.com/containerd/ttrpc v1.0.2/go.mod h1:UAxOpgT9ziI0gJrmKvgcZivgxOp8iFPSk8httJEt98Y=
+github.com/containerd/ttrpc v1.1.0/go.mod h1:XX4ZTnoOId4HklF4edwc4DcqskFZuvXB1Evzy5KFQpQ=
+github.com/containerd/typeurl v0.0.0-20180627222232-a93fcdb778cd/go.mod h1:Cm3kwCdlkCfMSHURc+r6fwoGH6/F1hH3S4sg0rLFWPc=
+github.com/containerd/typeurl v0.0.0-20190911142611-5eb25027c9fd/go.mod h1:GeKYzf2pQcqv7tJ0AoCuuhtnqhva5LNU3U+OyKxxJpk=
+github.com/containerd/typeurl v1.0.1/go.mod h1:TB1hUtrpaiO88KEK56ijojHS1+NeF0izUACaJW2mdXg=
+github.com/containerd/typeurl v1.0.2/go.mod h1:9trJWW2sRlGub4wZJRTW83VtbOLS6hwcDZXTn6oPz9s=
+github.com/containerd/zfs v0.0.0-20200918131355-0a33824f23a2/go.mod h1:8IgZOBdv8fAgXddBT4dBXJPtxyRsejFIpXoklgxgEjw=
+github.com/containerd/zfs v0.0.0-20210301145711-11e8f1707f62/go.mod h1:A9zfAbMlQwE+/is6hi0Xw8ktpL+6glmqZYtevJgaB8Y=
+github.com/containerd/zfs v0.0.0-20210315114300-dde8f0fda960/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
+github.com/containerd/zfs v0.0.0-20210324211415-d5c4544f0433/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
+github.com/containerd/zfs v1.0.0/go.mod h1:m+m51S1DvAP6r3FcmYCp54bQ34pyOwTieQDNRIRHsFY=
+github.com/containernetworking/cni v0.7.1/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
+github.com/containernetworking/cni v0.8.0/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
+github.com/containernetworking/cni v0.8.1/go.mod h1:LGwApLUm2FpoOfxTDEeq8T9ipbpZ61X79hmU3w8FmsY=
+github.com/containernetworking/cni v1.0.1/go.mod h1:AKuhXbN5EzmD4yTNtfSsX3tPcmtrBI6QcRV0NiNt15Y=
+github.com/containernetworking/plugins v0.8.6/go.mod h1:qnw5mN19D8fIwkqW7oHHYDHVlzhJpcY6TQxn/fUyDDM=
+github.com/containernetworking/plugins v0.9.1/go.mod h1:xP/idU2ldlzN6m4p5LmGiwRDjeJr6FLK6vuiUwoH7P8=
+github.com/containernetworking/plugins v1.0.1/go.mod h1:QHCfGpaTwYTbbH+nZXKVTxNBDZcxSOplJT5ico8/FLE=
+github.com/containers/ocicrypt v1.0.1/go.mod h1:MeJDzk1RJHv89LjsH0Sp5KTY3ZYkjXO/C+bKAeWFIrc=
+github.com/containers/ocicrypt v1.1.0/go.mod h1:b8AOe0YR67uU8OqfVNcznfFpAzu3rdgUV4GP9qXPfu4=
+github.com/containers/ocicrypt v1.1.1/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
+github.com/containers/ocicrypt v1.1.2/go.mod h1:Dm55fwWm1YZAjYRaJ94z2mfZikIyIN4B0oB3dj3jFxY=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
+github.com/coreos/etcd v3.3.10+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/go-iptables v0.4.5/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
+github.com/coreos/go-iptables v0.5.0/go.mod h1:/mVI274lEDI2ns62jHCDnCyBF9Iwsmekav8Dbxlm1MU=
+github.com/coreos/go-iptables v0.6.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
+github.com/coreos/go-oidc v2.1.0+incompatible/go.mod h1:CgnwVTmzoESiwO9qyAFEMiHoZ1nMCKZlZ9V6mm3/LKc=
+github.com/coreos/go-semver v0.2.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
+github.com/coreos/go-systemd v0.0.0-20161114122254-48702e0da86b/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd v0.0.0-20180511133405-39ca1b05acc7/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/coreos/go-systemd v0.0.0-20190719114852-fd7a80b32e1f/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
+github.com/coreos/go-systemd/v22 v22.0.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
+github.com/coreos/go-systemd/v22 v22.1.0/go.mod h1:xO0FLkIi5MaZafQlIrOotqXZ90ih+1atmu1JpKERPPk=
+github.com/coreos/go-systemd/v22 v22.3.2/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/coreos/pkg v0.0.0-20160727233714-3ac0863d7acf/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
 github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/cpuguy83/go-md2man/v2 v2.0.0/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
-github.com/creack/pty v1.1.7 h1:6pwm8kMQKCmgUg0ZHTm5+/YvRK0s3THD/28+T6/kk4A=
+github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
 github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/creack/pty v1.1.11/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/cubicdaiya/gonp v1.0.4 h1:ky2uIAJh81WiLcGKBVD5R7KsM/36W6IqqTy6Bo6rGws=
+github.com/cubicdaiya/gonp v1.0.4/go.mod h1:iWGuP/7+JVTn02OWhRemVbMmG1DOUnmrGTYYACpOI0I=
+github.com/cyphar/filepath-securejoin v0.2.2/go.mod h1:FpkQEhXnPnOthhzymB7CGsFk2G9VLXONKD9G7QGMM+4=
+github.com/cyphar/filepath-securejoin v0.2.3/go.mod h1:aPGpWjXOXUn2NCNjFvBE6aRxGGx79pTxQpKOJNYHHl4=
 github.com/cznic/mathutil v0.0.0-20180504122225-ca4c9f2c1369/go.mod h1:e6NPNENfs9mPDVNRekM7lKScauxd5kXTr1Mfyig6TDM=
-github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964 h1:y5HC9v93H5EPKqaS1UYVg1uYah5Xf51mBfIoWehClUQ=
-github.com/danwakefield/fnmatch v0.0.0-20160403171240-cbb64ac3d964/go.mod h1:Xd9hchkHSWYkEqJwUGisez3G1QY8Ryz0sdWrLPMGjLk=
+github.com/d2g/dhcp4 v0.0.0-20170904100407-a1d1b6c41b1c/go.mod h1:Ct2BUK8SB0YC1SMSibvLzxjeJLnrYEVLULFNiHY9YfQ=
+github.com/d2g/dhcp4client v1.0.0/go.mod h1:j0hNfjhrt2SxUOw55nL0ATM/z4Yt3t2Kd1mW34z5W5s=
+github.com/d2g/dhcp4server v0.0.0-20181031114812-7d4a0a7f59a5/go.mod h1:Eo87+Kg/IX2hfWJfwxMzLyuSZyxSoAug2nGa1G2QAi8=
+github.com/d2g/hardwareaddr v0.0.0-20190221164911-e7d9fbe030e4/go.mod h1:bMl4RjIciD2oAxI7DmWRx6gbeqrkoLqv3MV0vzNad+I=
+github.com/dave/jennifer v1.7.0 h1:uRbSBH9UTS64yXbh4FrMHfgfY762RD+C7bUPKODpSJE=
+github.com/dave/jennifer v1.7.0/go.mod h1:nXbxhEmQfOZhWml3D1cDK5M1FLnMSozpbFN/m3RmGZc=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/denisenkom/go-mssqldb v0.0.0-20200620013148-b91950f658ec/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/denisenkom/go-mssqldb v0.10.0/go.mod h1:xbL0rPBG9cCiLr28tMa8zpbdarY27NDyej4t/EjAShU=
+github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba/go.mod h1:dV8lFg6daOBZbT6/BDGIz6Y3WFGn8juu6G+CQ6LHtl0=
+github.com/dgrijalva/jwt-go v0.0.0-20170104182250-a601269ab70c/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
 github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
 github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8PWV+bWy6jNmig1y/TA+kYO4g3RSRF0IAv0no=
-github.com/dhui/dktest v0.3.3 h1:DBuH/9GFaWbDRa42qsut/hbQu+srAQ0rPWnUoiGX7CA=
-github.com/dhui/dktest v0.3.3/go.mod h1:EML9sP4sqJELHn4jV7B0TY8oF6077nk83/tz7M56jcQ=
-github.com/dlclark/regexp2 v1.2.0 h1:8sAhBGEM0dRWogWqWyQeIJnxjWO6oIjl8FKqREDsGfk=
-github.com/dlclark/regexp2 v1.2.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
-github.com/docker/distribution v2.7.1+incompatible h1:a5mlkVzth6W5A4fOsS3D2EO5BUmsJpcB+cRlLU7cSug=
+github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48 h1:fRzb/w+pyskVMQ+UbP35JkH8yB7MYb4q/qhBarqZE6g=
+github.com/dgryski/trifles v0.0.0-20200323201526-dd97f9abfb48/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
+github.com/dhui/dktest v0.3.10 h1:0frpeeoM9pHouHjhLeZDuDTJ0PqjDTrycaHaMmkJAo8=
+github.com/dhui/dktest v0.3.10/go.mod h1:h5Enh0nG3Qbo9WjNFRrwmKUaePEBhXMOygbz3Ww7Sz0=
+github.com/dlclark/regexp2 v1.4.0/go.mod h1:2pZnwuY/m+8K6iRw6wQdMtk+rH5tNGR1i55kozfMjCc=
+github.com/dlclark/regexp2 v1.7.0 h1:7lJfhqlPssTb1WQx4yvTHN0uElPEv52sbaECrAQxjAo=
+github.com/dlclark/regexp2 v1.7.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8=
+github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
+github.com/docker/cli v0.0.0-20191017083524-a8ff7f821017/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/cli v27.1.1+incompatible h1:goaZxOqs4QKxznZjjBWKONQci/MywhtRv2oNn0GkeZE=
+github.com/docker/cli v27.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
+github.com/docker/distribution v0.0.0-20190905152932-14b96e55d84c/go.mod h1:0+TTO4EOBfRPhZXAeF1Vu+W3hHZ8eLp8PgKVZlcvtFY=
+github.com/docker/distribution v2.7.1-0.20190205005809-0d3efadf0154+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
 github.com/docker/distribution v2.7.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible h1:iWPIG7pWIsCwT6ZtHnTUpoVMnete7O/pzd9HFE3+tn8=
-github.com/docker/docker v17.12.0-ce-rc1.0.20200618181300-9dc6525e6118+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/distribution v2.8.1+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/distribution v2.8.2+incompatible h1:T3de5rq0dB1j30rp0sA2rER+m322EBzniBPB6ZIzuh8=
+github.com/docker/distribution v2.8.2+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
+github.com/docker/docker v1.4.2-0.20190924003213-a8608b5b67c7/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v20.10.13+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v24.0.7+incompatible h1:Wo6l37AuwP3JaMnZa226lzVXGA3F9Ig1seQen0cKYlM=
+github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker-credential-helpers v0.6.3/go.mod h1:WRaJzqw3CTB9bk10avuGsjVBZsD05qeibJ1/TYlvc0Y=
+github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8=
+github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
 github.com/docker/go-connections v0.4.0/go.mod h1:Gbd7IOopHjR8Iph03tsViu4nIes5XhDvyHbTtUxmeec=
-github.com/docker/go-units v0.4.0 h1:3uh0PgVws3nIA0Q+MwDC8yjEPf9zjRfZZWXZYDct3Tw=
+github.com/docker/go-events v0.0.0-20170721190031-9461782956ad/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
+github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
+github.com/docker/go-metrics v0.0.0-20180209012529-399ea8c73916/go.mod h1:/u0gXw0Gay3ceNrsHubL3BtdOL2fHf93USgMTe0W5dI=
+github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw=
 github.com/docker/go-units v0.4.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
+github.com/docker/go-units v0.5.0/go.mod h1:fgPhTUdO+D/Jk86RDLlptpiXQzgHJF7gydDDbaIK4Dk=
+github.com/docker/libtrust v0.0.0-20150114040149-fa567046d9b1/go.mod h1:cyGadeNEkKy96OOhEzfZl+yxihPEzKnqJwvfuSUqbZE=
+github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96/go.mod h1:Qh8CwZgvJUkLughtfhJv5dyTYa91l1fOUCrgjqmcifM=
+github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
+github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/dustin/go-humanize v1.0.0/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
+github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
+github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/edsrzf/mmap-go v0.0.0-20170320065105-0bce6a688712/go.mod h1:YO35OhQPt3KJa3ryjFM5Bs14WD66h8eGKpfaBNrHW5M=
+github.com/elazarl/goproxy v0.0.0-20180725130230-947c36da3153/go.mod h1:/Zj4wYkgs4iZTTu3o/KG3Itv/qCCa8VVMlb3i9OVuzc=
+github.com/emicklei/go-restful v0.0.0-20170410110728-ff4f55a20633/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/go-restful v2.9.5+incompatible/go.mod h1:otzb+WCGbkyDHkqmQmT5YD2WR4BBwUdeQoFo8l/7tVs=
+github.com/emicklei/proto v1.9.2 h1:YX2MPuUfUi/h8v+yt4WD8cdj6bt9P3475d2zrL0iogM=
+github.com/emicklei/proto v1.9.2/go.mod h1:rn1FgRS/FANiZdD2djyH7TMA9jdRDcYQ9IEN9yvjX0A=
 github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
 github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/go-control-plane v0.9.7/go.mod h1:cwu0lG7PUMfa9snN8LXBig5ynNVH9qI8YYLbd1fK2po=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210217033140-668b12f5399d/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
+github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
+github.com/envoyproxy/go-control-plane v0.9.10-0.20210907150352-cf90f659a021/go.mod h1:AFq3mo9L8Lqqiid3OhADV3RfLJnjiw63cSpi+fDTRC0=
+github.com/envoyproxy/go-control-plane v0.10.1/go.mod h1:AY7fTTXNdv/aJ2O5jwpxAPOWUZ7hQAEvzN5Pf27BkQQ=
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/envoyproxy/protoc-gen-validate v0.6.2/go.mod h1:2t7qjJNvHPx8IjnBOzl9E9/baC+qXE/TeeyBRzgJDws=
+github.com/evanphx/json-patch v4.9.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanphx/json-patch v4.11.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
+github.com/evanw/esbuild v0.19.8 h1:IJ1CRsv3i4dkjPLo6NEGTMI0DDba7jOlPc6JFzIxtl4=
+github.com/evanw/esbuild v0.19.8/go.mod h1:D2vIQZqV/vIf/VRHtViaUtViZmG7o+kKmlBfVQuRi48=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
-github.com/fatih/color v1.10.0 h1:s36xzo75JdqLaaWoiEHk767eHiwo0598uUxyfiPkDsg=
-github.com/fatih/color v1.10.0/go.mod h1:ELkj/draVOlAH/xkhN6mQ50Qd0MPOk5AAr3maGEBuJM=
+github.com/fatih/color v1.15.0 h1:kOqh6YHBtK8aywxGerMG2Eq3H6Qgoqeo13Bk2Mv/nBs=
+github.com/fatih/color v1.15.0/go.mod h1:0h5ZqXfHYED7Bhv2ZJamyIOUej9KtShiJESRwBDUSsw=
 github.com/fatih/structtag v1.2.0 h1:/OdNE99OxoI/PqaW/SuSK9uxxT3f/tcSZgon/ssNSx4=
 github.com/fatih/structtag v1.2.0/go.mod h1:mBJUNpUnHmRKrKlQQlmCrh5PuhftFbNv8Ys4/aAZl94=
-github.com/frankban/quicktest v1.11.2 h1:mjwHjStlXWibxOohM7HYieIViKyh56mmt3+6viyhDDI=
-github.com/frankban/quicktest v1.11.2/go.mod h1:K+q6oSqb0W0Ininfk863uOk1lMy69l/P6txr3mVT54s=
+github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/fmstephe/unsafeutil v1.0.0 h1:hWKjyW7jOL7rfCiBgX61tGy742pZ3C3VpHcGwTAgB2w=
+github.com/fmstephe/unsafeutil v1.0.0/go.mod h1:00y9QPGpX2A5iB0UmPDtnSpO4c2XsRQu3dQYuGL8+RA=
+github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
+github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k=
+github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+github.com/form3tech-oss/jwt-go v3.2.5+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
+github.com/frankban/quicktest v1.11.3/go.mod h1:wRf/ReqHper53s+kmmSZizM8NamnL3IM0I9ntUbOk+k=
+github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
+github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
 github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/fsnotify/fsnotify v1.8.0 h1:dAwr6QBTBZIkG8roQaJjGof0pp0EeF+tNV7YBP3F/8M=
+github.com/fsnotify/fsnotify v1.8.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
 github.com/fsouza/fake-gcs-server v1.17.0/go.mod h1:D1rTE4YCyHFNa99oyJJ5HyclvN/0uQR+pM/VdlL83bw=
+github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
+github.com/gabriel-vasile/mimetype v1.3.1/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmxRtOJlERCzSmRvr8=
+github.com/gabriel-vasile/mimetype v1.4.0/go.mod h1:fA8fi6KUiG7MgQQ+mEWotXoEOvmxRtOJlERCzSmRvr8=
+github.com/garyburd/redigo v0.0.0-20150301180006-535138d7bcd7/go.mod h1:NR3MbYisc3/PwhQ00EMzDiPmrwpPxAn5GI05/YaO1SY=
+github.com/getkin/kin-openapi v0.115.0 h1:c8WHRLVY3G8m9jQTy0/DnIuljgRwTCB5twZytQS4JyU=
+github.com/getkin/kin-openapi v0.115.0/go.mod h1:l5e9PaFUo9fyLJCPGQeXI2ML8c3P8BHOEV2VaAVf/pc=
+github.com/getsentry/raven-go v0.2.0/go.mod h1:KungGk8q33+aIAZUIVWZDr2OfAEBsO49PX4NzFV5kcQ=
+github.com/getsentry/sentry-go v0.25.0 h1:q6Eo+hS+yoJlTO3uu/azhQadsD8V+jQn2D8VvX1eOyI=
+github.com/getsentry/sentry-go v0.25.0/go.mod h1:lc76E2QywIyW8WuBnwl8Lc4bkmQH4+w1gwTf25trprY=
+github.com/ghodss/yaml v0.0.0-20150909031657-73d445a93680/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
+github.com/go-errors/errors v1.4.2 h1:J6MZopCL4uSllY1OfXM374weqZFFItUbrImctkmUxIA=
+github.com/go-errors/errors v1.4.2/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og=
+github.com/go-fonts/dejavu v0.1.0/go.mod h1:4Wt4I4OU2Nq9asgDCteaAaWZOV24E+0/Pwo0gppep4g=
+github.com/go-fonts/latin-modern v0.2.0/go.mod h1:rQVLdDMK+mK1xscDwsqM5J8U2jrRa3T0ecnM9pNujks=
+github.com/go-fonts/liberation v0.1.1/go.mod h1:K6qoJYypsmfVjWg8KOVDQhLc8UDgIK2HYqyqAO9z7GY=
+github.com/go-fonts/stix v0.1.0/go.mod h1:w/c1f0ldAUlJmLBvlbkvVXLAD+tAMqobIIQpmnUIzUY=
 github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
+github.com/go-ini/ini v1.25.4/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
 github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
+github.com/go-kit/log v0.1.0/go.mod h1:zbhenjAZHb184qTLMA9ZjW7ThYL0H2mk7Q6pNt4vbaY=
+github.com/go-latex/latex v0.0.0-20210118124228-b3d85cf34e07/go.mod h1:CO1AlKB2CSIqUrmQPqA0gdRIlnLEY0gK5JGjh37zN5U=
 github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
 github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
+github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
+github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/go-logr/logr v0.2.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
+github.com/go-logr/logr v0.4.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
+github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.1/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.0/go.mod h1:YkVgnZu1ZjjL7xTxrfm/LLZBfkhTqSR1ydtm6jTKKwI=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-openapi/jsonpointer v0.0.0-20160704185906-46af16f9f7b1/go.mod h1:+35s3my2LFTysnkMfxsJBAMHj/DoqoB9knIWoYG/Vk0=
+github.com/go-openapi/jsonpointer v0.19.2/go.mod h1:3akKfEdA7DF1sugOqz1dVQHBcuDBPKZGEoHC/NkiQRg=
+github.com/go-openapi/jsonpointer v0.19.3/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
+github.com/go-openapi/jsonpointer v0.20.0 h1:ESKJdU9ASRfaPNOPRx12IUyA1vn3R9GiE3KYD14BXdQ=
+github.com/go-openapi/jsonpointer v0.20.0/go.mod h1:6PGzBjjIIumbLYysB73Klnms1mwnU4G3YHOECG3CedA=
+github.com/go-openapi/jsonreference v0.0.0-20160704190145-13c6e3589ad9/go.mod h1:W3Z9FmVs9qj+KR4zFKmDPGiLdk1D9Rlm7cyMvf57TTg=
+github.com/go-openapi/jsonreference v0.19.2/go.mod h1:jMjeRr2HHw6nAVajTXJ4eiUwohSTlpa0o73RUL1owJc=
+github.com/go-openapi/jsonreference v0.19.3/go.mod h1:rjx6GuL8TTa9VaixXglHmQmIL98+wF9xc8zWvFonSJ8=
+github.com/go-openapi/jsonreference v0.19.5/go.mod h1:RdybgQwPxbL4UEjuAruzK1x3nE69AqPYEJeo/TWfEeg=
+github.com/go-openapi/spec v0.0.0-20160808142527-6aced65f8501/go.mod h1:J8+jY1nAiCcj+friV/PDoE1/3eeccG9LYBs0tYvLOWc=
+github.com/go-openapi/spec v0.19.3/go.mod h1:FpwSN1ksY1eteniUU7X0N/BgJ7a4WvBFVA8Lj9mJglo=
+github.com/go-openapi/swag v0.0.0-20160704191624-1d0bd113de87/go.mod h1:DXUve3Dpr1UfpPtxFw+EFuQ41HhCWZfha5jSVRG7C7I=
+github.com/go-openapi/swag v0.19.2/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.5/go.mod h1:POnQmlKehdgb5mhVOsnJFsivZCEZ/vjK9gh66Z9tfKk=
+github.com/go-openapi/swag v0.19.14/go.mod h1:QYRuS/SOXUCsnplDa677K7+DxSOj6IPNl/eQntq43wQ=
+github.com/go-openapi/swag v0.22.4 h1:QLMzNJnMGPRNDCbySlcj1x01tzU8/9LTTL9hZZZogBU=
+github.com/go-openapi/swag v0.22.4/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
+github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
+github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
 github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
 github.com/go-sql-driver/mysql v1.5.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
+github.com/go-sql-driver/mysql v1.9.2 h1:4cNKDYQ1I84SXslGddlsrMhc8k4LeDVj6Ad6WRjiHuU=
+github.com/go-sql-driver/mysql v1.9.2/go.mod h1:qn46aNg1333BRMNU69Lq93t8du/dwxI64Gl8i5p1WMU=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
+github.com/go-test/deep v1.0.8 h1:TDsG77qcSprGbC6vTN8OuXp5g+J+b5Pcguhf7Zt61VM=
+github.com/go-test/deep v1.0.8/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE=
+github.com/go-viper/mapstructure/v2 v2.2.1 h1:ZAaOCxANMuZx5RCeg0mBdEZk7DZasvvZIxtHqx8aGss=
+github.com/go-viper/mapstructure/v2 v2.2.1/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM=
+github.com/gobuffalo/attrs v0.0.0-20190224210810-a9411de4debd/go.mod h1:4duuawTqi2wkkpB4ePgWMaai6/Kc6WEz83bhFwpHzj0=
+github.com/gobuffalo/depgen v0.0.0-20190329151759-d478694a28d3/go.mod h1:3STtPUQYuzV0gBVOY3vy6CfMm/ljR4pABfrTeHNLHUY=
+github.com/gobuffalo/depgen v0.1.0/go.mod h1:+ifsuy7fhi15RWncXQQKjWS9JPkdah5sZvtHc2RXGlg=
+github.com/gobuffalo/envy v1.6.15/go.mod h1:n7DRkBerg/aorDM8kbduw5dN3oXGswK5liaSCx4T5NI=
+github.com/gobuffalo/envy v1.7.0/go.mod h1:n7DRkBerg/aorDM8kbduw5dN3oXGswK5liaSCx4T5NI=
+github.com/gobuffalo/flect v0.1.0/go.mod h1:d2ehjJqGOH/Kjqcoz+F7jHTBbmDb38yXA598Hb50EGs=
+github.com/gobuffalo/flect v0.1.1/go.mod h1:8JCgGVbRjJhVgD6399mQr4fx5rRfGKVzFjbj6RE/9UI=
+github.com/gobuffalo/flect v0.1.3/go.mod h1:8JCgGVbRjJhVgD6399mQr4fx5rRfGKVzFjbj6RE/9UI=
+github.com/gobuffalo/genny v0.0.0-20190329151137-27723ad26ef9/go.mod h1:rWs4Z12d1Zbf19rlsn0nurr75KqhYp52EAGGxTbBhNk=
+github.com/gobuffalo/genny v0.0.0-20190403191548-3ca520ef0d9e/go.mod h1:80lIj3kVJWwOrXWWMRzzdhW3DsrdjILVil/SFKBzF28=
+github.com/gobuffalo/genny v0.1.0/go.mod h1:XidbUqzak3lHdS//TPu2OgiFB+51Ur5f7CSnXZ/JDvo=
+github.com/gobuffalo/genny v0.1.1/go.mod h1:5TExbEyY48pfunL4QSXxlDOmdsD44RRq4mVZ0Ex28Xk=
+github.com/gobuffalo/gitgen v0.0.0-20190315122116-cc086187d211/go.mod h1:vEHJk/E9DmhejeLeNt7UVvlSGv3ziL+djtTr3yyzcOw=
+github.com/gobuffalo/gogen v0.0.0-20190315121717-8f38393713f5/go.mod h1:V9QVDIxsgKNZs6L2IYiGR8datgMhB577vzTDqypH360=
+github.com/gobuffalo/gogen v0.1.0/go.mod h1:8NTelM5qd8RZ15VjQTFkAW6qOMx5wBbW4dSCS3BY8gg=
+github.com/gobuffalo/gogen v0.1.1/go.mod h1:y8iBtmHmGc4qa3urIyo1shvOD8JftTtfcKi+71xfDNE=
 github.com/gobuffalo/here v0.6.0/go.mod h1:wAG085dHOYqUpf+Ap+WOdrPTp5IYcDAs/x7PLa8Y5fM=
-github.com/gocql/gocql v0.0.0-20190301043612-f6df8288f9b4/go.mod h1:4Fw1eo5iaEhDUs8XyuhSVCVy52Jq3L+/3GJgYkwc+/0=
+github.com/gobuffalo/logger v0.0.0-20190315122211-86e12af44bc2/go.mod h1:QdxcLw541hSGtBnhUc4gaNIXRjiDppFGaDqzbrBd3v8=
+github.com/gobuffalo/mapi v1.0.1/go.mod h1:4VAGh89y6rVOvm5A8fKFxYG+wIW6LO1FMTG9hnKStFc=
+github.com/gobuffalo/mapi v1.0.2/go.mod h1:4VAGh89y6rVOvm5A8fKFxYG+wIW6LO1FMTG9hnKStFc=
+github.com/gobuffalo/packd v0.0.0-20190315124812-a385830c7fc0/go.mod h1:M2Juc+hhDXf/PnmBANFCqx4DM3wRbgDvnVWeG2RIxq4=
+github.com/gobuffalo/packd v0.1.0/go.mod h1:M2Juc+hhDXf/PnmBANFCqx4DM3wRbgDvnVWeG2RIxq4=
+github.com/gobuffalo/packr/v2 v2.0.9/go.mod h1:emmyGweYTm6Kdper+iywB6YK5YzuKchGtJQZ0Odn4pQ=
+github.com/gobuffalo/packr/v2 v2.2.0/go.mod h1:CaAwI0GPIAv+5wKLtv8Afwl+Cm78K/I/VCm/3ptBN+0=
+github.com/gobuffalo/syncx v0.0.0-20190224160051-33c29581e754/go.mod h1:HhnNqWY95UYwwW3uSASeV7vtgYkT2t16hJgV3AEPUpw=
+github.com/gocql/gocql v0.0.0-20210515062232-b7ef815b4556/go.mod h1:DL0ekTmBSTdlNF25Orwt/JMzqIq3EJ4MVa/J/uK64OY=
+github.com/godbus/dbus v0.0.0-20151105175453-c7fdd8b5cd55/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
+github.com/godbus/dbus v0.0.0-20180201030542-885f9cc04c9c/go.mod h1:/YcGZj5zSblfDWMMoOzV4fas9FZnQYTkDnsGvmh2Grw=
+github.com/godbus/dbus v0.0.0-20190422162347-ade71ed3457e/go.mod h1:bBOAhwG1umN6/6ZUMtDFBMQR8jRg9O75tm9K00oMsK4=
+github.com/godbus/dbus/v5 v5.0.3/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/godbus/dbus/v5 v5.0.6/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/gofrs/uuid v4.0.0+incompatible h1:1SD/1F5pU8p29ybwgQSwpQk+mwdRrXCYuPhW6m+TnJw=
 github.com/gofrs/uuid v4.0.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
+github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
+github.com/gogo/googleapis v1.2.0/go.mod h1:Njal3psf3qN6dwBtQfUmBZh2ybovJ0tlu3o/AC7HYjU=
+github.com/gogo/googleapis v1.4.0/go.mod h1:5YRNX2z1oM5gXdAkurHa942MDgEJyk02w4OecKY87+c=
 github.com/gogo/protobuf v1.1.1/go.mod h1:r8qH/GZQm5c6nD/R0oafs1akxWv10x8SbQlK7atdtwQ=
 github.com/gogo/protobuf v1.2.1/go.mod h1:hp+jE20tsWTFYpLwKvXlhS1hjn+gTNwPg2I6zVXpSg4=
-github.com/gogo/protobuf v1.3.1 h1:DqDEcV5aeaTmdFBePNpYsp3FlcVH/2ISVVM9Qf8PSls=
+github.com/gogo/protobuf v1.2.2-0.20190723190241-65acae22fc9d/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
+github.com/gogo/protobuf v1.3.0/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
 github.com/gogo/protobuf v1.3.1/go.mod h1:SlYgWuQ5SjCEi6WLHjHCa1yvBfUnHcTbrrZtXPKa29o=
-github.com/golang-migrate/migrate/v4 v4.14.1 h1:qmRd/rNGjM1r3Ve5gHd5ZplytrD02UcItYNxJ3iUHHE=
-github.com/golang-migrate/migrate/v4 v4.14.1/go.mod h1:l7Ks0Au6fYHuUIxUhQ0rcVX1uLlJg54C/VvW7tvxSz0=
+github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
+github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/golang-jwt/jwt/v4 v4.0.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
+github.com/golang-jwt/jwt/v4 v4.1.0/go.mod h1:/xlHOz8bRuivTWchD4jCa+NbatV+wEUSzwAxVc6locg=
+github.com/golang-migrate/migrate/v4 v4.15.2 h1:vU+M05vs6jWHKDdmE1Ecwj0BznygFc4QsdRe2E/L7kc=
+github.com/golang-migrate/migrate/v4 v4.15.2/go.mod h1:f2toGLkYqD3JH+Todi4aZ2ZdbeUNx4sIwiOK96rE9Lw=
 github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe/go.mod h1:8vg3r2VgvsThLBIFL93Qb5yWzgyZWhEmBwUJWevAkK0=
+github.com/golang/freetype v0.0.0-20170609003504-e2365dfdc4a0/go.mod h1:E/TSTwGwJL78qG/PmXZO1EjYhfJinVAhrmmHX6Z8B9k=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/glog v1.2.4 h1:CNNw5U8lSiiBk7druxtSHHTsRWcxKoac6kZKm2peBBc=
+github.com/golang/glog v1.2.4/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
+github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.2.0/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
@@ -165,6 +651,8 @@ github.com/golang/mock v1.4.0/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt
 github.com/golang/mock v1.4.1/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.3/go.mod h1:UOMv5ysSaYNkG+OFQykRIcU/QvvxJf3p21QfJ2Bt3cw=
 github.com/golang/mock v1.4.4/go.mod h1:l3mdAwkq5BuhzHwde/uurv3sEJeZMXNpwsxVWU71h+4=
+github.com/golang/mock v1.5.0/go.mod h1:CWnOUgYIOo4TcNZ0wHX3YZCqsaM1I1Jvs6v3mP3KVu8=
+github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
 github.com/golang/protobuf v1.0.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -179,13 +667,25 @@ github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:W
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3 h1:JjCZWpVbqXDqFVmTfYWEVTMIYrL/NPdPSCHPJ0T/raM=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
+github.com/golang/protobuf v1.5.1/go.mod h1:DopwsBzvsk0Fs44TXzsVbJyPhcCPeIwnvohx4u74HPM=
+github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/golang/snappy v0.0.0-20170215233205-553a64147049/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.3/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
-github.com/google/flatbuffers v1.11.0/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
+github.com/google/btree v1.0.1/go.mod h1:xXMiIv4Fb/0kKde4SpL7qlzvu5cMJDRkFDxJfI9uaxA=
+github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
+github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
+github.com/google/cel-go v0.24.1 h1:jsBCtxG8mM5wiUJDSGUqU0K7Mtr3w7Eyv00rw4DiZxI=
+github.com/google/cel-go v0.24.1/go.mod h1:Hdf9TqOaTNSFQA1ybQaRqATVoK7m/zcf7IMhGXP5zI8=
+github.com/google/flatbuffers v2.0.0+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
 github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -193,12 +693,30 @@ github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.4.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.2 h1:X2ev0eStA3AbceY54o37/0PQ/UWqKEiiO2dKL5OPaFM=
 github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-github v17.0.0+incompatible/go.mod h1:zLgOLi98H3fifZn+44m+umXrS52loVEgC2AApnigrVQ=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-containerregistry v0.5.1/go.mod h1:Ct15B4yir3PLOP5jsy0GNeYVaIZs/MK/Jz5any1wFW0=
+github.com/google/go-containerregistry v0.20.2 h1:B1wPJ1SN/S7pB+ZAimcciVD+r+yV/l/DSArMxlbwseo=
+github.com/google/go-containerregistry v0.20.2/go.mod h1:z38EKdKh4h7IP2gSfUUqEvalZBqs6AoLeWfUy34nQC8=
+github.com/google/go-github/v39 v39.2.0/go.mod h1:C1s8C5aCC9L+JXIYpJM5GYytdX52vC1bLvHEF1IhBrE=
 github.com/google/go-querystring v1.0.0/go.mod h1:odCYkC5MyYFN7vkCjXpyrEuKhc/BUO6wN/zVPAxq5ck=
+github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
 github.com/google/martian v2.1.0+incompatible/go.mod h1:9I4somxYTbIHy5NJKHRl3wXiIaQGbYVAs8BPL6v8lEs=
 github.com/google/martian/v3 v3.0.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/martian/v3 v3.1.0/go.mod h1:y5Zk1BBys9G+gd6Jrk0W3cC1+ELVxBWuIGO+w/tUAp0=
+github.com/google/martian/v3 v3.2.1/go.mod h1:oBOf6HBosgwRXnUGWUB05QECsc6uvmMiJ3+6W4l/CUk=
+github.com/google/martian/v3 v3.3.3 h1:DIhPTQrbPkgs2yJYdXU/eNACCG5DVQjySNRNlflZ9Fc=
+github.com/google/martian/v3 v3.3.3/go.mod h1:iEPrYcgCF7jA9OtScMFQyAlZZ4YXTKEtJ1E6RWzmBA0=
 github.com/google/pprof v0.0.0-20181206194817-3ea8567a2e57/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20190515194954-54271f7e092f/go.mod h1:zfwlbNMJ+OItoe0UupaVj+oy1omPYYDuagoSzA8v9mc=
 github.com/google/pprof v0.0.0-20191218002539-d4f498aebedc/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
@@ -206,33 +724,74 @@ github.com/google/pprof v0.0.0-20200212024743-f11f1df84d12/go.mod h1:ZgVRPoUq/hf
 github.com/google/pprof v0.0.0-20200229191704-1ebb73c60ed3/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
 github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
+github.com/google/pprof v0.0.0-20201023163331-3e6fc7fc9c4c/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20201203190320-1bf35d6f28c2/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210122040257-d980be63207e/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210226084205-cbba55b83ad5/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210601050228-01bbb1931b22/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210609004039-a478d1d731e9/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLew5upagYY7GY0pfYCcupk39gWOCRROcvE=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
+github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
+github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
+github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
+github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
+github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
+github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.3.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4 h1:XYIDZApgAnrN1c855gTgghdIA6Stxb52D5RnLI1SLyw=
+github.com/googleapis/enterprise-certificate-proxy v0.3.4/go.mod h1:YKe7cfqYXjKGpGvmSg28/fFvhNzinZQm8DGnaburhGA=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
+github.com/googleapis/gax-go/v2 v2.1.0/go.mod h1:Q3nei7sK6ybPYH7twZdmQpAd1MKb7pfu6SK+H1/DsU0=
+github.com/googleapis/gax-go/v2 v2.1.1/go.mod h1:hddJymUZASv3XPyGkUpKj8pPO47Rmb0eJc8R6ouapiM=
+github.com/googleapis/gax-go/v2 v2.13.0 h1:yitjD5f7jQHhyDsnhKEBU52NdvvdSeGzlAnDPT0hH1s=
+github.com/googleapis/gax-go/v2 v2.13.0/go.mod h1:Z/fvTZXF8/uw7Xu5GuslPw+bplx6SS338j1Is2S+B7A=
+github.com/googleapis/gnostic v0.4.1/go.mod h1:LRhVm6pbyptWbWbuZ38d1eyptfvIytN3ir6b65WBswg=
+github.com/googleapis/gnostic v0.5.1/go.mod h1:6U4PtQXGIEt/Z3h5MAT7FNofLnw9vXk2cUuW7uA/OeU=
+github.com/googleapis/gnostic v0.5.5/go.mod h1:7+EbHbldMins07ALC74bsA81Ovc97DwqyJO1AENw9kA=
 github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
-github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
+github.com/gorilla/handlers v0.0.0-20150720190736-60c7bfde3e33/go.mod h1:Qkdc/uu4tH4g6mTK6auzZ766c4CA0Ng8+o/OAirnOIQ=
 github.com/gorilla/handlers v1.4.2/go.mod h1:Qkdc/uu4tH4g6mTK6auzZ766c4CA0Ng8+o/OAirnOIQ=
-github.com/gorilla/mux v1.6.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
+github.com/gorilla/mux v1.7.2/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.3/go.mod h1:1lud6UwP+6orDFRuTfBEV8e9/aOM/c4fVVCaMa2zaAs=
 github.com/gorilla/mux v1.7.4/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
-github.com/gorilla/websocket v1.4.2 h1:+/TMaTYc4QFitKJxsQ7Yye35DkWvkdLcvGKqM+x0Ufc=
+github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
+github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
+github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
+github.com/gorilla/websocket v0.0.0-20170926233335-4201258b820c/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
+github.com/gorilla/websocket v1.4.0/go.mod h1:E7qHFY5m1UJ88s3WnNqhKjPHQ0heANvMoAMk2YaljkQ=
 github.com/gorilla/websocket v1.4.2/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gorilla/websocket v1.5.0 h1:PPwGk2jz7EePpoHN/+ClbZu8SPxiqlu12wZP/3sWmnc=
+github.com/gorilla/websocket v1.5.0/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
 github.com/grpc-ecosystem/go-grpc-middleware v1.0.0/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
+github.com/grpc-ecosystem/go-grpc-middleware v1.0.1-0.20190118093823-f849b5445de4/go.mod h1:FiyG127CGDf3tlThmgyCl78X/SZQqEOJBCDaAfeWzPs=
+github.com/grpc-ecosystem/go-grpc-middleware v1.3.0/go.mod h1:z0ButlSOZa5vEBq9m2m2hlwIgKw+rp3sdCBRoJY+30Y=
 github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0/go.mod h1:8NvIoxWQoOIhqOTXgfV/d3M/q6VIi02HzZEHgUlZvzk=
 github.com/grpc-ecosystem/grpc-gateway v1.9.0/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/grpc-ecosystem/grpc-gateway v1.9.5/go.mod h1:vNeuVxBJEsws4ogUvrchl83t/GYV9WGTSLVdBhOQFDY=
+github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
 github.com/hailocab/go-hostpool v0.0.0-20160125115350-e80d13ce29ed/go.mod h1:tMWxXQ9wFIaZeTI9F+hmhFiGpFmhOHzyShyFUhRm0H4=
 github.com/hashicorp/consul/api v1.1.0/go.mod h1:VmuI/Lkw1nC05EYQWNKwWGbkg+FbDBtguAZLlVdkD9Q=
 github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
-github.com/hashicorp/errwrap v1.0.0 h1:hLrqtEDnRye3+sgx6z4qVLNuviH3MR5aQ0ykNJa/UYA=
+github.com/hashicorp/errwrap v0.0.0-20141028054710-7554cd9344ce/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
+github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
+github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-immutable-radix v1.0.0/go.mod h1:0y9vanUI8NX6FsYoO3zeMjhV/C5i9g4Q3DwcSNZ4P60=
 github.com/hashicorp/go-msgpack v0.5.3/go.mod h1:ahLV/dePpqEmjfWmKiqvPkv/twdG7iPBM1vqhUKIvfM=
+github.com/hashicorp/go-multierror v0.0.0-20161216184304-ed905158d874/go.mod h1:JMRHfdO9jKNzS/+BTlxCjKNQHg/jZAft8U7LloJvN7I=
 github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHhCYQXV3UM06sGGrk=
-github.com/hashicorp/go-multierror v1.1.0 h1:B9UzwGQJehnUY1yNrnwREHc3fGbC2xefo8g4TbElacI=
-github.com/hashicorp/go-multierror v1.1.0/go.mod h1:spPvp8C1qA32ftKqdAHm4hHTbPw+vmowP0z+KUhOZdA=
+github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
+github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-rootcerts v1.0.0/go.mod h1:K6zTfqpRlCUIjkwsN4Z+hiSfzSTQa6eBIzfwKfwNnHU=
 github.com/hashicorp/go-sockaddr v1.0.0/go.mod h1:7Xibr9yA9JjQq1JpNB2Vw7kxv8xerXegt+ozgdvDeDU=
 github.com/hashicorp/go-syslog v1.0.0/go.mod h1:qPfqrKkXGihmCqbJM2mZgkZGvKG1dFdvsLplgctolz4=
@@ -246,15 +805,25 @@ github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO
 github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
 github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
 github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/JwenrHc=
-github.com/hashicorp/yamux v0.0.0-20200609203250-aecfd211c9ce h1:7UnVY3T/ZnHUrfviiAgIUjg2PXxsQfs5bphsG8F7Keo=
-github.com/hashicorp/yamux v0.0.0-20200609203250-aecfd211c9ce/go.mod h1:+NfK9FKeTrX5uv1uIXGdwYDTeHna2qgaIlx54MXqjAM=
-github.com/hinshun/vt10x v0.0.0-20180616224451-1954e6464174 h1:WlZsjVhE8Af9IcZDGgJGQpNflI3+MJSBhsgT5PCtzBQ=
-github.com/hinshun/vt10x v0.0.0-20180616224451-1954e6464174/go.mod h1:DqJ97dSdRW1W22yXSB90986pcOyQ7r45iio1KN2ez1A=
+github.com/hasura/go-graphql-client v0.12.1 h1:tL+BCoyubkYYyaQ+tJz+oPe/pSxYwOJHwe5SSqqi6WI=
+github.com/hasura/go-graphql-client v0.12.1/go.mod h1:F4N4kR6vY8amio3gEu3tjSZr8GPOXJr3zj72DKixfLE=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
+github.com/iancoleman/strcase v0.2.0/go.mod h1:iwCmte+B7n89clKwxIoIXy/HfoL7AsD47ZCWhYzw7ho=
 github.com/ianlancetaylor/demangle v0.0.0-20181102032728-5e5cf60278f6/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
+github.com/ianlancetaylor/demangle v0.0.0-20200824232613-28f6c0f3b639/go.mod h1:aSSvb/t6k1mPoxDqO4vJh6VOCGPwU4O0C2/Eqndh1Sc=
+github.com/imdario/mergo v0.3.5/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
+github.com/imdario/mergo v0.3.10/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
+github.com/imdario/mergo v0.3.12/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/jackc/chunkreader v1.0.0 h1:4s39bBR8ByfqH+DKm8rQA3E1LHZWB9XWcrz8fqaZbe0=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/intel/goresctrl v0.2.0/go.mod h1:+CZdzouYFn5EsxgqAQTEzMfwKwuc0fVdMrT9FCCAVRQ=
+github.com/invopop/yaml v0.1.0 h1:YW3WGUoJEXYfzWBjn00zIlrw7brGVD0fUKRYDPAPhrc=
+github.com/invopop/yaml v0.1.0/go.mod h1:2XuRLgs/ouIrW3XNzuNj7J3Nvu/Dig5MXvbCEdiBN3Q=
+github.com/j-keck/arping v0.0.0-20160618110441-2cf9dc699c56/go.mod h1:ymszkNOg6tORTn+6F6j+Jc8TOr5osrynvN6ivFWZ2GA=
+github.com/j-keck/arping v1.0.2/go.mod h1:aJbELhR92bSk7tp79AWM/ftfc90EfEi2bQJrbBFOsPw=
 github.com/jackc/chunkreader v1.0.0/go.mod h1:RT6O25fNZIuasFJRyZ4R/Y2BbhasbmZXF9QQ7T3kePo=
 github.com/jackc/chunkreader/v2 v2.0.0/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgOHwnPIn9lDKlk=
 github.com/jackc/chunkreader/v2 v2.0.1 h1:i+RDz65UE+mmpjTfyz0MoVTnzeYxroil2G82ki7MGG8=
@@ -262,19 +831,20 @@ github.com/jackc/chunkreader/v2 v2.0.1/go.mod h1:odVSm741yZoC3dpHEUXIqA9tQRhFrgO
 github.com/jackc/pgconn v0.0.0-20190420214824-7e0022ef6ba3/go.mod h1:jkELnwuX+w9qN5YIfX0fl88Ehu4XC3keFuOJJk9pcnA=
 github.com/jackc/pgconn v0.0.0-20190824142844-760dd75542eb/go.mod h1:lLjNuW/+OfW9/pnVKPazfWOgNfH2aPem8YQ7ilXGvJE=
 github.com/jackc/pgconn v0.0.0-20190831204454-2fabfa3c18b7/go.mod h1:ZJKsE/KZfsUgOEh9hBm+xYTstcNHg7UPMVJqRfQxq4s=
-github.com/jackc/pgconn v1.3.2/go.mod h1:LvCquS3HbBKwgl7KbX9KyqEIumJAbm1UMcTvGaIf3bM=
 github.com/jackc/pgconn v1.4.0/go.mod h1:Y2O3ZDF0q4mMacyWV3AstPJpeHXWGEetiFttmq5lahk=
 github.com/jackc/pgconn v1.5.0/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
 github.com/jackc/pgconn v1.5.1-0.20200601181101-fa742c524853/go.mod h1:QeD3lBfpTFe8WUnPZWN5KY/mB8FGMIYRdd8P8Jr0fAI=
-github.com/jackc/pgconn v1.8.0 h1:FmjZ0rOyXTr1wfWs45i4a9vjnjWUAGpMuQLD9OSs+lw=
 github.com/jackc/pgconn v1.8.0/go.mod h1:1C2Pb36bGIP9QHGBYCjnyhqu7Rv3sGshaQUvmfGIB/o=
+github.com/jackc/pgconn v1.14.3 h1:bVoTr12EGANZz66nZPkMInAV/KHD2TxH9npjXXgiB3w=
+github.com/jackc/pgconn v1.14.3/go.mod h1:RZbme4uasqzybK2RK5c65VsHxoyaml09lx3tXOcO/VM=
+github.com/jackc/pgerrcode v0.0.0-20201024163028-a0d42d470451/go.mod h1:a/s9Lp5W7n/DD0VrVoyJ00FbP2ytTPDVOivvn2bMlds=
 github.com/jackc/pgio v1.0.0 h1:g12B9UwVnzGhueNavwioyEEpAmqMe1E/BN9ES+8ovkE=
 github.com/jackc/pgio v1.0.0/go.mod h1:oP+2QK2wFfUWgr+gxjoBH9KGBb31Eio69xUb0w5bYf8=
-github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2 h1:JVX6jT/XfzNqIjye4717ITLaNwV9mWbJx0dLCpcRzdA=
 github.com/jackc/pgmock v0.0.0-20190831213851-13a1b77aafa2/go.mod h1:fGZlG77KXmcq05nJLRkk0+p82V8B8Dw8KN2/V9c/OAE=
+github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65 h1:DadwsjnMwFjfWc9y5Wi/+Zz7xoE5ALHsRQlOctkOiHc=
+github.com/jackc/pgmock v0.0.0-20210724152146-4ad1a8207f65/go.mod h1:5R2h2EEX+qri8jOWMbJCtaPWkrrNc7OHwsp2TCqp7ak=
 github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
-github.com/jackc/pgproto3 v1.1.0 h1:FYYE4yRw+AgI8wXIinMlNjBbp/UitDJwfj5LqqewP1A=
 github.com/jackc/pgproto3 v1.1.0/go.mod h1:eR5FA3leWg7p9aeAqi37XOTgTIbkABlvcPB3E5rlc78=
 github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190420180111-c116219b62db/go.mod h1:bhq50y+xrl9n5mRYyCBFKkpRVTLYJVWeCc+mEAI3yXA=
 github.com/jackc/pgproto3/v2 v2.0.0-alpha1.0.20190609003834-432c2951c711/go.mod h1:uH0AWtUmuShn0bcesswc4aBTWGvw0cAxIJp+6OB//Wg=
@@ -282,18 +852,19 @@ github.com/jackc/pgproto3/v2 v2.0.0-rc3/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvW
 github.com/jackc/pgproto3/v2 v2.0.0-rc3.0.20190831210041-4c03ce451f29/go.mod h1:ryONWYqW6dqSg1Lw6vXNMXoBJhpzvWKnT95C46ckYeM=
 github.com/jackc/pgproto3/v2 v2.0.1/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgproto3/v2 v2.0.6/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
-github.com/jackc/pgproto3/v2 v2.0.7 h1:6Pwi1b3QdY65cuv6SyVO0FgPd5J3Bl7wf/nQQjinHMA=
 github.com/jackc/pgproto3/v2 v2.0.7/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
+github.com/jackc/pgproto3/v2 v2.3.3 h1:1HLSx5H+tXR9pW3in3zaztoEwQYRC9SQaYUHjTSUOag=
+github.com/jackc/pgproto3/v2 v2.3.3/go.mod h1:WfJCnwN3HIg9Ish/j3sgWXnAfK8A9Y0bwXYU5xKaEdA=
 github.com/jackc/pgservicefile v0.0.0-20200307190119-3430c5407db8/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
-github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b h1:C8S2+VttkHFdOOCXJe+YGfa4vHYwlt4Zx+IVXQ97jYg=
 github.com/jackc/pgservicefile v0.0.0-20200714003250-2b9c44734f2b/go.mod h1:vsD4gTJCa9TptPL8sPkXrLZ+hDuNrZCnj29CQpr4X1E=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
+github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
 github.com/jackc/pgtype v0.0.0-20190421001408-4ed0de4755e0/go.mod h1:hdSHsc1V01CGwFsrv11mJRHWJ6aifDLfdV3aVjFF0zg=
 github.com/jackc/pgtype v0.0.0-20190824184912-ab885b375b90/go.mod h1:KcahbBH1nCMSo2DXpzsoWOAfFkdEtEJpPbVLq8eE+mc=
 github.com/jackc/pgtype v0.0.0-20190828014616-a8802b16cc59/go.mod h1:MWlu30kVJrUS8lot6TQqcg7mtthZ9T0EoIBFiJcmcyw=
 github.com/jackc/pgtype v1.2.0/go.mod h1:5m2OfMh1wTK7x+Fk952IDmI4nw3nPrvtQdM0ZT4WpC0=
 github.com/jackc/pgtype v1.3.1-0.20200510190516-8cd94a14c75a/go.mod h1:vaogEUkALtxZMCH411K+tKzNpwzCKU+AnPzBKZ+I+Po=
 github.com/jackc/pgtype v1.3.1-0.20200606141011-f6355165a91c/go.mod h1:cvk9Bgu/VzJ9/lxTO5R5sf80p0DiucVtN7ZxvaC4GmQ=
-github.com/jackc/pgtype v1.6.2 h1:b3pDeuhbbzBYcg5kwNmNDun4pFUD/0AAr1kLXZLeNt8=
 github.com/jackc/pgtype v1.6.2/go.mod h1:JCULISAZBFGrHaOXIIFiyfzW5VY0GRitRr8NeJsrdig=
 github.com/jackc/pgx/v4 v4.0.0-20190420224344-cc3461e65d96/go.mod h1:mdxmSJJuR08CZQyj1PVQBHy9XOp5p8/SHH6a0psbY9Y=
 github.com/jackc/pgx/v4 v4.0.0-20190421002000-1b8f0016e912/go.mod h1:no/Y67Jkk/9WuGR0JG/JseM9irFbnEPbuWV2EELPNuM=
@@ -301,249 +872,697 @@ github.com/jackc/pgx/v4 v4.0.0-pre1.0.20190824185557-6972a5742186/go.mod h1:X+GQ
 github.com/jackc/pgx/v4 v4.5.0/go.mod h1:EpAKPLdnTorwmPUUsqrPxy5fphV18j9q3wrfRXgo+kA=
 github.com/jackc/pgx/v4 v4.6.1-0.20200510190926-94ba730bb1e9/go.mod h1:t3/cdRQl6fOLDxqtlyhe9UWgfIi9R8+8v8GKV5TRA/o=
 github.com/jackc/pgx/v4 v4.6.1-0.20200606145419-4e5062306904/go.mod h1:ZDaNWkt9sW1JMiNn0kdYBaLelIhw7Pg4qd+Vk6tw7Hg=
-github.com/jackc/pgx/v4 v4.10.1 h1:/6Q3ye4myIj6AaplUm+eRcz4OhK9HAvFf4ePsG40LJY=
 github.com/jackc/pgx/v4 v4.10.1/go.mod h1:QlrWebbs3kqEZPHCTGyxecvzG6tvIsYu+A5b1raylkA=
+github.com/jackc/pgx/v5 v5.7.4 h1:9wKznZrhWa2QiHL+NjTSPP6yjl3451BX3imWDnokYlg=
+github.com/jackc/pgx/v5 v5.7.4/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
 github.com/jackc/puddle v0.0.0-20190413234325-e4ced69a3a2b/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v0.0.0-20190608224051-11cab39313c9/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.0/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.1/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
 github.com/jackc/puddle v1.1.3/go.mod h1:m4B5Dj62Y0fbyuIc15OsIqK0+JU8nkqQjsgx7dvjSWk=
+github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
+github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
+github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.1.1/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/jmespath/go-jmespath v0.0.0-20160202185014-0b12d6b521d8/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/jmespath/go-jmespath v0.0.0-20160803190731-bd40a432e4c7/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
 github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
 github.com/jmoiron/sqlx v1.2.0/go.mod h1:1FEQNm3xlJgrMD+FBdI9+xvCksHtbpVBBw5dYhBSsks=
+github.com/jmoiron/sqlx v1.3.1/go.mod h1:2BljVx/86SuTyjE+aPYlHCTNvZrnJXghYGpNiXLBMCQ=
+github.com/joefitzgerald/rainbow-reporter v0.1.0/go.mod h1:481CNgqmVHQZzdIbN52CupLJyoVwB10FQ/IQlF1pdL8=
+github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
 github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
-github.com/jsimonetti/rtnetlink v0.0.0-20190606172950-9527aa82566a/go.mod h1:Oz+70psSo5OFh8DBl0Zv2ACw7Esh6pPUphlvZG9x7uw=
-github.com/jsimonetti/rtnetlink v0.0.0-20200117123717-f846d4f6c1f4 h1:nwOc1YaOrYJ37sEBrtWZrdqzK22hiJs3GpDmP3sR2Yw=
-github.com/jsimonetti/rtnetlink v0.0.0-20200117123717-f846d4f6c1f4/go.mod h1:WGuG/smIU4J/54PblvSbh+xvCZmpJnFgr3ds6Z55XMQ=
+github.com/jonboulle/clockwork v0.2.2/go.mod h1:Pkfl5aHPm1nk2H9h0bjmnJD/BcgbGXUBGnn1kMkgxc8=
+github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY=
+github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y=
+github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
 github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
+github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.11/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024/go.mod h1:6v2b51hI/fHJwM22ozAgKL4VKDeJcHhJFhtBdhmNjmU=
 github.com/jstemmer/go-junit-report v0.9.1/go.mod h1:Brl9GWCQeLvo8nXZwPNNblvFj/XSXhF0NWZEnDohbsk=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
+github.com/judwhite/go-svc v1.2.1/go.mod h1:mo/P2JNX8C07ywpP9YtO2gnBgnUiFTHqtsZekJrUuTk=
 github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
+github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
+github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
+github.com/jung-kurt/gofpdf v1.0.0/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
+github.com/jung-kurt/gofpdf v1.0.3-0.20190309125859-24315acbbda5/go.mod h1:7Id9E/uU8ce6rXgefFLlgrJj/GYY22cpxn+r32jIOes=
+github.com/jwalton/go-supportscolor v1.1.0 h1:HsXFJdMPjRUAx8cIW6g30hVSFYaxh9yRQwEWgkAR7lQ=
+github.com/jwalton/go-supportscolor v1.1.0/go.mod h1:hFVUAZV2cWg+WFFC4v8pT2X/S2qUUBYMioBD9AINXGs=
 github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88/go.mod h1:3w7q1U84EfirKl04SVQ/s7nPm1ZPhiXd34z40TNz36k=
 github.com/k0kubun/pp v2.3.0+incompatible/go.mod h1:GWse8YhT0p8pT4ir3ZgBbfZild3tgzSScAn6HmfYukg=
 github.com/kardianos/osext v0.0.0-20190222173326-2bc1f35cddc0/go.mod h1:1NbS8ALrpOvjt0rHPNLyCIeMtbizbir8U//inJ+zuB8=
-github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs=
+github.com/karrick/godirwalk v1.8.0/go.mod h1:H5KPZjojv4lE+QYImBI8xVtrBRgYrIVsaRPx4tDPEn4=
+github.com/karrick/godirwalk v1.10.3/go.mod h1:RoGL9dQei4vP9ilrpETWE8CLOZ1kiN0LhBygSwrAsHA=
 github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8=
 github.com/kisielk/errcheck v1.1.0/go.mod h1:EZBBE59ingxPouuu3KfxchcWSUPOHkagtvWXihfKN4Q=
 github.com/kisielk/errcheck v1.2.0/go.mod h1:/BMXB+zMLi60iA8Vv6Ksmxu/1UDYcXs4uQLJ+jE2L00=
+github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.9.5/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A=
+github.com/klauspost/compress v1.11.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.11.13/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.13.1/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
+github.com/klauspost/compress v1.13.4/go.mod h1:8dP1Hq4DHOhN9w426knH3Rhby4rFm6D8eO+e+Dq5Gzg=
+github.com/klauspost/compress v1.13.6/go.mod h1:/3/Vjq9QcHkK5uEr5lBEmyoZ1iFhe47etQ6QUkpK6sk=
+github.com/klauspost/compress v1.17.2 h1:RlWWUY/Dr4fL8qk9YG7DTZ7PDgME2V4csBXA8L/ixi4=
+github.com/klauspost/compress v1.17.2/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/knadh/koanf/maps v0.1.1 h1:G5TjmUh2D7G2YWf5SQQqSiHRJEjaicvU0KpypqB3NIs=
+github.com/knadh/koanf/maps v0.1.1/go.mod h1:npD/QZY3V6ghQDdcQzl1W4ICNVTkohC8E73eI2xW4yI=
+github.com/knadh/koanf/parsers/toml/v2 v2.1.0 h1:EUdIKIeezfDj6e1ABDhIjhbURUpyrP1HToqW6tz8R0I=
+github.com/knadh/koanf/parsers/toml/v2 v2.1.0/go.mod h1:0KtwfsWJt4igUTQnsn0ZjFWVrP80Jv7edTBRbQFd2ho=
+github.com/knadh/koanf/providers/file v1.1.2 h1:aCC36YGOgV5lTtAFz2qkgtWdeQsgfxUkxDOe+2nQY3w=
+github.com/knadh/koanf/providers/file v1.1.2/go.mod h1:/faSBcv2mxPVjFrXck95qeoyoZ5myJ6uxN8OOVNJJCI=
+github.com/knadh/koanf/providers/rawbytes v0.1.0 h1:dpzgu2KO6uf6oCb4aP05KDmKmAmI51k5pe8RYKQ0qME=
+github.com/knadh/koanf/providers/rawbytes v0.1.0/go.mod h1:mMTB1/IcJ/yE++A2iEZbY1MLygX7vttU+C+S/YmPu9c=
+github.com/knadh/koanf/v2 v2.1.2 h1:I2rtLRqXRy1p01m/utEtpZSSA6dcJbgGVuE27kW2PzQ=
+github.com/knadh/koanf/v2 v2.1.2/go.mod h1:Gphfaen0q1Fc1HTgJgSTC4oRX9R2R5ErYMZJy8fLJBo=
 github.com/konsorten/go-windows-terminal-sequences v1.0.1/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.2/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
 github.com/konsorten/go-windows-terminal-sequences v1.0.3/go.mod h1:T0+1ngSBFLxvqU3pZ+m/2kptfBszLMUkC4ZK/EgS/cQ=
+github.com/kr/fs v0.1.0/go.mod h1:FFnZGqtBN9Gxj7eW1uZ42v5BccTP0vu6NEaFoC2HwRg=
 github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515/go.mod h1:+0opPa2QZZtGFBFZlji/RkVcI2GknAs/DXo4wKdlNEc=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
-github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
+github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.4/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/pty v1.1.8 h1:AkaSdXYQOWeaO3neb8EM634ahkXXe3jYbVh/F9lq+GI=
+github.com/kr/pty v1.1.5/go.mod h1:9r2w37qlBe7rQ6e1fg1S/9xpWHSnaqNdHD3WcMdbPDA=
 github.com/kr/pty v1.1.8/go.mod h1:O1sed60cT9XZ5uDucP5qwvh+TE3NnUj51EiZO/lmSfw=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/ktrysmt/go-bitbucket v0.6.4/go.mod h1:9u0v3hsd2rqCHRIpbir1oP7F58uo5dq19sBYvuMoyQ4=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.1.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.2.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
 github.com/lib/pq v1.3.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
-github.com/lib/pq v1.8.0 h1:9xohqzkUwzR4Ga4ivdTcawVS89YSDVxXMa3xJX3cGzg=
 github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lxn/walk v0.0.0-20201123161058-0a7a9b4462c3/go.mod h1:E23UucZGqpuUANJooIbHWCufXvOcT6E7Stq81gU+CSQ=
-github.com/lxn/win v0.0.0-20201111105847-2a20daff6a55/go.mod h1:KxxjdtRkfNoYDCUP5ryK7XJJNTnpC8atvtmTheChOtk=
+github.com/lib/pq v1.10.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.9 h1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=
+github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/linuxkit/virtsock v0.0.0-20201010232012-f8cee7dfc7a3/go.mod h1:3r6x7q95whyfWQpmGZTu3gk3v2YkMi05HEzl7Tf7YEo=
+github.com/logrusorgru/aurora v2.0.3+incompatible h1:tOpm7WcpBTn4fjmVfgpQq0EfczGlG91VSDkswnjF5A8=
+github.com/logrusorgru/aurora v2.0.3+incompatible/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
+github.com/logrusorgru/aurora/v3 v3.0.0 h1:R6zcoZZbvVcGMvDCKo45A9U/lzYyzl5NfYIvznmDfE4=
+github.com/logrusorgru/aurora/v3 v3.0.0/go.mod h1:vsR12bk5grlLvLXAYrBsb5Oc/N+LxAlxggSjiwMnCUc=
+github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
+github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w=
+github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
 github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
+github.com/mailru/easyjson v0.0.0-20160728113105-d5b7844b561a/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
+github.com/mailru/easyjson v0.7.0/go.mod h1:KAzv3t3aY1NaHWoQz1+4F1ccyAH66Jk7yos7ldAVICs=
+github.com/mailru/easyjson v0.7.6/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
+github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mark3labs/mcp-go v0.27.0 h1:iok9kU4DUIU2/XVLgFS2Q9biIDqstC0jY4EQTK2Erzc=
+github.com/mark3labs/mcp-go v0.27.0/go.mod h1:rXqOudj/djTORU/ThxYx8fqEVj/5pvTuuebQ2RC7uk4=
+github.com/markbates/oncer v0.0.0-20181203154359-bf2de49a0be2/go.mod h1:Ld9puTsIW75CHf65OeIOkyKbteujpZVXDpWK6YGZbxE=
 github.com/markbates/pkger v0.15.1/go.mod h1:0JoVlrol20BSywW79rN3kdFFsE5xYM+rSCQDXbLhiuI=
+github.com/markbates/safe v1.0.1/go.mod h1:nAqgmRi7cY2nqMc92/bSEeQA+R4OheNU2T1kNSCBdG0=
+github.com/marstr/guid v1.1.0/go.mod h1:74gB1z2wpxxInTG6yaqA7KrtM0NZ+RbrcqDvYHefzho=
 github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.1/go.mod h1:FuOcm+DKB9mbwrcAfNl7/TZVBZ6rcnceauSikq3lYCQ=
 github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE=
 github.com/mattn/go-colorable v0.1.6/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
-github.com/mattn/go-colorable v0.1.8 h1:c1ghPdyEDarC70ftn0y+A/Ee++9zz8ljHG1b13eJ0s8=
-github.com/mattn/go-colorable v0.1.8/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-ieproxy v0.0.1/go.mod h1:pYabZ6IHcRpFh7vIaLfK7rdcWgFEb3SFJ6/gNWuh88E=
 github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
+github.com/mattn/go-isatty v0.0.4/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.5/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.7/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s=
 github.com/mattn/go-isatty v0.0.9/go.mod h1:YNRxwqDuOph6SZLI9vUUz6OYw3QyUt7WiY2yME+cCiQ=
-github.com/mattn/go-isatty v0.0.12 h1:wuysRhFDzyxgEmMf5xjvJ2M9dZoWAXNNr5LSBS7uHXY=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-localereader v0.0.1 h1:ygSAOl7ZXTx4RdPYinUpg6W99U8jWvWi9Ye2JC/oIi4=
+github.com/mattn/go-localereader v0.0.1/go.mod h1:8fBrzywKY7BI3czFoHkuzRoWE9C+EiG4R1k4Cjx5p88=
+github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzpuz5H//U1FU=
+github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk=
+github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
+github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
+github.com/mattn/go-shellwords v1.0.3/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
+github.com/mattn/go-shellwords v1.0.6/go.mod h1:3xCvwCdWdlDJUrvuMn7Wuy9eWs4pE8vqg+NOMyg4B2o=
+github.com/mattn/go-shellwords v1.0.12/go.mod h1:EZzvwXDESEeg03EKmM+RmDnNOPKG4lLtQsUlTZDWQ8Y=
 github.com/mattn/go-sqlite3 v1.9.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
-github.com/mattn/go-sqlite3 v1.10.0/go.mod h1:FPy6KqzDD04eiIsT53CuJW3U88zkxoIYsOqkbpncsNc=
+github.com/mattn/go-sqlite3 v1.14.6/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-sqlite3 v1.14.10/go.mod h1:NyWgC/yNuGj7Q9rpYnZvas74GogHl5/Z4A/KQRfk6bU=
+github.com/mattn/go-sqlite3 v1.14.18 h1:JL0eqdCOq6DJVNPSvArO/bIV9/P7fbGrV00LZHc+5aI=
+github.com/mattn/go-sqlite3 v1.14.18/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
-github.com/mdlayher/genetlink v1.0.0 h1:OoHN1OdyEIkScEmRgxLEe2M9U8ClMytqA5niynLtfj0=
-github.com/mdlayher/genetlink v1.0.0/go.mod h1:0rJ0h4itni50A86M2kHcgS85ttZazNt7a8H2a2cw0Gc=
-github.com/mdlayher/netlink v0.0.0-20190409211403-11939a169225/go.mod h1:eQB3mZE4aiYnlUsyGGCOpPETfdQq4Jhsgf1fk3cwQaA=
-github.com/mdlayher/netlink v1.0.0/go.mod h1:KxeJAFOFLG6AjpyDkQ/iIhxygIUKD+vcwqcnu43w/+M=
-github.com/mdlayher/netlink v1.1.0 h1:mpdLgm+brq10nI9zM1BpX1kpDbh3NLl3RSnVq6ZSkfg=
-github.com/mdlayher/netlink v1.1.0/go.mod h1:H4WCitaheIsdF9yOYu8CFmCgQthAPIWZmcKp9uZHgmY=
-github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b h1:j7+1HpAFS1zy5+Q4qx1fWh90gTKwiN4QCGoY9TWyyO4=
-github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE=
+github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369/go.mod h1:BSXmuO+STAnVfrANrmjBb36TMTDstsz7MSK+HVaYKv4=
+github.com/maxbrunsfeld/counterfeiter/v6 v6.2.2/go.mod h1:eD9eIE7cdwcMi9rYluz88Jz2VyhSmden33/aXg4oVIY=
 github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
-github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721 h1:RlZweED6sbSArvlE924+mUcZuXKLBHA35U7LN621Bws=
-github.com/mikioh/ipaddr v0.0.0-20190404000644-d465c8ab6721/go.mod h1:Ickgr2WtCLZ2MDGd4Gr0geeCH5HybhRJbonOgQpvSxc=
+github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
+github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
+github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
+github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
 github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
+github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-testing-interface v1.0.0/go.mod h1:kRemZodwjscx+RGhAo8eIhFbs2+BFgRtFPeD/KE+zxI=
+github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
+github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
 github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS42BGNg=
 github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
 github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v0.0.0-20180220230111-00c29f56e238/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
 github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
+github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
+github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ=
+github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
+github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc=
+github.com/moby/spdystream v0.2.0/go.mod h1:f7i0iNDQJ059oMTcWxx8MA/zKFIuD/lY+0GqbN2Wy8c=
+github.com/moby/sys/mountinfo v0.4.0/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
+github.com/moby/sys/mountinfo v0.4.1/go.mod h1:rEr8tzG/lsIZHBtN/JjGG+LMYx9eXgW2JI+6q0qou+A=
+github.com/moby/sys/mountinfo v0.5.0/go.mod h1:3bMD3Rg+zkqx8MRYPi7Pyb0Ie97QEBmdxbhnCLlSvSU=
+github.com/moby/sys/signal v0.6.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
+github.com/moby/sys/symlink v0.1.0/go.mod h1:GGDODQmbFOjFsXvfLVn3+ZRxkch54RkSiGqsZeMYowQ=
+github.com/moby/sys/symlink v0.2.0/go.mod h1:7uZVF2dqJjG/NsClqul95CqKOBRQyYSNnJ6BMgR/gFs=
+github.com/moby/term v0.0.0-20200312100748-672ec06f55cd/go.mod h1:DdlQx2hp0Ss5/fLikoLlEeIYiATotOjgB//nb973jeo=
+github.com/moby/term v0.0.0-20210610120745-9d4ed1856297/go.mod h1:vgPCkQMyxTZ7IDy8SXRufE172gr8+K/JE/7hHFxHW3A=
+github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6/go.mod h1:E2VnQOmVuvZB6UYnnDB0qG5Nq/1tD9acaOpo6xmt0Kw=
+github.com/moby/term v0.5.0 h1:xt8Q1nalod/v7BqbG21f8mQPqH+xAaC9C3N3wfWbVP0=
+github.com/moby/term v0.5.0/go.mod h1:8FzsFHVUBGZdbDsJw/ot+X+d5HLUbvklYLJ9uGfcI3Y=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
 github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
 github.com/modern-go/reflect2 v1.0.1/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 h1:RWengNIwukTxcDr9M+97sNutRR1RKhG96O6jWumTTnw=
+github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826/go.mod h1:TaXosZuwdSHYgviHp1DAtfrULt5eUgsSMsZf+YrPgl8=
+github.com/montanaflynn/stats v0.0.0-20171201202039-1bf9dbcd8cbe/go.mod h1:wL8QJuTMNUDYhXwkmfOly8iTdp5TEcJFWZD2D7SIkUc=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
+github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de h1:D5x39vF5KCwKQaw+OC9ZPiLVHXz3UFw2+psEX+gYcto=
+github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de/go.mod h1:kJun4WP5gFuHZgRjZUWWuH1DTxCtxbHDOIJsudS8jzY=
+github.com/mreiferson/go-options v1.0.0/go.mod h1:zHtCks/HQvOt8ATyfwVe3JJq2PPuImzXINPRTC03+9w=
+github.com/mrunalp/fileutils v0.5.0/go.mod h1:M1WthSahJixYnrXQl/DFQuteStB1weuxD2QJNHXfbSQ=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=
+github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo=
+github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=
+github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
+github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=
+github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8=
+github.com/muesli/termenv v0.15.2 h1:GohcuySI0QmI3wN8Ok9PtKGkgkFIk7y6Vpb5PvrY+Wo=
+github.com/muesli/termenv v0.15.2/go.mod h1:Epx+iuz8sNs7mNKhxzH4fWXGNpZwUaJKRS1noLXviQ8=
+github.com/munnerz/goautoneg v0.0.0-20120707110453-a547fc61f48d/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
+github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
 github.com/mutecomm/go-sqlcipher/v4 v4.4.0/go.mod h1:PyN04SaWalavxRGH9E8ZftG6Ju7rsPrGmQRjrEaVpiY=
 github.com/mwitkow/go-conntrack v0.0.0-20161129095857-cc309e4a2223/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f/go.mod h1:qRWi+5nqEBWmkhHvq77mSJWrCKwh8bxhgT7d/eI7P4U=
+github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f/go.mod h1:ZdcZmHo+o7JKHSa8/e818NopupXU1YMK5fe1lsApnBw=
 github.com/nakagami/firebirdsql v0.0.0-20190310045651-3c02a58cfed8/go.mod h1:86wM1zFnC6/uDBfZGNwB65O+pR2OFi5q/YQaEUid1qA=
+github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
+github.com/ncruces/go-strftime v0.1.9/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls=
+github.com/ncw/swift v1.0.47/go.mod h1:23YIA4yWVnGwv2dQlN4bB7egfYX6YLn0Yo/S6zZO/ZM=
 github.com/neo4j/neo4j-go-driver v1.8.1-0.20200803113522-b626aa943eba/go.mod h1:ncO5VaFWh0Nrt+4KT4mOZboaczBZcLuHrG+/sUeP8gI=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
+github.com/nsqio/go-diskqueue v1.0.0/go.mod h1:INuJIxl4ayUsyoNtHL5+9MFPDfSZ0zY93hNY6vhBRsI=
+github.com/nsqio/go-diskqueue v1.1.0 h1:r0dJ0DMXT3+2mOq+79cvCjnhoBxyGC2S9O+OjQrpe4Q=
+github.com/nsqio/go-diskqueue v1.1.0/go.mod h1:INuJIxl4ayUsyoNtHL5+9MFPDfSZ0zY93hNY6vhBRsI=
+github.com/nsqio/go-nsq v1.0.8/go.mod h1:vKq36oyeVXgsS5Q8YEO7WghqidAVXQlcFxzQbQTuDEY=
+github.com/nsqio/go-nsq v1.1.0 h1:PQg+xxiUjA7V+TLdXw7nVrJ5Jbl3sN86EhGCQj4+FYE=
+github.com/nsqio/go-nsq v1.1.0/go.mod h1:vKq36oyeVXgsS5Q8YEO7WghqidAVXQlcFxzQbQTuDEY=
+github.com/nsqio/nsq v1.2.1 h1:ZVjANYLnX1vPLmuSNCOdiw4nNPnzWgAC4t8wFhznMqU=
+github.com/nsqio/nsq v1.2.1/go.mod h1:vXbwehoIygyVoX44oLFaN7MA0xrmudeuborDpMPiLTY=
+github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
 github.com/oklog/ulid v1.3.1/go.mod h1:CirwcVhetQ6Lv90oh/F+FBtV6XMibvdAFo93nm5qn4U=
+github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:vsDQFd/mU46D+Z4whnwzcISnGGzXWMclvtLoiIKAKIo=
+github.com/onsi/ginkgo v0.0.0-20151202141238-7f8ab55aaf3b/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v0.0.0-20170829012221-11459a886d9c/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.8.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.10.1/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.10.3/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
+github.com/onsi/ginkgo v1.11.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/ginkgo v1.12.0/go.mod h1:oUhWkIvk5aDxtKvDDuw8gItl8pKl42LzjC9KZE0HfGg=
+github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
+github.com/onsi/ginkgo v1.13.0/go.mod h1:+REjRxOmWfHCjfv9TTWB1jD1Frx4XydAD3zm1lskyM0=
+github.com/onsi/ginkgo v1.14.0/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
+github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
+github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
+github.com/onsi/gomega v0.0.0-20151007035656-2152b45fa28a/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/gomega v0.0.0-20170829124025-dcabb60a477c/go.mod h1:C1qb7wdrVGGVU+Z6iS04AVkA3Q65CEZX59MT0QO5uiA=
+github.com/onsi/gomega v1.5.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
+github.com/onsi/gomega v1.7.0/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
 github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
 github.com/onsi/gomega v1.9.0/go.mod h1:Ho0h+IUsWyvy1OpqCwxlQ/21gkhVunqlU8fDGcoTdcA=
+github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
+github.com/onsi/gomega v1.10.3/go.mod h1:V9xEwhxec5O8UDM77eCW8vLymOMltsqPVYWrpDsH8xc=
+github.com/onsi/gomega v1.15.0/go.mod h1:cIuvLEne0aoVhAgh/O6ac0Op8WWw9H6eYCriF+tEHG0=
+github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
+github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
+github.com/opencontainers/go-digest v0.0.0-20170106003457-a6d0ee40d420/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/opencontainers/go-digest v0.0.0-20180430190053-c9281466c8b2/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/opencontainers/go-digest v1.0.0-rc1/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
+github.com/opencontainers/go-digest v1.0.0-rc1.0.20180430190053-c9281466c8b2/go.mod h1:cMLVZDEM3+U2I4VmLI6N8jQYUd2OVphdqWwCJHrFt2s=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
-github.com/opencontainers/image-spec v1.0.1 h1:JMemWkRwHx4Zj+fVxWoMCFm/8sYGGrUVojFA6h/TRcI=
+github.com/opencontainers/image-spec v1.0.0/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
 github.com/opencontainers/image-spec v1.0.1/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/opencontainers/image-spec v1.0.2-0.20211117181255-693428a734f5/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/opencontainers/image-spec v1.0.2/go.mod h1:BtxoFyWECRxE4U/7sNtV5W15zMzWCbyJoFRP3s7yZA0=
+github.com/opencontainers/image-spec v1.1.0-rc5 h1:Ygwkfw9bpDvs+c9E34SdgGOj41dX/cbdlwvlWt0pnFI=
+github.com/opencontainers/image-spec v1.1.0-rc5/go.mod h1:X4pATf0uXsnn3g5aiGIsVnJBR4mxhKzfwmvK/B2NTm8=
+github.com/opencontainers/runc v0.0.0-20190115041553-12f6a991201f/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
+github.com/opencontainers/runc v0.1.1/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
+github.com/opencontainers/runc v1.0.0-rc8.0.20190926000215-3e425f80a8c9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
+github.com/opencontainers/runc v1.0.0-rc9/go.mod h1:qT5XzbpPznkRYVz/mWwUaVBUv2rmF59PVA73FjuZG0U=
+github.com/opencontainers/runc v1.0.0-rc93/go.mod h1:3NOsor4w32B2tC0Zbl8Knk4Wg84SM2ImC1fxBuqJ/H0=
+github.com/opencontainers/runc v1.0.2/go.mod h1:aTaHFFwQXuA71CiyxOdFFIorAoemI04suvGRQFzWTD0=
+github.com/opencontainers/runc v1.1.0/go.mod h1:Tj1hFw6eFWp/o33uxGf5yF2BX5yz2Z6iptFpuvbbKqc=
+github.com/opencontainers/runtime-spec v0.1.2-0.20190507144316-5b71a03e2700/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.0.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.0.2-0.20190207185410-29686dbc5559/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.0.2/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.0.3-0.20200929063507-e6143ca7d51d/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
+github.com/opencontainers/runtime-tools v0.0.0-20181011054405-1d69bd0f9c39/go.mod h1:r3f7wjNzSs2extwzU3Y+6pKfobzPh+kKFJ3ofN+3nfs=
+github.com/opencontainers/selinux v1.6.0/go.mod h1:VVGKuOLlE7v4PJyT6h7mNWvq1rzqiriPsEqVhc+svHE=
+github.com/opencontainers/selinux v1.8.0/go.mod h1:RScLhm78qiWa2gbVCcGkC7tCGdgk3ogry1nUQF8Evvo=
+github.com/opencontainers/selinux v1.8.2/go.mod h1:MUIHuUEvKB1wtJjQdOyYRgOnLD2xAPP8dBsCoU0KuF8=
+github.com/opencontainers/selinux v1.10.0/go.mod h1:2i0OySw99QjzBBQByd1Gr9gSjvuho1lHsJxIJ3gGbJI=
+github.com/opentracing/opentracing-go v1.1.0/go.mod h1:UkNAQd3GIcIGf0SeVgPpRdFStlNbqXla1AfSYxPUl2o=
 github.com/pascaldekloe/goe v0.0.0-20180627143212-57f6aae5913c/go.mod h1:lzWF7FIEvWOWxwDKqyGYQf6ZUaNfKdP144TG7ZOy1lc=
 github.com/pelletier/go-toml v1.2.0/go.mod h1:5z9KED0ma1S8pY6P1sdut58dfprrGBbd/94hg7ilaic=
+github.com/pelletier/go-toml v1.7.0/go.mod h1:vwGMzjaWMwyfHwgIBhI2YUM4fB6nL6lVAvS1LBMMhTE=
+github.com/pelletier/go-toml v1.8.1/go.mod h1:T2/BmBdy8dvIRq1a/8aqjN41wvWlN4lrapLU/GW4pbc=
+github.com/pelletier/go-toml v1.9.3/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
+github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
+github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c=
+github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
+github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
+github.com/perimeterx/marshmallow v1.1.4 h1:pZLDH9RjlLGGorbXhcaQLhfuV0pFMNfPO55FuFkxqLw=
+github.com/perimeterx/marshmallow v1.1.4/go.mod h1:dsXbUu8CRzfYP5a87xpp0xq9S3u0Vchtcl8we9tYaXw=
+github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI=
+github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU=
+github.com/pganalyze/pg_query_go/v6 v6.1.0 h1:jG5ZLhcVgL1FAw4C/0VNQaVmX1SUJx71wBGdtTtBvls=
+github.com/pganalyze/pg_query_go/v6 v6.1.0/go.mod h1:nvTHIuoud6e1SfrUaFwHqT0i4b5Nr+1rPWVds3B5+50=
+github.com/phpdave11/gofpdf v1.4.2/go.mod h1:zpO6xFn9yxo3YLyMvW8HcKWVdbNqgIfOOp2dXMnm1mY=
+github.com/phpdave11/gofpdi v1.0.12/go.mod h1:vBmVV0Do6hSBHC8uKUQ71JGW+ZGQq74llk/7bXwjDoI=
 github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
-github.com/pkg/browser v0.0.0-20180916011732-0a3d74bf9ce4/go.mod h1:4OwLy04Bl9Ef3GJJCoec+30X3LQs/0/m4HFRt/2LUSA=
+github.com/pierrec/lz4/v4 v4.1.8/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
+github.com/pingcap/errors v0.11.0/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTwv5KuLY8=
+github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb h1:3pSi4EDG6hg0orE1ndHkXvX6Qdq2cZn8gAPir8ymKZk=
+github.com/pingcap/errors v0.11.5-0.20240311024730-e056997136bb/go.mod h1:X2r9ueLEUZgtx2cIogM0v4Zj5uvvzhuuiu7Pn8HzMPg=
+github.com/pingcap/failpoint v0.0.0-20240528011301-b51a646c7c86 h1:tdMsjOqUR7YXHoBitzdebTvOjs/swniBTOLy5XiMtuE=
+github.com/pingcap/failpoint v0.0.0-20240528011301-b51a646c7c86/go.mod h1:exzhVYca3WRtd6gclGNErRWb1qEgff3LYta0LvRmON4=
+github.com/pingcap/log v1.1.0 h1:ELiPxACz7vdo1qAvvaWJg1NrYFoY6gqAh/+Uo6aXdD8=
+github.com/pingcap/log v1.1.0/go.mod h1:DWQW5jICDR7UJh4HtxXSM20Churx4CQL0fwL/SoOSA4=
+github.com/pingcap/tidb/pkg/parser v0.0.0-20250324122243-d51e00e5bbf0 h1:W3rpAI3bubR6VWOcwxDIG0Gz9G5rl5b3SL116T0vBt0=
+github.com/pingcap/tidb/pkg/parser v0.0.0-20250324122243-d51e00e5bbf0/go.mod h1:+8feuexTKcXHZF/dkDfvCwEyBAmgb4paFc3/WeYV2eE=
+github.com/pkg/browser v0.0.0-20210706143420-7d21f8c997e2/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
+github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
+github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e h1:aoZm08cpOy4WuID//EZDgcC4zIxODThtZNPirFr42+A=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pkg/sftp v1.10.1/go.mod h1:lYOWFsE0bwd1+KfKJaKeuokY15vzFx25BLbzYYoAxZI=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
+github.com/pquerna/cachecontrol v0.0.0-20171018203845-0dec1b30a021/go.mod h1:prYjPmNq4d1NPVmpShWobRqXY3q7Vp+80DqgxxUrUIA=
+github.com/prometheus/client_golang v0.0.0-20180209125602-c332b6f63c06/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
 github.com/prometheus/client_golang v0.9.3/go.mod h1:/TN21ttK/J9q6uSwhBd54HahCDft0ttaMvbicHlPoso=
+github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
+github.com/prometheus/client_golang v1.1.0/go.mod h1:I1FGZT9+L76gKKOs5djB6ezCbFQP1xR9D75/vuwEF3g=
+github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
+github.com/prometheus/client_golang v1.11.0/go.mod h1:Z6t4BnS23TR94PD6BsDNk8yVqroYurpAkEiz0P2BEV0=
+github.com/prometheus/client_model v0.0.0-20171117100541-99fa1f4be8e5/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
 github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/prometheus/common v0.0.0-20180110214958-89604d197083/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.0.0-20181113130724-41aa239b4cce/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
 github.com/prometheus/common v0.4.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
+github.com/prometheus/common v0.6.0/go.mod h1:eBmuwkDJBwy6iBfxCBob6t6dR6ENT/y+J+Zk0j9GMYc=
+github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
+github.com/prometheus/common v0.26.0/go.mod h1:M7rCNAaPfAosfx8veZJCuw84e35h3Cfd9VFqTh1DIvc=
+github.com/prometheus/common v0.30.0/go.mod h1:vu+V0TpY+O6vW9J44gczi3Ap/oXXR10b+M/gUGO4Hls=
+github.com/prometheus/procfs v0.0.0-20180125133057-cb4147076ac7/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
 github.com/prometheus/procfs v0.0.0-20190507164030-5867b95ac084/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.0.0-20190522114515-bc1a522cf7b1/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
+github.com/prometheus/procfs v0.0.3/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
+github.com/prometheus/procfs v0.0.5/go.mod h1:4A/X28fw3Fc593LaREMrKMqOKvUAntwMDaekg4FpcdQ=
+github.com/prometheus/procfs v0.0.8/go.mod h1:7Qr8sr6344vo1JqZ6HhLceV9o3AJ1Ff+GxbHq6oeK9A=
+github.com/prometheus/procfs v0.1.3/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
+github.com/prometheus/procfs v0.2.0/go.mod h1:lV6e/gmhEcM9IjHGsFOCxxuZ+z1YqCvr4OA4YeYWdaU=
+github.com/prometheus/procfs v0.6.0/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
+github.com/prometheus/procfs v0.7.3/go.mod h1:cz+aTbrPOrUb4q7XlbU9ygM+/jj0fzG6c1xBZuNvfVA=
 github.com/prometheus/tsdb v0.7.1/go.mod h1:qhTCs0VvXwvX/y3TZrWD7rabWM+ijKTux40TwIPHuXU=
+github.com/protocolbuffers/txtpbfmt v0.0.0-20220131092820-39736dd543b4 h1:t0R4wRdWPe9ZD+qsJRaidE1gN1CyM7d3IaKxJDyypQI=
+github.com/protocolbuffers/txtpbfmt v0.0.0-20220131092820-39736dd543b4/go.mod h1:lqKDuJp+gFrjIzf8LR/daIFsmcKkP6fmczWBs/7n39k=
 github.com/remyoudompheng/bigfft v0.0.0-20190728182440-6a916e37a237/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
-github.com/rjeczalik/notify v0.9.2 h1:MiTWrPj55mNDHEiIX5YUSKefw/+lCQVoAFmD6oQm5w8=
-github.com/rjeczalik/notify v0.9.2/go.mod h1:aErll2f0sUX9PXZnVNyeiObbmTlk5jnMoCa4QEjJeqM=
+github.com/remyoudompheng/bigfft v0.0.0-20200410134404-eec4a21b6bb0/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
+github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
+github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
+github.com/rivo/uniseg v0.4.4 h1:8TfxU8dW6PdqD27gjM8MVNuicgxIjxpm4K7x4jp8sis=
+github.com/rivo/uniseg v0.4.4/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
+github.com/riza-io/grpc-go v0.2.0 h1:2HxQKFVE7VuYstcJ8zqpN84VnAoJ4dCL6YFhJewNcHQ=
+github.com/riza-io/grpc-go v0.2.0/go.mod h1:2bDvR9KkKC3KhtlSHfR3dAXjUMT86kg4UfWFyVGWqi8=
+github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
+github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/fastuuid v0.0.0-20150106093220-6724a57986af/go.mod h1:XWv6SoW27p1b0cqNHllgS5HIMJraePCO15w5zCzIWYg=
+github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
+github.com/rogpeppe/go-internal v1.1.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
+github.com/rogpeppe/go-internal v1.2.2/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
-github.com/rogpeppe/go-internal v1.6.2 h1:aIihoIOHCiLZHxyoNQ+ABL4NKhFTgKLBdMLyEAh98m0=
-github.com/rogpeppe/go-internal v1.6.2/go.mod h1:xXDCJY+GAPziupqXw64V24skbSoqbTEfhy4qGm1nDQc=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
 github.com/rs/xid v1.2.1/go.mod h1:+uKXf+4Djp6Md1KODXJxgGQPKngRmWyn10oCKFzNHOQ=
+github.com/rs/xid v1.6.0 h1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=
+github.com/rs/xid v1.6.0/go.mod h1:7XoLgs4eV+QndskICGsho+ADou8ySMSjJKDIan90Nz0=
 github.com/rs/zerolog v1.13.0/go.mod h1:YbFCdg8HfsridGWAh22vktObvhZbQsZXe4/zB0OKkWU=
 github.com/rs/zerolog v1.15.0/go.mod h1:xYTKnLHcpfU2225ny5qZjxnj9NvkumZYjJHlAThCjNc=
-github.com/rs/zerolog v1.20.0 h1:38k9hgtUBdxFwE34yS8rTHmHBa4eN16E4DJlv177LNs=
-github.com/rs/zerolog v1.20.0/go.mod h1:IzD0RJ65iWH0w97OQQebJEvTZYvsCUm9WVLWBQrJRjo=
+github.com/rs/zerolog v1.34.0 h1:k43nTLIwcTVQAncfCw4KZ2VY6ukYoZaBPNOE8txlOeY=
+github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6wYQ=
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
+github.com/ruudk/golang-pdf417 v0.0.0-20181029194003-1af4ab5afa58/go.mod h1:6lfFZQK844Gfx8o5WFuvpxWRwnSoipWe/p622j1v06w=
 github.com/rwcarlsen/goexif v0.0.0-20190401172101-9e8deecbddbd/go.mod h1:hPqNNc0+uJM6H+SuU8sEs5K5IQeKccPqeSjfgcKGgPk=
 github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
+github.com/safchain/ethtool v0.0.0-20190326074333-42ed695e3de8/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
+github.com/safchain/ethtool v0.0.0-20210803160452-9aa261dae9b1/go.mod h1:Z0q5wiBQGYcxhMZ6gUqHn6pYNLypFAvaL3UvgZLR0U4=
+github.com/sahilm/fuzzy v0.1.0 h1:FzWGaw2Opqyu+794ZQ9SYifWv2EIXpwP4q8dY1kDAwI=
+github.com/sahilm/fuzzy v0.1.0/go.mod h1:VFvziUEIMCrT6A6tw2RFIXPXXmzXbOsSHF0DOI8ZK9Y=
 github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
+github.com/sclevine/agouti v3.0.0+incompatible/go.mod h1:b4WX9W9L1sfQKXeJf1mUTLZKJ48R1S7H23Ji7oFO5Bw=
+github.com/sclevine/spec v1.2.0/go.mod h1:W4J29eT/Kzv7/b9IWLB055Z+qvVC9vt0Arko24q7p+U=
 github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
-github.com/sergi/go-diff v1.0.0 h1:Kpca3qRNrduNnOQeazBd0ysaKrUJiIuISHxogkT9RPQ=
-github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
+github.com/seccomp/libseccomp-golang v0.9.1/go.mod h1:GbW5+tmTXfcxTToHLXlScSlAvWlF4P2Ca7zGrPiEpWo=
+github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921/go.mod h1:JA8cRccbGaA1s33RQf7Y1+q9gHmZX1yB/z9WDN1C6fg=
 github.com/shopspring/decimal v0.0.0-20180709203117-cd690d0c9e24/go.mod h1:M+9NzErvs504Cn4c5DxATwIqPbtswREoFCre64PpcG4=
-github.com/shopspring/decimal v0.0.0-20200227202807-02e2044944cc h1:jUIKcSPO9MoMJBbEoyE/RJoE8vz7Mb8AjvifMMwSyvY=
 github.com/shopspring/decimal v0.0.0-20200227202807-02e2044944cc/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
+github.com/shopspring/decimal v1.2.0/go.mod h1:DKyhrW/HYNuLGql+MJL6WCR6knT2jwCFRcu2hWCYk4o=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
+github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
+github.com/sirupsen/logrus v1.0.6/go.mod h1:pMByvHTf9Beacp5x1UXfOR9xyW/9antXMhjMPG0dEzc=
 github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
+github.com/sirupsen/logrus v1.4.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
 github.com/sirupsen/logrus v1.4.1/go.mod h1:ni0Sbl8bgC9z8RoU9G6nDWqqs/fq4eDPysMBDgk/93Q=
 github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
 github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
-github.com/sirupsen/logrus v1.7.0 h1:ShrD1U9pZB12TX0cVy0DtePoCH97K8EtX+mg7ZARUtM=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.8.1/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
 github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
+github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
 github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
-github.com/snowflakedb/glog v0.0.0-20180824191149-f5055e6f21ce/go.mod h1:EB/w24pR5VKI60ecFnKqXzxX3dOorz1rnVicQTQrGM0=
-github.com/snowflakedb/gosnowflake v1.3.5/go.mod h1:13Ky+lxzIm3VqNDZJdyvu9MCGy+WgRdYFdXp96UcLZU=
+github.com/snowflakedb/gosnowflake v1.6.3/go.mod h1:6hLajn6yxuJ4xUHZegMekpq9rnQbGJ7TMwXjgTmA6lg=
 github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
+github.com/soheilhy/cmux v0.1.5/go.mod h1:T7TcVDs9LWfQgPlPsdngu6I6QIoyIFZDDC6sNE1GqG0=
 github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
 github.com/spf13/afero v1.1.2/go.mod h1:j4pytiNVoe2o6bmDsKpLACNPDBIoEAkihy7loJ1B0CQ=
+github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
+github.com/spf13/afero v1.3.3/go.mod h1:5KUK8ByomD5Ti5Artl0RtHeI5pTF7MIDuXL3yY520V4=
+github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z93I=
 github.com/spf13/cast v1.3.0/go.mod h1:Qx5cxh0v+4UWYiBimWS+eyWzqEqokIECu5etghLkUJE=
-github.com/spf13/cobra v1.1.3 h1:xghbfqPkxzxP3C/f3n5DdpAbdKLj4ZE4BWQI362l53M=
+github.com/spf13/cast v1.7.1 h1:cuNEagBQEHWN1FnbGEjCXL2szYEXqfJPbP2HNUaca9Y=
+github.com/spf13/cast v1.7.1/go.mod h1:ancEpBxwJDODSW/UG4rDrAqiKolqNNh2DX3mk86cAdo=
+github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
+github.com/spf13/cobra v1.0.0/go.mod h1:/6GTrnGXV9HjY+aR4k0oJ5tcvakLuG6EuKReYlHNrgE=
 github.com/spf13/cobra v1.1.3/go.mod h1:pGADOWyqRD/YMrPZigI/zbliZ2wVD/23d+is3pSWzOo=
+github.com/spf13/cobra v1.9.1 h1:CXSaggrXdbHK9CF+8ywj8Amf7PBRmPCOJugH954Nnlo=
+github.com/spf13/cobra v1.9.1/go.mod h1:nDyEzZ8ogv936Cinf6g1RU9MRY64Ir93oCnqb9wxYW0=
 github.com/spf13/jwalterweatherman v1.0.0/go.mod h1:cQK4TGJAtQXfYWX+Ddv3mKDzgVb68N+wFjFa4jdeBTo=
+github.com/spf13/pflag v0.0.0-20170130214245-9ff6c6923cff/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
+github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.6 h1:jFzHGLGAlb3ruxLB8MhbI6A8+AQX/2eW4qeyNZXNp2o=
+github.com/spf13/pflag v1.0.6/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/viper v1.4.0/go.mod h1:PTJ7Z/lr49W6bUbkmS1V3by4uWynFiR9p7+dSq/yZzE=
 github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
+github.com/sqlc-dev/sqlc v1.29.0 h1:HQctoD7y/i29Bao53qXO7CZ/BV9NcvpGpsJWvz9nKWs=
+github.com/sqlc-dev/sqlc v1.29.0/go.mod h1:BavmYw11px5AdPOjAVHmb9fctP5A8GTziC38wBF9tp0=
+github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980/go.mod h1:AO3tvPzVZ/ayst6UlUKUv6rcPQInYe3IknH3jYhAKu8=
+github.com/stoewer/go-strcase v1.2.0 h1:Z2iHWqGXH00XYgqDmNgQbIBxf3wrNq0F3feEy0ainaU=
+github.com/stoewer/go-strcase v1.2.0/go.mod h1:IBiWB2sKIp3wVVQ3Y035++gc+knqhUQag1KpM8ahLw8=
+github.com/stretchr/objx v0.0.0-20180129172003-8a3f7159479f/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.2.0/go.mod h1:qt09Ya8vawLte6SNmTgCsAVtYtaKzEcn8ATUoHMkEqE=
-github.com/stretchr/testify v1.2.0/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
-github.com/stretchr/testify v1.2.1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v0.0.0-20180303142811-b89eecf5ca5d/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/stretchr/testify v1.5.1 h1:nOGnQDM7FYENwehXlg/kFVnos3rEvtKTjRvOWSzb6H4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
+github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
-github.com/tailscale/hujson v0.0.0-20200924210142-dde312d0d6a2 h1:reREUgl2FG+o7YCsrZB8XLjnuKv5hEIWtnOdAbRAXZI=
-github.com/tailscale/hujson v0.0.0-20200924210142-dde312d0d6a2/go.mod h1:STqf+YV0ADdzk4ejtXFsGqDpATP9JoL0OB+hiFQbkdE=
-github.com/tidwall/pretty v0.0.0-20180105212114-65a9db5fad51/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
+github.com/syndtr/gocapability v0.0.0-20170704070218-db04d3cc01c8/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
+github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
+github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
+github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a h1:SJy1Pu0eH1C29XwJucQo73FrleVK6t4kYz4NVhp34Yw=
+github.com/tailscale/hujson v0.0.0-20221223112325-20486734a56a/go.mod h1:DFSS3NAGHthKo1gTlmEcSBiZrRJXi28rLNd/1udP1c8=
+github.com/tchap/go-patricia v2.2.6+incompatible/go.mod h1:bmLyhP68RS6kStMGxByiQ23RP/odRBOTVjwp2cDyi6I=
+github.com/tetratelabs/wazero v1.9.0 h1:IcZ56OuxrtaEz8UYNRHBrUa9bYeX9oVY93KspZZBf/I=
+github.com/tetratelabs/wazero v1.9.0/go.mod h1:TSbcXCfFP0L2FGkRPxHphadXPjo1T6W+CseNNY7EkjM=
+github.com/tidwall/pretty v1.0.0/go.mod h1:XNkn88O1ChpSDQmQeStsy+sBenx6DDtFZJxhVysOjyk=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
 github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/tmc/grpc-websocket-proxy v0.0.0-20201229170055-e5319fda7802/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
+github.com/tv42/httpunix v0.0.0-20191220191345-2ba4b9c3382c/go.mod h1:hzIxponao9Kjc7aWznkXaL4U4TWaDSs8zcsY4Ka08nM=
+github.com/ugorji/go v1.1.4/go.mod h1:uQMGLiO92mf5W77hV/PUCpI3pbzQx3CRekS0kk+RGrc=
+github.com/ugorji/go v1.2.7 h1:qYhyWUUd6WbiM+C6JZAUkIJt/1WrjzNHY9+KCIjVqTo=
+github.com/ugorji/go v1.2.7/go.mod h1:nF9osbDWLy6bDVv/Rtoh6QgnvNDpmCalQV5urGCCS6M=
+github.com/ugorji/go/codec v1.2.7 h1:YPXUKf7fYbp/y8xloBqZOw2qaVggbfwMlI8WM3wZUJ0=
+github.com/ugorji/go/codec v1.2.7/go.mod h1:WGN1fab3R1fzQlVQTkfxVtIBhWDRqOviHU95kRgeqEY=
+github.com/urfave/cli v0.0.0-20171014202726-7bc6a0acffa5/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
+github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
+github.com/urfave/cli v1.22.1/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+github.com/urfave/cli v1.22.2/go.mod h1:Gos4lmkARVdJ6EkW0WaNv/tZAAMe9V7XWyB60NtXRu0=
+github.com/vbatts/tar-split v0.11.5 h1:3bHCTIheBm1qFTcgh9oPu+nNBtX+XJIupG/vacinCts=
+github.com/vbatts/tar-split v0.11.5/go.mod h1:yZbwRsSeGjusneWgA781EKej9HF8vme8okylkAeNKLk=
+github.com/vishvananda/netlink v0.0.0-20181108222139-023a6dafdcdf/go.mod h1:+SR5DhBJrl6ZM7CoCKvpw5BKroDKQ+PJqOg65H/2ktk=
+github.com/vishvananda/netlink v1.1.0/go.mod h1:cTgwzPIzzgDAYoQrMm0EdrjRUBkTqKYppBueQtXaqoE=
+github.com/vishvananda/netlink v1.1.1-0.20201029203352-d40f9887b852/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
+github.com/vishvananda/netlink v1.1.1-0.20210330154013-f5de75959ad5/go.mod h1:twkDnbuQxJYemMlGd4JFIcuhgX83tXhKS2B/PRMpOho=
+github.com/vishvananda/netns v0.0.0-20180720170159-13995c7128cc/go.mod h1:ZjcWmFBXmLKZu9Nxj3WKYEafiSqer2rnvPr0en9UNpI=
+github.com/vishvananda/netns v0.0.0-20191106174202-0a2b9b5464df/go.mod h1:JP3t17pCcGlemwknint6hfoeCVQrEMVwxRLRjXpq+BU=
+github.com/vishvananda/netns v0.0.0-20200728191858-db3c7e526aae/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
+github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f/go.mod h1:DD4vA1DwXk04H54A1oHXtwZmA0grkVMdPxx/VGLCah0=
+github.com/wasilibs/go-pgquery v0.0.0-20250409022910-10ac41983c07 h1:mJdDDPblDfPe7z7go8Dvv1AJQDI3eQ/5xith3q2mFlo=
+github.com/wasilibs/go-pgquery v0.0.0-20250409022910-10ac41983c07/go.mod h1:Ak17IJ037caFp4jpCw/iQQ7/W74Sqpb1YuKJU6HTKfM=
+github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52 h1:OvLBa8SqJnZ6P+mjlzc2K7PM22rRUPE1x32G9DTPrC4=
+github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52/go.mod h1:jMeV4Vpbi8osrE/pKUxRZkVaA0EX7NZN0A9/oRzgpgY=
+github.com/willf/bitset v1.1.11-0.20200630133818-d5bec3311243/go.mod h1:RjeCKbqT1RxIR/KWY6phxZiaY1IyutSBfGjNPySAYV4=
+github.com/willf/bitset v1.1.11/go.mod h1:83CECat5yLh5zVOf4P1ErAgKA5UDvKtgyUABdr3+MjI=
 github.com/xanzy/go-gitlab v0.15.0/go.mod h1:8zdQa/ri1dfn8eS3Ir1SyfvOKlw7WBJ8DVThkpGiXrs=
-github.com/xdg/scram v0.0.0-20180814205039-7eeb5667e42c/go.mod h1:lB8K/P019DLNhemzwFU4jHLhdvlE6uDZjXFejJXr49I=
-github.com/xdg/stringprep v1.0.0/go.mod h1:Jhud4/sHMO4oL310DaZAKk9ZaJ08SJfe+sJh0HrGL1Y=
+github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI=
+github.com/xdg-go/scram v1.0.2/go.mod h1:1WAq6h33pAW+iRreB34OORO2Nf7qel3VV3fjBj+hCSs=
+github.com/xdg-go/stringprep v1.0.2/go.mod h1:8F9zXuvzgwmyT5DUm4GUfZGDdT3W+LCvS6+da4O5kxM=
+github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f/go.mod h1:N2zxlSyiKSe5eX1tZViRH5QA0qijqEDrYZiPEAiq3wU=
+github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415/go.mod h1:GwrjFmJcFw6At/Gs6z4yjiIwzuJ1/+UwLxMQDVQXShQ=
+github.com/xeipuuv/gojsonschema v0.0.0-20180618132009-1d523034197f/go.mod h1:5yf86TLmAcydyeJq5YvxkGPE2fm/u4myDekKRoLuqhs=
 github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2/go.mod h1:UETIi67q53MR2AWcXfiuqkDkRtnGDLqkBTpCHuJHxtU=
+github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77/go.mod h1:aYKd//L2LvnjZzWKhF00oedf4jCCReLcmhLdhm1A27Q=
+github.com/yosida95/uritemplate/v3 v3.0.2 h1:Ed3Oyj9yrmi9087+NczuL5BwkIc4wvTb5zIM+UJPGz4=
+github.com/yosida95/uritemplate/v3 v3.0.2/go.mod h1:ILOh0sOhIJR3+L/8afwt/kE++YT040gmv5BQTMR2HP4=
+github.com/youmark/pkcs8 v0.0.0-20181117223130-1be2e3e5546d/go.mod h1:rHwXgn7JulP+udvsHwJoVG1YGAP6VLg4y9I5dyZdqmA=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9/go.mod h1:E1AXubJBdNmFERAOucpDIxNzeGfLzg0mYh+UfMWdChA=
+github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64 h1:5mLPGnFdSsevFRFc9q3yYbBkB6tsm4aCwwQV/j1JQAQ=
+github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
+github.com/yvasiyarov/go-metrics v0.0.0-20140926110328-57bccd1ccd43/go.mod h1:aX5oPXxHm3bOH+xeAttToC8pqch2ScQN/JoXYupl6xs=
+github.com/yvasiyarov/gorelic v0.0.0-20141212073537-a9bba5b9ab50/go.mod h1:NUSPSUX/bi6SeDMUh6brw0nXpxHnc96TguQh0+r/ssA=
+github.com/yvasiyarov/newrelic_platform_go v0.0.0-20140908184405-b21fdbd4370f/go.mod h1:GlGEuHIJweS1mbCqG+7vt2nvWLzLLnRHbXz5JKd/Qbg=
 github.com/zenazn/goji v0.9.0/go.mod h1:7S9M489iMyHBNxwZnk9/EHS098H4/F6TATF2mIxtB1Q=
 gitlab.com/nyarla/go-crypt v0.0.0-20160106005555-d9a5dc2b789b/go.mod h1:T3BPAOm2cqquPa0MKWeNkmOM5RQsRhkrwMWonFMN7fE=
+go.encore.dev/platform-sdk v1.1.0 h1:0BYLt7ZAoPje3KMLee6/gA2FECHwzi1sKgp3SqC+QRo=
+go.encore.dev/platform-sdk v1.1.0/go.mod h1:ImcJU8p0V3bSXb+d++Ni/8hFDwVZaFpUAAySTY2x6FY=
 go.etcd.io/bbolt v1.3.2/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
-go.mongodb.org/mongo-driver v1.1.0/go.mod h1:u7ryQJ+DOzQmeO7zB6MHyr8jkEQvC8vH7qLUO4lqsUM=
+go.etcd.io/bbolt v1.3.3/go.mod h1:IbVyRI1SCnLcuJnV2u8VeU0CEYM7e686BmAb1XKL+uU=
+go.etcd.io/bbolt v1.3.5/go.mod h1:G5EMThwa9y8QZGBClrRx5EY+Yw9kAhnjy3bSjsnlVTQ=
+go.etcd.io/bbolt v1.3.6/go.mod h1:qXsaaIqmgQH0T+OPdb99Bf+PKfBBQVAdyD6TY9G8XM4=
+go.etcd.io/etcd v0.5.0-alpha.5.0.20200910180754-dd1b699fc489/go.mod h1:yVHk9ub3CSBatqGNg7GRmsnfLWtoW60w4eDYfh7vHDg=
+go.etcd.io/etcd/api/v3 v3.5.0/go.mod h1:cbVKeC6lCfl7j/8jBhAK6aIYO9XOjdptoxU/nLQcPvs=
+go.etcd.io/etcd/client/pkg/v3 v3.5.0/go.mod h1:IJHfcCEKxYu1Os13ZdwCwIUTUVGYTSAM3YSwc9/Ac1g=
+go.etcd.io/etcd/client/v2 v2.305.0/go.mod h1:h9puh54ZTgAKtEbut2oe9P4L/oqKCVB6xsXlzd7alYQ=
+go.etcd.io/etcd/client/v3 v3.5.0/go.mod h1:AIKXXVX/DQXtfTEqBryiLTUXwON+GuvO6Z7lLS/oTh0=
+go.etcd.io/etcd/pkg/v3 v3.5.0/go.mod h1:UzJGatBQ1lXChBkQF0AuAtkRQMYnHubxAEYIrC3MSsE=
+go.etcd.io/etcd/raft/v3 v3.5.0/go.mod h1:UFOHSIvO/nKwd4lhkwabrTD3cqW5yVyYYf/KlD00Szc=
+go.etcd.io/etcd/server/v3 v3.5.0/go.mod h1:3Ah5ruV+M+7RZr0+Y/5mNLwC+eQlni+mQmOVdCRJoS4=
+go.mongodb.org/mongo-driver v1.7.0/go.mod h1:Q4oFMbo1+MSNqICAdYMlC/zSTrwCogR4R8NzkI+yfU8=
+go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.3/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
 go.opencensus.io v0.22.4/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
+go.opencensus.io v0.22.5/go.mod h1:5pWMHQbX5EPX2/62yrJeAkowc+lfs/XD7Uxpq3pI6kk=
+go.opencensus.io v0.23.0/go.mod h1:XItmlyltB5F7CS4xOC1DcqMoFqwtC6OG2xF7mCv7P7E=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
+go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
+go.opentelemetry.io/contrib v0.20.0/go.mod h1:G/EtFaa6qaN7+LxqfIAT3GiZa7Wv5DTBUzl5H4LY0Kc=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.20.0/go.mod h1:oVGt1LRbBOBq1A5BQLlUg9UaU/54aiHw8cgjV3aWZ/E=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.28.0/go.mod h1:vEhqr0m4eTc+DWxfsXoXue2GBgV2uUwVznkGIHW/e5w=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0 h1:r6I7RJCN86bpD/FQwedZ0vSixDpwuWREjW9oRMsmqDc=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.54.0/go.mod h1:B9yO6b04uB80CzjedvewuqDhxJxi11s7/GtiGa8bAjI=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.20.0/go.mod h1:2AboqHi0CiIZU0qwhtUfCYD1GeUzvvIXWNkhDt7ZMG4=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 h1:TT4fX+nBOA/+LUkobKGW1ydGcn+G3vRw9+g5HwCphpk=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0/go.mod h1:L7UH0GbB0p47T4Rri3uHjbpCFYrVrwc1I25QhNPiGK8=
+go.opentelemetry.io/otel v0.20.0/go.mod h1:Y3ugLH2oa81t5QO+Lty+zXf8zC9L26ax4Nzoxm/dooo=
+go.opentelemetry.io/otel v1.3.0/go.mod h1:PWIKzi6JCp7sM0k9yZ43VX+T345uNbAkDKwHVjb2PTs=
+go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
+go.opentelemetry.io/otel v1.34.0/go.mod h1:OWFPOQ+h4G8xpyjgqo4SxJYdDQ/qmRH+wivy7zzx9oI=
+go.opentelemetry.io/otel/exporters/otlp v0.20.0/go.mod h1:YIieizyaN77rtLJra0buKiNBOm9XQfkPEKBeuhoMwAM=
+go.opentelemetry.io/otel/exporters/otlp/internal/retry v1.3.0/go.mod h1:VpP4/RMn8bv8gNo9uK7/IMY4mtWLELsS+JIP0inH0h4=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.3.0/go.mod h1:hO1KLR7jcKaDDKDkvI9dP/FIhpmna5lkqPUQdEjFAM8=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.3.0/go.mod h1:keUU7UfnwWTWpJ+FWnyqmogPa82nuU5VUANFq49hlMY=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.3.0/go.mod h1:QNX1aly8ehqqX1LEa6YniTU7VY9I6R3X/oPxhGdTceE=
+go.opentelemetry.io/otel/metric v0.20.0/go.mod h1:598I5tYlH1vzBjn+BTuhzTCSb/9debfNp6R3s7Pr1eU=
+go.opentelemetry.io/otel/metric v1.34.0 h1:+eTR3U0MyfWjRDhmFMxe2SsW64QrZ84AOhvqS7Y+PoQ=
+go.opentelemetry.io/otel/metric v1.34.0/go.mod h1:CEDrp0fy2D0MvkXE+dPV7cMi8tWZwX3dmaIhwPOaqHE=
+go.opentelemetry.io/otel/oteltest v0.20.0/go.mod h1:L7bgKf9ZB7qCwT9Up7i9/pn0PWIa9FqQ2IQ8LoxiGnw=
+go.opentelemetry.io/otel/sdk v0.20.0/go.mod h1:g/IcepuwNsoiX5Byy2nNV0ySUF1em498m7hBWC279Yc=
+go.opentelemetry.io/otel/sdk v1.3.0/go.mod h1:rIo4suHNhQwBIPg9axF8V9CA72Wz2mKF1teNrup8yzs=
+go.opentelemetry.io/otel/sdk v1.34.0 h1:95zS4k/2GOy069d321O8jWgYsW3MzVV+KuSPKp7Wr1A=
+go.opentelemetry.io/otel/sdk v1.34.0/go.mod h1:0e/pNiaMAqaykJGKbi+tSjWfNNHMTxoC9qANsCzbyxU=
+go.opentelemetry.io/otel/sdk/export/metric v0.20.0/go.mod h1:h7RBNMsDJ5pmI1zExLi+bJK+Dr8NQCh0qGhm1KDnNlE=
+go.opentelemetry.io/otel/sdk/metric v0.20.0/go.mod h1:knxiS8Xd4E/N+ZqKmUPf3gTTZ4/0TjTXukfxjzSTpHE=
+go.opentelemetry.io/otel/sdk/metric v1.34.0 h1:5CeK9ujjbFVL5c1PhLuStg1wxA7vQv7ce1EK0Gyvahk=
+go.opentelemetry.io/otel/sdk/metric v1.34.0/go.mod h1:jQ/r8Ze28zRKoNRdkjCZxfs6YvBTG1+YIqyFVFYec5w=
+go.opentelemetry.io/otel/trace v0.20.0/go.mod h1:6GjCW8zgDjwGHGa6GkyeB8+/5vjT16gUEi0Nf1iBdgw=
+go.opentelemetry.io/otel/trace v1.3.0/go.mod h1:c/VDhno8888bvQYmbYLqe41/Ldmr/KKunbvWM4/fEjk=
+go.opentelemetry.io/otel/trace v1.34.0 h1:+ouXS2V8Rd4hp4580a8q23bg0azF2nI8cqLYnC8mh/k=
+go.opentelemetry.io/otel/trace v1.34.0/go.mod h1:Svm7lSjQD7kG7KJ/MUHPVXSDGz2OX4h0M2jHBhmSfRE=
+go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
+go.opentelemetry.io/proto/otlp v0.11.0/go.mod h1:QpEjXPrNQzrFDZgoTo49dgHR9RYRSrg3NAKnUGl9YpQ=
 go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.4.0/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
 go.uber.org/atomic v1.6.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
-go.uber.org/goleak v1.1.10 h1:z+mqJhf6ss6BSfSM671tgKyZBFPTTJM+HLxnhPC3wu0=
+go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=
+go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
 go.uber.org/goleak v1.1.10/go.mod h1:8a7PlsEVH3e/a/GLqe5IIrQx6GzcnRmZEufDUTk4A7A=
+go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
+go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
+go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.uber.org/multierr v1.1.0/go.mod h1:wR5kodmAFQ0UK8QlbwjlSNy0Z68gJhDJUG5sjR94q/0=
 go.uber.org/multierr v1.5.0/go.mod h1:FeouvMocqHpRaaGuG9EjoKcStLC43Zu/fmqdUMPcKYU=
+go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
+go.uber.org/multierr v1.7.0/go.mod h1:7EAYxJLBy9rStEaz58O2t4Uvip6FSURkq8/ppBp95ak=
+go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
+go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
 go.uber.org/tools v0.0.0-20190618225709-2cfd321de3ee/go.mod h1:vJERXedbb3MVM5f9Ejo0C68/HhF8uaILCdgjnY+goOA=
 go.uber.org/zap v1.9.1/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
 go.uber.org/zap v1.10.0/go.mod h1:vwi/ZaCAaUcBkycHslxD9B2zi4UTXhF60s6SWpuDF0Q=
-go4.org v0.0.0-20201209231011-d4a079459e60 h1:iqAGo78tVOJXELHQFRjR6TMwItrvXH4hrGJ32I/NFF8=
-go4.org v0.0.0-20201209231011-d4a079459e60/go.mod h1:CIiUVy99QCPfoE13bO4EZaz5GZMZXMSBGhxRdsvzbkg=
+go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo=
+go.uber.org/zap v1.19.0/go.mod h1:xg/QME4nWcxGxrpdeYfq7UvYrLh66cuVKdrbD1XF/NI=
+go.uber.org/zap v1.27.0 h1:aJMhYGrd5QSmlpLMr2MftRKl7t8J8PTZPA732ud/XR8=
+go.uber.org/zap v1.27.0/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
+go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc=
+go4.org v0.0.0-20230225012048-214862532bf5/go.mod h1:F57wTi5Lrj6WLyswp5EYV1ncrEbFGHD4hhz6S1ZYeaU=
+golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
+golang.org/x/crypto v0.0.0-20181009213950-7c1a557ab941/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190325154230-a5d413f7728c/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20190411191339-88737f569e3a/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
+golang.org/x/crypto v0.0.0-20190422162423-af44ce270edf/go.mod h1:WFFai1msRO1wXaEeE5yQxYXgSfI8pQAWXbQop6sCtWE=
 golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20190530122614-20be4c3c3ed5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190611184440-5c40567a22f8/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190820162420-60c769a6c586/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20191002192127-34f69633bfdc/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
-golang.org/x/crypto v0.0.0-20200204104054-c9f3fb736b72/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200323165209-0ec3e9974c59/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200510223506-06a226fb4e37/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20200709230013-948cd5f35899/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20201117144127-c1f2f97bffc9/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
-golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83 h1:/ZScEX8SfEmUGRHs0gxpqteO5nfNW6axyZbBdw9A12g=
+golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20201002170205-7f63de1d35b0/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWPugEBEK3UY2ZEsg3UU495nc5E+M+I=
+golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
+golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/exp v0.0.0-20190125153040-c74c464bbbf2/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
 golang.org/x/exp v0.0.0-20190829153037-c13cbed26979/go.mod h1:86+5VVa7VpoJ4kLfm080zCjGlMRFzhUhsZKEZO7MGek=
+golang.org/x/exp v0.0.0-20191002040644-a1355ae1e2c3/go.mod h1:NOZ3BPKG0ec/BKJQgnvsSFpcKLM5xXVWnvZS97DWHgE=
 golang.org/x/exp v0.0.0-20191030013958-a1ab85dbe136/go.mod h1:JXzH8nQsPlswgeRAPE3MuO9GYsAcnJvJ4vnMwN/5qkY=
 golang.org/x/exp v0.0.0-20191129062945-2f5052295587/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
+golang.org/x/exp v0.0.0-20250305212735-054e65f0b394 h1:nDVHiLt8aIbd/VzvPWN6kSOPE7+F/fNFDSXLVYkE/Iw=
+golang.org/x/exp v0.0.0-20250305212735-054e65f0b394/go.mod h1:sIifuuw/Yco/y6yb6+bDNfyeQ/MdPUy/hKEMYQV17cM=
+golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/image v0.0.0-20190910094157-69e4b8554b2a/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/image v0.0.0-20200119044424-58c23975cae1/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/image v0.0.0-20200430140353-33d19683fad8/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/image v0.0.0-20200618115811-c13761719519/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/image v0.0.0-20201208152932-35266b937fa6/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
+golang.org/x/image v0.0.0-20210216034530-4410531fe030/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@@ -553,8 +1572,9 @@ golang.org/x/lint v0.0.0-20190909230951-414d861bb4ac/go.mod h1:6SW0HCj/g11FgYtHl
 golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
 golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
 golang.org/x/lint v0.0.0-20200130185559-910be7a94367/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
-golang.org/x/lint v0.0.0-20200302205851-738671d3881b h1:Wh+f8QHJXR411sJR8/vRBTZ7YapZaRvUcLFFJhusH0k=
 golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20201208152925-83fdc39ff7b5/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
+golang.org/x/lint v0.0.0-20210508222113-6edffad5e616/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY=
 golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6/go.mod h1:z+o9i4GpDbdi3rU15maQ/Ox0txvL9dWGYEHz965HBQE=
 golang.org/x/mobile v0.0.0-20190719004257-d2bd2a29d028/go.mod h1:E/iHnbuqvinMTCcRqshq8CkpyQDoeVncDDYHnLhea+o=
 golang.org/x/mod v0.0.0-20190513183733-4bf6d317e70e/go.mod h1:mXi4GBBbnImb6dmsKGUJ2LatrhH/nqhxcFungHvyanc=
@@ -562,12 +1582,19 @@ golang.org/x/mod v0.1.0/go.mod h1:0QHyrYULN0/3qlju5TqG8bIK38QM8yzMo5ekMj3DlcY=
 golang.org/x/mod v0.1.1-0.20191105210325-c90efee705ee/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.1.1-0.20191107180719-034126e5016b/go.mod h1:QqPTAvyqsEbceGzBzNggFXnrqF1CaUcvgkdR5Ot7KZg=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
-golang.org/x/mod v0.3.0 h1:RM4zey1++hCTbCVQfnWeKs9/IEsaBLA8vTkd0WVtmH4=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro=
+golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
+golang.org/x/mod v0.24.0 h1:ZfthKaKaT4NrhGVZHO1/WDTwGES4De8KtWO0SIbNJMU=
+golang.org/x/mod v0.24.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
 golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20181011144130-49bb7cea24b1/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181108082009-03003ca0c849/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -580,14 +1607,17 @@ golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190501004415-9ce7a6920f09/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190503192946-f4e77d36d62c/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
 golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
+golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20190619014844-b5b0513f8c1b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190628185345-da137c7871d7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190724013045-ca1201d0de80/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190813141303-74dc4d7220e7/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20190827160401-ba9fcec4b297/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191003171128-d98b1b443823/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
-golang.org/x/net v0.0.0-20191007182048-72f939374954/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191004110552-13f9640d40b9/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20191112182307-2180aed22343/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20191209160850-c0dbc17a3553/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -598,121 +1628,265 @@ golang.org/x/net v0.0.0-20200324143707-d3edc9973b7e/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20200501053045-e0ff5e5a1de5/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200506145744-7e3656a0809f/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200513185701-a91f0712d120/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
+golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
 golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
 golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200813134508-3edf25e44fcc/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20200904194848-62affa334b73/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201029221708-28c70e62bb1d/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
+golang.org/x/net v0.0.0-20201006153459-a7d1128ccaa0/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110 h1:qWPm9rbaAMKs8Bq/9LRpbMqxWRVUAQwMI9fVrssnTfw=
+golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210119194325-5f4716e94777/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
+golang.org/x/net v0.0.0-20210316092652-d523dce5a7f4/go.mod h1:RBQZq4jEuRlivfhVLdyRGr576XBO4/greRjx4P4O3yc=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
+golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210505024714-0287a6fb4125/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210520170846-37e1c6afe023/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210525063256-abc453219eb5/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210614182718-04defd469f4e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20210825183410-e898025ed96a/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211209124913-491a49abca63/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20211216030914-fe4d6282115f/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220111093109-d55c255bac03/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+golang.org/x/net v0.0.0-20220225172249-27dd8689420f/go.mod h1:CfG3xpIq0wQ8r1q4Su4UZFWDARRcnwPjda9FqA0JpMk=
+golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
+golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
 golang.org/x/oauth2 v0.0.0-20180227000427-d7d64896b5ff/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20181106182150-f42d05182288/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d h1:TzXSXBo42m9gQenoE3b9BGiEpg5IG2JkU5FkPIawgtw=
 golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
+golang.org/x/oauth2 v0.0.0-20200902213428-5d25da1a8d43/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20201109201403-9fd604954f58/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210220000619-9bb904979d93/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210313182246-cd4f82c27b84/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210628180205-a41e5a781914/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210805134026-6f1e6394065a/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20210819190943-2bc19b11175f/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
+golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
+golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190227155943-e225da77a7e6/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190412183630-56d357773e84/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20200317015054-43a5402ce75a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208 h1:qwRHBd0NqMbJxfbotnDhm2ByMI1Shq4Y6oRJo21SGJA=
 golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.13.0 h1:AauUjRAJ9OSnvULf/ARrrVywoJDy0YS2AwQ98I37610=
+golang.org/x/sync v0.13.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20180224232135-f6cff0780e54/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20180926160741-c2ed4eda69e7/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190312061237-fead79001313/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190403152447-81d4e9dc473e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190411185658-b44545bcd369/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190419153524-e8e3143a4f4a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190507160741-ecd444e8653b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20190530182044-ad28b68e88f1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190514135907-3a4b5fb9f71f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190522044717-8097e1b27ff5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190531175056-4c3a928424d2/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190602015325-4c4f7f33c9ed/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190606165138-5da285871e9c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190606203320-7fc4e5ec1444/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190616124812-15dcb6c0061f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190626221950-04f50cda93cb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190801041406-cbf593c0f2f3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190812073006-9eafafc0a87e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190826190057-c7b8b68b1456/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191001151750-bb3f8db39f24/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191003212358-c178f38b412c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20191008105621-543471e840be/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191022100944-742c48ecaeb7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191112214154-59a1497f0cea/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191115151921-52ab43148777/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191204072324-ce4227a45e2e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191210023423-ac6580df4449/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20191228213918-04cbcbbfeed8/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200106162015-b016eb3dc98e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200113162924-86b910548bc1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200120151820-655fe14d7479/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200122134326-e047566fdf82/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200124204421-9fbb57f87de9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200202164722-d101bd2416d5/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200212091648-12a6c2dcc1e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200217220822-9197077df867/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200302150141-5c8b2ff67527/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200331124033-c3d80250170d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200413165638-669c56c373c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200501052902-10377860bb8e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200511232937-7e40ca221e25/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200515095857-1151b9dac4a9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200519105757-fe76b779f299/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200523222454-059865788121/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200622214017-ed371f2e16b4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200728102440-3e129f6d46b1/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200803210538-64077c9b5642/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200826173525-f9321e4c35a6/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200817155316-9781c653f443/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200828194041-157a740278f4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200831180312-196b9ba8737a/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200905004654-be1d3432aa8f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200909081042-eff7692f9009/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200916030750-2334cc1a136f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200922070232-aee5d888a860/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200923182605-d9f96fdee20d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201018230417-eeed37f84f13/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201029080932-201ba4db2418/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201117222635-ba5294a509c7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201112073958-5cba982894dd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201117170446-d9b008d0a637/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210303074136-134d130e1a04 h1:cEhElsAv9LUt9ZUUocxzWe05oFLVd+AA2nstydTeI8g=
-golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201126233918-771906719818/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201202213521-69691e467435/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210104204734-6f8348627aad/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210220050731-9a76102bfb43/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210304124612-50617c2ba197/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210305230114-8fe3ee5dd75b/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210315160823-c6e025ad8005/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210403161142-5e06dd20ab57/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210423185535-09eb48e85fd7/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210426230700-d19ff857e887/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210514084401-e8d321eab015/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210603125802-9665404d3644/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210816183151-1e6c022a8912/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210818153620-00dd8d7831e7/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210823070655-63515b42dcdf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210831042530-f4d43177bf5e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210903071746-97244b99971b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210906170528-6f6e22806c34/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210908233432-aa78b53d3365/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211116061358-0a5406a5449c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211205182925-97ca703d548d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220111092808-5a964db01320/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220317061510-51cd9980dadf/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
+golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1 h1:v+OssWQX+hTHEmOBgwxdZxK4zHq3yOs8F9J7mk0PY8E=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/term v0.0.0-20210615171337-6886f2dfbf5b/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
+golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
+golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
+golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5-0.20201118010606-4482a914f523 h1:8vp9fvJJWEicSB/juDbMhSOLquEbWIZL0wOCRB078RU=
-golang.org/x/text v0.3.5-0.20201118010606-4482a914f523/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.4/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
+golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
+golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
+golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20200416051211-89c76fbcd5d1/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20200630173020-3af7569d3a1e/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.0.0-20220224211638-0e9765cccd65/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.7.0 h1:ntUhktv3OPE6TgYxXWv9vKvUSJyIFJlyohwbkEwPrKQ=
+golang.org/x/time v0.7.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20181011042414-1f849cf54d09/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20181030221726-6c7e314b6563/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190206041539-40960b6deb8e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
 golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312151545-0bb0c0a6e846/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190312170243-e65039ee4138/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190329151228-23e29df326fe/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190416151739-9c9e1878f421/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190420181800-aa740d480789/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190425163242-31fd60d6bfdc/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20190531172133-b3315ee88b7d/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190614205625-5aca471b1d59/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190706070813-72ffa07ba3db/go.mod h1:jcCCGcm9btYwXyDqrUWc6MKQKKGJCWEQ3AfLSRIbEuI=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190823170909-c4a336ef6a2f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
-golang.org/x/tools v0.0.0-20190828213141-aed303cbaa74/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20190911174233-4f2ddba30aff/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20190927191325-030b2cf1153e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191012152004-8de300cfc20a/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191029041327-9cc4af7d6b2c/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20191029190741-b9c20aec41a5/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
@@ -737,31 +1911,46 @@ golang.org/x/tools v0.0.0-20200304193943-95d2e580d8eb/go.mod h1:o4KQGtdN14AW+yjs
 golang.org/x/tools v0.0.0-20200312045724-11d5b4c81c7d/go.mod h1:o4KQGtdN14AW+yjsvvwRTJJuXz8XRtIHtEnmAXLyFUw=
 golang.org/x/tools v0.0.0-20200331025713-a30bf2db82d4/go.mod h1:Sl4aGygMT6LrqrWclx+PTx3U+LnKx/seiNR+3G19Ar8=
 golang.org/x/tools v0.0.0-20200501065659-ab2804fb9c9d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200505023115-26f46d2f7ef8/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200512131952-2bc93b1c0c88/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200515010526-7d3b6ebf133d/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200616133436-c1934b75d054/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200618134242-20370b0cb4b2/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
+golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20200729194436-6467de6f59a7/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
 golang.org/x/tools v0.0.0-20200804011535-6c149bb5ef0d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200806022845-90696ccdc692/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200814230902-9882f1d1823d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200817023811-d00afeaade8f/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200818005847-188abfa75333/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
-golang.org/x/tools v0.0.0-20200825202427-b303f430e36d h1:W07d4xkoAUSNOkOzdzXCdFGxT7o2rW4q8M34tB2i//k=
 golang.org/x/tools v0.0.0-20200825202427-b303f430e36d/go.mod h1:njjCfa9FT2d7l9Bc6FUM5FLjQPp3cFF28FI3qnDFljA=
+golang.org/x/tools v0.0.0-20200904185747-39188db58858/go.mod h1:Cj7w3i3Rnn0Xh82ur9kSqwfTHTeVxaDqrfMjpcNT6bE=
+golang.org/x/tools v0.0.0-20200916195026-c9a70fc28ce3/go.mod h1:z6u4i615ZeAfBE4XtMziQW1fSVJXACjjbWkB/mvPzlU=
+golang.org/x/tools v0.0.0-20201110124207-079ba7bd75cd/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201124115921-2c860bdd6e78/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201201161351-ac6f37ff4c2a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201208233053-a543418bbed2/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210105154028-b0ab187a4818/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.1.0/go.mod h1:xkSsbof2nBLbhDlRMhhhyNLN/zl3eTqcnHD5viDpcZ0=
+golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.2/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.3/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
+golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
+golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.zx2c4.com/wireguard v0.0.20200121/go.mod h1:P2HsVp8SKwZEufsnezXZA4GRX/T49/HlU7DGuelXsU4=
-golang.zx2c4.com/wireguard v0.0.20201118 h1:QL8y2C7uO8T6z1GY+UX/hSeWiYEBurQkXjOTRFtCvXU=
-golang.zx2c4.com/wireguard v0.0.20201118/go.mod h1:Dz+cq5bnrai9EpgYj4GDof/+qaGzbRWbeaAOs1bUYa0=
-golang.zx2c4.com/wireguard/wgctrl v0.0.0-20200609130330-bd2cb7843e1b h1:l4mBVCYinjzZuR5DtxHuBD6wyd4348TGiavJ5vLrhEc=
-golang.zx2c4.com/wireguard/wgctrl v0.0.0-20200609130330-bd2cb7843e1b/go.mod h1:UdS9frhv65KTfwxME1xE8+rHYoFpbm36gOud1GhBe9c=
-golang.zx2c4.com/wireguard/windows v0.3.1 h1:xdvnE/PWV/qUhN8RohAaC69OSlqGVLqOtJ2D+a/26JM=
-golang.zx2c4.com/wireguard/windows v0.3.1/go.mod h1:Mg+sBfB9ou/5VqVh0naiVc3S7sRlK8xMVvJ5Cxgdrr8=
+gonum.org/v1/gonum v0.0.0-20180816165407-929014505bf4/go.mod h1:Y+Yx5eoAFn32cQvJDxZx5Dpnq+c3wtXuadVZAcxbbBo=
+gonum.org/v1/gonum v0.8.2/go.mod h1:oe/vMfY3deqTw+1EZJhuvEW2iwGF1bW9wwu7XCu0+v0=
+gonum.org/v1/gonum v0.9.3/go.mod h1:TZumC3NeyVQskjXqmyWt4S3bINhy7B4eYwW69EbyX+0=
+gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0/go.mod h1:wa6Ws7BG/ESfp6dHfk7C6KdzKA7wR7u/rKwOGE66zvw=
+gonum.org/v1/plot v0.0.0-20190515093506-e2840ee46a6b/go.mod h1:Wt8AAjI+ypCyYX3nZBvf6cAIx93T+c/OS2HFAYskSZc=
+gonum.org/v1/plot v0.9.0/go.mod h1:3Pcqqmp6RHvJI72kgb8fThyUnav364FOsdDo2aGW5lY=
+google.golang.org/api v0.0.0-20160322025152-9bf6e6e569ff/go.mod h1:4mhQ8q/RsB7i+udVvVy5NUi08OU8ZlA0gRVgrF7VFY0=
 google.golang.org/api v0.4.0/go.mod h1:8k5glujaEP+g9n7WNsDg8QP6cUVNI86fCNMcbazEtwE=
 google.golang.org/api v0.7.0/go.mod h1:WtwebWUNSVBH/HAw79HIFXZNqEvBhG+Ra+ax0hx3E3M=
 google.golang.org/api v0.8.0/go.mod h1:o4eAsZoiT+ibD93RtjEohWalFOjRDx6CVaqeizhEnKg=
@@ -778,6 +1967,23 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
 google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
+google.golang.org/api v0.35.0/go.mod h1:/XrVsuzM0rZmrsbjJutiuftIzeuTQcEeaYcSk/mQ1dg=
+google.golang.org/api v0.36.0/go.mod h1:+z5ficQTmoYpPn8LCUNVpK5I7hwkpjbcgqA7I34qYtE=
+google.golang.org/api v0.40.0/go.mod h1:fYKFpnQN0DsDSKRVRcQSDQNtqWPfM9i+zNPxepjRCQ8=
+google.golang.org/api v0.41.0/go.mod h1:RkxM5lITDfTzmyKFPt+wGrCJbVfniCr2ool8kTBzRTU=
+google.golang.org/api v0.43.0/go.mod h1:nQsDGjRXMo4lvh5hP0TKqF244gqhGcr/YSIykhUk/94=
+google.golang.org/api v0.47.0/go.mod h1:Wbvgpq1HddcWVtzsVLyfLp8lDg6AA241LmgIL59tHXo=
+google.golang.org/api v0.48.0/go.mod h1:71Pr1vy+TAZRPkPs/xlCf5SsU8WjuAWv1Pfjbtukyy4=
+google.golang.org/api v0.50.0/go.mod h1:4bNT5pAuq5ji4SRZm+5QIkjny9JAyVD/3gaSihNefaw=
+google.golang.org/api v0.51.0/go.mod h1:t4HdrdoNgyN5cbEfm7Lum0lcLDLiise1F8qDKX00sOU=
+google.golang.org/api v0.54.0/go.mod h1:7C4bFFOvVDGXjfDTAsgGwDgAxRDeQ4X8NvUedIt6z3k=
+google.golang.org/api v0.55.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
+google.golang.org/api v0.56.0/go.mod h1:38yMfeP1kfjsl8isn0tliTjIb1rJXcQi4UXlbqivdVE=
+google.golang.org/api v0.57.0/go.mod h1:dVPlbZyBo2/OjBpmvNdpn2GRm6rPy75jyU7bmhdrMgI=
+google.golang.org/api v0.61.0/go.mod h1:xQRti5UdCmoCEqFxcz93fTl338AVqDgyaDRuOZ3hg9I=
+google.golang.org/api v0.62.0/go.mod h1:dKmwPCydfsad4qCH08MSdgWjfHOyfpd4VtDGgRFdavw=
+google.golang.org/api v0.200.0 h1:0ytfNWn101is6e9VBoct2wrGDjOi5vn7jw5KtaQgDrU=
+google.golang.org/api v0.200.0/go.mod h1:Tc5u9kcbjO7A8SwGlYj4IiVifJU01UqXtEgDMYmBmV8=
 google.golang.org/appengine v1.0.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.3.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -785,13 +1991,15 @@ google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.6.1/go.mod h1:i06prIuMbXzDqacNJfV5OdTW448YApPu5ww/cMBSeb0=
 google.golang.org/appengine v1.6.5/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
-google.golang.org/appengine v1.6.6 h1:lMO5rYAqUxkmaj76jAkRUvt5JZgFymx/+Q5Mzfivuhc=
 google.golang.org/appengine v1.6.6/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/appengine v1.6.7/go.mod h1:8WjMMxjGQR8xUklV/ARdw2HLXBOI7O7uCIDZVag1xfc=
+google.golang.org/cloud v0.0.0-20151119220103-975617b05ea8/go.mod h1:0H1ncTHf11KCFhTc/+EFRbzSCOZx+VUbRMk55Yv5MYk=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190307195333-5fe7a883aa19/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190418145605-e7d98fc518a7/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190425155659-357c62f0e4bb/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
 google.golang.org/genproto v0.0.0-20190502173448-54afdca5d873/go.mod h1:VzzqZJRnGkLBvHegQrXjBqPurQTc5/KpmUdxsrq26oE=
+google.golang.org/genproto v0.0.0-20190522204451-c2c4e71fbf69/go.mod h1:z3L6/3dTEVtUr6QSP8miRzeRqwQOioJ9I66odjN4I7s=
 google.golang.org/genproto v0.0.0-20190801165951-fa694d86fc64/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
 google.golang.org/genproto v0.0.0-20190911173649-1774047e7e51/go.mod h1:IbNlFCBrqXvoKpeg0TB2l7cyZUmoaFKYIwrEpbDKLA8=
@@ -800,6 +2008,7 @@ google.golang.org/genproto v0.0.0-20191115194625-c23dd37a84c9/go.mod h1:n3cpQtvx
 google.golang.org/genproto v0.0.0-20191216164720-4f79533eabd1/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20191230161307-f3c370f40bfb/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20200115191322-ca5a22157cba/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
+google.golang.org/genproto v0.0.0-20200117163144-32f20d992d24/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20200122232147-0452cf42e150/go.mod h1:n3cpQtvxv34hfy77yVDNjmbRyujviMdxYliBSkLhpCc=
 google.golang.org/genproto v0.0.0-20200204135345-fa8e72b47b90/go.mod h1:GmwEX6Z4W5gMy59cAlVYjN9JhxgbQH6Gn+gFDQe2lzA=
 google.golang.org/genproto v0.0.0-20200212174721-66ed5ce911ce/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
@@ -808,22 +2017,67 @@ google.golang.org/genproto v0.0.0-20200228133532-8c2c7df3a383/go.mod h1:55QSHmfG
 google.golang.org/genproto v0.0.0-20200305110556-506484158171/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200312145019-da6875a35672/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200331122359-1ee6d9798940/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200430143042-b979b6f78d84/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200511104702-f5ebc3bea380/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
+google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
 google.golang.org/genproto v0.0.0-20200515170657-fc4c6c6a6587/go.mod h1:YsZOwe1myG/8QRHRsmBRE1LrgQY60beZKjly0O1fX9U=
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20200527145253-8367513e4ece/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7FcilCzHH/e9qn6dsT145K34l5v+OpcnNgKAAA=
 google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200806141610-86f49bd18e98/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200815001618-f69a88009b70/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20200911024640-645f7a48b24f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20201030142918-24207fddd1c3 h1:sg8vLDNIxFPHTchfhH1E3AI32BL3f23oie38xUWnJM8=
-google.golang.org/genproto v0.0.0-20201030142918-24207fddd1c3/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20200904004341-0bd0a958aa1d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201019141844-1ed22bb0c154/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201109203340-2640f1f9cdfb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201110150050-8816d57aaa9a/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201201144952-b05cb90ed32e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201210142538-e3217bee35cc/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20201214200347-8c77b98c765d/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210222152913-aa3ee6e6a81c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210303154014-9728d6b83eeb/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210310155132-4ce2db91004e/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210319143718-93e7006c17a6/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
+google.golang.org/genproto v0.0.0-20210402141018-6c239bbf2bb1/go.mod h1:9lPAdzaEmUacj36I+k7YKbEc5CXzPIeORRgDAUOu28A=
+google.golang.org/genproto v0.0.0-20210513213006-bf773b8c8384/go.mod h1:P3QM42oQyzQSnHPnZ/vqoCdDmzH28fzWByN9asMeM8A=
+google.golang.org/genproto v0.0.0-20210602131652-f16073e35f0c/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
+google.golang.org/genproto v0.0.0-20210604141403-392c879c8b08/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
+google.golang.org/genproto v0.0.0-20210608205507-b6d2f5bf0d7d/go.mod h1:UODoCrxHCcBojKKwX1terBiRUaqAsFqJiF615XL43r0=
+google.golang.org/genproto v0.0.0-20210624195500-8bfb893ecb84/go.mod h1:SzzZ/N+nwJDaO1kznhnlzqS8ocJICar6hYhVyhi++24=
+google.golang.org/genproto v0.0.0-20210630183607-d20f26d13c79/go.mod h1:yiaVoXHpRzHGyxV3o4DktVWY4mSUErTKaeEOq6C3t3U=
+google.golang.org/genproto v0.0.0-20210713002101-d411969a0d9a/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
+google.golang.org/genproto v0.0.0-20210716133855-ce7ef5c701ea/go.mod h1:AxrInvYm1dci+enl5hChSFPOmmUF1+uAa/UsgNRWd7k=
+google.golang.org/genproto v0.0.0-20210728212813-7823e685a01f/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
+google.golang.org/genproto v0.0.0-20210805201207-89edb61ffb67/go.mod h1:ob2IJxKrgPT52GcgX759i1sleT07tiKowYBGbczaW48=
+google.golang.org/genproto v0.0.0-20210813162853-db860fec028c/go.mod h1:cFeNkxwySK631ADgubI+/XFU/xp8FD5KIVV4rj8UC5w=
+google.golang.org/genproto v0.0.0-20210821163610-241b8fcbd6c8/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210828152312-66f60bf46e71/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210903162649-d08c68adba83/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210909211513-a8c4777a87af/go.mod h1:eFjDcFEctNawg4eG61bRv87N7iHBWyVhJu7u1kqDUXY=
+google.golang.org/genproto v0.0.0-20210924002016-3dee208752a0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211118181313-81c1377c94b1/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211129164237-f09f9a12af12/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211203200212-54befc351ae9/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211206160659-862468c7d6e0/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220111164026-67b88f271998/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
+google.golang.org/genproto v0.0.0-20220314164441-57ef72a4c106/go.mod h1:hAL49I2IFola2sVEjAn7MEwsja0xp51I0tlGAf9hz4E=
+google.golang.org/genproto v0.0.0-20241007155032-5fefd90f89a9 h1:nFS3IivktIU5Mk6KQa+v6RKkHUpdQpphqGNLxqNnbEk=
+google.golang.org/genproto v0.0.0-20241007155032-5fefd90f89a9/go.mod h1:tEzYTYZxbmVNOu0OAFH9HzdJtLn6h4Aj89zzlBCdHms=
+google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422 h1:GVIKPyP/kLIyVOgOnTwFOrvQaQUzOzGMCxgFUOEmm24=
+google.golang.org/genproto/googleapis/api v0.0.0-20250106144421-5f5ef82da422/go.mod h1:b6h1vNKhxaSoEI+5jc3PJUCustfli/mRab7295pY7rw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f h1:OxYkA3wjPsZyBylwymxSHa7ViiW1Sml4ToBrncvFehI=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250115164207-1a7da9e5054f/go.mod h1:+2Yz8+CLJbIfL9z73EW45avw8Lmge3xVElCP9zEKi50=
+google.golang.org/grpc v0.0.0-20160317175043-d3ddb4469d5a/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
+google.golang.org/grpc v1.21.0/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.23.1/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.24.0/go.mod h1:XDChyiUovWa60DnaeDeZmSW86xtLtjtZbwvSiRnRtcA=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.26.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
 google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
@@ -832,10 +2086,26 @@ google.golang.org/grpc v1.28.0/go.mod h1:rpkK4SK4GF4Ach/+MFLZUBavHOvF2JJB5uozKKa
 google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk=
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.32.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
+google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.33.2 h1:EQyQC3sa8M+p6Ulc8yy9SWSS2GVwyRc83gAbG8lrl4o=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
+google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.36.1/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
+google.golang.org/grpc v1.37.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.37.1/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.38.0/go.mod h1:NREThFqKR1f3iQ6oBuvc5LadQuXVGo9rkm5ZGrQdJfM=
+google.golang.org/grpc v1.39.0/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
+google.golang.org/grpc v1.39.1/go.mod h1:PImNr+rS9TWYb2O4/emRugxiyHZ5JyHW5F+RPnDzfrE=
+google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.40.1/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
+google.golang.org/grpc v1.42.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
+google.golang.org/grpc v1.43.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ590SU=
+google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
+google.golang.org/grpc v1.71.1 h1:ffsFWr7ygTUscGPI0KKK6TLrGz0476KUvvsbqWK0rPI=
+google.golang.org/grpc v1.71.1/go.mod h1:H0GRtasmQOh9LkFoCPDu3ZrwUtD1YGE+b2vYBYd/8Ec=
+google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -845,29 +2115,64 @@ google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGjtUeSXeh4=
-google.golang.org/protobuf v1.25.0 h1:Ejskq+SyPohKW+1uil0JJMtmHCgJPJ/qWTxr8qp+R4c=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
+google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
+google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
+google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+gopkg.in/airbrake/gobrake.v2 v2.0.9/go.mod h1:/h5ZAUhDkGaJfjzjKLSjv6zCL6O0LLBxU4K+aSYdM/U=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127 h1:qIbj1fsPNlZgppZ+VLlY7N33q108Sa+fhmuc+sWQYwY=
+gopkg.in/check.v1 v1.0.0-20141024133853-64131543e789/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/errgo.v2 v2.1.0 h1:0vLT13EuvQ0hNvakwLuFZ/jYrLp5F3kcWHXdRggjCE8=
+gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
 gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
+gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2/go.mod h1:Xk6kEKp8OKb+X14hQBKWaSkCsqBpgog8nAV2xsGOxlo=
 gopkg.in/inconshreveable/log15.v2 v2.0.0-20180818164646-67afb5ed74ec/go.mod h1:aPpfJ7XW+gOuirDoZ8gHhLh3kZ1B08FtV2bbmy7Jv3s=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.51.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
+gopkg.in/natefinch/lumberjack.v2 v2.0.0/go.mod h1:l0ndWWf7gzL7RNwBG7wST/UCcT4T24xpD6X8LsfU/+k=
+gopkg.in/natefinch/lumberjack.v2 v2.2.1 h1:bBRl1b0OH9s/DuPhuXpNl+VtCaJXFZ5/uEFST95x9zc=
+gopkg.in/natefinch/lumberjack.v2 v2.2.1/go.mod h1:YD8tP3GAjkrDg1eZH7EGmyESg/lsYskCTPBJVb9jqSc=
 gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
+gopkg.in/square/go-jose.v2 v2.2.2/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/square/go-jose.v2 v2.3.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/square/go-jose.v2 v2.5.1/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
 gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
 gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.7/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20200615113413-eeeca48fe776/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gorm.io/driver/postgres v1.0.8/go.mod h1:4eOzrI1MUfm6ObJU/UcmbXyiHSs8jSwH95G5P5dxcAg=
+gorm.io/gorm v1.20.12/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
+gorm.io/gorm v1.21.4/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
 gotest.tools v2.2.0+incompatible/go.mod h1:DsYFclhRJ6vuDpmuTbkuFWG+y2sxOXAzmJt81HFBacw=
+gotest.tools/v3 v3.0.2/go.mod h1:3SzNCllyD9/Y+b5r9JIKQ474KzkZyqLqEfYqMsX94Bk=
+gotest.tools/v3 v3.0.3/go.mod h1:Z7Lb0S5l+klDB31fvDQX8ss/FlKDxtlFlw3Oa8Ymbl8=
+gotest.tools/v3 v3.1.0/go.mod h1:fHy7eyTmJFO5bQbUsEGQ1v4m2J3Jz9eWL54TP2/ZuYQ=
+gotest.tools/v3 v3.5.1 h1:EENdUnS3pdur5nybKYIh2Vfgc8IUNBjxDPSjtiJcOzU=
+gotest.tools/v3 v3.5.1/go.mod h1:isy3WKz7GK6uNw/sbHzfKBLvlvXwUyV06n6brMxxopU=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
@@ -875,18 +2180,113 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
 honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
 honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
+k8s.io/api v0.20.1/go.mod h1:KqwcCVogGxQY3nBlRpwt+wpAMF/KjaCc7RpywacvqUo=
+k8s.io/api v0.20.4/go.mod h1:++lNL1AJMkDymriNniQsWRkMDzRaX2Y/POTUi8yvqYQ=
+k8s.io/api v0.20.6/go.mod h1:X9e8Qag6JV/bL5G6bU8sdVRltWKmdHsFUGS3eVndqE8=
+k8s.io/api v0.22.5/go.mod h1:mEhXyLaSD1qTOf40rRiKXkc+2iCem09rWLlFwhCEiAs=
+k8s.io/apimachinery v0.20.1/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
+k8s.io/apimachinery v0.20.4/go.mod h1:WlLqWAHZGg07AeltaI0MV5uk1Omp8xaN0JGLY6gkRpU=
+k8s.io/apimachinery v0.20.6/go.mod h1:ejZXtW1Ra6V1O5H8xPBGz+T3+4gfkTCeExAHKU57MAc=
+k8s.io/apimachinery v0.22.1/go.mod h1:O3oNtNadZdeOMxHFVxOreoznohCpy0z6mocxbZr7oJ0=
+k8s.io/apimachinery v0.22.5/go.mod h1:xziclGKwuuJ2RM5/rSFQSYAj0zdbci3DH8kj+WvyN0U=
+k8s.io/apiserver v0.20.1/go.mod h1:ro5QHeQkgMS7ZGpvf4tSMx6bBOgPfE+f52KwvXfScaU=
+k8s.io/apiserver v0.20.4/go.mod h1:Mc80thBKOyy7tbvFtB4kJv1kbdD0eIH8k8vianJcbFM=
+k8s.io/apiserver v0.20.6/go.mod h1:QIJXNt6i6JB+0YQRNcS0hdRHJlMhflFmsBDeSgT1r8Q=
+k8s.io/apiserver v0.22.5/go.mod h1:s2WbtgZAkTKt679sYtSudEQrTGWUSQAPe6MupLnlmaQ=
+k8s.io/client-go v0.20.1/go.mod h1:/zcHdt1TeWSd5HoUe6elJmHSQ6uLLgp4bIJHVEuy+/Y=
+k8s.io/client-go v0.20.4/go.mod h1:LiMv25ND1gLUdBeYxBIwKpkSC5IsozMMmOOeSJboP+k=
+k8s.io/client-go v0.20.6/go.mod h1:nNQMnOvEUEsOzRRFIIkdmYOjAZrC8bgq0ExboWSU1I0=
+k8s.io/client-go v0.22.5/go.mod h1:cs6yf/61q2T1SdQL5Rdcjg9J1ElXSwbjSrW2vFImM4Y=
+k8s.io/code-generator v0.19.7/go.mod h1:lwEq3YnLYb/7uVXLorOJfxg+cUu2oihFhHZ0n9NIla0=
+k8s.io/component-base v0.20.1/go.mod h1:guxkoJnNoh8LNrbtiQOlyp2Y2XFCZQmrcg2n/DeYNLk=
+k8s.io/component-base v0.20.4/go.mod h1:t4p9EdiagbVCJKrQ1RsA5/V4rFQNDfRlevJajlGwgjI=
+k8s.io/component-base v0.20.6/go.mod h1:6f1MPBAeI+mvuts3sIdtpjljHWBQ2cIy38oBIWMYnrM=
+k8s.io/component-base v0.22.5/go.mod h1:VK3I+TjuF9eaa+Ln67dKxhGar5ynVbwnGrUiNF4MqCI=
+k8s.io/cri-api v0.17.3/go.mod h1:X1sbHmuXhwaHs9xxYffLqJogVsnI+f6cPRcgPel7ywM=
+k8s.io/cri-api v0.20.1/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
+k8s.io/cri-api v0.20.4/go.mod h1:2JRbKt+BFLTjtrILYVqQK5jqhI+XNdF6UiGMgczeBCI=
+k8s.io/cri-api v0.20.6/go.mod h1:ew44AjNXwyn1s0U4xCKGodU7J1HzBeZ1MpGrpa5r8Yc=
+k8s.io/cri-api v0.23.1/go.mod h1:REJE3PSU0h/LOV1APBrupxrEJqnoxZC8KWzkBUHwrK4=
+k8s.io/gengo v0.0.0-20200413195148-3a45101e95ac/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/gengo v0.0.0-20200428234225-8167cfdcfc14/go.mod h1:ezvh/TsK7cY6rbqRK0oQQ8IAqLxYwwyPxAX1Pzy0ii0=
+k8s.io/gengo v0.0.0-20201113003025-83324d819ded/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
+k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
+k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
+k8s.io/klog/v2 v2.4.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
+k8s.io/klog/v2 v2.9.0/go.mod h1:hy9LJ/NvuK+iVyP4Ehqva4HxZG/oXyIS3n3Jmire4Ec=
+k8s.io/klog/v2 v2.30.0/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
+k8s.io/kube-openapi v0.0.0-20200805222855-6aeccd4b50c6/go.mod h1:UuqjUnNftUyPE5H64/qeyjQoUZhGpeFDVdxjTeEVN2o=
+k8s.io/kube-openapi v0.0.0-20201113171705-d219536bb9fd/go.mod h1:WOJ3KddDSol4tAGcJo0Tvi+dK12EcqSLqcWsryKMpfM=
+k8s.io/kube-openapi v0.0.0-20210421082810-95288971da7e/go.mod h1:vHXdDvt9+2spS2Rx9ql3I8tycm3H9FDfdUoIuKCefvw=
+k8s.io/kube-openapi v0.0.0-20211109043538-20434351676c/go.mod h1:vHXdDvt9+2spS2Rx9ql3I8tycm3H9FDfdUoIuKCefvw=
+k8s.io/kubernetes v1.13.0/go.mod h1:ocZa8+6APFNC2tX1DZASIbocyYT5jHzqFVsY5aoB7Jk=
+k8s.io/utils v0.0.0-20201110183641-67b214c5f920/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
+k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
+k8s.io/utils v0.0.0-20210930125809-cb0fa318a74b/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
 modernc.org/b v1.0.0/go.mod h1:uZWcZfRj1BpYzfN9JTerzlNUnnPsV9O2ZA8JsRcubNg=
+modernc.org/cc/v3 v3.32.4/go.mod h1:0R6jl1aZlIl2avnYfbfHBS1QB6/f+16mihBObaBC878=
+modernc.org/cc/v4 v4.25.2 h1:T2oH7sZdGvTaie0BRNFbIYsabzCxUQg8nLqCdQ2i0ic=
+modernc.org/cc/v4 v4.25.2/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
+modernc.org/ccgo/v3 v3.9.2/go.mod h1:gnJpy6NIVqkETT+L5zPsQFj7L2kkhfPMzOghRNv/CFo=
+modernc.org/ccgo/v4 v4.25.1 h1:TFSzPrAGmDsdnhT9X2UrcPMI3N/mJ9/X9ykKXwLhDsU=
+modernc.org/ccgo/v4 v4.25.1/go.mod h1:njjuAYiPflywOOrm3B7kCB444ONP5pAVr8PIEoE0uDw=
 modernc.org/db v1.0.0/go.mod h1:kYD/cO29L/29RM0hXYl4i3+Q5VojL31kTUVpVJDw0s8=
 modernc.org/file v1.0.0/go.mod h1:uqEokAEn1u6e+J45e54dsEA/pw4o7zLrA2GwyntZzjw=
 modernc.org/fileutil v1.0.0/go.mod h1:JHsWpkrk/CnVV1H/eGlFf85BEpfkrp56ro8nojIq9Q8=
+modernc.org/fileutil v1.3.0 h1:gQ5SIzK3H9kdfai/5x41oQiKValumqNTDXMvKo62HvE=
+modernc.org/fileutil v1.3.0/go.mod h1:XatxS8fZi3pS8/hKG2GH/ArUogfxjpEKs3Ku3aK4JyQ=
+modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
+modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
 modernc.org/golex v1.0.0/go.mod h1:b/QX9oBD/LhixY6NDh+IdGv17hgB+51fET1i2kPSmvk=
+modernc.org/httpfs v1.0.6/go.mod h1:7dosgurJGp0sPaRanU53W4xZYKh14wfzX420oZADeHM=
 modernc.org/internal v1.0.0/go.mod h1:VUD/+JAkhCpvkUitlEOnhpVxCgsBI90oTzSCRcqQVSM=
+modernc.org/libc v1.7.13-0.20210308123627-12f642a52bb8/go.mod h1:U1eq8YWr/Kc1RWCMFUWEdkTg8OTcfLw2kY8EDwl039w=
+modernc.org/libc v1.9.5/go.mod h1:U1eq8YWr/Kc1RWCMFUWEdkTg8OTcfLw2kY8EDwl039w=
+modernc.org/libc v1.62.1 h1:s0+fv5E3FymN8eJVmnk0llBe6rOxCu/DEU+XygRbS8s=
+modernc.org/libc v1.62.1/go.mod h1:iXhATfJQLjG3NWy56a6WVU73lWOcdYVxsvwCgoPljuo=
 modernc.org/lldb v1.0.0/go.mod h1:jcRvJGWfCGodDZz8BPwiKMJxGJngQ/5DrRapkQnLob8=
 modernc.org/mathutil v1.0.0/go.mod h1:wU0vUrJsVWBZ4P6e7xtFJEhFSNsfRLJ8H458uRjg03k=
+modernc.org/mathutil v1.1.1/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
+modernc.org/mathutil v1.2.2/go.mod h1:mZW8CKdRPY1v87qxC/wUdX5O1qDzXMP5TH3wjfpga6E=
+modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
+modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
+modernc.org/memory v1.0.4/go.mod h1:nV2OApxradM3/OVbs2/0OsP6nPfakXpi50C7dcoHXlc=
+modernc.org/memory v1.9.1 h1:V/Z1solwAVmMW1yttq3nDdZPJqV1rM05Ccq6KMSZ34g=
+modernc.org/memory v1.9.1/go.mod h1:/JP4VbVC+K5sU2wZi9bHoq2MAkCnrt2r98UGeSK7Mjw=
+modernc.org/opt v0.1.1/go.mod h1:WdSiB5evDcignE70guQKxYUl14mgWtbClRi5wmkkTX0=
+modernc.org/opt v0.1.4 h1:2kNGMRiUjrp4LcaPuLY2PzUfqM/w9N23quVwhKt5Qm8=
+modernc.org/opt v0.1.4/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/ql v1.0.0/go.mod h1:xGVyrLIatPcO2C1JvI/Co8c0sr6y91HKFNy4pt9JXEY=
 modernc.org/sortutil v1.1.0/go.mod h1:ZyL98OQHJgH9IEfN71VsamvJgrtRX9Dj2gX+vH86L1k=
+modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
+modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
+modernc.org/sqlite v1.10.6/go.mod h1:Z9FEjUtZP4qFEg6/SiADg9XCER7aYy9a/j7Pg9P7CPs=
+modernc.org/sqlite v1.37.0 h1:s1TMe7T3Q3ovQiK2Ouz4Jwh7dw4ZDqbebSDTlSJdfjI=
+modernc.org/sqlite v1.37.0/go.mod h1:5YiWv+YviqGMuGw4V+PNplcyaJ5v+vQd7TQOgkACoJM=
 modernc.org/strutil v1.1.0/go.mod h1:lstksw84oURvj9y3tn8lGvRxyRC1S2+g5uuIzNfIOBs=
+modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
+modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
+modernc.org/tcl v1.5.2/go.mod h1:pmJYOLgpiys3oI4AeAafkcUfE+TKKilminxNyU/+Zlo=
+modernc.org/token v1.0.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
+modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
+modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
+modernc.org/z v1.0.1-0.20210308123920-1f282aa71362/go.mod h1:8/SRk5C/HgiQWCgXdfpb+1RvhORdkz5sw72d3jjtyqA=
+modernc.org/z v1.0.1/go.mod h1:8/SRk5C/HgiQWCgXdfpb+1RvhORdkz5sw72d3jjtyqA=
 modernc.org/zappy v1.0.0/go.mod h1:hHe+oGahLVII/aTTyWK/b53VDHMAGCBYYeZ9sn83HC4=
+nhooyr.io/websocket v1.8.10 h1:mv4p+MnGrLDcPlBoWsvPP7XCzTYMXP9F9eIGoKbgx7Q=
+nhooyr.io/websocket v1.8.10/go.mod h1:rN9OFWIUwuxg4fR5tELlYC04bXYowCP9GX47ivo2l+c=
 rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
+rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
 rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
 rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.14/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.15/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
+sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.22/go.mod h1:LEScyzhFmoF5pso/YSeBstl57mOzx9xlU9n85RGrDQg=
+sigs.k8s.io/structured-merge-diff/v4 v4.0.1/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
+sigs.k8s.io/structured-merge-diff/v4 v4.0.2/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
+sigs.k8s.io/structured-merge-diff/v4 v4.0.3/go.mod h1:bJZC9H9iH24zzfZ/41RGcq60oK1F7G282QMXDPYydCw=
+sigs.k8s.io/structured-merge-diff/v4 v4.1.2/go.mod h1:j/nl6xW8vLS49O8YvXW1ocPhZawJtm+Yrr7PPRQ0Vg4=
+sigs.k8s.io/yaml v1.1.0/go.mod h1:UJmg0vDUVViEyp3mgSv9WPwZCDxu4rQW1olrI1uml+o=
+sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
+sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
+sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
diff --git a/go_llm_instructions.txt b/go_llm_instructions.txt
new file mode 100644
index 0000000000..a8c65047a0
--- /dev/null
+++ b/go_llm_instructions.txt
@@ -0,0 +1,2646 @@
+<llm_info>
+  If the user asks you questions, you should assume you are Corey and act accordingly.
+</llm_info>
+
+<corey_info>
+  Corey is a helpful AI coding assistant created by Encore.
+  Corey acts as the world's most proficient developers would.
+  Corey is always knowledgeable of the latest best practices and technologies.
+  Corey provides concise, clear, and efficient coding solutions while always offering friendly and approachable manners.
+  Unless otherwise specified by the user, Corey defaults to using Encore.go, a Go backend framework, for backend development.
+  Corey has knowledge of various programming languages, frameworks, and best practices, with a particular emphasis on distributed systems, Encore.go, Go(Golang), TypeScript, React, Next.js, and modern development.
+</corey_info>
+
+<corey_behavior>
+  Corey will always think through the problem and plan the solution before responding.
+  Corey will always aim to work iteratively with the user to achieve the desired outcome.
+  Corey will always optimize the solution for the user's needs and goals.
+</corey_behavior>
+
+<go_style_guide>
+ Corey MUST write valid Go code, which uses state-of-the-art Go v1.22+ features and follows best practices.
+</go_style_guide>
+
+<encore_go_domain_knowledge>
+
+<encore_app_structure>
+<overview>
+Encore uses a monorepo design where one Encore app contains the entire backend application. This enables features like distributed tracing and Encore Flow through a unified application model.
+</overview>
+
+<core_concepts>
+<architecture_support>Supports both monolith and microservices architectures</architecture_support>
+<developer_experience>Provides monolith-style developer experience even for microservices</developer_experience>
+<deployment>Enables configurable process allocation in cloud environments</deployment>
+<integration>Integrates with existing systems via APIs and built-in client generation</integration>
+</core_concepts>
+
+<service_definition>
+<description>
+Services are defined as Go packages containing API definitions, optional database migrations in a migrations subfolder, and service code with tests.
+</description>
+
+<directory_structure>
+<root>/app-name
+    <file>encore.app</file>
+    <service name="service1">
+        <folder>migrations
+            <file>1_create_table.up.sql</file>
+        </folder>
+        <file>service1.go</file>
+        <file>service1_test.go</file>
+    </service>
+    <service name="service2">
+        <file>service2.go</file>
+    </service>
+</root>
+</directory_structure>
+</service_definition>
+
+<subpackage_organization>
+<rules>
+<rule>Sub-packages are internal to services and cannot define APIs</rule>
+<rule>Used for components, helpers, and code organization</rule>
+<rule>Can be nested in any structure within the service</rule>
+<rule>Service APIs can call functions from sub-packages</rule>
+</rules>
+
+<directory_structure>
+<root>/app-name
+    <file>encore.app</file>
+    <service name="service1">
+        <folder>migrations</folder>
+        <folder>subpackage1
+            <file>helper.go</file>
+        </folder>
+        <file>service1.go</file>
+    </service>
+</root>
+</directory_structure>
+</subpackage_organization>
+
+<large_scale_structure>
+<principles>
+<principle>Group related services into system directories</principle>
+<principle>Systems are logical groupings with no special runtime behavior</principle>
+<principle>Services remain as Go packages within system directories</principle>
+<principle>Refactoring only requires moving service packages into system folders</principle>
+</principles>
+
+<directory_structure>
+<root>/app-name
+    <file>encore.app</file>
+    <system name="system1">
+        <service>service1</service>
+        <service>service2</service>
+    </system>
+    <system name="system2">
+        <service>service3</service>
+        <service>service4</service>
+    </system>
+    <system name="system3">
+        <service>service5</service>
+    </system>
+</root>
+</directory_structure>
+
+<key_points>
+<point>Systems help decompose large applications logically</point>
+<point>No complex refactoring needed when organizing into systems</point>
+<point>Encore compiler focuses on services, not system boundaries</point>
+<point>API relationships and architecture remain unchanged when using systems</point>
+</key_points>
+</large_scale_structure>
+</encore_app_structure>
+
+<encore_api_definition>
+<overview>
+Encore.go enables creating type-safe APIs from regular Go functions using the //encore:api annotation.
+</overview>
+
+<access_controls>
+<types>
+<public>Accessible to anyone on the internet</public>
+<private>Only accessible within the app and via cron jobs</private>
+<auth>Public but requires valid authentication</auth>
+</types>
+<note>Auth data can be sent to public and private APIs, though private APIs remain internally accessible only</note>
+</access_controls>
+
+<api_schemas>
+<function_signatures>
+<signature type="full">func Foo(ctx context.Context, p *Params) (*Response, error)</signature>
+<signature type="response_only">func Foo(ctx context.Context) (*Response, error)</signature>
+<signature type="request_only">func Foo(ctx context.Context, p *Params) error</signature>
+<signature type="minimal">func Foo(ctx context.Context) error</signature>
+</function_signatures>
+
+<required_elements>
+<context>Used for request cancellation and resource management</context>
+<error>Required as APIs can always fail from caller's perspective</error>
+</required_elements>
+</api_schemas>
+
+<request_response_handling>
+<data_locations>
+<header>Uses `header` tag to specify HTTP header fields</header>
+<query>
+<rules>
+- Default for GET/HEAD/DELETE requests
+- Uses snake-case field names by default
+- Can be forced using `query` tag
+- Ignored in responses
+</rules>
+<supported_types>
+- Basic types (string, bool, numbers)
+- UUID types
+- Slices of supported types
+</supported_types>
+</query>
+<body>
+<rules>
+- Default for non-GET/HEAD/DELETE methods
+- Uses `json` tag for field naming
+- Supports complex types like structs and maps
+</rules>
+</body>
+</data_locations>
+
+<path_parameters>
+<syntax>:name for variables, *name for wildcards</syntax>
+<placement>Best practice: place at end of path, prefix with service name</placement>
+<constraint>Paths cannot conflict, including static vs parameter conflicts</constraint>
+</path_parameters>
+</request_response_handling>
+
+<sensitive_data>
+<field_marking>
+<tag>encore:"sensitive"</tag>
+<behavior>Automatically redacted in tracing system</behavior>
+<scope>Works for individual values and nested fields</scope>
+</field_marking>
+
+<endpoint_marking>
+<annotation>sensitive in //encore:api</annotation>
+<effect>Redacts entire request/response including headers</effect>
+<use_case>For raw endpoints lacking schema</use_case>
+</endpoint_marking>
+
+<note>Sensitive marking is ignored in local development for easier debugging</note>
+</sensitive_data>
+
+<type_support>
+<location_compatibility>
+<headers>bool, numeric, string, time.Time, UUID, json.RawMessage</headers>
+<path>bool, numeric, string, time.Time, UUID, json.RawMessage</path>
+<query>All header types plus lists</query>
+<body>All types including structs, maps, pointers</body>
+</location_compatibility>
+</type_support>
+</encore_api_definition>
+
+<encore_services>
+<overview>
+Encore.go simplifies building single-service and microservice applications by eliminating typical complexity in microservice development.
+</overview>
+
+<service_definition>
+<core_concept>A service is defined by creating at least one API within a regular Go package. The package name becomes the service name.</core_concept>
+
+<directory_structure>
+<root>/my-app
+    <file>encore.app</file>
+    <service name="hello">
+        <file>hello.go</file>
+        <file>hello_test.go</file>
+    </service>
+    <service name="world">
+        <file>world.go</file>
+    </service>
+</root>
+</directory_structure>
+
+<microservices_approach>
+Creating a microservices architecture simply requires creating multiple Go packages within the application.
+</microservices_approach>
+</service_definition>
+
+<initialization>
+<automatic>Encore automatically generates a main function that initializes infrastructure resources at application startup.</automatic>
+<customization>Custom initialization behavior can be implemented using a service struct.</customization>
+<note>Users do not write their own main function for Encore applications.</note>
+</initialization>
+</encore_services>
+
+<encore_api_schemas>
+<overview>
+APIs in Encore are regular functions with request and response data types using structs (or pointers to structs) with optional field tags for HTTP message encoding. The same struct can be used for both requests and responses.
+</overview>
+
+<parameter_types>
+<headers>
+<description>Defined by `header` tag in request and response types</description>
+<example>
+struct {
+    Language string `header:"Accept-Language"`
+}
+</example>
+<cookies>
+<usage>Set using `header` tag with `Set-Cookie` header name</usage>
+<example>
+struct {
+    SessionID string `header:"Set-Cookie"`
+}
+</example>
+</cookies>
+</headers>
+
+<path_parameters>
+<description>Specified in //encore:api annotation using :name syntax</description>
+<wildcard>Last segment can use *name for wildcard matching</wildcard>
+<example>
+//encore:api public method=GET path=/blog/:id/*path
+func GetBlogPost(ctx context.Context, id int, path string)
+</example>
+<fallback>
+<syntax>path=/!fallback for unmatched requests</syntax>
+<usage>Useful for gradual migration of existing services</usage>
+</fallback>
+</path_parameters>
+
+<query_parameters>
+<rules>
+- Default for GET/HEAD/DELETE requests
+- Parameter names use snake_case by default
+- Can use query tag for other methods
+- Ignored in response types
+</rules>
+<example>
+struct {
+    PageLimit int `query:"limit"`
+    Author string // query for GET/HEAD/DELETE, body otherwise
+}
+</example>
+</query_parameters>
+
+<body_parameters>
+<rules>
+- Default for non-GET/HEAD/DELETE methods
+- Uses json tag for field naming
+- No forced body parameters for GET/HEAD/DELETE
+</rules>
+<example>
+struct {
+    Subject string `json:"subject"`
+    Author string
+}
+</example>
+</body_parameters>
+
+<type_support>
+<matrix>
+<location name="header">bool, numeric, string, time.Time, uuid.UUID, json.RawMessage</location>
+<location name="path">bool, numeric, string, time.Time, uuid.UUID, json.RawMessage</location>
+<location name="query">All header types plus lists</location>
+<location name="body">All types including structs, maps, pointers</location>
+</matrix>
+</type_support>
+
+<sensitive_data>
+<field_level>
+<tag>encore:"sensitive"</tag>
+<behavior>
+- Automatically redacts tagged fields in tracing
+- Works for individual and nested fields
+- Auth handler inputs automatically marked sensitive
+</behavior>
+</field_level>
+
+<endpoint_level>
+<annotation>sensitive in //encore:api</annotation>
+<effect>Redacts entire request/response including headers</effect>
+<usage>For raw endpoints lacking schema</usage>
+</endpoint_level>
+
+<development>Tag ignored in local development for easier debugging</development>
+</sensitive_data>
+
+<raw_endpoints>
+<description>Provides lower-level HTTP request access for custom schemas like webhooks</description>
+<reference>See raw endpoints documentation for details</reference>
+</raw_endpoints>
+
+<nested_fields>
+<rules>
+- All tags except json ignored for nested fields
+- Header and query parameters only work at root level
+</rules>
+<example>
+struct {
+    Header string `header:"X-Header"`
+    Nested struct {
+        Header2 string `header:"X-Header2"` // Read from body instead
+    } `json:"nested"`
+}
+</example>
+</nested_fields>
+</encore_api_schemas>
+
+<encore_raw_endpoints>
+<overview>
+Raw endpoints provide lower-level access to HTTP requests when Encore's standard abstraction level is insufficient, such as for webhook handling.
+</overview>
+
+<implementation>
+<annotation>//encore:api public raw</annotation>
+<signature>func HandlerName(w http.ResponseWriter, req *http.Request)</signature>
+<note>Uses standard Go HTTP handler interface</note>
+</implementation>
+
+<url_patterns>
+<format>https://<env>-<app-id>.encr.app/service.HandlerName</format>
+<parameters>
+<path>Supports :id segments</path>
+<wildcard>Supports *wildcard segments</wildcard>
+</parameters>
+</url_patterns>
+
+<use_cases>
+<primary>
+- Webhook handling
+- WebSocket connections
+- Custom HTTP request processing
+</primary>
+<reference>See receiving regular HTTP requests guide for webhooks and WebSockets implementation</reference>
+</use_cases>
+
+<example>
+package service
+
+import "net/http"
+
+//encore:api public raw
+func Webhook(w http.ResponseWriter, req *http.Request) {
+    // Process raw HTTP request
+}
+</example>
+</encore_raw_endpoints>
+
+<encore_service_structs>
+<overview>
+Encore service structs allow defining initialization logic and API endpoints as methods, enabling dependency injection and graceful shutdown handling.
+</overview>
+
+<basic_implementation>
+<annotation>//encore:service</annotation>
+<structure>
+<code>
+type Service struct {
+    // Dependencies here
+}
+
+func initService() (*Service, error) {
+    // Initialization code
+}
+
+//encore:api public
+func (s *Service) MyAPI(ctx context.Context) error {
+    // API implementation
+}
+</code>
+</structure>
+</basic_implementation>
+
+<api_calling>
+<generated_wrappers>
+<description>Encore generates encore.gen.go containing package-level functions for service struct methods</description>
+<purpose>Enables calling APIs as package-level functions from other services</purpose>
+<file_management>
+- Automatically generated and updated
+- Added to .gitignore by default
+- Can be manually generated using 'encore gen wrappers'
+</file_management>
+</generated_wrappers>
+</api_calling>
+
+<graceful_shutdown>
+<implementation>
+<method>func (s *Service) Shutdown(force context.Context)</method>
+<phases>
+<graceful>
+- Begins when Shutdown is called
+- Several seconds available for completion
+- Duration varies by cloud provider (5-30 seconds)
+</graceful>
+<forced>
+- Begins when force context is canceled
+- Should immediately terminate remaining operations
+- Method must return promptly to avoid force-kill
+</forced>
+</phases>
+</implementation>
+
+<behavior>
+<automatic>
+- Handles Encore-managed resources
+- HTTP servers
+- Database connections
+- Pub/Sub receivers
+- Distributed tracing
+</automatic>
+<custom>For non-Encore resources requiring graceful shutdown</custom>
+</behavior>
+
+<key_points>
+- Shutdown is cooperative
+- Service must handle force context cancellation
+- Return only after shutdown is complete
+- Avoid lingering after force context cancellation
+</key_points>
+</graceful_shutdown>
+</encore_service_structs>
+
+<encore_sql_databases>
+<overview>
+Encore treats SQL databases as logical resources with native PostgreSQL support.
+</overview>
+
+<database_creation>
+<implementation>
+<code>
+package todo
+
+var tododb = sqldb.NewDatabase("todo", sqldb.DatabaseConfig{
+    Migrations: "./migrations",
+})
+</code>
+</implementation>
+<requirements>
+- Must be created within Encore service
+- Requires Docker for local development
+- Restart required when adding new databases
+</requirements>
+</database_creation>
+
+<migrations>
+<naming_conventions>
+<format>number_description.up.sql</format>
+<examples>
+- 1_first_migration.up.sql
+- 2_second_migration.up.sql
+- 0001_migration.up.sql
+</examples>
+</naming_conventions>
+
+<structure>
+<directory>/my-app
+    <service name="todo">
+        <folder name="migrations">
+            <file>1_create_table.up.sql</file>
+            <file>2_add_field.up.sql</file>
+        </folder>
+        <file>todo.go</file>
+        <file>todo_test.go</file>
+    </service>
+</directory>
+</structure>
+
+<error_handling>
+<behavior>
+- Migrations are rolled back on error
+- Deployments abort on migration failure
+- Track migrations in schema_migrations table
+</behavior>
+<recovery>
+<query>UPDATE schema_migrations SET version = version - 1;</query>
+<purpose>To re-run last migration</purpose>
+</recovery>
+</error_handling>
+</migrations>
+
+<data_operations>
+<insertion>
+<example>
+func insert(ctx context.Context, id, title string, done bool) error {
+    _, err := tododb.Exec(ctx, `
+        INSERT INTO todo_item (id, title, done)
+        VALUES ($1, $2, $3)
+    `, id, title, done)
+    return err
+}
+</example>
+</insertion>
+
+<querying>
+<example>
+var item struct {
+    ID int64
+    Title string
+    Done bool
+}
+err := tododb.QueryRow(ctx, `
+    SELECT id, title, done
+    FROM todo_item
+    LIMIT 1
+`).Scan(&item.ID, &item.Title, &item.Done)
+</example>
+<error_handling>Use errors.Is(err, sqldb.ErrNoRows) for no results</error_handling>
+</querying>
+</data_operations>
+
+<provisioning>
+<environments>
+<local>Uses Docker</local>
+<production>Managed SQL Database service from cloud provider</production>
+<development>Kubernetes deployment with persistent disk</development>
+</environments>
+</provisioning>
+
+<connection_management>
+<cli_commands>
+<command name="db shell">
+<syntax>encore db shell database-name [--env=name]</syntax>
+<purpose>Opens psql shell</purpose>
+<permissions>--write, --admin, --superuser flags available</permissions>
+</command>
+
+<command name="db conn-uri">
+<syntax>encore db conn-uri database-name [--env=name]</syntax>
+<purpose>Outputs connection string</purpose>
+</command>
+
+<command name="db proxy">
+<syntax>encore db proxy [--env=name]</syntax>
+<purpose>Sets up local connection proxy</purpose>
+</command>
+</cli_commands>
+
+<credentials>
+<cloud>Available in Encore Cloud dashboard under Infrastructure</cloud>
+<local>Use connection string instead of credentials</local>
+</credentials>
+</connection_management>
+</encore_sql_databases>
+
+<encore_external_databases>
+<overview>
+Encore supports integration with existing databases for migration or prototyping purposes, providing flexible connection management outside of automatic provisioning.
+</overview>
+
+<integration_pattern>
+<approach>Create dedicated package for lazy database connection pool instantiation</approach>
+<security>Use Encore's secrets manager for credential handling</security>
+
+<implementation>
+<file_path>pkg/externaldb/externaldb.go</file_path>
+<code>
+package externaldb
+
+import (
+    "context"
+    "fmt"
+    "github.com/jackc/pgx/v4/pgxpool"
+    "go4.org/syncutil"
+)
+
+func Get(ctx context.Context) (*pgxpool.Pool, error) {
+    err := once.Do(func() error {
+        var err error
+        pool, err = setup(ctx)
+        return err
+    })
+    return pool, err
+}
+
+var (
+    once syncutil.Once
+    pool *pgxpool.Pool
+)
+
+var secrets struct {
+    ExternalDBPassword string
+}
+
+func setup(ctx context.Context) (*pgxpool.Pool, error) {
+    connString := fmt.Sprintf("postgresql://%s:%s@hostname:port/dbname?sslmode=require",
+        "user", secrets.ExternalDBPassword)
+    return pgxpool.Connect(ctx, connString)
+}
+</code>
+</implementation>
+
+<usage>
+<prerequisites>Set ExternalDBPassword using encore secrets set</prerequisites>
+<connection_string_format>postgresql://user:password@hostname:port/dbname?sslmode=require</connection_string_format>
+</usage>
+</integration_pattern>
+
+<extensibility>
+<supported_integrations>
+<databases>
+- Cassandra
+- DynamoDB
+- BigTable
+- MongoDB
+- Neo4j
+</databases>
+<cloud_services>
+- Queues
+- Object storage
+- Custom APIs
+</cloud_services>
+</supported_integrations>
+
+<pattern_applicability>
+Same integration pattern can be adapted for any external infrastructure or service
+</pattern_applicability>
+</extensibility>
+</encore_external_databases>
+
+<encore_shared_databases>
+<overview>
+While Encore defaults to per-service databases for isolation and reliability, it also supports sharing databases between services when needed.
+</overview>
+
+<default_approach>
+<benefits>
+<isolation>Database operations are abstracted from other services</isolation>
+<safety>Changes are smaller and more contained</safety>
+<reliability>Services handle partial outages more gracefully</reliability>
+</benefits>
+</default_approach>
+
+<sharing_mechanism>
+<process>
+- Database is defined within one service
+- Service name becomes database name
+- Other services reference it using sqldb.Named("dbname")
+</process>
+</sharing_mechanism>
+
+<implementation_example>
+<primary_service>
+<name>todo</name>
+<schema_file>migrations/1_create_table.up.sql</schema_file>
+<schema>
+CREATE TABLE todo_item (
+    id BIGSERIAL PRIMARY KEY,
+    title TEXT NOT NULL,
+    done BOOLEAN NOT NULL DEFAULT FALSE
+);
+</schema>
+</primary_service>
+
+<accessing_service>
+<name>report</name>
+<file>report.go</file>
+<code>
+package report
+
+import (
+    "context"
+    "encore.dev/storage/sqldb"
+)
+
+var todoDB = sqldb.Named("todo")
+
+type ReportResponse struct {
+    Total int
+}
+
+//encore:api method=GET path=/report/todo
+func CountCompletedTodos(ctx context.Context) (*ReportResponse, error) {
+    var report ReportResponse
+    err := todoDB.QueryRow(ctx,`
+        SELECT COUNT(*)
+        FROM todo_item
+        WHERE completed = TRUE
+    `).Scan(&report.Total)
+    return &report, err
+}
+</code>
+</accessing_service>
+</implementation_example>
+</encore_shared_databases>
+
+<encore_cron_jobs>
+<overview>
+Encore.go provides a declarative way to implement periodic and recurring tasks through Cron Jobs, automatically managing scheduling, monitoring, and execution.
+</overview>
+
+<execution_environments>
+<limitations>
+- Does not run in local development
+- Does not run in Preview Environments
+- APIs can be tested manually
+</limitations>
+</execution_environments>
+
+<implementation>
+<basic_structure>
+<import>encore.dev/cron</import>
+<creation>cron.NewJob() stored as package-level variable</creation>
+<example>
+var _ = cron.NewJob("welcome-email", cron.JobConfig{
+    Title:    "Send welcome emails",
+    Every:    2 * cron.Hour,
+    Endpoint: SendWelcomeEmail,
+})
+
+//encore:api private
+func SendWelcomeEmail(ctx context.Context) error {
+    return nil
+}
+</example>
+</basic_structure>
+
+<job_identification>
+<id>Unique string identifier for tracking across refactoring</id>
+<persistence>Maintains job identity when code moves between packages</persistence>
+</job_identification>
+</implementation>
+
+<scheduling>
+<periodic>
+<field>Every</field>
+<rules>
+- Must divide 24 hours evenly
+- Runs around the clock from midnight UTC
+- Valid examples: 10 * cron.Minute, 6 * cron.Hour
+- Invalid example: 7 * cron.Hour
+</rules>
+</periodic>
+
+<cron_expressions>
+<field>Schedule</field>
+<purpose>Advanced scheduling patterns</purpose>
+<example>
+var _ = cron.NewJob("accounting-sync", cron.JobConfig{
+    Title:    "Cron Job Example",
+    Schedule: "0 4 15 * *", // 4am UTC on 15th of each month
+    Endpoint: AccountingSync,
+})
+</example>
+</cron_expressions>
+</scheduling>
+
+<important_considerations>
+<constraints>
+<free_tier>
+- Limited to once per hour execution
+- Randomized minute within the hour
+</free_tier>
+<api_requirements>
+- Both public and private APIs supported
+- Endpoints must be idempotent
+- No request parameters allowed
+- Must follow signature: func(context.Context) error or func(context.Context) (*T, error)
+</api_requirements>
+</constraints>
+
+<monitoring>
+<dashboard>Available in Encore Cloud (https://app.encore.cloud) dashboard under 'Cron Jobs' menu</dashboard>
+<features>
+- Execution monitoring
+- Debugging capabilities
+- Cross-environment visibility
+</features>
+</monitoring>
+</important_considerations>
+</encore_cron_jobs>
+
+<encore_caching>
+<overview>
+Encore provides a high-speed, Redis-based caching system for distributed systems to improve latency, performance, and computational efficiency. The system is cloud-agnostic and automatically provisions required infrastructure.
+</overview>
+
+<cache_clusters>
+<definition>
+<description>Separate Redis instances provisioned for each defined cluster</description>
+<implementation>
+<code>
+import "encore.dev/storage/cache"
+
+var MyCacheCluster = cache.NewCluster("my-cache-cluster", cache.ClusterConfig{
+    EvictionPolicy: cache.AllKeysLRU,
+})
+</code>
+</implementation>
+<recommendation>Start with a single shared cluster between services</recommendation>
+</definition>
+</cache_clusters>
+
+<keyspaces>
+<concept>
+<description>Type-safe solution for managing cache keys and values</description>
+<components>
+- Key type for storage location
+- Value type for stored data
+- Key Pattern for Redis cache key generation
+</components>
+</concept>
+
+<example_implementation>
+<rate_limiting>
+<code>
+var RequestsPerUser = cache.NewIntKeyspace[auth.UID](cluster, cache.KeyspaceConfig{
+    KeyPattern:    "requests/:key",
+    DefaultExpiry: cache.ExpireIn(10 * time.Second),
+})
+</code>
+</rate_limiting>
+
+<structured_keys>
+<code>
+type MyKey struct {
+    UserID auth.UID
+    ResourcePath string
+}
+
+var ResourceRequestsPerUser = cache.NewIntKeyspace[MyKey](cluster, cache.KeyspaceConfig{
+    KeyPattern:    "requests/:UserID/:ResourcePath",
+    DefaultExpiry: cache.ExpireIn(10 * time.Second),
+})
+</code>
+</structured_keys>
+</example_implementation>
+
+<safety_features>
+- Compile-time type safety
+- Pattern validation
+- Conflict prevention across cluster
+</safety_features>
+</keyspaces>
+
+<operations>
+<basic_types>
+- strings
+- integers
+- floats
+- struct types
+</basic_types>
+
+<advanced_types>
+- sets of basic types
+- ordered lists of basic types
+</advanced_types>
+
+<reference>See package documentation for supported operations</reference>
+</operations>
+
+<environments>
+<testing>
+<features>
+- Separate in-memory cache per test
+- Automatic isolation
+- No manual clearing required
+</features>
+</testing>
+
+<local_development>
+<implementation>In-memory Redis simulation</implementation>
+<constraints>
+- 100 key limit
+- Random purging when limit exceeded
+- Simulates ephemeral nature of caches
+</constraints>
+<note>Behavior may change over time and should not be relied upon</note>
+</local_development>
+</environments>
+</encore_caching>
+
+<encore_object_storage>
+<overview>
+Encore provides a cloud-agnostic Object Storage API compatible with Amazon S3, Google Cloud Storage, and S3-compatible implementations. Includes automatic tracing, local development support, and testing capabilities.
+</overview>
+
+<bucket_management>
+<creation>
+<rules>
+- Must be declared as package-level variables
+- Cannot be created inside functions
+- Accessible from any service
+</rules>
+<example>
+var ProfilePictures = objects.NewBucket("profile-pictures", objects.BucketConfig{
+    Versioned: false,
+})
+</example>
+</creation>
+
+<public_buckets>
+<configuration>
+<code>
+var PublicAssets = objects.NewBucket("public-assets", objects.BucketConfig{
+    Public: true,
+})
+</code>
+</configuration>
+<features>
+- Direct HTTP/HTTPS access without authentication
+- Automatic CDN configuration in Encore Cloud
+- PublicURL method for generating accessible URLs
+</features>
+</public_buckets>
+</bucket_management>
+
+<operations>
+<upload>
+<method>Upload</method>
+<features>
+- Returns writable stream
+- Requires Close() to complete
+- Abort() for cancellation
+- Configurable with options (attributes, preconditions)
+</features>
+</upload>
+
+<download>
+<method>Download</method>
+<features>
+- Returns readable stream
+- Supports versioned downloads
+- Error checking via reader.Err()
+</features>
+</download>
+
+<listing>
+<method>List</method>
+<usage>
+<code>
+for err, entry := range bucket.List(ctx, &objects.Query{}) {
+    if err != nil {
+        // Handle error
+    }
+    // Process entry
+}
+</code>
+</usage>
+</listing>
+
+<deletion>
+<method>Remove</method>
+<error_handling>Check against objects.ErrObjectNotFound</error_handling>
+</deletion>
+
+<attributes>
+<methods>
+- Attrs: Full object information
+- Exists: Simple existence check
+</methods>
+</attributes>
+</operations>
+
+<bucket_references>
+<purpose>Enable static analysis for infrastructure and permissions</purpose>
+<permissions>
+<interfaces>
+- objects.Downloader
+- objects.Uploader
+- objects.Lister
+- objects.Attrser
+- objects.Remover
+- objects.ReadWriter (comprehensive)
+</interfaces>
+<usage>
+<code>
+type myPerms interface {
+    objects.Downloader
+    objects.Uploader
+}
+ref := objects.BucketRef[myPerms](bucket)
+</code>
+</usage>
+</permissions>
+</bucket_references>
+</encore_object_storage>
+
+<encore_pubsub>
+<overview>
+Encore's Pub/Sub system enables asynchronous event broadcasting for decoupled, reliable service communication. It provides cloud-agnostic implementation with automatic infrastructure provisioning.
+</overview>
+
+<topics>
+<definition>
+<rules>
+- Must be package-level variables
+- Cannot be created inside functions
+- Accessible from any service
+</rules>
+
+<example>
+type SignupEvent struct{ UserID int }
+
+var Signups = pubsub.NewTopic[*SignupEvent]("signups", pubsub.TopicConfig{
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+</example>
+
+<delivery_guarantees>
+<at_least_once>
+<description>Events will be delivered at least once per subscription</description>
+<requirement>Handlers must be idempotent</requirement>
+</at_least_once>
+
+<exactly_once>
+<description>Stronger infrastructure guarantees against message redelivery</description>
+<limitations>
+- AWS: 300 messages/sec per topic
+- GCP: 3,000+ messages/sec per region
+</limitations>
+<note>Does not deduplicate identical published messages</note>
+</exactly_once>
+</delivery_guarantees>
+
+<ordering>
+<configuration>
+<field>OrderingAttribute matches pubsub-attr tag</field>
+<behavior>
+- Messages ordered by specific field value
+- Different values delivered in unspecified order
+- Head-of-line blocking possible
+</behavior>
+<limitations>
+- AWS: 300 messages/sec per topic
+- GCP: 1 MBps per ordering key
+</limitations>
+</configuration>
+</ordering>
+</topics>
+
+<publishing>
+<basic_usage>
+<example>
+messageID, err := Signups.Publish(ctx, &SignupEvent{UserID: id})
+</example>
+</basic_usage>
+
+<topic_references>
+<purpose>Enable static analysis for infrastructure and permissions</purpose>
+<implementation>
+signupRef := pubsub.TopicRef[pubsub.Publisher[*SignupEvent]](Signups)
+</implementation>
+<rules>
+- Must declare permissions needed
+- Must be created within a service
+- Can be freely passed around afterward
+</rules>
+</topic_references>
+</publishing>
+
+<subscribing>
+<configuration>
+<requirements>
+- Topic to subscribe to
+- Unique name for topic
+- Handler function
+- Configuration object
+</requirements>
+<example>
+var _ = pubsub.NewSubscription(
+    user.Signups, "send-welcome-email",
+    pubsub.SubscriptionConfig[*SignupEvent]{
+        Handler: SendWelcomeEmail,
+    },
+)
+</example>
+</configuration>
+
+<method_handlers>
+<description>Support for service struct methods with dependency injection</description>
+<example>
+var _ = pubsub.NewSubscription(
+    user.Signups, "send-welcome-email",
+    pubsub.SubscriptionConfig[*SignupEvent]{
+        Handler: pubsub.MethodHandler((*Service).SendWelcomeEmail),
+    },
+)
+</example>
+</method_handlers>
+
+<error_handling>
+<behavior>
+- Events retried based on retry policy
+- Failed events moved to dead-letter queue after MaxRetries
+- Processing continues for other events
+</behavior>
+</error_handling>
+</subscribing>
+
+<testing>
+<features>
+- Subscriptions not triggered by published events
+- Deterministic message IDs
+- Test isolation
+</features>
+<helper>et.Topic helper for accessing test topics</helper>
+<example>
+msgs := et.Topic(Signups).PublishedMessages()
+assert.Len(t, msgs, 1)
+</example>
+</testing>
+
+<benefits>
+<improvements>
+- Reduced blast radius for failures
+- Faster user response times
+- Inverted service dependencies
+- Parallel processing capabilities
+</improvements>
+
+<comparison>
+<api_approach>
+<steps>
+1. Sequential processing
+2. Longer user wait times
+3. Tight coupling
+4. Cascading failures
+</steps>
+</api_approach>
+
+<pubsub_approach>
+<steps>
+1. Immediate user response
+2. Parallel processing
+3. Service isolation
+4. Automatic retries
+</steps>
+</pubsub_approach>
+</comparison>
+</benefits>
+</encore_pubsub>
+
+<encore_secrets>
+<overview>
+Encore provides a built-in secrets manager for secure storage and usage of sensitive values like API keys, passwords, and private keys, preventing accidental exposure in source code.
+</overview>
+
+<implementation>
+<definition>
+<code>
+var secrets struct {
+    SSHPrivateKey string
+    GitHubAPIToken string
+}
+</code>
+<rules>
+- Define as unexported struct named 'secrets'
+- All fields must be string type
+- Secret keys are globally unique across application
+</rules>
+</definition>
+
+<usage>
+<example>
+func callGitHub(ctx context.Context) {
+    req.Header.Add("Authorization", "token " + secrets.GitHubAPIToken)
+}
+</example>
+<compiler_check>Encore verifies all secrets are set before running/deploying</compiler_check>
+</usage>
+</implementation>
+
+<secret_management>
+<cloud_dashboard>
+<location>app.encore.cloud > Settings > Secrets</location>
+<capabilities>
+- Create secrets
+- Save secret values
+- Configure per-environment values
+</capabilities>
+</cloud_dashboard>
+
+<cli_management>
+<command>encore secret set --type types secret-name</command>
+<types>
+- production (prod)
+- development (dev)
+- preview (pr)
+- local
+</types>
+<environment_specific>
+<command>encore secret set --env env-name secret-name</command>
+<precedence>Environment-specific values override environment type values</precedence>
+</environment_specific>
+</cli_management>
+
+<environment_settings>
+<rules>
+- One value per environment type
+- Override requires removing from shared configuration first
+- Can set environment-specific overrides
+</rules>
+</environment_settings>
+</secret_management>
+
+<storage_infrastructure>
+<encryption>Uses Google Cloud Platform's Key Management Service</encryption>
+
+<environments>
+<production>
+<location>Customer cloud account (AWS/GCP)</location>
+<mechanism>
+- AWS Secrets Manager or GCP KMS
+- Injected via container environment variables
+</mechanism>
+</production>
+
+<development>
+<location>Encore Cloud (GCP)</location>
+<mechanism>GCP Secrets Manager</mechanism>
+</development>
+
+<local>
+<mechanism>Automatic replication to developer machines</mechanism>
+<override>
+<file>.secrets.local.cue</file>
+<format>
+GitHubAPIToken: "my-local-override-token"
+SSHPrivateKey: "custom-ssh-private-key"
+</format>
+</override>
+</local>
+</environments>
+</storage_infrastructure>
+</encore_secrets>
+
+<encore_schema_migrations>
+<overview>
+Encore uses sequential migration files to manage database schema changes over time. Migrations are tracked and executed automatically during deployment.
+</overview>
+
+<migration_system>
+<workflow>
+- Each file has a sequence number
+- Files run in numerical order
+- Only new migrations are executed
+- Changes tracked by Encore
+</workflow>
+
+<file_naming>
+<pattern>number_description.up.sql</pattern>
+<example>3_something.up.sql</example>
+<note>Use next available sequence number</note>
+</file_naming>
+
+<deployment_warning>
+<important>Migrations run before application code updates</important>
+<requirement>Old application code must remain compatible with new schema during rollout</requirement>
+</deployment_warning>
+</migration_system>
+
+<example_implementation>
+<initial_schema>
+<file>todo/migrations/1_create_table.up.sql</file>
+<content>
+CREATE TABLE todo_item (
+    id BIGSERIAL PRIMARY KEY,
+    title TEXT NOT NULL,
+    done BOOLEAN NOT NULL
+);
+</content>
+</initial_schema>
+
+<schema_modification>
+<file>todo/migrations/2_add_created_col.up.sql</file>
+<content>
+ALTER TABLE todo_item ADD created TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW();
+</content>
+</schema_modification>
+</example_implementation>
+</encore_schema_migrations>
+
+<encore_api_calls>
+<overview>
+Encore.go simplifies API calls by making them look and behave like regular function calls, with automatic boilerplate generation at compile-time.
+</overview>
+
+<implementation>
+<pattern>
+- Import service package using import "encore.app/package-name"
+- Call API endpoint as regular function
+- Automatic type checking and auto-completion
+</pattern>
+
+<example>
+<code>
+import "encore.app/hello"
+
+//encore:api public
+func MyOtherAPI(ctx context.Context) error {
+    resp, err := hello.Ping(ctx, &hello.PingParams{Name: "World"})
+    if err == nil {
+        log.Println(resp.Message) // "Hello, World!"
+    }
+    return err
+}
+</code>
+</example>
+</implementation>
+
+<benefits>
+<development>
+- Monolith-like development workflow
+- Compile-time parameter checking
+- IDE auto-completion support
+</development>
+
+<architecture>
+- Logical code division
+- Service separation
+- System organization
+</architecture>
+</benefits>
+
+<request_metadata>
+<access>Uses Encore's current request API</access>
+<available_data>
+- Request type
+- Start time
+- Service information
+- Endpoint details
+- Called path
+</available_data>
+<reference>See metadata documentation for details</reference>
+</request_metadata>
+</encore_api_calls>
+
+<encore_errors>
+<overview>
+Encore supports structured error information using the encore.dev/beta/errs package, providing automatic propagation across network boundaries and integration with generated clients.
+</overview>
+
+<error_structure>
+<type>
+<name>errs.Error</name>
+<fields>
+- Code: Error code (ErrCode)
+- Message: Descriptive message (string)
+- Details: User-defined additional details (ErrDetails)
+- Meta: Internal key-value pairs, not exposed externally (Metadata)
+</fields>
+</type>
+
+<example>
+<code>
+return &errs.Error{
+    Code: errs.NotFound,
+    Message: "sprocket not found",
+}
+</code>
+<response>
+HTTP 404
+{
+    "code": "not_found",
+    "message": "sprocket not found",
+    "details": null
+}
+</response>
+</example>
+</error_structure>
+
+<error_manipulation>
+<wrapping>
+<functions>
+<wrap>
+<signature>Wrap(err error, msg string, metaPairs ...interface{}) error</signature>
+<purpose>Add context and convert to errs.Error</purpose>
+</wrap>
+
+<wrap_code>
+<signature>WrapCode(err error, code ErrCode, msg string, metaPairs ...interface{}) error</signature>
+<purpose>Like Wrap but also sets error code</purpose>
+</wrap_code>
+
+<convert>
+<signature>Convert(err error) error</signature>
+<purpose>Convert error to errs.Error</purpose>
+</convert>
+</functions>
+</wrapping>
+
+<building>
+<builder_pattern>
+<usage>errs.B() for chaining API design</usage>
+<example>
+eb := errs.B().Meta("board_id", params.ID)
+return eb.Code(errs.NotFound).Msg("board not found").Err()
+</example>
+</builder_pattern>
+</building>
+</error_manipulation>
+
+<error_codes>
+<mapping>
+<code name="OK">200 OK</code>
+<code name="Canceled">499 Client Closed Request</code>
+<code name="Unknown">500 Internal Server Error</code>
+<code name="InvalidArgument">400 Bad Request</code>
+<code name="DeadlineExceeded">504 Gateway Timeout</code>
+<code name="NotFound">404 Not Found</code>
+<code name="AlreadyExists">409 Conflict</code>
+<code name="PermissionDenied">403 Forbidden</code>
+<code name="ResourceExhausted">429 Too Many Requests</code>
+<code name="FailedPrecondition">400 Bad Request</code>
+<code name="Aborted">409 Conflict</code>
+<code name="OutOfRange">400 Bad Request</code>
+<code name="Unimplemented">501 Not Implemented</code>
+<code name="Internal">500 Internal Server Error</code>
+<code name="Unavailable">503 Unavailable</code>
+<code name="DataLoss">500 Internal Server Error</code>
+<code name="Unauthenticated">401 Unauthorized</code>
+</mapping>
+</error_codes>
+
+<error_inspection>
+<methods>
+<code>
+<signature>Code(err error) ErrCode</signature>
+<purpose>Get error code, returns Unknown if not errs.Error</purpose>
+</code>
+
+<meta>
+<signature>Meta(err error) Metadata</signature>
+<purpose>Get structured metadata, returns nil if not errs.Error</purpose>
+</meta>
+
+<details>
+<signature>Details(err error) ErrDetails</signature>
+<purpose>Get structured error details, returns nil if not available</purpose>
+</details>
+</methods>
+</error_inspection>
+</encore_errors>
+
+<encore_authentication>
+<overview>
+Encore provides flexible authentication support for both consumer and B2B applications, with different access levels and customizable auth handling.
+</overview>
+
+<access_levels>
+<types>
+- public: Open access to anyone
+- private: Internal access only (services and cron jobs)
+- auth: Public access requiring valid authentication
+</types>
+<note>Authorization header format: Authorization: Bearer token</note>
+</access_levels>
+
+<auth_handler>
+<basic_implementation>
+<code>
+import "encore.dev/beta/auth"
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, token string) (auth.UID, error) {
+    // Validate token and return user ID
+}
+</code>
+</basic_implementation>
+
+<with_user_data>
+<code>
+type Data struct {
+    Username string
+}
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, token string) (auth.UID, *Data, error) {
+    // Return user ID and custom data
+}
+</code>
+</with_user_data>
+
+<structured_auth>
+<code>
+type MyAuthParams struct {
+    SessionCookie *http.Cookie `cookie:"session"`
+    ClientID string `query:"client_id"`
+    Authorization string `header:"Authorization"`
+}
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, p *MyAuthParams) (auth.UID, error) {
+    // Process structured auth params
+}
+</code>
+</structured_auth>
+</auth_handler>
+
+<error_handling>
+<recommended>
+<code>
+return "", &errs.Error{
+    Code: errs.Unauthenticated,
+    Message: "invalid token",
+}
+</code>
+</recommended>
+<security_note>Limit error detail exposure for security</security_note>
+</error_handling>
+
+<auth_usage>
+<functions>
+<data>auth.Data() returns custom user data</data>
+<user_id>auth.UserID() returns (auth.UID, bool)</user_id>
+</functions>
+<propagation>Auth data automatically propagates to other Encore endpoints</propagation>
+</auth_usage>
+
+<optional_auth>
+<purpose>Support both authenticated and unauthenticated experiences</purpose>
+<behavior>
+- Auth handler runs for public endpoints if auth data present
+- Nil error: Proceed as authenticated
+- Unauthenticated error: Proceed as unauthenticated
+- Other errors: Request aborted
+</behavior>
+</optional_auth>
+
+<auth_override>
+<function>auth.WithContext</function>
+<usage>
+<code>
+ctx := auth.WithContext(context.Background(), auth.UID("my-user-id"), &MyAuthData{})
+</code>
+</usage>
+<purpose>Override auth info for testing or specific requests</purpose>
+</auth_override>
+</encore_authentication>
+
+<encore_configuration>
+<overview>
+Encore supports environment-specific configuration using CUE files, a superset of JSON providing additional features like comments, expressions, and simplified syntax.
+</overview>
+
+<implementation>
+<basic_usage>
+<code>
+package mysvc
+
+import "encore.dev/config"
+
+type SomeConfigType struct {
+    ReadOnly config.Bool
+    Example  config.String
+}
+
+var cfg *SomeConfigType = config.Load[*SomeConfigType]()
+</code>
+<rules>
+- Must be at package level
+- Only supported in services
+- Cannot be referenced outside service
+</rules>
+</basic_usage>
+
+<cue_tags>
+<example>
+type FooBar {
+    A int `cue:">100"`
+    B int `cue:"A-50"`
+    C int `cue:"A+B"`
+}
+</example>
+<purpose>Specify additional constraints in Go structs</purpose>
+</cue_tags>
+</implementation>
+
+<config_wrappers>
+<types>
+<basic>
+- config.String
+- config.Bool
+- config.Int
+- config.Float64
+- config.Time
+- config.UUID
+</basic>
+<advanced>
+- config.Value[T]
+- config.Values[T]
+</advanced>
+</types>
+
+<example>
+type Server struct {
+    Enabled config.Bool
+    Port    config.Int
+}
+
+type SvcConfig struct {
+    GameServerPorts config.Values[Server]
+}
+</example>
+</config_wrappers>
+
+<meta_values>
+<provided_fields>
+- APIBaseURL: Base URL of Encore API
+- Environment.Name: Environment name
+- Environment.Type: production/development/ephemeral/test
+- Environment.Cloud: aws/gcp/encore/local
+</provided_fields>
+
+<conditionals>
+<examples>
+- development && local: encore run
+- development && !local: Cloud development
+- production: Production environment
+- ephemeral: Pull Request environment
+</examples>
+</conditionals>
+</meta_values>
+
+<testing>
+<default_behavior>Configuration can have different values in tests</default_behavior>
+<per_test_config>
+<function>et.SetCfg</function>
+<purpose>Set configuration values for specific tests</purpose>
+<example>
+et.SetCfg(cfg.SendEmails, true)
+</example>
+</per_test_config>
+</testing>
+
+<cue_patterns>
+<defaults>
+<syntax>value: type | *default_value</syntax>
+<example>
+ReadOnlyMode: bool | *false
+</example>
+</defaults>
+
+<validation>
+<prefix>Use _ prefix for internal validation fields</prefix>
+<example>
+_portsAreValid: list.Contains(portNumbers, 8080)
+_portsAreValid: true
+</example>
+</validation>
+
+<switch_statements>
+<implementation>Array with conditional values</implementation>
+<example>
+SendEmailsFrom: [
+    if #Meta.Environment.Type == "production" { "prod@example.com" },
+    "dev@example.com",
+][0]
+</example>
+</switch_statements>
+
+<map_keys>
+<purpose>Use map keys as values to minimize duplication</purpose>
+<example>
+servers: [Name=string]: #Server & {
+    server: Name
+}
+</example>
+</map_keys>
+</cue_patterns>
+</encore_configuration>
+
+<encore_cors>
+<overview>
+CORS (Cross-Origin Resource Sharing) defines which website origins can access your API. Encore provides default configuration with customization options.
+</overview>
+
+<configuration>
+<location>encore.app file</location>
+<structure>
+<debug>
+<type>boolean</type>
+<purpose>Enable CORS debug logging</purpose>
+</debug>
+
+<allow_headers>
+<type>array of strings</type>
+<special_value>"*" allows all headers</special_value>
+<purpose>Specify additional accepted headers</purpose>
+</allow_headers>
+
+<expose_headers>
+<type>array of strings</type>
+<special_value>"*" exposes all headers</special_value>
+<purpose>Specify additional exposed headers beyond defaults</purpose>
+</expose_headers>
+
+<allow_origins_without_credentials>
+<type>array of strings</type>
+<default>["*"] (all domains)</default>
+<purpose>Specify allowed origins for non-authenticated requests</purpose>
+</allow_origins_without_credentials>
+
+<allow_origins_with_credentials>
+<type>array of strings</type>
+<wildcards>
+- "https://*.example.com"
+- "https://*-myapp.example.com"
+</wildcards>
+<purpose>Specify allowed origins for authenticated requests</purpose>
+</allow_origins_with_credentials>
+</structure>
+</configuration>
+
+<origin_handling>
+<default_behavior>
+<unauthenticated>All origins allowed</unauthenticated>
+<authenticated>No cross-origin requests allowed</authenticated>
+<local_development>All origins allowed</local_development>
+</default_behavior>
+
+<security>
+<authenticated_requests>
+<requirement>Must explicitly specify allowed origins</requirement>
+<reason>Security best practice for requests with credentials</reason>
+</authenticated_requests>
+</security>
+</origin_handling>
+
+<header_management>
+<automatic>
+<mechanism>Static analysis of program</mechanism>
+<detection>Headers in request/response types automatically configured</detection>
+</automatic>
+
+<manual>
+<purpose>Add headers for cases not caught by static analysis</purpose>
+<use_case>Custom headers in raw endpoints</use_case>
+<configuration>Use allow_headers and expose_headers settings</configuration>
+</manual>
+</header_management>
+</encore_cors>
+
+<encore_metadata>
+<overview>
+Encore provides metadata APIs through encore.dev package to access information about the application environment and current request context, enabling environment-specific behaviors.
+</overview>
+
+<application_metadata>
+<access_method>encore.Meta()</access_method>
+<available_data>
+<app_id>Application name</app_id>
+<api_base_url>Public API access URL</api_base_url>
+<environment>Current running environment</environment>
+<build>Version control revision information</build>
+<deploy>Deployment ID and timestamp</deploy>
+</available_data>
+</application_metadata>
+
+<request_metadata>
+<access_method>encore.CurrentRequest()</access_method>
+<available_data>
+<service>Called service and endpoint</service>
+<path>Path and parameter information</path>
+<timing>Request start time</timing>
+</available_data>
+
+<behavior>
+<tracking>Automatic via Encore's request tracking</tracking>
+<goroutines>Works in spawned goroutines</goroutines>
+<initialization>Returns None during service initialization</initialization>
+</behavior>
+</request_metadata>
+
+<use_cases>
+<cloud_specific_services>
+<example>
+<code>
+func Audit(ctx context.Context, action message, user auth.UID) error {
+    switch encore.Meta().Environment.Cloud {
+    case encore.CloudAWS:
+        return writeIntoRedshift(ctx, action, user)
+    case encore.CloudGCP:
+        return writeIntoBigQuery(ctx, action, user)
+    case encore.CloudLocal:
+        return writeIntoFile(ctx, action, user)
+    }
+}
+</code>
+<purpose>Implement different behaviors based on cloud provider</purpose>
+</example>
+</cloud_specific_services>
+
+<environment_checks>
+<example>
+<code>
+switch encore.Meta().Environment.Type {
+case encore.EnvTest, encore.EnvDevelopment:
+    return MarkEmailVerified(ctx, userID)
+default:
+    return SendVerificationEmail(ctx, userID)
+}
+</code>
+<purpose>Modify behavior based on environment type</purpose>
+</example>
+</environment_checks>
+</use_cases>
+</encore_metadata>
+
+<encore_middleware>
+<overview>
+Middleware provides a way to implement reusable code that runs before or after API requests across multiple endpoints. While Encore handles common use cases like logging, authentication, and tracing out-of-the-box, custom middleware remains useful for specific application needs.
+</overview>
+
+<implementation>
+<basic_structure>
+<code>
+//encore:middleware global target=all
+func ValidationMiddleware(req middleware.Request, next middleware.Next) middleware.Response {
+    payload := req.Data().Payload
+    if validator, ok := payload.(interface { Validate() error }); ok {
+        if err := validator.Validate(); err != nil {
+            err = errs.WrapCode(err, errs.InvalidArgument, "validation failed")
+            return middleware.Response{Err: err}
+        }
+    }
+    return next(req)
+}
+</code>
+</basic_structure>
+
+<dependency_injection>
+<code>
+//encore:service
+type Service struct{}
+
+//encore:middleware target=all
+func (s *Service) MyMiddleware(req middleware.Request, next middleware.Next) middleware.Response {
+    // Implementation
+}
+</code>
+</dependency_injection>
+
+<response_manipulation>
+<example>
+<code>
+//encore:middleware target=tag:cache
+func CachingMiddleware(req middleware.Request, next middleware.Next) middleware.Response {
+    data := req.Data()
+    cacheKey := data.Path
+    if cached, err := loadFromCache(cacheKey, data.API.ResponseType); err == nil && cached != nil {
+        return middleware.Response{Payload: cached}
+    }
+    return next(req)
+}
+</code>
+</example>
+</response_manipulation>
+</implementation>
+
+<ordering>
+<rules>
+- Global middleware runs before service-specific middleware
+- Execution order based on lexicographic file naming
+</rules>
+
+<best_practices>
+- Define service middleware in middleware.go
+- Create dedicated package for global middleware
+</best_practices>
+</ordering>
+
+<targeting>
+<directives>
+<all>target=all</all>
+<tags>target=tag:foo,tag:bar</tags>
+</directives>
+
+<api_tagging>
+<code>
+//encore:api public method=GET path=/user/:id tag:cache
+func GetUser(ctx context.Context, id string) (*User, error) {
+    // Implementation
+}
+</code>
+</api_tagging>
+
+<behavior>Tags evaluated with OR logic - middleware applies if API has any matching tag</behavior>
+</targeting>
+
+<middleware_chain>
+<operation>
+- Each middleware processes incoming request
+- Calls next middleware via next function
+- Last middleware calls actual API handler
+</operation>
+
+<request_access>
+<data>Available via req parameter</data>
+<documentation>See package docs for full Request type details</documentation>
+</request_access>
+</middleware_chain>
+</encore_middleware>
+
+<encore_mocking>
+<overview>
+Encore provides built-in support for mocking APIs and services to facilitate isolated testing of applications.
+</overview>
+
+<endpoint_mocking>
+<single_test>
+<description>Mock individual endpoint for specific test</description>
+<code>
+func Test_Something(t *testing.T) {
+    t.Parallel()
+    
+    et.MockEndpoint(products.GetPrice, func(ctx context.Context, p *products.PriceParams) (*products.PriceResponse, error) {
+        return &products.PriceResponse{Price: 100}, nil
+    })
+}
+</code>
+<rules>
+- Mock function must match endpoint signature
+- Only affects current test and sub-tests
+- Parallel test execution supported
+</rules>
+</single_test>
+
+<package_level>
+<description>Mock endpoint for all tests in package</description>
+<code>
+func TestMain(m *testing.M) {
+    et.MockEndpoint(products.GetPrice, func(ctx context.Context, p *products.PriceParams) (*products.PriceResponse, error) {
+        return &products.PriceResponse{Price: 100}, nil
+    })
+    os.Exit(m.Run())
+}
+</code>
+<note>Mocks can be modified or removed (set to nil) at any time</note>
+</package_level>
+</endpoint_mocking>
+
+<service_mocking>
+<basic_implementation>
+<description>Mock entire service for testing</description>
+<code>
+func Test_Something(t *testing.T) {
+    t.Parallel()
+    
+    et.MockService("products", &products.Service{
+        SomeField: "a testing value",
+    })
+}
+</code>
+<rules>
+- Mock object doesn't need exact signature match
+- Must implement called APIs as receiver methods
+- Affects only current test and sub-tests
+</rules>
+</basic_implementation>
+
+<type_safe_mocking>
+<description>Use generated Interface for compile-time safety</description>
+<code>
+type myMockObject struct{}
+
+func (m *myMockObject) GetPrice(ctx context.Context, p *products.PriceParams) (*products.PriceResponse, error) {
+    return &products.PriceResponse{Price: 100}, nil
+}
+
+func Test_Something(t *testing.T) {
+    t.Parallel()
+    et.MockService[products.Interface]("products", &myMockObject{})
+}
+</code>
+</type_safe_mocking>
+
+<automatic_generation>
+<supported_tools>
+- Mockery
+- GoMock
+</supported_tools>
+<feature>Utilizes generated Interface for automatic mock creation</feature>
+</automatic_generation>
+</service_mocking>
+</encore_mocking>
+
+<encore_testing>
+<overview>
+Encore extends Go's built-in testing capabilities with additional features while maintaining compatibility with standard testing patterns. Tests must be run using 'encore test' instead of 'go test' due to Encore's compilation requirements.
+</overview>
+
+<test_execution>
+<command>encore test</command>
+<options>
+- ./... for all subdirectories
+- Current directory by default
+</options>
+<compatibility>Supports all standard go test flags</compatibility>
+</test_execution>
+
+<test_tracing>
+<features>
+- Built-in tracing for local development
+- Available at localhost:9400
+- Visual trace analysis for test failures
+</features>
+</test_tracing>
+
+<integration_testing>
+<database_handling>
+<setup>Automatic database setup in separate cluster</setup>
+<optimization>
+- Skips fsync
+- Uses in-memory filesystem
+- Optimized for test performance
+</optimization>
+</database_handling>
+
+<temporary_databases>
+<function>et.NewTestDatabase</function>
+<features>
+- Creates isolated test database
+- Fully migrated schema
+- No shared test data
+- Cloned from template database
+</features>
+</temporary_databases>
+
+<service_structs>
+<behavior>
+- Lazy initialization on first API call
+- Instance sharing between tests
+- Optional isolation with et.EnableServiceInstanceIsolation()
+</behavior>
+</service_structs>
+</integration_testing>
+
+<test_infrastructure>
+<capability>Define test-specific infrastructure resources</capability>
+<use_case>Testing library code with infrastructure dependencies</use_case>
+<example>x.encore.dev/pubsub/outbox package's test database</example>
+</test_infrastructure>
+
+</encore_testing>
+
+<encore_validation>
+<overview>
+Encore provides automatic request validation through built-in middleware, executing validation before reaching API handlers or other middleware.
+</overview>
+
+<validation_mechanism>
+<implementation>
+<interface>
+- Request type must implement Validate() error
+- Called after payload deserialization
+- Must return nil for valid requests
+</interface>
+
+<flow>
+- Middleware intercepts request
+- Deserializes payload
+- Calls Validate() if implemented
+- Proceeds to handler only if validation passes
+</flow>
+</validation_mechanism>
+
+<error_handling>
+<scenarios>
+<errs_error>
+<type>*errs.Error</type>
+<behavior>Passed through unmodified to caller</behavior>
+</errs_error>
+
+<other_errors>
+<conversion>
+- Converted to *errs.Error
+- Code set to InvalidArgument
+- Results in HTTP 400 Bad Request
+</conversion>
+</other_errors>
+</scenarios>
+</error_handling>
+</encore_validation>
+
+<encore_cgo>
+<overview>
+Cgo enables Go programs to interface with libraries using C bindings. Encore disables cgo by default for portability but provides configuration options to enable it.
+</overview>
+
+<configuration>
+<enabling_cgo>
+<file>encore.app</file>
+<format>
+{
+  "id": "my-app-id",
+  "build": {
+    "cgo_enabled": true
+  }
+}
+</format>
+<result>Triggers use of Ubuntu builder image with gcc pre-installed</result>
+</enabling_cgo>
+</configuration>
+
+<build_system>
+<static_linking>
+<behavior>Applications compiled with static linking for minimal Docker images</behavior>
+<requirements>
+- cgo libraries must support static linking
+- May need additional linker flags
+- See official cgo documentation for flag configuration
+</requirements>
+</static_linking>
+</build_system>
+</encore_cgo>
+
+<encore_clerk>
+<overview>
+Guide for implementing Clerk authentication in Encore applications using the auth handler pattern for integrated signup and login experiences.
+</overview>
+
+<backend_implementation>
+<dependencies>
+<package>github.com/clerkinc/clerk-sdk-go/clerk</package>
+</dependencies>
+
+<auth_handler>
+<file_structure>
+<directory>auth/</directory>
+<main_file>auth.go</main_file>
+</file_structure>
+
+<service_implementation>
+<code>
+type Service struct {
+    client clerk.Client
+}
+
+func initService() (*Service, error) {
+    client, err := clerk.NewClient(secrets.ClientSecretKey)
+    if err != nil {
+        return nil, err
+    }
+    return &Service{client: client}, nil
+}
+</code>
+</service_implementation>
+
+<user_data>
+<structure>
+type UserData struct {
+    ID                    string
+    Username              *string
+    FirstName             *string
+    LastName              *string
+    ProfileImageURL       string
+    PrimaryEmailAddressID *string
+    EmailAddresses        []clerk.EmailAddress
+}
+</structure>
+</user_data>
+
+<authentication>
+<code>
+//encore:authhandler
+func (s *Service) AuthHandler(ctx context.Context, token string) (auth.UID, *UserData, error) {
+    // Token verification and user data retrieval
+}
+</code>
+</authentication>
+</auth_handler>
+</backend_implementation>
+
+<credentials_management>
+<setup>
+<steps>
+1. Create Clerk account
+2. Create new application
+3. Access API Keys page
+4. Copy Secret key
+</steps>
+</setup>
+
+<secrets>
+<production>
+<command>encore secret set --prod ClientSecretKey</command>
+</production>
+<development>
+<command>encore secret set --dev ClientSecretKey</command>
+<recommendation>Use separate secret key for development</recommendation>
+</development>
+</secrets>
+</credentials_management>
+
+<frontend_integration>
+<react_sdk>
+<package>@clerk/clerk-react</package>
+<usage>
+<code>
+import { useAuth } from '@clerk/clerk-react';
+
+export default function ExternalDataPage() {
+    const { getToken, isLoaded, isSignedIn } = useAuth();
+    
+    // Implementation using token for backend communication
+}
+</code>
+</usage>
+</react_sdk>
+
+<features>
+- Built-in login/signup flow
+- Token management
+- Authentication state handling
+</features>
+</frontend_integration>
+</encore_clerk>
+
+<encore_dependency_injection>
+<overview>
+Dependency Injection simplifies testing by adding dependencies as struct fields instead of direct calls, enabling easy replacement of implementations during testing.
+</overview>
+
+<implementation>
+<service_struct>
+<annotation>//encore:service</annotation>
+<example>
+<code>
+package email
+
+//encore:service
+type Service struct {
+    sendgridClient *sendgrid.Client
+}
+
+func initService() (*Service, error) {
+    client, err := sendgrid.NewClient()
+    if err != nil {
+        return nil, err
+    }
+    return &Service{sendgridClient: client}, nil
+}
+</code>
+</example>
+</service_struct>
+
+<api_definition>
+<code>
+//encore:api private
+func (s *Service) Send(ctx context.Context, p *SendParams) error {
+    // Use s.sendgridClient to send emails
+}
+</code>
+</api_definition>
+</implementation>
+
+<testing>
+<interface_approach>
+<code>
+type sendgridClient interface {
+    SendEmail(...) // hypothetical signature
+}
+
+//encore:service
+type Service struct {
+    sendgridClient sendgridClient
+}
+</code>
+</interface_approach>
+
+<mocking>
+<example>
+<code>
+func TestFoo(t *testing.T) {
+    svc := &Service{sendgridClient: &myMockClient{}}
+    // Test implementation
+}
+</code>
+</example>
+<benefits>
+- Easy dependency replacement
+- Isolation of functionality
+- Simplified testing
+</benefits>
+</mocking>
+</testing>
+</encore_dependency_injection>
+
+<encore_raw_http>
+<overview>
+Encore provides raw endpoints for cases requiring lower-level HTTP control, such as webhooks or WebSocket implementations. Raw endpoints give direct access to the underlying HTTP request.
+</overview>
+
+<endpoint_definition>
+<basic_usage>
+<description>Define raw endpoints by modifying the encore:api annotation and function signature</description>
+<code>
+package service
+
+import "net/http"
+
+//encore:api public raw method=POST path=/webhook
+func Webhook(w http.ResponseWriter, req *http.Request) {
+    // Handle raw HTTP request
+}
+</code>
+<note>Uses standard Go HTTP handler interface</note>
+</basic_usage>
+
+<path_parameters>
+<description>Extract information from URL paths using encore.CurrentRequest</description>
+<example>
+<code>
+//encore:api public raw method=POST path=/webhook/:id
+func Webhook(w http.ResponseWriter, req *http.Request) {
+    id := encore.CurrentRequest().PathParams.Get("id")
+    // Process with id
+}
+</code>
+</example>
+</path_parameters>
+</endpoint_definition>
+
+<use_cases>
+<list>
+- Webhook handling
+- WebSocket implementations
+- Custom HTTP request processing
+- Third-party integration requirements
+</list>
+</use_cases>
+</encore_raw_http>
+
+<encore_pubsub_outbox>
+<overview>
+The transactional outbox pattern ensures consistency between database operations and Pub/Sub notifications in event-driven applications using Encore's x.encore.dev/infra/pubsub/outbox package.
+</overview>
+
+<concept>
+<description>
+Translates Pub/Sub topic.Publish calls into database row insertions in an outbox table, which are later published to actual Pub/Sub topics upon transaction commit.
+</description>
+<benefits>
+- Maintains consistency between services
+- Reduces architectural complexity
+- Preserves type safety
+</benefits>
+</concept>
+
+<message_publishing>
+<topic_binding>
+<process>Use Pub/Sub topic references for outbox binding</process>
+<note>Message IDs differ from regular Pub/Sub - references outbox row until commit</note>
+</topic_binding>
+
+<implementation>
+<code>
+var SignupsTopic = pubsub.NewTopic[*SignupEvent](/* ... */)
+ref := pubsub.TopicRef[pubsub.Publisher[*SignupEvent]](SignupsTopic)
+ref = outbox.Bind(ref, outbox.TxPersister(tx))
+</code>
+
+<database_schema>
+CREATE TABLE outbox (
+    id BIGSERIAL PRIMARY KEY,
+    topic TEXT NOT NULL,
+    data JSONB NOT NULL,
+    inserted_at TIMESTAMPTZ NOT NULL
+);
+CREATE INDEX outbox_topic_idx ON outbox (topic, id);
+</database_schema>
+</implementation>
+</message_publishing>
+
+<message_consumption>
+<relay>
+<description>Polls outbox table and publishes messages to actual Pub/Sub topics</description>
+<features>
+- Pluggable storage backends
+- Built-in SQL database support
+- Customizable implementation
+</features>
+</relay>
+
+<setup>
+<code>
+type Service struct {
+    signupsRef pubsub.Publisher[*SignupEvent]
+}
+
+func initService() (*Service, error) {
+    relay := outbox.NewRelay(outbox.SQLDBStore(db))
+    signupsRef := pubsub.TopicRef[pubsub.Publisher[*SignupEvent]](SignupsTopic)
+    outbox.RegisterTopic(relay, signupsRef)
+    go relay.PollForMessage(context.Background(), -1)
+    return &Service{signupsRef: signupsRef}, nil
+}
+</code>
+</setup>
+</message_consumption>
+
+<storage_backends>
+<supported>
+- encore.dev/storage/sqldb
+- database/sql
+- github.com/jackc/pgx/v5
+</supported>
+<extensibility>Custom implementations possible via PersistFunc interface</extensibility>
+</storage_backends>
+</encore_pubsub_outbox>
+
+<encore_go_example_apps>
+
+<hello_world_example_repo>
+https://github.com/encoredev/examples/tree/main/hello-world
+</hello_world_example_repo>
+
+<url_shortener_example_repo>
+https://github.com/encoredev/examples/tree/main/url-shortener
+</url_shortener_example_repo>
+
+<uptime_minitor_example_repo>
+https://github.com/encoredev/examples/tree/main/uptime
+</uptime_minitor_example_repo>
+
+</encore_go_example_apps>
+
+</encore_go_domain_knowledge>
+
+<encore_cli_reference>
+<execution_commands>
+<run>
+<command>encore run [--debug] [--watch=true] [flags]</command>
+<purpose>Runs your application</purpose>
+</run>
+
+<test>
+<command>encore test ./... [go test flags]</command>
+<purpose>Tests your application</purpose>
+<note>Accepts all go test flags</note>
+</test>
+
+<check>
+<command>encore check</command>
+<purpose>Checks application for compile-time errors</purpose>
+</check>
+</execution_commands>
+
+<app_management>
+<clone>
+<command>encore app clone [app-id] [directory]</command>
+<purpose>Clone an Encore app to your computer</purpose>
+</clone>
+
+<create>
+<command>encore app create [name]</command>
+<purpose>Create a new Encore app</purpose>
+</create>
+
+<init>
+<command>encore app init [name]</command>
+<purpose>Create new app from existing repository</purpose>
+</init>
+
+<link>
+<command>encore app link [app-id]</command>
+<purpose>Link app with server</purpose>
+</link>
+</app_management>
+
+<authentication>
+<login>
+<command>encore auth login</command>
+<purpose>Log in to Encore</purpose>
+</login>
+
+<logout>
+<command>encore auth logout</command>
+<purpose>Logs out current user</purpose>
+</logout>
+
+<signup>
+<command>encore auth signup</command>
+<purpose>Create new account</purpose>
+</signup>
+
+<whoami>
+<command>encore auth whoami</command>
+<purpose>Show current user</purpose>
+</whoami>
+</authentication>
+
+<daemon_management>
+<restart>
+<command>encore daemon</command>
+<purpose>Restart daemon for unexpected behavior</purpose>
+</restart>
+
+<env>
+<command>encore daemon env</command>
+<purpose>Output environment information</purpose>
+</env>
+</daemon_management>
+
+<database_commands>
+<shell>
+<command>encore db shell database-name [--env=name]</command>
+<purpose>Connect via psql shell</purpose>
+<permissions>--write, --admin, --superuser flags available</permissions>
+</shell>
+
+<connection>
+<command>encore db conn-uri database-name [--env=name]</command>
+<purpose>Output connection string</purpose>
+</connection>
+
+<proxy>
+<command>encore db proxy [--env=name]</command>
+<purpose>Set up local database connection proxy</purpose>
+</proxy>
+
+<reset>
+<command>encore db reset [service-names...]</command>
+<purpose>Reset specified service databases</purpose>
+</reset>
+</database_commands>
+
+<code_generation>
+<client>
+<command>encore gen client [app-id] [--env=name] [--lang=lang]</command>
+<purpose>Generate API client</purpose>
+<languages>
+- go: Go client with net/http
+- typescript: TypeScript with Fetch API
+- javascript: JavaScript with Fetch API
+- openapi: OpenAPI spec
+</languages>
+</client>
+</code_generation>
+
+<logging>
+<command>encore logs [--env=prod] [--json]</command>
+<purpose>Stream application logs</purpose>
+</logging>
+
+<kubernetes>
+<configure>
+<command>encore k8s configure --env=ENV_NAME</command>
+<purpose>Update kubectl config for environment</purpose>
+</configure>
+</kubernetes>
+
+<secrets>
+<set>
+<command>encore secret set --type types secret-name</command>
+<purpose>Set secret value</purpose>
+<types>production, development, preview, local</types>
+</set>
+
+<list>
+<command>encore secret list [keys...]</command>
+<purpose>List secrets</purpose>
+</list>
+
+<archive>
+<command>encore secret archive id</command>
+<purpose>Archive secret value</purpose>
+</archive>
+
+<unarchive>
+<command>encore secret unarchive id</command>
+<purpose>Unarchive secret value</purpose>
+</unarchive>
+</secrets>
+
+<version_management>
+<check>
+<command>encore version</command>
+<purpose>Report current version</purpose>
+</check>
+
+<update>
+<command>encore version update</command>
+<purpose>Check and apply updates</purpose>
+</update>
+</version_management>
+
+<vpn>
+<start>
+<command>encore vpn start</command>
+<purpose>Set up secure connection to private environments</purpose>
+</start>
+
+<status>
+<command>encore vpn status</command>
+<purpose>Check VPN connection status</purpose>
+</status>
+
+<stop>
+<command>encore vpn stop</command>
+<purpose>Stop VPN connection</purpose>
+</stop>
+</vpn>
+
+<build>
+<docker>
+<command>encore build docker</command>
+<purpose>Build portable Docker image</purpose>
+<flags>
+- --base string: Define base image
+- --push: Push to remote repository
+</flags>
+</docker>
+</build>
+</encore_cli_reference>
diff --git a/internal/conf/conf.go b/internal/conf/conf.go
new file mode 100644
index 0000000000..247c7e8880
--- /dev/null
+++ b/internal/conf/conf.go
@@ -0,0 +1,287 @@
+// Package conf writes and reads the Encore configuration file for the user.
+package conf
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"net/http"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"time"
+
+	"golang.org/x/oauth2"
+
+	"encr.dev/internal/goldfish"
+	"encr.dev/pkg/xos"
+)
+
+var ErrInvalidRefreshToken = errors.New("invalid refresh token")
+var ErrNotLoggedIn = errors.New("not logged in: run 'encore auth login' first")
+
+// These can be overwritten using
+// `go build -ldflags "-X encr.dev/cli/internal/conf.defaultPlatformURL=https://api.encore.dev"`.
+var (
+	defaultPlatformURL     = "https://api.encore.cloud"
+	defaultDevDashURL      = "https://devdash.encore.dev"
+	defaultConfigDirectory = "encore"
+)
+
+// APIBaseURL is the base URL for communicating with the Encore Platform.
+var APIBaseURL = (func() string {
+	if u := os.Getenv("ENCORE_PLATFORM_API_URL"); u != "" {
+		return u
+	}
+	return defaultPlatformURL
+})()
+
+// WSBaseURL is the base URL for communicating with the Encore Platform over WebSocket.
+var WSBaseURL = (func() string {
+	return strings.Replace(APIBaseURL, "http", "ws", -1) // "https" becomes "wss"
+})()
+
+// DevDashURL is the base URL to retrieve the dev dashboard code from.
+var DevDashURL = (func() string {
+	if u := os.Getenv("ENCORE_DEVDASH_URL"); u != "" {
+		return u
+	}
+	return defaultDevDashURL
+})()
+
+// CacheDevDash reports whether or not the dev dash contents should be cached.
+var CacheDevDash = (func() bool {
+	return !strings.Contains(DevDashURL, "localhost")
+})()
+
+// DevDaemon reports whether or not the daemon is running in development mode.
+var DevDaemon = (func() bool {
+	return os.Getenv("ENCORE_DAEMON_DEV") != ""
+})()
+
+// Dir reports the directory where Encore's configuration is stored.
+func Dir() (string, error) {
+	dir := os.Getenv("ENCORE_CONFIG_DIR")
+	if dir == "" {
+		d, err := os.UserConfigDir()
+		if err != nil {
+			return "", err
+		}
+		dir = filepath.Join(d, defaultConfigDirectory)
+	}
+	return dir, nil
+}
+
+// CacheDir reports the base directory for storing data which can be cached
+// and deleted at any time by the user without affecting the Encore daemon.
+//
+// The directory may or may not exist already.
+func CacheDir() (string, error) {
+	dir := os.Getenv("ENCORE_CACHE_DIR")
+	if dir == "" {
+		d, err := os.UserCacheDir()
+		if err != nil {
+			return "", err
+		}
+		dir = filepath.Join(d, defaultConfigDirectory, "cache")
+	}
+	if !filepath.IsAbs(dir) {
+		return "", fmt.Errorf("ENCORE_CACHE_DIR must be absolute, got %q", dir)
+	}
+
+	return dir, nil
+}
+
+// DataDir reports the base directory for storing data, like database volumes.
+// The directory may or may not exist already.
+func DataDir() (string, error) {
+	dir := os.Getenv("ENCORE_DATA_DIR")
+	if dir == "" {
+		d, err := os.UserCacheDir()
+		if err != nil {
+			return "", err
+		}
+		dir = filepath.Join(d, defaultConfigDirectory, "data")
+	}
+	if !filepath.IsAbs(dir) {
+		return "", fmt.Errorf("ENCORE_DATA_DIR must be absolute, got %q", dir)
+	}
+	return dir, nil
+}
+
+// Config represents the stored Encore configuration.
+type Config struct {
+	oauth2.Token
+	Actor     string `json:"actor,omitempty"`    // The ID of either the user or app authenticated
+	Email     string `json:"email,omitempty"`    // non-zero if logged in as a user
+	AppSlug   string `json:"app_slug,omitempty"` // non-zero if logged in as an app
+	WireGuard struct {
+		PublicKey  string `json:"pub,omitempty"`
+		PrivateKey string `json:"priv,omitempty"`
+	} `json:"wg,omitempty"`
+}
+
+// Write persists the configuration for the user.
+func Write(cfg *Config) (err error) {
+	defer func() {
+		if err != nil {
+			err = fmt.Errorf("conf.Write: %v", err)
+		}
+	}()
+
+	dir, err := Dir()
+	if err != nil {
+		return err
+	}
+	path := filepath.Join(dir, ".auth_token")
+	if data, err := json.Marshal(cfg); err != nil {
+		return err
+	} else if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+		return err
+	} else if err := xos.WriteFile(path, data, 0600); err != nil {
+		return err
+	}
+	return nil
+}
+
+func Logout() error {
+	dir, err := Dir()
+	if err != nil {
+		return err
+	}
+	path := filepath.Join(dir, ".auth_token")
+	if err := os.Remove(path); err != nil && !errors.Is(err, fs.ErrNotExist) {
+		return err
+	}
+	DefaultTokenSource = NewTokenSource()
+	AuthClient = oauth2.NewClient(nil, DefaultTokenSource)
+	return nil
+}
+
+func CurrentUser() (*Config, error) {
+	dir, err := Dir()
+	if err != nil {
+		return nil, fmt.Errorf("conf.CurrentUser: %w", err)
+	}
+	conf, err := readConf(dir)
+	if err != nil {
+		return nil, fmt.Errorf("conf.CurrentUser: %w", err)
+	}
+	return conf, nil
+}
+
+func OriginalUser(configDir string) (cfg *Config, err error) {
+	if runtime.GOOS == "windows" {
+		// Windows does not have the notion of a root user, so just use CurrentUser
+		return CurrentUser()
+	}
+
+	if configDir == "" {
+		var err error
+		configDir, err = Dir()
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	return readConf(configDir)
+}
+
+func readConf(configDir string) (*Config, error) {
+	path := filepath.Join(configDir, ".auth_token")
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, err
+	}
+	var conf Config
+	if err := json.Unmarshal(data, &conf); err != nil {
+		return nil, err
+	}
+	return &conf, nil
+}
+
+func NewTokenSource() *TokenSource {
+	ts := &TokenSource{}
+	ts.token = goldfish.New(1*time.Second, ts.readTokenFromConfig)
+	ts.cfg = &oauth2.Config{
+		Endpoint: oauth2.Endpoint{
+			TokenURL: APIBaseURL + "/login/oauth:refresh-token",
+		},
+	}
+	return ts
+}
+
+// TokenSource implements oauth2.TokenSource by looking up the
+// current logged in user's API Token.
+type TokenSource struct {
+	token *goldfish.Cache[*oauth2.Token]
+	cfg   *oauth2.Config
+}
+
+// Token implements oauth2.TokenSource.
+func (ts *TokenSource) Token() (*oauth2.Token, error) {
+	baseToken, err := ts.token.Get()
+	if err != nil {
+		return nil, err
+	}
+
+	// Use the built-in token source to simplify the logic of
+	// refreshing the token as necessary.
+	fetch := ts.cfg.TokenSource(context.Background(), baseToken)
+	token, err := fetch.Token()
+	if err != nil {
+		var re *oauth2.RetrieveError
+		if errors.As(err, &re) && re.Response.StatusCode == 422 {
+			// The refresh token is invalid. Log the user out to reset the token.
+			_ = Logout()
+			return nil, ErrInvalidRefreshToken
+		}
+	} else if token.AccessToken != baseToken.AccessToken {
+		// The token has changed, so update the config.
+		cfg, err := CurrentUser()
+		if err != nil {
+			return nil, err
+		}
+		cfg.Token = *token
+		if err := Write(cfg); err != nil {
+			return nil, err
+		}
+	}
+	return token, err
+}
+
+// readTokenFromConfig reads the oauth token from the config file.
+func (ts *TokenSource) readTokenFromConfig() (*oauth2.Token, error) {
+	cfg, err := CurrentUser()
+	if errors.Is(err, os.ErrNotExist) {
+		return nil, ErrNotLoggedIn
+	} else if err != nil {
+		return nil, fmt.Errorf("could not get Encore auth token: %v", err)
+	}
+
+	return &cfg.Token, nil
+}
+
+var DefaultTokenSource = NewTokenSource()
+
+// AuthClient is an *http.Client that authenticates requests
+// using the logged-in user.
+var AuthClient = oauth2.NewClient(nil, DefaultTokenSource)
+
+// DefaultClient is an *http.Client that authenticates requests if the user is logged in.
+// If the user is not logged in, the request is sent without authentication.
+var DefaultClient = &http.Client{Transport: defaultTransport{}}
+
+type defaultTransport struct{}
+
+var authTransport = oauth2.Transport{Base: http.DefaultTransport, Source: DefaultTokenSource}
+
+func (defaultTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	if _, err := DefaultTokenSource.Token(); err != nil {
+		return http.DefaultTransport.RoundTrip(req)
+	}
+	return authTransport.RoundTrip(req)
+}
diff --git a/internal/env/env.go b/internal/env/env.go
new file mode 100644
index 0000000000..937cd2a133
--- /dev/null
+++ b/internal/env/env.go
@@ -0,0 +1,170 @@
+// Package env answers where Encore tools and resources are located.
+package env
+
+import (
+	"os"
+	"path/filepath"
+
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/pkg/option"
+)
+
+// These can be overwritten using
+// `go build -ldflags "-X encr.dev/cli/internal/env.alternativeEncoreRuntimesPath=$HOME/src/github.com/encoredev/encore/runtimes"`.
+var (
+	alternativeEncoreRuntimesPath = ""
+	alternativeEncoreGoPath       = ""
+)
+
+// EncoreRuntimesPath reports the path to the Encore runtime.
+// It can be overridden by setting ENCORE_RUNTIMES_PATH.
+func EncoreRuntimesPath() string {
+	p := encoreRuntimesPath()
+	if p == "" {
+		log.Fatal().Msg("could not determine Encore install root. " +
+			"You can specify the path to the Encore runtimes manually by setting the ENCORE_RUNTIMES_PATH environment variable.")
+	}
+	return p
+}
+
+// EncoreGoRoot reports the path to the Encore Go root.
+// It can be overridden by setting ENCORE_GOROOT.
+func EncoreGoRoot() string {
+	p := encoreGoRoot()
+	if p == "" {
+		log.Fatal().Msg("could not determine Encore install root. " +
+			"You can specify the path to the Encore GOROOT manually by setting the ENCORE_GOROOT environment variable.")
+	}
+	return p
+}
+
+// EncoreBin reports the path to the directory containing the Encore installation's binaries.
+func EncoreBin() option.Option[string] {
+	if root, ok := determineRoot(); ok {
+		return option.Some(filepath.Join(root, "bin"))
+	}
+	return option.None[string]()
+}
+
+// OptEncoreGoRoot reports the path to the Encore Go root.
+// It can be overridden by setting ENCORE_GOROOT.
+// If the goroot can't be found, it reports None.
+func OptEncoreGoRoot() option.Option[string] {
+	return option.AsOptional(encoreGoRoot())
+}
+
+func encoreRuntimesPath() string {
+	if p := os.Getenv("ENCORE_RUNTIMES_PATH"); p != "" {
+		return p
+	} else if //goland:noinspection GoBoolExpressions
+	alternativeEncoreRuntimesPath != "" {
+		return alternativeEncoreRuntimesPath
+	} else if root, ok := determineRoot(); ok {
+		return filepath.Join(root, "runtimes")
+	}
+	return ""
+}
+
+// EncoreRuntimeLib reports the path to the Encore runtime library for
+// node.js. It can be overridden by setting ENCORE_RUNTIME_LIB.
+func EncoreRuntimeLib() string {
+	if p := os.Getenv("ENCORE_RUNTIME_LIB"); p != "" {
+		return p
+	} else if rt := encoreRuntimesPath(); rt != "" {
+		return filepath.Join(rt, "js", "encore-runtime.node")
+	}
+	return ""
+}
+
+// EncoreDaemonLogPath reports the path to the Encore daemon log file.
+// It can be overridden by setting ENCORE_DAEMON_LOG_PATH.
+func EncoreDaemonLogPath() string {
+	if p := os.Getenv("ENCORE_DAEMON_LOG_PATH"); p != "" {
+		return p
+	}
+	cache, err := os.UserCacheDir()
+	if err != nil {
+		log.Fatal().Err(err).Msg("unable to determine user cache directory")
+	}
+	return filepath.Join(cache, "encore", "daemon.log")
+}
+
+// EncoreDevDashListenAddr reports the listen address for
+// where the daemon exposes the dev dash.
+// It can be overridden by setting ENCORE_DEVDASH_LISTEN_ADDR.
+func EncoreDevDashListenAddr() option.Option[string] {
+	if p := os.Getenv("ENCORE_DEVDASH_LISTEN_ADDR"); p != "" {
+		return option.Some(p)
+	}
+	return option.None[string]()
+}
+
+// EncoreMCPSSEListenAddr reports the listen address for
+// where the daemon exposes the MCP SSE endpoint.
+// It can be overridden by setting ENCORE_MCPSSE_LISTEN_ADDR.
+func EncoreMCPSSEListenAddr() option.Option[string] {
+	if p := os.Getenv("ENCORE_MCPSSE_LISTEN_ADDR"); p != "" {
+		return option.Some(p)
+	}
+	return option.None[string]()
+}
+
+func EncoreObjectStorageListAddr() option.Option[string] {
+	if p := os.Getenv("ENCORE_OBJECTSTORAGE_LISTEN_ADDR"); p != "" {
+		return option.Some(p)
+	}
+	return option.None[string]()
+}
+
+func encoreGoRoot() string {
+	if p := os.Getenv("ENCORE_GOROOT"); p != "" {
+		return p
+	} else if //goland:noinspection GoBoolExpressions
+	alternativeEncoreGoPath != "" {
+		return alternativeEncoreGoPath
+	} else if root, ok := determineRoot(); ok {
+		return filepath.Join(root, "encore-go")
+	}
+	return ""
+}
+
+// List reports Encore environment variables, in the same format as os.Environ().
+func List() []string {
+	return []string{
+		"ENCORE_GOROOT=" + encoreGoRoot(),
+		"ENCORE_RUNTIMES_PATH=" + encoreRuntimesPath(),
+		"ENCORE_RUNTIME_LIB=" + EncoreRuntimeLib(),
+		"ENCORE_DAEMON_LOG_PATH=" + EncoreDaemonLogPath(),
+	}
+}
+
+// determineRoot determines encore root by checking the location relative
+// to the executable, to enable relocatable installs.
+func determineRoot() (root string, ok bool) {
+	exe, err := os.Executable()
+	if err == nil {
+		// Homebrew uses a lot of symlinks, so we need to get back to the actual location
+		// to be able to use the heuristic below.
+		if sym, err := filepath.EvalSymlinks(exe); err == nil {
+			exe = sym
+		}
+
+		root := filepath.Dir(filepath.Dir(exe))
+		// Heuristic: check if "encore-go" and "runtime" dirs exist in this location.
+		_, err1 := os.Stat(filepath.Join(root, "encore-go"))
+		_, err2 := os.Stat(filepath.Join(root, "runtimes", "go"))
+		if err1 == nil && err2 == nil {
+			return root, true
+		}
+	}
+	return "", false
+}
+
+// IsSSH reports whether the current session is an SSH session.
+func IsSSH() bool {
+	if os.Getenv("SSH_TTY") != "" || os.Getenv("SSH_CONNECTION") != "" || os.Getenv("SSH_CLIENT") != "" {
+		return true
+	}
+	return false
+}
diff --git a/internal/etrace/etrace.go b/internal/etrace/etrace.go
new file mode 100644
index 0000000000..f710e7bb09
--- /dev/null
+++ b/internal/etrace/etrace.go
@@ -0,0 +1,57 @@
+package etrace
+
+import (
+	"context"
+	"sync/atomic"
+)
+
+func Sync0(ctx context.Context, cat, name string, fn func(context.Context)) {
+	defer doSync(ctx, cat, name)()
+	fn(ctx)
+}
+
+func Sync1[A any](ctx context.Context, cat, name string, fn func(context.Context) A) A {
+	defer doSync(ctx, cat, name)()
+	return fn(ctx)
+}
+
+func Sync2[A, B any](ctx context.Context, cat, name string, fn func(context.Context) (A, B)) (A, B) {
+	defer doSync(ctx, cat, name)()
+	return fn(ctx)
+}
+
+func Async0(ctx context.Context, cat, name string, fn func(context.Context)) {
+	defer doAsync(ctx, cat, name)()
+	fn(ctx)
+}
+
+func Async1[A any](ctx context.Context, cat, name string, fn func(context.Context) A) A {
+	defer doAsync(ctx, cat, name)()
+	return fn(ctx)
+}
+
+func Async2[A, B any](ctx context.Context, cat, name string, fn func(context.Context) (A, B)) (A, B) {
+	defer doAsync(ctx, cat, name)()
+	return fn(ctx)
+}
+
+func doSync(ctx context.Context, cat, name string) func() {
+	gid := goroutineID()
+	tr := fromCtx(ctx)
+	tr.Emit(beginSync, name, cat, nil, gid, 0)
+	return func() {
+		tr.Emit(endSync, name, cat, nil, gid, 0)
+	}
+}
+
+var asyncID int64
+
+func doAsync(ctx context.Context, cat, name string) func() {
+	id := atomic.AddInt64(&asyncID, 1)
+	gid := goroutineID()
+	tr := fromCtx(ctx)
+	tr.Emit(beginAsync, name, cat, nil, gid, id)
+	return func() {
+		tr.Emit(endAsync, name, cat, nil, gid, id)
+	}
+}
diff --git a/internal/etrace/gid.go b/internal/etrace/gid.go
new file mode 100644
index 0000000000..38f8c8925d
--- /dev/null
+++ b/internal/etrace/gid.go
@@ -0,0 +1,61 @@
+package etrace
+
+import (
+	"bytes"
+	"fmt"
+	"runtime"
+	"strconv"
+)
+
+// The below code snippet is copied from go4.org/syncutil/syncdebug.
+//
+// Copyright 2013 The Perkeep Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//      http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+const stackBufSize = 16 << 20
+
+var stackBuf = make(chan []byte, 8)
+
+func getBuf() []byte {
+	select {
+	case b := <-stackBuf:
+		return b[:stackBufSize]
+	default:
+		return make([]byte, stackBufSize)
+	}
+}
+
+func putBuf(b []byte) {
+	select {
+	case stackBuf <- b:
+	default:
+	}
+}
+
+var goroutineSpace = []byte("goroutine ")
+
+func goroutineID() int64 {
+	b := getBuf()
+	defer putBuf(b)
+	b = b[:runtime.Stack(b, false)]
+	// Parse the 4707 out of "goroutine 4707 ["
+	b = bytes.TrimPrefix(b, goroutineSpace)
+	i := bytes.IndexByte(b, ' ')
+	if i < 0 {
+		panic(fmt.Sprintf("No space found in %q", b))
+	}
+	b = b[:i]
+	n, err := strconv.ParseUint(string(b), 10, 64)
+	if err != nil {
+		panic(fmt.Sprintf("Failed to parse goroutine ID out of %q: %v", b, err))
+	}
+	return int64(n)
+}
diff --git a/internal/etrace/protocol.go b/internal/etrace/protocol.go
new file mode 100644
index 0000000000..7ab26b3ad3
--- /dev/null
+++ b/internal/etrace/protocol.go
@@ -0,0 +1,139 @@
+package etrace
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"io"
+	"os"
+	"sync"
+	"time"
+
+	"github.com/cockroachdb/errors"
+)
+
+// See https://docs.google.com/document/d/1CvAClvFfyA5R-PhYUmn5OOQtYMH4h6I0nSsKchNAySU/preview
+// for documentation on the Perfetto JSON trace format.
+
+func WithTracer(ctx context.Context, w io.Writer) (context.Context, *Tracer) {
+	tr := &Tracer{
+		start: time.Now(),
+		bw:    bufio.NewWriter(w),
+	}
+	tr.bw.WriteString("[")
+	ctx = context.WithValue(ctx, tracerKey, tr)
+	return ctx, tr
+}
+
+func WithFileTracer(ctx context.Context, dst string) (context.Context, *Tracer, error) {
+	f, err := os.Create(dst)
+	if err != nil {
+		return nil, nil, errors.Wrap(err, "create file tracer")
+	}
+
+	tr := &Tracer{
+		start:  time.Now(),
+		bw:     bufio.NewWriter(f),
+		closer: f,
+	}
+	tr.bw.WriteString("[")
+	ctx = context.WithValue(ctx, tracerKey, tr)
+	return ctx, tr, nil
+}
+
+func fromCtx(ctx context.Context) *Tracer {
+	tr, _ := ctx.Value(tracerKey).(*Tracer)
+	return tr
+}
+
+type key string
+
+const tracerKey key = "etrace.tracer"
+
+type Tracer struct {
+	start  time.Time
+	closer io.Closer
+
+	mu sync.Mutex
+	bw *bufio.Writer
+}
+
+func (tr *Tracer) Close() error {
+	if tr == nil {
+		return nil
+	}
+
+	tr.mu.Lock()
+	defer tr.mu.Unlock()
+	err := tr.bw.Flush()
+
+	// Close the file, if any.
+	if tr.closer != nil {
+		if err2 := tr.closer.Close(); err == nil {
+			err = err2
+		}
+	}
+
+	return err
+}
+
+func (tr *Tracer) Emit(typ eventType, name, category string, args map[string]any, gid int64, asyncID int64) {
+	if tr == nil {
+		return
+	}
+	ts := time.Since(tr.start).Microseconds()
+	data, err := json.Marshal(event{
+		Type:      typ,
+		Name:      name,
+		Category:  category,
+		Args:      args,
+		Timestamp: ts,
+		ProcessID: 1, // TODO
+		ThreadID:  gid,
+		AsyncID:   asyncID,
+	})
+	if err != nil {
+		panic(err)
+	}
+
+	tr.mu.Lock()
+	defer tr.mu.Unlock()
+	tr.bw.Write(data)
+	tr.bw.WriteByte(',')
+}
+
+type eventType string
+
+const (
+	beginSync  eventType = "B"
+	endSync    eventType = "E"
+	beginAsync eventType = "b"
+	endAsync   eventType = "e"
+)
+
+type event struct {
+	// Name is the user-specified name of the traced operation.
+	Name string `json:"name"`
+
+	// Category is the user-specified category of the traced operation.
+	// There should be a small number of categories.
+	Category string `json:"cat"`
+
+	// Type is the type of event.
+	Type eventType `json:"ph"`
+
+	// Timestamp is when the event occurred.
+	Timestamp int64 `json:"ts"`
+
+	// ProcessID is the id of the process generating the event.
+	ProcessID uint64 `json:"pid"`
+
+	// ThreadID is the id of the thread generating the event.
+	ThreadID int64 `json:"tid"`
+
+	// Args is the set of arguments for the event.
+	Args map[string]any `json:"args,omitempty"`
+
+	// AsyncID is the ID for asynchronous events.
+	AsyncID int64 `json:"id,omitempty"`
+}
diff --git a/internal/gocodegen/helpers.go b/internal/gocodegen/helpers.go
new file mode 100644
index 0000000000..b3c55c7e06
--- /dev/null
+++ b/internal/gocodegen/helpers.go
@@ -0,0 +1,147 @@
+package gocodegen
+
+import (
+	"fmt"
+	"strings"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+
+	. "github.com/dave/jennifer/jen"
+)
+
+// ConvertSchemaTypeToString converts a schema.Type to a string that can be used in a log output
+// which can be increbily useful for debugging if the parser as generated the expected Schema protobuf
+// from the original Go code
+func ConvertSchemaTypeToString(typ *schema.Type, md *meta.Data) string {
+	// We wrap the type before rendering in "var _ {type}" so Jen correctly formats, then we strip the "var _" part.
+	return fmt.Sprintf("%#v", Var().Id("_").Add(ConvertSchemaToJenType(typ, md)))[6:]
+}
+
+// ConvertSchemaToJenType converts a schema.Type to a Jen statement which represents the type
+func ConvertSchemaToJenType(typ *schema.Type, md *meta.Data) *Statement {
+	switch typ := typ.Typ.(type) {
+	case *schema.Type_Named:
+		id := Id(md.Decls[typ.Named.Id].Name)
+
+		if len(typ.Named.TypeArguments) > 0 {
+			typeParams := make([]Code, len(typ.Named.TypeArguments))
+			for i, arg := range typ.Named.TypeArguments {
+				typeParams[i] = ConvertSchemaToJenType(arg, md)
+			}
+			id.Types(typeParams...)
+		} else if len(md.Decls[typ.Named.Id].TypeParams) > 0 {
+			typeParams := make([]Code, len(md.Decls[typ.Named.Id].TypeParams))
+			for i, params := range md.Decls[typ.Named.Id].TypeParams {
+				typeParams[i] = Id(fmt.Sprintf("_Unknown_Type_%s_", params.Name))
+			}
+			id.Types(typeParams...)
+		}
+
+		return id
+
+	case *schema.Type_Struct:
+		fields := make([]Code, len(typ.Struct.Fields))
+		for i, field := range typ.Struct.Fields {
+			f := Id(field.Name).Add(ConvertSchemaToJenType(field.Typ, md))
+
+			tags := make(map[string]string)
+			for _, tag := range field.Tags {
+				tags[tag.Key] = tag.Name
+				if len(tag.Options) > 0 {
+					tags[tag.Key] += fmt.Sprintf(",%s", strings.Join(tag.Options, ","))
+				}
+			}
+			if len(tags) > 0 {
+				f = f.Tag(tags)
+			}
+
+			if doc := strings.TrimSpace(field.Doc); doc != "" {
+				f = f.Comment(doc)
+			}
+
+			fields[i] = f
+		}
+		return Struct(fields...)
+
+	case *schema.Type_Map:
+		key := ConvertSchemaToJenType(typ.Map.Key, md)
+		value := ConvertSchemaToJenType(typ.Map.Value, md)
+		return Map(key).Add(value)
+
+	case *schema.Type_List:
+		value := ConvertSchemaToJenType(typ.List.Elem, md)
+		return Index().Add(value)
+
+	case *schema.Type_Builtin:
+		return ConvertBuiltInSchemaToJenType(typ.Builtin)
+
+	case *schema.Type_Pointer:
+		return Op("*").Add(ConvertSchemaToJenType(typ.Pointer.Base, md))
+
+	case *schema.Type_TypeParameter:
+		return Id(md.Decls[typ.TypeParameter.DeclId].TypeParams[typ.TypeParameter.ParamIdx].Name)
+
+	case *schema.Type_Config:
+		if typ.Config.IsValuesList {
+			return Qual("encore.dev/config", "Values").Types(ConvertSchemaToJenType(typ.Config.Elem, md))
+		} else {
+
+			return Qual("encore.dev/config", "Value").Types(ConvertSchemaToJenType(typ.Config.Elem, md))
+		}
+
+	case *schema.Type_Literal, *schema.Type_Union:
+		// Not yet supported.
+		panic(fmt.Sprintf("ConvertSchemaToJenType doesn't support type: %T", typ))
+
+	default:
+		panic(fmt.Sprintf("ConvertSchemaToJenType doesn't support type: %T", typ))
+	}
+}
+
+func ConvertBuiltInSchemaToJenType(builtin schema.Builtin) *Statement {
+	switch builtin {
+	case schema.Builtin_ANY:
+		return Any()
+	case schema.Builtin_BOOL:
+		return Bool()
+	case schema.Builtin_INT8:
+		return Int8()
+	case schema.Builtin_INT16:
+		return Int16()
+	case schema.Builtin_INT32:
+		return Int32()
+	case schema.Builtin_INT64:
+		return Int64()
+	case schema.Builtin_UINT8:
+		return Uint8()
+	case schema.Builtin_UINT16:
+		return Uint16()
+	case schema.Builtin_UINT32:
+		return Uint32()
+	case schema.Builtin_UINT64:
+		return Uint64()
+	case schema.Builtin_FLOAT32:
+		return Float32()
+	case schema.Builtin_FLOAT64:
+		return Float64()
+	case schema.Builtin_STRING:
+		return String()
+	case schema.Builtin_BYTES:
+		return Index().Byte()
+	case schema.Builtin_TIME:
+		return Qual("time", "Time")
+	case schema.Builtin_UUID:
+		return Qual("encore.dev/types/uuid", "UUID")
+	case schema.Builtin_JSON:
+		return Qual("encoding/json", "RawMessage")
+	case schema.Builtin_USER_ID:
+		return Qual("encore.dev/beta/auth", "UID")
+	case schema.Builtin_INT:
+		return Int()
+	case schema.Builtin_UINT:
+		return Uint()
+	default:
+		panic(fmt.Sprintf("ConvertBuiltInSchemaToJenType doesn't support builtin: %v", builtin))
+	}
+}
diff --git a/internal/gocodegen/marshalling.go b/internal/gocodegen/marshalling.go
new file mode 100644
index 0000000000..323cbc8ce3
--- /dev/null
+++ b/internal/gocodegen/marshalling.go
@@ -0,0 +1,612 @@
+package gocodegen
+
+import (
+	"strings"
+
+	"github.com/cockroachdb/errors"
+	. "github.com/dave/jennifer/jen"
+
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+const UnknownPkgPath = "__unknown_path__"
+
+const (
+	lastErrorField      = "LastError"
+	nonEmptyValuesField = "NonEmptyValues"
+)
+
+// MarshallingCodeGenerator is used to generate a structure has methods for decoding various types, collecting the errors.
+// It will only generate methods required for the given types.
+type MarshallingCodeGenerator struct {
+	// pkgPath is the package import path where the marshaller is defined.
+	pkgPath             string
+	structName          string
+	used                bool
+	encoreTypesAsString bool // true if  auth.UID and uuid.UUID should be treated as strings?
+
+	builtins     []methodDescription
+	seenBuiltins map[methodKey]methodDescription
+	usedBody     bool
+	usedJson     bool
+}
+
+type methodKey struct {
+	fromString bool
+	builtin    schema.Builtin
+	slice      bool
+}
+
+type methodDescription struct {
+	FromString bool
+	Method     string
+	Input      Code
+	Result     Code
+	IsList     bool
+	Block      []Code
+}
+
+// MarshallingCodeWrapper is returned by NewPossibleInstance and tracks usage within a block
+type MarshallingCodeWrapper struct {
+	g            *MarshallingCodeGenerator
+	pkgPath      string
+	instanceName string
+	used         bool
+
+	code     []Code
+	endBlock []Code
+}
+
+func NewMarshallingCodeGenerator(pkgPath, structName string, forClientGen bool) *MarshallingCodeGenerator {
+	return &MarshallingCodeGenerator{
+		pkgPath:             pkgPath,
+		structName:          structName,
+		builtins:            nil,
+		seenBuiltins:        make(map[methodKey]methodDescription),
+		encoreTypesAsString: forClientGen,
+	}
+}
+
+// NewPossibleInstance Creates a statement to initialise a new encoding instance.
+//
+// Use the returned wrapper to convert FromStrings to the target types, adding any code you
+// are generating to the wrapper using Add. Once you've finished generating all the code which
+// may need type conversion with that _instance_ of the deserializer, call Finalize to generate the code full code
+// including error handling.
+//
+// Once you've finished writing the whole app with all the code which uses this generator call WriteToFile to write
+// the supporting struct and methods to the given file
+func (g *MarshallingCodeGenerator) NewPossibleInstance(instanceName string) *MarshallingCodeWrapper {
+	g.used = true
+	return &MarshallingCodeWrapper{
+		g:            g,
+		instanceName: instanceName,
+	}
+}
+
+// GenerateAll causes the generator to generate all possible methods.
+func (g *MarshallingCodeGenerator) GenerateAll() {
+	for _, val := range schema.Builtin_value {
+		b := schema.Builtin(val)
+		_, _ = g.builtinToString(b, true)
+		_, _ = g.builtinToString(b, false)
+		_, _ = g.builtinFromString(b, true)
+		_, _ = g.builtinFromString(b, false)
+	}
+	g.usedBody = true
+	g.usedJson = true
+}
+
+// WriteToFile writes the full encoder type into the given file.
+func (g *MarshallingCodeGenerator) WriteToFile(f *File) {
+	if !g.used || (len(g.builtins) == 0 && !g.usedBody && !g.usedJson) {
+		return
+	}
+
+	f.Commentf("%s is used to serialize request data into strings and deserialize response data from strings", g.structName)
+	f.Type().Id(g.structName).Struct(
+		Id(lastErrorField).Error().Comment("The last error that occurred"),
+		Id(nonEmptyValuesField).Int().Comment("The number of values this decoder has decoded"),
+	)
+
+	for _, desc := range g.builtins {
+		var params []Code
+		if desc.FromString {
+			params = []Code{Id("field").String(), Id("s").Add(desc.Input), Id("required").Bool()}
+		} else {
+			params = []Code{Id("s").Add(desc.Input)}
+		}
+
+		f.Func().Params(
+			Id("e").Op("*").Id(g.structName),
+		).Id(desc.Method).Params(params...).Params(Id("v").Add(desc.Result)).BlockFunc(func(g *Group) {
+			if desc.FromString {
+				// If we're dealing with a list of strings, we need to compare with len(s) == 0 instead of s == ""
+				if desc.IsList {
+					g.If(Op("!").Id("required").Op("&&").Len(Id("s")).Op("==").Lit(0)).Block(Return())
+				} else {
+					g.If(Op("!").Id("required").Op("&&").Id("s").Op("==").Lit("")).Block(Return())
+				}
+			}
+			g.Id("e").Dot(nonEmptyValuesField).Op("++")
+			for _, s := range desc.Block {
+				g.Add(s)
+			}
+		})
+		f.Line()
+	}
+
+	f.Comment("setErr sets the last error within the object if one is not already set")
+	f.Func().Params(Id("e").Op("*").Id(g.structName)).Id("setErr").Params(List(Id("msg"), Id("field")).String(), Err().Error()).Block(
+		If(Err().Op("!=").Nil().Op("&&").Id("e").Dot(lastErrorField).Op("==").Nil()).Block(
+			Id("e").Dot(lastErrorField).Op("=").Qual("fmt", "Errorf").Call(
+				Lit("%s: %s: %w"),
+				Id("field"),
+				Id("msg"),
+				Id("err"),
+			),
+		),
+	)
+	f.Line()
+
+	if g.usedBody {
+		f.Func().Params(Id("d").Op("*").Id(g.structName)).Id("Body").Params(Id("body").Qual("io", "Reader")).Params(Id("payload").Index().Byte()).Block(
+			List(Id("payload"), Err()).Op(":=").Qual("io", "ReadAll").Call(Id("body")),
+			If(Err().Op("==").Nil().Op("&&").Len(Id("payload")).Op("==").Lit(0)).Block(
+				Id("d").Dot("setErr").Call(Lit("missing request body"), Lit("request_body"), Qual("fmt", "Errorf").Call(Lit("missing request body"))),
+			).Else().If(Err().Op("!=").Nil()).Block(
+				Id("d").Dot("setErr").Call(Lit("could not parse request body"), Lit("request_body"), Err()),
+			),
+			Return(Id("payload")),
+		)
+	}
+
+	if g.usedJson {
+		f.Func().Params(Id("d").Op("*").Id(g.structName)).Id("ParseJSON").Params(Id("field").String(), Id("iter").Op("*").Qual("github.com/json-iterator/go", "Iterator"), Id("dst").Interface()).Block(
+			Id("iter").Dot("ReadVal").Call(Id("dst")),
+			Id("d").Dot("setErr").Call(Lit("invalid json parameter"), Id("field"), Id("iter").Dot("Error")),
+		)
+	}
+	f.Line()
+}
+
+func (b *MarshallingCodeGenerator) builtinFromString(t schema.Builtin, slice bool) (string, error) {
+	key := methodKey{builtin: t, slice: slice, fromString: true}
+	if n, ok := b.seenBuiltins[key]; ok {
+		return n.Method, nil
+	} else if slice {
+		k2 := methodKey{builtin: t, fromString: true}
+		if _, err := b.builtinFromString(t, false); err != nil {
+			return "", err
+		}
+		desc := b.seenBuiltins[k2]
+		name := desc.Method + "List"
+		fn := methodDescription{
+			FromString: true,
+			Method:     name,
+			Input:      Index().String(),
+			Result:     Index().Add(desc.Result),
+			IsList:     true,
+			Block: []Code{
+				For(List(Id("_"), Id("x")).Op(":=").Range().Id("s")).Block(
+					Id("v").Op("=").Append(Id("v"), Id("e").Dot(desc.Method).Call(Id("field"), Id("x"), Id("required"))),
+				),
+				Return(Id("v")),
+			},
+		}
+		b.seenBuiltins[key] = fn
+		b.builtins = append(b.builtins, fn)
+		return fn.Method, nil
+	}
+
+	var fn methodDescription
+	switch t {
+	case schema.Builtin_STRING:
+		fn = methodDescription{true, "ToString", String(), String(), false, []Code{Return(Id("s"))}}
+	case schema.Builtin_BYTES:
+		fn = methodDescription{true, "ToBytes", String(), Index().Byte(), false, []Code{
+			List(Id("v"), Err()).Op(":=").Qual("encoding/base64", "URLEncoding").Dot("DecodeString").Call(Id("s")),
+			Id("e").Dot("setErr").Call(Lit("invalid parameter"), Id("field"), Err()),
+			Return(Id("v")),
+		}}
+	case schema.Builtin_BOOL:
+		fn = methodDescription{true, "ToBool", String(), Bool(), false, []Code{
+			List(Id("v"), Err()).Op(":=").Qual("strconv", "ParseBool").Call(Id("s")),
+			Id("e").Dot("setErr").Call(Lit("invalid parameter"), Id("field"), Err()),
+			Return(Id("v")),
+		}}
+	case schema.Builtin_UUID:
+		fn = methodDescription{true, "ToUUID", String(), Qual("encore.dev/types/uuid", "UUID"), false, []Code{
+			List(Id("v"), Err()).Op(":=").Qual("encore.dev/types/uuid", "FromString").Call(Id("s")),
+			Id("e").Dot("setErr").Call(Lit("invalid parameter"), Id("field"), Err()),
+			Return(Id("v")),
+		}}
+	case schema.Builtin_TIME:
+		fn = methodDescription{true, "ToTime", String(), Qual("time", "Time"), false, []Code{
+			List(Id("v"), Err()).Op(":=").Qual("time", "Parse").Call(Qual("time", "RFC3339"), Id("s")),
+			Id("e").Dot("setErr").Call(Lit("invalid parameter"), Id("field"), Err()),
+			Return(Id("v")),
+		}}
+	case schema.Builtin_USER_ID:
+		fn = methodDescription{true, "ToUserID", String(), Qual("encore.dev/beta/auth", "UID"), false, []Code{
+			Return(Qual("encore.dev/beta/auth", "UID").Call(Id("s"))),
+		}}
+	case schema.Builtin_JSON:
+		fn = methodDescription{true, "ToJSON", String(), Qual("encoding/json", "RawMessage"), false, []Code{
+			Return(Qual("encoding/json", "RawMessage").Call(Id("s"))),
+		}}
+	default:
+		type kind int
+		const (
+			unsigned kind = iota + 1
+			signed
+			float
+		)
+		numTypes := map[schema.Builtin]struct {
+			typ  string
+			kind kind
+			bits int
+		}{
+			schema.Builtin_INT8:    {"int8", signed, 8},
+			schema.Builtin_INT16:   {"int16", signed, 16},
+			schema.Builtin_INT32:   {"int32", signed, 32},
+			schema.Builtin_INT64:   {"int64", signed, 64},
+			schema.Builtin_INT:     {"int", signed, 64},
+			schema.Builtin_UINT8:   {"uint8", unsigned, 8},
+			schema.Builtin_UINT16:  {"uint16", unsigned, 16},
+			schema.Builtin_UINT32:  {"uint32", unsigned, 32},
+			schema.Builtin_UINT64:  {"uint64", unsigned, 64},
+			schema.Builtin_UINT:    {"uint", unsigned, 64},
+			schema.Builtin_FLOAT64: {"float64", float, 64},
+			schema.Builtin_FLOAT32: {"float32", float, 32},
+		}
+
+		def, ok := numTypes[t]
+		if !ok {
+			return "", errors.Newf("unsupported type: %s", t)
+		}
+
+		cast := def.typ != "int64" && def.typ != "uint64" && def.typ != "float64"
+		var err error
+		fn = methodDescription{true, "To" + strings.Title(def.typ), String(), Id(def.typ), false, []Code{
+			List(Id("x"), Err()).Op(":=").Do(func(s *Statement) {
+				switch def.kind {
+				case unsigned:
+					s.Qual("strconv", "ParseUint").Call(Id("s"), Lit(10), Lit(def.bits))
+				case signed:
+					s.Qual("strconv", "ParseInt").Call(Id("s"), Lit(10), Lit(def.bits))
+				case float:
+					s.Qual("strconv", "ParseFloat").Call(Id("s"), Lit(def.bits))
+				default:
+					err = errors.Newf("unknown kind %v", def.kind)
+				}
+			}),
+			Id("e").Dot("setErr").Call(Lit("invalid parameter"), Id("field"), Err()),
+			ReturnFunc(func(g *Group) {
+				if cast {
+					g.Id(def.typ).Call(Id("x"))
+				} else {
+					g.Id("x")
+				}
+			}),
+		}}
+		if err != nil {
+			return "", err
+		}
+	}
+
+	b.seenBuiltins[key] = fn
+	b.builtins = append(b.builtins, fn)
+	return fn.Method, nil
+}
+
+func (b *MarshallingCodeGenerator) builtinToString(t schema.Builtin, slice bool) (string, error) {
+	key := methodKey{builtin: t, slice: slice, fromString: false}
+	if fn, ok := b.seenBuiltins[key]; ok {
+		return fn.Method, nil
+	}
+
+	if slice {
+		k2 := methodKey{builtin: t, fromString: false}
+		if _, err := b.builtinToString(t, false); err != nil {
+			return "", err
+		}
+		desc := b.seenBuiltins[k2]
+		name := desc.Method + "List"
+		fn := methodDescription{
+			FromString: false,
+			Method:     name,
+			Input:      Index().Add(desc.Input),
+			Result:     Index().String(),
+			IsList:     true,
+			Block: []Code{
+				For(List(Id("_"), Id("x")).Op(":=").Range().Id("s")).Block(
+					Id("v").Op("=").Append(Id("v"), Id("e").Dot(desc.Method).Call(Id("x"))),
+				),
+				Return(Id("v")),
+			},
+		}
+		b.seenBuiltins[key] = fn
+		b.builtins = append(b.builtins, fn)
+		return fn.Method, nil
+	}
+
+	var fn methodDescription
+	switch t {
+	case schema.Builtin_STRING:
+		fn = methodDescription{false, "FromString", String(), String(), false, []Code{Return(Id("s"))}}
+	case schema.Builtin_BYTES:
+		fn = methodDescription{false, "FromBytes", Index().Byte(), String(), false, []Code{
+			Return(Qual("encoding/base64", "URLEncoding").Dot("EncodeToString").Call(Id("s"))),
+		}}
+	case schema.Builtin_BOOL:
+		fn = methodDescription{false, "FromBool", Bool(), String(), false, []Code{
+			Return(Qual("strconv", "FormatBool").Call(Id("s"))),
+		}}
+	case schema.Builtin_UUID:
+		fn = methodDescription{false, "FromUUID", Qual("encore.dev/types/uuid", "UUID"), String(), false, []Code{
+			Return(Id("s").Dot("String").Call()),
+		}}
+	case schema.Builtin_TIME:
+		fn = methodDescription{false, "FromTime", Qual("time", "Time"), String(), false, []Code{
+			Return(Id("s").Dot("Format").Call(Qual("time", "RFC3339"))),
+		}}
+	case schema.Builtin_USER_ID:
+		fn = methodDescription{false, "FromUserID", Qual("encore.dev/beta/auth", "UID"), String(), false, []Code{
+			Return(String().Call(Id("s"))),
+		}}
+	case schema.Builtin_JSON:
+		fn = methodDescription{false, "FromJSON", Qual("encoding/json", "RawMessage"), String(), false, []Code{
+			Return(String().Call(Id("s"))),
+		}}
+	default:
+		type kind int
+		const (
+			unsigned kind = iota + 1
+			signed
+			float
+		)
+		numTypes := map[schema.Builtin]struct {
+			typ     string
+			castTyp string
+			kind    kind
+			bits    int
+		}{
+			schema.Builtin_INT8:    {"int8", "int64", signed, 8},
+			schema.Builtin_INT16:   {"int16", "int64", signed, 16},
+			schema.Builtin_INT32:   {"int32", "int64", signed, 32},
+			schema.Builtin_INT64:   {"int64", "int64", signed, 64},
+			schema.Builtin_INT:     {"int", "int64", signed, 64},
+			schema.Builtin_UINT8:   {"uint8", "uint64", unsigned, 8},
+			schema.Builtin_UINT16:  {"uint16", "uint64", unsigned, 16},
+			schema.Builtin_UINT32:  {"uint32", "uint64", unsigned, 32},
+			schema.Builtin_UINT64:  {"uint64", "uint64", unsigned, 64},
+			schema.Builtin_UINT:    {"uint", "uint64", unsigned, 64},
+			schema.Builtin_FLOAT64: {"float64", "float64", float, 64},
+			schema.Builtin_FLOAT32: {"float32", "float64", float, 32},
+		}
+
+		def, ok := numTypes[t]
+		if !ok {
+			return "", errors.Newf("unsupported type: %s", t)
+		}
+
+		var err error
+		fn = methodDescription{false, "From" + strings.Title(def.typ), Id(def.typ), String(), false, []Code{
+			Return(Do(func(s *Statement) {
+				id := Id("s")
+				if def.typ != def.castTyp {
+					id = Id(def.castTyp).Call(id)
+				}
+
+				switch def.kind {
+				case unsigned:
+					s.Qual("strconv", "FormatUint").Call(id, Lit(10))
+				case signed:
+					s.Qual("strconv", "FormatInt").Call(id, Lit(10))
+				case float:
+					s.Qual("strconv", "FormatFloat").Call(id, Lit(byte('f')), Lit(-1), Lit(def.bits))
+				default:
+					err = errors.Newf("unknown kind %v", def.kind)
+				}
+			})),
+		}}
+		if err != nil {
+			return "", err
+		}
+	}
+
+	b.seenBuiltins[key] = fn
+	b.builtins = append(b.builtins, fn)
+	return fn.Method, nil
+}
+
+func (w *MarshallingCodeWrapper) WithFunc(body func(*Group), errBlock func(*Group)) []Code {
+	o := Options{Separator: "\n", Multi: true}
+	bodyStatement := CustomFunc(o, body)
+	errStatement := CustomFunc(o, errBlock)
+
+	w.Add(bodyStatement)
+	return w.Finalize(errStatement)
+}
+
+func (w *MarshallingCodeWrapper) LastError() Code {
+	return Id(w.instanceName).Dot(lastErrorField)
+}
+
+// Add adds code into the wrapped block
+func (w *MarshallingCodeWrapper) Add(c ...Code) {
+	w.code = append(w.code, c...)
+}
+
+// EndBlock adds custom logic after the error block
+func (w *MarshallingCodeWrapper) EndBlock(endBlock ...Code) {
+	w.endBlock = endBlock
+}
+
+// Finalize returns the final code block including all wrapped code
+func (w *MarshallingCodeWrapper) Finalize(ifErrorBlock ...Code) []Code {
+	if !w.used {
+		return w.code
+	}
+
+	// If we know the package path, refer to the decoder with a qualified name.
+	var structRef *Statement
+	if w.g.pkgPath != UnknownPkgPath {
+		structRef = Qual(w.g.pkgPath, w.g.structName)
+	} else {
+		structRef = Id(w.g.structName)
+	}
+
+	code := []Code{Id(w.instanceName).Op(":=").Op("&").Add(structRef).Values(), Line()}
+	code = append(code, w.code...)
+	code = append(code, Line().If(Id(w.instanceName).Dot(lastErrorField).Op("!=").Nil()).Block(ifErrorBlock...))
+	code = append(code, Line())
+	code = append(code, w.endBlock...)
+	return code
+}
+
+func (g *MarshallingCodeGenerator) shouldBeTreatedAsString(builtin schema.Builtin) bool {
+	return builtin == schema.Builtin_STRING || builtin == schema.Builtin_DECIMAL ||
+		(g.encoreTypesAsString && builtin == schema.Builtin_UUID) ||
+		(g.encoreTypesAsString && builtin == schema.Builtin_USER_ID)
+}
+
+func (w *MarshallingCodeWrapper) Body(getBody Code) Code {
+	w.used = true
+	w.g.usedBody = true
+	return Id(w.instanceName).Dot("Body").Call(getBody)
+}
+
+// FromStringToBuiltin will return either the original string or a call to the encoder
+func (w *MarshallingCodeWrapper) FromStringToBuiltin(builtin schema.Builtin, fieldName string, getAsString Code, required bool) (code Code, err error) {
+	// get the method name for the target type
+	funcName := ""
+	srcCode := getAsString
+
+	// If the list is strings, we can just return the value
+	if builtin == schema.Builtin_STRING && !required {
+		return getAsString, nil
+	}
+
+	funcName, err = w.g.builtinFromString(builtin, false)
+	if err != nil {
+		return nil, err
+	}
+
+	// mark this code wrapper as actually using the deserializer type
+	w.used = true
+	return Id(w.instanceName).Dot(funcName).Call(Lit(fieldName), srcCode, Lit(required)), nil
+}
+
+func (w *MarshallingCodeWrapper) FromJSON(targetType *schema.Type, fieldName string, iterName string, dst Code) (code Code, err error) {
+	// TODO: Call readers for specific types once we've added Pointer Type support
+	w.used = true
+	w.g.usedJson = true
+	return Id(w.instanceName).Dot("ParseJSON").Call(Lit(fieldName), Id(iterName), Op("&").Add(dst)), nil
+}
+
+// FromString will return a call to a decoder method
+func (w *MarshallingCodeWrapper) FromString(targetType *schema.Type, fieldName string, getAsString Code, getAsStringSlice Code, required bool) (code Code, err error) {
+	// get the method name for the target type
+	funcName := ""
+	srcCode := getAsString
+	switch t := targetType.Typ.(type) {
+	case *schema.Type_List:
+		if bt, ok := t.List.Elem.Typ.(*schema.Type_Builtin); ok {
+			// If the list is uuids or userids, treat it as string
+			builtin := bt.Builtin
+			if w.g.shouldBeTreatedAsString(bt.Builtin) {
+				builtin = schema.Builtin_STRING
+			}
+
+			funcName, err = w.g.builtinFromString(builtin, true)
+			srcCode = getAsStringSlice
+			if err != nil {
+				return nil, err
+			}
+		} else {
+			return nil, errors.Newf("unsupported list type %T", t.List.Elem.Typ)
+		}
+	case *schema.Type_Builtin:
+		// If it's uuid, userid then treat it as string
+		builtin := t.Builtin
+		if w.g.shouldBeTreatedAsString(t.Builtin) {
+			builtin = schema.Builtin_STRING
+		}
+
+		funcName, err = w.g.builtinFromString(builtin, false)
+		if err != nil {
+			return nil, err
+		}
+	default:
+		return nil, errors.Newf("unsupported type for deserialization: %T", t)
+	}
+
+	// mark this code wrapper as actually using the deserializer type
+	w.used = true
+	return Id(w.instanceName).Dot(funcName).Call(Lit(fieldName), srcCode, Lit(required)), nil
+}
+
+// ToStringSlice will return either the original string or a call to the encoder
+func (w *MarshallingCodeWrapper) ToStringSlice(sourceType *schema.Type, sourceValue Code) (code Code, err error) {
+	// get the method name for the target type
+	funcName := ""
+	switch t := sourceType.Typ.(type) {
+	case *schema.Type_List:
+		if bt, ok := t.List.Elem.Typ.(*schema.Type_Builtin); ok {
+			builtin := bt.Builtin
+			if w.g.shouldBeTreatedAsString(bt.Builtin) {
+				builtin = schema.Builtin_STRING
+			}
+
+			funcName, err = w.g.builtinToString(builtin, true)
+			if err != nil {
+				return nil, err
+			}
+
+			w.used = true
+			return Id(w.instanceName).Dot(funcName).Call(sourceValue), nil
+		} else {
+			return nil, errors.Newf("unsupported list type %T", t.List.Elem.Typ)
+		}
+	case *schema.Type_Builtin:
+		builtin := t.Builtin
+		if w.g.shouldBeTreatedAsString(t.Builtin) {
+			builtin = schema.Builtin_STRING
+		}
+
+		funcName, err = w.g.builtinToString(builtin, false)
+		if err != nil {
+			return nil, err
+		}
+
+		w.used = true
+		return Values(Id(w.instanceName).Dot(funcName).Call(sourceValue)), nil
+	default:
+		return nil, errors.Newf("unsupported type for deserialization: %T", t)
+	}
+}
+
+// ToString will return either the original string or a call to the encoder
+func (w *MarshallingCodeWrapper) ToString(sourceType *schema.Type, sourceValue Code) (code Code, err error) {
+	// get the method name for the target type
+	funcName := ""
+	switch t := sourceType.Typ.(type) {
+	case *schema.Type_Builtin:
+		builtin := t.Builtin
+		if w.g.shouldBeTreatedAsString(t.Builtin) {
+			builtin = schema.Builtin_STRING
+		}
+
+		funcName, err = w.g.builtinToString(builtin, false)
+		if err != nil {
+			return nil, err
+		}
+
+		w.used = true
+		return Id(w.instanceName).Dot(funcName).Call(sourceValue), nil
+	default:
+		return nil, errors.Newf("unsupported type for serialization: %T", t)
+	}
+}
diff --git a/internal/gocodegen/package.go b/internal/gocodegen/package.go
new file mode 100644
index 0000000000..acc17d7cec
--- /dev/null
+++ b/internal/gocodegen/package.go
@@ -0,0 +1,3 @@
+// Package gocodegen contains shared code used for generating Go code by both the
+// compilers code generator, and the CLI's client generator.
+package gocodegen
diff --git a/internal/goldfish/goldfish.go b/internal/goldfish/goldfish.go
new file mode 100644
index 0000000000..a54f4a26aa
--- /dev/null
+++ b/internal/goldfish/goldfish.go
@@ -0,0 +1,46 @@
+// Package goldfish provides a short-term cache of values.
+package goldfish
+
+import (
+	"sync"
+	"time"
+)
+
+type Cache[V any] struct {
+	keepalive time.Duration
+	fn        func() (V, error)
+	mu        sync.Mutex
+	last      time.Time
+	val       V
+}
+
+func New[V any](keepalive time.Duration, fn func() (V, error)) *Cache[V] {
+	return &Cache[V]{
+		keepalive: keepalive,
+		fn:        fn,
+	}
+}
+
+func (c *Cache[V]) Get() (V, error) {
+	now := time.Now()
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if now.Sub(c.last) < c.keepalive {
+		return c.val, nil
+	}
+
+	// Cache is out of date, re-fetch
+	val, err := c.fn()
+	if err == nil {
+		c.val, c.last = val, now
+	}
+	return c.val, err
+}
+
+func (c *Cache[V]) Set(val V) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.val = val
+	c.last = time.Now()
+}
diff --git a/internal/httpcache/LICENSE.txt b/internal/httpcache/LICENSE.txt
new file mode 100644
index 0000000000..81316beb0c
--- /dev/null
+++ b/internal/httpcache/LICENSE.txt
@@ -0,0 +1,7 @@
+Copyright © 2012 Greg Jones (greg.jones@gmail.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
\ No newline at end of file
diff --git a/internal/httpcache/README.md b/internal/httpcache/README.md
new file mode 100644
index 0000000000..2cb9040a37
--- /dev/null
+++ b/internal/httpcache/README.md
@@ -0,0 +1,29 @@
+httpcache
+=========
+
+[![Build Status](https://travis-ci.org/gregjones/httpcache.svg?branch=master)](https://travis-ci.org/gregjones/httpcache) [![GoDoc](https://godoc.org/github.com/gregjones/httpcache?status.svg)](https://godoc.org/github.com/gregjones/httpcache)
+
+Package httpcache provides a http.RoundTripper implementation that works as a mostly [RFC 7234](https://tools.ietf.org/html/rfc7234) compliant cache for http responses.
+
+It is only suitable for use as a 'private' cache (i.e. for a web-browser or an API-client and not for a shared proxy).
+
+This project isn't actively maintained; it works for what I, and seemingly others, want to do with it, and I consider it "done". That said, if you find any issues, please open a Pull Request and I will try to review it. Any changes now that change the public API won't be considered.
+
+Cache Backends
+--------------
+
+- The built-in 'memory' cache stores responses in an in-memory map.
+- [`github.com/gregjones/httpcache/diskcache`](https://github.com/gregjones/httpcache/tree/master/diskcache) provides a filesystem-backed cache using the [diskv](https://github.com/peterbourgon/diskv) library.
+- [`github.com/gregjones/httpcache/memcache`](https://github.com/gregjones/httpcache/tree/master/memcache) provides memcache implementations, for both App Engine and 'normal' memcache servers.
+- [`sourcegraph.com/sourcegraph/s3cache`](https://sourcegraph.com/github.com/sourcegraph/s3cache) uses Amazon S3 for storage.
+- [`github.com/gregjones/httpcache/leveldbcache`](https://github.com/gregjones/httpcache/tree/master/leveldbcache) provides a filesystem-backed cache using [leveldb](https://github.com/syndtr/goleveldb/tree/master/leveldb).
+- [`github.com/die-net/lrucache`](https://github.com/die-net/lrucache) provides an in-memory cache that will evict least-recently used entries.
+- [`github.com/die-net/lrucache/twotier`](https://github.com/die-net/lrucache/tree/master/twotier) allows caches to be combined, for example to use lrucache above with a persistent disk-cache.
+- [`github.com/birkelund/boltdbcache`](https://github.com/birkelund/boltdbcache) provides a BoltDB implementation (based on the [bbolt](https://github.com/coreos/bbolt) fork).
+
+If you implement any other backend and wish it to be linked here, please send a PR editing this file.
+
+License
+-------
+
+-	[MIT License](LICENSE.txt)
diff --git a/internal/httpcache/diskcache/diskcache.go b/internal/httpcache/diskcache/diskcache.go
new file mode 100644
index 0000000000..42e3129d82
--- /dev/null
+++ b/internal/httpcache/diskcache/diskcache.go
@@ -0,0 +1,61 @@
+// Package diskcache provides an implementation of httpcache.Cache that uses the diskv package
+// to supplement an in-memory map with persistent storage
+//
+package diskcache
+
+import (
+	"bytes"
+	"crypto/md5"
+	"encoding/hex"
+	"github.com/peterbourgon/diskv"
+	"io"
+)
+
+// Cache is an implementation of httpcache.Cache that supplements the in-memory map with persistent storage
+type Cache struct {
+	d *diskv.Diskv
+}
+
+// Get returns the response corresponding to key if present
+func (c *Cache) Get(key string) (resp []byte, ok bool) {
+	key = keyToFilename(key)
+	resp, err := c.d.Read(key)
+	if err != nil {
+		return []byte{}, false
+	}
+	return resp, true
+}
+
+// Set saves a response to the cache as key
+func (c *Cache) Set(key string, resp []byte) {
+	key = keyToFilename(key)
+	c.d.WriteStream(key, bytes.NewReader(resp), true)
+}
+
+// Delete removes the response with key from the cache
+func (c *Cache) Delete(key string) {
+	key = keyToFilename(key)
+	c.d.Erase(key)
+}
+
+func keyToFilename(key string) string {
+	h := md5.New()
+	io.WriteString(h, key)
+	return hex.EncodeToString(h.Sum(nil))
+}
+
+// New returns a new Cache that will store files in basePath
+func New(basePath string) *Cache {
+	return &Cache{
+		d: diskv.New(diskv.Options{
+			BasePath:     basePath,
+			CacheSizeMax: 100 * 1024 * 1024, // 100MB
+		}),
+	}
+}
+
+// NewWithDiskv returns a new Cache using the provided Diskv as underlying
+// storage.
+func NewWithDiskv(d *diskv.Diskv) *Cache {
+	return &Cache{d}
+}
diff --git a/internal/httpcache/diskcache/diskcache_test.go b/internal/httpcache/diskcache/diskcache_test.go
new file mode 100644
index 0000000000..30fc4cc57d
--- /dev/null
+++ b/internal/httpcache/diskcache/diskcache_test.go
@@ -0,0 +1,19 @@
+package diskcache
+
+import (
+	"io/ioutil"
+	"os"
+	"testing"
+
+	"encr.dev/internal/httpcache/test"
+)
+
+func TestDiskCache(t *testing.T) {
+	tempDir, err := ioutil.TempDir("", "httpcache")
+	if err != nil {
+		t.Fatalf("TempDir: %v", err)
+	}
+	defer os.RemoveAll(tempDir)
+
+	test.Cache(t, New(tempDir))
+}
diff --git a/internal/httpcache/httpcache.go b/internal/httpcache/httpcache.go
new file mode 100644
index 0000000000..74bf038222
--- /dev/null
+++ b/internal/httpcache/httpcache.go
@@ -0,0 +1,550 @@
+// Package httpcache provides a http.RoundTripper implementation that works as a
+// mostly RFC-compliant cache for http responses.
+//
+// It is only suitable for use as a 'private' cache (i.e. for a web-browser or an API-client
+// and not for a shared proxy).
+package httpcache
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"net/http/httputil"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	stale = iota
+	fresh
+	transparent
+	// XFromCache is the header added to responses that are returned from the cache
+	XFromCache = "X-From-Cache"
+)
+
+// A Cache interface is used by the Transport to store and retrieve responses.
+type Cache interface {
+	// Get returns the []byte representation of a cached response and a bool
+	// set to true if the value isn't empty
+	Get(key string) (responseBytes []byte, ok bool)
+	// Set stores the []byte representation of a response against a key
+	Set(key string, responseBytes []byte)
+	// Delete removes the value associated with the key
+	Delete(key string)
+}
+
+// cacheKey returns the cache key for req.
+func cacheKey(req *http.Request) string {
+	if req.Method == http.MethodGet {
+		return req.URL.String()
+	} else {
+		return req.Method + " " + req.URL.String()
+	}
+}
+
+// CachedResponse returns the cached http.Response for req if present, and nil
+// otherwise.
+func CachedResponse(c Cache, req *http.Request) (resp *http.Response, err error) {
+	cachedVal, ok := c.Get(cacheKey(req))
+	if !ok {
+		return
+	}
+
+	b := bytes.NewBuffer(cachedVal)
+	return http.ReadResponse(bufio.NewReader(b), req)
+}
+
+// MemoryCache is an implemtation of Cache that stores responses in an in-memory map.
+type MemoryCache struct {
+	mu    sync.RWMutex
+	items map[string][]byte
+}
+
+// Get returns the []byte representation of the response and true if present, false if not
+func (c *MemoryCache) Get(key string) (resp []byte, ok bool) {
+	c.mu.RLock()
+	resp, ok = c.items[key]
+	c.mu.RUnlock()
+	return resp, ok
+}
+
+// Set saves response resp to the cache with key
+func (c *MemoryCache) Set(key string, resp []byte) {
+	c.mu.Lock()
+	c.items[key] = resp
+	c.mu.Unlock()
+}
+
+// Delete removes key from the cache
+func (c *MemoryCache) Delete(key string) {
+	c.mu.Lock()
+	delete(c.items, key)
+	c.mu.Unlock()
+}
+
+// NewMemoryCache returns a new Cache that will store items in an in-memory map
+func NewMemoryCache() *MemoryCache {
+	c := &MemoryCache{items: map[string][]byte{}}
+	return c
+}
+
+// Transport is an implementation of http.RoundTripper that will return values from a cache
+// where possible (avoiding a network request) and will additionally add validators (etag/if-modified-since)
+// to repeated requests allowing servers to return 304 / Not Modified
+type Transport struct {
+	// The RoundTripper interface actually used to make requests
+	// If nil, http.DefaultTransport is used
+	Transport http.RoundTripper
+	Cache     Cache
+	// If true, responses returned from the cache will be given an extra header, X-From-Cache
+	MarkCachedResponses bool
+}
+
+// NewTransport returns a new Transport with the
+// provided Cache implementation and MarkCachedResponses set to true
+func NewTransport(c Cache) *Transport {
+	return &Transport{Cache: c, MarkCachedResponses: true}
+}
+
+// Client returns an *http.Client that caches responses.
+func (t *Transport) Client() *http.Client {
+	return &http.Client{Transport: t}
+}
+
+// varyMatches will return false unless all of the cached values for the headers listed in Vary
+// match the new request
+func varyMatches(cachedResp *http.Response, req *http.Request) bool {
+	for _, header := range headerAllCommaSepValues(cachedResp.Header, "vary") {
+		header = http.CanonicalHeaderKey(header)
+		if header != "" && req.Header.Get(header) != cachedResp.Header.Get("X-Varied-"+header) {
+			return false
+		}
+	}
+	return true
+}
+
+// RoundTrip takes a Request and returns a Response
+//
+// If there is a fresh Response already in cache, then it will be returned without connecting to
+// the server.
+//
+// If there is a stale Response, then any validators it contains will be set on the new request
+// to give the server a chance to respond with NotModified. If this happens, then the cached Response
+// will be returned.
+func (t *Transport) RoundTrip(req *http.Request) (resp *http.Response, err error) {
+	cacheKey := cacheKey(req)
+	cacheable := (req.Method == "GET" || req.Method == "HEAD") && req.Header.Get("range") == ""
+	var cachedResp *http.Response
+	if cacheable {
+		cachedResp, err = CachedResponse(t.Cache, req)
+	} else {
+		// Need to invalidate an existing value
+		t.Cache.Delete(cacheKey)
+	}
+
+	transport := t.Transport
+	if transport == nil {
+		transport = http.DefaultTransport
+	}
+
+	if cacheable && cachedResp != nil && err == nil {
+		if t.MarkCachedResponses {
+			cachedResp.Header.Set(XFromCache, "1")
+		}
+
+		if varyMatches(cachedResp, req) {
+			// Can only use cached value if the new request doesn't Vary significantly
+			freshness := getFreshness(cachedResp.Header, req.Header)
+			if freshness == fresh {
+				return cachedResp, nil
+			}
+
+			if freshness == stale {
+				var req2 *http.Request
+				// Add validators if caller hasn't already done so
+				etag := cachedResp.Header.Get("etag")
+				if etag != "" && req.Header.Get("etag") == "" {
+					req2 = cloneRequest(req)
+					req2.Header.Set("if-none-match", etag)
+				}
+				lastModified := cachedResp.Header.Get("last-modified")
+				if lastModified != "" && req.Header.Get("last-modified") == "" {
+					if req2 == nil {
+						req2 = cloneRequest(req)
+					}
+					req2.Header.Set("if-modified-since", lastModified)
+				}
+				if req2 != nil {
+					req = req2
+				}
+			}
+		}
+
+		resp, err = transport.RoundTrip(req)
+		if err == nil && req.Method == "GET" && resp.StatusCode == http.StatusNotModified {
+			// Replace the 304 response with the one from cache, but update with some new headers
+			endToEndHeaders := getEndToEndHeaders(resp.Header)
+			for _, header := range endToEndHeaders {
+				cachedResp.Header[header] = resp.Header[header]
+			}
+			resp = cachedResp
+		} else if (err != nil || (cachedResp != nil && resp.StatusCode >= 500)) &&
+			req.Method == "GET" && canStaleOnError(cachedResp.Header, req.Header) {
+			// In case of transport failure and stale-if-error activated, returns cached content
+			// when available
+			return cachedResp, nil
+		} else {
+			if err != nil || resp.StatusCode != http.StatusOK {
+				t.Cache.Delete(cacheKey)
+			}
+			if err != nil {
+				return nil, err
+			}
+		}
+	} else {
+		reqCacheControl := parseCacheControl(req.Header)
+		if _, ok := reqCacheControl["only-if-cached"]; ok {
+			resp = newGatewayTimeoutResponse(req)
+		} else {
+			resp, err = transport.RoundTrip(req)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	if cacheable && canStore(parseCacheControl(req.Header), parseCacheControl(resp.Header)) {
+		for _, varyKey := range headerAllCommaSepValues(resp.Header, "vary") {
+			varyKey = http.CanonicalHeaderKey(varyKey)
+			fakeHeader := "X-Varied-" + varyKey
+			reqValue := req.Header.Get(varyKey)
+			if reqValue != "" {
+				resp.Header.Set(fakeHeader, reqValue)
+			}
+		}
+		switch req.Method {
+		case "GET":
+			// Delay caching until EOF is reached.
+			resp.Body = &cachingReadCloser{
+				R: resp.Body,
+				OnEOF: func(r io.Reader) {
+					resp := *resp
+					resp.Body = ioutil.NopCloser(r)
+					respBytes, err := httputil.DumpResponse(&resp, true)
+					if err == nil {
+						t.Cache.Set(cacheKey, respBytes)
+					}
+				},
+			}
+		default:
+			respBytes, err := httputil.DumpResponse(resp, true)
+			if err == nil {
+				t.Cache.Set(cacheKey, respBytes)
+			}
+		}
+	} else {
+		t.Cache.Delete(cacheKey)
+	}
+	return resp, nil
+}
+
+// ErrNoDateHeader indicates that the HTTP headers contained no Date header.
+var ErrNoDateHeader = errors.New("no Date header")
+
+// Date parses and returns the value of the Date header.
+func Date(respHeaders http.Header) (date time.Time, err error) {
+	dateHeader := respHeaders.Get("date")
+	if dateHeader == "" {
+		err = ErrNoDateHeader
+		return
+	}
+
+	return time.Parse(time.RFC1123, dateHeader)
+}
+
+type realClock struct{}
+
+func (c *realClock) since(d time.Time) time.Duration {
+	return time.Since(d)
+}
+
+type timer interface {
+	since(d time.Time) time.Duration
+}
+
+var clock timer = &realClock{}
+
+// getFreshness will return one of fresh/stale/transparent based on the cache-control
+// values of the request and the response
+//
+// fresh indicates the response can be returned
+// stale indicates that the response needs validating before it is returned
+// transparent indicates the response should not be used to fulfil the request
+//
+// Because this is only a private cache, 'public' and 'private' in cache-control aren't
+// signficant. Similarly, smax-age isn't used.
+func getFreshness(respHeaders, reqHeaders http.Header) (freshness int) {
+	respCacheControl := parseCacheControl(respHeaders)
+	reqCacheControl := parseCacheControl(reqHeaders)
+	if _, ok := reqCacheControl["no-cache"]; ok {
+		return transparent
+	}
+	if _, ok := respCacheControl["no-cache"]; ok {
+		return stale
+	}
+	if _, ok := reqCacheControl["only-if-cached"]; ok {
+		return fresh
+	}
+
+	date, err := Date(respHeaders)
+	if err != nil {
+		return stale
+	}
+	currentAge := clock.since(date)
+
+	var lifetime time.Duration
+	var zeroDuration time.Duration
+
+	// If a response includes both an Expires header and a max-age directive,
+	// the max-age directive overrides the Expires header, even if the Expires header is more restrictive.
+	if maxAge, ok := respCacheControl["max-age"]; ok {
+		lifetime, err = time.ParseDuration(maxAge + "s")
+		if err != nil {
+			lifetime = zeroDuration
+		}
+	} else {
+		expiresHeader := respHeaders.Get("Expires")
+		if expiresHeader != "" {
+			expires, err := time.Parse(time.RFC1123, expiresHeader)
+			if err != nil {
+				lifetime = zeroDuration
+			} else {
+				lifetime = expires.Sub(date)
+			}
+		}
+	}
+
+	if maxAge, ok := reqCacheControl["max-age"]; ok {
+		// the client is willing to accept a response whose age is no greater than the specified time in seconds
+		lifetime, err = time.ParseDuration(maxAge + "s")
+		if err != nil {
+			lifetime = zeroDuration
+		}
+	}
+	if minfresh, ok := reqCacheControl["min-fresh"]; ok {
+		//  the client wants a response that will still be fresh for at least the specified number of seconds.
+		minfreshDuration, err := time.ParseDuration(minfresh + "s")
+		if err == nil {
+			currentAge = time.Duration(currentAge + minfreshDuration)
+		}
+	}
+
+	if maxstale, ok := reqCacheControl["max-stale"]; ok {
+		// Indicates that the client is willing to accept a response that has exceeded its expiration time.
+		// If max-stale is assigned a value, then the client is willing to accept a response that has exceeded
+		// its expiration time by no more than the specified number of seconds.
+		// If no value is assigned to max-stale, then the client is willing to accept a stale response of any age.
+		//
+		// Responses served only because of a max-stale value are supposed to have a Warning header added to them,
+		// but that seems like a  hassle, and is it actually useful? If so, then there needs to be a different
+		// return-value available here.
+		if maxstale == "" {
+			return fresh
+		}
+		maxstaleDuration, err := time.ParseDuration(maxstale + "s")
+		if err == nil {
+			currentAge = time.Duration(currentAge - maxstaleDuration)
+		}
+	}
+
+	if lifetime > currentAge {
+		return fresh
+	}
+
+	return stale
+}
+
+// Returns true if either the request or the response includes the stale-if-error
+// cache control extension: https://tools.ietf.org/html/rfc5861
+func canStaleOnError(respHeaders, reqHeaders http.Header) bool {
+	respCacheControl := parseCacheControl(respHeaders)
+	reqCacheControl := parseCacheControl(reqHeaders)
+
+	var err error
+	lifetime := time.Duration(-1)
+
+	if staleMaxAge, ok := respCacheControl["stale-if-error"]; ok {
+		if staleMaxAge != "" {
+			lifetime, err = time.ParseDuration(staleMaxAge + "s")
+			if err != nil {
+				return false
+			}
+		} else {
+			return true
+		}
+	}
+	if staleMaxAge, ok := reqCacheControl["stale-if-error"]; ok {
+		if staleMaxAge != "" {
+			lifetime, err = time.ParseDuration(staleMaxAge + "s")
+			if err != nil {
+				return false
+			}
+		} else {
+			return true
+		}
+	}
+
+	if lifetime >= 0 {
+		date, err := Date(respHeaders)
+		if err != nil {
+			return false
+		}
+		currentAge := clock.since(date)
+		if lifetime > currentAge {
+			return true
+		}
+	}
+
+	return false
+}
+
+func getEndToEndHeaders(respHeaders http.Header) []string {
+	// These headers are always hop-by-hop
+	hopByHopHeaders := map[string]struct{}{
+		"Connection":          {},
+		"Keep-Alive":          {},
+		"Proxy-Authenticate":  {},
+		"Proxy-Authorization": {},
+		"Te":                  {},
+		"Trailers":            {},
+		"Transfer-Encoding":   {},
+		"Upgrade":             {},
+	}
+
+	for _, extra := range strings.Split(respHeaders.Get("connection"), ",") {
+		// any header listed in connection, if present, is also considered hop-by-hop
+		if strings.Trim(extra, " ") != "" {
+			hopByHopHeaders[http.CanonicalHeaderKey(extra)] = struct{}{}
+		}
+	}
+	endToEndHeaders := []string{}
+	for respHeader := range respHeaders {
+		if _, ok := hopByHopHeaders[respHeader]; !ok {
+			endToEndHeaders = append(endToEndHeaders, respHeader)
+		}
+	}
+	return endToEndHeaders
+}
+
+func canStore(reqCacheControl, respCacheControl cacheControl) (canStore bool) {
+	if _, ok := respCacheControl["no-store"]; ok {
+		return false
+	}
+	if _, ok := reqCacheControl["no-store"]; ok {
+		return false
+	}
+	return true
+}
+
+func newGatewayTimeoutResponse(req *http.Request) *http.Response {
+	var braw bytes.Buffer
+	braw.WriteString("HTTP/1.1 504 Gateway Timeout\r\n\r\n")
+	resp, err := http.ReadResponse(bufio.NewReader(&braw), req)
+	if err != nil {
+		panic(err)
+	}
+	return resp
+}
+
+// cloneRequest returns a clone of the provided *http.Request.
+// The clone is a shallow copy of the struct and its Header map.
+// (This function copyright goauth2 authors: https://code.google.com/p/goauth2)
+func cloneRequest(r *http.Request) *http.Request {
+	// shallow copy of the struct
+	r2 := new(http.Request)
+	*r2 = *r
+	// deep copy of the Header
+	r2.Header = make(http.Header)
+	for k, s := range r.Header {
+		r2.Header[k] = s
+	}
+	return r2
+}
+
+type cacheControl map[string]string
+
+func parseCacheControl(headers http.Header) cacheControl {
+	cc := cacheControl{}
+	ccHeader := headers.Get("Cache-Control")
+	for _, part := range strings.Split(ccHeader, ",") {
+		part = strings.Trim(part, " ")
+		if part == "" {
+			continue
+		}
+		if strings.ContainsRune(part, '=') {
+			keyval := strings.Split(part, "=")
+			cc[strings.Trim(keyval[0], " ")] = strings.Trim(keyval[1], ",")
+		} else {
+			cc[part] = ""
+		}
+	}
+	return cc
+}
+
+// headerAllCommaSepValues returns all comma-separated values (each
+// with whitespace trimmed) for header name in headers. According to
+// Section 4.2 of the HTTP/1.1 spec
+// (http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html#sec4.2),
+// values from multiple occurrences of a header should be concatenated, if
+// the header's value is a comma-separated list.
+func headerAllCommaSepValues(headers http.Header, name string) []string {
+	var vals []string
+	for _, val := range headers[http.CanonicalHeaderKey(name)] {
+		fields := strings.Split(val, ",")
+		for i, f := range fields {
+			fields[i] = strings.TrimSpace(f)
+		}
+		vals = append(vals, fields...)
+	}
+	return vals
+}
+
+// cachingReadCloser is a wrapper around ReadCloser R that calls OnEOF
+// handler with a full copy of the content read from R when EOF is
+// reached.
+type cachingReadCloser struct {
+	// Underlying ReadCloser.
+	R io.ReadCloser
+	// OnEOF is called with a copy of the content of R when EOF is reached.
+	OnEOF func(io.Reader)
+
+	buf bytes.Buffer // buf stores a copy of the content of R.
+}
+
+// Read reads the next len(p) bytes from R or until R is drained. The
+// return value n is the number of bytes read. If R has no data to
+// return, err is io.EOF and OnEOF is called with a full copy of what
+// has been read so far.
+func (r *cachingReadCloser) Read(p []byte) (n int, err error) {
+	n, err = r.R.Read(p)
+	r.buf.Write(p[:n])
+	if err == io.EOF {
+		r.OnEOF(bytes.NewReader(r.buf.Bytes()))
+	}
+	return n, err
+}
+
+func (r *cachingReadCloser) Close() error {
+	return r.R.Close()
+}
+
+// NewMemoryCacheTransport returns a new Transport using the in-memory cache implementation
+func NewMemoryCacheTransport() *Transport {
+	c := NewMemoryCache()
+	t := NewTransport(c)
+	return t
+}
diff --git a/internal/httpcache/httpcache_test.go b/internal/httpcache/httpcache_test.go
new file mode 100644
index 0000000000..a504641804
--- /dev/null
+++ b/internal/httpcache/httpcache_test.go
@@ -0,0 +1,1475 @@
+package httpcache
+
+import (
+	"bytes"
+	"errors"
+	"flag"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strconv"
+	"testing"
+	"time"
+)
+
+var s struct {
+	server    *httptest.Server
+	client    http.Client
+	transport *Transport
+	done      chan struct{} // Closed to unlock infinite handlers.
+}
+
+type fakeClock struct {
+	elapsed time.Duration
+}
+
+func (c *fakeClock) since(t time.Time) time.Duration {
+	return c.elapsed
+}
+
+func TestMain(m *testing.M) {
+	flag.Parse()
+	setup()
+	code := m.Run()
+	teardown()
+	os.Exit(code)
+}
+
+func setup() {
+	tp := NewMemoryCacheTransport()
+	client := http.Client{Transport: tp}
+	s.transport = tp
+	s.client = client
+	s.done = make(chan struct{})
+
+	mux := http.NewServeMux()
+	s.server = httptest.NewServer(mux)
+
+	mux.HandleFunc("/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "max-age=3600")
+	}))
+
+	mux.HandleFunc("/method", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "max-age=3600")
+		w.Write([]byte(r.Method))
+	}))
+
+	mux.HandleFunc("/range", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		lm := "Fri, 14 Dec 2010 01:01:50 GMT"
+		if r.Header.Get("if-modified-since") == lm {
+			w.WriteHeader(http.StatusNotModified)
+			return
+		}
+		w.Header().Set("last-modified", lm)
+		if r.Header.Get("range") == "bytes=4-9" {
+			w.WriteHeader(http.StatusPartialContent)
+			w.Write([]byte(" text "))
+			return
+		}
+		w.Write([]byte("Some text content"))
+	}))
+
+	mux.HandleFunc("/nostore", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+	}))
+
+	mux.HandleFunc("/etag", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		etag := "124567"
+		if r.Header.Get("if-none-match") == etag {
+			w.WriteHeader(http.StatusNotModified)
+			return
+		}
+		w.Header().Set("etag", etag)
+	}))
+
+	mux.HandleFunc("/lastmodified", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		lm := "Fri, 14 Dec 2010 01:01:50 GMT"
+		if r.Header.Get("if-modified-since") == lm {
+			w.WriteHeader(http.StatusNotModified)
+			return
+		}
+		w.Header().Set("last-modified", lm)
+	}))
+
+	mux.HandleFunc("/varyaccept", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "max-age=3600")
+		w.Header().Set("Content-Type", "text/plain")
+		w.Header().Set("Vary", "Accept")
+		w.Write([]byte("Some text content"))
+	}))
+
+	mux.HandleFunc("/doublevary", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "max-age=3600")
+		w.Header().Set("Content-Type", "text/plain")
+		w.Header().Set("Vary", "Accept, Accept-Language")
+		w.Write([]byte("Some text content"))
+	}))
+	mux.HandleFunc("/2varyheaders", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "max-age=3600")
+		w.Header().Set("Content-Type", "text/plain")
+		w.Header().Add("Vary", "Accept")
+		w.Header().Add("Vary", "Accept-Language")
+		w.Write([]byte("Some text content"))
+	}))
+	mux.HandleFunc("/varyunused", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "max-age=3600")
+		w.Header().Set("Content-Type", "text/plain")
+		w.Header().Set("Vary", "X-Madeup-Header")
+		w.Write([]byte("Some text content"))
+	}))
+
+	mux.HandleFunc("/cachederror", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		etag := "abc"
+		if r.Header.Get("if-none-match") == etag {
+			w.WriteHeader(http.StatusNotModified)
+			return
+		}
+		w.Header().Set("etag", etag)
+		w.WriteHeader(http.StatusNotFound)
+		w.Write([]byte("Not found"))
+	}))
+
+	updateFieldsCounter := 0
+	mux.HandleFunc("/updatefields", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Counter", strconv.Itoa(updateFieldsCounter))
+		w.Header().Set("Etag", `"e"`)
+		updateFieldsCounter++
+		if r.Header.Get("if-none-match") != "" {
+			w.WriteHeader(http.StatusNotModified)
+			return
+		}
+		w.Write([]byte("Some text content"))
+	}))
+
+	// Take 3 seconds to return 200 OK (for testing client timeouts).
+	mux.HandleFunc("/3seconds", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		time.Sleep(3 * time.Second)
+	}))
+
+	mux.HandleFunc("/infinite", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		for {
+			select {
+			case <-s.done:
+				return
+			default:
+				w.Write([]byte{0})
+			}
+		}
+	}))
+}
+
+func teardown() {
+	close(s.done)
+	s.server.Close()
+}
+
+func resetTest() {
+	s.transport.Cache = NewMemoryCache()
+	clock = &realClock{}
+}
+
+// TestCacheableMethod ensures that uncacheable method does not get stored
+// in cache and get incorrectly used for a following cacheable method request.
+func TestCacheableMethod(t *testing.T) {
+	resetTest()
+	{
+		req, err := http.NewRequest("POST", s.server.URL+"/method", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var buf bytes.Buffer
+		_, err = io.Copy(&buf, resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+		err = resp.Body.Close()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got, want := buf.String(), "POST"; got != want {
+			t.Errorf("got %q, want %q", got, want)
+		}
+		if resp.StatusCode != http.StatusOK {
+			t.Errorf("response status code isn't 200 OK: %v", resp.StatusCode)
+		}
+	}
+	{
+		req, err := http.NewRequest("GET", s.server.URL+"/method", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var buf bytes.Buffer
+		_, err = io.Copy(&buf, resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+		err = resp.Body.Close()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got, want := buf.String(), "GET"; got != want {
+			t.Errorf("got wrong body %q, want %q", got, want)
+		}
+		if resp.StatusCode != http.StatusOK {
+			t.Errorf("response status code isn't 200 OK: %v", resp.StatusCode)
+		}
+		if resp.Header.Get(XFromCache) != "" {
+			t.Errorf("XFromCache header isn't blank")
+		}
+	}
+}
+
+func TestDontServeHeadResponseToGetRequest(t *testing.T) {
+	resetTest()
+	url := s.server.URL + "/"
+	req, err := http.NewRequest(http.MethodHead, url, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = s.client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req, err = http.NewRequest(http.MethodGet, url, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := s.client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp.Header.Get(XFromCache) != "" {
+		t.Errorf("Cache should not match")
+	}
+}
+
+func TestDontStorePartialRangeInCache(t *testing.T) {
+	resetTest()
+	{
+		req, err := http.NewRequest("GET", s.server.URL+"/range", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		req.Header.Set("range", "bytes=4-9")
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var buf bytes.Buffer
+		_, err = io.Copy(&buf, resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+		err = resp.Body.Close()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got, want := buf.String(), " text "; got != want {
+			t.Errorf("got %q, want %q", got, want)
+		}
+		if resp.StatusCode != http.StatusPartialContent {
+			t.Errorf("response status code isn't 206 Partial Content: %v", resp.StatusCode)
+		}
+	}
+	{
+		req, err := http.NewRequest("GET", s.server.URL+"/range", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var buf bytes.Buffer
+		_, err = io.Copy(&buf, resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+		err = resp.Body.Close()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got, want := buf.String(), "Some text content"; got != want {
+			t.Errorf("got %q, want %q", got, want)
+		}
+		if resp.StatusCode != http.StatusOK {
+			t.Errorf("response status code isn't 200 OK: %v", resp.StatusCode)
+		}
+		if resp.Header.Get(XFromCache) != "" {
+			t.Error("XFromCache header isn't blank")
+		}
+	}
+	{
+		req, err := http.NewRequest("GET", s.server.URL+"/range", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var buf bytes.Buffer
+		_, err = io.Copy(&buf, resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+		err = resp.Body.Close()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got, want := buf.String(), "Some text content"; got != want {
+			t.Errorf("got %q, want %q", got, want)
+		}
+		if resp.StatusCode != http.StatusOK {
+			t.Errorf("response status code isn't 200 OK: %v", resp.StatusCode)
+		}
+		if resp.Header.Get(XFromCache) != "1" {
+			t.Errorf(`XFromCache header isn't "1": %v`, resp.Header.Get(XFromCache))
+		}
+	}
+	{
+		req, err := http.NewRequest("GET", s.server.URL+"/range", nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		req.Header.Set("range", "bytes=4-9")
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		var buf bytes.Buffer
+		_, err = io.Copy(&buf, resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+		err = resp.Body.Close()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if got, want := buf.String(), " text "; got != want {
+			t.Errorf("got %q, want %q", got, want)
+		}
+		if resp.StatusCode != http.StatusPartialContent {
+			t.Errorf("response status code isn't 206 Partial Content: %v", resp.StatusCode)
+		}
+	}
+}
+
+func TestCacheOnlyIfBodyRead(t *testing.T) {
+	resetTest()
+	{
+		req, err := http.NewRequest("GET", s.server.URL, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+		// We do not read the body
+		resp.Body.Close()
+	}
+	{
+		req, err := http.NewRequest("GET", s.server.URL, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatalf("XFromCache header isn't blank")
+		}
+	}
+}
+
+func TestOnlyReadBodyOnDemand(t *testing.T) {
+	resetTest()
+
+	req, err := http.NewRequest("GET", s.server.URL+"/infinite", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp, err := s.client.Do(req) // This shouldn't hang forever.
+	if err != nil {
+		t.Fatal(err)
+	}
+	buf := make([]byte, 10) // Only partially read the body.
+	_, err = resp.Body.Read(buf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	resp.Body.Close()
+}
+
+func TestGetOnlyIfCachedHit(t *testing.T) {
+	resetTest()
+	{
+		req, err := http.NewRequest("GET", s.server.URL, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+		_, err = ioutil.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	{
+		req, err := http.NewRequest("GET", s.server.URL, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		req.Header.Add("cache-control", "only-if-cached")
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "1" {
+			t.Fatalf(`XFromCache header isn't "1": %v`, resp.Header.Get(XFromCache))
+		}
+		if resp.StatusCode != http.StatusOK {
+			t.Fatalf("response status code isn't 200 OK: %v", resp.StatusCode)
+		}
+	}
+}
+
+func TestGetOnlyIfCachedMiss(t *testing.T) {
+	resetTest()
+	req, err := http.NewRequest("GET", s.server.URL, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Add("cache-control", "only-if-cached")
+	resp, err := s.client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.Header.Get(XFromCache) != "" {
+		t.Fatal("XFromCache header isn't blank")
+	}
+	if resp.StatusCode != http.StatusGatewayTimeout {
+		t.Fatalf("response status code isn't 504 GatewayTimeout: %v", resp.StatusCode)
+	}
+}
+
+func TestGetNoStoreRequest(t *testing.T) {
+	resetTest()
+	req, err := http.NewRequest("GET", s.server.URL, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Add("Cache-Control", "no-store")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+	}
+}
+
+func TestGetNoStoreResponse(t *testing.T) {
+	resetTest()
+	req, err := http.NewRequest("GET", s.server.URL+"/nostore", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+	}
+}
+
+func TestGetWithEtag(t *testing.T) {
+	resetTest()
+	req, err := http.NewRequest("GET", s.server.URL+"/etag", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+		_, err = ioutil.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "1" {
+			t.Fatalf(`XFromCache header isn't "1": %v`, resp.Header.Get(XFromCache))
+		}
+		// additional assertions to verify that 304 response is converted properly
+		if resp.StatusCode != http.StatusOK {
+			t.Fatalf("response status code isn't 200 OK: %v", resp.StatusCode)
+		}
+		if _, ok := resp.Header["Connection"]; ok {
+			t.Fatalf("Connection header isn't absent")
+		}
+	}
+}
+
+func TestGetWithLastModified(t *testing.T) {
+	resetTest()
+	req, err := http.NewRequest("GET", s.server.URL+"/lastmodified", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+		_, err = ioutil.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "1" {
+			t.Fatalf(`XFromCache header isn't "1": %v`, resp.Header.Get(XFromCache))
+		}
+	}
+}
+
+func TestGetWithVary(t *testing.T) {
+	resetTest()
+	req, err := http.NewRequest("GET", s.server.URL+"/varyaccept", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Accept", "text/plain")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get("Vary") != "Accept" {
+			t.Fatalf(`Vary header isn't "Accept": %v`, resp.Header.Get("Vary"))
+		}
+		_, err = ioutil.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "1" {
+			t.Fatalf(`XFromCache header isn't "1": %v`, resp.Header.Get(XFromCache))
+		}
+	}
+	req.Header.Set("Accept", "text/html")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+	}
+	req.Header.Set("Accept", "")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+	}
+}
+
+func TestGetWithDoubleVary(t *testing.T) {
+	resetTest()
+	req, err := http.NewRequest("GET", s.server.URL+"/doublevary", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Accept", "text/plain")
+	req.Header.Set("Accept-Language", "da, en-gb;q=0.8, en;q=0.7")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get("Vary") == "" {
+			t.Fatalf(`Vary header is blank`)
+		}
+		_, err = ioutil.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "1" {
+			t.Fatalf(`XFromCache header isn't "1": %v`, resp.Header.Get(XFromCache))
+		}
+	}
+	req.Header.Set("Accept-Language", "")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+	}
+	req.Header.Set("Accept-Language", "da")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+	}
+}
+
+func TestGetWith2VaryHeaders(t *testing.T) {
+	resetTest()
+	// Tests that multiple Vary headers' comma-separated lists are
+	// merged. See https://github.com/gregjones/httpcache/issues/27.
+	const (
+		accept         = "text/plain"
+		acceptLanguage = "da, en-gb;q=0.8, en;q=0.7"
+	)
+	req, err := http.NewRequest("GET", s.server.URL+"/2varyheaders", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Accept", accept)
+	req.Header.Set("Accept-Language", acceptLanguage)
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get("Vary") == "" {
+			t.Fatalf(`Vary header is blank`)
+		}
+		_, err = ioutil.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "1" {
+			t.Fatalf(`XFromCache header isn't "1": %v`, resp.Header.Get(XFromCache))
+		}
+	}
+	req.Header.Set("Accept-Language", "")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+	}
+	req.Header.Set("Accept-Language", "da")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+	}
+	req.Header.Set("Accept-Language", acceptLanguage)
+	req.Header.Set("Accept", "")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+	}
+	req.Header.Set("Accept", "image/png")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "" {
+			t.Fatal("XFromCache header isn't blank")
+		}
+		_, err = ioutil.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "1" {
+			t.Fatalf(`XFromCache header isn't "1": %v`, resp.Header.Get(XFromCache))
+		}
+	}
+}
+
+func TestGetVaryUnused(t *testing.T) {
+	resetTest()
+	req, err := http.NewRequest("GET", s.server.URL+"/varyunused", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Accept", "text/plain")
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get("Vary") == "" {
+			t.Fatalf(`Vary header is blank`)
+		}
+		_, err = ioutil.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "1" {
+			t.Fatalf(`XFromCache header isn't "1": %v`, resp.Header.Get(XFromCache))
+		}
+	}
+}
+
+func TestUpdateFields(t *testing.T) {
+	resetTest()
+	req, err := http.NewRequest("GET", s.server.URL+"/updatefields", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var counter, counter2 string
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		counter = resp.Header.Get("x-counter")
+		_, err = ioutil.ReadAll(resp.Body)
+		if err != nil {
+			t.Fatal(err)
+		}
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.Header.Get(XFromCache) != "1" {
+			t.Fatalf(`XFromCache header isn't "1": %v`, resp.Header.Get(XFromCache))
+		}
+		counter2 = resp.Header.Get("x-counter")
+	}
+	if counter == counter2 {
+		t.Fatalf(`both "x-counter" values are equal: %v %v`, counter, counter2)
+	}
+}
+
+// This tests the fix for https://github.com/gregjones/httpcache/issues/74.
+// Previously, after validating a cached response, its StatusCode
+// was incorrectly being replaced.
+func TestCachedErrorsKeepStatus(t *testing.T) {
+	resetTest()
+	req, err := http.NewRequest("GET", s.server.URL+"/cachederror", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		io.Copy(ioutil.Discard, resp.Body)
+	}
+	{
+		resp, err := s.client.Do(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		defer resp.Body.Close()
+		if resp.StatusCode != http.StatusNotFound {
+			t.Fatalf("Status code isn't 404: %d", resp.StatusCode)
+		}
+	}
+}
+
+func TestParseCacheControl(t *testing.T) {
+	resetTest()
+	h := http.Header{}
+	for range parseCacheControl(h) {
+		t.Fatal("cacheControl should be empty")
+	}
+
+	h.Set("cache-control", "no-cache")
+	{
+		cc := parseCacheControl(h)
+		if _, ok := cc["foo"]; ok {
+			t.Error(`Value "foo" shouldn't exist`)
+		}
+		noCache, ok := cc["no-cache"]
+		if !ok {
+			t.Fatalf(`"no-cache" value isn't set`)
+		}
+		if noCache != "" {
+			t.Fatalf(`"no-cache" value isn't blank: %v`, noCache)
+		}
+	}
+	h.Set("cache-control", "no-cache, max-age=3600")
+	{
+		cc := parseCacheControl(h)
+		noCache, ok := cc["no-cache"]
+		if !ok {
+			t.Fatalf(`"no-cache" value isn't set`)
+		}
+		if noCache != "" {
+			t.Fatalf(`"no-cache" value isn't blank: %v`, noCache)
+		}
+		if cc["max-age"] != "3600" {
+			t.Fatalf(`"max-age" value isn't "3600": %v`, cc["max-age"])
+		}
+	}
+}
+
+func TestNoCacheRequestExpiration(t *testing.T) {
+	resetTest()
+	respHeaders := http.Header{}
+	respHeaders.Set("Cache-Control", "max-age=7200")
+
+	reqHeaders := http.Header{}
+	reqHeaders.Set("Cache-Control", "no-cache")
+	if getFreshness(respHeaders, reqHeaders) != transparent {
+		t.Fatal("freshness isn't transparent")
+	}
+}
+
+func TestNoCacheResponseExpiration(t *testing.T) {
+	resetTest()
+	respHeaders := http.Header{}
+	respHeaders.Set("Cache-Control", "no-cache")
+	respHeaders.Set("Expires", "Wed, 19 Apr 3000 11:43:00 GMT")
+
+	reqHeaders := http.Header{}
+	if getFreshness(respHeaders, reqHeaders) != stale {
+		t.Fatal("freshness isn't stale")
+	}
+}
+
+func TestReqMustRevalidate(t *testing.T) {
+	resetTest()
+	// not paying attention to request setting max-stale means never returning stale
+	// responses, so always acting as if must-revalidate is set
+	respHeaders := http.Header{}
+
+	reqHeaders := http.Header{}
+	reqHeaders.Set("Cache-Control", "must-revalidate")
+	if getFreshness(respHeaders, reqHeaders) != stale {
+		t.Fatal("freshness isn't stale")
+	}
+}
+
+func TestRespMustRevalidate(t *testing.T) {
+	resetTest()
+	respHeaders := http.Header{}
+	respHeaders.Set("Cache-Control", "must-revalidate")
+
+	reqHeaders := http.Header{}
+	if getFreshness(respHeaders, reqHeaders) != stale {
+		t.Fatal("freshness isn't stale")
+	}
+}
+
+func TestFreshExpiration(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	respHeaders := http.Header{}
+	respHeaders.Set("date", now.Format(time.RFC1123))
+	respHeaders.Set("expires", now.Add(time.Duration(2)*time.Second).Format(time.RFC1123))
+
+	reqHeaders := http.Header{}
+	if getFreshness(respHeaders, reqHeaders) != fresh {
+		t.Fatal("freshness isn't fresh")
+	}
+
+	clock = &fakeClock{elapsed: 3 * time.Second}
+	if getFreshness(respHeaders, reqHeaders) != stale {
+		t.Fatal("freshness isn't stale")
+	}
+}
+
+func TestMaxAge(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	respHeaders := http.Header{}
+	respHeaders.Set("date", now.Format(time.RFC1123))
+	respHeaders.Set("cache-control", "max-age=2")
+
+	reqHeaders := http.Header{}
+	if getFreshness(respHeaders, reqHeaders) != fresh {
+		t.Fatal("freshness isn't fresh")
+	}
+
+	clock = &fakeClock{elapsed: 3 * time.Second}
+	if getFreshness(respHeaders, reqHeaders) != stale {
+		t.Fatal("freshness isn't stale")
+	}
+}
+
+func TestMaxAgeZero(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	respHeaders := http.Header{}
+	respHeaders.Set("date", now.Format(time.RFC1123))
+	respHeaders.Set("cache-control", "max-age=0")
+
+	reqHeaders := http.Header{}
+	if getFreshness(respHeaders, reqHeaders) != stale {
+		t.Fatal("freshness isn't stale")
+	}
+}
+
+func TestBothMaxAge(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	respHeaders := http.Header{}
+	respHeaders.Set("date", now.Format(time.RFC1123))
+	respHeaders.Set("cache-control", "max-age=2")
+
+	reqHeaders := http.Header{}
+	reqHeaders.Set("cache-control", "max-age=0")
+	if getFreshness(respHeaders, reqHeaders) != stale {
+		t.Fatal("freshness isn't stale")
+	}
+}
+
+func TestMinFreshWithExpires(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	respHeaders := http.Header{}
+	respHeaders.Set("date", now.Format(time.RFC1123))
+	respHeaders.Set("expires", now.Add(time.Duration(2)*time.Second).Format(time.RFC1123))
+
+	reqHeaders := http.Header{}
+	reqHeaders.Set("cache-control", "min-fresh=1")
+	if getFreshness(respHeaders, reqHeaders) != fresh {
+		t.Fatal("freshness isn't fresh")
+	}
+
+	reqHeaders = http.Header{}
+	reqHeaders.Set("cache-control", "min-fresh=2")
+	if getFreshness(respHeaders, reqHeaders) != stale {
+		t.Fatal("freshness isn't stale")
+	}
+}
+
+func TestEmptyMaxStale(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	respHeaders := http.Header{}
+	respHeaders.Set("date", now.Format(time.RFC1123))
+	respHeaders.Set("cache-control", "max-age=20")
+
+	reqHeaders := http.Header{}
+	reqHeaders.Set("cache-control", "max-stale")
+	clock = &fakeClock{elapsed: 10 * time.Second}
+	if getFreshness(respHeaders, reqHeaders) != fresh {
+		t.Fatal("freshness isn't fresh")
+	}
+
+	clock = &fakeClock{elapsed: 60 * time.Second}
+	if getFreshness(respHeaders, reqHeaders) != fresh {
+		t.Fatal("freshness isn't fresh")
+	}
+}
+
+func TestMaxStaleValue(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	respHeaders := http.Header{}
+	respHeaders.Set("date", now.Format(time.RFC1123))
+	respHeaders.Set("cache-control", "max-age=10")
+
+	reqHeaders := http.Header{}
+	reqHeaders.Set("cache-control", "max-stale=20")
+	clock = &fakeClock{elapsed: 5 * time.Second}
+	if getFreshness(respHeaders, reqHeaders) != fresh {
+		t.Fatal("freshness isn't fresh")
+	}
+
+	clock = &fakeClock{elapsed: 15 * time.Second}
+	if getFreshness(respHeaders, reqHeaders) != fresh {
+		t.Fatal("freshness isn't fresh")
+	}
+
+	clock = &fakeClock{elapsed: 30 * time.Second}
+	if getFreshness(respHeaders, reqHeaders) != stale {
+		t.Fatal("freshness isn't stale")
+	}
+}
+
+func containsHeader(headers []string, header string) bool {
+	for _, v := range headers {
+		if http.CanonicalHeaderKey(v) == http.CanonicalHeaderKey(header) {
+			return true
+		}
+	}
+	return false
+}
+
+func TestGetEndToEndHeaders(t *testing.T) {
+	resetTest()
+	var (
+		headers http.Header
+		end2end []string
+	)
+
+	headers = http.Header{}
+	headers.Set("content-type", "text/html")
+	headers.Set("te", "deflate")
+
+	end2end = getEndToEndHeaders(headers)
+	if !containsHeader(end2end, "content-type") {
+		t.Fatal(`doesn't contain "content-type" header`)
+	}
+	if containsHeader(end2end, "te") {
+		t.Fatal(`doesn't contain "te" header`)
+	}
+
+	headers = http.Header{}
+	headers.Set("connection", "content-type")
+	headers.Set("content-type", "text/csv")
+	headers.Set("te", "deflate")
+	end2end = getEndToEndHeaders(headers)
+	if containsHeader(end2end, "connection") {
+		t.Fatal(`doesn't contain "connection" header`)
+	}
+	if containsHeader(end2end, "content-type") {
+		t.Fatal(`doesn't contain "content-type" header`)
+	}
+	if containsHeader(end2end, "te") {
+		t.Fatal(`doesn't contain "te" header`)
+	}
+
+	headers = http.Header{}
+	end2end = getEndToEndHeaders(headers)
+	if len(end2end) != 0 {
+		t.Fatal(`non-zero end2end headers`)
+	}
+
+	headers = http.Header{}
+	headers.Set("connection", "content-type")
+	end2end = getEndToEndHeaders(headers)
+	if len(end2end) != 0 {
+		t.Fatal(`non-zero end2end headers`)
+	}
+}
+
+type transportMock struct {
+	response *http.Response
+	err      error
+}
+
+func (t transportMock) RoundTrip(req *http.Request) (resp *http.Response, err error) {
+	return t.response, t.err
+}
+
+func TestStaleIfErrorRequest(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	tmock := transportMock{
+		response: &http.Response{
+			Status:     http.StatusText(http.StatusOK),
+			StatusCode: http.StatusOK,
+			Header: http.Header{
+				"Date":          []string{now.Format(time.RFC1123)},
+				"Cache-Control": []string{"no-cache"},
+			},
+			Body: ioutil.NopCloser(bytes.NewBuffer([]byte("some data"))),
+		},
+		err: nil,
+	}
+	tp := NewMemoryCacheTransport()
+	tp.Transport = &tmock
+
+	// First time, response is cached on success
+	r, _ := http.NewRequest("GET", "http://somewhere.com/", nil)
+	r.Header.Set("Cache-Control", "stale-if-error")
+	resp, err := tp.RoundTrip(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("resp is nil")
+	}
+	_, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// On failure, response is returned from the cache
+	tmock.response = nil
+	tmock.err = errors.New("some error")
+	resp, err = tp.RoundTrip(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("resp is nil")
+	}
+}
+
+func TestStaleIfErrorRequestLifetime(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	tmock := transportMock{
+		response: &http.Response{
+			Status:     http.StatusText(http.StatusOK),
+			StatusCode: http.StatusOK,
+			Header: http.Header{
+				"Date":          []string{now.Format(time.RFC1123)},
+				"Cache-Control": []string{"no-cache"},
+			},
+			Body: ioutil.NopCloser(bytes.NewBuffer([]byte("some data"))),
+		},
+		err: nil,
+	}
+	tp := NewMemoryCacheTransport()
+	tp.Transport = &tmock
+
+	// First time, response is cached on success
+	r, _ := http.NewRequest("GET", "http://somewhere.com/", nil)
+	r.Header.Set("Cache-Control", "stale-if-error=100")
+	resp, err := tp.RoundTrip(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("resp is nil")
+	}
+	_, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// On failure, response is returned from the cache
+	tmock.response = nil
+	tmock.err = errors.New("some error")
+	resp, err = tp.RoundTrip(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("resp is nil")
+	}
+
+	// Same for http errors
+	tmock.response = &http.Response{StatusCode: http.StatusInternalServerError}
+	tmock.err = nil
+	resp, err = tp.RoundTrip(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("resp is nil")
+	}
+
+	// If failure last more than max stale, error is returned
+	clock = &fakeClock{elapsed: 200 * time.Second}
+	_, err = tp.RoundTrip(r)
+	if err != tmock.err {
+		t.Fatalf("got err %v, want %v", err, tmock.err)
+	}
+}
+
+func TestStaleIfErrorResponse(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	tmock := transportMock{
+		response: &http.Response{
+			Status:     http.StatusText(http.StatusOK),
+			StatusCode: http.StatusOK,
+			Header: http.Header{
+				"Date":          []string{now.Format(time.RFC1123)},
+				"Cache-Control": []string{"no-cache, stale-if-error"},
+			},
+			Body: ioutil.NopCloser(bytes.NewBuffer([]byte("some data"))),
+		},
+		err: nil,
+	}
+	tp := NewMemoryCacheTransport()
+	tp.Transport = &tmock
+
+	// First time, response is cached on success
+	r, _ := http.NewRequest("GET", "http://somewhere.com/", nil)
+	resp, err := tp.RoundTrip(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("resp is nil")
+	}
+	_, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// On failure, response is returned from the cache
+	tmock.response = nil
+	tmock.err = errors.New("some error")
+	resp, err = tp.RoundTrip(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("resp is nil")
+	}
+}
+
+func TestStaleIfErrorResponseLifetime(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	tmock := transportMock{
+		response: &http.Response{
+			Status:     http.StatusText(http.StatusOK),
+			StatusCode: http.StatusOK,
+			Header: http.Header{
+				"Date":          []string{now.Format(time.RFC1123)},
+				"Cache-Control": []string{"no-cache, stale-if-error=100"},
+			},
+			Body: ioutil.NopCloser(bytes.NewBuffer([]byte("some data"))),
+		},
+		err: nil,
+	}
+	tp := NewMemoryCacheTransport()
+	tp.Transport = &tmock
+
+	// First time, response is cached on success
+	r, _ := http.NewRequest("GET", "http://somewhere.com/", nil)
+	resp, err := tp.RoundTrip(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("resp is nil")
+	}
+	_, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// On failure, response is returned from the cache
+	tmock.response = nil
+	tmock.err = errors.New("some error")
+	resp, err = tp.RoundTrip(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("resp is nil")
+	}
+
+	// If failure last more than max stale, error is returned
+	clock = &fakeClock{elapsed: 200 * time.Second}
+	_, err = tp.RoundTrip(r)
+	if err != tmock.err {
+		t.Fatalf("got err %v, want %v", err, tmock.err)
+	}
+}
+
+// This tests the fix for https://github.com/gregjones/httpcache/issues/74.
+// Previously, after a stale response was used after encountering an error,
+// its StatusCode was being incorrectly replaced.
+func TestStaleIfErrorKeepsStatus(t *testing.T) {
+	resetTest()
+	now := time.Now()
+	tmock := transportMock{
+		response: &http.Response{
+			Status:     http.StatusText(http.StatusNotFound),
+			StatusCode: http.StatusNotFound,
+			Header: http.Header{
+				"Date":          []string{now.Format(time.RFC1123)},
+				"Cache-Control": []string{"no-cache"},
+			},
+			Body: ioutil.NopCloser(bytes.NewBuffer([]byte("some data"))),
+		},
+		err: nil,
+	}
+	tp := NewMemoryCacheTransport()
+	tp.Transport = &tmock
+
+	// First time, response is cached on success
+	r, _ := http.NewRequest("GET", "http://somewhere.com/", nil)
+	r.Header.Set("Cache-Control", "stale-if-error")
+	resp, err := tp.RoundTrip(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("resp is nil")
+	}
+	_, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// On failure, response is returned from the cache
+	tmock.response = nil
+	tmock.err = errors.New("some error")
+	resp, err = tp.RoundTrip(r)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("resp is nil")
+	}
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("Status wasn't 404: %d", resp.StatusCode)
+	}
+}
+
+// Test that http.Client.Timeout is respected when cache transport is used.
+// That is so as long as request cancellation is propagated correctly.
+// In the past, that required CancelRequest to be implemented correctly,
+// but modern http.Client uses Request.Cancel (or request context) instead,
+// so we don't have to do anything.
+func TestClientTimeout(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping timeout test in short mode") // Because it takes at least 3 seconds to run.
+	}
+	resetTest()
+	client := &http.Client{
+		Transport: NewMemoryCacheTransport(),
+		Timeout:   time.Second,
+	}
+	started := time.Now()
+	resp, err := client.Get(s.server.URL + "/3seconds")
+	taken := time.Since(started)
+	if err == nil {
+		t.Error("got nil error, want timeout error")
+	}
+	if resp != nil {
+		t.Error("got non-nil resp, want nil resp")
+	}
+	if taken >= 2*time.Second {
+		t.Error("client.Do took 2+ seconds, want < 2 seconds")
+	}
+}
diff --git a/internal/httpcache/test/test.go b/internal/httpcache/test/test.go
new file mode 100644
index 0000000000..2a267d304c
--- /dev/null
+++ b/internal/httpcache/test/test.go
@@ -0,0 +1,35 @@
+package test
+
+import (
+	"bytes"
+	"testing"
+
+	"encr.dev/internal/httpcache"
+)
+
+// Cache excercises a httpcache.Cache implementation.
+func Cache(t *testing.T, cache httpcache.Cache) {
+	key := "testKey"
+	_, ok := cache.Get(key)
+	if ok {
+		t.Fatal("retrieved key before adding it")
+	}
+
+	val := []byte("some bytes")
+	cache.Set(key, val)
+
+	retVal, ok := cache.Get(key)
+	if !ok {
+		t.Fatal("could not retrieve an element we just added")
+	}
+	if !bytes.Equal(retVal, val) {
+		t.Fatal("retrieved a different value than what we put in")
+	}
+
+	cache.Delete(key)
+
+	_, ok = cache.Get(key)
+	if ok {
+		t.Fatal("deleted key still present")
+	}
+}
diff --git a/internal/httpcache/test/test_test.go b/internal/httpcache/test/test_test.go
new file mode 100644
index 0000000000..0c33c29eca
--- /dev/null
+++ b/internal/httpcache/test/test_test.go
@@ -0,0 +1,12 @@
+package test_test
+
+import (
+	"testing"
+
+	"encr.dev/internal/httpcache"
+	"encr.dev/internal/httpcache/test"
+)
+
+func TestMemoryCache(t *testing.T) {
+	test.Cache(t, httpcache.NewMemoryCache())
+}
diff --git a/internal/lookpath/lookpath.go b/internal/lookpath/lookpath.go
new file mode 100644
index 0000000000..85f5e181b5
--- /dev/null
+++ b/internal/lookpath/lookpath.go
@@ -0,0 +1,242 @@
+/*
+This package contains code from https://github.com/mvdan/sh.
+
+Copyright (c) 2016, Daniel Martí. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of the copyright holder nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+package lookpath
+
+import (
+	"cmp"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strings"
+)
+
+func checkStat(dir, file string, checkExec bool) (string, error) {
+	if !filepath.IsAbs(file) {
+		file = filepath.Join(dir, file)
+	}
+	info, err := os.Stat(file)
+	if err != nil {
+		return "", err
+	}
+	m := info.Mode()
+	if m.IsDir() {
+		return "", fmt.Errorf("is a directory")
+	}
+	if checkExec && runtime.GOOS != "windows" && m&0o111 == 0 {
+		return "", fmt.Errorf("permission denied")
+	}
+	return file, nil
+}
+
+func winHasExt(file string) bool {
+	i := strings.LastIndex(file, ".")
+	if i < 0 {
+		return false
+	}
+	return strings.LastIndexAny(file, `:\/`) < i
+}
+
+// findExecutable returns the path to an existing executable file.
+func findExecutable(dir, file string, exts []string) (string, error) {
+	if len(exts) == 0 {
+		// non-windows
+		return checkStat(dir, file, true)
+	}
+	if winHasExt(file) {
+		if file, err := checkStat(dir, file, true); err == nil {
+			return file, nil
+		}
+	}
+	for _, e := range exts {
+		f := file + e
+		if f, err := checkStat(dir, f, true); err == nil {
+			return f, nil
+		}
+	}
+	return "", fmt.Errorf("not found")
+}
+
+// findFile returns the path to an existing file.
+func findFile(dir, file string, _ []string) (string, error) {
+	return checkStat(dir, file, false)
+}
+
+// InDir is similar to [os/exec.LookPath], with the difference that it uses the
+// provided environment. env is used to fetch relevant environment variables
+// such as PWD and PATH.
+//
+// If no error is returned, the returned path must be valid.
+func InDir(cwd string, env []string, file string) (string, error) {
+	if filepath.IsAbs(file) {
+		return file, nil
+	}
+
+	upper := runtime.GOOS == "windows"
+	envs := listEnvironWithUpper(upper, env...)
+	return lookPathDir(cwd, envs, file, findExecutable)
+}
+
+// findAny defines a function to pass to lookPathDir.
+type findAny = func(dir string, file string, exts []string) (string, error)
+
+func lookPathDir(cwd string, env listEnviron, file string, find findAny) (string, error) {
+	if find == nil {
+		panic("no find function found")
+	}
+
+	pathList := filepath.SplitList(env.Get("PATH"))
+	if len(pathList) == 0 {
+		pathList = []string{""}
+	}
+	chars := `/`
+	if runtime.GOOS == "windows" {
+		chars = `:\/`
+	}
+	exts := pathExts(env)
+	if strings.ContainsAny(file, chars) {
+		return find(cwd, file, exts)
+	}
+	for _, elem := range pathList {
+		var path string
+		switch elem {
+		case "", ".":
+			// otherwise "foo" won't be "./foo"
+			path = "." + string(filepath.Separator) + file
+		default:
+			path = filepath.Join(elem, file)
+		}
+		if f, err := find(cwd, path, exts); err == nil {
+			return f, nil
+		}
+	}
+	return "", fmt.Errorf("%q: executable file not found in $PATH", file)
+}
+
+func pathExts(env listEnviron) []string {
+	if runtime.GOOS != "windows" {
+		return nil
+	}
+	pathext := env.Get("PATHEXT")
+	if pathext == "" {
+		return []string{".com", ".exe", ".bat", ".cmd"}
+	}
+	var exts []string
+	for _, e := range strings.Split(strings.ToLower(pathext), `;`) {
+		if e == "" {
+			continue
+		}
+		if e[0] != '.' {
+			e = "." + e
+		}
+		exts = append(exts, e)
+	}
+	return exts
+}
+
+// listEnvironWithUpper implements ListEnviron, but letting the tests specify
+// whether to uppercase all names or not.
+func listEnvironWithUpper(upper bool, pairs ...string) listEnviron {
+	list := slices.Clone(pairs)
+	if upper {
+		// Uppercase before sorting, so that we can remove duplicates
+		// without the need for linear search nor a map.
+		for i, s := range list {
+			if sep := strings.IndexByte(s, '='); sep > 0 {
+				list[i] = strings.ToUpper(s[:sep]) + s[sep:]
+			}
+		}
+	}
+
+	slices.SortStableFunc(list, func(a, b string) int {
+		isep := strings.IndexByte(a, '=')
+		jsep := strings.IndexByte(b, '=')
+		if isep < 0 {
+			isep = 0
+		} else {
+			isep += 1
+		}
+		if jsep < 0 {
+			jsep = 0
+		} else {
+			jsep += 1
+		}
+		return strings.Compare(a[:isep], b[:jsep])
+	})
+
+	last := ""
+	for i := 0; i < len(list); {
+		s := list[i]
+		sep := strings.IndexByte(s, '=')
+		if sep <= 0 {
+			// invalid element; remove it
+			list = append(list[:i], list[i+1:]...)
+			continue
+		}
+		name := s[:sep]
+		if last == name {
+			// duplicate; the last one wins
+			list = append(list[:i-1], list[i:]...)
+			continue
+		}
+		last = name
+		i++
+	}
+	return listEnviron(list)
+}
+
+// listEnviron is a sorted list of "name=value" strings.
+type listEnviron []string
+
+func (l listEnviron) Get(name string) string {
+	eqpos := len(name)
+	endpos := len(name) + 1
+	i, ok := slices.BinarySearchFunc(l, name, func(l, name string) int {
+		if len(l) < endpos {
+			// Too short; see if we are before or after the name.
+			return strings.Compare(l, name)
+		}
+		// Compare the name prefix, then the equal character.
+		c := strings.Compare(l[:eqpos], name)
+		eq := l[eqpos]
+		if c == 0 {
+			return cmp.Compare(eq, '=')
+		}
+		return c
+	})
+	if ok {
+		return l[i][endpos:]
+	}
+	return ""
+}
diff --git a/internal/optracker/async.go b/internal/optracker/async.go
new file mode 100644
index 0000000000..25afc270b4
--- /dev/null
+++ b/internal/optracker/async.go
@@ -0,0 +1,86 @@
+package optracker
+
+import (
+	"context"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+type AsyncBuildJobs struct {
+	ctx        context.Context
+	cancelCtx  context.CancelFunc
+	m          sync.Mutex
+	wait       sync.WaitGroup
+	firstError error
+	tracker    *OpTracker
+	start      time.Time
+	appID      string
+}
+
+func (a *AsyncBuildJobs) Tracker() *OpTracker {
+	return a.tracker
+}
+
+func NewAsyncBuildJobs(ctx context.Context, appID string, tracker *OpTracker) *AsyncBuildJobs {
+	ctx, cancelCtx := context.WithCancel(ctx)
+
+	return &AsyncBuildJobs{
+		ctx:       ctx,
+		cancelCtx: cancelCtx,
+		appID:     appID,
+		tracker:   tracker,
+		start:     time.Now(),
+	}
+}
+
+func (a *AsyncBuildJobs) Go(description string, track bool, minDuration time.Duration, f func(ctx context.Context) error) {
+	a.wait.Add(1)
+
+	trackerID := NoOperationID
+	if track && a.tracker != nil {
+		trackerID = a.tracker.Add(description, a.start)
+	}
+
+	go func() {
+		defer a.wait.Done()
+
+		log.Info().Str("app_id", a.appID).Str("job", description).Msg("starting build job")
+		if err := f(a.ctx); err != nil {
+			// If the context was canceled, it probably means the error was due to that.
+			if a.ctx.Err() != nil {
+				if a.tracker != nil {
+					a.tracker.Cancel(trackerID)
+				}
+			} else {
+				log.Err(err).Str("app_id", a.appID).Str("job", description).Msg("build job failed")
+				if a.tracker != nil {
+					a.tracker.Fail(trackerID, err)
+				}
+				a.recordError(err)
+			}
+		} else {
+			if a.tracker != nil {
+				a.tracker.Done(trackerID, minDuration)
+			}
+			log.Info().Str("app_id", a.appID).Str("job", description).Msg("build job finished")
+		}
+	}()
+}
+
+func (a *AsyncBuildJobs) Wait() error {
+	a.wait.Wait()
+	return a.firstError
+}
+
+func (a *AsyncBuildJobs) recordError(err error) {
+	a.m.Lock()
+	defer a.m.Unlock()
+
+	a.cancelCtx()
+
+	if a.firstError == nil {
+		a.firstError = err
+	}
+}
diff --git a/internal/optracker/optracker.go b/internal/optracker/optracker.go
new file mode 100644
index 0000000000..7372083b04
--- /dev/null
+++ b/internal/optracker/optracker.go
@@ -0,0 +1,236 @@
+package optracker
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"runtime"
+	"sort"
+	"sync"
+	"time"
+
+	"github.com/logrusorgru/aurora/v3"
+
+	"encr.dev/pkg/ansi"
+	"encr.dev/pkg/errlist"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+type OutputStream interface {
+	Send(*daemonpb.CommandMessage) error
+}
+
+func New(w io.Writer, stream OutputStream) *OpTracker {
+	return &OpTracker{
+		w:      w,
+		stream: stream,
+	}
+}
+
+type OpTracker struct {
+	mu          sync.Mutex
+	ops         []*slowOp
+	w           io.Writer
+	started     bool
+	quit        bool // quit indicates that the tracker has been stopped (this should only be set by AllDone)
+	savedCursor sync.Once
+	stream      OutputStream
+}
+
+type OperationID int
+
+const NoOperationID OperationID = -1
+
+// AllDone marks all ops as done.
+// This function is safe to call on a Nil OpTracker.
+func (t *OpTracker) AllDone() {
+	if t == nil {
+		return
+	}
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+
+	// If we've already quit, don't do anything
+	if t.quit == true {
+		return
+	}
+
+	now := time.Now()
+	for _, o := range t.ops {
+		if o.done.IsZero() || o.done.After(now) {
+			o.done = now
+		}
+		if o.start.After(now) {
+			o.start = now
+		}
+	}
+	t.quit = true
+	t.refresh()
+}
+
+// Add creates a new item on the operations tracker returning the ID for that op.
+// minStart is the time at which the tracker will start to show the task as in progress.
+//
+// This function is safe to call on a Nil OpTracker and will no-op in that case
+func (t *OpTracker) Add(msg string, minStart time.Time) OperationID {
+	if t == nil {
+		return NoOperationID
+	}
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	id := OperationID(len(t.ops))
+
+	start := time.Now()
+	if start.Before(minStart) {
+		start = minStart
+	}
+	op := &slowOp{msg: msg, start: start}
+	t.ops = append(t.ops, op)
+	t.refresh()
+
+	if !t.started {
+		go t.spin()
+		t.started = true
+	}
+
+	return id
+}
+
+// Done marks the given operation as done
+//
+// This function is safe to call on a Nil OpTracker and will no-op in that case
+func (t *OpTracker) Done(id OperationID, minDuration time.Duration) {
+	if t == nil || id == NoOperationID {
+		return
+	}
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	o := t.ops[id]
+
+	done := time.Now()
+	if a := o.start.Add(minDuration); a.After(done) {
+		done = a
+	}
+	o.done = done
+	t.refresh()
+}
+
+var ErrCanceled = errors.New("operation canceled")
+
+// Fail marks the operation as failed with the given error
+//
+// This function is safe to call on a Nil OpTracker and will no-op in that case
+func (t *OpTracker) Fail(id OperationID, err error) {
+	if t == nil || id == NoOperationID {
+		return
+	}
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if !t.ops[id].done.IsZero() {
+		return
+	}
+	t.ops[id].err = err
+	t.ops[id].done = time.Now()
+	t.refresh()
+}
+
+// Cancel marks the operation as canceled.
+// It is equivalent to t.Fail(id, ErrCanceled).
+func (t *OpTracker) Cancel(id OperationID) {
+	t.Fail(id, ErrCanceled)
+}
+
+// refresh refreshes the display by writing to t.w.
+// The mutex must be held by the caller.
+func (t *OpTracker) refresh() {
+	t.savedCursor.Do(func() {
+		fmt.Fprint(t.w, ansi.SaveCursorPosition)
+	})
+	fmt.Fprint(t.w, ansi.RestoreCursorPosition+ansi.ClearScreen(ansi.CursorToBottom))
+
+	now := time.Now()
+
+	// Sort ops by start time
+	ops := make([]*slowOp, len(t.ops))
+	copy(ops, t.ops)
+	sort.Slice(ops, func(i, j int) bool {
+		return ops[i].start.Before(ops[j].start)
+	})
+
+	for _, o := range ops {
+		started := o.start.Before(now)
+		done := !o.done.IsZero() && o.done.Before(now)
+		if !started && !done {
+			continue
+		}
+
+		var msg aurora.Value
+		format := "  %s %s... "
+		switch {
+		case done && o.err != nil:
+			if errors.Is(o.err, ErrCanceled) {
+				msg = aurora.Yellow(fmt.Sprintf(format+"Canceled", canceled, o.msg))
+			} else {
+				if errlist := errlist.Convert(o.err); errlist != nil {
+					if len(errlist.List) > 0 {
+						msg = aurora.Red(fmt.Sprintf(format+"Failed: %v", fail, o.msg, errlist.List[0].Title()))
+					} else {
+						msg = aurora.Red(fmt.Sprintf(format+"Failed: %v", fail, o.msg, errlist))
+					}
+				} else {
+					msg = aurora.Red(fmt.Sprintf(format+"Failed: %v", fail, o.msg, o.err))
+				}
+			}
+		case done && o.err == nil:
+			msg = aurora.Green(fmt.Sprintf(format+"Done!", success, o.msg))
+		case !done:
+			msg = aurora.Cyan(fmt.Sprintf(format, spinner[o.spinIdx], o.msg))
+			o.spinIdx = (o.spinIdx + 1) % len(spinner)
+		}
+		str := msg.String()
+		fmt.Fprintf(t.w, "%s%s%s\n",
+			ansi.MoveCursorLeft(1000),
+			ansi.ClearLine(ansi.WholeLine),
+			str,
+		)
+	}
+}
+
+func (t *OpTracker) spin() {
+	refresh := 100 * time.Millisecond
+	if runtime.GOOS == "windows" {
+		// Window's terminal is quite slow at rendering.
+		// Reduce the refresh rate to avoid excessive flickering.
+		refresh = 250 * time.Millisecond
+	}
+	for {
+		time.Sleep(refresh)
+		(func() {
+			t.mu.Lock()
+			defer t.mu.Unlock()
+			if !t.quit {
+				t.refresh()
+			}
+		})()
+	}
+
+}
+
+type slowOp struct {
+	msg     string
+	err     error
+	spinIdx int
+	start   time.Time
+	done    time.Time
+}
+
+var (
+	success  = "✔"
+	fail     = "❌"
+	canceled = "⚠️"
+	spinner  = []string{"⠋", "⠙", "⠚", "⠒", "⠂", "⠂", "⠒", "⠲", "⠴", "⠦", "⠖", "⠒", "⠐", "⠐", "⠒", "⠓", "⠋"}
+)
diff --git a/internal/userconfig/config.go b/internal/userconfig/config.go
new file mode 100644
index 0000000000..f0b9ebd450
--- /dev/null
+++ b/internal/userconfig/config.go
@@ -0,0 +1,8 @@
+package userconfig
+
+// Config describes the configuration structure we support.
+type Config struct {
+	// Whether to open the Local Development Dashboard in the browser on `encore run`.
+	// If set to "auto", the browser will be opened if the dashboard is not already open.
+	RunBrowser string `koanf:"run.browser" oneof:"always,never,auto" default:"auto"`
+}
diff --git a/internal/userconfig/def.go b/internal/userconfig/def.go
new file mode 100644
index 0000000000..e029949329
--- /dev/null
+++ b/internal/userconfig/def.go
@@ -0,0 +1,52 @@
+package userconfig
+
+import (
+	"fmt"
+	"maps"
+	"reflect"
+	"slices"
+	"sort"
+	"strings"
+)
+
+func (c *Config) GetByKey(key string) (v Value, ok bool) {
+	val := reflect.ValueOf(c).Elem()
+	desc, ok := descs[key]
+	if !ok {
+		return Value{}, false
+	}
+
+	f := val.FieldByName(desc.FieldName)
+	if !f.IsValid() {
+		return Value{}, false
+	}
+
+	return Value{Val: f.Interface(), Type: desc.Type}, true
+}
+
+func (c *Config) Render() string {
+	var buf strings.Builder
+	for _, key := range configKeys {
+		v, ok := c.GetByKey(key)
+		if !ok {
+			continue
+		}
+		buf.WriteString(fmt.Sprintf("%s: %s\n", key, v))
+	}
+	return buf.String()
+}
+
+var configKeys = (func() []string {
+	keys := slices.Collect(maps.Keys(descs))
+	sort.Strings(keys)
+	return keys
+})()
+
+func GetType(key string) (Type, bool) {
+	typ, ok := descs[key]
+	return typ.Type, ok
+}
+
+func Keys() []string {
+	return configKeys
+}
diff --git a/internal/userconfig/docs.go b/internal/userconfig/docs.go
new file mode 100644
index 0000000000..1717f6ad90
--- /dev/null
+++ b/internal/userconfig/docs.go
@@ -0,0 +1,127 @@
+package userconfig
+
+import (
+	"fmt"
+	"strings"
+)
+
+//go:generate go run ./gendocs
+
+func CLIDocs() string {
+	var buf strings.Builder
+	for _, key := range configKeys {
+		desc := descs[key]
+		doc := desc.Doc
+		fmt.Fprintf(&buf, "%s (%s)\n", key, desc.Type.Kind.String())
+
+		if doc != "" {
+			rem := doc
+			for rem != "" {
+				var line string
+				if idx := strings.IndexByte(rem, '\n'); idx != -1 {
+					line = rem[:idx]
+					rem = rem[idx+1:]
+				} else {
+					line = rem
+					rem = ""
+				}
+				buf.WriteString("  ")
+				buf.WriteString(line)
+				buf.WriteByte('\n')
+			}
+		} else {
+			buf.WriteString("  No documentation available.\n")
+		}
+
+		buf.WriteByte('\n')
+
+		didWriteMore := false
+		if desc.Type.Default != nil {
+			fmt.Fprintf(&buf, "  Default: %v\n", RenderValue(*desc.Type.Default))
+			didWriteMore = true
+		}
+		if len(desc.Type.Oneof) > 0 {
+			fmt.Fprintf(&buf, "  Must be one of: %v\n", RenderOneof(desc.Type.Oneof))
+			didWriteMore = true
+		}
+
+		// Add an extra newline if we wrote validation details.
+		if didWriteMore {
+			buf.WriteByte('\n')
+		}
+	}
+
+	return buf.String()
+}
+
+// bt renders a backtick-enclosed string.
+func bt(val string) string {
+	return fmt.Sprintf("`%s`", val)
+}
+
+var markdownHeader = `
+The Encore CLI has a number of configuration options to customize its behavior.
+
+Configuration options can be set both for individual Encore applications, as well as
+globally for the local user.
+
+Configuration options can be set using ` + bt("encore config <key> <value>") + `,
+and options can similarly be read using ` + bt("encore config <key>") + `.
+
+When running ` + bt("encore config") + ` within an Encore application, it automatically
+sets and gets configuration for that application.
+
+To set or get global configuration, use the ` + bt("--global") + ` flag.
+
+## Configuration files
+
+The configuration is stored in one ore more TOML files on the filesystem.
+
+The configuration is read from the following files, in order:
+
+### Global configuration
+* ` + bt("$XDG_CONFIG_HOME/encore/config") + `
+* ` + bt("$HOME/.config/encore/config") + `
+* ` + bt("$HOME/.encoreconfig") + `
+
+### Application-specific configuration
+* ` + bt("$APP_ROOT/.encore/config") + `
+
+Where ` + bt("$APP_ROOT") + ` is the directory containing the ` + bt("encore.app") + ` file.
+
+The files are read and merged, in the order defined above, with latter files taking precedence over earlier files.
+
+## Configuration options
+
+`
+
+func MarkdownDocs() string {
+	var buf strings.Builder
+
+	buf.WriteString(markdownHeader)
+
+	for _, key := range configKeys {
+		desc := descs[key]
+		doc := desc.Doc
+
+		fmt.Fprintf(&buf, "#### %s\n", key)
+		fmt.Fprintf(&buf, "Type: %s<br/>\n", desc.Type.Kind.String())
+		if desc.Type.Default != nil {
+			fmt.Fprintf(&buf, "Default: %v<br/>\n", RenderValue(*desc.Type.Default))
+		}
+		if len(desc.Type.Oneof) > 0 {
+			fmt.Fprintf(&buf, "Must be one of: %v\n", RenderOneof(desc.Type.Oneof))
+		}
+		buf.WriteByte('\n')
+
+		if doc != "" {
+			buf.WriteString(doc)
+		} else {
+			buf.WriteString("No documentation available.\n")
+		}
+
+		buf.WriteByte('\n')
+	}
+
+	return buf.String()
+}
diff --git a/internal/userconfig/files.go b/internal/userconfig/files.go
new file mode 100644
index 0000000000..cce3a2fa3f
--- /dev/null
+++ b/internal/userconfig/files.go
@@ -0,0 +1,104 @@
+package userconfig
+
+import (
+	"io/fs"
+	"os"
+	"os/user"
+	"path/filepath"
+	"slices"
+	"sync"
+	"time"
+
+	"encr.dev/internal/goldfish"
+	"github.com/cockroachdb/errors"
+	"github.com/knadh/koanf/parsers/toml/v2"
+	"github.com/knadh/koanf/providers/file"
+	"github.com/knadh/koanf/providers/rawbytes"
+	"github.com/knadh/koanf/v2"
+)
+
+const globalCacheKey = "#global#"
+
+var (
+	goldfishMu sync.Mutex
+	goldfishes = make(map[string]*Cached)
+)
+
+type Cached = goldfish.Cache[*Config]
+
+func ForApp(appRoot string) *Cached {
+	appRoot = filepath.Clean(appRoot)
+	paths := slices.Clone(userPaths)
+	paths = append(paths, appFilePath(appRoot))
+	return forCacheKey(appRoot, paths)
+}
+
+func Global() *Cached {
+	return forCacheKey(globalCacheKey, userPaths)
+}
+
+func forCacheKey(key string, paths []string) *Cached {
+	goldfishMu.Lock()
+	defer goldfishMu.Unlock()
+
+	if c, ok := goldfishes[key]; ok {
+		return c
+	}
+
+	c := goldfish.New(1*time.Second, func() (*Config, error) {
+		return newInstance(paths...)
+	})
+	goldfishes[key] = c
+	return c
+}
+
+func appFilePath(appRoot string) string {
+	return filepath.Join(appRoot, ".encore", "config")
+}
+
+var userPaths []string = func() []string {
+	var paths []string
+
+	configHome := os.Getenv("XDG_CONFIG_HOME")
+	if configHome != "" {
+		paths = append(paths, filepath.Join(configHome, "encore", "config"))
+	}
+
+	if u, err := user.Current(); err == nil {
+		if configHome == "" {
+			paths = append(paths, filepath.Join(u.HomeDir, ".config", "encore", "config"))
+		}
+		paths = append(paths, filepath.Join(u.HomeDir, ".encoreconfig"))
+	}
+
+	return paths
+}()
+
+var tomlParser = toml.Parser()
+
+func newInstance(paths ...string) (*Config, error) {
+	k := koanf.New(".")
+
+	for _, path := range paths {
+		f := file.Provider(path)
+		err := k.Load(f, tomlParser)
+		if err != nil && !errors.Is(err, fs.ErrNotExist) {
+			return nil, errors.Wrap(err, "unable to parse config file")
+		}
+	}
+
+	cfg := &Config{}
+	err := k.UnmarshalWithConf("", cfg, koanf.UnmarshalConf{
+		Tag:       "koanf",
+		FlatPaths: true,
+	})
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to unmarshal config")
+	}
+	return cfg, nil
+}
+
+func validateConfig(data []byte) error {
+	k := koanf.New(".")
+	return k.Load(rawbytes.Provider(data), tomlParser)
+}
diff --git a/internal/userconfig/gendocs/gendocs.go b/internal/userconfig/gendocs/gendocs.go
new file mode 100644
index 0000000000..df21239d49
--- /dev/null
+++ b/internal/userconfig/gendocs/gendocs.go
@@ -0,0 +1,51 @@
+package main
+
+import (
+	"fmt"
+	"log"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"encr.dev/internal/userconfig"
+	"encr.dev/pkg/xos"
+)
+
+func main() {
+	repoRoot := resolveRepoRoot()
+	docsDir := filepath.Join(repoRoot, "docs")
+
+	for _, lang := range []string{"go", "ts"} {
+		docs := generateDocs(lang)
+		dst := filepath.Join(docsDir, lang, "cli", "config-reference.md")
+		if err := xos.WriteFile(dst, []byte(docs), 0644); err != nil {
+			log.Fatalf("error writing %s docs file: %v\n", lang, err)
+		}
+	}
+	log.Printf("successfully regenerated docs")
+}
+
+func generateDocs(lang string) string {
+	return docsHeader(lang) + "\n" + userconfig.MarkdownDocs()
+}
+
+func docsHeader(lang string) string {
+	return fmt.Sprintf(`---
+seotitle: Encore CLI Configuration Options
+seodesc: Configuration options to customize the behavior of the Encore CLI.
+title: Configuration Reference
+subtitle: Configuration options to customize the behavior of the Encore CLI.
+lang: %s
+---
+`, lang)
+}
+
+func resolveRepoRoot() string {
+	// Use `git rev-parse --show-toplevel` to get the root of the repository
+	cmd := exec.Command("git", "rev-parse", "--show-toplevel")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		log.Fatalf("Error running git rev-parse: %v\n", err)
+	}
+	return filepath.Clean(strings.TrimSpace(string(out)))
+}
diff --git a/internal/userconfig/reflect.go b/internal/userconfig/reflect.go
new file mode 100644
index 0000000000..dec3d9bc09
--- /dev/null
+++ b/internal/userconfig/reflect.go
@@ -0,0 +1,166 @@
+package userconfig
+
+import (
+	_ "embed"
+	"fmt"
+	"go/ast"
+	"go/doc"
+	"go/parser"
+	"go/token"
+	"reflect"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+	"github.com/fatih/structtag"
+)
+
+func keyForField(f *reflect.StructField) (string, error) {
+	tags, err := structtag.Parse(string(f.Tag))
+	if err != nil {
+		return "", err
+	}
+	tag, err := tags.Get("koanf")
+	if err != nil {
+		return "", err
+	}
+	key := tag.Name
+	if key == "" {
+		return "", errors.New("empty key")
+	}
+	return key, nil
+}
+
+type keyDesc struct {
+	Doc       string
+	Type      Type
+	FieldName string // field name in the Config struct
+}
+
+func newKeyDesc(f *reflect.StructField) (key string, desc keyDesc, err error) {
+	tags, err := structtag.Parse(string(f.Tag))
+	if err != nil {
+		return "", keyDesc{}, err
+	}
+	tag, err := tags.Get("koanf")
+	if err != nil {
+		return "", keyDesc{}, errors.Wrap(err, "failed to get koanf tag")
+	}
+	key = tag.Name
+	if key == "" {
+		return "", keyDesc{}, errors.New("empty key")
+	}
+
+	kind, ok := kindFromReflect(f.Type.Kind())
+	if !ok {
+		return "", keyDesc{}, errors.Errorf("unsupported type %v", f.Type)
+	}
+
+	ty := Type{Kind: kind}
+
+	// Do we have a default?
+	if def, _ := tags.Get("default"); def != nil {
+		val, err := kind.parseValue(def.Name)
+		if err != nil {
+			return "", keyDesc{}, errors.Wrap(err, "parse default value")
+		}
+		ty.Default = &val
+	}
+
+	// Do we have a oneof?
+	if tag := f.Tag.Get("oneof"); tag != "" {
+		var oneof []any
+		for _, part := range strings.Split(tag, ",") {
+			val, err := kind.parseValue(part)
+			if err != nil {
+				return "", keyDesc{}, errors.Wrap(err, "parse oneof value")
+			}
+			oneof = append(oneof, val)
+		}
+		ty.Oneof = oneof
+	}
+
+	desc = keyDesc{
+		Doc:       docComments[f.Name],
+		Type:      ty,
+		FieldName: f.Name,
+	}
+	return key, desc, nil
+}
+
+var descs = (func() map[string]keyDesc {
+	var cfg Config
+	t := reflect.TypeOf(cfg)
+	descs := make(map[string]keyDesc, t.NumField())
+
+	for i := 0; i < t.NumField(); i++ {
+		f := t.Field(i)
+		key, desc, err := newKeyDesc(&f)
+		if err != nil {
+			panic(fmt.Sprintf("invalid userconfig definition for field %s: %v", f.Name, err))
+		}
+		if _, ok := descs[key]; ok {
+			panic(fmt.Sprintf("duplicate key %s in userconfig.Config", key))
+		}
+		descs[key] = desc
+	}
+
+	return descs
+})()
+
+func kindFromReflect(kind reflect.Kind) (Kind, bool) {
+	switch kind {
+	case reflect.String:
+		return String, true
+	case reflect.Bool:
+		return Bool, true
+	case reflect.Int:
+		return Int, true
+	case reflect.Uint:
+		return Uint, true
+	default:
+		return 0, false
+	}
+}
+
+//go:embed config.go
+var configGo string
+
+// doc comments, keyed by field name.
+var docComments = (func() map[string]string {
+	// Parse config.go as a Go file to extract the doc comments.
+	fset := token.NewFileSet()
+	f, err := parser.ParseFile(fset, "config.go", configGo, parser.ParseComments)
+	if err != nil {
+		panic(fmt.Sprintf("userconfig/config.go is invalid: %v", err))
+	}
+
+	// Compute package documentation with examples.
+	p, err := doc.NewFromFiles(fset, []*ast.File{f}, "encr.dev/internal/userconfig")
+	if err != nil {
+		panic(fmt.Sprintf("userconfig/config.go is invalid: %v", err))
+	}
+
+	for _, typ := range p.Types {
+		if typ.Name == "Config" {
+			comments := make(map[string]string)
+
+			// Extract comments for each field.
+			structType := typ.Decl.Specs[0].(*ast.TypeSpec).Type.(*ast.StructType)
+			for _, f := range structType.Fields.List {
+				if f.Doc == nil {
+					continue
+				}
+				if len(f.Names) == 0 {
+					panic("field has no name")
+				}
+				text := f.Doc.Text()
+				for _, name := range f.Names {
+					comments[name.Name] = text
+				}
+			}
+			return comments
+		}
+	}
+
+	panic("Config type not found in userconfig/config.go")
+})()
diff --git a/internal/userconfig/value.go b/internal/userconfig/value.go
new file mode 100644
index 0000000000..1be16d9855
--- /dev/null
+++ b/internal/userconfig/value.go
@@ -0,0 +1,160 @@
+package userconfig
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+)
+
+type Kind int
+
+const (
+	String Kind = iota + 1
+	Bool
+	Int
+	Uint
+)
+
+func (k Kind) String() string {
+	switch k {
+	case String:
+		return "string"
+	case Bool:
+		return "bool"
+	case Int:
+		return "int"
+	case Uint:
+		return "uint"
+	default:
+		return "unknown kind"
+	}
+}
+
+func (k Kind) HumanString() string {
+	switch k {
+	case String:
+		return "a string"
+	case Bool:
+		return "a boolean (true/false)"
+	case Int:
+		return "an integer"
+	case Uint:
+		return "an unsigned integer (>=0)"
+	default:
+		return "an unknown kind"
+	}
+}
+
+type Type struct {
+	Kind    Kind
+	Default *any  // nil means no default
+	Oneof   []any // nil means no restrictions
+}
+
+type Value struct {
+	Val  any
+	Type Type
+}
+
+func (v Value) String() string {
+	return RenderValue(v.Val)
+}
+
+func (t Type) ParseAndValidate(val string) (any, error) {
+	parsed, err := t.Kind.parseValue(val)
+	if err != nil {
+		return nil, err
+	} else if err := t.validate(parsed); err != nil {
+		return nil, err
+	}
+	return parsed, nil
+}
+
+func (t Type) validate(val any) error {
+	if val == nil {
+		return errors.New("value cannot be nil")
+	}
+	if len(t.Oneof) > 0 {
+		for _, v := range t.Oneof {
+			if val == v {
+				return nil
+			}
+		}
+
+		strVal := fmt.Sprintf("%v", val)
+		return errors.Errorf("value %q is not one of: %s", strVal, RenderOneof(t.Oneof))
+	}
+
+	if k, ok := kindOf(val); ok {
+		if k != t.Kind {
+			return errors.Errorf("value v is not %s", t.Kind.HumanString())
+		}
+	}
+
+	return nil
+}
+
+func RenderValue(v any) string {
+	return fmt.Sprintf("%v", v)
+}
+
+func RenderOneof(oneof []any) string {
+	if len(oneof) == 0 {
+		return ""
+	}
+
+	// Render as "a, b, or c"
+	var s strings.Builder
+	for i, v := range oneof {
+		if i > 0 {
+			if i == len(oneof)-1 {
+				if len(oneof) > 2 {
+					s.WriteString(", or ")
+				} else {
+					s.WriteString(" or ")
+				}
+			} else {
+				s.WriteString(", ")
+			}
+		}
+
+		s.WriteString(RenderValue(v))
+	}
+	return s.String()
+}
+
+func (k Kind) parseValue(value string) (any, error) {
+	switch k {
+	case String:
+		return value, nil
+	case Bool:
+		return strconv.ParseBool(value)
+	case Int:
+		return strconv.ParseInt(value, 10, 64)
+	case Uint:
+		return strconv.ParseUint(value, 10, 64)
+	default:
+		return nil, fmt.Errorf("unknown kind %v", k)
+	}
+}
+
+func KindOf[T interface{ string | bool | int | uint }](val T) (k Kind, ok bool) {
+	return kindOf(val)
+}
+
+func kindOf(val any) (k Kind, ok bool) {
+	switch val.(type) {
+	case string:
+		return String, true
+	case bool:
+		return Bool, true
+	case int:
+		return Int, true
+	case uint:
+		return Uint, true
+	default:
+		return 0, false
+	}
+}
diff --git a/internal/userconfig/write.go b/internal/userconfig/write.go
new file mode 100644
index 0000000000..7f0129e0a9
--- /dev/null
+++ b/internal/userconfig/write.go
@@ -0,0 +1,86 @@
+package userconfig
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+
+	"encr.dev/pkg/xos"
+	"github.com/cockroachdb/errors"
+	"github.com/pelletier/go-toml"
+)
+
+func SetForApp(appRoot, key, value string) error {
+	if _, err := os.Stat(appRoot); err != nil {
+		return errors.Wrap(err, "app root directory does not exist")
+	}
+	dst := appFilePath(appRoot)
+	return updateConfig(dst, key, value)
+}
+
+func SetGlobal(key, value string) error {
+	if len(userPaths) == 0 {
+		return errors.New("no global config file location found")
+	}
+
+	// Find the last path in the list that exists.
+	for i := len(userPaths) - 1; i >= 0; i-- {
+		if _, err := os.Stat(userPaths[i]); err == nil {
+			return updateConfig(userPaths[i], key, value)
+		}
+	}
+
+	// Otherwise fall back to the lowest-priority entry.
+	dst := userPaths[0]
+	return updateConfig(dst, key, value)
+}
+
+func updateConfig(dstPath, key, value string) error {
+	desc, ok := descs[key]
+	if !ok {
+		return errors.Errorf("unknown key: %q", key)
+	}
+	val, err := desc.Type.ParseAndValidate(value)
+	if err != nil {
+		return err
+	}
+
+	// Read the existing config.
+	// If it doesn't exist it's initialized to an emty config.
+	var conf *toml.Tree
+	{
+		data, err := os.ReadFile(dstPath)
+		if err != nil && !os.IsNotExist(err) {
+			return errors.Wrap(err, "failed to read existing config")
+		}
+		if data != nil {
+			conf, err = toml.LoadBytes(data)
+		} else {
+			conf, err = toml.TreeFromMap(map[string]any{})
+		}
+		if err != nil {
+			return errors.Wrap(err, "failed to parse existing config")
+		}
+	}
+
+	keys := strings.Split(key, ".")
+	conf.SetPath(keys, val)
+
+	// Write the config back out.
+	data, err := conf.Marshal()
+	if err != nil {
+		return errors.Wrap(err, "failed to marshal config")
+	}
+
+	if err := validateConfig(data); err != nil {
+		return errors.Wrap(err, "resulting config is invalid")
+	}
+
+	if err := os.MkdirAll(filepath.Dir(dstPath), 0755); err != nil {
+		return errors.Wrap(err, "failed to create config file")
+	}
+	if err := xos.WriteFile(dstPath, data, 0644); err != nil {
+		return errors.Wrap(err, "failed to write config file")
+	}
+	return nil
+}
diff --git a/internal/version/version.go b/internal/version/version.go
new file mode 100644
index 0000000000..eee36d13df
--- /dev/null
+++ b/internal/version/version.go
@@ -0,0 +1,125 @@
+package version
+
+import (
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+	"runtime/debug"
+	"strings"
+
+	"golang.org/x/mod/semver"
+
+	"encr.dev/internal/conf"
+	"encr.dev/internal/env"
+)
+
+// Version is the version of the encore binary.
+// It is set using `go build -ldflags "-X encr.dev/internal/version.Version=v1.2.3"`.
+var Version string
+
+// Channel tells us which ReleaseChannel this build of Encore is under
+var Channel ReleaseChannel
+
+type ReleaseChannel string
+
+const (
+	GA       ReleaseChannel = "ga"      // A general availability release of Encore in Semver: v1.10.0
+	Beta     ReleaseChannel = "beta"    // A beta build of an upcoming Encore release: v1.10.0-beta.1
+	Nightly  ReleaseChannel = "nightly" // A nightly build of Encore with the date of the build: v1.10.0-nightly.20221231
+	DevBuild ReleaseChannel = "develop" // A development build of Encore with the commit of the build: v0.0.0-develop+0140ab0f78fd10d52673a961e900993b64b7b9e3
+	unknown  ReleaseChannel = "unknown" // An unknown release stream (not exported as it should be an error case)
+)
+
+// ConfigHash reports a hash of the configuration that affects the behavior of the daemon.
+// It is used to decide whether to restart the daemon.
+func ConfigHash() (string, error) {
+	h := sha256.New()
+	configDir, err := conf.Dir()
+	if err != nil {
+		return "", err
+	}
+
+	fmt.Fprintf(h, "APIBaseURL=%s\n", conf.APIBaseURL)
+	fmt.Fprintf(h, "ConfigDir=%s\n", configDir)
+	fmt.Fprintf(h, "EncoreDevDashListenAddr=%s\n", env.EncoreDevDashListenAddr().GetOrElse(""))
+	fmt.Fprintf(h, "EncoreMCPSSEListenAddr=%s\n", env.EncoreMCPSSEListenAddr().GetOrElse(""))
+	fmt.Fprintf(h, "EncoreObjectStorageListAddr=%s\n", env.EncoreObjectStorageListAddr().GetOrElse(""))
+
+	digest := h.Sum(nil)
+	return base64.RawURLEncoding.EncodeToString(digest), nil
+}
+
+func init() {
+	// If version is already set via a compiler link flag, then we don't need to do anything
+	if Version == "" {
+		// Otherwise, we want to read the information from this built binary
+		Version = "v0.0.0-develop"
+
+		info, ok := debug.ReadBuildInfo()
+		if !ok {
+			return
+		}
+
+		// Add the commit info
+		vcsVersion := ""
+		vcsModified := ""
+		for _, p := range info.Settings {
+			switch p.Key {
+			case "vcs.revision":
+				vcsVersion = p.Value
+			case "vcs.modified":
+				if p.Value == "true" {
+					vcsModified = "-modified"
+				}
+			}
+		}
+		if vcsVersion != "" {
+			Version += "+" + vcsVersion + vcsModified
+		}
+	}
+	Channel = ChannelFor(Version)
+}
+
+func ChannelFor(version string) ReleaseChannel {
+	if !strings.HasPrefix(version, "v") {
+		return unknown
+	}
+	// Now work out the release channel
+	switch {
+	case strings.Contains(version, "-beta."):
+		return Beta
+	case strings.Contains(version, "-nightly."):
+		return Nightly
+	case strings.HasSuffix(version, "-develop") || strings.Contains(version, "-develop+"):
+		return DevBuild
+	default:
+		return GA
+	}
+}
+
+// Compare compares this version of Encore against another version
+// accounting for the release channel.
+//
+// If the releases are from the same channel, then it returns:
+//   - 0 if the versions are the same
+//   - a negative number if this version is older than the other
+//   - a positive number if this version is newer than the other
+//
+// If the releases are from different channels, it always returns 1.
+func Compare(againstVersion string) int {
+	againstChannel := ChannelFor(againstVersion)
+
+	if Channel != againstChannel {
+		// If the channels are different, this "version" is always newer
+		return 1
+	}
+
+	switch Channel {
+	case GA, Beta, Nightly:
+		return semver.Compare(Version, againstVersion)
+	case DevBuild:
+		return 0 // devel versions are always the same
+	default:
+		return 0 // never newer if we can't test
+	}
+}
diff --git a/parser/.gitignore b/parser/.gitignore
deleted file mode 100644
index 0dc7b4b001..0000000000
--- a/parser/.gitignore
+++ /dev/null
@@ -1 +0,0 @@
-/.vscode
\ No newline at end of file
diff --git a/parser/directive.go b/parser/directive.go
deleted file mode 100644
index 96a3f45c54..0000000000
--- a/parser/directive.go
+++ /dev/null
@@ -1,144 +0,0 @@
-package parser
-
-import (
-	"errors"
-	"fmt"
-	"go/ast"
-	"go/token"
-	"strings"
-
-	"encr.dev/parser/est"
-)
-
-// parseDirectives parses the encore:foo directives in cg.
-// It returns the parsed directive, if any, and the
-// remaining doc text after stripping the directive lines.
-//
-// If no directive was found, it reports nil, "".
-func (p *parser) parseDirectives(cg *ast.CommentGroup) (d directive, doc string) {
-	if cg == nil {
-		return nil, ""
-	}
-
-	// Go has standardized on directives in the form "//[a-z0-9]+:[a-z0-9+]".
-	// Encore has allowed a space between // and the directive,
-	// but we would like to migrate to the standard syntax.
-	//
-	// First try the standard syntax and fall back to the legacy syntax
-	// if we don't find any directives.
-
-	var dir directive
-
-	// Standard syntax
-	for _, c := range cg.List {
-		const prefix = "//encore:"
-		if strings.HasPrefix(c.Text, prefix) {
-			if dir != nil {
-				p.err(c.Pos(), "cannot have multiple encore annotations")
-				continue
-			}
-			var err error
-			dir, err = parseDirective(c.Pos(), c.Text[len(prefix):])
-			if err != nil {
-				p.err(c.Pos(), err.Error())
-			}
-		}
-	}
-	if dir != nil {
-		doc := cg.Text() // skips directives for us
-		return dir, doc
-	}
-
-	// Legacy syntax
-	lines := strings.Split(cg.Text(), "\n")
-	var docLines []string
-
-LineLoop:
-	for _, line := range lines {
-		const prefix = "encore:"
-		if strings.HasPrefix(line, prefix) {
-			if dir != nil {
-				p.err(cg.Pos(), "cannot have multiple encore annotations")
-				continue
-			}
-			var err error
-			dir, err = parseDirective(cg.Pos(), line[len(prefix):])
-			if err != nil {
-				p.err(cg.Pos(), err.Error())
-			}
-			continue LineLoop
-		}
-		docLines = append(docLines, line)
-	}
-	if dir == nil {
-		return nil, ""
-	}
-	doc = strings.TrimSpace(strings.Join(docLines, "\n"))
-	return dir, doc
-}
-
-// parseDirective parses a single directive from line.
-func parseDirective(pos token.Pos, line string) (directive, error) {
-	fields := strings.Fields(line)
-	if len(fields) == 0 {
-		return nil, fmt.Errorf("invalid encore directive: %q", line)
-	}
-	switch fields[0] {
-	default:
-		return nil, fmt.Errorf("invalid encore directive: %q", fields[0])
-
-	case "api":
-		rpc := &rpcDirective{
-			TokenPos: pos,
-			Access:   est.Private,
-		}
-		for _, field := range fields[1:] {
-			switch field {
-			case "public":
-				rpc.Access = est.Public
-			case "private":
-				rpc.Access = est.Private
-			case "auth":
-				rpc.Access = est.Auth
-			case "raw":
-				rpc.Raw = true
-			default:
-				return nil, fmt.Errorf("unrecognized encore:api directive field: %q", field)
-			}
-		}
-		// We don't support private raw APIs for now
-		if rpc.Raw && rpc.Access == est.Private {
-			return nil, errors.New("private APIs cannot be declared raw")
-		}
-		return rpc, nil
-
-	case "authhandler":
-		if len(fields) > 1 {
-			return nil, fmt.Errorf("unrecognized encore:authhandler directive field: %q", fields[1])
-		}
-		return &authHandlerDirective{TokenPos: pos}, nil
-	}
-}
-
-// The directive interface is a marker interface for the directive types we support.
-type directive interface {
-	Pos() token.Pos
-	directive()
-}
-
-// An rpcDirective is the parsed representation of the encore:api directive.
-type rpcDirective struct {
-	TokenPos token.Pos
-	Access   est.AccessType
-	Raw      bool
-}
-
-// An authHandlerDirective is the parsed representation of the encore:authhandler directive.
-type authHandlerDirective struct {
-	TokenPos token.Pos
-}
-
-func (d *rpcDirective) Pos() token.Pos         { return d.TokenPos }
-func (d *authHandlerDirective) Pos() token.Pos { return d.TokenPos }
-func (*rpcDirective) directive()               {}
-func (*authHandlerDirective) directive()       {}
diff --git a/parser/dirs.go b/parser/dirs.go
deleted file mode 100644
index 1837603ac0..0000000000
--- a/parser/dirs.go
+++ /dev/null
@@ -1,129 +0,0 @@
-package parser
-
-import (
-	"fmt"
-	"go/ast"
-	goparser "go/parser"
-	"go/scanner"
-	"go/token"
-	"io/ioutil"
-	"os"
-	"path"
-	"path/filepath"
-	"sort"
-	"strings"
-
-	"encr.dev/parser/est"
-)
-
-// walkFunc is the callback called by walkDirs to process a directory.
-// dir is the path to the current directory; relPath is the (slash-separated)
-// relative path from the original root dir.
-type walkFunc func(dir, relPath string, files []os.FileInfo) error
-
-// walkDirs is like filepath.Walk but it calls walkFn once for each directory and not for individual files.
-// It also reports both the full path and the path relative to the given root dir.
-// It does not allow skipping directories in any way; any error returned from walkFn aborts the walk.
-func walkDirs(root string, walkFn walkFunc) error {
-	return walkDir(root, ".", walkFn)
-}
-
-// walkDir processes a single directory and recurses.
-// dir is the current directory path, and rel is the relative path from the original root.
-// rel is always in slash form, while dir uses the OS-native filepath separator.
-func walkDir(dir, rel string, walkFn walkFunc) error {
-	entries, err := ioutil.ReadDir(dir)
-	if err != nil {
-		return err
-	}
-
-	// Split the files and dirs
-	var dirs, files []os.FileInfo
-	for _, entry := range entries {
-		if entry.IsDir() {
-			dirs = append(dirs, entry)
-		} else {
-			files = append(files, entry)
-		}
-	}
-
-	if err := walkFn(dir, rel, files); err != nil {
-		return err
-	}
-
-	for _, d := range dirs {
-		dir2 := filepath.Join(dir, d.Name())
-		rel2 := path.Join(rel, d.Name())
-		if err := walkDir(dir2, rel2, walkFn); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// parseDir is like go/parser.ParseDir but it constructs *est.File objects instead.
-func parseDir(fset *token.FileSet, dir, relPath string, filter func(os.FileInfo) bool, mode goparser.Mode) (pkgs map[string]*ast.Package, files []*est.File, err error) {
-	fd, err := os.Open(dir)
-	if err != nil {
-		return nil, nil, err
-	}
-	defer fd.Close()
-
-	list, err := fd.Readdir(-1)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	// Sort the slice so that we have a stable order to ensure deterministic metadata.
-	sort.Slice(list, func(i, j int) bool { return list[i].Name() < list[j].Name() })
-
-	var errors scanner.ErrorList
-
-	pkgs = make(map[string]*ast.Package)
-	for _, d := range list {
-		if strings.HasSuffix(d.Name(), ".go") && (filter == nil || filter(d)) {
-			filename := filepath.Join(dir, d.Name())
-			contents, err := ioutil.ReadFile(filename)
-			if err != nil {
-				return nil, nil, err
-			}
-
-			src, err := goparser.ParseFile(fset, filename, contents, mode)
-			if err != nil || !src.Pos().IsValid() {
-				// Parse error or invalid file
-				if err == nil {
-					err = fmt.Errorf("could not parse file %s", d.Name())
-				}
-				if el, ok := err.(scanner.ErrorList); ok {
-					errors = append(errors, el...)
-				} else {
-					errors.Add(token.Position{Filename: filename}, err.Error())
-				}
-				continue
-			}
-
-			name := src.Name.Name
-			pkg, found := pkgs[name]
-			if !found {
-				pkg = &ast.Package{
-					Name:  name,
-					Files: make(map[string]*ast.File),
-				}
-				pkgs[name] = pkg
-			}
-			pkg.Files[filename] = src
-			tokFile := fset.File(src.Package)
-			files = append(files, &est.File{
-				Name:       d.Name(),
-				AST:        src,
-				Token:      tokFile,
-				Contents:   contents,
-				Path:       filename,
-				References: make(map[ast.Node]*est.Node),
-				Pkg:        nil, // will be set later
-			})
-		}
-	}
-
-	return pkgs, files, errors.Err()
-}
diff --git a/parser/dirs_test.go b/parser/dirs_test.go
deleted file mode 100644
index 7996eb87b1..0000000000
--- a/parser/dirs_test.go
+++ /dev/null
@@ -1,143 +0,0 @@
-package parser
-
-import (
-	goparser "go/parser"
-	"go/token"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-
-	qt "github.com/frankban/quicktest"
-	"github.com/rogpeppe/go-internal/txtar"
-)
-
-func TestWalkDirs(t *testing.T) {
-	type call struct {
-		Dir   string
-		Path  string
-		Files []string
-	}
-	tests := []struct {
-		// Tree represents a directory tree. See createTree.
-		Tree string
-		// Calls are the expected calls to walkFn, in order.
-		Calls []call
-	}{
-		{"a", []call{{"", ".", []string{"a"}}}},
-		{"a/", []call{
-			{"", ".", []string{}},
-			{"a", "a", []string{}},
-		}},
-		{"a/b", []call{
-			{"", ".", []string{}},
-			{"a", "a", []string{"b"}},
-		}},
-		{"a/b a/c a/d/e", []call{
-			{"", ".", []string{}},
-			{"a", "a", []string{"b", "c"}},
-			{"a/d", "a/d", []string{"e"}},
-		}},
-	}
-
-	// createTree creates the directory tree represented by tree.
-	// Nodes are space-separated; dirs end with a trailing slash.
-	//
-	// "a b/c d/" represents a root with one file "a",
-	// the directory "b" (containing file "c") and an empty directory "d".
-	// It reports the directory root.
-	createTree := func(tree string) (root string) {
-		root = t.TempDir()
-		for _, node := range strings.Fields(tree) {
-			// Create the dir if we have a slash
-			if idx := strings.LastIndexByte(node, '/'); idx > 0 {
-				p := filepath.Join(root, filepath.FromSlash(node[:idx]))
-				if err := os.MkdirAll(p, 0755); err != nil {
-					t.Fatal(err)
-				}
-			}
-			if !strings.HasSuffix(node, "/") {
-				f, err := os.Create(filepath.Join(root, filepath.FromSlash(node)))
-				if err != nil {
-					t.Fatal(err)
-				}
-				f.Close()
-			}
-		}
-		return root
-	}
-
-	c := qt.New(t)
-	for _, test := range tests {
-		root := createTree(test.Tree)
-		var calls []call
-		walkDirs(root, func(dir, relPath string, files []os.FileInfo) error {
-			names := make([]string, len(files))
-			for i, f := range files {
-				names[i] = f.Name()
-			}
-			if dir == root {
-				dir = ""
-			} else {
-				dir = dir[len(root)+1:]
-			}
-			calls = append(calls, call{dir, relPath, names})
-			return nil
-		})
-
-		expect := make([]call, len(test.Calls))
-		for i, c := range test.Calls {
-			expect[i] = call{c.Dir, c.Path, c.Files}
-		}
-		c.Assert(calls, qt.DeepEquals, expect, qt.Commentf("tree: %s", test.Tree))
-	}
-}
-
-func TestParseDir(t *testing.T) {
-	tests := []struct {
-		Archive  string
-		PkgNames []string
-		NFiles   int
-		Err      string
-	}{
-		{
-			Archive: `
--- foo.go --
-package foo
--- bar.go --
-package bar
-`,
-			PkgNames: []string{"foo", "bar"},
-			NFiles:   2,
-		},
-		{
-			Archive: `
--- foo.go --
-package fo/;
-`,
-			Err: ".*foo.go:.*expected ';', found '/'",
-		},
-	}
-
-	c := qt.New(t)
-	for i, test := range tests {
-		a := txtar.Parse([]byte(test.Archive))
-		base := t.TempDir()
-		err := txtar.Write(a, base)
-		c.Assert(err, qt.IsNil, qt.Commentf("test #%d", i))
-
-		fs := token.NewFileSet()
-		pkgs, files, err := parseDir(fs, base, ".", nil, goparser.ParseComments)
-		if test.Err != "" {
-			c.Assert(err, qt.ErrorMatches, test.Err)
-			continue
-		}
-		c.Assert(err, qt.IsNil)
-		var pkgNames []string
-		for name := range pkgs {
-			pkgNames = append(pkgNames, name)
-		}
-		c.Assert(pkgNames, qt.ContentEquals, test.PkgNames)
-		c.Assert(files, qt.HasLen, test.NFiles)
-	}
-}
diff --git a/parser/encoding/rpc.go b/parser/encoding/rpc.go
new file mode 100644
index 0000000000..64e46417de
--- /dev/null
+++ b/parser/encoding/rpc.go
@@ -0,0 +1,785 @@
+package encoding
+
+import (
+	"fmt"
+	"reflect"
+	"slices"
+	"sort"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+	"github.com/golang/protobuf/proto"
+
+	"encr.dev/pkg/idents"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+// ParameterLocation is the request/response home of the parameter
+type ParameterLocation string
+
+const (
+	Undefined ParameterLocation = "undefined" // Parameter location is Undefined
+	Header    ParameterLocation = "header"    // Parameter is placed in the HTTP header
+	Query     ParameterLocation = "query"     // Parameter is placed in the query string
+	Body      ParameterLocation = "body"      // Parameter is placed in the body
+	Cookie    ParameterLocation = "cookie"    // Parameter is placed in cookies
+)
+
+var (
+	QueryTag = tagDescription{
+		location:        Query,
+		overrideDefault: true,
+	}
+	QsTag     = QueryTag
+	HeaderTag = tagDescription{
+		location:        Header,
+		overrideDefault: true,
+		wireFormatter:   strings.ToLower,
+	}
+	JSONTag = tagDescription{
+		location:        Body,
+		omitEmptyOption: "omitempty",
+		overrideDefault: false,
+	}
+	CookieTag = tagDescription{
+		location:        Cookie,
+		omitEmptyOption: "omitempty",
+		overrideDefault: true,
+	}
+)
+
+// authTags is a description of tags used for auth
+var authTags = map[string]tagDescription{
+	"query":  QueryTag,
+	"header": HeaderTag,
+	"cookie": CookieTag,
+}
+
+// requestTags is a description of tags used for requests
+var requestTags = map[string]tagDescription{
+	"query":  QueryTag,
+	"qs":     QsTag,
+	"header": HeaderTag,
+	"cookie": CookieTag,
+	"json":   JSONTag,
+}
+
+// responseTags is a description of tags used for responses
+var responseTags = map[string]tagDescription{
+	"header": HeaderTag,
+	"cookie": CookieTag,
+	"json":   JSONTag,
+}
+
+// tagDescription is used to map struct field tags to param locations
+// if overrideDefault is set, tagDescription.location will be used instead of encodingHints.defaultLocation
+// if the tag matches the paramLocation, the param name will be replaced with the
+// tag name
+type tagDescription struct {
+	location        ParameterLocation
+	overrideDefault bool
+	omitEmptyOption string
+	wireFormatter   func(name string) string
+}
+
+// encodingHints is used to determine the default location and applicable tag overrides for http
+// request/response encoding
+type encodingHints struct {
+	defaultLocation ParameterLocation
+	tags            map[string]tagDescription
+	options         *Options
+}
+
+// RPCEncoding expresses how an RPC should be encoded on the wire for both the request and responses.
+type RPCEncoding struct {
+	Name        string     `json:"name"`
+	Doc         string     `json:"doc"`
+	AccessType  string     `json:"access_type"`
+	Proto       string     `json:"proto"`
+	Path        *meta.Path `json:"path"`
+	HttpMethods []string   `json:"http_methods"`
+
+	DefaultMethod string `json:"default_method"`
+	// Expresses how the default request encoding and method should be
+	// Note: DefaultRequestEncoding.HTTPMethods will always be a slice with length 1
+	DefaultRequestEncoding *RequestEncoding `json:"request_encoding"`
+	// Expresses all the different ways the request can be encoded for this RPC
+	RequestEncoding []*RequestEncoding `json:"all_request_encodings"`
+	// Expresses how the response to this RPC will be encoded
+	ResponseEncoding *ResponseEncoding `json:"response_encoding"`
+}
+
+// RequestEncodingForMethod returns the request encoding required for the given HTTP method.
+// If the method is not supported by the RPC it reports nil.
+func (e *RPCEncoding) RequestEncodingForMethod(method string) *RequestEncoding {
+	var wildcardOption *RequestEncoding
+
+	for _, reqEnc := range e.RequestEncoding {
+		for _, m := range reqEnc.HTTPMethods {
+			if strings.EqualFold(m, method) {
+				return reqEnc
+			}
+
+			if m == "*" {
+				wildcardOption = reqEnc
+			}
+		}
+	}
+	return wildcardOption
+}
+
+// AuthEncoding expresses how a response should be encoded on the wire.
+type AuthEncoding struct {
+	// LegacyTokenFormat specifies whether the auth encoding uses the legacy format of
+	// "just give us a token as a string". If true, the other parameters are all empty.
+	LegacyTokenFormat bool
+
+	// Contains metadata about how to marshal an HTTP parameter
+	HeaderParameters []*ParameterEncoding `json:"header_parameters"`
+	QueryParameters  []*ParameterEncoding `json:"query_parameters"`
+	CookieParameters []*ParameterEncoding `json:"cookie_parameters"`
+}
+
+// ParameterEncodingMap returns the parameter encodings as a map, keyed by SrcName.
+func (e *AuthEncoding) ParameterEncodingMap() map[string]*ParameterEncoding {
+	return toEncodingMap(srcNameKey, e.HeaderParameters, e.QueryParameters, e.CookieParameters)
+}
+
+// ParameterEncodingMapByName returns the parameter encodings as a map, keyed by Name.
+// Conflicts result in an undefined encoding getting set.
+func (e *AuthEncoding) ParameterEncodingMapByName() map[string][]*ParameterEncoding {
+	return toEncodingMultiMap(nameKey, e.HeaderParameters, e.QueryParameters, e.CookieParameters)
+}
+
+// ResponseEncoding expresses how a response should be encoded on the wire
+type ResponseEncoding struct {
+	// Contains metadata about how to marshal an HTTP parameter
+	HeaderParameters []*ParameterEncoding `json:"header_parameters"`
+	CookieParameters []*ParameterEncoding `json:"cookie_parameters"`
+	BodyParameters   []*ParameterEncoding `json:"body_parameters"`
+}
+
+// ParameterEncodingMap returns the parameter encodings as a map, keyed by SrcName.
+func (e *ResponseEncoding) ParameterEncodingMap() map[string]*ParameterEncoding {
+	return toEncodingMap(srcNameKey, e.HeaderParameters, e.CookieParameters, e.BodyParameters)
+}
+
+// ParameterEncodingMapByName returns the parameter encodings as a map, keyed by Name.
+// Conflicts result in an undefined encoding getting set.
+func (e *ResponseEncoding) ParameterEncodingMapByName() map[string][]*ParameterEncoding {
+	return toEncodingMultiMap(nameKey, e.HeaderParameters, e.CookieParameters, e.BodyParameters)
+}
+
+// RequestEncoding expresses how a request should be encoded for an explicit set of HTTPMethods
+type RequestEncoding struct {
+	// The HTTP methods these field configurations can be used for
+	HTTPMethods []string `json:"http_methods"`
+	// Contains metadata about how to marshal an HTTP parameter
+	HeaderParameters []*ParameterEncoding `json:"header_parameters"`
+	QueryParameters  []*ParameterEncoding `json:"query_parameters"`
+	CookieParameters []*ParameterEncoding `json:"cookie_parameters"`
+	BodyParameters   []*ParameterEncoding `json:"body_parameters"`
+}
+
+// ParameterEncodingMap returns the parameter encodings as a map, keyed by SrcName.
+func (e *RequestEncoding) ParameterEncodingMap() map[string]*ParameterEncoding {
+	return toEncodingMap(srcNameKey, e.HeaderParameters, e.QueryParameters, e.BodyParameters, e.CookieParameters)
+}
+
+// ParameterEncodingMapByName returns the parameter encodings as a map, keyed by Name.
+// Conflicts result in an undefined encoding getting set.
+func (e *RequestEncoding) ParameterEncodingMapByName() map[string][]*ParameterEncoding {
+	return toEncodingMultiMap(nameKey, e.HeaderParameters, e.QueryParameters, e.BodyParameters, e.CookieParameters)
+}
+
+// ParameterEncoding expresses how a parameter should be encoded on the wire
+type ParameterEncoding struct {
+	// The location specific name of the parameter (e.g. cheeseEater, cheese-eater, X-Cheese-Eater)
+	Name string `json:"name"`
+	// Location is the location this encoding is for.
+	Location ParameterLocation `json:"location"`
+	// OmitEmpty specifies whether the parameter should be omitted if it's empty.
+	OmitEmpty bool `json:"omit_empty"`
+	// SrcName is the name of the struct field
+	SrcName string `json:"src_name"`
+	// Doc is the documentation of the struct field
+	Doc string `json:"doc"`
+	// Type is the field's type description.
+	Type *schema.Type `json:"type"`
+	// RawTag specifies the raw, unparsed struct tag for the field.
+	RawTag string `json:"raw_tag"`
+	// WireFormat is the wire format of the parameter.
+	WireFormat string `json:"wire_format"`
+	// Optional indicates whether the field is optional.
+	Optional bool `json:"optional"`
+}
+
+type Options struct {
+	// SrcNameTag, if set, specifies which source tag should be used to determine
+	// the value of the SrcName field in the returned parameter descriptions.
+	//
+	// If the given SrcNameTag is not present on the field, SrcName will be set
+	// to the Go field name instead.
+	//
+	// If SrcNameTag is empty, SrcName is set to the Go field name.
+	SrcNameTag string
+}
+
+type APIEncoding struct {
+	Services      []*ServiceEncoding `json:"services"`
+	Authorization *AuthEncoding      `json:"authorization"`
+}
+
+type ServiceEncoding struct {
+	Name string         `json:"name"`
+	Doc  string         `json:"doc"`
+	RPCs []*RPCEncoding `json:"rpcs"`
+}
+
+func DescribeAPI(meta *meta.Data) *APIEncoding {
+	api := &APIEncoding{Services: make([]*ServiceEncoding, len(meta.Svcs))}
+	for i, s := range meta.Svcs {
+		api.Services[i] = DescribeService(meta, s)
+	}
+	if meta.AuthHandler == nil {
+		return api
+	}
+
+	var err error
+	api.Authorization, err = DescribeAuth(meta, meta.AuthHandler.Params, nil)
+	if err != nil {
+		panic(fmt.Sprintf("Invalid auth definition: %s: %v", meta.AuthHandler.Name, err))
+	}
+	return api
+}
+
+func findDoc(relPath string, meta *meta.Data) string {
+	for _, p := range meta.Pkgs {
+		if p.RelPath == relPath {
+			return p.Doc
+		}
+	}
+	return ""
+}
+
+func DescribeService(meta *meta.Data, svc *meta.Service) *ServiceEncoding {
+	service := &ServiceEncoding{Name: svc.Name, Doc: findDoc(svc.RelPath, meta), RPCs: make([]*RPCEncoding, len(svc.Rpcs))}
+	for i, r := range svc.Rpcs {
+		rpc, err := DescribeRPC(meta, r, nil)
+		if err != nil {
+			panic(fmt.Sprintf("invalid rpc: %v", err))
+		}
+		service.RPCs[i] = rpc
+	}
+	return service
+}
+
+// DescribeRPC expresses how to encode an RPCs request and response objects for the wire.
+func DescribeRPC(appMetaData *meta.Data, rpc *meta.RPC, options *Options) (*RPCEncoding, error) {
+	encoding := &RPCEncoding{
+		DefaultMethod: DefaultClientHttpMethod(rpc),
+		Name:          rpc.Name,
+		AccessType:    rpc.AccessType.String(),
+		Proto:         rpc.Proto.String(),
+		Path:          rpc.Path,
+		Doc:           rpc.GetDoc(),
+	}
+	var err error
+	// Work out the request encoding
+	encoding.RequestEncoding, err = DescribeRequest(appMetaData, rpc.RequestSchema, options, rpc.HttpMethods...)
+	if err != nil {
+		return nil, errors.Wrap(err, "request encoding")
+	}
+
+	// Work out the response encoding
+	encoding.ResponseEncoding, err = DescribeResponse(appMetaData, rpc.ResponseSchema, options)
+	if err != nil {
+		return nil, errors.Wrap(err, "request encoding")
+	}
+
+	if encoding.RequestEncoding != nil {
+		// Setup the default request encoding
+		defaultEncoding := encoding.RequestEncodingForMethod(encoding.DefaultMethod)
+		encoding.DefaultRequestEncoding = &RequestEncoding{
+			HTTPMethods:      []string{encoding.DefaultMethod},
+			HeaderParameters: defaultEncoding.HeaderParameters,
+			BodyParameters:   defaultEncoding.BodyParameters,
+			QueryParameters:  defaultEncoding.QueryParameters,
+			CookieParameters: defaultEncoding.CookieParameters,
+		}
+	}
+
+	return encoding, nil
+}
+
+// GetConcreteStructType returns a construct Struct object for the given schema. This means any generic types
+// in the struct will be resolved to their concrete types and there will be no generic parameters in the struct object.
+// However, any nested structs may still contain generic types.
+//
+// If a nil schema is provided, a nil struct is returned.
+func GetConcreteStructType(appDecls []*schema.Decl, typ *schema.Type, typeArgs []*schema.Type) (*schema.Struct, error) {
+	// dereference pointers
+	pointer := typ.GetPointer()
+	for pointer != nil {
+		typ = pointer.Base
+		pointer = typ.GetPointer()
+	}
+
+	typ, err := GetConcreteType(appDecls, typ, typeArgs)
+	if err != nil {
+		return nil, err
+	}
+
+	struc := typ.GetStruct()
+	if struc == nil {
+		return nil, errors.Newf("unsupported type %+v", reflect.TypeOf(typ.Typ))
+	}
+
+	return struc, nil
+}
+
+// GetConcreteType returns a concrete type for the given schema. This means any generic types
+// in the top level type will be resolved to their concrete types and there will be no generic parameters in returned typ.
+// However, any nested types may still contain generic types.
+//
+// If a nil schema is provided, a nil is returned.
+func GetConcreteType(appDecls []*schema.Decl, originalType *schema.Type, typeArgs []*schema.Type) (*schema.Type, error) {
+	if originalType == nil {
+		// If there's no schema type, we want to shortcut
+		return nil, nil
+	}
+
+	switch typ := originalType.Typ.(type) {
+	case *schema.Type_Struct:
+		// If there are no type arguments, we've got a concrete type
+		if len(typeArgs) == 0 {
+			return originalType, nil
+		}
+
+		// Deep copy the original struct
+		struc, ok := proto.Clone(typ.Struct).(*schema.Struct)
+		if !ok {
+			return nil, errors.New("failed to clone struct")
+		}
+
+		// replace any type parameters with the type argument
+		for _, field := range struc.Fields {
+			field.Typ = resolveTypeParams(field.Typ, typeArgs)
+		}
+
+		return &schema.Type{Typ: &schema.Type_Struct{Struct: struc}}, nil
+
+	case *schema.Type_Map:
+		// If there are no type arguments, we've got a concrete type
+		if len(typeArgs) == 0 {
+			return originalType, nil
+		}
+
+		// Deep copy the original struct
+		mapType, ok := proto.Clone(typ.Map).(*schema.Map)
+		if !ok {
+			return nil, errors.New("failed to clone map")
+		}
+
+		return resolveTypeParams(&schema.Type{Typ: &schema.Type_Map{Map: mapType}}, typeArgs), nil
+
+	case *schema.Type_Union:
+		// If there are no type arguments, we've got a concrete type
+		if len(typeArgs) == 0 {
+			return originalType, nil
+		}
+
+		types := make([]*schema.Type, len(typ.Union.Types))
+		for i, t := range typ.Union.Types {
+			// Deep copy the type
+			cloned := proto.Clone(t).(*schema.Type)
+			types[i] = resolveTypeParams(cloned, typeArgs)
+		}
+
+		return &schema.Type{Typ: &schema.Type_Union{
+			Union: &schema.Union{
+				Types: types,
+			},
+		}}, nil
+
+	case *schema.Type_List:
+		// If there are no type arguments, we've got a concrete type
+		if len(typeArgs) == 0 {
+			return originalType, nil
+		}
+
+		// Deep copy the original struct
+		list, ok := proto.Clone(typ.List).(*schema.List)
+		if !ok {
+			return nil, errors.New("failed to clone list type")
+		}
+
+		// replace any type parameters with the type argument
+		return resolveTypeParams(&schema.Type{Typ: &schema.Type_List{List: list}}, typeArgs), nil
+
+	case *schema.Type_Pointer:
+		// If there are no type arguments, we've got a concrete type
+		if len(typeArgs) == 0 {
+			return originalType, nil
+		}
+
+		// Deep copy the original struct
+		pointer, ok := proto.Clone(typ.Pointer).(*schema.Pointer)
+		if !ok {
+			return nil, errors.New("failed to clone pointer type")
+		}
+
+		var err error
+		pointer.Base, err = GetConcreteType(appDecls, pointer.Base, typeArgs)
+		if err != nil {
+			return nil, err
+		}
+
+		// replace any type parameters with the type argument
+		return resolveTypeParams(&schema.Type{Typ: &schema.Type_Pointer{Pointer: pointer}}, typeArgs), nil
+
+	case *schema.Type_Config:
+		// If there are no type arguments, we've got a concrete type
+		if len(typeArgs) == 0 {
+			return originalType, nil
+		}
+
+		// Deep copy the original struct
+		config, ok := proto.Clone(typ.Config).(*schema.ConfigValue)
+		if !ok {
+			return nil, errors.New("failed to clone config type")
+		}
+
+		// replace any type parameters with the type argument
+		return resolveTypeParams(&schema.Type{Typ: &schema.Type_Config{Config: config}}, typeArgs), nil
+
+	case *schema.Type_Named:
+		decl := appDecls[typ.Named.Id]
+		return GetConcreteType(appDecls, decl.Type, typ.Named.TypeArguments)
+
+	case *schema.Type_Builtin:
+		return originalType, nil
+
+	case *schema.Type_Literal:
+		return originalType, nil
+
+	default:
+		return nil, errors.Newf("unsupported type %+v", reflect.TypeOf(typ))
+	}
+}
+
+// resolveTypeParams resolves any type parameters in the given type to the given type arguments.
+// only at the top level object - so nested type arguments are not resolved
+func resolveTypeParams(typ *schema.Type, typeArgs []*schema.Type) *schema.Type {
+	switch t := typ.Typ.(type) {
+	case *schema.Type_TypeParameter:
+		return typeArgs[t.TypeParameter.ParamIdx]
+
+	case *schema.Type_Struct:
+		for _, field := range t.Struct.Fields {
+			field.Typ = resolveTypeParams(field.Typ, typeArgs)
+		}
+
+	case *schema.Type_List:
+		t.List.Elem = resolveTypeParams(t.List.Elem, typeArgs)
+
+	case *schema.Type_Map:
+		t.Map.Key = resolveTypeParams(t.Map.Key, typeArgs)
+		t.Map.Value = resolveTypeParams(t.Map.Value, typeArgs)
+
+	case *schema.Type_Config:
+		t.Config.Elem = resolveTypeParams(t.Config.Elem, typeArgs)
+
+	case *schema.Type_Pointer:
+		t.Pointer.Base = resolveTypeParams(t.Pointer.Base, typeArgs)
+
+	case *schema.Type_Named:
+		for i, param := range t.Named.TypeArguments {
+			t.Named.TypeArguments[i] = resolveTypeParams(param, typeArgs)
+		}
+	}
+
+	return typ
+}
+
+// DefaultClientHttpMethod works out the default HTTP method a client should use for a given RPC.
+// When possible we will default to POST either when no method has been specified on the API or when
+// then is a selection of methods and POST is one of them. If POST is not allowed as a method then
+// we will use the first specified method.
+func DefaultClientHttpMethod(rpc *meta.RPC) string {
+	if rpc.HttpMethods[0] == "*" {
+		return "POST"
+	}
+
+	for _, httpMethod := range rpc.HttpMethods {
+		if httpMethod == "POST" {
+			return "POST"
+		}
+	}
+
+	return rpc.HttpMethods[0]
+
+}
+
+// DescribeAuth generates a ParameterEncoding per field of the auth struct and returns it as
+// the AuthEncoding. If authSchema is nil it returns nil, nil.
+func DescribeAuth(appMetaData *meta.Data, authSchema *schema.Type, options *Options) (*AuthEncoding, error) {
+	if authSchema == nil {
+		return nil, nil
+	}
+
+	switch t := authSchema.Typ.(type) {
+	case *schema.Type_Builtin:
+		if t.Builtin != schema.Builtin_STRING {
+			return nil, errors.Newf("unsupported auth parameter %v", errors.Safe(t.Builtin))
+		}
+		return &AuthEncoding{LegacyTokenFormat: true}, nil
+	case *schema.Type_Named:
+	case *schema.Type_Pointer:
+	default:
+		return nil, errors.Newf("unsupported auth parameter type %T", errors.Safe(t))
+	}
+
+	authStruct, err := GetConcreteStructType(appMetaData.Decls, authSchema, nil)
+	if err != nil {
+		return nil, errors.Wrap(err, "auth struct")
+	}
+	fields, err := describeParams(appMetaData.Language, &encodingHints{Undefined, authTags, options}, authStruct)
+	if err != nil {
+		return nil, err
+	}
+	if locationDiff := keyDiff(fields, Header, Query, Cookie); len(locationDiff) > 0 {
+		return nil, errors.Newf("auth must only contain query, header, and cookie parameters. Found: %v", locationDiff)
+	}
+	return &AuthEncoding{
+		QueryParameters:  fields[Query],
+		HeaderParameters: fields[Header],
+		CookieParameters: fields[Cookie],
+	}, nil
+}
+
+// DescribeResponse generates a ParameterEncoding per field of the response struct and returns it as
+// the ResponseEncoding
+func DescribeResponse(appMetaData *meta.Data, responseSchema *schema.Type, options *Options) (*ResponseEncoding, error) {
+	if responseSchema == nil {
+		return nil, nil
+	}
+	responseStruct, err := GetConcreteStructType(appMetaData.Decls, responseSchema, nil)
+	if err != nil {
+		return nil, errors.Wrap(err, "response struct")
+	}
+	fields, err := describeParams(appMetaData.Language, &encodingHints{Body, responseTags, options}, responseStruct)
+	if err != nil {
+		return nil, err
+	}
+	if keys := keyDiff(fields, Header, Body, Cookie); len(keys) > 0 {
+		return nil, errors.Newf("response must only contain body, header and cookie parameters. Found: %v", keys)
+	}
+	return &ResponseEncoding{
+		BodyParameters:   fields[Body],
+		HeaderParameters: fields[Header],
+		CookieParameters: fields[Cookie],
+	}, nil
+}
+
+// keyDiff returns the diff between src.keys and keys
+func keyDiff[T comparable, V any](src map[T]V, keys ...T) (diff []T) {
+	for k := range src {
+		if !slices.Contains(keys, k) {
+			diff = append(diff, k)
+		}
+	}
+	return diff
+}
+
+// DescribeRequest groups the provided httpMethods by default ParameterLocation and returns a RequestEncoding
+// per ParameterLocation
+func DescribeRequest(appMetaData *meta.Data, requestSchema *schema.Type, options *Options, httpMethods ...string) ([]*RequestEncoding, error) {
+	methodsByDefaultLocation := make(map[ParameterLocation][]string)
+	for _, m := range httpMethods {
+		switch m {
+		case "GET", "HEAD", "DELETE":
+			methodsByDefaultLocation[Query] = append(methodsByDefaultLocation[Query], m)
+		case "*":
+			methodsByDefaultLocation[Body] = []string{"POST", "PUT", "PATCH"}
+			methodsByDefaultLocation[Query] = []string{"GET", "HEAD", "DELETE"}
+		default:
+			methodsByDefaultLocation[Body] = append(methodsByDefaultLocation[Body], m)
+		}
+	}
+
+	var requestStruct *schema.Struct
+	var err error
+	if requestSchema != nil {
+		requestStruct, err = GetConcreteStructType(appMetaData.Decls, requestSchema, nil)
+		if err != nil {
+			return nil, errors.Wrap(err, "request struct")
+		}
+	}
+
+	var reqs []*RequestEncoding
+	for location, methods := range methodsByDefaultLocation {
+		var fields map[ParameterLocation][]*ParameterEncoding
+
+		if requestStruct != nil {
+			fields, err = describeParams(appMetaData.Language, &encodingHints{location, requestTags, options}, requestStruct)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		if keys := keyDiff(fields, Query, Header, Body, Cookie); len(keys) > 0 {
+			return nil, errors.Newf("request must only contain Query, Body, Header and Cookie parameters. Found: %v", keys)
+		}
+		reqs = append(reqs, &RequestEncoding{
+			HTTPMethods:      methods,
+			QueryParameters:  fields[Query],
+			HeaderParameters: fields[Header],
+			CookieParameters: fields[Cookie],
+			BodyParameters:   fields[Body],
+		})
+	}
+
+	// Sort by first method to get a deterministic order (list is randomized by map above)
+	sort.Slice(reqs, func(i, j int) bool {
+		return reqs[i].HTTPMethods[0] < reqs[j].HTTPMethods[0]
+	})
+	return reqs, nil
+}
+
+// describeParams calls describeParam() for each field in the payload struct
+func describeParams(lang meta.Lang, encodingHints *encodingHints, payload *schema.Struct) (fields map[ParameterLocation][]*ParameterEncoding, err error) {
+	paramByLocation := make(map[ParameterLocation][]*ParameterEncoding)
+	for _, f := range payload.GetFields() {
+		f, err := describeParam(lang, encodingHints, f)
+		if err != nil {
+			return nil, err
+		}
+
+		if f != nil {
+			paramByLocation[f.Location] = append(paramByLocation[f.Location], f)
+		}
+	}
+	return paramByLocation, nil
+}
+
+// formatName formats a parameter name with the default formatting for the location (e.g. snakecase for query)
+func formatName(lang meta.Lang, location ParameterLocation, name string) string {
+	if location == Query && lang == meta.Lang_GO {
+		return idents.Convert(name, idents.SnakeCase)
+	}
+
+	return name
+}
+
+// IgnoreField returns true if the field name is "-" is any of the valid request or response tags
+// or if the field is marked with encore:"httpstatus" (which shouldn't appear in client types)
+func IgnoreField(field *schema.Field) bool {
+	for _, tag := range field.Tags {
+		if _, found := requestTags[tag.Key]; found && tag.Name == "-" {
+			return true
+		}
+		// Skip fields with encore:"httpstatus" tag - they're for internal HTTP status handling only
+		if tag.Key == "encore" && tag.Name == "httpstatus" {
+			return true
+		}
+	}
+	return false
+}
+
+// describeParam returns the ParameterEncoding which uses field tags to describe how the parameter
+// (e.g. qs, query, header) should be encoded in HTTP (name and location).
+//
+// It returns nil, nil if the field is not to be encoded.
+func describeParam(lang meta.Lang, encodingHints *encodingHints, field *schema.Field) (*ParameterEncoding, error) {
+	location := encodingHints.defaultLocation
+	name := formatName(lang, encodingHints.defaultLocation, field.Name)
+	param := ParameterEncoding{
+		Name:       name,
+		OmitEmpty:  false,
+		SrcName:    field.Name,
+		Doc:        field.Doc,
+		Type:       field.Typ,
+		RawTag:     field.RawTag,
+		Optional:   field.Optional,
+		WireFormat: name,
+	}
+
+	var usedOverrideTag string
+	for _, tag := range field.Tags {
+		if IgnoreField(field) {
+			return nil, nil
+		}
+
+		tagHint, ok := encodingHints.tags[tag.Key]
+		if !ok {
+			continue
+		}
+
+		if tagHint.overrideDefault {
+			if usedOverrideTag != "" {
+				return nil, errors.Newf("tag conflict: %s cannot be combined with %s", usedOverrideTag, tag.Key)
+			}
+			location = tagHint.location
+			usedOverrideTag = tag.Key
+		}
+		if tagHint.location == location {
+			param.Name = tag.Name
+			if tagHint.wireFormatter != nil {
+				param.WireFormat = tagHint.wireFormatter(tag.Name)
+			} else {
+				param.WireFormat = tag.Name
+			}
+		}
+		if tagHint.omitEmptyOption != "" {
+			for _, o := range tag.Options {
+				if o == tagHint.omitEmptyOption {
+					param.OmitEmpty = true
+				}
+			}
+		}
+		if encodingHints.options != nil && tag.Key == encodingHints.options.SrcNameTag {
+			param.SrcName = tag.Name
+		}
+	}
+
+	if param.Name == "-" {
+		return nil, nil
+	}
+
+	param.Location = location
+	return &param, nil
+}
+
+// toEncodingMap returns a map from SrcName to parameter encodings.
+func toEncodingMap(keyFunc func(e *ParameterEncoding) string, encodings ...[]*ParameterEncoding) map[string]*ParameterEncoding {
+	res := make(map[string]*ParameterEncoding)
+	for _, e := range encodings {
+		for _, param := range e {
+			res[keyFunc(param)] = param
+		}
+	}
+	return res
+}
+
+// toEncodingMultiMap returns a map from a key to the list of parameter encodings
+// matching that key.
+func toEncodingMultiMap(keyFunc func(e *ParameterEncoding) string, encodings ...[]*ParameterEncoding) map[string][]*ParameterEncoding {
+	res := make(map[string][]*ParameterEncoding)
+	for _, e := range encodings {
+		for _, param := range e {
+			key := keyFunc(param)
+			res[key] = append(res[key], param)
+		}
+	}
+	return res
+}
+
+func srcNameKey(e *ParameterEncoding) string {
+	return e.SrcName
+}
+
+func nameKey(e *ParameterEncoding) string {
+	return e.Name
+}
diff --git a/parser/errs.go b/parser/errs.go
deleted file mode 100644
index 7012c2a9f6..0000000000
--- a/parser/errs.go
+++ /dev/null
@@ -1,40 +0,0 @@
-package parser
-
-import (
-	"fmt"
-	"go/scanner"
-	"go/token"
-	"path/filepath"
-	"strings"
-)
-
-type bailout struct{}
-
-func (p *parser) err(pos token.Pos, msg string) {
-	pp := p.fset.Position(pos)
-	n := len(p.errors)
-	if n > 0 && p.errors[n-1].Pos.Line == pp.Line {
-		return // spurious
-	} else if n > 10 {
-		panic(bailout{})
-	}
-	p.errors.Add(pp, msg)
-}
-
-func (p *parser) errf(pos token.Pos, format string, args ...interface{}) {
-	p.err(pos, fmt.Sprintf(format, args...))
-}
-
-// makeErrsRelative goes through the errors and tweaks the filename to be relative
-// to the relwd.
-func makeErrsRelative(errs scanner.ErrorList, root, relwd string) {
-	wdroot := filepath.Join(root, relwd)
-	for _, e := range errs {
-		fn := e.Pos.Filename
-		if strings.HasPrefix(fn, root) {
-			if rel, err := filepath.Rel(wdroot, fn); err == nil {
-				e.Pos.Filename = rel
-			}
-		}
-	}
-}
diff --git a/parser/est/est.go b/parser/est/est.go
deleted file mode 100644
index ba63596975..0000000000
--- a/parser/est/est.go
+++ /dev/null
@@ -1,107 +0,0 @@
-// Package est provides the Encore Syntax Tree (EST).
-//
-// It is an Encore-specific syntax tree that represents the higher-level representation
-// of the application that Encore understands.
-package est
-
-import (
-	"go/ast"
-	"go/token"
-
-	schema "encr.dev/proto/encore/parser/schema/v1"
-)
-
-type Application struct {
-	ModulePath  string
-	Packages    []*Package
-	Services    []*Service
-	Decls       []*schema.Decl
-	AuthHandler *AuthHandler
-}
-
-type File struct {
-	Name       string   // file name ("foo.go")
-	Pkg        *Package // package it belongs to
-	Path       string   // filesystem path
-	AST        *ast.File
-	Token      *token.File
-	Contents   []byte
-	References map[ast.Node]*Node
-}
-
-type Package struct {
-	AST        *ast.Package
-	Name       string
-	Doc        string
-	ImportPath string // import path
-	RelPath    string // import path relative to app root
-	Dir        string // filesystem path
-	Files      []*File
-	Service    *Service // the service this package belongs to, if any
-	Secrets    []string
-}
-
-// A Service is a Go package that defines one or more RPCs.
-// Its name is defined by the Go package name.
-// A Service may not be a located in a child directory of another service.
-type Service struct {
-	Name string
-	Root *Package
-	Pkgs []*Package
-	RPCs []*RPC
-}
-
-type Param struct {
-	IsPtr bool
-	Decl  *schema.Decl
-}
-
-type AccessType string
-
-const (
-	Public  AccessType = "public"
-	Private AccessType = "private"
-	// Auth is like public but requires authentication.
-	Auth AccessType = "auth"
-)
-
-type RPC struct {
-	Svc      *Service
-	Name     string
-	Doc      string
-	Func     *ast.FuncDecl
-	File     *File
-	Access   AccessType
-	Raw      bool
-	Request  *Param // request data; nil for Raw RPCs
-	Response *Param // response data; nil for Raw RPCs
-}
-
-type NodeType int
-
-const (
-	RPCDefNode NodeType = iota + 1
-	RPCCallNode
-	SQLDBNode
-	RLogNode
-	SecretsNode
-)
-
-type Node struct {
-	Type NodeType
-	// If Type == RPCDefNode or RPCCallNode,
-	// RPC is the RPC being defined or called.
-	RPC *RPC
-	// If Type == SQLDBNode or RLogNode,
-	// Func is the func name being called.
-	Func string
-}
-
-type AuthHandler struct {
-	Svc      *Service
-	Name     string
-	Doc      string
-	Func     *ast.FuncDecl
-	File     *File
-	AuthData *Param // or nil
-}
diff --git a/parser/internal/names/names.go b/parser/internal/names/names.go
deleted file mode 100644
index 887bc1c4d8..0000000000
--- a/parser/internal/names/names.go
+++ /dev/null
@@ -1,604 +0,0 @@
-package names
-
-import (
-	"fmt"
-	"go/ast"
-	"go/build"
-	"go/scanner"
-	"go/token"
-	pathpkg "path"
-	"strconv"
-
-	"encr.dev/parser/est"
-)
-
-// TrackedPackages defines the set of packages to track,
-// defined as a map from import path to package name.
-//
-// It is used to allow Resolve to efficiently determine
-// the name of a package given its import path, as one
-// otherwise needs to parse the package source to find it.
-type TrackedPackages map[string]string
-
-// Resolution represents the name resolution results.
-type Resolution struct {
-	Decls map[string]*PkgDecl // package-level declarations, keyed by name
-	Files map[*est.File]*File
-}
-
-// PkgDecl provides metadata for a package-level declaration.
-type PkgDecl struct {
-	Name string
-	File *est.File
-	Pos  token.Pos
-	Type token.Token   // CONST, TYPE, VAR, FUNC
-	Func *ast.FuncDecl // for Type == FUNC
-	Spec ast.Spec      // for other types
-	Doc  string
-}
-
-// File provides file-level name resolution results.
-type File struct {
-	PathToName map[string]string    // path -> local name
-	NameToPath map[string]string    // local name -> path
-	Idents     map[*ast.Ident]*Name // ident -> resolved
-	Calls      []*ast.CallExpr
-}
-
-// Name provides metadata for a single identifier.
-type Name struct {
-	Package    bool   // package symbol
-	Local      bool   // locally defined symbol
-	ImportPath string // non-zero indicates it resolves to the package with the given import path
-}
-
-// Resolve resolves information about the names (idents) in the given package.
-// The reported error is of type scanner.ErrorList if non-nil.
-func Resolve(fset *token.FileSet, track TrackedPackages, pkg *est.Package) (*Resolution, error) {
-	res := &Resolution{
-		Decls: make(map[string]*PkgDecl),
-		Files: make(map[*est.File]*File),
-	}
-
-	pkgNames, pkgScope := collectPackageObjects(pkg)
-	res.Decls = pkgNames
-
-	var errors scanner.ErrorList
-	for _, file := range pkg.Files {
-		f := &File{
-			PathToName: make(map[string]string),
-			NameToPath: make(map[string]string),
-			Idents:     make(map[*ast.Ident]*Name),
-		}
-		res.Files[file] = f
-		r := resolver{
-			File:  f,
-			fset:  fset,
-			track: track,
-			scope: pkgScope,
-		}
-		if err := r.Process(file); err != nil {
-			if e, ok := err.(*scanner.Error); ok {
-				errors = append(errors, e)
-			} else {
-				errors.Add(fset.Position(file.AST.Pos()), err.Error())
-			}
-		}
-	}
-	return res, errors.Err()
-}
-
-// collectPackageObjects collects all package-level objects from the given files.
-func collectPackageObjects(pkg *est.Package) (map[string]*PkgDecl, *scope) {
-	decls := make(map[string]*PkgDecl)
-	scope := newScope(nil)
-
-	for _, f := range pkg.Files {
-		for _, d := range f.AST.Decls {
-			switch d := d.(type) {
-			case *ast.FuncDecl:
-				if d.Recv == nil {
-					scope.Insert(d.Name.Name, &Name{Package: true})
-					decls[d.Name.Name] = &PkgDecl{
-						Name: d.Name.Name,
-						File: f,
-						Pos:  d.Name.Pos(),
-						Type: token.FUNC,
-						Func: d,
-						Doc:  d.Doc.Text(),
-					}
-
-				}
-			case *ast.GenDecl:
-				for _, spec := range d.Specs {
-					var doc string
-					switch spec := spec.(type) {
-					case *ast.ValueSpec:
-						doc = spec.Doc.Text()
-					case *ast.TypeSpec:
-						doc = spec.Doc.Text()
-					}
-					if doc == "" && len(d.Specs) == 1 {
-						doc = d.Doc.Text()
-					}
-
-					switch spec := spec.(type) {
-					case *ast.ImportSpec:
-						// Skip, file-level
-					case *ast.ValueSpec:
-						for _, name := range spec.Names {
-							scope.Insert(name.Name, &Name{Package: true})
-							decls[name.Name] = &PkgDecl{
-								Name: name.Name,
-								File: f,
-								Pos:  name.Pos(),
-								Type: d.Tok,
-								Spec: spec,
-								Doc:  doc,
-							}
-						}
-					case *ast.TypeSpec:
-						scope.Insert(spec.Name.Name, &Name{Package: true})
-						decls[spec.Name.Name] = &PkgDecl{
-							Name: spec.Name.Name,
-							File: f,
-							Pos:  spec.Name.Pos(),
-							Type: d.Tok,
-							Spec: spec,
-							Doc:  doc,
-						}
-					}
-				}
-			}
-		}
-	}
-	return decls, scope
-}
-
-type resolver struct {
-	*File
-	pkg   *est.Package
-	fset  *token.FileSet
-	track TrackedPackages
-	scope *scope
-}
-
-func (r *resolver) Process(f *est.File) error {
-	if err := r.processImports(f); err != nil {
-		return err
-	}
-	for _, decl := range f.AST.Decls {
-		switch decl := decl.(type) {
-		case *ast.GenDecl:
-			for _, spec := range decl.Specs {
-				switch spec := spec.(type) {
-				case *ast.ValueSpec:
-					for _, name := range spec.Names {
-						r.ident(name)
-					}
-					r.exprList(spec.Values)
-					r.expr(spec.Type)
-				case *ast.TypeSpec:
-					r.expr(spec.Type)
-					r.expr(spec.Type)
-				}
-			}
-
-		case *ast.FuncDecl:
-			r.funcDecl(decl)
-		}
-	}
-	return nil
-}
-
-// processImports finds the file-local names of imports we care about.
-// The name mapping is stored in r.File.PathToName and r.File.NameToPath.
-func (r *resolver) processImports(f *est.File) error {
-	for _, decl := range f.AST.Decls {
-		gd, ok := decl.(*ast.GenDecl)
-		if !ok || gd.Tok != token.IMPORT {
-			continue
-		}
-		for _, spec := range gd.Specs {
-			is := spec.(*ast.ImportSpec)
-			path, err := strconv.Unquote(is.Path.Value)
-			if err != nil {
-				return &scanner.Error{
-					Pos: r.fset.Position(is.Path.Pos()),
-					Msg: "invalid import path " + is.Path.Value,
-				}
-			}
-			if build.IsLocalImport(path) {
-				path = pathpkg.Join(r.pkg.ImportPath, path)
-			}
-			if pkgName := r.track[path]; pkgName != "" {
-				if is.Name != nil {
-					if is.Name.Name == "." {
-						return &scanner.Error{
-							Pos: r.fset.Position(is.Name.Pos()),
-							Msg: "cannot use dot import of Encore-related packages",
-						}
-					}
-					pkgName = is.Name.Name
-				}
-				if p2 := r.NameToPath[pkgName]; p2 != "" {
-					return &scanner.Error{
-						Pos: r.fset.Position(is.Path.Pos()),
-						Msg: fmt.Sprintf("name %s already declared (import of package %s)", pkgName, p2),
-					}
-				}
-				r.PathToName[path] = pkgName
-				r.NameToPath[pkgName] = path
-			}
-		}
-	}
-	return nil
-}
-
-func (r *resolver) funcDecl(fd *ast.FuncDecl) {
-	r.openScope()
-	defer r.closeScope()
-
-	// First resolve types before introducing names
-	for _, param := range fd.Type.Params.List {
-		r.expr(param.Type)
-	}
-	if fd.Type.Results != nil {
-		for _, result := range fd.Type.Results.List {
-			r.expr(result.Type)
-		}
-	}
-
-	if fd.Recv != nil {
-		for _, field := range fd.Recv.List {
-			for _, name := range field.Names {
-				r.scope.Insert(name.Name, &Name{Local: true})
-			}
-		}
-	}
-	for _, field := range fd.Type.Params.List {
-		for _, name := range field.Names {
-			r.scope.Insert(name.Name, &Name{Local: true})
-		}
-	}
-	if fd.Type.Results != nil {
-		for _, field := range fd.Type.Results.List {
-			for _, name := range field.Names {
-				r.scope.Insert(name.Name, &Name{Local: true})
-			}
-		}
-	}
-	if fd.Body != nil {
-		r.stmtList(fd.Body.List)
-	}
-}
-
-func (r *resolver) stmt(stmt ast.Stmt) {
-	if stmt == nil {
-		return
-	}
-
-	switch stmt := stmt.(type) {
-	case *ast.AssignStmt:
-		r.exprList(stmt.Rhs)
-		for _, lhs := range stmt.Lhs {
-			if id, ok := lhs.(*ast.Ident); ok && stmt.Tok == token.DEFINE {
-				r.define(id, &Name{Local: true})
-			}
-		}
-
-	case *ast.BlockStmt:
-		r.openScope()
-		defer r.closeScope()
-		r.stmtList(stmt.List)
-
-	case *ast.DeclStmt:
-		decl := stmt.Decl.(*ast.GenDecl)
-		for _, spec := range decl.Specs {
-			switch spec := spec.(type) {
-			case *ast.ValueSpec:
-				r.exprList(spec.Values)
-				r.expr(spec.Type)
-				for _, name := range spec.Names {
-					r.define(name, &Name{Local: true})
-				}
-			case *ast.TypeSpec:
-				r.expr(spec.Type)
-				r.define(spec.Name, &Name{Local: true})
-			}
-		}
-
-	case *ast.DeferStmt:
-		r.expr(stmt.Call)
-
-	case *ast.ExprStmt:
-		r.expr(stmt.X)
-
-	case *ast.ForStmt:
-		r.openScope()
-		defer r.closeScope()
-		r.stmt(stmt.Init)
-		r.expr(stmt.Cond)
-		r.stmt(stmt.Post)
-		r.stmt(stmt.Body)
-
-	case *ast.GoStmt:
-		r.expr(stmt.Call)
-
-	case *ast.IfStmt:
-		r.openScope()
-		defer r.closeScope()
-		r.stmt(stmt.Init)
-		r.expr(stmt.Cond)
-		r.stmt(stmt.Body)
-		r.stmt(stmt.Else)
-
-	case *ast.IncDecStmt:
-		r.expr(stmt.X)
-
-	case *ast.LabeledStmt:
-		r.stmt(stmt.Stmt)
-
-	case *ast.RangeStmt:
-		r.openScope()
-		defer r.closeScope()
-		r.expr(stmt.X)
-		r.expr(stmt.Key)
-		r.expr(stmt.Value)
-		r.stmt(stmt.Body)
-
-	case *ast.ReturnStmt:
-		r.exprList(stmt.Results)
-
-	case *ast.SelectStmt:
-		r.stmtList(stmt.Body.List)
-
-	case *ast.SendStmt:
-		r.expr(stmt.Value)
-		r.expr(stmt.Chan)
-
-	case *ast.SwitchStmt:
-		r.openScope()
-		defer r.closeScope()
-		r.stmt(stmt.Init)
-		r.expr(stmt.Tag)
-		r.stmt(stmt.Body)
-
-	case *ast.TypeSwitchStmt:
-		r.openScope()
-		defer r.closeScope()
-		r.stmt(stmt.Init)
-		r.stmt(stmt.Assign)
-		r.stmt(stmt.Body)
-
-	case *ast.CommClause:
-		r.openScope()
-		defer r.closeScope()
-		r.stmt(stmt.Comm)
-		r.stmtList(stmt.Body)
-
-	case *ast.CaseClause:
-		r.exprList(stmt.List)
-		r.openScope()
-		defer r.closeScope()
-		r.stmtList(stmt.Body)
-
-	case *ast.BadStmt, *ast.BranchStmt, *ast.EmptyStmt:
-		// do nothing
-
-	default:
-		panic(fmt.Sprintf("unhandled ast.Stmt type: %T", stmt))
-	}
-}
-
-func (r *resolver) expr(expr ast.Expr) {
-	if expr == nil {
-		return
-	}
-
-	switch expr := expr.(type) {
-	case *ast.Ident:
-		r.ident(expr)
-
-	case *ast.Ellipsis:
-		r.expr(expr.Elt)
-
-	case *ast.FuncLit:
-		r.openScope()
-		defer r.closeScope()
-
-		// First resolve types before introducing names
-		for _, param := range expr.Type.Params.List {
-			r.expr(param.Type)
-		}
-		if expr.Type.Results != nil {
-			for _, result := range expr.Type.Results.List {
-				r.expr(result.Type)
-			}
-		}
-
-		for _, field := range expr.Type.Params.List {
-			for _, name := range field.Names {
-				r.define(name, &Name{Local: true})
-			}
-		}
-		if expr.Type.Results != nil {
-			for _, field := range expr.Type.Results.List {
-				for _, name := range field.Names {
-					r.define(name, &Name{Local: true})
-				}
-			}
-		}
-		if expr.Body != nil {
-			r.stmt(expr.Body)
-		}
-
-	case *ast.CompositeLit:
-		r.expr(expr.Type)
-		r.exprList(expr.Elts)
-
-	case *ast.ParenExpr:
-		r.expr(expr.X)
-
-	case *ast.SelectorExpr:
-		r.expr(expr.X)
-		r.expr(expr.Sel)
-
-	case *ast.IndexExpr:
-		r.expr(expr.X)
-		r.expr(expr.Index)
-
-	case *ast.SliceExpr:
-		r.expr(expr.X)
-		r.expr(expr.Low)
-		r.expr(expr.High)
-		r.expr(expr.Max)
-
-	case *ast.TypeAssertExpr:
-		r.expr(expr.X)
-		r.expr(expr.Type)
-
-	case *ast.CallExpr:
-		r.Calls = append(r.Calls, expr)
-		r.expr(expr.Fun)
-		r.exprList(expr.Args)
-
-	case *ast.StarExpr:
-		r.expr(expr.X)
-
-	case *ast.UnaryExpr:
-		r.expr(expr.X)
-
-	case *ast.BinaryExpr:
-		r.expr(expr.X)
-		r.expr(expr.Y)
-
-	case *ast.KeyValueExpr:
-		// HACK: We want to track uses of functions. This is tricky because
-		// struct types use keys that are idents that refer to the struct field,
-		// while map types can use keys to refer to idents in scope.
-		//
-		// Unfortunately We cannot easily know the type of the composite literal
-		// without typechecking. However, funcs are incomparable and therefore
-		// are not valid as map keys. So let's simply avoid tracking idents
-		// in the keys, and rely on the compiler to eventually catch this for us.
-		if _, ok := expr.Key.(*ast.Ident); !ok {
-			r.expr(expr.Key)
-		}
-		r.expr(expr.Value)
-
-	case *ast.ArrayType:
-		r.expr(expr.Len)
-		r.expr(expr.Elt)
-
-	case *ast.StructType:
-		for _, field := range expr.Fields.List {
-			r.expr(field.Type)
-			// Don't look at names; they don't resolve to outside scope
-		}
-
-	case *ast.FuncType:
-		for _, field := range expr.Params.List {
-			r.expr(field.Type)
-			// Don't look at names; they don't resolve to outside scope
-		}
-		if expr.Results != nil {
-			for _, field := range expr.Results.List {
-				r.expr(field.Type)
-				// Don't look at names; they don't resolve to outside scope
-			}
-		}
-
-	case *ast.InterfaceType:
-		for _, field := range expr.Methods.List {
-			r.expr(field.Type)
-			// Don't look at names; they don't resolve to outside scope
-		}
-
-	case *ast.MapType:
-		r.expr(expr.Key)
-		r.expr(expr.Value)
-
-	case *ast.ChanType:
-		r.expr(expr.Value)
-
-	case *ast.BadExpr, *ast.BasicLit:
-		// do nothing
-
-	default:
-		panic(fmt.Sprintf("unhandled ast.Expr type: %T", expr))
-	}
-}
-
-func (r *resolver) stmtList(stmts []ast.Stmt) {
-	for _, s := range stmts {
-		r.stmt(s)
-	}
-}
-
-func (r *resolver) exprList(exprs []ast.Expr) {
-	for _, x := range exprs {
-		r.expr(x)
-	}
-}
-
-func (r *resolver) ident(id *ast.Ident) {
-	// Map this ident. If the name is already in scope, use that definition.
-	// Otherwise check if it's an imported name.
-	if obj := r.scope.LookupParent(id.Name); obj != nil {
-		r.Idents[id] = obj
-	} else if path := r.NameToPath[id.Name]; path != "" {
-		r.Idents[id] = &Name{
-			ImportPath: path,
-		}
-	}
-}
-
-func (r *resolver) define(id *ast.Ident, name *Name) {
-	r.Idents[id] = name
-	r.scope.Insert(id.Name, name)
-}
-
-func (r *resolver) openScope() {
-	r.scope = newScope(r.scope)
-}
-
-func (r *resolver) closeScope() {
-	r.scope = r.scope.Pop()
-}
-
-// scope maps names to information about them.
-type scope struct {
-	names  map[string]*Name
-	parent *scope
-}
-
-func newScope(parent *scope) *scope {
-	return &scope{
-		names:  make(map[string]*Name),
-		parent: parent,
-	}
-}
-
-func (s *scope) Pop() *scope {
-	return s.parent
-}
-
-func (s *scope) Insert(name string, r *Name) {
-	if name != "_" {
-		s.names[name] = r
-	}
-}
-
-func (s *scope) Lookup(name string) *Name {
-	return s.names[name]
-}
-
-func (s *scope) LookupParent(name string) *Name {
-	if r := s.names[name]; r != nil {
-		return r
-	} else if s.parent != nil {
-		return s.parent.LookupParent(name)
-	}
-	return nil
-}
diff --git a/parser/internal/names/names_test.go b/parser/internal/names/names_test.go
deleted file mode 100644
index 646629639d..0000000000
--- a/parser/internal/names/names_test.go
+++ /dev/null
@@ -1,246 +0,0 @@
-package names
-
-import (
-	"go/ast"
-	"go/parser"
-	"go/token"
-	"testing"
-
-	"encr.dev/parser/est"
-	qt "github.com/frankban/quicktest"
-	"github.com/rogpeppe/go-internal/txtar"
-)
-
-func TestResolve(t *testing.T) {
-	tests := []struct {
-		Name    string
-		Track   TrackedPackages
-		Archive string
-
-		// Expected error, if any
-		Err string
-		// Names expected to be found in package scope
-		PkgNames []string
-		// Expected (import -> name) pairs in *File.NameToPath and *File.PathToName
-		PkgMap map[string]string
-		// Name information to validate
-		Names map[string]*Name
-	}{
-		{
-			Name: "pkg_map",
-			Track: TrackedPackages{
-				"foo/path": "foo",
-			},
-			Archive: `
--- pkg.go --
-package pkg
-
-import "foo/path"
-			`,
-
-			PkgNames: []string{},
-			PkgMap:   map[string]string{"foo/path": "foo"},
-			Names:    map[string]*Name{},
-		},
-		{
-			Name: "pkg_var",
-			Archive: `
--- pkg.go --
-package pkg
-
-var foo = true
-			`,
-
-			PkgNames: []string{"foo"},
-			Names: map[string]*Name{
-				"foo": {
-					Package: true,
-				},
-			},
-		},
-		{
-			Name: "func_local",
-			Archive: `
--- pkg.go --
-package pkg
-
-func fn() {
-	bar := "hello"
-}
-			`,
-
-			PkgNames: []string{"fn"},
-			Names: map[string]*Name{
-				"bar": {Local: true},
-			},
-		},
-		{
-			Name:  "imported_name",
-			Track: TrackedPackages{"foo/path": "foo"},
-			Archive: `
--- pkg.go --
-package pkg
-
-import "foo/path"
-
-func fn() {
-	bar := foo.Moo()
-}
-			`,
-
-			PkgNames: []string{"fn"},
-			Names: map[string]*Name{
-				"bar": {Local: true},
-				"foo": {ImportPath: "foo/path"},
-			},
-		},
-		{
-			Name: "import_name_collision",
-			Track: TrackedPackages{
-				"foo":  "foo",
-				"foo2": "foo",
-			},
-			Archive: `
--- pkg.go --
-package pkg
-
-import (
-	"foo"
-	"foo2"
-)
-			`,
-			Err: `.*pkg.go:5:2: name foo already declared \(import of package foo\)`,
-		},
-	}
-
-	for _, test := range tests {
-		t.Run(test.Name, func(t *testing.T) {
-			c := qt.New(t)
-			dir := t.TempDir()
-			err := txtar.Write(txtar.Parse([]byte(test.Archive)), dir)
-			c.Assert(err, qt.IsNil)
-
-			fs := token.NewFileSet()
-			pkgs, err := parser.ParseDir(fs, dir, nil, parser.ParseComments)
-			c.Assert(err, qt.IsNil)
-			astPkg := pkgs["pkg"]
-			c.Assert(astPkg, qt.Not(qt.IsNil))
-
-			pkg := &est.Package{
-				AST:        astPkg,
-				Name:       "pkg",
-				ImportPath: "foo",
-				RelPath:    ".",
-				Dir:        dir,
-			}
-			var firstFile *ast.File
-			for _, f := range astPkg.Files {
-				firstFile = f
-				break
-			}
-			pkg.Files = []*est.File{{AST: firstFile}}
-
-			res, err := Resolve(fs, test.Track, pkg)
-			if test.Err != "" {
-				c.Assert(err, qt.ErrorMatches, test.Err)
-				return
-			}
-			c.Assert(err, qt.IsNil)
-
-			// Compare res with our expectations
-			c.Assert(res.Decls, qt.HasLen, len(test.PkgNames))
-			for _, name := range test.PkgNames {
-				c.Assert(res.Decls[name], qt.Not(qt.IsNil))
-			}
-
-			var file *est.File
-			for _, file = range pkg.Files {
-				break
-			}
-			f := res.Files[file]
-			c.Assert(f, qt.Not(qt.IsNil))
-			for path, name := range test.PkgMap {
-				c.Assert(f.NameToPath[name], qt.Equals, path)
-				c.Assert(f.PathToName[path], qt.Equals, name)
-			}
-
-			ast.Inspect(file.AST, func(node ast.Node) bool {
-				if id, ok := node.(*ast.Ident); ok {
-					name := id.Name
-					if want, ok := test.Names[name]; ok {
-						info := res.Files[file].Idents[id]
-						c.Assert(info, qt.Not(qt.IsNil), qt.Commentf("%s: %s", fs.Position(id.Pos()), name))
-						c.Assert(info, qt.DeepEquals, want)
-					}
-				}
-				return true
-			})
-		})
-	}
-}
-
-func TestKeyValueExpr(t *testing.T) {
-	const data = `-- pkg.go --
-package pkg
-
-type Foo struct {
-	Key string
-}
-
-func Key() {
-	return &Foo{Key: "test"}
-}
-`
-	c := qt.New(t)
-	dir := t.TempDir()
-	err := txtar.Write(txtar.Parse([]byte(data)), dir)
-	c.Assert(err, qt.IsNil)
-
-	fs := token.NewFileSet()
-	pkgs, err := parser.ParseDir(fs, dir, nil, parser.ParseComments)
-	c.Assert(err, qt.IsNil)
-	astPkg := pkgs["pkg"]
-	c.Assert(astPkg, qt.Not(qt.IsNil))
-
-	pkg := &est.Package{
-		AST:        astPkg,
-		Name:       "pkg",
-		ImportPath: "foo",
-		RelPath:    ".",
-		Dir:        dir,
-	}
-	var firstFile *ast.File
-	for _, f := range astPkg.Files {
-		firstFile = f
-		break
-	}
-	pkg.Files = []*est.File{{AST: firstFile}}
-
-	res, err := Resolve(fs, nil, pkg)
-	c.Assert(err, qt.IsNil)
-
-	// Compare res with our expectations
-	var file *est.File
-	for _, file = range pkg.Files {
-		break
-	}
-	f := res.Files[file]
-	c.Assert(f, qt.Not(qt.IsNil))
-
-	// Walk to our "Key" ident within the &Foo{} struct literal.
-	inLiteral := false
-	ast.Inspect(file.AST, func(node ast.Node) bool {
-		if _, ok := node.(*ast.KeyValueExpr); ok {
-			inLiteral = true
-		}
-
-		if inLiteral {
-			if id, ok := node.(*ast.Ident); ok && id.Name == "Key" {
-				// We want this ident to not be tracked.
-				_, ok := f.Idents[id]
-				c.Assert(ok, qt.IsFalse)
-			}
-		}
-		return true
-	})
-}
diff --git a/parser/meta.go b/parser/meta.go
deleted file mode 100644
index ba067f79c5..0000000000
--- a/parser/meta.go
+++ /dev/null
@@ -1,363 +0,0 @@
-package parser
-
-import (
-	"fmt"
-	"go/ast"
-	"io/ioutil"
-	"os"
-	"path"
-	"path/filepath"
-	"regexp"
-	"sort"
-	"strconv"
-
-	"encr.dev/parser/est"
-	meta "encr.dev/proto/encore/parser/meta/v1"
-	schema "encr.dev/proto/encore/parser/schema/v1"
-)
-
-type TraceNodes map[ast.Node]*meta.TraceNode
-
-// ParseMeta parses app metadata.
-func ParseMeta(version, appRoot string, app *est.Application) (*meta.Data, map[*est.Package]TraceNodes, error) {
-	data := &meta.Data{
-		ModulePath: app.ModulePath,
-		AppVersion: version,
-		Decls:      app.Decls,
-	}
-	pkgMap := make(map[string]*meta.Package)
-	nodes := parceTraceNodes(app)
-	for _, pkg := range app.Packages {
-		p := &meta.Package{
-			RelPath: pkg.RelPath,
-			Name:    pkg.Name,
-			Doc:     pkg.Doc,
-			Secrets: pkg.Secrets,
-		}
-		if pkg.Service != nil {
-			p.ServiceName = pkg.Service.Name
-		}
-		tx := nodes[pkg]
-		for _, n := range tx {
-			p.TraceNodes = append(p.TraceNodes, n)
-		}
-		sort.Slice(p.TraceNodes, func(i, j int) bool { return p.TraceNodes[i].Id < p.TraceNodes[j].Id })
-		data.Pkgs = append(data.Pkgs, p)
-		pkgMap[p.RelPath] = p
-	}
-
-	for _, svc := range app.Services {
-		s, err := parseSvc(appRoot, svc)
-		if err != nil {
-			return nil, nil, err
-		}
-		data.Svcs = append(data.Svcs, s)
-	}
-
-	// Populate rpc calls based on rewrite information
-	for _, pkg := range app.Packages {
-		type key struct {
-			pkg string
-			rpc string
-		}
-		seen := make(map[key]bool)
-		for _, f := range pkg.Files {
-			for _, r := range sortedRefs(f.References) {
-				if r.Node.Type == est.RPCCallNode {
-					k := key{pkg: r.Node.RPC.Svc.Root.RelPath, rpc: r.Node.RPC.Name}
-					if !seen[k] {
-						p := pkgMap[pkg.RelPath]
-						p.RpcCalls = append(p.RpcCalls, &meta.QualifiedName{
-							Pkg:  k.pkg,
-							Name: k.rpc,
-						})
-						seen[k] = true
-					}
-				}
-			}
-		}
-	}
-
-	if app.AuthHandler != nil {
-		data.AuthHandler = parseAuthHandler(app.AuthHandler)
-	}
-
-	return data, nodes, nil
-}
-
-var migrationRe = regexp.MustCompile(`^([0-9]+)_([^.]+)\.up.sql$`)
-
-func parseSvc(appRoot string, svc *est.Service) (*meta.Service, error) {
-	s := &meta.Service{
-		Name:    svc.Name,
-		RelPath: svc.Root.RelPath,
-	}
-	for _, rpc := range svc.RPCs {
-		proto := meta.RPC_REGULAR
-		if rpc.Raw {
-			proto = meta.RPC_RAW
-		}
-		var accessType meta.RPC_AccessType
-		switch rpc.Access {
-		case est.Public:
-			accessType = meta.RPC_PUBLIC
-		case est.Private:
-			accessType = meta.RPC_PRIVATE
-		case est.Auth:
-			accessType = meta.RPC_AUTH
-		default:
-			return nil, fmt.Errorf("unhandled access type %v", rpc.Access)
-		}
-
-		var req, resp *schema.Decl
-		if rpc.Request != nil {
-			req = rpc.Request.Decl
-		}
-		if rpc.Response != nil {
-			resp = rpc.Response.Decl
-		}
-		r := &meta.RPC{
-			Name:           rpc.Name,
-			Doc:            rpc.Doc,
-			AccessType:     accessType,
-			RequestSchema:  req,
-			ResponseSchema: resp,
-			Proto:          proto,
-			Loc:            parseLoc(rpc.File, rpc.Func),
-		}
-		s.Rpcs = append(s.Rpcs, r)
-	}
-
-	relPath := filepath.Join(svc.Root.RelPath, "migrations")
-	migs, err := parseMigrations(appRoot, relPath)
-	if err != nil {
-		return nil, fmt.Errorf("%s: could not parse sqldb migrations: %v", svc.Root.RelPath, err)
-	}
-	s.Migrations = migs
-	return s, nil
-}
-
-func parseMigrations(appRoot, relPath string) ([]*meta.DBMigration, error) {
-	absPath := filepath.Join(appRoot, relPath)
-	fi, err := os.Stat(absPath)
-	if os.IsNotExist(err) {
-		return nil, nil
-	} else if err != nil {
-		return nil, err
-	} else if !fi.IsDir() {
-		return nil, fmt.Errorf("%s is not a directory", relPath)
-	}
-
-	files, err := ioutil.ReadDir(absPath)
-	if err != nil {
-		return nil, fmt.Errorf("could not read migrations: %v", err)
-	}
-	migrations := make([]*meta.DBMigration, 0, len(files))
-	for _, f := range files {
-		if f.IsDir() {
-			continue
-		}
-		match := migrationRe.FindStringSubmatch(f.Name())
-		if match == nil {
-			return nil, fmt.Errorf("migration %s/%s has an invalid name (must be of the format '123_description_here.up.sql')",
-				relPath, f.Name())
-		}
-		num, _ := strconv.Atoi(match[1])
-		migrations = append(migrations, &meta.DBMigration{
-			Filename:    f.Name(),
-			Number:      int32(num),
-			Description: match[2],
-		})
-	}
-	sort.Slice(migrations, func(i, j int) bool {
-		return migrations[i].Number < migrations[j].Number
-	})
-	for i := int32(0); i < int32(len(migrations)); i++ {
-		fn := migrations[i].Filename
-		num := migrations[i].Number
-		if num <= 0 {
-			return nil, fmt.Errorf("%s/%s: invalid migration number %d", relPath, fn, num)
-		} else if num < (i + 1) {
-			return nil, fmt.Errorf("%s/%s: duplicate migration with number %d", relPath, fn, num)
-		} else if num > (i + 1) {
-			return nil, fmt.Errorf("%s/%s: missing migration with number %d", relPath, fn, i+1)
-		}
-	}
-	return migrations, nil
-}
-
-func parseAuthHandler(h *est.AuthHandler) *meta.AuthHandler {
-	pb := &meta.AuthHandler{
-		Name:    h.Name,
-		Doc:     h.Name,
-		PkgPath: h.Svc.Root.ImportPath,
-		PkgName: h.Svc.Root.Name,
-		Loc:     parseLoc(h.File, h.Func),
-	}
-	if h.AuthData != nil {
-		pb.AuthData = h.AuthData.Decl
-	}
-	return pb
-}
-
-func parceTraceNodes(app *est.Application) map[*est.Package]TraceNodes {
-	var id int32
-	res := make(map[*est.Package]TraceNodes)
-	for _, pkg := range app.Packages {
-		nodes := make(TraceNodes)
-		res[pkg] = nodes
-		for _, file := range pkg.Files {
-			for _, r := range sortedRefs(file.References) {
-				switch r.Node.Type {
-				// Secret nodes are not relevant for tracing
-				case est.SecretsNode:
-					continue
-				}
-
-				tx := newTraceNode(&id, pkg, file, r.AST)
-				nodes[r.AST] = tx
-				start := file.Token.Offset(r.AST.Pos())
-				end := file.Token.Offset(r.AST.End())
-
-				switch r.Node.Type {
-				case est.RPCCallNode:
-					tx.Context = &meta.TraceNode_RpcCall{
-						RpcCall: &meta.RPCCallNode{
-							ServiceName: r.Node.RPC.Svc.Name,
-							RpcName:     r.Node.RPC.Name,
-							Context:     string(file.Contents[start:end]),
-						},
-					}
-
-				case est.SQLDBNode:
-					tx.Context = &meta.TraceNode_StaticCall{
-						StaticCall: &meta.StaticCallNode{
-							Package: meta.StaticCallNode_SQLDB,
-							Func:    r.Node.Func,
-							Context: string(file.Contents[start:end]),
-						},
-					}
-
-				case est.RLogNode:
-					tx.Context = &meta.TraceNode_StaticCall{
-						StaticCall: &meta.StaticCallNode{
-							Package: meta.StaticCallNode_RLOG,
-							Func:    r.Node.Func,
-							Context: string(file.Contents[start:end]),
-						},
-					}
-				}
-			}
-		}
-	}
-
-	for _, svc := range app.Services {
-		for _, rpc := range svc.RPCs {
-			fd := rpc.Func
-			tx := newTraceNode(&id, rpc.Svc.Root, rpc.File, fd)
-			res[svc.Root][fd] = tx
-			f := rpc.File
-			start := f.Token.Offset(fd.Type.Pos())
-			end := f.Token.Offset(fd.Type.End())
-			tx.Context = &meta.TraceNode_RpcDef{
-				RpcDef: &meta.RPCDefNode{
-					ServiceName: svc.Name,
-					RpcName:     fd.Name.Name,
-					Context:     string(f.Contents[start:end]),
-				},
-			}
-		}
-	}
-
-	if h := app.AuthHandler; h != nil {
-		fd := h.Func
-		tx := newTraceNode(&id, h.Svc.Root, h.File, fd)
-		res[h.Svc.Root][fd] = tx
-		f := h.File
-		start := f.Token.Offset(fd.Type.Pos())
-		end := f.Token.Offset(fd.Type.End())
-		tx.Context = &meta.TraceNode_AuthHandlerDef{
-			AuthHandlerDef: &meta.AuthHandlerDefNode{
-				ServiceName: h.Svc.Name,
-				Name:        fd.Name.Name,
-				Context:     string(f.Contents[start:end]),
-			},
-		}
-	}
-
-	return res
-}
-
-func newTraceNode(id *int32, pkg *est.Package, f *est.File, node ast.Node) *meta.TraceNode {
-	*id++
-	var expr *meta.TraceNode
-	file := f.Token
-	filename := filepath.Base(f.Path)
-	filepath := path.Join(pkg.RelPath, filename)
-
-	switch node := node.(type) {
-	case *ast.CallExpr:
-		expr = &meta.TraceNode{
-			Id:       *id,
-			Filepath: filepath,
-			StartPos: int32(file.Offset(node.Lparen)),
-			EndPos:   int32(file.Offset(node.Rparen)),
-		}
-	case *ast.FuncDecl:
-		expr = &meta.TraceNode{
-			Id:       *id,
-			Filepath: filepath,
-			StartPos: int32(file.Offset(node.Type.Pos())),
-			EndPos:   int32(file.Offset(node.Type.End())),
-		}
-	default:
-		panic(fmt.Sprintf("unhandled trace expression node %T", node))
-	}
-
-	start := file.Pos(int(expr.StartPos))
-	end := file.Pos(int(expr.EndPos))
-	sPos, ePos := file.Position(start), file.Position(end)
-	expr.SrcLineStart = int32(sPos.Line)
-	expr.SrcLineEnd = int32(ePos.Line)
-	expr.SrcColStart = int32(sPos.Column)
-	expr.SrcColEnd = int32(ePos.Column)
-	return expr
-}
-
-func qualified(pkg *est.Package, name string) *meta.QualifiedName {
-	return &meta.QualifiedName{
-		Pkg:  pkg.RelPath,
-		Name: name,
-	}
-}
-
-func parseLoc(f *est.File, node ast.Node) *schema.Loc {
-	sPos, ePos := f.Token.Position(node.Pos()), f.Token.Position(node.Pos())
-	return &schema.Loc{
-		PkgName:      f.Pkg.Name,
-		PkgPath:      f.Pkg.ImportPath,
-		Filename:     f.Name,
-		StartPos:     int32(f.Token.Offset(node.Pos())),
-		EndPos:       int32(f.Token.Offset(node.End())),
-		SrcLineStart: int32(sPos.Line),
-		SrcLineEnd:   int32(ePos.Line),
-		SrcColStart:  int32(sPos.Column),
-		SrcColEnd:    int32(ePos.Column),
-	}
-}
-
-type refPair struct {
-	AST  ast.Node
-	Node *est.Node
-}
-
-func sortedRefs(refs map[ast.Node]*est.Node) []refPair {
-	p := make([]refPair, 0, len(refs))
-	for ast, node := range refs {
-		p = append(p, refPair{ast, node})
-	}
-	sort.Slice(p, func(i, j int) bool {
-		return p[i].AST.Pos() < p[j].AST.Pos()
-	})
-	return p
-}
diff --git a/parser/parser.go b/parser/parser.go
deleted file mode 100644
index 06f451c4a5..0000000000
--- a/parser/parser.go
+++ /dev/null
@@ -1,491 +0,0 @@
-// Package parser parses Encore applications into an Encore Syntax Tree (EST).
-package parser
-
-import (
-	"go/ast"
-	goparser "go/parser"
-	"go/scanner"
-	"go/token"
-	"os"
-	"path"
-	"path/filepath"
-	"sort"
-	"strings"
-
-	"encr.dev/parser/est"
-	"encr.dev/parser/internal/names"
-	meta "encr.dev/proto/encore/parser/meta/v1"
-	schema "encr.dev/proto/encore/parser/schema/v1"
-	"golang.org/x/tools/go/ast/astutil"
-)
-
-type Result struct {
-	FileSet *token.FileSet
-	App     *est.Application
-	Meta    *meta.Data
-	Nodes   map[*est.Package]TraceNodes
-}
-
-type parser struct {
-	// inputs
-	cfg *Config
-
-	// accumulated results
-	fset        *token.FileSet
-	errors      scanner.ErrorList
-	pkgs        []*est.Package
-	pkgMap      map[string]*est.Package // import path -> pkg
-	svcs        []*est.Service
-	svcMap      map[string]*est.Service // name -> svc
-	names       map[*est.Package]*names.Resolution
-	authHandler *est.AuthHandler
-	declMap     map[string]*schema.Decl // pkg/path.Name -> decl
-	decls       []*schema.Decl
-}
-
-// Config represents the configuration options for parsing.
-type Config struct {
-	AppRoot    string
-	Version    string
-	ModulePath string
-	WorkingDir string
-	ParseTests bool
-}
-
-func Parse(cfg *Config) (*Result, error) {
-	p := &parser{
-		cfg:     cfg,
-		declMap: make(map[string]*schema.Decl),
-	}
-	return p.Parse()
-}
-
-const (
-	sqldbImportPath = "encore.dev/storage/sqldb"
-	rlogImportPath  = "encore.dev/rlog"
-	uuidImportPath  = "encore.dev/types/uuid"
-	authImportPath  = "encore.dev/beta/auth"
-)
-
-func (p *parser) Parse() (res *Result, err error) {
-	defer func() {
-		if e := recover(); e != nil {
-			if _, ok := e.(bailout); !ok {
-				panic(e)
-			}
-		}
-		if err == nil {
-			p.errors.Sort()
-			makeErrsRelative(p.errors, p.cfg.AppRoot, p.cfg.WorkingDir)
-			err = p.errors.Err()
-		}
-	}()
-	p.fset = token.NewFileSet()
-
-	p.pkgs, err = collectPackages(p.fset, p.cfg.AppRoot, p.cfg.ModulePath, goparser.ParseComments, p.cfg.ParseTests)
-	if err != nil {
-		return nil, err
-	}
-	p.pkgMap = make(map[string]*est.Package)
-	for _, pkg := range p.pkgs {
-		p.pkgMap[pkg.ImportPath] = pkg
-	}
-
-	track := names.TrackedPackages{
-		sqldbImportPath: "sqldb",
-		rlogImportPath:  "rlog",
-		uuidImportPath:  "uuid",
-		authImportPath:  "auth",
-
-		"net/http":      "http",
-		"context":       "context",
-		"encoding/json": "json",
-		"time":          "time",
-	}
-	p.resolveNames(track)
-	p.parseServices()
-	p.parseReferences()
-	p.parseSecrets()
-	p.validateApp()
-
-	sort.Slice(p.pkgs, func(i, j int) bool {
-		return p.pkgs[i].RelPath < p.pkgs[j].RelPath
-	})
-	sort.Slice(p.svcs, func(i, j int) bool {
-		return p.svcs[i].Name < p.svcs[j].Name
-	})
-	for _, svc := range p.svcs {
-		sort.Slice(svc.RPCs, func(i, j int) bool {
-			return svc.RPCs[i].Name < svc.RPCs[j].Name
-		})
-	}
-	app := &est.Application{
-		ModulePath:  p.cfg.ModulePath,
-		Packages:    p.pkgs,
-		Services:    p.svcs,
-		Decls:       p.decls,
-		AuthHandler: p.authHandler,
-	}
-	md, nodes, err := ParseMeta(p.cfg.Version, p.cfg.AppRoot, app)
-	if err != nil {
-		return nil, err
-	}
-	return &Result{
-		FileSet: p.fset,
-		App:     app,
-		Meta:    md,
-		Nodes:   nodes,
-	}, nil
-}
-
-// collectPackages collects and parses the regular Go AST
-// for all subdirectories in the root.
-func collectPackages(fs *token.FileSet, rootDir, rootImportPath string, mode goparser.Mode, parseTests bool) ([]*est.Package, error) {
-	var pkgs []*est.Package
-	var errors scanner.ErrorList
-	filter := func(f os.FileInfo) bool {
-		return parseTests || !strings.HasSuffix(f.Name(), "_test.go")
-	}
-	err := walkDirs(rootDir, func(dir, relPath string, files []os.FileInfo) error {
-		ps, pkgFiles, err := parseDir(fs, dir, relPath, filter, mode)
-		if err != nil {
-			// If the error is an error list, it means we have a parsing error.
-			// Keep going with other directories in that case.
-			if el, ok := err.(scanner.ErrorList); ok {
-				errors = append(errors, el...)
-				return nil
-			}
-			return err
-		}
-
-		var pkgNames []string
-		for name := range ps {
-			pkgNames = append(pkgNames, name)
-		}
-		if n := len(ps); n > 1 {
-			// We only support a single package for now
-			sort.Strings(pkgNames)
-			first := ps[pkgNames[0]]
-			namestr := strings.Join(pkgNames[:n-1], ", ") + " and " + pkgNames[n-1]
-			errors.Add(fs.Position(first.Pos()), "got multiple package names in directory: "+namestr)
-			return nil
-		} else if n == 0 {
-			// No Go files; ignore directory
-			return nil
-		}
-
-		p := ps[pkgNames[0]]
-
-		var doc string
-		for _, astFile := range p.Files {
-			// HACK: getting package comments is not at all easy
-			// because of the quirks of go/ast. This seems to work.
-			cm := ast.NewCommentMap(fs, astFile, astFile.Comments)
-			for _, cg := range cm[astFile] {
-				if text := strings.TrimSpace(cg.Text()); text != "" {
-					doc = text
-				}
-				break
-			}
-			if doc != "" {
-				break
-			}
-		}
-
-		pkg := &est.Package{
-			AST:        p,
-			Name:       p.Name,
-			Doc:        doc,
-			ImportPath: path.Clean(path.Join(rootImportPath, relPath)),
-			RelPath:    path.Clean(relPath),
-			Dir:        dir,
-			Files:      pkgFiles,
-		}
-		for _, f := range pkgFiles {
-			f.Pkg = pkg
-		}
-		pkgs = append(pkgs, pkg)
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	return pkgs, errors.Err()
-}
-
-// resolveNames resolves identifiers for the application's packages.
-// track defines the non-application packages to track usage for.
-func (p *parser) resolveNames(track names.TrackedPackages) {
-	p.names = make(map[*est.Package]*names.Resolution)
-
-	for _, pkg := range p.pkgs {
-		track[pkg.ImportPath] = pkg.Name
-	}
-	for _, pkg := range p.pkgs {
-		res, err := names.Resolve(p.fset, track, pkg)
-		if err != nil {
-			if el, ok := err.(scanner.ErrorList); ok {
-				p.errors = append(p.errors, el...)
-			} else {
-				p.err(pkg.Files[0].AST.Pos(), err.Error())
-			}
-			continue
-		}
-		p.names[pkg] = res
-	}
-	if len(p.errors) > 0 {
-		panic(bailout{})
-	}
-}
-
-func (p *parser) parseReferences() {
-	// For all RPCs defined, store them in a map per package for faster lookup
-	rpcMap := make(map[string]map[string]*est.RPC, len(p.pkgs)) // path -> name -> RPC
-	for _, svc := range p.svcs {
-		rpcs := make(map[string]*est.RPC, len(svc.RPCs))
-		rpcMap[svc.Root.ImportPath] = rpcs
-		for _, rpc := range svc.RPCs {
-			rpcs[rpc.Func.Name.Name] = rpc
-			rpc.File.References[rpc.Func] = &est.Node{
-				Type: est.RPCDefNode,
-				RPC:  rpc,
-			}
-		}
-	}
-
-	for _, pkg := range p.pkgs {
-		for _, file := range pkg.Files {
-			info := p.names[pkg].Files[file]
-
-			// For every call, determine if it should be rewritten
-		CallLoop:
-			for _, call := range info.Calls {
-				switch x := call.Fun.(type) {
-				case *ast.SelectorExpr:
-					if id, ok := x.X.(*ast.Ident); ok {
-						ri := info.Idents[id]
-						if ri == nil || ri.ImportPath == "" {
-							continue
-						}
-						path := ri.ImportPath
-
-						// Is it an RPC?
-						if rpc := rpcMap[path][x.Sel.Name]; rpc != nil {
-							file.References[call] = &est.Node{
-								Type: est.RPCCallNode,
-								RPC:  rpc,
-							}
-							continue CallLoop
-						}
-						switch path {
-						case sqldbImportPath:
-							file.References[call] = &est.Node{
-								Type: est.SQLDBNode,
-								Func: x.Sel.Name,
-							}
-						case rlogImportPath:
-							file.References[call] = &est.Node{
-								Type: est.RLogNode,
-								Func: x.Sel.Name,
-							}
-						}
-					}
-
-				case *ast.Ident:
-					ri := info.Idents[x]
-					// Is it a package-local rpc?
-					if ri != nil && ri.Package {
-						if rpc := rpcMap[pkg.ImportPath][x.Name]; rpc != nil {
-							file.References[call] = &est.Node{
-								Type: est.RPCCallNode,
-								RPC:  rpc,
-							}
-						}
-					}
-				}
-			}
-
-			// Find all references to RPCs and objects to rewrite that are not
-			// part of rewritten calls.
-			astutil.Apply(file.AST, func(c *astutil.Cursor) bool {
-				if sel, ok := c.Node().(*ast.SelectorExpr); ok {
-					if id, ok := sel.X.(*ast.Ident); ok {
-						// Have we rewritten this already?
-						if file.References[c.Parent()] != nil {
-							// We can't recurse into children because that will lead to
-							// spurious errors since we'll look up the child Ident in the case below
-							// and fail because it looks like we're referencing an RPC without calling it.
-							return false
-						}
-						ri := info.Idents[id]
-						if ri == nil || ri.ImportPath == "" {
-							return true
-						}
-						path := ri.ImportPath
-						pkg2, ok := p.pkgMap[path]
-						if !ok {
-							return true
-						}
-
-						// Is it an RPC?
-						if rpc := rpcMap[path][sel.Sel.Name]; rpc != nil {
-							p.errf(sel.Pos(), "cannot reference API %s.%s without calling it", rpc.Svc.Name, sel.Sel.Name)
-							return false
-						} else if h := p.authHandler; h != nil && path == h.Svc.Root.ImportPath && sel.Sel.Name == h.Name {
-							p.errf(sel.Pos(), "cannot reference auth handler %s.%s from another package", h.Svc.Root.RelPath, sel.Sel.Name)
-							return false
-						}
-
-						switch path {
-						case sqldbImportPath:
-							// Allow types to be references
-							switch sel.Sel.Name {
-							case "Tx", "Row", "Rows":
-								return true
-							default:
-								p.errf(sel.Pos(), "cannot reference func %s.%s without calling it", path, sel.Sel.Name)
-								return false
-							}
-						case rlogImportPath:
-							// Allow types to be whitelisted
-							switch sel.Sel.Name {
-							case "Ctx":
-								return true
-							default:
-								p.errf(sel.Pos(), "cannot reference func %s.%s without calling it", path, sel.Sel.Name)
-								return false
-							}
-						}
-
-						// Is it a type in a different service?
-						if pkg2.Service != nil && pkg2.Service.Name != pkg.Service.Name {
-							if decl, ok := p.names[pkg2].Decls[sel.Sel.Name]; ok {
-								switch decl.Type {
-								case token.CONST:
-									// all good
-								case token.TYPE:
-									// TODO check if there are methods on the type
-								case token.VAR:
-									p.errf(sel.Pos(), "cannot reference variable %s.%s in another Encore service", pkg2.RelPath, sel.Sel.Name)
-									return false
-								}
-							}
-						}
-					}
-				} else if id, ok := c.Node().(*ast.Ident); ok {
-					// Have we rewritten this already?
-					if file.References[c.Parent()] != nil {
-						return true
-					}
-
-					ri := info.Idents[id]
-					// Is it a package-local rpc?
-					if ri != nil && ri.Package {
-						if rpc := rpcMap[pkg.ImportPath][id.Name]; rpc != nil {
-							p.errf(id.Pos(), "cannot reference API %s without calling it", rpc.Name)
-							return false
-						}
-					}
-				}
-				return true
-			}, nil)
-
-			if pkg.Service == nil && len(file.References) > 0 {
-				for astNode, node := range file.References {
-					switch node.Type {
-					case est.RPCCallNode:
-						rpc := node.RPC
-						p.errf(astNode.Pos(), "cannot reference API %s%s outside of a service\n\tpackage %s is not considered a service (it has no APIs defined)", rpc.Svc.Name, rpc.Name, pkg.Name)
-					case est.SQLDBNode:
-						p.errf(astNode.Pos(), "cannot use package %s outside of a service\n\tpackage %s is not considered a service (it has no APIs defined)", sqldbImportPath, pkg.Name)
-					case est.RLogNode:
-						p.errf(astNode.Pos(), "cannot use package %s outside of a service\n\tpackage %s is not considered a service (it has no APIs defined)", rlogImportPath, pkg.Name)
-					default:
-						p.errf(astNode.Pos(), "invalid reference outside of a service\n\tpackage %s is not considered a service (it has no APIs defined)", pkg.Name)
-					}
-					break
-				}
-			}
-		}
-	}
-}
-
-func (p *parser) parseSecrets() {
-	for _, pkg := range p.pkgs {
-		p.parsePackageSecrets(pkg)
-	}
-}
-
-func (p *parser) parsePackageSecrets(pkg *est.Package) {
-	var secretsDecl *ast.StructType
-SpecLoop:
-	for _, f := range pkg.Files {
-		for _, decl := range f.AST.Decls {
-			gd, ok := decl.(*ast.GenDecl)
-			if !ok || gd.Tok != token.VAR {
-				continue
-			}
-			for _, spec := range gd.Specs {
-				spec := spec.(*ast.ValueSpec)
-				for _, name := range spec.Names {
-					if name.Name == "secrets" {
-						typ, ok := spec.Type.(*ast.StructType)
-						if !ok {
-							p.err(spec.Pos(), "secrets var must be a struct")
-							return
-						} else if len(spec.Names) != 1 {
-							p.err(spec.Pos(), "secrets var must be declared separately")
-							return
-						} else if len(spec.Values) != 0 {
-							p.err(spec.Pos(), "secrets var must not be given a value")
-							return
-						}
-						secretsDecl = typ
-						f.References[spec] = &est.Node{Type: est.SecretsNode}
-						break SpecLoop
-					}
-				}
-			}
-		}
-	}
-
-	if secretsDecl == nil {
-		// No secrets
-		return
-	}
-
-	names := p.names[pkg]
-	var secretNames []string
-	for _, field := range secretsDecl.Fields.List {
-		if typ, ok := field.Type.(*ast.Ident); !ok || typ.Name != "string" {
-			p.errf(typ.Pos(), "field %s is not of type string", field.Names[0].Name)
-			return
-		} else if decl := names.Decls["string"]; decl != nil {
-			pp := p.fset.Position(decl.Pos)
-			p.errf(typ.Pos(), "package shadows built-in type string:\n\tshadowing declaration at %s:%d",
-				filepath.Base(pp.Filename), pp.Line)
-			return
-		}
-		for _, name := range field.Names {
-			secretNames = append(secretNames, name.Name)
-		}
-	}
-	sort.Strings(secretNames)
-	pkg.Secrets = secretNames
-}
-
-// validateApp performs full-app validation after everything has been parsed.
-func (p *parser) validateApp() {
-	// Error if we have auth endpoints without an auth handlers
-	if p.authHandler == nil {
-	AuthLoop:
-		for _, svc := range p.svcs {
-			for _, rpc := range svc.RPCs {
-				if rpc.Access == est.Auth {
-					p.errf(rpc.Func.Pos(), "cannot use \"auth\" access type, no auth handler is defined in the app")
-					break AuthLoop
-				}
-			}
-		}
-	}
-}
diff --git a/parser/parser_test.go b/parser/parser_test.go
deleted file mode 100644
index 273b4732d0..0000000000
--- a/parser/parser_test.go
+++ /dev/null
@@ -1,146 +0,0 @@
-package parser
-
-import (
-	"fmt"
-	goparser "go/parser"
-	"go/token"
-	"io/ioutil"
-	"os"
-	"path/filepath"
-	"testing"
-
-	"encr.dev/parser/est"
-	qt "github.com/frankban/quicktest"
-	"github.com/rogpeppe/go-internal/testscript"
-	ts "github.com/rogpeppe/go-internal/testscript"
-	"github.com/rogpeppe/go-internal/txtar"
-	"golang.org/x/mod/modfile"
-)
-
-func TestCollectPackages(t *testing.T) {
-	const modulePath = "test.path"
-	tests := []struct {
-		Archive string
-		Pkgs    []*est.Package
-		Err     string
-	}{
-		{
-			Archive: `
--- a/a.go --
-package foo
--- a/b/b.go --
-package bar
-`,
-			Pkgs: []*est.Package{
-				{
-					Name:       "foo",
-					ImportPath: modulePath + "/a",
-					RelPath:    "a",
-					Dir:        "./a",
-				},
-				{
-					Name:       "bar",
-					ImportPath: modulePath + "/a/b",
-					RelPath:    "a/b",
-					Dir:        "./a/b",
-				},
-			},
-		},
-		{
-			Archive: `
--- a/a.go --
-package fo/;
-`,
-			Err: ".*a.go:.*expected ';', found '/'",
-		},
-		{
-			Archive: `
--- a/a.go --
-package a;
--- a/b.go --
-package b;
-`,
-			Err: "got multiple package names in directory: a and b",
-		},
-		{
-			Archive: `
--- a/a.txt --
-`,
-			Pkgs: []*est.Package{},
-		},
-	}
-
-	c := qt.New(t)
-	for i, test := range tests {
-		a := txtar.Parse([]byte(test.Archive))
-		base := t.TempDir()
-		err := txtar.Write(a, base)
-		c.Assert(err, qt.IsNil, qt.Commentf("test #%d", i))
-
-		fs := token.NewFileSet()
-		pkgs, err := collectPackages(fs, base, modulePath, goparser.ParseComments, true)
-		if test.Err != "" {
-			c.Assert(err, qt.ErrorMatches, test.Err, qt.Commentf("test #%d", i))
-			continue
-		}
-		c.Assert(err, qt.IsNil)
-		c.Assert(pkgs, qt.HasLen, len(test.Pkgs), qt.Commentf("test #%d", i))
-		for i, got := range pkgs {
-			want := test.Pkgs[i]
-			c.Assert(got.Name, qt.Equals, want.Name)
-			c.Assert(got.ImportPath, qt.Equals, want.ImportPath)
-			c.Assert(got.RelPath, qt.Equals, want.RelPath)
-			c.Assert(got.Dir, qt.Equals, filepath.Join(base, filepath.FromSlash(want.Dir)))
-		}
-	}
-}
-
-func TestCompile(t *testing.T) {
-	ts.Run(t, ts.Params{
-		Dir: "testdata",
-		Setup: func(e *ts.Env) error {
-			gomod := []byte("module test\n\nrequire encore.dev v0.0.6")
-			return ioutil.WriteFile(filepath.Join(e.WorkDir, "go.mod"), gomod, 0755)
-		},
-	})
-}
-
-func TestMain(m *testing.M) {
-	os.Exit(testscript.RunMain(m, map[string]func() int{
-		"parse": func() int {
-			wd, err := os.Getwd()
-			if err != nil {
-				os.Stderr.WriteString(err.Error())
-				return 1
-			}
-			modPath := filepath.Join(wd, "go.mod")
-			modData, err := ioutil.ReadFile(modPath)
-			if err != nil {
-				os.Stderr.WriteString(err.Error())
-				return 1
-			}
-			modFile, err := modfile.Parse(modPath, modData, nil)
-			if err != nil {
-				os.Stderr.WriteString(err.Error())
-				return 1
-			}
-
-			cfg := &Config{
-				AppRoot:    wd,
-				WorkingDir: ".",
-				ModulePath: modFile.Module.Mod.Path,
-			}
-			res, err := Parse(cfg)
-			if err != nil {
-				os.Stderr.WriteString(err.Error())
-				return 1
-			}
-			for _, svc := range res.App.Services {
-				for _, rpc := range svc.RPCs {
-					fmt.Fprintf(os.Stdout, "rpc %s.%s access=%v raw=%v\n", svc.Name, rpc.Name, rpc.Access, rpc.Raw)
-				}
-			}
-			return 0
-		},
-	}))
-}
diff --git a/parser/schema.go b/parser/schema.go
deleted file mode 100644
index 68759267f0..0000000000
--- a/parser/schema.go
+++ /dev/null
@@ -1,267 +0,0 @@
-package parser
-
-import (
-	"go/ast"
-	"go/token"
-	"go/types"
-	"strconv"
-
-	"encr.dev/parser/est"
-	"encr.dev/parser/internal/names"
-	schema "encr.dev/proto/encore/parser/schema/v1"
-	"github.com/fatih/structtag"
-)
-
-// resolveType parses the schema from a type expression.
-func (p *parser) resolveDecl(pkg *est.Package, file *est.File, expr ast.Expr) *schema.Decl {
-	typ := p.resolveType(pkg, file, expr)
-	n := typ.GetNamed()
-	if n == nil {
-		p.errf(expr.Pos(), "%s is not a named type", types.ExprString(expr))
-		panic(bailout{})
-	}
-	return p.decls[n.Id]
-}
-
-// resolveType parses the schema from a type expression.
-func (p *parser) resolveType(pkg *est.Package, file *est.File, expr ast.Expr) *schema.Type {
-	expr = deref(expr)
-	names := p.names[pkg]
-
-	switch expr := expr.(type) {
-	case *ast.Ident:
-		// Local type name or universe scope
-		if d, ok := names.Decls[expr.Name]; ok && d.Type == token.TYPE {
-			return p.parseDecl(pkg, d)
-		} else if b, ok := builtinTypes[expr.Name]; ok {
-			return &schema.Type{
-				Typ: &schema.Type_Builtin{Builtin: b},
-			}
-		}
-		p.errf(expr.Pos(), "undefined type: %s", expr.Name)
-
-	case *ast.SelectorExpr:
-		// pkg.T
-		if pkgName, ok := expr.X.(*ast.Ident); ok {
-			pkgPath := names.Files[file].NameToPath[pkgName.Name]
-			if otherPkg, ok := p.pkgMap[pkgPath]; ok {
-				if d, ok := p.names[otherPkg].Decls[expr.Sel.Name]; ok && d.Type == token.TYPE {
-					return p.parseDecl(otherPkg, d)
-				}
-			} else {
-				return p.parseEncoreBuiltin(expr.Pos(), pkgPath, expr.Sel.Name)
-			}
-		}
-		p.errf(expr.Pos(), "%s is not a type", types.ExprString(expr))
-
-	case *ast.StructType:
-		st := &schema.Struct{}
-
-		// Track seen names to make sure there aren't any name conflicts
-		// in the presence of json tags.
-		seenNames := make(map[string]token.Pos)
-		checkName := func(pos token.Pos, name, typ string) {
-			if pos2, ok := seenNames[name]; ok {
-				pp := p.fset.Position(pos2)
-				p.errf(pos, typ+" name %s conflicts with already defined name at %s", name, pp)
-			} else {
-				seenNames[name] = pos
-			}
-		}
-
-		for _, field := range expr.Fields.List {
-			typ := p.resolveType(pkg, file, field.Type)
-			if len(field.Names) == 0 {
-				p.err(field.Pos(), "cannot use anonymous fields in Encore struct types")
-			}
-			opts := p.parseStructTag(field.Tag)
-
-			// Validate the names to make sure we don't have any name collisions
-			if js := opts.JSONName; js != "" {
-				if len(field.Names) > 1 {
-					pp := p.fset.Position(field.Names[0].Pos())
-					p.errf(field.Names[1].Pos(), "json field name %s conflicts with previous field (defined at %s)", js, pp)
-				}
-				checkName(field.Tag.Pos(), js, "json")
-			} else {
-				for _, name := range field.Names {
-					checkName(name.Pos(), name.Name, "field")
-				}
-			}
-
-			for _, name := range field.Names {
-				f := &schema.Field{
-					Typ:      typ,
-					Name:     name.Name,
-					Doc:      field.Doc.Text(),
-					Optional: opts.Optional,
-					JsonName: opts.JSONName,
-				}
-				st.Fields = append(st.Fields, f)
-			}
-		}
-		return &schema.Type{Typ: &schema.Type_Struct{Struct: st}}
-
-	case *ast.MapType:
-		key := p.resolveType(pkg, file, expr.Key)
-		value := p.resolveType(pkg, file, expr.Value)
-		return &schema.Type{Typ: &schema.Type_Map{Map: &schema.Map{Key: key, Value: value}}}
-
-	case *ast.ArrayType:
-		elem := p.resolveType(pkg, file, expr.Elt)
-		// Translate []byte to BYTES
-		if b, ok := elem.Typ.(*schema.Type_Builtin); ok && b.Builtin == schema.Builtin_UINT8 {
-			return &schema.Type{Typ: &schema.Type_Builtin{Builtin: schema.Builtin_BYTES}}
-		}
-		return &schema.Type{Typ: &schema.Type_List{List: &schema.List{Elem: elem}}}
-
-	case *ast.InterfaceType:
-		p.err(expr.Pos(), "cannot use interface types in Encore schema definitions")
-
-	case *ast.ChanType:
-		p.err(expr.Pos(), "cannot use channel types in Encore schema definitions")
-
-	case *ast.FuncType:
-		p.err(expr.Pos(), "cannot use function types in Encore schema definitions")
-
-	default:
-		p.errf(expr.Pos(), "%s is not a type", types.ExprString(expr))
-	}
-
-	panic(bailout{})
-}
-
-// parseDecl parses the type from a package declaration.
-func (p *parser) parseDecl(pkg *est.Package, d *names.PkgDecl) *schema.Type {
-	key := pkg.ImportPath + "." + d.Name
-	decl, ok := p.declMap[key]
-	if !ok {
-		// We haven't parsed this yet; do so now.
-		// Allocate a decl immediately so that we can properly handle
-		// recursive types by short-circuiting above the second time we get here.
-		id := uint32(len(p.decls))
-		typ := d.Spec.(*ast.TypeSpec).Type
-		decl = &schema.Decl{
-			Id:   id,
-			Name: d.Name,
-			Doc:  d.Doc,
-			Loc:  parseLoc(d.File, typ),
-			// Type is set below
-		}
-		p.declMap[key] = decl
-		p.decls = append(p.decls, decl)
-		decl.Type = p.resolveType(pkg, d.File, d.Spec.(*ast.TypeSpec).Type)
-	}
-
-	return &schema.Type{Typ: &schema.Type_Named{
-		Named: &schema.Named{Id: decl.Id},
-	}}
-}
-
-func (p *parser) parseEncoreBuiltin(pos token.Pos, pkgPath, name string) *schema.Type {
-	switch {
-	case pkgPath == uuidImportPath && name == "UUID":
-		return &schema.Type{Typ: &schema.Type_Builtin{Builtin: schema.Builtin_UUID}}
-	case pkgPath == authImportPath && name == "UID":
-		return &schema.Type{Typ: &schema.Type_Builtin{Builtin: schema.Builtin_USER_ID}}
-	case pkgPath == "time" && name == "Time":
-		return &schema.Type{Typ: &schema.Type_Builtin{Builtin: schema.Builtin_TIME}}
-	case pkgPath == "encoding/json" && name == "RawMessage":
-		return &schema.Type{Typ: &schema.Type_Builtin{Builtin: schema.Builtin_JSON}}
-	}
-	p.errf(pos, "%s.%s is not a supported type in Encore\n\tnote: you can only use types defined within your Encore app and builtins\n\tbuiltins also include time.Time, json.RawMessage, and encore.dev/types/uuid.UUID", pkgPath, name)
-	panic(bailout{})
-}
-
-// structFieldOptions represents the parsed struct tag information
-// that Encore recognizes.
-type structFieldOptions struct {
-	// JSONName is set if there is a distinct json name (`json:"foo"`)
-	JSONName string
-	// Optional is true if there is an `encore:"optional"` tag
-	Optional bool
-}
-
-// parseStructTag parses the struct tag to determine any encore-specific options
-// and the JSON name, if any.
-func (p *parser) parseStructTag(tag *ast.BasicLit) structFieldOptions {
-	var opts structFieldOptions
-	if tag == nil {
-		return opts
-	}
-
-	val, _ := strconv.Unquote(tag.Value)
-	tags, err := structtag.Parse(val)
-	if err != nil {
-		p.errf(tag.Pos(), "invalid struct tag: %v", err)
-		return opts
-	}
-	if enc, _ := tags.Get("encore"); enc != nil {
-		ops := append([]string{enc.Name}, enc.Options...)
-		for _, o := range ops {
-			switch o {
-			case "optional":
-				opts.Optional = true
-			default:
-				p.errf(tag.Pos(), "invalid encore struct tag option: %s", o)
-			}
-		}
-	}
-	if js, _ := tags.Get("json"); js != nil {
-		if v := js.Value(); v != "" {
-			opts.JSONName = v
-		}
-	}
-	return opts
-}
-
-func getField(list *ast.FieldList, n int) (field *ast.Field, name string) {
-	i := 0
-	for _, f := range list.List {
-		num := len(f.Names)
-		if num == 0 {
-			num = 1
-		}
-		if n < (i + num) {
-			if len(f.Names) == 0 {
-				return f, ""
-			}
-			return f, f.Names[(i+num)-n-1].Name
-		}
-		i += num
-	}
-	return nil, ""
-}
-
-func deref(expr ast.Expr) ast.Expr {
-	for {
-		star, ok := expr.(*ast.StarExpr)
-		if !ok {
-			break
-		}
-		expr = star.X
-	}
-	return expr
-}
-
-var builtinTypes = map[string]schema.Builtin{
-	"bool":       schema.Builtin_BOOL,
-	"int":        schema.Builtin_INT64,
-	"int8":       schema.Builtin_INT8,
-	"int16":      schema.Builtin_INT16,
-	"int32":      schema.Builtin_INT32,
-	"int64":      schema.Builtin_INT64,
-	"uint":       schema.Builtin_UINT64,
-	"uint8":      schema.Builtin_UINT8,
-	"uint16":     schema.Builtin_UINT16,
-	"uint32":     schema.Builtin_UINT32,
-	"uint64":     schema.Builtin_UINT64,
-	"uintptr":    -1,
-	"float32":    schema.Builtin_FLOAT32,
-	"float64":    schema.Builtin_FLOAT64,
-	"complex64":  -1,
-	"complex128": -1,
-	"string":     schema.Builtin_STRING,
-	"byte":       schema.Builtin_UINT8,
-	"rune":       schema.Builtin_UINT32,
-}
diff --git a/parser/svc.go b/parser/svc.go
deleted file mode 100644
index 320bf5cfa2..0000000000
--- a/parser/svc.go
+++ /dev/null
@@ -1,367 +0,0 @@
-package parser
-
-import (
-	"errors"
-	"fmt"
-	"go/ast"
-	"strings"
-
-	"encr.dev/parser/est"
-	"encr.dev/parser/internal/names"
-)
-
-// parseFeatures parses the application packages looking for Encore features
-// such as RPCs and auth handlers, and computes the set of services.
-func (p *parser) parseServices() {
-	svcPaths := make(map[string]*est.Service) // import path -> *Service
-
-	// First determine which packages are considered services based on
-	// whether they define RPCs.
-	p.svcMap = make(map[string]*est.Service)
-	for _, pkg := range p.pkgs {
-		// svc is a candidate service; if we don't find any
-		// rpcs it is discarded.
-		svc := &est.Service{
-			Name: pkg.Name,
-			Root: pkg,
-			Pkgs: []*est.Package{pkg},
-		}
-		if isSvc := p.parseFuncs(pkg, svc); !isSvc {
-			continue
-		}
-		pkg.Service = svc
-		svcPaths[pkg.ImportPath] = svc
-		if svc2 := p.svcMap[svc.Name]; svc2 != nil {
-			p.errf(pkg.AST.Pos(), "service %s defined twice (previous definition at %s)",
-				svc.Name, p.fset.Position(svc2.Root.Files[0].AST.Pos()))
-			continue
-		}
-		p.svcs = append(p.svcs, svc)
-		p.svcMap[svc.Name] = svc
-	}
-
-PkgLoop:
-	for _, pkg := range p.pkgs {
-		// Determine which service this pkg belongs to, if any
-		path := pkg.ImportPath
-		for {
-			idx := strings.LastIndexByte(path, '/')
-			if idx < 0 {
-				break
-			}
-			path = path[:idx]
-			if svc := svcPaths[path]; svc != nil {
-				if svcPaths[pkg.ImportPath] != nil {
-					// This pkg is a service, but it's nested within another service
-					p.errf(pkg.Files[0].AST.Pos(), "cannot nest service %s within service %s", pkg.Name, svc.Name)
-					continue PkgLoop
-				}
-				pkg.Service = svc
-				svc.Pkgs = append(svc.Pkgs, pkg)
-			}
-		}
-	}
-}
-
-// parseFuncs parses the pkg for any declared RPCs and auth handlers.
-func (p *parser) parseFuncs(pkg *est.Package, svc *est.Service) (isService bool) {
-	for _, f := range pkg.Files {
-		for _, decl := range f.AST.Decls {
-			fd, ok := decl.(*ast.FuncDecl)
-			if !ok {
-				continue
-			}
-
-			dir, doc := p.parseDirectives(fd.Doc)
-			if dir == nil {
-				continue
-			}
-
-			switch dir := dir.(type) {
-			case *rpcDirective:
-				rpc := &est.RPC{
-					Svc:    svc,
-					Name:   fd.Name.Name,
-					Doc:    doc,
-					Access: dir.Access,
-					Raw:    dir.Raw,
-					Func:   fd,
-					File:   f,
-				}
-				p.validateRPC(rpc)
-				svc.RPCs = append(svc.RPCs, rpc)
-				isService = true
-
-			case *authHandlerDirective:
-				if h := p.authHandler; h != nil {
-					p.errf(fd.Pos(), "cannot declare multiple auth handlers (previous declaration at %s)",
-						p.fset.Position(h.Func.Pos()))
-					continue
-				}
-				authHandler := &est.AuthHandler{
-					Svc:  svc,
-					Name: fd.Name.Name,
-					Doc:  doc,
-					Func: fd,
-					File: f,
-				}
-				p.validateAuthHandler(authHandler)
-				p.authHandler = authHandler
-				isService = true
-
-			default:
-				p.errf(dir.Pos(), "unexpected directive type %T", dir)
-				panic(bailout{})
-			}
-		}
-	}
-	return isService
-}
-
-func (p *parser) validateRPC(rpc *est.RPC) {
-	if rpc.Raw {
-		p.validateRawRPC(rpc)
-	} else {
-		p.validateTypedRPC(rpc)
-	}
-}
-
-func (p *parser) validateTypedRPC(rpc *est.RPC) {
-	const sigHint = `
-	hint: valid signatures are:
-	- func(context.Context) error
-	- func(context.Context) (*ResponseData, error)
-	- func(context.Context, *RequestData) error
-	- func(context.Context, *RequestType) (*ResponseData, error)`
-	params := rpc.Func.Type.Params
-	numParams := params.NumFields()
-	if numParams == 0 {
-		p.errf(rpc.Func.Type.Pos(), "invalid API signature (too few parameters)"+sigHint)
-		return
-	}
-
-	results := rpc.Func.Type.Results
-	numResults := results.NumFields()
-	if numResults == 0 {
-		p.errf(rpc.Func.Type.Pos(), "invalid API signature (too few results)"+sigHint)
-		return
-	}
-
-	names := p.names[rpc.Svc.Root]
-	info := names.Files[rpc.File]
-
-	// First type should always be context.Context
-	req := params.List[0].Type
-	if err := validateSel(info, req, "context", "Context"); err != nil {
-		if err == errNotFound {
-			p.err(req.Pos(), "first parameter must be of type context.Context"+sigHint)
-		} else {
-			p.err(req.Pos(), err.Error()+sigHint)
-		}
-		return
-	}
-
-	// Second type must be *T or *pkg.T
-	if numParams >= 2 {
-		param, _ := getField(params, 1)
-		decl := p.resolveDecl(rpc.Svc.Root, rpc.File, param.Type)
-		if decl.Type.GetStruct() == nil {
-			p.err(param.Pos(), "request type must be a struct type")
-		}
-
-		_, isPtr := param.Type.(*ast.StarExpr)
-		rpc.Request = &est.Param{
-			IsPtr: isPtr,
-			Decl:  decl,
-		}
-	}
-
-	// First return value must be *T or *pkg.T
-	if numResults >= 2 {
-		result := results.List[0]
-		decl := p.resolveDecl(rpc.Svc.Root, rpc.File, result.Type)
-		if decl.Type.GetStruct() == nil {
-			p.err(result.Pos(), "response type must be a struct type")
-		}
-		_, isPtr := result.Type.(*ast.StarExpr)
-		rpc.Response = &est.Param{
-			IsPtr: isPtr,
-			Decl:  decl,
-		}
-	}
-
-	if numParams > 2 {
-		param, _ := getField(params, 2)
-		p.err(param.Pos(), "API signature cannot contain more than two parameters"+sigHint)
-		return
-	} else if numResults > 2 {
-		result, _ := getField(results, 2)
-		p.err(result.Pos(), "API signature cannot contain more than two results"+sigHint)
-		return
-	}
-
-	err, _ := getField(results, numResults-1)
-	if id, ok := err.Type.(*ast.Ident); !ok || id.Name != "error" {
-		p.err(err.Pos(), "last result is not of type error"+sigHint)
-		return
-	} else if names.Decls["error"] != nil {
-		p.err(err.Pos(), "last result is not of type error (local name shadows builtin)"+sigHint)
-		return
-	}
-}
-
-func (p *parser) validateRawRPC(rpc *est.RPC) {
-	const sigHint = `
-	hint: signature must be func(http.ResponseWriter, *http.Request)`
-
-	params := rpc.Func.Type.Params
-	if params.NumFields() < 2 {
-		p.err(params.Pos(), "invalid API signature (too few parameters)"+sigHint)
-		return
-	} else if params.NumFields() > 2 {
-		p.err(params.Pos(), "invalid API signature (too many parameters)"+sigHint)
-		return
-	} else if results := rpc.Func.Type.Results; results.NumFields() != 0 {
-		p.err(params.Pos(), "invalid API signature (too many results)"+sigHint)
-		return
-	}
-
-	info := p.names[rpc.Svc.Root].Files[rpc.File]
-
-	{
-		// First type should always be http.ResponseWriter
-		rw := params.List[0].Type
-		if err := validateSel(info, rw, "net/http", "ResponseWriter"); err != nil {
-			if err == errNotFound {
-				p.err(rw.Pos(), "first parameter must be http.ResponseWriter"+sigHint)
-			} else {
-				p.err(rw.Pos(), err.Error()+sigHint)
-			}
-			return
-		}
-	}
-
-	{
-		// First type should always be *http.Request
-		req := params.List[1].Type
-		star, ok := req.(*ast.StarExpr)
-		if !ok {
-			p.err(req.Pos(), "second parameter must be *http.Request"+sigHint)
-			return
-		} else if err := validateSel(info, star.X, "net/http", "Request"); err != nil {
-			if err == errNotFound {
-				p.err(req.Pos(), "second parameter must be *http.Request"+sigHint)
-			} else {
-				p.err(req.Pos(), err.Error()+sigHint)
-			}
-			return
-		}
-	}
-}
-
-// validateAuthHandler parses and valiidates the function declaration for an auth handler.
-func (p *parser) validateAuthHandler(h *est.AuthHandler) {
-	const sigHint = `
-	hint: valid signatures are:
-	- func(ctx context.Context, token string) (auth.UID, error)
-	- func(ctx context.Context, token string) (auth.UID, *UserData, error)
-
-	note: *UserData is a custom data type you define`
-
-	typ := h.Func.Type
-	params := typ.Params
-	numParams := params.NumFields()
-	if numParams < 2 {
-		p.errf(h.Func.Type.Pos(), "invalid API signature (too few parameters)"+sigHint)
-		return
-	} else if numParams > 3 {
-		p.errf(h.Func.Type.Pos(), "invalid API signature (too many parameters)"+sigHint)
-		return
-	}
-
-	results := typ.Results
-	numResults := results.NumFields()
-	if numResults < 2 {
-		p.errf(h.Func.Type.Pos(), "invalid API signature (too few results)"+sigHint)
-		return
-	} else if numResults > 3 {
-		p.errf(h.Func.Type.Pos(), "invalid API signature (too many results)"+sigHint)
-		return
-	}
-
-	names := p.names[h.Svc.Root]
-	info := names.Files[h.File]
-
-	// First param must be context.Context
-	req, _ := getField(params, 0)
-	if err := validateSel(info, req.Type, "context", "Context"); err != nil {
-		if err == errNotFound {
-			p.err(req.Type.Pos(), "first parameter must be of type context.Context"+sigHint)
-		} else {
-			p.err(req.Type.Pos(), err.Error()+sigHint)
-		}
-		return
-	}
-
-	// Second param must be string
-	tok, _ := getField(params, 1)
-	if id, ok := tok.Type.(*ast.Ident); !ok || id.Name != "string" {
-		p.err(tok.Type.Pos(), "second parameter must be of type string"+sigHint)
-		return
-	} else if names.Decls["string"] != nil {
-		p.err(tok.Type.Pos(), "second parameter must be of type string (local name shadows builtin)"+sigHint)
-		return
-	}
-
-	// First result must be auth.UID
-	uid, _ := getField(results, 0)
-	if err := validateSel(info, uid.Type, "encore.dev/beta/auth", "UID"); err != nil {
-		if err == errNotFound {
-			p.err(req.Type.Pos(), "first result must be of type auth.UID"+sigHint)
-		} else {
-			p.err(req.Type.Pos(), err.Error()+sigHint)
-		}
-		return
-	}
-
-	if numResults == 3 {
-		// Second result must be *T or *pkg.T
-		authData, _ := getField(results, 1)
-		decl := p.resolveDecl(h.Svc.Root, h.File, authData.Type)
-		if decl.Type.GetStruct() == nil {
-			p.err(authData.Pos(), "auth data must be a struct type")
-		}
-		_, isPtr := authData.Type.(*ast.StarExpr)
-		h.AuthData = &est.Param{
-			IsPtr: isPtr,
-			Decl:  decl,
-		}
-	}
-
-	// Last result must be error
-	err, _ := getField(results, numResults-1)
-	if id, ok := err.Type.(*ast.Ident); !ok || id.Name != "error" {
-		p.err(err.Pos(), "last result is not of type error"+sigHint)
-		return
-	} else if names.Decls["error"] != nil {
-		p.err(err.Pos(), "last result is not of type error (local name shadows builtin)"+sigHint)
-		return
-	}
-}
-
-var errNotFound = errors.New("not found")
-
-func validateSel(info *names.File, x ast.Node, pkgPath, name string) error {
-	if sel, ok := x.(*ast.SelectorExpr); ok && sel.Sel.Name == name {
-		if id, ok := sel.X.(*ast.Ident); ok {
-			path := info.NameToPath[id.Name]
-			if path == "" {
-				return fmt.Errorf(`missing import of package "%s"`, pkgPath)
-			} else if path != pkgPath {
-				return fmt.Errorf(`missing import of package "%s"\n\tidentifier %s" refers to package "%s"`, pkgPath, id.Name, path)
-			}
-			return nil
-		}
-	}
-	return errNotFound
-}
diff --git a/parser/testdata/auth_handler_call.txt b/parser/testdata/auth_handler_call.txt
deleted file mode 100644
index 488a35e5aa..0000000000
--- a/parser/testdata/auth_handler_call.txt
+++ /dev/null
@@ -1,29 +0,0 @@
-! parse
-stderr 'cannot reference auth handler svc.MyAuth from another package'
-
--- svc/svc.go --
-package svc
-
-import (
-    "context"
-    "encore.dev/beta/auth"
-)
-
-type MyData struct {
-    Name string
-}
-
-//encore:authhandler
-func MyAuth(ctx context.Context, token string) (auth.UID, *MyData, error) { return "", nil, nil }
-
--- svc2/svc2.go --
-package svc2
-
-import (
-    "context"
-    "test/svc"
-)
-
-func Foo() {
-    svc.MyAuth(context.Background(), "foo")
-}
\ No newline at end of file
diff --git a/parser/testdata/auth_handler_multiple.txt b/parser/testdata/auth_handler_multiple.txt
deleted file mode 100644
index 46c665628c..0000000000
--- a/parser/testdata/auth_handler_multiple.txt
+++ /dev/null
@@ -1,16 +0,0 @@
-! parse
-stderr 'cannot declare multiple auth handlers'
-
--- svc/svc.go --
-package svc
-
-import (
-    "context"
-    "encore.dev/beta/auth"
-)
-
-//encore:authhandler
-func MyAuth(ctx context.Context, token string) (auth.UID, error) { return "", nil }
-
-//encore:authhandler
-func MyAuth2(ctx context.Context, token string) (auth.UID, error) { return "", nil }
\ No newline at end of file
diff --git a/parser/testdata/auth_handler_reference.txt b/parser/testdata/auth_handler_reference.txt
deleted file mode 100644
index 962f263db9..0000000000
--- a/parser/testdata/auth_handler_reference.txt
+++ /dev/null
@@ -1,25 +0,0 @@
-! parse
-stderr 'cannot reference auth handler svc.MyAuth from another package'
-
--- svc/svc.go --
-package svc
-
-import (
-    "context"
-    "encore.dev/beta/auth"
-)
-
-//encore:authhandler
-func MyAuth(ctx context.Context, token string) (auth.UID, error) { return "", nil }
-
--- svc2/svc2.go --
-package svc2
-
-import (
-    "context"
-    "test/svc"
-)
-
-func Foo() {
-    _ = svc.MyAuth
-}
\ No newline at end of file
diff --git a/parser/testdata/rpc_auth_no_authhandler.txt b/parser/testdata/rpc_auth_no_authhandler.txt
deleted file mode 100644
index e43f05f58f..0000000000
--- a/parser/testdata/rpc_auth_no_authhandler.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-! parse
-stderr 'cannot use "auth" access type'
-
--- svc/svc.go --
-package svc
-
-import "context"
-
-//encore:api auth
-func API(ctx context.Context) error { return nil }
\ No newline at end of file
diff --git a/parser/testdata/rpc_legacy_syntax.txt b/parser/testdata/rpc_legacy_syntax.txt
deleted file mode 100644
index ae37f7b42d..0000000000
--- a/parser/testdata/rpc_legacy_syntax.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-parse
-stdout 'svc.API access=private raw=false'
-
--- svc/svc.go --
-package svc
-
-import "context"
-
-// encore:api
-func API(ctx context.Context) error { return nil }
\ No newline at end of file
diff --git a/parser/testdata/rpc_raw_internal.txt b/parser/testdata/rpc_raw_internal.txt
deleted file mode 100644
index 5918218479..0000000000
--- a/parser/testdata/rpc_raw_internal.txt
+++ /dev/null
@@ -1,12 +0,0 @@
-# Verify that one cannot use internal and raw RPCs
-
-! parse
-stderr 'private APIs cannot be declared raw'
-
--- svc/svc.go --
-package svc
-
-import "net/http"
-
-//encore:api raw
-func API(w http.ResponseWriter, req *http.Request) { }
\ No newline at end of file
diff --git a/parser/testdata/secrets.txt b/parser/testdata/secrets.txt
deleted file mode 100644
index f475e0e5ab..0000000000
--- a/parser/testdata/secrets.txt
+++ /dev/null
@@ -1,10 +0,0 @@
-# Verify that secrets are parsed successfully
-
-parse
-
--- svc/svc.go --
-package svc
-
-var secrets struct {
-    Foo string
-}
\ No newline at end of file
diff --git a/parser/testdata/secrets_non_string.txt b/parser/testdata/secrets_non_string.txt
deleted file mode 100644
index d3a668b517..0000000000
--- a/parser/testdata/secrets_non_string.txt
+++ /dev/null
@@ -1,11 +0,0 @@
-# Verify that secret fields are of type string
-
-! parse
-stderr 'field Foo is not of type string'
-
--- svc/svc.go --
-package svc
-
-var secrets struct {
-    Foo int
-}
\ No newline at end of file
diff --git a/pkg/ansi/ansi.go b/pkg/ansi/ansi.go
new file mode 100644
index 0000000000..351cb0ffae
--- /dev/null
+++ b/pkg/ansi/ansi.go
@@ -0,0 +1,71 @@
+// Package ansi provides helper functions for writing ANSI terminal escape codes.
+package ansi
+
+import "fmt"
+
+// SetCursorPosition returns the ANSI escape code for setting the cursor position.
+// The rows and columns are one-based. If <=0 they default to the first row/column.
+func SetCursorPosition(row, col int) string {
+	if row <= 0 {
+		row = 1
+	}
+	if col <= 0 {
+		col = 1
+	}
+	return fmt.Sprintf("\u001b[%d;%dH", row, col)
+}
+
+type ClearScreenMethod int
+
+const (
+	CursorToBottom           ClearScreenMethod = 0
+	CursorToTop              ClearScreenMethod = 1
+	WholeScreen              ClearScreenMethod = 2
+	WholeScreenAndScrollback ClearScreenMethod = 3
+)
+
+// ClearScreen clears the screen according to the given method.
+func ClearScreen(method ClearScreenMethod) string {
+	return fmt.Sprintf("\u001b[%dJ", method)
+}
+
+type ClearLineMethod int
+
+const (
+	CursorToEnd   ClearLineMethod = 0 // cursor to end of line
+	CursorToStart ClearLineMethod = 1 // cursor to start of line
+	WholeLine     ClearLineMethod = 2
+)
+
+// ClearLine clears the current line according to the given method.
+// The cursor position within the line does not change.
+func ClearLine(method ClearLineMethod) string {
+	return fmt.Sprintf("\u001b[%dK", method)
+}
+
+const (
+	// SaveCursorPosition saves the current cursor position.
+	SaveCursorPosition = "\u001b7"
+	// RestoreCursorPosition restores the cursor position to the saved position.
+	RestoreCursorPosition = "\u001b8"
+)
+
+// MoveCursorLeft moves the cursor left n cells.
+// If the cursor is already at the edge of the screen it has no effect.
+// If n is negative it moves to the right instead.
+func MoveCursorLeft(n int) string {
+	if n < 0 {
+		return MoveCursorRight(-n)
+	}
+	return fmt.Sprintf("\u001b[%dD", n)
+}
+
+// MoveCursorRight moves the cursor right n cells.
+// If the cursor is already at the edge of the screen it has no effect.
+// If n is negative it moves to the left instead.
+func MoveCursorRight(n int) string {
+	if n < 0 {
+		return MoveCursorLeft(-n)
+	}
+	return fmt.Sprintf("\u001b[%dC", n)
+}
diff --git a/pkg/appfile/appfile.go b/pkg/appfile/appfile.go
new file mode 100644
index 0000000000..f6b1c1be44
--- /dev/null
+++ b/pkg/appfile/appfile.go
@@ -0,0 +1,215 @@
+// Package appfile reads and writes encore.app files.
+package appfile
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"path/filepath"
+
+	"github.com/tailscale/hujson"
+
+	"encore.dev/appruntime/exported/experiments"
+)
+
+// Name is the name of the Encore app file.
+// It is expected to be located in the root of the Encore app
+// (which is usually the Git repository root).
+const Name = "encore.app"
+
+type Lang string
+
+const (
+	LangGo Lang = "go"
+	LangTS Lang = "typescript"
+)
+
+// File is a parsed encore.app file.
+type File struct {
+	// ID is the encore.dev app id for the app.
+	// It is empty if the app is not linked to encore.dev.
+	ID string `json:"id"` // can be empty
+
+	// Experiments is a list of values to enable experimental features in Encore.
+	// These are not guaranteed to be stable in either runtime behaviour
+	// or in API design.
+	//
+	// Do not use these features in production without consulting the Encore team.
+	Experiments []experiments.Name `json:"experiments,omitempty"`
+
+	// Lang is the language the app is written in.
+	// If empty it defaults to Go.
+	Lang Lang `json:"lang"`
+
+	// Configure global CORS settings for the application which
+	// will be applied to all API gateways into the application.
+	GlobalCORS *CORS `json:"global_cors,omitempty"`
+
+	// Build contains build settings for the application.
+	Build Build `json:"build,omitempty"`
+
+	// CgoEnabled enables building with cgo.
+	//
+	// Deprecated: Use build.cgo_enabled instead.
+	CgoEnabled bool `json:"cgo_enabled,omitempty"`
+
+	// DockerBaseImage changes the docker base image used for building the application
+	// in Encore's CI/CD system. If unspecified it defaults to "scratch".
+	//
+	// Deprecated: Use build.docker.base_image instead.
+	DockerBaseImage string `json:"docker_base_image,omitempty"`
+
+	// LogLevel is the minimum log level for the app.
+	// If empty it defaults to "trace".
+	LogLevel string `json:"log_level,omitempty"`
+}
+
+type Build struct {
+	// CgoEnabled enables building with cgo.
+	CgoEnabled bool `json:"cgo_enabled,omitempty"`
+
+	// Docker configures the docker images built
+	// by Encore's CI/CD system.
+	Docker Docker `json:"docker,omitempty"`
+
+	// WorkerPooling enables worker pooling for Encore.ts.
+	WorkerPooling bool `json:"worker_pooling,omitempty"`
+}
+
+type Docker struct {
+	// BaseImage changes the docker base image used for building the application
+	// in Encore's CI/CD system. If unspecified it defaults to "scratch".
+	BaseImage string `json:"base_image,omitempty"`
+
+	// BundleSource determines whether the source code of the application
+	// should be bundled into the binary, at "/workspace".
+	BundleSource bool `json:"bundle_source,omitempty"`
+
+	// WorkingDir specifies the working directory to start the docker image in.
+	// If empty it defaults to "/workspace" if the source code is bundled, and to "/" otherwise.
+	WorkingDir string `json:"working_dir,omitempty"`
+
+	// ProcessPerService specifies whether each service should run in its own process. If false,
+	// all services are run in the same process.
+	ProcessPerService bool `json:"process_per_service,omitempty"`
+}
+
+type CORS struct {
+	// Debug enables CORS debug logging.
+	Debug bool `json:"debug,omitempty"`
+
+	// AllowHeaders allows an app to specify additional headers that should be
+	// accepted by the app.
+	//
+	// If the list contains "*", then all headers are allowed.
+	AllowHeaders []string `json:"allow_headers"`
+
+	// ExposeHeaders allows an app to specify additional headers that should be
+	// exposed from the app, beyond the default set always recognized by Encore.
+	//
+	// If the list contains "*", then all headers are exposed.
+	ExposeHeaders []string `json:"expose_headers"`
+
+	// AllowOriginsWithoutCredentials specifies the allowed origins for requests
+	// that don't include credentials. If nil it defaults to allowing all domains
+	// (equivalent to []string{"*"}).
+	AllowOriginsWithoutCredentials []string `json:"allow_origins_without_credentials,omitempty"`
+
+	// AllowOriginsWithCredentials specifies the allowed origins for requests
+	// that include credentials. If a request is made from an Origin in this list
+	// Encore responds with Access-Control-Allow-Origin: <Origin>.
+	//
+	// The URLs in this list may include wildcards (e.g. "https://*.example.com"
+	// or "https://*-myapp.example.com").
+	AllowOriginsWithCredentials []string `json:"allow_origins_with_credentials,omitempty"`
+}
+
+// Parse parses the app file data into a File.
+func Parse(data []byte) (*File, error) {
+	var f File
+	data, err := hujson.Standardize(data)
+	if err == nil {
+		err = json.Unmarshal(data, &f)
+	}
+	if err != nil {
+		return nil, fmt.Errorf("appfile.Parse: %v", err)
+	}
+
+	switch f.Lang {
+	case LangGo, LangTS:
+	// Do nothing
+	case "":
+		f.Lang = LangGo
+	default:
+		return nil, fmt.Errorf("appfile.Parse: invalid lang %q", f.Lang)
+	}
+
+	// Parse deprecated fields into the new Build struct.
+	f.Build.CgoEnabled = f.Build.CgoEnabled || f.CgoEnabled
+	if f.Build.Docker.BaseImage == "" {
+		f.Build.Docker.BaseImage = f.DockerBaseImage
+	}
+
+	return &f, nil
+}
+
+// ParseFile parses the app file located at path.
+func ParseFile(path string) (*File, error) {
+	data, err := os.ReadFile(path)
+	if errors.Is(err, fs.ErrNotExist) {
+		return &File{}, nil
+	} else if err != nil {
+		return nil, fmt.Errorf("appfile.ParseFile: %w", err)
+	}
+	return Parse(data)
+}
+
+// ParseFileStrict parses the app file located at path.
+// Unlike ParseFile, it returns an error if the file does not exist.
+func ParseFileStrict(path string) (*File, error) {
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("appfile.ParseFileStrict: %w", err)
+	}
+	return Parse(data)
+}
+
+// Slug parses the app slug for the encore.app file located at path.
+// The slug can be empty if the app is not linked to encore.dev.
+func Slug(appRoot string) (string, error) {
+	f, err := ParseFile(filepath.Join(appRoot, Name))
+	if err != nil {
+		return "", err
+	}
+	return f.ID, nil
+}
+
+// Experiments returns the experimental feature the app located
+// at appRoot has opted into.
+func Experiments(appRoot string) ([]experiments.Name, error) {
+	f, err := ParseFile(filepath.Join(appRoot, Name))
+	if err != nil {
+		return nil, err
+	}
+	return f.Experiments, nil
+}
+
+// GlobalCORS returns the global CORS settings for the app located
+func GlobalCORS(appRoot string) (*CORS, error) {
+	f, err := ParseFile(filepath.Join(appRoot, Name))
+	if err != nil {
+		return nil, err
+	}
+	return f.GlobalCORS, nil
+}
+
+// AppLang returns the language of the app located at appRoot.
+func AppLang(appRoot string) (Lang, error) {
+	f, err := ParseFile(filepath.Join(appRoot, Name))
+	if err != nil {
+		return "", err
+	}
+	return f.Lang, nil
+}
diff --git a/pkg/bits/bits.go b/pkg/bits/bits.go
new file mode 100644
index 0000000000..665c78f853
--- /dev/null
+++ b/pkg/bits/bits.go
@@ -0,0 +1,68 @@
+package bits
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/url"
+
+	"github.com/cockroachdb/errors"
+)
+
+type Bit struct {
+	Slug        string
+	Title       string
+	Description string
+
+	// GitHubTree is a URL to the GitHub tree for this bit,
+	// in the format expected by github.ParseTree.
+	GitHubTree string
+}
+
+// List lists available bits.
+func List(ctx context.Context) ([]*Bit, error) {
+	resp, err := http.Get("https://automativity.encore.dev/bits")
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != 200 {
+		slurp, _ := io.ReadAll(resp.Body)
+		return nil, errors.Newf("got status %d: %s", resp.StatusCode, slurp)
+	}
+
+	var data struct {
+		Bits []*Bit
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
+		return nil, errors.Wrap(err, "decode json response")
+	}
+	return data.Bits, nil
+}
+
+// ErrNotFound is reported by Get if the bit with the given slug is not found.
+var ErrNotFound = errors.New("bit not found")
+
+// Get retrieves a bit by its slug.
+func Get(ctx context.Context, slug string) (*Bit, error) {
+	resp, err := http.Get("https://automativity.encore.dev/bits/" + url.PathEscape(slug))
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == 404 {
+		return nil, ErrNotFound
+	} else if resp.StatusCode != 200 {
+		slurp, _ := io.ReadAll(resp.Body)
+		return nil, errors.Newf("got status %d: %s", resp.StatusCode, slurp)
+	}
+
+	var bit Bit
+	if err := json.NewDecoder(resp.Body).Decode(&bit); err != nil {
+		return nil, errors.Wrap(err, "decode json response")
+	}
+	return &bit, nil
+}
diff --git a/pkg/bits/download.go b/pkg/bits/download.go
new file mode 100644
index 0000000000..937c382d24
--- /dev/null
+++ b/pkg/bits/download.go
@@ -0,0 +1,57 @@
+package bits
+
+import (
+	"context"
+	"go/token"
+	"runtime"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog"
+
+	"encr.dev/pkg/github"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/app"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/parser"
+)
+
+// Extract downloads and extracts a bit into a given directory.
+func Extract(ctx context.Context, b *Bit, dst string) error {
+	tree, err := github.ParseTree(ctx, b.GitHubTree)
+	if err != nil {
+		return err
+	}
+	return github.ExtractTree(ctx, tree, dst)
+}
+
+// Describe describes the contents of the bit extracted in dir.
+func Describe(ctx context.Context, dir string) (desc *app.Desc, err error) {
+	fs := token.NewFileSet()
+	errs := perr.NewList(ctx, fs)
+	pc := &parsectx.Context{
+		Ctx: ctx,
+		Log: zerolog.Logger{},
+		Build: parsectx.BuildInfo{
+			Experiments: nil,
+			GOARCH:      runtime.GOARCH,
+			GOOS:        runtime.GOOS,
+		},
+		MainModuleDir: paths.RootedFSPath(dir, "."),
+		FS:            fs,
+		ParseTests:    false,
+		Errs:          errs,
+	}
+
+	defer func() {
+		if l, ok := perr.CatchBailout(recover()); ok {
+			err = errors.Newf("parse failure:\n%s", l.FormatErrors())
+		} else if errs.Len() > 0 {
+			err = errors.Newf("parse failure:\n%s", errs.FormatErrors())
+		}
+	}()
+
+	pp := parser.NewParser(pc)
+	res := pp.Parse()
+	return app.ValidateAndDescribe(pc, res), nil
+}
diff --git a/pkg/builder/builder.go b/pkg/builder/builder.go
new file mode 100644
index 0000000000..e9a328f0ec
--- /dev/null
+++ b/pkg/builder/builder.go
@@ -0,0 +1,287 @@
+package builder
+
+import (
+	"context"
+	"errors"
+	"io"
+	"io/fs"
+	"os"
+	pathspkg "path"
+	"runtime"
+	"slices"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/experiments"
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/internal/optracker"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/cueutil"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+var LocalBuildTags = []string{
+	"encore_local",
+	"encore_no_gcp", "encore_no_aws", "encore_no_azure",
+	"encore_no_datadog", "encore_no_prometheus",
+}
+
+// DebugMode specifies how to compile the application for debugging.
+type DebugMode string
+
+const (
+	DebugModeDisabled DebugMode = "disabled"
+	DebugModeEnabled  DebugMode = "enabled"
+	DebugModeBreak    DebugMode = "break"
+)
+
+type BuildInfo struct {
+	BuildTags          []string
+	CgoEnabled         bool
+	StaticLink         bool
+	DebugMode          DebugMode
+	Environ            []string
+	GOOS, GOARCH       string
+	KeepOutput         bool
+	Revision           string
+	UncommittedChanges bool
+
+	// MainPkg is the path to the existing main package to use, if any.
+	MainPkg option.Option[paths.Pkg]
+
+	// Overrides to explicitly set the GoRoot and EncoreRuntime paths.
+	// if not set, they will be inferred from the current executable.
+	GoRoot         option.Option[paths.FS]
+	EncoreRuntimes option.Option[paths.FS]
+
+	// UseLocalJSRuntime specifies whether to override the installed Encore version
+	// with the local JS runtime.
+	UseLocalJSRuntime bool
+
+	// Logger allows a custom logger to be used by the various phases of the builder.
+	Logger option.Option[zerolog.Logger]
+}
+
+func (b *BuildInfo) IsCrossBuild() bool {
+	return b.GOOS != runtime.GOOS || b.GOARCH != runtime.GOARCH
+}
+
+// DefaultBuildInfo returns a BuildInfo with default values.
+// It can be modified afterwards.
+func DefaultBuildInfo() BuildInfo {
+	return BuildInfo{
+		BuildTags:          slices.Clone(LocalBuildTags),
+		CgoEnabled:         true,
+		StaticLink:         false,
+		DebugMode:          DebugModeDisabled,
+		GOOS:               runtime.GOOS,
+		GOARCH:             runtime.GOARCH,
+		KeepOutput:         false,
+		Revision:           "",
+		UncommittedChanges: false,
+
+		// Use the local JS runtime if this is a development build.
+		UseLocalJSRuntime: version.Channel == version.DevBuild,
+	}
+}
+
+type ParseParams struct {
+	Build       BuildInfo
+	App         *apps.Instance
+	Experiments *experiments.Set
+	WorkingDir  string
+	ParseTests  bool
+
+	// Optional writer to redirect stderr to.
+	Stderr option.Option[io.Writer]
+}
+
+type ParseResult struct {
+	Meta *meta.Data
+	Data any
+}
+
+type CompileParams struct {
+	Build       BuildInfo
+	App         *apps.Instance
+	Parse       *ParseResult
+	OpTracker   *optracker.OpTracker
+	Experiments *experiments.Set
+	WorkingDir  string
+
+	// Override to explicitly allow the Encore version to be set.
+	EncoreVersion option.Option[string]
+
+	Environ []string
+}
+
+type ArtifactString string
+
+func (a ArtifactString) Join(strs ...string) ArtifactString {
+	str := pathspkg.Join(strs...)
+	return ArtifactString(pathspkg.Join(string(a), str))
+}
+
+func (a ArtifactString) Expand(artifactDir paths.FS) string {
+	return os.Expand(string(a), func(key string) string {
+		if key == "ARTIFACT_DIR" {
+			return artifactDir.ToIO()
+		}
+		return ""
+	})
+}
+
+type ArtifactStrings []ArtifactString
+
+func (a ArtifactStrings) Expand(artifactDir paths.FS) []string {
+	return fns.Map(a, func(a ArtifactString) string { return a.Expand(artifactDir) })
+}
+
+// CmdSpec is a specification for a command to run.
+//
+// The fields can refer to file paths within the artifact directory
+// using the "${ARTIFACT_DIR}" placeholder (substituted with os.ExpandEnv).
+// This is necessary when building docker images, as otherwise the file paths
+// will refer to the wrong filesystem location in the built docker image.
+type CmdSpec struct {
+	// The command to execute. Can either be a filesystem path
+	// or a path to a binary (using "${ARTIFACT_DIR}" as a placeholder).
+	Command ArtifactStrings `json:"command"`
+
+	// Additional env variables to pass in.
+	Env ArtifactStrings `json:"env"`
+
+	// PrioritizedFiles are file paths that should be prioritized when
+	// building a streamable docker image.
+	PrioritizedFiles ArtifactStrings `json:"prioritized_files"`
+}
+
+func (s *CmdSpec) Expand(artifactDir paths.FS) Cmd {
+	return Cmd{
+		Command: s.Command.Expand(artifactDir),
+		Env:     s.Env.Expand(artifactDir),
+	}
+}
+
+// Cmd defines a command to run. It's like CmdSpec, but uses expanded paths
+// instead of ArtifactStrings. A CmdSpec can be turned into a Cmd using Expand.
+type Cmd struct {
+	// The command to execute, with arguments.
+	Command []string
+
+	// Additional env variables to pass in.
+	Env []string
+}
+
+type CompileResult struct {
+	OS      string
+	Arch    string
+	Outputs []BuildOutput
+}
+
+type BuildOutput interface {
+	GetArtifactDir() paths.FS
+	GetEntrypoints() []Entrypoint
+}
+
+type Entrypoint struct {
+	// How to run this entrypoint.
+	Cmd CmdSpec `json:"cmd"`
+	// Services hosted by this entrypoint.
+	Services []string `json:"services"`
+	// Gateways hosted by this entrypoint.
+	Gateways []string `json:"gateways"`
+	// Whether this entrypoint uses the new runtime config.
+	UseRuntimeConfigV2 bool `json:"use_runtime_config_v2"`
+}
+
+type GoBuildOutput struct {
+	// The folder containing the build artifacts.
+	// These artifacts are assumed to be relocatable.
+	ArtifactDir paths.FS `json:"artifact_dir"`
+
+	// The entrypoints that are part of this build output.
+	Entrypoints []Entrypoint `json:"entrypoints"`
+}
+
+func (o *GoBuildOutput) GetArtifactDir() paths.FS     { return o.ArtifactDir }
+func (o *GoBuildOutput) GetEntrypoints() []Entrypoint { return o.Entrypoints }
+
+type JSBuildOutput struct {
+	// The folder containing the build artifacts.
+	// These artifacts are assumed to be relocatable.
+	ArtifactDir paths.FS `json:"artifact_dir"`
+
+	// The entrypoints that are part of this build output.
+	Entrypoints []Entrypoint `json:"entrypoints"`
+
+	// Whether the build output uses the local runtime on the builder,
+	// as opposed to installing a published release via e.g. 'npm install'.
+	UsesLocalRuntime bool `json:"uses_local_runtime"`
+}
+
+func (o *JSBuildOutput) GetArtifactDir() paths.FS     { return o.ArtifactDir }
+func (o *JSBuildOutput) GetEntrypoints() []Entrypoint { return o.Entrypoints }
+
+type RunTestsParams struct {
+	Spec *TestSpecResult
+
+	// WorkingDir is the directory to invoke the test command from.
+	WorkingDir paths.FS
+
+	// Stdout and Stderr are where to redirect the command output.
+	Stdout, Stderr io.Writer
+}
+
+type TestSpecParams struct {
+	Compile CompileParams
+
+	// Env sets environment variables for "go test".
+	Env []string
+
+	// Args sets extra arguments for "go test".
+	Args []string
+}
+
+// ErrNoTests is reported by TestSpec when there aren't any tests to run.
+var ErrNoTests = errors.New("no tests found")
+
+type TestSpecResult struct {
+	Command string
+	Args    []string
+	Environ []string
+
+	// For use by the builder when invoking RunTests.
+	BuilderData any
+}
+
+type GenUserFacingParams struct {
+	Build BuildInfo
+	App   *apps.Instance
+	Parse *ParseResult
+}
+
+type ServiceConfigsParams struct {
+	Parse   *ParseResult
+	CueMeta *cueutil.Meta
+}
+
+type ServiceConfigsResult struct {
+	Configs     map[string]string
+	ConfigFiles fs.FS
+}
+
+type Impl interface {
+	Parse(context.Context, ParseParams) (*ParseResult, error)
+	Compile(context.Context, CompileParams) (*CompileResult, error)
+	TestSpec(context.Context, TestSpecParams) (*TestSpecResult, error)
+	RunTests(context.Context, RunTestsParams) error
+	ServiceConfigs(context.Context, ServiceConfigsParams) (*ServiceConfigsResult, error)
+	GenUserFacing(context.Context, GenUserFacingParams) error
+	UseNewRuntimeConfig() bool
+	NeedsMeta() bool
+	Close() error
+}
diff --git a/pkg/builder/builderimpl/builders.go b/pkg/builder/builderimpl/builders.go
new file mode 100644
index 0000000000..6374e809b7
--- /dev/null
+++ b/pkg/builder/builderimpl/builders.go
@@ -0,0 +1,16 @@
+package builderimpl
+
+import (
+	"encore.dev/appruntime/exported/experiments"
+	"encr.dev/pkg/appfile"
+	"encr.dev/pkg/builder"
+	"encr.dev/v2/tsbuilder"
+	"encr.dev/v2/v2builder"
+)
+
+func Resolve(lang appfile.Lang, expSet *experiments.Set) builder.Impl {
+	if lang == appfile.LangTS || experiments.TypeScript.Enabled(expSet) {
+		return tsbuilder.New()
+	}
+	return v2builder.BuilderImpl{}
+}
diff --git a/pkg/clientgen/client.go b/pkg/clientgen/client.go
new file mode 100644
index 0000000000..804e32a780
--- /dev/null
+++ b/pkg/clientgen/client.go
@@ -0,0 +1,117 @@
+// Package clientgen generates code for use with Encore apps.
+package clientgen
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"encr.dev/pkg/clientgen/clientgentypes"
+	"encr.dev/pkg/clientgen/openapi"
+	"encr.dev/pkg/errinsrc/srcerrors"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+// Lang represents a programming language or dialect that we support generating code for.
+type Lang string
+
+// These constants represent supported languages.
+const (
+	LangUnknown    Lang = ""
+	LangTypeScript Lang = "typescript"
+	LangJavascript Lang = "javascript"
+	LangGo         Lang = "go"
+	LangOpenAPI    Lang = "openapi"
+)
+
+type generator interface {
+	Generate(p clientgentypes.GenerateParams) error
+	Version() int // The version of the generator.
+}
+
+// ErrUnknownLang is reported by Generate when the language is not known.
+var ErrUnknownLang = errors.New("unknown language")
+
+// Detect attempts to detect the language from the given filename.
+func Detect(path string) (lang Lang, ok bool) {
+	suffix := strings.ToLower(filepath.Ext(path))
+	switch suffix {
+	case ".ts":
+		return LangTypeScript, true
+	case ".js":
+		return LangJavascript, true
+	case ".go":
+		return LangGo, true
+	default:
+		return LangUnknown, false
+	}
+}
+
+// Client generates an API client based on the given app metadata.
+// ServiceNames are the services to include in the output.
+// If it's nil, all services are included.
+func Client(
+	lang Lang,
+	appSlug string,
+	md *meta.Data,
+	services clientgentypes.ServiceSet,
+	tags clientgentypes.TagSet,
+	opts clientgentypes.Options,
+) (code []byte, err error) {
+	defer func() {
+		if e := recover(); e != nil {
+			err = srcerrors.UnhandledPanic(e)
+		}
+	}()
+
+	var gen generator
+	switch lang {
+	case LangTypeScript:
+		if opts.TSSharedTypes && md.Language == meta.Lang_TYPESCRIPT {
+			gen = &typescript{generatorVersion: typescriptGenLatestVersion, sharedTypes: true, clientTarget: opts.TSClientTarget}
+		} else {
+			gen = &typescript{generatorVersion: typescriptGenLatestVersion, sharedTypes: false}
+		}
+	case LangJavascript:
+		gen = &javascript{generatorVersion: javascriptGenLatestVersion}
+	case LangGo:
+		gen = &golang{generatorVersion: goGenLatestVersion}
+	case LangOpenAPI:
+		gen = openapi.New(openapi.LatestVersion)
+	default:
+		return nil, ErrUnknownLang
+	}
+
+	var buf bytes.Buffer
+	params := clientgentypes.GenerateParams{
+		Buf:      &buf,
+		AppSlug:  appSlug,
+		Meta:     md,
+		Services: services,
+		Tags:     tags,
+		Options:  opts,
+	}
+
+	if err := gen.Generate(params); err != nil {
+		return nil, fmt.Errorf("genclient.Generate %s %s: %v", lang, appSlug, err)
+	}
+	return buf.Bytes(), nil
+}
+
+// GetLang returns the language specified by the given string, allowing for case insensitivity and common aliases.
+func GetLang(lang string) (Lang, error) {
+	switch strings.TrimSpace(strings.ToLower(lang)) {
+	case "typescript", "ts":
+		return LangTypeScript, nil
+	case "javascript", "js":
+		return LangJavascript, nil
+	case "go", "golang":
+		return LangGo, nil
+	case "openapi", "swagger", "oas":
+		return LangOpenAPI, nil
+	default:
+		return LangUnknown, ErrUnknownLang
+	}
+}
diff --git a/pkg/clientgen/client_test.go b/pkg/clientgen/client_test.go
new file mode 100644
index 0000000000..662aa6a5bd
--- /dev/null
+++ b/pkg/clientgen/client_test.go
@@ -0,0 +1,164 @@
+package clientgen
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/clientgen/clientgentypes"
+	"encr.dev/pkg/golden"
+	"encr.dev/v2/tsbuilder"
+	"encr.dev/v2/v2builder"
+)
+
+func TestMain(m *testing.M) {
+	golden.TestMain(m)
+}
+
+func TestClientCodeGenerationFromGoApp(t *testing.T) {
+	t.Helper()
+	c := qt.New(t)
+
+	tests, err := filepath.Glob("./testdata/goapp/input*.go")
+	if err != nil {
+		t.Fatal(err)
+	}
+	c.Assert(err, qt.IsNil)
+
+	ctx := context.Background()
+	bld := v2builder.BuilderImpl{}
+
+	for _, path := range tests {
+		path := path
+		c.Run("expected"+strings.TrimPrefix(strings.TrimSuffix(filepath.Base(path), ".go"), "input"), func(c *qt.C) {
+			ar, err := txtar.ParseFile(path)
+			c.Assert(err, qt.IsNil)
+
+			base := t.TempDir()
+			err = txtar.Write(ar, base)
+			c.Assert(err, qt.IsNil)
+
+			res, err := bld.Parse(ctx, builder.ParseParams{
+				Build:       builder.DefaultBuildInfo(),
+				App:         apps.NewInstance(base, "app", ""),
+				Experiments: nil,
+				WorkingDir:  ".",
+				ParseTests:  false,
+			})
+			c.Assert(err, qt.IsNil)
+
+			files, err := os.ReadDir("./testdata/goapp")
+			c.Assert(err, qt.IsNil)
+
+			expectedPrefix := "expected" + strings.TrimPrefix(strings.TrimSuffix(filepath.Base(path), ".go"), "input") + "_"
+
+			for _, file := range files {
+				testName := strings.TrimPrefix(file.Name(), expectedPrefix)
+
+				// Check that the trim prefix removed the expectedPrefix && there are no other underscores in the testName
+				if testName != file.Name() && !strings.Contains(testName, "_") {
+					c.Run(testName, func(c *qt.C) {
+						language, ok := Detect(file.Name())
+						if strings.Contains(file.Name(), "openapi") {
+							language, ok = LangOpenAPI, true
+						}
+						c.Assert(ok, qt.IsTrue, qt.Commentf("Unable to detect language type for %s", file.Name()))
+
+						services := clientgentypes.AllServices(res.Meta)
+
+						generatedClient, err := Client(
+							language,
+							"app",
+							res.Meta,
+							services,
+							clientgentypes.TagSet{},
+							clientgentypes.Options{},
+						)
+						c.Assert(err, qt.IsNil)
+
+						golden.TestAgainst(c, "goapp/"+file.Name(), string(generatedClient))
+					})
+				}
+			}
+		})
+	}
+}
+
+func TestClientCodeGenerationFromTSApp(t *testing.T) {
+	t.Helper()
+	c := qt.New(t)
+
+	tests, err := filepath.Glob("./testdata/tsapp/input*.ts")
+	if err != nil {
+		t.Fatal(err)
+	}
+	c.Assert(err, qt.IsNil)
+
+	ctx := context.Background()
+	bld := tsbuilder.New()
+
+	for _, path := range tests {
+		path := path
+		c.Run("expected"+strings.TrimPrefix(strings.TrimSuffix(filepath.Base(path), ".ts"), "input"), func(c *qt.C) {
+			ar, err := txtar.ParseFile(path)
+			c.Assert(err, qt.IsNil)
+
+			base := t.TempDir()
+			err = txtar.Write(ar, base)
+			c.Assert(err, qt.IsNil)
+
+			res, err := bld.Parse(ctx, builder.ParseParams{
+				Build:       builder.DefaultBuildInfo(),
+				App:         apps.NewInstance(base, "app", ""),
+				Experiments: nil,
+				WorkingDir:  ".",
+				ParseTests:  false,
+			})
+			c.Assert(err, qt.IsNil)
+
+			files, err := os.ReadDir("./testdata/tsapp")
+			c.Assert(err, qt.IsNil)
+
+			expectedPrefix := "expected" + strings.TrimPrefix(strings.TrimSuffix(filepath.Base(path), ".ts"), "input") + "_"
+
+			for _, file := range files {
+				testName := strings.TrimPrefix(file.Name(), expectedPrefix)
+
+				// Check that the trim prefix removed the expectedPrefix && there are no other underscores in the testName
+				if testName != file.Name() && !strings.Contains(testName, "_") {
+					c.Run(testName, func(c *qt.C) {
+						language, ok := Detect(file.Name())
+						if strings.Contains(file.Name(), "openapi") {
+							language, ok = LangOpenAPI, true
+						}
+						options := clientgentypes.Options{}
+						if strings.Contains(file.Name(), "shared") {
+							options.TSSharedTypes = true
+						}
+						c.Assert(ok, qt.IsTrue, qt.Commentf("Unable to detect language type for %s", file.Name()))
+
+						services := clientgentypes.AllServices(res.Meta)
+						generatedClient, err := Client(
+							language,
+							"app",
+							res.Meta,
+							services,
+							clientgentypes.TagSet{},
+							options,
+						)
+						c.Assert(err, qt.IsNil)
+
+						golden.TestAgainst(c, "tsapp/"+file.Name(), string(generatedClient))
+					})
+				}
+			}
+		})
+	}
+}
diff --git a/pkg/clientgen/clientgentypes/clientgentypes.go b/pkg/clientgen/clientgentypes/clientgentypes.go
new file mode 100644
index 0000000000..d9b873f034
--- /dev/null
+++ b/pkg/clientgen/clientgentypes/clientgentypes.go
@@ -0,0 +1,127 @@
+package clientgentypes
+
+import (
+	"bytes"
+	"slices"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+// Options for the client generator.
+type Options struct {
+	OpenAPIExcludePrivateEndpoints bool
+	TSSharedTypes                  bool
+	TSClientTarget                 string
+}
+
+type GenerateParams struct {
+	Buf      *bytes.Buffer
+	AppSlug  string
+	Meta     *meta.Data
+	Services ServiceSet
+	Tags     TagSet
+	Options  Options
+}
+
+type ServiceSet struct {
+	list []string
+	set  map[string]bool
+}
+
+func (s ServiceSet) List() []string {
+	return s.list
+}
+
+func (s ServiceSet) Has(svc string) bool {
+	return s.set[svc]
+}
+
+// NewServiceSet constructs a new service set.
+// If the list contains "*", include all services in the metadata.
+// Finally, exclude any services in the exclude list.
+func NewServiceSet(md *meta.Data, include, exclude []string) ServiceSet {
+	set := make(map[string]bool, len(include))
+	if slices.Contains(include, "*") {
+		// If the list contains "*", include all services.
+		for _, svc := range md.Svcs {
+			set[svc.Name] = true
+		}
+	} else {
+		for _, svc := range include {
+			set[svc] = true
+		}
+	}
+
+	// Remove excludes.
+	for _, svc := range exclude {
+		delete(set, svc)
+	}
+
+	list := make([]string, 0, len(set))
+	for svc := range set {
+		list = append(list, svc)
+	}
+	slices.Sort(list)
+
+	return ServiceSet{
+		list: list,
+		set:  set,
+	}
+}
+
+func AllServices(md *meta.Data) ServiceSet {
+	return NewServiceSet(md, []string{"*"}, nil)
+}
+
+type TagSet struct {
+	included map[string]bool
+	excluded map[string]bool
+}
+
+func NewTagSet(tags, excludedTags []string) TagSet {
+	tagSet := TagSet{
+		included: make(map[string]bool),
+		excluded: make(map[string]bool),
+	}
+
+	for _, tag := range tags {
+		tagSet.included[tag] = true
+	}
+	for _, tag := range excludedTags {
+		tagSet.excluded[tag] = true
+	}
+
+	return tagSet
+}
+
+func (t TagSet) IsRPCIncluded(rpc *meta.RPC) bool {
+	// First check if the RPC has any of the excluded tags.
+	for _, selector := range rpc.Tags {
+		if selector.Type != meta.Selector_TAG {
+			continue
+		}
+
+		if excluded, ok := t.excluded[selector.Value]; ok && excluded {
+			return false
+		}
+	}
+
+	// If no included tags are specified, all tags are included.
+	if len(t.included) == 0 {
+		return true
+	}
+
+	// Check if the RPC has any of the included tags.
+	for _, selector := range rpc.Tags {
+		if selector.Type != meta.Selector_TAG {
+			continue
+		}
+
+		if included, ok := t.included[selector.Value]; ok && included {
+			return true
+		}
+	}
+
+	// If no included tags are found, the RPC is not included.
+	return false
+}
diff --git a/pkg/clientgen/errors.go b/pkg/clientgen/errors.go
new file mode 100644
index 0000000000..7fcc14815b
--- /dev/null
+++ b/pkg/clientgen/errors.go
@@ -0,0 +1,27 @@
+package clientgen
+
+type ErrCode struct {
+	Name           string
+	Comment        string
+	HttpStatusCode int
+}
+
+var errorCodes []ErrCode = []ErrCode{
+	{"OK", "OK indicates the operation was successful.", 200},
+	{"Canceled", "Canceled indicates the operation was canceled (typically by the caller).\n\nEncore will generate this error code when cancellation is requested.", 499},
+	{"Unknown", "Unknown error. An example of where this error may be returned is\nif a Status value received from another address space belongs to\nan error-space that is not known in this address space. Also\nerrors raised by APIs that do not return enough error information\nmay be converted to this error.\n\nEncore will generate this error code in the above two mentioned cases.", 500},
+	{"InvalidArgument", "InvalidArgument indicates client specified an invalid argument.\nNote that this differs from FailedPrecondition. It indicates arguments\nthat are problematic regardless of the state of the system\n(e.g., a malformed file name).\n\nThis error code will not be generated by the gRPC framework.", 400},
+	{"DeadlineExceeded", "DeadlineExceeded means operation expired before completion.\nFor operations that change the state of the system, this error may be\nreturned even if the operation has completed successfully. For\nexample, a successful response from a server could have been delayed\nlong enough for the deadline to expire.\n\nThe gRPC framework will generate this error code when the deadline is\nexceeded.", 504},
+	{"NotFound", "NotFound means some requested entity (e.g., file or directory) was\nnot found.\n\nThis error code will not be generated by the gRPC framework.", 404},
+	{"AlreadyExists", "AlreadyExists means an attempt to create an entity failed because one\nalready exists.\n\nThis error code will not be generated by the gRPC framework.", 409},
+	{"PermissionDenied", "PermissionDenied indicates the caller does not have permission to\nexecute the specified operation. It must not be used for rejections\ncaused by exhausting some resource (use ResourceExhausted\ninstead for those errors). It must not be\nused if the caller cannot be identified (use Unauthenticated\ninstead for those errors).\n\nThis error code will not be generated by the gRPC core framework,\nbut expect authentication middleware to use it.", 403},
+	{"ResourceExhausted", "ResourceExhausted indicates some resource has been exhausted, perhaps\na per-user quota, or perhaps the entire file system is out of space.\n\nThis error code will be generated by the gRPC framework in\nout-of-memory and server overload situations, or when a message is\nlarger than the configured maximum size.", 429},
+	{"FailedPrecondition", "FailedPrecondition indicates operation was rejected because the\nsystem is not in a state required for the operation's execution.\nFor example, directory to be deleted may be non-empty, an rmdir\noperation is applied to a non-directory, etc.\n\nA litmus test that may help a service implementor in deciding\nbetween FailedPrecondition, Aborted, and Unavailable:\n (a) Use Unavailable if the client can retry just the failing call.\n (b) Use Aborted if the client should retry at a higher-level\n     (e.g., restarting a read-modify-write sequence).\n (c) Use FailedPrecondition if the client should not retry until\n     the system state has been explicitly fixed. E.g., if an \"rmdir\"\n     fails because the directory is non-empty, FailedPrecondition\n     should be returned since the client should not retry unless\n     they have first fixed up the directory by deleting files from it.\n (d) Use FailedPrecondition if the client performs conditional\n     REST Get/Update/Delete on a resource and the resource on the\n     server does not match the condition. E.g., conflicting\n     read-modify-write on the same resource.\n\nThis error code will not be generated by the gRPC framework.", 400},
+	{"Aborted", "Aborted indicates the operation was aborted, typically due to a\nconcurrency issue like sequencer check failures, transaction aborts,\netc.\n\nSee litmus test above for deciding between FailedPrecondition,\nAborted, and Unavailable.", 409},
+	{"OutOfRange", "OutOfRange means operation was attempted past the valid range.\nE.g., seeking or reading past end of file.\n\nUnlike InvalidArgument, this error indicates a problem that may\nbe fixed if the system state changes. For example, a 32-bit file\nmay be rotated to a 64-bit file without error.\n\nThere is a fair bit of overlap between FailedPrecondition and\nOutOfRange. We recommend using OutOfRange (the more specific\nerror) when it applies so that callers who are iterating through\na space can easily look for an OutOfRange error to detect when\nthey are done.\n\nThis error code will not be generated by the gRPC framework.", 400},
+	{"Unimplemented", "Unimplemented indicates operation is not implemented or not\nsupported/enabled in this service.\n\nThis is not an error, but a feature not available.\n\nThis error code will not be generated by the gRPC framework.", 501},
+	{"Internal", "Internal means some invariant expected by the underlying system has\nbeen broken. This is not a per-message error, it is a global\nconditions check.\n\nThis error code will not be generated by the gRPC framework.", 500},
+	{"Unavailable", "Unavailable indicates the service is currently unavailable.\nThis is most likely a transient condition, which can be corrected by\nretrying with a backoff.\n\nSee litmus test above for deciding between FailedPrecondition,\nAborted, and Unavailable.", 503},
+	{"DataLoss", "DataLoss indicates unrecoverable data loss or corruption.\n\nThis error code is only defined in the gRPC library, and only for\nunrecoverable data loss (i.e., data loss resulting from errors\nlike hard disk corruption or bandwidth exceeded).\n\nThis error code will not be generated by the gRPC framework.", 500},
+	{"Unauthenticated", "Unauthenticated indicates the request does not have valid\nauthentication credentials for the operation.\n\nThe gRPC framework will generate this error code when the\nauthentication metadata is invalid or a Credentials callback fails,\nbut also expect authentication middleware to generate it.", 401},
+}
diff --git a/pkg/clientgen/golang.go b/pkg/clientgen/golang.go
new file mode 100644
index 0000000000..c7850949c3
--- /dev/null
+++ b/pkg/clientgen/golang.go
@@ -0,0 +1,1506 @@
+package clientgen
+
+import (
+	"bytes"
+	"fmt"
+	"regexp"
+	"sort"
+	"strings"
+	"unicode"
+
+	"github.com/cockroachdb/errors"
+	. "github.com/dave/jennifer/jen"
+	"github.com/fatih/structtag"
+
+	"encr.dev/internal/gocodegen"
+	"encr.dev/internal/version"
+	"encr.dev/parser/encoding"
+	"encr.dev/pkg/clientgen/clientgentypes"
+	"encr.dev/pkg/idents"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+// goGenVersion allows us to introduce breaking changes in the generated code but behind a switch
+// meaning that people with client code reliant on the old behaviour can continue to generate the
+// old code.
+type goGenVersion int
+
+const (
+	// GoInitial is the originally released Go client generator
+	GoInitial goGenVersion = iota
+
+	// GoExperimental can be used to lock experimental or uncompleted features in the generated code
+	// It should always be the last item in the enum
+	GoExperimental
+)
+
+const goGenLatestVersion = GoExperimental - 1
+
+type golang struct {
+	md                *meta.Data
+	enc               *gocodegen.MarshallingCodeGenerator
+	generatorVersion  goGenVersion
+	skipDocs          bool
+	skipPkgTypePrefix bool
+
+	seenSlicePath   bool
+	seenLiteralNull bool
+}
+
+func GenTypes(md *meta.Data, typs ...*schema.Decl) ([]byte, error) {
+	g := &golang{
+		generatorVersion:  goGenLatestVersion,
+		md:                md,
+		enc:               gocodegen.NewMarshallingCodeGenerator(gocodegen.UnknownPkgPath, "serde", true),
+		skipDocs:          true,
+		skipPkgTypePrefix: true,
+	}
+	rtn := &bytes.Buffer{}
+	stmt := Add()
+	g.generateTypeDefinitions(stmt, typs)
+	err := stmt.Render(rtn)
+	return rtn.Bytes(), err
+}
+
+func (g *golang) Generate(p clientgentypes.GenerateParams) (err error) {
+	g.md = p.Meta
+	g.enc = gocodegen.NewMarshallingCodeGenerator(gocodegen.UnknownPkgPath, "serde", true)
+
+	namedTypes := getNamedTypes(p.Meta, p.Services)
+
+	// Create a new client file
+	file := NewFile("client")
+	file.HeaderComment(doNotEditHeader())
+
+	// Generate the parent Client struct
+	g.generateClient(file, p.AppSlug, p.Services)
+
+	// Generate the types and service client structs
+	seenNs := make(map[string]bool)
+	for _, service := range p.Meta.Svcs {
+		nsName := service.Name
+		g.generateTypeDefinitions(file, namedTypes.Decls(nsName))
+		seenNs[nsName] = true
+
+		if hasPublicRPC(service) && p.Services.Has(service.Name) {
+			if err := g.generateServiceClient(file, service, p.Tags); err != nil {
+				return errors.Wrapf(err, "unable to generate service client for service: %s", service)
+			}
+		}
+	}
+	for _, ns := range namedTypes.Namespaces() {
+		if !seenNs[ns] {
+			g.generateTypeDefinitions(file, namedTypes.Decls(ns))
+		}
+	}
+
+	// Generate the base client
+	if err := g.generateBaseClient(file); err != nil {
+		return errors.Wrap(err, "unable to generate base client")
+	}
+
+	g.writeExtraHelpers(file)
+
+	// Write the APIError type
+	g.writeErrorType(file)
+
+	// Generate the serializer
+	g.enc.WriteToFile(file)
+
+	// Finally, render the client
+	if err := file.Render(p.Buf); err != nil {
+		return errors.Wrap(err, "unable to generate go client")
+	}
+
+	return nil
+}
+
+func (g *golang) Version() int {
+	return int(g.generatorVersion)
+}
+
+func (g *golang) cleanServiceName(service *meta.Service) string {
+	return strings.Title(strings.ToLower(service.Name))
+}
+
+// generateClient creates the Client struct, Option type and New function
+func (g *golang) generateClient(file *File, appSlug string, set clientgentypes.ServiceSet) {
+	// List all services which have public RPCs or types we need
+	fieldDef := make([]Code, 0, len(set.List()))
+	fieldInit := make(Dict)
+	for _, service := range g.md.Svcs {
+		if !hasPublicRPC(service) || !set.Has(service.Name) {
+			continue
+		}
+
+		name := g.cleanServiceName(service)
+
+		fieldDef = append(fieldDef,
+			Id(name).Id(fmt.Sprintf("%sClient", name)),
+		)
+
+		fieldInit[Id(name)] = Op("&").Id(fmt.Sprintf("%sClient", strings.ToLower(name))).Values(Id("base"))
+	}
+
+	// The client struct
+	file.Commentf("Client is an API client for the %s Encore application.", appSlug)
+	file.Add(
+		Type().Id("Client").Struct(fieldDef...),
+		Line(),
+		Line(),
+	)
+
+	file.Comment("BaseURL is the base URL for calling the Encore application's API.")
+	file.Type().Id("BaseURL").String()
+	file.Line()
+
+	file.Const().Id("Local").Id("BaseURL").Op("=").Lit("http://localhost:4000")
+	file.Line()
+
+	file.Comment("Environment returns a BaseURL for calling the cloud environment with the given name.")
+	file.Func().Id("Environment").
+		Params(Id("name").String()).
+		Id("BaseURL").
+		Block(Return(
+			Id("BaseURL").Call(
+				Qual("fmt", "Sprintf").Call(
+					Lit(fmt.Sprintf("https://%%s-%s.encr.app", appSlug)),
+					Id("name"),
+				),
+			),
+		))
+
+	file.Comment("PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.")
+	file.Func().Id("PreviewEnv").
+		Params(Id("pr").Int()).
+		Id("BaseURL").
+		Block(Return(Id("Environment").Call(
+			Qual("fmt", "Sprintf").Call(Lit("pr%d"), Id("pr")),
+		)))
+
+	// Option type alias
+	file.Comment("Option allows you to customise the baseClient used by the Client")
+	file.Add(
+		Type().Id("Option").Op("=").
+			Func().Params(Id("client").Op("*").Id("baseClient")).Error(),
+		Line(),
+		Line(),
+	)
+
+	// New Function
+	file.Comment("New returns a Client for calling the public and authenticated APIs of your Encore application.")
+	file.Comment("You can customize the behaviour of the client using the given Option functions, such as WithHTTPClient or WithAuthFunc.")
+	file.Add(
+		Func().Id("New").
+			Params(
+				Id("target").Id("BaseURL"),
+				Id("options").Id("...Option"),
+			).
+			Params(Op("*").Id("Client"), Error()).
+			Block(
+				Comment("Parse the base URL where the Encore application is being hosted"),
+				List(Id("baseURL"), Err()).
+					Op(":=").
+					Qual("net/url", "Parse").Call(String().Call(Id("target"))),
+				If(Err().Op("!=").Nil()).Block(
+					Return(
+						Nil(),
+						Qual("fmt", "Errorf").Call(Lit("unable to parse base url: %w"), Err()),
+					),
+				),
+				Line(),
+
+				Comment("Create a client with sensible defaults"),
+				Id("base").Op(":=").Op("&").Id("baseClient").Values(Dict{
+					Id("baseURL"):    Id("baseURL"),
+					Id("httpClient"): Qual("net/http", "DefaultClient"),
+					Id("userAgent"):  Lit(fmt.Sprintf("%s-Generated-Go-Client (Encore/%s)", appSlug, version.Version)),
+				}),
+				Line(),
+
+				Comment("Apply any given options"),
+				For(List(Id("_"), Id("option")).Op(":=").Range().Id("options")).Block(
+					If(
+						Id("err").Op(":=").Id("option").Call(Id("base")),
+						Id("err").Op("!=").Nil(),
+					).Block(
+						Return(
+							Nil(),
+							Qual("fmt", "Errorf").Call(
+								Lit("unable to apply client option: %w"),
+								Id("err"),
+							),
+						),
+					),
+				),
+				Line(),
+
+				Return(Op("&").Id("Client").Values(fieldInit), Nil()),
+			),
+	)
+
+	// Generate the WithHttpClient function
+	g.generateOptionFunc(
+		file,
+		"HTTPClient",
+		`can be used to configure the underlying HTTP client used when making API calls.
+
+Defaults to http.DefaultClient`,
+		&Statement{Id("client").Id("HTTPDoer")},
+		&Statement{
+			Id("base").Dot("httpClient").Op("=").Id("client"),
+			Return(Nil()),
+		},
+	)
+
+	if g.md.AuthHandler != nil {
+		typ := g.getType(g.md.AuthHandler.Params)
+		rawType := typ
+		funcName := "AuthToken"
+		paramName := "bearerToken"
+		pointer := Id(paramName)
+		comment := "an authentication token to be used for each request.\n\nThis token will be sent as a Bearer token in the Authorization header."
+		if g.md.AuthHandler.Params.GetBuiltin() != schema.Builtin_STRING {
+			funcName = "Auth"
+			paramName = "auth"
+			pointer = Id("auth")
+			typ = rawType
+			comment = "the authentication data to be used with each request"
+		}
+
+		// Generate the WithAuth function
+		g.generateOptionFunc(
+			file,
+			funcName,
+			"allows you to set "+comment,
+			// Note we take the auth data by value rather than a pointer to ensure it's safe
+			// to use inside multiple goroutines
+			&Statement{Id(paramName).Add(rawType)},
+			&Statement{
+				Id("base").Dot("authGenerator").Op("=").Func().
+					Params(Id("_").Qual("context", "Context")).
+					Params(typ, Error()).
+					Block(Return(pointer, Nil())),
+				Return(Nil()),
+			},
+		)
+
+		g.generateOptionFunc(
+			file,
+			"AuthFunc",
+			"allows you to pass a function which is called for each request to return "+comment,
+			&Statement{
+				Id("authGenerator").Func().
+					Params(Id("ctx").Qual("context", "Context")).
+					Params(typ, Error()),
+			},
+			&Statement{
+				&Statement{Id("base").Dot("authGenerator").Op("=").Id("authGenerator")},
+				Return(Nil()),
+			},
+		)
+	}
+}
+
+// generateOptionFunc is a helper for reducing the boilerplate we have when creating the option functions
+func (g *golang) generateOptionFunc(file *File, optionName string, doc string, params *Statement, block *Statement) {
+	for i, line := range strings.Split(doc, "\n") {
+		if i == 0 {
+			file.Commentf("With%s %s", optionName, line)
+		} else {
+			file.Comment(line)
+		}
+	}
+
+	file.Func().
+		Id(fmt.Sprintf("With%s", optionName)).
+		Params(*params...).
+		Id("Option").
+		Block(
+			Return(Func().Params(Id("base").Op("*").Id("baseClient")).Error().Block(
+				*block...,
+			)),
+		)
+}
+
+func (g *golang) generateServiceClient(file *File, service *meta.Service, tags clientgentypes.TagSet) error {
+	name := g.cleanServiceName(service)
+	interfaceName := fmt.Sprintf("%sClient", name)
+	structName := fmt.Sprintf("%sClient", strings.ToLower(name))
+
+	// The interface
+	file.Commentf("%s Provides you access to call public and authenticated APIs on %s. The concrete implementation is %s.", interfaceName, service.Name, structName)
+	file.Comment("It is setup as an interface allowing you to use GoMock to create mock implementations during tests.")
+	var interfaceMethods []Code
+	for _, rpc := range service.Rpcs {
+		if rpc.AccessType == meta.RPC_PRIVATE || !tags.IsRPCIncluded(rpc) {
+			continue
+		}
+
+		// streaming endpoints not supported yet
+		if rpc.StreamingRequest || rpc.StreamingResponse {
+			continue
+		}
+
+		// Add the documentation for the API to the interface method
+		if rpc.Doc != nil && !g.skipDocs {
+			// Add a newline if this is not the first method
+			if len(interfaceMethods) > 0 {
+				interfaceMethods = append(interfaceMethods, Line())
+			}
+
+			for _, line := range strings.Split(strings.TrimSpace(*rpc.Doc), "\n") {
+				interfaceMethods = append(interfaceMethods, Comment(line))
+			}
+		}
+
+		interfaceMethods = append(interfaceMethods,
+			Id(idents.Convert(rpc.Name, idents.PascalCase)).Add(g.rpcParams(rpc)).Add(g.rpcReturnType(rpc, false)),
+		)
+	}
+	file.Type().Id(interfaceName).Interface(interfaceMethods...)
+	file.Line()
+
+	// The struct
+	file.Type().Id(structName).Struct(
+		Id("base").Op("*").Id("baseClient"),
+	)
+	file.Line()
+	file.Var().Id("_").Id(interfaceName).Op("=").Params(Op("*").Id(structName)).Params(Nil())
+
+	// The API functions
+	for _, rpc := range service.Rpcs {
+		if rpc.AccessType == meta.RPC_PRIVATE {
+			continue
+		}
+
+		// streaming endpoints not supported yet
+		if rpc.StreamingRequest || rpc.StreamingResponse {
+			continue
+		}
+
+		if rpc.Doc != nil && *rpc.Doc != "" && !g.skipDocs {
+			for _, line := range strings.Split(strings.TrimSpace(*rpc.Doc), "\n") {
+				if line != "" {
+					file.Comment(line)
+				}
+			}
+		}
+
+		callSite, err := g.rpcCallSite(rpc)
+		if err != nil {
+			return errors.Wrapf(err, "rpc: %s", rpc.Name)
+		}
+
+		file.Func().
+			Params(Id("c").Op("*").Id(structName)).
+			Id(idents.Convert(rpc.Name, idents.PascalCase)).
+			Add(
+				g.rpcParams(rpc),
+				g.rpcReturnType(rpc, true),
+			).Block(callSite...)
+		file.Line()
+	}
+	return nil
+}
+
+func (g *golang) rpcParams(rpc *meta.RPC) Code {
+	params := []Code{
+		Id("ctx").Qual("context", "Context"),
+	}
+
+	if rpc.Path != nil && len(rpc.Path.Segments) > 0 {
+		for _, segment := range rpc.Path.Segments {
+			if segment.Type == meta.PathSegment_LITERAL {
+				continue
+			}
+
+			// We'll default to strings for most things
+			typ := String()
+
+			switch segment.ValueType {
+			case meta.PathSegment_BOOL:
+				typ = Bool()
+
+			case meta.PathSegment_INT8:
+				typ = Int8()
+
+			case meta.PathSegment_INT16:
+				typ = Int16()
+
+			case meta.PathSegment_INT32:
+				typ = Int32()
+
+			case meta.PathSegment_INT64:
+				typ = Int64()
+
+			case meta.PathSegment_INT:
+				typ = Int()
+
+			case meta.PathSegment_UINT8:
+				typ = Uint8()
+
+			case meta.PathSegment_UINT16:
+				typ = Uint16()
+
+			case meta.PathSegment_UINT32:
+				typ = Uint32()
+
+			case meta.PathSegment_UINT64:
+				typ = Uint64()
+
+			case meta.PathSegment_UINT:
+				typ = Uint()
+			}
+
+			if segment.Type == meta.PathSegment_WILDCARD || segment.Type == meta.PathSegment_FALLBACK {
+				typ = Index().Add(typ)
+			}
+
+			params = append(params,
+				Id(g.nonReservedId(segment.Value)).Add(typ),
+			)
+		}
+	}
+
+	if rpc.Proto == meta.RPC_RAW {
+		params = append(params, Id("request").Op("*").Qual("net/http", "Request"))
+	} else {
+		if rpc.RequestSchema != nil {
+			params = append(params, Id("params").Add(g.getType(rpc.RequestSchema)))
+		}
+	}
+
+	return Params(params...)
+}
+
+// nonReservedId returns the given ID, unless we have it a reserved within the client function _or_ it's a reserved Go keyword
+func (g *golang) nonReservedId(id string) string {
+	switch id {
+	// our reserved keywords (or ID's we use within the generated client functions)
+	case "c", "ctx", "request", "resp", "err",
+		"reqEncoder", "headers", "queryString", "body", "respBody", "respHeaders", "respDecoder":
+		return "_" + id
+
+	// Go keywords
+	case "break", "default", "func", "interface", "select", "case", "defer", "go", "map", "struct", "chan", "else",
+		"goto", "package", "switch", "const", "fallthrough", "if", "range", "type", "continue", "for", "import",
+		"return", "var":
+		return "_" + id
+
+	// Go predeclared identifiers
+	case "append", "bool", "byte", "cap", "close", "complex", "complex64", "complex128", "uint16", "copy", "false",
+		"float32", "float64", "imag", "int", "int8", "int16", "uint32", "int32", "int64", "iota", "len", "make", "new",
+		"nil", "panic", "uint64", "print", "println", "real", "recover", "string", "true", "uint", "uint8", "uintptr":
+		return "_" + id
+
+	default:
+		return id
+	}
+}
+
+func (g *golang) rpcReturnType(rpc *meta.RPC, concreteImpl bool) Code {
+	if rpc.Proto == meta.RPC_RAW {
+		return Params(Op("*").Qual("net/http", "Response"), Error())
+	}
+
+	if rpc.ResponseSchema == nil {
+		return Error()
+	}
+
+	if concreteImpl {
+		// For the concrete implementation we want the response type to be named so we can
+		// refer to it without having to define a variable.
+		return Params(Id("resp").Add(g.getType(rpc.ResponseSchema)), Err().Error())
+	} else {
+		return Params(g.getType(rpc.ResponseSchema), Error())
+	}
+}
+
+func (g *golang) rpcCallSite(rpc *meta.RPC) (code []Code, err error) {
+	// Work out how we're going to encode and call this RPC
+	rpcEncoding, err := encoding.DescribeRPC(g.md, rpc, nil)
+	if err != nil {
+		return nil, errors.Wrapf(err, "rpc %s", rpc.Name)
+	}
+
+	// Raw end points just pass through the request
+	// and need no further code generation
+	if rpc.Proto == meta.RPC_RAW {
+		code = append(
+			code,
+			Id("request").Op("=").Id("request").Dot("WithContext").Call(Id("ctx")),
+			Line(),
+
+			Comment("Check the request has the method set, as we can't guess what method is required"),
+			If(Id("request").Dot("Method").Op("==").Lit("")).Block(
+				Return(
+					Nil(),
+					Qual("errors", "New").Call(Lit("request.Method must be set")),
+				),
+			),
+			Line(),
+
+			Comment("Set the relative URL for the API call"),
+			List(Id("path"), Err()).Op(":=").Qual("net/url", "Parse").Call(g.createApiPath(rpc, false)),
+			If(Err().Op("!=").Nil()).Block(
+				Return(
+					Nil(),
+					Qual("fmt", "Errorf").Call(Lit("unable to parse api url: %w"), Err()),
+				),
+			),
+			If(Id("request").Dot("URL").Op("!=").Nil()).Block(
+				Comment("If the request already has a URL associated, we'll keep any fields set inside it, and just override the schema, "),
+				Comment("host and path to ensure the final URL which hit the right BaseURL"),
+				Id("request").Dot("URL").Dot("Scheme").Op("=").Id("path").Dot("Scheme"),
+				Id("request").Dot("URL").Dot("Host").Op("=").Id("path").Dot("Host"),
+				Id("request").Dot("URL").Dot("Path").Op("=").Id("path").Dot("Path"),
+			).Else().Block(
+				Id("request").Dot("URL").Op("=").Id("path"),
+			),
+			Line(),
+
+			Line(),
+			Return(Id("c").Dot("base").Dot("Do").Call(Id("request"))),
+		)
+
+		return
+	}
+
+	headers := Nil()
+	body := Nil()
+	withQueryString := false
+
+	// Work out how we encode the Request Schema
+	if rpc.RequestSchema != nil {
+		reqEnc := rpcEncoding.DefaultRequestEncoding
+
+		if len(reqEnc.HeaderParameters) > 0 || len(reqEnc.QueryParameters) > 0 {
+			code = append(code, Comment("Convert our params into the objects we need for the request"))
+		}
+
+		enc := g.enc.NewPossibleInstance("reqEncoder")
+
+		// Generate the headers
+		if len(reqEnc.HeaderParameters) > 0 {
+			values := Dict{}
+
+			for _, field := range reqEnc.HeaderParameters {
+				slice, err := enc.ToStringSlice(
+					field.Type,
+					Id("params").Dot(field.SrcName),
+				)
+				if err != nil {
+					return nil, errors.Wrapf(err, "unable to encode header %s", field.SrcName)
+				}
+				values[Lit(field.WireFormat)] = slice
+			}
+
+			headers = Id("headers")
+			enc.Add(Id("headers").Op(":=").Qual("net/http", "Header").Values(values), Line())
+		}
+
+		// Generate the query string
+		if len(reqEnc.QueryParameters) > 0 {
+			withQueryString = true
+			values := Dict{}
+
+			// Check the request schema for fields we can put in the query string
+			for _, field := range reqEnc.QueryParameters {
+				slice, err := enc.ToStringSlice(
+					field.Type,
+					Id("params").Dot(field.SrcName),
+				)
+				if err != nil {
+					return nil, errors.Wrapf(err, "unable to encode query fields %s", field.SrcName)
+				}
+
+				values[Lit(field.WireFormat)] = slice
+			}
+
+			enc.Add(Id("queryString").Op(":=").Qual("net/url", "Values").Values(values), Line())
+		}
+
+		if rpc.ResponseSchema != nil {
+			code = append(code, enc.Finalize(
+				Id("err").Op("=").Qual("fmt", "Errorf").Call(
+					Lit("unable to marshal parameters: %w"),
+					enc.LastError(),
+				),
+				Return(),
+			)...)
+		} else {
+			code = append(code, enc.Finalize(
+				Return(Qual("fmt", "Errorf").Call(
+					Lit("unable to marshal parameters: %w"),
+					enc.LastError(),
+				)),
+			)...)
+		}
+
+		// Generate the body
+		if len(reqEnc.BodyParameters) > 0 {
+			if len(reqEnc.HeaderParameters) == 0 && len(reqEnc.QueryParameters) == 0 {
+				// In the simple case we can just encode the params as the body directly
+				body = Id("params")
+			} else {
+				// Else we need a new struct called "body"
+				body = Id("body")
+
+				types, err := g.generateAnonStructTypes(reqEnc.BodyParameters, "json")
+				if err != nil {
+					return nil, err
+				}
+
+				values := Dict{}
+				for _, field := range reqEnc.BodyParameters {
+					values[Id(field.SrcName)] = Id("params").Dot(field.SrcName)
+				}
+
+				code = append(code,
+					Comment("Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)"),
+					Id("body").Op(":=").Struct(types...).Values(values),
+					Line(),
+				)
+			}
+		}
+	}
+
+	// Make the request
+	resp := Nil()
+	apiCallCode := func() Code {
+		return Id("callAPI").Call(
+			Id("ctx"),
+			Id("c").Dot("base"),
+			Lit(rpcEncoding.DefaultMethod),
+			g.createApiPath(rpc, withQueryString),
+			headers,
+			body,
+			resp,
+		)
+	}
+
+	// If there's no response schema, we can just return the call to the API directly
+	if rpc.ResponseSchema == nil {
+		code = append(code,
+			List(Id("_"), Err()).Op(":=").Add(apiCallCode()),
+			Return(Err()),
+		)
+		return
+	}
+
+	hasAnonResponseStruct := false
+	respEnc := rpcEncoding.ResponseEncoding
+
+	// If we have a response object, we need
+	if len(respEnc.BodyParameters) > 0 {
+		if len(respEnc.HeaderParameters) == 0 {
+			// If there are no other fields, we can just take the return type and pass it straight through
+			resp = Op("&").Id("resp")
+		} else {
+			hasAnonResponseStruct = true
+			resp = Op("&").Id("respBody")
+
+			// we need to construct an anonymous struct
+			types, err := g.generateAnonStructTypes(respEnc.BodyParameters, "json")
+			if err != nil {
+				return nil, errors.Wrap(err, "response unmarshal")
+			}
+
+			code = append(code,
+				Comment("We only want the response body to marshal into these fields and none of the header fields,"),
+				Comment("so we'll construct a new struct with only those fields."),
+				Id("respBody").Op(":=").Struct(types...).Values(),
+				Line(),
+			)
+		}
+	}
+
+	// The API Call itself
+	code = append(code, Comment("Now make the actual call to the API"))
+
+	headersId := "_"
+	if len(respEnc.HeaderParameters) > 0 {
+		headersId = "respHeaders"
+		code = append(code, Var().Id(headersId).Qual("net/http", "Header"))
+	}
+
+	code = append(code,
+		List(Id(headersId), Err()).Op("=").Add(apiCallCode()),
+		If(Err().Op("!=").Nil()).Block(
+			Return(),
+		),
+		Line(),
+	)
+
+	// In we have an anonymous response struct, we need to copy the results into the full response struct
+	if hasAnonResponseStruct || len(respEnc.HeaderParameters) > 0 {
+		code = append(code, Comment("Copy the unmarshalled response body into our response struct"))
+
+		enc := g.enc.NewPossibleInstance("respDecoder")
+		for _, field := range respEnc.HeaderParameters {
+			str, err := enc.FromString(
+				field.Type,
+				field.SrcName,
+				Id(headersId).Dot("Get").Call(Lit(field.WireFormat)),
+				Id(headersId).Dot("Values").Call(Lit(field.WireFormat)),
+				true,
+			)
+			if err != nil {
+				return nil, errors.Wrapf(err, "unable to convert %s to string in response header", field.SrcName)
+			}
+
+			enc.Add(Id("resp").Dot(field.SrcName).Op("=").Add(str))
+		}
+		for _, field := range respEnc.BodyParameters {
+			enc.Add(Id("resp").Dot(field.SrcName).Op("=").Id("respBody").Dot(field.SrcName))
+		}
+		code = append(code, enc.Finalize(
+			Id("err").Op("=").Qual("fmt", "Errorf").Call(
+				Lit("unable to unmarshal headers: %w"),
+				enc.LastError(),
+			),
+			Return(),
+		)...)
+		code = append(code, Line())
+	}
+
+	code = append(code, Return())
+
+	return code, err
+}
+
+// goIdentifier converts a string into a valid Go identifier.
+func goIdentifier(input string) string {
+	if input == "" {
+		return "_"
+	}
+
+	// Convert string to rune slice for proper handling of Unicode characters
+	runes := []rune(input)
+
+	// Ensure the first character is a valid Go identifier start (letter or `_`)
+	if !unicode.IsLetter(runes[0]) && runes[0] != '_' {
+		runes[0] = '_'
+	}
+
+	// Regex to replace invalid characters (anything that isn't a letter, number, or `_`)
+	invalidChars := regexp.MustCompile(`[^\p{L}\p{N}_]`)
+	output := invalidChars.ReplaceAllString(string(runes), "_")
+
+	return output
+}
+
+func (g *golang) declToID(decl *schema.Decl) *Statement {
+	if g.skipPkgTypePrefix {
+		return Id(goIdentifier(strings.Title(decl.Name)))
+	} else {
+		return Id(goIdentifier(fmt.Sprintf("%s%s", strings.Title(decl.Loc.PkgName), strings.Title(decl.Name))))
+	}
+}
+
+func (g *golang) getType(typ *schema.Type) Code {
+	switch typ := typ.Typ.(type) {
+	case *schema.Type_Named:
+		decl := g.md.Decls[typ.Named.Id]
+
+		named := g.declToID(decl)
+
+		if len(typ.Named.TypeArguments) == 0 {
+			return named
+		}
+
+		// Add the type arguments
+		types := make([]Code, len(typ.Named.TypeArguments))
+		for i, t := range typ.Named.TypeArguments {
+			types[i] = g.getType(t)
+		}
+
+		return named.Types(types...)
+
+	case *schema.Type_List:
+		return Index().Add(g.getType(typ.List.Elem))
+
+	case *schema.Type_Map:
+		return Map(g.getType(typ.Map.Key)).Add(g.getType(typ.Map.Value))
+
+	case *schema.Type_Literal:
+		switch typ.Literal.Value.(type) {
+		case *schema.Literal_Str:
+			return String()
+		case *schema.Literal_Boolean:
+			return Bool()
+		case *schema.Literal_Int:
+			return Int()
+		case *schema.Literal_Float:
+			return Float64()
+		case *schema.Literal_Null:
+			// Can't use nil as a type, so use *bool
+			g.seenLiteralNull = true
+			return Id("null")
+		default:
+			return Any()
+		}
+
+	case *schema.Type_Union:
+		// There's no good way of representing unions in Go.
+		// Use 'any' for now.
+		return Any()
+
+	case *schema.Type_Builtin:
+		switch typ.Builtin {
+		case schema.Builtin_ANY:
+			return Any()
+		case schema.Builtin_BOOL:
+			return Bool()
+		case schema.Builtin_INT:
+			return Int()
+		case schema.Builtin_INT8:
+			return Int8()
+		case schema.Builtin_INT16:
+			return Int16()
+		case schema.Builtin_INT32:
+			return Int32()
+		case schema.Builtin_INT64:
+			return Int64()
+		case schema.Builtin_UINT:
+			return Uint()
+		case schema.Builtin_UINT8:
+			return Uint8()
+		case schema.Builtin_UINT16:
+			return Uint16()
+		case schema.Builtin_UINT32:
+			return Uint32()
+		case schema.Builtin_UINT64:
+			return Uint64()
+		case schema.Builtin_FLOAT32:
+			return Float32()
+		case schema.Builtin_FLOAT64:
+			return Float64()
+		case schema.Builtin_STRING:
+			return String()
+		case schema.Builtin_BYTES:
+			return Index().Byte()
+		case schema.Builtin_TIME:
+			return Qual("time", "Time")
+		case schema.Builtin_JSON:
+			return Qual("encoding/json", "RawMessage")
+		case schema.Builtin_UUID, schema.Builtin_USER_ID, schema.Builtin_DECIMAL:
+			// we don't want to add any custom depdancies, so these come in as strings
+			return String()
+		default:
+			return Any()
+		}
+
+	case *schema.Type_Pointer:
+		return Op("*").Add(g.getType(typ.Pointer.Base))
+
+	case *schema.Type_Struct:
+		fields := make([]Code, 0, len(typ.Struct.Fields))
+
+		for _, field := range typ.Struct.Fields {
+			// Skip over hidden fields
+			if encoding.IgnoreField(field) {
+				continue
+			}
+
+			// The base field name and type
+			fieldTyp := Id(idents.Convert(field.Name, idents.PascalCase)).Add(g.getType(field.Typ))
+
+			// Add the field tags
+			if field.RawTag != "" {
+				tags, err := structtag.Parse(field.RawTag)
+				if err != nil {
+					panic("raw tags failed to parse") // This shouldn't happen at runtime, because the parser should have caught this
+				}
+
+				tagsForJen := make(map[string]string)
+				for _, tag := range tags.Tags() {
+					tagsForJen[tag.Key] = tag.Value()
+				}
+
+				fieldTyp = fieldTyp.Tag(tagsForJen)
+			}
+
+			// Add the docs for the field
+			if field.Doc != "" && !g.skipDocs {
+				lines := strings.Split(strings.TrimSpace(field.Doc), "\n")
+
+				if len(lines) == 1 {
+					fieldTyp = fieldTyp.Comment(lines[0])
+				} else {
+					fields = append(fields, Line())
+					for _, line := range lines {
+						fields = append(fields, Comment(line))
+					}
+				}
+			}
+
+			// Finally, add the field to the list of fields on the struct
+			fields = append(fields, fieldTyp)
+		}
+
+		return Struct(fields...)
+
+	case *schema.Type_TypeParameter:
+		decl := g.md.Decls[typ.TypeParameter.DeclId]
+		typeParam := decl.TypeParams[typ.TypeParameter.ParamIdx]
+
+		return Id(typeParam.Name)
+
+	case *schema.Type_Config:
+		// Config types are invisible outside of the Encore app
+		return g.getType(typ.Config.Elem)
+
+	default:
+		return Any()
+	}
+}
+
+func (g *golang) createApiPath(rpc *meta.RPC, withQueryString bool) (urlPath *Statement) {
+	var url strings.Builder
+	params := make([]Code, 0)
+
+	for _, segment := range rpc.Path.Segments {
+		url.WriteByte('/')
+
+		if segment.Type == meta.PathSegment_LITERAL {
+			url.WriteString(segment.Value)
+		} else {
+			paramID := Id(g.nonReservedId(segment.Value))
+
+			switch segment.ValueType {
+			case meta.PathSegment_STRING, meta.PathSegment_UUID:
+				url.WriteString("%s")
+
+				if segment.Type == meta.PathSegment_WILDCARD || segment.Type == meta.PathSegment_FALLBACK {
+					g.seenSlicePath = true
+					paramID = Id("pathEscapeSlice").Call(paramID)
+				} else {
+					paramID = Qual("net/url", "PathEscape").Call(paramID)
+				}
+
+			case meta.PathSegment_BOOL:
+				url.WriteString("%t")
+			case meta.PathSegment_INT8, meta.PathSegment_INT16, meta.PathSegment_INT32, meta.PathSegment_INT64, meta.PathSegment_INT,
+				meta.PathSegment_UINT8, meta.PathSegment_UINT16, meta.PathSegment_UINT32, meta.PathSegment_UINT64, meta.PathSegment_UINT:
+				url.WriteString("%d")
+			default:
+				url.WriteString("%v")
+			}
+
+			params = append(params, paramID)
+		}
+	}
+
+	// Construct the query string
+	if withQueryString {
+		url.WriteString("?%s")
+		params = append(params, Id("queryString").Dot("Encode").Call())
+	}
+
+	if len(params) == 0 {
+		urlPath = Lit(url.String())
+	} else {
+		// Prepend the string format
+		params = append([]Code{Lit(url.String())}, params...)
+		urlPath = Qual("fmt", "Sprintf").Call(params...)
+	}
+
+	return urlPath
+}
+
+// FileStatement is an interface implemented by both jen.File and jen.Statement
+type FileStatement interface {
+	Comment(string) *Statement
+	Line() *Statement
+	Type() *Statement
+}
+
+func (g *golang) generateTypeDefinitions(stmt FileStatement, decls []*schema.Decl) {
+	sort.Slice(decls, func(i, j int) bool {
+		return decls[i].Name < decls[j].Name
+	})
+
+	for _, decl := range decls {
+		// Write the docs
+		if decl.Doc != "" && !g.skipDocs {
+			for _, line := range strings.Split(strings.TrimSpace(decl.Doc), "\n") {
+				stmt.Comment(line)
+			}
+		} else {
+			stmt.Line()
+		}
+
+		// Create the base type definition; `type X[T]`
+		typ := stmt.Type().Add(g.declToID(decl))
+		if len(decl.TypeParams) > 0 {
+			types := make([]Code, len(decl.TypeParams))
+
+			for i, param := range decl.TypeParams {
+				types[i] = Id(param.Name).Any()
+			}
+
+			typ = typ.Types(types...)
+		}
+
+		// All types which are not structs should be aliases
+		if decl.Type.GetStruct() == nil && len(decl.TypeParams) == 0 {
+			typ = typ.Op("=")
+		}
+
+		// Add the type
+		typ.Add(g.getType(decl.Type))
+	}
+}
+
+func (g *golang) generateAnonStructTypes(fields []*encoding.ParameterEncoding, encodingTag string) (types []Code, err error) {
+	for _, field := range fields {
+		var tagValue strings.Builder
+		tagValue.WriteString(field.Name)
+
+		// Parse the tags and extract the encoding tag
+		tags, err := structtag.Parse(field.RawTag)
+		if err != nil {
+			return nil, errors.Wrapf(err, "parse tags: %s", field.SrcName)
+		}
+		if tag, err := tags.Get(encodingTag); err == nil {
+			options := strings.Join(tag.Options, ",")
+			if options != "" {
+				tagValue.WriteRune(',')
+				tagValue.WriteString(options)
+			}
+		}
+
+		types = append(
+			types,
+			Id(idents.Convert(field.SrcName, idents.PascalCase)).Add(g.getType(field.Type)).Tag(map[string]string{encodingTag: tagValue.String()}),
+		)
+	}
+
+	return
+}
+
+func (g *golang) generateBaseClient(file *File) (err error) {
+	// Add the interface
+	file.Comment("HTTPDoer is an interface which can be used to swap out the default")
+	file.Comment("HTTP client (http.DefaultClient) with your own custom implementation.")
+	file.Comment("This can be used to inject middleware or mock responses during unit tests.")
+	file.Type().Id("HTTPDoer").Interface(
+		Id("Do").
+			Params(Id("req").Op("*").Qual("net/http", "Request")).
+			Params(Op("*").Qual("net/http", "Response"), Error()),
+	)
+
+	// Add the base client struct
+	file.Line()
+	file.Comment("baseClient holds all the information we need to make requests to an Encore application")
+	file.Type().Id("baseClient").StructFunc(func(grp *Group) {
+		if g.md.AuthHandler != nil {
+			typ := g.getType(g.md.AuthHandler.Params)
+
+			grp.Id("authGenerator").Func().
+				Params(Id("ctx").Qual("context", "Context")).
+				Params(typ, Error()).
+				Comment("The function which will add the authentication data to the requests")
+		}
+
+		grp.Id("httpClient").Id("HTTPDoer").
+			Comment("The HTTP client which will be used for all API requests")
+
+		grp.Id("baseURL").Op("*").Qual("net/url", "URL").
+			Comment("The base URL which API requests will be made against")
+
+		grp.Id("userAgent").String().
+			Commentf("What user agent we will use in the API requests")
+	})
+
+	// Add the Do method for th base client
+	file.Line()
+	file.Comment("Do sends the req to the Encore application adding the authorization token as required.")
+	file.Func().
+		Params(Id("b").Op("*").Id("baseClient")).
+		Id("Do").
+		Params(Id("req").Op("*").Qual("net/http", "Request")).
+		Params(Op("*").Qual("net/http", "Response"), Error()).
+		BlockFunc(func(grp *Group) {
+			grp.Id("req").Dot("Header").Dot("Set").Call(
+				Lit("Content-Type"),
+				Lit("application/json"),
+			)
+			grp.Id("req").Dot("Header").Dot("Set").Call(
+				Lit("User-Agent"),
+				Id("b").Dot("userAgent"),
+			)
+			grp.Line()
+
+			if g.md.AuthHandler != nil {
+				err = g.addAuthData(grp)
+				if err != nil {
+					return
+				}
+			}
+
+			grp.Comment("Merge the base URL and the API URL")
+			grp.Id("req").Dot("URL").Op("=").
+				Id("b").Dot("baseURL").Dot("ResolveReference").Call(Id("req").Dot("URL"))
+			grp.Id("req").Dot("Host").Op("=").Id("req").Dot("URL").Dot("Host")
+			grp.Line()
+
+			grp.Comment("Finally, make the request via the configured HTTP Client")
+			grp.Return(
+				Id("b").Dot("httpClient").Dot("Do").Call(Id("req")),
+			)
+		})
+	if err != nil {
+		return
+	}
+
+	// Add the call API function
+	file.Line()
+	file.Comment("callAPI is used by each generated API method to actually make request and decode the responses")
+	file.Func().
+		Id("callAPI").
+		Params(
+			Id("ctx").Qual("context", "Context"),
+			Id("client").Op("*").Id("baseClient"),
+			Id("method"),
+			Id("path").String(),
+			Id("headers").Qual("net/http", "Header"),
+			List(Id("body"), Id("resp")).Any(),
+		).
+		Params(Qual("net/http", "Header"), Error()).
+		Block(
+			Comment("Encode the API body"),
+			Var().Id("bodyReader").Qual("io", "Reader"),
+			If(Id("body").Op("!=").Nil()).Block(
+				List(Id("bodyBytes"), Err()).Op(":=").
+					Qual("encoding/json", "Marshal").
+					Call(Id("body")),
+				If(Err().Op("!=").Nil()).Block(
+					Return(Nil(), Qual("fmt", "Errorf").Call(Lit("marshal request: %w"), Err())),
+				),
+
+				Id("bodyReader").Op("=").Qual("bytes", "NewReader").Call(Id("bodyBytes")),
+			),
+			Line(),
+
+			Comment("Create the request"),
+			List(Id("req"), Err()).Op(":=").
+				Qual("net/http", "NewRequestWithContext").
+				Call(
+					Id("ctx"), Id("method"), Id("path"), Id("bodyReader"),
+				),
+			If(Err().Op("!=").Nil()).Block(
+				Return(Nil(), Qual("fmt", "Errorf").Call(Lit("create request: %w"), Err())),
+			),
+			Line(),
+
+			Comment("Add any headers to the request"),
+			For(List(Id("header"), Id("values")).Op(":=").Range().Id("headers")).Block(
+				For(List(Id("_"), Id("value")).Op(":=").Range().Id("values")).Block(
+					Id("req").Dot("Header").Dot("Add").Call(Id("header"), Id("value")),
+				),
+			),
+			Line(),
+
+			Comment("Make the request via the base client"),
+			List(Id("rawResponse"), Err()).Op(":=").
+				Id("client").Dot("Do").Call(Id("req")),
+			If(Err().Op("!=").Nil()).Block(
+				Return(Nil(), Qual("fmt", "Errorf").Call(Lit("request failed: %w"), Err())),
+			),
+			Defer().Func().Params().Block(
+				Id("_").Op("=").Id("rawResponse").Dot("Body").Dot("Close").Call(),
+			).Call(),
+			If(Id("rawResponse").Dot("StatusCode").Op(">=").Lit(400)).Block(
+				Comment("Read the full body sent back"),
+				List(Id("body"), Err()).Op(":=").Qual("io", "ReadAll").Call(Id("rawResponse").Dot("Body")),
+				If(Err().Op("!=").Nil()).Block(
+					Return(
+						Nil(),
+						Op("&").Id("APIError").Values(Dict{
+							Id("Code"):    Id("ErrUnknown"),
+							Id("Message"): Qual("fmt", "Sprintf").Call(Lit("got error response without readable body: %s"), Id("rawResponse").Dot("Status")),
+						}),
+					),
+				),
+				Line(),
+
+				Comment("Attempt to decode the error response as a structured APIError"),
+				Id("apiError").Op(":=").Op("&").Id("APIError").Block(),
+				If(
+					Err().Op(":=").Qual("encoding/json", "Unmarshal").
+						Call(Id("body"), Id("apiError")),
+					Err().Op("!=").Nil(),
+				).Block(
+					Comment("If the error is not a parsable as an APIError, then return an error with the raw body"),
+					Return(
+						Nil(),
+						Op("&").Id("APIError").Values(Dict{
+							Id("Code"):    Id("ErrUnknown"),
+							Id("Message"): Qual("fmt", "Sprintf").Call(Lit("got error response: %s"), String().Call(Id("body"))),
+						}),
+					),
+				),
+				Return(Nil(), Id("apiError")),
+			),
+			Line(),
+
+			Comment("Decode the response"),
+			If(
+				Id("resp").Op("!=").Nil(),
+			).Block(
+				If(
+					Err().Op(":=").Qual("encoding/json", "NewDecoder").
+						Call(Id("rawResponse").Dot("Body")).
+						Dot("Decode").
+						Call(Id("resp")),
+					Err().Op("!=").Nil(),
+				).Block(
+					Return(Nil(), Qual("fmt", "Errorf").Call(Lit("decode response: %w"), Err())),
+				),
+			),
+			Return(
+				Id("rawResponse").Dot("Header"),
+				Nil(),
+			),
+		)
+
+	return nil
+}
+
+func (g *golang) writeErrorType(file *File) {
+	const ErrPrefix = "Err"
+
+	// Create the error type
+	file.Line()
+	file.Comment("APIError is the error type returned by the API")
+	file.Type().Id("APIError").Struct(
+		Id("Code").Id("ErrCode").Tag(map[string]string{"json": "code"}),
+		Id("Message").String().Tag(map[string]string{"json": "message"}),
+		Id("Details").Any().Tag(map[string]string{"json": "details"}),
+	)
+	file.Func().Params(Id("e").Op("*").Id("APIError")).Id("Error").Params().String().Block(
+		Return(Qual("fmt", "Sprintf").Call(Lit("%s: %s"), Id("e").Dot("Code"), Id("e").Dot("Message"))),
+	)
+	file.Line()
+	file.Line()
+
+	// Create the ErrCode type and list
+	file.Type().Id("ErrCode").Int()
+	errTypes := make([]Code, 0)
+	for i, err := range errorCodes {
+		for _, line := range strings.Split(strings.TrimSpace(err.Comment), "\n") {
+			// Fix the comment with the prefix
+			if strings.HasPrefix(line, err.Name) {
+				line = ErrPrefix + line
+			}
+			errTypes = append(errTypes, Comment(line))
+		}
+
+		errTypes = append(
+			errTypes,
+			Id(ErrPrefix+err.Name).Id("ErrCode").Op("=").Lit(i),
+			Line(),
+		)
+	}
+	file.Const().Defs(errTypes...)
+
+	// Create the functions to convert an error to string
+	file.Comment("// String returns the string representation of the error code")
+	file.Func().Params(Id("c").Id("ErrCode")).Id("String").Params().String().Block(
+		Switch(Id("c")).BlockFunc(func(g *Group) {
+			for _, err := range errorCodes {
+				g.Case(Id(ErrPrefix + err.Name)).Block(
+					Return(Lit(idents.Convert(err.Name, idents.SnakeCase))),
+				)
+			}
+
+			g.Default().Block(
+				Return(Lit("unknown")),
+			)
+		}),
+	)
+	file.Line()
+
+	file.Comment("MarshalJSON converts the error code to a human-readable string")
+	file.Func().Params(Id("c").Id("ErrCode")).Id("MarshalJSON").Params().Params(Index().Byte(), Error()).Block(
+		Return(Index().Byte().Call(Qual("fmt", "Sprintf").Call(Lit("\"%s\""), Id("c"))), Nil()),
+	)
+	file.Line()
+
+	file.Comment("UnmarshalJSON converts the human-readable string to an error code")
+	file.Func().Params(Id("c").Op("*").Id("ErrCode")).Id("UnmarshalJSON").Params(Id("b").Index().Byte()).Error().Block(
+		Switch(String().Call(Id("b"))).BlockFunc(func(g *Group) {
+			for _, err := range errorCodes {
+				g.Case(Lit(fmt.Sprintf("\"%s\"", idents.Convert(err.Name, idents.SnakeCase)))).Block(
+					Op("*").Id("c").Op("=").Id(ErrPrefix + err.Name),
+				)
+			}
+
+			g.Default().Block(
+				Op("*").Id("c").Op("=").Id(ErrPrefix + "Unknown"),
+			)
+		}),
+
+		Return(Nil()),
+	)
+}
+
+func (g *golang) writeExtraHelpers(file *File) {
+	if g.seenSlicePath {
+		file.Line()
+		file.Comment("// pathEscapeSlice escapes a slice of strings and then joins them into a single string")
+		file.Func().Id("pathEscapeSlice").Params(Id("paths").Index().String()).String().Block(
+			Var().Id("escapedPaths").Qual("strings", "Builder"),
+			For(List(Id("i"), Id("path")).Op(":=").Range().Id("paths")).Block(
+				If(Id("i").Op(">").Lit(0)).Block(
+					Id("escapedPaths").Dot("WriteString").Call(Lit("/")),
+				),
+				Id("escapedPaths").Dot("WriteString").Call(Qual("net/url", "PathEscape").Call(Id("path"))),
+			),
+			Return(Id("escapedPaths").Dot("String").Call()),
+		)
+	}
+
+	if g.seenLiteralNull {
+		file.Line()
+		file.Comment("null is a helper type to indicate a null value in JSON.")
+		file.Type().Id("null").Op("=").Op("*").Bool()
+	}
+}
+
+func (g *golang) addAuthData(grp *Group) (err error) {
+	grp.Comment("If a authorization data generator is present, call it and add the returned token to the request")
+
+	// If the auth data is a string, then we want to add it as a bearer token
+	if g.md.AuthHandler.Params.GetBuiltin() == schema.Builtin_STRING {
+		grp.If(Id("b").Dot("authGenerator").Op("!=").Nil()).Block(
+			If(
+				List(Id("token"), Err()).Op(":=").
+					Id("b").Dot("authGenerator").Call(
+					Id("req").Dot("Context").Call(),
+				),
+				Err().Op("!=").Nil(),
+			).Block(
+				Return(Nil(), Qual("fmt", "Errorf").Call(Lit("unable to create authorization token for api request: %w"), Err())),
+			).Else().If(Id("token").Op("!=").Lit("")).Block(
+				Id("req").Dot("Header").Dot("Set").Call(
+					Lit("Authorization"),
+					Qual("fmt", "Sprintf").
+						Call(Lit("Bearer %s"), Id("token")),
+				),
+			),
+		)
+		grp.Line()
+
+		return nil
+	}
+
+	// Otherwise, we need to add the complex data type
+	auth, err := encoding.DescribeAuth(g.md, g.md.AuthHandler.Params, nil)
+	if err != nil {
+		return errors.Wrap(err, "unable to describe auth data")
+	}
+
+	authGeneratorCodeBlock := If(
+		List(Id("authData"), Err()).Op(":=").
+			Id("b").Dot("authGenerator").Call(
+			Id("req").Dot("Context").Call(),
+		),
+		Err().Op("!=").Nil(),
+	).Block(
+		Return(Nil(), Qual("fmt", "Errorf").Call(Lit("unable to create authorization token for api request: %w"), Err())),
+	).Else()
+
+	if g.md.AuthHandler.AuthData.GetPointer() != nil {
+		authGeneratorCodeBlock = authGeneratorCodeBlock.If(Id("authData").Op("!=").Nil())
+	}
+
+	authGeneratorCodeBlock = authGeneratorCodeBlock.BlockFunc(func(grp *Group) {
+
+		enc := g.enc.NewPossibleInstance("authEncoder")
+		enc.Add(Line())
+
+		if len(auth.QueryParameters) > 0 {
+			enc.Add(Comment("Add the auth fields to the query string"), Line())
+			enc.Add(Id("query").Op(":=").Id("req").Dot("URL").Dot("Query").Call(), Line())
+
+			// Check the request schema for fields we can put in the query string
+			for _, field := range auth.QueryParameters {
+				if field.Type.GetList() != nil {
+					// If we have a slice, we need to encode each bit
+					slice, err := enc.ToStringSlice(
+						field.Type,
+						Id("authData").Dot(idents.Convert(field.SrcName, idents.PascalCase)),
+					)
+					if err != nil {
+						err = errors.Wrapf(err, "unable to encode query fields %s", field.SrcName)
+						return
+					}
+
+					enc.Add(For(List(Id("_"), Id("v")).Op(":=").Range().Add(slice)).Block(
+						Id("query").Dot("Add").Call(
+							Lit(field.WireFormat),
+							Id("v"),
+						),
+					), Line())
+				} else {
+					// Otherwise, we can just append the field
+					val, err := enc.ToString(
+						field.Type,
+						Id("authData").Dot(idents.Convert(field.SrcName, idents.PascalCase)),
+					)
+					if err != nil {
+						err = errors.Wrapf(err, "unable to encode query field %s", field.SrcName)
+						return
+					}
+
+					enc.Add(Id("query").Dot("Set").Call(
+						Lit(field.WireFormat),
+						val,
+					), Line())
+				}
+
+			}
+
+			enc.Add(Id("req").Dot("URL").Dot("RawQuery").Op("=").Id("query").Dot("Encode").Call(), Line(), Line())
+		}
+
+		if len(auth.HeaderParameters) > 0 {
+			enc.Add(Comment("Add the auth fields to the headers"), Line())
+
+			// Check the request schema for fields we can put in the query string
+			for _, field := range auth.HeaderParameters {
+				// Otherwise, we can just append the field
+				val, err := enc.ToString(
+					field.Type,
+					Id("authData").Dot(idents.Convert(field.SrcName, idents.PascalCase)),
+				)
+				if err != nil {
+					err = errors.Wrapf(err, "unable to encode header field %s", field.SrcName)
+					return
+				}
+
+				enc.Add(Id("req").Dot("Header").Dot("Set").Call(
+					Lit(field.WireFormat),
+					val,
+				), Line())
+			}
+		}
+
+		grp.Add(enc.Finalize(Return(Nil(), Qual("fmt", "Errorf").Call(
+			Lit("unable to marshal authentication data: %w"),
+			enc.LastError(),
+		)))...)
+	})
+
+	grp.If(Id("b").Dot("authGenerator").Op("!=").Nil()).Block(
+		authGeneratorCodeBlock,
+	)
+	grp.Line()
+
+	return
+}
diff --git a/pkg/clientgen/javascript.go b/pkg/clientgen/javascript.go
new file mode 100644
index 0000000000..44d8c7e464
--- /dev/null
+++ b/pkg/clientgen/javascript.go
@@ -0,0 +1,1494 @@
+package clientgen
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"sort"
+	"strings"
+	"unicode"
+
+	"github.com/cockroachdb/errors"
+	"golang.org/x/text/cases"
+	"golang.org/x/text/language"
+
+	"encr.dev/pkg/clientgen/clientgentypes"
+	"encr.dev/pkg/idents"
+
+	"encr.dev/internal/version"
+	"encr.dev/parser/encoding"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+/* The JavaScript generator generates code that looks like this:
+class TaskServiceClient {
+	public Add(params) {
+		// ...
+	}
+}
+
+export const task = {
+    ServiceClient: TaskServiceClient
+}
+
+*/
+
+// jsGenVersion allows us to introduce breaking changes in the generated code but behind a switch
+// meaning that people with client code reliant on the old behaviour can continue to generate the
+// old code.
+type jsGenVersion int
+
+const (
+	// JsInitial is the originally released javascript generator
+	JsInitial jsGenVersion = iota
+
+	// JsExperimental can be used to lock experimental or uncompleted features in the generated code
+	// It should always be the last item in the enum
+	JsExperimental
+)
+
+const javascriptGenLatestVersion = JsExperimental - 1
+
+type javascript struct {
+	*bytes.Buffer
+	md               *meta.Data
+	appSlug          string
+	typs             *typeRegistry
+	currDecl         *schema.Decl
+	generatorVersion jsGenVersion
+
+	seenJSON           bool // true if a JSON type was seen
+	seenHeaderResponse bool // true if we've seen a header used in a response object
+	hasAuth            bool // true if we've seen an authentication handler
+	authIsComplexType  bool // true if the auth type is a complex type
+}
+
+func (js *javascript) Version() int {
+	return int(js.generatorVersion)
+}
+
+func (js *javascript) Generate(p clientgentypes.GenerateParams) (err error) {
+	defer js.handleBailout(&err)
+
+	js.Buffer = p.Buf
+	js.md = p.Meta
+	js.appSlug = p.AppSlug
+	js.typs = getNamedTypes(p.Meta, p.Services)
+
+	if js.md.AuthHandler != nil {
+		if !js.isAuthCookiesOnly() {
+			js.hasAuth = true
+			js.authIsComplexType = js.md.AuthHandler.Params.GetBuiltin() != schema.Builtin_STRING
+		}
+	}
+
+	js.WriteString("// " + doNotEditHeader() + "\n\n")
+
+	js.WriteString("// Disable eslint, jshint, and jslint for this file.\n")
+	js.WriteString("/* eslint-disable */\n")
+	js.WriteString("/* jshint ignore:start */\n")
+	js.WriteString("/*jslint-disable*/\n")
+
+	seenNs := make(map[string]bool)
+	js.writeClient(p.Services)
+	for _, svc := range p.Meta.Svcs {
+		if err := js.writeService(svc, p.Services, p.Tags); err != nil {
+			return err
+		}
+		seenNs[svc.Name] = true
+	}
+	js.writeExtraTypes()
+	js.writeStreamClasses()
+	if err := js.writeBaseClient(p.AppSlug); err != nil {
+		return err
+	}
+	js.writeCustomErrorType()
+
+	return nil
+}
+
+func (js *javascript) getFields(typ *schema.Type) []*schema.Field {
+	if typ == nil {
+		return nil
+	}
+	switch typ.Typ.(type) {
+	case *schema.Type_Struct:
+		return typ.GetStruct().Fields
+	case *schema.Type_Named:
+		decl := js.md.Decls[typ.GetNamed().Id]
+		return js.getFields(decl.Type)
+	default:
+		return nil
+	}
+}
+
+func (js *javascript) isAuthCookiesOnly() bool {
+	if js.md.AuthHandler == nil {
+		return false
+	}
+	fields := js.getFields(js.md.AuthHandler.Params)
+	if fields == nil {
+		return false
+	}
+	for _, field := range fields {
+		if field.Wire.GetCookie() == nil {
+			return false
+		}
+	}
+	return true
+}
+
+func (js *javascript) writeService(svc *meta.Service, set clientgentypes.ServiceSet, tags clientgentypes.TagSet) error {
+	// Determine if we have anything worth exposing.
+	// Either a public RPC or a named type.
+	isIncluded := hasPublicRPC(svc) && set.Has(svc.Name)
+	if !isIncluded {
+		return nil
+	}
+
+	ns := svc.Name
+	numIndent := 0
+	indent := func() {
+		js.WriteString(strings.Repeat("    ", numIndent))
+	}
+
+	fmt.Fprintf(js, "class %sServiceClient {\n", cases.Title(language.English, cases.Compact).String(js.typeName(ns)))
+	numIndent++
+
+	// Constructor
+	indent()
+	js.WriteString("constructor(baseClient) {\n")
+	numIndent++
+	indent()
+	js.WriteString("this.baseClient = baseClient\n")
+	for _, rpc := range svc.Rpcs {
+		if rpc.AccessType == meta.RPC_PRIVATE || !tags.IsRPCIncluded(rpc) {
+			continue
+		}
+		name := js.memberName(rpc.Name)
+		indent()
+		fmt.Fprintf(js, "this.%s = this.%s.bind(this)\n", name, name)
+	}
+
+	numIndent--
+	indent()
+	js.WriteString("}\n")
+
+	// RPCs
+	for _, rpc := range svc.Rpcs {
+		if rpc.AccessType == meta.RPC_PRIVATE || !tags.IsRPCIncluded(rpc) {
+			continue
+		}
+
+		js.WriteByte('\n')
+
+		// Doc string
+		if rpc.Doc != nil && *rpc.Doc != "" {
+			scanner := bufio.NewScanner(strings.NewReader(*rpc.Doc))
+			indent()
+			js.WriteString("/**\n")
+			for scanner.Scan() {
+				indent()
+				js.WriteString(" * ")
+				js.WriteString(scanner.Text())
+				js.WriteByte('\n')
+			}
+			indent()
+			js.WriteString(" */\n")
+		}
+
+		// Signature
+		indent()
+		fmt.Fprintf(js, "async %s(", js.memberName(rpc.Name))
+
+		if rpc.Proto == meta.RPC_RAW {
+			js.WriteString("method, ")
+		}
+
+		nParams := 0
+		var rpcPath strings.Builder
+		for _, s := range rpc.Path.Segments {
+			rpcPath.WriteByte('/')
+			if s.Type != meta.PathSegment_LITERAL {
+				if nParams > 0 {
+					js.WriteString(", ")
+				}
+
+				js.WriteString(js.nonReservedId(s.Value))
+				if s.Type == meta.PathSegment_WILDCARD || s.Type == meta.PathSegment_FALLBACK {
+					rpcPath.WriteString("${" + js.nonReservedId(s.Value) + ".map(encodeURIComponent).join(\"/\")}")
+				} else {
+					rpcPath.WriteString("${encodeURIComponent(" + js.nonReservedId(s.Value) + ")}")
+				}
+				nParams++
+			} else {
+				rpcPath.WriteString(s.Value)
+			}
+		}
+
+		var isStream = rpc.StreamingRequest || rpc.StreamingResponse
+
+		// Avoid a name collision.
+		payloadName := "params"
+
+		if (!isStream && rpc.RequestSchema != nil) || (isStream && rpc.HandshakeSchema != nil) {
+			if nParams > 0 {
+				js.WriteString(", ")
+			}
+			js.WriteString(payloadName)
+		} else if rpc.Proto == meta.RPC_RAW {
+			if nParams > 0 {
+				js.WriteString(", ")
+			}
+			js.WriteString("body, options")
+		}
+
+		js.WriteString(") {\n")
+
+		if isStream {
+			var direction streamDirection
+
+			if rpc.StreamingRequest && rpc.StreamingResponse {
+				direction = InOut
+			} else if rpc.StreamingRequest {
+				direction = Out
+			} else {
+				direction = In
+			}
+
+			if err := js.streamCallSite(js.newIdentWriter(numIndent+1), rpc, rpcPath.String(), direction); err != nil {
+				return errors.Wrapf(err, "unable to write streaming RPC call site for %s.%s", rpc.ServiceName, rpc.Name)
+			}
+		} else {
+			if err := js.rpcCallSite(js.newIdentWriter(numIndent+1), rpc, rpcPath.String()); err != nil {
+				return errors.Wrapf(err, "unable to write RPC call site for %s.%s", rpc.ServiceName, rpc.Name)
+			}
+		}
+
+		indent()
+		js.WriteString("}\n")
+	}
+	numIndent--
+	indent()
+	js.WriteString("}\n\n")
+
+	fmt.Fprintf(js, "export const %s = {\n", js.typeName(ns))
+	numIndent++
+	indent()
+	fmt.Fprintf(js, "ServiceClient: %sServiceClient\n", cases.Title(language.English, cases.Compact).String(js.typeName(ns)))
+	numIndent--
+	indent()
+	js.WriteString("}\n\n")
+	return nil
+}
+
+type streamDirection int
+
+const (
+	InOut streamDirection = iota
+	In
+	Out
+)
+
+func (js *javascript) streamCallSite(w *indentWriter, rpc *meta.RPC, rpcPath string, direction streamDirection) error {
+	headers := ""
+	query := ""
+
+	if rpc.HandshakeSchema != nil {
+		encs, err := encoding.DescribeRequest(js.md, rpc.HandshakeSchema, &encoding.Options{SrcNameTag: "json"}, "GET")
+		if err != nil {
+			return errors.Wrapf(err, "stream %s", rpc.Name)
+		}
+
+		handshakeEnc := encs[0]
+
+		if len(handshakeEnc.HeaderParameters) > 0 || len(handshakeEnc.QueryParameters) > 0 {
+			w.WriteString("// Convert our params into the objects we need for the request\n")
+		}
+
+		// Generate the headers
+		if len(handshakeEnc.HeaderParameters) > 0 {
+			headers = "headers"
+
+			dict := make(map[string]string)
+			for _, field := range handshakeEnc.HeaderParameters {
+				ref := js.Dot("params", field.SrcName)
+				dict[field.WireFormat] = js.convertBuiltinToString(field.Type.GetBuiltin(), ref, field.Optional)
+			}
+
+			w.WriteString("const headers = makeRecord(")
+			js.Values(w, dict)
+			w.WriteString(")\n\n")
+		}
+
+		// Generate the query string
+		if len(handshakeEnc.QueryParameters) > 0 {
+			query = "query"
+
+			dict := make(map[string]string)
+			for _, field := range handshakeEnc.QueryParameters {
+				if list := field.Type.GetList(); list != nil {
+					dict[field.WireFormat] = js.Dot("params", field.SrcName) +
+						".map((v) => " + js.convertBuiltinToString(list.Elem.GetBuiltin(), "v", field.Optional) + ")"
+				} else {
+					dict[field.WireFormat] = js.convertBuiltinToString(
+						field.Type.GetBuiltin(),
+						js.Dot("params", field.SrcName),
+						field.Optional,
+					)
+				}
+			}
+
+			w.WriteString("const query = makeRecord(")
+			js.Values(w, dict)
+			w.WriteString(")\n\n")
+		}
+	}
+
+	// Build the call to createStream
+	var method string
+
+	switch direction {
+	case InOut:
+		method = "createStreamInOut"
+	case In:
+		method = "createStreamIn"
+	case Out:
+		method = "createStreamOut"
+	}
+
+	createStream := fmt.Sprintf(
+		"this.baseClient.%s(`%s`",
+		method,
+		rpcPath,
+	)
+
+	if headers != "" || query != "" {
+		createStream += ", {" + headers
+
+		if headers != "" && query != "" {
+			createStream += ", "
+		}
+
+		if query != "" {
+			createStream += query
+		}
+
+		createStream += "}"
+	}
+	createStream += ")"
+
+	w.WriteStringf("return await %s\n", createStream)
+	return nil
+}
+
+func (js *javascript) rpcCallSite(w *indentWriter, rpc *meta.RPC, rpcPath string) error {
+	// Work out how we're going to encode and call this RPC
+	rpcEncoding, err := encoding.DescribeRPC(js.md, rpc, &encoding.Options{SrcNameTag: "json"})
+	if err != nil {
+		return errors.Wrapf(err, "rpc %s", rpc.Name)
+	}
+
+	// Raw end points just pass through the request
+	// and need no further code generation
+	if rpc.Proto == meta.RPC_RAW {
+		w.WriteStringf(
+			"return this.baseClient.callAPI(method, `%s`, body, options)\n",
+			rpcPath,
+		)
+		return nil
+	}
+
+	// Work out how we encode the Request Schema
+	headers := ""
+	query := ""
+	body := ""
+
+	if rpc.RequestSchema != nil {
+		reqEnc := rpcEncoding.DefaultRequestEncoding
+
+		if len(reqEnc.HeaderParameters) > 0 || len(reqEnc.QueryParameters) > 0 {
+			w.WriteString("// Convert our params into the objects we need for the request\n")
+		}
+
+		// Generate the headers
+		if len(reqEnc.HeaderParameters) > 0 {
+			headers = "headers"
+
+			dict := make(map[string]string)
+			for _, field := range reqEnc.HeaderParameters {
+				ref := js.Dot("params", field.SrcName)
+				dict[field.WireFormat] = js.convertBuiltinToString(field.Type.GetBuiltin(), ref, field.Optional)
+			}
+
+			w.WriteString("const headers = makeRecord(")
+			js.Values(w, dict)
+			w.WriteString(")\n\n")
+		}
+
+		// Generate the query string
+		if len(reqEnc.QueryParameters) > 0 {
+			query = "query"
+
+			dict := make(map[string]string)
+			for _, field := range reqEnc.QueryParameters {
+				if list := field.Type.GetList(); list != nil {
+					dict[field.WireFormat] = js.Dot("params", field.SrcName) +
+						".map((v) => " + js.convertBuiltinToString(list.Elem.GetBuiltin(), "v", field.Optional) + ")"
+				} else {
+					dict[field.WireFormat] = js.convertBuiltinToString(
+						field.Type.GetBuiltin(),
+						js.Dot("params", field.SrcName),
+						field.Optional,
+					)
+				}
+			}
+
+			w.WriteString("const query = makeRecord(")
+			js.Values(w, dict)
+			w.WriteString(")\n\n")
+		}
+
+		// Generate the body
+		if len(reqEnc.BodyParameters) > 0 {
+			if len(reqEnc.HeaderParameters) == 0 && len(reqEnc.QueryParameters) == 0 {
+				// In the simple case we can just encode the params as the body directly
+				body = "JSON.stringify(params)"
+			} else {
+				// Else we need a new struct called "body"
+				body = "JSON.stringify(body)"
+
+				dict := make(map[string]string)
+				for _, field := range reqEnc.BodyParameters {
+					fieldName := field.SrcName
+					dict[fieldName] = js.Dot("params", fieldName)
+				}
+
+				w.WriteString("// Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)\nconst body = ")
+				js.Values(w, dict)
+				w.WriteString("\n\n")
+			}
+		}
+	}
+
+	// Build the call to callTypedAPI
+	callAPI := fmt.Sprintf(
+		"this.baseClient.callTypedAPI(\"%s\", `%s`",
+		rpcEncoding.DefaultMethod,
+		rpcPath,
+	)
+	if body != "" || headers != "" || query != "" {
+		if body == "" {
+			callAPI += ", undefined"
+		} else {
+			callAPI += ", " + body
+		}
+
+		if headers != "" || query != "" {
+			callAPI += ", {" + headers
+
+			if headers != "" && query != "" {
+				callAPI += ", "
+			}
+
+			if query != "" {
+				callAPI += query
+			}
+
+			callAPI += "}"
+
+		}
+	}
+	callAPI += ")"
+
+	// If there's no response schema, we can just return the call to the API directly
+	if rpc.ResponseSchema == nil {
+		w.WriteStringf("await %s\n", callAPI)
+		return nil
+	}
+
+	w.WriteStringf("// Now make the actual call to the API\nconst resp = await %s\n", callAPI)
+
+	respEnc := rpcEncoding.ResponseEncoding
+
+	// If we don't need to do anything with the body, we can just return the response
+	if len(respEnc.HeaderParameters) == 0 {
+		w.WriteString("return await resp.json()\n")
+		return nil
+	}
+
+	// Otherwise, we need to add the header fields to the response
+	w.WriteString("\n//Populate the return object from the JSON body and received headers\nconst rtn = await resp.json()\n")
+
+	for _, headerField := range respEnc.HeaderParameters {
+		isSetCookie := strings.ToLower(headerField.WireFormat) == "set-cookie"
+		if isSetCookie {
+			w.WriteString("// Skip set-cookie header in browser context as browsers doesn't have access to read it\n")
+			w.WriteString("if (!BROWSER) {\n")
+			w = w.Indent()
+		}
+
+		js.seenHeaderResponse = true
+		fieldValue := fmt.Sprintf("mustBeSet(\"Header `%s`\", resp.headers.get(\"%s\"))", headerField.WireFormat, headerField.WireFormat)
+
+		w.WriteStringf("%s = %s\n", js.Dot("rtn", headerField.SrcName), js.convertStringToBuiltin(headerField.Type.GetBuiltin(), fieldValue))
+
+		if isSetCookie {
+			w = w.Dedent()
+			w.WriteString("}\n")
+		}
+	}
+	w.WriteString("return rtn\n")
+	return nil
+}
+
+// nonReservedId returns the given ID, unless we have it a reserved within the client function _or_ it's a reserved Typescript keyword
+func (js *javascript) nonReservedId(id string) string {
+	switch id {
+	// our reserved keywords (or ID's we use within the generated client functions)
+	case "params", "headers", "query", "body", "resp", "rtn":
+		return "_" + id
+
+	// Javascript keywords
+	// Based on https://www.w3schools.com/js/js_reserved.asp
+	case "abstract", "arguments", "async", "await", "boolean", "break", "byte", "case", "catch", "char",
+		"class", "const", "continue", "debugger", "default", "delete", "do", "double", "else",
+		"enum", "eval", "export", "extends", "false", "final", "finally", "float", "for", "function", "get",
+		"goto", "if", "implements", "import", "in", "instanceof", "int", "interface", "let", "long",
+		"native", "new", "null", "of", "package", "private", "protected", "public", "require", "return",
+		"short", "static", "super", "switch", "symbol", "synchronized", "this", "throw", "throws",
+		"transient", "true", "try", "type", "typeof", "var", "void", "volatile", "while", "with", "yield":
+		return "_" + id
+
+	default:
+		return id
+	}
+}
+
+func (js *javascript) writeClient(set clientgentypes.ServiceSet) {
+	w := js.newIdentWriter(0)
+	w.WriteString(`
+/**
+ * Local is the base URL for calling the Encore application's API.
+ */
+export const Local = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name) {
+    return ` + "`https://${name}-" + js.appSlug + ".encr.app`" + `
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr) {
+    return Environment(` + "`pr${pr}`" + `)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the ` + js.appSlug + ` Encore application.
+ */
+export default class Client {`)
+
+	{
+		w := w.Indent()
+		w.WriteString(`
+/**
+ * Creates a Client for calling the public and authenticated APIs of your Encore application.
+ *
+ * @param target  The target which the client should be configured to use. See Local and Environment for options.
+ * @param options Options for the client
+ */
+constructor(target = "prod", options = undefined) {`)
+		{
+			w := w.Indent()
+
+			if js.hasAuth && !js.authIsComplexType {
+				w.WriteString(`
+// Convert the old constructor parameters to a BaseURL object and a ClientOptions object
+if (!target.startsWith("http://") && !target.startsWith("https://")) {
+    target = Environment(target)
+}
+
+if (typeof options === "string") {
+    options = { auth: options }
+}
+
+`)
+			} else {
+				w.WriteString("\n")
+			}
+
+			w.WriteString("const base = new BaseClient(target, options ?? {})\n")
+			for _, svc := range js.md.Svcs {
+				if hasPublicRPC(svc) && set.Has(svc.Name) {
+					w.WriteStringf("this.%s = new %s.ServiceClient(base)\n", js.memberName(svc.Name), js.typeName(svc.Name))
+				}
+			}
+		}
+
+		w.WriteString("    }\n")
+	}
+	w.WriteString("}\n\n")
+}
+
+func (js *javascript) writeStreamClasses() {
+	send := `
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }`
+
+	receive := `
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }`
+
+	js.WriteString(`
+
+function encodeWebSocketHeaders(headers) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    hasUpdateHandlers = [];
+
+    constructor(url, headers) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers));
+        }
+
+        this.ws = new WebSocket(url, protocols);
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type, handler) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type, handler) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+` + send + `
+` + receive + `
+}
+
+export class StreamIn {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+` + receive + `
+}
+
+export class StreamOut {
+    constructor(url, headers) {
+        let responseResolver;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response() {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+` + send + `
+}`)
+}
+func (js *javascript) writeBaseClient(appSlug string) error {
+	userAgent := fmt.Sprintf("%s-Generated-JS-Client (Encore/%s)", appSlug, version.Version)
+
+	js.WriteString(`
+
+const boundFetch = fetch.bind(this)
+
+class BaseClient {`)
+	js.WriteString(`
+    constructor(baseURL, options) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "` + userAgent + `";
+        }
+
+        this.requestInit = options.requestInit ?? {}
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }`)
+
+	if js.hasAuth {
+		js.WriteString(`
+
+        // Setup an authentication data generator using the auth data token option
+        if (options.auth !== undefined) {
+            const auth = options.auth
+            if (typeof auth === "function") {
+                this.authGenerator = auth
+            } else {
+                this.authGenerator = () => auth
+            }
+        }
+`)
+	}
+
+	js.WriteString(`
+    }
+
+    async getAuthData() {`)
+	if js.hasAuth {
+		js.WriteString(`
+        let authData;
+
+        // If authorization data generator is present, call it and add the returned data to the request
+        if (this.authGenerator) {
+            const mayBePromise = this.authGenerator();
+            if (mayBePromise instanceof Promise) {
+                authData = await mayBePromise;
+            } else {
+                authData = mayBePromise;
+            }
+        }
+
+        if (authData) {
+            const data = {};
+
+`)
+
+		w := js.newIdentWriter(3)
+		if js.authIsComplexType {
+			authData, err := encoding.DescribeAuth(js.md, js.md.AuthHandler.Params, &encoding.Options{SrcNameTag: "json"})
+			if err != nil {
+				return errors.Wrap(err, "unable to describe auth data")
+			}
+
+			// Generate the query string
+			if len(authData.QueryParameters) > 0 {
+				dict := make(map[string]string)
+				for _, field := range authData.QueryParameters {
+					if list := field.Type.GetList(); list != nil {
+						dict[field.WireFormat] = js.Dot("authData", field.SrcName) +
+							".map((v) => " + js.convertBuiltinToString(list.Elem.GetBuiltin(), "v", field.Optional) + ")"
+					} else {
+						dict[field.WireFormat] = js.convertBuiltinToString(
+							field.Type.GetBuiltin(),
+							js.Dot("authData", field.SrcName),
+							field.Optional,
+						)
+					}
+				}
+
+				w.WriteString("data.query = makeRecord(")
+				js.Values(w, dict)
+				w.WriteString(");\n")
+			}
+
+			// Generate the headers
+			if len(authData.HeaderParameters) > 0 {
+				dict := make(map[string]string)
+				for _, field := range authData.HeaderParameters {
+					ref := js.Dot("authData", field.SrcName)
+					dict[field.WireFormat] = js.convertBuiltinToString(field.Type.GetBuiltin(), ref, field.Optional)
+				}
+
+				w.WriteString("data.headers = makeRecord(")
+				js.Values(w, dict)
+				w.WriteString(")\n")
+			}
+		} else {
+			w.WriteString("data.headers = {};\n")
+			w.WriteString("data.headers[\"Authorization\"] = \"Bearer \" + authData;\n")
+		}
+
+		w.WriteString("\nreturn data;\n")
+		w.Dedent().WriteString("}\n")
+	}
+
+	js.WriteString(`
+        return undefined;
+    }
+`)
+
+	js.WriteString(`
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : '';
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    async callTypedAPI(method, path, body, params) {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    async callAPI(method, path, body, params) {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body = { code: ErrCode.Unknown, message: ` + "`request failed: status ${response.status}`" + ` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}`)
+	return nil
+}
+
+func (js *javascript) writeExtraTypes() {
+	js.WriteString(`
+function encodeQuery(parts) {
+    const pairs = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]])
+        for (const v of val) {
+            pairs.push(` + "`" + `${key}=${encodeURIComponent(v)}` + "`" + `)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+function makeRecord(record) {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record
+}
+`)
+
+	if js.seenHeaderResponse {
+		js.WriteString(`
+// mustBeSet will throw an APIError with the Data Loss code if value is null or undefined
+function mustBeSet(field, value) {
+    if (value === null || value === undefined) {
+        throw new APIError(
+            500,
+            {
+                code: ErrCode.DataLoss,
+                message: ` + "`${field} was unexpectedly ${value}`" + `, // ${value} will create the string "null" or "undefined"
+            },
+        )
+    }
+    return value
+}
+`)
+	}
+}
+
+func (js *javascript) convertBuiltinToString(typ schema.Builtin, val string, isOptional bool) string {
+	var code string
+	switch typ {
+	case schema.Builtin_STRING:
+		return val
+	case schema.Builtin_JSON:
+		code = fmt.Sprintf("JSON.stringify(%s)", val)
+	default:
+		code = fmt.Sprintf("String(%s)", val)
+	}
+
+	if isOptional {
+		code = fmt.Sprintf("%s === undefined ? undefined : %s", val, code)
+	}
+	return code
+}
+
+func (js *javascript) convertStringToBuiltin(typ schema.Builtin, val string) string {
+	switch typ {
+	case schema.Builtin_ANY:
+		return val
+	case schema.Builtin_BOOL:
+		return fmt.Sprintf("%s.toLowerCase() === \"true\"", val)
+	case schema.Builtin_INT, schema.Builtin_INT8, schema.Builtin_INT16, schema.Builtin_INT32, schema.Builtin_INT64,
+		schema.Builtin_UINT, schema.Builtin_UINT8, schema.Builtin_UINT16, schema.Builtin_UINT32, schema.Builtin_UINT64:
+		return fmt.Sprintf("parseInt(%s, 10)", val)
+	case schema.Builtin_FLOAT32, schema.Builtin_FLOAT64:
+		return fmt.Sprintf("Number(%s)", val)
+	case schema.Builtin_STRING:
+		return val
+	case schema.Builtin_BYTES:
+		return val
+	case schema.Builtin_TIME:
+		return val
+	case schema.Builtin_JSON:
+		js.seenJSON = true
+		return fmt.Sprintf("JSON.parse(%s)", val)
+	case schema.Builtin_UUID:
+		return val
+	case schema.Builtin_USER_ID:
+		return val
+	case schema.Builtin_DECIMAL:
+		return val
+	default:
+		js.errorf("unknown builtin type %v", typ)
+		return "any"
+	}
+}
+
+func (js *javascript) errorf(format string, args ...interface{}) {
+	panic(bailout{fmt.Errorf(format, args...)})
+}
+
+func (js *javascript) handleBailout(dst *error) {
+	if err := recover(); err != nil {
+		if bail, ok := err.(bailout); ok {
+			*dst = bail.err
+		} else {
+			panic(err)
+		}
+	}
+}
+
+func (js *javascript) newIdentWriter(indent int) *indentWriter {
+	return &indentWriter{
+		w:                js.Buffer,
+		depth:            indent,
+		indent:           "    ",
+		firstWriteOnLine: true,
+	}
+}
+
+func (js *javascript) Quote(s string) string {
+	return fmt.Sprintf("\"%s\"", strings.Replace(s, "\"", "\\\"", -1))
+}
+
+func (js *javascript) QuoteIfRequired(s string) string {
+	// If the identifier isn't purely alphanumeric, we need to add quotes.
+	if !stringIsOnly(s, func(r rune) bool { return unicode.IsLetter(r) || unicode.IsDigit(r) }) {
+		return js.Quote(s)
+	}
+	return s
+}
+
+// Dot allows us to reference a field in a struct by ijs name.
+func (js *javascript) Dot(structIdent string, fieldIdent string) string {
+	fieldIdent = js.QuoteIfRequired(fieldIdent)
+
+	if len(fieldIdent) > 0 && fieldIdent[0] == '"' {
+		return fmt.Sprintf("%s[%s]", structIdent, fieldIdent)
+	} else {
+		return fmt.Sprintf("%s.%s", structIdent, fieldIdent)
+	}
+}
+
+func (js *javascript) Values(w *indentWriter, dict map[string]string) {
+	// Work out the largest key length.
+	largestKey := 0
+	keys := make([]string, 0, len(dict))
+	for key := range dict {
+		keys = append(keys, key)
+		key = js.QuoteIfRequired(key)
+		if len(key) > largestKey {
+			largestKey = len(key)
+		}
+	}
+
+	sort.Strings(keys)
+
+	w.WriteString("{\n")
+	{
+		w := w.Indent()
+		for _, key := range keys {
+			ident := js.QuoteIfRequired(key)
+			w.WriteStringf("%s: %s%s,\n", ident, strings.Repeat(" ", largestKey-len(ident)), dict[key])
+		}
+	}
+	w.WriteString("}")
+}
+
+func (js *javascript) typeName(identifier string) string {
+	if js.generatorVersion < JsExperimental {
+		return identifier
+	} else {
+		return idents.Convert(identifier, idents.PascalCase)
+	}
+}
+
+func (js *javascript) memberName(identifier string) string {
+	if js.generatorVersion < JsExperimental {
+		return identifier
+	} else {
+		return idents.Convert(identifier, idents.CamelCase)
+	}
+}
+
+func (js *javascript) fieldNameInStruct(field *schema.Field) string {
+	name := field.Name
+	if field.JsonName != "" {
+		name = field.JsonName
+	}
+	return name
+}
+
+func (js *javascript) writeCustomErrorType() {
+	w := js.newIdentWriter(0)
+
+	w.WriteString(`
+
+function isAPIErrorResponse(err) {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code) {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    constructor(status, response) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if (Object.setPrototypeOf == undefined) {
+            this.__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if (Error.captureStackTrace !== undefined) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+
+        /**
+         * The HTTP status code associated with the error.
+         */
+        this.status = status
+
+        /**
+         * The Encore error code
+         */
+        this.code = response.code
+
+        /**
+         * The error details
+         */
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err) {
+    return err instanceof APIError;
+}
+
+export const ErrCode = {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK: "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled: "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown: "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument: "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded: "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound: "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists: "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied: "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted: "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition: "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted: "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange: "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented: "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal: "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable: "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss: "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated: "unauthenticated"
+}
+`)
+}
diff --git a/pkg/clientgen/openapi/openapi.go b/pkg/clientgen/openapi/openapi.go
new file mode 100644
index 0000000000..1a7fafd9c0
--- /dev/null
+++ b/pkg/clientgen/openapi/openapi.go
@@ -0,0 +1,396 @@
+package openapi
+
+import (
+	"encoding/json"
+	"fmt"
+	"go/doc/comment"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+	"github.com/getkin/kin-openapi/openapi3"
+
+	"encr.dev/parser/encoding"
+	"encr.dev/pkg/clientgen/clientgentypes"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+type GenVersion int
+
+const (
+	// Initial is the originally released OpenAPI client generator
+	Initial GenVersion = iota
+
+	// Experimental can be used to lock experimental or uncompleted features in the generated code
+	// It should always be the last item in the enum.
+	Experimental
+
+	LatestVersion GenVersion = Experimental - 1
+)
+
+type Generator struct {
+	ver       GenVersion
+	spec      *openapi3.T
+	md        *meta.Data
+	seenDecls map[string]uint32
+}
+
+func New(version GenVersion) *Generator {
+	return &Generator{
+		ver:       version,
+		seenDecls: make(map[string]uint32),
+	}
+}
+
+func (g *Generator) Version() int {
+	return int(g.ver)
+}
+
+func (g *Generator) Generate(p clientgentypes.GenerateParams) (err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			if b, ok := r.(bailout); ok {
+				err = b.err
+			} else {
+				panic(r)
+			}
+		}
+	}()
+
+	g.md = p.Meta
+	g.spec = newSpec(p.AppSlug)
+
+	for _, svc := range p.Meta.Svcs {
+		if p.Services.Has(svc.Name) {
+			if err := g.addService(svc, p.Tags, p.Options); err != nil {
+				return err
+			}
+		}
+	}
+
+	out, err := g.spec.MarshalJSON()
+	if err != nil {
+		return errors.Wrap(err, "marshal openapi spec")
+	}
+
+	// Pretty-print the JSON output
+	return json.Indent(p.Buf, out, "", "  ")
+}
+
+func (g *Generator) addService(svc *meta.Service, tags clientgentypes.TagSet, opts clientgentypes.Options) error {
+	for _, rpc := range svc.Rpcs {
+		// streaming endpoints not supported yet
+		if rpc.StreamingRequest || rpc.StreamingResponse {
+			continue
+		}
+
+		// Skip private endpoints if the flag is set
+		if opts.OpenAPIExcludePrivateEndpoints && rpc.AccessType == meta.RPC_PRIVATE {
+			continue
+		}
+
+		// Skip RPCs that don't match the tags
+		if !tags.IsRPCIncluded(rpc) {
+			continue
+		}
+
+		if err := g.addRPC(rpc); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (g *Generator) addRPC(rpc *meta.RPC) error {
+	item := g.getOrCreatePath(rpc)
+
+	encodings, err := encoding.DescribeRPC(g.md, rpc, &encoding.Options{})
+	if err != nil {
+		return errors.Wrapf(err, "describe rpc %s.%s", rpc.ServiceName, rpc.Name)
+	}
+
+	for _, reqEnc := range encodings.RequestEncoding {
+		for _, m := range reqEnc.HTTPMethods {
+			op, err := g.newOperationForEncoding(rpc, m, reqEnc, encodings.ResponseEncoding)
+			if err != nil {
+				return errors.Wrapf(err, "create operation for rpc %s.%s", rpc.ServiceName, rpc.Name)
+			}
+			item.SetOperation(m, op)
+		}
+	}
+
+	g.spec.Paths[rpcPath(rpc)] = item
+	return nil
+}
+
+func (g *Generator) getOrCreatePath(rpc *meta.RPC) *openapi3.PathItem {
+	path := rpcPath(rpc)
+	if existing, ok := g.spec.Paths[path]; ok {
+		return existing
+	}
+	item := &openapi3.PathItem{}
+	g.spec.Paths[path] = item
+	return item
+}
+
+func (g *Generator) newOperationForEncoding(rpc *meta.RPC, method string, reqEnc *encoding.RequestEncoding, respEnc *encoding.ResponseEncoding) (*openapi3.Operation, error) {
+	summary, desc := "", ""
+	if rpc.Doc != nil {
+		summary, desc = splitDoc(*rpc.Doc)
+	}
+	op := &openapi3.Operation{
+		Summary:     summary,
+		Description: desc,
+		OperationID: method + ":" + rpc.ServiceName + "." + rpc.Name,
+		Responses:   make(openapi3.Responses),
+	}
+
+	// Add path parameters
+	for _, seg := range rpc.Path.Segments {
+		if seg.Type == meta.PathSegment_LITERAL {
+			continue
+		}
+
+		op.Parameters = append(op.Parameters, &openapi3.ParameterRef{
+			Value: &openapi3.Parameter{
+				Name:            seg.Value,
+				In:              openapi3.ParameterInPath,
+				Description:     "",
+				Style:           openapi3.SerializationSimple,
+				Explode:         ptr(false),
+				AllowEmptyValue: true,
+				AllowReserved:   false,
+				Deprecated:      false,
+				Required:        true,
+				Schema:          g.pathParamType(seg.ValueType).NewRef(),
+				Example:         nil,
+				Examples:        nil,
+				Content:         nil,
+			},
+		})
+	}
+
+	// Add header parameters
+	for _, param := range reqEnc.HeaderParameters {
+		op.Parameters = append(op.Parameters, &openapi3.ParameterRef{
+			Value: &openapi3.Parameter{
+				Name:            param.WireFormat,
+				In:              openapi3.ParameterInHeader,
+				Description:     markdownDoc(param.Doc),
+				Style:           openapi3.SerializationSimple,
+				Explode:         ptr(true),
+				AllowEmptyValue: true,
+				AllowReserved:   false,
+				Deprecated:      false,
+				Required:        !param.Optional,
+				Schema:          g.schemaType(param.Type),
+				Example:         nil,
+				Examples:        nil,
+				Content:         nil,
+			},
+		})
+	}
+
+	// Add query parameters
+	for _, param := range reqEnc.QueryParameters {
+		op.Parameters = append(op.Parameters, &openapi3.ParameterRef{
+			Value: &openapi3.Parameter{
+				Name:            param.WireFormat,
+				In:              openapi3.ParameterInQuery,
+				Description:     markdownDoc(param.Doc),
+				Style:           openapi3.SerializationForm,
+				Explode:         ptr(true),
+				AllowEmptyValue: true,
+				AllowReserved:   false,
+				Deprecated:      false,
+				Required:        !param.Optional,
+				Schema:          g.schemaType(param.Type),
+				Example:         nil,
+				Examples:        nil,
+				Content:         nil,
+			},
+		})
+	}
+
+	// Add request body
+	if len(reqEnc.BodyParameters) > 0 {
+		op.RequestBody = &openapi3.RequestBodyRef{
+			Value: &openapi3.RequestBody{
+				Description: "",
+				Required:    false,
+				Content:     g.bodyContent(reqEnc.BodyParameters),
+			},
+		}
+	}
+
+	// Encode the response
+	{
+		resp := &openapi3.Response{
+			Headers:     make(openapi3.Headers),
+			Links:       nil,
+			Description: ptr("Success response"),
+		}
+
+		if respEnc != nil {
+			for _, param := range respEnc.HeaderParameters {
+				resp.Headers[param.WireFormat] = &openapi3.HeaderRef{
+					Value: &openapi3.Header{Parameter: openapi3.Parameter{
+						Description:     markdownDoc(param.Doc),
+						Style:           openapi3.SerializationSimple,
+						Explode:         ptr(true),
+						AllowEmptyValue: true,
+						AllowReserved:   false,
+						Deprecated:      false,
+						Required:        !param.Optional,
+						Schema:          g.schemaType(param.Type),
+						Example:         nil,
+						Examples:        nil,
+						Content:         nil,
+					}},
+				}
+			}
+
+			if len(respEnc.BodyParameters) > 0 {
+				resp.Content = g.bodyContent(respEnc.BodyParameters)
+			}
+		}
+
+		op.Responses["200"] = &openapi3.ResponseRef{
+			Value: resp,
+		}
+		op.Responses["default"] = &openapi3.ResponseRef{
+			Ref: "#/components/responses/APIError",
+		}
+	}
+
+	return op, nil
+}
+
+func rpcPath(rpc *meta.RPC) string {
+	var b strings.Builder
+	for _, seg := range rpc.Path.Segments {
+		b.WriteString("/")
+		switch seg.Type {
+		case meta.PathSegment_LITERAL:
+			b.WriteString(seg.Value)
+		default:
+			b.WriteString("{")
+			b.WriteString(seg.Value)
+			b.WriteString("}")
+		}
+	}
+	return b.String()
+}
+
+func splitDoc(doc string) (plaintextSummary, markdownDescription string) {
+	firstLine, remaining := doc, ""
+	if idx := strings.Index(doc, "\n"); idx >= 0 {
+		firstLine = doc[:idx]
+		remaining = doc[idx+1:]
+	}
+
+	return plaintextDoc(firstLine), markdownDoc(remaining)
+}
+
+func plaintextDoc(doc string) string {
+	var parser comment.Parser
+	var pr comment.Printer
+	d := parser.Parse(doc)
+	return string(pr.Text(d))
+}
+
+func markdownDoc(doc string) string {
+	var parser comment.Parser
+	var pr comment.Printer
+	d := parser.Parse(doc)
+	return string(pr.Markdown(d))
+}
+
+func ptr[T any](t T) *T {
+	return &t
+}
+
+func newSpec(appSlug string) *openapi3.T {
+	t := &openapi3.T{
+		Components: &openapi3.Components{
+			RequestBodies:   make(map[string]*openapi3.RequestBodyRef),
+			Responses:       make(map[string]*openapi3.ResponseRef),
+			SecuritySchemes: make(map[string]*openapi3.SecuritySchemeRef),
+			Schemas:         make(map[string]*openapi3.SchemaRef),
+		},
+		Info: &openapi3.Info{
+			Title:       fmt.Sprintf("API for %s", appSlug),
+			Description: "Generated by encore",
+			Version:     "1",
+			Extensions: map[string]any{
+				"x-logo": map[string]string{
+					"url":             "https://encore.dev/assets/branding/logo/logo-black.png",
+					"backgroundColor": "#EEEEE1",
+					"altText":         "Encore logo",
+				},
+			},
+		},
+		OpenAPI: "3.0.0",
+		Paths:   make(openapi3.Paths),
+	}
+
+	// Add the local platform server:
+	t.AddServer(
+		&openapi3.Server{
+			URL:         "http://localhost:4000",
+			Description: "Encore local dev environment",
+		},
+	)
+
+	t.Components.Responses["APIError"] = &openapi3.ResponseRef{
+		Value: &openapi3.Response{
+			Content: openapi3.Content{
+				"application/json": &openapi3.MediaType{
+					Schema: &openapi3.SchemaRef{
+						Value: &openapi3.Schema{
+							Type:  openapi3.TypeObject,
+							Title: "APIError",
+							ExternalDocs: &openapi3.ExternalDocs{
+								URL: "https://pkg.go.dev/encore.dev/beta/errs#Error",
+							},
+							Properties: map[string]*openapi3.SchemaRef{
+								"code": {
+									Value: &openapi3.Schema{
+										Description: "Error code",
+										Example:     "not_found",
+										Type:        openapi3.TypeString,
+										ExternalDocs: &openapi3.ExternalDocs{
+											URL: "https://pkg.go.dev/encore.dev/beta/errs#ErrCode",
+										},
+									},
+								},
+								"message": {
+									Value: &openapi3.Schema{
+										Description: "Error message",
+										Type:        openapi3.TypeString,
+									},
+								},
+								"details": {
+									Value: &openapi3.Schema{
+										Description: "Error details",
+										Type:        openapi3.TypeObject,
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			Description: ptr("Error response"),
+		},
+	}
+
+	return t
+}
+
+type bailout struct {
+	err error
+}
+
+func doBailout(err error) {
+	panic(bailout{err})
+}
diff --git a/pkg/clientgen/openapi/schema.go b/pkg/clientgen/openapi/schema.go
new file mode 100644
index 0000000000..ad769e5176
--- /dev/null
+++ b/pkg/clientgen/openapi/schema.go
@@ -0,0 +1,427 @@
+package openapi
+
+import (
+	"fmt"
+	"math"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+	"github.com/getkin/kin-openapi/openapi3"
+
+	"encr.dev/parser/encoding"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+func (g *Generator) bodyContent(params []*encoding.ParameterEncoding) openapi3.Content {
+	if len(params) == 0 {
+		return nil
+	}
+
+	required := make([]string, 0, len(params))
+	props := make(openapi3.Schemas)
+	for _, p := range params {
+		val := g.schemaType(p.Type)
+		if vv := val.Value; vv != nil {
+			vv.Title, vv.Description = splitDoc(p.Doc)
+		}
+		props[p.WireFormat] = val
+		if !p.Optional {
+			required = append(required, p.WireFormat)
+		}
+	}
+
+	s := openapi3.NewObjectSchema()
+	s.Properties = props
+	s.Required = required
+
+	return openapi3.Content{
+		"application/json": &openapi3.MediaType{
+			Schema:   s.NewRef(),
+			Example:  nil,
+			Examples: nil,
+			Encoding: nil,
+		},
+	}
+}
+
+func (g *Generator) schemaType(typ *schema.Type) *openapi3.SchemaRef {
+	switch t := typ.Typ.(type) {
+	// A type switch for all the different schema types we support
+	case *schema.Type_Named:
+		return g.namedSchemaType(t.Named)
+
+	case *schema.Type_Struct:
+		props := make(openapi3.Schemas)
+		required := make([]string, 0, len(t.Struct.Fields))
+		for _, f := range t.Struct.Fields {
+			jsonName := f.JsonName
+			if jsonName == "-" {
+				continue
+			}
+			if jsonName == "" {
+				jsonName = f.Name
+			}
+			if !f.Optional {
+				required = append(required, jsonName)
+			}
+
+			val := g.schemaType(f.Typ)
+
+			if vv := val.Value; vv != nil {
+				// Direct schema - can set title and description directly
+				vv.Title, vv.Description = splitDoc(f.Doc)
+			} else if val.Ref != "" && f.Doc != "" {
+				// Schema reference with field documentation - use allOf pattern to add description
+				// This is the recommended workaround for OpenAPI 3.0 to add descriptions to $ref
+				// See: https://github.com/OAI/OpenAPI-Specification/issues/2033
+				// OpenAPI 3.1 supports description alongside $ref directly, but we use a library that doesn't support 3.1 yet
+				title, description := splitDoc(f.Doc)
+				val = &openapi3.SchemaRef{
+					Value: &openapi3.Schema{
+						AllOf:       []*openapi3.SchemaRef{val},
+						Title:       title,
+						Description: description,
+					},
+				}
+			}
+			props[jsonName] = val
+		}
+
+		s := openapi3.NewObjectSchema()
+		s.Properties = props
+		s.Required = required
+		return s.NewRef()
+
+	case *schema.Type_Map:
+		// TODO non-string keys are not supported
+		s := openapi3.NewObjectSchema()
+		s.AdditionalProperties = openapi3.AdditionalProperties{
+			Schema: g.schemaType(t.Map.Value),
+		}
+		return s.NewRef()
+
+	case *schema.Type_List:
+		arr := openapi3.NewArraySchema()
+		arr.Items = g.schemaType(t.List.Elem)
+		return arr.NewRef()
+
+	case *schema.Type_Pointer:
+		return g.schemaType(t.Pointer.Base)
+
+	case *schema.Type_Literal:
+		switch tt := t.Literal.Value.(type) {
+		case *schema.Literal_Str:
+			return openapi3.NewStringSchema().WithEnum(tt.Str).NewRef()
+		case *schema.Literal_Boolean:
+			return openapi3.NewBoolSchema().WithEnum(tt.Boolean).NewRef()
+		case *schema.Literal_Int:
+			return openapi3.NewInt64Schema().WithEnum(tt.Int).NewRef()
+		case *schema.Literal_Float:
+			return openapi3.NewFloat64Schema().WithEnum(tt.Float).NewRef()
+		case *schema.Literal_Null:
+			// This shouldn't happen in most situations as we handle literals explicitly.
+			return openapi3.NewBoolSchema().WithNullable().NewRef()
+		default:
+			doBailout(errors.Newf("unknown literal type %T", tt))
+			return nil // unreachable
+		}
+
+	case *schema.Type_Union:
+		// First check if all the fields are literals.
+		// If so we can more accurately represent this union as an enum.
+		var (
+			literals        []any
+			literalsType    string
+			haveAllLiterals = true
+			haveLiteralNull bool
+		)
+		for _, tt := range t.Union.Types {
+			lit, ok := tt.Typ.(*schema.Type_Literal)
+			if !ok {
+				// It's not a literal.
+				// Still need to keep going to find any nulls.
+				haveAllLiterals = false
+				continue
+			}
+
+			var litType string
+			switch tt := lit.Literal.Value.(type) {
+			case *schema.Literal_Str:
+				litType = openapi3.TypeString
+				literals = append(literals, tt.Str)
+			case *schema.Literal_Boolean:
+				litType = openapi3.TypeBoolean
+				literals = append(literals, tt.Boolean)
+			case *schema.Literal_Int:
+				litType = openapi3.TypeInteger
+				literals = append(literals, tt.Int)
+			case *schema.Literal_Float:
+				litType = openapi3.TypeNumber
+				literals = append(literals, tt.Float)
+			case *schema.Literal_Null:
+				haveLiteralNull = true
+				continue
+			default:
+				doBailout(errors.Newf("unknown literal type %T", tt))
+			}
+
+			// Set the literals type if we haven't seen it yet.
+			if literalsType == "" {
+				literalsType = litType
+			} else if literalsType != litType {
+				// If we have different types, it can't be represented as an enum.
+				haveAllLiterals = false
+			}
+		}
+
+		if haveAllLiterals {
+			s := openapi3.NewSchema()
+			s.Type = literalsType
+			s.Nullable = haveLiteralNull
+			return s.WithEnum(literals...).NewRef()
+		}
+
+		// Otherwise, we have to represent this as an anyOf schema.
+		schemas := make([]*openapi3.Schema, 0, len(t.Union.Types))
+		for _, tt := range t.Union.Types {
+			schemas = append(schemas, g.schemaType(tt).Value)
+		}
+
+		s := openapi3.NewAnyOfSchema(schemas...)
+		s.Nullable = haveLiteralNull
+		return s.NewRef()
+
+	case *schema.Type_TypeParameter:
+		return openapi3.NewObjectSchema().NewRef() // unknown
+
+	case *schema.Type_Config:
+		elem := g.schemaType(t.Config.Elem)
+		if t.Config.IsValuesList {
+			s := openapi3.NewArraySchema()
+			s.Items = elem
+			return s.NewRef()
+		} else {
+			return elem
+		}
+
+	case *schema.Type_Builtin:
+		return g.builtinSchemaType(t.Builtin).NewRef()
+
+	default:
+		doBailout(errors.Newf("unknown schema type %T", t))
+		panic("unreachable")
+	}
+}
+
+func (g *Generator) builtinSchemaType(t schema.Builtin) *openapi3.Schema {
+	switch t {
+	case schema.Builtin_BOOL:
+		return openapi3.NewBoolSchema()
+	case schema.Builtin_INT8:
+		return openapi3.NewInt32Schema().WithMin(math.MinInt8).WithMax(math.MaxInt8)
+	case schema.Builtin_INT16:
+		return openapi3.NewInt32Schema().WithMin(math.MinInt16).WithMax(math.MaxInt16)
+	case schema.Builtin_INT32:
+		return openapi3.NewInt32Schema().WithMin(math.MinInt32).WithMax(math.MaxInt32)
+	case schema.Builtin_INT64, schema.Builtin_INT:
+		return openapi3.NewInt64Schema()
+	case schema.Builtin_UINT8:
+		return openapi3.NewInt32Schema().WithMin(0).WithMax(math.MaxUint8)
+	case schema.Builtin_UINT16:
+		return openapi3.NewInt32Schema().WithMin(0).WithMax(math.MaxUint16)
+	case schema.Builtin_UINT32:
+		return openapi3.NewInt64Schema().WithMin(0).WithMax(math.MaxUint32)
+	case schema.Builtin_UINT64, schema.Builtin_UINT:
+		return openapi3.NewInt64Schema().WithMin(0)
+	case schema.Builtin_FLOAT32, schema.Builtin_FLOAT64:
+		return openapi3.NewFloat64Schema()
+	case schema.Builtin_STRING:
+		return openapi3.NewStringSchema()
+	case schema.Builtin_BYTES:
+		return openapi3.NewStringSchema().WithFormat("byte")
+	case schema.Builtin_TIME:
+		return openapi3.NewStringSchema().WithFormat("date-time")
+	case schema.Builtin_UUID:
+		return openapi3.NewUUIDSchema()
+	case schema.Builtin_JSON:
+		return openapi3.NewObjectSchema()
+	case schema.Builtin_USER_ID:
+		return openapi3.NewStringSchema()
+	case schema.Builtin_DECIMAL:
+		return openapi3.NewStringSchema()
+	default:
+		doBailout(errors.Newf("unknown builtin type %v", t))
+		panic("unreachable")
+	}
+}
+
+func (g *Generator) namedSchemaType(typ *schema.Named) *openapi3.SchemaRef {
+	namedType := &schema.Type{Typ: &schema.Type_Named{Named: typ}}
+	concrete, err := encoding.GetConcreteType(g.md.Decls, namedType, nil)
+	if err != nil {
+		doBailout(errors.Wrap(err, "get concrete type"))
+	}
+
+	origCandidate := g.typeToDefinitionName(namedType)
+
+	// Make sure the candidate name corresponds to this declaration.
+	for idx := 1; ; idx++ {
+		candidate := origCandidate
+		// Add a suffix if this is not the first candidate.
+		if idx > 1 {
+			candidate += fmt.Sprintf("_%d", idx)
+		}
+
+		if _, ok := g.spec.Components.Schemas[candidate]; ok {
+			// There is already a declaration with that name; make sure it matches
+			if seen, ok := g.seenDecls[candidate]; ok && seen != typ.Id {
+				// Different declaration; try again.
+				continue
+			}
+		} else {
+			// Unused name; allocate it.
+			// Write to the maps before we compute the schema to avoid infinite recursion
+			// in the presence of recursive types.
+			g.seenDecls[candidate] = typ.Id
+			g.spec.Components.Schemas[candidate] = nil
+
+			// Generate the schema and add the declaration's documentation
+			schemaRef := g.schemaType(concrete)
+			if schemaRef.Value != nil {
+				// Get the declaration to access its documentation
+				if decl := g.md.Decls[typ.Id]; decl != nil && decl.Doc != "" {
+					title, description := splitDoc(decl.Doc)
+					if schemaRef.Value.Title == "" {
+						schemaRef.Value.Title = title
+					}
+					if schemaRef.Value.Description == "" {
+						schemaRef.Value.Description = description
+					}
+				}
+			}
+			g.spec.Components.Schemas[candidate] = schemaRef
+		}
+
+		return &openapi3.SchemaRef{
+			Ref: "#/components/schemas/" + candidate,
+		}
+	}
+}
+
+func (g *Generator) typeToDefinitionName(typ *schema.Type) string {
+	switch typ := typ.Typ.(type) {
+	case *schema.Type_Named:
+		var name strings.Builder
+		decl := g.md.Decls[typ.Named.Id]
+		name.WriteString(decl.Loc.PkgName)
+		name.WriteString(".")
+		name.WriteString(decl.Name)
+		for _, typeArg := range typ.Named.TypeArguments {
+			name.WriteString("_")
+			name.WriteString(g.typeToDefinitionName(typeArg))
+		}
+		return name.String()
+	case *schema.Type_List:
+		return "List_" + g.typeToDefinitionName(typ.List.Elem)
+	case *schema.Type_Map:
+		return "Map_" + g.typeToDefinitionName(typ.Map.Key) + "_" + g.typeToDefinitionName(typ.Map.Value)
+	case *schema.Type_Pointer:
+		return g.typeToDefinitionName(typ.Pointer.Base)
+	case *schema.Type_Config:
+		return g.typeToDefinitionName(typ.Config.Elem)
+	case *schema.Type_Builtin:
+		switch typ.Builtin {
+		case schema.Builtin_ANY:
+			return "any"
+		case schema.Builtin_BOOL:
+			return "bool"
+		case schema.Builtin_INT8:
+			return "int8"
+		case schema.Builtin_INT16:
+			return "int16"
+		case schema.Builtin_INT32:
+			return "int32"
+		case schema.Builtin_INT64:
+			return "int64"
+		case schema.Builtin_UINT8:
+			return "uint8"
+		case schema.Builtin_UINT16:
+			return "uint16"
+		case schema.Builtin_UINT32:
+			return "uint32"
+		case schema.Builtin_UINT64:
+			return "uint64"
+		case schema.Builtin_FLOAT32:
+			return "float32"
+		case schema.Builtin_FLOAT64:
+			return "float64"
+		case schema.Builtin_STRING:
+			return "string"
+		case schema.Builtin_BYTES:
+			return "bytes"
+		case schema.Builtin_TIME:
+			return "string"
+		case schema.Builtin_UUID:
+			return "string"
+		case schema.Builtin_JSON:
+			return "string"
+		case schema.Builtin_USER_ID:
+			return "string"
+		case schema.Builtin_INT:
+			return "int"
+		case schema.Builtin_UINT:
+			return "uint"
+		case schema.Builtin_DECIMAL:
+			return "string"
+		default:
+			return ""
+		}
+
+	case *schema.Type_Literal:
+		switch typ.Literal.Value.(type) {
+		case *schema.Literal_Boolean:
+			return "bool"
+		case *schema.Literal_Str:
+			return "string"
+		case *schema.Literal_Null:
+			return "null"
+		case *schema.Literal_Int:
+			return "int"
+		case *schema.Literal_Float:
+			return "float64"
+		}
+	}
+
+	return ""
+}
+
+func (g *Generator) pathParamType(typ meta.PathSegment_ParamType) *openapi3.Schema {
+	switch typ {
+	case meta.PathSegment_BOOL:
+		return openapi3.NewBoolSchema()
+	case meta.PathSegment_INT8:
+		return openapi3.NewInt32Schema().WithMin(math.MinInt8).WithMax(math.MaxInt8)
+	case meta.PathSegment_INT16:
+		return openapi3.NewInt32Schema().WithMin(math.MinInt16).WithMax(math.MaxInt16)
+	case meta.PathSegment_INT32:
+		return openapi3.NewInt32Schema().WithMin(math.MinInt32).WithMax(math.MaxInt32)
+	case meta.PathSegment_INT64, meta.PathSegment_INT:
+		return openapi3.NewInt64Schema()
+	case meta.PathSegment_UINT8:
+		return openapi3.NewInt32Schema().WithMin(0).WithMax(math.MaxUint8)
+	case meta.PathSegment_UINT16:
+		return openapi3.NewInt32Schema().WithMin(0).WithMax(math.MaxUint16)
+	case meta.PathSegment_UINT32:
+		return openapi3.NewInt64Schema().WithMin(0).WithMax(math.MaxUint32)
+	case meta.PathSegment_UINT64, meta.PathSegment_UINT:
+		return openapi3.NewInt64Schema().WithMin(0)
+	case meta.PathSegment_STRING:
+		return openapi3.NewStringSchema()
+	case meta.PathSegment_UUID:
+		return openapi3.NewUUIDSchema()
+	default:
+		doBailout(errors.Newf("unknown path param type: %v"))
+		panic("unreachable")
+	}
+}
diff --git a/pkg/clientgen/testdata/README.md b/pkg/clientgen/testdata/README.md
new file mode 100644
index 0000000000..34cbeb6ed9
--- /dev/null
+++ b/pkg/clientgen/testdata/README.md
@@ -0,0 +1,8 @@
+# Update Golden Tests
+
+Instead of manually updating the golden tests, once you've verified the output of the tests is correct, then you
+can simply update all the `expected output files` files by running
+
+```bash
+go test ./pkg/clientgen -golden-update
+```
diff --git a/pkg/clientgen/testdata/goapp/expected_baseauth_golang.go b/pkg/clientgen/testdata/goapp/expected_baseauth_golang.go
new file mode 100644
index 0000000000..a6e8425874
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_baseauth_golang.go
@@ -0,0 +1,486 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+)
+
+// Client is an API client for the app Encore application.
+type Client struct {
+	Svc SvcClient
+}
+
+// BaseURL is the base URL for calling the Encore application's API.
+type BaseURL string
+
+const Local BaseURL = "http://localhost:4000"
+
+// Environment returns a BaseURL for calling the cloud environment with the given name.
+func Environment(name string) BaseURL {
+	return BaseURL(fmt.Sprintf("https://%s-app.encr.app", name))
+}
+
+// PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+func PreviewEnv(pr int) BaseURL {
+	return Environment(fmt.Sprintf("pr%d", pr))
+}
+
+// Option allows you to customise the baseClient used by the Client
+type Option = func(client *baseClient) error
+
+// New returns a Client for calling the public and authenticated APIs of your Encore application.
+// You can customize the behaviour of the client using the given Option functions, such as WithHTTPClient or WithAuthFunc.
+func New(target BaseURL, options ...Option) (*Client, error) {
+	// Parse the base URL where the Encore application is being hosted
+	baseURL, err := url.Parse(string(target))
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse base url: %w", err)
+	}
+
+	// Create a client with sensible defaults
+	base := &baseClient{
+		baseURL:    baseURL,
+		httpClient: http.DefaultClient,
+		userAgent:  "app-Generated-Go-Client (Encore/v0.0.0-develop)",
+	}
+
+	// Apply any given options
+	for _, option := range options {
+		if err := option(base); err != nil {
+			return nil, fmt.Errorf("unable to apply client option: %w", err)
+		}
+	}
+
+	return &Client{Svc: &svcClient{base}}, nil
+}
+
+// WithHTTPClient can be used to configure the underlying HTTP client used when making API calls.
+//
+// Defaults to http.DefaultClient
+func WithHTTPClient(client HTTPDoer) Option {
+	return func(base *baseClient) error {
+		base.httpClient = client
+		return nil
+	}
+}
+
+// WithAuthToken allows you to set an authentication token to be used for each request.
+//
+// This token will be sent as a Bearer token in the Authorization header.
+func WithAuthToken(bearerToken string) Option {
+	return func(base *baseClient) error {
+		base.authGenerator = func(_ context.Context) (string, error) {
+			return bearerToken, nil
+		}
+		return nil
+	}
+}
+
+// WithAuthFunc allows you to pass a function which is called for each request to return an authentication token to be used for each request.
+//
+// This token will be sent as a Bearer token in the Authorization header.
+func WithAuthFunc(authGenerator func(ctx context.Context) (string, error)) Option {
+	return func(base *baseClient) error {
+		base.authGenerator = authGenerator
+		return nil
+	}
+}
+
+type SvcRequest struct {
+	Message string
+}
+
+// SvcClient Provides you access to call public and authenticated APIs on svc. The concrete implementation is svcClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type SvcClient interface {
+	// DummyAPI is a dummy endpoint.
+	DummyAPI(ctx context.Context, params SvcRequest) error
+
+	// Private is a basic auth endpoint.
+	Private(ctx context.Context, params SvcRequest) error
+}
+
+type svcClient struct {
+	base *baseClient
+}
+
+var _ SvcClient = (*svcClient)(nil)
+
+// DummyAPI is a dummy endpoint.
+func (c *svcClient) DummyAPI(ctx context.Context, params SvcRequest) error {
+	_, err := callAPI(ctx, c.base, "POST", "/svc.DummyAPI", nil, params, nil)
+	return err
+}
+
+// Private is a basic auth endpoint.
+func (c *svcClient) Private(ctx context.Context, params SvcRequest) error {
+	_, err := callAPI(ctx, c.base, "POST", "/svc.Private", nil, params, nil)
+	return err
+}
+
+// HTTPDoer is an interface which can be used to swap out the default
+// HTTP client (http.DefaultClient) with your own custom implementation.
+// This can be used to inject middleware or mock responses during unit tests.
+type HTTPDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// baseClient holds all the information we need to make requests to an Encore application
+type baseClient struct {
+	authGenerator func(ctx context.Context) (string, error) // The function which will add the authentication data to the requests
+	httpClient    HTTPDoer                                  // The HTTP client which will be used for all API requests
+	baseURL       *url.URL                                  // The base URL which API requests will be made against
+	userAgent     string                                    // What user agent we will use in the API requests
+}
+
+// Do sends the req to the Encore application adding the authorization token as required.
+func (b *baseClient) Do(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", b.userAgent)
+
+	// If a authorization data generator is present, call it and add the returned token to the request
+	if b.authGenerator != nil {
+		if token, err := b.authGenerator(req.Context()); err != nil {
+			return nil, fmt.Errorf("unable to create authorization token for api request: %w", err)
+		} else if token != "" {
+			req.Header.Set("Authorization", fmt.Sprintf("Bearer %s", token))
+		}
+	}
+
+	// Merge the base URL and the API URL
+	req.URL = b.baseURL.ResolveReference(req.URL)
+	req.Host = req.URL.Host
+
+	// Finally, make the request via the configured HTTP Client
+	return b.httpClient.Do(req)
+}
+
+// callAPI is used by each generated API method to actually make request and decode the responses
+func callAPI(ctx context.Context, client *baseClient, method, path string, headers http.Header, body, resp any) (http.Header, error) {
+	// Encode the API body
+	var bodyReader io.Reader
+	if body != nil {
+		bodyBytes, err := json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("marshal request: %w", err)
+		}
+		bodyReader = bytes.NewReader(bodyBytes)
+	}
+
+	// Create the request
+	req, err := http.NewRequestWithContext(ctx, method, path, bodyReader)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	// Add any headers to the request
+	for header, values := range headers {
+		for _, value := range values {
+			req.Header.Add(header, value)
+		}
+	}
+
+	// Make the request via the base client
+	rawResponse, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer func() {
+		_ = rawResponse.Body.Close()
+	}()
+	if rawResponse.StatusCode >= 400 {
+		// Read the full body sent back
+		body, err := io.ReadAll(rawResponse.Body)
+		if err != nil {
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response without readable body: %s", rawResponse.Status),
+			}
+		}
+
+		// Attempt to decode the error response as a structured APIError
+		apiError := &APIError{}
+		if err := json.Unmarshal(body, apiError); err != nil {
+			// If the error is not a parsable as an APIError, then return an error with the raw body
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response: %s", string(body)),
+			}
+		}
+		return nil, apiError
+	}
+
+	// Decode the response
+	if resp != nil {
+		if err := json.NewDecoder(rawResponse.Body).Decode(resp); err != nil {
+			return nil, fmt.Errorf("decode response: %w", err)
+		}
+	}
+	return rawResponse.Header, nil
+}
+
+// APIError is the error type returned by the API
+type APIError struct {
+	Code    ErrCode `json:"code"`
+	Message string  `json:"message"`
+	Details any     `json:"details"`
+}
+
+func (e *APIError) Error() string {
+	return fmt.Sprintf("%s: %s", e.Code, e.Message)
+}
+
+type ErrCode int
+
+const (
+	// ErrOK indicates the operation was successful.
+	ErrOK ErrCode = 0
+
+	// ErrCanceled indicates the operation was canceled (typically by the caller).
+	//
+	// Encore will generate this error code when cancellation is requested.
+	ErrCanceled ErrCode = 1
+
+	// ErrUnknown error. An example of where this error may be returned is
+	// if a Status value received from another address space belongs to
+	// an error-space that is not known in this address space. Also
+	// errors raised by APIs that do not return enough error information
+	// may be converted to this error.
+	//
+	// Encore will generate this error code in the above two mentioned cases.
+	ErrUnknown ErrCode = 2
+
+	// ErrInvalidArgument indicates client specified an invalid argument.
+	// Note that this differs from FailedPrecondition. It indicates arguments
+	// that are problematic regardless of the state of the system
+	// (e.g., a malformed file name).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInvalidArgument ErrCode = 3
+
+	// ErrDeadlineExceeded means operation expired before completion.
+	// For operations that change the state of the system, this error may be
+	// returned even if the operation has completed successfully. For
+	// example, a successful response from a server could have been delayed
+	// long enough for the deadline to expire.
+	//
+	// The gRPC framework will generate this error code when the deadline is
+	// exceeded.
+	ErrDeadlineExceeded ErrCode = 4
+
+	// ErrNotFound means some requested entity (e.g., file or directory) was
+	// not found.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrNotFound ErrCode = 5
+
+	// ErrAlreadyExists means an attempt to create an entity failed because one
+	// already exists.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrAlreadyExists ErrCode = 6
+
+	// ErrPermissionDenied indicates the caller does not have permission to
+	// execute the specified operation. It must not be used for rejections
+	// caused by exhausting some resource (use ResourceExhausted
+	// instead for those errors). It must not be
+	// used if the caller cannot be identified (use Unauthenticated
+	// instead for those errors).
+	//
+	// This error code will not be generated by the gRPC core framework,
+	// but expect authentication middleware to use it.
+	ErrPermissionDenied ErrCode = 7
+
+	// ErrResourceExhausted indicates some resource has been exhausted, perhaps
+	// a per-user quota, or perhaps the entire file system is out of space.
+	//
+	// This error code will be generated by the gRPC framework in
+	// out-of-memory and server overload situations, or when a message is
+	// larger than the configured maximum size.
+	ErrResourceExhausted ErrCode = 8
+
+	// ErrFailedPrecondition indicates operation was rejected because the
+	// system is not in a state required for the operation's execution.
+	// For example, directory to be deleted may be non-empty, an rmdir
+	// operation is applied to a non-directory, etc.
+	//
+	// A litmus test that may help a service implementor in deciding
+	// between FailedPrecondition, Aborted, and Unavailable:
+	//
+	//	(a) Use Unavailable if the client can retry just the failing call.
+	//	(b) Use Aborted if the client should retry at a higher-level
+	//	    (e.g., restarting a read-modify-write sequence).
+	//	(c) Use FailedPrecondition if the client should not retry until
+	//	    the system state has been explicitly fixed. E.g., if an "rmdir"
+	//	    fails because the directory is non-empty, FailedPrecondition
+	//	    should be returned since the client should not retry unless
+	//	    they have first fixed up the directory by deleting files from it.
+	//	(d) Use FailedPrecondition if the client performs conditional
+	//	    REST Get/Update/Delete on a resource and the resource on the
+	//	    server does not match the condition. E.g., conflicting
+	//	    read-modify-write on the same resource.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrFailedPrecondition ErrCode = 9
+
+	// ErrAborted indicates the operation was aborted, typically due to a
+	// concurrency issue like sequencer check failures, transaction aborts,
+	// etc.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// ErrAborted, and Unavailable.
+	ErrAborted ErrCode = 10
+
+	// ErrOutOfRange means operation was attempted past the valid range.
+	// E.g., seeking or reading past end of file.
+	//
+	// Unlike InvalidArgument, this error indicates a problem that may
+	// be fixed if the system state changes. For example, a 32-bit file
+	// may be rotated to a 64-bit file without error.
+	//
+	// There is a fair bit of overlap between FailedPrecondition and
+	// ErrOutOfRange. We recommend using OutOfRange (the more specific
+	// error) when it applies so that callers who are iterating through
+	// a space can easily look for an OutOfRange error to detect when
+	// they are done.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrOutOfRange ErrCode = 11
+
+	// ErrUnimplemented indicates operation is not implemented or not
+	// supported/enabled in this service.
+	//
+	// This is not an error, but a feature not available.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrUnimplemented ErrCode = 12
+
+	// ErrInternal means some invariant expected by the underlying system has
+	// been broken. This is not a per-message error, it is a global
+	// conditions check.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInternal ErrCode = 13
+
+	// ErrUnavailable indicates the service is currently unavailable.
+	// This is most likely a transient condition, which can be corrected by
+	// retrying with a backoff.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	ErrUnavailable ErrCode = 14
+
+	// ErrDataLoss indicates unrecoverable data loss or corruption.
+	//
+	// This error code is only defined in the gRPC library, and only for
+	// unrecoverable data loss (i.e., data loss resulting from errors
+	// like hard disk corruption or bandwidth exceeded).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrDataLoss ErrCode = 15
+
+	// ErrUnauthenticated indicates the request does not have valid
+	// authentication credentials for the operation.
+	//
+	// The gRPC framework will generate this error code when the
+	// authentication metadata is invalid or a Credentials callback fails,
+	// but also expect authentication middleware to generate it.
+	ErrUnauthenticated ErrCode = 16
+)
+
+// String returns the string representation of the error code
+func (c ErrCode) String() string {
+	switch c {
+	case ErrOK:
+		return "ok"
+	case ErrCanceled:
+		return "canceled"
+	case ErrUnknown:
+		return "unknown"
+	case ErrInvalidArgument:
+		return "invalid_argument"
+	case ErrDeadlineExceeded:
+		return "deadline_exceeded"
+	case ErrNotFound:
+		return "not_found"
+	case ErrAlreadyExists:
+		return "already_exists"
+	case ErrPermissionDenied:
+		return "permission_denied"
+	case ErrResourceExhausted:
+		return "resource_exhausted"
+	case ErrFailedPrecondition:
+		return "failed_precondition"
+	case ErrAborted:
+		return "aborted"
+	case ErrOutOfRange:
+		return "out_of_range"
+	case ErrUnimplemented:
+		return "unimplemented"
+	case ErrInternal:
+		return "internal"
+	case ErrUnavailable:
+		return "unavailable"
+	case ErrDataLoss:
+		return "data_loss"
+	case ErrUnauthenticated:
+		return "unauthenticated"
+	default:
+		return "unknown"
+	}
+}
+
+// MarshalJSON converts the error code to a human-readable string
+func (c ErrCode) MarshalJSON() ([]byte, error) {
+	return []byte(fmt.Sprintf("\"%s\"", c)), nil
+}
+
+// UnmarshalJSON converts the human-readable string to an error code
+func (c *ErrCode) UnmarshalJSON(b []byte) error {
+	switch string(b) {
+	case "\"ok\"":
+		*c = ErrOK
+	case "\"canceled\"":
+		*c = ErrCanceled
+	case "\"unknown\"":
+		*c = ErrUnknown
+	case "\"invalid_argument\"":
+		*c = ErrInvalidArgument
+	case "\"deadline_exceeded\"":
+		*c = ErrDeadlineExceeded
+	case "\"not_found\"":
+		*c = ErrNotFound
+	case "\"already_exists\"":
+		*c = ErrAlreadyExists
+	case "\"permission_denied\"":
+		*c = ErrPermissionDenied
+	case "\"resource_exhausted\"":
+		*c = ErrResourceExhausted
+	case "\"failed_precondition\"":
+		*c = ErrFailedPrecondition
+	case "\"aborted\"":
+		*c = ErrAborted
+	case "\"out_of_range\"":
+		*c = ErrOutOfRange
+	case "\"unimplemented\"":
+		*c = ErrUnimplemented
+	case "\"internal\"":
+		*c = ErrInternal
+	case "\"unavailable\"":
+		*c = ErrUnavailable
+	case "\"data_loss\"":
+		*c = ErrDataLoss
+	case "\"unauthenticated\"":
+		*c = ErrUnauthenticated
+	default:
+		*c = ErrUnknown
+	}
+	return nil
+}
diff --git a/pkg/clientgen/testdata/goapp/expected_baseauth_javascript.js b/pkg/clientgen/testdata/goapp/expected_baseauth_javascript.js
new file mode 100644
index 0000000000..b524b02c2e
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_baseauth_javascript.js
@@ -0,0 +1,716 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * Local is the base URL for calling the Encore application's API.
+ */
+export const Local = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name) {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr) {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target = "prod", options = undefined) {
+        // Convert the old constructor parameters to a BaseURL object and a ClientOptions object
+        if (!target.startsWith("http://") && !target.startsWith("https://")) {
+            target = Environment(target)
+        }
+
+        if (typeof options === "string") {
+            options = { auth: options }
+        }
+
+        const base = new BaseClient(target, options ?? {})
+        this.svc = new svc.ServiceClient(base)
+    }
+}
+
+class SvcServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.DummyAPI = this.DummyAPI.bind(this)
+        this.Private = this.Private.bind(this)
+    }
+
+    /**
+     * DummyAPI is a dummy endpoint.
+     */
+    async DummyAPI(params) {
+        await this.baseClient.callTypedAPI("POST", `/svc.DummyAPI`, JSON.stringify(params))
+    }
+
+    /**
+     * Private is a basic auth endpoint.
+     */
+    async Private(params) {
+        await this.baseClient.callTypedAPI("POST", `/svc.Private`, JSON.stringify(params))
+    }
+}
+
+export const svc = {
+    ServiceClient: SvcServiceClient
+}
+
+
+function encodeQuery(parts) {
+    const pairs = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]])
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+function makeRecord(record) {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record
+}
+
+
+function encodeWebSocketHeaders(headers) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    hasUpdateHandlers = [];
+
+    constructor(url, headers) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers));
+        }
+
+        this.ws = new WebSocket(url, protocols);
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type, handler) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type, handler) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut {
+    constructor(url, headers) {
+        let responseResolver;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response() {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+
+const boundFetch = fetch.bind(this)
+
+class BaseClient {
+    constructor(baseURL, options) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-JS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {}
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+
+        // Setup an authentication data generator using the auth data token option
+        if (options.auth !== undefined) {
+            const auth = options.auth
+            if (typeof auth === "function") {
+                this.authGenerator = auth
+            } else {
+                this.authGenerator = () => auth
+            }
+        }
+
+    }
+
+    async getAuthData() {
+        let authData;
+
+        // If authorization data generator is present, call it and add the returned data to the request
+        if (this.authGenerator) {
+            const mayBePromise = this.authGenerator();
+            if (mayBePromise instanceof Promise) {
+                authData = await mayBePromise;
+            } else {
+                authData = mayBePromise;
+            }
+        }
+
+        if (authData) {
+            const data = {};
+
+            data.headers = {};
+            data.headers["Authorization"] = "Bearer " + authData;
+
+            return data;
+        }
+
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : '';
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    async callTypedAPI(method, path, body, params) {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    async callAPI(method, path, body, params) {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+function isAPIErrorResponse(err) {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code) {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    constructor(status, response) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if (Object.setPrototypeOf == undefined) {
+            this.__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if (Error.captureStackTrace !== undefined) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+
+        /**
+         * The HTTP status code associated with the error.
+         */
+        this.status = status
+
+        /**
+         * The Encore error code
+         */
+        this.code = response.code
+
+        /**
+         * The error details
+         */
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err) {
+    return err instanceof APIError;
+}
+
+export const ErrCode = {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK: "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled: "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown: "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument: "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded: "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound: "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists: "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied: "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted: "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition: "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted: "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange: "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented: "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal: "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable: "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss: "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated: "unauthenticated"
+}
diff --git a/pkg/clientgen/testdata/goapp/expected_baseauth_openapi.json b/pkg/clientgen/testdata/goapp/expected_baseauth_openapi.json
new file mode 100644
index 0000000000..3dee75d458
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_baseauth_openapi.json
@@ -0,0 +1,119 @@
+{
+  "components": {
+    "responses": {
+      "APIError": {
+        "content": {
+          "application/json": {
+            "schema": {
+              "externalDocs": {
+                "url": "https://pkg.go.dev/encore.dev/beta/errs#Error"
+              },
+              "properties": {
+                "code": {
+                  "description": "Error code",
+                  "example": "not_found",
+                  "externalDocs": {
+                    "url": "https://pkg.go.dev/encore.dev/beta/errs#ErrCode"
+                  },
+                  "type": "string"
+                },
+                "details": {
+                  "description": "Error details",
+                  "type": "object"
+                },
+                "message": {
+                  "description": "Error message",
+                  "type": "string"
+                }
+              },
+              "title": "APIError",
+              "type": "object"
+            }
+          }
+        },
+        "description": "Error response"
+      }
+    }
+  },
+  "info": {
+    "description": "Generated by encore",
+    "title": "API for app",
+    "version": "1",
+    "x-logo": {
+      "altText": "Encore logo",
+      "backgroundColor": "#EEEEE1",
+      "url": "https://encore.dev/assets/branding/logo/logo-black.png"
+    }
+  },
+  "openapi": "3.0.0",
+  "paths": {
+    "/svc.DummyAPI": {
+      "post": {
+        "operationId": "POST:svc.DummyAPI",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "Message": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "Message"
+                ],
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        },
+        "summary": "DummyAPI is a dummy endpoint.\n"
+      }
+    },
+    "/svc.Private": {
+      "post": {
+        "operationId": "POST:svc.Private",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "Message": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "Message"
+                ],
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        },
+        "summary": "Private is a basic auth endpoint.\n"
+      }
+    }
+  },
+  "servers": [
+    {
+      "description": "Encore local dev environment",
+      "url": "http://localhost:4000"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/pkg/clientgen/testdata/goapp/expected_baseauth_typescript.ts b/pkg/clientgen/testdata/goapp/expected_baseauth_typescript.ts
new file mode 100644
index 0000000000..54dccc817b
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_baseauth_typescript.ts
@@ -0,0 +1,816 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * @deprecated This constructor is deprecated, and you should move to using BaseURL with an Options object
+     */
+    constructor(target: string, token?: string)
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions)
+    constructor(target: string | BaseURL = "prod", options?: string | ClientOptions) {
+
+        // Convert the old constructor parameters to a BaseURL object and a ClientOptions object
+        if (!target.startsWith("http://") && !target.startsWith("https://")) {
+            target = Environment(target)
+        }
+
+        if (typeof options === "string") {
+            options = { auth: options }
+        }
+
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    /**
+     * Allows you to set the auth token to be used for each request
+     * either by passing in a static token string or by passing in a function
+     * which returns the auth token.
+     *
+     * These tokens will be sent as bearer tokens in the Authorization header.
+     */
+    auth?: string | AuthDataGenerator
+}
+
+export namespace svc {
+    export interface Request {
+        Message: string
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.DummyAPI = this.DummyAPI.bind(this)
+            this.Private = this.Private.bind(this)
+        }
+
+        /**
+         * DummyAPI is a dummy endpoint.
+         */
+        public async DummyAPI(params: Request): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/svc.DummyAPI`, JSON.stringify(params))
+        }
+
+        /**
+         * Private is a basic auth endpoint.
+         */
+        public async Private(params: Request): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/svc.Private`, JSON.stringify(params))
+        }
+    }
+}
+
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "method" | "body" | "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+// AuthDataGenerator is a function that returns a new instance of the authentication data required by this API
+export type AuthDataGenerator = () =>
+  | string
+  | Promise<string | undefined>
+  | undefined;
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+    readonly authGenerator?: AuthDataGenerator
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+
+        // Setup an authentication data generator using the auth data token option
+        if (options.auth !== undefined) {
+            const auth = options.auth
+            if (typeof auth === "function") {
+                this.authGenerator = auth
+            } else {
+                this.authGenerator = () => auth
+            }
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        let authData: string | undefined;
+
+        // If authorization data generator is present, call it and add the returned data to the request
+        if (this.authGenerator) {
+            const mayBePromise = this.authGenerator();
+            if (mayBePromise instanceof Promise) {
+                authData = await mayBePromise;
+            } else {
+                authData = mayBePromise;
+            }
+        }
+
+        if (authData) {
+            const data: CallParameters = {};
+
+            data.headers = {};
+            data.headers["Authorization"] = "Bearer " + authData;
+
+            return data;
+        }
+
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/goapp/expected_golang.go b/pkg/clientgen/testdata/goapp/expected_golang.go
new file mode 100644
index 0000000000..7fef498f3f
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_golang.go
@@ -0,0 +1,1079 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Client is an API client for the app Encore application.
+type Client struct {
+	Authentication AuthenticationClient
+	Products       ProductsClient
+	Svc            SvcClient
+}
+
+// BaseURL is the base URL for calling the Encore application's API.
+type BaseURL string
+
+const Local BaseURL = "http://localhost:4000"
+
+// Environment returns a BaseURL for calling the cloud environment with the given name.
+func Environment(name string) BaseURL {
+	return BaseURL(fmt.Sprintf("https://%s-app.encr.app", name))
+}
+
+// PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+func PreviewEnv(pr int) BaseURL {
+	return Environment(fmt.Sprintf("pr%d", pr))
+}
+
+// Option allows you to customise the baseClient used by the Client
+type Option = func(client *baseClient) error
+
+// New returns a Client for calling the public and authenticated APIs of your Encore application.
+// You can customize the behaviour of the client using the given Option functions, such as WithHTTPClient or WithAuthFunc.
+func New(target BaseURL, options ...Option) (*Client, error) {
+	// Parse the base URL where the Encore application is being hosted
+	baseURL, err := url.Parse(string(target))
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse base url: %w", err)
+	}
+
+	// Create a client with sensible defaults
+	base := &baseClient{
+		baseURL:    baseURL,
+		httpClient: http.DefaultClient,
+		userAgent:  "app-Generated-Go-Client (Encore/v0.0.0-develop)",
+	}
+
+	// Apply any given options
+	for _, option := range options {
+		if err := option(base); err != nil {
+			return nil, fmt.Errorf("unable to apply client option: %w", err)
+		}
+	}
+
+	return &Client{
+		Authentication: &authenticationClient{base},
+		Products:       &productsClient{base},
+		Svc:            &svcClient{base},
+	}, nil
+}
+
+// WithHTTPClient can be used to configure the underlying HTTP client used when making API calls.
+//
+// Defaults to http.DefaultClient
+func WithHTTPClient(client HTTPDoer) Option {
+	return func(base *baseClient) error {
+		base.httpClient = client
+		return nil
+	}
+}
+
+// WithAuth allows you to set the authentication data to be used with each request
+func WithAuth(auth AuthenticationAuthData) Option {
+	return func(base *baseClient) error {
+		base.authGenerator = func(_ context.Context) (AuthenticationAuthData, error) {
+			return auth, nil
+		}
+		return nil
+	}
+}
+
+// WithAuthFunc allows you to pass a function which is called for each request to return the authentication data to be used with each request
+func WithAuthFunc(authGenerator func(ctx context.Context) (AuthenticationAuthData, error)) Option {
+	return func(base *baseClient) error {
+		base.authGenerator = authGenerator
+		return nil
+	}
+}
+
+type AuthenticationAuthData struct {
+	APIKey string `header:"X-API-Key"`
+}
+
+// BarType docs
+type AuthenticationBarType struct {
+	Baz string // Baz docs
+}
+
+// FooType docs
+type AuthenticationFooType struct {
+	Moo string                // Moo docs
+	Bar AuthenticationBarType // Bar docs
+}
+
+type AuthenticationUser struct {
+	ID   int    `json:"id"`
+	Name string `json:"name"`
+}
+
+// AuthenticationClient Provides you access to call public and authenticated APIs on authentication. The concrete implementation is authenticationClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type AuthenticationClient interface {
+	Docs(ctx context.Context, params AuthenticationFooType) error
+}
+
+type authenticationClient struct {
+	base *baseClient
+}
+
+var _ AuthenticationClient = (*authenticationClient)(nil)
+
+func (c *authenticationClient) Docs(ctx context.Context, params AuthenticationFooType) error {
+	_, err := callAPI(ctx, c.base, "POST", "/authentication.Docs", nil, params, nil)
+	return err
+}
+
+type ProductsCreateProductRequest struct {
+	IdempotencyKey string `header:"Idempotency-Key"`
+	Name           string `json:"name"`
+	Description    string `json:"description,omitempty"`
+}
+
+type ProductsProduct struct {
+	ID          string              `json:"id"`
+	Name        string              `json:"name"`
+	Description string              `json:"description,omitempty"`
+	CreatedAt   time.Time           `json:"created_at"`
+	CreatedBy   *AuthenticationUser `json:"created_by"`
+}
+
+type ProductsProductListing struct {
+	Products     []*ProductsProduct `json:"products"`
+	PreviousPage struct {
+		Cursor string `json:"cursor,omitempty"`
+		Exists bool   `json:"exists"`
+	} `json:"previous"`
+	NextPage struct {
+		Cursor string `json:"cursor,omitempty"`
+		Exists bool   `json:"exists"`
+	} `json:"next"`
+}
+
+// ProductsClient Provides you access to call public and authenticated APIs on products. The concrete implementation is productsClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type ProductsClient interface {
+	Create(ctx context.Context, params ProductsCreateProductRequest) (ProductsProduct, error)
+	List(ctx context.Context) (ProductsProductListing, error)
+}
+
+type productsClient struct {
+	base *baseClient
+}
+
+var _ ProductsClient = (*productsClient)(nil)
+
+func (c *productsClient) Create(ctx context.Context, params ProductsCreateProductRequest) (resp ProductsProduct, err error) {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{"idempotency-key": {reqEncoder.FromString(params.IdempotencyKey)}}
+
+	if reqEncoder.LastError != nil {
+		err = fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+		return
+	}
+
+	// Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+	body := struct {
+		Name        string `json:"name"`
+		Description string `json:"description,omitempty"`
+	}{
+		Description: params.Description,
+		Name:        params.Name,
+	}
+
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/products.Create", headers, body, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *productsClient) List(ctx context.Context) (resp ProductsProductListing, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "GET", "/products.List", nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+type SvcAllInputTypes[A any] struct {
+	A    time.Time `header:"X-Alice"`               // Specify this comes from a header field
+	B    []int     `query:"Bob"`                    // Specify this comes from a query string
+	C    bool      `json:"Charlies-Bool,omitempty"` // This can come from anywhere, but if it comes from the payload in JSON it must be called Charile
+	Dave A         // This generic type complicates the whole thing 🙈
+}
+
+// DocumentedOrder represents a customer order with references
+type SvcDocumentedOrder struct {
+	Customer SvcDocumentedUser `json:"customer"` // Customer who placed this order (different from shipping recipient)
+	OrderID  string            `json:"order_id"`
+}
+
+// DocumentedUser represents a user in the system with profile information
+type SvcDocumentedUser struct {
+	Name  string `json:"name"`
+	Email string `json:"email"`
+}
+
+// Foo represents a documented integer type
+type SvcFoo = int
+
+type SvcGetRequest struct {
+	Baz int `qs:"boo"`
+}
+
+// HeaderOnlyStruct contains all types we support in headers
+type SvcHeaderOnlyStruct struct {
+	Boolean bool            `header:"x-boolean"`
+	Int     int             `header:"x-int"`
+	Float   float64         `header:"x-float"`
+	String  string          `header:"x-string"`
+	Bytes   []byte          `header:"x-bytes"`
+	Time    time.Time       `header:"x-time"`
+	Json    json.RawMessage `header:"x-json"`
+	UUID    string          `header:"x-uuid"`
+	UserID  string          `header:"x-user-id"`
+}
+
+type SvcRecursive struct {
+	Optional *SvcRecursive `encore:"optional"`
+	Slice    []SvcRecursive
+	Map      map[string]SvcRecursive
+}
+
+type SvcRequest struct {
+	Foo       SvcFoo `encore:"optional"` // Foo is good
+	Baz       string `json:"boo"`        // Baz is better
+	QueryFoo  bool   `encore:"optional" query:"foo"`
+	QueryBar  string `encore:"optional" query:"bar"`
+	HeaderBaz string `encore:"optional" header:"baz"`
+	HeaderInt int    `encore:"optional" header:"int"`
+
+	// This is a multiline
+	// comment on the raw message!
+	Raw json.RawMessage
+}
+
+// Tuple is a generic type which allows us to
+// return two values of two different types
+type SvcTuple[A any, B any] struct {
+	A A
+	B B
+}
+
+type SvcWithNested struct {
+	Nested *NestedType
+}
+
+type SvcWrappedRequest = SvcWrapper[SvcRequest]
+
+type SvcWrapper[T any] struct {
+	Value T
+}
+
+// SvcClient Provides you access to call public and authenticated APIs on svc. The concrete implementation is svcClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type SvcClient interface {
+	CreateDocumentedOrder(ctx context.Context, params SvcDocumentedOrder) (SvcDocumentedOrder, error)
+
+	// DummyAPI is a dummy endpoint.
+	DummyAPI(ctx context.Context, params SvcRequest) error
+	FallbackPath(ctx context.Context, a string, b []string) error
+	Get(ctx context.Context, params SvcGetRequest) error
+	GetRequestWithAllInputTypes(ctx context.Context, params SvcAllInputTypes[int]) (SvcHeaderOnlyStruct, error)
+	HeaderOnlyRequest(ctx context.Context, params SvcHeaderOnlyStruct) error
+	Nested(ctx context.Context, params SvcWithNested) (SvcWithNested, error)
+	RESTPath(ctx context.Context, a string, b int) error
+	Rec(ctx context.Context, params SvcRecursive) (SvcRecursive, error)
+	RequestWithAllInputTypes(ctx context.Context, params SvcAllInputTypes[string]) (SvcAllInputTypes[float64], error)
+
+	// TupleInputOutput tests the usage of generics in the client generator
+	// and this comment is also multiline, so multiline comments get tested as well.
+	TupleInputOutput(ctx context.Context, params SvcTuple[string, SvcWrappedRequest]) (SvcTuple[bool, SvcFoo], error)
+	Webhook(ctx context.Context, a string, b []string, request *http.Request) (*http.Response, error)
+	Webhook2(ctx context.Context, a string, b []string) error
+}
+
+type svcClient struct {
+	base *baseClient
+}
+
+var _ SvcClient = (*svcClient)(nil)
+
+func (c *svcClient) CreateDocumentedOrder(ctx context.Context, params SvcDocumentedOrder) (resp SvcDocumentedOrder, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/svc.CreateDocumentedOrder", nil, params, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// DummyAPI is a dummy endpoint.
+func (c *svcClient) DummyAPI(ctx context.Context, params SvcRequest) error {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{
+		"baz": {reqEncoder.FromString(params.HeaderBaz)},
+		"int": {reqEncoder.FromInt(params.HeaderInt)},
+	}
+
+	queryString := url.Values{
+		"bar": {reqEncoder.FromString(params.QueryBar)},
+		"foo": {reqEncoder.FromBool(params.QueryFoo)},
+	}
+
+	if reqEncoder.LastError != nil {
+		return fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+	}
+
+	// Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+	body := struct {
+		Foo SvcFoo          `json:"Foo"`
+		Baz string          `json:"boo"`
+		Raw json.RawMessage `json:"Raw"`
+	}{
+		Baz: params.Baz,
+		Foo: params.Foo,
+		Raw: params.Raw,
+	}
+
+	_, err := callAPI(ctx, c.base, "POST", fmt.Sprintf("/svc.DummyAPI?%s", queryString.Encode()), headers, body, nil)
+	return err
+}
+
+func (c *svcClient) FallbackPath(ctx context.Context, a string, b []string) error {
+	_, err := callAPI(ctx, c.base, "POST", fmt.Sprintf("/fallbackPath/%s/%s", url.PathEscape(a), pathEscapeSlice(b)), nil, nil, nil)
+	return err
+}
+
+func (c *svcClient) Get(ctx context.Context, params SvcGetRequest) error {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	queryString := url.Values{"boo": {reqEncoder.FromInt(params.Baz)}}
+
+	if reqEncoder.LastError != nil {
+		return fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+	}
+
+	_, err := callAPI(ctx, c.base, "GET", fmt.Sprintf("/svc.Get?%s", queryString.Encode()), nil, nil, nil)
+	return err
+}
+
+func (c *svcClient) GetRequestWithAllInputTypes(ctx context.Context, params SvcAllInputTypes[int]) (resp SvcHeaderOnlyStruct, err error) {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{"x-alice": {reqEncoder.FromTime(params.A)}}
+
+	queryString := url.Values{
+		"Bob":  reqEncoder.FromIntList(params.B),
+		"c":    {reqEncoder.FromBool(params.C)},
+		"dave": {reqEncoder.FromInt(params.Dave)},
+	}
+
+	if reqEncoder.LastError != nil {
+		err = fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+		return
+	}
+
+	// Now make the actual call to the API
+	var respHeaders http.Header
+	respHeaders, err = callAPI(ctx, c.base, "GET", fmt.Sprintf("/svc.GetRequestWithAllInputTypes?%s", queryString.Encode()), headers, nil, nil)
+	if err != nil {
+		return
+	}
+
+	// Copy the unmarshalled response body into our response struct
+	respDecoder := &serde{}
+
+	resp.Boolean = respDecoder.ToBool("Boolean", respHeaders.Get("x-boolean"), true)
+	resp.Int = respDecoder.ToInt("Int", respHeaders.Get("x-int"), true)
+	resp.Float = respDecoder.ToFloat64("Float", respHeaders.Get("x-float"), true)
+	resp.String = respDecoder.ToString("String", respHeaders.Get("x-string"), true)
+	resp.Bytes = respDecoder.ToBytes("Bytes", respHeaders.Get("x-bytes"), true)
+	resp.Time = respDecoder.ToTime("Time", respHeaders.Get("x-time"), true)
+	resp.Json = respDecoder.ToJSON("Json", respHeaders.Get("x-json"), true)
+	resp.UUID = respDecoder.ToString("UUID", respHeaders.Get("x-uuid"), true)
+	resp.UserID = respDecoder.ToString("UserID", respHeaders.Get("x-user-id"), true)
+
+	if respDecoder.LastError != nil {
+		err = fmt.Errorf("unable to unmarshal headers: %w", respDecoder.LastError)
+		return
+	}
+
+	return
+}
+
+func (c *svcClient) HeaderOnlyRequest(ctx context.Context, params SvcHeaderOnlyStruct) error {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{
+		"x-boolean": {reqEncoder.FromBool(params.Boolean)},
+		"x-bytes":   {reqEncoder.FromBytes(params.Bytes)},
+		"x-float":   {reqEncoder.FromFloat64(params.Float)},
+		"x-int":     {reqEncoder.FromInt(params.Int)},
+		"x-json":    {reqEncoder.FromJSON(params.Json)},
+		"x-string":  {reqEncoder.FromString(params.String)},
+		"x-time":    {reqEncoder.FromTime(params.Time)},
+		"x-user-id": {reqEncoder.FromString(params.UserID)},
+		"x-uuid":    {reqEncoder.FromString(params.UUID)},
+	}
+
+	if reqEncoder.LastError != nil {
+		return fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+	}
+
+	_, err := callAPI(ctx, c.base, "GET", "/svc.HeaderOnlyRequest", headers, nil, nil)
+	return err
+}
+
+func (c *svcClient) Nested(ctx context.Context, params SvcWithNested) (resp SvcWithNested, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/svc.Nested", nil, params, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *svcClient) RESTPath(ctx context.Context, a string, b int) error {
+	_, err := callAPI(ctx, c.base, "POST", fmt.Sprintf("/path/%s/%d", url.PathEscape(a), b), nil, nil, nil)
+	return err
+}
+
+func (c *svcClient) Rec(ctx context.Context, params SvcRecursive) (resp SvcRecursive, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/svc.Rec", nil, params, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *svcClient) RequestWithAllInputTypes(ctx context.Context, params SvcAllInputTypes[string]) (resp SvcAllInputTypes[float64], err error) {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{"x-alice": {reqEncoder.FromTime(params.A)}}
+
+	queryString := url.Values{"Bob": reqEncoder.FromIntList(params.B)}
+
+	if reqEncoder.LastError != nil {
+		err = fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+		return
+	}
+
+	// Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+	body := struct {
+		C    bool   `json:"Charlies-Bool,omitempty"`
+		Dave string `json:"Dave"`
+	}{
+		C:    params.C,
+		Dave: params.Dave,
+	}
+
+	// We only want the response body to marshal into these fields and none of the header fields,
+	// so we'll construct a new struct with only those fields.
+	respBody := struct {
+		B    []int   `json:"B"`
+		C    bool    `json:"Charlies-Bool,omitempty"`
+		Dave float64 `json:"Dave"`
+	}{}
+
+	// Now make the actual call to the API
+	var respHeaders http.Header
+	respHeaders, err = callAPI(ctx, c.base, "POST", fmt.Sprintf("/svc.RequestWithAllInputTypes?%s", queryString.Encode()), headers, body, &respBody)
+	if err != nil {
+		return
+	}
+
+	// Copy the unmarshalled response body into our response struct
+	respDecoder := &serde{}
+
+	resp.A = respDecoder.ToTime("A", respHeaders.Get("x-alice"), true)
+	resp.B = respBody.B
+	resp.C = respBody.C
+	resp.Dave = respBody.Dave
+
+	if respDecoder.LastError != nil {
+		err = fmt.Errorf("unable to unmarshal headers: %w", respDecoder.LastError)
+		return
+	}
+
+	return
+}
+
+// TupleInputOutput tests the usage of generics in the client generator
+// and this comment is also multiline, so multiline comments get tested as well.
+func (c *svcClient) TupleInputOutput(ctx context.Context, params SvcTuple[string, SvcWrappedRequest]) (resp SvcTuple[bool, SvcFoo], err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/svc.TupleInputOutput", nil, params, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *svcClient) Webhook(ctx context.Context, a string, b []string, request *http.Request) (*http.Response, error) {
+	request = request.WithContext(ctx)
+
+	// Check the request has the method set, as we can't guess what method is required
+	if request.Method == "" {
+		return nil, errors.New("request.Method must be set")
+	}
+
+	// Set the relative URL for the API call
+	path, err := url.Parse(fmt.Sprintf("/webhook/%s/%s", url.PathEscape(a), pathEscapeSlice(b)))
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse api url: %w", err)
+	}
+	if request.URL != nil {
+		// If the request already has a URL associated, we'll keep any fields set inside it, and just override the schema,
+		// host and path to ensure the final URL which hit the right BaseURL
+		request.URL.Scheme = path.Scheme
+		request.URL.Host = path.Host
+		request.URL.Path = path.Path
+	} else {
+		request.URL = path
+	}
+
+	return c.base.Do(request)
+}
+
+func (c *svcClient) Webhook2(ctx context.Context, a string, b []string) error {
+	_, err := callAPI(ctx, c.base, "POST", fmt.Sprintf("/webhook2/%s/%s", url.PathEscape(a), pathEscapeSlice(b)), nil, nil, nil)
+	return err
+}
+
+type NestedType struct {
+	Message string
+}
+
+// HTTPDoer is an interface which can be used to swap out the default
+// HTTP client (http.DefaultClient) with your own custom implementation.
+// This can be used to inject middleware or mock responses during unit tests.
+type HTTPDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// baseClient holds all the information we need to make requests to an Encore application
+type baseClient struct {
+	authGenerator func(ctx context.Context) (AuthenticationAuthData, error) // The function which will add the authentication data to the requests
+	httpClient    HTTPDoer                                                  // The HTTP client which will be used for all API requests
+	baseURL       *url.URL                                                  // The base URL which API requests will be made against
+	userAgent     string                                                    // What user agent we will use in the API requests
+}
+
+// Do sends the req to the Encore application adding the authorization token as required.
+func (b *baseClient) Do(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", b.userAgent)
+
+	// If a authorization data generator is present, call it and add the returned token to the request
+	if b.authGenerator != nil {
+		if authData, err := b.authGenerator(req.Context()); err != nil {
+			return nil, fmt.Errorf("unable to create authorization token for api request: %w", err)
+		} else {
+			authEncoder := &serde{}
+
+			// Add the auth fields to the headers
+			req.Header.Set("x-api-key", authEncoder.FromString(authData.APIKey))
+
+			if authEncoder.LastError != nil {
+				return nil, fmt.Errorf("unable to marshal authentication data: %w", authEncoder.LastError)
+			}
+
+		}
+	}
+
+	// Merge the base URL and the API URL
+	req.URL = b.baseURL.ResolveReference(req.URL)
+	req.Host = req.URL.Host
+
+	// Finally, make the request via the configured HTTP Client
+	return b.httpClient.Do(req)
+}
+
+// callAPI is used by each generated API method to actually make request and decode the responses
+func callAPI(ctx context.Context, client *baseClient, method, path string, headers http.Header, body, resp any) (http.Header, error) {
+	// Encode the API body
+	var bodyReader io.Reader
+	if body != nil {
+		bodyBytes, err := json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("marshal request: %w", err)
+		}
+		bodyReader = bytes.NewReader(bodyBytes)
+	}
+
+	// Create the request
+	req, err := http.NewRequestWithContext(ctx, method, path, bodyReader)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	// Add any headers to the request
+	for header, values := range headers {
+		for _, value := range values {
+			req.Header.Add(header, value)
+		}
+	}
+
+	// Make the request via the base client
+	rawResponse, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer func() {
+		_ = rawResponse.Body.Close()
+	}()
+	if rawResponse.StatusCode >= 400 {
+		// Read the full body sent back
+		body, err := io.ReadAll(rawResponse.Body)
+		if err != nil {
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response without readable body: %s", rawResponse.Status),
+			}
+		}
+
+		// Attempt to decode the error response as a structured APIError
+		apiError := &APIError{}
+		if err := json.Unmarshal(body, apiError); err != nil {
+			// If the error is not a parsable as an APIError, then return an error with the raw body
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response: %s", string(body)),
+			}
+		}
+		return nil, apiError
+	}
+
+	// Decode the response
+	if resp != nil {
+		if err := json.NewDecoder(rawResponse.Body).Decode(resp); err != nil {
+			return nil, fmt.Errorf("decode response: %w", err)
+		}
+	}
+	return rawResponse.Header, nil
+}
+
+// pathEscapeSlice escapes a slice of strings and then joins them into a single string
+func pathEscapeSlice(paths []string) string {
+	var escapedPaths strings.Builder
+	for i, path := range paths {
+		if i > 0 {
+			escapedPaths.WriteString("/")
+		}
+		escapedPaths.WriteString(url.PathEscape(path))
+	}
+	return escapedPaths.String()
+}
+
+// APIError is the error type returned by the API
+type APIError struct {
+	Code    ErrCode `json:"code"`
+	Message string  `json:"message"`
+	Details any     `json:"details"`
+}
+
+func (e *APIError) Error() string {
+	return fmt.Sprintf("%s: %s", e.Code, e.Message)
+}
+
+type ErrCode int
+
+const (
+	// ErrOK indicates the operation was successful.
+	ErrOK ErrCode = 0
+
+	// ErrCanceled indicates the operation was canceled (typically by the caller).
+	//
+	// Encore will generate this error code when cancellation is requested.
+	ErrCanceled ErrCode = 1
+
+	// ErrUnknown error. An example of where this error may be returned is
+	// if a Status value received from another address space belongs to
+	// an error-space that is not known in this address space. Also
+	// errors raised by APIs that do not return enough error information
+	// may be converted to this error.
+	//
+	// Encore will generate this error code in the above two mentioned cases.
+	ErrUnknown ErrCode = 2
+
+	// ErrInvalidArgument indicates client specified an invalid argument.
+	// Note that this differs from FailedPrecondition. It indicates arguments
+	// that are problematic regardless of the state of the system
+	// (e.g., a malformed file name).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInvalidArgument ErrCode = 3
+
+	// ErrDeadlineExceeded means operation expired before completion.
+	// For operations that change the state of the system, this error may be
+	// returned even if the operation has completed successfully. For
+	// example, a successful response from a server could have been delayed
+	// long enough for the deadline to expire.
+	//
+	// The gRPC framework will generate this error code when the deadline is
+	// exceeded.
+	ErrDeadlineExceeded ErrCode = 4
+
+	// ErrNotFound means some requested entity (e.g., file or directory) was
+	// not found.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrNotFound ErrCode = 5
+
+	// ErrAlreadyExists means an attempt to create an entity failed because one
+	// already exists.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrAlreadyExists ErrCode = 6
+
+	// ErrPermissionDenied indicates the caller does not have permission to
+	// execute the specified operation. It must not be used for rejections
+	// caused by exhausting some resource (use ResourceExhausted
+	// instead for those errors). It must not be
+	// used if the caller cannot be identified (use Unauthenticated
+	// instead for those errors).
+	//
+	// This error code will not be generated by the gRPC core framework,
+	// but expect authentication middleware to use it.
+	ErrPermissionDenied ErrCode = 7
+
+	// ErrResourceExhausted indicates some resource has been exhausted, perhaps
+	// a per-user quota, or perhaps the entire file system is out of space.
+	//
+	// This error code will be generated by the gRPC framework in
+	// out-of-memory and server overload situations, or when a message is
+	// larger than the configured maximum size.
+	ErrResourceExhausted ErrCode = 8
+
+	// ErrFailedPrecondition indicates operation was rejected because the
+	// system is not in a state required for the operation's execution.
+	// For example, directory to be deleted may be non-empty, an rmdir
+	// operation is applied to a non-directory, etc.
+	//
+	// A litmus test that may help a service implementor in deciding
+	// between FailedPrecondition, Aborted, and Unavailable:
+	//
+	//	(a) Use Unavailable if the client can retry just the failing call.
+	//	(b) Use Aborted if the client should retry at a higher-level
+	//	    (e.g., restarting a read-modify-write sequence).
+	//	(c) Use FailedPrecondition if the client should not retry until
+	//	    the system state has been explicitly fixed. E.g., if an "rmdir"
+	//	    fails because the directory is non-empty, FailedPrecondition
+	//	    should be returned since the client should not retry unless
+	//	    they have first fixed up the directory by deleting files from it.
+	//	(d) Use FailedPrecondition if the client performs conditional
+	//	    REST Get/Update/Delete on a resource and the resource on the
+	//	    server does not match the condition. E.g., conflicting
+	//	    read-modify-write on the same resource.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrFailedPrecondition ErrCode = 9
+
+	// ErrAborted indicates the operation was aborted, typically due to a
+	// concurrency issue like sequencer check failures, transaction aborts,
+	// etc.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// ErrAborted, and Unavailable.
+	ErrAborted ErrCode = 10
+
+	// ErrOutOfRange means operation was attempted past the valid range.
+	// E.g., seeking or reading past end of file.
+	//
+	// Unlike InvalidArgument, this error indicates a problem that may
+	// be fixed if the system state changes. For example, a 32-bit file
+	// may be rotated to a 64-bit file without error.
+	//
+	// There is a fair bit of overlap between FailedPrecondition and
+	// ErrOutOfRange. We recommend using OutOfRange (the more specific
+	// error) when it applies so that callers who are iterating through
+	// a space can easily look for an OutOfRange error to detect when
+	// they are done.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrOutOfRange ErrCode = 11
+
+	// ErrUnimplemented indicates operation is not implemented or not
+	// supported/enabled in this service.
+	//
+	// This is not an error, but a feature not available.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrUnimplemented ErrCode = 12
+
+	// ErrInternal means some invariant expected by the underlying system has
+	// been broken. This is not a per-message error, it is a global
+	// conditions check.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInternal ErrCode = 13
+
+	// ErrUnavailable indicates the service is currently unavailable.
+	// This is most likely a transient condition, which can be corrected by
+	// retrying with a backoff.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	ErrUnavailable ErrCode = 14
+
+	// ErrDataLoss indicates unrecoverable data loss or corruption.
+	//
+	// This error code is only defined in the gRPC library, and only for
+	// unrecoverable data loss (i.e., data loss resulting from errors
+	// like hard disk corruption or bandwidth exceeded).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrDataLoss ErrCode = 15
+
+	// ErrUnauthenticated indicates the request does not have valid
+	// authentication credentials for the operation.
+	//
+	// The gRPC framework will generate this error code when the
+	// authentication metadata is invalid or a Credentials callback fails,
+	// but also expect authentication middleware to generate it.
+	ErrUnauthenticated ErrCode = 16
+)
+
+// String returns the string representation of the error code
+func (c ErrCode) String() string {
+	switch c {
+	case ErrOK:
+		return "ok"
+	case ErrCanceled:
+		return "canceled"
+	case ErrUnknown:
+		return "unknown"
+	case ErrInvalidArgument:
+		return "invalid_argument"
+	case ErrDeadlineExceeded:
+		return "deadline_exceeded"
+	case ErrNotFound:
+		return "not_found"
+	case ErrAlreadyExists:
+		return "already_exists"
+	case ErrPermissionDenied:
+		return "permission_denied"
+	case ErrResourceExhausted:
+		return "resource_exhausted"
+	case ErrFailedPrecondition:
+		return "failed_precondition"
+	case ErrAborted:
+		return "aborted"
+	case ErrOutOfRange:
+		return "out_of_range"
+	case ErrUnimplemented:
+		return "unimplemented"
+	case ErrInternal:
+		return "internal"
+	case ErrUnavailable:
+		return "unavailable"
+	case ErrDataLoss:
+		return "data_loss"
+	case ErrUnauthenticated:
+		return "unauthenticated"
+	default:
+		return "unknown"
+	}
+}
+
+// MarshalJSON converts the error code to a human-readable string
+func (c ErrCode) MarshalJSON() ([]byte, error) {
+	return []byte(fmt.Sprintf("\"%s\"", c)), nil
+}
+
+// UnmarshalJSON converts the human-readable string to an error code
+func (c *ErrCode) UnmarshalJSON(b []byte) error {
+	switch string(b) {
+	case "\"ok\"":
+		*c = ErrOK
+	case "\"canceled\"":
+		*c = ErrCanceled
+	case "\"unknown\"":
+		*c = ErrUnknown
+	case "\"invalid_argument\"":
+		*c = ErrInvalidArgument
+	case "\"deadline_exceeded\"":
+		*c = ErrDeadlineExceeded
+	case "\"not_found\"":
+		*c = ErrNotFound
+	case "\"already_exists\"":
+		*c = ErrAlreadyExists
+	case "\"permission_denied\"":
+		*c = ErrPermissionDenied
+	case "\"resource_exhausted\"":
+		*c = ErrResourceExhausted
+	case "\"failed_precondition\"":
+		*c = ErrFailedPrecondition
+	case "\"aborted\"":
+		*c = ErrAborted
+	case "\"out_of_range\"":
+		*c = ErrOutOfRange
+	case "\"unimplemented\"":
+		*c = ErrUnimplemented
+	case "\"internal\"":
+		*c = ErrInternal
+	case "\"unavailable\"":
+		*c = ErrUnavailable
+	case "\"data_loss\"":
+		*c = ErrDataLoss
+	case "\"unauthenticated\"":
+		*c = ErrUnauthenticated
+	default:
+		*c = ErrUnknown
+	}
+	return nil
+}
+
+// serde is used to serialize request data into strings and deserialize response data from strings
+type serde struct {
+	LastError      error // The last error that occurred
+	NonEmptyValues int   // The number of values this decoder has decoded
+}
+
+func (e *serde) FromString(s string) (v string) {
+	e.NonEmptyValues++
+	return s
+}
+
+func (e *serde) FromInt(s int) (v string) {
+	e.NonEmptyValues++
+	return strconv.FormatInt(int64(s), 10)
+}
+
+func (e *serde) FromBool(s bool) (v string) {
+	e.NonEmptyValues++
+	return strconv.FormatBool(s)
+}
+
+func (e *serde) FromTime(s time.Time) (v string) {
+	e.NonEmptyValues++
+	return s.Format(time.RFC3339)
+}
+
+func (e *serde) FromIntList(s []int) (v []string) {
+	e.NonEmptyValues++
+	for _, x := range s {
+		v = append(v, e.FromInt(x))
+	}
+	return v
+}
+
+func (e *serde) ToBool(field string, s string, required bool) (v bool) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	v, err := strconv.ParseBool(s)
+	e.setErr("invalid parameter", field, err)
+	return v
+}
+
+func (e *serde) ToInt(field string, s string, required bool) (v int) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	x, err := strconv.ParseInt(s, 10, 64)
+	e.setErr("invalid parameter", field, err)
+	return int(x)
+}
+
+func (e *serde) ToFloat64(field string, s string, required bool) (v float64) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	x, err := strconv.ParseFloat(s, 64)
+	e.setErr("invalid parameter", field, err)
+	return x
+}
+
+func (e *serde) ToString(field string, s string, required bool) (v string) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	return s
+}
+
+func (e *serde) ToBytes(field string, s string, required bool) (v []byte) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	v, err := base64.URLEncoding.DecodeString(s)
+	e.setErr("invalid parameter", field, err)
+	return v
+}
+
+func (e *serde) ToTime(field string, s string, required bool) (v time.Time) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	v, err := time.Parse(time.RFC3339, s)
+	e.setErr("invalid parameter", field, err)
+	return v
+}
+
+func (e *serde) ToJSON(field string, s string, required bool) (v json.RawMessage) {
+	if !required && s == "" {
+		return
+	}
+	e.NonEmptyValues++
+	return json.RawMessage(s)
+}
+
+func (e *serde) FromFloat64(s float64) (v string) {
+	e.NonEmptyValues++
+	return strconv.FormatFloat(s, uint8(0x66), -1, 64)
+}
+
+func (e *serde) FromBytes(s []byte) (v string) {
+	e.NonEmptyValues++
+	return base64.URLEncoding.EncodeToString(s)
+}
+
+func (e *serde) FromJSON(s json.RawMessage) (v string) {
+	e.NonEmptyValues++
+	return string(s)
+}
+
+// setErr sets the last error within the object if one is not already set
+func (e *serde) setErr(msg, field string, err error) {
+	if err != nil && e.LastError == nil {
+		e.LastError = fmt.Errorf("%s: %s: %w", field, msg, err)
+	}
+}
diff --git a/pkg/clientgen/testdata/goapp/expected_httpstatus_golang.go b/pkg/clientgen/testdata/goapp/expected_httpstatus_golang.go
new file mode 100644
index 0000000000..1055c570ac
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_httpstatus_golang.go
@@ -0,0 +1,450 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+)
+
+// Client is an API client for the app Encore application.
+type Client struct {
+	Svc SvcClient
+}
+
+// BaseURL is the base URL for calling the Encore application's API.
+type BaseURL string
+
+const Local BaseURL = "http://localhost:4000"
+
+// Environment returns a BaseURL for calling the cloud environment with the given name.
+func Environment(name string) BaseURL {
+	return BaseURL(fmt.Sprintf("https://%s-app.encr.app", name))
+}
+
+// PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+func PreviewEnv(pr int) BaseURL {
+	return Environment(fmt.Sprintf("pr%d", pr))
+}
+
+// Option allows you to customise the baseClient used by the Client
+type Option = func(client *baseClient) error
+
+// New returns a Client for calling the public and authenticated APIs of your Encore application.
+// You can customize the behaviour of the client using the given Option functions, such as WithHTTPClient or WithAuthFunc.
+func New(target BaseURL, options ...Option) (*Client, error) {
+	// Parse the base URL where the Encore application is being hosted
+	baseURL, err := url.Parse(string(target))
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse base url: %w", err)
+	}
+
+	// Create a client with sensible defaults
+	base := &baseClient{
+		baseURL:    baseURL,
+		httpClient: http.DefaultClient,
+		userAgent:  "app-Generated-Go-Client (Encore/v0.0.0-develop)",
+	}
+
+	// Apply any given options
+	for _, option := range options {
+		if err := option(base); err != nil {
+			return nil, fmt.Errorf("unable to apply client option: %w", err)
+		}
+	}
+
+	return &Client{Svc: &svcClient{base}}, nil
+}
+
+// WithHTTPClient can be used to configure the underlying HTTP client used when making API calls.
+//
+// Defaults to http.DefaultClient
+func WithHTTPClient(client HTTPDoer) Option {
+	return func(base *baseClient) error {
+		base.httpClient = client
+		return nil
+	}
+}
+
+type SvcResponse struct {
+	Message string
+}
+
+// SvcClient Provides you access to call public and authenticated APIs on svc. The concrete implementation is svcClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type SvcClient interface {
+	// DummyAPI is a dummy endpoint.
+	DummyAPI(ctx context.Context) (SvcResponse, error)
+}
+
+type svcClient struct {
+	base *baseClient
+}
+
+var _ SvcClient = (*svcClient)(nil)
+
+// DummyAPI is a dummy endpoint.
+func (c *svcClient) DummyAPI(ctx context.Context) (resp SvcResponse, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/svc.DummyAPI", nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// HTTPDoer is an interface which can be used to swap out the default
+// HTTP client (http.DefaultClient) with your own custom implementation.
+// This can be used to inject middleware or mock responses during unit tests.
+type HTTPDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// baseClient holds all the information we need to make requests to an Encore application
+type baseClient struct {
+	httpClient HTTPDoer // The HTTP client which will be used for all API requests
+	baseURL    *url.URL // The base URL which API requests will be made against
+	userAgent  string   // What user agent we will use in the API requests
+}
+
+// Do sends the req to the Encore application adding the authorization token as required.
+func (b *baseClient) Do(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", b.userAgent)
+
+	// Merge the base URL and the API URL
+	req.URL = b.baseURL.ResolveReference(req.URL)
+	req.Host = req.URL.Host
+
+	// Finally, make the request via the configured HTTP Client
+	return b.httpClient.Do(req)
+}
+
+// callAPI is used by each generated API method to actually make request and decode the responses
+func callAPI(ctx context.Context, client *baseClient, method, path string, headers http.Header, body, resp any) (http.Header, error) {
+	// Encode the API body
+	var bodyReader io.Reader
+	if body != nil {
+		bodyBytes, err := json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("marshal request: %w", err)
+		}
+		bodyReader = bytes.NewReader(bodyBytes)
+	}
+
+	// Create the request
+	req, err := http.NewRequestWithContext(ctx, method, path, bodyReader)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	// Add any headers to the request
+	for header, values := range headers {
+		for _, value := range values {
+			req.Header.Add(header, value)
+		}
+	}
+
+	// Make the request via the base client
+	rawResponse, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer func() {
+		_ = rawResponse.Body.Close()
+	}()
+	if rawResponse.StatusCode >= 400 {
+		// Read the full body sent back
+		body, err := io.ReadAll(rawResponse.Body)
+		if err != nil {
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response without readable body: %s", rawResponse.Status),
+			}
+		}
+
+		// Attempt to decode the error response as a structured APIError
+		apiError := &APIError{}
+		if err := json.Unmarshal(body, apiError); err != nil {
+			// If the error is not a parsable as an APIError, then return an error with the raw body
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response: %s", string(body)),
+			}
+		}
+		return nil, apiError
+	}
+
+	// Decode the response
+	if resp != nil {
+		if err := json.NewDecoder(rawResponse.Body).Decode(resp); err != nil {
+			return nil, fmt.Errorf("decode response: %w", err)
+		}
+	}
+	return rawResponse.Header, nil
+}
+
+// APIError is the error type returned by the API
+type APIError struct {
+	Code    ErrCode `json:"code"`
+	Message string  `json:"message"`
+	Details any     `json:"details"`
+}
+
+func (e *APIError) Error() string {
+	return fmt.Sprintf("%s: %s", e.Code, e.Message)
+}
+
+type ErrCode int
+
+const (
+	// ErrOK indicates the operation was successful.
+	ErrOK ErrCode = 0
+
+	// ErrCanceled indicates the operation was canceled (typically by the caller).
+	//
+	// Encore will generate this error code when cancellation is requested.
+	ErrCanceled ErrCode = 1
+
+	// ErrUnknown error. An example of where this error may be returned is
+	// if a Status value received from another address space belongs to
+	// an error-space that is not known in this address space. Also
+	// errors raised by APIs that do not return enough error information
+	// may be converted to this error.
+	//
+	// Encore will generate this error code in the above two mentioned cases.
+	ErrUnknown ErrCode = 2
+
+	// ErrInvalidArgument indicates client specified an invalid argument.
+	// Note that this differs from FailedPrecondition. It indicates arguments
+	// that are problematic regardless of the state of the system
+	// (e.g., a malformed file name).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInvalidArgument ErrCode = 3
+
+	// ErrDeadlineExceeded means operation expired before completion.
+	// For operations that change the state of the system, this error may be
+	// returned even if the operation has completed successfully. For
+	// example, a successful response from a server could have been delayed
+	// long enough for the deadline to expire.
+	//
+	// The gRPC framework will generate this error code when the deadline is
+	// exceeded.
+	ErrDeadlineExceeded ErrCode = 4
+
+	// ErrNotFound means some requested entity (e.g., file or directory) was
+	// not found.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrNotFound ErrCode = 5
+
+	// ErrAlreadyExists means an attempt to create an entity failed because one
+	// already exists.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrAlreadyExists ErrCode = 6
+
+	// ErrPermissionDenied indicates the caller does not have permission to
+	// execute the specified operation. It must not be used for rejections
+	// caused by exhausting some resource (use ResourceExhausted
+	// instead for those errors). It must not be
+	// used if the caller cannot be identified (use Unauthenticated
+	// instead for those errors).
+	//
+	// This error code will not be generated by the gRPC core framework,
+	// but expect authentication middleware to use it.
+	ErrPermissionDenied ErrCode = 7
+
+	// ErrResourceExhausted indicates some resource has been exhausted, perhaps
+	// a per-user quota, or perhaps the entire file system is out of space.
+	//
+	// This error code will be generated by the gRPC framework in
+	// out-of-memory and server overload situations, or when a message is
+	// larger than the configured maximum size.
+	ErrResourceExhausted ErrCode = 8
+
+	// ErrFailedPrecondition indicates operation was rejected because the
+	// system is not in a state required for the operation's execution.
+	// For example, directory to be deleted may be non-empty, an rmdir
+	// operation is applied to a non-directory, etc.
+	//
+	// A litmus test that may help a service implementor in deciding
+	// between FailedPrecondition, Aborted, and Unavailable:
+	//
+	//	(a) Use Unavailable if the client can retry just the failing call.
+	//	(b) Use Aborted if the client should retry at a higher-level
+	//	    (e.g., restarting a read-modify-write sequence).
+	//	(c) Use FailedPrecondition if the client should not retry until
+	//	    the system state has been explicitly fixed. E.g., if an "rmdir"
+	//	    fails because the directory is non-empty, FailedPrecondition
+	//	    should be returned since the client should not retry unless
+	//	    they have first fixed up the directory by deleting files from it.
+	//	(d) Use FailedPrecondition if the client performs conditional
+	//	    REST Get/Update/Delete on a resource and the resource on the
+	//	    server does not match the condition. E.g., conflicting
+	//	    read-modify-write on the same resource.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrFailedPrecondition ErrCode = 9
+
+	// ErrAborted indicates the operation was aborted, typically due to a
+	// concurrency issue like sequencer check failures, transaction aborts,
+	// etc.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// ErrAborted, and Unavailable.
+	ErrAborted ErrCode = 10
+
+	// ErrOutOfRange means operation was attempted past the valid range.
+	// E.g., seeking or reading past end of file.
+	//
+	// Unlike InvalidArgument, this error indicates a problem that may
+	// be fixed if the system state changes. For example, a 32-bit file
+	// may be rotated to a 64-bit file without error.
+	//
+	// There is a fair bit of overlap between FailedPrecondition and
+	// ErrOutOfRange. We recommend using OutOfRange (the more specific
+	// error) when it applies so that callers who are iterating through
+	// a space can easily look for an OutOfRange error to detect when
+	// they are done.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrOutOfRange ErrCode = 11
+
+	// ErrUnimplemented indicates operation is not implemented or not
+	// supported/enabled in this service.
+	//
+	// This is not an error, but a feature not available.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrUnimplemented ErrCode = 12
+
+	// ErrInternal means some invariant expected by the underlying system has
+	// been broken. This is not a per-message error, it is a global
+	// conditions check.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInternal ErrCode = 13
+
+	// ErrUnavailable indicates the service is currently unavailable.
+	// This is most likely a transient condition, which can be corrected by
+	// retrying with a backoff.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	ErrUnavailable ErrCode = 14
+
+	// ErrDataLoss indicates unrecoverable data loss or corruption.
+	//
+	// This error code is only defined in the gRPC library, and only for
+	// unrecoverable data loss (i.e., data loss resulting from errors
+	// like hard disk corruption or bandwidth exceeded).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrDataLoss ErrCode = 15
+
+	// ErrUnauthenticated indicates the request does not have valid
+	// authentication credentials for the operation.
+	//
+	// The gRPC framework will generate this error code when the
+	// authentication metadata is invalid or a Credentials callback fails,
+	// but also expect authentication middleware to generate it.
+	ErrUnauthenticated ErrCode = 16
+)
+
+// String returns the string representation of the error code
+func (c ErrCode) String() string {
+	switch c {
+	case ErrOK:
+		return "ok"
+	case ErrCanceled:
+		return "canceled"
+	case ErrUnknown:
+		return "unknown"
+	case ErrInvalidArgument:
+		return "invalid_argument"
+	case ErrDeadlineExceeded:
+		return "deadline_exceeded"
+	case ErrNotFound:
+		return "not_found"
+	case ErrAlreadyExists:
+		return "already_exists"
+	case ErrPermissionDenied:
+		return "permission_denied"
+	case ErrResourceExhausted:
+		return "resource_exhausted"
+	case ErrFailedPrecondition:
+		return "failed_precondition"
+	case ErrAborted:
+		return "aborted"
+	case ErrOutOfRange:
+		return "out_of_range"
+	case ErrUnimplemented:
+		return "unimplemented"
+	case ErrInternal:
+		return "internal"
+	case ErrUnavailable:
+		return "unavailable"
+	case ErrDataLoss:
+		return "data_loss"
+	case ErrUnauthenticated:
+		return "unauthenticated"
+	default:
+		return "unknown"
+	}
+}
+
+// MarshalJSON converts the error code to a human-readable string
+func (c ErrCode) MarshalJSON() ([]byte, error) {
+	return []byte(fmt.Sprintf("\"%s\"", c)), nil
+}
+
+// UnmarshalJSON converts the human-readable string to an error code
+func (c *ErrCode) UnmarshalJSON(b []byte) error {
+	switch string(b) {
+	case "\"ok\"":
+		*c = ErrOK
+	case "\"canceled\"":
+		*c = ErrCanceled
+	case "\"unknown\"":
+		*c = ErrUnknown
+	case "\"invalid_argument\"":
+		*c = ErrInvalidArgument
+	case "\"deadline_exceeded\"":
+		*c = ErrDeadlineExceeded
+	case "\"not_found\"":
+		*c = ErrNotFound
+	case "\"already_exists\"":
+		*c = ErrAlreadyExists
+	case "\"permission_denied\"":
+		*c = ErrPermissionDenied
+	case "\"resource_exhausted\"":
+		*c = ErrResourceExhausted
+	case "\"failed_precondition\"":
+		*c = ErrFailedPrecondition
+	case "\"aborted\"":
+		*c = ErrAborted
+	case "\"out_of_range\"":
+		*c = ErrOutOfRange
+	case "\"unimplemented\"":
+		*c = ErrUnimplemented
+	case "\"internal\"":
+		*c = ErrInternal
+	case "\"unavailable\"":
+		*c = ErrUnavailable
+	case "\"data_loss\"":
+		*c = ErrDataLoss
+	case "\"unauthenticated\"":
+		*c = ErrUnauthenticated
+	default:
+		*c = ErrUnknown
+	}
+	return nil
+}
diff --git a/pkg/clientgen/testdata/goapp/expected_httpstatus_typescript.ts b/pkg/clientgen/testdata/goapp/expected_httpstatus_typescript.ts
new file mode 100644
index 0000000000..0b5279e480
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_httpstatus_typescript.ts
@@ -0,0 +1,748 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+}
+
+export namespace svc {
+    export interface Response {
+        Message: string
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.DummyAPI = this.DummyAPI.bind(this)
+        }
+
+        /**
+         * DummyAPI is a dummy endpoint.
+         */
+        public async DummyAPI(): Promise<Response> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/svc.DummyAPI`)
+            return await resp.json() as Response
+        }
+    }
+}
+
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "method" | "body" | "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/goapp/expected_javascript.js b/pkg/clientgen/testdata/goapp/expected_javascript.js
new file mode 100644
index 0000000000..99eb180a35
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_javascript.js
@@ -0,0 +1,920 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * Local is the base URL for calling the Encore application's API.
+ */
+export const Local = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name) {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr) {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target = "prod", options = undefined) {
+        const base = new BaseClient(target, options ?? {})
+        this.authentication = new authentication.ServiceClient(base)
+        this.products = new products.ServiceClient(base)
+        this.svc = new svc.ServiceClient(base)
+    }
+}
+
+class AuthenticationServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.Docs = this.Docs.bind(this)
+    }
+
+    async Docs(params) {
+        await this.baseClient.callTypedAPI("POST", `/authentication.Docs`, JSON.stringify(params))
+    }
+}
+
+export const authentication = {
+    ServiceClient: AuthenticationServiceClient
+}
+
+class ProductsServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.Create = this.Create.bind(this)
+        this.List = this.List.bind(this)
+    }
+
+    async Create(params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "idempotency-key": params.IdempotencyKey,
+        })
+
+        // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+        const body = {
+            description: params.description,
+            name:        params.name,
+        }
+
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/products.Create`, JSON.stringify(body), {headers})
+        return await resp.json()
+    }
+
+    async List() {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("GET", `/products.List`)
+        return await resp.json()
+    }
+}
+
+export const products = {
+    ServiceClient: ProductsServiceClient
+}
+
+class SvcServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.CreateDocumentedOrder = this.CreateDocumentedOrder.bind(this)
+        this.DummyAPI = this.DummyAPI.bind(this)
+        this.FallbackPath = this.FallbackPath.bind(this)
+        this.Get = this.Get.bind(this)
+        this.GetRequestWithAllInputTypes = this.GetRequestWithAllInputTypes.bind(this)
+        this.HeaderOnlyRequest = this.HeaderOnlyRequest.bind(this)
+        this.Nested = this.Nested.bind(this)
+        this.RESTPath = this.RESTPath.bind(this)
+        this.Rec = this.Rec.bind(this)
+        this.RequestWithAllInputTypes = this.RequestWithAllInputTypes.bind(this)
+        this.TupleInputOutput = this.TupleInputOutput.bind(this)
+        this.Webhook = this.Webhook.bind(this)
+        this.Webhook2 = this.Webhook2.bind(this)
+    }
+
+    async CreateDocumentedOrder(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/svc.CreateDocumentedOrder`, JSON.stringify(params))
+        return await resp.json()
+    }
+
+    /**
+     * DummyAPI is a dummy endpoint.
+     */
+    async DummyAPI(params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            baz: params.HeaderBaz,
+            int: params.HeaderInt === undefined ? undefined : String(params.HeaderInt),
+        })
+
+        const query = makeRecord({
+            bar: params.QueryBar,
+            foo: params.QueryFoo === undefined ? undefined : String(params.QueryFoo),
+        })
+
+        // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+        const body = {
+            Foo: params.Foo,
+            Raw: params.Raw,
+            boo: params.boo,
+        }
+
+        await this.baseClient.callTypedAPI("POST", `/svc.DummyAPI`, JSON.stringify(body), {headers, query})
+    }
+
+    async FallbackPath(a, b) {
+        await this.baseClient.callTypedAPI("POST", `/fallbackPath/${encodeURIComponent(a)}/${b.map(encodeURIComponent).join("/")}`)
+    }
+
+    async Get(params) {
+        // Convert our params into the objects we need for the request
+        const query = makeRecord({
+            boo: String(params.Baz),
+        })
+
+        await this.baseClient.callTypedAPI("GET", `/svc.Get`, undefined, {query})
+    }
+
+    async GetRequestWithAllInputTypes(params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "x-alice": String(params.A),
+        })
+
+        const query = makeRecord({
+            Bob:  params.B.map((v) => String(v)),
+            c:    String(params["Charlies-Bool"]),
+            dave: String(params.Dave),
+        })
+
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("GET", `/svc.GetRequestWithAllInputTypes`, undefined, {headers, query})
+
+        //Populate the return object from the JSON body and received headers
+        const rtn = await resp.json()
+        rtn.Boolean = mustBeSet("Header `x-boolean`", resp.headers.get("x-boolean")).toLowerCase() === "true"
+        rtn.Int = parseInt(mustBeSet("Header `x-int`", resp.headers.get("x-int")), 10)
+        rtn.Float = Number(mustBeSet("Header `x-float`", resp.headers.get("x-float")))
+        rtn.String = mustBeSet("Header `x-string`", resp.headers.get("x-string"))
+        rtn.Bytes = mustBeSet("Header `x-bytes`", resp.headers.get("x-bytes"))
+        rtn.Time = mustBeSet("Header `x-time`", resp.headers.get("x-time"))
+        rtn.Json = JSON.parse(mustBeSet("Header `x-json`", resp.headers.get("x-json")))
+        rtn.UUID = mustBeSet("Header `x-uuid`", resp.headers.get("x-uuid"))
+        rtn.UserID = mustBeSet("Header `x-user-id`", resp.headers.get("x-user-id"))
+        return rtn
+    }
+
+    async HeaderOnlyRequest(params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "x-boolean": String(params.Boolean),
+            "x-bytes":   String(params.Bytes),
+            "x-float":   String(params.Float),
+            "x-int":     String(params.Int),
+            "x-json":    JSON.stringify(params.Json),
+            "x-string":  params.String,
+            "x-time":    String(params.Time),
+            "x-user-id": String(params.UserID),
+            "x-uuid":    String(params.UUID),
+        })
+
+        await this.baseClient.callTypedAPI("GET", `/svc.HeaderOnlyRequest`, undefined, {headers})
+    }
+
+    async Nested(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/svc.Nested`, JSON.stringify(params))
+        return await resp.json()
+    }
+
+    async RESTPath(a, b) {
+        await this.baseClient.callTypedAPI("POST", `/path/${encodeURIComponent(a)}/${encodeURIComponent(b)}`)
+    }
+
+    async Rec(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/svc.Rec`, JSON.stringify(params))
+        return await resp.json()
+    }
+
+    async RequestWithAllInputTypes(params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "x-alice": String(params.A),
+        })
+
+        const query = makeRecord({
+            Bob: params.B.map((v) => String(v)),
+        })
+
+        // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+        const body = {
+            "Charlies-Bool": params["Charlies-Bool"],
+            Dave:            params.Dave,
+        }
+
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/svc.RequestWithAllInputTypes`, JSON.stringify(body), {headers, query})
+
+        //Populate the return object from the JSON body and received headers
+        const rtn = await resp.json()
+        rtn.A = mustBeSet("Header `x-alice`", resp.headers.get("x-alice"))
+        return rtn
+    }
+
+    /**
+     * TupleInputOutput tests the usage of generics in the client generator
+     * and this comment is also multiline, so multiline comments get tested as well.
+     */
+    async TupleInputOutput(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/svc.TupleInputOutput`, JSON.stringify(params))
+        return await resp.json()
+    }
+
+    async Webhook(method, a, b, body, options) {
+        return this.baseClient.callAPI(method, `/webhook/${encodeURIComponent(a)}/${b.map(encodeURIComponent).join("/")}`, body, options)
+    }
+
+    async Webhook2(a, b) {
+        await this.baseClient.callTypedAPI("POST", `/webhook2/${encodeURIComponent(a)}/${b.map(encodeURIComponent).join("/")}`)
+    }
+}
+
+export const svc = {
+    ServiceClient: SvcServiceClient
+}
+
+
+function encodeQuery(parts) {
+    const pairs = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]])
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+function makeRecord(record) {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record
+}
+
+// mustBeSet will throw an APIError with the Data Loss code if value is null or undefined
+function mustBeSet(field, value) {
+    if (value === null || value === undefined) {
+        throw new APIError(
+            500,
+            {
+                code: ErrCode.DataLoss,
+                message: `${field} was unexpectedly ${value}`, // ${value} will create the string "null" or "undefined"
+            },
+        )
+    }
+    return value
+}
+
+
+function encodeWebSocketHeaders(headers) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    hasUpdateHandlers = [];
+
+    constructor(url, headers) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers));
+        }
+
+        this.ws = new WebSocket(url, protocols);
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type, handler) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type, handler) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut {
+    constructor(url, headers) {
+        let responseResolver;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response() {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+
+const boundFetch = fetch.bind(this)
+
+class BaseClient {
+    constructor(baseURL, options) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-JS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {}
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+
+        // Setup an authentication data generator using the auth data token option
+        if (options.auth !== undefined) {
+            const auth = options.auth
+            if (typeof auth === "function") {
+                this.authGenerator = auth
+            } else {
+                this.authGenerator = () => auth
+            }
+        }
+
+    }
+
+    async getAuthData() {
+        let authData;
+
+        // If authorization data generator is present, call it and add the returned data to the request
+        if (this.authGenerator) {
+            const mayBePromise = this.authGenerator();
+            if (mayBePromise instanceof Promise) {
+                authData = await mayBePromise;
+            } else {
+                authData = mayBePromise;
+            }
+        }
+
+        if (authData) {
+            const data = {};
+
+            data.headers = makeRecord({
+                "x-api-key": authData.APIKey,
+            })
+
+            return data;
+        }
+
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : '';
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    async callTypedAPI(method, path, body, params) {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    async callAPI(method, path, body, params) {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+function isAPIErrorResponse(err) {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code) {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    constructor(status, response) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if (Object.setPrototypeOf == undefined) {
+            this.__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if (Error.captureStackTrace !== undefined) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+
+        /**
+         * The HTTP status code associated with the error.
+         */
+        this.status = status
+
+        /**
+         * The Encore error code
+         */
+        this.code = response.code
+
+        /**
+         * The error details
+         */
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err) {
+    return err instanceof APIError;
+}
+
+export const ErrCode = {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK: "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled: "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown: "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument: "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded: "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound: "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists: "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied: "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted: "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition: "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted: "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange: "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented: "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal: "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable: "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss: "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated: "unauthenticated"
+}
diff --git a/pkg/clientgen/testdata/goapp/expected_noauth_golang.go b/pkg/clientgen/testdata/goapp/expected_noauth_golang.go
new file mode 100644
index 0000000000..f1914885ad
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_noauth_golang.go
@@ -0,0 +1,445 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+)
+
+// Client is an API client for the app Encore application.
+type Client struct {
+	Svc SvcClient
+}
+
+// BaseURL is the base URL for calling the Encore application's API.
+type BaseURL string
+
+const Local BaseURL = "http://localhost:4000"
+
+// Environment returns a BaseURL for calling the cloud environment with the given name.
+func Environment(name string) BaseURL {
+	return BaseURL(fmt.Sprintf("https://%s-app.encr.app", name))
+}
+
+// PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+func PreviewEnv(pr int) BaseURL {
+	return Environment(fmt.Sprintf("pr%d", pr))
+}
+
+// Option allows you to customise the baseClient used by the Client
+type Option = func(client *baseClient) error
+
+// New returns a Client for calling the public and authenticated APIs of your Encore application.
+// You can customize the behaviour of the client using the given Option functions, such as WithHTTPClient or WithAuthFunc.
+func New(target BaseURL, options ...Option) (*Client, error) {
+	// Parse the base URL where the Encore application is being hosted
+	baseURL, err := url.Parse(string(target))
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse base url: %w", err)
+	}
+
+	// Create a client with sensible defaults
+	base := &baseClient{
+		baseURL:    baseURL,
+		httpClient: http.DefaultClient,
+		userAgent:  "app-Generated-Go-Client (Encore/v0.0.0-develop)",
+	}
+
+	// Apply any given options
+	for _, option := range options {
+		if err := option(base); err != nil {
+			return nil, fmt.Errorf("unable to apply client option: %w", err)
+		}
+	}
+
+	return &Client{Svc: &svcClient{base}}, nil
+}
+
+// WithHTTPClient can be used to configure the underlying HTTP client used when making API calls.
+//
+// Defaults to http.DefaultClient
+func WithHTTPClient(client HTTPDoer) Option {
+	return func(base *baseClient) error {
+		base.httpClient = client
+		return nil
+	}
+}
+
+type SvcRequest struct {
+	Message string
+}
+
+// SvcClient Provides you access to call public and authenticated APIs on svc. The concrete implementation is svcClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type SvcClient interface {
+	// DummyAPI is a dummy endpoint.
+	DummyAPI(ctx context.Context, params SvcRequest) error
+}
+
+type svcClient struct {
+	base *baseClient
+}
+
+var _ SvcClient = (*svcClient)(nil)
+
+// DummyAPI is a dummy endpoint.
+func (c *svcClient) DummyAPI(ctx context.Context, params SvcRequest) error {
+	_, err := callAPI(ctx, c.base, "POST", "/svc.DummyAPI", nil, params, nil)
+	return err
+}
+
+// HTTPDoer is an interface which can be used to swap out the default
+// HTTP client (http.DefaultClient) with your own custom implementation.
+// This can be used to inject middleware or mock responses during unit tests.
+type HTTPDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// baseClient holds all the information we need to make requests to an Encore application
+type baseClient struct {
+	httpClient HTTPDoer // The HTTP client which will be used for all API requests
+	baseURL    *url.URL // The base URL which API requests will be made against
+	userAgent  string   // What user agent we will use in the API requests
+}
+
+// Do sends the req to the Encore application adding the authorization token as required.
+func (b *baseClient) Do(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", b.userAgent)
+
+	// Merge the base URL and the API URL
+	req.URL = b.baseURL.ResolveReference(req.URL)
+	req.Host = req.URL.Host
+
+	// Finally, make the request via the configured HTTP Client
+	return b.httpClient.Do(req)
+}
+
+// callAPI is used by each generated API method to actually make request and decode the responses
+func callAPI(ctx context.Context, client *baseClient, method, path string, headers http.Header, body, resp any) (http.Header, error) {
+	// Encode the API body
+	var bodyReader io.Reader
+	if body != nil {
+		bodyBytes, err := json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("marshal request: %w", err)
+		}
+		bodyReader = bytes.NewReader(bodyBytes)
+	}
+
+	// Create the request
+	req, err := http.NewRequestWithContext(ctx, method, path, bodyReader)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	// Add any headers to the request
+	for header, values := range headers {
+		for _, value := range values {
+			req.Header.Add(header, value)
+		}
+	}
+
+	// Make the request via the base client
+	rawResponse, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer func() {
+		_ = rawResponse.Body.Close()
+	}()
+	if rawResponse.StatusCode >= 400 {
+		// Read the full body sent back
+		body, err := io.ReadAll(rawResponse.Body)
+		if err != nil {
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response without readable body: %s", rawResponse.Status),
+			}
+		}
+
+		// Attempt to decode the error response as a structured APIError
+		apiError := &APIError{}
+		if err := json.Unmarshal(body, apiError); err != nil {
+			// If the error is not a parsable as an APIError, then return an error with the raw body
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response: %s", string(body)),
+			}
+		}
+		return nil, apiError
+	}
+
+	// Decode the response
+	if resp != nil {
+		if err := json.NewDecoder(rawResponse.Body).Decode(resp); err != nil {
+			return nil, fmt.Errorf("decode response: %w", err)
+		}
+	}
+	return rawResponse.Header, nil
+}
+
+// APIError is the error type returned by the API
+type APIError struct {
+	Code    ErrCode `json:"code"`
+	Message string  `json:"message"`
+	Details any     `json:"details"`
+}
+
+func (e *APIError) Error() string {
+	return fmt.Sprintf("%s: %s", e.Code, e.Message)
+}
+
+type ErrCode int
+
+const (
+	// ErrOK indicates the operation was successful.
+	ErrOK ErrCode = 0
+
+	// ErrCanceled indicates the operation was canceled (typically by the caller).
+	//
+	// Encore will generate this error code when cancellation is requested.
+	ErrCanceled ErrCode = 1
+
+	// ErrUnknown error. An example of where this error may be returned is
+	// if a Status value received from another address space belongs to
+	// an error-space that is not known in this address space. Also
+	// errors raised by APIs that do not return enough error information
+	// may be converted to this error.
+	//
+	// Encore will generate this error code in the above two mentioned cases.
+	ErrUnknown ErrCode = 2
+
+	// ErrInvalidArgument indicates client specified an invalid argument.
+	// Note that this differs from FailedPrecondition. It indicates arguments
+	// that are problematic regardless of the state of the system
+	// (e.g., a malformed file name).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInvalidArgument ErrCode = 3
+
+	// ErrDeadlineExceeded means operation expired before completion.
+	// For operations that change the state of the system, this error may be
+	// returned even if the operation has completed successfully. For
+	// example, a successful response from a server could have been delayed
+	// long enough for the deadline to expire.
+	//
+	// The gRPC framework will generate this error code when the deadline is
+	// exceeded.
+	ErrDeadlineExceeded ErrCode = 4
+
+	// ErrNotFound means some requested entity (e.g., file or directory) was
+	// not found.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrNotFound ErrCode = 5
+
+	// ErrAlreadyExists means an attempt to create an entity failed because one
+	// already exists.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrAlreadyExists ErrCode = 6
+
+	// ErrPermissionDenied indicates the caller does not have permission to
+	// execute the specified operation. It must not be used for rejections
+	// caused by exhausting some resource (use ResourceExhausted
+	// instead for those errors). It must not be
+	// used if the caller cannot be identified (use Unauthenticated
+	// instead for those errors).
+	//
+	// This error code will not be generated by the gRPC core framework,
+	// but expect authentication middleware to use it.
+	ErrPermissionDenied ErrCode = 7
+
+	// ErrResourceExhausted indicates some resource has been exhausted, perhaps
+	// a per-user quota, or perhaps the entire file system is out of space.
+	//
+	// This error code will be generated by the gRPC framework in
+	// out-of-memory and server overload situations, or when a message is
+	// larger than the configured maximum size.
+	ErrResourceExhausted ErrCode = 8
+
+	// ErrFailedPrecondition indicates operation was rejected because the
+	// system is not in a state required for the operation's execution.
+	// For example, directory to be deleted may be non-empty, an rmdir
+	// operation is applied to a non-directory, etc.
+	//
+	// A litmus test that may help a service implementor in deciding
+	// between FailedPrecondition, Aborted, and Unavailable:
+	//
+	//	(a) Use Unavailable if the client can retry just the failing call.
+	//	(b) Use Aborted if the client should retry at a higher-level
+	//	    (e.g., restarting a read-modify-write sequence).
+	//	(c) Use FailedPrecondition if the client should not retry until
+	//	    the system state has been explicitly fixed. E.g., if an "rmdir"
+	//	    fails because the directory is non-empty, FailedPrecondition
+	//	    should be returned since the client should not retry unless
+	//	    they have first fixed up the directory by deleting files from it.
+	//	(d) Use FailedPrecondition if the client performs conditional
+	//	    REST Get/Update/Delete on a resource and the resource on the
+	//	    server does not match the condition. E.g., conflicting
+	//	    read-modify-write on the same resource.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrFailedPrecondition ErrCode = 9
+
+	// ErrAborted indicates the operation was aborted, typically due to a
+	// concurrency issue like sequencer check failures, transaction aborts,
+	// etc.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// ErrAborted, and Unavailable.
+	ErrAborted ErrCode = 10
+
+	// ErrOutOfRange means operation was attempted past the valid range.
+	// E.g., seeking or reading past end of file.
+	//
+	// Unlike InvalidArgument, this error indicates a problem that may
+	// be fixed if the system state changes. For example, a 32-bit file
+	// may be rotated to a 64-bit file without error.
+	//
+	// There is a fair bit of overlap between FailedPrecondition and
+	// ErrOutOfRange. We recommend using OutOfRange (the more specific
+	// error) when it applies so that callers who are iterating through
+	// a space can easily look for an OutOfRange error to detect when
+	// they are done.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrOutOfRange ErrCode = 11
+
+	// ErrUnimplemented indicates operation is not implemented or not
+	// supported/enabled in this service.
+	//
+	// This is not an error, but a feature not available.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrUnimplemented ErrCode = 12
+
+	// ErrInternal means some invariant expected by the underlying system has
+	// been broken. This is not a per-message error, it is a global
+	// conditions check.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInternal ErrCode = 13
+
+	// ErrUnavailable indicates the service is currently unavailable.
+	// This is most likely a transient condition, which can be corrected by
+	// retrying with a backoff.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	ErrUnavailable ErrCode = 14
+
+	// ErrDataLoss indicates unrecoverable data loss or corruption.
+	//
+	// This error code is only defined in the gRPC library, and only for
+	// unrecoverable data loss (i.e., data loss resulting from errors
+	// like hard disk corruption or bandwidth exceeded).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrDataLoss ErrCode = 15
+
+	// ErrUnauthenticated indicates the request does not have valid
+	// authentication credentials for the operation.
+	//
+	// The gRPC framework will generate this error code when the
+	// authentication metadata is invalid or a Credentials callback fails,
+	// but also expect authentication middleware to generate it.
+	ErrUnauthenticated ErrCode = 16
+)
+
+// String returns the string representation of the error code
+func (c ErrCode) String() string {
+	switch c {
+	case ErrOK:
+		return "ok"
+	case ErrCanceled:
+		return "canceled"
+	case ErrUnknown:
+		return "unknown"
+	case ErrInvalidArgument:
+		return "invalid_argument"
+	case ErrDeadlineExceeded:
+		return "deadline_exceeded"
+	case ErrNotFound:
+		return "not_found"
+	case ErrAlreadyExists:
+		return "already_exists"
+	case ErrPermissionDenied:
+		return "permission_denied"
+	case ErrResourceExhausted:
+		return "resource_exhausted"
+	case ErrFailedPrecondition:
+		return "failed_precondition"
+	case ErrAborted:
+		return "aborted"
+	case ErrOutOfRange:
+		return "out_of_range"
+	case ErrUnimplemented:
+		return "unimplemented"
+	case ErrInternal:
+		return "internal"
+	case ErrUnavailable:
+		return "unavailable"
+	case ErrDataLoss:
+		return "data_loss"
+	case ErrUnauthenticated:
+		return "unauthenticated"
+	default:
+		return "unknown"
+	}
+}
+
+// MarshalJSON converts the error code to a human-readable string
+func (c ErrCode) MarshalJSON() ([]byte, error) {
+	return []byte(fmt.Sprintf("\"%s\"", c)), nil
+}
+
+// UnmarshalJSON converts the human-readable string to an error code
+func (c *ErrCode) UnmarshalJSON(b []byte) error {
+	switch string(b) {
+	case "\"ok\"":
+		*c = ErrOK
+	case "\"canceled\"":
+		*c = ErrCanceled
+	case "\"unknown\"":
+		*c = ErrUnknown
+	case "\"invalid_argument\"":
+		*c = ErrInvalidArgument
+	case "\"deadline_exceeded\"":
+		*c = ErrDeadlineExceeded
+	case "\"not_found\"":
+		*c = ErrNotFound
+	case "\"already_exists\"":
+		*c = ErrAlreadyExists
+	case "\"permission_denied\"":
+		*c = ErrPermissionDenied
+	case "\"resource_exhausted\"":
+		*c = ErrResourceExhausted
+	case "\"failed_precondition\"":
+		*c = ErrFailedPrecondition
+	case "\"aborted\"":
+		*c = ErrAborted
+	case "\"out_of_range\"":
+		*c = ErrOutOfRange
+	case "\"unimplemented\"":
+		*c = ErrUnimplemented
+	case "\"internal\"":
+		*c = ErrInternal
+	case "\"unavailable\"":
+		*c = ErrUnavailable
+	case "\"data_loss\"":
+		*c = ErrDataLoss
+	case "\"unauthenticated\"":
+		*c = ErrUnauthenticated
+	default:
+		*c = ErrUnknown
+	}
+	return nil
+}
diff --git a/pkg/clientgen/testdata/goapp/expected_noauth_javascript.js b/pkg/clientgen/testdata/goapp/expected_noauth_javascript.js
new file mode 100644
index 0000000000..3b06fcecbf
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_noauth_javascript.js
@@ -0,0 +1,667 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * Local is the base URL for calling the Encore application's API.
+ */
+export const Local = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name) {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr) {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target = "prod", options = undefined) {
+        const base = new BaseClient(target, options ?? {})
+        this.svc = new svc.ServiceClient(base)
+    }
+}
+
+class SvcServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.DummyAPI = this.DummyAPI.bind(this)
+    }
+
+    /**
+     * DummyAPI is a dummy endpoint.
+     */
+    async DummyAPI(params) {
+        await this.baseClient.callTypedAPI("POST", `/svc.DummyAPI`, JSON.stringify(params))
+    }
+}
+
+export const svc = {
+    ServiceClient: SvcServiceClient
+}
+
+
+function encodeQuery(parts) {
+    const pairs = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]])
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+function makeRecord(record) {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record
+}
+
+
+function encodeWebSocketHeaders(headers) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    hasUpdateHandlers = [];
+
+    constructor(url, headers) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers));
+        }
+
+        this.ws = new WebSocket(url, protocols);
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type, handler) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type, handler) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut {
+    constructor(url, headers) {
+        let responseResolver;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response() {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+
+const boundFetch = fetch.bind(this)
+
+class BaseClient {
+    constructor(baseURL, options) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-JS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {}
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData() {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : '';
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    async callTypedAPI(method, path, body, params) {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    async callAPI(method, path, body, params) {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+function isAPIErrorResponse(err) {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code) {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    constructor(status, response) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if (Object.setPrototypeOf == undefined) {
+            this.__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if (Error.captureStackTrace !== undefined) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+
+        /**
+         * The HTTP status code associated with the error.
+         */
+        this.status = status
+
+        /**
+         * The Encore error code
+         */
+        this.code = response.code
+
+        /**
+         * The error details
+         */
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err) {
+    return err instanceof APIError;
+}
+
+export const ErrCode = {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK: "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled: "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown: "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument: "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded: "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound: "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists: "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied: "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted: "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition: "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted: "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange: "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented: "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal: "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable: "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss: "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated: "unauthenticated"
+}
diff --git a/pkg/clientgen/testdata/goapp/expected_noauth_openapi.json b/pkg/clientgen/testdata/goapp/expected_noauth_openapi.json
new file mode 100644
index 0000000000..b7abc65215
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_noauth_openapi.json
@@ -0,0 +1,88 @@
+{
+  "components": {
+    "responses": {
+      "APIError": {
+        "content": {
+          "application/json": {
+            "schema": {
+              "externalDocs": {
+                "url": "https://pkg.go.dev/encore.dev/beta/errs#Error"
+              },
+              "properties": {
+                "code": {
+                  "description": "Error code",
+                  "example": "not_found",
+                  "externalDocs": {
+                    "url": "https://pkg.go.dev/encore.dev/beta/errs#ErrCode"
+                  },
+                  "type": "string"
+                },
+                "details": {
+                  "description": "Error details",
+                  "type": "object"
+                },
+                "message": {
+                  "description": "Error message",
+                  "type": "string"
+                }
+              },
+              "title": "APIError",
+              "type": "object"
+            }
+          }
+        },
+        "description": "Error response"
+      }
+    }
+  },
+  "info": {
+    "description": "Generated by encore",
+    "title": "API for app",
+    "version": "1",
+    "x-logo": {
+      "altText": "Encore logo",
+      "backgroundColor": "#EEEEE1",
+      "url": "https://encore.dev/assets/branding/logo/logo-black.png"
+    }
+  },
+  "openapi": "3.0.0",
+  "paths": {
+    "/svc.DummyAPI": {
+      "post": {
+        "operationId": "POST:svc.DummyAPI",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "Message": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "Message"
+                ],
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        },
+        "summary": "DummyAPI is a dummy endpoint.\n"
+      }
+    }
+  },
+  "servers": [
+    {
+      "description": "Encore local dev environment",
+      "url": "http://localhost:4000"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/pkg/clientgen/testdata/goapp/expected_noauth_typescript.ts b/pkg/clientgen/testdata/goapp/expected_noauth_typescript.ts
new file mode 100644
index 0000000000..0156bbcd7e
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_noauth_typescript.ts
@@ -0,0 +1,746 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+}
+
+export namespace svc {
+    export interface Request {
+        Message: string
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.DummyAPI = this.DummyAPI.bind(this)
+        }
+
+        /**
+         * DummyAPI is a dummy endpoint.
+         */
+        public async DummyAPI(params: Request): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/svc.DummyAPI`, JSON.stringify(params))
+        }
+    }
+}
+
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "method" | "body" | "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/goapp/expected_openapi.json b/pkg/clientgen/testdata/goapp/expected_openapi.json
new file mode 100644
index 0000000000..5683e3b73f
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_openapi.json
@@ -0,0 +1,1550 @@
+{
+  "components": {
+    "responses": {
+      "APIError": {
+        "content": {
+          "application/json": {
+            "schema": {
+              "externalDocs": {
+                "url": "https://pkg.go.dev/encore.dev/beta/errs#Error"
+              },
+              "properties": {
+                "code": {
+                  "description": "Error code",
+                  "example": "not_found",
+                  "externalDocs": {
+                    "url": "https://pkg.go.dev/encore.dev/beta/errs#ErrCode"
+                  },
+                  "type": "string"
+                },
+                "details": {
+                  "description": "Error details",
+                  "type": "object"
+                },
+                "message": {
+                  "description": "Error message",
+                  "type": "string"
+                }
+              },
+              "title": "APIError",
+              "type": "object"
+            }
+          }
+        },
+        "description": "Error response"
+      }
+    },
+    "schemas": {
+      "authentication.BarType": {
+        "properties": {
+          "Baz": {
+            "title": "Baz docs\n",
+            "type": "string"
+          }
+        },
+        "required": [
+          "Baz"
+        ],
+        "title": "BarType docs\n",
+        "type": "object"
+      },
+      "authentication.User": {
+        "properties": {
+          "id": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "name": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "name"
+        ],
+        "type": "object"
+      },
+      "nested.Type": {
+        "properties": {
+          "Message": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "Message"
+        ],
+        "type": "object"
+      },
+      "products.Product": {
+        "properties": {
+          "created_at": {
+            "format": "date-time",
+            "type": "string"
+          },
+          "created_by": {
+            "$ref": "#/components/schemas/authentication.User"
+          },
+          "description": {
+            "type": "string"
+          },
+          "id": {
+            "format": "uuid",
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "id",
+          "name",
+          "description",
+          "created_at",
+          "created_by"
+        ],
+        "type": "object"
+      },
+      "svc.DocumentedUser": {
+        "properties": {
+          "email": {
+            "type": "string"
+          },
+          "name": {
+            "type": "string"
+          }
+        },
+        "required": [
+          "name",
+          "email"
+        ],
+        "title": "DocumentedUser represents a user in the system with profile information\n",
+        "type": "object"
+      },
+      "svc.Foo": {
+        "format": "int64",
+        "title": "Foo represents a documented integer type\n",
+        "type": "integer"
+      },
+      "svc.Recursive": {
+        "properties": {
+          "Map": {
+            "additionalProperties": {
+              "$ref": "#/components/schemas/svc.Recursive"
+            },
+            "type": "object"
+          },
+          "Optional": {
+            "$ref": "#/components/schemas/svc.Recursive"
+          },
+          "Slice": {
+            "items": {
+              "$ref": "#/components/schemas/svc.Recursive"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "Slice",
+          "Map"
+        ],
+        "type": "object"
+      },
+      "svc.Request": {
+        "properties": {
+          "Foo": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/svc.Foo"
+              }
+            ],
+            "title": "Foo is good\n"
+          },
+          "HeaderBaz": {
+            "type": "string"
+          },
+          "HeaderInt": {
+            "format": "int64",
+            "type": "integer"
+          },
+          "QueryBar": {
+            "type": "string"
+          },
+          "QueryFoo": {
+            "type": "boolean"
+          },
+          "Raw": {
+            "description": "comment on the raw message!\n",
+            "title": "This is a multiline\n",
+            "type": "object"
+          },
+          "boo": {
+            "title": "Baz is better\n",
+            "type": "string"
+          }
+        },
+        "required": [
+          "boo",
+          "Raw"
+        ],
+        "type": "object"
+      },
+      "svc.WrappedRequest": {
+        "properties": {
+          "Value": {
+            "$ref": "#/components/schemas/svc.Request"
+          }
+        },
+        "required": [
+          "Value"
+        ],
+        "type": "object"
+      }
+    }
+  },
+  "info": {
+    "description": "Generated by encore",
+    "title": "API for app",
+    "version": "1",
+    "x-logo": {
+      "altText": "Encore logo",
+      "backgroundColor": "#EEEEE1",
+      "url": "https://encore.dev/assets/branding/logo/logo-black.png"
+    }
+  },
+  "openapi": "3.0.0",
+  "paths": {
+    "/authentication.Docs": {
+      "post": {
+        "operationId": "POST:authentication.Docs",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "Bar": {
+                    "$ref": "#/components/schemas/authentication.BarType"
+                  },
+                  "Moo": {
+                    "title": "Moo docs\n",
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "Moo",
+                  "Bar"
+                ],
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/fallbackPath/{a}/{b}": {
+      "get": {
+        "operationId": "GET:svc.FallbackPath",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      },
+      "post": {
+        "operationId": "POST:svc.FallbackPath",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/path/{a}/{b}": {
+      "get": {
+        "operationId": "GET:svc.RESTPath",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "format": "int64",
+              "type": "integer"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      },
+      "post": {
+        "operationId": "POST:svc.RESTPath",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "format": "int64",
+              "type": "integer"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/products.Create": {
+      "post": {
+        "operationId": "POST:products.Create",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "idempotency-key",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "description": {
+                    "type": "string"
+                  },
+                  "name": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "name",
+                  "description"
+                ],
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "created_at": {
+                      "format": "date-time",
+                      "type": "string"
+                    },
+                    "created_by": {
+                      "$ref": "#/components/schemas/authentication.User"
+                    },
+                    "description": {
+                      "type": "string"
+                    },
+                    "id": {
+                      "format": "uuid",
+                      "type": "string"
+                    },
+                    "name": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "id",
+                    "name",
+                    "description",
+                    "created_at",
+                    "created_by"
+                  ],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/products.List": {
+      "get": {
+        "operationId": "GET:products.List",
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "next": {
+                      "properties": {
+                        "cursor": {
+                          "type": "string"
+                        },
+                        "exists": {
+                          "type": "boolean"
+                        }
+                      },
+                      "required": [
+                        "cursor",
+                        "exists"
+                      ],
+                      "type": "object"
+                    },
+                    "previous": {
+                      "properties": {
+                        "cursor": {
+                          "type": "string"
+                        },
+                        "exists": {
+                          "type": "boolean"
+                        }
+                      },
+                      "required": [
+                        "cursor",
+                        "exists"
+                      ],
+                      "type": "object"
+                    },
+                    "products": {
+                      "items": {
+                        "$ref": "#/components/schemas/products.Product"
+                      },
+                      "type": "array"
+                    }
+                  },
+                  "required": [
+                    "products",
+                    "previous",
+                    "next"
+                  ],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/svc.CreateDocumentedOrder": {
+      "post": {
+        "operationId": "POST:svc.CreateDocumentedOrder",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "customer": {
+                    "$ref": "#/components/schemas/svc.DocumentedUser"
+                  },
+                  "order_id": {
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "customer",
+                  "order_id"
+                ],
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "customer": {
+                      "$ref": "#/components/schemas/svc.DocumentedUser"
+                    },
+                    "order_id": {
+                      "type": "string"
+                    }
+                  },
+                  "required": [
+                    "customer",
+                    "order_id"
+                  ],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/svc.DummyAPI": {
+      "post": {
+        "operationId": "POST:svc.DummyAPI",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "baz",
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "int",
+            "schema": {
+              "format": "int64",
+              "type": "integer"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "query",
+            "name": "foo",
+            "schema": {
+              "type": "boolean"
+            },
+            "style": "form"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "query",
+            "name": "bar",
+            "schema": {
+              "type": "string"
+            },
+            "style": "form"
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "Foo": {
+                    "$ref": "#/components/schemas/svc.Foo"
+                  },
+                  "Raw": {
+                    "description": "comment on the raw message!\n",
+                    "title": "This is a multiline\n",
+                    "type": "object"
+                  },
+                  "boo": {
+                    "title": "Baz is better\n",
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "boo",
+                  "Raw"
+                ],
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        },
+        "summary": "DummyAPI is a dummy endpoint.\n"
+      }
+    },
+    "/svc.Get": {
+      "get": {
+        "operationId": "GET:svc.Get",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "query",
+            "name": "boo",
+            "required": true,
+            "schema": {
+              "format": "int64",
+              "type": "integer"
+            },
+            "style": "form"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/svc.GetRequestWithAllInputTypes": {
+      "get": {
+        "operationId": "GET:svc.GetRequestWithAllInputTypes",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "description": "Specify this comes from a header field\n",
+            "explode": true,
+            "in": "header",
+            "name": "x-alice",
+            "required": true,
+            "schema": {
+              "format": "date-time",
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "description": "Specify this comes from a query string\n",
+            "explode": true,
+            "in": "query",
+            "name": "Bob",
+            "required": true,
+            "schema": {
+              "items": {
+                "format": "int64",
+                "type": "integer"
+              },
+              "type": "array"
+            },
+            "style": "form"
+          },
+          {
+            "allowEmptyValue": true,
+            "description": "This can come from anywhere, but if it comes from the payload in JSON it must be called Charile\n",
+            "explode": true,
+            "in": "query",
+            "name": "c",
+            "required": true,
+            "schema": {
+              "type": "boolean"
+            },
+            "style": "form"
+          },
+          {
+            "allowEmptyValue": true,
+            "description": "This generic type complicates the whole thing 🙈\n",
+            "explode": true,
+            "in": "query",
+            "name": "dave",
+            "required": true,
+            "schema": {
+              "format": "int64",
+              "type": "integer"
+            },
+            "style": "form"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response",
+            "headers": {
+              "x-boolean": {
+                "allowEmptyValue": true,
+                "explode": true,
+                "required": true,
+                "schema": {
+                  "type": "boolean"
+                },
+                "style": "simple"
+              },
+              "x-bytes": {
+                "allowEmptyValue": true,
+                "explode": true,
+                "required": true,
+                "schema": {
+                  "format": "byte",
+                  "type": "string"
+                },
+                "style": "simple"
+              },
+              "x-float": {
+                "allowEmptyValue": true,
+                "explode": true,
+                "required": true,
+                "schema": {
+                  "type": "number"
+                },
+                "style": "simple"
+              },
+              "x-int": {
+                "allowEmptyValue": true,
+                "explode": true,
+                "required": true,
+                "schema": {
+                  "format": "int64",
+                  "type": "integer"
+                },
+                "style": "simple"
+              },
+              "x-json": {
+                "allowEmptyValue": true,
+                "explode": true,
+                "required": true,
+                "schema": {
+                  "type": "object"
+                },
+                "style": "simple"
+              },
+              "x-string": {
+                "allowEmptyValue": true,
+                "explode": true,
+                "required": true,
+                "schema": {
+                  "type": "string"
+                },
+                "style": "simple"
+              },
+              "x-time": {
+                "allowEmptyValue": true,
+                "explode": true,
+                "required": true,
+                "schema": {
+                  "format": "date-time",
+                  "type": "string"
+                },
+                "style": "simple"
+              },
+              "x-user-id": {
+                "allowEmptyValue": true,
+                "explode": true,
+                "required": true,
+                "schema": {
+                  "type": "string"
+                },
+                "style": "simple"
+              },
+              "x-uuid": {
+                "allowEmptyValue": true,
+                "explode": true,
+                "required": true,
+                "schema": {
+                  "format": "uuid",
+                  "type": "string"
+                },
+                "style": "simple"
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/svc.HeaderOnlyRequest": {
+      "get": {
+        "operationId": "GET:svc.HeaderOnlyRequest",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "x-boolean",
+            "required": true,
+            "schema": {
+              "type": "boolean"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "x-int",
+            "required": true,
+            "schema": {
+              "format": "int64",
+              "type": "integer"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "x-float",
+            "required": true,
+            "schema": {
+              "type": "number"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "x-string",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "x-bytes",
+            "required": true,
+            "schema": {
+              "format": "byte",
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "x-time",
+            "required": true,
+            "schema": {
+              "format": "date-time",
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "x-json",
+            "required": true,
+            "schema": {
+              "type": "object"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "x-uuid",
+            "required": true,
+            "schema": {
+              "format": "uuid",
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": true,
+            "in": "header",
+            "name": "x-user-id",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/svc.Nested": {
+      "post": {
+        "operationId": "POST:svc.Nested",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "Nested": {
+                    "$ref": "#/components/schemas/nested.Type"
+                  }
+                },
+                "required": [
+                  "Nested"
+                ],
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "Nested": {
+                      "$ref": "#/components/schemas/nested.Type"
+                    }
+                  },
+                  "required": [
+                    "Nested"
+                  ],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/svc.Rec": {
+      "post": {
+        "operationId": "POST:svc.Rec",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "Map": {
+                    "additionalProperties": {
+                      "$ref": "#/components/schemas/svc.Recursive"
+                    },
+                    "type": "object"
+                  },
+                  "Optional": {
+                    "$ref": "#/components/schemas/svc.Recursive"
+                  },
+                  "Slice": {
+                    "items": {
+                      "$ref": "#/components/schemas/svc.Recursive"
+                    },
+                    "type": "array"
+                  }
+                },
+                "required": [
+                  "Slice",
+                  "Map"
+                ],
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "Map": {
+                      "additionalProperties": {
+                        "$ref": "#/components/schemas/svc.Recursive"
+                      },
+                      "type": "object"
+                    },
+                    "Optional": {
+                      "$ref": "#/components/schemas/svc.Recursive"
+                    },
+                    "Slice": {
+                      "items": {
+                        "$ref": "#/components/schemas/svc.Recursive"
+                      },
+                      "type": "array"
+                    }
+                  },
+                  "required": [
+                    "Slice",
+                    "Map"
+                  ],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/svc.RequestWithAllInputTypes": {
+      "post": {
+        "operationId": "POST:svc.RequestWithAllInputTypes",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "description": "Specify this comes from a header field\n",
+            "explode": true,
+            "in": "header",
+            "name": "x-alice",
+            "required": true,
+            "schema": {
+              "format": "date-time",
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "description": "Specify this comes from a query string\n",
+            "explode": true,
+            "in": "query",
+            "name": "Bob",
+            "required": true,
+            "schema": {
+              "items": {
+                "format": "int64",
+                "type": "integer"
+              },
+              "type": "array"
+            },
+            "style": "form"
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "Charlies-Bool": {
+                    "title": "This can come from anywhere, but if it comes from the payload in JSON it must be\ncalled Charile\n",
+                    "type": "boolean"
+                  },
+                  "Dave": {
+                    "title": "This generic type complicates the whole thing 🙈\n",
+                    "type": "string"
+                  }
+                },
+                "required": [
+                  "Charlies-Bool",
+                  "Dave"
+                ],
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "B": {
+                      "items": {
+                        "format": "int64",
+                        "type": "integer"
+                      },
+                      "title": "Specify this comes from a query string\n",
+                      "type": "array"
+                    },
+                    "Charlies-Bool": {
+                      "title": "This can come from anywhere, but if it comes from the payload in JSON it must be\ncalled Charile\n",
+                      "type": "boolean"
+                    },
+                    "Dave": {
+                      "title": "This generic type complicates the whole thing 🙈\n",
+                      "type": "number"
+                    }
+                  },
+                  "required": [
+                    "B",
+                    "Charlies-Bool",
+                    "Dave"
+                  ],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Success response",
+            "headers": {
+              "x-alice": {
+                "allowEmptyValue": true,
+                "description": "Specify this comes from a header field\n",
+                "explode": true,
+                "required": true,
+                "schema": {
+                  "format": "date-time",
+                  "type": "string"
+                },
+                "style": "simple"
+              }
+            }
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/svc.TupleInputOutput": {
+      "post": {
+        "description": "and this comment is also multiline, so multiline comments get tested as well.\n",
+        "operationId": "POST:svc.TupleInputOutput",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "A": {
+                    "type": "string"
+                  },
+                  "B": {
+                    "$ref": "#/components/schemas/svc.WrappedRequest"
+                  }
+                },
+                "required": [
+                  "A",
+                  "B"
+                ],
+                "type": "object"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "properties": {
+                    "A": {
+                      "type": "boolean"
+                    },
+                    "B": {
+                      "$ref": "#/components/schemas/svc.Foo"
+                    }
+                  },
+                  "required": [
+                    "A",
+                    "B"
+                  ],
+                  "type": "object"
+                }
+              }
+            },
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        },
+        "summary": "TupleInputOutput tests the usage of generics in the client generator\n"
+      }
+    },
+    "/webhook/{a}/{b}": {
+      "delete": {
+        "operationId": "DELETE:svc.Webhook",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      },
+      "get": {
+        "operationId": "GET:svc.Webhook",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      },
+      "head": {
+        "operationId": "HEAD:svc.Webhook",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      },
+      "patch": {
+        "operationId": "PATCH:svc.Webhook",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      },
+      "post": {
+        "operationId": "POST:svc.Webhook",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      },
+      "put": {
+        "operationId": "PUT:svc.Webhook",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    },
+    "/webhook2/{a}/{b}": {
+      "get": {
+        "operationId": "GET:svc.Webhook2",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      },
+      "post": {
+        "operationId": "POST:svc.Webhook2",
+        "parameters": [
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "a",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          },
+          {
+            "allowEmptyValue": true,
+            "explode": false,
+            "in": "path",
+            "name": "b",
+            "required": true,
+            "schema": {
+              "type": "string"
+            },
+            "style": "simple"
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Success response"
+          },
+          "default": {
+            "$ref": "#/components/responses/APIError"
+          }
+        }
+      }
+    }
+  },
+  "servers": [
+    {
+      "description": "Encore local dev environment",
+      "url": "http://localhost:4000"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/pkg/clientgen/testdata/goapp/expected_typescript.ts b/pkg/clientgen/testdata/goapp/expected_typescript.ts
new file mode 100644
index 0000000000..17f6b38229
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/expected_typescript.ts
@@ -0,0 +1,1191 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly authentication: authentication.ServiceClient
+    public readonly products: products.ServiceClient
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.authentication = new authentication.ServiceClient(base)
+        this.products = new products.ServiceClient(base)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    /**
+     * Allows you to set the authentication data to be used for each
+     * request either by passing in a static object or by passing in
+     * a function which returns a new object for each request.
+     */
+    auth?: authentication.AuthData | AuthDataGenerator
+}
+
+export namespace authentication {
+    export interface AuthData {
+        APIKey: string
+    }
+
+    /**
+     * BarType docs
+     */
+    export interface BarType {
+        /**
+         * Baz docs
+         */
+        Baz: string
+    }
+
+    /**
+     * FooType docs
+     */
+    export interface FooType {
+        /**
+         * Moo docs
+         */
+        Moo: string
+
+        /**
+         * Bar docs
+         */
+        Bar: BarType
+    }
+
+    export interface User {
+        id: number
+        name: string
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.Docs = this.Docs.bind(this)
+        }
+
+        public async Docs(params: FooType): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/authentication.Docs`, JSON.stringify(params))
+        }
+    }
+}
+
+export namespace products {
+    export interface CreateProductRequest {
+        IdempotencyKey: string
+        name: string
+        description: string
+    }
+
+    export interface Product {
+        id: string
+        name: string
+        description: string
+        "created_at": string
+        "created_by": authentication.User
+    }
+
+    export interface ProductListing {
+        products: Product[]
+        previous: {
+            cursor: string
+            exists: boolean
+        }
+        next: {
+            cursor: string
+            exists: boolean
+        }
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.Create = this.Create.bind(this)
+            this.List = this.List.bind(this)
+        }
+
+        public async Create(params: CreateProductRequest): Promise<Product> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "idempotency-key": params.IdempotencyKey,
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                description: params.description,
+                name:        params.name,
+            }
+
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/products.Create`, JSON.stringify(body), {headers})
+            return await resp.json() as Product
+        }
+
+        public async List(): Promise<ProductListing> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("GET", `/products.List`)
+            return await resp.json() as ProductListing
+        }
+    }
+}
+
+export namespace svc {
+    export interface AllInputTypes<A> {
+        /**
+         * Specify this comes from a header field
+         */
+        A: string
+
+        /**
+         * Specify this comes from a query string
+         */
+        B: number[]
+
+        /**
+         * This can come from anywhere, but if it comes from the payload in JSON it must be called Charile
+         */
+        "Charlies-Bool": boolean
+
+        /**
+         * This generic type complicates the whole thing 🙈
+         */
+        Dave: A
+    }
+
+    /**
+     * DocumentedOrder represents a customer order with references
+     */
+    export interface DocumentedOrder {
+        /**
+         * Customer who placed this order (different from shipping recipient)
+         */
+        customer: DocumentedUser
+
+        "order_id": string
+    }
+
+    /**
+     * DocumentedUser represents a user in the system with profile information
+     */
+    export interface DocumentedUser {
+        name: string
+        email: string
+    }
+
+    /**
+     * Foo represents a documented integer type
+     */
+    export type Foo = number
+
+    export interface GetRequest {
+        Baz: number
+    }
+
+    /**
+     * HeaderOnlyStruct contains all types we support in headers
+     */
+    export interface HeaderOnlyStruct {
+        Boolean: boolean
+        Int: number
+        Float: number
+        String: string
+        Bytes: string
+        Time: string
+        Json: JSONValue
+        UUID: string
+        UserID: string
+    }
+
+    export interface Recursive {
+        Optional?: Recursive
+        Slice: Recursive[]
+        Map: { [key: string]: Recursive }
+    }
+
+    export interface Request {
+        /**
+         * Foo is good
+         */
+        Foo?: Foo
+
+        /**
+         * Baz is better
+         */
+        boo: string
+
+        QueryFoo?: boolean
+        QueryBar?: string
+        HeaderBaz?: string
+        HeaderInt?: number
+        /**
+         * This is a multiline
+         * comment on the raw message!
+         */
+        Raw: JSONValue
+    }
+
+    /**
+     * Tuple is a generic type which allows us to
+     * return two values of two different types
+     */
+    export interface Tuple<A, B> {
+        A: A
+        B: B
+    }
+
+    export interface WithNested {
+        Nested: nested.Type
+    }
+
+    export type WrappedRequest = Wrapper<Request>
+
+    export interface Wrapper<T> {
+        Value: T
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.CreateDocumentedOrder = this.CreateDocumentedOrder.bind(this)
+            this.DummyAPI = this.DummyAPI.bind(this)
+            this.FallbackPath = this.FallbackPath.bind(this)
+            this.Get = this.Get.bind(this)
+            this.GetRequestWithAllInputTypes = this.GetRequestWithAllInputTypes.bind(this)
+            this.HeaderOnlyRequest = this.HeaderOnlyRequest.bind(this)
+            this.Nested = this.Nested.bind(this)
+            this.RESTPath = this.RESTPath.bind(this)
+            this.Rec = this.Rec.bind(this)
+            this.RequestWithAllInputTypes = this.RequestWithAllInputTypes.bind(this)
+            this.TupleInputOutput = this.TupleInputOutput.bind(this)
+            this.Webhook = this.Webhook.bind(this)
+            this.Webhook2 = this.Webhook2.bind(this)
+        }
+
+        public async CreateDocumentedOrder(params: DocumentedOrder): Promise<DocumentedOrder> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/svc.CreateDocumentedOrder`, JSON.stringify(params))
+            return await resp.json() as DocumentedOrder
+        }
+
+        /**
+         * DummyAPI is a dummy endpoint.
+         */
+        public async DummyAPI(params: Request): Promise<void> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                baz: params.HeaderBaz,
+                int: params.HeaderInt === undefined ? undefined : String(params.HeaderInt),
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                bar: params.QueryBar,
+                foo: params.QueryFoo === undefined ? undefined : String(params.QueryFoo),
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                Foo: params.Foo,
+                Raw: params.Raw,
+                boo: params.boo,
+            }
+
+            await this.baseClient.callTypedAPI("POST", `/svc.DummyAPI`, JSON.stringify(body), {headers, query})
+        }
+
+        public async FallbackPath(a: string, b: string[]): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/fallbackPath/${encodeURIComponent(a)}/${b.map(encodeURIComponent).join("/")}`)
+        }
+
+        public async Get(params: GetRequest): Promise<void> {
+            // Convert our params into the objects we need for the request
+            const query = makeRecord<string, string | string[]>({
+                boo: String(params.Baz),
+            })
+
+            await this.baseClient.callTypedAPI("GET", `/svc.Get`, undefined, {query})
+        }
+
+        public async GetRequestWithAllInputTypes(params: AllInputTypes<number>): Promise<HeaderOnlyStruct> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "x-alice": String(params.A),
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                Bob:  params.B.map((v) => String(v)),
+                c:    String(params["Charlies-Bool"]),
+                dave: String(params.Dave),
+            })
+
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("GET", `/svc.GetRequestWithAllInputTypes`, undefined, {headers, query})
+
+            //Populate the return object from the JSON body and received headers
+            const rtn = await resp.json() as HeaderOnlyStruct
+            rtn.Boolean = mustBeSet("Header `x-boolean`", resp.headers.get("x-boolean")).toLowerCase() === "true"
+            rtn.Int = parseInt(mustBeSet("Header `x-int`", resp.headers.get("x-int")), 10)
+            rtn.Float = Number(mustBeSet("Header `x-float`", resp.headers.get("x-float")))
+            rtn.String = mustBeSet("Header `x-string`", resp.headers.get("x-string"))
+            rtn.Bytes = mustBeSet("Header `x-bytes`", resp.headers.get("x-bytes"))
+            rtn.Time = mustBeSet("Header `x-time`", resp.headers.get("x-time"))
+            rtn.Json = JSON.parse(mustBeSet("Header `x-json`", resp.headers.get("x-json")))
+            rtn.UUID = mustBeSet("Header `x-uuid`", resp.headers.get("x-uuid"))
+            rtn.UserID = mustBeSet("Header `x-user-id`", resp.headers.get("x-user-id"))
+            return rtn
+        }
+
+        public async HeaderOnlyRequest(params: HeaderOnlyStruct): Promise<void> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "x-boolean": String(params.Boolean),
+                "x-bytes":   String(params.Bytes),
+                "x-float":   String(params.Float),
+                "x-int":     String(params.Int),
+                "x-json":    JSON.stringify(params.Json),
+                "x-string":  params.String,
+                "x-time":    String(params.Time),
+                "x-user-id": String(params.UserID),
+                "x-uuid":    String(params.UUID),
+            })
+
+            await this.baseClient.callTypedAPI("GET", `/svc.HeaderOnlyRequest`, undefined, {headers})
+        }
+
+        public async Nested(params: WithNested): Promise<WithNested> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/svc.Nested`, JSON.stringify(params))
+            return await resp.json() as WithNested
+        }
+
+        public async RESTPath(a: string, b: number): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/path/${encodeURIComponent(a)}/${encodeURIComponent(b)}`)
+        }
+
+        public async Rec(params: Recursive): Promise<Recursive> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/svc.Rec`, JSON.stringify(params))
+            return await resp.json() as Recursive
+        }
+
+        public async RequestWithAllInputTypes(params: AllInputTypes<string>): Promise<AllInputTypes<number>> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "x-alice": String(params.A),
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                Bob: params.B.map((v) => String(v)),
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                "Charlies-Bool": params["Charlies-Bool"],
+                Dave:            params.Dave,
+            }
+
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/svc.RequestWithAllInputTypes`, JSON.stringify(body), {headers, query})
+
+            //Populate the return object from the JSON body and received headers
+            const rtn = await resp.json() as AllInputTypes<number>
+            rtn.A = mustBeSet("Header `x-alice`", resp.headers.get("x-alice"))
+            return rtn
+        }
+
+        /**
+         * TupleInputOutput tests the usage of generics in the client generator
+         * and this comment is also multiline, so multiline comments get tested as well.
+         */
+        public async TupleInputOutput(params: Tuple<string, WrappedRequest>): Promise<Tuple<boolean, Foo>> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/svc.TupleInputOutput`, JSON.stringify(params))
+            return await resp.json() as Tuple<boolean, Foo>
+        }
+
+        public async Webhook(method: string, a: string, b: string[], body?: RequestInit["body"], options?: CallParameters): Promise<globalThis.Response> {
+            return this.baseClient.callAPI(method, `/webhook/${encodeURIComponent(a)}/${b.map(encodeURIComponent).join("/")}`, body, options)
+        }
+
+        public async Webhook2(a: string, b: string[]): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/webhook2/${encodeURIComponent(a)}/${b.map(encodeURIComponent).join("/")}`)
+        }
+    }
+}
+
+export namespace nested {
+    export interface Type {
+        Message: string
+    }
+}
+
+// JSONValue represents an arbitrary JSON value.
+export type JSONValue = string | number | boolean | null | JSONValue[] | {[key: string]: JSONValue}
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+
+// mustBeSet will throw an APIError with the Data Loss code if value is null or undefined
+function mustBeSet<A>(field: string, value: A | null | undefined): A {
+    if (value === null || value === undefined) {
+        throw new APIError(
+            500,
+            {
+                code: ErrCode.DataLoss,
+                message: `${field} was unexpectedly ${value}`, // ${value} will create the string "null" or "undefined"
+            },
+        )
+    }
+    return value
+}
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "method" | "body" | "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+// AuthDataGenerator is a function that returns a new instance of the authentication data required by this API
+export type AuthDataGenerator = () =>
+  | authentication.AuthData
+  | Promise<authentication.AuthData | undefined>
+  | undefined;
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+    readonly authGenerator?: AuthDataGenerator
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+
+        // Setup an authentication data generator using the auth data token option
+        if (options.auth !== undefined) {
+            const auth = options.auth
+            if (typeof auth === "function") {
+                this.authGenerator = auth
+            } else {
+                this.authGenerator = () => auth
+            }
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        let authData: authentication.AuthData | undefined;
+
+        // If authorization data generator is present, call it and add the returned data to the request
+        if (this.authGenerator) {
+            const mayBePromise = this.authGenerator();
+            if (mayBePromise instanceof Promise) {
+                authData = await mayBePromise;
+            } else {
+                authData = mayBePromise;
+            }
+        }
+
+        if (authData) {
+            const data: CallParameters = {};
+
+            data.headers = makeRecord<string, string>({
+                "x-api-key": authData.APIKey,
+            });
+
+            return data;
+        }
+
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/goapp/input.go b/pkg/clientgen/testdata/goapp/input.go
new file mode 100644
index 0000000000..6d4f701522
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/input.go
@@ -0,0 +1,276 @@
+-- go.mod --
+module app
+
+-- encore.app --
+{"id": ""}
+
+-- svc/svc.go --
+package svc
+
+import (
+    "encoding/json"
+    "time"
+
+    "encore.dev/beta/auth"
+    "encore.dev/types/uuid"
+)
+
+type UnusedType struct {
+Foo Foo
+}
+
+type Wrapper[T any] struct { Value T }
+
+// Tuple is a generic type which allows us to
+// return two values of two different types
+type Tuple[A any, B any] struct {
+  A A
+  B B
+}
+
+type Request struct {
+    Foo Foo    `encore:"optional"` // Foo is good
+    Bar string `json:"-"`
+    Baz string `json:"boo"`        // Baz is better
+
+    QueryFoo bool    `query:"foo" encore:"optional"`
+    QueryBar string  `query:"bar" encore:"optional"`
+    HeaderBaz string `header:"baz" encore:"optional"`
+    HeaderInt int    `header:"int" encore:"optional"`
+
+// This is a multiline
+    // comment on the raw message!
+    Raw json.RawMessage
+}
+
+type WrappedRequest = Wrapper[Request]
+
+type GetRequest struct {
+    Bar string `qs:"-"`
+    Baz int    `qs:"boo"`
+}
+
+// Foo represents a documented integer type
+type Foo int
+
+// DocumentedUser represents a user in the system with profile information  
+type DocumentedUser struct {
+    Name  string `json:"name"`
+    Email string `json:"email"`
+}
+
+// DocumentedOrder represents a customer order with references
+type DocumentedOrder struct {
+    // Customer who placed this order (different from shipping recipient)
+    Customer DocumentedUser `json:"customer"`
+    OrderID  string         `json:"order_id"`
+}
+
+type Nested struct {
+    Value string
+}
+
+type AllInputTypes[A any] struct {
+    A time.Time `header:"X-Alice"`               // Specify this comes from a header field
+    B []int     `query:"Bob"`                    // Specify this comes from a query string
+    C bool      `json:"Charlies-Bool,omitempty"` // This can come from anywhere, but if it comes from the payload in JSON it must be called Charile
+    Dave A                                       // This generic type complicates the whole thing 🙈
+
+    // Tags named "-" are ignored in schemas
+    Ignore1 string `header:"-"`
+    Ignore2 string `query:"-"`
+    Ignore3 string `json:"-"`
+
+    // Unexported tags are ignored
+    ignore4 string
+}
+
+// HeaderOnlyStruct contains all types we support in headers
+type HeaderOnlyStruct struct {
+    Boolean bool            `header:"x-boolean"`
+    Int     int             `header:"x-int"`
+    Float   float64         `header:"x-float"`
+    String  string          `header:"x-string"`
+    Bytes   []byte          `header:"x-bytes"`
+    Time    time.Time       `header:"x-time"`
+    Json    json.RawMessage `header:"x-json"`
+    UUID    uuid.UUID       `header:"x-uuid"`
+    UserID  auth.UID        `header:"x-user-id"`
+}
+
+type Recursive struct {
+    Optional *Recursive `encore:"optional"`
+    Slice   []Recursive
+    Map map[string]Recursive
+}
+
+-- svc/api.go --
+package svc
+
+import (
+    "context"
+    "net/http"
+    "app/svc/nested"
+)
+
+// DummyAPI is a dummy endpoint.
+//encore:api public
+func DummyAPI(ctx context.Context, req *Request) error {
+    return nil
+}
+
+//encore:api public method=GET
+func Get(ctx context.Context, req *GetRequest) error {
+    return nil
+}
+
+// TupleInputOutput tests the usage of generics in the client generator
+// and this comment is also multiline, so multiline comments get tested as well.
+//encore:api public
+func TupleInputOutput(ctx context.Context, req Tuple[string, WrappedRequest]) (Tuple[bool, Foo], error) {
+    return nil
+}
+
+//encore:api public path=/path/:a/:b
+func RESTPath(ctx context.Context, a string, b int) error {
+    return nil
+}
+
+//encore:api public raw path=/webhook/:a/*b
+func Webhook(w http.ResponseWriter, req *http.Request) {}
+
+
+//encore:api public path=/webhook2/:a/*b
+func Webhook2(ctx context.Context, a string, b string) error { return nil }
+
+//encore:api public path=/fallbackPath/:a/!b
+func FallbackPath(ctx context.Context, a string, b string) error { return nil }
+
+//encore:api public method=POST
+func RequestWithAllInputTypes(ctx context.Context, req *AllInputTypes[string]) (*AllInputTypes[float64], error) {
+    return nil
+}
+
+//encore:api public method=GET
+func GetRequestWithAllInputTypes(ctx context.Context, req *AllInputTypes[int]) (HeaderOnlyStruct, error) {
+    return nil
+}
+
+//encore:api public method=GET
+func HeaderOnlyRequest(ctx context.Context, req *HeaderOnlyStruct) error {
+    return nil
+}
+
+type WithNested struct {
+    Nested *nested.Type
+}
+
+//encore:api public method=POST
+func Nested(ctx context.Context, req *WithNested) (*WithNested, error) {
+    return nil, nil
+}
+
+//encore:api public method=POST
+func Rec(ctx context.Context, req *Recursive) (*Recursive, error) {
+    return nil, nil
+}
+
+//encore:api public method=POST
+func CreateDocumentedOrder(ctx context.Context, req *DocumentedOrder) (*DocumentedOrder, error) {
+    return req, nil
+}
+-- svc/nested/nested.go --
+package nested
+
+type Type struct {
+    Message string
+}
+
+-- products/product.go --
+package products
+
+import (
+    "context"
+    "time"
+
+    "encore.dev/types/uuid"
+
+    "app/authentication"
+)
+
+type Product struct {
+    ID          uuid.UUID            `json:"id"`
+    Name        string               `json:"name"`
+    Description string               `json:"description,omitempty"`
+    CreatedAt   time.Time            `json:"created_at"`
+    CreatedBy   *authentication.User `json:"created_by"`
+}
+
+type ProductListing struct {
+    Products []*Product `json:"products"`
+
+    PreviousPage struct {
+        Cursor string `json:"cursor,omitempty"`
+        Exists bool   `json:"exists"`
+    } `json:"previous"`
+
+    NextPage struct {
+        Cursor string `json:"cursor,omitempty"`
+        Exists bool   `json:"exists"`
+    } `json:"next"`
+}
+
+type CreateProductRequest struct {
+    IdempotencyKey string `header:"Idempotency-Key"`
+    Name           string `json:"name"`
+    Description    string `json:"description,omitempty"`
+}
+
+//encore:api public method=GET
+func List(ctx context.Context) (*ProductListing, error) {
+    return nil, nil
+}
+
+//encore:api auth
+func Create(ctx context.Context, req *CreateProductRequest) (*Product, error) {
+    return nil, nil
+}
+
+-- authentication/auth.go --
+package authentication
+
+import (
+    "context"
+
+    "encore.dev/beta/auth"
+)
+
+type AuthData struct {
+    APIKey string `header:"X-API-Key"`
+}
+
+type User struct {
+    ID   int     `json:"id"`
+    Name string  `json:"name"`
+}
+
+//encore:authhandler
+func AuthenticateRequest(ctx context.Context, auth *AuthData) (auth.UID, *User, error) {
+    return "", nil, nil
+}
+
+// FooType docs
+type FooType struct {
+    Moo string // Moo docs
+    Bar BarType // Bar docs
+}
+
+// BarType docs
+type BarType struct {
+    Baz string // Baz docs
+}
+
+//encore:api public
+func Docs(ctx context.Context, req *FooType) error {
+    return nil
+}
diff --git a/pkg/clientgen/testdata/goapp/input_baseauth.go b/pkg/clientgen/testdata/goapp/input_baseauth.go
new file mode 100644
index 0000000000..b4dea4d689
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/input_baseauth.go
@@ -0,0 +1,51 @@
+-- go.mod --
+module app
+
+-- encore.app --
+{"id": ""}
+
+-- svc/svc.go --
+package svc
+
+type Request struct {
+	Message string
+}
+
+-- svc/api.go --
+package svc
+
+import (
+	"context"
+	"net/http"
+)
+
+// DummyAPI is a dummy endpoint.
+//encore:api public
+func DummyAPI(ctx context.Context, req *Request) error {
+	return nil
+}
+
+// Private is a basic auth endpoint.
+//encore:api auth
+func Private(ctx context.Context, req *Request) error {
+	return nil
+}
+
+-- authentication/auth.go --
+package authentication
+
+import (
+	"context"
+
+	"encore.dev/beta/auth"
+)
+
+type User struct {
+	ID   int     `json:"id"`
+	Name string  `json:"name"`
+}
+
+//encore:authhandler
+func AuthenticateRequest(ctx context.Context, token string) (auth.UID, *User, error) {
+	return "", nil, nil
+}
diff --git a/pkg/clientgen/testdata/goapp/input_httpstatus.go b/pkg/clientgen/testdata/goapp/input_httpstatus.go
new file mode 100644
index 0000000000..48955e9211
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/input_httpstatus.go
@@ -0,0 +1,27 @@
+-- go.mod --
+module app
+
+-- encore.app --
+{"id": ""}
+
+-- svc/svc.go --
+package svc
+
+type Response struct {
+    Message string
+    Status int `encore:"httpstatus"`
+}
+
+-- svc/api.go --
+package svc
+
+import (
+    "context"
+    "net/http"
+)
+
+// DummyAPI is a dummy endpoint.
+//encore:api public
+func DummyAPI(ctx context.Context) (*Response, error) {
+    return nil, nil
+}
diff --git a/pkg/clientgen/testdata/goapp/input_noauth.go b/pkg/clientgen/testdata/goapp/input_noauth.go
new file mode 100644
index 0000000000..cc7c3b595c
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/input_noauth.go
@@ -0,0 +1,26 @@
+-- go.mod --
+module app
+
+-- encore.app --
+{"id": ""}
+
+-- svc/svc.go --
+package svc
+
+type Request struct {
+    Message string
+}
+
+-- svc/api.go --
+package svc
+
+import (
+    "context"
+    "net/http"
+)
+
+// DummyAPI is a dummy endpoint.
+//encore:api public
+func DummyAPI(ctx context.Context, req *Request) error {
+    return nil
+}
diff --git a/pkg/clientgen/testdata/goapp/tsconfig.json b/pkg/clientgen/testdata/goapp/tsconfig.json
new file mode 100644
index 0000000000..fe4a7d530d
--- /dev/null
+++ b/pkg/clientgen/testdata/goapp/tsconfig.json
@@ -0,0 +1,6 @@
+// Note: this config is here purely to remove errors about promises not being present in IDE's when viewing the expected_typescript.ts file
+{
+  "compilerOptions": {
+    "target": "es2021"
+  }
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_decimal_golang.go b/pkg/clientgen/testdata/tsapp/expected_decimal_golang.go
new file mode 100644
index 0000000000..8e38418f2a
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_decimal_golang.go
@@ -0,0 +1,484 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+)
+
+// Client is an API client for the app Encore application.
+type Client struct {
+	Svc SvcClient
+}
+
+// BaseURL is the base URL for calling the Encore application's API.
+type BaseURL string
+
+const Local BaseURL = "http://localhost:4000"
+
+// Environment returns a BaseURL for calling the cloud environment with the given name.
+func Environment(name string) BaseURL {
+	return BaseURL(fmt.Sprintf("https://%s-app.encr.app", name))
+}
+
+// PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+func PreviewEnv(pr int) BaseURL {
+	return Environment(fmt.Sprintf("pr%d", pr))
+}
+
+// Option allows you to customise the baseClient used by the Client
+type Option = func(client *baseClient) error
+
+// New returns a Client for calling the public and authenticated APIs of your Encore application.
+// You can customize the behaviour of the client using the given Option functions, such as WithHTTPClient or WithAuthFunc.
+func New(target BaseURL, options ...Option) (*Client, error) {
+	// Parse the base URL where the Encore application is being hosted
+	baseURL, err := url.Parse(string(target))
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse base url: %w", err)
+	}
+
+	// Create a client with sensible defaults
+	base := &baseClient{
+		baseURL:    baseURL,
+		httpClient: http.DefaultClient,
+		userAgent:  "app-Generated-Go-Client (Encore/v0.0.0-develop)",
+	}
+
+	// Apply any given options
+	for _, option := range options {
+		if err := option(base); err != nil {
+			return nil, fmt.Errorf("unable to apply client option: %w", err)
+		}
+	}
+
+	return &Client{Svc: &svcClient{base}}, nil
+}
+
+// WithHTTPClient can be used to configure the underlying HTTP client used when making API calls.
+//
+// Defaults to http.DefaultClient
+func WithHTTPClient(client HTTPDoer) Option {
+	return func(base *baseClient) error {
+		base.httpClient = client
+		return nil
+	}
+}
+
+type SvcRequest struct {
+	Message string
+	Val     string
+}
+
+type SvcResponse struct {
+	Result string
+}
+
+// SvcClient Provides you access to call public and authenticated APIs on svc. The concrete implementation is svcClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type SvcClient interface {
+	Dummy(ctx context.Context, params SvcRequest) (SvcResponse, error)
+}
+
+type svcClient struct {
+	base *baseClient
+}
+
+var _ SvcClient = (*svcClient)(nil)
+
+func (c *svcClient) Dummy(ctx context.Context, params SvcRequest) (resp SvcResponse, err error) {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	queryString := url.Values{
+		"message": {reqEncoder.FromString(params.message)},
+		"val":     {reqEncoder.FromString(params.val)},
+	}
+
+	if reqEncoder.LastError != nil {
+		err = fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+		return
+	}
+
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "GET", fmt.Sprintf("/dummy?%s", queryString.Encode()), nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// HTTPDoer is an interface which can be used to swap out the default
+// HTTP client (http.DefaultClient) with your own custom implementation.
+// This can be used to inject middleware or mock responses during unit tests.
+type HTTPDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// baseClient holds all the information we need to make requests to an Encore application
+type baseClient struct {
+	httpClient HTTPDoer // The HTTP client which will be used for all API requests
+	baseURL    *url.URL // The base URL which API requests will be made against
+	userAgent  string   // What user agent we will use in the API requests
+}
+
+// Do sends the req to the Encore application adding the authorization token as required.
+func (b *baseClient) Do(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", b.userAgent)
+
+	// Merge the base URL and the API URL
+	req.URL = b.baseURL.ResolveReference(req.URL)
+	req.Host = req.URL.Host
+
+	// Finally, make the request via the configured HTTP Client
+	return b.httpClient.Do(req)
+}
+
+// callAPI is used by each generated API method to actually make request and decode the responses
+func callAPI(ctx context.Context, client *baseClient, method, path string, headers http.Header, body, resp any) (http.Header, error) {
+	// Encode the API body
+	var bodyReader io.Reader
+	if body != nil {
+		bodyBytes, err := json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("marshal request: %w", err)
+		}
+		bodyReader = bytes.NewReader(bodyBytes)
+	}
+
+	// Create the request
+	req, err := http.NewRequestWithContext(ctx, method, path, bodyReader)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	// Add any headers to the request
+	for header, values := range headers {
+		for _, value := range values {
+			req.Header.Add(header, value)
+		}
+	}
+
+	// Make the request via the base client
+	rawResponse, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer func() {
+		_ = rawResponse.Body.Close()
+	}()
+	if rawResponse.StatusCode >= 400 {
+		// Read the full body sent back
+		body, err := io.ReadAll(rawResponse.Body)
+		if err != nil {
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response without readable body: %s", rawResponse.Status),
+			}
+		}
+
+		// Attempt to decode the error response as a structured APIError
+		apiError := &APIError{}
+		if err := json.Unmarshal(body, apiError); err != nil {
+			// If the error is not a parsable as an APIError, then return an error with the raw body
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response: %s", string(body)),
+			}
+		}
+		return nil, apiError
+	}
+
+	// Decode the response
+	if resp != nil {
+		if err := json.NewDecoder(rawResponse.Body).Decode(resp); err != nil {
+			return nil, fmt.Errorf("decode response: %w", err)
+		}
+	}
+	return rawResponse.Header, nil
+}
+
+// APIError is the error type returned by the API
+type APIError struct {
+	Code    ErrCode `json:"code"`
+	Message string  `json:"message"`
+	Details any     `json:"details"`
+}
+
+func (e *APIError) Error() string {
+	return fmt.Sprintf("%s: %s", e.Code, e.Message)
+}
+
+type ErrCode int
+
+const (
+	// ErrOK indicates the operation was successful.
+	ErrOK ErrCode = 0
+
+	// ErrCanceled indicates the operation was canceled (typically by the caller).
+	//
+	// Encore will generate this error code when cancellation is requested.
+	ErrCanceled ErrCode = 1
+
+	// ErrUnknown error. An example of where this error may be returned is
+	// if a Status value received from another address space belongs to
+	// an error-space that is not known in this address space. Also
+	// errors raised by APIs that do not return enough error information
+	// may be converted to this error.
+	//
+	// Encore will generate this error code in the above two mentioned cases.
+	ErrUnknown ErrCode = 2
+
+	// ErrInvalidArgument indicates client specified an invalid argument.
+	// Note that this differs from FailedPrecondition. It indicates arguments
+	// that are problematic regardless of the state of the system
+	// (e.g., a malformed file name).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInvalidArgument ErrCode = 3
+
+	// ErrDeadlineExceeded means operation expired before completion.
+	// For operations that change the state of the system, this error may be
+	// returned even if the operation has completed successfully. For
+	// example, a successful response from a server could have been delayed
+	// long enough for the deadline to expire.
+	//
+	// The gRPC framework will generate this error code when the deadline is
+	// exceeded.
+	ErrDeadlineExceeded ErrCode = 4
+
+	// ErrNotFound means some requested entity (e.g., file or directory) was
+	// not found.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrNotFound ErrCode = 5
+
+	// ErrAlreadyExists means an attempt to create an entity failed because one
+	// already exists.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrAlreadyExists ErrCode = 6
+
+	// ErrPermissionDenied indicates the caller does not have permission to
+	// execute the specified operation. It must not be used for rejections
+	// caused by exhausting some resource (use ResourceExhausted
+	// instead for those errors). It must not be
+	// used if the caller cannot be identified (use Unauthenticated
+	// instead for those errors).
+	//
+	// This error code will not be generated by the gRPC core framework,
+	// but expect authentication middleware to use it.
+	ErrPermissionDenied ErrCode = 7
+
+	// ErrResourceExhausted indicates some resource has been exhausted, perhaps
+	// a per-user quota, or perhaps the entire file system is out of space.
+	//
+	// This error code will be generated by the gRPC framework in
+	// out-of-memory and server overload situations, or when a message is
+	// larger than the configured maximum size.
+	ErrResourceExhausted ErrCode = 8
+
+	// ErrFailedPrecondition indicates operation was rejected because the
+	// system is not in a state required for the operation's execution.
+	// For example, directory to be deleted may be non-empty, an rmdir
+	// operation is applied to a non-directory, etc.
+	//
+	// A litmus test that may help a service implementor in deciding
+	// between FailedPrecondition, Aborted, and Unavailable:
+	//
+	//	(a) Use Unavailable if the client can retry just the failing call.
+	//	(b) Use Aborted if the client should retry at a higher-level
+	//	    (e.g., restarting a read-modify-write sequence).
+	//	(c) Use FailedPrecondition if the client should not retry until
+	//	    the system state has been explicitly fixed. E.g., if an "rmdir"
+	//	    fails because the directory is non-empty, FailedPrecondition
+	//	    should be returned since the client should not retry unless
+	//	    they have first fixed up the directory by deleting files from it.
+	//	(d) Use FailedPrecondition if the client performs conditional
+	//	    REST Get/Update/Delete on a resource and the resource on the
+	//	    server does not match the condition. E.g., conflicting
+	//	    read-modify-write on the same resource.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrFailedPrecondition ErrCode = 9
+
+	// ErrAborted indicates the operation was aborted, typically due to a
+	// concurrency issue like sequencer check failures, transaction aborts,
+	// etc.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// ErrAborted, and Unavailable.
+	ErrAborted ErrCode = 10
+
+	// ErrOutOfRange means operation was attempted past the valid range.
+	// E.g., seeking or reading past end of file.
+	//
+	// Unlike InvalidArgument, this error indicates a problem that may
+	// be fixed if the system state changes. For example, a 32-bit file
+	// may be rotated to a 64-bit file without error.
+	//
+	// There is a fair bit of overlap between FailedPrecondition and
+	// ErrOutOfRange. We recommend using OutOfRange (the more specific
+	// error) when it applies so that callers who are iterating through
+	// a space can easily look for an OutOfRange error to detect when
+	// they are done.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrOutOfRange ErrCode = 11
+
+	// ErrUnimplemented indicates operation is not implemented or not
+	// supported/enabled in this service.
+	//
+	// This is not an error, but a feature not available.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrUnimplemented ErrCode = 12
+
+	// ErrInternal means some invariant expected by the underlying system has
+	// been broken. This is not a per-message error, it is a global
+	// conditions check.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInternal ErrCode = 13
+
+	// ErrUnavailable indicates the service is currently unavailable.
+	// This is most likely a transient condition, which can be corrected by
+	// retrying with a backoff.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	ErrUnavailable ErrCode = 14
+
+	// ErrDataLoss indicates unrecoverable data loss or corruption.
+	//
+	// This error code is only defined in the gRPC library, and only for
+	// unrecoverable data loss (i.e., data loss resulting from errors
+	// like hard disk corruption or bandwidth exceeded).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrDataLoss ErrCode = 15
+
+	// ErrUnauthenticated indicates the request does not have valid
+	// authentication credentials for the operation.
+	//
+	// The gRPC framework will generate this error code when the
+	// authentication metadata is invalid or a Credentials callback fails,
+	// but also expect authentication middleware to generate it.
+	ErrUnauthenticated ErrCode = 16
+)
+
+// String returns the string representation of the error code
+func (c ErrCode) String() string {
+	switch c {
+	case ErrOK:
+		return "ok"
+	case ErrCanceled:
+		return "canceled"
+	case ErrUnknown:
+		return "unknown"
+	case ErrInvalidArgument:
+		return "invalid_argument"
+	case ErrDeadlineExceeded:
+		return "deadline_exceeded"
+	case ErrNotFound:
+		return "not_found"
+	case ErrAlreadyExists:
+		return "already_exists"
+	case ErrPermissionDenied:
+		return "permission_denied"
+	case ErrResourceExhausted:
+		return "resource_exhausted"
+	case ErrFailedPrecondition:
+		return "failed_precondition"
+	case ErrAborted:
+		return "aborted"
+	case ErrOutOfRange:
+		return "out_of_range"
+	case ErrUnimplemented:
+		return "unimplemented"
+	case ErrInternal:
+		return "internal"
+	case ErrUnavailable:
+		return "unavailable"
+	case ErrDataLoss:
+		return "data_loss"
+	case ErrUnauthenticated:
+		return "unauthenticated"
+	default:
+		return "unknown"
+	}
+}
+
+// MarshalJSON converts the error code to a human-readable string
+func (c ErrCode) MarshalJSON() ([]byte, error) {
+	return []byte(fmt.Sprintf("\"%s\"", c)), nil
+}
+
+// UnmarshalJSON converts the human-readable string to an error code
+func (c *ErrCode) UnmarshalJSON(b []byte) error {
+	switch string(b) {
+	case "\"ok\"":
+		*c = ErrOK
+	case "\"canceled\"":
+		*c = ErrCanceled
+	case "\"unknown\"":
+		*c = ErrUnknown
+	case "\"invalid_argument\"":
+		*c = ErrInvalidArgument
+	case "\"deadline_exceeded\"":
+		*c = ErrDeadlineExceeded
+	case "\"not_found\"":
+		*c = ErrNotFound
+	case "\"already_exists\"":
+		*c = ErrAlreadyExists
+	case "\"permission_denied\"":
+		*c = ErrPermissionDenied
+	case "\"resource_exhausted\"":
+		*c = ErrResourceExhausted
+	case "\"failed_precondition\"":
+		*c = ErrFailedPrecondition
+	case "\"aborted\"":
+		*c = ErrAborted
+	case "\"out_of_range\"":
+		*c = ErrOutOfRange
+	case "\"unimplemented\"":
+		*c = ErrUnimplemented
+	case "\"internal\"":
+		*c = ErrInternal
+	case "\"unavailable\"":
+		*c = ErrUnavailable
+	case "\"data_loss\"":
+		*c = ErrDataLoss
+	case "\"unauthenticated\"":
+		*c = ErrUnauthenticated
+	default:
+		*c = ErrUnknown
+	}
+	return nil
+}
+
+// serde is used to serialize request data into strings and deserialize response data from strings
+type serde struct {
+	LastError      error // The last error that occurred
+	NonEmptyValues int   // The number of values this decoder has decoded
+}
+
+func (e *serde) FromString(s string) (v string) {
+	e.NonEmptyValues++
+	return s
+}
+
+// setErr sets the last error within the object if one is not already set
+func (e *serde) setErr(msg, field string, err error) {
+	if err != nil && e.LastError == nil {
+		e.LastError = fmt.Errorf("%s: %s: %w", field, msg, err)
+	}
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_decimal_javascript.js b/pkg/clientgen/testdata/tsapp/expected_decimal_javascript.js
new file mode 100644
index 0000000000..bea8f9bfe4
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_decimal_javascript.js
@@ -0,0 +1,672 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * Local is the base URL for calling the Encore application's API.
+ */
+export const Local = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name) {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr) {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target = "prod", options = undefined) {
+        const base = new BaseClient(target, options ?? {})
+        this.svc = new svc.ServiceClient(base)
+    }
+}
+
+class SvcServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.dummy = this.dummy.bind(this)
+    }
+
+    async dummy(params) {
+        // Convert our params into the objects we need for the request
+        const query = makeRecord({
+            message: params.message,
+            val:     String(params.val),
+        })
+
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("GET", `/dummy`, undefined, {query})
+        return await resp.json()
+    }
+}
+
+export const svc = {
+    ServiceClient: SvcServiceClient
+}
+
+
+function encodeQuery(parts) {
+    const pairs = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]])
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+function makeRecord(record) {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record
+}
+
+
+function encodeWebSocketHeaders(headers) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    hasUpdateHandlers = [];
+
+    constructor(url, headers) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers));
+        }
+
+        this.ws = new WebSocket(url, protocols);
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type, handler) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type, handler) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut {
+    constructor(url, headers) {
+        let responseResolver;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response() {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+
+const boundFetch = fetch.bind(this)
+
+class BaseClient {
+    constructor(baseURL, options) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-JS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {}
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData() {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : '';
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    async callTypedAPI(method, path, body, params) {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    async callAPI(method, path, body, params) {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+function isAPIErrorResponse(err) {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code) {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    constructor(status, response) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if (Object.setPrototypeOf == undefined) {
+            this.__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if (Error.captureStackTrace !== undefined) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+
+        /**
+         * The HTTP status code associated with the error.
+         */
+        this.status = status
+
+        /**
+         * The Encore error code
+         */
+        this.code = response.code
+
+        /**
+         * The error details
+         */
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err) {
+    return err instanceof APIError;
+}
+
+export const ErrCode = {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK: "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled: "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown: "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument: "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded: "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound: "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists: "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied: "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted: "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition: "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted: "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange: "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented: "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal: "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable: "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss: "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated: "unauthenticated"
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_decimal_typescript.ts b/pkg/clientgen/testdata/tsapp/expected_decimal_typescript.ts
new file mode 100644
index 0000000000..6836b91dd8
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_decimal_typescript.ts
@@ -0,0 +1,756 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+}
+
+export namespace svc {
+    export interface Request {
+        message: string
+        val: string
+    }
+
+    export interface Response {
+        result: string
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.dummy = this.dummy.bind(this)
+        }
+
+        public async dummy(params: Request): Promise<Response> {
+            // Convert our params into the objects we need for the request
+            const query = makeRecord<string, string | string[]>({
+                message: params.message,
+                val:     String(params.val),
+            })
+
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("GET", `/dummy`, undefined, {query})
+            return await resp.json() as Response
+        }
+    }
+}
+
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "method" | "body" | "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_golang.go b/pkg/clientgen/testdata/tsapp/expected_golang.go
new file mode 100644
index 0000000000..d6f3caec3c
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_golang.go
@@ -0,0 +1,699 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"strconv"
+)
+
+// Client is an API client for the app Encore application.
+type Client struct {
+	Svc SvcClient
+}
+
+// BaseURL is the base URL for calling the Encore application's API.
+type BaseURL string
+
+const Local BaseURL = "http://localhost:4000"
+
+// Environment returns a BaseURL for calling the cloud environment with the given name.
+func Environment(name string) BaseURL {
+	return BaseURL(fmt.Sprintf("https://%s-app.encr.app", name))
+}
+
+// PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+func PreviewEnv(pr int) BaseURL {
+	return Environment(fmt.Sprintf("pr%d", pr))
+}
+
+// Option allows you to customise the baseClient used by the Client
+type Option = func(client *baseClient) error
+
+// New returns a Client for calling the public and authenticated APIs of your Encore application.
+// You can customize the behaviour of the client using the given Option functions, such as WithHTTPClient or WithAuthFunc.
+func New(target BaseURL, options ...Option) (*Client, error) {
+	// Parse the base URL where the Encore application is being hosted
+	baseURL, err := url.Parse(string(target))
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse base url: %w", err)
+	}
+
+	// Create a client with sensible defaults
+	base := &baseClient{
+		baseURL:    baseURL,
+		httpClient: http.DefaultClient,
+		userAgent:  "app-Generated-Go-Client (Encore/v0.0.0-develop)",
+	}
+
+	// Apply any given options
+	for _, option := range options {
+		if err := option(base); err != nil {
+			return nil, fmt.Errorf("unable to apply client option: %w", err)
+		}
+	}
+
+	return &Client{Svc: &svcClient{base}}, nil
+}
+
+// WithHTTPClient can be used to configure the underlying HTTP client used when making API calls.
+//
+// Defaults to http.DefaultClient
+func WithHTTPClient(client HTTPDoer) Option {
+	return func(base *baseClient) error {
+		base.httpClient = client
+		return nil
+	}
+}
+
+// WithAuth allows you to set the authentication data to be used with each request
+func WithAuth(auth SvcAuthParams) Option {
+	return func(base *baseClient) error {
+		base.authGenerator = func(_ context.Context) (SvcAuthParams, error) {
+			return auth, nil
+		}
+		return nil
+	}
+}
+
+// WithAuthFunc allows you to pass a function which is called for each request to return the authentication data to be used with each request
+func WithAuthFunc(authGenerator func(ctx context.Context) (SvcAuthParams, error)) Option {
+	return func(base *baseClient) error {
+		base.authGenerator = authGenerator
+		return nil
+	}
+}
+
+type SvcAuthParams struct {
+	Cookie      string `encore:"optional" header:"Cookie,optional"`
+	Token       string `encore:"optional" header:"x-api-token,optional"`
+	CookieValue string `cookie:"actual-cookie,optional" encore:"optional"`
+}
+
+type SvcRequest struct {
+	Foo        float64 `encore:"optional"` // Foo is good
+	Baz        string  // Baz is better
+	QueryFoo   bool    `encore:"optional" query:"foo,optional"`
+	QueryBar   string  `encore:"optional" query:"bar,optional"`
+	HeaderBaz  string  `encore:"optional" header:"baz,optional"`
+	HeaderNum  float64 `encore:"optional" header:"num,optional"`
+	CookieQux  string  `cookie:"qux,optional" encore:"optional"`
+	CookieQuux float64 `cookie:"quux,optional" encore:"optional"`
+}
+
+type SvcRequest struct {
+	Foo        float64 `encore:"optional"` // Foo is good
+	Baz        string  // Baz is better
+	QueryFoo   bool    `encore:"optional" query:"foo,optional"`
+	QueryBar   string  `encore:"optional" query:"bar,optional"`
+	HeaderBaz  string  `encore:"optional" header:"baz,optional"`
+	HeaderNum  float64 `encore:"optional" header:"num,optional"`
+	CookieQux  string  `cookie:"qux,optional" encore:"optional"`
+	CookieQuux float64 `cookie:"quux,optional" encore:"optional"`
+}
+
+type SvcRequest struct {
+	Foo        float64 `encore:"optional"` // Foo is good
+	Baz        string  // Baz is better
+	QueryFoo   bool    `encore:"optional" query:"foo,optional"`
+	QueryBar   string  `encore:"optional" query:"bar,optional"`
+	HeaderBaz  string  `encore:"optional" header:"baz,optional"`
+	HeaderNum  float64 `encore:"optional" header:"num,optional"`
+	CookieQux  string  `cookie:"qux,optional" encore:"optional"`
+	CookieQuux float64 `cookie:"quux,optional" encore:"optional"`
+}
+
+// SvcClient Provides you access to call public and authenticated APIs on svc. The concrete implementation is svcClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type SvcClient interface {
+	CookieDummy(ctx context.Context, params SvcRequest) (struct {
+		Cookie string `cookie:"cookie"`
+	}, error)
+	CookiesOnly(ctx context.Context, params struct {
+		Field string `cookie:"cookie"`
+	}) (struct {
+		Cookie string `cookie:"cookie"`
+	}, error)
+	Dummy(ctx context.Context, params SvcRequest) error
+	Imported(ctx context.Context, params Common_StuffImportedRequest) (Common_StuffImportedResponse, error)
+	NoTypes(ctx context.Context) error
+	OnlyPathParams(ctx context.Context, pathParam string, pathParam2 string) (Common_StuffImportedResponse, error)
+	Root(ctx context.Context, params SvcRequest) error
+}
+
+type svcClient struct {
+	base *baseClient
+}
+
+var _ SvcClient = (*svcClient)(nil)
+
+func (c *svcClient) CookieDummy(ctx context.Context, params SvcRequest) (resp struct {
+	Cookie string `cookie:"cookie"`
+}, err error) {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{
+		"baz": {reqEncoder.FromString(params.headerBaz)},
+		"num": {reqEncoder.FromFloat64(params.headerNum)},
+	}
+
+	queryString := url.Values{
+		"bar": {reqEncoder.FromString(params.queryBar)},
+		"foo": {reqEncoder.FromBool(params.queryFoo)},
+	}
+
+	if reqEncoder.LastError != nil {
+		err = fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+		return
+	}
+
+	// Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+	body := struct {
+		Foo float64 `json:"foo"`
+		Baz string  `json:"baz"`
+	}{
+		baz: params.baz,
+		foo: params.foo,
+	}
+
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", fmt.Sprintf("/cookie-dummy?%s", queryString.Encode()), headers, body, nil)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *svcClient) CookiesOnly(ctx context.Context, params struct {
+	Field string `cookie:"cookie"`
+}) (resp struct {
+	Cookie string `cookie:"cookie"`
+}, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/cookies-only", nil, nil, nil)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *svcClient) Dummy(ctx context.Context, params SvcRequest) error {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{
+		"baz": {reqEncoder.FromString(params.headerBaz)},
+		"num": {reqEncoder.FromFloat64(params.headerNum)},
+	}
+
+	queryString := url.Values{
+		"bar": {reqEncoder.FromString(params.queryBar)},
+		"foo": {reqEncoder.FromBool(params.queryFoo)},
+	}
+
+	if reqEncoder.LastError != nil {
+		return fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+	}
+
+	// Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+	body := struct {
+		Foo float64 `json:"foo"`
+		Baz string  `json:"baz"`
+	}{
+		baz: params.baz,
+		foo: params.foo,
+	}
+
+	_, err := callAPI(ctx, c.base, "POST", fmt.Sprintf("/dummy?%s", queryString.Encode()), headers, body, nil)
+	return err
+}
+
+func (c *svcClient) Imported(ctx context.Context, params Common_StuffImportedRequest) (resp Common_StuffImportedResponse, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", "/imported", nil, params, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *svcClient) NoTypes(ctx context.Context) error {
+	_, err := callAPI(ctx, c.base, "POST", "/type-less", nil, nil, nil)
+	return err
+}
+
+func (c *svcClient) OnlyPathParams(ctx context.Context, pathParam string, pathParam2 string) (resp Common_StuffImportedResponse, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "POST", fmt.Sprintf("/path/%s/%s", url.PathEscape(pathParam), url.PathEscape(pathParam2)), nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+func (c *svcClient) Root(ctx context.Context, params SvcRequest) error {
+	// Convert our params into the objects we need for the request
+	reqEncoder := &serde{}
+
+	headers := http.Header{
+		"baz": {reqEncoder.FromString(params.headerBaz)},
+		"num": {reqEncoder.FromFloat64(params.headerNum)},
+	}
+
+	queryString := url.Values{
+		"bar": {reqEncoder.FromString(params.queryBar)},
+		"foo": {reqEncoder.FromBool(params.queryFoo)},
+	}
+
+	if reqEncoder.LastError != nil {
+		return fmt.Errorf("unable to marshal parameters: %w", reqEncoder.LastError)
+	}
+
+	// Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+	body := struct {
+		Foo float64 `json:"foo"`
+		Baz string  `json:"baz"`
+	}{
+		baz: params.baz,
+		foo: params.foo,
+	}
+
+	_, err := callAPI(ctx, c.base, "POST", fmt.Sprintf("/?%s", queryString.Encode()), headers, body, nil)
+	return err
+}
+
+type Common_StuffImportedRequest struct {
+	Name string
+}
+
+type Common_StuffImportedResponse struct {
+	Message string
+}
+
+// HTTPDoer is an interface which can be used to swap out the default
+// HTTP client (http.DefaultClient) with your own custom implementation.
+// This can be used to inject middleware or mock responses during unit tests.
+type HTTPDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// baseClient holds all the information we need to make requests to an Encore application
+type baseClient struct {
+	authGenerator func(ctx context.Context) (SvcAuthParams, error) // The function which will add the authentication data to the requests
+	httpClient    HTTPDoer                                         // The HTTP client which will be used for all API requests
+	baseURL       *url.URL                                         // The base URL which API requests will be made against
+	userAgent     string                                           // What user agent we will use in the API requests
+}
+
+// Do sends the req to the Encore application adding the authorization token as required.
+func (b *baseClient) Do(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", b.userAgent)
+
+	// If a authorization data generator is present, call it and add the returned token to the request
+	if b.authGenerator != nil {
+		if authData, err := b.authGenerator(req.Context()); err != nil {
+			return nil, fmt.Errorf("unable to create authorization token for api request: %w", err)
+		} else {
+			authEncoder := &serde{}
+
+			// Add the auth fields to the headers
+			req.Header.Set("cookie", authEncoder.FromString(authData.Cookie))
+			req.Header.Set("x-api-token", authEncoder.FromString(authData.Token))
+
+			if authEncoder.LastError != nil {
+				return nil, fmt.Errorf("unable to marshal authentication data: %w", authEncoder.LastError)
+			}
+
+		}
+	}
+
+	// Merge the base URL and the API URL
+	req.URL = b.baseURL.ResolveReference(req.URL)
+	req.Host = req.URL.Host
+
+	// Finally, make the request via the configured HTTP Client
+	return b.httpClient.Do(req)
+}
+
+// callAPI is used by each generated API method to actually make request and decode the responses
+func callAPI(ctx context.Context, client *baseClient, method, path string, headers http.Header, body, resp any) (http.Header, error) {
+	// Encode the API body
+	var bodyReader io.Reader
+	if body != nil {
+		bodyBytes, err := json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("marshal request: %w", err)
+		}
+		bodyReader = bytes.NewReader(bodyBytes)
+	}
+
+	// Create the request
+	req, err := http.NewRequestWithContext(ctx, method, path, bodyReader)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	// Add any headers to the request
+	for header, values := range headers {
+		for _, value := range values {
+			req.Header.Add(header, value)
+		}
+	}
+
+	// Make the request via the base client
+	rawResponse, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer func() {
+		_ = rawResponse.Body.Close()
+	}()
+	if rawResponse.StatusCode >= 400 {
+		// Read the full body sent back
+		body, err := io.ReadAll(rawResponse.Body)
+		if err != nil {
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response without readable body: %s", rawResponse.Status),
+			}
+		}
+
+		// Attempt to decode the error response as a structured APIError
+		apiError := &APIError{}
+		if err := json.Unmarshal(body, apiError); err != nil {
+			// If the error is not a parsable as an APIError, then return an error with the raw body
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response: %s", string(body)),
+			}
+		}
+		return nil, apiError
+	}
+
+	// Decode the response
+	if resp != nil {
+		if err := json.NewDecoder(rawResponse.Body).Decode(resp); err != nil {
+			return nil, fmt.Errorf("decode response: %w", err)
+		}
+	}
+	return rawResponse.Header, nil
+}
+
+// APIError is the error type returned by the API
+type APIError struct {
+	Code    ErrCode `json:"code"`
+	Message string  `json:"message"`
+	Details any     `json:"details"`
+}
+
+func (e *APIError) Error() string {
+	return fmt.Sprintf("%s: %s", e.Code, e.Message)
+}
+
+type ErrCode int
+
+const (
+	// ErrOK indicates the operation was successful.
+	ErrOK ErrCode = 0
+
+	// ErrCanceled indicates the operation was canceled (typically by the caller).
+	//
+	// Encore will generate this error code when cancellation is requested.
+	ErrCanceled ErrCode = 1
+
+	// ErrUnknown error. An example of where this error may be returned is
+	// if a Status value received from another address space belongs to
+	// an error-space that is not known in this address space. Also
+	// errors raised by APIs that do not return enough error information
+	// may be converted to this error.
+	//
+	// Encore will generate this error code in the above two mentioned cases.
+	ErrUnknown ErrCode = 2
+
+	// ErrInvalidArgument indicates client specified an invalid argument.
+	// Note that this differs from FailedPrecondition. It indicates arguments
+	// that are problematic regardless of the state of the system
+	// (e.g., a malformed file name).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInvalidArgument ErrCode = 3
+
+	// ErrDeadlineExceeded means operation expired before completion.
+	// For operations that change the state of the system, this error may be
+	// returned even if the operation has completed successfully. For
+	// example, a successful response from a server could have been delayed
+	// long enough for the deadline to expire.
+	//
+	// The gRPC framework will generate this error code when the deadline is
+	// exceeded.
+	ErrDeadlineExceeded ErrCode = 4
+
+	// ErrNotFound means some requested entity (e.g., file or directory) was
+	// not found.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrNotFound ErrCode = 5
+
+	// ErrAlreadyExists means an attempt to create an entity failed because one
+	// already exists.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrAlreadyExists ErrCode = 6
+
+	// ErrPermissionDenied indicates the caller does not have permission to
+	// execute the specified operation. It must not be used for rejections
+	// caused by exhausting some resource (use ResourceExhausted
+	// instead for those errors). It must not be
+	// used if the caller cannot be identified (use Unauthenticated
+	// instead for those errors).
+	//
+	// This error code will not be generated by the gRPC core framework,
+	// but expect authentication middleware to use it.
+	ErrPermissionDenied ErrCode = 7
+
+	// ErrResourceExhausted indicates some resource has been exhausted, perhaps
+	// a per-user quota, or perhaps the entire file system is out of space.
+	//
+	// This error code will be generated by the gRPC framework in
+	// out-of-memory and server overload situations, or when a message is
+	// larger than the configured maximum size.
+	ErrResourceExhausted ErrCode = 8
+
+	// ErrFailedPrecondition indicates operation was rejected because the
+	// system is not in a state required for the operation's execution.
+	// For example, directory to be deleted may be non-empty, an rmdir
+	// operation is applied to a non-directory, etc.
+	//
+	// A litmus test that may help a service implementor in deciding
+	// between FailedPrecondition, Aborted, and Unavailable:
+	//
+	//	(a) Use Unavailable if the client can retry just the failing call.
+	//	(b) Use Aborted if the client should retry at a higher-level
+	//	    (e.g., restarting a read-modify-write sequence).
+	//	(c) Use FailedPrecondition if the client should not retry until
+	//	    the system state has been explicitly fixed. E.g., if an "rmdir"
+	//	    fails because the directory is non-empty, FailedPrecondition
+	//	    should be returned since the client should not retry unless
+	//	    they have first fixed up the directory by deleting files from it.
+	//	(d) Use FailedPrecondition if the client performs conditional
+	//	    REST Get/Update/Delete on a resource and the resource on the
+	//	    server does not match the condition. E.g., conflicting
+	//	    read-modify-write on the same resource.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrFailedPrecondition ErrCode = 9
+
+	// ErrAborted indicates the operation was aborted, typically due to a
+	// concurrency issue like sequencer check failures, transaction aborts,
+	// etc.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// ErrAborted, and Unavailable.
+	ErrAborted ErrCode = 10
+
+	// ErrOutOfRange means operation was attempted past the valid range.
+	// E.g., seeking or reading past end of file.
+	//
+	// Unlike InvalidArgument, this error indicates a problem that may
+	// be fixed if the system state changes. For example, a 32-bit file
+	// may be rotated to a 64-bit file without error.
+	//
+	// There is a fair bit of overlap between FailedPrecondition and
+	// ErrOutOfRange. We recommend using OutOfRange (the more specific
+	// error) when it applies so that callers who are iterating through
+	// a space can easily look for an OutOfRange error to detect when
+	// they are done.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrOutOfRange ErrCode = 11
+
+	// ErrUnimplemented indicates operation is not implemented or not
+	// supported/enabled in this service.
+	//
+	// This is not an error, but a feature not available.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrUnimplemented ErrCode = 12
+
+	// ErrInternal means some invariant expected by the underlying system has
+	// been broken. This is not a per-message error, it is a global
+	// conditions check.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInternal ErrCode = 13
+
+	// ErrUnavailable indicates the service is currently unavailable.
+	// This is most likely a transient condition, which can be corrected by
+	// retrying with a backoff.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	ErrUnavailable ErrCode = 14
+
+	// ErrDataLoss indicates unrecoverable data loss or corruption.
+	//
+	// This error code is only defined in the gRPC library, and only for
+	// unrecoverable data loss (i.e., data loss resulting from errors
+	// like hard disk corruption or bandwidth exceeded).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrDataLoss ErrCode = 15
+
+	// ErrUnauthenticated indicates the request does not have valid
+	// authentication credentials for the operation.
+	//
+	// The gRPC framework will generate this error code when the
+	// authentication metadata is invalid or a Credentials callback fails,
+	// but also expect authentication middleware to generate it.
+	ErrUnauthenticated ErrCode = 16
+)
+
+// String returns the string representation of the error code
+func (c ErrCode) String() string {
+	switch c {
+	case ErrOK:
+		return "ok"
+	case ErrCanceled:
+		return "canceled"
+	case ErrUnknown:
+		return "unknown"
+	case ErrInvalidArgument:
+		return "invalid_argument"
+	case ErrDeadlineExceeded:
+		return "deadline_exceeded"
+	case ErrNotFound:
+		return "not_found"
+	case ErrAlreadyExists:
+		return "already_exists"
+	case ErrPermissionDenied:
+		return "permission_denied"
+	case ErrResourceExhausted:
+		return "resource_exhausted"
+	case ErrFailedPrecondition:
+		return "failed_precondition"
+	case ErrAborted:
+		return "aborted"
+	case ErrOutOfRange:
+		return "out_of_range"
+	case ErrUnimplemented:
+		return "unimplemented"
+	case ErrInternal:
+		return "internal"
+	case ErrUnavailable:
+		return "unavailable"
+	case ErrDataLoss:
+		return "data_loss"
+	case ErrUnauthenticated:
+		return "unauthenticated"
+	default:
+		return "unknown"
+	}
+}
+
+// MarshalJSON converts the error code to a human-readable string
+func (c ErrCode) MarshalJSON() ([]byte, error) {
+	return []byte(fmt.Sprintf("\"%s\"", c)), nil
+}
+
+// UnmarshalJSON converts the human-readable string to an error code
+func (c *ErrCode) UnmarshalJSON(b []byte) error {
+	switch string(b) {
+	case "\"ok\"":
+		*c = ErrOK
+	case "\"canceled\"":
+		*c = ErrCanceled
+	case "\"unknown\"":
+		*c = ErrUnknown
+	case "\"invalid_argument\"":
+		*c = ErrInvalidArgument
+	case "\"deadline_exceeded\"":
+		*c = ErrDeadlineExceeded
+	case "\"not_found\"":
+		*c = ErrNotFound
+	case "\"already_exists\"":
+		*c = ErrAlreadyExists
+	case "\"permission_denied\"":
+		*c = ErrPermissionDenied
+	case "\"resource_exhausted\"":
+		*c = ErrResourceExhausted
+	case "\"failed_precondition\"":
+		*c = ErrFailedPrecondition
+	case "\"aborted\"":
+		*c = ErrAborted
+	case "\"out_of_range\"":
+		*c = ErrOutOfRange
+	case "\"unimplemented\"":
+		*c = ErrUnimplemented
+	case "\"internal\"":
+		*c = ErrInternal
+	case "\"unavailable\"":
+		*c = ErrUnavailable
+	case "\"data_loss\"":
+		*c = ErrDataLoss
+	case "\"unauthenticated\"":
+		*c = ErrUnauthenticated
+	default:
+		*c = ErrUnknown
+	}
+	return nil
+}
+
+// serde is used to serialize request data into strings and deserialize response data from strings
+type serde struct {
+	LastError      error // The last error that occurred
+	NonEmptyValues int   // The number of values this decoder has decoded
+}
+
+func (e *serde) FromString(s string) (v string) {
+	e.NonEmptyValues++
+	return s
+}
+
+func (e *serde) FromFloat64(s float64) (v string) {
+	e.NonEmptyValues++
+	return strconv.FormatFloat(s, uint8(0x66), -1, 64)
+}
+
+func (e *serde) FromBool(s bool) (v string) {
+	e.NonEmptyValues++
+	return strconv.FormatBool(s)
+}
+
+// setErr sets the last error within the object if one is not already set
+func (e *serde) setErr(msg, field string, err error) {
+	if err != nil && e.LastError == nil {
+		e.LastError = fmt.Errorf("%s: %s: %w", field, msg, err)
+	}
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_httpstatus_golang.go b/pkg/clientgen/testdata/tsapp/expected_httpstatus_golang.go
new file mode 100644
index 0000000000..f9e0361bee
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_httpstatus_golang.go
@@ -0,0 +1,448 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+package client
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+)
+
+// Client is an API client for the app Encore application.
+type Client struct {
+	Svc SvcClient
+}
+
+// BaseURL is the base URL for calling the Encore application's API.
+type BaseURL string
+
+const Local BaseURL = "http://localhost:4000"
+
+// Environment returns a BaseURL for calling the cloud environment with the given name.
+func Environment(name string) BaseURL {
+	return BaseURL(fmt.Sprintf("https://%s-app.encr.app", name))
+}
+
+// PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+func PreviewEnv(pr int) BaseURL {
+	return Environment(fmt.Sprintf("pr%d", pr))
+}
+
+// Option allows you to customise the baseClient used by the Client
+type Option = func(client *baseClient) error
+
+// New returns a Client for calling the public and authenticated APIs of your Encore application.
+// You can customize the behaviour of the client using the given Option functions, such as WithHTTPClient or WithAuthFunc.
+func New(target BaseURL, options ...Option) (*Client, error) {
+	// Parse the base URL where the Encore application is being hosted
+	baseURL, err := url.Parse(string(target))
+	if err != nil {
+		return nil, fmt.Errorf("unable to parse base url: %w", err)
+	}
+
+	// Create a client with sensible defaults
+	base := &baseClient{
+		baseURL:    baseURL,
+		httpClient: http.DefaultClient,
+		userAgent:  "app-Generated-Go-Client (Encore/v0.0.0-develop)",
+	}
+
+	// Apply any given options
+	for _, option := range options {
+		if err := option(base); err != nil {
+			return nil, fmt.Errorf("unable to apply client option: %w", err)
+		}
+	}
+
+	return &Client{Svc: &svcClient{base}}, nil
+}
+
+// WithHTTPClient can be used to configure the underlying HTTP client used when making API calls.
+//
+// Defaults to http.DefaultClient
+func WithHTTPClient(client HTTPDoer) Option {
+	return func(base *baseClient) error {
+		base.httpClient = client
+		return nil
+	}
+}
+
+type SvcResponse struct {
+	Message string
+}
+
+// SvcClient Provides you access to call public and authenticated APIs on svc. The concrete implementation is svcClient.
+// It is setup as an interface allowing you to use GoMock to create mock implementations during tests.
+type SvcClient interface {
+	Dummy(ctx context.Context) (SvcResponse, error)
+}
+
+type svcClient struct {
+	base *baseClient
+}
+
+var _ SvcClient = (*svcClient)(nil)
+
+func (c *svcClient) Dummy(ctx context.Context) (resp SvcResponse, err error) {
+	// Now make the actual call to the API
+	_, err = callAPI(ctx, c.base, "GET", "/dummy", nil, nil, &resp)
+	if err != nil {
+		return
+	}
+
+	return
+}
+
+// HTTPDoer is an interface which can be used to swap out the default
+// HTTP client (http.DefaultClient) with your own custom implementation.
+// This can be used to inject middleware or mock responses during unit tests.
+type HTTPDoer interface {
+	Do(req *http.Request) (*http.Response, error)
+}
+
+// baseClient holds all the information we need to make requests to an Encore application
+type baseClient struct {
+	httpClient HTTPDoer // The HTTP client which will be used for all API requests
+	baseURL    *url.URL // The base URL which API requests will be made against
+	userAgent  string   // What user agent we will use in the API requests
+}
+
+// Do sends the req to the Encore application adding the authorization token as required.
+func (b *baseClient) Do(req *http.Request) (*http.Response, error) {
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("User-Agent", b.userAgent)
+
+	// Merge the base URL and the API URL
+	req.URL = b.baseURL.ResolveReference(req.URL)
+	req.Host = req.URL.Host
+
+	// Finally, make the request via the configured HTTP Client
+	return b.httpClient.Do(req)
+}
+
+// callAPI is used by each generated API method to actually make request and decode the responses
+func callAPI(ctx context.Context, client *baseClient, method, path string, headers http.Header, body, resp any) (http.Header, error) {
+	// Encode the API body
+	var bodyReader io.Reader
+	if body != nil {
+		bodyBytes, err := json.Marshal(body)
+		if err != nil {
+			return nil, fmt.Errorf("marshal request: %w", err)
+		}
+		bodyReader = bytes.NewReader(bodyBytes)
+	}
+
+	// Create the request
+	req, err := http.NewRequestWithContext(ctx, method, path, bodyReader)
+	if err != nil {
+		return nil, fmt.Errorf("create request: %w", err)
+	}
+
+	// Add any headers to the request
+	for header, values := range headers {
+		for _, value := range values {
+			req.Header.Add(header, value)
+		}
+	}
+
+	// Make the request via the base client
+	rawResponse, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("request failed: %w", err)
+	}
+	defer func() {
+		_ = rawResponse.Body.Close()
+	}()
+	if rawResponse.StatusCode >= 400 {
+		// Read the full body sent back
+		body, err := io.ReadAll(rawResponse.Body)
+		if err != nil {
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response without readable body: %s", rawResponse.Status),
+			}
+		}
+
+		// Attempt to decode the error response as a structured APIError
+		apiError := &APIError{}
+		if err := json.Unmarshal(body, apiError); err != nil {
+			// If the error is not a parsable as an APIError, then return an error with the raw body
+			return nil, &APIError{
+				Code:    ErrUnknown,
+				Message: fmt.Sprintf("got error response: %s", string(body)),
+			}
+		}
+		return nil, apiError
+	}
+
+	// Decode the response
+	if resp != nil {
+		if err := json.NewDecoder(rawResponse.Body).Decode(resp); err != nil {
+			return nil, fmt.Errorf("decode response: %w", err)
+		}
+	}
+	return rawResponse.Header, nil
+}
+
+// APIError is the error type returned by the API
+type APIError struct {
+	Code    ErrCode `json:"code"`
+	Message string  `json:"message"`
+	Details any     `json:"details"`
+}
+
+func (e *APIError) Error() string {
+	return fmt.Sprintf("%s: %s", e.Code, e.Message)
+}
+
+type ErrCode int
+
+const (
+	// ErrOK indicates the operation was successful.
+	ErrOK ErrCode = 0
+
+	// ErrCanceled indicates the operation was canceled (typically by the caller).
+	//
+	// Encore will generate this error code when cancellation is requested.
+	ErrCanceled ErrCode = 1
+
+	// ErrUnknown error. An example of where this error may be returned is
+	// if a Status value received from another address space belongs to
+	// an error-space that is not known in this address space. Also
+	// errors raised by APIs that do not return enough error information
+	// may be converted to this error.
+	//
+	// Encore will generate this error code in the above two mentioned cases.
+	ErrUnknown ErrCode = 2
+
+	// ErrInvalidArgument indicates client specified an invalid argument.
+	// Note that this differs from FailedPrecondition. It indicates arguments
+	// that are problematic regardless of the state of the system
+	// (e.g., a malformed file name).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInvalidArgument ErrCode = 3
+
+	// ErrDeadlineExceeded means operation expired before completion.
+	// For operations that change the state of the system, this error may be
+	// returned even if the operation has completed successfully. For
+	// example, a successful response from a server could have been delayed
+	// long enough for the deadline to expire.
+	//
+	// The gRPC framework will generate this error code when the deadline is
+	// exceeded.
+	ErrDeadlineExceeded ErrCode = 4
+
+	// ErrNotFound means some requested entity (e.g., file or directory) was
+	// not found.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrNotFound ErrCode = 5
+
+	// ErrAlreadyExists means an attempt to create an entity failed because one
+	// already exists.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrAlreadyExists ErrCode = 6
+
+	// ErrPermissionDenied indicates the caller does not have permission to
+	// execute the specified operation. It must not be used for rejections
+	// caused by exhausting some resource (use ResourceExhausted
+	// instead for those errors). It must not be
+	// used if the caller cannot be identified (use Unauthenticated
+	// instead for those errors).
+	//
+	// This error code will not be generated by the gRPC core framework,
+	// but expect authentication middleware to use it.
+	ErrPermissionDenied ErrCode = 7
+
+	// ErrResourceExhausted indicates some resource has been exhausted, perhaps
+	// a per-user quota, or perhaps the entire file system is out of space.
+	//
+	// This error code will be generated by the gRPC framework in
+	// out-of-memory and server overload situations, or when a message is
+	// larger than the configured maximum size.
+	ErrResourceExhausted ErrCode = 8
+
+	// ErrFailedPrecondition indicates operation was rejected because the
+	// system is not in a state required for the operation's execution.
+	// For example, directory to be deleted may be non-empty, an rmdir
+	// operation is applied to a non-directory, etc.
+	//
+	// A litmus test that may help a service implementor in deciding
+	// between FailedPrecondition, Aborted, and Unavailable:
+	//
+	//	(a) Use Unavailable if the client can retry just the failing call.
+	//	(b) Use Aborted if the client should retry at a higher-level
+	//	    (e.g., restarting a read-modify-write sequence).
+	//	(c) Use FailedPrecondition if the client should not retry until
+	//	    the system state has been explicitly fixed. E.g., if an "rmdir"
+	//	    fails because the directory is non-empty, FailedPrecondition
+	//	    should be returned since the client should not retry unless
+	//	    they have first fixed up the directory by deleting files from it.
+	//	(d) Use FailedPrecondition if the client performs conditional
+	//	    REST Get/Update/Delete on a resource and the resource on the
+	//	    server does not match the condition. E.g., conflicting
+	//	    read-modify-write on the same resource.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrFailedPrecondition ErrCode = 9
+
+	// ErrAborted indicates the operation was aborted, typically due to a
+	// concurrency issue like sequencer check failures, transaction aborts,
+	// etc.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// ErrAborted, and Unavailable.
+	ErrAborted ErrCode = 10
+
+	// ErrOutOfRange means operation was attempted past the valid range.
+	// E.g., seeking or reading past end of file.
+	//
+	// Unlike InvalidArgument, this error indicates a problem that may
+	// be fixed if the system state changes. For example, a 32-bit file
+	// may be rotated to a 64-bit file without error.
+	//
+	// There is a fair bit of overlap between FailedPrecondition and
+	// ErrOutOfRange. We recommend using OutOfRange (the more specific
+	// error) when it applies so that callers who are iterating through
+	// a space can easily look for an OutOfRange error to detect when
+	// they are done.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrOutOfRange ErrCode = 11
+
+	// ErrUnimplemented indicates operation is not implemented or not
+	// supported/enabled in this service.
+	//
+	// This is not an error, but a feature not available.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrUnimplemented ErrCode = 12
+
+	// ErrInternal means some invariant expected by the underlying system has
+	// been broken. This is not a per-message error, it is a global
+	// conditions check.
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrInternal ErrCode = 13
+
+	// ErrUnavailable indicates the service is currently unavailable.
+	// This is most likely a transient condition, which can be corrected by
+	// retrying with a backoff.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	ErrUnavailable ErrCode = 14
+
+	// ErrDataLoss indicates unrecoverable data loss or corruption.
+	//
+	// This error code is only defined in the gRPC library, and only for
+	// unrecoverable data loss (i.e., data loss resulting from errors
+	// like hard disk corruption or bandwidth exceeded).
+	//
+	// This error code will not be generated by the gRPC framework.
+	ErrDataLoss ErrCode = 15
+
+	// ErrUnauthenticated indicates the request does not have valid
+	// authentication credentials for the operation.
+	//
+	// The gRPC framework will generate this error code when the
+	// authentication metadata is invalid or a Credentials callback fails,
+	// but also expect authentication middleware to generate it.
+	ErrUnauthenticated ErrCode = 16
+)
+
+// String returns the string representation of the error code
+func (c ErrCode) String() string {
+	switch c {
+	case ErrOK:
+		return "ok"
+	case ErrCanceled:
+		return "canceled"
+	case ErrUnknown:
+		return "unknown"
+	case ErrInvalidArgument:
+		return "invalid_argument"
+	case ErrDeadlineExceeded:
+		return "deadline_exceeded"
+	case ErrNotFound:
+		return "not_found"
+	case ErrAlreadyExists:
+		return "already_exists"
+	case ErrPermissionDenied:
+		return "permission_denied"
+	case ErrResourceExhausted:
+		return "resource_exhausted"
+	case ErrFailedPrecondition:
+		return "failed_precondition"
+	case ErrAborted:
+		return "aborted"
+	case ErrOutOfRange:
+		return "out_of_range"
+	case ErrUnimplemented:
+		return "unimplemented"
+	case ErrInternal:
+		return "internal"
+	case ErrUnavailable:
+		return "unavailable"
+	case ErrDataLoss:
+		return "data_loss"
+	case ErrUnauthenticated:
+		return "unauthenticated"
+	default:
+		return "unknown"
+	}
+}
+
+// MarshalJSON converts the error code to a human-readable string
+func (c ErrCode) MarshalJSON() ([]byte, error) {
+	return []byte(fmt.Sprintf("\"%s\"", c)), nil
+}
+
+// UnmarshalJSON converts the human-readable string to an error code
+func (c *ErrCode) UnmarshalJSON(b []byte) error {
+	switch string(b) {
+	case "\"ok\"":
+		*c = ErrOK
+	case "\"canceled\"":
+		*c = ErrCanceled
+	case "\"unknown\"":
+		*c = ErrUnknown
+	case "\"invalid_argument\"":
+		*c = ErrInvalidArgument
+	case "\"deadline_exceeded\"":
+		*c = ErrDeadlineExceeded
+	case "\"not_found\"":
+		*c = ErrNotFound
+	case "\"already_exists\"":
+		*c = ErrAlreadyExists
+	case "\"permission_denied\"":
+		*c = ErrPermissionDenied
+	case "\"resource_exhausted\"":
+		*c = ErrResourceExhausted
+	case "\"failed_precondition\"":
+		*c = ErrFailedPrecondition
+	case "\"aborted\"":
+		*c = ErrAborted
+	case "\"out_of_range\"":
+		*c = ErrOutOfRange
+	case "\"unimplemented\"":
+		*c = ErrUnimplemented
+	case "\"internal\"":
+		*c = ErrInternal
+	case "\"unavailable\"":
+		*c = ErrUnavailable
+	case "\"data_loss\"":
+		*c = ErrDataLoss
+	case "\"unauthenticated\"":
+		*c = ErrUnauthenticated
+	default:
+		*c = ErrUnknown
+	}
+	return nil
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_httpstatus_typescript.ts b/pkg/clientgen/testdata/tsapp/expected_httpstatus_typescript.ts
new file mode 100644
index 0000000000..4f12583833
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_httpstatus_typescript.ts
@@ -0,0 +1,745 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+}
+
+export namespace svc {
+    export interface Response {
+        message: string
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.dummy = this.dummy.bind(this)
+        }
+
+        public async dummy(): Promise<Response> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("GET", `/dummy`)
+            return await resp.json() as Response
+        }
+    }
+}
+
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "method" | "body" | "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_javascript.js b/pkg/clientgen/testdata/tsapp/expected_javascript.js
new file mode 100644
index 0000000000..bab9b878ed
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_javascript.js
@@ -0,0 +1,787 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * Local is the base URL for calling the Encore application's API.
+ */
+export const Local = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name) {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr) {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target = "prod", options = undefined) {
+        const base = new BaseClient(target, options ?? {})
+        this.svc = new svc.ServiceClient(base)
+    }
+}
+
+class SvcServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.cookieDummy = this.cookieDummy.bind(this)
+        this.cookiesOnly = this.cookiesOnly.bind(this)
+        this.dummy = this.dummy.bind(this)
+        this.imported = this.imported.bind(this)
+        this.noTypes = this.noTypes.bind(this)
+        this.onlyPathParams = this.onlyPathParams.bind(this)
+        this.root = this.root.bind(this)
+    }
+
+    async cookieDummy(params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            baz: params.headerBaz,
+            num: params.headerNum === undefined ? undefined : String(params.headerNum),
+        })
+
+        const query = makeRecord({
+            bar: params.queryBar,
+            foo: params.queryFoo === undefined ? undefined : String(params.queryFoo),
+        })
+
+        // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+        const body = {
+            baz: params.baz,
+            foo: params.foo,
+        }
+
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/cookie-dummy`, JSON.stringify(body), {headers, query})
+        return await resp.json()
+    }
+
+    async cookiesOnly(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/cookies-only`)
+        return await resp.json()
+    }
+
+    async dummy(params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            baz: params.headerBaz,
+            num: params.headerNum === undefined ? undefined : String(params.headerNum),
+        })
+
+        const query = makeRecord({
+            bar: params.queryBar,
+            foo: params.queryFoo === undefined ? undefined : String(params.queryFoo),
+        })
+
+        // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+        const body = {
+            baz: params.baz,
+            foo: params.foo,
+        }
+
+        await this.baseClient.callTypedAPI("POST", `/dummy`, JSON.stringify(body), {headers, query})
+    }
+
+    async imported(params) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/imported`, JSON.stringify(params))
+        return await resp.json()
+    }
+
+    async noTypes() {
+        await this.baseClient.callTypedAPI("POST", `/type-less`)
+    }
+
+    async onlyPathParams(pathParam, pathParam2) {
+        // Now make the actual call to the API
+        const resp = await this.baseClient.callTypedAPI("POST", `/path/${encodeURIComponent(pathParam)}/${encodeURIComponent(pathParam2)}`)
+        return await resp.json()
+    }
+
+    async root(params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            baz: params.headerBaz,
+            num: params.headerNum === undefined ? undefined : String(params.headerNum),
+        })
+
+        const query = makeRecord({
+            bar: params.queryBar,
+            foo: params.queryFoo === undefined ? undefined : String(params.queryFoo),
+        })
+
+        // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+        const body = {
+            baz: params.baz,
+            foo: params.foo,
+        }
+
+        await this.baseClient.callTypedAPI("POST", `/`, JSON.stringify(body), {headers, query})
+    }
+}
+
+export const svc = {
+    ServiceClient: SvcServiceClient
+}
+
+
+function encodeQuery(parts) {
+    const pairs = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]])
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+function makeRecord(record) {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record
+}
+
+
+function encodeWebSocketHeaders(headers) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    hasUpdateHandlers = [];
+
+    constructor(url, headers) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers));
+        }
+
+        this.ws = new WebSocket(url, protocols);
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type, handler) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type, handler) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut {
+    constructor(url, headers) {
+        let responseResolver;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response() {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+
+const boundFetch = fetch.bind(this)
+
+class BaseClient {
+    constructor(baseURL, options) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-JS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {}
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+
+        // Setup an authentication data generator using the auth data token option
+        if (options.auth !== undefined) {
+            const auth = options.auth
+            if (typeof auth === "function") {
+                this.authGenerator = auth
+            } else {
+                this.authGenerator = () => auth
+            }
+        }
+
+    }
+
+    async getAuthData() {
+        let authData;
+
+        // If authorization data generator is present, call it and add the returned data to the request
+        if (this.authGenerator) {
+            const mayBePromise = this.authGenerator();
+            if (mayBePromise instanceof Promise) {
+                authData = await mayBePromise;
+            } else {
+                authData = mayBePromise;
+            }
+        }
+
+        if (authData) {
+            const data = {};
+
+            data.headers = makeRecord({
+                cookie:        authData.cookie,
+                "x-api-token": authData.token,
+            })
+
+            return data;
+        }
+
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : '';
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    async callTypedAPI(method, path, body, params) {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    async callAPI(method, path, body, params) {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+function isAPIErrorResponse(err) {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code) {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    constructor(status, response) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if (Object.setPrototypeOf == undefined) {
+            this.__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if (Error.captureStackTrace !== undefined) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+
+        /**
+         * The HTTP status code associated with the error.
+         */
+        this.status = status
+
+        /**
+         * The Encore error code
+         */
+        this.code = response.code
+
+        /**
+         * The error details
+         */
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err) {
+    return err instanceof APIError;
+}
+
+export const ErrCode = {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK: "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled: "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown: "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument: "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded: "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound: "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists: "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied: "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted: "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition: "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted: "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange: "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented: "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal: "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable: "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss: "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated: "unauthenticated"
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_list_of_union_javascript.js b/pkg/clientgen/testdata/tsapp/expected_list_of_union_javascript.js
new file mode 100644
index 0000000000..7d74ddf774
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_list_of_union_javascript.js
@@ -0,0 +1,669 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * Local is the base URL for calling the Encore application's API.
+ */
+export const Local = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name) {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr) {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target = "prod", options = undefined) {
+        const base = new BaseClient(target, options ?? {})
+        this.svc = new svc.ServiceClient(base)
+    }
+}
+
+class SvcServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.dummy = this.dummy.bind(this)
+    }
+
+    async dummy(params) {
+        // Convert our params into the objects we need for the request
+        const query = makeRecord({
+            listOfUnion: params.listOfUnion.map((v) => String(v)),
+        })
+
+        await this.baseClient.callTypedAPI("GET", `/dummy`, undefined, {query})
+    }
+}
+
+export const svc = {
+    ServiceClient: SvcServiceClient
+}
+
+
+function encodeQuery(parts) {
+    const pairs = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]])
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+function makeRecord(record) {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record
+}
+
+
+function encodeWebSocketHeaders(headers) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    hasUpdateHandlers = [];
+
+    constructor(url, headers) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers));
+        }
+
+        this.ws = new WebSocket(url, protocols);
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type, handler) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type, handler) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut {
+    constructor(url, headers) {
+        let responseResolver;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response() {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+
+const boundFetch = fetch.bind(this)
+
+class BaseClient {
+    constructor(baseURL, options) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-JS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {}
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData() {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : '';
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    async callTypedAPI(method, path, body, params) {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    async callAPI(method, path, body, params) {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+function isAPIErrorResponse(err) {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code) {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    constructor(status, response) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if (Object.setPrototypeOf == undefined) {
+            this.__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if (Error.captureStackTrace !== undefined) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+
+        /**
+         * The HTTP status code associated with the error.
+         */
+        this.status = status
+
+        /**
+         * The Encore error code
+         */
+        this.code = response.code
+
+        /**
+         * The error details
+         */
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err) {
+    return err instanceof APIError;
+}
+
+export const ErrCode = {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK: "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled: "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown: "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument: "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded: "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound: "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists: "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied: "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted: "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition: "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted: "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange: "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented: "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal: "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable: "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss: "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated: "unauthenticated"
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_list_of_union_shared.ts b/pkg/clientgen/testdata/tsapp/expected_list_of_union_shared.ts
new file mode 100644
index 0000000000..0bf3d00a88
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_list_of_union_shared.ts
@@ -0,0 +1,799 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+import type { CookieWithOptions } from "encore.dev/api";
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+}
+
+/**
+ * Import the endpoint handlers to derive the types for the client.
+ */
+import { dummy as api_svc_svc_dummy } from "~backend/svc/svc";
+
+export namespace svc {
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.dummy = this.dummy.bind(this)
+        }
+
+        public async dummy(params: RequestType<typeof api_svc_svc_dummy>): Promise<void> {
+            // Convert our params into the objects we need for the request
+            const query = makeRecord<string, string | string[]>({
+                listOfUnion: params.listOfUnion.map((v) => String(v)),
+            })
+
+            await this.baseClient.callTypedAPI(`/dummy`, {query, method: "GET", body: undefined})
+        }
+    }
+}
+
+
+type PickMethods<Type> = Omit<CallParameters, "method"> & { method?: Type };
+
+// Helper type to omit all fields that are cookies.
+type OmitCookie<T> = {
+  [K in keyof T as T[K] extends CookieWithOptions<any> ? never : K]: T[K];
+};
+
+type RequestType<Type extends (...args: any[]) => any> =
+  Parameters<Type> extends [infer H, ...any[]]
+    ? OmitCookie<H>
+    : void;
+
+type ResponseType<Type extends (...args: any[]) => any> = OmitCookie<Awaited<ReturnType<Type>>>;
+
+function dateReviver(key: string, value: any): any {
+  if (
+    typeof value === "string" &&
+    value.length >= 10 &&
+    value.charCodeAt(0) >= 48 && // '0'
+    value.charCodeAt(0) <= 57 // '9'
+  ) {
+    const parsedDate = new Date(value);
+    if (!isNaN(parsedDate.getTime())) {
+      return parsedDate;
+    }
+  }
+  return value;
+}
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+import {
+  StreamInOutHandlerFn,
+  StreamInHandlerFn,
+  StreamOutHandlerFn,
+} from "encore.dev/api";
+
+type StreamRequest<Type> = Type extends
+  | StreamInOutHandlerFn<any, infer Req, any>
+  | StreamInHandlerFn<any, infer Req, any>
+  | StreamOutHandlerFn<any, any>
+  ? Req
+  : never;
+
+type StreamResponse<Type> = Type extends
+  | StreamInOutHandlerFn<any, any, infer Resp>
+  | StreamInHandlerFn<any, any, infer Resp>
+  | StreamOutHandlerFn<any, infer Resp>
+  ? Resp
+  : never;
+
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data, dateReviver));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data, dateReviver));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data, dateReviver))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(path: string, params?: CallParameters): Promise<Response> {
+        return this.callAPI(path, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(path: string, params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_list_of_union_typescript.ts b/pkg/clientgen/testdata/tsapp/expected_list_of_union_typescript.ts
new file mode 100644
index 0000000000..1eac45fe16
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_list_of_union_typescript.ts
@@ -0,0 +1,748 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+}
+
+export namespace svc {
+    export interface Request {
+        listOfUnion: ("a" | "b")[]
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.dummy = this.dummy.bind(this)
+        }
+
+        public async dummy(params: Request): Promise<void> {
+            // Convert our params into the objects we need for the request
+            const query = makeRecord<string, string | string[]>({
+                listOfUnion: params.listOfUnion.map((v) => String(v)),
+            })
+
+            await this.baseClient.callTypedAPI("GET", `/dummy`, undefined, {query})
+        }
+    }
+}
+
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "method" | "body" | "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_shared.ts b/pkg/clientgen/testdata/tsapp/expected_shared.ts
new file mode 100644
index 0000000000..1743f69568
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_shared.ts
@@ -0,0 +1,941 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+import type { CookieWithOptions } from "encore.dev/api";
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * Import the auth handler to be able to derive the auth type
+ */
+import type { auth as auth_auth } from "~backend/svc/svc";
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    /**
+     * Allows you to set the authentication data to be used for each
+     * request either by passing in a static object or by passing in
+     * a function which returns a new object for each request.
+     */
+    auth?: RequestType<typeof auth_auth> | AuthDataGenerator
+}
+
+/**
+ * Import the endpoint handlers to derive the types for the client.
+ */
+import {
+    cookieDummy as api_svc_svc_cookieDummy,
+    cookiesOnly as api_svc_svc_cookiesOnly,
+    dummy as api_svc_svc_dummy,
+    imported as api_svc_svc_imported,
+    onlyPathParams as api_svc_svc_onlyPathParams,
+    root as api_svc_svc_root
+} from "~backend/svc/svc";
+
+export namespace svc {
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.cookieDummy = this.cookieDummy.bind(this)
+            this.cookiesOnly = this.cookiesOnly.bind(this)
+            this.dummy = this.dummy.bind(this)
+            this.imported = this.imported.bind(this)
+            this.noTypes = this.noTypes.bind(this)
+            this.onlyPathParams = this.onlyPathParams.bind(this)
+            this.root = this.root.bind(this)
+        }
+
+        public async cookieDummy(params: RequestType<typeof api_svc_svc_cookieDummy>): Promise<ResponseType<typeof api_svc_svc_cookieDummy>> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                baz: params.headerBaz,
+                num: params.headerNum === undefined ? undefined : String(params.headerNum),
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                bar: params.queryBar,
+                foo: params.queryFoo === undefined ? undefined : String(params.queryFoo),
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                baz: params.baz,
+                foo: params.foo,
+            }
+
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI(`/cookie-dummy`, {headers, query, method: "POST", body: JSON.stringify(body)})
+            return JSON.parse(await resp.text(), dateReviver) as ResponseType<typeof api_svc_svc_cookieDummy>
+        }
+
+        public async cookiesOnly(params: RequestType<typeof api_svc_svc_cookiesOnly>): Promise<ResponseType<typeof api_svc_svc_cookiesOnly>> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI(`/cookies-only`, {method: "POST", body: undefined})
+            return JSON.parse(await resp.text(), dateReviver) as ResponseType<typeof api_svc_svc_cookiesOnly>
+        }
+
+        public async dummy(params: RequestType<typeof api_svc_svc_dummy>): Promise<void> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                baz: params.headerBaz,
+                num: params.headerNum === undefined ? undefined : String(params.headerNum),
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                bar: params.queryBar,
+                foo: params.queryFoo === undefined ? undefined : String(params.queryFoo),
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                baz: params.baz,
+                foo: params.foo,
+            }
+
+            await this.baseClient.callTypedAPI(`/dummy`, {headers, query, method: "POST", body: JSON.stringify(body)})
+        }
+
+        public async imported(params: RequestType<typeof api_svc_svc_imported>): Promise<ResponseType<typeof api_svc_svc_imported>> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI(`/imported`, {method: "POST", body: JSON.stringify(params)})
+            return JSON.parse(await resp.text(), dateReviver) as ResponseType<typeof api_svc_svc_imported>
+        }
+
+        public async noTypes(): Promise<void> {
+            await this.baseClient.callTypedAPI(`/type-less`, {method: "POST", body: undefined})
+        }
+
+        public async onlyPathParams(params: { pathParam: string, pathParam2: string }): Promise<ResponseType<typeof api_svc_svc_onlyPathParams>> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI(`/path/${encodeURIComponent(params.pathParam)}/${encodeURIComponent(params.pathParam2)}`, {method: "POST", body: undefined})
+            return JSON.parse(await resp.text(), dateReviver) as ResponseType<typeof api_svc_svc_onlyPathParams>
+        }
+
+        public async root(params: RequestType<typeof api_svc_svc_root>): Promise<void> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                baz: params.headerBaz,
+                num: params.headerNum === undefined ? undefined : String(params.headerNum),
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                bar: params.queryBar,
+                foo: params.queryFoo === undefined ? undefined : String(params.queryFoo),
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                baz: params.baz,
+                foo: params.foo,
+            }
+
+            await this.baseClient.callTypedAPI(`/`, {headers, query, method: "POST", body: JSON.stringify(body)})
+        }
+    }
+}
+
+
+type PickMethods<Type> = Omit<CallParameters, "method"> & { method?: Type };
+
+// Helper type to omit all fields that are cookies.
+type OmitCookie<T> = {
+  [K in keyof T as T[K] extends CookieWithOptions<any> ? never : K]: T[K];
+};
+
+type RequestType<Type extends (...args: any[]) => any> =
+  Parameters<Type> extends [infer H, ...any[]]
+    ? OmitCookie<H>
+    : void;
+
+type ResponseType<Type extends (...args: any[]) => any> = OmitCookie<Awaited<ReturnType<Type>>>;
+
+function dateReviver(key: string, value: any): any {
+  if (
+    typeof value === "string" &&
+    value.length >= 10 &&
+    value.charCodeAt(0) >= 48 && // '0'
+    value.charCodeAt(0) <= 57 // '9'
+  ) {
+    const parsedDate = new Date(value);
+    if (!isNaN(parsedDate.getTime())) {
+      return parsedDate;
+    }
+  }
+  return value;
+}
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+import {
+  StreamInOutHandlerFn,
+  StreamInHandlerFn,
+  StreamOutHandlerFn,
+} from "encore.dev/api";
+
+type StreamRequest<Type> = Type extends
+  | StreamInOutHandlerFn<any, infer Req, any>
+  | StreamInHandlerFn<any, infer Req, any>
+  | StreamOutHandlerFn<any, any>
+  ? Req
+  : never;
+
+type StreamResponse<Type> = Type extends
+  | StreamInOutHandlerFn<any, any, infer Resp>
+  | StreamInHandlerFn<any, any, infer Resp>
+  | StreamOutHandlerFn<any, infer Resp>
+  ? Resp
+  : never;
+
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data, dateReviver));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data, dateReviver));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data, dateReviver))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+// AuthDataGenerator is a function that returns a new instance of the authentication data required by this API
+export type AuthDataGenerator = () =>
+  | RequestType<typeof auth_auth>
+  | Promise<RequestType<typeof auth_auth> | undefined>
+  | undefined;
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+    readonly authGenerator?: AuthDataGenerator
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+
+        // Setup an authentication data generator using the auth data token option
+        if (options.auth !== undefined) {
+            const auth = options.auth
+            if (typeof auth === "function") {
+                this.authGenerator = auth
+            } else {
+                this.authGenerator = () => auth
+            }
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        let authData: RequestType<typeof auth_auth> | undefined;
+
+        // If authorization data generator is present, call it and add the returned data to the request
+        if (this.authGenerator) {
+            const mayBePromise = this.authGenerator();
+            if (mayBePromise instanceof Promise) {
+                authData = await mayBePromise;
+            } else {
+                authData = mayBePromise;
+            }
+        }
+
+        if (authData) {
+            const data: CallParameters = {};
+
+            data.headers = makeRecord<string, string>({
+                cookie:        authData.cookie,
+                "x-api-token": authData.token,
+            });
+
+            return data;
+        }
+
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(path: string, params?: CallParameters): Promise<Response> {
+        return this.callAPI(path, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(path: string, params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_stream_javascript.js b/pkg/clientgen/testdata/tsapp/expected_stream_javascript.js
new file mode 100644
index 0000000000..20f0e91a91
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_stream_javascript.js
@@ -0,0 +1,745 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * Local is the base URL for calling the Encore application's API.
+ */
+export const Local = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name) {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr) {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target = "prod", options = undefined) {
+        const base = new BaseClient(target, options ?? {})
+        this.svc = new svc.ServiceClient(base)
+    }
+}
+
+class SvcServiceClient {
+    constructor(baseClient) {
+        this.baseClient = baseClient
+        this.inOutWithHandshake = this.inOutWithHandshake.bind(this)
+        this.inOutWithoutHandshake = this.inOutWithoutHandshake.bind(this)
+        this.inWithHandshake = this.inWithHandshake.bind(this)
+        this.inWithResponse = this.inWithResponse.bind(this)
+        this.inWithResponseAndHandshake = this.inWithResponseAndHandshake.bind(this)
+        this.inWithoutHandshake = this.inWithoutHandshake.bind(this)
+        this.outWithHandshake = this.outWithHandshake.bind(this)
+        this.outWithoutHandshake = this.outWithoutHandshake.bind(this)
+    }
+
+    /**
+     * InOut stream type variants
+     */
+    async inOutWithHandshake(pathParam, params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "some-header": params.headerValue,
+        })
+
+        const query = makeRecord({
+            "some-query": params.queryValue,
+        })
+
+        return await this.baseClient.createStreamInOut(`/inout/${encodeURIComponent(pathParam)}`, {headers, query})
+    }
+
+    async inOutWithoutHandshake() {
+        return await this.baseClient.createStreamInOut(`/inout/noHandshake`)
+    }
+
+    /**
+     * In stream type variants
+     */
+    async inWithHandshake(pathParam, params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "some-header": params.headerValue,
+        })
+
+        const query = makeRecord({
+            "some-query": params.queryValue,
+        })
+
+        return await this.baseClient.createStreamOut(`/in/${encodeURIComponent(pathParam)}`, {headers, query})
+    }
+
+    async inWithResponse() {
+        return await this.baseClient.createStreamOut(`/in/withResponse`)
+    }
+
+    async inWithResponseAndHandshake(params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "some-header": params.headerValue,
+        })
+
+        const query = makeRecord({
+            pathParam:    params.pathParam,
+            "some-query": params.queryValue,
+        })
+
+        return await this.baseClient.createStreamOut(`/in/withResponseAndHandshake`, {headers, query})
+    }
+
+    async inWithoutHandshake() {
+        return await this.baseClient.createStreamOut(`/in/noHandshake`)
+    }
+
+    /**
+     * Out stream type variants
+     */
+    async outWithHandshake(pathParam, params) {
+        // Convert our params into the objects we need for the request
+        const headers = makeRecord({
+            "some-header": params.headerValue,
+        })
+
+        const query = makeRecord({
+            "some-query": params.queryValue,
+        })
+
+        return await this.baseClient.createStreamIn(`/out/${encodeURIComponent(pathParam)}`, {headers, query})
+    }
+
+    async outWithoutHandshake() {
+        return await this.baseClient.createStreamIn(`/out/noHandshake`)
+    }
+}
+
+export const svc = {
+    ServiceClient: SvcServiceClient
+}
+
+
+function encodeQuery(parts) {
+    const pairs = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]])
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+function makeRecord(record) {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record
+}
+
+
+function encodeWebSocketHeaders(headers) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    hasUpdateHandlers = [];
+
+    constructor(url, headers) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers));
+        }
+
+        this.ws = new WebSocket(url, protocols);
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type, handler) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type, handler) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn {
+    buffer = [];
+
+    constructor(url, headers) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next() {
+        for await (const next of this) return next;
+    }
+
+    async *[Symbol.asyncIterator]() {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift();
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) break;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut {
+    constructor(url, headers) {
+        let responseResolver;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response() {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+
+const boundFetch = fetch.bind(this)
+
+class BaseClient {
+    constructor(baseURL, options) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-JS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {}
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData() {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : '';
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut(path, params) {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    async callTypedAPI(method, path, body, params) {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    async callAPI(method, path, body, params) {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+function isAPIErrorResponse(err) {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code) {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    constructor(status, response) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if (Object.setPrototypeOf == undefined) {
+            this.__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if (Error.captureStackTrace !== undefined) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+
+        /**
+         * The HTTP status code associated with the error.
+         */
+        this.status = status
+
+        /**
+         * The Encore error code
+         */
+        this.code = response.code
+
+        /**
+         * The error details
+         */
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err) {
+    return err instanceof APIError;
+}
+
+export const ErrCode = {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK: "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled: "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown: "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument: "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded: "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound: "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists: "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied: "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted: "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition: "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted: "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange: "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented: "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal: "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable: "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss: "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated: "unauthenticated"
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_stream_shared.ts b/pkg/clientgen/testdata/tsapp/expected_stream_shared.ts
new file mode 100644
index 0000000000..f3f874ab7a
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_stream_shared.ts
@@ -0,0 +1,884 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+import type { CookieWithOptions } from "encore.dev/api";
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+}
+
+/**
+ * Import the endpoint handlers to derive the types for the client.
+ */
+import {
+    inOutWithHandshake as api_svc_svc_inOutWithHandshake,
+    inOutWithoutHandshake as api_svc_svc_inOutWithoutHandshake,
+    inWithHandshake as api_svc_svc_inWithHandshake,
+    inWithResponse as api_svc_svc_inWithResponse,
+    inWithResponseAndHandshake as api_svc_svc_inWithResponseAndHandshake,
+    inWithoutHandshake as api_svc_svc_inWithoutHandshake,
+    outWithHandshake as api_svc_svc_outWithHandshake,
+    outWithoutHandshake as api_svc_svc_outWithoutHandshake
+} from "~backend/svc/svc";
+
+export namespace svc {
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.inOutWithHandshake = this.inOutWithHandshake.bind(this)
+            this.inOutWithoutHandshake = this.inOutWithoutHandshake.bind(this)
+            this.inWithHandshake = this.inWithHandshake.bind(this)
+            this.inWithResponse = this.inWithResponse.bind(this)
+            this.inWithResponseAndHandshake = this.inWithResponseAndHandshake.bind(this)
+            this.inWithoutHandshake = this.inWithoutHandshake.bind(this)
+            this.outWithHandshake = this.outWithHandshake.bind(this)
+            this.outWithoutHandshake = this.outWithoutHandshake.bind(this)
+        }
+
+        /**
+         * InOut stream type variants
+         */
+        public async inOutWithHandshake(params: RequestType<typeof api_svc_svc_inOutWithHandshake>): Promise<StreamInOut<StreamRequest<typeof api_svc_svc_inOutWithHandshake>, StreamResponse<typeof api_svc_svc_inOutWithHandshake>>> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "some-header": params.headerValue,
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                "some-query": params.queryValue,
+            })
+
+            return await this.baseClient.createStreamInOut(`/inout/${encodeURIComponent(params.pathParam)}`, {headers, query})
+        }
+
+        public async inOutWithoutHandshake(): Promise<StreamInOut<StreamRequest<typeof api_svc_svc_inOutWithoutHandshake>, StreamResponse<typeof api_svc_svc_inOutWithoutHandshake>>> {
+            return await this.baseClient.createStreamInOut(`/inout/noHandshake`)
+        }
+
+        /**
+         * In stream type variants
+         */
+        public async inWithHandshake(params: RequestType<typeof api_svc_svc_inWithHandshake>): Promise<StreamOut<StreamRequest<typeof api_svc_svc_inWithHandshake>, void>> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "some-header": params.headerValue,
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                "some-query": params.queryValue,
+            })
+
+            return await this.baseClient.createStreamOut(`/in/${encodeURIComponent(params.pathParam)}`, {headers, query})
+        }
+
+        public async inWithResponse(): Promise<StreamOut<StreamRequest<typeof api_svc_svc_inWithResponse>, StreamResponse<typeof api_svc_svc_inWithResponse>>> {
+            return await this.baseClient.createStreamOut(`/in/withResponse`)
+        }
+
+        public async inWithResponseAndHandshake(params: RequestType<typeof api_svc_svc_inWithResponseAndHandshake>): Promise<StreamOut<StreamRequest<typeof api_svc_svc_inWithResponseAndHandshake>, StreamResponse<typeof api_svc_svc_inWithResponseAndHandshake>>> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "some-header": params.headerValue,
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                pathParam:    params.pathParam,
+                "some-query": params.queryValue,
+            })
+
+            return await this.baseClient.createStreamOut(`/in/withResponseAndHandshake`, {headers, query})
+        }
+
+        public async inWithoutHandshake(): Promise<StreamOut<StreamRequest<typeof api_svc_svc_inWithoutHandshake>, void>> {
+            return await this.baseClient.createStreamOut(`/in/noHandshake`)
+        }
+
+        /**
+         * Out stream type variants
+         */
+        public async outWithHandshake(params: RequestType<typeof api_svc_svc_outWithHandshake>): Promise<StreamIn<StreamResponse<typeof api_svc_svc_outWithHandshake>>> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "some-header": params.headerValue,
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                "some-query": params.queryValue,
+            })
+
+            return await this.baseClient.createStreamIn(`/out/${encodeURIComponent(params.pathParam)}`, {headers, query})
+        }
+
+        public async outWithoutHandshake(): Promise<StreamIn<StreamResponse<typeof api_svc_svc_outWithoutHandshake>>> {
+            return await this.baseClient.createStreamIn(`/out/noHandshake`)
+        }
+    }
+}
+
+
+type PickMethods<Type> = Omit<CallParameters, "method"> & { method?: Type };
+
+// Helper type to omit all fields that are cookies.
+type OmitCookie<T> = {
+  [K in keyof T as T[K] extends CookieWithOptions<any> ? never : K]: T[K];
+};
+
+type RequestType<Type extends (...args: any[]) => any> =
+  Parameters<Type> extends [infer H, ...any[]]
+    ? OmitCookie<H>
+    : void;
+
+type ResponseType<Type extends (...args: any[]) => any> = OmitCookie<Awaited<ReturnType<Type>>>;
+
+function dateReviver(key: string, value: any): any {
+  if (
+    typeof value === "string" &&
+    value.length >= 10 &&
+    value.charCodeAt(0) >= 48 && // '0'
+    value.charCodeAt(0) <= 57 // '9'
+  ) {
+    const parsedDate = new Date(value);
+    if (!isNaN(parsedDate.getTime())) {
+      return parsedDate;
+    }
+  }
+  return value;
+}
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+import {
+  StreamInOutHandlerFn,
+  StreamInHandlerFn,
+  StreamOutHandlerFn,
+} from "encore.dev/api";
+
+type StreamRequest<Type> = Type extends
+  | StreamInOutHandlerFn<any, infer Req, any>
+  | StreamInHandlerFn<any, infer Req, any>
+  | StreamOutHandlerFn<any, any>
+  ? Req
+  : never;
+
+type StreamResponse<Type> = Type extends
+  | StreamInOutHandlerFn<any, any, infer Resp>
+  | StreamInHandlerFn<any, any, infer Resp>
+  | StreamOutHandlerFn<any, infer Resp>
+  ? Resp
+  : never;
+
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data, dateReviver));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data, dateReviver));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data, dateReviver))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(path: string, params?: CallParameters): Promise<Response> {
+        return this.callAPI(path, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(path: string, params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_stream_typescript.ts b/pkg/clientgen/testdata/tsapp/expected_stream_typescript.ts
new file mode 100644
index 0000000000..6c24c246a3
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_stream_typescript.ts
@@ -0,0 +1,870 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+}
+
+export namespace svc {
+    export interface Handshake {
+        headerValue: string
+        queryValue: string
+    }
+
+    export interface Handshake {
+        headerValue: string
+        queryValue: string
+    }
+
+    export interface Handshake {
+        headerValue: string
+        queryValue: string
+        pathParam: string
+    }
+
+    export interface Handshake {
+        headerValue: string
+        queryValue: string
+    }
+
+    export interface InMsg {
+        data: string
+    }
+
+    export interface InMsg {
+        data: string
+    }
+
+    export interface InMsg {
+        data: string
+    }
+
+    export interface InMsg {
+        data: string
+    }
+
+    export interface InMsg {
+        data: string
+    }
+
+    export interface InMsg {
+        data: string
+    }
+
+    export interface OutMsg {
+        user: number
+        msg: string
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.inOutWithHandshake = this.inOutWithHandshake.bind(this)
+            this.inOutWithoutHandshake = this.inOutWithoutHandshake.bind(this)
+            this.inWithHandshake = this.inWithHandshake.bind(this)
+            this.inWithResponse = this.inWithResponse.bind(this)
+            this.inWithResponseAndHandshake = this.inWithResponseAndHandshake.bind(this)
+            this.inWithoutHandshake = this.inWithoutHandshake.bind(this)
+            this.outWithHandshake = this.outWithHandshake.bind(this)
+            this.outWithoutHandshake = this.outWithoutHandshake.bind(this)
+        }
+
+        /**
+         * InOut stream type variants
+         */
+        public async inOutWithHandshake(pathParam: string, params: Handshake): Promise<StreamInOut<InMsg, OutMsg>> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "some-header": params.headerValue,
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                "some-query": params.queryValue,
+            })
+
+            return await this.baseClient.createStreamInOut(`/inout/${encodeURIComponent(pathParam)}`, {headers, query})
+        }
+
+        public async inOutWithoutHandshake(): Promise<StreamInOut<InMsg, OutMsg>> {
+            return await this.baseClient.createStreamInOut(`/inout/noHandshake`)
+        }
+
+        /**
+         * In stream type variants
+         */
+        public async inWithHandshake(pathParam: string, params: Handshake): Promise<StreamOut<InMsg, void>> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "some-header": params.headerValue,
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                "some-query": params.queryValue,
+            })
+
+            return await this.baseClient.createStreamOut(`/in/${encodeURIComponent(pathParam)}`, {headers, query})
+        }
+
+        public async inWithResponse(): Promise<StreamOut<InMsg, OutMsg>> {
+            return await this.baseClient.createStreamOut(`/in/withResponse`)
+        }
+
+        public async inWithResponseAndHandshake(params: Handshake): Promise<StreamOut<InMsg, OutMsg>> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "some-header": params.headerValue,
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                pathParam:    params.pathParam,
+                "some-query": params.queryValue,
+            })
+
+            return await this.baseClient.createStreamOut(`/in/withResponseAndHandshake`, {headers, query})
+        }
+
+        public async inWithoutHandshake(): Promise<StreamOut<InMsg, void>> {
+            return await this.baseClient.createStreamOut(`/in/noHandshake`)
+        }
+
+        /**
+         * Out stream type variants
+         */
+        public async outWithHandshake(pathParam: string, params: Handshake): Promise<StreamIn<OutMsg>> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                "some-header": params.headerValue,
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                "some-query": params.queryValue,
+            })
+
+            return await this.baseClient.createStreamIn(`/out/${encodeURIComponent(pathParam)}`, {headers, query})
+        }
+
+        public async outWithoutHandshake(): Promise<StreamIn<OutMsg>> {
+            return await this.baseClient.createStreamIn(`/out/noHandshake`)
+        }
+    }
+}
+
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "method" | "body" | "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/tsapp/expected_typescript.ts b/pkg/clientgen/testdata/tsapp/expected_typescript.ts
new file mode 100644
index 0000000000..27cc76ae06
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/expected_typescript.ts
@@ -0,0 +1,945 @@
+// Code generated by the Encore v0.0.0-develop client generator. DO NOT EDIT.
+
+// Disable eslint, jshint, and jslint for this file.
+/* eslint-disable */
+/* jshint ignore:start */
+/*jslint-disable*/
+
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `https://${name}-app.encr.app`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`pr${pr}`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the app Encore application.
+ */
+export default class Client {
+    public readonly svc: svc.ServiceClient
+    private readonly options: ClientOptions
+    private readonly target: string
+
+
+    /**
+     * Creates a Client for calling the public and authenticated APIs of your Encore application.
+     *
+     * @param target  The target which the client should be configured to use. See Local and Environment for options.
+     * @param options Options for the client
+     */
+    constructor(target: BaseURL, options?: ClientOptions) {
+        this.target = target
+        this.options = options ?? {}
+        const base = new BaseClient(this.target, this.options)
+        this.svc = new svc.ServiceClient(base)
+    }
+
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+}
+
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+
+    /**
+     * Allows you to set the authentication data to be used for each
+     * request either by passing in a static object or by passing in
+     * a function which returns a new object for each request.
+     */
+    auth?: svc.AuthParams | AuthDataGenerator
+}
+
+export namespace svc {
+    export interface AuthParams {
+        cookie?: string
+        token?: string
+    }
+
+    export interface Request {
+        /**
+         * Foo is good
+         */
+        foo?: number
+
+        /**
+         * Baz is better
+         */
+        baz: string
+
+        queryFoo?: boolean
+        queryBar?: string
+        headerBaz?: string
+        headerNum?: number
+    }
+
+    export interface Request {
+        /**
+         * Foo is good
+         */
+        foo?: number
+
+        /**
+         * Baz is better
+         */
+        baz: string
+
+        queryFoo?: boolean
+        queryBar?: string
+        headerBaz?: string
+        headerNum?: number
+    }
+
+    export interface Request {
+        /**
+         * Foo is good
+         */
+        foo?: number
+
+        /**
+         * Baz is better
+         */
+        baz: string
+
+        queryFoo?: boolean
+        queryBar?: string
+        headerBaz?: string
+        headerNum?: number
+    }
+
+    export class ServiceClient {
+        private baseClient: BaseClient
+
+        constructor(baseClient: BaseClient) {
+            this.baseClient = baseClient
+            this.cookieDummy = this.cookieDummy.bind(this)
+            this.cookiesOnly = this.cookiesOnly.bind(this)
+            this.dummy = this.dummy.bind(this)
+            this.imported = this.imported.bind(this)
+            this.noTypes = this.noTypes.bind(this)
+            this.onlyPathParams = this.onlyPathParams.bind(this)
+            this.root = this.root.bind(this)
+        }
+
+        public async cookieDummy(params: Request): Promise<{
+}> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                baz: params.headerBaz,
+                num: params.headerNum === undefined ? undefined : String(params.headerNum),
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                bar: params.queryBar,
+                foo: params.queryFoo === undefined ? undefined : String(params.queryFoo),
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                baz: params.baz,
+                foo: params.foo,
+            }
+
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/cookie-dummy`, JSON.stringify(body), {headers, query})
+            return await resp.json() as {
+}
+        }
+
+        public async cookiesOnly(params: {
+}): Promise<{
+}> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/cookies-only`)
+            return await resp.json() as {
+}
+        }
+
+        public async dummy(params: Request): Promise<void> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                baz: params.headerBaz,
+                num: params.headerNum === undefined ? undefined : String(params.headerNum),
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                bar: params.queryBar,
+                foo: params.queryFoo === undefined ? undefined : String(params.queryFoo),
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                baz: params.baz,
+                foo: params.foo,
+            }
+
+            await this.baseClient.callTypedAPI("POST", `/dummy`, JSON.stringify(body), {headers, query})
+        }
+
+        public async imported(params: common_stuff.ImportedRequest): Promise<common_stuff.ImportedResponse> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/imported`, JSON.stringify(params))
+            return await resp.json() as common_stuff.ImportedResponse
+        }
+
+        public async noTypes(): Promise<void> {
+            await this.baseClient.callTypedAPI("POST", `/type-less`)
+        }
+
+        public async onlyPathParams(pathParam: string, pathParam2: string): Promise<common_stuff.ImportedResponse> {
+            // Now make the actual call to the API
+            const resp = await this.baseClient.callTypedAPI("POST", `/path/${encodeURIComponent(pathParam)}/${encodeURIComponent(pathParam2)}`)
+            return await resp.json() as common_stuff.ImportedResponse
+        }
+
+        public async root(params: Request): Promise<void> {
+            // Convert our params into the objects we need for the request
+            const headers = makeRecord<string, string>({
+                baz: params.headerBaz,
+                num: params.headerNum === undefined ? undefined : String(params.headerNum),
+            })
+
+            const query = makeRecord<string, string | string[]>({
+                bar: params.queryBar,
+                foo: params.queryFoo === undefined ? undefined : String(params.queryFoo),
+            })
+
+            // Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)
+            const body: Record<string, any> = {
+                baz: params.baz,
+                foo: params.foo,
+            }
+
+            await this.baseClient.callTypedAPI("POST", `/`, JSON.stringify(body), {headers, query})
+        }
+    }
+}
+
+export namespace common_stuff {
+    export interface ImportedRequest {
+        name: string
+    }
+
+    export interface ImportedResponse {
+        message: string
+    }
+}
+
+
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(`${key}=${encodeURIComponent(v)}`)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(JSON.parse(event.data));
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(JSON.parse(event.data))
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }
+}
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, "method" | "body" | "headers"> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+
+// AuthDataGenerator is a function that returns a new instance of the authentication data required by this API
+export type AuthDataGenerator = () =>
+  | svc.AuthParams
+  | Promise<svc.AuthParams | undefined>
+  | undefined;
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+    readonly authGenerator?: AuthDataGenerator
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "app-Generated-TS-Client (Encore/v0.0.0-develop)";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }
+
+        // Setup an authentication data generator using the auth data token option
+        if (options.auth !== undefined) {
+            const auth = options.auth
+            if (typeof auth === "function") {
+                this.authGenerator = auth
+            } else {
+                this.authGenerator = () => auth
+            }
+        }
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {
+        let authData: svc.AuthParams | undefined;
+
+        // If authorization data generator is present, call it and add the returned data to the request
+        if (this.authGenerator) {
+            const mayBePromise = this.authGenerator();
+            if (mayBePromise instanceof Promise) {
+                authData = await mayBePromise;
+            } else {
+                authData = mayBePromise;
+            }
+        }
+
+        if (authData) {
+            const data: CallParameters = {};
+
+            data.headers = makeRecord<string, string>({
+                cookie:        authData.cookie,
+                "x-api-token": authData.token,
+            });
+
+            return data;
+        }
+
+        return undefined;
+    }
+
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        return this.callAPI(method, path, body, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(method: string, path: string, body?: RequestInit["body"], params?: CallParameters): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,
+            method,
+            body: body ?? null,
+        }
+
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: `request failed: status ${response.status}` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
diff --git a/pkg/clientgen/testdata/tsapp/input.ts b/pkg/clientgen/testdata/tsapp/input.ts
new file mode 100644
index 0000000000..42fd94c093
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/input.ts
@@ -0,0 +1,95 @@
+-- encore.app --
+{"id": ""}
+
+-- package.json --
+{"name": "ts-test-app"}
+
+-- common-stuff/types.ts --
+export interface ImportedRequest {
+  name: string;
+}
+
+export interface ImportedResponse {
+  message: string;
+}
+
+-- svc/svc.ts --
+import { Header, Query, api, Gateway, Cookie } from "encore.dev/api";
+import { authHandler } from "encore.dev/auth";
+import type { ImportedRequest, ImportedResponse } from "../common-stuff/types";
+
+interface UnusedType {
+  foo: Foo;
+}
+
+export const root = api(
+  { expose: true, method: "POST", path: "/" },
+  async (req: Request) => { },
+);
+
+export const imported = api(
+  { expose: true, method: "POST", path: "/imported" },
+  async (req: ImportedRequest) : Promise<ImportedResponse> => { },
+);
+
+export const onlyPathParams = api(
+  { expose: true, method: "POST", path: "/path/:pathParam/:pathParam2" },
+  async (req: { pathParam: string, pathParam2: string }) : Promise<ImportedResponse> => { },
+);
+
+
+export const dummy = api(
+  { expose: true, method: "POST", path: "/dummy" },
+  async (req: Request) => { },
+);
+
+
+export const noTypes = api(
+  { expose: true, method: "POST", path: "/type-less" },
+  async () => { },
+)
+export const cookiesOnly = api(
+  { expose: true, method: "POST", path: "/cookies-only" },
+  async (req: { field: Cookie<'cookie'> }): Promise<{ cookie: Cookie<'cookie'> }> => {
+    return { cookie: { value: "value" } }
+  },
+)
+
+export const cookieDummy = api(
+  { expose: true, method: "POST", path: "/cookie-dummy" },
+  async (req: Request): Promise<{ cookie: Cookie<'cookie'> }> => { return { cookie: { value: "value" } } },
+);
+
+export interface AuthParams {
+  cookie?: Header<'Cookie'>
+  token?: Header<'x-api-token'>
+  cookieValue?: Cookie<'actual-cookie'>
+}
+
+export interface AuthData {
+  userID: string;
+}
+
+export const auth = authHandler<AuthParams, AuthData>(
+  async (params) => {
+    return { userID: "my-user-id" };
+  }
+)
+
+export const gw = new Gateway({
+  authHandler: auth,
+})
+
+interface Request {
+  // Foo is good
+  foo?: number;
+  // Baz is better
+  baz: string;
+
+  queryFoo?: Query<boolean, "foo">;
+  queryBar?: Query<"bar">;
+  headerBaz?: Header<"baz">;
+  headerNum?: Header<number, "num">;
+  cookieQux?: Cookie<"qux">;
+  cookieQuux?: Cookie<number, "quux">;
+}
diff --git a/pkg/clientgen/testdata/tsapp/input_decimal.ts b/pkg/clientgen/testdata/tsapp/input_decimal.ts
new file mode 100644
index 0000000000..d64a237c54
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/input_decimal.ts
@@ -0,0 +1,22 @@
+-- encore.app --
+{"id": ""}
+
+-- package.json --
+{"name": "ts-test-app"}
+
+-- svc/svc.ts --
+import { api } from "encore.dev/api";
+import { Decimal } from "encore.dev/types";
+
+export const dummy = api(
+  { expose: true, method: "GET", path: "/dummy" },
+  async (req: Request): Promise<Response> => {},
+);
+
+interface Request {
+  message: string,
+  val: Decimal,
+}
+interface Response {
+  result: Decimal
+}
diff --git a/pkg/clientgen/testdata/tsapp/input_httpstatus.ts b/pkg/clientgen/testdata/tsapp/input_httpstatus.ts
new file mode 100644
index 0000000000..6fa237b406
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/input_httpstatus.ts
@@ -0,0 +1,19 @@
+-- encore.app --
+{"id": ""}
+
+-- package.json --
+{"name": "ts-test-app"}
+
+-- svc/svc.ts --
+import { api, HttpStatus } from "encore.dev/api";
+
+export const dummy = api(
+  { expose: true, method: "GET", path: "/dummy" },
+  async (): Promise<Response> => {},
+);
+
+
+interface Response {
+  message: string,
+  status: HttpStatus,
+}
diff --git a/pkg/clientgen/testdata/tsapp/input_list_of_union.ts b/pkg/clientgen/testdata/tsapp/input_list_of_union.ts
new file mode 100644
index 0000000000..e120437639
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/input_list_of_union.ts
@@ -0,0 +1,19 @@
+-- encore.app --
+{"id": ""}
+
+-- package.json --
+{"name": "ts-test-app"}
+
+-- svc/svc.ts --
+import { api } from "encore.dev/api";
+
+export const dummy = api(
+  { expose: true, method: "GET", path: "/dummy" },
+  async (req: Request) => {},
+);
+
+
+interface Request {
+    listOfUnion: ("a" | "b")[]
+}
+
diff --git a/pkg/clientgen/testdata/tsapp/input_stream.ts b/pkg/clientgen/testdata/tsapp/input_stream.ts
new file mode 100644
index 0000000000..0272dfa5c8
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/input_stream.ts
@@ -0,0 +1,63 @@
+-- encore.app --
+{"id": ""}
+
+-- package.json --
+{"name": "ts-test-app"}
+
+-- svc/svc.ts --
+import { api, Header, Query } from "encore.dev/api";
+
+interface Handshake {
+    headerValue: Header<"some-header">;
+    queryValue: Query<"some-query">;
+    pathParam: string;
+}
+interface InMsg {
+    data: string;
+}
+interface OutMsg {
+    user: number;
+    msg: string;
+}
+
+// InOut stream type variants
+export const inOutWithHandshake = api.streamInOut<Handshake, InMsg, OutMsg>(
+  { expose: true, path: "/inout/:pathParam" },
+  async (handshake: Handshake, stream) => {},
+);
+export const inOutWithoutHandshake = api.streamInOut<InMsg, OutMsg>(
+  { expose: true, path: "/inout/noHandshake" },
+  async (stream) => {},
+);
+
+// Out stream type variants
+export const outWithHandshake = api.streamOut<Handshake, OutMsg>(
+  { expose: true, path: "/out/:pathParam" },
+  async (handshake: Handshake, stream) => {},
+);
+
+export const outWithoutHandshake = api.streamOut<OutMsg>(
+  { expose: true, path: "/out/noHandshake" },
+  async (stream) => {},
+);
+
+// In stream type variants
+export const inWithHandshake = api.streamIn<Handshake, InMsg>(
+  { expose: true, path: "/in/:pathParam" },
+  async (handshake: Handshake, stream) => {},
+);
+
+export const inWithoutHandshake = api.streamIn<InMsg>(
+  { expose: true, path: "/in/noHandshake" },
+  async (stream) => {},
+);
+
+export const inWithResponse = api.streamIn<InMsg, OutMsg>(
+  { expose: true, path: "/in/withResponse" },
+  async (stream) => {},
+);
+
+export const inWithResponseAndHandshake = api.streamIn<Handshake, InMsg, OutMsg>(
+  { expose: true, path: "/in/withResponseAndHandshake" },
+  async (handshake: Handshake, stream) => {},
+);
diff --git a/pkg/clientgen/testdata/tsapp/tsconfig.json b/pkg/clientgen/testdata/tsapp/tsconfig.json
new file mode 100644
index 0000000000..75ab6ace4b
--- /dev/null
+++ b/pkg/clientgen/testdata/tsapp/tsconfig.json
@@ -0,0 +1,9 @@
+// Note: this config is here purely to remove errors about promises not being present in IDE's when viewing the expected_typescript.ts file
+{
+  "compilerOptions": {
+    "target": "es2022",
+    "paths": {
+      "~backend/*": ["./*"]
+    },
+  }
+}
diff --git a/pkg/clientgen/types.go b/pkg/clientgen/types.go
new file mode 100644
index 0000000000..e057a7e018
--- /dev/null
+++ b/pkg/clientgen/types.go
@@ -0,0 +1,145 @@
+package clientgen
+
+import (
+	"fmt"
+	"reflect"
+	"sort"
+
+	"encr.dev/pkg/clientgen/clientgentypes"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+func getNamedTypes(md *meta.Data, set clientgentypes.ServiceSet) *typeRegistry {
+	r := &typeRegistry{
+		md:         md,
+		namespaces: make(map[string][]*schema.Decl),
+		seenDecls:  make(map[uint32]bool),
+		declRefs:   make(map[uint32]map[uint32]bool),
+	}
+	for _, svc := range md.Svcs {
+		if !set.Has(svc.Name) {
+			continue
+		}
+		for _, rpc := range svc.Rpcs {
+			if rpc.AccessType != meta.RPC_PRIVATE {
+				r.Visit(rpc.HandshakeSchema)
+				r.Visit(rpc.RequestSchema)
+				r.Visit(rpc.ResponseSchema)
+			}
+		}
+	}
+
+	if md.AuthHandler != nil && md.AuthHandler.Params != nil {
+		r.Visit(md.AuthHandler.Params)
+	}
+
+	return r
+}
+
+// typeRegistry computes the visible set of type declarations
+// and how to group them into namespaces.
+type typeRegistry struct {
+	md         *meta.Data
+	namespaces map[string][]*schema.Decl
+	seenDecls  map[uint32]bool
+	declRefs   map[uint32]map[uint32]bool // tracks which decls reference which other decls
+	currDecl   *schema.Decl               // may be nil
+}
+
+func (v *typeRegistry) Decls(name string) []*schema.Decl {
+	return v.namespaces[name]
+}
+
+func (v *typeRegistry) Namespaces() []string {
+	nss := make([]string, 0, len(v.namespaces))
+	for ns := range v.namespaces {
+		nss = append(nss, ns)
+	}
+	sort.Strings(nss)
+	return nss
+}
+
+func (v *typeRegistry) Visit(typ *schema.Type) {
+	if typ == nil {
+		return
+	}
+	switch t := typ.Typ.(type) {
+	case *schema.Type_Named:
+		v.visitNamed(t.Named)
+	case *schema.Type_List:
+		v.Visit(t.List.Elem)
+	case *schema.Type_Map:
+		v.Visit(t.Map.Key)
+		v.Visit(t.Map.Value)
+	case *schema.Type_Struct:
+		for _, f := range t.Struct.Fields {
+			v.Visit(f.Typ)
+		}
+	case *schema.Type_Builtin, *schema.Type_TypeParameter, *schema.Type_Literal:
+	// do nothing
+
+	case *schema.Type_Pointer:
+		v.Visit(t.Pointer.Base)
+
+	case *schema.Type_Config:
+		v.Visit(t.Config.Elem)
+
+	case *schema.Type_Union:
+		for _, tt := range t.Union.Types {
+			v.Visit(tt)
+		}
+
+	default:
+		panic(fmt.Sprintf("unhandled type: %+v", reflect.TypeOf(typ.Typ)))
+	}
+}
+
+func (v *typeRegistry) visitDecl(decl *schema.Decl) {
+	if decl == nil {
+		return
+	}
+
+	if !v.seenDecls[decl.Id] {
+		v.seenDecls[decl.Id] = true
+		ns := decl.Loc.PkgName
+		v.namespaces[ns] = append(v.namespaces[ns], decl)
+
+		// Set currDecl when processing this and then reset it
+		prev := v.currDecl
+		v.currDecl = decl
+		v.Visit(decl.Type)
+		v.currDecl = prev
+	}
+}
+
+func (v *typeRegistry) visitNamed(n *schema.Named) {
+	to := n.Id
+	curr := v.currDecl
+	if curr != nil {
+		from := curr.Id
+		if _, ok := v.declRefs[from]; !ok {
+			v.declRefs[from] = make(map[uint32]bool)
+		}
+		v.declRefs[from][to] = true
+	}
+
+	decl := v.md.Decls[to]
+	v.visitDecl(decl)
+
+	// Add transitive refs
+	if curr != nil {
+		from := curr.Id
+		for to2 := range v.declRefs[to] {
+			v.declRefs[from][to2] = true
+		}
+	}
+
+	for _, typeArg := range n.TypeArguments {
+		v.Visit(typeArg)
+	}
+}
+
+func (v *typeRegistry) IsRecursiveRef(from, to uint32) bool {
+	return v.declRefs[from][to] && v.declRefs[to][from]
+}
diff --git a/pkg/clientgen/typescript.go b/pkg/clientgen/typescript.go
new file mode 100644
index 0000000000..e547e96c50
--- /dev/null
+++ b/pkg/clientgen/typescript.go
@@ -0,0 +1,2279 @@
+package clientgen
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"maps"
+	"path/filepath"
+	"reflect"
+	"regexp"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+	"unicode"
+
+	"github.com/cockroachdb/errors"
+
+	"encr.dev/internal/version"
+	"encr.dev/parser/encoding"
+	"encr.dev/pkg/clientgen/clientgentypes"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/idents"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+/* The TypeScript generator generates code that looks like this:
+export namespace task {
+	export interface AddParams {
+		description: string
+	}
+
+	export class ServiceClient {
+		public Add(params: task_AddParams): Promise<task_AddResponse> {
+			// ...
+		}
+	}
+}
+
+*/
+
+// tsGenVersion allows us to introduce breaking changes in the generated code but behind a switch
+// meaning that people with client code reliant on the old behaviour can continue to generate the
+// old code.
+type tsGenVersion int
+
+const (
+	// TsInitial is the originally released typescript generator
+	TsInitial tsGenVersion = iota
+
+	// TsExperimental can be used to lock experimental or uncompleted features in the generated code
+	// It should always be the last item in the enum
+	TsExperimental
+)
+
+const typescriptGenLatestVersion = TsExperimental - 1
+
+type typescript struct {
+	*bytes.Buffer
+	md               *meta.Data
+	appSlug          string
+	typs             *typeRegistry
+	currDecl         *schema.Decl
+	generatorVersion tsGenVersion
+	sharedTypes      bool
+	clientTarget     string
+
+	seenJSON           bool // true if a JSON type was seen
+	seenStream         bool // true if a stream endpoint was seen
+	seenHeaderResponse bool // true if we've seen a header used in a response object
+	hasAuth            bool // true if we've seen an authentication handler
+	authIsComplexType  bool // true if the auth type is a complex type
+}
+
+func (ts *typescript) Version() int {
+	return int(ts.generatorVersion)
+}
+
+func (ts *typescript) Generate(p clientgentypes.GenerateParams) (err error) {
+	defer ts.handleBailout(&err)
+
+	ts.Buffer = p.Buf
+	ts.md = p.Meta
+	ts.appSlug = p.AppSlug
+	ts.typs = getNamedTypes(p.Meta, p.Services)
+
+	if ts.md.AuthHandler != nil {
+		if !ts.isAuthCookieOnly() {
+			ts.hasAuth = true
+			ts.authIsComplexType = ts.md.AuthHandler.Params.GetBuiltin() != schema.Builtin_STRING
+		}
+	}
+
+	ts.WriteString("// " + doNotEditHeader() + "\n\n")
+	ts.WriteString("// Disable eslint, jshint, and jslint for this file.\n")
+	ts.WriteString("/* eslint-disable */\n")
+	ts.WriteString("/* jshint ignore:start */\n")
+	ts.WriteString("/*jslint-disable*/\n")
+
+	if ts.sharedTypes {
+		ts.WriteString("import type { CookieWithOptions } from \"encore.dev/api\";\n")
+	}
+
+	nss := ts.typs.Namespaces()
+	seenNs := make(map[string]bool)
+	ts.writeClient(p.Services)
+	for _, svc := range p.Meta.Svcs {
+		if err := ts.writeService(svc, p.Services, p.Tags); err != nil {
+			return err
+		}
+		seenNs[svc.Name] = true
+	}
+	if !ts.sharedTypes {
+		for _, ns := range nss {
+			if !seenNs[ns] {
+				ts.writeNamespace(ns)
+			}
+		}
+	}
+	ts.writeExtraTypes()
+	ts.writeStreamClasses()
+	if err := ts.writeBaseClient(p.AppSlug); err != nil {
+		return err
+	}
+	ts.writeCustomErrorType()
+
+	if ts.clientTarget != "" {
+		fmt.Fprintf(ts, `
+export default new Client(%s, { requestInit: { credentials: "include" } });
+`, ts.clientTarget)
+	}
+
+	return nil
+}
+
+func (ts *typescript) getFields(typ *schema.Type) []*schema.Field {
+	if typ == nil {
+		return nil
+	}
+	switch typ.Typ.(type) {
+	case *schema.Type_Struct:
+		return typ.GetStruct().Fields
+	case *schema.Type_Named:
+		decl := ts.md.Decls[typ.GetNamed().Id]
+		return ts.getFields(decl.Type)
+	default:
+		return nil
+	}
+}
+
+func (ts *typescript) isAuthCookieOnly() bool {
+	if ts.md.AuthHandler == nil {
+		return false
+	}
+	fields := ts.getFields(ts.md.AuthHandler.Params)
+	if fields == nil {
+		return false
+	}
+	for _, field := range fields {
+		if field.Wire.GetCookie() == nil {
+			return false
+		}
+	}
+	return true
+}
+
+func hasPathParams(rpc *meta.RPC) bool {
+	return fns.Any(rpc.Path.Segments, func(s *meta.PathSegment) bool {
+		return s.Type != meta.PathSegment_LITERAL
+	})
+}
+
+func (ts *typescript) authImportName() string {
+	return fmt.Sprintf("auth_%s", validTSIdentifier(ts.md.AuthHandler.Name))
+}
+
+func (ts *typescript) writeAuthType() {
+	if ts.sharedTypes {
+		fmt.Fprintf(ts, "RequestType<typeof %s>", ts.authImportName())
+	} else {
+		ts.writeTyp("", ts.md.AuthHandler.Params, 2)
+	}
+}
+
+func rpcImportName(rpc *meta.RPC) string {
+	fileName := strings.TrimSuffix(rpc.Loc.Filename, filepath.Ext(rpc.Loc.Filename))
+	return fmt.Sprintf("api_%s_%s_%s", validTSIdentifier(rpc.ServiceName), validTSIdentifier(fileName), validTSIdentifier(rpc.Name))
+}
+
+func getMethodType(rpc *meta.RPC) string {
+	ts := strings.Builder{}
+	for i, method := range rpc.HttpMethods {
+		if i > 0 {
+			ts.WriteString(" | ")
+		}
+
+		if method == "*" {
+			ts.WriteString("string")
+		} else {
+			ts.WriteString("\"" + method + "\"")
+		}
+	}
+	return ts.String()
+}
+
+func (ts *typescript) writeService(svc *meta.Service, p clientgentypes.ServiceSet, tags clientgentypes.TagSet) error {
+	// Determine if we have anything worth exposing.
+	// Either a public RPC or a named type.
+	isIncluded := hasPublicRPC(svc) && p.Has(svc.Name)
+
+	decls := ts.typs.Decls(svc.Name)
+	if !isIncluded && len(decls) == 0 {
+		return nil
+	}
+
+	if ts.sharedTypes {
+		importsByPath := make(map[string][]string)
+		for _, rpc := range svc.Rpcs {
+			if rpc.AccessType == meta.RPC_PRIVATE || !tags.IsRPCIncluded(rpc) || rpc.Proto == meta.RPC_RAW ||
+				(rpc.ResponseSchema == nil && rpc.RequestSchema == nil && !hasPathParams(rpc)) {
+				continue
+			}
+			path := fmt.Sprintf("~backend/%s/%s", rpc.Loc.PkgName, strings.TrimSuffix(rpc.Loc.Filename, filepath.Ext(rpc.Loc.Filename)))
+			importsByPath[path] = append(importsByPath[path], fmt.Sprintf("%s as %s", rpc.Name, rpcImportName(rpc)))
+		}
+		if len(importsByPath) > 0 {
+			ts.WriteString(`/**
+ * Import the endpoint handlers to derive the types for the client.
+ */
+`)
+		}
+		for _, path := range slices.Sorted(maps.Keys(importsByPath)) {
+			imps := fmt.Sprintf(" %s ", importsByPath[path][0])
+			if len(importsByPath[path]) > 1 {
+				imps = "\n    " + strings.Join(importsByPath[path], ",\n    ") + "\n"
+			}
+			fmt.Fprintf(ts, "import {%s} from \"%s\";\n", imps, path)
+		}
+		ts.WriteString("\n")
+	}
+
+	ns := svc.Name
+	fmt.Fprintf(ts, "export namespace %s {\n", ts.typeName(ns))
+
+	sort.Slice(decls, func(i, j int) bool {
+		return decls[i].Name < decls[j].Name
+	})
+	if !ts.sharedTypes {
+		for i, d := range decls {
+			if i > 0 {
+				ts.WriteString("\n")
+			}
+			ts.writeDeclDef(ns, d)
+		}
+	}
+
+	if !isIncluded {
+		ts.WriteString("}\n\n")
+		return nil
+	}
+	ts.WriteString("\n")
+
+	numIndent := 1
+	indent := func() {
+		ts.WriteString(strings.Repeat("    ", numIndent))
+	}
+
+	indent()
+	fmt.Fprint(ts, "export class ServiceClient {\n")
+	numIndent++
+
+	// Constructor
+	indent()
+	ts.WriteString("private baseClient: BaseClient\n\n")
+	indent()
+	ts.WriteString("constructor(baseClient: BaseClient) {\n")
+	numIndent++
+	indent()
+	ts.WriteString("this.baseClient = baseClient\n")
+	for _, rpc := range svc.Rpcs {
+		if rpc.AccessType == meta.RPC_PRIVATE || !tags.IsRPCIncluded(rpc) {
+			continue
+		}
+		name := ts.memberName(rpc.Name)
+		indent()
+		fmt.Fprintf(ts, "this.%s = this.%s.bind(this)\n", name, name)
+	}
+	numIndent--
+	indent()
+	ts.WriteString("}\n")
+
+	// RPCs
+	for _, rpc := range svc.Rpcs {
+		if rpc.AccessType == meta.RPC_PRIVATE || !tags.IsRPCIncluded(rpc) {
+			continue
+		}
+
+		ts.WriteByte('\n')
+
+		// Doc string
+		if rpc.Doc != nil && *rpc.Doc != "" {
+			scanner := bufio.NewScanner(strings.NewReader(*rpc.Doc))
+			indent()
+			ts.WriteString("/**\n")
+			for scanner.Scan() {
+				indent()
+				ts.WriteString(" * ")
+				ts.WriteString(scanner.Text())
+				ts.WriteByte('\n')
+			}
+			indent()
+			ts.WriteString(" */\n")
+		}
+
+		// Signature
+		indent()
+		fmt.Fprintf(ts, "public async %s(", ts.memberName(rpc.Name))
+
+		isRaw := rpc.Proto == meta.RPC_RAW
+
+		if isRaw && !ts.sharedTypes {
+			fmt.Fprintf(ts, "method: %s, ", getMethodType(rpc))
+		}
+
+		nParams := 0
+		// Avoid a name collision.
+		payloadName := "params"
+		segmentPrefix := ""
+		if ts.sharedTypes {
+			segmentPrefix = payloadName + "."
+		}
+		var isStream = rpc.StreamingRequest || rpc.StreamingResponse
+		var hasHandshake = rpc.HandshakeSchema != nil
+		var inlinePathParams = (isRaw || (rpc.RequestSchema == nil && !hasHandshake)) && hasPathParams(rpc) && ts.sharedTypes
+		if inlinePathParams {
+			ts.WriteString(payloadName + ": { ")
+		}
+		var rpcPath strings.Builder
+		for _, s := range rpc.Path.Segments {
+			rpcPath.WriteByte('/')
+			if s.Type != meta.PathSegment_LITERAL {
+				if !ts.sharedTypes || inlinePathParams {
+					if nParams > 0 {
+						ts.WriteString(", ")
+					}
+
+					ts.WriteString(ts.nonReservedId(s.Value))
+					ts.WriteString(": ")
+					switch s.ValueType {
+					case meta.PathSegment_STRING, meta.PathSegment_UUID:
+						ts.WriteString("string")
+					case meta.PathSegment_BOOL:
+						ts.WriteString("boolean")
+					case meta.PathSegment_INT8, meta.PathSegment_INT16, meta.PathSegment_INT32, meta.PathSegment_INT64, meta.PathSegment_INT,
+						meta.PathSegment_UINT8, meta.PathSegment_UINT16, meta.PathSegment_UINT32, meta.PathSegment_UINT64, meta.PathSegment_UINT:
+						ts.WriteString("number")
+					default:
+						panic(fmt.Sprintf("unhandled PathSegment type %s", s.ValueType))
+					}
+					if s.Type == meta.PathSegment_WILDCARD || s.Type == meta.PathSegment_FALLBACK {
+						ts.WriteString("[]")
+					}
+				}
+				if s.Type == meta.PathSegment_WILDCARD || s.Type == meta.PathSegment_FALLBACK {
+					rpcPath.WriteString("${" + segmentPrefix + ts.nonReservedId(s.Value) + ".map(encodeURIComponent).join(\"/\")}")
+				} else {
+					rpcPath.WriteString("${encodeURIComponent(" + segmentPrefix + ts.nonReservedId(s.Value) + ")}")
+				}
+				nParams++
+			} else {
+				rpcPath.WriteString(s.Value)
+			}
+		}
+		if inlinePathParams {
+			ts.WriteString(" }")
+		}
+
+		if (!isStream && rpc.RequestSchema != nil) || (isStream && hasHandshake) {
+			if !ts.sharedTypes && nParams > 0 {
+				ts.WriteString(", ")
+			}
+			ts.WriteString(payloadName + ": ")
+			if ts.sharedTypes {
+				fmt.Fprintf(ts, "RequestType<typeof %s>", rpcImportName(rpc))
+			} else if isStream {
+				ts.writeTyp(ns, rpc.HandshakeSchema, 0)
+			} else {
+				ts.writeTyp(ns, rpc.RequestSchema, 0)
+
+			}
+		} else if isRaw {
+			if nParams > 0 {
+				ts.WriteString(", ")
+			}
+			if !ts.sharedTypes {
+				ts.WriteString("body?: RequestInit[\"body\"], ")
+			}
+
+			if ts.sharedTypes {
+				fmt.Fprintf(ts, "options: PickMethods<%s> = {}", getMethodType(rpc))
+			} else {
+				ts.WriteString("options?: CallParameters")
+			}
+		}
+
+		var direction streamDirection
+
+		if rpc.StreamingRequest && rpc.StreamingResponse {
+			direction = InOut
+		} else if rpc.StreamingRequest {
+			direction = Out
+		} else {
+			direction = In
+		}
+
+		writeStreamRequest := func(ns string, numIndents int) {
+			if rpc.RequestSchema == nil {
+				ts.WriteString("void")
+			} else if ts.sharedTypes {
+				fmt.Fprintf(ts, "StreamRequest<typeof %s>", rpcImportName(rpc))
+			} else {
+				ts.writeTyp(ns, rpc.RequestSchema, numIndents)
+			}
+		}
+		writeStreamResponse := func(ns string, numIndents int) {
+			if rpc.ResponseSchema == nil {
+				ts.WriteString("void")
+			} else if ts.sharedTypes {
+				ts.seenStream = true
+				fmt.Fprintf(ts, "StreamResponse<typeof %s>", rpcImportName(rpc))
+			} else {
+				ts.writeTyp(ns, rpc.ResponseSchema, numIndents)
+			}
+		}
+
+		ts.WriteString("): Promise<")
+
+		if isStream {
+			ts.seenStream = true
+			switch direction {
+			case InOut:
+				ts.WriteString("StreamInOut<")
+				writeStreamRequest(ns, 0)
+				ts.WriteString(", ")
+				writeStreamResponse(ns, 0)
+				ts.WriteString(">")
+			case In:
+				ts.WriteString("StreamIn<")
+				writeStreamResponse(ns, 0)
+				ts.WriteString(">")
+			case Out:
+				ts.WriteString("StreamOut<")
+				writeStreamRequest(ns, 0)
+				ts.WriteString(", ")
+				writeStreamResponse(ns, 0)
+				ts.WriteString(">")
+			}
+		} else if rpc.ResponseSchema != nil {
+			if ts.sharedTypes {
+				fmt.Fprintf(ts, "ResponseType<typeof %s>", rpcImportName(rpc))
+			} else {
+				ts.writeTyp(ns, rpc.ResponseSchema, 0)
+			}
+		} else if isRaw {
+			ts.WriteString("globalThis.Response")
+		} else {
+			ts.WriteString("void")
+		}
+		ts.WriteString("> {\n")
+
+		if isStream {
+			if err := ts.streamCallSite(ts.newIdentWriter(numIndent+1), rpc, rpcPath.String(), direction); err != nil {
+				return errors.Wrapf(err, "unable to write streaming RPC call site for %ss.%s", rpc.ServiceName, rpc.Name)
+			}
+		} else {
+			if err := ts.rpcCallSite(ns, ts.newIdentWriter(numIndent+1), rpc, rpcPath.String()); err != nil {
+				return errors.Wrapf(err, "unable to write RPC call site for %s.%s", rpc.ServiceName, rpc.Name)
+			}
+		}
+
+		indent()
+		ts.WriteString("}\n")
+	}
+	numIndent--
+	indent()
+	ts.WriteString("}\n}\n\n")
+	return nil
+}
+
+func (ts *typescript) streamCallSite(w *indentWriter, rpc *meta.RPC, rpcPath string, direction streamDirection) error {
+	headers := ""
+	query := ""
+
+	if rpc.HandshakeSchema != nil {
+		encs, err := encoding.DescribeRequest(ts.md, rpc.HandshakeSchema, &encoding.Options{SrcNameTag: "json"}, "GET")
+		if err != nil {
+			return errors.Wrapf(err, "stream %s", rpc.Name)
+		}
+
+		handshakeEnc := encs[0]
+
+		if len(handshakeEnc.HeaderParameters) > 0 || len(handshakeEnc.QueryParameters) > 0 {
+			w.WriteString("// Convert our params into the objects we need for the request\n")
+		}
+
+		// Generate the headers
+		if len(handshakeEnc.HeaderParameters) > 0 {
+			headers = "headers"
+
+			dict := make(map[string]string)
+			for _, field := range handshakeEnc.HeaderParameters {
+				ref := ts.Dot("params", field.SrcName)
+				dict[field.WireFormat] = ts.convertBuiltinToString(field.Type.GetBuiltin(), ref, field.Optional)
+			}
+
+			w.WriteString("const headers = makeRecord<string, string>(")
+			ts.Values(w, dict)
+			w.WriteString(")\n\n")
+		}
+
+		// Generate the query string
+		if len(handshakeEnc.QueryParameters) > 0 {
+			query = "query"
+
+			dict := make(map[string]string)
+			for _, field := range handshakeEnc.QueryParameters {
+				if list := field.Type.GetList(); list != nil {
+					dot := ts.Dot("params", field.SrcName)
+					if field.Optional || ts.isRecursive(field.Type) {
+						dot += "?"
+					}
+					dict[field.WireFormat] = dot +
+						".map((v) => " + ts.convertBuiltinToString(list.Elem.GetBuiltin(), "v", field.Optional) + ")"
+				} else {
+					dict[field.WireFormat] = ts.convertBuiltinToString(
+						field.Type.GetBuiltin(),
+						ts.Dot("params", field.SrcName),
+						field.Optional,
+					)
+				}
+			}
+
+			w.WriteString("const query = makeRecord<string, string | string[]>(")
+			ts.Values(w, dict)
+			w.WriteString(")\n\n")
+		}
+	}
+
+	// Build the call to createStream
+	var method string
+
+	switch direction {
+	case InOut:
+		method = "createStreamInOut"
+	case In:
+		method = "createStreamIn"
+	case Out:
+		method = "createStreamOut"
+	}
+
+	createStream := fmt.Sprintf(
+		"this.baseClient.%s(`%s`",
+		method,
+		rpcPath,
+	)
+
+	if headers != "" || query != "" {
+		createStream += ", {" + headers
+
+		if headers != "" && query != "" {
+			createStream += ", "
+		}
+
+		if query != "" {
+			createStream += query
+		}
+
+		createStream += "}"
+	}
+	createStream += ")"
+
+	w.WriteStringf("return await %s\n", createStream)
+	return nil
+}
+
+func (ts *typescript) rpcCallSite(ns string, w *indentWriter, rpc *meta.RPC, rpcPath string) error {
+	// Work out how we're going to encode and call this RPC
+	rpcEncoding, err := encoding.DescribeRPC(ts.md, rpc, &encoding.Options{SrcNameTag: "json"})
+	if err != nil {
+		return errors.Wrapf(err, "rpc %s", rpc.Name)
+	}
+
+	// Raw end points just pass through the request
+	// and need no further code generation
+	if rpc.Proto == meta.RPC_RAW {
+		if ts.sharedTypes {
+			w.WriteStringf("options.method ||= \"%s\";\n", rpcEncoding.DefaultMethod)
+		}
+		w.WriteString("return this.baseClient.callAPI(")
+		if ts.sharedTypes {
+			w.WriteStringf(
+				"`%s`, options",
+				rpcPath,
+			)
+
+		} else {
+			w.WriteStringf(
+				"method, `%s`, body, options",
+				rpcPath,
+			)
+		}
+		w.WriteString(")\n")
+		return nil
+	}
+
+	// Work out how we encode the Request Schema
+	headers := ""
+	query := ""
+	body := ""
+
+	if rpc.RequestSchema != nil {
+		reqEnc := rpcEncoding.DefaultRequestEncoding
+
+		if len(reqEnc.HeaderParameters) > 0 || len(reqEnc.QueryParameters) > 0 {
+			w.WriteString("// Convert our params into the objects we need for the request\n")
+		}
+
+		// Generate the headers
+		if len(reqEnc.HeaderParameters) > 0 {
+			headers = "headers"
+
+			dict := make(map[string]string)
+			for _, field := range reqEnc.HeaderParameters {
+				ref := ts.Dot("params", field.SrcName)
+				dict[field.WireFormat] = ts.convertBuiltinToString(field.Type.GetBuiltin(), ref, field.Optional)
+			}
+
+			w.WriteString("const headers = makeRecord<string, string>(")
+			ts.Values(w, dict)
+			w.WriteString(")\n\n")
+		}
+
+		// Generate the query string
+		if len(reqEnc.QueryParameters) > 0 {
+			query = "query"
+
+			dict := make(map[string]string)
+			for _, field := range reqEnc.QueryParameters {
+				if list := field.Type.GetList(); list != nil {
+					dot := ts.Dot("params", field.SrcName)
+					if field.Optional || ts.isRecursive(field.Type) {
+						dot += "?"
+					}
+					dict[field.WireFormat] = dot +
+						".map((v) => " + ts.convertBuiltinToString(list.Elem.GetBuiltin(), "v", field.Optional) + ")"
+				} else {
+					dict[field.WireFormat] = ts.convertBuiltinToString(
+						field.Type.GetBuiltin(),
+						ts.Dot("params", field.SrcName),
+						field.Optional,
+					)
+				}
+			}
+
+			w.WriteString("const query = makeRecord<string, string | string[]>(")
+			ts.Values(w, dict)
+			w.WriteString(")\n\n")
+		}
+
+		// Generate the body
+		if len(reqEnc.BodyParameters) > 0 {
+			if len(reqEnc.HeaderParameters) == 0 && len(reqEnc.QueryParameters) == 0 && (!ts.sharedTypes || !hasPathParams(rpc)) {
+				// In the simple case we can just encode the params as the body directly
+				body = "JSON.stringify(params)"
+			} else {
+				// Else we need a new struct called "body"
+				body = "JSON.stringify(body)"
+
+				dict := make(map[string]string)
+				for _, field := range reqEnc.BodyParameters {
+					dict[field.WireFormat] = ts.Dot("params", field.SrcName)
+				}
+
+				w.WriteString("// Construct the body with only the fields which we want encoded within the body (excluding query string or header fields)\nconst body: Record<string, any> = ")
+				ts.Values(w, dict)
+				w.WriteString("\n\n")
+			}
+		}
+	}
+
+	// Build the call to callTypedAPI
+	callAPI := "this.baseClient.callTypedAPI("
+	if !ts.sharedTypes {
+		callAPI += fmt.Sprintf("\"%s\", ", rpcEncoding.DefaultMethod)
+	}
+	callAPI += fmt.Sprintf("`%s`", rpcPath)
+	if body != "" || headers != "" || query != "" || ts.sharedTypes {
+		if body == "" {
+			body = "undefined"
+		}
+		if !ts.sharedTypes {
+			callAPI += ", " + body
+		}
+
+		if headers != "" || query != "" || ts.sharedTypes {
+			callAPI += ", {" + headers
+
+			if headers != "" && query != "" {
+				callAPI += ", "
+			}
+
+			if query != "" {
+				callAPI += query
+			}
+
+			if ts.sharedTypes {
+				if headers != "" || query != "" {
+					callAPI += ", "
+				}
+				callAPI += fmt.Sprintf(`method: "%s", body: %s`, rpcEncoding.DefaultMethod, body)
+			}
+			callAPI += "}"
+		}
+	}
+	callAPI += ")"
+
+	// If there's no response schema, we can just return the call to the API directly
+	if rpc.ResponseSchema == nil {
+		w.WriteStringf("await %s\n", callAPI)
+		return nil
+	}
+
+	w.WriteStringf("// Now make the actual call to the API\nconst resp = await %s\n", callAPI)
+
+	respEnc := rpcEncoding.ResponseEncoding
+
+	// If we don't need to do anything with the body, we can just return the response
+	if len(respEnc.HeaderParameters) == 0 {
+		if ts.sharedTypes {
+			w.WriteString("return JSON.parse(await resp.text(), dateReviver) as ")
+			fmt.Fprintf(ts, "ResponseType<typeof %s>", rpcImportName(rpc))
+		} else {
+			w.WriteString("return await resp.json() as ")
+			ts.writeTyp(ns, rpc.ResponseSchema, 0)
+		}
+		w.WriteString("\n")
+		return nil
+	}
+
+	// Otherwise, we need to add the header fields to the response
+	w.WriteString("\n//Populate the return object from the JSON body and received headers\n")
+
+	if ts.sharedTypes {
+		w.WriteStringf("const rtn = JSON.parse(await resp.text(), dateReviver) as ResponseType<typeof %s>", rpcImportName(rpc))
+	} else {
+		w.WriteString("const rtn = await resp.json() as ")
+		ts.writeTyp(ns, rpc.ResponseSchema, 0)
+	}
+	w.WriteString("\n")
+
+	for _, headerField := range respEnc.HeaderParameters {
+		isSetCookie := strings.ToLower(headerField.WireFormat) == "set-cookie"
+		if isSetCookie {
+			w.WriteString("// Skip set-cookie header in browser context as browsers doesn't have access to read it\n")
+			w.WriteString("if (!BROWSER) {\n")
+			w = w.Indent()
+		}
+
+		ts.seenHeaderResponse = true
+		fieldValue := fmt.Sprintf("mustBeSet(\"Header `%s`\", resp.headers.get(\"%s\"))", headerField.WireFormat, headerField.WireFormat)
+
+		w.WriteStringf("%s = %s\n", ts.Dot("rtn", headerField.SrcName), ts.convertStringToBuiltin(headerField.Type.GetBuiltin(), fieldValue))
+
+		if isSetCookie {
+			w = w.Dedent()
+			w.WriteString("}\n")
+		}
+	}
+
+	w.WriteString("return rtn\n")
+	return nil
+}
+
+// nonReservedId returns the given ID, unless we have it a reserved within the client function _or_ it's a reserved Typescript keyword
+func (ts *typescript) nonReservedId(id string) string {
+	switch id {
+	// our reserved keywords (or ID's we use within the generated client functions)
+	case "params", "headers", "query", "body", "resp", "rtn":
+		return "_" + id
+
+	// Typescript & Javascript keywords
+	case "abstract", "any", "arguments", "as", "async", "await", "boolean", "break", "byte", "case", "catch", "char",
+		"class", "const", "constructor", "continue", "debugger", "declare", "default", "delete", "do", "double", "else",
+		"enum", "eval", "export", "extends", "false", "final", "finally", "float", "for", "from", "function", "get",
+		"goto", "if", "implements", "import", "in", "instanceof", "interface", "let", "long", "module", "namespace",
+		"native", "new", "null", "number", "of", "package", "private", "protected", "public", "require", "return",
+		"set", "short", "static", "string", "super", "switch", "symbol", "synchronized", "this", "throw", "throws",
+		"transient", "true", "try", "type", "typeof", "var", "void", "volatile", "while", "with", "yield":
+		return "_" + id
+
+	default:
+		return id
+	}
+}
+
+func (ts *typescript) writeNamespace(ns string) {
+	decls := ts.typs.Decls(ns)
+	if len(decls) == 0 {
+		return
+	}
+
+	fmt.Fprintf(ts, "export namespace %s {\n", ts.typeName(ns))
+	sort.Slice(decls, func(i, j int) bool {
+		return decls[i].Name < decls[j].Name
+	})
+	for i, d := range decls {
+		if i > 0 {
+			ts.WriteString("\n")
+		}
+
+		ts.writeDeclDef(ns, d)
+	}
+	ts.WriteString("}\n\n")
+}
+
+func (ts *typescript) writeDeclDef(ns string, decl *schema.Decl) {
+	if decl.Doc != "" {
+		scanner := bufio.NewScanner(strings.NewReader(decl.Doc))
+		ts.WriteString("    /**\n")
+		for scanner.Scan() {
+			ts.WriteString("     * ")
+			ts.WriteString(scanner.Text())
+			ts.WriteByte('\n')
+		}
+		ts.WriteString("     */\n")
+	}
+
+	var typeParams strings.Builder
+	if len(decl.TypeParams) > 0 {
+		typeParams.WriteRune('<')
+
+		for i, typeParam := range decl.TypeParams {
+			if i > 0 {
+				typeParams.WriteString(", ")
+			}
+
+			typeParams.WriteString(typeParam.Name)
+		}
+
+		typeParams.WriteRune('>')
+	}
+
+	// If it's a struct type, expose it as an interface;
+	// other types should be type aliases.
+	if st := decl.Type.GetStruct(); st != nil {
+		fmt.Fprintf(ts, "    export interface %s%s ", ts.typeName(decl.Name), typeParams.String())
+	} else {
+		fmt.Fprintf(ts, "    export type %s%s = ", ts.typeName(decl.Name), typeParams.String())
+	}
+	ts.currDecl = decl
+	ts.writeTyp(ns, decl.Type, 1)
+	ts.WriteString("\n")
+}
+
+func (ts *typescript) writeStreamClasses() {
+	if ts.sharedTypes {
+		ts.WriteString(`
+import {
+  StreamInOutHandlerFn,
+  StreamInHandlerFn,
+  StreamOutHandlerFn,
+} from "encore.dev/api";
+
+type StreamRequest<Type> = Type extends
+  | StreamInOutHandlerFn<any, infer Req, any>
+  | StreamInHandlerFn<any, infer Req, any>
+  | StreamOutHandlerFn<any, any>
+  ? Req
+  : never;
+
+type StreamResponse<Type> = Type extends
+  | StreamInOutHandlerFn<any, any, infer Resp>
+  | StreamInHandlerFn<any, any, infer Resp>
+  | StreamOutHandlerFn<any, infer Resp>
+  ? Resp
+  : never;
+
+`)
+	}
+
+	parse := "JSON.parse(event.data)"
+	if ts.sharedTypes {
+		parse = "JSON.parse(event.data, dateReviver)"
+	}
+
+	send := `
+    async send(msg: Request) {
+        if (this.socket.ws.readyState === WebSocket.CONNECTING) {
+            // await that the socket is opened
+            await new Promise((resolve) => {
+                this.socket.ws.addEventListener("open", resolve, { once: true });
+            });
+        }
+
+        return this.socket.ws.send(JSON.stringify(msg));
+    }`
+
+	receive := `
+    async next(): Promise<Response | undefined> {
+        for await (const next of this) return next;
+        return undefined;
+    }
+
+    async *[Symbol.asyncIterator](): AsyncGenerator<Response, undefined, void> {
+        while (true) {
+            if (this.buffer.length > 0) {
+                yield this.buffer.shift() as Response;
+            } else {
+                if (this.socket.ws.readyState === WebSocket.CLOSED) return;
+                await this.socket.hasUpdate();
+            }
+        }
+    }`
+
+	ts.WriteString(`
+function encodeWebSocketHeaders(headers: Record<string, string>) {
+    // url safe, no pad
+    const base64encoded = btoa(JSON.stringify(headers))
+      .replaceAll("=", "")
+      .replaceAll("+", "-")
+      .replaceAll("/", "_");
+    return "encore.dev.headers." + base64encoded;
+}
+
+class WebSocketConnection {
+    public ws: WebSocket;
+
+    private hasUpdateHandlers: (() => void)[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let protocols = ["encore-ws"];
+        if (headers) {
+            protocols.push(encodeWebSocketHeaders(headers))
+        }
+
+        this.ws = new WebSocket(url, protocols)
+
+        this.on("error", () => {
+            this.resolveHasUpdateHandlers();
+        });
+
+        this.on("close", () => {
+            this.resolveHasUpdateHandlers();
+        });
+    }
+
+    resolveHasUpdateHandlers() {
+        const handlers = this.hasUpdateHandlers;
+        this.hasUpdateHandlers = [];
+
+        for (const handler of handlers) {
+            handler()
+        }
+    }
+
+    async hasUpdate() {
+        // await until a new message have been received, or the socket is closed
+        await new Promise((resolve) => {
+            this.hasUpdateHandlers.push(() => resolve(null))
+        });
+    }
+
+    on(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.addEventListener(type, handler);
+    }
+
+    off(type: "error" | "close" | "message" | "open", handler: (event: any) => void) {
+        this.ws.removeEventListener(type, handler);
+    }
+
+    close() {
+        this.ws.close();
+    }
+}
+
+export class StreamInOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(` + parse + `);
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+` + send + `
+` + receive + `
+}
+
+export class StreamIn<Response> {
+    public socket: WebSocketConnection;
+    private buffer: Response[] = [];
+
+    constructor(url: string, headers?: Record<string, string>) {
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            this.buffer.push(` + parse + `);
+            this.socket.resolveHasUpdateHandlers();
+        });
+    }
+
+    close() {
+        this.socket.close();
+    }
+` + receive + `
+}
+
+export class StreamOut<Request, Response> {
+    public socket: WebSocketConnection;
+    private responseValue: Promise<Response>;
+
+    constructor(url: string, headers?: Record<string, string>) {
+        let responseResolver: (_: any) => void;
+        this.responseValue = new Promise((resolve) => responseResolver = resolve);
+
+        this.socket = new WebSocketConnection(url, headers);
+        this.socket.on("message", (event: any) => {
+            responseResolver(` + parse + `)
+        });
+    }
+
+    async response(): Promise<Response> {
+        return this.responseValue;
+    }
+
+    close() {
+        this.socket.close();
+    }
+` + send + `
+}`)
+}
+
+func (ts *typescript) writeClient(set clientgentypes.ServiceSet) {
+	w := ts.newIdentWriter(0)
+	w.WriteStringf(`
+/**
+ * BaseURL is the base URL for calling the Encore application's API.
+ */
+export type BaseURL = string
+
+export const Local: BaseURL = "http://localhost:4000"
+
+/**
+ * Environment returns a BaseURL for calling the cloud environment with the given name.
+ */
+export function Environment(name: string): BaseURL {
+    return `+"`https://${name}-"+ts.appSlug+".encr.app`"+`
+}
+
+/**
+ * PreviewEnv returns a BaseURL for calling the preview environment with the given PR number.
+ */
+export function PreviewEnv(pr: number | string): BaseURL {
+    return Environment(`+"`pr${pr}`"+`)
+}
+
+const BROWSER = typeof globalThis === "object" && ("window" in globalThis);
+
+/**
+ * Client is an API client for the `+ts.appSlug+` Encore application.
+ */
+export %sclass Client {
+`, func() string {
+		if ts.clientTarget != "" {
+			return ""
+		}
+		return "default "
+	}())
+
+	{
+		w := w.Indent()
+
+		for _, svc := range ts.md.Svcs {
+			if hasPublicRPC(svc) && set.Has(svc.Name) {
+				w.WriteStringf("public readonly %s: %s.ServiceClient\n", ts.memberName(svc.Name), ts.typeName(svc.Name))
+			}
+		}
+		w.WriteString("private readonly options: ClientOptions\n")
+		w.WriteString("private readonly target: string\n")
+		w.WriteString("\n")
+
+		// Only include the deprecated constructor if bearer token authentication is being used
+		if ts.hasAuth && !ts.authIsComplexType {
+			w.WriteString(`
+/**
+ * @deprecated This constructor is deprecated, and you should move to using BaseURL with an Options object
+ */
+constructor(target: string, token?: string)
+`)
+		}
+
+		w.WriteString(`
+/**
+ * Creates a Client for calling the public and authenticated APIs of your Encore application.
+ *
+ * @param target  The target which the client should be configured to use. See Local and Environment for options.
+ * @param options Options for the client
+ */
+constructor(target: BaseURL, options?: ClientOptions)`)
+
+		if ts.hasAuth && !ts.authIsComplexType {
+			w.WriteString("\nconstructor(target: string | BaseURL = \"prod\", options?: string | ClientOptions) {\n")
+			{
+				w := w.Indent()
+
+				w.WriteString(`
+// Convert the old constructor parameters to a BaseURL object and a ClientOptions object
+if (!target.startsWith("http://") && !target.startsWith("https://")) {
+    target = Environment(target)
+}
+
+if (typeof options === "string") {
+    options = { auth: options }
+}
+
+`)
+			}
+		} else {
+			w.WriteString(" {\n")
+		}
+
+		{
+			w := w.Indent()
+
+			w.WriteString("this.target = target\n")
+			w.WriteString("this.options = options ?? {}\n")
+			w.WriteString("const base = new BaseClient(this.target, this.options)\n")
+			for _, svc := range ts.md.Svcs {
+				if hasPublicRPC(svc) && set.Has(svc.Name) {
+					w.WriteStringf("this.%s = new %s.ServiceClient(base)\n", ts.memberName(svc.Name), ts.typeName(svc.Name))
+				}
+			}
+		}
+		w.WriteString("}\n")
+	}
+
+	w.WriteString(`
+    /**
+     * Creates a new Encore client with the given client options set.
+     *
+     * @param options Client options to set. They are merged with existing options.
+     **/
+    public with(options: ClientOptions): Client {
+        return new Client(this.target, {
+            ...this.options,
+            ...options,
+        })
+    }
+`)
+
+	w.WriteString("}\n")
+
+	handler := ts.md.AuthHandler
+	if ts.hasAuth && ts.sharedTypes && ts.authIsComplexType {
+
+		ts.WriteString(`
+/**
+ * Import the auth handler to be able to derive the auth type
+ */
+`)
+		fmt.Fprintf(ts, `import type { %s as %s } from "~backend/%s/%s";`,
+			handler.Name,
+			ts.authImportName(),
+			handler.Loc.PkgName,
+			strings.TrimSuffix(handler.Loc.Filename, filepath.Ext(handler.Loc.Filename)))
+		ts.WriteString("\n")
+	}
+
+	w.WriteString(`
+/**
+ * ClientOptions allows you to override any default behaviour within the generated Encore client.
+ */
+export interface ClientOptions {
+    /**
+     * By default the client will use the inbuilt fetch function for making the API requests.
+     * however you can override it with your own implementation here if you want to run custom
+     * code on each API request made or response received.
+     */
+    fetcher?: Fetcher
+
+    /** Default RequestInit to be used for the client */
+    requestInit?: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }
+`)
+
+	if ts.hasAuth {
+		if !ts.authIsComplexType {
+			w.WriteString(`
+    /**
+     * Allows you to set the auth token to be used for each request
+     * either by passing in a static token string or by passing in a function
+     * which returns the auth token.
+     *
+     * These tokens will be sent as bearer tokens in the Authorization header.
+     */
+`)
+		} else {
+			w.WriteString(`
+    /**
+     * Allows you to set the authentication data to be used for each
+     * request either by passing in a static object or by passing in
+     * a function which returns a new object for each request.
+     */
+`)
+		}
+
+		w.WriteString("    auth?: ")
+		ts.writeAuthType()
+		w.WriteString(" | AuthDataGenerator\n")
+	}
+
+	w.WriteString(`}
+
+`)
+}
+
+func (ts *typescript) writeBaseClient(appSlug string) error {
+	userAgent := fmt.Sprintf("%s-Generated-TS-Client (Encore/%s)", appSlug, version.Version)
+
+	reqOmit := `"method" | "body" | "headers"`
+	if ts.sharedTypes {
+		reqOmit = `"headers"`
+	}
+	fmt.Fprintf(ts, `
+// CallParameters is the type of the parameters to a method call, but require headers to be a Record type
+type CallParameters = Omit<RequestInit, %s> & {
+    /** Headers to be sent with the request */
+    headers?: Record<string, string>
+
+    /** Query parameters to be sent with the request */
+    query?: Record<string, string | string[]>
+}
+`, reqOmit)
+
+	if ts.hasAuth {
+		ts.WriteString(`
+// AuthDataGenerator is a function that returns a new instance of the authentication data required by this API
+export type AuthDataGenerator = () =>
+  | `)
+		ts.writeAuthType()
+		ts.WriteString(`
+  | Promise<`)
+		ts.writeAuthType()
+		ts.WriteString(` | undefined>
+  | undefined;`)
+	}
+
+	ts.WriteString(`
+
+// A fetcher is the prototype for the inbuilt Fetch function
+export type Fetcher = typeof fetch;
+
+const boundFetch = fetch.bind(this);
+
+class BaseClient {
+    readonly baseURL: string
+    readonly fetcher: Fetcher
+    readonly headers: Record<string, string>
+    readonly requestInit: Omit<RequestInit, "headers"> & { headers?: Record<string, string> }`)
+
+	if ts.hasAuth {
+		ts.WriteString("\n    readonly authGenerator?: AuthDataGenerator")
+	}
+
+	ts.WriteString(`
+
+    constructor(baseURL: string, options: ClientOptions) {
+        this.baseURL = baseURL
+        this.headers = {}
+
+        // Add User-Agent header if the script is running in the server
+        // because browsers do not allow setting User-Agent headers to requests
+        if (!BROWSER) {
+            this.headers["User-Agent"] = "` + userAgent + `";
+        }
+
+        this.requestInit = options.requestInit ?? {};
+
+        // Setup what fetch function we'll be using in the base client
+        if (options.fetcher !== undefined) {
+            this.fetcher = options.fetcher
+        } else {
+            this.fetcher = boundFetch
+        }`)
+
+	if ts.hasAuth {
+		ts.WriteString(`
+
+        // Setup an authentication data generator using the auth data token option
+        if (options.auth !== undefined) {
+            const auth = options.auth
+            if (typeof auth === "function") {
+                this.authGenerator = auth
+            } else {
+                this.authGenerator = () => auth
+            }
+        }`)
+	}
+
+	ts.WriteString(`
+    }
+
+    async getAuthData(): Promise<CallParameters | undefined> {`)
+	if ts.hasAuth {
+		ts.WriteString(`
+        let authData: `)
+		ts.writeAuthType()
+		ts.WriteString(` | undefined;
+
+        // If authorization data generator is present, call it and add the returned data to the request
+        if (this.authGenerator) {
+            const mayBePromise = this.authGenerator();
+            if (mayBePromise instanceof Promise) {
+                authData = await mayBePromise;
+            } else {
+                authData = mayBePromise;
+            }
+        }
+
+        if (authData) {
+            const data: CallParameters = {};
+
+`)
+
+		w := ts.newIdentWriter(3)
+		if ts.authIsComplexType {
+			authData, err := encoding.DescribeAuth(ts.md, ts.md.AuthHandler.Params, &encoding.Options{SrcNameTag: "json"})
+			if err != nil {
+				return errors.Wrap(err, "unable to describe auth data")
+			}
+
+			// Generate the query string
+			if len(authData.QueryParameters) > 0 {
+				dict := make(map[string]string)
+				for _, field := range authData.QueryParameters {
+					if list := field.Type.GetList(); list != nil {
+						dot := ts.Dot("authData", field.SrcName)
+						if field.Optional || ts.isRecursive(field.Type) {
+							dot += "?"
+						}
+						dict[field.WireFormat] = dot +
+							".map((v) => " + ts.convertBuiltinToString(list.Elem.GetBuiltin(), "v", field.Optional) + ")"
+					} else {
+						dict[field.WireFormat] = ts.convertBuiltinToString(
+							field.Type.GetBuiltin(),
+							ts.Dot("authData", field.SrcName),
+							field.Optional,
+						)
+					}
+				}
+
+				w.WriteString("data.query = makeRecord<string, string | string[]>(")
+				ts.Values(w, dict)
+				w.WriteString(");\n")
+			}
+
+			// Generate the headers
+			if len(authData.HeaderParameters) > 0 {
+				dict := make(map[string]string)
+				for _, field := range authData.HeaderParameters {
+					ref := ts.Dot("authData", field.SrcName)
+					dict[field.WireFormat] = ts.convertBuiltinToString(field.Type.GetBuiltin(), ref, field.Optional)
+				}
+
+				w.WriteString("data.headers = makeRecord<string, string>(")
+				ts.Values(w, dict)
+				w.WriteString(");\n")
+			}
+		} else {
+			w.WriteString("data.headers = {};\n")
+			w.WriteString("data.headers[\"Authorization\"] = \"Bearer \" + authData;\n")
+		}
+
+		w.WriteString("\nreturn data;\n")
+		w.Dedent().WriteString("}\n")
+	}
+
+	ts.WriteString(`
+        return undefined;
+    }
+`)
+
+	ts.WriteString(`
+    // createStreamInOut sets up a stream to a streaming API endpoint.
+    async createStreamInOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamInOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamInOut(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamIn sets up a stream to a streaming API endpoint.
+    async createStreamIn<Response>(path: string, params?: CallParameters): Promise<StreamIn<Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamIn(this.baseURL + path + queryString, headers);
+    }
+
+    // createStreamOut sets up a stream to a streaming API endpoint.
+    async createStreamOut<Request, Response>(path: string, params?: CallParameters): Promise<StreamOut<Request, Response>> {
+        let { query, headers } = params ?? {};
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                headers = {...headers, ...authData.headers};
+            }
+        }
+
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        return new StreamOut(this.baseURL + path + queryString, headers);
+    }
+`)
+
+	callParams := "method: string, path: string, body?: RequestInit[\"body\"], params?: CallParameters"
+	callAPIParams := "method, path, body"
+	initParams := `
+            method,
+            body: body ?? null,`
+	if ts.sharedTypes {
+		callParams = "path: string, params?: CallParameters"
+		callAPIParams = "path"
+		initParams = ""
+	}
+
+	fmt.Fprintf(ts, `
+    // callTypedAPI makes an API call, defaulting content type to "application/json"
+    public async callTypedAPI(%s): Promise<Response> {
+        return this.callAPI(%s, {
+            ...params,
+            headers: { "Content-Type": "application/json", ...params?.headers }
+        });
+    }
+`, callParams, callAPIParams)
+
+	fmt.Fprintf(ts, `
+    // callAPI is used by each generated API method to actually make the request
+    public async callAPI(%s): Promise<Response> {
+        let { query, headers, ...rest } = params ?? {}
+        const init = {
+            ...this.requestInit,
+            ...rest,%s
+        }
+`, callParams, initParams)
+
+	ts.WriteString(`
+        // Merge our headers with any predefined headers
+        init.headers = {...this.headers, ...init.headers, ...headers}
+
+        // Fetch auth data if there is any
+        const authData = await this.getAuthData();
+
+        // If we now have authentication data, add it to the request
+        if (authData) {
+            if (authData.query) {
+                query = {...query, ...authData.query};
+            }
+            if (authData.headers) {
+                init.headers = {...init.headers, ...authData.headers};
+            }
+        }
+
+        // Make the actual request
+        const queryString = query ? '?' + encodeQuery(query) : ''
+        const response = await this.fetcher(this.baseURL+path+queryString, init)
+
+        // handle any error responses
+        if (!response.ok) {
+            // try and get the error message from the response body
+            let body: APIErrorResponse = { code: ErrCode.Unknown, message: ` + "`request failed: status ${response.status}`" + ` }
+
+            // if we can get the structured error we should, otherwise give a best effort
+            try {
+                const text = await response.text()
+
+                try {
+                    const jsonBody = JSON.parse(text)
+                    if (isAPIErrorResponse(jsonBody)) {
+                        body = jsonBody
+                    } else {
+                        body.message += ": " + JSON.stringify(jsonBody)
+                    }
+                } catch {
+                    body.message += ": " + text
+                }
+            } catch (e) {
+                // otherwise we just append the text to the error message
+                body.message += ": " + String(e)
+            }
+
+            throw new APIError(response.status, body)
+        }
+
+        return response
+    }
+}`)
+	return nil
+}
+
+func (ts *typescript) writeExtraTypes() {
+	if ts.seenJSON {
+		ts.WriteString(`// JSONValue represents an arbitrary JSON value.
+export type JSONValue = string | number | boolean | null | JSONValue[] | {[key: string]: JSONValue}
+`)
+	}
+	if ts.sharedTypes {
+		ts.WriteString(`
+type PickMethods<Type> = Omit<CallParameters, "method"> & { method?: Type };
+
+// Helper type to omit all fields that are cookies.
+type OmitCookie<T> = {
+  [K in keyof T as T[K] extends CookieWithOptions<any> ? never : K]: T[K];
+};
+
+type RequestType<Type extends (...args: any[]) => any> =
+  Parameters<Type> extends [infer H, ...any[]]
+    ? OmitCookie<H>
+    : void;
+
+type ResponseType<Type extends (...args: any[]) => any> = OmitCookie<Awaited<ReturnType<Type>>>;
+
+function dateReviver(key: string, value: any): any {
+  if (
+    typeof value === "string" &&
+    value.length >= 10 &&
+    value.charCodeAt(0) >= 48 && // '0'
+    value.charCodeAt(0) <= 57 // '9'
+  ) {
+    const parsedDate = new Date(value);
+    if (!isNaN(parsedDate.getTime())) {
+      return parsedDate;
+    }
+  }
+  return value;
+}
+`)
+	}
+
+	ts.WriteString(`
+
+function encodeQuery(parts: Record<string, string | string[]>): string {
+    const pairs: string[] = []
+    for (const key in parts) {
+        const val = (Array.isArray(parts[key]) ?  parts[key] : [parts[key]]) as string[]
+        for (const v of val) {
+            pairs.push(` + "`" + `${key}=${encodeURIComponent(v)}` + "`" + `)
+        }
+    }
+    return pairs.join("&")
+}
+
+// makeRecord takes a record and strips any undefined values from it,
+// and returns the same record with a narrower type.
+// @ts-ignore - TS ignore because makeRecord is not always used
+function makeRecord<K extends string | number | symbol, V>(record: Record<K, V | undefined>): Record<K, V> {
+    for (const key in record) {
+        if (record[key] === undefined) {
+            delete record[key]
+        }
+    }
+    return record as Record<K, V>
+}
+`)
+
+	if ts.seenHeaderResponse {
+		ts.WriteString(`
+
+// mustBeSet will throw an APIError with the Data Loss code if value is null or undefined
+function mustBeSet<A>(field: string, value: A | null | undefined): A {
+    if (value === null || value === undefined) {
+        throw new APIError(
+            500,
+            {
+                code: ErrCode.DataLoss,
+                message: ` + "`${field} was unexpectedly ${value}`" + `, // ${value} will create the string "null" or "undefined"
+            },
+        )
+    }
+    return value
+}
+`)
+	}
+}
+
+func (ts *typescript) writeDecl(ns string, decl *schema.Decl) {
+	if decl.Loc.PkgName != ns {
+		ts.WriteString(ts.typeName(decl.Loc.PkgName) + ".")
+	}
+	ts.WriteString(ts.typeName(decl.Name))
+}
+
+func (ts *typescript) builtinType(typ schema.Builtin) string {
+	switch typ {
+	case schema.Builtin_ANY:
+		return "any"
+	case schema.Builtin_BOOL:
+		return "boolean"
+	case schema.Builtin_INT, schema.Builtin_INT8, schema.Builtin_INT16, schema.Builtin_INT32, schema.Builtin_INT64,
+		schema.Builtin_UINT, schema.Builtin_UINT8, schema.Builtin_UINT16, schema.Builtin_UINT32, schema.Builtin_UINT64,
+		schema.Builtin_FLOAT32, schema.Builtin_FLOAT64:
+		return "number"
+	case schema.Builtin_STRING:
+		return "string"
+	case schema.Builtin_BYTES:
+		return "string" // TODO
+	case schema.Builtin_TIME:
+		return "string" // TODO
+	case schema.Builtin_JSON:
+		ts.seenJSON = true
+		return "JSONValue"
+	case schema.Builtin_UUID:
+		return "string"
+	case schema.Builtin_USER_ID:
+		return "string"
+	case schema.Builtin_DECIMAL:
+		return "string"
+	default:
+		ts.errorf("unknown builtin type %v", typ)
+		return "any"
+	}
+}
+
+func (ts *typescript) convertBuiltinToString(typ schema.Builtin, val string, isOptional bool) string {
+	var code string
+	switch typ {
+	case schema.Builtin_STRING:
+		return val
+	case schema.Builtin_JSON:
+		code = fmt.Sprintf("JSON.stringify(%s)", val)
+	case schema.Builtin_TIME:
+		if ts.sharedTypes {
+			// If we're using shared types then this will actually be a Date object.
+			// Otherwise it will be a string.
+			code = fmt.Sprintf("%s.toISOString()", val)
+		} else {
+			code = fmt.Sprintf("String(%s)", val)
+		}
+	default:
+		code = fmt.Sprintf("String(%s)", val)
+	}
+
+	if isOptional {
+		code = fmt.Sprintf("%s === undefined ? undefined : %s", val, code)
+	}
+	return code
+}
+
+func (ts *typescript) convertStringToBuiltin(typ schema.Builtin, val string) string {
+	switch typ {
+	case schema.Builtin_ANY:
+		return val
+	case schema.Builtin_BOOL:
+		return fmt.Sprintf("%s.toLowerCase() === \"true\"", val)
+	case schema.Builtin_INT, schema.Builtin_INT8, schema.Builtin_INT16, schema.Builtin_INT32, schema.Builtin_INT64,
+		schema.Builtin_UINT, schema.Builtin_UINT8, schema.Builtin_UINT16, schema.Builtin_UINT32, schema.Builtin_UINT64:
+		return fmt.Sprintf("parseInt(%s, 10)", val)
+	case schema.Builtin_FLOAT32, schema.Builtin_FLOAT64:
+		return fmt.Sprintf("Number(%s)", val)
+	case schema.Builtin_STRING:
+		return val
+	case schema.Builtin_BYTES:
+		return val
+	case schema.Builtin_TIME:
+		return val
+	case schema.Builtin_JSON:
+		ts.seenJSON = true
+		return fmt.Sprintf("JSON.parse(%s)", val)
+	case schema.Builtin_UUID:
+		return val
+	case schema.Builtin_USER_ID:
+		return val
+	default:
+		ts.errorf("unknown builtin type %v", typ)
+		return "any"
+	}
+}
+
+func (ts *typescript) writeTyp(ns string, typ *schema.Type, numIndents int) {
+	switch typ := typ.Typ.(type) {
+	case *schema.Type_Named:
+		decl := ts.md.Decls[typ.Named.Id]
+		ts.writeDecl(ns, decl)
+
+		// Write the type arguments
+		if len(typ.Named.TypeArguments) > 0 {
+			ts.WriteRune('<')
+
+			for i, typeArg := range typ.Named.TypeArguments {
+				if i > 0 {
+					ts.WriteString(", ")
+				}
+
+				ts.writeTyp(ns, typeArg, 0)
+			}
+
+			ts.WriteRune('>')
+		}
+	case *schema.Type_List:
+		elem := typ.List.Elem
+		union, isUnion := elem.Typ.(*schema.Type_Union)
+		paren := isUnion && len(union.Union.Types) > 1
+
+		if paren {
+			ts.WriteString("(")
+		}
+		ts.writeTyp(ns, elem, numIndents)
+		if paren {
+			ts.WriteString(")")
+		}
+
+		ts.WriteString("[]")
+
+	case *schema.Type_Map:
+		ts.WriteString("{ [key: ")
+		ts.writeTyp(ns, typ.Map.Key, numIndents)
+		ts.WriteString("]: ")
+		ts.writeTyp(ns, typ.Map.Value, numIndents)
+		ts.WriteString(" }")
+
+	case *schema.Type_Builtin:
+		ts.WriteString(ts.builtinType(typ.Builtin))
+
+	case *schema.Type_Pointer:
+		// FIXME(ENC-827): Handle pointers in TypeScript in a way which more technically correct without
+		// making the end user experience of using a generated client worse.
+		ts.writeTyp(ns, typ.Pointer.Base, numIndents)
+
+	case *schema.Type_Literal:
+		switch lit := typ.Literal.Value.(type) {
+		case *schema.Literal_Str:
+			ts.WriteString(ts.Quote(lit.Str))
+		case *schema.Literal_Int:
+			ts.WriteString(strconv.FormatInt(lit.Int, 10))
+		case *schema.Literal_Float:
+			ts.WriteString(strconv.FormatFloat(lit.Float, 'f', -1, 64))
+		case *schema.Literal_Boolean:
+			ts.WriteString(strconv.FormatBool(lit.Boolean))
+		case *schema.Literal_Null:
+			ts.WriteString("null")
+		default:
+			ts.errorf("unknown literal type %T", lit)
+		}
+
+	case *schema.Type_Union:
+		for i, typ := range typ.Union.Types {
+			if i > 0 {
+				ts.WriteString(" | ")
+			}
+			ts.writeTyp(ns, typ, numIndents)
+		}
+
+	case *schema.Type_Struct:
+		indent := func() {
+			ts.WriteString(strings.Repeat("    ", numIndents+1))
+		}
+
+		// Filter the fields to print based on struct tags.
+		fields := make([]*schema.Field, 0, len(typ.Struct.Fields))
+		for _, f := range typ.Struct.Fields {
+			// skip cookie fields as they are handled by the browser
+			if f.Wire.GetCookie() != nil {
+				continue
+			}
+			if encoding.IgnoreField(f) {
+				continue
+			}
+			fields = append(fields, f)
+		}
+
+		ts.WriteString("{\n")
+		for i, field := range fields {
+			if field.Doc != "" {
+				scanner := bufio.NewScanner(strings.NewReader(field.Doc))
+				indent()
+				ts.WriteString("/**\n")
+				for scanner.Scan() {
+					indent()
+					ts.WriteString(" * ")
+					ts.WriteString(scanner.Text())
+					ts.WriteByte('\n')
+				}
+				indent()
+				ts.WriteString(" */\n")
+			}
+
+			indent()
+			ts.WriteString(ts.QuoteIfRequired(ts.fieldNameInStruct(field)))
+
+			if field.Optional || ts.isRecursive(field.Typ) {
+				ts.WriteString("?")
+			}
+			ts.WriteString(": ")
+			ts.writeTyp(ns, field.Typ, numIndents+1)
+			ts.WriteString("\n")
+
+			// Add another empty line if we have a doc comment
+			// and this was not the last field.
+			if field.Doc != "" && i < len(fields)-1 {
+				ts.WriteByte('\n')
+			}
+		}
+		ts.WriteString(strings.Repeat("    ", numIndents))
+		ts.WriteByte('}')
+
+	case *schema.Type_TypeParameter:
+		decl := ts.md.Decls[typ.TypeParameter.DeclId]
+		typeParam := decl.TypeParams[typ.TypeParameter.ParamIdx]
+
+		ts.WriteString(typeParam.Name)
+
+	case *schema.Type_Config:
+		// Config type is transparent
+		ts.writeTyp(ns, typ.Config.Elem, numIndents)
+
+	default:
+		ts.errorf("unknown type %+v", reflect.TypeOf(typ))
+	}
+}
+
+type bailout struct{ err error }
+
+func (ts *typescript) errorf(format string, args ...interface{}) {
+	panic(bailout{fmt.Errorf(format, args...)})
+}
+
+func (ts *typescript) handleBailout(dst *error) {
+	if err := recover(); err != nil {
+		if bail, ok := err.(bailout); ok {
+			*dst = bail.err
+		} else {
+			panic(err)
+		}
+	}
+}
+
+func (ts *typescript) newIdentWriter(indent int) *indentWriter {
+	return &indentWriter{
+		w:                ts.Buffer,
+		depth:            indent,
+		indent:           "    ",
+		firstWriteOnLine: true,
+	}
+}
+
+func (ts *typescript) Quote(s string) string {
+	return fmt.Sprintf("\"%s\"", strings.Replace(s, "\"", "\\\"", -1))
+}
+
+func (ts *typescript) QuoteIfRequired(s string) string {
+	// If the identifier isn't purely alphanumeric, we need to add quotes.
+	if !stringIsOnly(s, func(r rune) bool { return unicode.IsLetter(r) || unicode.IsDigit(r) }) {
+		return ts.Quote(s)
+	}
+	return s
+}
+
+// Dot allows us to reference a field in a struct by its name.
+func (ts *typescript) Dot(structIdent string, fieldIdent string) string {
+	fieldIdent = ts.QuoteIfRequired(fieldIdent)
+
+	if len(fieldIdent) > 0 && fieldIdent[0] == '"' {
+		return fmt.Sprintf("%s[%s]", structIdent, fieldIdent)
+	} else {
+		return fmt.Sprintf("%s.%s", structIdent, fieldIdent)
+	}
+}
+
+func (ts *typescript) Values(w *indentWriter, dict map[string]string) {
+	// Work out the largest key length.
+	largestKey := 0
+	keys := make([]string, 0, len(dict))
+	for key := range dict {
+		keys = append(keys, key)
+		key = ts.QuoteIfRequired(key)
+		if len(key) > largestKey {
+			largestKey = len(key)
+		}
+	}
+
+	sort.Strings(keys)
+
+	w.WriteString("{\n")
+	{
+		w := w.Indent()
+		for _, key := range keys {
+			ident := ts.QuoteIfRequired(key)
+			w.WriteStringf("%s: %s%s,\n", ident, strings.Repeat(" ", largestKey-len(ident)), dict[key])
+		}
+	}
+	w.WriteString("}")
+}
+
+// Regex to replace invalid characters (anything that isn't a letter, number, `_`, or `$`)
+var invalidChars = regexp.MustCompile(`[^\p{L}\p{N}$_]`)
+
+// validTSIdentifier converts a string into a valid TypeScript identifier.
+func validTSIdentifier(input string) string {
+	if input == "" {
+		return "_"
+	}
+	runes := []rune(input)
+	// Ensure the first character is a valid TS identifier start (letter, `_`, or `$`)
+	if !unicode.IsLetter(runes[0]) && runes[0] != '_' && runes[0] != '$' {
+		runes[0] = '_'
+	}
+
+	output := invalidChars.ReplaceAllString(string(runes), "_")
+	return output
+}
+
+func (ts *typescript) typeName(identifier string) string {
+	if ts.generatorVersion < TsExperimental {
+		return validTSIdentifier(identifier)
+	} else {
+		return idents.Convert(identifier, idents.PascalCase)
+	}
+}
+
+func (ts *typescript) memberName(identifier string) string {
+	if ts.generatorVersion < TsExperimental {
+		return validTSIdentifier(identifier)
+	} else {
+		return idents.Convert(identifier, idents.CamelCase)
+	}
+}
+
+func (ts *typescript) fieldNameInStruct(field *schema.Field) string {
+	name := field.Name
+	if field.JsonName != "" {
+		name = field.JsonName
+	}
+	return name
+}
+
+func (ts *typescript) isRecursive(typ *schema.Type) bool {
+	// Treat recursively seen types as if they are optional
+	recursiveType := false
+	if n := typ.GetNamed(); n != nil {
+		recursiveType = ts.typs.IsRecursiveRef(ts.currDecl.Id, n.Id)
+	}
+	return recursiveType
+}
+
+func (ts *typescript) writeCustomErrorType() {
+	w := ts.newIdentWriter(0)
+
+	w.WriteString(`
+
+/**
+ * APIErrorDetails represents the response from an Encore API in the case of an error
+ */
+interface APIErrorResponse {
+    code: ErrCode
+    message: string
+    details?: any
+}
+
+function isAPIErrorResponse(err: any): err is APIErrorResponse {
+    return (
+        err !== undefined && err !== null &&
+        isErrCode(err.code) &&
+        typeof(err.message) === "string" &&
+        (err.details === undefined || err.details === null || typeof(err.details) === "object")
+    )
+}
+
+function isErrCode(code: any): code is ErrCode {
+    return code !== undefined && Object.values(ErrCode).includes(code)
+}
+
+/**
+ * APIError represents a structured error as returned from an Encore application.
+ */
+export class APIError extends Error {
+    /**
+     * The HTTP status code associated with the error.
+     */
+    public readonly status: number
+
+    /**
+     * The Encore error code
+     */
+    public readonly code: ErrCode
+
+    /**
+     * The error details
+     */
+    public readonly details?: any
+
+    constructor(status: number, response: APIErrorResponse) {
+        // extending errors causes issues after you construct them, unless you apply the following fixes
+        super(response.message);
+
+        // set error name as constructor name, make it not enumerable to keep native Error behavior
+        // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+        Object.defineProperty(this, 'name', {
+            value:        'APIError',
+            enumerable:   false,
+            configurable: true,
+        })
+
+        // fix the prototype chain
+        if ((Object as any).setPrototypeOf == undefined) {
+            (this as any).__proto__ = APIError.prototype
+        } else {
+            Object.setPrototypeOf(this, APIError.prototype);
+        }
+
+        // capture a stack trace
+        if ((Error as any).captureStackTrace !== undefined) {
+            (Error as any).captureStackTrace(this, this.constructor);
+        }
+
+        this.status = status
+        this.code = response.code
+        this.details = response.details
+    }
+}
+
+/**
+ * Typeguard allowing use of an APIError's fields'
+ */
+export function isAPIError(err: any): err is APIError {
+    return err instanceof APIError;
+}
+
+export enum ErrCode {
+    /**
+     * OK indicates the operation was successful.
+     */
+    OK = "ok",
+
+    /**
+     * Canceled indicates the operation was canceled (typically by the caller).
+     *
+     * Encore will generate this error code when cancellation is requested.
+     */
+    Canceled = "canceled",
+
+    /**
+     * Unknown error. An example of where this error may be returned is
+     * if a Status value received from another address space belongs to
+     * an error-space that is not known in this address space. Also
+     * errors raised by APIs that do not return enough error information
+     * may be converted to this error.
+     *
+     * Encore will generate this error code in the above two mentioned cases.
+     */
+    Unknown = "unknown",
+
+    /**
+     * InvalidArgument indicates client specified an invalid argument.
+     * Note that this differs from FailedPrecondition. It indicates arguments
+     * that are problematic regardless of the state of the system
+     * (e.g., a malformed file name).
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    InvalidArgument = "invalid_argument",
+
+    /**
+     * DeadlineExceeded means operation expired before completion.
+     * For operations that change the state of the system, this error may be
+     * returned even if the operation has completed successfully. For
+     * example, a successful response from a server could have been delayed
+     * long enough for the deadline to expire.
+     *
+     * The gRPC framework will generate this error code when the deadline is
+     * exceeded.
+     */
+    DeadlineExceeded = "deadline_exceeded",
+
+    /**
+     * NotFound means some requested entity (e.g., file or directory) was
+     * not found.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    NotFound = "not_found",
+
+    /**
+     * AlreadyExists means an attempt to create an entity failed because one
+     * already exists.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    AlreadyExists = "already_exists",
+
+    /**
+     * PermissionDenied indicates the caller does not have permission to
+     * execute the specified operation. It must not be used for rejections
+     * caused by exhausting some resource (use ResourceExhausted
+     * instead for those errors). It must not be
+     * used if the caller cannot be identified (use Unauthenticated
+     * instead for those errors).
+     *
+     * This error code will not be generated by the gRPC core framework,
+     * but expect authentication middleware to use it.
+     */
+    PermissionDenied = "permission_denied",
+
+    /**
+     * ResourceExhausted indicates some resource has been exhausted, perhaps
+     * a per-user quota, or perhaps the entire file system is out of space.
+     *
+     * This error code will be generated by the gRPC framework in
+     * out-of-memory and server overload situations, or when a message is
+     * larger than the configured maximum size.
+     */
+    ResourceExhausted = "resource_exhausted",
+
+    /**
+     * FailedPrecondition indicates operation was rejected because the
+     * system is not in a state required for the operation's execution.
+     * For example, directory to be deleted may be non-empty, an rmdir
+     * operation is applied to a non-directory, etc.
+     *
+     * A litmus test that may help a service implementor in deciding
+     * between FailedPrecondition, Aborted, and Unavailable:
+     *  (a) Use Unavailable if the client can retry just the failing call.
+     *  (b) Use Aborted if the client should retry at a higher-level
+     *      (e.g., restarting a read-modify-write sequence).
+     *  (c) Use FailedPrecondition if the client should not retry until
+     *      the system state has been explicitly fixed. E.g., if an "rmdir"
+     *      fails because the directory is non-empty, FailedPrecondition
+     *      should be returned since the client should not retry unless
+     *      they have first fixed up the directory by deleting files from it.
+     *  (d) Use FailedPrecondition if the client performs conditional
+     *      REST Get/Update/Delete on a resource and the resource on the
+     *      server does not match the condition. E.g., conflicting
+     *      read-modify-write on the same resource.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    FailedPrecondition = "failed_precondition",
+
+    /**
+     * Aborted indicates the operation was aborted, typically due to a
+     * concurrency issue like sequencer check failures, transaction aborts,
+     * etc.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     */
+    Aborted = "aborted",
+
+    /**
+     * OutOfRange means operation was attempted past the valid range.
+     * E.g., seeking or reading past end of file.
+     *
+     * Unlike InvalidArgument, this error indicates a problem that may
+     * be fixed if the system state changes. For example, a 32-bit file
+     * system will generate InvalidArgument if asked to read at an
+     * offset that is not in the range [0,2^32-1], but it will generate
+     * OutOfRange if asked to read from an offset past the current
+     * file size.
+     *
+     * There is a fair bit of overlap between FailedPrecondition and
+     * OutOfRange. We recommend using OutOfRange (the more specific
+     * error) when it applies so that callers who are iterating through
+     * a space can easily look for an OutOfRange error to detect when
+     * they are done.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    OutOfRange = "out_of_range",
+
+    /**
+     * Unimplemented indicates operation is not implemented or not
+     * supported/enabled in this service.
+     *
+     * This error code will be generated by the gRPC framework. Most
+     * commonly, you will see this error code when a method implementation
+     * is missing on the server. It can also be generated for unknown
+     * compression algorithms or a disagreement as to whether an RPC should
+     * be streaming.
+     */
+    Unimplemented = "unimplemented",
+
+    /**
+     * Internal errors. Means some invariants expected by underlying
+     * system has been broken. If you see one of these errors,
+     * something is very broken.
+     *
+     * This error code will be generated by the gRPC framework in several
+     * internal error conditions.
+     */
+    Internal = "internal",
+
+    /**
+     * Unavailable indicates the service is currently unavailable.
+     * This is a most likely a transient condition and may be corrected
+     * by retrying with a backoff. Note that it is not always safe to retry
+     * non-idempotent operations.
+     *
+     * See litmus test above for deciding between FailedPrecondition,
+     * Aborted, and Unavailable.
+     *
+     * This error code will be generated by the gRPC framework during
+     * abrupt shutdown of a server process or network connection.
+     */
+    Unavailable = "unavailable",
+
+    /**
+     * DataLoss indicates unrecoverable data loss or corruption.
+     *
+     * This error code will not be generated by the gRPC framework.
+     */
+    DataLoss = "data_loss",
+
+    /**
+     * Unauthenticated indicates the request does not have valid
+     * authentication credentials for the operation.
+     *
+     * The gRPC framework will generate this error code when the
+     * authentication metadata is invalid or a Credentials callback fails,
+     * but also expect authentication middleware to generate it.
+     */
+    Unauthenticated = "unauthenticated",
+}
+`)
+}
+
+func stringIsOnly(str string, predicate func(r rune) bool) bool {
+	for _, r := range str {
+		if !predicate(r) {
+			return false
+		}
+	}
+	return true
+}
diff --git a/pkg/clientgen/utils.go b/pkg/clientgen/utils.go
new file mode 100644
index 0000000000..bb023a00f7
--- /dev/null
+++ b/pkg/clientgen/utils.go
@@ -0,0 +1,72 @@
+package clientgen
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+
+	"encr.dev/internal/version"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+func doNotEditHeader() string {
+	return fmt.Sprintf("Code generated by the Encore %s client generator. DO NOT EDIT.", version.Version)
+}
+
+func hasPublicRPC(svc *meta.Service) bool {
+	for _, rpc := range svc.Rpcs {
+		if rpc.AccessType != meta.RPC_PRIVATE {
+			return true
+		}
+	}
+	return false
+}
+
+type indentWriter struct {
+	w                *bytes.Buffer
+	depth            int
+	indent           string
+	firstWriteOnLine bool
+}
+
+func (w *indentWriter) Indent() *indentWriter {
+	return &indentWriter{
+		w:                w.w,
+		depth:            w.depth + 1,
+		indent:           w.indent,
+		firstWriteOnLine: true,
+	}
+}
+
+func (w *indentWriter) Dedent() *indentWriter {
+	return &indentWriter{
+		w:                w.w,
+		depth:            max(w.depth-1, 0),
+		indent:           w.indent,
+		firstWriteOnLine: true,
+	}
+}
+
+func (w *indentWriter) WriteString(s string) {
+	parts := strings.Split(s, "\n")
+	for i, part := range parts {
+		if i > 0 {
+			w.w.WriteString("\n")
+			w.firstWriteOnLine = true
+		}
+		if part == "" {
+			continue
+		}
+
+		if w.firstWriteOnLine {
+			w.w.WriteString(strings.Repeat(w.indent, w.depth))
+			w.firstWriteOnLine = false
+		}
+
+		w.w.WriteString(part)
+	}
+}
+
+func (w *indentWriter) WriteStringf(s string, args ...interface{}) {
+	w.WriteString(fmt.Sprintf(s, args...))
+}
diff --git a/pkg/cueutil/build.go b/pkg/cueutil/build.go
new file mode 100644
index 0000000000..cfe28e401f
--- /dev/null
+++ b/pkg/cueutil/build.go
@@ -0,0 +1,250 @@
+package cueutil
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"cuelang.org/go/cue"
+	"cuelang.org/go/cue/ast"
+	"cuelang.org/go/cue/build"
+	"cuelang.org/go/cue/cuecontext"
+	"cuelang.org/go/cue/load"
+	"cuelang.org/go/cue/parser"
+	"cuelang.org/go/cue/token"
+	"golang.org/x/text/encoding/unicode"
+	"golang.org/x/text/transform"
+
+	"encr.dev/pkg/eerror"
+	"encr.dev/pkg/errinsrc/srcerrors"
+	"encr.dev/pkg/fns"
+)
+
+// LoadFromFS takes a given filesystem object and the app-relative path to the service's root package
+// and loads the full configuration needed for that service.
+func LoadFromFS(filesys fs.FS, serviceRelPath string, meta *Meta) (cue.Value, error) {
+	// Work out of a temporary directory
+	tmpPath, err := os.MkdirTemp("", "encr-cfg-")
+	if err != nil {
+		return cue.Value{}, eerror.Wrap(err, "config", "unable to create temporary directory", nil)
+	}
+	defer func() { _ = os.RemoveAll(tmpPath) }()
+
+	// Write the FS to the file system
+	err = writeFSToPath(filesys, tmpPath)
+	if err != nil {
+		return cue.Value{}, err
+	}
+
+	// Find all config files for the service
+	configFilesForService, err := allFilesUnder(filesys, serviceRelPath)
+	if err != nil {
+		return cue.Value{}, eerror.Wrap(err, "config", "unable to list all config files for service", map[string]any{"path": serviceRelPath})
+	}
+
+	// If there are no config files, return an empty value
+	if len(configFilesForService) == 0 {
+		return cue.Value{}, nil
+	}
+
+	// Tell CUE to load all the files
+	loaderCfg := &load.Config{
+		Dir:   tmpPath,
+		Tools: true,
+		Tags:  meta.ToTags(),
+	}
+	pkgs := load.Instances(configFilesForService, loaderCfg)
+	for _, pkg := range pkgs {
+		if pkg.Err != nil {
+			return cue.Value{}, srcerrors.UnableToLoadCUEInstances(pkg.Err, tmpPath)
+		}
+
+		// Non CUE files may be orphaned (JSON/YAML), so need to be parsed into the CUE AST and added to the package.
+		if err := addOrphanedFiles(pkg); err != nil {
+			return cue.Value{}, srcerrors.UnableToAddOrphanedCUEFiles(err, tmpPath)
+		}
+	}
+
+	// Build the CUE values
+	ctx := cuecontext.New()
+	values, err := ctx.BuildInstances(pkgs)
+	if err != nil {
+		return cue.Value{}, srcerrors.UnableToLoadCUEInstances(err, tmpPath)
+	}
+	if len(values) == 0 {
+		return cue.Value{}, eerror.New("config", "no values generated from config", nil)
+	}
+
+	// Unify all returned values into a single value
+	// Note; to get all errors in the CUE files, we want to wait until
+	// the validate output to check for errors
+	rtnValue := values[0]
+	for _, value := range values {
+		rtnValue = rtnValue.Unify(value)
+	}
+
+	// Validate the unified value is concrete
+	if err := rtnValue.Validate(cue.Concrete(true)); err != nil {
+		return cue.Value{}, srcerrors.CUEEvaluationFailed(err, tmpPath)
+	}
+
+	return rtnValue, nil
+}
+
+// allFilesUnder returns all files under the given path in the given filesystem.
+func allFilesUnder(filesys fs.FS, path string) ([]string, error) {
+	var files []string
+
+	// Check if the path exists
+	// and if it doesn't that means there zero CUE files for this service
+	// this can happen when a Config struct has zero fields
+	if _, err := fs.Stat(filesys, path); err != nil {
+		if errors.Is(err, fs.ErrNotExist) {
+			return nil, nil
+		}
+		return nil, err
+	}
+
+	err := fs.WalkDir(filesys, path, func(path string, info fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+
+		if !info.IsDir() {
+			files = append(files, path)
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return files, nil
+}
+
+// writeFSToPath writes the contents of the given filesystem to a temporary directory on the local filesystem.
+func writeFSToPath(fsys fs.FS, targetPath string) error {
+	// Copy the files into the temporary directory
+	err := fs.WalkDir(fsys, ".", func(path string, info fs.DirEntry, err error) error {
+		if err != nil {
+			return eerror.Wrap(err, "config", "unable to walk VFS", nil)
+		}
+
+		// Convert the io/fs slash-based path to a filepath.
+		osPath := filepath.FromSlash(path)
+
+		if !info.IsDir() {
+			// Open the source file from our filesystem
+			srcFile, err := fsys.Open(path)
+			if err != nil {
+				return eerror.Wrap(err, "config", "unable to open src file", nil)
+			}
+			defer fns.CloseIgnore(srcFile)
+
+			dstFile, err := os.OpenFile(filepath.Join(targetPath, osPath), os.O_CREATE|os.O_WRONLY, 0644)
+			if err != nil {
+				return eerror.Wrap(err, "config", "unable to open dst file", nil)
+			}
+
+			_, err = io.Copy(dstFile, srcFile)
+			if err2 := dstFile.Close(); err == nil {
+				err = err2
+			}
+			if err != nil {
+				return eerror.Wrap(err, "config", "unable to copy file", nil)
+			}
+		} else {
+			if err := os.Mkdir(filepath.Join(targetPath, osPath), 0755); err != nil && !errors.Is(err, os.ErrExist) {
+				return eerror.Wrap(err, "config", "unable to make dir", nil)
+			}
+		}
+
+		return nil
+	})
+	if err != nil {
+		return eerror.Wrap(err, "config", "unable to write config files to temporary directory", map[string]any{"path": targetPath})
+	}
+	return nil
+}
+
+// addOrphanedFiles adds any orphaned files outside the package to the build instance. This could be CUE, YAML or JSON files
+//
+// The majority of the code in the function is taken directly from the CUE source code as the code is currently only accessible
+// from internal paths - they are planning to move this out of the internal path so non-CUE code can directly call it
+// as library functions. (Src: cue/internal/encoding/encoding.go : NewDecoder())
+func addOrphanedFiles(i *build.Instance) (err error) {
+	for _, f := range i.OrphanedFiles {
+		var file ast.Node
+
+		rc, err := reader(f)
+		if err != nil {
+			return err
+		}
+		//goland:noinspection GoDeferInLoop
+		defer func() { _ = rc.Close() }()
+
+		t := unicode.BOMOverride(unicode.UTF8.NewDecoder())
+		r := transform.NewReader(rc, t)
+
+		switch f.Encoding {
+		case build.CUE:
+			file, err = parser.ParseFile(f.Filename, r, parser.ParseComments)
+			if err != nil {
+				return err
+			}
+		default:
+			return errors.New(fmt.Sprintf("unsupported encoding: %s", f.Encoding))
+		}
+
+		if err != nil {
+			return err
+		}
+		if err := i.AddSyntax(toFile(file)); err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// toFile converts an ast.Node to a *ast.File. (from the CUE source code)
+func toFile(n ast.Node) *ast.File {
+	switch x := n.(type) {
+	case nil:
+		return nil
+	case *ast.StructLit:
+		return &ast.File{Decls: x.Elts}
+	case ast.Expr:
+		ast.SetRelPos(x, token.NoSpace)
+		return &ast.File{Decls: []ast.Decl{&ast.EmbedDecl{Expr: x}}}
+	case *ast.File:
+		return x
+	default:
+		panic(fmt.Sprintf("Unsupported node type %T", x))
+	}
+}
+
+// reader returns a reader for the given file. (from the CUE source code)
+func reader(f *build.File) (io.ReadCloser, error) {
+	switch s := f.Source.(type) {
+	case nil:
+		// Use the file name.
+	case string:
+		return io.NopCloser(strings.NewReader(s)), nil
+	case []byte:
+		return io.NopCloser(bytes.NewReader(s)), nil
+	case *bytes.Buffer:
+		// is io.Reader, but it needs to be readable repeatedly
+		if s != nil {
+			return io.NopCloser(bytes.NewReader(s.Bytes())), nil
+		}
+	default:
+		return nil, fmt.Errorf("invalid source type %T", f.Source)
+	}
+	return os.Open(f.Filename)
+}
diff --git a/pkg/cueutil/types.go b/pkg/cueutil/types.go
new file mode 100644
index 0000000000..f0d267c673
--- /dev/null
+++ b/pkg/cueutil/types.go
@@ -0,0 +1,44 @@
+package cueutil
+
+type EnvType string
+
+const (
+	EnvType_Production  EnvType = "production"
+	EnvType_Development EnvType = "development"
+	EnvType_Ephemeral   EnvType = "ephemeral"
+	EnvType_Test        EnvType = "test"
+)
+
+type CloudType string
+
+const (
+	CloudType_AWS    CloudType = "aws"
+	CloudType_Azure  CloudType = "azure"
+	CloudType_GCP    CloudType = "gcp"
+	CloudType_Encore CloudType = "encore"
+	CloudType_Local  CloudType = "local"
+)
+
+type Meta struct {
+	APIBaseURL string
+	EnvName    string
+	EnvType    EnvType
+	CloudType  CloudType
+}
+
+func (m *Meta) ToTags() []string {
+	if m == nil {
+		return nil
+	}
+
+	return []string{
+		tag("APIBaseURL", m.APIBaseURL),
+		tag("EnvName", m.EnvName),
+		tag("EnvType", m.EnvType),
+		tag("CloudType", m.CloudType),
+	}
+}
+
+func tag[T ~string](name string, value T) string {
+	return name + "=" + string(value)
+}
diff --git a/pkg/dockerbuild/dockerbuild.go b/pkg/dockerbuild/dockerbuild.go
new file mode 100644
index 0000000000..30da7cec6b
--- /dev/null
+++ b/pkg/dockerbuild/dockerbuild.go
@@ -0,0 +1,344 @@
+package dockerbuild
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/google/go-containerregistry/pkg/name"
+	v1 "github.com/google/go-containerregistry/pkg/v1"
+	"github.com/google/go-containerregistry/pkg/v1/empty"
+	"github.com/google/go-containerregistry/pkg/v1/mutate"
+	"github.com/google/go-containerregistry/pkg/v1/remote"
+	"github.com/google/go-containerregistry/pkg/v1/tarball"
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/pkg/option"
+)
+
+// DefaultCACertsPath is the default path for where to write CA Certs.
+// From https://go.dev/src/crypto/x509/root_linux.go.
+const DefaultCACertsPath ImagePath = "/etc/ssl/certs/ca-certificates.crt"
+
+type ImageBuildConfig struct {
+	// The time to use when recording times in the image.
+	BuildTime time.Time
+
+	// AddCACerts, if set, specifies where in the image to mount the CA certificates.
+	// If set to Some(""), defaults to DefaultCACertsPath.
+	AddCACerts option.Option[ImagePath]
+
+	// SupervisorPath is the path to the supervisor binary to use.
+	// It must be set if the image includes the supervisor.
+	SupervisorPath option.Option[HostPath]
+
+	// BaseImageOverride overrides the base image to use.
+	// If None it resolves the image from the spec using ResolveRemoteImage.
+	BaseImageOverride option.Option[v1.Image]
+
+	// A URL to a http proxy used to fetch images
+	DockerOptions []remote.Option
+}
+
+// BuildImage builds a docker image from the given spec.
+func BuildImage(ctx context.Context, spec *ImageSpec, cfg ImageBuildConfig) (v1.Image, error) {
+	options := append(cfg.DockerOptions,
+		remote.WithPlatform(v1.Platform{
+			OS:           spec.OS,
+			Architecture: spec.Arch,
+		}),
+	)
+	baseImg, err := resolveBaseImage(ctx, spec.DockerBaseImage, cfg.BaseImageOverride, options...)
+	if err != nil {
+		return nil, errors.Wrap(err, "resolve base image")
+	}
+
+	opener, err := buildImageFilesystem(ctx, spec, &cfg)
+	if err != nil {
+		return nil, errors.Wrap(err, "build image fs")
+	}
+
+	layer, err := tarball.LayerFromOpener(opener,
+		tarball.WithCompressionLevel(5), // balance speed and compression
+	)
+
+	if err != nil {
+		return nil, errors.Wrap(err, "create tarball layer")
+	}
+
+	log.Info().Msg("adding layer to base image")
+	img, err := mutate.Append(baseImg, mutate.Addendum{
+		Layer: layer,
+		History: v1.History{
+			Author:    "encore-app",
+			Created:   v1.Time{Time: cfg.BuildTime},
+			CreatedBy: "encore.dev",
+			Comment:   "Built with encore.dev, the backend development engine",
+		},
+	})
+	if err != nil {
+		return nil, errors.Wrap(err, "add layer")
+	}
+
+	// Copy the base image's environment variables.
+	baseCfg, err := baseImg.ConfigFile()
+	if err != nil {
+		return nil, errors.Wrap(err, "get base image config")
+	}
+	envs := newEnvMap(baseCfg.Config.Env)
+
+	imgCfg, err := img.ConfigFile()
+	if err != nil {
+		return nil, errors.Wrap(err, "get image config")
+	}
+	imgCfg = imgCfg.DeepCopy()
+
+	// Add the image spec's environment.
+	envs.Update(spec.Env)
+
+	imgCfg.Config.Entrypoint = spec.Entrypoint
+	imgCfg.Config.Cmd = nil
+	imgCfg.Config.Env = envs.ToSlice()
+	imgCfg.Config.WorkingDir = string(spec.WorkingDir)
+	imgCfg.Author = "encore.dev"
+	imgCfg.Created = v1.Time{Time: cfg.BuildTime}
+
+	img, err = mutate.ConfigFile(img, imgCfg)
+	if err != nil {
+		return nil, errors.Wrap(err, "add config")
+	}
+	return img, nil
+}
+
+// ResolveRemoteImage resolves the base image with the given reference.
+// If imageRef is the empty string or "scratch" it resolves to the empty image.
+func ResolveRemoteImage(ctx context.Context, imageRef string, options ...remote.Option) (v1.Image, error) {
+	if imageRef == "" || imageRef == "scratch" {
+		return empty.Image, nil
+	}
+
+	// Try to get it from the daemon if it exists.
+	baseImgRef, err := name.ParseReference(imageRef)
+	if err != nil {
+		return nil, errors.Wrap(err, "parse image ref")
+	}
+
+	img, err := remote.Image(baseImgRef, append(options, remote.WithContext(ctx))...)
+	if err != nil {
+		return nil, errors.Wrap(err, "fetch image")
+	}
+	return img, nil
+}
+
+func resolveBaseImage(ctx context.Context, baseImgTag string, overrideBaseImage option.Option[v1.Image], options ...remote.Option) (v1.Image, error) {
+	if override, ok := overrideBaseImage.Get(); ok {
+		return override, nil
+	}
+	return ResolveRemoteImage(ctx, baseImgTag, options...)
+}
+
+func buildImageFilesystem(ctx context.Context, spec *ImageSpec, cfg *ImageBuildConfig) (opener tarball.Opener, err error) {
+	tc := newTarCopier(setFileTimes(cfg.BuildTime))
+
+	// Bundle the source code, if requested.
+	if bundle, ok := spec.BundleSource.Get(); ok {
+		if err := bundleSource(tc, spec, &bundle); err != nil {
+			return nil, err
+		}
+	}
+
+	// Copy data into the image.
+	if err := tc.CopyData(spec); err != nil {
+		return nil, err
+	}
+
+	// Copy Encore binaries into the image.
+	if err := setupSupervisor(tc, spec, cfg); err != nil {
+		return nil, err
+	}
+
+	// Add build information.
+	if err := writeBuildInfo(tc, spec.BuildInfo); err != nil {
+		return nil, err
+	}
+
+	// Write additional files
+	if err := writeExtraFiles(tc, spec.WriteFiles); err != nil {
+		return nil, err
+	}
+
+	// Add CA certificates, if requested.
+	if caCertsDest, ok := cfg.AddCACerts.Get(); ok {
+		if caCertsDest == "" {
+			caCertsDest = DefaultCACertsPath
+		}
+		if err := addCACerts(ctx, tc, caCertsDest); err != nil {
+			return nil, errors.Wrap(err, "add ca certs")
+		}
+	}
+
+	return tc.Opener(), nil
+}
+
+func writeExtraFiles(tc *tarCopier, files map[ImagePath][]byte) error {
+	for path, data := range files {
+		if err := tc.WriteFile(path, 0644, data); err != nil {
+			return errors.Wrap(err, "write image data")
+		}
+	}
+	return nil
+}
+
+func setupSupervisor(tc *tarCopier, spec *ImageSpec, cfg *ImageBuildConfig) error {
+	super, ok := spec.Supervisor.Get()
+	if !ok {
+		return nil
+	}
+
+	// Add the supervisor binary.
+	{
+		hostPath, ok := cfg.SupervisorPath.Get()
+		if !ok {
+			return errors.New("supervisor requested, but not provided")
+		}
+		fi, err := os.Stat(string(hostPath))
+		if err != nil {
+			return errors.Wrap(err, "stat supervisor")
+		}
+
+		if err := tc.MkdirAll(super.MountPath.Dir(), 0755); err != nil {
+			return errors.Wrap(err, "create supervisor dir")
+		}
+		if err := tc.CopyFile(super.MountPath, hostPath, fi, ""); err != nil {
+			return errors.Wrap(err, "copy supervisor")
+		}
+	}
+
+	// Write the supervisor configuration.
+	{
+		data, err := json.MarshalIndent(super.Config, "", "  ")
+		if err != nil {
+			return errors.Wrap(err, "marshal supervisor config")
+		}
+		if err := tc.WriteFile(super.ConfigPath, 0644, data); err != nil {
+			return errors.Wrap(err, "write supervisor config")
+		}
+	}
+
+	return nil
+}
+
+func bundleSource(tc *tarCopier, spec *ImageSpec, bundle *BundleSourceSpec) error {
+	includes := []HostPath{bundle.Source.Join(filepath.FromSlash(string(bundle.AppRootRelpath)))}
+	for _, ex := range bundle.IncludeSource {
+		includes = append(includes, bundle.Source.Join(string(ex)))
+	}
+
+	excludes := make(map[HostPath]bool, len(bundle.ExcludeSource))
+	for _, ex := range bundle.ExcludeSource {
+		absPath := bundle.Source.Join(string(ex))
+		excludes[absPath] = true
+	}
+
+	err := tc.CopyDir(&dirCopyDesc{
+		Spec:            spec,
+		SrcPath:         bundle.Source,
+		DstPath:         bundle.Dest,
+		ExcludeSrcPaths: excludes,
+		IncludeSrcPaths: includes,
+	})
+	return errors.Wrap(err, "bundle source")
+}
+
+func writeBuildInfo(tc *tarCopier, spec BuildInfoSpec) error {
+	info, err := json.MarshalIndent(spec.Info, "", "  ")
+	if err != nil {
+		return errors.Wrap(err, "marshal build info")
+	}
+
+	err = tc.WriteFile(spec.InfoPath, 0644, info)
+	return errors.Wrap(err, "write build info")
+}
+
+func tryFetch(ctx context.Context, url string) (*http.Response, error) {
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return nil, errors.Wrap(err, "create request")
+	}
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return nil, errors.Wrap(err, "get root certs")
+	}
+
+	if resp.StatusCode != http.StatusOK {
+		_ = resp.Body.Close()
+		return nil, errors.Newf("root cert url returned status code: %s", resp.Status)
+	}
+	return resp, nil
+}
+
+func addCACerts(ctx context.Context, tc *tarCopier, dest ImagePath) error {
+	const (
+		encoreCachedRootCerts = "https://api.encore.cloud/artifacts/build/root-certs"
+		curlCACertStore       = "https://curl.se/ca/cacert.pem"
+	)
+	var (
+		resp *http.Response
+		err  error
+	)
+	for _, url := range []string{encoreCachedRootCerts, curlCACertStore} {
+		resp, err = tryFetch(ctx, url)
+		if err == nil {
+			break
+		}
+		log.Warn().Err(err).Msgf("failed to fetch root certs from: %s", url)
+	}
+	if err != nil {
+		return errors.Wrap(err, "failed to fetch cert file")
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	data, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return errors.Wrap(err, "read cert data")
+	}
+
+	// Add the file
+	err = tc.WriteFile(dest, 0644, data)
+	return err
+}
+
+type envMap map[string]string
+
+func (m envMap) Update(envs []string) {
+	for _, e := range envs {
+		key, value, _ := strings.Cut(e, "=")
+		m[key] = value
+	}
+}
+
+func (m envMap) ToSlice() []string {
+	envs := make([]string, 0, len(m))
+	for k, v := range m {
+		envs = append(envs, k+"="+v)
+	}
+	slices.Sort(envs)
+	return envs
+}
+
+func newEnvMap(envs []string) envMap {
+	m := make(envMap, len(envs))
+	for _, e := range envs {
+		key, value, _ := strings.Cut(e, "=")
+		m[key] = value
+	}
+	return m
+}
diff --git a/pkg/dockerbuild/dockerbuild_test.go b/pkg/dockerbuild/dockerbuild_test.go
new file mode 100644
index 0000000000..5773c3c94e
--- /dev/null
+++ b/pkg/dockerbuild/dockerbuild_test.go
@@ -0,0 +1,90 @@
+package dockerbuild
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	qt "github.com/frankban/quicktest"
+
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+func TestBuildImage(t *testing.T) {
+	c := qt.New(t)
+
+	artifacts := paths.FS(c.TempDir())
+	writeFiles(c, artifacts, map[string]string{
+		"entrypoint":       "echo hello",
+		"package.json":     `{"name": "package/name"}`,
+		"node_modules/foo": "foo",
+	})
+	runtimes := paths.FS(c.TempDir())
+	writeFiles(c, runtimes, map[string]string{
+		"js/encore-runtime.node":     "node runtime",
+		"js/encore.dev/package.json": `{"name": "encore.dev"}`,
+	})
+
+	cfg := DescribeConfig{
+		Meta:     &meta.Data{},
+		Runtimes: HostPath(runtimes),
+		BundleSource: option.Some(BundleSourceSpec{
+			Source:         HostPath(artifacts),
+			Dest:           "/workspace",
+			AppRootRelpath: ".",
+		}),
+		Compile: &builder.CompileResult{Outputs: []builder.BuildOutput{
+			&builder.JSBuildOutput{
+				ArtifactDir: artifacts,
+				Entrypoints: []builder.Entrypoint{{
+					Cmd: builder.CmdSpec{
+						Command:          builder.ArtifactStrings{"${ARTIFACT_DIR}/entrypoint"},
+						PrioritizedFiles: builder.ArtifactStrings{"${ARTIFACT_DIR}/entrypoint"},
+					},
+					Services:           []string{"foo", "bar"},
+					Gateways:           []string{"baz", "qux"},
+					UseRuntimeConfigV2: true,
+				}},
+			},
+		}},
+	}
+
+	spec, err := describe(cfg)
+	c.Assert(err, qt.IsNil)
+
+	encoreBinaries := paths.FS(c.TempDir())
+	writeFiles(c, encoreBinaries, map[string]string{
+		"supervisor.bin": "supervisor",
+	})
+
+	ctx := context.Background()
+	buildTime := time.Unix(1234567890, 0)
+	img, err := BuildImage(ctx, spec, ImageBuildConfig{
+		BuildTime:      buildTime,
+		SupervisorPath: option.Some(HostPath(encoreBinaries.Join("supervisor.bin"))),
+	})
+	c.Assert(err, qt.IsNil)
+
+	_, err = img.Digest()
+	c.Assert(err, qt.IsNil)
+	// Note: this digest changes depending on the machine it's being built on
+	// c.Assert(digest.String(), qt.Equals, "sha256:6e0032a1560c506901bbc1bb291d7655639d242f5ca09d5e119876830e34813d")
+}
+
+func writeFiles(c *qt.C, dir paths.FS, files map[string]string) {
+	for name, content := range files {
+		c.Assert(filepath.IsLocal(name), qt.IsTrue)
+		path := string(dir.Join(name))
+
+		err := os.MkdirAll(filepath.Dir(path), 0755)
+		c.Assert(err, qt.IsNil)
+
+		err = os.WriteFile(path, []byte(content), 0755)
+		c.Assert(err, qt.IsNil)
+	}
+}
diff --git a/pkg/dockerbuild/features.go b/pkg/dockerbuild/features.go
new file mode 100644
index 0000000000..a3aba5d3e3
--- /dev/null
+++ b/pkg/dockerbuild/features.go
@@ -0,0 +1,7 @@
+package dockerbuild
+
+type FeatureFlag string
+
+const (
+	NewRuntimeConfig FeatureFlag = "new_runtime_config"
+)
diff --git a/pkg/dockerbuild/manifest.go b/pkg/dockerbuild/manifest.go
new file mode 100644
index 0000000000..2595ec2ee9
--- /dev/null
+++ b/pkg/dockerbuild/manifest.go
@@ -0,0 +1,17 @@
+package dockerbuild
+
+type ImageManifestFile struct {
+	Manifests []*ImageManifest
+}
+
+type ImageManifest struct {
+	// The Docker Image reference, e.g. "gcr.io/my-project/my-image:sha256:abcdef..."
+	Reference string
+
+	// Services and gateways bundled in this image.
+	BundledServices []string
+	BundledGateways []string
+
+	// FeatureFlags captures feature flags enabled for this image.
+	FeatureFlags map[FeatureFlag]bool
+}
diff --git a/pkg/dockerbuild/spec.go b/pkg/dockerbuild/spec.go
new file mode 100644
index 0000000000..8507e6d9cf
--- /dev/null
+++ b/pkg/dockerbuild/spec.go
@@ -0,0 +1,565 @@
+package dockerbuild
+
+import (
+	"fmt"
+	"os"
+	pathpkg "path"
+	"path/filepath"
+	"runtime"
+	"slices"
+	strconv "strconv"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+	"github.com/golang/protobuf/proto"
+	"github.com/rs/xid"
+
+	"encr.dev/pkg/appfile"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/noopgateway"
+	"encr.dev/pkg/noopgwdesc"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/pkg/supervisor"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+type ImageSpecFile struct {
+	Images []*ImageSpec
+}
+
+// ImageSpec is a specification for how to build a docker image.
+type ImageSpec struct {
+	// The operating system to use for the image.
+	OS string
+
+	// The architecture to use for the image.
+	Arch string
+
+	// The entrypoint to use for the image. It must be non-empty.
+	// The first entry is the executable path, and the rest are the arguments.
+	Entrypoint []string
+
+	// Environment variables to set for the entrypoint.
+	Env []string
+
+	// The working dir to use for executing the entrypoint.
+	WorkingDir ImagePath
+
+	// BuildInfo contains information about the build.
+	BuildInfo BuildInfoSpec
+
+	// A map from the builder filesystem paths to the destination path in the image.
+	// If the source is a directory, it will be copied recursively.
+	CopyData map[ImagePath]HostPath
+
+	// A set of files which should be written to the image.
+	WriteFiles map[ImagePath][]byte
+
+	// Whether to bundle source into the image.
+	// It's handled separately from CopyData since we apply some filtering
+	// on what's copied, like excluding .git directories and other build artifacts.
+	BundleSource option.Option[BundleSourceSpec]
+
+	// Supervisor specifies the supervisor configuration.
+	Supervisor option.Option[SupervisorSpec]
+
+	// The names of services bundled in this image.
+	BundledServices []string
+
+	// The names of gateways bundled in this image.
+	BundledGateways []string
+
+	// The docker base image to use. If None it defaults to the empty scratch image.
+	DockerBaseImage string
+
+	// StargzPrioritizedFiles are file paths in the image that should be prioritized for
+	// stargz compression, allowing for faster streaming of those files.
+	StargzPrioritizedFiles []ImagePath
+
+	// FeatureFlags specifies feature flags enabled for this image.
+	FeatureFlags map[FeatureFlag]bool
+}
+
+type BuildInfoSpec struct {
+	// The build info to include in the image.
+	Info BuildInfo
+
+	// The path in the image where the build info is written, as a JSON file.
+	InfoPath ImagePath
+}
+
+type BuildInfo struct {
+	// The version of Encore with which the app was compiled.
+	// This is string is for informational use only, and its format should not be relied on.
+	EncoreCompiler string
+
+	// AppCommit describes the commit of the app.
+	AppCommit CommitInfo
+}
+
+type CommitInfo struct {
+	Revision    string
+	Uncommitted bool
+}
+
+type BundleSourceSpec struct {
+	Source HostPath
+	Dest   ImagePath
+
+	// Source paths to exclude from copying, relative to Source.
+	ExcludeSource []RelPath
+
+	// Path to app root, will be included, relative to Source.
+	AppRootRelpath RelPath
+
+	// Extra source paths to include when bundling, relative to Source.
+	IncludeSource []RelPath
+}
+
+type SupervisorSpec struct {
+	// Where to mount the supervisor binary in the image.
+	MountPath ImagePath
+
+	// Where to write the supervisor configuration in the image.
+	ConfigPath ImagePath
+
+	// The config to pass to the supervisor.
+	Config *supervisor.Config
+}
+
+type DescribeConfig struct {
+	// The parsed metadata.
+	Meta *meta.Data
+
+	// The compile result.
+	Compile *builder.CompileResult
+
+	// The directory containing the runtimes.
+	Runtimes HostPath
+
+	// The path to the node runtime, if any.
+	NodeRuntime option.Option[HostPath]
+
+	// The docker base image to use, if any. If None it defaults to the empty scratch image.
+	DockerBaseImage option.Option[string]
+
+	// BundleSource specifies whether to bundle source into the image,
+	// and where the source is located on the host filesystem.
+	BundleSource option.Option[BundleSourceSpec]
+
+	// WorkingDir specifies the working directory to start the docker image in.
+	WorkingDir option.Option[ImagePath]
+
+	// BuildInfo contains information about the build.
+	BuildInfo BuildInfo
+
+	// ProcessPerService specifies whether to run each service in a separate process.
+	ProcessPerService bool
+}
+
+type (
+	// HostPath is a path on the host filesystem.
+	HostPath string
+	// ImagePath is a path in the docker image.
+	ImagePath string
+	// RelPath is a relative path.
+	RelPath string
+)
+
+func (i ImagePath) Dir() ImagePath   { return ImagePath(pathpkg.Dir(string(i))) }
+func (i ImagePath) Clean() ImagePath { return ImagePath(pathpkg.Clean(string(i))) }
+func (i ImagePath) String() string   { return string(i) }
+func (i ImagePath) Join(p ...string) ImagePath {
+	return ImagePath(pathpkg.Join(string(i), pathpkg.Join(p...)))
+}
+func (i ImagePath) JoinImage(p ImagePath) ImagePath {
+	return i.Join(string(p))
+}
+func (h HostPath) Dir() HostPath { return HostPath(filepath.Dir(string(h))) }
+func (h HostPath) Join(p ...string) HostPath {
+	return HostPath(filepath.Join(string(h), filepath.Join(p...)))
+}
+func (h HostPath) JoinHost(p HostPath) HostPath {
+	return h.Join(string(p))
+}
+func (h HostPath) ToImage() ImagePath {
+	return ImagePath(string(h.ToUnix()))
+}
+func (h HostPath) ToUnix() HostPath {
+	if runtime.GOOS == "windows" {
+		// convert windows path with volume to a unix path, i.e c:\some\path -> /c/some/path
+		volume := filepath.VolumeName(string(h))
+		if len(volume) == 2 && volume[1] == ':' {
+			return HostPath("/" + string(volume[0]) + filepath.ToSlash(string(h[2:])))
+		}
+	}
+
+	return HostPath(filepath.ToSlash(string(h)))
+}
+func (h HostPath) String() string { return string(h) }
+func (h HostPath) Rel(target HostPath) (HostPath, error) {
+	rel, err := filepath.Rel(string(h), string(target))
+	return HostPath(rel), err
+}
+func (h HostPath) IsAbs() bool {
+	return filepath.IsAbs(h.String())
+}
+
+// Describe describes the docker image to build.
+func Describe(cfg DescribeConfig) (*ImageSpec, error) {
+	return newImageSpecBuilder().Describe(cfg)
+}
+
+func newImageSpecBuilder() *imageSpecBuilder {
+	return &imageSpecBuilder{
+		procIDGen: randomProcID,
+		spec: &ImageSpec{
+			CopyData:        make(map[ImagePath]HostPath),
+			WriteFiles:      map[ImagePath][]byte{},
+			FeatureFlags:    make(map[FeatureFlag]bool),
+			BundledGateways: []string{},
+			BundledServices: []string{},
+		},
+		seenArtifactDirs: make(map[HostPath]*imageArtifactDir),
+		seenPrioFiles:    make(map[ImagePath]bool),
+	}
+}
+
+type imageArtifactDir struct {
+	Base           ImagePath
+	BuildArtifacts ImagePath
+}
+
+type imageSpecBuilder struct {
+	spec *ImageSpec
+
+	// procIDGen generates a random id for each process.
+	// Defaults to randomProcID.
+	procIDGen func() string
+
+	// The artifact dirs we've already seen, to avoid
+	// duplicate copies into the image.
+	seenArtifactDirs map[HostPath]*imageArtifactDir
+	seenPrioFiles    map[ImagePath]bool
+}
+
+const (
+	// defaultSupervisorMountPath is the path in the image where the supervisor is mounted.
+	defaultSupervisorMountPath ImagePath = "/encore/bin/supervisor"
+
+	// defaultSupervisorConfigPath is the path in the image where the supervisor config is located.
+	defaultSupervisorConfigPath ImagePath = "/encore/supervisor.config.json"
+
+	// defaultBuildInfoPath is the path in the image where the build information is located.
+	defaultBuildInfoPath ImagePath = "/encore/build-info.json"
+
+	// defaultMetaPath is the path in the image where the application metadata is located.
+	defaultMetaPath ImagePath = "/encore/meta"
+)
+
+func (b *imageSpecBuilder) Describe(cfg DescribeConfig) (*ImageSpec, error) {
+	// Allocate artifact directories for each output.
+	for _, out := range cfg.Compile.Outputs {
+		b.allocArtifactDir(cfg, out)
+	}
+
+	// Determine if we should use the supervisor.
+	// We must use the supervisor if we have more than one service or gateway.
+	useSupervisor := cfg.ProcessPerService || len(cfg.Compile.Outputs) > 1 || len(cfg.Compile.Outputs[0].GetEntrypoints()) > 1
+
+	if !useSupervisor {
+		ep := cfg.Compile.Outputs[0].GetEntrypoints()[0]
+		out := cfg.Compile.Outputs[0]
+		imageArtifacts, ok := b.seenArtifactDirs[HostPath(out.GetArtifactDir())]
+		if !ok {
+			return nil, errors.Errorf("missing image artifact dir for %q", out.GetArtifactDir())
+		}
+		cmd := ep.Cmd.Expand(paths.FS(imageArtifacts.BuildArtifacts))
+		b.spec.Entrypoint = cmd.Command
+		b.spec.Env = cmd.Env
+	} else {
+		config := &supervisor.Config{
+			NoopGateways: make(map[string]*noopgateway.Description),
+		}
+		super := SupervisorSpec{
+			MountPath:  defaultSupervisorMountPath,
+			ConfigPath: defaultSupervisorConfigPath,
+			Config:     config,
+		}
+
+		seenGateways := make(map[string]bool)
+		for _, out := range cfg.Compile.Outputs {
+			imageArtifacts, ok := b.seenArtifactDirs[HostPath(out.GetArtifactDir())]
+			if !ok {
+				return nil, errors.Errorf("missing image artifact dir for %q", out.GetArtifactDir())
+			}
+
+			for _, ep := range out.GetEntrypoints() {
+				cmd := ep.Cmd.Expand(paths.FS(imageArtifacts.BuildArtifacts))
+				proc := supervisor.Proc{
+					ID:       b.procIDGen(),
+					Command:  cmd.Command,
+					Env:      cmd.Env,
+					Services: slices.Clone(ep.Services),
+					Gateways: slices.Clone(ep.Gateways),
+				}
+				slices.Sort(proc.Services)
+				slices.Sort(proc.Gateways)
+
+				for _, gw := range ep.Gateways {
+					seenGateways[gw] = true
+				}
+
+				config.Procs = append(config.Procs, proc)
+			}
+		}
+
+		// We need all gateways to be provided by some docker image. But for now, since we only support
+		// a single docker image, we need all gateways to be provided by this image.
+		// Each gateway that's not hosted by this image should be provided by a noop-gateway.
+		if cfg.Meta != nil { // nil check for backwards compatibility
+			for _, gw := range cfg.Meta.Gateways {
+				if !seenGateways[gw.EncoreName] {
+					config.NoopGateways[gw.EncoreName] = noopgwdesc.Describe(cfg.Meta, nil)
+				}
+			}
+		}
+
+		b.addPrio(super.MountPath)
+		b.spec.Supervisor = option.Some(super)
+		b.spec.Entrypoint = []string{string(super.MountPath), "-c", string(super.ConfigPath)}
+		b.spec.Env = nil // not needed by supervisor
+	}
+
+	// TS apps use runtime config v2.
+	if cfg.Meta.Language == meta.Lang_TYPESCRIPT {
+		b.spec.FeatureFlags[NewRuntimeConfig] = true
+	}
+
+	// Compute bundled services and gateways.
+	{
+		for _, out := range cfg.Compile.Outputs {
+			for _, ep := range out.GetEntrypoints() {
+				b.spec.BundledServices = append(b.spec.BundledServices, ep.Services...)
+				b.spec.BundledGateways = append(b.spec.BundledGateways, ep.Gateways...)
+			}
+		}
+
+		// If we have any noop-gateways, consider them bundled, too.
+		if super, ok := b.spec.Supervisor.Get(); ok {
+			for name := range super.Config.NoopGateways {
+				b.spec.BundledGateways = append(b.spec.BundledGateways, name)
+			}
+		}
+
+		// Sort and deduplicate.
+		slices.Sort(b.spec.BundledServices)
+		b.spec.BundledServices = slices.Compact(b.spec.BundledServices)
+
+		slices.Sort(b.spec.BundledGateways)
+		b.spec.BundledGateways = slices.Compact(b.spec.BundledGateways)
+	}
+
+	// Add entrypoint files to prioritized files.
+	for _, out := range cfg.Compile.Outputs {
+		hostArtifacts := HostPath(out.GetArtifactDir())
+		imageArtifacts, ok := b.seenArtifactDirs[hostArtifacts]
+		if !ok {
+			return nil, errors.Errorf("missing image artifact dir for %q", hostArtifacts)
+		}
+
+		for _, ep := range out.GetEntrypoints() {
+			// For each entrypoint, add prioritized files.
+			files := ep.Cmd.PrioritizedFiles.Expand(paths.FS(imageArtifacts.BuildArtifacts))
+			for _, file := range files {
+				b.addPrio(ImagePath(file))
+			}
+		}
+	}
+
+	// If we have any JS outputs that need the local runtime, copy it into the image.
+	{
+		for _, out := range cfg.Compile.Outputs {
+			if _, ok := out.(*builder.JSBuildOutput); ok {
+				if nativeRuntimeHost, ok := cfg.NodeRuntime.Get(); ok {
+					// Add the encore-runtime.node file, and set the environment variable to point to it.
+					nativeRuntimeImg := ImagePath("/encore/runtimes/js/encore-runtime.node")
+					b.spec.CopyData[nativeRuntimeImg] = nativeRuntimeHost
+					b.spec.Env = append(b.spec.Env, fmt.Sprintf("ENCORE_RUNTIME_LIB=%s", nativeRuntimeImg))
+					b.addPrio(nativeRuntimeImg)
+
+					// Copy the encore.dev package.
+					nativePackageHost := cfg.Runtimes.Join("js", "encore.dev")
+					nativePackageImg := ImagePath("/encore/runtimes/js/encore.dev")
+					b.spec.CopyData[nativePackageImg] = nativePackageHost
+				} else {
+					// Copy the whole js runtime.
+					runtimeHost := cfg.Runtimes.Join("js")
+					runtimeImg := ImagePath("/encore/runtimes/js")
+					b.spec.CopyData[runtimeImg] = runtimeHost
+
+					nativeRuntimeImg := runtimeImg.Join("encore-runtime.node")
+					b.spec.Env = append(b.spec.Env, fmt.Sprintf("ENCORE_RUNTIME_LIB=%s", nativeRuntimeImg))
+					b.addPrio(nativeRuntimeImg)
+				}
+
+				break
+			}
+		}
+	}
+
+	b.spec.DockerBaseImage = cfg.DockerBaseImage.GetOrElse("scratch")
+	b.spec.BundleSource = cfg.BundleSource
+	b.spec.WorkingDir = cfg.WorkingDir.GetOrElse("/")
+	b.spec.OS = cfg.Compile.OS
+	b.spec.Arch = cfg.Compile.Arch
+
+	// Include build information.
+	b.spec.BuildInfo = BuildInfoSpec{
+		Info:     cfg.BuildInfo,
+		InfoPath: defaultBuildInfoPath,
+	}
+
+	// Include the app metadata.
+	{
+		md, err := proto.Marshal(cfg.Meta)
+		if err != nil {
+			return nil, errors.Wrap(err, "marshal meta")
+		}
+		b.spec.WriteFiles[defaultMetaPath] = md
+	}
+
+	return b.spec, nil
+}
+
+func (b *imageSpecBuilder) addPrio(path ImagePath) {
+	if !b.seenPrioFiles[path] {
+		b.seenPrioFiles[path] = true
+		b.spec.StargzPrioritizedFiles = append(b.spec.StargzPrioritizedFiles, path)
+	}
+}
+
+func (b *imageSpecBuilder) allocArtifactDir(cfg DescribeConfig, out builder.BuildOutput) *imageArtifactDir {
+	hostArtifacts := HostPath(out.GetArtifactDir())
+	if s := b.seenArtifactDirs[hostArtifacts]; s != nil {
+		// Already copied this artifact dir.
+		return s
+	}
+
+	bundle, hasBundle := cfg.BundleSource.Get()
+	_, isJSOutput := out.(*builder.JSBuildOutput)
+
+	// For TS apps the artifacts will be bundled with the source
+	if isJSOutput && hasBundle {
+		// If hostArtifacts are within the the bundled source, we dont need to copy them.
+		if strings.HasPrefix(string(hostArtifacts), string(bundle.Source)) {
+			relpath, err := filepath.Rel(string(bundle.Source), string(hostArtifacts))
+			if err != nil {
+				panic(fmt.Sprintf("failed to calculate relative path from %q to %q: %v", bundle.Source, hostArtifacts, err))
+			}
+
+			imageBuildArtifactsDir := bundle.Dest.Join(string(filepath.ToSlash(relpath)))
+
+			artifactDir := &imageArtifactDir{
+				Base:           imageBuildArtifactsDir.Dir(),
+				BuildArtifacts: imageBuildArtifactsDir,
+			}
+
+			b.seenArtifactDirs[hostArtifacts] = artifactDir
+			return artifactDir
+		}
+	}
+
+	// This artifact directory has not been copied yet.
+	// Determine a reasonable name for it.
+	basePath := "/artifacts"
+
+	for i := 0; ; i++ {
+		candidatePath := ImagePath(pathpkg.Join(basePath, strconv.Itoa(i)))
+		candidate := &imageArtifactDir{
+			Base:           candidatePath,
+			BuildArtifacts: candidatePath.Join("build"),
+		}
+		if b.spec.CopyData[candidate.Base] == "" && b.spec.CopyData[candidate.BuildArtifacts] == "" {
+			// This name is available.
+			b.spec.CopyData[candidate.BuildArtifacts] = hostArtifacts
+			b.seenArtifactDirs[hostArtifacts] = candidate
+			return candidate
+		}
+
+		// This path already exists. Keep trying.
+	}
+
+}
+
+func randomProcID() string {
+	return fmt.Sprintf("proc_%s", xid.New())
+}
+
+// DetermineIncludes determines what paths within the workspace should be included in the image.
+func DetermineIncludes(appLang appfile.Lang, bundleSource bool, workspaceRoot string, appRoot string) ([]RelPath, error) {
+	// if the actual setting is set, include all files from the workspace
+	if bundleSource {
+		return []RelPath{"."}, nil
+	}
+
+	// app root is always included
+	if workspaceRoot == appRoot {
+		return nil, nil
+	}
+
+	var extraIncludePaths []RelPath
+
+	// Include node_modules and package.json from the workspace root if the app is a TypeScript app.
+	if appLang == appfile.LangTS {
+		dir := filepath.Dir(appRoot)
+		for {
+			relPath, err := filepath.Rel(workspaceRoot, dir)
+			if err != nil {
+				return nil, errors.Wrap(err, "relative path from workspace root")
+			}
+
+			pathsToCheck := []string{"node_modules", "package.json"}
+			for _, path := range pathsToCheck {
+				if _, err := os.Stat(filepath.Join(dir, path)); err == nil {
+					extraIncludePaths = append(extraIncludePaths, RelPath(filepath.Join(relPath, path)))
+				}
+			}
+
+			if dir == workspaceRoot {
+				break
+			}
+
+			dir = filepath.Dir(dir)
+		}
+	}
+
+	// Walk all files and folders in includedPaths and find any symlinks.
+	// Add the symlink target to includedPaths if it is within the workspace root.
+	for _, path := range extraIncludePaths {
+		absPath := filepath.Join(workspaceRoot, string(path))
+		filepath.Walk(absPath, func(path string, fi os.FileInfo, err error) error {
+			if err != nil {
+				return err
+			}
+			if fi.Mode()&os.ModeSymlink != 0 {
+				target, err := os.Readlink(path)
+				if err != nil {
+					return nil
+				}
+				absTarget := filepath.Join(filepath.Dir(path), filepath.Clean(target))
+				relTarget, err := filepath.Rel(workspaceRoot, absTarget)
+				if err != nil {
+					return nil
+				}
+				if strings.HasPrefix(absTarget, workspaceRoot) {
+					extraIncludePaths = append(extraIncludePaths, RelPath(relTarget))
+				}
+			}
+			return nil
+		})
+	}
+
+	return extraIncludePaths, nil
+}
diff --git a/pkg/dockerbuild/spec_test.go b/pkg/dockerbuild/spec_test.go
new file mode 100644
index 0000000000..83b17843f3
--- /dev/null
+++ b/pkg/dockerbuild/spec_test.go
@@ -0,0 +1,207 @@
+package dockerbuild
+
+import (
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/golang/protobuf/proto"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/supervisor"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+func TestBuild_Node(t *testing.T) {
+	c := qt.New(t)
+	cfg := DescribeConfig{
+		Meta:     &meta.Data{Language: meta.Lang_TYPESCRIPT},
+		Runtimes: "/host/runtimes",
+		BundleSource: option.Some(BundleSourceSpec{
+			Source:         "/host",
+			Dest:           "/image",
+			AppRootRelpath: ".",
+		}),
+		Compile: &builder.CompileResult{Outputs: []builder.BuildOutput{
+			&builder.JSBuildOutput{
+				ArtifactDir: "/host/artifacts",
+				Entrypoints: []builder.Entrypoint{{
+					Cmd: builder.CmdSpec{
+						Command:          builder.ArtifactStrings{"${ARTIFACT_DIR}/entrypoint"},
+						PrioritizedFiles: builder.ArtifactStrings{"${ARTIFACT_DIR}/entrypoint"},
+					},
+					Services: []string{"foo", "bar"},
+					Gateways: []string{"baz", "qux"},
+				}},
+			},
+		}},
+	}
+	spec, err := describe(cfg)
+	c.Assert(err, qt.IsNil)
+
+	meta, err := proto.Marshal(cfg.Meta)
+	c.Assert(err, qt.IsNil)
+
+	opts := append([]cmp.Option{cmpopts.EquateEmpty()}, option.CmpOpts()...)
+	c.Assert(spec, qt.CmpEquals(opts...), &ImageSpec{
+		Entrypoint: []string{"/image/artifacts/entrypoint"},
+		Env: []string{
+			"ENCORE_RUNTIME_LIB=/encore/runtimes/js/encore-runtime.node",
+		},
+		WorkingDir: "/",
+		BuildInfo:  BuildInfoSpec{InfoPath: defaultBuildInfoPath},
+		WriteFiles: map[ImagePath][]byte{defaultMetaPath: meta},
+		CopyData: map[ImagePath]HostPath{
+			"/encore/runtimes/js": "/host/runtimes/js",
+		},
+		BundleSource: option.Some(BundleSourceSpec{
+			Source:         "/host",
+			Dest:           "/image",
+			AppRootRelpath: ".",
+			ExcludeSource:  []RelPath{},
+			IncludeSource:  []RelPath{},
+		}),
+		Supervisor:      option.None[SupervisorSpec](),
+		BundledServices: []string{"bar", "foo"},
+		BundledGateways: []string{"baz", "qux"},
+		DockerBaseImage: "scratch",
+		FeatureFlags:    map[FeatureFlag]bool{NewRuntimeConfig: true},
+		StargzPrioritizedFiles: []ImagePath{
+			"/image/artifacts/entrypoint",
+			"/encore/runtimes/js/encore-runtime.node",
+		},
+	})
+}
+
+func TestBuild_Go_SingleBinary(t *testing.T) {
+	c := qt.New(t)
+	cfg := DescribeConfig{
+		Meta: &meta.Data{},
+		Compile: &builder.CompileResult{Outputs: []builder.BuildOutput{
+			&builder.GoBuildOutput{
+				ArtifactDir: "/host/artifacts",
+				Entrypoints: []builder.Entrypoint{
+					{
+						Cmd: builder.CmdSpec{
+							Command:          builder.ArtifactStrings{"${ARTIFACT_DIR}/entrypoint"},
+							PrioritizedFiles: builder.ArtifactStrings{"${ARTIFACT_DIR}/entrypoint"},
+						},
+						Services: []string{"foo", "bar"},
+					},
+				},
+			},
+		}},
+	}
+
+	spec, err := describe(cfg)
+	c.Assert(err, qt.IsNil)
+
+	opts := append([]cmp.Option{cmpopts.EquateEmpty()}, option.CmpOpts()...)
+	c.Assert(spec, qt.CmpEquals(opts...), &ImageSpec{
+		Entrypoint: []string{"/artifacts/0/build/entrypoint"},
+		Env:        nil,
+		WorkingDir: "/",
+		BuildInfo:  BuildInfoSpec{InfoPath: defaultBuildInfoPath},
+		CopyData: map[ImagePath]HostPath{
+			"/artifacts/0/build": "/host/artifacts",
+		},
+		BundledServices: []string{"bar", "foo"},
+		BundleSource:    option.Option[BundleSourceSpec]{},
+		Supervisor:      option.None[SupervisorSpec](),
+		DockerBaseImage: "scratch",
+		FeatureFlags:    map[FeatureFlag]bool{},
+		StargzPrioritizedFiles: []ImagePath{
+			"/artifacts/0/build/entrypoint",
+		},
+		WriteFiles: map[ImagePath][]byte{
+			defaultMetaPath: {},
+		},
+	})
+}
+
+func TestBuild_Go_MultiProc(t *testing.T) {
+	c := qt.New(t)
+	cfg := DescribeConfig{
+		Meta: &meta.Data{Language: meta.Lang_TYPESCRIPT},
+		Compile: &builder.CompileResult{Outputs: []builder.BuildOutput{
+			&builder.GoBuildOutput{
+				ArtifactDir: "/host/artifacts",
+				Entrypoints: []builder.Entrypoint{
+					{
+						Cmd: builder.CmdSpec{
+							Command:          builder.ArtifactStrings{"${ARTIFACT_DIR}/entrypoint"},
+							PrioritizedFiles: builder.ArtifactStrings{"${ARTIFACT_DIR}/entrypoint"},
+						},
+						Services: []string{"foo"},
+					},
+					{
+						Cmd: builder.CmdSpec{
+							Command:          builder.ArtifactStrings{"${ARTIFACT_DIR}/other-entrypoint"},
+							PrioritizedFiles: builder.ArtifactStrings{"${ARTIFACT_DIR}/other-entrypoint"},
+						},
+						Services: []string{"bar"},
+					},
+				},
+			},
+		}},
+	}
+
+	spec, err := describe(cfg)
+	c.Assert(err, qt.IsNil)
+
+	meta, err := proto.Marshal(cfg.Meta)
+	c.Assert(err, qt.IsNil)
+
+	opts := append([]cmp.Option{cmpopts.EquateEmpty()}, option.CmpOpts()...)
+	c.Assert(spec, qt.CmpEquals(opts...), &ImageSpec{
+		Entrypoint: []string{"/encore/bin/supervisor", "-c", string(defaultSupervisorConfigPath)},
+		Env:        nil,
+		WorkingDir: "/",
+		BuildInfo:  BuildInfoSpec{InfoPath: defaultBuildInfoPath},
+		CopyData: map[ImagePath]HostPath{
+			"/artifacts/0/build": "/host/artifacts",
+		},
+		BundledServices: []string{"bar", "foo"},
+		BundleSource:    option.Option[BundleSourceSpec]{},
+		Supervisor: option.Some(SupervisorSpec{
+			MountPath:  "/encore/bin/supervisor",
+			ConfigPath: defaultSupervisorConfigPath,
+			Config: &supervisor.Config{
+				Procs: []supervisor.Proc{
+					{
+						ID:       "proc-id",
+						Command:  []string{"/artifacts/0/build/entrypoint"},
+						Services: []string{"foo"},
+						Gateways: []string{},
+					},
+					{
+						ID:       "proc-id",
+						Command:  []string{"/artifacts/0/build/other-entrypoint"},
+						Services: []string{"bar"},
+						Gateways: []string{},
+					},
+				},
+			},
+		}),
+		DockerBaseImage: "scratch",
+		FeatureFlags:    map[FeatureFlag]bool{NewRuntimeConfig: true},
+		StargzPrioritizedFiles: []ImagePath{
+			"/encore/bin/supervisor",
+			"/artifacts/0/build/entrypoint",
+			"/artifacts/0/build/other-entrypoint",
+		},
+		WriteFiles: map[ImagePath][]byte{
+			defaultMetaPath: meta,
+		},
+	})
+}
+
+// describe is like Describe but mocks the proc id generation
+// for reproducible tests.
+func describe(cfg DescribeConfig) (*ImageSpec, error) {
+	b := newImageSpecBuilder()
+	b.procIDGen = func() string { return "proc-id" }
+	return b.Describe(cfg)
+}
diff --git a/pkg/dockerbuild/tarcopy.go b/pkg/dockerbuild/tarcopy.go
new file mode 100644
index 0000000000..f62a224996
--- /dev/null
+++ b/pkg/dockerbuild/tarcopy.go
@@ -0,0 +1,411 @@
+package dockerbuild
+
+import (
+	"archive/tar"
+	"bytes"
+	"fmt"
+	"io"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"runtime"
+	"sort"
+	"strings"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/google/go-containerregistry/pkg/v1/tarball"
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/tarstream"
+	"encr.dev/pkg/xos"
+	"encr.dev/v2/compiler/build"
+)
+
+type tarCopier struct {
+	fileTimes *time.Time
+	entries   []*tarEntry
+	seenDirs  map[ImagePath]bool
+}
+
+func newTarCopier(opts ...tarCopyOption) *tarCopier {
+	tc := &tarCopier{
+		seenDirs: make(map[ImagePath]bool),
+	}
+	for _, opt := range opts {
+		opt(tc)
+	}
+	return tc
+}
+
+type tarCopyOption func(*tarCopier)
+
+func setFileTimes(t time.Time) tarCopyOption {
+	return func(tc *tarCopier) {
+		tc.fileTimes = &t
+	}
+}
+
+// dirCopyDesc describes how to copy a directory to the tar.
+type dirCopyDesc struct {
+	Spec    *ImageSpec
+	SrcPath HostPath
+	DstPath ImagePath
+
+	// Src paths to exclude.
+	ExcludeSrcPaths map[HostPath]bool
+
+	// Src paths to include.
+	IncludeSrcPaths []HostPath
+}
+
+func (tc *tarCopier) CopyData(spec *ImageSpec) error {
+	// Sort the paths by the destination path so that the tar file is deterministic.
+	type pathPair struct {
+		Src  HostPath
+		Dest ImagePath
+	}
+
+	var paths []pathPair
+	for dest, src := range spec.CopyData {
+		paths = append(paths, pathPair{Src: src, Dest: dest})
+	}
+	sort.Slice(paths, func(i, j int) bool {
+		return paths[i].Dest < paths[j].Dest
+	})
+
+	for _, p := range paths {
+		fi, err := os.Stat(string(p.Src))
+		if err != nil {
+			return errors.Wrap(err, "stat source file")
+		}
+		if err := tc.MkdirAll(p.Dest.Dir(), 0755); err != nil {
+			return errors.Wrap(err, "create dirs")
+		}
+		if fi.IsDir() {
+			err = tc.CopyDir(&dirCopyDesc{
+				Spec:            spec,
+				SrcPath:         p.Src,
+				DstPath:         p.Dest,
+				ExcludeSrcPaths: nil,
+				IncludeSrcPaths: []HostPath{p.Src},
+			})
+		} else {
+			err = tc.CopyFile(p.Dest, p.Src, fi, "")
+		}
+		if err != nil {
+			return errors.Wrap(err, "copy path")
+		}
+	}
+
+	return nil
+}
+
+// shouldInclude returns true if the path should be included in the tar.
+func shouldInclude(desc *dirCopyDesc, path HostPath) bool {
+	for _, include := range desc.IncludeSrcPaths {
+		if string(path) == string(include) {
+			return true
+		}
+
+		if strings.HasPrefix(string(path), string(include)) {
+			return true
+		}
+
+		if strings.HasPrefix(string(include), string(path)) {
+			return true
+		}
+	}
+
+	return false
+}
+
+func (tc *tarCopier) CopyDir(desc *dirCopyDesc) error {
+	err := filepath.WalkDir(string(desc.SrcPath), func(pathStr string, d fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		path := HostPath(pathStr)
+
+		// Should we keep this path?
+		if !shouldInclude(desc, path) {
+			if d.IsDir() {
+				return filepath.SkipDir
+			} else {
+				return nil
+			}
+		}
+
+		// Should we skip this path?
+		if desc.ExcludeSrcPaths[path] {
+			if d.IsDir() {
+				return filepath.SkipDir
+			} else {
+				return nil
+			}
+		}
+
+		relPath, err := desc.SrcPath.Rel(path)
+		if err != nil {
+			return errors.WithStack(err)
+		}
+		dstPath := desc.DstPath.Join(string(relPath.ToImage()))
+
+		// If this is a symlink, compute the link target relative to DstPath.
+		var link ImagePath
+
+		isSymlink := d.Type()&fs.ModeSymlink != 0
+		if !isSymlink && runtime.GOOS == "windows" {
+			// Check if the file is a junction point on Windows.
+			if isJunction, _ := xos.IsWindowsJunctionPoint(pathStr); isJunction {
+				return errors.Newf("%q is a windows junction point and cannot be copied to a docker image. Use symlinks instead.", pathStr)
+			}
+
+		}
+
+		if isSymlink {
+			target, err := os.Readlink(string(path))
+			if err != nil {
+				return errors.WithStack(err)
+			}
+
+			link, err = tc.rewriteSymlink(desc, path, HostPath(target))
+			if err != nil {
+				return errors.WithStack(err)
+			} else if link == "" {
+				// Drop the symlink
+				return nil
+			}
+		}
+
+		fi, err := d.Info()
+		if err != nil {
+			return errors.WithStack(err)
+		}
+		err = tc.CopyFile(dstPath, path, fi, link)
+		return errors.Wrap(err, "add file")
+	})
+
+	return errors.WithStack(err)
+}
+
+// rewriteSymlink rewrites the symlink to the target filesystem.
+func (tc *tarCopier) rewriteSymlink(desc *dirCopyDesc, path HostPath, linkTarget HostPath) (newTarget ImagePath, err error) {
+	var (
+		absTarget      HostPath
+		relFromSrcPath HostPath
+	)
+
+	if linkTarget.IsAbs() {
+		// It's a link to an absolute destination.
+		// Determine its relative path, and see if that lives within the desc.SrcPath.
+		absTarget = linkTarget
+		// On Windows, we can only make a relative link if the source and target are on the same volume.
+		if runtime.GOOS != "windows" || filepath.VolumeName(desc.SrcPath.String()) == filepath.VolumeName(absTarget.String()) {
+			relFromSrcPath, err = desc.SrcPath.Rel(absTarget)
+			if err != nil {
+				return "", err
+			}
+
+			// If the relative path is local to the SrcPath, allow it.
+			if filepath.IsLocal(relFromSrcPath.String()) {
+				return desc.DstPath.JoinImage(relFromSrcPath.ToImage()), nil
+			}
+		}
+	} else {
+		// We have a relative link target. Determine its absolute destination.
+		// Use path.Dir() since the symlink is relative to its directory, not relative to itself.
+		absTarget = path.Dir().JoinHost(linkTarget)
+
+		// Determine its relative path, and see if that lives within the desc.SrcPath.
+		relFromSrcPath, err = desc.SrcPath.Rel(absTarget)
+		if err != nil {
+			return "", err
+		}
+
+		// If the relative path is local to the SrcPath, allow it.
+		if filepath.IsLocal(relFromSrcPath.String()) {
+			return desc.DstPath.JoinImage(relFromSrcPath.ToImage()), nil
+		}
+	}
+
+	// Otherwise, determine if the absTarget is within some other path being copied.
+	absTargetStr := absTarget.String()
+	for dst, src := range desc.Spec.CopyData {
+		srcStr := src.String()
+		stcStrSep := srcStr + string(filepath.Separator)
+		if absTargetStr == srcStr {
+			return dst, nil
+		} else if suffix, found := strings.CutPrefix(absTargetStr, stcStrSep); found {
+			// It lives within the target. Compute the new target path.
+			return dst.Join(suffix), nil
+		}
+	}
+
+	log.Debug().
+		Str("target", linkTarget.String()).
+		Str("rel_target", relFromSrcPath.String()).
+		Str("abs_target", absTarget.String()).
+		Msg("dropping escaping symlink")
+
+	return "", nil
+}
+
+func (tc *tarCopier) MkdirAll(dstPath ImagePath, mode fs.FileMode) (err error) {
+	dstPath = ImagePath(filepath.ToSlash(dstPath.String()))
+	dstPath = dstPath.Clean()
+
+	for dstPath != "." && dstPath != "/" {
+		if !tc.seenDirs[dstPath] {
+			modTime := time.Time{}
+			if tc.fileTimes != nil {
+				modTime = *tc.fileTimes
+			}
+			header := &tar.Header{
+				Typeflag: tar.TypeDir,
+				ModTime:  modTime,
+				Name:     tarHeaderName(dstPath, true),
+				Mode:     int64(mode.Perm()),
+			}
+			tc.entries = append(tc.entries, &tarEntry{
+				header: header,
+			})
+			tc.seenDirs[dstPath] = true
+		}
+
+		dstPath = dstPath.Dir()
+	}
+
+	return nil
+}
+
+func (tc *tarCopier) CopyFile(dstPath ImagePath, srcPath HostPath, fi fs.FileInfo, linkTarget ImagePath) (err error) {
+	header, err := tar.FileInfoHeader(fi, linkTarget.String())
+	if err != nil {
+		return err
+	}
+	if tc.fileTimes != nil {
+		t := *tc.fileTimes
+		header.ModTime = t
+		header.AccessTime = t
+		header.ChangeTime = t
+	}
+
+	// HACK: make the linux binary executable when cross compiling from windows as the unix permissions gets lost.
+	if runtime.GOOS == "windows" && fi.Name() == build.BinaryName {
+		header.Mode = 0755
+	}
+
+	header.Name = tarHeaderName(dstPath, fi.IsDir())
+	entry := &tarEntry{header: header}
+	tc.entries = append(tc.entries, entry)
+
+	if fi.IsDir() {
+		tc.seenDirs[dstPath] = true
+		return nil
+	}
+
+	// If this is not a symlink, write the file.
+	if (fi.Mode() & fs.ModeSymlink) != fs.ModeSymlink {
+		entry.hostPath = option.Some(srcPath)
+	}
+
+	return nil
+}
+
+func (tc *tarCopier) WriteFile(dstPath ImagePath, mode fs.FileMode, data []byte) (err error) {
+	header := &tar.Header{
+		Name:     tarHeaderName(dstPath, false),
+		Typeflag: tar.TypeReg,
+		Mode:     int64(mode.Perm()),
+		Size:     int64(len(data)),
+	}
+	if tc.fileTimes != nil {
+		t := *tc.fileTimes
+		header.ModTime = t
+		header.AccessTime = t
+		header.ChangeTime = t
+	}
+
+	tc.entries = append(tc.entries, &tarEntry{
+		header: header,
+		data:   option.Some(data),
+	})
+	return nil
+}
+
+type tarEntry struct {
+	header *tar.Header
+
+	data     option.Option[[]byte]
+	hostPath option.Option[HostPath]
+}
+
+func (tc *tarCopier) Opener() tarball.Opener {
+	errThunk := func(err error) tarball.Opener {
+		return func() (io.ReadCloser, error) {
+			return nil, err
+		}
+	}
+
+	var dvecs []tarstream.Datavec
+	for _, e := range tc.entries {
+
+		// create buffer to write tar header to
+		buf := new(bytes.Buffer)
+		tw := tar.NewWriter(buf)
+
+		// write tar header to buffer
+		if err := tw.WriteHeader(e.header); err != nil {
+			return errThunk(errors.Wrap(err, fmt.Sprintf("writing header %v", e)))
+		}
+
+		memv := tarstream.MemVec{
+			Data: buf.Bytes(),
+		}
+
+		// add the tar header mem buffer to the tarvec
+		dvecs = append(dvecs, memv)
+
+		var dataEntry tarstream.Datavec
+		if hostPath, ok := e.hostPath.Get(); ok {
+			fi := e.header.FileInfo()
+			dataEntry = &tarstream.PathVec{
+				Path: hostPath.String(),
+				Info: fi,
+			}
+		} else if data, ok := e.data.Get(); ok {
+			dataEntry = tarstream.MemVec{Data: data}
+		}
+
+		if dataEntry != nil {
+			// add the file path info to the tarvec
+			dvecs = append(dvecs, dataEntry)
+
+			// tar requires file entries to be padded out to 512 bytes.
+			if !e.header.FileInfo().IsDir() {
+				if size := dataEntry.GetSize(); size%512 != 0 {
+					padv := tarstream.PadVec{
+						Size: 512 - (size % 512),
+					}
+					dvecs = append(dvecs, padv)
+				}
+			}
+		}
+	}
+
+	tv := tarstream.NewTarVec(dvecs)
+	return func() (io.ReadCloser, error) {
+		tv2 := tv.Clone()
+		return tv2, nil
+	}
+}
+
+func tarHeaderName(p ImagePath, isDir bool) string {
+	name := strings.TrimPrefix(filepath.ToSlash(p.String()), "/")
+	if isDir {
+		name += "/"
+	}
+	return name
+}
diff --git a/pkg/editors/LICENSE b/pkg/editors/LICENSE
new file mode 100644
index 0000000000..fdec41da8e
--- /dev/null
+++ b/pkg/editors/LICENSE
@@ -0,0 +1,19 @@
+Original Copyright (c) GitHub, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/pkg/editors/doc.go b/pkg/editors/doc.go
new file mode 100644
index 0000000000..597ab467bc
--- /dev/null
+++ b/pkg/editors/doc.go
@@ -0,0 +1,4 @@
+// Package editors is a Go Port of [GitHub Desktop's editor code](https://github.com/desktop/desktop/tree/development/app/src/lib/editors)
+//
+// It was taken at this commit [a1ece18](https://github.com/desktop/desktop/tree/a1ece186bae3a742f206c5edeb0762e78fba2f7c/app/src/lib/editors)
+package editors
diff --git a/pkg/editors/encore_names.go b/pkg/editors/encore_names.go
new file mode 100644
index 0000000000..a98434b99f
--- /dev/null
+++ b/pkg/editors/encore_names.go
@@ -0,0 +1,66 @@
+package editors
+
+/*
+   This file was added by Encore and is not part of the original GitHub Desktop codebase
+*/
+
+// EditorName represents the name of an editor we display to a user
+//
+// This file contains the full list of editors we support
+type EditorName string
+
+const (
+	AndroidStudio       EditorName = "Android Studio"
+	AptanaStudio        EditorName = "Aptana Studio"
+	Atom                EditorName = "Atom"
+	AtomBeta            EditorName = "Atom (Beta)"
+	AtomNightly         EditorName = "Atom (Nightly)"
+	BBEdit              EditorName = "BBEdit"
+	Brackets            EditorName = "Brackets"
+	Code                EditorName = "Code"
+	CodeRunner          EditorName = "CodeRunner"
+	ColdFusionBuilder   EditorName = "ColdFusion Builder"
+	Emacs               EditorName = "Emacs"
+	Geany               EditorName = "Geany"
+	GEdit               EditorName = "GEdit"
+	GnomeBuilder        EditorName = "GNOME Builder"
+	GnomeTextEditor     EditorName = "GNOME Text Editor"
+	GVim                EditorName = "gVim"
+	JetbrainsCLion      EditorName = "CLion"
+	JetbrainsDataSpell  EditorName = "DataSpell"
+	JetbrainsFleet      EditorName = "Fleet"
+	JetbrainsGoLand     EditorName = "GoLand"
+	JetbrainsIntelliJ   EditorName = "IntelliJ"
+	JetbrainsIntelliJCE EditorName = "IntelliJ CE"
+	JetbrainsPhpStorm   EditorName = "PhpStorm"
+	JetbrainsPyCharm    EditorName = "PyCharm"
+	JetbrainsPyCharmCE  EditorName = "PyCharm CE"
+	JetbrainsRider      EditorName = "Rider"
+	JetbrainsRubyMine   EditorName = "RubyMine"
+	JetbrainsWebStorm   EditorName = "WebStorm"
+	Kate                EditorName = "Kate"
+	LiteXL              EditorName = "Lite XL"
+	MacVim              EditorName = "MacVim"
+	Mousepad            EditorName = "Mousepad"
+	Neovim              EditorName = "Neovim"
+	NeovimQt            EditorName = "Neovim-Qt"
+	Neovide             EditorName = "Neovide"
+	NotePadPlusPlus     EditorName = "Notepad++"
+	Notepadqq           EditorName = "Notepadqq"
+	Nova                EditorName = "Nova"
+	Pulsar              EditorName = "Pulsar"
+	RStudio             EditorName = "RStudio"
+	SlickEdit           EditorName = "SlickEdit"
+	Studio              EditorName = "Studio"
+	SublimeText         EditorName = "Sublime Text"
+	TextMate            EditorName = "TextMate"
+	Typora              EditorName = "Typora"
+	VimR                EditorName = "VimR"
+	VSCode              EditorName = "VSCode"
+	VSCodeInsiders      EditorName = "VSCode (Insiders)"
+	VSCodium            EditorName = "VSCodium"
+	VSCodiumInsiders    EditorName = "VSCodium (Insiders)"
+	XCode               EditorName = "XCode"
+	Zed                 EditorName = "Zed"
+	ZedPreview          EditorName = "Zed (Preview)"
+)
diff --git a/pkg/editors/encore_urls.go b/pkg/editors/encore_urls.go
new file mode 100644
index 0000000000..1f15d1e3c5
--- /dev/null
+++ b/pkg/editors/encore_urls.go
@@ -0,0 +1,79 @@
+package editors
+
+/*
+   This file was added by Encore and is not part of the original GitHub Desktop codebase
+*/
+
+import (
+	"fmt"
+	"net/url"
+)
+
+// convertFilePathToURLScheme converts a file path to a URL scheme that can be used to open to a specific
+// line and column number.
+//
+// If the returned string should be executed as a URL, true is returned as the second argument. If the returned string
+// should be executed as a normal argument against the editor, then false is returned
+//
+// If no URL scheme exists for that editor and empty string and false is returned.
+func convertFilePathToURLScheme(editorName EditorName, fullPath string, startLine int, startCol int) (openArg string, executeAsURL bool) {
+	switch editorName {
+	case VSCode, VSCodeInsiders:
+		if startLine > 0 {
+			fullPath = fmt.Sprintf("%s:%d", fullPath, startLine)
+		}
+		return toURLScheme("vscode", "file", fullPath, "", "", 0, 0), true
+	case JetbrainsGoLand:
+		return toJetBrainsScheme("goland", fullPath, startLine, startCol), true
+	case JetbrainsPhpStorm:
+		return toJetBrainsScheme("phpstorm", fullPath, startLine, startCol), true
+	case JetbrainsPyCharm, JetbrainsPyCharmCE:
+		return toJetBrainsScheme("pycharm", fullPath, startLine, startCol), true
+	case JetbrainsRubyMine:
+		return toJetBrainsScheme("rubymine", fullPath, startLine, startCol), true
+	case JetbrainsWebStorm:
+		return toJetBrainsScheme("webstorm", fullPath, startLine, startCol), true
+	case JetbrainsIntelliJ, JetbrainsIntelliJCE:
+		return toJetBrainsScheme("idea", fullPath, startLine, startCol), true
+	case JetbrainsCLion:
+		return toJetBrainsScheme("clion", fullPath, startLine, startCol), true
+	case TextMate:
+		return toOpenURLScheme("txmt", "", fullPath, startLine, startCol), true
+	case BBEdit:
+		return toOpenURLScheme("bbedit", "", fullPath, startLine, startCol), true
+	default:
+		return "", false
+	}
+}
+
+func toJetBrainsScheme(scheme string, file string, line int, col int) string {
+	return toURLScheme(scheme, "open", "", "file", file, line, col)
+}
+
+func toOpenURLScheme(scheme string, basePath string, file string, line int, col int) string {
+	return toURLScheme(scheme, "open", basePath, "url", fmt.Sprintf("file://%s", file), line, col)
+}
+
+func toURLScheme(scheme string, host string, basePath string, fileKey string, file string, line int, col int) string {
+	u := &url.URL{
+		Scheme: scheme,
+		Host:   host,
+		Path:   basePath,
+	}
+
+	q := u.Query()
+	if fileKey != "" && file != "" {
+		q.Set(fileKey, file)
+	}
+	if line > 0 {
+		q.Set("line", fmt.Sprintf("%d", line))
+
+		if col > 0 {
+			q.Set("col", fmt.Sprintf("%d", col))
+		}
+	}
+
+	u.RawQuery = q.Encode()
+
+	return u.String()
+}
diff --git a/pkg/editors/launch.go b/pkg/editors/launch.go
new file mode 100644
index 0000000000..e6195f46df
--- /dev/null
+++ b/pkg/editors/launch.go
@@ -0,0 +1,66 @@
+package editors
+
+import (
+	"io/fs"
+	"os"
+	"os/exec"
+	"runtime"
+
+	"github.com/cockroachdb/errors"
+	"github.com/pkg/browser"
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/pkg/xos"
+)
+
+// LaunchExternalEditor opens a given file or folder in the desired external editor.
+func LaunchExternalEditor(fullPath string, startLine int, startCol int, editor FoundEditor) error {
+	_, err := os.Stat(editor.Path)
+	if errors.Is(err, fs.ErrNotExist) {
+		return errors.Wrapf(err, "editor %s not found", editor.Editor)
+	}
+
+	// Encore patch to allow opening to a specific line and column in the file
+	// if supported by the IDE
+	toExecute, executeAsURL := convertFilePathToURLScheme(editor.Editor, fullPath, startLine, startCol)
+	if executeAsURL {
+		log.Info().Str("full_path", fullPath).Str("editor", string(editor.Editor)).Str("url", toExecute).Msg("attempting to open file via URL")
+		if err := browser.OpenURL(toExecute); err == nil {
+			return nil
+		} else {
+			log.Warn().Err(err).Str("url", toExecute).Msg("failed to open URL, falling back to file appraoch")
+			// If the URL scheme failed to open, then we'll just open the file normally
+			toExecute = fullPath
+		}
+	} else if toExecute == "" {
+		toExecute = fullPath
+	}
+
+	var cmd *exec.Cmd
+
+	//goland:noinspection GoBoolExpressions
+	if editor.UsesShell {
+		if runtime.GOOS == "windows" {
+			// nosemgrep
+			cmd = exec.Command("cmd.exe", "/c", editor.Path, toExecute)
+		} else {
+			// nosemgrep
+			cmd = exec.Command("sh", "-c", editor.Path+" "+toExecute)
+		}
+	} else if runtime.GOOS == "darwin" {
+		// nosemgrep
+		cmd = exec.Command("open", "-a", editor.Path, toExecute)
+	} else {
+		// nosemgrep
+		cmd = exec.Command(editor.Path, toExecute)
+	}
+
+	// Make sure the editor processes are detached from the Encore daemon.
+	// Otherwise, some editors (like Notepad++) will be killed when the
+	// Encore daemon shutsdown.
+	cmd.SysProcAttr = xos.CreateNewProcessGroup()
+
+	log.Info().Str("full_path", fullPath).Str("editor", string(editor.Editor)).Str("cmd", cmd.String()).Msg("attempting to open file")
+
+	return errors.Wrap(cmd.Start(), "failed to start editor")
+}
diff --git a/pkg/editors/lookup.go b/pkg/editors/lookup.go
new file mode 100644
index 0000000000..36c4a3890e
--- /dev/null
+++ b/pkg/editors/lookup.go
@@ -0,0 +1,66 @@
+package editors
+
+import (
+	"context"
+	goerrors "errors"
+	"sort"
+
+	"github.com/cockroachdb/errors"
+	"go4.org/syncutil"
+)
+
+// FoundEditor is a found external editor on the user's machine
+type FoundEditor struct {
+	// The friendly name of the editor, to be used in labels
+	Editor EditorName `json:"editor"`
+	// The executable associated with the editor to launch
+	Path string `json:"path"`
+	// The editor requires a shell to spawn
+	UsesShell bool `json:"usesShell,omitempty"`
+}
+
+var (
+	editorCacheOnce syncutil.Once
+	// editorCache is a cache of the available editors on the user's machine
+	editorCache []FoundEditor
+
+	// ErrEditorNotFound is returned when an editor is not found when called from
+	// the Find function
+	ErrEditorNotFound = goerrors.New("editor not found")
+)
+
+// Resolve a list of installed editors on the user's machine, using the known
+// install identifiers that each OS supports.
+func Resolve(ctx context.Context) ([]FoundEditor, error) {
+	err := editorCacheOnce.Do(func() error {
+		var err error
+		editorCache, err = getAvailableEditors(ctx)
+		if err != nil {
+			return errors.Wrap(err, "unable to get available editors")
+		}
+
+		sort.Slice(editorCache, func(i, j int) bool {
+			return editorCache[i].Editor < editorCache[j].Editor
+		})
+		return nil
+	})
+
+	return editorCache, err
+}
+
+// Find searches to an editor by name, returning the editor if found, or
+// [ErrEditorNotFound] if not found
+func Find(ctx context.Context, name EditorName) (FoundEditor, error) {
+	editors, err := Resolve(ctx)
+	if err != nil {
+		return FoundEditor{}, err
+	}
+
+	for _, editor := range editors {
+		if editor.Editor == name {
+			return editor, nil
+		}
+	}
+
+	return FoundEditor{}, errors.WithStack(ErrEditorNotFound)
+}
diff --git a/pkg/editors/lookup_darwin.go b/pkg/editors/lookup_darwin.go
new file mode 100644
index 0000000000..bb9688d726
--- /dev/null
+++ b/pkg/editors/lookup_darwin.go
@@ -0,0 +1,251 @@
+//go:build darwin
+
+package editors
+
+import (
+	"bytes"
+	"context"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+	"golang.org/x/sync/errgroup"
+	exec "golang.org/x/sys/execabs"
+)
+
+// DarwinExternalEditor represents an external editor on macOS
+type DarwinExternalEditor struct {
+	// Name of the editor. It will be used both as identifier and user-facing.
+	Name EditorName
+
+	// List of bundle identifiers that are used by the app in its multiple versions.
+	BundleIdentifiers []string
+}
+
+// This list contains all the external editors supported on macOS. Add a new
+// entry here to add support for your favorite editor.
+var editors = []DarwinExternalEditor{
+	{
+		Name:              Atom,
+		BundleIdentifiers: []string{"com.github.atom"},
+	},
+	{
+		Name:              AptanaStudio,
+		BundleIdentifiers: []string{"aptana.studio"},
+	},
+	{
+		Name:              MacVim,
+		BundleIdentifiers: []string{"org.vim.MacVim"},
+	},
+	{
+		Name:              Neovide,
+		BundleIdentifiers: []string{"com.neovide.neovide"},
+	},
+	{
+		Name:              VimR,
+		BundleIdentifiers: []string{"com.qvacua.VimR"},
+	},
+	{
+		Name:              VSCode,
+		BundleIdentifiers: []string{"com.microsoft.VSCode"},
+	},
+	{
+		Name:              VSCodeInsiders,
+		BundleIdentifiers: []string{"com.microsoft.VSCodeInsiders"},
+	},
+	{
+		Name:              VSCodium,
+		BundleIdentifiers: []string{"com.visualstudio.code.oss", "com.vscodium"},
+	},
+	{
+		Name: SublimeText,
+		BundleIdentifiers: []string{
+			"com.sublimetext.4",
+			"com.sublimetext.3",
+			"com.sublimetext.2",
+		},
+	},
+	{
+		Name:              BBEdit,
+		BundleIdentifiers: []string{"com.barebones.bbedit"},
+	},
+	{
+		Name:              JetbrainsPhpStorm,
+		BundleIdentifiers: []string{"com.jetbrains.PhpStorm"},
+	},
+	{
+		Name:              JetbrainsPyCharm,
+		BundleIdentifiers: []string{"com.jetbrains.PyCharm"},
+	},
+	{
+		Name:              JetbrainsPyCharmCE,
+		BundleIdentifiers: []string{"com.jetbrains.pycharm.ce"},
+	},
+	{
+		Name:              JetbrainsDataSpell,
+		BundleIdentifiers: []string{"com.jetbrains.DataSpell"},
+	},
+	{
+		Name:              JetbrainsRubyMine,
+		BundleIdentifiers: []string{"com.jetbrains.RubyMine"},
+	},
+	{
+		Name:              RStudio,
+		BundleIdentifiers: []string{"org.rstudio.RStudio", "com.rstudio.desktop"},
+	},
+	{
+		Name:              TextMate,
+		BundleIdentifiers: []string{"com.macromates.TextMate"},
+	},
+	{
+		Name:              Brackets,
+		BundleIdentifiers: []string{"io.brackets.appshell"},
+	},
+	{
+		Name:              JetbrainsWebStorm,
+		BundleIdentifiers: []string{"com.jetbrains.WebStorm"},
+	},
+	{
+		Name:              JetbrainsCLion,
+		BundleIdentifiers: []string{"com.jetbrains.CLion"},
+	},
+	{
+		Name:              Typora,
+		BundleIdentifiers: []string{"abnerworks.Typora"},
+	},
+	{
+		Name:              CodeRunner,
+		BundleIdentifiers: []string{"com.krill.CodeRunner"},
+	},
+	{
+		Name: SlickEdit,
+		BundleIdentifiers: []string{
+			"com.slickedit.SlickEditPro2018",
+			"com.slickedit.SlickEditPro2017",
+			"com.slickedit.SlickEditPro2016",
+			"com.slickedit.SlickEditPro2015",
+		},
+	},
+	{
+		Name:              JetbrainsIntelliJ,
+		BundleIdentifiers: []string{"com.jetbrains.intellij"},
+	},
+	{
+		Name:              JetbrainsIntelliJCE,
+		BundleIdentifiers: []string{"com.jetbrains.intellij.ce"},
+	},
+	{
+		Name:              XCode,
+		BundleIdentifiers: []string{"com.apple.dt.Xcode"},
+	},
+	{
+		Name:              JetbrainsGoLand,
+		BundleIdentifiers: []string{"com.jetbrains.goland"},
+	},
+	{
+		Name:              AndroidStudio,
+		BundleIdentifiers: []string{"com.google.android.studio"},
+	},
+	{
+		Name:              JetbrainsRider,
+		BundleIdentifiers: []string{"com.jetbrains.rider"},
+	},
+	{
+		Name:              Nova,
+		BundleIdentifiers: []string{"com.panic.Nova"},
+	},
+	{
+		Name:              Emacs,
+		BundleIdentifiers: []string{"org.gnu.Emacs"},
+	},
+	{
+		Name:              LiteXL,
+		BundleIdentifiers: []string{"com.lite-xl"},
+	},
+	{
+		Name:              JetbrainsFleet,
+		BundleIdentifiers: []string{"Fleet.app"},
+	},
+	{
+		Name:              Pulsar,
+		BundleIdentifiers: []string{"dev.pulsar-edit.pulsar"},
+	},
+	{
+		Name:              Zed,
+		BundleIdentifiers: []string{"dev.zed.Zed"},
+	},
+	{
+		Name:              ZedPreview,
+		BundleIdentifiers: []string{"dev.zed.Zed-Preview"},
+	},
+}
+
+func findApplication(ctx context.Context, editor DarwinExternalEditor, foundEditors chan FoundEditor) error {
+	for _, bundleIdentifier := range editor.BundleIdentifiers {
+		path, err := getAppLocationByBundleID(ctx, bundleIdentifier)
+
+		switch {
+		case err != nil:
+			return errors.WithStack(err)
+
+		case path != "":
+			foundEditors <- FoundEditor{
+				Editor: editor.Name,
+				Path:   path,
+			}
+		}
+	}
+
+	return nil
+}
+
+// getAppLocationByBundleID returns the location of the app with the given bundle identifier.
+func getAppLocationByBundleID(ctx context.Context, bundleID string) (string, error) {
+	cmd := exec.CommandContext(ctx, "mdfind", "kMDItemCFBundleIdentifier == '"+bundleID+"'")
+	var out bytes.Buffer
+	cmd.Stdout = &out
+
+	err := cmd.Run()
+	if err != nil {
+		return "", err
+	}
+
+	// mdfind can return multiple results, so we'll just take the first one.
+	results := strings.Split(out.String(), "\n")
+	if len(results) > 0 {
+		return results[0], nil
+	}
+
+	return "", nil
+}
+
+// Resolve a list of installed editors on the user's machine, using the known
+// install identifiers that each OS supports.
+func getAvailableEditors(ctx context.Context) ([]FoundEditor, error) {
+	results := make([]FoundEditor, 0)
+
+	grp, ctx := errgroup.WithContext(ctx)
+
+	foundEditors := make(chan FoundEditor)
+	errs := make(chan error, 1)
+	for _, editor := range editors {
+		editor := editor
+		grp.Go(func() error {
+			return findApplication(ctx, editor, foundEditors)
+		})
+	}
+
+	go func() {
+		errs <- grp.Wait()
+		close(foundEditors)
+	}()
+
+	// Collect results and the error from the group
+	for editor := range foundEditors {
+		results = append(results, editor)
+	}
+	if err := <-errs; err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	return results, nil
+}
diff --git a/pkg/editors/lookup_linux.go b/pkg/editors/lookup_linux.go
new file mode 100644
index 0000000000..cbd1fc359a
--- /dev/null
+++ b/pkg/editors/lookup_linux.go
@@ -0,0 +1,182 @@
+//go:build linux
+
+package editors
+
+import (
+	"context"
+)
+
+// LinuxExternalEditor represents an external editor on Linux
+type LinuxExternalEditor struct {
+	// Name of the editor. It will be used both as identifier and user-facing.
+	Name EditorName
+
+	// List of possible paths where the editor's executable might be located.
+	Paths []string
+}
+
+// This list contains all the external editors supported on Linux. Add a new
+// entry here to add support for your favorite editor.
+var editors = []LinuxExternalEditor{
+	{
+		Name:  Atom,
+		Paths: []string{"/snap/bin/atom", "/usr/bin/atom"},
+	},
+	{
+		Name:  Neovim,
+		Paths: []string{"/usr/bin/nvim"},
+	},
+	{
+		Name:  NeovimQt,
+		Paths: []string{"/usr/bin/nvim-qt"},
+	},
+	{
+		Name:  Neovide,
+		Paths: []string{"/usr/bin/neovide"},
+	},
+	{
+		Name:  GVim,
+		Paths: []string{"/usr/bin/gvim"},
+	},
+	{
+		Name: VSCode,
+		Paths: []string{
+			"/usr/share/code/bin/code",
+			"/snap/bin/code",
+			"/usr/bin/code",
+			"/mnt/c/Program Files/Microsoft VS Code/bin/code",
+		},
+	},
+	{
+		Name:  VSCodeInsiders,
+		Paths: []string{"/snap/bin/code-insiders", "/usr/bin/code-insiders"},
+	},
+	{
+		Name: VSCodium,
+		Paths: []string{
+			"/usr/bin/codium",
+			"/var/lib/flatpak/app/com.vscodium.codium",
+			"/usr/share/vscodium-bin/bin/codium",
+		},
+	},
+	{
+		Name:  SublimeText,
+		Paths: []string{"/usr/bin/subl"},
+	},
+	{
+		Name:  Typora,
+		Paths: []string{"/usr/bin/typora"},
+	},
+	{
+		Name: SlickEdit,
+		Paths: []string{
+			"/opt/slickedit-pro2018/bin/vs",
+			"/opt/slickedit-pro2017/bin/vs",
+			"/opt/slickedit-pro2016/bin/vs",
+			"/opt/slickedit-pro2015/bin/vs",
+		},
+	},
+	{
+		// Code editor for elementary OS
+		// https://github.com/elementary/code
+		Name:  Code,
+		Paths: []string{"/usr/bin/io.elementary.code"},
+	},
+	{
+		Name:  LiteXL,
+		Paths: []string{"/usr/bin/lite-xl"},
+	},
+	{
+		Name: JetbrainsPhpStorm,
+		Paths: []string{
+			"/snap/bin/phpstorm",
+			".local/share/JetBrains/Toolbox/scripts/phpstorm",
+		},
+	},
+	{
+		Name: JetbrainsGoLand,
+		Paths: []string{
+			"/snap/bin/goland",
+			".local/share/JetBrains/Toolbox/scripts/goland",
+		},
+	},
+	{
+		Name: JetbrainsWebStorm,
+		Paths: []string{
+			"/snap/bin/webstorm",
+			".local/share/JetBrains/Toolbox/scripts/webstorm",
+		},
+	},
+	{
+		Name:  JetbrainsIntelliJ,
+		Paths: []string{"/snap/bin/idea", ".local/share/JetBrains/Toolbox/scripts/idea"},
+	},
+	{
+		Name: JetbrainsPyCharm,
+		Paths: []string{
+			"/snap/bin/pycharm",
+			".local/share/JetBrains/Toolbox/scripts/pycharm",
+		},
+	},
+	{
+		Name: Studio,
+		Paths: []string{
+			"/snap/bin/studio",
+			".local/share/JetBrains/Toolbox/scripts/studio",
+		},
+	},
+	{
+		Name:  Emacs,
+		Paths: []string{"/snap/bin/emacs", "/usr/local/bin/emacs", "/usr/bin/emacs"},
+	},
+	{
+		Name:  Kate,
+		Paths: []string{"/usr/bin/kate"},
+	},
+	{
+		Name:  GEdit,
+		Paths: []string{"/usr/bin/gedit"},
+	},
+	{
+		Name:  GnomeTextEditor,
+		Paths: []string{"/usr/bin/gnome-text-editor"},
+	},
+	{
+		Name:  GnomeBuilder,
+		Paths: []string{"/usr/bin/gnome-builder"},
+	},
+	{
+		Name:  Notepadqq,
+		Paths: []string{"/usr/bin/notepadqq"},
+	},
+	{
+		Name:  Geany,
+		Paths: []string{"/usr/bin/geany"},
+	},
+	{
+		Name:  Mousepad,
+		Paths: []string{"/usr/bin/mousepad"},
+	},
+}
+
+// Returns the first available path from the provided list.
+func getAvailablePath(paths []string) string {
+	for _, path := range paths {
+		if pathExists(path) {
+			return path
+		}
+	}
+	return ""
+}
+
+// Returns a list of available editors with their paths.
+func getAvailableEditors(_ context.Context) ([]FoundEditor, error) {
+	var results []FoundEditor
+	for _, editor := range editors {
+		path := getAvailablePath(editor.Paths) // Assuming the editor struct has a Paths field
+		if path != "" {
+			results = append(results, FoundEditor{Editor: editor.Name, Path: path})
+		}
+	}
+	return results, nil
+}
diff --git a/pkg/editors/lookup_test.go b/pkg/editors/lookup_test.go
new file mode 100644
index 0000000000..60e6730de2
--- /dev/null
+++ b/pkg/editors/lookup_test.go
@@ -0,0 +1,17 @@
+package editors
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+)
+
+func TestResolve(t *testing.T) {
+	c := qt.New(t)
+
+	editors, err := Resolve(context.Background())
+	c.Assert(err, qt.IsNil)
+	fmt.Printf("Found editors:\n%+v\n", editors)
+}
diff --git a/pkg/editors/lookup_unsupported.go b/pkg/editors/lookup_unsupported.go
new file mode 100644
index 0000000000..2bcd03457d
--- /dev/null
+++ b/pkg/editors/lookup_unsupported.go
@@ -0,0 +1,12 @@
+//go:build !darwin && !linux && !windows
+
+package editors
+
+import (
+	"context"
+)
+
+// Returns no editors as we don't know how to find them on this platform.
+func getAvailableEditors(ctx context.Context) ([]FoundEditor, error) {
+	return []FoundEditor{}, nil
+}
diff --git a/pkg/editors/lookup_windows.go b/pkg/editors/lookup_windows.go
new file mode 100644
index 0000000000..fa0bc2de1c
--- /dev/null
+++ b/pkg/editors/lookup_windows.go
@@ -0,0 +1,611 @@
+//go:build windows
+
+package editors
+
+import (
+	"context"
+	"fmt"
+	"path"
+	"path/filepath"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog/log"
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/sys/windows/registry"
+
+	"encr.dev/pkg/fns"
+)
+
+type WindowsExternalEditor struct {
+	Name                       EditorName
+	RegistryKeys               []RegistryKey
+	DisplayNamePrefixes        []string
+	Publishers                 []string
+	JetBrainsToolboxScriptName string
+	InstallLocationRegistryKey string
+	ExecutableShimPaths        []string
+}
+
+type RegistryKey struct {
+	Key    registry.Key
+	SubKey string
+}
+
+type RegistryValue struct {
+	Name        string
+	Type        uint32
+	StringValue string
+}
+
+var editors = []WindowsExternalEditor{
+	{
+		Name:                Atom,
+		RegistryKeys:        []RegistryKey{CurrentUserUninstallKey("atom")},
+		ExecutableShimPaths: []string{"bin/atom.cmd"},
+		DisplayNamePrefixes: []string{"Atom"},
+		Publishers:          []string{"GitHub Inc."},
+	},
+	{
+		Name:                AtomBeta,
+		RegistryKeys:        []RegistryKey{CurrentUserUninstallKey("atom-beta")},
+		ExecutableShimPaths: []string{"bin/atom-beta.cmd"},
+		DisplayNamePrefixes: []string{"Atom Beta"},
+		Publishers:          []string{"GitHub Inc."},
+	},
+	{
+		Name:                AtomNightly,
+		RegistryKeys:        []RegistryKey{CurrentUserUninstallKey("atom-nightly")},
+		ExecutableShimPaths: []string{"bin/atom-nightly.cmd"},
+		DisplayNamePrefixes: []string{"Atom Nightly"},
+		Publishers:          []string{"GitHub Inc."},
+	},
+	{
+		Name: VSCode,
+		RegistryKeys: []RegistryKey{
+			// 64-bit version of VSCode (user) - provided by default in 64-bit Windows
+			CurrentUserUninstallKey("{771FD6B0-FA20-440A-A002-3B3BAC16DC50}_is1"),
+			// 32-bit version of VSCode (user)
+			CurrentUserUninstallKey("{D628A17A-9713-46BF-8D57-E671B46A741E}_is1"),
+			// ARM64 version of VSCode (user)
+			CurrentUserUninstallKey("{D9E514E7-1A56-452D-9337-2990C0DC4310}_is1"),
+			// 64-bit version of VSCode (system) - was default before user scope installation
+			LocalMachineUninstallKey("{EA457B21-F73E-494C-ACAB-524FDE069978}_is1"),
+			// 32-bit version of VSCode (system)
+			Wow64LocalMachineUninstallKey("{F8A2A208-72B3-4D61-95FC-8A65D340689B}_is1"),
+			// ARM64 version of VSCode (system)
+			LocalMachineUninstallKey("{A5270FC5-65AD-483E-AC30-2C276B63D0AC}_is1"),
+		},
+		ExecutableShimPaths: []string{"bin/code.cmd"},
+		DisplayNamePrefixes: []string{"Microsoft Visual Studio Code"},
+		Publishers:          []string{"Microsoft Corporation"},
+	},
+	{
+		Name: VSCodeInsiders,
+		RegistryKeys: []RegistryKey{
+			// 64-bit version of VSCode (user) - provided by default in 64-bit Windows
+			CurrentUserUninstallKey("{217B4C08-948D-4276-BFBB-BEE930AE5A2C}_is1"),
+			// 32-bit version of VSCode (user)
+			CurrentUserUninstallKey("{26F4A15E-E392-4887-8C09-7BC55712FD5B}_is1"),
+			// ARM64 version of VSCode (user)
+			CurrentUserUninstallKey("{69BD8F7B-65EB-4C6F-A14E-44CFA83712C0}_is1"),
+			// 64-bit version of VSCode (system) - was default before user scope installation
+			LocalMachineUninstallKey("{1287CAD5-7C8D-410D-88B9-0D1EE4A83FF2}_is1"),
+			// 32-bit version of VSCode (system)
+			Wow64LocalMachineUninstallKey("{C26E74D1-022E-4238-8B9D-1E7564A36CC9}_is1"),
+			// ARM64 version of VSCode (system)
+			LocalMachineUninstallKey("{0AEDB616-9614-463B-97D7-119DD86CCA64}_is1"),
+		},
+		ExecutableShimPaths: []string{"bin/code-insiders.cmd"},
+		DisplayNamePrefixes: []string{"Microsoft Visual Studio Code Insiders"},
+		Publishers:          []string{"Microsoft Corporation"},
+	},
+	{
+		Name: VSCodium,
+		RegistryKeys: []RegistryKey{
+			// 64-bit version of VSCodium (user)
+			CurrentUserUninstallKey("{2E1F05D1-C245-4562-81EE-28188DB6FD17}_is1"),
+			// 32-bit version of VSCodium (user) - new key
+			CurrentUserUninstallKey("{0FD05EB4-651E-4E78-A062-515204B47A3A}_is1"),
+			// ARM64 version of VSCodium (user) - new key
+			CurrentUserUninstallKey("{57FD70A5-1B8D-4875-9F40-C5553F094828}_is1"),
+			// 64-bit version of VSCodium (system) - new key
+			LocalMachineUninstallKey("{88DA3577-054F-4CA1-8122-7D820494CFFB}_is1"),
+			// 32-bit version of VSCodium (system) - new key
+			Wow64LocalMachineUninstallKey("{763CBF88-25C6-4B10-952F-326AE657F16B}_is1"),
+			// ARM64 version of VSCodium (system) - new key
+			LocalMachineUninstallKey("{67DEE444-3D04-4258-B92A-BC1F0FF2CAE4}_is1"),
+			// 32-bit version of VSCodium (user) - old key
+			CurrentUserUninstallKey("{C6065F05-9603-4FC4-8101-B9781A25D88E}}_is1"),
+			// ARM64 version of VSCodium (user) - old key
+			CurrentUserUninstallKey("{3AEBF0C8-F733-4AD4-BADE-FDB816D53D7B}_is1"),
+			// 64-bit version of VSCodium (system) - old key
+			LocalMachineUninstallKey("{D77B7E06-80BA-4137-BCF4-654B95CCEBC5}_is1"),
+			// 32-bit version of VSCodium (system) - old key
+			Wow64LocalMachineUninstallKey("{E34003BB-9E10-4501-8C11-BE3FAA83F23F}_is1"),
+			// ARM64 version of VSCodium (system) - old key
+			LocalMachineUninstallKey("{D1ACE434-89C5-48D1-88D3-E2991DF85475}_is1"),
+		},
+		ExecutableShimPaths: []string{"bin/codium.cmd"},
+		DisplayNamePrefixes: []string{"VSCodium"},
+		Publishers:          []string{"VSCodium", "Microsoft Corporation"},
+	},
+	{
+		Name: VSCodiumInsiders,
+		RegistryKeys: []RegistryKey{
+			// 64-bit version of VSCodium - Insiders (user)
+			CurrentUserUninstallKey("{20F79D0D-A9AC-4220-9A81-CE675FFB6B41}_is1"),
+			// 32-bit version of VSCodium - Insiders (user)
+			CurrentUserUninstallKey("{ED2E5618-3E7E-4888-BF3C-A6CCC84F586F}_is1"),
+			// ARM64 version of VSCodium - Insiders (user)
+			CurrentUserUninstallKey("{2E362F92-14EA-455A-9ABD-3E656BBBFE71}_is1"),
+			// 64-bit version of VSCodium - Insiders (system)
+			LocalMachineUninstallKey("{B2E0DDB2-120E-4D34-9F7E-8C688FF839A2}_is1"),
+			// 32-bit version of VSCodium - Insiders (system)
+			Wow64LocalMachineUninstallKey("{EF35BB36-FA7E-4BB9-B7DA-D1E09F2DA9C9}_is1"),
+			// ARM64 version of VSCodium - Insiders (system)
+			LocalMachineUninstallKey("{44721278-64C6-4513-BC45-D48E07830599}_is1"),
+		},
+		ExecutableShimPaths: []string{"bin/codium-insiders.cmd"},
+		DisplayNamePrefixes: []string{"VSCodium Insiders", "VSCodium (Insiders)"},
+		Publishers:          []string{"VSCodium"},
+	},
+	{
+		Name: SublimeText,
+		RegistryKeys: []RegistryKey{
+			// Sublime Text 4 (and newer?)
+			LocalMachineUninstallKey("Sublime Text_is1"),
+			// Sublime Text 3
+			LocalMachineUninstallKey("Sublime Text 3_is1"),
+		},
+		ExecutableShimPaths: []string{"subl.exe"},
+		DisplayNamePrefixes: []string{"Sublime Text"},
+		Publishers:          []string{"Sublime HQ Pty Ltd"},
+	},
+	{
+		Name: Brackets,
+		RegistryKeys: []RegistryKey{
+			Wow64LocalMachineUninstallKey("{4F3B6E8C-401B-4EDE-A423-6481C239D6FF}"),
+		},
+		ExecutableShimPaths: []string{"Brackets.exe"},
+		DisplayNamePrefixes: []string{"Brackets"},
+		Publishers:          []string{"brackets.io"},
+	},
+	{
+		Name: ColdFusionBuilder,
+		RegistryKeys: []RegistryKey{
+			// 64-bit version of ColdFusionBuilder3
+			LocalMachineUninstallKey("Adobe ColdFusion Builder 3_is1"),
+			// 64-bit version of ColdFusionBuilder2016
+			LocalMachineUninstallKey("Adobe ColdFusion Builder 2016"),
+		},
+		ExecutableShimPaths: []string{"CFBuilder.exe"},
+		DisplayNamePrefixes: []string{"Adobe ColdFusion Builder"},
+		Publishers:          []string{"Adobe Systems Incorporated"},
+	},
+	{
+		Name: Typora,
+		RegistryKeys: []RegistryKey{
+			// 64-bit version of Typora
+			LocalMachineUninstallKey("{37771A20-7167-44C0-B322-FD3E54C56156}_is1"),
+			// 32-bit version of Typora
+			Wow64LocalMachineUninstallKey("{37771A20-7167-44C0-B322-FD3E54C56156}_is1"),
+		},
+		ExecutableShimPaths: []string{"typora.exe"},
+		DisplayNamePrefixes: []string{"Typora"},
+		Publishers:          []string{"typora.io"},
+	},
+	{
+		Name: SlickEdit,
+		RegistryKeys: []RegistryKey{
+			// 64-bit version of SlickEdit Pro 2018
+			LocalMachineUninstallKey("{18406187-F49E-4822-CAF2-1D25C0C83BA2}"),
+			// 32-bit version of SlickEdit Pro 2018
+			Wow64LocalMachineUninstallKey("{18006187-F49E-4822-CAF2-1D25C0C83BA2}"),
+			// 64-bit version of SlickEdit Standard 2018
+			LocalMachineUninstallKey("{18606187-F49E-4822-CAF2-1D25C0C83BA2}"),
+			// 32-bit version of SlickEdit Standard 2018
+			Wow64LocalMachineUninstallKey("{18206187-F49E-4822-CAF2-1D25C0C83BA2}"),
+			// 64-bit version of SlickEdit Pro 2017
+			LocalMachineUninstallKey("{15406187-F49E-4822-CAF2-1D25C0C83BA2}"),
+			// 32-bit version of SlickEdit Pro 2017
+			Wow64LocalMachineUninstallKey("{15006187-F49E-4822-CAF2-1D25C0C83BA2}"),
+			// 64-bit version of SlickEdit Pro 2016 (21.0.1)
+			LocalMachineUninstallKey("{10C06187-F49E-4822-CAF2-1D25C0C83BA2}"),
+			// 64-bit version of SlickEdit Pro 2016 (21.0.0)
+			LocalMachineUninstallKey("{10406187-F49E-4822-CAF2-1D25C0C83BA2}"),
+			// 64-bit version of SlickEdit Pro 2015 (20.0.3)
+			LocalMachineUninstallKey("{0DC06187-F49E-4822-CAF2-1D25C0C83BA2}"),
+			// 64-bit version of SlickEdit Pro 2015 (20.0.2)
+			LocalMachineUninstallKey("{0D406187-F49E-4822-CAF2-1D25C0C83BA2}"),
+			// 64-bit version of SlickEdit Pro 2014 (19.0.2)
+			LocalMachineUninstallKey("{7CC0E567-ACD6-41E8-95DA-154CEEDB0A18}"),
+		},
+		ExecutableShimPaths: []string{"win/vs.exe"},
+		DisplayNamePrefixes: []string{"SlickEdit"},
+		Publishers:          []string{"SlickEdit Inc."},
+	},
+	{
+		Name: AptanaStudio,
+		RegistryKeys: []RegistryKey{
+			Wow64LocalMachineUninstallKey("{2D6C1116-78C6-469C-9923-3E549218773F}"),
+		},
+		ExecutableShimPaths: []string{"AptanaStudio3.exe"},
+		DisplayNamePrefixes: []string{"Aptana Studio"},
+		Publishers:          []string{"Appcelerator"},
+	},
+	{
+		Name:                       JetbrainsWebStorm,
+		RegistryKeys:               registryKeysForJetBrainsIDE("WebStorm"),
+		ExecutableShimPaths:        executableShimPathsForJetBrainsIDE("webstorm"),
+		JetBrainsToolboxScriptName: "webstorm",
+		DisplayNamePrefixes:        []string{"WebStorm"},
+		Publishers:                 []string{"JetBrains s.r.o."},
+	},
+	{
+		Name:                       JetbrainsPhpStorm,
+		RegistryKeys:               registryKeysForJetBrainsIDE("PhpStorm"),
+		ExecutableShimPaths:        executableShimPathsForJetBrainsIDE("phpstorm"),
+		JetBrainsToolboxScriptName: "phpstorm",
+		DisplayNamePrefixes:        []string{"PhpStorm"},
+		Publishers:                 []string{"JetBrains s.r.o."},
+	},
+	{
+		Name:                       AndroidStudio,
+		RegistryKeys:               []RegistryKey{LocalMachineUninstallKey("Android Studio")},
+		InstallLocationRegistryKey: "UninstallString",
+		JetBrainsToolboxScriptName: "studio",
+		ExecutableShimPaths: []string{
+			"../bin/studio64.exe",
+			"../bin/studio.exe",
+		},
+		DisplayNamePrefixes: []string{"Android Studio"},
+		Publishers:          []string{"Google LLC"},
+	},
+	{
+		Name: NotePadPlusPlus,
+		RegistryKeys: []RegistryKey{
+			// 64-bit version of Notepad++
+			LocalMachineUninstallKey("Notepad++"),
+			// 32-bit version of Notepad++
+			Wow64LocalMachineUninstallKey("Notepad++"),
+		},
+		InstallLocationRegistryKey: "DisplayIcon",
+		DisplayNamePrefixes:        []string{"Notepad++"},
+		Publishers:                 []string{"Notepad++ Team"},
+	},
+	{
+		Name:                       JetbrainsRider,
+		RegistryKeys:               registryKeysForJetBrainsIDE("JetBrains Rider"),
+		ExecutableShimPaths:        executableShimPathsForJetBrainsIDE("rider"),
+		JetBrainsToolboxScriptName: "rider",
+		DisplayNamePrefixes:        []string{"JetBrains Rider"},
+		Publishers:                 []string{"JetBrains s.r.o."},
+	},
+	{
+		Name:                       RStudio,
+		RegistryKeys:               []RegistryKey{Wow64LocalMachineUninstallKey("RStudio")},
+		InstallLocationRegistryKey: "DisplayIcon",
+		DisplayNamePrefixes:        []string{"RStudio"},
+		Publishers:                 []string{"RStudio", "Posit Software"},
+	},
+	{
+		Name:                       JetbrainsIntelliJ,
+		RegistryKeys:               registryKeysForJetBrainsIDE("IntelliJ IDEA"),
+		ExecutableShimPaths:        executableShimPathsForJetBrainsIDE("idea"),
+		JetBrainsToolboxScriptName: "idea",
+		DisplayNamePrefixes:        []string{"IntelliJ IDEA "},
+		Publishers:                 []string{"JetBrains s.r.o."},
+	},
+	{
+		Name:                JetbrainsIntelliJCE,
+		RegistryKeys:        registryKeysForJetBrainsIDE("IntelliJ IDEA Community Edition"),
+		ExecutableShimPaths: executableShimPathsForJetBrainsIDE("idea"),
+		DisplayNamePrefixes: []string{"IntelliJ IDEA Community Edition "},
+		Publishers:          []string{"JetBrains s.r.o."},
+	},
+	{
+		Name:                       JetbrainsPyCharm,
+		RegistryKeys:               registryKeysForJetBrainsIDE("PyCharm"),
+		ExecutableShimPaths:        executableShimPathsForJetBrainsIDE("pycharm"),
+		JetBrainsToolboxScriptName: "pycharm",
+		DisplayNamePrefixes:        []string{"PyCharm "},
+		Publishers:                 []string{"JetBrains s.r.o."},
+	},
+	{
+		Name:                JetbrainsPyCharmCE,
+		RegistryKeys:        registryKeysForJetBrainsIDE("PyCharm Community Edition"),
+		ExecutableShimPaths: executableShimPathsForJetBrainsIDE("pycharm"),
+		DisplayNamePrefixes: []string{"PyCharm Community Edition"},
+		Publishers:          []string{"JetBrains s.r.o."},
+	},
+	{
+		Name:                       JetbrainsCLion,
+		RegistryKeys:               registryKeysForJetBrainsIDE("CLion"),
+		ExecutableShimPaths:        executableShimPathsForJetBrainsIDE("clion"),
+		JetBrainsToolboxScriptName: "clion",
+		DisplayNamePrefixes:        []string{"CLion "},
+		Publishers:                 []string{"JetBrains s.r.o."},
+	},
+	{
+		Name:                       JetbrainsRubyMine,
+		RegistryKeys:               registryKeysForJetBrainsIDE("RubyMine"),
+		ExecutableShimPaths:        executableShimPathsForJetBrainsIDE("rubymine"),
+		JetBrainsToolboxScriptName: "rubymine",
+		DisplayNamePrefixes:        []string{"RubyMine "},
+		Publishers:                 []string{"JetBrains s.r.o."},
+	},
+	{
+		Name:                       JetbrainsGoLand,
+		RegistryKeys:               registryKeysForJetBrainsIDE("GoLand"),
+		ExecutableShimPaths:        executableShimPathsForJetBrainsIDE("goland"),
+		JetBrainsToolboxScriptName: "goland",
+		DisplayNamePrefixes:        []string{"GoLand "},
+		Publishers:                 []string{"JetBrains s.r.o."},
+	},
+	{
+		Name:                       JetbrainsFleet,
+		RegistryKeys:               []RegistryKey{LocalMachineUninstallKey("Fleet")},
+		JetBrainsToolboxScriptName: "fleet",
+		InstallLocationRegistryKey: "DisplayIcon",
+		DisplayNamePrefixes:        []string{"Fleet "},
+		Publishers:                 []string{"JetBrains s.r.o."},
+	},
+	{
+		Name:                       JetbrainsDataSpell,
+		RegistryKeys:               registryKeysForJetBrainsIDE("DataSpell"),
+		ExecutableShimPaths:        executableShimPathsForJetBrainsIDE("dataspell"),
+		JetBrainsToolboxScriptName: "dataspell",
+		DisplayNamePrefixes:        []string{"DataSpell "},
+		Publishers:                 []string{"JetBrains s.r.o."},
+	},
+	{
+		Name: Pulsar,
+		RegistryKeys: []RegistryKey{
+			CurrentUserUninstallKey("0949b555-c22c-56b7-873a-a960bdefa81f"),
+			LocalMachineUninstallKey("0949b555-c22c-56b7-873a-a960bdefa81f"),
+		},
+		ExecutableShimPaths: []string{"../pulsar/Pulsar.exe"},
+		DisplayNamePrefixes: []string{"Pulsar"},
+		Publishers:          []string{"Pulsar-Edit"},
+	},
+}
+
+func registryKey(key registry.Key, subKey string) RegistryKey {
+	return RegistryKey{Key: key, SubKey: subKey}
+}
+
+func CurrentUserUninstallKey(subKey string) RegistryKey {
+	return registryKey(registry.CURRENT_USER, "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\"+subKey)
+}
+
+func LocalMachineUninstallKey(subKey string) RegistryKey {
+	return registryKey(registry.LOCAL_MACHINE, "Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\"+subKey)
+}
+
+func Wow64LocalMachineUninstallKey(subKey string) RegistryKey {
+	return registryKey(registry.LOCAL_MACHINE, "Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\"+subKey)
+}
+
+// This function generates registry keys for a given JetBrains product for the
+// last 2 years, assuming JetBrains make no more than 5 major releases and
+// no more than 5 minor releases per year.
+func registryKeysForJetBrainsIDE(product string) []RegistryKey {
+	const maxMajorReleasesPerYear = 5
+	const maxMinorReleasesPerYear = 5
+	var lastYear = time.Now().Year()
+	var firstYear = lastYear - 2
+
+	var result []RegistryKey
+
+	for year := firstYear; year <= lastYear; year++ {
+		for majorRelease := 1; majorRelease <= maxMajorReleasesPerYear; majorRelease++ {
+			for minorRelease := 0; minorRelease <= maxMinorReleasesPerYear; minorRelease++ {
+				key := fmt.Sprintf("%s %d.%d", product, year, majorRelease)
+				if minorRelease > 0 {
+					key = fmt.Sprintf("%s.%d", key, minorRelease)
+				}
+
+				result = append(result,
+					Wow64LocalMachineUninstallKey(key),
+					CurrentUserUninstallKey(key),
+				)
+			}
+		}
+	}
+
+	// Return in reverse order to prioritize newer versions
+	slices.Reverse(result)
+	return result
+}
+
+// JetBrains IDE's might have 64 and/or 32 bit executables, so let's add both
+func executableShimPathsForJetBrainsIDE(baseName string) []string {
+	return []string{
+		fmt.Sprintf("bin/%s64.exe", baseName),
+		fmt.Sprintf("bin/%s.exe", baseName),
+	}
+}
+
+func getKeyOrEmpty(keys []RegistryValue, valueName string) string {
+	for _, key := range keys {
+		if key.Name == valueName {
+			if key.Type == registry.SZ {
+				return key.StringValue
+			}
+		}
+	}
+	return ""
+}
+
+func getAppInfo(editor WindowsExternalEditor, keys []RegistryValue) (displayName, publisher, installLocation string) {
+	displayName = getKeyOrEmpty(keys, "DisplayName")
+	publisher = getKeyOrEmpty(keys, "Publisher")
+	loc := editor.InstallLocationRegistryKey
+	if loc == "" {
+		loc = "InstallLocation"
+	}
+	installLocation = getKeyOrEmpty(keys, loc)
+	return
+}
+
+func findApplication(ctx context.Context, editor WindowsExternalEditor, foundEditors chan FoundEditor) error {
+	for _, registryKey := range editor.RegistryKeys {
+		values, err := enumerateValues(registryKey.Key, registryKey.SubKey)
+		if err != nil {
+			return errors.Wrap(err, "failed to enumerate registry values")
+		}
+		if len(values) == 0 {
+			continue
+		}
+
+		displayName, publisher, installLocation := getAppInfo(editor, values)
+
+		if !validateStartsWith(displayName, editor.DisplayNamePrefixes) ||
+			!stringInSlice(publisher, editor.Publishers) {
+			log.Warn().Str("editor", string(editor.Name)).Str("publisher", publisher).Str("display_name", displayName).Msg("unexpected registry entry")
+			continue
+		}
+
+		var executableShimPaths []string
+		if editor.InstallLocationRegistryKey == "DisplayIcon" {
+			executableShimPaths = []string{installLocation}
+		} else {
+			for _, shim := range editor.ExecutableShimPaths {
+				executableShimPaths = append(executableShimPaths, filepath.Join(installLocation, shim))
+			}
+		}
+
+		for _, exePath := range executableShimPaths {
+			if pathExists(exePath) {
+				foundEditors <- FoundEditor{
+					Editor:    editor.Name,
+					Path:      exePath,
+					UsesShell: strings.HasSuffix(exePath, ".cmd"),
+				}
+				return nil
+			} else {
+				log.Debug().Str("editor", string(editor.Name)).Str("path", exePath).Msg("executable not found")
+			}
+		}
+	}
+
+	return findJetBrainsToolboxApplication(ctx, editor, foundEditors)
+}
+
+// Find JetBrain products installed through JetBrains Toolbox
+func findJetBrainsToolboxApplication(_ context.Context, editor WindowsExternalEditor, foundEditors chan FoundEditor) error {
+	if editor.JetBrainsToolboxScriptName == "" {
+		return nil
+	}
+
+	var toolboxRegistryReference = []RegistryKey{
+		CurrentUserUninstallKey("toolbox"),
+		Wow64LocalMachineUninstallKey("toolbox"),
+	}
+
+	for _, registryKey := range toolboxRegistryReference {
+		keys, err := enumerateValues(registryKey.Key, registryKey.SubKey)
+		if err != nil {
+			return errors.Wrap(err, "failed to enumerate registry values")
+		}
+
+		if len(keys) > 0 {
+			editorPathInToolbox := path.Join(
+				getKeyOrEmpty(keys, "UninstallString"),
+				"..",
+				"..",
+				"scripts",
+				fmt.Sprintf("%s.cmd", editor.JetBrainsToolboxScriptName),
+			)
+			if pathExists(editorPathInToolbox) {
+				foundEditors <- FoundEditor{
+					Editor:    editor.Name,
+					Path:      editorPathInToolbox,
+					UsesShell: true,
+				}
+			}
+		}
+	}
+
+	return nil
+}
+
+func validateStartsWith(registryVal string, definedVal []string) bool {
+	for _, val := range definedVal {
+		if strings.HasPrefix(registryVal, val) {
+			return true
+		}
+	}
+	return false
+}
+
+func enumerateValues(key registry.Key, subKey string) ([]RegistryValue, error) {
+	k, err := registry.OpenKey(key, subKey, registry.ENUMERATE_SUB_KEYS|registry.QUERY_VALUE)
+	if err != nil {
+		return nil, err
+	}
+	defer fns.CloseIgnore(k)
+
+	valueNames, err := k.ReadValueNames(-1) // read all value names
+	if err != nil {
+		return nil, err
+	}
+
+	var values []RegistryValue
+	for _, valueName := range valueNames {
+		value, valueType, err := k.GetStringValue(valueName)
+		if err != nil {
+			if !errors.Is(err, registry.ErrUnexpectedType) && !errors.Is(err, registry.ErrNotExist) {
+				return nil, err
+			}
+		} else {
+			values = append(values, RegistryValue{Name: valueName, Type: valueType, StringValue: value})
+		}
+	}
+
+	return values, nil
+}
+
+func stringInSlice(a string, list []string) bool {
+	for _, b := range list {
+		if b == a {
+			return true
+		}
+	}
+	return false
+}
+
+// Resolve a list of installed editors on the user's machine, using known
+// install and uninstall path registry keys
+func getAvailableEditors(ctx context.Context) ([]FoundEditor, error) {
+	results := make([]FoundEditor, 0)
+
+	grp, ctx := errgroup.WithContext(ctx)
+
+	foundEditors := make(chan FoundEditor)
+	errs := make(chan error, 1)
+	for _, editor := range editors {
+		editor := editor
+		grp.Go(func() error {
+			return findApplication(ctx, editor, foundEditors)
+		})
+	}
+
+	go func() {
+		errs <- grp.Wait()
+		close(foundEditors)
+	}()
+
+	// Collect results and the error from the group
+	for editor := range foundEditors {
+		results = append(results, editor)
+	}
+	if err := <-errs; err != nil {
+		return nil, errors.WithStack(err)
+	}
+
+	return results, nil
+}
diff --git a/pkg/editors/utils.go b/pkg/editors/utils.go
new file mode 100644
index 0000000000..db6140297a
--- /dev/null
+++ b/pkg/editors/utils.go
@@ -0,0 +1,13 @@
+package editors
+
+import (
+	"errors"
+	"io/fs"
+	"os"
+)
+
+// Checks if the given path exists.
+func pathExists(path string) bool {
+	_, err := os.Stat(path)
+	return !errors.Is(err, fs.ErrNotExist)
+}
diff --git a/pkg/eerror/error.go b/pkg/eerror/error.go
new file mode 100644
index 0000000000..56dbb380c0
--- /dev/null
+++ b/pkg/eerror/error.go
@@ -0,0 +1,184 @@
+// Package eerror stands for Encore Error and is used to provide
+// a little more information about the underlying error's metadata.
+//
+// It also provides helper methods for working with zerolog's context
+package eerror
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/cockroachdb/errors/errbase"
+	"github.com/pkg/errors"
+	"github.com/rs/zerolog"
+)
+
+type Error struct {
+	Module  string         `json:"module"`  // The module the error was raised in (normally the package name, but could be a larger "module" name)
+	Message string         `json:"message"` // The message of the error, it should be human-readable and should be low entropy (i.e. so multiple errors of the same can be grouped)
+	Meta    map[string]any `json:"meta"`    // Metadata about the error, this can be high entropy as it isn't used to group errors
+	Stack   []*StackFrame  `json:"stack"`   // The stack trace of the error
+	cause   error          `json:"-"`       // The underlying error, this is not serialized
+}
+
+var _ error = (*Error)(nil)
+var _ errbase.StackTraceProvider = (*Error)(nil)
+
+// New creates a new error with the given error
+func New(module string, msg string, meta map[string]any) error {
+	return &Error{
+		Module:  module,
+		Message: msg,
+		Meta:    meta,
+		Stack:   getStack(),
+	}
+}
+
+// Wrap wraps the cause error with the given message and meta.
+// If cause is nil, wrap returns nil
+func Wrap(cause error, module string, msg string, meta map[string]any) error {
+	if cause == nil {
+		return nil
+	}
+	return &Error{
+		Module:  module,
+		Message: msg,
+		Meta:    meta,
+		Stack:   getStack(),
+		cause:   cause,
+	}
+}
+
+func WithMeta(err error, meta map[string]any) error {
+	loopErr := err
+	for loopErr != nil {
+		if e, ok := loopErr.(*Error); ok {
+			for key, value := range meta {
+				e.Meta[key] = value
+			}
+			return loopErr
+		}
+
+		switch e := loopErr.(type) {
+		case interface{ Unwrap() error }:
+			loopErr = e.Unwrap()
+		case interface{ Cause() error }:
+			loopErr = e.Cause()
+		default:
+			loopErr = nil
+		}
+	}
+
+	// if here we didn't find an *Error to add the metadata to, so we'll put on in
+	return &Error{
+		Module:  "",
+		Message: err.Error(),
+		Meta:    meta,
+		Stack:   getStack(),
+		cause:   err,
+	}
+}
+
+// Error returns a simple string of the error
+func (e *Error) Error() string {
+	if e.cause != nil {
+		cause := e.cause.Error()
+
+		// Remove the module prefix if it's the same
+		cause = strings.TrimPrefix(cause, "["+e.Module+"]: ")
+
+		return fmt.Sprintf("[%s]: %s: %s", e.Module, e.Message, cause)
+	}
+	return fmt.Sprintf("[%s]: %s", e.Module, e.Message)
+}
+
+// Cause implements Causer for some libraries and returns the underlying cause
+func (e *Error) Cause() error {
+	return e.cause
+}
+
+// Unwrap implements the Go 2 unwrap interface used by xerrors and errors
+func (e *Error) Unwrap() error {
+	return e.cause
+}
+
+// StackTrace implements the StackTraceProvider interface for some libraries
+// including ZeroLog, xerrors and Sentry
+func (e *Error) StackTrace() errors.StackTrace {
+	frames := make([]errors.Frame, len(e.Stack))
+	for i, frame := range e.Stack {
+		// Note: for historic reasons the PC is off by 1 in github.com/pkg/errors
+		frames[i] = errors.Frame(frame.PC + 1)
+	}
+	return frames
+}
+
+// MarshalZerologObject provides a strongly-typed and encoding-agnostic interface
+// to be implemented by types used with Event/Context's Object methods.
+func (e *Error) MarshalZerologObject(evt *zerolog.Event) {
+	LogWithMeta(evt, e)
+}
+
+// BottomStackTraceFrom returns the deepest stack trace from the given error
+func BottomStackTraceFrom(err error) (rtn errors.StackTrace) {
+	count := 0
+
+	for err != nil && count < 100 {
+		count++
+
+		// If we're an error set our return data
+		if e, ok := err.(interface{ StackTrace() errors.StackTrace }); ok {
+			rtn = e.StackTrace()
+		}
+
+		// Recurse
+		switch typed := err.(type) {
+		case interface{ Unwrap() error }:
+			err = typed.Unwrap()
+
+		case interface{ Unwrap() []error }:
+			errs := typed.Unwrap()
+			if len(errs) > 0 {
+				err = errs[0]
+			} else {
+				err = nil
+			}
+
+		case interface{ Cause() error }:
+			err = typed.Cause()
+		}
+	}
+
+	return
+}
+
+// MetaFrom will return the merged metadata from any eerror.Error objects in the errors
+// given. It will unwrap errors as it descends
+func MetaFrom(err error) map[string]any {
+	meta := make(map[string]any)
+	mergeMeta(err, meta)
+	return meta
+}
+
+func mergeMeta(err error, meta map[string]any) {
+	if err == nil {
+		return
+	}
+
+	// Merge in the data from the deepest error first
+	switch err := err.(type) {
+	case interface{ Unwrap() error }:
+		mergeMeta(err.Unwrap(), meta)
+
+	case interface{ Cause() error }:
+		mergeMeta(err.Cause(), meta)
+	}
+
+	// Then merge in our data
+	if e, ok := err.(*Error); ok {
+		for key, value := range e.Meta {
+			meta[key] = value
+		}
+	}
+
+}
diff --git a/pkg/eerror/stack.go b/pkg/eerror/stack.go
new file mode 100644
index 0000000000..a333cc2e17
--- /dev/null
+++ b/pkg/eerror/stack.go
@@ -0,0 +1,73 @@
+package eerror
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+)
+
+type StackFrame struct {
+	// PC is the program counter for the frame (needed for things like sentry reporting)
+	PC uintptr `json:"pc"`
+
+	// Human-readable fields
+	Function string `json:"function"`
+	File     string `json:"file"`
+	Line     int    `json:"line"`
+}
+
+var projectSourcePath = getProjectSrcPath()
+
+// getProjectSrcPath returns the path to this repo on the local system
+func getProjectSrcPath() string {
+	_, file, _, ok := runtime.Caller(0)
+	if !ok {
+		return ""
+	}
+
+	eerrorPath := filepath.Dir(file)
+	pkgPath := filepath.Dir(eerrorPath)
+	encoreProjectPath := filepath.Dir(pkgPath)
+
+	return fmt.Sprintf("%s%c", encoreProjectPath, os.PathSeparator)
+}
+
+// getStack returns a human read able stack trace
+func getStack() []*StackFrame {
+	ret := make([]uintptr, 100)
+
+	index := runtime.Callers(1, ret)
+	if index == 0 {
+		return nil
+	}
+
+	cf := runtime.CallersFrames(ret[:index])
+	frame, more := cf.Next()
+
+	// Skip over the "eerror" package files
+	for strings.Contains(frame.File, "eerror") {
+		if !more {
+			return nil
+		}
+
+		frame, more = cf.Next()
+	}
+
+	var frames []*StackFrame
+	for {
+		frames = append(frames, &StackFrame{
+			PC:       frame.PC,
+			Function: strings.TrimPrefix(frame.Function, "encr.dev/"),
+			File:     strings.TrimPrefix(frame.File, projectSourcePath),
+			Line:     frame.Line,
+		})
+
+		if !more {
+			return frames
+		}
+
+		frame, more = cf.Next()
+	}
+}
diff --git a/pkg/eerror/zerolog.go b/pkg/eerror/zerolog.go
new file mode 100644
index 0000000000..88f9f11076
--- /dev/null
+++ b/pkg/eerror/zerolog.go
@@ -0,0 +1,283 @@
+package eerror
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"net"
+	"runtime"
+	"sort"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/rs/zerolog"
+)
+
+type errorMeta struct {
+	Frames []uintptr      `json:"frames"`
+	Meta   map[string]any `json:"meta"`
+}
+
+// ZeroLogStackMarshaller will encode the following in the Zerolog error stack field:
+// - the deepest error stack trace
+// - the error meta data collected from all errors
+//
+// This can then be extracted by ZeroLogConsoleExtraFormatter
+func ZeroLogStackMarshaller(err error) interface{} {
+	var frames []uintptr
+	for _, frame := range BottomStackTraceFrom(err) {
+		// Account for the stack trace being 1 frame deeper than the error
+		frames = append(frames, uintptr(frame-1))
+	}
+	frames = filterFrames(frames)
+
+	return &errorMeta{
+		Frames: frames,
+		Meta:   MetaFrom(err),
+	}
+}
+
+// ZeroLogConsoleExtraFormatter extracts the extra fields from the error and formats them for console output
+//
+// This field can be passed to a zerolog.ConsoleWriter as it's ExtraFieldFormatter
+func ZeroLogConsoleExtraFormatter(event map[string]any, buf *bytes.Buffer) error {
+	stackFieldValue, found := event[zerolog.ErrorStackFieldName]
+	if !found || stackFieldValue == nil {
+		return nil
+	}
+
+	// Marshal the stack field to our error meta
+	var errorMeta errorMeta
+	jsonBytes, err := json.Marshal(stackFieldValue)
+	if err != nil {
+		return err
+	}
+	if err := json.Unmarshal(jsonBytes, &errorMeta); err != nil {
+		return err
+	}
+
+	// Log any additional meta data
+	if len(errorMeta.Meta) > 0 {
+		// Get the fields not already set in the log, and then sort them
+		fields := make([]string, 0, len(errorMeta.Meta))
+		for field := range errorMeta.Meta {
+			if _, alreadySet := event[field]; !alreadySet {
+				fields = append(fields, field)
+			}
+		}
+		sort.Strings(fields)
+
+		// Then log the additional fields
+		for _, field := range fields {
+			if buf.Len() > 0 {
+				buf.WriteByte(' ')
+			}
+
+			fieldName := fmt.Sprintf("\x1b[%dm%v\x1b[0m=", 36, field)
+			buf.WriteString(fieldName)
+
+			switch fValue := errorMeta.Meta[field].(type) {
+			case string:
+				if needsQuote(fValue) {
+					buf.WriteString(strconv.Quote(fValue))
+				} else {
+					buf.WriteString(fValue)
+				}
+			case json.Number:
+				buf.WriteString(fValue.String())
+			default:
+				b, err := zerolog.InterfaceMarshalFunc(fValue)
+				if err != nil {
+					buf.WriteString(fmt.Sprintf("[error: \x1b[%dm%v\x1b[0m=]", 31, err))
+				} else {
+					buf.WriteString(string(b))
+				}
+			}
+		}
+	}
+
+	// Now print a stack trace if we have it
+	if len(errorMeta.Frames) > 0 {
+		// Find the longest function name so we can align them
+		longestFunc := 0
+		for _, frame := range errorMeta.Frames {
+			module, function := frameToModuleFunc(frame)
+			fName := fmt.Sprintf("%s.%s", module, function)
+			if len(fName) > longestFunc {
+				longestFunc = len(fName)
+			}
+		}
+
+		// Print the stack trace
+		for i, frame := range errorMeta.Frames {
+			module, function := frameToModuleFunc(frame)
+			filename, line := frameToFileLine(frame)
+
+			buf.WriteString(fmt.Sprintf(
+				"\n\tat %s.%s%s %s:%d",
+				fmt.Sprintf("\x1b[%dm%v\x1b[0m", 90, module),
+				fmt.Sprintf("\x1b[%dm%v\x1b[0m", 35, function),
+				strings.Repeat(" ", longestFunc-(len(function)+len(module)+1)),
+				filename, line,
+			))
+
+			if i > 5 {
+				buf.WriteString(fmt.Sprintf("\n\t... remaining %d frames omitted ...", len(errorMeta.Frames)-(i+1)))
+				break
+			}
+		}
+	}
+
+	return nil
+}
+
+func frameToModuleFunc(frame uintptr) (module string, name string) {
+	fn := runtime.FuncForPC(frame)
+	if fn == nil {
+		return "", "unknown"
+	}
+
+	name = fn.Name()
+	if idx := strings.LastIndex(name, "."); idx != -1 {
+		module = name[:idx]
+		name = name[idx+1:]
+	}
+
+	module = strings.TrimPrefix(module, "encr.dev/")
+	name = strings.Replace(name, "·", ".", -1)
+	return
+}
+
+func frameToFileLine(frame uintptr) (file string, line int) {
+	fn := runtime.FuncForPC(frame)
+	if fn == nil {
+		return "unknown", 0
+	}
+
+	filename, line := fn.FileLine(frame)
+	filename = strings.TrimPrefix(filename, projectSourcePath)
+
+	return filename, line
+}
+
+// filterFrames filters out stack frames from zerolog and this package.
+func filterFrames(frames []uintptr) []uintptr {
+	if len(frames) == 0 {
+		return nil
+	}
+	filteredFrames := make([]uintptr, 0, len(frames))
+
+	for _, frame := range frames {
+		module, _ := frameToModuleFunc(frame)
+		if strings.HasPrefix(module, "github.com/rs/zerolog") {
+			continue
+		} else if strings.HasPrefix(module, "github.com/spf13/cobra") {
+			continue
+		}
+		filteredFrames = append(filteredFrames, frame)
+	}
+	return filteredFrames
+}
+
+// needsQuote returns true when the string s should be quoted in output.
+func needsQuote(s string) bool {
+	for i := range s {
+		if s[i] < 0x20 || s[i] > 0x7e || s[i] == ' ' || s[i] == '\\' || s[i] == '"' {
+			return true
+		}
+	}
+	return false
+}
+
+// LogWithMeta merges in the metadata from the errors into the log context
+func LogWithMeta(evt *zerolog.Event, err error) *zerolog.Event {
+	if err == nil {
+		return evt
+	}
+
+	meta := MetaFrom(err)
+	for key, value := range meta {
+		switch value := value.(type) {
+		case json.RawMessage:
+			evt = evt.RawJSON(key, value)
+		case error:
+			evt = evt.AnErr(key, value)
+		case time.Time:
+			evt = evt.Time(key, value)
+		case time.Duration:
+			evt = evt.Dur(key, value)
+		case net.IP:
+			evt = evt.IPAddr(key, value)
+		case net.IPNet:
+			evt = evt.IPPrefix(key, value)
+		case net.HardwareAddr:
+			evt = evt.MACAddr(key, value)
+		case string:
+			evt = evt.Str(key, value)
+		case int:
+			evt = evt.Int(key, value)
+		case int8:
+			evt = evt.Int8(key, value)
+		case int16:
+			evt = evt.Int16(key, value)
+		case int32:
+			evt = evt.Int32(key, value)
+		case int64:
+			evt = evt.Int64(key, value)
+		case uint:
+			evt = evt.Uint(key, value)
+		case uint8:
+			evt = evt.Uint8(key, value)
+		case uint16:
+			evt = evt.Uint16(key, value)
+		case uint32:
+			evt = evt.Uint32(key, value)
+		case uint64:
+			evt = evt.Uint64(key, value)
+		case float32:
+			evt = evt.Float32(key, value)
+		case float64:
+			evt = evt.Float64(key, value)
+		case bool:
+			evt = evt.Bool(key, value)
+		case []error:
+			evt = evt.Errs(key, value)
+		case []time.Time:
+			evt = evt.Times(key, value)
+		case []time.Duration:
+			evt = evt.Durs(key, value)
+		case []string:
+			evt = evt.Strs(key, value)
+		case []int:
+			evt = evt.Ints(key, value)
+		case []int8:
+			evt = evt.Ints8(key, value)
+		case []int16:
+			evt = evt.Ints16(key, value)
+		case []int32:
+			evt = evt.Ints32(key, value)
+		case []int64:
+			evt = evt.Ints64(key, value)
+		case []uint:
+			evt = evt.Uints(key, value)
+		case []byte: // uint8 / byte are the same thing so we'll default to bytes
+			evt = evt.Bytes(key, value)
+		case []uint16:
+			evt = evt.Uints16(key, value)
+		case []uint32:
+			evt = evt.Uints32(key, value)
+		case []uint64:
+			evt = evt.Uints64(key, value)
+		case []float32:
+			evt = evt.Floats32(key, value)
+		case []float64:
+			evt = evt.Floats64(key, value)
+		case []bool:
+			evt = evt.Bools(key, value)
+		default:
+			evt = evt.Interface(key, value)
+		}
+	}
+	return evt
+}
diff --git a/pkg/emulators/storage/LICENSE b/pkg/emulators/storage/LICENSE
new file mode 100644
index 0000000000..25706a4763
--- /dev/null
+++ b/pkg/emulators/storage/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Engineering at Fullstory
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/pkg/emulators/storage/gcsemu/batch.go b/pkg/emulators/storage/gcsemu/batch.go
new file mode 100644
index 0000000000..56077f5fe2
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/batch.go
@@ -0,0 +1,107 @@
+package gcsemu
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"net/http"
+	"net/http/httptest"
+	"net/textproto"
+)
+
+// BatchHandler handles emulated GCS http requests for "storage.googleapis.com/batch/storage/v1".
+func (g *GcsEmu) BatchHandler(w http.ResponseWriter, r *http.Request) {
+	// First parse the entire incoming message.
+	reader, err := r.MultipartReader()
+	if err != nil {
+		g.gapiError(w, httpStatusCodeOf(err), err.Error())
+		return
+	}
+
+	var reqs []*http.Request
+	var contentIds []string
+	for i := 0; true; i++ {
+		part, err := reader.NextPart()
+		if err == io.EOF {
+			break // done
+		} else if err != nil {
+			g.gapiError(w, http.StatusBadRequest, err.Error())
+			return
+		}
+
+		if ct := part.Header.Get("Content-Type"); ct != "application/http" {
+			g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("Content-Type: want=application/http, got=%s", ct))
+			return
+		}
+
+		contentId := part.Header.Get("Content-ID")
+
+		content, err := io.ReadAll(part)
+		_ = part.Close()
+		if err != nil {
+			g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("part=%d, Content-ID=%s: read error %v", i, contentId, err))
+			return
+		}
+
+		newReader := bufio.NewReader(bytes.NewReader(content))
+		req, err := http.ReadRequest(newReader)
+		if err != nil {
+			g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("part=%d, Content-ID=%s: unable to parse request %v", i, contentId, err))
+			return
+		}
+		// Any remaining bytes are the body.
+		rem, _ := io.ReadAll(newReader)
+		if len(rem) > 0 {
+			req.GetBody = func() (io.ReadCloser, error) {
+				return io.NopCloser(bytes.NewReader(rem)), nil
+			}
+			req.Body, _ = req.GetBody()
+		}
+		if cte := part.Header.Get("Content-Transfer-Encoding"); cte != "" {
+			req.Header.Set("Transfer-Encoding", cte)
+		}
+		// encoded requests don't include a host, so patch it up from the incoming request
+		req.Host = r.Host
+		reqs = append(reqs, req)
+		contentIds = append(contentIds, contentId)
+	}
+
+	// At this point, we can respond with a 200.
+	mw := multipart.NewWriter(w)
+	w.Header().Set("Content-Type", "multipart/mixed; boundary="+mw.Boundary())
+	w.WriteHeader(http.StatusOK)
+
+	// run each request
+	for i := range reqs {
+		req, contentId := reqs[i], contentIds[i]
+
+		rw := httptest.NewRecorder()
+		g.Handler(rw, req)
+		rsp := rw.Result()
+		rsp.ContentLength = int64(rw.Body.Len())
+
+		partHeaders := textproto.MIMEHeader{}
+		partHeaders.Set("Content-Type", "application/http")
+		if contentId != "" {
+			if contentId[0] == '<' {
+				contentId = "<response-" + contentId[1:]
+			} else {
+				contentId = "response-" + contentId
+			}
+			partHeaders.Set("Content-ID", contentId)
+		}
+
+		pw, _ := mw.CreatePart(partHeaders)
+		if err := rsp.Write(pw); err != nil {
+			g.log(err, "failed to write")
+			return
+		}
+	}
+
+	if err := mw.Close(); err != nil {
+		g.log(err, "failed to close")
+		return
+	}
+}
diff --git a/pkg/emulators/storage/gcsemu/client.go b/pkg/emulators/storage/gcsemu/client.go
new file mode 100644
index 0000000000..abdf8a17a2
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/client.go
@@ -0,0 +1,40 @@
+package gcsemu
+
+import (
+	"context"
+	"net/http"
+	"os"
+	"strings"
+
+	"cloud.google.com/go/storage"
+	"google.golang.org/api/option"
+)
+
+// NewClient returns either a real *storage.Cient, or else a *storage.Client that routes
+// to a local emulator if a `GCS_EMULATOR_HOST` environment variable is configured.
+func NewClient(ctx context.Context) (*storage.Client, error) {
+	if host := os.Getenv("GCS_EMULATOR_HOST"); host != "" {
+		return NewTestClientWithHost(ctx, "http://"+host)
+	}
+	return storage.NewClient(ctx)
+}
+
+// NewTestClientWithHost returns a new Google storage client that connects to the given host:port address.
+func NewTestClientWithHost(ctx context.Context, hostUrl string) (*storage.Client, error) {
+	delegate := http.DefaultTransport
+	httpClient := &http.Client{
+		Transport: tripperFunc(func(r *http.Request) (*http.Response, error) {
+			r = r.Clone(r.Context())
+			r.URL.Host = strings.TrimPrefix(hostUrl, "http://")
+			r.URL.Scheme = "http"
+			return delegate.RoundTrip(r)
+		}),
+	}
+	return storage.NewClient(ctx, option.WithHTTPClient(httpClient))
+}
+
+type tripperFunc func(*http.Request) (*http.Response, error)
+
+func (f tripperFunc) RoundTrip(r *http.Request) (*http.Response, error) {
+	return f(r)
+}
diff --git a/pkg/emulators/storage/gcsemu/errors.go b/pkg/emulators/storage/gcsemu/errors.go
new file mode 100644
index 0000000000..d8b7af3baf
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/errors.go
@@ -0,0 +1,42 @@
+package gcsemu
+
+import (
+	"fmt"
+
+	"google.golang.org/api/googleapi"
+)
+
+func httpStatusCodeOf(err error) int {
+	if gapiErr, ok := err.(*googleapi.Error); ok {
+		return gapiErr.Code
+	}
+
+	if httpErr, ok := err.(*httpError); ok {
+		if httpErr.code != 0 {
+			return httpErr.code
+		}
+		return httpStatusCodeOf(httpErr.cause)
+	}
+	return 0
+}
+
+func fmtErrorfCode(httpCode int, f string, args ...interface{}) error {
+	return &httpError{
+		cause: fmt.Errorf(f, args...),
+		code:  httpCode,
+	}
+}
+
+// httpError is a custom error type that decorates with an HTTP error code
+type httpError struct {
+	cause error
+	code  int
+}
+
+// Error returns a string describing the entire causal chain.
+func (err *httpError) Error() string {
+	if err == nil {
+		return "<nil>"
+	}
+	return fmt.Sprintf("http error %d: %s", err.code, err.cause)
+}
diff --git a/pkg/emulators/storage/gcsemu/filestore.go b/pkg/emulators/storage/gcsemu/filestore.go
new file mode 100644
index 0000000000..b3814b2321
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/filestore.go
@@ -0,0 +1,263 @@
+package gcsemu
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	cloudstorage "cloud.google.com/go/storage"
+	"google.golang.org/api/storage/v1"
+)
+
+const (
+	metaExtention = ".emumeta"
+)
+
+type filestore struct {
+	gcsDir string
+}
+
+var _ Store = (*filestore)(nil)
+
+// NewFileStore returns a new Store that writes to the given directory.
+func NewFileStore(gcsDir string) *filestore {
+	return &filestore{gcsDir: gcsDir}
+}
+
+type composeObj struct {
+	filename string
+	conds    cloudstorage.Conditions
+}
+
+func (fs *filestore) CreateBucket(bucket string) error {
+	bucketDir := filepath.Join(fs.gcsDir, bucket)
+	return os.MkdirAll(bucketDir, 0777)
+}
+
+func (fs *filestore) GetBucketMeta(baseUrl HttpBaseUrl, bucket string) (*storage.Bucket, error) {
+	f := fs.filename(bucket, "")
+	fInfo, err := os.Stat(f)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("stating %s: %w", f, err)
+	}
+
+	obj := BucketMeta(baseUrl, bucket)
+	obj.Updated = fInfo.ModTime().UTC().Format(time.RFC3339Nano)
+	return obj, nil
+}
+
+func (fs *filestore) Get(baseUrl HttpBaseUrl, bucket string, filename string) (*storage.Object, []byte, error) {
+	obj, err := fs.GetMeta(baseUrl, bucket, filename)
+	if err != nil {
+		return nil, nil, err
+	}
+	if obj == nil {
+		return nil, nil, nil
+	}
+
+	f := fs.filename(bucket, filename)
+	contents, err := os.ReadFile(f)
+	if err != nil {
+		return nil, nil, fmt.Errorf("reading  %s: %w", f, err)
+	}
+	return obj, contents, nil
+}
+
+func (fs *filestore) GetMeta(baseUrl HttpBaseUrl, bucket string, filename string) (*storage.Object, error) {
+	f := fs.filename(bucket, filename)
+	fInfo, err := os.Stat(f)
+	if err != nil {
+		if os.IsNotExist(err) {
+			return nil, nil
+		}
+		return nil, fmt.Errorf("stating  %s: %w", f, err)
+	}
+
+	return fs.ReadMeta(baseUrl, bucket, filename, fInfo)
+}
+
+func (fs *filestore) Add(bucket string, filename string, contents []byte, meta *storage.Object) error {
+	f := fs.filename(bucket, filename)
+	if err := os.MkdirAll(filepath.Dir(f), 0777); err != nil {
+		return fmt.Errorf("could not create dirs for:  %s: %w", f, err)
+	}
+
+	if err := os.WriteFile(f, contents, 0666); err != nil {
+		return fmt.Errorf("could not write:  %s: %w", f, err)
+	}
+
+	// Force a new modification time, since this is what Generation is based on.
+	now := time.Now().UTC()
+	_ = os.Chtimes(f, now, now)
+
+	InitScrubbedMeta(meta, filename)
+	meta.Metageneration = 1
+	meta.Generation = now.UnixNano()
+	if meta.TimeCreated == "" {
+		meta.TimeCreated = now.UTC().Format(time.RFC3339Nano)
+	}
+	meta.Id = fmt.Sprintf("%s/%s/%d", bucket, filename, meta.Generation)
+	meta.Etag = fmt.Sprintf("%d", meta.Generation)
+
+	fMeta := metaFilename(f)
+	if err := os.WriteFile(fMeta, mustJson(meta), 0666); err != nil {
+		return fmt.Errorf("could not write metadata file: %s: %w", fMeta, err)
+	}
+
+	return nil
+}
+
+func (fs *filestore) UpdateMeta(bucket string, filename string, meta *storage.Object, metagen int64) error {
+	InitScrubbedMeta(meta, filename)
+	meta.Metageneration = metagen
+
+	fMeta := metaFilename(fs.filename(bucket, filename))
+	if err := os.WriteFile(fMeta, mustJson(meta), 0666); err != nil {
+		return fmt.Errorf("could not write metadata file: %s: %w", fMeta, err)
+	}
+
+	return nil
+}
+
+func (fs *filestore) Copy(srcBucket string, srcFile string, dstBucket string, dstFile string) (bool, error) {
+	// Make sure it's there
+	meta, err := fs.GetMeta(dontNeedUrls, srcBucket, srcFile)
+	if err != nil {
+		return false, err
+	}
+	// Handle object-not-found
+	if meta == nil {
+		return false, nil
+	}
+
+	// Copy with metadata
+	f1 := fs.filename(srcBucket, srcFile)
+	contents, err := os.ReadFile(f1)
+	if err != nil {
+		return false, err
+	}
+	meta.TimeCreated = "" // reset creation time on the dest file
+	err = fs.Add(dstBucket, dstFile, contents, meta)
+	if err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
+
+func (fs *filestore) Delete(bucket string, filename string) error {
+	f := fs.filename(bucket, filename)
+
+	err := func() error {
+		// Check if the bucket exists
+		if _, err := os.Stat(f); os.IsNotExist(err) {
+			return os.ErrNotExist
+		}
+
+		// Remove the bucket
+		if filename == "" {
+			return os.RemoveAll(f)
+		}
+
+		// Remove just the file and the associated metadata file
+		if err := os.Remove(f); err != nil {
+			return err
+		}
+		err := os.Remove(metaFilename(f))
+		if os.IsNotExist(err) {
+			// Legacy files do not have an accompanying metadata file.
+			return nil
+		}
+		return err
+	}()
+	if err != nil {
+		if os.IsNotExist(err) {
+			return err
+		}
+		return fmt.Errorf("could not delete %s: %w", f, err)
+	}
+
+	// Try to delete empty directories
+	for fp := filepath.Dir(f); len(fp) > len(fs.filename(bucket, "")); fp = filepath.Dir(fp) {
+		files, err := os.ReadDir(fp)
+		if err != nil || len(files) > 0 {
+			// Quit trying to delete the directory
+			break
+		}
+		if err := os.Remove(fp); err != nil {
+			// If removing fails, quit trying
+			break
+		}
+	}
+	return nil
+}
+
+func (fs *filestore) ReadMeta(baseUrl HttpBaseUrl, bucket string, filename string, fInfo os.FileInfo) (*storage.Object, error) {
+	if fInfo.IsDir() {
+		return nil, nil
+	}
+
+	f := fs.filename(bucket, filename)
+	obj := &storage.Object{}
+	fMeta := metaFilename(f)
+	buf, err := os.ReadFile(fMeta)
+	if err != nil {
+		if !os.IsNotExist(err) {
+			return nil, fmt.Errorf("could not read metadata file %s: %w", fMeta, err)
+		}
+	}
+
+	if len(buf) != 0 {
+		if err := json.NewDecoder(bytes.NewReader(buf)).Decode(obj); err != nil {
+			return nil, fmt.Errorf("could not parse file attributes %q for %s: %w", buf, f, err)
+		}
+	}
+
+	InitMetaWithUrls(baseUrl, obj, bucket, filename, uint64(fInfo.Size()))
+	// obj.Generation = fInfo.ModTime().UnixNano() // use the mod time as the generation number
+	obj.Updated = fInfo.ModTime().UTC().Format(time.RFC3339Nano)
+	return obj, nil
+}
+
+func (fs *filestore) filename(bucket string, filename string) string {
+	if filename == "" {
+		return filepath.Join(fs.gcsDir, bucket)
+	}
+	return filepath.Join(fs.gcsDir, bucket, filename)
+}
+
+func metaFilename(filename string) string {
+	return filename + metaExtention
+}
+
+func (fs *filestore) Walk(ctx context.Context, bucket string, cb func(ctx context.Context, filename string, fInfo os.FileInfo) error) error {
+	root := filepath.Join(fs.gcsDir, bucket)
+	return filepath.Walk(root, func(path string, fInfo os.FileInfo, err error) error {
+		if strings.HasSuffix(path, metaExtention) {
+			// Ignore metadata files
+			return nil
+		}
+
+		filename := strings.TrimPrefix(path, root)
+		filename = strings.TrimPrefix(filename, string(os.PathSeparator))
+		if err != nil {
+			if os.IsNotExist(err) {
+				return err
+			}
+			return fmt.Errorf("walk error at %s: %w", filename, err)
+		}
+
+		if err := cb(ctx, filename, fInfo); err != nil {
+			return err
+		}
+		return nil
+	})
+}
diff --git a/pkg/emulators/storage/gcsemu/filestore_test.go b/pkg/emulators/storage/gcsemu/filestore_test.go
new file mode 100644
index 0000000000..49b76b3e32
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/filestore_test.go
@@ -0,0 +1,67 @@
+package gcsemu
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"gotest.tools/v3/assert"
+)
+
+func TestFileStore(t *testing.T) {
+	// Setup an on-disk emulator.
+	gcsDir := filepath.Join(os.TempDir(), fmt.Sprintf("gcsemu-test-%d", time.Now().Unix()))
+	gcsEmu := NewGcsEmu(Options{
+		Store:   NewFileStore(gcsDir),
+		Verbose: true,
+		Log: func(err error, fmt string, args ...interface{}) {
+			t.Helper()
+			if err != nil {
+				fmt = "ERROR: " + fmt + ": %s"
+				args = append(args, err)
+			}
+			t.Logf(fmt, args...)
+		},
+	})
+	mux := http.NewServeMux()
+	gcsEmu.Register(mux)
+	svr := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Logf("about to method=%s host=%s u=%s", r.Method, r.Host, r.URL)
+		mux.ServeHTTP(w, r)
+	}))
+	t.Cleanup(svr.Close)
+
+	gcsClient, err := NewTestClientWithHost(context.Background(), svr.URL)
+	assert.NilError(t, err)
+	t.Cleanup(func() {
+		_ = gcsClient.Close()
+	})
+
+	bh := BucketHandle{
+		Name:         "file-bucket",
+		BucketHandle: gcsClient.Bucket("file-bucket"),
+	}
+	initBucket(t, bh)
+	attrs, err := bh.Attrs(context.Background())
+	assert.NilError(t, err)
+	assert.Equal(t, bh.Name, attrs.Name)
+
+	t.Parallel()
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			tc.f(t, bh)
+		})
+	}
+
+	t.Run("RawHttp", func(t *testing.T) {
+		t.Parallel()
+		testRawHttp(t, bh, http.DefaultClient, svr.URL)
+	})
+}
diff --git a/pkg/emulators/storage/gcsemu/gcsemu.go b/pkg/emulators/storage/gcsemu/gcsemu.go
new file mode 100644
index 0000000000..54971cd0af
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/gcsemu.go
@@ -0,0 +1,830 @@
+// Package gcsemu implements a Google Cloud Storage emulator for development.
+package gcsemu
+
+import (
+	"bytes"
+	"compress/gzip"
+	"context"
+	"crypto/md5"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"sync/atomic"
+
+	cloudstorage "cloud.google.com/go/storage"
+	"encr.dev/pkg/emulators/storage/gcsutil"
+	"github.com/bluele/gcache"
+	"google.golang.org/api/storage/v1"
+)
+
+const maybeNotImplementedErrorMsg = "This may be a valid request, but we haven't implemented it in gcsemu yet."
+
+// Options configure the emulator.
+type Options struct {
+	// A storage layer to use; if nil, defaults to in-mem storage.
+	Store Store
+
+	// If true, log verbosely.
+	Verbose bool
+
+	// Optional log function. `err` will be `nil` for informational/debug messages.
+	Log func(err error, fmt string, args ...interface{})
+}
+
+// GcsEmu is a Google Cloud Storage emulator for development.
+type GcsEmu struct {
+	// The directory which contains gcs emulation.
+	store Store
+	locks *gcsutil.TransientLockMap
+
+	uploadIds gcache.Cache
+	idCounter int32
+
+	verbose bool
+	log     func(err error, fmt string, args ...interface{})
+}
+
+// NewGcsEmu creates a new Google Cloud Storage emulator.
+func NewGcsEmu(opts Options) *GcsEmu {
+	if opts.Store == nil {
+		opts.Store = NewMemStore()
+	}
+	if opts.Log == nil {
+		opts.Log = func(_ error, _ string, _ ...interface{}) {}
+	}
+	return &GcsEmu{
+		store:     opts.Store,
+		locks:     gcsutil.NewTransientLockMap(),
+		uploadIds: gcache.New(1024).LRU().Build(),
+		verbose:   opts.Verbose,
+		log:       opts.Log,
+	}
+}
+
+func lockName(bucket string, filename string) string {
+	return bucket + "/" + filename
+}
+
+// Register the emulator's HTTP handlers on the given mux.
+func (g *GcsEmu) Register(mux *http.ServeMux) {
+	mux.HandleFunc("/", DrainRequestHandler(GzipRequestHandler(g.Handler)))
+	mux.HandleFunc("/batch/storage/v1", DrainRequestHandler(GzipRequestHandler(g.BatchHandler)))
+}
+
+// Handler handles emulated GCS http requests for "storage.googleapis.com".
+func (g *GcsEmu) Handler(w http.ResponseWriter, r *http.Request) {
+	baseUrl := dontNeedUrls
+	{
+		host := requestHost(r)
+		if host != "" {
+			// Prepend the proto.
+			if r.TLS != nil || r.Header.Get("X-Forwarded-Proto") == "https" {
+				baseUrl = HttpBaseUrl("https://" + host + "/")
+			} else {
+				baseUrl = HttpBaseUrl("http://" + host + "/")
+			}
+		}
+	}
+
+	ctx := r.Context()
+	p, ok := ParseGcsUrl(r.URL)
+	if !ok {
+		g.gapiError(w, http.StatusBadRequest, "unrecognized request")
+		return
+	}
+	object := p.Object
+	bucket := p.Bucket
+
+	if err := r.ParseForm(); err != nil {
+		g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("failed to parse form: %s", err))
+		return
+	}
+
+	conds, err := parseConds(r.Form)
+	if err != nil {
+		g.gapiError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	if g.verbose {
+		if object == "" {
+			g.log(nil, "%s request for bucket %q", r.Method, bucket)
+		} else {
+			g.log(nil, "%s request for bucket %q, object %q", r.Method, bucket, object)
+		}
+	}
+
+	switch r.Method {
+	case "DELETE":
+		g.handleGcsDelete(ctx, w, bucket, object, conds)
+	case "GET":
+		if object == "" {
+			if strings.HasSuffix(r.URL.Path, "/o") {
+				g.handleGcsListBucket(ctx, baseUrl, w, r.URL.Query(), bucket)
+			} else {
+				g.handleGcsMetadataRequest(baseUrl, w, bucket, object)
+			}
+		} else {
+			alt := r.URL.Query().Get("alt")
+			if alt == "media" || (p.IsPublic && alt == "") {
+				g.handleGcsMediaRequest(baseUrl, w, r.Header.Get("Accept-Encoding"), bucket, object)
+			} else if alt == "json" || (!p.IsPublic && alt == "") {
+				g.handleGcsMetadataRequest(baseUrl, w, bucket, object)
+			} else {
+				// should never happen?
+				g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("unsupported value for alt param to GET: %q\n%s", alt, maybeNotImplementedErrorMsg))
+			}
+		}
+	case "PATCH":
+		alt := r.URL.Query().Get("alt")
+		if alt == "json" || r.Header.Get("Content-Type") == "application/json" {
+			g.handleGcsUpdateMetadataRequest(ctx, baseUrl, w, r, bucket, object, conds)
+		} else {
+			// should never happen?
+			g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("unsupported value for alt param to PATCH: %q\n%s", alt, maybeNotImplementedErrorMsg))
+		}
+	case "POST":
+		if bucket == "" {
+			g.handleGcsNewBucket(ctx, w, r, conds)
+		} else if object == "" {
+			g.handleGcsNewObject(ctx, baseUrl, w, r, bucket, conds)
+		} else if strings.Contains(object, "/compose") {
+			// TODO: enforce other conditions outside of generation
+			g.handleGcsCompose(ctx, baseUrl, w, r, bucket, object, conds)
+		} else if strings.Contains(object, "/rewriteTo/") {
+			g.handleGcsCopy(ctx, baseUrl, w, bucket, object)
+		} else if r.Form.Get("upload_id") != "" {
+			g.handleGcsNewObjectResume(ctx, baseUrl, w, r, r.Form.Get("upload_id"))
+		} else {
+			// unsupported method, or maybe should never happen
+			g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("unsupported POST request: %v\n%s", r.URL, maybeNotImplementedErrorMsg))
+		}
+	case "PUT":
+		if r.Form.Get("upload_id") != "" {
+			g.handleGcsNewObjectResume(ctx, baseUrl, w, r, r.Form.Get("upload_id"))
+		} else {
+			// unsupported method, or maybe should never happen
+			g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("unsupported PUT request: %v\n%s", r.URL, maybeNotImplementedErrorMsg))
+		}
+	default:
+		g.gapiError(w, http.StatusMethodNotAllowed, "")
+	}
+}
+
+func (g *GcsEmu) handleGcsCompose(ctx context.Context, baseUrl HttpBaseUrl, w http.ResponseWriter, r *http.Request, bucket, object string, conds cloudstorage.Conditions) {
+	var req storage.ComposeRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		g.gapiError(w, http.StatusBadRequest, "bad compose request")
+		return
+	}
+	// Get the composed object name from the path
+	parts := strings.Split(object, "/compose")
+	if len(parts) != 2 {
+		g.gapiError(w, http.StatusBadRequest, "bad compose request")
+		return
+	}
+	dst := composeObj{
+		filename: parts[0],
+		conds:    conds,
+	}
+
+	srcs := make([]composeObj, len(req.SourceObjects))
+	for i, sObj := range req.SourceObjects {
+		var generationMatch int64
+		if sObj.ObjectPreconditions != nil {
+			generationMatch = sObj.ObjectPreconditions.IfGenerationMatch
+		}
+		srcs[i] = composeObj{
+			filename: sObj.Name,
+			conds: cloudstorage.Conditions{
+				GenerationMatch: generationMatch,
+			},
+		}
+	}
+	var obj *storage.Object
+	if err := g.locks.Run(ctx, lockName(bucket, dst.filename), func(_ context.Context) error {
+		var err error
+		obj, err = g.finishCompose(baseUrl, bucket, dst, srcs, req.Destination)
+		return err
+	}); err != nil {
+		g.gapiError(w, httpStatusCodeOf(err), fmt.Sprintf("failed to compose objects: %s", err))
+		return
+	}
+	g.jsonRespond(w, &obj)
+}
+
+func (g *GcsEmu) handleGcsListBucket(ctx context.Context, baseUrl HttpBaseUrl, w http.ResponseWriter, params url.Values, bucket string) {
+	delimiter := params.Get("delimiter")
+	prefix := params.Get("prefix")
+	pageToken := params.Get("pageToken")
+
+	var cursor string
+	if pageToken != "" {
+		lastFilename, err := gcsutil.DecodePageToken(pageToken)
+		if err != nil {
+			g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("invalid pageToken parameter (failed to decode) %s: %s", pageToken, err))
+			return
+		}
+		cursor = lastFilename
+	}
+
+	maxResults := 1000
+	maxResultsStr := params.Get("maxResults")
+	if maxResultsStr != "" {
+		var err error
+		maxResults, err = strconv.Atoi(maxResultsStr)
+		if err != nil || maxResults < 1 {
+			g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("invalid maxResults parameter: %s", maxResultsStr))
+			return
+		}
+	}
+
+	g.makeBucketListResults(ctx, baseUrl, w, delimiter, cursor, prefix, bucket, maxResults)
+}
+
+func (g *GcsEmu) handleGcsDelete(ctx context.Context, w http.ResponseWriter, bucket string, filename string, conds cloudstorage.Conditions) {
+	err := g.locks.Run(ctx, lockName(bucket, filename), func(ctx context.Context) error {
+		// Find the existing file / meta.
+		obj, err := g.store.GetMeta(dontNeedUrls, bucket, filename)
+		if err != nil {
+			return fmt.Errorf("failed to check existence of %s/%s: %w", bucket, filename, err)
+		}
+
+		if err := validateConds(obj, conds); err != nil {
+			return err
+		}
+
+		if err := g.store.Delete(bucket, filename); err != nil {
+			if os.IsNotExist(err) {
+				return fmtErrorfCode(http.StatusNotFound, "%s/%s not found", bucket, filename)
+			}
+			return fmt.Errorf("failed to delete %s/%s: %w", bucket, filename, err)
+		}
+
+		return nil
+	})
+	if err != nil {
+		g.gapiError(w, httpStatusCodeOf(err), err.Error())
+		return
+	}
+
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func (g *GcsEmu) handleGcsMediaRequest(baseUrl HttpBaseUrl, w http.ResponseWriter, acceptEncoding, bucket, filename string) {
+	obj, contents, err := g.store.Get(baseUrl, bucket, filename)
+	if err != nil {
+		g.gapiError(w, http.StatusInternalServerError, fmt.Sprintf("failed to check existence of %s/%s: %s", bucket, filename, err))
+		return
+	}
+	if obj == nil {
+		g.gapiError(w, http.StatusNotFound, fmt.Sprintf("%s/%s not found", bucket, filename))
+		return
+	}
+
+	w.Header().Set("Content-Type", obj.ContentType)
+	w.Header().Set("X-Goog-Generation", strconv.FormatInt(obj.Generation, 10))
+	w.Header().Set("X-Goog-Metageneration", strconv.FormatInt(obj.Metageneration, 10))
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+	w.Header().Set("Access-Control-Expose-Headers", "Content-Type, Content-Length, Content-Encoding, Date, X-Goog-Generation, X-Goog-Metageneration")
+	w.Header().Set("Content-Disposition", obj.ContentDisposition)
+
+	if obj.ContentEncoding == "gzip" {
+		if strings.Contains(acceptEncoding, "gzip") {
+			w.Header().Set("Content-Encoding", "gzip")
+		} else {
+			// Uncompress on behalf of the client.
+			buf := bytes.NewBuffer(contents)
+			gzipReader, err := gzip.NewReader(buf)
+			if err != nil {
+				g.gapiError(w, http.StatusInternalServerError, fmt.Sprintf("failed to gunzip from %s/%s: %s", bucket, filename, err))
+			}
+			if _, err := io.Copy(w, gzipReader); err != nil {
+				g.gapiError(w, http.StatusInternalServerError, fmt.Sprintf("failed to copy+gunzip from %s/%s: %s", bucket, filename, err))
+			}
+			if err := gzipReader.Close(); err != nil {
+				g.gapiError(w, http.StatusInternalServerError, fmt.Sprintf("failed to copy+gunzip from %s/%s: %s", bucket, filename, err))
+			}
+			return
+		}
+	}
+
+	// Just write the contents
+	w.Header().Set("Content-Length", strconv.Itoa(len(contents)))
+	if _, err := w.Write(contents); err != nil {
+		g.gapiError(w, http.StatusInternalServerError, fmt.Sprintf("failed to copy from %s/%s: %s", bucket, filename, err))
+	}
+}
+
+func (g *GcsEmu) handleGcsMetadataRequest(baseUrl HttpBaseUrl, w http.ResponseWriter, bucket string, filename string) {
+	var obj interface{}
+	var err error
+	if filename == "" {
+		var b *storage.Bucket
+		b, err = g.store.GetBucketMeta(baseUrl, bucket)
+		if b != nil {
+			obj = b
+		}
+	} else {
+		var o *storage.Object
+		o, err = g.store.GetMeta(baseUrl, bucket, filename)
+		if o != nil {
+			obj = o
+		}
+	}
+
+	if err != nil {
+		g.gapiError(w, http.StatusInternalServerError, fmt.Sprintf("failed to get meta for %s/%s: %s", bucket, filename, err))
+		return
+	}
+	if obj == nil {
+		g.gapiError(w, http.StatusNotFound, fmt.Sprintf("%s/%s not found", bucket, filename))
+		return
+	}
+	g.jsonRespond(w, obj)
+}
+
+func (g *GcsEmu) handleGcsUpdateMetadataRequest(ctx context.Context, baseUrl HttpBaseUrl, w http.ResponseWriter, r *http.Request, bucket, filename string, conds cloudstorage.Conditions) {
+	var obj *storage.Object
+	err := g.locks.Run(ctx, lockName(bucket, filename), func(ctx context.Context) error {
+		// Find the existing file / meta.
+		var err error
+		obj, err = g.store.GetMeta(baseUrl, bucket, filename)
+		if err != nil {
+			return fmt.Errorf("failed to check existence of %s/%s: %w", bucket, filename, err)
+		}
+
+		if obj == nil {
+			return nil
+		}
+
+		if err := validateConds(obj, conds); err != nil {
+			return err
+		}
+
+		// Update via json decode.
+		metagen := obj.Metageneration
+		err = json.NewDecoder(r.Body).Decode(&obj)
+		if err != nil {
+			return fmtErrorfCode(http.StatusBadRequest, "failed to parse request: %w", err)
+		}
+
+		if err := g.store.UpdateMeta(bucket, filename, obj, metagen+1); err != nil {
+			return fmt.Errorf("failed to update attrs of %s/%s: %w", bucket, filename, err)
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		g.gapiError(w, httpStatusCodeOf(err), err.Error())
+		return
+	}
+	if obj == nil {
+		g.gapiError(w, http.StatusNotFound, fmt.Sprintf("%s/%s not found", bucket, filename))
+		return
+	}
+
+	// Respond with the updated metadata.
+	obj, err = g.store.GetMeta(baseUrl, bucket, filename)
+	if err != nil {
+		g.gapiError(w, http.StatusInternalServerError, fmt.Sprintf("failed to get meta for %s/%s: %s", bucket, filename, err))
+		return
+	}
+	g.jsonRespond(w, obj)
+}
+
+func (g *GcsEmu) handleGcsCopy(ctx context.Context, baseUrl HttpBaseUrl, w http.ResponseWriter, b1 string, objectPaths string) {
+	// TODO(dk): this operation supports conditionals and metadata rewriting, but the emulator implementation currently does not.
+	// See https://cloud.google.com/storage/docs/json_api/v1/objects/rewrite
+	parts := strings.Split(objectPaths, "/rewriteTo/b/")
+	// Copy is implemented using the Rewrite API, with object strings of format /o/sourceObject/rewriteTo/b/destinationBucket/o/destinationObject
+	if len(parts) != 2 {
+		g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("Bad rewrite request format: %s", objectPaths))
+		return
+	}
+	f1 := parts[0]
+	destParts := strings.Split(parts[1], "/o/")
+	if len(parts) != 2 {
+		g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("Bad rewrite request, expected object/file split: %s", parts[1]))
+		return
+	}
+	b2 := destParts[0]
+	f2 := destParts[1]
+
+	// Must lock the destination object.
+	var obj *storage.Object
+	err := g.locks.Run(ctx, lockName(b2, f2), func(ctx context.Context) error {
+		if ok, err := g.store.Copy(b1, f1, b2, f2); err != nil {
+			return err
+		} else if !ok {
+			return nil // file missing
+		} else {
+			obj, err = g.store.GetMeta(baseUrl, b2, f2)
+			return err
+		}
+	})
+	if err != nil {
+		g.gapiError(w, httpStatusCodeOf(err), fmt.Sprintf("failed to copy: %s", err))
+		return
+	}
+	if obj == nil {
+		g.gapiError(w, http.StatusNotFound, fmt.Sprintf("%s not found", b1+"/"+f1))
+		return
+	}
+
+	rr := storage.RewriteResponse{
+		Kind:                "storage#rewriteResponse",
+		TotalBytesRewritten: int64(obj.Size),
+		ObjectSize:          int64(obj.Size),
+		Done:                true,
+		RewriteToken:        "-not-implemented-",
+		Resource:            obj,
+	}
+
+	g.jsonRespond(w, &rr)
+}
+
+type uploadData struct {
+	Object storage.Object
+	Conds  cloudstorage.Conditions
+	data   []byte
+}
+
+func (g *GcsEmu) handleGcsNewBucket(ctx context.Context, w http.ResponseWriter, r *http.Request, _ cloudstorage.Conditions) {
+	var bucket storage.Bucket
+	if err := json.NewDecoder(r.Body).Decode(&bucket); err != nil {
+		g.gapiError(w, http.StatusBadRequest, "failed to parse body as json")
+		return
+	}
+	bucketName := bucket.Name
+
+	err := g.locks.Run(ctx, lockName(bucketName, ""), func(ctx context.Context) error {
+		if err := g.store.CreateBucket(bucketName); err != nil {
+			return fmt.Errorf("could not create bucket %s: %w", bucketName, err)
+		}
+		return nil
+	})
+
+	if err != nil {
+		g.gapiError(w, httpStatusCodeOf(err), err.Error())
+		return
+	}
+
+	g.jsonRespond(w, bucket)
+}
+
+func (g *GcsEmu) handleGcsNewObject(ctx context.Context, baseUrl HttpBaseUrl, w http.ResponseWriter, r *http.Request, bucket string, conds cloudstorage.Conditions) {
+	switch r.Form.Get("uploadType") {
+	case "media":
+		// simple upload
+		name := r.Form.Get("name")
+		if name == "" {
+			g.gapiError(w, http.StatusBadRequest, "missing object name")
+			return
+		}
+
+		contents, err := io.ReadAll(r.Body)
+		if err != nil {
+			g.gapiError(w, http.StatusBadRequest, "failed to read body")
+			return
+		}
+
+		obj := &storage.Object{
+			Bucket:      bucket,
+			ContentType: r.Header.Get("Content-Type"),
+			Name:        name,
+			Size:        uint64(len(contents)),
+		}
+
+		meta, err := g.finishUpload(ctx, baseUrl, obj, contents, bucket, conds)
+		if err != nil {
+			g.gapiError(w, httpStatusCodeOf(err), err.Error())
+			return
+		}
+
+		w.Header().Set("x-goog-generation", strconv.FormatInt(meta.Generation, 10))
+		w.Header().Set("X-Goog-Metageneration", strconv.FormatInt(meta.Metageneration, 10))
+		g.jsonRespond(w, meta)
+		return
+	case "resumable":
+		var obj storage.Object
+		if err := json.NewDecoder(r.Body).Decode(&obj); err != nil {
+			g.gapiError(w, http.StatusBadRequest, "failed to parse body as json")
+			return
+		}
+		obj.Bucket = bucket
+
+		nextId := atomic.AddInt32(&g.idCounter, 1)
+		id := strconv.Itoa(int(nextId))
+		_ = g.uploadIds.Set(id, &uploadData{
+			Object: obj,
+			Conds:  conds,
+		})
+
+		w.Header().Set("Location", ObjectUrl(baseUrl, bucket, obj.Name)+"?upload_id="+id)
+		w.Header().Set("Content-Type", obj.ContentType)
+		w.WriteHeader(http.StatusCreated)
+		return
+	case "multipart":
+		obj, contents, err := readMultipartInsert(r)
+		if err != nil {
+			g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("failed to parse request: %s", err))
+			return
+		}
+
+		meta, err := g.finishUpload(ctx, baseUrl, obj, contents, bucket, conds)
+		if err != nil {
+			g.gapiError(w, httpStatusCodeOf(err), err.Error())
+			return
+		}
+
+		w.Header().Set("x-goog-generation", strconv.FormatInt(meta.Generation, 10))
+		w.Header().Set("X-Goog-Metageneration", strconv.FormatInt(meta.Metageneration, 10))
+		g.jsonRespond(w, meta)
+		return
+	default:
+		// TODO
+		g.gapiError(w, http.StatusNotImplemented, "not yet implemented")
+		return
+
+	}
+}
+
+func (g *GcsEmu) handleGcsNewObjectResume(ctx context.Context, baseUrl HttpBaseUrl, w http.ResponseWriter, r *http.Request, id string) {
+	found, err := g.uploadIds.GetIFPresent(id)
+	if err != nil {
+		g.gapiError(w, http.StatusInternalServerError, fmt.Sprintf("unexpected error: %s", err))
+		return
+	}
+	if found == nil {
+		g.gapiError(w, http.StatusNotFound, "no such id")
+		return
+	}
+
+	u := found.(*uploadData)
+
+	contents, err := io.ReadAll(r.Body)
+	if err != nil {
+		g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("failed to ready body: %s", err))
+		return
+	}
+
+	contentRange := r.Header.Get("Content-Range")
+	if contentRange == "" {
+		g.gapiError(w, http.StatusBadRequest, "expected Content-Range")
+		return
+	}
+
+	// Parse the content range
+	byteRange := parseByteRange(contentRange)
+	if byteRange == nil {
+		g.gapiError(w, http.StatusBadRequest, "malformed Content-Range header")
+		return
+	}
+
+	if byteRange.lo == -1 && len(contents) != 0 || byteRange.lo != -1 && len(contents) != int(byteRange.hi+1-byteRange.lo) {
+		g.gapiError(w, http.StatusBadRequest, fmt.Sprintf("Content-Range does not match content size: range=%v, len=%v", contentRange, len(contents)))
+		return
+	}
+
+	if len(u.data) < int(byteRange.lo) {
+		g.gapiError(w, http.StatusBadRequest, "missing content")
+		return
+	}
+
+	// Apply the content to our stored data.
+	if byteRange.lo != -1 {
+		u.data = u.data[:byteRange.lo] // truncate a previous write if we've seen this range before
+	}
+	u.data = append(u.data, contents...)
+
+	// Are we done?
+	if byteRange.sz < 0 || len(u.data) < int(byteRange.sz) {
+		// Not finished; save the contents and tell the client to resume.
+		w.Header().Set("Range", fmt.Sprintf("bytes=0-%d", len(u.data)-1))
+		w.Header().Set("Content-Type", u.Object.ContentType)
+		if r.Header.Get("X-Guploader-No-308") == "yes" {
+			w.Header().Set("X-Http-Status-Code-Override", "308")
+			w.WriteHeader(http.StatusOK)
+		} else {
+			w.WriteHeader(http.StatusPermanentRedirect)
+		}
+		return
+	}
+
+	// Done
+	meta, err := g.finishUpload(ctx, baseUrl, &u.Object, u.data, u.Object.Bucket, u.Conds)
+	if err != nil {
+		g.gapiError(w, httpStatusCodeOf(err), err.Error())
+		return
+	}
+
+	g.uploadIds.Remove(id)
+	w.Header().Set("x-goog-generation", strconv.FormatInt(meta.Generation, 10))
+	w.Header().Set("X-Goog-Metageneration", strconv.FormatInt(meta.Metageneration, 10))
+	g.jsonRespond(w, meta)
+}
+
+func (g *GcsEmu) finishUpload(ctx context.Context, baseUrl HttpBaseUrl, obj *storage.Object, contents []byte, bucket string, conds cloudstorage.Conditions) (*storage.Object, error) {
+	filename := obj.Name
+	bHash := md5.Sum(contents)
+	contentHash := bHash[:]
+	md5Hash := base64.StdEncoding.EncodeToString(contentHash)
+	if obj.Md5Hash != "" {
+		h, err := base64.StdEncoding.DecodeString(obj.Md5Hash)
+		if err != nil {
+			return nil, fmtErrorfCode(http.StatusBadRequest, "not a valid md5 hash: %w", err)
+		}
+		if !bytes.Equal(contentHash, h) {
+			return nil, fmtErrorfCode(http.StatusBadRequest, "md5 hash %s != expected %s", obj.Md5Hash, md5Hash)
+		}
+	}
+	obj.Md5Hash = md5Hash
+	obj.Etag = strconv.Quote(md5Hash)
+
+	err := g.locks.Run(ctx, lockName(bucket, filename), func(ctx context.Context) error {
+		// Find the existing file / meta.
+		existing, err := g.store.GetMeta(baseUrl, bucket, filename)
+		if err != nil {
+			return fmt.Errorf("failed to check existence of %s/%s: %w", bucket, filename, err)
+		}
+
+		if err := validateConds(existing, conds); err != nil {
+			return err
+		}
+
+		if existing != nil {
+			obj.TimeCreated = existing.TimeCreated
+		}
+
+		if err := g.store.Add(bucket, filename, contents, obj); err != nil {
+			return fmt.Errorf("failed to create %s/%s: %w", bucket, filename, err)
+		}
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	// respond with object metadata
+	meta, err := g.store.GetMeta(baseUrl, bucket, filename)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get meta for %s/%s: %w", bucket, filename, err)
+	}
+
+	meta.Id = fmt.Sprintf("%s/%s/%d", bucket, filename, meta.Generation)
+	return meta, nil
+}
+
+// Returns true if item is strictly greater than anything that begins with prefix
+func greaterThanPrefix(item string, prefix string) bool {
+	if len(item) < len(prefix) {
+		return item > prefix
+	}
+	return item[:len(prefix)] > prefix
+}
+
+// Returns true if item is strictly less than anything that begins with prefix
+func lessThanPrefix(item string, prefix string) bool {
+	if len(item) < len(prefix) {
+		return item < prefix[:len(item)]
+	}
+	return item < prefix
+}
+
+var (
+	emptyConds        = cloudstorage.Conditions{}
+	doesNotExistConds = cloudstorage.Conditions{DoesNotExist: true}
+)
+
+func validateConds(obj *storage.Object, cond cloudstorage.Conditions) error {
+	if obj == nil {
+		// The only way a nil object can succeed is if the conds are exactly equal to empty or doesNotExist
+		if cond == emptyConds || cond == doesNotExistConds {
+			return nil
+		}
+		return fmtErrorfCode(http.StatusPreconditionFailed, "precondition failed")
+	}
+
+	// obj != nil from here on
+
+	if cond.DoesNotExist {
+		return fmtErrorfCode(http.StatusPreconditionFailed, "precondition failed")
+	}
+
+	if cond.GenerationMatch != 0 && obj.Generation != cond.GenerationMatch {
+		return fmtErrorfCode(http.StatusPreconditionFailed, "precondition failed")
+	}
+
+	if cond.GenerationNotMatch != 0 && obj.Generation == cond.GenerationNotMatch {
+		// not-match failures use a different code
+		return fmtErrorfCode(http.StatusNotModified, "precondition failed")
+	}
+
+	if cond.MetagenerationMatch != 0 && obj.Metageneration != cond.MetagenerationMatch {
+		return fmtErrorfCode(http.StatusPreconditionFailed, "precondition failed")
+	}
+
+	if cond.MetagenerationNotMatch != 0 && obj.Metageneration == cond.MetagenerationNotMatch {
+		// not-match failures use a different code
+		return fmtErrorfCode(http.StatusNotModified, "precondition failed")
+	}
+
+	return nil
+}
+
+func parseConds(vals url.Values) (cloudstorage.Conditions, error) {
+	var ret cloudstorage.Conditions
+	for i, e := range []struct {
+		paramName string
+		ref       *int64
+	}{
+		{"ifGenerationMatch", &ret.GenerationMatch},
+		{"ifGenerationNotMatch", &ret.GenerationNotMatch},
+		{"ifMetagenerationMatch", &ret.MetagenerationMatch},
+		{"ifMetagenerationNotMatch", &ret.MetagenerationNotMatch},
+	} {
+		v := vals.Get(e.paramName)
+		if v == "" {
+			continue
+		}
+		val, err := strconv.ParseInt(v, 10, 64)
+		if err != nil {
+			return ret, fmt.Errorf("failed to parse %s=%s: %w", e.paramName, v, err)
+		}
+		*e.ref = val
+		if i == 0 {
+			// Special case
+			ret.DoesNotExist = val == 0
+		}
+	}
+
+	return ret, nil
+}
+
+const (
+	gcsMaxComposeSources = 32
+)
+
+func (g *GcsEmu) finishCompose(baseUrl HttpBaseUrl, bucket string, dst composeObj, srcs []composeObj, meta *storage.Object) (*storage.Object, error) {
+	if len(srcs) > gcsMaxComposeSources {
+		return nil, fmtErrorfCode(http.StatusBadRequest, "too many sources")
+	}
+
+	// TODO: consider moving this to disk to handle very large compose operations
+	var data []byte
+	metas := make([]*storage.Object, len(srcs))
+	for i, src := range srcs {
+		meta, contents, err := g.store.Get(baseUrl, bucket, src.filename)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get object %s: %w", src.filename, err)
+		}
+		if meta == nil {
+			return nil, fmtErrorfCode(http.StatusNotFound, "no such source object %s", src.filename)
+		}
+		if err := validateConds(meta, src.conds); err != nil {
+			return nil, err
+		}
+		data = append(data, contents...)
+		metas[i] = meta
+	}
+
+	for _, m := range metas {
+		meta.ComponentCount += m.ComponentCount
+	}
+	// composite objects do not have an MD5 hash (https://cloud.google.com/storage/docs/composite-objects)
+	meta.Md5Hash = ""
+
+	dstMeta, err := g.store.GetMeta(baseUrl, bucket, dst.filename)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get object %s: %w", dst.filename, err)
+	}
+	if err := validateConds(dstMeta, dst.conds); err != nil {
+		return nil, err
+	}
+	if dstMeta != nil {
+		meta.TimeCreated = dstMeta.TimeCreated
+	}
+	if err := g.store.Add(bucket, dst.filename, data, meta); err != nil {
+		return nil, fmt.Errorf("failed to add new file: %w", err)
+	}
+	return g.store.GetMeta(baseUrl, bucket, dst.filename)
+}
+
+// InitBucket creates the given bucket directly.
+func (g *GcsEmu) InitBucket(bucketName string) error {
+	return g.locks.Run(context.Background(), lockName(bucketName, ""), func(ctx context.Context) error {
+		if err := g.store.CreateBucket(bucketName); err != nil {
+			return fmt.Errorf("could not create bucket: %s: %w", bucketName, err)
+		}
+		return nil
+	})
+}
diff --git a/pkg/emulators/storage/gcsemu/gcsemu_test.go b/pkg/emulators/storage/gcsemu/gcsemu_test.go
new file mode 100644
index 0000000000..d201de3f92
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/gcsemu_test.go
@@ -0,0 +1,593 @@
+package gcsemu
+
+import (
+	"context"
+	"crypto/md5"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+
+	"cloud.google.com/go/storage"
+	"google.golang.org/api/googleapi"
+	"google.golang.org/api/iterator"
+	"gotest.tools/v3/assert"
+)
+
+const (
+	invalidBucketName = "fullstory-non-existant-bucket"
+)
+
+var (
+	testCases = []struct {
+		name string
+		f    func(t *testing.T, bh BucketHandle)
+	}{
+		{"Basics", testBasics},
+		{"MultipleFiles", testMultipleFiles},
+		{"HugeFile", testHugeFile},
+		{"HugeFile_MultipleOfChunkSize", testHugeFileMultipleOfChunkSize},
+		{"HugeFileWithConditional", testHugeFileWithConditional},
+		{"ConditionalUpdates", testConditionalUpdates},
+		{"GenNotMatchDoesntExist", testGenNotMatchDoesntExist},
+		{"CopyBasics", testCopyBasics},
+		{"Compose", testCompose},
+		{"CopyMetadata", testCopyMetadata},
+		{"CopyConditionals", testCopyConditionals},
+	}
+)
+
+const (
+	v1      = `This file is for gcsemu_intg_test.go, please ignore (v1)`
+	v2      = `This file is for gcsemu_intg_test.go, please ignore (this is version 2)`
+	source1 = `This is source file number 1`
+	source2 = `This is source file number 2`
+)
+
+type BucketHandle struct {
+	Name string
+	*storage.BucketHandle
+}
+
+func initBucket(t *testing.T, bh BucketHandle) {
+	ctx := context.Background()
+
+	_ = bh.Delete(ctx)
+	err := bh.Create(ctx, "dev", &storage.BucketAttrs{})
+	assert.NilError(t, err, "failed")
+
+	attrs, err := bh.Attrs(ctx)
+	assert.NilError(t, err, "failed")
+	assert.Equal(t, bh.Name, attrs.Name, "wrong")
+}
+
+func testBasics(t *testing.T, bh BucketHandle) {
+	const name = "gscemu-test/1.txt"
+	ctx := context.Background()
+	oh := bh.Object(name)
+
+	// Forcibly delete the object at the start, make sure it doesn't exist.
+	err := oh.Delete(ctx)
+	if err != nil {
+		assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+	}
+
+	// Should not exist.
+	_, err = oh.Attrs(ctx)
+	assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+
+	// Checker funcs
+	checkAttrs := func(attrs *storage.ObjectAttrs, content string, metagen int64) {
+		assert.Equal(t, name, attrs.Name, "wrong")
+		assert.Equal(t, bh.Name, attrs.Bucket, "wrong")
+		assert.Equal(t, int64(len(content)), attrs.Size, "wrong")
+		assert.Equal(t, metagen, attrs.Metageneration, "wrong")
+		checkSum := md5.Sum([]byte(content))
+		assert.DeepEqual(t, checkSum[:], attrs.MD5)
+	}
+
+	checkObject := func(content string, metagen int64) *storage.ObjectAttrs {
+		attrs, err := oh.Attrs(ctx)
+		assert.NilError(t, err, "failed")
+		checkAttrs(attrs, content, metagen)
+
+		r, err := oh.NewReader(ctx)
+		assert.NilError(t, err, "failed")
+		data, err := io.ReadAll(r)
+		assert.NilError(t, err, "failed")
+		assert.NilError(t, r.Close(), "failed")
+		assert.Equal(t, content, string(data), "wrong data")
+		return attrs
+	}
+
+	// Create the object.
+	w := oh.NewWriter(ctx)
+	assert.NilError(t, write(w, v1), "failed")
+	checkAttrs(w.Attrs(), v1, 1)
+
+	// Read the object.
+	attrs := checkObject(v1, 1)
+	assert.Assert(t, attrs.Generation != 0, "expected non-zero")
+	gen := attrs.Generation
+
+	// Update the object to version 2.  Also test MD5 setting.
+	w = oh.NewWriter(ctx)
+	checkSum := md5.Sum([]byte(v2))
+	w.MD5 = checkSum[:]
+	assert.NilError(t, write(w, v2), "failed")
+	checkAttrs(w.Attrs(), v2, 1)
+	assert.Assert(t, gen != w.Attrs().Generation, "expected different gen")
+	gen = w.Attrs().Generation
+
+	// Read the object again.
+	attrs = checkObject(v2, 1)
+	assert.Equal(t, gen, attrs.Generation, "expected same gen")
+
+	// Update the attrs.
+	attrs, err = oh.Update(ctx, storage.ObjectAttrsToUpdate{
+		ContentType: "text/plain",
+	})
+	assert.NilError(t, err, "failed")
+	checkAttrs(attrs, v2, 2)
+	assert.Equal(t, "text/plain", attrs.ContentType, "wrong")
+	assert.Equal(t, gen, attrs.Generation, "expected same gen")
+
+	// Delete the object.
+	assert.NilError(t, oh.Delete(ctx), "failed")
+
+	// Should not exist.
+	_, err = oh.Attrs(ctx)
+	assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+
+	// Should not be able to update attrs.
+	_, err = oh.Update(ctx, storage.ObjectAttrsToUpdate{
+		ContentType: "text/plain",
+	})
+	assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+}
+
+func testMultipleFiles(t *testing.T, bh BucketHandle) {
+	dir := "multi-test/"
+	ctx := context.Background()
+
+	files := []string{"file1", "file2", "file3"}
+	for _, f := range files {
+		oh := bh.Object(dir + f)
+		w := oh.NewWriter(ctx)
+		assert.NilError(t, write(w, v1), "failed to write file %s", dir+f)
+	}
+
+	iter := bh.Objects(ctx, &storage.Query{Prefix: dir})
+	for _, f := range files {
+		obj, err := iter.Next()
+		assert.NilError(t, err, "failed to fetch next object")
+		assert.Equal(t, dir+f, obj.Name, "wrong filename")
+	}
+
+	// No more objects should exist
+	_, err := iter.Next()
+	assert.Equal(t, iterator.Done, err, "iteration not finished or failed after first bucket object")
+}
+
+// Tests resumable GCS uploads.
+func testHugeFile(t *testing.T, bh BucketHandle) {
+	doHugeFile(t, bh, "gscemu-test/huge.txt", googleapi.DefaultUploadChunkSize+4*1024*1024)
+}
+
+func testHugeFileMultipleOfChunkSize(t *testing.T, bh BucketHandle) {
+	doHugeFile(t, bh, "gscemu-test/huge2.txt", googleapi.DefaultUploadChunkSize*4)
+}
+
+func doHugeFile(t *testing.T, bh BucketHandle, name string, size int) {
+	ctx := context.Background()
+	oh := bh.Object(name)
+
+	// Forcibly delete the object at the start, make sure it doesn't exist.
+	err := oh.Delete(ctx)
+	if err != nil {
+		assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+	}
+
+	// Should not exist.
+	_, err = oh.Attrs(ctx)
+	assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+
+	// Create the object.
+	w := oh.NewWriter(ctx)
+	hash, err := writeHugeObject(t, w, size)
+	assert.NilError(t, err, "failed")
+
+	attrs, err := oh.Attrs(ctx)
+	assert.NilError(t, err, "failed")
+	assert.Equal(t, size, int(attrs.Size), "wrong")
+	assert.DeepEqual(t, hash, attrs.MD5)
+}
+
+func writeHugeObject(t *testing.T, w *storage.Writer, sz int) ([]byte, error) {
+	data := []byte(`0123456789ABCDEF`)
+	hash := md5.New()
+	for i := 0; i < sz/len(data); i++ {
+		n, err := w.Write(data)
+		_, _ = hash.Write(data)
+		assert.NilError(t, err, "failed")
+		assert.Equal(t, n, len(data), "short write")
+	}
+	return hash.Sum(nil), w.Close()
+}
+
+// Tests resumable GCS uploads.
+func testHugeFileWithConditional(t *testing.T, bh BucketHandle) {
+	const name = "gscemu-test/huge2.txt"
+	const size = googleapi.DefaultUploadChunkSize*2 + 1024
+
+	ctx := context.Background()
+	oh := bh.Object(name)
+
+	// Forcibly delete the object at the start, make sure it doesn't exist.
+	err := oh.Delete(ctx)
+	if err != nil {
+		assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+	}
+
+	// Should not exist.
+	_, err = oh.Attrs(ctx)
+	assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+
+	// Create the object.
+	w := oh.If(storage.Conditions{DoesNotExist: true}).NewWriter(ctx)
+	hash, err := writeHugeObject(t, w, size)
+	assert.NilError(t, err, "failed")
+
+	attrs, err := oh.Attrs(ctx)
+	assert.NilError(t, err, "failed")
+	assert.Equal(t, size, int(attrs.Size), "wrong")
+	assert.DeepEqual(t, hash, attrs.MD5)
+
+	// Should fail this time.
+	w = oh.If(storage.Conditions{DoesNotExist: true}).NewWriter(ctx)
+	_, err = writeHugeObject(t, w, size)
+	assert.Equal(t, http.StatusPreconditionFailed, httpStatusCodeOf(err), "wrong error %T: %s", err, err)
+}
+
+func testConditionalUpdates(t *testing.T, bh BucketHandle) {
+	const name = "gscemu-test/2.txt"
+	ctx := context.Background()
+	oh := bh.Object(name)
+
+	// Forcibly delete the object at the start, make sure it doesn't exist.
+	err := oh.Delete(ctx)
+	if err != nil {
+		assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+	}
+
+	// Ensure write fails
+	w := oh.If(storage.Conditions{GenerationMatch: 1}).NewWriter(ctx)
+	err = write(w, "bogus")
+	assert.Equal(t, http.StatusPreconditionFailed, httpStatusCodeOf(err), "wrong error %T: %s", err, err)
+
+	// Now actually write it.
+	w = oh.If(storage.Conditions{DoesNotExist: true}).NewWriter(ctx)
+	assert.NilError(t, write(w, v1), "failed")
+	attrs := w.Attrs()
+	t.Logf("attrs.Generation=%d attrs.Metageneration=%d", attrs.Generation, attrs.Metageneration)
+
+	expectFailConds := func(expectCode int, conds storage.Conditions) {
+		// Ensure attr update fails.
+		_, err = oh.If(conds).Update(ctx, storage.ObjectAttrsToUpdate{ContentType: "text/plain"})
+		assert.Equal(t, expectCode, httpStatusCodeOf(err), "wrong error %T: %s", err, err)
+
+		// Ensure write fails
+		w := oh.If(conds).NewWriter(ctx)
+		err = write(w, "bogus")
+		assert.Equal(t, expectCode, httpStatusCodeOf(err), "wrong error %T: %s", err, err)
+
+		// Ensure delete fails
+		err = oh.If(conds).Delete(ctx)
+		assert.Equal(t, expectCode, httpStatusCodeOf(err), "wrong error %T: %s", err, err)
+	}
+
+	for i, conds := range []storage.Conditions{
+		{
+			DoesNotExist: true,
+		},
+		{
+			GenerationMatch: attrs.Generation + 1,
+		},
+		{
+			MetagenerationMatch: attrs.Metageneration + 1,
+		},
+		{
+			GenerationMatch:     attrs.Generation,
+			MetagenerationMatch: attrs.Metageneration + 1,
+		},
+		{
+			GenerationMatch:     attrs.Generation + 1,
+			MetagenerationMatch: attrs.Metageneration,
+		},
+		{
+			GenerationNotMatch: attrs.Generation,
+		},
+		{
+			MetagenerationNotMatch: attrs.Metageneration,
+		},
+		{
+			GenerationNotMatch:  attrs.Generation,
+			MetagenerationMatch: attrs.Metageneration,
+		},
+		{
+			GenerationMatch:        attrs.Generation,
+			MetagenerationNotMatch: attrs.Metageneration,
+		},
+	} {
+		t.Logf("case %d", i)
+		expectCode := http.StatusPreconditionFailed
+		if i >= 5 {
+			// For some reason, "not match" cases return 304 rather than 412.
+			expectCode = http.StatusNotModified
+		}
+		expectFailConds(expectCode, conds)
+	}
+
+	// Actually update the attrs.
+	attrs, err = oh.If(storage.Conditions{
+		GenerationMatch:     attrs.Generation,
+		MetagenerationMatch: attrs.Metageneration,
+	}).Update(ctx, storage.ObjectAttrsToUpdate{
+		ContentType: "text/plain",
+	})
+	assert.NilError(t, err, "failed")
+
+	// Actually update the content.
+	w = oh.If(storage.Conditions{
+		GenerationMatch:     attrs.Generation,
+		MetagenerationMatch: attrs.Metageneration,
+	}).NewWriter(ctx)
+	assert.NilError(t, write(w, v2), "failed")
+	attrs = w.Attrs()
+
+	// Actually delete.
+	err = oh.If(storage.Conditions{
+		GenerationMatch:     attrs.Generation,
+		MetagenerationMatch: attrs.Metageneration,
+	}).Delete(ctx)
+	assert.NilError(t, err, "failed")
+
+	// Should not exist.
+	_, err = oh.Attrs(ctx)
+	assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+}
+
+func testGenNotMatchDoesntExist(t *testing.T, bh BucketHandle) {
+	// How does generation not match interact with a non-existent file?
+
+	const name = "gscemu-test-gen-not-match.txt"
+	ctx := context.Background()
+	oh := bh.Object(name)
+
+	// Forcibly delete the object at the start, make sure it doesn't exist.
+	err := oh.Delete(ctx)
+	if err != nil {
+		assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+	}
+
+	// Write should fail on non-existent object, even though the generation doesn't match.
+	w := oh.If(storage.Conditions{GenerationNotMatch: 1}).NewWriter(ctx)
+	err = write(w, "bogus")
+	assert.Equal(t, http.StatusPreconditionFailed, httpStatusCodeOf(err), "wrong error %T: %s", err, err)
+}
+
+func testCopyBasics(t *testing.T, bh BucketHandle) {
+	ctx := context.Background()
+
+	file1 := "file-1"
+	file2 := "file-1-again"
+
+	src := bh.Object(file1)
+	dest := bh.Object(file2)
+
+	// Forcibly delete the object at the start, make sure it doesn't exist.
+	_ = src.Delete(ctx)
+	_ = dest.Delete(ctx)
+
+	// Should not exist.
+	_, err := src.Attrs(ctx)
+	assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+
+	// Create the object.
+	w := src.NewWriter(ctx)
+	n, err := io.Copy(w, strings.NewReader(v1))
+	assert.NilError(t, err, "failed")
+	assert.Equal(t, n, int64(len(v1)), "wrong length")
+	assert.NilError(t, w.Close(), "failed")
+
+	// Wait a ms to ensure different timestamps.
+	time.Sleep(time.Millisecond)
+
+	// Copy the object
+	destAttrs, err := dest.CopierFrom(src).Run(ctx)
+	assert.NilError(t, err, "failed to copy")
+
+	// Read the object.
+	r, err := dest.NewReader(ctx)
+	assert.NilError(t, err, "failed")
+	data, err := io.ReadAll(r)
+	assert.NilError(t, err, "failed")
+	assert.NilError(t, r.Close(), "failed")
+	assert.Equal(t, string(data), v1, "wrong data")
+
+	// Check the metadata reread correct
+	reDestAttrs, err := dest.Attrs(ctx)
+	assert.NilError(t, err, "failed")
+	assert.DeepEqual(t, destAttrs, reDestAttrs)
+
+	// Check the metadata was copied and makes sense.
+	srcAttrs, err := src.Attrs(ctx)
+	assert.NilError(t, err, "failed")
+	expectAttrs := *srcAttrs
+
+	// Some things should be different
+	assert.Assert(t, srcAttrs.Name != destAttrs.Name, "should not equal: %s", destAttrs.Name)
+	expectAttrs.Name = destAttrs.Name
+
+	assert.Assert(t, srcAttrs.MediaLink != destAttrs.MediaLink, "should not equal: %s", destAttrs.MediaLink)
+	expectAttrs.MediaLink = destAttrs.MediaLink
+
+	assert.Assert(t, srcAttrs.Generation != destAttrs.Generation, "should not equal: %d", destAttrs.Generation)
+	expectAttrs.Generation = destAttrs.Generation
+
+	assert.Assert(t, srcAttrs.Created != destAttrs.Created, "should not equal: %s", destAttrs.Created)
+	expectAttrs.Created = destAttrs.Created
+
+	assert.Assert(t, srcAttrs.Updated != destAttrs.Updated, "should not equal: %s", destAttrs.Updated)
+	expectAttrs.Updated = destAttrs.Updated
+
+	expectAttrs.Etag = destAttrs.Etag
+
+	// Rest should be same
+	assert.DeepEqual(t, expectAttrs, *destAttrs)
+
+	// Delete the object.
+	assert.NilError(t, src.Delete(ctx), "failed")
+	assert.NilError(t, dest.Delete(ctx), "failed")
+
+	// Copy an object that doesn't exist
+	_, err = dest.CopierFrom(src).Run(ctx)
+	assert.Equal(t, http.StatusNotFound, httpStatusCodeOf(err), "wrong error %T: %s", err, err)
+}
+
+func testCompose(t *testing.T, bh BucketHandle) {
+	ctx := context.Background()
+
+	srcFiles := []string{source1, source2}
+	srcGens := []int64{0, 0}
+	manualCompose := ""
+	dstName := "gcs-test-data/dest.txt"
+	dstNameSecondary := "gcs-test-data/dest-secondary.txt"
+
+	srcs := make([]*storage.ObjectHandle, len(srcFiles))
+	for i, src := range srcFiles {
+		name := fmt.Sprintf("gcs-test-sources/src-%d.txt", i)
+		srcs[i] = bh.Object(name)
+		// Forcibly delete the object at the start, make sure it doesn't exist.
+		_ = srcs[i].Delete(ctx)
+
+		// Should not exist.
+		_, err := srcs[i].Attrs(ctx)
+		assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+
+		// Create the object.
+		w := srcs[i].NewWriter(ctx)
+		w.ContentType = "text/csv"
+		n, err := io.Copy(w, strings.NewReader(src))
+		assert.NilError(t, err, "failed")
+		assert.Equal(t, n, int64(len(src)), "wrong length")
+		assert.NilError(t, w.Close(), "failed")
+		srcGens[i] = w.Attrs().Generation
+
+		manualCompose += src
+	}
+
+	dest := bh.Object(dstName)
+
+	destSecondary := bh.Object(dstNameSecondary)
+	err := destSecondary.Delete(ctx) // this one needs to be deleted to start
+	assert.Assert(t, err == nil || err == storage.ErrObjectNotExist, "failed to delete secondary")
+
+	composer := dest.ComposerFrom(srcs...)
+	composer.ContentType = "text/plain"
+	attrs, err := composer.Run(ctx)
+	assert.NilError(t, err, "failed to run compose")
+
+	assert.Equal(t, dest.BucketName(), attrs.Bucket, "bucket doesn't match")
+	assert.Equal(t, dest.ObjectName(), attrs.Name, "object name doesn't match")
+	assert.Equal(t, "text/plain", attrs.ContentType, "content type doesn't match")
+	r, err := dest.NewReader(ctx)
+	assert.NilError(t, err, "failed to create reader for composed file")
+	data, err := io.ReadAll(r)
+	assert.NilError(t, err, "failed to read from composed file")
+	assert.NilError(t, r.Close(), "failed to close composed file reader")
+	assert.Equal(t, manualCompose, string(data), "content doesn't match")
+
+	// Issue the same request with incorrect generation on a source.
+	composer = dest.If(storage.Conditions{GenerationMatch: attrs.Generation}).ComposerFrom(
+		srcs[0].If(storage.Conditions{GenerationMatch: srcGens[0]}),     // correct
+		srcs[1].If(storage.Conditions{GenerationMatch: srcGens[1] + 1})) // incorrect
+	composer.ContentType = "text/plain"
+	_, err = composer.Run(ctx)
+	assert.ErrorContains(t, err, "googleapi: Error 412")
+	assert.Equal(t, http.StatusPreconditionFailed, httpStatusCodeOf(err), "expected precondition failed")
+
+	// Issue the same request with incorrect generation on the destination.
+	composer = dest.If(storage.Conditions{DoesNotExist: true}).ComposerFrom(
+		srcs[0].If(storage.Conditions{GenerationMatch: srcGens[0]}),
+		srcs[1].If(storage.Conditions{GenerationMatch: srcGens[1]}))
+	composer.ContentType = "text/plain"
+	_, err = composer.Run(ctx)
+	assert.ErrorContains(t, err, "googleapi: Error 412")
+	assert.Equal(t, http.StatusPreconditionFailed, httpStatusCodeOf(err), "expected precondition failed")
+
+	// Issue the a request does not exist destination.
+	composer = destSecondary.If(storage.Conditions{DoesNotExist: true}).ComposerFrom(
+		srcs[0].If(storage.Conditions{GenerationMatch: srcGens[0]}),
+		srcs[1].If(storage.Conditions{GenerationMatch: srcGens[1]}))
+	composer.ContentType = "text/plain"
+	_, err = composer.Run(ctx)
+	assert.NilError(t, err, "failed to run compose")
+	// The resulting data should be correct (like in the original test).
+	r, err = destSecondary.NewReader(ctx)
+	assert.NilError(t, err, "failed to create reader for composed file")
+	data, err = io.ReadAll(r)
+	assert.NilError(t, err, "failed to read from composed file")
+	assert.NilError(t, r.Close(), "failed to close composed file reader")
+	assert.Equal(t, manualCompose, string(data), "content doesn't match")
+
+	// Use the new destination as the source for another compose. This is how we append
+	// Additionally, use generation conditions for all of the source objects.
+	composer = dest.ComposerFrom(
+		dest.If(storage.Conditions{GenerationMatch: attrs.Generation}),
+		srcs[0].If(storage.Conditions{GenerationMatch: srcGens[0]}))
+	newAttrs, err := composer.Run(ctx)
+	assert.NilError(t, err, "failed to run compose")
+	assert.Equal(t, "", newAttrs.ContentType, "content type doesn't match")
+
+	r, err = dest.NewReader(ctx)
+	assert.NilError(t, err, "failed to create reader for composed file")
+	data, err = io.ReadAll(r)
+	assert.NilError(t, err, "failed to read from composed file")
+	assert.NilError(t, r.Close(), "failed to close composed file reader")
+	assert.Equal(t, manualCompose+source1, string(data), "content doesn't match")
+
+	// Make sure we get a 404 if the source doesn't exist
+	dneObj := bh.Object("dneObject")
+	_ = dneObj.Delete(ctx)
+	// Should not exist.
+	_, err = dneObj.Attrs(ctx)
+	assert.Equal(t, storage.ErrObjectNotExist, err, "wrong error")
+
+	composer = dest.ComposerFrom(dneObj)
+	_, err = composer.Run(ctx)
+	assert.Equal(t, http.StatusNotFound, httpStatusCodeOf(err), "wrong error returned")
+}
+
+func testCopyMetadata(t *testing.T, bh BucketHandle) {
+	// TODO(dk): Metadata-rewriting on copy is not currently implemented.
+	t.Skip()
+}
+
+func testCopyConditionals(t *testing.T, bh BucketHandle) {
+	// TODO(dk): Conditional support for copy is not currently implemented.
+	t.Skip()
+}
+
+func write(w *storage.Writer, content string) error {
+	n, err := io.Copy(w, strings.NewReader(content))
+	if err != nil {
+		return err
+	}
+	if n != int64(len(content)) {
+		panic("not all content sent")
+	}
+	return w.Close()
+}
diff --git a/pkg/emulators/storage/gcsemu/http_wrappers.go b/pkg/emulators/storage/gcsemu/http_wrappers.go
new file mode 100644
index 0000000000..778d8bb2ec
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/http_wrappers.go
@@ -0,0 +1,35 @@
+package gcsemu
+
+import (
+	"compress/gzip"
+	"io"
+	"net/http"
+)
+
+// DrainRequestHandler wraps the given handler to drain the incoming request body on exit.
+func DrainRequestHandler(h http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		defer func() {
+			// Always drain and close the request body to properly free up the connection.
+			// See https://groups.google.com/forum/#!topic/golang-nuts/pP3zyUlbT00
+			_, _ = io.Copy(io.Discard, r.Body)
+			_ = r.Body.Close()
+		}()
+		h(w, r)
+	}
+}
+
+// GzipRequestHandler wraps the given handler to automatically decompress gzipped content.
+func GzipRequestHandler(h http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		if r.Header.Get("Content-Encoding") == "gzip" {
+			gzr, err := gzip.NewReader(r.Body)
+			if err != nil {
+				http.Error(w, err.Error(), http.StatusBadRequest)
+				return
+			}
+			r.Body = gzr
+		}
+		h(w, r)
+	}
+}
diff --git a/pkg/emulators/storage/gcsemu/memstore.go b/pkg/emulators/storage/gcsemu/memstore.go
new file mode 100644
index 0000000000..8356ce0da6
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/memstore.go
@@ -0,0 +1,215 @@
+package gcsemu
+
+import (
+	"context"
+	"os"
+	"sync"
+	"time"
+	"fmt"
+
+	"github.com/google/btree"
+	"google.golang.org/api/storage/v1"
+)
+
+type memstore struct {
+	mu      sync.RWMutex
+	buckets map[string]*memBucket
+}
+
+var _ Store = (*memstore)(nil)
+
+// NewMemStore returns a Store that operates purely in memory.
+func NewMemStore() *memstore {
+	return &memstore{buckets: map[string]*memBucket{}}
+}
+
+type memBucket struct {
+	created time.Time
+
+	// mutex required (despite lock map in gcsemu), because btree mutations are not structurally safe
+	mu    sync.RWMutex
+	files *btree.BTree
+}
+
+func (ms *memstore) getBucket(bucket string) *memBucket {
+	ms.mu.RLock()
+	defer ms.mu.RUnlock()
+	return ms.buckets[bucket]
+}
+
+type memFile struct {
+	meta storage.Object
+	data []byte
+}
+
+func (mf *memFile) Less(than btree.Item) bool {
+	// TODO(dragonsinth): is a simple lexical sort ok for Walk?
+	return mf.meta.Name < than.(*memFile).meta.Name
+}
+
+var _ btree.Item = (*memFile)(nil)
+
+func (ms *memstore) CreateBucket(bucket string) error {
+	ms.mu.Lock()
+	defer ms.mu.Unlock()
+	if ms.buckets[bucket] == nil {
+		ms.buckets[bucket] = &memBucket{
+			created: time.Now(),
+			files:   btree.New(16),
+		}
+	}
+	return nil
+}
+
+func (ms *memstore) GetBucketMeta(baseUrl HttpBaseUrl, bucket string) (*storage.Bucket, error) {
+	if b := ms.getBucket(bucket); b != nil {
+		obj := BucketMeta(baseUrl, bucket)
+		obj.Updated = b.created.UTC().Format(time.RFC3339Nano)
+		return obj, nil
+	}
+	return nil, nil
+}
+
+func (ms *memstore) Get(baseUrl HttpBaseUrl, bucket string, filename string) (*storage.Object, []byte, error) {
+	f := ms.find(bucket, filename)
+	if f != nil {
+		return &f.meta, f.data, nil
+	}
+	return nil, nil, nil
+}
+
+func (ms *memstore) GetMeta(baseUrl HttpBaseUrl, bucket string, filename string) (*storage.Object, error) {
+	f := ms.find(bucket, filename)
+	if f != nil {
+		meta := f.meta
+		InitMetaWithUrls(baseUrl, &meta, bucket, filename, uint64(len(f.data)))
+		return &meta, nil
+	}
+	return nil, nil
+}
+
+func (ms *memstore) Add(bucket string, filename string, contents []byte, meta *storage.Object) error {
+	_ = ms.CreateBucket(bucket)
+
+	InitScrubbedMeta(meta, filename)
+	meta.Metageneration = 1
+
+	// Cannot be overridden by caller
+	now := time.Now().UTC()
+	meta.Updated = now.UTC().Format(time.RFC3339Nano)
+	meta.Generation = now.UnixNano()
+	if meta.TimeCreated == "" {
+		meta.TimeCreated = meta.Updated
+	}
+	meta.Id = fmt.Sprintf("%s/%s/%d", bucket, filename, meta.Generation)
+	meta.Etag = fmt.Sprintf("%d", meta.Generation)
+
+	b := ms.getBucket(bucket)
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.files.ReplaceOrInsert(&memFile{
+		meta: *meta,
+		data: contents,
+	})
+	return nil
+}
+
+func (ms *memstore) UpdateMeta(bucket string, filename string, meta *storage.Object, metagen int64) error {
+	f := ms.find(bucket, filename)
+	if f == nil {
+		return os.ErrNotExist
+	}
+
+	InitScrubbedMeta(meta, filename)
+	meta.Metageneration = metagen
+
+	b := ms.getBucket(bucket)
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	b.files.ReplaceOrInsert(&memFile{
+		meta: *meta,
+		data: f.data,
+	})
+	return nil
+}
+
+func (ms *memstore) Copy(srcBucket string, srcFile string, dstBucket string, dstFile string) (bool, error) {
+	src := ms.find(srcBucket, srcFile)
+	if src == nil {
+		return false, nil
+	}
+
+	// Copy with metadata
+	meta := src.meta
+	meta.TimeCreated = "" // reset creation time on the dest file
+	err := ms.Add(dstBucket, dstFile, src.data, &meta)
+	if err != nil {
+		return false, err
+	}
+
+	return true, nil
+}
+
+func (ms *memstore) Delete(bucket string, filename string) error {
+	if filename == "" {
+		// Remove the bucket
+		ms.mu.Lock()
+		defer ms.mu.Unlock()
+		if _, ok := ms.buckets[bucket]; !ok {
+			return os.ErrNotExist
+		}
+
+		delete(ms.buckets, bucket)
+	} else if b := ms.getBucket(bucket); b != nil {
+		// Remove just the file
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		if b.files.Delete(ms.key(filename)) == nil {
+			// case file does not exist
+			return os.ErrNotExist
+		}
+	} else {
+		return os.ErrNotExist
+	}
+
+	return nil
+}
+
+func (ms *memstore) ReadMeta(baseUrl HttpBaseUrl, bucket string, filename string, _ os.FileInfo) (*storage.Object, error) {
+	return ms.GetMeta(baseUrl, bucket, filename)
+}
+
+func (ms *memstore) Walk(ctx context.Context, bucket string, cb func(ctx context.Context, filename string, fInfo os.FileInfo) error) error {
+	if b := ms.getBucket(bucket); b != nil {
+		var err error
+		b.mu.RLock()
+		defer b.mu.RUnlock()
+		b.files.Ascend(func(i btree.Item) bool {
+			mf := i.(*memFile)
+			err = cb(ctx, mf.meta.Name, nil)
+			return err == nil
+		})
+		return nil
+	}
+	return os.ErrNotExist
+}
+
+func (ms *memstore) key(filename string) btree.Item {
+	return &memFile{
+		meta: storage.Object{
+			Name: filename,
+		},
+	}
+}
+
+func (ms *memstore) find(bucket string, filename string) *memFile {
+	if b := ms.getBucket(bucket); b != nil {
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		f := b.files.Get(ms.key(filename))
+		if f != nil {
+			return f.(*memFile)
+		}
+	}
+	return nil
+}
diff --git a/pkg/emulators/storage/gcsemu/memstore_test.go b/pkg/emulators/storage/gcsemu/memstore_test.go
new file mode 100644
index 0000000000..150a5cafd8
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/memstore_test.go
@@ -0,0 +1,61 @@
+package gcsemu
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"gotest.tools/v3/assert"
+)
+
+func TestMemStore(t *testing.T) {
+	// Setup an in-memory emulator.
+	gcsEmu := NewGcsEmu(Options{
+		Verbose: true,
+		Log: func(err error, fmt string, args ...interface{}) {
+			t.Helper()
+			if err != nil {
+				fmt = "ERROR: " + fmt + ": %s"
+				args = append(args, err)
+			}
+			t.Logf(fmt, args...)
+		},
+	})
+	mux := http.NewServeMux()
+	gcsEmu.Register(mux)
+	svr := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Logf("about to method=%s host=%s u=%s", r.Method, r.Host, r.URL)
+		mux.ServeHTTP(w, r)
+	}))
+	t.Cleanup(svr.Close)
+
+	gcsClient, err := NewTestClientWithHost(context.Background(), svr.URL)
+	assert.NilError(t, err)
+	t.Cleanup(func() {
+		_ = gcsClient.Close()
+	})
+
+	bh := BucketHandle{
+		Name:         "mem-bucket",
+		BucketHandle: gcsClient.Bucket("mem-bucket"),
+	}
+	initBucket(t, bh)
+	attrs, err := bh.Attrs(context.Background())
+	assert.NilError(t, err)
+	assert.Equal(t, bh.Name, attrs.Name)
+
+	t.Parallel()
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			tc.f(t, bh)
+		})
+	}
+
+	t.Run("RawHttp", func(t *testing.T) {
+		t.Parallel()
+		testRawHttp(t, bh, http.DefaultClient, svr.URL)
+	})
+}
diff --git a/pkg/emulators/storage/gcsemu/meta.go b/pkg/emulators/storage/gcsemu/meta.go
new file mode 100644
index 0000000000..dd5fdae2fa
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/meta.go
@@ -0,0 +1,84 @@
+package gcsemu
+
+import (
+	"fmt"
+	"mime"
+	"strings"
+
+	"google.golang.org/api/storage/v1"
+)
+
+// BucketMeta returns a default bucket metadata for the given name and base url.
+func BucketMeta(baseUrl HttpBaseUrl, bucket string) *storage.Bucket {
+	return &storage.Bucket{
+		Kind:         "storage#bucket",
+		Name:         bucket,
+		SelfLink:     BucketUrl(baseUrl, bucket),
+		StorageClass: "STANDARD",
+	}
+}
+
+// InitScrubbedMeta "bakes" metadata with intrinsic values and removes fields that are intrinsic / computed.
+func InitScrubbedMeta(meta *storage.Object, filename string) {
+	parts := strings.Split(filename, ".")
+	ext := parts[len(parts)-1]
+
+	if meta.ContentType == "" {
+		meta.ContentType = mime.TypeByExtension(ext)
+	}
+	meta.Name = filename
+	ScrubMeta(meta)
+}
+
+// InitMetaWithUrls "bakes" metadata with intrinsic values, including computed links.
+func InitMetaWithUrls(baseUrl HttpBaseUrl, meta *storage.Object, bucket string, filename string, size uint64) {
+	parts := strings.Split(filename, ".")
+	ext := parts[len(parts)-1]
+
+	meta.Bucket = bucket
+	if meta.ContentType == "" {
+		meta.ContentType = mime.TypeByExtension(ext)
+	}
+	meta.Kind = "storage#object"
+	meta.MediaLink = ObjectUrl(baseUrl, bucket, filename) + "?alt=media"
+	meta.Name = filename
+	meta.SelfLink = ObjectUrl(baseUrl, bucket, filename)
+	meta.Size = size
+	meta.StorageClass = "STANDARD"
+}
+
+// ScrubMeta removes fields that are intrinsic / computed for minimal storage.
+func ScrubMeta(meta *storage.Object) {
+	meta.Bucket = ""
+	meta.Kind = ""
+	meta.MediaLink = ""
+	meta.SelfLink = ""
+	meta.Size = 0
+	meta.StorageClass = ""
+}
+
+// BucketUrl returns the URL for a bucket.
+func BucketUrl(baseUrl HttpBaseUrl, bucket string) string {
+	return fmt.Sprintf("%sstorage/v1/b/%s", normalizeBaseUrl(baseUrl), bucket)
+}
+
+// ObjectUrl returns the URL for a file.
+func ObjectUrl(baseUrl HttpBaseUrl, bucket string, filepath string) string {
+	return fmt.Sprintf("%sstorage/v1/b/%s/o/%s", normalizeBaseUrl(baseUrl), bucket, filepath)
+}
+
+// HttpBaseUrl represents the emulator base URL, including trailing slash; e.g. https://www.googleapis.com/
+type HttpBaseUrl string
+
+// when the caller doesn't really care about the object meta URLs
+const dontNeedUrls = HttpBaseUrl("")
+
+func normalizeBaseUrl(baseUrl HttpBaseUrl) HttpBaseUrl {
+	if baseUrl == dontNeedUrls || baseUrl == "https://storage.googleapis.com/" {
+		return "https://www.googleapis.com/"
+	} else if baseUrl == "http://storage.googleapis.com/" {
+		return "http://www.googleapis.com/"
+	} else {
+		return baseUrl
+	}
+}
diff --git a/pkg/emulators/storage/gcsemu/multipart.go b/pkg/emulators/storage/gcsemu/multipart.go
new file mode 100644
index 0000000000..c0362e87b7
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/multipart.go
@@ -0,0 +1,65 @@
+package gcsemu
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"mime"
+	"mime/multipart"
+	"net/http"
+
+	"google.golang.org/api/storage/v1"
+)
+
+func readMultipartInsert(r *http.Request) (*storage.Object, []byte, error) {
+	v := r.Header.Get("Content-Type")
+	if v == "" {
+		return nil, nil, fmt.Errorf("failed to parse Content-Type header: %q", v)
+	}
+	d, params, err := mime.ParseMediaType(v)
+	if err != nil || d != "multipart/related" {
+		return nil, nil, fmt.Errorf("failed to parse Content-Type header: %q", v)
+	}
+	boundary, ok := params["boundary"]
+	if !ok {
+		return nil, nil, fmt.Errorf("Content-Type header is missing boundary: %q", v)
+	}
+
+	reader := multipart.NewReader(r.Body, boundary)
+
+	readPart := func() ([]byte, error) {
+		part, err := reader.NextPart()
+		if err != nil {
+			return nil, fmt.Errorf("failed to get multipart: %w", err)
+		}
+
+		b, err := io.ReadAll(part)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get read multipart: %w", err)
+		}
+
+		return b, nil
+	}
+
+	// read the first part to get the storage.Object (in json)
+	b, err := readPart()
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to read first part of body: %w", err)
+	}
+
+	var obj storage.Object
+	err = json.Unmarshal(b, &obj)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to parse body as json: %w", err)
+	}
+
+	// read the next part to get the file contents
+	contents, err := readPart()
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to read second part of body: %w", err)
+	}
+
+	obj.Size = uint64(len(contents))
+
+	return &obj, contents, nil
+}
diff --git a/pkg/emulators/storage/gcsemu/parse.go b/pkg/emulators/storage/gcsemu/parse.go
new file mode 100644
index 0000000000..6baacff2d3
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/parse.go
@@ -0,0 +1,65 @@
+package gcsemu
+
+import (
+	"net/url"
+	"regexp"
+)
+
+const (
+	// example: "/storage/v1/b/my-bucket/o/2013-tax-returns.pdf" (for a file) or "/storage/v1/b/my-bucket/o" (for a bucket)
+	gcsObjectPathPattern = "/storage/v1/b/([^\\/]+)/o(?:/(.+))?"
+	// example: "//b/my-bucket/o/2013-tax-returns.pdf" (for a file) or "/b/my-bucket/o" (for a bucket)
+	gcsObjectPathPattern2 = "/b/([^\\/]+)/o(?:/(.+))?"
+	// example: "/storage/v1/b/my-bucket
+	gcsBucketPathPattern = "/storage/v1/b(?:/([^\\/]+))?"
+	// example: "/my-bucket/2013-tax-returns.pdf" (for a file)
+	gcsStoragePathPattern = "/([^\\/]+)/(.+)"
+)
+
+var (
+	gcsObjectPathRegex  = regexp.MustCompile(gcsObjectPathPattern)
+	gcsObjectPathRegex2 = regexp.MustCompile(gcsObjectPathPattern2)
+	gcsBucketPathRegex  = regexp.MustCompile(gcsBucketPathPattern)
+	gcsStoragePathRegex = regexp.MustCompile(gcsStoragePathPattern)
+)
+
+// GcsParams represent a parsed GCS url.
+type GcsParams struct {
+	Bucket   string
+	Object   string
+	IsPublic bool
+}
+
+// ParseGcsUrl parses a GCS url.
+func ParseGcsUrl(u *url.URL) (*GcsParams, bool) {
+	if g, ok := parseGcsUrl(gcsObjectPathRegex, u); ok {
+		return g, true
+	}
+	if g, ok := parseGcsUrl(gcsBucketPathRegex, u); ok {
+		return g, true
+	}
+	if g, ok := parseGcsUrl(gcsObjectPathRegex2, u); ok {
+		return g, true
+	}
+	if g, ok := parseGcsUrl(gcsStoragePathRegex, u); ok {
+		g.IsPublic = true
+		return g, true
+	}
+	return nil, false
+}
+
+func parseGcsUrl(re *regexp.Regexp, u *url.URL) (*GcsParams, bool) {
+	submatches := re.FindStringSubmatch(u.Path)
+	if submatches == nil {
+		return nil, false
+	}
+
+	g := &GcsParams{}
+	if len(submatches) > 1 {
+		g.Bucket = submatches[1]
+	}
+	if len(submatches) > 2 {
+		g.Object = submatches[2]
+	}
+	return g, true
+}
diff --git a/pkg/emulators/storage/gcsemu/range.go b/pkg/emulators/storage/gcsemu/range.go
new file mode 100644
index 0000000000..1c7a832a15
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/range.go
@@ -0,0 +1,52 @@
+package gcsemu
+
+import (
+	"strconv"
+	"strings"
+)
+
+type byteRange struct {
+	lo, hi, sz int64
+}
+
+func parseByteRange(in string) *byteRange {
+	var err error
+	if !strings.HasPrefix(in, "bytes ") {
+		return nil
+	}
+	in = strings.TrimPrefix(in, "bytes ")
+	parts := strings.Split(in, "/")
+	if len(parts) != 2 {
+		return nil
+	}
+
+	ret := byteRange{
+		lo: -1,
+		hi: -1,
+		sz: -1,
+	}
+
+	if parts[0] != "*" {
+		parts := strings.Split(parts[0], "-")
+		if len(parts) != 2 {
+			return nil
+		}
+		ret.lo, err = strconv.ParseInt(parts[0], 10, 64)
+		if err != nil {
+			return nil
+		}
+		ret.hi, err = strconv.ParseInt(parts[1], 10, 64)
+		if err != nil {
+			return nil
+		}
+	}
+
+	if parts[1] != "*" {
+		ret.sz, err = strconv.ParseInt(parts[1], 10, 64)
+		if err != nil {
+			return nil
+		}
+	}
+
+	return &ret
+}
diff --git a/pkg/emulators/storage/gcsemu/range_test.go b/pkg/emulators/storage/gcsemu/range_test.go
new file mode 100644
index 0000000000..6cac438b34
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/range_test.go
@@ -0,0 +1,23 @@
+package gcsemu
+
+import (
+	"testing"
+
+	"gotest.tools/v3/assert"
+)
+
+func TestParseByteRange(t *testing.T) {
+	tcs := []struct {
+		in     string
+		expect byteRange
+	}{
+		{in: "bytes 0-8388607/*", expect: byteRange{lo: 0, hi: 8388607, sz: -1}},
+		{in: "bytes 8388608-10485759/10485760", expect: byteRange{lo: 8388608, hi: 10485759, sz: 10485760}},
+		{in: "bytes */10485760", expect: byteRange{lo: -1, hi: -1, sz: 10485760}},
+	}
+
+	for _, tc := range tcs {
+		t.Logf("test case: %s", tc.in)
+		assert.Equal(t, tc.expect, *parseByteRange(tc.in))
+	}
+}
diff --git a/pkg/emulators/storage/gcsemu/raw_http_test.go b/pkg/emulators/storage/gcsemu/raw_http_test.go
new file mode 100644
index 0000000000..20ba7b30e2
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/raw_http_test.go
@@ -0,0 +1,299 @@
+package gcsemu
+
+import (
+	"bufio"
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	api "google.golang.org/api/storage/v1"
+	"gotest.tools/v3/assert"
+	"io"
+	"mime"
+	"mime/multipart"
+	"net/http"
+	"net/http/httputil"
+	"net/textproto"
+	"strings"
+	"testing"
+)
+
+func testRawHttp(t *testing.T, bh BucketHandle, httpClient *http.Client, url string) {
+	const name = "gscemu-test3.txt"
+	const name2 = "gscemu-test4.txt"
+	const delName = "gscemu-test-deletion.txt"    // used for successful deletion
+	const delName2 = "gscemu-test-deletion-2.txt" // used for not found deletion
+
+	expectMetaGen := int64(1)
+	tcs := []struct {
+		name          string
+		makeRequest   func(*testing.T) *http.Request
+		checkResponse func(*testing.T, *http.Response)
+	}{
+		{
+			name: "rawGetObject",
+			makeRequest: func(t *testing.T) *http.Request {
+				u := fmt.Sprintf("%s/download/storage/v1/b/%s/o/%s?alt=media", url, bh.Name, name)
+				t.Log(u)
+				req, err := http.NewRequest("GET", u, nil)
+				assert.NilError(t, err)
+				return req
+			},
+			checkResponse: func(t *testing.T, rsp *http.Response) {
+				body, err := io.ReadAll(rsp.Body)
+				assert.NilError(t, err)
+				assert.Equal(t, http.StatusOK, rsp.StatusCode)
+				assert.Equal(t, v1, string(body))
+			},
+		},
+		{
+			name: "rawGetMeta",
+			makeRequest: func(t *testing.T) *http.Request {
+				u := fmt.Sprintf("%s/storage/v1/b/%s/o/%s", url, bh.Name, name)
+				t.Log(u)
+				req, err := http.NewRequest("GET", u, nil)
+				assert.NilError(t, err)
+				return req
+			},
+			checkResponse: func(t *testing.T, rsp *http.Response) {
+				body, err := io.ReadAll(rsp.Body)
+				assert.NilError(t, err)
+				assert.Equal(t, http.StatusOK, rsp.StatusCode)
+
+				var attrs api.Object
+				err = json.NewDecoder(bytes.NewReader(body)).Decode(&attrs)
+				assert.NilError(t, err)
+				assert.Equal(t, name, attrs.Name)
+				assert.Equal(t, bh.Name, attrs.Bucket)
+				assert.Equal(t, uint64(len(v1)), attrs.Size)
+				assert.Equal(t, expectMetaGen, attrs.Metageneration)
+			},
+		},
+		{
+			name: "rawPatchMeta",
+			makeRequest: func(t *testing.T) *http.Request {
+				u := fmt.Sprintf("%s/storage/v1/b/%s/o/%s", url, bh.Name, name)
+				t.Log(u)
+				req, err := http.NewRequest("PATCH", u, strings.NewReader(`{"metadata": {"type": "tabby"}}`))
+				assert.NilError(t, err)
+				req.Header.Set("Content-Type", "application/json")
+				return req
+			},
+			checkResponse: func(t *testing.T, rsp *http.Response) {
+				body, err := io.ReadAll(rsp.Body)
+				assert.NilError(t, err)
+				assert.Equal(t, http.StatusOK, rsp.StatusCode)
+
+				expectMetaGen++
+
+				var attrs api.Object
+				err = json.NewDecoder(bytes.NewReader(body)).Decode(&attrs)
+				assert.NilError(t, err)
+				assert.Equal(t, name, attrs.Name)
+				assert.Equal(t, bh.Name, attrs.Bucket)
+				assert.Equal(t, uint64(len(v1)), attrs.Size)
+				assert.Equal(t, expectMetaGen, attrs.Metageneration)
+				assert.Equal(t, "tabby", attrs.Metadata["type"])
+			},
+		},
+		{
+			name: "rawDeleteObject-Success",
+			makeRequest: func(t *testing.T) *http.Request {
+				u := fmt.Sprintf("%s/storage/v1/b/%s/o/%s", url, bh.Name, delName)
+				t.Log(u)
+				req, err := http.NewRequest("DELETE", u, nil)
+				assert.NilError(t, err)
+				req.Header.Set("Content-Type", "text/plain")
+				return req
+			},
+			checkResponse: func(t *testing.T, rsp *http.Response) {
+				assert.Equal(t, http.StatusNoContent, rsp.StatusCode)
+			},
+		},
+		{
+			name: "rawDeleteObject-ObjectNotFound",
+			makeRequest: func(t *testing.T) *http.Request {
+				u := fmt.Sprintf("%s/storage/v1/b/%s/o/%s", url, bh.Name, delName2)
+				t.Log(u)
+				req, err := http.NewRequest("DELETE", u, nil)
+				assert.NilError(t, err)
+				req.Header.Set("Content-Type", "text/plain")
+				return req
+			},
+			checkResponse: func(t *testing.T, rsp *http.Response) {
+				assert.Equal(t, http.StatusNotFound, rsp.StatusCode)
+			},
+		},
+		{
+			name: "rawDeleteObject-BucketNotFound",
+			makeRequest: func(t *testing.T) *http.Request {
+				u := fmt.Sprintf("%s/storage/v1/b/%s/o/%s", url, invalidBucketName, delName)
+				t.Log(u)
+				req, err := http.NewRequest("DELETE", u, nil)
+				assert.NilError(t, err)
+				req.Header.Set("Content-Type", "text/plain")
+				return req
+			},
+			checkResponse: func(t *testing.T, rsp *http.Response) {
+				assert.Equal(t, http.StatusNotFound, rsp.StatusCode)
+			},
+		},
+		{
+			name: "rawDeleteBucket-BucketNotFound",
+			makeRequest: func(t *testing.T) *http.Request {
+				u := fmt.Sprintf("%s/storage/v1/b/%s", url, invalidBucketName)
+				t.Log(u)
+				req, err := http.NewRequest("DELETE", u, nil)
+				assert.NilError(t, err)
+				req.Header.Set("Content-Type", "text/plain")
+				return req
+			},
+			checkResponse: func(t *testing.T, rsp *http.Response) {
+				assert.Equal(t, http.StatusNotFound, rsp.StatusCode)
+			},
+		},
+		{
+			name: "rawUpload",
+			makeRequest: func(t *testing.T) *http.Request {
+				u := fmt.Sprintf("%s/upload/storage/v1/b/%s/o?uploadType=media&name=%s", url, bh.Name, name2)
+				t.Log(u)
+				req, err := http.NewRequest("POST", u, strings.NewReader(v2))
+				assert.NilError(t, err)
+				req.Header.Set("Content-Type", "text/plain")
+				return req
+			},
+			checkResponse: func(t *testing.T, rsp *http.Response) {
+				body, err := io.ReadAll(rsp.Body)
+				assert.NilError(t, err)
+				assert.Equal(t, http.StatusOK, rsp.StatusCode)
+
+				var attrs api.Object
+				err = json.NewDecoder(bytes.NewReader(body)).Decode(&attrs)
+				assert.NilError(t, err)
+				assert.Equal(t, name2, attrs.Name)
+				assert.Equal(t, bh.Name, attrs.Bucket)
+				assert.Equal(t, uint64(len(v2)), attrs.Size)
+				assert.Equal(t, int64(1), attrs.Metageneration)
+			},
+		},
+		{
+			name: "publicUrl",
+			makeRequest: func(t *testing.T) *http.Request {
+				u := fmt.Sprintf("%s/%s/%s?alt=media", url, bh.Name, name)
+				t.Log(u)
+				req, err := http.NewRequest("GET", u, nil)
+				assert.NilError(t, err)
+				return req
+			},
+			checkResponse: func(t *testing.T, rsp *http.Response) {
+				body, err := io.ReadAll(rsp.Body)
+				assert.NilError(t, err)
+				assert.Equal(t, http.StatusOK, rsp.StatusCode)
+				assert.Equal(t, v1, string(body))
+			},
+		},
+	}
+
+	ctx := context.Background()
+	oh := bh.Object(name)
+
+	// Create the object 1.
+	w := oh.NewWriter(ctx)
+	assert.NilError(t, write(w, v1))
+
+	// Make sure object 2 is not there.
+	_ = bh.Object(name2).Delete(ctx)
+
+	// batch setup
+	// Create the object for successful deletion.
+	w = bh.Object(delName).NewWriter(ctx)
+	assert.NilError(t, write(w, v1))
+	// Make sure object for not found deletion is not there.
+	_ = bh.Object(delName2).Delete(ctx)
+
+	// Run each test individually.
+	for _, tc := range tcs {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			req := tc.makeRequest(t)
+			rsp, err := httpClient.Do(req)
+			assert.NilError(t, err)
+			body, err := httputil.DumpResponse(rsp, true)
+			assert.NilError(t, err)
+			t.Log(string(body))
+			tc.checkResponse(t, rsp)
+		})
+	}
+
+	// batch setup again for batch deletion step
+	// Create the object for successful deletion.
+	w = bh.Object(delName).NewWriter(ctx)
+	assert.NilError(t, write(w, v1))
+	// Make sure object for not found deletion is not there.
+	_ = bh.Object(delName2).Delete(ctx)
+
+	// Batch requests don't support upload and download, only metadata stuff.
+	t.Run("batch", func(t *testing.T) {
+		var buf bytes.Buffer
+		w := multipart.NewWriter(&buf)
+
+		// Only use the [second, fifth] requests.
+		batchTcs := tcs[1:6]
+		for i, tc := range batchTcs {
+			req := tc.makeRequest(t)
+			req.Host = ""
+			req.URL.Host = ""
+
+			p, _ := w.CreatePart(textproto.MIMEHeader{
+				"Content-Type":              []string{"application/http"},
+				"Content-Transfer-Encoding": []string{"binary"},
+				"Content-ID":                []string{fmt.Sprintf("<id+%d>", i)},
+			})
+			buf, err := httputil.DumpRequest(req, true)
+			assert.NilError(t, err)
+			_, _ = p.Write(buf)
+		}
+		_ = w.Close()
+
+		// Compile the request
+		req, err := http.NewRequest("POST", fmt.Sprintf("%s/batch/storage/v1", url), &buf)
+		assert.NilError(t, err)
+		req.Header.Set("Content-Type", "multipart/mixed; boundary="+w.Boundary())
+
+		body, err := httputil.DumpRequest(req, true)
+		assert.NilError(t, err)
+		t.Log(string(body))
+
+		rsp, err := httpClient.Do(req)
+		assert.NilError(t, err)
+		assert.Equal(t, http.StatusOK, rsp.StatusCode)
+
+		body, err = httputil.DumpResponse(rsp, true)
+		assert.NilError(t, err)
+		t.Log(string(body))
+
+		// decode the multipart response
+		v := rsp.Header.Get("Content-type")
+		assert.Check(t, v != "")
+		d, params, err := mime.ParseMediaType(v)
+		assert.NilError(t, err)
+		assert.Equal(t, "multipart/mixed", d)
+		boundary, ok := params["boundary"]
+		assert.Check(t, ok)
+
+		r := multipart.NewReader(rsp.Body, boundary)
+		for i, tc := range batchTcs {
+			part, err := r.NextPart()
+			assert.NilError(t, err)
+			assert.Equal(t, "application/http", part.Header.Get("Content-Type"))
+			assert.Equal(t, fmt.Sprintf("<response-id+%d>", i), part.Header.Get("Content-ID"))
+			b, err := io.ReadAll(part)
+			assert.NilError(t, err)
+
+			// Decode the buffer into an http.Response
+			rsp, err := http.ReadResponse(bufio.NewReader(bytes.NewReader(b)), nil)
+			assert.NilError(t, err)
+			tc.checkResponse(t, rsp)
+		}
+	})
+}
diff --git a/pkg/emulators/storage/gcsemu/remote_test.go b/pkg/emulators/storage/gcsemu/remote_test.go
new file mode 100644
index 0000000000..55dc4d5387
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/remote_test.go
@@ -0,0 +1,50 @@
+package gcsemu
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"cloud.google.com/go/storage"
+	"golang.org/x/oauth2/google"
+	"gotest.tools/v3/assert"
+)
+
+func TestRealStore(t *testing.T) {
+	bucket := os.Getenv("BUCKET_ID")
+	if bucket == "" {
+		t.Skip("BUCKET_ID must be set to run this")
+	}
+
+	ctx := context.Background()
+	gcsClient, err := storage.NewClient(ctx)
+	assert.NilError(t, err)
+	t.Cleanup(func() {
+		_ = gcsClient.Close()
+	})
+
+	bh := BucketHandle{
+		Name:         bucket,
+		BucketHandle: gcsClient.Bucket(bucket),
+	}
+
+	// Instead of `initBucket`, just check that it exists.
+	_, err = bh.Attrs(ctx)
+	assert.NilError(t, err)
+
+	t.Parallel()
+	for _, tc := range testCases {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			tc.f(t, bh)
+		})
+	}
+
+	httpClient, err := google.DefaultClient(context.Background())
+	assert.NilError(t, err)
+	t.Run("RawHttp", func(t *testing.T) {
+		t.Parallel()
+		testRawHttp(t, bh, httpClient, "https://storage.googleapis.com")
+	})
+}
diff --git a/pkg/emulators/storage/gcsemu/server.go b/pkg/emulators/storage/gcsemu/server.go
new file mode 100644
index 0000000000..0d407b8030
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/server.go
@@ -0,0 +1,44 @@
+package gcsemu
+
+import (
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+)
+
+// Server is an in-memory Cloud Storage emulator; it is unauthenticated, and only a rough approximation.
+type Server struct {
+	Addr string
+	*httptest.Server
+	*GcsEmu
+}
+
+// NewServer creates a new Server with the given options.
+// The Server will be listening for HTTP connections, without TLS,
+// on the provided address. The resolved address is named by the Addr field.
+// An address with a port of 0 will bind to an open port on the system.
+//
+// For running a full in-process setup (e.g. unit tests), initialize
+// os.Setenv("GCS_EMULATOR_HOST", srv.Addr) so that subsequent calls to NewClient()
+// will return an in-process targeted storage client.
+func NewServer(laddr string, opts Options) (*Server, error) {
+	gcsEmu := NewGcsEmu(opts)
+	mux := http.NewServeMux()
+	gcsEmu.Register(mux)
+
+	srv := httptest.NewUnstartedServer(mux)
+	l, err := net.Listen("tcp", laddr)
+	if err != nil {
+		return nil, fmt.Errorf("failed to listen on addr %s: %w", laddr, err)
+	}
+	srv.Listener = l
+	srv.Start()
+
+	return &Server{
+		Addr:   strings.TrimPrefix(srv.URL, "http://"),
+		Server: srv,
+		GcsEmu: gcsEmu,
+	}, nil
+}
diff --git a/pkg/emulators/storage/gcsemu/store.go b/pkg/emulators/storage/gcsemu/store.go
new file mode 100644
index 0000000000..92ea335c6c
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/store.go
@@ -0,0 +1,41 @@
+package gcsemu
+
+import (
+	"context"
+	"os"
+
+	"google.golang.org/api/storage/v1"
+)
+
+// Store is an interface to either on-disk or in-mem storage
+type Store interface {
+	// CreateBucket creates a bucket; no error if the bucket already exists.
+	CreateBucket(bucket string) error
+
+	// Get returns a bucket's metadata.
+	GetBucketMeta(baseUrl HttpBaseUrl, bucket string) (*storage.Bucket, error)
+
+	// Get returns a file's contents and metadata.
+	Get(url HttpBaseUrl, bucket string, filename string) (*storage.Object, []byte, error)
+
+	// GetMeta returns a file's metadata.
+	GetMeta(url HttpBaseUrl, bucket string, filename string) (*storage.Object, error)
+
+	// Add creates the specified file.
+	Add(bucket string, filename string, contents []byte, meta *storage.Object) error
+
+	// UpdateMeta updates the given file's metadata.
+	UpdateMeta(bucket string, filename string, meta *storage.Object, metagen int64) error
+
+	// Copy copies the file
+	Copy(srcBucket string, srcFile string, dstBucket string, dstFile string) (bool, error)
+
+	// Delete deletes the file.
+	Delete(bucket string, filename string) error
+
+	// ReadMeta reads the GCS metadata for a file, when you already have file info.
+	ReadMeta(url HttpBaseUrl, bucket string, filename string, fInfo os.FileInfo) (*storage.Object, error)
+
+	// Walks the given bucket.
+	Walk(ctx context.Context, bucket string, cb func(ctx context.Context, filename string, fInfo os.FileInfo) error) error
+}
diff --git a/pkg/emulators/storage/gcsemu/util.go b/pkg/emulators/storage/gcsemu/util.go
new file mode 100644
index 0000000000..0d9a197eb5
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/util.go
@@ -0,0 +1,141 @@
+package gcsemu
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+	"regexp"
+	"strings"
+
+	"google.golang.org/api/googleapi"
+)
+
+// jsonRespond json-encodes rsp and writes it to w.  If an error occurs, then it is logged and a 500 error is written to w.
+func (g *GcsEmu) jsonRespond(w http.ResponseWriter, rsp interface{}) {
+	// do NOT write a http status since OK will be the default and this allows the caller to use their own if they want
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+
+	encoder := json.NewEncoder(w)
+	if err := encoder.Encode(rsp); err != nil {
+		g.log(err, "failed to send response")
+		http.Error(w, "Internal Server Error", http.StatusInternalServerError)
+	}
+}
+
+type gapiErrorPartial struct {
+	// Code is the HTTP response status code and will always be populated.
+	Code int `json:"code"`
+
+	// Message is the server response message and is only populated when
+	// explicitly referenced by the JSON server response.
+	Message string `json:"message"`
+
+	Errors []googleapi.ErrorItem `json:"errors,omitempty"`
+}
+
+// gapiError responds to the client with a GAPI error
+func (g *GcsEmu) gapiError(w http.ResponseWriter, code int, message string) {
+	if code == 0 {
+		code = http.StatusInternalServerError
+	}
+	if code != http.StatusNotFound {
+		g.log(errors.New(message), "responding with HTTP %d", code)
+	}
+	if message == "" {
+		message = http.StatusText(code)
+	}
+
+	// format copied from errorReply struct in google.golang.org/api/googleapi
+	rsp := struct {
+		Error gapiErrorPartial `json:"error"`
+	}{
+		Error: gapiErrorPartial{
+			Code:    code,
+			Message: message,
+		},
+	}
+
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(code)
+	enc := json.NewEncoder(w)
+	enc.SetIndent("", "  ")
+	_ = enc.Encode(&rsp)
+}
+
+// mustJson serializes the given value to json, panicking on failure
+func mustJson(val interface{}) []byte {
+	if val == nil {
+		return []byte("null")
+	}
+
+	b, err := json.MarshalIndent(val, "", "  ")
+	if err != nil {
+		panic(err)
+	}
+	return b
+}
+
+// requestHost returns the host from an http.Request, respecting proxy headers. Works locally with devproxy
+// and gulp proxies as well as in AppEngine (both real GAE and the dev_appserver).
+func requestHost(req *http.Request) string {
+	// proxies like gulp are supposed to accumulate original host, next-step-host, etc in order from
+	// client-most to server-most in X-ForwardedHost; return the first entry from that if any are listed
+	if proxyHost := req.Header.Get("X-Forwarded-Host"); proxyHost != "" {
+		// Use the first (closest to client) host
+		splits := strings.SplitN(proxyHost, ",", 2)
+		return splits[0]
+	}
+
+	// Forwarded is the standardized version of X-Forwarded-Host.
+	f := parseForwardedHeader(req.Header.Get("Forwarded"))
+	if len(f.Host) > 0 && len(f.Host[0]) > 0 {
+		return f.Host[0]
+	}
+
+	// Clients that generate HTTP/2 requests should use the :authority header instead
+	// of Host. See http://httpwg.org/specs/rfc7540.html#rfc.section.8.1.2.3
+	host := req.Header.Get("Authority")
+	if len(host) > 0 {
+		return host
+	}
+
+	// Fall back to the host line.
+	return req.Host
+}
+
+// forwarded represents the values of a Forwarded HTTP header.
+//
+// For more details, see the RFC: https://tools.ietf.org/html/rfc7239 and
+// MDN: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Forwarded.
+type forwarded struct {
+	By    []string
+	For   []string
+	Host  []string
+	Proto []string
+}
+
+var (
+	forwardedHostRx = regexp.MustCompile(`(?i)host=(.*?)(?:[,;\s]|$)`)
+)
+
+func removeDoubleQuotes(s string) string {
+	return strings.TrimSuffix(strings.TrimPrefix(s, `"`), `"`)
+}
+
+// Note: this currently only supports the forwarded.Host field.
+func parseForwardedHeader(s string) forwarded {
+	var f forwarded
+
+	if s == "" {
+		return f
+	}
+
+	matches := forwardedHostRx.FindAllStringSubmatch(s, -1)
+	for _, m := range matches {
+		if len(m) > 0 {
+			f.Host = append(f.Host, removeDoubleQuotes(m[1]))
+		}
+	}
+
+	return f
+}
diff --git a/pkg/emulators/storage/gcsemu/walk.go b/pkg/emulators/storage/gcsemu/walk.go
new file mode 100644
index 0000000000..cafc2627db
--- /dev/null
+++ b/pkg/emulators/storage/gcsemu/walk.go
@@ -0,0 +1,139 @@
+package gcsemu
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"encr.dev/pkg/emulators/storage/gcsutil"
+	"google.golang.org/api/storage/v1"
+)
+
+// Iterate over the file system to serve a GCS list-bucket request.
+func (g *GcsEmu) makeBucketListResults(ctx context.Context, baseUrl HttpBaseUrl, w http.ResponseWriter, delimiter string, cursor string, prefix string, bucket string, maxResults int) {
+	var errAbort = errors.New("sentinel error to abort walk")
+
+	type item struct {
+		filename string
+		fInfo    os.FileInfo
+	}
+	var found []item
+	var prefixes []string
+	seenPrefixes := make(map[string]bool)
+
+	dbgWalk := func(fmt string, args ...interface{}) {
+		if g.verbose {
+			g.log(nil, fmt, args...)
+		}
+	}
+
+	moreResults := false
+	count := 0
+	err := g.store.Walk(ctx, bucket, func(ctx context.Context, filename string, fInfo os.FileInfo) error {
+		dbgWalk("walk: %s", filename)
+
+		// If we're beyond the prefix, we're completely done.
+		if greaterThanPrefix(filename, prefix) {
+			dbgWalk("%q > prefix=%q aborting", filename, prefix)
+			return errAbort
+		}
+
+		// In the filesystem implementation, skip any directories strictly less than the cursor or prefix.
+		if fInfo != nil && fInfo.IsDir() {
+			if lessThanPrefix(filename, cursor) {
+				dbgWalk("%q < cursor=%q skip dir", filename, cursor)
+				return filepath.SkipDir
+			}
+			if lessThanPrefix(filename, prefix) {
+				dbgWalk("%q < prefix=%q skip dir", filename, prefix)
+				return filepath.SkipDir
+			}
+			return nil // keep going
+		}
+
+		// If the file is <= cursor, or < prefix, skip.
+		if filename <= cursor {
+			dbgWalk("%q <= cursor=%q skipping", filename, cursor)
+			return nil
+		}
+		if !strings.HasPrefix(filename, prefix) {
+			dbgWalk("%q < prefix=%q skipping", filename, prefix)
+			return nil
+		}
+
+		if count >= maxResults {
+			moreResults = true
+			return errAbort
+		}
+		count++
+
+		if delimiter != "" {
+			// See if the filename (beyond the prefix) contains delimiter, if it does, don't record the item,
+			// instead record the prefix (including the delimiter).
+			withoutPrefix := strings.TrimPrefix(filename, prefix)
+			delimiterPos := strings.Index(withoutPrefix, delimiter)
+			if delimiterPos >= 0 {
+				// Got a hit, reconstruct the item's prefix, including the trailing delimiter
+				itemPrefix := filename[:len(prefix)+delimiterPos+len(delimiter)]
+				if !seenPrefixes[itemPrefix] {
+					seenPrefixes[itemPrefix] = true
+					prefixes = append(prefixes, itemPrefix)
+				}
+				return nil
+			}
+		}
+
+		found = append(found, item{
+			filename: filename,
+			fInfo:    fInfo,
+		})
+		return nil
+	})
+	// Sentinel error is not an error
+	if err == errAbort {
+		err = nil
+	}
+	if err != nil {
+		if len(found) == 0 {
+			if os.IsNotExist(err) {
+				g.gapiError(w, http.StatusNotFound, fmt.Sprintf("%s not found", bucket))
+			} else {
+				g.gapiError(w, http.StatusInternalServerError, "failed to iterate: "+err.Error())
+			}
+			return
+		}
+		// return our partial results + the cursor so that the client can retry from this point
+		g.log(nil, "failed to iterate")
+	}
+
+	// Resolve the found items.
+	var items []*storage.Object
+	for _, item := range found {
+		if obj, err := g.store.ReadMeta(baseUrl, bucket, item.filename, item.fInfo); err != nil {
+			// return our partial results + the cursor so that the client can retry from this point
+			g.log(nil, "failed to resolve: %s", item.filename)
+			break
+		} else {
+			items = append(items, obj)
+		}
+	}
+
+	var nextPageToken = ""
+	if moreResults && len(items) > 0 {
+		lastItemName := items[len(items)-1].Name
+		nextPageToken = gcsutil.EncodePageToken(lastItemName)
+	}
+
+	rsp := storage.Objects{
+		Kind:          "storage#objects",
+		NextPageToken: nextPageToken,
+		Items:         items,
+		Prefixes:      prefixes,
+	}
+
+	g.jsonRespond(w, &rsp)
+}
diff --git a/pkg/emulators/storage/gcsutil/counted_lock.go b/pkg/emulators/storage/gcsutil/counted_lock.go
new file mode 100644
index 0000000000..724aed7136
--- /dev/null
+++ b/pkg/emulators/storage/gcsutil/counted_lock.go
@@ -0,0 +1,51 @@
+package gcsutil
+
+import (
+	"context"
+)
+
+type countedLock struct {
+	// a 1 element channel; empty == unlocked, full == locked
+	// push an element into the channel to lock, remove the element to unlock
+	ch chan struct{}
+
+	// should only be accessed while the outer _map_ lock is held (not this key lock)
+	refcount int64
+}
+
+func newCountedLock() *countedLock {
+	return &countedLock{
+		ch:       make(chan struct{}, 1),
+		refcount: 0,
+	}
+}
+
+func (m *countedLock) Lock(ctx context.Context) bool {
+	// If the context is already cancelled don't even try to lock.
+	if ctx.Err() != nil {
+		return false
+	}
+	select {
+	case m.ch <- struct{}{}:
+		return true
+	case <-ctx.Done():
+		return false
+	}
+}
+
+func (m *countedLock) Unlock() {
+	select {
+	case <-m.ch:
+		return
+	default:
+		panic("BUG: lock not held")
+	}
+}
+
+func (m *countedLock) Run(ctx context.Context, f func(ctx context.Context) error) error {
+	if !m.Lock(ctx) {
+		return ctx.Err()
+	}
+	defer m.Unlock()
+	return f(ctx)
+}
diff --git a/pkg/emulators/storage/gcsutil/doc.go b/pkg/emulators/storage/gcsutil/doc.go
new file mode 100644
index 0000000000..b38272099f
--- /dev/null
+++ b/pkg/emulators/storage/gcsutil/doc.go
@@ -0,0 +1,3 @@
+// Package gcsutil contains some generic utilities to support gcsemu.
+// TODO(dragonsinth): consider open sourcing these separately, or finding open source replacements.
+package gcsutil
diff --git a/pkg/emulators/storage/gcsutil/gcspagetoken.go b/pkg/emulators/storage/gcsutil/gcspagetoken.go
new file mode 100644
index 0000000000..79c6669e17
--- /dev/null
+++ b/pkg/emulators/storage/gcsutil/gcspagetoken.go
@@ -0,0 +1,37 @@
+package gcsutil
+
+//go:generate protoc --go_out=. --go_opt=paths=source_relative gcspagetoken.proto
+
+import (
+	"encoding/base64"
+	"fmt"
+
+	"google.golang.org/protobuf/proto"
+)
+
+// EncodePageToken returns a synthetic page token to find files greater than the given string.
+// If this is part of a prefix query, the token should fall within the prefixed range.
+// BRITTLE: relies on a reverse-engineered internal GCS token format, which may be subject to change.
+func EncodePageToken(greaterThan string) string {
+	bytes, err := proto.Marshal(&GcsPageToken{
+		LastFile: greaterThan,
+	})
+	if err != nil {
+		panic("could not encode gcsPageToken:" + err.Error())
+	}
+	return base64.StdEncoding.EncodeToString(bytes)
+}
+
+// DecodePageToken decodes a GCS pageToken to the name of the last file returned.
+func DecodePageToken(pageToken string) (string, error) {
+	bytes, err := base64.StdEncoding.DecodeString(pageToken)
+	if err != nil {
+		return "", fmt.Errorf("could not base64 decode pageToken %s: %w", pageToken, err)
+	}
+	var message GcsPageToken
+	if err := proto.Unmarshal(bytes, &message); err != nil {
+		return "", fmt.Errorf("could not unmarshal proto: %w", err)
+	}
+
+	return message.LastFile, nil
+}
diff --git a/pkg/emulators/storage/gcsutil/gcspagetoken.pb.go b/pkg/emulators/storage/gcsutil/gcspagetoken.pb.go
new file mode 100644
index 0000000000..52d42b48dd
--- /dev/null
+++ b/pkg/emulators/storage/gcsutil/gcspagetoken.pb.go
@@ -0,0 +1,146 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.23.4
+// source: gcspagetoken.proto
+
+package gcsutil
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type GcsPageToken struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The full name of the last result file, when returned from the server.
+	// When sent as a cursor, interpreted as "return files greater than this value".
+	LastFile string `protobuf:"bytes,1,opt,name=LastFile,proto3" json:"LastFile,omitempty"`
+}
+
+func (x *GcsPageToken) Reset() {
+	*x = GcsPageToken{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_gcspagetoken_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GcsPageToken) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GcsPageToken) ProtoMessage() {}
+
+func (x *GcsPageToken) ProtoReflect() protoreflect.Message {
+	mi := &file_gcspagetoken_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GcsPageToken.ProtoReflect.Descriptor instead.
+func (*GcsPageToken) Descriptor() ([]byte, []int) {
+	return file_gcspagetoken_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *GcsPageToken) GetLastFile() string {
+	if x != nil {
+		return x.LastFile
+	}
+	return ""
+}
+
+var File_gcspagetoken_proto protoreflect.FileDescriptor
+
+var file_gcspagetoken_proto_rawDesc = []byte{
+	0x0a, 0x12, 0x67, 0x63, 0x73, 0x70, 0x61, 0x67, 0x65, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x07, 0x67, 0x63, 0x73, 0x75, 0x74, 0x69, 0x6c, 0x22, 0x2a, 0x0a,
+	0x0c, 0x47, 0x63, 0x73, 0x50, 0x61, 0x67, 0x65, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x1a, 0x0a,
+	0x08, 0x4c, 0x61, 0x73, 0x74, 0x46, 0x69, 0x6c, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x4c, 0x61, 0x73, 0x74, 0x46, 0x69, 0x6c, 0x65, 0x42, 0x28, 0x5a, 0x26, 0x65, 0x6e, 0x63,
+	0x72, 0x2e, 0x64, 0x65, 0x76, 0x2f, 0x70, 0x6b, 0x67, 0x2f, 0x65, 0x6d, 0x75, 0x6c, 0x61, 0x74,
+	0x6f, 0x72, 0x73, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x2f, 0x67, 0x63, 0x73, 0x75,
+	0x74, 0x69, 0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_gcspagetoken_proto_rawDescOnce sync.Once
+	file_gcspagetoken_proto_rawDescData = file_gcspagetoken_proto_rawDesc
+)
+
+func file_gcspagetoken_proto_rawDescGZIP() []byte {
+	file_gcspagetoken_proto_rawDescOnce.Do(func() {
+		file_gcspagetoken_proto_rawDescData = protoimpl.X.CompressGZIP(file_gcspagetoken_proto_rawDescData)
+	})
+	return file_gcspagetoken_proto_rawDescData
+}
+
+var file_gcspagetoken_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_gcspagetoken_proto_goTypes = []interface{}{
+	(*GcsPageToken)(nil), // 0: gcsutil.GcsPageToken
+}
+var file_gcspagetoken_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_gcspagetoken_proto_init() }
+func file_gcspagetoken_proto_init() {
+	if File_gcspagetoken_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_gcspagetoken_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GcsPageToken); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_gcspagetoken_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_gcspagetoken_proto_goTypes,
+		DependencyIndexes: file_gcspagetoken_proto_depIdxs,
+		MessageInfos:      file_gcspagetoken_proto_msgTypes,
+	}.Build()
+	File_gcspagetoken_proto = out.File
+	file_gcspagetoken_proto_rawDesc = nil
+	file_gcspagetoken_proto_goTypes = nil
+	file_gcspagetoken_proto_depIdxs = nil
+}
diff --git a/pkg/emulators/storage/gcsutil/gcspagetoken.proto b/pkg/emulators/storage/gcsutil/gcspagetoken.proto
new file mode 100644
index 0000000000..ada481ed35
--- /dev/null
+++ b/pkg/emulators/storage/gcsutil/gcspagetoken.proto
@@ -0,0 +1,11 @@
+syntax = "proto3";
+
+package gcsutil;
+
+option go_package = "encr.dev/pkg/emulators/storage/gcsutil";
+
+message GcsPageToken{
+  // The full name of the last result file, when returned from the server.
+  // When sent as a cursor, interpreted as "return files greater than this value".
+  string LastFile = 1;
+}
diff --git a/pkg/emulators/storage/gcsutil/gcspagetoken_test.go b/pkg/emulators/storage/gcsutil/gcspagetoken_test.go
new file mode 100644
index 0000000000..17d2cd7bd2
--- /dev/null
+++ b/pkg/emulators/storage/gcsutil/gcspagetoken_test.go
@@ -0,0 +1,103 @@
+package gcsutil
+
+import (
+	"testing"
+
+	"gotest.tools/v3/assert"
+)
+
+// TODO(dragonsinth): it would be nice to have an integration test that hits real GCS with known data stored.
+
+// TestGcsTokenGen tests that we produce expected GCS tokens that match real data we collected.
+func TestGcsTokenGen(t *testing.T) {
+	tcs := []struct {
+		lastFile string
+		cursor   string
+	}{
+		{
+			lastFile: "containers/images/4dcc5142000d12f1a0f67c1e95df4035ca0ebba70117cc04101e53422d391d61/json",
+			cursor:   "Cldjb250YWluZXJzL2ltYWdlcy80ZGNjNTE0MjAwMGQxMmYxYTBmNjdjMWU5NWRmNDAzNWNhMGViYmE3MDExN2NjMDQxMDFlNTM0MjJkMzkxZDYxL2pzb24=",
+		},
+		{
+			lastFile: "containers/images/sha256:0e89fc4aeb48f92acff2dddaf610b2ceea5d76a93a44d4c20b31e69d1ed68c10",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6MGU4OWZjNGFlYjQ4ZjkyYWNmZjJkZGRhZjYxMGIyY2VlYTVkNzZhOTNhNDRkNGMyMGIzMWU2OWQxZWQ2OGMxMA==",
+		},
+		{
+			lastFile: "containers/images/sha256:2072bc4567e1f13081af323d046f39453f010471701fa11fc50b786b60512e99",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6MjA3MmJjNDU2N2UxZjEzMDgxYWYzMjNkMDQ2ZjM5NDUzZjAxMDQ3MTcwMWZhMTFmYzUwYjc4NmI2MDUxMmU5OQ==",
+		},
+		{
+			lastFile: "containers/images/sha256:43ecade58b2ddff87a696fada3970491de28c8ea1dca09c988b447b5c5a56412",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6NDNlY2FkZTU4YjJkZGZmODdhNjk2ZmFkYTM5NzA0OTFkZTI4YzhlYTFkY2EwOWM5ODhiNDQ3YjVjNWE1NjQxMg==",
+		},
+		{
+			lastFile: "containers/images/sha256:57076bf87737c2f448e75324ceba121b3b90372ab913f604f928a40da4ebddc7",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6NTcwNzZiZjg3NzM3YzJmNDQ4ZTc1MzI0Y2ViYTEyMWIzYjkwMzcyYWI5MTNmNjA0ZjkyOGE0MGRhNGViZGRjNw==",
+		},
+		{
+			lastFile: "containers/images/sha256:6f73a9b0052f169d8296382660a31050004b691f3e6252008545a3dcb7371a49",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6NmY3M2E5YjAwNTJmMTY5ZDgyOTYzODI2NjBhMzEwNTAwMDRiNjkxZjNlNjI1MjAwODU0NWEzZGNiNzM3MWE0OQ==",
+		},
+		{
+			lastFile: "containers/images/sha256:765b6a129bd04f06c876f3d5b5a346e71a72fae522b230215f67375ccb659a11",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6NzY1YjZhMTI5YmQwNGYwNmM4NzZmM2Q1YjVhMzQ2ZTcxYTcyZmFlNTIyYjIzMDIxNWY2NzM3NWNjYjY1OWExMQ==",
+		},
+		{
+			lastFile: "containers/images/sha256:973d921f391393e65d20a6e990e8ad5aa1129681ab8c54bf59c9192b809594c4",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6OTczZDkyMWYzOTEzOTNlNjVkMjBhNmU5OTBlOGFkNWFhMTEyOTY4MWFiOGM1NGJmNTljOTE5MmI4MDk1OTRjNA==",
+		},
+		{
+			lastFile: "containers/images/sha256:a9d5802ef798d88c0f4f9dc0094249db5e26d8a8a18ba4c2194aab4a44983d2f",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6YTlkNTgwMmVmNzk4ZDg4YzBmNGY5ZGMwMDk0MjQ5ZGI1ZTI2ZDhhOGExOGJhNGMyMTk0YWFiNGE0NDk4M2QyZg==",
+		},
+		{
+			lastFile: "containers/images/sha256:b5714cf3ed3a6b5f1fbc736ef0d5673c5637ccb14d53a23b8728dd828f21a22d",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6YjU3MTRjZjNlZDNhNmI1ZjFmYmM3MzZlZjBkNTY3M2M1NjM3Y2NiMTRkNTNhMjNiODcyOGRkODI4ZjIxYTIyZA==",
+		},
+		{
+			lastFile: "containers/images/sha256:bfdef622d405cb35c466aa29ea7411fd594e7985127bec4e8080572d7ef45cfd",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6YmZkZWY2MjJkNDA1Y2IzNWM0NjZhYTI5ZWE3NDExZmQ1OTRlNzk4NTEyN2JlYzRlODA4MDU3MmQ3ZWY0NWNmZA==",
+		},
+		{
+			lastFile: "containers/images/sha256:da543d0747020a528b8eee057912f6bd07e28f9c006606da28c82c70dac962e2",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6ZGE1NDNkMDc0NzAyMGE1MjhiOGVlZTA1NzkxMmY2YmQwN2UyOGY5YzAwNjYwNmRhMjhjODJjNzBkYWM5NjJlMg==",
+		},
+		{
+			lastFile: "containers/images/sha256:ee73b32b0f0a9dafabd9445a3380094f984858e79c85eafde56c2e037c039c6a",
+			cursor:   "Clljb250YWluZXJzL2ltYWdlcy9zaGEyNTY6ZWU3M2IzMmIwZjBhOWRhZmFiZDk0NDVhMzM4MDA5NGY5ODQ4NThlNzljODVlYWZkZTU2YzJlMDM3YzAzOWM2YQ==",
+		},
+		{
+			lastFile: "containers/repositories/library/cpu-test/tag_v1",
+			cursor:   "Ci9jb250YWluZXJzL3JlcG9zaXRvcmllcy9saWJyYXJ5L2NwdS10ZXN0L3RhZ192MQ==",
+		},
+		{
+			lastFile: "containers/repositories/library/dns-test/manifest_sha256:9759da4d052f154ba5d0ea32bf0404f442082e3dbad3f3cf6dc6529c6575aec2",
+			cursor:   "Cnljb250YWluZXJzL3JlcG9zaXRvcmllcy9saWJyYXJ5L2Rucy10ZXN0L21hbmlmZXN0X3NoYTI1Njo5NzU5ZGE0ZDA1MmYxNTRiYTVkMGVhMzJiZjA0MDRmNDQyMDgyZTNkYmFkM2YzY2Y2ZGM2NTI5YzY1NzVhZWMy",
+		},
+		{
+			lastFile: "containers/repositories/library/dns-test/manifest_sha256:ee49d4935c33260d84499e38dbd5ec3f426c9a2a7e100a901267c712874e4c1d",
+			cursor:   "Cnljb250YWluZXJzL3JlcG9zaXRvcmllcy9saWJyYXJ5L2Rucy10ZXN0L21hbmlmZXN0X3NoYTI1NjplZTQ5ZDQ5MzVjMzMyNjBkODQ0OTllMzhkYmQ1ZWMzZjQyNmM5YTJhN2UxMDBhOTAxMjY3YzcxMjg3NGU0YzFk",
+		},
+		{
+			lastFile: "containers/repositories/library/dns-test/tag_v2",
+			cursor:   "Ci9jb250YWluZXJzL3JlcG9zaXRvcmllcy9saWJyYXJ5L2Rucy10ZXN0L3RhZ192Mg==",
+		},
+		{
+			lastFile: "containers/repositories/library/kapi-test/manifest_sha256:ca6d9c13fba12363760e6d2495811081b1d2e6fcbf974e551605b65cb5b0a94e",
+			cursor:   "Cnpjb250YWluZXJzL3JlcG9zaXRvcmllcy9saWJyYXJ5L2thcGktdGVzdC9tYW5pZmVzdF9zaGEyNTY6Y2E2ZDljMTNmYmExMjM2Mzc2MGU2ZDI0OTU4MTEwODFiMWQyZTZmY2JmOTc0ZTU1MTYwNWI2NWNiNWIwYTk0ZQ==",
+		},
+		{
+			lastFile: "containers/repositories/library/memclient-test/manifest_sha256:7b7979b351c9a019062446c1f033b2f8491868cf943758f006ae219eca231e01",
+			cursor:   "Cn9jb250YWluZXJzL3JlcG9zaXRvcmllcy9saWJyYXJ5L21lbWNsaWVudC10ZXN0L21hbmlmZXN0X3NoYTI1Njo3Yjc5NzliMzUxYzlhMDE5MDYyNDQ2YzFmMDMzYjJmODQ5MTg2OGNmOTQzNzU4ZjAwNmFlMjE5ZWNhMjMxZTAx",
+		},
+	}
+
+	for i, tc := range tcs {
+		actualCursor := EncodePageToken(tc.lastFile)
+		assert.Equal(t, tc.cursor, actualCursor, "case %d", i)
+
+		lastFile, err := DecodePageToken(actualCursor)
+		assert.NilError(t, err, "case %i: failed to decode", i)
+		assert.Equal(t, tc.lastFile, lastFile, "case %d", i)
+	}
+}
diff --git a/pkg/emulators/storage/gcsutil/transient_lock_map.go b/pkg/emulators/storage/gcsutil/transient_lock_map.go
new file mode 100644
index 0000000000..1c2377d6db
--- /dev/null
+++ b/pkg/emulators/storage/gcsutil/transient_lock_map.go
@@ -0,0 +1,94 @@
+package gcsutil
+
+import (
+	"context"
+	"fmt"
+	"sync"
+)
+
+// TransientLockMap is a map of mutexes that is safe for concurrent access.  It does not bother to save mutexes after
+// they have been unlocked, and thus this data structure is best for situations where the space of keys is very large.
+// If the space of keys is small then it may be inefficient to constantly recreate mutexes whenever they are needed.
+type TransientLockMap struct {
+	mu    sync.Mutex              // the mutex that locks the map
+	locks map[string]*countedLock // all locks that are currently held
+}
+
+// NewTransientLockMap returns a new TransientLockMap.
+func NewTransientLockMap() *TransientLockMap {
+	return &TransientLockMap{
+		locks: make(map[string]*countedLock),
+	}
+}
+
+// Lock acquires the lock for the specified key and returns true, unless the context finishes before the lock could be
+// acquired, in which case false is returned.
+func (l *TransientLockMap) Lock(ctx context.Context, key string) bool {
+	lock := func() *countedLock {
+		// If there is high lock contention, we could use a readonly lock to check if the lock is already in the map (and
+		// thus no map writes are necessary), but this is complicated enough as it is so we skip that optimization for now.
+		l.mu.Lock()
+		defer l.mu.Unlock()
+
+		// Check if there is already a lock for this key.
+		lock, ok := l.locks[key]
+		if !ok {
+			// no lock yet, so make one and add it to the map
+			lock = newCountedLock()
+			l.locks[key] = lock
+		}
+
+		// Order is very important here.  First we have to increment the refcount while we still have the map locked; this
+		// will prevent anyone else from evicting this lock after we unlock the map but before we lock the key.  Second we
+		// have to unlock the map _before_ we start trying to lock the key (because locking the key could take a long time
+		// and we don't want to keep the map locked that whole time).
+		lock.refcount++ // incremented while holding _map_ lock
+		return lock
+	}()
+
+	if !lock.Lock(ctx) {
+		l.returnLockObj(key, lock)
+		return false
+	}
+	return true
+}
+
+// Unlock unlocks the lock for the specified key. Panics if the lock is not currently held.
+func (l *TransientLockMap) Unlock(key string) {
+	lock := func() *countedLock {
+		l.mu.Lock()
+		defer l.mu.Unlock()
+
+		lock, ok := l.locks[key]
+		if !ok {
+			panic(fmt.Sprintf("lock not held for key %s", key))
+		}
+		return lock
+	}()
+
+	lock.Unlock()
+	l.returnLockObj(key, lock)
+}
+
+// Run runs the given callback while holding the lock, unless the context finishes before the lock could be
+// acquired, in which case the context error is returned.
+func (l *TransientLockMap) Run(ctx context.Context, key string, f func(ctx context.Context) error) error {
+	if !l.Lock(ctx, key) {
+		return ctx.Err()
+	}
+	defer l.Unlock(key)
+	return f(ctx)
+}
+
+func (l *TransientLockMap) returnLockObj(key string, lock *countedLock) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	lock.refcount--
+	if lock.refcount < 0 {
+		panic(fmt.Sprintf("BUG: somehow the lock.refcount for %q dropped to %d", key, lock.refcount))
+	}
+	if lock.refcount == 0 {
+		delete(l.locks, key)
+	}
+}
diff --git a/pkg/emulators/storage/gcsutil/transient_lock_map_test.go b/pkg/emulators/storage/gcsutil/transient_lock_map_test.go
new file mode 100644
index 0000000000..ae53d7c38a
--- /dev/null
+++ b/pkg/emulators/storage/gcsutil/transient_lock_map_test.go
@@ -0,0 +1,293 @@
+package gcsutil
+
+import (
+	"context"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"gotest.tools/v3/assert"
+)
+
+func (l *TransientLockMap) len() int {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return len(l.locks)
+}
+
+func TestTransientLockMapBasics(t *testing.T) {
+	m := NewTransientLockMap()
+	upstream := make(chan int, 1)
+	downstream := make(chan int, 1)
+
+	waitFor := func(c <-chan int, expected int) {
+		val := <-c
+		assert.Equal(t, expected, val, "got an unexpected value from a channel")
+	}
+
+	readSignalNow := func(c <-chan int, expected int, msg string) {
+		select {
+		case val := <-c:
+			assert.Equal(t, expected, val, "got an unexpected value from a channel")
+		default:
+			t.Fatal(msg)
+		}
+	}
+
+	// wrt upstream and downstream, this goroutine is "above" the main thread, so it writes to downstream and reads from
+	// upstream
+	go func() {
+		lockWithin(t, m, "foo", 10*time.Millisecond)
+		downstream <- 1
+		waitFor(upstream, 2)
+		downstream <- 3
+		m.Unlock("foo")
+	}()
+
+	// wait until the other goroutine has locked "foo"
+	waitFor(downstream, 1)
+
+	// prove that we can lock other keys without a problem
+	lockWithin(t, m, "bar", 10*time.Millisecond)
+	lockWithin(t, m, "baz", 10*time.Millisecond)
+
+	assert.Equal(t, 3, m.len(), "wrong number of internal locks")
+
+	// start trying to lock "foo" which will block until we signal the other goroutine to unlock it
+	time.AfterFunc(20*time.Millisecond, func() { upstream <- 2 })
+	lockWithin(t, m, "foo", 200*time.Millisecond)
+
+	// there better be a 3 already queued up in the downstream, otherwise we locked too fast
+	readSignalNow(downstream, 3, "locked \"foo\" before the other goroutine unlocked it...")
+
+	assert.Equal(t, 3, m.len(), "wrong number of internal locks")
+
+	// we can unlock out of order, and locks go away as we unlock them
+	m.Unlock("bar")
+	assert.Equal(t, 2, m.len(), "wrong number of internal locks")
+
+	m.Unlock("baz")
+	assert.Equal(t, 1, m.len(), "wrong number of internal locks")
+
+	m.Unlock("foo")
+	assert.Equal(t, 0, m.len(), "wrong number of internal locks")
+}
+
+func TestTransientLockMapBadUnlock(t *testing.T) {
+	// call a function, and fail the test if the function doesn't panic
+	index := 0
+	shouldPanic := func(f func()) {
+		index++
+		defer func() {
+			if recovered := recover(); recovered != nil {
+				// ok, all is well
+			} else {
+				// we were supposed to panic but didn't - fail the test!
+				t.Fatalf("test #%d did not panic as expected...", index)
+			}
+		}()
+		f()
+	}
+
+	// unlocking a key that has never been referenced
+	m := NewTransientLockMap()
+	shouldPanic(func() {
+		m.Unlock("foo")
+	})
+	assert.Equal(t, 0, m.len(), "wrong number of internal locks")
+
+	// double-unlocking a key in the same goroutine
+	m = NewTransientLockMap()
+	shouldPanic(func() {
+		assertLock(t, m, "foo")
+		m.Unlock("foo")
+		m.Unlock("foo")
+	})
+	assert.Equal(t, 0, m.len(), "wrong number of internal locks")
+
+	// double-unlocking a key across 2 goroutines
+	m = NewTransientLockMap()
+	shouldPanic(func() {
+		signal := make(chan struct{})
+
+		go func() {
+			assertLock(t, m, "foo")
+			m.Unlock("foo")
+			close(signal)
+		}()
+
+		<-signal
+		m.Unlock("foo")
+	})
+	assert.Equal(t, 0, m.len(), "wrong number of internal locks")
+}
+
+func TestTransientLockMapSequence(t *testing.T) {
+	m := NewTransientLockMap()
+
+	// signals
+	partnerAboutToLock := make(chan struct{})
+	partnerGotLock := make(chan struct{})
+
+	assertLock(t, m, "foo")
+	go func() {
+		close(partnerAboutToLock)
+		assertLock(t, m, "foo")
+		close(partnerGotLock)
+		time.Sleep(125 * time.Millisecond)
+		m.Unlock("foo")
+	}()
+
+	<-partnerAboutToLock
+	time.Sleep(100 * time.Millisecond) // give our partner time to actually call Lock()
+	m.Unlock("foo")
+
+	<-partnerGotLock
+	start := time.Now()
+	assertLock(t, m, "foo")
+
+	// ensure that the prior Lock() call actually blocked and waited for a while, as intended
+	if d := time.Since(start); d < 100*time.Millisecond {
+		t.Fatalf("Lock acquired too fast (%s)", d)
+	}
+	m.Unlock("foo")
+	assert.Equal(t, 0, m.len(), "wrong number of internal locks")
+}
+
+func TestTransientLockMapContention(t *testing.T) {
+	m := NewTransientLockMap()
+
+	var wg sync.WaitGroup
+
+	assertLock(t, m, "foo")
+	assertLock(t, m, "bar")
+
+	for i := 0; i < 100; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			assertLock(t, m, "foo")
+			m.Unlock("foo")
+			assertLock(t, m, "bar")
+			m.Unlock("bar")
+		}()
+	}
+
+	time.Sleep(30 * time.Millisecond)
+	m.Unlock("bar")
+	m.Unlock("foo")
+
+	wg.Wait()
+
+	assert.Equal(t, 0, m.len(), "wrong number of internal locks")
+}
+
+func TestTransientLockMapTimeout(t *testing.T) {
+	m := NewTransientLockMap()
+
+	assertLock(t, m, "foo")
+
+	ctx, cancel := context.WithTimeout(context.Background(), 50*time.Millisecond)
+	defer cancel()
+
+	res := m.Lock(ctx, "foo")
+	assert.Equal(t, false, res, "lock foo (2)")
+
+	m.Unlock("foo")
+	lockWithin(t, m, "foo", 10*time.Millisecond) // should be able to lock near instantly
+
+	ctx2, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		res := m.Lock(ctx2, "foo")
+		assert.Equal(t, false, res, "lock foo (4)")
+		close(done)
+	}()
+
+	time.Sleep(25 * time.Millisecond)
+
+	// goroutine should not be done yet (i.e. Lock() should still be blocked)
+	select {
+	case <-done:
+		t.Fatal("done should not be closed yet!")
+	default:
+	}
+
+	cancel()
+
+	select {
+	case <-time.After(25 * time.Millisecond):
+		t.Fatal("timeout waiting for done channel to close")
+	case <-done:
+		// ok
+	}
+
+	// finally, verify that we can unlock and lock still
+	m.Unlock("foo")
+	lockWithin(t, m, "foo", 10*time.Millisecond) // should be able to lock near instantly
+	m.Unlock("foo")
+
+	assert.Equal(t, 0, m.len(), "wrong number of internal locks")
+
+	// We should not be able to lock with an already-cancelled context.
+	for i := 0; i < 10; i++ {
+		assert.Assert(t, !m.Lock(ctx2, "foo"), "lock foo (final) expected canceled")
+	}
+}
+
+func TestTransientLockMapRun(t *testing.T) {
+	m := NewTransientLockMap()
+
+	start := make(chan struct{})
+	var wgSucc sync.WaitGroup
+	var wgFail sync.WaitGroup
+	var nFail int32
+	var nSucc int32
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	for i := 0; i < 10; i++ {
+		if i == 0 {
+			wgSucc.Add(1)
+		} else {
+			wgFail.Add(1)
+		}
+		go func() {
+			<-start
+			err := m.Run(ctx, "foo", func(ctx context.Context) error {
+				// Whoever got the lock should cancel everyone else.
+				cancel()
+				wgFail.Wait()
+				return nil
+			})
+			if err == nil {
+				defer wgSucc.Done()
+				atomic.AddInt32(&nSucc, 1)
+			} else {
+				defer wgFail.Done()
+				if err == context.Canceled {
+					atomic.AddInt32(&nFail, 1)
+				} else {
+					t.Errorf("expected canceled, got %T: %s", err, err)
+				}
+			}
+		}()
+	}
+
+	close(start)
+	wgSucc.Wait()
+
+	assert.Equal(t, int32(1), nSucc, "wrong # success")
+	assert.Equal(t, int32(9), nFail, "wrong # failures")
+}
+
+func assertLock(t *testing.T, m *TransientLockMap, key string) {
+	assert.Assert(t, m.Lock(context.Background(), key), "should have locked")
+}
+
+// grabs a lock, panicking if this takes longer than expected
+func lockWithin(t *testing.T, m *TransientLockMap, key string, timeout time.Duration) {
+	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	defer cancel()
+	assert.Assert(t, m.Lock(ctx, key), "should have locked")
+}
diff --git a/pkg/encorebuild/buildconf/config.go b/pkg/encorebuild/buildconf/config.go
new file mode 100644
index 0000000000..8ed624c1b8
--- /dev/null
+++ b/pkg/encorebuild/buildconf/config.go
@@ -0,0 +1,67 @@
+package buildconf
+
+import (
+	"runtime"
+
+	"github.com/rs/zerolog"
+
+	"encr.dev/pkg/encorebuild/buildutil"
+	"encr.dev/pkg/option"
+)
+
+type Config struct {
+	// Logger to use.
+	Log zerolog.Logger
+
+	// Target OS and architecture (in GOOS/GOARCH format)
+	OS   string
+	Arch string
+
+	// Release is true if this is a release build.
+	Release bool
+
+	// The version being built.
+	Version string
+
+	// RepoDir is the path to the encore repo on the filesystem.
+	RepoDir string
+
+	// CacheDir is the cache dir to use for the build.
+	CacheDir string
+
+	// The path to the MacOS SDK. Must be set for cross-compiles to macOS.
+	MacSDKPath option.Option[string]
+
+	// Whether or not to publish packages to NPM. Only used if Release is also true.
+	PublishNPMPackages bool
+
+	// Whether to copy the built native module back to the repo dir.
+	CopyToRepo bool
+
+	// RustBuilder will override the automatic builder selection if set.
+	RustBuilder option.Option[string]
+}
+
+// IsCross reports whether the build is a cross-compile.
+func (cfg *Config) IsCross() bool {
+	return cfg.OS != runtime.GOOS || cfg.Arch != runtime.GOARCH
+}
+
+func (cfg *Config) CrossMacSDKPath() string {
+	if cfg.OS != "darwin" {
+		return ""
+	}
+	val, ok := cfg.MacSDKPath.Get()
+	if !ok {
+		buildutil.Bailf("macOS SDK path must be set for cross-compiles to macOS")
+	}
+	return val
+}
+
+// Exe returns the executable file suffix for the target OS.
+func (cfg *Config) Exe() string {
+	if cfg.OS == "windows" {
+		return ".exe"
+	}
+	return ""
+}
diff --git a/pkg/encorebuild/buildutil/buildutil.go b/pkg/encorebuild/buildutil/buildutil.go
new file mode 100644
index 0000000000..1f22aa6e29
--- /dev/null
+++ b/pkg/encorebuild/buildutil/buildutil.go
@@ -0,0 +1,83 @@
+package buildutil
+
+import (
+	"fmt"
+	"os/exec"
+	"sync"
+
+	"github.com/cockroachdb/errors"
+)
+
+type Bailout struct {
+	Err error
+}
+
+func (b Bailout) Error() string {
+    return b.Err.Error()
+}
+
+func Bail(err error) {
+	panic(Bailout{err})
+}
+
+func Bailf(format string, args ...any) {
+	Bail(fmt.Errorf(format, args...))
+}
+
+func Must[T any](val T, err error) T {
+	if err != nil {
+		Bail(err)
+	}
+	return val
+}
+
+func Check(err error) {
+	if err != nil {
+		Bail(err)
+	}
+}
+
+func TarGzip(srcDirectory string, tarFile string) error {
+	// Create the tar.gz file from the src directory
+	cmd := exec.Command("tar", "-czf", tarFile, "-C", srcDirectory, ".")
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return errors.Wrapf(err, "failed to create tar.gz: %s", out)
+	}
+	return nil
+}
+
+// RunParallel runs the given functions in parallel, bailing with the first error
+func RunParallel(functions ...func()) {
+	var wg sync.WaitGroup
+	wg.Add(len(functions))
+	var firstErr error
+	var mu sync.Mutex
+
+	for _, f := range functions {
+		f := f
+		go func() {
+			defer wg.Done()
+
+			defer func() {
+				if err := recover(); err != nil {
+					if b, ok := err.(Bailout); ok {
+						mu.Lock()
+						defer mu.Unlock()
+						if firstErr == nil {
+							firstErr = b.Err
+						}
+					} else {
+						panic(err)
+					}
+				}
+			}()
+
+			f()
+		}()
+	}
+
+	wg.Wait()
+
+	Check(firstErr)
+}
diff --git a/pkg/encorebuild/cmd/build-local-binary/build-local-binary.go b/pkg/encorebuild/cmd/build-local-binary/build-local-binary.go
new file mode 100644
index 0000000000..f7ee09812d
--- /dev/null
+++ b/pkg/encorebuild/cmd/build-local-binary/build-local-binary.go
@@ -0,0 +1,78 @@
+package main
+
+import (
+	"flag"
+	"os"
+	"path/filepath"
+	"runtime"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/internal/version"
+	"encr.dev/pkg/encorebuild"
+	"encr.dev/pkg/encorebuild/buildconf"
+	"encr.dev/pkg/option"
+)
+
+func join(strs ...string) string {
+	return filepath.Join(strs...)
+}
+
+var archFlag = flag.String("arch", runtime.GOARCH, "the architecture to target")
+var osFlag = flag.String("os", runtime.GOOS, "the operating system to target")
+var builderFlag = flag.String("builder", "", "the builder to use")
+
+func main() {
+	binary := os.Args[1]
+	if binary == "" || binary[0] == '-' {
+		log.Fatal().Msg("expected binary name as first argument")
+	}
+	os.Args = os.Args[1:]
+	flag.Parse()
+	log.Logger = zerolog.New(zerolog.NewConsoleWriter()).With().Caller().Timestamp().Stack().Logger()
+
+	root, err := os.Getwd()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to get working directory")
+	} else if _, err := os.Stat(join(root, ".git")); err != nil {
+		log.Fatal().Err(err).Msg("expected to run build-local-binary from encr.dev repository root")
+	}
+
+	userCacheDir, err := os.UserCacheDir()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to get user cache dir")
+	}
+	cacheDir := filepath.Join(userCacheDir, "encore-build-cache")
+
+	builder := option.None[string]()
+
+	if builderFlag != nil && *builderFlag != "" {
+		builder = option.Some(*builderFlag)
+	}
+
+	cfg := &buildconf.Config{
+		Log:         log.Logger,
+		OS:          *osFlag,
+		Arch:        *archFlag,
+		Release:     false,
+		Version:     version.Version,
+		RepoDir:     root,
+		CacheDir:    cacheDir,
+		MacSDKPath:  option.None[string](),
+		CopyToRepo:  true,
+		RustBuilder: builder,
+	}
+
+	switch binary {
+	case "all":
+		encorebuild.NewJSRuntimeBuilder(cfg).Build()
+		encorebuild.NewSupervisorBuilder(cfg).Build()
+	case "supervisor-encore":
+		encorebuild.NewSupervisorBuilder(cfg).Build()
+	case "encore-runtime.node":
+		encorebuild.NewJSRuntimeBuilder(cfg).Build()
+	default:
+		log.Fatal().Msgf("unknown binary %s", binary)
+	}
+}
diff --git a/pkg/encorebuild/cmd/make-release/make-release.go b/pkg/encorebuild/cmd/make-release/make-release.go
new file mode 100644
index 0000000000..60a3129f10
--- /dev/null
+++ b/pkg/encorebuild/cmd/make-release/make-release.go
@@ -0,0 +1,130 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"runtime/debug"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/internal/version"
+	"encr.dev/pkg/encorebuild"
+	"encr.dev/pkg/encorebuild/buildconf"
+	"encr.dev/pkg/encorebuild/buildutil"
+	"encr.dev/pkg/option"
+)
+
+func join(strs ...string) string {
+	return filepath.Join(strs...)
+}
+
+func main() {
+	log.Logger = zerolog.New(zerolog.NewConsoleWriter()).With().Caller().Timestamp().Stack().Logger()
+
+	dst := flag.String("dst", "", "build destination")
+	versionStr := flag.String("v", "", "version number")
+	onlyBuild := flag.String("only", "", "build only the valid target ('darwin-arm64' or 'darwin' or 'arm64' or '' for all)")
+	publishNPM := flag.Bool("publish-npm", false, "publish packages to npm")
+	flag.Parse()
+	if *dst == "" || *versionStr == "" {
+		log.Fatal().Msgf("missing -dst %q or -v %q", *dst, *versionStr)
+	}
+
+	if (*versionStr)[0] != 'v' {
+		log.Fatal().Msg("version must start with 'v'")
+	}
+	switch version.ChannelFor(*versionStr) {
+	case version.GA, version.Beta, version.Nightly, version.DevBuild:
+		// no-op
+	default:
+		log.Fatal().Msgf("unknown version channel for %s", *versionStr)
+	}
+
+	root, err := os.Getwd()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to get working directory")
+	} else if _, err := os.Stat(join(root, "go.mod")); err != nil {
+		log.Fatal().Err(err).Msg("expected to run make-release.go from encr.dev repository root")
+	}
+
+	userCacheDir, err := os.UserCacheDir()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to get user cache dir")
+	}
+	cacheDir := filepath.Join(userCacheDir, "encore-build-cache")
+
+	*dst, err = filepath.Abs(*dst)
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to get absolute path to destination")
+	}
+
+	// Prepare the target directory.
+	if err := os.RemoveAll(*dst); err != nil {
+		log.Fatal().Err(err).Msg("failed to remove existing target dir")
+	} else if err := os.MkdirAll(filepath.Join(*dst, "artifacts"), 0755); err != nil {
+		log.Fatal().Err(err).Msg("failed to create target dir")
+	}
+
+	type buildTarget struct {
+		OS   string
+		Arch string
+	}
+
+	targets := []buildTarget{
+		{"darwin", "amd64"},
+		{"darwin", "arm64"},
+		{"linux", "amd64"},
+		{"linux", "arm64"},
+		{"windows", "amd64"},
+	}
+
+	var parallelFuncs []func()
+	// Give them the common settings
+	for _, t := range targets {
+		if *onlyBuild != "" && !(*onlyBuild == fmt.Sprintf("%s-%s", t.OS, t.Arch) ||
+			*onlyBuild == t.OS ||
+			*onlyBuild == t.Arch) {
+			continue
+		}
+
+		b := &encorebuild.DistBuilder{
+			Cfg: &buildconf.Config{
+				Log:                log.With().Str("os", t.OS).Str("arch", t.Arch).Logger(),
+				OS:                 t.OS,
+				Arch:               t.Arch,
+				Release:            true,
+				Version:            *versionStr,
+				RepoDir:            root,
+				CacheDir:           cacheDir,
+				MacSDKPath:         option.Some("/sdk"),
+				PublishNPMPackages: *publishNPM,
+			},
+			DistBuildDir:     join(*dst, t.OS+"_"+t.Arch),
+			ArtifactsTarFile: join(*dst, "artifacts", "encore-"+*versionStr+"-"+t.OS+"_"+t.Arch+".tar.gz"),
+		}
+
+		parallelFuncs = append(parallelFuncs, b.Build)
+	}
+
+	defer func() {
+		if err := recover(); err != nil {
+			if b, ok := err.(buildutil.Bailout); ok {
+				log.Fatal().Err(b.Err).Msg("failed to build")
+			} else {
+				stack := debug.Stack()
+				log.Fatal().Msgf("failed to build: unrecovered panic: %v: \n%s", err, stack)
+			}
+		}
+	}()
+
+	buildutil.RunParallel(parallelFuncs...)
+	log.Info().Msg("all distributions built successfully")
+
+	if *publishNPM {
+		encorebuild.PublishNPMPackages(root, *versionStr)
+	}
+	log.Info().Msg("successfully published NPM package")
+}
diff --git a/pkg/encorebuild/compile/compile.go b/pkg/encorebuild/compile/compile.go
new file mode 100644
index 0000000000..4c2da4a086
--- /dev/null
+++ b/pkg/encorebuild/compile/compile.go
@@ -0,0 +1,274 @@
+package compile
+
+import (
+	osPkg "os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+
+	"encr.dev/pkg/encorebuild/buildconf"
+	. "encr.dev/pkg/encorebuild/buildutil"
+)
+
+// GoBinary compiles a Go binary for the given OS and architecture with GCP enabled
+//
+// This file was inspired by the blog post: https://lucor.dev/post/cross-compile-golang-fyne-project-using-zig/
+func GoBinary(cfg *buildconf.Config, outputPath string, entrypointPkg string, ldFlags []string) {
+	cc, cxx, compilerEnvs, compilerLDFlags := compilerSettings(cfg)
+	if cfg.OS == "windows" && !strings.HasSuffix(outputPath, ".exe") {
+		outputPath += ".exe"
+	}
+
+	combinedLDFlags := append(append([]string{}, compilerLDFlags...), ldFlags...)
+
+	baseEnvs := goBaseEnvs(cfg)
+	envs := append(baseEnvs,
+		"CGO_ENABLED=1",
+		"CC="+cc,
+		"CXX="+cxx,
+	)
+	envs = append(envs, compilerEnvs...)
+
+	// Build the go build args
+	args := []string{"build",
+		"-trimpath",
+		"-tags", "netgo", // Always force netgo otherwise we end up with segfaults on MacOS
+	}
+	if len(combinedLDFlags) > 0 {
+		args = append(args, "-ldflags="+strings.Join(combinedLDFlags, " "))
+	}
+	if cfg.OS == "darwin" {
+		args = append(args, "-buildmode=pie")
+	}
+	args = append(args,
+		"-o", outputPath,
+		entrypointPkg,
+	)
+
+	// Build the command
+	cmd := exec.Command("go", args...)
+	cmd.Env = envs
+
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		Bailf("failed to compile go binary: %v: %s", err, string(out))
+	}
+}
+
+func goBaseEnvs(cfg *buildconf.Config) []string {
+	gocache := filepath.Join(cfg.CacheDir, "go", cfg.OS, cfg.Arch)
+	Check(osPkg.MkdirAll(gocache, 0755))
+	return append(osPkg.Environ(),
+		"GOOS="+cfg.OS,
+		"GOARCH="+cfg.Arch,
+		"GOCACHE="+gocache,
+	)
+}
+
+// CompileRustBinary compiles a Rust binary for the given OS and architecture
+//
+// We're using zigbuild to perform easy cross compiling
+func RustBinary(cfg *buildconf.Config, artifactPath, outputPath string, cratePath string, libc string, extraFeatures []string, extraEnvVars ...string) {
+	if cfg.OS == "windows" {
+		if !strings.HasSuffix(artifactPath, ".dll") {
+			outputPath += ".exe"
+			artifactPath += ".exe"
+		}
+	}
+
+	useZig := cfg.IsCross() || cfg.Release
+	useCross := false
+
+	if cfg.IsCross() && runtime.GOOS == "darwin" {
+		// check is cross is installed
+		_, err := exec.LookPath("cross")
+		if err == nil {
+			useCross = true
+			useZig = false
+		}
+	}
+
+	if builder, ok := cfg.RustBuilder.Get(); ok {
+		switch builder {
+		case "cargo":
+			useCross = false
+			useZig = false
+		case "zigbuild":
+			useCross = false
+			useZig = true
+		case "cross-rs":
+			useCross = true
+			useZig = false
+		default:
+			Bailf("unknown builder: %q", cfg.RustBuilder)
+		}
+	}
+
+	envs := append(extraEnvVars, osPkg.Environ()...)
+	var target, zigTargetSuffix string
+	switch cfg.OS {
+	case "darwin":
+		switch cfg.Arch {
+		case "amd64":
+			target = "x86_64-apple-darwin"
+		case "arm64":
+			target = "aarch64-apple-darwin"
+		default:
+			Bailf("unsupported architecture for darwin: %q", cfg.Arch)
+		}
+
+		// We need to set the SDKROOT for cross compiling to MacOS
+		if cfg.IsCross() {
+			envs = append(envs, "SDKROOT="+cfg.CrossMacSDKPath())
+		}
+
+	case "linux":
+		switch cfg.Arch {
+		case "amd64":
+			target = "x86_64-unknown-linux-" + libc
+		case "arm64":
+			target = "aarch64-unknown-linux-" + libc
+		default:
+			Bailf("unsupported architecture for linux: %q", cfg.Arch)
+		}
+
+		// If we're using zig, specify the glibc version we want.
+		if useZig {
+			zigTargetSuffix = ".2.31"
+		}
+
+	case "windows":
+		switch cfg.Arch {
+		case "amd64":
+			target = "x86_64-pc-windows-gnu"
+		default:
+			Bailf("unsupported architecture for windows: %q", cfg.Arch)
+		}
+
+	default:
+		Bailf("unsupported os: %q", cfg.OS)
+	}
+
+	// Create a cache dir for the go build cache for this specific OS and architecture pair
+	path := filepath.Join(cfg.CacheDir, "rust", cfg.OS, cfg.Arch)
+
+	Check(osPkg.MkdirAll(path, 0755))
+
+	// Build the command
+	cargoArgs := []string{
+		"build",
+		"--target", target + zigTargetSuffix,
+		"--target-dir", path,
+	}
+	if useZig {
+		cargoArgs[0] = "zigbuild"
+	}
+	buildMode := "debug"
+	if cfg.Release {
+		cargoArgs = append(cargoArgs, "--release")
+		buildMode = "release"
+	}
+
+	if len(extraFeatures) > 0 {
+		cargoArgs = append(cargoArgs, "--features", strings.Join(extraFeatures, ","))
+	}
+
+	builder := "cargo"
+	if useCross {
+		builder = "cross"
+	}
+	cmd := exec.Command(builder, cargoArgs...)
+	// forwards the output to the parent process
+	cmd.Stdout = osPkg.Stdout
+	cmd.Stderr = osPkg.Stderr
+	cmd.Dir = cratePath
+	cmd.Env = envs
+
+	// Cargo can't run multiple compiles at the same time for the same crate
+	// so let's lock here, then unlock once the compile has finished
+	cargoLock.Lock()
+	defer cargoLock.Unlock()
+
+	// nosemgrep
+	if err := cmd.Run(); err != nil {
+		Bailf("failed to compile rust binary: %v", err)
+	}
+
+	// Copy the binary to the output path
+	binaryFile := filepath.Join(path, target, buildMode, artifactPath)
+	cmd = exec.Command("cp", binaryFile, outputPath)
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		Bailf("failed to copy rust binary: %v: %s", err, string(out))
+	}
+}
+
+// compilerSettings returns the CC and CXX settings for the given OS and architecture
+func compilerSettings(cfg *buildconf.Config) (cc, cxx string, envs, ldFlags []string) {
+	var zigTarget string
+	var zigArgs string
+	zigBinary := "zig"
+
+	switch cfg.OS {
+	case "darwin":
+		zigBinary = "/usr/local/zig-0.9.1/zig" // We need an explicit version of Zig for darwin (0.11.0 compiles, build causes runtime errors)
+		ldFlags = []string{"-s", "-w"}
+
+		switch cfg.Arch {
+		case "amd64":
+			zigTarget = "x86_64-macos.10.12"
+		case "arm64":
+			zigTarget = "aarch64-macos.11.1"
+		default:
+			Bailf("unsupported architecture for darwin: %q", cfg.Arch)
+		}
+
+		// We need to set some extra stuff if we're cross compiling to MacOS
+		if cfg.IsCross() {
+			sdkPath := cfg.CrossMacSDKPath()
+			zigArgs = " -isysroot " + sdkPath + " -iwithsysroot /usr/include -iframeworkwithsysroot /System/Library/Frameworks"
+			envs = []string{
+				"CGO_LDFLAGS=--sysroot " + sdkPath + " -F/System/Library/Frameworks -L/usr/lib",
+			}
+		}
+
+	case "linux":
+		switch cfg.Arch {
+		case "amd64":
+			// Note: we're not targeting a specific glibc version here as we tried before
+			// with 2.35 - but for some reason we still get runtime errors not finding 2.34 or 2.33 on WSL (which had 2.35)
+			zigTarget = "x86_64-linux-gnu.2.31"
+			zigArgs = " -static -isystem /usr/include"
+		case "arm64":
+			zigTarget = "aarch64-linux-gnu.2.31"
+			zigArgs = " -static -isystem /usr/include"
+			envs = []string{
+				"PKG_CONFIG_LIBDIR=/usr/lib/aarch64-linux-gnu/pkgconfig",
+			}
+		default:
+			Bailf("unsupported architecture for linux: %q", cfg.Arch)
+		}
+
+	case "windows":
+		switch cfg.Arch {
+		case "amd64":
+			zigTarget = "x86_64-windows-gnu"
+		default:
+			Bailf("unsupported architecture for windows: %q", cfg.Arch)
+		}
+
+		ldFlags = []string{"-H=windowsgui"}
+
+	default:
+		Bailf("unsupported os: %q", cfg.OS)
+	}
+
+	cc = zigBinary + " cc -target " + zigTarget + zigArgs
+	cxx = zigBinary + " c++ -target " + zigTarget + zigArgs
+	return cc, cxx, envs, ldFlags
+}
+
+// cargoLock is a lock to prevent concurrent cargo builds.
+var cargoLock sync.Mutex
diff --git a/pkg/encorebuild/dist_builder.go b/pkg/encorebuild/dist_builder.go
new file mode 100644
index 0000000000..880288dab8
--- /dev/null
+++ b/pkg/encorebuild/dist_builder.go
@@ -0,0 +1,194 @@
+package encorebuild
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"encr.dev/internal/version"
+	"encr.dev/pkg/encorebuild/buildconf"
+	. "encr.dev/pkg/encorebuild/buildutil"
+	"encr.dev/pkg/encorebuild/compile"
+	"encr.dev/pkg/encorebuild/githubrelease"
+)
+
+// A DistBuilder is a builder for a specific distribution of Encore.
+//
+// Anything which does not need to be built for a specific distribution
+// should be built in the main builder before these are invoked.
+//
+// Make release will run multiple of these in parallel to build all the
+// distributions.
+type DistBuilder struct {
+	Cfg              *buildconf.Config
+	DistBuildDir     string // The directory to build into
+	ArtifactsTarFile string // The directory to put the final tar.gz artifact into
+}
+
+func (d *DistBuilder) buildEncoreCLI() {
+	// Build the CLI binaries.
+	d.Cfg.Log.Info().Msg("building encore binary...")
+
+	linkerOpts := []string{
+		"-X", fmt.Sprintf("'encr.dev/internal/version.Version=%s'", d.Cfg.Version),
+	}
+
+	// If we're building a nightly, devel or beta version, we need to set the default config directory
+	var versionSuffix string
+	switch version.ChannelFor(d.Cfg.Version) {
+	case version.GA:
+		versionSuffix = ""
+	case version.Beta:
+		versionSuffix = "-beta"
+	case version.Nightly:
+		versionSuffix = "-nightly"
+	case version.DevBuild:
+		versionSuffix = "-develop"
+	default:
+		Bailf("unknown version channel for %s", d.Cfg.Version)
+	}
+
+	if versionSuffix != "" {
+		linkerOpts = append(linkerOpts,
+			"-X", "'encr.dev/internal/conf.defaultConfigDirectory=encore"+versionSuffix+"'",
+		)
+	}
+
+	compile.GoBinary(
+		d.Cfg,
+		join(d.DistBuildDir, "bin", "encore"+versionSuffix),
+		"./cli/cmd/encore",
+		linkerOpts,
+	)
+	d.Cfg.Log.Info().Msg("encore built successfully")
+}
+
+func (d *DistBuilder) buildGitHook() {
+	// Build the git-remote-encore binary.
+	d.Cfg.Log.Info().Msg("building git-remote-encore binary...")
+	compile.GoBinary(
+		d.Cfg,
+		join(d.DistBuildDir, "bin", "git-remote-encore"),
+		"./cli/cmd/git-remote-encore",
+		nil,
+	)
+	d.Cfg.Log.Info().Msg("git-remote-encore built successfully")
+}
+
+func (d *DistBuilder) buildTSBundler() {
+	// Build the TS bundler.
+	d.Cfg.Log.Info().Msg("building tsbundler binary...")
+
+	linkerOpts := []string{
+		"-X", fmt.Sprintf("'encr.dev/internal/version.Version=%s'", d.Cfg.Version),
+	}
+
+	compile.GoBinary(
+		d.Cfg,
+		join(d.DistBuildDir, "bin", "tsbundler-encore"),
+		"./cli/cmd/tsbundler-encore",
+		linkerOpts,
+	)
+	d.Cfg.Log.Info().Msg("tsbundler built successfully")
+}
+
+func (d *DistBuilder) buildTSParser() {
+	// Build the TS parser.
+	d.Cfg.Log.Info().Msg("building tsparser binary...")
+	compile.RustBinary(
+		d.Cfg,
+		"tsparser-encore",
+		join(d.DistBuildDir, "bin", "tsparser-encore"),
+		"./tsparser",
+		"gnu",
+		[]string{}, // features
+		fmt.Sprintf("ENCORE_VERSION=%s", d.Cfg.Version),
+	)
+	d.Cfg.Log.Info().Msg("tsparser built successfully")
+}
+
+func (d *DistBuilder) buildNodePlugin() {
+	builder := NewJSRuntimeBuilder(d.Cfg)
+	builder.Build()
+
+	d.Cfg.Log.Info().Msg("copying encore runtime for JS...")
+	{
+		cmd := exec.Command("cp", "-r", "runtimes/js/.", join(d.DistBuildDir, "runtimes", "js")+"/")
+		cmd.Dir = d.Cfg.RepoDir
+		// nosemgrep
+		if out, err := cmd.CombinedOutput(); err != nil {
+			Bailf("failed to copy encore go runtime: %v: %s", err, out)
+		}
+	}
+
+	{
+		src := builder.NativeModuleOutput()
+		dst := join(d.DistBuildDir, "runtimes", "js", "encore-runtime.node")
+		cmd := exec.Command("cp", src, dst)
+		// nosemgrep
+		if out, err := cmd.CombinedOutput(); err != nil {
+			Bailf("failed to copy encore go runtime: %v: %s", err, out)
+		}
+	}
+
+	d.Cfg.Log.Info().Msg("encore runtime for js copied successfully")
+}
+
+func (d *DistBuilder) downloadEncoreGo() {
+	// Step 1: Find out the latest release version for Encore's Go distribution
+	d.Cfg.Log.Info().Msg("downloading latest encore-go...")
+	encoreGoArchive := githubrelease.DownloadLatest(d.Cfg, "encoredev", "go")
+
+	d.Cfg.Log.Info().Msg("extracting encore-go...")
+	githubrelease.Extract(encoreGoArchive, d.DistBuildDir)
+	d.Cfg.Log.Info().Msg("encore-go extracted successfully")
+}
+
+func (d *DistBuilder) copyEncoreRuntimeForGo() {
+	d.Cfg.Log.Info().Msg("copying encore runtime for Go...")
+	cmd := exec.Command("cp", "-r", "runtimes/go/.", join(d.DistBuildDir, "runtimes", "go")+"/")
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		Bailf("failed to copy encore go runtime: %v: %s", err, out)
+	}
+	d.Cfg.Log.Info().Msg("encore runtime for go copied successfully")
+}
+
+// Build builds the distribution running each step in order
+func (d *DistBuilder) Build() {
+	d.Cfg.Log.Info().Msg("building distribution...")
+
+	if d.DistBuildDir == "" {
+		Bailf("DistBuildDir not set")
+	}
+
+	// Prepare the target directory.
+	Check(os.RemoveAll(d.DistBuildDir))
+	Check(os.MkdirAll(d.DistBuildDir, 0755))
+	Check(os.MkdirAll(join(d.DistBuildDir, "bin"), 0755))
+	Check(os.MkdirAll(join(d.DistBuildDir, "runtimes"), 0755))
+	Check(os.MkdirAll(join(d.DistBuildDir, "runtimes", "go"), 0755))
+	Check(os.MkdirAll(join(d.DistBuildDir, "runtimes", "js"), 0755))
+
+	// Now we're prepped, start building.
+	RunParallel(
+		d.buildEncoreCLI,
+		d.buildTSBundler,
+		d.buildGitHook,
+		d.buildTSParser,
+		d.buildNodePlugin,
+		d.copyEncoreRuntimeForGo,
+		d.downloadEncoreGo,
+	)
+
+	// Now tar gzip the directory
+	d.Cfg.Log.Info().Str("tar_file", d.ArtifactsTarFile).Msg("creating distribution tar file...")
+	TarGzip(d.DistBuildDir, d.ArtifactsTarFile)
+
+	d.Cfg.Log.Info().Str("tar_file", d.ArtifactsTarFile).Msg("distribution built successfully")
+}
+
+func join(segs ...string) string {
+	return filepath.Join(segs...)
+}
diff --git a/pkg/encorebuild/gentypedefs/gentypedefs.go b/pkg/encorebuild/gentypedefs/gentypedefs.go
new file mode 100644
index 0000000000..d183255378
--- /dev/null
+++ b/pkg/encorebuild/gentypedefs/gentypedefs.go
@@ -0,0 +1,307 @@
+package gentypedefs
+
+import (
+	"bytes"
+	_ "embed"
+	"encoding/json"
+	"fmt"
+	"os"
+	"slices"
+	"sort"
+	"strings"
+	"text/template"
+
+	"golang.org/x/exp/maps"
+)
+
+type Config struct {
+	// The version string to embed
+	ReleaseVersion string
+
+	// The path to the intermediate type definition file.
+	TypeDefFile string
+
+	// The path to the .d.ts output file.
+	DtsOutputFile string
+
+	// The path to the .cjs output file.
+	CjsOutputFile string
+}
+
+func Generate(cfg Config) error {
+	typeDefStr, exports, err := processTypeDef(cfg.TypeDefFile, false, DefaultTypeDefHeader)
+	if err != nil {
+		return fmt.Errorf("failed to parse type definitions: %v", err)
+	}
+
+	err = os.WriteFile(cfg.DtsOutputFile, []byte(typeDefStr), 0644)
+	if err != nil {
+		return fmt.Errorf("failed to write .d.ts file: %v", err)
+	}
+
+	{
+		out, err := renderExportTemplate(cfg.ReleaseVersion, exports)
+		if err != nil {
+			return fmt.Errorf("failed to render .cjs file: %v", err)
+		}
+		err = os.WriteFile(cfg.CjsOutputFile, out, 0644)
+		if err != nil {
+			return fmt.Errorf("failed to write .cjs file: %v", err)
+		}
+	}
+
+	return nil
+}
+
+//go:embed napi.cjs.tmpl
+var napiCjsTemplate string
+
+func renderExportTemplate(version string, exports []string) ([]byte, error) {
+	tmpl, err := template.New("napi.cjs").Parse(napiCjsTemplate)
+	if err != nil {
+		return nil, err
+	}
+
+	var buf bytes.Buffer
+	err = tmpl.Execute(&buf, map[string]any{
+		"ModuleVersion": version,
+		"Exports":       exports,
+	})
+	return buf.Bytes(), err
+}
+
+const TopLevelNamespace = "__TOP_LEVEL_MODULE__"
+const DefaultTypeDefHeader = `/* tslint:disable */
+/* eslint:disable */
+// Automatically generated by gen_type_defs. Do not edit.
+`
+
+type TypeDefKind string
+
+const (
+	TypeDefKindConst     TypeDefKind = "const"
+	TypeDefKindEnum      TypeDefKind = "enum"
+	TypeDefKindInterface TypeDefKind = "interface"
+	TypeDefKindFn        TypeDefKind = "fn"
+	TypeDefKindStruct    TypeDefKind = "struct"
+	TypeDefKindImpl      TypeDefKind = "impl"
+)
+
+type TypeDefLine struct {
+	Kind         TypeDefKind `json:"kind"`
+	Name         string      `json:"name"`
+	OriginalName string      `json:"original_name,omitempty"`
+	Def          string      `json:"def"`
+	JSDoc        string      `json:"js_doc,omitempty"`
+	JSMod        string      `json:"js_mod,omitempty"`
+}
+
+func prettyPrint(line *TypeDefLine, constEnum bool, indent int) string {
+	s := line.JSDoc
+	switch line.Kind {
+	case TypeDefKindInterface:
+		s += "export interface " + line.Name + " {"
+		if strings.TrimSpace(line.Def) != "" {
+			s += "\n" + line.Def + "\n"
+		}
+		s += "}"
+
+		if line.OriginalName != "" && line.OriginalName != line.Name {
+			s += "\nexport type " + line.OriginalName + " = " + line.Name
+		}
+
+	case TypeDefKindEnum:
+		enumName := "enum"
+		if constEnum {
+			enumName = "const enum"
+		}
+		s += "export " + enumName + " " + line.Name + " {"
+		if strings.TrimSpace(line.Def) != "" {
+			s += "\n" + line.Def + "\n"
+		}
+		s += "}"
+
+	case TypeDefKindStruct:
+		s += "export class " + line.Name + " {"
+		if strings.TrimSpace(line.Def) != "" {
+			s += "\n" + line.Def + "\n"
+		}
+		s += "}"
+
+		if line.OriginalName != "" && line.OriginalName != line.Name {
+			s += "\nexport type " + line.OriginalName + " = " + line.Name
+		}
+	default:
+		s += line.Def
+	}
+
+	return correctStringIndent(s, indent)
+}
+
+func processTypeDef(intermediateTypeFile string, constEnum bool, header string) (string, []string, error) {
+	var exports []string
+	content, err := os.ReadFile(intermediateTypeFile)
+	if err != nil {
+		return "", nil, err
+	}
+	defs, err := readIntermediateTypeFile(content)
+	if err != nil {
+		return "", nil, err
+	}
+	groupedDefs := preprocessTypeDef(defs)
+
+	if header != "" {
+		header += "\n"
+	}
+	dts := ""
+
+	namespaces := maps.Keys(groupedDefs)
+	sort.Strings(namespaces)
+
+	for _, namespace := range namespaces {
+		defs := groupedDefs[namespace]
+		slices.SortFunc(defs, func(a, b *TypeDefLine) int {
+			return strings.Compare(a.Name, b.Name)
+		})
+		if namespace == TopLevelNamespace {
+			for _, def := range defs {
+				dts += prettyPrint(def, constEnum, 0) + "\n\n"
+				switch def.Kind {
+				case TypeDefKindConst, TypeDefKindEnum, TypeDefKindFn, TypeDefKindStruct:
+					exports = append(exports, def.Name)
+					if def.OriginalName != "" && def.OriginalName != def.Name {
+						exports = append(exports, def.OriginalName)
+					}
+				}
+			}
+		} else {
+			exports = append(exports, namespace)
+			dts += `export namespace ` + namespace + ` {
+`
+			for _, def := range defs {
+				dts += prettyPrint(def, constEnum, 2) + "\n"
+			}
+			dts += `}
+`
+		}
+	}
+
+	if strings.Contains(dts, "ExternalObject<") {
+		header += `
+export class ExternalObject<T> {
+  readonly '': {
+    readonly '': unique symbol
+    [K: symbol]: T
+  }
+}
+`
+	}
+
+	sort.Strings(exports)
+	return header + dts, exports, nil
+}
+
+func readIntermediateTypeFile(content []byte) ([]*TypeDefLine, error) {
+	lines := strings.Split(string(content), "\n")
+	var defs []*TypeDefLine
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		if !strings.HasPrefix(line, "{") {
+			// crateName: { "def": "", ... }
+			start := strings.IndexByte(line, ':') + 1
+			line = line[start:]
+		}
+		var def TypeDefLine
+		err := json.Unmarshal([]byte(line), &def)
+		if err != nil {
+			return nil, err
+		}
+		defs = append(defs, &def)
+	}
+
+	slices.SortFunc(defs, func(a, b *TypeDefLine) int {
+		if a.Kind == TypeDefKindStruct {
+			if b.Kind == TypeDefKindStruct {
+				return strings.Compare(a.Name, b.Name)
+			}
+			return -1
+		} else if b.Kind == TypeDefKindStruct {
+			return 1
+		} else {
+			return strings.Compare(a.Name, b.Name)
+		}
+	})
+
+	return defs, nil
+}
+
+func preprocessTypeDef(defs []*TypeDefLine) map[string][]*TypeDefLine {
+	namespaceGrouped := make(map[string][]*TypeDefLine)
+	classDefs := make(map[string]*TypeDefLine)
+
+	for _, def := range defs {
+		namespace := def.JSMod
+		if namespace == "" {
+			namespace = TopLevelNamespace
+		}
+
+		if def.Kind == TypeDefKindStruct {
+			namespaceGrouped[namespace] = append(namespaceGrouped[namespace], def)
+			classDefs[def.Name] = def
+		} else if def.Kind == TypeDefKindImpl {
+			if classDef, ok := classDefs[def.Name]; ok {
+				if classDef.Def != "" {
+					classDef.Def += "\n"
+				}
+				classDef.Def += def.Def
+			}
+		} else {
+			namespaceGrouped[namespace] = append(namespaceGrouped[namespace], def)
+		}
+	}
+
+	return namespaceGrouped
+}
+
+func correctStringIndent(src string, indent int) string {
+	var result strings.Builder
+	bracketDepth := 0
+	for _, line := range strings.Split(src, "\n") {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			result.WriteString("\n")
+			continue
+		}
+
+		isInMultilineComment := strings.HasPrefix(line, "*")
+		isClosingBracket := strings.HasSuffix(line, "}")
+		isOpeningBracket := strings.HasSuffix(line, "{")
+
+		rightIndent := indent
+		if isOpeningBracket && !isInMultilineComment {
+			bracketDepth++
+			rightIndent += (bracketDepth - 1) * 2
+		} else {
+			if isClosingBracket && bracketDepth > 0 && !isInMultilineComment {
+				bracketDepth--
+			}
+			rightIndent += bracketDepth * 2
+		}
+
+		if isInMultilineComment {
+			rightIndent++
+		}
+
+		result.WriteString(strings.Repeat(" ", rightIndent) + line + "\n")
+	}
+
+	res := result.String()
+	if strings.HasSuffix(res, "\n") {
+		res = res[:len(res)-1]
+	}
+
+	return res
+}
diff --git a/pkg/encorebuild/gentypedefs/napi.cjs.tmpl b/pkg/encorebuild/gentypedefs/napi.cjs.tmpl
new file mode 100644
index 0000000000..8f5db270b4
--- /dev/null
+++ b/pkg/encorebuild/gentypedefs/napi.cjs.tmpl
@@ -0,0 +1,34 @@
+// The version of the runtime this JS bundle was generated for.
+const version = {{.ModuleVersion | printf "%q"}};
+
+// Load the native module.
+const nativeModulePath = process.env.ENCORE_RUNTIME_LIB;
+if (!nativeModulePath) {
+  throw new Error(
+    "The ENCORE_RUNTIME_LIB environment variable is not set. It must be set to the path of the Encore runtime library ('encore-runtime.node')."
+  );
+}
+const nativeModule = require(nativeModulePath);
+
+// Load the exported objects from the native module.
+const {
+{{- range .Exports}}
+  {{.}},
+  {{- end}}
+} = nativeModule;
+
+// Export the objects from the native module.
+module.exports = {
+{{- range .Exports}}
+  {{.}},
+  {{- end}}
+};
+
+
+// Sanity check incase the JS bundle was built for a different version of the runtime.
+if (version !== Runtime.version()) {
+  console.warn(`⚠️ WARNING: The version of the Encore runtime this JS bundle was built for (${version}) does not match the version of the Encore runtime it is running in (${Runtime.version()}).
+This may cause unexpected behaviour in your application.
+
+To resolve this, try update your Encore CLI using "encore version update" and then update the dependencies in your package.json file using "npm install encore.dev@latest".`);
+}
diff --git a/pkg/encorebuild/githubrelease/githubrelease.go b/pkg/encorebuild/githubrelease/githubrelease.go
new file mode 100644
index 0000000000..e2582eccec
--- /dev/null
+++ b/pkg/encorebuild/githubrelease/githubrelease.go
@@ -0,0 +1,210 @@
+package githubrelease
+
+import (
+	"bufio"
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	osPkg "os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"encr.dev/pkg/encorebuild/buildconf"
+	. "encr.dev/pkg/encorebuild/buildutil"
+	"github.com/cockroachdb/errors"
+)
+
+type Info struct {
+	Version  string // The version of the release
+	Filename string // The filename of the release (inc extension)
+	FileExt  string // The file extension
+	URL      string // The URL to download the release from
+	Checksum []byte // The checksum of the release
+}
+
+// getGithubRelease fetches the latest release from Github for the given org and repo.
+func FetchInfo(cfg *buildconf.Config, org string, repo string) *Info {
+	rtn := &Info{}
+
+	type GithubRelease struct {
+		TagName string `json:"tag_name"`
+		Assets  []struct {
+			Name               string `json:"name"`
+			BrowserDownloadURL string `json:"browser_download_url"`
+		} `json:"assets"`
+	}
+
+	// Download the latest releases
+	releasesResp := Must(http.Get(fmt.Sprintf("https://api.github.com/repos/%s/%s/releases/latest", org, repo)))
+	defer func() { _ = releasesResp.Body.Close() }()
+
+	if releasesResp.StatusCode != http.StatusOK {
+		Bailf("Unexpected response status code: %s", releasesResp.Status)
+	}
+
+	releases := &GithubRelease{}
+	Check(json.NewDecoder(releasesResp.Body).Decode(releases))
+
+	rtn.Version = releases.TagName
+
+	// Build a list of possible file names
+	osOptions := []string{cfg.OS}
+	if cfg.OS == "darwin" {
+		osOptions = append(osOptions, "macos")
+	}
+	archOptions := []string{cfg.Arch}
+	if cfg.Arch == "amd64" {
+		archOptions = append(archOptions, "x86_64", "x86-64")
+	} else if cfg.Arch == "arm64" {
+		archOptions = append(archOptions, "aarch64")
+	}
+	extOptions := []string{"tar.gz"} // , "zip"}
+
+	var fileNameOptions []string
+	for _, osOption := range osOptions {
+		for _, archOption := range archOptions {
+			for _, extOption := range extOptions {
+				fileNameOptions = append(fileNameOptions,
+					fmt.Sprintf("%s_%s.%s", osOption, archOption, extOption),
+					fmt.Sprintf("%s-%s.%s", osOption, archOption, extOption),
+				)
+			}
+		}
+	}
+
+	// Find the checksum file
+	checksumFileURL := ""
+	for _, asset := range releases.Assets {
+		// We want to know the checksum URL
+		if strings.EqualFold(asset.Name, "checksums.txt") {
+			checksumFileURL = asset.BrowserDownloadURL
+
+		}
+
+		for _, filenameOption := range fileNameOptions {
+			if strings.EqualFold(asset.Name, filenameOption) {
+				// We also want to know the asset name and download URL
+				rtn.Filename = asset.Name
+				rtn.URL = asset.BrowserDownloadURL
+
+				if strings.HasSuffix(asset.Name, ".tar.gz") {
+					rtn.FileExt = ".tar.gz"
+				} else {
+					rtn.FileExt = filepath.Ext(asset.Name)
+				}
+			}
+		}
+	}
+	if checksumFileURL == "" {
+		Bailf("unable to find checksum file in Github release")
+	}
+	if rtn.URL == "" || rtn.Filename == "" {
+		Bailf("unable to find binary in Github release")
+	}
+
+	// Download the checksum file
+	checksumResp := Must(http.Get(checksumFileURL))
+	defer func() { _ = checksumResp.Body.Close() }()
+	if checksumResp.StatusCode != http.StatusOK {
+		Bailf("Unexpected response status code for checksum file: %s", checksumResp.Status)
+	}
+
+	// Read the checksum file line by line
+	scanner := bufio.NewScanner(checksumResp.Body)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if strings.HasSuffix(line, rtn.Filename) {
+			checksumStr := strings.Split(line, " ")[0]
+
+			checksum := Must(hex.DecodeString(checksumStr))
+			rtn.Checksum = checksum
+
+			return rtn
+		}
+	}
+	Bailf("unable to find checksum for asset file in checksum file")
+	panic("unreachable")
+}
+
+func DownloadLatest(cfg *buildconf.Config, org, repo string) (pathToFile string) {
+	// Find the latest release
+	release := FetchInfo(cfg, org, repo)
+
+	// Create a cache dir for the download cache for this specific OS and architecture pair
+	path := filepath.Join(cfg.CacheDir, "github-releases", org, repo, cfg.OS, cfg.Arch)
+	Check(osPkg.MkdirAll(path, 0755))
+
+	downloadFileName := fmt.Sprintf("%s-%s%s", release.Version, hex.EncodeToString(release.Checksum), release.FileExt)
+	downloadPath := filepath.Join(path, downloadFileName)
+
+	// Check if the file already exists
+	if _, err := osPkg.Stat(downloadPath); err == nil {
+		return downloadPath
+	} else if !osPkg.IsNotExist(err) {
+		Bailf("failed to stat existing download file: %v", err)
+	}
+
+	// Now download the file
+	downloadResp := Must(http.Get(release.URL))
+	defer func() { _ = downloadResp.Body.Close() }()
+	if downloadResp.StatusCode != http.StatusOK {
+		Bailf("Unexpected response status code for release file: %s", downloadResp.Status)
+	}
+
+	// Create the file
+	downloadFile := Must(osPkg.Create(downloadPath))
+	defer func() {
+		_ = downloadFile.Close()
+		if r := recover(); r != nil {
+			_ = osPkg.Remove(downloadPath) // delete any partially written file
+			panic(r)                       // re-panic
+		}
+	}()
+	_ = Must(io.Copy(downloadFile, downloadResp.Body))
+
+	// Now checksum the file
+	_ = Must(downloadFile.Seek(0, 0))
+
+	checksum := Must(checksumFile(downloadFile))
+
+	// Check the checksum
+	if !bytes.Equal(checksum, release.Checksum) {
+		Bailf("checksum of downloaded file (%q) does not match expected checksum (%q)", hex.EncodeToString(checksum), hex.EncodeToString(release.Checksum))
+	}
+
+	return downloadPath
+}
+
+func checksumFile(file *osPkg.File) ([]byte, error) {
+	hash := sha256.New()
+	if _, err := io.Copy(hash, file); err != nil {
+		return nil, errors.Wrap(err, "unable to checksum file")
+	}
+	return hash.Sum(nil), nil
+}
+
+func Extract(pathToArchive string, targetDir string) {
+	// Create the target dir
+	Check(osPkg.MkdirAll(targetDir, 0755))
+
+	// Extract the archive
+	cmd := exec.Command("tar", "-xzf", pathToArchive, "--strip-components", "1", "-C", targetDir)
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		Bailf("failed to extract archive: %s", out)
+	}
+}
+
+func copyDir(src, dst string) error {
+	cmd := exec.Command("cp", "-r", src+"/", dst)
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return errors.Wrapf(err, "failed to copy dir: %s", out)
+	}
+	return nil
+}
diff --git a/pkg/encorebuild/jsruntimebuild.go b/pkg/encorebuild/jsruntimebuild.go
new file mode 100644
index 0000000000..82db5fc545
--- /dev/null
+++ b/pkg/encorebuild/jsruntimebuild.go
@@ -0,0 +1,246 @@
+package encorebuild
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+
+	"github.com/rs/zerolog"
+
+	"encr.dev/pkg/encorebuild/buildconf"
+	. "encr.dev/pkg/encorebuild/buildutil"
+	"encr.dev/pkg/encorebuild/compile"
+	"encr.dev/pkg/encorebuild/gentypedefs"
+)
+
+func NewJSRuntimeBuilder(cfg *buildconf.Config) *JSRuntimeBuilder {
+	if cfg.RepoDir == "" {
+		Bailf("repo dir not set")
+	} else if _, err := os.Stat(cfg.RepoDir); err != nil {
+		Bailf("repo does not exist")
+	}
+
+	workdir := filepath.Join(cfg.CacheDir, "jsruntimebuild", cfg.OS, cfg.Arch)
+	Check(os.MkdirAll(workdir, 0755))
+	return &JSRuntimeBuilder{
+		log:     cfg.Log,
+		cfg:     cfg,
+		workdir: workdir,
+	}
+}
+
+type JSRuntimeBuilder struct {
+	log     zerolog.Logger
+	cfg     *buildconf.Config
+	workdir string
+}
+
+func (b *JSRuntimeBuilder) Build() {
+	b.log.Info().Msgf("Building local JS runtime targeting %s/%s", b.cfg.OS, b.cfg.Arch)
+	b.buildRustModule()
+	b.genTypeDefWrappers()
+	b.makeDistFolder()
+
+	if b.cfg.CopyToRepo {
+		b.copyNativeModule()
+	}
+}
+
+// buildRustModule builds the Rust module for the JS runtime.
+func (b *JSRuntimeBuilder) buildRustModule() {
+	b.log.Info().Msg("building rust module")
+
+	// Figure out the names of the compiled and target binaries.
+	compiledBinaryName := func() string {
+		switch b.cfg.OS {
+		case "darwin":
+			return "libencore_js_runtime.dylib"
+		case "linux":
+			return "libencore_js_runtime.so"
+		case "windows":
+			return "encore_js_runtime.dll"
+		default:
+			Bailf("unknown OS: %s", b.cfg.OS)
+			panic("unreachable")
+		}
+	}()
+
+	features := []string{}
+	if !b.cfg.Release {
+		// Enable runtime tracing in debug builds.
+		features = append(features, "encore-runtime-core/rttrace")
+	}
+
+	compile.RustBinary(
+		b.cfg,
+		compiledBinaryName,
+		b.NativeModuleOutput(),
+		filepath.Join(b.cfg.RepoDir, "runtimes", "js"),
+		"gnu",
+		features, // features
+		"TYPE_DEF_TMP_PATH="+b.typeDefPath(),
+		"ENCORE_VERSION="+b.cfg.Version,
+		"ENCORE_WORKDIR="+b.workdir,
+	)
+}
+
+// genTypeDefWrappers generates the napi.cjs and napi.d.cts files for
+// use by the JS SDK.
+func (b *JSRuntimeBuilder) genTypeDefWrappers() {
+	b.log.Info().Msg("generating napi type definitions")
+	napiPath := filepath.Join(b.npmPackagePath(), napiRelPath)
+	Check(os.MkdirAll(napiPath, 0755))
+
+	cfg := gentypedefs.Config{
+		ReleaseVersion: b.cfg.Version,
+		TypeDefFile:    b.typeDefPath(),
+		DtsOutputFile:  filepath.Join(napiPath, "napi.d.cts"),
+		CjsOutputFile:  filepath.Join(napiPath, "napi.cjs"),
+	}
+	Check(gentypedefs.Generate(cfg))
+}
+
+// makeDistFolder creates the dist folder for the JS runtime,
+// and fixes the imports to be ESM-compatible.
+func (b *JSRuntimeBuilder) makeDistFolder() {
+	b.log.Info().Msg("creating dist folder")
+	// Sanity-check the runtime dir configuration so we don't delete the wrong thing.
+	base := filepath.Base(b.cfg.RepoDir)
+	parentBase := filepath.Base(filepath.Dir(b.cfg.RepoDir))
+	if b.cfg.RepoDir == "" || (base != "encore" && base != "encr.dev" && parentBase != "encore.worktrees") {
+		Bailf("invalid repo directory %q, aborting", b.cfg.RepoDir)
+	}
+
+	pkgPath := filepath.Join(b.jsRuntimePath(), "encore.dev")
+	distPath := filepath.Join(pkgPath, "dist")
+	Check(os.RemoveAll(distPath))
+
+	// Run 'npm install'.
+	{
+		cmd := exec.Command("npm", "install")
+		cmd.Dir = pkgPath
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		Check(cmd.Run())
+	}
+
+	// Run 'npm run build'.
+	{
+		cmd := exec.Command("npm", "run", "build")
+		cmd.Dir = pkgPath
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		Check(cmd.Run())
+	}
+
+	// Copy the napi directory over.
+	{
+		src := filepath.Join(b.npmPackagePath(), napiRelPath)
+		dst := filepath.Join(distPath, napiRelPath)
+		cmd := exec.Command("cp", "-r", src, dst)
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		Check(cmd.Run())
+	}
+
+	// Run 'tsc-esm-fix'.
+	{
+		cmd := exec.Command("./node_modules/.bin/tsc-esm-fix", "--target=dist")
+		cmd.Dir = pkgPath
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		Check(cmd.Run())
+	}
+
+}
+
+func (b *JSRuntimeBuilder) copyNativeModule() {
+	b.log.Info().Msg("copying native module")
+	copyFile := func(src, dst string) {
+		cmd := exec.Command("cp", src, dst)
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			Bailf("unable to copy native module: %v: %s", err, out)
+		}
+	}
+
+	src := b.NativeModuleOutput()
+	suffix := ""
+	if b.cfg.OS != runtime.GOOS || b.cfg.Arch != runtime.GOARCH {
+		suffix = "-" + b.cfg.OS + "-" + b.cfg.Arch
+	}
+	dst := filepath.Join(b.jsRuntimePath(), "encore-runtime.node"+suffix)
+	copyFile(src, dst)
+}
+
+func (b *JSRuntimeBuilder) NativeModuleOutput() string {
+	return filepath.Join(b.workdir, "encore-runtime.node")
+}
+
+func (b *JSRuntimeBuilder) typeDefPath() string {
+	return filepath.Join(b.workdir, "typedefs.ndjson")
+}
+
+func (b *JSRuntimeBuilder) npmPackagePath() string {
+	return filepath.Join(b.jsRuntimePath(), "encore.dev")
+}
+
+func (b *JSRuntimeBuilder) jsRuntimePath() string {
+	return filepath.Join(b.cfg.RepoDir, "runtimes", "js")
+}
+
+// napiRelPath is the relative path from the package root to the napi directory.
+var napiRelPath = filepath.Join("internal", "runtime", "napi")
+
+func PublishNPMPackages(repoDir, version string) {
+	packages := []string{"encore.dev"}
+	npmVersion := strings.TrimPrefix(version[1:], "v")
+
+	npmTag := "latest"
+	switch {
+	case strings.Contains(version, "-beta."):
+		npmTag = "beta"
+	case strings.Contains(version, "-nightly."):
+		npmTag = "nightly"
+	}
+
+	// Configure the auth token
+	{
+		authToken := os.Getenv("NPM_PUBLISH_TOKEN")
+		if authToken == "" {
+			Bailf("NPM_PUBLISH_TOKEN not set")
+		}
+		cmd := exec.Command("npm", "set", "//registry.npmjs.org/:_authToken="+authToken)
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		Check(cmd.Run())
+	}
+
+	for _, pkg := range packages {
+		pkgDir := filepath.Join(repoDir, "runtimes", "js", pkg)
+
+		// Run 'npm version'.
+		{
+			cmd := exec.Command("npm", "version", "--no-git-tag-version", "--no-commit-hooks", npmVersion)
+			cmd.Dir = pkgDir
+			cmd.Stdout = os.Stdout
+			cmd.Stderr = os.Stderr
+			Check(cmd.Run())
+		}
+
+		// Run 'npm publish'.
+		{
+			cmd := exec.Command("npm", "publish",
+				"--tolerate-republish",
+				"--access", "public",
+				"--tag", npmTag,
+			)
+			cmd.Dir = pkgDir
+			cmd.Stdout = os.Stdout
+			cmd.Stderr = os.Stderr
+			Check(cmd.Run())
+		}
+	}
+}
diff --git a/pkg/encorebuild/supervisorbuild.go b/pkg/encorebuild/supervisorbuild.go
new file mode 100644
index 0000000000..ac0e11b211
--- /dev/null
+++ b/pkg/encorebuild/supervisorbuild.go
@@ -0,0 +1,82 @@
+package encorebuild
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+
+	"github.com/rs/zerolog"
+
+	"encr.dev/pkg/encorebuild/buildconf"
+	. "encr.dev/pkg/encorebuild/buildutil"
+	"encr.dev/pkg/encorebuild/compile"
+)
+
+func NewSupervisorBuilder(cfg *buildconf.Config) *SupervisorBuilder {
+	if cfg.RepoDir == "" {
+		Bailf("repo dir not set")
+	} else if _, err := os.Stat(cfg.RepoDir); err != nil {
+		Bailf("repo does not exist")
+	}
+
+	workdir := filepath.Join(cfg.CacheDir, "supervisorbuild", cfg.OS, cfg.Arch)
+	Check(os.MkdirAll(workdir, 0755))
+	return &SupervisorBuilder{
+		log:     cfg.Log,
+		cfg:     cfg,
+		workdir: workdir,
+	}
+}
+
+type SupervisorBuilder struct {
+	log     zerolog.Logger
+	cfg     *buildconf.Config
+	workdir string
+}
+
+func (b *SupervisorBuilder) Build() {
+	b.log.Info().Msgf("Building local Supervisor targeting %s/%s", b.cfg.OS, b.cfg.Arch)
+	b.buildRustModule()
+	if b.cfg.CopyToRepo {
+		b.copyToRepo()
+	}
+}
+
+// buildRustModule builds the Rust module for the Supervisor runtime.
+func (b *SupervisorBuilder) buildRustModule() {
+	b.log.Info().Msg("building rust module")
+	compile.RustBinary(
+		b.cfg,
+		"supervisor-encore",
+		b.BinaryOutput(),
+		filepath.Join(b.cfg.RepoDir, "supervisor"),
+		"musl",
+		[]string{}, // features
+		"ENCORE_VERSION="+b.cfg.Version,
+		"ENCORE_WORKDIR="+b.workdir,
+	)
+}
+
+func (b *SupervisorBuilder) copyToRepo() {
+	b.log.Info().Msg("copying binary to repo dir")
+	copyFile := func(src, dst string) {
+		cmd := exec.Command("cp", src, dst)
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			Bailf("unable to copy binary: %v: %s", err, out)
+		}
+	}
+
+	src := b.BinaryOutput()
+	suffix := ""
+	if b.cfg.OS != runtime.GOOS || b.cfg.Arch != runtime.GOARCH {
+		suffix = "-" + b.cfg.OS + "-" + b.cfg.Arch
+	}
+	dst := filepath.Join(b.cfg.RepoDir, "runtimes", "supervisor-encore"+suffix)
+	copyFile(src, dst)
+}
+
+func (b *SupervisorBuilder) BinaryOutput() string {
+	return filepath.Join(b.workdir, "supervisor-encore")
+}
diff --git a/pkg/encorebuild/windows/.gitignore b/pkg/encorebuild/windows/.gitignore
new file mode 100644
index 0000000000..597caeb7c5
--- /dev/null
+++ b/pkg/encorebuild/windows/.gitignore
@@ -0,0 +1 @@
+/.deps
\ No newline at end of file
diff --git a/pkg/encorebuild/windows/build.bat b/pkg/encorebuild/windows/build.bat
new file mode 100644
index 0000000000..e643bd97be
--- /dev/null
+++ b/pkg/encorebuild/windows/build.bat
@@ -0,0 +1,78 @@
+@echo off
+rem SPDX-License-Identifier: MIT
+rem Copyright (C) 2019-2021 WireGuard LLC. All Rights Reserved.
+
+setlocal enableextensions enabledelayedexpansion
+set BUILDDIR=%~dp0
+set ROOT=%BUILDDIR%\..\..\..
+set DST=%ROOT%\dist\windows_amd64
+set PATH=%BUILDDIR%.deps\llvm-mingw\bin;%BUILDDIR%.deps;%PATH%
+set PATHEXT=.EXE;.CMD
+
+if "%ENCORE_VERSION%" == "" (
+	echo ENCORE_VERSION not set
+	exit /b 1
+)
+
+if "%ENCORE_GOROOT%" == "" (
+	echo ENCORE_GOROOT not set
+	exit /b 1
+)
+
+:: Get absolute path
+cd %ENCORE_GOROOT% || exit /b 1
+set ENCORE_GOROOT=%CD%
+
+cd /d %BUILDDIR% || exit /b 1
+
+if exist .deps\prepared goto :build
+:installdeps
+	rmdir /s /q .deps 2> NUL
+	mkdir .deps || goto :error
+	cd .deps || goto :error
+	call :download llvm-mingw-msvcrt.zip https://download.wireguard.com/windows-toolchain/distfiles/llvm-mingw-20201020-msvcrt-x86_64.zip 2e46593245090df96d15e360e092f0b62b97e93866e0162dca7f93b16722b844 || goto :error
+	call :download wintun.zip https://www.wintun.net/builds/wintun-0.10.2.zip fcd9f62f1bd5a550fcb9c21fbb5d6a556214753ccbbd1a3ebad4d318ec9dcbef || goto :error
+	call :download wix-binaries.zip https://github.com/wixtoolset/wix3/releases/download/wix3112rtm/wix311-binaries.zip 2c1888d5d1dba377fc7fa14444cf556963747ff9a0a289a3599cf09da03b9e2e || goto :error
+	copy /y NUL prepared > NUL || goto :error
+	cd .. || goto :error
+
+:build
+	set GOOS=windows
+	call :build_plat amd64 x86_64 amd64 || goto :error
+	call :copy_artifacts || goto :error
+
+:success
+	echo [+] Success!
+	exit /b 0
+
+:download
+	echo [+] Downloading %1
+	curl -#fLo %1 %2 || exit /b 1
+	echo [+] Verifying %1
+	for /f %%a in ('CertUtil -hashfile %1 SHA256 ^| findstr /r "^[0-9a-f]*$"') do if not "%%a"=="%~3" exit /b 1
+	echo [+] Extracting %1
+	tar -xf %1 %~4 || exit /b 1
+	echo [+] Cleaning up %1
+	del %1 || exit /b 1
+	goto :eof
+
+:build_plat
+	rmdir /S /Q "%DST%"
+	mkdir %DST%\bin >NUL 2>&1
+	echo [+] Assembling resources
+	x86_64-w64-mingw32-windres -I ".deps\wintun\bin\amd64" -i resources.rc -o "%ROOT%\cli\cmd\encore\resources_amd64.syso" -O coff -c 65001 || exit /b %errorlevel%
+	set GOARCH=amd64
+	echo [+] Building
+	go build -tags load_wintun_from_rsrc -ldflags "-X 'encr.dev/internal/version.Version=v%ENCORE_VERSION%'" -o "%DST%\bin\encore.exe" "%ROOT%\cli\cmd\encore" || exit /b 1
+	go build -trimpath -o "%DST%\bin\git-remote-encore.exe" "%ROOT%\cli\cmd\git-remote-encore" || exit /b 1
+	goto :eof
+
+:copy_artifacts
+	echo [+] Copying files
+	xcopy /S /I /E /H /Q "%ENCORE_GOROOT%" "%DST%\encore-go" || exit /b 1
+	xcopy /S /I /E /H /Q "%ROOT%\runtimes\go" "%DST%\runtimes\go" || exit /b 1
+	goto :eof
+
+:error
+	echo [-] Failed with error #%errorlevel%.
+	cmd /c exit %errorlevel%
diff --git a/pkg/encorebuild/windows/manifest.xml b/pkg/encorebuild/windows/manifest.xml
new file mode 100644
index 0000000000..d1502825c1
--- /dev/null
+++ b/pkg/encorebuild/windows/manifest.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
+    <assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="encore" type="win32" />
+    <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+        <application>
+            <!-- Windows 10 -->
+            <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />
+            <!-- Windows 8.1 -->
+            <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" />
+            <!-- Windows 8 -->
+            <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" />
+            <!-- Windows 7 -->
+            <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" />
+        </application>
+    </compatibility>
+    <dependency>
+        <dependentAssembly>
+            <assemblyIdentity type="win32" name="Microsoft.Windows.Common-Controls" version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df" language="*" />
+        </dependentAssembly>
+    </dependency>
+    <application xmlns="urn:schemas-microsoft-com:asm.v3">
+        <windowsSettings>
+            <dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2, PerMonitor</dpiAwareness>
+            <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">True</dpiAware>
+        </windowsSettings>
+    </application>
+</assembly>
\ No newline at end of file
diff --git a/pkg/encorebuild/windows/resources.rc b/pkg/encorebuild/windows/resources.rc
new file mode 100644
index 0000000000..338a06a3d7
--- /dev/null
+++ b/pkg/encorebuild/windows/resources.rc
@@ -0,0 +1,8 @@
+/* SPDX-License-Identifier: MIT
+ *
+ * Copyright (C) 2019-2021 WireGuard LLC. All Rights Reserved.
+ */
+
+#pragma code_page(65001) // UTF-8
+CREATEPROCESS_MANIFEST_RESOURCE_ID RT_MANIFEST manifest.xml
+wintun.dll RCDATA wintun.dll
\ No newline at end of file
diff --git a/pkg/environ/environ.go b/pkg/environ/environ.go
new file mode 100644
index 0000000000..a4a0b12a9d
--- /dev/null
+++ b/pkg/environ/environ.go
@@ -0,0 +1,26 @@
+package environ
+
+// Environ is a slice of strings representing the environment of a process.
+type Environ []string
+
+// Get retrieves the value of the environment variable named by the key.
+// It returns the value, which will be empty if the variable is not present.
+// To distinguish between an empty value and an unset value, use LookupEnv.
+func (e Environ) Get(key string) string {
+	v, _ := e.Lookup(key)
+	return v
+}
+
+// Lookup retrieves the value of the environment variable named
+// by the key. If the variable is present in the environment the
+// value (which may be empty) is returned and the boolean is true.
+// Otherwise the returned value will be empty and the boolean will
+// be false.
+func (e Environ) Lookup(key string) (string, bool) {
+	for _, env := range e {
+		if len(env) > len(key) && env[len(key)] == '=' && env[:len(key)] == key {
+			return env[len(key)+1:], true
+		}
+	}
+	return "", false
+}
diff --git a/pkg/errinsrc/characters.go b/pkg/errinsrc/characters.go
new file mode 100644
index 0000000000..3b82f4ff60
--- /dev/null
+++ b/pkg/errinsrc/characters.go
@@ -0,0 +1,69 @@
+package errinsrc
+
+// The current character set to use when rendering
+var set CharacterSet = unicodeSet
+
+type CharacterSet struct {
+	HorizontalBar rune
+	VerticalBar   rune
+	CrossBar      rune
+	VerticalBreak rune
+	VerticalGap   rune
+	UpArrow       rune
+	RightArrow    rune
+	LeftTop       rune
+	MiddleTop     rune
+	RightTop      rune
+	LeftBottom    rune
+	RightBottom   rune
+	MiddleBottom  rune
+	LeftBracket   rune
+	RightBracket  rune
+	LeftCross     rune
+	RightCross    rune
+	UnderBar      rune
+	Underline     rune
+}
+
+var unicodeSet = CharacterSet{
+	HorizontalBar: '─',
+	VerticalBar:   '│',
+	CrossBar:      '┼',
+	VerticalBreak: '·',
+	VerticalGap:   '⋮',
+	UpArrow:       '▲',
+	RightArrow:    '▶',
+	LeftTop:       '╭',
+	MiddleTop:     '┬',
+	RightTop:      '╮',
+	LeftBottom:    '╰',
+	MiddleBottom:  '┴',
+	RightBottom:   '╯',
+	LeftBracket:   '[',
+	RightBracket:  ']',
+	LeftCross:     '├',
+	RightCross:    '┤',
+	UnderBar:      '┬',
+	Underline:     '─',
+}
+var asciiSet = CharacterSet{
+	HorizontalBar: '-',
+	VerticalBar:   '|',
+	CrossBar:      '+',
+	VerticalBreak: '*',
+	VerticalGap:   ':',
+	UpArrow:       '^',
+	RightArrow:    '>',
+	LeftTop:       ',',
+	MiddleTop:     'v',
+	RightTop:      '.',
+	LeftBottom:    '`',
+	MiddleBottom:  '^',
+	RightBottom:   '\'',
+	LeftBracket:   '[',
+	RightBracket:  ']',
+	LeftCross:     '|',
+	RightCross:    '|',
+	UnderBar:      '|',
+	Underline:     '^',
+}
diff --git a/pkg/errinsrc/errinsrc.go b/pkg/errinsrc/errinsrc.go
new file mode 100644
index 0000000000..d0d944e09c
--- /dev/null
+++ b/pkg/errinsrc/errinsrc.go
@@ -0,0 +1,228 @@
+package errinsrc
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"strings"
+
+	"github.com/pkg/errors"
+
+	encerrors "encr.dev/pkg/errors"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+
+	. "encr.dev/pkg/errinsrc/internal"
+)
+
+// ErrInSrc represents an error which occurred due to the source code
+// of the application being run through Encore.
+//
+// It supports the concept of one of more locations within the users
+// source code which caused the error. The locations will be rendered
+// in the final output.
+//
+// Construct these using helper functions in the `srcerrors` package
+// as we can use that as a central repository error types
+type ErrInSrc struct {
+	// The parameters of the error
+	// This is an internal data type to force the
+	// creation of these inside `srcerrors`
+	Params ErrParams `json:"params"`
+
+	// The Stack trace of where the error was created within the Encore codebase
+	// this will be empty if the error was created in a production build of Encore.
+	// To populate this, build Encore with the tag `dev_build`.
+	Stack []*StackFrame `json:"stack,omitempty"`
+}
+
+var _ error = (*ErrInSrc)(nil)
+
+// New returns a new ErrInSrc with a Stack trace attached
+func New(params ErrParams, alwaysIncludeStack bool) *ErrInSrc {
+	var stack []*StackFrame
+
+	//goland:noinspection GoBoolExpressions
+	if IncludeStackByDefault || alwaysIncludeStack {
+		if params.Cause != nil {
+			stack = bottomStackTraceFrom(params.Cause)
+		}
+
+		if len(stack) == 0 {
+			stack = GetStack()
+		}
+	}
+
+	return &ErrInSrc{
+		Params: params,
+		Stack:  stack,
+	}
+}
+
+// FromTemplate returns a new ErrInSrc using the [errs.Template] as a template
+func FromTemplate(template encerrors.Template, fileset *token.FileSet, fileReaders ...paths.FileReader) *ErrInSrc {
+	// Setup the parameters
+	params := ErrParams{
+		Code:    template.Code,
+		Title:   template.Title,
+		Summary: template.Summary,
+		Detail:  template.Detail,
+		Cause:   template.Cause,
+	}
+
+	// Read the locations
+	for _, tmplLoc := range template.Locations {
+		var location option.Option[*SrcLocation]
+		switch tmplLoc.Kind {
+		case encerrors.LocFile:
+			params.Summary += "\n\nIn file: " + tmplLoc.Filepath
+			continue
+		case encerrors.LocGoNode:
+			location = FromGoASTNode(fileset, tmplLoc.GoNode, fileReaders...)
+		case encerrors.LocGoPos:
+			location = FromGoTokenPos(fileset, tmplLoc.GoStartPos, tmplLoc.GoEndPos, fileReaders...)
+		case encerrors.LocGoPositions:
+			location = FromGoTokenPositions(tmplLoc.GoStartPosition, tmplLoc.GoEndPosition, fileReaders...)
+		default:
+			panic(fmt.Sprintf("unknown location kind: %v", tmplLoc.Kind))
+		}
+
+		loc, ok := location.Get()
+		if !ok {
+			continue
+		}
+
+		switch tmplLoc.LocType {
+		case encerrors.LocError:
+			loc.Type = LocError
+		case encerrors.LocWarning:
+			loc.Type = LocWarning
+		case encerrors.LocHelp:
+			loc.Type = LocHelp
+		default:
+			panic(fmt.Sprintf("unknown location type: %v", tmplLoc.LocType))
+		}
+
+		loc.Text = tmplLoc.Text
+
+		params.Locations = append(params.Locations, loc)
+	}
+
+	// Create the error
+	return New(params, template.AlwaysIncludeStack)
+}
+
+// TerminalWidth is the width of the terminal in columns that we're rendering to.
+//
+// We default to 100 characters, but the CLI overrides this when it renders errors.
+// When using the value, note it might be very small (e.g. 5) if the user has shrunk
+// their terminal window super small. Thus any code which uses this or creates new
+// widths off it should cope with <= 0 values.
+var TerminalWidth = 100
+
+func (e *ErrInSrc) Unwrap() error {
+	return e.Params.Cause
+}
+
+// StackTrace implements the StackTraceProvider interface for some libraries
+// including ZeroLog, xerrors and Sentry
+func (e *ErrInSrc) StackTrace() errors.StackTrace {
+	frames := make([]errors.Frame, len(e.Stack))
+	for i, frame := range e.Stack {
+		// Note: interpreted as a uintptr its value represents the program counter + 1.
+		frames[i] = errors.Frame(frame.ProgramCounter + 1)
+	}
+	return frames
+}
+
+func (e *ErrInSrc) Is(target error) bool {
+	if target == nil || e == nil {
+		return target == e
+	}
+
+	if target, ok := target.(*ErrInSrc); ok && target != nil {
+		return target.Params.Title == e.Params.Title
+	}
+	return false
+}
+
+func (e *ErrInSrc) As(target any) bool {
+	if target, ok := target.(*ErrInSrc); ok {
+		*target = *e
+		return true
+	}
+	return false
+}
+
+// Bailout is a helper function which will abort the current process
+// and report the error
+func (e *ErrInSrc) Bailout() {
+	panic(Bailout{List: List{e}})
+}
+
+func (e *ErrInSrc) Title() string {
+	return e.Params.Title
+}
+
+func (e *ErrInSrc) Error() string {
+	var b strings.Builder
+
+	// Write the header
+	const headerGrayLevel = 12
+	const spacing = 4 + 2 + 7 // (4 = "--" on both sides, 2 = " " on the sides of the title, 7 = "[E0000]")
+	b.WriteRune('\n')         // Always start with a new line as these errors are expected to be full screen
+	b.WriteString(aurora.Gray(headerGrayLevel, fmt.Sprintf("%c%c ", set.HorizontalBar, set.HorizontalBar)).String())
+	b.WriteString(aurora.Red(e.Params.Title).String())
+	b.WriteByte(' ')
+	headerWidth := TerminalWidth - len(e.Params.Title) - spacing
+	if headerWidth > 0 {
+		b.WriteString(aurora.Gray(headerGrayLevel, strings.Repeat(string(set.HorizontalBar), headerWidth)).String())
+	}
+	b.WriteString(aurora.Gray(headerGrayLevel, fmt.Sprintf("%cE%04d%c", set.LeftBracket, e.Params.Code, set.RightBracket)).String())
+	b.WriteString(aurora.Gray(headerGrayLevel, fmt.Sprintf("%c%c\n\n", set.HorizontalBar, set.HorizontalBar)).String())
+
+	// Write the summary
+	if e.Params.Summary != "" {
+		wordWrap(e.Params.Summary, &b)
+		b.WriteString("\n")
+	}
+
+	// List the root causes
+	if len(e.Params.Locations) > 0 {
+		for _, causes := range e.Params.Locations.GroupByFile() {
+			renderSrc(&b, causes)
+			b.WriteString("\n")
+		}
+	}
+
+	// Write any details out
+	if e.Params.Detail != "" {
+		wordWrap(e.Params.Detail, &b)
+		b.WriteString("\n")
+	}
+
+	// Write the Stack trace out (for where the error was generated within Encore's source)
+	if len(e.Stack) > 0 {
+		prettyPrintStack(e.Stack, &b)
+	}
+
+	return b.String()
+}
+
+func (e *ErrInSrc) OnSameLine(other *ErrInSrc) bool {
+	for _, loc := range e.Params.Locations {
+		for _, otherLoc := range other.Params.Locations {
+			if loc.Start.Line >= otherLoc.Start.Line && loc.End.Line <= otherLoc.End.Line {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// WithGoNode adds a Go AST node to the error
+func (e *ErrInSrc) WithGoNode(fileset *token.FileSet, node ast.Node, fileReaders ...paths.FileReader) {
+	if val, ok := FromGoASTNode(fileset, node, fileReaders...).Get(); ok {
+		e.Params.Locations = append(e.Params.Locations, val)
+	}
+}
diff --git a/pkg/errinsrc/internal/cuelocation.go b/pkg/errinsrc/internal/cuelocation.go
new file mode 100644
index 0000000000..e8fe4241d7
--- /dev/null
+++ b/pkg/errinsrc/internal/cuelocation.go
@@ -0,0 +1,90 @@
+package internal
+
+import (
+	"os"
+	"sort"
+	"strings"
+
+	"cuelang.org/go/cue/ast"
+	cueerrors "cuelang.org/go/cue/errors"
+	"cuelang.org/go/cue/parser"
+	"github.com/rs/zerolog/log"
+)
+
+// LocationsFromCueError returns a list of SrcLocations based on what was given in the
+// cueerror.Error.
+func LocationsFromCueError(err cueerrors.Error, pathPrefix string) SrcLocations {
+	// Convert cueerror.Pos to a *CueLocation
+	rtn := make(SrcLocations, 0, len(err.InputPositions()))
+
+	if pos := err.Position(); pos.IsValid() {
+		rtn = append(rtn, FromCueTokenPos(pos, pathPrefix))
+	}
+
+	for _, pos := range err.InputPositions() {
+		if pos.IsValid() {
+			rtn = append(rtn, FromCueTokenPos(pos, pathPrefix))
+		}
+	}
+	sort.Sort(rtn)
+
+	return rtn
+}
+
+// FromCueTokenPos converts a cueerror.Pos to a SrcLocation
+//
+// We use an interface for `cue/token.Pos` so we can test it
+func FromCueTokenPos(cueLoc interface {
+	Filename() string
+	Line() int
+	Column() int
+}, pathPrefix string) *SrcLocation {
+	// Note: for CUE files we must read the bytes now, as the defer on the CUE load code will delete
+	// the source file form the disk before this location is rendered
+	bytes, err := os.ReadFile(cueLoc.Filename())
+	if err != nil {
+		log.Err(err).Str("filename", cueLoc.Filename()).Msg("Failed to read CUE file")
+		// Don't return, `bytes == nil` is fine here
+	}
+
+	start := Pos{Line: cueLoc.Line(), Col: cueLoc.Column()}
+	end := convertSingleCUEPositionToRange(cueLoc.Filename(), bytes, start)
+
+	return &SrcLocation{
+		File: &File{
+			RelPath:  strings.TrimPrefix(cueLoc.Filename(), pathPrefix),
+			FullPath: cueLoc.Filename(),
+			Contents: bytes,
+		},
+		Start: start,
+		End:   end,
+		Type:  LocError,
+	}
+}
+
+// convertSingleCUEPositionToRange attempts to convert a CUE error from a single position to a range
+//
+// It does this by running the CUE parser over the file and looking for the AST node that starts
+// at the same line and column. Once found, we use the end position of that node as the end position
+// of the error.
+func convertSingleCUEPositionToRange(filename string, bytes []byte, start Pos) Pos {
+	file, err := parser.ParseFile(filename, bytes, parser.ParseComments)
+	if err != nil {
+		return start
+	}
+
+	var matching ast.Node
+	ast.Walk(file, func(node ast.Node) bool {
+		if node.Pos().Line() == start.Line && node.Pos().Column() == start.Col {
+			matching = node
+			return false
+		}
+
+		return true
+	}, nil)
+
+	if matching != nil {
+		return Pos{Line: matching.End().Line(), Col: matching.End().Column()}
+	}
+	return start
+}
diff --git a/pkg/errinsrc/internal/golocation.go b/pkg/errinsrc/internal/golocation.go
new file mode 100644
index 0000000000..4a5ed3b669
--- /dev/null
+++ b/pkg/errinsrc/internal/golocation.go
@@ -0,0 +1,208 @@
+package internal
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+)
+
+func FromGoASTNodeWithTypeAndText(fileset *token.FileSet, node ast.Node, typ LocationType, text string, fileReaders ...paths.FileReader) option.Option[*SrcLocation] {
+	loc := FromGoASTNode(fileset, node, fileReaders...)
+	if l, ok := loc.Get(); ok {
+		l.Type = typ
+		l.Text = text
+	}
+	return loc
+}
+
+// FromGoASTNode returns a SrcLocation from a Go AST node storing the start and end
+// locations of that node.
+func FromGoASTNode(fileset *token.FileSet, node ast.Node, fileReaders ...paths.FileReader) option.Option[*SrcLocation] {
+	start := fileset.Position(node.Pos())
+	end := fileset.Position(node.End())
+
+	// Custom end locations for some node types
+	switch node := node.(type) {
+	case *ast.CallExpr:
+		end = fileset.Position(node.Rparen + 1)
+	}
+
+	if !start.IsValid() || !end.IsValid() {
+		return option.None[*SrcLocation]()
+	}
+
+	return FromGoTokenPositions(start, end, fileReaders...)
+}
+
+func FromGoTokenPos(fileset *token.FileSet, start, end token.Pos, fileReaders ...paths.FileReader) option.Option[*SrcLocation] {
+	startPos := fileset.Position(start)
+	endPos := fileset.Position(end)
+
+	if !startPos.IsValid() || !endPos.IsValid() {
+		return option.None[*SrcLocation]()
+	}
+
+	return FromGoTokenPositions(startPos, endPos, fileReaders...)
+}
+
+// FromGoTokenPositions returns a SrcLocation from two Go token positions.
+// They can be the same position or different positions. However, they must
+// be locations within the same file.
+//
+// This function will panic if the locations are in different files.
+func FromGoTokenPositions(start token.Position, end token.Position, fileReaders ...paths.FileReader) option.Option[*SrcLocation] {
+	if start.Filename != end.Filename {
+		panic("FromGoASTNode: start and end files must be the same")
+	}
+	fileReaders = append(fileReaders, os.ReadFile)
+	var bytes []byte
+	var err error
+	for _, reader := range fileReaders {
+		if reader == nil {
+			continue
+		}
+		bytes, err = reader(start.Filename)
+		if err == nil {
+			break
+		}
+	}
+	if err != nil {
+		log.Err(err).Str("filename", start.Filename).Msg("Failed to read Go file")
+		// Don't return, `bytes == nil` is fine here
+	}
+
+	// Attempt to convert a single start/end position into a range
+	if start == end {
+		end = convertSingleGoPositionToRange(start.Filename, bytes, start)
+	}
+
+	// If either position is invalid, return nil
+	// as that means we're not dealing with a Go Token Position
+	if !start.IsValid() || !end.IsValid() {
+		log.Warn().Str("start", start.String()).Str("end", end.String()).Msg("Invalid Go token position")
+		return option.None[*SrcLocation]()
+	}
+
+	return option.Some(&SrcLocation{
+		File: &File{
+			RelPath:  start.Filename,
+			FullPath: start.Filename,
+			Contents: bytes,
+		},
+		Start: Pos{Line: start.Line, Col: start.Column},
+		End:   Pos{Line: end.Line, Col: end.Column},
+		Type:  LocError,
+	})
+}
+
+// convertSingleGoPositionToRange attempts to convert a single Go token position to a range with a start and end
+// position.
+//
+// This is done by attempting to parse the file, and then if we are able to parse it successfully, we look for an AST
+// node which starts at the exact line and column of the position. If we find one, we use the end position of that
+// node as the end position of the range.
+//
+// We use the first found node at that position, as we assume the largest node at that position is the most relevant
+func convertSingleGoPositionToRange(filename string, fileBody []byte, start token.Position) (end token.Position) {
+	fs := token.NewFileSet()
+	file, err := parser.ParseFile(fs, filename, fileBody, parser.ParseComments)
+	if err != nil || file == nil {
+		end = start
+		// If the file is not parsable for some reason (e.g. syntax error), we can't determine the end position
+		// based on ast.Nodes. If so, we can fall back on guessing the end position by looking for common delimiters
+		offset, ok := findPositionOffset(start, fileBody)
+		if !ok {
+			return end
+		}
+		endOffset := GuessEndColumn(fileBody, offset)
+		end.Column += endOffset - offset
+		return end
+	}
+
+	var match ast.Node
+	ast.Inspect(file, func(n ast.Node) bool {
+		if n == nil {
+			return true
+		}
+
+		nodePos := fs.Position(n.Pos())
+		if nodePos.Line == start.Line && nodePos.Column == start.Column {
+			match = n
+			return false
+		}
+
+		return true
+	})
+
+	if match != nil {
+		return fs.Position(match.End())
+	}
+	return start
+}
+
+func findPositionOffset(pos token.Position, data []byte) (int, bool) {
+	line, col := 1, 1
+	for i, c := range data {
+		if line == pos.Line && col == pos.Column {
+			return i, true
+		} else if line > pos.Line {
+			return -1, false
+		}
+		if c == '\n' {
+			line++
+			col = 1
+		} else {
+			col++
+		}
+	}
+	return -1, false
+}
+
+func GuessEndColumn(data []byte, offset int) int {
+	var params, brackets, braces int
+	inBackticks := false
+
+	for i := offset; i < len(data); i++ {
+		switch data[i] {
+		case '(':
+			params++
+		case '[':
+			brackets++
+		case '{':
+			braces++
+		case ')':
+			params--
+			if params <= 0 {
+				return i + 1
+			}
+		case ']':
+			brackets--
+			if brackets <= 0 {
+				return i + 1
+			}
+		case '}':
+			braces--
+			if braces <= 0 {
+				return i + 1
+			}
+		case '`':
+			inBackticks = !inBackticks
+		case ';', ',', ':', '"', '\'':
+			if !inBackticks && params == 0 && brackets == 0 && braces == 0 {
+				return i + 1
+			}
+		case ' ', '\t', '\n', '\r':
+			if params == 0 && brackets == 0 && braces == 0 {
+				return i + 1
+			}
+		}
+	}
+
+	return len(data) + 1
+}
diff --git a/pkg/errinsrc/internal/helper.go b/pkg/errinsrc/internal/helper.go
new file mode 100644
index 0000000000..0dc3ef8f1f
--- /dev/null
+++ b/pkg/errinsrc/internal/helper.go
@@ -0,0 +1,16 @@
+package internal
+
+// ErrParams are used to create *errinsrc.ErrInSrc objects.
+//
+// It exists within an `internal` package so that it can only
+// be used by other packages within the `errinsrc` folder.
+// This is enforce through the Go compiler that all
+// errors are created inside the `srcerrors` subpackage.
+type ErrParams struct {
+	Code      int          `json:"code"`
+	Title     string       `json:"title"`
+	Summary   string       `json:"summary"`
+	Detail    string       `json:"detail,omitempty"`
+	Cause     error        `json:"-"`
+	Locations SrcLocations `json:"locations,omitempty"`
+}
diff --git a/pkg/errinsrc/internal/location.go b/pkg/errinsrc/internal/location.go
new file mode 100644
index 0000000000..d21c337b25
--- /dev/null
+++ b/pkg/errinsrc/internal/location.go
@@ -0,0 +1,189 @@
+package internal
+
+import (
+	"cmp"
+	"slices"
+	"sort"
+
+	"encr.dev/pkg/option"
+)
+
+type LocationType uint8
+
+const (
+	LocError   LocationType = iota // Renders in red
+	LocWarning                     // Renders in yellow
+	LocHelp                        // Renders in blue
+)
+
+type SrcLocation struct {
+	Type  LocationType `json:"type"`           // The type of this location
+	Text  string       `json:"text,omitempty"` // Optional text to render at this location
+	File  *File        `json:"file,omitempty"` // The file containing the error
+	Start Pos          `json:"start"`          // The position this location starts at
+	End   Pos          `json:"end"`            // The position this location ends at
+}
+
+func (s *SrcLocation) Less(other *SrcLocation) bool {
+	// Order by type of location first (Err, then Warn, then Help)
+	// as we always want errors rendered above warnings and warnings above help
+	// if s.Type != other.Type {
+	// 	return s.Type < other.Type
+	// }
+
+	// Order by file first
+	if s.File.FullPath != other.File.FullPath {
+		return s.File.FullPath < other.File.FullPath
+	}
+
+	// And then by the line number of where they start
+	if s.Start.Line != other.Start.Line {
+		return s.Start.Line < other.Start.Line
+	}
+
+	// And then where they start on that line
+	if s.Start.Col != other.Start.Col {
+		return s.Start.Col < other.Start.Col
+	}
+
+	// And which line they end on
+	if s.End.Line != other.End.Line {
+		return s.End.Line < other.End.Line
+	}
+
+	// Then by ending column
+	if s.End.Col != other.End.Col {
+		return s.End.Col < other.End.Col
+	}
+
+	// Finally, by the text in the location
+	if s.Text != other.Text {
+		return s.Text < other.Text
+	}
+
+	if s.Type != other.Type {
+		return s.Type < other.Type
+	}
+
+	return false
+}
+
+type Pos struct {
+	Line int `json:"line"`
+	Col  int `json:"col"`
+}
+
+type File struct {
+	RelPath  string // The relative path within the project
+	FullPath string // The full path to the file
+	Contents []byte // The contents of the file
+}
+
+// SrcLocations represents a list of locations
+// within the source code. It can be sorted and split
+// up into separate lists using GroupByFile
+type SrcLocations []*SrcLocation
+
+var _ sort.Interface = SrcLocations{}
+
+func (s SrcLocations) Len() int {
+	return len(s)
+}
+
+func (s SrcLocations) Less(i, j int) bool {
+	return s[i].Less(s[j])
+}
+
+func (s SrcLocations) Swap(i, j int) {
+	s[i], s[j] = s[j], s[i]
+}
+
+func NewSrcLocations(opts ...option.Option[*SrcLocation]) SrcLocations {
+	var rtn SrcLocations
+	for _, opt := range opts {
+		if loc, ok := opt.Get(); ok {
+			rtn = append(rtn, loc)
+		}
+	}
+	return rtn
+}
+
+// GroupByFile groups all locations by file and returns a new
+// SrcLocations for each file.
+//
+// If a file has overlapping locations or two locations on the same line
+// then more than one SrcLocations will be returned for that file. This
+// is due to a limitation in the srcrender, and may be relaxed in the future.
+func (s SrcLocations) GroupByFile() []SrcLocations {
+	type locationGroup struct {
+		fileName  string
+		locations SrcLocations
+	}
+
+	var nonOverlappingLocations []*locationGroup
+
+	inlineOnSameLine := func(a, b *SrcLocation) bool {
+		return a.Start.Line == a.End.Line &&
+			b.Start.Line == b.End.Line &&
+			a.Start.Line == b.Start.Line &&
+			a.Text == "" && b.Text == "" && // Don't inline if there is text as we don't support rendering this yet
+			((a.Start.Col > b.End.Col) ||
+				(a.End.Col < b.Start.Col))
+
+	}
+
+	// Add locations to groups on the same file without overlaps
+nextOriginalLoc:
+	for _, loc := range s {
+		// Attempt to match it into an existing group
+		for _, grp := range nonOverlappingLocations {
+			if grp.fileName == loc.File.FullPath {
+				for _, other := range grp.locations {
+					if other.Start.Line > loc.End.Line ||
+						other.End.Line < loc.Start.Line ||
+						inlineOnSameLine(other, loc) {
+						grp.locations = append(grp.locations, loc)
+						continue nextOriginalLoc
+					}
+				}
+			}
+		}
+
+		// if here we found no matching groups
+		nonOverlappingLocations = append(nonOverlappingLocations, &locationGroup{
+			fileName:  loc.File.FullPath,
+			locations: SrcLocations{loc},
+		})
+	}
+
+	// Sort the locations in each group
+	rtn := make([]SrcLocations, len(nonOverlappingLocations))
+	for i, grp := range nonOverlappingLocations {
+		sort.Sort(grp.locations)
+		rtn[i] = grp.locations
+	}
+
+	// Now sort the groups by the lowest location hint
+	// this means that errors will be rendered first, then warnings, then help
+	// if they are in different files
+	slices.SortStableFunc(rtn, func(a, b SrcLocations) int {
+		lowestA := LocHelp
+		lowestB := LocHelp
+
+		for _, loc := range a {
+			if loc.Type < lowestA {
+				lowestA = loc.Type
+			}
+		}
+
+		for _, loc := range b {
+			if loc.Type < lowestB {
+				lowestB = loc.Type
+			}
+		}
+
+		return cmp.Compare(lowestA, lowestB)
+	})
+
+	return rtn
+}
diff --git a/pkg/errinsrc/list.go b/pkg/errinsrc/list.go
new file mode 100644
index 0000000000..e69229bdf9
--- /dev/null
+++ b/pkg/errinsrc/list.go
@@ -0,0 +1,74 @@
+package errinsrc
+
+import (
+	"fmt"
+	"sort"
+)
+
+// List is a list of ErrInSrc objects.
+type List []*ErrInSrc
+
+var _ sort.Interface = List{}
+var _ ErrorList = List{}
+var _ error = List{}
+
+func (l List) Len() int {
+	return len(l)
+}
+
+func (l List) Less(i, j int) bool {
+	// This less function follows (as much as possible) the behaviour
+	// of scanner.ErrorList's sort, that is filename, then line, then column
+	// We then move onto extra data only Encore has
+	iErr, jErr := l[i], l[j]
+
+	numLocationsToCompare := len(iErr.Params.Locations)
+	if otherNum := len(jErr.Params.Locations); otherNum < numLocationsToCompare {
+		numLocationsToCompare = otherNum
+	}
+
+	for idx := 0; idx < numLocationsToCompare; idx++ {
+		iLoc, jLoc := iErr.Params.Locations[idx], jErr.Params.Locations[idx]
+		if iLoc.Less(jLoc) {
+			return true
+		}
+	}
+
+	// Now our custom sort logic
+	if iErr.Params.Code != jErr.Params.Code {
+		return iErr.Params.Code < jErr.Params.Code
+	}
+
+	if iErr.Params.Title != jErr.Params.Title {
+		return iErr.Params.Title < jErr.Params.Title
+	}
+
+	if iErr.Params.Summary != jErr.Params.Summary {
+		return iErr.Params.Summary < jErr.Params.Summary
+	}
+
+	if iErr.Params.Detail != jErr.Params.Detail {
+		return iErr.Params.Detail < jErr.Params.Detail
+	}
+
+	if len(iErr.Params.Locations) != len(jErr.Params.Locations) {
+		return len(iErr.Params.Locations) < len(jErr.Params.Locations)
+	}
+
+	return false
+}
+
+func (l List) Swap(i, j int) {
+	l[i], l[j] = l[j], l[i]
+}
+
+func (l List) Error() string {
+	switch len(l) {
+	case 0:
+		return "no errors"
+	case 1:
+		return l[0].Error()
+	}
+	return fmt.Sprintf("%s (and %d more errors)", l[0], len(l)-1)
+}
+func (l List) ErrorList() []*ErrInSrc { return l }
diff --git a/pkg/errinsrc/setup_test.go b/pkg/errinsrc/setup_test.go
new file mode 100644
index 0000000000..7a3d5a430a
--- /dev/null
+++ b/pkg/errinsrc/setup_test.go
@@ -0,0 +1,26 @@
+package errinsrc
+
+import (
+	"os"
+	"path"
+	"testing"
+
+	"encr.dev/pkg/golden"
+)
+
+var testDataFullPath string
+
+func TestMain(m *testing.M) {
+	ColoursInErrors(false)
+	golden.TestMain(m)
+}
+
+func init() {
+	var err error
+	testDataFullPath, err = os.Getwd()
+	if err != nil {
+		panic(err)
+	}
+
+	testDataFullPath = path.Join(testDataFullPath, "testdata")
+}
diff --git a/pkg/errinsrc/srcerrors/errors.go b/pkg/errinsrc/srcerrors/errors.go
new file mode 100644
index 0000000000..86105cb35d
--- /dev/null
+++ b/pkg/errinsrc/srcerrors/errors.go
@@ -0,0 +1,178 @@
+package srcerrors
+
+import (
+	"fmt"
+	"go/ast"
+	"go/scanner"
+	"go/token"
+	"strconv"
+	"strings"
+
+	"golang.org/x/tools/go/packages"
+
+	"encr.dev/pkg/errinsrc"
+	. "encr.dev/pkg/errinsrc/internal"
+	"encr.dev/pkg/paths"
+)
+
+// UnhandledPanic is an error we use to wrap a panic that was not handled
+// It should ideally never be seen by users, but if it is, it means we have
+// a bug within Encore which needs fixing.
+func UnhandledPanic(recovered any) error {
+	if err := errinsrc.ExtractFromPanic(recovered); err != nil {
+		return err
+	}
+
+	// If recovered is an error, then track it as the source
+	var srcError error
+	if err, ok := recovered.(error); ok {
+		srcError = err
+	}
+	// If we get here, it's an unhandled panic / error
+	return errinsrc.New(ErrParams{
+		Code:    1,
+		Title:   "Internal compiler error",
+		Summary: fmt.Sprintf("An unhandled panic occurred in the Encore compiler: %v", recovered),
+		Detail:  internalErrReportToEncore,
+		Cause:   srcError,
+	}, true)
+}
+
+// GenericGoParserError reports an error was that was reported from the Go parser.
+// It should not be returned by any errors caused by Encore's own parser as they
+// should have specific errors listed below
+func GenericGoParserError(err *scanner.Error, fileReaders ...paths.FileReader) *errinsrc.ErrInSrc {
+	locs := SrcLocations{}
+	if pos, ok := FromGoTokenPositions(err.Pos, err.Pos, fileReaders...).Get(); ok {
+		locs = SrcLocations{pos}
+	}
+
+	return errinsrc.New(ErrParams{
+		Code:      2,
+		Title:     "Parse Error in Go Source",
+		Summary:   err.Msg,
+		Cause:     err,
+		Locations: locs,
+	}, false)
+}
+
+// GenericGoPackageError reports an error was that was reported from the Go package loader.
+// It should not be returned by any errors caused by Encore's own parser as they
+// should have specific errors listed below
+func GenericGoPackageError(err packages.Error, fileReaders ...paths.FileReader) *errinsrc.ErrInSrc {
+	var locations SrcLocations
+
+	// Extract the position from the error
+	var pos token.Position
+	switch p := strings.SplitN(err.Pos, ":", 3); len(p) {
+	case 3:
+		pos.Column, _ = strconv.Atoi(p[2])
+		fallthrough
+	case 2:
+		pos.Line, _ = strconv.Atoi(p[1])
+		fallthrough
+	case 1:
+		if p[0] != "" && p[0] != "-" {
+			pos.Filename = p[0]
+		}
+	}
+	if pos.Filename != "" && pos.Line > 0 {
+		locations = NewSrcLocations(FromGoTokenPositions(pos, pos, fileReaders...))
+	}
+
+	return errinsrc.New(ErrParams{
+		Code:      3,
+		Title:     "Go Package Error",
+		Summary:   err.Msg,
+		Cause:     err,
+		Locations: locations,
+	}, false)
+}
+
+// GenericGoCompilerError reports an error was that was reported from the Go compiler.
+// It should not be returned by any errors caused by Encore's own compiler as they
+// should have specific errors listed below.
+func GenericGoCompilerError(fileName string, lineNumber int, column int, error string, fileReaders ...paths.FileReader) error {
+	errLocation := token.Position{
+		Filename: fileName,
+		Offset:   0,
+		Line:     lineNumber,
+		Column:   column,
+	}
+
+	return errinsrc.New(ErrParams{
+		Code:      3,
+		Title:     "Go Compilation Error",
+		Summary:   strings.TrimSpace(error),
+		Locations: NewSrcLocations(FromGoTokenPositions(errLocation, errLocation, fileReaders...)),
+	}, false)
+}
+
+// StandardLibraryError is an error that is not caused by Encore, but is
+// returned by a standard library function. We wrap it in an ErrInSrc so that
+// we can still possibly provide a source location.
+func StandardLibraryError(err error) *errinsrc.ErrInSrc {
+	return errinsrc.New(ErrParams{
+		Code:    3,
+		Title:   "Error",
+		Summary: err.Error(),
+		Cause:   err,
+	}, true)
+}
+
+// GenericError is a place holder for errors reported through perr.Add or perr.Addf
+func GenericError(pos token.Position, msg string, fileReaders ...paths.FileReader) *errinsrc.ErrInSrc {
+	return errinsrc.New(ErrParams{
+		Code:      3,
+		Title:     "Error",
+		Summary:   msg,
+		Locations: NewSrcLocations(FromGoTokenPositions(pos, pos, fileReaders...)),
+	}, false)
+}
+
+func UnableToLoadCUEInstances(err error, pathPrefix string) error {
+	return handleCUEError(err, pathPrefix, ErrParams{
+		Code:  6,
+		Title: "Unable to load CUE instances",
+	})
+}
+
+func UnableToAddOrphanedCUEFiles(err error, pathPrefix string) error {
+	return handleCUEError(err, pathPrefix, ErrParams{
+		Code:  7,
+		Title: "Unable to add orphaned CUE files",
+	})
+}
+
+func CUEEvaluationFailed(err error, pathPrefix string) error {
+	return handleCUEError(err, pathPrefix, ErrParams{
+		Code:  8,
+		Title: "CUE evaluation failed",
+		Detail: "While evaluating the CUE configuration to generate a concrete configuration for your application, CUE returned an error. " +
+			"This is usually caused by either a constraint on a field being unsatisfied or there being two different values for a given field. " +
+			"For more information on CUE and this error, see https://cuelang.org/docs/",
+	})
+}
+
+func ResourceNameReserved(fileset *token.FileSet, node ast.Node, resourceType string, paramName string, name, reservedPrefix string, isSnakeCase bool, fileReaders ...paths.FileReader) error {
+	suggestion := ""
+	if strings.HasPrefix(name, reservedPrefix) { // should always be the case, but better to be safe
+		suggestion = fmt.Sprintf("try %q?", name[len(reservedPrefix):])
+	}
+
+	var detail string
+	if isSnakeCase {
+		detail = resourceNameHelpSnakeCase(resourceType, paramName)
+	} else {
+		detail = resourceNameHelpKebabCase(resourceType, paramName)
+	}
+
+	return errinsrc.New(ErrParams{
+		Code:  37,
+		Title: "Reserved resource name",
+		// The metrics.NewCounter metric name "e_blah" uses the reserved prefix "e_".
+		Summary:   fmt.Sprintf("The %s %s %q uses the reserved prefix %q", resourceType, paramName, name, reservedPrefix),
+		Detail:    detail,
+		Locations: NewSrcLocations(FromGoASTNodeWithTypeAndText(fileset, node, LocError, suggestion, fileReaders...)),
+	}, false)
+}
diff --git a/pkg/errinsrc/srcerrors/helpers.go b/pkg/errinsrc/srcerrors/helpers.go
new file mode 100644
index 0000000000..117ea7d80a
--- /dev/null
+++ b/pkg/errinsrc/srcerrors/helpers.go
@@ -0,0 +1,162 @@
+package srcerrors
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"reflect"
+	"strings"
+
+	cueerrors "cuelang.org/go/cue/errors"
+
+	"encr.dev/pkg/errinsrc"
+	. "encr.dev/pkg/errinsrc/internal"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+func handleCUEError(err error, pathPrefix string, param ErrParams) error {
+	if err == nil {
+		return nil
+	}
+
+	toReturn := make(errinsrc.List, 0, 1)
+
+	if param.Detail == "" {
+		param.Detail = "For more information on CUE and this error, see https://cuelang.org/docs/"
+	}
+
+	for _, e := range cueerrors.Errors(err) {
+		param.Summary = e.Error()
+		param.Cause = e
+		param.Locations = LocationsFromCueError(e, pathPrefix)
+		toReturn = append(toReturn, errinsrc.New(param, false))
+	}
+
+	switch len(toReturn) {
+	case 0:
+		return nil
+	case 1:
+		return toReturn[0]
+	default:
+		return toReturn
+	}
+}
+
+// Converts a node to a string which looks like the original go code.
+// such as a ast.SelectorExpr will become "foo.Blah"
+//
+// It's not intended to be an exact representation, but rather a helperful
+// representation for error messages.
+func nodeAsGoSrc(node ast.Node) string {
+	switch node := node.(type) {
+	case *ast.Ident:
+		return node.Name
+
+	case *ast.SelectorExpr:
+		return fmt.Sprintf("%s.%s", nodeAsGoSrc(node.X), node.Sel.Name)
+
+	case *ast.IndexExpr:
+		return fmt.Sprintf("%s[%s]", nodeAsGoSrc(node.X), nodeAsGoSrc(node.Index))
+
+	case *ast.IndexListExpr:
+		indices := make([]string, 0, len(node.Indices))
+		for _, n := range node.Indices {
+			indices = append(indices, nodeAsGoSrc(n))
+		}
+		return fmt.Sprintf("%s[%s]", nodeAsGoSrc(node.X), strings.Join(indices, ", "))
+
+	case *ast.FuncLit:
+		return "a function literal"
+
+	case *ast.BasicLit:
+		return node.Value
+
+	case *ast.CallExpr:
+		return fmt.Sprintf("%s(...)", nodeAsGoSrc(node.Fun))
+
+	default:
+		return fmt.Sprintf("a %v", reflect.TypeOf(node))
+	}
+}
+
+// Converts a node to a string that can be used in an error message.
+// such as a ast.CallExpr will return "a function call to foo.Blah"
+func nodeType(node ast.Node) string {
+	switch node := node.(type) {
+	case *ast.Ident:
+		return "an identifier"
+
+	case *ast.SelectorExpr:
+		return "an identifier"
+
+	case *ast.IndexExpr:
+		return "a identifier"
+
+	case *ast.IndexListExpr:
+		return "a identifier"
+
+	case *ast.FuncLit:
+		return "a function literal"
+
+	case *ast.BasicLit:
+		switch node.Kind {
+		case token.INT:
+			return "an integer literal"
+		case token.FLOAT:
+			return "a float literal"
+		case token.IMAG:
+			return "an imaginary literal"
+		case token.CHAR:
+			return "a character literal"
+		case token.STRING:
+			return "a string literal"
+		default:
+			return "a literal"
+		}
+
+	case *ast.CallExpr:
+		return fmt.Sprintf("a function call to %s", nodeAsGoSrc(node.Fun))
+
+	default:
+		return fmt.Sprintf("a %v", reflect.TypeOf(node))
+	}
+}
+
+// Converts a schema type to a string that can be used in an error message.
+// such as a ast.CallExpr will return "a function call to foo.Blah"
+func schemaType(typ *schema.Type) string {
+	switch tt := typ.Typ.(type) {
+	case *schema.Type_Named:
+		return "a named type"
+
+	case *schema.Type_Struct:
+		return "a struct type"
+
+	case *schema.Type_Map:
+		return "a map type"
+
+	case *schema.Type_Literal:
+		return "a literal"
+
+	case *schema.Type_Union:
+		return "a union type"
+
+	case *schema.Type_List:
+		return "a list type"
+
+	case *schema.Type_Builtin:
+		return fmt.Sprintf("a builtin type (%s)", tt.Builtin)
+
+	case *schema.Type_Pointer:
+		return "a pointer to " + schemaType(tt.Pointer.Base)
+
+	case *schema.Type_TypeParameter:
+		return "a type parameter"
+
+	case *schema.Type_Config:
+		return "a config value"
+
+	default:
+		return fmt.Sprintf("a %v", reflect.TypeOf(tt))
+	}
+}
diff --git a/pkg/errinsrc/srcerrors/helptext.go b/pkg/errinsrc/srcerrors/helptext.go
new file mode 100644
index 0000000000..483c878a60
--- /dev/null
+++ b/pkg/errinsrc/srcerrors/helptext.go
@@ -0,0 +1,53 @@
+package srcerrors
+
+import (
+	"fmt"
+	"strings"
+)
+
+func combine(parts ...string) string {
+	return strings.Join(parts, "\n\n")
+}
+
+const (
+	internalErrReportToEncore = "This is a bug in Encore and should not have occurred. Please report this issue to the " +
+		"Encore team either on Github at https://github.com/encoredev/encore/issues/new and include this error."
+
+	makeService = "To make this package a count as a service, this package or one of it's parents must have either one " +
+		"or more API's declared within them or a PubSub subscription."
+
+	configHelp = "For more information on configuration, see https://encore.dev/docs/develop/config"
+
+	pubsubNewTopicHelp = "For example `pubsub.NewTopic[MyMessage](\"my-topic\", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })`"
+
+	pubsubNewSubscriptionHelp = "A pubsub subscription must have a unique name per topic and be given a handler function for processing the message. " +
+		"The handler for the subscription must be defined in the same service as the call to pubsub.NewSubscription and can be an inline function. " +
+		"For example:\n" +
+		"\tpubsub.NewSubscription(myTopic, \"subscription-name\", pubsub.SubscriptionConfig[MyMessage]{\n" +
+		"\t\tHandler: func(ctx context.Context, event MyMessage) error { return nil },\n" +
+		"\t})"
+
+	pubsubHelp = "For more information on PubSub, see https://encore.dev/docs/primitives/pubsub"
+
+	metricsHelp = "For more information on metrics, see https://encore.dev/docs/observability/metrics"
+
+	serviceHelp = "For more information on services and how to define them, see https://encore.dev/docs/primitives/services"
+
+	authHelp = "For more information on auth handlers and how to define them, see https://encore.dev/docs/develop/auth"
+)
+
+func resourceNameHelpKebabCase(resourceName string, paramName string) string {
+	return fmt.Sprintf("%s %s's must be defined as string literals, "+
+		"be between 1 and 63 characters long, and defined in \"kebab-case\", meaning it must start with a letter, end with a letter "+
+		"or number and only contain lower case letters, numbers and dashes.",
+		resourceName, paramName,
+	)
+}
+
+func resourceNameHelpSnakeCase(resourceName string, paramName string) string {
+	return fmt.Sprintf("%s %s's must be defined as string literals, "+
+		"be between 1 and 63 characters long, and defined in \"snake_case\", meaning it must start with a letter, end with a letter "+
+		"or number and only contain lower case letters, numbers and underscores.",
+		resourceName, paramName,
+	)
+}
diff --git a/pkg/errinsrc/srcrender.go b/pkg/errinsrc/srcrender.go
new file mode 100644
index 0000000000..d45e6a82f8
--- /dev/null
+++ b/pkg/errinsrc/srcrender.go
@@ -0,0 +1,409 @@
+package errinsrc
+
+import (
+	"bufio"
+	"bytes"
+	"fmt"
+	"math"
+	"strings"
+	"unicode"
+
+	"github.com/alecthomas/chroma/quick"
+	"github.com/jwalton/go-supportscolor"
+	auroraPkg "github.com/logrusorgru/aurora/v3"
+	"github.com/rs/zerolog/log"
+
+	. "encr.dev/pkg/errinsrc/internal"
+)
+
+const grayLevelOnLineNumbers = 12
+const endEscape = "\x1b[0m"
+
+const tabSize = 4
+
+var aurora auroraPkg.Aurora
+var enableColors bool
+
+func init() {
+	ColoursInErrors(supportscolor.Stdout().SupportsColor)
+}
+
+func ColoursInErrors(enabled bool) {
+	enableColors = enabled
+	aurora = auroraPkg.NewAurora(enabled)
+}
+
+// renderSrc returns the lines of code surrounding the location with a pointer to the error on the error line
+func renderSrc(builder *strings.Builder, causes SrcLocations) {
+	const linesBeforeError = 2
+	const linesAfterError = 2
+
+	idx := 0
+	currentCause := causes[idx]
+	lastEnd := causes[len(causes)-1].End
+
+	// Check if any of the causes are multiline
+	multilineSpace := 0
+	for _, cause := range causes {
+		if cause.Start.Line != cause.End.Line {
+			multilineSpace = 4
+			break
+		}
+	}
+
+	numDigitsInLineNumbers := int(math.Log10(float64(lastEnd.Line+linesAfterError+1))) + 1
+	lineNumberFmt := fmt.Sprintf(" %%%dd %c ", numDigitsInLineNumbers, set.VerticalBar)
+
+	// Render the filename
+	builder.WriteString(strings.Repeat(" ", numDigitsInLineNumbers+1))
+	builder.WriteString(aurora.Gray(grayLevelOnLineNumbers, fmt.Sprintf(" %c%c%c", set.LeftTop, set.HorizontalBar, set.LeftBracket)).String())
+	// Note the space on both sides of this string is important
+	// as it allows editors (such as GoLand) to pickup the filename in
+	// terminal output and convert it into a clickable link into the code
+	builder.WriteString(aurora.Cyan(fmt.Sprintf(" %s:%d:%d ",
+		causes[0].File.RelPath,
+		causes[0].Start.Line,
+		causes[0].Start.Col,
+	)).String())
+	builder.WriteString(aurora.Gray(grayLevelOnLineNumbers, string(set.RightBracket)).String())
+	builder.WriteRune('\n')
+	builder.WriteString(strings.Repeat(" ", numDigitsInLineNumbers+2))
+	builder.WriteString(aurora.Gray(grayLevelOnLineNumbers, fmt.Sprintf("%c", set.VerticalBar)).String())
+	builder.WriteRune('\n')
+
+	var currentLine int
+	gapRenderedUntil := currentCause.Start.Line
+	bBuffer := new(bytes.Buffer)
+	bBuffer.Write(causes[0].File.Contents)
+	sc := bufio.NewScanner(bBuffer)
+linePrintLoop:
+	for sc.Scan() {
+		currentLine++
+
+		if currentLine >= currentCause.Start.Line-linesBeforeError && currentLine <= currentCause.End.Line+linesAfterError {
+			// Write the line number
+			builder.WriteString(aurora.Gray(grayLevelOnLineNumbers, fmt.Sprintf(lineNumberFmt, currentLine)).String())
+
+			// If this is a multiline error, then render the gutters
+			if multilineSpace > 0 {
+				if currentCause.Start.Line <= currentLine && currentLine <= currentCause.End.Line {
+					line := fmt.Sprintf("%c   ", set.VerticalBar)
+
+					switch currentLine {
+					case currentCause.Start.Line:
+						if currentCause.Start.Col == 1 {
+							line = fmt.Sprintf("%c%c%c ", set.LeftTop, set.HorizontalBar, set.RightArrow)
+						} else {
+							line = strings.Repeat(" ", multilineSpace)
+						}
+					case currentCause.End.Line:
+						if currentCause.End.Col == 1 {
+							line = fmt.Sprintf("%c%c%c ", set.LeftCross, set.HorizontalBar, set.RightArrow)
+						}
+					}
+
+					switch currentCause.Type {
+					case LocError:
+						builder.WriteString(aurora.BrightRed(line).String())
+					case LocWarning:
+						builder.WriteString(aurora.BrightYellow(line).String())
+					case LocHelp:
+						builder.WriteString(aurora.BrightBlue(line).String())
+					}
+				} else {
+					builder.WriteString(strings.Repeat(" ", multilineSpace))
+				}
+			}
+
+			unifiedLine := replaceTabsWithSpaces(sc.Text())
+
+			// Then the line of code itself (attempting to highlight the syntax)
+			// Note: we always use the "go" lexer, as it works nicely on CUE files too
+			var subBuilder strings.Builder
+			if err := quick.Highlight(&subBuilder, unifiedLine, "go", "terminal256", "monokai"); err != nil || !enableColors {
+				if err != nil {
+					log.Error().AnErr("error", err).Msg("Unable to highlight line of code")
+				}
+				builder.WriteString(unifiedLine)
+			} else {
+				syntaxHighlightedLine := subBuilder.String()
+
+				// There's a bug in the quick.Highlight function that causes it sometimes add an extra line feed before the endEscape squence
+				// so this if statement removes it
+				if strings.HasSuffix(syntaxHighlightedLine, endEscape) {
+					syntaxHighlightedLine = strings.TrimRight(syntaxHighlightedLine[:len(syntaxHighlightedLine)-len(endEscape)], " \n\r\t") + endEscape
+				}
+				builder.WriteString(syntaxHighlightedLine)
+			}
+			builder.WriteRune('\n')
+		} else if currentLine >= gapRenderedUntil && idx < len(causes) {
+			gapRenderedUntil = currentCause.Start.Line
+
+			// render two spaces for a break in the file
+			for i := 0; i < 2; i++ {
+				lineNumberSpacer(builder, numDigitsInLineNumbers, set.VerticalBreak)
+				builder.WriteString("\n")
+			}
+		}
+
+		errorRendered := true
+		colOffset := 0
+		for errorRendered {
+			errorRendered = false
+
+			if currentCause.Start.Line < currentCause.End.Line {
+				// If a multiline error then render the currentCause.Start() and currentCause.End() pointers
+				color := aurora.BrightRed
+				switch currentCause.Type {
+				case LocWarning:
+					color = aurora.BrightYellow
+				case LocHelp:
+					color = aurora.BrightBlue
+				}
+				switch currentLine {
+				case currentCause.Start.Line:
+					if currentCause.Start.Col > 1 {
+						charCount := calcNumberCharactersForColumnNumber(sc.Text(), currentCause.Start.Col)
+
+						lineNumberSpacer(builder, numDigitsInLineNumbers, set.VerticalGap)
+						builder.WriteString(color(fmt.Sprintf("%s%c", strings.Repeat(" ", charCount+3), set.UpArrow)).String())
+						builder.WriteString("\n")
+
+						lineNumberSpacer(builder, numDigitsInLineNumbers, set.VerticalGap)
+						builder.WriteString(color(fmt.Sprintf("%c%s%c", set.LeftTop, strings.Repeat(string(set.HorizontalBar), charCount+2), set.RightBottom)).String())
+						builder.WriteString("\n")
+					}
+				case currentCause.End.Line:
+					if currentCause.End.Col > 1 {
+						charCount := calcNumberCharactersForColumnNumber(sc.Text(), currentCause.End.Col)
+
+						lineNumberSpacer(builder, numDigitsInLineNumbers, set.VerticalGap)
+						builder.WriteString(color(fmt.Sprintf("%c%s%c", set.VerticalBar, strings.Repeat(" ", charCount+2), set.UpArrow)).String())
+						builder.WriteString("\n")
+
+						lineNumberSpacer(builder, numDigitsInLineNumbers, set.VerticalGap)
+						builder.WriteString(color(fmt.Sprintf("%c%s%c", set.LeftCross, strings.Repeat(string(set.HorizontalBar), charCount+2), set.RightBottom)).String())
+						builder.WriteString("\n")
+					}
+
+					// And on the final line also render the error message
+					renderErrorText(builder, 0, numDigitsInLineNumbers, "", 2, currentCause.Type, currentCause.Text, nil, true, true)
+					errorRendered = true
+				}
+			} else if currentLine == currentCause.End.Line {
+				var startCol, endCol int
+				startCol = currentCause.Start.Col
+				endCol = currentCause.End.Col
+
+				// Try and guess the atom where the error is
+				// if the currentCause.Start()/currentCause.End() point is the same position
+				if endCol <= startCol {
+					endCol = GuessEndColumn(sc.Bytes(), startCol)
+				}
+
+				// Work out how long the indicator is
+				indicatorLength := endCol - startCol
+				if indicatorLength <= 1 {
+					indicatorLength = 1
+				}
+
+				// Create out the error lines
+				errorLines := []string{""}
+				errorTextStart := indicatorLength + 1
+
+				if indicatorLength >= 2 {
+					half := float64(indicatorLength-1) / 2
+					errorTextStart = int(math.Floor(half)) + 2
+					if currentCause.Text != "" {
+						errorLines[0] = fmt.Sprintf(
+							"%s%c%s",
+							strings.Repeat(string(set.HorizontalBar), int(math.Floor(half))),
+							set.MiddleTop,
+							strings.Repeat(string(set.HorizontalBar), int(math.Ceil(half))),
+						)
+					} else {
+						errorLines[0] = strings.Repeat(string(set.HorizontalBar), indicatorLength)
+					}
+				} else {
+					errorLines[0] = string(set.UpArrow)
+				}
+
+				renderNewLine := true
+				if currentCause.Text == "" {
+					if idx+1 < len(causes) {
+						nextCause := causes[idx+1]
+						if nextCause.Start.Line == currentLine && nextCause.End.Line == currentLine {
+							renderNewLine = false
+						}
+					}
+				}
+
+				renderGutter := colOffset == 0
+
+				renderErrorText(builder, startCol-colOffset, numDigitsInLineNumbers, sc.Text(), errorTextStart, currentCause.Type, currentCause.Text, errorLines, renderNewLine, renderGutter)
+				errorRendered = true
+				colOffset = endCol
+			}
+
+			if errorRendered {
+				idx = idx + 1
+				if idx < len(causes) {
+					currentCause = causes[idx]
+				} else {
+					// stop looking for errors on this line
+					break
+				}
+			}
+
+			if currentLine > lastEnd.Line+linesAfterError {
+				// stop printing al errors
+				break linePrintLoop
+			}
+		}
+	}
+
+	builder.WriteString(aurora.Gray(grayLevelOnLineNumbers, strings.Repeat(string(set.HorizontalBar), numDigitsInLineNumbers+2)+string(set.RightBottom)).String())
+	builder.WriteRune('\n')
+}
+
+func lineNumberSpacer(builder *strings.Builder, numDigitsInLineNumbers int, r rune) {
+	builder.WriteString(strings.Repeat(" ", numDigitsInLineNumbers+1))
+	builder.WriteString(aurora.Gray(grayLevelOnLineNumbers, fmt.Sprintf(" %c ", r)).String())
+}
+
+func replaceTabsWithSpaces(line string) string {
+	var str strings.Builder
+	var col int
+
+	for _, r := range line {
+		if r == '\t' {
+			// Tabs always count as at least 1 space
+			str.WriteRune(' ')
+			col++
+
+			// We then align onto the next tab column
+			for col%tabSize != 0 {
+				str.WriteRune(' ')
+				col++
+			}
+		} else {
+			str.WriteRune(r)
+			col++
+		}
+	}
+
+	return str.String()
+}
+
+// calcNumberCharactersForColumnNumber calculates the number of monospaced characters we need
+// to render the given column number on the line - accounting for tab characters
+func calcNumberCharactersForColumnNumber(line string, col int) int {
+	count := 0
+	for i, r := range line {
+		if r == '\t' {
+			count++
+			for count%tabSize != 0 {
+				count++
+			}
+		} else {
+			count++
+		}
+
+		if i+1 >= col {
+			break
+		}
+
+	}
+	return count
+}
+
+func renderErrorText(builder *strings.Builder, startCol int, numDigitsInLineNumbers int, srcLine string, errorTextStart int, typ LocationType, text string, errorLines []string, renderNewLine bool, renderGutter bool) {
+	if text != "" {
+		lines := splitTextOnWords(text, errorTextStart)
+		for i, line := range lines {
+			prefix := strings.Repeat(" ", errorTextStart+1)
+			if i == 0 {
+				prefix = fmt.Sprintf("%s%c%c ", strings.Repeat(" ", errorTextStart-2), set.LeftBottom, set.HorizontalBar)
+			}
+
+			errorLines = append(errorLines, prefix+line)
+		}
+	}
+
+	var prefixWhitespace string
+
+	// It's possible the start column references generated code; in that case reset
+	// the column information as a fallback to prevent panics below.
+	if startCol > len(srcLine) {
+		startCol = 0
+	} else {
+		// Compute the whitespace prefix we need on each line
+		// (Note this will render tabs as tabs still if they are present)
+		prefixWhitespace = strings.Repeat(" ", calcNumberCharactersForColumnNumber(srcLine, startCol-1))
+	}
+
+	// Now write the error lines
+	for _, line := range errorLines {
+		if renderGutter {
+			lineNumberSpacer(builder, numDigitsInLineNumbers, set.VerticalGap)
+		}
+		builder.WriteString(prefixWhitespace)
+
+		switch typ {
+		case LocError:
+			builder.WriteString(aurora.BrightRed(line).String())
+		case LocWarning:
+			builder.WriteString(aurora.BrightYellow(line).String())
+		case LocHelp:
+			builder.WriteString(aurora.BrightBlue(line).String())
+		}
+
+		if renderNewLine || len(errorLines) > 1 {
+			builder.WriteString("\n")
+		}
+	}
+}
+
+func splitTextOnWords(text string, startingCol int) (rtn []string) {
+	text = strings.TrimSpace(text)
+	maxLineLength := TerminalWidth - startingCol
+	if maxLineLength < 20 {
+		maxLineLength = 20
+	}
+
+	for _, line := range strings.Split(text, "\n") {
+		if len(line) <= maxLineLength {
+			rtn = append(rtn, line)
+			continue
+		}
+
+		lineStart := 0
+		lastSpace := 0
+		for i := 0; i < len(line); i++ {
+			if unicode.IsSpace(rune(line[i])) {
+				if i-lineStart >= maxLineLength {
+					rtn = append(rtn, line[lineStart:lastSpace])
+					lineStart = lastSpace + 1
+				}
+				lastSpace = i
+			}
+		}
+
+		if len(line)-lineStart >= maxLineLength {
+			rtn = append(rtn, line[lineStart:lastSpace])
+			lineStart = lastSpace + 1
+		}
+		if lineStart < len(line) {
+			rtn = append(rtn, line[lineStart:])
+		}
+
+	}
+	return
+}
+
+func wordWrap(text string, b *strings.Builder) {
+	for _, line := range splitTextOnWords(text, 0) {
+		b.WriteString(line)
+		b.WriteString("\n")
+	}
+}
diff --git a/pkg/errinsrc/srcrender_test.go b/pkg/errinsrc/srcrender_test.go
new file mode 100644
index 0000000000..7b2f9a1114
--- /dev/null
+++ b/pkg/errinsrc/srcrender_test.go
@@ -0,0 +1,148 @@
+package errinsrc
+
+import (
+	"fmt"
+	"path"
+	"strings"
+	"testing"
+
+	. "encr.dev/pkg/errinsrc/internal"
+	"encr.dev/pkg/golden"
+)
+
+func Test_renderSrc_Simple(t *testing.T) {
+	testParams := []struct {
+		testName     string
+		line, column int
+		level        LocationType
+		message      string
+	}{
+		{testName: "error no text", line: 5, column: 7, level: LocError, message: ""},
+		{testName: "simple error", line: 5, column: 2, level: LocError, message: "What is a foo?"},
+		{testName: "simple warning", line: 10, column: 7, level: LocWarning, message: "You sure about this?"},
+		{testName: "simple help", line: 13, column: 4, level: LocHelp, message: "help: try a switch statement here"},
+		{testName: "single character error", line: 6, column: 11, level: LocError, message: "This looks dodgy"},
+		{testName: "multiline message", line: 1, column: 9, level: LocError, message: "Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aenean interdum porttitor elementum. Duis eget cursus arcu, ut interdum lorem. Suspendisse vel diam et eros cursus vestibulum at et lacus. Nullam felis tellus, cursus nec arcu nec, laoreet maximus ante. Cras pellentesque est est, nec laoreet magna accumsan vel. Mauris commodo dui purus, non ullamcorper nisl commodo auctor. Vivamus finibus mi ut risus tempor pellentesque. Nulla facilisi. Nullam rhoncus neque porta erat molestie, at malesuada est aliquam. Etiam convallis lorem eget euismod eleifend. Phasellus sit amet diam in orci molestie pulvinar. Vestibulum non auctor dolor, vel imperdiet risus. Nam egestas et purus id sodales. Aliquam in metus varius, porta mi nec, ornare mauris.\n\nQuisque eu nisi vel nulla sodales pretium sed a dolor. Morbi convallis ornare ligula, ut aliquam velit auctor id. In in neque turpis. Pellentesque habitant morbi tristique senectus et netus et malesuada fames ac turpis egestas. Cras et arcu id magna accumsan semper. Vestibulum ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia curae; Nunc semper rhoncus tincidunt. Vestibulum lacus erat, molestie ut ultrices convallis, placerat at lacus. Integer tempus tempus sodales. Integer sit amet est quam. Praesent vitae condimentum mi.\n\n"},
+	}
+
+	for _, tp := range testParams {
+		tp := tp
+		t.Run(tp.testName, func(t *testing.T) {
+			loc := FromCueTokenPos(&errorLoc{path.Join(testDataFullPath, "test.cue"), tp.line, tp.column}, testDataFullPath)
+			loc.Text = tp.message
+			loc.Type = tp.level
+
+			err := New(ErrParams{
+				Code:      1,
+				Title:     "simple test error",
+				Summary:   "There has been a simple error in your code",
+				Detail:    "For more information please visit our great help documentation",
+				Locations: SrcLocations{loc},
+			}, false)
+
+			testError(t, err)
+		})
+	}
+}
+
+func Test_renderSrc_MultipleSeperateInSameFile(t *testing.T) {
+	t.Run("spaced apart", func(t *testing.T) {
+		loc1 := FromCueTokenPos(&errorLoc{path.Join(testDataFullPath, "test.cue"), 5, 7}, testDataFullPath)
+		loc1.Text = "defined as a boolean here"
+		loc2 := FromCueTokenPos(&errorLoc{path.Join(testDataFullPath, "test.cue"), 13, 9}, testDataFullPath)
+		loc2.Text = "referenced here"
+
+		err := New(ErrParams{
+			Code:      1,
+			Title:     "simple test error",
+			Summary:   "There has been a simple error in your code",
+			Detail:    "For more information please visit our great help documentation",
+			Locations: SrcLocations{loc1, loc2},
+		}, false)
+
+		testError(t, err)
+	})
+	t.Run("on following lines", func(t *testing.T) {
+		loc1 := FromCueTokenPos(&errorLoc{path.Join(testDataFullPath, "test.cue"), 5, 7}, testDataFullPath)
+		loc1.Text = "this is weird"
+		loc2 := FromCueTokenPos(&errorLoc{path.Join(testDataFullPath, "test.cue"), 6, 13}, testDataFullPath)
+		loc2.Text = "so is this!"
+
+		err := New(ErrParams{
+			Code:      1,
+			Title:     "simple test error",
+			Summary:   "There has been a simple error in your code",
+			Detail:    "For more information please visit our great help documentation",
+			Locations: SrcLocations{loc1, loc2},
+		}, false)
+
+		testError(t, err)
+	})
+	t.Run("on same line", func(t *testing.T) {
+		loc1 := FromCueTokenPos(&errorLoc{path.Join(testDataFullPath, "test.cue"), 5, 7}, testDataFullPath)
+		loc1.Text = "hint: change this to an int"
+		loc1.Type = LocHelp
+		loc2 := FromCueTokenPos(&errorLoc{path.Join(testDataFullPath, "test.cue"), 5, 2}, testDataFullPath)
+		loc2.Text = "wrong type here"
+
+		err := New(ErrParams{
+			Code:      1,
+			Title:     "simple test error",
+			Summary:   "There has been a simple error in your code",
+			Detail:    "For more information please visit our great help documentation",
+			Locations: SrcLocations{loc1, loc2},
+		}, false)
+
+		testError(t, err)
+	})
+}
+
+func Test_renderSrc_MutlilineError(t *testing.T) {
+	loc1 := FromCueTokenPos(&errorLoc{path.Join(testDataFullPath, "test.cue"), 4, 7}, testDataFullPath)
+	loc1.End = Pos{7, 1}
+	loc1.Text = "this is an error which spans multiple lines\nlike this so we can test alignment"
+
+	err := New(ErrParams{
+		Code:      1,
+		Title:     "simple test error",
+		Summary:   "There has been a simple error in your code",
+		Detail:    "For more information please visit our great help documentation",
+		Locations: SrcLocations{loc1},
+	}, false)
+
+	testError(t, err)
+}
+
+/* helpers */
+
+func testError(t *testing.T, err *ErrInSrc) {
+	// Reset for stdout with colours
+	set = unicodeSet
+	ColoursInErrors(true)
+	fmt.Println(err.Error())
+
+	// Now golden files without colours
+	goldenFile := strings.Replace(t.Name(), "/", "__", -1)
+	ColoursInErrors(false)
+	golden.TestAgainst(t, goldenFile+"_unicode.golden", err.Error())
+	set = asciiSet
+	golden.TestAgainst(t, goldenFile+"_ascii.golden", err.Error())
+}
+
+type errorLoc struct {
+	filename string
+	line     int
+	column   int
+}
+
+func (e *errorLoc) Filename() string {
+	return e.filename
+}
+
+func (e *errorLoc) Line() int {
+	return e.line
+}
+
+func (e *errorLoc) Column() int {
+	return e.column
+}
diff --git a/pkg/errinsrc/stack.go b/pkg/errinsrc/stack.go
new file mode 100644
index 0000000000..d62d9f615e
--- /dev/null
+++ b/pkg/errinsrc/stack.go
@@ -0,0 +1,167 @@
+package errinsrc
+
+import (
+	"fmt"
+	"runtime"
+	"strings"
+
+	"github.com/pkg/errors"
+)
+
+// StackFrame represents a single frame in a Stack trace
+type StackFrame struct {
+	ProgramCounter uintptr `json:"pc"`
+	File           string  `json:"file"`
+	Package        string  `json:"pkg"`
+	Function       string  `json:"fun"`
+	Line           int     `json:"line"`
+}
+
+const maxFramesOnPrettyPrint = 5
+
+func GetStack() []*StackFrame {
+	ret := make([]uintptr, 100)
+
+	index := runtime.Callers(1, ret)
+	if index == 0 {
+		return nil
+	}
+
+	return convertFrames(ret[:index])
+}
+
+// bottomStackTraceFrom returns the deepest stack trace from the given error
+func bottomStackTraceFrom(err error) (rtn []*StackFrame) {
+	count := 0
+
+	for err != nil && count < 100 {
+		count++
+
+		// Look for an error which provides a stack trace
+		if e, ok := err.(*ErrInSrc); ok {
+			rtn = e.Stack
+		} else if e, ok := err.(interface{ StackTrace() errors.StackTrace }); ok {
+			frames := e.StackTrace()
+			pcs := make([]uintptr, len(frames))
+			for i, pc := range frames {
+				pcs[i] = uintptr(pc)
+			}
+			rtn = convertFrames(pcs)
+		}
+
+		// Recurse
+		switch typed := err.(type) {
+		case interface{ Unwrap() error }:
+			err = typed.Unwrap()
+
+		case interface{ Unwrap() []error }:
+			errs := typed.Unwrap()
+			if len(errs) > 0 {
+				err = errs[0]
+			} else {
+				err = nil
+			}
+
+		case interface{ Cause() error }:
+			err = typed.Cause()
+		}
+	}
+
+	return
+}
+
+func convertFrames(pcs []uintptr) []*StackFrame {
+	cf := runtime.CallersFrames(pcs)
+	frame, more := cf.Next()
+
+	// Skip over the "errinsrc" or "errlist" package files or any subpackages
+	// which are the top frames (as these would only be related to the creation of the error)
+	for strings.Contains(frame.File, "errinsrc") ||
+		strings.Contains(frame.File, "errlist") ||
+		strings.Contains(frame.File, "perr") ||
+		strings.Contains(frame.File, "eerror") ||
+		strings.HasSuffix(frame.File, "errs.go") {
+		if !more {
+			return nil
+		}
+
+		frame, more = cf.Next()
+	}
+
+	var frames []*StackFrame
+	for {
+		// Skip the frame if it's Go Runtime or internal testing code related code
+		if !strings.HasPrefix(frame.Function, "runtime.") && !strings.HasPrefix(frame.Function, "testing.") {
+			// Separate the package name and function name
+			pkgAndFunc := frame.Function
+			if idx := strings.LastIndex(pkgAndFunc, "/"); idx >= 0 {
+				pkgAndFunc = pkgAndFunc[idx+1:]
+			}
+			pkgName, funcName, _ := strings.Cut(pkgAndFunc, ".")
+
+			// Record the frame
+			frames = append(frames, &StackFrame{
+				ProgramCounter: frame.PC,
+				Package:        pkgName,
+				Function:       funcName,
+				File:           frame.File,
+				Line:           frame.Line,
+			})
+		}
+
+		if !more {
+			return frames
+		}
+
+		frame, more = cf.Next()
+	}
+}
+
+func prettyPrintStack(stack []*StackFrame, b *strings.Builder) string {
+	b.WriteString(aurora.Gray(grayLevelOnLineNumbers, fmt.Sprintf("%c%c%c", set.LeftTop, set.HorizontalBar, set.LeftBracket)).String())
+	b.WriteString(aurora.Cyan("Stack Trace").String())
+	b.WriteString(aurora.Gray(grayLevelOnLineNumbers, fmt.Sprintf("%c", set.RightBracket)).String())
+
+	longestFunc := 0
+	for i, frame := range stack {
+		name := fmt.Sprintf("%s.%s", frame.Package, frame.Function)
+		if length := len(name); length > longestFunc {
+			longestFunc = length
+		}
+
+		if i >= maxFramesOnPrettyPrint {
+			break
+		}
+	}
+
+	for i, frame := range stack {
+		vertical := set.LeftCross
+		if i == len(stack)-1 {
+			vertical = set.LeftBottom
+		}
+
+		b.WriteString(
+			fmt.Sprintf(
+				"\n%s %s.%s%s %s:%d",
+				aurora.Gray(grayLevelOnLineNumbers, fmt.Sprintf("%c%c%c", vertical, set.HorizontalBar, set.RightArrow)),
+				aurora.Gray(18, frame.Package),
+				aurora.Magenta(frame.Function),
+				strings.Repeat(" ", longestFunc-len(frame.Function)-len(frame.Package)-1),
+				frame.File,
+				frame.Line,
+			),
+		)
+
+		if i >= maxFramesOnPrettyPrint && i != len(stack)-1 {
+			b.WriteString("\n")
+			b.WriteString(aurora.Gray(grayLevelOnLineNumbers, fmt.Sprintf("%c%c%c", set.LeftBottom, set.HorizontalBar, set.LeftBracket)).String())
+			b.WriteString(aurora.Yellow("... remaining frames omitted ...").Italic().String())
+			b.WriteString(aurora.Gray(grayLevelOnLineNumbers, fmt.Sprintf("%c", set.RightBracket)).String())
+
+			break
+		}
+	}
+	b.WriteString("\n\n")
+
+	return b.String()
+}
diff --git a/pkg/errinsrc/stack_dev.go b/pkg/errinsrc/stack_dev.go
new file mode 100644
index 0000000000..80ee104b3b
--- /dev/null
+++ b/pkg/errinsrc/stack_dev.go
@@ -0,0 +1,7 @@
+//go:build dev_build
+
+package errinsrc
+
+// IncludeStackByDefault is whether to include the stack by default on all errors.
+// This is exported to allow Encore's CI platform to set this to true for CI/CD builds.
+var IncludeStackByDefault = true
diff --git a/pkg/errinsrc/stack_release.go b/pkg/errinsrc/stack_release.go
new file mode 100644
index 0000000000..9183175dbd
--- /dev/null
+++ b/pkg/errinsrc/stack_release.go
@@ -0,0 +1,7 @@
+//go:build !dev_build
+
+package errinsrc
+
+// IncludeStackByDefault is whether to include the stack by default on all errors.
+// This is exported to allow Encore's CI platform to set this to true for CI/CD builds.
+var IncludeStackByDefault = false
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_following_lines_ascii.golden b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_following_lines_ascii.golden
new file mode 100644
index 0000000000..eb01b31405
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_following_lines_ascii.golden
@@ -0,0 +1,21 @@
+
+-- simple test error ----------------------------------------------------------------------[E0001]--
+
+There has been a simple error in your code
+
+   ,-[ /test.cue:5:7 ]
+   |
+ 3 | // This is a sample file
+ 4 | blah: {
+ 5 |     foo: bool
+   :          -v--
+   :           `- this is weird
+ 6 |     bar: int | *3
+   :                v-
+   :                `- so is this!
+ 7 | }
+ 8 | 
+---'
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_following_lines_unicode.golden b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_following_lines_unicode.golden
new file mode 100644
index 0000000000..16a05c8ae8
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_following_lines_unicode.golden
@@ -0,0 +1,21 @@
+
+── simple test error ──────────────────────────────────────────────────────────────────────[E0001]──
+
+There has been a simple error in your code
+
+   ╭─[ /test.cue:5:7 ]
+   │
+ 3 │ // This is a sample file
+ 4 │ blah: {
+ 5 │     foo: bool
+   ⋮          ─┬──
+   ⋮           ╰─ this is weird
+ 6 │     bar: int | *3
+   ⋮                ┬─
+   ⋮                ╰─ so is this!
+ 7 │ }
+ 8 │ 
+───╯
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_same_line_ascii.golden b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_same_line_ascii.golden
new file mode 100644
index 0000000000..9b50550079
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_same_line_ascii.golden
@@ -0,0 +1,29 @@
+
+-- simple test error ----------------------------------------------------------------------[E0001]--
+
+There has been a simple error in your code
+
+   ,-[ /test.cue:5:2 ]
+   |
+ 3 | // This is a sample file
+ 4 | blah: {
+ 5 |     foo: bool
+   :     ----v----
+   :         `- wrong type here
+ 6 |     bar: int | *3
+ 7 | }
+---'
+
+   ,-[ /test.cue:5:7 ]
+   |
+ 3 | // This is a sample file
+ 4 | blah: {
+ 5 |     foo: bool
+   :          -v--
+   :           `- hint: change this to an int
+ 6 |     bar: int | *3
+ 7 | }
+---'
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_same_line_unicode.golden b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_same_line_unicode.golden
new file mode 100644
index 0000000000..ea7e2e2ab0
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__on_same_line_unicode.golden
@@ -0,0 +1,29 @@
+
+── simple test error ──────────────────────────────────────────────────────────────────────[E0001]──
+
+There has been a simple error in your code
+
+   ╭─[ /test.cue:5:2 ]
+   │
+ 3 │ // This is a sample file
+ 4 │ blah: {
+ 5 │     foo: bool
+   ⋮     ────┬────
+   ⋮         ╰─ wrong type here
+ 6 │     bar: int | *3
+ 7 │ }
+───╯
+
+   ╭─[ /test.cue:5:7 ]
+   │
+ 3 │ // This is a sample file
+ 4 │ blah: {
+ 5 │     foo: bool
+   ⋮          ─┬──
+   ⋮           ╰─ hint: change this to an int
+ 6 │     bar: int | *3
+ 7 │ }
+───╯
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__spaced_apart_ascii.golden b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__spaced_apart_ascii.golden
new file mode 100644
index 0000000000..3dfd317a07
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__spaced_apart_ascii.golden
@@ -0,0 +1,25 @@
+
+-- simple test error ----------------------------------------------------------------------[E0001]--
+
+There has been a simple error in your code
+
+    ,-[ /test.cue:5:7 ]
+    |
+  3 | // This is a sample file
+  4 | blah: {
+  5 |     foo: bool
+    :          -v--
+    :           `- defined as a boolean here
+    * 
+    * 
+ 11 | 
+ 12 | // If foo then bar is 12
+ 13 | if blah.foo {
+    :         -v-
+    :          `- referenced here
+ 14 |     blah: bar: 12
+ 15 | }
+----'
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__spaced_apart_unicode.golden b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__spaced_apart_unicode.golden
new file mode 100644
index 0000000000..8136fc2d4b
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_MultipleSeperateInSameFile__spaced_apart_unicode.golden
@@ -0,0 +1,25 @@
+
+── simple test error ──────────────────────────────────────────────────────────────────────[E0001]──
+
+There has been a simple error in your code
+
+    ╭─[ /test.cue:5:7 ]
+    │
+  3 │ // This is a sample file
+  4 │ blah: {
+  5 │     foo: bool
+    ⋮          ─┬──
+    ⋮           ╰─ defined as a boolean here
+    · 
+    · 
+ 11 │ 
+ 12 │ // If foo then bar is 12
+ 13 │ if blah.foo {
+    ⋮         ─┬─
+    ⋮          ╰─ referenced here
+ 14 │     blah: bar: 12
+ 15 │ }
+────╯
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_MutlilineError_ascii.golden b/pkg/errinsrc/testdata/Test_renderSrc_MutlilineError_ascii.golden
new file mode 100644
index 0000000000..59fb16ce81
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_MutlilineError_ascii.golden
@@ -0,0 +1,23 @@
+
+-- simple test error ----------------------------------------------------------------------[E0001]--
+
+There has been a simple error in your code
+
+    ,-[ /test.cue:4:7 ]
+    |
+  2 |     
+  3 |     // This is a sample file
+  4 |     blah: {
+    :           ^
+    : ,---------'
+  5 | |       foo: bool
+  6 | |       bar: int | *3
+  7 | |-> }
+    : `- this is an error which spans multiple lines
+    :    like this so we can test alignment
+  8 |     
+  9 |     // Let's set foo to true
+----'
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_MutlilineError_unicode.golden b/pkg/errinsrc/testdata/Test_renderSrc_MutlilineError_unicode.golden
new file mode 100644
index 0000000000..31646915d6
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_MutlilineError_unicode.golden
@@ -0,0 +1,23 @@
+
+── simple test error ──────────────────────────────────────────────────────────────────────[E0001]──
+
+There has been a simple error in your code
+
+    ╭─[ /test.cue:4:7 ]
+    │
+  2 │     
+  3 │     // This is a sample file
+  4 │     blah: {
+    ⋮           ▲
+    ⋮ ╭─────────╯
+  5 │ │       foo: bool
+  6 │ │       bar: int | *3
+  7 │ ├─▶ }
+    ⋮ ╰─ this is an error which spans multiple lines
+    ⋮    like this so we can test alignment
+  8 │     
+  9 │     // Let's set foo to true
+────╯
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__error_no_text_ascii.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__error_no_text_ascii.golden
new file mode 100644
index 0000000000..adecf10b86
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__error_no_text_ascii.golden
@@ -0,0 +1,17 @@
+
+-- simple test error ----------------------------------------------------------------------[E0001]--
+
+There has been a simple error in your code
+
+   ,-[ /test.cue:5:7 ]
+   |
+ 3 | // This is a sample file
+ 4 | blah: {
+ 5 |     foo: bool
+   :          ----
+ 6 |     bar: int | *3
+ 7 | }
+---'
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__error_no_text_unicode.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__error_no_text_unicode.golden
new file mode 100644
index 0000000000..368007195c
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__error_no_text_unicode.golden
@@ -0,0 +1,17 @@
+
+── simple test error ──────────────────────────────────────────────────────────────────────[E0001]──
+
+There has been a simple error in your code
+
+   ╭─[ /test.cue:5:7 ]
+   │
+ 3 │ // This is a sample file
+ 4 │ blah: {
+ 5 │     foo: bool
+   ⋮          ────
+ 6 │     bar: int | *3
+ 7 │ }
+───╯
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__multiline_message_ascii.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__multiline_message_ascii.golden
new file mode 100644
index 0000000000..8c6cb8fef5
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__multiline_message_ascii.golden
@@ -0,0 +1,30 @@
+
+-- simple test error ----------------------------------------------------------------------[E0001]--
+
+There has been a simple error in your code
+
+   ,-[ /test.cue:1:9 ]
+   |
+ 1 | package test_cue
+   :         ---v----
+   :            `- Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aenean interdum porttitor elementum.
+   :               Duis eget cursus arcu, ut interdum lorem. Suspendisse vel diam et eros cursus vestibulum at et
+   :               lacus. Nullam felis tellus, cursus nec arcu nec, laoreet maximus ante. Cras pellentesque est
+   :               est, nec laoreet magna accumsan vel. Mauris commodo dui purus, non ullamcorper nisl commodo
+   :               auctor. Vivamus finibus mi ut risus tempor pellentesque. Nulla facilisi. Nullam rhoncus neque
+   :               porta erat molestie, at malesuada est aliquam. Etiam convallis lorem eget euismod eleifend.
+   :               Phasellus sit amet diam in orci molestie pulvinar. Vestibulum non auctor dolor, vel imperdiet
+   :               risus. Nam egestas et purus id sodales. Aliquam in metus varius, porta mi nec, ornare mauris.
+   :               
+   :               Quisque eu nisi vel nulla sodales pretium sed a dolor. Morbi convallis ornare ligula, ut
+   :               aliquam velit auctor id. In in neque turpis. Pellentesque habitant morbi tristique senectus et
+   :               netus et malesuada fames ac turpis egestas. Cras et arcu id magna accumsan semper. Vestibulum
+   :               ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia curae; Nunc semper
+   :               rhoncus tincidunt. Vestibulum lacus erat, molestie ut ultrices convallis, placerat at lacus.
+   :               Integer tempus tempus sodales. Integer sit amet est quam. Praesent vitae condimentum mi.
+ 2 | 
+ 3 | // This is a sample file
+---'
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__multiline_message_unicode.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__multiline_message_unicode.golden
new file mode 100644
index 0000000000..a03c46ae62
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__multiline_message_unicode.golden
@@ -0,0 +1,30 @@
+
+── simple test error ──────────────────────────────────────────────────────────────────────[E0001]──
+
+There has been a simple error in your code
+
+   ╭─[ /test.cue:1:9 ]
+   │
+ 1 │ package test_cue
+   ⋮         ───┬────
+   ⋮            ╰─ Lorem ipsum dolor sit amet, consectetur adipiscing elit. Aenean interdum porttitor elementum.
+   ⋮               Duis eget cursus arcu, ut interdum lorem. Suspendisse vel diam et eros cursus vestibulum at et
+   ⋮               lacus. Nullam felis tellus, cursus nec arcu nec, laoreet maximus ante. Cras pellentesque est
+   ⋮               est, nec laoreet magna accumsan vel. Mauris commodo dui purus, non ullamcorper nisl commodo
+   ⋮               auctor. Vivamus finibus mi ut risus tempor pellentesque. Nulla facilisi. Nullam rhoncus neque
+   ⋮               porta erat molestie, at malesuada est aliquam. Etiam convallis lorem eget euismod eleifend.
+   ⋮               Phasellus sit amet diam in orci molestie pulvinar. Vestibulum non auctor dolor, vel imperdiet
+   ⋮               risus. Nam egestas et purus id sodales. Aliquam in metus varius, porta mi nec, ornare mauris.
+   ⋮               
+   ⋮               Quisque eu nisi vel nulla sodales pretium sed a dolor. Morbi convallis ornare ligula, ut
+   ⋮               aliquam velit auctor id. In in neque turpis. Pellentesque habitant morbi tristique senectus et
+   ⋮               netus et malesuada fames ac turpis egestas. Cras et arcu id magna accumsan semper. Vestibulum
+   ⋮               ante ipsum primis in faucibus orci luctus et ultrices posuere cubilia curae; Nunc semper
+   ⋮               rhoncus tincidunt. Vestibulum lacus erat, molestie ut ultrices convallis, placerat at lacus.
+   ⋮               Integer tempus tempus sodales. Integer sit amet est quam. Praesent vitae condimentum mi.
+ 2 │ 
+ 3 │ // This is a sample file
+───╯
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_error_ascii.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_error_ascii.golden
new file mode 100644
index 0000000000..3e3e17f731
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_error_ascii.golden
@@ -0,0 +1,18 @@
+
+-- simple test error ----------------------------------------------------------------------[E0001]--
+
+There has been a simple error in your code
+
+   ,-[ /test.cue:5:2 ]
+   |
+ 3 | // This is a sample file
+ 4 | blah: {
+ 5 |     foo: bool
+   :     ----v----
+   :         `- What is a foo?
+ 6 |     bar: int | *3
+ 7 | }
+---'
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_error_unicode.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_error_unicode.golden
new file mode 100644
index 0000000000..17fc9645e7
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_error_unicode.golden
@@ -0,0 +1,18 @@
+
+── simple test error ──────────────────────────────────────────────────────────────────────[E0001]──
+
+There has been a simple error in your code
+
+   ╭─[ /test.cue:5:2 ]
+   │
+ 3 │ // This is a sample file
+ 4 │ blah: {
+ 5 │     foo: bool
+   ⋮     ────┬────
+   ⋮         ╰─ What is a foo?
+ 6 │     bar: int | *3
+ 7 │ }
+───╯
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_help_ascii.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_help_ascii.golden
new file mode 100644
index 0000000000..5a9ad62d26
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_help_ascii.golden
@@ -0,0 +1,18 @@
+
+-- simple test error ----------------------------------------------------------------------[E0001]--
+
+There has been a simple error in your code
+
+    ,-[ /test.cue:13:4 ]
+    |
+ 11 | 
+ 12 | // If foo then bar is 12
+ 13 | if blah.foo {
+    :    ---v----
+    :       `- help: try a switch statement here
+ 14 |     blah: bar: 12
+ 15 | }
+----'
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_help_unicode.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_help_unicode.golden
new file mode 100644
index 0000000000..b10543aa1b
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_help_unicode.golden
@@ -0,0 +1,18 @@
+
+── simple test error ──────────────────────────────────────────────────────────────────────[E0001]──
+
+There has been a simple error in your code
+
+    ╭─[ /test.cue:13:4 ]
+    │
+ 11 │ 
+ 12 │ // If foo then bar is 12
+ 13 │ if blah.foo {
+    ⋮    ───┬────
+    ⋮       ╰─ help: try a switch statement here
+ 14 │     blah: bar: 12
+ 15 │ }
+────╯
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_warning_ascii.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_warning_ascii.golden
new file mode 100644
index 0000000000..14b97f81be
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_warning_ascii.golden
@@ -0,0 +1,18 @@
+
+-- simple test error ----------------------------------------------------------------------[E0001]--
+
+There has been a simple error in your code
+
+    ,-[ /test.cue:10:7 ]
+    |
+  8 | 
+  9 | // Let's set foo to true
+ 10 | blah: foo: true
+    :       -v-
+    :        `- You sure about this?
+ 11 | 
+ 12 | // If foo then bar is 12
+----'
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_warning_unicode.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_warning_unicode.golden
new file mode 100644
index 0000000000..5afe053ab8
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__simple_warning_unicode.golden
@@ -0,0 +1,18 @@
+
+── simple test error ──────────────────────────────────────────────────────────────────────[E0001]──
+
+There has been a simple error in your code
+
+    ╭─[ /test.cue:10:7 ]
+    │
+  8 │ 
+  9 │ // Let's set foo to true
+ 10 │ blah: foo: true
+    ⋮       ─┬─
+    ⋮        ╰─ You sure about this?
+ 11 │ 
+ 12 │ // If foo then bar is 12
+────╯
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__single_character_error_ascii.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__single_character_error_ascii.golden
new file mode 100644
index 0000000000..9be42265ce
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__single_character_error_ascii.golden
@@ -0,0 +1,18 @@
+
+-- simple test error ----------------------------------------------------------------------[E0001]--
+
+There has been a simple error in your code
+
+   ,-[ /test.cue:6:11 ]
+   |
+ 4 | blah: {
+ 5 |     foo: bool
+ 6 |     bar: int | *3
+   :              ^
+   :              `- This looks dodgy
+ 7 | }
+ 8 | 
+---'
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/Test_renderSrc_Simple__single_character_error_unicode.golden b/pkg/errinsrc/testdata/Test_renderSrc_Simple__single_character_error_unicode.golden
new file mode 100644
index 0000000000..101423527c
--- /dev/null
+++ b/pkg/errinsrc/testdata/Test_renderSrc_Simple__single_character_error_unicode.golden
@@ -0,0 +1,18 @@
+
+── simple test error ──────────────────────────────────────────────────────────────────────[E0001]──
+
+There has been a simple error in your code
+
+   ╭─[ /test.cue:6:11 ]
+   │
+ 4 │ blah: {
+ 5 │     foo: bool
+ 6 │     bar: int | *3
+   ⋮              ▲
+   ⋮              ╰─ This looks dodgy
+ 7 │ }
+ 8 │ 
+───╯
+
+For more information please visit our great help documentation
+
diff --git a/pkg/errinsrc/testdata/test.cue b/pkg/errinsrc/testdata/test.cue
new file mode 100644
index 0000000000..3bdb7d686f
--- /dev/null
+++ b/pkg/errinsrc/testdata/test.cue
@@ -0,0 +1,15 @@
+package test_cue
+
+// This is a sample file
+blah: {
+	foo: bool
+	bar: int | *3
+}
+
+// Let's set foo to true
+blah: foo: true
+
+// If foo then bar is 12
+if blah.foo {
+	blah: bar: 12
+}
diff --git a/pkg/errinsrc/testdata/test.go b/pkg/errinsrc/testdata/test.go
new file mode 100644
index 0000000000..fec959c539
--- /dev/null
+++ b/pkg/errinsrc/testdata/test.go
@@ -0,0 +1,27 @@
+package testdata
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+	Blah struct {
+		Foo config.Bool `json:"foo"`
+		Bar config.Int  `json:"bar"`
+	} `json:"blah"`
+}
+
+var cfg = config.Load[Config]()
+
+type WhatIsBarResponse struct {
+	Bar int
+}
+
+//encore:api public
+func WhatIsBar(ctx context.Context) (*WhatIsBarResponse, error) {
+	return &WhatIsBarResponse{
+		Bar: cfg.Blah.Bar(),
+	}, nil
+}
diff --git a/pkg/errinsrc/utils.go b/pkg/errinsrc/utils.go
new file mode 100644
index 0000000000..45de508a94
--- /dev/null
+++ b/pkg/errinsrc/utils.go
@@ -0,0 +1,84 @@
+package errinsrc
+
+import (
+	"go/ast"
+	"go/token"
+
+	. "encr.dev/pkg/errinsrc/internal"
+)
+
+type ErrorList interface {
+	Error() string
+	ErrorList() []*ErrInSrc
+}
+
+// Bailout is a panic value that can be used to
+type Bailout struct {
+	List ErrorList
+}
+
+func (b Bailout) Error() string {
+	return b.List.Error()
+}
+
+func (b Bailout) Unwrap() error {
+	return b.List
+}
+
+func (b Bailout) ErrorList() []*ErrInSrc {
+	return b.List.ErrorList()
+}
+
+func Panic(list ErrorList) {
+	panic(Bailout{list})
+}
+
+// ExtractFromPanic returns the first ErrInSrc or ErrorList found in the recovered
+// value.
+//
+// If no value is recovered, then nil is returned.
+func ExtractFromPanic(recovered any) error {
+	// If it's already an ErrInSrc or list of them, just return that
+	if unwrapped, ok := recovered.(error); ok {
+		// Check the type of the error then unwrap as needed
+		n := 0
+		for unwrapped != nil {
+			// Limit recursion to 100 unwraps to prevent infinite loops.
+			n++
+			if n > 100 {
+				return nil
+			}
+
+			switch err := unwrapped.(type) {
+			case *ErrInSrc:
+				return err
+			case ErrorList:
+				return err
+			case Bailout:
+				return err.List
+			case interface{ Unwrap() error }:
+				unwrapped = err.Unwrap()
+			default:
+				// If we get here, it's not an errinsrc or error list, so return nil
+				return nil
+			}
+		}
+	}
+
+	return nil
+}
+
+func AddHintFromGo(err error, fileset *token.FileSet, node ast.Node, hint string) {
+	switch err := err.(type) {
+	case *ErrInSrc:
+		if hintLoc, ok := FromGoASTNode(fileset, node).Get(); ok {
+			hintLoc.Type = LocHelp
+			hintLoc.Text = hint
+			err.Params.Locations = append(err.Params.Locations, hintLoc)
+		}
+	case ErrorList:
+		for _, err := range err.ErrorList() {
+			AddHintFromGo(err, fileset, node, hint)
+		}
+	}
+}
diff --git a/pkg/errlist/errlist.go b/pkg/errlist/errlist.go
new file mode 100644
index 0000000000..7647d23481
--- /dev/null
+++ b/pkg/errlist/errlist.go
@@ -0,0 +1,284 @@
+package errlist
+
+import (
+	"encoding/json"
+	"fmt"
+	"go/scanner"
+	"go/token"
+	"io"
+	"path/filepath"
+	"strings"
+
+	"encr.dev/pkg/errinsrc"
+	"encr.dev/pkg/errinsrc/srcerrors"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+// Verbose controls whether the error list prints all errors
+// or just the what MaxErrorsToPrint is set to
+var Verbose = false
+
+// MaxErrorsToPrint is the maximum number of errors to print
+// if Verbose is false
+var MaxErrorsToPrint = 1
+
+type List struct {
+	List errinsrc.List `json:"list,omitempty"`
+	fset *token.FileSet
+}
+
+var _ errinsrc.ErrorList = (*List)(nil)
+
+func New(fset *token.FileSet) *List {
+	return &List{fset: fset}
+}
+
+// Convert attempts to convert known error types into an error list
+// if it can't it returns nil
+func Convert(err error) *List {
+	switch err := err.(type) {
+	case *List:
+		return err
+	case *errinsrc.ErrInSrc:
+		l := New(nil)
+		l.List = []*errinsrc.ErrInSrc{err}
+		return l
+	case errinsrc.ErrorList:
+		l := New(nil)
+		l.List = err.ErrorList()
+		return l
+	default:
+		return nil
+	}
+}
+
+// Report is a function that allows you to report an error into
+// this list, without having to check for nil.
+//
+// This function only supports error of types:
+//   - *List
+//   - *errinsrc.ErrInSrc
+//   - *scanner.Error
+//
+// If too many errors have been reported it panics
+// with a Bailout value to abort processing.
+// Use HandleBailout to conveniently handle this.
+func (l *List) Report(err error) {
+	if err == nil {
+		return
+	}
+
+	var errToAdd *errinsrc.ErrInSrc
+	switch err := (err).(type) {
+	case *errinsrc.ErrInSrc:
+		// the base type we expect
+		errToAdd = err
+
+	case *scanner.Error:
+		// errors directly from the Go parser
+		errToAdd = srcerrors.GenericGoParserError(err)
+
+	case scanner.ErrorList:
+		for _, e := range err {
+			l.Report(e)
+		}
+		return
+	case *List:
+		// If it's a different list, then merge it in
+		if err != l {
+			for _, e := range err.ErrorList() {
+				l.Report(e)
+			}
+		}
+		return
+	case errinsrc.ErrorList:
+		// either another errlist or a list from `srcerrors`
+		for _, e := range err.ErrorList() {
+			l.Report(e)
+		}
+		return
+	default:
+		panic(fmt.Sprintf("unsupported type %T being reported to errlist.List", err))
+	}
+
+	// Skip adding this error if it's on the same line as another error
+	// we've already reported, since it's probably a spurious error caused
+	// by the first one.
+	for _, e := range l.List {
+		if errToAdd.OnSameLine(e) {
+			return
+		}
+	}
+
+	l.List = append(l.List, errToAdd)
+	if len(l.List) > 10 {
+		l.Abort()
+	}
+}
+
+// Add adds an error to the list.
+//
+// If too many errors have been added it panics
+// with a Bailout value to abort processing.
+// Use HandleBailout to conveniently handle this.
+//
+// Deprecated: use Report instead
+func (l *List) Add(pos token.Pos, msg string) {
+	pp := l.fset.Position(pos)
+	l.Report(&scanner.Error{
+		Pos: pp,
+		Msg: msg,
+	})
+}
+
+// Addf is equivalent to Add(pos, fmt.Sprintf(format, args...))
+//
+// Deprecated: use Report instead
+func (l *List) Addf(pos token.Pos, format string, args ...interface{}) {
+	l.Add(pos, fmt.Sprintf(format, args...))
+}
+
+// AddRaw adds a raw *scanner.Error to the list.
+//
+// If too many errors have been added it panics
+// with a Bailout value to abort processing.
+// Use HandleBailout to conveniently handle this.
+//
+// Deprecated: use Report instead
+func (l *List) AddRaw(err *scanner.Error) {
+	l.Report(err)
+}
+
+// Merge merges another list into this one.
+// The token.FileSet in use must be the same one as this one,
+// or else it panics.
+//
+// Deprecated: use Report instead
+func (l *List) Merge(other *List) {
+	if other.fset != l.fset {
+		panic("errlist: cannot merge lists with different *token.FileSets")
+	}
+	l.List = append(l.List, other.List...)
+}
+
+// Err returns an error equivalent to this error list.
+// If the list is empty, Err returns nil.
+func (l *List) Err() error {
+	if len(l.List) == 0 {
+		return nil
+	}
+	return l
+}
+
+// Error implements the error interface.
+func (l *List) Error() string {
+	var b strings.Builder
+
+	if Verbose {
+		for _, err := range l.List {
+			b.WriteString(err.Error())
+		}
+	} else {
+		if len(l.List) == 0 {
+			b.WriteString("no errors")
+		} else {
+			for i, err := range l.List {
+				b.WriteString(err.Error())
+				if i >= MaxErrorsToPrint-1 {
+					break
+				}
+			}
+
+			if len(l.List) > MaxErrorsToPrint {
+				b.WriteString(fmt.Sprintf("And %d more errors", len(l.List)-MaxErrorsToPrint))
+			}
+		}
+	}
+
+	return b.String()
+}
+
+func (l *List) ErrorList() []*errinsrc.ErrInSrc {
+	return l.List
+}
+
+// MakeRelative rewrites the errors by making filenames within the
+// app root relative to the relwd (which must be a relative path
+// within the root).
+func (l *List) MakeRelative(root, relwd string) {
+	wdroot := filepath.Join(root, relwd)
+	for _, e := range l.List {
+		for _, loc := range e.Params.Locations {
+			if loc.File != nil {
+				fn := loc.File.RelPath
+				if strings.HasPrefix(fn, root) {
+					if rel, err := filepath.Rel(wdroot, fn); err == nil {
+						loc.File.RelPath = rel
+					}
+				}
+			}
+		}
+	}
+}
+
+// HandleBailout handles bailouts raised by (*List).Add and family
+// when too many errors have been found.
+func (l *List) HandleBailout(err *error) {
+	if e := recover(); e != nil {
+		if b, ok := e.(errinsrc.Bailout); ok {
+			*err = b.List
+		} else {
+			panic(e)
+		}
+	}
+}
+
+func (l *List) Len() int {
+	return len(l.List)
+}
+
+// Abort aborts early if there is an error in the list.
+func (l *List) Abort() {
+	errinsrc.Panic(l)
+}
+
+// SendToStream sends a GRPC command with this
+// full errlist
+//
+// If l is nil or empty, it sends a nil command
+// allowing the client to know that there are no
+// longer an error present
+func (l *List) SendToStream(stream interface {
+	Send(*daemonpb.CommandMessage) error
+}) error {
+	var bytes []byte
+	if l != nil && len(l.List) > 0 {
+		var err error
+		bytes, err = json.Marshal(l)
+		if err != nil {
+			panic("unable to marshal error list")
+		}
+	}
+	return stream.Send(
+		&daemonpb.CommandMessage{
+			Msg: &daemonpb.CommandMessage_Errors{
+				Errors: &daemonpb.CommandDisplayErrors{
+					Errinsrc: bytes,
+				},
+			},
+		},
+	)
+}
+
+// Print is a utility function that prints a list of errors to w,
+// one error per line, if the err parameter is an errorList. Otherwise
+// it prints the err string.
+func Print(w io.Writer, err error) {
+	if l, ok := err.(*List); ok {
+		for _, e := range l.List {
+			fmt.Fprintf(w, "%s\n", e)
+		}
+	} else if err != nil {
+		fmt.Fprintf(w, "%s\n", err)
+	}
+}
diff --git a/pkg/errors/locations.go b/pkg/errors/locations.go
new file mode 100644
index 0000000000..ab94d4602a
--- /dev/null
+++ b/pkg/errors/locations.go
@@ -0,0 +1,71 @@
+package errors
+
+import (
+	goAst "go/ast"
+	goToken "go/token"
+)
+
+// LocationType represents if the locaton is the source of the error, a warning or a helpful hint
+type LocationType uint8
+
+const (
+	LocError LocationType = iota
+	LocWarning
+	LocHelp
+)
+
+// LocationKind tells us what language and position markers we're using to identify the source
+type LocationKind uint8
+
+const (
+	LocFile LocationKind = iota
+	LocGoNode
+	LocGoPos
+	LocGoPositions
+)
+
+// SrcLocation tells us where in the code base caused the error, warning or is a hint to the end
+// user.
+type SrcLocation struct {
+	Kind            LocationKind
+	LocType         LocationType
+	Text            string
+	Filepath        string
+	GoNode          goAst.Node
+	GoStartPos      goToken.Pos
+	GoEndPos        goToken.Pos
+	GoStartPosition goToken.Position
+	GoEndPosition   goToken.Position
+}
+
+type LocationOption func(*SrcLocation)
+
+// AsError allows you to set a SrcLocation's error text
+//
+// Pass this option in when you give the error [Template] a src location
+func AsError(errorText string) func(loc *SrcLocation) {
+	return func(loc *SrcLocation) {
+		loc.Text = errorText
+		loc.LocType = LocError
+	}
+}
+
+// AsWarning allows you to set a SrcLocation's text and mark it as a warning
+//
+// Pass this option in when you give the error [Template] a src location
+func AsWarning(warningText string) func(loc *SrcLocation) {
+	return func(loc *SrcLocation) {
+		loc.Text = warningText
+		loc.LocType = LocWarning
+	}
+}
+
+// AsHelp allows you to set a SrcLocation's text and mark it as a helpful hint
+//
+// Pass this option in when you give the error [Template] a src location
+func AsHelp(helpText string) func(loc *SrcLocation) {
+	return func(loc *SrcLocation) {
+		loc.LocType = LocHelp
+		loc.Text = helpText
+	}
+}
diff --git a/pkg/errors/range.go b/pkg/errors/range.go
new file mode 100644
index 0000000000..55487fbe12
--- /dev/null
+++ b/pkg/errors/range.go
@@ -0,0 +1,91 @@
+package errors
+
+import (
+	"fmt"
+)
+
+var (
+	nextRangeStart = 1000
+)
+
+// Range creates a new error code range for a given module.
+func Range(
+	module string,
+	defaultDetails string,
+	options ...RangeOption,
+) *TemplateRange {
+	if nextRangeStart > 9999 {
+		// If we hit this, we need to increase the number of digits in the error code renderer
+		panic("too many error code ranges")
+	}
+
+	// Configure the range
+	cfg := &rangeConfig{
+		rangeSize: 100,
+	}
+	for _, c := range options {
+		c(cfg)
+	}
+
+	// Create the Range
+	rangeStart := nextRangeStart
+	nextRangeStart += cfg.rangeSize
+
+	return &TemplateRange{
+		module:         module,
+		defaultDetails: defaultDetails,
+		nextErrorCode:  rangeStart,
+		codeRangeEnd:   nextRangeStart,
+	}
+}
+
+type rangeConfig struct {
+	rangeSize int
+}
+
+type RangeOption func(*rangeConfig)
+
+// WithRangeSize sets the size of the range. The default is 100.
+func WithRangeSize(size int) RangeOption {
+	return func(cfg *rangeConfig) {
+		cfg.rangeSize = size
+	}
+}
+
+// TemplateRange is a helper for creating a range of error codes for a given module
+// and generating templates for those errors.
+type TemplateRange struct {
+	module         string
+	defaultDetails string
+	nextErrorCode  int
+	codeRangeEnd   int // Exclusive
+}
+
+// New creates a new template for an error in this range.
+func (r *TemplateRange) New(title, summary string, options ...TemplateOption) Template {
+	return r.Newf(title, summary, options...)()
+}
+
+// Newf creates a function to return a template for an error in this range where the summary is a format string.
+func (r *TemplateRange) Newf(title, summaryFmt string, options ...TemplateOption) func(summaryArgs ...any) Template {
+	if r.nextErrorCode >= r.codeRangeEnd {
+		panic("too many errors in range")
+	}
+	errorCode := r.nextErrorCode
+	r.nextErrorCode++
+
+	return func(summaryArgs ...any) Template {
+		tmp := Template{
+			Code:    errorCode,
+			Title:   title,
+			Summary: fmt.Sprintf(summaryFmt, summaryArgs...),
+			Detail:  r.defaultDetails,
+		}
+
+		for _, o := range options {
+			o(&tmp)
+		}
+
+		return tmp
+	}
+}
diff --git a/pkg/errors/template.go b/pkg/errors/template.go
new file mode 100644
index 0000000000..54c8b2b4db
--- /dev/null
+++ b/pkg/errors/template.go
@@ -0,0 +1,162 @@
+package errors
+
+import (
+	goAst "go/ast"
+	goToken "go/token"
+	"reflect"
+	"strings"
+)
+
+// Template represents a template for a new error.
+//
+// It itself is not an error, but can be used to initialize a new [errorinsrc.ErrInSrc].
+type Template struct {
+	Code               int
+	Title              string
+	Summary            string
+	Detail             string
+	Cause              error
+	Locations          []SrcLocation
+	AlwaysIncludeStack bool
+}
+
+// TemplateOption can be passed into the [Range] when creating a new Template
+type TemplateOption func(*Template)
+
+// AlwaysIncludeStack will setup a Template so it always includes a stack trace
+// even in a production build of Encore.
+func AlwaysIncludeStack() TemplateOption {
+	return func(template *Template) {
+		template.AlwaysIncludeStack = true
+	}
+}
+
+// WithDetails will setup a template so it uses a different details to the
+// range default
+func WithDetails(details string) TemplateOption {
+	return func(template *Template) {
+		template.Detail = details
+	}
+}
+
+// PrependDetails will setup a template so it prepends the given details to the
+// range default
+func PrependDetails(details string) TemplateOption {
+	return func(template *Template) {
+		if template.Detail != "" {
+			details = details + "\n\n" + template.Detail
+		}
+		template.Detail = details
+	}
+}
+
+// MarkAsInternalError will setup a template so it is reported as an internal error.
+//
+// This means that the error will be reported to the user as an internal error
+// with a link to the Encore issue tracker and will include a stack trace.
+func MarkAsInternalError() TemplateOption {
+	return func(template *Template) {
+		template.AlwaysIncludeStack = true
+		template.Title = "Internal Error: " + template.Title
+		template.Detail = "This is a bug in Encore and should not have occurred. Please report this issue to the " +
+			"Encore team either on Github at https://github.com/encoredev/encore/issues/new and include this error."
+	}
+}
+
+// WithDetails will replace the details of the template with the given details
+func (t Template) WithDetails(details string) Template {
+	t.Detail = details
+	return t
+}
+
+// Wrapping wraps the given error with the template.
+//
+// It will append the given error to the summary of the template
+// as well as setting the cause of the template to the given error.
+func (t Template) Wrapping(err error) Template {
+	if err == nil {
+		return t
+	}
+	t.Summary += "\n\n" + err.Error()
+	t.Summary = strings.TrimSpace(t.Summary)
+
+	t.Cause = err
+	return t
+}
+
+// atLocation is a helper method for the various with methods
+func (t Template) atLocation(location SrcLocation, options []LocationOption) Template {
+	for _, o := range options {
+		o(&location)
+	}
+	t.Locations = append([]SrcLocation{location}, t.Locations...)
+	return t
+}
+
+// InFile adds the given file as a src of the error location
+//
+// Note: It is preferable to use one of the other location functions
+// as they will render the source around the error, not just the file name
+func (t Template) InFile(filepath string, options ...LocationOption) Template {
+	if filepath == "" {
+		return t
+	}
+
+	return t.atLocation(SrcLocation{Kind: LocFile, Filepath: filepath}, options)
+}
+
+// AtGoNode adds the given Go node to the template. If the node is nil, nothing happens.
+//
+// You can use the [LocationOption]s to add additional information to the location.
+//
+// Example:
+//
+//	errMyErrorTemplate.AtGoNode(node, errtmp.AsHelp("this is where it was defined before"))
+func (t Template) AtGoNode(node goAst.Node, options ...LocationOption) Template {
+	if node == nil {
+		return t
+	}
+
+	// In some cases the node may be a "typed nil" which isn't caught by the check above.
+	// Handle that separately, as otherwise we get unexpected panics later when
+	// trying to call .Pos().
+	if v := reflect.ValueOf(node); v.Kind() == reflect.Pointer && v.IsNil() {
+		return t
+	}
+
+	return t.atLocation(SrcLocation{Kind: LocGoNode, GoNode: node}, options)
+}
+
+// AtGoPos adds the given start and end [token.Pos] to the template. If both positions are token.NoPos, nothing happens.
+// If one of the two positions are token.NoPos, the other position will be used.
+//
+// It is valid to use the same value for start and end positions, in which case the error will estimate which Node
+// you are referencing.
+//
+// Example:
+//
+//	errMyErrorTemplate.AtGoPos(start, token.NoPos, errtmp.AsHelp("this is where it was defined before"))
+func (t Template) AtGoPos(start, end goToken.Pos, options ...LocationOption) Template {
+	switch {
+	case start == goToken.NoPos && end == goToken.NoPos:
+		return t
+	case start == goToken.NoPos && end != goToken.NoPos:
+		start = end
+	case end == goToken.NoPos && start != goToken.NoPos:
+		end = start
+	}
+
+	return t.atLocation(SrcLocation{Kind: LocGoPos, GoStartPos: start, GoEndPos: end}, options)
+}
+
+// AtGoPosition adds the given Go positions to the template.
+//
+// It is valid to use the same value for start and end positions, in which case the error will estimate which Node
+// you are referencing.
+//
+// Example:
+//
+//	errMyErrorTemplate.AtGoPosition(start, end, errtmp.AsHelp("this is where it was defined before"))
+func (t Template) AtGoPosition(start, end goToken.Position, options ...LocationOption) Template {
+	return t.atLocation(SrcLocation{Kind: LocGoPositions, GoStartPosition: start, GoEndPosition: end}, options)
+}
diff --git a/pkg/errors/utils.go b/pkg/errors/utils.go
new file mode 100644
index 0000000000..ef01f80655
--- /dev/null
+++ b/pkg/errors/utils.go
@@ -0,0 +1,16 @@
+package errors
+
+import (
+	"go/ast"
+
+	"encr.dev/pkg/option"
+)
+
+// AtOptionalNode returns an error at the given node if it is present.
+// Otherwise, it returns the error unchanged.
+func AtOptionalNode[T ast.Node](err Template, opt option.Option[T]) Template {
+	if node, ok := opt.Get(); ok {
+		return err.AtGoNode(node)
+	}
+	return err
+}
diff --git a/pkg/fns/fns.go b/pkg/fns/fns.go
new file mode 100644
index 0000000000..3f4421be67
--- /dev/null
+++ b/pkg/fns/fns.go
@@ -0,0 +1,186 @@
+package fns
+
+import (
+	"cmp"
+	"context"
+	"io"
+	"maps"
+)
+
+// Map applies fn on all elements in src, producing a new slice
+// with the results, in order.
+func Map[A, B any](src []A, fn func(A) B) []B {
+	dst := make([]B, len(src))
+	for i, v := range src {
+		dst[i] = fn(v)
+	}
+	return dst
+}
+
+func Max[A any, B cmp.Ordered](src []A, fn func(A) B) B {
+	var m B
+	for _, v := range src {
+		if val := fn(v); m < val {
+			m = val
+		}
+	}
+	return m
+}
+
+// MapAndFilter applies fn on all elements in src, producing a new slice
+// with the results, in order. If fn returns false, the element is
+// not included in the result.
+func MapAndFilter[A, B any](src []A, fn func(A) (B, bool)) []B {
+	var dst []B
+	for _, v := range src {
+		if r, ok := fn(v); ok {
+			dst = append(dst, r)
+		}
+	}
+	return dst
+
+}
+
+// MapErr applies fn on all elements in src, producing a new slice
+// with the results, in order. If fn returns an error, MapErr
+// returns that error and the resulting slice is nil.
+func MapErr[A, B any](src []A, fn func(A) (B, error)) ([]B, error) {
+	dst := make([]B, len(src))
+	for i, v := range src {
+		var err error
+		dst[i], err = fn(v)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return dst, nil
+
+}
+
+// TransformMapKeys creates a new map with the same values as m, but with
+// the keys transformed by fn.
+func TransformMapKeys[K1, K2 comparable, V any](m map[K1]V, fn func(K1) K2) map[K2]V {
+	dst := make(map[K2]V, len(m))
+	for k, v := range m {
+		dst[fn(k)] = v
+	}
+	return dst
+}
+
+// Any returns true if any element in src satisfies the predicate.
+func Any[A any](src []A, pred func(A) bool) bool {
+	for _, v := range src {
+		if pred(v) {
+			return true
+		}
+	}
+	return false
+}
+
+// All returns true if all elements in src satisfy the predicate.
+func All[A any](src []A, pred func(A) bool) bool {
+	for _, v := range src {
+		if !pred(v) {
+			return false
+		}
+	}
+	return true
+}
+
+// FlatMap applies fn on all elements in src, producing a new slice
+// with the results, in order.
+func FlatMap[A, B any](src []A, fn func(A) []B) []B {
+	var dst []B
+	for _, v := range src {
+		dst = append(dst, fn(v)...)
+	}
+	return dst
+}
+
+// Find returns the first element where pred returns true.
+// The second argument is true if an element was found.
+func Find[A any](src []A, pred func(A) bool) (A, bool) {
+	for _, v := range src {
+		if pred(v) {
+			return v, true
+		}
+	}
+
+	var zero A
+	return zero, false
+}
+
+// Filter applies fn on all elements in src, producing a new slice
+// containing the elements for which fn returned true, preserving
+// the same order.
+func Filter[Elem any](src []Elem, fn func(Elem) bool) []Elem {
+	dst := make([]Elem, 0, len(src))
+	for _, v := range src {
+		if fn(v) {
+			dst = append(dst, v)
+		}
+	}
+	return dst
+}
+
+// ToMap converts a slice to a map.
+func ToMap[K comparable, V any](src []V, key func(V) K) map[K]V {
+	dst := make(map[K]V, len(src))
+	for _, v := range src {
+		dst[key(v)] = v
+	}
+	return dst
+}
+
+// TransformMapToSlice creates a new slice with the results of applying fn to each
+// key-value pair in m.
+func TransformMapToSlice[K comparable, V any, R any](m map[K]V, fn func(K, V) R) []R {
+	r := make([]R, 0, len(m))
+	for k, v := range m {
+		r = append(r, fn(k, v))
+	}
+	return r
+}
+
+// MapKeys returns the keys of the map m.
+// The keys will be in an indeterminate order.
+func MapKeys[M ~map[K]V, K comparable, V any](m M) []K {
+	r := make([]K, 0, len(m))
+	for k := range m {
+		r = append(r, k)
+	}
+	return r
+}
+
+// CloseIgnore closes c, ignoring any error.
+// Its main use is to satisfy linters.
+func CloseIgnore(c io.Closer) {
+	_ = c.Close()
+}
+
+func CloseIgnoreCtx(ctx context.Context, close func(ctx context.Context) error) {
+	_ = close(ctx)
+}
+
+// MergeMaps merges all maps into a single map.
+func MergeMaps[K comparable, V any](ms ...map[K]V) map[K]V {
+	var rtn map[K]V
+	for i, m := range ms {
+		if i == 0 {
+			rtn = m
+			continue
+		}
+		maps.Copy(rtn, m)
+	}
+	return rtn
+}
+
+func Delete[T comparable](slice []T, t T) ([]T, bool) {
+	for i, v := range slice {
+		if v == t {
+			slice = append(slice[:i], slice[i+1:]...)
+			return slice, true
+		}
+	}
+	return slice, false
+}
diff --git a/pkg/github/github.go b/pkg/github/github.go
new file mode 100644
index 0000000000..e170b97984
--- /dev/null
+++ b/pkg/github/github.go
@@ -0,0 +1,194 @@
+// Package github provides utilities for interacting with GitHub repositories.
+package github
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"os"
+	"path"
+	"path/filepath"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+)
+
+// Tree contains information about a (sub-)tree in a GitHub repository.
+type Tree struct {
+	Owner  string // GitHub owner (user or organization)
+	Repo   string // repository name
+	Branch string // branch name
+	Path   string // path to subtree ("." for whole project)
+}
+
+// Name reports a suitable name of the top-level directory in the tree.
+// It defaults to the repository name, unless a Path is given
+// in which case it is the last component of the path.
+func (t *Tree) Name() string {
+	if base := path.Base(t.Path); base != "." {
+		return base
+	}
+	return t.Repo
+}
+
+// ParseTree parses a GitHub repository URL into a Tree.
+//
+// Valid URLs are:
+// - github.com/owner/repo
+// - github.com/owner/repo/tree/<branch>
+// - github.com/owner/repo/tree/<branch>/<path>
+//
+// If the URL does not contain a branch, the default branch is queried
+// using GitHub's API.
+func ParseTree(ctx context.Context, s string) (*Tree, error) {
+	switch {
+	case strings.HasPrefix(s, "http"):
+		// Already an URL; do nothing
+	case strings.HasPrefix(s, "github.com"):
+		// Assume a URL without the scheme
+		s = "https://" + s
+	}
+
+	u, err := url.Parse(s)
+	if err != nil {
+		return nil, errors.Wrap(err, "invalid tree string")
+	}
+
+	if u.Host != "github.com" {
+		return nil, errors.Newf("url host must be github.com, not %q", u.Host)
+	}
+
+	// Path must be one of:
+	// "/owner/repo"
+	// "/owner/repo/tree/<branch>"
+	// "/owner/repo/tree/<branch>/path"
+	parts := strings.SplitN(u.Path, "/", 6)
+	switch {
+	case len(parts) == 3: // "/owner/repo"
+		owner, repo := parts[1], parts[2]
+		// Check the default branch
+		var resp struct {
+			DefaultBranch string `json:"default_branch"`
+		}
+		url := fmt.Sprintf("https://api.github.com/repos/%s/%s", owner, repo)
+		req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+		if err != nil {
+			return nil, errors.Wrap(err, "lookup default branch")
+		} else if err := slurpJSON(req, &resp); err != nil {
+			return nil, errors.Wrap(err, "lookup default branch")
+		}
+		return &Tree{
+			Owner:  owner,
+			Repo:   repo,
+			Branch: resp.DefaultBranch,
+			Path:   ".",
+		}, nil
+	case len(parts) >= 5: // "/owner/repo"
+		owner, repo, t, branch := parts[1], parts[2], parts[3], parts[4]
+		p := "."
+		if len(parts) == 6 {
+			p = parts[5]
+		}
+		if t != "tree" {
+			return nil, errors.Newf("invalid url: %s", u)
+		}
+		return &Tree{
+			Owner:  owner,
+			Repo:   repo,
+			Branch: branch,
+			Path:   p,
+		}, nil
+	default:
+		return nil, errors.Newf("unsupported url: %s", u)
+	}
+}
+
+func slurpJSON(req *http.Request, respData any) error {
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return errors.Wrap(err, "send request")
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 {
+		body, _ := io.ReadAll(resp.Body)
+		return errors.Newf("got non-200 response: %s: %s", resp.Status, body)
+	}
+	if err := json.NewDecoder(resp.Body).Decode(respData); err != nil {
+		return errors.Wrap(err, "decode response")
+	}
+	return nil
+}
+
+var ErrEmptyTree = errors.New("empty tree")
+
+// ExtractTree downloads a (sub-)tree from a GitHub repository and writes it to dst.
+func ExtractTree(ctx context.Context, tree *Tree, dst string) error {
+	url := fmt.Sprintf("https://codeload.github.com/%s/%s/tar.gz/%s", tree.Owner, tree.Repo, tree.Branch)
+	req, err := http.NewRequestWithContext(ctx, "GET", url, nil)
+	if err != nil {
+		return errors.Wrap(err, "create request")
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return errors.Wrap(err, "send request")
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != 200 {
+		return errors.Newf("GET %s: got non-200 response: %s", url, resp.Status)
+	}
+	gz, err := gzip.NewReader(resp.Body)
+	if err != nil {
+		return errors.Wrap(err, "read gzip response")
+	}
+	defer gz.Close()
+	tr := tar.NewReader(gz)
+
+	prefix := path.Join(tree.Repo+"-"+tree.Branch, tree.Path)
+	prefix += "/"
+	files := 0
+
+	for {
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			if files == 0 {
+				return ErrEmptyTree
+			}
+			return nil
+		} else if err != nil {
+			return errors.Wrap(err, "read repository data")
+		}
+		if hdr.FileInfo().IsDir() {
+			continue
+		}
+		if p := path.Clean(hdr.Name); strings.HasPrefix(p, prefix) {
+			files++
+			p = p[len(prefix):]
+			filePath := filepath.Join(dst, filepath.FromSlash(p))
+			if err := createFile(tr, filePath); err != nil {
+				return errors.Wrapf(err, "create %s", p)
+			}
+		}
+	}
+}
+
+// createFile creates the given file, creating any non-existent parent directories
+// in the process. It returns an error if the file already exists.
+func createFile(src io.Reader, dst string) error {
+	if err := os.MkdirAll(filepath.Dir(dst), 0755); err != nil {
+		return err
+	}
+	f, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0644)
+	if err != nil {
+		return err
+	}
+	_, err = io.Copy(f, src)
+	if err2 := f.Close(); err == nil {
+		err = err2
+	}
+	return err
+}
diff --git a/pkg/golden/golden.go b/pkg/golden/golden.go
new file mode 100644
index 0000000000..8250e33007
--- /dev/null
+++ b/pkg/golden/golden.go
@@ -0,0 +1,72 @@
+package golden
+
+import (
+	"flag"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+var (
+	update      bool // should we update golden files?
+	testMainRan bool // did TestMain get called?
+)
+
+// Test checks the test output against the golden file where the path to the golden file is
+// based on the test name; i.e. `testName.golden` within the `testdata` folder.
+// If -golden-update was passed to "go test", it writes new golden files instead.
+func Test(t testing.TB, output string) {
+	fn := strings.Replace(t.Name(), "/", "__", -1)
+	TestAgainst(t, fn+".golden", output)
+}
+
+// TestAgainst checks the test output against the golden file.
+// If -golden-update was passed to "go test", it writes new golden files instead.
+func TestAgainst(t testing.TB, goldenFileName string, output string) {
+	if !testMainRan {
+		t.Fatal("golden.TestMain was not called")
+	}
+	wd, err := os.Getwd()
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(wd, "testdata", goldenFileName)
+
+	if update {
+		if err := os.MkdirAll(filepath.Dir(path), 0755); err != nil {
+			t.Fatalf("update golden: %v", err)
+		}
+		err := os.WriteFile(path, []byte(output), 0644)
+		if err != nil {
+			t.Fatalf("update golden: %v", err)
+		}
+	} else {
+		expect, err := os.ReadFile(path)
+		if err != nil {
+			t.Fatalf("read golden: %v", err)
+		}
+		if diff := cmp.Diff(string(expect), output); diff != "" {
+			t.Fatalf("bad output (-want +got):\n%s", diff)
+		}
+	}
+}
+
+// TestMain sets up the golden testing functionality for the package.
+// Packages that want to integrate golden testing should themselves
+// implement TestMain and call this function.
+func TestMain(m *testing.M) {
+	Setup()
+	os.Exit(m.Run())
+}
+
+// Setup sets up the golden testing functionality for the package.
+// It can be called instead of TestMain if a package wants to do multiple
+// main function handling.
+func Setup() {
+	flag.BoolVar(&update, "golden-update", os.Getenv("GOLDEN_UPDATE") != "", "update golden files")
+	flag.Parse()
+	testMainRan = true
+}
diff --git a/pkg/idents/identifiers.go b/pkg/idents/identifiers.go
new file mode 100644
index 0000000000..a4a7a8e177
--- /dev/null
+++ b/pkg/idents/identifiers.go
@@ -0,0 +1,163 @@
+package idents
+
+import (
+	"strings"
+	"unicode"
+)
+
+type IdentFormat int
+
+const (
+	CamelCase          IdentFormat = iota // camelCase
+	PascalCase                            // PascalCase
+	SnakeCase                             // snake_case
+	ScreamingSnakeCase                    // SCREAMING_SNAKE_CASE
+	KebabCase                             // kebab-case
+)
+
+// Convert will take a given identifier and convert it to the
+// specified format.
+func Convert(goIdentifier string, format IdentFormat) string {
+	parts := parseIdentifier(goIdentifier)
+
+	// Step 1: convert case
+	for i, part := range parts {
+		switch format {
+		case CamelCase:
+			if i == 0 {
+				parts[i] = strings.ToLower(part)
+			} else {
+				parts[i] = strings.Title(part)
+			}
+
+		case PascalCase:
+			parts[i] = strings.Title(part)
+
+		case SnakeCase, KebabCase:
+			parts[i] = strings.ToLower(part)
+
+		case ScreamingSnakeCase:
+			parts[i] = strings.ToUpper(part)
+		}
+	}
+
+	// Step 2: Join Parts
+	switch format {
+	case CamelCase, PascalCase:
+		return strings.Join(parts, "")
+	case SnakeCase, ScreamingSnakeCase:
+		return strings.Join(parts, "_")
+	case KebabCase:
+		return strings.Join(parts, "-")
+	default:
+		panic("unknown identifier format")
+	}
+}
+
+// parseIdentifier parses a Go Identifier into the separate parts.
+// which can then be recombined as needed.
+func parseIdentifier(goIdentifier string) (parts []string) {
+	if goIdentifier == "" {
+		return nil
+	}
+
+	type runeType int
+	const (
+		other runeType = iota
+		upper
+		lower
+	)
+
+	runeToType := func(r rune, lastType runeType) runeType {
+		switch {
+		case unicode.IsUpper(r):
+			return upper
+		case unicode.IsLower(r):
+			return lower
+		case unicode.IsDigit(r):
+			if lastType == other {
+				return lower
+			}
+			return lastType
+		default:
+			return other
+		}
+	}
+
+	var str strings.Builder
+	recordPart := func() {
+		part := str.String()
+		str.Reset()
+		if part == "" {
+			return
+		}
+
+		if !stringIsOnly(part, unicode.IsUpper) {
+			// strings will always start with uppercase runes, so the if
+			// the last uppercase rune is after index 0 but before the last
+			// rune in the string, then we need to split it into two parts.
+			//
+			// i.e. "GetAPIDocs" => { "Get", "APIDocs" } => { "Get", "API", "Docs" }
+			lastUpperCase := strings.LastIndexFunc(part, unicode.IsUpper)
+			if lastUpperCase > 0 && lastUpperCase != len(part)-1 {
+				parts = append(parts, part[:lastUpperCase])
+				part = part[lastUpperCase:]
+			}
+
+			part = strings.ToLower(part)
+		}
+
+		parts = append(parts, part)
+	}
+
+	lastType := runeToType(rune(goIdentifier[0]), other)
+	for _, r := range goIdentifier {
+		runeType := runeToType(r, lastType)
+
+		// If the type of rune has changed
+		if lastType > runeType {
+			recordPart()
+		}
+		lastType = runeType
+
+		if runeType != other {
+			str.WriteRune(r)
+		}
+	}
+
+	recordPart()
+	return
+}
+
+func stringIsOnly(str string, predicate func(r rune) bool) bool {
+	for _, r := range str {
+		if !predicate(r) {
+			return false
+		}
+	}
+	return true
+}
+
+// GenerateSuggestion creates a suggestion for an identifier in the given format
+// from the given input string.
+func GenerateSuggestion(input string, format IdentFormat) string {
+	// Clean the string up first and remove unsupported characters
+	input = strings.TrimSpace(input)
+	input = strings.Map(func(r rune) rune {
+		if unicode.IsLetter(r) || unicode.IsDigit(r) || unicode.IsSpace(r) || r == '_' || r == '-' {
+			return r
+		}
+		return -1
+	}, input)
+
+	// Remove any leading or trailing characters which are not letters
+	input = strings.TrimLeftFunc(input, func(r rune) bool {
+		return !unicode.IsLetter(r)
+	})
+	input = strings.TrimRightFunc(input, func(r rune) bool {
+		return !unicode.IsLetter(r)
+	})
+
+	// Now convert the cleaned input into the desired format
+	return Convert(input, format)
+}
diff --git a/pkg/idents/identifiers_test.go b/pkg/idents/identifiers_test.go
new file mode 100644
index 0000000000..257aec66db
--- /dev/null
+++ b/pkg/idents/identifiers_test.go
@@ -0,0 +1,73 @@
+package idents
+
+import (
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+)
+
+func Test_parseIdentifier(t *testing.T) {
+	c := qt.New(t)
+	c.Parallel()
+
+	tests := []struct {
+		input  string
+		expect []string
+	}{
+		{"hello", []string{"hello"}},
+		{"Hello", []string{"hello"}},
+		{"HelloWorld", []string{"hello", "world"}},
+		{"hello_world", []string{"hello", "world"}},
+		{"Hello_World", []string{"hello", "world"}},
+		{"_Hello___World__", []string{"hello", "world"}},
+		{"RenderMarkdown", []string{"render", "markdown"}},
+		{"RenderHTML", []string{"render", "HTML"}},
+		{"getVersion2", []string{"get", "version2"}},
+		{"GetAPIDocs", []string{"get", "API", "docs"}},
+		{"EncoreResource-123abc", []string{"encore", "resource", "123abc"}},
+		{"EncoreResource-abs-123", []string{"encore", "resource", "abs", "123"}},
+		{"This is a full sentence... with \"random! bits-and_pieces123 blah", []string{"this", "is", "a", "full", "sentence", "with", "random", "bits", "and", "pieces123", "blah"}},
+	}
+	for _, tt := range tests {
+		tt := tt
+		c.Run(tt.input, func(c *qt.C) {
+			c.Parallel()
+
+			gotParts := parseIdentifier(tt.input)
+			c.Assert(gotParts, qt.DeepEquals, tt.expect)
+		})
+	}
+}
+
+func Test_convertIdentifierTo(t *testing.T) {
+	c := qt.New(t)
+	c.Parallel()
+	type args struct {
+		input              string
+		camelCase          string
+		pascalCase         string
+		snakeCase          string
+		screamingSnakeCase string
+		kebabCase          string
+	}
+	tests := []args{
+		{"Hello", "hello", "Hello", "hello", "HELLO", "hello"},
+		{"HelloWorld", "helloWorld", "HelloWorld", "hello_world", "HELLO_WORLD", "hello-world"},
+		{"getVersion2", "getVersion2", "GetVersion2", "get_version2", "GET_VERSION2", "get-version2"},
+		{"GetAPIDocs", "getAPIDocs", "GetAPIDocs", "get_api_docs", "GET_API_DOCS", "get-api-docs"},
+		{"EncoreResource-123abc", "encoreResource123abc", "EncoreResource123abc", "encore_resource_123abc", "ENCORE_RESOURCE_123ABC", "encore-resource-123abc"},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		c.Run(tt.input, func(c *qt.C) {
+			c.Parallel()
+
+			c.Assert(Convert(tt.input, CamelCase), qt.Equals, tt.camelCase)
+			c.Assert(Convert(tt.input, PascalCase), qt.Equals, tt.pascalCase)
+			c.Assert(Convert(tt.input, SnakeCase), qt.Equals, tt.snakeCase)
+			c.Assert(Convert(tt.input, ScreamingSnakeCase), qt.Equals, tt.screamingSnakeCase)
+			c.Assert(Convert(tt.input, KebabCase), qt.Equals, tt.kebabCase)
+		})
+	}
+}
diff --git a/pkg/jsonext/listencoder.go b/pkg/jsonext/listencoder.go
new file mode 100644
index 0000000000..52d96731de
--- /dev/null
+++ b/pkg/jsonext/listencoder.go
@@ -0,0 +1,46 @@
+package jsonext
+
+import (
+	"reflect"
+	"unsafe"
+
+	jsoniter "github.com/json-iterator/go"
+	"github.com/modern-go/reflect2"
+)
+
+type ListEncoderExtension struct {
+	jsoniter.DummyExtension
+}
+
+func NewListEncoderExtension() *ListEncoderExtension {
+	return &ListEncoderExtension{}
+}
+
+func (e *ListEncoderExtension) DecorateEncoder(typ reflect2.Type, encoder jsoniter.ValEncoder) jsoniter.ValEncoder {
+	if typ.Kind() == reflect.Slice {
+		return &sliceEncoder{typ: typ, encoder: encoder}
+	}
+	return encoder
+}
+
+type sliceEncoder struct {
+	typ     reflect2.Type
+	encoder jsoniter.ValEncoder
+}
+
+func (codec *sliceEncoder) IsEmpty(ptr unsafe.Pointer) bool {
+	return codec.encoder.IsEmpty(ptr)
+}
+
+func (codec *sliceEncoder) Encode(ptr unsafe.Pointer, stream *jsoniter.Stream) {
+	if codec.IsEmpty(ptr) {
+		if codec.typ.Type1().Elem().Kind() == reflect.Uint8 {
+			stream.WriteString("")
+		} else {
+			stream.WriteEmptyArray()
+		}
+		return
+	}
+
+	codec.encoder.Encode(ptr, stream)
+}
diff --git a/pkg/jsonext/listencoder_test.go b/pkg/jsonext/listencoder_test.go
new file mode 100644
index 0000000000..e814587488
--- /dev/null
+++ b/pkg/jsonext/listencoder_test.go
@@ -0,0 +1,32 @@
+package jsonext
+
+import (
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	jsoniter "github.com/json-iterator/go"
+)
+
+func TestListEncoder(t *testing.T) {
+	c := qt.New(t)
+
+	jsoniterAPI := jsoniter.Config{SortMapKeys: true}.Froze()
+	jsoniterAPI.RegisterExtension(NewListEncoderExtension())
+	marshal, err := jsoniterAPI.Marshal(struct {
+		StringList    []string `json:",omitempty"`
+		IntList       []string
+		FloatList     []float64
+		NilBytes      []byte
+		EmptyBytes    []byte
+		SomeBytes     []byte
+		StringPointer *string
+		ZeroArray     [0]int
+	}{
+		FloatList:  []float64{1.0, 2.0, 3.0},
+		NilBytes:   nil,
+		EmptyBytes: []byte{},
+		SomeBytes:  []byte("foobar"),
+	})
+	c.Assert(err, qt.IsNil)
+	c.Assert(string(marshal), qt.Equals, `{"IntList":[],"FloatList":[1,2,3],"NilBytes":"","EmptyBytes":"","SomeBytes":"Zm9vYmFy","StringPointer":null,"ZeroArray":[]}`)
+}
diff --git a/pkg/jsonext/protojson.go b/pkg/jsonext/protojson.go
new file mode 100644
index 0000000000..2862964315
--- /dev/null
+++ b/pkg/jsonext/protojson.go
@@ -0,0 +1,69 @@
+package jsonext
+
+import (
+	"unsafe"
+
+	jsoniter "github.com/json-iterator/go"
+	"github.com/modern-go/reflect2"
+	"google.golang.org/protobuf/encoding/protojson"
+	"google.golang.org/protobuf/proto"
+)
+
+type ProtoEncoderExtension struct {
+	jsoniter.DummyExtension
+	messageType reflect2.Type
+	opts        protojson.MarshalOptions
+}
+
+func NewProtoEncoderExtension() *ProtoEncoderExtension {
+	msgType := reflect2.TypeOfPtr((*proto.Message)(nil)).Elem()
+	opts := protojson.MarshalOptions{
+		UseProtoNames:   true,
+		EmitUnpopulated: true,
+	}
+	return &ProtoEncoderExtension{
+		messageType: msgType,
+		opts:        opts,
+	}
+}
+
+func (e *ProtoEncoderExtension) DecorateEncoder(typ reflect2.Type, encoder jsoniter.ValEncoder) jsoniter.ValEncoder {
+	if typ.Implements(e.messageType) {
+		return &messageEncoder{typ: typ, encoder: encoder, opts: e.opts}
+	}
+	return encoder
+}
+
+type messageEncoder struct {
+	typ     reflect2.Type
+	encoder jsoniter.ValEncoder
+	opts    protojson.MarshalOptions
+}
+
+func (codec *messageEncoder) IsEmpty(ptr unsafe.Pointer) bool {
+	return codec.encoder.IsEmpty(ptr)
+}
+
+func (codec *messageEncoder) Encode(ptr unsafe.Pointer, stream *jsoniter.Stream) {
+	if msg, ok := codec.typ.UnsafeIndirect(ptr).(proto.Message); ok {
+		data, err := codec.opts.Marshal(msg)
+		if err != nil {
+			if stream.Error == nil {
+				stream.Error = err
+			}
+		} else {
+			stream.Write(data)
+		}
+		return
+	}
+	codec.encoder.Encode(ptr, stream)
+}
+
+var ProtoEncoder = (func() jsoniter.API {
+	enc := jsoniter.Config{}.Froze()
+	// Note: the order is important. We don't want the list encoder to process repeated fields in proto
+	// messages, so it must come first so it only applies to non-protobuf slices.
+	enc.RegisterExtension(NewListEncoderExtension())
+	enc.RegisterExtension(NewProtoEncoderExtension())
+	return enc
+})()
diff --git a/pkg/logging/zerolog_adapter.go b/pkg/logging/zerolog_adapter.go
new file mode 100644
index 0000000000..6c5175324a
--- /dev/null
+++ b/pkg/logging/zerolog_adapter.go
@@ -0,0 +1,23 @@
+package logging
+
+import (
+	"log"
+
+	"github.com/rs/zerolog"
+)
+
+type zeroLogWriter struct {
+	logger zerolog.Logger
+	level  zerolog.Level
+}
+
+func (z *zeroLogWriter) Write(p []byte) (n int, err error) {
+	z.logger.WithLevel(z.level).CallerSkipFrame(3).Msg(string(p))
+	return len(p), nil
+}
+
+// NewZeroLogAdapter returns a new log.Logger that writes to the given zerolog.Logger at the given level.
+func NewZeroLogAdapter(logger zerolog.Logger, level zerolog.Level) *log.Logger {
+	zlw := &zeroLogWriter{logger, level}
+	return log.New(zlw, "", 0)
+}
diff --git a/pkg/make-release/compilers.go b/pkg/make-release/compilers.go
new file mode 100644
index 0000000000..412c16eb64
--- /dev/null
+++ b/pkg/make-release/compilers.go
@@ -0,0 +1,259 @@
+package main
+
+import (
+	osPkg "os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+
+	"github.com/cockroachdb/errors"
+)
+
+// MacOSSDKPath is the path to where the MacOS SDK is located on Encore's builder systems
+const MacOSSDKPath = "/sdk"
+
+func GoBaseEnvs(os string, arch string) ([]string, error) {
+	// Create a cache dir for the go build cache for this specific OS and architecture pair
+	cacheDir, err := osPkg.UserCacheDir()
+	if err != nil {
+		return nil, errors.Wrap(err, "user cache dir")
+	}
+
+	path := filepath.Join(cacheDir, "encore-build-cache", "go", os, arch)
+
+	err = osPkg.MkdirAll(path, 0755)
+	if err != nil {
+		return nil, errors.Wrap(err, "failed to make cache dir")
+	}
+
+	return append(osPkg.Environ(),
+		"GOOS="+os,
+		"GOARCH="+arch,
+		"GOCACHE="+path,
+	), nil
+}
+
+// CompileGoBinary compiles a Go binary for the given OS and architecture with GCP enabled
+//
+// This file was inspired by the blog post: https://lucor.dev/post/cross-compile-golang-fyne-project-using-zig/
+func CompileGoBinary(outputPath string, entrypointPkg string, ldFlags []string, os string, arch string) error {
+	cc, cxx, compilerEnvs, compilerLDFlags, err := compilerSettings(os, arch)
+	if err != nil {
+		return errors.Wrap(err, "compiler settings")
+	}
+
+	if os == "windows" {
+		outputPath += ".exe"
+	}
+
+	combinedLDFlags := append(append([]string{}, compilerLDFlags...), ldFlags...)
+
+	baseEnvs, err := GoBaseEnvs(os, arch)
+	if err != nil {
+		return errors.Wrap(err, "go base envs")
+	}
+
+	envs := append(baseEnvs,
+		"CGO_ENABLED=1",
+		"CC="+cc,
+		"CXX="+cxx,
+	)
+	envs = append(envs, compilerEnvs...)
+
+	// Build the go build args
+	args := []string{"build",
+		"-trimpath",
+		"-tags", "netgo", // Always force netgo otherwise we end up with segfaults on MacOS
+	}
+	if len(combinedLDFlags) > 0 {
+		args = append(args, "-ldflags="+strings.Join(combinedLDFlags, " "))
+	}
+	if os == "darwin" {
+		args = append(args, "-buildmode=pie")
+	}
+	args = append(args,
+		"-o", outputPath,
+		entrypointPkg,
+	)
+
+	// Build the command
+	cmd := exec.Command("go", args...)
+	cmd.Env = envs
+
+	// nosemgrep
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return errors.Newf("failed to compile go binary: %s", string(out))
+	}
+
+	return nil
+}
+
+// CompileRustBinary compiles a Rust binary for the given OS and architecture
+//
+// We're using zigbuild to perform easy cross compiling
+func CompileRustBinary(artifactPath, outputPath string, cratePath string, os string, arch string, extraEnvVars ...string) error {
+	if os == "windows" {
+		if !strings.HasSuffix(artifactPath, ".dll") {
+			outputPath += ".exe"
+			artifactPath += ".exe"
+		}
+	}
+
+	envs := append(extraEnvVars, osPkg.Environ()...)
+
+	var target string
+	switch os {
+	case "darwin":
+		switch arch {
+		case "amd64":
+			target = "x86_64-apple-darwin"
+		case "arm64":
+			target = "aarch64-apple-darwin"
+		default:
+			return errors.New("unsupported architecture for darwin: " + arch)
+		}
+
+		// We need to set the SDKROOT for cross compiling to MacOS
+		if runtime.GOOS != "darwin" {
+			envs = append(envs,
+				"SDKROOT="+MacOSSDKPath,
+			)
+		}
+
+	case "linux":
+		switch arch {
+		case "amd64":
+			target = "x86_64-unknown-linux-gnu"
+		case "arm64":
+			target = "aarch64-unknown-linux-gnu"
+		default:
+			return errors.New("unsupported architecture for linux: " + arch)
+		}
+
+	case "windows":
+		switch arch {
+		case "amd64":
+			target = "x86_64-pc-windows-gnu"
+		default:
+			return errors.New("unsupported architecture for windows: " + arch)
+		}
+
+	default:
+		return errors.New("unsupported os: " + os)
+	}
+
+	// Create a cache dir for the go build cache for this specific OS and architecture pair
+	cacheDir, err := osPkg.UserCacheDir()
+	if err != nil {
+		return errors.Wrap(err, "user cache dir")
+	}
+
+	path := filepath.Join(cacheDir, "encore-build-cache", "rust", os, arch)
+
+	err = osPkg.MkdirAll(path, 0755)
+	if err != nil {
+		return errors.Wrap(err, "failed to make cache dir")
+	}
+
+	// Build the command
+	cargoArgs := []string{"zigbuild",
+		"--target", target,
+		"--target-dir", path,
+		"--release",
+	}
+
+	cmd := exec.Command("cargo", cargoArgs...)
+	cmd.Dir = cratePath
+	cmd.Env = envs
+
+	// Cargo can't run multiple compiles at the same time for the same crate
+	// so let's lock here, then unlock once the compile has finished
+	cargoLock.Lock()
+	defer cargoLock.Unlock()
+
+	// nosemgrep
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return errors.Newf("failed to compile rust binary: %v - %s", err, string(out))
+	}
+
+	// Copy the binary to the output path
+	binaryFile := filepath.Join(path, target, "release", artifactPath)
+	cmd = exec.Command("cp", binaryFile, outputPath)
+	// nosemgrep
+	out, err = cmd.CombinedOutput()
+	if err != nil {
+		return errors.Newf("failed to copy rust binary: %v - %s", err, string(out))
+	}
+
+	return nil
+}
+
+// compilerSettings returns the CC and CXX settings for the given OS and architecture
+func compilerSettings(os string, arch string) (cc, cxx string, envs, ldFlags []string, err error) {
+	var zigTarget string
+	var zigArgs string
+	zigBinary := "zig" // pick it up off the path
+
+	switch os {
+	case "darwin":
+		zigBinary = "/usr/local/zig-0.9.1/zig" // We need an explicit version of Zig for darwin (0.11.0 compiles, build causes runtime errors)
+		ldFlags = []string{"-s", "-w"}
+
+		switch arch {
+		case "amd64":
+			zigTarget = "x86_64-macos.10.12"
+		case "arm64":
+			zigTarget = "aarch64-macos.11.1"
+		default:
+			return "", "", nil, nil, errors.New("unsupported architecture for darwin: " + arch)
+		}
+
+		// We need to set some extra stuff if we're cross compiling to MacOS
+		if runtime.GOOS != "darwin" {
+			zigArgs = " -isysroot " + MacOSSDKPath + " -iwithsysroot /usr/include -iframeworkwithsysroot /System/Library/Frameworks"
+			envs = []string{
+				"CGO_LDFLAGS=--sysroot " + MacOSSDKPath + " -F/System/Library/Frameworks -L/usr/lib",
+			}
+		}
+
+	case "linux":
+		switch arch {
+		case "amd64":
+			zigTarget = "x86_64-linux-gnu" // Note: we're not targeting a specific glibc version here as we tried before with 2.35 - but for some reason we still get runtime errors not finding 2.34 or 2.33 on WSL (which had 2.35)
+			zigArgs = " -static -isystem /usr/include"
+		case "arm64":
+			zigTarget = "aarch64-linux-gnu"
+			zigArgs = " -static -isystem /usr/include"
+			envs = []string{
+				"PKG_CONFIG_LIBDIR=/usr/lib/aarch64-linux-gnu/pkgconfig",
+			}
+		default:
+			return "", "", nil, nil, errors.New("unsupported architecture for linux: " + arch)
+		}
+
+	case "windows":
+		switch arch {
+		case "amd64":
+			zigTarget = "x86_64-windows-gnu"
+		default:
+			return "", "", nil, nil, errors.New("unsupported architecture for windows: " + arch)
+		}
+
+		ldFlags = []string{"-H=windowsgui"}
+
+	default:
+		return "", "", nil, nil, errors.New("unsupported os: " + os)
+	}
+
+	cc = zigBinary + " cc -target " + zigTarget + zigArgs
+	cxx = zigBinary + " c++ -target " + zigTarget + zigArgs
+	return cc, cxx, envs, ldFlags, nil
+}
+
+var (
+	cargoLock sync.Mutex
+)
diff --git a/pkg/make-release/dist_builder.go b/pkg/make-release/dist_builder.go
new file mode 100644
index 0000000000..82ddcf1295
--- /dev/null
+++ b/pkg/make-release/dist_builder.go
@@ -0,0 +1,326 @@
+package main
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sync"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/internal/version"
+)
+
+// A DistBuilder is a builder for a specific distribution of Encore.
+//
+// Anything which does not need to be built for a specific distribution
+// should be built in the main builder before these are invoked.
+//
+// Make release will run multiple of these in parallel to build all the
+// distributions.
+type DistBuilder struct {
+	log              zerolog.Logger
+	OS               string      // The OS to build for
+	Arch             string      // The architecture to build for
+	TSParserPath     string      // The path to the ts-parser repo
+	DistBuildDir     string      // The directory to build into
+	ArtifactsTarFile string      // The directory to put the final tar.gz artifact into
+	Version          string      // The version to build
+	jsBuilder        *JSPackager // The JS builder
+}
+
+func (d *DistBuilder) buildEncoreCLI() error {
+	// Build the CLI binaries.
+	d.log.Info().Msg("building encore binary...")
+
+	linkerOpts := []string{
+		"-X", fmt.Sprintf("'encr.dev/internal/version.Version=%s'", d.Version),
+	}
+
+	// If we're building a nightly, devel or beta version, we need to set the default config directory
+	var versionSuffix string
+	switch version.ChannelFor(d.Version) {
+	case version.GA:
+		versionSuffix = ""
+	case version.Beta:
+		versionSuffix = "-beta"
+	case version.Nightly:
+		versionSuffix = "-nightly"
+	case version.DevBuild:
+		versionSuffix = "-develop"
+	default:
+		return errors.Newf("unknown version channel for %s", d.Version)
+	}
+
+	if versionSuffix != "" {
+		linkerOpts = append(linkerOpts,
+			"-X", "'encr.dev/internal/conf.defaultConfigDirectory=encore"+versionSuffix+"'",
+		)
+	}
+
+	err := CompileGoBinary(
+		join(d.DistBuildDir, "bin", "encore"+versionSuffix),
+		"./cli/cmd/encore",
+		linkerOpts,
+		d.OS,
+		d.Arch,
+	)
+	if err != nil {
+		d.log.Err(err).Msg("encore failed to build")
+		return errors.Wrap(err, "compile encore")
+	}
+	d.log.Info().Msg("encore built successfully")
+	return nil
+}
+
+func (d *DistBuilder) buildGitHook() error {
+	// Build the git-remote-encore binary.
+	d.log.Info().Msg("building git-remote-encore binary...")
+	err := CompileGoBinary(
+		join(d.DistBuildDir, "bin", "git-remote-encore"),
+		"./cli/cmd/git-remote-encore",
+		nil,
+		d.OS,
+		d.Arch,
+	)
+	if err != nil {
+		d.log.Err(err).Msg("git-remote-encore failed to build")
+		return errors.Wrap(err, "compile git-remote-encore")
+	}
+	d.log.Info().Msg("git-remote-encore built successfully")
+	return nil
+}
+
+func (d *DistBuilder) buildTSBundler() error {
+	// Build the TS bundler.
+	d.log.Info().Msg("building tsbundler binary...")
+
+	linkerOpts := []string{
+		"-X", fmt.Sprintf("'encr.dev/internal/version.Version=%s'", d.Version),
+	}
+
+	err := CompileGoBinary(
+		join(d.DistBuildDir, "bin", "tsbundler-encore"),
+		"./cli/cmd/tsbundler-encore",
+		linkerOpts,
+		d.OS,
+		d.Arch,
+	)
+	if err != nil {
+		d.log.Err(err).Msg("tsbundler failed to build")
+		return errors.Wrap(err, "compile tsbundler")
+	}
+	d.log.Info().Msg("tsbundler built successfully")
+	return nil
+}
+
+func (d *DistBuilder) buildTSParser() error {
+	// Build the TS parser.
+	d.log.Info().Msg("building ts-parser binary...")
+	err := CompileRustBinary(
+		"tsparser-encore",
+		join(d.DistBuildDir, "bin", "tsparser-encore"),
+		d.TSParserPath,
+		d.OS,
+		d.Arch,
+		fmt.Sprintf("ENCORE_VERSION=%s", d.Version),
+	)
+	if err != nil {
+		d.log.Err(err).Msg("ts-parser failed to build")
+		return errors.Wrap(err, "compile ts-parser")
+	}
+	d.log.Info().Msg("ts-parser built successfully")
+	return nil
+}
+
+func (d *DistBuilder) buildNodePlugin() error {
+	d.log.Info().Msg("building node plugin...")
+
+	// Figure out the names of the compiled and target binaries.
+	compiledBinaryName, err := func() (string, error) {
+		switch d.OS {
+		case "darwin":
+			return "libencore_js_runtime.dylib", nil
+		case "linux":
+			return "libencore_js_runtime.so", nil
+		case "windows":
+			return "encore_js_runtime.dll", nil
+		default:
+			return "", errors.Newf("unknown OS: %s", d.OS)
+		}
+	}()
+	if err != nil {
+		d.log.Err(err).Msg("node plugin failed to build")
+		return errors.Wrap(err, "compile node plugin")
+	}
+
+	d.log.Info().Msg("Patching jscore/api/version.cjs...")
+	err = os.WriteFile(
+		filepath.Join(".", "runtimes", "jscore", "api", "version.cjs"),
+		[]byte(`// Code generated by /pkg/make-release. DO NOT EDIT.
+
+/**
+ * The version of the runtime this JS bundle was built for
+ */
+module.exports.version = "`+d.Version+`";
+`),
+		0644,
+	)
+	if err != nil {
+		d.log.Err(err).Msg("failed to patch version.cjs")
+		return errors.Wrap(err, "write patch version.cjs")
+	}
+
+	// Build the node plugin.
+	err = CompileRustBinary(
+		compiledBinaryName,
+		join(d.DistBuildDir, "bin", "encore-runtime.node"),
+		"./runtimes/jscore",
+		d.OS,
+		d.Arch,
+		fmt.Sprintf("ENCORE_VERSION=%s", d.Version),
+	)
+	if err != nil {
+		d.log.Err(err).Msg("node plugin failed to build")
+		return errors.Wrap(err, "compile node plugin")
+	}
+	d.log.Info().Msg("node plugin built successfully")
+	return nil
+}
+
+func (d *DistBuilder) downloadEncoreGo() error {
+	// Step 1: Find out the latest release version for Encore's Go distribution
+	d.log.Info().Msg("downloading latest encore-go...")
+	encoreGoArchive, err := downloadLatestGithubRelease("encoredev", "go", d.OS, d.Arch)
+	if err != nil {
+		d.log.Err(err).Msg("failed to download encore-go")
+		return errors.Wrap(err, "download encore-go")
+	}
+
+	d.log.Info().Msg("extracting encore-go...")
+	err = extractArchive(encoreGoArchive, d.DistBuildDir)
+	if err != nil {
+		d.log.Err(err).Msg("failed to extract encore-go")
+		return errors.Wrap(err, "extract encore-go")
+	}
+
+	d.log.Info().Msg("encore-go extracted successfully")
+	return nil
+}
+
+func (d *DistBuilder) copyEncoreRuntimeForGo() error {
+	d.log.Info().Msg("copying encore runtime for Go...")
+	cmd := exec.Command("cp", "-r", "runtimes/go/.", join(d.DistBuildDir, "runtimes", "go")+"/")
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		d.log.Err(err).Str("stderr", string(out)).Msg("encore runtime for go failed to be copied")
+		return errors.Wrapf(err, "cp go runtime: %s", out)
+	}
+	d.log.Info().Msg("encore runtime for go copied successfully")
+	return nil
+}
+
+func (d *DistBuilder) copyEncoreRuntimeForJS() error {
+	d.log.Info().Msg("waiting for JS packager to complete...")
+	<-d.jsBuilder.compileCompleted
+	if d.jsBuilder.compileFailed.Load() {
+		d.log.Error().Msg("JS packager failed to build")
+		return errors.New("js build failed")
+	}
+
+	d.log.Info().Msg("copying encore runtime for JS...")
+	cmd := exec.Command("cp", "-r", d.jsBuilder.DistFolder+"/.", join(d.DistBuildDir, "runtimes", "js")+"/")
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		d.log.Err(err).Str("stderr", string(out)).Msg("encore runtime for js failed to be copied")
+		return errors.Wrapf(err, "cp js runtime: %s", out)
+	}
+	d.log.Info().Msg("encore runtime for js copied successfully")
+	return nil
+}
+
+// Build builds the distribution running each step in order
+func (d *DistBuilder) Build() error {
+	d.log = log.With().Str("os", d.OS).Str("arch", d.Arch).Logger()
+
+	d.log.Info().Msg("building distribution...")
+
+	// Prepare the target directory.
+	if err := os.RemoveAll(d.DistBuildDir); err != nil {
+		d.log.Err(err).Msg("failed to remove existing target dir")
+		return errors.Wrap(err, "remove target dir")
+	} else if err := os.MkdirAll(d.DistBuildDir, 0755); err != nil {
+		d.log.Err(err).Msg("failed to create target dir")
+		return errors.Wrap(err, "create target dir")
+	} else if err := os.MkdirAll(join(d.DistBuildDir, "bin"), 0755); err != nil {
+		d.log.Err(err).Msg("failed to create bin dir")
+		return errors.Wrap(err, "create bin dir")
+	} else if err := os.MkdirAll(join(d.DistBuildDir, "runtimes"), 0755); err != nil {
+		d.log.Err(err).Msg("failed to create runtimes dir")
+		return errors.Wrap(err, "create runtimes/go dir")
+	} else if err := os.MkdirAll(join(d.DistBuildDir, "runtimes", "go"), 0755); err != nil {
+		d.log.Err(err).Msg("failed to create runtimes/go dir")
+		return errors.Wrap(err, "create runtimes/go dir")
+	} else if err := os.MkdirAll(join(d.DistBuildDir, "runtimes", "js"), 0755); err != nil {
+		d.log.Err(err).Msg("failed to create runtimes/js dir")
+		return errors.Wrap(err, "create runtimes/js dir")
+	}
+
+	// Now we're prepped, start building.
+	err := runParallel(
+		d.buildEncoreCLI,
+		d.buildTSBundler,
+		d.buildGitHook,
+		d.buildTSParser,
+		d.buildNodePlugin,
+		d.copyEncoreRuntimeForGo,
+		d.copyEncoreRuntimeForJS,
+		d.downloadEncoreGo,
+	)
+	if err != nil {
+		d.log.Err(err).Msg("failed to build distribution")
+		return errors.Wrapf(err, " os: %s, arch: %s", d.OS, d.Arch)
+	}
+
+	// Now tar gzip the directory
+	d.log.Info().Str("tar_file", d.ArtifactsTarFile).Msg("creating distribution tar file...")
+	err = TarGzip(d.DistBuildDir, d.ArtifactsTarFile)
+	if err != nil {
+		d.log.Err(err).Msg("failed to tar gzip distribution")
+		return errors.Wrapf(err, " os: %s, arch: %s", d.OS, d.Arch)
+	}
+
+	d.log.Info().Str("tar_file", d.ArtifactsTarFile).Msg("distribution built successfully")
+	return nil
+}
+
+// runParallel runs the given functions in parallel, returning the first error
+func runParallel(functions ...func() error) error {
+	var wg sync.WaitGroup
+	wg.Add(len(functions))
+	var firstErr error
+	var mu sync.Mutex
+
+	for _, f := range functions {
+		f := f
+		go func() {
+			defer wg.Done()
+
+			if err := f(); err != nil {
+				mu.Lock()
+				defer mu.Unlock()
+				if firstErr == nil {
+					firstErr = err
+				}
+			}
+		}()
+	}
+
+	wg.Wait()
+	mu.Lock()
+	defer mu.Unlock()
+	return firstErr
+}
diff --git a/pkg/make-release/js_packager.go b/pkg/make-release/js_packager.go
new file mode 100644
index 0000000000..af0e716821
--- /dev/null
+++ b/pkg/make-release/js_packager.go
@@ -0,0 +1,275 @@
+package main
+
+import (
+	"io/fs"
+	osPkg "os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"sync/atomic"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+)
+
+type JSPackager struct {
+	log              zerolog.Logger
+	WorkspaceRoot    string // Path to the yarn workspace root
+	Version          string // the new version number
+	DistFolder       string // the folder to output the compiled JS to
+	compileCompleted chan struct{}
+	compileFailed    atomic.Bool
+}
+
+func (j *JSPackager) PatchVersions() error {
+	j.log.Info().Msg("Patching versions...")
+
+	replaceVersionRegex, err := regexp.Compile(`"version": "([^-"]+)(?:-[^"]+)?",`)
+	if err != nil {
+		j.log.Err(err).Msg("failed to compile regex")
+		return errors.Wrap(err, "compile regex")
+	}
+
+	// For all the folders in the packages dir
+	packages, err := j.listPackages(filepath.Join(j.WorkspaceRoot, "packages"), "")
+	if err != nil {
+		return errors.Wrap(err, "list packages")
+	}
+
+	for _, pkg := range packages {
+		// Look for a line containing `"version": ".*"`, and replace it
+		// with `"version": "0.0.0"`.
+		// (note we drop the "v" prefix for the package.json)
+		newFile := replaceVersionRegex.ReplaceAll(pkg.PackageJsonData, []byte(`"version": "`+j.Version[1:]+`",`))
+
+		// Write the file back to disk
+		err = osPkg.WriteFile(pkg.PackageJsonPath, newFile, 0644)
+		if err != nil {
+			j.log.Err(err).Str("package", pkg.Name).Msg("failed to write package.json")
+			return errors.Wrap(err, "write package.json")
+		}
+	}
+
+	j.log.Info().Msg("Patching internal-runtime/conf/version.ts...")
+	err = osPkg.WriteFile(
+		filepath.Join(j.WorkspaceRoot, "packages", "@encore.dev", "internal-runtime", "conf", "version.ts"),
+		[]byte(`// Code generated by /pkg/make-release. DO NOT EDIT.
+
+/**
+ * The current version of the runtime.
+ */
+export const Version = "`+j.Version+`";
+`),
+		0644,
+	)
+	if err != nil {
+		j.log.Err(err).Msg("failed to patch version.ts")
+		return errors.Wrap(err, "write patch version.ts")
+	}
+
+	return nil
+}
+
+type packageInfo struct {
+	RootDir         string
+	Name            string
+	PackageJsonPath string
+	PackageJsonData []byte
+}
+
+func (j *JSPackager) listPackages(dir string, basePkgName string) ([]packageInfo, error) {
+	var pkgs []packageInfo
+
+	// For all the folders in the packages dir
+	entries, err := osPkg.ReadDir(dir)
+	if err != nil {
+		j.log.Err(err).Str("dir", dir).Msg("failed to read directory")
+		return nil, errors.Wrap(err, "read directory")
+	}
+
+	for _, e := range entries {
+		pkgDir := filepath.Join(dir, e.Name())
+		switch {
+		case !e.IsDir():
+			continue
+		case strings.HasPrefix(e.Name(), "@"):
+			children, err := j.listPackages(pkgDir, e.Name())
+			if err != nil {
+				return nil, err
+			}
+			pkgs = append(pkgs, children...)
+		default:
+			pkgJsonPath := filepath.Join(pkgDir, "package.json")
+			pkgJson, err := osPkg.ReadFile(pkgJsonPath)
+			if errors.Is(err, fs.ErrNotExist) {
+				continue
+			} else if err != nil {
+				return nil, errors.Wrap(err, "read package.json")
+			}
+
+			pkgName := e.Name()
+			if basePkgName != "" {
+				pkgName = basePkgName + "/" + pkgName
+			}
+
+			pkgs = append(pkgs, packageInfo{
+				RootDir:         pkgDir,
+				Name:            pkgName,
+				PackageJsonPath: pkgJsonPath,
+				PackageJsonData: pkgJson,
+			})
+		}
+	}
+
+	return pkgs, nil
+}
+
+func (j *JSPackager) Package() (rtnErr error) {
+	defer func() {
+		if rtnErr != nil {
+			j.compileFailed.Store(true)
+		}
+		close(j.compileCompleted)
+	}()
+
+	j.DistFolder = filepath.Join(j.WorkspaceRoot, "dist")
+
+	// Remove the existing dist directory
+	if err := osPkg.RemoveAll(j.DistFolder); err != nil {
+		if !errors.Is(err, fs.ErrNotExist) {
+			j.log.Err(err).Msg("failed to remove dist directory")
+			return errors.Wrap(err, "remove dist directory")
+		}
+	}
+
+	// Patch the versions
+	if err := j.PatchVersions(); err != nil {
+		j.log.Err(err).Msg("failed to patch versions")
+		return errors.Wrap(err, "patch versions")
+	}
+
+	// Ensure our node_modules is up to date and installed
+	log.Info().Msg("Installing JS dependencies...")
+	err := j.yarn("install")
+	if err != nil {
+		j.log.Err(err).Msg("yarn install failed")
+		return errors.Wrap(err, "yarn install")
+	}
+
+	// Now clean up previous builds inside yarn
+	log.Info().Msg("Cleaning up from previous builds...")
+	err = j.yarn("clean")
+	if err != nil {
+		j.log.Err(err).Msg("yarn clean failed")
+		return errors.Wrap(err, "yarn clean")
+	}
+
+	log.Info().Msg("Building JS...")
+	err = j.yarn("build", "--filter=./packages/**/*", "--force") // only build our packages
+	if err != nil {
+		j.log.Err(err).Msg("yarn build failed")
+		return errors.Wrap(err, "yarn build")
+	}
+
+	log.Info().Msg("Fixing dist folder for ESM")
+	err = j.yarn("fix-dist")
+	if err != nil {
+		j.log.Err(err).Msg("yarn fix-dist failed")
+		return errors.Wrap(err, "yarn fix-dist")
+	}
+
+	// Now it's all build we can start the publish/packing process
+	log.Info().Msg("Publishing packages to npm...")
+	npmTag := "latest"
+	switch {
+	case strings.Contains(j.Version, "-beta."):
+		npmTag = "beta"
+	case strings.Contains(j.Version, "-nightly."):
+		npmTag = "nightly"
+	}
+	err = j.yarn("workspaces", "foreach", "--no-private", "-pt", "npm", "publish", "--tolerate-republish", "--access", "public", "--tag", npmTag)
+	if err != nil {
+		j.log.Err(err).Msg("yarn publish failed")
+		return errors.Wrap(err, "yarn publish")
+	}
+
+	// Create our dist folder
+	err = osPkg.MkdirAll(j.DistFolder, 0755)
+	if err != nil {
+		j.log.Err(err).Msg("failed to create dist directory")
+		return errors.Wrap(err, "create dist directory")
+	}
+
+	// Package up our JS runtime
+	log.Info().Msg("Packaging JS runtime packages...")
+	err = j.yarn("workspaces", "foreach", "--no-private", "pack", "--out", filepath.Join(j.DistFolder, "%s.tgz"))
+	if err != nil {
+		j.log.Err(err).Msg("yarn pack failed")
+		return errors.Wrap(err, "yarn pack")
+	}
+
+	// Now extract all the tarballs in our dist folder, deleting the tarballs
+	// as we go.
+	log.Info().Msg("Extracting JS runtime packages...")
+	dirEntries, err := osPkg.ReadDir(j.DistFolder)
+	if err != nil {
+		j.log.Err(err).Msg("failed to read dist directory")
+		return errors.Wrap(err, "read dist directory")
+	}
+	for _, entry := range dirEntries {
+		if entry.IsDir() {
+			continue
+		}
+
+		if filepath.Ext(entry.Name()) != ".tgz" {
+			continue
+		}
+
+		name := entry.Name()
+		name = strings.TrimSuffix(name, filepath.Ext(name))
+		dirToExtractTo := filepath.Join(j.DistFolder, name)
+		dirToExtractTo = strings.ReplaceAll(dirToExtractTo, "@encore.dev-", "@encore.dev/")
+
+		// Create the target directory
+		err = osPkg.MkdirAll(dirToExtractTo, 0755)
+		if err != nil {
+			j.log.Err(err).Str("tgz_file", entry.Name()).Str("target", dirToExtractTo).Msg("failed to create target directory")
+			return errors.Wrap(err, "create target directory")
+		}
+
+		// Extract the tarball
+		out, err := exec.Command("tar", "-xzf", filepath.Join(j.DistFolder, entry.Name()), "--strip-components", "1", "-C", dirToExtractTo).CombinedOutput()
+		// nosemgrep
+		if err != nil {
+			j.log.Err(err).Str("tgz_file", entry.Name()).Str("target", dirToExtractTo).Str("output", string(out)).Msg("failed to extract tarball")
+			return errors.Wrap(err, "extract tarball")
+		}
+
+		// Delete the tarball
+		err = osPkg.Remove(filepath.Join(j.DistFolder, entry.Name()))
+		if err != nil {
+			j.log.Err(err).Str("tgz_file", entry.Name()).Str("target", dirToExtractTo).Msg("failed to delete tarball")
+			return errors.Wrap(err, "delete tarball")
+		}
+	}
+
+	log.Info().Msg("JS runtime packaged successfully")
+	return nil
+}
+
+func (j *JSPackager) yarn(args ...string) error {
+	cmd := exec.Command("yarn", args...)
+	cmd.Env = osPkg.Environ()
+	cmd.Dir = j.WorkspaceRoot
+	cmd.Stdout = osPkg.Stdout
+	cmd.Stderr = osPkg.Stderr
+
+	j.log.Debug().Str("cmd", cmd.String()).Msg("running yarn command...")
+	if err := cmd.Run(); err != nil {
+		return errors.Wrap(err, "yarn command failed")
+	}
+
+	return nil
+}
diff --git a/pkg/make-release/make-release.go b/pkg/make-release/make-release.go
index 263dea3d02..21d6b5a278 100644
--- a/pkg/make-release/make-release.go
+++ b/pkg/make-release/make-release.go
@@ -3,163 +3,96 @@ package main
 import (
 	"flag"
 	"fmt"
-	"log"
 	"os"
-	"os/exec"
 	"path/filepath"
-)
-
-type Builder struct {
-	GOOS     string
-	GOARCH   string
-	encoreGo string
-	dst      string
-	version  string
-}
-
-func (b *Builder) PrepareWorkdir() error {
-	if err := os.RemoveAll(b.dst); err != nil {
-		return err
-	} else if err := os.MkdirAll(b.dst, 0755); err != nil {
-		return err
-	} else if err := os.MkdirAll(join(b.dst, "bin"), 0755); err != nil {
-		return err
-	}
-	return nil
-}
-
-func (b *Builder) BuildDashFrontend() error {
-	dir := join("cli", "daemon", "dash", "dashapp")
-	npmInst := exec.Command("npm", "install")
-	npmInst.Dir = dir
-	if out, err := npmInst.CombinedOutput(); err != nil {
-		return fmt.Errorf("npm install failed: %s (%v)", out, err)
-	}
 
-	npmBuild := exec.Command("npm", "run", "build")
-	npmBuild.Dir = dir
-	if out, err := npmBuild.CombinedOutput(); err != nil {
-		return fmt.Errorf("npm run build failed: %s (%v)", out, err)
-	}
-	return nil
-}
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
 
-func (b *Builder) BuildBinaries() error {
-	env := append(os.Environ(),
-		"CGO_ENABLED=1",
-		"GOOS="+b.GOOS,
-		"GOARCH="+b.GOARCH,
-	)
-
-	if b.GOOS == "darwin" {
-		var target string
-		switch b.GOARCH {
-		case "amd64":
-			target = "x86_64-apple-macos10.12"
-		case "arm64":
-			target = "arm64-apple-macos11"
-			env = append(env, "SDKROOT=/Library/Developer/CommandLineTools/SDKs/MacOSX11.1.sdk")
-		default:
-			return fmt.Errorf("unsupported GOARCH %q", b.GOARCH)
-		}
-		env = append(env,
-			"LDFLAGS=--target="+target,
-			"CFLAGS=-O3 --target="+target,
-		)
-	}
-
-	cmd := exec.Command("go", "build",
-		fmt.Sprintf("-ldflags=-X 'main.Version=v%s'", b.version),
-		"-o", join(b.dst, "bin", "encore"),
-		"./cli/cmd/encore")
-	cmd.Env = env
-	if out, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("go build encore failed: %s (%v)", out, err)
-	}
-
-	cmd = exec.Command("go", "build",
-		"-o", join(b.dst, "bin", "git-remote-encore"),
-		"./cli/cmd/git-remote-encore")
-	cmd.Env = env
-	if out, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("go build git-remote-encore failed: %s (%v)", out, err)
-	}
-
-	return nil
-}
-
-func (b *Builder) CopyEncoreGo() error {
-	cmd := exec.Command("cp", "-r", b.encoreGo, join(b.dst, "encore-go"))
-	if out, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("cp %v failed: %s (%v)", cmd.Args, out, err)
-	}
-	return nil
-}
-
-func (b *Builder) CopyRuntime() error {
-	cmd := exec.Command("cp", "-r", join("compiler", "runtime"), join(b.dst, "runtime"))
-	if out, err := cmd.CombinedOutput(); err != nil {
-		return fmt.Errorf("cp %v failed: %s (%v)", cmd.Args, out, err)
-	}
-	return nil
-}
+	"encr.dev/internal/version"
+)
 
 func join(strs ...string) string {
 	return filepath.Join(strs...)
 }
 
-func all(src string, all ...string) []string {
-	var res []string
-	for _, a := range all {
-		res = append(res, join(src, a))
-	}
-	return res
-}
-
 func main() {
-	goos := flag.String("goos", "", "GOOS")
-	goarch := flag.String("goarch", "", "GOARCH")
+	log.Logger = zerolog.New(zerolog.NewConsoleWriter()).With().Caller().Timestamp().Stack().Logger()
+
 	dst := flag.String("dst", "", "build destination")
-	version := flag.String("v", "", "version number (without 'v')")
-	encoreGo := flag.String("encore-go", "", "path to encore-go root")
+	versionStr := flag.String("v", "", "version number")
+	tsParserRepo := flag.String("ts-parser", "", "path to ts-parser repo")
+	onlyBuild := flag.String("only", "", "build only the valid target ('darwin-arm64' or 'darwin' or 'arm64' or '' for all)")
 	flag.Parse()
-	if *goos == "" || *goarch == "" || *dst == "" || *version == "" || *encoreGo == "" {
-		log.Fatalf("missing -dst %q, -goos %q, -goarch %q, -v %q, or -encore-go %q", *dst, *goos, *goarch, *version, *encoreGo)
+	if *dst == "" || *versionStr == "" || *tsParserRepo == "" {
+		log.Fatal().Msgf("missing -dst %q, -v %q or ts-parser %q", *dst, *versionStr, *tsParserRepo)
 	}
 
-	if *goos == "windows" {
-		log.Fatalf("cannot use make-release.go for Windows builds. use ./windows/build.bat instead.")
+	if (*versionStr)[0] != 'v' {
+		log.Fatal().Msg("version must start with 'v'")
+	}
+	switch version.ChannelFor(*versionStr) {
+	case version.GA, version.Beta, version.Nightly, version.DevBuild:
+		// no-op
+	default:
+		log.Fatal().Msgf("unknown version channel for %s", *versionStr)
 	}
 
 	root, err := os.Getwd()
 	if err != nil {
-		log.Fatalln(err)
+		log.Fatal().Err(err).Msg("failed to get working directory")
 	} else if _, err := os.Stat(join(root, "go.mod")); err != nil {
-		log.Fatalln("expected to run make-release.go from encr.dev repository root")
+		log.Fatal().Err(err).Msg("expected to run make-release.go from encr.dev repository root")
 	}
 
 	*dst, err = filepath.Abs(*dst)
 	if err != nil {
-		log.Fatalln(err)
+		log.Fatal().Err(err).Msg("failed to get absolute path to destination")
+	}
+
+	// Prepare the target directory.
+	if err := os.RemoveAll(*dst); err != nil {
+		log.Fatal().Err(err).Msg("failed to remove existing target dir")
+	} else if err := os.MkdirAll(filepath.Join(*dst, "artifacts"), 0755); err != nil {
+		log.Fatal().Err(err).Msg("failed to create target dir")
 	}
 
-	b := &Builder{
-		GOOS:     *goos,
-		GOARCH:   *goarch,
-		encoreGo: filepath.FromSlash(*encoreGo),
-		dst:      join(*dst, *goos+"_"+*goarch),
-		version:  *version,
+	jsBuilder := &JSPackager{
+		WorkspaceRoot:    join(root, "runtimes", "js"),
+		Version:          *versionStr,
+		log:              log.Logger.With().Str("builder", "js").Logger(),
+		compileCompleted: make(chan struct{}),
 	}
 
-	for _, f := range []func() error{
-		b.PrepareWorkdir,
-		b.BuildDashFrontend,
-		b.BuildBinaries,
-		b.CopyEncoreGo,
-		b.CopyRuntime,
-	} {
-		if err := f(); err != nil {
-			log.Fatalln(err)
+	// Create all the builders
+	builders := []*DistBuilder{
+		{OS: "darwin", Arch: "amd64"},
+		{OS: "darwin", Arch: "arm64"},
+		{OS: "linux", Arch: "amd64"},
+		{OS: "linux", Arch: "arm64"},
+		{OS: "windows", Arch: "amd64"},
+	}
+	parralelFuncs := make([]func() error, 1, len(builders)+1)
+	parralelFuncs[0] = jsBuilder.Package
+
+	// Give them the common settings
+	for _, b := range builders {
+		if *onlyBuild != "" && !(*onlyBuild == fmt.Sprintf("%s-%s", b.OS, b.Arch) ||
+			*onlyBuild == b.OS ||
+			*onlyBuild == b.Arch) {
+			continue
 		}
+		b.TSParserPath = *tsParserRepo
+		b.DistBuildDir = join(*dst, b.OS+"_"+b.Arch)
+		b.ArtifactsTarFile = join(*dst, "artifacts", "encore-"+*versionStr+"-"+b.OS+"_"+b.Arch+".tar.gz")
+		b.Version = *versionStr
+		b.jsBuilder = jsBuilder
+
+		parralelFuncs = append(parralelFuncs, b.Build)
+	}
+
+	if err := runParallel(parralelFuncs...); err != nil {
+		log.Fatal().Err(err).Msg("failed to build all distributions")
 	}
+	log.Info().Msg("all distributions built successfully")
 }
diff --git a/pkg/make-release/utils.go b/pkg/make-release/utils.go
new file mode 100644
index 0000000000..9c33ead82c
--- /dev/null
+++ b/pkg/make-release/utils.go
@@ -0,0 +1,253 @@
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	osPkg "os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+)
+
+type Release struct {
+	Version  string // The version of the release
+	Filename string // The filename of the release (inc extension)
+	FileExt  string // The file extension
+	URL      string // The URL to download the release from
+	Checksum []byte // The checksum of the release
+}
+
+// getGithubRelease fetches the latest release from Github for the given org and repo
+func getGithubRelease(org string, repo string, os string, arch string) (*Release, error) {
+	rtn := &Release{}
+
+	type GithubRelease struct {
+		TagName string `json:"tag_name"`
+		Assets  []struct {
+			Name               string `json:"name"`
+			BrowserDownloadURL string `json:"browser_download_url"`
+		} `json:"assets"`
+	}
+
+	// Download the latest releases
+	releasesResp, err := http.Get(fmt.Sprintf("https://api.github.com/repos/%s/%s/releases/latest", org, repo))
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to fetch latest release information")
+	}
+	defer func() { _ = releasesResp.Body.Close() }()
+
+	if releasesResp.StatusCode != http.StatusOK {
+		return nil, errors.Newf("Unexpected response status code: %s", releasesResp.Status)
+	}
+
+	releases := &GithubRelease{}
+	if err := json.NewDecoder(releasesResp.Body).Decode(releases); err != nil {
+		return nil, errors.Wrap(err, "unable to decode Github releases")
+	}
+
+	rtn.Version = releases.TagName
+
+	// Build a list of possible file names
+	osOptions := []string{os}
+	if os == "darwin" {
+		osOptions = append(osOptions, "macos")
+	}
+	archOptions := []string{arch}
+	if arch == "amd64" {
+		archOptions = append(archOptions, "x86_64", "x86-64")
+	} else if arch == "arm64" {
+		archOptions = append(archOptions, "aarch64")
+	}
+	extOptions := []string{"tar.gz"} // , "zip"}
+
+	var fileNameOptions []string
+	for _, osOption := range osOptions {
+		for _, archOption := range archOptions {
+			for _, extOption := range extOptions {
+				fileNameOptions = append(fileNameOptions,
+					fmt.Sprintf("%s_%s.%s", osOption, archOption, extOption),
+					fmt.Sprintf("%s-%s.%s", osOption, archOption, extOption),
+				)
+			}
+		}
+	}
+
+	// Find the checksum file
+	checksumFileURL := ""
+	for _, asset := range releases.Assets {
+		// We want to know the checksum URL
+		if strings.EqualFold(asset.Name, "checksums.txt") {
+			checksumFileURL = asset.BrowserDownloadURL
+
+		}
+
+		for _, filenameOption := range fileNameOptions {
+			if strings.EqualFold(asset.Name, filenameOption) {
+				// We also want to know the asset name and download URL
+				rtn.Filename = asset.Name
+				rtn.URL = asset.BrowserDownloadURL
+
+				if strings.HasSuffix(asset.Name, ".tar.gz") {
+					rtn.FileExt = ".tar.gz"
+				} else {
+					rtn.FileExt = filepath.Ext(asset.Name)
+				}
+			}
+		}
+	}
+	if checksumFileURL == "" {
+		return nil, errors.New("unable to find checksum file in Github release")
+	}
+	if rtn.URL == "" || rtn.Filename == "" {
+		return nil, errors.New("unable to find binary in Github release")
+	}
+
+	// Download the checksum file
+	checksumResp, err := http.Get(checksumFileURL)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to fetch checksum file")
+	}
+	defer func() { _ = checksumResp.Body.Close() }()
+	if checksumResp.StatusCode != http.StatusOK {
+		return nil, errors.Newf("Unexpected response status code for checksum file: %s", checksumResp.Status)
+	}
+
+	// Read the checksum file line by line
+	scanner := bufio.NewScanner(checksumResp.Body)
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if strings.HasSuffix(line, rtn.Filename) {
+			checksumStr := strings.Split(line, " ")[0]
+
+			checksum, err := hex.DecodeString(checksumStr)
+			if err != nil {
+				return nil, errors.Wrap(err, "unable to decode checksum")
+			}
+			rtn.Checksum = checksum
+
+			return rtn, nil
+		}
+	}
+	return nil, errors.New("unable to find checksum for asset file in checksum file")
+}
+
+func downloadLatestGithubRelease(org, repo, os, arch string) (pathToFile string, rtnErr error) {
+	// Find the latest release
+	release, err := getGithubRelease(org, repo, os, arch)
+	if err != nil {
+		return "", err
+	}
+
+	// Create a cache dir for the download cache for this specific OS and architecture pair
+	cacheDir, err := osPkg.UserCacheDir()
+	if err != nil {
+		return "", errors.Wrap(err, "user cache dir")
+	}
+
+	path := filepath.Join(cacheDir, "encore-build-cache", "github-releases", org, repo, os, arch)
+	err = osPkg.MkdirAll(path, 0755)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to make cache dir")
+	}
+
+	downloadFileName := fmt.Sprintf("%s-%s%s", release.Version, hex.EncodeToString(release.Checksum), release.FileExt)
+	downloadPath := filepath.Join(path, downloadFileName)
+
+	// Check if the file already exists
+	if _, err := osPkg.Stat(downloadPath); err == nil {
+		return downloadPath, nil
+	} else if !osPkg.IsNotExist(err) {
+		return "", errors.Wrap(err, "failed to stat existing download file")
+	}
+
+	// Now download the file
+	downloadResp, err := http.Get(release.URL)
+	if err != nil {
+		return "", errors.Wrap(err, "unable to fetch release file")
+	}
+	defer func() { _ = downloadResp.Body.Close() }()
+	if downloadResp.StatusCode != http.StatusOK {
+		return "", errors.Newf("Unexpected response status code for release file: %s", downloadResp.Status)
+	}
+
+	// Create the file
+	downloadFile, err := osPkg.Create(downloadPath)
+	defer func() {
+		_ = downloadFile.Close()
+		if rtnErr != nil {
+			_ = osPkg.Remove(downloadPath) // delete any partially written file
+		}
+	}()
+	_, err = io.Copy(downloadFile, downloadResp.Body)
+	if err != nil {
+		return "", errors.Wrap(err, "unable to download release file")
+	}
+
+	// Now checksum the file
+	if _, err := downloadFile.Seek(0, 0); err != nil {
+		return "", errors.Wrap(err, "unable to seek to start of release file")
+	}
+
+	checksum, err := checksumFile(downloadFile)
+	if err != nil {
+		return "", errors.Wrap(err, "unable to checksum release file")
+	}
+
+	// Check the checksum
+	if !bytes.Equal(checksum, release.Checksum) {
+		return "", errors.Newf("checksum of downloaded file (%q) does not match expected checksum (%q)", hex.EncodeToString(checksum), hex.EncodeToString(release.Checksum))
+	}
+
+	return downloadPath, nil
+}
+
+func checksumFile(file *osPkg.File) ([]byte, error) {
+	hash := sha256.New()
+	if _, err := io.Copy(hash, file); err != nil {
+		return nil, errors.Wrap(err, "unable to checksum file")
+	}
+	return hash.Sum(nil), nil
+}
+
+func extractArchive(pathToArchive string, targetDir string) error {
+	// Create the target dir
+	if err := osPkg.MkdirAll(targetDir, 0755); err != nil {
+		return errors.Wrap(err, "failed to create target dir")
+	}
+
+	// Extract the archive
+	cmd := exec.Command("tar", "-xzf", pathToArchive, "--strip-components", "1", "-C", targetDir)
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return errors.Wrapf(err, "failed to extract archive: %s", out)
+	}
+
+	return nil
+}
+
+func TarGzip(srcDirectory string, tarFile string) error {
+	// Create the tar.gz file from the src directory
+	cmd := exec.Command("tar", "-czf", tarFile, "-C", srcDirectory, ".")
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return errors.Wrapf(err, "failed to create tar.gz: %s", out)
+	}
+	return nil
+}
+
+func copyDir(src, dst string) error {
+	cmd := exec.Command("cp", "-r", src+"/", dst)
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		return errors.Wrapf(err, "failed to copy dir: %s", out)
+	}
+	return nil
+}
diff --git a/pkg/make-release/windows/build.bat b/pkg/make-release/windows/build.bat
index 1a8e86063f..e643bd97be 100644
--- a/pkg/make-release/windows/build.bat
+++ b/pkg/make-release/windows/build.bat
@@ -38,7 +38,6 @@ if exist .deps\prepared goto :build
 
 :build
 	set GOOS=windows
-	call :build_dashapp || goto :error
 	call :build_plat amd64 x86_64 amd64 || goto :error
 	call :copy_artifacts || goto :error
 
@@ -57,14 +56,6 @@ if exist .deps\prepared goto :build
 	del %1 || exit /b 1
 	goto :eof
 
-:build_dashapp
-	cd %ROOT%\cli\daemon\dash\dashapp || exit /b 1
-	echo [+] Building dash app
-	cmd /C npm install || goto :error
-	cmd /C npm run build || goto :error
-	cd %BUILDDIR% || exit /b 1
-	goto :eof
-
 :build_plat
 	rmdir /S /Q "%DST%"
 	mkdir %DST%\bin >NUL 2>&1
@@ -72,16 +63,16 @@ if exist .deps\prepared goto :build
 	x86_64-w64-mingw32-windres -I ".deps\wintun\bin\amd64" -i resources.rc -o "%ROOT%\cli\cmd\encore\resources_amd64.syso" -O coff -c 65001 || exit /b %errorlevel%
 	set GOARCH=amd64
 	echo [+] Building
-	go build -tags load_wintun_from_rsrc -ldflags "-X 'main.Version=v%ENCORE_VERSION%'" -o "%DST%\bin\encore.exe" "%ROOT%\cli\cmd\encore" || exit /b 1
+	go build -tags load_wintun_from_rsrc -ldflags "-X 'encr.dev/internal/version.Version=v%ENCORE_VERSION%'" -o "%DST%\bin\encore.exe" "%ROOT%\cli\cmd\encore" || exit /b 1
 	go build -trimpath -o "%DST%\bin\git-remote-encore.exe" "%ROOT%\cli\cmd\git-remote-encore" || exit /b 1
 	goto :eof
 
 :copy_artifacts
 	echo [+] Copying files
 	xcopy /S /I /E /H /Q "%ENCORE_GOROOT%" "%DST%\encore-go" || exit /b 1
-	xcopy /S /I /E /H /Q "%ROOT%\compiler\runtime" "%DST%\runtime" || exit /b 1
+	xcopy /S /I /E /H /Q "%ROOT%\runtimes\go" "%DST%\runtimes\go" || exit /b 1
 	goto :eof
 
 :error
 	echo [-] Failed with error #%errorlevel%.
-	cmd /c exit %errorlevel%
\ No newline at end of file
+	cmd /c exit %errorlevel%
diff --git a/pkg/namealloc/namealloc.go b/pkg/namealloc/namealloc.go
new file mode 100644
index 0000000000..cf7022b2db
--- /dev/null
+++ b/pkg/namealloc/namealloc.go
@@ -0,0 +1,45 @@
+package namealloc
+
+import (
+	"go/token"
+	"strconv"
+)
+
+// Allocator helps choosing names without collisions
+// and without using Go keywords. The zero value is ready
+// to be used.
+type Allocator struct {
+	// Reserved decides whether a given input is reserved.
+	// If nil it defaults to token.IsKeyword.
+	Reserved func(input string) bool
+
+	used map[string]bool
+}
+
+// Get allocates a name that is a valid, unused identifier
+// based on the input string. It ensures the same name is not
+// returned multiple times even for the same input.
+func (a *Allocator) Get(input string) (name string) {
+	if a.isReserved(input) {
+		input = input + "_"
+	}
+
+	candidate := input
+	for i := 2; a.used[candidate]; i++ {
+		candidate = input + strconv.Itoa(i)
+	}
+
+	if a.used == nil {
+		a.used = make(map[string]bool)
+	}
+	a.used[candidate] = true
+	return candidate
+}
+
+func (a *Allocator) isReserved(input string) bool {
+	reserved := a.Reserved
+	if reserved == nil {
+		reserved = token.IsKeyword
+	}
+	return reserved(input)
+}
diff --git a/pkg/namealloc/namealloc_test.go b/pkg/namealloc/namealloc_test.go
new file mode 100644
index 0000000000..f527435bd8
--- /dev/null
+++ b/pkg/namealloc/namealloc_test.go
@@ -0,0 +1,49 @@
+package namealloc
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestAlloc(t *testing.T) {
+	tests := []struct {
+		name     string
+		reserved []string // reserved words
+		in       []string
+		out      []string
+	}{
+		{
+			name: "simple",
+			in:   []string{"hello", "hello", "there", "hello"},
+			out:  []string{"hello", "hello2", "there", "hello3"},
+		},
+		{
+			name:     "reserved",
+			reserved: []string{"hello"},
+			in:       []string{"hello", "hello", "there", "hello"},
+			out:      []string{"hello_", "hello_2", "there", "hello_3"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			reserved := func(s string) bool {
+				for _, r := range tt.reserved {
+					if r == s {
+						return true
+					}
+				}
+				return false
+			}
+			a := &Allocator{Reserved: reserved}
+
+			got := make([]string, 0, len(tt.in))
+			for _, in := range tt.in {
+				v := a.Get(in)
+				got = append(got, v)
+			}
+			if !reflect.DeepEqual(got, tt.out) {
+				t.Errorf("Alloc(%+v) = %+v, want %+v", tt.in, got, tt.out)
+			}
+		})
+	}
+}
diff --git a/pkg/noopgateway/noopgateway.go b/pkg/noopgateway/noopgateway.go
new file mode 100644
index 0000000000..99f546ef0c
--- /dev/null
+++ b/pkg/noopgateway/noopgateway.go
@@ -0,0 +1,252 @@
+package noopgateway
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"strings"
+
+	"github.com/gorilla/mux"
+	"github.com/julienschmidt/httprouter"
+)
+
+// ServiceName is the name of a service.
+type ServiceName string
+
+// Route defines a single route in the gateway.
+type Route struct {
+	Methods []string    // HTTP methods
+	Path    string      // "/path/:param/*wildcard"
+	Dest    ServiceName // where to route the request
+
+	// RequiresAuth specifies whether the route requires authentication.
+	RequiresAuth bool
+}
+
+// Service describes how to route traffic to a service.
+type Service struct {
+	// URL is the URL to proxy traffic to.
+	URL *url.URL
+}
+
+// AuthHandler describes the auth handler.
+type AuthHandler struct {
+	// Service is the service containing the auth handler.
+	Service ServiceName
+	Name    string // name of the auth handler
+
+	// Parameters that the auth handler expects.
+	// If any one of these are present in the request,
+	// the auth handler is invoked.
+	Query  []Param
+	Header []Param
+	Cookie []Param
+}
+
+// Param describes a request parameter.
+type Param struct {
+	// WireFormat is the name of the parameter on the wire.
+	WireFormat string
+	// CaseSensitive specifies whether or not
+	// the wire format is case sensitive.
+	CaseSensitive bool
+}
+
+// Description describes a gateway.
+type Description struct {
+	// Routes are the routes to proxy.
+	Routes []*Route
+
+	// Services defines how to proxy traffic to each service.
+	Services map[ServiceName]Service
+
+	// Auth describes the authentication handler, if any.
+	Auth *AuthHandler
+}
+
+// New constructs a new gateway.
+func New(desc *Description) *Gateway {
+	// TODO validate config:
+	// route -> service mapping
+	// requires auth -> auth handler present
+
+	gw := &Gateway{
+		RoundTripper: http.DefaultTransport,
+		desc:         desc,
+		routeLookup:  newRouteLookuper(desc.Routes),
+	}
+
+	// Create our proxy.
+	gw.proxy = &httputil.ReverseProxy{
+		Rewrite:      gw.handleRequest,
+		Transport:    &errorCheckingRoundTripper{gw: gw},
+		ErrorHandler: gw.errorHandler,
+	}
+
+	return gw
+}
+
+// Gateway implements a gateway that validates and authenticates incoming requests,
+// and forwards them to the appropriate service.
+type Gateway struct {
+	// Rewrite allows for rewriting the request before it is proxied.
+	// If nil it does nothing.
+	Rewrite func(p *httputil.ProxyRequest)
+
+	// RoundTripper is the http.RoundTripper to use. It defaults to http.DefaultTransport.
+	RoundTripper http.RoundTripper
+
+	// ExtraRoutes, if non-nil, specifies a router that will be consulted first.
+	// Requests will be proxied to the backend only if the router has no matching path.
+	ExtraRoutes *mux.Router
+
+	desc *Description
+
+	// routeLookup is the httprouter for resolving incoming requests
+	// to the routes they match.
+	routeLookup *httprouter.Router
+
+	// proxy proxies requests to the right backend.
+	proxy *httputil.ReverseProxy
+}
+
+// ServeHTTP implements http.Handler.
+func (g *Gateway) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	if g.ExtraRoutes != nil {
+		var match mux.RouteMatch
+		if g.ExtraRoutes.Match(req, &match) {
+			// ExtraRoutes has a matching route. Use it.
+			g.ExtraRoutes.ServeHTTP(w, req)
+			return
+		}
+	}
+
+	g.proxy.ServeHTTP(w, req)
+}
+
+// handleRequest handles the request.
+func (g *Gateway) handleRequest(r *httputil.ProxyRequest) {
+	// setErrResp sets an error response, by setting the
+	// sentinel error.
+	setErrResp := func(err error) {
+		out := &http.Request{
+			// Assumed to be non-nil by httputil.
+			Header: make(http.Header),
+		}
+		ctx := context.WithValue(context.Background(), errCtxKey, err)
+		r.Out = out.WithContext(ctx)
+	}
+
+	route, ok := g.lookupRoute(r.In)
+	if !ok {
+		setErrResp(errRouteNotFound)
+		return
+	}
+
+	// TODO perform authentication
+
+	dest := g.desc.Services[route.Dest]
+	r.SetURL(dest.URL)
+
+	if g.Rewrite != nil {
+		g.Rewrite(r)
+	}
+	r.Out.Header["X-Forwarded-For"] = r.In.Header["X-Forwarded-For"]
+	r.SetXForwarded()
+}
+
+// lookupRoute looks up the route the request is for.
+// If no route is found, it reports (nil, false).
+func (g *Gateway) lookupRoute(req *http.Request) (route *Route, ok bool) {
+	handle, _, tsr := g.routeLookup.Lookup(req.Method, req.URL.Path)
+
+	// Handle trailing slash redirects.
+	if tsr {
+		path := req.URL.Path
+		if strings.HasSuffix(path, "/") {
+			path = path[:len(path)-1]
+		} else {
+			path += "/"
+		}
+		handle, _, _ = g.routeLookup.Lookup(req.Method, path)
+	}
+
+	if handle == nil {
+		// Route not found
+		return nil, false
+	}
+
+	rw := &sentinelResponseWriter{}
+	handle(rw, nil, httprouter.Params{})
+	return rw.route, true
+}
+
+func (g *Gateway) errorHandler(w http.ResponseWriter, req *http.Request, err error) {
+	// TODO handle this properly
+	http.Error(w, err.Error(), http.StatusInternalServerError)
+}
+
+var (
+	errRouteNotFound = errors.New("route not found")
+)
+
+// sentinelResponseWriter is a sentinel value that implements
+// http.ResponseWriter as a way to get the Route registered for a given path.
+type sentinelResponseWriter struct {
+	http.ResponseWriter // always nil; dummy value to implement http.ResponseWriter
+	// route is the selected route (an output parameter).
+	route *Route
+}
+
+// errorCheckingRoundTripper is a http.RoundTripper that
+// checks for specific error responses in the request context
+// and returns an error if they are found.
+type errorCheckingRoundTripper struct {
+	gw *Gateway
+}
+
+func (rt errorCheckingRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	ctx := req.Context()
+	if err, ok := ctx.Value(errCtxKey).(error); ok && err != nil {
+		return nil, err
+	}
+	return rt.gw.RoundTripper.RoundTrip(req)
+}
+
+type ctxKey string
+
+const errCtxKey ctxKey = "error"
+
+func newRouteLookuper(routes []*Route) *httprouter.Router {
+	r := httprouter.New()
+	for _, route := range routes {
+		route := route // for the closure below
+		for _, m := range route.Methods {
+			r.Handle(m, route.Path, func(w http.ResponseWriter, _ *http.Request, _ httprouter.Params) {
+				w.(*sentinelResponseWriter).route = route
+			})
+		}
+	}
+	return r
+}
+
+// authInfo represents extracted auth information from a request.
+type authInfo struct {
+}
+
+// extractAuthInfo extracts the auth information from the request.
+// If there is no auth information (or the gateway has no auth handler)
+// it reports nil.
+func (g *Gateway) extractAuthInfo(req *http.Request) *authInfo {
+	auth := g.desc.Auth
+	if auth == nil {
+		return nil
+	}
+
+	// TODO check Query, Header, Cookie etc
+	// TODO check legacy bearer token auth
+
+	return nil
+}
diff --git a/pkg/noopgateway/retry_dialer.go b/pkg/noopgateway/retry_dialer.go
new file mode 100644
index 0000000000..fbf3c42759
--- /dev/null
+++ b/pkg/noopgateway/retry_dialer.go
@@ -0,0 +1,50 @@
+package noopgateway
+
+import (
+	"context"
+	"net"
+	"strings"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+)
+
+// RetryDialer wraps another dialer and adds exponential backoff
+// in the case of connection refused errors.
+type RetryDialer struct {
+	net.Dialer
+	MaxBackoff time.Duration
+}
+
+func (d *RetryDialer) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	var conn net.Conn
+	b := backoff.NewExponentialBackOff()
+
+	b.MaxElapsedTime = d.MaxBackoff
+	if b.MaxElapsedTime == 0 {
+		b.MaxElapsedTime = time.Minute // Set maximum backoff time to 1 minute
+	}
+
+	operation := func() error {
+		var err error
+		conn, err = d.Dialer.DialContext(ctx, network, address)
+		if err != nil {
+			if strings.Contains(err.Error(), "connection refused") {
+				// Retry if connection is refused
+				return err
+			}
+
+			// Don't retry if connection isn't refused
+			return backoff.Permanent(err)
+		}
+
+		return nil
+	}
+
+	err := backoff.Retry(operation, b)
+	if err != nil {
+		return nil, err
+	}
+
+	return conn, nil
+}
diff --git a/pkg/noopgwdesc/gateway.go b/pkg/noopgwdesc/gateway.go
new file mode 100644
index 0000000000..fb8d6f21bc
--- /dev/null
+++ b/pkg/noopgwdesc/gateway.go
@@ -0,0 +1,73 @@
+package noopgwdesc
+
+import (
+	"fmt"
+	"net/url"
+	"slices"
+	"strings"
+
+	"encr.dev/pkg/noopgateway"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+// Describe computes a Description based on the given metadata and service discovery configuration.
+// If serviceDiscovery is nil, the routes will be added but the service discovery setup will be empty.
+func Describe(md *meta.Data, serviceDiscovery map[noopgateway.ServiceName]string) *noopgateway.Description {
+	desc := &noopgateway.Description{
+		Services: make(map[noopgateway.ServiceName]noopgateway.Service),
+	}
+
+	for _, svc := range md.Svcs {
+		svcName := noopgateway.ServiceName(svc.Name)
+
+		if serviceDiscovery != nil {
+			host, ok := serviceDiscovery[svcName]
+			if !ok {
+				continue
+			}
+
+			target := &url.URL{
+				Scheme: "http",
+				Host:   host,
+			}
+			desc.Services[svcName] = noopgateway.Service{
+				URL: target,
+			}
+		}
+
+		for _, ep := range svc.Rpcs {
+			methods := ep.HttpMethods
+			if slices.Contains(methods, "*") {
+				methods = []string{"GET", "HEAD", "POST", "PUT", "DELETE", "CONNECT", "OPTIONS", "TRACE", "PATCH"}
+			}
+			desc.Routes = append(desc.Routes, &noopgateway.Route{
+				Methods:      methods,
+				Dest:         svcName,
+				RequiresAuth: ep.AccessType == meta.RPC_AUTH,
+				Path:         pathToString(ep.Path),
+			})
+		}
+	}
+
+	return desc
+}
+
+func pathToString(path *meta.Path) string {
+	parts := make([]string, 0, len(path.Segments))
+	paramIdx := 0
+	for _, seg := range path.Segments {
+		var val string
+		switch seg.Type {
+		case meta.PathSegment_LITERAL:
+			val = seg.Value
+		case meta.PathSegment_PARAM:
+			val = fmt.Sprintf(":p%d", paramIdx)
+			paramIdx++
+		case meta.PathSegment_WILDCARD, meta.PathSegment_FALLBACK:
+			val = fmt.Sprintf("*p%d", paramIdx)
+			paramIdx++
+		}
+		parts = append(parts, val)
+	}
+	return "/" + strings.Join(parts, "/")
+}
diff --git a/pkg/option/option.go b/pkg/option/option.go
new file mode 100644
index 0000000000..c5c590322f
--- /dev/null
+++ b/pkg/option/option.go
@@ -0,0 +1,184 @@
+package option
+
+import (
+	"encoding/json"
+	"fmt"
+	"reflect"
+	"strings"
+
+	"github.com/cockroachdb/errors"
+	"github.com/google/go-cmp/cmp"
+)
+
+// Option is a type that represents a value that may or may not be present
+//
+// It is different a normal value as it can distinguish between a zero value and a missing value
+// even on pointer types
+type Option[T any] struct {
+	value   T
+	present bool
+}
+
+func (o *Option[T]) MarshalJSON() ([]byte, error) {
+	if !o.present {
+		return []byte("null"), nil
+	}
+	return json.Marshal(o.value)
+}
+
+func (o *Option[T]) UnmarshalJSON(data []byte) error {
+	if string(data) == "null" {
+		o.present = false
+		return nil
+	}
+
+	o.present = true
+	return json.Unmarshal(data, &o.value)
+}
+
+// CmpOpts returns the options to use to compare options
+// by checking the unexported fields. For testing purposes.
+func CmpOpts() []cmp.Option {
+	return []cmp.Option{
+		cmp.Exporter(func(rt reflect.Type) bool {
+			return rt.PkgPath() == "encr.dev/pkg/option" && strings.HasPrefix(rt.Name(), "Option[")
+		}),
+	}
+}
+
+// AsOptional returns an Option where a zero value T is considered None
+// and any other value is considered Some
+//
+// i.e.
+//
+//	AsOptional(nil) == None()
+//	AsOptional(0) == None()
+//	AsOptional(false) == None()
+//	AsOptional("") == None()
+//	AsOptional(&MyStruct{}) == Some(&MyStruct{})
+//	AsOptional(1) == Some(1)
+//	AsOptional(true) == Some(true)
+func AsOptional[T comparable](v T) Option[T] {
+	var zero T
+	if v == zero {
+		return None[T]()
+	}
+	return Some[T](v)
+}
+
+// FromPointer returns an Option where a nil pointer is considered None
+// and any other value is considered Some, with the value dereferenced.
+func FromPointer[T any](v *T) Option[T] {
+	if v == nil {
+		return None[T]()
+	}
+	return Some[T](*v)
+}
+
+// Some returns an Option with the given value and present set to true
+//
+// This means Some(nil) is a valid present Option
+// and Some(nil) != None()
+func Some[T any](v T) Option[T] {
+	return Option[T]{value: v, present: true}
+}
+
+// None returns an Option with no value set
+func None[T any]() Option[T] {
+	return Option[T]{present: false}
+}
+
+// CommaOk is a helper function to convert a comma ok idiom into an Option.
+// If ok is true it returns Some(v), otherwise it returns None.
+func CommaOk[T any](v T, ok bool) Option[T] {
+	if ok {
+		return Some[T](v)
+	}
+	return None[T]()
+}
+
+// Present returns true if the Option has a value set
+func (o Option[T]) Present() bool {
+	return o.present
+}
+
+// Empty returns true if the Option has no value set
+func (o Option[T]) Empty() bool {
+	return !o.present
+}
+
+// OrElse returns an Option with the value if present, otherwise returns the alternative value
+func (o Option[T]) OrElse(alternative T) Option[T] {
+	if o.present {
+		return o
+	}
+	return Some(alternative)
+}
+
+// Get gets the option value and returns ok==true if present.
+func (o Option[T]) Get() (val T, ok bool) {
+	return o.value, o.present
+}
+
+// GetOrElse returns the value if present, otherwise returns the alternative value
+func (o Option[T]) GetOrElse(alternative T) T {
+	if o.present {
+		return o.value
+	}
+	return alternative
+}
+
+// GetOrElseF returns the value if present, otherwise returns the alternative value
+func (o Option[T]) GetOrElseF(alternative func() T) T {
+	if o.present {
+		return o.value
+	}
+	return alternative()
+}
+
+// MustGet returns the value if present, otherwise panics
+func (o Option[T]) MustGet() (rtn T) {
+	if o.present {
+		return o.value
+	}
+	panic(errors.Newf("Option value is not set: %T", rtn))
+}
+
+// ForAll calls the given function with the value if present
+func (o Option[T]) ForAll(f func(v T)) {
+	if o.present {
+		f(o.value)
+	}
+}
+
+// ForEach returns true if the Option is empty or the given predicate returns true on the value
+func (o Option[T]) ForEach(predicate func(v T) bool) bool {
+	if o.present {
+		return predicate(o.value)
+	}
+	return true
+}
+
+// Contains returns true if the Option is present and the given predicate returns true on the value
+// otherwise returns false
+func (o Option[T]) Contains(predicate func(v T) bool) bool {
+	if o.present {
+		return predicate(o.value)
+	}
+	return false
+}
+
+func (o Option[T]) String() string {
+	if o.present {
+		return fmt.Sprintf("%v", o.value)
+	}
+	return "None"
+}
+
+// PtrOrNil returns the value as a pointer, if present, or nil otherwise.
+func (o Option[T]) PtrOrNil() *T {
+	if o.present {
+		return &o.value
+	}
+	return nil
+}
diff --git a/pkg/option/pkgfn.go b/pkg/option/pkgfn.go
new file mode 100644
index 0000000000..1fc7acfed2
--- /dev/null
+++ b/pkg/option/pkgfn.go
@@ -0,0 +1,41 @@
+package option
+
+// Contains returns true if the option is present and matches the given value
+func Contains[T comparable](option Option[T], matches T) bool {
+	if option.present {
+		return option.value == matches
+	}
+	return false
+}
+
+// Map returns an Option with the value mapped by the given function if present, otherwise returns None
+func Map[T, R any](option Option[T], f func(T) R) Option[R] {
+	if option.present {
+		return Some(f(option.value))
+	}
+	return None[R]()
+}
+
+// FlatMap returns an Option with the value mapped by the given function if present, otherwise returns None
+func FlatMap[T, R any](option Option[T], f func(T) Option[R]) Option[R] {
+	if option.present {
+		return f(option.value)
+	}
+	return None[R]()
+}
+
+// Fold returns the result of f applied to the value if present, otherwise returns the defaultValue
+func Fold[T, R any](option Option[T], defaultValue R, f func(T) R) R {
+	if option.present {
+		return f(option.value)
+	}
+	return defaultValue
+}
+
+// FoldLeft applies the binary operator f to the value if present, otherwise returns the zero value
+func FoldLeft[T, R any](option Option[T], zero R, f func(accum R, value T) R) R {
+	if option.present {
+		return f(zero, option.value)
+	}
+	return zero
+}
diff --git a/pkg/paths/paths.go b/pkg/paths/paths.go
new file mode 100644
index 0000000000..6d83a3bb10
--- /dev/null
+++ b/pkg/paths/paths.go
@@ -0,0 +1,299 @@
+package paths
+
+import (
+	"path"
+	"path/filepath"
+	"strings"
+
+	"encr.dev/pkg/fns"
+)
+
+type FileReader func(string) ([]byte, error)
+
+// RootedFSPath returns a new FS path.
+// It should typically not be used except for at parser initialization.
+// Use FS.Join, FS.New, or FS.Resolve instead to preserve the working dir.
+func RootedFSPath(wd, p string) FS {
+	if wd == "" {
+		panic("paths: empty wd")
+	} else if !filepath.IsAbs(wd) {
+		panic("paths: wd is relative")
+	}
+
+	if filepath.IsAbs(p) {
+		return FS(filepath.Clean(p))
+	} else {
+		return FS(filepath.Join(wd, p))
+	}
+}
+
+// FS represents a filesystem path.
+//
+// It is an absolute path, and is always in the OS-specific format.
+type FS string
+
+// ToIO returns the path for use in IO operations.
+func (fs FS) ToIO() string {
+	fs.checkValid()
+	return string(fs)
+}
+
+// ToDisplay returns the path in a form suitable for displaying
+// to the user.
+func (fs FS) ToDisplay() string {
+	fs.checkValid()
+	return string(fs)
+}
+
+// Resolve returns a new FS path to the given path.
+// If p is absolute it returns p directly,
+// otherwise it returns the path joined with the current path.
+func (fs FS) Resolve(p string) FS {
+	fs.checkValid()
+	if filepath.IsAbs(p) {
+		return FS(filepath.Clean(p))
+	}
+	return FS(filepath.Join(string(fs), p))
+}
+
+// Join joins the path with the given elems, according to filepath.Join.
+func (fs FS) Join(elem ...string) FS {
+	fs.checkValid()
+	parts := append([]string{string(fs)}, elem...)
+	return FS(filepath.Join(parts...))
+}
+
+func (fs FS) JoinSlash(rel RelSlash) FS {
+	return fs.Join(filepath.FromSlash(rel.ToIO()))
+}
+
+// Base returns the filepath.Base of the path.
+func (fs FS) Base() string {
+	fs.checkValid()
+	return filepath.Base(string(fs))
+}
+
+// Dir returns the filepath.Dir of the path.
+func (fs FS) Dir() FS {
+	fs.checkValid()
+	return FS(filepath.Dir(string(fs)))
+}
+
+// HasPrefix reports whether fs is a descendant of other
+// or is equal to other. (i.e. it is the given path or a subdirectory of it)
+func (fs FS) HasPrefix(other FS) bool {
+	fs.checkValid()
+	other.checkValid()
+
+	// Note: we use filepath.Rel instead of strings.HasPrefix with filepath.Abs
+	// because that wouldn't work on case-insensitive filesystems.
+	rel, err := filepath.Rel(string(other), string(fs))
+	if err != nil {
+		return false
+	}
+
+	return filepath.IsLocal(rel)
+}
+
+func (fs FS) checkValid() {
+	if fs == "" {
+		panic("empty FS path")
+	}
+}
+
+// ValidPkgPath reports whether a given module path is valid.
+func ValidPkgPath(p string) bool {
+	return p != ""
+}
+
+// PkgPath returns a new Pkg path for p. If p is not a valid
+// package path it reports "", false.
+func PkgPath(p string) (Pkg, bool) {
+	if !ValidPkgPath(p) {
+		return "", false
+	}
+	return Pkg(p), true
+}
+
+func MustPkgPath(p string) Pkg {
+	if !ValidPkgPath(p) {
+		panic("invalid Package path")
+	}
+	return Pkg(p)
+}
+
+// Pkg represents a package path within a module.
+// It is always slash-separated.
+type Pkg string
+
+// String returns the string representation of p.
+func (p Pkg) String() string {
+	return string(p)
+}
+
+// JoinSlash joins the path with the given elems, according to path.Join.
+// The elems are expected to be slash-separated, not filesystem-separated.
+// Use filesystem.ToSlash() to convert filesystem paths to slash-separated paths.
+func (p Pkg) JoinSlash(elem ...RelSlash) Pkg {
+	p.checkValid()
+	strs := make([]string, len(elem)+1)
+	strs[0] = string(p)
+	copy(strs[1:], fns.Map(elem, RelSlash.String))
+	return Pkg(path.Join(strs...)) // Join cleans the result
+}
+
+func (p Pkg) checkValid() {
+	if p == "" {
+		panic("invalid Pkg path")
+	}
+}
+
+// LexicallyContains reports whether the given package path contains the package path p
+// as a "sub-package".
+func (p Pkg) LexicallyContains(other Pkg) bool {
+	p.checkValid()
+	if other == "" {
+		return false
+	}
+	return p == other || strings.HasPrefix(string(other), string(p)+"/")
+}
+
+const stdModule = "std"
+
+// Mod represents a module path.
+// It is always slash-separated.
+type Mod string
+
+// ValidModPath reports whether a given module path is valid.
+func ValidModPath(p string) bool {
+	return p != ""
+}
+
+// MustModPath returns a new Mod path for p.
+func MustModPath(p string) Mod {
+	if !ValidModPath(p) {
+		panic("invalid Module path")
+	}
+	return Mod(p)
+}
+
+// StdlibMod returns the Mod path representing the standard library.
+func StdlibMod() Mod {
+	return stdModule
+}
+
+// LexicallyContains reports whether the given module path contains the package path p.
+// It only considers the lexical path and ignores whether there exists
+// a nested module that contains p.
+func (m Mod) LexicallyContains(p Pkg) bool {
+	m.checkValid()
+	if p == "" {
+		return false
+	}
+
+	// From the spec:
+	// A module that will never be fetched as a dependency of any other module may use
+	// any valid package path for its module path, but must take care not to collide
+	// with paths that may be used by the module's dependencies or the Go standard
+	// library. The Go standard library uses package paths that do not contain a dot in
+	// the first path element, and the `go` command does not attempt to resolve such
+	// paths from network servers. The paths `example` and `test` are reserved for
+	// users: they will not be used in the standard library and are suitable for use in
+	// self-contained modules, such as those defined in tutorials or example code or
+	// created and manipulated as part of a test.
+
+	ms, ps := string(m), string(p)
+	if m == stdModule {
+		// Treat any dotless package path as being contained, as long as
+		// it's not one of the reserved paths.
+		if first, _, _ := strings.Cut(ps, "/"); strings.Contains(first, ".") {
+			return false
+		} else if first == "example" || first == "tests" {
+			// Reserved; guaranteed not to be part of std
+			return false
+		}
+		return true
+	}
+
+	// We can treat the module path as a package path for this purpose.
+	return ms == ps || strings.HasPrefix(ps, ms+"/")
+}
+
+// RelativePathToPkg returns the relative path from the module to the package.
+// If the package is not contained within the module it reports "", false.
+func (m Mod) RelativePathToPkg(p Pkg) (relative RelSlash, ok bool) {
+	m.checkValid()
+	p.checkValid()
+	if !m.LexicallyContains(p) {
+		return "", false
+	}
+
+	// The module path is a prefix of the package path.
+	// Remove the module path and the leading slash.
+	if m == stdModule {
+		return RelSlash(p), true
+	}
+
+	// Is the package path the same as the module path?
+	if string(p) == string(m) {
+		return ".", true
+	}
+
+	suffix, ok := strings.CutPrefix(string(p), string(m)+"/")
+	if !ok {
+		return "", false
+	}
+	return RelSlash(suffix), true
+}
+
+func (m Mod) Pkg(rel RelSlash) Pkg {
+	m.checkValid()
+	if m == stdModule {
+		return Pkg(rel)
+	}
+	return Pkg(path.Join(string(m), string(rel)))
+}
+
+func (m Mod) checkValid() {
+	if m == "" {
+		panic("invalid Module path")
+	}
+}
+
+// IsStdlib reports whether m represents the standard library.
+func (m Mod) IsStdlib() bool {
+	return m == stdModule
+}
+
+// RelSlash is a relative path that is always slash-separated.
+type RelSlash string
+
+// ToIO converts the slash-separated path to a filesystem path
+// using filepath.FromSlash.
+func (p RelSlash) ToIO() string {
+	return filepath.FromSlash(string(p))
+}
+
+// Join joins the path with the given elems, according to path.Join.
+func (rel RelSlash) Join(elem ...string) RelSlash {
+	parts := append([]string{string(rel)}, elem...)
+	return RelSlash(path.Join(parts...))
+}
+
+func (p RelSlash) String() string {
+	return string(p)
+}
+
+// MainModuleRelSlash is like RelSlash, but it's always relative to the application's
+// main module directory.
+type MainModuleRelSlash string
+
+// ToIO converts the slash-separated path to a filesystem path
+// using filepath.FromSlash.
+func (p MainModuleRelSlash) ToIO(mainModDir FS) string {
+	return mainModDir.Join(filepath.FromSlash(string(p))).ToIO()
+}
+
+func (p MainModuleRelSlash) String() string {
+	return string(p)
+}
diff --git a/pkg/pgproxy/README.md b/pkg/pgproxy/README.md
index 7cd8390dcd..83ed7b6d8f 100644
--- a/pkg/pgproxy/README.md
+++ b/pkg/pgproxy/README.md
@@ -1,11 +1,6 @@
 # pgproxy
 
-PGProxy is a proxy for the Postgres wire protocol that allows for
-customizing authentication and backend selection by overriding
-the startup message flow.
+pgproxy is a flexible proxy for the Postgres wire protocol that allows for customizing authentication and backend selection by breaking apart the startup message flow between frontend and backend.
 
-Once authenticated, PGProxy falls back to being a dumb proxy
+Once authenticated, it falls back to being a dumb proxy
 that simple shuffles bytes back and forth.
-
-Internally pgproxy vendors simplified versions of the excellent
-[pgproto3](https://github.com/jackc/pgproto3) and [pgio](https://github.com/jackc/pgio).
\ No newline at end of file
diff --git a/pkg/pgproxy/internal/pgio/LICENSE b/pkg/pgproxy/internal/pgio/LICENSE
deleted file mode 100644
index c1c4f50fc6..0000000000
--- a/pkg/pgproxy/internal/pgio/LICENSE
+++ /dev/null
@@ -1,22 +0,0 @@
-Copyright (c) 2019 Jack Christensen
-
-MIT License
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/pkg/pgproxy/internal/pgio/doc.go b/pkg/pgproxy/internal/pgio/doc.go
deleted file mode 100644
index ef2dcc7f72..0000000000
--- a/pkg/pgproxy/internal/pgio/doc.go
+++ /dev/null
@@ -1,6 +0,0 @@
-// Package pgio is a low-level toolkit building messages in the PostgreSQL wire protocol.
-/*
-pgio provides functions for appending integers to a []byte while doing byte
-order conversion.
-*/
-package pgio
diff --git a/pkg/pgproxy/internal/pgio/write.go b/pkg/pgproxy/internal/pgio/write.go
deleted file mode 100644
index 67800bac91..0000000000
--- a/pkg/pgproxy/internal/pgio/write.go
+++ /dev/null
@@ -1,89 +0,0 @@
-package pgio
-
-import (
-	"encoding/binary"
-	"fmt"
-	"io"
-)
-
-func AppendUint16(buf []byte, n uint16) []byte {
-	wp := len(buf)
-	buf = append(buf, 0, 0)
-	binary.BigEndian.PutUint16(buf[wp:], n)
-	return buf
-}
-
-func AppendUint32(buf []byte, n uint32) []byte {
-	wp := len(buf)
-	buf = append(buf, 0, 0, 0, 0)
-	binary.BigEndian.PutUint32(buf[wp:], n)
-	return buf
-}
-
-func AppendUint64(buf []byte, n uint64) []byte {
-	wp := len(buf)
-	buf = append(buf, 0, 0, 0, 0, 0, 0, 0, 0)
-	binary.BigEndian.PutUint64(buf[wp:], n)
-	return buf
-}
-
-func AppendInt16(buf []byte, n int16) []byte {
-	return AppendUint16(buf, uint16(n))
-}
-
-func AppendInt32(buf []byte, n int32) []byte {
-	return AppendUint32(buf, uint32(n))
-}
-
-func AppendInt64(buf []byte, n int64) []byte {
-	return AppendUint64(buf, uint64(n))
-}
-
-func SetInt32(buf []byte, n int32) {
-	binary.BigEndian.PutUint32(buf, uint32(n))
-}
-
-type PgMsg interface {
-	Encode(dst []byte) []byte
-	Decode(src []byte) error
-}
-
-func WriteMsg(conn io.Writer, msg PgMsg) error {
-	_, err := conn.Write(msg.Encode(nil))
-	return err
-}
-
-type RawMsg struct {
-	Typ byte
-	Buf []byte
-}
-
-func (r *RawMsg) Decode(src []byte) error {
-	return fmt.Errorf("pgio: cannot decode into RawMsg")
-}
-
-func (r *RawMsg) Encode(dst []byte) []byte {
-	dst = append(dst, r.Typ)
-	sp := len(dst)
-	dst = AppendInt32(dst, -1)
-	dst = append(dst, r.Buf...)
-	SetInt32(dst[sp:], int32(len(dst[sp:])))
-	return dst
-}
-
-func ReadMsg(conn io.Reader) (*RawMsg, error) {
-	var hdr [5]byte
-	if _, err := io.ReadFull(conn, hdr[:]); err != nil {
-		return nil, err
-	}
-	bodyLen := int(binary.BigEndian.Uint32(hdr[1:5])) - 4
-	if bodyLen > (1 << 20) {
-		// don't support messages from frontend longer than 1MiB.
-		return nil, fmt.Errorf("too long message: %d bytes", bodyLen)
-	}
-	buf := make([]byte, bodyLen)
-	if _, err := io.ReadFull(conn, buf); err != nil {
-		return nil, err
-	}
-	return &RawMsg{Typ: hdr[0], Buf: buf}, nil
-}
diff --git a/pkg/pgproxy/internal/pgio/write_test.go b/pkg/pgproxy/internal/pgio/write_test.go
deleted file mode 100644
index bd50e71cfd..0000000000
--- a/pkg/pgproxy/internal/pgio/write_test.go
+++ /dev/null
@@ -1,78 +0,0 @@
-package pgio
-
-import (
-	"reflect"
-	"testing"
-)
-
-func TestAppendUint16NilBuf(t *testing.T) {
-	buf := AppendUint16(nil, 1)
-	if !reflect.DeepEqual(buf, []byte{0, 1}) {
-		t.Errorf("AppendUint16(nil, 1) => %v, want %v", buf, []byte{0, 1})
-	}
-}
-
-func TestAppendUint16EmptyBuf(t *testing.T) {
-	buf := []byte{}
-	buf = AppendUint16(buf, 1)
-	if !reflect.DeepEqual(buf, []byte{0, 1}) {
-		t.Errorf("AppendUint16(nil, 1) => %v, want %v", buf, []byte{0, 1})
-	}
-}
-
-func TestAppendUint16BufWithCapacityDoesNotAllocate(t *testing.T) {
-	buf := make([]byte, 0, 4)
-	AppendUint16(buf, 1)
-	buf = buf[0:2]
-	if !reflect.DeepEqual(buf, []byte{0, 1}) {
-		t.Errorf("AppendUint16(nil, 1) => %v, want %v", buf, []byte{0, 1})
-	}
-}
-
-func TestAppendUint32NilBuf(t *testing.T) {
-	buf := AppendUint32(nil, 1)
-	if !reflect.DeepEqual(buf, []byte{0, 0, 0, 1}) {
-		t.Errorf("AppendUint32(nil, 1) => %v, want %v", buf, []byte{0, 0, 0, 1})
-	}
-}
-
-func TestAppendUint32EmptyBuf(t *testing.T) {
-	buf := []byte{}
-	buf = AppendUint32(buf, 1)
-	if !reflect.DeepEqual(buf, []byte{0, 0, 0, 1}) {
-		t.Errorf("AppendUint32(nil, 1) => %v, want %v", buf, []byte{0, 0, 0, 1})
-	}
-}
-
-func TestAppendUint32BufWithCapacityDoesNotAllocate(t *testing.T) {
-	buf := make([]byte, 0, 4)
-	AppendUint32(buf, 1)
-	buf = buf[0:4]
-	if !reflect.DeepEqual(buf, []byte{0, 0, 0, 1}) {
-		t.Errorf("AppendUint32(nil, 1) => %v, want %v", buf, []byte{0, 0, 0, 1})
-	}
-}
-
-func TestAppendUint64NilBuf(t *testing.T) {
-	buf := AppendUint64(nil, 1)
-	if !reflect.DeepEqual(buf, []byte{0, 0, 0, 0, 0, 0, 0, 1}) {
-		t.Errorf("AppendUint64(nil, 1) => %v, want %v", buf, []byte{0, 0, 0, 0, 0, 0, 0, 1})
-	}
-}
-
-func TestAppendUint64EmptyBuf(t *testing.T) {
-	buf := []byte{}
-	buf = AppendUint64(buf, 1)
-	if !reflect.DeepEqual(buf, []byte{0, 0, 0, 0, 0, 0, 0, 1}) {
-		t.Errorf("AppendUint64(nil, 1) => %v, want %v", buf, []byte{0, 0, 0, 0, 0, 0, 0, 1})
-	}
-}
-
-func TestAppendUint64BufWithCapacityDoesNotAllocate(t *testing.T) {
-	buf := make([]byte, 0, 8)
-	AppendUint64(buf, 1)
-	buf = buf[0:8]
-	if !reflect.DeepEqual(buf, []byte{0, 0, 0, 0, 0, 0, 0, 1}) {
-		t.Errorf("AppendUint64(nil, 1) => %v, want %v", buf, []byte{0, 0, 0, 0, 0, 0, 0, 1})
-	}
-}
diff --git a/pkg/pgproxy/internal/pgproto3/LICENSE b/pkg/pgproxy/internal/pgproto3/LICENSE
deleted file mode 100644
index c1c4f50fc6..0000000000
--- a/pkg/pgproxy/internal/pgproto3/LICENSE
+++ /dev/null
@@ -1,22 +0,0 @@
-Copyright (c) 2019 Jack Christensen
-
-MIT License
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/pkg/pgproxy/internal/pgproto3/authentication.go b/pkg/pgproxy/internal/pgproto3/authentication.go
deleted file mode 100644
index 134eabc763..0000000000
--- a/pkg/pgproxy/internal/pgproto3/authentication.go
+++ /dev/null
@@ -1,54 +0,0 @@
-package pgproto3
-
-import (
-	"encoding/binary"
-	"fmt"
-
-	"encr.dev/pkg/pgproxy/internal/pgio"
-)
-
-const (
-	AuthTypeOk                = 0
-	AuthTypeCleartextPassword = 3
-	AuthTypeMD5Password       = 5
-)
-
-type Authentication struct {
-	Type uint32
-
-	// MD5Password fields
-	Salt [4]byte
-}
-
-func (*Authentication) Backend() {}
-
-func (dst *Authentication) Decode(src []byte) error {
-	*dst = Authentication{Type: binary.BigEndian.Uint32(src[:4])}
-
-	switch dst.Type {
-	case AuthTypeOk:
-	case AuthTypeCleartextPassword:
-	case AuthTypeMD5Password:
-		copy(dst.Salt[:], src[4:8])
-	default:
-		return fmt.Errorf("unknown authentication type: %d", dst.Type)
-	}
-
-	return nil
-}
-
-func (src *Authentication) Encode(dst []byte) []byte {
-	dst = append(dst, 'R')
-	sp := len(dst)
-	dst = pgio.AppendInt32(dst, -1)
-	dst = pgio.AppendUint32(dst, src.Type)
-
-	switch src.Type {
-	case AuthTypeMD5Password:
-		dst = append(dst, src.Salt[:]...)
-	}
-
-	pgio.SetInt32(dst[sp:], int32(len(dst[sp:])))
-
-	return dst
-}
diff --git a/pkg/pgproxy/internal/pgproto3/backend_key_data.go b/pkg/pgproxy/internal/pgproto3/backend_key_data.go
deleted file mode 100644
index 6cc5e8ec99..0000000000
--- a/pkg/pgproxy/internal/pgproto3/backend_key_data.go
+++ /dev/null
@@ -1,46 +0,0 @@
-package pgproto3
-
-import (
-	"encoding/binary"
-	"encoding/json"
-
-	"encr.dev/pkg/pgproxy/internal/pgio"
-)
-
-type BackendKeyData struct {
-	ProcessID uint32
-	SecretKey uint32
-}
-
-func (*BackendKeyData) Backend() {}
-
-func (dst *BackendKeyData) Decode(src []byte) error {
-	if len(src) != 8 {
-		return &invalidMessageLenErr{messageType: "BackendKeyData", expectedLen: 8, actualLen: len(src)}
-	}
-
-	dst.ProcessID = binary.BigEndian.Uint32(src[:4])
-	dst.SecretKey = binary.BigEndian.Uint32(src[4:])
-
-	return nil
-}
-
-func (src *BackendKeyData) Encode(dst []byte) []byte {
-	dst = append(dst, 'K')
-	dst = pgio.AppendUint32(dst, 12)
-	dst = pgio.AppendUint32(dst, src.ProcessID)
-	dst = pgio.AppendUint32(dst, src.SecretKey)
-	return dst
-}
-
-func (src *BackendKeyData) MarshalJSON() ([]byte, error) {
-	return json.Marshal(struct {
-		Type      string
-		ProcessID uint32
-		SecretKey uint32
-	}{
-		Type:      "BackendKeyData",
-		ProcessID: src.ProcessID,
-		SecretKey: src.SecretKey,
-	})
-}
diff --git a/pkg/pgproxy/internal/pgproto3/big_endian.go b/pkg/pgproxy/internal/pgproto3/big_endian.go
deleted file mode 100644
index f7bdb97eb7..0000000000
--- a/pkg/pgproxy/internal/pgproto3/big_endian.go
+++ /dev/null
@@ -1,37 +0,0 @@
-package pgproto3
-
-import (
-	"encoding/binary"
-)
-
-type BigEndianBuf [8]byte
-
-func (b BigEndianBuf) Int16(n int16) []byte {
-	buf := b[0:2]
-	binary.BigEndian.PutUint16(buf, uint16(n))
-	return buf
-}
-
-func (b BigEndianBuf) Uint16(n uint16) []byte {
-	buf := b[0:2]
-	binary.BigEndian.PutUint16(buf, n)
-	return buf
-}
-
-func (b BigEndianBuf) Int32(n int32) []byte {
-	buf := b[0:4]
-	binary.BigEndian.PutUint32(buf, uint32(n))
-	return buf
-}
-
-func (b BigEndianBuf) Uint32(n uint32) []byte {
-	buf := b[0:4]
-	binary.BigEndian.PutUint32(buf, n)
-	return buf
-}
-
-func (b BigEndianBuf) Int64(n int64) []byte {
-	buf := b[0:8]
-	binary.BigEndian.PutUint64(buf, uint64(n))
-	return buf
-}
diff --git a/pkg/pgproxy/internal/pgproto3/cancel_request.go b/pkg/pgproxy/internal/pgproto3/cancel_request.go
deleted file mode 100644
index 8ff5192c79..0000000000
--- a/pkg/pgproxy/internal/pgproto3/cancel_request.go
+++ /dev/null
@@ -1,58 +0,0 @@
-package pgproto3
-
-import (
-	"encoding/binary"
-	"encoding/json"
-	"errors"
-
-	"encr.dev/pkg/pgproxy/internal/pgio"
-)
-
-const CancelRequestCode = 80877102
-
-type CancelRequest struct {
-	ProcessID uint32
-	SecretKey uint32
-}
-
-// Frontend identifies this message as sendable by a PostgreSQL frontend.
-func (*CancelRequest) Frontend() {}
-
-func (dst *CancelRequest) Decode(src []byte) error {
-	if len(src) != 12 {
-		return errors.New("bad cancel request size")
-	}
-
-	requestCode := binary.BigEndian.Uint32(src)
-
-	if requestCode != CancelRequestCode {
-		return errors.New("bad cancel request code")
-	}
-
-	dst.ProcessID = binary.BigEndian.Uint32(src[4:])
-	dst.SecretKey = binary.BigEndian.Uint32(src[8:])
-
-	return nil
-}
-
-// Encode encodes src into dst. dst will include the 4 byte message length.
-func (src *CancelRequest) Encode(dst []byte) []byte {
-	dst = pgio.AppendInt32(dst, 16)
-	dst = pgio.AppendInt32(dst, CancelRequestCode)
-	dst = pgio.AppendUint32(dst, src.ProcessID)
-	dst = pgio.AppendUint32(dst, src.SecretKey)
-	return dst
-}
-
-// MarshalJSON implements encoding/json.Marshaler.
-func (src CancelRequest) MarshalJSON() ([]byte, error) {
-	return json.Marshal(struct {
-		Type      string
-		ProcessID uint32
-		SecretKey uint32
-	}{
-		Type:      "CancelRequest",
-		ProcessID: src.ProcessID,
-		SecretKey: src.SecretKey,
-	})
-}
diff --git a/pkg/pgproxy/internal/pgproto3/error_response.go b/pkg/pgproxy/internal/pgproto3/error_response.go
deleted file mode 100644
index 987fe38ac6..0000000000
--- a/pkg/pgproxy/internal/pgproto3/error_response.go
+++ /dev/null
@@ -1,214 +0,0 @@
-package pgproto3
-
-import (
-	"bytes"
-	"encoding/binary"
-	"strconv"
-)
-
-type ErrorResponse struct {
-	Severity         string
-	Code             string
-	Message          string
-	Detail           string
-	Hint             string
-	Position         int32
-	InternalPosition int32
-	InternalQuery    string
-	Where            string
-	SchemaName       string
-	TableName        string
-	ColumnName       string
-	DataTypeName     string
-	ConstraintName   string
-	File             string
-	Line             int32
-	Routine          string
-
-	UnknownFields map[byte]string
-}
-
-func (*ErrorResponse) Backend() {}
-
-func (dst *ErrorResponse) Decode(src []byte) error {
-	*dst = ErrorResponse{}
-
-	buf := bytes.NewBuffer(src)
-
-	for {
-		k, err := buf.ReadByte()
-		if err != nil {
-			return err
-		}
-		if k == 0 {
-			break
-		}
-
-		vb, err := buf.ReadBytes(0)
-		if err != nil {
-			return err
-		}
-		v := string(vb[:len(vb)-1])
-
-		switch k {
-		case 'S':
-			dst.Severity = v
-		case 'C':
-			dst.Code = v
-		case 'M':
-			dst.Message = v
-		case 'D':
-			dst.Detail = v
-		case 'H':
-			dst.Hint = v
-		case 'P':
-			s := v
-			n, _ := strconv.ParseInt(s, 10, 32)
-			dst.Position = int32(n)
-		case 'p':
-			s := v
-			n, _ := strconv.ParseInt(s, 10, 32)
-			dst.InternalPosition = int32(n)
-		case 'q':
-			dst.InternalQuery = v
-		case 'W':
-			dst.Where = v
-		case 's':
-			dst.SchemaName = v
-		case 't':
-			dst.TableName = v
-		case 'c':
-			dst.ColumnName = v
-		case 'd':
-			dst.DataTypeName = v
-		case 'n':
-			dst.ConstraintName = v
-		case 'F':
-			dst.File = v
-		case 'L':
-			s := v
-			n, _ := strconv.ParseInt(s, 10, 32)
-			dst.Line = int32(n)
-		case 'R':
-			dst.Routine = v
-
-		default:
-			if dst.UnknownFields == nil {
-				dst.UnknownFields = make(map[byte]string)
-			}
-			dst.UnknownFields[k] = v
-		}
-	}
-
-	return nil
-}
-
-func (src *ErrorResponse) Encode(dst []byte) []byte {
-	return append(dst, src.marshalBinary('E')...)
-}
-
-func (src *ErrorResponse) marshalBinary(typeByte byte) []byte {
-	var bigEndian BigEndianBuf
-	buf := &bytes.Buffer{}
-
-	buf.WriteByte(typeByte)
-	buf.Write(bigEndian.Uint32(0))
-
-	if src.Severity != "" {
-		buf.WriteByte('S')
-		buf.WriteString(src.Severity)
-		buf.WriteByte(0)
-	}
-	if src.Code != "" {
-		buf.WriteByte('C')
-		buf.WriteString(src.Code)
-		buf.WriteByte(0)
-	}
-	if src.Message != "" {
-		buf.WriteByte('M')
-		buf.WriteString(src.Message)
-		buf.WriteByte(0)
-	}
-	if src.Detail != "" {
-		buf.WriteByte('D')
-		buf.WriteString(src.Detail)
-		buf.WriteByte(0)
-	}
-	if src.Hint != "" {
-		buf.WriteByte('H')
-		buf.WriteString(src.Hint)
-		buf.WriteByte(0)
-	}
-	if src.Position != 0 {
-		buf.WriteByte('P')
-		buf.WriteString(strconv.Itoa(int(src.Position)))
-		buf.WriteByte(0)
-	}
-	if src.InternalPosition != 0 {
-		buf.WriteByte('p')
-		buf.WriteString(strconv.Itoa(int(src.InternalPosition)))
-		buf.WriteByte(0)
-	}
-	if src.InternalQuery != "" {
-		buf.WriteByte('q')
-		buf.WriteString(src.InternalQuery)
-		buf.WriteByte(0)
-	}
-	if src.Where != "" {
-		buf.WriteByte('W')
-		buf.WriteString(src.Where)
-		buf.WriteByte(0)
-	}
-	if src.SchemaName != "" {
-		buf.WriteByte('s')
-		buf.WriteString(src.SchemaName)
-		buf.WriteByte(0)
-	}
-	if src.TableName != "" {
-		buf.WriteByte('t')
-		buf.WriteString(src.TableName)
-		buf.WriteByte(0)
-	}
-	if src.ColumnName != "" {
-		buf.WriteByte('c')
-		buf.WriteString(src.ColumnName)
-		buf.WriteByte(0)
-	}
-	if src.DataTypeName != "" {
-		buf.WriteByte('d')
-		buf.WriteString(src.DataTypeName)
-		buf.WriteByte(0)
-	}
-	if src.ConstraintName != "" {
-		buf.WriteByte('n')
-		buf.WriteString(src.ConstraintName)
-		buf.WriteByte(0)
-	}
-	if src.File != "" {
-		buf.WriteByte('F')
-		buf.WriteString(src.File)
-		buf.WriteByte(0)
-	}
-	if src.Line != 0 {
-		buf.WriteByte('L')
-		buf.WriteString(strconv.Itoa(int(src.Line)))
-		buf.WriteByte(0)
-	}
-	if src.Routine != "" {
-		buf.WriteByte('R')
-		buf.WriteString(src.Routine)
-		buf.WriteByte(0)
-	}
-
-	for k, v := range src.UnknownFields {
-		buf.WriteByte(k)
-		buf.WriteByte(0)
-		buf.WriteString(v)
-		buf.WriteByte(0)
-	}
-	buf.WriteByte(0)
-
-	binary.BigEndian.PutUint32(buf.Bytes()[1:5], uint32(buf.Len()-1))
-
-	return buf.Bytes()
-}
diff --git a/pkg/pgproxy/internal/pgproto3/password_message.go b/pkg/pgproxy/internal/pgproto3/password_message.go
deleted file mode 100644
index 22429f9366..0000000000
--- a/pkg/pgproxy/internal/pgproto3/password_message.go
+++ /dev/null
@@ -1,46 +0,0 @@
-package pgproto3
-
-import (
-	"bytes"
-	"encoding/json"
-
-	"encr.dev/pkg/pgproxy/internal/pgio"
-)
-
-type PasswordMessage struct {
-	Password string
-}
-
-func (*PasswordMessage) Frontend() {}
-
-func (dst *PasswordMessage) Decode(src []byte) error {
-	buf := bytes.NewBuffer(src)
-
-	b, err := buf.ReadBytes(0)
-	if err != nil {
-		return err
-	}
-	dst.Password = string(b[:len(b)-1])
-
-	return nil
-}
-
-func (src *PasswordMessage) Encode(dst []byte) []byte {
-	dst = append(dst, 'p')
-	dst = pgio.AppendInt32(dst, int32(4+len(src.Password)+1))
-
-	dst = append(dst, src.Password...)
-	dst = append(dst, 0)
-
-	return dst
-}
-
-func (src *PasswordMessage) MarshalJSON() ([]byte, error) {
-	return json.Marshal(struct {
-		Type     string
-		Password string
-	}{
-		Type:     "PasswordMessage",
-		Password: src.Password,
-	})
-}
diff --git a/pkg/pgproxy/internal/pgproto3/pgproto3.go b/pkg/pgproxy/internal/pgproto3/pgproto3.go
deleted file mode 100644
index fe7b085bcb..0000000000
--- a/pkg/pgproxy/internal/pgproto3/pgproto3.go
+++ /dev/null
@@ -1,42 +0,0 @@
-package pgproto3
-
-import "fmt"
-
-// Message is the interface implemented by an object that can decode and encode
-// a particular PostgreSQL message.
-type Message interface {
-	// Decode is allowed and expected to retain a reference to data after
-	// returning (unlike encoding.BinaryUnmarshaler).
-	Decode(data []byte) error
-
-	// Encode appends itself to dst and returns the new buffer.
-	Encode(dst []byte) []byte
-}
-
-type FrontendMessage interface {
-	Message
-	Frontend() // no-op method to distinguish frontend from backend methods
-}
-
-type BackendMessage interface {
-	Message
-	Backend() // no-op method to distinguish frontend from backend methods
-}
-
-type invalidMessageLenErr struct {
-	messageType string
-	expectedLen int
-	actualLen   int
-}
-
-func (e *invalidMessageLenErr) Error() string {
-	return fmt.Sprintf("%s body must have length of %d, but it is %d", e.messageType, e.expectedLen, e.actualLen)
-}
-
-type invalidMessageFormatErr struct {
-	messageType string
-}
-
-func (e *invalidMessageFormatErr) Error() string {
-	return fmt.Sprintf("%s body is invalid", e.messageType)
-}
diff --git a/pkg/pgproxy/internal/pgproto3/ssl_message.go b/pkg/pgproxy/internal/pgproto3/ssl_message.go
deleted file mode 100644
index 2e7845954d..0000000000
--- a/pkg/pgproxy/internal/pgproto3/ssl_message.go
+++ /dev/null
@@ -1,45 +0,0 @@
-package pgproto3
-
-import (
-	"encoding/binary"
-	"encoding/json"
-	"errors"
-
-	"encr.dev/pkg/pgproxy/internal/pgio"
-)
-
-const (
-	sslRequestNumber = 80877103
-)
-
-type SSLMessage struct{}
-
-func (*SSLMessage) Frontend() {}
-
-func (dst *SSLMessage) Decode(src []byte) error {
-	if len(src) != 4 {
-		return errors.New("ssl message too short")
-	}
-
-	if version := binary.BigEndian.Uint32(src); version != sslRequestNumber {
-		return errors.New("bad version number")
-	}
-	return nil
-}
-
-func (src *SSLMessage) Encode(dst []byte) []byte {
-	sp := len(dst)
-	dst = pgio.AppendInt32(dst, -1)
-
-	dst = pgio.AppendUint32(dst, sslRequestNumber)
-	pgio.SetInt32(dst[sp:], int32(len(dst[sp:])))
-	return dst
-}
-
-func (src *SSLMessage) MarshalJSON() ([]byte, error) {
-	return json.Marshal(struct {
-		Type string
-	}{
-		Type: "SSLMessage",
-	})
-}
diff --git a/pkg/pgproxy/internal/pgproto3/startup_message.go b/pkg/pgproxy/internal/pgproto3/startup_message.go
deleted file mode 100644
index cbed6f9c5e..0000000000
--- a/pkg/pgproxy/internal/pgproto3/startup_message.go
+++ /dev/null
@@ -1,97 +0,0 @@
-package pgproto3
-
-import (
-	"bytes"
-	"encoding/binary"
-	"encoding/json"
-	"errors"
-	"fmt"
-
-	"encr.dev/pkg/pgproxy/internal/pgio"
-)
-
-const (
-	ProtocolVersionNumber = 196608 // 3.0
-)
-
-type StartupMessage struct {
-	ProtocolVersion uint32
-	Parameters      map[string]string
-}
-
-func (*StartupMessage) Frontend() {}
-
-func (dst *StartupMessage) Decode(src []byte) error {
-	if len(src) < 4 {
-		return errors.New("startup message too short")
-	}
-
-	dst.ProtocolVersion = binary.BigEndian.Uint32(src)
-	rp := 4
-
-	if dst.ProtocolVersion == sslRequestNumber {
-		return errors.New("can't handle ssl connection request")
-	}
-
-	if dst.ProtocolVersion != ProtocolVersionNumber {
-		return fmt.Errorf("Bad startup message version number. Expected %d, got %d", ProtocolVersionNumber, dst.ProtocolVersion)
-	}
-
-	dst.Parameters = make(map[string]string)
-	for {
-		idx := bytes.IndexByte(src[rp:], 0)
-		if idx < 0 {
-			return &invalidMessageFormatErr{messageType: "StartupMesage"}
-		}
-		key := string(src[rp : rp+idx])
-		rp += idx + 1
-
-		idx = bytes.IndexByte(src[rp:], 0)
-		if idx < 0 {
-			return &invalidMessageFormatErr{messageType: "StartupMesage"}
-		}
-		value := string(src[rp : rp+idx])
-		rp += idx + 1
-
-		dst.Parameters[key] = value
-
-		if len(src[rp:]) == 1 {
-			if src[rp] != 0 {
-				return fmt.Errorf("Bad startup message last byte. Expected 0, got %d", src[rp])
-			}
-			break
-		}
-	}
-
-	return nil
-}
-
-func (src *StartupMessage) Encode(dst []byte) []byte {
-	sp := len(dst)
-	dst = pgio.AppendInt32(dst, -1)
-
-	dst = pgio.AppendUint32(dst, src.ProtocolVersion)
-	for k, v := range src.Parameters {
-		dst = append(dst, k...)
-		dst = append(dst, 0)
-		dst = append(dst, v...)
-		dst = append(dst, 0)
-	}
-	dst = append(dst, 0)
-
-	pgio.SetInt32(dst[sp:], int32(len(dst[sp:])))
-
-	return dst
-}
-
-func (src *StartupMessage) MarshalJSON() ([]byte, error) {
-	return json.Marshal(struct {
-		Type            string
-		ProtocolVersion uint32
-		Parameters      map[string]string
-	}{
-		Type:            "StartupMessage",
-		ProtocolVersion: src.ProtocolVersion,
-		Parameters:      src.Parameters,
-	})
-}
diff --git a/pkg/pgproxy/pgproxy.go b/pkg/pgproxy/pgproxy.go
index dce58d418c..821b00dccc 100644
--- a/pkg/pgproxy/pgproxy.go
+++ b/pkg/pgproxy/pgproxy.go
@@ -9,461 +9,576 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"log"
 	"net"
+	"sync"
 	"time"
 
-	"encr.dev/pkg/pgproxy/internal/pgio"
-	"encr.dev/pkg/pgproxy/internal/pgproto3"
-)
+	"github.com/jackc/pgconn"
+	"github.com/jackc/pgproto3/v2"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
 
-// ErrCancelled is reported when the proxy is closed
-// due to requesting cancellation.
-var ErrCancelled = errors.New("request cancelled")
+	"encr.dev/pkg/fns"
+)
 
-// FrontendMessage represents messages received from the frontend.
-type FrontendMessage interface {
-	pgproto3.FrontendMessage
+type LogicalConn interface {
+	net.Conn
+	Cancel(*CancelData) error
 }
 
-type (
-	StartupMessage = pgproto3.StartupMessage
-	CancelRequest  = pgproto3.CancelRequest
-)
+type HelloData interface {
+	hello()
+}
 
-// AuthData is the authentication data received from the frontend.
-type AuthData struct {
-	Startup  FrontendMessage // *StartupMessage or *CancelRequest
+type StartupData struct {
+	Raw      *pgproto3.StartupMessage
 	Database string
 	Username string
-	Password string // may be empty if ProxyConfig.RequirePassword is false
+	Password string // may be empty if RequirePassword is false
 }
 
-// Proxy proxies the Postgres wire protocol between a client and a server,
-// injecting custom behavior into the authentication and server selection
-// at startup.
-type Proxy struct {
-	Debug    bool
-	frontend *conn
-	backend  *conn
+type CancelData struct {
+	Raw *pgproto3.CancelRequest
 }
 
-// SimpleConfig provides a convenient approach to setting up most common proxy scenarios.
-type SimpleConfig struct {
+func (*StartupData) hello() {}
+func (*CancelData) hello()  {}
+
+type SingleBackendProxy struct {
+	Log             zerolog.Logger
 	RequirePassword bool
 	FrontendTLS     *tls.Config
-	BackendTLS      *tls.Config
-	Debug           bool
+	DialBackend     func(context.Context, *StartupData) (LogicalConn, error)
+
+	gotBackend chan struct{} // closed when first connection is received
+
+	mu      sync.Mutex
+	keyData map[pgproto3.BackendKeyData]LogicalConn
 }
 
-// Proxy begins proxying from frontend to backend.
-func (cfg *SimpleConfig) Proxy(ctx context.Context, frontend, backend io.ReadWriter) error {
-	p := &Proxy{Debug: cfg.Debug}
-	if auth, err := p.FrontendAuth(frontend, cfg.FrontendTLS, cfg.RequirePassword); err != nil {
-		return err
-	} else if _, err := p.BackendAuth(backend, cfg.BackendTLS, auth); err != nil {
-		if errors.Is(err, ErrCancelled) {
-			return nil
+type DatabaseNotFoundError struct {
+	Database string
+}
+
+func (e DatabaseNotFoundError) Error() string {
+	return fmt.Sprintf("database %s not found", e.Database)
+}
+
+func (p *SingleBackendProxy) Serve(ctx context.Context, ln net.Listener) error {
+	defer fns.CloseIgnore(ln)
+	if p.gotBackend != nil {
+		panic("SingleBackendProxy: Serve called twice")
+	}
+	p.gotBackend = make(chan struct{})
+
+	go func() {
+		ctx, cancel := context.WithTimeout(ctx, 10*time.Minute)
+		defer cancel()
+
+		select {
+		case <-p.gotBackend:
+		case <-ctx.Done():
+			_ = ln.Close()
 		}
-		return err
+	}()
+
+	var tempDelay time.Duration // how long to sleep on accept failure
+	gotBackend := false
+	for {
+		frontend, err := ln.Accept()
+		if err != nil {
+			if ne, ok := err.(net.Error); ok && ne.Temporary() {
+				if tempDelay == 0 {
+					tempDelay = 5 * time.Millisecond
+				} else {
+					tempDelay *= 2
+				}
+				if max := 1 * time.Second; tempDelay > max {
+					tempDelay = max
+				}
+				log.Printf("pgproxy: accept error: %v; retrying in %v", err, tempDelay)
+				time.Sleep(tempDelay)
+				continue
+			}
+			return fmt.Errorf("pgproxy: could not accept: %v", err)
+		}
+
+		if !gotBackend {
+			close(p.gotBackend)
+			gotBackend = true
+		}
+
+		go p.ProxyConn(ctx, frontend)
+		tempDelay = 0
 	}
-	return p.Data(ctx)
 }
 
-// FrontendAuth performs the client-side authentication step, and reports the auth data received.
-func (p *Proxy) FrontendAuth(frontend io.ReadWriter, tlsCfg *tls.Config, requirePassword bool) (*AuthData, error) {
-	if _, ok := frontend.(net.Conn); !ok && tlsCfg != nil {
-		panic("pgproxy: frontend connection with TLS must provide a net.Conn")
+func (p *SingleBackendProxy) ProxyConn(ctx context.Context, client net.Conn) {
+	defer fns.CloseIgnore(client)
+
+	cl, err := SetupClient(client, &ClientConfig{
+		TLS:          p.FrontendTLS,
+		WantPassword: p.RequirePassword,
+	})
+	if err != nil {
+		p.Log.Error().Err(err).Msg("unable to setup frontend")
+		return
+	}
+
+	switch data := cl.Hello.(type) {
+	case *StartupData:
+		if err := p.doRunProxy(ctx, cl); err != nil {
+			p.Log.Error().Err(err).Msg("unable to run backend proxy")
+		}
+	case *CancelData:
+		p.cancelRequest(ctx, data)
+	default:
+		p.Log.Error().Msgf("unknown hello message type: %T", data)
 	}
-	p.frontend = &conn{rw: frontend}
-	conn, err := p.negotiateSSL(p.frontend, tlsCfg, false)
+}
+
+func (p *SingleBackendProxy) doRunProxy(ctx context.Context, cl *Client) error {
+	startup := cl.Hello.(*StartupData)
+	server, err := p.DialBackend(ctx, startup)
 	if err != nil {
-		return nil, err
+		_ = cl.Backend.Send(&pgproto3.ErrorResponse{
+			Severity: "FATAL",
+			Message:  err.Error(),
+		})
+		return err
 	}
-	p.frontend = conn
+	defer fns.CloseIgnore(server)
+
+	fe := pgproto3.NewFrontend(pgproto3.NewChunkReader(server), server)
+	log.Trace().Msg("successfully setup server connection")
 
-	startup, err := p.readStartupMsg(p.frontend)
+	err = AuthenticateClient(cl.Backend)
 	if err != nil {
-		return nil, err
+		log.Error().Err(err).Msg("unable to authenticate client")
+		return err
 	}
+	log.Trace().Msg("successfully authenticated client")
 
-	data := &AuthData{Startup: startup}
-	if startup, ok := startup.(*StartupMessage); ok {
-		data.Username = startup.Parameters["user"]
-		data.Database = startup.Parameters["database"]
-		if data.Database == "" {
-			return nil, fmt.Errorf("missing database name in connection string")
-		}
-		if requirePassword {
-			var err error
-			data.Password, err = readPassword(p.frontend)
-			if err != nil {
-				return nil, err
-			}
+	key, err := FinalizeInitialHandshake(cl.Backend, fe)
+	if err != nil {
+		log.Error().Err(err).Msg("unable to finalize handshake")
+		return err
+	}
+
+	if key != nil {
+		p.mu.Lock()
+		if p.keyData == nil {
+			p.keyData = make(map[pgproto3.BackendKeyData]LogicalConn)
 		}
+		p.keyData[*key] = server
+		p.mu.Unlock()
 	}
 
-	return data, nil
+	err = CopySteadyState(cl.Backend, fe)
+	if err != nil {
+		log.Error().Err(err).Msg("unable to copy steady state")
+		return err
+	}
+
+	return nil
 }
 
-// BackendData is the data reported from the backend after authentication is completed.
-type BackendData struct {
-	KeyData *pgproto3.BackendKeyData // may be nil
+type ServerConfig struct {
+	TLS     *tls.Config // nil indicates no TLS
+	Startup *StartupData
 }
 
-// BackendAuth performs the server-side authentication step, and reports any key data received from the server
-// for use with cancellation requests.
-func (p *Proxy) BackendAuth(backend io.ReadWriter, tlsCfg *tls.Config, auth *AuthData) (*BackendData, error) {
-	if _, ok := backend.(net.Conn); !ok && tlsCfg != nil {
-		panic("pgproxy: backend connection with TLS must provide a net.Conn")
-	}
-	p.backend = &conn{rw: backend}
-	conn, err := p.negotiateSSL(p.backend, tlsCfg, true)
+// SetupServer sets up a frontend connected to the given server.
+func SetupServer(server net.Conn, cfg *ServerConfig) (*pgproto3.Frontend, error) {
+	fe, err := serverTLSNegotiate(server, cfg.TLS)
 	if err != nil {
 		return nil, err
 	}
-	p.backend = conn
 
-	switch startup := auth.Startup.(type) {
-	case *CancelRequest:
-		p.debug("sending cancellation request: %+v", *startup)
-		if err := p.backend.WriteMsg(startup); err != nil {
-			return nil, fmt.Errorf("pgproxy: could not send cancel request: %v", err)
-		}
-		return nil, ErrCancelled
-
-	case *StartupMessage:
-		// Update the startup parameters in case they were changed
-		startup.Parameters["user"] = auth.Username
-		startup.Parameters["database"] = auth.Database
-		if err := pgio.WriteMsg(p.backend, startup); err != nil {
-			return nil, fmt.Errorf("pgproxy: could not send startup msg: %v", err)
-		}
+	raw := cfg.Startup.Raw
+	raw.Parameters["database"] = cfg.Startup.Database
+	raw.Parameters["user"] = cfg.Startup.Username
 
-		if err := p.authenticateBackend(auth); err != nil {
-			var e *pgErr
-			if errors.As(err, &e) {
-				_ = p.frontend.WriteMsg(&e.msg)
-			}
-			return nil, fmt.Errorf("pgproxy: could not authenticate: %v", err)
-		}
+	log.Trace().Msg("sending startup message to server")
+	if err := fe.Send(raw); err != nil {
+		return nil, fmt.Errorf("unable to send startup message: %v", err)
+	}
 
-		// Notify the frontend of successful auth
-		if err := pgio.WriteMsg(p.frontend, &pgproto3.Authentication{Type: pgproto3.AuthTypeOk}); err != nil {
-			return nil, fmt.Errorf("pgproxy: could not write to frontend: %v", err)
+	// Handle authentication
+	for {
+		msg, err := fe.Receive()
+		if err != nil {
+			return nil, fmt.Errorf("unexpected message from server: %v", err)
 		}
 
-		// Read messages from backend until we get ReadyForQuery
-		var data BackendData
-		for {
-			msg, err := p.backend.ReadMsg()
-			if err != nil {
-				return nil, fmt.Errorf("pgproxy: cannot read from backend: %v", err)
-			} else if err := p.frontend.WriteMsg(msg); err != nil {
-				return nil, fmt.Errorf("pgproxy: could not write to frontend: %v", err)
-			}
+		switch msg := msg.(type) {
+		case *pgproto3.ErrorResponse:
+			return nil, pgconn.ErrorResponseToPgError(msg)
 
-			switch msg.Typ {
-			case 'K': // BackendKeyData
-				var keyData pgproto3.BackendKeyData
-				if err := keyData.Decode(msg.Buf); err != nil {
-					return nil, fmt.Errorf("pgproxy: could not decode backend key data: %v", err)
+		case pgproto3.AuthenticationResponseMessage:
+			if len(cfg.Startup.Password) == 0 {
+				if _, ok := msg.(*pgproto3.AuthenticationOk); !ok {
+					return nil, fmt.Errorf("backend requested authentication but no password given")
 				}
-				data.KeyData = &keyData
-			case 'Z': // ReadyForQuery
-				return &data, nil
 			}
-		}
 
-	default:
-		return nil, fmt.Errorf("pgproxy: cannot perform backend handshake: unexpected startup message type %T", startup)
-	}
-}
+			switch msg := msg.(type) {
+			case *pgproto3.AuthenticationOk:
+				// We're done!
+				return fe, nil
 
-// Data proxies the steady-state data between the frontend and backend once both sides are authenticated.
-func (p *Proxy) Data(ctx context.Context) error {
-	p.debug("proxying data between frontend and backend (steady-state)")
-	defer p.debug("proxy closed")
+			case *pgproto3.AuthenticationCleartextPassword:
+				err := fe.Send(&pgproto3.PasswordMessage{Password: cfg.Startup.Password})
+				if err != nil {
+					return nil, err
+				}
 
-	quit := make(chan struct{}, 2)
-	go func() {
-		io.Copy(p.frontend, p.backend)
-		quit <- struct{}{}
-	}()
-	go func() {
-		io.Copy(p.backend, p.frontend)
-		quit <- struct{}{}
-	}()
+			case *pgproto3.AuthenticationMD5Password:
+				password := computeMD5(cfg.Startup.Username, cfg.Startup.Password, msg.Salt)
+				err := fe.Send(&pgproto3.PasswordMessage{Password: password})
+				if err != nil {
+					return nil, err
+				}
 
-	select {
-	case <-ctx.Done():
-		return ctx.Err()
-	case <-quit:
-		// Wait up to 1s for graceful exit
-		select {
-		case <-quit:
-		case <-ctx.Done():
-		case <-time.After(1 * time.Second):
+			case *pgproto3.AuthenticationSASL:
+				if err := scramAuth(fe, cfg.Startup.Password, msg.AuthMechanisms); err != nil {
+					return nil, err
+				}
+
+			default:
+				return nil, fmt.Errorf("unsupported auth message: %T", msg)
+			}
+
+		default:
+			return nil, fmt.Errorf("unexpected message type from backend: %T", msg)
 		}
-		return nil
 	}
 }
 
-func (p *Proxy) debug(format string, args ...interface{}) {
-	if p.Debug {
-		format = "pgproxy: " + format
-		log.Printf(format, args...)
+func serverTLSNegotiate(server net.Conn, tlsConfig *tls.Config) (*pgproto3.Frontend, error) {
+	cr := pgproto3.NewChunkReader(server)
+	frontend := pgproto3.NewFrontend(cr, server)
+	if tlsConfig == nil {
+		return frontend, nil
 	}
-}
 
-func (p *Proxy) negotiateSSL(c *conn, cfg *tls.Config, server bool) (*conn, error) {
-	if server {
-		if cfg == nil {
-			// We don't want SSL so just don't request it.
-			p.debug("skipping TLS negotiation with server since no TLS config was given")
-			return c, nil
+	log.Trace().Msg("negotiating tls with server")
+	if err := frontend.Send(&pgproto3.SSLRequest{}); err != nil {
+		return nil, err
+	}
+	// Read the TLS response.
+	resp, err := cr.Next(1)
+	if err != nil {
+		return nil, err
+	}
+	switch resp[0] {
+	case 'S':
+		log.Trace().Msg("server accepted tls request")
+		tlsConn := tls.Client(server, tlsConfig)
+		if err := tlsConn.Handshake(); err != nil {
+			log.Error().Err(err).Msg("server tls handshake failed")
+			_ = tlsConn.Close()
+			return nil, fmt.Errorf("server tls handshake failed: %v", err)
 		}
-		p.debug("negotiating TLS with server...")
-		msg := &pgproto3.SSLMessage{}
-		if err := c.WriteMsg(msg); err != nil {
+		log.Trace().Msg("completed server tls handshake")
+
+		// Return a new backend that wraps the tls conn.
+		return pgproto3.NewFrontend(pgproto3.NewChunkReader(tlsConn), tlsConn), nil
+	case 'N':
+		log.Trace().Msg("server rejected tls request")
+		return nil, fmt.Errorf("server rejected tls")
+	case 'E':
+		// ErrorMessage: we've already parsed the first byte so read it manually.
+		hdr, err := cr.Next(4)
+		if err != nil {
 			return nil, err
 		}
-		var resp [1]byte
-		if _, err := io.ReadFull(c, resp[:]); err != nil {
+		bodyLen := int(binary.BigEndian.Uint32(hdr)) - 4
+		msgBody, err := cr.Next(bodyLen)
+		if err != nil {
 			return nil, err
 		}
-		switch resp[0] {
-		case 'S':
-			p.debug("server accepted TLS request")
-			c2 := tls.Client(c.rw.(net.Conn), cfg)
-			if err := c2.Handshake(); err != nil {
-				p.debug("TLS handshake failed: %v", err)
-				c2.Close()
-				return nil, fmt.Errorf("TLS handshake failed: %v", err)
-			}
-			p.debug("TLS handshake completed")
-			return &conn{rw: c2}, nil
-		case 'N':
-			p.debug("server rejected TLS request")
-			return nil, fmt.Errorf("server rejected TLS")
-		case 'E':
-			// ErrorMessage
-			p.debug("server responded with ErrorResponse to TLS request")
-			c.UnreadByte(resp[0])
-			var msg pgproto3.ErrorResponse
-			if err := c.ReadInto(&msg); err != nil {
-				p.debug("could not parse ErrorResponse: %v", err)
-			}
-			p.debug("TLS negotiation error: %+v", msg)
-			return nil, fmt.Errorf("could not negotiate TLS: error %s: %s", msg.Code, msg.Message)
-		default:
-			return nil, fmt.Errorf("got unexpected response to TLS Request: %v", resp[0])
-		}
-	}
-
-	p.debug("checking if client wants TLS")
-	msg, err := p.readStartupMsg(c)
-	if err == nil {
-		// readStartupMsg returns err == errSSL if the client requests TLS,
-		// so if we get here it means the client did not request TLS.
-		p.debug("client did not request TLS")
-		if cfg == nil {
-			// We don't require TLS, so proceed.
-			// Unread the startup message so we pick it up again when we do the startup.
-			c.UnreadMsg(msg)
-			return c, nil
-		}
-		return nil, fmt.Errorf("client did not request TLS")
-	} else if err != errSSL {
-		return nil, err
-	}
-
-	p.debug("client requested TLS")
-	if cfg == nil {
-		// We got an SSL request but we don't want to use TLS
-		if _, err := c.Write([]byte{'N'}); err != nil {
+		var errMsg pgproto3.ErrorResponse
+		if err := errMsg.Decode(msgBody); err != nil {
 			return nil, err
 		}
-		return c, nil
-	}
-
-	if _, err := c.Write([]byte{'S'}); err != nil {
-		return nil, err
-	}
-	c2 := tls.Server(c.rw.(net.Conn), cfg)
-	if err := c2.Handshake(); err != nil {
-		c2.Close()
-		return nil, fmt.Errorf("TLS handshake failed: %v", err)
+		log.Error().Msgf("server tls negotiation error: %+v", errMsg)
+		return nil, fmt.Errorf("could not negotiate tls with server: error %s: %s", errMsg.Code, errMsg.Message)
+	default:
+		return nil, fmt.Errorf("got unexpected response to tls request: %v", resp[0])
 	}
-	return &conn{rw: c2}, nil
 }
 
-const sslProtocolVersionNumber = 80877103
+type ClientConfig struct {
+	// TLS, if non-nil, indicates we support TLS connections.
+	TLS *tls.Config
+
+	// WantPassword, if true, indicates we want to capture
+	// the password sent by the frontend.
+	WantPassword bool
+}
 
-var errSSL = errors.New("client requested SSL")
+type Client struct {
+	Backend *pgproto3.Backend
+	Hello   HelloData
+}
 
-func (p *Proxy) readStartupMsg(c *conn) (FrontendMessage, error) {
-	var hdr [8]byte
-	if _, err := io.ReadFull(c, hdr[:]); err != nil {
+// SetupClient sets up a backend connected to the given client.
+// If tlsConfig is non-nil it negotiates TLS if requested by the client.
+//
+// On successful startup the returned message is either *pgproto3.StartupMessage or *pgproto3.CancelRequest.
+//
+// It is up to the caller to authenticate the client using AuthenticateClient.
+func SetupClient(client net.Conn, cfg *ClientConfig) (*Client, error) {
+	log.Trace().Msg("setting up client backend")
+	be, msg, err := clientTLSNegotiate(client, cfg.TLS)
+	if err != nil {
 		return nil, err
 	}
 
-	// Read the rest of the message. Splice the first 4 bytes from
-	// the header which we've already read, and only read the rest from the conn.
-	// This is so that we can use pgproto3.StartupMessage.Decode() to parse
-	// the message, which expects the protocol version to be part of the buffer.
-	msgSize := int(binary.BigEndian.Uint32(hdr[0:4]) - 4)
-	if msgSize > (1 << 20) {
-		return nil, fmt.Errorf("startup message too big (> 1GiB)")
-	}
-	buf := make([]byte, msgSize)
-	copy(buf[0:4], hdr[4:8])
-	if _, err := io.ReadFull(c, buf[4:]); err != nil {
-		return nil, err
+	if cancel, ok := msg.(*pgproto3.CancelRequest); ok {
+		return &Client{
+			Backend: be,
+			Hello:   &CancelData{Raw: cancel},
+		}, nil
 	}
 
-	code := binary.BigEndian.Uint32(hdr[4:8])
-	p.debug("got startup message code: %v", code)
-	switch code {
-	case sslProtocolVersionNumber:
-		return nil, errSSL
-	case pgproto3.ProtocolVersionNumber:
-		var msg pgproto3.StartupMessage
-		if err := msg.Decode(buf); err != nil {
-			return nil, fmt.Errorf("could not parse startup message: %v", err)
+	startup := msg.(*pgproto3.StartupMessage)
+	hello := &StartupData{
+		Raw:      startup,
+		Database: startup.Parameters["database"],
+		Username: startup.Parameters["user"],
+	}
+	if cfg.WantPassword {
+		err := be.Send(&pgproto3.AuthenticationCleartextPassword{})
+		if err != nil {
+			return nil, err
 		}
-		return &msg, nil
-	case pgproto3.CancelRequestCode:
-		var msg pgproto3.CancelRequest
-		if err := msg.Decode(buf); err != nil {
-			return nil, fmt.Errorf("could not parse cancel request message: %v", err)
+		msg, err := be.Receive()
+		if err != nil {
+			return nil, err
 		}
-		return &msg, nil
-	default:
-		return nil, fmt.Errorf("unknown startup message code: %d", code)
+		passwd, ok := msg.(*pgproto3.PasswordMessage)
+		if !ok {
+			return nil, fmt.Errorf("expected PasswordMessage, got %T", msg)
+		}
+		hello.Password = passwd.Password
 	}
-}
 
-func readPassword(frontend *conn) (string, error) {
-	err := frontend.WriteMsg(&pgproto3.Authentication{
-		Type: pgproto3.AuthTypeCleartextPassword,
-	})
-	if err != nil {
-		return "", err
-	}
-	msg, err := frontend.ReadMsg()
-	if err != nil {
-		return "", err
-	}
-	if msg.Typ != 'p' {
-		return "", fmt.Errorf("expected password msg, got %v", msg.Typ)
-	}
-	var pwdMsg pgproto3.PasswordMessage
-	if err := pwdMsg.Decode(msg.Buf); err != nil {
-		return "", fmt.Errorf("could not decode password message: %v", err)
-	}
-	return pwdMsg.Password, nil
+	return &Client{
+		Backend: be,
+		Hello:   hello,
+	}, nil
 }
 
-func (p *Proxy) authenticateBackend(data *AuthData) error {
+func clientTLSNegotiate(client net.Conn, tlsConfig *tls.Config) (*pgproto3.Backend, pgproto3.FrontendMessage, error) {
+	log.Trace().Msg("negotiating TLS with client")
+	backend := pgproto3.NewBackend(pgproto3.NewChunkReader(client), client)
+	hasTLS := false
+
+StartupMessageLoop:
 	for {
-		msg, err := p.backend.ReadMsg()
+		startup, err := backend.ReceiveStartupMessage()
 		if err != nil {
-			return err
+			return nil, nil, err
 		}
-		switch msg.Typ {
-		case 'R': // Authentication Required
-			var auth pgproto3.Authentication
-			if err := auth.Decode(msg.Buf); err != nil {
-				return err
-			}
-			switch auth.Type {
-			case pgproto3.AuthTypeOk:
-				return nil
-			case pgproto3.AuthTypeCleartextPassword:
-				pwdMsg := &pgproto3.PasswordMessage{
-					Password: data.Password,
-				}
-				if err := p.backend.WriteMsg(pwdMsg); err != nil {
-					return err
+		switch startup := startup.(type) {
+		case *pgproto3.SSLRequest:
+			if hasTLS {
+				return nil, nil, fmt.Errorf("received duplicate SSL request")
+			} else if tlsConfig == nil {
+				// We got an SSL request but we don't want to use TLS
+				if _, err := client.Write([]byte{'N'}); err != nil {
+					return nil, nil, err
 				}
-			case pgproto3.AuthTypeMD5Password:
-				// Send the password hashed as:
-				// concat('md5', md5(concat(md5(concat(password, username)), random-salt)))
-
-				// s1 := md5(concat(password, username))
-				s1 := md5.Sum([]byte(data.Password + data.Username))
-				// s2 := md5(concat(s1, random-salt))
-				s2 := md5.Sum([]byte(hex.EncodeToString(s1[:]) + string(auth.Salt[:])))
-				pwdMsg := &pgproto3.PasswordMessage{
-					Password: "md5" + hex.EncodeToString(s2[:]),
-				}
-				if err := p.backend.WriteMsg(pwdMsg); err != nil {
-					return err
-				}
-			default:
-				return fmt.Errorf("unknown authentication type %v", auth.Type)
+				continue StartupMessageLoop
 			}
 
-		case 'E':
-			var resp pgproto3.ErrorResponse
-			if err := resp.Decode(msg.Buf); err != nil {
-				return err
+			if _, err := client.Write([]byte{'S'}); err != nil {
+				return nil, nil, err
 			}
-			return &pgErr{msg: resp}
-		default:
-			return fmt.Errorf("unexpected message type from backend: %x", msg.Typ)
+			tlsConn := tls.Server(client, tlsConfig)
+			if err := tlsConn.Handshake(); err != nil {
+				_ = tlsConn.Close()
+				return nil, nil, fmt.Errorf("client tls handshake failed: %v", err)
+			}
+			log.Trace().Msg("client tls handshake successful")
+
+			// The TLS handshake was successful.
+			// Create a new backend that reads from the now-encrypted TLS connection.
+			hasTLS = true
+			backend = pgproto3.NewBackend(pgproto3.NewChunkReader(tlsConn), tlsConn)
+		case *pgproto3.CancelRequest, *pgproto3.StartupMessage:
+			// Startup complete.
+			log.Debug().Msg("startup completed")
+			return backend, startup, nil
+		case *pgproto3.GSSEncRequest:
+			// We got a GSSAPI encryption request but we don't support it.
+			if _, err := client.Write([]byte{'N'}); err != nil {
+				return nil, nil, err
+			}
+			continue StartupMessageLoop
 		}
 	}
 }
 
-type conn struct {
-	rw     io.ReadWriter
-	unread []byte
+type AuthData struct {
+	Username string
+	Password string
+}
+
+// AuthenticateClient tells the client they've successfully authenticated.
+func AuthenticateClient(be *pgproto3.Backend) error {
+	_ = be.SetAuthType(pgproto3.AuthTypeOk)
+	return be.Send(&pgproto3.AuthenticationOk{})
+}
+
+func computeMD5(username, password string, salt [4]byte) string {
+	// concat('md5', md5(concat(md5(concat(password, username)), random-salt)))
+
+	// s1 := md5(concat(password, username))
+	// nosemgrep
+	s1 := md5.Sum([]byte(password + username))
+	// s2 := md5(concat(s1, random-salt))
+	// nosemgrep
+	s2 := md5.Sum([]byte(hex.EncodeToString(s1[:]) + string(salt[:])))
+	return "md5" + hex.EncodeToString(s2[:])
 }
 
-func (c *conn) ReadInto(msg pgio.PgMsg) error {
-	raw, err := c.ReadMsg()
+func SendCancelRequest(conn io.ReadWriter, req *pgproto3.CancelRequest) error {
+	buf := make([]byte, 16)
+	binary.BigEndian.PutUint32(buf[0:4], 16)
+	binary.BigEndian.PutUint32(buf[4:8], 80877102)
+	binary.BigEndian.PutUint32(buf[8:12], uint32(req.ProcessID))
+	binary.BigEndian.PutUint32(buf[12:16], uint32(req.SecretKey))
+	_, err := conn.Write(buf)
 	if err != nil {
 		return err
 	}
-	return msg.Decode(raw.Buf)
-}
 
-func (c *conn) ReadMsg() (*pgio.RawMsg, error) {
-	return pgio.ReadMsg(c)
+	_, err = conn.Read(buf)
+	if err != io.EOF {
+		return err
+	}
+	return nil
 }
 
-func (c *conn) UnreadMsg(msg pgio.PgMsg) {
-	c.unread = msg.Encode(nil)
-}
+// FinalizeInitialHandshake completes the handshake between client and server,
+// snooping the BackendKeyData from the server if sent.
+// It is nil if the server did not send any backend key data.
+func FinalizeInitialHandshake(client *pgproto3.Backend, server *pgproto3.Frontend) (*pgproto3.BackendKeyData, error) {
+	var keyData *pgproto3.BackendKeyData
 
-func (c *conn) UnreadByte(b byte) {
-	c.unread = []byte{b}
-}
+	// Read messages from backend until we get ReadyForQuery
+	for {
+		msg, err := server.Receive()
+		if err != nil {
+			return nil, fmt.Errorf("pgproxy: cannot read from backend: %v", err)
+		} else if err := client.Send(msg); err != nil {
+			return nil, fmt.Errorf("pgproxy: could not write to frontend: %v", err)
+		}
+
+		switch msg := msg.(type) {
+		case *pgproto3.BackendKeyData:
+			// Make a copy; this object is only valid until the next call to Receive()
+			copy := *msg
+			keyData = &copy
 
-func (c *conn) Read(p []byte) (n int, err error) {
-	if len(c.unread) > 0 {
-		n = copy(p, c.unread)
-		c.unread = c.unread[n:]
-		return n, nil
+		case *pgproto3.ReadyForQuery:
+			// Handshake completed
+			return keyData, nil
+		}
 	}
-	n, err = c.rw.Read(p)
-	return
 }
 
-func (c *conn) Write(p []byte) (n int, err error) {
-	return c.rw.Write(p)
-}
+// CopySteadyState copies messages back and forth after the initial handshake.
+func CopySteadyState(client *pgproto3.Backend, server *pgproto3.Frontend) error {
+	errChan := make(chan error, 2)
+	msgAck := make(chan struct{})
+	done := make(chan struct{})
+	defer close(done)
+
+	runTask := func(task func() error) {
+		go func() {
+			errChan <- task()
+		}()
+	}
+	clientMsgs := make(chan pgproto3.FrontendMessage)
 
-func (c *conn) WriteMsg(msg pgio.PgMsg) error {
-	return pgio.WriteMsg(c, msg)
-}
+	runTask(func() (err error) {
+		for {
+			msg, err := server.Receive()
+			if errors.Is(err, io.ErrUnexpectedEOF) {
+				log.Trace().Msg("pgproxy: connection terminated by server, closing connection")
+				return nil
+			} else if err != nil {
+				return err
+			}
+			if err := client.Send(msg); err != nil {
+				return err
+			}
+			select {
+			case <-done:
+				return nil
+			default:
+			}
+		}
+	})
+
+	runTask(func() error {
+		for {
+			msg, err := client.Receive()
+			if err != nil {
+				return err
+			}
+			select {
+			case <-done:
+				return nil
+			case clientMsgs <- msg:
+			}
+			select {
+			case <-done:
+				return nil
+			case <-msgAck:
+			}
+		}
+	})
 
-type pgErr struct {
-	msg pgproto3.ErrorResponse
+	// Copy from client to server.
+	for {
+		select {
+		case err := <-errChan:
+			return err
+		case msg := <-clientMsgs:
+			err := server.Send(msg)
+
+			if err != nil {
+				return err
+			}
+			if _, ok := msg.(*pgproto3.Terminate); ok {
+				log.Trace().Msg("received terminate from client, closing connection")
+				return nil
+			}
+			msgAck <- struct{}{}
+		}
+	}
 }
 
-func (e *pgErr) Error() string {
-	return fmt.Sprintf("%s - code: %s", e.msg.Message, e.msg.Code)
+func (p *SingleBackendProxy) cancelRequest(ctx context.Context, cancel *CancelData) {
+	p.Log.Trace().Msg("received cancel request")
+	key := pgproto3.BackendKeyData{
+		ProcessID: cancel.Raw.ProcessID,
+		SecretKey: cancel.Raw.SecretKey,
+	}
+	p.mu.Lock()
+	conn, ok := p.keyData[key]
+	p.mu.Unlock()
+
+	if ok {
+		if err := conn.Cancel(cancel); err != nil {
+			p.Log.Error().Err(err).Msg("unable to send cancel request")
+		}
+	} else {
+		p.Log.Error().Msg("could not find backend key data")
+	}
 }
diff --git a/pkg/pgproxy/scram.go b/pkg/pgproxy/scram.go
new file mode 100644
index 0000000000..be6396f865
--- /dev/null
+++ b/pkg/pgproxy/scram.go
@@ -0,0 +1,261 @@
+package pgproxy
+
+import (
+	"bytes"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strconv"
+
+	"github.com/jackc/pgproto3/v2"
+	"golang.org/x/crypto/pbkdf2"
+	"golang.org/x/text/secure/precis"
+)
+
+// The below code is taken from github.com/jackc/pgconn (auth_scram.go).
+
+/*
+Copyright (c) 2019-2021 Jack Christensen
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+*/
+
+const clientNonceLen = 18
+
+func scramAuth(fe *pgproto3.Frontend, password string, serverAuthMechanisms []string) error {
+	sc, err := newScramClient(serverAuthMechanisms, password)
+	if err != nil {
+		return err
+	}
+
+	// Send client-first-message in a SASLInitialResponse
+	saslInitialResponse := &pgproto3.SASLInitialResponse{
+		AuthMechanism: "SCRAM-SHA-256",
+		Data:          sc.clientFirstMessage(),
+	}
+	if err := fe.Send(saslInitialResponse); err != nil {
+		return err
+	}
+
+	// Receive server-first-message payload in a AuthenticationSASLContinue.
+	msg, err := fe.Receive()
+	if err != nil {
+		return err
+	}
+	saslContinue, ok := msg.(*pgproto3.AuthenticationSASLContinue)
+	if !ok {
+		return fmt.Errorf("expected AuthenticationSASLContinue message, got %T", msg)
+	}
+
+	err = sc.recvServerFirstMessage(saslContinue.Data)
+	if err != nil {
+		return err
+	}
+
+	// Send client-final-message in a SASLResponse
+	saslResponse := &pgproto3.SASLResponse{
+		Data: []byte(sc.clientFinalMessage()),
+	}
+	if err := fe.Send(saslResponse); err != nil {
+		return err
+	}
+
+	// Receive server-final-message payload in a AuthenticationSASLFinal.
+	msg, err = fe.Receive()
+	if err != nil {
+		return err
+	}
+	saslFinal, ok := msg.(*pgproto3.AuthenticationSASLFinal)
+	if !ok {
+		return fmt.Errorf("expected AuthenticationSASLFinal message, got %T", msg)
+	}
+	return sc.recvServerFinalMessage(saslFinal.Data)
+}
+
+type scramClient struct {
+	serverAuthMechanisms []string
+	password             []byte
+	clientNonce          []byte
+
+	clientFirstMessageBare []byte
+
+	serverFirstMessage   []byte
+	clientAndServerNonce []byte
+	salt                 []byte
+	iterations           int
+
+	saltedPassword []byte
+	authMessage    []byte
+}
+
+func newScramClient(serverAuthMechanisms []string, password string) (*scramClient, error) {
+	sc := &scramClient{
+		serverAuthMechanisms: serverAuthMechanisms,
+	}
+
+	// Ensure server supports SCRAM-SHA-256
+	hasScramSHA256 := false
+	for _, mech := range sc.serverAuthMechanisms {
+		if mech == "SCRAM-SHA-256" {
+			hasScramSHA256 = true
+			break
+		}
+	}
+	if !hasScramSHA256 {
+		return nil, errors.New("server does not support SCRAM-SHA-256")
+	}
+
+	// precis.OpaqueString is equivalent to SASLprep for password.
+	var err error
+	sc.password, err = precis.OpaqueString.Bytes([]byte(password))
+	if err != nil {
+		// PostgreSQL allows passwords invalid according to SCRAM / SASLprep.
+		sc.password = []byte(password)
+	}
+
+	buf := make([]byte, clientNonceLen)
+	_, err = rand.Read(buf)
+	if err != nil {
+		return nil, err
+	}
+	sc.clientNonce = make([]byte, base64.RawStdEncoding.EncodedLen(len(buf)))
+	base64.RawStdEncoding.Encode(sc.clientNonce, buf)
+
+	return sc, nil
+}
+
+func (sc *scramClient) clientFirstMessage() []byte {
+	sc.clientFirstMessageBare = []byte(fmt.Sprintf("n=,r=%s", sc.clientNonce))
+	return []byte(fmt.Sprintf("n,,%s", sc.clientFirstMessageBare))
+}
+
+func (sc *scramClient) recvServerFirstMessage(serverFirstMessage []byte) error {
+	sc.serverFirstMessage = serverFirstMessage
+	buf := serverFirstMessage
+	if !bytes.HasPrefix(buf, []byte("r=")) {
+		return errors.New("invalid SCRAM server-first-message received from server: did not include r=")
+	}
+	buf = buf[2:]
+
+	idx := bytes.IndexByte(buf, ',')
+	if idx == -1 {
+		return errors.New("invalid SCRAM server-first-message received from server: did not include s=")
+	}
+	sc.clientAndServerNonce = buf[:idx]
+	buf = buf[idx+1:]
+
+	if !bytes.HasPrefix(buf, []byte("s=")) {
+		return errors.New("invalid SCRAM server-first-message received from server: did not include s=")
+	}
+	buf = buf[2:]
+
+	idx = bytes.IndexByte(buf, ',')
+	if idx == -1 {
+		return errors.New("invalid SCRAM server-first-message received from server: did not include i=")
+	}
+	saltStr := buf[:idx]
+	buf = buf[idx+1:]
+
+	if !bytes.HasPrefix(buf, []byte("i=")) {
+		return errors.New("invalid SCRAM server-first-message received from server: did not include i=")
+	}
+	buf = buf[2:]
+	iterationsStr := buf
+
+	var err error
+	sc.salt, err = base64.StdEncoding.DecodeString(string(saltStr))
+	if err != nil {
+		return fmt.Errorf("invalid SCRAM salt received from server: %w", err)
+	}
+
+	sc.iterations, err = strconv.Atoi(string(iterationsStr))
+	if err != nil || sc.iterations <= 0 {
+		return fmt.Errorf("invalid SCRAM iteration count received from server: %w", err)
+	}
+
+	if !bytes.HasPrefix(sc.clientAndServerNonce, sc.clientNonce) {
+		return errors.New("invalid SCRAM nonce: did not start with client nonce")
+	}
+
+	if len(sc.clientAndServerNonce) <= len(sc.clientNonce) {
+		return errors.New("invalid SCRAM nonce: did not include server nonce")
+	}
+
+	return nil
+}
+
+func (sc *scramClient) clientFinalMessage() string {
+	clientFinalMessageWithoutProof := []byte(fmt.Sprintf("c=biws,r=%s", sc.clientAndServerNonce))
+
+	sc.saltedPassword = pbkdf2.Key([]byte(sc.password), sc.salt, sc.iterations, 32, sha256.New)
+	sc.authMessage = bytes.Join([][]byte{sc.clientFirstMessageBare, sc.serverFirstMessage, clientFinalMessageWithoutProof}, []byte(","))
+
+	clientProof := computeClientProof(sc.saltedPassword, sc.authMessage)
+
+	return fmt.Sprintf("%s,p=%s", clientFinalMessageWithoutProof, clientProof)
+}
+
+func (sc *scramClient) recvServerFinalMessage(serverFinalMessage []byte) error {
+	if !bytes.HasPrefix(serverFinalMessage, []byte("v=")) {
+		return errors.New("invalid SCRAM server-final-message received from server")
+	}
+
+	serverSignature := serverFinalMessage[2:]
+
+	if !hmac.Equal(serverSignature, computeServerSignature(sc.saltedPassword, sc.authMessage)) {
+		return errors.New("invalid SCRAM ServerSignature received from server")
+	}
+
+	return nil
+}
+
+func computeHMAC(key, msg []byte) []byte {
+	mac := hmac.New(sha256.New, key)
+	mac.Write(msg)
+	return mac.Sum(nil)
+}
+
+func computeClientProof(saltedPassword, authMessage []byte) []byte {
+	clientKey := computeHMAC(saltedPassword, []byte("Client Key"))
+	storedKey := sha256.Sum256(clientKey)
+	clientSignature := computeHMAC(storedKey[:], authMessage)
+
+	clientProof := make([]byte, len(clientSignature))
+	for i := 0; i < len(clientSignature); i++ {
+		clientProof[i] = clientKey[i] ^ clientSignature[i]
+	}
+
+	buf := make([]byte, base64.StdEncoding.EncodedLen(len(clientProof)))
+	base64.StdEncoding.Encode(buf, clientProof)
+	return buf
+}
+
+func computeServerSignature(saltedPassword []byte, authMessage []byte) []byte {
+	serverKey := computeHMAC(saltedPassword, []byte("Server Key"))
+	serverSignature := computeHMAC(serverKey, authMessage)
+	buf := make([]byte, base64.StdEncoding.EncodedLen(len(serverSignature)))
+	base64.StdEncoding.Encode(buf, serverSignature)
+	return buf
+}
diff --git a/pkg/promise/prom.go b/pkg/promise/prom.go
new file mode 100644
index 0000000000..4682995a5f
--- /dev/null
+++ b/pkg/promise/prom.go
@@ -0,0 +1,130 @@
+package promise
+
+import (
+	"context"
+	"sync"
+)
+
+type Value[T any] struct {
+	val  T
+	err  error
+	done chan struct{}
+
+	onResolve eventList[T]
+	onReject  eventList[error]
+}
+
+func (v *Value[T]) Get(ctx context.Context) (T, error) {
+	select {
+	case <-ctx.Done():
+		var zero T
+		return zero, ctx.Err()
+	case <-v.done:
+		return v.val, v.err
+	}
+}
+
+func (v *Value[T]) OnResolve(fn func(T)) {
+	v.onResolve.Add(fn)
+}
+
+func (v *Value[T]) OnReject(fn func(error)) {
+	v.onReject.Add(fn)
+}
+
+func New[T any](fn func() (T, error)) *Value[T] {
+	val := &Value[T]{
+		done: make(chan struct{}),
+	}
+	go func() {
+		func() {
+			// If we panic, we want to mark the promise as done
+			defer close(val.done)
+			val.val, val.err = fn()
+		}()
+
+		if val.err == nil {
+			val.onResolve.MarkDoneAndProcess(val.val)
+		} else {
+			val.onReject.MarkDoneAndProcess(val.err)
+		}
+	}()
+	return val
+}
+
+func Resolved[T any](val T) *Value[T] {
+	done := make(chan struct{})
+	close(done)
+	v := &Value[T]{
+		done: done,
+		val:  val,
+	}
+	v.onResolve.MarkDoneAndProcess(val)
+	return v
+}
+
+func Rejected[T any](err error) *Value[T] {
+	done := make(chan struct{})
+	close(done)
+	v := &Value[T]{
+		done: done,
+		err:  err,
+	}
+	v.onReject.MarkDoneAndProcess(err)
+	return v
+}
+
+type eventList[V any] struct {
+	mu    sync.Mutex
+	done  bool
+	val   V
+	funcs []func(V)
+}
+
+func (g *eventList[V]) Add(fn func(V)) {
+	g.mu.Lock()
+	if g.done {
+		g.mu.Unlock()
+		fn(g.val)
+	} else {
+		g.funcs = append(g.funcs, fn)
+		g.mu.Unlock()
+	}
+}
+
+func (g *eventList[V]) MarkDoneAndProcess(val V) {
+	g.mu.Lock()
+	g.done = true
+	g.val = val
+	g.mu.Unlock()
+
+	for _, fn := range g.funcs {
+		fn(val)
+	}
+}
+
+func Wait2[A, B any](ctx context.Context, a *Value[A], b *Value[B]) (A, B, error) {
+	aVal, err1 := a.Get(ctx)
+	bVal, err2 := b.Get(ctx)
+
+	err := err1
+	if err == nil {
+		err = err2
+	}
+	return aVal, bVal, err
+}
+
+func Wait3[A, B, C any](ctx context.Context, a *Value[A], b *Value[B], c *Value[C]) (A, B, C, error) {
+	aVal, err1 := a.Get(ctx)
+	bVal, err2 := b.Get(ctx)
+	cVal, err3 := c.Get(ctx)
+
+	err := err1
+	if err == nil {
+		err = err2
+	}
+	if err == nil {
+		err = err3
+	}
+	return aVal, bVal, cVal, err
+}
diff --git a/pkg/rtconfgen/base_builder.go b/pkg/rtconfgen/base_builder.go
new file mode 100644
index 0000000000..4f0b6975ce
--- /dev/null
+++ b/pkg/rtconfgen/base_builder.go
@@ -0,0 +1,282 @@
+package rtconfgen
+
+import (
+	"cmp"
+	"fmt"
+	"slices"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/golang/protobuf/proto"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	runtimev1 "encr.dev/proto/encore/runtime/v1"
+)
+
+type ResourceID interface {
+	comparable
+	fmt.Stringer
+}
+
+type Builder struct {
+	Infra *InfraBuilder
+	rs    *resourceSet
+
+	env    *runtimev1.Environment
+	encore *runtimev1.EncorePlatform
+	obs    *runtimev1.Observability
+
+	// Any errors encountered during the build process.
+	err error
+
+	// authMethods are the service auth methods to use for authenticating to this deployment.
+	authMethods []*runtimev1.ServiceAuth
+
+	// defaultGracefulShutdown is the graceful shutdown behavior to use by default,
+	// unless a deployment overrides it.
+	defaultGracefulShutdown *runtimev1.GracefulShutdown
+
+	defaultDeployID   string
+	defaultDeployedAt time.Time
+
+	deployments map[string]*Deployment
+	services    map[string]*runtimev1.HostedService
+}
+
+func NewBuilder() *Builder {
+	rs := new(resourceSet)
+	b := &Builder{
+		Infra:       newInfraBuilder(rs),
+		rs:          rs,
+		obs:         &runtimev1.Observability{},
+		deployments: make(map[string]*Deployment),
+		services:    make(map[string]*runtimev1.HostedService),
+	}
+
+	return b
+}
+
+func (b *Builder) Env(env *runtimev1.Environment) *Builder {
+	b.env = env
+	return b
+}
+
+func (b *Builder) EncorePlatform(encore *runtimev1.EncorePlatform) *Builder {
+	b.encore = encore
+	return b
+}
+
+func (b *Builder) DefaultGracefulShutdown(s *runtimev1.GracefulShutdown) *Builder {
+	b.defaultGracefulShutdown = s
+	return b
+}
+
+func (b *Builder) AuthMethods(m []*runtimev1.ServiceAuth) *Builder {
+	b.authMethods = m
+	return b
+}
+
+func (b *Builder) DeployID(id string) *Builder {
+	b.defaultDeployID = id
+	return b
+}
+
+func (b *Builder) DeployedAt(t time.Time) *Builder {
+	b.defaultDeployedAt = t
+	return b
+}
+
+func (b *Builder) TracingProvider(p *runtimev1.TracingProvider) {
+	b.TracingProviderFn(p.Rid, tofn(p))
+}
+
+func (b *Builder) TracingProviderFn(rid string, fn func() *runtimev1.TracingProvider) {
+	addResFunc(&b.obs.Tracing, b.rs, rid, fn)
+}
+
+func (b *Builder) MetricsProvider(p *runtimev1.MetricsProvider) {
+	b.MetricsProviderFn(p.Rid, tofn(p))
+}
+
+func (b *Builder) MetricsProviderFn(rid string, fn func() *runtimev1.MetricsProvider) {
+	addResFunc(&b.obs.Metrics, b.rs, rid, fn)
+}
+
+func (b *Builder) LogsProvider(p *runtimev1.LogsProvider) {
+	b.LogsProviderFn(p.Rid, tofn(p))
+}
+
+func (b *Builder) LogsProviderFn(rid string, fn func() *runtimev1.LogsProvider) {
+	addResFunc(&b.obs.Logs, b.rs, rid, fn)
+}
+
+func (b *Builder) ServiceConfig(svc *runtimev1.HostedService) {
+	b.services[svc.Name] = svc
+}
+
+func (b *Builder) Deployment(rid string) *Deployment {
+	if d, ok := b.deployments[rid]; ok {
+		return d
+	}
+	d := &Deployment{b: b, rid: rid}
+	b.deployments[rid] = d
+	return d
+}
+
+type Deployment struct {
+	b   *Builder
+	rid string
+
+	deployID   option.Option[string]
+	deployedAt option.Option[time.Time]
+	reduceWith option.Option[*meta.Data]
+
+	dynamicExperiments []string
+
+	// The graceful shutdown behavior to use for this deployment.
+	// If None, uses the default graceful shutdown behavior.
+	gracefulShutdown option.Option[*runtimev1.GracefulShutdown]
+
+	// The service-discovery configuration for this deployment.
+	sd *runtimev1.ServiceDiscovery
+
+	// The base URL for reaching this deployment from another service.
+	svc2svcBaseURL string
+
+	hostedGateways     []string
+	hostedServiceNames []string
+}
+
+// DeployID sets the deploy id.
+func (d *Deployment) DeployID(id string) *Deployment {
+	d.deployID = option.Some(id)
+	return d
+}
+
+// OverrideDeployedAt sets the time of deploy.
+func (d *Deployment) OverrideDeployedAt(t time.Time) *Deployment {
+	d.deployedAt = option.Some(t)
+	return d
+}
+
+func (d *Deployment) DynamicExperiments(experiments []string) *Deployment {
+	d.dynamicExperiments = experiments
+	return d
+}
+
+// HostsServices adds the given service names as being hosted by this deployment.
+// It appends and doesn't overwrite any existing hosted services.
+func (d *Deployment) HostsServices(names ...string) *Deployment {
+	d.hostedServiceNames = append(d.hostedServiceNames, names...)
+	return d
+}
+
+// HostsGateways adds the given gateway names as being hosted by this deployment.
+// It appends and doesn't overwrite any existing hosted gateways.
+func (d *Deployment) HostsGateways(names ...string) *Deployment {
+	d.hostedGateways = append(d.hostedGateways, names...)
+	return d
+}
+
+// OverrideGracefulShutdown sets the graceful shutdown behavior for this specific deployment.
+// To set a default graceful shutdown shared for all deployments, use [Builder.DefaultGracefulShutdown] instead.
+func (d *Deployment) OverrideGracefulShutdown(s *runtimev1.GracefulShutdown) *Deployment {
+	d.gracefulShutdown = option.Some(s)
+	return d
+}
+
+func (d *Deployment) ServiceDiscovery(sd *runtimev1.ServiceDiscovery) *Deployment {
+	d.sd = sd
+	return d
+}
+
+func (d *Deployment) ReduceWithMeta(md *meta.Data) *Deployment {
+	d.reduceWith = option.Some(md)
+	return d
+}
+
+func (d *Deployment) BuildRuntimeConfig() (*runtimev1.RuntimeConfig, error) {
+	b := d.b
+
+	infra, err := b.Infra.get()
+	if err != nil {
+		return nil, err
+	}
+	if reduced, ok := d.reduceWith.Get(); ok {
+		infra = reduceForServices(infra, reduced, d.hostedServiceNames)
+	}
+
+	graceful := d.gracefulShutdown.GetOrElse(d.b.defaultGracefulShutdown)
+
+	var hostedServices []*runtimev1.HostedService
+	{
+		for _, svcName := range d.hostedServiceNames {
+			// If we have a service config defined for this service, use it.
+			cfg := b.services[svcName]
+			if cfg == nil {
+				cfg = &runtimev1.HostedService{
+					Name: svcName,
+				}
+			}
+			hostedServices = append(hostedServices, cfg)
+		}
+	}
+	slices.SortFunc(hostedServices, func(a, b *runtimev1.HostedService) int {
+		return cmp.Compare(a.Name, b.Name)
+	})
+
+	gatewaysByName := make(map[string]*runtimev1.Gateway)
+	for _, gw := range infra.Resources.Gateways {
+		gatewaysByName[gw.EncoreName] = gw
+	}
+
+	gatewayRids := fns.Map(d.hostedGateways, func(name string) string {
+		gw, ok := gatewaysByName[name]
+		if !ok {
+			b.setErrf("gateway %q not found", name)
+			return ""
+		}
+		return gw.Rid
+	})
+
+	deploy := &runtimev1.Deployment{
+		HostedGateways:     gatewayRids,
+		HostedServices:     hostedServices,
+		ServiceDiscovery:   d.sd,
+		GracefulShutdown:   graceful,
+		DynamicExperiments: d.dynamicExperiments,
+		Observability:      b.obs,
+		AuthMethods:        d.b.authMethods,
+		DeployId:           d.deployID.GetOrElse(b.defaultDeployID),
+		DeployedAt:         timestamppb.New(d.deployedAt.GetOrElse(b.defaultDeployedAt)),
+	}
+
+	cfg := &runtimev1.RuntimeConfig{
+		Environment:    b.env,
+		EncorePlatform: b.encore,
+		Infra:          infra,
+		Deployment:     deploy,
+	}
+
+	// Deep-clone the protobuf to avoid subsequent mutations from modifying this one.
+	cfg = cloneProto(cfg)
+
+	return cfg, b.err
+}
+
+func (b *Builder) setErr(err error) {
+	if b.err == nil {
+		b.err = err
+	}
+}
+
+func (b *Builder) setErrf(format string, args ...any) {
+	b.setErr(errors.Newf(format, args...))
+}
+
+func cloneProto[M proto.Message](m M) M {
+	return proto.Clone(m).(M)
+}
diff --git a/pkg/rtconfgen/convert.go b/pkg/rtconfgen/convert.go
new file mode 100644
index 0000000000..a0b4e6b05e
--- /dev/null
+++ b/pkg/rtconfgen/convert.go
@@ -0,0 +1,684 @@
+package rtconfgen
+
+import (
+	"encoding/base64"
+	"encoding/json"
+	"reflect"
+	"slices"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog"
+
+	"go.encore.dev/platform-sdk/pkg/auth"
+
+	runtimev1 "encr.dev/proto/encore/runtime/v1"
+
+	encore "encore.dev"
+	"encore.dev/appruntime/exported/config"
+	"encr.dev/pkg/fns"
+)
+
+func ToLegacy(conf *runtimev1.RuntimeConfig, secretEnvs map[string][]byte) (*config.Runtime, error) {
+	conv := &legacyConverter{in: conf, secretEnvs: secretEnvs}
+	return conv.Convert()
+}
+
+type legacyConverter struct {
+	in         *runtimev1.RuntimeConfig
+	secretEnvs map[string][]byte
+	err        error
+}
+
+func findRID[T interface{ GetRid() string }](rid string, list []T) (T, bool) {
+	return fns.Find(list, func(item T) bool {
+		return item.GetRid() == rid
+	})
+}
+
+func (c *legacyConverter) Convert() (*config.Runtime, error) {
+	cfg := &config.Runtime{
+		AppID:              c.in.Environment.AppId,
+		AppSlug:            c.in.Environment.AppSlug,
+		EnvID:              c.in.Environment.EnvId,
+		EnvName:            c.in.Environment.EnvName,
+		EnvType:            string(c.envType()),
+		EnvCloud:           c.envCloud(),
+		DeployID:           c.in.Deployment.DeployId,
+		DeployedAt:         c.in.Deployment.DeployedAt.AsTime(),
+		ServiceDiscovery:   nil,
+		ServiceAuth:        nil,
+		ShutdownTimeout:    0,
+		GracefulShutdown:   nil,
+		DynamicExperiments: nil,
+		Gateways:           []config.Gateway{},
+		PubsubTopics:       make(map[string]*config.PubsubTopic),
+		Buckets:            make(map[string]*config.Bucket),
+		CORS:               &config.CORS{},
+	}
+
+	// Deployment handling.
+	{
+		deployment := c.in.Deployment
+		cfg.HostedServices = fns.Map(deployment.HostedServices, func(s *runtimev1.HostedService) string {
+			return s.Name
+		})
+
+		cfg.ServiceAuth = fns.Map(deployment.AuthMethods, func(sa *runtimev1.ServiceAuth) config.ServiceAuth {
+			switch sa.AuthMethod.(type) {
+			case *runtimev1.ServiceAuth_EncoreAuth_:
+				return config.ServiceAuth{Method: "encore-auth"}
+			}
+			return config.ServiceAuth{Method: "noop"}
+		})
+
+		cfg.ServiceDiscovery = make(map[string]config.Service)
+		for key, value := range deployment.ServiceDiscovery.Services {
+			method := config.ServiceAuth{Method: "noop"}
+			if len(value.AuthMethods) > 0 {
+				if _, ok := value.AuthMethods[0].AuthMethod.(*runtimev1.ServiceAuth_EncoreAuth_); ok {
+					method.Method = "encore-auth"
+				}
+			}
+			cfg.ServiceDiscovery[key] = config.Service{
+				Name:        key,
+				URL:         value.BaseUrl,
+				Protocol:    config.Http,
+				ServiceAuth: method,
+			}
+		}
+
+		if deployment.GracefulShutdown != nil {
+			cfg.GracefulShutdown = &config.GracefulShutdownTimings{
+				Total:         ptr(deployment.GracefulShutdown.Total.AsDuration()),
+				ShutdownHooks: ptr(deployment.GracefulShutdown.ShutdownHooks.AsDuration()),
+				Handlers:      ptr(deployment.GracefulShutdown.Handlers.AsDuration()),
+			}
+			cfg.ShutdownTimeout = deployment.GracefulShutdown.Total.AsDuration()
+		}
+		cfg.DynamicExperiments = deployment.DynamicExperiments
+
+		// Set the API Base URL if we have a gateway.
+		if len(c.in.Infra.Resources.Gateways) > 0 {
+			cfg.APIBaseURL = c.in.Infra.Resources.Gateways[0].BaseUrl
+		}
+
+		for _, gwRID := range deployment.HostedGateways {
+			idx := slices.IndexFunc(c.in.Infra.Resources.Gateways, func(gw *runtimev1.Gateway) bool {
+				return gw.Rid == gwRID
+			})
+			if idx >= 0 {
+				gw := c.in.Infra.Resources.Gateways[idx]
+				if gw.Cors != nil {
+					var allowOriginsWithCredentials []string
+					switch data := gw.Cors.AllowedOriginsWithCredentials.(type) {
+					case *runtimev1.Gateway_CORS_AllowedOrigins:
+						allowOriginsWithCredentials = data.AllowedOrigins.AllowedOrigins
+					case *runtimev1.Gateway_CORS_UnsafeAllowAllOriginsWithCredentials:
+						if data.UnsafeAllowAllOriginsWithCredentials {
+							allowOriginsWithCredentials = []string{config.UnsafeAllOriginWithCredentials}
+						}
+					}
+					cfg.CORS = &config.CORS{
+						Debug:                          gw.Cors.Debug,
+						DisableCredentials:             gw.Cors.DisableCredentials,
+						AllowOriginsWithCredentials:    allowOriginsWithCredentials,
+						AllowOriginsWithoutCredentials: gw.Cors.AllowedOriginsWithoutCredentials.AllowedOrigins,
+						ExtraAllowedHeaders:            gw.Cors.ExtraAllowedHeaders,
+						ExtraExposedHeaders:            gw.Cors.ExtraExposedHeaders,
+						AllowPrivateNetworkAccess:      gw.Cors.AllowPrivateNetworkAccess,
+					}
+				}
+				cfg.Gateways = append(cfg.Gateways, config.Gateway{
+					Name: gw.EncoreName,
+					Host: gw.Hostnames[0],
+				})
+			}
+		}
+
+		// Use the most verbose logging requested.
+		currLevel := zerolog.PanicLevel
+		foundLevel := false
+		for _, svc := range deployment.HostedServices {
+			if svc.LogConfig != nil {
+				if level, err := zerolog.ParseLevel(*svc.LogConfig); err == nil && level < currLevel {
+					currLevel = level
+					foundLevel = true
+				}
+			}
+		}
+		if !foundLevel {
+			currLevel = zerolog.TraceLevel
+		}
+		cfg.LogConfig = currLevel.String()
+	}
+
+	// Infrastructure handling.
+	{
+		res := c.in.Infra.Resources
+
+		getClientCert := func(certKeyRID *string) (clientCertPEM, clientKeyPem string) {
+			if certKeyRID == nil {
+				return "", ""
+			}
+			cert, ok := findRID(*certKeyRID, c.in.Infra.Credentials.ClientCerts)
+			if !ok {
+				return "", ""
+			}
+			return cert.GetCert(), c.secretString(cert.GetKey())
+		}
+
+		// SQL Servers & Databases
+		{
+			for _, cluster := range res.SqlClusters {
+				primary, ok := fns.Find(cluster.Servers, func(s *runtimev1.SQLServer) bool {
+					return s.Kind == runtimev1.ServerKind_SERVER_KIND_PRIMARY
+				})
+				if !ok {
+					c.setErrf("unable to find primary server for SQL cluster %q", cluster.Rid)
+					continue
+				}
+
+				for _, db := range cluster.Databases {
+					// Find the read-write connection pool.
+					pool, ok := fns.Find(db.ConnPools, func(pool *runtimev1.SQLConnectionPool) bool {
+						return !pool.IsReadonly
+					})
+					if !ok {
+						// Use the first pool if none were read-write
+						pool = db.ConnPools[0]
+					}
+
+					role, ok := findRID(pool.RoleRid, c.in.Infra.Credentials.SqlRoles)
+					if !ok {
+						c.setErrf("unable to find sql role %q", pool.RoleRid)
+						continue
+					}
+
+					clientCert, clientKey := getClientCert(role.ClientCertRid)
+					candidateServer := &config.SQLServer{
+						Host:       primary.Host,
+						ClientCert: clientCert,
+						ClientKey:  clientKey,
+					}
+					if primary.TlsConfig != nil {
+						candidateServer.ServerCACert = primary.TlsConfig.GetServerCaCert()
+					}
+
+					serverIdx := slices.IndexFunc(cfg.SQLServers, func(s *config.SQLServer) bool {
+						return s.Host == candidateServer.Host &&
+							s.ServerCACert == candidateServer.ServerCACert &&
+							s.ClientCert == candidateServer.ClientCert &&
+							s.ClientKey == candidateServer.ClientKey
+					})
+					if serverIdx == -1 {
+						serverIdx = len(cfg.SQLServers)
+						cfg.SQLServers = append(cfg.SQLServers, candidateServer)
+					}
+
+					cfg.SQLDatabases = append(cfg.SQLDatabases, &config.SQLDatabase{
+						ServerID:       serverIdx,
+						EncoreName:     db.EncoreName,
+						DatabaseName:   db.CloudName,
+						User:           role.Username,
+						Password:       c.secretString(role.Password),
+						MinConnections: int(pool.MinConnections),
+						MaxConnections: int(pool.MaxConnections),
+					})
+				}
+			}
+		}
+
+		// Redis Servers & Databases
+		{
+			for _, cluster := range res.RedisClusters {
+				primary, ok := fns.Find(cluster.Servers, func(s *runtimev1.RedisServer) bool {
+					return s.Kind == runtimev1.ServerKind_SERVER_KIND_PRIMARY
+				})
+				if !ok {
+					c.setErrf("unable to find primary server for Redis cluster %q", cluster.Rid)
+					continue
+				}
+
+				for _, db := range cluster.Databases {
+					// Find the read-write connection pool.
+					pool, ok := fns.Find(db.ConnPools, func(pool *runtimev1.RedisConnectionPool) bool {
+						return !pool.IsReadonly
+					})
+					if !ok {
+						// Use the first pool if none were read-write
+						pool = db.ConnPools[0]
+					}
+
+					role, ok := findRID(pool.RoleRid, c.in.Infra.Credentials.RedisRoles)
+					if !ok {
+						c.setErrf("unable to find Redis role %q", pool.RoleRid)
+						continue
+					}
+
+					user, password := func() (string, string) {
+						switch s := role.Auth.(type) {
+						case nil:
+							return "", "" // no authentication
+						case *runtimev1.RedisRole_Acl:
+							return s.Acl.Username, c.secretString(s.Acl.Password)
+						case *runtimev1.RedisRole_AuthString:
+							return "", c.secretString(s.AuthString)
+						default:
+							c.setErrf("unknown redis auth type %T", s)
+							return "", ""
+						}
+					}()
+
+					clientCert, clientKey := getClientCert(role.ClientCertRid)
+					candidateServer := &config.RedisServer{
+						Host:       primary.Host,
+						ClientCert: clientCert,
+						ClientKey:  clientKey,
+						User:       user,
+						Password:   password,
+					}
+					if primary.TlsConfig != nil {
+						candidateServer.EnableTLS = true
+						candidateServer.ServerCACert = primary.TlsConfig.GetServerCaCert()
+					}
+
+					serverIdx := slices.IndexFunc(cfg.RedisServers, func(s *config.RedisServer) bool {
+						return reflect.DeepEqual(s, candidateServer)
+					})
+					if serverIdx == -1 {
+						serverIdx = len(cfg.RedisServers)
+						cfg.RedisServers = append(cfg.RedisServers, candidateServer)
+					}
+
+					cfg.RedisDatabases = append(cfg.RedisDatabases, &config.RedisDatabase{
+						ServerID:       serverIdx,
+						EncoreName:     db.EncoreName,
+						Database:       int(db.DatabaseIdx),
+						MinConnections: int(pool.MinConnections),
+						MaxConnections: int(pool.MaxConnections),
+						KeyPrefix:      nilPtrToZero(db.KeyPrefix),
+					})
+				}
+			}
+
+		}
+
+		// Pubsub Providers & Topics
+		{
+			for _, cluster := range c.in.Infra.Resources.PubsubClusters {
+				p := &config.PubsubProvider{}
+				switch prov := cluster.Provider.(type) {
+				case *runtimev1.PubSubCluster_Encore:
+					p.EncoreCloud = &config.EncoreCloudPubsubProvider{}
+				case *runtimev1.PubSubCluster_Aws:
+					p.AWS = &config.AWSPubsubProvider{}
+				case *runtimev1.PubSubCluster_Gcp:
+					p.GCP = &config.GCPPubsubProvider{}
+				case *runtimev1.PubSubCluster_Nsq:
+					p.NSQ = &config.NSQProvider{Host: prov.Nsq.Hosts[0]}
+				case *runtimev1.PubSubCluster_Azure:
+					p.Azure = &config.AzureServiceBusProvider{Namespace: prov.Azure.Namespace}
+				default:
+					c.setErrf("unknown pubsub provider type %T", prov)
+					continue
+				}
+
+				providerID := len(cfg.PubsubProviders)
+				cfg.PubsubProviders = append(cfg.PubsubProviders, p)
+				for _, top := range cluster.Topics {
+					cfg.PubsubTopics[top.EncoreName] = &config.PubsubTopic{
+						EncoreName:    top.EncoreName,
+						ProviderID:    providerID,
+						ProviderName:  top.CloudName,
+						Limiter:       nil, // TODO?
+						Subscriptions: make(map[string]*config.PubsubSubscription),
+						GCP: func() *config.PubsubTopicGCPData {
+							switch pc := top.ProviderConfig.(type) {
+							case *runtimev1.PubSubTopic_GcpConfig:
+								return &config.PubsubTopicGCPData{
+									ProjectID: pc.GcpConfig.ProjectId,
+								}
+							}
+							return nil
+						}(),
+					}
+				}
+
+				for _, sub := range cluster.Subscriptions {
+					topic := cfg.PubsubTopics[sub.TopicEncoreName]
+					if topic == nil {
+						// In the new config we could end up with a subscription where the
+						// corresponding topic wasn't included, as we only include what's needed.
+						// That doesn't work with the legacy metadata, so add it here in that case.
+						topic = &config.PubsubTopic{
+							EncoreName:    sub.TopicEncoreName,
+							ProviderID:    providerID,
+							ProviderName:  sub.TopicCloudName,
+							Limiter:       nil,
+							Subscriptions: make(map[string]*config.PubsubSubscription),
+							GCP: func() *config.PubsubTopicGCPData {
+								// HACK: this synthesizes a topic config based on the subscription's config.
+								// That's not correct in the general case, but we only get here
+								// if the service doesn't have access to the topic in the first place,
+								// so this should be fine and prevents the runtime from exploding since
+								// it doesn't expect to get a nil topic config.
+								switch sub.ProviderConfig.(type) {
+								case *runtimev1.PubSubSubscription_GcpConfig:
+									return &config.PubsubTopicGCPData{
+										ProjectID: "",
+									}
+								}
+								return nil
+							}(),
+						}
+						cfg.PubsubTopics[sub.TopicEncoreName] = topic
+					}
+
+					topic.Subscriptions[sub.SubscriptionEncoreName] = &config.PubsubSubscription{
+						ID:           sub.Rid,
+						EncoreName:   sub.SubscriptionEncoreName,
+						ProviderName: sub.SubscriptionCloudName,
+						PushOnly:     sub.PushOnly,
+						GCP: func() *config.PubsubSubscriptionGCPData {
+							switch pc := sub.ProviderConfig.(type) {
+							case *runtimev1.PubSubSubscription_GcpConfig:
+								return &config.PubsubSubscriptionGCPData{
+									ProjectID:          pc.GcpConfig.ProjectId,
+									PushServiceAccount: pc.GcpConfig.GetPushServiceAccount(),
+								}
+							}
+							return nil
+						}(),
+					}
+				}
+			}
+		}
+
+		// Cloud Storage
+		{
+			for _, cluster := range c.in.Infra.Resources.BucketClusters {
+				p := &config.BucketProvider{}
+				switch prov := cluster.Provider.(type) {
+				case *runtimev1.BucketCluster_S3_:
+					p.S3 = &config.S3BucketProvider{
+						Region:          prov.S3.GetRegion(),
+						Endpoint:        prov.S3.Endpoint,
+						AccessKeyID:     prov.S3.AccessKeyId,
+						SecretAccessKey: ptrOrNil(c.secretString(prov.S3.SecretAccessKey)),
+					}
+				case *runtimev1.BucketCluster_Gcs:
+					p.GCS = &config.GCSBucketProvider{
+						Endpoint:  prov.Gcs.GetEndpoint(),
+						Anonymous: prov.Gcs.Anonymous,
+					}
+					if opt := prov.Gcs.LocalSign; opt != nil {
+						p.GCS.LocalSign = &config.GCSLocalSignOptions{
+							BaseURL:    opt.BaseUrl,
+							AccessID:   opt.AccessId,
+							PrivateKey: opt.PrivateKey,
+						}
+					}
+				default:
+					c.setErrf("unknown object storage provider type %T", prov)
+					continue
+				}
+
+				providerID := len(cfg.BucketProviders)
+				cfg.BucketProviders = append(cfg.BucketProviders, p)
+				for _, bkt := range cluster.Buckets {
+					cfg.Buckets[bkt.EncoreName] = &config.Bucket{
+						ProviderID:    providerID,
+						EncoreName:    bkt.EncoreName,
+						CloudName:     bkt.CloudName,
+						KeyPrefix:     bkt.GetKeyPrefix(),
+						PublicBaseURL: bkt.GetPublicBaseUrl(),
+					}
+				}
+
+			}
+		}
+	}
+
+	// Observability.
+	{
+		obs := c.in.Deployment.Observability
+		if len(obs.Metrics) > 0 {
+			prov := obs.Metrics[0]
+			m := &config.Metrics{
+				CollectionInterval: prov.CollectionInterval.AsDuration(),
+			}
+			switch p := prov.Provider.(type) {
+			case *runtimev1.MetricsProvider_Gcp:
+				pp := p.Gcp
+				m.CloudMonitoring = &config.GCPCloudMonitoringProvider{
+					ProjectID:               pp.ProjectId,
+					MonitoredResourceType:   pp.MonitoredResourceType,
+					MonitoredResourceLabels: pp.MonitoredResourceLabels,
+					MetricNames:             pp.MetricNames,
+				}
+			case *runtimev1.MetricsProvider_EncoreCloud:
+				pp := p.EncoreCloud
+				m.EncoreCloud = &config.GCPCloudMonitoringProvider{
+					ProjectID:               pp.ProjectId,
+					MonitoredResourceType:   pp.MonitoredResourceType,
+					MonitoredResourceLabels: pp.MonitoredResourceLabels,
+					MetricNames:             pp.MetricNames,
+				}
+			case *runtimev1.MetricsProvider_Aws:
+				pp := p.Aws
+				m.CloudWatch = &config.AWSCloudWatchMetricsProvider{Namespace: pp.Namespace}
+			case *runtimev1.MetricsProvider_Datadog_:
+				pp := p.Datadog
+				m.Datadog = &config.DatadogProvider{
+					APIKey: c.secretString(pp.ApiKey),
+					Site:   pp.Site,
+				}
+
+			case *runtimev1.MetricsProvider_PromRemoteWrite:
+				pp := p.PromRemoteWrite
+				m.Prometheus = &config.PrometheusRemoteWriteProvider{
+					RemoteWriteURL: c.secretString(pp.RemoteWriteUrl),
+				}
+
+			default:
+				c.setErrf("unknown metrics provider type %T", p)
+			}
+
+			cfg.Metrics = m
+		}
+
+		// Add the Encore Tracing endpoint, if any.
+		for _, prov := range obs.Tracing {
+			if enc := prov.GetEncore(); enc != nil {
+				cfg.TraceEndpoint = enc.TraceEndpoint
+				cfg.TraceSamplingRate = enc.SamplingRate
+				break
+			}
+		}
+	}
+
+	if c.in.EncorePlatform != nil {
+		cfg.AuthKeys = c.authKeys(c.in.EncorePlatform.PlatformSigningKeys)
+	}
+
+	if ec := c.in.EncorePlatform.GetEncoreCloud(); ec != nil {
+		cfg.EncoreCloudAPI = &config.EncoreCloudAPI{
+			Server: ec.ServerUrl,
+			AuthKeys: fns.Map(c.authKeys(ec.AuthKeys), func(k config.EncoreAuthKey) auth.Key {
+				return auth.Key{KeyID: k.KeyID, Data: k.Data}
+			}),
+		}
+	}
+
+	if c.err != nil {
+		return nil, c.err
+	}
+	return cfg, nil
+}
+
+func (c *legacyConverter) envType() encore.EnvironmentType {
+	switch c.in.Environment.EnvType {
+	case runtimev1.Environment_TYPE_DEVELOPMENT:
+		return encore.EnvDevelopment
+	case runtimev1.Environment_TYPE_PRODUCTION:
+		return encore.EnvProduction
+	case runtimev1.Environment_TYPE_EPHEMERAL:
+		return encore.EnvEphemeral
+	case runtimev1.Environment_TYPE_TEST:
+		return encore.EnvTest
+	default:
+		c.setErrf("unknown environment type %+v", c.in.Environment.EnvType)
+		return ""
+	}
+}
+
+func (c *legacyConverter) envCloud() encore.CloudProvider {
+	switch c.in.Environment.Cloud {
+	case runtimev1.Environment_CLOUD_LOCAL:
+		return encore.CloudLocal
+	case runtimev1.Environment_CLOUD_AWS:
+		return encore.CloudAWS
+	case runtimev1.Environment_CLOUD_GCP:
+		return encore.CloudGCP
+	case runtimev1.Environment_CLOUD_AZURE:
+		return encore.CloudAzure
+	case runtimev1.Environment_CLOUD_ENCORE:
+		return encore.EncoreCloud
+	default:
+		c.setErrf("unknown cloud %+v", c.in.Environment.Cloud)
+		return ""
+	}
+}
+
+func (c *legacyConverter) authKeys(keys []*runtimev1.EncoreAuthKey) []config.EncoreAuthKey {
+	return fns.Map(keys, func(k *runtimev1.EncoreAuthKey) config.EncoreAuthKey {
+		return config.EncoreAuthKey{
+			KeyID: k.Id,
+			Data:  c.secretBytes(k.Data),
+		}
+	})
+}
+
+func (c *legacyConverter) limiter(lim *runtimev1.RateLimiter) *config.Limiter {
+	if lim == nil {
+		return nil
+	}
+
+	switch lim := lim.Kind.(type) {
+	case *runtimev1.RateLimiter_TokenBucket_:
+		return &config.Limiter{
+			TokenBucket: &config.TokenBucketLimiter{
+				PerSecondRate: lim.TokenBucket.Rate,
+				BucketSize:    int(lim.TokenBucket.Burst),
+			},
+		}
+	default:
+		c.setErrf("unknown rate limiter type %T", lim)
+		return nil
+	}
+}
+
+func (c *legacyConverter) secretString(s *runtimev1.SecretData) string {
+	return string(c.secretBytes(s))
+}
+
+func (c *legacyConverter) secretBytes(s *runtimev1.SecretData) []byte {
+	if s == nil {
+		return nil
+	}
+
+	// First resolve the secret data
+	var secretData []byte
+	switch data := s.Source.(type) {
+	case *runtimev1.SecretData_Embedded:
+		secretData = data.Embedded
+	case *runtimev1.SecretData_Env:
+		val, ok := c.secretEnvs[data.Env]
+		if !ok {
+			c.setErrf("missing secret env var %q", data.Env)
+		}
+		secretData = val
+	default:
+		c.setErrf("unknown secret data type %T", data)
+		return nil
+	}
+
+	// Resolve a sub-path, if any.
+	switch sub := s.SubPath.(type) {
+	case nil:
+		// No sub-path defined.
+		return secretData
+
+	case *runtimev1.SecretData_JsonKey:
+		jsonObj := map[string]any{}
+		if err := json.Unmarshal(secretData, &jsonObj); err != nil {
+			c.setErrf("secret data is not valid json: %v", err)
+			return nil
+		}
+		val, ok := jsonObj[sub.JsonKey]
+		if !ok {
+			c.setErrf("missing json key %q", sub.JsonKey)
+		}
+		switch val := val.(type) {
+		case string:
+			return []byte(val)
+		case map[string]any:
+			baseVal, ok := val["bytes"]
+			if !ok {
+				panic("missing bytes key")
+			}
+			b64Str, ok := baseVal.(string)
+			if !ok {
+				panic("bytes key is not a string")
+			}
+			bytes, err := base64.StdEncoding.DecodeString(b64Str)
+			if err != nil {
+				panic(err)
+			}
+			return bytes
+		default:
+			panic("unexpected value type")
+		}
+	default:
+		c.setErrf("unknown secret sub-path type %T", s)
+		return nil
+	}
+}
+
+func (c *legacyConverter) setErr(err error) {
+	if c.err == nil {
+		c.err = err
+	}
+}
+
+func (c *legacyConverter) setErrf(format string, args ...any) {
+	c.setErr(errors.Newf(format, args...))
+}
+
+func nilPtrToZero[T comparable](val *T) T {
+	if val == nil {
+		var zero T
+		return zero
+	}
+	return *val
+}
+
+func ptr[T comparable](val T) *T {
+	return &val
+}
+
+func ptrOrNil[T comparable](val T) *T {
+	var zero T
+	if val == zero {
+		return nil
+	}
+	return &val
+}
+
+func randomMapValue[K comparable, V any](m map[K]V) (V, bool) {
+	for _, v := range m {
+		return v, true
+	}
+	var zero V
+	return zero, false
+}
diff --git a/pkg/rtconfgen/infra_builder.go b/pkg/rtconfgen/infra_builder.go
new file mode 100644
index 0000000000..3001367599
--- /dev/null
+++ b/pkg/rtconfgen/infra_builder.go
@@ -0,0 +1,367 @@
+package rtconfgen
+
+import (
+	"slices"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	runtimev1 "encr.dev/proto/encore/runtime/v1"
+)
+
+type InfraBuilder struct {
+	infra *runtimev1.Infrastructure
+	rs    *resourceSet
+}
+
+func newInfraBuilder(rs *resourceSet) *InfraBuilder {
+	infra := &runtimev1.Infrastructure{
+		Credentials: &runtimev1.Infrastructure_Credentials{},
+		Resources:   &runtimev1.Infrastructure_Resources{},
+	}
+	return &InfraBuilder{
+		infra: infra,
+		rs:    rs,
+	}
+}
+
+func (b *InfraBuilder) ClientCert(rid string, fn func() *runtimev1.ClientCert) *ClientCert {
+	val := addResFunc(&b.infra.Credentials.ClientCerts, b.rs, rid, fn)
+	return &ClientCert{Val: val, b: b}
+}
+
+type ClientCert struct {
+	Val *runtimev1.ClientCert
+	b   *InfraBuilder
+}
+
+func (b *InfraBuilder) SQLRole(p *runtimev1.SQLRole) *SQLRole {
+	return b.SQLRoleFn(p.Rid, tofn(p))
+}
+
+func (b *InfraBuilder) SQLRoleFn(rid string, fn func() *runtimev1.SQLRole) *SQLRole {
+	val := addResFunc(&b.infra.Credentials.SqlRoles, b.rs, rid, fn)
+	return &SQLRole{Val: val, b: b}
+}
+
+type SQLRole struct {
+	Val *runtimev1.SQLRole
+	b   *InfraBuilder
+}
+
+func (b *InfraBuilder) SQLCluster(p *runtimev1.SQLCluster) *SQLCluster {
+	return b.SQLClusterFn(p.Rid, tofn(p))
+}
+
+func (b *InfraBuilder) SQLClusterFn(rid string, fn func() *runtimev1.SQLCluster) *SQLCluster {
+	val := addResFunc(&b.infra.Resources.SqlClusters, b.rs, rid, fn)
+	return &SQLCluster{Val: val, b: b}
+}
+
+type SQLCluster struct {
+	Val *runtimev1.SQLCluster
+	b   *InfraBuilder
+}
+
+func (c *SQLCluster) SQLDatabase(p *runtimev1.SQLDatabase) *SQLDatabase {
+	return c.SQLDatabaseFn(p.Rid, tofn(p))
+}
+
+func (c *SQLCluster) SQLDatabaseFn(rid string, fn func() *runtimev1.SQLDatabase) *SQLDatabase {
+	val := addResFunc(&c.Val.Databases, c.b.rs, rid, fn)
+	return &SQLDatabase{Val: val, b: c.b}
+}
+
+type SQLDatabase struct {
+	Val *runtimev1.SQLDatabase
+	b   *InfraBuilder
+}
+
+func (c *SQLDatabase) AddConnectionPool(p *runtimev1.SQLConnectionPool) {
+	c.Val.ConnPools = append(c.Val.ConnPools, p)
+}
+
+func (c *SQLCluster) SQLServer(p *runtimev1.SQLServer) *SQLServer {
+	return c.SQLServerFn(p.Rid, tofn(p))
+}
+
+func (c *SQLCluster) SQLServerFn(rid string, fn func() *runtimev1.SQLServer) *SQLServer {
+	val := addResFunc(&c.Val.Servers, c.b.rs, rid, fn)
+	return &SQLServer{Val: val, b: c.b}
+}
+
+type SQLServer struct {
+	Val *runtimev1.SQLServer
+	b   *InfraBuilder
+}
+
+func (b *InfraBuilder) PubSubCluster(p *runtimev1.PubSubCluster) *PubSubCluster {
+	return b.PubSubClusterFn(p.Rid, tofn(p))
+}
+
+func (b *InfraBuilder) PubSubClusterFn(rid string, fn func() *runtimev1.PubSubCluster) *PubSubCluster {
+	val := addResFunc(&b.infra.Resources.PubsubClusters, b.rs, rid, fn)
+	return &PubSubCluster{Val: val, b: b}
+}
+
+type PubSubCluster struct {
+	Val *runtimev1.PubSubCluster
+	b   *InfraBuilder
+}
+
+func (c *PubSubCluster) PubSubTopic(p *runtimev1.PubSubTopic) *PubSubTopic {
+	return c.PubSubTopicFn(p.Rid, tofn(p))
+}
+
+func (c *PubSubCluster) PubSubTopicFn(rid string, fn func() *runtimev1.PubSubTopic) *PubSubTopic {
+	val := addResFunc(&c.Val.Topics, c.b.rs, rid, fn)
+	return &PubSubTopic{Val: val, b: c.b}
+}
+
+type PubSubTopic struct {
+	Val *runtimev1.PubSubTopic
+	b   *InfraBuilder
+}
+
+func (c *PubSubCluster) PubSubSubscription(p *runtimev1.PubSubSubscription) *PubSubSubscription {
+	return c.PubSubSubscriptionFn(p.Rid, tofn(p))
+}
+
+func (c *PubSubCluster) PubSubSubscriptionFn(rid string, fn func() *runtimev1.PubSubSubscription) *PubSubSubscription {
+	val := addResFunc(&c.Val.Subscriptions, c.b.rs, rid, fn)
+	return &PubSubSubscription{Val: val, b: c.b}
+}
+
+type PubSubSubscription struct {
+	Val *runtimev1.PubSubSubscription
+	b   *InfraBuilder
+}
+
+func (b *InfraBuilder) RedisRole(p *runtimev1.RedisRole) *RedisRole {
+	return b.RedisRoleFn(p.Rid, tofn(p))
+}
+
+func (b *InfraBuilder) RedisRoleFn(rid string, fn func() *runtimev1.RedisRole) *RedisRole {
+	val := addResFunc(&b.infra.Credentials.RedisRoles, b.rs, rid, fn)
+	return &RedisRole{Val: val, b: b}
+}
+
+type RedisRole struct {
+	Val *runtimev1.RedisRole
+	b   *InfraBuilder
+}
+
+func (b *InfraBuilder) RedisCluster(p *runtimev1.RedisCluster) *RedisCluster {
+	return b.RedisClusterFn(p.Rid, tofn(p))
+}
+
+func (b *InfraBuilder) RedisClusterFn(rid string, fn func() *runtimev1.RedisCluster) *RedisCluster {
+	val := addResFunc(&b.infra.Resources.RedisClusters, b.rs, rid, fn)
+	return &RedisCluster{Val: val, b: b}
+}
+
+type RedisCluster struct {
+	Val *runtimev1.RedisCluster
+	b   *InfraBuilder
+}
+
+func (c *RedisCluster) RedisDatabase(p *runtimev1.RedisDatabase) *RedisDatabase {
+	return c.RedisDatabaseFn(p.Rid, tofn(p))
+}
+
+func (c *RedisCluster) RedisDatabaseFn(rid string, fn func() *runtimev1.RedisDatabase) *RedisDatabase {
+	val := addResFunc(&c.Val.Databases, c.b.rs, rid, fn)
+	return &RedisDatabase{Val: val, b: c.b}
+}
+
+type RedisDatabase struct {
+	Val *runtimev1.RedisDatabase
+	b   *InfraBuilder
+}
+
+func (c *RedisDatabase) AddConnectionPool(p *runtimev1.RedisConnectionPool) {
+	c.Val.ConnPools = append(c.Val.ConnPools, p)
+}
+
+func (c *RedisCluster) RedisServer(p *runtimev1.RedisServer) *RedisServer {
+	return c.RedisServerFn(p.Rid, tofn(p))
+}
+
+func (c *RedisCluster) RedisServerFn(rid string, fn func() *runtimev1.RedisServer) *RedisServer {
+	val := addResFunc(&c.Val.Servers, c.b.rs, rid, fn)
+	return &RedisServer{Val: val, b: c.b}
+}
+
+type RedisServer struct {
+	Val *runtimev1.RedisServer
+	b   *InfraBuilder
+}
+
+func (b *InfraBuilder) BucketCluster(p *runtimev1.BucketCluster) *BucketCluster {
+	return b.BucketClusterFn(p.Rid, tofn(p))
+}
+
+func (b *InfraBuilder) BucketClusterFn(rid string, fn func() *runtimev1.BucketCluster) *BucketCluster {
+	val := addResFunc(&b.infra.Resources.BucketClusters, b.rs, rid, fn)
+	return &BucketCluster{Val: val, b: b}
+}
+
+type BucketCluster struct {
+	Val *runtimev1.BucketCluster
+	b   *InfraBuilder
+}
+
+func (c *BucketCluster) Bucket(p *runtimev1.Bucket) *Bucket {
+	return c.BucketFn(p.Rid, tofn(p))
+}
+
+func (c *BucketCluster) BucketFn(rid string, fn func() *runtimev1.Bucket) *Bucket {
+	val := addResFunc(&c.Val.Buckets, c.b.rs, rid, fn)
+	return &Bucket{Val: val, b: c.b}
+}
+
+type Bucket struct {
+	Val *runtimev1.Bucket
+	b   *InfraBuilder
+}
+
+func (b *InfraBuilder) Gateway(gw *runtimev1.Gateway) *Gateway {
+	return b.GatewayFn(gw.Rid, tofn(gw))
+}
+
+func (b *InfraBuilder) GatewayFn(rid string, fn func() *runtimev1.Gateway) *Gateway {
+	val := addResFunc(&b.infra.Resources.Gateways, b.rs, rid, fn)
+	return &Gateway{Val: val, b: b}
+}
+
+type Gateway struct {
+	Val *runtimev1.Gateway
+	b   *InfraBuilder
+}
+
+func (b *InfraBuilder) AppSecret(p *runtimev1.AppSecret) *AppSecret {
+	return b.AppSecretFn(p.Rid, tofn(p))
+}
+
+func (b *InfraBuilder) AppSecretFn(rid string, fn func() *runtimev1.AppSecret) *AppSecret {
+	val := addResFunc(&b.infra.Resources.AppSecrets, b.rs, rid, fn)
+	return &AppSecret{Val: val, b: b}
+}
+
+type AppSecret struct {
+	Val *runtimev1.AppSecret
+	b   *InfraBuilder
+}
+
+func (b *InfraBuilder) get() (*runtimev1.Infrastructure, error) {
+	return b.infra, nil
+}
+
+func tofn[V any](v V) func() V {
+	return func() V { return v }
+}
+
+// reduceForServices reduces the given infrastructure to only include resource accessible by
+// the given services, using the metadata for access control.
+func reduceForServices(infra *runtimev1.Infrastructure, md *meta.Data, svcs []string) *runtimev1.Infrastructure {
+	// Clone the protobuf so the changes don't affect the original.
+	infra = cloneProto(infra)
+
+	svcNames := make(map[string]bool)
+	for _, svc := range svcs {
+		svcNames[svc] = true
+	}
+
+	dbsToKeep := make(map[string]bool)
+	for _, svc := range md.Svcs {
+		if !svcNames[svc.Name] {
+			continue
+		}
+		for _, dbName := range svc.Databases {
+			dbsToKeep[dbName] = true
+		}
+	}
+
+	bucketsToKeep := make(map[string]bool)
+	for _, svc := range md.Svcs {
+		if !svcNames[svc.Name] {
+			continue
+		}
+		for _, bktName := range svc.Buckets {
+			bucketsToKeep[bktName.Bucket] = true
+		}
+	}
+
+	type subKey struct {
+		topicName string
+		subName   string
+	}
+	topicsToKeep := make(map[string]bool)
+	subsToKeep := make(map[subKey]bool)
+	for _, topic := range md.PubsubTopics {
+		for _, publisher := range topic.Publishers {
+			if svcNames[publisher.ServiceName] {
+				topicsToKeep[topic.Name] = true
+			}
+		}
+
+		for _, subscriber := range topic.Subscriptions {
+			if svcNames[subscriber.ServiceName] {
+				subsToKeep[subKey{topicName: topic.Name, subName: subscriber.Name}] = true
+			}
+		}
+	}
+
+	cachesToKeep := make(map[string]bool)
+	for _, cacheCluster := range md.CacheClusters {
+		for _, keySpace := range cacheCluster.Keyspaces {
+			if svcNames[keySpace.Service] {
+				cachesToKeep[cacheCluster.Name] = true
+			}
+		}
+	}
+
+	for _, cluster := range infra.Resources.PubsubClusters {
+		cluster.Topics = slices.DeleteFunc(cluster.Topics, func(t *runtimev1.PubSubTopic) bool {
+			_, found := topicsToKeep[t.EncoreName]
+			return !found
+		})
+		cluster.Subscriptions = slices.DeleteFunc(cluster.Subscriptions, func(t *runtimev1.PubSubSubscription) bool {
+			_, found := subsToKeep[subKey{topicName: t.TopicEncoreName, subName: t.SubscriptionEncoreName}]
+			return !found
+		})
+	}
+
+	for _, cluster := range infra.Resources.RedisClusters {
+		cluster.Databases = slices.DeleteFunc(cluster.Databases, func(t *runtimev1.RedisDatabase) bool {
+			_, found := cachesToKeep[t.EncoreName]
+			return !found
+		})
+	}
+
+	for _, cluster := range infra.Resources.BucketClusters {
+		cluster.Buckets = slices.DeleteFunc(cluster.Buckets, func(t *runtimev1.Bucket) bool {
+			_, found := bucketsToKeep[t.EncoreName]
+			return !found
+		})
+	}
+
+	secretsToKeep := secretsUsedByServices(md, svcNames)
+	infra.Resources.AppSecrets = slices.DeleteFunc(infra.Resources.AppSecrets, func(t *runtimev1.AppSecret) bool {
+		_, found := secretsToKeep[t.EncoreName]
+		return !found
+	})
+
+	return infra
+}
+
+// secretsUsedByServices returns the set of secrets that are accessible by the given services, using the metadata for access control.
+func secretsUsedByServices(md *meta.Data, svcNames map[string]bool) (secretNames map[string]bool) {
+	secretNames = make(map[string]bool)
+	for _, pkg := range md.Pkgs {
+		if len(pkg.Secrets) > 0 && (pkg.ServiceName == "" || svcNames[pkg.ServiceName]) {
+			for _, secret := range pkg.Secrets {
+				secretNames[secret] = true
+			}
+		}
+	}
+	return secretNames
+}
diff --git a/pkg/rtconfgen/resource_map.go b/pkg/rtconfgen/resource_map.go
new file mode 100644
index 0000000000..63fe9e8fc4
--- /dev/null
+++ b/pkg/rtconfgen/resource_map.go
@@ -0,0 +1,53 @@
+package rtconfgen
+
+import "fmt"
+
+// A resource is an object with a unique resource id (rid).
+type resource interface {
+	GetRid() string
+}
+
+type resourceKey struct {
+	typ string
+	rid string
+}
+
+// A resourceSet tracks whether a resource has been seen before based on its id,
+// and allows efficient lookup of a resource by id.
+type resourceSet struct {
+	m map[resourceKey]any
+}
+
+// rsAdd adds a resource to the set. It reports whether the resource was added.
+func rsAdd[R any](rs *resourceSet, rid string, fn func() R) (val R, added bool) {
+	key := internalRSKeyByID[R](rid)
+	if existing := rs.m[key]; existing != nil {
+		return existing.(R), false
+	}
+	if rs.m == nil {
+		rs.m = make(map[resourceKey]any)
+	}
+
+	val = fn()
+	rs.m[key] = val
+	return val, true
+}
+
+func internalRSKeyByID[R any](rid string) resourceKey {
+	var zero R
+	typ := fmt.Sprintf("%T", zero)
+	return resourceKey{typ, rid}
+}
+
+func addResFunc[R any](dst *[]R, rs *resourceSet, rid string, fn func() R) (stored R) {
+	*dst, stored = appendResFunc(*dst, rs, rid, fn)
+	return stored
+}
+
+func appendResFunc[R any](dst []R, rs *resourceSet, rid string, fn func() R) (result []R, stored R) {
+	stored, updated := rsAdd(rs, rid, fn)
+	if updated {
+		dst = append(dst, stored)
+	}
+	return dst, stored
+}
diff --git a/pkg/scrub/benchmark_test.go b/pkg/scrub/benchmark_test.go
new file mode 100644
index 0000000000..fbac7c1af3
--- /dev/null
+++ b/pkg/scrub/benchmark_test.go
@@ -0,0 +1,357 @@
+package scrub
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+var benchmarkTotal int64 // prevent compiler from optimizing away the benchmark
+
+func BenchmarkJSONIndices(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		bounds := JSONIndices(benchJSON, benchPaths)
+		benchmarkTotal += int64(len(bounds))
+	}
+	b.ReportMetric(float64(len(benchJSON)*b.N)/float64(b.Elapsed().Seconds())/(1024.0*1024.0), "MiB/s")
+}
+
+func BenchmarkStdlibUnmarshal(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		data := new(benchData)
+		if err := json.Unmarshal(benchJSON, &data); err != nil {
+			b.Fatal(err)
+		}
+		benchmarkTotal += int64(len(data.Data))
+	}
+	b.ReportMetric(float64(len(benchJSON)*b.N)/float64(b.Elapsed().Seconds())/(1024.0*1024.0), "MiB/s")
+}
+
+var benchPaths = []Path{
+	// data[*].friends[*].name
+	{
+		{Kind: ObjectField, FieldName: "data", CaseSensitive: true},
+		{Kind: ObjectField, FieldName: "friends", CaseSensitive: true},
+		{Kind: ObjectField, FieldName: "name", CaseSensitive: true},
+	},
+	// data[*].name
+	{
+		{Kind: ObjectField, FieldName: "data", CaseSensitive: true},
+		{Kind: ObjectField, FieldName: "name", CaseSensitive: true},
+	},
+	// data[*].address
+	{
+		{Kind: ObjectField, FieldName: "data", CaseSensitive: true},
+		{Kind: ObjectField, FieldName: "address", CaseSensitive: true},
+	},
+	// data[*].email
+	{
+		{Kind: ObjectField, FieldName: "data", CaseSensitive: true},
+		{Kind: ObjectField, FieldName: "email", CaseSensitive: true},
+	},
+}
+
+// benchJSON is randomly generated sample data.
+var benchJSON = []byte(`
+{"data": [
+  {
+    "_id": "6481d7ace923338d11cdecaf",
+    "index": 0,
+    "guid": "04d97d05-b475-4465-b15d-de7159794dac",
+    "isActive": true,
+    "balance": "$2,218.53",
+    "picture": "http://placehold.it/32x32",
+    "age": 31,
+    "eyeColor": "green",
+    "name": "Jo Pugh",
+    "gender": "female",
+    "company": "QUANTASIS",
+    "email": "jopugh@quantasis.com",
+    "phone": "+1 (934) 590-3966",
+    "address": "955 Granite Street, Nutrioso, West Virginia, 3957",
+    "about": "Culpa ut et in sit officia voluptate. Anim dolor esse qui pariatur nisi exercitation nostrud tempor labore sint. Est duis ut est nulla in tempor id velit minim deserunt ullamco laborum. Qui dolor nostrud anim deserunt nostrud anim adipisicing nostrud aliqua. Adipisicing occaecat adipisicing duis et labore sunt id ea et magna adipisicing labore. Consectetur tempor mollit mollit duis nostrud officia in elit. Dolor dolore deserunt fugiat labore aliqua fugiat irure sunt ipsum veniam.\r\n",
+    "registered": "2022-07-01T04:27:58 -02:00",
+    "latitude": -57.797481,
+    "longitude": 84.309916,
+    "tags": [
+      "ad",
+      "eiusmod",
+      "ex",
+      "dolor",
+      "sunt",
+      "excepteur",
+      "duis"
+    ],
+    "friends": [
+      {
+        "id": 0,
+        "name": "Bray Hogan"
+      },
+      {
+        "id": 1,
+        "name": "Hope Conley"
+      },
+      {
+        "id": 2,
+        "name": "Rollins Combs"
+      }
+    ],
+    "greeting": "Hello, Jo Pugh! You have 7 unread messages.",
+    "favoriteFruit": "strawberry"
+  },
+  {
+    "_id": "6481d7ac6b1179b1585fca2f",
+    "index": 1,
+    "guid": "56da4017-435e-4d4a-a9b3-6ec8ada947f6",
+    "isActive": true,
+    "balance": "$1,492.03",
+    "picture": "http://placehold.it/32x32",
+    "age": 21,
+    "eyeColor": "blue",
+    "name": "Mills Nicholson",
+    "gender": "male",
+    "company": "BOILICON",
+    "email": "millsnicholson@boilicon.com",
+    "phone": "+1 (846) 499-2163",
+    "address": "846 Albemarle Road, Celeryville, Florida, 3173",
+    "about": "Et fugiat adipisicing sit eu. Irure enim occaecat sunt duis dolor. Qui mollit velit aute excepteur aliqua qui incididunt adipisicing tempor enim.\r\n",
+    "registered": "2019-11-17T02:23:12 -01:00",
+    "latitude": 39.918662,
+    "longitude": 101.881282,
+    "tags": [
+      "consequat",
+      "laboris",
+      "minim",
+      "id",
+      "laborum",
+      "labore",
+      "cillum"
+    ],
+    "friends": [
+      {
+        "id": 0,
+        "name": "Cleo Juarez"
+      },
+      {
+        "id": 1,
+        "name": "Aline Rowe"
+      },
+      {
+        "id": 2,
+        "name": "Ester Oconnor"
+      }
+    ],
+    "greeting": "Hello, Mills Nicholson! You have 5 unread messages.",
+    "favoriteFruit": "strawberry"
+  },
+  {
+    "_id": "6481d7ac88ee534c9f5bfff0",
+    "index": 2,
+    "guid": "b46ff220-b872-4d1a-b095-2a16d30b4fbd",
+    "isActive": false,
+    "balance": "$1,673.74",
+    "picture": "http://placehold.it/32x32",
+    "age": 34,
+    "eyeColor": "blue",
+    "name": "Eunice Gould",
+    "gender": "female",
+    "company": "AVIT",
+    "email": "eunicegould@avit.com",
+    "phone": "+1 (962) 427-2923",
+    "address": "477 Hinsdale Street, Edneyville, Oregon, 9253",
+    "about": "Et Lorem qui reprehenderit incididunt labore est occaecat cupidatat ullamco mollit. Amet cillum consectetur ex sunt sint anim adipisicing duis veniam do qui enim anim cillum. Irure eu elit minim et est. Fugiat officia incididunt elit ut fugiat in do mollit ullamco sint in ut consequat. Occaecat deserunt dolor ipsum veniam aliqua mollit sit culpa elit ex.\r\n",
+    "registered": "2018-06-17T11:52:20 -02:00",
+    "latitude": 50.048343,
+    "longitude": -78.508861,
+    "tags": [
+      "amet",
+      "ullamco",
+      "voluptate",
+      "voluptate",
+      "dolor",
+      "elit",
+      "id"
+    ],
+    "friends": [
+      {
+        "id": 0,
+        "name": "Ericka Pennington"
+      },
+      {
+        "id": 1,
+        "name": "Cain Pearson"
+      },
+      {
+        "id": 2,
+        "name": "Pacheco Walters"
+      }
+    ],
+    "greeting": "Hello, Eunice Gould! You have 10 unread messages.",
+    "favoriteFruit": "banana"
+  },
+  {
+    "_id": "6481d7acce8494cef525f2bc",
+    "index": 3,
+    "guid": "1498919d-fae5-4ade-aa4a-7eb332d899e6",
+    "isActive": false,
+    "balance": "$1,592.80",
+    "picture": "http://placehold.it/32x32",
+    "age": 33,
+    "eyeColor": "brown",
+    "name": "Lindsay Howe",
+    "gender": "male",
+    "company": "EXTRAGEN",
+    "email": "lindsayhowe@extragen.com",
+    "phone": "+1 (940) 473-3478",
+    "address": "759 Montieth Street, Dellview, Wyoming, 3283",
+    "about": "Commodo minim sint non id aute minim exercitation. In qui nulla ut non reprehenderit adipisicing duis elit. Dolore non aliqua est veniam nisi id eiusmod aliqua non fugiat labore. Ullamco dolore culpa aliquip id tempor laboris. Officia adipisicing pariatur ullamco sunt veniam pariatur ullamco ullamco nostrud nisi qui mollit. Nisi velit ut commodo magna qui fugiat eu ut amet qui consequat excepteur.\r\n",
+    "registered": "2014-11-27T02:20:32 -01:00",
+    "latitude": -53.18764,
+    "longitude": -164.847231,
+    "tags": [
+      "qui",
+      "nulla",
+      "quis",
+      "exercitation",
+      "non",
+      "occaecat",
+      "est"
+    ],
+    "friends": [
+      {
+        "id": 0,
+        "name": "Stone Gallagher"
+      },
+      {
+        "id": 1,
+        "name": "Chavez Pope"
+      },
+      {
+        "id": 2,
+        "name": "Farmer Mueller"
+      }
+    ],
+    "greeting": "Hello, Lindsay Howe! You have 4 unread messages.",
+    "favoriteFruit": "apple"
+  },
+  {
+    "_id": "6481d7ac14c51c8748cbab88",
+    "index": 4,
+    "guid": "f72fa31e-bd75-46ce-a9bf-53675f50f01c",
+    "isActive": true,
+    "balance": "$1,160.87",
+    "picture": "http://placehold.it/32x32",
+    "age": 37,
+    "eyeColor": "brown",
+    "name": "Minerva Sims",
+    "gender": "female",
+    "company": "NETPLAX",
+    "email": "minervasims@netplax.com",
+    "phone": "+1 (887) 477-2537",
+    "address": "864 Ryder Avenue, Tedrow, Virginia, 4180",
+    "about": "Magna id sit adipisicing eiusmod fugiat nulla voluptate sint culpa sit consectetur est sint. Culpa velit eu velit non Lorem irure adipisicing fugiat culpa aliquip Lorem eiusmod. Occaecat ad est commodo est irure veniam magna deserunt laboris commodo quis cupidatat occaecat. Consequat exercitation officia commodo id. Incididunt magna sunt mollit labore. Proident exercitation est enim mollit reprehenderit Lorem anim. Fugiat consectetur elit anim reprehenderit.\r\n",
+    "registered": "2014-02-05T11:36:57 -01:00",
+    "latitude": 5.818084,
+    "longitude": 156.041539,
+    "tags": [
+      "do",
+      "amet",
+      "ex",
+      "dolor",
+      "cupidatat",
+      "dolor",
+      "tempor"
+    ],
+    "friends": [
+      {
+        "id": 0,
+        "name": "Karen Dickerson"
+      },
+      {
+        "id": 1,
+        "name": "Frye Jones"
+      },
+      {
+        "id": 2,
+        "name": "Rosie Travis"
+      }
+    ],
+    "greeting": "Hello, Minerva Sims! You have 5 unread messages.",
+    "favoriteFruit": "apple"
+  },
+  {
+    "_id": "6481d7ac80e906f930d8deea",
+    "index": 5,
+    "guid": "17c377e0-0ba6-46ea-8faa-6c0301ffb3d4",
+    "isActive": true,
+    "balance": "$3,838.92",
+    "picture": "http://placehold.it/32x32",
+    "age": 37,
+    "eyeColor": "green",
+    "name": "Fischer Avery",
+    "gender": "male",
+    "company": "POLARIUM",
+    "email": "fischeravery@polarium.com",
+    "phone": "+1 (876) 442-3098",
+    "address": "339 Wyona Street, Wadsworth, Arizona, 5446",
+    "about": "Laborum sint consectetur et ex officia. Aliqua veniam aliquip aliqua pariatur deserunt quis esse nisi non amet culpa. Sint nostrud magna sit amet mollit fugiat non adipisicing.\r\n",
+    "registered": "2022-01-30T12:04:00 -01:00",
+    "latitude": 33.64373,
+    "longitude": 114.28595,
+    "tags": [
+      "ex",
+      "ipsum",
+      "adipisicing",
+      "sint",
+      "elit",
+      "et",
+      "ad"
+    ],
+    "friends": [
+      {
+        "id": 0,
+        "name": "Gayle Walker"
+      },
+      {
+        "id": 1,
+        "name": "Sherman Tyler"
+      },
+      {
+        "id": 2,
+        "name": "Gladys Shaffer"
+      }
+    ],
+    "greeting": "Hello, Fischer Avery! You have 2 unread messages.",
+    "favoriteFruit": "banana"
+  }
+]}
+`)
+
+type benchData struct {
+	Data []struct {
+		Id         string   `json:"_id"`
+		Index      int      `json:"index"`
+		Guid       string   `json:"guid"`
+		IsActive   bool     `json:"isActive"`
+		Balance    string   `json:"balance"`
+		Picture    string   `json:"picture"`
+		Age        int      `json:"age"`
+		EyeColor   string   `json:"eyeColor"`
+		Name       string   `json:"name"`
+		Gender     string   `json:"gender"`
+		Company    string   `json:"company"`
+		Email      string   `json:"email"`
+		Phone      string   `json:"phone"`
+		Address    string   `json:"address"`
+		About      string   `json:"about"`
+		Registered string   `json:"registered"`
+		Latitude   float64  `json:"latitude"`
+		Longitude  float64  `json:"longitude"`
+		Tags       []string `json:"tags"`
+		Friends    []struct {
+			Id   int    `json:"id"`
+			Name string `json:"name"`
+		} `json:"friends"`
+		Greeting      string `json:"greeting"`
+		FavoriteFruit string `json:"favoriteFruit"`
+	} `json:"data"`
+}
diff --git a/pkg/scrub/metascrub/metascrub.go b/pkg/scrub/metascrub/metascrub.go
new file mode 100644
index 0000000000..d60f6ef7e5
--- /dev/null
+++ b/pkg/scrub/metascrub/metascrub.go
@@ -0,0 +1,296 @@
+// Package metascrub computes scrub paths for a metadata type.
+package metascrub
+
+import (
+	"slices"
+	"strconv"
+
+	"github.com/rs/zerolog"
+
+	"encr.dev/pkg/scrub"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+)
+
+// New constructs a new Computer for the given metadata.
+func New(md *meta.Data, log zerolog.Logger) *Computer {
+	return &Computer{
+		md:        md,
+		log:       log.With().Str("component", "metascrub").Logger(),
+		declCache: make(map[declCacheKey]declResult),
+	}
+}
+
+// Computer computes scrub paths for types, caching the computation.
+// It can safely be reused across multiple types for the same metadata.
+// It is not safe for concurrent use.
+type Computer struct {
+	md  *meta.Data
+	log zerolog.Logger
+
+	// declCache caches the scrub paths for encountered declarations
+	declCache map[declCacheKey]declResult
+}
+
+type Desc struct {
+	Payload []scrub.Path
+	Headers []string
+}
+
+type ParseMode int
+
+const (
+	// AuthHandler specifies that the type is an auth handler.
+	AuthHandler ParseMode = 1 << iota
+)
+
+// Compute computes the scrub paths for the given typ.
+// It is not safe for concurrent use.
+func (c *Computer) Compute(typ *schema.Type, mode ParseMode) Desc {
+	if typ == nil {
+		return Desc{}
+	}
+
+	defer func() {
+		if err := recover(); err != nil {
+			c.log.Error().Stack().Msgf("metascrub.Compute panicked: %v", err)
+		}
+	}()
+
+	p := &typeParser{c: c, mode: mode}
+	res := p.typ(typ)
+
+	// Did we exceed the steps?
+	if p.steps > maxSteps {
+		c.log.Error().Msg("metascrub.Compute aborted due to exceeding max steps")
+	}
+
+	return Desc{
+		Payload: res.scrub,
+		Headers: res.headers,
+	}
+}
+
+const maxSteps = 10000
+
+type typeParser struct {
+	c    *Computer
+	mode ParseMode
+
+	// steps is a fail-safe to catch any potential infinite loops.
+	steps int
+}
+
+type declCacheKey struct {
+	id   uint32
+	mode ParseMode
+}
+
+func (p *typeParser) decl(id uint32) declResult {
+	key := declCacheKey{id, p.mode}
+	if res, ok := p.c.declCache[key]; ok {
+		return res
+	}
+
+	// Mark that we're beginning to process this decl,
+	// so we avoid infinite recursion.
+	p.c.declCache[key] = declResult{}
+
+	// Do the actual parsing.
+	decl := p.c.md.Decls[id]
+	res := p.typ(decl.Type)
+
+	// We're done, cache the final result.
+	p.c.declCache[key] = res
+	return res
+}
+
+type declResult struct {
+	scrub      []scrub.Path
+	typeParams []typeParamPath
+	headers    []string
+}
+
+func (p *typeParser) typ(typ *schema.Type) declResult {
+	if typ == nil {
+		return declResult{}
+	}
+	p.steps++
+	if p.steps > maxSteps {
+		return declResult{}
+	}
+
+	switch t := typ.Typ.(type) {
+	case *schema.Type_Named:
+		decl := p.decl(t.Named.Id)
+		out := declResult{
+			// Clone the paths since we're modifying them.
+			scrub: slices.Clone(decl.scrub),
+
+			// Copy the headers directly since they never get modified,
+			// since we only care about the top-level type's headers.
+			headers: decl.headers,
+		}
+
+		for i, arg := range t.Named.TypeArguments {
+			argRes := p.typ(arg)
+			if len(argRes.scrub) == 0 && len(argRes.typeParams) == 0 {
+				// Nothing to do
+				continue
+			}
+
+			// For every type parameter, find the places
+			// where it's used and copy it to the combined result.
+			for _, declParam := range decl.typeParams {
+				if declParam.paramIdx == uint32(i) {
+					for _, s := range argRes.scrub {
+						path := append(slices.Clone(declParam.p), s...)
+						out.scrub = append(out.scrub, path)
+					}
+					for _, s := range argRes.typeParams {
+						path := append(slices.Clone(declParam.p), s.p...)
+						out.typeParams = append(out.typeParams, typeParamPath{
+							p:        path,
+							paramIdx: s.paramIdx,
+						})
+					}
+				}
+			}
+
+		}
+		return out
+
+	case *schema.Type_Pointer:
+		return p.typ(t.Pointer.Base)
+
+	case *schema.Type_List:
+		return p.typ(t.List.Elem)
+
+	case *schema.Type_Union:
+		var results []declResult
+		var numScrub, numTypeParams, numHeaders int
+		for _, typ := range t.Union.Types {
+			res := p.typ(typ)
+			results = append(results, res)
+			numScrub += len(res.scrub)
+			numTypeParams += len(res.typeParams)
+			numHeaders += len(res.headers)
+		}
+		combined := declResult{
+			scrub:      make([]scrub.Path, 0, numScrub),
+			typeParams: make([]typeParamPath, 0, numTypeParams),
+			headers:    make([]string, 0, numHeaders),
+		}
+		for _, res := range results {
+			combined.scrub = append(combined.scrub, res.scrub...)
+			combined.typeParams = append(combined.typeParams, res.typeParams...)
+			combined.headers = append(combined.headers, res.headers...)
+		}
+		return combined
+
+	case *schema.Type_Map:
+		key := p.typ(t.Map.Key)
+		val := p.typ(t.Map.Value)
+
+		combined := declResult{
+			scrub:      make([]scrub.Path, 0, len(key.scrub)+len(val.scrub)),
+			typeParams: make([]typeParamPath, 0, len(key.typeParams)+len(val.typeParams)),
+		}
+		for i, res := range [...]declResult{key, val} {
+			kind := scrub.MapKey
+			if i == 1 {
+				kind = scrub.MapValue
+			}
+			for _, e := range res.scrub {
+				path := append(scrub.Path{{Kind: kind}}, e...)
+				combined.scrub = append(combined.scrub, path)
+			}
+			for _, e := range res.typeParams {
+				path := append(scrub.Path{{Kind: kind}}, e.p...)
+				combined.typeParams = append(combined.typeParams, typeParamPath{p: path, paramIdx: e.paramIdx})
+			}
+		}
+		return combined
+
+	case *schema.Type_Struct:
+		var out declResult
+		for _, f := range t.Struct.Fields {
+			sensitive, fieldName, caseSensitive := isSensitive(f)
+
+			// For Auth Handlers everything is sensitive.
+			if (p.mode & AuthHandler) != 0 {
+				sensitive = true
+			}
+
+			if sensitive {
+				// If the field is sensitive add it directly.
+				out.scrub = append(out.scrub, scrub.Path{{Kind: scrub.ObjectField, FieldName: fieldName, CaseSensitive: caseSensitive}})
+
+				// If this is a header field, add it to the headers to scrub.
+				if headerName, ok := isHeader(f); ok {
+					out.headers = append(out.headers, headerName)
+				}
+			} else {
+				// Otherwise check the type and see if there's anything to scrub within it.
+				fieldRes := p.typ(f.Typ)
+				for _, e := range fieldRes.scrub {
+					path := append(scrub.Path{{Kind: scrub.ObjectField, FieldName: fieldName, CaseSensitive: caseSensitive}}, e...)
+					out.scrub = append(out.scrub, path)
+				}
+				for _, e := range fieldRes.typeParams {
+					path := append(scrub.Path{{Kind: scrub.ObjectField, FieldName: fieldName, CaseSensitive: caseSensitive}}, e.p...)
+					out.typeParams = append(out.typeParams, typeParamPath{p: path, paramIdx: e.paramIdx})
+				}
+			}
+		}
+		return out
+
+	case *schema.Type_Builtin, *schema.Type_Literal:
+		// Nothing to do
+		return declResult{}
+
+	case *schema.Type_TypeParameter:
+		return declResult{typeParams: []typeParamPath{{
+			paramIdx: t.TypeParameter.ParamIdx,
+		}}}
+
+	default:
+		p.c.log.Warn().Msgf("got unexpected schema.Type %T in metascrub, skipping", t)
+		return declResult{}
+	}
+}
+
+func isSensitive(f *schema.Field) (sensitive bool, fieldName string, caseSensitive bool) {
+	fieldName = f.Name
+	if f.JsonName != "" {
+		fieldName = f.JsonName
+		caseSensitive = true
+	}
+	fieldName = strconv.Quote(fieldName) // the scrub package wants exact byte matches
+
+	for _, t := range f.Tags {
+		if t.Key == "encore" {
+			sensitive = t.Name == "sensitive" || slices.Contains(t.Options, "sensitive")
+			break
+		}
+	}
+	return sensitive, fieldName, caseSensitive
+}
+
+func isHeader(f *schema.Field) (headerName string, ok bool) {
+	for _, t := range f.Tags {
+		if t.Key == "header" {
+			name := t.Name
+			if name == "" {
+				name = f.Name
+			}
+			return name, true
+		}
+	}
+	return "", false
+}
+
+type typeParamPath struct {
+	p        scrub.Path
+	paramIdx uint32
+}
diff --git a/pkg/scrub/metascrub/metascrub_test.go b/pkg/scrub/metascrub/metascrub_test.go
new file mode 100644
index 0000000000..f189b16b23
--- /dev/null
+++ b/pkg/scrub/metascrub/metascrub_test.go
@@ -0,0 +1,181 @@
+package metascrub
+
+import (
+	"context"
+	"os"
+	"strconv"
+	"strings"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/rogpeppe/go-internal/txtar"
+	"github.com/rs/zerolog"
+
+	"encr.dev/cli/daemon/apps"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/scrub"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	"encr.dev/v2/v2builder"
+)
+
+func TestScrub(t *testing.T) {
+	c := qt.New(t)
+	md := testParse(c, `
+-- svc/svc.go --
+package svc
+import "context"
+
+type Params struct {
+	Foo string SCRUB
+
+	NestedScrub struct {
+		Inner string SCRUB
+	} SCRUB
+
+	Nested struct {
+		Inner string SCRUB
+	}
+
+	List []string SCRUB
+	ListInner []struct { Inner string SCRUB }
+
+	RecurseScrub *Params SCRUB
+	// Ideally this should yield nested scrubs but we don't support that yet.
+	Recurse *Params
+
+	Gen      Generic[string]
+	GenScrub Generic[string] SCRUB
+	GenInner Generic[Bar]
+	Multi    NestedGeneric[string, Bar]
+
+	MapOne map[Generic[Bar]]NestedGeneric[string, Bar]
+	MapTwo GenericMap[Bar, NestedGeneric[string, Bar]]
+
+	JsonKey string `+"`"+`json:"json_key" encore:"sensitive"`+"`"+`
+	Header string `+"`"+`header:"X-Header" encore:"sensitive"`+"`"+`
+}
+
+type Generic[T any] struct {
+	Foo T
+	FooScrub T SCRUB
+}
+
+type NestedGeneric[A any, B any] struct {
+	One NestedGenericTwo[B, string]
+	Two B
+}
+
+type NestedGenericTwo[A any, B any] struct {
+	Alpha A
+	Beta B
+}
+
+type GenericMap[K comparable, V any] struct {
+	Foo map[K]V
+}
+
+type Bar struct {
+	Scrub string SCRUB
+}
+
+//encore:api public
+func Foo(ctx context.Context, p *Params) error { return nil }
+`)
+
+	cmp := New(md, zerolog.New(os.Stdout))
+	rpc := md.Svcs[0].Rpcs[0]
+	res := cmp.Compute(rpc.RequestSchema, 0)
+
+	f := func(name string) scrub.PathEntry {
+		return scrub.PathEntry{Kind: scrub.ObjectField, FieldName: strconv.Quote(name)}
+	}
+	fCase := func(name string) scrub.PathEntry {
+		return scrub.PathEntry{Kind: scrub.ObjectField, FieldName: strconv.Quote(name), CaseSensitive: true}
+	}
+	mapKey := scrub.PathEntry{Kind: scrub.MapKey}
+	mapVal := scrub.PathEntry{Kind: scrub.MapValue}
+
+	c.Assert(res.Payload, qt.DeepEquals, []scrub.Path{
+		{f("Foo")},
+		{f("NestedScrub")},
+		{f("Nested"), f("Inner")},
+		{f("List")},
+		{f("ListInner"), f("Inner")},
+		{f("RecurseScrub")},
+		{f("Gen"), f("FooScrub")},
+		{f("GenScrub")},
+		{f("GenInner"), f("FooScrub")},
+		{f("GenInner"), f("Foo"), f("Scrub")},
+		{f("Multi"), f("One"), f("Alpha"), f("Scrub")},
+		{f("Multi"), f("Two"), f("Scrub")},
+
+		{f("MapOne"), mapKey, f("FooScrub")},
+		{f("MapOne"), mapKey, f("Foo"), f("Scrub")},
+		{f("MapOne"), mapVal, f("One"), f("Alpha"), f("Scrub")},
+		{f("MapOne"), mapVal, f("Two"), f("Scrub")},
+		{f("MapTwo"), f("Foo"), mapKey, f("Scrub")},
+		{f("MapTwo"), f("Foo"), mapVal, f("One"), f("Alpha"), f("Scrub")},
+		{f("MapTwo"), f("Foo"), mapVal, f("Two"), f("Scrub")},
+		{fCase("json_key")},
+		{f("Header")},
+	})
+
+	c.Assert(res.Headers, qt.DeepEquals, []string{"X-Header"})
+}
+
+func TestScrubAuthHandler(t *testing.T) {
+	c := qt.New(t)
+	md := testParse(c, `
+-- svc/svc.go --
+package svc
+import "context"
+
+type Params struct {
+	Header string `+"`"+`header:"Foo"`+"`"+`
+	Query string `+"`"+`query:"query"`+"`"+`
+	Other string
+}
+
+//encore:api public
+func Foo(ctx context.Context, p *Params) error { return nil }
+`)
+
+	cmp := New(md, zerolog.New(os.Stdout))
+	rpc := md.Svcs[0].Rpcs[0]
+	res := cmp.Compute(rpc.RequestSchema, AuthHandler)
+
+	f := func(name string) scrub.PathEntry {
+		return scrub.PathEntry{Kind: scrub.ObjectField, FieldName: strconv.Quote(name)}
+	}
+
+	c.Assert(res.Payload, qt.DeepEquals, []scrub.Path{
+		{f("Header")},
+		{f("Query")},
+		{f("Other")},
+	})
+
+	c.Assert(res.Headers, qt.DeepEquals, []string{"Foo"})
+}
+
+func testParse(c *qt.C, code string) *meta.Data {
+	code = strings.Replace(code, "SCRUB", "`encore:\"sensitive\"`", -1)
+	ar := txtar.Parse([]byte(code))
+	ar.Files = append(ar.Files, txtar.File{Name: "go.mod", Data: []byte("module test")})
+
+	root := c.TempDir()
+	err := txtar.Write(ar, root)
+	c.Assert(err, qt.IsNil)
+
+	bld := v2builder.BuilderImpl{}
+	ctx := context.Background()
+
+	res, err := bld.Parse(ctx, builder.ParseParams{
+		Build:       builder.DefaultBuildInfo(),
+		App:         apps.NewInstance(root, "test", ""),
+		Experiments: nil,
+		WorkingDir:  ".",
+		ParseTests:  false,
+	})
+	c.Assert(err, qt.IsNil)
+	return res.Meta
+}
diff --git a/pkg/scrub/scanner.go b/pkg/scrub/scanner.go
new file mode 100644
index 0000000000..60f96ae917
--- /dev/null
+++ b/pkg/scrub/scanner.go
@@ -0,0 +1,254 @@
+package scrub
+
+import "io"
+
+func newScanner(r io.ByteReader) *scanner {
+	return &scanner{r: r}
+}
+
+type scanner struct {
+	r          io.ByteReader
+	it         scanItem
+	err        error // first error encountered; EOF on successful completion
+	pos        int64
+	lastRead   byte
+	unreadByte byte // unread byte in storage, or 0 if none.
+
+	// stack keeps track of the stack of objects/arrays we've started
+	// but not yet completed parsing. It's used to determine whether
+	// a value encountered in parsing an object is a key or a value.
+	stack []scanState
+}
+
+// Next advances the scanner to the next token.
+// It reports false when the whole input stream has been consumed,
+// or when reading it encountered an error.
+func (s *scanner) Next() bool {
+	s.it = s.scan()
+	return s.err == nil || s.it.tok != 0
+}
+
+func (s *scanner) Item() scanItem {
+	return s.it
+}
+
+// Err reports the first error encountered during scanning,
+// or nil if no errors were encountered.
+//
+// When the underlying reader reports io.EOF this is not reported as an
+// error but as the successful completion of scanning, so Err reports nil.
+func (s *scanner) Err() error {
+	if s.err == io.EOF {
+		return nil
+	}
+	return s.err
+}
+
+// scan consumes a single scan item.
+func (s *scanner) scan() scanItem {
+	it, preContext, postContext := s.scanOne()
+
+	// If we're inside an object, update the key detection
+	if n := len(s.stack); n > 0 {
+		if st := &s.stack[n-1]; st.tok == objectBegin {
+			switch it.tok {
+			case objectBegin, arrayBegin, literal:
+				st.isKey = !st.isKey
+			}
+			if postContext == ':' {
+				st.isKey = true
+			} else if preContext == ':' {
+				st.isKey = false
+			}
+
+			it.isMapKey = st.isKey
+		}
+	}
+
+	switch it.tok {
+	case objectBegin, arrayBegin:
+		s.stack = append(s.stack, scanState{tok: it.tok})
+	case objectEnd, arrayEnd:
+		// Pop the last entry off the stack, if we have one.
+		// Assume begin/end are balanced; it's not valid JSON if they're not
+		// and this is just a best-effort approach anyway.
+		if n := len(s.stack); n > 0 {
+			s.stack = s.stack[:n-1]
+		}
+	}
+
+	return it
+}
+
+// scanOne scans a single item.
+// The extraContext reports whether the scanning encountered a
+// newline, comma, or colon in the process.
+func (s *scanner) scanOne() (it scanItem, preContext, postContext byte) {
+	for {
+		c := s.readToken()
+		postContext = s.peekToken()
+		switch c {
+		case '"':
+			it = s.scanString()
+			return
+		case '{':
+			it = scanItem{from: s.pos - 1, to: s.pos, tok: objectBegin}
+			return
+		case '}':
+			it = scanItem{from: s.pos - 1, to: s.pos, tok: objectEnd}
+			return
+		case '[':
+			it = scanItem{from: s.pos - 1, to: s.pos, tok: arrayBegin}
+			return
+		case ']':
+			it = scanItem{from: s.pos - 1, to: s.pos, tok: arrayEnd}
+			return
+		case ':', ',':
+			preContext = c
+			continue
+		case 0:
+			return
+		default:
+			it = s.scanLiteral()
+			return
+		}
+	}
+}
+
+func (s *scanner) scanString() scanItem {
+	// Use s.pos-1 since scan already consumed the first byte.
+	it := scanItem{from: s.pos - 1, tok: literal}
+
+	for {
+		b := s.readByte()
+
+		if b == '\\' {
+			b = s.readByte()
+			// Escaped symbols never signal the end of the string,
+			// so it's safe to just continue here regardless of value.
+			continue
+		}
+
+		switch b {
+		case '"':
+			it.to = s.pos
+			return it
+		case '\n', '\r':
+			// newline or line feed, treat this as the end of the string.
+			s.unread()
+			it.to = s.pos
+			return it
+		case 0:
+			// end of input
+			it.to = s.pos
+			return it
+		}
+	}
+}
+
+func (s *scanner) scanLiteral() scanItem {
+	// Use s.pos-1 since scan already consumed the first byte.
+	it := scanItem{from: s.pos - 1, tok: literal}
+	for {
+		b := s.readByte()
+		switch b {
+		case '"', ' ', '\r', '\n', '\t', ',', ':', '{', '[', ']', '}':
+			// new token to follow
+			s.unread()
+			it.to = s.pos
+			return it
+		case 0:
+			// end of input
+			it.to = s.pos
+			return it
+		}
+	}
+}
+
+// readToken returns the next token in the input.
+// If there is no more data it reports 0.
+func (s *scanner) readToken() byte {
+	for {
+		b := s.readByte()
+		// Ignore whitespace.
+		switch b {
+		case ' ', '\t', '\n', '\r':
+			continue
+		}
+		return b
+	}
+}
+
+// peekToken peeks at the next token.
+// It is equivalent to read() followed by unread().
+func (s *scanner) peekToken() byte {
+	b := s.readToken()
+	if b != 0 {
+		s.unread()
+	}
+	return b
+}
+
+// readByte reads a single byte and returns it.
+// If there is no more data, it reports 0.
+func (s *scanner) readByte() byte {
+	// Do we have an unread byte?
+	var b byte
+	if b = s.unreadByte; b != 0 {
+		s.lastRead = b
+		s.unreadByte = 0
+		s.pos++
+		return b
+	}
+
+	if s.err != nil {
+		return 0
+	}
+
+	b, s.err = s.r.ReadByte()
+	if s.err == nil {
+		s.lastRead = b
+		s.pos++
+	}
+	return b
+}
+
+func (s *scanner) unread() {
+	if s.unreadByte != 0 {
+		panic("cannot unread multiple bytes in a row")
+	}
+	s.unreadByte = s.lastRead
+	s.pos--
+}
+
+type scanItem struct {
+	from, to int64
+	tok      token
+	isMapKey bool
+}
+
+func (it scanItem) Bounds() Bounds {
+	return Bounds{
+		From: int(it.from),
+		To:   int(it.to),
+	}
+}
+
+// token represents a single
+type token uint8
+
+//go:generate stringer -type=token
+const (
+	unknown token = iota
+
+	objectBegin // {
+	objectEnd   // }
+	arrayBegin  // [
+	arrayEnd    // ]
+	literal
+)
+
+type scanState struct {
+	tok   token
+	isKey bool
+}
diff --git a/pkg/scrub/scanner_test.go b/pkg/scrub/scanner_test.go
new file mode 100644
index 0000000000..3b50c3a91d
--- /dev/null
+++ b/pkg/scrub/scanner_test.go
@@ -0,0 +1,182 @@
+package scrub
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"testing"
+)
+
+var tests = []scannerTest{
+	{
+		name: "simple",
+		src:  `{"foo": "bar"}`,
+		want: []tokDesc{
+			objStart, k(str("foo")), str("bar"), objEnd,
+		},
+	},
+	{
+		name: "missing_quotes",
+		src:  `{"foo": "bar}`,
+		want: []tokDesc{
+			objStart, k(str("foo")), raw(`"bar}`),
+		},
+	},
+	{
+		name: "escaped_string",
+		src:  `"foo\"bar"`,
+		want: []tokDesc{
+			str("foo\"bar"),
+		},
+	},
+	{
+		name: "escaped_string_at_end",
+		src:  `"foo\""`,
+		want: []tokDesc{
+			str("foo\""),
+		},
+	},
+	{
+		name: "escaped_quoted_string",
+		src:  `["\"one\""]`,
+		want: []tokDesc{
+			arrStart, str("\"one\""), arrEnd,
+		},
+	},
+	{
+		name: "newline_reset_key",
+		src:  "{0: true, 1:\n2: true}",
+		want: []tokDesc{
+			objStart,
+			k(num(0)), raw("true"),
+			k(num(1)),
+			k(num(2)), raw("true"),
+			objEnd,
+		},
+	},
+	{
+		name: "newline_missing_quotes_reset_key",
+		src: `{"a
+"b": "c"
+}`,
+		want: []tokDesc{
+			objStart,
+			k(raw(`"a`)),
+			k(str("b")), str("c"),
+			objEnd,
+		},
+	},
+	{
+		name: "invalid_array",
+		src:  `[{"foo", ["test"]]`,
+		want: []tokDesc{
+			arrStart, objStart, k(str("foo")),
+			arrStart, str("test"), arrEnd,
+			arrEnd,
+		},
+	},
+	{
+		name: "array_as_obj_key",
+		src:  `[{["test"]]`,
+		want: []tokDesc{
+			arrStart, objStart,
+			arrStart, str("test"), arrEnd,
+			arrEnd,
+		},
+	},
+	{
+		name: "multiple_top_level_objs",
+		src:  `{"foo", "bar"}["test"]null`,
+		want: []tokDesc{
+			objStart, k(str("foo")), str("bar"), objEnd,
+			arrStart, str("test"), arrEnd,
+			raw("null"),
+		},
+	},
+}
+
+func FuzzScanner(f *testing.F) {
+	for _, test := range tests {
+		f.Add(test.src)
+	}
+	f.Fuzz(func(t *testing.T, src string) {
+		s := newScanner(strings.NewReader(src))
+		for s.Next() {
+			_ = s.Item()
+		}
+		if err := s.Err(); err != nil {
+			t.Errorf("%v", err)
+		}
+	})
+}
+
+func TestScanner(t *testing.T) {
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			lit := func(it scanItem) string {
+				if it.from < 0 || it.from > int64(len(test.src)) {
+					return fmt.Sprintf("<INVALID FROM: %d>", it.from)
+				} else if it.to < 0 || it.to > int64(len(test.src)) {
+					return fmt.Sprintf("<INVALID TO: %d>", it.to)
+				}
+				return test.src[it.from:it.to]
+			}
+
+			s := newScanner(strings.NewReader(test.src))
+			for i, want := range test.want {
+				if !s.Next() {
+					t.Fatalf("tok[%d]: got Next() = false, want true", i)
+				}
+				it := s.Item()
+				if it.tok != want.tok {
+					t.Fatalf("tok[%d]: got tok kind %s, want %s", i, it.tok, want.tok)
+				} else if got := lit(it); got != want.val {
+					t.Fatalf("tok[%d]: got lit %s, want %s", i, got, want.val)
+				}
+			}
+			if s.Next() {
+				it := s.Item()
+				t.Fatalf("got extra token beyond expected tokens: %s (val: %s)", it.tok, lit(it))
+			}
+			if err := s.Err(); err != nil {
+				t.Fatalf("got err %v, want nil", err)
+			}
+		})
+	}
+}
+
+type scannerTest struct {
+	name string
+	src  string
+	want []tokDesc
+}
+
+type tokDesc struct {
+	tok      token
+	val      string
+	isMapKey bool
+}
+
+func str(s string) tokDesc {
+	return raw(strconv.Quote(s))
+}
+
+func num(n int) tokDesc {
+	return tokDesc{tok: literal, val: strconv.Itoa(n)}
+}
+
+func raw(s string) tokDesc {
+	return tokDesc{tok: literal, val: s}
+}
+
+func k(t tokDesc) tokDesc {
+	t.isMapKey = true
+	return t
+}
+
+var (
+	objStart = tokDesc{tok: objectBegin, val: "{"}
+	objEnd   = tokDesc{tok: objectEnd, val: "}"}
+	arrStart = tokDesc{tok: arrayBegin, val: "["}
+	arrEnd   = tokDesc{tok: arrayEnd, val: "]"}
+)
diff --git a/pkg/scrub/scrub.go b/pkg/scrub/scrub.go
new file mode 100644
index 0000000000..f1f686667b
--- /dev/null
+++ b/pkg/scrub/scrub.go
@@ -0,0 +1,340 @@
+package scrub
+
+import (
+	"bytes"
+	"fmt"
+	"strings"
+	"unsafe"
+
+	"github.com/fmstephe/unsafeutil"
+)
+
+type EntryKind int
+
+const (
+	ObjectField EntryKind = iota
+	MapKey
+	MapValue
+)
+
+// scrubNode is an internal EntryKind for scrubbing the node
+const scrubNode EntryKind = -1
+
+type Path []PathEntry
+
+type PathEntry struct {
+	Kind          EntryKind
+	FieldName     string
+	CaseSensitive bool
+}
+
+// JSON scrubs the input JSON data, substituting values at the given paths
+// with replaceWith.
+//
+// It returns the scrubbed data. If no substitutions were made scrubbed
+// is the same slice as input.
+func JSON(input []byte, paths []Path, replaceWith []byte) (scrubbed []byte) {
+	indices := JSONIndices(input, paths)
+	return scrub(input, indices, replaceWith)
+}
+
+func scrub(input []byte, indices []Bounds, replaceWith []byte) (scrubbed []byte) {
+	if len(indices) == 0 {
+		return input
+	}
+
+	// Compute the new length
+	newLen := len(input)
+	replaceLen := len(replaceWith)
+	for _, idx := range indices {
+		segLen := idx.To - idx.From
+		newLen = newLen - segLen + replaceLen
+	}
+
+	scrubbed = make([]byte, newLen)
+	prevEnd := 0
+	dstIdx := 0
+	for _, idx := range indices {
+		dstIdx += copy(scrubbed[dstIdx:], input[prevEnd:idx.From])
+		dstIdx += copy(scrubbed[dstIdx:], replaceWith)
+		prevEnd = idx.To
+	}
+
+	copy(scrubbed[dstIdx:], input[prevEnd:])
+
+	return scrubbed
+}
+
+type Bounds struct {
+	From, To int
+}
+
+// JSONIndices computes the indices to replace in order to scrub the input JSON data.
+func JSONIndices(input []byte, paths []Path) []Bounds {
+	nodes := groupNodes(paths)
+	str := newStream(input, nodes)
+	return str.Process()
+}
+
+func newStream(input []byte, rootNodes []node) *stream {
+	return &stream{
+		s:         newScanner(bytes.NewReader(input)),
+		input:     input,
+		rootNodes: rootNodes,
+	}
+}
+
+type stream struct {
+	s         *scanner
+	input     []byte
+	rootNodes []node
+
+	debugLit string
+	tok      token
+	pos      Bounds
+	mapKey   bool
+
+	unreadItem scanItem
+
+	toScrub []Bounds
+}
+
+func (s *stream) Process() []Bounds {
+	s.next() // initialize
+	for s.tok != unknown {
+		s.processValue(s.rootNodes)
+	}
+	return s.toScrub
+}
+
+// processValue processes a single complete value (such as an entire object
+// or array recursively) and returns its bounds.
+func (s *stream) processValue(nodes []node) {
+	if s.scrubNow(nodes) {
+		bounds := s.skipValue()
+		s.toScrub = append(s.toScrub, bounds)
+		return
+	} else if len(nodes) == 0 {
+		// no more nodes; just skip the value entirely.
+		s.skipValue()
+		return
+	}
+
+	switch s.tok {
+	case objectBegin:
+		s.processObject(nodes)
+	case arrayBegin:
+		s.processArray(nodes)
+	default:
+		// nothing to do
+		s.next()
+	}
+}
+
+func (s *stream) processArray(nodes []node) {
+	s.next() // Move to first array value
+	for {
+		if s.tok == unknown {
+			return
+		} else if s.tok == arrayEnd {
+			s.next()
+			return
+		}
+
+		s.processValue(nodes)
+	}
+}
+
+func (s *stream) processObject(nodes []node) {
+	s.next() // Move to the first key
+	for {
+		if s.tok == unknown {
+			return
+		} else if s.tok == objectEnd {
+			s.next()
+			return
+		}
+
+		// Determine which nodes to continue with
+		currNodes, valueNodes := s.matchingMapNodes(nodes)
+		s.processValue(currNodes)
+
+		// If we have a map value next, process it.
+		if s.isMapValue() {
+			s.processValue(valueNodes)
+		}
+	}
+}
+
+func (s *stream) skipValue() Bounds {
+	start := s.pos.From
+	end := s.pos.To
+	var depth int
+	for {
+		switch s.tok {
+		case objectBegin, arrayBegin:
+			depth++
+		case objectEnd, arrayEnd:
+			depth--
+		}
+		end = s.pos.To
+		s.next()
+		if depth <= 0 {
+			break
+		}
+	}
+	return Bounds{From: start, To: end}
+}
+
+func (s *stream) matchingMapNodes(nodes []node) (currNodes, valueNodes []node) {
+	for _, n := range nodes {
+		if (n.Kind == MapKey && s.mapKey) || (n.Kind == MapValue && !s.mapKey) {
+			currNodes = append(currNodes, n.Children...)
+		} else if n.Kind == ObjectField && s.mapKey {
+			fieldName := s.input[s.pos.From:s.pos.To]
+			cs := n.CaseSensitive
+
+			// Have we found a matching field?
+			var fieldMatch bool
+			if cs {
+				fieldMatch = bytes.Equal(fieldName, unsafeutil.StringToBytes(n.FieldName))
+			} else {
+				fieldMatch = bytes.EqualFold(fieldName, unsafeutil.StringToBytes(n.FieldName))
+			}
+
+			if fieldMatch {
+				valueNodes = append(valueNodes, n.Children...)
+			}
+		}
+	}
+	return
+}
+
+// isMapValue reports whether the current token is a map value.
+func (s *stream) isMapValue() bool {
+	if s.mapKey {
+		return false
+	}
+	switch s.tok {
+	case objectBegin, arrayBegin, literal:
+		return true
+	default:
+		return false
+	}
+}
+
+func (s *stream) scrubNow(nodes []node) bool {
+	for _, n := range nodes {
+		if n.Kind == scrubNode {
+			return true
+		}
+	}
+	return false
+}
+
+func (s *stream) next() {
+	// Handle unread
+	if s.unreadItem.tok != 0 {
+		it := s.unreadItem
+		s.unreadItem = scanItem{}
+		s.tok, s.pos, s.mapKey = it.tok, it.Bounds(), it.isMapKey
+		s.debugLit = string(s.input[s.pos.From:s.pos.To])
+		return
+	}
+
+	if !s.s.Next() {
+		s.tok = unknown
+		s.debugLit = ""
+	} else {
+		it := s.s.Item()
+		s.tok, s.pos, s.mapKey = it.tok, it.Bounds(), it.isMapKey
+		s.debugLit = string(s.input[s.pos.From:s.pos.To])
+	}
+}
+
+func (s *stream) unread() {
+	if s.unreadItem.tok != 0 {
+		panic(fmt.Sprintf("double unread: %s followed by %s", s.unreadItem.tok, s.tok))
+	}
+
+	s.unreadItem = scanItem{
+		tok:      s.tok,
+		from:     int64(s.pos.From),
+		to:       int64(s.pos.To),
+		isMapKey: s.mapKey,
+	}
+}
+
+// groupNodes transforms the paths into a node tree for efficient matching.
+func groupNodes(paths []Path) []node {
+	findMatch := func(parent *node, e PathEntry) int {
+		for idx, c := range parent.Children {
+			if c.Kind != e.Kind {
+				continue
+			}
+			if e.Kind != ObjectField {
+				// The other attributes only matter for ObjectField
+				return idx
+			}
+
+			if e.CaseSensitive != c.CaseSensitive {
+				continue
+			}
+
+			var equal bool
+			if e.CaseSensitive {
+				equal = strings.EqualFold(e.FieldName, c.FieldName)
+			} else {
+				equal = e.FieldName == c.FieldName
+			}
+			if equal {
+				return idx
+			}
+		}
+		return -1
+	}
+
+	hasScrub := func(parent *node) bool {
+		return len(parent.Children) == 1 && parent.Children[0].Kind == scrubNode
+	}
+
+	root := node{}
+	for _, path := range paths {
+		parent := &root
+		for _, e := range path {
+			// If we're already scrubbing this path, we're done.
+			if hasScrub(parent) {
+				break
+			}
+
+			idx := findMatch(parent, e)
+			if idx == -1 {
+				parent.Children = append(parent.Children, node{
+					Kind:          e.Kind,
+					FieldName:     e.FieldName,
+					CaseSensitive: e.CaseSensitive,
+				})
+				parent = &parent.Children[len(parent.Children)-1]
+			} else {
+				parent = &parent.Children[idx]
+			}
+		}
+
+		// At the end of each path we want to scrub the current value.
+		// Add a synthetic node to do so.
+		parent.Children = []node{{Kind: scrubNode}}
+	}
+
+	return root.Children
+}
+
+type node struct {
+	Kind          EntryKind
+	FieldName     string
+	CaseSensitive bool
+	Children      []node
+}
+
+func unsafeStrToBytes(s string) []byte {
+	return *(*[]byte)(unsafe.Pointer(&s))
+}
diff --git a/pkg/scrub/scrub_test.go b/pkg/scrub/scrub_test.go
new file mode 100644
index 0000000000..888439429e
--- /dev/null
+++ b/pkg/scrub/scrub_test.go
@@ -0,0 +1,265 @@
+package scrub
+
+import (
+	"bytes"
+	"fmt"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+)
+
+func Test_groupNodes(t *testing.T) {
+	f := func(name string) PathEntry {
+		return PathEntry{Kind: ObjectField, FieldName: name, CaseSensitive: false}
+	}
+	cf := func(name string) PathEntry {
+		return PathEntry{Kind: ObjectField, FieldName: name, CaseSensitive: true}
+	}
+	nf := func(name string, ch ...node) node {
+		return node{Kind: ObjectField, FieldName: name, CaseSensitive: false, Children: ch}
+	}
+	ncf := func(name string, ch ...node) node {
+		return node{Kind: ObjectField, FieldName: name, CaseSensitive: true, Children: ch}
+	}
+	scr := node{Kind: scrubNode}
+
+	tests := []struct {
+		name  string
+		paths []Path
+		want  []node
+	}{
+		{
+			name: "single",
+			paths: []Path{
+				{f("a")},
+			},
+			want: []node{
+				nf("a", scr),
+			},
+		},
+
+		{
+			name: "two_separate",
+			paths: []Path{
+				{f("a")},
+				{f("b")},
+			},
+			want: []node{nf("a", scr), nf("b", scr)},
+		},
+
+		{
+			name: "case_sensitive_match",
+			paths: []Path{
+				{cf("a")},
+				{cf("a"), f("b")},
+			},
+			want: []node{ncf("a", scr)},
+		},
+
+		{
+			name: "case_sensitive_mismatch",
+			paths: []Path{
+				{cf("a")},
+				{f("a"), cf("a")},
+			},
+			want: []node{
+				ncf("a", scr),
+				nf("a", ncf("a", scr)),
+			},
+		},
+
+		{
+			name: "complex",
+			paths: []Path{
+				{f("a"), f("b"), f("c")},
+				{f("a"), f("d"), cf("e")},
+				{f("a"), cf("b"), cf("e")},
+			},
+			want: []node{
+				nf("a",
+					nf("b", nf("c", scr)),
+					nf("d", ncf("e", scr)),
+					ncf("b", ncf("e", scr)),
+				),
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := groupNodes(tt.paths)
+			if diff := cmp.Diff(got, tt.want); diff != "" {
+				t.Error(diff)
+			}
+		})
+	}
+}
+
+func Test_scrub(t *testing.T) {
+	tests := []struct {
+		input   string
+		bounds  []Bounds
+		replace string
+		want    string
+	}{
+		{
+			input:   "aaa bbb ccc",
+			bounds:  []Bounds{{0, 3}},
+			replace: "X",
+			want:    "X bbb ccc",
+		},
+		{
+			input:   "aaa bbb ccc",
+			bounds:  []Bounds{{0, 1}, {1, 2}, {2, 3}},
+			replace: "X",
+			want:    "XXX bbb ccc",
+		},
+		{
+			input:   "aaa bbb ccc",
+			bounds:  []Bounds{{0, 1}, {1, 2}, {2, 3}},
+			replace: "XX",
+			want:    "XXXXXX bbb ccc",
+		},
+		{
+			input:   "aaa",
+			bounds:  []Bounds{{0, 3}},
+			replace: "XX",
+			want:    "XX",
+		},
+		{
+			input:   "a",
+			bounds:  []Bounds{{0, 0}},
+			replace: "XXX",
+			want:    "XXXa",
+		},
+		{
+			input:   "a",
+			bounds:  []Bounds{{1, 1}},
+			replace: "XXX",
+			want:    "aXXX",
+		},
+		{
+			input:   "",
+			bounds:  []Bounds{{0, 0}},
+			replace: "XXX",
+			want:    "XXX",
+		},
+		{
+			input:   "a",
+			bounds:  []Bounds{{0, 1}},
+			replace: "XXX",
+			want:    "XXX",
+		},
+	}
+	for i, tt := range tests {
+		t.Run(fmt.Sprint(i), func(t *testing.T) {
+			if got := scrub([]byte(tt.input), tt.bounds, []byte(tt.replace)); !bytes.Equal(got, []byte(tt.want)) {
+				t.Errorf("scrub() = %q, want %q", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestJSON(t *testing.T) {
+	tests := []struct {
+		name       string
+		input      string
+		paths      []Path
+		wantOutput string
+	}{
+		{
+			name:  "simple_object",
+			input: `{"a": "1234"}`,
+			paths: []Path{
+				[]PathEntry{{Kind: ObjectField, FieldName: `"a"`, CaseSensitive: true}},
+			},
+			wantOutput: `{"a": "[sensitive]"}`,
+		},
+		{
+			name:  "array_nesting",
+			input: `[[{"a": "1234"}], [{"b": "1234"}], [[[{"a":"1234"}, {"a": "1234"}]]]`,
+			paths: []Path{
+				[]PathEntry{{Kind: ObjectField, FieldName: `"a"`, CaseSensitive: true}},
+			},
+			wantOutput: `[[{"a": "[sensitive]"}], [{"b": "1234"}], [[[{"a":"[sensitive]"}, {"a": "[sensitive]"}]]]`,
+		},
+		{
+			name:  "case_sensitivity",
+			input: `[[{"a": "1234"}], [{"A": "1234"}], [[[{"aa":"1234"}, ["aA": "1234"]]]]`,
+			paths: []Path{
+				[]PathEntry{{Kind: ObjectField, FieldName: `"a"`, CaseSensitive: true}},
+			},
+			wantOutput: `[[{"a": "[sensitive]"}], [{"A": "1234"}], [[[{"aa":"1234"}, ["aA": "1234"]]]]`,
+		},
+		{
+			name:  "object_nesting_1",
+			input: `{"a": "1234", "b": {"a": "1234"}`,
+			paths: []Path{
+				[]PathEntry{{Kind: ObjectField, FieldName: `"a"`, CaseSensitive: true}},
+			},
+			wantOutput: `{"a": "[sensitive]", "b": {"a": "1234"}`,
+		},
+		{
+			name:  "object_nesting_2",
+			input: `{"a": "1234", "b": {"a": "1234"}`,
+			paths: []Path{
+				[]PathEntry{
+					{Kind: ObjectField, FieldName: `"b"`, CaseSensitive: true},
+					{Kind: ObjectField, FieldName: `"a"`, CaseSensitive: true},
+				},
+			},
+			wantOutput: `{"a": "1234", "b": {"a": "[sensitive]"}`,
+		},
+		{
+			name:  "missing_map_values",
+			input: "{0:\n 1: 123}",
+			paths: []Path{
+				[]PathEntry{
+					{Kind: ObjectField, FieldName: "1", CaseSensitive: true},
+				},
+			},
+			wantOutput: "{0:\n 1: \"[sensitive]\"}",
+		},
+		{
+			name:  "map_values_multiline",
+			input: "{0:\n 1}",
+			paths: []Path{
+				[]PathEntry{
+					{Kind: ObjectField, FieldName: "0", CaseSensitive: true},
+				},
+			},
+			wantOutput: "{0:\n \"[sensitive]\"}",
+		},
+		{
+			name:  "test",
+			input: `{"One":["\"one\""]}}`,
+			paths: []Path{
+				[]PathEntry{
+					{Kind: ObjectField, FieldName: `"x"`, CaseSensitive: false},
+				},
+			},
+			wantOutput: `{"One":["\"one\""]}}`,
+		},
+		{
+			name:  "multiple_array_nested_obj",
+			input: `{"one": [{"two": {"three": "ABC"}}, {"two": {"three": "DEF"}}]}`,
+			paths: []Path{
+				[]PathEntry{
+					{Kind: ObjectField, FieldName: `"one"`, CaseSensitive: true},
+					{Kind: ObjectField, FieldName: `"two"`, CaseSensitive: true},
+					{Kind: ObjectField, FieldName: `"three"`, CaseSensitive: true},
+				},
+			},
+			wantOutput: `{"one": [{"two": {"three": "[sensitive]"}}, {"two": {"three": "[sensitive]"}}]}`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			input := []byte(tt.input)
+			if out := JSON(input, tt.paths, []byte(`"[sensitive]"`)); !bytes.Equal(out, []byte(tt.wantOutput)) {
+				t.Errorf("scrub() = %s, want %s", out, tt.wantOutput)
+			}
+		})
+	}
+}
diff --git a/pkg/scrub/token_string.go b/pkg/scrub/token_string.go
new file mode 100644
index 0000000000..0e15049e0c
--- /dev/null
+++ b/pkg/scrub/token_string.go
@@ -0,0 +1,28 @@
+// Code generated by "stringer -type=token"; DO NOT EDIT.
+
+package scrub
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[unknown-0]
+	_ = x[objectBegin-1]
+	_ = x[objectEnd-2]
+	_ = x[arrayBegin-3]
+	_ = x[arrayEnd-4]
+	_ = x[literal-5]
+}
+
+const _token_name = "unknownobjectBeginobjectEndarrayBeginarrayEndliteral"
+
+var _token_index = [...]uint8{0, 7, 18, 27, 37, 45, 52}
+
+func (i token) String() string {
+	if i >= token(len(_token_index)-1) {
+		return "token(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _token_name[_token_index[i]:_token_index[i+1]]
+}
diff --git a/pkg/supervisor/cmd/supervisor-encore/main.go b/pkg/supervisor/cmd/supervisor-encore/main.go
new file mode 100644
index 0000000000..87b742f2c6
--- /dev/null
+++ b/pkg/supervisor/cmd/supervisor-encore/main.go
@@ -0,0 +1,102 @@
+package main
+
+import (
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"flag"
+	"os"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"google.golang.org/protobuf/proto"
+
+	"encr.dev/pkg/supervisor"
+	runtimev1 "encr.dev/proto/encore/runtime/v1"
+)
+
+func main() {
+	log.Info().Msg("supervisor starting")
+	if err := run(); err != nil {
+		log.Fatal().Err(err).Msg("unable to run supervisor")
+	}
+}
+
+func run() error {
+	cfgPath := flag.String("c", "", "path to the config file")
+	flag.Parse()
+	if *cfgPath == "" {
+		return errors.New("missing config file")
+	}
+
+	cfg, err := loadSupervisorConfig(*cfgPath)
+	if err != nil {
+		return errors.Wrap(err, "load supervisor config")
+	}
+
+	// Configure the logger.
+	rtcfg, err := loadRuntimeConfig()
+	if err != nil {
+		return errors.Wrap(err, "load runtime config")
+	}
+	configureLogger(rtcfg)
+
+	super, err := supervisor.New(cfg, rtcfg)
+	if err != nil {
+		return errors.Wrap(err, "create supervisor")
+	}
+
+	err = super.Run(context.Background())
+	return errors.Wrap(err, "run supervisor")
+}
+
+func loadSupervisorConfig(path string) (*supervisor.Config, error) {
+	var cfg supervisor.Config
+	data, err := os.ReadFile(path)
+	if err != nil {
+		return nil, errors.Wrap(err, "read config file")
+	}
+	if err := json.Unmarshal(data, &cfg); err != nil {
+		return nil, errors.Wrap(err, "unmarshal config file")
+	}
+	return &cfg, nil
+}
+
+// loadRuntimeConfig loads the runtime config from the ENCORE_RUNTIME_CONFIG env var.
+func loadRuntimeConfig() (*runtimev1.RuntimeConfig, error) {
+	val, ok := os.LookupEnv("ENCORE_RUNTIME_CONFIG")
+	if !ok {
+		return nil, errors.New("ENCORE_RUNTIME_CONFIG not set")
+	}
+
+	decoded, err := base64.StdEncoding.DecodeString(val)
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to decode ENCORE_RUNTIME_CONFIG")
+	}
+
+	var cfg runtimev1.RuntimeConfig
+	if err := proto.Unmarshal(decoded, &cfg); err != nil {
+		return nil, errors.Wrap(err, "unable to unmarshal runtime config")
+	}
+
+	return &cfg, nil
+}
+
+func configureLogger(cfg *runtimev1.RuntimeConfig) {
+	// Log in GCP's log format for Encore Cloud and GCP.
+	if cloud := cfg.Environment.Cloud; cloud == runtimev1.Environment_CLOUD_GCP || cloud == runtimev1.Environment_CLOUD_ENCORE {
+		zerolog.LevelFieldName = "severity"
+		zerolog.TimestampFieldName = "timestamp"
+		zerolog.TimeFieldFormat = time.RFC3339Nano
+	}
+
+	// Create our root logger
+	logger := zerolog.New(os.Stderr).
+		Level(zerolog.DebugLevel).
+		With().Caller().Timestamp().Stack().Str("process", "supervisor").
+		Logger()
+
+	log.Logger = logger
+}
diff --git a/pkg/supervisor/supervisor.go b/pkg/supervisor/supervisor.go
new file mode 100644
index 0000000000..9ba52e1176
--- /dev/null
+++ b/pkg/supervisor/supervisor.go
@@ -0,0 +1,281 @@
+package supervisor
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/netip"
+	"net/url"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog"
+	"go4.org/syncutil"
+
+	"encr.dev/pkg/noopgateway"
+	runtimev1 "encr.dev/proto/encore/runtime/v1"
+)
+
+// Config is the configuration used by the supervisor.
+type Config struct {
+	Procs []Proc `json:"procs"`
+
+	// NoopGateways are the noop-gateways to start up,
+	// keyed by gateway name.
+	NoopGateways map[string]*noopgateway.Description
+}
+
+// Proc represents a supervised proc.
+type Proc struct {
+	// ID is a unique id representing this process.
+	ID string `json:"id"`
+
+	// Command and arguments for running the proc.
+	Command []string `json:"command"`
+
+	// Extra environment variables to pass.
+	Env []string `json:"env"`
+
+	// supervisedProc and gateway names included in this proc.
+	Services []string `json:"services"`
+	Gateways []string `json:"gateways"`
+}
+
+// New creates a new supervisor.
+func New(cfg *Config, rtCfg *runtimev1.RuntimeConfig) (*Supervisor, error) {
+	log := zerolog.New(os.Stderr).With().Timestamp().Logger()
+
+	super := &Supervisor{
+		cfg:   cfg,
+		rt:    rtCfg,
+		procs: make(map[string]*supervisedProc),
+		log:   log,
+	}
+
+	return super, nil
+}
+
+type Supervisor struct {
+	cfg   *Config
+	rt    *runtimev1.RuntimeConfig
+	procs map[string]*supervisedProc
+
+	buildInfoOnce syncutil.Once
+	buildInfo     BuildInfo
+
+	log zerolog.Logger
+}
+
+// Run runs the supervisor. It returns immediately on error,
+// and otherwise blocks until ctx is canceled.
+func (s *Supervisor) Run(ctx context.Context) error {
+	// Start up the procs to supervise.
+	for i, proc := range s.cfg.Procs {
+		services := strings.Join(proc.Services, ",")
+		gateways := strings.Join(proc.Gateways, ",")
+
+		logger := s.log.With().
+			Str("services", services).
+			Str("gateways", gateways).
+			Str("proc_id", proc.ID).
+			Logger()
+
+		port := 12000 + i
+		sp := &supervisedProc{
+			super: s,
+			proc:  proc,
+			log:   logger,
+			port:  port,
+		}
+		s.procs[proc.ID] = sp
+		go sp.Supervise()
+	}
+
+	// Start up the noop-gateways.
+	go s.runNoopGateway(ctx, "noop")
+
+	<-ctx.Done()
+	return nil
+}
+
+// runNoopGateway runs a noop-gateway until ctx is canceled.
+func (s *Supervisor) runNoopGateway(ctx context.Context, name string) {
+	logger := s.log.With().Str("gateway", name).Logger()
+	logger.Info().Msg("starting noop-gateway")
+
+	// Find the default gateway
+	var targetGW *supervisedProc
+	for _, proc := range s.procs {
+		if len(proc.proc.Gateways) > 0 {
+			targetGW = proc
+			break
+		}
+	}
+	if targetGW == nil {
+		logger.Error().Msg("no gateway found")
+		return
+	}
+
+	target := &url.URL{
+		Scheme: "http",
+		Host:   fmt.Sprintf("localhost:%d", targetGW.port),
+	}
+	rp := httputil.NewSingleHostReverseProxy(target)
+	ln, err := listenGateway()
+	if err != nil {
+		logger.Error().Err(err).Msg("listen")
+		return
+	}
+	logger.Info().Msgf("listening on %s", ln.Addr().String())
+	srv := &http.Server{
+		BaseContext: func(_ net.Listener) context.Context { return ctx },
+		Handler:     rp,
+	}
+	if err := srv.Serve(ln); err != nil {
+		logger.Error().Err(err).Msg("serve")
+		return
+	}
+}
+
+func listenGateway() (net.Listener, error) {
+	listenAddr := os.Getenv("ENCORE_LISTEN_ADDR")
+	if listenAddr != "" {
+		addrPort, err := netip.ParseAddrPort(listenAddr)
+		if err != nil {
+			return nil, err
+		}
+		return net.Listen("tcp", addrPort.String())
+	}
+
+	port, _ := strconv.Atoi(os.Getenv("PORT"))
+	if port == 0 {
+		port = 8080
+	}
+	return net.Listen("tcp", ":"+strconv.Itoa(port))
+}
+
+// supervisedProc is a supervised process.
+type supervisedProc struct {
+	super   *Supervisor
+	proc    Proc
+	log     zerolog.Logger
+	healthy atomic.Bool
+	port    int
+}
+
+// Healthy reports whether the service is currently healthy.
+func (s *supervisedProc) Healthy() bool {
+	return s.healthy.Load()
+}
+
+// Supervise supervises the service, starting it and restarting it if it exits.
+func (p *supervisedProc) Supervise() {
+	const (
+		minSleep = 100 * time.Millisecond
+		maxSleep = 10 * time.Second
+	)
+
+	var (
+		mu         sync.Mutex
+		generation uint64 = 1
+		retrySleep        = minSleep
+	)
+
+	errSleep := func(msg string, err error) {
+		// Mark the service as unhealthy.
+		p.healthy.Store(false)
+
+		// Increment retry sleep and generation.
+		mu.Lock()
+		generation++
+		toSleep := retrySleep
+		retrySleep *= 2
+		if retrySleep > maxSleep {
+			retrySleep = maxSleep
+		}
+		mu.Unlock()
+
+		p.log.Error().Err(err).Msgf("%s: %v, retrying in %v", msg, err, toSleep)
+		time.Sleep(toSleep)
+	}
+
+	// If this proc is using the sidecar, add its environment variables.
+	env := os.Environ()
+	env = append(env, p.proc.Env...)
+
+	// Add the port to listen on.
+	env = append(env, fmt.Sprintf("PORT=%d", p.port))
+
+	for {
+		mu.Lock()
+		currGen := generation
+		mu.Unlock()
+
+		cmd := exec.Command(p.proc.Command[0], p.proc.Command[1:]...)
+		cmd.Env = env
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+
+		p.log.Info().Msg("starting proc")
+		if err := cmd.Start(); err != nil {
+			errSleep("service startup failed", err)
+			continue
+		}
+
+		// Check in on the process after a few seconds and reset the retry sleep if it's still alive.
+		go func() {
+			time.Sleep(1 * time.Second)
+			mu.Lock()
+			defer mu.Unlock()
+			if generation == currGen {
+				// Still alive. Reset the retry sleep.
+				retrySleep = minSleep
+				p.healthy.Store(true)
+			}
+		}()
+
+		if err := cmd.Wait(); err != nil {
+			errSleep("proc exited", err)
+			continue
+		}
+	}
+}
+
+func readBuildInfo() (BuildInfo, error) {
+	var info BuildInfo
+	data, err := os.ReadFile("/encore/build-info.json")
+	if err == nil {
+		err = json.Unmarshal(data, &info)
+	}
+	return info, errors.Wrap(err, "read build info")
+}
+
+type BuildInfo struct {
+	// The version of Encore with which the app was compiled.
+	// This is string is for informational use only, and its format should not be relied on.
+	EncoreCompiler string
+
+	// AppCommit describes the commit of the app.
+	AppCommit CommitInfo
+}
+
+type CommitInfo struct {
+	Revision    string
+	Uncommitted bool
+}
+
+func (ci CommitInfo) AsRevisionString() string {
+	if ci.Uncommitted {
+		return fmt.Sprintf("%s-modified", ci.Revision)
+	}
+	return ci.Revision
+}
diff --git a/pkg/svcproxy/dialer.go b/pkg/svcproxy/dialer.go
new file mode 100644
index 0000000000..4cea4150a2
--- /dev/null
+++ b/pkg/svcproxy/dialer.go
@@ -0,0 +1,43 @@
+package svcproxy
+
+import (
+	"context"
+	"net"
+	"strings"
+	"time"
+
+	"github.com/cenkalti/backoff/v4"
+)
+
+type retryDialer struct {
+	net.Dialer
+}
+
+func (d *retryDialer) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	var conn net.Conn
+	b := backoff.NewExponentialBackOff()
+	b.MaxElapsedTime = time.Minute // Set maximum backoff time to 1 minute
+
+	operation := func() error {
+		var err error
+		conn, err = d.Dialer.DialContext(ctx, network, address)
+		if err != nil {
+			if strings.Contains(err.Error(), "connection refused") {
+				// Retry if connection is refused
+				return err
+			}
+
+			// Don't retry if connection isn't refused
+			return backoff.Permanent(err)
+		}
+
+		return nil
+	}
+
+	err := backoff.Retry(operation, b)
+	if err != nil {
+		return nil, err
+	}
+
+	return conn, nil
+}
diff --git a/pkg/svcproxy/doc.go b/pkg/svcproxy/doc.go
new file mode 100644
index 0000000000..888750574b
--- /dev/null
+++ b/pkg/svcproxy/doc.go
@@ -0,0 +1,4 @@
+// Package svcproxy provides an HTTP proxy which allows the daemon to
+// serve HTTP requests on behalf of services within the app and forward
+// then to the appropriate process.
+package svcproxy
diff --git a/pkg/svcproxy/svcproxy.go b/pkg/svcproxy/svcproxy.go
new file mode 100644
index 0000000000..81d8a9279f
--- /dev/null
+++ b/pkg/svcproxy/svcproxy.go
@@ -0,0 +1,156 @@
+package svcproxy
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/netip"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog"
+
+	"encr.dev/pkg/logging"
+)
+
+type SvcProxy struct {
+	listener   net.Listener
+	logger     zerolog.Logger
+	httpServer *http.Server
+
+	mu       sync.RWMutex
+	gateways map[string]*httputil.ReverseProxy // Map of the gateway name to address and port it's listening on
+	services map[string]*httputil.ReverseProxy // Map of service name to address and port it's listening on
+}
+
+var (
+	_ http.Handler = (*SvcProxy)(nil)
+)
+
+// New creates a new service proxy and it starts listening on a random port
+//
+// You must call Close() on the returned service proxy when you are done with it.
+func New(ctx context.Context, logger zerolog.Logger) (*SvcProxy, error) {
+	var lc net.ListenConfig
+	ln, err := lc.Listen(ctx, "tcp", "127.0.0.1:0")
+	if err != nil {
+		return nil, errors.Wrap(err, "unable to listen")
+	}
+
+	proxy := &SvcProxy{
+		listener: ln,
+		logger:   logger,
+		gateways: make(map[string]*httputil.ReverseProxy),
+		services: make(map[string]*httputil.ReverseProxy),
+	}
+
+	proxy.httpServer = &http.Server{
+		Addr:        ln.Addr().String(),
+		BaseContext: func(_ net.Listener) context.Context { return ctx },
+		Handler:     proxy,
+	}
+
+	go func() {
+		if err := proxy.httpServer.Serve(ln); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			logger.Err(err).Msg("error serving")
+		}
+	}()
+
+	return proxy, nil
+}
+
+// Close stops running the service proxy
+func (p *SvcProxy) Close() {
+	_ = p.httpServer.Close()
+	_ = p.listener.Close()
+}
+
+func (p *SvcProxy) RegisterGateway(name string, addr netip.AddrPort) string {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	p.gateways[name] = p.createReverseProxy("gateway", name, addr)
+
+	return fmt.Sprintf("http://%s/gateway/%s", p.listener.Addr().String(), name)
+}
+
+// RegisterService registers a service with the proxy and returns the BaseURL to be used
+// to access the service.
+func (p *SvcProxy) RegisterService(name string, addr netip.AddrPort) string {
+	p.mu.Lock()
+	defer p.mu.Unlock()
+
+	p.services[name] = p.createReverseProxy("service", name, addr)
+
+	return fmt.Sprintf("http://%s/service/%s", p.listener.Addr().String(), name)
+}
+
+func (p *SvcProxy) createReverseProxy(what, name string, listener netip.AddrPort) *httputil.ReverseProxy {
+	return &httputil.ReverseProxy{
+		// This transport is copied from the default transport in the http package just with the dial context
+		// wrapped in our retry dialer.
+		Transport: &http.Transport{
+			Proxy: http.ProxyFromEnvironment,
+			DialContext: (&retryDialer{net.Dialer{
+				Timeout:   30 * time.Second,
+				KeepAlive: 30 * time.Second,
+			}}).DialContext,
+			ForceAttemptHTTP2:     true,
+			MaxIdleConns:          100,
+			IdleConnTimeout:       90 * time.Second,
+			TLSHandshakeTimeout:   10 * time.Second,
+			ExpectContinueTimeout: 1 * time.Second,
+		},
+		Rewrite: func(request *httputil.ProxyRequest) {
+			request.Out.URL.Scheme = "http"
+			request.Out.URL.Host = listener.String()
+			request.Out.URL.Path = strings.TrimPrefix(request.In.URL.Path, fmt.Sprintf("/%s/%s", what, name))
+		},
+		ErrorLog: logging.NewZeroLogAdapter(p.logger.With().Str(what, name).Logger(), zerolog.ErrorLevel),
+	}
+}
+
+// ServeHTTP implements the http.Handler interface
+func (p *SvcProxy) ServeHTTP(w http.ResponseWriter, req *http.Request) {
+	// Resolve the handler with the lock held.
+	proxy, err := func() (http.Handler, error) {
+		p.mu.RLock()
+		defer p.mu.RUnlock()
+
+		parts := strings.SplitN(strings.TrimPrefix(req.URL.Path, "/"), "/", 3)
+		if len(parts) >= 2 {
+			switch parts[0] {
+			case "gateway":
+				proxy, ok := p.gateways[parts[1]]
+				if !ok {
+					return nil, errors.Newf("unknown gateway: %s", parts[1])
+				} else {
+					return proxy, nil
+				}
+			case "service":
+				proxy, ok := p.services[parts[1]]
+				if !ok {
+					return nil, errors.Newf("unknown service: %s", parts[1])
+				} else {
+					return proxy, nil
+				}
+			default:
+				return nil, errors.Newf("unknown path prefix: %s", parts[0])
+			}
+		} else {
+			return nil, errors.Newf("unknown path prefix format: %s", req.URL.Path)
+		}
+	}()
+
+	if err != nil {
+		p.logger.Err(err).Str("url", req.URL.String()).Msg("error proxying service request")
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	proxy.ServeHTTP(w, req)
+}
diff --git a/pkg/tarstream/LICENSE b/pkg/tarstream/LICENSE
new file mode 100644
index 0000000000..cba6d7a7db
--- /dev/null
+++ b/pkg/tarstream/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2016 Ben McClelland
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/pkg/tarstream/datavec.go b/pkg/tarstream/datavec.go
new file mode 100644
index 0000000000..5e6b80c096
--- /dev/null
+++ b/pkg/tarstream/datavec.go
@@ -0,0 +1,108 @@
+package tarstream
+
+import (
+	"bytes"
+	"io"
+	"os"
+)
+
+// MemVec is a buffer vec type
+type MemVec struct {
+	Data []byte
+}
+
+// PathVec is a filename vec type
+type PathVec struct {
+	Path string
+	Info os.FileInfo
+}
+
+// PadVec is a padding (0s) vec type
+type PadVec struct {
+	Size int64
+}
+
+type DataReader interface {
+	io.ReaderAt
+	io.Closer
+}
+
+func nopCloser(r io.ReaderAt) DataReader {
+	return noopCloser{r}
+}
+
+type noopCloser struct {
+	io.ReaderAt
+}
+
+func (n noopCloser) Close() error { return nil }
+
+// Datavec is an interface for all vector types
+type Datavec interface {
+	Clone() Datavec
+	GetSize() int64
+	Open() (DataReader, error)
+}
+
+// GetSize gets the size of the memory vec
+func (m MemVec) GetSize() int64 {
+	return int64(len(m.Data))
+}
+
+func (m MemVec) Clone() Datavec {
+	return m
+}
+
+// Open opens a memory vec
+func (m MemVec) Open() (DataReader, error) {
+	return nopCloser(bytes.NewReader(m.Data)), nil
+}
+
+// GetSize gets the file size of the path vec
+func (p PathVec) GetSize() int64 {
+	return p.Info.Size()
+}
+
+// Open opens a file represented by a path vec
+func (p *PathVec) Open() (DataReader, error) {
+	return os.Open(p.Path)
+}
+
+func (p *PathVec) Clone() Datavec {
+	return p
+}
+
+// GetSize gets the size of the padding vec
+func (p PadVec) GetSize() int64 {
+	return p.Size
+}
+
+// Open opens the padding vec
+func (p PadVec) Open() (DataReader, error) {
+	return padReader{p.Size}, nil
+}
+
+func (p PadVec) Clone() Datavec {
+	return p
+}
+
+type padReader struct {
+	size int64
+}
+
+func (r padReader) ReadAt(b []byte, off int64) (int, error) {
+	rem := int(r.size - off)
+	if rem == 0 {
+		return 0, io.EOF
+	}
+
+	n := min(rem, len(b))
+	for i := range n {
+		b[i] = 0
+	}
+	return n, nil
+}
+
+func (r padReader) Close() error {
+	return nil
+}
diff --git a/pkg/tarstream/datavec_test.go b/pkg/tarstream/datavec_test.go
new file mode 100644
index 0000000000..9cd1242e31
--- /dev/null
+++ b/pkg/tarstream/datavec_test.go
@@ -0,0 +1 @@
+package tarstream
diff --git a/pkg/tarstream/tarstream.go b/pkg/tarstream/tarstream.go
new file mode 100644
index 0000000000..dbb3b9ca22
--- /dev/null
+++ b/pkg/tarstream/tarstream.go
@@ -0,0 +1,177 @@
+package tarstream
+
+import (
+	"archive/tar"
+	"fmt"
+	"io"
+	"os"
+	"sort"
+
+	"github.com/pkg/errors"
+)
+
+func NewTarVec(vecs []Datavec) *TarVec {
+	var totalSize int64
+	starts := make([]int64, len(vecs))
+	ends := make([]int64, len(vecs))
+	for i, dv := range vecs {
+		size := dv.GetSize()
+		starts[i] = totalSize
+		ends[i] = totalSize + size
+		totalSize += size
+	}
+
+	return &TarVec{
+		vecs:   vecs,
+		starts: starts,
+		ends:   ends,
+		size:   totalSize,
+	}
+}
+
+// TarVec is an array of datavecs representing a tarball
+type TarVec struct {
+	vecs   []Datavec
+	starts []int64 // starting offset for each vec, inclusive
+	ends   []int64 // ending offset for each vec, exclusive
+	size   int64
+
+	// Current reading pos
+	pos  int64
+	curr *currReader
+}
+
+type currReader struct {
+	idx  int // datavec index
+	size int64
+	data DataReader
+}
+
+// Size gets the size of the tarball represented by the tarvec
+func (tv *TarVec) Size() int64 {
+	return tv.size
+}
+
+func (tv *TarVec) Clone() *TarVec {
+	return &TarVec{
+		vecs:   tv.vecs,
+		starts: tv.starts,
+		ends:   tv.ends,
+		pos:    tv.pos,
+	}
+}
+
+func (tv *TarVec) getReader() (*currReader, error) {
+	// Do we have a current reader?
+	if tv.curr != nil {
+		// Is the current position within the current datavec?
+		if tv.pos >= tv.starts[tv.curr.idx] && tv.pos < tv.ends[tv.curr.idx] {
+			return tv.curr, nil
+		}
+		_ = tv.curr.data.Close()
+		tv.curr = nil
+	}
+
+	// Find the datavec that contains the current position
+	candidate := sort.Search(len(tv.ends), func(i int) bool {
+		return tv.ends[i] > tv.pos
+	})
+	if candidate == len(tv.ends) {
+		// Position exceeds the end of the last data vec.
+		return nil, io.EOF
+	}
+
+	vec := tv.vecs[candidate]
+	data, err := vec.Open()
+	if err != nil {
+		return nil, fmt.Errorf("error opening data vec: %v", err)
+	}
+
+	tv.curr = &currReader{
+		idx:  candidate,
+		size: vec.GetSize(),
+		data: data,
+	}
+	return tv.curr, nil
+}
+
+// Read the data represented by the tarvec
+func (tv *TarVec) Read(b []byte) (int, error) {
+	cr, err := tv.getReader()
+	if err != nil {
+		return 0, err
+	}
+
+	off := tv.pos - tv.starts[cr.idx]
+
+	// Sanity checks
+	remaining := cr.size - off
+	hasMoreVecs := cr.idx+1 < len(tv.vecs)
+	if remaining < 0 {
+		panic("TarVec: negative remaining size")
+	} else if remaining == 0 && hasMoreVecs && cr.size > 0 {
+		panic("TarVec: zero remaining size but more vecs exist")
+	}
+
+	n, err := cr.data.ReadAt(b, off)
+	if err == io.EOF {
+		// Ignore EOF from individual readers.
+		// getReader reports EOF when running out of readers.
+		err = nil
+	}
+
+	if n == 0 && len(b) > 0 && (err == nil || err == io.EOF) {
+		panic("TarVec: empty read from vec, more data remaining")
+	}
+	tv.pos += int64(n)
+
+	return n, err
+}
+
+// Seek the virtual offset of the tarvec
+func (tv *TarVec) Seek(offset int64, whence int) (int64, error) {
+	switch whence {
+	case io.SeekStart:
+		if offset < 0 {
+			return 0, os.ErrInvalid
+		}
+		tv.pos = offset
+		return tv.pos, nil
+	case io.SeekCurrent:
+		if tv.pos+offset < 0 {
+			return 0, os.ErrInvalid
+		}
+		tv.pos += offset
+		return tv.pos, nil
+	case io.SeekEnd:
+		if tv.size+offset < 0 {
+			return 0, os.ErrInvalid
+		}
+		tv.pos = tv.size + offset
+		return tv.pos, nil
+	}
+	return 0, os.ErrInvalid
+}
+
+func (tv *TarVec) Close() error {
+	if tv.curr != nil {
+		err := tv.curr.data.Close()
+		tv.curr = nil
+		return err
+	}
+
+	return nil
+}
+
+// Validate gets and validates the next header within the tarfile
+func Validate(r io.Reader) (*tar.Header, error) {
+	tr := tar.NewReader(r)
+	// Next will find the next header and read it in
+	// this skips all meta-headers like long names, etc
+	// hopefully thats what we want here
+	hdr, err := tr.Next()
+	if err != nil {
+		return &tar.Header{}, errors.Wrap(err, fmt.Sprintf("read header"))
+	}
+	return hdr, nil
+}
diff --git a/pkg/tarstream/tarstream_test.go b/pkg/tarstream/tarstream_test.go
new file mode 100644
index 0000000000..e88c03be0d
--- /dev/null
+++ b/pkg/tarstream/tarstream_test.go
@@ -0,0 +1,42 @@
+package tarstream
+
+import (
+	"math/rand"
+	"slices"
+	"testing"
+	"testing/iotest"
+	"testing/quick"
+)
+
+func TestReader(t *testing.T) {
+	err := quick.Check(func(data []byte) bool {
+		tv := genRandomVec(data)
+		if err := iotest.TestReader(tv, data); err != nil {
+			t.Logf("got read err %v", err)
+			return false
+		}
+		return true
+	}, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func genRandomVec(data []byte) *TarVec {
+	var vecs []Datavec
+	for len(data) > 0 {
+		n := rand.Intn(len(data) + 1)
+		vecData := data[:n]
+		data = data[n:]
+		allZeroes := !slices.ContainsFunc(vecData, func(b byte) bool {
+			return b != 0
+		})
+
+		if allZeroes {
+			vecs = append(vecs, PadVec{Size: int64(len(vecData))})
+		} else {
+			vecs = append(vecs, MemVec{Data: vecData})
+		}
+	}
+	return NewTarVec(vecs)
+}
diff --git a/pkg/traceparser/binreader.go b/pkg/traceparser/binreader.go
new file mode 100644
index 0000000000..f891fb6ba8
--- /dev/null
+++ b/pkg/traceparser/binreader.go
@@ -0,0 +1,208 @@
+package traceparser
+
+import (
+	"bufio"
+	"encoding/binary"
+	"io"
+	"math"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"encore.dev/appruntime/exported/trace2"
+)
+
+var bin = binary.LittleEndian
+
+type traceReader struct {
+	buf        *bufio.Reader
+	version    trace2.Version
+	bytesRead  int
+	timeAnchor int64
+	err        error // any error encountered during reading
+}
+
+func (tr *traceReader) setErr(err error) {
+	if tr.err == nil {
+		tr.err = err
+	}
+}
+
+// Err reports any error encountered during reading.
+func (tr *traceReader) Err() error {
+	return tr.err
+}
+
+func (tr *traceReader) Bytes(b []byte) {
+	n, err := io.ReadFull(tr.buf, b)
+	tr.bytesRead += n
+	tr.setErr(err)
+}
+
+func (tr *traceReader) Skip(n int) {
+	discarded, err := tr.buf.Discard(n)
+	tr.bytesRead += discarded
+	tr.setErr(err)
+}
+
+func (tr *traceReader) Byte() byte {
+	b, err := tr.buf.ReadByte()
+	tr.setErr(err)
+	if err == nil {
+		tr.bytesRead++
+	}
+	return b
+}
+
+func (tr *traceReader) Bool() bool {
+	return tr.Byte() != 0
+}
+
+func (tr *traceReader) String() string {
+	s := string(tr.ByteString())
+
+	// Ensure the string is valid UTF-8.
+	// Needed because proto.Marshal requires strings to be valid utf8.
+	s = strings.ToValidUTF8(s, string(utf8.RuneError))
+
+	return s
+}
+
+func (tr *traceReader) OptString() *string {
+	return ptrOrNil(tr.String())
+}
+
+func (tr *traceReader) OptUVarint() *uint64 {
+	return ptrOrNil(tr.UVarint())
+}
+
+func (tr *traceReader) ByteString() []byte {
+	size := tr.UVarint()
+	if (size) == 0 {
+		return nil
+	}
+	b := make([]byte, int(size))
+	tr.Bytes(b)
+	return b
+}
+
+func (tr *traceReader) Time() *timestamppb.Timestamp {
+	sec := tr.Int64()
+	nsec := tr.Int32()
+	t := time.Unix(sec, int64(nsec)).UTC()
+	return timestamppb.New(t)
+}
+
+func (tr *traceReader) Nanotime() int64 {
+	return tr.Int64()
+}
+
+func (tr *traceReader) Int32() int32 {
+	u := tr.Uint32()
+	var v int32
+	if u&1 == 0 {
+		v = int32(u >> 1)
+	} else {
+		v = ^int32(u >> 1)
+	}
+	return v
+}
+
+func (tr *traceReader) Uint32() uint32 {
+	var buf [4]byte
+	tr.Bytes(buf[:])
+	return bin.Uint32(buf[:])
+}
+
+func (tr *traceReader) Int64() int64 {
+	return unsignedToSigned(tr.Uint64())
+}
+
+func (tr *traceReader) Uint64() uint64 {
+	var buf [8]byte
+	tr.Bytes(buf[:])
+	return bin.Uint64(buf[:])
+}
+
+func (tr *traceReader) Varint() int64 {
+	u := tr.UVarint()
+	var v int64
+	if u&1 == 0 {
+		v = int64(u >> 1)
+	} else {
+		v = ^int64(u >> 1)
+	}
+	return v
+}
+
+func (tr *traceReader) UVarint() uint64 {
+	i := 0
+	var u uint64
+	for {
+		b, err := tr.buf.ReadByte()
+		tr.setErr(err)
+		if err != nil {
+			return 0
+		}
+		tr.bytesRead++
+		u |= uint64(b&^0x80) << i
+		if b&0x80 == 0 {
+			return u
+		}
+		i += 7
+	}
+}
+
+func (tr *traceReader) Float32() float32 {
+	b := tr.Uint32()
+	return math.Float32frombits(b)
+}
+
+func (tr *traceReader) Float64() float64 {
+	b := tr.Uint64()
+	return math.Float64frombits(b)
+}
+
+func (tr *traceReader) EventID() trace2.EventID {
+	return trace2.EventID(tr.UVarint())
+}
+
+func (tr *traceReader) Duration() time.Duration {
+	return time.Duration(tr.Varint())
+}
+
+func ptrOrNil[T comparable](val T) *T {
+	var zero T
+	if val == zero {
+		return nil
+	}
+	return &val
+}
+
+func unsignedToSigned(u uint64) int64 {
+	var v int64
+	if u&1 == 0 {
+		v = int64(u >> 1)
+	} else {
+		v = ^int64(u >> 1)
+	}
+	return v
+}
+
+type versionFilterReader struct {
+	traceReader *traceReader
+	filtered    bool
+}
+
+func (tr *traceReader) FromVer(version trace2.Version) versionFilterReader {
+	return versionFilterReader{traceReader: tr, filtered: tr.version < version}
+}
+
+func (tr versionFilterReader) Bool(defaultForOlderVersions bool) bool {
+	if tr.filtered {
+		return defaultForOlderVersions
+	}
+	return tr.traceReader.Bool()
+}
diff --git a/pkg/traceparser/parser.go b/pkg/traceparser/parser.go
new file mode 100644
index 0000000000..94bb8673a0
--- /dev/null
+++ b/pkg/traceparser/parser.go
@@ -0,0 +1,999 @@
+package traceparser
+
+import (
+	"bufio"
+	"errors"
+	"fmt"
+	"io"
+	"runtime/debug"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/trace2"
+	"encr.dev/pkg/option"
+	tracepb2 "encr.dev/proto/encore/engine/trace2"
+)
+
+// ParseEvent parses a single event from the buffer.
+func ParseEvent(buf *bufio.Reader, ta trace2.TimeAnchor, version trace2.Version) (*tracepb2.TraceEvent, error) {
+	tp := &traceParser{traceReader: traceReader{buf: buf, version: version}, ta: ta, log: &log.Logger}
+	// If we already have an error, return it.
+	if err := tp.Err(); err != nil {
+		return nil, err
+	}
+
+	typ := trace2.EventType(tp.Byte())
+	if err := tp.Err(); err != nil {
+		return nil, err
+	}
+	h := header{
+		Type:     typ,
+		EventID:  trace2.EventID(tp.Uint64()),
+		Nanotime: tp.Nanotime(),
+		TraceID:  tp.traceID(),
+		SpanID:   tp.Uint64(),
+		Len:      tp.Uint32(),
+	}
+	if err := tp.Err(); err != nil {
+		log.Error().Err(err).Any("header", h).Msgf("failed to parse event header")
+		return nil, err
+	}
+
+	bytesReadAfterHeader := tp.bytesRead
+
+	ev, err := tp.parseEvent(h)
+	if err != nil {
+		return nil, fmt.Errorf("parse event %v: %v", h.Type, err)
+	}
+
+	err = tp.Err()
+	if err == io.EOF {
+		// If we have an io.EOF and we've read exactly the right amount of bytes,
+		// treat it as a non-error.
+		if n := tp.bytesRead - bytesReadAfterHeader; n == int(h.Len) {
+			err = io.EOF
+		} else if n < int(h.Len) {
+			err = io.ErrUnexpectedEOF
+		} else {
+			err = fmt.Errorf("parser of event %s overflowed event buffer", h.Type)
+		}
+	}
+
+	if n := tp.bytesRead - bytesReadAfterHeader; n != int(h.Len) {
+		log.Info().Msgf("event %s: read %d bytes, expected %d", h.Type, n, h.Len)
+	}
+
+	return ev, err
+}
+
+type spanStartEvent struct {
+	Goid             uint32
+	ParentTraceID    option.Option[*tracepb2.TraceID]
+	ParentSpanID     option.Option[uint64]
+	DefLoc           option.Option[uint32]
+	CallerEventID    option.Option[trace2.EventID]
+	ExtCorrelationID option.Option[string]
+}
+
+type spanEndEvent struct {
+	DurationNanos uint64
+	Err           *tracepb2.Error
+	PanicStack    option.Option[*tracepb2.StackTrace]
+	ParentTraceID option.Option[*tracepb2.TraceID]
+	ParentSpanID  option.Option[uint64]
+}
+
+type traceParser struct {
+	traceReader
+	ta  trace2.TimeAnchor
+	log *zerolog.Logger
+}
+
+type header struct {
+	Type    trace2.EventType
+	EventID trace2.EventID
+
+	// TS is a monotonic timestamp in nanoseconds.
+	// It can be converted to an actual timestamp using the trace stream's epoch.
+	Nanotime int64
+
+	TraceID *tracepb2.TraceID
+	SpanID  uint64
+	Len     uint32
+}
+
+var errUnknownEvent = errors.New("unknown event")
+
+func (tp *traceParser) parseEvent(h header) (ev *tracepb2.TraceEvent, err error) {
+	defer func() {
+		if r := recover(); r != nil {
+			if b, ok := r.(bailout); ok {
+				err = b.err
+			} else {
+				err = fmt.Errorf("panic parsing event: %v\n%s", r, debug.Stack())
+			}
+		}
+	}()
+
+	ev = &tracepb2.TraceEvent{
+		TraceId:   h.TraceID,
+		SpanId:    h.SpanID,
+		EventId:   uint64(h.EventID),
+		EventTime: timestamppb.New(tp.ta.ToReal(h.Nanotime)),
+	}
+
+	switch h.Type {
+	case trace2.RequestSpanStart:
+		ev.Event = &tracepb2.TraceEvent_SpanStart{SpanStart: tp.requestSpanStart()}
+	case trace2.RequestSpanEnd:
+		ev.Event = &tracepb2.TraceEvent_SpanEnd{SpanEnd: tp.requestSpanEnd()}
+	case trace2.AuthSpanStart:
+		ev.Event = &tracepb2.TraceEvent_SpanStart{SpanStart: tp.authSpanStart()}
+	case trace2.AuthSpanEnd:
+		ev.Event = &tracepb2.TraceEvent_SpanEnd{SpanEnd: tp.authSpanEnd()}
+	case trace2.PubsubMessageSpanStart:
+		ev.Event = &tracepb2.TraceEvent_SpanStart{SpanStart: tp.pubsubMessageSpanStart()}
+	case trace2.PubsubMessageSpanEnd:
+		ev.Event = &tracepb2.TraceEvent_SpanEnd{SpanEnd: tp.pubsubMessageSpanEnd()}
+	case trace2.TestStart:
+		ev.Event = &tracepb2.TraceEvent_SpanStart{SpanStart: tp.testSpanStart()}
+	case trace2.TestEnd:
+		ev.Event = &tracepb2.TraceEvent_SpanEnd{SpanEnd: tp.testSpanEnd()}
+	default:
+		ev.Event = &tracepb2.TraceEvent_SpanEvent{SpanEvent: tp.spanEvent(h.Type)}
+	}
+
+	return ev, nil
+}
+
+func (tp *traceParser) spanStartEvent() spanStartEvent {
+	goid := uint32(tp.UVarint())
+	parentTraceID := tp.traceID()
+	parentSpanID := tp.Uint64()
+	defLoc := uint32(tp.UVarint())
+	callerEventID := trace2.EventID(tp.UVarint())
+	extCorrelationID := tp.String()
+
+	ev := spanStartEvent{
+		Goid:             goid,
+		ParentSpanID:     option.AsOptional(parentSpanID),
+		DefLoc:           option.AsOptional(defLoc),
+		CallerEventID:    option.AsOptional(callerEventID),
+		ExtCorrelationID: option.AsOptional(extCorrelationID),
+	}
+	if !parentTraceID.IsZero() {
+		ev.ParentTraceID = option.Some(parentTraceID)
+	}
+	return ev
+}
+
+func (tp *traceParser) spanEndEvent() spanEndEvent {
+	dur := tp.Duration()
+	if dur < 0 {
+		dur = 0
+	}
+	err := tp.errWithStack()
+	panicStack := tp.formattedStack()
+	parentTraceID := tp.traceID()
+	parentSpanID := tp.Uint64()
+
+	ev := spanEndEvent{
+		DurationNanos: uint64(dur),
+		Err:           err,
+		PanicStack:    option.AsOptional(panicStack),
+		ParentSpanID:  option.AsOptional(parentSpanID),
+	}
+	if !parentTraceID.IsZero() {
+		ev.ParentTraceID = option.Some(parentTraceID)
+	}
+	return ev
+}
+
+func (tp *traceParser) spanEvent(eventType trace2.EventType) *tracepb2.SpanEvent {
+	defLoc := uint32(tp.UVarint())
+	goid := uint32(tp.UVarint())
+	correlationEventID := tp.EventID()
+
+	ev := &tracepb2.SpanEvent{Goid: goid}
+	if defLoc > 0 {
+		ev.DefLoc = &defLoc
+	}
+	if correlationEventID > 0 {
+		ev.CorrelationEventId = (*uint64)(&correlationEventID)
+	}
+
+	switch eventType {
+	case trace2.RPCCallStart:
+		ev.Data = &tracepb2.SpanEvent_RpcCallStart{RpcCallStart: tp.rpcCallStart()}
+	case trace2.RPCCallEnd:
+		ev.Data = &tracepb2.SpanEvent_RpcCallEnd{RpcCallEnd: tp.rpcCallEnd()}
+	case trace2.DBQueryStart:
+		ev.Data = &tracepb2.SpanEvent_DbQueryStart{DbQueryStart: tp.dbQueryStart()}
+	case trace2.DBQueryEnd:
+		ev.Data = &tracepb2.SpanEvent_DbQueryEnd{DbQueryEnd: tp.dbQueryEnd()}
+	case trace2.DBTransactionStart:
+		ev.Data = &tracepb2.SpanEvent_DbTransactionStart{DbTransactionStart: tp.dbTransactionStart()}
+	case trace2.DBTransactionEnd:
+		ev.Data = &tracepb2.SpanEvent_DbTransactionEnd{DbTransactionEnd: tp.dbTransactionEnd()}
+	case trace2.PubsubPublishStart:
+		ev.Data = &tracepb2.SpanEvent_PubsubPublishStart{PubsubPublishStart: tp.pubsubPublishStart()}
+	case trace2.PubsubPublishEnd:
+		ev.Data = &tracepb2.SpanEvent_PubsubPublishEnd{PubsubPublishEnd: tp.pubsubPublishEnd()}
+	case trace2.HTTPCallStart:
+		ev.Data = &tracepb2.SpanEvent_HttpCallStart{HttpCallStart: tp.httpCallStart()}
+	case trace2.HTTPCallEnd:
+		ev.Data = &tracepb2.SpanEvent_HttpCallEnd{HttpCallEnd: tp.httpCallEnd()}
+	case trace2.LogMessage:
+		ev.Data = &tracepb2.SpanEvent_LogMessage{LogMessage: tp.logMessage()}
+	case trace2.ServiceInitStart:
+		ev.Data = &tracepb2.SpanEvent_ServiceInitStart{ServiceInitStart: tp.serviceInitStart()}
+	case trace2.ServiceInitEnd:
+		ev.Data = &tracepb2.SpanEvent_ServiceInitEnd{ServiceInitEnd: tp.serviceInitEnd()}
+	case trace2.CacheCallStart:
+		ev.Data = &tracepb2.SpanEvent_CacheCallStart{CacheCallStart: tp.cacheCallStart()}
+	case trace2.CacheCallEnd:
+		ev.Data = &tracepb2.SpanEvent_CacheCallEnd{CacheCallEnd: tp.cacheCallEnd()}
+	case trace2.BodyStream:
+		ev.Data = &tracepb2.SpanEvent_BodyStream{BodyStream: tp.bodyStream()}
+	case trace2.BucketObjectUploadStart:
+		ev.Data = &tracepb2.SpanEvent_BucketObjectUploadStart{BucketObjectUploadStart: tp.bucketObjectUploadStart()}
+	case trace2.BucketObjectUploadEnd:
+		ev.Data = &tracepb2.SpanEvent_BucketObjectUploadEnd{BucketObjectUploadEnd: tp.bucketObjectUploadEnd()}
+	case trace2.BucketObjectDownloadStart:
+		ev.Data = &tracepb2.SpanEvent_BucketObjectDownloadStart{BucketObjectDownloadStart: tp.bucketObjectDownloadStart()}
+	case trace2.BucketObjectDownloadEnd:
+		ev.Data = &tracepb2.SpanEvent_BucketObjectDownloadEnd{BucketObjectDownloadEnd: tp.bucketObjectDownloadEnd()}
+	case trace2.BucketObjectGetAttrsStart:
+		ev.Data = &tracepb2.SpanEvent_BucketObjectGetAttrsStart{BucketObjectGetAttrsStart: tp.bucketObjectGetAttrsStart()}
+	case trace2.BucketObjectGetAttrsEnd:
+		ev.Data = &tracepb2.SpanEvent_BucketObjectGetAttrsEnd{BucketObjectGetAttrsEnd: tp.bucketObjectGetAttrsEnd()}
+	case trace2.BucketListObjectsStart:
+		ev.Data = &tracepb2.SpanEvent_BucketListObjectsStart{BucketListObjectsStart: tp.bucketListObjectsStart()}
+	case trace2.BucketListObjectsEnd:
+		ev.Data = &tracepb2.SpanEvent_BucketListObjectsEnd{BucketListObjectsEnd: tp.bucketListObjectsEnd()}
+	case trace2.BucketDeleteObjectsStart:
+		ev.Data = &tracepb2.SpanEvent_BucketDeleteObjectsStart{BucketDeleteObjectsStart: tp.bucketDeleteObjectsStart()}
+	case trace2.BucketDeleteObjectsEnd:
+		ev.Data = &tracepb2.SpanEvent_BucketDeleteObjectsEnd{BucketDeleteObjectsEnd: tp.bucketDeleteObjectsEnd()}
+
+	default:
+		tp.bailout(fmt.Errorf("unknown event %v", eventType))
+	}
+
+	return ev
+}
+
+func (tp *traceParser) requestSpanStart() *tracepb2.SpanStart {
+	spanStart := tp.spanStartEvent()
+
+	start := &tracepb2.SpanStart{
+		Goid:                  spanStart.Goid,
+		ParentTraceId:         spanStart.ParentTraceID.GetOrElse(nil),
+		ParentSpanId:          spanStart.ParentSpanID.PtrOrNil(),
+		DefLoc:                spanStart.DefLoc.PtrOrNil(),
+		CallerEventId:         (*uint64)(spanStart.CallerEventID.PtrOrNil()),
+		ExternalCorrelationId: spanStart.ExtCorrelationID.PtrOrNil(),
+		Data: &tracepb2.SpanStart_Request{
+			Request: &tracepb2.RequestSpanStart{
+				ServiceName:  tp.String(),
+				EndpointName: tp.String(),
+				HttpMethod:   tp.String(),
+				Path:         tp.String(),
+				PathParams: (func() []string {
+					n := tp.UVarint()
+					if n == 0 {
+						return nil
+					}
+					params := make([]string, n)
+					for i := 0; i < int(n); i++ {
+						params[i] = tp.String()
+					}
+					return params
+				})(),
+				RequestHeaders:   tp.headers(),
+				RequestPayload:   tp.ByteString(),
+				ExtCorrelationId: ptrOrNil(tp.String()),
+				Uid:              ptrOrNil(tp.String()),
+				Mocked:           tp.FromVer(15).Bool(false),
+			},
+		},
+	}
+
+	return start
+}
+
+func (tp *traceParser) requestSpanEnd() *tracepb2.SpanEnd {
+	spanEnd := tp.spanEndEvent()
+	return &tracepb2.SpanEnd{
+		DurationNanos: spanEnd.DurationNanos,
+		Error:         spanEnd.Err,
+		PanicStack:    spanEnd.PanicStack.GetOrElse(nil),
+		ParentTraceId: spanEnd.ParentTraceID.GetOrElse(nil),
+		ParentSpanId:  spanEnd.ParentSpanID.PtrOrNil(),
+		Data: &tracepb2.SpanEnd_Request{
+			Request: &tracepb2.RequestSpanEnd{
+				ServiceName:     tp.String(),
+				EndpointName:    tp.String(),
+				HttpStatusCode:  uint32(tp.UVarint()),
+				ResponseHeaders: tp.headers(),
+				ResponsePayload: tp.ByteString(),
+			},
+		},
+	}
+}
+
+func (tp *traceParser) authSpanStart() *tracepb2.SpanStart {
+	spanStart := tp.spanStartEvent()
+
+	return &tracepb2.SpanStart{
+		Goid:                  spanStart.Goid,
+		ParentTraceId:         spanStart.ParentTraceID.GetOrElse(nil),
+		ParentSpanId:          spanStart.ParentSpanID.PtrOrNil(),
+		DefLoc:                spanStart.DefLoc.PtrOrNil(),
+		CallerEventId:         (*uint64)(spanStart.CallerEventID.PtrOrNil()),
+		ExternalCorrelationId: spanStart.ExtCorrelationID.PtrOrNil(),
+		Data: &tracepb2.SpanStart_Auth{
+			Auth: &tracepb2.AuthSpanStart{
+				ServiceName:  tp.String(),
+				EndpointName: tp.String(),
+				AuthPayload:  tp.ByteString(),
+			},
+		},
+	}
+}
+
+func (tp *traceParser) authSpanEnd() *tracepb2.SpanEnd {
+	spanEnd := tp.spanEndEvent()
+	return &tracepb2.SpanEnd{
+		DurationNanos: spanEnd.DurationNanos,
+		Error:         spanEnd.Err,
+		PanicStack:    spanEnd.PanicStack.GetOrElse(nil),
+		ParentTraceId: spanEnd.ParentTraceID.GetOrElse(nil),
+		ParentSpanId:  spanEnd.ParentSpanID.PtrOrNil(),
+		Data: &tracepb2.SpanEnd_Auth{
+			Auth: &tracepb2.AuthSpanEnd{
+				ServiceName:  tp.String(),
+				EndpointName: tp.String(),
+				Uid:          tp.String(),
+				UserData:     tp.ByteString(),
+			},
+		},
+	}
+}
+
+func (tp *traceParser) pubsubMessageSpanStart() *tracepb2.SpanStart {
+	spanStart := tp.spanStartEvent()
+
+	return &tracepb2.SpanStart{
+		Goid:                  spanStart.Goid,
+		ParentTraceId:         spanStart.ParentTraceID.GetOrElse(nil),
+		ParentSpanId:          spanStart.ParentSpanID.PtrOrNil(),
+		DefLoc:                spanStart.DefLoc.PtrOrNil(),
+		CallerEventId:         (*uint64)(spanStart.CallerEventID.PtrOrNil()),
+		ExternalCorrelationId: spanStart.ExtCorrelationID.PtrOrNil(),
+		Data: &tracepb2.SpanStart_PubsubMessage{
+			PubsubMessage: &tracepb2.PubsubMessageSpanStart{
+				ServiceName:      tp.String(),
+				TopicName:        tp.String(),
+				SubscriptionName: tp.String(),
+				MessageId:        tp.String(),
+				Attempt:          uint32(tp.UVarint()),
+				PublishTime:      tp.Time(), // TODO use nanotime
+				MessagePayload:   tp.ByteString(),
+			},
+		},
+	}
+}
+
+func (tp *traceParser) pubsubMessageSpanEnd() *tracepb2.SpanEnd {
+	spanEnd := tp.spanEndEvent()
+	return &tracepb2.SpanEnd{
+		DurationNanos: spanEnd.DurationNanos,
+		Error:         spanEnd.Err,
+		PanicStack:    spanEnd.PanicStack.GetOrElse(nil),
+		ParentTraceId: spanEnd.ParentTraceID.GetOrElse(nil),
+		ParentSpanId:  spanEnd.ParentSpanID.PtrOrNil(),
+		Data: &tracepb2.SpanEnd_PubsubMessage{
+			PubsubMessage: &tracepb2.PubsubMessageSpanEnd{
+				ServiceName:      tp.String(),
+				TopicName:        tp.String(),
+				SubscriptionName: tp.String(),
+			},
+		},
+	}
+}
+
+func (tp *traceParser) testSpanStart() *tracepb2.SpanStart {
+	spanStart := tp.spanStartEvent()
+
+	return &tracepb2.SpanStart{
+		Goid:                  spanStart.Goid,
+		ParentTraceId:         spanStart.ParentTraceID.GetOrElse(nil),
+		ParentSpanId:          spanStart.ParentSpanID.PtrOrNil(),
+		DefLoc:                spanStart.DefLoc.PtrOrNil(),
+		CallerEventId:         (*uint64)(spanStart.CallerEventID.PtrOrNil()),
+		ExternalCorrelationId: spanStart.ExtCorrelationID.PtrOrNil(),
+		Data: &tracepb2.SpanStart_Test{
+			Test: &tracepb2.TestSpanStart{
+				ServiceName: tp.String(),
+				TestName:    tp.String(),
+				Uid:         tp.String(),
+				TestFile:    tp.String(),
+				TestLine:    tp.Uint32(),
+			},
+		},
+	}
+}
+
+func (tp *traceParser) testSpanEnd() *tracepb2.SpanEnd {
+	spanEnd := tp.spanEndEvent()
+	return &tracepb2.SpanEnd{
+		DurationNanos: spanEnd.DurationNanos,
+		Error:         spanEnd.Err,
+		PanicStack:    spanEnd.PanicStack.GetOrElse(nil),
+		ParentTraceId: spanEnd.ParentTraceID.GetOrElse(nil),
+		ParentSpanId:  spanEnd.ParentSpanID.PtrOrNil(),
+		Data: &tracepb2.SpanEnd_Test{
+			Test: &tracepb2.TestSpanEnd{
+				ServiceName: tp.String(),
+				TestName:    tp.String(),
+				Failed:      tp.Bool(),
+				Skipped:     tp.Bool(),
+			},
+		},
+	}
+}
+
+func (tp *traceParser) rpcCallStart() *tracepb2.RPCCallStart {
+	return &tracepb2.RPCCallStart{
+		TargetServiceName:  tp.String(),
+		TargetEndpointName: tp.String(),
+		Stack:              tp.stack(),
+	}
+}
+
+func (tp *traceParser) rpcCallEnd() *tracepb2.RPCCallEnd {
+	return &tracepb2.RPCCallEnd{
+		Err: tp.errWithStack(),
+	}
+}
+
+func (tp *traceParser) dbQueryStart() *tracepb2.DBQueryStart {
+	return &tracepb2.DBQueryStart{
+		Query: tp.String(),
+		Stack: tp.stack(),
+	}
+}
+
+func (tp *traceParser) dbQueryEnd() *tracepb2.DBQueryEnd {
+	return &tracepb2.DBQueryEnd{
+		Err: tp.errWithStack(),
+	}
+}
+
+func (tp *traceParser) dbTransactionStart() *tracepb2.DBTransactionStart {
+	return &tracepb2.DBTransactionStart{
+		Stack: tp.stack(),
+	}
+}
+
+func (tp *traceParser) dbTransactionEnd() *tracepb2.DBTransactionEnd {
+	return &tracepb2.DBTransactionEnd{
+		Completion: (func() tracepb2.DBTransactionEnd_CompletionType {
+			if commit := tp.Bool(); commit {
+				return tracepb2.DBTransactionEnd_COMMIT
+			} else {
+				return tracepb2.DBTransactionEnd_ROLLBACK
+			}
+		})(),
+		Stack: tp.stack(),
+		Err:   tp.errWithStack(),
+	}
+}
+
+func (tp *traceParser) pubsubPublishStart() *tracepb2.PubsubPublishStart {
+	return &tracepb2.PubsubPublishStart{
+		Topic:   tp.String(),
+		Message: tp.ByteString(),
+		Stack:   tp.stack(),
+	}
+}
+
+func (tp *traceParser) pubsubPublishEnd() *tracepb2.PubsubPublishEnd {
+	return &tracepb2.PubsubPublishEnd{
+		MessageId: ptrOrNil(tp.String()),
+		Err:       tp.errWithStack(),
+	}
+}
+
+func (tp *traceParser) serviceInitStart() *tracepb2.ServiceInitStart {
+	return &tracepb2.ServiceInitStart{
+		Service: tp.String(),
+	}
+}
+
+func (tp *traceParser) serviceInitEnd() *tracepb2.ServiceInitEnd {
+	return &tracepb2.ServiceInitEnd{
+		Err: tp.errWithStack(),
+	}
+}
+
+func (tp *traceParser) httpCallStart() *tracepb2.HTTPCallStart {
+	return &tracepb2.HTTPCallStart{
+		CorrelationParentSpanId: tp.Uint64(),
+		Method:                  tp.String(),
+		Url:                     tp.String(),
+		Stack:                   tp.stack(),
+		StartNanotime:           tp.Int64(),
+	}
+}
+
+func (tp *traceParser) httpCallEnd() *tracepb2.HTTPCallEnd {
+	return &tracepb2.HTTPCallEnd{
+		StatusCode: ptrOrNil(uint32(tp.UVarint())),
+		Err:        tp.errWithStack(),
+		TraceEvents: (func() []*tracepb2.HTTPTraceEvent {
+			n := tp.UVarint()
+			events := make([]*tracepb2.HTTPTraceEvent, 0, n)
+			for i := 0; i < int(n); i++ {
+				if ev := tp.httpEvent(); ev != nil {
+					events = append(events, ev)
+				}
+			}
+			return events
+		})(),
+	}
+}
+
+func (tp *traceParser) cacheCallStart() *tracepb2.CacheCallStart {
+	return &tracepb2.CacheCallStart{
+		Operation: tp.String(),
+		Write:     tp.Bool(),
+		Stack:     tp.stack(),
+		Keys: (func() []string {
+			n := tp.UVarint()
+			keys := make([]string, n)
+			for i := 0; i < int(n); i++ {
+				keys[i] = tp.String()
+			}
+			return keys
+		})(),
+	}
+}
+
+func (tp *traceParser) cacheCallEnd() *tracepb2.CacheCallEnd {
+	return &tracepb2.CacheCallEnd{
+		Result: (func() tracepb2.CacheCallEnd_Result {
+			res := tp.Byte()
+			switch trace2.CacheCallResult(res) {
+			case trace2.CacheOK:
+				return tracepb2.CacheCallEnd_OK
+			case trace2.CacheNoSuchKey:
+				return tracepb2.CacheCallEnd_NO_SUCH_KEY
+			case trace2.CacheConflict:
+				return tracepb2.CacheCallEnd_CONFLICT
+			case trace2.CacheErr:
+				return tracepb2.CacheCallEnd_ERR
+			default:
+				return tracepb2.CacheCallEnd_UNKNOWN
+			}
+		})(),
+		Err: tp.errWithStack(),
+	}
+}
+
+func (tp *traceParser) bucketObjectUploadStart() *tracepb2.BucketObjectUploadStart {
+	return &tracepb2.BucketObjectUploadStart{
+		Bucket: tp.String(),
+		Object: tp.String(),
+		Attrs:  tp.bucketObjectAttrs(),
+		Stack:  tp.stack(),
+	}
+}
+
+func (tp *traceParser) bucketObjectAttrs() *tracepb2.BucketObjectAttributes {
+	return &tracepb2.BucketObjectAttributes{
+		Size:        tp.OptUVarint(),
+		Version:     tp.OptString(),
+		Etag:        tp.OptString(),
+		ContentType: tp.OptString(),
+	}
+}
+
+func (tp *traceParser) bucketObjectUploadEnd() *tracepb2.BucketObjectUploadEnd {
+	return &tracepb2.BucketObjectUploadEnd{
+		Size:    tp.OptUVarint(),
+		Version: tp.OptString(),
+		Err:     tp.errWithStack(),
+	}
+}
+
+func (tp *traceParser) bucketObjectDownloadStart() *tracepb2.BucketObjectDownloadStart {
+	return &tracepb2.BucketObjectDownloadStart{
+		Bucket:  tp.String(),
+		Object:  tp.String(),
+		Version: tp.OptString(),
+		Stack:   tp.stack(),
+	}
+}
+
+func (tp *traceParser) bucketObjectDownloadEnd() *tracepb2.BucketObjectDownloadEnd {
+	return &tracepb2.BucketObjectDownloadEnd{
+		Size: tp.OptUVarint(),
+		Err:  tp.errWithStack(),
+	}
+}
+
+func (tp *traceParser) bucketDeleteObjectsStart() *tracepb2.BucketDeleteObjectsStart {
+	ev := &tracepb2.BucketDeleteObjectsStart{
+		Bucket: tp.String(),
+		Stack:  tp.stack(),
+	}
+
+	num := tp.UVarint()
+	for i := 0; i < int(num); i++ {
+		ev.Entries = append(ev.Entries, &tracepb2.BucketDeleteObjectEntry{
+			Object:  tp.String(),
+			Version: tp.OptString(),
+		})
+	}
+
+	return ev
+}
+
+func (tp *traceParser) bucketDeleteObjectsEnd() *tracepb2.BucketDeleteObjectsEnd {
+	return &tracepb2.BucketDeleteObjectsEnd{
+		Err: tp.errWithStack(),
+	}
+}
+
+func (tp *traceParser) bucketListObjectsStart() *tracepb2.BucketListObjectsStart {
+	return &tracepb2.BucketListObjectsStart{
+		Bucket: tp.String(),
+		Prefix: tp.OptString(),
+		Stack:  tp.stack(),
+	}
+}
+
+func (tp *traceParser) bucketListObjectsEnd() *tracepb2.BucketListObjectsEnd {
+	return &tracepb2.BucketListObjectsEnd{
+		Err:      tp.errWithStack(),
+		Observed: tp.UVarint(),
+		HasMore:  tp.Bool(),
+	}
+}
+
+func (tp *traceParser) bucketObjectGetAttrsStart() *tracepb2.BucketObjectGetAttrsStart {
+	return &tracepb2.BucketObjectGetAttrsStart{
+		Bucket:  tp.String(),
+		Object:  tp.String(),
+		Version: tp.OptString(),
+		Stack:   tp.stack(),
+	}
+}
+
+func (tp *traceParser) bucketObjectGetAttrsEnd() *tracepb2.BucketObjectGetAttrsEnd {
+	ev := &tracepb2.BucketObjectGetAttrsEnd{
+		Err: tp.errWithStack(),
+	}
+
+	if ev.Err == nil {
+		ev.Attrs = tp.bucketObjectAttrs()
+	}
+
+	return ev
+}
+
+func (tp *traceParser) bodyStream() *tracepb2.BodyStream {
+	flags := tp.Byte()
+	data := tp.ByteString()
+	return &tracepb2.BodyStream{
+		IsResponse: flags&0b01 == 0b01,
+		Overflowed: flags&0b10 == 0b10,
+		Data:       data,
+	}
+}
+
+func (tp *traceParser) headers() map[string]string {
+	n := tp.UVarint()
+	if n == 0 {
+		return nil
+	}
+	headers := make(map[string]string, n)
+	for i := 0; i < int(n); i++ {
+		headers[tp.String()] = tp.String()
+	}
+	return headers
+}
+
+func (tp *traceParser) httpEvent() *tracepb2.HTTPTraceEvent {
+	code := trace2.HTTPEventCode(tp.Byte())
+	ev := &tracepb2.HTTPTraceEvent{
+		Nanotime: tp.Int64(),
+	}
+
+	switch code {
+	case trace2.GetConn:
+		ev.Data = &tracepb2.HTTPTraceEvent_GetConn{
+			GetConn: &tracepb2.HTTPGetConn{
+				HostPort: tp.String(),
+			},
+		}
+
+	case trace2.GotConn:
+		ev.Data = &tracepb2.HTTPTraceEvent_GotConn{
+			GotConn: &tracepb2.HTTPGotConn{
+				Reused:         tp.Bool(),
+				WasIdle:        tp.Bool(),
+				IdleDurationNs: tp.Int64(),
+			},
+		}
+
+	case trace2.GotFirstResponseByte:
+		ev.Data = &tracepb2.HTTPTraceEvent_GotFirstResponseByte{
+			GotFirstResponseByte: &tracepb2.HTTPGotFirstResponseByte{
+				// No data
+			},
+		}
+
+	case trace2.Got1xxResponse:
+		ev.Data = &tracepb2.HTTPTraceEvent_Got_1XxResponse{
+			Got_1XxResponse: &tracepb2.HTTPGot1XxResponse{
+				Code: int32(tp.Varint()),
+			},
+		}
+
+	case trace2.DNSStart:
+		ev.Data = &tracepb2.HTTPTraceEvent_DnsStart{
+			DnsStart: &tracepb2.HTTPDNSStart{
+				Host: tp.String(),
+			},
+		}
+
+	case trace2.DNSDone:
+		data := &tracepb2.HTTPDNSDone{
+			Err: tp.ByteString(),
+		}
+		addrs := int(tp.UVarint())
+		for j := 0; j < addrs; j++ {
+			data.Addrs = append(data.Addrs, &tracepb2.DNSAddr{
+				Ip: tp.ByteString(),
+			})
+		}
+		ev.Data = &tracepb2.HTTPTraceEvent_DnsDone{DnsDone: data}
+
+	case trace2.ConnectStart:
+		ev.Data = &tracepb2.HTTPTraceEvent_ConnectStart{
+			ConnectStart: &tracepb2.HTTPConnectStart{
+				Network: tp.String(),
+				Addr:    tp.String(),
+			},
+		}
+
+	case trace2.ConnectDone:
+		ev.Data = &tracepb2.HTTPTraceEvent_ConnectDone{
+			ConnectDone: &tracepb2.HTTPConnectDone{
+				Network: tp.String(),
+				Addr:    tp.String(),
+				Err:     tp.ByteString(),
+			},
+		}
+
+	case trace2.TLSHandshakeStart:
+		ev.Data = &tracepb2.HTTPTraceEvent_TlsHandshakeStart{
+			TlsHandshakeStart: &tracepb2.HTTPTLSHandshakeStart{
+				// No data
+			},
+		}
+
+	case trace2.TLSHandshakeDone:
+		ev.Data = &tracepb2.HTTPTraceEvent_TlsHandshakeDone{
+			TlsHandshakeDone: &tracepb2.HTTPTLSHandshakeDone{
+				Err:                tp.ByteString(),
+				TlsVersion:         tp.Uint32(),
+				CipherSuite:        tp.Uint32(),
+				ServerName:         tp.String(),
+				NegotiatedProtocol: tp.String(),
+			},
+		}
+
+	case trace2.WroteHeaders:
+		ev.Data = &tracepb2.HTTPTraceEvent_WroteHeaders{
+			WroteHeaders: &tracepb2.HTTPWroteHeaders{
+				// No data
+			},
+		}
+
+	case trace2.WroteRequest:
+		ev.Data = &tracepb2.HTTPTraceEvent_WroteRequest{
+			WroteRequest: &tracepb2.HTTPWroteRequest{
+				Err: tp.ByteString(),
+			},
+		}
+
+	case trace2.Wait100Continue:
+		// no data
+		ev.Data = &tracepb2.HTTPTraceEvent_Wait_100Continue{
+			Wait_100Continue: &tracepb2.HTTPWait100Continue{
+				// No data
+			},
+		}
+
+	case trace2.ClosedBody:
+		ev.Data = &tracepb2.HTTPTraceEvent_ClosedBody{
+			ClosedBody: &tracepb2.HTTPClosedBodyData{
+				Err: tp.ByteString(),
+			},
+		}
+
+	default:
+		// TODO bailout
+		tp.log.Error().Int32("code", int32(code)).Msg("unknown http event code")
+		return nil
+	}
+	return ev
+}
+
+func (tp *traceParser) logMessage() *tracepb2.LogMessage {
+	return &tracepb2.LogMessage{
+		Level: (func() tracepb2.LogMessage_Level {
+			switch model.LogLevel(tp.Byte()) {
+			case model.LevelTrace:
+				return tracepb2.LogMessage_TRACE
+			case model.LevelDebug:
+				return tracepb2.LogMessage_DEBUG
+			case model.LevelInfo:
+				return tracepb2.LogMessage_INFO
+			case model.LevelWarn:
+				return tracepb2.LogMessage_WARN
+			case model.LevelError:
+				return tracepb2.LogMessage_ERROR
+			default:
+				return tracepb2.LogMessage_TRACE
+			}
+		})(),
+		Msg: tp.String(),
+		Fields: (func() []*tracepb2.LogField {
+			n := int(tp.UVarint())
+			if n > 64 {
+				// TODO bailout
+			}
+			fields := make([]*tracepb2.LogField, 0, n)
+			for i := 0; i < n; i++ {
+				fields = append(fields, tp.logField())
+			}
+			return fields
+		})(),
+		Stack: tp.stack(),
+	}
+}
+
+func (tp *traceParser) logField() *tracepb2.LogField {
+	typ := model.LogFieldType(tp.Byte())
+	f := &tracepb2.LogField{
+		Key: tp.String(),
+	}
+	switch typ {
+	case model.ErrField:
+		f.Value = &tracepb2.LogField_Error{Error: tp.errWithStack()}
+	case model.StringField:
+		f.Value = &tracepb2.LogField_Str{Str: tp.String()}
+	case model.BoolField:
+		f.Value = &tracepb2.LogField_Bool{Bool: tp.Bool()}
+	case model.TimeField:
+		f.Value = &tracepb2.LogField_Time{Time: tp.Time()}
+	case model.DurationField:
+		f.Value = &tracepb2.LogField_Dur{Dur: tp.Int64()}
+	case model.UUIDField:
+		b := make([]byte, 16)
+		tp.Bytes(b)
+		f.Value = &tracepb2.LogField_Uuid{Uuid: b}
+	case model.JSONField:
+		val := tp.ByteString()
+		err := tp.errWithStack()
+		if err != nil {
+			f.Value = &tracepb2.LogField_Error{Error: err}
+		} else {
+			f.Value = &tracepb2.LogField_Json{Json: val}
+		}
+	case model.IntField:
+		f.Value = &tracepb2.LogField_Int{Int: tp.Varint()}
+	case model.UintField:
+		f.Value = &tracepb2.LogField_Uint{Uint: tp.UVarint()}
+	case model.Float32Field:
+		f.Value = &tracepb2.LogField_Float32{Float32: tp.Float32()}
+	case model.Float64Field:
+		f.Value = &tracepb2.LogField_Float64{Float64: tp.Float64()}
+	default:
+		// TODO bailout
+		tp.log.Error().Msgf("unknown log field type %v", typ)
+		return nil
+	}
+	return f
+}
+
+func (tp *traceParser) stack() *tracepb2.StackTrace {
+	n := int(tp.Byte())
+	if n == 0 {
+		return nil
+	}
+
+	tr := &tracepb2.StackTrace{}
+	diffs := make([]int64, n)
+	for i := 0; i < n; i++ {
+		diff := tp.Varint()
+		diffs[i] = diff
+	}
+	tr.Pcs = diffs
+
+	prev := int64(0)
+
+	pcs := make([]uint64, n)
+	for i := 0; i < n; i++ {
+		x := prev + diffs[i]
+		prev = x
+		pcs[i] = uint64(x)
+	}
+
+	return tr
+}
+
+func (tp *traceParser) formattedStack() *tracepb2.StackTrace {
+	n := int(tp.Byte())
+	if n == 0 {
+		return nil
+	}
+
+	tr := &tracepb2.StackTrace{
+		Frames: make([]*tracepb2.StackFrame, n),
+	}
+
+	for i := 0; i < n; i++ {
+		tr.Frames[i] = &tracepb2.StackFrame{
+			Filename: tp.String(),
+			Line:     int32(tp.UVarint()),
+			Func:     tp.String(),
+		}
+	}
+
+	return tr
+}
+
+// errWithStack parses an error with stack information.
+func (tp *traceParser) errWithStack() *tracepb2.Error {
+	msg := tp.String()
+	if len(msg) == 0 {
+		return nil
+	}
+	stack := tp.stack()
+	return &tracepb2.Error{
+		Msg:   msg,
+		Stack: stack,
+	}
+}
+
+func (tp *traceParser) traceID() *tracepb2.TraceID {
+	var traceID [16]byte
+	tp.Bytes(traceID[:])
+	return &tracepb2.TraceID{
+		Low:  bin.Uint64(traceID[:8]),
+		High: bin.Uint64(traceID[8:]),
+	}
+}
+
+func (tp *traceParser) spanID() uint64 {
+	var spanID [8]byte
+	tp.Bytes(spanID[:])
+	return bin.Uint64(spanID[:])
+}
+
+type bailout struct {
+	err error
+}
+
+func (tp *traceParser) bailout(err error) {
+	panic(bailout{err: err})
+}
diff --git a/pkg/traceparser/parser_test.go b/pkg/traceparser/parser_test.go
new file mode 100644
index 0000000000..bf45201c95
--- /dev/null
+++ b/pkg/traceparser/parser_test.go
@@ -0,0 +1,690 @@
+package traceparser
+
+import (
+	"bufio"
+	"bytes"
+	"errors"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/types/uuid"
+	tracepb2 "encr.dev/proto/encore/engine/trace2"
+)
+
+func TestParse(t *testing.T) {
+	traceID := model.TraceID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
+	spanID := model.SpanID{8, 7, 6, 5, 4, 3, 2, 1}
+	now := time.Now()
+	err := errors.New("some-error")
+	goid := uint32(123)
+	defLoc := uint32(456)
+	udefLoc := uint32(defLoc) // for compat
+	uuidVal := uuid.UUID{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}
+
+	pbNow := timestamppb.New(now)
+	pbTraceID := &tracepb2.TraceID{High: 1157159078456920585, Low: 578437695752307201}
+	pbSpanID := uint64(72623859790382856)
+	pbErr := &tracepb2.Error{Msg: "some-error"}
+	pbUUID := uuidVal.Bytes()
+
+	ep := trace2.EventParams{TraceID: traceID, SpanID: spanID, Goid: goid, DefLoc: defLoc}
+
+	tests := []struct {
+		Name string
+		Emit func(l *trace2.Log)
+		Want *tracepb2.TraceEvent
+	}{
+		{
+			Name: "RequestSpanStart",
+			Emit: func(l *trace2.Log) {
+				l.RequestSpanStart(&model.Request{
+					Type:         model.RPCCall,
+					TraceID:      traceID,
+					SpanID:       spanID,
+					ParentSpanID: model.SpanID{},
+					Start:        now,
+					Traced:       true,
+					DefLoc:       defLoc,
+					RPCData: &model.RPCData{
+						Desc: &model.RPCDesc{
+							Service:  "service",
+							Endpoint: "endpoint",
+							Raw:      false,
+						},
+						HTTPMethod:     "POST",
+						Path:           "/path/hello",
+						PathParams:     model.PathParams{{Name: "one", Value: "hello"}},
+						UserID:         "userid",
+						AuthData:       nil,
+						NonRawPayload:  []byte(`{"Body":"foo"}`),
+						RequestHeaders: http.Header{"Content-Type": []string{"application/json"}},
+					},
+				}, goid)
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanStart{SpanStart: &tracepb2.SpanStart{
+					ParentTraceId:         nil,
+					ParentSpanId:          nil,
+					ExternalCorrelationId: nil,
+					DefLoc:                &udefLoc,
+					Goid:                  goid,
+					Data: &tracepb2.SpanStart_Request{
+						Request: &tracepb2.RequestSpanStart{
+							ServiceName:      "service",
+							EndpointName:     "endpoint",
+							HttpMethod:       "POST",
+							Path:             "/path/hello",
+							PathParams:       []string{"hello"},
+							RequestHeaders:   map[string]string{"Content-Type": "application/json"},
+							RequestPayload:   []byte(`{"Body":"foo"}`),
+							ExtCorrelationId: nil,
+							Uid:              ptr("userid"),
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "RequestSpanEnd",
+			Emit: func(l *trace2.Log) {
+				l.RequestSpanEnd(trace2.RequestSpanEndParams{
+					EventParams: ep,
+					Req: &model.Request{
+						RPCData: &model.RPCData{
+							Desc: &model.RPCDesc{
+								Service:  "service",
+								Endpoint: "endpoint",
+							},
+						},
+					},
+					Resp: &model.Response{
+						HTTPStatus:         123,
+						Err:                err,
+						Payload:            []byte("payload"),
+						RawResponseHeaders: map[string][]string{"Content-Type": {"application/json"}},
+					},
+				})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEnd{SpanEnd: &tracepb2.SpanEnd{
+					Error: pbErr,
+					Data: &tracepb2.SpanEnd_Request{
+						Request: &tracepb2.RequestSpanEnd{
+							ServiceName:     "service",
+							EndpointName:    "endpoint",
+							HttpStatusCode:  123,
+							ResponseHeaders: map[string]string{"Content-Type": "application/json"},
+							ResponsePayload: []byte("payload"),
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "AuthSpanStart",
+			Emit: func(l *trace2.Log) {
+				l.AuthSpanStart(&model.Request{
+					Type:         model.AuthHandler,
+					TraceID:      traceID,
+					SpanID:       spanID,
+					ParentSpanID: model.SpanID{},
+					Start:        now,
+					Traced:       true,
+					DefLoc:       defLoc,
+					RPCData: &model.RPCData{
+						Desc: &model.RPCDesc{
+							Service:  "service",
+							Endpoint: "endpoint",
+							Raw:      false,
+						},
+						NonRawPayload: []byte(`{"Body":"foo"}`),
+					},
+				}, goid)
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanStart{SpanStart: &tracepb2.SpanStart{
+					ParentTraceId:         nil,
+					ParentSpanId:          nil,
+					ExternalCorrelationId: nil,
+					DefLoc:                &udefLoc,
+					Goid:                  goid,
+					Data: &tracepb2.SpanStart_Auth{
+						Auth: &tracepb2.AuthSpanStart{
+							ServiceName:  "service",
+							EndpointName: "endpoint",
+							AuthPayload:  []byte(`{"Body":"foo"}`),
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "AuthSpanEnd",
+			Emit: func(l *trace2.Log) {
+				l.AuthSpanEnd(trace2.AuthSpanEndParams{
+					EventParams: ep,
+					Req: &model.Request{
+						RPCData: &model.RPCData{
+							Desc: &model.RPCDesc{
+								Service:  "service",
+								Endpoint: "endpoint",
+							},
+						},
+					},
+					Resp: &model.Response{
+						HTTPStatus: 123,
+						AuthUID:    "userid",
+						Err:        err,
+						Payload:    []byte("payload"),
+					},
+				})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEnd{SpanEnd: &tracepb2.SpanEnd{
+					Error: pbErr,
+					Data: &tracepb2.SpanEnd_Auth{
+						Auth: &tracepb2.AuthSpanEnd{
+							ServiceName:  "service",
+							EndpointName: "endpoint",
+							Uid:          "userid",
+							UserData:     []byte("payload"),
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "PubsubMessageSpanStart",
+			Emit: func(l *trace2.Log) {
+				l.PubsubMessageSpanStart(&model.Request{
+					Type:         model.PubSubMessage,
+					TraceID:      traceID,
+					SpanID:       spanID,
+					ParentSpanID: model.SpanID{},
+					Start:        now,
+					Traced:       true,
+					DefLoc:       defLoc,
+					MsgData: &model.PubSubMsgData{
+						Service:      "service",
+						Topic:        "topic",
+						Subscription: "subscription",
+						MessageID:    "message-id",
+						Attempt:      3,
+						Published:    now,
+						Payload:      []byte("payload"),
+					},
+				}, goid)
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanStart{SpanStart: &tracepb2.SpanStart{
+					ParentTraceId:         nil,
+					ParentSpanId:          nil,
+					ExternalCorrelationId: nil,
+					DefLoc:                &udefLoc,
+					Goid:                  goid,
+					Data: &tracepb2.SpanStart_PubsubMessage{
+						PubsubMessage: &tracepb2.PubsubMessageSpanStart{
+							ServiceName:      "service",
+							TopicName:        "topic",
+							SubscriptionName: "subscription",
+							MessageId:        "message-id",
+							Attempt:          3,
+							PublishTime:      pbNow,
+							MessagePayload:   []byte("payload"),
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "PubsubMessageSpanEnd",
+			Emit: func(l *trace2.Log) {
+				l.PubsubMessageSpanEnd(trace2.PubsubMessageSpanEndParams{
+					EventParams: ep,
+					Req: &model.Request{
+						MsgData: &model.PubSubMsgData{
+							Service:      "service",
+							Topic:        "topic",
+							Subscription: "subscription",
+						},
+					},
+					Resp: &model.Response{Err: err},
+				})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEnd{SpanEnd: &tracepb2.SpanEnd{
+					Error: pbErr,
+					Data: &tracepb2.SpanEnd_PubsubMessage{
+						PubsubMessage: &tracepb2.PubsubMessageSpanEnd{
+							ServiceName:      "service",
+							TopicName:        "topic",
+							SubscriptionName: "subscription",
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "RPCCallStart",
+			Emit: func(l *trace2.Log) {
+				l.RPCCallStart(&model.APICall{
+					Source:             &model.Request{TraceID: traceID, SpanID: spanID},
+					TargetServiceName:  "service",
+					TargetEndpointName: "endpoint",
+					DefLoc:             defLoc,
+					StartEventID:       0,
+				}, goid)
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:   goid,
+					DefLoc: &udefLoc,
+					Data: &tracepb2.SpanEvent_RpcCallStart{
+						RpcCallStart: &tracepb2.RPCCallStart{
+							TargetServiceName:  "service",
+							TargetEndpointName: "endpoint",
+							Stack:              nil,
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "RPCCallEnd",
+			Emit: func(l *trace2.Log) {
+				l.RPCCallEnd(&model.APICall{
+					Source:       &model.Request{TraceID: traceID, SpanID: spanID},
+					DefLoc:       defLoc,
+					StartEventID: 1,
+				}, goid, err)
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:               goid,
+					CorrelationEventId: ptr[uint64](1),
+					Data: &tracepb2.SpanEvent_RpcCallEnd{
+						RpcCallEnd: &tracepb2.RPCCallEnd{
+							Err: pbErr,
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "DBQueryStart",
+			Emit: func(l *trace2.Log) {
+				l.DBQueryStart(trace2.DBQueryStartParams{
+					EventParams: ep,
+					TxStartID:   1,
+					Query:       "query",
+				})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:               goid,
+					DefLoc:             &udefLoc,
+					CorrelationEventId: ptr[uint64](1),
+					Data: &tracepb2.SpanEvent_DbQueryStart{
+						DbQueryStart: &tracepb2.DBQueryStart{
+							Query: "query",
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "DBQueryEnd",
+			Emit: func(l *trace2.Log) {
+				l.DBQueryEnd(ep, 1, err)
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:               goid,
+					DefLoc:             &udefLoc,
+					CorrelationEventId: ptr[uint64](1),
+					Data: &tracepb2.SpanEvent_DbQueryEnd{
+						DbQueryEnd: &tracepb2.DBQueryEnd{
+							Err: pbErr,
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "DBTransactionStart",
+			Emit: func(l *trace2.Log) {
+				l.DBTransactionStart(ep, stack.Stack{})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:   goid,
+					DefLoc: &udefLoc,
+					Data: &tracepb2.SpanEvent_DbTransactionStart{
+						DbTransactionStart: &tracepb2.DBTransactionStart{},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "DBTransactionEnd",
+			Emit: func(l *trace2.Log) {
+				l.DBTransactionEnd(trace2.DBTransactionEndParams{
+					EventParams: ep,
+					StartID:     1,
+					Commit:      true,
+					Err:         err,
+					Stack:       stack.Stack{},
+				})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:               goid,
+					DefLoc:             &udefLoc,
+					CorrelationEventId: ptr[uint64](1),
+					Data: &tracepb2.SpanEvent_DbTransactionEnd{
+						DbTransactionEnd: &tracepb2.DBTransactionEnd{
+							Completion: tracepb2.DBTransactionEnd_COMMIT,
+							Err:        pbErr,
+							Stack:      nil,
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "PubsubPublishStart",
+			Emit: func(l *trace2.Log) {
+				l.PubsubPublishStart(trace2.PubsubPublishStartParams{
+					EventParams: ep,
+					Topic:       "topic",
+					Message:     []byte("message"),
+					Stack:       stack.Stack{},
+				})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:   goid,
+					DefLoc: &udefLoc,
+					Data: &tracepb2.SpanEvent_PubsubPublishStart{
+						PubsubPublishStart: &tracepb2.PubsubPublishStart{
+							Topic:   "topic",
+							Message: []byte("message"),
+							Stack:   nil,
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "PubsubPublishEnd",
+			Emit: func(l *trace2.Log) {
+				l.PubsubPublishEnd(trace2.PubsubPublishEndParams{
+					EventParams: ep,
+					StartID:     1,
+					MessageID:   "message-id",
+					Err:         err,
+				})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:               goid,
+					DefLoc:             &udefLoc,
+					CorrelationEventId: ptr[uint64](1),
+					Data: &tracepb2.SpanEvent_PubsubPublishEnd{
+						PubsubPublishEnd: &tracepb2.PubsubPublishEnd{
+							MessageId: ptr("message-id"),
+							Err:       pbErr,
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "ServiceInitStart",
+			Emit: func(l *trace2.Log) {
+				l.ServiceInitStart(trace2.ServiceInitStartParams{
+					EventParams: ep,
+					Service:     "service",
+				})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:   goid,
+					DefLoc: &udefLoc,
+					Data: &tracepb2.SpanEvent_ServiceInitStart{
+						ServiceInitStart: &tracepb2.ServiceInitStart{
+							Service: "service",
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "ServiceInitEnd",
+			Emit: func(l *trace2.Log) {
+				l.ServiceInitEnd(ep, 1, err)
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:               goid,
+					DefLoc:             &udefLoc,
+					CorrelationEventId: ptr[uint64](1),
+					Data: &tracepb2.SpanEvent_ServiceInitEnd{
+						ServiceInitEnd: &tracepb2.ServiceInitEnd{
+							Err: pbErr,
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "CacheCallStart",
+			Emit: func(l *trace2.Log) {
+				l.CacheCallStart(trace2.CacheCallStartParams{
+					EventParams: ep,
+					Operation:   "operation",
+					IsWrite:     true,
+					Keys:        []string{"one", "two"},
+					Stack:       stack.Stack{},
+				})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:   goid,
+					DefLoc: &udefLoc,
+					Data: &tracepb2.SpanEvent_CacheCallStart{
+						CacheCallStart: &tracepb2.CacheCallStart{
+							Operation: "operation",
+							Write:     true,
+							Keys:      []string{"one", "two"},
+							Stack:     nil,
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "CacheCallEnd",
+			Emit: func(l *trace2.Log) {
+				l.CacheCallEnd(trace2.CacheCallEndParams{
+					EventParams: ep,
+					StartID:     1,
+					Res:         trace2.CacheErr,
+					Err:         err,
+				})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:               goid,
+					DefLoc:             &udefLoc,
+					CorrelationEventId: ptr[uint64](1),
+					Data: &tracepb2.SpanEvent_CacheCallEnd{
+						CacheCallEnd: &tracepb2.CacheCallEnd{
+							Result: tracepb2.CacheCallEnd_ERR,
+							Err:    pbErr,
+						},
+					},
+				}},
+			},
+		},
+
+		{
+			Name: "LogMessage",
+			Emit: func(l *trace2.Log) {
+				l.LogMessage(trace2.LogMessageParams{
+					EventParams: ep,
+					Level:       model.LevelWarn,
+					Msg:         "message",
+					Stack:       stack.Stack{},
+					Fields: []trace2.LogField{
+						{Key: "error", Value: err},
+						{Key: "string", Value: "string"},
+						{Key: "bool", Value: true},
+						{Key: "time", Value: now},
+						{Key: "duration", Value: time.Second},
+						{Key: "uuid", Value: uuidVal},
+						{Key: "json", Value: map[string]any{"json": true}},
+						{Key: "json_err", Value: func() {}},
+						{Key: "int8", Value: int8(-8)},
+						{Key: "int16", Value: int16(-16)},
+						{Key: "int32", Value: int32(-32)},
+						{Key: "int64", Value: int64(-64)},
+						{Key: "int", Value: int(-1)},
+						{Key: "uint8", Value: uint8(8)},
+						{Key: "uint16", Value: uint16(16)},
+						{Key: "uint32", Value: uint32(32)},
+						{Key: "uint64", Value: uint64(64)},
+						{Key: "uint", Value: uint(1)},
+						{Key: "float32", Value: float32(1.2)},
+						{Key: "float64", Value: float64(3.4)},
+					},
+				})
+			},
+			Want: &tracepb2.TraceEvent{
+				TraceId: pbTraceID,
+				SpanId:  pbSpanID,
+				Event: &tracepb2.TraceEvent_SpanEvent{SpanEvent: &tracepb2.SpanEvent{
+					Goid:   goid,
+					DefLoc: &udefLoc,
+					Data: &tracepb2.SpanEvent_LogMessage{
+						LogMessage: &tracepb2.LogMessage{
+							Level: tracepb2.LogMessage_WARN,
+							Msg:   "message",
+							Stack: nil,
+							Fields: []*tracepb2.LogField{
+								{Key: "error", Value: &tracepb2.LogField_Error{Error: pbErr}},
+								{Key: "string", Value: &tracepb2.LogField_Str{Str: "string"}},
+								{Key: "bool", Value: &tracepb2.LogField_Bool{Bool: true}},
+								{Key: "time", Value: &tracepb2.LogField_Time{Time: pbNow}},
+								{Key: "duration", Value: &tracepb2.LogField_Dur{Dur: int64(time.Second)}},
+								{Key: "uuid", Value: &tracepb2.LogField_Uuid{Uuid: pbUUID}},
+								{Key: "json", Value: &tracepb2.LogField_Json{Json: []byte(`{"json":true}`)}},
+								{Key: "json_err", Value: &tracepb2.LogField_Error{Error: &tracepb2.Error{Msg: "json: unsupported type: func()"}}},
+								{Key: "int8", Value: &tracepb2.LogField_Int{Int: -8}},
+								{Key: "int16", Value: &tracepb2.LogField_Int{Int: -16}},
+								{Key: "int32", Value: &tracepb2.LogField_Int{Int: -32}},
+								{Key: "int64", Value: &tracepb2.LogField_Int{Int: -64}},
+								{Key: "int", Value: &tracepb2.LogField_Int{Int: -1}},
+								{Key: "uint8", Value: &tracepb2.LogField_Uint{Uint: 8}},
+								{Key: "uint16", Value: &tracepb2.LogField_Uint{Uint: 16}},
+								{Key: "uint32", Value: &tracepb2.LogField_Uint{Uint: 32}},
+								{Key: "uint64", Value: &tracepb2.LogField_Uint{Uint: 64}},
+								{Key: "uint", Value: &tracepb2.LogField_Uint{Uint: 1}},
+								{Key: "float32", Value: &tracepb2.LogField_Float32{Float32: 1.2}},
+								{Key: "float64", Value: &tracepb2.LogField_Float64{Float64: 3.4}},
+							},
+						},
+					},
+				}},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.Name, func(t *testing.T) {
+			log := trace2.NewLog()
+			tt.Emit(log)
+			data, _ := log.GetAndClear()
+			ta := trace2.NewTimeAnchor(0, now)
+			got, err := ParseEvent(bufio.NewReader(bytes.NewReader(data)), ta, 99)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			opt := []cmp.Option{
+				protocmp.Transform(),
+				protocmp.IgnoreFields(&tracepb2.TraceEvent{}, "event_time"),
+				protocmp.IgnoreFields(&tracepb2.TraceEvent{}, "event_id"),
+				protocmp.IgnoreMessages(&tracepb2.StackTrace{}),
+			}
+			if diff := cmp.Diff(tt.Want, got, opt...); diff != "" {
+				t.Errorf("ParseEvent() mismatch (-want +got):\n%s", diff)
+			}
+		})
+	}
+}
+
+func ptr[T any](val T) *T {
+	return &val
+}
diff --git a/pkg/vcs/app.go b/pkg/vcs/app.go
new file mode 100644
index 0000000000..10542cb70d
--- /dev/null
+++ b/pkg/vcs/app.go
@@ -0,0 +1,32 @@
+package vcs
+
+import (
+	"github.com/rs/zerolog/log"
+)
+
+// GetRevision returns the version control system (VCS) revision information for the Encore application.
+//
+// If there is an error getting the revision information, no revision information is returned and the App is flagged as
+// having uncommitted files. This will happen most likely because no supported VCS system can be found.
+//
+// Supported VCS systems include;
+//  - Hg
+//  - Git
+//  - Svn
+//  - Bzr
+//  - Fossil
+func GetRevision(appRoot string) Status {
+	appRoot, cmd, err := fromDir(appRoot, "", false)
+	if err != nil {
+		log.Err(err).Str("app", appRoot).Msg("unable to determine VCS system")
+		return Status{Uncommitted: true}
+	}
+
+	status, err := cmd.Status(cmd, appRoot)
+	if err != nil {
+		log.Err(err).Str("app", appRoot).Msg("unable to get VCS status")
+		return Status{Uncommitted: true}
+	}
+
+	return status
+}
diff --git a/pkg/vcs/vcs.go b/pkg/vcs/vcs.go
new file mode 100644
index 0000000000..20251a466d
--- /dev/null
+++ b/pkg/vcs/vcs.go
@@ -0,0 +1,818 @@
+// Simplified version of the version from Go Get:
+// https://github.com/golang/go/blob/f87e28d1b9ab33491b32255f333f1f1d83eeb6fc/src/cmd/go/internal/vcs/vcs.go
+// Copyright 2012 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package vcs
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"io/fs"
+	urlpkg "net/url"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// A cmd describes how to use a version control system
+// like Mercurial, Git, or Subversion.
+type cmd struct {
+	Name      string
+	Cmd       string   // name of binary to invoke command
+	RootNames []string // filename indicating the root of a checkout directory
+
+	CreateCmd   []string // commands to download a fresh copy of a repository
+	DownloadCmd []string // commands to download updates into an existing repository
+
+	TagCmd         []tagCmd // commands to list tags
+	TagLookupCmd   []tagCmd // commands to lookup tags before running tagSyncCmd
+	TagSyncCmd     []string // commands to sync to specific tag
+	TagSyncDefault []string // commands to sync to default tag
+
+	Scheme  []string
+	PingCmd string
+
+	RemoteRepo  func(v *cmd, rootDir string) (remoteRepo string, err error)
+	ResolveRepo func(v *cmd, rootDir, remoteRepo string) (realRepo string, err error)
+	Status      func(v *cmd, rootDir string) (Status, error)
+}
+
+// Status is the current state of a local repository.
+type Status struct {
+	Revision    string    // Optional.
+	CommitTime  time.Time // Optional.
+	Uncommitted bool      // Required.
+}
+
+var defaultSecureScheme = map[string]bool{
+	"https":   true,
+	"git+ssh": true,
+	"bzr+ssh": true,
+	"svn+ssh": true,
+	"ssh":     true,
+}
+
+func (v *cmd) IsSecure(repo string) bool {
+	u, err := urlpkg.Parse(repo)
+	if err != nil {
+		// If repo is not a URL, it's not secure.
+		return false
+	}
+	return v.isSecureScheme(u.Scheme)
+}
+
+func (v *cmd) isSecureScheme(scheme string) bool {
+	switch v.Cmd {
+	case "git":
+		// GIT_ALLOW_PROTOCOL is an environment variable defined by Git. It is a
+		// colon-separated list of schemes that are allowed to be used with git
+		// fetch/clone. Any scheme not mentioned will be considered insecure.
+		if allow := os.Getenv("GIT_ALLOW_PROTOCOL"); allow != "" {
+			for _, s := range strings.Split(allow, ":") {
+				if s == scheme {
+					return true
+				}
+			}
+			return false
+		}
+	}
+	return defaultSecureScheme[scheme]
+}
+
+// A tagCmd describes a command to list available tags
+// that can be passed to tagSyncCmd.
+type tagCmd struct {
+	cmd     string // command to list tags
+	pattern string // regexp to extract tags from list
+}
+
+// vcsList lists the known version control systems
+var vcsList = []*cmd{
+	vcsHg,
+	vcsGit,
+	vcsSvn,
+	vcsBzr,
+	vcsFossil,
+}
+
+// vcsHg describes how to use Mercurial.
+var vcsHg = &cmd{
+	Name:      "Mercurial",
+	Cmd:       "hg",
+	RootNames: []string{".hg"},
+
+	CreateCmd:   []string{"clone -U -- {repo} {dir}"},
+	DownloadCmd: []string{"pull"},
+
+	// We allow both tag and branch names as 'tags'
+	// for selecting a version. This lets people have
+	// a go.release.r60 branch and a go1 branch
+	// and make changes in both, without constantly
+	// editing .hgtags.
+	TagCmd: []tagCmd{
+		{"tags", `^(\S+)`},
+		{"branches", `^(\S+)`},
+	},
+	TagSyncCmd:     []string{"update -r {tag}"},
+	TagSyncDefault: []string{"update default"},
+
+	Scheme:     []string{"https", "http", "ssh"},
+	PingCmd:    "identify -- {scheme}://{repo}",
+	RemoteRepo: hgRemoteRepo,
+	Status:     hgStatus,
+}
+
+func hgRemoteRepo(vcsHg *cmd, rootDir string) (remoteRepo string, err error) {
+	out, err := vcsHg.runOutput(rootDir, "paths default")
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(out)), nil
+}
+
+func hgStatus(vcsHg *cmd, rootDir string) (Status, error) {
+	// Output changeset ID and seconds since epoch.
+	out, err := vcsHg.runOutputVerboseOnly(rootDir, `log -l1 -T {node}:{date|hgdate}`)
+	if err != nil {
+		return Status{}, err
+	}
+
+	// Successful execution without output indicates an empty repo (no commits).
+	var rev string
+	var commitTime time.Time
+	if len(out) > 0 {
+		// Strip trailing timezone offset.
+		if i := bytes.IndexByte(out, ' '); i > 0 {
+			out = out[:i]
+		}
+		rev, commitTime, err = parseRevTime(out)
+		if err != nil {
+			return Status{}, err
+		}
+	}
+
+	// Also look for untracked files.
+	out, err = vcsHg.runOutputVerboseOnly(rootDir, "status")
+	if err != nil {
+		return Status{}, err
+	}
+	uncommitted := len(out) > 0
+
+	return Status{
+		Revision:    rev,
+		CommitTime:  commitTime,
+		Uncommitted: uncommitted,
+	}, nil
+}
+
+// parseRevTime parses commit details in "revision:seconds" format.
+func parseRevTime(out []byte) (string, time.Time, error) {
+	buf := string(bytes.TrimSpace(out))
+
+	i := strings.IndexByte(buf, ':')
+	if i < 1 {
+		return "", time.Time{}, errors.New("unrecognized VCS tool output")
+	}
+	rev := buf[:i]
+
+	secs, err := strconv.ParseInt(string(buf[i+1:]), 10, 64)
+	if err != nil {
+		return "", time.Time{}, fmt.Errorf("unrecognized VCS tool output: %v", err)
+	}
+
+	return rev, time.Unix(secs, 0), nil
+}
+
+// vcsGit describes how to use Git.
+var vcsGit = &cmd{
+	Name:      "Git",
+	Cmd:       "git",
+	RootNames: []string{".git"},
+
+	CreateCmd:   []string{"clone -- {repo} {dir}", "-go-internal-cd {dir} submodule update --init --recursive"},
+	DownloadCmd: []string{"pull --ff-only", "submodule update --init --recursive"},
+
+	TagCmd: []tagCmd{
+		// tags/xxx matches a git tag named xxx
+		// origin/xxx matches a git branch named xxx on the default remote repository
+		{"show-ref", `(?:tags|origin)/(\S+)$`},
+	},
+	TagLookupCmd: []tagCmd{
+		{"show-ref tags/{tag} origin/{tag}", `((?:tags|origin)/\S+)$`},
+	},
+	TagSyncCmd: []string{"checkout {tag}", "submodule update --init --recursive"},
+	// both createCmd and downloadCmd update the working dir.
+	// No need to do more here. We used to 'checkout master'
+	// but that doesn't work if the default branch is not named master.
+	// DO NOT add 'checkout master' here.
+	// See golang.org/issue/9032.
+	TagSyncDefault: []string{"submodule update --init --recursive"},
+
+	Scheme: []string{"git", "https", "http", "git+ssh", "ssh"},
+
+	// Leave out the '--' separator in the ls-remote command: git 2.7.4 does not
+	// support such a separator for that command, and this use should be safe
+	// without it because the {scheme} value comes from the predefined list above.
+	// See golang.org/issue/33836.
+	PingCmd: "ls-remote {scheme}://{repo}",
+
+	RemoteRepo: gitRemoteRepo,
+	Status:     gitStatus,
+}
+
+// scpSyntaxRe matches the SCP-like addresses used by Git to access
+// repositories by SSH.
+var scpSyntaxRe = regexp.MustCompile(`^([a-zA-Z0-9_]+)@([a-zA-Z0-9._-]+):(.*)$`)
+
+func gitRemoteRepo(vcsGit *cmd, rootDir string) (remoteRepo string, err error) {
+	cmd := "config remote.origin.url"
+	errParse := errors.New("unable to parse output of git " + cmd)
+	errRemoteOriginNotFound := errors.New("remote origin not found")
+	outb, err := vcsGit.run1(rootDir, cmd, nil, false)
+	if err != nil {
+		// if it doesn't output any message, it means the config argument is correct,
+		// but the config value itself doesn't exist
+		if outb != nil && len(outb) == 0 {
+			return "", errRemoteOriginNotFound
+		}
+		return "", err
+	}
+	out := strings.TrimSpace(string(outb))
+
+	var repoURL *urlpkg.URL
+	if m := scpSyntaxRe.FindStringSubmatch(out); m != nil {
+		// Match SCP-like syntax and convert it to a URL.
+		// Eg, "git@github.com:user/repo" becomes
+		// "ssh://git@github.com/user/repo".
+		repoURL = &urlpkg.URL{
+			Scheme: "ssh",
+			User:   urlpkg.User(m[1]),
+			Host:   m[2],
+			Path:   m[3],
+		}
+	} else {
+		repoURL, err = urlpkg.Parse(out)
+		if err != nil {
+			return "", err
+		}
+	}
+
+	// Iterate over insecure schemes too, because this function simply
+	// reports the state of the repo. If we can't see insecure schemes then
+	// we can't report the actual repo URL.
+	for _, s := range vcsGit.Scheme {
+		if repoURL.Scheme == s {
+			return repoURL.String(), nil
+		}
+	}
+	return "", errParse
+}
+
+func gitStatus(vcsGit *cmd, rootDir string) (Status, error) {
+	out, err := vcsGit.runOutputVerboseOnly(rootDir, "status --porcelain")
+	if err != nil {
+		return Status{}, err
+	}
+	uncommitted := len(out) > 0
+
+	// "git status" works for empty repositories, but "git show" does not.
+	// Assume there are no commits in the repo when "git show" fails with
+	// uncommitted files and skip tagging revision / committime.
+	var rev string
+	var commitTime time.Time
+	out, err = vcsGit.runOutputVerboseOnly(rootDir, "-c log.showsignature=false show -s --format=%H:%ct")
+	if err != nil && !uncommitted {
+		return Status{}, err
+	} else if err == nil {
+		rev, commitTime, err = parseRevTime(out)
+		if err != nil {
+			return Status{}, err
+		}
+	}
+
+	return Status{
+		Revision:    rev,
+		CommitTime:  commitTime,
+		Uncommitted: uncommitted,
+	}, nil
+}
+
+// vcsBzr describes how to use Bazaar.
+var vcsBzr = &cmd{
+	Name:      "Bazaar",
+	Cmd:       "bzr",
+	RootNames: []string{".bzr"},
+
+	CreateCmd: []string{"branch -- {repo} {dir}"},
+
+	// Without --overwrite bzr will not pull tags that changed.
+	// Replace by --overwrite-tags after http://pad.lv/681792 goes in.
+	DownloadCmd: []string{"pull --overwrite"},
+
+	TagCmd:         []tagCmd{{"tags", `^(\S+)`}},
+	TagSyncCmd:     []string{"update -r {tag}"},
+	TagSyncDefault: []string{"update -r revno:-1"},
+
+	Scheme:      []string{"https", "http", "bzr", "bzr+ssh"},
+	PingCmd:     "info -- {scheme}://{repo}",
+	RemoteRepo:  bzrRemoteRepo,
+	ResolveRepo: bzrResolveRepo,
+	Status:      bzrStatus,
+}
+
+func bzrRemoteRepo(vcsBzr *cmd, rootDir string) (remoteRepo string, err error) {
+	outb, err := vcsBzr.runOutput(rootDir, "config parent_location")
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(outb)), nil
+}
+
+func bzrResolveRepo(vcsBzr *cmd, rootDir, remoteRepo string) (realRepo string, err error) {
+	outb, err := vcsBzr.runOutput(rootDir, "info "+remoteRepo)
+	if err != nil {
+		return "", err
+	}
+	out := string(outb)
+
+	// Expect:
+	// ...
+	//   (branch root|repository branch): <URL>
+	// ...
+
+	found := false
+	for _, prefix := range []string{"\n  branch root: ", "\n  repository branch: "} {
+		i := strings.Index(out, prefix)
+		if i >= 0 {
+			out = out[i+len(prefix):]
+			found = true
+			break
+		}
+	}
+	if !found {
+		return "", fmt.Errorf("unable to parse output of bzr info")
+	}
+
+	i := strings.Index(out, "\n")
+	if i < 0 {
+		return "", fmt.Errorf("unable to parse output of bzr info")
+	}
+	out = out[:i]
+	return strings.TrimSpace(out), nil
+}
+
+func bzrStatus(vcsBzr *cmd, rootDir string) (Status, error) {
+	outb, err := vcsBzr.runOutputVerboseOnly(rootDir, "version-info")
+	if err != nil {
+		return Status{}, err
+	}
+	out := string(outb)
+
+	// Expect (non-empty repositories only):
+	//
+	// revision-id: gopher@gopher.net-20211021072330-qshok76wfypw9lpm
+	// date: 2021-09-21 12:00:00 +1000
+	// ...
+	var rev string
+	var commitTime time.Time
+
+	for _, line := range strings.Split(out, "\n") {
+		i := strings.IndexByte(line, ':')
+		if i < 0 {
+			continue
+		}
+		key := line[:i]
+		value := strings.TrimSpace(line[i+1:])
+
+		switch key {
+		case "revision-id":
+			rev = value
+		case "date":
+			var err error
+			commitTime, err = time.Parse("2006-01-02 15:04:05 -0700", value)
+			if err != nil {
+				return Status{}, errors.New("unable to parse output of bzr version-info")
+			}
+		}
+	}
+
+	outb, err = vcsBzr.runOutputVerboseOnly(rootDir, "status")
+	if err != nil {
+		return Status{}, err
+	}
+
+	// Skip warning when working directory is set to an older revision.
+	if bytes.HasPrefix(outb, []byte("working tree is out of date")) {
+		i := bytes.IndexByte(outb, '\n')
+		if i < 0 {
+			i = len(outb)
+		}
+		outb = outb[:i]
+	}
+	uncommitted := len(outb) > 0
+
+	return Status{
+		Revision:    rev,
+		CommitTime:  commitTime,
+		Uncommitted: uncommitted,
+	}, nil
+}
+
+// vcsSvn describes how to use Subversion.
+var vcsSvn = &cmd{
+	Name:      "Subversion",
+	Cmd:       "svn",
+	RootNames: []string{".svn"},
+
+	CreateCmd:   []string{"checkout -- {repo} {dir}"},
+	DownloadCmd: []string{"update"},
+
+	// There is no tag command in subversion.
+	// The branch information is all in the path names.
+
+	Scheme:     []string{"https", "http", "svn", "svn+ssh"},
+	PingCmd:    "info -- {scheme}://{repo}",
+	RemoteRepo: svnRemoteRepo,
+}
+
+func svnRemoteRepo(vcsSvn *cmd, rootDir string) (remoteRepo string, err error) {
+	outb, err := vcsSvn.runOutput(rootDir, "info")
+	if err != nil {
+		return "", err
+	}
+	out := string(outb)
+
+	// Expect:
+	//
+	//	 ...
+	// 	URL: <URL>
+	// 	...
+	//
+	// Note that we're not using the Repository Root line,
+	// because svn allows checking out subtrees.
+	// The URL will be the URL of the subtree (what we used with 'svn co')
+	// while the Repository Root may be a much higher parent.
+	i := strings.Index(out, "\nURL: ")
+	if i < 0 {
+		return "", fmt.Errorf("unable to parse output of svn info")
+	}
+	out = out[i+len("\nURL: "):]
+	i = strings.Index(out, "\n")
+	if i < 0 {
+		return "", fmt.Errorf("unable to parse output of svn info")
+	}
+	out = out[:i]
+	return strings.TrimSpace(out), nil
+}
+
+// fossilRepoName is the name go get associates with a fossil repository. In the
+// real world the file can be named anything.
+const fossilRepoName = ".fossil"
+
+// vcsFossil describes how to use Fossil (fossil-scm.org)
+var vcsFossil = &cmd{
+	Name:      "Fossil",
+	Cmd:       "fossil",
+	RootNames: []string{".fslckout", "_FOSSIL_"},
+
+	CreateCmd:   []string{"-go-internal-mkdir {dir} clone -- {repo} " + filepath.Join("{dir}", fossilRepoName), "-go-internal-cd {dir} open .fossil"},
+	DownloadCmd: []string{"up"},
+
+	TagCmd:         []tagCmd{{"tag ls", `(.*)`}},
+	TagSyncCmd:     []string{"up tag:{tag}"},
+	TagSyncDefault: []string{"up trunk"},
+
+	Scheme:     []string{"https", "http"},
+	RemoteRepo: fossilRemoteRepo,
+	Status:     fossilStatus,
+}
+
+func fossilRemoteRepo(vcsFossil *cmd, rootDir string) (remoteRepo string, err error) {
+	out, err := vcsFossil.runOutput(rootDir, "remote-url")
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(out)), nil
+}
+
+var errFossilInfo = errors.New("unable to parse output of fossil info")
+
+func fossilStatus(vcsFossil *cmd, rootDir string) (Status, error) {
+	outb, err := vcsFossil.runOutputVerboseOnly(rootDir, "info")
+	if err != nil {
+		return Status{}, err
+	}
+	out := string(outb)
+
+	// Expect:
+	// ...
+	// checkout:     91ed71f22c77be0c3e250920f47bfd4e1f9024d2 2021-09-21 12:00:00 UTC
+	// ...
+
+	// Extract revision and commit time.
+	// Ensure line ends with UTC (known timezone offset).
+	const prefix = "\ncheckout:"
+	const suffix = " UTC"
+	i := strings.Index(out, prefix)
+	if i < 0 {
+		return Status{}, errFossilInfo
+	}
+	checkout := out[i+len(prefix):]
+	i = strings.Index(checkout, suffix)
+	if i < 0 {
+		return Status{}, errFossilInfo
+	}
+	checkout = strings.TrimSpace(checkout[:i])
+
+	i = strings.IndexByte(checkout, ' ')
+	if i < 0 {
+		return Status{}, errFossilInfo
+	}
+	rev := checkout[:i]
+
+	commitTime, err := time.ParseInLocation("2006-01-02 15:04:05", checkout[i+1:], time.UTC)
+	if err != nil {
+		return Status{}, fmt.Errorf("%v: %v", errFossilInfo, err)
+	}
+
+	// Also look for untracked changes.
+	outb, err = vcsFossil.runOutputVerboseOnly(rootDir, "changes --differ")
+	if err != nil {
+		return Status{}, err
+	}
+	uncommitted := len(outb) > 0
+
+	return Status{
+		Revision:    rev,
+		CommitTime:  commitTime,
+		Uncommitted: uncommitted,
+	}, nil
+}
+
+func (v *cmd) String() string {
+	return v.Name
+}
+
+// run runs the command line cmd in the given directory.
+// keyval is a list of key, value pairs. run expands
+// instances of {key} in cmd into value, but only after
+// splitting cmd into individual arguments.
+// If an error occurs, run prints the command line and the
+// command's combined stdout+stderr to standard error.
+// Otherwise run discards the command's output.
+func (v *cmd) run(dir string, cmd string, keyval ...string) error {
+	_, err := v.run1(dir, cmd, keyval, true)
+	return err
+}
+
+// runVerboseOnly is like run but only generates error output to standard error in verbose mode.
+func (v *cmd) runVerboseOnly(dir string, cmd string, keyval ...string) error {
+	_, err := v.run1(dir, cmd, keyval, false)
+	return err
+}
+
+// runOutput is like run but returns the output of the command.
+func (v *cmd) runOutput(dir string, cmd string, keyval ...string) ([]byte, error) {
+	return v.run1(dir, cmd, keyval, true)
+}
+
+// runOutputVerboseOnly is like runOutput but only generates error output to
+// standard error in verbose mode.
+func (v *cmd) runOutputVerboseOnly(dir string, cmd string, keyval ...string) ([]byte, error) {
+	return v.run1(dir, cmd, keyval, false)
+}
+
+// run1 is the generalized implementation of run and runOutput.
+func (v *cmd) run1(dir string, cmdline string, keyval []string, verbose bool) ([]byte, error) {
+	m := make(map[string]string)
+	for i := 0; i < len(keyval); i += 2 {
+		m[keyval[i]] = keyval[i+1]
+	}
+	args := strings.Fields(cmdline)
+	for i, arg := range args {
+		args[i] = expand(m, arg)
+	}
+
+	if len(args) >= 2 && args[0] == "-go-internal-mkdir" {
+		var err error
+		if filepath.IsAbs(args[1]) {
+			err = os.Mkdir(args[1], fs.ModePerm)
+		} else {
+			err = os.Mkdir(filepath.Join(dir, args[1]), fs.ModePerm)
+		}
+		if err != nil {
+			return nil, err
+		}
+		args = args[2:]
+	}
+
+	if len(args) >= 2 && args[0] == "-go-internal-cd" {
+		if filepath.IsAbs(args[1]) {
+			dir = args[1]
+		} else {
+			dir = filepath.Join(dir, args[1])
+		}
+		args = args[2:]
+	}
+
+	_, err := exec.LookPath(v.Cmd)
+	if err != nil {
+		fmt.Fprintf(os.Stderr,
+			"go: missing %s command. See https://golang.org/s/gogetcmd\n",
+			v.Name)
+		return nil, err
+	}
+
+	cmd := exec.Command(v.Cmd, args...)
+	cmd.Dir = dir
+	out, err := cmd.Output()
+	if err != nil {
+		if verbose {
+			fmt.Fprintf(os.Stderr, "# cd %s; %s %s\n", dir, v.Cmd, strings.Join(args, " "))
+			if ee, ok := err.(*exec.ExitError); ok && len(ee.Stderr) > 0 {
+				os.Stderr.Write(ee.Stderr)
+			} else {
+				fmt.Fprintln(os.Stderr, err.Error())
+			}
+		}
+	}
+	return out, err
+}
+
+// Create creates a new copy of repo in dir.
+// The parent of dir must exist; dir must not.
+func (v *cmd) Create(dir, repo string) error {
+	for _, cmd := range v.CreateCmd {
+		if err := v.run(filepath.Dir(dir), cmd, "dir", dir, "repo", repo); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Download downloads any new changes for the repo in dir.
+func (v *cmd) Download(dir string) error {
+	for _, cmd := range v.DownloadCmd {
+		if err := v.run(dir, cmd); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Tags returns the list of available tags for the repo in dir.
+func (v *cmd) Tags(dir string) ([]string, error) {
+	var tags []string
+	for _, tc := range v.TagCmd {
+		out, err := v.runOutput(dir, tc.cmd)
+		if err != nil {
+			return nil, err
+		}
+		re := regexp.MustCompile(`(?m-s)` + tc.pattern)
+		for _, m := range re.FindAllStringSubmatch(string(out), -1) {
+			tags = append(tags, m[1])
+		}
+	}
+	return tags, nil
+}
+
+// TagSync syncs the repo in dir to the named tag,
+// which either is a tag returned by tags or is v.tagDefault.
+func (v *cmd) TagSync(dir, tag string) error {
+	if v.TagSyncCmd == nil {
+		return nil
+	}
+	if tag != "" {
+		for _, tc := range v.TagLookupCmd {
+			out, err := v.runOutput(dir, tc.cmd, "tag", tag)
+			if err != nil {
+				return err
+			}
+			re := regexp.MustCompile(`(?m-s)` + tc.pattern)
+			m := re.FindStringSubmatch(string(out))
+			if len(m) > 1 {
+				tag = m[1]
+				break
+			}
+		}
+	}
+
+	if tag == "" && v.TagSyncDefault != nil {
+		for _, cmd := range v.TagSyncDefault {
+			if err := v.run(dir, cmd); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+
+	for _, cmd := range v.TagSyncCmd {
+		if err := v.run(dir, cmd, "tag", tag); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// fromDir inspects dir and its parents to determine the
+// version control system and code repository to use.
+// If no repository is found, fromDir returns an error
+// equivalent to os.ErrNotExist.
+func fromDir(dir, srcRoot string, allowNesting bool) (repoDir string, vcsCmd *cmd, err error) {
+	// Clean and double-check that dir is in (a subdirectory of) srcRoot.
+	dir = filepath.Clean(dir)
+	if srcRoot != "" {
+		srcRoot = filepath.Clean(srcRoot)
+		if len(dir) <= len(srcRoot) || dir[len(srcRoot)] != filepath.Separator {
+			return "", nil, fmt.Errorf("directory %q is outside source root %q", dir, srcRoot)
+		}
+	}
+
+	origDir := dir
+	for len(dir) > len(srcRoot) {
+		for _, vcs := range vcsList {
+			if _, err := statAny(dir, vcs.RootNames); err == nil {
+				// Record first VCS we find.
+				// If allowNesting is false (as it is in GOPATH), keep looking for
+				// repositories in parent directories and report an error if one is
+				// found to mitigate VCS injection attacks.
+				if vcsCmd == nil {
+					vcsCmd = vcs
+					repoDir = dir
+					if allowNesting {
+						return repoDir, vcsCmd, nil
+					}
+					continue
+				}
+				// Allow .git inside .git, which can arise due to submodules.
+				if vcsCmd == vcs && vcs.Cmd == "git" {
+					continue
+				}
+				// Otherwise, we have one VCS inside a different VCS.
+				return "", nil, fmt.Errorf("directory %q uses %s, but parent %q uses %s",
+					repoDir, vcsCmd.Cmd, dir, vcs.Cmd)
+			}
+		}
+
+		// Move to parent.
+		ndir := filepath.Dir(dir)
+		if len(ndir) >= len(dir) {
+			break
+		}
+		dir = ndir
+	}
+	if vcsCmd == nil {
+		return "", nil, &vcsNotFoundError{dir: origDir}
+	}
+	return repoDir, vcsCmd, nil
+}
+
+// statAny provides FileInfo for the first filename found in the directory.
+// Otherwise, it returns the last error seen.
+func statAny(dir string, filenames []string) (os.FileInfo, error) {
+	if len(filenames) == 0 {
+		return nil, errors.New("invalid argument: no filenames provided")
+	}
+
+	var err error
+	var fi os.FileInfo
+	for _, name := range filenames {
+		fi, err = os.Stat(filepath.Join(dir, name))
+		if err == nil {
+			return fi, nil
+		}
+	}
+
+	return nil, err
+}
+
+type vcsNotFoundError struct {
+	dir string
+}
+
+func (e *vcsNotFoundError) Error() string {
+	return fmt.Sprintf("directory %q is not using a known version control system", e.dir)
+}
+
+func (e *vcsNotFoundError) Is(err error) bool {
+	return err == os.ErrNotExist
+}
+
+// expand rewrites s to replace {k} with match[k] for each key k in match.
+func expand(match map[string]string, s string) string {
+	// We want to replace each match exactly once, and the result of expansion
+	// must not depend on the iteration order through the map.
+	// A strings.Replacer has exactly the properties we're looking for.
+	oldNew := make([]string, 0, 2*len(match))
+	for k, v := range match {
+		oldNew = append(oldNew, "{"+k+"}", v)
+	}
+	return strings.NewReplacer(oldNew...).Replace(s)
+}
diff --git a/pkg/vfs/directory.go b/pkg/vfs/directory.go
new file mode 100644
index 0000000000..27b5e11d03
--- /dev/null
+++ b/pkg/vfs/directory.go
@@ -0,0 +1,150 @@
+package vfs
+
+import (
+	"errors"
+	"io"
+	"io/fs"
+	"sort"
+	"time"
+)
+
+type directoryContents struct {
+	node
+	childDirs map[string]*directoryContents
+	files     map[string]*fileContents
+}
+
+// Directory is a wrapper around directoryContents which stores the state
+// needed to implement ReadDirFile
+type Directory struct {
+	*directoryContents
+	readDirCount int
+	readEntries  []fs.DirEntry
+	closed       bool
+}
+
+var (
+	_ fs.FileInfo    = (*Directory)(nil)
+	_ fs.DirEntry    = (*Directory)(nil)
+	_ fs.ReadDirFile = (*Directory)(nil)
+)
+
+func newDirectoryContents(name string) *directoryContents {
+	return &directoryContents{
+		node: node{
+			name:    name,
+			parent:  nil,
+			modTime: time.Now(),
+		},
+		childDirs: make(map[string]*directoryContents),
+		files:     make(map[string]*fileContents),
+	}
+}
+
+func (d *Directory) createEntries() []fs.DirEntry {
+	rtn := make([]fs.DirEntry, 0, len(d.childDirs)+len(d.files))
+	for _, child := range d.childDirs {
+		rtn = append(rtn, &Directory{directoryContents: child})
+	}
+
+	for _, child := range d.files {
+		rtn = append(rtn, &File{fileContents: child})
+	}
+
+	sort.SliceStable(rtn, func(i, j int) bool {
+		return rtn[i].Name() < rtn[j].Name()
+	})
+	return rtn
+}
+
+// ReadDir reads the contents of the directory and returns
+// a slice of up to n DirEntry values in directory order.
+// Subsequent calls on the same file will yield further DirEntry values.
+//
+// If n > 0, ReadDir returns at most n DirEntry structures.
+// In this case, if ReadDir returns an empty slice, it will return
+// a non-nil error explaining why.
+// At the end of a directory, the error is io.EOF.
+//
+// If n <= 0, ReadDir returns all the DirEntry values from the directory
+// in a single slice. In this case, if ReadDir succeeds (reads all the way
+// to the end of the directory), it returns the slice and a nil error.
+// If it encounters an error before the end of the directory,
+// ReadDir returns the DirEntry list read until that point and a non-nil error.
+func (d *Directory) ReadDir(n int) ([]fs.DirEntry, error) {
+	if d.closed {
+		return nil, fs.ErrClosed
+	}
+
+	// Create the directory listing if it doesn't exist already
+	if d.readEntries == nil {
+		d.readEntries = d.createEntries()
+	}
+
+	// detect an EOF
+	if d.readDirCount == len(d.readEntries) {
+		if n <= 0 { // special case return
+			return nil, nil
+		}
+
+		return nil, io.EOF
+	}
+
+	// Create the return data with the number of requested entries
+	readNum := len(d.readEntries) - d.readDirCount
+	if readNum > n && n > 0 {
+		readNum = n
+	}
+	rtn := make([]fs.DirEntry, readNum)
+	for i := 0; i < readNum; i++ {
+		rtn[i] = d.readEntries[d.readDirCount]
+		d.readDirCount++
+	}
+
+	return rtn, nil
+}
+
+func (d *Directory) Read(_ []byte) (int, error) {
+	return 0, errors.New("cannot read directory")
+}
+
+func (d *Directory) Name() string {
+	return d.node.name
+}
+
+func (d *Directory) IsDir() bool {
+	return true
+}
+
+func (d *Directory) Type() fs.FileMode {
+	return fs.ModeDir
+}
+
+func (d *Directory) Info() (fs.FileInfo, error) {
+	return d, nil
+}
+
+func (d *Directory) Size() int64 {
+	return 0
+}
+
+func (d *Directory) Mode() fs.FileMode {
+	return d.Type()
+}
+
+func (d *Directory) ModTime() time.Time {
+	return d.node.modTime
+}
+
+func (d *Directory) Stat() (fs.FileInfo, error) {
+	return d.Info()
+}
+
+func (d *Directory) Close() error {
+	d.closed = true
+	return nil
+}
+
+func (d *Directory) Sys() any {
+	return nil
+}
diff --git a/pkg/vfs/doc.go b/pkg/vfs/doc.go
new file mode 100644
index 0000000000..c14b6b1f2f
--- /dev/null
+++ b/pkg/vfs/doc.go
@@ -0,0 +1,2 @@
+// Package vfs represents a virtual filesystem
+package vfs
diff --git a/pkg/vfs/file.go b/pkg/vfs/file.go
new file mode 100644
index 0000000000..d22cc411ce
--- /dev/null
+++ b/pkg/vfs/file.go
@@ -0,0 +1,84 @@
+package vfs
+
+import (
+	"io"
+	"io/fs"
+	"time"
+)
+
+type fileContents struct {
+	node
+	contents []byte
+}
+
+type File struct {
+	*fileContents
+	bytesRead int
+	closed    bool
+}
+
+var (
+	_ fs.File     = (*File)(nil)
+	_ fs.FileInfo = (*File)(nil)
+	_ fs.DirEntry = (*File)(nil)
+)
+
+func (f *File) Name() string {
+	return f.node.name
+}
+
+// Read implements io.Reader
+func (f *File) Read(bytes []byte) (int, error) {
+	if f.closed {
+		return 0, fs.ErrClosed
+	}
+
+	if f.bytesRead >= len(f.contents) {
+		return 0, io.EOF
+	}
+
+	bytesRead := copy(bytes, f.contents[f.bytesRead:])
+	f.bytesRead += bytesRead
+	if f.bytesRead >= len(f.contents) {
+		return bytesRead, io.EOF
+	}
+
+	return bytesRead, nil
+}
+
+func (f *File) Close() error {
+	f.closed = true
+	return nil
+}
+
+func (f *File) Size() int64 {
+	return int64(len(f.contents))
+}
+
+func (f *File) Mode() fs.FileMode {
+	return fs.ModePerm & 0444 // files in this file system are read only
+}
+
+func (f *File) ModTime() time.Time {
+	return f.node.modTime
+}
+
+func (f *File) IsDir() bool {
+	return false
+}
+
+func (f *File) Sys() any {
+	return nil
+}
+
+func (f *File) Type() fs.FileMode {
+	return f.Mode() & fs.ModeType
+}
+
+func (f *File) Info() (fs.FileInfo, error) {
+	return f, nil
+}
+
+func (f *File) Stat() (fs.FileInfo, error) {
+	return f, nil
+}
diff --git a/pkg/vfs/node.go b/pkg/vfs/node.go
new file mode 100644
index 0000000000..b2a26a620d
--- /dev/null
+++ b/pkg/vfs/node.go
@@ -0,0 +1,11 @@
+package vfs
+
+import (
+	"time"
+)
+
+type node struct {
+	name    string // The name of this node
+	parent  *directoryContents
+	modTime time.Time
+}
diff --git a/pkg/vfs/testdata/filteredglob/blahsvc/another.json b/pkg/vfs/testdata/filteredglob/blahsvc/another.json
new file mode 100644
index 0000000000..c353e67812
--- /dev/null
+++ b/pkg/vfs/testdata/filteredglob/blahsvc/another.json
@@ -0,0 +1,3 @@
+{
+  "foo": false
+}
diff --git a/pkg/vfs/testdata/filteredglob/blahsvc/test.json b/pkg/vfs/testdata/filteredglob/blahsvc/test.json
new file mode 100644
index 0000000000..ca66bccf04
--- /dev/null
+++ b/pkg/vfs/testdata/filteredglob/blahsvc/test.json
@@ -0,0 +1,3 @@
+{
+  "foo": "blah"
+}
diff --git a/pkg/vfs/testdata/filteredglob/foosystem/README.md b/pkg/vfs/testdata/filteredglob/foosystem/README.md
new file mode 100644
index 0000000000..58a70c1519
--- /dev/null
+++ b/pkg/vfs/testdata/filteredglob/foosystem/README.md
@@ -0,0 +1 @@
+This is a example file
diff --git a/pkg/vfs/testdata/filteredglob/foosystem/anotherservice/test.txt b/pkg/vfs/testdata/filteredglob/foosystem/anotherservice/test.txt
new file mode 100644
index 0000000000..9b24da92a9
--- /dev/null
+++ b/pkg/vfs/testdata/filteredglob/foosystem/anotherservice/test.txt
@@ -0,0 +1 @@
+another
diff --git a/pkg/vfs/testdata/filteredglob/foosystem/barservice/blah.json b/pkg/vfs/testdata/filteredglob/foosystem/barservice/blah.json
new file mode 100644
index 0000000000..c8c4105eb5
--- /dev/null
+++ b/pkg/vfs/testdata/filteredglob/foosystem/barservice/blah.json
@@ -0,0 +1,3 @@
+{
+  "foo": "bar"
+}
diff --git a/pkg/vfs/testdata/filteredglob/foosystem/barservice/test.txt b/pkg/vfs/testdata/filteredglob/foosystem/barservice/test.txt
new file mode 100644
index 0000000000..802992c422
--- /dev/null
+++ b/pkg/vfs/testdata/filteredglob/foosystem/barservice/test.txt
@@ -0,0 +1 @@
+Hello world
diff --git a/pkg/vfs/testdata/filteredglob/nope/ignored.txt b/pkg/vfs/testdata/filteredglob/nope/ignored.txt
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/pkg/vfs/utils.go b/pkg/vfs/utils.go
new file mode 100644
index 0000000000..ced987aa10
--- /dev/null
+++ b/pkg/vfs/utils.go
@@ -0,0 +1,53 @@
+package vfs
+
+import (
+	"io/fs"
+	"os"
+
+	"encr.dev/pkg/eerror"
+)
+
+// FromDir creates a Virtual File System (VFS) from the workingDir on the local computer
+//
+// Only files or folders which match the predicate will be added into the file system
+// A nil predicate will result in all files and folders being added into the file system
+func FromDir(workingDir string, predicate func(fileName string, info fs.DirEntry) bool) (*VFS, error) {
+	dirFS := os.DirFS(workingDir)
+	rtn := New()
+
+	if predicate == nil {
+		predicate = func(fileName string, info fs.DirEntry) bool { return true }
+	}
+
+	err := fs.WalkDir(dirFS, ".", func(path string, info fs.DirEntry, err error) error {
+		if err != nil {
+			return eerror.Wrap(err, "vfs", "error walking directory", map[string]any{"path": path})
+		}
+
+		if predicate(path, info) {
+			if info.IsDir() {
+				_ = rtn.AddDir(path)
+			} else {
+				bytes, err := fs.ReadFile(dirFS, path)
+				if err != nil {
+					return eerror.Wrap(err, "vfs", "error reading file", map[string]any{"path": path})
+				}
+
+				stat, err := fs.Stat(dirFS, path)
+				if err != nil {
+					return eerror.Wrap(err, "vfs", "error stat file", map[string]any{"path": path})
+				}
+
+				if _, err := rtn.AddFile(path, bytes, stat.ModTime()); err != nil {
+					return eerror.Wrap(err, "vfs", "unable to add file", map[string]any{"path": path})
+				}
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return rtn, nil
+}
diff --git a/pkg/vfs/vfs.go b/pkg/vfs/vfs.go
new file mode 100644
index 0000000000..bb443c8f68
--- /dev/null
+++ b/pkg/vfs/vfs.go
@@ -0,0 +1,225 @@
+package vfs
+
+import (
+	"errors"
+	"io/fs"
+	"path/filepath"
+	"strings"
+	"time"
+)
+
+type VFS struct {
+	root *directoryContents
+}
+
+var (
+	_ fs.FS         = (*VFS)(nil)
+	_ fs.ReadDirFS  = (*VFS)(nil)
+	_ fs.ReadFileFS = (*VFS)(nil)
+	_ fs.SubFS      = (*VFS)(nil)
+	_ fs.StatFS     = (*VFS)(nil)
+)
+
+func New() *VFS {
+	return &VFS{root: newDirectoryContents("")}
+}
+
+// Open opens the named file.
+//
+// When Open returns an error, it should be of type *PathError
+// with the Op field set to "open", the Path field set to name,
+// and the Err field describing the problem.
+//
+// Open should reject attempts to open names that do not satisfy
+// ValidPath(name), returning a *PathError with Err set to
+// ErrInvalid or ErrNotExist.
+func (v *VFS) Open(name string) (fs.File, error) {
+	if name == "." {
+		return &Directory{directoryContents: v.root}, nil
+	}
+
+	if !fs.ValidPath(name) {
+		return nil, &fs.PathError{
+			Op:   "open",
+			Path: name,
+			Err:  fs.ErrInvalid,
+		}
+	}
+
+	parts := strings.Split(name, "/")
+
+	pathTravelled := make([]string, 0, len(parts))
+	dir := v.root
+	pathTravelled = append(pathTravelled, dir.name)
+	if len(parts) > 1 {
+		for _, subDir := range parts[:len(parts)-1] {
+
+			pathTravelled = append(pathTravelled, subDir)
+			dir = dir.childDirs[subDir]
+			if dir == nil {
+				return nil, &fs.PathError{
+					Op:   "open",
+					Path: strings.Join(pathTravelled, "/"),
+					Err:  fs.ErrNotExist,
+				}
+			}
+		}
+	}
+
+	// Return the child
+	childName := parts[len(parts)-1]
+	if childFile, found := dir.files[childName]; found {
+		return &File{fileContents: childFile}, nil
+	}
+	if childDir, found := dir.childDirs[childName]; found {
+		return &Directory{directoryContents: childDir}, nil
+	}
+
+	return nil, &fs.PathError{
+		Op:   "open",
+		Path: strings.Join(pathTravelled, "/"),
+		Err:  fs.ErrNotExist,
+	}
+}
+
+// ReadDir reads the named directory
+// and returns a list of directory entries sorted by filename.
+func (v *VFS) ReadDir(name string) ([]fs.DirEntry, error) {
+	file, err := v.Open(name)
+	if err != nil {
+		return nil, &fs.PathError{
+			Op:   "ReadDir",
+			Path: name,
+			Err:  err,
+		}
+	}
+
+	switch file := file.(type) {
+	case *Directory:
+		return file.createEntries(), nil
+
+	default:
+		return nil, &fs.PathError{
+			Op:   "ReadDir",
+			Path: name,
+			Err:  errors.New("not a directory"),
+		}
+	}
+}
+
+// ReadFile reads the named file and returns its contents.
+// A successful call returns a nil error, not io.EOF.
+// (Because ReadFile reads the whole file, the expected EOF
+// from the final Read is not treated as an error to be reported.)
+//
+// The caller is permitted to modify the returned byte slice.
+// This method should return a copy of the underlying data.
+func (v *VFS) ReadFile(name string) ([]byte, error) {
+	file, err := v.Open(name)
+	if err != nil {
+		return nil, &fs.PathError{
+			Op:   "ReadFile",
+			Path: name,
+			Err:  err,
+		}
+	}
+
+	switch file := file.(type) {
+	case *File:
+		rtnBytes := make([]byte, len(file.contents))
+		copy(rtnBytes, file.contents)
+		return rtnBytes, nil
+
+	default:
+		return nil, &fs.PathError{
+			Op:   "ReadFile",
+			Path: name,
+			Err:  errors.New("not a file"),
+		}
+	}
+}
+
+// Sub returns an FS corresponding to the subtree rooted at dir.
+func (v *VFS) Sub(dir string) (fs.FS, error) {
+	file, err := v.Open(dir)
+	if err != nil {
+		return nil, &fs.PathError{
+			Op:   "Sub",
+			Path: dir,
+			Err:  err,
+		}
+	}
+
+	switch file := file.(type) {
+	case *Directory:
+		return &VFS{root: file.directoryContents}, nil
+
+	default:
+		return nil, &fs.PathError{
+			Op:   "Sub",
+			Path: dir,
+			Err:  errors.New("not a directory"),
+		}
+	}
+}
+
+// Stat returns a FileInfo describing the file.
+// If there is an error, it should be of type *PathError.
+func (v *VFS) Stat(name string) (fs.FileInfo, error) {
+	file, err := v.Open(name)
+	if err != nil {
+		return nil, &fs.PathError{
+			Op:   "Stat",
+			Path: name,
+			Err:  err,
+		}
+	}
+
+	return file.Stat()
+}
+
+// AddFile records a file into the VFS
+func (v *VFS) AddFile(path string, bytes []byte, time time.Time) (*fileContents, error) {
+	dirPath, filename := filepath.Split(path)
+	dir := v.AddDir(dirPath)
+	dir.files[filename] = &fileContents{
+		node: node{
+			name:    filename,
+			parent:  dir,
+			modTime: time,
+		},
+		contents: bytes,
+	}
+
+	return dir.files[filename], nil
+}
+
+// AddDir records a directory into the VFS.
+func (v *VFS) AddDir(dirPath string) *directoryContents {
+	dirParts := strings.Split(dirPath, "/")
+	dir := v.root
+	for _, dirPart := range dirParts {
+		if dirPart == "." || dirPart == "" {
+			continue
+		}
+
+		if dirPart == ".." {
+			if dir.node.parent == nil {
+				return nil
+			}
+
+			dir = dir.node.parent
+			continue
+		}
+
+		child := dir.childDirs[dirPart]
+		if child == nil {
+			child = newDirectoryContents(dirPart)
+			child.node.parent = dir
+			dir.childDirs[dirPart] = child
+		}
+		dir = child
+	}
+
+	return dir
+}
diff --git a/pkg/vfs/vfs_test.go b/pkg/vfs/vfs_test.go
new file mode 100644
index 0000000000..84d8322aee
--- /dev/null
+++ b/pkg/vfs/vfs_test.go
@@ -0,0 +1,43 @@
+package vfs
+
+import (
+	"io/fs"
+	"path/filepath"
+	"testing"
+	"testing/fstest"
+
+	qt "github.com/frankban/quicktest"
+)
+
+func TestFromDir(t *testing.T) {
+	c := qt.New(t)
+
+	dir, err := FromDir(
+		filepath.Join(".", "testdata", "filteredglob"),
+		func(file string, info fs.DirEntry) bool { return filepath.Ext(file) == ".json" },
+	)
+	c.Assert(err, qt.IsNil, qt.Commentf("error creating VFS"))
+
+	// Test that the VFS contains the expected number of files (no more no less)
+	fileCount := 0
+	dirCount := 0
+	err = fs.WalkDir(dir, ".", func(path string, info fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if !info.IsDir() {
+			fileCount++
+		} else {
+			dirCount++
+		}
+		return nil
+	})
+	c.Assert(err, qt.IsNil, qt.Commentf("error walking directory"))
+	c.Assert(fileCount, qt.Equals, 3, qt.Commentf("unexpected number of files"))
+	c.Assert(dirCount, qt.Equals, 4, qt.Commentf("unexpected number of directories"))
+
+	// Perform the standardised tests on the VFS implementation checking for the existence of the files we wanted
+	if err := fstest.TestFS(dir, "blahsvc/another.json", "blahsvc/test.json", "foosystem/barservice/blah.json"); err != nil {
+		t.Fatal(err)
+	}
+}
diff --git a/pkg/watcher/event.go b/pkg/watcher/event.go
new file mode 100644
index 0000000000..9c45dd370d
--- /dev/null
+++ b/pkg/watcher/event.go
@@ -0,0 +1,44 @@
+package watcher
+
+import "os"
+
+type EventType = string
+
+const (
+	CREATED  EventType = "Created"
+	MODIFIED EventType = "Modified"
+	DELETED  EventType = "Deleted"
+)
+
+type Event struct {
+	EventType EventType
+	Path      string
+	Info      os.FileInfo
+}
+
+type Events struct {
+	latestEvents map[string]Event // Latest event per file
+}
+
+func newEventBatch() *Events {
+	return &Events{
+		latestEvents: make(map[string]Event),
+	}
+}
+
+func (e *Events) addEvent(path string, event EventType, info os.FileInfo) {
+	e.latestEvents[path] = Event{
+		EventType: event,
+		Path:      path,
+		Info:      info,
+	}
+}
+
+func (e *Events) Events() []Event {
+	events := make([]Event, 0, len(e.latestEvents))
+	for _, event := range e.latestEvents {
+		events = append(events, event)
+	}
+
+	return events
+}
diff --git a/pkg/watcher/rlimit_nix.go b/pkg/watcher/rlimit_nix.go
new file mode 100644
index 0000000000..2a25322abe
--- /dev/null
+++ b/pkg/watcher/rlimit_nix.go
@@ -0,0 +1,27 @@
+//go:build linux || darwin
+
+package watcher
+
+import (
+	"syscall"
+
+	"github.com/rs/zerolog/log"
+)
+
+// BumpRLimitSoftToHardLimit bumps the soft limit of the rlimit to the hard limit.
+//
+// To go higher the user will need to update their kernel settings which can be viewed:
+//
+//	sysctl -a | grep kern.maxfile
+func BumpRLimitSoftToHardLimit() {
+	var rLimit syscall.Rlimit
+	err := syscall.Getrlimit(syscall.RLIMIT_NOFILE, &rLimit)
+	if err != nil {
+		log.Error().Err(err).Msg("failed to get rlimit")
+	}
+	rLimit.Cur = rLimit.Max
+	err = syscall.Setrlimit(syscall.RLIMIT_NOFILE, &rLimit)
+	if err != nil {
+		log.Error().Err(err).Msg("failed to set rlimit")
+	}
+}
diff --git a/pkg/watcher/rlimit_noop.go b/pkg/watcher/rlimit_noop.go
new file mode 100644
index 0000000000..9b79568866
--- /dev/null
+++ b/pkg/watcher/rlimit_noop.go
@@ -0,0 +1,12 @@
+//go:build !linux && !darwin
+
+package watcher
+
+// BumpRLimitSoftToHardLimit bumps the soft limit of the rlimit to the hard limit.
+//
+// To go higher the user will need to update their kernel settings which can be viewed:
+//
+//	sysctl -a | grep kern.maxfile
+func BumpRLimitSoftToHardLimit() {
+	// no-op
+}
diff --git a/pkg/watcher/util.go b/pkg/watcher/util.go
new file mode 100644
index 0000000000..422a0471e5
--- /dev/null
+++ b/pkg/watcher/util.go
@@ -0,0 +1,31 @@
+package watcher
+
+import (
+	"os"
+	"path/filepath"
+)
+
+// IgnoreFolder returns true for folders we don't want to watch certain folders
+// as they'll never impact an Encore app, and they cause an extreme amount of noise.
+func IgnoreFolder(folder string) bool {
+	folderName := filepath.Base(filepath.Clean(folder))
+	if folderName == "node_modules" || folderName == "encore.gen" {
+		return true
+	}
+
+	if folderName == "target" {
+		// Do we have a "Cargo.toml" file in the parent directory? If so, ignore this.
+		cargoPath := filepath.Join(filepath.Dir(folder), "Cargo.toml")
+		if _, err := os.Stat(cargoPath); err == nil {
+			return true
+		}
+	}
+
+	// Don't watch hidden folders like `.git` or `.idea` as
+	// they also don't impact an Encore app.
+	if len(folderName) > 1 && folderName[0] == '.' {
+		return true
+	}
+
+	return false
+}
diff --git a/pkg/watcher/watcher.go b/pkg/watcher/watcher.go
new file mode 100644
index 0000000000..ffc42f4966
--- /dev/null
+++ b/pkg/watcher/watcher.go
@@ -0,0 +1,197 @@
+package watcher
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/bep/debounce"
+	"github.com/fsnotify/fsnotify"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+
+	"encr.dev/pkg/eerror"
+)
+
+type Watcher struct {
+	mutex          sync.Mutex
+	eventCond      *sync.Cond
+	events         *Events
+	signalDebounce func(func())
+
+	log     *zerolog.Logger
+	appRoot string
+
+	watcher     *fsnotify.Watcher
+	directories map[string]struct{}
+	stop        chan struct{}
+}
+
+func New(appID string) (*Watcher, error) {
+	fswatcher, err := fsnotify.NewWatcher()
+	if err != nil {
+		return nil, eerror.Wrap(err, "watcher", "unable to create watcher", map[string]interface{}{"app": appID})
+	}
+
+	logger := log.With().Str("component", "watcher").Str("app", appID).Logger()
+	logger.Debug().Msg("File system watcher created")
+	w := &Watcher{
+		watcher:        fswatcher,
+		log:            &logger,
+		directories:    make(map[string]struct{}),
+		stop:           make(chan struct{}),
+		events:         nil,
+		signalDebounce: debounce.New(50 * time.Millisecond),
+	}
+
+	w.eventCond = sync.NewCond(&w.mutex)
+
+	go w.listenForChangeEvents()
+
+	return w, nil
+}
+
+func (w *Watcher) RecursivelyWatch(folder string) error {
+	return filepath.WalkDir(folder, func(path string, info os.DirEntry, err error) error {
+		if err != nil {
+			return eerror.Wrap(err, "watcher", "unable to walk directory", map[string]any{"path": path})
+		}
+
+		if info.IsDir() {
+			folder := filepath.Clean(path)
+
+			if IgnoreFolder(folder) {
+				return filepath.SkipDir
+			}
+
+			// Track the fact we're watching this directory
+			w.mutex.Lock()
+			if _, found := w.directories[folder]; found {
+				w.mutex.Unlock()
+				return filepath.SkipDir
+			}
+			w.directories[folder] = struct{}{}
+			w.mutex.Unlock() // unlock here to prevent reentrant locks during recursion
+
+			// Now start watching this folder
+			if err := w.watcher.Add(folder); err != nil {
+				return eerror.Wrap(err, "watcher", "unable to add folder to watch", map[string]any{"folder": folder})
+			}
+		}
+
+		return nil
+	})
+}
+
+func (w *Watcher) listenForChangeEvents() {
+	for {
+		select {
+		case <-w.stop:
+			_ = w.watcher.Close()
+			return
+
+		case event := <-w.watcher.Events:
+			if event.Has(fsnotify.Remove) {
+				w.handleDeleteEvent(event.Name)
+			} else if event.Has(fsnotify.Create) {
+				w.handleCreateEvent(event.Name)
+			} else if event.Has(fsnotify.Write) {
+				w.handleWriteEvent(event.Name)
+			}
+
+		case err := <-w.watcher.Errors:
+			w.log.Err(err).Msg("Watcher error")
+		}
+	}
+}
+
+func (w *Watcher) handleCreateEvent(path string) {
+	if info, err := os.Stat(path); err != nil {
+		w.log.Err(err).Str("path", path).Msg("unable to stat file")
+	} else if info.IsDir() {
+		if err := w.RecursivelyWatch(path); err != nil {
+			w.log.Err(err).Str("path", path).Msg("unable to start watching new directory")
+		}
+	} else {
+		w.recordEventInBatch(path, CREATED, info)
+	}
+}
+
+func (w *Watcher) handleDeleteEvent(path string) {
+	path = filepath.Clean(path)
+
+	pathWithSep := path + string(filepath.Separator)
+
+	// If it's a directory we're watching, stop watching it
+	w.mutex.Lock()
+	for watchedFolder := range w.directories {
+		// I sthis the path itself, or a subdirectory thereof?
+		if strings.HasPrefix(watchedFolder, pathWithSep) || watchedFolder == path {
+			if err := w.watcher.Remove(watchedFolder); err != nil {
+				w.log.Err(err).Str("path", watchedFolder).Msg("unable to stop watching deleted directory")
+			}
+			delete(w.directories, watchedFolder)
+		}
+	}
+	w.mutex.Unlock()
+
+	w.recordEventInBatch(path, DELETED, nil)
+}
+
+func (w *Watcher) handleWriteEvent(path string) {
+	if info, err := os.Stat(path); err != nil {
+		w.log.Err(err).Str("path", path).Msg("unable to stat file")
+	} else if !info.IsDir() {
+		w.recordEventInBatch(path, MODIFIED, info)
+	}
+}
+
+func (w *Watcher) recordEventInBatch(path string, event EventType, info os.FileInfo) {
+	w.mutex.Lock()
+	defer w.mutex.Unlock()
+
+	if w.events == nil {
+		w.events = newEventBatch()
+	}
+
+	w.events.addEvent(path, event, info)
+
+	// Debounce the signal to avoid waking up on every event in case of a burst of events.
+	w.signalDebounce(func() {
+		w.eventCond.Signal()
+	})
+}
+
+func (w *Watcher) WaitForEvents() (events []Event, ok bool) {
+	w.eventCond.L.Lock()
+	defer w.eventCond.L.Unlock()
+
+	for {
+		select {
+		case <-w.stop:
+			// We're shutting down, so return immediately.
+			return nil, false
+
+		default:
+			if w.events == nil || len(w.events.latestEvents) == 0 {
+				w.eventCond.Wait()
+			}
+			// Post-condition: we have at least one event.
+
+			events := w.events.Events()
+			w.events = newEventBatch()
+			return events, true
+		}
+	}
+}
+
+func (w *Watcher) Close() error {
+	close(w.stop)
+	return nil
+}
+
+func (w *Watcher) Done() <-chan struct{} {
+	return w.stop
+}
diff --git a/pkg/words/funcs.go b/pkg/words/funcs.go
new file mode 100644
index 0000000000..0b1d86bed5
--- /dev/null
+++ b/pkg/words/funcs.go
@@ -0,0 +1,22 @@
+package words
+
+import (
+	"crypto/rand"
+	"fmt"
+	"math/big"
+)
+
+// Select selects n random words from the short word list.
+func Select(n int) ([]string, error) {
+	selected := make([]string, n)
+	words := shortWords.Get()
+	max := big.NewInt(int64(len(words)))
+	for i := 0; i < n; i++ {
+		j, err := rand.Int(rand.Reader, max)
+		if err != nil {
+			return nil, fmt.Errorf("wordlist.Select %d: %v", n, err)
+		}
+		selected[i] = words[j.Int64()]
+	}
+	return selected, nil
+}
diff --git a/pkg/words/shortwords.txt b/pkg/words/shortwords.txt
new file mode 100644
index 0000000000..028ca87e7f
--- /dev/null
+++ b/pkg/words/shortwords.txt
@@ -0,0 +1,1295 @@
+acid
+acorn
+acre
+acts
+afar
+affix
+aged
+agent
+agile
+aging
+agony
+ahead
+aide
+aids
+aim
+ajar
+alarm
+alias
+alibi
+alien
+alike
+alive
+aloe
+aloft
+aloha
+alone
+amend
+amino
+ample
+amuse
+angel
+anger
+angle
+ankle
+apple
+april
+apron
+aqua
+area
+arena
+argue
+arise
+armed
+armor
+army
+aroma
+array
+arson
+art
+ashen
+ashes
+atlas
+atom
+attic
+audio
+avert
+avoid
+awake
+award
+awoke
+axis
+bacon
+badge
+bagel
+baggy
+baked
+baker
+balmy
+banjo
+barge
+barn
+bash
+basil
+bask
+batch
+bath
+baton
+bats
+blade
+blank
+blast
+blaze
+bleak
+blend
+bless
+blimp
+blink
+bloat
+blob
+blog
+blot
+blunt
+blurt
+blush
+boast
+boat
+body
+boil
+bok
+bolt
+boned
+boney
+bonus
+bony
+book
+booth
+boots
+boss
+botch
+both
+boxer
+breed
+bribe
+brick
+bride
+brim
+bring
+brink
+brisk
+broad
+broil
+broke
+brook
+broom
+brush
+buck
+bud
+buggy
+bulge
+bulk
+bully
+bunch
+bunny
+bunt
+bush
+bust
+busy
+buzz
+cable
+cache
+cadet
+cage
+cake
+calm
+cameo
+canal
+candy
+cane
+canon
+cape
+card
+cargo
+carol
+carry
+carve
+case
+cash
+cause
+cedar
+chain
+chair
+chant
+chaos
+charm
+chase
+cheek
+cheer
+chef
+chess
+chest
+chew
+chief
+chili
+chill
+chip
+chomp
+chop
+chow
+chuck
+chump
+chunk
+churn
+chute
+cider
+cinch
+city
+civic
+civil
+clad
+claim
+clamp
+clap
+clash
+clasp
+class
+claw
+clay
+clean
+clear
+cleat
+cleft
+clerk
+click
+cling
+clink
+clip
+cloak
+clock
+clone
+cloth
+cloud
+clump
+coach
+coast
+coat
+cod
+coil
+coke
+cola
+cold
+colt
+coma
+come
+comic
+comma
+cone
+cope
+copy
+coral
+cork
+cost
+cot
+couch
+cough
+cover
+cozy
+craft
+cramp
+crane
+crank
+crate
+crave
+crawl
+crazy
+creme
+crepe
+crept
+crib
+cried
+crisp
+crook
+crop
+cross
+crowd
+crown
+crumb
+crush
+crust
+cub
+cult
+cupid
+cure
+curl
+curry
+curse
+curve
+curvy
+cushy
+cut
+cycle
+dab
+dad
+daily
+dairy
+daisy
+dance
+dandy
+darn
+dart
+dash
+data
+date
+dawn
+deaf
+deal
+dean
+debit
+debt
+debug
+decaf
+decal
+decay
+deck
+decor
+decoy
+deed
+delay
+denim
+dense
+dent
+depth
+derby
+desk
+dial
+diary
+dice
+dig
+dill
+dime
+dimly
+diner
+dingy
+disco
+dish
+disk
+ditch
+ditzy
+dizzy
+dock
+dodge
+doing
+doll
+dome
+donor
+donut
+dose
+dot
+dove
+down
+dowry
+doze
+drab
+drama
+drank
+draw
+dress
+dried
+drift
+drill
+drive
+drone
+droop
+drove
+drown
+drum
+dry
+duck
+duct
+dude
+dug
+duke
+duo
+dusk
+dust
+duty
+dwarf
+dwell
+eagle
+early
+earth
+easel
+east
+eaten
+eats
+ebay
+ebony
+ebook
+echo
+edge
+eel
+eject
+elbow
+elder
+elf
+elk
+elm
+elope
+elude
+elves
+email
+emit
+empty
+emu
+enter
+entry
+envoy
+equal
+erase
+error
+erupt
+essay
+etch
+evade
+even
+evict
+evil
+evoke
+exact
+exit
+fable
+faced
+fact
+fade
+fall
+false
+fancy
+fang
+fax
+feast
+feed
+femur
+fence
+fend
+ferry
+fetal
+fetch
+fever
+fiber
+fifth
+fifty
+film
+filth
+final
+finch
+fit
+five
+flag
+flaky
+flame
+flap
+flask
+fled
+flick
+fling
+flint
+flip
+flirt
+float
+flock
+flop
+floss
+flyer
+foam
+foe
+fog
+foil
+folic
+folk
+food
+fool
+found
+fox
+foyer
+frail
+frame
+fray
+fresh
+fried
+frill
+frisk
+from
+front
+frost
+froth
+frown
+froze
+fruit
+gag
+gains
+gala
+game
+gap
+gas
+gave
+gear
+gecko
+geek
+gem
+genre
+gift
+gig
+gills
+given
+giver
+glad
+glass
+glide
+gloss
+glove
+glow
+glue
+goal
+going
+golf
+gong
+good
+gooey
+goofy
+gore
+gown
+grab
+grain
+grant
+grape
+graph
+grasp
+grass
+grave
+gravy
+gray
+green
+greet
+grew
+grid
+grief
+grill
+grip
+grit
+groom
+grope
+growl
+grub
+grunt
+guide
+gulf
+gulp
+gummy
+guru
+gush
+gut
+guy
+habit
+half
+halo
+halt
+happy
+harm
+hash
+hasty
+hatch
+hate
+haven
+hazel
+hazy
+heap
+heat
+heave
+hedge
+hefty
+help
+herbs
+hers
+hub
+hug
+hula
+hull
+human
+humid
+hump
+hung
+hunk
+hunt
+hurry
+hurt
+hush
+hut
+ice
+icing
+icon
+icy
+igloo
+image
+ion
+iron
+islam
+issue
+item
+ivory
+ivy
+jab
+jam
+jaws
+jazz
+jeep
+jelly
+jet
+jiffy
+job
+jog
+jolly
+jolt
+jot
+joy
+judge
+juice
+juicy
+july
+jumbo
+jump
+junky
+juror
+jury
+keep
+keg
+kept
+kick
+kilt
+king
+kite
+kitty
+kiwi
+knee
+knelt
+koala
+kung
+ladle
+lady
+lair
+lake
+lance
+land
+lapel
+large
+lash
+lasso
+last
+latch
+late
+lazy
+left
+legal
+lemon
+lend
+lens
+lent
+level
+lever
+lid
+life
+lift
+lilac
+lily
+limb
+limes
+line
+lint
+lion
+lip
+list
+lived
+liver
+lunar
+lunch
+lung
+lurch
+lure
+lurk
+lying
+lyric
+mace
+maker
+malt
+mama
+mango
+manor
+many
+map
+march
+mardi
+marry
+mash
+match
+mate
+math
+moan
+mocha
+moist
+mold
+mom
+moody
+mop
+morse
+most
+motor
+motto
+mount
+mouse
+mousy
+mouth
+move
+movie
+mower
+mud
+mug
+mulch
+mule
+mull
+mumbo
+mummy
+mural
+muse
+music
+musky
+mute
+nacho
+nag
+nail
+name
+nanny
+nap
+navy
+near
+neat
+neon
+nerd
+nest
+net
+next
+niece
+ninth
+nutty
+oak
+oasis
+oat
+ocean
+oil
+old
+olive
+omen
+onion
+only
+ooze
+opal
+open
+opera
+opt
+otter
+ouch
+ounce
+outer
+oval
+oven
+owl
+ozone
+pace
+pagan
+pager
+palm
+panda
+panic
+pants
+panty
+paper
+park
+party
+pasta
+patch
+path
+patio
+payer
+pecan
+penny
+pep
+perch
+perky
+perm
+pest
+petal
+petri
+petty
+photo
+plank
+plant
+plaza
+plead
+plot
+plow
+pluck
+plug
+plus
+poach
+pod
+poem
+poet
+pogo
+point
+poise
+poker
+polar
+polio
+polka
+polo
+pond
+pony
+poppy
+pork
+poser
+pouch
+pound
+pout
+power
+prank
+press
+print
+prior
+prism
+prize
+probe
+prong
+proof
+props
+prude
+prune
+pry
+pug
+pull
+pulp
+pulse
+puma
+punch
+punk
+pupil
+puppy
+purr
+purse
+push
+putt
+quack
+quake
+query
+quiet
+quill
+quilt
+quit
+quota
+quote
+rabid
+race
+rack
+radar
+radio
+raft
+rage
+raid
+rail
+rake
+rally
+ramp
+ranch
+range
+rank
+rant
+rash
+raven
+reach
+react
+ream
+rebel
+recap
+relax
+relay
+relic
+remix
+repay
+repel
+reply
+rerun
+reset
+rhyme
+rice
+rich
+ride
+rigid
+rigor
+rinse
+riot
+ripen
+rise
+risk
+ritzy
+rival
+river
+roast
+robe
+robin
+rock
+rogue
+roman
+romp
+rope
+rover
+royal
+ruby
+rug
+ruin
+rule
+runny
+rush
+rust
+rut
+sadly
+sage
+said
+saint
+salad
+salon
+salsa
+salt
+same
+sandy
+santa
+satin
+sauna
+saved
+savor
+sax
+say
+scale
+scam
+scan
+scare
+scarf
+scary
+scoff
+scold
+scoop
+scoot
+scope
+score
+scorn
+scout
+scowl
+scrap
+scrub
+scuba
+scuff
+sect
+sedan
+self
+send
+sepia
+serve
+set
+seven
+shack
+shade
+shady
+shaft
+shaky
+sham
+shape
+share
+sharp
+shed
+sheep
+sheet
+shelf
+shell
+shine
+shiny
+ship
+shirt
+shock
+shop
+shore
+shout
+shove
+shown
+showy
+shred
+shrug
+shun
+shush
+shut
+shy
+sift
+silk
+silly
+silo
+sip
+siren
+sixth
+size
+skate
+skew
+skid
+skier
+skies
+skip
+skirt
+skit
+sky
+slab
+slack
+slain
+slam
+slang
+slash
+slate
+slaw
+sled
+sleek
+sleep
+sleet
+slept
+slice
+slick
+slimy
+sling
+slip
+slit
+slob
+slot
+slug
+slum
+slurp
+slush
+small
+smash
+smell
+smile
+smirk
+smog
+snack
+snap
+snare
+snarl
+sneak
+sneer
+sniff
+snore
+snort
+snout
+snowy
+snub
+snuff
+speak
+speed
+spend
+spent
+spew
+spied
+spill
+spiny
+spoil
+spoke
+spoof
+spool
+spoon
+sport
+spot
+spout
+spray
+spree
+spur
+squad
+squat
+squid
+stack
+staff
+stage
+stain
+stall
+stamp
+stand
+stank
+stark
+start
+stash
+state
+stays
+steam
+steep
+stem
+step
+stew
+stick
+sting
+stir
+stock
+stole
+stomp
+stony
+stood
+stool
+stoop
+stop
+storm
+stout
+stove
+straw
+stray
+strut
+stuck
+stud
+stuff
+stump
+stung
+stunt
+suds
+sugar
+sulk
+surf
+sushi
+swab
+swan
+swarm
+sway
+swear
+sweat
+sweep
+swell
+swept
+swim
+swing
+swipe
+swirl
+swoop
+swore
+syrup
+tacky
+taco
+tag
+take
+tall
+talon
+tamer
+tank
+taper
+taps
+tarot
+tart
+task
+taste
+tasty
+taunt
+thank
+thaw
+theft
+theme
+thigh
+thing
+think
+thong
+thorn
+those
+throb
+thud
+thumb
+thump
+thus
+tiara
+tidal
+tidy
+tiger
+tile
+tilt
+tint
+tiny
+trace
+track
+trade
+train
+trait
+trap
+trash
+tray
+treat
+tree
+trek
+trend
+trial
+tribe
+trick
+trio
+trout
+truce
+truck
+trump
+trunk
+try
+tug
+tulip
+tummy
+turf
+tusk
+tutor
+tutu
+tux
+tweak
+tweet
+twice
+twine
+twins
+twirl
+twist
+uncle
+uncut
+undo
+unify
+union
+unit
+untie
+upon
+upper
+urban
+used
+user
+usher
+utter
+value
+vapor
+vegan
+venue
+verse
+vest
+veto
+vice
+video
+view
+viral
+virus
+visa
+visor
+vixen
+vocal
+voice
+void
+volt
+voter
+vowel
+wad
+wafer
+wager
+wages
+wagon
+wake
+walk
+wand
+wasp
+watch
+water
+wavy
+wheat
+whiff
+whole
+whoop
+wick
+widen
+widow
+width
+wife
+wifi
+wilt
+wimp
+wind
+wing
+wink
+wipe
+wired
+wiry
+wise
+wish
+wispy
+wok
+wolf
+womb
+wool
+woozy
+word
+work
+worry
+wound
+woven
+wrath
+wreck
+wrist
+xerox
+yahoo
+yam
+yard
+year
+yeast
+yelp
+yield
+yodel
+yoga
+yoyo
+yummy
+zebra
+zero
+zesty
+zippy
+zone
+zoom
diff --git a/pkg/words/words.go b/pkg/words/words.go
new file mode 100644
index 0000000000..0fd9df7c10
--- /dev/null
+++ b/pkg/words/words.go
@@ -0,0 +1,28 @@
+package words
+
+import (
+	_ "embed" // for go:embed
+	"strings"
+	"sync"
+)
+
+type wordList struct {
+	raw   string
+	once  sync.Once
+	words []string
+}
+
+func (w *wordList) Get() []string {
+	w.once.Do(func() {
+		raw := strings.TrimSpace(w.raw)
+		w.words = strings.Split(raw, "\n")
+	})
+	return w.words
+}
+
+var (
+	//go:embed shortwords.txt
+	shortRaw string
+
+	shortWords = wordList{raw: shortRaw}
+)
diff --git a/pkg/words/words_test.go b/pkg/words/words_test.go
new file mode 100644
index 0000000000..280dfcf7e7
--- /dev/null
+++ b/pkg/words/words_test.go
@@ -0,0 +1,25 @@
+package words
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestWords(t *testing.T) {
+	list := shortWords.Get()
+	if len(list) != 1295 {
+		t.Errorf("expected 1295 words, got %d", len(list))
+	}
+
+	seen := make(map[string]bool)
+	for _, w := range list {
+		if seen[w] {
+			t.Errorf("duplicate word %q", w)
+		} else if len(w) < 3 || len(w) > 5 {
+			t.Errorf("expected word to be 3-5 5 characters, got %q", w)
+		} else if strings.TrimSpace(w) != w {
+			t.Errorf("expected word to be trimmed, got %q", w)
+		}
+		seen[w] = true
+	}
+}
diff --git a/pkg/xos/xos_unix.go b/pkg/xos/xos_unix.go
new file mode 100644
index 0000000000..4bf04a3791
--- /dev/null
+++ b/pkg/xos/xos_unix.go
@@ -0,0 +1,56 @@
+//go:build !windows
+// +build !windows
+
+// Package xos provides cross-platform helper functions.
+package xos
+
+import (
+	"os"
+	"os/exec"
+	"os/user"
+	"syscall"
+
+	"github.com/cockroachdb/errors"
+	"github.com/google/renameio/v2"
+)
+
+func CreateNewProcessGroup() *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{Setpgid: true}
+}
+
+func SocketStat(path string) (interface{}, error) {
+	return os.Stat(path)
+}
+
+func SameSocket(a, b interface{}) bool {
+	ai := a.(os.FileInfo)
+	bi := b.(os.FileInfo)
+	return os.SameFile(ai, bi)
+}
+
+func ArrangeExtraFiles(cmd *exec.Cmd, files ...*os.File) error {
+	cmd.ExtraFiles = files
+	return nil
+}
+
+func IsAdminUser() (bool, error) {
+	usr, err := user.Current()
+	if err != nil {
+		return false, err
+	}
+	return usr.Gid == "0", nil
+}
+
+// WriteFile writes the given file with the given data and permissions.
+//
+// Where possible (i.e. not on windows) it will use an atomic write process
+// which removes the possibility of a partial file being written during a crash
+// or error.
+func WriteFile(filename string, data []byte, perm os.FileMode) error {
+	return errors.WithStack(renameio.WriteFile(filename, data, perm))
+}
+
+// IsWindowsJunctionPoint reports whether a filename is a Windows junction point.
+func IsWindowsJunctionPoint(filename string) (ok bool, err error) {
+	return false, nil
+}
diff --git a/pkg/xos/xos_windows.go b/pkg/xos/xos_windows.go
new file mode 100644
index 0000000000..1c2849f9d8
--- /dev/null
+++ b/pkg/xos/xos_windows.go
@@ -0,0 +1,96 @@
+//go:build windows
+// +build windows
+
+package xos
+
+import (
+	"fmt"
+	"os"
+	"os/exec"
+	"strconv"
+	"strings"
+	"syscall"
+
+	"github.com/cockroachdb/errors"
+	"golang.org/x/sys/windows"
+)
+
+func CreateNewProcessGroup() *syscall.SysProcAttr {
+	return &syscall.SysProcAttr{
+		CreationFlags: windows.CREATE_NEW_PROCESS_GROUP,
+	}
+}
+
+func SocketStat(path string) (interface{}, error) {
+	fd, err := windows.CreateFile(windows.StringToUTF16Ptr(path), windows.GENERIC_READ, 0, nil, windows.OPEN_EXISTING, windows.FILE_FLAG_OPEN_REPARSE_POINT|windows.FILE_FLAG_BACKUP_SEMANTICS, 0)
+	if err != nil {
+		return nil, fmt.Errorf("CreateFile %s: %w", path, err)
+	}
+	defer windows.CloseHandle(fd)
+
+	var d syscall.ByHandleFileInformation
+	err = syscall.GetFileInformationByHandle(syscall.Handle(fd), &d)
+	if err != nil {
+		return nil, &os.PathError{"GetFileInformationByHandle", path, err}
+	}
+	return &d, nil
+}
+
+func SameSocket(a, b interface{}) bool {
+	ai := a.(*syscall.ByHandleFileInformation)
+	bi := b.(*syscall.ByHandleFileInformation)
+	return ai.VolumeSerialNumber == bi.VolumeSerialNumber && ai.FileIndexHigh == bi.FileIndexHigh && ai.FileIndexLow == bi.FileIndexLow
+}
+
+func ArrangeExtraFiles(cmd *exec.Cmd, files ...*os.File) error {
+	attr := cmd.SysProcAttr
+	if attr == nil {
+		attr = &syscall.SysProcAttr{}
+		cmd.SysProcAttr = attr
+	}
+
+	// Flag the files to bbe inherited by the child process
+	var fds []string
+	for _, f := range files {
+		fd := f.Fd()
+		fds = append(fds, strconv.FormatUint(uint64(fd), 10))
+		err := windows.SetHandleInformation(windows.Handle(fd), windows.HANDLE_FLAG_INHERIT, 1)
+		if err != nil {
+			return fmt.Errorf("xos.ArrangeExtraFiles: SetHandleInformation: %v", err)
+		}
+		attr.AdditionalInheritedHandles = append(attr.AdditionalInheritedHandles, syscall.Handle(fd))
+	}
+	// If the env hasn't been set, copy over this process' env so we preserve the cmd.Env semantics.
+	if cmd.Env == nil {
+		cmd.Env = os.Environ()
+	}
+	cmd.Env = append(cmd.Env, "ENCORE_EXTRA_FILES="+strings.Join(fds, ","))
+	return nil
+}
+
+func IsAdminUser() (bool, error) {
+	// For Windows we elevate permissions on demand, so pretend we are admin
+	return true, nil
+}
+
+// WriteFile writes the given file with the given data and permissions.
+//
+// Where possible (i.e. not on windows) it will use an atomic write process
+// which removes the possibility of a partial file being written during a crash
+// or error.
+func WriteFile(filename string, data []byte, perm os.FileMode) error {
+	return errors.WithStack(os.WriteFile(filename, data, perm))
+}
+
+// IsWindowsJunctionPoint reports whether a filename is a Windows junction point.
+func IsWindowsJunctionPoint(filename string) (ok bool, err error) {
+	ptr, err := syscall.UTF16PtrFromString(filename)
+	if err != nil {
+		return false, err
+	}
+	attrs, err := windows.GetFileAttributes(ptr)
+	if err != nil {
+		return false, err
+	}
+	return attrs&windows.FILE_ATTRIBUTE_REPARSE_POINT == windows.FILE_ATTRIBUTE_REPARSE_POINT, nil
+}
diff --git a/proto/encore/daemon/daemon.pb.go b/proto/encore/daemon/daemon.pb.go
index 427a8fcbcc..4d6685342e 100644
--- a/proto/encore/daemon/daemon.pb.go
+++ b/proto/encore/daemon/daemon.pb.go
@@ -1,13 +1,12 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.14.0
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.23.4
 // source: encore/daemon/daemon.proto
 
 package daemon
 
 import (
-	proto "github.com/golang/protobuf/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	emptypb "google.golang.org/protobuf/types/known/emptypb"
@@ -22,54 +21,258 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
-type SetSecretRequest_Type int32
+type DBRole int32
 
 const (
-	SetSecretRequest_DEVELOPMENT SetSecretRequest_Type = 0
-	SetSecretRequest_PRODUCTION  SetSecretRequest_Type = 1
+	DBRole_DB_ROLE_UNSPECIFIED DBRole = 0
+	DBRole_DB_ROLE_SUPERUSER   DBRole = 1
+	DBRole_DB_ROLE_ADMIN       DBRole = 2
+	DBRole_DB_ROLE_WRITE       DBRole = 3
+	DBRole_DB_ROLE_READ        DBRole = 4
 )
 
-// Enum value maps for SetSecretRequest_Type.
+// Enum value maps for DBRole.
 var (
-	SetSecretRequest_Type_name = map[int32]string{
-		0: "DEVELOPMENT",
-		1: "PRODUCTION",
+	DBRole_name = map[int32]string{
+		0: "DB_ROLE_UNSPECIFIED",
+		1: "DB_ROLE_SUPERUSER",
+		2: "DB_ROLE_ADMIN",
+		3: "DB_ROLE_WRITE",
+		4: "DB_ROLE_READ",
 	}
-	SetSecretRequest_Type_value = map[string]int32{
-		"DEVELOPMENT": 0,
-		"PRODUCTION":  1,
+	DBRole_value = map[string]int32{
+		"DB_ROLE_UNSPECIFIED": 0,
+		"DB_ROLE_SUPERUSER":   1,
+		"DB_ROLE_ADMIN":       2,
+		"DB_ROLE_WRITE":       3,
+		"DB_ROLE_READ":        4,
 	}
 )
 
-func (x SetSecretRequest_Type) Enum() *SetSecretRequest_Type {
-	p := new(SetSecretRequest_Type)
+func (x DBRole) Enum() *DBRole {
+	p := new(DBRole)
 	*p = x
 	return p
 }
 
-func (x SetSecretRequest_Type) String() string {
+func (x DBRole) String() string {
 	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
 }
 
-func (SetSecretRequest_Type) Descriptor() protoreflect.EnumDescriptor {
+func (DBRole) Descriptor() protoreflect.EnumDescriptor {
 	return file_encore_daemon_daemon_proto_enumTypes[0].Descriptor()
 }
 
-func (SetSecretRequest_Type) Type() protoreflect.EnumType {
+func (DBRole) Type() protoreflect.EnumType {
 	return &file_encore_daemon_daemon_proto_enumTypes[0]
 }
 
-func (x SetSecretRequest_Type) Number() protoreflect.EnumNumber {
+func (x DBRole) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use DBRole.Descriptor instead.
+func (DBRole) EnumDescriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{0}
+}
+
+type DBClusterType int32
+
+const (
+	DBClusterType_DB_CLUSTER_TYPE_UNSPECIFIED DBClusterType = 0
+	DBClusterType_DB_CLUSTER_TYPE_RUN         DBClusterType = 1
+	DBClusterType_DB_CLUSTER_TYPE_TEST        DBClusterType = 2
+	DBClusterType_DB_CLUSTER_TYPE_SHADOW      DBClusterType = 3
+)
+
+// Enum value maps for DBClusterType.
+var (
+	DBClusterType_name = map[int32]string{
+		0: "DB_CLUSTER_TYPE_UNSPECIFIED",
+		1: "DB_CLUSTER_TYPE_RUN",
+		2: "DB_CLUSTER_TYPE_TEST",
+		3: "DB_CLUSTER_TYPE_SHADOW",
+	}
+	DBClusterType_value = map[string]int32{
+		"DB_CLUSTER_TYPE_UNSPECIFIED": 0,
+		"DB_CLUSTER_TYPE_RUN":         1,
+		"DB_CLUSTER_TYPE_TEST":        2,
+		"DB_CLUSTER_TYPE_SHADOW":      3,
+	}
+)
+
+func (x DBClusterType) Enum() *DBClusterType {
+	p := new(DBClusterType)
+	*p = x
+	return p
+}
+
+func (x DBClusterType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (DBClusterType) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_daemon_daemon_proto_enumTypes[1].Descriptor()
+}
+
+func (DBClusterType) Type() protoreflect.EnumType {
+	return &file_encore_daemon_daemon_proto_enumTypes[1]
+}
+
+func (x DBClusterType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use DBClusterType.Descriptor instead.
+func (DBClusterType) EnumDescriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{1}
+}
+
+type RunRequest_BrowserMode int32
+
+const (
+	RunRequest_BROWSER_AUTO   RunRequest_BrowserMode = 0
+	RunRequest_BROWSER_NEVER  RunRequest_BrowserMode = 1
+	RunRequest_BROWSER_ALWAYS RunRequest_BrowserMode = 2
+)
+
+// Enum value maps for RunRequest_BrowserMode.
+var (
+	RunRequest_BrowserMode_name = map[int32]string{
+		0: "BROWSER_AUTO",
+		1: "BROWSER_NEVER",
+		2: "BROWSER_ALWAYS",
+	}
+	RunRequest_BrowserMode_value = map[string]int32{
+		"BROWSER_AUTO":   0,
+		"BROWSER_NEVER":  1,
+		"BROWSER_ALWAYS": 2,
+	}
+)
+
+func (x RunRequest_BrowserMode) Enum() *RunRequest_BrowserMode {
+	p := new(RunRequest_BrowserMode)
+	*p = x
+	return p
+}
+
+func (x RunRequest_BrowserMode) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (RunRequest_BrowserMode) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_daemon_daemon_proto_enumTypes[2].Descriptor()
+}
+
+func (RunRequest_BrowserMode) Type() protoreflect.EnumType {
+	return &file_encore_daemon_daemon_proto_enumTypes[2]
+}
+
+func (x RunRequest_BrowserMode) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use RunRequest_BrowserMode.Descriptor instead.
+func (RunRequest_BrowserMode) EnumDescriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{6, 0}
+}
+
+type RunRequest_DebugMode int32
+
+const (
+	RunRequest_DEBUG_DISABLED RunRequest_DebugMode = 0
+	RunRequest_DEBUG_ENABLED  RunRequest_DebugMode = 1
+	RunRequest_DEBUG_BREAK    RunRequest_DebugMode = 2
+)
+
+// Enum value maps for RunRequest_DebugMode.
+var (
+	RunRequest_DebugMode_name = map[int32]string{
+		0: "DEBUG_DISABLED",
+		1: "DEBUG_ENABLED",
+		2: "DEBUG_BREAK",
+	}
+	RunRequest_DebugMode_value = map[string]int32{
+		"DEBUG_DISABLED": 0,
+		"DEBUG_ENABLED":  1,
+		"DEBUG_BREAK":    2,
+	}
+)
+
+func (x RunRequest_DebugMode) Enum() *RunRequest_DebugMode {
+	p := new(RunRequest_DebugMode)
+	*p = x
+	return p
+}
+
+func (x RunRequest_DebugMode) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (RunRequest_DebugMode) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_daemon_daemon_proto_enumTypes[3].Descriptor()
+}
+
+func (RunRequest_DebugMode) Type() protoreflect.EnumType {
+	return &file_encore_daemon_daemon_proto_enumTypes[3]
+}
+
+func (x RunRequest_DebugMode) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use RunRequest_DebugMode.Descriptor instead.
+func (RunRequest_DebugMode) EnumDescriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{6, 1}
+}
+
+type DumpMetaRequest_Format int32
+
+const (
+	DumpMetaRequest_FORMAT_UNSPECIFIED DumpMetaRequest_Format = 0
+	DumpMetaRequest_FORMAT_JSON        DumpMetaRequest_Format = 1
+	DumpMetaRequest_FORMAT_PROTO       DumpMetaRequest_Format = 2
+)
+
+// Enum value maps for DumpMetaRequest_Format.
+var (
+	DumpMetaRequest_Format_name = map[int32]string{
+		0: "FORMAT_UNSPECIFIED",
+		1: "FORMAT_JSON",
+		2: "FORMAT_PROTO",
+	}
+	DumpMetaRequest_Format_value = map[string]int32{
+		"FORMAT_UNSPECIFIED": 0,
+		"FORMAT_JSON":        1,
+		"FORMAT_PROTO":       2,
+	}
+)
+
+func (x DumpMetaRequest_Format) Enum() *DumpMetaRequest_Format {
+	p := new(DumpMetaRequest_Format)
+	*p = x
+	return p
+}
+
+func (x DumpMetaRequest_Format) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (DumpMetaRequest_Format) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_daemon_daemon_proto_enumTypes[4].Descriptor()
+}
+
+func (DumpMetaRequest_Format) Type() protoreflect.EnumType {
+	return &file_encore_daemon_daemon_proto_enumTypes[4]
+}
+
+func (x DumpMetaRequest_Format) Number() protoreflect.EnumNumber {
 	return protoreflect.EnumNumber(x)
 }
 
-// Deprecated: Use SetSecretRequest_Type.Descriptor instead.
-func (SetSecretRequest_Type) EnumDescriptor() ([]byte, []int) {
-	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{17, 0}
+// Deprecated: Use DumpMetaRequest_Format.Descriptor instead.
+func (DumpMetaRequest_Format) EnumDescriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{32, 0}
 }
 
 type CommandMessage struct {
@@ -78,8 +281,10 @@ type CommandMessage struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to Msg:
+	//
 	//	*CommandMessage_Output
 	//	*CommandMessage_Exit
+	//	*CommandMessage_Errors
 	Msg isCommandMessage_Msg `protobuf_oneof:"msg"`
 }
 
@@ -136,6 +341,13 @@ func (x *CommandMessage) GetExit() *CommandExit {
 	return nil
 }
 
+func (x *CommandMessage) GetErrors() *CommandDisplayErrors {
+	if x, ok := x.GetMsg().(*CommandMessage_Errors); ok {
+		return x.Errors
+	}
+	return nil
+}
+
 type isCommandMessage_Msg interface {
 	isCommandMessage_Msg()
 }
@@ -148,10 +360,16 @@ type CommandMessage_Exit struct {
 	Exit *CommandExit `protobuf:"bytes,2,opt,name=exit,proto3,oneof"`
 }
 
+type CommandMessage_Errors struct {
+	Errors *CommandDisplayErrors `protobuf:"bytes,3,opt,name=errors,proto3,oneof"`
+}
+
 func (*CommandMessage_Output) isCommandMessage_Msg() {}
 
 func (*CommandMessage_Exit) isCommandMessage_Msg() {}
 
+func (*CommandMessage_Errors) isCommandMessage_Msg() {}
+
 type CommandOutput struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -254,27 +472,16 @@ func (x *CommandExit) GetCode() int32 {
 	return 0
 }
 
-type RunRequest struct {
+type CommandDisplayErrors struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// app_root is the absolute filesystem path to the Encore app root.
-	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
-	// working_dir is the working directory relative to the app_root,
-	// for formatting relative paths in error messages.
-	WorkingDir string `protobuf:"bytes,2,opt,name=working_dir,json=workingDir,proto3" json:"working_dir,omitempty"`
-	// tunnel, if true, creates a tunnel environment on the encore.dev platform
-	// that forwards requests to the running app.
-	Tunnel bool `protobuf:"varint,3,opt,name=tunnel,proto3" json:"tunnel,omitempty"`
-	// debug, if true, compiles the app with flags that improve the debugging experience.
-	Debug bool `protobuf:"varint,4,opt,name=debug,proto3" json:"debug,omitempty"`
-	// watch, if true, enables live reloading of the app whenever the source changes.
-	Watch bool `protobuf:"varint,5,opt,name=watch,proto3" json:"watch,omitempty"`
+	Errinsrc []byte `protobuf:"bytes,1,opt,name=errinsrc,proto3" json:"errinsrc,omitempty"` // error messages in source code
 }
 
-func (x *RunRequest) Reset() {
-	*x = RunRequest{}
+func (x *CommandDisplayErrors) Reset() {
+	*x = CommandDisplayErrors{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_daemon_daemon_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -282,13 +489,13 @@ func (x *RunRequest) Reset() {
 	}
 }
 
-func (x *RunRequest) String() string {
+func (x *CommandDisplayErrors) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*RunRequest) ProtoMessage() {}
+func (*CommandDisplayErrors) ProtoMessage() {}
 
-func (x *RunRequest) ProtoReflect() protoreflect.Message {
+func (x *CommandDisplayErrors) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_daemon_daemon_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -300,60 +507,33 @@ func (x *RunRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use RunRequest.ProtoReflect.Descriptor instead.
-func (*RunRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use CommandDisplayErrors.ProtoReflect.Descriptor instead.
+func (*CommandDisplayErrors) Descriptor() ([]byte, []int) {
 	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{3}
 }
 
-func (x *RunRequest) GetAppRoot() string {
-	if x != nil {
-		return x.AppRoot
-	}
-	return ""
-}
-
-func (x *RunRequest) GetWorkingDir() string {
-	if x != nil {
-		return x.WorkingDir
-	}
-	return ""
-}
-
-func (x *RunRequest) GetTunnel() bool {
-	if x != nil {
-		return x.Tunnel
-	}
-	return false
-}
-
-func (x *RunRequest) GetDebug() bool {
+func (x *CommandDisplayErrors) GetErrinsrc() []byte {
 	if x != nil {
-		return x.Debug
-	}
-	return false
-}
-
-func (x *RunRequest) GetWatch() bool {
-	if x != nil {
-		return x.Watch
+		return x.Errinsrc
 	}
-	return false
+	return nil
 }
 
-type RunMessage struct {
+type CreateAppRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	// Types that are assignable to Msg:
-	//	*RunMessage_Started
-	//	*RunMessage_Output
-	//	*RunMessage_Exit
-	Msg isRunMessage_Msg `protobuf_oneof:"msg"`
+	// app_root is the absolute filesystem path to the Encore app root.
+	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	// template is the template used to create the app
+	Template string `protobuf:"bytes,2,opt,name=template,proto3" json:"template,omitempty"`
+	// tutorial is a flag to indicate if the app is a tutorial app
+	Tutorial bool `protobuf:"varint,3,opt,name=tutorial,proto3" json:"tutorial,omitempty"`
 }
 
-func (x *RunMessage) Reset() {
-	*x = RunMessage{}
+func (x *CreateAppRequest) Reset() {
+	*x = CreateAppRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_daemon_daemon_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -361,13 +541,13 @@ func (x *RunMessage) Reset() {
 	}
 }
 
-func (x *RunMessage) String() string {
+func (x *CreateAppRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*RunMessage) ProtoMessage() {}
+func (*CreateAppRequest) ProtoMessage() {}
 
-func (x *RunMessage) ProtoReflect() protoreflect.Message {
+func (x *CreateAppRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_daemon_daemon_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -379,74 +559,42 @@ func (x *RunMessage) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use RunMessage.ProtoReflect.Descriptor instead.
-func (*RunMessage) Descriptor() ([]byte, []int) {
+// Deprecated: Use CreateAppRequest.ProtoReflect.Descriptor instead.
+func (*CreateAppRequest) Descriptor() ([]byte, []int) {
 	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{4}
 }
 
-func (m *RunMessage) GetMsg() isRunMessage_Msg {
-	if m != nil {
-		return m.Msg
-	}
-	return nil
-}
-
-func (x *RunMessage) GetStarted() *RunStarted {
-	if x, ok := x.GetMsg().(*RunMessage_Started); ok {
-		return x.Started
+func (x *CreateAppRequest) GetAppRoot() string {
+	if x != nil {
+		return x.AppRoot
 	}
-	return nil
+	return ""
 }
 
-func (x *RunMessage) GetOutput() *CommandOutput {
-	if x, ok := x.GetMsg().(*RunMessage_Output); ok {
-		return x.Output
+func (x *CreateAppRequest) GetTemplate() string {
+	if x != nil {
+		return x.Template
 	}
-	return nil
+	return ""
 }
 
-func (x *RunMessage) GetExit() *CommandExit {
-	if x, ok := x.GetMsg().(*RunMessage_Exit); ok {
-		return x.Exit
+func (x *CreateAppRequest) GetTutorial() bool {
+	if x != nil {
+		return x.Tutorial
 	}
-	return nil
-}
-
-type isRunMessage_Msg interface {
-	isRunMessage_Msg()
-}
-
-type RunMessage_Started struct {
-	Started *RunStarted `protobuf:"bytes,1,opt,name=started,proto3,oneof"`
-}
-
-type RunMessage_Output struct {
-	Output *CommandOutput `protobuf:"bytes,2,opt,name=output,proto3,oneof"`
-}
-
-type RunMessage_Exit struct {
-	Exit *CommandExit `protobuf:"bytes,3,opt,name=exit,proto3,oneof"`
+	return false
 }
 
-func (*RunMessage_Started) isRunMessage_Msg() {}
-
-func (*RunMessage_Output) isRunMessage_Msg() {}
-
-func (*RunMessage_Exit) isRunMessage_Msg() {}
-
-type RunStarted struct {
+type CreateAppResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	RunId     string `protobuf:"bytes,1,opt,name=run_id,json=runId,proto3" json:"run_id,omitempty"`
-	Port      int32  `protobuf:"varint,2,opt,name=port,proto3" json:"port,omitempty"`
-	TunnelUrl string `protobuf:"bytes,3,opt,name=tunnel_url,json=tunnelUrl,proto3" json:"tunnel_url,omitempty"`
-	Pid       int32  `protobuf:"varint,4,opt,name=pid,proto3" json:"pid,omitempty"`
+	AppId string `protobuf:"bytes,1,opt,name=app_id,json=appId,proto3" json:"app_id,omitempty"`
 }
 
-func (x *RunStarted) Reset() {
-	*x = RunStarted{}
+func (x *CreateAppResponse) Reset() {
+	*x = CreateAppResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_daemon_daemon_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -454,13 +602,13 @@ func (x *RunStarted) Reset() {
 	}
 }
 
-func (x *RunStarted) String() string {
+func (x *CreateAppResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*RunStarted) ProtoMessage() {}
+func (*CreateAppResponse) ProtoMessage() {}
 
-func (x *RunStarted) ProtoReflect() protoreflect.Message {
+func (x *CreateAppResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_daemon_daemon_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -472,51 +620,49 @@ func (x *RunStarted) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use RunStarted.ProtoReflect.Descriptor instead.
-func (*RunStarted) Descriptor() ([]byte, []int) {
+// Deprecated: Use CreateAppResponse.ProtoReflect.Descriptor instead.
+func (*CreateAppResponse) Descriptor() ([]byte, []int) {
 	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{5}
 }
 
-func (x *RunStarted) GetRunId() string {
-	if x != nil {
-		return x.RunId
-	}
-	return ""
-}
-
-func (x *RunStarted) GetPort() int32 {
-	if x != nil {
-		return x.Port
-	}
-	return 0
-}
-
-func (x *RunStarted) GetTunnelUrl() string {
+func (x *CreateAppResponse) GetAppId() string {
 	if x != nil {
-		return x.TunnelUrl
+		return x.AppId
 	}
 	return ""
 }
 
-func (x *RunStarted) GetPid() int32 {
-	if x != nil {
-		return x.Pid
-	}
-	return 0
-}
-
-type TestRequest struct {
+type RunRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	AppRoot    string   `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
-	WorkingDir string   `protobuf:"bytes,2,opt,name=working_dir,json=workingDir,proto3" json:"working_dir,omitempty"`
-	Args       []string `protobuf:"bytes,3,rep,name=args,proto3" json:"args,omitempty"`
+	// app_root is the absolute filesystem path to the Encore app root.
+	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	// working_dir is the working directory relative to the app_root,
+	// for formatting relative paths in error messages.
+	WorkingDir string `protobuf:"bytes,2,opt,name=working_dir,json=workingDir,proto3" json:"working_dir,omitempty"`
+	// watch, if true, enables live reloading of the app whenever the source changes.
+	Watch bool `protobuf:"varint,5,opt,name=watch,proto3" json:"watch,omitempty"`
+	// listen_addr is the address to listen on.
+	ListenAddr string `protobuf:"bytes,6,opt,name=listen_addr,json=listenAddr,proto3" json:"listen_addr,omitempty"`
+	// environ is the environment to set for the running command.
+	// Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+	Environ []string `protobuf:"bytes,7,rep,name=environ,proto3" json:"environ,omitempty"`
+	// trace_file, if set specifies a trace file to write trace information
+	// about the parse and compilation process to.
+	TraceFile *string `protobuf:"bytes,8,opt,name=trace_file,json=traceFile,proto3,oneof" json:"trace_file,omitempty"`
+	// namespace is the infrastructure namespace to use.
+	// If empty the active namespace is used.
+	Namespace *string `protobuf:"bytes,9,opt,name=namespace,proto3,oneof" json:"namespace,omitempty"`
+	// browser specifies whether and how to open the browser on startup.
+	Browser RunRequest_BrowserMode `protobuf:"varint,10,opt,name=browser,proto3,enum=encore.daemon.RunRequest_BrowserMode" json:"browser,omitempty"`
+	// debug_mode specifies the debug mode to use.
+	DebugMode RunRequest_DebugMode `protobuf:"varint,11,opt,name=debug_mode,json=debugMode,proto3,enum=encore.daemon.RunRequest_DebugMode" json:"debug_mode,omitempty"`
 }
 
-func (x *TestRequest) Reset() {
-	*x = TestRequest{}
+func (x *RunRequest) Reset() {
+	*x = RunRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_daemon_daemon_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -524,13 +670,13 @@ func (x *TestRequest) Reset() {
 	}
 }
 
-func (x *TestRequest) String() string {
+func (x *RunRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*TestRequest) ProtoMessage() {}
+func (*RunRequest) ProtoMessage() {}
 
-func (x *TestRequest) ProtoReflect() protoreflect.Message {
+func (x *RunRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_daemon_daemon_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -542,57 +688,108 @@ func (x *TestRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use TestRequest.ProtoReflect.Descriptor instead.
-func (*TestRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use RunRequest.ProtoReflect.Descriptor instead.
+func (*RunRequest) Descriptor() ([]byte, []int) {
 	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{6}
 }
 
-func (x *TestRequest) GetAppRoot() string {
+func (x *RunRequest) GetAppRoot() string {
 	if x != nil {
 		return x.AppRoot
 	}
 	return ""
 }
 
-func (x *TestRequest) GetWorkingDir() string {
+func (x *RunRequest) GetWorkingDir() string {
 	if x != nil {
 		return x.WorkingDir
 	}
 	return ""
 }
 
-func (x *TestRequest) GetArgs() []string {
+func (x *RunRequest) GetWatch() bool {
 	if x != nil {
-		return x.Args
+		return x.Watch
 	}
-	return nil
-}
-
-type CheckRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	AppRoot    string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
-	WorkingDir string `protobuf:"bytes,2,opt,name=working_dir,json=workingDir,proto3" json:"working_dir,omitempty"`
+	return false
 }
 
-func (x *CheckRequest) Reset() {
-	*x = CheckRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_daemon_daemon_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+func (x *RunRequest) GetListenAddr() string {
+	if x != nil {
+		return x.ListenAddr
 	}
+	return ""
 }
 
-func (x *CheckRequest) String() string {
+func (x *RunRequest) GetEnviron() []string {
+	if x != nil {
+		return x.Environ
+	}
+	return nil
+}
+
+func (x *RunRequest) GetTraceFile() string {
+	if x != nil && x.TraceFile != nil {
+		return *x.TraceFile
+	}
+	return ""
+}
+
+func (x *RunRequest) GetNamespace() string {
+	if x != nil && x.Namespace != nil {
+		return *x.Namespace
+	}
+	return ""
+}
+
+func (x *RunRequest) GetBrowser() RunRequest_BrowserMode {
+	if x != nil {
+		return x.Browser
+	}
+	return RunRequest_BROWSER_AUTO
+}
+
+func (x *RunRequest) GetDebugMode() RunRequest_DebugMode {
+	if x != nil {
+		return x.DebugMode
+	}
+	return RunRequest_DEBUG_DISABLED
+}
+
+type TestRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AppRoot    string   `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	WorkingDir string   `protobuf:"bytes,2,opt,name=working_dir,json=workingDir,proto3" json:"working_dir,omitempty"`
+	Args       []string `protobuf:"bytes,3,rep,name=args,proto3" json:"args,omitempty"`
+	// environ is the environment to set for the running command.
+	// Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+	Environ []string `protobuf:"bytes,4,rep,name=environ,proto3" json:"environ,omitempty"`
+	// trace_file, if set specifies a trace file to write trace information
+	// about the parse and compilation process to.
+	TraceFile *string `protobuf:"bytes,6,opt,name=trace_file,json=traceFile,proto3,oneof" json:"trace_file,omitempty"`
+	// codegen_debug, if true, dumps the generated code and prints where it is located.
+	CodegenDebug bool `protobuf:"varint,7,opt,name=codegen_debug,json=codegenDebug,proto3" json:"codegen_debug,omitempty"`
+}
+
+func (x *TestRequest) Reset() {
+	*x = TestRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TestRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*CheckRequest) ProtoMessage() {}
+func (*TestRequest) ProtoMessage() {}
 
-func (x *CheckRequest) ProtoReflect() protoreflect.Message {
+func (x *TestRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_daemon_daemon_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -604,36 +801,68 @@ func (x *CheckRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use CheckRequest.ProtoReflect.Descriptor instead.
-func (*CheckRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use TestRequest.ProtoReflect.Descriptor instead.
+func (*TestRequest) Descriptor() ([]byte, []int) {
 	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{7}
 }
 
-func (x *CheckRequest) GetAppRoot() string {
+func (x *TestRequest) GetAppRoot() string {
 	if x != nil {
 		return x.AppRoot
 	}
 	return ""
 }
 
-func (x *CheckRequest) GetWorkingDir() string {
+func (x *TestRequest) GetWorkingDir() string {
 	if x != nil {
 		return x.WorkingDir
 	}
 	return ""
 }
 
-type LogsRequest struct {
+func (x *TestRequest) GetArgs() []string {
+	if x != nil {
+		return x.Args
+	}
+	return nil
+}
+
+func (x *TestRequest) GetEnviron() []string {
+	if x != nil {
+		return x.Environ
+	}
+	return nil
+}
+
+func (x *TestRequest) GetTraceFile() string {
+	if x != nil && x.TraceFile != nil {
+		return *x.TraceFile
+	}
+	return ""
+}
+
+func (x *TestRequest) GetCodegenDebug() bool {
+	if x != nil {
+		return x.CodegenDebug
+	}
+	return false
+}
+
+type TestSpecRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
-	EnvName string `protobuf:"bytes,2,opt,name=env_name,json=envName,proto3" json:"env_name,omitempty"`
+	AppRoot    string   `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	WorkingDir string   `protobuf:"bytes,2,opt,name=working_dir,json=workingDir,proto3" json:"working_dir,omitempty"`
+	Args       []string `protobuf:"bytes,3,rep,name=args,proto3" json:"args,omitempty"`
+	// environ is the environment to set for the running command.
+	// Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+	Environ []string `protobuf:"bytes,4,rep,name=environ,proto3" json:"environ,omitempty"`
 }
 
-func (x *LogsRequest) Reset() {
-	*x = LogsRequest{}
+func (x *TestSpecRequest) Reset() {
+	*x = TestSpecRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_daemon_daemon_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -641,13 +870,13 @@ func (x *LogsRequest) Reset() {
 	}
 }
 
-func (x *LogsRequest) String() string {
+func (x *TestSpecRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*LogsRequest) ProtoMessage() {}
+func (*TestSpecRequest) ProtoMessage() {}
 
-func (x *LogsRequest) ProtoReflect() protoreflect.Message {
+func (x *TestSpecRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_daemon_daemon_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -659,36 +888,51 @@ func (x *LogsRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use LogsRequest.ProtoReflect.Descriptor instead.
-func (*LogsRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use TestSpecRequest.ProtoReflect.Descriptor instead.
+func (*TestSpecRequest) Descriptor() ([]byte, []int) {
 	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{8}
 }
 
-func (x *LogsRequest) GetAppRoot() string {
+func (x *TestSpecRequest) GetAppRoot() string {
 	if x != nil {
 		return x.AppRoot
 	}
 	return ""
 }
 
-func (x *LogsRequest) GetEnvName() string {
+func (x *TestSpecRequest) GetWorkingDir() string {
 	if x != nil {
-		return x.EnvName
+		return x.WorkingDir
 	}
 	return ""
 }
 
-type LogsMessage struct {
+func (x *TestSpecRequest) GetArgs() []string {
+	if x != nil {
+		return x.Args
+	}
+	return nil
+}
+
+func (x *TestSpecRequest) GetEnviron() []string {
+	if x != nil {
+		return x.Environ
+	}
+	return nil
+}
+
+type TestSpecResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Lines      [][]byte `protobuf:"bytes,1,rep,name=lines,proto3" json:"lines,omitempty"`
-	DropNotice bool     `protobuf:"varint,2,opt,name=drop_notice,json=dropNotice,proto3" json:"drop_notice,omitempty"`
+	Command string   `protobuf:"bytes,1,opt,name=command,proto3" json:"command,omitempty"`
+	Args    []string `protobuf:"bytes,2,rep,name=args,proto3" json:"args,omitempty"`
+	Environ []string `protobuf:"bytes,3,rep,name=environ,proto3" json:"environ,omitempty"`
 }
 
-func (x *LogsMessage) Reset() {
-	*x = LogsMessage{}
+func (x *TestSpecResponse) Reset() {
+	*x = TestSpecResponse{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_daemon_daemon_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -696,13 +940,13 @@ func (x *LogsMessage) Reset() {
 	}
 }
 
-func (x *LogsMessage) String() string {
+func (x *TestSpecResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*LogsMessage) ProtoMessage() {}
+func (*TestSpecResponse) ProtoMessage() {}
 
-func (x *LogsMessage) ProtoReflect() protoreflect.Message {
+func (x *TestSpecResponse) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_daemon_daemon_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -714,36 +958,53 @@ func (x *LogsMessage) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use LogsMessage.ProtoReflect.Descriptor instead.
-func (*LogsMessage) Descriptor() ([]byte, []int) {
+// Deprecated: Use TestSpecResponse.ProtoReflect.Descriptor instead.
+func (*TestSpecResponse) Descriptor() ([]byte, []int) {
 	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{9}
 }
 
-func (x *LogsMessage) GetLines() [][]byte {
+func (x *TestSpecResponse) GetCommand() string {
+	if x != nil {
+		return x.Command
+	}
+	return ""
+}
+
+func (x *TestSpecResponse) GetArgs() []string {
 	if x != nil {
-		return x.Lines
+		return x.Args
 	}
 	return nil
 }
 
-func (x *LogsMessage) GetDropNotice() bool {
+func (x *TestSpecResponse) GetEnviron() []string {
 	if x != nil {
-		return x.DropNotice
+		return x.Environ
 	}
-	return false
+	return nil
 }
 
-type ResetDBRequest struct {
+type ExecScriptRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	AppRoot  string   `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
-	Services []string `protobuf:"bytes,2,rep,name=services,proto3" json:"services,omitempty"` // services to reset
-}
-
-func (x *ResetDBRequest) Reset() {
-	*x = ResetDBRequest{}
+	AppRoot    string   `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	WorkingDir string   `protobuf:"bytes,2,opt,name=working_dir,json=workingDir,proto3" json:"working_dir,omitempty"`
+	ScriptArgs []string `protobuf:"bytes,4,rep,name=script_args,json=scriptArgs,proto3" json:"script_args,omitempty"`
+	// environ is the environment to set for the running command.
+	// Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+	Environ []string `protobuf:"bytes,5,rep,name=environ,proto3" json:"environ,omitempty"`
+	// trace_file, if set specifies a trace file to write trace information
+	// about the parse and compilation process to.
+	TraceFile *string `protobuf:"bytes,6,opt,name=trace_file,json=traceFile,proto3,oneof" json:"trace_file,omitempty"`
+	// namespace is the infrastructure namespace to use.
+	// If empty the active namespace is used.
+	Namespace *string `protobuf:"bytes,7,opt,name=namespace,proto3,oneof" json:"namespace,omitempty"`
+}
+
+func (x *ExecScriptRequest) Reset() {
+	*x = ExecScriptRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_daemon_daemon_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -751,13 +1012,13 @@ func (x *ResetDBRequest) Reset() {
 	}
 }
 
-func (x *ResetDBRequest) String() string {
+func (x *ExecScriptRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*ResetDBRequest) ProtoMessage() {}
+func (*ExecScriptRequest) ProtoMessage() {}
 
-func (x *ResetDBRequest) ProtoReflect() protoreflect.Message {
+func (x *ExecScriptRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_daemon_daemon_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -769,37 +1030,71 @@ func (x *ResetDBRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use ResetDBRequest.ProtoReflect.Descriptor instead.
-func (*ResetDBRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use ExecScriptRequest.ProtoReflect.Descriptor instead.
+func (*ExecScriptRequest) Descriptor() ([]byte, []int) {
 	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{10}
 }
 
-func (x *ResetDBRequest) GetAppRoot() string {
+func (x *ExecScriptRequest) GetAppRoot() string {
 	if x != nil {
 		return x.AppRoot
 	}
 	return ""
 }
 
-func (x *ResetDBRequest) GetServices() []string {
+func (x *ExecScriptRequest) GetWorkingDir() string {
 	if x != nil {
-		return x.Services
+		return x.WorkingDir
+	}
+	return ""
+}
+
+func (x *ExecScriptRequest) GetScriptArgs() []string {
+	if x != nil {
+		return x.ScriptArgs
 	}
 	return nil
 }
 
-type DBConnectRequest struct {
+func (x *ExecScriptRequest) GetEnviron() []string {
+	if x != nil {
+		return x.Environ
+	}
+	return nil
+}
+
+func (x *ExecScriptRequest) GetTraceFile() string {
+	if x != nil && x.TraceFile != nil {
+		return *x.TraceFile
+	}
+	return ""
+}
+
+func (x *ExecScriptRequest) GetNamespace() string {
+	if x != nil && x.Namespace != nil {
+		return *x.Namespace
+	}
+	return ""
+}
+
+type CheckRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
-	SvcName string `protobuf:"bytes,2,opt,name=svc_name,json=svcName,proto3" json:"svc_name,omitempty"`
-	EnvName string `protobuf:"bytes,3,opt,name=env_name,json=envName,proto3" json:"env_name,omitempty"` // optional
+	AppRoot    string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	WorkingDir string `protobuf:"bytes,2,opt,name=working_dir,json=workingDir,proto3" json:"working_dir,omitempty"`
+	// codegen_debug, if true, dumps the generated code and prints where it is located.
+	CodegenDebug bool `protobuf:"varint,3,opt,name=codegen_debug,json=codegenDebug,proto3" json:"codegen_debug,omitempty"`
+	// parse_tests, if true, exercises test parsing and codegen as well.
+	ParseTests bool `protobuf:"varint,4,opt,name=parse_tests,json=parseTests,proto3" json:"parse_tests,omitempty"`
+	// environ is the environment to set for the running command.
+	// Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+	Environ []string `protobuf:"bytes,5,rep,name=environ,proto3" json:"environ,omitempty"`
 }
 
-func (x *DBConnectRequest) Reset() {
-	*x = DBConnectRequest{}
+func (x *CheckRequest) Reset() {
+	*x = CheckRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_daemon_daemon_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -807,13 +1102,13 @@ func (x *DBConnectRequest) Reset() {
 	}
 }
 
-func (x *DBConnectRequest) String() string {
+func (x *CheckRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*DBConnectRequest) ProtoMessage() {}
+func (*CheckRequest) ProtoMessage() {}
 
-func (x *DBConnectRequest) ProtoReflect() protoreflect.Message {
+func (x *CheckRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_daemon_daemon_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -825,42 +1120,77 @@ func (x *DBConnectRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use DBConnectRequest.ProtoReflect.Descriptor instead.
-func (*DBConnectRequest) Descriptor() ([]byte, []int) {
+// Deprecated: Use CheckRequest.ProtoReflect.Descriptor instead.
+func (*CheckRequest) Descriptor() ([]byte, []int) {
 	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{11}
 }
 
-func (x *DBConnectRequest) GetAppRoot() string {
+func (x *CheckRequest) GetAppRoot() string {
 	if x != nil {
 		return x.AppRoot
 	}
 	return ""
 }
 
-func (x *DBConnectRequest) GetSvcName() string {
+func (x *CheckRequest) GetWorkingDir() string {
 	if x != nil {
-		return x.SvcName
+		return x.WorkingDir
 	}
 	return ""
 }
 
-func (x *DBConnectRequest) GetEnvName() string {
+func (x *CheckRequest) GetCodegenDebug() bool {
 	if x != nil {
-		return x.EnvName
+		return x.CodegenDebug
 	}
-	return ""
+	return false
 }
 
-type DBConnectResponse struct {
+func (x *CheckRequest) GetParseTests() bool {
+	if x != nil {
+		return x.ParseTests
+	}
+	return false
+}
+
+func (x *CheckRequest) GetEnviron() []string {
+	if x != nil {
+		return x.Environ
+	}
+	return nil
+}
+
+type ExportRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Dsn string `protobuf:"bytes,1,opt,name=dsn,proto3" json:"dsn,omitempty"`
-}
-
-func (x *DBConnectResponse) Reset() {
-	*x = DBConnectResponse{}
+	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	// goos and goarch specify the platform configuration to compile
+	// the application for. The values must be valid GOOS/GOARCH values.
+	Goos   string `protobuf:"bytes,2,opt,name=goos,proto3" json:"goos,omitempty"`
+	Goarch string `protobuf:"bytes,3,opt,name=goarch,proto3" json:"goarch,omitempty"`
+	// cgo_enabled specifies whether to build with cgo enabled.
+	// The host must have a valid C compiler for the target platform
+	// if true.
+	CgoEnabled bool `protobuf:"varint,4,opt,name=cgo_enabled,json=cgoEnabled,proto3" json:"cgo_enabled,omitempty"`
+	// environ is the environment to set for the running command.
+	// Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+	Environ []string `protobuf:"bytes,5,rep,name=environ,proto3" json:"environ,omitempty"`
+	// Types that are assignable to Format:
+	//
+	//	*ExportRequest_Docker
+	Format        isExportRequest_Format `protobuf_oneof:"format"`
+	InfraConfPath string                 `protobuf:"bytes,7,opt,name=infra_conf_path,json=infraConfPath,proto3" json:"infra_conf_path,omitempty"`
+	Services      []string               `protobuf:"bytes,8,rep,name=services,proto3" json:"services,omitempty"`
+	Gateways      []string               `protobuf:"bytes,9,rep,name=gateways,proto3" json:"gateways,omitempty"`
+	SkipInfraConf bool                   `protobuf:"varint,10,opt,name=skip_infra_conf,json=skipInfraConf,proto3" json:"skip_infra_conf,omitempty"`
+	// A parent path to app_root containing the .git, or the same as app_root
+	WorkspaceRoot string `protobuf:"bytes,11,opt,name=workspace_root,json=workspaceRoot,proto3" json:"workspace_root,omitempty"`
+}
+
+func (x *ExportRequest) Reset() {
+	*x = ExportRequest{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_daemon_daemon_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -868,13 +1198,13 @@ func (x *DBConnectResponse) Reset() {
 	}
 }
 
-func (x *DBConnectResponse) String() string {
+func (x *ExportRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*DBConnectResponse) ProtoMessage() {}
+func (*ExportRequest) ProtoMessage() {}
 
-func (x *DBConnectResponse) ProtoReflect() protoreflect.Message {
+func (x *ExportRequest) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_daemon_daemon_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -886,107 +1216,140 @@ func (x *DBConnectResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use DBConnectResponse.ProtoReflect.Descriptor instead.
-func (*DBConnectResponse) Descriptor() ([]byte, []int) {
+// Deprecated: Use ExportRequest.ProtoReflect.Descriptor instead.
+func (*ExportRequest) Descriptor() ([]byte, []int) {
 	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{12}
 }
 
-func (x *DBConnectResponse) GetDsn() string {
+func (x *ExportRequest) GetAppRoot() string {
 	if x != nil {
-		return x.Dsn
+		return x.AppRoot
 	}
 	return ""
 }
 
-type DBProxyRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
-	EnvName string `protobuf:"bytes,2,opt,name=env_name,json=envName,proto3" json:"env_name,omitempty"` // optional
-	Port    int32  `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`                     // optional
+func (x *ExportRequest) GetGoos() string {
+	if x != nil {
+		return x.Goos
+	}
+	return ""
 }
 
-func (x *DBProxyRequest) Reset() {
-	*x = DBProxyRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_daemon_daemon_proto_msgTypes[13]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+func (x *ExportRequest) GetGoarch() string {
+	if x != nil {
+		return x.Goarch
 	}
+	return ""
 }
 
-func (x *DBProxyRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
+func (x *ExportRequest) GetCgoEnabled() bool {
+	if x != nil {
+		return x.CgoEnabled
+	}
+	return false
 }
 
-func (*DBProxyRequest) ProtoMessage() {}
+func (x *ExportRequest) GetEnviron() []string {
+	if x != nil {
+		return x.Environ
+	}
+	return nil
+}
 
-func (x *DBProxyRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_daemon_daemon_proto_msgTypes[13]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
+func (m *ExportRequest) GetFormat() isExportRequest_Format {
+	if m != nil {
+		return m.Format
 	}
-	return mi.MessageOf(x)
+	return nil
 }
 
-// Deprecated: Use DBProxyRequest.ProtoReflect.Descriptor instead.
-func (*DBProxyRequest) Descriptor() ([]byte, []int) {
-	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{13}
+func (x *ExportRequest) GetDocker() *DockerExportParams {
+	if x, ok := x.GetFormat().(*ExportRequest_Docker); ok {
+		return x.Docker
+	}
+	return nil
 }
 
-func (x *DBProxyRequest) GetAppRoot() string {
+func (x *ExportRequest) GetInfraConfPath() string {
 	if x != nil {
-		return x.AppRoot
+		return x.InfraConfPath
 	}
 	return ""
 }
 
-func (x *DBProxyRequest) GetEnvName() string {
+func (x *ExportRequest) GetServices() []string {
 	if x != nil {
-		return x.EnvName
+		return x.Services
 	}
-	return ""
+	return nil
 }
 
-func (x *DBProxyRequest) GetPort() int32 {
+func (x *ExportRequest) GetGateways() []string {
 	if x != nil {
-		return x.Port
+		return x.Gateways
 	}
-	return 0
+	return nil
 }
 
-type DBResetRequest struct {
+func (x *ExportRequest) GetSkipInfraConf() bool {
+	if x != nil {
+		return x.SkipInfraConf
+	}
+	return false
+}
+
+func (x *ExportRequest) GetWorkspaceRoot() string {
+	if x != nil {
+		return x.WorkspaceRoot
+	}
+	return ""
+}
+
+type isExportRequest_Format interface {
+	isExportRequest_Format()
+}
+
+type ExportRequest_Docker struct {
+	// docker specifies to export the app as a docker image.
+	Docker *DockerExportParams `protobuf:"bytes,6,opt,name=docker,proto3,oneof"`
+}
+
+func (*ExportRequest_Docker) isExportRequest_Format() {}
+
+type DockerExportParams struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	AppRoot  string   `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
-	Services []string `protobuf:"bytes,2,rep,name=services,proto3" json:"services,omitempty"` // services to reset
+	// local_daemon_tag specifies what to tag the image as
+	// in the local Docker daemon. If empty the export does not
+	// interact with (or require) the local docker daemon at all.
+	LocalDaemonTag string `protobuf:"bytes,1,opt,name=local_daemon_tag,json=localDaemonTag,proto3" json:"local_daemon_tag,omitempty"`
+	// push_destination_tag specifies the remote registry tag
+	// to push the exported image to. If empty the built image
+	// is not pushed anywhere.
+	PushDestinationTag string `protobuf:"bytes,2,opt,name=push_destination_tag,json=pushDestinationTag,proto3" json:"push_destination_tag,omitempty"`
+	// base_image_tag is the base image to build the image from.
+	BaseImageTag string `protobuf:"bytes,3,opt,name=base_image_tag,json=baseImageTag,proto3" json:"base_image_tag,omitempty"`
 }
 
-func (x *DBResetRequest) Reset() {
-	*x = DBResetRequest{}
+func (x *DockerExportParams) Reset() {
+	*x = DockerExportParams{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_daemon_daemon_proto_msgTypes[14]
+		mi := &file_encore_daemon_daemon_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *DBResetRequest) String() string {
+func (x *DockerExportParams) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*DBResetRequest) ProtoMessage() {}
+func (*DockerExportParams) ProtoMessage() {}
 
-func (x *DBResetRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_daemon_daemon_proto_msgTypes[14]
+func (x *DockerExportParams) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -997,53 +1360,64 @@ func (x *DBResetRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use DBResetRequest.ProtoReflect.Descriptor instead.
-func (*DBResetRequest) Descriptor() ([]byte, []int) {
-	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{14}
+// Deprecated: Use DockerExportParams.ProtoReflect.Descriptor instead.
+func (*DockerExportParams) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{13}
 }
 
-func (x *DBResetRequest) GetAppRoot() string {
+func (x *DockerExportParams) GetLocalDaemonTag() string {
 	if x != nil {
-		return x.AppRoot
+		return x.LocalDaemonTag
 	}
 	return ""
 }
 
-func (x *DBResetRequest) GetServices() []string {
+func (x *DockerExportParams) GetPushDestinationTag() string {
 	if x != nil {
-		return x.Services
+		return x.PushDestinationTag
 	}
-	return nil
+	return ""
 }
 
-type GenClientRequest struct {
+func (x *DockerExportParams) GetBaseImageTag() string {
+	if x != nil {
+		return x.BaseImageTag
+	}
+	return ""
+}
+
+type DBConnectRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	AppId    string `protobuf:"bytes,1,opt,name=app_id,json=appId,proto3" json:"app_id,omitempty"`
-	EnvName  string `protobuf:"bytes,2,opt,name=env_name,json=envName,proto3" json:"env_name,omitempty"`
-	Lang     string `protobuf:"bytes,3,opt,name=lang,proto3" json:"lang,omitempty"`
-	Filepath string `protobuf:"bytes,4,opt,name=filepath,proto3" json:"filepath,omitempty"`
+	AppRoot     string        `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	DbName      string        `protobuf:"bytes,2,opt,name=db_name,json=dbName,proto3" json:"db_name,omitempty"`
+	EnvName     string        `protobuf:"bytes,3,opt,name=env_name,json=envName,proto3" json:"env_name,omitempty"` // optional
+	ClusterType DBClusterType `protobuf:"varint,4,opt,name=cluster_type,json=clusterType,proto3,enum=encore.daemon.DBClusterType" json:"cluster_type,omitempty"`
+	// namespace is the infrastructure namespace to use.
+	// If empty the active namespace is used.
+	Namespace *string `protobuf:"bytes,5,opt,name=namespace,proto3,oneof" json:"namespace,omitempty"`
+	Role      DBRole  `protobuf:"varint,6,opt,name=role,proto3,enum=encore.daemon.DBRole" json:"role,omitempty"`
 }
 
-func (x *GenClientRequest) Reset() {
-	*x = GenClientRequest{}
+func (x *DBConnectRequest) Reset() {
+	*x = DBConnectRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_daemon_daemon_proto_msgTypes[15]
+		mi := &file_encore_daemon_daemon_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *GenClientRequest) String() string {
+func (x *DBConnectRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*GenClientRequest) ProtoMessage() {}
+func (*DBConnectRequest) ProtoMessage() {}
 
-func (x *GenClientRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_daemon_daemon_proto_msgTypes[15]
+func (x *DBConnectRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1054,64 +1428,78 @@ func (x *GenClientRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use GenClientRequest.ProtoReflect.Descriptor instead.
-func (*GenClientRequest) Descriptor() ([]byte, []int) {
-	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{15}
+// Deprecated: Use DBConnectRequest.ProtoReflect.Descriptor instead.
+func (*DBConnectRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{14}
 }
 
-func (x *GenClientRequest) GetAppId() string {
+func (x *DBConnectRequest) GetAppRoot() string {
 	if x != nil {
-		return x.AppId
+		return x.AppRoot
 	}
 	return ""
 }
 
-func (x *GenClientRequest) GetEnvName() string {
+func (x *DBConnectRequest) GetDbName() string {
 	if x != nil {
-		return x.EnvName
+		return x.DbName
 	}
 	return ""
 }
 
-func (x *GenClientRequest) GetLang() string {
+func (x *DBConnectRequest) GetEnvName() string {
 	if x != nil {
-		return x.Lang
+		return x.EnvName
 	}
 	return ""
 }
 
-func (x *GenClientRequest) GetFilepath() string {
+func (x *DBConnectRequest) GetClusterType() DBClusterType {
 	if x != nil {
-		return x.Filepath
+		return x.ClusterType
+	}
+	return DBClusterType_DB_CLUSTER_TYPE_UNSPECIFIED
+}
+
+func (x *DBConnectRequest) GetNamespace() string {
+	if x != nil && x.Namespace != nil {
+		return *x.Namespace
 	}
 	return ""
 }
 
-type GenClientResponse struct {
+func (x *DBConnectRequest) GetRole() DBRole {
+	if x != nil {
+		return x.Role
+	}
+	return DBRole_DB_ROLE_UNSPECIFIED
+}
+
+type DBConnectResponse struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Code []byte `protobuf:"bytes,1,opt,name=code,proto3" json:"code,omitempty"`
+	Dsn string `protobuf:"bytes,1,opt,name=dsn,proto3" json:"dsn,omitempty"`
 }
 
-func (x *GenClientResponse) Reset() {
-	*x = GenClientResponse{}
+func (x *DBConnectResponse) Reset() {
+	*x = DBConnectResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_daemon_daemon_proto_msgTypes[16]
+		mi := &file_encore_daemon_daemon_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *GenClientResponse) String() string {
+func (x *DBConnectResponse) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*GenClientResponse) ProtoMessage() {}
+func (*DBConnectResponse) ProtoMessage() {}
 
-func (x *GenClientResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_daemon_daemon_proto_msgTypes[16]
+func (x *DBConnectResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1122,46 +1510,50 @@ func (x *GenClientResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use GenClientResponse.ProtoReflect.Descriptor instead.
-func (*GenClientResponse) Descriptor() ([]byte, []int) {
-	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{16}
+// Deprecated: Use DBConnectResponse.ProtoReflect.Descriptor instead.
+func (*DBConnectResponse) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{15}
 }
 
-func (x *GenClientResponse) GetCode() []byte {
+func (x *DBConnectResponse) GetDsn() string {
 	if x != nil {
-		return x.Code
+		return x.Dsn
 	}
-	return nil
+	return ""
 }
 
-type SetSecretRequest struct {
+type DBProxyRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	AppRoot string                `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
-	Key     string                `protobuf:"bytes,2,opt,name=key,proto3" json:"key,omitempty"`
-	Value   string                `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"`
-	Type    SetSecretRequest_Type `protobuf:"varint,4,opt,name=type,proto3,enum=encore.daemon.SetSecretRequest_Type" json:"type,omitempty"`
+	AppRoot     string        `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	EnvName     string        `protobuf:"bytes,2,opt,name=env_name,json=envName,proto3" json:"env_name,omitempty"` // optional
+	Port        int32         `protobuf:"varint,3,opt,name=port,proto3" json:"port,omitempty"`                     // optional
+	ClusterType DBClusterType `protobuf:"varint,4,opt,name=cluster_type,json=clusterType,proto3,enum=encore.daemon.DBClusterType" json:"cluster_type,omitempty"`
+	// namespace is the infrastructure namespace to use.
+	// If empty the active namespace is used.
+	Namespace *string `protobuf:"bytes,5,opt,name=namespace,proto3,oneof" json:"namespace,omitempty"`
+	Role      DBRole  `protobuf:"varint,6,opt,name=role,proto3,enum=encore.daemon.DBRole" json:"role,omitempty"`
 }
 
-func (x *SetSecretRequest) Reset() {
-	*x = SetSecretRequest{}
+func (x *DBProxyRequest) Reset() {
+	*x = DBProxyRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_daemon_daemon_proto_msgTypes[17]
+		mi := &file_encore_daemon_daemon_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *SetSecretRequest) String() string {
+func (x *DBProxyRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*SetSecretRequest) ProtoMessage() {}
+func (*DBProxyRequest) ProtoMessage() {}
 
-func (x *SetSecretRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_daemon_daemon_proto_msgTypes[17]
+func (x *DBProxyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1172,64 +1564,83 @@ func (x *SetSecretRequest) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use SetSecretRequest.ProtoReflect.Descriptor instead.
-func (*SetSecretRequest) Descriptor() ([]byte, []int) {
-	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{17}
+// Deprecated: Use DBProxyRequest.ProtoReflect.Descriptor instead.
+func (*DBProxyRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{16}
 }
 
-func (x *SetSecretRequest) GetAppRoot() string {
+func (x *DBProxyRequest) GetAppRoot() string {
 	if x != nil {
 		return x.AppRoot
 	}
 	return ""
 }
 
-func (x *SetSecretRequest) GetKey() string {
+func (x *DBProxyRequest) GetEnvName() string {
 	if x != nil {
-		return x.Key
+		return x.EnvName
 	}
 	return ""
 }
 
-func (x *SetSecretRequest) GetValue() string {
+func (x *DBProxyRequest) GetPort() int32 {
 	if x != nil {
-		return x.Value
+		return x.Port
+	}
+	return 0
+}
+
+func (x *DBProxyRequest) GetClusterType() DBClusterType {
+	if x != nil {
+		return x.ClusterType
+	}
+	return DBClusterType_DB_CLUSTER_TYPE_UNSPECIFIED
+}
+
+func (x *DBProxyRequest) GetNamespace() string {
+	if x != nil && x.Namespace != nil {
+		return *x.Namespace
 	}
 	return ""
 }
 
-func (x *SetSecretRequest) GetType() SetSecretRequest_Type {
+func (x *DBProxyRequest) GetRole() DBRole {
 	if x != nil {
-		return x.Type
+		return x.Role
 	}
-	return SetSecretRequest_DEVELOPMENT
+	return DBRole_DB_ROLE_UNSPECIFIED
 }
 
-type SetSecretResponse struct {
+type DBResetRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Created bool `protobuf:"varint,1,opt,name=created,proto3" json:"created,omitempty"` // whether or not the secret was created (as opposed to updated)
+	AppRoot       string        `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	DatabaseNames []string      `protobuf:"bytes,2,rep,name=database_names,json=databaseNames,proto3" json:"database_names,omitempty"` // database names to reset
+	ClusterType   DBClusterType `protobuf:"varint,3,opt,name=cluster_type,json=clusterType,proto3,enum=encore.daemon.DBClusterType" json:"cluster_type,omitempty"`
+	// namespace is the infrastructure namespace to use.
+	// If empty the active namespace is used.
+	Namespace *string `protobuf:"bytes,4,opt,name=namespace,proto3,oneof" json:"namespace,omitempty"`
 }
 
-func (x *SetSecretResponse) Reset() {
-	*x = SetSecretResponse{}
+func (x *DBResetRequest) Reset() {
+	*x = DBResetRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_daemon_daemon_proto_msgTypes[18]
+		mi := &file_encore_daemon_daemon_proto_msgTypes[17]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *SetSecretResponse) String() string {
+func (x *DBResetRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*SetSecretResponse) ProtoMessage() {}
+func (*DBResetRequest) ProtoMessage() {}
 
-func (x *SetSecretResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_daemon_daemon_proto_msgTypes[18]
+func (x *DBResetRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[17]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1240,43 +1651,92 @@ func (x *SetSecretResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use SetSecretResponse.ProtoReflect.Descriptor instead.
-func (*SetSecretResponse) Descriptor() ([]byte, []int) {
-	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{18}
+// Deprecated: Use DBResetRequest.ProtoReflect.Descriptor instead.
+func (*DBResetRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{17}
 }
 
-func (x *SetSecretResponse) GetCreated() bool {
+func (x *DBResetRequest) GetAppRoot() string {
 	if x != nil {
-		return x.Created
+		return x.AppRoot
 	}
-	return false
+	return ""
 }
 
-type VersionResponse struct {
+func (x *DBResetRequest) GetDatabaseNames() []string {
+	if x != nil {
+		return x.DatabaseNames
+	}
+	return nil
+}
+
+func (x *DBResetRequest) GetClusterType() DBClusterType {
+	if x != nil {
+		return x.ClusterType
+	}
+	return DBClusterType_DB_CLUSTER_TYPE_UNSPECIFIED
+}
+
+func (x *DBResetRequest) GetNamespace() string {
+	if x != nil && x.Namespace != nil {
+		return *x.Namespace
+	}
+	return ""
+}
+
+type GenClientRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
+	AppId    string `protobuf:"bytes,1,opt,name=app_id,json=appId,proto3" json:"app_id,omitempty"`
+	EnvName  string `protobuf:"bytes,2,opt,name=env_name,json=envName,proto3" json:"env_name,omitempty"`
+	Lang     string `protobuf:"bytes,3,opt,name=lang,proto3" json:"lang,omitempty"`
+	Filepath string `protobuf:"bytes,4,opt,name=filepath,proto3" json:"filepath,omitempty"`
+	// Services to include in the output.
+	// If the string "*" is present all services are included.
+	Services []string `protobuf:"bytes,5,rep,name=services,proto3" json:"services,omitempty"`
+	// Services to exclude from the output.
+	// Takes precedence over 'services' above.
+	ExcludedServices []string `protobuf:"bytes,6,rep,name=excluded_services,json=excludedServices,proto3" json:"excluded_services,omitempty"`
+	// Tags of endpoints to include in the output.
+	// Only includes endpoints from services included in 'services' above.
+	EndpointTags []string `protobuf:"bytes,7,rep,name=endpoint_tags,json=endpointTags,proto3" json:"endpoint_tags,omitempty"`
+	// Tags of endpoints to exclude from the output.
+	// Takes precedence over 'endpoint_tags' above.
+	ExcludedEndpointTags []string `protobuf:"bytes,8,rep,name=excluded_endpoint_tags,json=excludedEndpointTags,proto3" json:"excluded_endpoint_tags,omitempty"`
+	// The OpenAPI spec generator by default includes private endpoints.
+	// If this is set to `true`, private endpoints will not be included
+	// in the generated OpenAPI spec.
+	OpenapiExcludePrivateEndpoints *bool `protobuf:"varint,9,opt,name=openapi_exclude_private_endpoints,json=openapiExcludePrivateEndpoints,proto3,oneof" json:"openapi_exclude_private_endpoints,omitempty"`
+	// The TS generator by default re-declares the api types in the client.
+	// If this is set to `true`, the types will be imported and shared between
+	// the client and the server. It assumes "~backend" is available in the
+	// import path.
+	TsSharedTypes *bool `protobuf:"varint,10,opt,name=ts_shared_types,json=tsSharedTypes,proto3,oneof" json:"ts_shared_types,omitempty"`
+	// If set, the default export of the generate TypeScript client will be
+	// an instantiated client with the given target. The target can be e.g.
+	// a variable, e.g. "import.meta.env.VITE_CLIENT_TARGET" or a string literal.
+	TsClientTarget *string `protobuf:"bytes,11,opt,name=ts_client_target,json=tsClientTarget,proto3,oneof" json:"ts_client_target,omitempty"`
 }
 
-func (x *VersionResponse) Reset() {
-	*x = VersionResponse{}
+func (x *GenClientRequest) Reset() {
+	*x = GenClientRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_daemon_daemon_proto_msgTypes[19]
+		mi := &file_encore_daemon_daemon_proto_msgTypes[18]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *VersionResponse) String() string {
+func (x *GenClientRequest) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*VersionResponse) ProtoMessage() {}
+func (*GenClientRequest) ProtoMessage() {}
 
-func (x *VersionResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_daemon_daemon_proto_msgTypes[19]
+func (x *GenClientRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[18]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1287,264 +1747,2897 @@ func (x *VersionResponse) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use VersionResponse.ProtoReflect.Descriptor instead.
-func (*VersionResponse) Descriptor() ([]byte, []int) {
-	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{19}
+// Deprecated: Use GenClientRequest.ProtoReflect.Descriptor instead.
+func (*GenClientRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{18}
 }
 
-func (x *VersionResponse) GetVersion() string {
+func (x *GenClientRequest) GetAppId() string {
 	if x != nil {
-		return x.Version
+		return x.AppId
 	}
 	return ""
 }
 
-var File_encore_daemon_daemon_proto protoreflect.FileDescriptor
+func (x *GenClientRequest) GetEnvName() string {
+	if x != nil {
+		return x.EnvName
+	}
+	return ""
+}
 
-var file_encore_daemon_daemon_proto_rawDesc = []byte{
-	0x0a, 0x1a, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2f,
-	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x65, 0x6e,
-	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x1a, 0x1b, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70,
-	0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x81, 0x01, 0x0a, 0x0e, 0x43, 0x6f, 0x6d,
-	0x6d, 0x61, 0x6e, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x36, 0x0a, 0x06, 0x6f,
-	0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e,
-	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d,
-	0x61, 0x6e, 0x64, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x48, 0x00, 0x52, 0x06, 0x6f, 0x75, 0x74,
-	0x70, 0x75, 0x74, 0x12, 0x30, 0x0a, 0x04, 0x65, 0x78, 0x69, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x45, 0x78, 0x69, 0x74, 0x48, 0x00, 0x52,
-	0x04, 0x65, 0x78, 0x69, 0x74, 0x42, 0x05, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0x3f, 0x0a, 0x0d,
-	0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12, 0x16, 0x0a,
-	0x06, 0x73, 0x74, 0x64, 0x6f, 0x75, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x73,
-	0x74, 0x64, 0x6f, 0x75, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x64, 0x65, 0x72, 0x72, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x73, 0x74, 0x64, 0x65, 0x72, 0x72, 0x22, 0x21, 0x0a,
-	0x0b, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x45, 0x78, 0x69, 0x74, 0x12, 0x12, 0x0a, 0x04,
-	0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x04, 0x63, 0x6f, 0x64, 0x65,
-	0x22, 0x8c, 0x01, 0x0a, 0x0a, 0x52, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x77, 0x6f,
-	0x72, 0x6b, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x69, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0a, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x44, 0x69, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x74,
-	0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x74, 0x75, 0x6e,
-	0x6e, 0x65, 0x6c, 0x12, 0x14, 0x0a, 0x05, 0x64, 0x65, 0x62, 0x75, 0x67, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x08, 0x52, 0x05, 0x64, 0x65, 0x62, 0x75, 0x67, 0x12, 0x14, 0x0a, 0x05, 0x77, 0x61, 0x74,
-	0x63, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x77, 0x61, 0x74, 0x63, 0x68, 0x22,
-	0xb4, 0x01, 0x0a, 0x0a, 0x52, 0x75, 0x6e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x35,
-	0x0a, 0x07, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x19, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e,
-	0x52, 0x75, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x48, 0x00, 0x52, 0x07, 0x73, 0x74,
-	0x61, 0x72, 0x74, 0x65, 0x64, 0x12, 0x36, 0x0a, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64,
-	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4f, 0x75, 0x74,
-	0x70, 0x75, 0x74, 0x48, 0x00, 0x52, 0x06, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12, 0x30, 0x0a,
-	0x04, 0x65, 0x78, 0x69, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x65, 0x6e,
-	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d,
-	0x61, 0x6e, 0x64, 0x45, 0x78, 0x69, 0x74, 0x48, 0x00, 0x52, 0x04, 0x65, 0x78, 0x69, 0x74, 0x42,
-	0x05, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0x68, 0x0a, 0x0a, 0x52, 0x75, 0x6e, 0x53, 0x74, 0x61,
-	0x72, 0x74, 0x65, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x72, 0x75, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x72, 0x75, 0x6e, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x70,
-	0x6f, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12,
-	0x1d, 0x0a, 0x0a, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x03, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x55, 0x72, 0x6c, 0x12, 0x10,
-	0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x03, 0x70, 0x69, 0x64,
-	0x22, 0x5d, 0x0a, 0x0b, 0x54, 0x65, 0x73, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x77, 0x6f,
-	0x72, 0x6b, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x69, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0a, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x44, 0x69, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x61,
-	0x72, 0x67, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x61, 0x72, 0x67, 0x73, 0x22,
-	0x4a, 0x0a, 0x0c, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x77, 0x6f,
-	0x72, 0x6b, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x69, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0a, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x44, 0x69, 0x72, 0x22, 0x43, 0x0a, 0x0b, 0x4c,
-	0x6f, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70,
-	0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70,
-	0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x76, 0x5f, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x4e, 0x61, 0x6d, 0x65,
-	0x22, 0x44, 0x0a, 0x0b, 0x4c, 0x6f, 0x67, 0x73, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12,
-	0x14, 0x0a, 0x05, 0x6c, 0x69, 0x6e, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x05,
-	0x6c, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x64, 0x72, 0x6f, 0x70, 0x5f, 0x6e, 0x6f,
-	0x74, 0x69, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x64, 0x72, 0x6f, 0x70,
-	0x4e, 0x6f, 0x74, 0x69, 0x63, 0x65, 0x22, 0x47, 0x0a, 0x0e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x44,
-	0x42, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f,
-	0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52,
-	0x6f, 0x6f, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18,
-	0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x22,
-	0x63, 0x0a, 0x10, 0x44, 0x42, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x19,
-	0x0a, 0x08, 0x73, 0x76, 0x63, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x07, 0x73, 0x76, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x76,
-	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x65, 0x6e, 0x76,
-	0x4e, 0x61, 0x6d, 0x65, 0x22, 0x25, 0x0a, 0x11, 0x44, 0x42, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
-	0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x73, 0x6e,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x73, 0x6e, 0x22, 0x5a, 0x0a, 0x0e, 0x44,
-	0x42, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a,
-	0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x76, 0x5f,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x4e,
-	0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x05, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x22, 0x47, 0x0a, 0x0e, 0x44, 0x42, 0x52, 0x65, 0x73,
-	0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70,
-	0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70,
-	0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73,
-	0x22, 0x74, 0x0a, 0x10, 0x47, 0x65, 0x6e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x15, 0x0a, 0x06, 0x61, 0x70, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x61, 0x70, 0x70, 0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x65,
-	0x6e, 0x76, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x65,
-	0x6e, 0x76, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6c, 0x61, 0x6e, 0x67, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6c, 0x61, 0x6e, 0x67, 0x12, 0x1a, 0x0a, 0x08, 0x66, 0x69,
-	0x6c, 0x65, 0x70, 0x61, 0x74, 0x68, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x69,
-	0x6c, 0x65, 0x70, 0x61, 0x74, 0x68, 0x22, 0x27, 0x0a, 0x11, 0x47, 0x65, 0x6e, 0x43, 0x6c, 0x69,
-	0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x63,
-	0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x22,
-	0xb8, 0x01, 0x0a, 0x10, 0x53, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12,
-	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
-	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x38, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64,
-	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70,
-	0x65, 0x22, 0x27, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0f, 0x0a, 0x0b, 0x44, 0x45, 0x56,
-	0x45, 0x4c, 0x4f, 0x50, 0x4d, 0x45, 0x4e, 0x54, 0x10, 0x00, 0x12, 0x0e, 0x0a, 0x0a, 0x50, 0x52,
-	0x4f, 0x44, 0x55, 0x43, 0x54, 0x49, 0x4f, 0x4e, 0x10, 0x01, 0x22, 0x2d, 0x0a, 0x11, 0x53, 0x65,
-	0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x18, 0x0a, 0x07, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x07, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x22, 0x2b, 0x0a, 0x0f, 0x56, 0x65, 0x72,
-	0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07,
-	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76,
-	0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x32, 0xde, 0x05, 0x0a, 0x06, 0x44, 0x61, 0x65, 0x6d, 0x6f,
-	0x6e, 0x12, 0x3d, 0x0a, 0x03, 0x52, 0x75, 0x6e, 0x12, 0x19, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x52, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x19, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65,
-	0x6d, 0x6f, 0x6e, 0x2e, 0x52, 0x75, 0x6e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x30, 0x01,
-	0x12, 0x43, 0x0a, 0x04, 0x54, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x54, 0x65, 0x73, 0x74, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61,
-	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4d, 0x65, 0x73, 0x73,
-	0x61, 0x67, 0x65, 0x30, 0x01, 0x12, 0x45, 0x0a, 0x05, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x1b,
-	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43,
-	0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x65, 0x6e,
-	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d,
-	0x61, 0x6e, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x30, 0x01, 0x12, 0x40, 0x0a, 0x04,
-	0x4c, 0x6f, 0x67, 0x73, 0x12, 0x1a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61,
-	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x1a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e,
-	0x2e, 0x4c, 0x6f, 0x67, 0x73, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x30, 0x01, 0x12, 0x4e,
-	0x0a, 0x09, 0x44, 0x42, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x12, 0x1f, 0x2e, 0x65, 0x6e,
-	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x42, 0x43, 0x6f,
-	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x65,
-	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x42, 0x43,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x49,
-	0x0a, 0x07, 0x44, 0x42, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x12, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
-	0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x42, 0x50, 0x72, 0x6f, 0x78,
-	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64,
-	0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x30, 0x01, 0x12, 0x49, 0x0a, 0x07, 0x44, 0x42, 0x52,
-	0x65, 0x73, 0x65, 0x74, 0x12, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61,
-	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x42, 0x52, 0x65, 0x73, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65,
-	0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61,
-	0x67, 0x65, 0x30, 0x01, 0x12, 0x4e, 0x0a, 0x09, 0x47, 0x65, 0x6e, 0x43, 0x6c, 0x69, 0x65, 0x6e,
-	0x74, 0x12, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x47, 0x65, 0x6e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d,
-	0x6f, 0x6e, 0x2e, 0x47, 0x65, 0x6e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4e, 0x0a, 0x09, 0x53, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65,
-	0x74, 0x12, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
-	0x6e, 0x2e, 0x53, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d,
-	0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x41, 0x0a, 0x07, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
-	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
-	0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x1e, 0x5a, 0x1c, 0x65, 0x6e, 0x63, 0x72, 0x2e,
-	0x64, 0x65, 0x76, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
-	0x2f, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+func (x *GenClientRequest) GetLang() string {
+	if x != nil {
+		return x.Lang
+	}
+	return ""
 }
 
-var (
-	file_encore_daemon_daemon_proto_rawDescOnce sync.Once
-	file_encore_daemon_daemon_proto_rawDescData = file_encore_daemon_daemon_proto_rawDesc
-)
+func (x *GenClientRequest) GetFilepath() string {
+	if x != nil {
+		return x.Filepath
+	}
+	return ""
+}
 
-func file_encore_daemon_daemon_proto_rawDescGZIP() []byte {
-	file_encore_daemon_daemon_proto_rawDescOnce.Do(func() {
-		file_encore_daemon_daemon_proto_rawDescData = protoimpl.X.CompressGZIP(file_encore_daemon_daemon_proto_rawDescData)
-	})
-	return file_encore_daemon_daemon_proto_rawDescData
+func (x *GenClientRequest) GetServices() []string {
+	if x != nil {
+		return x.Services
+	}
+	return nil
 }
 
-var file_encore_daemon_daemon_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_encore_daemon_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 20)
-var file_encore_daemon_daemon_proto_goTypes = []interface{}{
-	(SetSecretRequest_Type)(0), // 0: encore.daemon.SetSecretRequest.Type
-	(*CommandMessage)(nil),     // 1: encore.daemon.CommandMessage
-	(*CommandOutput)(nil),      // 2: encore.daemon.CommandOutput
-	(*CommandExit)(nil),        // 3: encore.daemon.CommandExit
-	(*RunRequest)(nil),         // 4: encore.daemon.RunRequest
-	(*RunMessage)(nil),         // 5: encore.daemon.RunMessage
-	(*RunStarted)(nil),         // 6: encore.daemon.RunStarted
-	(*TestRequest)(nil),        // 7: encore.daemon.TestRequest
-	(*CheckRequest)(nil),       // 8: encore.daemon.CheckRequest
-	(*LogsRequest)(nil),        // 9: encore.daemon.LogsRequest
-	(*LogsMessage)(nil),        // 10: encore.daemon.LogsMessage
-	(*ResetDBRequest)(nil),     // 11: encore.daemon.ResetDBRequest
-	(*DBConnectRequest)(nil),   // 12: encore.daemon.DBConnectRequest
-	(*DBConnectResponse)(nil),  // 13: encore.daemon.DBConnectResponse
-	(*DBProxyRequest)(nil),     // 14: encore.daemon.DBProxyRequest
-	(*DBResetRequest)(nil),     // 15: encore.daemon.DBResetRequest
-	(*GenClientRequest)(nil),   // 16: encore.daemon.GenClientRequest
-	(*GenClientResponse)(nil),  // 17: encore.daemon.GenClientResponse
-	(*SetSecretRequest)(nil),   // 18: encore.daemon.SetSecretRequest
-	(*SetSecretResponse)(nil),  // 19: encore.daemon.SetSecretResponse
-	(*VersionResponse)(nil),    // 20: encore.daemon.VersionResponse
-	(*emptypb.Empty)(nil),      // 21: google.protobuf.Empty
+func (x *GenClientRequest) GetExcludedServices() []string {
+	if x != nil {
+		return x.ExcludedServices
+	}
+	return nil
 }
-var file_encore_daemon_daemon_proto_depIdxs = []int32{
-	2,  // 0: encore.daemon.CommandMessage.output:type_name -> encore.daemon.CommandOutput
-	3,  // 1: encore.daemon.CommandMessage.exit:type_name -> encore.daemon.CommandExit
-	6,  // 2: encore.daemon.RunMessage.started:type_name -> encore.daemon.RunStarted
-	2,  // 3: encore.daemon.RunMessage.output:type_name -> encore.daemon.CommandOutput
-	3,  // 4: encore.daemon.RunMessage.exit:type_name -> encore.daemon.CommandExit
-	0,  // 5: encore.daemon.SetSecretRequest.type:type_name -> encore.daemon.SetSecretRequest.Type
-	4,  // 6: encore.daemon.Daemon.Run:input_type -> encore.daemon.RunRequest
-	7,  // 7: encore.daemon.Daemon.Test:input_type -> encore.daemon.TestRequest
-	8,  // 8: encore.daemon.Daemon.Check:input_type -> encore.daemon.CheckRequest
-	9,  // 9: encore.daemon.Daemon.Logs:input_type -> encore.daemon.LogsRequest
-	12, // 10: encore.daemon.Daemon.DBConnect:input_type -> encore.daemon.DBConnectRequest
-	14, // 11: encore.daemon.Daemon.DBProxy:input_type -> encore.daemon.DBProxyRequest
-	15, // 12: encore.daemon.Daemon.DBReset:input_type -> encore.daemon.DBResetRequest
-	16, // 13: encore.daemon.Daemon.GenClient:input_type -> encore.daemon.GenClientRequest
-	18, // 14: encore.daemon.Daemon.SetSecret:input_type -> encore.daemon.SetSecretRequest
-	21, // 15: encore.daemon.Daemon.Version:input_type -> google.protobuf.Empty
-	5,  // 16: encore.daemon.Daemon.Run:output_type -> encore.daemon.RunMessage
-	1,  // 17: encore.daemon.Daemon.Test:output_type -> encore.daemon.CommandMessage
-	1,  // 18: encore.daemon.Daemon.Check:output_type -> encore.daemon.CommandMessage
-	10, // 19: encore.daemon.Daemon.Logs:output_type -> encore.daemon.LogsMessage
-	13, // 20: encore.daemon.Daemon.DBConnect:output_type -> encore.daemon.DBConnectResponse
-	1,  // 21: encore.daemon.Daemon.DBProxy:output_type -> encore.daemon.CommandMessage
-	1,  // 22: encore.daemon.Daemon.DBReset:output_type -> encore.daemon.CommandMessage
-	17, // 23: encore.daemon.Daemon.GenClient:output_type -> encore.daemon.GenClientResponse
-	19, // 24: encore.daemon.Daemon.SetSecret:output_type -> encore.daemon.SetSecretResponse
-	20, // 25: encore.daemon.Daemon.Version:output_type -> encore.daemon.VersionResponse
-	16, // [16:26] is the sub-list for method output_type
-	6,  // [6:16] is the sub-list for method input_type
-	6,  // [6:6] is the sub-list for extension type_name
-	6,  // [6:6] is the sub-list for extension extendee
-	0,  // [0:6] is the sub-list for field type_name
+
+func (x *GenClientRequest) GetEndpointTags() []string {
+	if x != nil {
+		return x.EndpointTags
+	}
+	return nil
 }
 
-func init() { file_encore_daemon_daemon_proto_init() }
-func file_encore_daemon_daemon_proto_init() {
-	if File_encore_daemon_daemon_proto != nil {
-		return
+func (x *GenClientRequest) GetExcludedEndpointTags() []string {
+	if x != nil {
+		return x.ExcludedEndpointTags
+	}
+	return nil
+}
+
+func (x *GenClientRequest) GetOpenapiExcludePrivateEndpoints() bool {
+	if x != nil && x.OpenapiExcludePrivateEndpoints != nil {
+		return *x.OpenapiExcludePrivateEndpoints
+	}
+	return false
+}
+
+func (x *GenClientRequest) GetTsSharedTypes() bool {
+	if x != nil && x.TsSharedTypes != nil {
+		return *x.TsSharedTypes
+	}
+	return false
+}
+
+func (x *GenClientRequest) GetTsClientTarget() string {
+	if x != nil && x.TsClientTarget != nil {
+		return *x.TsClientTarget
+	}
+	return ""
+}
+
+type GenClientResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Code []byte `protobuf:"bytes,1,opt,name=code,proto3" json:"code,omitempty"`
+}
+
+func (x *GenClientResponse) Reset() {
+	*x = GenClientResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GenClientResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GenClientResponse) ProtoMessage() {}
+
+func (x *GenClientResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GenClientResponse.ProtoReflect.Descriptor instead.
+func (*GenClientResponse) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *GenClientResponse) GetCode() []byte {
+	if x != nil {
+		return x.Code
+	}
+	return nil
+}
+
+type GenWrappersRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+}
+
+func (x *GenWrappersRequest) Reset() {
+	*x = GenWrappersRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GenWrappersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GenWrappersRequest) ProtoMessage() {}
+
+func (x *GenWrappersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GenWrappersRequest.ProtoReflect.Descriptor instead.
+func (*GenWrappersRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *GenWrappersRequest) GetAppRoot() string {
+	if x != nil {
+		return x.AppRoot
+	}
+	return ""
+}
+
+type GenWrappersResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *GenWrappersResponse) Reset() {
+	*x = GenWrappersResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GenWrappersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GenWrappersResponse) ProtoMessage() {}
+
+func (x *GenWrappersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GenWrappersResponse.ProtoReflect.Descriptor instead.
+func (*GenWrappersResponse) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{21}
+}
+
+type SecretsRefreshRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	Key     string `protobuf:"bytes,2,opt,name=key,proto3" json:"key,omitempty"`
+	Value   string `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *SecretsRefreshRequest) Reset() {
+	*x = SecretsRefreshRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[22]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SecretsRefreshRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SecretsRefreshRequest) ProtoMessage() {}
+
+func (x *SecretsRefreshRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[22]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SecretsRefreshRequest.ProtoReflect.Descriptor instead.
+func (*SecretsRefreshRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *SecretsRefreshRequest) GetAppRoot() string {
+	if x != nil {
+		return x.AppRoot
+	}
+	return ""
+}
+
+func (x *SecretsRefreshRequest) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *SecretsRefreshRequest) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+type SecretsRefreshResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *SecretsRefreshResponse) Reset() {
+	*x = SecretsRefreshResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[23]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SecretsRefreshResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SecretsRefreshResponse) ProtoMessage() {}
+
+func (x *SecretsRefreshResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[23]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SecretsRefreshResponse.ProtoReflect.Descriptor instead.
+func (*SecretsRefreshResponse) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{23}
+}
+
+type VersionResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Version    string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
+	ConfigHash string `protobuf:"bytes,2,opt,name=config_hash,json=configHash,proto3" json:"config_hash,omitempty"`
+}
+
+func (x *VersionResponse) Reset() {
+	*x = VersionResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[24]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *VersionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VersionResponse) ProtoMessage() {}
+
+func (x *VersionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[24]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VersionResponse.ProtoReflect.Descriptor instead.
+func (*VersionResponse) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *VersionResponse) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *VersionResponse) GetConfigHash() string {
+	if x != nil {
+		return x.ConfigHash
+	}
+	return ""
+}
+
+type Namespace struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id           string  `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Name         string  `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Active       bool    `protobuf:"varint,3,opt,name=active,proto3" json:"active,omitempty"`
+	CreatedAt    string  `protobuf:"bytes,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	LastActiveAt *string `protobuf:"bytes,5,opt,name=last_active_at,json=lastActiveAt,proto3,oneof" json:"last_active_at,omitempty"`
+}
+
+func (x *Namespace) Reset() {
+	*x = Namespace{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[25]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Namespace) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Namespace) ProtoMessage() {}
+
+func (x *Namespace) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[25]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Namespace.ProtoReflect.Descriptor instead.
+func (*Namespace) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *Namespace) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *Namespace) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Namespace) GetActive() bool {
+	if x != nil {
+		return x.Active
+	}
+	return false
+}
+
+func (x *Namespace) GetCreatedAt() string {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return ""
+}
+
+func (x *Namespace) GetLastActiveAt() string {
+	if x != nil && x.LastActiveAt != nil {
+		return *x.LastActiveAt
+	}
+	return ""
+}
+
+type CreateNamespaceRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	Name    string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+}
+
+func (x *CreateNamespaceRequest) Reset() {
+	*x = CreateNamespaceRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[26]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateNamespaceRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateNamespaceRequest) ProtoMessage() {}
+
+func (x *CreateNamespaceRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[26]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateNamespaceRequest.ProtoReflect.Descriptor instead.
+func (*CreateNamespaceRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *CreateNamespaceRequest) GetAppRoot() string {
+	if x != nil {
+		return x.AppRoot
+	}
+	return ""
+}
+
+func (x *CreateNamespaceRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+type SwitchNamespaceRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	Name    string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Create  bool   `protobuf:"varint,3,opt,name=create,proto3" json:"create,omitempty"`
+}
+
+func (x *SwitchNamespaceRequest) Reset() {
+	*x = SwitchNamespaceRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[27]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SwitchNamespaceRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SwitchNamespaceRequest) ProtoMessage() {}
+
+func (x *SwitchNamespaceRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[27]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SwitchNamespaceRequest.ProtoReflect.Descriptor instead.
+func (*SwitchNamespaceRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{27}
+}
+
+func (x *SwitchNamespaceRequest) GetAppRoot() string {
+	if x != nil {
+		return x.AppRoot
+	}
+	return ""
+}
+
+func (x *SwitchNamespaceRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *SwitchNamespaceRequest) GetCreate() bool {
+	if x != nil {
+		return x.Create
+	}
+	return false
+}
+
+type ListNamespacesRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+}
+
+func (x *ListNamespacesRequest) Reset() {
+	*x = ListNamespacesRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[28]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListNamespacesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListNamespacesRequest) ProtoMessage() {}
+
+func (x *ListNamespacesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[28]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListNamespacesRequest.ProtoReflect.Descriptor instead.
+func (*ListNamespacesRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{28}
+}
+
+func (x *ListNamespacesRequest) GetAppRoot() string {
+	if x != nil {
+		return x.AppRoot
+	}
+	return ""
+}
+
+type DeleteNamespaceRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AppRoot string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	Name    string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+}
+
+func (x *DeleteNamespaceRequest) Reset() {
+	*x = DeleteNamespaceRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[29]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteNamespaceRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteNamespaceRequest) ProtoMessage() {}
+
+func (x *DeleteNamespaceRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[29]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteNamespaceRequest.ProtoReflect.Descriptor instead.
+func (*DeleteNamespaceRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{29}
+}
+
+func (x *DeleteNamespaceRequest) GetAppRoot() string {
+	if x != nil {
+		return x.AppRoot
+	}
+	return ""
+}
+
+func (x *DeleteNamespaceRequest) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+type ListNamespacesResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Namespaces []*Namespace `protobuf:"bytes,1,rep,name=namespaces,proto3" json:"namespaces,omitempty"`
+}
+
+func (x *ListNamespacesResponse) Reset() {
+	*x = ListNamespacesResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[30]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ListNamespacesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListNamespacesResponse) ProtoMessage() {}
+
+func (x *ListNamespacesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[30]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListNamespacesResponse.ProtoReflect.Descriptor instead.
+func (*ListNamespacesResponse) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{30}
+}
+
+func (x *ListNamespacesResponse) GetNamespaces() []*Namespace {
+	if x != nil {
+		return x.Namespaces
+	}
+	return nil
+}
+
+type TelemetryConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AnonId  string `protobuf:"bytes,1,opt,name=anon_id,json=anonId,proto3" json:"anon_id,omitempty"`
+	Enabled bool   `protobuf:"varint,2,opt,name=enabled,proto3" json:"enabled,omitempty"`
+	Debug   bool   `protobuf:"varint,3,opt,name=debug,proto3" json:"debug,omitempty"`
+}
+
+func (x *TelemetryConfig) Reset() {
+	*x = TelemetryConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[31]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TelemetryConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TelemetryConfig) ProtoMessage() {}
+
+func (x *TelemetryConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[31]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TelemetryConfig.ProtoReflect.Descriptor instead.
+func (*TelemetryConfig) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{31}
+}
+
+func (x *TelemetryConfig) GetAnonId() string {
+	if x != nil {
+		return x.AnonId
+	}
+	return ""
+}
+
+func (x *TelemetryConfig) GetEnabled() bool {
+	if x != nil {
+		return x.Enabled
+	}
+	return false
+}
+
+func (x *TelemetryConfig) GetDebug() bool {
+	if x != nil {
+		return x.Debug
+	}
+	return false
+}
+
+type DumpMetaRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AppRoot    string `protobuf:"bytes,1,opt,name=app_root,json=appRoot,proto3" json:"app_root,omitempty"`
+	WorkingDir string `protobuf:"bytes,2,opt,name=working_dir,json=workingDir,proto3" json:"working_dir,omitempty"` // for error reporting
+	// environ is the environment to set for the running command.
+	// Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+	Environ []string `protobuf:"bytes,3,rep,name=environ,proto3" json:"environ,omitempty"`
+	// Whether or not to parse tests.
+	ParseTests bool                   `protobuf:"varint,4,opt,name=parse_tests,json=parseTests,proto3" json:"parse_tests,omitempty"`
+	Format     DumpMetaRequest_Format `protobuf:"varint,5,opt,name=format,proto3,enum=encore.daemon.DumpMetaRequest_Format" json:"format,omitempty"`
+}
+
+func (x *DumpMetaRequest) Reset() {
+	*x = DumpMetaRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[32]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DumpMetaRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DumpMetaRequest) ProtoMessage() {}
+
+func (x *DumpMetaRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[32]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DumpMetaRequest.ProtoReflect.Descriptor instead.
+func (*DumpMetaRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{32}
+}
+
+func (x *DumpMetaRequest) GetAppRoot() string {
+	if x != nil {
+		return x.AppRoot
+	}
+	return ""
+}
+
+func (x *DumpMetaRequest) GetWorkingDir() string {
+	if x != nil {
+		return x.WorkingDir
+	}
+	return ""
+}
+
+func (x *DumpMetaRequest) GetEnviron() []string {
+	if x != nil {
+		return x.Environ
+	}
+	return nil
+}
+
+func (x *DumpMetaRequest) GetParseTests() bool {
+	if x != nil {
+		return x.ParseTests
+	}
+	return false
+}
+
+func (x *DumpMetaRequest) GetFormat() DumpMetaRequest_Format {
+	if x != nil {
+		return x.Format
+	}
+	return DumpMetaRequest_FORMAT_UNSPECIFIED
+}
+
+type DumpMetaResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Meta []byte `protobuf:"bytes,1,opt,name=meta,proto3" json:"meta,omitempty"`
+}
+
+func (x *DumpMetaResponse) Reset() {
+	*x = DumpMetaResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[33]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DumpMetaResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DumpMetaResponse) ProtoMessage() {}
+
+func (x *DumpMetaResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[33]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DumpMetaResponse.ProtoReflect.Descriptor instead.
+func (*DumpMetaResponse) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{33}
+}
+
+func (x *DumpMetaResponse) GetMeta() []byte {
+	if x != nil {
+		return x.Meta
+	}
+	return nil
+}
+
+// The following messages are used for sqlc plugin integration.
+type SQLCPlugin struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *SQLCPlugin) Reset() {
+	*x = SQLCPlugin{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[34]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin) ProtoMessage() {}
+
+func (x *SQLCPlugin) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[34]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34}
+}
+
+type SQLCPlugin_File struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name     string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Contents []byte `protobuf:"bytes,2,opt,name=contents,proto3" json:"contents,omitempty"`
+}
+
+func (x *SQLCPlugin_File) Reset() {
+	*x = SQLCPlugin_File{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[35]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_File) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_File) ProtoMessage() {}
+
+func (x *SQLCPlugin_File) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[35]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_File.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_File) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 0}
+}
+
+func (x *SQLCPlugin_File) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_File) GetContents() []byte {
+	if x != nil {
+		return x.Contents
+	}
+	return nil
+}
+
+type SQLCPlugin_Settings struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Version string              `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
+	Engine  string              `protobuf:"bytes,2,opt,name=engine,proto3" json:"engine,omitempty"`
+	Schema  []string            `protobuf:"bytes,3,rep,name=schema,proto3" json:"schema,omitempty"`
+	Queries []string            `protobuf:"bytes,4,rep,name=queries,proto3" json:"queries,omitempty"`
+	Codegen *SQLCPlugin_Codegen `protobuf:"bytes,12,opt,name=codegen,proto3" json:"codegen,omitempty"`
+}
+
+func (x *SQLCPlugin_Settings) Reset() {
+	*x = SQLCPlugin_Settings{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[36]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Settings) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Settings) ProtoMessage() {}
+
+func (x *SQLCPlugin_Settings) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[36]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Settings.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Settings) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 1}
+}
+
+func (x *SQLCPlugin_Settings) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Settings) GetEngine() string {
+	if x != nil {
+		return x.Engine
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Settings) GetSchema() []string {
+	if x != nil {
+		return x.Schema
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Settings) GetQueries() []string {
+	if x != nil {
+		return x.Queries
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Settings) GetCodegen() *SQLCPlugin_Codegen {
+	if x != nil {
+		return x.Codegen
+	}
+	return nil
+}
+
+type SQLCPlugin_Codegen struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Out     string                      `protobuf:"bytes,1,opt,name=out,proto3" json:"out,omitempty"`
+	Plugin  string                      `protobuf:"bytes,2,opt,name=plugin,proto3" json:"plugin,omitempty"`
+	Options []byte                      `protobuf:"bytes,3,opt,name=options,proto3" json:"options,omitempty"`
+	Env     []string                    `protobuf:"bytes,4,rep,name=env,proto3" json:"env,omitempty"`
+	Process *SQLCPlugin_Codegen_Process `protobuf:"bytes,5,opt,name=process,proto3" json:"process,omitempty"`
+	Wasm    *SQLCPlugin_Codegen_WASM    `protobuf:"bytes,6,opt,name=wasm,proto3" json:"wasm,omitempty"`
+}
+
+func (x *SQLCPlugin_Codegen) Reset() {
+	*x = SQLCPlugin_Codegen{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[37]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Codegen) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Codegen) ProtoMessage() {}
+
+func (x *SQLCPlugin_Codegen) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[37]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Codegen.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Codegen) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 2}
+}
+
+func (x *SQLCPlugin_Codegen) GetOut() string {
+	if x != nil {
+		return x.Out
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Codegen) GetPlugin() string {
+	if x != nil {
+		return x.Plugin
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Codegen) GetOptions() []byte {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Codegen) GetEnv() []string {
+	if x != nil {
+		return x.Env
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Codegen) GetProcess() *SQLCPlugin_Codegen_Process {
+	if x != nil {
+		return x.Process
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Codegen) GetWasm() *SQLCPlugin_Codegen_WASM {
+	if x != nil {
+		return x.Wasm
+	}
+	return nil
+}
+
+type SQLCPlugin_Catalog struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Comment       string               `protobuf:"bytes,1,opt,name=comment,proto3" json:"comment,omitempty"`
+	DefaultSchema string               `protobuf:"bytes,2,opt,name=default_schema,json=defaultSchema,proto3" json:"default_schema,omitempty"`
+	Name          string               `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+	Schemas       []*SQLCPlugin_Schema `protobuf:"bytes,4,rep,name=schemas,proto3" json:"schemas,omitempty"`
+}
+
+func (x *SQLCPlugin_Catalog) Reset() {
+	*x = SQLCPlugin_Catalog{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[38]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Catalog) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Catalog) ProtoMessage() {}
+
+func (x *SQLCPlugin_Catalog) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[38]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Catalog.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Catalog) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 3}
+}
+
+func (x *SQLCPlugin_Catalog) GetComment() string {
+	if x != nil {
+		return x.Comment
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Catalog) GetDefaultSchema() string {
+	if x != nil {
+		return x.DefaultSchema
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Catalog) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Catalog) GetSchemas() []*SQLCPlugin_Schema {
+	if x != nil {
+		return x.Schemas
+	}
+	return nil
+}
+
+type SQLCPlugin_Schema struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Comment        string                      `protobuf:"bytes,1,opt,name=comment,proto3" json:"comment,omitempty"`
+	Name           string                      `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Tables         []*SQLCPlugin_Table         `protobuf:"bytes,3,rep,name=tables,proto3" json:"tables,omitempty"`
+	Enums          []*SQLCPlugin_Enum          `protobuf:"bytes,4,rep,name=enums,proto3" json:"enums,omitempty"`
+	CompositeTypes []*SQLCPlugin_CompositeType `protobuf:"bytes,5,rep,name=composite_types,json=compositeTypes,proto3" json:"composite_types,omitempty"`
+}
+
+func (x *SQLCPlugin_Schema) Reset() {
+	*x = SQLCPlugin_Schema{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[39]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Schema) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Schema) ProtoMessage() {}
+
+func (x *SQLCPlugin_Schema) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[39]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Schema.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Schema) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 4}
+}
+
+func (x *SQLCPlugin_Schema) GetComment() string {
+	if x != nil {
+		return x.Comment
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Schema) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Schema) GetTables() []*SQLCPlugin_Table {
+	if x != nil {
+		return x.Tables
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Schema) GetEnums() []*SQLCPlugin_Enum {
+	if x != nil {
+		return x.Enums
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Schema) GetCompositeTypes() []*SQLCPlugin_CompositeType {
+	if x != nil {
+		return x.CompositeTypes
+	}
+	return nil
+}
+
+type SQLCPlugin_CompositeType struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name    string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Comment string `protobuf:"bytes,2,opt,name=comment,proto3" json:"comment,omitempty"`
+}
+
+func (x *SQLCPlugin_CompositeType) Reset() {
+	*x = SQLCPlugin_CompositeType{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[40]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_CompositeType) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_CompositeType) ProtoMessage() {}
+
+func (x *SQLCPlugin_CompositeType) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[40]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_CompositeType.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_CompositeType) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 5}
+}
+
+func (x *SQLCPlugin_CompositeType) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_CompositeType) GetComment() string {
+	if x != nil {
+		return x.Comment
+	}
+	return ""
+}
+
+type SQLCPlugin_Enum struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name    string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Vals    []string `protobuf:"bytes,2,rep,name=vals,proto3" json:"vals,omitempty"`
+	Comment string   `protobuf:"bytes,3,opt,name=comment,proto3" json:"comment,omitempty"`
+}
+
+func (x *SQLCPlugin_Enum) Reset() {
+	*x = SQLCPlugin_Enum{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[41]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Enum) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Enum) ProtoMessage() {}
+
+func (x *SQLCPlugin_Enum) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[41]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Enum.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Enum) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 6}
+}
+
+func (x *SQLCPlugin_Enum) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Enum) GetVals() []string {
+	if x != nil {
+		return x.Vals
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Enum) GetComment() string {
+	if x != nil {
+		return x.Comment
+	}
+	return ""
+}
+
+type SQLCPlugin_Table struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Rel     *SQLCPlugin_Identifier `protobuf:"bytes,1,opt,name=rel,proto3" json:"rel,omitempty"`
+	Columns []*SQLCPlugin_Column   `protobuf:"bytes,2,rep,name=columns,proto3" json:"columns,omitempty"`
+	Comment string                 `protobuf:"bytes,3,opt,name=comment,proto3" json:"comment,omitempty"`
+}
+
+func (x *SQLCPlugin_Table) Reset() {
+	*x = SQLCPlugin_Table{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[42]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Table) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Table) ProtoMessage() {}
+
+func (x *SQLCPlugin_Table) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[42]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Table.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Table) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 7}
+}
+
+func (x *SQLCPlugin_Table) GetRel() *SQLCPlugin_Identifier {
+	if x != nil {
+		return x.Rel
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Table) GetColumns() []*SQLCPlugin_Column {
+	if x != nil {
+		return x.Columns
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Table) GetComment() string {
+	if x != nil {
+		return x.Comment
+	}
+	return ""
+}
+
+type SQLCPlugin_Identifier struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Catalog string `protobuf:"bytes,1,opt,name=catalog,proto3" json:"catalog,omitempty"`
+	Schema  string `protobuf:"bytes,2,opt,name=schema,proto3" json:"schema,omitempty"`
+	Name    string `protobuf:"bytes,3,opt,name=name,proto3" json:"name,omitempty"`
+}
+
+func (x *SQLCPlugin_Identifier) Reset() {
+	*x = SQLCPlugin_Identifier{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[43]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Identifier) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Identifier) ProtoMessage() {}
+
+func (x *SQLCPlugin_Identifier) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[43]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Identifier.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Identifier) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 8}
+}
+
+func (x *SQLCPlugin_Identifier) GetCatalog() string {
+	if x != nil {
+		return x.Catalog
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Identifier) GetSchema() string {
+	if x != nil {
+		return x.Schema
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Identifier) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+type SQLCPlugin_Column struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name         string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	NotNull      bool   `protobuf:"varint,3,opt,name=not_null,json=notNull,proto3" json:"not_null,omitempty"`
+	IsArray      bool   `protobuf:"varint,4,opt,name=is_array,json=isArray,proto3" json:"is_array,omitempty"`
+	Comment      string `protobuf:"bytes,5,opt,name=comment,proto3" json:"comment,omitempty"`
+	Length       int32  `protobuf:"varint,6,opt,name=length,proto3" json:"length,omitempty"`
+	IsNamedParam bool   `protobuf:"varint,7,opt,name=is_named_param,json=isNamedParam,proto3" json:"is_named_param,omitempty"`
+	IsFuncCall   bool   `protobuf:"varint,8,opt,name=is_func_call,json=isFuncCall,proto3" json:"is_func_call,omitempty"`
+	// XXX: Figure out what PostgreSQL calls `foo.id`
+	Scope        string                 `protobuf:"bytes,9,opt,name=scope,proto3" json:"scope,omitempty"`
+	Table        *SQLCPlugin_Identifier `protobuf:"bytes,10,opt,name=table,proto3" json:"table,omitempty"`
+	TableAlias   string                 `protobuf:"bytes,11,opt,name=table_alias,json=tableAlias,proto3" json:"table_alias,omitempty"`
+	Type         *SQLCPlugin_Identifier `protobuf:"bytes,12,opt,name=type,proto3" json:"type,omitempty"`
+	IsSqlcSlice  bool                   `protobuf:"varint,13,opt,name=is_sqlc_slice,json=isSqlcSlice,proto3" json:"is_sqlc_slice,omitempty"`
+	EmbedTable   *SQLCPlugin_Identifier `protobuf:"bytes,14,opt,name=embed_table,json=embedTable,proto3" json:"embed_table,omitempty"`
+	OriginalName string                 `protobuf:"bytes,15,opt,name=original_name,json=originalName,proto3" json:"original_name,omitempty"`
+	Unsigned     bool                   `protobuf:"varint,16,opt,name=unsigned,proto3" json:"unsigned,omitempty"`
+	ArrayDims    int32                  `protobuf:"varint,17,opt,name=array_dims,json=arrayDims,proto3" json:"array_dims,omitempty"`
+}
+
+func (x *SQLCPlugin_Column) Reset() {
+	*x = SQLCPlugin_Column{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[44]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Column) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Column) ProtoMessage() {}
+
+func (x *SQLCPlugin_Column) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[44]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Column.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Column) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 9}
+}
+
+func (x *SQLCPlugin_Column) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Column) GetNotNull() bool {
+	if x != nil {
+		return x.NotNull
+	}
+	return false
+}
+
+func (x *SQLCPlugin_Column) GetIsArray() bool {
+	if x != nil {
+		return x.IsArray
+	}
+	return false
+}
+
+func (x *SQLCPlugin_Column) GetComment() string {
+	if x != nil {
+		return x.Comment
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Column) GetLength() int32 {
+	if x != nil {
+		return x.Length
+	}
+	return 0
+}
+
+func (x *SQLCPlugin_Column) GetIsNamedParam() bool {
+	if x != nil {
+		return x.IsNamedParam
+	}
+	return false
+}
+
+func (x *SQLCPlugin_Column) GetIsFuncCall() bool {
+	if x != nil {
+		return x.IsFuncCall
+	}
+	return false
+}
+
+func (x *SQLCPlugin_Column) GetScope() string {
+	if x != nil {
+		return x.Scope
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Column) GetTable() *SQLCPlugin_Identifier {
+	if x != nil {
+		return x.Table
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Column) GetTableAlias() string {
+	if x != nil {
+		return x.TableAlias
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Column) GetType() *SQLCPlugin_Identifier {
+	if x != nil {
+		return x.Type
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Column) GetIsSqlcSlice() bool {
+	if x != nil {
+		return x.IsSqlcSlice
+	}
+	return false
+}
+
+func (x *SQLCPlugin_Column) GetEmbedTable() *SQLCPlugin_Identifier {
+	if x != nil {
+		return x.EmbedTable
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Column) GetOriginalName() string {
+	if x != nil {
+		return x.OriginalName
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Column) GetUnsigned() bool {
+	if x != nil {
+		return x.Unsigned
+	}
+	return false
+}
+
+func (x *SQLCPlugin_Column) GetArrayDims() int32 {
+	if x != nil {
+		return x.ArrayDims
+	}
+	return 0
+}
+
+type SQLCPlugin_Query struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Text            string                  `protobuf:"bytes,1,opt,name=text,proto3" json:"text,omitempty"`
+	Name            string                  `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Cmd             string                  `protobuf:"bytes,3,opt,name=cmd,proto3" json:"cmd,omitempty"`
+	Columns         []*SQLCPlugin_Column    `protobuf:"bytes,4,rep,name=columns,proto3" json:"columns,omitempty"`
+	Params          []*SQLCPlugin_Parameter `protobuf:"bytes,5,rep,name=params,json=parameters,proto3" json:"params,omitempty"`
+	Comments        []string                `protobuf:"bytes,6,rep,name=comments,proto3" json:"comments,omitempty"`
+	Filename        string                  `protobuf:"bytes,7,opt,name=filename,proto3" json:"filename,omitempty"`
+	InsertIntoTable *SQLCPlugin_Identifier  `protobuf:"bytes,8,opt,name=insert_into_table,proto3" json:"insert_into_table,omitempty"`
+}
+
+func (x *SQLCPlugin_Query) Reset() {
+	*x = SQLCPlugin_Query{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[45]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Query) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Query) ProtoMessage() {}
+
+func (x *SQLCPlugin_Query) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[45]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Query.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Query) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 10}
+}
+
+func (x *SQLCPlugin_Query) GetText() string {
+	if x != nil {
+		return x.Text
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Query) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Query) GetCmd() string {
+	if x != nil {
+		return x.Cmd
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Query) GetColumns() []*SQLCPlugin_Column {
+	if x != nil {
+		return x.Columns
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Query) GetParams() []*SQLCPlugin_Parameter {
+	if x != nil {
+		return x.Params
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Query) GetComments() []string {
+	if x != nil {
+		return x.Comments
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_Query) GetFilename() string {
+	if x != nil {
+		return x.Filename
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Query) GetInsertIntoTable() *SQLCPlugin_Identifier {
+	if x != nil {
+		return x.InsertIntoTable
+	}
+	return nil
+}
+
+type SQLCPlugin_Parameter struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Number int32              `protobuf:"varint,1,opt,name=number,proto3" json:"number,omitempty"`
+	Column *SQLCPlugin_Column `protobuf:"bytes,2,opt,name=column,proto3" json:"column,omitempty"`
+}
+
+func (x *SQLCPlugin_Parameter) Reset() {
+	*x = SQLCPlugin_Parameter{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[46]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Parameter) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Parameter) ProtoMessage() {}
+
+func (x *SQLCPlugin_Parameter) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[46]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Parameter.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Parameter) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 11}
+}
+
+func (x *SQLCPlugin_Parameter) GetNumber() int32 {
+	if x != nil {
+		return x.Number
+	}
+	return 0
+}
+
+func (x *SQLCPlugin_Parameter) GetColumn() *SQLCPlugin_Column {
+	if x != nil {
+		return x.Column
+	}
+	return nil
+}
+
+type SQLCPlugin_GenerateRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Settings      *SQLCPlugin_Settings `protobuf:"bytes,1,opt,name=settings,proto3" json:"settings,omitempty"`
+	Catalog       *SQLCPlugin_Catalog  `protobuf:"bytes,2,opt,name=catalog,proto3" json:"catalog,omitempty"`
+	Queries       []*SQLCPlugin_Query  `protobuf:"bytes,3,rep,name=queries,proto3" json:"queries,omitempty"`
+	SqlcVersion   string               `protobuf:"bytes,4,opt,name=sqlc_version,proto3" json:"sqlc_version,omitempty"`
+	PluginOptions []byte               `protobuf:"bytes,5,opt,name=plugin_options,proto3" json:"plugin_options,omitempty"`
+	GlobalOptions []byte               `protobuf:"bytes,6,opt,name=global_options,proto3" json:"global_options,omitempty"`
+}
+
+func (x *SQLCPlugin_GenerateRequest) Reset() {
+	*x = SQLCPlugin_GenerateRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[47]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_GenerateRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_GenerateRequest) ProtoMessage() {}
+
+func (x *SQLCPlugin_GenerateRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[47]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_GenerateRequest.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_GenerateRequest) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 12}
+}
+
+func (x *SQLCPlugin_GenerateRequest) GetSettings() *SQLCPlugin_Settings {
+	if x != nil {
+		return x.Settings
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_GenerateRequest) GetCatalog() *SQLCPlugin_Catalog {
+	if x != nil {
+		return x.Catalog
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_GenerateRequest) GetQueries() []*SQLCPlugin_Query {
+	if x != nil {
+		return x.Queries
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_GenerateRequest) GetSqlcVersion() string {
+	if x != nil {
+		return x.SqlcVersion
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_GenerateRequest) GetPluginOptions() []byte {
+	if x != nil {
+		return x.PluginOptions
+	}
+	return nil
+}
+
+func (x *SQLCPlugin_GenerateRequest) GetGlobalOptions() []byte {
+	if x != nil {
+		return x.GlobalOptions
+	}
+	return nil
+}
+
+type SQLCPlugin_GenerateResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Files []*SQLCPlugin_File `protobuf:"bytes,1,rep,name=files,proto3" json:"files,omitempty"`
+}
+
+func (x *SQLCPlugin_GenerateResponse) Reset() {
+	*x = SQLCPlugin_GenerateResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[48]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_GenerateResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_GenerateResponse) ProtoMessage() {}
+
+func (x *SQLCPlugin_GenerateResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[48]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_GenerateResponse.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_GenerateResponse) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 13}
+}
+
+func (x *SQLCPlugin_GenerateResponse) GetFiles() []*SQLCPlugin_File {
+	if x != nil {
+		return x.Files
+	}
+	return nil
+}
+
+type SQLCPlugin_Codegen_Process struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Cmd string `protobuf:"bytes,1,opt,name=cmd,proto3" json:"cmd,omitempty"`
+}
+
+func (x *SQLCPlugin_Codegen_Process) Reset() {
+	*x = SQLCPlugin_Codegen_Process{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[49]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Codegen_Process) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Codegen_Process) ProtoMessage() {}
+
+func (x *SQLCPlugin_Codegen_Process) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[49]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Codegen_Process.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Codegen_Process) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 2, 0}
+}
+
+func (x *SQLCPlugin_Codegen_Process) GetCmd() string {
+	if x != nil {
+		return x.Cmd
+	}
+	return ""
+}
+
+type SQLCPlugin_Codegen_WASM struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Url    string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	Sha256 string `protobuf:"bytes,2,opt,name=sha256,proto3" json:"sha256,omitempty"`
+}
+
+func (x *SQLCPlugin_Codegen_WASM) Reset() {
+	*x = SQLCPlugin_Codegen_WASM{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_daemon_daemon_proto_msgTypes[50]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCPlugin_Codegen_WASM) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCPlugin_Codegen_WASM) ProtoMessage() {}
+
+func (x *SQLCPlugin_Codegen_WASM) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_daemon_daemon_proto_msgTypes[50]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCPlugin_Codegen_WASM.ProtoReflect.Descriptor instead.
+func (*SQLCPlugin_Codegen_WASM) Descriptor() ([]byte, []int) {
+	return file_encore_daemon_daemon_proto_rawDescGZIP(), []int{34, 2, 1}
+}
+
+func (x *SQLCPlugin_Codegen_WASM) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+func (x *SQLCPlugin_Codegen_WASM) GetSha256() string {
+	if x != nil {
+		return x.Sha256
+	}
+	return ""
+}
+
+var File_encore_daemon_daemon_proto protoreflect.FileDescriptor
+
+var file_encore_daemon_daemon_proto_rawDesc = []byte{
+	0x0a, 0x1a, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2f,
+	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0d, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x1a, 0x1b, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70,
+	0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xc0, 0x01, 0x0a, 0x0e, 0x43, 0x6f, 0x6d,
+	0x6d, 0x61, 0x6e, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x36, 0x0a, 0x06, 0x6f,
+	0x75, 0x74, 0x70, 0x75, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d,
+	0x61, 0x6e, 0x64, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x48, 0x00, 0x52, 0x06, 0x6f, 0x75, 0x74,
+	0x70, 0x75, 0x74, 0x12, 0x30, 0x0a, 0x04, 0x65, 0x78, 0x69, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x45, 0x78, 0x69, 0x74, 0x48, 0x00, 0x52,
+	0x04, 0x65, 0x78, 0x69, 0x74, 0x12, 0x3d, 0x0a, 0x06, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64,
+	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x44, 0x69, 0x73,
+	0x70, 0x6c, 0x61, 0x79, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x48, 0x00, 0x52, 0x06, 0x65, 0x72,
+	0x72, 0x6f, 0x72, 0x73, 0x42, 0x05, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0x3f, 0x0a, 0x0d, 0x43,
+	0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x12, 0x16, 0x0a, 0x06,
+	0x73, 0x74, 0x64, 0x6f, 0x75, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x73, 0x74,
+	0x64, 0x6f, 0x75, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x64, 0x65, 0x72, 0x72, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x73, 0x74, 0x64, 0x65, 0x72, 0x72, 0x22, 0x21, 0x0a, 0x0b,
+	0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x45, 0x78, 0x69, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x63,
+	0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x22,
+	0x32, 0x0a, 0x14, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x44, 0x69, 0x73, 0x70, 0x6c, 0x61,
+	0x79, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x72, 0x72, 0x69, 0x6e,
+	0x73, 0x72, 0x63, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x65, 0x72, 0x72, 0x69, 0x6e,
+	0x73, 0x72, 0x63, 0x22, 0x65, 0x0a, 0x10, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x70,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72,
+	0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f,
+	0x6f, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x12, 0x1a,
+	0x0a, 0x08, 0x74, 0x75, 0x74, 0x6f, 0x72, 0x69, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x08, 0x74, 0x75, 0x74, 0x6f, 0x72, 0x69, 0x61, 0x6c, 0x22, 0x2a, 0x0a, 0x11, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x15, 0x0a, 0x06, 0x61, 0x70, 0x70, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x61, 0x70, 0x70, 0x49, 0x64, 0x22, 0x8f, 0x04, 0x0a, 0x0a, 0x52, 0x75, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74,
+	0x12, 0x1f, 0x0a, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x69, 0x72, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x44, 0x69,
+	0x72, 0x12, 0x14, 0x0a, 0x05, 0x77, 0x61, 0x74, 0x63, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x05, 0x77, 0x61, 0x74, 0x63, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x73, 0x74, 0x65,
+	0x6e, 0x5f, 0x61, 0x64, 0x64, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6c, 0x69,
+	0x73, 0x74, 0x65, 0x6e, 0x41, 0x64, 0x64, 0x72, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x76, 0x69,
+	0x72, 0x6f, 0x6e, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x69, 0x72,
+	0x6f, 0x6e, 0x12, 0x22, 0x0a, 0x0a, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x74, 0x72, 0x61, 0x63, 0x65, 0x46,
+	0x69, 0x6c, 0x65, 0x88, 0x01, 0x01, 0x12, 0x21, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x09, 0x6e, 0x61, 0x6d,
+	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x88, 0x01, 0x01, 0x12, 0x3f, 0x0a, 0x07, 0x62, 0x72, 0x6f,
+	0x77, 0x73, 0x65, 0x72, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x52, 0x75, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x42, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x4d, 0x6f, 0x64,
+	0x65, 0x52, 0x07, 0x62, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x12, 0x42, 0x0a, 0x0a, 0x64, 0x65,
+	0x62, 0x75, 0x67, 0x5f, 0x6d, 0x6f, 0x64, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x23,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x52,
+	0x75, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x44, 0x65, 0x62, 0x75, 0x67, 0x4d,
+	0x6f, 0x64, 0x65, 0x52, 0x09, 0x64, 0x65, 0x62, 0x75, 0x67, 0x4d, 0x6f, 0x64, 0x65, 0x22, 0x46,
+	0x0a, 0x0b, 0x42, 0x72, 0x6f, 0x77, 0x73, 0x65, 0x72, 0x4d, 0x6f, 0x64, 0x65, 0x12, 0x10, 0x0a,
+	0x0c, 0x42, 0x52, 0x4f, 0x57, 0x53, 0x45, 0x52, 0x5f, 0x41, 0x55, 0x54, 0x4f, 0x10, 0x00, 0x12,
+	0x11, 0x0a, 0x0d, 0x42, 0x52, 0x4f, 0x57, 0x53, 0x45, 0x52, 0x5f, 0x4e, 0x45, 0x56, 0x45, 0x52,
+	0x10, 0x01, 0x12, 0x12, 0x0a, 0x0e, 0x42, 0x52, 0x4f, 0x57, 0x53, 0x45, 0x52, 0x5f, 0x41, 0x4c,
+	0x57, 0x41, 0x59, 0x53, 0x10, 0x02, 0x22, 0x43, 0x0a, 0x09, 0x44, 0x65, 0x62, 0x75, 0x67, 0x4d,
+	0x6f, 0x64, 0x65, 0x12, 0x12, 0x0a, 0x0e, 0x44, 0x45, 0x42, 0x55, 0x47, 0x5f, 0x44, 0x49, 0x53,
+	0x41, 0x42, 0x4c, 0x45, 0x44, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x44, 0x45, 0x42, 0x55, 0x47,
+	0x5f, 0x45, 0x4e, 0x41, 0x42, 0x4c, 0x45, 0x44, 0x10, 0x01, 0x12, 0x0f, 0x0a, 0x0b, 0x44, 0x45,
+	0x42, 0x55, 0x47, 0x5f, 0x42, 0x52, 0x45, 0x41, 0x4b, 0x10, 0x02, 0x42, 0x0d, 0x0a, 0x0b, 0x5f,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x22, 0xd5, 0x01, 0x0a, 0x0b, 0x54, 0x65, 0x73,
+	0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f,
+	0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52,
+	0x6f, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x5f, 0x64,
+	0x69, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e,
+	0x67, 0x44, 0x69, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x61, 0x72, 0x67, 0x73, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x04, 0x61, 0x72, 0x67, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x76, 0x69,
+	0x72, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x69, 0x72,
+	0x6f, 0x6e, 0x12, 0x22, 0x0a, 0x0a, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x74, 0x72, 0x61, 0x63, 0x65, 0x46,
+	0x69, 0x6c, 0x65, 0x88, 0x01, 0x01, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6f, 0x64, 0x65, 0x67, 0x65,
+	0x6e, 0x5f, 0x64, 0x65, 0x62, 0x75, 0x67, 0x18, 0x07, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x63,
+	0x6f, 0x64, 0x65, 0x67, 0x65, 0x6e, 0x44, 0x65, 0x62, 0x75, 0x67, 0x42, 0x0d, 0x0a, 0x0b, 0x5f,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x4a, 0x04, 0x08, 0x05, 0x10, 0x06,
+	0x22, 0x7b, 0x0a, 0x0f, 0x54, 0x65, 0x73, 0x74, 0x53, 0x70, 0x65, 0x63, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1f,
+	0x0a, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x69, 0x72, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0a, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x44, 0x69, 0x72, 0x12,
+	0x12, 0x0a, 0x04, 0x61, 0x72, 0x67, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x61,
+	0x72, 0x67, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x18, 0x04,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x22, 0x5a, 0x0a,
+	0x10, 0x54, 0x65, 0x73, 0x74, 0x53, 0x70, 0x65, 0x63, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x61,
+	0x72, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x61, 0x72, 0x67, 0x73, 0x12,
+	0x18, 0x0a, 0x07, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x07, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x22, 0xee, 0x01, 0x0a, 0x11, 0x45, 0x78,
+	0x65, 0x63, 0x53, 0x63, 0x72, 0x69, 0x70, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x77, 0x6f,
+	0x72, 0x6b, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x69, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0a, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x44, 0x69, 0x72, 0x12, 0x1f, 0x0a, 0x0b, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x5f, 0x61, 0x72, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x0a, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x41, 0x72, 0x67, 0x73, 0x12, 0x18, 0x0a, 0x07,
+	0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x65,
+	0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x12, 0x22, 0x0a, 0x0a, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f,
+	0x66, 0x69, 0x6c, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x88, 0x01, 0x01, 0x12, 0x21, 0x0a, 0x09, 0x6e, 0x61,
+	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52,
+	0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x88, 0x01, 0x01, 0x42, 0x0d, 0x0a,
+	0x0b, 0x5f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x42, 0x0c, 0x0a, 0x0a,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x22, 0xaa, 0x01, 0x0a, 0x0c, 0x43,
+	0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61,
+	0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61,
+	0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e,
+	0x67, 0x5f, 0x64, 0x69, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x77, 0x6f, 0x72,
+	0x6b, 0x69, 0x6e, 0x67, 0x44, 0x69, 0x72, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6f, 0x64, 0x65, 0x67,
+	0x65, 0x6e, 0x5f, 0x64, 0x65, 0x62, 0x75, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c,
+	0x63, 0x6f, 0x64, 0x65, 0x67, 0x65, 0x6e, 0x44, 0x65, 0x62, 0x75, 0x67, 0x12, 0x1f, 0x0a, 0x0b,
+	0x70, 0x61, 0x72, 0x73, 0x65, 0x5f, 0x74, 0x65, 0x73, 0x74, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0a, 0x70, 0x61, 0x72, 0x73, 0x65, 0x54, 0x65, 0x73, 0x74, 0x73, 0x12, 0x18, 0x0a,
+	0x07, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07,
+	0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x22, 0x87, 0x03, 0x0a, 0x0d, 0x45, 0x78, 0x70, 0x6f,
+	0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70,
+	0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70,
+	0x52, 0x6f, 0x6f, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x6f, 0x73, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x04, 0x67, 0x6f, 0x6f, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x67, 0x6f, 0x61, 0x72,
+	0x63, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x67, 0x6f, 0x61, 0x72, 0x63, 0x68,
+	0x12, 0x1f, 0x0a, 0x0b, 0x63, 0x67, 0x6f, 0x5f, 0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x63, 0x67, 0x6f, 0x45, 0x6e, 0x61, 0x62, 0x6c, 0x65,
+	0x64, 0x12, 0x18, 0x0a, 0x07, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x12, 0x3b, 0x0a, 0x06, 0x64,
+	0x6f, 0x63, 0x6b, 0x65, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x6f, 0x63, 0x6b,
+	0x65, 0x72, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x48, 0x00,
+	0x52, 0x06, 0x64, 0x6f, 0x63, 0x6b, 0x65, 0x72, 0x12, 0x26, 0x0a, 0x0f, 0x69, 0x6e, 0x66, 0x72,
+	0x61, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x07, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0d, 0x69, 0x6e, 0x66, 0x72, 0x61, 0x43, 0x6f, 0x6e, 0x66, 0x50, 0x61, 0x74, 0x68,
+	0x12, 0x1a, 0x0a, 0x08, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x08, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x08, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x1a, 0x0a, 0x08,
+	0x67, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08,
+	0x67, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x73, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x6b, 0x69, 0x70,
+	0x5f, 0x69, 0x6e, 0x66, 0x72, 0x61, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x18, 0x0a, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0d, 0x73, 0x6b, 0x69, 0x70, 0x49, 0x6e, 0x66, 0x72, 0x61, 0x43, 0x6f, 0x6e, 0x66,
+	0x12, 0x25, 0x0a, 0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x72, 0x6f,
+	0x6f, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x52, 0x6f, 0x6f, 0x74, 0x42, 0x08, 0x0a, 0x06, 0x66, 0x6f, 0x72, 0x6d, 0x61,
+	0x74, 0x22, 0x96, 0x01, 0x0a, 0x12, 0x44, 0x6f, 0x63, 0x6b, 0x65, 0x72, 0x45, 0x78, 0x70, 0x6f,
+	0x72, 0x74, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x6c, 0x6f, 0x63, 0x61,
+	0x6c, 0x5f, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x5f, 0x74, 0x61, 0x67, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0e, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x54,
+	0x61, 0x67, 0x12, 0x30, 0x0a, 0x14, 0x70, 0x75, 0x73, 0x68, 0x5f, 0x64, 0x65, 0x73, 0x74, 0x69,
+	0x6e, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x61, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x12, 0x70, 0x75, 0x73, 0x68, 0x44, 0x65, 0x73, 0x74, 0x69, 0x6e, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x54, 0x61, 0x67, 0x12, 0x24, 0x0a, 0x0e, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x6d, 0x61,
+	0x67, 0x65, 0x5f, 0x74, 0x61, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x62, 0x61,
+	0x73, 0x65, 0x49, 0x6d, 0x61, 0x67, 0x65, 0x54, 0x61, 0x67, 0x22, 0xfe, 0x01, 0x0a, 0x10, 0x44,
+	0x42, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x64, 0x62,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x62, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x76, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x3f,
+	0x0a, 0x0c, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61,
+	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x42, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x54, 0x79,
+	0x70, 0x65, 0x52, 0x0b, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x54, 0x79, 0x70, 0x65, 0x12,
+	0x21, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x88,
+	0x01, 0x01, 0x12, 0x29, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x15, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e,
+	0x2e, 0x44, 0x42, 0x52, 0x6f, 0x6c, 0x65, 0x52, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x42, 0x0c, 0x0a,
+	0x0a, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x22, 0x25, 0x0a, 0x11, 0x44,
+	0x42, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x10, 0x0a, 0x03, 0x64, 0x73, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64,
+	0x73, 0x6e, 0x22, 0xf7, 0x01, 0x0a, 0x0e, 0x44, 0x42, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74,
+	0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x76, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x70,
+	0x6f, 0x72, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x12,
+	0x3f, 0x0a, 0x0c, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64,
+	0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x42, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x54,
+	0x79, 0x70, 0x65, 0x52, 0x0b, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x54, 0x79, 0x70, 0x65,
+	0x12, 0x21, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x88, 0x01, 0x01, 0x12, 0x29, 0x0a, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x15, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x44, 0x42, 0x52, 0x6f, 0x6c, 0x65, 0x52, 0x04, 0x72, 0x6f, 0x6c, 0x65, 0x42, 0x0c,
+	0x0a, 0x0a, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x22, 0xc4, 0x01, 0x0a,
+	0x0e, 0x44, 0x42, 0x52, 0x65, 0x73, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x25, 0x0a, 0x0e, 0x64, 0x61,
+	0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x0d, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x4e, 0x61, 0x6d, 0x65,
+	0x73, 0x12, 0x3f, 0x0a, 0x0c, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x74, 0x79, 0x70,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x42, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65,
+	0x72, 0x54, 0x79, 0x70, 0x65, 0x52, 0x0b, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x54, 0x79,
+	0x70, 0x65, 0x12, 0x21, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x88, 0x01, 0x01, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x22, 0x93, 0x04, 0x0a, 0x10, 0x47, 0x65, 0x6e, 0x43, 0x6c, 0x69, 0x65, 0x6e,
+	0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x15, 0x0a, 0x06, 0x61, 0x70, 0x70, 0x5f,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x61, 0x70, 0x70, 0x49, 0x64, 0x12,
+	0x19, 0x0a, 0x08, 0x65, 0x6e, 0x76, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6c, 0x61,
+	0x6e, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6c, 0x61, 0x6e, 0x67, 0x12, 0x1a,
+	0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x70, 0x61, 0x74, 0x68, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x65, 0x78, 0x63, 0x6c, 0x75, 0x64,
+	0x65, 0x64, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x10, 0x65, 0x78, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f,
+	0x74, 0x61, 0x67, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x6e, 0x64, 0x70,
+	0x6f, 0x69, 0x6e, 0x74, 0x54, 0x61, 0x67, 0x73, 0x12, 0x34, 0x0a, 0x16, 0x65, 0x78, 0x63, 0x6c,
+	0x75, 0x64, 0x65, 0x64, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f, 0x74, 0x61,
+	0x67, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x09, 0x52, 0x14, 0x65, 0x78, 0x63, 0x6c, 0x75, 0x64,
+	0x65, 0x64, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x54, 0x61, 0x67, 0x73, 0x12, 0x4e,
+	0x0a, 0x21, 0x6f, 0x70, 0x65, 0x6e, 0x61, 0x70, 0x69, 0x5f, 0x65, 0x78, 0x63, 0x6c, 0x75, 0x64,
+	0x65, 0x5f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69,
+	0x6e, 0x74, 0x73, 0x18, 0x09, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x1e, 0x6f, 0x70, 0x65,
+	0x6e, 0x61, 0x70, 0x69, 0x45, 0x78, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x50, 0x72, 0x69, 0x76, 0x61,
+	0x74, 0x65, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73, 0x88, 0x01, 0x01, 0x12, 0x2b,
+	0x0a, 0x0f, 0x74, 0x73, 0x5f, 0x73, 0x68, 0x61, 0x72, 0x65, 0x64, 0x5f, 0x74, 0x79, 0x70, 0x65,
+	0x73, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x48, 0x01, 0x52, 0x0d, 0x74, 0x73, 0x53, 0x68, 0x61,
+	0x72, 0x65, 0x64, 0x54, 0x79, 0x70, 0x65, 0x73, 0x88, 0x01, 0x01, 0x12, 0x2d, 0x0a, 0x10, 0x74,
+	0x73, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18,
+	0x0b, 0x20, 0x01, 0x28, 0x09, 0x48, 0x02, 0x52, 0x0e, 0x74, 0x73, 0x43, 0x6c, 0x69, 0x65, 0x6e,
+	0x74, 0x54, 0x61, 0x72, 0x67, 0x65, 0x74, 0x88, 0x01, 0x01, 0x42, 0x24, 0x0a, 0x22, 0x5f, 0x6f,
+	0x70, 0x65, 0x6e, 0x61, 0x70, 0x69, 0x5f, 0x65, 0x78, 0x63, 0x6c, 0x75, 0x64, 0x65, 0x5f, 0x70,
+	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x73,
+	0x42, 0x12, 0x0a, 0x10, 0x5f, 0x74, 0x73, 0x5f, 0x73, 0x68, 0x61, 0x72, 0x65, 0x64, 0x5f, 0x74,
+	0x79, 0x70, 0x65, 0x73, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x74, 0x73, 0x5f, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x5f, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x22, 0x27, 0x0a, 0x11, 0x47, 0x65, 0x6e,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x63, 0x6f,
+	0x64, 0x65, 0x22, 0x2f, 0x0a, 0x12, 0x47, 0x65, 0x6e, 0x57, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f,
+	0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52,
+	0x6f, 0x6f, 0x74, 0x22, 0x15, 0x0a, 0x13, 0x47, 0x65, 0x6e, 0x57, 0x72, 0x61, 0x70, 0x70, 0x65,
+	0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x5a, 0x0a, 0x15, 0x53, 0x65,
+	0x63, 0x72, 0x65, 0x74, 0x73, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x18, 0x0a, 0x16, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74,
+	0x73, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0x4c, 0x0a, 0x0f, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a,
+	0x0b, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0a, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x48, 0x61, 0x73, 0x68, 0x22, 0xa4,
+	0x01, 0x0a, 0x09, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x0e, 0x0a, 0x02,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x12, 0x16, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x29, 0x0a, 0x0e, 0x6c, 0x61, 0x73, 0x74, 0x5f,
+	0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x61, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48,
+	0x00, 0x52, 0x0c, 0x6c, 0x61, 0x73, 0x74, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x41, 0x74, 0x88,
+	0x01, 0x01, 0x42, 0x11, 0x0a, 0x0f, 0x5f, 0x6c, 0x61, 0x73, 0x74, 0x5f, 0x61, 0x63, 0x74, 0x69,
+	0x76, 0x65, 0x5f, 0x61, 0x74, 0x22, 0x47, 0x0a, 0x16, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e,
+	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x5f,
+	0x0a, 0x16, 0x53, 0x77, 0x69, 0x74, 0x63, 0x68, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f,
+	0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52,
+	0x6f, 0x6f, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x22,
+	0x32, 0x0a, 0x15, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f,
+	0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52,
+	0x6f, 0x6f, 0x74, 0x22, 0x47, 0x0a, 0x16, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4e, 0x61, 0x6d,
+	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a,
+	0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x52, 0x0a, 0x16,
+	0x4c, 0x69, 0x73, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x38, 0x0a, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x73,
+	0x70, 0x61, 0x63, 0x65, 0x52, 0x0a, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73,
+	0x22, 0x5a, 0x0a, 0x0f, 0x54, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x12, 0x17, 0x0a, 0x07, 0x61, 0x6e, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x61, 0x6e, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07,
+	0x65, 0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x65,
+	0x6e, 0x61, 0x62, 0x6c, 0x65, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x64, 0x65, 0x62, 0x75, 0x67, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x64, 0x65, 0x62, 0x75, 0x67, 0x22, 0x8c, 0x02, 0x0a,
+	0x0f, 0x44, 0x75, 0x6d, 0x70, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x77,
+	0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x5f, 0x64, 0x69, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0a, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x44, 0x69, 0x72, 0x12, 0x18, 0x0a, 0x07,
+	0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x65,
+	0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x61, 0x72, 0x73, 0x65, 0x5f,
+	0x74, 0x65, 0x73, 0x74, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x70, 0x61, 0x72,
+	0x73, 0x65, 0x54, 0x65, 0x73, 0x74, 0x73, 0x12, 0x3d, 0x0a, 0x06, 0x66, 0x6f, 0x72, 0x6d, 0x61,
+	0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x75, 0x6d, 0x70, 0x4d, 0x65, 0x74, 0x61,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x52, 0x06,
+	0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x22, 0x43, 0x0a, 0x06, 0x46, 0x6f, 0x72, 0x6d, 0x61, 0x74,
+	0x12, 0x16, 0x0a, 0x12, 0x46, 0x4f, 0x52, 0x4d, 0x41, 0x54, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45,
+	0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0f, 0x0a, 0x0b, 0x46, 0x4f, 0x52, 0x4d,
+	0x41, 0x54, 0x5f, 0x4a, 0x53, 0x4f, 0x4e, 0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x46, 0x4f, 0x52,
+	0x4d, 0x41, 0x54, 0x5f, 0x50, 0x52, 0x4f, 0x54, 0x4f, 0x10, 0x02, 0x22, 0x26, 0x0a, 0x10, 0x44,
+	0x75, 0x6d, 0x70, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x12, 0x0a, 0x04, 0x6d, 0x65, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x6d,
+	0x65, 0x74, 0x61, 0x22, 0xcb, 0x15, 0x0a, 0x0a, 0x53, 0x51, 0x4c, 0x43, 0x50, 0x6c, 0x75, 0x67,
+	0x69, 0x6e, 0x1a, 0x36, 0x0a, 0x04, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1a,
+	0x0a, 0x08, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x08, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x73, 0x1a, 0xc9, 0x01, 0x0a, 0x08, 0x53,
+	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x12, 0x16, 0x0a, 0x06, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x06, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x06, 0x73, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x12, 0x18, 0x0a, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73, 0x12, 0x3b, 0x0a, 0x07, 0x63,
+	0x6f, 0x64, 0x65, 0x67, 0x65, 0x6e, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c,
+	0x43, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x43, 0x6f, 0x64, 0x65, 0x67, 0x65, 0x6e, 0x52,
+	0x07, 0x63, 0x6f, 0x64, 0x65, 0x67, 0x65, 0x6e, 0x4a, 0x04, 0x08, 0x05, 0x10, 0x06, 0x4a, 0x04,
+	0x08, 0x08, 0x10, 0x09, 0x4a, 0x04, 0x08, 0x09, 0x10, 0x0a, 0x4a, 0x04, 0x08, 0x0a, 0x10, 0x0b,
+	0x4a, 0x04, 0x08, 0x0b, 0x10, 0x0c, 0x1a, 0xaf, 0x02, 0x0a, 0x07, 0x43, 0x6f, 0x64, 0x65, 0x67,
+	0x65, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x6f, 0x75, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x6f, 0x75, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x12, 0x18, 0x0a, 0x07,
+	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x6f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x6e, 0x76, 0x18, 0x04, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x03, 0x65, 0x6e, 0x76, 0x12, 0x43, 0x0a, 0x07, 0x70, 0x72, 0x6f, 0x63,
+	0x65, 0x73, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43, 0x50, 0x6c,
+	0x75, 0x67, 0x69, 0x6e, 0x2e, 0x43, 0x6f, 0x64, 0x65, 0x67, 0x65, 0x6e, 0x2e, 0x50, 0x72, 0x6f,
+	0x63, 0x65, 0x73, 0x73, 0x52, 0x07, 0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x12, 0x3a, 0x0a,
+	0x04, 0x77, 0x61, 0x73, 0x6d, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43,
+	0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x43, 0x6f, 0x64, 0x65, 0x67, 0x65, 0x6e, 0x2e, 0x57,
+	0x41, 0x53, 0x4d, 0x52, 0x04, 0x77, 0x61, 0x73, 0x6d, 0x1a, 0x1b, 0x0a, 0x07, 0x50, 0x72, 0x6f,
+	0x63, 0x65, 0x73, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x63, 0x6d, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x63, 0x6d, 0x64, 0x1a, 0x30, 0x0a, 0x04, 0x57, 0x41, 0x53, 0x4d, 0x12, 0x10,
+	0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c,
+	0x12, 0x16, 0x0a, 0x06, 0x73, 0x68, 0x61, 0x32, 0x35, 0x36, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x73, 0x68, 0x61, 0x32, 0x35, 0x36, 0x1a, 0x9a, 0x01, 0x0a, 0x07, 0x43, 0x61, 0x74,
+	0x61, 0x6c, 0x6f, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x25,
+	0x0a, 0x0e, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x53,
+	0x63, 0x68, 0x65, 0x6d, 0x61, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3a, 0x0a, 0x07, 0x73, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43, 0x50,
+	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x52, 0x07, 0x73, 0x63,
+	0x68, 0x65, 0x6d, 0x61, 0x73, 0x1a, 0xf7, 0x01, 0x0a, 0x06, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61,
+	0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x37,
+	0x0a, 0x06, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53,
+	0x51, 0x4c, 0x43, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x54, 0x61, 0x62, 0x6c, 0x65, 0x52,
+	0x06, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x12, 0x34, 0x0a, 0x05, 0x65, 0x6e, 0x75, 0x6d, 0x73,
+	0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43, 0x50, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x2e, 0x45, 0x6e, 0x75, 0x6d, 0x52, 0x05, 0x65, 0x6e, 0x75, 0x6d, 0x73, 0x12, 0x50, 0x0a,
+	0x0f, 0x63, 0x6f, 0x6d, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x73,
+	0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43, 0x50, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x52,
+	0x0e, 0x63, 0x6f, 0x6d, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65, 0x73, 0x1a,
+	0x3d, 0x0a, 0x0d, 0x43, 0x6f, 0x6d, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x65, 0x54, 0x79, 0x70, 0x65,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x1a, 0x48,
+	0x0a, 0x04, 0x45, 0x6e, 0x75, 0x6d, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x76, 0x61,
+	0x6c, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x76, 0x61, 0x6c, 0x73, 0x12, 0x18,
+	0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x1a, 0x95, 0x01, 0x0a, 0x05, 0x54, 0x61, 0x62,
+	0x6c, 0x65, 0x12, 0x36, 0x0a, 0x03, 0x72, 0x65, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x53, 0x51, 0x4c, 0x43, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x66, 0x69, 0x65, 0x72, 0x52, 0x03, 0x72, 0x65, 0x6c, 0x12, 0x3a, 0x0a, 0x07, 0x63, 0x6f,
+	0x6c, 0x75, 0x6d, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43,
+	0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x43, 0x6f, 0x6c, 0x75, 0x6d, 0x6e, 0x52, 0x07, 0x63,
+	0x6f, 0x6c, 0x75, 0x6d, 0x6e, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e,
+	0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74,
+	0x1a, 0x52, 0x0a, 0x0a, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x12, 0x18,
+	0x0a, 0x07, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x07, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x63, 0x68, 0x65,
+	0x6d, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x1a, 0xc4, 0x04, 0x0a, 0x06, 0x43, 0x6f, 0x6c, 0x75, 0x6d, 0x6e, 0x12,
+	0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6e, 0x6f, 0x74, 0x5f, 0x6e, 0x75, 0x6c, 0x6c, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x6e, 0x6f, 0x74, 0x4e, 0x75, 0x6c, 0x6c, 0x12, 0x19,
+	0x0a, 0x08, 0x69, 0x73, 0x5f, 0x61, 0x72, 0x72, 0x61, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08,
+	0x52, 0x07, 0x69, 0x73, 0x41, 0x72, 0x72, 0x61, 0x79, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d,
+	0x6d, 0x65, 0x6e, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d,
+	0x65, 0x6e, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x18, 0x06, 0x20,
+	0x01, 0x28, 0x05, 0x52, 0x06, 0x6c, 0x65, 0x6e, 0x67, 0x74, 0x68, 0x12, 0x24, 0x0a, 0x0e, 0x69,
+	0x73, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x64, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x18, 0x07, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x0c, 0x69, 0x73, 0x4e, 0x61, 0x6d, 0x65, 0x64, 0x50, 0x61, 0x72, 0x61,
+	0x6d, 0x12, 0x20, 0x0a, 0x0c, 0x69, 0x73, 0x5f, 0x66, 0x75, 0x6e, 0x63, 0x5f, 0x63, 0x61, 0x6c,
+	0x6c, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x69, 0x73, 0x46, 0x75, 0x6e, 0x63, 0x43,
+	0x61, 0x6c, 0x6c, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x18, 0x09, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x12, 0x3a, 0x0a, 0x05, 0x74, 0x61, 0x62,
+	0x6c, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43, 0x50, 0x6c, 0x75,
+	0x67, 0x69, 0x6e, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x52, 0x05,
+	0x74, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x61,
+	0x6c, 0x69, 0x61, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x74, 0x61, 0x62, 0x6c,
+	0x65, 0x41, 0x6c, 0x69, 0x61, 0x73, 0x12, 0x38, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x0c,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61,
+	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e,
+	0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65,
+	0x12, 0x22, 0x0a, 0x0d, 0x69, 0x73, 0x5f, 0x73, 0x71, 0x6c, 0x63, 0x5f, 0x73, 0x6c, 0x69, 0x63,
+	0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0b, 0x69, 0x73, 0x53, 0x71, 0x6c, 0x63, 0x53,
+	0x6c, 0x69, 0x63, 0x65, 0x12, 0x45, 0x0a, 0x0b, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x5f, 0x74, 0x61,
+	0x62, 0x6c, 0x65, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43, 0x50, 0x6c,
+	0x75, 0x67, 0x69, 0x6e, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x66, 0x69, 0x65, 0x72, 0x52,
+	0x0a, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x54, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x6f,
+	0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0f, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0c, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x61, 0x6c, 0x4e, 0x61, 0x6d, 0x65,
+	0x12, 0x1a, 0x0a, 0x08, 0x75, 0x6e, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x18, 0x10, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x08, 0x75, 0x6e, 0x73, 0x69, 0x67, 0x6e, 0x65, 0x64, 0x12, 0x1d, 0x0a, 0x0a,
+	0x61, 0x72, 0x72, 0x61, 0x79, 0x5f, 0x64, 0x69, 0x6d, 0x73, 0x18, 0x11, 0x20, 0x01, 0x28, 0x05,
+	0x52, 0x09, 0x61, 0x72, 0x72, 0x61, 0x79, 0x44, 0x69, 0x6d, 0x73, 0x1a, 0xca, 0x02, 0x0a, 0x05,
+	0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x65, 0x78, 0x74, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x65, 0x78, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a,
+	0x03, 0x63, 0x6d, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x63, 0x6d, 0x64, 0x12,
+	0x3a, 0x0a, 0x07, 0x63, 0x6f, 0x6c, 0x75, 0x6d, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e,
+	0x2e, 0x53, 0x51, 0x4c, 0x43, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x43, 0x6f, 0x6c, 0x75,
+	0x6d, 0x6e, 0x52, 0x07, 0x63, 0x6f, 0x6c, 0x75, 0x6d, 0x6e, 0x73, 0x12, 0x3f, 0x0a, 0x06, 0x70,
+	0x61, 0x72, 0x61, 0x6d, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43,
+	0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72,
+	0x52, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12, 0x1a, 0x0a, 0x08,
+	0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x08,
+	0x63, 0x6f, 0x6d, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x52, 0x0a, 0x11, 0x69, 0x6e, 0x73, 0x65, 0x72, 0x74, 0x5f, 0x69,
+	0x6e, 0x74, 0x6f, 0x5f, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x53, 0x51, 0x4c, 0x43, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x66, 0x69, 0x65, 0x72, 0x52, 0x11, 0x69, 0x6e, 0x73, 0x65, 0x72, 0x74, 0x5f, 0x69, 0x6e,
+	0x74, 0x6f, 0x5f, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x1a, 0x5d, 0x0a, 0x09, 0x50, 0x61, 0x72, 0x61,
+	0x6d, 0x65, 0x74, 0x65, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x38, 0x0a,
+	0x06, 0x63, 0x6f, 0x6c, 0x75, 0x6d, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51,
+	0x4c, 0x43, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x43, 0x6f, 0x6c, 0x75, 0x6d, 0x6e, 0x52,
+	0x06, 0x63, 0x6f, 0x6c, 0x75, 0x6d, 0x6e, 0x1a, 0xbd, 0x02, 0x0a, 0x0f, 0x47, 0x65, 0x6e, 0x65,
+	0x72, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x3e, 0x0a, 0x08, 0x73,
+	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51,
+	0x4c, 0x43, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
+	0x73, 0x52, 0x08, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x3b, 0x0a, 0x07, 0x63,
+	0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c,
+	0x43, 0x50, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x43, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x52,
+	0x07, 0x63, 0x61, 0x74, 0x61, 0x6c, 0x6f, 0x67, 0x12, 0x39, 0x0a, 0x07, 0x71, 0x75, 0x65, 0x72,
+	0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43, 0x50, 0x6c,
+	0x75, 0x67, 0x69, 0x6e, 0x2e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x52, 0x07, 0x71, 0x75, 0x65, 0x72,
+	0x69, 0x65, 0x73, 0x12, 0x22, 0x0a, 0x0c, 0x73, 0x71, 0x6c, 0x63, 0x5f, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x73, 0x71, 0x6c, 0x63, 0x5f,
+	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x26, 0x0a, 0x0e, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x0e, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12,
+	0x26, 0x0a, 0x0e, 0x67, 0x6c, 0x6f, 0x62, 0x61, 0x6c, 0x5f, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0e, 0x67, 0x6c, 0x6f, 0x62, 0x61, 0x6c, 0x5f,
+	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x48, 0x0a, 0x10, 0x47, 0x65, 0x6e, 0x65, 0x72,
+	0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x34, 0x0a, 0x05, 0x66,
+	0x69, 0x6c, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x51, 0x4c, 0x43, 0x50,
+	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2e, 0x46, 0x69, 0x6c, 0x65, 0x52, 0x05, 0x66, 0x69, 0x6c, 0x65,
+	0x73, 0x2a, 0x70, 0x0a, 0x06, 0x44, 0x42, 0x52, 0x6f, 0x6c, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x44,
+	0x42, 0x5f, 0x52, 0x4f, 0x4c, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49,
+	0x45, 0x44, 0x10, 0x00, 0x12, 0x15, 0x0a, 0x11, 0x44, 0x42, 0x5f, 0x52, 0x4f, 0x4c, 0x45, 0x5f,
+	0x53, 0x55, 0x50, 0x45, 0x52, 0x55, 0x53, 0x45, 0x52, 0x10, 0x01, 0x12, 0x11, 0x0a, 0x0d, 0x44,
+	0x42, 0x5f, 0x52, 0x4f, 0x4c, 0x45, 0x5f, 0x41, 0x44, 0x4d, 0x49, 0x4e, 0x10, 0x02, 0x12, 0x11,
+	0x0a, 0x0d, 0x44, 0x42, 0x5f, 0x52, 0x4f, 0x4c, 0x45, 0x5f, 0x57, 0x52, 0x49, 0x54, 0x45, 0x10,
+	0x03, 0x12, 0x10, 0x0a, 0x0c, 0x44, 0x42, 0x5f, 0x52, 0x4f, 0x4c, 0x45, 0x5f, 0x52, 0x45, 0x41,
+	0x44, 0x10, 0x04, 0x2a, 0x7f, 0x0a, 0x0d, 0x44, 0x42, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x54, 0x79, 0x70, 0x65, 0x12, 0x1f, 0x0a, 0x1b, 0x44, 0x42, 0x5f, 0x43, 0x4c, 0x55, 0x53, 0x54,
+	0x45, 0x52, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
+	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x44, 0x42, 0x5f, 0x43, 0x4c, 0x55, 0x53,
+	0x54, 0x45, 0x52, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x52, 0x55, 0x4e, 0x10, 0x01, 0x12, 0x18,
+	0x0a, 0x14, 0x44, 0x42, 0x5f, 0x43, 0x4c, 0x55, 0x53, 0x54, 0x45, 0x52, 0x5f, 0x54, 0x59, 0x50,
+	0x45, 0x5f, 0x54, 0x45, 0x53, 0x54, 0x10, 0x02, 0x12, 0x1a, 0x0a, 0x16, 0x44, 0x42, 0x5f, 0x43,
+	0x4c, 0x55, 0x53, 0x54, 0x45, 0x52, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x53, 0x48, 0x41, 0x44,
+	0x4f, 0x57, 0x10, 0x03, 0x32, 0xa7, 0x0c, 0x0a, 0x06, 0x44, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x12,
+	0x41, 0x0a, 0x03, 0x52, 0x75, 0x6e, 0x12, 0x19, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x52, 0x75, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65,
+	0x30, 0x01, 0x12, 0x43, 0x0a, 0x04, 0x54, 0x65, 0x73, 0x74, 0x12, 0x1a, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x54, 0x65, 0x73, 0x74, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x30, 0x01, 0x12, 0x4b, 0x0a, 0x08, 0x54, 0x65, 0x73, 0x74, 0x53,
+	0x70, 0x65, 0x63, 0x12, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x54, 0x65, 0x73, 0x74, 0x53, 0x70, 0x65, 0x63, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x54, 0x65, 0x73, 0x74, 0x53, 0x70, 0x65, 0x63, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x0a, 0x45, 0x78, 0x65, 0x63, 0x53, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x12, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x45, 0x78, 0x65, 0x63, 0x53, 0x63, 0x72, 0x69, 0x70, 0x74, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61,
+	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x30, 0x01, 0x12, 0x45, 0x0a, 0x05, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x12, 0x1b,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43,
+	0x68, 0x65, 0x63, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d,
+	0x61, 0x6e, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x30, 0x01, 0x12, 0x47, 0x0a, 0x06,
+	0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x12, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61,
+	0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x30, 0x01, 0x12, 0x4e, 0x0a, 0x09, 0x44, 0x42, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x12, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d,
+	0x6f, 0x6e, 0x2e, 0x44, 0x42, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x42, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x49, 0x0a, 0x07, 0x44, 0x42, 0x50, 0x72, 0x6f, 0x78, 0x79,
+	0x12, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e,
+	0x2e, 0x44, 0x42, 0x50, 0x72, 0x6f, 0x78, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e,
+	0x43, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x30, 0x01,
+	0x12, 0x49, 0x0a, 0x07, 0x44, 0x42, 0x52, 0x65, 0x73, 0x65, 0x74, 0x12, 0x1d, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x42, 0x52, 0x65,
+	0x73, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1d, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x6f, 0x6d, 0x6d, 0x61,
+	0x6e, 0x64, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x30, 0x01, 0x12, 0x4e, 0x0a, 0x09, 0x47,
+	0x65, 0x6e, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x12, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x47, 0x65, 0x6e, 0x43, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x47, 0x65, 0x6e, 0x43, 0x6c, 0x69,
+	0x65, 0x6e, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x54, 0x0a, 0x0b, 0x47,
+	0x65, 0x6e, 0x57, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x12, 0x21, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x47, 0x65, 0x6e, 0x57, 0x72,
+	0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x47, 0x65,
+	0x6e, 0x57, 0x72, 0x61, 0x70, 0x70, 0x65, 0x72, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x5d, 0x0a, 0x0e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x73, 0x52, 0x65, 0x66, 0x72,
+	0x65, 0x73, 0x68, 0x12, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x73, 0x52, 0x65, 0x66, 0x72, 0x65,
+	0x73, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74,
+	0x73, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x41, 0x0a, 0x07, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x1a, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x52, 0x0a, 0x0f, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x61, 0x6d,
+	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x4e, 0x61, 0x6d,
+	0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x18, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4e, 0x61,
+	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x52, 0x0a, 0x0f, 0x53, 0x77, 0x69, 0x74, 0x63,
+	0x68, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x25, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x53, 0x77, 0x69, 0x74, 0x63,
+	0x68, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x18, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f,
+	0x6e, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x5d, 0x0a, 0x0e, 0x4c,
+	0x69, 0x73, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x12, 0x24, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x69,
+	0x73, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65,
+	0x6d, 0x6f, 0x6e, 0x2e, 0x4c, 0x69, 0x73, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x50, 0x0a, 0x0f, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x25, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x4b, 0x0a, 0x08,
+	0x44, 0x75, 0x6d, 0x70, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x75, 0x6d, 0x70, 0x4d, 0x65, 0x74,
+	0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x44, 0x75, 0x6d, 0x70, 0x4d, 0x65, 0x74,
+	0x61, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x43, 0x0a, 0x09, 0x54, 0x65, 0x6c,
+	0x65, 0x6d, 0x65, 0x74, 0x72, 0x79, 0x12, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x54, 0x65, 0x6c, 0x65, 0x6d, 0x65, 0x74, 0x72, 0x79,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x4e,
+	0x0a, 0x09, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x70, 0x12, 0x1f, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x41, 0x70, 0x70, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x2e, 0x43, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x41, 0x70, 0x70, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x1e,
+	0x5a, 0x1c, 0x65, 0x6e, 0x63, 0x72, 0x2e, 0x64, 0x65, 0x76, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x64, 0x61, 0x65, 0x6d, 0x6f, 0x6e, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_encore_daemon_daemon_proto_rawDescOnce sync.Once
+	file_encore_daemon_daemon_proto_rawDescData = file_encore_daemon_daemon_proto_rawDesc
+)
+
+func file_encore_daemon_daemon_proto_rawDescGZIP() []byte {
+	file_encore_daemon_daemon_proto_rawDescOnce.Do(func() {
+		file_encore_daemon_daemon_proto_rawDescData = protoimpl.X.CompressGZIP(file_encore_daemon_daemon_proto_rawDescData)
+	})
+	return file_encore_daemon_daemon_proto_rawDescData
+}
+
+var file_encore_daemon_daemon_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
+var file_encore_daemon_daemon_proto_msgTypes = make([]protoimpl.MessageInfo, 51)
+var file_encore_daemon_daemon_proto_goTypes = []interface{}{
+	(DBRole)(0),                         // 0: encore.daemon.DBRole
+	(DBClusterType)(0),                  // 1: encore.daemon.DBClusterType
+	(RunRequest_BrowserMode)(0),         // 2: encore.daemon.RunRequest.BrowserMode
+	(RunRequest_DebugMode)(0),           // 3: encore.daemon.RunRequest.DebugMode
+	(DumpMetaRequest_Format)(0),         // 4: encore.daemon.DumpMetaRequest.Format
+	(*CommandMessage)(nil),              // 5: encore.daemon.CommandMessage
+	(*CommandOutput)(nil),               // 6: encore.daemon.CommandOutput
+	(*CommandExit)(nil),                 // 7: encore.daemon.CommandExit
+	(*CommandDisplayErrors)(nil),        // 8: encore.daemon.CommandDisplayErrors
+	(*CreateAppRequest)(nil),            // 9: encore.daemon.CreateAppRequest
+	(*CreateAppResponse)(nil),           // 10: encore.daemon.CreateAppResponse
+	(*RunRequest)(nil),                  // 11: encore.daemon.RunRequest
+	(*TestRequest)(nil),                 // 12: encore.daemon.TestRequest
+	(*TestSpecRequest)(nil),             // 13: encore.daemon.TestSpecRequest
+	(*TestSpecResponse)(nil),            // 14: encore.daemon.TestSpecResponse
+	(*ExecScriptRequest)(nil),           // 15: encore.daemon.ExecScriptRequest
+	(*CheckRequest)(nil),                // 16: encore.daemon.CheckRequest
+	(*ExportRequest)(nil),               // 17: encore.daemon.ExportRequest
+	(*DockerExportParams)(nil),          // 18: encore.daemon.DockerExportParams
+	(*DBConnectRequest)(nil),            // 19: encore.daemon.DBConnectRequest
+	(*DBConnectResponse)(nil),           // 20: encore.daemon.DBConnectResponse
+	(*DBProxyRequest)(nil),              // 21: encore.daemon.DBProxyRequest
+	(*DBResetRequest)(nil),              // 22: encore.daemon.DBResetRequest
+	(*GenClientRequest)(nil),            // 23: encore.daemon.GenClientRequest
+	(*GenClientResponse)(nil),           // 24: encore.daemon.GenClientResponse
+	(*GenWrappersRequest)(nil),          // 25: encore.daemon.GenWrappersRequest
+	(*GenWrappersResponse)(nil),         // 26: encore.daemon.GenWrappersResponse
+	(*SecretsRefreshRequest)(nil),       // 27: encore.daemon.SecretsRefreshRequest
+	(*SecretsRefreshResponse)(nil),      // 28: encore.daemon.SecretsRefreshResponse
+	(*VersionResponse)(nil),             // 29: encore.daemon.VersionResponse
+	(*Namespace)(nil),                   // 30: encore.daemon.Namespace
+	(*CreateNamespaceRequest)(nil),      // 31: encore.daemon.CreateNamespaceRequest
+	(*SwitchNamespaceRequest)(nil),      // 32: encore.daemon.SwitchNamespaceRequest
+	(*ListNamespacesRequest)(nil),       // 33: encore.daemon.ListNamespacesRequest
+	(*DeleteNamespaceRequest)(nil),      // 34: encore.daemon.DeleteNamespaceRequest
+	(*ListNamespacesResponse)(nil),      // 35: encore.daemon.ListNamespacesResponse
+	(*TelemetryConfig)(nil),             // 36: encore.daemon.TelemetryConfig
+	(*DumpMetaRequest)(nil),             // 37: encore.daemon.DumpMetaRequest
+	(*DumpMetaResponse)(nil),            // 38: encore.daemon.DumpMetaResponse
+	(*SQLCPlugin)(nil),                  // 39: encore.daemon.SQLCPlugin
+	(*SQLCPlugin_File)(nil),             // 40: encore.daemon.SQLCPlugin.File
+	(*SQLCPlugin_Settings)(nil),         // 41: encore.daemon.SQLCPlugin.Settings
+	(*SQLCPlugin_Codegen)(nil),          // 42: encore.daemon.SQLCPlugin.Codegen
+	(*SQLCPlugin_Catalog)(nil),          // 43: encore.daemon.SQLCPlugin.Catalog
+	(*SQLCPlugin_Schema)(nil),           // 44: encore.daemon.SQLCPlugin.Schema
+	(*SQLCPlugin_CompositeType)(nil),    // 45: encore.daemon.SQLCPlugin.CompositeType
+	(*SQLCPlugin_Enum)(nil),             // 46: encore.daemon.SQLCPlugin.Enum
+	(*SQLCPlugin_Table)(nil),            // 47: encore.daemon.SQLCPlugin.Table
+	(*SQLCPlugin_Identifier)(nil),       // 48: encore.daemon.SQLCPlugin.Identifier
+	(*SQLCPlugin_Column)(nil),           // 49: encore.daemon.SQLCPlugin.Column
+	(*SQLCPlugin_Query)(nil),            // 50: encore.daemon.SQLCPlugin.Query
+	(*SQLCPlugin_Parameter)(nil),        // 51: encore.daemon.SQLCPlugin.Parameter
+	(*SQLCPlugin_GenerateRequest)(nil),  // 52: encore.daemon.SQLCPlugin.GenerateRequest
+	(*SQLCPlugin_GenerateResponse)(nil), // 53: encore.daemon.SQLCPlugin.GenerateResponse
+	(*SQLCPlugin_Codegen_Process)(nil),  // 54: encore.daemon.SQLCPlugin.Codegen.Process
+	(*SQLCPlugin_Codegen_WASM)(nil),     // 55: encore.daemon.SQLCPlugin.Codegen.WASM
+	(*emptypb.Empty)(nil),               // 56: google.protobuf.Empty
+}
+var file_encore_daemon_daemon_proto_depIdxs = []int32{
+	6,  // 0: encore.daemon.CommandMessage.output:type_name -> encore.daemon.CommandOutput
+	7,  // 1: encore.daemon.CommandMessage.exit:type_name -> encore.daemon.CommandExit
+	8,  // 2: encore.daemon.CommandMessage.errors:type_name -> encore.daemon.CommandDisplayErrors
+	2,  // 3: encore.daemon.RunRequest.browser:type_name -> encore.daemon.RunRequest.BrowserMode
+	3,  // 4: encore.daemon.RunRequest.debug_mode:type_name -> encore.daemon.RunRequest.DebugMode
+	18, // 5: encore.daemon.ExportRequest.docker:type_name -> encore.daemon.DockerExportParams
+	1,  // 6: encore.daemon.DBConnectRequest.cluster_type:type_name -> encore.daemon.DBClusterType
+	0,  // 7: encore.daemon.DBConnectRequest.role:type_name -> encore.daemon.DBRole
+	1,  // 8: encore.daemon.DBProxyRequest.cluster_type:type_name -> encore.daemon.DBClusterType
+	0,  // 9: encore.daemon.DBProxyRequest.role:type_name -> encore.daemon.DBRole
+	1,  // 10: encore.daemon.DBResetRequest.cluster_type:type_name -> encore.daemon.DBClusterType
+	30, // 11: encore.daemon.ListNamespacesResponse.namespaces:type_name -> encore.daemon.Namespace
+	4,  // 12: encore.daemon.DumpMetaRequest.format:type_name -> encore.daemon.DumpMetaRequest.Format
+	42, // 13: encore.daemon.SQLCPlugin.Settings.codegen:type_name -> encore.daemon.SQLCPlugin.Codegen
+	54, // 14: encore.daemon.SQLCPlugin.Codegen.process:type_name -> encore.daemon.SQLCPlugin.Codegen.Process
+	55, // 15: encore.daemon.SQLCPlugin.Codegen.wasm:type_name -> encore.daemon.SQLCPlugin.Codegen.WASM
+	44, // 16: encore.daemon.SQLCPlugin.Catalog.schemas:type_name -> encore.daemon.SQLCPlugin.Schema
+	47, // 17: encore.daemon.SQLCPlugin.Schema.tables:type_name -> encore.daemon.SQLCPlugin.Table
+	46, // 18: encore.daemon.SQLCPlugin.Schema.enums:type_name -> encore.daemon.SQLCPlugin.Enum
+	45, // 19: encore.daemon.SQLCPlugin.Schema.composite_types:type_name -> encore.daemon.SQLCPlugin.CompositeType
+	48, // 20: encore.daemon.SQLCPlugin.Table.rel:type_name -> encore.daemon.SQLCPlugin.Identifier
+	49, // 21: encore.daemon.SQLCPlugin.Table.columns:type_name -> encore.daemon.SQLCPlugin.Column
+	48, // 22: encore.daemon.SQLCPlugin.Column.table:type_name -> encore.daemon.SQLCPlugin.Identifier
+	48, // 23: encore.daemon.SQLCPlugin.Column.type:type_name -> encore.daemon.SQLCPlugin.Identifier
+	48, // 24: encore.daemon.SQLCPlugin.Column.embed_table:type_name -> encore.daemon.SQLCPlugin.Identifier
+	49, // 25: encore.daemon.SQLCPlugin.Query.columns:type_name -> encore.daemon.SQLCPlugin.Column
+	51, // 26: encore.daemon.SQLCPlugin.Query.params:type_name -> encore.daemon.SQLCPlugin.Parameter
+	48, // 27: encore.daemon.SQLCPlugin.Query.insert_into_table:type_name -> encore.daemon.SQLCPlugin.Identifier
+	49, // 28: encore.daemon.SQLCPlugin.Parameter.column:type_name -> encore.daemon.SQLCPlugin.Column
+	41, // 29: encore.daemon.SQLCPlugin.GenerateRequest.settings:type_name -> encore.daemon.SQLCPlugin.Settings
+	43, // 30: encore.daemon.SQLCPlugin.GenerateRequest.catalog:type_name -> encore.daemon.SQLCPlugin.Catalog
+	50, // 31: encore.daemon.SQLCPlugin.GenerateRequest.queries:type_name -> encore.daemon.SQLCPlugin.Query
+	40, // 32: encore.daemon.SQLCPlugin.GenerateResponse.files:type_name -> encore.daemon.SQLCPlugin.File
+	11, // 33: encore.daemon.Daemon.Run:input_type -> encore.daemon.RunRequest
+	12, // 34: encore.daemon.Daemon.Test:input_type -> encore.daemon.TestRequest
+	13, // 35: encore.daemon.Daemon.TestSpec:input_type -> encore.daemon.TestSpecRequest
+	15, // 36: encore.daemon.Daemon.ExecScript:input_type -> encore.daemon.ExecScriptRequest
+	16, // 37: encore.daemon.Daemon.Check:input_type -> encore.daemon.CheckRequest
+	17, // 38: encore.daemon.Daemon.Export:input_type -> encore.daemon.ExportRequest
+	19, // 39: encore.daemon.Daemon.DBConnect:input_type -> encore.daemon.DBConnectRequest
+	21, // 40: encore.daemon.Daemon.DBProxy:input_type -> encore.daemon.DBProxyRequest
+	22, // 41: encore.daemon.Daemon.DBReset:input_type -> encore.daemon.DBResetRequest
+	23, // 42: encore.daemon.Daemon.GenClient:input_type -> encore.daemon.GenClientRequest
+	25, // 43: encore.daemon.Daemon.GenWrappers:input_type -> encore.daemon.GenWrappersRequest
+	27, // 44: encore.daemon.Daemon.SecretsRefresh:input_type -> encore.daemon.SecretsRefreshRequest
+	56, // 45: encore.daemon.Daemon.Version:input_type -> google.protobuf.Empty
+	31, // 46: encore.daemon.Daemon.CreateNamespace:input_type -> encore.daemon.CreateNamespaceRequest
+	32, // 47: encore.daemon.Daemon.SwitchNamespace:input_type -> encore.daemon.SwitchNamespaceRequest
+	33, // 48: encore.daemon.Daemon.ListNamespaces:input_type -> encore.daemon.ListNamespacesRequest
+	34, // 49: encore.daemon.Daemon.DeleteNamespace:input_type -> encore.daemon.DeleteNamespaceRequest
+	37, // 50: encore.daemon.Daemon.DumpMeta:input_type -> encore.daemon.DumpMetaRequest
+	36, // 51: encore.daemon.Daemon.Telemetry:input_type -> encore.daemon.TelemetryConfig
+	9,  // 52: encore.daemon.Daemon.CreateApp:input_type -> encore.daemon.CreateAppRequest
+	5,  // 53: encore.daemon.Daemon.Run:output_type -> encore.daemon.CommandMessage
+	5,  // 54: encore.daemon.Daemon.Test:output_type -> encore.daemon.CommandMessage
+	14, // 55: encore.daemon.Daemon.TestSpec:output_type -> encore.daemon.TestSpecResponse
+	5,  // 56: encore.daemon.Daemon.ExecScript:output_type -> encore.daemon.CommandMessage
+	5,  // 57: encore.daemon.Daemon.Check:output_type -> encore.daemon.CommandMessage
+	5,  // 58: encore.daemon.Daemon.Export:output_type -> encore.daemon.CommandMessage
+	20, // 59: encore.daemon.Daemon.DBConnect:output_type -> encore.daemon.DBConnectResponse
+	5,  // 60: encore.daemon.Daemon.DBProxy:output_type -> encore.daemon.CommandMessage
+	5,  // 61: encore.daemon.Daemon.DBReset:output_type -> encore.daemon.CommandMessage
+	24, // 62: encore.daemon.Daemon.GenClient:output_type -> encore.daemon.GenClientResponse
+	26, // 63: encore.daemon.Daemon.GenWrappers:output_type -> encore.daemon.GenWrappersResponse
+	28, // 64: encore.daemon.Daemon.SecretsRefresh:output_type -> encore.daemon.SecretsRefreshResponse
+	29, // 65: encore.daemon.Daemon.Version:output_type -> encore.daemon.VersionResponse
+	30, // 66: encore.daemon.Daemon.CreateNamespace:output_type -> encore.daemon.Namespace
+	30, // 67: encore.daemon.Daemon.SwitchNamespace:output_type -> encore.daemon.Namespace
+	35, // 68: encore.daemon.Daemon.ListNamespaces:output_type -> encore.daemon.ListNamespacesResponse
+	56, // 69: encore.daemon.Daemon.DeleteNamespace:output_type -> google.protobuf.Empty
+	38, // 70: encore.daemon.Daemon.DumpMeta:output_type -> encore.daemon.DumpMetaResponse
+	56, // 71: encore.daemon.Daemon.Telemetry:output_type -> google.protobuf.Empty
+	10, // 72: encore.daemon.Daemon.CreateApp:output_type -> encore.daemon.CreateAppResponse
+	53, // [53:73] is the sub-list for method output_type
+	33, // [33:53] is the sub-list for method input_type
+	33, // [33:33] is the sub-list for extension type_name
+	33, // [33:33] is the sub-list for extension extendee
+	0,  // [0:33] is the sub-list for field type_name
+}
+
+func init() { file_encore_daemon_daemon_proto_init() }
+func file_encore_daemon_daemon_proto_init() {
+	if File_encore_daemon_daemon_proto != nil {
+		return
 	}
 	if !protoimpl.UnsafeEnabled {
 		file_encore_daemon_daemon_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
@@ -1559,8 +4652,140 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CommandOutput); i {
+		file_encore_daemon_daemon_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CommandOutput); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CommandExit); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CommandDisplayErrors); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateAppRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateAppResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RunRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TestRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TestSpecRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TestSpecResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExecScriptRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CheckRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExportRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1571,8 +4796,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CommandExit); i {
+		file_encore_daemon_daemon_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DockerExportParams); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1583,8 +4808,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RunRequest); i {
+		file_encore_daemon_daemon_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DBConnectRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1595,8 +4820,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RunMessage); i {
+		file_encore_daemon_daemon_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DBConnectResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1607,8 +4832,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RunStarted); i {
+		file_encore_daemon_daemon_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DBProxyRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1619,8 +4844,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TestRequest); i {
+		file_encore_daemon_daemon_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DBResetRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1631,8 +4856,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*CheckRequest); i {
+		file_encore_daemon_daemon_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GenClientRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1643,8 +4868,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LogsRequest); i {
+		file_encore_daemon_daemon_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GenClientResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1655,8 +4880,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LogsMessage); i {
+		file_encore_daemon_daemon_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GenWrappersRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1667,8 +4892,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*ResetDBRequest); i {
+		file_encore_daemon_daemon_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GenWrappersResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1679,8 +4904,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DBConnectRequest); i {
+		file_encore_daemon_daemon_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SecretsRefreshRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1691,8 +4916,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DBConnectResponse); i {
+		file_encore_daemon_daemon_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SecretsRefreshResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1703,8 +4928,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DBProxyRequest); i {
+		file_encore_daemon_daemon_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*VersionResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1715,8 +4940,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DBResetRequest); i {
+		file_encore_daemon_daemon_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Namespace); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1727,8 +4952,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GenClientRequest); i {
+		file_encore_daemon_daemon_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateNamespaceRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1739,8 +4964,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GenClientResponse); i {
+		file_encore_daemon_daemon_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SwitchNamespaceRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1751,8 +4976,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetSecretRequest); i {
+		file_encore_daemon_daemon_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListNamespacesRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1763,8 +4988,8 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetSecretResponse); i {
+		file_encore_daemon_daemon_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DeleteNamespaceRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1775,8 +5000,248 @@ func file_encore_daemon_daemon_proto_init() {
 				return nil
 			}
 		}
-		file_encore_daemon_daemon_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*VersionResponse); i {
+		file_encore_daemon_daemon_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ListNamespacesResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TelemetryConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DumpMetaRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DumpMetaResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_File); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Settings); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Codegen); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Catalog); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[39].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Schema); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[40].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_CompositeType); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[41].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Enum); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[42].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Table); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[43].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Identifier); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[44].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Column); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[45].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Query); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[46].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Parameter); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_GenerateRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_GenerateResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Codegen_Process); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_daemon_daemon_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCPlugin_Codegen_WASM); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1791,19 +5256,26 @@ func file_encore_daemon_daemon_proto_init() {
 	file_encore_daemon_daemon_proto_msgTypes[0].OneofWrappers = []interface{}{
 		(*CommandMessage_Output)(nil),
 		(*CommandMessage_Exit)(nil),
+		(*CommandMessage_Errors)(nil),
 	}
-	file_encore_daemon_daemon_proto_msgTypes[4].OneofWrappers = []interface{}{
-		(*RunMessage_Started)(nil),
-		(*RunMessage_Output)(nil),
-		(*RunMessage_Exit)(nil),
+	file_encore_daemon_daemon_proto_msgTypes[6].OneofWrappers = []interface{}{}
+	file_encore_daemon_daemon_proto_msgTypes[7].OneofWrappers = []interface{}{}
+	file_encore_daemon_daemon_proto_msgTypes[10].OneofWrappers = []interface{}{}
+	file_encore_daemon_daemon_proto_msgTypes[12].OneofWrappers = []interface{}{
+		(*ExportRequest_Docker)(nil),
 	}
+	file_encore_daemon_daemon_proto_msgTypes[14].OneofWrappers = []interface{}{}
+	file_encore_daemon_daemon_proto_msgTypes[16].OneofWrappers = []interface{}{}
+	file_encore_daemon_daemon_proto_msgTypes[17].OneofWrappers = []interface{}{}
+	file_encore_daemon_daemon_proto_msgTypes[18].OneofWrappers = []interface{}{}
+	file_encore_daemon_daemon_proto_msgTypes[25].OneofWrappers = []interface{}{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_encore_daemon_daemon_proto_rawDesc,
-			NumEnums:      1,
-			NumMessages:   20,
+			NumEnums:      5,
+			NumMessages:   51,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/proto/encore/daemon/daemon.proto b/proto/encore/daemon/daemon.proto
index 7a7336c4c5..d8e5431585 100644
--- a/proto/encore/daemon/daemon.proto
+++ b/proto/encore/daemon/daemon.proto
@@ -8,13 +8,17 @@ package encore.daemon;
 
 service Daemon {
   // Run runs the application.
-  rpc Run (RunRequest) returns (stream RunMessage);
+  rpc Run (RunRequest) returns (stream CommandMessage);
   // Test runs tests.
   rpc Test (TestRequest) returns (stream CommandMessage);
+  // TestSpec returns the specification for how to run tests.
+  rpc TestSpec (TestSpecRequest) returns (TestSpecResponse);
+  // ExecScript executes a one-off script.
+  rpc ExecScript (ExecScriptRequest) returns (stream CommandMessage);
   // Check checks the app for compilation errors.
   rpc Check (CheckRequest) returns (stream CommandMessage);
-  // Logs streams logs from the encore.dev platform.
-  rpc Logs (LogsRequest) returns (stream LogsMessage);
+  // Export exports the app in various formats.
+  rpc Export (ExportRequest) returns (stream CommandMessage);
 
   // DBConnect starts the database and returns the DSN for connecting to it.
   rpc DBConnect (DBConnectRequest) returns (DBConnectResponse);
@@ -26,16 +30,35 @@ service Daemon {
 
   // GenClient generates a client based on the app's API.
   rpc GenClient (GenClientRequest) returns (GenClientResponse);
-  // SetSecret sets a secret key on the encore.dev platform.
-  rpc SetSecret (SetSecretRequest) returns (SetSecretResponse);
+  // GenWrappers generates user-facing wrapper code.
+  rpc GenWrappers (GenWrappersRequest) returns (GenWrappersResponse);
+  // SecretsRefresh tells the daemon to refresh the local development secrets
+  // for the given application.
+  rpc SecretsRefresh (SecretsRefreshRequest) returns (SecretsRefreshResponse);
   // Version reports the daemon version.
   rpc Version (google.protobuf.Empty) returns (VersionResponse);
+
+  // CreateNamespace creates a new infra namespace.
+  rpc CreateNamespace (CreateNamespaceRequest) returns (Namespace);
+  // SwitchNamespace switches the active infra namespace.
+  rpc SwitchNamespace (SwitchNamespaceRequest) returns (Namespace);
+  // ListNamespaces lists all namespaces for the given app.
+  rpc ListNamespaces (ListNamespacesRequest) returns (ListNamespacesResponse);
+  // DeleteNamespace deletes an infra namespace.
+  rpc DeleteNamespace (DeleteNamespaceRequest) returns (google.protobuf.Empty);
+
+  rpc DumpMeta(DumpMetaRequest) returns (DumpMetaResponse);
+  // Telemetry enables or disables telemetry.
+  rpc Telemetry(TelemetryConfig) returns (google.protobuf.Empty);
+  // InitTutorial sets the tutorial flag of the app
+  rpc CreateApp(CreateAppRequest)  returns (CreateAppResponse);
 }
 
 message CommandMessage {
   oneof msg {
     CommandOutput output = 1;
     CommandExit exit = 2;
+    CommandDisplayErrors errors = 3;
   }
 }
 
@@ -48,66 +71,201 @@ message CommandExit {
   int32 code = 1; // exit code
 }
 
+message CommandDisplayErrors {
+  bytes errinsrc = 1; // error messages in source code
+}
+
+message CreateAppRequest {
+  // app_root is the absolute filesystem path to the Encore app root.
+  string app_root = 1;
+  // template is the template used to create the app
+  string template = 2;
+  // tutorial is a flag to indicate if the app is a tutorial app
+  bool tutorial = 3;
+}
+
+message CreateAppResponse {
+  string app_id = 1;
+}
+
 message RunRequest {
   // app_root is the absolute filesystem path to the Encore app root.
   string app_root = 1;
   // working_dir is the working directory relative to the app_root,
   // for formatting relative paths in error messages.
   string working_dir = 2;
-  // tunnel, if true, creates a tunnel environment on the encore.dev platform
-  // that forwards requests to the running app.
-  bool tunnel = 3;
-  // debug, if true, compiles the app with flags that improve the debugging experience.
-  bool debug = 4;
   // watch, if true, enables live reloading of the app whenever the source changes.
- bool watch = 5;
-}
+  bool watch = 5;
+  // listen_addr is the address to listen on.
+  string listen_addr = 6;
+  // environ is the environment to set for the running command.
+  // Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+  repeated string environ = 7;
 
-message RunMessage {
-  oneof msg {
-    RunStarted started = 1;
-    CommandOutput output = 2;
-    CommandExit exit = 3;
+  // trace_file, if set specifies a trace file to write trace information
+  // about the parse and compilation process to.
+  optional string trace_file = 8;
+
+  // namespace is the infrastructure namespace to use.
+  // If empty the active namespace is used.
+  optional string namespace = 9;
+
+  // browser specifies whether and how to open the browser on startup.
+  BrowserMode browser = 10;
+
+  // debug_mode specifies the debug mode to use.
+  DebugMode debug_mode = 11;
+  
+  enum BrowserMode {
+    BROWSER_AUTO = 0;
+    BROWSER_NEVER = 1;
+    BROWSER_ALWAYS = 2;
   }
-}
 
-message RunStarted {
-  string run_id = 1;
-  int32 port = 2;
-  string tunnel_url = 3;
-  int32 pid = 4;
+  enum DebugMode {
+    DEBUG_DISABLED = 0;
+    DEBUG_ENABLED = 1;
+    DEBUG_BREAK = 2;
+  }
 }
 
 message TestRequest {
   string app_root = 1;
   string working_dir = 2;
   repeated string args = 3;
+  // environ is the environment to set for the running command.
+  // Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+  repeated string environ = 4;
+
+  // No longer used; debug, if true, compiles the app with flags that improve the debugging experience.
+  reserved 5;
+
+  // trace_file, if set specifies a trace file to write trace information
+  // about the parse and compilation process to.
+  optional string trace_file = 6;
+
+  // codegen_debug, if true, dumps the generated code and prints where it is located.
+  bool codegen_debug = 7;
 }
 
-message CheckRequest {
+message TestSpecRequest {
   string app_root = 1;
   string working_dir = 2;
+  repeated string args = 3;
+
+  // environ is the environment to set for the running command.
+  // Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+  repeated string environ = 4;
 }
 
-message LogsRequest {
+message TestSpecResponse {
+  string command = 1;
+  repeated string args = 2;
+  repeated string environ = 3;
+}
+
+message ExecScriptRequest {
   string app_root = 1;
-  string env_name = 2;
+  string working_dir = 2;
+
+  repeated string script_args = 4;
+  // environ is the environment to set for the running command.
+  // Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+  repeated string environ = 5;
+
+  // trace_file, if set specifies a trace file to write trace information
+  // about the parse and compilation process to.
+  optional string trace_file = 6;
+
+  // namespace is the infrastructure namespace to use.
+  // If empty the active namespace is used.
+  optional string namespace = 7;
 }
 
-message LogsMessage {
-  repeated bytes lines = 1;
-  bool drop_notice = 2;
+message CheckRequest {
+  string app_root = 1;
+  string working_dir = 2;
+  // codegen_debug, if true, dumps the generated code and prints where it is located.
+  bool codegen_debug = 3;
+  // parse_tests, if true, exercises test parsing and codegen as well.
+  bool parse_tests = 4;
+  // environ is the environment to set for the running command.
+  // Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+  repeated string environ = 5;
 }
 
-message ResetDBRequest {
+message ExportRequest {
   string app_root = 1;
-  repeated string services = 2; // services to reset
+
+  // goos and goarch specify the platform configuration to compile
+  // the application for. The values must be valid GOOS/GOARCH values.
+  string goos = 2;
+  string goarch = 3;
+
+  // cgo_enabled specifies whether to build with cgo enabled.
+  // The host must have a valid C compiler for the target platform
+  // if true.
+  bool cgo_enabled = 4;
+
+  // environ is the environment to set for the running command.
+  // Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+  repeated string environ = 5;
+
+  oneof format {
+    // docker specifies to export the app as a docker image.
+    DockerExportParams docker = 6;
+  }
+
+  string infra_conf_path = 7;
+  repeated string services = 8;
+  repeated string gateways = 9;
+  bool skip_infra_conf = 10;
+
+  // A parent path to app_root containing the .git, or the same as app_root
+  string workspace_root = 11;
+}
+
+message DockerExportParams {
+  // local_daemon_tag specifies what to tag the image as
+  // in the local Docker daemon. If empty the export does not
+  // interact with (or require) the local docker daemon at all.
+  string local_daemon_tag = 1;
+
+  // push_destination_tag specifies the remote registry tag
+  // to push the exported image to. If empty the built image
+  // is not pushed anywhere.
+  string push_destination_tag = 2;
+
+  // base_image_tag is the base image to build the image from.
+  string base_image_tag = 3;
 }
 
 message DBConnectRequest {
   string app_root = 1;
-  string svc_name = 2;
+  string db_name = 2;
   string env_name = 3; // optional
+  DBClusterType cluster_type = 4;
+
+  // namespace is the infrastructure namespace to use.
+  // If empty the active namespace is used.
+  optional string namespace = 5;
+
+  DBRole role = 6;
+}
+
+enum DBRole {
+  DB_ROLE_UNSPECIFIED = 0;
+  DB_ROLE_SUPERUSER = 1;
+  DB_ROLE_ADMIN = 2;
+  DB_ROLE_WRITE = 3;
+  DB_ROLE_READ = 4;
+}
+
+enum DBClusterType {
+  DB_CLUSTER_TYPE_UNSPECIFIED = 0;
+  DB_CLUSTER_TYPE_RUN = 1;
+  DB_CLUSTER_TYPE_TEST = 2;
+  DB_CLUSTER_TYPE_SHADOW = 3;
 }
 
 message DBConnectResponse {
@@ -118,11 +276,22 @@ message DBProxyRequest {
   string app_root = 1;
   string env_name = 2; // optional
   int32 port = 3; // optional
+  DBClusterType cluster_type = 4;
+
+  // namespace is the infrastructure namespace to use.
+  // If empty the active namespace is used.
+  optional string namespace = 5;
+  DBRole role = 6;
 }
 
 message DBResetRequest {
   string app_root = 1;
-  repeated string services = 2; // services to reset
+  repeated string database_names = 2; // database names to reset
+  DBClusterType cluster_type = 3;
+
+  // namespace is the infrastructure namespace to use.
+  // If empty the active namespace is used.
+  optional string namespace = 4;
 }
 
 message GenClientRequest {
@@ -130,27 +299,255 @@ message GenClientRequest {
   string env_name = 2;
   string lang = 3;
   string filepath = 4;
+
+  // Services to include in the output.
+  // If the string "*" is present all services are included.
+  repeated string services = 5;
+
+  // Services to exclude from the output.
+  // Takes precedence over 'services' above.
+  repeated string excluded_services = 6;
+
+  // Tags of endpoints to include in the output.
+  // Only includes endpoints from services included in 'services' above.
+  repeated string endpoint_tags = 7;
+
+  // Tags of endpoints to exclude from the output.
+  // Takes precedence over 'endpoint_tags' above.
+  repeated string excluded_endpoint_tags = 8;
+
+  // The OpenAPI spec generator by default includes private endpoints.
+  // If this is set to `true`, private endpoints will not be included
+  // in the generated OpenAPI spec.
+  optional bool openapi_exclude_private_endpoints = 9;
+
+  // The TS generator by default re-declares the api types in the client.
+  // If this is set to `true`, the types will be imported and shared between
+  // the client and the server. It assumes "~backend" is available in the
+  // import path.
+  optional bool ts_shared_types = 10;
+
+  // If set, the default export of the generate TypeScript client will be
+  // an instantiated client with the given target. The target can be e.g.
+  // a variable, e.g. "import.meta.env.VITE_CLIENT_TARGET" or a string literal.
+  optional string ts_client_target = 11;
 }
 
 message GenClientResponse {
   bytes code = 1;
 }
 
-message SetSecretRequest {
-  enum Type {
-    DEVELOPMENT = 0;
-    PRODUCTION = 1;
-  }
+message GenWrappersRequest {
+  string app_root = 1;
+}
+
+message GenWrappersResponse {
+}
+
+message SecretsRefreshRequest {
   string app_root = 1;
   string key = 2;
   string value = 3;
-  Type type = 4;
 }
 
-message SetSecretResponse {
-  bool created = 1; // whether or not the secret was created (as opposed to updated)
+message SecretsRefreshResponse {
 }
 
 message VersionResponse {
   string version = 1;
+  string config_hash = 2;
+}
+
+// Namespaces
+
+message Namespace {
+  string id = 1;
+  string name = 2;
+  bool active = 3;
+  string created_at = 4;
+  optional string last_active_at = 5;
+}
+
+message CreateNamespaceRequest {
+  string app_root = 1;
+  string name = 2;
+}
+
+message SwitchNamespaceRequest {
+  string app_root = 1;
+  string name = 2;
+  bool create = 3;
+}
+
+message ListNamespacesRequest {
+  string app_root = 1;
+}
+
+message DeleteNamespaceRequest {
+  string app_root = 1;
+  string name = 2;
+}
+
+message ListNamespacesResponse {
+  repeated Namespace namespaces = 1;
+}
+
+message TelemetryConfig {
+  string anon_id = 1;
+  bool enabled = 2;
+  bool debug = 3;
+}
+
+message DumpMetaRequest {
+  string app_root = 1;
+  string working_dir = 2; // for error reporting
+
+  // environ is the environment to set for the running command.
+  // Each entry is a string in the format "KEY=VALUE", identical to os.Environ().
+  repeated string environ = 3;
+
+  // Whether or not to parse tests.
+  bool parse_tests = 4;
+
+  Format format = 5;
+
+  enum Format {
+    FORMAT_UNSPECIFIED = 0;
+    FORMAT_JSON = 1;
+    FORMAT_PROTO = 2;
+  }
+}
+
+message DumpMetaResponse {
+  bytes meta = 1;
+}
+
+
+
+// The following messages are used for sqlc plugin integration.
+message SQLCPlugin {
+  message File {
+    string name = 1 [json_name = "name"];
+    bytes contents = 2 [json_name = "contents"];
+  }
+
+  message Settings {
+    // Rename message was field 5
+    // Overides message was field 6
+    // PythonCode message was field 8
+    // KotlinCode message was field 9
+    // GoCode message was field 10;
+    // JSONCode message was field 11;
+    reserved 5, 8, 9, 10, 11;
+
+    string version = 1 [json_name = "version"];
+    string engine = 2 [json_name = "engine"];
+    repeated string schema = 3 [json_name = "schema"];
+    repeated string queries = 4 [json_name = "queries"];
+    Codegen codegen = 12 [json_name = "codegen"];
+  }
+
+  message Codegen {
+    message Process {
+      string cmd = 1;
+    }
+    message WASM {
+      string url = 1;
+      string sha256 = 2;
+    }
+    string out = 1 [json_name = "out"];
+    string plugin = 2 [json_name = "plugin"];
+    bytes options = 3 [json_name = "options"];
+    repeated string env = 4 [json_name = "env"];
+    Process process = 5 [json_name = "process"];
+    WASM wasm = 6 [json_name = "wasm"];
+  }
+
+  message Catalog {
+    string comment = 1;
+    string default_schema = 2;
+    string name = 3;
+    repeated Schema schemas = 4;
+  }
+
+  message Schema {
+    string comment = 1;
+    string name = 2;
+    repeated Table tables = 3;
+    repeated Enum enums = 4;
+    repeated CompositeType composite_types = 5;
+  }
+
+  message CompositeType {
+    string name = 1;
+    string comment = 2;
+  }
+
+  message Enum {
+    string name = 1;
+    repeated string vals = 2;
+    string comment = 3;
+  }
+
+  message Table {
+    Identifier rel = 1;
+    repeated Column columns = 2;
+    string comment = 3;
+  }
+
+  message Identifier {
+    string catalog = 1;
+    string schema = 2;
+    string name = 3;
+  }
+
+  message Column {
+    string name = 1;
+    bool not_null = 3;
+    bool is_array = 4;
+    string comment = 5;
+    int32 length = 6;
+    bool is_named_param = 7;
+    bool is_func_call = 8;
+
+    // XXX: Figure out what PostgreSQL calls `foo.id`
+    string scope = 9;
+    Identifier table = 10;
+    string table_alias = 11;
+    Identifier type = 12;
+    bool is_sqlc_slice = 13;
+    Identifier embed_table = 14;
+    string original_name = 15;
+    bool unsigned = 16;
+    int32 array_dims = 17;
+  }
+
+  message Query {
+    string text = 1 [json_name = "text"];
+    string name = 2 [json_name = "name"];
+    string cmd = 3 [json_name = "cmd"];
+    repeated Column columns = 4 [json_name = "columns"];
+    repeated Parameter params = 5 [json_name = "parameters"];
+    repeated string comments = 6 [json_name = "comments"];
+    string filename = 7 [json_name = "filename"];
+    Identifier insert_into_table = 8 [json_name = "insert_into_table"];
+  }
+
+  message Parameter {
+    int32 number = 1 [json_name = "number"];
+    Column column = 2 [json_name = "column"];
+  }
+
+  message GenerateRequest {
+    Settings settings = 1 [json_name = "settings"];
+    Catalog catalog = 2 [json_name = "catalog"];
+    repeated Query queries = 3 [json_name = "queries"];
+    string sqlc_version = 4 [json_name = "sqlc_version"];
+    bytes plugin_options = 5 [json_name = "plugin_options"];
+    bytes global_options = 6 [json_name = "global_options"];
+  }
+
+  message GenerateResponse {
+    repeated File files = 1 [json_name = "files"];
+  }
 }
diff --git a/proto/encore/daemon/daemon_grpc.pb.go b/proto/encore/daemon/daemon_grpc.pb.go
index dbd62d65d0..d956a651b5 100644
--- a/proto/encore/daemon/daemon_grpc.pb.go
+++ b/proto/encore/daemon/daemon_grpc.pb.go
@@ -1,4 +1,8 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.3.0
+// - protoc             v4.23.4
+// source: encore/daemon/daemon.proto
 
 package daemon
 
@@ -12,7 +16,31 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-const _ = grpc.SupportPackageIsVersion6
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+const (
+	Daemon_Run_FullMethodName             = "/encore.daemon.Daemon/Run"
+	Daemon_Test_FullMethodName            = "/encore.daemon.Daemon/Test"
+	Daemon_TestSpec_FullMethodName        = "/encore.daemon.Daemon/TestSpec"
+	Daemon_ExecScript_FullMethodName      = "/encore.daemon.Daemon/ExecScript"
+	Daemon_Check_FullMethodName           = "/encore.daemon.Daemon/Check"
+	Daemon_Export_FullMethodName          = "/encore.daemon.Daemon/Export"
+	Daemon_DBConnect_FullMethodName       = "/encore.daemon.Daemon/DBConnect"
+	Daemon_DBProxy_FullMethodName         = "/encore.daemon.Daemon/DBProxy"
+	Daemon_DBReset_FullMethodName         = "/encore.daemon.Daemon/DBReset"
+	Daemon_GenClient_FullMethodName       = "/encore.daemon.Daemon/GenClient"
+	Daemon_GenWrappers_FullMethodName     = "/encore.daemon.Daemon/GenWrappers"
+	Daemon_SecretsRefresh_FullMethodName  = "/encore.daemon.Daemon/SecretsRefresh"
+	Daemon_Version_FullMethodName         = "/encore.daemon.Daemon/Version"
+	Daemon_CreateNamespace_FullMethodName = "/encore.daemon.Daemon/CreateNamespace"
+	Daemon_SwitchNamespace_FullMethodName = "/encore.daemon.Daemon/SwitchNamespace"
+	Daemon_ListNamespaces_FullMethodName  = "/encore.daemon.Daemon/ListNamespaces"
+	Daemon_DeleteNamespace_FullMethodName = "/encore.daemon.Daemon/DeleteNamespace"
+	Daemon_DumpMeta_FullMethodName        = "/encore.daemon.Daemon/DumpMeta"
+	Daemon_Telemetry_FullMethodName       = "/encore.daemon.Daemon/Telemetry"
+	Daemon_CreateApp_FullMethodName       = "/encore.daemon.Daemon/CreateApp"
+)
 
 // DaemonClient is the client API for Daemon service.
 //
@@ -22,10 +50,14 @@ type DaemonClient interface {
 	Run(ctx context.Context, in *RunRequest, opts ...grpc.CallOption) (Daemon_RunClient, error)
 	// Test runs tests.
 	Test(ctx context.Context, in *TestRequest, opts ...grpc.CallOption) (Daemon_TestClient, error)
+	// TestSpec returns the specification for how to run tests.
+	TestSpec(ctx context.Context, in *TestSpecRequest, opts ...grpc.CallOption) (*TestSpecResponse, error)
+	// ExecScript executes a one-off script.
+	ExecScript(ctx context.Context, in *ExecScriptRequest, opts ...grpc.CallOption) (Daemon_ExecScriptClient, error)
 	// Check checks the app for compilation errors.
 	Check(ctx context.Context, in *CheckRequest, opts ...grpc.CallOption) (Daemon_CheckClient, error)
-	// Logs streams logs from the encore.dev platform.
-	Logs(ctx context.Context, in *LogsRequest, opts ...grpc.CallOption) (Daemon_LogsClient, error)
+	// Export exports the app in various formats.
+	Export(ctx context.Context, in *ExportRequest, opts ...grpc.CallOption) (Daemon_ExportClient, error)
 	// DBConnect starts the database and returns the DSN for connecting to it.
 	DBConnect(ctx context.Context, in *DBConnectRequest, opts ...grpc.CallOption) (*DBConnectResponse, error)
 	// DBProxy starts a local database proxy for connecting to remote databases
@@ -35,10 +67,26 @@ type DaemonClient interface {
 	DBReset(ctx context.Context, in *DBResetRequest, opts ...grpc.CallOption) (Daemon_DBResetClient, error)
 	// GenClient generates a client based on the app's API.
 	GenClient(ctx context.Context, in *GenClientRequest, opts ...grpc.CallOption) (*GenClientResponse, error)
-	// SetSecret sets a secret key on the encore.dev platform.
-	SetSecret(ctx context.Context, in *SetSecretRequest, opts ...grpc.CallOption) (*SetSecretResponse, error)
+	// GenWrappers generates user-facing wrapper code.
+	GenWrappers(ctx context.Context, in *GenWrappersRequest, opts ...grpc.CallOption) (*GenWrappersResponse, error)
+	// SecretsRefresh tells the daemon to refresh the local development secrets
+	// for the given application.
+	SecretsRefresh(ctx context.Context, in *SecretsRefreshRequest, opts ...grpc.CallOption) (*SecretsRefreshResponse, error)
 	// Version reports the daemon version.
 	Version(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*VersionResponse, error)
+	// CreateNamespace creates a new infra namespace.
+	CreateNamespace(ctx context.Context, in *CreateNamespaceRequest, opts ...grpc.CallOption) (*Namespace, error)
+	// SwitchNamespace switches the active infra namespace.
+	SwitchNamespace(ctx context.Context, in *SwitchNamespaceRequest, opts ...grpc.CallOption) (*Namespace, error)
+	// ListNamespaces lists all namespaces for the given app.
+	ListNamespaces(ctx context.Context, in *ListNamespacesRequest, opts ...grpc.CallOption) (*ListNamespacesResponse, error)
+	// DeleteNamespace deletes an infra namespace.
+	DeleteNamespace(ctx context.Context, in *DeleteNamespaceRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	DumpMeta(ctx context.Context, in *DumpMetaRequest, opts ...grpc.CallOption) (*DumpMetaResponse, error)
+	// Telemetry enables or disables telemetry.
+	Telemetry(ctx context.Context, in *TelemetryConfig, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	// InitTutorial sets the tutorial flag of the app
+	CreateApp(ctx context.Context, in *CreateAppRequest, opts ...grpc.CallOption) (*CreateAppResponse, error)
 }
 
 type daemonClient struct {
@@ -50,7 +98,7 @@ func NewDaemonClient(cc grpc.ClientConnInterface) DaemonClient {
 }
 
 func (c *daemonClient) Run(ctx context.Context, in *RunRequest, opts ...grpc.CallOption) (Daemon_RunClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Daemon_serviceDesc.Streams[0], "/encore.daemon.Daemon/Run", opts...)
+	stream, err := c.cc.NewStream(ctx, &Daemon_ServiceDesc.Streams[0], Daemon_Run_FullMethodName, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -65,7 +113,7 @@ func (c *daemonClient) Run(ctx context.Context, in *RunRequest, opts ...grpc.Cal
 }
 
 type Daemon_RunClient interface {
-	Recv() (*RunMessage, error)
+	Recv() (*CommandMessage, error)
 	grpc.ClientStream
 }
 
@@ -73,8 +121,8 @@ type daemonRunClient struct {
 	grpc.ClientStream
 }
 
-func (x *daemonRunClient) Recv() (*RunMessage, error) {
-	m := new(RunMessage)
+func (x *daemonRunClient) Recv() (*CommandMessage, error) {
+	m := new(CommandMessage)
 	if err := x.ClientStream.RecvMsg(m); err != nil {
 		return nil, err
 	}
@@ -82,7 +130,7 @@ func (x *daemonRunClient) Recv() (*RunMessage, error) {
 }
 
 func (c *daemonClient) Test(ctx context.Context, in *TestRequest, opts ...grpc.CallOption) (Daemon_TestClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Daemon_serviceDesc.Streams[1], "/encore.daemon.Daemon/Test", opts...)
+	stream, err := c.cc.NewStream(ctx, &Daemon_ServiceDesc.Streams[1], Daemon_Test_FullMethodName, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -113,8 +161,49 @@ func (x *daemonTestClient) Recv() (*CommandMessage, error) {
 	return m, nil
 }
 
+func (c *daemonClient) TestSpec(ctx context.Context, in *TestSpecRequest, opts ...grpc.CallOption) (*TestSpecResponse, error) {
+	out := new(TestSpecResponse)
+	err := c.cc.Invoke(ctx, Daemon_TestSpec_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonClient) ExecScript(ctx context.Context, in *ExecScriptRequest, opts ...grpc.CallOption) (Daemon_ExecScriptClient, error) {
+	stream, err := c.cc.NewStream(ctx, &Daemon_ServiceDesc.Streams[2], Daemon_ExecScript_FullMethodName, opts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &daemonExecScriptClient{stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+type Daemon_ExecScriptClient interface {
+	Recv() (*CommandMessage, error)
+	grpc.ClientStream
+}
+
+type daemonExecScriptClient struct {
+	grpc.ClientStream
+}
+
+func (x *daemonExecScriptClient) Recv() (*CommandMessage, error) {
+	m := new(CommandMessage)
+	if err := x.ClientStream.RecvMsg(m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
 func (c *daemonClient) Check(ctx context.Context, in *CheckRequest, opts ...grpc.CallOption) (Daemon_CheckClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Daemon_serviceDesc.Streams[2], "/encore.daemon.Daemon/Check", opts...)
+	stream, err := c.cc.NewStream(ctx, &Daemon_ServiceDesc.Streams[3], Daemon_Check_FullMethodName, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -145,12 +234,12 @@ func (x *daemonCheckClient) Recv() (*CommandMessage, error) {
 	return m, nil
 }
 
-func (c *daemonClient) Logs(ctx context.Context, in *LogsRequest, opts ...grpc.CallOption) (Daemon_LogsClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Daemon_serviceDesc.Streams[3], "/encore.daemon.Daemon/Logs", opts...)
+func (c *daemonClient) Export(ctx context.Context, in *ExportRequest, opts ...grpc.CallOption) (Daemon_ExportClient, error) {
+	stream, err := c.cc.NewStream(ctx, &Daemon_ServiceDesc.Streams[4], Daemon_Export_FullMethodName, opts...)
 	if err != nil {
 		return nil, err
 	}
-	x := &daemonLogsClient{stream}
+	x := &daemonExportClient{stream}
 	if err := x.ClientStream.SendMsg(in); err != nil {
 		return nil, err
 	}
@@ -160,17 +249,17 @@ func (c *daemonClient) Logs(ctx context.Context, in *LogsRequest, opts ...grpc.C
 	return x, nil
 }
 
-type Daemon_LogsClient interface {
-	Recv() (*LogsMessage, error)
+type Daemon_ExportClient interface {
+	Recv() (*CommandMessage, error)
 	grpc.ClientStream
 }
 
-type daemonLogsClient struct {
+type daemonExportClient struct {
 	grpc.ClientStream
 }
 
-func (x *daemonLogsClient) Recv() (*LogsMessage, error) {
-	m := new(LogsMessage)
+func (x *daemonExportClient) Recv() (*CommandMessage, error) {
+	m := new(CommandMessage)
 	if err := x.ClientStream.RecvMsg(m); err != nil {
 		return nil, err
 	}
@@ -179,7 +268,7 @@ func (x *daemonLogsClient) Recv() (*LogsMessage, error) {
 
 func (c *daemonClient) DBConnect(ctx context.Context, in *DBConnectRequest, opts ...grpc.CallOption) (*DBConnectResponse, error) {
 	out := new(DBConnectResponse)
-	err := c.cc.Invoke(ctx, "/encore.daemon.Daemon/DBConnect", in, out, opts...)
+	err := c.cc.Invoke(ctx, Daemon_DBConnect_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -187,7 +276,7 @@ func (c *daemonClient) DBConnect(ctx context.Context, in *DBConnectRequest, opts
 }
 
 func (c *daemonClient) DBProxy(ctx context.Context, in *DBProxyRequest, opts ...grpc.CallOption) (Daemon_DBProxyClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Daemon_serviceDesc.Streams[4], "/encore.daemon.Daemon/DBProxy", opts...)
+	stream, err := c.cc.NewStream(ctx, &Daemon_ServiceDesc.Streams[5], Daemon_DBProxy_FullMethodName, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -219,7 +308,7 @@ func (x *daemonDBProxyClient) Recv() (*CommandMessage, error) {
 }
 
 func (c *daemonClient) DBReset(ctx context.Context, in *DBResetRequest, opts ...grpc.CallOption) (Daemon_DBResetClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Daemon_serviceDesc.Streams[5], "/encore.daemon.Daemon/DBReset", opts...)
+	stream, err := c.cc.NewStream(ctx, &Daemon_ServiceDesc.Streams[6], Daemon_DBReset_FullMethodName, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -252,16 +341,25 @@ func (x *daemonDBResetClient) Recv() (*CommandMessage, error) {
 
 func (c *daemonClient) GenClient(ctx context.Context, in *GenClientRequest, opts ...grpc.CallOption) (*GenClientResponse, error) {
 	out := new(GenClientResponse)
-	err := c.cc.Invoke(ctx, "/encore.daemon.Daemon/GenClient", in, out, opts...)
+	err := c.cc.Invoke(ctx, Daemon_GenClient_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonClient) GenWrappers(ctx context.Context, in *GenWrappersRequest, opts ...grpc.CallOption) (*GenWrappersResponse, error) {
+	out := new(GenWrappersResponse)
+	err := c.cc.Invoke(ctx, Daemon_GenWrappers_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
 	return out, nil
 }
 
-func (c *daemonClient) SetSecret(ctx context.Context, in *SetSecretRequest, opts ...grpc.CallOption) (*SetSecretResponse, error) {
-	out := new(SetSecretResponse)
-	err := c.cc.Invoke(ctx, "/encore.daemon.Daemon/SetSecret", in, out, opts...)
+func (c *daemonClient) SecretsRefresh(ctx context.Context, in *SecretsRefreshRequest, opts ...grpc.CallOption) (*SecretsRefreshResponse, error) {
+	out := new(SecretsRefreshResponse)
+	err := c.cc.Invoke(ctx, Daemon_SecretsRefresh_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -270,7 +368,70 @@ func (c *daemonClient) SetSecret(ctx context.Context, in *SetSecretRequest, opts
 
 func (c *daemonClient) Version(ctx context.Context, in *emptypb.Empty, opts ...grpc.CallOption) (*VersionResponse, error) {
 	out := new(VersionResponse)
-	err := c.cc.Invoke(ctx, "/encore.daemon.Daemon/Version", in, out, opts...)
+	err := c.cc.Invoke(ctx, Daemon_Version_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonClient) CreateNamespace(ctx context.Context, in *CreateNamespaceRequest, opts ...grpc.CallOption) (*Namespace, error) {
+	out := new(Namespace)
+	err := c.cc.Invoke(ctx, Daemon_CreateNamespace_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonClient) SwitchNamespace(ctx context.Context, in *SwitchNamespaceRequest, opts ...grpc.CallOption) (*Namespace, error) {
+	out := new(Namespace)
+	err := c.cc.Invoke(ctx, Daemon_SwitchNamespace_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonClient) ListNamespaces(ctx context.Context, in *ListNamespacesRequest, opts ...grpc.CallOption) (*ListNamespacesResponse, error) {
+	out := new(ListNamespacesResponse)
+	err := c.cc.Invoke(ctx, Daemon_ListNamespaces_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonClient) DeleteNamespace(ctx context.Context, in *DeleteNamespaceRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Daemon_DeleteNamespace_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonClient) DumpMeta(ctx context.Context, in *DumpMetaRequest, opts ...grpc.CallOption) (*DumpMetaResponse, error) {
+	out := new(DumpMetaResponse)
+	err := c.cc.Invoke(ctx, Daemon_DumpMeta_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonClient) Telemetry(ctx context.Context, in *TelemetryConfig, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, Daemon_Telemetry_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *daemonClient) CreateApp(ctx context.Context, in *CreateAppRequest, opts ...grpc.CallOption) (*CreateAppResponse, error) {
+	out := new(CreateAppResponse)
+	err := c.cc.Invoke(ctx, Daemon_CreateApp_FullMethodName, in, out, opts...)
 	if err != nil {
 		return nil, err
 	}
@@ -285,10 +446,14 @@ type DaemonServer interface {
 	Run(*RunRequest, Daemon_RunServer) error
 	// Test runs tests.
 	Test(*TestRequest, Daemon_TestServer) error
+	// TestSpec returns the specification for how to run tests.
+	TestSpec(context.Context, *TestSpecRequest) (*TestSpecResponse, error)
+	// ExecScript executes a one-off script.
+	ExecScript(*ExecScriptRequest, Daemon_ExecScriptServer) error
 	// Check checks the app for compilation errors.
 	Check(*CheckRequest, Daemon_CheckServer) error
-	// Logs streams logs from the encore.dev platform.
-	Logs(*LogsRequest, Daemon_LogsServer) error
+	// Export exports the app in various formats.
+	Export(*ExportRequest, Daemon_ExportServer) error
 	// DBConnect starts the database and returns the DSN for connecting to it.
 	DBConnect(context.Context, *DBConnectRequest) (*DBConnectResponse, error)
 	// DBProxy starts a local database proxy for connecting to remote databases
@@ -298,10 +463,26 @@ type DaemonServer interface {
 	DBReset(*DBResetRequest, Daemon_DBResetServer) error
 	// GenClient generates a client based on the app's API.
 	GenClient(context.Context, *GenClientRequest) (*GenClientResponse, error)
-	// SetSecret sets a secret key on the encore.dev platform.
-	SetSecret(context.Context, *SetSecretRequest) (*SetSecretResponse, error)
+	// GenWrappers generates user-facing wrapper code.
+	GenWrappers(context.Context, *GenWrappersRequest) (*GenWrappersResponse, error)
+	// SecretsRefresh tells the daemon to refresh the local development secrets
+	// for the given application.
+	SecretsRefresh(context.Context, *SecretsRefreshRequest) (*SecretsRefreshResponse, error)
 	// Version reports the daemon version.
 	Version(context.Context, *emptypb.Empty) (*VersionResponse, error)
+	// CreateNamespace creates a new infra namespace.
+	CreateNamespace(context.Context, *CreateNamespaceRequest) (*Namespace, error)
+	// SwitchNamespace switches the active infra namespace.
+	SwitchNamespace(context.Context, *SwitchNamespaceRequest) (*Namespace, error)
+	// ListNamespaces lists all namespaces for the given app.
+	ListNamespaces(context.Context, *ListNamespacesRequest) (*ListNamespacesResponse, error)
+	// DeleteNamespace deletes an infra namespace.
+	DeleteNamespace(context.Context, *DeleteNamespaceRequest) (*emptypb.Empty, error)
+	DumpMeta(context.Context, *DumpMetaRequest) (*DumpMetaResponse, error)
+	// Telemetry enables or disables telemetry.
+	Telemetry(context.Context, *TelemetryConfig) (*emptypb.Empty, error)
+	// InitTutorial sets the tutorial flag of the app
+	CreateApp(context.Context, *CreateAppRequest) (*CreateAppResponse, error)
 	mustEmbedUnimplementedDaemonServer()
 }
 
@@ -309,40 +490,77 @@ type DaemonServer interface {
 type UnimplementedDaemonServer struct {
 }
 
-func (*UnimplementedDaemonServer) Run(*RunRequest, Daemon_RunServer) error {
+func (UnimplementedDaemonServer) Run(*RunRequest, Daemon_RunServer) error {
 	return status.Errorf(codes.Unimplemented, "method Run not implemented")
 }
-func (*UnimplementedDaemonServer) Test(*TestRequest, Daemon_TestServer) error {
+func (UnimplementedDaemonServer) Test(*TestRequest, Daemon_TestServer) error {
 	return status.Errorf(codes.Unimplemented, "method Test not implemented")
 }
-func (*UnimplementedDaemonServer) Check(*CheckRequest, Daemon_CheckServer) error {
+func (UnimplementedDaemonServer) TestSpec(context.Context, *TestSpecRequest) (*TestSpecResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method TestSpec not implemented")
+}
+func (UnimplementedDaemonServer) ExecScript(*ExecScriptRequest, Daemon_ExecScriptServer) error {
+	return status.Errorf(codes.Unimplemented, "method ExecScript not implemented")
+}
+func (UnimplementedDaemonServer) Check(*CheckRequest, Daemon_CheckServer) error {
 	return status.Errorf(codes.Unimplemented, "method Check not implemented")
 }
-func (*UnimplementedDaemonServer) Logs(*LogsRequest, Daemon_LogsServer) error {
-	return status.Errorf(codes.Unimplemented, "method Logs not implemented")
+func (UnimplementedDaemonServer) Export(*ExportRequest, Daemon_ExportServer) error {
+	return status.Errorf(codes.Unimplemented, "method Export not implemented")
 }
-func (*UnimplementedDaemonServer) DBConnect(context.Context, *DBConnectRequest) (*DBConnectResponse, error) {
+func (UnimplementedDaemonServer) DBConnect(context.Context, *DBConnectRequest) (*DBConnectResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method DBConnect not implemented")
 }
-func (*UnimplementedDaemonServer) DBProxy(*DBProxyRequest, Daemon_DBProxyServer) error {
+func (UnimplementedDaemonServer) DBProxy(*DBProxyRequest, Daemon_DBProxyServer) error {
 	return status.Errorf(codes.Unimplemented, "method DBProxy not implemented")
 }
-func (*UnimplementedDaemonServer) DBReset(*DBResetRequest, Daemon_DBResetServer) error {
+func (UnimplementedDaemonServer) DBReset(*DBResetRequest, Daemon_DBResetServer) error {
 	return status.Errorf(codes.Unimplemented, "method DBReset not implemented")
 }
-func (*UnimplementedDaemonServer) GenClient(context.Context, *GenClientRequest) (*GenClientResponse, error) {
+func (UnimplementedDaemonServer) GenClient(context.Context, *GenClientRequest) (*GenClientResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GenClient not implemented")
 }
-func (*UnimplementedDaemonServer) SetSecret(context.Context, *SetSecretRequest) (*SetSecretResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method SetSecret not implemented")
+func (UnimplementedDaemonServer) GenWrappers(context.Context, *GenWrappersRequest) (*GenWrappersResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GenWrappers not implemented")
+}
+func (UnimplementedDaemonServer) SecretsRefresh(context.Context, *SecretsRefreshRequest) (*SecretsRefreshResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SecretsRefresh not implemented")
 }
-func (*UnimplementedDaemonServer) Version(context.Context, *emptypb.Empty) (*VersionResponse, error) {
+func (UnimplementedDaemonServer) Version(context.Context, *emptypb.Empty) (*VersionResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method Version not implemented")
 }
-func (*UnimplementedDaemonServer) mustEmbedUnimplementedDaemonServer() {}
+func (UnimplementedDaemonServer) CreateNamespace(context.Context, *CreateNamespaceRequest) (*Namespace, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateNamespace not implemented")
+}
+func (UnimplementedDaemonServer) SwitchNamespace(context.Context, *SwitchNamespaceRequest) (*Namespace, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method SwitchNamespace not implemented")
+}
+func (UnimplementedDaemonServer) ListNamespaces(context.Context, *ListNamespacesRequest) (*ListNamespacesResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ListNamespaces not implemented")
+}
+func (UnimplementedDaemonServer) DeleteNamespace(context.Context, *DeleteNamespaceRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DeleteNamespace not implemented")
+}
+func (UnimplementedDaemonServer) DumpMeta(context.Context, *DumpMetaRequest) (*DumpMetaResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method DumpMeta not implemented")
+}
+func (UnimplementedDaemonServer) Telemetry(context.Context, *TelemetryConfig) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Telemetry not implemented")
+}
+func (UnimplementedDaemonServer) CreateApp(context.Context, *CreateAppRequest) (*CreateAppResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CreateApp not implemented")
+}
+func (UnimplementedDaemonServer) mustEmbedUnimplementedDaemonServer() {}
 
-func RegisterDaemonServer(s *grpc.Server, srv DaemonServer) {
-	s.RegisterService(&_Daemon_serviceDesc, srv)
+// UnsafeDaemonServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to DaemonServer will
+// result in compilation errors.
+type UnsafeDaemonServer interface {
+	mustEmbedUnimplementedDaemonServer()
+}
+
+func RegisterDaemonServer(s grpc.ServiceRegistrar, srv DaemonServer) {
+	s.RegisterService(&Daemon_ServiceDesc, srv)
 }
 
 func _Daemon_Run_Handler(srv interface{}, stream grpc.ServerStream) error {
@@ -354,7 +572,7 @@ func _Daemon_Run_Handler(srv interface{}, stream grpc.ServerStream) error {
 }
 
 type Daemon_RunServer interface {
-	Send(*RunMessage) error
+	Send(*CommandMessage) error
 	grpc.ServerStream
 }
 
@@ -362,7 +580,7 @@ type daemonRunServer struct {
 	grpc.ServerStream
 }
 
-func (x *daemonRunServer) Send(m *RunMessage) error {
+func (x *daemonRunServer) Send(m *CommandMessage) error {
 	return x.ServerStream.SendMsg(m)
 }
 
@@ -387,6 +605,45 @@ func (x *daemonTestServer) Send(m *CommandMessage) error {
 	return x.ServerStream.SendMsg(m)
 }
 
+func _Daemon_TestSpec_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TestSpecRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServer).TestSpec(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Daemon_TestSpec_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServer).TestSpec(ctx, req.(*TestSpecRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Daemon_ExecScript_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(ExecScriptRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(DaemonServer).ExecScript(m, &daemonExecScriptServer{stream})
+}
+
+type Daemon_ExecScriptServer interface {
+	Send(*CommandMessage) error
+	grpc.ServerStream
+}
+
+type daemonExecScriptServer struct {
+	grpc.ServerStream
+}
+
+func (x *daemonExecScriptServer) Send(m *CommandMessage) error {
+	return x.ServerStream.SendMsg(m)
+}
+
 func _Daemon_Check_Handler(srv interface{}, stream grpc.ServerStream) error {
 	m := new(CheckRequest)
 	if err := stream.RecvMsg(m); err != nil {
@@ -408,24 +665,24 @@ func (x *daemonCheckServer) Send(m *CommandMessage) error {
 	return x.ServerStream.SendMsg(m)
 }
 
-func _Daemon_Logs_Handler(srv interface{}, stream grpc.ServerStream) error {
-	m := new(LogsRequest)
+func _Daemon_Export_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(ExportRequest)
 	if err := stream.RecvMsg(m); err != nil {
 		return err
 	}
-	return srv.(DaemonServer).Logs(m, &daemonLogsServer{stream})
+	return srv.(DaemonServer).Export(m, &daemonExportServer{stream})
 }
 
-type Daemon_LogsServer interface {
-	Send(*LogsMessage) error
+type Daemon_ExportServer interface {
+	Send(*CommandMessage) error
 	grpc.ServerStream
 }
 
-type daemonLogsServer struct {
+type daemonExportServer struct {
 	grpc.ServerStream
 }
 
-func (x *daemonLogsServer) Send(m *LogsMessage) error {
+func (x *daemonExportServer) Send(m *CommandMessage) error {
 	return x.ServerStream.SendMsg(m)
 }
 
@@ -439,7 +696,7 @@ func _Daemon_DBConnect_Handler(srv interface{}, ctx context.Context, dec func(in
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/encore.daemon.Daemon/DBConnect",
+		FullMethod: Daemon_DBConnect_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DaemonServer).DBConnect(ctx, req.(*DBConnectRequest))
@@ -499,7 +756,7 @@ func _Daemon_GenClient_Handler(srv interface{}, ctx context.Context, dec func(in
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/encore.daemon.Daemon/GenClient",
+		FullMethod: Daemon_GenClient_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DaemonServer).GenClient(ctx, req.(*GenClientRequest))
@@ -507,20 +764,38 @@ func _Daemon_GenClient_Handler(srv interface{}, ctx context.Context, dec func(in
 	return interceptor(ctx, in, info, handler)
 }
 
-func _Daemon_SetSecret_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(SetSecretRequest)
+func _Daemon_GenWrappers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GenWrappersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServer).GenWrappers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Daemon_GenWrappers_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServer).GenWrappers(ctx, req.(*GenWrappersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Daemon_SecretsRefresh_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SecretsRefreshRequest)
 	if err := dec(in); err != nil {
 		return nil, err
 	}
 	if interceptor == nil {
-		return srv.(DaemonServer).SetSecret(ctx, in)
+		return srv.(DaemonServer).SecretsRefresh(ctx, in)
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/encore.daemon.Daemon/SetSecret",
+		FullMethod: Daemon_SecretsRefresh_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(DaemonServer).SetSecret(ctx, req.(*SetSecretRequest))
+		return srv.(DaemonServer).SecretsRefresh(ctx, req.(*SecretsRefreshRequest))
 	}
 	return interceptor(ctx, in, info, handler)
 }
@@ -535,7 +810,7 @@ func _Daemon_Version_Handler(srv interface{}, ctx context.Context, dec func(inte
 	}
 	info := &grpc.UnaryServerInfo{
 		Server:     srv,
-		FullMethod: "/encore.daemon.Daemon/Version",
+		FullMethod: Daemon_Version_FullMethodName,
 	}
 	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
 		return srv.(DaemonServer).Version(ctx, req.(*emptypb.Empty))
@@ -543,10 +818,143 @@ func _Daemon_Version_Handler(srv interface{}, ctx context.Context, dec func(inte
 	return interceptor(ctx, in, info, handler)
 }
 
-var _Daemon_serviceDesc = grpc.ServiceDesc{
+func _Daemon_CreateNamespace_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateNamespaceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServer).CreateNamespace(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Daemon_CreateNamespace_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServer).CreateNamespace(ctx, req.(*CreateNamespaceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Daemon_SwitchNamespace_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(SwitchNamespaceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServer).SwitchNamespace(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Daemon_SwitchNamespace_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServer).SwitchNamespace(ctx, req.(*SwitchNamespaceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Daemon_ListNamespaces_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListNamespacesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServer).ListNamespaces(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Daemon_ListNamespaces_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServer).ListNamespaces(ctx, req.(*ListNamespacesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Daemon_DeleteNamespace_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteNamespaceRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServer).DeleteNamespace(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Daemon_DeleteNamespace_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServer).DeleteNamespace(ctx, req.(*DeleteNamespaceRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Daemon_DumpMeta_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DumpMetaRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServer).DumpMeta(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Daemon_DumpMeta_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServer).DumpMeta(ctx, req.(*DumpMetaRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Daemon_Telemetry_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(TelemetryConfig)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServer).Telemetry(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Daemon_Telemetry_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServer).Telemetry(ctx, req.(*TelemetryConfig))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Daemon_CreateApp_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateAppRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(DaemonServer).CreateApp(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: Daemon_CreateApp_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(DaemonServer).CreateApp(ctx, req.(*CreateAppRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Daemon_ServiceDesc is the grpc.ServiceDesc for Daemon service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Daemon_ServiceDesc = grpc.ServiceDesc{
 	ServiceName: "encore.daemon.Daemon",
 	HandlerType: (*DaemonServer)(nil),
 	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "TestSpec",
+			Handler:    _Daemon_TestSpec_Handler,
+		},
 		{
 			MethodName: "DBConnect",
 			Handler:    _Daemon_DBConnect_Handler,
@@ -556,13 +964,45 @@ var _Daemon_serviceDesc = grpc.ServiceDesc{
 			Handler:    _Daemon_GenClient_Handler,
 		},
 		{
-			MethodName: "SetSecret",
-			Handler:    _Daemon_SetSecret_Handler,
+			MethodName: "GenWrappers",
+			Handler:    _Daemon_GenWrappers_Handler,
+		},
+		{
+			MethodName: "SecretsRefresh",
+			Handler:    _Daemon_SecretsRefresh_Handler,
 		},
 		{
 			MethodName: "Version",
 			Handler:    _Daemon_Version_Handler,
 		},
+		{
+			MethodName: "CreateNamespace",
+			Handler:    _Daemon_CreateNamespace_Handler,
+		},
+		{
+			MethodName: "SwitchNamespace",
+			Handler:    _Daemon_SwitchNamespace_Handler,
+		},
+		{
+			MethodName: "ListNamespaces",
+			Handler:    _Daemon_ListNamespaces_Handler,
+		},
+		{
+			MethodName: "DeleteNamespace",
+			Handler:    _Daemon_DeleteNamespace_Handler,
+		},
+		{
+			MethodName: "DumpMeta",
+			Handler:    _Daemon_DumpMeta_Handler,
+		},
+		{
+			MethodName: "Telemetry",
+			Handler:    _Daemon_Telemetry_Handler,
+		},
+		{
+			MethodName: "CreateApp",
+			Handler:    _Daemon_CreateApp_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{
@@ -575,14 +1015,19 @@ var _Daemon_serviceDesc = grpc.ServiceDesc{
 			Handler:       _Daemon_Test_Handler,
 			ServerStreams: true,
 		},
+		{
+			StreamName:    "ExecScript",
+			Handler:       _Daemon_ExecScript_Handler,
+			ServerStreams: true,
+		},
 		{
 			StreamName:    "Check",
 			Handler:       _Daemon_Check_Handler,
 			ServerStreams: true,
 		},
 		{
-			StreamName:    "Logs",
-			Handler:       _Daemon_Logs_Handler,
+			StreamName:    "Export",
+			Handler:       _Daemon_Export_Handler,
 			ServerStreams: true,
 		},
 		{
diff --git a/proto/encore/engine/trace/trace.pb.go b/proto/encore/engine/trace/trace.pb.go
index 739ad69d99..fa58a46a1f 100644
--- a/proto/encore/engine/trace/trace.pb.go
+++ b/proto/encore/engine/trace/trace.pb.go
@@ -1,15 +1,15 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.14.0
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.23.4
 // source: encore/engine/trace/trace.proto
 
 package trace
 
 import (
-	proto "github.com/golang/protobuf/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 	reflect "reflect"
 	sync "sync"
 )
@@ -21,10 +21,6 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
 type HTTPTraceEventCode int32
 
 const (
@@ -110,8 +106,9 @@ func (HTTPTraceEventCode) EnumDescriptor() ([]byte, []int) {
 type Request_Type int32
 
 const (
-	Request_RPC  Request_Type = 0
-	Request_AUTH Request_Type = 1
+	Request_RPC        Request_Type = 0
+	Request_AUTH       Request_Type = 1
+	Request_PUBSUB_MSG Request_Type = 2
 )
 
 // Enum value maps for Request_Type.
@@ -119,10 +116,12 @@ var (
 	Request_Type_name = map[int32]string{
 		0: "RPC",
 		1: "AUTH",
+		2: "PUBSUB_MSG",
 	}
 	Request_Type_value = map[string]int32{
-		"RPC":  0,
-		"AUTH": 1,
+		"RPC":        0,
+		"AUTH":       1,
+		"PUBSUB_MSG": 2,
 	}
 )
 
@@ -199,6 +198,120 @@ func (DBTransaction_CompletionType) EnumDescriptor() ([]byte, []int) {
 	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{5, 0}
 }
 
+type CacheOp_Result int32
+
+const (
+	CacheOp_UNKNOWN     CacheOp_Result = 0
+	CacheOp_OK          CacheOp_Result = 1
+	CacheOp_NO_SUCH_KEY CacheOp_Result = 2
+	CacheOp_CONFLICT    CacheOp_Result = 3
+	CacheOp_ERR         CacheOp_Result = 4
+)
+
+// Enum value maps for CacheOp_Result.
+var (
+	CacheOp_Result_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "OK",
+		2: "NO_SUCH_KEY",
+		3: "CONFLICT",
+		4: "ERR",
+	}
+	CacheOp_Result_value = map[string]int32{
+		"UNKNOWN":     0,
+		"OK":          1,
+		"NO_SUCH_KEY": 2,
+		"CONFLICT":    3,
+		"ERR":         4,
+	}
+)
+
+func (x CacheOp_Result) Enum() *CacheOp_Result {
+	p := new(CacheOp_Result)
+	*p = x
+	return p
+}
+
+func (x CacheOp_Result) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (CacheOp_Result) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_engine_trace_trace_proto_enumTypes[3].Descriptor()
+}
+
+func (CacheOp_Result) Type() protoreflect.EnumType {
+	return &file_encore_engine_trace_trace_proto_enumTypes[3]
+}
+
+func (x CacheOp_Result) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use CacheOp_Result.Descriptor instead.
+func (CacheOp_Result) EnumDescriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{9, 0}
+}
+
+// Note: These values don't match the values used by the binary trace protocol,
+// as these values are stored in persisted traces and therefore must maintain
+// backwards compatibility. The binary trace protocol is versioned and doesn't
+// have the same limitations.
+type LogMessage_Level int32
+
+const (
+	LogMessage_DEBUG LogMessage_Level = 0
+	LogMessage_INFO  LogMessage_Level = 1
+	LogMessage_ERROR LogMessage_Level = 2
+	LogMessage_WARN  LogMessage_Level = 3
+	LogMessage_TRACE LogMessage_Level = 4
+)
+
+// Enum value maps for LogMessage_Level.
+var (
+	LogMessage_Level_name = map[int32]string{
+		0: "DEBUG",
+		1: "INFO",
+		2: "ERROR",
+		3: "WARN",
+		4: "TRACE",
+	}
+	LogMessage_Level_value = map[string]int32{
+		"DEBUG": 0,
+		"INFO":  1,
+		"ERROR": 2,
+		"WARN":  3,
+		"TRACE": 4,
+	}
+)
+
+func (x LogMessage_Level) Enum() *LogMessage_Level {
+	p := new(LogMessage_Level)
+	*p = x
+	return p
+}
+
+func (x LogMessage_Level) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (LogMessage_Level) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_engine_trace_trace_proto_enumTypes[4].Descriptor()
+}
+
+func (LogMessage_Level) Type() protoreflect.EnumType {
+	return &file_encore_engine_trace_trace_proto_enumTypes[4]
+}
+
+func (x LogMessage_Level) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use LogMessage_Level.Descriptor instead.
+func (LogMessage_Level) EnumDescriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{23, 0}
+}
+
 type TraceID struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -259,20 +372,44 @@ type Request struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	TraceId      *TraceID     `protobuf:"bytes,1,opt,name=trace_id,json=traceId,proto3" json:"trace_id,omitempty"`
-	SpanId       uint64       `protobuf:"varint,2,opt,name=span_id,json=spanId,proto3" json:"span_id,omitempty"`
-	ParentSpanId uint64       `protobuf:"varint,3,opt,name=parent_span_id,json=parentSpanId,proto3" json:"parent_span_id,omitempty"`
-	Goid         uint32       `protobuf:"varint,4,opt,name=goid,proto3" json:"goid,omitempty"`
-	StartTime    uint64       `protobuf:"varint,5,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
-	EndTime      uint64       `protobuf:"varint,6,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
-	CallLoc      int32        `protobuf:"varint,7,opt,name=call_loc,json=callLoc,proto3" json:"call_loc,omitempty"`
-	DefLoc       int32        `protobuf:"varint,8,opt,name=def_loc,json=defLoc,proto3" json:"def_loc,omitempty"`
-	Inputs       [][]byte     `protobuf:"bytes,9,rep,name=inputs,proto3" json:"inputs,omitempty"`
-	Outputs      [][]byte     `protobuf:"bytes,10,rep,name=outputs,proto3" json:"outputs,omitempty"`
-	Err          []byte       `protobuf:"bytes,11,opt,name=err,proto3" json:"err,omitempty"`
-	Events       []*Event     `protobuf:"bytes,12,rep,name=events,proto3" json:"events,omitempty"`
-	Uid          string       `protobuf:"bytes,13,opt,name=uid,proto3" json:"uid,omitempty"`
-	Type         Request_Type `protobuf:"varint,14,opt,name=type,proto3,enum=encore.engine.trace.Request_Type" json:"type,omitempty"`
+	TraceId       *TraceID     `protobuf:"bytes,1,opt,name=trace_id,json=traceId,proto3" json:"trace_id,omitempty"`
+	SpanId        uint64       `protobuf:"varint,2,opt,name=span_id,json=spanId,proto3" json:"span_id,omitempty"`
+	ParentSpanId  uint64       `protobuf:"varint,3,opt,name=parent_span_id,json=parentSpanId,proto3" json:"parent_span_id,omitempty"`
+	ParentTraceId *TraceID     `protobuf:"bytes,32,opt,name=parent_trace_id,json=parentTraceId,proto3" json:"parent_trace_id,omitempty"`
+	Goid          uint32       `protobuf:"varint,4,opt,name=goid,proto3" json:"goid,omitempty"`
+	StartTime     uint64       `protobuf:"varint,5,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
+	EndTime       uint64       `protobuf:"varint,6,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
+	DefLoc        int32        `protobuf:"varint,8,opt,name=def_loc,json=defLoc,proto3" json:"def_loc,omitempty"`
+	Err           []byte       `protobuf:"bytes,11,opt,name=err,proto3" json:"err,omitempty"`
+	Events        []*Event     `protobuf:"bytes,12,rep,name=events,proto3" json:"events,omitempty"`
+	Type          Request_Type `protobuf:"varint,14,opt,name=type,proto3,enum=encore.engine.trace.Request_Type" json:"type,omitempty"`
+	ErrStack      *StackTrace  `protobuf:"bytes,15,opt,name=err_stack,json=errStack,proto3" json:"err_stack,omitempty"`       // null if unavailable
+	PanicStack    *StackTrace  `protobuf:"bytes,34,opt,name=panic_stack,json=panicStack,proto3" json:"panic_stack,omitempty"` // null if unavailable
+	// abs_start_time is the absolute unix timestamp
+	// (in nanosecond resolution) of when the request started.
+	AbsStartTime uint64 `protobuf:"varint,16,opt,name=abs_start_time,json=absStartTime,proto3" json:"abs_start_time,omitempty"`
+	ServiceName  string `protobuf:"bytes,17,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	EndpointName string `protobuf:"bytes,18,opt,name=endpoint_name,json=endpointName,proto3" json:"endpoint_name,omitempty"`
+	// Fields set if Type == PUBSUB_MSG
+	TopicName        string `protobuf:"bytes,19,opt,name=topic_name,json=topicName,proto3" json:"topic_name,omitempty"`
+	SubscriptionName string `protobuf:"bytes,20,opt,name=subscription_name,json=subscriptionName,proto3" json:"subscription_name,omitempty"`
+	MessageId        string `protobuf:"bytes,21,opt,name=message_id,json=messageId,proto3" json:"message_id,omitempty"`
+	Attempt          uint32 `protobuf:"varint,22,opt,name=attempt,proto3" json:"attempt,omitempty"`
+	PublishTime      uint64 `protobuf:"varint,23,opt,name=publish_time,json=publishTime,proto3" json:"publish_time,omitempty"`
+	// Fields set if Type == RPC or AUTH
+	Inputs             [][]byte          `protobuf:"bytes,9,rep,name=inputs,proto3" json:"inputs,omitempty"`    // Deprecated: use request_payload and path_params
+	Outputs            [][]byte          `protobuf:"bytes,10,rep,name=outputs,proto3" json:"outputs,omitempty"` // Deprecated: use response_payload and uid
+	Uid                string            `protobuf:"bytes,13,opt,name=uid,proto3" json:"uid,omitempty"`
+	HttpMethod         string            `protobuf:"bytes,24,opt,name=http_method,json=httpMethod,proto3" json:"http_method,omitempty"`
+	Path               string            `protobuf:"bytes,25,opt,name=path,proto3" json:"path,omitempty"`
+	PathParams         []string          `protobuf:"bytes,26,rep,name=path_params,json=pathParams,proto3" json:"path_params,omitempty"`
+	RequestPayload     []byte            `protobuf:"bytes,27,opt,name=request_payload,json=requestPayload,proto3" json:"request_payload,omitempty"`
+	ResponsePayload    []byte            `protobuf:"bytes,28,opt,name=response_payload,json=responsePayload,proto3" json:"response_payload,omitempty"`
+	RawRequestHeaders  map[string]string `protobuf:"bytes,29,rep,name=raw_request_headers,json=rawRequestHeaders,proto3" json:"raw_request_headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	RawResponseHeaders map[string]string `protobuf:"bytes,30,rep,name=raw_response_headers,json=rawResponseHeaders,proto3" json:"raw_response_headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// external_request_id is the value of the X-Request-ID header.
+	ExternalRequestId     string `protobuf:"bytes,31,opt,name=external_request_id,json=externalRequestId,proto3" json:"external_request_id,omitempty"`
+	ExternalCorrelationId string `protobuf:"bytes,33,opt,name=external_correlation_id,json=externalCorrelationId,proto3" json:"external_correlation_id,omitempty"`
 }
 
 func (x *Request) Reset() {
@@ -328,6 +465,13 @@ func (x *Request) GetParentSpanId() uint64 {
 	return 0
 }
 
+func (x *Request) GetParentTraceId() *TraceID {
+	if x != nil {
+		return x.ParentTraceId
+	}
+	return nil
+}
+
 func (x *Request) GetGoid() uint32 {
 	if x != nil {
 		return x.Goid
@@ -349,16 +493,100 @@ func (x *Request) GetEndTime() uint64 {
 	return 0
 }
 
-func (x *Request) GetCallLoc() int32 {
+func (x *Request) GetDefLoc() int32 {
 	if x != nil {
-		return x.CallLoc
+		return x.DefLoc
 	}
 	return 0
 }
 
-func (x *Request) GetDefLoc() int32 {
+func (x *Request) GetErr() []byte {
 	if x != nil {
-		return x.DefLoc
+		return x.Err
+	}
+	return nil
+}
+
+func (x *Request) GetEvents() []*Event {
+	if x != nil {
+		return x.Events
+	}
+	return nil
+}
+
+func (x *Request) GetType() Request_Type {
+	if x != nil {
+		return x.Type
+	}
+	return Request_RPC
+}
+
+func (x *Request) GetErrStack() *StackTrace {
+	if x != nil {
+		return x.ErrStack
+	}
+	return nil
+}
+
+func (x *Request) GetPanicStack() *StackTrace {
+	if x != nil {
+		return x.PanicStack
+	}
+	return nil
+}
+
+func (x *Request) GetAbsStartTime() uint64 {
+	if x != nil {
+		return x.AbsStartTime
+	}
+	return 0
+}
+
+func (x *Request) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *Request) GetEndpointName() string {
+	if x != nil {
+		return x.EndpointName
+	}
+	return ""
+}
+
+func (x *Request) GetTopicName() string {
+	if x != nil {
+		return x.TopicName
+	}
+	return ""
+}
+
+func (x *Request) GetSubscriptionName() string {
+	if x != nil {
+		return x.SubscriptionName
+	}
+	return ""
+}
+
+func (x *Request) GetMessageId() string {
+	if x != nil {
+		return x.MessageId
+	}
+	return ""
+}
+
+func (x *Request) GetAttempt() uint32 {
+	if x != nil {
+		return x.Attempt
+	}
+	return 0
+}
+
+func (x *Request) GetPublishTime() uint64 {
+	if x != nil {
+		return x.PublishTime
 	}
 	return 0
 }
@@ -377,32 +605,74 @@ func (x *Request) GetOutputs() [][]byte {
 	return nil
 }
 
-func (x *Request) GetErr() []byte {
+func (x *Request) GetUid() string {
 	if x != nil {
-		return x.Err
+		return x.Uid
+	}
+	return ""
+}
+
+func (x *Request) GetHttpMethod() string {
+	if x != nil {
+		return x.HttpMethod
+	}
+	return ""
+}
+
+func (x *Request) GetPath() string {
+	if x != nil {
+		return x.Path
+	}
+	return ""
+}
+
+func (x *Request) GetPathParams() []string {
+	if x != nil {
+		return x.PathParams
 	}
 	return nil
 }
 
-func (x *Request) GetEvents() []*Event {
+func (x *Request) GetRequestPayload() []byte {
 	if x != nil {
-		return x.Events
+		return x.RequestPayload
 	}
 	return nil
 }
 
-func (x *Request) GetUid() string {
+func (x *Request) GetResponsePayload() []byte {
 	if x != nil {
-		return x.Uid
+		return x.ResponsePayload
+	}
+	return nil
+}
+
+func (x *Request) GetRawRequestHeaders() map[string]string {
+	if x != nil {
+		return x.RawRequestHeaders
+	}
+	return nil
+}
+
+func (x *Request) GetRawResponseHeaders() map[string]string {
+	if x != nil {
+		return x.RawResponseHeaders
+	}
+	return nil
+}
+
+func (x *Request) GetExternalRequestId() string {
+	if x != nil {
+		return x.ExternalRequestId
 	}
 	return ""
 }
 
-func (x *Request) GetType() Request_Type {
+func (x *Request) GetExternalCorrelationId() string {
 	if x != nil {
-		return x.Type
+		return x.ExternalCorrelationId
 	}
-	return Request_RPC
+	return ""
 }
 
 type Event struct {
@@ -411,11 +681,17 @@ type Event struct {
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to Data:
+	//
 	//	*Event_Rpc
 	//	*Event_Tx
 	//	*Event_Query
 	//	*Event_Goroutine
 	//	*Event_Http
+	//	*Event_Log
+	//	*Event_PublishedMsg
+	//	*Event_ServiceInit
+	//	*Event_Cache
+	//	*Event_BodyStream
 	Data isEvent_Data `protobuf_oneof:"data"`
 }
 
@@ -493,6 +769,41 @@ func (x *Event) GetHttp() *HTTPCall {
 	return nil
 }
 
+func (x *Event) GetLog() *LogMessage {
+	if x, ok := x.GetData().(*Event_Log); ok {
+		return x.Log
+	}
+	return nil
+}
+
+func (x *Event) GetPublishedMsg() *PubsubMsgPublished {
+	if x, ok := x.GetData().(*Event_PublishedMsg); ok {
+		return x.PublishedMsg
+	}
+	return nil
+}
+
+func (x *Event) GetServiceInit() *ServiceInit {
+	if x, ok := x.GetData().(*Event_ServiceInit); ok {
+		return x.ServiceInit
+	}
+	return nil
+}
+
+func (x *Event) GetCache() *CacheOp {
+	if x, ok := x.GetData().(*Event_Cache); ok {
+		return x.Cache
+	}
+	return nil
+}
+
+func (x *Event) GetBodyStream() *BodyStream {
+	if x, ok := x.GetData().(*Event_BodyStream); ok {
+		return x.BodyStream
+	}
+	return nil
+}
+
 type isEvent_Data interface {
 	isEvent_Data()
 }
@@ -517,6 +828,26 @@ type Event_Http struct {
 	Http *HTTPCall `protobuf:"bytes,5,opt,name=http,proto3,oneof"`
 }
 
+type Event_Log struct {
+	Log *LogMessage `protobuf:"bytes,6,opt,name=log,proto3,oneof"`
+}
+
+type Event_PublishedMsg struct {
+	PublishedMsg *PubsubMsgPublished `protobuf:"bytes,7,opt,name=publishedMsg,proto3,oneof"`
+}
+
+type Event_ServiceInit struct {
+	ServiceInit *ServiceInit `protobuf:"bytes,8,opt,name=service_init,json=serviceInit,proto3,oneof"`
+}
+
+type Event_Cache struct {
+	Cache *CacheOp `protobuf:"bytes,9,opt,name=cache,proto3,oneof"`
+}
+
+type Event_BodyStream struct {
+	BodyStream *BodyStream `protobuf:"bytes,10,opt,name=body_stream,json=bodyStream,proto3,oneof"`
+}
+
 func (*Event_Rpc) isEvent_Data() {}
 
 func (*Event_Tx) isEvent_Data() {}
@@ -527,18 +858,28 @@ func (*Event_Goroutine) isEvent_Data() {}
 
 func (*Event_Http) isEvent_Data() {}
 
+func (*Event_Log) isEvent_Data() {}
+
+func (*Event_PublishedMsg) isEvent_Data() {}
+
+func (*Event_ServiceInit) isEvent_Data() {}
+
+func (*Event_Cache) isEvent_Data() {}
+
+func (*Event_BodyStream) isEvent_Data() {}
+
 type RPCCall struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	SpanId    uint64 `protobuf:"varint,1,opt,name=span_id,json=spanId,proto3" json:"span_id,omitempty"`
-	Goid      uint32 `protobuf:"varint,2,opt,name=goid,proto3" json:"goid,omitempty"`
-	CallLoc   int32  `protobuf:"varint,3,opt,name=call_loc,json=callLoc,proto3" json:"call_loc,omitempty"`
-	DefLoc    int32  `protobuf:"varint,4,opt,name=def_loc,json=defLoc,proto3" json:"def_loc,omitempty"`
-	StartTime uint64 `protobuf:"varint,5,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
-	EndTime   uint64 `protobuf:"varint,6,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
-	Err       []byte `protobuf:"bytes,7,opt,name=err,proto3" json:"err,omitempty"`
+	SpanId    uint64      `protobuf:"varint,1,opt,name=span_id,json=spanId,proto3" json:"span_id,omitempty"`
+	Goid      uint32      `protobuf:"varint,2,opt,name=goid,proto3" json:"goid,omitempty"`
+	DefLoc    int32       `protobuf:"varint,4,opt,name=def_loc,json=defLoc,proto3" json:"def_loc,omitempty"`
+	StartTime uint64      `protobuf:"varint,5,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
+	EndTime   uint64      `protobuf:"varint,6,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
+	Err       []byte      `protobuf:"bytes,7,opt,name=err,proto3" json:"err,omitempty"`
+	Stack     *StackTrace `protobuf:"bytes,8,opt,name=stack,proto3" json:"stack,omitempty"` // where it was called (null if unavailable)
 }
 
 func (x *RPCCall) Reset() {
@@ -587,13 +928,6 @@ func (x *RPCCall) GetGoid() uint32 {
 	return 0
 }
 
-func (x *RPCCall) GetCallLoc() int32 {
-	if x != nil {
-		return x.CallLoc
-	}
-	return 0
-}
-
 func (x *RPCCall) GetDefLoc() int32 {
 	if x != nil {
 		return x.DefLoc
@@ -622,13 +956,19 @@ func (x *RPCCall) GetErr() []byte {
 	return nil
 }
 
+func (x *RPCCall) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
 type Goroutine struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
 	Goid      uint32 `protobuf:"varint,1,opt,name=goid,proto3" json:"goid,omitempty"`
-	CallLoc   int32  `protobuf:"varint,2,opt,name=call_loc,json=callLoc,proto3" json:"call_loc,omitempty"` // not yet set
 	StartTime uint64 `protobuf:"varint,3,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
 	EndTime   uint64 `protobuf:"varint,4,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
 }
@@ -672,13 +1012,6 @@ func (x *Goroutine) GetGoid() uint32 {
 	return 0
 }
 
-func (x *Goroutine) GetCallLoc() int32 {
-	if x != nil {
-		return x.CallLoc
-	}
-	return 0
-}
-
 func (x *Goroutine) GetStartTime() uint64 {
 	if x != nil {
 		return x.StartTime
@@ -699,13 +1032,13 @@ type DBTransaction struct {
 	unknownFields protoimpl.UnknownFields
 
 	Goid       uint32                       `protobuf:"varint,1,opt,name=goid,proto3" json:"goid,omitempty"`
-	StartLoc   int32                        `protobuf:"varint,2,opt,name=start_loc,json=startLoc,proto3" json:"start_loc,omitempty"`
-	EndLoc     int32                        `protobuf:"varint,3,opt,name=end_loc,json=endLoc,proto3" json:"end_loc,omitempty"`
 	StartTime  uint64                       `protobuf:"varint,4,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
 	EndTime    uint64                       `protobuf:"varint,5,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
 	Err        []byte                       `protobuf:"bytes,6,opt,name=err,proto3" json:"err,omitempty"`
 	Completion DBTransaction_CompletionType `protobuf:"varint,7,opt,name=completion,proto3,enum=encore.engine.trace.DBTransaction_CompletionType" json:"completion,omitempty"`
 	Queries    []*DBQuery                   `protobuf:"bytes,8,rep,name=queries,proto3" json:"queries,omitempty"`
+	BeginStack *StackTrace                  `protobuf:"bytes,9,opt,name=begin_stack,json=beginStack,proto3" json:"begin_stack,omitempty"` // null if unavailable
+	EndStack   *StackTrace                  `protobuf:"bytes,10,opt,name=end_stack,json=endStack,proto3" json:"end_stack,omitempty"`      // null if unavailable
 }
 
 func (x *DBTransaction) Reset() {
@@ -747,20 +1080,6 @@ func (x *DBTransaction) GetGoid() uint32 {
 	return 0
 }
 
-func (x *DBTransaction) GetStartLoc() int32 {
-	if x != nil {
-		return x.StartLoc
-	}
-	return 0
-}
-
-func (x *DBTransaction) GetEndLoc() int32 {
-	if x != nil {
-		return x.EndLoc
-	}
-	return 0
-}
-
 func (x *DBTransaction) GetStartTime() uint64 {
 	if x != nil {
 		return x.StartTime
@@ -796,17 +1115,31 @@ func (x *DBTransaction) GetQueries() []*DBQuery {
 	return nil
 }
 
+func (x *DBTransaction) GetBeginStack() *StackTrace {
+	if x != nil {
+		return x.BeginStack
+	}
+	return nil
+}
+
+func (x *DBTransaction) GetEndStack() *StackTrace {
+	if x != nil {
+		return x.EndStack
+	}
+	return nil
+}
+
 type DBQuery struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Goid      uint32 `protobuf:"varint,1,opt,name=goid,proto3" json:"goid,omitempty"`
-	CallLoc   int32  `protobuf:"varint,2,opt,name=call_loc,json=callLoc,proto3" json:"call_loc,omitempty"`
-	StartTime uint64 `protobuf:"varint,3,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
-	EndTime   uint64 `protobuf:"varint,4,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
-	Query     []byte `protobuf:"bytes,5,opt,name=query,proto3" json:"query,omitempty"`
-	Err       []byte `protobuf:"bytes,6,opt,name=err,proto3" json:"err,omitempty"`
+	Goid      uint32      `protobuf:"varint,1,opt,name=goid,proto3" json:"goid,omitempty"`
+	StartTime uint64      `protobuf:"varint,3,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
+	EndTime   uint64      `protobuf:"varint,4,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
+	Query     []byte      `protobuf:"bytes,5,opt,name=query,proto3" json:"query,omitempty"`
+	Err       []byte      `protobuf:"bytes,6,opt,name=err,proto3" json:"err,omitempty"`
+	Stack     *StackTrace `protobuf:"bytes,7,opt,name=stack,proto3" json:"stack,omitempty"` // null if unavailable
 }
 
 func (x *DBQuery) Reset() {
@@ -848,13 +1181,6 @@ func (x *DBQuery) GetGoid() uint32 {
 	return 0
 }
 
-func (x *DBQuery) GetCallLoc() int32 {
-	if x != nil {
-		return x.CallLoc
-	}
-	return 0
-}
-
 func (x *DBQuery) GetStartTime() uint64 {
 	if x != nil {
 		return x.StartTime
@@ -883,25 +1209,30 @@ func (x *DBQuery) GetErr() []byte {
 	return nil
 }
 
-type HTTPCall struct {
+func (x *DBQuery) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+type PubsubMsgPublished struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	SpanId         uint64            `protobuf:"varint,1,opt,name=span_id,json=spanId,proto3" json:"span_id,omitempty"`
-	Goid           uint32            `protobuf:"varint,2,opt,name=goid,proto3" json:"goid,omitempty"`
-	StartTime      uint64            `protobuf:"varint,3,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
-	EndTime        uint64            `protobuf:"varint,4,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
-	Method         string            `protobuf:"bytes,5,opt,name=method,proto3" json:"method,omitempty"`
-	Url            string            `protobuf:"bytes,6,opt,name=url,proto3" json:"url,omitempty"`
-	StatusCode     uint32            `protobuf:"varint,7,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"`
-	Err            []byte            `protobuf:"bytes,8,opt,name=err,proto3" json:"err,omitempty"`
-	BodyClosedTime uint64            `protobuf:"varint,9,opt,name=body_closed_time,json=bodyClosedTime,proto3" json:"body_closed_time,omitempty"`
-	Events         []*HTTPTraceEvent `protobuf:"bytes,10,rep,name=events,proto3" json:"events,omitempty"`
+	Goid      uint64      `protobuf:"varint,1,opt,name=goid,proto3" json:"goid,omitempty"`
+	StartTime uint64      `protobuf:"varint,3,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
+	EndTime   uint64      `protobuf:"varint,4,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
+	Topic     string      `protobuf:"bytes,5,opt,name=topic,proto3" json:"topic,omitempty"`
+	Message   []byte      `protobuf:"bytes,6,opt,name=message,proto3" json:"message,omitempty"`
+	MessageId string      `protobuf:"bytes,7,opt,name=message_id,json=messageId,proto3" json:"message_id,omitempty"`
+	Err       []byte      `protobuf:"bytes,8,opt,name=err,proto3" json:"err,omitempty"`
+	Stack     *StackTrace `protobuf:"bytes,9,opt,name=stack,proto3" json:"stack,omitempty"`
 }
 
-func (x *HTTPCall) Reset() {
-	*x = HTTPCall{}
+func (x *PubsubMsgPublished) Reset() {
+	*x = PubsubMsgPublished{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_engine_trace_trace_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -909,13 +1240,13 @@ func (x *HTTPCall) Reset() {
 	}
 }
 
-func (x *HTTPCall) String() string {
+func (x *PubsubMsgPublished) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*HTTPCall) ProtoMessage() {}
+func (*PubsubMsgPublished) ProtoMessage() {}
 
-func (x *HTTPCall) ProtoReflect() protoreflect.Message {
+func (x *PubsubMsgPublished) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_engine_trace_trace_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -927,103 +1258,83 @@ func (x *HTTPCall) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use HTTPCall.ProtoReflect.Descriptor instead.
-func (*HTTPCall) Descriptor() ([]byte, []int) {
+// Deprecated: Use PubsubMsgPublished.ProtoReflect.Descriptor instead.
+func (*PubsubMsgPublished) Descriptor() ([]byte, []int) {
 	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{7}
 }
 
-func (x *HTTPCall) GetSpanId() uint64 {
-	if x != nil {
-		return x.SpanId
-	}
-	return 0
-}
-
-func (x *HTTPCall) GetGoid() uint32 {
+func (x *PubsubMsgPublished) GetGoid() uint64 {
 	if x != nil {
 		return x.Goid
 	}
 	return 0
 }
 
-func (x *HTTPCall) GetStartTime() uint64 {
+func (x *PubsubMsgPublished) GetStartTime() uint64 {
 	if x != nil {
 		return x.StartTime
 	}
 	return 0
 }
 
-func (x *HTTPCall) GetEndTime() uint64 {
+func (x *PubsubMsgPublished) GetEndTime() uint64 {
 	if x != nil {
 		return x.EndTime
 	}
 	return 0
 }
 
-func (x *HTTPCall) GetMethod() string {
+func (x *PubsubMsgPublished) GetTopic() string {
 	if x != nil {
-		return x.Method
+		return x.Topic
 	}
 	return ""
 }
 
-func (x *HTTPCall) GetUrl() string {
+func (x *PubsubMsgPublished) GetMessage() []byte {
 	if x != nil {
-		return x.Url
+		return x.Message
 	}
-	return ""
+	return nil
 }
 
-func (x *HTTPCall) GetStatusCode() uint32 {
+func (x *PubsubMsgPublished) GetMessageId() string {
 	if x != nil {
-		return x.StatusCode
+		return x.MessageId
 	}
-	return 0
+	return ""
 }
 
-func (x *HTTPCall) GetErr() []byte {
+func (x *PubsubMsgPublished) GetErr() []byte {
 	if x != nil {
 		return x.Err
 	}
 	return nil
 }
 
-func (x *HTTPCall) GetBodyClosedTime() uint64 {
-	if x != nil {
-		return x.BodyClosedTime
-	}
-	return 0
-}
-
-func (x *HTTPCall) GetEvents() []*HTTPTraceEvent {
+func (x *PubsubMsgPublished) GetStack() *StackTrace {
 	if x != nil {
-		return x.Events
+		return x.Stack
 	}
 	return nil
 }
 
-type HTTPTraceEvent struct {
+type ServiceInit struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Code HTTPTraceEventCode `protobuf:"varint,1,opt,name=code,proto3,enum=encore.engine.trace.HTTPTraceEventCode" json:"code,omitempty"`
-	Time uint64             `protobuf:"varint,2,opt,name=time,proto3" json:"time,omitempty"`
-	// Types that are assignable to Data:
-	//	*HTTPTraceEvent_GetConn
-	//	*HTTPTraceEvent_GotConn
-	//	*HTTPTraceEvent_Got_1XxResponse
-	//	*HTTPTraceEvent_DnsStart
-	//	*HTTPTraceEvent_DnsDone
-	//	*HTTPTraceEvent_ConnectStart
-	//	*HTTPTraceEvent_ConnectDone
-	//	*HTTPTraceEvent_TlsHandshakeDone
-	//	*HTTPTraceEvent_WroteRequest
-	Data isHTTPTraceEvent_Data `protobuf_oneof:"data"`
+	Goid      uint64      `protobuf:"varint,1,opt,name=goid,proto3" json:"goid,omitempty"`
+	DefLoc    int32       `protobuf:"varint,2,opt,name=def_loc,json=defLoc,proto3" json:"def_loc,omitempty"`
+	StartTime uint64      `protobuf:"varint,3,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
+	EndTime   uint64      `protobuf:"varint,4,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
+	Service   string      `protobuf:"bytes,5,opt,name=service,proto3" json:"service,omitempty"`
+	Err       []byte      `protobuf:"bytes,6,opt,name=err,proto3" json:"err,omitempty"`
+	ErrStack  *StackTrace `protobuf:"bytes,7,opt,name=err_stack,json=errStack,proto3" json:"err_stack,omitempty"` // null if not an error
 }
 
-func (x *HTTPTraceEvent) Reset() {
-	*x = HTTPTraceEvent{}
+func (x *ServiceInit) Reset() {
+	*x = ServiceInit{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_engine_trace_trace_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -1031,13 +1342,13 @@ func (x *HTTPTraceEvent) Reset() {
 	}
 }
 
-func (x *HTTPTraceEvent) String() string {
+func (x *ServiceInit) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*HTTPTraceEvent) ProtoMessage() {}
+func (*ServiceInit) ProtoMessage() {}
 
-func (x *HTTPTraceEvent) ProtoReflect() protoreflect.Message {
+func (x *ServiceInit) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_engine_trace_trace_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -1049,178 +1360,222 @@ func (x *HTTPTraceEvent) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use HTTPTraceEvent.ProtoReflect.Descriptor instead.
-func (*HTTPTraceEvent) Descriptor() ([]byte, []int) {
+// Deprecated: Use ServiceInit.ProtoReflect.Descriptor instead.
+func (*ServiceInit) Descriptor() ([]byte, []int) {
 	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{8}
 }
 
-func (x *HTTPTraceEvent) GetCode() HTTPTraceEventCode {
+func (x *ServiceInit) GetGoid() uint64 {
 	if x != nil {
-		return x.Code
+		return x.Goid
 	}
-	return HTTPTraceEventCode_UNKNOWN
+	return 0
 }
 
-func (x *HTTPTraceEvent) GetTime() uint64 {
+func (x *ServiceInit) GetDefLoc() int32 {
 	if x != nil {
-		return x.Time
+		return x.DefLoc
 	}
 	return 0
 }
 
-func (m *HTTPTraceEvent) GetData() isHTTPTraceEvent_Data {
-	if m != nil {
-		return m.Data
+func (x *ServiceInit) GetStartTime() uint64 {
+	if x != nil {
+		return x.StartTime
 	}
-	return nil
+	return 0
 }
 
-func (x *HTTPTraceEvent) GetGetConn() *HTTPGetConnData {
-	if x, ok := x.GetData().(*HTTPTraceEvent_GetConn); ok {
-		return x.GetConn
+func (x *ServiceInit) GetEndTime() uint64 {
+	if x != nil {
+		return x.EndTime
 	}
-	return nil
+	return 0
 }
 
-func (x *HTTPTraceEvent) GetGotConn() *HTTPGotConnData {
-	if x, ok := x.GetData().(*HTTPTraceEvent_GotConn); ok {
-		return x.GotConn
+func (x *ServiceInit) GetService() string {
+	if x != nil {
+		return x.Service
 	}
-	return nil
+	return ""
 }
 
-func (x *HTTPTraceEvent) GetGot_1XxResponse() *HTTPGot1XxResponseData {
-	if x, ok := x.GetData().(*HTTPTraceEvent_Got_1XxResponse); ok {
-		return x.Got_1XxResponse
+func (x *ServiceInit) GetErr() []byte {
+	if x != nil {
+		return x.Err
 	}
 	return nil
 }
 
-func (x *HTTPTraceEvent) GetDnsStart() *HTTPDNSStartData {
-	if x, ok := x.GetData().(*HTTPTraceEvent_DnsStart); ok {
-		return x.DnsStart
+func (x *ServiceInit) GetErrStack() *StackTrace {
+	if x != nil {
+		return x.ErrStack
 	}
 	return nil
 }
 
-func (x *HTTPTraceEvent) GetDnsDone() *HTTPDNSDoneData {
-	if x, ok := x.GetData().(*HTTPTraceEvent_DnsDone); ok {
-		return x.DnsDone
+type CacheOp struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Goid      uint32         `protobuf:"varint,1,opt,name=goid,proto3" json:"goid,omitempty"`
+	DefLoc    int32          `protobuf:"varint,2,opt,name=def_loc,json=defLoc,proto3" json:"def_loc,omitempty"`
+	StartTime uint64         `protobuf:"varint,3,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
+	EndTime   uint64         `protobuf:"varint,4,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
+	Operation string         `protobuf:"bytes,5,opt,name=operation,proto3" json:"operation,omitempty"`
+	Keys      []string       `protobuf:"bytes,6,rep,name=keys,proto3" json:"keys,omitempty"`
+	Inputs    [][]byte       `protobuf:"bytes,7,rep,name=inputs,proto3" json:"inputs,omitempty"`
+	Outputs   [][]byte       `protobuf:"bytes,8,rep,name=outputs,proto3" json:"outputs,omitempty"`
+	Stack     *StackTrace    `protobuf:"bytes,9,opt,name=stack,proto3" json:"stack,omitempty"` // null if unavailable
+	Err       []byte         `protobuf:"bytes,10,opt,name=err,proto3" json:"err,omitempty"`    // set iff result == ERR
+	Write     bool           `protobuf:"varint,11,opt,name=write,proto3" json:"write,omitempty"`
+	Result    CacheOp_Result `protobuf:"varint,12,opt,name=result,proto3,enum=encore.engine.trace.CacheOp_Result" json:"result,omitempty"`
+}
+
+func (x *CacheOp) Reset() {
+	*x = CacheOp{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
 	}
-	return nil
 }
 
-func (x *HTTPTraceEvent) GetConnectStart() *HTTPConnectStartData {
-	if x, ok := x.GetData().(*HTTPTraceEvent_ConnectStart); ok {
-		return x.ConnectStart
-	}
-	return nil
+func (x *CacheOp) String() string {
+	return protoimpl.X.MessageStringOf(x)
 }
 
-func (x *HTTPTraceEvent) GetConnectDone() *HTTPConnectDoneData {
-	if x, ok := x.GetData().(*HTTPTraceEvent_ConnectDone); ok {
-		return x.ConnectDone
+func (*CacheOp) ProtoMessage() {}
+
+func (x *CacheOp) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
 	}
-	return nil
+	return mi.MessageOf(x)
 }
 
-func (x *HTTPTraceEvent) GetTlsHandshakeDone() *HTTPTLSHandshakeDoneData {
-	if x, ok := x.GetData().(*HTTPTraceEvent_TlsHandshakeDone); ok {
-		return x.TlsHandshakeDone
-	}
-	return nil
+// Deprecated: Use CacheOp.ProtoReflect.Descriptor instead.
+func (*CacheOp) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{9}
 }
 
-func (x *HTTPTraceEvent) GetWroteRequest() *HTTPWroteRequestData {
-	if x, ok := x.GetData().(*HTTPTraceEvent_WroteRequest); ok {
-		return x.WroteRequest
+func (x *CacheOp) GetGoid() uint32 {
+	if x != nil {
+		return x.Goid
 	}
-	return nil
+	return 0
 }
 
-type isHTTPTraceEvent_Data interface {
-	isHTTPTraceEvent_Data()
+func (x *CacheOp) GetDefLoc() int32 {
+	if x != nil {
+		return x.DefLoc
+	}
+	return 0
 }
 
-type HTTPTraceEvent_GetConn struct {
-	GetConn *HTTPGetConnData `protobuf:"bytes,3,opt,name=get_conn,json=getConn,proto3,oneof"`
+func (x *CacheOp) GetStartTime() uint64 {
+	if x != nil {
+		return x.StartTime
+	}
+	return 0
 }
 
-type HTTPTraceEvent_GotConn struct {
-	GotConn *HTTPGotConnData `protobuf:"bytes,4,opt,name=got_conn,json=gotConn,proto3,oneof"`
+func (x *CacheOp) GetEndTime() uint64 {
+	if x != nil {
+		return x.EndTime
+	}
+	return 0
 }
 
-type HTTPTraceEvent_Got_1XxResponse struct {
-	Got_1XxResponse *HTTPGot1XxResponseData `protobuf:"bytes,5,opt,name=got_1xx_response,json=got1xxResponse,proto3,oneof"`
+func (x *CacheOp) GetOperation() string {
+	if x != nil {
+		return x.Operation
+	}
+	return ""
 }
 
-type HTTPTraceEvent_DnsStart struct {
-	DnsStart *HTTPDNSStartData `protobuf:"bytes,6,opt,name=dns_start,json=dnsStart,proto3,oneof"`
+func (x *CacheOp) GetKeys() []string {
+	if x != nil {
+		return x.Keys
+	}
+	return nil
 }
 
-type HTTPTraceEvent_DnsDone struct {
-	DnsDone *HTTPDNSDoneData `protobuf:"bytes,7,opt,name=dns_done,json=dnsDone,proto3,oneof"`
+func (x *CacheOp) GetInputs() [][]byte {
+	if x != nil {
+		return x.Inputs
+	}
+	return nil
 }
 
-type HTTPTraceEvent_ConnectStart struct {
-	ConnectStart *HTTPConnectStartData `protobuf:"bytes,8,opt,name=connect_start,json=connectStart,proto3,oneof"`
+func (x *CacheOp) GetOutputs() [][]byte {
+	if x != nil {
+		return x.Outputs
+	}
+	return nil
 }
 
-type HTTPTraceEvent_ConnectDone struct {
-	ConnectDone *HTTPConnectDoneData `protobuf:"bytes,9,opt,name=connect_done,json=connectDone,proto3,oneof"`
+func (x *CacheOp) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
 }
 
-type HTTPTraceEvent_TlsHandshakeDone struct {
-	TlsHandshakeDone *HTTPTLSHandshakeDoneData `protobuf:"bytes,10,opt,name=tls_handshake_done,json=tlsHandshakeDone,proto3,oneof"`
+func (x *CacheOp) GetErr() []byte {
+	if x != nil {
+		return x.Err
+	}
+	return nil
 }
 
-type HTTPTraceEvent_WroteRequest struct {
-	WroteRequest *HTTPWroteRequestData `protobuf:"bytes,11,opt,name=wrote_request,json=wroteRequest,proto3,oneof"`
+func (x *CacheOp) GetWrite() bool {
+	if x != nil {
+		return x.Write
+	}
+	return false
 }
 
-func (*HTTPTraceEvent_GetConn) isHTTPTraceEvent_Data() {}
-
-func (*HTTPTraceEvent_GotConn) isHTTPTraceEvent_Data() {}
-
-func (*HTTPTraceEvent_Got_1XxResponse) isHTTPTraceEvent_Data() {}
-
-func (*HTTPTraceEvent_DnsStart) isHTTPTraceEvent_Data() {}
-
-func (*HTTPTraceEvent_DnsDone) isHTTPTraceEvent_Data() {}
-
-func (*HTTPTraceEvent_ConnectStart) isHTTPTraceEvent_Data() {}
-
-func (*HTTPTraceEvent_ConnectDone) isHTTPTraceEvent_Data() {}
-
-func (*HTTPTraceEvent_TlsHandshakeDone) isHTTPTraceEvent_Data() {}
-
-func (*HTTPTraceEvent_WroteRequest) isHTTPTraceEvent_Data() {}
+func (x *CacheOp) GetResult() CacheOp_Result {
+	if x != nil {
+		return x.Result
+	}
+	return CacheOp_UNKNOWN
+}
 
-type HTTPGetConnData struct {
+type BodyStream struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	HostPort string `protobuf:"bytes,1,opt,name=host_port,json=hostPort,proto3" json:"host_port,omitempty"`
+	IsResponse bool   `protobuf:"varint,1,opt,name=is_response,json=isResponse,proto3" json:"is_response,omitempty"`
+	Overflowed bool   `protobuf:"varint,2,opt,name=overflowed,proto3" json:"overflowed,omitempty"`
+	Data       []byte `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"`
 }
 
-func (x *HTTPGetConnData) Reset() {
-	*x = HTTPGetConnData{}
+func (x *BodyStream) Reset() {
+	*x = BodyStream{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_engine_trace_trace_proto_msgTypes[9]
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *HTTPGetConnData) String() string {
+func (x *BodyStream) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*HTTPGetConnData) ProtoMessage() {}
+func (*BodyStream) ProtoMessage() {}
 
-func (x *HTTPGetConnData) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_engine_trace_trace_proto_msgTypes[9]
+func (x *BodyStream) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1231,45 +1586,734 @@ func (x *HTTPGetConnData) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use HTTPGetConnData.ProtoReflect.Descriptor instead.
-func (*HTTPGetConnData) Descriptor() ([]byte, []int) {
-	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{9}
+// Deprecated: Use BodyStream.ProtoReflect.Descriptor instead.
+func (*BodyStream) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{10}
 }
 
-func (x *HTTPGetConnData) GetHostPort() string {
+func (x *BodyStream) GetIsResponse() bool {
 	if x != nil {
-		return x.HostPort
+		return x.IsResponse
 	}
-	return ""
+	return false
 }
 
-type HTTPGotConnData struct {
+func (x *BodyStream) GetOverflowed() bool {
+	if x != nil {
+		return x.Overflowed
+	}
+	return false
+}
+
+func (x *BodyStream) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+type HTTPCall struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Reused         bool  `protobuf:"varint,1,opt,name=reused,proto3" json:"reused,omitempty"`
-	WasIdle        bool  `protobuf:"varint,2,opt,name=was_idle,json=wasIdle,proto3" json:"was_idle,omitempty"`
-	IdleDurationNs int64 `protobuf:"varint,3,opt,name=idle_duration_ns,json=idleDurationNs,proto3" json:"idle_duration_ns,omitempty"`
-}
-
-func (x *HTTPGotConnData) Reset() {
+	SpanId         uint64            `protobuf:"varint,1,opt,name=span_id,json=spanId,proto3" json:"span_id,omitempty"`
+	Goid           uint32            `protobuf:"varint,2,opt,name=goid,proto3" json:"goid,omitempty"`
+	StartTime      uint64            `protobuf:"varint,3,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
+	EndTime        uint64            `protobuf:"varint,4,opt,name=end_time,json=endTime,proto3" json:"end_time,omitempty"`
+	Method         string            `protobuf:"bytes,5,opt,name=method,proto3" json:"method,omitempty"`
+	Url            string            `protobuf:"bytes,6,opt,name=url,proto3" json:"url,omitempty"`
+	StatusCode     uint32            `protobuf:"varint,7,opt,name=status_code,json=statusCode,proto3" json:"status_code,omitempty"`
+	Err            []byte            `protobuf:"bytes,8,opt,name=err,proto3" json:"err,omitempty"`
+	BodyClosedTime uint64            `protobuf:"varint,9,opt,name=body_closed_time,json=bodyClosedTime,proto3" json:"body_closed_time,omitempty"`
+	Events         []*HTTPTraceEvent `protobuf:"bytes,10,rep,name=events,proto3" json:"events,omitempty"`
+}
+
+func (x *HTTPCall) Reset() {
+	*x = HTTPCall{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPCall) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPCall) ProtoMessage() {}
+
+func (x *HTTPCall) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPCall.ProtoReflect.Descriptor instead.
+func (*HTTPCall) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *HTTPCall) GetSpanId() uint64 {
+	if x != nil {
+		return x.SpanId
+	}
+	return 0
+}
+
+func (x *HTTPCall) GetGoid() uint32 {
+	if x != nil {
+		return x.Goid
+	}
+	return 0
+}
+
+func (x *HTTPCall) GetStartTime() uint64 {
+	if x != nil {
+		return x.StartTime
+	}
+	return 0
+}
+
+func (x *HTTPCall) GetEndTime() uint64 {
+	if x != nil {
+		return x.EndTime
+	}
+	return 0
+}
+
+func (x *HTTPCall) GetMethod() string {
+	if x != nil {
+		return x.Method
+	}
+	return ""
+}
+
+func (x *HTTPCall) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+func (x *HTTPCall) GetStatusCode() uint32 {
+	if x != nil {
+		return x.StatusCode
+	}
+	return 0
+}
+
+func (x *HTTPCall) GetErr() []byte {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+func (x *HTTPCall) GetBodyClosedTime() uint64 {
+	if x != nil {
+		return x.BodyClosedTime
+	}
+	return 0
+}
+
+func (x *HTTPCall) GetEvents() []*HTTPTraceEvent {
+	if x != nil {
+		return x.Events
+	}
+	return nil
+}
+
+type HTTPTraceEvent struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Code HTTPTraceEventCode `protobuf:"varint,1,opt,name=code,proto3,enum=encore.engine.trace.HTTPTraceEventCode" json:"code,omitempty"`
+	Time uint64             `protobuf:"varint,2,opt,name=time,proto3" json:"time,omitempty"`
+	// Types that are assignable to Data:
+	//
+	//	*HTTPTraceEvent_GetConn
+	//	*HTTPTraceEvent_GotConn
+	//	*HTTPTraceEvent_Got_1XxResponse
+	//	*HTTPTraceEvent_DnsStart
+	//	*HTTPTraceEvent_DnsDone
+	//	*HTTPTraceEvent_ConnectStart
+	//	*HTTPTraceEvent_ConnectDone
+	//	*HTTPTraceEvent_TlsHandshakeDone
+	//	*HTTPTraceEvent_WroteRequest
+	Data isHTTPTraceEvent_Data `protobuf_oneof:"data"`
+}
+
+func (x *HTTPTraceEvent) Reset() {
+	*x = HTTPTraceEvent{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPTraceEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPTraceEvent) ProtoMessage() {}
+
+func (x *HTTPTraceEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPTraceEvent.ProtoReflect.Descriptor instead.
+func (*HTTPTraceEvent) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *HTTPTraceEvent) GetCode() HTTPTraceEventCode {
+	if x != nil {
+		return x.Code
+	}
+	return HTTPTraceEventCode_UNKNOWN
+}
+
+func (x *HTTPTraceEvent) GetTime() uint64 {
+	if x != nil {
+		return x.Time
+	}
+	return 0
+}
+
+func (m *HTTPTraceEvent) GetData() isHTTPTraceEvent_Data {
+	if m != nil {
+		return m.Data
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetGetConn() *HTTPGetConnData {
+	if x, ok := x.GetData().(*HTTPTraceEvent_GetConn); ok {
+		return x.GetConn
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetGotConn() *HTTPGotConnData {
+	if x, ok := x.GetData().(*HTTPTraceEvent_GotConn); ok {
+		return x.GotConn
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetGot_1XxResponse() *HTTPGot1XxResponseData {
+	if x, ok := x.GetData().(*HTTPTraceEvent_Got_1XxResponse); ok {
+		return x.Got_1XxResponse
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetDnsStart() *HTTPDNSStartData {
+	if x, ok := x.GetData().(*HTTPTraceEvent_DnsStart); ok {
+		return x.DnsStart
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetDnsDone() *HTTPDNSDoneData {
+	if x, ok := x.GetData().(*HTTPTraceEvent_DnsDone); ok {
+		return x.DnsDone
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetConnectStart() *HTTPConnectStartData {
+	if x, ok := x.GetData().(*HTTPTraceEvent_ConnectStart); ok {
+		return x.ConnectStart
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetConnectDone() *HTTPConnectDoneData {
+	if x, ok := x.GetData().(*HTTPTraceEvent_ConnectDone); ok {
+		return x.ConnectDone
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetTlsHandshakeDone() *HTTPTLSHandshakeDoneData {
+	if x, ok := x.GetData().(*HTTPTraceEvent_TlsHandshakeDone); ok {
+		return x.TlsHandshakeDone
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetWroteRequest() *HTTPWroteRequestData {
+	if x, ok := x.GetData().(*HTTPTraceEvent_WroteRequest); ok {
+		return x.WroteRequest
+	}
+	return nil
+}
+
+type isHTTPTraceEvent_Data interface {
+	isHTTPTraceEvent_Data()
+}
+
+type HTTPTraceEvent_GetConn struct {
+	GetConn *HTTPGetConnData `protobuf:"bytes,3,opt,name=get_conn,json=getConn,proto3,oneof"`
+}
+
+type HTTPTraceEvent_GotConn struct {
+	GotConn *HTTPGotConnData `protobuf:"bytes,4,opt,name=got_conn,json=gotConn,proto3,oneof"`
+}
+
+type HTTPTraceEvent_Got_1XxResponse struct {
+	Got_1XxResponse *HTTPGot1XxResponseData `protobuf:"bytes,5,opt,name=got_1xx_response,json=got1xxResponse,proto3,oneof"`
+}
+
+type HTTPTraceEvent_DnsStart struct {
+	DnsStart *HTTPDNSStartData `protobuf:"bytes,6,opt,name=dns_start,json=dnsStart,proto3,oneof"`
+}
+
+type HTTPTraceEvent_DnsDone struct {
+	DnsDone *HTTPDNSDoneData `protobuf:"bytes,7,opt,name=dns_done,json=dnsDone,proto3,oneof"`
+}
+
+type HTTPTraceEvent_ConnectStart struct {
+	ConnectStart *HTTPConnectStartData `protobuf:"bytes,8,opt,name=connect_start,json=connectStart,proto3,oneof"`
+}
+
+type HTTPTraceEvent_ConnectDone struct {
+	ConnectDone *HTTPConnectDoneData `protobuf:"bytes,9,opt,name=connect_done,json=connectDone,proto3,oneof"`
+}
+
+type HTTPTraceEvent_TlsHandshakeDone struct {
+	TlsHandshakeDone *HTTPTLSHandshakeDoneData `protobuf:"bytes,10,opt,name=tls_handshake_done,json=tlsHandshakeDone,proto3,oneof"`
+}
+
+type HTTPTraceEvent_WroteRequest struct {
+	WroteRequest *HTTPWroteRequestData `protobuf:"bytes,11,opt,name=wrote_request,json=wroteRequest,proto3,oneof"`
+}
+
+func (*HTTPTraceEvent_GetConn) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_GotConn) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_Got_1XxResponse) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_DnsStart) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_DnsDone) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_ConnectStart) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_ConnectDone) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_TlsHandshakeDone) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_WroteRequest) isHTTPTraceEvent_Data() {}
+
+type HTTPGetConnData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	HostPort string `protobuf:"bytes,1,opt,name=host_port,json=hostPort,proto3" json:"host_port,omitempty"`
+}
+
+func (x *HTTPGetConnData) Reset() {
+	*x = HTTPGetConnData{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPGetConnData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPGetConnData) ProtoMessage() {}
+
+func (x *HTTPGetConnData) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPGetConnData.ProtoReflect.Descriptor instead.
+func (*HTTPGetConnData) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *HTTPGetConnData) GetHostPort() string {
+	if x != nil {
+		return x.HostPort
+	}
+	return ""
+}
+
+type HTTPGotConnData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Reused         bool  `protobuf:"varint,1,opt,name=reused,proto3" json:"reused,omitempty"`
+	WasIdle        bool  `protobuf:"varint,2,opt,name=was_idle,json=wasIdle,proto3" json:"was_idle,omitempty"`
+	IdleDurationNs int64 `protobuf:"varint,3,opt,name=idle_duration_ns,json=idleDurationNs,proto3" json:"idle_duration_ns,omitempty"`
+}
+
+func (x *HTTPGotConnData) Reset() {
 	*x = HTTPGotConnData{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_engine_trace_trace_proto_msgTypes[10]
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPGotConnData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPGotConnData) ProtoMessage() {}
+
+func (x *HTTPGotConnData) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPGotConnData.ProtoReflect.Descriptor instead.
+func (*HTTPGotConnData) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *HTTPGotConnData) GetReused() bool {
+	if x != nil {
+		return x.Reused
+	}
+	return false
+}
+
+func (x *HTTPGotConnData) GetWasIdle() bool {
+	if x != nil {
+		return x.WasIdle
+	}
+	return false
+}
+
+func (x *HTTPGotConnData) GetIdleDurationNs() int64 {
+	if x != nil {
+		return x.IdleDurationNs
+	}
+	return 0
+}
+
+type HTTPGot1XxResponseData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Code int32 `protobuf:"varint,1,opt,name=code,proto3" json:"code,omitempty"`
+}
+
+func (x *HTTPGot1XxResponseData) Reset() {
+	*x = HTTPGot1XxResponseData{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPGot1XxResponseData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPGot1XxResponseData) ProtoMessage() {}
+
+func (x *HTTPGot1XxResponseData) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPGot1XxResponseData.ProtoReflect.Descriptor instead.
+func (*HTTPGot1XxResponseData) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *HTTPGot1XxResponseData) GetCode() int32 {
+	if x != nil {
+		return x.Code
+	}
+	return 0
+}
+
+type HTTPDNSStartData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+}
+
+func (x *HTTPDNSStartData) Reset() {
+	*x = HTTPDNSStartData{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPDNSStartData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPDNSStartData) ProtoMessage() {}
+
+func (x *HTTPDNSStartData) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPDNSStartData.ProtoReflect.Descriptor instead.
+func (*HTTPDNSStartData) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *HTTPDNSStartData) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+type HTTPDNSDoneData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err   []byte     `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
+	Addrs []*DNSAddr `protobuf:"bytes,2,rep,name=addrs,proto3" json:"addrs,omitempty"`
+}
+
+func (x *HTTPDNSDoneData) Reset() {
+	*x = HTTPDNSDoneData{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPDNSDoneData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPDNSDoneData) ProtoMessage() {}
+
+func (x *HTTPDNSDoneData) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPDNSDoneData.ProtoReflect.Descriptor instead.
+func (*HTTPDNSDoneData) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *HTTPDNSDoneData) GetErr() []byte {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+func (x *HTTPDNSDoneData) GetAddrs() []*DNSAddr {
+	if x != nil {
+		return x.Addrs
+	}
+	return nil
+}
+
+type DNSAddr struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Ip []byte `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
+}
+
+func (x *DNSAddr) Reset() {
+	*x = DNSAddr{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DNSAddr) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DNSAddr) ProtoMessage() {}
+
+func (x *DNSAddr) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DNSAddr.ProtoReflect.Descriptor instead.
+func (*DNSAddr) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *DNSAddr) GetIp() []byte {
+	if x != nil {
+		return x.Ip
+	}
+	return nil
+}
+
+type HTTPConnectStartData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Network string `protobuf:"bytes,1,opt,name=network,proto3" json:"network,omitempty"`
+	Addr    string `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
+}
+
+func (x *HTTPConnectStartData) Reset() {
+	*x = HTTPConnectStartData{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPConnectStartData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPConnectStartData) ProtoMessage() {}
+
+func (x *HTTPConnectStartData) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPConnectStartData.ProtoReflect.Descriptor instead.
+func (*HTTPConnectStartData) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *HTTPConnectStartData) GetNetwork() string {
+	if x != nil {
+		return x.Network
+	}
+	return ""
+}
+
+func (x *HTTPConnectStartData) GetAddr() string {
+	if x != nil {
+		return x.Addr
+	}
+	return ""
+}
+
+type HTTPConnectDoneData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Network string `protobuf:"bytes,1,opt,name=network,proto3" json:"network,omitempty"`
+	Addr    string `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
+	Err     []byte `protobuf:"bytes,3,opt,name=err,proto3" json:"err,omitempty"`
+}
+
+func (x *HTTPConnectDoneData) Reset() {
+	*x = HTTPConnectDoneData{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[20]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *HTTPGotConnData) String() string {
+func (x *HTTPConnectDoneData) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*HTTPGotConnData) ProtoMessage() {}
+func (*HTTPConnectDoneData) ProtoMessage() {}
 
-func (x *HTTPGotConnData) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_engine_trace_trace_proto_msgTypes[10]
+func (x *HTTPConnectDoneData) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[20]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1280,57 +2324,61 @@ func (x *HTTPGotConnData) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use HTTPGotConnData.ProtoReflect.Descriptor instead.
-func (*HTTPGotConnData) Descriptor() ([]byte, []int) {
-	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{10}
+// Deprecated: Use HTTPConnectDoneData.ProtoReflect.Descriptor instead.
+func (*HTTPConnectDoneData) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{20}
 }
 
-func (x *HTTPGotConnData) GetReused() bool {
+func (x *HTTPConnectDoneData) GetNetwork() string {
 	if x != nil {
-		return x.Reused
+		return x.Network
 	}
-	return false
+	return ""
 }
 
-func (x *HTTPGotConnData) GetWasIdle() bool {
+func (x *HTTPConnectDoneData) GetAddr() string {
 	if x != nil {
-		return x.WasIdle
+		return x.Addr
 	}
-	return false
+	return ""
 }
 
-func (x *HTTPGotConnData) GetIdleDurationNs() int64 {
+func (x *HTTPConnectDoneData) GetErr() []byte {
 	if x != nil {
-		return x.IdleDurationNs
+		return x.Err
 	}
-	return 0
+	return nil
 }
 
-type HTTPGot1XxResponseData struct {
+type HTTPTLSHandshakeDoneData struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Code int32 `protobuf:"varint,1,opt,name=code,proto3" json:"code,omitempty"`
+	Err                []byte `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
+	TlsVersion         uint32 `protobuf:"varint,2,opt,name=tls_version,json=tlsVersion,proto3" json:"tls_version,omitempty"`
+	CipherSuite        uint32 `protobuf:"varint,3,opt,name=cipher_suite,json=cipherSuite,proto3" json:"cipher_suite,omitempty"`
+	ServerName         string `protobuf:"bytes,4,opt,name=server_name,json=serverName,proto3" json:"server_name,omitempty"`
+	NegotiatedProtocol string `protobuf:"bytes,5,opt,name=negotiated_protocol,json=negotiatedProtocol,proto3" json:"negotiated_protocol,omitempty"`
 }
 
-func (x *HTTPGot1XxResponseData) Reset() {
-	*x = HTTPGot1XxResponseData{}
+func (x *HTTPTLSHandshakeDoneData) Reset() {
+	*x = HTTPTLSHandshakeDoneData{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_engine_trace_trace_proto_msgTypes[11]
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[21]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *HTTPGot1XxResponseData) String() string {
+func (x *HTTPTLSHandshakeDoneData) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*HTTPGot1XxResponseData) ProtoMessage() {}
+func (*HTTPTLSHandshakeDoneData) ProtoMessage() {}
 
-func (x *HTTPGot1XxResponseData) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_engine_trace_trace_proto_msgTypes[11]
+func (x *HTTPTLSHandshakeDoneData) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[21]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1341,43 +2389,71 @@ func (x *HTTPGot1XxResponseData) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use HTTPGot1XxResponseData.ProtoReflect.Descriptor instead.
-func (*HTTPGot1XxResponseData) Descriptor() ([]byte, []int) {
-	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{11}
+// Deprecated: Use HTTPTLSHandshakeDoneData.ProtoReflect.Descriptor instead.
+func (*HTTPTLSHandshakeDoneData) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{21}
 }
 
-func (x *HTTPGot1XxResponseData) GetCode() int32 {
+func (x *HTTPTLSHandshakeDoneData) GetErr() []byte {
 	if x != nil {
-		return x.Code
+		return x.Err
+	}
+	return nil
+}
+
+func (x *HTTPTLSHandshakeDoneData) GetTlsVersion() uint32 {
+	if x != nil {
+		return x.TlsVersion
 	}
 	return 0
 }
 
-type HTTPDNSStartData struct {
+func (x *HTTPTLSHandshakeDoneData) GetCipherSuite() uint32 {
+	if x != nil {
+		return x.CipherSuite
+	}
+	return 0
+}
+
+func (x *HTTPTLSHandshakeDoneData) GetServerName() string {
+	if x != nil {
+		return x.ServerName
+	}
+	return ""
+}
+
+func (x *HTTPTLSHandshakeDoneData) GetNegotiatedProtocol() string {
+	if x != nil {
+		return x.NegotiatedProtocol
+	}
+	return ""
+}
+
+type HTTPWroteRequestData struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+	Err []byte `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
 }
 
-func (x *HTTPDNSStartData) Reset() {
-	*x = HTTPDNSStartData{}
+func (x *HTTPWroteRequestData) Reset() {
+	*x = HTTPWroteRequestData{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_engine_trace_trace_proto_msgTypes[12]
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[22]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *HTTPDNSStartData) String() string {
+func (x *HTTPWroteRequestData) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*HTTPDNSStartData) ProtoMessage() {}
+func (*HTTPWroteRequestData) ProtoMessage() {}
 
-func (x *HTTPDNSStartData) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_engine_trace_trace_proto_msgTypes[12]
+func (x *HTTPWroteRequestData) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[22]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1388,44 +2464,49 @@ func (x *HTTPDNSStartData) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use HTTPDNSStartData.ProtoReflect.Descriptor instead.
-func (*HTTPDNSStartData) Descriptor() ([]byte, []int) {
-	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{12}
+// Deprecated: Use HTTPWroteRequestData.ProtoReflect.Descriptor instead.
+func (*HTTPWroteRequestData) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{22}
 }
 
-func (x *HTTPDNSStartData) GetHost() string {
+func (x *HTTPWroteRequestData) GetErr() []byte {
 	if x != nil {
-		return x.Host
+		return x.Err
 	}
-	return ""
+	return nil
 }
 
-type HTTPDNSDoneData struct {
+type LogMessage struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Err   []byte     `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
-	Addrs []*DNSAddr `protobuf:"bytes,2,rep,name=addrs,proto3" json:"addrs,omitempty"`
+	SpanId uint64           `protobuf:"varint,1,opt,name=span_id,json=spanId,proto3" json:"span_id,omitempty"`
+	Goid   uint32           `protobuf:"varint,2,opt,name=goid,proto3" json:"goid,omitempty"`
+	Time   uint64           `protobuf:"varint,3,opt,name=time,proto3" json:"time,omitempty"`
+	Level  LogMessage_Level `protobuf:"varint,4,opt,name=level,proto3,enum=encore.engine.trace.LogMessage_Level" json:"level,omitempty"`
+	Msg    string           `protobuf:"bytes,5,opt,name=msg,proto3" json:"msg,omitempty"`
+	Fields []*LogField      `protobuf:"bytes,6,rep,name=fields,proto3" json:"fields,omitempty"`
+	Stack  *StackTrace      `protobuf:"bytes,7,opt,name=stack,proto3" json:"stack,omitempty"` // null if unavailable
 }
 
-func (x *HTTPDNSDoneData) Reset() {
-	*x = HTTPDNSDoneData{}
+func (x *LogMessage) Reset() {
+	*x = LogMessage{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_engine_trace_trace_proto_msgTypes[13]
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[23]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *HTTPDNSDoneData) String() string {
+func (x *LogMessage) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*HTTPDNSDoneData) ProtoMessage() {}
+func (*LogMessage) ProtoMessage() {}
 
-func (x *HTTPDNSDoneData) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_engine_trace_trace_proto_msgTypes[13]
+func (x *LogMessage) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[23]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1436,50 +2517,100 @@ func (x *HTTPDNSDoneData) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use HTTPDNSDoneData.ProtoReflect.Descriptor instead.
-func (*HTTPDNSDoneData) Descriptor() ([]byte, []int) {
-	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{13}
+// Deprecated: Use LogMessage.ProtoReflect.Descriptor instead.
+func (*LogMessage) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{23}
 }
 
-func (x *HTTPDNSDoneData) GetErr() []byte {
+func (x *LogMessage) GetSpanId() uint64 {
 	if x != nil {
-		return x.Err
+		return x.SpanId
+	}
+	return 0
+}
+
+func (x *LogMessage) GetGoid() uint32 {
+	if x != nil {
+		return x.Goid
+	}
+	return 0
+}
+
+func (x *LogMessage) GetTime() uint64 {
+	if x != nil {
+		return x.Time
+	}
+	return 0
+}
+
+func (x *LogMessage) GetLevel() LogMessage_Level {
+	if x != nil {
+		return x.Level
+	}
+	return LogMessage_DEBUG
+}
+
+func (x *LogMessage) GetMsg() string {
+	if x != nil {
+		return x.Msg
+	}
+	return ""
+}
+
+func (x *LogMessage) GetFields() []*LogField {
+	if x != nil {
+		return x.Fields
 	}
 	return nil
 }
 
-func (x *HTTPDNSDoneData) GetAddrs() []*DNSAddr {
+func (x *LogMessage) GetStack() *StackTrace {
 	if x != nil {
-		return x.Addrs
+		return x.Stack
 	}
 	return nil
 }
 
-type DNSAddr struct {
+type LogField struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Ip []byte `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
-}
-
-func (x *DNSAddr) Reset() {
-	*x = DNSAddr{}
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	// Types that are assignable to Value:
+	//
+	//	*LogField_ErrorWithoutStack
+	//	*LogField_ErrorWithStack
+	//	*LogField_Str
+	//	*LogField_Bool
+	//	*LogField_Time
+	//	*LogField_Dur
+	//	*LogField_Uuid
+	//	*LogField_Json
+	//	*LogField_Int
+	//	*LogField_Uint
+	//	*LogField_Float32
+	//	*LogField_Float64
+	Value isLogField_Value `protobuf_oneof:"value"`
+}
+
+func (x *LogField) Reset() {
+	*x = LogField{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_engine_trace_trace_proto_msgTypes[14]
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[24]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *DNSAddr) String() string {
+func (x *LogField) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*DNSAddr) ProtoMessage() {}
+func (*LogField) ProtoMessage() {}
 
-func (x *DNSAddr) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_engine_trace_trace_proto_msgTypes[14]
+func (x *LogField) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[24]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1490,100 +2621,211 @@ func (x *DNSAddr) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use DNSAddr.ProtoReflect.Descriptor instead.
-func (*DNSAddr) Descriptor() ([]byte, []int) {
-	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{14}
+// Deprecated: Use LogField.ProtoReflect.Descriptor instead.
+func (*LogField) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{24}
 }
 
-func (x *DNSAddr) GetIp() []byte {
+func (x *LogField) GetKey() string {
 	if x != nil {
-		return x.Ip
+		return x.Key
+	}
+	return ""
+}
+
+func (m *LogField) GetValue() isLogField_Value {
+	if m != nil {
+		return m.Value
 	}
 	return nil
 }
 
-type HTTPConnectStartData struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *LogField) GetErrorWithoutStack() string {
+	if x, ok := x.GetValue().(*LogField_ErrorWithoutStack); ok {
+		return x.ErrorWithoutStack
+	}
+	return ""
+}
 
-	Network string `protobuf:"bytes,1,opt,name=network,proto3" json:"network,omitempty"`
-	Addr    string `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
+func (x *LogField) GetErrorWithStack() *ErrWithStack {
+	if x, ok := x.GetValue().(*LogField_ErrorWithStack); ok {
+		return x.ErrorWithStack
+	}
+	return nil
 }
 
-func (x *HTTPConnectStartData) Reset() {
-	*x = HTTPConnectStartData{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_engine_trace_trace_proto_msgTypes[15]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+func (x *LogField) GetStr() string {
+	if x, ok := x.GetValue().(*LogField_Str); ok {
+		return x.Str
 	}
+	return ""
 }
 
-func (x *HTTPConnectStartData) String() string {
-	return protoimpl.X.MessageStringOf(x)
+func (x *LogField) GetBool() bool {
+	if x, ok := x.GetValue().(*LogField_Bool); ok {
+		return x.Bool
+	}
+	return false
 }
 
-func (*HTTPConnectStartData) ProtoMessage() {}
+func (x *LogField) GetTime() *timestamppb.Timestamp {
+	if x, ok := x.GetValue().(*LogField_Time); ok {
+		return x.Time
+	}
+	return nil
+}
 
-func (x *HTTPConnectStartData) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_engine_trace_trace_proto_msgTypes[15]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
+func (x *LogField) GetDur() int64 {
+	if x, ok := x.GetValue().(*LogField_Dur); ok {
+		return x.Dur
 	}
-	return mi.MessageOf(x)
+	return 0
+}
+
+func (x *LogField) GetUuid() []byte {
+	if x, ok := x.GetValue().(*LogField_Uuid); ok {
+		return x.Uuid
+	}
+	return nil
+}
+
+func (x *LogField) GetJson() []byte {
+	if x, ok := x.GetValue().(*LogField_Json); ok {
+		return x.Json
+	}
+	return nil
+}
+
+func (x *LogField) GetInt() int64 {
+	if x, ok := x.GetValue().(*LogField_Int); ok {
+		return x.Int
+	}
+	return 0
+}
+
+func (x *LogField) GetUint() uint64 {
+	if x, ok := x.GetValue().(*LogField_Uint); ok {
+		return x.Uint
+	}
+	return 0
+}
+
+func (x *LogField) GetFloat32() float32 {
+	if x, ok := x.GetValue().(*LogField_Float32); ok {
+		return x.Float32
+	}
+	return 0
+}
+
+func (x *LogField) GetFloat64() float64 {
+	if x, ok := x.GetValue().(*LogField_Float64); ok {
+		return x.Float64
+	}
+	return 0
+}
+
+type isLogField_Value interface {
+	isLogField_Value()
+}
+
+type LogField_ErrorWithoutStack struct {
+	ErrorWithoutStack string `protobuf:"bytes,2,opt,name=error_without_stack,json=errorWithoutStack,proto3,oneof"` // deprecated: use error_with_stack
+}
+
+type LogField_ErrorWithStack struct {
+	ErrorWithStack *ErrWithStack `protobuf:"bytes,13,opt,name=error_with_stack,json=errorWithStack,proto3,oneof"`
+}
+
+type LogField_Str struct {
+	Str string `protobuf:"bytes,3,opt,name=str,proto3,oneof"`
+}
+
+type LogField_Bool struct {
+	Bool bool `protobuf:"varint,4,opt,name=bool,proto3,oneof"`
+}
+
+type LogField_Time struct {
+	Time *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=time,proto3,oneof"`
 }
 
-// Deprecated: Use HTTPConnectStartData.ProtoReflect.Descriptor instead.
-func (*HTTPConnectStartData) Descriptor() ([]byte, []int) {
-	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{15}
+type LogField_Dur struct {
+	Dur int64 `protobuf:"varint,6,opt,name=dur,proto3,oneof"`
 }
 
-func (x *HTTPConnectStartData) GetNetwork() string {
-	if x != nil {
-		return x.Network
-	}
-	return ""
+type LogField_Uuid struct {
+	Uuid []byte `protobuf:"bytes,7,opt,name=uuid,proto3,oneof"`
 }
 
-func (x *HTTPConnectStartData) GetAddr() string {
-	if x != nil {
-		return x.Addr
-	}
-	return ""
+type LogField_Json struct {
+	Json []byte `protobuf:"bytes,8,opt,name=json,proto3,oneof"`
 }
 
-type HTTPConnectDoneData struct {
+type LogField_Int struct {
+	Int int64 `protobuf:"varint,9,opt,name=int,proto3,oneof"`
+}
+
+type LogField_Uint struct {
+	Uint uint64 `protobuf:"varint,10,opt,name=uint,proto3,oneof"`
+}
+
+type LogField_Float32 struct {
+	Float32 float32 `protobuf:"fixed32,11,opt,name=float32,proto3,oneof"`
+}
+
+type LogField_Float64 struct {
+	Float64 float64 `protobuf:"fixed64,12,opt,name=float64,proto3,oneof"`
+}
+
+func (*LogField_ErrorWithoutStack) isLogField_Value() {}
+
+func (*LogField_ErrorWithStack) isLogField_Value() {}
+
+func (*LogField_Str) isLogField_Value() {}
+
+func (*LogField_Bool) isLogField_Value() {}
+
+func (*LogField_Time) isLogField_Value() {}
+
+func (*LogField_Dur) isLogField_Value() {}
+
+func (*LogField_Uuid) isLogField_Value() {}
+
+func (*LogField_Json) isLogField_Value() {}
+
+func (*LogField_Int) isLogField_Value() {}
+
+func (*LogField_Uint) isLogField_Value() {}
+
+func (*LogField_Float32) isLogField_Value() {}
+
+func (*LogField_Float64) isLogField_Value() {}
+
+type ErrWithStack struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Network string `protobuf:"bytes,1,opt,name=network,proto3" json:"network,omitempty"`
-	Addr    string `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
-	Err     []byte `protobuf:"bytes,3,opt,name=err,proto3" json:"err,omitempty"`
+	Error string      `protobuf:"bytes,1,opt,name=error,proto3" json:"error,omitempty"`
+	Stack *StackTrace `protobuf:"bytes,2,opt,name=stack,proto3" json:"stack,omitempty"`
 }
 
-func (x *HTTPConnectDoneData) Reset() {
-	*x = HTTPConnectDoneData{}
+func (x *ErrWithStack) Reset() {
+	*x = ErrWithStack{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_engine_trace_trace_proto_msgTypes[16]
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[25]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *HTTPConnectDoneData) String() string {
+func (x *ErrWithStack) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*HTTPConnectDoneData) ProtoMessage() {}
+func (*ErrWithStack) ProtoMessage() {}
 
-func (x *HTTPConnectDoneData) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_engine_trace_trace_proto_msgTypes[16]
+func (x *ErrWithStack) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[25]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1594,61 +2836,51 @@ func (x *HTTPConnectDoneData) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use HTTPConnectDoneData.ProtoReflect.Descriptor instead.
-func (*HTTPConnectDoneData) Descriptor() ([]byte, []int) {
-	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{16}
-}
-
-func (x *HTTPConnectDoneData) GetNetwork() string {
-	if x != nil {
-		return x.Network
-	}
-	return ""
+// Deprecated: Use ErrWithStack.ProtoReflect.Descriptor instead.
+func (*ErrWithStack) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{25}
 }
 
-func (x *HTTPConnectDoneData) GetAddr() string {
+func (x *ErrWithStack) GetError() string {
 	if x != nil {
-		return x.Addr
+		return x.Error
 	}
 	return ""
 }
 
-func (x *HTTPConnectDoneData) GetErr() []byte {
+func (x *ErrWithStack) GetStack() *StackTrace {
 	if x != nil {
-		return x.Err
+		return x.Stack
 	}
 	return nil
 }
 
-type HTTPTLSHandshakeDoneData struct {
+type StackTrace struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Err                []byte `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
-	TlsVersion         uint32 `protobuf:"varint,2,opt,name=tls_version,json=tlsVersion,proto3" json:"tls_version,omitempty"`
-	CipherSuite        uint32 `protobuf:"varint,3,opt,name=cipher_suite,json=cipherSuite,proto3" json:"cipher_suite,omitempty"`
-	ServerName         string `protobuf:"bytes,4,opt,name=server_name,json=serverName,proto3" json:"server_name,omitempty"`
-	NegotiatedProtocol string `protobuf:"bytes,5,opt,name=negotiated_protocol,json=negotiatedProtocol,proto3" json:"negotiated_protocol,omitempty"`
+	Pcs    []int64       `protobuf:"varint,1,rep,packed,name=pcs,proto3" json:"pcs,omitempty"`
+	Frames []*StackFrame `protobuf:"bytes,2,rep,name=frames,proto3" json:"frames,omitempty"`
 }
 
-func (x *HTTPTLSHandshakeDoneData) Reset() {
-	*x = HTTPTLSHandshakeDoneData{}
+func (x *StackTrace) Reset() {
+	*x = StackTrace{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_engine_trace_trace_proto_msgTypes[17]
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[26]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *HTTPTLSHandshakeDoneData) String() string {
+func (x *StackTrace) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*HTTPTLSHandshakeDoneData) ProtoMessage() {}
+func (*StackTrace) ProtoMessage() {}
 
-func (x *HTTPTLSHandshakeDoneData) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_engine_trace_trace_proto_msgTypes[17]
+func (x *StackTrace) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[26]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1659,71 +2891,52 @@ func (x *HTTPTLSHandshakeDoneData) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use HTTPTLSHandshakeDoneData.ProtoReflect.Descriptor instead.
-func (*HTTPTLSHandshakeDoneData) Descriptor() ([]byte, []int) {
-	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{17}
+// Deprecated: Use StackTrace.ProtoReflect.Descriptor instead.
+func (*StackTrace) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{26}
 }
 
-func (x *HTTPTLSHandshakeDoneData) GetErr() []byte {
+func (x *StackTrace) GetPcs() []int64 {
 	if x != nil {
-		return x.Err
+		return x.Pcs
 	}
 	return nil
 }
 
-func (x *HTTPTLSHandshakeDoneData) GetTlsVersion() uint32 {
-	if x != nil {
-		return x.TlsVersion
-	}
-	return 0
-}
-
-func (x *HTTPTLSHandshakeDoneData) GetCipherSuite() uint32 {
-	if x != nil {
-		return x.CipherSuite
-	}
-	return 0
-}
-
-func (x *HTTPTLSHandshakeDoneData) GetServerName() string {
-	if x != nil {
-		return x.ServerName
-	}
-	return ""
-}
-
-func (x *HTTPTLSHandshakeDoneData) GetNegotiatedProtocol() string {
+func (x *StackTrace) GetFrames() []*StackFrame {
 	if x != nil {
-		return x.NegotiatedProtocol
+		return x.Frames
 	}
-	return ""
+	return nil
 }
 
-type HTTPWroteRequestData struct {
+type StackFrame struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Err []byte `protobuf:"bytes,1,opt,name=err,proto3" json:"err,omitempty"`
+	Filename string `protobuf:"bytes,1,opt,name=filename,proto3" json:"filename,omitempty"`
+	Func     string `protobuf:"bytes,2,opt,name=func,proto3" json:"func,omitempty"`
+	Line     int32  `protobuf:"varint,3,opt,name=line,proto3" json:"line,omitempty"`
 }
 
-func (x *HTTPWroteRequestData) Reset() {
-	*x = HTTPWroteRequestData{}
+func (x *StackFrame) Reset() {
+	*x = StackFrame{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_engine_trace_trace_proto_msgTypes[18]
+		mi := &file_encore_engine_trace_trace_proto_msgTypes[27]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *HTTPWroteRequestData) String() string {
+func (x *StackFrame) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*HTTPWroteRequestData) ProtoMessage() {}
+func (*StackFrame) ProtoMessage() {}
 
-func (x *HTTPWroteRequestData) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_engine_trace_trace_proto_msgTypes[18]
+func (x *StackFrame) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace_trace_proto_msgTypes[27]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1734,16 +2947,30 @@ func (x *HTTPWroteRequestData) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use HTTPWroteRequestData.ProtoReflect.Descriptor instead.
-func (*HTTPWroteRequestData) Descriptor() ([]byte, []int) {
-	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{18}
+// Deprecated: Use StackFrame.ProtoReflect.Descriptor instead.
+func (*StackFrame) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace_trace_proto_rawDescGZIP(), []int{27}
 }
 
-func (x *HTTPWroteRequestData) GetErr() []byte {
+func (x *StackFrame) GetFilename() string {
 	if x != nil {
-		return x.Err
+		return x.Filename
 	}
-	return nil
+	return ""
+}
+
+func (x *StackFrame) GetFunc() string {
+	if x != nil {
+		return x.Func
+	}
+	return ""
+}
+
+func (x *StackFrame) GetLine() int32 {
+	if x != nil {
+		return x.Line
+	}
+	return 0
 }
 
 var File_encore_engine_trace_trace_proto protoreflect.FileDescriptor
@@ -1752,83 +2979,171 @@ var file_encore_engine_trace_trace_proto_rawDesc = []byte{
 	0x0a, 0x1f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2f,
 	0x74, 0x72, 0x61, 0x63, 0x65, 0x2f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
 	0x6f, 0x12, 0x13, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65,
-	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x22, 0x2f, 0x0a, 0x07, 0x54, 0x72, 0x61, 0x63, 0x65, 0x49,
-	0x44, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x69, 0x67, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52,
-	0x04, 0x68, 0x69, 0x67, 0x68, 0x12, 0x10, 0x0a, 0x03, 0x6c, 0x6f, 0x77, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x04, 0x52, 0x03, 0x6c, 0x6f, 0x77, 0x22, 0xdf, 0x03, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x37, 0x0a, 0x08, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
+	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x2f, 0x0a, 0x07, 0x54, 0x72, 0x61, 0x63, 0x65,
+	0x49, 0x44, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x69, 0x67, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x04, 0x68, 0x69, 0x67, 0x68, 0x12, 0x10, 0x0a, 0x03, 0x6c, 0x6f, 0x77, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x04, 0x52, 0x03, 0x6c, 0x6f, 0x77, 0x22, 0xa2, 0x0c, 0x0a, 0x07, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x37, 0x0a, 0x08, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x54, 0x72, 0x61,
+	0x63, 0x65, 0x49, 0x44, 0x52, 0x07, 0x74, 0x72, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x17, 0x0a,
+	0x07, 0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06,
+	0x73, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74,
+	0x5f, 0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c,
+	0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x12, 0x44, 0x0a, 0x0f,
+	0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18,
+	0x20, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
 	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x54, 0x72, 0x61, 0x63,
-	0x65, 0x49, 0x44, 0x52, 0x07, 0x74, 0x72, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07,
-	0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73,
-	0x70, 0x61, 0x6e, 0x49, 0x64, 0x12, 0x24, 0x0a, 0x0e, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f,
-	0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c, 0x70,
-	0x61, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x67,
-	0x6f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x12,
-	0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x05, 0x20,
-	0x01, 0x28, 0x04, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x19,
-	0x0a, 0x08, 0x65, 0x6e, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x04,
-	0x52, 0x07, 0x65, 0x6e, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x63, 0x61, 0x6c,
-	0x6c, 0x5f, 0x6c, 0x6f, 0x63, 0x18, 0x07, 0x20, 0x01, 0x28, 0x05, 0x52, 0x07, 0x63, 0x61, 0x6c,
-	0x6c, 0x4c, 0x6f, 0x63, 0x12, 0x17, 0x0a, 0x07, 0x64, 0x65, 0x66, 0x5f, 0x6c, 0x6f, 0x63, 0x18,
-	0x08, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x64, 0x65, 0x66, 0x4c, 0x6f, 0x63, 0x12, 0x16, 0x0a,
-	0x06, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x06, 0x69,
-	0x6e, 0x70, 0x75, 0x74, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x73,
-	0x18, 0x0a, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x07, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x73, 0x12,
-	0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65, 0x72,
-	0x72, 0x12, 0x32, 0x0a, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e,
-	0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x65,
-	0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x69, 0x64, 0x18, 0x0d, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x75, 0x69, 0x64, 0x12, 0x35, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
-	0x0e, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x21, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
-	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x19,
-	0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x07, 0x0a, 0x03, 0x52, 0x50, 0x43, 0x10, 0x00, 0x12,
-	0x08, 0x0a, 0x04, 0x41, 0x55, 0x54, 0x48, 0x10, 0x01, 0x22, 0xa2, 0x02, 0x0a, 0x05, 0x45, 0x76,
-	0x65, 0x6e, 0x74, 0x12, 0x30, 0x0a, 0x03, 0x72, 0x70, 0x63, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65,
-	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x52, 0x50, 0x43, 0x43, 0x61, 0x6c, 0x6c, 0x48, 0x00,
-	0x52, 0x03, 0x72, 0x70, 0x63, 0x12, 0x34, 0x0a, 0x02, 0x74, 0x78, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e,
-	0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x44, 0x42, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x61,
-	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x00, 0x52, 0x02, 0x74, 0x78, 0x12, 0x34, 0x0a, 0x05, 0x71,
-	0x75, 0x65, 0x72, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63,
-	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
-	0x2e, 0x44, 0x42, 0x51, 0x75, 0x65, 0x72, 0x79, 0x48, 0x00, 0x52, 0x05, 0x71, 0x75, 0x65, 0x72,
-	0x79, 0x12, 0x3e, 0x0a, 0x09, 0x67, 0x6f, 0x72, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x65, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
-	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x47, 0x6f, 0x72, 0x6f, 0x75,
-	0x74, 0x69, 0x6e, 0x65, 0x48, 0x00, 0x52, 0x09, 0x67, 0x6f, 0x72, 0x6f, 0x75, 0x74, 0x69, 0x6e,
-	0x65, 0x12, 0x33, 0x0a, 0x04, 0x68, 0x74, 0x74, 0x70, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e,
-	0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x43, 0x61, 0x6c, 0x6c, 0x48, 0x00,
-	0x52, 0x04, 0x68, 0x74, 0x74, 0x70, 0x42, 0x06, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0xb6,
-	0x01, 0x0a, 0x07, 0x52, 0x50, 0x43, 0x43, 0x61, 0x6c, 0x6c, 0x12, 0x17, 0x0a, 0x07, 0x73, 0x70,
-	0x61, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73, 0x70, 0x61,
-	0x6e, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0d, 0x52, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x63, 0x61, 0x6c, 0x6c, 0x5f,
-	0x6c, 0x6f, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x07, 0x63, 0x61, 0x6c, 0x6c, 0x4c,
-	0x6f, 0x63, 0x12, 0x17, 0x0a, 0x07, 0x64, 0x65, 0x66, 0x5f, 0x6c, 0x6f, 0x63, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x05, 0x52, 0x06, 0x64, 0x65, 0x66, 0x4c, 0x6f, 0x63, 0x12, 0x1d, 0x0a, 0x0a, 0x73,
-	0x74, 0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52,
-	0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e,
-	0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x65, 0x6e,
-	0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x07, 0x20, 0x01,
-	0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x22, 0x74, 0x0a, 0x09, 0x47, 0x6f, 0x72, 0x6f, 0x75,
-	0x74, 0x69, 0x6e, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0d, 0x52, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x63, 0x61, 0x6c, 0x6c,
-	0x5f, 0x6c, 0x6f, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x07, 0x63, 0x61, 0x6c, 0x6c,
-	0x4c, 0x6f, 0x63, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d,
+	0x65, 0x49, 0x44, 0x52, 0x0d, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x54, 0x72, 0x61, 0x63, 0x65,
+	0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d,
+	0x52, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f,
+	0x74, 0x69, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72,
+	0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x5f, 0x74, 0x69, 0x6d,
+	0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x65, 0x6e, 0x64, 0x54, 0x69, 0x6d, 0x65,
+	0x12, 0x17, 0x0a, 0x07, 0x64, 0x65, 0x66, 0x5f, 0x6c, 0x6f, 0x63, 0x18, 0x08, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x06, 0x64, 0x65, 0x66, 0x4c, 0x6f, 0x63, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72,
+	0x18, 0x0b, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x12, 0x32, 0x0a, 0x06, 0x65,
+	0x76, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x2e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x12,
+	0x35, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x21, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x54, 0x79, 0x70, 0x65,
+	0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x09, 0x65, 0x72, 0x72, 0x5f, 0x73, 0x74,
+	0x61, 0x63, 0x6b, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e,
+	0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x08, 0x65, 0x72, 0x72, 0x53,
+	0x74, 0x61, 0x63, 0x6b, 0x12, 0x40, 0x0a, 0x0b, 0x70, 0x61, 0x6e, 0x69, 0x63, 0x5f, 0x73, 0x74,
+	0x61, 0x63, 0x6b, 0x18, 0x22, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e,
+	0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x0a, 0x70, 0x61, 0x6e, 0x69,
+	0x63, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x12, 0x24, 0x0a, 0x0e, 0x61, 0x62, 0x73, 0x5f, 0x73, 0x74,
+	0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x10, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c,
+	0x61, 0x62, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x21, 0x0a, 0x0c,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x11, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12,
+	0x23, 0x0a, 0x0d, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x12, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x13, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x4e,
+	0x61, 0x6d, 0x65, 0x12, 0x2b, 0x0a, 0x11, 0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10,
+	0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65,
+	0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x15,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x49, 0x64, 0x12,
+	0x18, 0x0a, 0x07, 0x61, 0x74, 0x74, 0x65, 0x6d, 0x70, 0x74, 0x18, 0x16, 0x20, 0x01, 0x28, 0x0d,
+	0x52, 0x07, 0x61, 0x74, 0x74, 0x65, 0x6d, 0x70, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x70, 0x75, 0x62,
+	0x6c, 0x69, 0x73, 0x68, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x17, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x0b, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06,
+	0x69, 0x6e, 0x70, 0x75, 0x74, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x06, 0x69, 0x6e,
+	0x70, 0x75, 0x74, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x73, 0x18,
+	0x0a, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x07, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x73, 0x12, 0x10,
+	0x0a, 0x03, 0x75, 0x69, 0x64, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x69, 0x64,
+	0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18,
+	0x18, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x68, 0x74, 0x74, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f,
+	0x64, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x19, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x61, 0x74, 0x68, 0x5f, 0x70, 0x61,
+	0x72, 0x61, 0x6d, 0x73, 0x18, 0x1a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x61, 0x74, 0x68,
+	0x50, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x1b, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x0e, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12,
+	0x29, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x70, 0x61, 0x79, 0x6c,
+	0x6f, 0x61, 0x64, 0x18, 0x1c, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x63, 0x0a, 0x13, 0x72, 0x61,
+	0x77, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72,
+	0x73, 0x18, 0x1d, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x33, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x52, 0x61, 0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x11, 0x72, 0x61,
+	0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x12,
+	0x66, 0x0a, 0x14, 0x72, 0x61, 0x77, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f,
+	0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x18, 0x1e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x34, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x52, 0x61, 0x77, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x12, 0x72, 0x61, 0x77, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x65, 0x78, 0x74, 0x65, 0x72,
+	0x6e, 0x61, 0x6c, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x1f,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x49, 0x64, 0x12, 0x36, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72,
+	0x6e, 0x61, 0x6c, 0x5f, 0x63, 0x6f, 0x72, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
+	0x69, 0x64, 0x18, 0x21, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x43, 0x6f, 0x72, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x1a,
+	0x44, 0x0a, 0x16, 0x52, 0x61, 0x77, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x45, 0x0a, 0x17, 0x52, 0x61, 0x77, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x29, 0x0a, 0x04,
+	0x54, 0x79, 0x70, 0x65, 0x12, 0x07, 0x0a, 0x03, 0x52, 0x50, 0x43, 0x10, 0x00, 0x12, 0x08, 0x0a,
+	0x04, 0x41, 0x55, 0x54, 0x48, 0x10, 0x01, 0x12, 0x0e, 0x0a, 0x0a, 0x50, 0x55, 0x42, 0x53, 0x55,
+	0x42, 0x5f, 0x4d, 0x53, 0x47, 0x10, 0x02, 0x4a, 0x04, 0x08, 0x07, 0x10, 0x08, 0x22, 0xe7, 0x04,
+	0x0a, 0x05, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x30, 0x0a, 0x03, 0x72, 0x70, 0x63, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
+	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x52, 0x50, 0x43, 0x43, 0x61,
+	0x6c, 0x6c, 0x48, 0x00, 0x52, 0x03, 0x72, 0x70, 0x63, 0x12, 0x34, 0x0a, 0x02, 0x74, 0x78, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
+	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x44, 0x42, 0x54, 0x72,
+	0x61, 0x6e, 0x73, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x48, 0x00, 0x52, 0x02, 0x74, 0x78, 0x12,
+	0x34, 0x0a, 0x05, 0x71, 0x75, 0x65, 0x72, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74,
+	0x72, 0x61, 0x63, 0x65, 0x2e, 0x44, 0x42, 0x51, 0x75, 0x65, 0x72, 0x79, 0x48, 0x00, 0x52, 0x05,
+	0x71, 0x75, 0x65, 0x72, 0x79, 0x12, 0x3e, 0x0a, 0x09, 0x67, 0x6f, 0x72, 0x6f, 0x75, 0x74, 0x69,
+	0x6e, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x47,
+	0x6f, 0x72, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x65, 0x48, 0x00, 0x52, 0x09, 0x67, 0x6f, 0x72, 0x6f,
+	0x75, 0x74, 0x69, 0x6e, 0x65, 0x12, 0x33, 0x0a, 0x04, 0x68, 0x74, 0x74, 0x70, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67,
+	0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x43, 0x61,
+	0x6c, 0x6c, 0x48, 0x00, 0x52, 0x04, 0x68, 0x74, 0x74, 0x70, 0x12, 0x33, 0x0a, 0x03, 0x6c, 0x6f,
+	0x67, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x4c, 0x6f,
+	0x67, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x48, 0x00, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x12,
+	0x4d, 0x0a, 0x0c, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x65, 0x64, 0x4d, 0x73, 0x67, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
+	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x50, 0x75, 0x62, 0x73,
+	0x75, 0x62, 0x4d, 0x73, 0x67, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x65, 0x64, 0x48, 0x00,
+	0x52, 0x0c, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x65, 0x64, 0x4d, 0x73, 0x67, 0x12, 0x45,
+	0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x6e, 0x69, 0x74, 0x18, 0x08,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
+	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x48, 0x00, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x49, 0x6e, 0x69, 0x74, 0x12, 0x34, 0x0a, 0x05, 0x63, 0x61, 0x63, 0x68, 0x65, 0x18, 0x09,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
+	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x43, 0x61, 0x63, 0x68, 0x65,
+	0x4f, 0x70, 0x48, 0x00, 0x52, 0x05, 0x63, 0x61, 0x63, 0x68, 0x65, 0x12, 0x42, 0x0a, 0x0b, 0x62,
+	0x6f, 0x64, 0x79, 0x5f, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65,
+	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x42, 0x6f, 0x64, 0x79, 0x53, 0x74, 0x72, 0x65, 0x61,
+	0x6d, 0x48, 0x00, 0x52, 0x0a, 0x62, 0x6f, 0x64, 0x79, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x42,
+	0x06, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0xd8, 0x01, 0x0a, 0x07, 0x52, 0x50, 0x43, 0x43,
+	0x61, 0x6c, 0x6c, 0x12, 0x17, 0x0a, 0x07, 0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04,
+	0x67, 0x6f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x67, 0x6f, 0x69, 0x64,
+	0x12, 0x17, 0x0a, 0x07, 0x64, 0x65, 0x66, 0x5f, 0x6c, 0x6f, 0x63, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x06, 0x64, 0x65, 0x66, 0x4c, 0x6f, 0x63, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x73,
+	0x74, 0x61, 0x72, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x5f,
+	0x74, 0x69, 0x6d, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x65, 0x6e, 0x64, 0x54,
+	0x69, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x03, 0x65, 0x72, 0x72, 0x12, 0x35, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x08,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
+	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b,
+	0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x4a, 0x04, 0x08, 0x03,
+	0x10, 0x04, 0x22, 0x5f, 0x0a, 0x09, 0x47, 0x6f, 0x72, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x65, 0x12,
+	0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x67,
+	0x6f, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d,
 	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x54, 0x69,
 	0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x65, 0x6e, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x22, 0xdc, 0x02,
-	0x0a, 0x0d, 0x44, 0x42, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12,
-	0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x67,
-	0x6f, 0x69, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x6c, 0x6f, 0x63,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x08, 0x73, 0x74, 0x61, 0x72, 0x74, 0x4c, 0x6f, 0x63,
-	0x12, 0x17, 0x0a, 0x07, 0x65, 0x6e, 0x64, 0x5f, 0x6c, 0x6f, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x05, 0x52, 0x06, 0x65, 0x6e, 0x64, 0x4c, 0x6f, 0x63, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x65, 0x6e, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x4a, 0x04, 0x08,
+	0x02, 0x10, 0x03, 0x22, 0xb2, 0x03, 0x0a, 0x0d, 0x44, 0x42, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61,
 	0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x73,
 	0x74, 0x61, 0x72, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x5f,
 	0x74, 0x69, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x65, 0x6e, 0x64, 0x54,
@@ -1842,157 +3157,296 @@ var file_encore_engine_trace_trace_proto_rawDesc = []byte{
 	0x69, 0x65, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
 	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e,
 	0x44, 0x42, 0x51, 0x75, 0x65, 0x72, 0x79, 0x52, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73,
+	0x12, 0x40, 0x0a, 0x0b, 0x62, 0x65, 0x67, 0x69, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
+	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x63,
+	0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x0a, 0x62, 0x65, 0x67, 0x69, 0x6e, 0x53, 0x74, 0x61,
+	0x63, 0x6b, 0x12, 0x3c, 0x0a, 0x09, 0x65, 0x6e, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
+	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x63,
+	0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x53, 0x74, 0x61, 0x63, 0x6b,
 	0x22, 0x2a, 0x0a, 0x0e, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x79,
 	0x70, 0x65, 0x12, 0x0c, 0x0a, 0x08, 0x52, 0x4f, 0x4c, 0x4c, 0x42, 0x41, 0x43, 0x4b, 0x10, 0x00,
-	0x12, 0x0a, 0x0a, 0x06, 0x43, 0x4f, 0x4d, 0x4d, 0x49, 0x54, 0x10, 0x01, 0x22, 0x9a, 0x01, 0x0a,
-	0x07, 0x44, 0x42, 0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x12, 0x19, 0x0a, 0x08,
-	0x63, 0x61, 0x6c, 0x6c, 0x5f, 0x6c, 0x6f, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x07,
-	0x63, 0x61, 0x6c, 0x6c, 0x4c, 0x6f, 0x63, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74,
-	0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x73, 0x74, 0x61,
-	0x72, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x5f, 0x74, 0x69,
-	0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x65, 0x6e, 0x64, 0x54, 0x69, 0x6d,
-	0x65, 0x12, 0x14, 0x0a, 0x05, 0x71, 0x75, 0x65, 0x72, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x05, 0x71, 0x75, 0x65, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x22, 0xb5, 0x02, 0x0a, 0x08, 0x48, 0x54,
-	0x54, 0x50, 0x43, 0x61, 0x6c, 0x6c, 0x12, 0x17, 0x0a, 0x07, 0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x12,
-	0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x67,
-	0x6f, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d,
-	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x54, 0x69,
-	0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x65, 0x6e, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x16, 0x0a,
-	0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d,
-	0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x06, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x74, 0x61, 0x74, 0x75,
-	0x73, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x73, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18,
-	0x08, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x12, 0x28, 0x0a, 0x10, 0x62, 0x6f,
-	0x64, 0x79, 0x5f, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x09,
-	0x20, 0x01, 0x28, 0x04, 0x52, 0x0e, 0x62, 0x6f, 0x64, 0x79, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x64,
-	0x54, 0x69, 0x6d, 0x65, 0x12, 0x3b, 0x0a, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x0a,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
-	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x54,
-	0x72, 0x61, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74,
-	0x73, 0x22, 0xa3, 0x06, 0x0a, 0x0e, 0x48, 0x54, 0x54, 0x50, 0x54, 0x72, 0x61, 0x63, 0x65, 0x45,
-	0x76, 0x65, 0x6e, 0x74, 0x12, 0x3b, 0x0a, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x27, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69,
-	0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x54, 0x72, 0x61,
-	0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x64, 0x65, 0x52, 0x04, 0x63, 0x6f, 0x64,
-	0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52,
-	0x04, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x41, 0x0a, 0x08, 0x67, 0x65, 0x74, 0x5f, 0x63, 0x6f, 0x6e,
-	0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
-	0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54,
-	0x54, 0x50, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52,
-	0x07, 0x67, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x12, 0x41, 0x0a, 0x08, 0x67, 0x6f, 0x74, 0x5f,
-	0x63, 0x6f, 0x6e, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63,
-	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
-	0x2e, 0x48, 0x54, 0x54, 0x50, 0x47, 0x6f, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x44, 0x61, 0x74, 0x61,
-	0x48, 0x00, 0x52, 0x07, 0x67, 0x6f, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x12, 0x57, 0x0a, 0x10, 0x67,
-	0x6f, 0x74, 0x5f, 0x31, 0x78, 0x78, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18,
-	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
-	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50,
-	0x47, 0x6f, 0x74, 0x31, 0x78, 0x78, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x44, 0x61,
-	0x74, 0x61, 0x48, 0x00, 0x52, 0x0e, 0x67, 0x6f, 0x74, 0x31, 0x78, 0x78, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x44, 0x0a, 0x09, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x72,
-	0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
-	0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54,
-	0x54, 0x50, 0x44, 0x4e, 0x53, 0x53, 0x74, 0x61, 0x72, 0x74, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00,
-	0x52, 0x08, 0x64, 0x6e, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x41, 0x0a, 0x08, 0x64, 0x6e,
-	0x73, 0x5f, 0x64, 0x6f, 0x6e, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65,
+	0x12, 0x0a, 0x0a, 0x06, 0x43, 0x4f, 0x4d, 0x4d, 0x49, 0x54, 0x10, 0x01, 0x4a, 0x04, 0x08, 0x02,
+	0x10, 0x03, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x04, 0x22, 0xbc, 0x01, 0x0a, 0x07, 0x44, 0x42, 0x51,
+	0x75, 0x65, 0x72, 0x79, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0d, 0x52, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72,
+	0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x73, 0x74,
+	0x61, 0x72, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x5f, 0x74,
+	0x69, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x65, 0x6e, 0x64, 0x54, 0x69,
+	0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x71, 0x75, 0x65, 0x72, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x05, 0x71, 0x75, 0x65, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x12, 0x35, 0x0a, 0x05, 0x73, 0x74,
+	0x61, 0x63, 0x6b, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e,
+	0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x63,
+	0x6b, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x22, 0xfa, 0x01, 0x0a, 0x12, 0x50, 0x75, 0x62, 0x73,
+	0x75, 0x62, 0x4d, 0x73, 0x67, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x65, 0x64, 0x12, 0x12,
+	0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x67, 0x6f,
+	0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x54, 0x69, 0x6d,
+	0x65, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x04, 0x52, 0x07, 0x65, 0x6e, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x74, 0x6f, 0x70, 0x69, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x70,
+	0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x06, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x1d, 0x0a, 0x0a,
+	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x49, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x65,
+	0x72, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x12, 0x35, 0x0a,
+	0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65,
 	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61,
-	0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x44, 0x4e, 0x53, 0x44, 0x6f, 0x6e, 0x65, 0x44, 0x61,
-	0x74, 0x61, 0x48, 0x00, 0x52, 0x07, 0x64, 0x6e, 0x73, 0x44, 0x6f, 0x6e, 0x65, 0x12, 0x50, 0x0a,
-	0x0d, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x08,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
-	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x43,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x53, 0x74, 0x61, 0x72, 0x74, 0x44, 0x61, 0x74, 0x61, 0x48,
-	0x00, 0x52, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12,
-	0x4d, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x5f, 0x64, 0x6f, 0x6e, 0x65, 0x18,
-	0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
+	0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73,
+	0x74, 0x61, 0x63, 0x6b, 0x22, 0xde, 0x01, 0x0a, 0x0b, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x49, 0x6e, 0x69, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x64, 0x65, 0x66, 0x5f,
+	0x6c, 0x6f, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x64, 0x65, 0x66, 0x4c, 0x6f,
+	0x63, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x54, 0x69, 0x6d, 0x65,
+	0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x07, 0x65, 0x6e, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x12, 0x3c, 0x0a, 0x09, 0x65, 0x72, 0x72, 0x5f, 0x73,
+	0x74, 0x61, 0x63, 0x6b, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x08, 0x65, 0x72, 0x72,
+	0x53, 0x74, 0x61, 0x63, 0x6b, 0x22, 0xb7, 0x03, 0x0a, 0x07, 0x43, 0x61, 0x63, 0x68, 0x65, 0x4f,
+	0x70, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x04, 0x67, 0x6f, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x64, 0x65, 0x66, 0x5f, 0x6c, 0x6f, 0x63,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x64, 0x65, 0x66, 0x4c, 0x6f, 0x63, 0x12, 0x1d,
+	0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x19, 0x0a,
+	0x08, 0x65, 0x6e, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x07, 0x65, 0x6e, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x6f, 0x70, 0x65, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6f, 0x70, 0x65,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x06,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x69, 0x6e,
+	0x70, 0x75, 0x74, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0c, 0x52, 0x06, 0x69, 0x6e, 0x70, 0x75,
+	0x74, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x73, 0x18, 0x08, 0x20,
+	0x03, 0x28, 0x0c, 0x52, 0x07, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x73, 0x12, 0x35, 0x0a, 0x05,
+	0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73, 0x74,
+	0x61, 0x63, 0x6b, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x03, 0x65, 0x72, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x77, 0x72, 0x69, 0x74, 0x65, 0x18, 0x0b,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x77, 0x72, 0x69, 0x74, 0x65, 0x12, 0x3b, 0x0a, 0x06, 0x72,
+	0x65, 0x73, 0x75, 0x6c, 0x74, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x2e, 0x43, 0x61, 0x63, 0x68, 0x65, 0x4f, 0x70, 0x2e, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74,
+	0x52, 0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x22, 0x45, 0x0a, 0x06, 0x52, 0x65, 0x73, 0x75,
+	0x6c, 0x74, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12,
+	0x06, 0x0a, 0x02, 0x4f, 0x4b, 0x10, 0x01, 0x12, 0x0f, 0x0a, 0x0b, 0x4e, 0x4f, 0x5f, 0x53, 0x55,
+	0x43, 0x48, 0x5f, 0x4b, 0x45, 0x59, 0x10, 0x02, 0x12, 0x0c, 0x0a, 0x08, 0x43, 0x4f, 0x4e, 0x46,
+	0x4c, 0x49, 0x43, 0x54, 0x10, 0x03, 0x12, 0x07, 0x0a, 0x03, 0x45, 0x52, 0x52, 0x10, 0x04, 0x22,
+	0x61, 0x0a, 0x0a, 0x42, 0x6f, 0x64, 0x79, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x1f, 0x0a,
+	0x0b, 0x69, 0x73, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0a, 0x69, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1e,
+	0x0a, 0x0a, 0x6f, 0x76, 0x65, 0x72, 0x66, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0a, 0x6f, 0x76, 0x65, 0x72, 0x66, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x12, 0x12,
+	0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61,
+	0x74, 0x61, 0x22, 0xb5, 0x02, 0x0a, 0x08, 0x48, 0x54, 0x54, 0x50, 0x43, 0x61, 0x6c, 0x6c, 0x12,
+	0x17, 0x0a, 0x07, 0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x06, 0x73, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x65,
+	0x6e, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x65,
+	0x6e, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x10,
+	0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c,
+	0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x43, 0x6f, 0x64,
+	0x65, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03,
+	0x65, 0x72, 0x72, 0x12, 0x28, 0x0a, 0x10, 0x62, 0x6f, 0x64, 0x79, 0x5f, 0x63, 0x6c, 0x6f, 0x73,
+	0x65, 0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0e, 0x62,
+	0x6f, 0x64, 0x79, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x3b, 0x0a,
+	0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x54, 0x72, 0x61, 0x63, 0x65, 0x45, 0x76, 0x65,
+	0x6e, 0x74, 0x52, 0x06, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x22, 0xa3, 0x06, 0x0a, 0x0e, 0x48,
+	0x54, 0x54, 0x50, 0x54, 0x72, 0x61, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x3b, 0x0a,
+	0x04, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x27, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x54, 0x72, 0x61, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x43, 0x6f, 0x64, 0x65, 0x52, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x69,
+	0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x41,
+	0x0a, 0x08, 0x67, 0x65, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65,
+	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x47, 0x65, 0x74, 0x43, 0x6f,
+	0x6e, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x07, 0x67, 0x65, 0x74, 0x43, 0x6f, 0x6e,
+	0x6e, 0x12, 0x41, 0x0a, 0x08, 0x67, 0x6f, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67,
+	0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x47, 0x6f,
+	0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x07, 0x67, 0x6f, 0x74,
+	0x43, 0x6f, 0x6e, 0x6e, 0x12, 0x57, 0x0a, 0x10, 0x67, 0x6f, 0x74, 0x5f, 0x31, 0x78, 0x78, 0x5f,
+	0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74,
+	0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x47, 0x6f, 0x74, 0x31, 0x78, 0x78, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x0e, 0x67,
+	0x6f, 0x74, 0x31, 0x78, 0x78, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x44, 0x0a,
+	0x09, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65,
+	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x44, 0x4e, 0x53, 0x53, 0x74,
+	0x61, 0x72, 0x74, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x08, 0x64, 0x6e, 0x73, 0x53, 0x74,
+	0x61, 0x72, 0x74, 0x12, 0x41, 0x0a, 0x08, 0x64, 0x6e, 0x73, 0x5f, 0x64, 0x6f, 0x6e, 0x65, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
 	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50,
-	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x6e, 0x65, 0x44, 0x61, 0x74, 0x61, 0x48,
-	0x00, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x6e, 0x65, 0x12, 0x5d,
-	0x0a, 0x12, 0x74, 0x6c, 0x73, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x5f,
-	0x64, 0x6f, 0x6e, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x65, 0x6e, 0x63,
+	0x44, 0x4e, 0x53, 0x44, 0x6f, 0x6e, 0x65, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x07, 0x64,
+	0x6e, 0x73, 0x44, 0x6f, 0x6e, 0x65, 0x12, 0x50, 0x0a, 0x0d, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x53,
+	0x74, 0x61, 0x72, 0x74, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x0c, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x4d, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x5f, 0x64, 0x6f, 0x6e, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74,
+	0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x44, 0x6f, 0x6e, 0x65, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x44, 0x6f, 0x6e, 0x65, 0x12, 0x5d, 0x0a, 0x12, 0x74, 0x6c, 0x73, 0x5f, 0x68,
+	0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x5f, 0x64, 0x6f, 0x6e, 0x65, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67,
+	0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x54, 0x4c,
+	0x53, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x44, 0x6f, 0x6e, 0x65, 0x44, 0x61,
+	0x74, 0x61, 0x48, 0x00, 0x52, 0x10, 0x74, 0x6c, 0x73, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61,
+	0x6b, 0x65, 0x44, 0x6f, 0x6e, 0x65, 0x12, 0x50, 0x0a, 0x0d, 0x77, 0x72, 0x6f, 0x74, 0x65, 0x5f,
+	0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x57, 0x72, 0x6f, 0x74, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x0c, 0x77, 0x72, 0x6f, 0x74,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42, 0x06, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61,
+	0x22, 0x2e, 0x0a, 0x0f, 0x48, 0x54, 0x54, 0x50, 0x47, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x44,
+	0x61, 0x74, 0x61, 0x12, 0x1b, 0x0a, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x50, 0x6f, 0x72, 0x74,
+	0x22, 0x6e, 0x0a, 0x0f, 0x48, 0x54, 0x54, 0x50, 0x47, 0x6f, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x44,
+	0x61, 0x74, 0x61, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x75, 0x73, 0x65, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x06, 0x72, 0x65, 0x75, 0x73, 0x65, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x77,
+	0x61, 0x73, 0x5f, 0x69, 0x64, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x77,
+	0x61, 0x73, 0x49, 0x64, 0x6c, 0x65, 0x12, 0x28, 0x0a, 0x10, 0x69, 0x64, 0x6c, 0x65, 0x5f, 0x64,
+	0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03,
+	0x52, 0x0e, 0x69, 0x64, 0x6c, 0x65, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x73,
+	0x22, 0x2c, 0x0a, 0x16, 0x48, 0x54, 0x54, 0x50, 0x47, 0x6f, 0x74, 0x31, 0x78, 0x78, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x44, 0x61, 0x74, 0x61, 0x12, 0x12, 0x0a, 0x04, 0x63, 0x6f,
+	0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x22, 0x26,
+	0x0a, 0x10, 0x48, 0x54, 0x54, 0x50, 0x44, 0x4e, 0x53, 0x53, 0x74, 0x61, 0x72, 0x74, 0x44, 0x61,
+	0x74, 0x61, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x22, 0x57, 0x0a, 0x0f, 0x48, 0x54, 0x54, 0x50, 0x44, 0x4e,
+	0x53, 0x44, 0x6f, 0x6e, 0x65, 0x44, 0x61, 0x74, 0x61, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x12, 0x32, 0x0a, 0x05, 0x61,
+	0x64, 0x64, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63,
 	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
-	0x2e, 0x48, 0x54, 0x54, 0x50, 0x54, 0x4c, 0x53, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b,
-	0x65, 0x44, 0x6f, 0x6e, 0x65, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x10, 0x74, 0x6c, 0x73,
-	0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x44, 0x6f, 0x6e, 0x65, 0x12, 0x50, 0x0a,
-	0x0d, 0x77, 0x72, 0x6f, 0x74, 0x65, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x0b,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
-	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x57,
-	0x72, 0x6f, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x44, 0x61, 0x74, 0x61, 0x48,
-	0x00, 0x52, 0x0c, 0x77, 0x72, 0x6f, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x42,
-	0x06, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0x2e, 0x0a, 0x0f, 0x48, 0x54, 0x54, 0x50, 0x47,
-	0x65, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x12, 0x1b, 0x0a, 0x09, 0x68, 0x6f,
-	0x73, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68,
-	0x6f, 0x73, 0x74, 0x50, 0x6f, 0x72, 0x74, 0x22, 0x6e, 0x0a, 0x0f, 0x48, 0x54, 0x54, 0x50, 0x47,
-	0x6f, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x44, 0x61, 0x74, 0x61, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65,
-	0x75, 0x73, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x72, 0x65, 0x75, 0x73,
-	0x65, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x77, 0x61, 0x73, 0x5f, 0x69, 0x64, 0x6c, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x77, 0x61, 0x73, 0x49, 0x64, 0x6c, 0x65, 0x12, 0x28, 0x0a,
-	0x10, 0x69, 0x64, 0x6c, 0x65, 0x5f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e,
-	0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0e, 0x69, 0x64, 0x6c, 0x65, 0x44, 0x75, 0x72,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x73, 0x22, 0x2c, 0x0a, 0x16, 0x48, 0x54, 0x54, 0x50, 0x47,
-	0x6f, 0x74, 0x31, 0x78, 0x78, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x44, 0x61, 0x74,
-	0x61, 0x12, 0x12, 0x0a, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52,
-	0x04, 0x63, 0x6f, 0x64, 0x65, 0x22, 0x26, 0x0a, 0x10, 0x48, 0x54, 0x54, 0x50, 0x44, 0x4e, 0x53,
-	0x53, 0x74, 0x61, 0x72, 0x74, 0x44, 0x61, 0x74, 0x61, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73,
-	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x22, 0x57, 0x0a,
-	0x0f, 0x48, 0x54, 0x54, 0x50, 0x44, 0x4e, 0x53, 0x44, 0x6f, 0x6e, 0x65, 0x44, 0x61, 0x74, 0x61,
-	0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65,
-	0x72, 0x72, 0x12, 0x32, 0x0a, 0x05, 0x61, 0x64, 0x64, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e,
-	0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x44, 0x4e, 0x53, 0x41, 0x64, 0x64, 0x72, 0x52,
-	0x05, 0x61, 0x64, 0x64, 0x72, 0x73, 0x22, 0x19, 0x0a, 0x07, 0x44, 0x4e, 0x53, 0x41, 0x64, 0x64,
-	0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x02, 0x69,
-	0x70, 0x22, 0x44, 0x0a, 0x14, 0x48, 0x54, 0x54, 0x50, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
-	0x53, 0x74, 0x61, 0x72, 0x74, 0x44, 0x61, 0x74, 0x61, 0x12, 0x18, 0x0a, 0x07, 0x6e, 0x65, 0x74,
-	0x77, 0x6f, 0x72, 0x6b, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77,
-	0x6f, 0x72, 0x6b, 0x12, 0x12, 0x0a, 0x04, 0x61, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x04, 0x61, 0x64, 0x64, 0x72, 0x22, 0x55, 0x0a, 0x13, 0x48, 0x54, 0x54, 0x50, 0x43,
-	0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x6e, 0x65, 0x44, 0x61, 0x74, 0x61, 0x12, 0x18,
-	0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x12, 0x0a, 0x04, 0x61, 0x64, 0x64, 0x72,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x61, 0x64, 0x64, 0x72, 0x12, 0x10, 0x0a, 0x03,
-	0x65, 0x72, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x22, 0xc2,
-	0x01, 0x0a, 0x18, 0x48, 0x54, 0x54, 0x50, 0x54, 0x4c, 0x53, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68,
-	0x61, 0x6b, 0x65, 0x44, 0x6f, 0x6e, 0x65, 0x44, 0x61, 0x74, 0x61, 0x12, 0x10, 0x0a, 0x03, 0x65,
-	0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x12, 0x1f, 0x0a,
-	0x0b, 0x74, 0x6c, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0d, 0x52, 0x0a, 0x74, 0x6c, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x21,
-	0x0a, 0x0c, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x5f, 0x73, 0x75, 0x69, 0x74, 0x65, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x0d, 0x52, 0x0b, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x53, 0x75, 0x69, 0x74,
-	0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4e, 0x61,
-	0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x13, 0x6e, 0x65, 0x67, 0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x64,
-	0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x12, 0x6e, 0x65, 0x67, 0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x64, 0x50, 0x72, 0x6f, 0x74, 0x6f,
-	0x63, 0x6f, 0x6c, 0x22, 0x28, 0x0a, 0x14, 0x48, 0x54, 0x54, 0x50, 0x57, 0x72, 0x6f, 0x74, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x44, 0x61, 0x74, 0x61, 0x12, 0x10, 0x0a, 0x03, 0x65,
-	0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x2a, 0xa0, 0x02,
-	0x0a, 0x12, 0x48, 0x54, 0x54, 0x50, 0x54, 0x72, 0x61, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74,
-	0x43, 0x6f, 0x64, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10,
-	0x00, 0x12, 0x0c, 0x0a, 0x08, 0x47, 0x45, 0x54, 0x5f, 0x43, 0x4f, 0x4e, 0x4e, 0x10, 0x01, 0x12,
-	0x0c, 0x0a, 0x08, 0x47, 0x4f, 0x54, 0x5f, 0x43, 0x4f, 0x4e, 0x4e, 0x10, 0x02, 0x12, 0x1b, 0x0a,
-	0x17, 0x47, 0x4f, 0x54, 0x5f, 0x46, 0x49, 0x52, 0x53, 0x54, 0x5f, 0x52, 0x45, 0x53, 0x50, 0x4f,
-	0x4e, 0x53, 0x45, 0x5f, 0x42, 0x59, 0x54, 0x45, 0x10, 0x03, 0x12, 0x14, 0x0a, 0x10, 0x47, 0x4f,
-	0x54, 0x5f, 0x31, 0x58, 0x58, 0x5f, 0x52, 0x45, 0x53, 0x50, 0x4f, 0x4e, 0x53, 0x45, 0x10, 0x04,
-	0x12, 0x0d, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x5f, 0x53, 0x54, 0x41, 0x52, 0x54, 0x10, 0x05, 0x12,
-	0x0c, 0x0a, 0x08, 0x44, 0x4e, 0x53, 0x5f, 0x44, 0x4f, 0x4e, 0x45, 0x10, 0x06, 0x12, 0x11, 0x0a,
-	0x0d, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x5f, 0x53, 0x54, 0x41, 0x52, 0x54, 0x10, 0x07,
-	0x12, 0x10, 0x0a, 0x0c, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x5f, 0x44, 0x4f, 0x4e, 0x45,
-	0x10, 0x08, 0x12, 0x17, 0x0a, 0x13, 0x54, 0x4c, 0x53, 0x5f, 0x48, 0x41, 0x4e, 0x44, 0x53, 0x48,
-	0x41, 0x4b, 0x45, 0x5f, 0x53, 0x54, 0x41, 0x52, 0x54, 0x10, 0x09, 0x12, 0x16, 0x0a, 0x12, 0x54,
-	0x4c, 0x53, 0x5f, 0x48, 0x41, 0x4e, 0x44, 0x53, 0x48, 0x41, 0x4b, 0x45, 0x5f, 0x44, 0x4f, 0x4e,
-	0x45, 0x10, 0x0a, 0x12, 0x11, 0x0a, 0x0d, 0x57, 0x52, 0x4f, 0x54, 0x45, 0x5f, 0x48, 0x45, 0x41,
-	0x44, 0x45, 0x52, 0x53, 0x10, 0x0b, 0x12, 0x11, 0x0a, 0x0d, 0x57, 0x52, 0x4f, 0x54, 0x45, 0x5f,
-	0x52, 0x45, 0x51, 0x55, 0x45, 0x53, 0x54, 0x10, 0x0c, 0x12, 0x15, 0x0a, 0x11, 0x57, 0x41, 0x49,
-	0x54, 0x5f, 0x31, 0x30, 0x30, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x49, 0x4e, 0x55, 0x45, 0x10, 0x0d,
-	0x42, 0x24, 0x5a, 0x22, 0x65, 0x6e, 0x63, 0x72, 0x2e, 0x64, 0x65, 0x76, 0x2f, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65,
-	0x2f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x2e, 0x44, 0x4e, 0x53, 0x41, 0x64, 0x64, 0x72, 0x52, 0x05, 0x61, 0x64, 0x64, 0x72, 0x73, 0x22,
+	0x19, 0x0a, 0x07, 0x44, 0x4e, 0x53, 0x41, 0x64, 0x64, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x70,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x02, 0x69, 0x70, 0x22, 0x44, 0x0a, 0x14, 0x48, 0x54,
+	0x54, 0x50, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x53, 0x74, 0x61, 0x72, 0x74, 0x44, 0x61,
+	0x74, 0x61, 0x12, 0x18, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x12, 0x12, 0x0a, 0x04,
+	0x61, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x61, 0x64, 0x64, 0x72,
+	0x22, 0x55, 0x0a, 0x13, 0x48, 0x54, 0x54, 0x50, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x44,
+	0x6f, 0x6e, 0x65, 0x44, 0x61, 0x74, 0x61, 0x12, 0x18, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x12, 0x12, 0x0a, 0x04, 0x61, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x61, 0x64, 0x64, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x22, 0xc2, 0x01, 0x0a, 0x18, 0x48, 0x54, 0x54, 0x50,
+	0x54, 0x4c, 0x53, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x44, 0x6f, 0x6e, 0x65,
+	0x44, 0x61, 0x74, 0x61, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x6c, 0x73, 0x5f, 0x76, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x74, 0x6c, 0x73,
+	0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x69, 0x70, 0x68, 0x65,
+	0x72, 0x5f, 0x73, 0x75, 0x69, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0b, 0x63,
+	0x69, 0x70, 0x68, 0x65, 0x72, 0x53, 0x75, 0x69, 0x74, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x13, 0x6e,
+	0x65, 0x67, 0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63,
+	0x6f, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6e, 0x65, 0x67, 0x6f, 0x74, 0x69,
+	0x61, 0x74, 0x65, 0x64, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x22, 0x28, 0x0a, 0x14,
+	0x48, 0x54, 0x54, 0x50, 0x57, 0x72, 0x6f, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x44, 0x61, 0x74, 0x61, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x22, 0xc8, 0x02, 0x0a, 0x0a, 0x4c, 0x6f, 0x67, 0x4d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x12, 0x12,
+	0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x04, 0x67, 0x6f,
+	0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x04, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x3b, 0x0a, 0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
+	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x4c, 0x6f, 0x67, 0x4d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x2e, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x05, 0x6c, 0x65,
+	0x76, 0x65, 0x6c, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x6d, 0x73, 0x67, 0x12, 0x35, 0x0a, 0x06, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x18,
+	0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
+	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x4c, 0x6f, 0x67, 0x46,
+	0x69, 0x65, 0x6c, 0x64, 0x52, 0x06, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x12, 0x35, 0x0a, 0x05,
+	0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73, 0x74,
+	0x61, 0x63, 0x6b, 0x22, 0x3c, 0x0a, 0x05, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x09, 0x0a, 0x05,
+	0x44, 0x45, 0x42, 0x55, 0x47, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x4e, 0x46, 0x4f, 0x10,
+	0x01, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04,
+	0x57, 0x41, 0x52, 0x4e, 0x10, 0x03, 0x12, 0x09, 0x0a, 0x05, 0x54, 0x52, 0x41, 0x43, 0x45, 0x10,
+	0x04, 0x22, 0xa4, 0x03, 0x0a, 0x08, 0x4c, 0x6f, 0x67, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x12, 0x30, 0x0a, 0x13, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x6f, 0x75,
+	0x74, 0x5f, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52,
+	0x11, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x57, 0x69, 0x74, 0x68, 0x6f, 0x75, 0x74, 0x53, 0x74, 0x61,
+	0x63, 0x6b, 0x12, 0x4d, 0x0a, 0x10, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x5f, 0x77, 0x69, 0x74, 0x68,
+	0x5f, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61,
+	0x63, 0x65, 0x2e, 0x45, 0x72, 0x72, 0x57, 0x69, 0x74, 0x68, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x48,
+	0x00, 0x52, 0x0e, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x57, 0x69, 0x74, 0x68, 0x53, 0x74, 0x61, 0x63,
+	0x6b, 0x12, 0x12, 0x0a, 0x03, 0x73, 0x74, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00,
+	0x52, 0x03, 0x73, 0x74, 0x72, 0x12, 0x14, 0x0a, 0x04, 0x62, 0x6f, 0x6f, 0x6c, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x04, 0x62, 0x6f, 0x6f, 0x6c, 0x12, 0x30, 0x0a, 0x04, 0x74,
+	0x69, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x48, 0x00, 0x52, 0x04, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x12, 0x0a,
+	0x03, 0x64, 0x75, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x48, 0x00, 0x52, 0x03, 0x64, 0x75,
+	0x72, 0x12, 0x14, 0x0a, 0x04, 0x75, 0x75, 0x69, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x48,
+	0x00, 0x52, 0x04, 0x75, 0x75, 0x69, 0x64, 0x12, 0x14, 0x0a, 0x04, 0x6a, 0x73, 0x6f, 0x6e, 0x18,
+	0x08, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x04, 0x6a, 0x73, 0x6f, 0x6e, 0x12, 0x12, 0x0a,
+	0x03, 0x69, 0x6e, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x03, 0x48, 0x00, 0x52, 0x03, 0x69, 0x6e,
+	0x74, 0x12, 0x14, 0x0a, 0x04, 0x75, 0x69, 0x6e, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x04, 0x48,
+	0x00, 0x52, 0x04, 0x75, 0x69, 0x6e, 0x74, 0x12, 0x1a, 0x0a, 0x07, 0x66, 0x6c, 0x6f, 0x61, 0x74,
+	0x33, 0x32, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x02, 0x48, 0x00, 0x52, 0x07, 0x66, 0x6c, 0x6f, 0x61,
+	0x74, 0x33, 0x32, 0x12, 0x1a, 0x0a, 0x07, 0x66, 0x6c, 0x6f, 0x61, 0x74, 0x36, 0x34, 0x18, 0x0c,
+	0x20, 0x01, 0x28, 0x01, 0x48, 0x00, 0x52, 0x07, 0x66, 0x6c, 0x6f, 0x61, 0x74, 0x36, 0x34, 0x42,
+	0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x5b, 0x0a, 0x0c, 0x45, 0x72, 0x72, 0x57,
+	0x69, 0x74, 0x68, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x35,
+	0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05,
+	0x73, 0x74, 0x61, 0x63, 0x6b, 0x22, 0x57, 0x0a, 0x0a, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72,
+	0x61, 0x63, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x63, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x03,
+	0x52, 0x03, 0x70, 0x63, 0x73, 0x12, 0x37, 0x0a, 0x06, 0x66, 0x72, 0x61, 0x6d, 0x65, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
+	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x2e, 0x53, 0x74, 0x61, 0x63,
+	0x6b, 0x46, 0x72, 0x61, 0x6d, 0x65, 0x52, 0x06, 0x66, 0x72, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x50,
+	0x0a, 0x0a, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x46, 0x72, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08,
+	0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x75, 0x6e, 0x63,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x75, 0x6e, 0x63, 0x12, 0x12, 0x0a, 0x04,
+	0x6c, 0x69, 0x6e, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x04, 0x6c, 0x69, 0x6e, 0x65,
+	0x2a, 0xa0, 0x02, 0x0a, 0x12, 0x48, 0x54, 0x54, 0x50, 0x54, 0x72, 0x61, 0x63, 0x65, 0x45, 0x76,
+	0x65, 0x6e, 0x74, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f,
+	0x57, 0x4e, 0x10, 0x00, 0x12, 0x0c, 0x0a, 0x08, 0x47, 0x45, 0x54, 0x5f, 0x43, 0x4f, 0x4e, 0x4e,
+	0x10, 0x01, 0x12, 0x0c, 0x0a, 0x08, 0x47, 0x4f, 0x54, 0x5f, 0x43, 0x4f, 0x4e, 0x4e, 0x10, 0x02,
+	0x12, 0x1b, 0x0a, 0x17, 0x47, 0x4f, 0x54, 0x5f, 0x46, 0x49, 0x52, 0x53, 0x54, 0x5f, 0x52, 0x45,
+	0x53, 0x50, 0x4f, 0x4e, 0x53, 0x45, 0x5f, 0x42, 0x59, 0x54, 0x45, 0x10, 0x03, 0x12, 0x14, 0x0a,
+	0x10, 0x47, 0x4f, 0x54, 0x5f, 0x31, 0x58, 0x58, 0x5f, 0x52, 0x45, 0x53, 0x50, 0x4f, 0x4e, 0x53,
+	0x45, 0x10, 0x04, 0x12, 0x0d, 0x0a, 0x09, 0x44, 0x4e, 0x53, 0x5f, 0x53, 0x54, 0x41, 0x52, 0x54,
+	0x10, 0x05, 0x12, 0x0c, 0x0a, 0x08, 0x44, 0x4e, 0x53, 0x5f, 0x44, 0x4f, 0x4e, 0x45, 0x10, 0x06,
+	0x12, 0x11, 0x0a, 0x0d, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x5f, 0x53, 0x54, 0x41, 0x52,
+	0x54, 0x10, 0x07, 0x12, 0x10, 0x0a, 0x0c, 0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x5f, 0x44,
+	0x4f, 0x4e, 0x45, 0x10, 0x08, 0x12, 0x17, 0x0a, 0x13, 0x54, 0x4c, 0x53, 0x5f, 0x48, 0x41, 0x4e,
+	0x44, 0x53, 0x48, 0x41, 0x4b, 0x45, 0x5f, 0x53, 0x54, 0x41, 0x52, 0x54, 0x10, 0x09, 0x12, 0x16,
+	0x0a, 0x12, 0x54, 0x4c, 0x53, 0x5f, 0x48, 0x41, 0x4e, 0x44, 0x53, 0x48, 0x41, 0x4b, 0x45, 0x5f,
+	0x44, 0x4f, 0x4e, 0x45, 0x10, 0x0a, 0x12, 0x11, 0x0a, 0x0d, 0x57, 0x52, 0x4f, 0x54, 0x45, 0x5f,
+	0x48, 0x45, 0x41, 0x44, 0x45, 0x52, 0x53, 0x10, 0x0b, 0x12, 0x11, 0x0a, 0x0d, 0x57, 0x52, 0x4f,
+	0x54, 0x45, 0x5f, 0x52, 0x45, 0x51, 0x55, 0x45, 0x53, 0x54, 0x10, 0x0c, 0x12, 0x15, 0x0a, 0x11,
+	0x57, 0x41, 0x49, 0x54, 0x5f, 0x31, 0x30, 0x30, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x49, 0x4e, 0x55,
+	0x45, 0x10, 0x0d, 0x42, 0x24, 0x5a, 0x22, 0x65, 0x6e, 0x63, 0x72, 0x2e, 0x64, 0x65, 0x76, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x65, 0x6e, 0x67,
+	0x69, 0x6e, 0x65, 0x2f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
 }
 
 var (
@@ -2007,60 +3461,99 @@ func file_encore_engine_trace_trace_proto_rawDescGZIP() []byte {
 	return file_encore_engine_trace_trace_proto_rawDescData
 }
 
-var file_encore_engine_trace_trace_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
-var file_encore_engine_trace_trace_proto_msgTypes = make([]protoimpl.MessageInfo, 19)
+var file_encore_engine_trace_trace_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
+var file_encore_engine_trace_trace_proto_msgTypes = make([]protoimpl.MessageInfo, 30)
 var file_encore_engine_trace_trace_proto_goTypes = []interface{}{
 	(HTTPTraceEventCode)(0),           // 0: encore.engine.trace.HTTPTraceEventCode
 	(Request_Type)(0),                 // 1: encore.engine.trace.Request.Type
 	(DBTransaction_CompletionType)(0), // 2: encore.engine.trace.DBTransaction.CompletionType
-	(*TraceID)(nil),                   // 3: encore.engine.trace.TraceID
-	(*Request)(nil),                   // 4: encore.engine.trace.Request
-	(*Event)(nil),                     // 5: encore.engine.trace.Event
-	(*RPCCall)(nil),                   // 6: encore.engine.trace.RPCCall
-	(*Goroutine)(nil),                 // 7: encore.engine.trace.Goroutine
-	(*DBTransaction)(nil),             // 8: encore.engine.trace.DBTransaction
-	(*DBQuery)(nil),                   // 9: encore.engine.trace.DBQuery
-	(*HTTPCall)(nil),                  // 10: encore.engine.trace.HTTPCall
-	(*HTTPTraceEvent)(nil),            // 11: encore.engine.trace.HTTPTraceEvent
-	(*HTTPGetConnData)(nil),           // 12: encore.engine.trace.HTTPGetConnData
-	(*HTTPGotConnData)(nil),           // 13: encore.engine.trace.HTTPGotConnData
-	(*HTTPGot1XxResponseData)(nil),    // 14: encore.engine.trace.HTTPGot1xxResponseData
-	(*HTTPDNSStartData)(nil),          // 15: encore.engine.trace.HTTPDNSStartData
-	(*HTTPDNSDoneData)(nil),           // 16: encore.engine.trace.HTTPDNSDoneData
-	(*DNSAddr)(nil),                   // 17: encore.engine.trace.DNSAddr
-	(*HTTPConnectStartData)(nil),      // 18: encore.engine.trace.HTTPConnectStartData
-	(*HTTPConnectDoneData)(nil),       // 19: encore.engine.trace.HTTPConnectDoneData
-	(*HTTPTLSHandshakeDoneData)(nil),  // 20: encore.engine.trace.HTTPTLSHandshakeDoneData
-	(*HTTPWroteRequestData)(nil),      // 21: encore.engine.trace.HTTPWroteRequestData
+	(CacheOp_Result)(0),               // 3: encore.engine.trace.CacheOp.Result
+	(LogMessage_Level)(0),             // 4: encore.engine.trace.LogMessage.Level
+	(*TraceID)(nil),                   // 5: encore.engine.trace.TraceID
+	(*Request)(nil),                   // 6: encore.engine.trace.Request
+	(*Event)(nil),                     // 7: encore.engine.trace.Event
+	(*RPCCall)(nil),                   // 8: encore.engine.trace.RPCCall
+	(*Goroutine)(nil),                 // 9: encore.engine.trace.Goroutine
+	(*DBTransaction)(nil),             // 10: encore.engine.trace.DBTransaction
+	(*DBQuery)(nil),                   // 11: encore.engine.trace.DBQuery
+	(*PubsubMsgPublished)(nil),        // 12: encore.engine.trace.PubsubMsgPublished
+	(*ServiceInit)(nil),               // 13: encore.engine.trace.ServiceInit
+	(*CacheOp)(nil),                   // 14: encore.engine.trace.CacheOp
+	(*BodyStream)(nil),                // 15: encore.engine.trace.BodyStream
+	(*HTTPCall)(nil),                  // 16: encore.engine.trace.HTTPCall
+	(*HTTPTraceEvent)(nil),            // 17: encore.engine.trace.HTTPTraceEvent
+	(*HTTPGetConnData)(nil),           // 18: encore.engine.trace.HTTPGetConnData
+	(*HTTPGotConnData)(nil),           // 19: encore.engine.trace.HTTPGotConnData
+	(*HTTPGot1XxResponseData)(nil),    // 20: encore.engine.trace.HTTPGot1xxResponseData
+	(*HTTPDNSStartData)(nil),          // 21: encore.engine.trace.HTTPDNSStartData
+	(*HTTPDNSDoneData)(nil),           // 22: encore.engine.trace.HTTPDNSDoneData
+	(*DNSAddr)(nil),                   // 23: encore.engine.trace.DNSAddr
+	(*HTTPConnectStartData)(nil),      // 24: encore.engine.trace.HTTPConnectStartData
+	(*HTTPConnectDoneData)(nil),       // 25: encore.engine.trace.HTTPConnectDoneData
+	(*HTTPTLSHandshakeDoneData)(nil),  // 26: encore.engine.trace.HTTPTLSHandshakeDoneData
+	(*HTTPWroteRequestData)(nil),      // 27: encore.engine.trace.HTTPWroteRequestData
+	(*LogMessage)(nil),                // 28: encore.engine.trace.LogMessage
+	(*LogField)(nil),                  // 29: encore.engine.trace.LogField
+	(*ErrWithStack)(nil),              // 30: encore.engine.trace.ErrWithStack
+	(*StackTrace)(nil),                // 31: encore.engine.trace.StackTrace
+	(*StackFrame)(nil),                // 32: encore.engine.trace.StackFrame
+	nil,                               // 33: encore.engine.trace.Request.RawRequestHeadersEntry
+	nil,                               // 34: encore.engine.trace.Request.RawResponseHeadersEntry
+	(*timestamppb.Timestamp)(nil),     // 35: google.protobuf.Timestamp
 }
 var file_encore_engine_trace_trace_proto_depIdxs = []int32{
-	3,  // 0: encore.engine.trace.Request.trace_id:type_name -> encore.engine.trace.TraceID
-	5,  // 1: encore.engine.trace.Request.events:type_name -> encore.engine.trace.Event
-	1,  // 2: encore.engine.trace.Request.type:type_name -> encore.engine.trace.Request.Type
-	6,  // 3: encore.engine.trace.Event.rpc:type_name -> encore.engine.trace.RPCCall
-	8,  // 4: encore.engine.trace.Event.tx:type_name -> encore.engine.trace.DBTransaction
-	9,  // 5: encore.engine.trace.Event.query:type_name -> encore.engine.trace.DBQuery
-	7,  // 6: encore.engine.trace.Event.goroutine:type_name -> encore.engine.trace.Goroutine
-	10, // 7: encore.engine.trace.Event.http:type_name -> encore.engine.trace.HTTPCall
-	2,  // 8: encore.engine.trace.DBTransaction.completion:type_name -> encore.engine.trace.DBTransaction.CompletionType
-	9,  // 9: encore.engine.trace.DBTransaction.queries:type_name -> encore.engine.trace.DBQuery
-	11, // 10: encore.engine.trace.HTTPCall.events:type_name -> encore.engine.trace.HTTPTraceEvent
-	0,  // 11: encore.engine.trace.HTTPTraceEvent.code:type_name -> encore.engine.trace.HTTPTraceEventCode
-	12, // 12: encore.engine.trace.HTTPTraceEvent.get_conn:type_name -> encore.engine.trace.HTTPGetConnData
-	13, // 13: encore.engine.trace.HTTPTraceEvent.got_conn:type_name -> encore.engine.trace.HTTPGotConnData
-	14, // 14: encore.engine.trace.HTTPTraceEvent.got_1xx_response:type_name -> encore.engine.trace.HTTPGot1xxResponseData
-	15, // 15: encore.engine.trace.HTTPTraceEvent.dns_start:type_name -> encore.engine.trace.HTTPDNSStartData
-	16, // 16: encore.engine.trace.HTTPTraceEvent.dns_done:type_name -> encore.engine.trace.HTTPDNSDoneData
-	18, // 17: encore.engine.trace.HTTPTraceEvent.connect_start:type_name -> encore.engine.trace.HTTPConnectStartData
-	19, // 18: encore.engine.trace.HTTPTraceEvent.connect_done:type_name -> encore.engine.trace.HTTPConnectDoneData
-	20, // 19: encore.engine.trace.HTTPTraceEvent.tls_handshake_done:type_name -> encore.engine.trace.HTTPTLSHandshakeDoneData
-	21, // 20: encore.engine.trace.HTTPTraceEvent.wrote_request:type_name -> encore.engine.trace.HTTPWroteRequestData
-	17, // 21: encore.engine.trace.HTTPDNSDoneData.addrs:type_name -> encore.engine.trace.DNSAddr
-	22, // [22:22] is the sub-list for method output_type
-	22, // [22:22] is the sub-list for method input_type
-	22, // [22:22] is the sub-list for extension type_name
-	22, // [22:22] is the sub-list for extension extendee
-	0,  // [0:22] is the sub-list for field type_name
+	5,  // 0: encore.engine.trace.Request.trace_id:type_name -> encore.engine.trace.TraceID
+	5,  // 1: encore.engine.trace.Request.parent_trace_id:type_name -> encore.engine.trace.TraceID
+	7,  // 2: encore.engine.trace.Request.events:type_name -> encore.engine.trace.Event
+	1,  // 3: encore.engine.trace.Request.type:type_name -> encore.engine.trace.Request.Type
+	31, // 4: encore.engine.trace.Request.err_stack:type_name -> encore.engine.trace.StackTrace
+	31, // 5: encore.engine.trace.Request.panic_stack:type_name -> encore.engine.trace.StackTrace
+	33, // 6: encore.engine.trace.Request.raw_request_headers:type_name -> encore.engine.trace.Request.RawRequestHeadersEntry
+	34, // 7: encore.engine.trace.Request.raw_response_headers:type_name -> encore.engine.trace.Request.RawResponseHeadersEntry
+	8,  // 8: encore.engine.trace.Event.rpc:type_name -> encore.engine.trace.RPCCall
+	10, // 9: encore.engine.trace.Event.tx:type_name -> encore.engine.trace.DBTransaction
+	11, // 10: encore.engine.trace.Event.query:type_name -> encore.engine.trace.DBQuery
+	9,  // 11: encore.engine.trace.Event.goroutine:type_name -> encore.engine.trace.Goroutine
+	16, // 12: encore.engine.trace.Event.http:type_name -> encore.engine.trace.HTTPCall
+	28, // 13: encore.engine.trace.Event.log:type_name -> encore.engine.trace.LogMessage
+	12, // 14: encore.engine.trace.Event.publishedMsg:type_name -> encore.engine.trace.PubsubMsgPublished
+	13, // 15: encore.engine.trace.Event.service_init:type_name -> encore.engine.trace.ServiceInit
+	14, // 16: encore.engine.trace.Event.cache:type_name -> encore.engine.trace.CacheOp
+	15, // 17: encore.engine.trace.Event.body_stream:type_name -> encore.engine.trace.BodyStream
+	31, // 18: encore.engine.trace.RPCCall.stack:type_name -> encore.engine.trace.StackTrace
+	2,  // 19: encore.engine.trace.DBTransaction.completion:type_name -> encore.engine.trace.DBTransaction.CompletionType
+	11, // 20: encore.engine.trace.DBTransaction.queries:type_name -> encore.engine.trace.DBQuery
+	31, // 21: encore.engine.trace.DBTransaction.begin_stack:type_name -> encore.engine.trace.StackTrace
+	31, // 22: encore.engine.trace.DBTransaction.end_stack:type_name -> encore.engine.trace.StackTrace
+	31, // 23: encore.engine.trace.DBQuery.stack:type_name -> encore.engine.trace.StackTrace
+	31, // 24: encore.engine.trace.PubsubMsgPublished.stack:type_name -> encore.engine.trace.StackTrace
+	31, // 25: encore.engine.trace.ServiceInit.err_stack:type_name -> encore.engine.trace.StackTrace
+	31, // 26: encore.engine.trace.CacheOp.stack:type_name -> encore.engine.trace.StackTrace
+	3,  // 27: encore.engine.trace.CacheOp.result:type_name -> encore.engine.trace.CacheOp.Result
+	17, // 28: encore.engine.trace.HTTPCall.events:type_name -> encore.engine.trace.HTTPTraceEvent
+	0,  // 29: encore.engine.trace.HTTPTraceEvent.code:type_name -> encore.engine.trace.HTTPTraceEventCode
+	18, // 30: encore.engine.trace.HTTPTraceEvent.get_conn:type_name -> encore.engine.trace.HTTPGetConnData
+	19, // 31: encore.engine.trace.HTTPTraceEvent.got_conn:type_name -> encore.engine.trace.HTTPGotConnData
+	20, // 32: encore.engine.trace.HTTPTraceEvent.got_1xx_response:type_name -> encore.engine.trace.HTTPGot1xxResponseData
+	21, // 33: encore.engine.trace.HTTPTraceEvent.dns_start:type_name -> encore.engine.trace.HTTPDNSStartData
+	22, // 34: encore.engine.trace.HTTPTraceEvent.dns_done:type_name -> encore.engine.trace.HTTPDNSDoneData
+	24, // 35: encore.engine.trace.HTTPTraceEvent.connect_start:type_name -> encore.engine.trace.HTTPConnectStartData
+	25, // 36: encore.engine.trace.HTTPTraceEvent.connect_done:type_name -> encore.engine.trace.HTTPConnectDoneData
+	26, // 37: encore.engine.trace.HTTPTraceEvent.tls_handshake_done:type_name -> encore.engine.trace.HTTPTLSHandshakeDoneData
+	27, // 38: encore.engine.trace.HTTPTraceEvent.wrote_request:type_name -> encore.engine.trace.HTTPWroteRequestData
+	23, // 39: encore.engine.trace.HTTPDNSDoneData.addrs:type_name -> encore.engine.trace.DNSAddr
+	4,  // 40: encore.engine.trace.LogMessage.level:type_name -> encore.engine.trace.LogMessage.Level
+	29, // 41: encore.engine.trace.LogMessage.fields:type_name -> encore.engine.trace.LogField
+	31, // 42: encore.engine.trace.LogMessage.stack:type_name -> encore.engine.trace.StackTrace
+	30, // 43: encore.engine.trace.LogField.error_with_stack:type_name -> encore.engine.trace.ErrWithStack
+	35, // 44: encore.engine.trace.LogField.time:type_name -> google.protobuf.Timestamp
+	31, // 45: encore.engine.trace.ErrWithStack.stack:type_name -> encore.engine.trace.StackTrace
+	32, // 46: encore.engine.trace.StackTrace.frames:type_name -> encore.engine.trace.StackFrame
+	47, // [47:47] is the sub-list for method output_type
+	47, // [47:47] is the sub-list for method input_type
+	47, // [47:47] is the sub-list for extension type_name
+	47, // [47:47] is the sub-list for extension extendee
+	0,  // [0:47] is the sub-list for field type_name
 }
 
 func init() { file_encore_engine_trace_trace_proto_init() }
@@ -2154,7 +3647,7 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HTTPCall); i {
+			switch v := v.(*PubsubMsgPublished); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2166,7 +3659,7 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HTTPTraceEvent); i {
+			switch v := v.(*ServiceInit); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2178,7 +3671,7 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HTTPGetConnData); i {
+			switch v := v.(*CacheOp); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2190,7 +3683,7 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HTTPGotConnData); i {
+			switch v := v.(*BodyStream); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2202,7 +3695,7 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HTTPGot1XxResponseData); i {
+			switch v := v.(*HTTPCall); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2214,7 +3707,7 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HTTPDNSStartData); i {
+			switch v := v.(*HTTPTraceEvent); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2226,7 +3719,7 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HTTPDNSDoneData); i {
+			switch v := v.(*HTTPGetConnData); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2238,7 +3731,7 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*DNSAddr); i {
+			switch v := v.(*HTTPGotConnData); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2250,7 +3743,7 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HTTPConnectStartData); i {
+			switch v := v.(*HTTPGot1XxResponseData); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2262,7 +3755,7 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HTTPConnectDoneData); i {
+			switch v := v.(*HTTPDNSStartData); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2274,7 +3767,7 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*HTTPTLSHandshakeDoneData); i {
+			switch v := v.(*HTTPDNSDoneData); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -2286,6 +3779,54 @@ func file_encore_engine_trace_trace_proto_init() {
 			}
 		}
 		file_encore_engine_trace_trace_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DNSAddr); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace_trace_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPConnectStartData); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace_trace_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPConnectDoneData); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace_trace_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPTLSHandshakeDoneData); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace_trace_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*HTTPWroteRequestData); i {
 			case 0:
 				return &v.state
@@ -2297,6 +3838,66 @@ func file_encore_engine_trace_trace_proto_init() {
 				return nil
 			}
 		}
+		file_encore_engine_trace_trace_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LogMessage); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace_trace_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LogField); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace_trace_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ErrWithStack); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace_trace_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StackTrace); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace_trace_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StackFrame); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	file_encore_engine_trace_trace_proto_msgTypes[2].OneofWrappers = []interface{}{
 		(*Event_Rpc)(nil),
@@ -2304,8 +3905,13 @@ func file_encore_engine_trace_trace_proto_init() {
 		(*Event_Query)(nil),
 		(*Event_Goroutine)(nil),
 		(*Event_Http)(nil),
+		(*Event_Log)(nil),
+		(*Event_PublishedMsg)(nil),
+		(*Event_ServiceInit)(nil),
+		(*Event_Cache)(nil),
+		(*Event_BodyStream)(nil),
 	}
-	file_encore_engine_trace_trace_proto_msgTypes[8].OneofWrappers = []interface{}{
+	file_encore_engine_trace_trace_proto_msgTypes[12].OneofWrappers = []interface{}{
 		(*HTTPTraceEvent_GetConn)(nil),
 		(*HTTPTraceEvent_GotConn)(nil),
 		(*HTTPTraceEvent_Got_1XxResponse)(nil),
@@ -2316,13 +3922,27 @@ func file_encore_engine_trace_trace_proto_init() {
 		(*HTTPTraceEvent_TlsHandshakeDone)(nil),
 		(*HTTPTraceEvent_WroteRequest)(nil),
 	}
+	file_encore_engine_trace_trace_proto_msgTypes[24].OneofWrappers = []interface{}{
+		(*LogField_ErrorWithoutStack)(nil),
+		(*LogField_ErrorWithStack)(nil),
+		(*LogField_Str)(nil),
+		(*LogField_Bool)(nil),
+		(*LogField_Time)(nil),
+		(*LogField_Dur)(nil),
+		(*LogField_Uuid)(nil),
+		(*LogField_Json)(nil),
+		(*LogField_Int)(nil),
+		(*LogField_Uint)(nil),
+		(*LogField_Float32)(nil),
+		(*LogField_Float64)(nil),
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_encore_engine_trace_trace_proto_rawDesc,
-			NumEnums:      3,
-			NumMessages:   19,
+			NumEnums:      5,
+			NumMessages:   30,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/proto/encore/engine/trace/trace.proto b/proto/encore/engine/trace/trace.proto
index 730cf0745f..a501062db7 100644
--- a/proto/encore/engine/trace/trace.proto
+++ b/proto/encore/engine/trace/trace.proto
@@ -2,6 +2,8 @@ syntax = "proto3";
 
 option go_package = "encr.dev/proto/encore/engine/trace";
 
+import "google/protobuf/timestamp.proto";
+
 package encore.engine.trace;
 
 message TraceID {
@@ -10,24 +12,54 @@ message TraceID {
 }
 
 message Request {
+  reserved 7; // call_loc
   TraceID trace_id = 1;
   uint64 span_id = 2;
   uint64 parent_span_id = 3;
+  TraceID parent_trace_id = 32;
   uint32 goid = 4;
   uint64 start_time = 5;
   uint64 end_time = 6;
-  int32 call_loc = 7;
   int32 def_loc = 8;
-  repeated bytes inputs = 9;
-  repeated bytes outputs = 10;
   bytes err = 11;
   repeated Event events = 12;
-  string uid = 13;
   Type type = 14;
+  StackTrace err_stack = 15; // null if unavailable
+  StackTrace panic_stack = 34; // null if unavailable
+
+  // abs_start_time is the absolute unix timestamp
+  // (in nanosecond resolution) of when the request started.
+  uint64 abs_start_time = 16;
+
+  string service_name = 17;
+  string endpoint_name = 18;
+
+  // Fields set if Type == PUBSUB_MSG
+  string topic_name = 19;
+  string subscription_name = 20;
+  string message_id = 21;
+  uint32 attempt = 22;
+  uint64 publish_time = 23;
+
+  // Fields set if Type == RPC or AUTH
+  repeated bytes inputs = 9; // Deprecated: use request_payload and path_params
+  repeated bytes outputs = 10; // Deprecated: use response_payload and uid
+  string uid = 13;
+  string http_method = 24;
+  string path = 25;
+  repeated string path_params = 26;
+  bytes request_payload = 27;
+  bytes response_payload = 28;
+  map<string, string> raw_request_headers = 29;
+  map<string, string> raw_response_headers = 30;
+  // external_request_id is the value of the X-Request-ID header.
+  string external_request_id = 31;
+  string external_correlation_id = 33;
 
   enum Type {
     RPC = 0;
     AUTH = 1;
+    PUBSUB_MSG = 2;
   }
 }
 
@@ -38,22 +70,28 @@ message Event {
     DBQuery query = 3;
     Goroutine goroutine = 4;
     HTTPCall http = 5;
+    LogMessage log = 6;
+    PubsubMsgPublished publishedMsg = 7;
+    ServiceInit service_init = 8;
+    CacheOp cache = 9;
+    BodyStream body_stream = 10;
   }
 }
 
 message RPCCall {
+  reserved 3; // call_loc
   uint64 span_id = 1;
   uint32 goid = 2;
-  int32 call_loc = 3;
   int32 def_loc = 4;
   uint64 start_time = 5;
   uint64 end_time = 6;
   bytes err = 7;
+  StackTrace stack = 8; // where it was called (null if unavailable)
 }
 
 message Goroutine {
+  reserved 2; // call_loc
   uint32 goid = 1;
-  int32 call_loc = 2; // not yet set
   uint64 start_time = 3;
   uint64 end_time = 4;
 }
@@ -61,26 +99,79 @@ message Goroutine {
 message DBTransaction {
   enum CompletionType {
     ROLLBACK = 0;
-    COMMIT = 1; 
+    COMMIT = 1;
   }
 
+  reserved 2, 3; // start_loc, end_loc
+
   uint32 goid = 1;
-  int32 start_loc = 2;
-  int32 end_loc = 3;
   uint64 start_time = 4;
   uint64 end_time = 5;
   bytes err = 6;
   CompletionType completion = 7;
   repeated DBQuery queries = 8;
+  StackTrace begin_stack = 9; // null if unavailable
+  StackTrace end_stack = 10; // null if unavailable
 }
 
 message DBQuery {
+  reserved 2; // call_loc
   uint32 goid = 1;
-  int32 call_loc = 2;
   uint64 start_time = 3;
   uint64 end_time = 4;
   bytes query = 5;
   bytes err = 6;
+  StackTrace stack = 7; // null if unavailable
+}
+
+message PubsubMsgPublished {
+  uint64 goid = 1;
+  uint64 start_time = 3;
+  uint64 end_time = 4;
+  string topic = 5;
+  bytes message = 6;
+  string message_id = 7;
+  bytes err = 8;
+  StackTrace stack = 9;
+}
+
+message ServiceInit {
+  uint64 goid = 1;
+  int32 def_loc = 2;
+  uint64 start_time = 3;
+  uint64 end_time = 4;
+  string service = 5;
+  bytes err = 6;
+  StackTrace err_stack = 7; // null if not an error
+}
+
+message CacheOp {
+  uint32 goid = 1;
+  int32 def_loc = 2;
+  uint64 start_time = 3;
+  uint64 end_time = 4;
+  string operation = 5;
+  repeated string keys = 6;
+  repeated bytes inputs = 7;
+  repeated bytes outputs = 8;
+  StackTrace stack = 9; // null if unavailable
+  bytes err = 10; // set iff result == ERR
+  bool write = 11;
+  Result result = 12;
+
+  enum Result {
+    UNKNOWN = 0;
+    OK = 1;
+    NO_SUCH_KEY = 2;
+    CONFLICT = 3;
+    ERR = 4;
+  }
+}
+
+message BodyStream {
+  bool is_response = 1;
+  bool overflowed = 2;
+  bytes data = 3;
 }
 
 message HTTPCall {
@@ -177,4 +268,61 @@ message HTTPTLSHandshakeDoneData {
 
 message HTTPWroteRequestData {
   bytes err = 1;
-}
\ No newline at end of file
+}
+
+message LogMessage {
+  // Note: These values don't match the values used by the binary trace protocol,
+  // as these values are stored in persisted traces and therefore must maintain
+  // backwards compatibility. The binary trace protocol is versioned and doesn't
+  // have the same limitations.
+  enum Level {
+    DEBUG = 0;
+    INFO = 1;
+    ERROR = 2;
+    WARN = 3;
+    TRACE = 4;
+  }
+
+  uint64 span_id = 1;
+  uint32 goid = 2;
+  uint64 time = 3;
+  Level level = 4;
+  string msg = 5;
+  repeated LogField fields = 6;
+  StackTrace stack = 7; // null if unavailable
+}
+
+message LogField {
+  string key = 1;
+
+  oneof value {
+    string error_without_stack = 2; // deprecated: use error_with_stack
+    ErrWithStack error_with_stack = 13;
+    string str = 3;
+    bool bool = 4;
+    google.protobuf.Timestamp time = 5;
+    int64 dur = 6;
+    bytes uuid = 7;
+    bytes json = 8;
+    int64 int = 9;
+    uint64 uint = 10;
+    float float32 = 11;
+    double float64 = 12;
+  }
+}
+
+message ErrWithStack {
+  string error = 1;
+  StackTrace stack = 2;
+}
+
+message StackTrace {
+  repeated int64 pcs = 1;
+  repeated StackFrame frames = 2;
+}
+
+message StackFrame {
+  string filename = 1;
+  string func = 2;
+  int32 line = 3;
+}
diff --git a/proto/encore/engine/trace/trace_util.go b/proto/encore/engine/trace/trace_util.go
new file mode 100644
index 0000000000..5933c0a48d
--- /dev/null
+++ b/proto/encore/engine/trace/trace_util.go
@@ -0,0 +1,5 @@
+package trace
+
+func (id *TraceID) IsZero() bool {
+	return id == nil || (id.Low == 0 && id.High == 0)
+}
diff --git a/proto/encore/engine/trace2/trace2.pb.go b/proto/encore/engine/trace2/trace2.pb.go
new file mode 100644
index 0000000000..0ceca01e45
--- /dev/null
+++ b/proto/encore/engine/trace2/trace2.pb.go
@@ -0,0 +1,7291 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.23.4
+// source: encore/engine/trace2/trace2.proto
+
+package trace2
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type HTTPTraceEventCode int32
+
+const (
+	HTTPTraceEventCode_UNKNOWN                 HTTPTraceEventCode = 0
+	HTTPTraceEventCode_GET_CONN                HTTPTraceEventCode = 1
+	HTTPTraceEventCode_GOT_CONN                HTTPTraceEventCode = 2
+	HTTPTraceEventCode_GOT_FIRST_RESPONSE_BYTE HTTPTraceEventCode = 3
+	HTTPTraceEventCode_GOT_1XX_RESPONSE        HTTPTraceEventCode = 4
+	HTTPTraceEventCode_DNS_START               HTTPTraceEventCode = 5
+	HTTPTraceEventCode_DNS_DONE                HTTPTraceEventCode = 6
+	HTTPTraceEventCode_CONNECT_START           HTTPTraceEventCode = 7
+	HTTPTraceEventCode_CONNECT_DONE            HTTPTraceEventCode = 8
+	HTTPTraceEventCode_TLS_HANDSHAKE_START     HTTPTraceEventCode = 9
+	HTTPTraceEventCode_TLS_HANDSHAKE_DONE      HTTPTraceEventCode = 10
+	HTTPTraceEventCode_WROTE_HEADERS           HTTPTraceEventCode = 11
+	HTTPTraceEventCode_WROTE_REQUEST           HTTPTraceEventCode = 12
+	HTTPTraceEventCode_WAIT_100_CONTINUE       HTTPTraceEventCode = 13
+	HTTPTraceEventCode_CLOSED_BODY             HTTPTraceEventCode = 14
+)
+
+// Enum value maps for HTTPTraceEventCode.
+var (
+	HTTPTraceEventCode_name = map[int32]string{
+		0:  "UNKNOWN",
+		1:  "GET_CONN",
+		2:  "GOT_CONN",
+		3:  "GOT_FIRST_RESPONSE_BYTE",
+		4:  "GOT_1XX_RESPONSE",
+		5:  "DNS_START",
+		6:  "DNS_DONE",
+		7:  "CONNECT_START",
+		8:  "CONNECT_DONE",
+		9:  "TLS_HANDSHAKE_START",
+		10: "TLS_HANDSHAKE_DONE",
+		11: "WROTE_HEADERS",
+		12: "WROTE_REQUEST",
+		13: "WAIT_100_CONTINUE",
+		14: "CLOSED_BODY",
+	}
+	HTTPTraceEventCode_value = map[string]int32{
+		"UNKNOWN":                 0,
+		"GET_CONN":                1,
+		"GOT_CONN":                2,
+		"GOT_FIRST_RESPONSE_BYTE": 3,
+		"GOT_1XX_RESPONSE":        4,
+		"DNS_START":               5,
+		"DNS_DONE":                6,
+		"CONNECT_START":           7,
+		"CONNECT_DONE":            8,
+		"TLS_HANDSHAKE_START":     9,
+		"TLS_HANDSHAKE_DONE":      10,
+		"WROTE_HEADERS":           11,
+		"WROTE_REQUEST":           12,
+		"WAIT_100_CONTINUE":       13,
+		"CLOSED_BODY":             14,
+	}
+)
+
+func (x HTTPTraceEventCode) Enum() *HTTPTraceEventCode {
+	p := new(HTTPTraceEventCode)
+	*p = x
+	return p
+}
+
+func (x HTTPTraceEventCode) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (HTTPTraceEventCode) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_engine_trace2_trace2_proto_enumTypes[0].Descriptor()
+}
+
+func (HTTPTraceEventCode) Type() protoreflect.EnumType {
+	return &file_encore_engine_trace2_trace2_proto_enumTypes[0]
+}
+
+func (x HTTPTraceEventCode) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use HTTPTraceEventCode.Descriptor instead.
+func (HTTPTraceEventCode) EnumDescriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{0}
+}
+
+type SpanSummary_SpanType int32
+
+const (
+	SpanSummary_UNKNOWN        SpanSummary_SpanType = 0
+	SpanSummary_REQUEST        SpanSummary_SpanType = 1
+	SpanSummary_AUTH           SpanSummary_SpanType = 2
+	SpanSummary_PUBSUB_MESSAGE SpanSummary_SpanType = 3
+	SpanSummary_TEST           SpanSummary_SpanType = 4
+)
+
+// Enum value maps for SpanSummary_SpanType.
+var (
+	SpanSummary_SpanType_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "REQUEST",
+		2: "AUTH",
+		3: "PUBSUB_MESSAGE",
+		4: "TEST",
+	}
+	SpanSummary_SpanType_value = map[string]int32{
+		"UNKNOWN":        0,
+		"REQUEST":        1,
+		"AUTH":           2,
+		"PUBSUB_MESSAGE": 3,
+		"TEST":           4,
+	}
+)
+
+func (x SpanSummary_SpanType) Enum() *SpanSummary_SpanType {
+	p := new(SpanSummary_SpanType)
+	*p = x
+	return p
+}
+
+func (x SpanSummary_SpanType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (SpanSummary_SpanType) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_engine_trace2_trace2_proto_enumTypes[1].Descriptor()
+}
+
+func (SpanSummary_SpanType) Type() protoreflect.EnumType {
+	return &file_encore_engine_trace2_trace2_proto_enumTypes[1]
+}
+
+func (x SpanSummary_SpanType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use SpanSummary_SpanType.Descriptor instead.
+func (SpanSummary_SpanType) EnumDescriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type DBTransactionEnd_CompletionType int32
+
+const (
+	DBTransactionEnd_ROLLBACK DBTransactionEnd_CompletionType = 0
+	DBTransactionEnd_COMMIT   DBTransactionEnd_CompletionType = 1
+)
+
+// Enum value maps for DBTransactionEnd_CompletionType.
+var (
+	DBTransactionEnd_CompletionType_name = map[int32]string{
+		0: "ROLLBACK",
+		1: "COMMIT",
+	}
+	DBTransactionEnd_CompletionType_value = map[string]int32{
+		"ROLLBACK": 0,
+		"COMMIT":   1,
+	}
+)
+
+func (x DBTransactionEnd_CompletionType) Enum() *DBTransactionEnd_CompletionType {
+	p := new(DBTransactionEnd_CompletionType)
+	*p = x
+	return p
+}
+
+func (x DBTransactionEnd_CompletionType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (DBTransactionEnd_CompletionType) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_engine_trace2_trace2_proto_enumTypes[2].Descriptor()
+}
+
+func (DBTransactionEnd_CompletionType) Type() protoreflect.EnumType {
+	return &file_encore_engine_trace2_trace2_proto_enumTypes[2]
+}
+
+func (x DBTransactionEnd_CompletionType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use DBTransactionEnd_CompletionType.Descriptor instead.
+func (DBTransactionEnd_CompletionType) EnumDescriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{20, 0}
+}
+
+type CacheCallEnd_Result int32
+
+const (
+	CacheCallEnd_UNKNOWN     CacheCallEnd_Result = 0
+	CacheCallEnd_OK          CacheCallEnd_Result = 1
+	CacheCallEnd_NO_SUCH_KEY CacheCallEnd_Result = 2
+	CacheCallEnd_CONFLICT    CacheCallEnd_Result = 3
+	CacheCallEnd_ERR         CacheCallEnd_Result = 4
+)
+
+// Enum value maps for CacheCallEnd_Result.
+var (
+	CacheCallEnd_Result_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "OK",
+		2: "NO_SUCH_KEY",
+		3: "CONFLICT",
+		4: "ERR",
+	}
+	CacheCallEnd_Result_value = map[string]int32{
+		"UNKNOWN":     0,
+		"OK":          1,
+		"NO_SUCH_KEY": 2,
+		"CONFLICT":    3,
+		"ERR":         4,
+	}
+)
+
+func (x CacheCallEnd_Result) Enum() *CacheCallEnd_Result {
+	p := new(CacheCallEnd_Result)
+	*p = x
+	return p
+}
+
+func (x CacheCallEnd_Result) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (CacheCallEnd_Result) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_engine_trace2_trace2_proto_enumTypes[3].Descriptor()
+}
+
+func (CacheCallEnd_Result) Type() protoreflect.EnumType {
+	return &file_encore_engine_trace2_trace2_proto_enumTypes[3]
+}
+
+func (x CacheCallEnd_Result) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use CacheCallEnd_Result.Descriptor instead.
+func (CacheCallEnd_Result) EnumDescriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{28, 0}
+}
+
+// Note: These values don't match the values used by the binary trace protocol,
+// as these values are stored in persisted traces and therefore must maintain
+// backwards compatibility. The binary trace protocol is versioned and doesn't
+// have the same limitations.
+type LogMessage_Level int32
+
+const (
+	LogMessage_DEBUG LogMessage_Level = 0
+	LogMessage_INFO  LogMessage_Level = 1
+	LogMessage_ERROR LogMessage_Level = 2
+	LogMessage_WARN  LogMessage_Level = 3
+	LogMessage_TRACE LogMessage_Level = 4
+)
+
+// Enum value maps for LogMessage_Level.
+var (
+	LogMessage_Level_name = map[int32]string{
+		0: "DEBUG",
+		1: "INFO",
+		2: "ERROR",
+		3: "WARN",
+		4: "TRACE",
+	}
+	LogMessage_Level_value = map[string]int32{
+		"DEBUG": 0,
+		"INFO":  1,
+		"ERROR": 2,
+		"WARN":  3,
+		"TRACE": 4,
+	}
+)
+
+func (x LogMessage_Level) Enum() *LogMessage_Level {
+	p := new(LogMessage_Level)
+	*p = x
+	return p
+}
+
+func (x LogMessage_Level) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (LogMessage_Level) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_engine_trace2_trace2_proto_enumTypes[4].Descriptor()
+}
+
+func (LogMessage_Level) Type() protoreflect.EnumType {
+	return &file_encore_engine_trace2_trace2_proto_enumTypes[4]
+}
+
+func (x LogMessage_Level) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use LogMessage_Level.Descriptor instead.
+func (LogMessage_Level) EnumDescriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{60, 0}
+}
+
+// SpanSummary summarizes a span for display purposes.
+type SpanSummary struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TraceId          string                 `protobuf:"bytes,1,opt,name=trace_id,json=traceId,proto3" json:"trace_id,omitempty"`
+	SpanId           string                 `protobuf:"bytes,2,opt,name=span_id,json=spanId,proto3" json:"span_id,omitempty"`
+	Type             SpanSummary_SpanType   `protobuf:"varint,3,opt,name=type,proto3,enum=encore.engine.trace2.SpanSummary_SpanType" json:"type,omitempty"`
+	IsRoot           bool                   `protobuf:"varint,4,opt,name=is_root,json=isRoot,proto3" json:"is_root,omitempty"`                        // whether it's a root request
+	IsError          bool                   `protobuf:"varint,5,opt,name=is_error,json=isError,proto3" json:"is_error,omitempty"`                     // whether the request failed
+	DeployedCommit   string                 `protobuf:"bytes,6,opt,name=deployed_commit,json=deployedCommit,proto3" json:"deployed_commit,omitempty"` // the commit hash of the running service
+	StartedAt        *timestamppb.Timestamp `protobuf:"bytes,7,opt,name=started_at,json=startedAt,proto3" json:"started_at,omitempty"`
+	DurationNanos    uint64                 `protobuf:"varint,8,opt,name=duration_nanos,json=durationNanos,proto3" json:"duration_nanos,omitempty"`
+	ServiceName      string                 `protobuf:"bytes,9,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	EndpointName     *string                `protobuf:"bytes,10,opt,name=endpoint_name,json=endpointName,proto3,oneof" json:"endpoint_name,omitempty"`
+	TopicName        *string                `protobuf:"bytes,11,opt,name=topic_name,json=topicName,proto3,oneof" json:"topic_name,omitempty"`
+	SubscriptionName *string                `protobuf:"bytes,12,opt,name=subscription_name,json=subscriptionName,proto3,oneof" json:"subscription_name,omitempty"`
+	MessageId        *string                `protobuf:"bytes,13,opt,name=message_id,json=messageId,proto3,oneof" json:"message_id,omitempty"`
+	TestSkipped      *bool                  `protobuf:"varint,14,opt,name=test_skipped,json=testSkipped,proto3,oneof" json:"test_skipped,omitempty"` // whether the test was skipped
+	SrcFile          *string                `protobuf:"bytes,15,opt,name=src_file,json=srcFile,proto3,oneof" json:"src_file,omitempty"`              // the source file where the span was started (if available)
+	SrcLine          *uint32                `protobuf:"varint,16,opt,name=src_line,json=srcLine,proto3,oneof" json:"src_line,omitempty"`             // the source line where the span was started (if available)
+}
+
+func (x *SpanSummary) Reset() {
+	*x = SpanSummary{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SpanSummary) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SpanSummary) ProtoMessage() {}
+
+func (x *SpanSummary) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SpanSummary.ProtoReflect.Descriptor instead.
+func (*SpanSummary) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *SpanSummary) GetTraceId() string {
+	if x != nil {
+		return x.TraceId
+	}
+	return ""
+}
+
+func (x *SpanSummary) GetSpanId() string {
+	if x != nil {
+		return x.SpanId
+	}
+	return ""
+}
+
+func (x *SpanSummary) GetType() SpanSummary_SpanType {
+	if x != nil {
+		return x.Type
+	}
+	return SpanSummary_UNKNOWN
+}
+
+func (x *SpanSummary) GetIsRoot() bool {
+	if x != nil {
+		return x.IsRoot
+	}
+	return false
+}
+
+func (x *SpanSummary) GetIsError() bool {
+	if x != nil {
+		return x.IsError
+	}
+	return false
+}
+
+func (x *SpanSummary) GetDeployedCommit() string {
+	if x != nil {
+		return x.DeployedCommit
+	}
+	return ""
+}
+
+func (x *SpanSummary) GetStartedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.StartedAt
+	}
+	return nil
+}
+
+func (x *SpanSummary) GetDurationNanos() uint64 {
+	if x != nil {
+		return x.DurationNanos
+	}
+	return 0
+}
+
+func (x *SpanSummary) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *SpanSummary) GetEndpointName() string {
+	if x != nil && x.EndpointName != nil {
+		return *x.EndpointName
+	}
+	return ""
+}
+
+func (x *SpanSummary) GetTopicName() string {
+	if x != nil && x.TopicName != nil {
+		return *x.TopicName
+	}
+	return ""
+}
+
+func (x *SpanSummary) GetSubscriptionName() string {
+	if x != nil && x.SubscriptionName != nil {
+		return *x.SubscriptionName
+	}
+	return ""
+}
+
+func (x *SpanSummary) GetMessageId() string {
+	if x != nil && x.MessageId != nil {
+		return *x.MessageId
+	}
+	return ""
+}
+
+func (x *SpanSummary) GetTestSkipped() bool {
+	if x != nil && x.TestSkipped != nil {
+		return *x.TestSkipped
+	}
+	return false
+}
+
+func (x *SpanSummary) GetSrcFile() string {
+	if x != nil && x.SrcFile != nil {
+		return *x.SrcFile
+	}
+	return ""
+}
+
+func (x *SpanSummary) GetSrcLine() uint32 {
+	if x != nil && x.SrcLine != nil {
+		return *x.SrcLine
+	}
+	return 0
+}
+
+type TraceID struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	High uint64 `protobuf:"varint,1,opt,name=high,proto3" json:"high,omitempty"`
+	Low  uint64 `protobuf:"varint,2,opt,name=low,proto3" json:"low,omitempty"`
+}
+
+func (x *TraceID) Reset() {
+	*x = TraceID{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TraceID) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TraceID) ProtoMessage() {}
+
+func (x *TraceID) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TraceID.ProtoReflect.Descriptor instead.
+func (*TraceID) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *TraceID) GetHigh() uint64 {
+	if x != nil {
+		return x.High
+	}
+	return 0
+}
+
+func (x *TraceID) GetLow() uint64 {
+	if x != nil {
+		return x.Low
+	}
+	return 0
+}
+
+type EventList struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Events []*TraceEvent `protobuf:"bytes,1,rep,name=events,proto3" json:"events,omitempty"`
+}
+
+func (x *EventList) Reset() {
+	*x = EventList{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EventList) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EventList) ProtoMessage() {}
+
+func (x *EventList) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EventList.ProtoReflect.Descriptor instead.
+func (*EventList) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *EventList) GetEvents() []*TraceEvent {
+	if x != nil {
+		return x.Events
+	}
+	return nil
+}
+
+type TraceEvent struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TraceId   *TraceID               `protobuf:"bytes,1,opt,name=trace_id,json=traceId,proto3" json:"trace_id,omitempty"`
+	SpanId    uint64                 `protobuf:"varint,2,opt,name=span_id,json=spanId,proto3" json:"span_id,omitempty"`
+	EventId   uint64                 `protobuf:"varint,3,opt,name=event_id,json=eventId,proto3" json:"event_id,omitempty"`
+	EventTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=event_time,json=eventTime,proto3" json:"event_time,omitempty"`
+	// Types that are assignable to Event:
+	//
+	//	*TraceEvent_SpanStart
+	//	*TraceEvent_SpanEnd
+	//	*TraceEvent_SpanEvent
+	Event isTraceEvent_Event `protobuf_oneof:"event"`
+}
+
+func (x *TraceEvent) Reset() {
+	*x = TraceEvent{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TraceEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TraceEvent) ProtoMessage() {}
+
+func (x *TraceEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TraceEvent.ProtoReflect.Descriptor instead.
+func (*TraceEvent) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *TraceEvent) GetTraceId() *TraceID {
+	if x != nil {
+		return x.TraceId
+	}
+	return nil
+}
+
+func (x *TraceEvent) GetSpanId() uint64 {
+	if x != nil {
+		return x.SpanId
+	}
+	return 0
+}
+
+func (x *TraceEvent) GetEventId() uint64 {
+	if x != nil {
+		return x.EventId
+	}
+	return 0
+}
+
+func (x *TraceEvent) GetEventTime() *timestamppb.Timestamp {
+	if x != nil {
+		return x.EventTime
+	}
+	return nil
+}
+
+func (m *TraceEvent) GetEvent() isTraceEvent_Event {
+	if m != nil {
+		return m.Event
+	}
+	return nil
+}
+
+func (x *TraceEvent) GetSpanStart() *SpanStart {
+	if x, ok := x.GetEvent().(*TraceEvent_SpanStart); ok {
+		return x.SpanStart
+	}
+	return nil
+}
+
+func (x *TraceEvent) GetSpanEnd() *SpanEnd {
+	if x, ok := x.GetEvent().(*TraceEvent_SpanEnd); ok {
+		return x.SpanEnd
+	}
+	return nil
+}
+
+func (x *TraceEvent) GetSpanEvent() *SpanEvent {
+	if x, ok := x.GetEvent().(*TraceEvent_SpanEvent); ok {
+		return x.SpanEvent
+	}
+	return nil
+}
+
+type isTraceEvent_Event interface {
+	isTraceEvent_Event()
+}
+
+type TraceEvent_SpanStart struct {
+	SpanStart *SpanStart `protobuf:"bytes,10,opt,name=span_start,json=spanStart,proto3,oneof"`
+}
+
+type TraceEvent_SpanEnd struct {
+	SpanEnd *SpanEnd `protobuf:"bytes,11,opt,name=span_end,json=spanEnd,proto3,oneof"`
+}
+
+type TraceEvent_SpanEvent struct {
+	SpanEvent *SpanEvent `protobuf:"bytes,12,opt,name=span_event,json=spanEvent,proto3,oneof"`
+}
+
+func (*TraceEvent_SpanStart) isTraceEvent_Event() {}
+
+func (*TraceEvent_SpanEnd) isTraceEvent_Event() {}
+
+func (*TraceEvent_SpanEvent) isTraceEvent_Event() {}
+
+type SpanStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Goid                  uint32   `protobuf:"varint,1,opt,name=goid,proto3" json:"goid,omitempty"`
+	ParentTraceId         *TraceID `protobuf:"bytes,2,opt,name=parent_trace_id,json=parentTraceId,proto3,oneof" json:"parent_trace_id,omitempty"`
+	ParentSpanId          *uint64  `protobuf:"varint,3,opt,name=parent_span_id,json=parentSpanId,proto3,oneof" json:"parent_span_id,omitempty"`
+	CallerEventId         *uint64  `protobuf:"varint,4,opt,name=caller_event_id,json=callerEventId,proto3,oneof" json:"caller_event_id,omitempty"`
+	ExternalCorrelationId *string  `protobuf:"bytes,5,opt,name=external_correlation_id,json=externalCorrelationId,proto3,oneof" json:"external_correlation_id,omitempty"`
+	DefLoc                *uint32  `protobuf:"varint,6,opt,name=def_loc,json=defLoc,proto3,oneof" json:"def_loc,omitempty"`
+	// Types that are assignable to Data:
+	//
+	//	*SpanStart_Request
+	//	*SpanStart_Auth
+	//	*SpanStart_PubsubMessage
+	//	*SpanStart_Test
+	Data isSpanStart_Data `protobuf_oneof:"data"`
+}
+
+func (x *SpanStart) Reset() {
+	*x = SpanStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SpanStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SpanStart) ProtoMessage() {}
+
+func (x *SpanStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SpanStart.ProtoReflect.Descriptor instead.
+func (*SpanStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *SpanStart) GetGoid() uint32 {
+	if x != nil {
+		return x.Goid
+	}
+	return 0
+}
+
+func (x *SpanStart) GetParentTraceId() *TraceID {
+	if x != nil {
+		return x.ParentTraceId
+	}
+	return nil
+}
+
+func (x *SpanStart) GetParentSpanId() uint64 {
+	if x != nil && x.ParentSpanId != nil {
+		return *x.ParentSpanId
+	}
+	return 0
+}
+
+func (x *SpanStart) GetCallerEventId() uint64 {
+	if x != nil && x.CallerEventId != nil {
+		return *x.CallerEventId
+	}
+	return 0
+}
+
+func (x *SpanStart) GetExternalCorrelationId() string {
+	if x != nil && x.ExternalCorrelationId != nil {
+		return *x.ExternalCorrelationId
+	}
+	return ""
+}
+
+func (x *SpanStart) GetDefLoc() uint32 {
+	if x != nil && x.DefLoc != nil {
+		return *x.DefLoc
+	}
+	return 0
+}
+
+func (m *SpanStart) GetData() isSpanStart_Data {
+	if m != nil {
+		return m.Data
+	}
+	return nil
+}
+
+func (x *SpanStart) GetRequest() *RequestSpanStart {
+	if x, ok := x.GetData().(*SpanStart_Request); ok {
+		return x.Request
+	}
+	return nil
+}
+
+func (x *SpanStart) GetAuth() *AuthSpanStart {
+	if x, ok := x.GetData().(*SpanStart_Auth); ok {
+		return x.Auth
+	}
+	return nil
+}
+
+func (x *SpanStart) GetPubsubMessage() *PubsubMessageSpanStart {
+	if x, ok := x.GetData().(*SpanStart_PubsubMessage); ok {
+		return x.PubsubMessage
+	}
+	return nil
+}
+
+func (x *SpanStart) GetTest() *TestSpanStart {
+	if x, ok := x.GetData().(*SpanStart_Test); ok {
+		return x.Test
+	}
+	return nil
+}
+
+type isSpanStart_Data interface {
+	isSpanStart_Data()
+}
+
+type SpanStart_Request struct {
+	Request *RequestSpanStart `protobuf:"bytes,10,opt,name=request,proto3,oneof"`
+}
+
+type SpanStart_Auth struct {
+	Auth *AuthSpanStart `protobuf:"bytes,11,opt,name=auth,proto3,oneof"`
+}
+
+type SpanStart_PubsubMessage struct {
+	PubsubMessage *PubsubMessageSpanStart `protobuf:"bytes,12,opt,name=pubsub_message,json=pubsubMessage,proto3,oneof"`
+}
+
+type SpanStart_Test struct {
+	Test *TestSpanStart `protobuf:"bytes,13,opt,name=test,proto3,oneof"`
+}
+
+func (*SpanStart_Request) isSpanStart_Data() {}
+
+func (*SpanStart_Auth) isSpanStart_Data() {}
+
+func (*SpanStart_PubsubMessage) isSpanStart_Data() {}
+
+func (*SpanStart_Test) isSpanStart_Data() {}
+
+type SpanEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	DurationNanos uint64 `protobuf:"varint,1,opt,name=duration_nanos,json=durationNanos,proto3" json:"duration_nanos,omitempty"`
+	Error         *Error `protobuf:"bytes,2,opt,name=error,proto3,oneof" json:"error,omitempty"`
+	// panic_stack is the stack trace if the span ended due to a panic
+	PanicStack    *StackTrace `protobuf:"bytes,3,opt,name=panic_stack,json=panicStack,proto3,oneof" json:"panic_stack,omitempty"`
+	ParentTraceId *TraceID    `protobuf:"bytes,4,opt,name=parent_trace_id,json=parentTraceId,proto3,oneof" json:"parent_trace_id,omitempty"`
+	ParentSpanId  *uint64     `protobuf:"varint,5,opt,name=parent_span_id,json=parentSpanId,proto3,oneof" json:"parent_span_id,omitempty"`
+	// Types that are assignable to Data:
+	//
+	//	*SpanEnd_Request
+	//	*SpanEnd_Auth
+	//	*SpanEnd_PubsubMessage
+	//	*SpanEnd_Test
+	Data isSpanEnd_Data `protobuf_oneof:"data"`
+}
+
+func (x *SpanEnd) Reset() {
+	*x = SpanEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SpanEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SpanEnd) ProtoMessage() {}
+
+func (x *SpanEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SpanEnd.ProtoReflect.Descriptor instead.
+func (*SpanEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *SpanEnd) GetDurationNanos() uint64 {
+	if x != nil {
+		return x.DurationNanos
+	}
+	return 0
+}
+
+func (x *SpanEnd) GetError() *Error {
+	if x != nil {
+		return x.Error
+	}
+	return nil
+}
+
+func (x *SpanEnd) GetPanicStack() *StackTrace {
+	if x != nil {
+		return x.PanicStack
+	}
+	return nil
+}
+
+func (x *SpanEnd) GetParentTraceId() *TraceID {
+	if x != nil {
+		return x.ParentTraceId
+	}
+	return nil
+}
+
+func (x *SpanEnd) GetParentSpanId() uint64 {
+	if x != nil && x.ParentSpanId != nil {
+		return *x.ParentSpanId
+	}
+	return 0
+}
+
+func (m *SpanEnd) GetData() isSpanEnd_Data {
+	if m != nil {
+		return m.Data
+	}
+	return nil
+}
+
+func (x *SpanEnd) GetRequest() *RequestSpanEnd {
+	if x, ok := x.GetData().(*SpanEnd_Request); ok {
+		return x.Request
+	}
+	return nil
+}
+
+func (x *SpanEnd) GetAuth() *AuthSpanEnd {
+	if x, ok := x.GetData().(*SpanEnd_Auth); ok {
+		return x.Auth
+	}
+	return nil
+}
+
+func (x *SpanEnd) GetPubsubMessage() *PubsubMessageSpanEnd {
+	if x, ok := x.GetData().(*SpanEnd_PubsubMessage); ok {
+		return x.PubsubMessage
+	}
+	return nil
+}
+
+func (x *SpanEnd) GetTest() *TestSpanEnd {
+	if x, ok := x.GetData().(*SpanEnd_Test); ok {
+		return x.Test
+	}
+	return nil
+}
+
+type isSpanEnd_Data interface {
+	isSpanEnd_Data()
+}
+
+type SpanEnd_Request struct {
+	Request *RequestSpanEnd `protobuf:"bytes,10,opt,name=request,proto3,oneof"`
+}
+
+type SpanEnd_Auth struct {
+	Auth *AuthSpanEnd `protobuf:"bytes,11,opt,name=auth,proto3,oneof"`
+}
+
+type SpanEnd_PubsubMessage struct {
+	PubsubMessage *PubsubMessageSpanEnd `protobuf:"bytes,12,opt,name=pubsub_message,json=pubsubMessage,proto3,oneof"`
+}
+
+type SpanEnd_Test struct {
+	Test *TestSpanEnd `protobuf:"bytes,13,opt,name=test,proto3,oneof"`
+}
+
+func (*SpanEnd_Request) isSpanEnd_Data() {}
+
+func (*SpanEnd_Auth) isSpanEnd_Data() {}
+
+func (*SpanEnd_PubsubMessage) isSpanEnd_Data() {}
+
+func (*SpanEnd_Test) isSpanEnd_Data() {}
+
+type RequestSpanStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ServiceName      string            `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	EndpointName     string            `protobuf:"bytes,2,opt,name=endpoint_name,json=endpointName,proto3" json:"endpoint_name,omitempty"`
+	HttpMethod       string            `protobuf:"bytes,3,opt,name=http_method,json=httpMethod,proto3" json:"http_method,omitempty"`
+	Path             string            `protobuf:"bytes,4,opt,name=path,proto3" json:"path,omitempty"`
+	PathParams       []string          `protobuf:"bytes,5,rep,name=path_params,json=pathParams,proto3" json:"path_params,omitempty"`
+	RequestHeaders   map[string]string `protobuf:"bytes,6,rep,name=request_headers,json=requestHeaders,proto3" json:"request_headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	RequestPayload   []byte            `protobuf:"bytes,7,opt,name=request_payload,json=requestPayload,proto3,oneof" json:"request_payload,omitempty"`
+	ExtCorrelationId *string           `protobuf:"bytes,8,opt,name=ext_correlation_id,json=extCorrelationId,proto3,oneof" json:"ext_correlation_id,omitempty"`
+	Uid              *string           `protobuf:"bytes,9,opt,name=uid,proto3,oneof" json:"uid,omitempty"`
+	// mocked is true if the request was handled by a mock
+	Mocked bool `protobuf:"varint,10,opt,name=mocked,proto3" json:"mocked,omitempty"`
+}
+
+func (x *RequestSpanStart) Reset() {
+	*x = RequestSpanStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RequestSpanStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestSpanStart) ProtoMessage() {}
+
+func (x *RequestSpanStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestSpanStart.ProtoReflect.Descriptor instead.
+func (*RequestSpanStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *RequestSpanStart) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *RequestSpanStart) GetEndpointName() string {
+	if x != nil {
+		return x.EndpointName
+	}
+	return ""
+}
+
+func (x *RequestSpanStart) GetHttpMethod() string {
+	if x != nil {
+		return x.HttpMethod
+	}
+	return ""
+}
+
+func (x *RequestSpanStart) GetPath() string {
+	if x != nil {
+		return x.Path
+	}
+	return ""
+}
+
+func (x *RequestSpanStart) GetPathParams() []string {
+	if x != nil {
+		return x.PathParams
+	}
+	return nil
+}
+
+func (x *RequestSpanStart) GetRequestHeaders() map[string]string {
+	if x != nil {
+		return x.RequestHeaders
+	}
+	return nil
+}
+
+func (x *RequestSpanStart) GetRequestPayload() []byte {
+	if x != nil {
+		return x.RequestPayload
+	}
+	return nil
+}
+
+func (x *RequestSpanStart) GetExtCorrelationId() string {
+	if x != nil && x.ExtCorrelationId != nil {
+		return *x.ExtCorrelationId
+	}
+	return ""
+}
+
+func (x *RequestSpanStart) GetUid() string {
+	if x != nil && x.Uid != nil {
+		return *x.Uid
+	}
+	return ""
+}
+
+func (x *RequestSpanStart) GetMocked() bool {
+	if x != nil {
+		return x.Mocked
+	}
+	return false
+}
+
+type RequestSpanEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Repeat service/endpoint name here to make it possible
+	// to consume end events without having to look up the start.
+	ServiceName     string            `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	EndpointName    string            `protobuf:"bytes,2,opt,name=endpoint_name,json=endpointName,proto3" json:"endpoint_name,omitempty"`
+	HttpStatusCode  uint32            `protobuf:"varint,3,opt,name=http_status_code,json=httpStatusCode,proto3" json:"http_status_code,omitempty"`
+	ResponseHeaders map[string]string `protobuf:"bytes,4,rep,name=response_headers,json=responseHeaders,proto3" json:"response_headers,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	ResponsePayload []byte            `protobuf:"bytes,5,opt,name=response_payload,json=responsePayload,proto3,oneof" json:"response_payload,omitempty"`
+}
+
+func (x *RequestSpanEnd) Reset() {
+	*x = RequestSpanEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RequestSpanEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RequestSpanEnd) ProtoMessage() {}
+
+func (x *RequestSpanEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RequestSpanEnd.ProtoReflect.Descriptor instead.
+func (*RequestSpanEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *RequestSpanEnd) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *RequestSpanEnd) GetEndpointName() string {
+	if x != nil {
+		return x.EndpointName
+	}
+	return ""
+}
+
+func (x *RequestSpanEnd) GetHttpStatusCode() uint32 {
+	if x != nil {
+		return x.HttpStatusCode
+	}
+	return 0
+}
+
+func (x *RequestSpanEnd) GetResponseHeaders() map[string]string {
+	if x != nil {
+		return x.ResponseHeaders
+	}
+	return nil
+}
+
+func (x *RequestSpanEnd) GetResponsePayload() []byte {
+	if x != nil {
+		return x.ResponsePayload
+	}
+	return nil
+}
+
+type AuthSpanStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ServiceName  string `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	EndpointName string `protobuf:"bytes,2,opt,name=endpoint_name,json=endpointName,proto3" json:"endpoint_name,omitempty"`
+	AuthPayload  []byte `protobuf:"bytes,3,opt,name=auth_payload,json=authPayload,proto3,oneof" json:"auth_payload,omitempty"`
+}
+
+func (x *AuthSpanStart) Reset() {
+	*x = AuthSpanStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthSpanStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthSpanStart) ProtoMessage() {}
+
+func (x *AuthSpanStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthSpanStart.ProtoReflect.Descriptor instead.
+func (*AuthSpanStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *AuthSpanStart) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *AuthSpanStart) GetEndpointName() string {
+	if x != nil {
+		return x.EndpointName
+	}
+	return ""
+}
+
+func (x *AuthSpanStart) GetAuthPayload() []byte {
+	if x != nil {
+		return x.AuthPayload
+	}
+	return nil
+}
+
+type AuthSpanEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Repeat service/endpoint name here to make it possible
+	// to consume end events without having to look up the start.
+	ServiceName  string `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	EndpointName string `protobuf:"bytes,2,opt,name=endpoint_name,json=endpointName,proto3" json:"endpoint_name,omitempty"`
+	Uid          string `protobuf:"bytes,3,opt,name=uid,proto3" json:"uid,omitempty"`
+	UserData     []byte `protobuf:"bytes,4,opt,name=user_data,json=userData,proto3,oneof" json:"user_data,omitempty"`
+}
+
+func (x *AuthSpanEnd) Reset() {
+	*x = AuthSpanEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AuthSpanEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthSpanEnd) ProtoMessage() {}
+
+func (x *AuthSpanEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthSpanEnd.ProtoReflect.Descriptor instead.
+func (*AuthSpanEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *AuthSpanEnd) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *AuthSpanEnd) GetEndpointName() string {
+	if x != nil {
+		return x.EndpointName
+	}
+	return ""
+}
+
+func (x *AuthSpanEnd) GetUid() string {
+	if x != nil {
+		return x.Uid
+	}
+	return ""
+}
+
+func (x *AuthSpanEnd) GetUserData() []byte {
+	if x != nil {
+		return x.UserData
+	}
+	return nil
+}
+
+type PubsubMessageSpanStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ServiceName      string                 `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	TopicName        string                 `protobuf:"bytes,2,opt,name=topic_name,json=topicName,proto3" json:"topic_name,omitempty"`
+	SubscriptionName string                 `protobuf:"bytes,3,opt,name=subscription_name,json=subscriptionName,proto3" json:"subscription_name,omitempty"`
+	MessageId        string                 `protobuf:"bytes,4,opt,name=message_id,json=messageId,proto3" json:"message_id,omitempty"`
+	Attempt          uint32                 `protobuf:"varint,5,opt,name=attempt,proto3" json:"attempt,omitempty"`
+	PublishTime      *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=publish_time,json=publishTime,proto3" json:"publish_time,omitempty"`
+	MessagePayload   []byte                 `protobuf:"bytes,7,opt,name=message_payload,json=messagePayload,proto3,oneof" json:"message_payload,omitempty"`
+}
+
+func (x *PubsubMessageSpanStart) Reset() {
+	*x = PubsubMessageSpanStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubsubMessageSpanStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubsubMessageSpanStart) ProtoMessage() {}
+
+func (x *PubsubMessageSpanStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubsubMessageSpanStart.ProtoReflect.Descriptor instead.
+func (*PubsubMessageSpanStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *PubsubMessageSpanStart) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *PubsubMessageSpanStart) GetTopicName() string {
+	if x != nil {
+		return x.TopicName
+	}
+	return ""
+}
+
+func (x *PubsubMessageSpanStart) GetSubscriptionName() string {
+	if x != nil {
+		return x.SubscriptionName
+	}
+	return ""
+}
+
+func (x *PubsubMessageSpanStart) GetMessageId() string {
+	if x != nil {
+		return x.MessageId
+	}
+	return ""
+}
+
+func (x *PubsubMessageSpanStart) GetAttempt() uint32 {
+	if x != nil {
+		return x.Attempt
+	}
+	return 0
+}
+
+func (x *PubsubMessageSpanStart) GetPublishTime() *timestamppb.Timestamp {
+	if x != nil {
+		return x.PublishTime
+	}
+	return nil
+}
+
+func (x *PubsubMessageSpanStart) GetMessagePayload() []byte {
+	if x != nil {
+		return x.MessagePayload
+	}
+	return nil
+}
+
+type PubsubMessageSpanEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Repeat service/topic/subscription name here to make it possible
+	// to consume end events without having to look up the start.
+	ServiceName      string `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	TopicName        string `protobuf:"bytes,2,opt,name=topic_name,json=topicName,proto3" json:"topic_name,omitempty"`
+	SubscriptionName string `protobuf:"bytes,3,opt,name=subscription_name,json=subscriptionName,proto3" json:"subscription_name,omitempty"`
+}
+
+func (x *PubsubMessageSpanEnd) Reset() {
+	*x = PubsubMessageSpanEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubsubMessageSpanEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubsubMessageSpanEnd) ProtoMessage() {}
+
+func (x *PubsubMessageSpanEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubsubMessageSpanEnd.ProtoReflect.Descriptor instead.
+func (*PubsubMessageSpanEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *PubsubMessageSpanEnd) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *PubsubMessageSpanEnd) GetTopicName() string {
+	if x != nil {
+		return x.TopicName
+	}
+	return ""
+}
+
+func (x *PubsubMessageSpanEnd) GetSubscriptionName() string {
+	if x != nil {
+		return x.SubscriptionName
+	}
+	return ""
+}
+
+type TestSpanStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ServiceName string `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	TestName    string `protobuf:"bytes,2,opt,name=test_name,json=testName,proto3" json:"test_name,omitempty"`
+	Uid         string `protobuf:"bytes,3,opt,name=uid,proto3" json:"uid,omitempty"`
+	TestFile    string `protobuf:"bytes,4,opt,name=test_file,json=testFile,proto3" json:"test_file,omitempty"`
+	TestLine    uint32 `protobuf:"varint,5,opt,name=test_line,json=testLine,proto3" json:"test_line,omitempty"`
+}
+
+func (x *TestSpanStart) Reset() {
+	*x = TestSpanStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TestSpanStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TestSpanStart) ProtoMessage() {}
+
+func (x *TestSpanStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TestSpanStart.ProtoReflect.Descriptor instead.
+func (*TestSpanStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *TestSpanStart) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *TestSpanStart) GetTestName() string {
+	if x != nil {
+		return x.TestName
+	}
+	return ""
+}
+
+func (x *TestSpanStart) GetUid() string {
+	if x != nil {
+		return x.Uid
+	}
+	return ""
+}
+
+func (x *TestSpanStart) GetTestFile() string {
+	if x != nil {
+		return x.TestFile
+	}
+	return ""
+}
+
+func (x *TestSpanStart) GetTestLine() uint32 {
+	if x != nil {
+		return x.TestLine
+	}
+	return 0
+}
+
+type TestSpanEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ServiceName string `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	TestName    string `protobuf:"bytes,2,opt,name=test_name,json=testName,proto3" json:"test_name,omitempty"`
+	Failed      bool   `protobuf:"varint,3,opt,name=failed,proto3" json:"failed,omitempty"`
+	Skipped     bool   `protobuf:"varint,4,opt,name=skipped,proto3" json:"skipped,omitempty"`
+}
+
+func (x *TestSpanEnd) Reset() {
+	*x = TestSpanEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TestSpanEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TestSpanEnd) ProtoMessage() {}
+
+func (x *TestSpanEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TestSpanEnd.ProtoReflect.Descriptor instead.
+func (*TestSpanEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *TestSpanEnd) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *TestSpanEnd) GetTestName() string {
+	if x != nil {
+		return x.TestName
+	}
+	return ""
+}
+
+func (x *TestSpanEnd) GetFailed() bool {
+	if x != nil {
+		return x.Failed
+	}
+	return false
+}
+
+func (x *TestSpanEnd) GetSkipped() bool {
+	if x != nil {
+		return x.Skipped
+	}
+	return false
+}
+
+type SpanEvent struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Goid   uint32  `protobuf:"varint,1,opt,name=goid,proto3" json:"goid,omitempty"`
+	DefLoc *uint32 `protobuf:"varint,2,opt,name=def_loc,json=defLoc,proto3,oneof" json:"def_loc,omitempty"`
+	// correlation_event_id is the other event
+	// this event is correlated with.
+	CorrelationEventId *uint64 `protobuf:"varint,3,opt,name=correlation_event_id,json=correlationEventId,proto3,oneof" json:"correlation_event_id,omitempty"`
+	// Types that are assignable to Data:
+	//
+	//	*SpanEvent_LogMessage
+	//	*SpanEvent_BodyStream
+	//	*SpanEvent_RpcCallStart
+	//	*SpanEvent_RpcCallEnd
+	//	*SpanEvent_DbTransactionStart
+	//	*SpanEvent_DbTransactionEnd
+	//	*SpanEvent_DbQueryStart
+	//	*SpanEvent_DbQueryEnd
+	//	*SpanEvent_HttpCallStart
+	//	*SpanEvent_HttpCallEnd
+	//	*SpanEvent_PubsubPublishStart
+	//	*SpanEvent_PubsubPublishEnd
+	//	*SpanEvent_CacheCallStart
+	//	*SpanEvent_CacheCallEnd
+	//	*SpanEvent_ServiceInitStart
+	//	*SpanEvent_ServiceInitEnd
+	//	*SpanEvent_BucketObjectUploadStart
+	//	*SpanEvent_BucketObjectUploadEnd
+	//	*SpanEvent_BucketObjectDownloadStart
+	//	*SpanEvent_BucketObjectDownloadEnd
+	//	*SpanEvent_BucketObjectGetAttrsStart
+	//	*SpanEvent_BucketObjectGetAttrsEnd
+	//	*SpanEvent_BucketListObjectsStart
+	//	*SpanEvent_BucketListObjectsEnd
+	//	*SpanEvent_BucketDeleteObjectsStart
+	//	*SpanEvent_BucketDeleteObjectsEnd
+	Data isSpanEvent_Data `protobuf_oneof:"data"`
+}
+
+func (x *SpanEvent) Reset() {
+	*x = SpanEvent{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SpanEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SpanEvent) ProtoMessage() {}
+
+func (x *SpanEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SpanEvent.ProtoReflect.Descriptor instead.
+func (*SpanEvent) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *SpanEvent) GetGoid() uint32 {
+	if x != nil {
+		return x.Goid
+	}
+	return 0
+}
+
+func (x *SpanEvent) GetDefLoc() uint32 {
+	if x != nil && x.DefLoc != nil {
+		return *x.DefLoc
+	}
+	return 0
+}
+
+func (x *SpanEvent) GetCorrelationEventId() uint64 {
+	if x != nil && x.CorrelationEventId != nil {
+		return *x.CorrelationEventId
+	}
+	return 0
+}
+
+func (m *SpanEvent) GetData() isSpanEvent_Data {
+	if m != nil {
+		return m.Data
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetLogMessage() *LogMessage {
+	if x, ok := x.GetData().(*SpanEvent_LogMessage); ok {
+		return x.LogMessage
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetBodyStream() *BodyStream {
+	if x, ok := x.GetData().(*SpanEvent_BodyStream); ok {
+		return x.BodyStream
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetRpcCallStart() *RPCCallStart {
+	if x, ok := x.GetData().(*SpanEvent_RpcCallStart); ok {
+		return x.RpcCallStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetRpcCallEnd() *RPCCallEnd {
+	if x, ok := x.GetData().(*SpanEvent_RpcCallEnd); ok {
+		return x.RpcCallEnd
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetDbTransactionStart() *DBTransactionStart {
+	if x, ok := x.GetData().(*SpanEvent_DbTransactionStart); ok {
+		return x.DbTransactionStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetDbTransactionEnd() *DBTransactionEnd {
+	if x, ok := x.GetData().(*SpanEvent_DbTransactionEnd); ok {
+		return x.DbTransactionEnd
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetDbQueryStart() *DBQueryStart {
+	if x, ok := x.GetData().(*SpanEvent_DbQueryStart); ok {
+		return x.DbQueryStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetDbQueryEnd() *DBQueryEnd {
+	if x, ok := x.GetData().(*SpanEvent_DbQueryEnd); ok {
+		return x.DbQueryEnd
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetHttpCallStart() *HTTPCallStart {
+	if x, ok := x.GetData().(*SpanEvent_HttpCallStart); ok {
+		return x.HttpCallStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetHttpCallEnd() *HTTPCallEnd {
+	if x, ok := x.GetData().(*SpanEvent_HttpCallEnd); ok {
+		return x.HttpCallEnd
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetPubsubPublishStart() *PubsubPublishStart {
+	if x, ok := x.GetData().(*SpanEvent_PubsubPublishStart); ok {
+		return x.PubsubPublishStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetPubsubPublishEnd() *PubsubPublishEnd {
+	if x, ok := x.GetData().(*SpanEvent_PubsubPublishEnd); ok {
+		return x.PubsubPublishEnd
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetCacheCallStart() *CacheCallStart {
+	if x, ok := x.GetData().(*SpanEvent_CacheCallStart); ok {
+		return x.CacheCallStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetCacheCallEnd() *CacheCallEnd {
+	if x, ok := x.GetData().(*SpanEvent_CacheCallEnd); ok {
+		return x.CacheCallEnd
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetServiceInitStart() *ServiceInitStart {
+	if x, ok := x.GetData().(*SpanEvent_ServiceInitStart); ok {
+		return x.ServiceInitStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetServiceInitEnd() *ServiceInitEnd {
+	if x, ok := x.GetData().(*SpanEvent_ServiceInitEnd); ok {
+		return x.ServiceInitEnd
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetBucketObjectUploadStart() *BucketObjectUploadStart {
+	if x, ok := x.GetData().(*SpanEvent_BucketObjectUploadStart); ok {
+		return x.BucketObjectUploadStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetBucketObjectUploadEnd() *BucketObjectUploadEnd {
+	if x, ok := x.GetData().(*SpanEvent_BucketObjectUploadEnd); ok {
+		return x.BucketObjectUploadEnd
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetBucketObjectDownloadStart() *BucketObjectDownloadStart {
+	if x, ok := x.GetData().(*SpanEvent_BucketObjectDownloadStart); ok {
+		return x.BucketObjectDownloadStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetBucketObjectDownloadEnd() *BucketObjectDownloadEnd {
+	if x, ok := x.GetData().(*SpanEvent_BucketObjectDownloadEnd); ok {
+		return x.BucketObjectDownloadEnd
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetBucketObjectGetAttrsStart() *BucketObjectGetAttrsStart {
+	if x, ok := x.GetData().(*SpanEvent_BucketObjectGetAttrsStart); ok {
+		return x.BucketObjectGetAttrsStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetBucketObjectGetAttrsEnd() *BucketObjectGetAttrsEnd {
+	if x, ok := x.GetData().(*SpanEvent_BucketObjectGetAttrsEnd); ok {
+		return x.BucketObjectGetAttrsEnd
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetBucketListObjectsStart() *BucketListObjectsStart {
+	if x, ok := x.GetData().(*SpanEvent_BucketListObjectsStart); ok {
+		return x.BucketListObjectsStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetBucketListObjectsEnd() *BucketListObjectsEnd {
+	if x, ok := x.GetData().(*SpanEvent_BucketListObjectsEnd); ok {
+		return x.BucketListObjectsEnd
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetBucketDeleteObjectsStart() *BucketDeleteObjectsStart {
+	if x, ok := x.GetData().(*SpanEvent_BucketDeleteObjectsStart); ok {
+		return x.BucketDeleteObjectsStart
+	}
+	return nil
+}
+
+func (x *SpanEvent) GetBucketDeleteObjectsEnd() *BucketDeleteObjectsEnd {
+	if x, ok := x.GetData().(*SpanEvent_BucketDeleteObjectsEnd); ok {
+		return x.BucketDeleteObjectsEnd
+	}
+	return nil
+}
+
+type isSpanEvent_Data interface {
+	isSpanEvent_Data()
+}
+
+type SpanEvent_LogMessage struct {
+	LogMessage *LogMessage `protobuf:"bytes,10,opt,name=log_message,json=logMessage,proto3,oneof"`
+}
+
+type SpanEvent_BodyStream struct {
+	BodyStream *BodyStream `protobuf:"bytes,11,opt,name=body_stream,json=bodyStream,proto3,oneof"`
+}
+
+type SpanEvent_RpcCallStart struct {
+	RpcCallStart *RPCCallStart `protobuf:"bytes,12,opt,name=rpc_call_start,json=rpcCallStart,proto3,oneof"`
+}
+
+type SpanEvent_RpcCallEnd struct {
+	RpcCallEnd *RPCCallEnd `protobuf:"bytes,13,opt,name=rpc_call_end,json=rpcCallEnd,proto3,oneof"`
+}
+
+type SpanEvent_DbTransactionStart struct {
+	DbTransactionStart *DBTransactionStart `protobuf:"bytes,14,opt,name=db_transaction_start,json=dbTransactionStart,proto3,oneof"`
+}
+
+type SpanEvent_DbTransactionEnd struct {
+	DbTransactionEnd *DBTransactionEnd `protobuf:"bytes,15,opt,name=db_transaction_end,json=dbTransactionEnd,proto3,oneof"`
+}
+
+type SpanEvent_DbQueryStart struct {
+	DbQueryStart *DBQueryStart `protobuf:"bytes,16,opt,name=db_query_start,json=dbQueryStart,proto3,oneof"`
+}
+
+type SpanEvent_DbQueryEnd struct {
+	DbQueryEnd *DBQueryEnd `protobuf:"bytes,17,opt,name=db_query_end,json=dbQueryEnd,proto3,oneof"`
+}
+
+type SpanEvent_HttpCallStart struct {
+	HttpCallStart *HTTPCallStart `protobuf:"bytes,18,opt,name=http_call_start,json=httpCallStart,proto3,oneof"`
+}
+
+type SpanEvent_HttpCallEnd struct {
+	HttpCallEnd *HTTPCallEnd `protobuf:"bytes,19,opt,name=http_call_end,json=httpCallEnd,proto3,oneof"`
+}
+
+type SpanEvent_PubsubPublishStart struct {
+	PubsubPublishStart *PubsubPublishStart `protobuf:"bytes,20,opt,name=pubsub_publish_start,json=pubsubPublishStart,proto3,oneof"`
+}
+
+type SpanEvent_PubsubPublishEnd struct {
+	PubsubPublishEnd *PubsubPublishEnd `protobuf:"bytes,21,opt,name=pubsub_publish_end,json=pubsubPublishEnd,proto3,oneof"`
+}
+
+type SpanEvent_CacheCallStart struct {
+	CacheCallStart *CacheCallStart `protobuf:"bytes,22,opt,name=cache_call_start,json=cacheCallStart,proto3,oneof"`
+}
+
+type SpanEvent_CacheCallEnd struct {
+	CacheCallEnd *CacheCallEnd `protobuf:"bytes,23,opt,name=cache_call_end,json=cacheCallEnd,proto3,oneof"`
+}
+
+type SpanEvent_ServiceInitStart struct {
+	ServiceInitStart *ServiceInitStart `protobuf:"bytes,24,opt,name=service_init_start,json=serviceInitStart,proto3,oneof"`
+}
+
+type SpanEvent_ServiceInitEnd struct {
+	ServiceInitEnd *ServiceInitEnd `protobuf:"bytes,25,opt,name=service_init_end,json=serviceInitEnd,proto3,oneof"`
+}
+
+type SpanEvent_BucketObjectUploadStart struct {
+	BucketObjectUploadStart *BucketObjectUploadStart `protobuf:"bytes,26,opt,name=bucket_object_upload_start,json=bucketObjectUploadStart,proto3,oneof"`
+}
+
+type SpanEvent_BucketObjectUploadEnd struct {
+	BucketObjectUploadEnd *BucketObjectUploadEnd `protobuf:"bytes,27,opt,name=bucket_object_upload_end,json=bucketObjectUploadEnd,proto3,oneof"`
+}
+
+type SpanEvent_BucketObjectDownloadStart struct {
+	BucketObjectDownloadStart *BucketObjectDownloadStart `protobuf:"bytes,28,opt,name=bucket_object_download_start,json=bucketObjectDownloadStart,proto3,oneof"`
+}
+
+type SpanEvent_BucketObjectDownloadEnd struct {
+	BucketObjectDownloadEnd *BucketObjectDownloadEnd `protobuf:"bytes,29,opt,name=bucket_object_download_end,json=bucketObjectDownloadEnd,proto3,oneof"`
+}
+
+type SpanEvent_BucketObjectGetAttrsStart struct {
+	BucketObjectGetAttrsStart *BucketObjectGetAttrsStart `protobuf:"bytes,30,opt,name=bucket_object_get_attrs_start,json=bucketObjectGetAttrsStart,proto3,oneof"`
+}
+
+type SpanEvent_BucketObjectGetAttrsEnd struct {
+	BucketObjectGetAttrsEnd *BucketObjectGetAttrsEnd `protobuf:"bytes,31,opt,name=bucket_object_get_attrs_end,json=bucketObjectGetAttrsEnd,proto3,oneof"`
+}
+
+type SpanEvent_BucketListObjectsStart struct {
+	BucketListObjectsStart *BucketListObjectsStart `protobuf:"bytes,32,opt,name=bucket_list_objects_start,json=bucketListObjectsStart,proto3,oneof"`
+}
+
+type SpanEvent_BucketListObjectsEnd struct {
+	BucketListObjectsEnd *BucketListObjectsEnd `protobuf:"bytes,33,opt,name=bucket_list_objects_end,json=bucketListObjectsEnd,proto3,oneof"`
+}
+
+type SpanEvent_BucketDeleteObjectsStart struct {
+	BucketDeleteObjectsStart *BucketDeleteObjectsStart `protobuf:"bytes,34,opt,name=bucket_delete_objects_start,json=bucketDeleteObjectsStart,proto3,oneof"`
+}
+
+type SpanEvent_BucketDeleteObjectsEnd struct {
+	BucketDeleteObjectsEnd *BucketDeleteObjectsEnd `protobuf:"bytes,35,opt,name=bucket_delete_objects_end,json=bucketDeleteObjectsEnd,proto3,oneof"`
+}
+
+func (*SpanEvent_LogMessage) isSpanEvent_Data() {}
+
+func (*SpanEvent_BodyStream) isSpanEvent_Data() {}
+
+func (*SpanEvent_RpcCallStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_RpcCallEnd) isSpanEvent_Data() {}
+
+func (*SpanEvent_DbTransactionStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_DbTransactionEnd) isSpanEvent_Data() {}
+
+func (*SpanEvent_DbQueryStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_DbQueryEnd) isSpanEvent_Data() {}
+
+func (*SpanEvent_HttpCallStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_HttpCallEnd) isSpanEvent_Data() {}
+
+func (*SpanEvent_PubsubPublishStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_PubsubPublishEnd) isSpanEvent_Data() {}
+
+func (*SpanEvent_CacheCallStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_CacheCallEnd) isSpanEvent_Data() {}
+
+func (*SpanEvent_ServiceInitStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_ServiceInitEnd) isSpanEvent_Data() {}
+
+func (*SpanEvent_BucketObjectUploadStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_BucketObjectUploadEnd) isSpanEvent_Data() {}
+
+func (*SpanEvent_BucketObjectDownloadStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_BucketObjectDownloadEnd) isSpanEvent_Data() {}
+
+func (*SpanEvent_BucketObjectGetAttrsStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_BucketObjectGetAttrsEnd) isSpanEvent_Data() {}
+
+func (*SpanEvent_BucketListObjectsStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_BucketListObjectsEnd) isSpanEvent_Data() {}
+
+func (*SpanEvent_BucketDeleteObjectsStart) isSpanEvent_Data() {}
+
+func (*SpanEvent_BucketDeleteObjectsEnd) isSpanEvent_Data() {}
+
+type RPCCallStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TargetServiceName  string      `protobuf:"bytes,1,opt,name=target_service_name,json=targetServiceName,proto3" json:"target_service_name,omitempty"`
+	TargetEndpointName string      `protobuf:"bytes,2,opt,name=target_endpoint_name,json=targetEndpointName,proto3" json:"target_endpoint_name,omitempty"`
+	Stack              *StackTrace `protobuf:"bytes,3,opt,name=stack,proto3" json:"stack,omitempty"`
+}
+
+func (x *RPCCallStart) Reset() {
+	*x = RPCCallStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RPCCallStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RPCCallStart) ProtoMessage() {}
+
+func (x *RPCCallStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RPCCallStart.ProtoReflect.Descriptor instead.
+func (*RPCCallStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *RPCCallStart) GetTargetServiceName() string {
+	if x != nil {
+		return x.TargetServiceName
+	}
+	return ""
+}
+
+func (x *RPCCallStart) GetTargetEndpointName() string {
+	if x != nil {
+		return x.TargetEndpointName
+	}
+	return ""
+}
+
+func (x *RPCCallStart) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+type RPCCallEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err *Error `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+}
+
+func (x *RPCCallEnd) Reset() {
+	*x = RPCCallEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RPCCallEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RPCCallEnd) ProtoMessage() {}
+
+func (x *RPCCallEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RPCCallEnd.ProtoReflect.Descriptor instead.
+func (*RPCCallEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *RPCCallEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+type GoroutineStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *GoroutineStart) Reset() {
+	*x = GoroutineStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GoroutineStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GoroutineStart) ProtoMessage() {}
+
+func (x *GoroutineStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GoroutineStart.ProtoReflect.Descriptor instead.
+func (*GoroutineStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{17}
+}
+
+type GoroutineEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *GoroutineEnd) Reset() {
+	*x = GoroutineEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GoroutineEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GoroutineEnd) ProtoMessage() {}
+
+func (x *GoroutineEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GoroutineEnd.ProtoReflect.Descriptor instead.
+func (*GoroutineEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{18}
+}
+
+type DBTransactionStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Stack *StackTrace `protobuf:"bytes,1,opt,name=stack,proto3" json:"stack,omitempty"`
+}
+
+func (x *DBTransactionStart) Reset() {
+	*x = DBTransactionStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DBTransactionStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DBTransactionStart) ProtoMessage() {}
+
+func (x *DBTransactionStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DBTransactionStart.ProtoReflect.Descriptor instead.
+func (*DBTransactionStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *DBTransactionStart) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+type DBTransactionEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Completion DBTransactionEnd_CompletionType `protobuf:"varint,1,opt,name=completion,proto3,enum=encore.engine.trace2.DBTransactionEnd_CompletionType" json:"completion,omitempty"`
+	Stack      *StackTrace                     `protobuf:"bytes,2,opt,name=stack,proto3" json:"stack,omitempty"`
+	Err        *Error                          `protobuf:"bytes,3,opt,name=err,proto3,oneof" json:"err,omitempty"`
+}
+
+func (x *DBTransactionEnd) Reset() {
+	*x = DBTransactionEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DBTransactionEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DBTransactionEnd) ProtoMessage() {}
+
+func (x *DBTransactionEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DBTransactionEnd.ProtoReflect.Descriptor instead.
+func (*DBTransactionEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *DBTransactionEnd) GetCompletion() DBTransactionEnd_CompletionType {
+	if x != nil {
+		return x.Completion
+	}
+	return DBTransactionEnd_ROLLBACK
+}
+
+func (x *DBTransactionEnd) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+func (x *DBTransactionEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+type DBQueryStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Query string      `protobuf:"bytes,1,opt,name=query,proto3" json:"query,omitempty"`
+	Stack *StackTrace `protobuf:"bytes,2,opt,name=stack,proto3" json:"stack,omitempty"`
+}
+
+func (x *DBQueryStart) Reset() {
+	*x = DBQueryStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DBQueryStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DBQueryStart) ProtoMessage() {}
+
+func (x *DBQueryStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DBQueryStart.ProtoReflect.Descriptor instead.
+func (*DBQueryStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{21}
+}
+
+func (x *DBQueryStart) GetQuery() string {
+	if x != nil {
+		return x.Query
+	}
+	return ""
+}
+
+func (x *DBQueryStart) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+type DBQueryEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err *Error `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+}
+
+func (x *DBQueryEnd) Reset() {
+	*x = DBQueryEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[22]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DBQueryEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DBQueryEnd) ProtoMessage() {}
+
+func (x *DBQueryEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[22]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DBQueryEnd.ProtoReflect.Descriptor instead.
+func (*DBQueryEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *DBQueryEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+type PubsubPublishStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Topic   string      `protobuf:"bytes,1,opt,name=topic,proto3" json:"topic,omitempty"`
+	Message []byte      `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
+	Stack   *StackTrace `protobuf:"bytes,3,opt,name=stack,proto3" json:"stack,omitempty"`
+}
+
+func (x *PubsubPublishStart) Reset() {
+	*x = PubsubPublishStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[23]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubsubPublishStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubsubPublishStart) ProtoMessage() {}
+
+func (x *PubsubPublishStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[23]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubsubPublishStart.ProtoReflect.Descriptor instead.
+func (*PubsubPublishStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *PubsubPublishStart) GetTopic() string {
+	if x != nil {
+		return x.Topic
+	}
+	return ""
+}
+
+func (x *PubsubPublishStart) GetMessage() []byte {
+	if x != nil {
+		return x.Message
+	}
+	return nil
+}
+
+func (x *PubsubPublishStart) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+type PubsubPublishEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MessageId *string `protobuf:"bytes,1,opt,name=message_id,json=messageId,proto3,oneof" json:"message_id,omitempty"`
+	Err       *Error  `protobuf:"bytes,2,opt,name=err,proto3,oneof" json:"err,omitempty"`
+}
+
+func (x *PubsubPublishEnd) Reset() {
+	*x = PubsubPublishEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[24]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubsubPublishEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubsubPublishEnd) ProtoMessage() {}
+
+func (x *PubsubPublishEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[24]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubsubPublishEnd.ProtoReflect.Descriptor instead.
+func (*PubsubPublishEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *PubsubPublishEnd) GetMessageId() string {
+	if x != nil && x.MessageId != nil {
+		return *x.MessageId
+	}
+	return ""
+}
+
+func (x *PubsubPublishEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+type ServiceInitStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Service string `protobuf:"bytes,1,opt,name=service,proto3" json:"service,omitempty"`
+}
+
+func (x *ServiceInitStart) Reset() {
+	*x = ServiceInitStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[25]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceInitStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceInitStart) ProtoMessage() {}
+
+func (x *ServiceInitStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[25]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceInitStart.ProtoReflect.Descriptor instead.
+func (*ServiceInitStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *ServiceInitStart) GetService() string {
+	if x != nil {
+		return x.Service
+	}
+	return ""
+}
+
+type ServiceInitEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err *Error `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+}
+
+func (x *ServiceInitEnd) Reset() {
+	*x = ServiceInitEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[26]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceInitEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceInitEnd) ProtoMessage() {}
+
+func (x *ServiceInitEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[26]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceInitEnd.ProtoReflect.Descriptor instead.
+func (*ServiceInitEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *ServiceInitEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+type CacheCallStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Operation string      `protobuf:"bytes,1,opt,name=operation,proto3" json:"operation,omitempty"`
+	Keys      []string    `protobuf:"bytes,2,rep,name=keys,proto3" json:"keys,omitempty"`
+	Write     bool        `protobuf:"varint,3,opt,name=write,proto3" json:"write,omitempty"`
+	Stack     *StackTrace `protobuf:"bytes,4,opt,name=stack,proto3" json:"stack,omitempty"` // TODO include more info (like inputs)
+}
+
+func (x *CacheCallStart) Reset() {
+	*x = CacheCallStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[27]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CacheCallStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CacheCallStart) ProtoMessage() {}
+
+func (x *CacheCallStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[27]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CacheCallStart.ProtoReflect.Descriptor instead.
+func (*CacheCallStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{27}
+}
+
+func (x *CacheCallStart) GetOperation() string {
+	if x != nil {
+		return x.Operation
+	}
+	return ""
+}
+
+func (x *CacheCallStart) GetKeys() []string {
+	if x != nil {
+		return x.Keys
+	}
+	return nil
+}
+
+func (x *CacheCallStart) GetWrite() bool {
+	if x != nil {
+		return x.Write
+	}
+	return false
+}
+
+func (x *CacheCallStart) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+type CacheCallEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Result CacheCallEnd_Result `protobuf:"varint,1,opt,name=result,proto3,enum=encore.engine.trace2.CacheCallEnd_Result" json:"result,omitempty"`
+	Err    *Error              `protobuf:"bytes,2,opt,name=err,proto3,oneof" json:"err,omitempty"` // TODO include more info (like outputs)
+}
+
+func (x *CacheCallEnd) Reset() {
+	*x = CacheCallEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[28]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CacheCallEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CacheCallEnd) ProtoMessage() {}
+
+func (x *CacheCallEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[28]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CacheCallEnd.ProtoReflect.Descriptor instead.
+func (*CacheCallEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{28}
+}
+
+func (x *CacheCallEnd) GetResult() CacheCallEnd_Result {
+	if x != nil {
+		return x.Result
+	}
+	return CacheCallEnd_UNKNOWN
+}
+
+func (x *CacheCallEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+type BucketObjectUploadStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Bucket string                  `protobuf:"bytes,1,opt,name=bucket,proto3" json:"bucket,omitempty"`
+	Object string                  `protobuf:"bytes,2,opt,name=object,proto3" json:"object,omitempty"`
+	Attrs  *BucketObjectAttributes `protobuf:"bytes,3,opt,name=attrs,proto3" json:"attrs,omitempty"`
+	Stack  *StackTrace             `protobuf:"bytes,4,opt,name=stack,proto3" json:"stack,omitempty"`
+}
+
+func (x *BucketObjectUploadStart) Reset() {
+	*x = BucketObjectUploadStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[29]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketObjectUploadStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketObjectUploadStart) ProtoMessage() {}
+
+func (x *BucketObjectUploadStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[29]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketObjectUploadStart.ProtoReflect.Descriptor instead.
+func (*BucketObjectUploadStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{29}
+}
+
+func (x *BucketObjectUploadStart) GetBucket() string {
+	if x != nil {
+		return x.Bucket
+	}
+	return ""
+}
+
+func (x *BucketObjectUploadStart) GetObject() string {
+	if x != nil {
+		return x.Object
+	}
+	return ""
+}
+
+func (x *BucketObjectUploadStart) GetAttrs() *BucketObjectAttributes {
+	if x != nil {
+		return x.Attrs
+	}
+	return nil
+}
+
+func (x *BucketObjectUploadStart) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+type BucketObjectUploadEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err     *Error  `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+	Size    *uint64 `protobuf:"varint,2,opt,name=size,proto3,oneof" json:"size,omitempty"`
+	Version *string `protobuf:"bytes,3,opt,name=version,proto3,oneof" json:"version,omitempty"`
+}
+
+func (x *BucketObjectUploadEnd) Reset() {
+	*x = BucketObjectUploadEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[30]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketObjectUploadEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketObjectUploadEnd) ProtoMessage() {}
+
+func (x *BucketObjectUploadEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[30]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketObjectUploadEnd.ProtoReflect.Descriptor instead.
+func (*BucketObjectUploadEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{30}
+}
+
+func (x *BucketObjectUploadEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+func (x *BucketObjectUploadEnd) GetSize() uint64 {
+	if x != nil && x.Size != nil {
+		return *x.Size
+	}
+	return 0
+}
+
+func (x *BucketObjectUploadEnd) GetVersion() string {
+	if x != nil && x.Version != nil {
+		return *x.Version
+	}
+	return ""
+}
+
+type BucketObjectDownloadStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Bucket  string      `protobuf:"bytes,1,opt,name=bucket,proto3" json:"bucket,omitempty"`
+	Object  string      `protobuf:"bytes,2,opt,name=object,proto3" json:"object,omitempty"`
+	Version *string     `protobuf:"bytes,3,opt,name=version,proto3,oneof" json:"version,omitempty"`
+	Stack   *StackTrace `protobuf:"bytes,4,opt,name=stack,proto3" json:"stack,omitempty"`
+}
+
+func (x *BucketObjectDownloadStart) Reset() {
+	*x = BucketObjectDownloadStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[31]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketObjectDownloadStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketObjectDownloadStart) ProtoMessage() {}
+
+func (x *BucketObjectDownloadStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[31]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketObjectDownloadStart.ProtoReflect.Descriptor instead.
+func (*BucketObjectDownloadStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{31}
+}
+
+func (x *BucketObjectDownloadStart) GetBucket() string {
+	if x != nil {
+		return x.Bucket
+	}
+	return ""
+}
+
+func (x *BucketObjectDownloadStart) GetObject() string {
+	if x != nil {
+		return x.Object
+	}
+	return ""
+}
+
+func (x *BucketObjectDownloadStart) GetVersion() string {
+	if x != nil && x.Version != nil {
+		return *x.Version
+	}
+	return ""
+}
+
+func (x *BucketObjectDownloadStart) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+type BucketObjectDownloadEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err  *Error  `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+	Size *uint64 `protobuf:"varint,2,opt,name=size,proto3,oneof" json:"size,omitempty"`
+}
+
+func (x *BucketObjectDownloadEnd) Reset() {
+	*x = BucketObjectDownloadEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[32]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketObjectDownloadEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketObjectDownloadEnd) ProtoMessage() {}
+
+func (x *BucketObjectDownloadEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[32]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketObjectDownloadEnd.ProtoReflect.Descriptor instead.
+func (*BucketObjectDownloadEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{32}
+}
+
+func (x *BucketObjectDownloadEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+func (x *BucketObjectDownloadEnd) GetSize() uint64 {
+	if x != nil && x.Size != nil {
+		return *x.Size
+	}
+	return 0
+}
+
+type BucketObjectGetAttrsStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Bucket  string      `protobuf:"bytes,1,opt,name=bucket,proto3" json:"bucket,omitempty"`
+	Object  string      `protobuf:"bytes,2,opt,name=object,proto3" json:"object,omitempty"`
+	Version *string     `protobuf:"bytes,3,opt,name=version,proto3,oneof" json:"version,omitempty"`
+	Stack   *StackTrace `protobuf:"bytes,4,opt,name=stack,proto3" json:"stack,omitempty"`
+}
+
+func (x *BucketObjectGetAttrsStart) Reset() {
+	*x = BucketObjectGetAttrsStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[33]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketObjectGetAttrsStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketObjectGetAttrsStart) ProtoMessage() {}
+
+func (x *BucketObjectGetAttrsStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[33]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketObjectGetAttrsStart.ProtoReflect.Descriptor instead.
+func (*BucketObjectGetAttrsStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{33}
+}
+
+func (x *BucketObjectGetAttrsStart) GetBucket() string {
+	if x != nil {
+		return x.Bucket
+	}
+	return ""
+}
+
+func (x *BucketObjectGetAttrsStart) GetObject() string {
+	if x != nil {
+		return x.Object
+	}
+	return ""
+}
+
+func (x *BucketObjectGetAttrsStart) GetVersion() string {
+	if x != nil && x.Version != nil {
+		return *x.Version
+	}
+	return ""
+}
+
+func (x *BucketObjectGetAttrsStart) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+type BucketObjectGetAttrsEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err   *Error                  `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+	Attrs *BucketObjectAttributes `protobuf:"bytes,2,opt,name=attrs,proto3,oneof" json:"attrs,omitempty"`
+}
+
+func (x *BucketObjectGetAttrsEnd) Reset() {
+	*x = BucketObjectGetAttrsEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[34]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketObjectGetAttrsEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketObjectGetAttrsEnd) ProtoMessage() {}
+
+func (x *BucketObjectGetAttrsEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[34]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketObjectGetAttrsEnd.ProtoReflect.Descriptor instead.
+func (*BucketObjectGetAttrsEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{34}
+}
+
+func (x *BucketObjectGetAttrsEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+func (x *BucketObjectGetAttrsEnd) GetAttrs() *BucketObjectAttributes {
+	if x != nil {
+		return x.Attrs
+	}
+	return nil
+}
+
+type BucketListObjectsStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Bucket string      `protobuf:"bytes,1,opt,name=bucket,proto3" json:"bucket,omitempty"`
+	Prefix *string     `protobuf:"bytes,2,opt,name=prefix,proto3,oneof" json:"prefix,omitempty"`
+	Stack  *StackTrace `protobuf:"bytes,3,opt,name=stack,proto3" json:"stack,omitempty"`
+}
+
+func (x *BucketListObjectsStart) Reset() {
+	*x = BucketListObjectsStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[35]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketListObjectsStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketListObjectsStart) ProtoMessage() {}
+
+func (x *BucketListObjectsStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[35]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketListObjectsStart.ProtoReflect.Descriptor instead.
+func (*BucketListObjectsStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{35}
+}
+
+func (x *BucketListObjectsStart) GetBucket() string {
+	if x != nil {
+		return x.Bucket
+	}
+	return ""
+}
+
+func (x *BucketListObjectsStart) GetPrefix() string {
+	if x != nil && x.Prefix != nil {
+		return *x.Prefix
+	}
+	return ""
+}
+
+func (x *BucketListObjectsStart) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+type BucketListObjectsEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err      *Error `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+	Observed uint64 `protobuf:"varint,2,opt,name=observed,proto3" json:"observed,omitempty"`
+	HasMore  bool   `protobuf:"varint,3,opt,name=has_more,json=hasMore,proto3" json:"has_more,omitempty"`
+}
+
+func (x *BucketListObjectsEnd) Reset() {
+	*x = BucketListObjectsEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[36]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketListObjectsEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketListObjectsEnd) ProtoMessage() {}
+
+func (x *BucketListObjectsEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[36]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketListObjectsEnd.ProtoReflect.Descriptor instead.
+func (*BucketListObjectsEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{36}
+}
+
+func (x *BucketListObjectsEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+func (x *BucketListObjectsEnd) GetObserved() uint64 {
+	if x != nil {
+		return x.Observed
+	}
+	return 0
+}
+
+func (x *BucketListObjectsEnd) GetHasMore() bool {
+	if x != nil {
+		return x.HasMore
+	}
+	return false
+}
+
+type BucketDeleteObjectsStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Bucket  string                     `protobuf:"bytes,1,opt,name=bucket,proto3" json:"bucket,omitempty"`
+	Stack   *StackTrace                `protobuf:"bytes,2,opt,name=stack,proto3" json:"stack,omitempty"`
+	Entries []*BucketDeleteObjectEntry `protobuf:"bytes,3,rep,name=entries,proto3" json:"entries,omitempty"`
+}
+
+func (x *BucketDeleteObjectsStart) Reset() {
+	*x = BucketDeleteObjectsStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[37]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketDeleteObjectsStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketDeleteObjectsStart) ProtoMessage() {}
+
+func (x *BucketDeleteObjectsStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[37]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketDeleteObjectsStart.ProtoReflect.Descriptor instead.
+func (*BucketDeleteObjectsStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{37}
+}
+
+func (x *BucketDeleteObjectsStart) GetBucket() string {
+	if x != nil {
+		return x.Bucket
+	}
+	return ""
+}
+
+func (x *BucketDeleteObjectsStart) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+func (x *BucketDeleteObjectsStart) GetEntries() []*BucketDeleteObjectEntry {
+	if x != nil {
+		return x.Entries
+	}
+	return nil
+}
+
+type BucketDeleteObjectEntry struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Object  string  `protobuf:"bytes,1,opt,name=object,proto3" json:"object,omitempty"`
+	Version *string `protobuf:"bytes,2,opt,name=version,proto3,oneof" json:"version,omitempty"`
+}
+
+func (x *BucketDeleteObjectEntry) Reset() {
+	*x = BucketDeleteObjectEntry{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[38]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketDeleteObjectEntry) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketDeleteObjectEntry) ProtoMessage() {}
+
+func (x *BucketDeleteObjectEntry) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[38]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketDeleteObjectEntry.ProtoReflect.Descriptor instead.
+func (*BucketDeleteObjectEntry) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{38}
+}
+
+func (x *BucketDeleteObjectEntry) GetObject() string {
+	if x != nil {
+		return x.Object
+	}
+	return ""
+}
+
+func (x *BucketDeleteObjectEntry) GetVersion() string {
+	if x != nil && x.Version != nil {
+		return *x.Version
+	}
+	return ""
+}
+
+type BucketDeleteObjectsEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err *Error `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+}
+
+func (x *BucketDeleteObjectsEnd) Reset() {
+	*x = BucketDeleteObjectsEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[39]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketDeleteObjectsEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketDeleteObjectsEnd) ProtoMessage() {}
+
+func (x *BucketDeleteObjectsEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[39]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketDeleteObjectsEnd.ProtoReflect.Descriptor instead.
+func (*BucketDeleteObjectsEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{39}
+}
+
+func (x *BucketDeleteObjectsEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+type BucketObjectAttributes struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Size        *uint64 `protobuf:"varint,1,opt,name=size,proto3,oneof" json:"size,omitempty"`
+	Version     *string `protobuf:"bytes,2,opt,name=version,proto3,oneof" json:"version,omitempty"`
+	Etag        *string `protobuf:"bytes,3,opt,name=etag,proto3,oneof" json:"etag,omitempty"`
+	ContentType *string `protobuf:"bytes,4,opt,name=content_type,json=contentType,proto3,oneof" json:"content_type,omitempty"`
+}
+
+func (x *BucketObjectAttributes) Reset() {
+	*x = BucketObjectAttributes{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[40]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketObjectAttributes) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketObjectAttributes) ProtoMessage() {}
+
+func (x *BucketObjectAttributes) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[40]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketObjectAttributes.ProtoReflect.Descriptor instead.
+func (*BucketObjectAttributes) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{40}
+}
+
+func (x *BucketObjectAttributes) GetSize() uint64 {
+	if x != nil && x.Size != nil {
+		return *x.Size
+	}
+	return 0
+}
+
+func (x *BucketObjectAttributes) GetVersion() string {
+	if x != nil && x.Version != nil {
+		return *x.Version
+	}
+	return ""
+}
+
+func (x *BucketObjectAttributes) GetEtag() string {
+	if x != nil && x.Etag != nil {
+		return *x.Etag
+	}
+	return ""
+}
+
+func (x *BucketObjectAttributes) GetContentType() string {
+	if x != nil && x.ContentType != nil {
+		return *x.ContentType
+	}
+	return ""
+}
+
+type BodyStream struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	IsResponse bool   `protobuf:"varint,1,opt,name=is_response,json=isResponse,proto3" json:"is_response,omitempty"`
+	Overflowed bool   `protobuf:"varint,2,opt,name=overflowed,proto3" json:"overflowed,omitempty"`
+	Data       []byte `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *BodyStream) Reset() {
+	*x = BodyStream{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[41]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BodyStream) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BodyStream) ProtoMessage() {}
+
+func (x *BodyStream) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[41]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BodyStream.ProtoReflect.Descriptor instead.
+func (*BodyStream) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{41}
+}
+
+func (x *BodyStream) GetIsResponse() bool {
+	if x != nil {
+		return x.IsResponse
+	}
+	return false
+}
+
+func (x *BodyStream) GetOverflowed() bool {
+	if x != nil {
+		return x.Overflowed
+	}
+	return false
+}
+
+func (x *BodyStream) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+type HTTPCallStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	CorrelationParentSpanId uint64      `protobuf:"varint,1,opt,name=correlation_parent_span_id,json=correlationParentSpanId,proto3" json:"correlation_parent_span_id,omitempty"`
+	Method                  string      `protobuf:"bytes,2,opt,name=method,proto3" json:"method,omitempty"`
+	Url                     string      `protobuf:"bytes,3,opt,name=url,proto3" json:"url,omitempty"`
+	Stack                   *StackTrace `protobuf:"bytes,4,opt,name=stack,proto3" json:"stack,omitempty"`
+	// start_nanotime is used to compute timings based on the
+	// nanotime in the HTTP trace events.
+	StartNanotime int64 `protobuf:"varint,5,opt,name=start_nanotime,json=startNanotime,proto3" json:"start_nanotime,omitempty"`
+}
+
+func (x *HTTPCallStart) Reset() {
+	*x = HTTPCallStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[42]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPCallStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPCallStart) ProtoMessage() {}
+
+func (x *HTTPCallStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[42]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPCallStart.ProtoReflect.Descriptor instead.
+func (*HTTPCallStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{42}
+}
+
+func (x *HTTPCallStart) GetCorrelationParentSpanId() uint64 {
+	if x != nil {
+		return x.CorrelationParentSpanId
+	}
+	return 0
+}
+
+func (x *HTTPCallStart) GetMethod() string {
+	if x != nil {
+		return x.Method
+	}
+	return ""
+}
+
+func (x *HTTPCallStart) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+func (x *HTTPCallStart) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+func (x *HTTPCallStart) GetStartNanotime() int64 {
+	if x != nil {
+		return x.StartNanotime
+	}
+	return 0
+}
+
+type HTTPCallEnd struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// status_code is set if we got a HTTP response.
+	StatusCode *uint32 `protobuf:"varint,1,opt,name=status_code,json=statusCode,proto3,oneof" json:"status_code,omitempty"`
+	// err is set otherwise.
+	Err *Error `protobuf:"bytes,2,opt,name=err,proto3,oneof" json:"err,omitempty"`
+	// TODO these should be moved to be asynchronous via a separate event.
+	TraceEvents []*HTTPTraceEvent `protobuf:"bytes,3,rep,name=trace_events,json=traceEvents,proto3" json:"trace_events,omitempty"`
+}
+
+func (x *HTTPCallEnd) Reset() {
+	*x = HTTPCallEnd{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[43]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPCallEnd) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPCallEnd) ProtoMessage() {}
+
+func (x *HTTPCallEnd) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[43]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPCallEnd.ProtoReflect.Descriptor instead.
+func (*HTTPCallEnd) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{43}
+}
+
+func (x *HTTPCallEnd) GetStatusCode() uint32 {
+	if x != nil && x.StatusCode != nil {
+		return *x.StatusCode
+	}
+	return 0
+}
+
+func (x *HTTPCallEnd) GetErr() *Error {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+func (x *HTTPCallEnd) GetTraceEvents() []*HTTPTraceEvent {
+	if x != nil {
+		return x.TraceEvents
+	}
+	return nil
+}
+
+type HTTPTraceEvent struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Nanotime int64 `protobuf:"varint,1,opt,name=nanotime,proto3" json:"nanotime,omitempty"`
+	// Types that are assignable to Data:
+	//
+	//	*HTTPTraceEvent_GetConn
+	//	*HTTPTraceEvent_GotConn
+	//	*HTTPTraceEvent_GotFirstResponseByte
+	//	*HTTPTraceEvent_Got_1XxResponse
+	//	*HTTPTraceEvent_DnsStart
+	//	*HTTPTraceEvent_DnsDone
+	//	*HTTPTraceEvent_ConnectStart
+	//	*HTTPTraceEvent_ConnectDone
+	//	*HTTPTraceEvent_TlsHandshakeStart
+	//	*HTTPTraceEvent_TlsHandshakeDone
+	//	*HTTPTraceEvent_WroteHeaders
+	//	*HTTPTraceEvent_WroteRequest
+	//	*HTTPTraceEvent_Wait_100Continue
+	//	*HTTPTraceEvent_ClosedBody
+	Data isHTTPTraceEvent_Data `protobuf_oneof:"data"`
+}
+
+func (x *HTTPTraceEvent) Reset() {
+	*x = HTTPTraceEvent{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[44]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPTraceEvent) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPTraceEvent) ProtoMessage() {}
+
+func (x *HTTPTraceEvent) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[44]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPTraceEvent.ProtoReflect.Descriptor instead.
+func (*HTTPTraceEvent) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{44}
+}
+
+func (x *HTTPTraceEvent) GetNanotime() int64 {
+	if x != nil {
+		return x.Nanotime
+	}
+	return 0
+}
+
+func (m *HTTPTraceEvent) GetData() isHTTPTraceEvent_Data {
+	if m != nil {
+		return m.Data
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetGetConn() *HTTPGetConn {
+	if x, ok := x.GetData().(*HTTPTraceEvent_GetConn); ok {
+		return x.GetConn
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetGotConn() *HTTPGotConn {
+	if x, ok := x.GetData().(*HTTPTraceEvent_GotConn); ok {
+		return x.GotConn
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetGotFirstResponseByte() *HTTPGotFirstResponseByte {
+	if x, ok := x.GetData().(*HTTPTraceEvent_GotFirstResponseByte); ok {
+		return x.GotFirstResponseByte
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetGot_1XxResponse() *HTTPGot1XxResponse {
+	if x, ok := x.GetData().(*HTTPTraceEvent_Got_1XxResponse); ok {
+		return x.Got_1XxResponse
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetDnsStart() *HTTPDNSStart {
+	if x, ok := x.GetData().(*HTTPTraceEvent_DnsStart); ok {
+		return x.DnsStart
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetDnsDone() *HTTPDNSDone {
+	if x, ok := x.GetData().(*HTTPTraceEvent_DnsDone); ok {
+		return x.DnsDone
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetConnectStart() *HTTPConnectStart {
+	if x, ok := x.GetData().(*HTTPTraceEvent_ConnectStart); ok {
+		return x.ConnectStart
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetConnectDone() *HTTPConnectDone {
+	if x, ok := x.GetData().(*HTTPTraceEvent_ConnectDone); ok {
+		return x.ConnectDone
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetTlsHandshakeStart() *HTTPTLSHandshakeStart {
+	if x, ok := x.GetData().(*HTTPTraceEvent_TlsHandshakeStart); ok {
+		return x.TlsHandshakeStart
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetTlsHandshakeDone() *HTTPTLSHandshakeDone {
+	if x, ok := x.GetData().(*HTTPTraceEvent_TlsHandshakeDone); ok {
+		return x.TlsHandshakeDone
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetWroteHeaders() *HTTPWroteHeaders {
+	if x, ok := x.GetData().(*HTTPTraceEvent_WroteHeaders); ok {
+		return x.WroteHeaders
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetWroteRequest() *HTTPWroteRequest {
+	if x, ok := x.GetData().(*HTTPTraceEvent_WroteRequest); ok {
+		return x.WroteRequest
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetWait_100Continue() *HTTPWait100Continue {
+	if x, ok := x.GetData().(*HTTPTraceEvent_Wait_100Continue); ok {
+		return x.Wait_100Continue
+	}
+	return nil
+}
+
+func (x *HTTPTraceEvent) GetClosedBody() *HTTPClosedBodyData {
+	if x, ok := x.GetData().(*HTTPTraceEvent_ClosedBody); ok {
+		return x.ClosedBody
+	}
+	return nil
+}
+
+type isHTTPTraceEvent_Data interface {
+	isHTTPTraceEvent_Data()
+}
+
+type HTTPTraceEvent_GetConn struct {
+	GetConn *HTTPGetConn `protobuf:"bytes,2,opt,name=get_conn,json=getConn,proto3,oneof"`
+}
+
+type HTTPTraceEvent_GotConn struct {
+	GotConn *HTTPGotConn `protobuf:"bytes,3,opt,name=got_conn,json=gotConn,proto3,oneof"`
+}
+
+type HTTPTraceEvent_GotFirstResponseByte struct {
+	GotFirstResponseByte *HTTPGotFirstResponseByte `protobuf:"bytes,4,opt,name=got_first_response_byte,json=gotFirstResponseByte,proto3,oneof"`
+}
+
+type HTTPTraceEvent_Got_1XxResponse struct {
+	Got_1XxResponse *HTTPGot1XxResponse `protobuf:"bytes,5,opt,name=got_1xx_response,json=got1xxResponse,proto3,oneof"`
+}
+
+type HTTPTraceEvent_DnsStart struct {
+	DnsStart *HTTPDNSStart `protobuf:"bytes,6,opt,name=dns_start,json=dnsStart,proto3,oneof"`
+}
+
+type HTTPTraceEvent_DnsDone struct {
+	DnsDone *HTTPDNSDone `protobuf:"bytes,7,opt,name=dns_done,json=dnsDone,proto3,oneof"`
+}
+
+type HTTPTraceEvent_ConnectStart struct {
+	ConnectStart *HTTPConnectStart `protobuf:"bytes,8,opt,name=connect_start,json=connectStart,proto3,oneof"`
+}
+
+type HTTPTraceEvent_ConnectDone struct {
+	ConnectDone *HTTPConnectDone `protobuf:"bytes,9,opt,name=connect_done,json=connectDone,proto3,oneof"`
+}
+
+type HTTPTraceEvent_TlsHandshakeStart struct {
+	TlsHandshakeStart *HTTPTLSHandshakeStart `protobuf:"bytes,10,opt,name=tls_handshake_start,json=tlsHandshakeStart,proto3,oneof"`
+}
+
+type HTTPTraceEvent_TlsHandshakeDone struct {
+	TlsHandshakeDone *HTTPTLSHandshakeDone `protobuf:"bytes,11,opt,name=tls_handshake_done,json=tlsHandshakeDone,proto3,oneof"`
+}
+
+type HTTPTraceEvent_WroteHeaders struct {
+	WroteHeaders *HTTPWroteHeaders `protobuf:"bytes,12,opt,name=wrote_headers,json=wroteHeaders,proto3,oneof"`
+}
+
+type HTTPTraceEvent_WroteRequest struct {
+	WroteRequest *HTTPWroteRequest `protobuf:"bytes,13,opt,name=wrote_request,json=wroteRequest,proto3,oneof"`
+}
+
+type HTTPTraceEvent_Wait_100Continue struct {
+	Wait_100Continue *HTTPWait100Continue `protobuf:"bytes,14,opt,name=wait_100_continue,json=wait100Continue,proto3,oneof"`
+}
+
+type HTTPTraceEvent_ClosedBody struct {
+	ClosedBody *HTTPClosedBodyData `protobuf:"bytes,15,opt,name=closed_body,json=closedBody,proto3,oneof"`
+}
+
+func (*HTTPTraceEvent_GetConn) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_GotConn) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_GotFirstResponseByte) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_Got_1XxResponse) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_DnsStart) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_DnsDone) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_ConnectStart) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_ConnectDone) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_TlsHandshakeStart) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_TlsHandshakeDone) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_WroteHeaders) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_WroteRequest) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_Wait_100Continue) isHTTPTraceEvent_Data() {}
+
+func (*HTTPTraceEvent_ClosedBody) isHTTPTraceEvent_Data() {}
+
+type HTTPGetConn struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	HostPort string `protobuf:"bytes,1,opt,name=host_port,json=hostPort,proto3" json:"host_port,omitempty"`
+}
+
+func (x *HTTPGetConn) Reset() {
+	*x = HTTPGetConn{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[45]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPGetConn) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPGetConn) ProtoMessage() {}
+
+func (x *HTTPGetConn) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[45]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPGetConn.ProtoReflect.Descriptor instead.
+func (*HTTPGetConn) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{45}
+}
+
+func (x *HTTPGetConn) GetHostPort() string {
+	if x != nil {
+		return x.HostPort
+	}
+	return ""
+}
+
+type HTTPGotConn struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Reused         bool  `protobuf:"varint,1,opt,name=reused,proto3" json:"reused,omitempty"`
+	WasIdle        bool  `protobuf:"varint,2,opt,name=was_idle,json=wasIdle,proto3" json:"was_idle,omitempty"`
+	IdleDurationNs int64 `protobuf:"varint,3,opt,name=idle_duration_ns,json=idleDurationNs,proto3" json:"idle_duration_ns,omitempty"`
+}
+
+func (x *HTTPGotConn) Reset() {
+	*x = HTTPGotConn{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[46]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPGotConn) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPGotConn) ProtoMessage() {}
+
+func (x *HTTPGotConn) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[46]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPGotConn.ProtoReflect.Descriptor instead.
+func (*HTTPGotConn) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{46}
+}
+
+func (x *HTTPGotConn) GetReused() bool {
+	if x != nil {
+		return x.Reused
+	}
+	return false
+}
+
+func (x *HTTPGotConn) GetWasIdle() bool {
+	if x != nil {
+		return x.WasIdle
+	}
+	return false
+}
+
+func (x *HTTPGotConn) GetIdleDurationNs() int64 {
+	if x != nil {
+		return x.IdleDurationNs
+	}
+	return 0
+}
+
+type HTTPGotFirstResponseByte struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *HTTPGotFirstResponseByte) Reset() {
+	*x = HTTPGotFirstResponseByte{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[47]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPGotFirstResponseByte) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPGotFirstResponseByte) ProtoMessage() {}
+
+func (x *HTTPGotFirstResponseByte) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[47]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPGotFirstResponseByte.ProtoReflect.Descriptor instead.
+func (*HTTPGotFirstResponseByte) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{47}
+}
+
+type HTTPGot1XxResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Code int32 `protobuf:"varint,1,opt,name=code,proto3" json:"code,omitempty"`
+}
+
+func (x *HTTPGot1XxResponse) Reset() {
+	*x = HTTPGot1XxResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[48]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPGot1XxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPGot1XxResponse) ProtoMessage() {}
+
+func (x *HTTPGot1XxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[48]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPGot1XxResponse.ProtoReflect.Descriptor instead.
+func (*HTTPGot1XxResponse) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{48}
+}
+
+func (x *HTTPGot1XxResponse) GetCode() int32 {
+	if x != nil {
+		return x.Code
+	}
+	return 0
+}
+
+type HTTPDNSStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Host string `protobuf:"bytes,1,opt,name=host,proto3" json:"host,omitempty"`
+}
+
+func (x *HTTPDNSStart) Reset() {
+	*x = HTTPDNSStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[49]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPDNSStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPDNSStart) ProtoMessage() {}
+
+func (x *HTTPDNSStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[49]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPDNSStart.ProtoReflect.Descriptor instead.
+func (*HTTPDNSStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{49}
+}
+
+func (x *HTTPDNSStart) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+type HTTPDNSDone struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err   []byte     `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+	Addrs []*DNSAddr `protobuf:"bytes,2,rep,name=addrs,proto3" json:"addrs,omitempty"`
+}
+
+func (x *HTTPDNSDone) Reset() {
+	*x = HTTPDNSDone{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[50]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPDNSDone) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPDNSDone) ProtoMessage() {}
+
+func (x *HTTPDNSDone) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[50]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPDNSDone.ProtoReflect.Descriptor instead.
+func (*HTTPDNSDone) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{50}
+}
+
+func (x *HTTPDNSDone) GetErr() []byte {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+func (x *HTTPDNSDone) GetAddrs() []*DNSAddr {
+	if x != nil {
+		return x.Addrs
+	}
+	return nil
+}
+
+type DNSAddr struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Ip []byte `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
+}
+
+func (x *DNSAddr) Reset() {
+	*x = DNSAddr{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[51]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DNSAddr) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DNSAddr) ProtoMessage() {}
+
+func (x *DNSAddr) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[51]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DNSAddr.ProtoReflect.Descriptor instead.
+func (*DNSAddr) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{51}
+}
+
+func (x *DNSAddr) GetIp() []byte {
+	if x != nil {
+		return x.Ip
+	}
+	return nil
+}
+
+type HTTPConnectStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Network string `protobuf:"bytes,1,opt,name=network,proto3" json:"network,omitempty"`
+	Addr    string `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
+}
+
+func (x *HTTPConnectStart) Reset() {
+	*x = HTTPConnectStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[52]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPConnectStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPConnectStart) ProtoMessage() {}
+
+func (x *HTTPConnectStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[52]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPConnectStart.ProtoReflect.Descriptor instead.
+func (*HTTPConnectStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{52}
+}
+
+func (x *HTTPConnectStart) GetNetwork() string {
+	if x != nil {
+		return x.Network
+	}
+	return ""
+}
+
+func (x *HTTPConnectStart) GetAddr() string {
+	if x != nil {
+		return x.Addr
+	}
+	return ""
+}
+
+type HTTPConnectDone struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Network string `protobuf:"bytes,1,opt,name=network,proto3" json:"network,omitempty"`
+	Addr    string `protobuf:"bytes,2,opt,name=addr,proto3" json:"addr,omitempty"`
+	Err     []byte `protobuf:"bytes,3,opt,name=err,proto3" json:"err,omitempty"`
+}
+
+func (x *HTTPConnectDone) Reset() {
+	*x = HTTPConnectDone{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[53]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPConnectDone) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPConnectDone) ProtoMessage() {}
+
+func (x *HTTPConnectDone) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[53]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPConnectDone.ProtoReflect.Descriptor instead.
+func (*HTTPConnectDone) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{53}
+}
+
+func (x *HTTPConnectDone) GetNetwork() string {
+	if x != nil {
+		return x.Network
+	}
+	return ""
+}
+
+func (x *HTTPConnectDone) GetAddr() string {
+	if x != nil {
+		return x.Addr
+	}
+	return ""
+}
+
+func (x *HTTPConnectDone) GetErr() []byte {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+type HTTPTLSHandshakeStart struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *HTTPTLSHandshakeStart) Reset() {
+	*x = HTTPTLSHandshakeStart{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[54]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPTLSHandshakeStart) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPTLSHandshakeStart) ProtoMessage() {}
+
+func (x *HTTPTLSHandshakeStart) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[54]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPTLSHandshakeStart.ProtoReflect.Descriptor instead.
+func (*HTTPTLSHandshakeStart) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{54}
+}
+
+type HTTPTLSHandshakeDone struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err                []byte `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+	TlsVersion         uint32 `protobuf:"varint,2,opt,name=tls_version,json=tlsVersion,proto3" json:"tls_version,omitempty"`
+	CipherSuite        uint32 `protobuf:"varint,3,opt,name=cipher_suite,json=cipherSuite,proto3" json:"cipher_suite,omitempty"`
+	ServerName         string `protobuf:"bytes,4,opt,name=server_name,json=serverName,proto3" json:"server_name,omitempty"`
+	NegotiatedProtocol string `protobuf:"bytes,5,opt,name=negotiated_protocol,json=negotiatedProtocol,proto3" json:"negotiated_protocol,omitempty"`
+}
+
+func (x *HTTPTLSHandshakeDone) Reset() {
+	*x = HTTPTLSHandshakeDone{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[55]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPTLSHandshakeDone) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPTLSHandshakeDone) ProtoMessage() {}
+
+func (x *HTTPTLSHandshakeDone) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[55]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPTLSHandshakeDone.ProtoReflect.Descriptor instead.
+func (*HTTPTLSHandshakeDone) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{55}
+}
+
+func (x *HTTPTLSHandshakeDone) GetErr() []byte {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+func (x *HTTPTLSHandshakeDone) GetTlsVersion() uint32 {
+	if x != nil {
+		return x.TlsVersion
+	}
+	return 0
+}
+
+func (x *HTTPTLSHandshakeDone) GetCipherSuite() uint32 {
+	if x != nil {
+		return x.CipherSuite
+	}
+	return 0
+}
+
+func (x *HTTPTLSHandshakeDone) GetServerName() string {
+	if x != nil {
+		return x.ServerName
+	}
+	return ""
+}
+
+func (x *HTTPTLSHandshakeDone) GetNegotiatedProtocol() string {
+	if x != nil {
+		return x.NegotiatedProtocol
+	}
+	return ""
+}
+
+type HTTPWroteHeaders struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *HTTPWroteHeaders) Reset() {
+	*x = HTTPWroteHeaders{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[56]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPWroteHeaders) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPWroteHeaders) ProtoMessage() {}
+
+func (x *HTTPWroteHeaders) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[56]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPWroteHeaders.ProtoReflect.Descriptor instead.
+func (*HTTPWroteHeaders) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{56}
+}
+
+type HTTPWroteRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err []byte `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+}
+
+func (x *HTTPWroteRequest) Reset() {
+	*x = HTTPWroteRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[57]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPWroteRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPWroteRequest) ProtoMessage() {}
+
+func (x *HTTPWroteRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[57]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPWroteRequest.ProtoReflect.Descriptor instead.
+func (*HTTPWroteRequest) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{57}
+}
+
+func (x *HTTPWroteRequest) GetErr() []byte {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+type HTTPWait100Continue struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *HTTPWait100Continue) Reset() {
+	*x = HTTPWait100Continue{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[58]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPWait100Continue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPWait100Continue) ProtoMessage() {}
+
+func (x *HTTPWait100Continue) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[58]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPWait100Continue.ProtoReflect.Descriptor instead.
+func (*HTTPWait100Continue) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{58}
+}
+
+type HTTPClosedBodyData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Err []byte `protobuf:"bytes,1,opt,name=err,proto3,oneof" json:"err,omitempty"`
+}
+
+func (x *HTTPClosedBodyData) Reset() {
+	*x = HTTPClosedBodyData{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[59]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HTTPClosedBodyData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HTTPClosedBodyData) ProtoMessage() {}
+
+func (x *HTTPClosedBodyData) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[59]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HTTPClosedBodyData.ProtoReflect.Descriptor instead.
+func (*HTTPClosedBodyData) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{59}
+}
+
+func (x *HTTPClosedBodyData) GetErr() []byte {
+	if x != nil {
+		return x.Err
+	}
+	return nil
+}
+
+type LogMessage struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Level  LogMessage_Level `protobuf:"varint,1,opt,name=level,proto3,enum=encore.engine.trace2.LogMessage_Level" json:"level,omitempty"`
+	Msg    string           `protobuf:"bytes,2,opt,name=msg,proto3" json:"msg,omitempty"`
+	Fields []*LogField      `protobuf:"bytes,3,rep,name=fields,proto3" json:"fields,omitempty"`
+	Stack  *StackTrace      `protobuf:"bytes,4,opt,name=stack,proto3" json:"stack,omitempty"`
+}
+
+func (x *LogMessage) Reset() {
+	*x = LogMessage{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[60]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LogMessage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LogMessage) ProtoMessage() {}
+
+func (x *LogMessage) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[60]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LogMessage.ProtoReflect.Descriptor instead.
+func (*LogMessage) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{60}
+}
+
+func (x *LogMessage) GetLevel() LogMessage_Level {
+	if x != nil {
+		return x.Level
+	}
+	return LogMessage_DEBUG
+}
+
+func (x *LogMessage) GetMsg() string {
+	if x != nil {
+		return x.Msg
+	}
+	return ""
+}
+
+func (x *LogMessage) GetFields() []*LogField {
+	if x != nil {
+		return x.Fields
+	}
+	return nil
+}
+
+func (x *LogMessage) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+type LogField struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	// Types that are assignable to Value:
+	//
+	//	*LogField_Error
+	//	*LogField_Str
+	//	*LogField_Bool
+	//	*LogField_Time
+	//	*LogField_Dur
+	//	*LogField_Uuid
+	//	*LogField_Json
+	//	*LogField_Int
+	//	*LogField_Uint
+	//	*LogField_Float32
+	//	*LogField_Float64
+	Value isLogField_Value `protobuf_oneof:"value"`
+}
+
+func (x *LogField) Reset() {
+	*x = LogField{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[61]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LogField) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LogField) ProtoMessage() {}
+
+func (x *LogField) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[61]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LogField.ProtoReflect.Descriptor instead.
+func (*LogField) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{61}
+}
+
+func (x *LogField) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (m *LogField) GetValue() isLogField_Value {
+	if m != nil {
+		return m.Value
+	}
+	return nil
+}
+
+func (x *LogField) GetError() *Error {
+	if x, ok := x.GetValue().(*LogField_Error); ok {
+		return x.Error
+	}
+	return nil
+}
+
+func (x *LogField) GetStr() string {
+	if x, ok := x.GetValue().(*LogField_Str); ok {
+		return x.Str
+	}
+	return ""
+}
+
+func (x *LogField) GetBool() bool {
+	if x, ok := x.GetValue().(*LogField_Bool); ok {
+		return x.Bool
+	}
+	return false
+}
+
+func (x *LogField) GetTime() *timestamppb.Timestamp {
+	if x, ok := x.GetValue().(*LogField_Time); ok {
+		return x.Time
+	}
+	return nil
+}
+
+func (x *LogField) GetDur() int64 {
+	if x, ok := x.GetValue().(*LogField_Dur); ok {
+		return x.Dur
+	}
+	return 0
+}
+
+func (x *LogField) GetUuid() []byte {
+	if x, ok := x.GetValue().(*LogField_Uuid); ok {
+		return x.Uuid
+	}
+	return nil
+}
+
+func (x *LogField) GetJson() []byte {
+	if x, ok := x.GetValue().(*LogField_Json); ok {
+		return x.Json
+	}
+	return nil
+}
+
+func (x *LogField) GetInt() int64 {
+	if x, ok := x.GetValue().(*LogField_Int); ok {
+		return x.Int
+	}
+	return 0
+}
+
+func (x *LogField) GetUint() uint64 {
+	if x, ok := x.GetValue().(*LogField_Uint); ok {
+		return x.Uint
+	}
+	return 0
+}
+
+func (x *LogField) GetFloat32() float32 {
+	if x, ok := x.GetValue().(*LogField_Float32); ok {
+		return x.Float32
+	}
+	return 0
+}
+
+func (x *LogField) GetFloat64() float64 {
+	if x, ok := x.GetValue().(*LogField_Float64); ok {
+		return x.Float64
+	}
+	return 0
+}
+
+type isLogField_Value interface {
+	isLogField_Value()
+}
+
+type LogField_Error struct {
+	Error *Error `protobuf:"bytes,2,opt,name=error,proto3,oneof"`
+}
+
+type LogField_Str struct {
+	Str string `protobuf:"bytes,3,opt,name=str,proto3,oneof"`
+}
+
+type LogField_Bool struct {
+	Bool bool `protobuf:"varint,4,opt,name=bool,proto3,oneof"`
+}
+
+type LogField_Time struct {
+	Time *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=time,proto3,oneof"`
+}
+
+type LogField_Dur struct {
+	Dur int64 `protobuf:"varint,6,opt,name=dur,proto3,oneof"`
+}
+
+type LogField_Uuid struct {
+	Uuid []byte `protobuf:"bytes,7,opt,name=uuid,proto3,oneof"`
+}
+
+type LogField_Json struct {
+	Json []byte `protobuf:"bytes,8,opt,name=json,proto3,oneof"`
+}
+
+type LogField_Int struct {
+	Int int64 `protobuf:"varint,9,opt,name=int,proto3,oneof"`
+}
+
+type LogField_Uint struct {
+	Uint uint64 `protobuf:"varint,10,opt,name=uint,proto3,oneof"`
+}
+
+type LogField_Float32 struct {
+	Float32 float32 `protobuf:"fixed32,11,opt,name=float32,proto3,oneof"`
+}
+
+type LogField_Float64 struct {
+	Float64 float64 `protobuf:"fixed64,12,opt,name=float64,proto3,oneof"`
+}
+
+func (*LogField_Error) isLogField_Value() {}
+
+func (*LogField_Str) isLogField_Value() {}
+
+func (*LogField_Bool) isLogField_Value() {}
+
+func (*LogField_Time) isLogField_Value() {}
+
+func (*LogField_Dur) isLogField_Value() {}
+
+func (*LogField_Uuid) isLogField_Value() {}
+
+func (*LogField_Json) isLogField_Value() {}
+
+func (*LogField_Int) isLogField_Value() {}
+
+func (*LogField_Uint) isLogField_Value() {}
+
+func (*LogField_Float32) isLogField_Value() {}
+
+func (*LogField_Float64) isLogField_Value() {}
+
+type StackTrace struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Pcs    []int64       `protobuf:"varint,1,rep,packed,name=pcs,proto3" json:"pcs,omitempty"`
+	Frames []*StackFrame `protobuf:"bytes,2,rep,name=frames,proto3" json:"frames,omitempty"`
+}
+
+func (x *StackTrace) Reset() {
+	*x = StackTrace{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[62]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StackTrace) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StackTrace) ProtoMessage() {}
+
+func (x *StackTrace) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[62]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StackTrace.ProtoReflect.Descriptor instead.
+func (*StackTrace) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{62}
+}
+
+func (x *StackTrace) GetPcs() []int64 {
+	if x != nil {
+		return x.Pcs
+	}
+	return nil
+}
+
+func (x *StackTrace) GetFrames() []*StackFrame {
+	if x != nil {
+		return x.Frames
+	}
+	return nil
+}
+
+type StackFrame struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Filename string `protobuf:"bytes,1,opt,name=filename,proto3" json:"filename,omitempty"`
+	Func     string `protobuf:"bytes,2,opt,name=func,proto3" json:"func,omitempty"`
+	Line     int32  `protobuf:"varint,3,opt,name=line,proto3" json:"line,omitempty"`
+}
+
+func (x *StackFrame) Reset() {
+	*x = StackFrame{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[63]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StackFrame) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StackFrame) ProtoMessage() {}
+
+func (x *StackFrame) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[63]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StackFrame.ProtoReflect.Descriptor instead.
+func (*StackFrame) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{63}
+}
+
+func (x *StackFrame) GetFilename() string {
+	if x != nil {
+		return x.Filename
+	}
+	return ""
+}
+
+func (x *StackFrame) GetFunc() string {
+	if x != nil {
+		return x.Func
+	}
+	return ""
+}
+
+func (x *StackFrame) GetLine() int32 {
+	if x != nil {
+		return x.Line
+	}
+	return 0
+}
+
+type Error struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Msg   string      `protobuf:"bytes,1,opt,name=msg,proto3" json:"msg,omitempty"`
+	Stack *StackTrace `protobuf:"bytes,2,opt,name=stack,proto3,oneof" json:"stack,omitempty"`
+}
+
+func (x *Error) Reset() {
+	*x = Error{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_engine_trace2_trace2_proto_msgTypes[64]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Error) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Error) ProtoMessage() {}
+
+func (x *Error) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_engine_trace2_trace2_proto_msgTypes[64]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Error.ProtoReflect.Descriptor instead.
+func (*Error) Descriptor() ([]byte, []int) {
+	return file_encore_engine_trace2_trace2_proto_rawDescGZIP(), []int{64}
+}
+
+func (x *Error) GetMsg() string {
+	if x != nil {
+		return x.Msg
+	}
+	return ""
+}
+
+func (x *Error) GetStack() *StackTrace {
+	if x != nil {
+		return x.Stack
+	}
+	return nil
+}
+
+var File_encore_engine_trace2_trace2_proto protoreflect.FileDescriptor
+
+var file_encore_engine_trace2_trace2_proto_rawDesc = []byte{
+	0x0a, 0x21, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2f,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x14, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69,
+	0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xae, 0x06, 0x0a, 0x0b, 0x53,
+	0x70, 0x61, 0x6e, 0x53, 0x75, 0x6d, 0x6d, 0x61, 0x72, 0x79, 0x12, 0x19, 0x0a, 0x08, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x12, 0x3e,
+	0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61,
+	0x63, 0x65, 0x32, 0x2e, 0x53, 0x70, 0x61, 0x6e, 0x53, 0x75, 0x6d, 0x6d, 0x61, 0x72, 0x79, 0x2e,
+	0x53, 0x70, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x17,
+	0x0a, 0x07, 0x69, 0x73, 0x5f, 0x72, 0x6f, 0x6f, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x06, 0x69, 0x73, 0x52, 0x6f, 0x6f, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x69, 0x73, 0x5f, 0x65, 0x72,
+	0x72, 0x6f, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x69, 0x73, 0x45, 0x72, 0x72,
+	0x6f, 0x72, 0x12, 0x27, 0x0a, 0x0f, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x65, 0x64, 0x5f, 0x63,
+	0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x64, 0x65, 0x70,
+	0x6c, 0x6f, 0x79, 0x65, 0x64, 0x43, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x12, 0x39, 0x0a, 0x0a, 0x73,
+	0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x25, 0x0a, 0x0e, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6e, 0x6f, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0d,
+	0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x61, 0x6e, 0x6f, 0x73, 0x12, 0x21, 0x0a,
+	0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x09, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65,
+	0x12, 0x28, 0x0a, 0x0d, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0c, 0x65, 0x6e, 0x64, 0x70, 0x6f,
+	0x69, 0x6e, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x88, 0x01, 0x01, 0x12, 0x22, 0x0a, 0x0a, 0x74, 0x6f,
+	0x70, 0x69, 0x63, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01,
+	0x52, 0x09, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x88, 0x01, 0x01, 0x12, 0x30,
+	0x0a, 0x11, 0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x48, 0x02, 0x52, 0x10, 0x73, 0x75, 0x62,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x88, 0x01, 0x01,
+	0x12, 0x22, 0x0a, 0x0a, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0d,
+	0x20, 0x01, 0x28, 0x09, 0x48, 0x03, 0x52, 0x09, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x49,
+	0x64, 0x88, 0x01, 0x01, 0x12, 0x26, 0x0a, 0x0c, 0x74, 0x65, 0x73, 0x74, 0x5f, 0x73, 0x6b, 0x69,
+	0x70, 0x70, 0x65, 0x64, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x08, 0x48, 0x04, 0x52, 0x0b, 0x74, 0x65,
+	0x73, 0x74, 0x53, 0x6b, 0x69, 0x70, 0x70, 0x65, 0x64, 0x88, 0x01, 0x01, 0x12, 0x1e, 0x0a, 0x08,
+	0x73, 0x72, 0x63, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x09, 0x48, 0x05,
+	0x52, 0x07, 0x73, 0x72, 0x63, 0x46, 0x69, 0x6c, 0x65, 0x88, 0x01, 0x01, 0x12, 0x1e, 0x0a, 0x08,
+	0x73, 0x72, 0x63, 0x5f, 0x6c, 0x69, 0x6e, 0x65, 0x18, 0x10, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x06,
+	0x52, 0x07, 0x73, 0x72, 0x63, 0x4c, 0x69, 0x6e, 0x65, 0x88, 0x01, 0x01, 0x22, 0x4c, 0x0a, 0x08,
+	0x53, 0x70, 0x61, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e,
+	0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x52, 0x45, 0x51, 0x55, 0x45, 0x53, 0x54,
+	0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x55, 0x54, 0x48, 0x10, 0x02, 0x12, 0x12, 0x0a, 0x0e,
+	0x50, 0x55, 0x42, 0x53, 0x55, 0x42, 0x5f, 0x4d, 0x45, 0x53, 0x53, 0x41, 0x47, 0x45, 0x10, 0x03,
+	0x12, 0x08, 0x0a, 0x04, 0x54, 0x45, 0x53, 0x54, 0x10, 0x04, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x65,
+	0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x42, 0x0d, 0x0a, 0x0b,
+	0x5f, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x42, 0x14, 0x0a, 0x12, 0x5f,
+	0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x69, 0x64,
+	0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x74, 0x65, 0x73, 0x74, 0x5f, 0x73, 0x6b, 0x69, 0x70, 0x70, 0x65,
+	0x64, 0x42, 0x0b, 0x0a, 0x09, 0x5f, 0x73, 0x72, 0x63, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x42, 0x0b,
+	0x0a, 0x09, 0x5f, 0x73, 0x72, 0x63, 0x5f, 0x6c, 0x69, 0x6e, 0x65, 0x22, 0x2f, 0x0a, 0x07, 0x54,
+	0x72, 0x61, 0x63, 0x65, 0x49, 0x44, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x69, 0x67, 0x68, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x68, 0x69, 0x67, 0x68, 0x12, 0x10, 0x0a, 0x03, 0x6c, 0x6f,
+	0x77, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x03, 0x6c, 0x6f, 0x77, 0x22, 0x45, 0x0a, 0x09,
+	0x45, 0x76, 0x65, 0x6e, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x38, 0x0a, 0x06, 0x65, 0x76, 0x65,
+	0x6e, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32,
+	0x2e, 0x54, 0x72, 0x61, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x06, 0x65, 0x76, 0x65,
+	0x6e, 0x74, 0x73, 0x22, 0xfe, 0x02, 0x0a, 0x0a, 0x54, 0x72, 0x61, 0x63, 0x65, 0x45, 0x76, 0x65,
+	0x6e, 0x74, 0x12, 0x38, 0x0a, 0x08, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
+	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x54, 0x72, 0x61, 0x63,
+	0x65, 0x49, 0x44, 0x52, 0x07, 0x74, 0x72, 0x61, 0x63, 0x65, 0x49, 0x64, 0x12, 0x17, 0x0a, 0x07,
+	0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x73,
+	0x70, 0x61, 0x6e, 0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x69,
+	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x49, 0x64,
+	0x12, 0x39, 0x0a, 0x0a, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x52, 0x09, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x40, 0x0a, 0x0a, 0x73,
+	0x70, 0x61, 0x6e, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x70, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74,
+	0x48, 0x00, 0x52, 0x09, 0x73, 0x70, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x3a, 0x0a,
+	0x08, 0x73, 0x70, 0x61, 0x6e, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x70, 0x61, 0x6e, 0x45, 0x6e, 0x64, 0x48, 0x00,
+	0x52, 0x07, 0x73, 0x70, 0x61, 0x6e, 0x45, 0x6e, 0x64, 0x12, 0x40, 0x0a, 0x0a, 0x73, 0x70, 0x61,
+	0x6e, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1f, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x70, 0x61, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x48, 0x00,
+	0x52, 0x09, 0x73, 0x70, 0x61, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x42, 0x07, 0x0a, 0x05, 0x65,
+	0x76, 0x65, 0x6e, 0x74, 0x22, 0x9a, 0x05, 0x0a, 0x09, 0x53, 0x70, 0x61, 0x6e, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d,
+	0x52, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x12, 0x4a, 0x0a, 0x0f, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74,
+	0x5f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x54, 0x72, 0x61, 0x63, 0x65, 0x49, 0x44, 0x48, 0x01,
+	0x52, 0x0d, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x54, 0x72, 0x61, 0x63, 0x65, 0x49, 0x64, 0x88,
+	0x01, 0x01, 0x12, 0x29, 0x0a, 0x0e, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x70, 0x61,
+	0x6e, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x48, 0x02, 0x52, 0x0c, 0x70, 0x61,
+	0x72, 0x65, 0x6e, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x2b, 0x0a,
+	0x0f, 0x63, 0x61, 0x6c, 0x6c, 0x65, 0x72, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x48, 0x03, 0x52, 0x0d, 0x63, 0x61, 0x6c, 0x6c, 0x65, 0x72,
+	0x45, 0x76, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x3b, 0x0a, 0x17, 0x65, 0x78,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x63, 0x6f, 0x72, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x04, 0x52, 0x15, 0x65,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x43, 0x6f, 0x72, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x1c, 0x0a, 0x07, 0x64, 0x65, 0x66, 0x5f, 0x6c,
+	0x6f, 0x63, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x05, 0x52, 0x06, 0x64, 0x65, 0x66, 0x4c,
+	0x6f, 0x63, 0x88, 0x01, 0x01, 0x12, 0x42, 0x0a, 0x07, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00,
+	0x52, 0x07, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x39, 0x0a, 0x04, 0x61, 0x75, 0x74,
+	0x68, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x41,
+	0x75, 0x74, 0x68, 0x53, 0x70, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x04,
+	0x61, 0x75, 0x74, 0x68, 0x12, 0x55, 0x0a, 0x0e, 0x70, 0x75, 0x62, 0x73, 0x75, 0x62, 0x5f, 0x6d,
+	0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61,
+	0x63, 0x65, 0x32, 0x2e, 0x50, 0x75, 0x62, 0x73, 0x75, 0x62, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67,
+	0x65, 0x53, 0x70, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x0d, 0x70, 0x75,
+	0x62, 0x73, 0x75, 0x62, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x39, 0x0a, 0x04, 0x74,
+	0x65, 0x73, 0x74, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32,
+	0x2e, 0x54, 0x65, 0x73, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00,
+	0x52, 0x04, 0x74, 0x65, 0x73, 0x74, 0x42, 0x06, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x42, 0x12,
+	0x0a, 0x10, 0x5f, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f,
+	0x69, 0x64, 0x42, 0x11, 0x0a, 0x0f, 0x5f, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x70,
+	0x61, 0x6e, 0x5f, 0x69, 0x64, 0x42, 0x12, 0x0a, 0x10, 0x5f, 0x63, 0x61, 0x6c, 0x6c, 0x65, 0x72,
+	0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x42, 0x1a, 0x0a, 0x18, 0x5f, 0x65, 0x78,
+	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x63, 0x6f, 0x72, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x64, 0x65, 0x66, 0x5f, 0x6c, 0x6f,
+	0x63, 0x22, 0xf9, 0x04, 0x0a, 0x07, 0x53, 0x70, 0x61, 0x6e, 0x45, 0x6e, 0x64, 0x12, 0x25, 0x0a,
+	0x0e, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6e, 0x6f, 0x73, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0d, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e,
+	0x61, 0x6e, 0x6f, 0x73, 0x12, 0x36, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67,
+	0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72,
+	0x48, 0x01, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x88, 0x01, 0x01, 0x12, 0x46, 0x0a, 0x0b,
+	0x70, 0x61, 0x6e, 0x69, 0x63, 0x5f, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e,
+	0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72,
+	0x61, 0x63, 0x65, 0x48, 0x02, 0x52, 0x0a, 0x70, 0x61, 0x6e, 0x69, 0x63, 0x53, 0x74, 0x61, 0x63,
+	0x6b, 0x88, 0x01, 0x01, 0x12, 0x4a, 0x0a, 0x0f, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x74,
+	0x72, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x32, 0x2e, 0x54, 0x72, 0x61, 0x63, 0x65, 0x49, 0x44, 0x48, 0x03, 0x52, 0x0d,
+	0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x54, 0x72, 0x61, 0x63, 0x65, 0x49, 0x64, 0x88, 0x01, 0x01,
+	0x12, 0x29, 0x0a, 0x0e, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x70, 0x61, 0x6e, 0x5f,
+	0x69, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x48, 0x04, 0x52, 0x0c, 0x70, 0x61, 0x72, 0x65,
+	0x6e, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x40, 0x0a, 0x07, 0x72,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61,
+	0x63, 0x65, 0x32, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x45,
+	0x6e, 0x64, 0x48, 0x00, 0x52, 0x07, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x37, 0x0a,
+	0x04, 0x61, 0x75, 0x74, 0x68, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x32, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x53, 0x70, 0x61, 0x6e, 0x45, 0x6e, 0x64, 0x48, 0x00,
+	0x52, 0x04, 0x61, 0x75, 0x74, 0x68, 0x12, 0x53, 0x0a, 0x0e, 0x70, 0x75, 0x62, 0x73, 0x75, 0x62,
+	0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74,
+	0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x50, 0x75, 0x62, 0x73, 0x75, 0x62, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x53, 0x70, 0x61, 0x6e, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x0d, 0x70, 0x75,
+	0x62, 0x73, 0x75, 0x62, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x37, 0x0a, 0x04, 0x74,
+	0x65, 0x73, 0x74, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32,
+	0x2e, 0x54, 0x65, 0x73, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x04,
+	0x74, 0x65, 0x73, 0x74, 0x42, 0x06, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x42, 0x08, 0x0a, 0x06,
+	0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x42, 0x0e, 0x0a, 0x0c, 0x5f, 0x70, 0x61, 0x6e, 0x69, 0x63,
+	0x5f, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x42, 0x12, 0x0a, 0x10, 0x5f, 0x70, 0x61, 0x72, 0x65, 0x6e,
+	0x74, 0x5f, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x42, 0x11, 0x0a, 0x0f, 0x5f, 0x70,
+	0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69, 0x64, 0x22, 0x9b, 0x04,
+	0x0a, 0x10, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x74,
+	0x74, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0a, 0x68, 0x74, 0x74, 0x70, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x70,
+	0x61, 0x74, 0x68, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12,
+	0x1f, 0x0a, 0x0b, 0x70, 0x61, 0x74, 0x68, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x18, 0x05,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x61, 0x74, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x73,
+	0x12, 0x63, 0x0a, 0x0f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x68, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3a, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32,
+	0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x72,
+	0x74, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0e, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x65,
+	0x61, 0x64, 0x65, 0x72, 0x73, 0x12, 0x2c, 0x0a, 0x0f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00,
+	0x52, 0x0e, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
+	0x88, 0x01, 0x01, 0x12, 0x31, 0x0a, 0x12, 0x65, 0x78, 0x74, 0x5f, 0x63, 0x6f, 0x72, 0x72, 0x65,
+	0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x48,
+	0x01, 0x52, 0x10, 0x65, 0x78, 0x74, 0x43, 0x6f, 0x72, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x15, 0x0a, 0x03, 0x75, 0x69, 0x64, 0x18, 0x09, 0x20,
+	0x01, 0x28, 0x09, 0x48, 0x02, 0x52, 0x03, 0x75, 0x69, 0x64, 0x88, 0x01, 0x01, 0x12, 0x16, 0x0a,
+	0x06, 0x6d, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x6d,
+	0x6f, 0x63, 0x6b, 0x65, 0x64, 0x1a, 0x41, 0x0a, 0x13, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x12, 0x0a, 0x10, 0x5f, 0x72, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x42, 0x15, 0x0a, 0x13,
+	0x5f, 0x65, 0x78, 0x74, 0x5f, 0x63, 0x6f, 0x72, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x5f, 0x69, 0x64, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x75, 0x69, 0x64, 0x22, 0xf1, 0x02, 0x0a, 0x0e,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x45, 0x6e, 0x64, 0x12, 0x21,
+	0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d,
+	0x65, 0x12, 0x23, 0x0a, 0x0d, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69,
+	0x6e, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x28, 0x0a, 0x10, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x73,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d,
+	0x52, 0x0e, 0x68, 0x74, 0x74, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x43, 0x6f, 0x64, 0x65,
+	0x12, 0x64, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x68, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x39, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x32, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x45, 0x6e, 0x64,
+	0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x12, 0x2e, 0x0a, 0x10, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0c,
+	0x48, 0x00, 0x52, 0x0f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x50, 0x61, 0x79, 0x6c,
+	0x6f, 0x61, 0x64, 0x88, 0x01, 0x01, 0x1a, 0x42, 0x0a, 0x14, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10,
+	0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79,
+	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x72,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22,
+	0x90, 0x01, 0x0a, 0x0d, 0x41, 0x75, 0x74, 0x68, 0x53, 0x70, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x72,
+	0x74, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x6e, 0x64,
+	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x26, 0x0a, 0x0c, 0x61, 0x75, 0x74,
+	0x68, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x48,
+	0x00, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x88, 0x01,
+	0x01, 0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f,
+	0x61, 0x64, 0x22, 0x97, 0x01, 0x0a, 0x0b, 0x41, 0x75, 0x74, 0x68, 0x53, 0x70, 0x61, 0x6e, 0x45,
+	0x6e, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x23, 0x0a, 0x0d, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x65, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x69,
+	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x69, 0x64, 0x12, 0x20, 0x0a, 0x09,
+	0x75, 0x73, 0x65, 0x72, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c, 0x48,
+	0x00, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x44, 0x61, 0x74, 0x61, 0x88, 0x01, 0x01, 0x42, 0x0c,
+	0x0a, 0x0a, 0x5f, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x22, 0xc1, 0x02, 0x0a,
+	0x16, 0x50, 0x75, 0x62, 0x73, 0x75, 0x62, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x53, 0x70,
+	0x61, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f,
+	0x70, 0x69, 0x63, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x74, 0x6f, 0x70, 0x69, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2b, 0x0a, 0x11, 0x73, 0x75, 0x62,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67,
+	0x65, 0x5f, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x49, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x61, 0x74, 0x74, 0x65, 0x6d, 0x70, 0x74,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07, 0x61, 0x74, 0x74, 0x65, 0x6d, 0x70, 0x74, 0x12,
+	0x3d, 0x0a, 0x0c, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x52, 0x0b, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x54, 0x69, 0x6d, 0x65, 0x12, 0x2c,
+	0x0a, 0x0f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61,
+	0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x0e, 0x6d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x50, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x88, 0x01, 0x01, 0x42, 0x12, 0x0a, 0x10,
+	0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
+	0x22, 0x85, 0x01, 0x0a, 0x14, 0x50, 0x75, 0x62, 0x73, 0x75, 0x62, 0x4d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x53, 0x70, 0x61, 0x6e, 0x45, 0x6e, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a,
+	0x74, 0x6f, 0x70, 0x69, 0x63, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2b, 0x0a, 0x11, 0x73,
+	0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x9b, 0x01, 0x0a, 0x0d, 0x54, 0x65, 0x73,
+	0x74, 0x53, 0x70, 0x61, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a,
+	0x09, 0x74, 0x65, 0x73, 0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x08, 0x74, 0x65, 0x73, 0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x69,
+	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x69, 0x64, 0x12, 0x1b, 0x0a, 0x09,
+	0x74, 0x65, 0x73, 0x74, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x08, 0x74, 0x65, 0x73, 0x74, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x65, 0x73,
+	0x74, 0x5f, 0x6c, 0x69, 0x6e, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x74, 0x65,
+	0x73, 0x74, 0x4c, 0x69, 0x6e, 0x65, 0x22, 0x7f, 0x0a, 0x0b, 0x54, 0x65, 0x73, 0x74, 0x53, 0x70,
+	0x61, 0x6e, 0x45, 0x6e, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x65, 0x73, 0x74,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x65, 0x73,
+	0x74, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x66, 0x61, 0x69, 0x6c, 0x65, 0x64, 0x12, 0x18, 0x0a,
+	0x07, 0x73, 0x6b, 0x69, 0x70, 0x70, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07,
+	0x73, 0x6b, 0x69, 0x70, 0x70, 0x65, 0x64, 0x22, 0xe3, 0x13, 0x0a, 0x09, 0x53, 0x70, 0x61, 0x6e,
+	0x45, 0x76, 0x65, 0x6e, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x04, 0x67, 0x6f, 0x69, 0x64, 0x12, 0x1c, 0x0a, 0x07, 0x64, 0x65, 0x66,
+	0x5f, 0x6c, 0x6f, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x01, 0x52, 0x06, 0x64, 0x65,
+	0x66, 0x4c, 0x6f, 0x63, 0x88, 0x01, 0x01, 0x12, 0x35, 0x0a, 0x14, 0x63, 0x6f, 0x72, 0x72, 0x65,
+	0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x04, 0x48, 0x02, 0x52, 0x12, 0x63, 0x6f, 0x72, 0x72, 0x65, 0x6c, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x43,
+	0x0a, 0x0b, 0x6c, 0x6f, 0x67, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x0a, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67,
+	0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x4c, 0x6f, 0x67, 0x4d, 0x65,
+	0x73, 0x73, 0x61, 0x67, 0x65, 0x48, 0x00, 0x52, 0x0a, 0x6c, 0x6f, 0x67, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x12, 0x43, 0x0a, 0x0b, 0x62, 0x6f, 0x64, 0x79, 0x5f, 0x73, 0x74, 0x72, 0x65,
+	0x61, 0x6d, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e,
+	0x42, 0x6f, 0x64, 0x79, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x48, 0x00, 0x52, 0x0a, 0x62, 0x6f,
+	0x64, 0x79, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x4a, 0x0a, 0x0e, 0x72, 0x70, 0x63, 0x5f,
+	0x63, 0x61, 0x6c, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65,
+	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x52, 0x50, 0x43, 0x43, 0x61, 0x6c, 0x6c, 0x53,
+	0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x0c, 0x72, 0x70, 0x63, 0x43, 0x61, 0x6c, 0x6c, 0x53,
+	0x74, 0x61, 0x72, 0x74, 0x12, 0x44, 0x0a, 0x0c, 0x72, 0x70, 0x63, 0x5f, 0x63, 0x61, 0x6c, 0x6c,
+	0x5f, 0x65, 0x6e, 0x64, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x32, 0x2e, 0x52, 0x50, 0x43, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x0a,
+	0x72, 0x70, 0x63, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x6e, 0x64, 0x12, 0x5c, 0x0a, 0x14, 0x64, 0x62,
+	0x5f, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e,
+	0x44, 0x42, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x48, 0x00, 0x52, 0x12, 0x64, 0x62, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x61, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x56, 0x0a, 0x12, 0x64, 0x62, 0x5f, 0x74,
+	0x72, 0x61, 0x6e, 0x73, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x0f,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
+	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x44, 0x42, 0x54, 0x72,
+	0x61, 0x6e, 0x73, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x10,
+	0x64, 0x62, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64,
+	0x12, 0x4a, 0x0a, 0x0e, 0x64, 0x62, 0x5f, 0x71, 0x75, 0x65, 0x72, 0x79, 0x5f, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x18, 0x10, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e,
+	0x44, 0x42, 0x51, 0x75, 0x65, 0x72, 0x79, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x0c,
+	0x64, 0x62, 0x51, 0x75, 0x65, 0x72, 0x79, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x44, 0x0a, 0x0c,
+	0x64, 0x62, 0x5f, 0x71, 0x75, 0x65, 0x72, 0x79, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x11, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69,
+	0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x44, 0x42, 0x51, 0x75, 0x65, 0x72,
+	0x79, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x0a, 0x64, 0x62, 0x51, 0x75, 0x65, 0x72, 0x79, 0x45,
+	0x6e, 0x64, 0x12, 0x4d, 0x0a, 0x0f, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x61, 0x6c, 0x6c, 0x5f,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x12, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x32, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x43, 0x61, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72, 0x74,
+	0x48, 0x00, 0x52, 0x0d, 0x68, 0x74, 0x74, 0x70, 0x43, 0x61, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72,
+	0x74, 0x12, 0x47, 0x0a, 0x0d, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x63, 0x61, 0x6c, 0x6c, 0x5f, 0x65,
+	0x6e, 0x64, 0x18, 0x13, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e,
+	0x48, 0x54, 0x54, 0x50, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x0b, 0x68,
+	0x74, 0x74, 0x70, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x6e, 0x64, 0x12, 0x5c, 0x0a, 0x14, 0x70, 0x75,
+	0x62, 0x73, 0x75, 0x62, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x5f, 0x73, 0x74, 0x61,
+	0x72, 0x74, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e,
+	0x50, 0x75, 0x62, 0x73, 0x75, 0x62, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x48, 0x00, 0x52, 0x12, 0x70, 0x75, 0x62, 0x73, 0x75, 0x62, 0x50, 0x75, 0x62, 0x6c,
+	0x69, 0x73, 0x68, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x56, 0x0a, 0x12, 0x70, 0x75, 0x62, 0x73,
+	0x75, 0x62, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x15,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
+	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x50, 0x75, 0x62, 0x73,
+	0x75, 0x62, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x10,
+	0x70, 0x75, 0x62, 0x73, 0x75, 0x62, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x45, 0x6e, 0x64,
+	0x12, 0x50, 0x0a, 0x10, 0x63, 0x61, 0x63, 0x68, 0x65, 0x5f, 0x63, 0x61, 0x6c, 0x6c, 0x5f, 0x73,
+	0x74, 0x61, 0x72, 0x74, 0x18, 0x16, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x32, 0x2e, 0x43, 0x61, 0x63, 0x68, 0x65, 0x43, 0x61, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72, 0x74,
+	0x48, 0x00, 0x52, 0x0e, 0x63, 0x61, 0x63, 0x68, 0x65, 0x43, 0x61, 0x6c, 0x6c, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x12, 0x4a, 0x0a, 0x0e, 0x63, 0x61, 0x63, 0x68, 0x65, 0x5f, 0x63, 0x61, 0x6c, 0x6c,
+	0x5f, 0x65, 0x6e, 0x64, 0x18, 0x17, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x32, 0x2e, 0x43, 0x61, 0x63, 0x68, 0x65, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x6e, 0x64, 0x48, 0x00,
+	0x52, 0x0c, 0x63, 0x61, 0x63, 0x68, 0x65, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x6e, 0x64, 0x12, 0x56,
+	0x0a, 0x12, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x69, 0x6e, 0x69, 0x74, 0x5f, 0x73,
+	0x74, 0x61, 0x72, 0x74, 0x18, 0x18, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x32, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x48, 0x00, 0x52, 0x10, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69,
+	0x74, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x50, 0x0a, 0x10, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x5f, 0x69, 0x6e, 0x69, 0x74, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x19, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65,
+	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49,
+	0x6e, 0x69, 0x74, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x0e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x49, 0x6e, 0x69, 0x74, 0x45, 0x6e, 0x64, 0x12, 0x6c, 0x0a, 0x1a, 0x62, 0x75, 0x63, 0x6b,
+	0x65, 0x74, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x70, 0x6c, 0x6f, 0x61, 0x64,
+	0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x1a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61,
+	0x63, 0x65, 0x32, 0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x17, 0x62,
+	0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x55, 0x70, 0x6c, 0x6f, 0x61,
+	0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x66, 0x0a, 0x18, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74,
+	0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x75, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x65,
+	0x6e, 0x64, 0x18, 0x1b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e,
+	0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x55, 0x70, 0x6c, 0x6f,
+	0x61, 0x64, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x15, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x45, 0x6e, 0x64, 0x12, 0x72,
+	0x0a, 0x1c, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f,
+	0x64, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x1c,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
+	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x42, 0x75, 0x63, 0x6b,
+	0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64,
+	0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x19, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x12, 0x6c, 0x0a, 0x1a, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x5f, 0x6f, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x5f, 0x64, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x65, 0x6e, 0x64,
+	0x18, 0x1d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x42, 0x75,
+	0x63, 0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f,
+	0x61, 0x64, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x17, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f, 0x61, 0x64, 0x45, 0x6e, 0x64,
+	0x12, 0x73, 0x0a, 0x1d, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63,
+	0x74, 0x5f, 0x67, 0x65, 0x74, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x72,
+	0x74, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x42,
+	0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x47, 0x65, 0x74, 0x41, 0x74,
+	0x74, 0x72, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x19, 0x62, 0x75, 0x63, 0x6b,
+	0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x47, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x73,
+	0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x6d, 0x0a, 0x1b, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x5f,
+	0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x67, 0x65, 0x74, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x73,
+	0x5f, 0x65, 0x6e, 0x64, 0x18, 0x1f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x32, 0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x47, 0x65,
+	0x74, 0x41, 0x74, 0x74, 0x72, 0x73, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x17, 0x62, 0x75, 0x63,
+	0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x47, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72,
+	0x73, 0x45, 0x6e, 0x64, 0x12, 0x69, 0x0a, 0x19, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x5f, 0x6c,
+	0x69, 0x73, 0x74, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x72,
+	0x74, 0x18, 0x20, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x42,
+	0x75, 0x63, 0x6b, 0x65, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73,
+	0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x16, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4c,
+	0x69, 0x73, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12,
+	0x63, 0x0a, 0x17, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x5f, 0x6c, 0x69, 0x73, 0x74, 0x5f, 0x6f,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x21, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x2a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65,
+	0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4c, 0x69,
+	0x73, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x14,
+	0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74,
+	0x73, 0x45, 0x6e, 0x64, 0x12, 0x6f, 0x0a, 0x1b, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x5f, 0x64,
+	0x65, 0x6c, 0x65, 0x74, 0x65, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x5f, 0x73, 0x74,
+	0x61, 0x72, 0x74, 0x18, 0x22, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32,
+	0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4f, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x18, 0x62, 0x75, 0x63,
+	0x6b, 0x65, 0x74, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73,
+	0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x69, 0x0a, 0x19, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x5f,
+	0x64, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x5f, 0x65,
+	0x6e, 0x64, 0x18, 0x23, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e,
+	0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4f, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x73, 0x45, 0x6e, 0x64, 0x48, 0x00, 0x52, 0x16, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74,
+	0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x45, 0x6e, 0x64,
+	0x42, 0x06, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x64, 0x65, 0x66,
+	0x5f, 0x6c, 0x6f, 0x63, 0x42, 0x17, 0x0a, 0x15, 0x5f, 0x63, 0x6f, 0x72, 0x72, 0x65, 0x6c, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x5f, 0x69, 0x64, 0x22, 0xa8, 0x01,
+	0x0a, 0x0c, 0x52, 0x50, 0x43, 0x43, 0x61, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x2e,
+	0x0a, 0x13, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x74, 0x61, 0x72,
+	0x67, 0x65, 0x74, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x30,
+	0x0a, 0x14, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x74, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x4e, 0x61, 0x6d, 0x65,
+	0x12, 0x36, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63,
+	0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x22, 0x48, 0x0a, 0x0a, 0x52, 0x50, 0x43, 0x43,
+	0x61, 0x6c, 0x6c, 0x45, 0x6e, 0x64, 0x12, 0x32, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67,
+	0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72,
+	0x48, 0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x65,
+	0x72, 0x72, 0x22, 0x10, 0x0a, 0x0e, 0x47, 0x6f, 0x72, 0x6f, 0x75, 0x74, 0x69, 0x6e, 0x65, 0x53,
+	0x74, 0x61, 0x72, 0x74, 0x22, 0x0e, 0x0a, 0x0c, 0x47, 0x6f, 0x72, 0x6f, 0x75, 0x74, 0x69, 0x6e,
+	0x65, 0x45, 0x6e, 0x64, 0x22, 0x4c, 0x0a, 0x12, 0x44, 0x42, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x61,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x36, 0x0a, 0x05, 0x73, 0x74,
+	0x61, 0x63, 0x6b, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32,
+	0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61,
+	0x63, 0x6b, 0x22, 0x89, 0x02, 0x0a, 0x10, 0x44, 0x42, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x12, 0x55, 0x0a, 0x0a, 0x63, 0x6f, 0x6d, 0x70, 0x6c,
+	0x65, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x35, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x32, 0x2e, 0x44, 0x42, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x45, 0x6e, 0x64, 0x2e, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x79,
+	0x70, 0x65, 0x52, 0x0a, 0x63, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x36,
+	0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52,
+	0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x12, 0x32, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67,
+	0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72,
+	0x48, 0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01, 0x22, 0x2a, 0x0a, 0x0e, 0x43, 0x6f,
+	0x6d, 0x70, 0x6c, 0x65, 0x74, 0x69, 0x6f, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0c, 0x0a, 0x08,
+	0x52, 0x4f, 0x4c, 0x4c, 0x42, 0x41, 0x43, 0x4b, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x43, 0x4f,
+	0x4d, 0x4d, 0x49, 0x54, 0x10, 0x01, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x65, 0x72, 0x72, 0x22, 0x5c,
+	0x0a, 0x0c, 0x44, 0x42, 0x51, 0x75, 0x65, 0x72, 0x79, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x14,
+	0x0a, 0x05, 0x71, 0x75, 0x65, 0x72, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x71,
+	0x75, 0x65, 0x72, 0x79, 0x12, 0x36, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67,
+	0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b,
+	0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x22, 0x48, 0x0a, 0x0a,
+	0x44, 0x42, 0x51, 0x75, 0x65, 0x72, 0x79, 0x45, 0x6e, 0x64, 0x12, 0x32, 0x0a, 0x03, 0x65, 0x72,
+	0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x45,
+	0x72, 0x72, 0x6f, 0x72, 0x48, 0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01, 0x42, 0x06,
+	0x0a, 0x04, 0x5f, 0x65, 0x72, 0x72, 0x22, 0x7c, 0x0a, 0x12, 0x50, 0x75, 0x62, 0x73, 0x75, 0x62,
+	0x50, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x14, 0x0a, 0x05,
+	0x74, 0x6f, 0x70, 0x69, 0x63, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x70,
+	0x69, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x07, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x12, 0x36, 0x0a, 0x05,
+	0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73,
+	0x74, 0x61, 0x63, 0x6b, 0x22, 0x81, 0x01, 0x0a, 0x10, 0x50, 0x75, 0x62, 0x73, 0x75, 0x62, 0x50,
+	0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x45, 0x6e, 0x64, 0x12, 0x22, 0x0a, 0x0a, 0x6d, 0x65, 0x73,
+	0x73, 0x61, 0x67, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52,
+	0x09, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x32, 0x0a,
+	0x03, 0x65, 0x72, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x32, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x48, 0x01, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01,
+	0x01, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x69, 0x64,
+	0x42, 0x06, 0x0a, 0x04, 0x5f, 0x65, 0x72, 0x72, 0x22, 0x2c, 0x0a, 0x10, 0x53, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x18, 0x0a, 0x07,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x22, 0x4c, 0x0a, 0x0e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x49, 0x6e, 0x69, 0x74, 0x45, 0x6e, 0x64, 0x12, 0x32, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
+	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x45, 0x72, 0x72,
+	0x6f, 0x72, 0x48, 0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01, 0x42, 0x06, 0x0a, 0x04,
+	0x5f, 0x65, 0x72, 0x72, 0x22, 0x90, 0x01, 0x0a, 0x0e, 0x43, 0x61, 0x63, 0x68, 0x65, 0x43, 0x61,
+	0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x6f, 0x70, 0x65, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6f, 0x70, 0x65, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x04, 0x6b, 0x65, 0x79, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x77, 0x72, 0x69,
+	0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x77, 0x72, 0x69, 0x74, 0x65, 0x12,
+	0x36, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74,
+	0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65,
+	0x52, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x22, 0xd4, 0x01, 0x0a, 0x0c, 0x43, 0x61, 0x63, 0x68,
+	0x65, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x6e, 0x64, 0x12, 0x41, 0x0a, 0x06, 0x72, 0x65, 0x73, 0x75,
+	0x6c, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x29, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e,
+	0x43, 0x61, 0x63, 0x68, 0x65, 0x43, 0x61, 0x6c, 0x6c, 0x45, 0x6e, 0x64, 0x2e, 0x52, 0x65, 0x73,
+	0x75, 0x6c, 0x74, 0x52, 0x06, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x12, 0x32, 0x0a, 0x03, 0x65,
+	0x72, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e,
+	0x45, 0x72, 0x72, 0x6f, 0x72, 0x48, 0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01, 0x22,
+	0x45, 0x0a, 0x06, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b,
+	0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x06, 0x0a, 0x02, 0x4f, 0x4b, 0x10, 0x01, 0x12, 0x0f,
+	0x0a, 0x0b, 0x4e, 0x4f, 0x5f, 0x53, 0x55, 0x43, 0x48, 0x5f, 0x4b, 0x45, 0x59, 0x10, 0x02, 0x12,
+	0x0c, 0x0a, 0x08, 0x43, 0x4f, 0x4e, 0x46, 0x4c, 0x49, 0x43, 0x54, 0x10, 0x03, 0x12, 0x07, 0x0a,
+	0x03, 0x45, 0x52, 0x52, 0x10, 0x04, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x65, 0x72, 0x72, 0x22, 0xc5,
+	0x01, 0x0a, 0x17, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x55,
+	0x70, 0x6c, 0x6f, 0x61, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x62, 0x75,
+	0x63, 0x6b, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x62, 0x75, 0x63, 0x6b,
+	0x65, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x42, 0x0a, 0x05, 0x61, 0x74,
+	0x74, 0x72, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32,
+	0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x41, 0x74, 0x74,
+	0x72, 0x69, 0x62, 0x75, 0x74, 0x65, 0x73, 0x52, 0x05, 0x61, 0x74, 0x74, 0x72, 0x73, 0x12, 0x36,
+	0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52,
+	0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x22, 0xa0, 0x01, 0x0a, 0x15, 0x42, 0x75, 0x63, 0x6b, 0x65,
+	0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x45, 0x6e, 0x64,
+	0x12, 0x32, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x32, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x48, 0x00, 0x52, 0x03, 0x65, 0x72,
+	0x72, 0x88, 0x01, 0x01, 0x12, 0x17, 0x0a, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x04, 0x48, 0x01, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x88, 0x01, 0x01, 0x12, 0x1d, 0x0a,
+	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x02,
+	0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x42, 0x06, 0x0a, 0x04,
+	0x5f, 0x65, 0x72, 0x72, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x42, 0x0a, 0x0a,
+	0x08, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0xae, 0x01, 0x0a, 0x19, 0x42, 0x75,
+	0x63, 0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f,
+	0x61, 0x64, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x62, 0x75, 0x63, 0x6b, 0x65,
+	0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x12,
+	0x16, 0x0a, 0x06, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x06, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x1d, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x12, 0x36, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65,
+	0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74, 0x61,
+	0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x42, 0x0a,
+	0x0a, 0x08, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0x77, 0x0a, 0x17, 0x42, 0x75,
+	0x63, 0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x77, 0x6e, 0x6c, 0x6f,
+	0x61, 0x64, 0x45, 0x6e, 0x64, 0x12, 0x32, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69,
+	0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x48,
+	0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01, 0x12, 0x17, 0x0a, 0x04, 0x73, 0x69, 0x7a,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x48, 0x01, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x88,
+	0x01, 0x01, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x65, 0x72, 0x72, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x73,
+	0x69, 0x7a, 0x65, 0x22, 0xae, 0x01, 0x0a, 0x19, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x47, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x73, 0x53, 0x74, 0x61, 0x72,
+	0x74, 0x12, 0x16, 0x0a, 0x06, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x06, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x62, 0x6a,
+	0x65, 0x63, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6f, 0x62, 0x6a, 0x65, 0x63,
+	0x74, 0x12, 0x1d, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x48, 0x00, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01,
+	0x12, 0x36, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63,
+	0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x76, 0x65, 0x72,
+	0x73, 0x69, 0x6f, 0x6e, 0x22, 0xa8, 0x01, 0x0a, 0x17, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4f,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x47, 0x65, 0x74, 0x41, 0x74, 0x74, 0x72, 0x73, 0x45, 0x6e, 0x64,
+	0x12, 0x32, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x32, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x48, 0x00, 0x52, 0x03, 0x65, 0x72,
+	0x72, 0x88, 0x01, 0x01, 0x12, 0x47, 0x0a, 0x05, 0x61, 0x74, 0x74, 0x72, 0x73, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67,
+	0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65,
+	0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75, 0x74, 0x65,
+	0x73, 0x48, 0x01, 0x52, 0x05, 0x61, 0x74, 0x74, 0x72, 0x73, 0x88, 0x01, 0x01, 0x42, 0x06, 0x0a,
+	0x04, 0x5f, 0x65, 0x72, 0x72, 0x42, 0x08, 0x0a, 0x06, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x73, 0x22,
+	0x90, 0x01, 0x0a, 0x16, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4c, 0x69, 0x73, 0x74, 0x4f, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x62, 0x75,
+	0x63, 0x6b, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x62, 0x75, 0x63, 0x6b,
+	0x65, 0x74, 0x12, 0x1b, 0x0a, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x48, 0x00, 0x52, 0x06, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x88, 0x01, 0x01, 0x12,
+	0x36, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74,
+	0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65,
+	0x52, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x70, 0x72, 0x65, 0x66,
+	0x69, 0x78, 0x22, 0x89, 0x01, 0x0a, 0x14, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x4c, 0x69, 0x73,
+	0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x45, 0x6e, 0x64, 0x12, 0x32, 0x0a, 0x03, 0x65,
+	0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e,
+	0x45, 0x72, 0x72, 0x6f, 0x72, 0x48, 0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01, 0x12,
+	0x1a, 0x0a, 0x08, 0x6f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x08, 0x6f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x68,
+	0x61, 0x73, 0x5f, 0x6d, 0x6f, 0x72, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x68,
+	0x61, 0x73, 0x4d, 0x6f, 0x72, 0x65, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x65, 0x72, 0x72, 0x22, 0xb3,
+	0x01, 0x0a, 0x18, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x4f,
+	0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x62,
+	0x75, 0x63, 0x6b, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x62, 0x75, 0x63,
+	0x6b, 0x65, 0x74, 0x12, 0x36, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69,
+	0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54,
+	0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x12, 0x47, 0x0a, 0x07, 0x65,
+	0x6e, 0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61,
+	0x63, 0x65, 0x32, 0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65,
+	0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x65, 0x6e, 0x74,
+	0x72, 0x69, 0x65, 0x73, 0x22, 0x5c, 0x0a, 0x17, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x44, 0x65,
+	0x6c, 0x65, 0x74, 0x65, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x16, 0x0a, 0x06, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x06, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x12, 0x1d, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x22, 0x54, 0x0a, 0x16, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x44, 0x65, 0x6c, 0x65,
+	0x74, 0x65, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x45, 0x6e, 0x64, 0x12, 0x32, 0x0a, 0x03,
+	0x65, 0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32,
+	0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x48, 0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01,
+	0x42, 0x06, 0x0a, 0x04, 0x5f, 0x65, 0x72, 0x72, 0x22, 0xc0, 0x01, 0x0a, 0x16, 0x42, 0x75, 0x63,
+	0x6b, 0x65, 0x74, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x41, 0x74, 0x74, 0x72, 0x69, 0x62, 0x75,
+	0x74, 0x65, 0x73, 0x12, 0x17, 0x0a, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x04, 0x48, 0x00, 0x52, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x88, 0x01, 0x01, 0x12, 0x1d, 0x0a, 0x07,
+	0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52,
+	0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x12, 0x17, 0x0a, 0x04, 0x65,
+	0x74, 0x61, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x02, 0x52, 0x04, 0x65, 0x74, 0x61,
+	0x67, 0x88, 0x01, 0x01, 0x12, 0x26, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x5f,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x03, 0x52, 0x0b, 0x63, 0x6f,
+	0x6e, 0x74, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x88, 0x01, 0x01, 0x42, 0x07, 0x0a, 0x05,
+	0x5f, 0x73, 0x69, 0x7a, 0x65, 0x42, 0x0a, 0x0a, 0x08, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x65, 0x74, 0x61, 0x67, 0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x63,
+	0x6f, 0x6e, 0x74, 0x65, 0x6e, 0x74, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x22, 0x61, 0x0a, 0x0a, 0x42,
+	0x6f, 0x64, 0x79, 0x53, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x73, 0x5f,
+	0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a,
+	0x69, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1e, 0x0a, 0x0a, 0x6f, 0x76,
+	0x65, 0x72, 0x66, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a,
+	0x6f, 0x76, 0x65, 0x72, 0x66, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0xd5,
+	0x01, 0x0a, 0x0d, 0x48, 0x54, 0x54, 0x50, 0x43, 0x61, 0x6c, 0x6c, 0x53, 0x74, 0x61, 0x72, 0x74,
+	0x12, 0x3b, 0x0a, 0x1a, 0x63, 0x6f, 0x72, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f,
+	0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x70, 0x61, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x17, 0x63, 0x6f, 0x72, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x50, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x49, 0x64, 0x12, 0x16, 0x0a,
+	0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d,
+	0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x36, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74,
+	0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x12,
+	0x25, 0x0a, 0x0e, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x6e, 0x61, 0x6e, 0x6f, 0x74, 0x69, 0x6d,
+	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0d, 0x73, 0x74, 0x61, 0x72, 0x74, 0x4e, 0x61,
+	0x6e, 0x6f, 0x74, 0x69, 0x6d, 0x65, 0x22, 0xc8, 0x01, 0x0a, 0x0b, 0x48, 0x54, 0x54, 0x50, 0x43,
+	0x61, 0x6c, 0x6c, 0x45, 0x6e, 0x64, 0x12, 0x24, 0x0a, 0x0b, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
+	0x5f, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x48, 0x00, 0x52, 0x0a, 0x73,
+	0x74, 0x61, 0x74, 0x75, 0x73, 0x43, 0x6f, 0x64, 0x65, 0x88, 0x01, 0x01, 0x12, 0x32, 0x0a, 0x03,
+	0x65, 0x72, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32,
+	0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x48, 0x01, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01,
+	0x12, 0x47, 0x0a, 0x0c, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48, 0x54,
+	0x54, 0x50, 0x54, 0x72, 0x61, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x52, 0x0b, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x42, 0x0e, 0x0a, 0x0c, 0x5f, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x5f, 0x63, 0x6f, 0x64, 0x65, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x65, 0x72,
+	0x72, 0x22, 0x90, 0x09, 0x0a, 0x0e, 0x48, 0x54, 0x54, 0x50, 0x54, 0x72, 0x61, 0x63, 0x65, 0x45,
+	0x76, 0x65, 0x6e, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x6e, 0x61, 0x6e, 0x6f, 0x74, 0x69, 0x6d, 0x65,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x08, 0x6e, 0x61, 0x6e, 0x6f, 0x74, 0x69, 0x6d, 0x65,
+	0x12, 0x3e, 0x0a, 0x08, 0x67, 0x65, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69,
+	0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x47, 0x65,
+	0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x48, 0x00, 0x52, 0x07, 0x67, 0x65, 0x74, 0x43, 0x6f, 0x6e, 0x6e,
+	0x12, 0x3e, 0x0a, 0x08, 0x67, 0x6f, 0x74, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69,
+	0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x47, 0x6f,
+	0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x48, 0x00, 0x52, 0x07, 0x67, 0x6f, 0x74, 0x43, 0x6f, 0x6e, 0x6e,
+	0x12, 0x67, 0x0a, 0x17, 0x67, 0x6f, 0x74, 0x5f, 0x66, 0x69, 0x72, 0x73, 0x74, 0x5f, 0x72, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x2e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e,
+	0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x47, 0x6f, 0x74,
+	0x46, 0x69, 0x72, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x79, 0x74,
+	0x65, 0x48, 0x00, 0x52, 0x14, 0x67, 0x6f, 0x74, 0x46, 0x69, 0x72, 0x73, 0x74, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x79, 0x74, 0x65, 0x12, 0x54, 0x0a, 0x10, 0x67, 0x6f, 0x74,
+	0x5f, 0x31, 0x78, 0x78, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67,
+	0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x47,
+	0x6f, 0x74, 0x31, 0x78, 0x78, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x48, 0x00, 0x52,
+	0x0e, 0x67, 0x6f, 0x74, 0x31, 0x78, 0x78, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x41, 0x0a, 0x09, 0x64, 0x6e, 0x73, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69,
+	0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x44, 0x4e,
+	0x53, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x08, 0x64, 0x6e, 0x73, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x12, 0x3e, 0x0a, 0x08, 0x64, 0x6e, 0x73, 0x5f, 0x64, 0x6f, 0x6e, 0x65, 0x18, 0x07,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
+	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48, 0x54, 0x54, 0x50,
+	0x44, 0x4e, 0x53, 0x44, 0x6f, 0x6e, 0x65, 0x48, 0x00, 0x52, 0x07, 0x64, 0x6e, 0x73, 0x44, 0x6f,
+	0x6e, 0x65, 0x12, 0x4d, 0x0a, 0x0d, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x5f, 0x73, 0x74,
+	0x61, 0x72, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32,
+	0x2e, 0x48, 0x54, 0x54, 0x50, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x53, 0x74, 0x61, 0x72,
+	0x74, 0x48, 0x00, 0x52, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x53, 0x74, 0x61, 0x72,
+	0x74, 0x12, 0x4a, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x5f, 0x64, 0x6f, 0x6e,
+	0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48,
+	0x54, 0x54, 0x50, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x6e, 0x65, 0x48, 0x00,
+	0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x6e, 0x65, 0x12, 0x5d, 0x0a,
+	0x13, 0x74, 0x6c, 0x73, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x5f, 0x73,
+	0x74, 0x61, 0x72, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x32, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x54, 0x4c, 0x53, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61,
+	0x6b, 0x65, 0x53, 0x74, 0x61, 0x72, 0x74, 0x48, 0x00, 0x52, 0x11, 0x74, 0x6c, 0x73, 0x48, 0x61,
+	0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x5a, 0x0a, 0x12,
+	0x74, 0x6c, 0x73, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x5f, 0x64, 0x6f,
+	0x6e, 0x65, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e,
+	0x48, 0x54, 0x54, 0x50, 0x54, 0x4c, 0x53, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65,
+	0x44, 0x6f, 0x6e, 0x65, 0x48, 0x00, 0x52, 0x10, 0x74, 0x6c, 0x73, 0x48, 0x61, 0x6e, 0x64, 0x73,
+	0x68, 0x61, 0x6b, 0x65, 0x44, 0x6f, 0x6e, 0x65, 0x12, 0x4d, 0x0a, 0x0d, 0x77, 0x72, 0x6f, 0x74,
+	0x65, 0x5f, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x26, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e,
+	0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x57, 0x72, 0x6f, 0x74, 0x65,
+	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x48, 0x00, 0x52, 0x0c, 0x77, 0x72, 0x6f, 0x74, 0x65,
+	0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x12, 0x4d, 0x0a, 0x0d, 0x77, 0x72, 0x6f, 0x74, 0x65,
+	0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74,
+	0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x57, 0x72, 0x6f, 0x74, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x0c, 0x77, 0x72, 0x6f, 0x74, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x57, 0x0a, 0x11, 0x77, 0x61, 0x69, 0x74, 0x5f, 0x31,
+	0x30, 0x30, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65, 0x18, 0x0e, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x29, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e,
+	0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48, 0x54, 0x54, 0x50, 0x57, 0x61, 0x69,
+	0x74, 0x31, 0x30, 0x30, 0x43, 0x6f, 0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65, 0x48, 0x00, 0x52, 0x0f,
+	0x77, 0x61, 0x69, 0x74, 0x31, 0x30, 0x30, 0x43, 0x6f, 0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65, 0x12,
+	0x4b, 0x0a, 0x0b, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x64, 0x5f, 0x62, 0x6f, 0x64, 0x79, 0x18, 0x0f,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e,
+	0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x48, 0x54, 0x54, 0x50,
+	0x43, 0x6c, 0x6f, 0x73, 0x65, 0x64, 0x42, 0x6f, 0x64, 0x79, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00,
+	0x52, 0x0a, 0x63, 0x6c, 0x6f, 0x73, 0x65, 0x64, 0x42, 0x6f, 0x64, 0x79, 0x42, 0x06, 0x0a, 0x04,
+	0x64, 0x61, 0x74, 0x61, 0x22, 0x2a, 0x0a, 0x0b, 0x48, 0x54, 0x54, 0x50, 0x47, 0x65, 0x74, 0x43,
+	0x6f, 0x6e, 0x6e, 0x12, 0x1b, 0x0a, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x5f, 0x70, 0x6f, 0x72, 0x74,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x68, 0x6f, 0x73, 0x74, 0x50, 0x6f, 0x72, 0x74,
+	0x22, 0x6a, 0x0a, 0x0b, 0x48, 0x54, 0x54, 0x50, 0x47, 0x6f, 0x74, 0x43, 0x6f, 0x6e, 0x6e, 0x12,
+	0x16, 0x0a, 0x06, 0x72, 0x65, 0x75, 0x73, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x06, 0x72, 0x65, 0x75, 0x73, 0x65, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x77, 0x61, 0x73, 0x5f, 0x69,
+	0x64, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x77, 0x61, 0x73, 0x49, 0x64,
+	0x6c, 0x65, 0x12, 0x28, 0x0a, 0x10, 0x69, 0x64, 0x6c, 0x65, 0x5f, 0x64, 0x75, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x5f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0e, 0x69, 0x64,
+	0x6c, 0x65, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4e, 0x73, 0x22, 0x1a, 0x0a, 0x18,
+	0x48, 0x54, 0x54, 0x50, 0x47, 0x6f, 0x74, 0x46, 0x69, 0x72, 0x73, 0x74, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x42, 0x79, 0x74, 0x65, 0x22, 0x28, 0x0a, 0x12, 0x48, 0x54, 0x54, 0x50,
+	0x47, 0x6f, 0x74, 0x31, 0x78, 0x78, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x63, 0x6f, 0x64, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52, 0x04, 0x63, 0x6f,
+	0x64, 0x65, 0x22, 0x22, 0x0a, 0x0c, 0x48, 0x54, 0x54, 0x50, 0x44, 0x4e, 0x53, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x22, 0x61, 0x0a, 0x0b, 0x48, 0x54, 0x54, 0x50, 0x44, 0x4e,
+	0x53, 0x44, 0x6f, 0x6e, 0x65, 0x12, 0x15, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0c, 0x48, 0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01, 0x12, 0x33, 0x0a, 0x05,
+	0x61, 0x64, 0x64, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x32, 0x2e, 0x44, 0x4e, 0x53, 0x41, 0x64, 0x64, 0x72, 0x52, 0x05, 0x61, 0x64, 0x64, 0x72,
+	0x73, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x65, 0x72, 0x72, 0x22, 0x19, 0x0a, 0x07, 0x44, 0x4e, 0x53,
+	0x41, 0x64, 0x64, 0x72, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x02, 0x69, 0x70, 0x22, 0x40, 0x0a, 0x10, 0x48, 0x54, 0x54, 0x50, 0x43, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f,
+	0x72, 0x6b, 0x12, 0x12, 0x0a, 0x04, 0x61, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x04, 0x61, 0x64, 0x64, 0x72, 0x22, 0x51, 0x0a, 0x0f, 0x48, 0x54, 0x54, 0x50, 0x43, 0x6f,
+	0x6e, 0x6e, 0x65, 0x63, 0x74, 0x44, 0x6f, 0x6e, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x6e, 0x65, 0x74,
+	0x77, 0x6f, 0x72, 0x6b, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77,
+	0x6f, 0x72, 0x6b, 0x12, 0x12, 0x0a, 0x04, 0x61, 0x64, 0x64, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x61, 0x64, 0x64, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0c, 0x52, 0x03, 0x65, 0x72, 0x72, 0x22, 0x17, 0x0a, 0x15, 0x48, 0x54, 0x54,
+	0x50, 0x54, 0x4c, 0x53, 0x48, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x53, 0x74, 0x61,
+	0x72, 0x74, 0x22, 0xcb, 0x01, 0x0a, 0x14, 0x48, 0x54, 0x54, 0x50, 0x54, 0x4c, 0x53, 0x48, 0x61,
+	0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x44, 0x6f, 0x6e, 0x65, 0x12, 0x15, 0x0a, 0x03, 0x65,
+	0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88,
+	0x01, 0x01, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x6c, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x74, 0x6c, 0x73, 0x56, 0x65, 0x72, 0x73,
+	0x69, 0x6f, 0x6e, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x69, 0x70, 0x68, 0x65, 0x72, 0x5f, 0x73, 0x75,
+	0x69, 0x74, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0b, 0x63, 0x69, 0x70, 0x68, 0x65,
+	0x72, 0x53, 0x75, 0x69, 0x74, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x73, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2f, 0x0a, 0x13, 0x6e, 0x65, 0x67, 0x6f, 0x74,
+	0x69, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x12, 0x6e, 0x65, 0x67, 0x6f, 0x74, 0x69, 0x61, 0x74, 0x65, 0x64,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x65, 0x72, 0x72,
+	0x22, 0x12, 0x0a, 0x10, 0x48, 0x54, 0x54, 0x50, 0x57, 0x72, 0x6f, 0x74, 0x65, 0x48, 0x65, 0x61,
+	0x64, 0x65, 0x72, 0x73, 0x22, 0x31, 0x0a, 0x10, 0x48, 0x54, 0x54, 0x50, 0x57, 0x72, 0x6f, 0x74,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x15, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01, 0x42,
+	0x06, 0x0a, 0x04, 0x5f, 0x65, 0x72, 0x72, 0x22, 0x15, 0x0a, 0x13, 0x48, 0x54, 0x54, 0x50, 0x57,
+	0x61, 0x69, 0x74, 0x31, 0x30, 0x30, 0x43, 0x6f, 0x6e, 0x74, 0x69, 0x6e, 0x75, 0x65, 0x22, 0x33,
+	0x0a, 0x12, 0x48, 0x54, 0x54, 0x50, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x64, 0x42, 0x6f, 0x64, 0x79,
+	0x44, 0x61, 0x74, 0x61, 0x12, 0x15, 0x0a, 0x03, 0x65, 0x72, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x48, 0x00, 0x52, 0x03, 0x65, 0x72, 0x72, 0x88, 0x01, 0x01, 0x42, 0x06, 0x0a, 0x04, 0x5f,
+	0x65, 0x72, 0x72, 0x22, 0x8a, 0x02, 0x0a, 0x0a, 0x4c, 0x6f, 0x67, 0x4d, 0x65, 0x73, 0x73, 0x61,
+	0x67, 0x65, 0x12, 0x3c, 0x0a, 0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0e, 0x32, 0x26, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e,
+	0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x4c, 0x6f, 0x67, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x2e, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x52, 0x05, 0x6c, 0x65, 0x76, 0x65, 0x6c,
+	0x12, 0x10, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d,
+	0x73, 0x67, 0x12, 0x36, 0x0a, 0x06, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69,
+	0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x4c, 0x6f, 0x67, 0x46, 0x69, 0x65,
+	0x6c, 0x64, 0x52, 0x06, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x12, 0x36, 0x0a, 0x05, 0x73, 0x74,
+	0x61, 0x63, 0x6b, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32,
+	0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61,
+	0x63, 0x6b, 0x22, 0x3c, 0x0a, 0x05, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x09, 0x0a, 0x05, 0x44,
+	0x45, 0x42, 0x55, 0x47, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x4e, 0x46, 0x4f, 0x10, 0x01,
+	0x12, 0x09, 0x0a, 0x05, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x57,
+	0x41, 0x52, 0x4e, 0x10, 0x03, 0x12, 0x09, 0x0a, 0x05, 0x54, 0x52, 0x41, 0x43, 0x45, 0x10, 0x04,
+	0x22, 0xd8, 0x02, 0x0a, 0x08, 0x4c, 0x6f, 0x67, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x33, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74,
+	0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x48, 0x00, 0x52, 0x05, 0x65,
+	0x72, 0x72, 0x6f, 0x72, 0x12, 0x12, 0x0a, 0x03, 0x73, 0x74, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x48, 0x00, 0x52, 0x03, 0x73, 0x74, 0x72, 0x12, 0x14, 0x0a, 0x04, 0x62, 0x6f, 0x6f, 0x6c,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x04, 0x62, 0x6f, 0x6f, 0x6c, 0x12, 0x30,
+	0x0a, 0x04, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x48, 0x00, 0x52, 0x04, 0x74, 0x69, 0x6d, 0x65,
+	0x12, 0x12, 0x0a, 0x03, 0x64, 0x75, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x03, 0x48, 0x00, 0x52,
+	0x03, 0x64, 0x75, 0x72, 0x12, 0x14, 0x0a, 0x04, 0x75, 0x75, 0x69, 0x64, 0x18, 0x07, 0x20, 0x01,
+	0x28, 0x0c, 0x48, 0x00, 0x52, 0x04, 0x75, 0x75, 0x69, 0x64, 0x12, 0x14, 0x0a, 0x04, 0x6a, 0x73,
+	0x6f, 0x6e, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x04, 0x6a, 0x73, 0x6f, 0x6e,
+	0x12, 0x12, 0x0a, 0x03, 0x69, 0x6e, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x03, 0x48, 0x00, 0x52,
+	0x03, 0x69, 0x6e, 0x74, 0x12, 0x14, 0x0a, 0x04, 0x75, 0x69, 0x6e, 0x74, 0x18, 0x0a, 0x20, 0x01,
+	0x28, 0x04, 0x48, 0x00, 0x52, 0x04, 0x75, 0x69, 0x6e, 0x74, 0x12, 0x1a, 0x0a, 0x07, 0x66, 0x6c,
+	0x6f, 0x61, 0x74, 0x33, 0x32, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x02, 0x48, 0x00, 0x52, 0x07, 0x66,
+	0x6c, 0x6f, 0x61, 0x74, 0x33, 0x32, 0x12, 0x1a, 0x0a, 0x07, 0x66, 0x6c, 0x6f, 0x61, 0x74, 0x36,
+	0x34, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x01, 0x48, 0x00, 0x52, 0x07, 0x66, 0x6c, 0x6f, 0x61, 0x74,
+	0x36, 0x34, 0x42, 0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x58, 0x0a, 0x0a, 0x53,
+	0x74, 0x61, 0x63, 0x6b, 0x54, 0x72, 0x61, 0x63, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x63, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x03, 0x52, 0x03, 0x70, 0x63, 0x73, 0x12, 0x38, 0x0a, 0x06, 0x66,
+	0x72, 0x61, 0x6d, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2e, 0x74, 0x72, 0x61, 0x63,
+	0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x46, 0x72, 0x61, 0x6d, 0x65, 0x52, 0x06, 0x66,
+	0x72, 0x61, 0x6d, 0x65, 0x73, 0x22, 0x50, 0x0a, 0x0a, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x46, 0x72,
+	0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x12, 0x0a, 0x04, 0x66, 0x75, 0x6e, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66,
+	0x75, 0x6e, 0x63, 0x12, 0x12, 0x0a, 0x04, 0x6c, 0x69, 0x6e, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x04, 0x6c, 0x69, 0x6e, 0x65, 0x22, 0x60, 0x0a, 0x05, 0x45, 0x72, 0x72, 0x6f, 0x72,
+	0x12, 0x10, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6d,
+	0x73, 0x67, 0x12, 0x3b, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x65, 0x6e, 0x67, 0x69, 0x6e,
+	0x65, 0x2e, 0x74, 0x72, 0x61, 0x63, 0x65, 0x32, 0x2e, 0x53, 0x74, 0x61, 0x63, 0x6b, 0x54, 0x72,
+	0x61, 0x63, 0x65, 0x48, 0x00, 0x52, 0x05, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x88, 0x01, 0x01, 0x42,
+	0x08, 0x0a, 0x06, 0x5f, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x2a, 0xb1, 0x02, 0x0a, 0x12, 0x48, 0x54,
+	0x54, 0x50, 0x54, 0x72, 0x61, 0x63, 0x65, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x64, 0x65,
+	0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x0c, 0x0a,
+	0x08, 0x47, 0x45, 0x54, 0x5f, 0x43, 0x4f, 0x4e, 0x4e, 0x10, 0x01, 0x12, 0x0c, 0x0a, 0x08, 0x47,
+	0x4f, 0x54, 0x5f, 0x43, 0x4f, 0x4e, 0x4e, 0x10, 0x02, 0x12, 0x1b, 0x0a, 0x17, 0x47, 0x4f, 0x54,
+	0x5f, 0x46, 0x49, 0x52, 0x53, 0x54, 0x5f, 0x52, 0x45, 0x53, 0x50, 0x4f, 0x4e, 0x53, 0x45, 0x5f,
+	0x42, 0x59, 0x54, 0x45, 0x10, 0x03, 0x12, 0x14, 0x0a, 0x10, 0x47, 0x4f, 0x54, 0x5f, 0x31, 0x58,
+	0x58, 0x5f, 0x52, 0x45, 0x53, 0x50, 0x4f, 0x4e, 0x53, 0x45, 0x10, 0x04, 0x12, 0x0d, 0x0a, 0x09,
+	0x44, 0x4e, 0x53, 0x5f, 0x53, 0x54, 0x41, 0x52, 0x54, 0x10, 0x05, 0x12, 0x0c, 0x0a, 0x08, 0x44,
+	0x4e, 0x53, 0x5f, 0x44, 0x4f, 0x4e, 0x45, 0x10, 0x06, 0x12, 0x11, 0x0a, 0x0d, 0x43, 0x4f, 0x4e,
+	0x4e, 0x45, 0x43, 0x54, 0x5f, 0x53, 0x54, 0x41, 0x52, 0x54, 0x10, 0x07, 0x12, 0x10, 0x0a, 0x0c,
+	0x43, 0x4f, 0x4e, 0x4e, 0x45, 0x43, 0x54, 0x5f, 0x44, 0x4f, 0x4e, 0x45, 0x10, 0x08, 0x12, 0x17,
+	0x0a, 0x13, 0x54, 0x4c, 0x53, 0x5f, 0x48, 0x41, 0x4e, 0x44, 0x53, 0x48, 0x41, 0x4b, 0x45, 0x5f,
+	0x53, 0x54, 0x41, 0x52, 0x54, 0x10, 0x09, 0x12, 0x16, 0x0a, 0x12, 0x54, 0x4c, 0x53, 0x5f, 0x48,
+	0x41, 0x4e, 0x44, 0x53, 0x48, 0x41, 0x4b, 0x45, 0x5f, 0x44, 0x4f, 0x4e, 0x45, 0x10, 0x0a, 0x12,
+	0x11, 0x0a, 0x0d, 0x57, 0x52, 0x4f, 0x54, 0x45, 0x5f, 0x48, 0x45, 0x41, 0x44, 0x45, 0x52, 0x53,
+	0x10, 0x0b, 0x12, 0x11, 0x0a, 0x0d, 0x57, 0x52, 0x4f, 0x54, 0x45, 0x5f, 0x52, 0x45, 0x51, 0x55,
+	0x45, 0x53, 0x54, 0x10, 0x0c, 0x12, 0x15, 0x0a, 0x11, 0x57, 0x41, 0x49, 0x54, 0x5f, 0x31, 0x30,
+	0x30, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x49, 0x4e, 0x55, 0x45, 0x10, 0x0d, 0x12, 0x0f, 0x0a, 0x0b,
+	0x43, 0x4c, 0x4f, 0x53, 0x45, 0x44, 0x5f, 0x42, 0x4f, 0x44, 0x59, 0x10, 0x0e, 0x42, 0x25, 0x5a,
+	0x23, 0x65, 0x6e, 0x63, 0x72, 0x2e, 0x64, 0x65, 0x76, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x65, 0x6e, 0x67, 0x69, 0x6e, 0x65, 0x2f, 0x74, 0x72,
+	0x61, 0x63, 0x65, 0x32, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_encore_engine_trace2_trace2_proto_rawDescOnce sync.Once
+	file_encore_engine_trace2_trace2_proto_rawDescData = file_encore_engine_trace2_trace2_proto_rawDesc
+)
+
+func file_encore_engine_trace2_trace2_proto_rawDescGZIP() []byte {
+	file_encore_engine_trace2_trace2_proto_rawDescOnce.Do(func() {
+		file_encore_engine_trace2_trace2_proto_rawDescData = protoimpl.X.CompressGZIP(file_encore_engine_trace2_trace2_proto_rawDescData)
+	})
+	return file_encore_engine_trace2_trace2_proto_rawDescData
+}
+
+var file_encore_engine_trace2_trace2_proto_enumTypes = make([]protoimpl.EnumInfo, 5)
+var file_encore_engine_trace2_trace2_proto_msgTypes = make([]protoimpl.MessageInfo, 67)
+var file_encore_engine_trace2_trace2_proto_goTypes = []interface{}{
+	(HTTPTraceEventCode)(0),              // 0: encore.engine.trace2.HTTPTraceEventCode
+	(SpanSummary_SpanType)(0),            // 1: encore.engine.trace2.SpanSummary.SpanType
+	(DBTransactionEnd_CompletionType)(0), // 2: encore.engine.trace2.DBTransactionEnd.CompletionType
+	(CacheCallEnd_Result)(0),             // 3: encore.engine.trace2.CacheCallEnd.Result
+	(LogMessage_Level)(0),                // 4: encore.engine.trace2.LogMessage.Level
+	(*SpanSummary)(nil),                  // 5: encore.engine.trace2.SpanSummary
+	(*TraceID)(nil),                      // 6: encore.engine.trace2.TraceID
+	(*EventList)(nil),                    // 7: encore.engine.trace2.EventList
+	(*TraceEvent)(nil),                   // 8: encore.engine.trace2.TraceEvent
+	(*SpanStart)(nil),                    // 9: encore.engine.trace2.SpanStart
+	(*SpanEnd)(nil),                      // 10: encore.engine.trace2.SpanEnd
+	(*RequestSpanStart)(nil),             // 11: encore.engine.trace2.RequestSpanStart
+	(*RequestSpanEnd)(nil),               // 12: encore.engine.trace2.RequestSpanEnd
+	(*AuthSpanStart)(nil),                // 13: encore.engine.trace2.AuthSpanStart
+	(*AuthSpanEnd)(nil),                  // 14: encore.engine.trace2.AuthSpanEnd
+	(*PubsubMessageSpanStart)(nil),       // 15: encore.engine.trace2.PubsubMessageSpanStart
+	(*PubsubMessageSpanEnd)(nil),         // 16: encore.engine.trace2.PubsubMessageSpanEnd
+	(*TestSpanStart)(nil),                // 17: encore.engine.trace2.TestSpanStart
+	(*TestSpanEnd)(nil),                  // 18: encore.engine.trace2.TestSpanEnd
+	(*SpanEvent)(nil),                    // 19: encore.engine.trace2.SpanEvent
+	(*RPCCallStart)(nil),                 // 20: encore.engine.trace2.RPCCallStart
+	(*RPCCallEnd)(nil),                   // 21: encore.engine.trace2.RPCCallEnd
+	(*GoroutineStart)(nil),               // 22: encore.engine.trace2.GoroutineStart
+	(*GoroutineEnd)(nil),                 // 23: encore.engine.trace2.GoroutineEnd
+	(*DBTransactionStart)(nil),           // 24: encore.engine.trace2.DBTransactionStart
+	(*DBTransactionEnd)(nil),             // 25: encore.engine.trace2.DBTransactionEnd
+	(*DBQueryStart)(nil),                 // 26: encore.engine.trace2.DBQueryStart
+	(*DBQueryEnd)(nil),                   // 27: encore.engine.trace2.DBQueryEnd
+	(*PubsubPublishStart)(nil),           // 28: encore.engine.trace2.PubsubPublishStart
+	(*PubsubPublishEnd)(nil),             // 29: encore.engine.trace2.PubsubPublishEnd
+	(*ServiceInitStart)(nil),             // 30: encore.engine.trace2.ServiceInitStart
+	(*ServiceInitEnd)(nil),               // 31: encore.engine.trace2.ServiceInitEnd
+	(*CacheCallStart)(nil),               // 32: encore.engine.trace2.CacheCallStart
+	(*CacheCallEnd)(nil),                 // 33: encore.engine.trace2.CacheCallEnd
+	(*BucketObjectUploadStart)(nil),      // 34: encore.engine.trace2.BucketObjectUploadStart
+	(*BucketObjectUploadEnd)(nil),        // 35: encore.engine.trace2.BucketObjectUploadEnd
+	(*BucketObjectDownloadStart)(nil),    // 36: encore.engine.trace2.BucketObjectDownloadStart
+	(*BucketObjectDownloadEnd)(nil),      // 37: encore.engine.trace2.BucketObjectDownloadEnd
+	(*BucketObjectGetAttrsStart)(nil),    // 38: encore.engine.trace2.BucketObjectGetAttrsStart
+	(*BucketObjectGetAttrsEnd)(nil),      // 39: encore.engine.trace2.BucketObjectGetAttrsEnd
+	(*BucketListObjectsStart)(nil),       // 40: encore.engine.trace2.BucketListObjectsStart
+	(*BucketListObjectsEnd)(nil),         // 41: encore.engine.trace2.BucketListObjectsEnd
+	(*BucketDeleteObjectsStart)(nil),     // 42: encore.engine.trace2.BucketDeleteObjectsStart
+	(*BucketDeleteObjectEntry)(nil),      // 43: encore.engine.trace2.BucketDeleteObjectEntry
+	(*BucketDeleteObjectsEnd)(nil),       // 44: encore.engine.trace2.BucketDeleteObjectsEnd
+	(*BucketObjectAttributes)(nil),       // 45: encore.engine.trace2.BucketObjectAttributes
+	(*BodyStream)(nil),                   // 46: encore.engine.trace2.BodyStream
+	(*HTTPCallStart)(nil),                // 47: encore.engine.trace2.HTTPCallStart
+	(*HTTPCallEnd)(nil),                  // 48: encore.engine.trace2.HTTPCallEnd
+	(*HTTPTraceEvent)(nil),               // 49: encore.engine.trace2.HTTPTraceEvent
+	(*HTTPGetConn)(nil),                  // 50: encore.engine.trace2.HTTPGetConn
+	(*HTTPGotConn)(nil),                  // 51: encore.engine.trace2.HTTPGotConn
+	(*HTTPGotFirstResponseByte)(nil),     // 52: encore.engine.trace2.HTTPGotFirstResponseByte
+	(*HTTPGot1XxResponse)(nil),           // 53: encore.engine.trace2.HTTPGot1xxResponse
+	(*HTTPDNSStart)(nil),                 // 54: encore.engine.trace2.HTTPDNSStart
+	(*HTTPDNSDone)(nil),                  // 55: encore.engine.trace2.HTTPDNSDone
+	(*DNSAddr)(nil),                      // 56: encore.engine.trace2.DNSAddr
+	(*HTTPConnectStart)(nil),             // 57: encore.engine.trace2.HTTPConnectStart
+	(*HTTPConnectDone)(nil),              // 58: encore.engine.trace2.HTTPConnectDone
+	(*HTTPTLSHandshakeStart)(nil),        // 59: encore.engine.trace2.HTTPTLSHandshakeStart
+	(*HTTPTLSHandshakeDone)(nil),         // 60: encore.engine.trace2.HTTPTLSHandshakeDone
+	(*HTTPWroteHeaders)(nil),             // 61: encore.engine.trace2.HTTPWroteHeaders
+	(*HTTPWroteRequest)(nil),             // 62: encore.engine.trace2.HTTPWroteRequest
+	(*HTTPWait100Continue)(nil),          // 63: encore.engine.trace2.HTTPWait100Continue
+	(*HTTPClosedBodyData)(nil),           // 64: encore.engine.trace2.HTTPClosedBodyData
+	(*LogMessage)(nil),                   // 65: encore.engine.trace2.LogMessage
+	(*LogField)(nil),                     // 66: encore.engine.trace2.LogField
+	(*StackTrace)(nil),                   // 67: encore.engine.trace2.StackTrace
+	(*StackFrame)(nil),                   // 68: encore.engine.trace2.StackFrame
+	(*Error)(nil),                        // 69: encore.engine.trace2.Error
+	nil,                                  // 70: encore.engine.trace2.RequestSpanStart.RequestHeadersEntry
+	nil,                                  // 71: encore.engine.trace2.RequestSpanEnd.ResponseHeadersEntry
+	(*timestamppb.Timestamp)(nil),        // 72: google.protobuf.Timestamp
+}
+var file_encore_engine_trace2_trace2_proto_depIdxs = []int32{
+	1,   // 0: encore.engine.trace2.SpanSummary.type:type_name -> encore.engine.trace2.SpanSummary.SpanType
+	72,  // 1: encore.engine.trace2.SpanSummary.started_at:type_name -> google.protobuf.Timestamp
+	8,   // 2: encore.engine.trace2.EventList.events:type_name -> encore.engine.trace2.TraceEvent
+	6,   // 3: encore.engine.trace2.TraceEvent.trace_id:type_name -> encore.engine.trace2.TraceID
+	72,  // 4: encore.engine.trace2.TraceEvent.event_time:type_name -> google.protobuf.Timestamp
+	9,   // 5: encore.engine.trace2.TraceEvent.span_start:type_name -> encore.engine.trace2.SpanStart
+	10,  // 6: encore.engine.trace2.TraceEvent.span_end:type_name -> encore.engine.trace2.SpanEnd
+	19,  // 7: encore.engine.trace2.TraceEvent.span_event:type_name -> encore.engine.trace2.SpanEvent
+	6,   // 8: encore.engine.trace2.SpanStart.parent_trace_id:type_name -> encore.engine.trace2.TraceID
+	11,  // 9: encore.engine.trace2.SpanStart.request:type_name -> encore.engine.trace2.RequestSpanStart
+	13,  // 10: encore.engine.trace2.SpanStart.auth:type_name -> encore.engine.trace2.AuthSpanStart
+	15,  // 11: encore.engine.trace2.SpanStart.pubsub_message:type_name -> encore.engine.trace2.PubsubMessageSpanStart
+	17,  // 12: encore.engine.trace2.SpanStart.test:type_name -> encore.engine.trace2.TestSpanStart
+	69,  // 13: encore.engine.trace2.SpanEnd.error:type_name -> encore.engine.trace2.Error
+	67,  // 14: encore.engine.trace2.SpanEnd.panic_stack:type_name -> encore.engine.trace2.StackTrace
+	6,   // 15: encore.engine.trace2.SpanEnd.parent_trace_id:type_name -> encore.engine.trace2.TraceID
+	12,  // 16: encore.engine.trace2.SpanEnd.request:type_name -> encore.engine.trace2.RequestSpanEnd
+	14,  // 17: encore.engine.trace2.SpanEnd.auth:type_name -> encore.engine.trace2.AuthSpanEnd
+	16,  // 18: encore.engine.trace2.SpanEnd.pubsub_message:type_name -> encore.engine.trace2.PubsubMessageSpanEnd
+	18,  // 19: encore.engine.trace2.SpanEnd.test:type_name -> encore.engine.trace2.TestSpanEnd
+	70,  // 20: encore.engine.trace2.RequestSpanStart.request_headers:type_name -> encore.engine.trace2.RequestSpanStart.RequestHeadersEntry
+	71,  // 21: encore.engine.trace2.RequestSpanEnd.response_headers:type_name -> encore.engine.trace2.RequestSpanEnd.ResponseHeadersEntry
+	72,  // 22: encore.engine.trace2.PubsubMessageSpanStart.publish_time:type_name -> google.protobuf.Timestamp
+	65,  // 23: encore.engine.trace2.SpanEvent.log_message:type_name -> encore.engine.trace2.LogMessage
+	46,  // 24: encore.engine.trace2.SpanEvent.body_stream:type_name -> encore.engine.trace2.BodyStream
+	20,  // 25: encore.engine.trace2.SpanEvent.rpc_call_start:type_name -> encore.engine.trace2.RPCCallStart
+	21,  // 26: encore.engine.trace2.SpanEvent.rpc_call_end:type_name -> encore.engine.trace2.RPCCallEnd
+	24,  // 27: encore.engine.trace2.SpanEvent.db_transaction_start:type_name -> encore.engine.trace2.DBTransactionStart
+	25,  // 28: encore.engine.trace2.SpanEvent.db_transaction_end:type_name -> encore.engine.trace2.DBTransactionEnd
+	26,  // 29: encore.engine.trace2.SpanEvent.db_query_start:type_name -> encore.engine.trace2.DBQueryStart
+	27,  // 30: encore.engine.trace2.SpanEvent.db_query_end:type_name -> encore.engine.trace2.DBQueryEnd
+	47,  // 31: encore.engine.trace2.SpanEvent.http_call_start:type_name -> encore.engine.trace2.HTTPCallStart
+	48,  // 32: encore.engine.trace2.SpanEvent.http_call_end:type_name -> encore.engine.trace2.HTTPCallEnd
+	28,  // 33: encore.engine.trace2.SpanEvent.pubsub_publish_start:type_name -> encore.engine.trace2.PubsubPublishStart
+	29,  // 34: encore.engine.trace2.SpanEvent.pubsub_publish_end:type_name -> encore.engine.trace2.PubsubPublishEnd
+	32,  // 35: encore.engine.trace2.SpanEvent.cache_call_start:type_name -> encore.engine.trace2.CacheCallStart
+	33,  // 36: encore.engine.trace2.SpanEvent.cache_call_end:type_name -> encore.engine.trace2.CacheCallEnd
+	30,  // 37: encore.engine.trace2.SpanEvent.service_init_start:type_name -> encore.engine.trace2.ServiceInitStart
+	31,  // 38: encore.engine.trace2.SpanEvent.service_init_end:type_name -> encore.engine.trace2.ServiceInitEnd
+	34,  // 39: encore.engine.trace2.SpanEvent.bucket_object_upload_start:type_name -> encore.engine.trace2.BucketObjectUploadStart
+	35,  // 40: encore.engine.trace2.SpanEvent.bucket_object_upload_end:type_name -> encore.engine.trace2.BucketObjectUploadEnd
+	36,  // 41: encore.engine.trace2.SpanEvent.bucket_object_download_start:type_name -> encore.engine.trace2.BucketObjectDownloadStart
+	37,  // 42: encore.engine.trace2.SpanEvent.bucket_object_download_end:type_name -> encore.engine.trace2.BucketObjectDownloadEnd
+	38,  // 43: encore.engine.trace2.SpanEvent.bucket_object_get_attrs_start:type_name -> encore.engine.trace2.BucketObjectGetAttrsStart
+	39,  // 44: encore.engine.trace2.SpanEvent.bucket_object_get_attrs_end:type_name -> encore.engine.trace2.BucketObjectGetAttrsEnd
+	40,  // 45: encore.engine.trace2.SpanEvent.bucket_list_objects_start:type_name -> encore.engine.trace2.BucketListObjectsStart
+	41,  // 46: encore.engine.trace2.SpanEvent.bucket_list_objects_end:type_name -> encore.engine.trace2.BucketListObjectsEnd
+	42,  // 47: encore.engine.trace2.SpanEvent.bucket_delete_objects_start:type_name -> encore.engine.trace2.BucketDeleteObjectsStart
+	44,  // 48: encore.engine.trace2.SpanEvent.bucket_delete_objects_end:type_name -> encore.engine.trace2.BucketDeleteObjectsEnd
+	67,  // 49: encore.engine.trace2.RPCCallStart.stack:type_name -> encore.engine.trace2.StackTrace
+	69,  // 50: encore.engine.trace2.RPCCallEnd.err:type_name -> encore.engine.trace2.Error
+	67,  // 51: encore.engine.trace2.DBTransactionStart.stack:type_name -> encore.engine.trace2.StackTrace
+	2,   // 52: encore.engine.trace2.DBTransactionEnd.completion:type_name -> encore.engine.trace2.DBTransactionEnd.CompletionType
+	67,  // 53: encore.engine.trace2.DBTransactionEnd.stack:type_name -> encore.engine.trace2.StackTrace
+	69,  // 54: encore.engine.trace2.DBTransactionEnd.err:type_name -> encore.engine.trace2.Error
+	67,  // 55: encore.engine.trace2.DBQueryStart.stack:type_name -> encore.engine.trace2.StackTrace
+	69,  // 56: encore.engine.trace2.DBQueryEnd.err:type_name -> encore.engine.trace2.Error
+	67,  // 57: encore.engine.trace2.PubsubPublishStart.stack:type_name -> encore.engine.trace2.StackTrace
+	69,  // 58: encore.engine.trace2.PubsubPublishEnd.err:type_name -> encore.engine.trace2.Error
+	69,  // 59: encore.engine.trace2.ServiceInitEnd.err:type_name -> encore.engine.trace2.Error
+	67,  // 60: encore.engine.trace2.CacheCallStart.stack:type_name -> encore.engine.trace2.StackTrace
+	3,   // 61: encore.engine.trace2.CacheCallEnd.result:type_name -> encore.engine.trace2.CacheCallEnd.Result
+	69,  // 62: encore.engine.trace2.CacheCallEnd.err:type_name -> encore.engine.trace2.Error
+	45,  // 63: encore.engine.trace2.BucketObjectUploadStart.attrs:type_name -> encore.engine.trace2.BucketObjectAttributes
+	67,  // 64: encore.engine.trace2.BucketObjectUploadStart.stack:type_name -> encore.engine.trace2.StackTrace
+	69,  // 65: encore.engine.trace2.BucketObjectUploadEnd.err:type_name -> encore.engine.trace2.Error
+	67,  // 66: encore.engine.trace2.BucketObjectDownloadStart.stack:type_name -> encore.engine.trace2.StackTrace
+	69,  // 67: encore.engine.trace2.BucketObjectDownloadEnd.err:type_name -> encore.engine.trace2.Error
+	67,  // 68: encore.engine.trace2.BucketObjectGetAttrsStart.stack:type_name -> encore.engine.trace2.StackTrace
+	69,  // 69: encore.engine.trace2.BucketObjectGetAttrsEnd.err:type_name -> encore.engine.trace2.Error
+	45,  // 70: encore.engine.trace2.BucketObjectGetAttrsEnd.attrs:type_name -> encore.engine.trace2.BucketObjectAttributes
+	67,  // 71: encore.engine.trace2.BucketListObjectsStart.stack:type_name -> encore.engine.trace2.StackTrace
+	69,  // 72: encore.engine.trace2.BucketListObjectsEnd.err:type_name -> encore.engine.trace2.Error
+	67,  // 73: encore.engine.trace2.BucketDeleteObjectsStart.stack:type_name -> encore.engine.trace2.StackTrace
+	43,  // 74: encore.engine.trace2.BucketDeleteObjectsStart.entries:type_name -> encore.engine.trace2.BucketDeleteObjectEntry
+	69,  // 75: encore.engine.trace2.BucketDeleteObjectsEnd.err:type_name -> encore.engine.trace2.Error
+	67,  // 76: encore.engine.trace2.HTTPCallStart.stack:type_name -> encore.engine.trace2.StackTrace
+	69,  // 77: encore.engine.trace2.HTTPCallEnd.err:type_name -> encore.engine.trace2.Error
+	49,  // 78: encore.engine.trace2.HTTPCallEnd.trace_events:type_name -> encore.engine.trace2.HTTPTraceEvent
+	50,  // 79: encore.engine.trace2.HTTPTraceEvent.get_conn:type_name -> encore.engine.trace2.HTTPGetConn
+	51,  // 80: encore.engine.trace2.HTTPTraceEvent.got_conn:type_name -> encore.engine.trace2.HTTPGotConn
+	52,  // 81: encore.engine.trace2.HTTPTraceEvent.got_first_response_byte:type_name -> encore.engine.trace2.HTTPGotFirstResponseByte
+	53,  // 82: encore.engine.trace2.HTTPTraceEvent.got_1xx_response:type_name -> encore.engine.trace2.HTTPGot1xxResponse
+	54,  // 83: encore.engine.trace2.HTTPTraceEvent.dns_start:type_name -> encore.engine.trace2.HTTPDNSStart
+	55,  // 84: encore.engine.trace2.HTTPTraceEvent.dns_done:type_name -> encore.engine.trace2.HTTPDNSDone
+	57,  // 85: encore.engine.trace2.HTTPTraceEvent.connect_start:type_name -> encore.engine.trace2.HTTPConnectStart
+	58,  // 86: encore.engine.trace2.HTTPTraceEvent.connect_done:type_name -> encore.engine.trace2.HTTPConnectDone
+	59,  // 87: encore.engine.trace2.HTTPTraceEvent.tls_handshake_start:type_name -> encore.engine.trace2.HTTPTLSHandshakeStart
+	60,  // 88: encore.engine.trace2.HTTPTraceEvent.tls_handshake_done:type_name -> encore.engine.trace2.HTTPTLSHandshakeDone
+	61,  // 89: encore.engine.trace2.HTTPTraceEvent.wrote_headers:type_name -> encore.engine.trace2.HTTPWroteHeaders
+	62,  // 90: encore.engine.trace2.HTTPTraceEvent.wrote_request:type_name -> encore.engine.trace2.HTTPWroteRequest
+	63,  // 91: encore.engine.trace2.HTTPTraceEvent.wait_100_continue:type_name -> encore.engine.trace2.HTTPWait100Continue
+	64,  // 92: encore.engine.trace2.HTTPTraceEvent.closed_body:type_name -> encore.engine.trace2.HTTPClosedBodyData
+	56,  // 93: encore.engine.trace2.HTTPDNSDone.addrs:type_name -> encore.engine.trace2.DNSAddr
+	4,   // 94: encore.engine.trace2.LogMessage.level:type_name -> encore.engine.trace2.LogMessage.Level
+	66,  // 95: encore.engine.trace2.LogMessage.fields:type_name -> encore.engine.trace2.LogField
+	67,  // 96: encore.engine.trace2.LogMessage.stack:type_name -> encore.engine.trace2.StackTrace
+	69,  // 97: encore.engine.trace2.LogField.error:type_name -> encore.engine.trace2.Error
+	72,  // 98: encore.engine.trace2.LogField.time:type_name -> google.protobuf.Timestamp
+	68,  // 99: encore.engine.trace2.StackTrace.frames:type_name -> encore.engine.trace2.StackFrame
+	67,  // 100: encore.engine.trace2.Error.stack:type_name -> encore.engine.trace2.StackTrace
+	101, // [101:101] is the sub-list for method output_type
+	101, // [101:101] is the sub-list for method input_type
+	101, // [101:101] is the sub-list for extension type_name
+	101, // [101:101] is the sub-list for extension extendee
+	0,   // [0:101] is the sub-list for field type_name
+}
+
+func init() { file_encore_engine_trace2_trace2_proto_init() }
+func file_encore_engine_trace2_trace2_proto_init() {
+	if File_encore_engine_trace2_trace2_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_encore_engine_trace2_trace2_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SpanSummary); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TraceID); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EventList); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TraceEvent); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SpanStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SpanEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RequestSpanStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RequestSpanEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthSpanStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthSpanEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubsubMessageSpanStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubsubMessageSpanEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TestSpanStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TestSpanEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SpanEvent); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RPCCallStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RPCCallEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GoroutineStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GoroutineEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DBTransactionStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DBTransactionEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DBQueryStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DBQueryEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubsubPublishStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubsubPublishEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceInitStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceInitEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CacheCallStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CacheCallEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketObjectUploadStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketObjectUploadEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketObjectDownloadStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketObjectDownloadEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketObjectGetAttrsStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketObjectGetAttrsEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketListObjectsStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketListObjectsEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketDeleteObjectsStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketDeleteObjectEntry); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[39].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketDeleteObjectsEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[40].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketObjectAttributes); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[41].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BodyStream); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[42].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPCallStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[43].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPCallEnd); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[44].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPTraceEvent); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[45].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPGetConn); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[46].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPGotConn); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[47].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPGotFirstResponseByte); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[48].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPGot1XxResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[49].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPDNSStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[50].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPDNSDone); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[51].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DNSAddr); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[52].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPConnectStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[53].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPConnectDone); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[54].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPTLSHandshakeStart); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[55].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPTLSHandshakeDone); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[56].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPWroteHeaders); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[57].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPWroteRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[58].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPWait100Continue); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[59].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HTTPClosedBodyData); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[60].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LogMessage); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[61].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LogField); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[62].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StackTrace); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[63].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StackFrame); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_engine_trace2_trace2_proto_msgTypes[64].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Error); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_encore_engine_trace2_trace2_proto_msgTypes[0].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[3].OneofWrappers = []interface{}{
+		(*TraceEvent_SpanStart)(nil),
+		(*TraceEvent_SpanEnd)(nil),
+		(*TraceEvent_SpanEvent)(nil),
+	}
+	file_encore_engine_trace2_trace2_proto_msgTypes[4].OneofWrappers = []interface{}{
+		(*SpanStart_Request)(nil),
+		(*SpanStart_Auth)(nil),
+		(*SpanStart_PubsubMessage)(nil),
+		(*SpanStart_Test)(nil),
+	}
+	file_encore_engine_trace2_trace2_proto_msgTypes[5].OneofWrappers = []interface{}{
+		(*SpanEnd_Request)(nil),
+		(*SpanEnd_Auth)(nil),
+		(*SpanEnd_PubsubMessage)(nil),
+		(*SpanEnd_Test)(nil),
+	}
+	file_encore_engine_trace2_trace2_proto_msgTypes[6].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[7].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[8].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[9].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[10].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[14].OneofWrappers = []interface{}{
+		(*SpanEvent_LogMessage)(nil),
+		(*SpanEvent_BodyStream)(nil),
+		(*SpanEvent_RpcCallStart)(nil),
+		(*SpanEvent_RpcCallEnd)(nil),
+		(*SpanEvent_DbTransactionStart)(nil),
+		(*SpanEvent_DbTransactionEnd)(nil),
+		(*SpanEvent_DbQueryStart)(nil),
+		(*SpanEvent_DbQueryEnd)(nil),
+		(*SpanEvent_HttpCallStart)(nil),
+		(*SpanEvent_HttpCallEnd)(nil),
+		(*SpanEvent_PubsubPublishStart)(nil),
+		(*SpanEvent_PubsubPublishEnd)(nil),
+		(*SpanEvent_CacheCallStart)(nil),
+		(*SpanEvent_CacheCallEnd)(nil),
+		(*SpanEvent_ServiceInitStart)(nil),
+		(*SpanEvent_ServiceInitEnd)(nil),
+		(*SpanEvent_BucketObjectUploadStart)(nil),
+		(*SpanEvent_BucketObjectUploadEnd)(nil),
+		(*SpanEvent_BucketObjectDownloadStart)(nil),
+		(*SpanEvent_BucketObjectDownloadEnd)(nil),
+		(*SpanEvent_BucketObjectGetAttrsStart)(nil),
+		(*SpanEvent_BucketObjectGetAttrsEnd)(nil),
+		(*SpanEvent_BucketListObjectsStart)(nil),
+		(*SpanEvent_BucketListObjectsEnd)(nil),
+		(*SpanEvent_BucketDeleteObjectsStart)(nil),
+		(*SpanEvent_BucketDeleteObjectsEnd)(nil),
+	}
+	file_encore_engine_trace2_trace2_proto_msgTypes[16].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[20].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[22].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[24].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[26].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[28].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[30].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[31].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[32].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[33].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[34].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[35].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[36].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[38].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[39].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[40].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[43].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[44].OneofWrappers = []interface{}{
+		(*HTTPTraceEvent_GetConn)(nil),
+		(*HTTPTraceEvent_GotConn)(nil),
+		(*HTTPTraceEvent_GotFirstResponseByte)(nil),
+		(*HTTPTraceEvent_Got_1XxResponse)(nil),
+		(*HTTPTraceEvent_DnsStart)(nil),
+		(*HTTPTraceEvent_DnsDone)(nil),
+		(*HTTPTraceEvent_ConnectStart)(nil),
+		(*HTTPTraceEvent_ConnectDone)(nil),
+		(*HTTPTraceEvent_TlsHandshakeStart)(nil),
+		(*HTTPTraceEvent_TlsHandshakeDone)(nil),
+		(*HTTPTraceEvent_WroteHeaders)(nil),
+		(*HTTPTraceEvent_WroteRequest)(nil),
+		(*HTTPTraceEvent_Wait_100Continue)(nil),
+		(*HTTPTraceEvent_ClosedBody)(nil),
+	}
+	file_encore_engine_trace2_trace2_proto_msgTypes[50].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[55].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[57].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[59].OneofWrappers = []interface{}{}
+	file_encore_engine_trace2_trace2_proto_msgTypes[61].OneofWrappers = []interface{}{
+		(*LogField_Error)(nil),
+		(*LogField_Str)(nil),
+		(*LogField_Bool)(nil),
+		(*LogField_Time)(nil),
+		(*LogField_Dur)(nil),
+		(*LogField_Uuid)(nil),
+		(*LogField_Json)(nil),
+		(*LogField_Int)(nil),
+		(*LogField_Uint)(nil),
+		(*LogField_Float32)(nil),
+		(*LogField_Float64)(nil),
+	}
+	file_encore_engine_trace2_trace2_proto_msgTypes[64].OneofWrappers = []interface{}{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_encore_engine_trace2_trace2_proto_rawDesc,
+			NumEnums:      5,
+			NumMessages:   67,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_encore_engine_trace2_trace2_proto_goTypes,
+		DependencyIndexes: file_encore_engine_trace2_trace2_proto_depIdxs,
+		EnumInfos:         file_encore_engine_trace2_trace2_proto_enumTypes,
+		MessageInfos:      file_encore_engine_trace2_trace2_proto_msgTypes,
+	}.Build()
+	File_encore_engine_trace2_trace2_proto = out.File
+	file_encore_engine_trace2_trace2_proto_rawDesc = nil
+	file_encore_engine_trace2_trace2_proto_goTypes = nil
+	file_encore_engine_trace2_trace2_proto_depIdxs = nil
+}
diff --git a/proto/encore/engine/trace2/trace2.proto b/proto/encore/engine/trace2/trace2.proto
new file mode 100644
index 0000000000..bc70592c6a
--- /dev/null
+++ b/proto/encore/engine/trace2/trace2.proto
@@ -0,0 +1,536 @@
+syntax = "proto3";
+
+option go_package = "encr.dev/proto/encore/engine/trace2";
+
+import "google/protobuf/timestamp.proto";
+
+package encore.engine.trace2;
+
+// SpanSummary summarizes a span for display purposes.
+message SpanSummary {
+  string trace_id                      = 1;
+  string span_id                       = 2;
+  SpanType type                        = 3;
+  bool   is_root                       = 4;  // whether it's a root request
+  bool   is_error                      = 5;  // whether the request failed
+  string deployed_commit               = 6;  // the commit hash of the running service
+  google.protobuf.Timestamp started_at = 7;
+  uint64 duration_nanos                = 8;
+  string service_name                  = 9;
+  optional string endpoint_name        = 10;
+  optional string topic_name           = 11;
+  optional string subscription_name    = 12;
+  optional string message_id           = 13;
+  optional bool   test_skipped         = 14; // whether the test was skipped
+  optional string src_file             = 15; // the source file where the span was started (if available)
+  optional uint32 src_line             = 16; // the source line where the span was started (if available)
+
+  enum SpanType {
+    UNKNOWN = 0;
+    REQUEST = 1;
+    AUTH = 2;
+    PUBSUB_MESSAGE = 3;
+    TEST = 4;
+  }
+}
+
+message TraceID {
+  uint64 high = 1;
+  uint64 low = 2;
+}
+
+message EventList {
+  repeated TraceEvent events = 1;
+}
+
+message TraceEvent {
+  TraceID trace_id = 1;
+  uint64 span_id = 2;
+  uint64 event_id = 3;
+  google.protobuf.Timestamp event_time = 4;
+
+  oneof event {
+    SpanStart span_start = 10;
+    SpanEnd span_end = 11;
+    SpanEvent span_event = 12;
+  }
+}
+
+message SpanStart {
+  uint32 goid = 1;
+  optional TraceID parent_trace_id = 2;
+  optional uint64 parent_span_id = 3;
+  optional uint64 caller_event_id  = 4;
+  optional string external_correlation_id = 5;
+  optional uint32 def_loc = 6;
+
+  oneof data {
+    RequestSpanStart request = 10;
+    AuthSpanStart auth = 11;
+    PubsubMessageSpanStart pubsub_message = 12;
+    TestSpanStart test = 13;
+  }
+}
+
+message SpanEnd {
+  uint64 duration_nanos = 1;
+  optional Error error = 2;
+  // panic_stack is the stack trace if the span ended due to a panic
+  optional StackTrace panic_stack = 3;
+  optional TraceID parent_trace_id = 4;
+  optional uint64 parent_span_id = 5;
+
+  oneof data {
+    RequestSpanEnd request = 10;
+    AuthSpanEnd auth = 11;
+    PubsubMessageSpanEnd pubsub_message = 12;
+    TestSpanEnd test = 13;
+  }
+}
+
+message RequestSpanStart {
+  string service_name = 1;
+  string endpoint_name = 2;
+  string http_method = 3;
+  string path = 4;
+  repeated string path_params = 5;
+  map<string, string> request_headers = 6;
+  optional bytes request_payload = 7;
+  optional string ext_correlation_id = 8;
+  optional string uid = 9;
+  // mocked is true if the request was handled by a mock
+  bool mocked = 10;
+}
+
+message RequestSpanEnd {
+  // Repeat service/endpoint name here to make it possible
+  // to consume end events without having to look up the start.
+  string service_name = 1;
+  string endpoint_name = 2;
+
+  uint32 http_status_code = 3;
+  map<string, string> response_headers = 4;
+  optional bytes response_payload = 5;
+}
+
+message AuthSpanStart {
+  string service_name = 1;
+  string endpoint_name = 2;
+  optional bytes auth_payload = 3;
+}
+
+message AuthSpanEnd {
+  // Repeat service/endpoint name here to make it possible
+  // to consume end events without having to look up the start.
+  string service_name = 1;
+  string endpoint_name = 2;
+
+  string uid = 3;
+  optional bytes user_data = 4;
+}
+
+message PubsubMessageSpanStart {
+  string service_name = 1;
+  string topic_name = 2;
+  string subscription_name = 3;
+  string message_id = 4;
+  uint32 attempt = 5;
+  google.protobuf.Timestamp publish_time = 6;
+  optional bytes message_payload = 7;
+}
+
+message PubsubMessageSpanEnd {
+  // Repeat service/topic/subscription name here to make it possible
+  // to consume end events without having to look up the start.
+  string service_name = 1;
+  string topic_name = 2;
+  string subscription_name = 3;
+}
+
+message TestSpanStart {
+  string service_name = 1;
+  string test_name = 2;
+  string uid = 3;
+  string test_file = 4;
+  uint32 test_line = 5;
+}
+
+message TestSpanEnd {
+  string service_name = 1;
+  string test_name = 2;
+  bool   failed = 3;
+  bool   skipped = 4;
+}
+
+message SpanEvent {
+  uint32 goid = 1;
+  optional uint32 def_loc = 2;
+
+  // correlation_event_id is the other event
+  // this event is correlated with.
+  optional uint64 correlation_event_id = 3;
+
+  oneof data {
+    LogMessage log_message = 10;
+    BodyStream body_stream = 11;
+    RPCCallStart rpc_call_start = 12;
+    RPCCallEnd rpc_call_end = 13;
+    DBTransactionStart db_transaction_start = 14;
+    DBTransactionEnd db_transaction_end = 15;
+    DBQueryStart db_query_start = 16;
+    DBQueryEnd db_query_end = 17;
+    HTTPCallStart http_call_start = 18;
+    HTTPCallEnd http_call_end = 19;
+    PubsubPublishStart pubsub_publish_start = 20;
+    PubsubPublishEnd pubsub_publish_end = 21;
+    CacheCallStart cache_call_start = 22;
+    CacheCallEnd cache_call_end = 23;
+    ServiceInitStart service_init_start = 24;
+    ServiceInitEnd service_init_end = 25;
+
+    BucketObjectUploadStart bucket_object_upload_start = 26;
+    BucketObjectUploadEnd bucket_object_upload_end = 27;
+    BucketObjectDownloadStart bucket_object_download_start = 28;
+    BucketObjectDownloadEnd bucket_object_download_end = 29;
+    BucketObjectGetAttrsStart bucket_object_get_attrs_start = 30;
+    BucketObjectGetAttrsEnd bucket_object_get_attrs_end = 31;
+    BucketListObjectsStart bucket_list_objects_start = 32;
+    BucketListObjectsEnd bucket_list_objects_end = 33;
+    BucketDeleteObjectsStart bucket_delete_objects_start = 34;
+    BucketDeleteObjectsEnd bucket_delete_objects_end = 35;
+  }
+}
+
+message RPCCallStart {
+  string target_service_name = 1;
+  string target_endpoint_name = 2;
+  StackTrace stack = 3;
+}
+
+message RPCCallEnd {
+  optional Error err = 1;
+}
+
+message GoroutineStart {}
+message GoroutineEnd {}
+
+message DBTransactionStart {
+  StackTrace stack = 1;
+}
+
+message DBTransactionEnd {
+  enum CompletionType {
+    ROLLBACK = 0;
+    COMMIT = 1;
+  }
+
+  CompletionType completion = 1;
+  StackTrace stack = 2;
+  optional Error err = 3;
+}
+
+message DBQueryStart {
+  string query = 1;
+  StackTrace stack = 2;
+}
+
+message DBQueryEnd {
+  optional Error err = 1;
+}
+
+message PubsubPublishStart {
+  string topic = 1;
+  bytes message = 2;
+  StackTrace stack = 3;
+}
+
+message PubsubPublishEnd {
+  optional string message_id = 1;
+  optional Error err = 2;
+}
+
+message ServiceInitStart {
+  string service = 1;
+}
+
+message ServiceInitEnd {
+  optional Error err = 1;
+}
+
+message CacheCallStart {
+  string operation = 1;
+  repeated string keys = 2;
+  bool write = 3;
+  StackTrace stack = 4;
+  // TODO include more info (like inputs)
+}
+
+message CacheCallEnd {
+  Result result = 1;
+  optional Error err = 2;
+  // TODO include more info (like outputs)
+
+  enum Result {
+    UNKNOWN = 0;
+    OK = 1;
+    NO_SUCH_KEY = 2;
+    CONFLICT = 3;
+    ERR = 4;
+  }
+}
+
+message BucketObjectUploadStart {
+  string bucket = 1;
+  string object = 2;
+  BucketObjectAttributes attrs = 3;
+  StackTrace stack = 4;
+}
+
+message BucketObjectUploadEnd {
+  optional Error err = 1;
+  optional uint64 size = 2;
+  optional string version = 3;
+}
+
+message BucketObjectDownloadStart {
+  string bucket = 1;
+  string object = 2;
+  optional string version = 3;
+  StackTrace stack = 4;
+}
+
+message BucketObjectDownloadEnd {
+  optional Error err = 1;
+  optional uint64 size = 2;
+}
+
+message BucketObjectGetAttrsStart {
+  string bucket = 1;
+  string object = 2;
+  optional string version = 3;
+  StackTrace stack = 4;
+}
+
+message BucketObjectGetAttrsEnd {
+  optional Error err = 1;
+  optional BucketObjectAttributes attrs = 2;
+}
+
+message BucketListObjectsStart {
+  string bucket = 1;
+  optional string prefix = 2;
+  StackTrace stack = 3;
+}
+
+message BucketListObjectsEnd {
+  optional Error err = 1;
+  uint64 observed = 2;
+  bool has_more = 3;
+}
+
+message BucketDeleteObjectsStart {
+  string bucket = 1;
+  StackTrace stack = 2;
+  repeated BucketDeleteObjectEntry entries = 3;
+}
+
+message BucketDeleteObjectEntry {
+  string object = 1;
+  optional string version = 2;
+}
+
+message BucketDeleteObjectsEnd {
+  optional Error err = 1;
+}
+
+message BucketObjectAttributes {
+  optional uint64 size = 1;
+  optional string version = 2;
+  optional string etag = 3;
+  optional string content_type = 4;
+}
+
+message BodyStream {
+  bool is_response = 1;
+  bool overflowed = 2;
+  bytes data = 3;
+}
+
+message HTTPCallStart {
+  uint64 correlation_parent_span_id = 1;
+  string method = 2;
+  string url = 3;
+  StackTrace stack = 4;
+
+  // start_nanotime is used to compute timings based on the
+  // nanotime in the HTTP trace events.
+  int64 start_nanotime = 5;
+}
+
+message HTTPCallEnd {
+  // status_code is set if we got a HTTP response.
+  optional uint32 status_code = 1;
+  // err is set otherwise.
+  optional Error err = 2;
+
+  // TODO these should be moved to be asynchronous via a separate event.
+  repeated HTTPTraceEvent trace_events = 3;
+}
+
+enum HTTPTraceEventCode {
+  UNKNOWN = 0;
+  GET_CONN = 1;
+  GOT_CONN = 2;
+  GOT_FIRST_RESPONSE_BYTE = 3;
+  GOT_1XX_RESPONSE = 4;
+  DNS_START = 5;
+  DNS_DONE = 6;
+  CONNECT_START = 7;
+  CONNECT_DONE = 8;
+  TLS_HANDSHAKE_START = 9;
+  TLS_HANDSHAKE_DONE = 10;
+  WROTE_HEADERS = 11;
+  WROTE_REQUEST = 12;
+  WAIT_100_CONTINUE = 13;
+  CLOSED_BODY = 14;
+}
+
+
+message HTTPTraceEvent {
+  int64 nanotime = 1;
+  oneof data {
+    HTTPGetConn get_conn = 2;
+    HTTPGotConn got_conn = 3;
+    HTTPGotFirstResponseByte got_first_response_byte = 4;
+    HTTPGot1xxResponse got_1xx_response = 5;
+    HTTPDNSStart dns_start = 6;
+    HTTPDNSDone dns_done = 7;
+    HTTPConnectStart connect_start = 8;
+    HTTPConnectDone connect_done = 9;
+    HTTPTLSHandshakeStart tls_handshake_start = 10;
+    HTTPTLSHandshakeDone tls_handshake_done = 11;
+    HTTPWroteHeaders wrote_headers = 12;
+    HTTPWroteRequest wrote_request = 13;
+    HTTPWait100Continue wait_100_continue = 14;
+    HTTPClosedBodyData closed_body = 15;
+  }
+}
+
+message HTTPGetConn{
+  string host_port = 1;
+}
+
+message HTTPGotConn {
+  bool reused = 1;
+  bool was_idle = 2;
+  int64 idle_duration_ns = 3;
+}
+
+message HTTPGotFirstResponseByte {
+}
+
+message HTTPGot1xxResponse {
+  int32 code = 1;
+}
+
+message HTTPDNSStart {
+  string host = 1;
+}
+
+message HTTPDNSDone {
+  optional bytes err = 1;
+  repeated DNSAddr addrs = 2;
+}
+
+message DNSAddr {
+  bytes ip = 1;
+}
+
+message HTTPConnectStart {
+  string network = 1;
+  string addr = 2;
+}
+
+message HTTPConnectDone {
+  string network = 1;
+  string addr = 2;
+  bytes err = 3;
+}
+
+message HTTPTLSHandshakeStart {
+}
+
+message HTTPTLSHandshakeDone {
+  optional bytes err = 1;
+  uint32 tls_version = 2;
+  uint32 cipher_suite = 3;
+  string server_name = 4;
+  string negotiated_protocol = 5;
+}
+
+message HTTPWroteHeaders {
+}
+
+message HTTPWroteRequest {
+  optional bytes err = 1;
+}
+
+message HTTPWait100Continue {
+}
+
+message HTTPClosedBodyData {
+  optional bytes err = 1;
+}
+
+message LogMessage {
+  // Note: These values don't match the values used by the binary trace protocol,
+  // as these values are stored in persisted traces and therefore must maintain
+  // backwards compatibility. The binary trace protocol is versioned and doesn't
+  // have the same limitations.
+  enum Level {
+    DEBUG = 0;
+    INFO = 1;
+    ERROR = 2;
+    WARN = 3;
+    TRACE = 4;
+  }
+
+  Level level = 1;
+  string msg = 2;
+  repeated LogField fields = 3;
+  StackTrace stack = 4;
+}
+
+message LogField {
+  string key = 1;
+
+  oneof value {
+    Error error = 2;
+    string str = 3;
+    bool bool = 4;
+    google.protobuf.Timestamp time = 5;
+    int64 dur = 6;
+    bytes uuid = 7;
+    bytes json = 8;
+    int64 int = 9;
+    uint64 uint = 10;
+    float float32 = 11;
+    double float64 = 12;
+  }
+}
+
+message StackTrace {
+  repeated int64 pcs = 1;
+  repeated StackFrame frames = 2;
+}
+
+message StackFrame {
+  string filename = 1;
+  string func = 2;
+  int32 line = 3;
+}
+
+message Error {
+  string msg = 1;
+  optional StackTrace stack = 2;
+}
diff --git a/proto/encore/engine/trace2/trace_util.go b/proto/encore/engine/trace2/trace_util.go
new file mode 100644
index 0000000000..a344673fcc
--- /dev/null
+++ b/proto/encore/engine/trace2/trace_util.go
@@ -0,0 +1,5 @@
+package trace2
+
+func (id *TraceID) IsZero() bool {
+	return id == nil || (id.Low == 0 && id.High == 0)
+}
diff --git a/proto/encore/parser/meta/v1/meta.pb.go b/proto/encore/parser/meta/v1/meta.pb.go
index b57b1ad4f1..81079b0b63 100644
--- a/proto/encore/parser/meta/v1/meta.pb.go
+++ b/proto/encore/parser/meta/v1/meta.pb.go
@@ -1,14 +1,13 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.14.0
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.23.4
 // source: encore/parser/meta/v1/meta.proto
 
 package v1
 
 import (
 	v1 "encr.dev/proto/encore/parser/schema/v1"
-	proto "github.com/golang/protobuf/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -22,9 +21,182 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
+// Lang describes the language an application is written in.
+// Defaults to Go if not set.
+type Lang int32
+
+const (
+	Lang_GO         Lang = 0
+	Lang_TYPESCRIPT Lang = 1
+)
+
+// Enum value maps for Lang.
+var (
+	Lang_name = map[int32]string{
+		0: "GO",
+		1: "TYPESCRIPT",
+	}
+	Lang_value = map[string]int32{
+		"GO":         0,
+		"TYPESCRIPT": 1,
+	}
+)
+
+func (x Lang) Enum() *Lang {
+	p := new(Lang)
+	*p = x
+	return p
+}
+
+func (x Lang) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Lang) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_parser_meta_v1_meta_proto_enumTypes[0].Descriptor()
+}
+
+func (Lang) Type() protoreflect.EnumType {
+	return &file_encore_parser_meta_v1_meta_proto_enumTypes[0]
+}
+
+func (x Lang) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Lang.Descriptor instead.
+func (Lang) EnumDescriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{0}
+}
+
+type BucketUsage_Operation int32
+
+const (
+	BucketUsage_UNKNOWN BucketUsage_Operation = 0
+	// Listing objects and accessing their metadata during listing.
+	BucketUsage_LIST_OBJECTS BucketUsage_Operation = 1
+	// Reading the contents of an object.
+	BucketUsage_READ_OBJECT_CONTENTS BucketUsage_Operation = 2
+	// Creating or updating an object, with contents and metadata.
+	BucketUsage_WRITE_OBJECT BucketUsage_Operation = 3
+	// Updating the metadata of an object, without reading or writing its contents.
+	BucketUsage_UPDATE_OBJECT_METADATA BucketUsage_Operation = 4
+	// Reading the metadata of an object, or checking for its existence.
+	BucketUsage_GET_OBJECT_METADATA BucketUsage_Operation = 5
+	// Deleting an object.
+	BucketUsage_DELETE_OBJECT BucketUsage_Operation = 6
+	// Get an bucket/object's public url.
+	BucketUsage_GET_PUBLIC_URL BucketUsage_Operation = 7
+	// Generating a signed URL to allow an external recipient to create or
+	// update an object.
+	BucketUsage_SIGNED_UPLOAD_URL BucketUsage_Operation = 8
+	// Generating a signed URL to allow an external recipient to download an object.
+	BucketUsage_SIGNED_DOWNLOAD_URL BucketUsage_Operation = 9
+)
+
+// Enum value maps for BucketUsage_Operation.
+var (
+	BucketUsage_Operation_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "LIST_OBJECTS",
+		2: "READ_OBJECT_CONTENTS",
+		3: "WRITE_OBJECT",
+		4: "UPDATE_OBJECT_METADATA",
+		5: "GET_OBJECT_METADATA",
+		6: "DELETE_OBJECT",
+		7: "GET_PUBLIC_URL",
+		8: "SIGNED_UPLOAD_URL",
+		9: "SIGNED_DOWNLOAD_URL",
+	}
+	BucketUsage_Operation_value = map[string]int32{
+		"UNKNOWN":                0,
+		"LIST_OBJECTS":           1,
+		"READ_OBJECT_CONTENTS":   2,
+		"WRITE_OBJECT":           3,
+		"UPDATE_OBJECT_METADATA": 4,
+		"GET_OBJECT_METADATA":    5,
+		"DELETE_OBJECT":          6,
+		"GET_PUBLIC_URL":         7,
+		"SIGNED_UPLOAD_URL":      8,
+		"SIGNED_DOWNLOAD_URL":    9,
+	}
+)
+
+func (x BucketUsage_Operation) Enum() *BucketUsage_Operation {
+	p := new(BucketUsage_Operation)
+	*p = x
+	return p
+}
+
+func (x BucketUsage_Operation) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (BucketUsage_Operation) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_parser_meta_v1_meta_proto_enumTypes[1].Descriptor()
+}
+
+func (BucketUsage_Operation) Type() protoreflect.EnumType {
+	return &file_encore_parser_meta_v1_meta_proto_enumTypes[1]
+}
+
+func (x BucketUsage_Operation) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use BucketUsage_Operation.Descriptor instead.
+func (BucketUsage_Operation) EnumDescriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{4, 0}
+}
+
+type Selector_Type int32
+
+const (
+	Selector_UNKNOWN Selector_Type = 0
+	Selector_ALL     Selector_Type = 1
+	Selector_TAG     Selector_Type = 2 // NOTE: If more types are added, update the (selector.Selector).ToProto method.
+)
+
+// Enum value maps for Selector_Type.
+var (
+	Selector_Type_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "ALL",
+		2: "TAG",
+	}
+	Selector_Type_value = map[string]int32{
+		"UNKNOWN": 0,
+		"ALL":     1,
+		"TAG":     2,
+	}
+)
+
+func (x Selector_Type) Enum() *Selector_Type {
+	p := new(Selector_Type)
+	*p = x
+	return p
+}
+
+func (x Selector_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Selector_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_parser_meta_v1_meta_proto_enumTypes[2].Descriptor()
+}
+
+func (Selector_Type) Type() protoreflect.EnumType {
+	return &file_encore_parser_meta_v1_meta_proto_enumTypes[2]
+}
+
+func (x Selector_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Selector_Type.Descriptor instead.
+func (Selector_Type) EnumDescriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{5, 0}
+}
 
 type RPC_AccessType int32
 
@@ -59,11 +231,11 @@ func (x RPC_AccessType) String() string {
 }
 
 func (RPC_AccessType) Descriptor() protoreflect.EnumDescriptor {
-	return file_encore_parser_meta_v1_meta_proto_enumTypes[0].Descriptor()
+	return file_encore_parser_meta_v1_meta_proto_enumTypes[3].Descriptor()
 }
 
 func (RPC_AccessType) Type() protoreflect.EnumType {
-	return &file_encore_parser_meta_v1_meta_proto_enumTypes[0]
+	return &file_encore_parser_meta_v1_meta_proto_enumTypes[3]
 }
 
 func (x RPC_AccessType) Number() protoreflect.EnumNumber {
@@ -72,7 +244,7 @@ func (x RPC_AccessType) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use RPC_AccessType.Descriptor instead.
 func (RPC_AccessType) EnumDescriptor() ([]byte, []int) {
-	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{5, 0}
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{6, 0}
 }
 
 type RPC_Protocol int32
@@ -105,11 +277,11 @@ func (x RPC_Protocol) String() string {
 }
 
 func (RPC_Protocol) Descriptor() protoreflect.EnumDescriptor {
-	return file_encore_parser_meta_v1_meta_proto_enumTypes[1].Descriptor()
+	return file_encore_parser_meta_v1_meta_proto_enumTypes[4].Descriptor()
 }
 
 func (RPC_Protocol) Type() protoreflect.EnumType {
-	return &file_encore_parser_meta_v1_meta_proto_enumTypes[1]
+	return &file_encore_parser_meta_v1_meta_proto_enumTypes[4]
 }
 
 func (x RPC_Protocol) Number() protoreflect.EnumNumber {
@@ -118,7 +290,7 @@ func (x RPC_Protocol) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use RPC_Protocol.Descriptor instead.
 func (RPC_Protocol) EnumDescriptor() ([]byte, []int) {
-	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{5, 1}
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{6, 1}
 }
 
 type StaticCallNode_Package int32
@@ -154,11 +326,11 @@ func (x StaticCallNode_Package) String() string {
 }
 
 func (StaticCallNode_Package) Descriptor() protoreflect.EnumDescriptor {
-	return file_encore_parser_meta_v1_meta_proto_enumTypes[2].Descriptor()
+	return file_encore_parser_meta_v1_meta_proto_enumTypes[5].Descriptor()
 }
 
 func (StaticCallNode_Package) Type() protoreflect.EnumType {
-	return &file_encore_parser_meta_v1_meta_proto_enumTypes[2]
+	return &file_encore_parser_meta_v1_meta_proto_enumTypes[5]
 }
 
 func (x StaticCallNode_Package) Number() protoreflect.EnumNumber {
@@ -167,7 +339,279 @@ func (x StaticCallNode_Package) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use StaticCallNode_Package.Descriptor instead.
 func (StaticCallNode_Package) EnumDescriptor() ([]byte, []int) {
-	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{10, 0}
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{12, 0}
+}
+
+type Path_Type int32
+
+const (
+	Path_URL            Path_Type = 0
+	Path_CACHE_KEYSPACE Path_Type = 1
+)
+
+// Enum value maps for Path_Type.
+var (
+	Path_Type_name = map[int32]string{
+		0: "URL",
+		1: "CACHE_KEYSPACE",
+	}
+	Path_Type_value = map[string]int32{
+		"URL":            0,
+		"CACHE_KEYSPACE": 1,
+	}
+)
+
+func (x Path_Type) Enum() *Path_Type {
+	p := new(Path_Type)
+	*p = x
+	return p
+}
+
+func (x Path_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Path_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_parser_meta_v1_meta_proto_enumTypes[6].Descriptor()
+}
+
+func (Path_Type) Type() protoreflect.EnumType {
+	return &file_encore_parser_meta_v1_meta_proto_enumTypes[6]
+}
+
+func (x Path_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Path_Type.Descriptor instead.
+func (Path_Type) EnumDescriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{20, 0}
+}
+
+type PathSegment_SegmentType int32
+
+const (
+	PathSegment_LITERAL  PathSegment_SegmentType = 0
+	PathSegment_PARAM    PathSegment_SegmentType = 1
+	PathSegment_WILDCARD PathSegment_SegmentType = 2
+	PathSegment_FALLBACK PathSegment_SegmentType = 3
+)
+
+// Enum value maps for PathSegment_SegmentType.
+var (
+	PathSegment_SegmentType_name = map[int32]string{
+		0: "LITERAL",
+		1: "PARAM",
+		2: "WILDCARD",
+		3: "FALLBACK",
+	}
+	PathSegment_SegmentType_value = map[string]int32{
+		"LITERAL":  0,
+		"PARAM":    1,
+		"WILDCARD": 2,
+		"FALLBACK": 3,
+	}
+)
+
+func (x PathSegment_SegmentType) Enum() *PathSegment_SegmentType {
+	p := new(PathSegment_SegmentType)
+	*p = x
+	return p
+}
+
+func (x PathSegment_SegmentType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PathSegment_SegmentType) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_parser_meta_v1_meta_proto_enumTypes[7].Descriptor()
+}
+
+func (PathSegment_SegmentType) Type() protoreflect.EnumType {
+	return &file_encore_parser_meta_v1_meta_proto_enumTypes[7]
+}
+
+func (x PathSegment_SegmentType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PathSegment_SegmentType.Descriptor instead.
+func (PathSegment_SegmentType) EnumDescriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{21, 0}
+}
+
+type PathSegment_ParamType int32
+
+const (
+	PathSegment_STRING PathSegment_ParamType = 0
+	PathSegment_BOOL   PathSegment_ParamType = 1
+	PathSegment_INT8   PathSegment_ParamType = 2
+	PathSegment_INT16  PathSegment_ParamType = 3
+	PathSegment_INT32  PathSegment_ParamType = 4
+	PathSegment_INT64  PathSegment_ParamType = 5
+	PathSegment_INT    PathSegment_ParamType = 6
+	PathSegment_UINT8  PathSegment_ParamType = 7
+	PathSegment_UINT16 PathSegment_ParamType = 8
+	PathSegment_UINT32 PathSegment_ParamType = 9
+	PathSegment_UINT64 PathSegment_ParamType = 10
+	PathSegment_UINT   PathSegment_ParamType = 11
+	PathSegment_UUID   PathSegment_ParamType = 12
+)
+
+// Enum value maps for PathSegment_ParamType.
+var (
+	PathSegment_ParamType_name = map[int32]string{
+		0:  "STRING",
+		1:  "BOOL",
+		2:  "INT8",
+		3:  "INT16",
+		4:  "INT32",
+		5:  "INT64",
+		6:  "INT",
+		7:  "UINT8",
+		8:  "UINT16",
+		9:  "UINT32",
+		10: "UINT64",
+		11: "UINT",
+		12: "UUID",
+	}
+	PathSegment_ParamType_value = map[string]int32{
+		"STRING": 0,
+		"BOOL":   1,
+		"INT8":   2,
+		"INT16":  3,
+		"INT32":  4,
+		"INT64":  5,
+		"INT":    6,
+		"UINT8":  7,
+		"UINT16": 8,
+		"UINT32": 9,
+		"UINT64": 10,
+		"UINT":   11,
+		"UUID":   12,
+	}
+)
+
+func (x PathSegment_ParamType) Enum() *PathSegment_ParamType {
+	p := new(PathSegment_ParamType)
+	*p = x
+	return p
+}
+
+func (x PathSegment_ParamType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PathSegment_ParamType) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_parser_meta_v1_meta_proto_enumTypes[8].Descriptor()
+}
+
+func (PathSegment_ParamType) Type() protoreflect.EnumType {
+	return &file_encore_parser_meta_v1_meta_proto_enumTypes[8]
+}
+
+func (x PathSegment_ParamType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PathSegment_ParamType.Descriptor instead.
+func (PathSegment_ParamType) EnumDescriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{21, 1}
+}
+
+type PubSubTopic_DeliveryGuarantee int32
+
+const (
+	PubSubTopic_AT_LEAST_ONCE PubSubTopic_DeliveryGuarantee = 0 // All messages will be delivered to each subscription at least once
+	PubSubTopic_EXACTLY_ONCE  PubSubTopic_DeliveryGuarantee = 1 // All messages will be delivered to each subscription exactly once
+)
+
+// Enum value maps for PubSubTopic_DeliveryGuarantee.
+var (
+	PubSubTopic_DeliveryGuarantee_name = map[int32]string{
+		0: "AT_LEAST_ONCE",
+		1: "EXACTLY_ONCE",
+	}
+	PubSubTopic_DeliveryGuarantee_value = map[string]int32{
+		"AT_LEAST_ONCE": 0,
+		"EXACTLY_ONCE":  1,
+	}
+)
+
+func (x PubSubTopic_DeliveryGuarantee) Enum() *PubSubTopic_DeliveryGuarantee {
+	p := new(PubSubTopic_DeliveryGuarantee)
+	*p = x
+	return p
+}
+
+func (x PubSubTopic_DeliveryGuarantee) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PubSubTopic_DeliveryGuarantee) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_parser_meta_v1_meta_proto_enumTypes[9].Descriptor()
+}
+
+func (PubSubTopic_DeliveryGuarantee) Type() protoreflect.EnumType {
+	return &file_encore_parser_meta_v1_meta_proto_enumTypes[9]
+}
+
+func (x PubSubTopic_DeliveryGuarantee) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PubSubTopic_DeliveryGuarantee.Descriptor instead.
+func (PubSubTopic_DeliveryGuarantee) EnumDescriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{27, 0}
+}
+
+type Metric_MetricKind int32
+
+const (
+	Metric_COUNTER   Metric_MetricKind = 0
+	Metric_GAUGE     Metric_MetricKind = 1
+	Metric_HISTOGRAM Metric_MetricKind = 2
+)
+
+// Enum value maps for Metric_MetricKind.
+var (
+	Metric_MetricKind_name = map[int32]string{
+		0: "COUNTER",
+		1: "GAUGE",
+		2: "HISTOGRAM",
+	}
+	Metric_MetricKind_value = map[string]int32{
+		"COUNTER":   0,
+		"GAUGE":     1,
+		"HISTOGRAM": 2,
+	}
+)
+
+func (x Metric_MetricKind) Enum() *Metric_MetricKind {
+	p := new(Metric_MetricKind)
+	*p = x
+	return p
+}
+
+func (x Metric_MetricKind) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Metric_MetricKind) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_parser_meta_v1_meta_proto_enumTypes[10].Descriptor()
+}
+
+func (Metric_MetricKind) Type() protoreflect.EnumType {
+	return &file_encore_parser_meta_v1_meta_proto_enumTypes[10]
+}
+
+func (x Metric_MetricKind) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Metric_MetricKind.Descriptor instead.
+func (Metric_MetricKind) EnumDescriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{29, 0}
 }
 
 // Data is the metadata associated with an app version.
@@ -176,12 +620,23 @@ type Data struct {
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	ModulePath  string       `protobuf:"bytes,1,opt,name=module_path,json=modulePath,proto3" json:"module_path,omitempty"` // app module path
-	AppVersion  string       `protobuf:"bytes,2,opt,name=app_version,json=appVersion,proto3" json:"app_version,omitempty"`
-	Decls       []*v1.Decl   `protobuf:"bytes,3,rep,name=decls,proto3" json:"decls,omitempty"`
-	Pkgs        []*Package   `protobuf:"bytes,4,rep,name=pkgs,proto3" json:"pkgs,omitempty"`
-	Svcs        []*Service   `protobuf:"bytes,5,rep,name=svcs,proto3" json:"svcs,omitempty"`
-	AuthHandler *AuthHandler `protobuf:"bytes,6,opt,name=auth_handler,json=authHandler,proto3" json:"auth_handler,omitempty"`
+	ModulePath         string          `protobuf:"bytes,1,opt,name=module_path,json=modulePath,proto3" json:"module_path,omitempty"`                          // app module path
+	AppRevision        string          `protobuf:"bytes,2,opt,name=app_revision,json=appRevision,proto3" json:"app_revision,omitempty"`                       // app revision (always the VCS revision reference)
+	UncommittedChanges bool            `protobuf:"varint,8,opt,name=uncommitted_changes,json=uncommittedChanges,proto3" json:"uncommitted_changes,omitempty"` // true if there where changes made on-top of the VCS revision
+	Decls              []*v1.Decl      `protobuf:"bytes,3,rep,name=decls,proto3" json:"decls,omitempty"`
+	Pkgs               []*Package      `protobuf:"bytes,4,rep,name=pkgs,proto3" json:"pkgs,omitempty"`
+	Svcs               []*Service      `protobuf:"bytes,5,rep,name=svcs,proto3" json:"svcs,omitempty"`
+	AuthHandler        *AuthHandler    `protobuf:"bytes,6,opt,name=auth_handler,json=authHandler,proto3,oneof" json:"auth_handler,omitempty"` // the auth handler or nil
+	CronJobs           []*CronJob      `protobuf:"bytes,7,rep,name=cron_jobs,json=cronJobs,proto3" json:"cron_jobs,omitempty"`
+	PubsubTopics       []*PubSubTopic  `protobuf:"bytes,9,rep,name=pubsub_topics,json=pubsubTopics,proto3" json:"pubsub_topics,omitempty"` // All the pub sub topics declared in the application
+	Middleware         []*Middleware   `protobuf:"bytes,10,rep,name=middleware,proto3" json:"middleware,omitempty"`
+	CacheClusters      []*CacheCluster `protobuf:"bytes,11,rep,name=cache_clusters,json=cacheClusters,proto3" json:"cache_clusters,omitempty"`
+	Experiments        []string        `protobuf:"bytes,12,rep,name=experiments,proto3" json:"experiments,omitempty"`
+	Metrics            []*Metric       `protobuf:"bytes,13,rep,name=metrics,proto3" json:"metrics,omitempty"`
+	SqlDatabases       []*SQLDatabase  `protobuf:"bytes,14,rep,name=sql_databases,json=sqlDatabases,proto3" json:"sql_databases,omitempty"`
+	Gateways           []*Gateway      `protobuf:"bytes,15,rep,name=gateways,proto3" json:"gateways,omitempty"`
+	Language           Lang            `protobuf:"varint,16,opt,name=language,proto3,enum=encore.parser.meta.v1.Lang" json:"language,omitempty"`
+	Buckets            []*Bucket       `protobuf:"bytes,17,rep,name=buckets,proto3" json:"buckets,omitempty"`
 }
 
 func (x *Data) Reset() {
@@ -223,13 +678,20 @@ func (x *Data) GetModulePath() string {
 	return ""
 }
 
-func (x *Data) GetAppVersion() string {
+func (x *Data) GetAppRevision() string {
 	if x != nil {
-		return x.AppVersion
+		return x.AppRevision
 	}
 	return ""
 }
 
+func (x *Data) GetUncommittedChanges() bool {
+	if x != nil {
+		return x.UncommittedChanges
+	}
+	return false
+}
+
 func (x *Data) GetDecls() []*v1.Decl {
 	if x != nil {
 		return x.Decls
@@ -258,34 +720,104 @@ func (x *Data) GetAuthHandler() *AuthHandler {
 	return nil
 }
 
-// QualifiedName is a name of an object in a specific package.
-// It is never an unqualified name, even in circumstances
-// where a package may refer to its own objects.
-type QualifiedName struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *Data) GetCronJobs() []*CronJob {
+	if x != nil {
+		return x.CronJobs
+	}
+	return nil
+}
 
-	Pkg  string `protobuf:"bytes,1,opt,name=pkg,proto3" json:"pkg,omitempty"`   // "rel/path/to/pkg"
-	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` // ObjectName
+func (x *Data) GetPubsubTopics() []*PubSubTopic {
+	if x != nil {
+		return x.PubsubTopics
+	}
+	return nil
 }
 
-func (x *QualifiedName) Reset() {
-	*x = QualifiedName{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+func (x *Data) GetMiddleware() []*Middleware {
+	if x != nil {
+		return x.Middleware
 	}
+	return nil
 }
 
-func (x *QualifiedName) String() string {
-	return protoimpl.X.MessageStringOf(x)
+func (x *Data) GetCacheClusters() []*CacheCluster {
+	if x != nil {
+		return x.CacheClusters
+	}
+	return nil
 }
 
-func (*QualifiedName) ProtoMessage() {}
+func (x *Data) GetExperiments() []string {
+	if x != nil {
+		return x.Experiments
+	}
+	return nil
+}
 
-func (x *QualifiedName) ProtoReflect() protoreflect.Message {
+func (x *Data) GetMetrics() []*Metric {
+	if x != nil {
+		return x.Metrics
+	}
+	return nil
+}
+
+func (x *Data) GetSqlDatabases() []*SQLDatabase {
+	if x != nil {
+		return x.SqlDatabases
+	}
+	return nil
+}
+
+func (x *Data) GetGateways() []*Gateway {
+	if x != nil {
+		return x.Gateways
+	}
+	return nil
+}
+
+func (x *Data) GetLanguage() Lang {
+	if x != nil {
+		return x.Language
+	}
+	return Lang_GO
+}
+
+func (x *Data) GetBuckets() []*Bucket {
+	if x != nil {
+		return x.Buckets
+	}
+	return nil
+}
+
+// QualifiedName is a name of an object in a specific package.
+// It is never an unqualified name, even in circumstances
+// where a package may refer to its own objects.
+type QualifiedName struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Pkg  string `protobuf:"bytes,1,opt,name=pkg,proto3" json:"pkg,omitempty"`   // "rel/path/to/pkg"
+	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` // ObjectName
+}
+
+func (x *QualifiedName) Reset() {
+	*x = QualifiedName{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *QualifiedName) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*QualifiedName) ProtoMessage() {}
+
+func (x *QualifiedName) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -420,6 +952,9 @@ type Service struct {
 	RelPath    string         `protobuf:"bytes,2,opt,name=rel_path,json=relPath,proto3" json:"rel_path,omitempty"` // import path relative to app root for the root package in the service
 	Rpcs       []*RPC         `protobuf:"bytes,3,rep,name=rpcs,proto3" json:"rpcs,omitempty"`
 	Migrations []*DBMigration `protobuf:"bytes,4,rep,name=migrations,proto3" json:"migrations,omitempty"`
+	Databases  []string       `protobuf:"bytes,5,rep,name=databases,proto3" json:"databases,omitempty"`                   // databases this service connects to
+	HasConfig  bool           `protobuf:"varint,6,opt,name=has_config,json=hasConfig,proto3" json:"has_config,omitempty"` // true if the service has uses config
+	Buckets    []*BucketUsage `protobuf:"bytes,7,rep,name=buckets,proto3" json:"buckets,omitempty"`                       // buckets this service uses
 }
 
 func (x *Service) Reset() {
@@ -482,18 +1017,40 @@ func (x *Service) GetMigrations() []*DBMigration {
 	return nil
 }
 
-type DBMigration struct {
+func (x *Service) GetDatabases() []string {
+	if x != nil {
+		return x.Databases
+	}
+	return nil
+}
+
+func (x *Service) GetHasConfig() bool {
+	if x != nil {
+		return x.HasConfig
+	}
+	return false
+}
+
+func (x *Service) GetBuckets() []*BucketUsage {
+	if x != nil {
+		return x.Buckets
+	}
+	return nil
+}
+
+type BucketUsage struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Filename    string `protobuf:"bytes,1,opt,name=filename,proto3" json:"filename,omitempty"`       // filename
-	Number      int32  `protobuf:"varint,2,opt,name=number,proto3" json:"number,omitempty"`          // migration number
-	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"` // descriptive name
+	// The encore name of the bucket.
+	Bucket string `protobuf:"bytes,1,opt,name=bucket,proto3" json:"bucket,omitempty"`
+	// Recorded operations.
+	Operations []BucketUsage_Operation `protobuf:"varint,2,rep,packed,name=operations,proto3,enum=encore.parser.meta.v1.BucketUsage_Operation" json:"operations,omitempty"`
 }
 
-func (x *DBMigration) Reset() {
-	*x = DBMigration{}
+func (x *BucketUsage) Reset() {
+	*x = BucketUsage{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -501,13 +1058,13 @@ func (x *DBMigration) Reset() {
 	}
 }
 
-func (x *DBMigration) String() string {
+func (x *BucketUsage) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*DBMigration) ProtoMessage() {}
+func (*BucketUsage) ProtoMessage() {}
 
-func (x *DBMigration) ProtoReflect() protoreflect.Message {
+func (x *BucketUsage) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -519,28 +1076,76 @@ func (x *DBMigration) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use DBMigration.ProtoReflect.Descriptor instead.
-func (*DBMigration) Descriptor() ([]byte, []int) {
+// Deprecated: Use BucketUsage.ProtoReflect.Descriptor instead.
+func (*BucketUsage) Descriptor() ([]byte, []int) {
 	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{4}
 }
 
-func (x *DBMigration) GetFilename() string {
+func (x *BucketUsage) GetBucket() string {
 	if x != nil {
-		return x.Filename
+		return x.Bucket
 	}
 	return ""
 }
 
-func (x *DBMigration) GetNumber() int32 {
+func (x *BucketUsage) GetOperations() []BucketUsage_Operation {
 	if x != nil {
-		return x.Number
+		return x.Operations
 	}
-	return 0
+	return nil
 }
 
-func (x *DBMigration) GetDescription() string {
+type Selector struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Type  Selector_Type `protobuf:"varint,1,opt,name=type,proto3,enum=encore.parser.meta.v1.Selector_Type" json:"type,omitempty"`
+	Value string        `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *Selector) Reset() {
+	*x = Selector{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Selector) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Selector) ProtoMessage() {}
+
+func (x *Selector) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Selector.ProtoReflect.Descriptor instead.
+func (*Selector) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *Selector) GetType() Selector_Type {
 	if x != nil {
-		return x.Description
+		return x.Type
+	}
+	return Selector_UNKNOWN
+}
+
+func (x *Selector) GetValue() string {
+	if x != nil {
+		return x.Value
 	}
 	return ""
 }
@@ -551,19 +1156,38 @@ type RPC struct {
 	unknownFields protoimpl.UnknownFields
 
 	Name           string         `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`                                                                          // name of the RPC endpoint
-	Doc            string         `protobuf:"bytes,2,opt,name=doc,proto3" json:"doc,omitempty"`                                                                            // associated documentation
+	Doc            *string        `protobuf:"bytes,2,opt,name=doc,proto3,oneof" json:"doc,omitempty"`                                                                      // associated documentation
 	ServiceName    string         `protobuf:"bytes,3,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`                                         // the service the RPC belongs to.
 	AccessType     RPC_AccessType `protobuf:"varint,4,opt,name=access_type,json=accessType,proto3,enum=encore.parser.meta.v1.RPC_AccessType" json:"access_type,omitempty"` // how can the RPC be accessed?
-	RequestSchema  *v1.Decl       `protobuf:"bytes,5,opt,name=request_schema,json=requestSchema,proto3" json:"request_schema,omitempty"`                                   // request schema, or nil
-	ResponseSchema *v1.Decl       `protobuf:"bytes,6,opt,name=response_schema,json=responseSchema,proto3" json:"response_schema,omitempty"`                                // request schema, or nil
+	RequestSchema  *v1.Type       `protobuf:"bytes,5,opt,name=request_schema,json=requestSchema,proto3,oneof" json:"request_schema,omitempty"`                             // request schema, or nil
+	ResponseSchema *v1.Type       `protobuf:"bytes,6,opt,name=response_schema,json=responseSchema,proto3,oneof" json:"response_schema,omitempty"`                          // response schema, or nil
 	Proto          RPC_Protocol   `protobuf:"varint,7,opt,name=proto,proto3,enum=encore.parser.meta.v1.RPC_Protocol" json:"proto,omitempty"`
 	Loc            *v1.Loc        `protobuf:"bytes,8,opt,name=loc,proto3" json:"loc,omitempty"`
+	Path           *Path          `protobuf:"bytes,9,opt,name=path,proto3" json:"path,omitempty"`
+	HttpMethods    []string       `protobuf:"bytes,10,rep,name=http_methods,json=httpMethods,proto3" json:"http_methods,omitempty"`
+	Tags           []*Selector    `protobuf:"bytes,11,rep,name=tags,proto3" json:"tags,omitempty"`
+	// sensitive reports whether the whole payload is sensitive.
+	// If true, none of the request/response payload will be traced.
+	Sensitive bool `protobuf:"varint,12,opt,name=sensitive,proto3" json:"sensitive,omitempty"`
+	// Whether the endpoint can be called without auth parameters.
+	AllowUnauthenticated bool `protobuf:"varint,13,opt,name=allow_unauthenticated,json=allowUnauthenticated,proto3" json:"allow_unauthenticated,omitempty"`
+	// Whether the endpoint is exposed to the public, keyed by gateway.
+	Expose map[string]*RPC_ExposeOptions `protobuf:"bytes,14,rep,name=expose,proto3" json:"expose,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// The maximum size of the request body in bytes.
+	// If not set, defaults to no limit.
+	BodyLimit *uint64 `protobuf:"varint,15,opt,name=body_limit,json=bodyLimit,proto3,oneof" json:"body_limit,omitempty"`
+	// If the endpoint is streaming
+	StreamingRequest  bool     `protobuf:"varint,16,opt,name=streaming_request,json=streamingRequest,proto3" json:"streaming_request,omitempty"`
+	StreamingResponse bool     `protobuf:"varint,17,opt,name=streaming_response,json=streamingResponse,proto3" json:"streaming_response,omitempty"`
+	HandshakeSchema   *v1.Type `protobuf:"bytes,18,opt,name=handshake_schema,json=handshakeSchema,proto3,oneof" json:"handshake_schema,omitempty"` // handshake schema, or nil
+	// If the endpoint serves static assets.
+	StaticAssets *RPC_StaticAssets `protobuf:"bytes,19,opt,name=static_assets,json=staticAssets,proto3,oneof" json:"static_assets,omitempty"`
 }
 
 func (x *RPC) Reset() {
 	*x = RPC{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[5]
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -576,7 +1200,7 @@ func (x *RPC) String() string {
 func (*RPC) ProtoMessage() {}
 
 func (x *RPC) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[5]
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -589,7 +1213,7 @@ func (x *RPC) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RPC.ProtoReflect.Descriptor instead.
 func (*RPC) Descriptor() ([]byte, []int) {
-	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{5}
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *RPC) GetName() string {
@@ -600,8 +1224,8 @@ func (x *RPC) GetName() string {
 }
 
 func (x *RPC) GetDoc() string {
-	if x != nil {
-		return x.Doc
+	if x != nil && x.Doc != nil {
+		return *x.Doc
 	}
 	return ""
 }
@@ -620,14 +1244,14 @@ func (x *RPC) GetAccessType() RPC_AccessType {
 	return RPC_PRIVATE
 }
 
-func (x *RPC) GetRequestSchema() *v1.Decl {
+func (x *RPC) GetRequestSchema() *v1.Type {
 	if x != nil {
 		return x.RequestSchema
 	}
 	return nil
 }
 
-func (x *RPC) GetResponseSchema() *v1.Decl {
+func (x *RPC) GetResponseSchema() *v1.Type {
 	if x != nil {
 		return x.ResponseSchema
 	}
@@ -648,23 +1272,102 @@ func (x *RPC) GetLoc() *v1.Loc {
 	return nil
 }
 
+func (x *RPC) GetPath() *Path {
+	if x != nil {
+		return x.Path
+	}
+	return nil
+}
+
+func (x *RPC) GetHttpMethods() []string {
+	if x != nil {
+		return x.HttpMethods
+	}
+	return nil
+}
+
+func (x *RPC) GetTags() []*Selector {
+	if x != nil {
+		return x.Tags
+	}
+	return nil
+}
+
+func (x *RPC) GetSensitive() bool {
+	if x != nil {
+		return x.Sensitive
+	}
+	return false
+}
+
+func (x *RPC) GetAllowUnauthenticated() bool {
+	if x != nil {
+		return x.AllowUnauthenticated
+	}
+	return false
+}
+
+func (x *RPC) GetExpose() map[string]*RPC_ExposeOptions {
+	if x != nil {
+		return x.Expose
+	}
+	return nil
+}
+
+func (x *RPC) GetBodyLimit() uint64 {
+	if x != nil && x.BodyLimit != nil {
+		return *x.BodyLimit
+	}
+	return 0
+}
+
+func (x *RPC) GetStreamingRequest() bool {
+	if x != nil {
+		return x.StreamingRequest
+	}
+	return false
+}
+
+func (x *RPC) GetStreamingResponse() bool {
+	if x != nil {
+		return x.StreamingResponse
+	}
+	return false
+}
+
+func (x *RPC) GetHandshakeSchema() *v1.Type {
+	if x != nil {
+		return x.HandshakeSchema
+	}
+	return nil
+}
+
+func (x *RPC) GetStaticAssets() *RPC_StaticAssets {
+	if x != nil {
+		return x.StaticAssets
+	}
+	return nil
+}
+
 type AuthHandler struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Name     string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
-	Doc      string   `protobuf:"bytes,2,opt,name=doc,proto3" json:"doc,omitempty"`
-	PkgPath  string   `protobuf:"bytes,3,opt,name=pkg_path,json=pkgPath,proto3" json:"pkg_path,omitempty"` // package (service) import path
-	PkgName  string   `protobuf:"bytes,4,opt,name=pkg_name,json=pkgName,proto3" json:"pkg_name,omitempty"` // package (service) name
-	Loc      *v1.Loc  `protobuf:"bytes,5,opt,name=loc,proto3" json:"loc,omitempty"`
-	AuthData *v1.Decl `protobuf:"bytes,6,opt,name=auth_data,json=authData,proto3" json:"auth_data,omitempty"` // custom auth data, or nil
+	Name        string   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Doc         string   `protobuf:"bytes,2,opt,name=doc,proto3" json:"doc,omitempty"`
+	PkgPath     string   `protobuf:"bytes,3,opt,name=pkg_path,json=pkgPath,proto3" json:"pkg_path,omitempty"` // package (service) import path
+	PkgName     string   `protobuf:"bytes,4,opt,name=pkg_name,json=pkgName,proto3" json:"pkg_name,omitempty"` // package (service) name
+	Loc         *v1.Loc  `protobuf:"bytes,5,opt,name=loc,proto3" json:"loc,omitempty"`
+	AuthData    *v1.Type `protobuf:"bytes,6,opt,name=auth_data,json=authData,proto3,oneof" json:"auth_data,omitempty"` // custom auth data, or nil
+	Params      *v1.Type `protobuf:"bytes,7,opt,name=params,proto3,oneof" json:"params,omitempty"`                     // builtin string or named type
+	ServiceName string   `protobuf:"bytes,8,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
 }
 
 func (x *AuthHandler) Reset() {
 	*x = AuthHandler{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[6]
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -677,7 +1380,7 @@ func (x *AuthHandler) String() string {
 func (*AuthHandler) ProtoMessage() {}
 
 func (x *AuthHandler) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[6]
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -690,7 +1393,7 @@ func (x *AuthHandler) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthHandler.ProtoReflect.Descriptor instead.
 func (*AuthHandler) Descriptor() ([]byte, []int) {
-	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{6}
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{7}
 }
 
 func (x *AuthHandler) GetName() string {
@@ -728,51 +1431,57 @@ func (x *AuthHandler) GetLoc() *v1.Loc {
 	return nil
 }
 
-func (x *AuthHandler) GetAuthData() *v1.Decl {
+func (x *AuthHandler) GetAuthData() *v1.Type {
 	if x != nil {
 		return x.AuthData
 	}
 	return nil
 }
 
-type TraceNode struct {
+func (x *AuthHandler) GetParams() *v1.Type {
+	if x != nil {
+		return x.Params
+	}
+	return nil
+}
+
+func (x *AuthHandler) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+type Middleware struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Id           int32  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
-	Filepath     string `protobuf:"bytes,2,opt,name=filepath,proto3" json:"filepath,omitempty"` // slash-separated, relative to app root
-	StartPos     int32  `protobuf:"varint,4,opt,name=start_pos,json=startPos,proto3" json:"start_pos,omitempty"`
-	EndPos       int32  `protobuf:"varint,5,opt,name=end_pos,json=endPos,proto3" json:"end_pos,omitempty"`
-	SrcLineStart int32  `protobuf:"varint,6,opt,name=src_line_start,json=srcLineStart,proto3" json:"src_line_start,omitempty"`
-	SrcLineEnd   int32  `protobuf:"varint,7,opt,name=src_line_end,json=srcLineEnd,proto3" json:"src_line_end,omitempty"`
-	SrcColStart  int32  `protobuf:"varint,8,opt,name=src_col_start,json=srcColStart,proto3" json:"src_col_start,omitempty"`
-	SrcColEnd    int32  `protobuf:"varint,9,opt,name=src_col_end,json=srcColEnd,proto3" json:"src_col_end,omitempty"`
-	// Types that are assignable to Context:
-	//	*TraceNode_RpcDef
-	//	*TraceNode_RpcCall
-	//	*TraceNode_StaticCall
-	//	*TraceNode_AuthHandlerDef
-	Context isTraceNode_Context `protobuf_oneof:"context"`
+	Name        *QualifiedName `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Doc         string         `protobuf:"bytes,2,opt,name=doc,proto3" json:"doc,omitempty"`
+	Loc         *v1.Loc        `protobuf:"bytes,3,opt,name=loc,proto3" json:"loc,omitempty"`
+	Global      bool           `protobuf:"varint,4,opt,name=global,proto3" json:"global,omitempty"`
+	ServiceName *string        `protobuf:"bytes,5,opt,name=service_name,json=serviceName,proto3,oneof" json:"service_name,omitempty"` // nil if global
+	Target      []*Selector    `protobuf:"bytes,6,rep,name=target,proto3" json:"target,omitempty"`
 }
 
-func (x *TraceNode) Reset() {
-	*x = TraceNode{}
+func (x *Middleware) Reset() {
+	*x = Middleware{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[7]
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *TraceNode) String() string {
+func (x *Middleware) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*TraceNode) ProtoMessage() {}
+func (*Middleware) ProtoMessage() {}
 
-func (x *TraceNode) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[7]
+func (x *Middleware) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -783,59 +1492,161 @@ func (x *TraceNode) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use TraceNode.ProtoReflect.Descriptor instead.
-func (*TraceNode) Descriptor() ([]byte, []int) {
-	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{7}
+// Deprecated: Use Middleware.ProtoReflect.Descriptor instead.
+func (*Middleware) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{8}
 }
 
-func (x *TraceNode) GetId() int32 {
+func (x *Middleware) GetName() *QualifiedName {
 	if x != nil {
-		return x.Id
+		return x.Name
 	}
-	return 0
+	return nil
 }
 
-func (x *TraceNode) GetFilepath() string {
+func (x *Middleware) GetDoc() string {
 	if x != nil {
-		return x.Filepath
+		return x.Doc
 	}
 	return ""
 }
 
-func (x *TraceNode) GetStartPos() int32 {
+func (x *Middleware) GetLoc() *v1.Loc {
 	if x != nil {
-		return x.StartPos
+		return x.Loc
 	}
-	return 0
+	return nil
 }
 
-func (x *TraceNode) GetEndPos() int32 {
+func (x *Middleware) GetGlobal() bool {
 	if x != nil {
-		return x.EndPos
+		return x.Global
 	}
-	return 0
+	return false
 }
 
-func (x *TraceNode) GetSrcLineStart() int32 {
-	if x != nil {
-		return x.SrcLineStart
+func (x *Middleware) GetServiceName() string {
+	if x != nil && x.ServiceName != nil {
+		return *x.ServiceName
 	}
-	return 0
+	return ""
 }
 
-func (x *TraceNode) GetSrcLineEnd() int32 {
+func (x *Middleware) GetTarget() []*Selector {
 	if x != nil {
-		return x.SrcLineEnd
+		return x.Target
 	}
-	return 0
+	return nil
 }
 
-func (x *TraceNode) GetSrcColStart() int32 {
-	if x != nil {
-		return x.SrcColStart
-	}
-	return 0
-}
+type TraceNode struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id           int32  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	Filepath     string `protobuf:"bytes,2,opt,name=filepath,proto3" json:"filepath,omitempty"` // slash-separated, relative to app root
+	StartPos     int32  `protobuf:"varint,4,opt,name=start_pos,json=startPos,proto3" json:"start_pos,omitempty"`
+	EndPos       int32  `protobuf:"varint,5,opt,name=end_pos,json=endPos,proto3" json:"end_pos,omitempty"`
+	SrcLineStart int32  `protobuf:"varint,6,opt,name=src_line_start,json=srcLineStart,proto3" json:"src_line_start,omitempty"`
+	SrcLineEnd   int32  `protobuf:"varint,7,opt,name=src_line_end,json=srcLineEnd,proto3" json:"src_line_end,omitempty"`
+	SrcColStart  int32  `protobuf:"varint,8,opt,name=src_col_start,json=srcColStart,proto3" json:"src_col_start,omitempty"`
+	SrcColEnd    int32  `protobuf:"varint,9,opt,name=src_col_end,json=srcColEnd,proto3" json:"src_col_end,omitempty"`
+	// Types that are assignable to Context:
+	//
+	//	*TraceNode_RpcDef
+	//	*TraceNode_RpcCall
+	//	*TraceNode_StaticCall
+	//	*TraceNode_AuthHandlerDef
+	//	*TraceNode_PubsubTopicDef
+	//	*TraceNode_PubsubPublish
+	//	*TraceNode_PubsubSubscriber
+	//	*TraceNode_ServiceInit
+	//	*TraceNode_MiddlewareDef
+	//	*TraceNode_CacheKeyspace
+	Context isTraceNode_Context `protobuf_oneof:"context"`
+}
+
+func (x *TraceNode) Reset() {
+	*x = TraceNode{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TraceNode) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TraceNode) ProtoMessage() {}
+
+func (x *TraceNode) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TraceNode.ProtoReflect.Descriptor instead.
+func (*TraceNode) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *TraceNode) GetId() int32 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+func (x *TraceNode) GetFilepath() string {
+	if x != nil {
+		return x.Filepath
+	}
+	return ""
+}
+
+func (x *TraceNode) GetStartPos() int32 {
+	if x != nil {
+		return x.StartPos
+	}
+	return 0
+}
+
+func (x *TraceNode) GetEndPos() int32 {
+	if x != nil {
+		return x.EndPos
+	}
+	return 0
+}
+
+func (x *TraceNode) GetSrcLineStart() int32 {
+	if x != nil {
+		return x.SrcLineStart
+	}
+	return 0
+}
+
+func (x *TraceNode) GetSrcLineEnd() int32 {
+	if x != nil {
+		return x.SrcLineEnd
+	}
+	return 0
+}
+
+func (x *TraceNode) GetSrcColStart() int32 {
+	if x != nil {
+		return x.SrcColStart
+	}
+	return 0
+}
 
 func (x *TraceNode) GetSrcColEnd() int32 {
 	if x != nil {
@@ -879,6 +1690,48 @@ func (x *TraceNode) GetAuthHandlerDef() *AuthHandlerDefNode {
 	return nil
 }
 
+func (x *TraceNode) GetPubsubTopicDef() *PubSubTopicDefNode {
+	if x, ok := x.GetContext().(*TraceNode_PubsubTopicDef); ok {
+		return x.PubsubTopicDef
+	}
+	return nil
+}
+
+func (x *TraceNode) GetPubsubPublish() *PubSubPublishNode {
+	if x, ok := x.GetContext().(*TraceNode_PubsubPublish); ok {
+		return x.PubsubPublish
+	}
+	return nil
+}
+
+func (x *TraceNode) GetPubsubSubscriber() *PubSubSubscriberNode {
+	if x, ok := x.GetContext().(*TraceNode_PubsubSubscriber); ok {
+		return x.PubsubSubscriber
+	}
+	return nil
+}
+
+func (x *TraceNode) GetServiceInit() *ServiceInitNode {
+	if x, ok := x.GetContext().(*TraceNode_ServiceInit); ok {
+		return x.ServiceInit
+	}
+	return nil
+}
+
+func (x *TraceNode) GetMiddlewareDef() *MiddlewareDefNode {
+	if x, ok := x.GetContext().(*TraceNode_MiddlewareDef); ok {
+		return x.MiddlewareDef
+	}
+	return nil
+}
+
+func (x *TraceNode) GetCacheKeyspace() *CacheKeyspaceDefNode {
+	if x, ok := x.GetContext().(*TraceNode_CacheKeyspace); ok {
+		return x.CacheKeyspace
+	}
+	return nil
+}
+
 type isTraceNode_Context interface {
 	isTraceNode_Context()
 }
@@ -899,6 +1752,30 @@ type TraceNode_AuthHandlerDef struct {
 	AuthHandlerDef *AuthHandlerDefNode `protobuf:"bytes,13,opt,name=auth_handler_def,json=authHandlerDef,proto3,oneof"`
 }
 
+type TraceNode_PubsubTopicDef struct {
+	PubsubTopicDef *PubSubTopicDefNode `protobuf:"bytes,14,opt,name=pubsub_topic_def,json=pubsubTopicDef,proto3,oneof"`
+}
+
+type TraceNode_PubsubPublish struct {
+	PubsubPublish *PubSubPublishNode `protobuf:"bytes,15,opt,name=pubsub_publish,json=pubsubPublish,proto3,oneof"`
+}
+
+type TraceNode_PubsubSubscriber struct {
+	PubsubSubscriber *PubSubSubscriberNode `protobuf:"bytes,16,opt,name=pubsub_subscriber,json=pubsubSubscriber,proto3,oneof"`
+}
+
+type TraceNode_ServiceInit struct {
+	ServiceInit *ServiceInitNode `protobuf:"bytes,17,opt,name=service_init,json=serviceInit,proto3,oneof"`
+}
+
+type TraceNode_MiddlewareDef struct {
+	MiddlewareDef *MiddlewareDefNode `protobuf:"bytes,18,opt,name=middleware_def,json=middlewareDef,proto3,oneof"`
+}
+
+type TraceNode_CacheKeyspace struct {
+	CacheKeyspace *CacheKeyspaceDefNode `protobuf:"bytes,19,opt,name=cache_keyspace,json=cacheKeyspace,proto3,oneof"`
+}
+
 func (*TraceNode_RpcDef) isTraceNode_Context() {}
 
 func (*TraceNode_RpcCall) isTraceNode_Context() {}
@@ -907,6 +1784,18 @@ func (*TraceNode_StaticCall) isTraceNode_Context() {}
 
 func (*TraceNode_AuthHandlerDef) isTraceNode_Context() {}
 
+func (*TraceNode_PubsubTopicDef) isTraceNode_Context() {}
+
+func (*TraceNode_PubsubPublish) isTraceNode_Context() {}
+
+func (*TraceNode_PubsubSubscriber) isTraceNode_Context() {}
+
+func (*TraceNode_ServiceInit) isTraceNode_Context() {}
+
+func (*TraceNode_MiddlewareDef) isTraceNode_Context() {}
+
+func (*TraceNode_CacheKeyspace) isTraceNode_Context() {}
+
 type RPCDefNode struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -920,7 +1809,7 @@ type RPCDefNode struct {
 func (x *RPCDefNode) Reset() {
 	*x = RPCDefNode{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[8]
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -933,7 +1822,7 @@ func (x *RPCDefNode) String() string {
 func (*RPCDefNode) ProtoMessage() {}
 
 func (x *RPCDefNode) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[8]
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -946,7 +1835,7 @@ func (x *RPCDefNode) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RPCDefNode.ProtoReflect.Descriptor instead.
 func (*RPCDefNode) Descriptor() ([]byte, []int) {
-	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{8}
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *RPCDefNode) GetServiceName() string {
@@ -983,7 +1872,7 @@ type RPCCallNode struct {
 func (x *RPCCallNode) Reset() {
 	*x = RPCCallNode{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[9]
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -996,7 +1885,7 @@ func (x *RPCCallNode) String() string {
 func (*RPCCallNode) ProtoMessage() {}
 
 func (x *RPCCallNode) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[9]
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1009,7 +1898,7 @@ func (x *RPCCallNode) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RPCCallNode.ProtoReflect.Descriptor instead.
 func (*RPCCallNode) Descriptor() ([]byte, []int) {
-	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{9}
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *RPCCallNode) GetServiceName() string {
@@ -1046,7 +1935,7 @@ type StaticCallNode struct {
 func (x *StaticCallNode) Reset() {
 	*x = StaticCallNode{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[10]
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1059,7 +1948,7 @@ func (x *StaticCallNode) String() string {
 func (*StaticCallNode) ProtoMessage() {}
 
 func (x *StaticCallNode) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[10]
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1072,7 +1961,7 @@ func (x *StaticCallNode) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StaticCallNode.ProtoReflect.Descriptor instead.
 func (*StaticCallNode) Descriptor() ([]byte, []int) {
-	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{10}
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *StaticCallNode) GetPackage() StaticCallNode_Package {
@@ -1109,7 +1998,7 @@ type AuthHandlerDefNode struct {
 func (x *AuthHandlerDefNode) Reset() {
 	*x = AuthHandlerDefNode{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[11]
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -1122,7 +2011,7 @@ func (x *AuthHandlerDefNode) String() string {
 func (*AuthHandlerDefNode) ProtoMessage() {}
 
 func (x *AuthHandlerDefNode) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[11]
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1135,7 +2024,7 @@ func (x *AuthHandlerDefNode) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use AuthHandlerDefNode.ProtoReflect.Descriptor instead.
 func (*AuthHandlerDefNode) Descriptor() ([]byte, []int) {
-	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{11}
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *AuthHandlerDefNode) GetServiceName() string {
@@ -1159,267 +2048,2477 @@ func (x *AuthHandlerDefNode) GetContext() string {
 	return ""
 }
 
-var File_encore_parser_meta_v1_meta_proto protoreflect.FileDescriptor
+type PubSubTopicDefNode struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
 
-var file_encore_parser_meta_v1_meta_proto_rawDesc = []byte{
-	0x0a, 0x20, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2f,
-	0x6d, 0x65, 0x74, 0x61, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x12, 0x15, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65,
-	0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x1a, 0x24, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2f, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2f,
-	0x76, 0x31, 0x2f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
-	0xac, 0x02, 0x0a, 0x04, 0x44, 0x61, 0x74, 0x61, 0x12, 0x1f, 0x0a, 0x0b, 0x6d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6d,
-	0x6f, 0x64, 0x75, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x61, 0x70, 0x70,
-	0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
-	0x61, 0x70, 0x70, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x33, 0x0a, 0x05, 0x64, 0x65,
-	0x63, 0x6c, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
-	0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61,
-	0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x63, 0x6c, 0x52, 0x05, 0x64, 0x65, 0x63, 0x6c, 0x73, 0x12,
-	0x32, 0x0a, 0x04, 0x70, 0x6b, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e,
-	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65,
-	0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x52, 0x04, 0x70,
-	0x6b, 0x67, 0x73, 0x12, 0x32, 0x0a, 0x04, 0x73, 0x76, 0x63, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65,
-	0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x52, 0x04, 0x73, 0x76, 0x63, 0x73, 0x12, 0x45, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x5f,
-	0x68, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e,
-	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65,
-	0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65,
-	0x72, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x22, 0x35,
-	0x0a, 0x0d, 0x51, 0x75, 0x61, 0x6c, 0x69, 0x66, 0x69, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x12,
-	0x10, 0x0a, 0x03, 0x70, 0x6b, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x6b,
-	0x67, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x8d, 0x02, 0x0a, 0x07, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67,
-	0x65, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x65, 0x6c, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x07, 0x72, 0x65, 0x6c, 0x50, 0x61, 0x74, 0x68, 0x12, 0x12, 0x0a, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
-	0x12, 0x10, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64,
-	0x6f, 0x63, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x73,
-	0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x73, 0x12,
-	0x41, 0x0a, 0x09, 0x72, 0x70, 0x63, 0x5f, 0x63, 0x61, 0x6c, 0x6c, 0x73, 0x18, 0x06, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73,
-	0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x51, 0x75, 0x61, 0x6c, 0x69,
-	0x66, 0x69, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x52, 0x08, 0x72, 0x70, 0x63, 0x43, 0x61, 0x6c,
-	0x6c, 0x73, 0x12, 0x41, 0x0a, 0x0b, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x6e, 0x6f, 0x64, 0x65,
-	0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
-	0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e,
-	0x54, 0x72, 0x61, 0x63, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x0a, 0x74, 0x72, 0x61, 0x63, 0x65,
-	0x4e, 0x6f, 0x64, 0x65, 0x73, 0x22, 0xac, 0x01, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x65, 0x6c, 0x5f, 0x70, 0x61, 0x74,
-	0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x72, 0x65, 0x6c, 0x50, 0x61, 0x74, 0x68,
-	0x12, 0x2e, 0x0a, 0x04, 0x72, 0x70, 0x63, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a,
-	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d,
-	0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x52, 0x04, 0x72, 0x70, 0x63, 0x73,
-	0x12, 0x42, 0x0a, 0x0a, 0x6d, 0x69, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61,
-	0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x42, 0x4d,
-	0x69, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x6d, 0x69, 0x67, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x73, 0x22, 0x63, 0x0a, 0x0b, 0x44, 0x42, 0x4d, 0x69, 0x67, 0x72, 0x61, 0x74,
-	0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x12,
-	0x16, 0x0a, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x05, 0x52,
-	0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73, 0x63, 0x72,
-	0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x65,
-	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xe2, 0x03, 0x0a, 0x03, 0x52, 0x50,
-	0x43, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x46, 0x0a, 0x0b, 0x61, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e,
-	0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x2e, 0x41, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x54, 0x79, 0x70, 0x65, 0x52, 0x0a, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x79,
-	0x70, 0x65, 0x12, 0x44, 0x0a, 0x0e, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x73, 0x63,
-	0x68, 0x65, 0x6d, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63,
-	0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d,
-	0x61, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x63, 0x6c, 0x52, 0x0d, 0x72, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x12, 0x46, 0x0a, 0x0f, 0x72, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65,
-	0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x63, 0x6c,
-	0x52, 0x0e, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61,
-	0x12, 0x39, 0x0a, 0x05, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0e, 0x32,
-	0x23, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e,
-	0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x2e, 0x50, 0x72, 0x6f, 0x74,
-	0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x05, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x2e, 0x0a, 0x03, 0x6c,
-	0x6f, 0x63, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e,
-	0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x63, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x22, 0x2f, 0x0a, 0x0a, 0x41,
-	0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x50, 0x52, 0x49,
-	0x56, 0x41, 0x54, 0x45, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43,
-	0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x55, 0x54, 0x48, 0x10, 0x02, 0x22, 0x20, 0x0a, 0x08,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x12, 0x0b, 0x0a, 0x07, 0x52, 0x45, 0x47, 0x55,
-	0x4c, 0x41, 0x52, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x52, 0x41, 0x57, 0x10, 0x01, 0x22, 0xd5,
-	0x01, 0x0a, 0x0b, 0x41, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x12, 0x12,
-	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x03, 0x64, 0x6f, 0x63, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x6b, 0x67, 0x5f, 0x70, 0x61, 0x74, 0x68,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x6b, 0x67, 0x50, 0x61, 0x74, 0x68, 0x12,
-	0x19, 0x0a, 0x08, 0x70, 0x6b, 0x67, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x70, 0x6b, 0x67, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2e, 0x0a, 0x03, 0x6c, 0x6f,
-	0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
-	0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76,
-	0x31, 0x2e, 0x4c, 0x6f, 0x63, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x12, 0x3a, 0x0a, 0x09, 0x61, 0x75,
-	0x74, 0x68, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
-	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63,
-	0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x63, 0x6c, 0x52, 0x08, 0x61, 0x75,
-	0x74, 0x68, 0x44, 0x61, 0x74, 0x61, 0x22, 0xa4, 0x04, 0x0a, 0x09, 0x54, 0x72, 0x61, 0x63, 0x65,
-	0x4e, 0x6f, 0x64, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05,
-	0x52, 0x02, 0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x70, 0x61, 0x74, 0x68,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x70, 0x61, 0x74, 0x68,
-	0x12, 0x1b, 0x0a, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x70, 0x6f, 0x73, 0x18, 0x04, 0x20,
-	0x01, 0x28, 0x05, 0x52, 0x08, 0x73, 0x74, 0x61, 0x72, 0x74, 0x50, 0x6f, 0x73, 0x12, 0x17, 0x0a,
-	0x07, 0x65, 0x6e, 0x64, 0x5f, 0x70, 0x6f, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06,
-	0x65, 0x6e, 0x64, 0x50, 0x6f, 0x73, 0x12, 0x24, 0x0a, 0x0e, 0x73, 0x72, 0x63, 0x5f, 0x6c, 0x69,
-	0x6e, 0x65, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0c,
-	0x73, 0x72, 0x63, 0x4c, 0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x20, 0x0a, 0x0c,
-	0x73, 0x72, 0x63, 0x5f, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x07, 0x20, 0x01,
-	0x28, 0x05, 0x52, 0x0a, 0x73, 0x72, 0x63, 0x4c, 0x69, 0x6e, 0x65, 0x45, 0x6e, 0x64, 0x12, 0x22,
-	0x0a, 0x0d, 0x73, 0x72, 0x63, 0x5f, 0x63, 0x6f, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18,
-	0x08, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0b, 0x73, 0x72, 0x63, 0x43, 0x6f, 0x6c, 0x53, 0x74, 0x61,
-	0x72, 0x74, 0x12, 0x1e, 0x0a, 0x0b, 0x73, 0x72, 0x63, 0x5f, 0x63, 0x6f, 0x6c, 0x5f, 0x65, 0x6e,
-	0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x73, 0x72, 0x63, 0x43, 0x6f, 0x6c, 0x45,
-	0x6e, 0x64, 0x12, 0x3c, 0x0a, 0x07, 0x72, 0x70, 0x63, 0x5f, 0x64, 0x65, 0x66, 0x18, 0x0a, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72,
-	0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x44,
-	0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x06, 0x72, 0x70, 0x63, 0x44, 0x65, 0x66,
-	0x12, 0x3f, 0x0a, 0x08, 0x72, 0x70, 0x63, 0x5f, 0x63, 0x61, 0x6c, 0x6c, 0x18, 0x0b, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73,
-	0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x43, 0x61,
-	0x6c, 0x6c, 0x4e, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x07, 0x72, 0x70, 0x63, 0x43, 0x61, 0x6c,
-	0x6c, 0x12, 0x48, 0x0a, 0x0b, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x5f, 0x63, 0x61, 0x6c, 0x6c,
-	0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
-	0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x53,
-	0x74, 0x61, 0x74, 0x69, 0x63, 0x43, 0x61, 0x6c, 0x6c, 0x4e, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52,
-	0x0a, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x43, 0x61, 0x6c, 0x6c, 0x12, 0x55, 0x0a, 0x10, 0x61,
-	0x75, 0x74, 0x68, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x5f, 0x64, 0x65, 0x66, 0x18,
-	0x0d, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70,
-	0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75,
-	0x74, 0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x44, 0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65,
-	0x48, 0x00, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x44,
-	0x65, 0x66, 0x42, 0x09, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x22, 0x64, 0x0a,
-	0x0a, 0x52, 0x50, 0x43, 0x44, 0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x19,
-	0x0a, 0x08, 0x72, 0x70, 0x63, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x07, 0x72, 0x70, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6e,
-	0x74, 0x65, 0x78, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74,
-	0x65, 0x78, 0x74, 0x22, 0x65, 0x0a, 0x0b, 0x52, 0x50, 0x43, 0x43, 0x61, 0x6c, 0x6c, 0x4e, 0x6f,
-	0x64, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x70, 0x63, 0x5f, 0x6e, 0x61, 0x6d,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x72, 0x70, 0x63, 0x4e, 0x61, 0x6d, 0x65,
-	0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x22, 0xb4, 0x01, 0x0a, 0x0e, 0x53,
-	0x74, 0x61, 0x74, 0x69, 0x63, 0x43, 0x61, 0x6c, 0x6c, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x47, 0x0a,
-	0x07, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2d,
-	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d,
-	0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x43, 0x61, 0x6c,
-	0x6c, 0x4e, 0x6f, 0x64, 0x65, 0x2e, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x52, 0x07, 0x70,
-	0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x75, 0x6e, 0x63, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x75, 0x6e, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f,
-	0x6e, 0x74, 0x65, 0x78, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6e,
-	0x74, 0x65, 0x78, 0x74, 0x22, 0x2b, 0x0a, 0x07, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x12,
-	0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05,
-	0x53, 0x51, 0x4c, 0x44, 0x42, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x52, 0x4c, 0x4f, 0x47, 0x10,
-	0x02, 0x22, 0x65, 0x0a, 0x12, 0x41, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72,
-	0x44, 0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73,
-	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x18,
-	0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x42, 0x26, 0x5a, 0x24, 0x65, 0x6e, 0x63, 0x72,
-	0x2e, 0x64, 0x65, 0x76, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2f, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x2f, 0x76, 0x31,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	TopicName string `protobuf:"bytes,1,opt,name=topic_name,json=topicName,proto3" json:"topic_name,omitempty"`
+	Context   string `protobuf:"bytes,2,opt,name=context,proto3" json:"context,omitempty"`
 }
 
-var (
-	file_encore_parser_meta_v1_meta_proto_rawDescOnce sync.Once
-	file_encore_parser_meta_v1_meta_proto_rawDescData = file_encore_parser_meta_v1_meta_proto_rawDesc
-)
+func (x *PubSubTopicDefNode) Reset() {
+	*x = PubSubTopicDefNode{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
 
-func file_encore_parser_meta_v1_meta_proto_rawDescGZIP() []byte {
-	file_encore_parser_meta_v1_meta_proto_rawDescOnce.Do(func() {
-		file_encore_parser_meta_v1_meta_proto_rawDescData = protoimpl.X.CompressGZIP(file_encore_parser_meta_v1_meta_proto_rawDescData)
-	})
-	return file_encore_parser_meta_v1_meta_proto_rawDescData
+func (x *PubSubTopicDefNode) String() string {
+	return protoimpl.X.MessageStringOf(x)
 }
 
-var file_encore_parser_meta_v1_meta_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
-var file_encore_parser_meta_v1_meta_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
-var file_encore_parser_meta_v1_meta_proto_goTypes = []interface{}{
-	(RPC_AccessType)(0),         // 0: encore.parser.meta.v1.RPC.AccessType
-	(RPC_Protocol)(0),           // 1: encore.parser.meta.v1.RPC.Protocol
-	(StaticCallNode_Package)(0), // 2: encore.parser.meta.v1.StaticCallNode.Package
-	(*Data)(nil),                // 3: encore.parser.meta.v1.Data
-	(*QualifiedName)(nil),       // 4: encore.parser.meta.v1.QualifiedName
-	(*Package)(nil),             // 5: encore.parser.meta.v1.Package
-	(*Service)(nil),             // 6: encore.parser.meta.v1.Service
-	(*DBMigration)(nil),         // 7: encore.parser.meta.v1.DBMigration
-	(*RPC)(nil),                 // 8: encore.parser.meta.v1.RPC
-	(*AuthHandler)(nil),         // 9: encore.parser.meta.v1.AuthHandler
-	(*TraceNode)(nil),           // 10: encore.parser.meta.v1.TraceNode
-	(*RPCDefNode)(nil),          // 11: encore.parser.meta.v1.RPCDefNode
-	(*RPCCallNode)(nil),         // 12: encore.parser.meta.v1.RPCCallNode
-	(*StaticCallNode)(nil),      // 13: encore.parser.meta.v1.StaticCallNode
-	(*AuthHandlerDefNode)(nil),  // 14: encore.parser.meta.v1.AuthHandlerDefNode
-	(*v1.Decl)(nil),             // 15: encore.parser.schema.v1.Decl
-	(*v1.Loc)(nil),              // 16: encore.parser.schema.v1.Loc
+func (*PubSubTopicDefNode) ProtoMessage() {}
+
+func (x *PubSubTopicDefNode) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
 }
-var file_encore_parser_meta_v1_meta_proto_depIdxs = []int32{
-	15, // 0: encore.parser.meta.v1.Data.decls:type_name -> encore.parser.schema.v1.Decl
-	5,  // 1: encore.parser.meta.v1.Data.pkgs:type_name -> encore.parser.meta.v1.Package
-	6,  // 2: encore.parser.meta.v1.Data.svcs:type_name -> encore.parser.meta.v1.Service
-	9,  // 3: encore.parser.meta.v1.Data.auth_handler:type_name -> encore.parser.meta.v1.AuthHandler
-	4,  // 4: encore.parser.meta.v1.Package.rpc_calls:type_name -> encore.parser.meta.v1.QualifiedName
-	10, // 5: encore.parser.meta.v1.Package.trace_nodes:type_name -> encore.parser.meta.v1.TraceNode
-	8,  // 6: encore.parser.meta.v1.Service.rpcs:type_name -> encore.parser.meta.v1.RPC
-	7,  // 7: encore.parser.meta.v1.Service.migrations:type_name -> encore.parser.meta.v1.DBMigration
-	0,  // 8: encore.parser.meta.v1.RPC.access_type:type_name -> encore.parser.meta.v1.RPC.AccessType
-	15, // 9: encore.parser.meta.v1.RPC.request_schema:type_name -> encore.parser.schema.v1.Decl
-	15, // 10: encore.parser.meta.v1.RPC.response_schema:type_name -> encore.parser.schema.v1.Decl
-	1,  // 11: encore.parser.meta.v1.RPC.proto:type_name -> encore.parser.meta.v1.RPC.Protocol
-	16, // 12: encore.parser.meta.v1.RPC.loc:type_name -> encore.parser.schema.v1.Loc
-	16, // 13: encore.parser.meta.v1.AuthHandler.loc:type_name -> encore.parser.schema.v1.Loc
-	15, // 14: encore.parser.meta.v1.AuthHandler.auth_data:type_name -> encore.parser.schema.v1.Decl
-	11, // 15: encore.parser.meta.v1.TraceNode.rpc_def:type_name -> encore.parser.meta.v1.RPCDefNode
-	12, // 16: encore.parser.meta.v1.TraceNode.rpc_call:type_name -> encore.parser.meta.v1.RPCCallNode
-	13, // 17: encore.parser.meta.v1.TraceNode.static_call:type_name -> encore.parser.meta.v1.StaticCallNode
-	14, // 18: encore.parser.meta.v1.TraceNode.auth_handler_def:type_name -> encore.parser.meta.v1.AuthHandlerDefNode
-	2,  // 19: encore.parser.meta.v1.StaticCallNode.package:type_name -> encore.parser.meta.v1.StaticCallNode.Package
-	20, // [20:20] is the sub-list for method output_type
-	20, // [20:20] is the sub-list for method input_type
-	20, // [20:20] is the sub-list for extension type_name
-	20, // [20:20] is the sub-list for extension extendee
-	0,  // [0:20] is the sub-list for field type_name
+
+// Deprecated: Use PubSubTopicDefNode.ProtoReflect.Descriptor instead.
+func (*PubSubTopicDefNode) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{14}
 }
 
-func init() { file_encore_parser_meta_v1_meta_proto_init() }
-func file_encore_parser_meta_v1_meta_proto_init() {
-	if File_encore_parser_meta_v1_meta_proto != nil {
-		return
+func (x *PubSubTopicDefNode) GetTopicName() string {
+	if x != nil {
+		return x.TopicName
 	}
-	if !protoimpl.UnsafeEnabled {
-		file_encore_parser_meta_v1_meta_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Data); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
+	return ""
+}
+
+func (x *PubSubTopicDefNode) GetContext() string {
+	if x != nil {
+		return x.Context
+	}
+	return ""
+}
+
+type PubSubPublishNode struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TopicName string `protobuf:"bytes,1,opt,name=topic_name,json=topicName,proto3" json:"topic_name,omitempty"`
+	Context   string `protobuf:"bytes,2,opt,name=context,proto3" json:"context,omitempty"`
+}
+
+func (x *PubSubPublishNode) Reset() {
+	*x = PubSubPublishNode{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubPublishNode) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubPublishNode) ProtoMessage() {}
+
+func (x *PubSubPublishNode) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubPublishNode.ProtoReflect.Descriptor instead.
+func (*PubSubPublishNode) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *PubSubPublishNode) GetTopicName() string {
+	if x != nil {
+		return x.TopicName
+	}
+	return ""
+}
+
+func (x *PubSubPublishNode) GetContext() string {
+	if x != nil {
+		return x.Context
+	}
+	return ""
+}
+
+type PubSubSubscriberNode struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TopicName      string `protobuf:"bytes,1,opt,name=topic_name,json=topicName,proto3" json:"topic_name,omitempty"`
+	SubscriberName string `protobuf:"bytes,2,opt,name=subscriber_name,json=subscriberName,proto3" json:"subscriber_name,omitempty"`
+	ServiceName    string `protobuf:"bytes,3,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	Context        string `protobuf:"bytes,4,opt,name=context,proto3" json:"context,omitempty"`
+}
+
+func (x *PubSubSubscriberNode) Reset() {
+	*x = PubSubSubscriberNode{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubSubscriberNode) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubSubscriberNode) ProtoMessage() {}
+
+func (x *PubSubSubscriberNode) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubSubscriberNode.ProtoReflect.Descriptor instead.
+func (*PubSubSubscriberNode) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *PubSubSubscriberNode) GetTopicName() string {
+	if x != nil {
+		return x.TopicName
+	}
+	return ""
+}
+
+func (x *PubSubSubscriberNode) GetSubscriberName() string {
+	if x != nil {
+		return x.SubscriberName
+	}
+	return ""
+}
+
+func (x *PubSubSubscriberNode) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *PubSubSubscriberNode) GetContext() string {
+	if x != nil {
+		return x.Context
+	}
+	return ""
+}
+
+type ServiceInitNode struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ServiceName   string `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	SetupFuncName string `protobuf:"bytes,2,opt,name=setup_func_name,json=setupFuncName,proto3" json:"setup_func_name,omitempty"`
+	Context       string `protobuf:"bytes,3,opt,name=context,proto3" json:"context,omitempty"`
+}
+
+func (x *ServiceInitNode) Reset() {
+	*x = ServiceInitNode{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceInitNode) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceInitNode) ProtoMessage() {}
+
+func (x *ServiceInitNode) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceInitNode.ProtoReflect.Descriptor instead.
+func (*ServiceInitNode) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *ServiceInitNode) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *ServiceInitNode) GetSetupFuncName() string {
+	if x != nil {
+		return x.SetupFuncName
+	}
+	return ""
+}
+
+func (x *ServiceInitNode) GetContext() string {
+	if x != nil {
+		return x.Context
+	}
+	return ""
+}
+
+type MiddlewareDefNode struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PkgRelPath string      `protobuf:"bytes,1,opt,name=pkg_rel_path,json=pkgRelPath,proto3" json:"pkg_rel_path,omitempty"`
+	Name       string      `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Context    string      `protobuf:"bytes,3,opt,name=context,proto3" json:"context,omitempty"`
+	Target     []*Selector `protobuf:"bytes,4,rep,name=target,proto3" json:"target,omitempty"`
+}
+
+func (x *MiddlewareDefNode) Reset() {
+	*x = MiddlewareDefNode{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MiddlewareDefNode) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MiddlewareDefNode) ProtoMessage() {}
+
+func (x *MiddlewareDefNode) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MiddlewareDefNode.ProtoReflect.Descriptor instead.
+func (*MiddlewareDefNode) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *MiddlewareDefNode) GetPkgRelPath() string {
+	if x != nil {
+		return x.PkgRelPath
+	}
+	return ""
+}
+
+func (x *MiddlewareDefNode) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *MiddlewareDefNode) GetContext() string {
+	if x != nil {
+		return x.Context
+	}
+	return ""
+}
+
+func (x *MiddlewareDefNode) GetTarget() []*Selector {
+	if x != nil {
+		return x.Target
+	}
+	return nil
+}
+
+type CacheKeyspaceDefNode struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PkgRelPath  string `protobuf:"bytes,1,opt,name=pkg_rel_path,json=pkgRelPath,proto3" json:"pkg_rel_path,omitempty"`
+	VarName     string `protobuf:"bytes,2,opt,name=var_name,json=varName,proto3" json:"var_name,omitempty"`
+	ClusterName string `protobuf:"bytes,3,opt,name=cluster_name,json=clusterName,proto3" json:"cluster_name,omitempty"`
+	Context     string `protobuf:"bytes,4,opt,name=context,proto3" json:"context,omitempty"`
+}
+
+func (x *CacheKeyspaceDefNode) Reset() {
+	*x = CacheKeyspaceDefNode{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CacheKeyspaceDefNode) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CacheKeyspaceDefNode) ProtoMessage() {}
+
+func (x *CacheKeyspaceDefNode) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CacheKeyspaceDefNode.ProtoReflect.Descriptor instead.
+func (*CacheKeyspaceDefNode) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *CacheKeyspaceDefNode) GetPkgRelPath() string {
+	if x != nil {
+		return x.PkgRelPath
+	}
+	return ""
+}
+
+func (x *CacheKeyspaceDefNode) GetVarName() string {
+	if x != nil {
+		return x.VarName
+	}
+	return ""
+}
+
+func (x *CacheKeyspaceDefNode) GetClusterName() string {
+	if x != nil {
+		return x.ClusterName
+	}
+	return ""
+}
+
+func (x *CacheKeyspaceDefNode) GetContext() string {
+	if x != nil {
+		return x.Context
+	}
+	return ""
+}
+
+type Path struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Segments []*PathSegment `protobuf:"bytes,1,rep,name=segments,proto3" json:"segments,omitempty"`
+	Type     Path_Type      `protobuf:"varint,2,opt,name=type,proto3,enum=encore.parser.meta.v1.Path_Type" json:"type,omitempty"`
+}
+
+func (x *Path) Reset() {
+	*x = Path{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Path) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Path) ProtoMessage() {}
+
+func (x *Path) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Path.ProtoReflect.Descriptor instead.
+func (*Path) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *Path) GetSegments() []*PathSegment {
+	if x != nil {
+		return x.Segments
+	}
+	return nil
+}
+
+func (x *Path) GetType() Path_Type {
+	if x != nil {
+		return x.Type
+	}
+	return Path_URL
+}
+
+type PathSegment struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Type       PathSegment_SegmentType `protobuf:"varint,1,opt,name=type,proto3,enum=encore.parser.meta.v1.PathSegment_SegmentType" json:"type,omitempty"`
+	Value      string                  `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	ValueType  PathSegment_ParamType   `protobuf:"varint,3,opt,name=value_type,json=valueType,proto3,enum=encore.parser.meta.v1.PathSegment_ParamType" json:"value_type,omitempty"`
+	Validation *v1.ValidationExpr      `protobuf:"bytes,4,opt,name=validation,proto3,oneof" json:"validation,omitempty"`
+}
+
+func (x *PathSegment) Reset() {
+	*x = PathSegment{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PathSegment) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PathSegment) ProtoMessage() {}
+
+func (x *PathSegment) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PathSegment.ProtoReflect.Descriptor instead.
+func (*PathSegment) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{21}
+}
+
+func (x *PathSegment) GetType() PathSegment_SegmentType {
+	if x != nil {
+		return x.Type
+	}
+	return PathSegment_LITERAL
+}
+
+func (x *PathSegment) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+func (x *PathSegment) GetValueType() PathSegment_ParamType {
+	if x != nil {
+		return x.ValueType
+	}
+	return PathSegment_STRING
+}
+
+func (x *PathSegment) GetValidation() *v1.ValidationExpr {
+	if x != nil {
+		return x.Validation
+	}
+	return nil
+}
+
+type Gateway struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	EncoreName string `protobuf:"bytes,1,opt,name=encore_name,json=encoreName,proto3" json:"encore_name,omitempty"`
+	// Spec is the configuration for the gateway, if it's explicitly defined.
+	Explicit *Gateway_Explicit `protobuf:"bytes,2,opt,name=explicit,proto3,oneof" json:"explicit,omitempty"`
+}
+
+func (x *Gateway) Reset() {
+	*x = Gateway{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[22]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Gateway) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Gateway) ProtoMessage() {}
+
+func (x *Gateway) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[22]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Gateway.ProtoReflect.Descriptor instead.
+func (*Gateway) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *Gateway) GetEncoreName() string {
+	if x != nil {
+		return x.EncoreName
+	}
+	return ""
+}
+
+func (x *Gateway) GetExplicit() *Gateway_Explicit {
+	if x != nil {
+		return x.Explicit
+	}
+	return nil
+}
+
+type CronJob struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id       string         `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Title    string         `protobuf:"bytes,2,opt,name=title,proto3" json:"title,omitempty"`
+	Doc      *string        `protobuf:"bytes,3,opt,name=doc,proto3,oneof" json:"doc,omitempty"`
+	Schedule string         `protobuf:"bytes,4,opt,name=schedule,proto3" json:"schedule,omitempty"`
+	Endpoint *QualifiedName `protobuf:"bytes,5,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
+}
+
+func (x *CronJob) Reset() {
+	*x = CronJob{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[23]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CronJob) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CronJob) ProtoMessage() {}
+
+func (x *CronJob) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[23]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CronJob.ProtoReflect.Descriptor instead.
+func (*CronJob) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *CronJob) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *CronJob) GetTitle() string {
+	if x != nil {
+		return x.Title
+	}
+	return ""
+}
+
+func (x *CronJob) GetDoc() string {
+	if x != nil && x.Doc != nil {
+		return *x.Doc
+	}
+	return ""
+}
+
+func (x *CronJob) GetSchedule() string {
+	if x != nil {
+		return x.Schedule
+	}
+	return ""
+}
+
+func (x *CronJob) GetEndpoint() *QualifiedName {
+	if x != nil {
+		return x.Endpoint
+	}
+	return nil
+}
+
+type SQLDatabase struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name string  `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Doc  *string `protobuf:"bytes,2,opt,name=doc,proto3,oneof" json:"doc,omitempty"`
+	// migration_rel_path is the slash-separated path to the migrations,
+	// relative to the main module's root directory.
+	MigrationRelPath             *string        `protobuf:"bytes,3,opt,name=migration_rel_path,json=migrationRelPath,proto3,oneof" json:"migration_rel_path,omitempty"`
+	Migrations                   []*DBMigration `protobuf:"bytes,4,rep,name=migrations,proto3" json:"migrations,omitempty"`
+	AllowNonSequentialMigrations bool           `protobuf:"varint,5,opt,name=allow_non_sequential_migrations,json=allowNonSequentialMigrations,proto3" json:"allow_non_sequential_migrations,omitempty"`
+}
+
+func (x *SQLDatabase) Reset() {
+	*x = SQLDatabase{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[24]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLDatabase) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLDatabase) ProtoMessage() {}
+
+func (x *SQLDatabase) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[24]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLDatabase.ProtoReflect.Descriptor instead.
+func (*SQLDatabase) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *SQLDatabase) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *SQLDatabase) GetDoc() string {
+	if x != nil && x.Doc != nil {
+		return *x.Doc
+	}
+	return ""
+}
+
+func (x *SQLDatabase) GetMigrationRelPath() string {
+	if x != nil && x.MigrationRelPath != nil {
+		return *x.MigrationRelPath
+	}
+	return ""
+}
+
+func (x *SQLDatabase) GetMigrations() []*DBMigration {
+	if x != nil {
+		return x.Migrations
+	}
+	return nil
+}
+
+func (x *SQLDatabase) GetAllowNonSequentialMigrations() bool {
+	if x != nil {
+		return x.AllowNonSequentialMigrations
+	}
+	return false
+}
+
+type DBMigration struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Filename    string `protobuf:"bytes,1,opt,name=filename,proto3" json:"filename,omitempty"`       // filename
+	Number      uint64 `protobuf:"varint,2,opt,name=number,proto3" json:"number,omitempty"`          // migration number
+	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"` // descriptive name
+}
+
+func (x *DBMigration) Reset() {
+	*x = DBMigration{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[25]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DBMigration) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DBMigration) ProtoMessage() {}
+
+func (x *DBMigration) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[25]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DBMigration.ProtoReflect.Descriptor instead.
+func (*DBMigration) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *DBMigration) GetFilename() string {
+	if x != nil {
+		return x.Filename
+	}
+	return ""
+}
+
+func (x *DBMigration) GetNumber() uint64 {
+	if x != nil {
+		return x.Number
+	}
+	return 0
+}
+
+func (x *DBMigration) GetDescription() string {
+	if x != nil {
+		return x.Description
+	}
+	return ""
+}
+
+type Bucket struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name      string  `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Doc       *string `protobuf:"bytes,2,opt,name=doc,proto3,oneof" json:"doc,omitempty"`
+	Versioned bool    `protobuf:"varint,3,opt,name=versioned,proto3" json:"versioned,omitempty"`
+	Public    bool    `protobuf:"varint,4,opt,name=public,proto3" json:"public,omitempty"`
+}
+
+func (x *Bucket) Reset() {
+	*x = Bucket{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[26]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Bucket) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Bucket) ProtoMessage() {}
+
+func (x *Bucket) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[26]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Bucket.ProtoReflect.Descriptor instead.
+func (*Bucket) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *Bucket) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Bucket) GetDoc() string {
+	if x != nil && x.Doc != nil {
+		return *x.Doc
+	}
+	return ""
+}
+
+func (x *Bucket) GetVersioned() bool {
+	if x != nil {
+		return x.Versioned
+	}
+	return false
+}
+
+func (x *Bucket) GetPublic() bool {
+	if x != nil {
+		return x.Public
+	}
+	return false
+}
+
+type PubSubTopic struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name              string                        `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`                                                                                                              // The pub sub topic name (unique per application)
+	Doc               *string                       `protobuf:"bytes,2,opt,name=doc,proto3,oneof" json:"doc,omitempty"`                                                                                                          // The documentation for the topic
+	MessageType       *v1.Type                      `protobuf:"bytes,3,opt,name=message_type,json=messageType,proto3" json:"message_type,omitempty"`                                                                             // The type of the message
+	DeliveryGuarantee PubSubTopic_DeliveryGuarantee `protobuf:"varint,4,opt,name=delivery_guarantee,json=deliveryGuarantee,proto3,enum=encore.parser.meta.v1.PubSubTopic_DeliveryGuarantee" json:"delivery_guarantee,omitempty"` // The delivery guarantee for the topic
+	OrderingKey       string                        `protobuf:"bytes,5,opt,name=ordering_key,json=orderingKey,proto3" json:"ordering_key,omitempty"`                                                                             // The field used to group messages; if empty, the topic is not ordered
+	Publishers        []*PubSubTopic_Publisher      `protobuf:"bytes,6,rep,name=publishers,proto3" json:"publishers,omitempty"`                                                                                                  // The publishers for this topic
+	Subscriptions     []*PubSubTopic_Subscription   `protobuf:"bytes,7,rep,name=subscriptions,proto3" json:"subscriptions,omitempty"`                                                                                            // The subscriptions to the topic
+}
+
+func (x *PubSubTopic) Reset() {
+	*x = PubSubTopic{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[27]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubTopic) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubTopic) ProtoMessage() {}
+
+func (x *PubSubTopic) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[27]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubTopic.ProtoReflect.Descriptor instead.
+func (*PubSubTopic) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{27}
+}
+
+func (x *PubSubTopic) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *PubSubTopic) GetDoc() string {
+	if x != nil && x.Doc != nil {
+		return *x.Doc
+	}
+	return ""
+}
+
+func (x *PubSubTopic) GetMessageType() *v1.Type {
+	if x != nil {
+		return x.MessageType
+	}
+	return nil
+}
+
+func (x *PubSubTopic) GetDeliveryGuarantee() PubSubTopic_DeliveryGuarantee {
+	if x != nil {
+		return x.DeliveryGuarantee
+	}
+	return PubSubTopic_AT_LEAST_ONCE
+}
+
+func (x *PubSubTopic) GetOrderingKey() string {
+	if x != nil {
+		return x.OrderingKey
+	}
+	return ""
+}
+
+func (x *PubSubTopic) GetPublishers() []*PubSubTopic_Publisher {
+	if x != nil {
+		return x.Publishers
+	}
+	return nil
+}
+
+func (x *PubSubTopic) GetSubscriptions() []*PubSubTopic_Subscription {
+	if x != nil {
+		return x.Subscriptions
+	}
+	return nil
+}
+
+type CacheCluster struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name           string                   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`                                           // The pub sub topic name (unique per application)
+	Doc            string                   `protobuf:"bytes,2,opt,name=doc,proto3" json:"doc,omitempty"`                                             // The documentation for the topic
+	Keyspaces      []*CacheCluster_Keyspace `protobuf:"bytes,3,rep,name=keyspaces,proto3" json:"keyspaces,omitempty"`                                 // The publishers for this topic
+	EvictionPolicy string                   `protobuf:"bytes,4,opt,name=eviction_policy,json=evictionPolicy,proto3" json:"eviction_policy,omitempty"` // redis eviction policy
+}
+
+func (x *CacheCluster) Reset() {
+	*x = CacheCluster{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[28]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CacheCluster) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CacheCluster) ProtoMessage() {}
+
+func (x *CacheCluster) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[28]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CacheCluster.ProtoReflect.Descriptor instead.
+func (*CacheCluster) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{28}
+}
+
+func (x *CacheCluster) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *CacheCluster) GetDoc() string {
+	if x != nil {
+		return x.Doc
+	}
+	return ""
+}
+
+func (x *CacheCluster) GetKeyspaces() []*CacheCluster_Keyspace {
+	if x != nil {
+		return x.Keyspaces
+	}
+	return nil
+}
+
+func (x *CacheCluster) GetEvictionPolicy() string {
+	if x != nil {
+		return x.EvictionPolicy
+	}
+	return ""
+}
+
+type Metric struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name        string            `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` // the name of the metric
+	ValueType   v1.Builtin        `protobuf:"varint,2,opt,name=value_type,json=valueType,proto3,enum=encore.parser.schema.v1.Builtin" json:"value_type,omitempty"`
+	Doc         string            `protobuf:"bytes,3,opt,name=doc,proto3" json:"doc,omitempty"` // the doc string
+	Kind        Metric_MetricKind `protobuf:"varint,4,opt,name=kind,proto3,enum=encore.parser.meta.v1.Metric_MetricKind" json:"kind,omitempty"`
+	ServiceName *string           `protobuf:"bytes,5,opt,name=service_name,json=serviceName,proto3,oneof" json:"service_name,omitempty"` // the service the metric is exclusive to, if any.
+	Labels      []*Metric_Label   `protobuf:"bytes,6,rep,name=labels,proto3" json:"labels,omitempty"`
+}
+
+func (x *Metric) Reset() {
+	*x = Metric{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[29]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Metric) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Metric) ProtoMessage() {}
+
+func (x *Metric) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[29]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Metric.ProtoReflect.Descriptor instead.
+func (*Metric) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{29}
+}
+
+func (x *Metric) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Metric) GetValueType() v1.Builtin {
+	if x != nil {
+		return x.ValueType
+	}
+	return v1.Builtin(0)
+}
+
+func (x *Metric) GetDoc() string {
+	if x != nil {
+		return x.Doc
+	}
+	return ""
+}
+
+func (x *Metric) GetKind() Metric_MetricKind {
+	if x != nil {
+		return x.Kind
+	}
+	return Metric_COUNTER
+}
+
+func (x *Metric) GetServiceName() string {
+	if x != nil && x.ServiceName != nil {
+		return *x.ServiceName
+	}
+	return ""
+}
+
+func (x *Metric) GetLabels() []*Metric_Label {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+type RPC_ExposeOptions struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *RPC_ExposeOptions) Reset() {
+	*x = RPC_ExposeOptions{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[31]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RPC_ExposeOptions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RPC_ExposeOptions) ProtoMessage() {}
+
+func (x *RPC_ExposeOptions) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[31]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RPC_ExposeOptions.ProtoReflect.Descriptor instead.
+func (*RPC_ExposeOptions) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{6, 1}
+}
+
+type RPC_StaticAssets struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// dir_rel_path is the slash-separated path to the static files directory,
+	// relative to the app root.
+	DirRelPath string `protobuf:"bytes,1,opt,name=dir_rel_path,json=dirRelPath,proto3" json:"dir_rel_path,omitempty"`
+	// not_found_rel_path is the relative path to the file to serve when the requested
+	// file is not found. It is relative to the files_rel_path directory.
+	NotFoundRelPath *string `protobuf:"bytes,2,opt,name=not_found_rel_path,json=notFoundRelPath,proto3,oneof" json:"not_found_rel_path,omitempty"`
+	NotFoundStatus  *uint32 `protobuf:"varint,3,opt,name=not_found_status,json=notFoundStatus,proto3,oneof" json:"not_found_status,omitempty"`
+}
+
+func (x *RPC_StaticAssets) Reset() {
+	*x = RPC_StaticAssets{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[32]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RPC_StaticAssets) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RPC_StaticAssets) ProtoMessage() {}
+
+func (x *RPC_StaticAssets) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[32]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RPC_StaticAssets.ProtoReflect.Descriptor instead.
+func (*RPC_StaticAssets) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{6, 2}
+}
+
+func (x *RPC_StaticAssets) GetDirRelPath() string {
+	if x != nil {
+		return x.DirRelPath
+	}
+	return ""
+}
+
+func (x *RPC_StaticAssets) GetNotFoundRelPath() string {
+	if x != nil && x.NotFoundRelPath != nil {
+		return *x.NotFoundRelPath
+	}
+	return ""
+}
+
+func (x *RPC_StaticAssets) GetNotFoundStatus() uint32 {
+	if x != nil && x.NotFoundStatus != nil {
+		return *x.NotFoundStatus
+	}
+	return 0
+}
+
+type Gateway_Explicit struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The service name this gateway belongs to.
+	ServiceName string       `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`
+	AuthHandler *AuthHandler `protobuf:"bytes,2,opt,name=auth_handler,json=authHandler,proto3,oneof" json:"auth_handler,omitempty"`
+}
+
+func (x *Gateway_Explicit) Reset() {
+	*x = Gateway_Explicit{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[33]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Gateway_Explicit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Gateway_Explicit) ProtoMessage() {}
+
+func (x *Gateway_Explicit) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[33]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Gateway_Explicit.ProtoReflect.Descriptor instead.
+func (*Gateway_Explicit) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{22, 0}
+}
+
+func (x *Gateway_Explicit) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *Gateway_Explicit) GetAuthHandler() *AuthHandler {
+	if x != nil {
+		return x.AuthHandler
+	}
+	return nil
+}
+
+type PubSubTopic_Publisher struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ServiceName string `protobuf:"bytes,1,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"` // The service the publisher is in
+}
+
+func (x *PubSubTopic_Publisher) Reset() {
+	*x = PubSubTopic_Publisher{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[34]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubTopic_Publisher) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubTopic_Publisher) ProtoMessage() {}
+
+func (x *PubSubTopic_Publisher) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[34]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubTopic_Publisher.ProtoReflect.Descriptor instead.
+func (*PubSubTopic_Publisher) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{27, 0}
+}
+
+func (x *PubSubTopic_Publisher) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+type PubSubTopic_Subscription struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name             string                   `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`                                                  // The unique name of the subscription for this topic
+	ServiceName      string                   `protobuf:"bytes,2,opt,name=service_name,json=serviceName,proto3" json:"service_name,omitempty"`                 // The service that the subscriber is in
+	AckDeadline      int64                    `protobuf:"varint,3,opt,name=ack_deadline,json=ackDeadline,proto3" json:"ack_deadline,omitempty"`                // How long has a consumer got to process and ack a message in nanoseconds
+	MessageRetention int64                    `protobuf:"varint,4,opt,name=message_retention,json=messageRetention,proto3" json:"message_retention,omitempty"` // How long is an undelivered message kept in nanoseconds
+	RetryPolicy      *PubSubTopic_RetryPolicy `protobuf:"bytes,5,opt,name=retry_policy,json=retryPolicy,proto3" json:"retry_policy,omitempty"`                 // The retry policy for the subscription
+	// How many messages each instance can process concurrently.
+	// If not set, the default is provider-specific.
+	MaxConcurrency *int32 `protobuf:"varint,6,opt,name=max_concurrency,json=maxConcurrency,proto3,oneof" json:"max_concurrency,omitempty"`
+}
+
+func (x *PubSubTopic_Subscription) Reset() {
+	*x = PubSubTopic_Subscription{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[35]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubTopic_Subscription) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubTopic_Subscription) ProtoMessage() {}
+
+func (x *PubSubTopic_Subscription) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[35]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubTopic_Subscription.ProtoReflect.Descriptor instead.
+func (*PubSubTopic_Subscription) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{27, 1}
+}
+
+func (x *PubSubTopic_Subscription) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *PubSubTopic_Subscription) GetServiceName() string {
+	if x != nil {
+		return x.ServiceName
+	}
+	return ""
+}
+
+func (x *PubSubTopic_Subscription) GetAckDeadline() int64 {
+	if x != nil {
+		return x.AckDeadline
+	}
+	return 0
+}
+
+func (x *PubSubTopic_Subscription) GetMessageRetention() int64 {
+	if x != nil {
+		return x.MessageRetention
+	}
+	return 0
+}
+
+func (x *PubSubTopic_Subscription) GetRetryPolicy() *PubSubTopic_RetryPolicy {
+	if x != nil {
+		return x.RetryPolicy
+	}
+	return nil
+}
+
+func (x *PubSubTopic_Subscription) GetMaxConcurrency() int32 {
+	if x != nil && x.MaxConcurrency != nil {
+		return *x.MaxConcurrency
+	}
+	return 0
+}
+
+type PubSubTopic_RetryPolicy struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MinBackoff int64 `protobuf:"varint,1,opt,name=min_backoff,json=minBackoff,proto3" json:"min_backoff,omitempty"` // min backoff in nanoseconds
+	MaxBackoff int64 `protobuf:"varint,2,opt,name=max_backoff,json=maxBackoff,proto3" json:"max_backoff,omitempty"` // max backoff in nanoseconds
+	MaxRetries int64 `protobuf:"varint,3,opt,name=max_retries,json=maxRetries,proto3" json:"max_retries,omitempty"` // max number of retries
+}
+
+func (x *PubSubTopic_RetryPolicy) Reset() {
+	*x = PubSubTopic_RetryPolicy{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[36]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubTopic_RetryPolicy) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubTopic_RetryPolicy) ProtoMessage() {}
+
+func (x *PubSubTopic_RetryPolicy) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[36]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubTopic_RetryPolicy.ProtoReflect.Descriptor instead.
+func (*PubSubTopic_RetryPolicy) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{27, 2}
+}
+
+func (x *PubSubTopic_RetryPolicy) GetMinBackoff() int64 {
+	if x != nil {
+		return x.MinBackoff
+	}
+	return 0
+}
+
+func (x *PubSubTopic_RetryPolicy) GetMaxBackoff() int64 {
+	if x != nil {
+		return x.MaxBackoff
+	}
+	return 0
+}
+
+func (x *PubSubTopic_RetryPolicy) GetMaxRetries() int64 {
+	if x != nil {
+		return x.MaxRetries
+	}
+	return 0
+}
+
+type CacheCluster_Keyspace struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	KeyType     *v1.Type `protobuf:"bytes,1,opt,name=key_type,json=keyType,proto3" json:"key_type,omitempty"`
+	ValueType   *v1.Type `protobuf:"bytes,2,opt,name=value_type,json=valueType,proto3" json:"value_type,omitempty"`
+	Service     string   `protobuf:"bytes,3,opt,name=service,proto3" json:"service,omitempty"`
+	Doc         string   `protobuf:"bytes,4,opt,name=doc,proto3" json:"doc,omitempty"`
+	PathPattern *Path    `protobuf:"bytes,5,opt,name=path_pattern,json=pathPattern,proto3" json:"path_pattern,omitempty"`
+}
+
+func (x *CacheCluster_Keyspace) Reset() {
+	*x = CacheCluster_Keyspace{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[37]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CacheCluster_Keyspace) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CacheCluster_Keyspace) ProtoMessage() {}
+
+func (x *CacheCluster_Keyspace) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[37]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CacheCluster_Keyspace.ProtoReflect.Descriptor instead.
+func (*CacheCluster_Keyspace) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{28, 0}
+}
+
+func (x *CacheCluster_Keyspace) GetKeyType() *v1.Type {
+	if x != nil {
+		return x.KeyType
+	}
+	return nil
+}
+
+func (x *CacheCluster_Keyspace) GetValueType() *v1.Type {
+	if x != nil {
+		return x.ValueType
+	}
+	return nil
+}
+
+func (x *CacheCluster_Keyspace) GetService() string {
+	if x != nil {
+		return x.Service
+	}
+	return ""
+}
+
+func (x *CacheCluster_Keyspace) GetDoc() string {
+	if x != nil {
+		return x.Doc
+	}
+	return ""
+}
+
+func (x *CacheCluster_Keyspace) GetPathPattern() *Path {
+	if x != nil {
+		return x.PathPattern
+	}
+	return nil
+}
+
+type Metric_Label struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key  string     `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Type v1.Builtin `protobuf:"varint,2,opt,name=type,proto3,enum=encore.parser.schema.v1.Builtin" json:"type,omitempty"`
+	Doc  string     `protobuf:"bytes,3,opt,name=doc,proto3" json:"doc,omitempty"`
+}
+
+func (x *Metric_Label) Reset() {
+	*x = Metric_Label{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[38]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Metric_Label) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Metric_Label) ProtoMessage() {}
+
+func (x *Metric_Label) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_meta_v1_meta_proto_msgTypes[38]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Metric_Label.ProtoReflect.Descriptor instead.
+func (*Metric_Label) Descriptor() ([]byte, []int) {
+	return file_encore_parser_meta_v1_meta_proto_rawDescGZIP(), []int{29, 0}
+}
+
+func (x *Metric_Label) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *Metric_Label) GetType() v1.Builtin {
+	if x != nil {
+		return x.Type
+	}
+	return v1.Builtin(0)
+}
+
+func (x *Metric_Label) GetDoc() string {
+	if x != nil {
+		return x.Doc
+	}
+	return ""
+}
+
+var File_encore_parser_meta_v1_meta_proto protoreflect.FileDescriptor
+
+var file_encore_parser_meta_v1_meta_proto_rawDesc = []byte{
+	0x0a, 0x20, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2f,
+	0x6d, 0x65, 0x74, 0x61, 0x2f, 0x76, 0x31, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x12, 0x15, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65,
+	0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x1a, 0x24, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2f, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2f,
+	0x76, 0x31, 0x2f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
+	0xdc, 0x07, 0x0a, 0x04, 0x44, 0x61, 0x74, 0x61, 0x12, 0x1f, 0x0a, 0x0b, 0x6d, 0x6f, 0x64, 0x75,
+	0x6c, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6d,
+	0x6f, 0x64, 0x75, 0x6c, 0x65, 0x50, 0x61, 0x74, 0x68, 0x12, 0x21, 0x0a, 0x0c, 0x61, 0x70, 0x70,
+	0x5f, 0x72, 0x65, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0b, 0x61, 0x70, 0x70, 0x52, 0x65, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2f, 0x0a, 0x13,
+	0x75, 0x6e, 0x63, 0x6f, 0x6d, 0x6d, 0x69, 0x74, 0x74, 0x65, 0x64, 0x5f, 0x63, 0x68, 0x61, 0x6e,
+	0x67, 0x65, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x12, 0x75, 0x6e, 0x63, 0x6f, 0x6d,
+	0x6d, 0x69, 0x74, 0x74, 0x65, 0x64, 0x43, 0x68, 0x61, 0x6e, 0x67, 0x65, 0x73, 0x12, 0x33, 0x0a,
+	0x05, 0x64, 0x65, 0x63, 0x6c, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65, 0x63, 0x6c, 0x52, 0x05, 0x64, 0x65, 0x63,
+	0x6c, 0x73, 0x12, 0x32, 0x0a, 0x04, 0x70, 0x6b, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72,
+	0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65,
+	0x52, 0x04, 0x70, 0x6b, 0x67, 0x73, 0x12, 0x32, 0x0a, 0x04, 0x73, 0x76, 0x63, 0x73, 0x18, 0x05,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x52, 0x04, 0x73, 0x76, 0x63, 0x73, 0x12, 0x4a, 0x0a, 0x0c, 0x61, 0x75,
+	0x74, 0x68, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72,
+	0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e,
+	0x64, 0x6c, 0x65, 0x72, 0x48, 0x00, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e, 0x64,
+	0x6c, 0x65, 0x72, 0x88, 0x01, 0x01, 0x12, 0x3b, 0x0a, 0x09, 0x63, 0x72, 0x6f, 0x6e, 0x5f, 0x6a,
+	0x6f, 0x62, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76,
+	0x31, 0x2e, 0x43, 0x72, 0x6f, 0x6e, 0x4a, 0x6f, 0x62, 0x52, 0x08, 0x63, 0x72, 0x6f, 0x6e, 0x4a,
+	0x6f, 0x62, 0x73, 0x12, 0x47, 0x0a, 0x0d, 0x70, 0x75, 0x62, 0x73, 0x75, 0x62, 0x5f, 0x74, 0x6f,
+	0x70, 0x69, 0x63, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e,
+	0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x54, 0x6f, 0x70, 0x69, 0x63, 0x52, 0x0c,
+	0x70, 0x75, 0x62, 0x73, 0x75, 0x62, 0x54, 0x6f, 0x70, 0x69, 0x63, 0x73, 0x12, 0x41, 0x0a, 0x0a,
+	0x6d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x21, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72,
+	0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77,
+	0x61, 0x72, 0x65, 0x52, 0x0a, 0x6d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x12,
+	0x4a, 0x0a, 0x0e, 0x63, 0x61, 0x63, 0x68, 0x65, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72,
+	0x73, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e,
+	0x43, 0x61, 0x63, 0x68, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x0d, 0x63, 0x61,
+	0x63, 0x68, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x12, 0x20, 0x0a, 0x0b, 0x65,
+	0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x0b, 0x65, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x37, 0x0a,
+	0x07, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d,
+	0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x52, 0x07, 0x6d,
+	0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x12, 0x47, 0x0a, 0x0d, 0x73, 0x71, 0x6c, 0x5f, 0x64, 0x61,
+	0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65,
+	0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x51, 0x4c, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73,
+	0x65, 0x52, 0x0c, 0x73, 0x71, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x73, 0x12,
+	0x3a, 0x0a, 0x08, 0x67, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x73, 0x18, 0x0f, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65,
+	0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61,
+	0x79, 0x52, 0x08, 0x67, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x73, 0x12, 0x37, 0x0a, 0x08, 0x6c,
+	0x61, 0x6e, 0x67, 0x75, 0x61, 0x67, 0x65, 0x18, 0x10, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1b, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65,
+	0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x61, 0x6e, 0x67, 0x52, 0x08, 0x6c, 0x61, 0x6e, 0x67,
+	0x75, 0x61, 0x67, 0x65, 0x12, 0x37, 0x0a, 0x07, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x18,
+	0x11, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70,
+	0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75,
+	0x63, 0x6b, 0x65, 0x74, 0x52, 0x07, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x42, 0x0f, 0x0a,
+	0x0d, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x22, 0x35,
+	0x0a, 0x0d, 0x51, 0x75, 0x61, 0x6c, 0x69, 0x66, 0x69, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x12,
+	0x10, 0x0a, 0x03, 0x70, 0x6b, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x70, 0x6b,
+	0x67, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0x8d, 0x02, 0x0a, 0x07, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67,
+	0x65, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x65, 0x6c, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x72, 0x65, 0x6c, 0x50, 0x61, 0x74, 0x68, 0x12, 0x12, 0x0a, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65,
+	0x12, 0x10, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64,
+	0x6f, 0x63, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x73,
+	0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x73, 0x12,
+	0x41, 0x0a, 0x09, 0x72, 0x70, 0x63, 0x5f, 0x63, 0x61, 0x6c, 0x6c, 0x73, 0x18, 0x06, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73,
+	0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x51, 0x75, 0x61, 0x6c, 0x69,
+	0x66, 0x69, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x52, 0x08, 0x72, 0x70, 0x63, 0x43, 0x61, 0x6c,
+	0x6c, 0x73, 0x12, 0x41, 0x0a, 0x0b, 0x74, 0x72, 0x61, 0x63, 0x65, 0x5f, 0x6e, 0x6f, 0x64, 0x65,
+	0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e,
+	0x54, 0x72, 0x61, 0x63, 0x65, 0x4e, 0x6f, 0x64, 0x65, 0x52, 0x0a, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x4e, 0x6f, 0x64, 0x65, 0x73, 0x22, 0xa7, 0x02, 0x0a, 0x07, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x65, 0x6c, 0x5f, 0x70, 0x61, 0x74,
+	0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x72, 0x65, 0x6c, 0x50, 0x61, 0x74, 0x68,
+	0x12, 0x2e, 0x0a, 0x04, 0x72, 0x70, 0x63, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d,
+	0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x52, 0x04, 0x72, 0x70, 0x63, 0x73,
+	0x12, 0x42, 0x0a, 0x0a, 0x6d, 0x69, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x42, 0x4d,
+	0x69, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x6d, 0x69, 0x67, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65,
+	0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73,
+	0x65, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x68, 0x61, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x68, 0x61, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x12, 0x3c, 0x0a, 0x07, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x18, 0x07, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73,
+	0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65,
+	0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x07, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x22,
+	0xd8, 0x02, 0x0a, 0x0b, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12,
+	0x16, 0x0a, 0x06, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x06, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x12, 0x4c, 0x0a, 0x0a, 0x6f, 0x70, 0x65, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0e, 0x32, 0x2c, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61,
+	0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x2e,
+	0x4f, 0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x6f, 0x70, 0x65, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xe2, 0x01, 0x0a, 0x09, 0x4f, 0x70, 0x65, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00,
+	0x12, 0x10, 0x0a, 0x0c, 0x4c, 0x49, 0x53, 0x54, 0x5f, 0x4f, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x53,
+	0x10, 0x01, 0x12, 0x18, 0x0a, 0x14, 0x52, 0x45, 0x41, 0x44, 0x5f, 0x4f, 0x42, 0x4a, 0x45, 0x43,
+	0x54, 0x5f, 0x43, 0x4f, 0x4e, 0x54, 0x45, 0x4e, 0x54, 0x53, 0x10, 0x02, 0x12, 0x10, 0x0a, 0x0c,
+	0x57, 0x52, 0x49, 0x54, 0x45, 0x5f, 0x4f, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x10, 0x03, 0x12, 0x1a,
+	0x0a, 0x16, 0x55, 0x50, 0x44, 0x41, 0x54, 0x45, 0x5f, 0x4f, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f,
+	0x4d, 0x45, 0x54, 0x41, 0x44, 0x41, 0x54, 0x41, 0x10, 0x04, 0x12, 0x17, 0x0a, 0x13, 0x47, 0x45,
+	0x54, 0x5f, 0x4f, 0x42, 0x4a, 0x45, 0x43, 0x54, 0x5f, 0x4d, 0x45, 0x54, 0x41, 0x44, 0x41, 0x54,
+	0x41, 0x10, 0x05, 0x12, 0x11, 0x0a, 0x0d, 0x44, 0x45, 0x4c, 0x45, 0x54, 0x45, 0x5f, 0x4f, 0x42,
+	0x4a, 0x45, 0x43, 0x54, 0x10, 0x06, 0x12, 0x12, 0x0a, 0x0e, 0x47, 0x45, 0x54, 0x5f, 0x50, 0x55,
+	0x42, 0x4c, 0x49, 0x43, 0x5f, 0x55, 0x52, 0x4c, 0x10, 0x07, 0x12, 0x15, 0x0a, 0x11, 0x53, 0x49,
+	0x47, 0x4e, 0x45, 0x44, 0x5f, 0x55, 0x50, 0x4c, 0x4f, 0x41, 0x44, 0x5f, 0x55, 0x52, 0x4c, 0x10,
+	0x08, 0x12, 0x17, 0x0a, 0x13, 0x53, 0x49, 0x47, 0x4e, 0x45, 0x44, 0x5f, 0x44, 0x4f, 0x57, 0x4e,
+	0x4c, 0x4f, 0x41, 0x44, 0x5f, 0x55, 0x52, 0x4c, 0x10, 0x09, 0x22, 0x81, 0x01, 0x0a, 0x08, 0x53,
+	0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x12, 0x38, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70,
+	0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65,
+	0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x25, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12,
+	0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03,
+	0x41, 0x4c, 0x4c, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x41, 0x47, 0x10, 0x02, 0x22, 0xca,
+	0x0b, 0x0a, 0x03, 0x52, 0x50, 0x43, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x15, 0x0a, 0x03, 0x64, 0x6f,
+	0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x88, 0x01,
+	0x01, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x46, 0x0a, 0x0b, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x74,
+	0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76,
+	0x31, 0x2e, 0x52, 0x50, 0x43, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x79, 0x70, 0x65,
+	0x52, 0x0a, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x79, 0x70, 0x65, 0x12, 0x49, 0x0a, 0x0e,
+	0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54,
+	0x79, 0x70, 0x65, 0x48, 0x01, 0x52, 0x0d, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x53, 0x63,
+	0x68, 0x65, 0x6d, 0x61, 0x88, 0x01, 0x01, 0x12, 0x4b, 0x0a, 0x0f, 0x72, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72,
+	0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x48,
+	0x02, 0x52, 0x0e, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x53, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x88, 0x01, 0x01, 0x12, 0x39, 0x0a, 0x05, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x18, 0x07, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x23, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72,
+	0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x2e,
+	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c, 0x52, 0x05, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
+	0x2e, 0x0a, 0x03, 0x6c, 0x6f, 0x63, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x63, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x12,
+	0x2f, 0x0a, 0x04, 0x70, 0x61, 0x74, 0x68, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65,
+	0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68,
+	0x12, 0x21, 0x0a, 0x0c, 0x68, 0x74, 0x74, 0x70, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73,
+	0x18, 0x0a, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0b, 0x68, 0x74, 0x74, 0x70, 0x4d, 0x65, 0x74, 0x68,
+	0x6f, 0x64, 0x73, 0x12, 0x33, 0x0a, 0x04, 0x74, 0x61, 0x67, 0x73, 0x18, 0x0b, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65,
+	0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74,
+	0x6f, 0x72, 0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x65, 0x6e, 0x73,
+	0x69, 0x74, 0x69, 0x76, 0x65, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x73, 0x65, 0x6e,
+	0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x12, 0x33, 0x0a, 0x15, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f,
+	0x75, 0x6e, 0x61, 0x75, 0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x18,
+	0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x55, 0x6e, 0x61, 0x75,
+	0x74, 0x68, 0x65, 0x6e, 0x74, 0x69, 0x63, 0x61, 0x74, 0x65, 0x64, 0x12, 0x3e, 0x0a, 0x06, 0x65,
+	0x78, 0x70, 0x6f, 0x73, 0x65, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61,
+	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x06, 0x65, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x12, 0x22, 0x0a, 0x0a, 0x62,
+	0x6f, 0x64, 0x79, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x04, 0x48,
+	0x03, 0x52, 0x09, 0x62, 0x6f, 0x64, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x88, 0x01, 0x01, 0x12,
+	0x2b, 0x0a, 0x11, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x18, 0x10, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x73, 0x74, 0x72, 0x65,
+	0x61, 0x6d, 0x69, 0x6e, 0x67, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x12,
+	0x73, 0x74, 0x72, 0x65, 0x61, 0x6d, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x18, 0x11, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x73, 0x74, 0x72, 0x65, 0x61, 0x6d,
+	0x69, 0x6e, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4d, 0x0a, 0x10, 0x68,
+	0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b, 0x65, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x18,
+	0x12, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70,
+	0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e,
+	0x54, 0x79, 0x70, 0x65, 0x48, 0x04, 0x52, 0x0f, 0x68, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61, 0x6b,
+	0x65, 0x53, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x88, 0x01, 0x01, 0x12, 0x51, 0x0a, 0x0d, 0x73, 0x74,
+	0x61, 0x74, 0x69, 0x63, 0x5f, 0x61, 0x73, 0x73, 0x65, 0x74, 0x73, 0x18, 0x13, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x27, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65,
+	0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x2e, 0x53, 0x74,
+	0x61, 0x74, 0x69, 0x63, 0x41, 0x73, 0x73, 0x65, 0x74, 0x73, 0x48, 0x05, 0x52, 0x0c, 0x73, 0x74,
+	0x61, 0x74, 0x69, 0x63, 0x41, 0x73, 0x73, 0x65, 0x74, 0x73, 0x88, 0x01, 0x01, 0x1a, 0x63, 0x0a,
+	0x0b, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x3e,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65,
+	0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x2e, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65,
+	0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
+	0x38, 0x01, 0x1a, 0x0f, 0x0a, 0x0d, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x4f, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x1a, 0xbd, 0x01, 0x0a, 0x0c, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x41, 0x73,
+	0x73, 0x65, 0x74, 0x73, 0x12, 0x20, 0x0a, 0x0c, 0x64, 0x69, 0x72, 0x5f, 0x72, 0x65, 0x6c, 0x5f,
+	0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x64, 0x69, 0x72, 0x52,
+	0x65, 0x6c, 0x50, 0x61, 0x74, 0x68, 0x12, 0x30, 0x0a, 0x12, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f,
+	0x75, 0x6e, 0x64, 0x5f, 0x72, 0x65, 0x6c, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x48, 0x00, 0x52, 0x0f, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x52, 0x65,
+	0x6c, 0x50, 0x61, 0x74, 0x68, 0x88, 0x01, 0x01, 0x12, 0x2d, 0x0a, 0x10, 0x6e, 0x6f, 0x74, 0x5f,
+	0x66, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0d, 0x48, 0x01, 0x52, 0x0e, 0x6e, 0x6f, 0x74, 0x46, 0x6f, 0x75, 0x6e, 0x64, 0x53, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x88, 0x01, 0x01, 0x42, 0x15, 0x0a, 0x13, 0x5f, 0x6e, 0x6f, 0x74, 0x5f,
+	0x66, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x72, 0x65, 0x6c, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x42, 0x13,
+	0x0a, 0x11, 0x5f, 0x6e, 0x6f, 0x74, 0x5f, 0x66, 0x6f, 0x75, 0x6e, 0x64, 0x5f, 0x73, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x22, 0x2f, 0x0a, 0x0a, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x79, 0x70,
+	0x65, 0x12, 0x0b, 0x0a, 0x07, 0x50, 0x52, 0x49, 0x56, 0x41, 0x54, 0x45, 0x10, 0x00, 0x12, 0x0a,
+	0x0a, 0x06, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x41, 0x55,
+	0x54, 0x48, 0x10, 0x02, 0x22, 0x20, 0x0a, 0x08, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x63, 0x6f, 0x6c,
+	0x12, 0x0b, 0x0a, 0x07, 0x52, 0x45, 0x47, 0x55, 0x4c, 0x41, 0x52, 0x10, 0x00, 0x12, 0x07, 0x0a,
+	0x03, 0x52, 0x41, 0x57, 0x10, 0x01, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x64, 0x6f, 0x63, 0x42, 0x11,
+	0x0a, 0x0f, 0x5f, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x42, 0x12, 0x0a, 0x10, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x5f, 0x73,
+	0x63, 0x68, 0x65, 0x6d, 0x61, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x62, 0x6f, 0x64, 0x79, 0x5f, 0x6c,
+	0x69, 0x6d, 0x69, 0x74, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x73, 0x68, 0x61,
+	0x6b, 0x65, 0x5f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x73, 0x74,
+	0x61, 0x74, 0x69, 0x63, 0x5f, 0x61, 0x73, 0x73, 0x65, 0x74, 0x73, 0x22, 0xd2, 0x02, 0x0a, 0x0b,
+	0x41, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x10, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6f,
+	0x63, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x6b, 0x67, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x6b, 0x67, 0x50, 0x61, 0x74, 0x68, 0x12, 0x19, 0x0a, 0x08,
+	0x70, 0x6b, 0x67, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x70, 0x6b, 0x67, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x2e, 0x0a, 0x03, 0x6c, 0x6f, 0x63, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x4c,
+	0x6f, 0x63, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x12, 0x3f, 0x0a, 0x09, 0x61, 0x75, 0x74, 0x68, 0x5f,
+	0x64, 0x61, 0x74, 0x61, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x48, 0x00, 0x52, 0x08, 0x61, 0x75, 0x74,
+	0x68, 0x44, 0x61, 0x74, 0x61, 0x88, 0x01, 0x01, 0x12, 0x3a, 0x0a, 0x06, 0x70, 0x61, 0x72, 0x61,
+	0x6d, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e,
+	0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x48, 0x01, 0x52, 0x06, 0x70, 0x61, 0x72, 0x61, 0x6d,
+	0x73, 0x88, 0x01, 0x01, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x42, 0x0c, 0x0a, 0x0a, 0x5f, 0x61, 0x75, 0x74, 0x68,
+	0x5f, 0x64, 0x61, 0x74, 0x61, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x73,
+	0x22, 0x92, 0x02, 0x0a, 0x0a, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x12,
+	0x38, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65,
+	0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x51, 0x75, 0x61, 0x6c, 0x69, 0x66, 0x69, 0x65, 0x64, 0x4e,
+	0x61, 0x6d, 0x65, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x6f, 0x63,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x12, 0x2e, 0x0a, 0x03, 0x6c,
+	0x6f, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e,
+	0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x63, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x12, 0x16, 0x0a, 0x06, 0x67,
+	0x6c, 0x6f, 0x62, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06, 0x67, 0x6c, 0x6f,
+	0x62, 0x61, 0x6c, 0x12, 0x26, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0b, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x88, 0x01, 0x01, 0x12, 0x37, 0x0a, 0x06, 0x74,
+	0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61,
+	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x06, 0x74, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x22, 0xa0, 0x08, 0x0a, 0x09, 0x54, 0x72, 0x61, 0x63, 0x65, 0x4e,
+	0x6f, 0x64, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x05, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x70, 0x61, 0x74, 0x68, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x70, 0x61, 0x74, 0x68, 0x12,
+	0x1b, 0x0a, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x70, 0x6f, 0x73, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x05, 0x52, 0x08, 0x73, 0x74, 0x61, 0x72, 0x74, 0x50, 0x6f, 0x73, 0x12, 0x17, 0x0a, 0x07,
+	0x65, 0x6e, 0x64, 0x5f, 0x70, 0x6f, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x65,
+	0x6e, 0x64, 0x50, 0x6f, 0x73, 0x12, 0x24, 0x0a, 0x0e, 0x73, 0x72, 0x63, 0x5f, 0x6c, 0x69, 0x6e,
+	0x65, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0c, 0x73,
+	0x72, 0x63, 0x4c, 0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x20, 0x0a, 0x0c, 0x73,
+	0x72, 0x63, 0x5f, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x0a, 0x73, 0x72, 0x63, 0x4c, 0x69, 0x6e, 0x65, 0x45, 0x6e, 0x64, 0x12, 0x22, 0x0a,
+	0x0d, 0x73, 0x72, 0x63, 0x5f, 0x63, 0x6f, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x08,
+	0x20, 0x01, 0x28, 0x05, 0x52, 0x0b, 0x73, 0x72, 0x63, 0x43, 0x6f, 0x6c, 0x53, 0x74, 0x61, 0x72,
+	0x74, 0x12, 0x1e, 0x0a, 0x0b, 0x73, 0x72, 0x63, 0x5f, 0x63, 0x6f, 0x6c, 0x5f, 0x65, 0x6e, 0x64,
+	0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x73, 0x72, 0x63, 0x43, 0x6f, 0x6c, 0x45, 0x6e,
+	0x64, 0x12, 0x3c, 0x0a, 0x07, 0x72, 0x70, 0x63, 0x5f, 0x64, 0x65, 0x66, 0x18, 0x0a, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73,
+	0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x44, 0x65,
+	0x66, 0x4e, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x06, 0x72, 0x70, 0x63, 0x44, 0x65, 0x66, 0x12,
+	0x3f, 0x0a, 0x08, 0x72, 0x70, 0x63, 0x5f, 0x63, 0x61, 0x6c, 0x6c, 0x18, 0x0b, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65,
+	0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x50, 0x43, 0x43, 0x61, 0x6c,
+	0x6c, 0x4e, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x07, 0x72, 0x70, 0x63, 0x43, 0x61, 0x6c, 0x6c,
+	0x12, 0x48, 0x0a, 0x0b, 0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x5f, 0x63, 0x61, 0x6c, 0x6c, 0x18,
+	0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70,
+	0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x74,
+	0x61, 0x74, 0x69, 0x63, 0x43, 0x61, 0x6c, 0x6c, 0x4e, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x0a,
+	0x73, 0x74, 0x61, 0x74, 0x69, 0x63, 0x43, 0x61, 0x6c, 0x6c, 0x12, 0x55, 0x0a, 0x10, 0x61, 0x75,
+	0x74, 0x68, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x5f, 0x64, 0x65, 0x66, 0x18, 0x0d,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74,
+	0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x44, 0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65, 0x48,
+	0x00, 0x52, 0x0e, 0x61, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x44, 0x65,
+	0x66, 0x12, 0x55, 0x0a, 0x10, 0x70, 0x75, 0x62, 0x73, 0x75, 0x62, 0x5f, 0x74, 0x6f, 0x70, 0x69,
+	0x63, 0x5f, 0x64, 0x65, 0x66, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61,
+	0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x54, 0x6f, 0x70, 0x69, 0x63, 0x44,
+	0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x0e, 0x70, 0x75, 0x62, 0x73, 0x75, 0x62,
+	0x54, 0x6f, 0x70, 0x69, 0x63, 0x44, 0x65, 0x66, 0x12, 0x51, 0x0a, 0x0e, 0x70, 0x75, 0x62, 0x73,
+	0x75, 0x62, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72,
+	0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x50,
+	0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x4e, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x0d, 0x70, 0x75,
+	0x62, 0x73, 0x75, 0x62, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x12, 0x5a, 0x0a, 0x11, 0x70,
+	0x75, 0x62, 0x73, 0x75, 0x62, 0x5f, 0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x62, 0x65, 0x72,
+	0x18, 0x10, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x50,
+	0x75, 0x62, 0x53, 0x75, 0x62, 0x53, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x62, 0x65, 0x72, 0x4e,
+	0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x10, 0x70, 0x75, 0x62, 0x73, 0x75, 0x62, 0x53, 0x75, 0x62,
+	0x73, 0x63, 0x72, 0x69, 0x62, 0x65, 0x72, 0x12, 0x4b, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x5f, 0x69, 0x6e, 0x69, 0x74, 0x18, 0x11, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65,
+	0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69,
+	0x74, 0x4e, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x49, 0x6e, 0x69, 0x74, 0x12, 0x51, 0x0a, 0x0e, 0x6d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61,
+	0x72, 0x65, 0x5f, 0x64, 0x65, 0x66, 0x18, 0x12, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74,
+	0x61, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x69, 0x64, 0x64, 0x6c, 0x65, 0x77, 0x61, 0x72, 0x65, 0x44,
+	0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x0d, 0x6d, 0x69, 0x64, 0x64, 0x6c, 0x65,
+	0x77, 0x61, 0x72, 0x65, 0x44, 0x65, 0x66, 0x12, 0x54, 0x0a, 0x0e, 0x63, 0x61, 0x63, 0x68, 0x65,
+	0x5f, 0x6b, 0x65, 0x79, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x13, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x2b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e,
+	0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x61, 0x63, 0x68, 0x65, 0x4b, 0x65, 0x79,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x44, 0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65, 0x48, 0x00, 0x52, 0x0d,
+	0x63, 0x61, 0x63, 0x68, 0x65, 0x4b, 0x65, 0x79, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x09, 0x0a,
+	0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x22, 0x64, 0x0a, 0x0a, 0x52, 0x50, 0x43, 0x44,
+	0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x70, 0x63,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x72, 0x70, 0x63,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x22, 0x65,
+	0x0a, 0x0b, 0x52, 0x50, 0x43, 0x43, 0x61, 0x6c, 0x6c, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x21, 0x0a,
+	0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65,
+	0x12, 0x19, 0x0a, 0x08, 0x72, 0x70, 0x63, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x72, 0x70, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63,
+	0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f,
+	0x6e, 0x74, 0x65, 0x78, 0x74, 0x22, 0xb4, 0x01, 0x0a, 0x0e, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63,
+	0x43, 0x61, 0x6c, 0x6c, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x47, 0x0a, 0x07, 0x70, 0x61, 0x63, 0x6b,
+	0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2d, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76,
+	0x31, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x69, 0x63, 0x43, 0x61, 0x6c, 0x6c, 0x4e, 0x6f, 0x64, 0x65,
+	0x2e, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x52, 0x07, 0x70, 0x61, 0x63, 0x6b, 0x61, 0x67,
+	0x65, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x75, 0x6e, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x66, 0x75, 0x6e, 0x63, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x22,
+	0x2b, 0x0a, 0x07, 0x50, 0x61, 0x63, 0x6b, 0x61, 0x67, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e,
+	0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x53, 0x51, 0x4c, 0x44, 0x42,
+	0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x52, 0x4c, 0x4f, 0x47, 0x10, 0x02, 0x22, 0x65, 0x0a, 0x12,
+	0x41, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x44, 0x65, 0x66, 0x4e, 0x6f,
+	0x64, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6e,
+	0x74, 0x65, 0x78, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74,
+	0x65, 0x78, 0x74, 0x22, 0x4d, 0x0a, 0x12, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x54, 0x6f, 0x70,
+	0x69, 0x63, 0x44, 0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x70,
+	0x69, 0x63, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74,
+	0x6f, 0x70, 0x69, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74,
+	0x65, 0x78, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65,
+	0x78, 0x74, 0x22, 0x4c, 0x0a, 0x11, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x50, 0x75, 0x62, 0x6c,
+	0x69, 0x73, 0x68, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x70, 0x69, 0x63,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74, 0x6f, 0x70,
+	0x69, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78,
+	0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74,
+	0x22, 0x9b, 0x01, 0x0a, 0x14, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x53, 0x75, 0x62, 0x73, 0x63,
+	0x72, 0x69, 0x62, 0x65, 0x72, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x6f, 0x70,
+	0x69, 0x63, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x74,
+	0x6f, 0x70, 0x69, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x73, 0x75, 0x62, 0x73,
+	0x63, 0x72, 0x69, 0x62, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0e, 0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x62, 0x65, 0x72, 0x4e, 0x61, 0x6d,
+	0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x22, 0x76,
+	0x0a, 0x0f, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x49, 0x6e, 0x69, 0x74, 0x4e, 0x6f, 0x64,
+	0x65, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x26, 0x0a, 0x0f, 0x73, 0x65, 0x74, 0x75, 0x70, 0x5f, 0x66, 0x75,
+	0x6e, 0x63, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x73,
+	0x65, 0x74, 0x75, 0x70, 0x46, 0x75, 0x6e, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07,
+	0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63,
+	0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x22, 0x9c, 0x01, 0x0a, 0x11, 0x4d, 0x69, 0x64, 0x64, 0x6c,
+	0x65, 0x77, 0x61, 0x72, 0x65, 0x44, 0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x20, 0x0a, 0x0c,
+	0x70, 0x6b, 0x67, 0x5f, 0x72, 0x65, 0x6c, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0a, 0x70, 0x6b, 0x67, 0x52, 0x65, 0x6c, 0x50, 0x61, 0x74, 0x68, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x12, 0x37, 0x0a, 0x06,
+	0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74,
+	0x61, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x6c, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x52, 0x06, 0x74,
+	0x61, 0x72, 0x67, 0x65, 0x74, 0x22, 0x90, 0x01, 0x0a, 0x14, 0x43, 0x61, 0x63, 0x68, 0x65, 0x4b,
+	0x65, 0x79, 0x73, 0x70, 0x61, 0x63, 0x65, 0x44, 0x65, 0x66, 0x4e, 0x6f, 0x64, 0x65, 0x12, 0x20,
+	0x0a, 0x0c, 0x70, 0x6b, 0x67, 0x5f, 0x72, 0x65, 0x6c, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x6b, 0x67, 0x52, 0x65, 0x6c, 0x50, 0x61, 0x74, 0x68,
+	0x12, 0x19, 0x0a, 0x08, 0x76, 0x61, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x76, 0x61, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x21, 0x0a, 0x0c, 0x63,
+	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0b, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x18,
+	0x0a, 0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x07, 0x63, 0x6f, 0x6e, 0x74, 0x65, 0x78, 0x74, 0x22, 0xa1, 0x01, 0x0a, 0x04, 0x50, 0x61, 0x74,
+	0x68, 0x12, 0x3e, 0x0a, 0x08, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72,
+	0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x61, 0x74, 0x68,
+	0x53, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x52, 0x08, 0x73, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74,
+	0x73, 0x12, 0x34, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e,
+	0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x2e, 0x54, 0x79, 0x70,
+	0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x23, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12,
+	0x07, 0x0a, 0x03, 0x55, 0x52, 0x4c, 0x10, 0x00, 0x12, 0x12, 0x0a, 0x0e, 0x43, 0x41, 0x43, 0x48,
+	0x45, 0x5f, 0x4b, 0x45, 0x59, 0x53, 0x50, 0x41, 0x43, 0x45, 0x10, 0x01, 0x22, 0xef, 0x03, 0x0a,
+	0x0b, 0x50, 0x61, 0x74, 0x68, 0x53, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x42, 0x0a, 0x04,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2e, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e,
+	0x76, 0x31, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x53, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x53,
+	0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65,
+	0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x4b, 0x0a, 0x0a, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2c, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e,
+	0x76, 0x31, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x53, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x50,
+	0x61, 0x72, 0x61, 0x6d, 0x54, 0x79, 0x70, 0x65, 0x52, 0x09, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x54,
+	0x79, 0x70, 0x65, 0x12, 0x4c, 0x0a, 0x0a, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76,
+	0x31, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x72,
+	0x48, 0x00, 0x52, 0x0a, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x88, 0x01,
+	0x01, 0x22, 0x41, 0x0a, 0x0b, 0x53, 0x65, 0x67, 0x6d, 0x65, 0x6e, 0x74, 0x54, 0x79, 0x70, 0x65,
+	0x12, 0x0b, 0x0a, 0x07, 0x4c, 0x49, 0x54, 0x45, 0x52, 0x41, 0x4c, 0x10, 0x00, 0x12, 0x09, 0x0a,
+	0x05, 0x50, 0x41, 0x52, 0x41, 0x4d, 0x10, 0x01, 0x12, 0x0c, 0x0a, 0x08, 0x57, 0x49, 0x4c, 0x44,
+	0x43, 0x41, 0x52, 0x44, 0x10, 0x02, 0x12, 0x0c, 0x0a, 0x08, 0x46, 0x41, 0x4c, 0x4c, 0x42, 0x41,
+	0x43, 0x4b, 0x10, 0x03, 0x22, 0x98, 0x01, 0x0a, 0x09, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x54, 0x79,
+	0x70, 0x65, 0x12, 0x0a, 0x0a, 0x06, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x00, 0x12, 0x08,
+	0x0a, 0x04, 0x42, 0x4f, 0x4f, 0x4c, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x4e, 0x54, 0x38,
+	0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x49, 0x4e, 0x54, 0x31, 0x36, 0x10, 0x03, 0x12, 0x09, 0x0a,
+	0x05, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x04, 0x12, 0x09, 0x0a, 0x05, 0x49, 0x4e, 0x54, 0x36,
+	0x34, 0x10, 0x05, 0x12, 0x07, 0x0a, 0x03, 0x49, 0x4e, 0x54, 0x10, 0x06, 0x12, 0x09, 0x0a, 0x05,
+	0x55, 0x49, 0x4e, 0x54, 0x38, 0x10, 0x07, 0x12, 0x0a, 0x0a, 0x06, 0x55, 0x49, 0x4e, 0x54, 0x31,
+	0x36, 0x10, 0x08, 0x12, 0x0a, 0x0a, 0x06, 0x55, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x09, 0x12,
+	0x0a, 0x0a, 0x06, 0x55, 0x49, 0x4e, 0x54, 0x36, 0x34, 0x10, 0x0a, 0x12, 0x08, 0x0a, 0x04, 0x55,
+	0x49, 0x4e, 0x54, 0x10, 0x0b, 0x12, 0x08, 0x0a, 0x04, 0x55, 0x55, 0x49, 0x44, 0x10, 0x0c, 0x42,
+	0x0d, 0x0a, 0x0b, 0x5f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x8e,
+	0x02, 0x0a, 0x07, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0a, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x48, 0x0a, 0x08, 0x65,
+	0x78, 0x70, 0x6c, 0x69, 0x63, 0x69, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65,
+	0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x2e, 0x45, 0x78,
+	0x70, 0x6c, 0x69, 0x63, 0x69, 0x74, 0x48, 0x00, 0x52, 0x08, 0x65, 0x78, 0x70, 0x6c, 0x69, 0x63,
+	0x69, 0x74, 0x88, 0x01, 0x01, 0x1a, 0x8a, 0x01, 0x0a, 0x08, 0x45, 0x78, 0x70, 0x6c, 0x69, 0x63,
+	0x69, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x4a, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x68, 0x61,
+	0x6e, 0x64, 0x6c, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61,
+	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x48,
+	0x00, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x88, 0x01,
+	0x01, 0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x6c,
+	0x65, 0x72, 0x42, 0x0b, 0x0a, 0x09, 0x5f, 0x65, 0x78, 0x70, 0x6c, 0x69, 0x63, 0x69, 0x74, 0x22,
+	0xac, 0x01, 0x0a, 0x07, 0x43, 0x72, 0x6f, 0x6e, 0x4a, 0x6f, 0x62, 0x12, 0x0e, 0x0a, 0x02, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x74,
+	0x69, 0x74, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x69, 0x74, 0x6c,
+	0x65, 0x12, 0x15, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00,
+	0x52, 0x03, 0x64, 0x6f, 0x63, 0x88, 0x01, 0x01, 0x12, 0x1a, 0x0a, 0x08, 0x73, 0x63, 0x68, 0x65,
+	0x64, 0x75, 0x6c, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x73, 0x63, 0x68, 0x65,
+	0x64, 0x75, 0x6c, 0x65, 0x12, 0x40, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x51,
+	0x75, 0x61, 0x6c, 0x69, 0x66, 0x69, 0x65, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x52, 0x08, 0x65, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x64, 0x6f, 0x63, 0x22, 0x95,
+	0x02, 0x0a, 0x0b, 0x53, 0x51, 0x4c, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x15, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48,
+	0x00, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x88, 0x01, 0x01, 0x12, 0x31, 0x0a, 0x12, 0x6d, 0x69, 0x67,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65, 0x6c, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x10, 0x6d, 0x69, 0x67, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x52, 0x65, 0x6c, 0x50, 0x61, 0x74, 0x68, 0x88, 0x01, 0x01, 0x12, 0x42, 0x0a, 0x0a,
+	0x6d, 0x69, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72,
+	0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x42, 0x4d, 0x69, 0x67, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0a, 0x6d, 0x69, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x12, 0x45, 0x0a, 0x1f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x6e, 0x6f, 0x6e, 0x5f, 0x73, 0x65,
+	0x71, 0x75, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x5f, 0x6d, 0x69, 0x67, 0x72, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x1c, 0x61, 0x6c, 0x6c, 0x6f, 0x77,
+	0x4e, 0x6f, 0x6e, 0x53, 0x65, 0x71, 0x75, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x4d, 0x69, 0x67,
+	0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x64, 0x6f, 0x63, 0x42,
+	0x15, 0x0a, 0x13, 0x5f, 0x6d, 0x69, 0x67, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x72, 0x65,
+	0x6c, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x22, 0x63, 0x0a, 0x0b, 0x44, 0x42, 0x4d, 0x69, 0x67, 0x72,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d,
+	0x65, 0x12, 0x16, 0x0a, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x06, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x20, 0x0a, 0x0b, 0x64, 0x65, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b,
+	0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x71, 0x0a, 0x06, 0x42,
+	0x75, 0x63, 0x6b, 0x65, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x15, 0x0a, 0x03, 0x64, 0x6f, 0x63,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x88, 0x01, 0x01,
+	0x12, 0x1c, 0x0a, 0x09, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x64, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x09, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x64, 0x12, 0x16,
+	0x0a, 0x06, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x06,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x64, 0x6f, 0x63, 0x22, 0xb8,
+	0x07, 0x0a, 0x0b, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x54, 0x6f, 0x70, 0x69, 0x63, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x15, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48,
+	0x00, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x88, 0x01, 0x01, 0x12, 0x40, 0x0a, 0x0c, 0x6d, 0x65, 0x73,
+	0x73, 0x61, 0x67, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e,
+	0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x0b,
+	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x63, 0x0a, 0x12, 0x64,
+	0x65, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x79, 0x5f, 0x67, 0x75, 0x61, 0x72, 0x61, 0x6e, 0x74, 0x65,
+	0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x34, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e,
+	0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x54, 0x6f, 0x70, 0x69, 0x63, 0x2e, 0x44, 0x65, 0x6c, 0x69,
+	0x76, 0x65, 0x72, 0x79, 0x47, 0x75, 0x61, 0x72, 0x61, 0x6e, 0x74, 0x65, 0x65, 0x52, 0x11, 0x64,
+	0x65, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x79, 0x47, 0x75, 0x61, 0x72, 0x61, 0x6e, 0x74, 0x65, 0x65,
+	0x12, 0x21, 0x0a, 0x0c, 0x6f, 0x72, 0x64, 0x65, 0x72, 0x69, 0x6e, 0x67, 0x5f, 0x6b, 0x65, 0x79,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x6f, 0x72, 0x64, 0x65, 0x72, 0x69, 0x6e, 0x67,
+	0x4b, 0x65, 0x79, 0x12, 0x4c, 0x0a, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x65, 0x72,
+	0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e,
+	0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x54, 0x6f, 0x70, 0x69, 0x63, 0x2e, 0x50, 0x75, 0x62, 0x6c,
+	0x69, 0x73, 0x68, 0x65, 0x72, 0x52, 0x0a, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x65, 0x72,
+	0x73, 0x12, 0x55, 0x0a, 0x0d, 0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31,
+	0x2e, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x54, 0x6f, 0x70, 0x69, 0x63, 0x2e, 0x53, 0x75, 0x62,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0d, 0x73, 0x75, 0x62, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x2e, 0x0a, 0x09, 0x50, 0x75, 0x62, 0x6c,
+	0x69, 0x73, 0x68, 0x65, 0x72, 0x12, 0x21, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x1a, 0xaa, 0x02, 0x0a, 0x0c, 0x53, 0x75, 0x62,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x21, 0x0a,
+	0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0b, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65,
+	0x12, 0x21, 0x0a, 0x0c, 0x61, 0x63, 0x6b, 0x5f, 0x64, 0x65, 0x61, 0x64, 0x6c, 0x69, 0x6e, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x61, 0x63, 0x6b, 0x44, 0x65, 0x61, 0x64, 0x6c,
+	0x69, 0x6e, 0x65, 0x12, 0x2b, 0x0a, 0x11, 0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x5f, 0x72,
+	0x65, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10,
+	0x6d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x74, 0x65, 0x6e, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x51, 0x0a, 0x0c, 0x72, 0x65, 0x74, 0x72, 0x79, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x50,
+	0x75, 0x62, 0x53, 0x75, 0x62, 0x54, 0x6f, 0x70, 0x69, 0x63, 0x2e, 0x52, 0x65, 0x74, 0x72, 0x79,
+	0x50, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x52, 0x0b, 0x72, 0x65, 0x74, 0x72, 0x79, 0x50, 0x6f, 0x6c,
+	0x69, 0x63, 0x79, 0x12, 0x2c, 0x0a, 0x0f, 0x6d, 0x61, 0x78, 0x5f, 0x63, 0x6f, 0x6e, 0x63, 0x75,
+	0x72, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x48, 0x00, 0x52, 0x0e,
+	0x6d, 0x61, 0x78, 0x43, 0x6f, 0x6e, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x63, 0x79, 0x88, 0x01,
+	0x01, 0x42, 0x12, 0x0a, 0x10, 0x5f, 0x6d, 0x61, 0x78, 0x5f, 0x63, 0x6f, 0x6e, 0x63, 0x75, 0x72,
+	0x72, 0x65, 0x6e, 0x63, 0x79, 0x1a, 0x70, 0x0a, 0x0b, 0x52, 0x65, 0x74, 0x72, 0x79, 0x50, 0x6f,
+	0x6c, 0x69, 0x63, 0x79, 0x12, 0x1f, 0x0a, 0x0b, 0x6d, 0x69, 0x6e, 0x5f, 0x62, 0x61, 0x63, 0x6b,
+	0x6f, 0x66, 0x66, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x6d, 0x69, 0x6e, 0x42, 0x61,
+	0x63, 0x6b, 0x6f, 0x66, 0x66, 0x12, 0x1f, 0x0a, 0x0b, 0x6d, 0x61, 0x78, 0x5f, 0x62, 0x61, 0x63,
+	0x6b, 0x6f, 0x66, 0x66, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x6d, 0x61, 0x78, 0x42,
+	0x61, 0x63, 0x6b, 0x6f, 0x66, 0x66, 0x12, 0x1f, 0x0a, 0x0b, 0x6d, 0x61, 0x78, 0x5f, 0x72, 0x65,
+	0x74, 0x72, 0x69, 0x65, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x6d, 0x61, 0x78,
+	0x52, 0x65, 0x74, 0x72, 0x69, 0x65, 0x73, 0x22, 0x38, 0x0a, 0x11, 0x44, 0x65, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x79, 0x47, 0x75, 0x61, 0x72, 0x61, 0x6e, 0x74, 0x65, 0x65, 0x12, 0x11, 0x0a, 0x0d,
+	0x41, 0x54, 0x5f, 0x4c, 0x45, 0x41, 0x53, 0x54, 0x5f, 0x4f, 0x4e, 0x43, 0x45, 0x10, 0x00, 0x12,
+	0x10, 0x0a, 0x0c, 0x45, 0x58, 0x41, 0x43, 0x54, 0x4c, 0x59, 0x5f, 0x4f, 0x4e, 0x43, 0x45, 0x10,
+	0x01, 0x42, 0x06, 0x0a, 0x04, 0x5f, 0x64, 0x6f, 0x63, 0x22, 0x9a, 0x03, 0x0a, 0x0c, 0x43, 0x61,
+	0x63, 0x68, 0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x10,
+	0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6f, 0x63,
+	0x12, 0x4a, 0x0a, 0x09, 0x6b, 0x65, 0x79, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72,
+	0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x61, 0x63, 0x68,
+	0x65, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2e, 0x4b, 0x65, 0x79, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x52, 0x09, 0x6b, 0x65, 0x79, 0x73, 0x70, 0x61, 0x63, 0x65, 0x73, 0x12, 0x27, 0x0a, 0x0f,
+	0x65, 0x76, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x70, 0x6f, 0x6c, 0x69, 0x63, 0x79, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x65, 0x76, 0x69, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x50,
+	0x6f, 0x6c, 0x69, 0x63, 0x79, 0x1a, 0xee, 0x01, 0x0a, 0x08, 0x4b, 0x65, 0x79, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x12, 0x38, 0x0a, 0x08, 0x6b, 0x65, 0x79, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54,
+	0x79, 0x70, 0x65, 0x52, 0x07, 0x6b, 0x65, 0x79, 0x54, 0x79, 0x70, 0x65, 0x12, 0x3c, 0x0a, 0x0a,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72,
+	0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52,
+	0x09, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x12, 0x3e, 0x0a, 0x0c, 0x70, 0x61, 0x74, 0x68, 0x5f, 0x70,
+	0x61, 0x74, 0x74, 0x65, 0x72, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1b, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74,
+	0x61, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x61, 0x74, 0x68, 0x52, 0x0b, 0x70, 0x61, 0x74, 0x68, 0x50,
+	0x61, 0x74, 0x74, 0x65, 0x72, 0x6e, 0x22, 0xbb, 0x03, 0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69,
+	0x63, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3f, 0x0a, 0x0a, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x5f, 0x74,
+	0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61,
+	0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75, 0x69, 0x6c, 0x74, 0x69, 0x6e, 0x52, 0x09, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x12, 0x3c, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x4d,
+	0x65, 0x74, 0x72, 0x69, 0x63, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x4b, 0x69, 0x6e, 0x64,
+	0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x26, 0x0a, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0b,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x88, 0x01, 0x01, 0x12, 0x3b,
+	0x0a, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d,
+	0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x2e, 0x4c, 0x61,
+	0x62, 0x65, 0x6c, 0x52, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x1a, 0x61, 0x0a, 0x05, 0x4c,
+	0x61, 0x62, 0x65, 0x6c, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x34, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x42,
+	0x75, 0x69, 0x6c, 0x74, 0x69, 0x6e, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x10, 0x0a, 0x03,
+	0x64, 0x6f, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x22, 0x33,
+	0x0a, 0x0a, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x4b, 0x69, 0x6e, 0x64, 0x12, 0x0b, 0x0a, 0x07,
+	0x43, 0x4f, 0x55, 0x4e, 0x54, 0x45, 0x52, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x47, 0x41, 0x55,
+	0x47, 0x45, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x48, 0x49, 0x53, 0x54, 0x4f, 0x47, 0x52, 0x41,
+	0x4d, 0x10, 0x02, 0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x2a, 0x1e, 0x0a, 0x04, 0x4c, 0x61, 0x6e, 0x67, 0x12, 0x06, 0x0a, 0x02,
+	0x47, 0x4f, 0x10, 0x00, 0x12, 0x0e, 0x0a, 0x0a, 0x54, 0x59, 0x50, 0x45, 0x53, 0x43, 0x52, 0x49,
+	0x50, 0x54, 0x10, 0x01, 0x42, 0x26, 0x5a, 0x24, 0x65, 0x6e, 0x63, 0x72, 0x2e, 0x64, 0x65, 0x76,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x72, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x2f, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_encore_parser_meta_v1_meta_proto_rawDescOnce sync.Once
+	file_encore_parser_meta_v1_meta_proto_rawDescData = file_encore_parser_meta_v1_meta_proto_rawDesc
+)
+
+func file_encore_parser_meta_v1_meta_proto_rawDescGZIP() []byte {
+	file_encore_parser_meta_v1_meta_proto_rawDescOnce.Do(func() {
+		file_encore_parser_meta_v1_meta_proto_rawDescData = protoimpl.X.CompressGZIP(file_encore_parser_meta_v1_meta_proto_rawDescData)
+	})
+	return file_encore_parser_meta_v1_meta_proto_rawDescData
+}
+
+var file_encore_parser_meta_v1_meta_proto_enumTypes = make([]protoimpl.EnumInfo, 11)
+var file_encore_parser_meta_v1_meta_proto_msgTypes = make([]protoimpl.MessageInfo, 39)
+var file_encore_parser_meta_v1_meta_proto_goTypes = []interface{}{
+	(Lang)(0),                          // 0: encore.parser.meta.v1.Lang
+	(BucketUsage_Operation)(0),         // 1: encore.parser.meta.v1.BucketUsage.Operation
+	(Selector_Type)(0),                 // 2: encore.parser.meta.v1.Selector.Type
+	(RPC_AccessType)(0),                // 3: encore.parser.meta.v1.RPC.AccessType
+	(RPC_Protocol)(0),                  // 4: encore.parser.meta.v1.RPC.Protocol
+	(StaticCallNode_Package)(0),        // 5: encore.parser.meta.v1.StaticCallNode.Package
+	(Path_Type)(0),                     // 6: encore.parser.meta.v1.Path.Type
+	(PathSegment_SegmentType)(0),       // 7: encore.parser.meta.v1.PathSegment.SegmentType
+	(PathSegment_ParamType)(0),         // 8: encore.parser.meta.v1.PathSegment.ParamType
+	(PubSubTopic_DeliveryGuarantee)(0), // 9: encore.parser.meta.v1.PubSubTopic.DeliveryGuarantee
+	(Metric_MetricKind)(0),             // 10: encore.parser.meta.v1.Metric.MetricKind
+	(*Data)(nil),                       // 11: encore.parser.meta.v1.Data
+	(*QualifiedName)(nil),              // 12: encore.parser.meta.v1.QualifiedName
+	(*Package)(nil),                    // 13: encore.parser.meta.v1.Package
+	(*Service)(nil),                    // 14: encore.parser.meta.v1.Service
+	(*BucketUsage)(nil),                // 15: encore.parser.meta.v1.BucketUsage
+	(*Selector)(nil),                   // 16: encore.parser.meta.v1.Selector
+	(*RPC)(nil),                        // 17: encore.parser.meta.v1.RPC
+	(*AuthHandler)(nil),                // 18: encore.parser.meta.v1.AuthHandler
+	(*Middleware)(nil),                 // 19: encore.parser.meta.v1.Middleware
+	(*TraceNode)(nil),                  // 20: encore.parser.meta.v1.TraceNode
+	(*RPCDefNode)(nil),                 // 21: encore.parser.meta.v1.RPCDefNode
+	(*RPCCallNode)(nil),                // 22: encore.parser.meta.v1.RPCCallNode
+	(*StaticCallNode)(nil),             // 23: encore.parser.meta.v1.StaticCallNode
+	(*AuthHandlerDefNode)(nil),         // 24: encore.parser.meta.v1.AuthHandlerDefNode
+	(*PubSubTopicDefNode)(nil),         // 25: encore.parser.meta.v1.PubSubTopicDefNode
+	(*PubSubPublishNode)(nil),          // 26: encore.parser.meta.v1.PubSubPublishNode
+	(*PubSubSubscriberNode)(nil),       // 27: encore.parser.meta.v1.PubSubSubscriberNode
+	(*ServiceInitNode)(nil),            // 28: encore.parser.meta.v1.ServiceInitNode
+	(*MiddlewareDefNode)(nil),          // 29: encore.parser.meta.v1.MiddlewareDefNode
+	(*CacheKeyspaceDefNode)(nil),       // 30: encore.parser.meta.v1.CacheKeyspaceDefNode
+	(*Path)(nil),                       // 31: encore.parser.meta.v1.Path
+	(*PathSegment)(nil),                // 32: encore.parser.meta.v1.PathSegment
+	(*Gateway)(nil),                    // 33: encore.parser.meta.v1.Gateway
+	(*CronJob)(nil),                    // 34: encore.parser.meta.v1.CronJob
+	(*SQLDatabase)(nil),                // 35: encore.parser.meta.v1.SQLDatabase
+	(*DBMigration)(nil),                // 36: encore.parser.meta.v1.DBMigration
+	(*Bucket)(nil),                     // 37: encore.parser.meta.v1.Bucket
+	(*PubSubTopic)(nil),                // 38: encore.parser.meta.v1.PubSubTopic
+	(*CacheCluster)(nil),               // 39: encore.parser.meta.v1.CacheCluster
+	(*Metric)(nil),                     // 40: encore.parser.meta.v1.Metric
+	nil,                                // 41: encore.parser.meta.v1.RPC.ExposeEntry
+	(*RPC_ExposeOptions)(nil),          // 42: encore.parser.meta.v1.RPC.ExposeOptions
+	(*RPC_StaticAssets)(nil),           // 43: encore.parser.meta.v1.RPC.StaticAssets
+	(*Gateway_Explicit)(nil),           // 44: encore.parser.meta.v1.Gateway.Explicit
+	(*PubSubTopic_Publisher)(nil),      // 45: encore.parser.meta.v1.PubSubTopic.Publisher
+	(*PubSubTopic_Subscription)(nil),   // 46: encore.parser.meta.v1.PubSubTopic.Subscription
+	(*PubSubTopic_RetryPolicy)(nil),    // 47: encore.parser.meta.v1.PubSubTopic.RetryPolicy
+	(*CacheCluster_Keyspace)(nil),      // 48: encore.parser.meta.v1.CacheCluster.Keyspace
+	(*Metric_Label)(nil),               // 49: encore.parser.meta.v1.Metric.Label
+	(*v1.Decl)(nil),                    // 50: encore.parser.schema.v1.Decl
+	(*v1.Type)(nil),                    // 51: encore.parser.schema.v1.Type
+	(*v1.Loc)(nil),                     // 52: encore.parser.schema.v1.Loc
+	(*v1.ValidationExpr)(nil),          // 53: encore.parser.schema.v1.ValidationExpr
+	(v1.Builtin)(0),                    // 54: encore.parser.schema.v1.Builtin
+}
+var file_encore_parser_meta_v1_meta_proto_depIdxs = []int32{
+	50, // 0: encore.parser.meta.v1.Data.decls:type_name -> encore.parser.schema.v1.Decl
+	13, // 1: encore.parser.meta.v1.Data.pkgs:type_name -> encore.parser.meta.v1.Package
+	14, // 2: encore.parser.meta.v1.Data.svcs:type_name -> encore.parser.meta.v1.Service
+	18, // 3: encore.parser.meta.v1.Data.auth_handler:type_name -> encore.parser.meta.v1.AuthHandler
+	34, // 4: encore.parser.meta.v1.Data.cron_jobs:type_name -> encore.parser.meta.v1.CronJob
+	38, // 5: encore.parser.meta.v1.Data.pubsub_topics:type_name -> encore.parser.meta.v1.PubSubTopic
+	19, // 6: encore.parser.meta.v1.Data.middleware:type_name -> encore.parser.meta.v1.Middleware
+	39, // 7: encore.parser.meta.v1.Data.cache_clusters:type_name -> encore.parser.meta.v1.CacheCluster
+	40, // 8: encore.parser.meta.v1.Data.metrics:type_name -> encore.parser.meta.v1.Metric
+	35, // 9: encore.parser.meta.v1.Data.sql_databases:type_name -> encore.parser.meta.v1.SQLDatabase
+	33, // 10: encore.parser.meta.v1.Data.gateways:type_name -> encore.parser.meta.v1.Gateway
+	0,  // 11: encore.parser.meta.v1.Data.language:type_name -> encore.parser.meta.v1.Lang
+	37, // 12: encore.parser.meta.v1.Data.buckets:type_name -> encore.parser.meta.v1.Bucket
+	12, // 13: encore.parser.meta.v1.Package.rpc_calls:type_name -> encore.parser.meta.v1.QualifiedName
+	20, // 14: encore.parser.meta.v1.Package.trace_nodes:type_name -> encore.parser.meta.v1.TraceNode
+	17, // 15: encore.parser.meta.v1.Service.rpcs:type_name -> encore.parser.meta.v1.RPC
+	36, // 16: encore.parser.meta.v1.Service.migrations:type_name -> encore.parser.meta.v1.DBMigration
+	15, // 17: encore.parser.meta.v1.Service.buckets:type_name -> encore.parser.meta.v1.BucketUsage
+	1,  // 18: encore.parser.meta.v1.BucketUsage.operations:type_name -> encore.parser.meta.v1.BucketUsage.Operation
+	2,  // 19: encore.parser.meta.v1.Selector.type:type_name -> encore.parser.meta.v1.Selector.Type
+	3,  // 20: encore.parser.meta.v1.RPC.access_type:type_name -> encore.parser.meta.v1.RPC.AccessType
+	51, // 21: encore.parser.meta.v1.RPC.request_schema:type_name -> encore.parser.schema.v1.Type
+	51, // 22: encore.parser.meta.v1.RPC.response_schema:type_name -> encore.parser.schema.v1.Type
+	4,  // 23: encore.parser.meta.v1.RPC.proto:type_name -> encore.parser.meta.v1.RPC.Protocol
+	52, // 24: encore.parser.meta.v1.RPC.loc:type_name -> encore.parser.schema.v1.Loc
+	31, // 25: encore.parser.meta.v1.RPC.path:type_name -> encore.parser.meta.v1.Path
+	16, // 26: encore.parser.meta.v1.RPC.tags:type_name -> encore.parser.meta.v1.Selector
+	41, // 27: encore.parser.meta.v1.RPC.expose:type_name -> encore.parser.meta.v1.RPC.ExposeEntry
+	51, // 28: encore.parser.meta.v1.RPC.handshake_schema:type_name -> encore.parser.schema.v1.Type
+	43, // 29: encore.parser.meta.v1.RPC.static_assets:type_name -> encore.parser.meta.v1.RPC.StaticAssets
+	52, // 30: encore.parser.meta.v1.AuthHandler.loc:type_name -> encore.parser.schema.v1.Loc
+	51, // 31: encore.parser.meta.v1.AuthHandler.auth_data:type_name -> encore.parser.schema.v1.Type
+	51, // 32: encore.parser.meta.v1.AuthHandler.params:type_name -> encore.parser.schema.v1.Type
+	12, // 33: encore.parser.meta.v1.Middleware.name:type_name -> encore.parser.meta.v1.QualifiedName
+	52, // 34: encore.parser.meta.v1.Middleware.loc:type_name -> encore.parser.schema.v1.Loc
+	16, // 35: encore.parser.meta.v1.Middleware.target:type_name -> encore.parser.meta.v1.Selector
+	21, // 36: encore.parser.meta.v1.TraceNode.rpc_def:type_name -> encore.parser.meta.v1.RPCDefNode
+	22, // 37: encore.parser.meta.v1.TraceNode.rpc_call:type_name -> encore.parser.meta.v1.RPCCallNode
+	23, // 38: encore.parser.meta.v1.TraceNode.static_call:type_name -> encore.parser.meta.v1.StaticCallNode
+	24, // 39: encore.parser.meta.v1.TraceNode.auth_handler_def:type_name -> encore.parser.meta.v1.AuthHandlerDefNode
+	25, // 40: encore.parser.meta.v1.TraceNode.pubsub_topic_def:type_name -> encore.parser.meta.v1.PubSubTopicDefNode
+	26, // 41: encore.parser.meta.v1.TraceNode.pubsub_publish:type_name -> encore.parser.meta.v1.PubSubPublishNode
+	27, // 42: encore.parser.meta.v1.TraceNode.pubsub_subscriber:type_name -> encore.parser.meta.v1.PubSubSubscriberNode
+	28, // 43: encore.parser.meta.v1.TraceNode.service_init:type_name -> encore.parser.meta.v1.ServiceInitNode
+	29, // 44: encore.parser.meta.v1.TraceNode.middleware_def:type_name -> encore.parser.meta.v1.MiddlewareDefNode
+	30, // 45: encore.parser.meta.v1.TraceNode.cache_keyspace:type_name -> encore.parser.meta.v1.CacheKeyspaceDefNode
+	5,  // 46: encore.parser.meta.v1.StaticCallNode.package:type_name -> encore.parser.meta.v1.StaticCallNode.Package
+	16, // 47: encore.parser.meta.v1.MiddlewareDefNode.target:type_name -> encore.parser.meta.v1.Selector
+	32, // 48: encore.parser.meta.v1.Path.segments:type_name -> encore.parser.meta.v1.PathSegment
+	6,  // 49: encore.parser.meta.v1.Path.type:type_name -> encore.parser.meta.v1.Path.Type
+	7,  // 50: encore.parser.meta.v1.PathSegment.type:type_name -> encore.parser.meta.v1.PathSegment.SegmentType
+	8,  // 51: encore.parser.meta.v1.PathSegment.value_type:type_name -> encore.parser.meta.v1.PathSegment.ParamType
+	53, // 52: encore.parser.meta.v1.PathSegment.validation:type_name -> encore.parser.schema.v1.ValidationExpr
+	44, // 53: encore.parser.meta.v1.Gateway.explicit:type_name -> encore.parser.meta.v1.Gateway.Explicit
+	12, // 54: encore.parser.meta.v1.CronJob.endpoint:type_name -> encore.parser.meta.v1.QualifiedName
+	36, // 55: encore.parser.meta.v1.SQLDatabase.migrations:type_name -> encore.parser.meta.v1.DBMigration
+	51, // 56: encore.parser.meta.v1.PubSubTopic.message_type:type_name -> encore.parser.schema.v1.Type
+	9,  // 57: encore.parser.meta.v1.PubSubTopic.delivery_guarantee:type_name -> encore.parser.meta.v1.PubSubTopic.DeliveryGuarantee
+	45, // 58: encore.parser.meta.v1.PubSubTopic.publishers:type_name -> encore.parser.meta.v1.PubSubTopic.Publisher
+	46, // 59: encore.parser.meta.v1.PubSubTopic.subscriptions:type_name -> encore.parser.meta.v1.PubSubTopic.Subscription
+	48, // 60: encore.parser.meta.v1.CacheCluster.keyspaces:type_name -> encore.parser.meta.v1.CacheCluster.Keyspace
+	54, // 61: encore.parser.meta.v1.Metric.value_type:type_name -> encore.parser.schema.v1.Builtin
+	10, // 62: encore.parser.meta.v1.Metric.kind:type_name -> encore.parser.meta.v1.Metric.MetricKind
+	49, // 63: encore.parser.meta.v1.Metric.labels:type_name -> encore.parser.meta.v1.Metric.Label
+	42, // 64: encore.parser.meta.v1.RPC.ExposeEntry.value:type_name -> encore.parser.meta.v1.RPC.ExposeOptions
+	18, // 65: encore.parser.meta.v1.Gateway.Explicit.auth_handler:type_name -> encore.parser.meta.v1.AuthHandler
+	47, // 66: encore.parser.meta.v1.PubSubTopic.Subscription.retry_policy:type_name -> encore.parser.meta.v1.PubSubTopic.RetryPolicy
+	51, // 67: encore.parser.meta.v1.CacheCluster.Keyspace.key_type:type_name -> encore.parser.schema.v1.Type
+	51, // 68: encore.parser.meta.v1.CacheCluster.Keyspace.value_type:type_name -> encore.parser.schema.v1.Type
+	31, // 69: encore.parser.meta.v1.CacheCluster.Keyspace.path_pattern:type_name -> encore.parser.meta.v1.Path
+	54, // 70: encore.parser.meta.v1.Metric.Label.type:type_name -> encore.parser.schema.v1.Builtin
+	71, // [71:71] is the sub-list for method output_type
+	71, // [71:71] is the sub-list for method input_type
+	71, // [71:71] is the sub-list for extension type_name
+	71, // [71:71] is the sub-list for extension extendee
+	0,  // [0:71] is the sub-list for field type_name
+}
+
+func init() { file_encore_parser_meta_v1_meta_proto_init() }
+func file_encore_parser_meta_v1_meta_proto_init() {
+	if File_encore_parser_meta_v1_meta_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Data); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*QualifiedName); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Package); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Service); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketUsage); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
 		}
-		file_encore_parser_meta_v1_meta_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*QualifiedName); i {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Selector); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1430,8 +4529,8 @@ func file_encore_parser_meta_v1_meta_proto_init() {
 				return nil
 			}
 		}
-		file_encore_parser_meta_v1_meta_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Package); i {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RPC); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1442,8 +4541,8 @@ func file_encore_parser_meta_v1_meta_proto_init() {
 				return nil
 			}
 		}
-		file_encore_parser_meta_v1_meta_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Service); i {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthHandler); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1454,7 +4553,211 @@ func file_encore_parser_meta_v1_meta_proto_init() {
 				return nil
 			}
 		}
-		file_encore_parser_meta_v1_meta_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Middleware); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TraceNode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RPCDefNode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RPCCallNode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StaticCallNode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AuthHandlerDefNode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubTopicDefNode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubPublishNode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubSubscriberNode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceInitNode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MiddlewareDefNode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CacheKeyspaceDefNode); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Path); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PathSegment); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Gateway); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CronJob); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLDatabase); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*DBMigration); i {
 			case 0:
 				return &v.state
@@ -1466,8 +4769,8 @@ func file_encore_parser_meta_v1_meta_proto_init() {
 				return nil
 			}
 		}
-		file_encore_parser_meta_v1_meta_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RPC); i {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Bucket); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1478,8 +4781,8 @@ func file_encore_parser_meta_v1_meta_proto_init() {
 				return nil
 			}
 		}
-		file_encore_parser_meta_v1_meta_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthHandler); i {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubTopic); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1490,8 +4793,8 @@ func file_encore_parser_meta_v1_meta_proto_init() {
 				return nil
 			}
 		}
-		file_encore_parser_meta_v1_meta_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TraceNode); i {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CacheCluster); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1502,8 +4805,8 @@ func file_encore_parser_meta_v1_meta_proto_init() {
 				return nil
 			}
 		}
-		file_encore_parser_meta_v1_meta_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RPCDefNode); i {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Metric); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1514,8 +4817,8 @@ func file_encore_parser_meta_v1_meta_proto_init() {
 				return nil
 			}
 		}
-		file_encore_parser_meta_v1_meta_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RPCCallNode); i {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RPC_ExposeOptions); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1526,8 +4829,8 @@ func file_encore_parser_meta_v1_meta_proto_init() {
 				return nil
 			}
 		}
-		file_encore_parser_meta_v1_meta_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*StaticCallNode); i {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RPC_StaticAssets); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1538,8 +4841,68 @@ func file_encore_parser_meta_v1_meta_proto_init() {
 				return nil
 			}
 		}
-		file_encore_parser_meta_v1_meta_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*AuthHandlerDefNode); i {
+		file_encore_parser_meta_v1_meta_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Gateway_Explicit); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubTopic_Publisher); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[35].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubTopic_Subscription); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[36].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubTopic_RetryPolicy); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[37].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CacheCluster_Keyspace); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_meta_v1_meta_proto_msgTypes[38].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Metric_Label); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1551,19 +4914,39 @@ func file_encore_parser_meta_v1_meta_proto_init() {
 			}
 		}
 	}
-	file_encore_parser_meta_v1_meta_proto_msgTypes[7].OneofWrappers = []interface{}{
+	file_encore_parser_meta_v1_meta_proto_msgTypes[0].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[6].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[7].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[8].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[9].OneofWrappers = []interface{}{
 		(*TraceNode_RpcDef)(nil),
 		(*TraceNode_RpcCall)(nil),
 		(*TraceNode_StaticCall)(nil),
 		(*TraceNode_AuthHandlerDef)(nil),
+		(*TraceNode_PubsubTopicDef)(nil),
+		(*TraceNode_PubsubPublish)(nil),
+		(*TraceNode_PubsubSubscriber)(nil),
+		(*TraceNode_ServiceInit)(nil),
+		(*TraceNode_MiddlewareDef)(nil),
+		(*TraceNode_CacheKeyspace)(nil),
 	}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[21].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[22].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[23].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[24].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[26].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[27].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[29].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[32].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[33].OneofWrappers = []interface{}{}
+	file_encore_parser_meta_v1_meta_proto_msgTypes[35].OneofWrappers = []interface{}{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_encore_parser_meta_v1_meta_proto_rawDesc,
-			NumEnums:      3,
-			NumMessages:   12,
+			NumEnums:      11,
+			NumMessages:   39,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/proto/encore/parser/meta/v1/meta.pb.ts b/proto/encore/parser/meta/v1/meta.pb.ts
new file mode 100644
index 0000000000..df0346830a
--- /dev/null
+++ b/proto/encore/parser/meta/v1/meta.pb.ts
@@ -0,0 +1,398 @@
+/* eslint-disable */
+import type {
+  Loc,
+  Type,
+  Builtin,
+  Decl,
+} from "../../../../encore/parser/schema/v1/schema.pb";
+
+export const protobufPackage = "encore.parser.meta.v1";
+
+/** Data is the metadata associated with an app version. */
+export interface Data {
+  /** app module path */
+  module_path: string;
+  /** app revision (always the VCS revision reference) */
+  app_revision: string;
+  /** true if there where changes made on-top of the VCS revision */
+  uncommitted_changes: boolean;
+  decls: Decl[];
+  pkgs: Package[];
+  svcs: Service[];
+  /** the auth handler or nil */
+  auth_handler?: AuthHandler | undefined;
+  cron_jobs: CronJob[];
+  /** All the pub sub topics declared in the application */
+  pubsub_topics: PubSubTopic[];
+  middleware: Middleware[];
+  cache_clusters: CacheCluster[];
+  experiments: string[];
+  metrics: Metric[];
+  sql_databases: SQLDatabase[];
+}
+
+/**
+ * QualifiedName is a name of an object in a specific package.
+ * It is never an unqualified name, even in circumstances
+ * where a package may refer to its own objects.
+ */
+export interface QualifiedName {
+  /** "rel/path/to/pkg" */
+  pkg: string;
+  /** ObjectName */
+  name: string;
+}
+
+export interface Package {
+  /** import path relative to app root ("." for the app root itself) */
+  rel_path: string;
+  /** package name as declared in Go files */
+  name: string;
+  /** associated documentation */
+  doc: string;
+  /** service name this package is a part of, if any */
+  service_name: string;
+  /** secrets required by this package */
+  secrets: string[];
+  /** RPCs called by the package */
+  rpc_calls: QualifiedName[];
+  trace_nodes: TraceNode[];
+}
+
+export interface Service {
+  name: string;
+  /** import path relative to app root for the root package in the service */
+  rel_path: string;
+  rpcs: RPC[];
+  migrations: DBMigration[];
+  /** databases this service connects to */
+  databases: string[];
+  /** true if the service has uses config */
+  has_config: boolean;
+}
+
+export interface Selector {
+  type: Selector_Type;
+  value: string;
+}
+
+export enum Selector_Type {
+  UNKNOWN = "UNKNOWN",
+  ALL = "ALL",
+  /** TAG - NOTE: If more types are added, update the (selector.Selector).ToProto method. */
+  TAG = "TAG",
+  UNRECOGNIZED = "UNRECOGNIZED",
+}
+
+export interface RPC {
+  /** name of the RPC endpoint */
+  name: string;
+  /** associated documentation */
+  doc: string;
+  /** the service the RPC belongs to. */
+  service_name: string;
+  /** how can the RPC be accessed? */
+  access_type: RPC_AccessType;
+  /** request schema, or nil */
+  request_schema?: Type | undefined;
+  /** response schema, or nil */
+  response_schema?: Type | undefined;
+  proto: RPC_Protocol;
+  loc: Loc;
+  path: Path;
+  http_methods: string[];
+  tags: Selector[];
+}
+
+export enum RPC_AccessType {
+  PRIVATE = "PRIVATE",
+  PUBLIC = "PUBLIC",
+  AUTH = "AUTH",
+  UNRECOGNIZED = "UNRECOGNIZED",
+}
+
+export enum RPC_Protocol {
+  REGULAR = "REGULAR",
+  RAW = "RAW",
+  UNRECOGNIZED = "UNRECOGNIZED",
+}
+
+export interface AuthHandler {
+  name: string;
+  doc: string;
+  /** package (service) import path */
+  pkg_path: string;
+  /** package (service) name */
+  pkg_name: string;
+  loc: Loc;
+  /** custom auth data, or nil */
+  auth_data?: Type | undefined;
+  /** builtin string or named type */
+  params?: Type | undefined;
+}
+
+export interface Middleware {
+  name: QualifiedName;
+  doc: string;
+  loc: Loc;
+  global: boolean;
+  /** nil if global */
+  service_name?: string | undefined;
+  target: Selector[];
+}
+
+export interface TraceNode {
+  id: number;
+  /** slash-separated, relative to app root */
+  filepath: string;
+  start_pos: number;
+  end_pos: number;
+  src_line_start: number;
+  src_line_end: number;
+  src_col_start: number;
+  src_col_end: number;
+  rpc_def: RPCDefNode | undefined;
+  rpc_call: RPCCallNode | undefined;
+  static_call: StaticCallNode | undefined;
+  auth_handler_def: AuthHandlerDefNode | undefined;
+  pubsub_topic_def: PubSubTopicDefNode | undefined;
+  pubsub_publish: PubSubPublishNode | undefined;
+  pubsub_subscriber: PubSubSubscriberNode | undefined;
+  service_init: ServiceInitNode | undefined;
+  middleware_def: MiddlewareDefNode | undefined;
+  cache_keyspace: CacheKeyspaceDefNode | undefined;
+}
+
+export interface RPCDefNode {
+  service_name: string;
+  rpc_name: string;
+  context: string;
+}
+
+export interface RPCCallNode {
+  service_name: string;
+  rpc_name: string;
+  context: string;
+}
+
+export interface StaticCallNode {
+  package: StaticCallNode_Package;
+  func: string;
+  context: string;
+}
+
+export enum StaticCallNode_Package {
+  UNKNOWN = "UNKNOWN",
+  SQLDB = "SQLDB",
+  RLOG = "RLOG",
+  UNRECOGNIZED = "UNRECOGNIZED",
+}
+
+export interface AuthHandlerDefNode {
+  service_name: string;
+  name: string;
+  context: string;
+}
+
+export interface PubSubTopicDefNode {
+  topic_name: string;
+  context: string;
+}
+
+export interface PubSubPublishNode {
+  topic_name: string;
+  context: string;
+}
+
+export interface PubSubSubscriberNode {
+  topic_name: string;
+  subscriber_name: string;
+  service_name: string;
+  context: string;
+}
+
+export interface ServiceInitNode {
+  service_name: string;
+  setup_func_name: string;
+  context: string;
+}
+
+export interface MiddlewareDefNode {
+  pkg_rel_path: string;
+  name: string;
+  context: string;
+  target: Selector[];
+}
+
+export interface CacheKeyspaceDefNode {
+  pkg_rel_path: string;
+  var_name: string;
+  cluster_name: string;
+  context: string;
+}
+
+export interface Path {
+  segments: PathSegment[];
+  type: Path_Type;
+}
+
+export enum Path_Type {
+  URL = "URL",
+  CACHE_KEYSPACE = "CACHE_KEYSPACE",
+  UNRECOGNIZED = "UNRECOGNIZED",
+}
+
+export interface PathSegment {
+  type: PathSegment_SegmentType;
+  value: string;
+  value_type: PathSegment_ParamType;
+}
+
+export enum PathSegment_SegmentType {
+  LITERAL = "LITERAL",
+  PARAM = "PARAM",
+  WILDCARD = "WILDCARD",
+  FALLBACK = "FALLBACK",
+  UNRECOGNIZED = "UNRECOGNIZED",
+}
+
+export enum PathSegment_ParamType {
+  STRING = "STRING",
+  BOOL = "BOOL",
+  INT8 = "INT8",
+  INT16 = "INT16",
+  INT32 = "INT32",
+  INT64 = "INT64",
+  INT = "INT",
+  UINT8 = "UINT8",
+  UINT16 = "UINT16",
+  UINT32 = "UINT32",
+  UINT64 = "UINT64",
+  UINT = "UINT",
+  UUID = "UUID",
+  UNRECOGNIZED = "UNRECOGNIZED",
+}
+
+export interface CronJob {
+  id: string;
+  title: string;
+  doc: string;
+  schedule: string;
+  endpoint: QualifiedName;
+}
+
+export interface SQLDatabase {
+  name: string;
+  doc: string;
+  /**
+   * migration_rel_path is the slash-separated path to the migrations,
+   * relative to the main module's root directory.
+   */
+  migration_rel_path: string;
+  migrations: DBMigration[];
+}
+
+export interface DBMigration {
+  /** filename */
+  filename: string;
+  /** migration number */
+  number: number;
+  /** descriptive name */
+  description: string;
+}
+
+export interface PubSubTopic {
+  /** The pub sub topic name (unique per application) */
+  name: string;
+  /** The documentation for the topic */
+  doc: string;
+  /** The type of the message */
+  message_type: Type;
+  /** The delivery guarantee for the topic */
+  delivery_guarantee: PubSubTopic_DeliveryGuarantee;
+  /** The field used to group messages; if empty, the topic is not ordered */
+  ordering_key: string;
+  /** The publishers for this topic */
+  publishers: PubSubTopic_Publisher[];
+  /** The subscriptions to the topic */
+  subscriptions: PubSubTopic_Subscription[];
+}
+
+export enum PubSubTopic_DeliveryGuarantee {
+  /** AT_LEAST_ONCE - All messages will be delivered to each subscription at least once */
+  AT_LEAST_ONCE = "AT_LEAST_ONCE",
+  /** EXACTLY_ONCE - All messages will be delivered to each subscription exactly once */
+  EXACTLY_ONCE = "EXACTLY_ONCE",
+  UNRECOGNIZED = "UNRECOGNIZED",
+}
+
+export interface PubSubTopic_Publisher {
+  /** The service the publisher is in */
+  service_name: string;
+}
+
+export interface PubSubTopic_Subscription {
+  /** The unique name of the subscription for this topic */
+  name: string;
+  /** The service that the subscriber is in */
+  service_name: string;
+  /** How long has a consumer got to process and ack a message in nanoseconds */
+  ack_deadline: number;
+  /** How long is an undelivered message kept in nanoseconds */
+  message_retention: number;
+  /** The retry policy for the subscription */
+  retry_policy: PubSubTopic_RetryPolicy;
+}
+
+export interface PubSubTopic_RetryPolicy {
+  /** min backoff in nanoseconds */
+  min_backoff: number;
+  /** max backoff in nanoseconds */
+  max_backoff: number;
+  /** max number of retries */
+  max_retries: number;
+}
+
+export interface CacheCluster {
+  /** The pub sub topic name (unique per application) */
+  name: string;
+  /** The documentation for the topic */
+  doc: string;
+  /** The publishers for this topic */
+  keyspaces: CacheCluster_Keyspace[];
+  /** redis eviction policy */
+  eviction_policy: string;
+}
+
+export interface CacheCluster_Keyspace {
+  key_type: Type;
+  value_type: Type;
+  service: string;
+  doc: string;
+  path_pattern: Path;
+}
+
+export interface Metric {
+  /** the name of the metric */
+  name: string;
+  value_type: Builtin;
+  /** the doc string */
+  doc: string;
+  kind: Metric_MetricKind;
+  /** the service the metric is exclusive to, if any. */
+  service_name?: string | undefined;
+  labels: Metric_Label[];
+}
+
+export enum Metric_MetricKind {
+  COUNTER = "COUNTER",
+  GAUGE = "GAUGE",
+  HISTOGRAM = "HISTOGRAM",
+  UNRECOGNIZED = "UNRECOGNIZED",
+}
+
+export interface Metric_Label {
+  key: string;
+  type: Builtin;
+  doc: string;
+}
diff --git a/proto/encore/parser/meta/v1/meta.proto b/proto/encore/parser/meta/v1/meta.proto
index f3bce91f2a..d2989869ba 100644
--- a/proto/encore/parser/meta/v1/meta.proto
+++ b/proto/encore/parser/meta/v1/meta.proto
@@ -8,54 +8,146 @@ import "encore/parser/schema/v1/schema.proto";
 
 // Data is the metadata associated with an app version.
 message Data {
-  string module_path = 1; // app module path
-	string app_version = 2;
-  repeated schema.v1.Decl decls = 3;
-  repeated Package pkgs = 4;
-  repeated Service svcs = 5;
-  AuthHandler auth_handler = 6;
+  string                  module_path         = 1; // app module path
+  string                  app_revision        = 2; // app revision (always the VCS revision reference)
+  bool                    uncommitted_changes = 8; // true if there where changes made on-top of the VCS revision
+  repeated schema.v1.Decl decls               = 3;
+  repeated Package        pkgs                = 4;
+  repeated Service        svcs                = 5;
+  optional AuthHandler    auth_handler        = 6; // the auth handler or nil
+  repeated CronJob        cron_jobs           = 7;
+  repeated PubSubTopic    pubsub_topics       = 9; // All the pub sub topics declared in the application
+  repeated Middleware     middleware          = 10;
+  repeated CacheCluster   cache_clusters      = 11;
+  repeated string         experiments         = 12;
+  repeated Metric         metrics             = 13;
+  repeated SQLDatabase    sql_databases       = 14;
+  repeated Gateway        gateways            = 15;
+  Lang                    language            = 16;
+  repeated Bucket         buckets             = 17;
+}
+
+// Lang describes the language an application is written in.
+// Defaults to Go if not set.
+enum Lang {
+  GO = 0;
+  TYPESCRIPT = 1;
 }
 
 // QualifiedName is a name of an object in a specific package.
 // It is never an unqualified name, even in circumstances
 // where a package may refer to its own objects.
 message QualifiedName {
-  string pkg = 1; // "rel/path/to/pkg"
+  string pkg  = 1; // "rel/path/to/pkg"
   string name = 2; // ObjectName
 }
 
 message Package {
-  string rel_path = 1;                  // import path relative to app root ("." for the app root itself)
-  string name = 2;                      // package name as declared in Go files
-  string doc = 3;                       // associated documentation
-  string service_name = 4;              // service name this package is a part of, if any
-  repeated string secrets = 5;          // secrets required by this package
-  repeated QualifiedName rpc_calls = 6; // RPCs called by the package
-  repeated TraceNode trace_nodes = 7;
+  string                 rel_path     = 1; // import path relative to app root ("." for the app root itself)
+  string                 name         = 2; // package name as declared in Go files
+  string                 doc          = 3; // associated documentation
+  string                 service_name = 4; // service name this package is a part of, if any
+  repeated string        secrets      = 5; // secrets required by this package
+  repeated QualifiedName rpc_calls    = 6; // RPCs called by the package
+  repeated TraceNode     trace_nodes  = 7;
 }
 
 message Service {
-  string name = 1;
-  string rel_path = 2; // import path relative to app root for the root package in the service
-  repeated RPC rpcs = 3;
+  string               name       = 1;
+  string               rel_path   = 2; // import path relative to app root for the root package in the service
+  repeated RPC         rpcs       = 3;
   repeated DBMigration migrations = 4;
+  repeated string      databases  = 5; // databases this service connects to
+  bool                 has_config = 6; // true if the service has uses config
+  repeated BucketUsage buckets    = 7; // buckets this service uses
 }
 
-message DBMigration {
-  string filename = 1;    // filename
-  int32 number = 2;       // migration number
-  string description = 3; // descriptive name
+message BucketUsage {
+  // The encore name of the bucket.
+  string bucket = 1;
+
+  // Recorded operations.
+  repeated Operation operations = 2;
+
+  enum Operation {
+    UNKNOWN = 0;
+
+    // Listing objects and accessing their metadata during listing.
+    LIST_OBJECTS = 1;
+
+    // Reading the contents of an object.
+    READ_OBJECT_CONTENTS = 2;
+
+    // Creating or updating an object, with contents and metadata.
+    WRITE_OBJECT = 3;
+
+    // Updating the metadata of an object, without reading or writing its contents.
+    UPDATE_OBJECT_METADATA = 4;
+
+    // Reading the metadata of an object, or checking for its existence.
+    GET_OBJECT_METADATA = 5;
+
+    // Deleting an object.
+    DELETE_OBJECT = 6;
+
+    // Get an bucket/object's public url.
+    GET_PUBLIC_URL = 7;
+
+    // Generating a signed URL to allow an external recipient to create or
+    // update an object.
+    SIGNED_UPLOAD_URL = 8;
+
+    // Generating a signed URL to allow an external recipient to download an object.
+    SIGNED_DOWNLOAD_URL = 9;
+  }
+}
+
+message Selector {
+  enum Type {
+    UNKNOWN = 0;
+    ALL     = 1;
+    TAG     = 2;
+    // NOTE: If more types are added, update the (selector.Selector).ToProto method.
+  }
+
+  Type type = 1;
+  string value = 2;
 }
 
 message RPC {
-  string name = 1;                   // name of the RPC endpoint
-  string doc = 2;                    // associated documentation
-  string service_name = 3;           // the service the RPC belongs to.
-  AccessType access_type = 4;        // how can the RPC be accessed?
-  schema.v1.Decl request_schema = 5;    // request schema, or nil
-  schema.v1.Decl response_schema = 6;   // request schema, or nil
-  Protocol proto = 7;
-  schema.v1.Loc loc = 8;
+  string                   name            = 1; // name of the RPC endpoint
+  optional string          doc             = 2; // associated documentation
+  string                   service_name    = 3; // the service the RPC belongs to.
+  AccessType               access_type     = 4; // how can the RPC be accessed?
+  optional schema.v1.Type  request_schema  = 5; // request schema, or nil
+  optional schema.v1.Type  response_schema = 6; // response schema, or nil
+  Protocol                 proto           = 7;
+  schema.v1.Loc            loc             = 8;
+  Path                     path            = 9;
+  repeated string          http_methods    = 10;
+  repeated Selector        tags            = 11;
+
+  // sensitive reports whether the whole payload is sensitive.
+  // If true, none of the request/response payload will be traced.
+  bool sensitive = 12;
+
+  // Whether the endpoint can be called without auth parameters.
+  bool allow_unauthenticated = 13;
+
+  // Whether the endpoint is exposed to the public, keyed by gateway.
+  map<string, ExposeOptions> expose = 14;
+
+  // The maximum size of the request body in bytes.
+  // If not set, defaults to no limit.
+  optional uint64 body_limit = 15;
+
+  // If the endpoint is streaming
+  bool streaming_request = 16;
+  bool streaming_response = 17;
+  optional schema.v1.Type  handshake_schema = 18; // handshake schema, or nil
+
+  // If the endpoint serves static assets.
+  optional StaticAssets static_assets = 19;
 
   enum AccessType {
     PRIVATE = 0;
@@ -67,15 +159,39 @@ message RPC {
     REGULAR = 0;
     RAW = 1;
   }
+
+  message ExposeOptions {}
+
+  message StaticAssets {
+    // dir_rel_path is the slash-separated path to the static files directory,
+    // relative to the app root.
+    string dir_rel_path = 1;
+
+    // not_found_rel_path is the relative path to the file to serve when the requested
+    // file is not found. It is relative to the files_rel_path directory.
+    optional string not_found_rel_path = 2;
+    optional uint32 not_found_status = 3;
+  }
 }
 
 message AuthHandler {
-  string name = 1;
-  string doc = 2;
-  string pkg_path = 3; // package (service) import path
-  string pkg_name = 4; // package (service) name
-  schema.v1.Loc loc = 5;
-  schema.v1.Decl auth_data = 6; // custom auth data, or nil
+  string                  name      = 1;
+  string                  doc       = 2;
+  string                  pkg_path  = 3; // package (service) import path
+  string                  pkg_name  = 4; // package (service) name
+  schema.v1.Loc           loc       = 5;
+  optional schema.v1.Type auth_data = 6; // custom auth data, or nil
+  optional schema.v1.Type params    = 7; // builtin string or named type
+  string service_name               = 8;
+}
+
+message Middleware {
+  QualifiedName     name         = 1;
+  string            doc          = 2;
+  schema.v1.Loc     loc          = 3;
+  bool              global       = 4;
+  optional string   service_name = 5; // nil if global
+  repeated Selector target       = 6;
 }
 
 message TraceNode {
@@ -90,21 +206,27 @@ message TraceNode {
   int32 src_col_end = 9;
 
   oneof context {
-    RPCDefNode rpc_def = 10;
-    RPCCallNode rpc_call = 11;
-    StaticCallNode static_call = 12;
-    AuthHandlerDefNode auth_handler_def = 13;
+    RPCDefNode           rpc_def           = 10;
+    RPCCallNode          rpc_call          = 11;
+    StaticCallNode       static_call       = 12;
+    AuthHandlerDefNode   auth_handler_def  = 13;
+    PubSubTopicDefNode   pubsub_topic_def  = 14;
+    PubSubPublishNode    pubsub_publish    = 15;
+    PubSubSubscriberNode pubsub_subscriber = 16;
+    ServiceInitNode      service_init      = 17;
+    MiddlewareDefNode    middleware_def    = 18;
+    CacheKeyspaceDefNode cache_keyspace    = 19;
   }
 }
 
 message RPCDefNode {
-  string service_name = 1; 
+  string service_name = 1;
   string rpc_name = 2;
   string context = 3;
 }
 
 message RPCCallNode {
-  string service_name = 1; 
+  string service_name = 1;
   string rpc_name = 2;
   string context = 3;
 }
@@ -121,7 +243,202 @@ message StaticCallNode {
 }
 
 message AuthHandlerDefNode {
-  string service_name = 1; 
+  string service_name = 1;
   string name = 2;
   string context = 3;
 }
+
+message PubSubTopicDefNode {
+  string topic_name = 1;
+  string context    = 2;
+}
+
+message PubSubPublishNode {
+  string topic_name = 1;
+  string context    = 2;
+}
+
+message PubSubSubscriberNode {
+  string topic_name      = 1;
+  string subscriber_name = 2;
+  string service_name    = 3;
+  string context         = 4;
+}
+
+message ServiceInitNode {
+  string service_name    = 1;
+  string setup_func_name = 2;
+  string context         = 3;
+}
+
+message MiddlewareDefNode {
+  string pkg_rel_path      = 1;
+  string name              = 2;
+  string context           = 3;
+  repeated Selector target = 4;
+}
+
+message CacheKeyspaceDefNode {
+  string pkg_rel_path = 1;
+  string var_name     = 2;
+  string cluster_name = 3;
+  string context      = 4;
+}
+
+message Path {
+  enum Type {
+    URL = 0;
+    CACHE_KEYSPACE = 1;
+  }
+
+  repeated PathSegment segments = 1;
+  Type type = 2;
+}
+
+message PathSegment {
+  enum SegmentType {
+    LITERAL = 0;
+    PARAM = 1;
+    WILDCARD = 2;
+    FALLBACK = 3;
+  }
+
+  enum ParamType {
+    STRING = 0;
+    BOOL = 1;
+    INT8 = 2;
+    INT16 = 3;
+    INT32 = 4;
+    INT64 = 5;
+    INT = 6;
+    UINT8 = 7;
+    UINT16 = 8;
+    UINT32 = 9;
+    UINT64 = 10;
+    UINT = 11;
+    UUID = 12;
+  }
+
+  SegmentType type = 1;
+  string value = 2;
+  ParamType value_type = 3;
+
+  optional schema.v1.ValidationExpr validation = 4;
+}
+
+message Gateway {
+  string encore_name = 1;
+
+  // Spec is the configuration for the gateway, if it's explicitly defined.
+  optional Explicit explicit = 2;
+
+  message Explicit {
+    // The service name this gateway belongs to.
+    string service_name               = 1;
+    optional AuthHandler auth_handler = 2;
+  }
+}
+
+message CronJob {
+  string id = 1;
+  string title = 2;
+  optional string doc = 3;
+  string schedule = 4;
+  QualifiedName endpoint = 5;
+}
+
+message SQLDatabase {
+  string name = 1;
+  optional string doc = 2;
+  // migration_rel_path is the slash-separated path to the migrations,
+  // relative to the main module's root directory.
+  optional string migration_rel_path = 3;
+  repeated DBMigration migrations = 4;
+  bool allow_non_sequential_migrations = 5;
+}
+
+message DBMigration {
+  string filename    = 1; // filename
+  uint64 number      = 2; // migration number
+  string description = 3; // descriptive name
+}
+
+message Bucket {
+  string name         = 1;
+  optional string doc = 2;
+  bool versioned      = 3;
+  bool public         = 4;
+}
+
+message PubSubTopic {
+  string                name               = 1; // The pub sub topic name (unique per application)
+  optional string       doc                = 2; // The documentation for the topic
+  schema.v1.Type        message_type       = 3; // The type of the message
+  DeliveryGuarantee     delivery_guarantee = 4; // The delivery guarantee for the topic
+  string                ordering_key       = 5; // The field used to group messages; if empty, the topic is not ordered
+  repeated Publisher    publishers         = 6; // The publishers for this topic
+  repeated Subscription subscriptions      = 7; // The subscriptions to the topic
+
+  message Publisher {
+    string service_name = 1; // The service the publisher is in
+  }
+
+  message Subscription {
+    string name              = 1; // The unique name of the subscription for this topic
+    string service_name      = 2; // The service that the subscriber is in
+    int64  ack_deadline      = 3; // How long has a consumer got to process and ack a message in nanoseconds
+    int64  message_retention = 4; // How long is an undelivered message kept in nanoseconds
+    RetryPolicy retry_policy = 5; // The retry policy for the subscription
+
+    // How many messages each instance can process concurrently.
+    // If not set, the default is provider-specific.
+    optional int32 max_concurrency = 6;
+  }
+
+  message RetryPolicy {
+    int64 min_backoff = 1; // min backoff in nanoseconds
+    int64 max_backoff = 2; // max backoff in nanoseconds
+    int64 max_retries = 3; // max number of retries
+  }
+
+  enum DeliveryGuarantee {
+    AT_LEAST_ONCE = 0; // All messages will be delivered to each subscription at least once
+    EXACTLY_ONCE  = 1; // All messages will be delivered to each subscription exactly once
+  }
+}
+
+message CacheCluster {
+  string            name            = 1; // The pub sub topic name (unique per application)
+  string            doc             = 2; // The documentation for the topic
+  repeated Keyspace keyspaces       = 3; // The publishers for this topic
+  string            eviction_policy = 4; // redis eviction policy
+
+  message Keyspace {
+    schema.v1.Type key_type     = 1;
+    schema.v1.Type value_type   = 2;
+    string         service      = 3;
+    string         doc          = 4;
+    Path           path_pattern = 5;
+  }
+}
+
+message Metric {
+  string            name         = 1; // the name of the metric
+  schema.v1.Builtin value_type   = 2;
+  string            doc          = 3; // the doc string
+  MetricKind        kind         = 4;
+  optional string   service_name = 5; // the service the metric is exclusive to, if any.
+  repeated Label    labels       = 6;
+
+  enum MetricKind {
+    COUNTER = 0;
+    GAUGE = 1;
+    HISTOGRAM = 2;
+  }
+
+  message Label {
+    string key             = 1;
+    schema.v1.Builtin type = 2;
+    string doc             = 3;
+  }
+}
diff --git a/proto/encore/parser/schema/v1/schema.pb.go b/proto/encore/parser/schema/v1/schema.pb.go
index 7e17027231..313fa1c82f 100644
--- a/proto/encore/parser/schema/v1/schema.pb.go
+++ b/proto/encore/parser/schema/v1/schema.pb.go
@@ -1,13 +1,12 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.14.0
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.23.4
 // source: encore/parser/schema/v1/schema.proto
 
 package v1
 
 import (
-	proto "github.com/golang/protobuf/proto"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	reflect "reflect"
@@ -21,13 +20,12 @@ const (
 	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
 )
 
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
+// Builtin represents a type which Encore (and Go) have inbuilt support for and so can be represented by Encore's tooling
+// directly, rather than needing to understand the full implementation details of how the type is structured.
 type Builtin int32
 
 const (
+	// Inbuilt Go Types
 	Builtin_ANY     Builtin = 0
 	Builtin_BOOL    Builtin = 1
 	Builtin_INT8    Builtin = 2
@@ -42,10 +40,14 @@ const (
 	Builtin_FLOAT64 Builtin = 11
 	Builtin_STRING  Builtin = 12
 	Builtin_BYTES   Builtin = 13
+	// Additional Encore Types
 	Builtin_TIME    Builtin = 14
 	Builtin_UUID    Builtin = 15
 	Builtin_JSON    Builtin = 16
 	Builtin_USER_ID Builtin = 17
+	Builtin_INT     Builtin = 18
+	Builtin_UINT    Builtin = 19
+	Builtin_DECIMAL Builtin = 20
 )
 
 // Enum value maps for Builtin.
@@ -69,6 +71,9 @@ var (
 		15: "UUID",
 		16: "JSON",
 		17: "USER_ID",
+		18: "INT",
+		19: "UINT",
+		20: "DECIMAL",
 	}
 	Builtin_value = map[string]int32{
 		"ANY":     0,
@@ -89,6 +94,9 @@ var (
 		"UUID":    15,
 		"JSON":    16,
 		"USER_ID": 17,
+		"INT":     18,
+		"UINT":    19,
+		"DECIMAL": 20,
 	}
 )
 
@@ -119,18 +127,79 @@ func (Builtin) EnumDescriptor() ([]byte, []int) {
 	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{0}
 }
 
+type ValidationRule_Is int32
+
+const (
+	ValidationRule_UNKNOWN ValidationRule_Is = 0
+	ValidationRule_EMAIL   ValidationRule_Is = 1
+	ValidationRule_URL     ValidationRule_Is = 2
+)
+
+// Enum value maps for ValidationRule_Is.
+var (
+	ValidationRule_Is_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "EMAIL",
+		2: "URL",
+	}
+	ValidationRule_Is_value = map[string]int32{
+		"UNKNOWN": 0,
+		"EMAIL":   1,
+		"URL":     2,
+	}
+)
+
+func (x ValidationRule_Is) Enum() *ValidationRule_Is {
+	p := new(ValidationRule_Is)
+	*p = x
+	return p
+}
+
+func (x ValidationRule_Is) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ValidationRule_Is) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_parser_schema_v1_schema_proto_enumTypes[1].Descriptor()
+}
+
+func (ValidationRule_Is) Type() protoreflect.EnumType {
+	return &file_encore_parser_schema_v1_schema_proto_enumTypes[1]
+}
+
+func (x ValidationRule_Is) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ValidationRule_Is.Descriptor instead.
+func (ValidationRule_Is) EnumDescriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{1, 0}
+}
+
+// Type represents the base of our schema on which everything else is built on-top of. It has to be one, and only one,
+// thing from our list of meta types.
+//
+// A type may be concrete or abstract, however to determine if a type is abstract you need to recursive through the
+// structures looking for any uses of the TypeParameterPtr type
 type Type struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
 	// Types that are assignable to Typ:
+	//
 	//	*Type_Named
 	//	*Type_Struct
 	//	*Type_Map
 	//	*Type_List
 	//	*Type_Builtin
-	Typ isType_Typ `protobuf_oneof:"typ"`
+	//	*Type_Pointer
+	//	*Type_Union
+	//	*Type_Literal
+	//	*Type_TypeParameter
+	//	*Type_Config
+	Typ        isType_Typ      `protobuf_oneof:"typ"`
+	Validation *ValidationExpr `protobuf:"bytes,15,opt,name=validation,proto3,oneof" json:"validation,omitempty"` // The validation expression for this type
 }
 
 func (x *Type) Reset() {
@@ -207,28 +276,93 @@ func (x *Type) GetBuiltin() Builtin {
 	return Builtin_ANY
 }
 
+func (x *Type) GetPointer() *Pointer {
+	if x, ok := x.GetTyp().(*Type_Pointer); ok {
+		return x.Pointer
+	}
+	return nil
+}
+
+func (x *Type) GetUnion() *Union {
+	if x, ok := x.GetTyp().(*Type_Union); ok {
+		return x.Union
+	}
+	return nil
+}
+
+func (x *Type) GetLiteral() *Literal {
+	if x, ok := x.GetTyp().(*Type_Literal); ok {
+		return x.Literal
+	}
+	return nil
+}
+
+func (x *Type) GetTypeParameter() *TypeParameterRef {
+	if x, ok := x.GetTyp().(*Type_TypeParameter); ok {
+		return x.TypeParameter
+	}
+	return nil
+}
+
+func (x *Type) GetConfig() *ConfigValue {
+	if x, ok := x.GetTyp().(*Type_Config); ok {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *Type) GetValidation() *ValidationExpr {
+	if x != nil {
+		return x.Validation
+	}
+	return nil
+}
+
 type isType_Typ interface {
 	isType_Typ()
 }
 
 type Type_Named struct {
-	Named *Named `protobuf:"bytes,1,opt,name=named,proto3,oneof"`
+	// Concrete / non-parameterized Types
+	Named *Named `protobuf:"bytes,1,opt,name=named,proto3,oneof"` // A "named" type (https://tip.golang.org/ref/spec#Types)
 }
 
 type Type_Struct struct {
-	Struct *Struct `protobuf:"bytes,2,opt,name=struct,proto3,oneof"`
+	Struct *Struct `protobuf:"bytes,2,opt,name=struct,proto3,oneof"` // The type is a struct definition
 }
 
 type Type_Map struct {
-	Map *Map `protobuf:"bytes,3,opt,name=map,proto3,oneof"`
+	Map *Map `protobuf:"bytes,3,opt,name=map,proto3,oneof"` // The type is a map
 }
 
 type Type_List struct {
-	List *List `protobuf:"bytes,4,opt,name=list,proto3,oneof"`
+	List *List `protobuf:"bytes,4,opt,name=list,proto3,oneof"` // The type is a slice
 }
 
 type Type_Builtin struct {
-	Builtin Builtin `protobuf:"varint,5,opt,name=builtin,proto3,enum=encore.parser.schema.v1.Builtin,oneof"`
+	Builtin Builtin `protobuf:"varint,5,opt,name=builtin,proto3,enum=encore.parser.schema.v1.Builtin,oneof"` // The type is one of the base built in types within Go
+}
+
+type Type_Pointer struct {
+	Pointer *Pointer `protobuf:"bytes,8,opt,name=pointer,proto3,oneof"` // The type is a pointer
+}
+
+type Type_Union struct {
+	Union *Union `protobuf:"bytes,9,opt,name=union,proto3,oneof"` // The type is a union
+}
+
+type Type_Literal struct {
+	Literal *Literal `protobuf:"bytes,10,opt,name=literal,proto3,oneof"` // The type is a literal
+}
+
+type Type_TypeParameter struct {
+	// Abstract Types
+	TypeParameter *TypeParameterRef `protobuf:"bytes,6,opt,name=type_parameter,json=typeParameter,proto3,oneof"` // This is placeholder for a unknown type within the declaration block
+}
+
+type Type_Config struct {
+	// Encore Special Types
+	Config *ConfigValue `protobuf:"bytes,7,opt,name=config,proto3,oneof"` // This value is a config value
 }
 
 func (*Type_Named) isType_Typ() {}
@@ -241,20 +375,36 @@ func (*Type_List) isType_Typ() {}
 
 func (*Type_Builtin) isType_Typ() {}
 
-type Decl struct {
+func (*Type_Pointer) isType_Typ() {}
+
+func (*Type_Union) isType_Typ() {}
+
+func (*Type_Literal) isType_Typ() {}
+
+func (*Type_TypeParameter) isType_Typ() {}
+
+func (*Type_Config) isType_Typ() {}
+
+type ValidationRule struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Id   uint32 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
-	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` // type name
-	Type *Type  `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"`
-	Doc  string `protobuf:"bytes,4,opt,name=doc,proto3" json:"doc,omitempty"`
-	Loc  *Loc   `protobuf:"bytes,5,opt,name=loc,proto3" json:"loc,omitempty"`
-}
-
-func (x *Decl) Reset() {
-	*x = Decl{}
+	// Types that are assignable to Rule:
+	//
+	//	*ValidationRule_MinLen
+	//	*ValidationRule_MaxLen
+	//	*ValidationRule_MinVal
+	//	*ValidationRule_MaxVal
+	//	*ValidationRule_StartsWith
+	//	*ValidationRule_EndsWith
+	//	*ValidationRule_MatchesRegexp
+	//	*ValidationRule_Is_
+	Rule isValidationRule_Rule `protobuf_oneof:"rule"`
+}
+
+func (x *ValidationRule) Reset() {
+	*x = ValidationRule{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -262,13 +412,13 @@ func (x *Decl) Reset() {
 	}
 }
 
-func (x *Decl) String() string {
+func (x *ValidationRule) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Decl) ProtoMessage() {}
+func (*ValidationRule) ProtoMessage() {}
 
-func (x *Decl) ProtoReflect() protoreflect.Message {
+func (x *ValidationRule) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -280,64 +430,141 @@ func (x *Decl) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Decl.ProtoReflect.Descriptor instead.
-func (*Decl) Descriptor() ([]byte, []int) {
+// Deprecated: Use ValidationRule.ProtoReflect.Descriptor instead.
+func (*ValidationRule) Descriptor() ([]byte, []int) {
 	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{1}
 }
 
-func (x *Decl) GetId() uint32 {
-	if x != nil {
-		return x.Id
+func (m *ValidationRule) GetRule() isValidationRule_Rule {
+	if m != nil {
+		return m.Rule
+	}
+	return nil
+}
+
+func (x *ValidationRule) GetMinLen() uint64 {
+	if x, ok := x.GetRule().(*ValidationRule_MinLen); ok {
+		return x.MinLen
 	}
 	return 0
 }
 
-func (x *Decl) GetName() string {
-	if x != nil {
-		return x.Name
+func (x *ValidationRule) GetMaxLen() uint64 {
+	if x, ok := x.GetRule().(*ValidationRule_MaxLen); ok {
+		return x.MaxLen
+	}
+	return 0
+}
+
+func (x *ValidationRule) GetMinVal() float64 {
+	if x, ok := x.GetRule().(*ValidationRule_MinVal); ok {
+		return x.MinVal
+	}
+	return 0
+}
+
+func (x *ValidationRule) GetMaxVal() float64 {
+	if x, ok := x.GetRule().(*ValidationRule_MaxVal); ok {
+		return x.MaxVal
+	}
+	return 0
+}
+
+func (x *ValidationRule) GetStartsWith() string {
+	if x, ok := x.GetRule().(*ValidationRule_StartsWith); ok {
+		return x.StartsWith
 	}
 	return ""
 }
 
-func (x *Decl) GetType() *Type {
-	if x != nil {
-		return x.Type
+func (x *ValidationRule) GetEndsWith() string {
+	if x, ok := x.GetRule().(*ValidationRule_EndsWith); ok {
+		return x.EndsWith
 	}
-	return nil
+	return ""
 }
 
-func (x *Decl) GetDoc() string {
-	if x != nil {
-		return x.Doc
+func (x *ValidationRule) GetMatchesRegexp() string {
+	if x, ok := x.GetRule().(*ValidationRule_MatchesRegexp); ok {
+		return x.MatchesRegexp
 	}
 	return ""
 }
 
-func (x *Decl) GetLoc() *Loc {
-	if x != nil {
-		return x.Loc
+func (x *ValidationRule) GetIs() ValidationRule_Is {
+	if x, ok := x.GetRule().(*ValidationRule_Is_); ok {
+		return x.Is
 	}
-	return nil
+	return ValidationRule_UNKNOWN
 }
 
-type Loc struct {
+type isValidationRule_Rule interface {
+	isValidationRule_Rule()
+}
+
+type ValidationRule_MinLen struct {
+	MinLen uint64 `protobuf:"varint,1,opt,name=min_len,json=minLen,proto3,oneof"`
+}
+
+type ValidationRule_MaxLen struct {
+	MaxLen uint64 `protobuf:"varint,2,opt,name=max_len,json=maxLen,proto3,oneof"`
+}
+
+type ValidationRule_MinVal struct {
+	MinVal float64 `protobuf:"fixed64,3,opt,name=min_val,json=minVal,proto3,oneof"`
+}
+
+type ValidationRule_MaxVal struct {
+	MaxVal float64 `protobuf:"fixed64,4,opt,name=max_val,json=maxVal,proto3,oneof"`
+}
+
+type ValidationRule_StartsWith struct {
+	StartsWith string `protobuf:"bytes,5,opt,name=starts_with,json=startsWith,proto3,oneof"`
+}
+
+type ValidationRule_EndsWith struct {
+	EndsWith string `protobuf:"bytes,6,opt,name=ends_with,json=endsWith,proto3,oneof"`
+}
+
+type ValidationRule_MatchesRegexp struct {
+	MatchesRegexp string `protobuf:"bytes,7,opt,name=matches_regexp,json=matchesRegexp,proto3,oneof"`
+}
+
+type ValidationRule_Is_ struct {
+	Is ValidationRule_Is `protobuf:"varint,8,opt,name=is,proto3,enum=encore.parser.schema.v1.ValidationRule_Is,oneof"`
+}
+
+func (*ValidationRule_MinLen) isValidationRule_Rule() {}
+
+func (*ValidationRule_MaxLen) isValidationRule_Rule() {}
+
+func (*ValidationRule_MinVal) isValidationRule_Rule() {}
+
+func (*ValidationRule_MaxVal) isValidationRule_Rule() {}
+
+func (*ValidationRule_StartsWith) isValidationRule_Rule() {}
+
+func (*ValidationRule_EndsWith) isValidationRule_Rule() {}
+
+func (*ValidationRule_MatchesRegexp) isValidationRule_Rule() {}
+
+func (*ValidationRule_Is_) isValidationRule_Rule() {}
+
+type ValidationExpr struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	PkgPath      string `protobuf:"bytes,1,opt,name=pkg_path,json=pkgPath,proto3" json:"pkg_path,omitempty"`
-	PkgName      string `protobuf:"bytes,2,opt,name=pkg_name,json=pkgName,proto3" json:"pkg_name,omitempty"`
-	Filename     string `protobuf:"bytes,3,opt,name=filename,proto3" json:"filename,omitempty"`
-	StartPos     int32  `protobuf:"varint,4,opt,name=start_pos,json=startPos,proto3" json:"start_pos,omitempty"`
-	EndPos       int32  `protobuf:"varint,5,opt,name=end_pos,json=endPos,proto3" json:"end_pos,omitempty"`
-	SrcLineStart int32  `protobuf:"varint,6,opt,name=src_line_start,json=srcLineStart,proto3" json:"src_line_start,omitempty"`
-	SrcLineEnd   int32  `protobuf:"varint,7,opt,name=src_line_end,json=srcLineEnd,proto3" json:"src_line_end,omitempty"`
-	SrcColStart  int32  `protobuf:"varint,8,opt,name=src_col_start,json=srcColStart,proto3" json:"src_col_start,omitempty"`
-	SrcColEnd    int32  `protobuf:"varint,9,opt,name=src_col_end,json=srcColEnd,proto3" json:"src_col_end,omitempty"`
+	// Types that are assignable to Expr:
+	//
+	//	*ValidationExpr_Rule
+	//	*ValidationExpr_And_
+	//	*ValidationExpr_Or_
+	Expr isValidationExpr_Expr `protobuf_oneof:"expr"`
 }
 
-func (x *Loc) Reset() {
-	*x = Loc{}
+func (x *ValidationExpr) Reset() {
+	*x = ValidationExpr{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -345,13 +572,13 @@ func (x *Loc) Reset() {
 	}
 }
 
-func (x *Loc) String() string {
+func (x *ValidationExpr) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Loc) ProtoMessage() {}
+func (*ValidationExpr) ProtoMessage() {}
 
-func (x *Loc) ProtoReflect() protoreflect.Message {
+func (x *ValidationExpr) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -363,84 +590,73 @@ func (x *Loc) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Loc.ProtoReflect.Descriptor instead.
-func (*Loc) Descriptor() ([]byte, []int) {
+// Deprecated: Use ValidationExpr.ProtoReflect.Descriptor instead.
+func (*ValidationExpr) Descriptor() ([]byte, []int) {
 	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{2}
 }
 
-func (x *Loc) GetPkgPath() string {
-	if x != nil {
-		return x.PkgPath
+func (m *ValidationExpr) GetExpr() isValidationExpr_Expr {
+	if m != nil {
+		return m.Expr
 	}
-	return ""
+	return nil
 }
 
-func (x *Loc) GetPkgName() string {
-	if x != nil {
-		return x.PkgName
+func (x *ValidationExpr) GetRule() *ValidationRule {
+	if x, ok := x.GetExpr().(*ValidationExpr_Rule); ok {
+		return x.Rule
 	}
-	return ""
+	return nil
 }
 
-func (x *Loc) GetFilename() string {
-	if x != nil {
-		return x.Filename
+func (x *ValidationExpr) GetAnd() *ValidationExpr_And {
+	if x, ok := x.GetExpr().(*ValidationExpr_And_); ok {
+		return x.And
 	}
-	return ""
+	return nil
 }
 
-func (x *Loc) GetStartPos() int32 {
-	if x != nil {
-		return x.StartPos
+func (x *ValidationExpr) GetOr() *ValidationExpr_Or {
+	if x, ok := x.GetExpr().(*ValidationExpr_Or_); ok {
+		return x.Or
 	}
-	return 0
+	return nil
 }
 
-func (x *Loc) GetEndPos() int32 {
-	if x != nil {
-		return x.EndPos
-	}
-	return 0
+type isValidationExpr_Expr interface {
+	isValidationExpr_Expr()
 }
 
-func (x *Loc) GetSrcLineStart() int32 {
-	if x != nil {
-		return x.SrcLineStart
-	}
-	return 0
+type ValidationExpr_Rule struct {
+	Rule *ValidationRule `protobuf:"bytes,1,opt,name=rule,proto3,oneof"`
 }
 
-func (x *Loc) GetSrcLineEnd() int32 {
-	if x != nil {
-		return x.SrcLineEnd
-	}
-	return 0
+type ValidationExpr_And_ struct {
+	And *ValidationExpr_And `protobuf:"bytes,2,opt,name=and,proto3,oneof"`
 }
 
-func (x *Loc) GetSrcColStart() int32 {
-	if x != nil {
-		return x.SrcColStart
-	}
-	return 0
+type ValidationExpr_Or_ struct {
+	Or *ValidationExpr_Or `protobuf:"bytes,3,opt,name=or,proto3,oneof"`
 }
 
-func (x *Loc) GetSrcColEnd() int32 {
-	if x != nil {
-		return x.SrcColEnd
-	}
-	return 0
-}
+func (*ValidationExpr_Rule) isValidationExpr_Expr() {}
 
-type Named struct {
+func (*ValidationExpr_And_) isValidationExpr_Expr() {}
+
+func (*ValidationExpr_Or_) isValidationExpr_Expr() {}
+
+// TypeParameterRef is a reference to a `TypeParameter` within a declaration block
+type TypeParameterRef struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Id uint32 `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	DeclId   uint32 `protobuf:"varint,1,opt,name=decl_id,json=declId,proto3" json:"decl_id,omitempty"`       // The ID of the declaration block
+	ParamIdx uint32 `protobuf:"varint,2,opt,name=param_idx,json=paramIdx,proto3" json:"param_idx,omitempty"` // The index of the type parameter within the declaration block
 }
 
-func (x *Named) Reset() {
-	*x = Named{}
+func (x *TypeParameterRef) Reset() {
+	*x = TypeParameterRef{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -448,13 +664,13 @@ func (x *Named) Reset() {
 	}
 }
 
-func (x *Named) String() string {
+func (x *TypeParameterRef) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Named) ProtoMessage() {}
+func (*TypeParameterRef) ProtoMessage() {}
 
-func (x *Named) ProtoReflect() protoreflect.Message {
+func (x *TypeParameterRef) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -466,28 +682,67 @@ func (x *Named) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Named.ProtoReflect.Descriptor instead.
-func (*Named) Descriptor() ([]byte, []int) {
+// Deprecated: Use TypeParameterRef.ProtoReflect.Descriptor instead.
+func (*TypeParameterRef) Descriptor() ([]byte, []int) {
 	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{3}
 }
 
-func (x *Named) GetId() uint32 {
+func (x *TypeParameterRef) GetDeclId() uint32 {
 	if x != nil {
-		return x.Id
+		return x.DeclId
 	}
 	return 0
 }
 
-type Struct struct {
+func (x *TypeParameterRef) GetParamIdx() uint32 {
+	if x != nil {
+		return x.ParamIdx
+	}
+	return 0
+}
+
+// Decl represents the declaration of a type within the Go code which is either concrete or _parameterized_. The type is
+// concrete when there are zero type parameters assigned.
+//
+// For example the Go Code:
+// ```go
+// // Set[A] represents our set type
+// type Set[A any] = map[A]struct{}
+// ```
+//
+// Would become:
+// ```go
+//
+//	_ = &Decl{
+//	    id: 1,
+//	    name: "Set",
+//	    type: &Type{
+//	        typ_map: &Map{
+//	            key: &Type { typ_type_parameter: ... reference to "A" type parameter below ... },
+//	            value: &Type { typ_struct: ... empty struct type ... },
+//	        },
+//	    },
+//	    typeParameters: []*TypeParameter{ { name: "A" } },
+//	    doc: "Set[A] represents our set type",
+//	    loc: &Loc { ... },
+//	}
+//
+// ```
+type Decl struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Fields []*Field `protobuf:"bytes,1,rep,name=fields,proto3" json:"fields,omitempty"`
+	Id         uint32           `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`                                  // A internal ID which we can refer to this declaration by
+	Name       string           `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`                               // The name of the type as assigned in the code
+	Type       *Type            `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"`                               // The underlying type of this declaration
+	TypeParams []*TypeParameter `protobuf:"bytes,6,rep,name=type_params,json=typeParams,proto3" json:"type_params,omitempty"` // Any type parameters on this declaration (note; instantiated types used within this declaration would not be captured here)
+	Doc        string           `protobuf:"bytes,4,opt,name=doc,proto3" json:"doc,omitempty"`                                 // The comment block on the type
+	Loc        *Loc             `protobuf:"bytes,5,opt,name=loc,proto3" json:"loc,omitempty"`                                 // The location of the declaration within the project
 }
 
-func (x *Struct) Reset() {
-	*x = Struct{}
+func (x *Decl) Reset() {
+	*x = Decl{}
 	if protoimpl.UnsafeEnabled {
 		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -495,13 +750,13 @@ func (x *Struct) Reset() {
 	}
 }
 
-func (x *Struct) String() string {
+func (x *Decl) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Struct) ProtoMessage() {}
+func (*Decl) ProtoMessage() {}
 
-func (x *Struct) ProtoReflect() protoreflect.Message {
+func (x *Decl) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -513,48 +768,79 @@ func (x *Struct) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Struct.ProtoReflect.Descriptor instead.
-func (*Struct) Descriptor() ([]byte, []int) {
+// Deprecated: Use Decl.ProtoReflect.Descriptor instead.
+func (*Decl) Descriptor() ([]byte, []int) {
 	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{4}
 }
 
-func (x *Struct) GetFields() []*Field {
+func (x *Decl) GetId() uint32 {
 	if x != nil {
-		return x.Fields
+		return x.Id
 	}
-	return nil
+	return 0
 }
 
-type Field struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
+func (x *Decl) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
 
-	Typ  *Type  `protobuf:"bytes,1,opt,name=typ,proto3" json:"typ,omitempty"`
-	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
-	Doc  string `protobuf:"bytes,3,opt,name=doc,proto3" json:"doc,omitempty"`
-	// The optional json name if it's different from the field name.
-	JsonName string `protobuf:"bytes,4,opt,name=json_name,json=jsonName,proto3" json:"json_name,omitempty"`
-	// Whether the field is optional.
-	Optional bool `protobuf:"varint,5,opt,name=optional,proto3" json:"optional,omitempty"`
+func (x *Decl) GetType() *Type {
+	if x != nil {
+		return x.Type
+	}
+	return nil
 }
 
-func (x *Field) Reset() {
-	*x = Field{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
+func (x *Decl) GetTypeParams() []*TypeParameter {
+	if x != nil {
+		return x.TypeParams
 	}
+	return nil
 }
 
-func (x *Field) String() string {
+func (x *Decl) GetDoc() string {
+	if x != nil {
+		return x.Doc
+	}
+	return ""
+}
+
+func (x *Decl) GetLoc() *Loc {
+	if x != nil {
+		return x.Loc
+	}
+	return nil
+}
+
+// TypeParameter acts as a place holder for an (as of yet) unknown type in the declaration; the type parameter is
+// replaced with a type argument upon instantiation of the parameterized function or type.
+type TypeParameter struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` // The identifier given to the type parameter
+}
+
+func (x *TypeParameter) Reset() {
+	*x = TypeParameter{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TypeParameter) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Field) ProtoMessage() {}
+func (*TypeParameter) ProtoMessage() {}
 
-func (x *Field) ProtoReflect() protoreflect.Message {
+func (x *TypeParameter) ProtoReflect() protoreflect.Message {
 	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
@@ -566,72 +852,1118 @@ func (x *Field) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Field.ProtoReflect.Descriptor instead.
-func (*Field) Descriptor() ([]byte, []int) {
+// Deprecated: Use TypeParameter.ProtoReflect.Descriptor instead.
+func (*TypeParameter) Descriptor() ([]byte, []int) {
 	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{5}
 }
 
-func (x *Field) GetTyp() *Type {
+func (x *TypeParameter) GetName() string {
 	if x != nil {
-		return x.Typ
+		return x.Name
 	}
-	return nil
+	return ""
 }
 
-func (x *Field) GetName() string {
+// Loc is the location of a declaration within the code base
+type Loc struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PkgPath      string `protobuf:"bytes,1,opt,name=pkg_path,json=pkgPath,proto3" json:"pkg_path,omitempty"`                   // The package path within the repo (i.e. `users/signup`)
+	PkgName      string `protobuf:"bytes,2,opt,name=pkg_name,json=pkgName,proto3" json:"pkg_name,omitempty"`                   // The package name (i.e. `signup`)
+	Filename     string `protobuf:"bytes,3,opt,name=filename,proto3" json:"filename,omitempty"`                                // The file name (i.e. `signup.go`)
+	StartPos     int32  `protobuf:"varint,4,opt,name=start_pos,json=startPos,proto3" json:"start_pos,omitempty"`               // The starting index within the file for this node
+	EndPos       int32  `protobuf:"varint,5,opt,name=end_pos,json=endPos,proto3" json:"end_pos,omitempty"`                     // The ending index within the file for this node
+	SrcLineStart int32  `protobuf:"varint,6,opt,name=src_line_start,json=srcLineStart,proto3" json:"src_line_start,omitempty"` // The starting line within the file for this node
+	SrcLineEnd   int32  `protobuf:"varint,7,opt,name=src_line_end,json=srcLineEnd,proto3" json:"src_line_end,omitempty"`       // The ending line within the file for this node
+	SrcColStart  int32  `protobuf:"varint,8,opt,name=src_col_start,json=srcColStart,proto3" json:"src_col_start,omitempty"`    // The starting column on the starting line for this node
+	SrcColEnd    int32  `protobuf:"varint,9,opt,name=src_col_end,json=srcColEnd,proto3" json:"src_col_end,omitempty"`          // The ending column on the ending line for this node
+}
+
+func (x *Loc) Reset() {
+	*x = Loc{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Loc) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Loc) ProtoMessage() {}
+
+func (x *Loc) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Loc.ProtoReflect.Descriptor instead.
+func (*Loc) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *Loc) GetPkgPath() string {
 	if x != nil {
-		return x.Name
+		return x.PkgPath
+	}
+	return ""
+}
+
+func (x *Loc) GetPkgName() string {
+	if x != nil {
+		return x.PkgName
+	}
+	return ""
+}
+
+func (x *Loc) GetFilename() string {
+	if x != nil {
+		return x.Filename
 	}
 	return ""
 }
 
-func (x *Field) GetDoc() string {
-	if x != nil {
-		return x.Doc
+func (x *Loc) GetStartPos() int32 {
+	if x != nil {
+		return x.StartPos
+	}
+	return 0
+}
+
+func (x *Loc) GetEndPos() int32 {
+	if x != nil {
+		return x.EndPos
+	}
+	return 0
+}
+
+func (x *Loc) GetSrcLineStart() int32 {
+	if x != nil {
+		return x.SrcLineStart
+	}
+	return 0
+}
+
+func (x *Loc) GetSrcLineEnd() int32 {
+	if x != nil {
+		return x.SrcLineEnd
+	}
+	return 0
+}
+
+func (x *Loc) GetSrcColStart() int32 {
+	if x != nil {
+		return x.SrcColStart
+	}
+	return 0
+}
+
+func (x *Loc) GetSrcColEnd() int32 {
+	if x != nil {
+		return x.SrcColEnd
+	}
+	return 0
+}
+
+// Named references declaration block by name
+type Named struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id            uint32  `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`                                           // The `Decl.id` this name refers to
+	TypeArguments []*Type `protobuf:"bytes,2,rep,name=type_arguments,json=typeArguments,proto3" json:"type_arguments,omitempty"` // The type arguments used to instantiate this parameterised declaration
+}
+
+func (x *Named) Reset() {
+	*x = Named{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Named) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Named) ProtoMessage() {}
+
+func (x *Named) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Named.ProtoReflect.Descriptor instead.
+func (*Named) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *Named) GetId() uint32 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+func (x *Named) GetTypeArguments() []*Type {
+	if x != nil {
+		return x.TypeArguments
+	}
+	return nil
+}
+
+// Struct contains a list of fields which make up the struct
+type Struct struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Fields []*Field `protobuf:"bytes,1,rep,name=fields,proto3" json:"fields,omitempty"`
+}
+
+func (x *Struct) Reset() {
+	*x = Struct{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Struct) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Struct) ProtoMessage() {}
+
+func (x *Struct) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Struct.ProtoReflect.Descriptor instead.
+func (*Struct) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *Struct) GetFields() []*Field {
+	if x != nil {
+		return x.Fields
+	}
+	return nil
+}
+
+// Field represents a field within a struct
+type Field struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Typ             *Type     `protobuf:"bytes,1,opt,name=typ,proto3" json:"typ,omitempty"`                                                  // The type of the field
+	Name            string    `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`                                                // The name of the field
+	Doc             string    `protobuf:"bytes,3,opt,name=doc,proto3" json:"doc,omitempty"`                                                  // The comment for the field
+	JsonName        string    `protobuf:"bytes,4,opt,name=json_name,json=jsonName,proto3" json:"json_name,omitempty"`                        // The optional json name if it's different from the field name. (The value "-" indicates to omit the field.)
+	Optional        bool      `protobuf:"varint,5,opt,name=optional,proto3" json:"optional,omitempty"`                                       // Whether the field is optional.
+	QueryStringName string    `protobuf:"bytes,6,opt,name=query_string_name,json=queryStringName,proto3" json:"query_string_name,omitempty"` // The query string name to use in GET/HEAD/DELETE requests. (The value "-" indicates to omit the field.)
+	RawTag          string    `protobuf:"bytes,7,opt,name=raw_tag,json=rawTag,proto3" json:"raw_tag,omitempty"`                              // The original Go struct tag; should not be parsed individually
+	Tags            []*Tag    `protobuf:"bytes,8,rep,name=tags,proto3" json:"tags,omitempty"`                                                // Parsed go struct tags. Used for marshalling hints
+	Wire            *WireSpec `protobuf:"bytes,9,opt,name=wire,proto3,oneof" json:"wire,omitempty"`                                          // The explicitly set wire location of the field.
+}
+
+func (x *Field) Reset() {
+	*x = Field{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Field) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Field) ProtoMessage() {}
+
+func (x *Field) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Field.ProtoReflect.Descriptor instead.
+func (*Field) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *Field) GetTyp() *Type {
+	if x != nil {
+		return x.Typ
+	}
+	return nil
+}
+
+func (x *Field) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Field) GetDoc() string {
+	if x != nil {
+		return x.Doc
+	}
+	return ""
+}
+
+func (x *Field) GetJsonName() string {
+	if x != nil {
+		return x.JsonName
+	}
+	return ""
+}
+
+func (x *Field) GetOptional() bool {
+	if x != nil {
+		return x.Optional
+	}
+	return false
+}
+
+func (x *Field) GetQueryStringName() string {
+	if x != nil {
+		return x.QueryStringName
+	}
+	return ""
+}
+
+func (x *Field) GetRawTag() string {
+	if x != nil {
+		return x.RawTag
+	}
+	return ""
+}
+
+func (x *Field) GetTags() []*Tag {
+	if x != nil {
+		return x.Tags
+	}
+	return nil
+}
+
+func (x *Field) GetWire() *WireSpec {
+	if x != nil {
+		return x.Wire
+	}
+	return nil
+}
+
+// WireLocation provides information about how a field should be encoded on the wire.
+type WireSpec struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Location:
+	//
+	//	*WireSpec_Header_
+	//	*WireSpec_Query_
+	//	*WireSpec_Cookie_
+	//	*WireSpec_HttpStatus_
+	Location isWireSpec_Location `protobuf_oneof:"location"`
+}
+
+func (x *WireSpec) Reset() {
+	*x = WireSpec{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WireSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WireSpec) ProtoMessage() {}
+
+func (x *WireSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WireSpec.ProtoReflect.Descriptor instead.
+func (*WireSpec) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{10}
+}
+
+func (m *WireSpec) GetLocation() isWireSpec_Location {
+	if m != nil {
+		return m.Location
+	}
+	return nil
+}
+
+func (x *WireSpec) GetHeader() *WireSpec_Header {
+	if x, ok := x.GetLocation().(*WireSpec_Header_); ok {
+		return x.Header
+	}
+	return nil
+}
+
+func (x *WireSpec) GetQuery() *WireSpec_Query {
+	if x, ok := x.GetLocation().(*WireSpec_Query_); ok {
+		return x.Query
+	}
+	return nil
+}
+
+func (x *WireSpec) GetCookie() *WireSpec_Cookie {
+	if x, ok := x.GetLocation().(*WireSpec_Cookie_); ok {
+		return x.Cookie
+	}
+	return nil
+}
+
+func (x *WireSpec) GetHttpStatus() *WireSpec_HttpStatus {
+	if x, ok := x.GetLocation().(*WireSpec_HttpStatus_); ok {
+		return x.HttpStatus
+	}
+	return nil
+}
+
+type isWireSpec_Location interface {
+	isWireSpec_Location()
+}
+
+type WireSpec_Header_ struct {
+	Header *WireSpec_Header `protobuf:"bytes,1,opt,name=header,proto3,oneof"`
+}
+
+type WireSpec_Query_ struct {
+	Query *WireSpec_Query `protobuf:"bytes,2,opt,name=query,proto3,oneof"`
+}
+
+type WireSpec_Cookie_ struct {
+	Cookie *WireSpec_Cookie `protobuf:"bytes,3,opt,name=cookie,proto3,oneof"`
+}
+
+type WireSpec_HttpStatus_ struct {
+	HttpStatus *WireSpec_HttpStatus `protobuf:"bytes,4,opt,name=http_status,json=httpStatus,proto3,oneof"`
+}
+
+func (*WireSpec_Header_) isWireSpec_Location() {}
+
+func (*WireSpec_Query_) isWireSpec_Location() {}
+
+func (*WireSpec_Cookie_) isWireSpec_Location() {}
+
+func (*WireSpec_HttpStatus_) isWireSpec_Location() {}
+
+type Tag struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key     string   `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`         // The tag key (e.g. json, query, header ...)
+	Name    string   `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`       // The tag name (e.g. first_name, firstName, ...)
+	Options []string `protobuf:"bytes,3,rep,name=options,proto3" json:"options,omitempty"` // Key Options (e.g. omitempty, optional ...)
+}
+
+func (x *Tag) Reset() {
+	*x = Tag{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Tag) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Tag) ProtoMessage() {}
+
+func (x *Tag) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Tag.ProtoReflect.Descriptor instead.
+func (*Tag) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *Tag) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *Tag) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Tag) GetOptions() []string {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+// Map represents a map Type
+type Map struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Key   *Type `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`     // The type of the key for this map
+	Value *Type `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"` // The type of the value of this map
+}
+
+func (x *Map) Reset() {
+	*x = Map{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Map) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Map) ProtoMessage() {}
+
+func (x *Map) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Map.ProtoReflect.Descriptor instead.
+func (*Map) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *Map) GetKey() *Type {
+	if x != nil {
+		return x.Key
+	}
+	return nil
+}
+
+func (x *Map) GetValue() *Type {
+	if x != nil {
+		return x.Value
+	}
+	return nil
+}
+
+// List represents a list type (array or slice)
+type List struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Elem *Type `protobuf:"bytes,1,opt,name=elem,proto3" json:"elem,omitempty"` // The type of the elements in the list
+}
+
+func (x *List) Reset() {
+	*x = List{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *List) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*List) ProtoMessage() {}
+
+func (x *List) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use List.ProtoReflect.Descriptor instead.
+func (*List) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *List) GetElem() *Type {
+	if x != nil {
+		return x.Elem
+	}
+	return nil
+}
+
+// Pointer represents a pointer to a base type
+type Pointer struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Base *Type `protobuf:"bytes,1,opt,name=base,proto3" json:"base,omitempty"` // The type of the pointer
+}
+
+func (x *Pointer) Reset() {
+	*x = Pointer{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Pointer) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Pointer) ProtoMessage() {}
+
+func (x *Pointer) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Pointer.ProtoReflect.Descriptor instead.
+func (*Pointer) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *Pointer) GetBase() *Type {
+	if x != nil {
+		return x.Base
+	}
+	return nil
+}
+
+// Union represents a union type.
+type Union struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Types []*Type `protobuf:"bytes,1,rep,name=types,proto3" json:"types,omitempty"` // The types that make up the union
+}
+
+func (x *Union) Reset() {
+	*x = Union{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Union) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Union) ProtoMessage() {}
+
+func (x *Union) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Union.ProtoReflect.Descriptor instead.
+func (*Union) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *Union) GetTypes() []*Type {
+	if x != nil {
+		return x.Types
+	}
+	return nil
+}
+
+// Literal represents a literal value.
+type Literal struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Value:
+	//
+	//	*Literal_Str
+	//	*Literal_Boolean
+	//	*Literal_Int
+	//	*Literal_Float
+	//	*Literal_Null
+	Value isLiteral_Value `protobuf_oneof:"value"`
+}
+
+func (x *Literal) Reset() {
+	*x = Literal{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Literal) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Literal) ProtoMessage() {}
+
+func (x *Literal) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Literal.ProtoReflect.Descriptor instead.
+func (*Literal) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{16}
+}
+
+func (m *Literal) GetValue() isLiteral_Value {
+	if m != nil {
+		return m.Value
+	}
+	return nil
+}
+
+func (x *Literal) GetStr() string {
+	if x, ok := x.GetValue().(*Literal_Str); ok {
+		return x.Str
+	}
+	return ""
+}
+
+func (x *Literal) GetBoolean() bool {
+	if x, ok := x.GetValue().(*Literal_Boolean); ok {
+		return x.Boolean
+	}
+	return false
+}
+
+func (x *Literal) GetInt() int64 {
+	if x, ok := x.GetValue().(*Literal_Int); ok {
+		return x.Int
+	}
+	return 0
+}
+
+func (x *Literal) GetFloat() float64 {
+	if x, ok := x.GetValue().(*Literal_Float); ok {
+		return x.Float
+	}
+	return 0
+}
+
+func (x *Literal) GetNull() bool {
+	if x, ok := x.GetValue().(*Literal_Null); ok {
+		return x.Null
+	}
+	return false
+}
+
+type isLiteral_Value interface {
+	isLiteral_Value()
+}
+
+type Literal_Str struct {
+	Str string `protobuf:"bytes,1,opt,name=str,proto3,oneof"`
+}
+
+type Literal_Boolean struct {
+	Boolean bool `protobuf:"varint,2,opt,name=boolean,proto3,oneof"`
+}
+
+type Literal_Int struct {
+	Int int64 `protobuf:"varint,3,opt,name=int,proto3,oneof"`
+}
+
+type Literal_Float struct {
+	Float float64 `protobuf:"fixed64,4,opt,name=float,proto3,oneof"`
+}
+
+type Literal_Null struct {
+	Null bool `protobuf:"varint,5,opt,name=null,proto3,oneof"`
+}
+
+func (*Literal_Str) isLiteral_Value() {}
+
+func (*Literal_Boolean) isLiteral_Value() {}
+
+func (*Literal_Int) isLiteral_Value() {}
+
+func (*Literal_Float) isLiteral_Value() {}
+
+func (*Literal_Null) isLiteral_Value() {}
+
+// ConfigValue represents a config value wrapper.
+type ConfigValue struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Elem         *Type `protobuf:"bytes,1,opt,name=elem,proto3" json:"elem,omitempty"`                  // The type of the config value
+	IsValuesList bool  `protobuf:"varint,2,opt,name=IsValuesList,proto3" json:"IsValuesList,omitempty"` // Does this config value represent the type to `config.Values[T]`. If false it represents `config.Value[T]`
+}
+
+func (x *ConfigValue) Reset() {
+	*x = ConfigValue{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ConfigValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ConfigValue) ProtoMessage() {}
+
+func (x *ConfigValue) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ConfigValue.ProtoReflect.Descriptor instead.
+func (*ConfigValue) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *ConfigValue) GetElem() *Type {
+	if x != nil {
+		return x.Elem
+	}
+	return nil
+}
+
+func (x *ConfigValue) GetIsValuesList() bool {
+	if x != nil {
+		return x.IsValuesList
+	}
+	return false
+}
+
+type ValidationExpr_And struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Exprs []*ValidationExpr `protobuf:"bytes,1,rep,name=exprs,proto3" json:"exprs,omitempty"`
+}
+
+func (x *ValidationExpr_And) Reset() {
+	*x = ValidationExpr_And{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ValidationExpr_And) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ValidationExpr_And) ProtoMessage() {}
+
+func (x *ValidationExpr_And) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ValidationExpr_And.ProtoReflect.Descriptor instead.
+func (*ValidationExpr_And) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{2, 0}
+}
+
+func (x *ValidationExpr_And) GetExprs() []*ValidationExpr {
+	if x != nil {
+		return x.Exprs
+	}
+	return nil
+}
+
+type ValidationExpr_Or struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Exprs []*ValidationExpr `protobuf:"bytes,1,rep,name=exprs,proto3" json:"exprs,omitempty"`
+}
+
+func (x *ValidationExpr_Or) Reset() {
+	*x = ValidationExpr_Or{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ValidationExpr_Or) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ValidationExpr_Or) ProtoMessage() {}
+
+func (x *ValidationExpr_Or) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ValidationExpr_Or.ProtoReflect.Descriptor instead.
+func (*ValidationExpr_Or) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{2, 1}
+}
+
+func (x *ValidationExpr_Or) GetExprs() []*ValidationExpr {
+	if x != nil {
+		return x.Exprs
+	}
+	return nil
+}
+
+type WireSpec_Header struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The explicitly specified header name.
+	// If empty, the name of the field is used.
+	Name *string `protobuf:"bytes,1,opt,name=name,proto3,oneof" json:"name,omitempty"`
+}
+
+func (x *WireSpec_Header) Reset() {
+	*x = WireSpec_Header{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WireSpec_Header) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WireSpec_Header) ProtoMessage() {}
+
+func (x *WireSpec_Header) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WireSpec_Header.ProtoReflect.Descriptor instead.
+func (*WireSpec_Header) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{10, 0}
+}
+
+func (x *WireSpec_Header) GetName() string {
+	if x != nil && x.Name != nil {
+		return *x.Name
+	}
+	return ""
+}
+
+type WireSpec_Query struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The explicitly specified query string name.
+	// If empty, the name of the field is used.
+	Name *string `protobuf:"bytes,1,opt,name=name,proto3,oneof" json:"name,omitempty"`
+}
+
+func (x *WireSpec_Query) Reset() {
+	*x = WireSpec_Query{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WireSpec_Query) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WireSpec_Query) ProtoMessage() {}
+
+func (x *WireSpec_Query) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
 	}
-	return ""
+	return mi.MessageOf(x)
 }
 
-func (x *Field) GetJsonName() string {
-	if x != nil {
-		return x.JsonName
-	}
-	return ""
+// Deprecated: Use WireSpec_Query.ProtoReflect.Descriptor instead.
+func (*WireSpec_Query) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{10, 1}
 }
 
-func (x *Field) GetOptional() bool {
-	if x != nil {
-		return x.Optional
+func (x *WireSpec_Query) GetName() string {
+	if x != nil && x.Name != nil {
+		return *x.Name
 	}
-	return false
+	return ""
 }
 
-type Map struct {
+type WireSpec_Cookie struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
 
-	Key   *Type `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-	Value *Type `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	// The explicitly specified cookie string name.
+	// If empty, the name of the field is used.
+	Name *string `protobuf:"bytes,1,opt,name=name,proto3,oneof" json:"name,omitempty"`
 }
 
-func (x *Map) Reset() {
-	*x = Map{}
+func (x *WireSpec_Cookie) Reset() {
+	*x = WireSpec_Cookie{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[6]
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[22]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *Map) String() string {
+func (x *WireSpec_Cookie) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*Map) ProtoMessage() {}
+func (*WireSpec_Cookie) ProtoMessage() {}
 
-func (x *Map) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[6]
+func (x *WireSpec_Cookie) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[22]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -642,50 +1974,41 @@ func (x *Map) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use Map.ProtoReflect.Descriptor instead.
-func (*Map) Descriptor() ([]byte, []int) {
-	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *Map) GetKey() *Type {
-	if x != nil {
-		return x.Key
-	}
-	return nil
+// Deprecated: Use WireSpec_Cookie.ProtoReflect.Descriptor instead.
+func (*WireSpec_Cookie) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{10, 2}
 }
 
-func (x *Map) GetValue() *Type {
-	if x != nil {
-		return x.Value
+func (x *WireSpec_Cookie) GetName() string {
+	if x != nil && x.Name != nil {
+		return *x.Name
 	}
-	return nil
+	return ""
 }
 
-type List struct {
+type WireSpec_HttpStatus struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
 	unknownFields protoimpl.UnknownFields
-
-	Elem *Type `protobuf:"bytes,1,opt,name=elem,proto3" json:"elem,omitempty"`
 }
 
-func (x *List) Reset() {
-	*x = List{}
+func (x *WireSpec_HttpStatus) Reset() {
+	*x = WireSpec_HttpStatus{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[7]
+		mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[23]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
 }
 
-func (x *List) String() string {
+func (x *WireSpec_HttpStatus) String() string {
 	return protoimpl.X.MessageStringOf(x)
 }
 
-func (*List) ProtoMessage() {}
+func (*WireSpec_HttpStatus) ProtoMessage() {}
 
-func (x *List) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[7]
+func (x *WireSpec_HttpStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_parser_schema_v1_schema_proto_msgTypes[23]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -696,16 +2019,9 @@ func (x *List) ProtoReflect() protoreflect.Message {
 	return mi.MessageOf(x)
 }
 
-// Deprecated: Use List.ProtoReflect.Descriptor instead.
-func (*List) Descriptor() ([]byte, []int) {
-	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *List) GetElem() *Type {
-	if x != nil {
-		return x.Elem
-	}
-	return nil
+// Deprecated: Use WireSpec_HttpStatus.ProtoReflect.Descriptor instead.
+func (*WireSpec_HttpStatus) Descriptor() ([]byte, []int) {
+	return file_encore_parser_schema_v1_schema_proto_rawDescGZIP(), []int{10, 3}
 }
 
 var File_encore_parser_schema_v1_schema_proto protoreflect.FileDescriptor
@@ -715,7 +2031,7 @@ var file_encore_parser_schema_v1_schema_proto_rawDesc = []byte{
 	0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61,
 	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x17, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70,
 	0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x22,
-	0xa5, 0x02, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x36, 0x0a, 0x05, 0x6e, 0x61, 0x6d, 0x65,
+	0xca, 0x05, 0x0a, 0x04, 0x54, 0x79, 0x70, 0x65, 0x12, 0x36, 0x0a, 0x05, 0x6e, 0x61, 0x6d, 0x65,
 	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
 	0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76,
 	0x31, 0x2e, 0x4e, 0x61, 0x6d, 0x65, 0x64, 0x48, 0x00, 0x52, 0x05, 0x6e, 0x61, 0x6d, 0x65, 0x64,
@@ -733,77 +2049,232 @@ var file_encore_parser_schema_v1_schema_proto_rawDesc = []byte{
 	0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72,
 	0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75,
 	0x69, 0x6c, 0x74, 0x69, 0x6e, 0x48, 0x00, 0x52, 0x07, 0x62, 0x75, 0x69, 0x6c, 0x74, 0x69, 0x6e,
-	0x42, 0x05, 0x0a, 0x03, 0x74, 0x79, 0x70, 0x22, 0x9f, 0x01, 0x0a, 0x04, 0x44, 0x65, 0x63, 0x6c,
-	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x02, 0x69, 0x64,
-	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
-	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x31, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73,
-	0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70,
-	0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x12, 0x2e, 0x0a, 0x03, 0x6c, 0x6f, 0x63,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
-	0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31,
-	0x2e, 0x4c, 0x6f, 0x63, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x22, 0x99, 0x02, 0x0a, 0x03, 0x4c, 0x6f,
-	0x63, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x6b, 0x67, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x6b, 0x67, 0x50, 0x61, 0x74, 0x68, 0x12, 0x19, 0x0a, 0x08,
-	0x70, 0x6b, 0x67, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
-	0x70, 0x6b, 0x67, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e,
-	0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e,
-	0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x70, 0x6f, 0x73,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x08, 0x73, 0x74, 0x61, 0x72, 0x74, 0x50, 0x6f, 0x73,
-	0x12, 0x17, 0x0a, 0x07, 0x65, 0x6e, 0x64, 0x5f, 0x70, 0x6f, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x05, 0x52, 0x06, 0x65, 0x6e, 0x64, 0x50, 0x6f, 0x73, 0x12, 0x24, 0x0a, 0x0e, 0x73, 0x72, 0x63,
-	0x5f, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x05, 0x52, 0x0c, 0x73, 0x72, 0x63, 0x4c, 0x69, 0x6e, 0x65, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12,
-	0x20, 0x0a, 0x0c, 0x73, 0x72, 0x63, 0x5f, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x65, 0x6e, 0x64, 0x18,
-	0x07, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a, 0x73, 0x72, 0x63, 0x4c, 0x69, 0x6e, 0x65, 0x45, 0x6e,
-	0x64, 0x12, 0x22, 0x0a, 0x0d, 0x73, 0x72, 0x63, 0x5f, 0x63, 0x6f, 0x6c, 0x5f, 0x73, 0x74, 0x61,
-	0x72, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0b, 0x73, 0x72, 0x63, 0x43, 0x6f, 0x6c,
-	0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x1e, 0x0a, 0x0b, 0x73, 0x72, 0x63, 0x5f, 0x63, 0x6f, 0x6c,
-	0x5f, 0x65, 0x6e, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x05, 0x52, 0x09, 0x73, 0x72, 0x63, 0x43,
-	0x6f, 0x6c, 0x45, 0x6e, 0x64, 0x22, 0x17, 0x0a, 0x05, 0x4e, 0x61, 0x6d, 0x65, 0x64, 0x12, 0x0e,
-	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x02, 0x69, 0x64, 0x22, 0x40,
-	0x0a, 0x06, 0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x12, 0x36, 0x0a, 0x06, 0x66, 0x69, 0x65, 0x6c,
-	0x64, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e,
-	0x76, 0x31, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x52, 0x06, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x73,
-	0x22, 0x97, 0x01, 0x0a, 0x05, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x2f, 0x0a, 0x03, 0x74, 0x79,
-	0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x12, 0x3c, 0x0a, 0x07, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x18, 0x08, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65,
+	0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x6f, 0x69, 0x6e,
+	0x74, 0x65, 0x72, 0x48, 0x00, 0x52, 0x07, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x12, 0x36,
+	0x0a, 0x05, 0x75, 0x6e, 0x69, 0x6f, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1e, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63,
+	0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x55, 0x6e, 0x69, 0x6f, 0x6e, 0x48, 0x00, 0x52,
+	0x05, 0x75, 0x6e, 0x69, 0x6f, 0x6e, 0x12, 0x3c, 0x0a, 0x07, 0x6c, 0x69, 0x74, 0x65, 0x72, 0x61,
+	0x6c, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
 	0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76,
-	0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x03, 0x74, 0x79, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x6e,
-	0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
-	0x10, 0x0a, 0x03, 0x64, 0x6f, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6f,
-	0x63, 0x12, 0x1b, 0x0a, 0x09, 0x6a, 0x73, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x6a, 0x73, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1a,
-	0x0a, 0x08, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x08, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x22, 0x6b, 0x0a, 0x03, 0x4d, 0x61,
-	0x70, 0x12, 0x2f, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d,
+	0x31, 0x2e, 0x4c, 0x69, 0x74, 0x65, 0x72, 0x61, 0x6c, 0x48, 0x00, 0x52, 0x07, 0x6c, 0x69, 0x74,
+	0x65, 0x72, 0x61, 0x6c, 0x12, 0x52, 0x0a, 0x0e, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x70, 0x61, 0x72,
+	0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x50, 0x61, 0x72, 0x61, 0x6d,
+	0x65, 0x74, 0x65, 0x72, 0x52, 0x65, 0x66, 0x48, 0x00, 0x52, 0x0d, 0x74, 0x79, 0x70, 0x65, 0x50,
+	0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x12, 0x3e, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e,
+	0x76, 0x31, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x48, 0x00,
+	0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x4c, 0x0a, 0x0a, 0x76, 0x61, 0x6c, 0x69,
+	0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x45, 0x78, 0x70, 0x72, 0x48, 0x01, 0x52, 0x0a, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x88, 0x01, 0x01, 0x42, 0x05, 0x0a, 0x03, 0x74, 0x79, 0x70, 0x42, 0x0d, 0x0a,
+	0x0b, 0x5f, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0xd4, 0x02, 0x0a,
+	0x0e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x75, 0x6c, 0x65, 0x12,
+	0x19, 0x0a, 0x07, 0x6d, 0x69, 0x6e, 0x5f, 0x6c, 0x65, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
+	0x48, 0x00, 0x52, 0x06, 0x6d, 0x69, 0x6e, 0x4c, 0x65, 0x6e, 0x12, 0x19, 0x0a, 0x07, 0x6d, 0x61,
+	0x78, 0x5f, 0x6c, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x48, 0x00, 0x52, 0x06, 0x6d,
+	0x61, 0x78, 0x4c, 0x65, 0x6e, 0x12, 0x19, 0x0a, 0x07, 0x6d, 0x69, 0x6e, 0x5f, 0x76, 0x61, 0x6c,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x01, 0x48, 0x00, 0x52, 0x06, 0x6d, 0x69, 0x6e, 0x56, 0x61, 0x6c,
+	0x12, 0x19, 0x0a, 0x07, 0x6d, 0x61, 0x78, 0x5f, 0x76, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x01, 0x48, 0x00, 0x52, 0x06, 0x6d, 0x61, 0x78, 0x56, 0x61, 0x6c, 0x12, 0x21, 0x0a, 0x0b, 0x73,
+	0x74, 0x61, 0x72, 0x74, 0x73, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09,
+	0x48, 0x00, 0x52, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x73, 0x57, 0x69, 0x74, 0x68, 0x12, 0x1d,
+	0x0a, 0x09, 0x65, 0x6e, 0x64, 0x73, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x18, 0x06, 0x20, 0x01, 0x28,
+	0x09, 0x48, 0x00, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x73, 0x57, 0x69, 0x74, 0x68, 0x12, 0x27, 0x0a,
+	0x0e, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73, 0x5f, 0x72, 0x65, 0x67, 0x65, 0x78, 0x70, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x0d, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x73,
+	0x52, 0x65, 0x67, 0x65, 0x78, 0x70, 0x12, 0x3c, 0x0a, 0x02, 0x69, 0x73, 0x18, 0x08, 0x20, 0x01,
+	0x28, 0x0e, 0x32, 0x2a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73,
+	0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x56, 0x61, 0x6c,
+	0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x75, 0x6c, 0x65, 0x2e, 0x49, 0x73, 0x48, 0x00,
+	0x52, 0x02, 0x69, 0x73, 0x22, 0x25, 0x0a, 0x02, 0x49, 0x73, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e,
+	0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x4d, 0x41, 0x49, 0x4c,
+	0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x55, 0x52, 0x4c, 0x10, 0x02, 0x42, 0x06, 0x0a, 0x04, 0x72,
+	0x75, 0x6c, 0x65, 0x22, 0xe1, 0x02, 0x0a, 0x0e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x45, 0x78, 0x70, 0x72, 0x12, 0x3d, 0x0a, 0x04, 0x72, 0x75, 0x6c, 0x65, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x56,
+	0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x75, 0x6c, 0x65, 0x48, 0x00, 0x52,
+	0x04, 0x72, 0x75, 0x6c, 0x65, 0x12, 0x3f, 0x0a, 0x03, 0x61, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73,
+	0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x56, 0x61, 0x6c,
+	0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x72, 0x2e, 0x41, 0x6e, 0x64, 0x48,
+	0x00, 0x52, 0x03, 0x61, 0x6e, 0x64, 0x12, 0x3c, 0x0a, 0x02, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73,
+	0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x56, 0x61, 0x6c,
+	0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x72, 0x2e, 0x4f, 0x72, 0x48, 0x00,
+	0x52, 0x02, 0x6f, 0x72, 0x1a, 0x44, 0x0a, 0x03, 0x41, 0x6e, 0x64, 0x12, 0x3d, 0x0a, 0x05, 0x65,
+	0x78, 0x70, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d,
+	0x61, 0x2e, 0x76, 0x31, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45,
+	0x78, 0x70, 0x72, 0x52, 0x05, 0x65, 0x78, 0x70, 0x72, 0x73, 0x1a, 0x43, 0x0a, 0x02, 0x4f, 0x72,
+	0x12, 0x3d, 0x0a, 0x05, 0x65, 0x78, 0x70, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x27, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e,
+	0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x45, 0x78, 0x70, 0x72, 0x52, 0x05, 0x65, 0x78, 0x70, 0x72, 0x73, 0x42,
+	0x06, 0x0a, 0x04, 0x65, 0x78, 0x70, 0x72, 0x22, 0x48, 0x0a, 0x10, 0x54, 0x79, 0x70, 0x65, 0x50,
+	0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x52, 0x65, 0x66, 0x12, 0x17, 0x0a, 0x07, 0x64,
+	0x65, 0x63, 0x6c, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x06, 0x64, 0x65,
+	0x63, 0x6c, 0x49, 0x64, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x5f, 0x69, 0x64,
+	0x78, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x08, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x49, 0x64,
+	0x78, 0x22, 0xe8, 0x01, 0x0a, 0x04, 0x44, 0x65, 0x63, 0x6c, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x31,
+	0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68,
+	0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70,
+	0x65, 0x12, 0x47, 0x0a, 0x0b, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x73,
+	0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31,
+	0x2e, 0x54, 0x79, 0x70, 0x65, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x52, 0x0a,
+	0x74, 0x79, 0x70, 0x65, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x64, 0x6f,
+	0x63, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x12, 0x2e, 0x0a, 0x03,
+	0x6c, 0x6f, 0x63, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61,
+	0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x63, 0x52, 0x03, 0x6c, 0x6f, 0x63, 0x22, 0x23, 0x0a, 0x0d,
+	0x54, 0x79, 0x70, 0x65, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x12, 0x12, 0x0a,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x22, 0x99, 0x02, 0x0a, 0x03, 0x4c, 0x6f, 0x63, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x6b, 0x67,
+	0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x6b, 0x67,
+	0x50, 0x61, 0x74, 0x68, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x6b, 0x67, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x70, 0x6b, 0x67, 0x4e, 0x61, 0x6d, 0x65, 0x12,
+	0x1a, 0x0a, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x73,
+	0x74, 0x61, 0x72, 0x74, 0x5f, 0x70, 0x6f, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x08,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x50, 0x6f, 0x73, 0x12, 0x17, 0x0a, 0x07, 0x65, 0x6e, 0x64, 0x5f,
+	0x70, 0x6f, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x65, 0x6e, 0x64, 0x50, 0x6f,
+	0x73, 0x12, 0x24, 0x0a, 0x0e, 0x73, 0x72, 0x63, 0x5f, 0x6c, 0x69, 0x6e, 0x65, 0x5f, 0x73, 0x74,
+	0x61, 0x72, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0c, 0x73, 0x72, 0x63, 0x4c, 0x69,
+	0x6e, 0x65, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x20, 0x0a, 0x0c, 0x73, 0x72, 0x63, 0x5f, 0x6c,
+	0x69, 0x6e, 0x65, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x07, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a, 0x73,
+	0x72, 0x63, 0x4c, 0x69, 0x6e, 0x65, 0x45, 0x6e, 0x64, 0x12, 0x22, 0x0a, 0x0d, 0x73, 0x72, 0x63,
+	0x5f, 0x63, 0x6f, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x05,
+	0x52, 0x0b, 0x73, 0x72, 0x63, 0x43, 0x6f, 0x6c, 0x53, 0x74, 0x61, 0x72, 0x74, 0x12, 0x1e, 0x0a,
+	0x0b, 0x73, 0x72, 0x63, 0x5f, 0x63, 0x6f, 0x6c, 0x5f, 0x65, 0x6e, 0x64, 0x18, 0x09, 0x20, 0x01,
+	0x28, 0x05, 0x52, 0x09, 0x73, 0x72, 0x63, 0x43, 0x6f, 0x6c, 0x45, 0x6e, 0x64, 0x22, 0x5d, 0x0a,
+	0x05, 0x4e, 0x61, 0x6d, 0x65, 0x64, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0d, 0x52, 0x02, 0x69, 0x64, 0x12, 0x44, 0x0a, 0x0e, 0x74, 0x79, 0x70, 0x65, 0x5f, 0x61,
+	0x72, 0x67, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d,
 	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73,
-	0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x03, 0x6b,
-	0x65, 0x79, 0x12, 0x33, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65,
-	0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65,
-	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x39, 0x0a, 0x04, 0x4c, 0x69, 0x73, 0x74, 0x12,
-	0x31, 0x0a, 0x04, 0x65, 0x6c, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
+	0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x0d, 0x74,
+	0x79, 0x70, 0x65, 0x41, 0x72, 0x67, 0x75, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x40, 0x0a, 0x06,
+	0x53, 0x74, 0x72, 0x75, 0x63, 0x74, 0x12, 0x36, 0x0a, 0x06, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31,
+	0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x52, 0x06, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x73, 0x22, 0xd3,
+	0x02, 0x0a, 0x05, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x12, 0x2f, 0x0a, 0x03, 0x74, 0x79, 0x70, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70,
+	0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e,
+	0x54, 0x79, 0x70, 0x65, 0x52, 0x03, 0x74, 0x79, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x10, 0x0a,
+	0x03, 0x64, 0x6f, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x64, 0x6f, 0x63, 0x12,
+	0x1b, 0x0a, 0x09, 0x6a, 0x73, 0x6f, 0x6e, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x08, 0x6a, 0x73, 0x6f, 0x6e, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1a, 0x0a, 0x08,
+	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08,
+	0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x12, 0x2a, 0x0a, 0x11, 0x71, 0x75, 0x65, 0x72,
+	0x79, 0x5f, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x06, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0f, 0x71, 0x75, 0x65, 0x72, 0x79, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x17, 0x0a, 0x07, 0x72, 0x61, 0x77, 0x5f, 0x74, 0x61, 0x67, 0x18,
+	0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x61, 0x77, 0x54, 0x61, 0x67, 0x12, 0x30, 0x0a,
+	0x04, 0x74, 0x61, 0x67, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65,
+	0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x61, 0x67, 0x52, 0x04, 0x74, 0x61, 0x67, 0x73, 0x12,
+	0x3a, 0x0a, 0x04, 0x77, 0x69, 0x72, 0x65, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63,
+	0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x69, 0x72, 0x65, 0x53, 0x70, 0x65, 0x63,
+	0x48, 0x00, 0x52, 0x04, 0x77, 0x69, 0x72, 0x65, 0x88, 0x01, 0x01, 0x42, 0x07, 0x0a, 0x05, 0x5f,
+	0x77, 0x69, 0x72, 0x65, 0x22, 0xc1, 0x03, 0x0a, 0x08, 0x57, 0x69, 0x72, 0x65, 0x53, 0x70, 0x65,
+	0x63, 0x12, 0x42, 0x0a, 0x06, 0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65,
+	0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x69, 0x72, 0x65,
+	0x53, 0x70, 0x65, 0x63, 0x2e, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x48, 0x00, 0x52, 0x06, 0x68,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x3f, 0x0a, 0x05, 0x71, 0x75, 0x65, 0x72, 0x79, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x57,
+	0x69, 0x72, 0x65, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x48, 0x00, 0x52,
+	0x05, 0x71, 0x75, 0x65, 0x72, 0x79, 0x12, 0x42, 0x0a, 0x06, 0x63, 0x6f, 0x6f, 0x6b, 0x69, 0x65,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31,
+	0x2e, 0x57, 0x69, 0x72, 0x65, 0x53, 0x70, 0x65, 0x63, 0x2e, 0x43, 0x6f, 0x6f, 0x6b, 0x69, 0x65,
+	0x48, 0x00, 0x52, 0x06, 0x63, 0x6f, 0x6f, 0x6b, 0x69, 0x65, 0x12, 0x4f, 0x0a, 0x0b, 0x68, 0x74,
+	0x74, 0x70, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x2c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e,
+	0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x57, 0x69, 0x72, 0x65, 0x53, 0x70,
+	0x65, 0x63, 0x2e, 0x48, 0x74, 0x74, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x48, 0x00, 0x52,
+	0x0a, 0x68, 0x74, 0x74, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x1a, 0x2a, 0x0a, 0x06, 0x48,
+	0x65, 0x61, 0x64, 0x65, 0x72, 0x12, 0x17, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x88, 0x01, 0x01, 0x42, 0x07,
+	0x0a, 0x05, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x1a, 0x29, 0x0a, 0x05, 0x51, 0x75, 0x65, 0x72, 0x79,
+	0x12, 0x17, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00,
+	0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x88, 0x01, 0x01, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x6e, 0x61,
+	0x6d, 0x65, 0x1a, 0x2a, 0x0a, 0x06, 0x43, 0x6f, 0x6f, 0x6b, 0x69, 0x65, 0x12, 0x17, 0x0a, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x88, 0x01, 0x01, 0x42, 0x07, 0x0a, 0x05, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x1a, 0x0c,
+	0x0a, 0x0a, 0x48, 0x74, 0x74, 0x70, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x42, 0x0a, 0x0a, 0x08,
+	0x6c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x22, 0x45, 0x0a, 0x03, 0x54, 0x61, 0x67, 0x12,
+	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
+	0x79, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22,
+	0x6b, 0x0a, 0x03, 0x4d, 0x61, 0x70, 0x12, 0x2f, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72,
+	0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79,
+	0x70, 0x65, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x33, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31,
+	0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x39, 0x0a, 0x04,
+	0x4c, 0x69, 0x73, 0x74, 0x12, 0x31, 0x0a, 0x04, 0x65, 0x6c, 0x65, 0x6d, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73,
+	0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70,
+	0x65, 0x52, 0x04, 0x65, 0x6c, 0x65, 0x6d, 0x22, 0x3c, 0x0a, 0x07, 0x50, 0x6f, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x12, 0x31, 0x0a, 0x04, 0x62, 0x61, 0x73, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72,
+	0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52,
+	0x04, 0x62, 0x61, 0x73, 0x65, 0x22, 0x3c, 0x0a, 0x05, 0x55, 0x6e, 0x69, 0x6f, 0x6e, 0x12, 0x33,
+	0x0a, 0x05, 0x74, 0x79, 0x70, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
 	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63,
-	0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x65, 0x6c,
-	0x65, 0x6d, 0x2a, 0xd2, 0x01, 0x0a, 0x07, 0x42, 0x75, 0x69, 0x6c, 0x74, 0x69, 0x6e, 0x12, 0x07,
-	0x0a, 0x03, 0x41, 0x4e, 0x59, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x42, 0x4f, 0x4f, 0x4c, 0x10,
-	0x01, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x4e, 0x54, 0x38, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x49,
-	0x4e, 0x54, 0x31, 0x36, 0x10, 0x03, 0x12, 0x09, 0x0a, 0x05, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10,
-	0x04, 0x12, 0x09, 0x0a, 0x05, 0x49, 0x4e, 0x54, 0x36, 0x34, 0x10, 0x05, 0x12, 0x09, 0x0a, 0x05,
-	0x55, 0x49, 0x4e, 0x54, 0x38, 0x10, 0x06, 0x12, 0x0a, 0x0a, 0x06, 0x55, 0x49, 0x4e, 0x54, 0x31,
-	0x36, 0x10, 0x07, 0x12, 0x0a, 0x0a, 0x06, 0x55, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x08, 0x12,
-	0x0a, 0x0a, 0x06, 0x55, 0x49, 0x4e, 0x54, 0x36, 0x34, 0x10, 0x09, 0x12, 0x0b, 0x0a, 0x07, 0x46,
-	0x4c, 0x4f, 0x41, 0x54, 0x33, 0x32, 0x10, 0x0a, 0x12, 0x0b, 0x0a, 0x07, 0x46, 0x4c, 0x4f, 0x41,
-	0x54, 0x36, 0x34, 0x10, 0x0b, 0x12, 0x0a, 0x0a, 0x06, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x10,
-	0x0c, 0x12, 0x09, 0x0a, 0x05, 0x42, 0x59, 0x54, 0x45, 0x53, 0x10, 0x0d, 0x12, 0x08, 0x0a, 0x04,
-	0x54, 0x49, 0x4d, 0x45, 0x10, 0x0e, 0x12, 0x08, 0x0a, 0x04, 0x55, 0x55, 0x49, 0x44, 0x10, 0x0f,
-	0x12, 0x08, 0x0a, 0x04, 0x4a, 0x53, 0x4f, 0x4e, 0x10, 0x10, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x53,
-	0x45, 0x52, 0x5f, 0x49, 0x44, 0x10, 0x11, 0x42, 0x28, 0x5a, 0x26, 0x65, 0x6e, 0x63, 0x72, 0x2e,
-	0x64, 0x65, 0x76, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
-	0x2f, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2f, 0x76,
-	0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x05, 0x74, 0x79,
+	0x70, 0x65, 0x73, 0x22, 0x84, 0x01, 0x0a, 0x07, 0x4c, 0x69, 0x74, 0x65, 0x72, 0x61, 0x6c, 0x12,
+	0x12, 0x0a, 0x03, 0x73, 0x74, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x03,
+	0x73, 0x74, 0x72, 0x12, 0x1a, 0x0a, 0x07, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x07, 0x62, 0x6f, 0x6f, 0x6c, 0x65, 0x61, 0x6e, 0x12,
+	0x12, 0x0a, 0x03, 0x69, 0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x48, 0x00, 0x52, 0x03,
+	0x69, 0x6e, 0x74, 0x12, 0x16, 0x0a, 0x05, 0x66, 0x6c, 0x6f, 0x61, 0x74, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x01, 0x48, 0x00, 0x52, 0x05, 0x66, 0x6c, 0x6f, 0x61, 0x74, 0x12, 0x14, 0x0a, 0x04, 0x6e,
+	0x75, 0x6c, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x04, 0x6e, 0x75, 0x6c,
+	0x6c, 0x42, 0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x64, 0x0a, 0x0b, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x31, 0x0a, 0x04, 0x65, 0x6c, 0x65,
+	0x6d, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2e, 0x76,
+	0x31, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x65, 0x6c, 0x65, 0x6d, 0x12, 0x22, 0x0a, 0x0c,
+	0x49, 0x73, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x4c, 0x69, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0c, 0x49, 0x73, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x4c, 0x69, 0x73, 0x74,
+	0x2a, 0xf2, 0x01, 0x0a, 0x07, 0x42, 0x75, 0x69, 0x6c, 0x74, 0x69, 0x6e, 0x12, 0x07, 0x0a, 0x03,
+	0x41, 0x4e, 0x59, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x42, 0x4f, 0x4f, 0x4c, 0x10, 0x01, 0x12,
+	0x08, 0x0a, 0x04, 0x49, 0x4e, 0x54, 0x38, 0x10, 0x02, 0x12, 0x09, 0x0a, 0x05, 0x49, 0x4e, 0x54,
+	0x31, 0x36, 0x10, 0x03, 0x12, 0x09, 0x0a, 0x05, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x04, 0x12,
+	0x09, 0x0a, 0x05, 0x49, 0x4e, 0x54, 0x36, 0x34, 0x10, 0x05, 0x12, 0x09, 0x0a, 0x05, 0x55, 0x49,
+	0x4e, 0x54, 0x38, 0x10, 0x06, 0x12, 0x0a, 0x0a, 0x06, 0x55, 0x49, 0x4e, 0x54, 0x31, 0x36, 0x10,
+	0x07, 0x12, 0x0a, 0x0a, 0x06, 0x55, 0x49, 0x4e, 0x54, 0x33, 0x32, 0x10, 0x08, 0x12, 0x0a, 0x0a,
+	0x06, 0x55, 0x49, 0x4e, 0x54, 0x36, 0x34, 0x10, 0x09, 0x12, 0x0b, 0x0a, 0x07, 0x46, 0x4c, 0x4f,
+	0x41, 0x54, 0x33, 0x32, 0x10, 0x0a, 0x12, 0x0b, 0x0a, 0x07, 0x46, 0x4c, 0x4f, 0x41, 0x54, 0x36,
+	0x34, 0x10, 0x0b, 0x12, 0x0a, 0x0a, 0x06, 0x53, 0x54, 0x52, 0x49, 0x4e, 0x47, 0x10, 0x0c, 0x12,
+	0x09, 0x0a, 0x05, 0x42, 0x59, 0x54, 0x45, 0x53, 0x10, 0x0d, 0x12, 0x08, 0x0a, 0x04, 0x54, 0x49,
+	0x4d, 0x45, 0x10, 0x0e, 0x12, 0x08, 0x0a, 0x04, 0x55, 0x55, 0x49, 0x44, 0x10, 0x0f, 0x12, 0x08,
+	0x0a, 0x04, 0x4a, 0x53, 0x4f, 0x4e, 0x10, 0x10, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x53, 0x45, 0x52,
+	0x5f, 0x49, 0x44, 0x10, 0x11, 0x12, 0x07, 0x0a, 0x03, 0x49, 0x4e, 0x54, 0x10, 0x12, 0x12, 0x08,
+	0x0a, 0x04, 0x55, 0x49, 0x4e, 0x54, 0x10, 0x13, 0x12, 0x0b, 0x0a, 0x07, 0x44, 0x45, 0x43, 0x49,
+	0x4d, 0x41, 0x4c, 0x10, 0x14, 0x42, 0x28, 0x5a, 0x26, 0x65, 0x6e, 0x63, 0x72, 0x2e, 0x64, 0x65,
+	0x76, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x70,
+	0x61, 0x72, 0x73, 0x65, 0x72, 0x2f, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x2f, 0x76, 0x31, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -818,37 +2289,77 @@ func file_encore_parser_schema_v1_schema_proto_rawDescGZIP() []byte {
 	return file_encore_parser_schema_v1_schema_proto_rawDescData
 }
 
-var file_encore_parser_schema_v1_schema_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_encore_parser_schema_v1_schema_proto_msgTypes = make([]protoimpl.MessageInfo, 8)
+var file_encore_parser_schema_v1_schema_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_encore_parser_schema_v1_schema_proto_msgTypes = make([]protoimpl.MessageInfo, 24)
 var file_encore_parser_schema_v1_schema_proto_goTypes = []interface{}{
-	(Builtin)(0),   // 0: encore.parser.schema.v1.Builtin
-	(*Type)(nil),   // 1: encore.parser.schema.v1.Type
-	(*Decl)(nil),   // 2: encore.parser.schema.v1.Decl
-	(*Loc)(nil),    // 3: encore.parser.schema.v1.Loc
-	(*Named)(nil),  // 4: encore.parser.schema.v1.Named
-	(*Struct)(nil), // 5: encore.parser.schema.v1.Struct
-	(*Field)(nil),  // 6: encore.parser.schema.v1.Field
-	(*Map)(nil),    // 7: encore.parser.schema.v1.Map
-	(*List)(nil),   // 8: encore.parser.schema.v1.List
+	(Builtin)(0),                // 0: encore.parser.schema.v1.Builtin
+	(ValidationRule_Is)(0),      // 1: encore.parser.schema.v1.ValidationRule.Is
+	(*Type)(nil),                // 2: encore.parser.schema.v1.Type
+	(*ValidationRule)(nil),      // 3: encore.parser.schema.v1.ValidationRule
+	(*ValidationExpr)(nil),      // 4: encore.parser.schema.v1.ValidationExpr
+	(*TypeParameterRef)(nil),    // 5: encore.parser.schema.v1.TypeParameterRef
+	(*Decl)(nil),                // 6: encore.parser.schema.v1.Decl
+	(*TypeParameter)(nil),       // 7: encore.parser.schema.v1.TypeParameter
+	(*Loc)(nil),                 // 8: encore.parser.schema.v1.Loc
+	(*Named)(nil),               // 9: encore.parser.schema.v1.Named
+	(*Struct)(nil),              // 10: encore.parser.schema.v1.Struct
+	(*Field)(nil),               // 11: encore.parser.schema.v1.Field
+	(*WireSpec)(nil),            // 12: encore.parser.schema.v1.WireSpec
+	(*Tag)(nil),                 // 13: encore.parser.schema.v1.Tag
+	(*Map)(nil),                 // 14: encore.parser.schema.v1.Map
+	(*List)(nil),                // 15: encore.parser.schema.v1.List
+	(*Pointer)(nil),             // 16: encore.parser.schema.v1.Pointer
+	(*Union)(nil),               // 17: encore.parser.schema.v1.Union
+	(*Literal)(nil),             // 18: encore.parser.schema.v1.Literal
+	(*ConfigValue)(nil),         // 19: encore.parser.schema.v1.ConfigValue
+	(*ValidationExpr_And)(nil),  // 20: encore.parser.schema.v1.ValidationExpr.And
+	(*ValidationExpr_Or)(nil),   // 21: encore.parser.schema.v1.ValidationExpr.Or
+	(*WireSpec_Header)(nil),     // 22: encore.parser.schema.v1.WireSpec.Header
+	(*WireSpec_Query)(nil),      // 23: encore.parser.schema.v1.WireSpec.Query
+	(*WireSpec_Cookie)(nil),     // 24: encore.parser.schema.v1.WireSpec.Cookie
+	(*WireSpec_HttpStatus)(nil), // 25: encore.parser.schema.v1.WireSpec.HttpStatus
 }
 var file_encore_parser_schema_v1_schema_proto_depIdxs = []int32{
-	4,  // 0: encore.parser.schema.v1.Type.named:type_name -> encore.parser.schema.v1.Named
-	5,  // 1: encore.parser.schema.v1.Type.struct:type_name -> encore.parser.schema.v1.Struct
-	7,  // 2: encore.parser.schema.v1.Type.map:type_name -> encore.parser.schema.v1.Map
-	8,  // 3: encore.parser.schema.v1.Type.list:type_name -> encore.parser.schema.v1.List
+	9,  // 0: encore.parser.schema.v1.Type.named:type_name -> encore.parser.schema.v1.Named
+	10, // 1: encore.parser.schema.v1.Type.struct:type_name -> encore.parser.schema.v1.Struct
+	14, // 2: encore.parser.schema.v1.Type.map:type_name -> encore.parser.schema.v1.Map
+	15, // 3: encore.parser.schema.v1.Type.list:type_name -> encore.parser.schema.v1.List
 	0,  // 4: encore.parser.schema.v1.Type.builtin:type_name -> encore.parser.schema.v1.Builtin
-	1,  // 5: encore.parser.schema.v1.Decl.type:type_name -> encore.parser.schema.v1.Type
-	3,  // 6: encore.parser.schema.v1.Decl.loc:type_name -> encore.parser.schema.v1.Loc
-	6,  // 7: encore.parser.schema.v1.Struct.fields:type_name -> encore.parser.schema.v1.Field
-	1,  // 8: encore.parser.schema.v1.Field.typ:type_name -> encore.parser.schema.v1.Type
-	1,  // 9: encore.parser.schema.v1.Map.key:type_name -> encore.parser.schema.v1.Type
-	1,  // 10: encore.parser.schema.v1.Map.value:type_name -> encore.parser.schema.v1.Type
-	1,  // 11: encore.parser.schema.v1.List.elem:type_name -> encore.parser.schema.v1.Type
-	12, // [12:12] is the sub-list for method output_type
-	12, // [12:12] is the sub-list for method input_type
-	12, // [12:12] is the sub-list for extension type_name
-	12, // [12:12] is the sub-list for extension extendee
-	0,  // [0:12] is the sub-list for field type_name
+	16, // 5: encore.parser.schema.v1.Type.pointer:type_name -> encore.parser.schema.v1.Pointer
+	17, // 6: encore.parser.schema.v1.Type.union:type_name -> encore.parser.schema.v1.Union
+	18, // 7: encore.parser.schema.v1.Type.literal:type_name -> encore.parser.schema.v1.Literal
+	5,  // 8: encore.parser.schema.v1.Type.type_parameter:type_name -> encore.parser.schema.v1.TypeParameterRef
+	19, // 9: encore.parser.schema.v1.Type.config:type_name -> encore.parser.schema.v1.ConfigValue
+	4,  // 10: encore.parser.schema.v1.Type.validation:type_name -> encore.parser.schema.v1.ValidationExpr
+	1,  // 11: encore.parser.schema.v1.ValidationRule.is:type_name -> encore.parser.schema.v1.ValidationRule.Is
+	3,  // 12: encore.parser.schema.v1.ValidationExpr.rule:type_name -> encore.parser.schema.v1.ValidationRule
+	20, // 13: encore.parser.schema.v1.ValidationExpr.and:type_name -> encore.parser.schema.v1.ValidationExpr.And
+	21, // 14: encore.parser.schema.v1.ValidationExpr.or:type_name -> encore.parser.schema.v1.ValidationExpr.Or
+	2,  // 15: encore.parser.schema.v1.Decl.type:type_name -> encore.parser.schema.v1.Type
+	7,  // 16: encore.parser.schema.v1.Decl.type_params:type_name -> encore.parser.schema.v1.TypeParameter
+	8,  // 17: encore.parser.schema.v1.Decl.loc:type_name -> encore.parser.schema.v1.Loc
+	2,  // 18: encore.parser.schema.v1.Named.type_arguments:type_name -> encore.parser.schema.v1.Type
+	11, // 19: encore.parser.schema.v1.Struct.fields:type_name -> encore.parser.schema.v1.Field
+	2,  // 20: encore.parser.schema.v1.Field.typ:type_name -> encore.parser.schema.v1.Type
+	13, // 21: encore.parser.schema.v1.Field.tags:type_name -> encore.parser.schema.v1.Tag
+	12, // 22: encore.parser.schema.v1.Field.wire:type_name -> encore.parser.schema.v1.WireSpec
+	22, // 23: encore.parser.schema.v1.WireSpec.header:type_name -> encore.parser.schema.v1.WireSpec.Header
+	23, // 24: encore.parser.schema.v1.WireSpec.query:type_name -> encore.parser.schema.v1.WireSpec.Query
+	24, // 25: encore.parser.schema.v1.WireSpec.cookie:type_name -> encore.parser.schema.v1.WireSpec.Cookie
+	25, // 26: encore.parser.schema.v1.WireSpec.http_status:type_name -> encore.parser.schema.v1.WireSpec.HttpStatus
+	2,  // 27: encore.parser.schema.v1.Map.key:type_name -> encore.parser.schema.v1.Type
+	2,  // 28: encore.parser.schema.v1.Map.value:type_name -> encore.parser.schema.v1.Type
+	2,  // 29: encore.parser.schema.v1.List.elem:type_name -> encore.parser.schema.v1.Type
+	2,  // 30: encore.parser.schema.v1.Pointer.base:type_name -> encore.parser.schema.v1.Type
+	2,  // 31: encore.parser.schema.v1.Union.types:type_name -> encore.parser.schema.v1.Type
+	2,  // 32: encore.parser.schema.v1.ConfigValue.elem:type_name -> encore.parser.schema.v1.Type
+	4,  // 33: encore.parser.schema.v1.ValidationExpr.And.exprs:type_name -> encore.parser.schema.v1.ValidationExpr
+	4,  // 34: encore.parser.schema.v1.ValidationExpr.Or.exprs:type_name -> encore.parser.schema.v1.ValidationExpr
+	35, // [35:35] is the sub-list for method output_type
+	35, // [35:35] is the sub-list for method input_type
+	35, // [35:35] is the sub-list for extension type_name
+	35, // [35:35] is the sub-list for extension extendee
+	0,  // [0:35] is the sub-list for field type_name
 }
 
 func init() { file_encore_parser_schema_v1_schema_proto_init() }
@@ -870,7 +2381,7 @@ func file_encore_parser_schema_v1_schema_proto_init() {
 			}
 		}
 		file_encore_parser_schema_v1_schema_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Decl); i {
+			switch v := v.(*ValidationRule); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -882,7 +2393,7 @@ func file_encore_parser_schema_v1_schema_proto_init() {
 			}
 		}
 		file_encore_parser_schema_v1_schema_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Loc); i {
+			switch v := v.(*ValidationExpr); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -894,7 +2405,7 @@ func file_encore_parser_schema_v1_schema_proto_init() {
 			}
 		}
 		file_encore_parser_schema_v1_schema_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Named); i {
+			switch v := v.(*TypeParameterRef); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -906,7 +2417,7 @@ func file_encore_parser_schema_v1_schema_proto_init() {
 			}
 		}
 		file_encore_parser_schema_v1_schema_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Struct); i {
+			switch v := v.(*Decl); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -918,7 +2429,7 @@ func file_encore_parser_schema_v1_schema_proto_init() {
 			}
 		}
 		file_encore_parser_schema_v1_schema_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Field); i {
+			switch v := v.(*TypeParameter); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -930,7 +2441,7 @@ func file_encore_parser_schema_v1_schema_proto_init() {
 			}
 		}
 		file_encore_parser_schema_v1_schema_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Map); i {
+			switch v := v.(*Loc); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -942,6 +2453,78 @@ func file_encore_parser_schema_v1_schema_proto_init() {
 			}
 		}
 		file_encore_parser_schema_v1_schema_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Named); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Struct); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Field); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WireSpec); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Tag); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Map); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*List); i {
 			case 0:
 				return &v.state
@@ -953,6 +2536,126 @@ func file_encore_parser_schema_v1_schema_proto_init() {
 				return nil
 			}
 		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Pointer); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Union); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Literal); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ConfigValue); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ValidationExpr_And); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ValidationExpr_Or); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WireSpec_Header); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WireSpec_Query); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WireSpec_Cookie); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_parser_schema_v1_schema_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WireSpec_HttpStatus); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	file_encore_parser_schema_v1_schema_proto_msgTypes[0].OneofWrappers = []interface{}{
 		(*Type_Named)(nil),
@@ -960,14 +2663,51 @@ func file_encore_parser_schema_v1_schema_proto_init() {
 		(*Type_Map)(nil),
 		(*Type_List)(nil),
 		(*Type_Builtin)(nil),
+		(*Type_Pointer)(nil),
+		(*Type_Union)(nil),
+		(*Type_Literal)(nil),
+		(*Type_TypeParameter)(nil),
+		(*Type_Config)(nil),
+	}
+	file_encore_parser_schema_v1_schema_proto_msgTypes[1].OneofWrappers = []interface{}{
+		(*ValidationRule_MinLen)(nil),
+		(*ValidationRule_MaxLen)(nil),
+		(*ValidationRule_MinVal)(nil),
+		(*ValidationRule_MaxVal)(nil),
+		(*ValidationRule_StartsWith)(nil),
+		(*ValidationRule_EndsWith)(nil),
+		(*ValidationRule_MatchesRegexp)(nil),
+		(*ValidationRule_Is_)(nil),
+	}
+	file_encore_parser_schema_v1_schema_proto_msgTypes[2].OneofWrappers = []interface{}{
+		(*ValidationExpr_Rule)(nil),
+		(*ValidationExpr_And_)(nil),
+		(*ValidationExpr_Or_)(nil),
+	}
+	file_encore_parser_schema_v1_schema_proto_msgTypes[9].OneofWrappers = []interface{}{}
+	file_encore_parser_schema_v1_schema_proto_msgTypes[10].OneofWrappers = []interface{}{
+		(*WireSpec_Header_)(nil),
+		(*WireSpec_Query_)(nil),
+		(*WireSpec_Cookie_)(nil),
+		(*WireSpec_HttpStatus_)(nil),
+	}
+	file_encore_parser_schema_v1_schema_proto_msgTypes[16].OneofWrappers = []interface{}{
+		(*Literal_Str)(nil),
+		(*Literal_Boolean)(nil),
+		(*Literal_Int)(nil),
+		(*Literal_Float)(nil),
+		(*Literal_Null)(nil),
 	}
+	file_encore_parser_schema_v1_schema_proto_msgTypes[20].OneofWrappers = []interface{}{}
+	file_encore_parser_schema_v1_schema_proto_msgTypes[21].OneofWrappers = []interface{}{}
+	file_encore_parser_schema_v1_schema_proto_msgTypes[22].OneofWrappers = []interface{}{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_encore_parser_schema_v1_schema_proto_rawDesc,
-			NumEnums:      1,
-			NumMessages:   8,
+			NumEnums:      2,
+			NumMessages:   24,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/proto/encore/parser/schema/v1/schema.pb.ts b/proto/encore/parser/schema/v1/schema.pb.ts
new file mode 100644
index 0000000000..dfcbdae2f3
--- /dev/null
+++ b/proto/encore/parser/schema/v1/schema.pb.ts
@@ -0,0 +1,209 @@
+/* eslint-disable */
+export const protobufPackage = "encore.parser.schema.v1";
+
+/**
+ * Builtin represents a type which Encore (and Go) have inbuilt support for and so can be represented by Encore's tooling
+ * directly, rather than needing to understand the full implementation details of how the type is structured.
+ */
+export enum Builtin {
+  /** ANY - Inbuilt Go Types */
+  ANY = "ANY",
+  BOOL = "BOOL",
+  INT8 = "INT8",
+  INT16 = "INT16",
+  INT32 = "INT32",
+  INT64 = "INT64",
+  UINT8 = "UINT8",
+  UINT16 = "UINT16",
+  UINT32 = "UINT32",
+  UINT64 = "UINT64",
+  FLOAT32 = "FLOAT32",
+  FLOAT64 = "FLOAT64",
+  STRING = "STRING",
+  BYTES = "BYTES",
+  /** TIME - Additional Encore Types */
+  TIME = "TIME",
+  UUID = "UUID",
+  JSON = "JSON",
+  USER_ID = "USER_ID",
+  INT = "INT",
+  UINT = "UINT",
+  UNRECOGNIZED = "UNRECOGNIZED",
+}
+
+/**
+ * Type represents the base of our schema on which everything else is built on-top of. It has to be one, and only one,
+ * thing from our list of meta types.
+ *
+ * A type may be concrete or abstract, however to determine if a type is abstract you need to recursive through the
+ * structures looking for any uses of the TypeParameterPtr type
+ */
+export interface Type {
+  /** Concrete / non-parameterized Types */
+  named: Named | undefined;
+  /** The type is a struct definition */
+  struct: Struct | undefined;
+  /** The type is a map */
+  map: Map | undefined;
+  /** The type is a slice */
+  list: List | undefined;
+  /** The type is one of the base built in types within Go */
+  builtin: Builtin | undefined;
+  /** The type is a pointer */
+  pointer: Pointer | undefined;
+  /** Abstract Types */
+  type_parameter: TypeParameterRef | undefined;
+  /** Encore Special Types */
+  config: ConfigValue | undefined;
+}
+
+/** TypeParameterRef is a reference to a `TypeParameter` within a declaration block */
+export interface TypeParameterRef {
+  /** The ID of the declaration block */
+  decl_id: number;
+  /** The index of the type parameter within the declaration block */
+  param_idx: number;
+}
+
+/**
+ * Decl represents the declaration of a type within the Go code which is either concrete or _parameterized_. The type is
+ * concrete when there are zero type parameters assigned.
+ *
+ * For example the Go Code:
+ * ```
+ * // Set[A] represents our set type
+ * type Set[A any] = map[A]struct{}
+ * ```
+ *
+ * Would become:
+ * ```
+ * _ = &Decl{
+ *     id: 1,
+ *     name: "Set",
+ *     type: &Type{
+ *         typ_map: &Map{
+ *             key: &Type { typ_type_parameter: ... reference to "A" type parameter below ... },
+ *             value: &Type { typ_struct: ... empty struct type ... },
+ *         },
+ *     },
+ *     typeParameters: []*TypeParameter{ { name: "A" } },
+ *     doc: "Set[A] represents our set type",
+ *     loc: &Loc { ... },
+ * }
+ * ```
+ */
+export interface Decl {
+  /** A internal ID which we can refer to this declaration by */
+  id: number;
+  /** The name of the type as assigned in the code */
+  name: string;
+  /** The underlying type of this declaration */
+  type: Type;
+  /** Any type parameters on this declaration (note; instantiated types used within this declaration would not be captured here) */
+  type_params: TypeParameter[];
+  /** The comment block on the type */
+  doc: string;
+  /** The location of the declaration within the project */
+  loc: Loc;
+}
+
+/**
+ * TypeParameter acts as a place holder for an (as of yet) unknown type in the declaration; the type parameter is
+ * replaced with a type argument upon instantiation of the parameterized function or type.
+ */
+export interface TypeParameter {
+  /** The identifier given to the type parameter */
+  name: string;
+}
+
+/** Loc is the location of a declaration within the code base */
+export interface Loc {
+  /** The package path within the repo (i.e. `users/signup`) */
+  pkg_path: string;
+  /** The package name (i.e. `signup`) */
+  pkg_name: string;
+  /** The file name (i.e. `signup.go`) */
+  filename: string;
+  /** The starting index within the file for this node */
+  start_pos: number;
+  /** The ending index within the file for this node */
+  end_pos: number;
+  /** The starting line within the file for this node */
+  src_line_start: number;
+  /** The ending line within the file for this node */
+  src_line_end: number;
+  /** The starting column on the starting line for this node */
+  src_col_start: number;
+  /** The ending column on the ending line for this node */
+  src_col_end: number;
+}
+
+/** Named references declaration block by name */
+export interface Named {
+  /** The `Decl.id` this name refers to */
+  id: number;
+  /** The type arguments used to instantiate this parameterised declaration */
+  type_arguments: Type[];
+}
+
+/** Struct contains a list of fields which make up the struct */
+export interface Struct {
+  fields: Field[];
+}
+
+/** Field represents a field within a struct */
+export interface Field {
+  /** The type of the field */
+  typ: Type;
+  /** The name of the field */
+  name: string;
+  /** The comment for the field */
+  doc: string;
+  /** The optional json name if it's different from the field name. (The value "-" indicates to omit the field.) */
+  json_name: string;
+  /** Whether the field is optional. */
+  optional: boolean;
+  /** The query string name to use in GET/HEAD/DELETE requests. (The value "-" indicates to omit the field.) */
+  query_string_name: string;
+  /** The original Go struct tag; should not be parsed individually */
+  raw_tag: string;
+  /** Parsed go struct tags. Used for marshalling hints */
+  tags: Tag[];
+}
+
+export interface Tag {
+  /** The tag key (e.g. json, query, header ...) */
+  key: string;
+  /** The tag name (e.g. first_name, firstName, ...) */
+  name: string;
+  /** Key Options (e.g. omitempty, optional ...) */
+  options: string[];
+}
+
+/** Map represents a map Type */
+export interface Map {
+  /** The type of the key for this map */
+  key: Type;
+  /** The type of the value of this map */
+  value: Type;
+}
+
+/** List represents a list type (array or slice) */
+export interface List {
+  /** The type of the elements in the list */
+  elem: Type;
+}
+
+/** Pointer represents a pointer to a base type */
+export interface Pointer {
+  /** The type of the pointer */
+  base: Type;
+}
+
+/** ConfigValue represents a config value wrapper. */
+export interface ConfigValue {
+  /** The type of the config value */
+  elem: Type;
+  /** Does this config value represent the type to `config.Values[T]`. If false it represents `config.Value[T]` */
+  IsValuesList: boolean;
+}
diff --git a/proto/encore/parser/schema/v1/schema.proto b/proto/encore/parser/schema/v1/schema.proto
index 15c23a53f0..45369f6d5c 100644
--- a/proto/encore/parser/schema/v1/schema.proto
+++ b/proto/encore/parser/schema/v1/schema.proto
@@ -4,81 +4,255 @@ option go_package = "encr.dev/proto/encore/parser/schema/v1";
 
 package encore.parser.schema.v1;
 
+// Type represents the base of our schema on which everything else is built on-top of. It has to be one, and only one,
+// thing from our list of meta types.
+//
+// A type may be concrete or abstract, however to determine if a type is abstract you need to recursive through the
+// structures looking for any uses of the TypeParameterPtr type
 message Type {
   oneof typ {
-    Named named = 1;
-    Struct struct = 2;
-    Map map = 3;
-    List list = 4;
-    Builtin builtin = 5;
+    /* Concrete / non-parameterized Types */
+    Named            named          =  1; // A "named" type (https://tip.golang.org/ref/spec#Types)
+    Struct           struct         =  2; // The type is a struct definition
+    Map              map            =  3; // The type is a map
+    List             list           =  4; // The type is a slice
+    Builtin          builtin        =  5; // The type is one of the base built in types within Go
+    Pointer          pointer        =  8; // The type is a pointer
+    Union            union          =  9; // The type is a union
+    Literal          literal        =  10; // The type is a literal
+
+    /* Abstract Types */
+    TypeParameterRef type_parameter =  6; // This is placeholder for a unknown type within the declaration block
+
+    /* Encore Special Types */
+    ConfigValue config              =  7; // This value is a config value
+  }
+
+  optional ValidationExpr validation = 15; // The validation expression for this type
+}
+
+message ValidationRule {
+  oneof rule {
+    uint64 min_len          = 1;
+    uint64 max_len          = 2;
+    double min_val          = 3;
+    double max_val          = 4;
+    string starts_with      = 5;
+    string ends_with        = 6;
+    string matches_regexp   = 7;
+    Is     is               = 8;
+  }
+
+  enum Is {
+    UNKNOWN = 0;
+    EMAIL   = 1;
+    URL     = 2;
+  }
+}
+
+message ValidationExpr {
+  oneof expr {
+    ValidationRule rule = 1;
+    And            and  = 2;
+    Or             or   = 3;
   }
+
+  message And {
+    repeated ValidationExpr exprs = 1;
+  }
+
+  message Or {
+    repeated ValidationExpr exprs = 1;
+  }
+}
+
+// TypeParameterRef is a reference to a `TypeParameter` within a declaration block
+message TypeParameterRef {
+  uint32 decl_id   = 1; // The ID of the declaration block
+  uint32 param_idx = 2; // The index of the type parameter within the declaration block
 }
 
+// Decl represents the declaration of a type within the Go code which is either concrete or _parameterized_. The type is
+// concrete when there are zero type parameters assigned.
+//
+// For example the Go Code:
+// ```go
+// // Set[A] represents our set type
+// type Set[A any] = map[A]struct{}
+// ```
+//
+// Would become:
+// ```go
+// _ = &Decl{
+//     id: 1,
+//     name: "Set",
+//     type: &Type{
+//         typ_map: &Map{
+//             key: &Type { typ_type_parameter: ... reference to "A" type parameter below ... },
+//             value: &Type { typ_struct: ... empty struct type ... },
+//         },
+//     },
+//     typeParameters: []*TypeParameter{ { name: "A" } },
+//     doc: "Set[A] represents our set type",
+//     loc: &Loc { ... },
+// }
+// ```
 message Decl {
-  uint32 id = 1;
-  string name = 2;     // type name
-  Type type = 3;
-  string doc = 4;
-  Loc loc = 5;
+  uint32                 id          = 1; // A internal ID which we can refer to this declaration by
+  string                 name        = 2; // The name of the type as assigned in the code
+  Type                   type        = 3; // The underlying type of this declaration
+  repeated TypeParameter type_params = 6; // Any type parameters on this declaration (note; instantiated types used within this declaration would not be captured here)
+  string                 doc         = 4; // The comment block on the type
+  Loc                    loc         = 5; // The location of the declaration within the project
 }
 
+// TypeParameter acts as a place holder for an (as of yet) unknown type in the declaration; the type parameter is
+// replaced with a type argument upon instantiation of the parameterized function or type.
+message TypeParameter {
+  string name = 1; // The identifier given to the type parameter
+}
+
+// Loc is the location of a declaration within the code base
 message Loc {
-  string pkg_path = 1;
-  string pkg_name = 2;
-  string filename = 3;
-  int32 start_pos = 4;
-  int32 end_pos = 5;
-  int32 src_line_start = 6;
-  int32 src_line_end = 7;
-  int32 src_col_start = 8;
-  int32 src_col_end = 9;
+  string pkg_path       = 1; // The package path within the repo (i.e. `users/signup`)
+  string pkg_name       = 2; // The package name (i.e. `signup`)
+  string filename       = 3; // The file name (i.e. `signup.go`)
+  int32  start_pos      = 4; // The starting index within the file for this node
+  int32  end_pos        = 5; // The ending index within the file for this node
+  int32  src_line_start = 6; // The starting line within the file for this node
+  int32  src_line_end   = 7; // The ending line within the file for this node
+  int32  src_col_start  = 8; // The starting column on the starting line for this node
+  int32  src_col_end    = 9; // The ending column on the ending line for this node
 }
 
+// Named references declaration block by name
 message Named {
-  uint32 id = 1;
+  uint32   id                  = 1; // The `Decl.id` this name refers to
+  repeated Type type_arguments = 2; // The type arguments used to instantiate this parameterised declaration
 }
 
+// Struct contains a list of fields which make up the struct
 message Struct {
   repeated Field fields = 1;
 }
 
+// Field represents a field within a struct
 message Field {
-  Type typ = 1;
-  string name = 2;
-  string doc = 3;
-  // The optional json name if it's different from the field name.
-  string json_name = 4;
-  // Whether the field is optional.
-  bool optional = 5;
+  Type   typ               = 1; // The type of the field
+  string name              = 2; // The name of the field
+  string doc               = 3; // The comment for the field
+  string json_name         = 4; // The optional json name if it's different from the field name. (The value "-" indicates to omit the field.)
+  bool   optional          = 5; // Whether the field is optional.
+  string query_string_name = 6; // The query string name to use in GET/HEAD/DELETE requests. (The value "-" indicates to omit the field.)
+  string raw_tag           = 7; // The original Go struct tag; should not be parsed individually
+  repeated Tag tags        = 8; // Parsed go struct tags. Used for marshalling hints
+  optional WireSpec wire   = 9; // The explicitly set wire location of the field.
 }
 
+// WireLocation provides information about how a field should be encoded on the wire.
+message WireSpec {
+  oneof location {
+    Header     header     = 1;
+    Query      query      = 2;
+    Cookie     cookie     = 3;
+    HttpStatus http_status = 4;
+  }
+
+  message Header {
+    // The explicitly specified header name.
+    // If empty, the name of the field is used.
+    optional string name = 1;
+  }
+
+  message Query {
+    // The explicitly specified query string name.
+    // If empty, the name of the field is used.
+    optional string name = 1;
+  }
+
+  message Cookie {
+    // The explicitly specified cookie string name.
+    // If empty, the name of the field is used.
+    optional string name = 1;
+  }
+
+  message HttpStatus {
+    // HttpStatus fields don't have a name parameter
+    // as they represent the HTTP status code itself
+  }
+}
+
+message Tag {
+  string key               = 1; // The tag key (e.g. json, query, header ...)
+  string name              = 2; // The tag name (e.g. first_name, firstName, ...)
+  repeated string options  = 3; // Key Options (e.g. omitempty, optional ...)
+}
+
+// Map represents a map Type
 message Map {
-  Type key = 1;
-  Type value = 2;
+  Type key   = 1; // The type of the key for this map
+  Type value = 2; // The type of the value of this map
 }
 
+// List represents a list type (array or slice)
 message List {
-  Type elem = 1;
+  Type elem = 1; // The type of the elements in the list
 }
 
+// Pointer represents a pointer to a base type
+message Pointer {
+  Type base = 1; // The type of the pointer
+}
+
+// Union represents a union type.
+message Union {
+  repeated Type types = 1; // The types that make up the union
+}
+
+// Literal represents a literal value.
+message Literal {
+  oneof value {
+    string str     = 1;
+    bool   boolean = 2;
+    int64  int     = 3;
+    double float   = 4;
+    bool   null    = 5;
+  }
+}
+
+// ConfigValue represents a config value wrapper.
+message ConfigValue {
+  Type elem         = 1; // The type of the config value
+  bool IsValuesList = 2; // Does this config value represent the type to `config.Values[T]`. If false it represents `config.Value[T]`
+}
+
+// Builtin represents a type which Encore (and Go) have inbuilt support for and so can be represented by Encore's tooling
+// directly, rather than needing to understand the full implementation details of how the type is structured.
 enum Builtin {
-  ANY = 0;
-  BOOL = 1;
-  INT8 = 2;
-  INT16 = 3;
-  INT32 = 4;
-  INT64 = 5;
-  UINT8  = 6;
-  UINT16 = 7;
-  UINT32 = 8;
-  UINT64 = 9;
+  /* Inbuilt Go Types */
+  ANY     = 0;
+  BOOL    = 1;
+  INT8    = 2;
+  INT16   = 3;
+  INT32   = 4;
+  INT64   = 5;
+  UINT8   = 6;
+  UINT16  = 7;
+  UINT32  = 8;
+  UINT64  = 9;
   FLOAT32 = 10;
   FLOAT64 = 11;
-  STRING = 12;
-  BYTES = 13;
+  STRING  = 12;
+  BYTES   = 13;
 
-  TIME = 14;
-  UUID = 15;
-  JSON = 16;
+  /* Additional Encore Types */
+  TIME    = 14;
+  UUID    = 15;
+  JSON    = 16;
   USER_ID = 17;
-}
\ No newline at end of file
+
+  INT     = 18;
+  UINT    = 19;
+  
+  DECIMAL = 20;
+}
diff --git a/proto/encore/parser/schema/v1/walk.go b/proto/encore/parser/schema/v1/walk.go
new file mode 100644
index 0000000000..d7b20a1cd3
--- /dev/null
+++ b/proto/encore/parser/schema/v1/walk.go
@@ -0,0 +1,102 @@
+package v1
+
+import (
+	"fmt"
+	"reflect"
+)
+
+// Walk will perform a depth first walk of all schema nodes starting at node, calling visitor for each schema type found.
+//
+// If visitor returns false, the walk will be aborted.
+func Walk(decls []*Decl, node any, visitor func(node any) error) error {
+	namedChain := make([]uint32, 0, 10)
+	return walk(decls, node, visitor, namedChain)
+}
+
+func walk(decls []*Decl, node any, visitor func(node any) error, namedChain []uint32) error {
+	// Check the visitor against the node type
+	if err := visitor(node); err != nil {
+		return err
+	}
+
+	switch node := node.(type) {
+	case *Type:
+		switch v := node.Typ.(type) {
+		case *Type_Named:
+			return walk(decls, v.Named, visitor, namedChain)
+		case *Type_Struct:
+			return walk(decls, v.Struct, visitor, namedChain)
+		case *Type_Map:
+			return walk(decls, v.Map, visitor, namedChain)
+		case *Type_List:
+			return walk(decls, v.List, visitor, namedChain)
+		case *Type_Builtin:
+			return walk(decls, v.Builtin, visitor, namedChain)
+		case *Type_Pointer:
+			return walk(decls, v.Pointer, visitor, namedChain)
+		case *Type_TypeParameter:
+			return walk(decls, v.TypeParameter, visitor, namedChain)
+		case *Type_Literal:
+			return walk(decls, v.Literal, visitor, namedChain)
+		case *Type_Union:
+			return walk(decls, v.Union, visitor, namedChain)
+		case *Type_Config:
+			return walk(decls, v.Config, visitor, namedChain)
+		default:
+			panic(fmt.Sprintf("unknown type encountered: %+v", reflect.TypeOf(v)))
+		}
+
+	case *Decl:
+		return walk(decls, decls[node.Id].Type, visitor, namedChain)
+
+	case *Named:
+		for _, typ := range node.TypeArguments {
+			if err := walk(decls, typ, visitor, namedChain); err != nil {
+				return err
+			}
+		}
+
+		// Have we already visited this named type?
+		for i := len(namedChain) - 1; i >= 0; i-- {
+			if namedChain[i] == node.Id {
+				return nil
+			}
+		}
+		namedChain = append(namedChain, node.Id)
+
+		return walk(decls, decls[node.Id].Type, visitor, namedChain)
+	case *Struct:
+		for _, field := range node.Fields {
+			if err := walk(decls, field.Typ, visitor, namedChain); err != nil {
+				return err
+			}
+		}
+	case *Union:
+		for _, typ := range node.Types {
+			if err := walk(decls, typ, visitor, namedChain); err != nil {
+				return err
+			}
+		}
+	case *Map:
+		if err := walk(decls, node.Key, visitor, namedChain); err != nil {
+			return err
+		}
+		return walk(decls, node.Value, visitor, namedChain)
+	case *List:
+		return walk(decls, node.Elem, visitor, namedChain)
+	case Builtin:
+		return nil
+	case *Pointer:
+		return walk(decls, node.Base, visitor, namedChain)
+	case *TypeParameterRef:
+		return nil
+	case *Literal:
+		return nil
+	case *ConfigValue:
+		return walk(decls, node.Elem, visitor, namedChain)
+	default:
+		panic(fmt.Sprintf("unsupported node type encountered during walk: %+v", reflect.TypeOf(node)))
+	}
+
+	return nil
+}
diff --git a/proto/encore/parser/schema/v1/walk_test.go b/proto/encore/parser/schema/v1/walk_test.go
new file mode 100644
index 0000000000..69e0e9397b
--- /dev/null
+++ b/proto/encore/parser/schema/v1/walk_test.go
@@ -0,0 +1,77 @@
+package v1
+
+import "testing"
+
+// TestWalk_RecursiveDataStructure tests that Walk gracefully handles
+// recursive and mutually recursive data structures.
+func TestWalk_RecursiveDataStructure(t *testing.T) {
+	selfRecursive := &Decl{
+		Id: 0,
+		Type: &Type{
+			Typ: &Type_Named{
+				Named: &Named{
+					Id: 0,
+				},
+			},
+		},
+	}
+
+	mutualRecursiveOne := &Decl{
+		Id: 1,
+		Type: &Type{
+			Typ: &Type_Struct{
+				Struct: &Struct{
+					Fields: []*Field{
+						{
+							Typ: &Type{Typ: &Type_Named{
+								Named: &Named{Id: 1},
+							}},
+						},
+					},
+				},
+			},
+		},
+	}
+	mutualRecursiveTwo := &Decl{
+		Id: 1,
+		Type: &Type{
+			Typ: &Type_Struct{
+				Struct: &Struct{
+					Fields: []*Field{
+						{
+							Typ: &Type{Typ: &Type_Named{
+								Named: &Named{Id: 0},
+							}},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	tests := []struct {
+		name  string
+		decls []*Decl
+		node  any
+	}{
+		{
+			name:  "self_recursive",
+			decls: []*Decl{selfRecursive},
+			node:  selfRecursive.Type,
+		},
+		{
+			name:  "mutual_recursive",
+			decls: []*Decl{mutualRecursiveOne, mutualRecursiveTwo},
+			node:  mutualRecursiveOne.Type,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			visitor := func(node any) error { return nil }
+			if err := Walk(tt.decls, tt.node, visitor); err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
diff --git a/proto/encore/runtime/v1/infra.pb.go b/proto/encore/runtime/v1/infra.pb.go
new file mode 100644
index 0000000000..7d1f39d143
--- /dev/null
+++ b/proto/encore/runtime/v1/infra.pb.go
@@ -0,0 +1,3775 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.23.4
+// source: encore/runtime/v1/infra.proto
+
+package runtimev1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type ServerKind int32
+
+const (
+	ServerKind_SERVER_KIND_UNSPECIFIED ServerKind = 0
+	ServerKind_SERVER_KIND_PRIMARY     ServerKind = 1
+	// A hot-standby (a read replica designed to take over write traffic
+	// at a moment's notice).
+	ServerKind_SERVER_KIND_HOT_STANDBY ServerKind = 2
+	// A read-replica.
+	ServerKind_SERVER_KIND_READ_REPLICA ServerKind = 3
+)
+
+// Enum value maps for ServerKind.
+var (
+	ServerKind_name = map[int32]string{
+		0: "SERVER_KIND_UNSPECIFIED",
+		1: "SERVER_KIND_PRIMARY",
+		2: "SERVER_KIND_HOT_STANDBY",
+		3: "SERVER_KIND_READ_REPLICA",
+	}
+	ServerKind_value = map[string]int32{
+		"SERVER_KIND_UNSPECIFIED":  0,
+		"SERVER_KIND_PRIMARY":      1,
+		"SERVER_KIND_HOT_STANDBY":  2,
+		"SERVER_KIND_READ_REPLICA": 3,
+	}
+)
+
+func (x ServerKind) Enum() *ServerKind {
+	p := new(ServerKind)
+	*p = x
+	return p
+}
+
+func (x ServerKind) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ServerKind) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_runtime_v1_infra_proto_enumTypes[0].Descriptor()
+}
+
+func (ServerKind) Type() protoreflect.EnumType {
+	return &file_encore_runtime_v1_infra_proto_enumTypes[0]
+}
+
+func (x ServerKind) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ServerKind.Descriptor instead.
+func (ServerKind) EnumDescriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{0}
+}
+
+type PubSubTopic_DeliveryGuarantee int32
+
+const (
+	PubSubTopic_DELIVERY_GUARANTEE_UNSPECIFIED   PubSubTopic_DeliveryGuarantee = 0
+	PubSubTopic_DELIVERY_GUARANTEE_AT_LEAST_ONCE PubSubTopic_DeliveryGuarantee = 1 // All messages will be delivered to each subscription at least once
+	PubSubTopic_DELIVERY_GUARANTEE_EXACTLY_ONCE  PubSubTopic_DeliveryGuarantee = 2 // All messages will be delivered to each subscription exactly once
+)
+
+// Enum value maps for PubSubTopic_DeliveryGuarantee.
+var (
+	PubSubTopic_DeliveryGuarantee_name = map[int32]string{
+		0: "DELIVERY_GUARANTEE_UNSPECIFIED",
+		1: "DELIVERY_GUARANTEE_AT_LEAST_ONCE",
+		2: "DELIVERY_GUARANTEE_EXACTLY_ONCE",
+	}
+	PubSubTopic_DeliveryGuarantee_value = map[string]int32{
+		"DELIVERY_GUARANTEE_UNSPECIFIED":   0,
+		"DELIVERY_GUARANTEE_AT_LEAST_ONCE": 1,
+		"DELIVERY_GUARANTEE_EXACTLY_ONCE":  2,
+	}
+)
+
+func (x PubSubTopic_DeliveryGuarantee) Enum() *PubSubTopic_DeliveryGuarantee {
+	p := new(PubSubTopic_DeliveryGuarantee)
+	*p = x
+	return p
+}
+
+func (x PubSubTopic_DeliveryGuarantee) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PubSubTopic_DeliveryGuarantee) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_runtime_v1_infra_proto_enumTypes[1].Descriptor()
+}
+
+func (PubSubTopic_DeliveryGuarantee) Type() protoreflect.EnumType {
+	return &file_encore_runtime_v1_infra_proto_enumTypes[1]
+}
+
+func (x PubSubTopic_DeliveryGuarantee) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PubSubTopic_DeliveryGuarantee.Descriptor instead.
+func (PubSubTopic_DeliveryGuarantee) EnumDescriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{15, 0}
+}
+
+type Infrastructure struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Resources   *Infrastructure_Resources   `protobuf:"bytes,1,opt,name=resources,proto3" json:"resources,omitempty"`
+	Credentials *Infrastructure_Credentials `protobuf:"bytes,2,opt,name=credentials,proto3" json:"credentials,omitempty"`
+}
+
+func (x *Infrastructure) Reset() {
+	*x = Infrastructure{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Infrastructure) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Infrastructure) ProtoMessage() {}
+
+func (x *Infrastructure) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Infrastructure.ProtoReflect.Descriptor instead.
+func (*Infrastructure) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Infrastructure) GetResources() *Infrastructure_Resources {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
+func (x *Infrastructure) GetCredentials() *Infrastructure_Credentials {
+	if x != nil {
+		return x.Credentials
+	}
+	return nil
+}
+
+type SQLCluster struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this cluster.
+	Rid       string         `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	Servers   []*SQLServer   `protobuf:"bytes,2,rep,name=servers,proto3" json:"servers,omitempty"`
+	Databases []*SQLDatabase `protobuf:"bytes,3,rep,name=databases,proto3" json:"databases,omitempty"`
+}
+
+func (x *SQLCluster) Reset() {
+	*x = SQLCluster{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLCluster) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLCluster) ProtoMessage() {}
+
+func (x *SQLCluster) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLCluster.ProtoReflect.Descriptor instead.
+func (*SQLCluster) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *SQLCluster) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *SQLCluster) GetServers() []*SQLServer {
+	if x != nil {
+		return x.Servers
+	}
+	return nil
+}
+
+func (x *SQLCluster) GetDatabases() []*SQLDatabase {
+	if x != nil {
+		return x.Databases
+	}
+	return nil
+}
+
+type TLSConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Server CA Cert PEM to use for verifying the server's certificate.
+	ServerCaCert *string `protobuf:"bytes,1,opt,name=server_ca_cert,json=serverCaCert,proto3,oneof" json:"server_ca_cert,omitempty"`
+	// If true, skips hostname verification when connecting.
+	// If invalid hostnames are trusted, *any* valid certificate for *any* site will be trusted for use.
+	// This introduces significant vulnerabilities, and should only be used as a last resort.
+	DisableTlsHostnameVerification bool `protobuf:"varint,2,opt,name=disable_tls_hostname_verification,json=disableTlsHostnameVerification,proto3" json:"disable_tls_hostname_verification,omitempty"`
+	// If true, skips CA cert validation when connecting.
+	// This introduces significant vulnerabilities, and should only be used as a last resort.
+	DisableCaValidation bool `protobuf:"varint,3,opt,name=disable_ca_validation,json=disableCaValidation,proto3" json:"disable_ca_validation,omitempty"`
+}
+
+func (x *TLSConfig) Reset() {
+	*x = TLSConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TLSConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TLSConfig) ProtoMessage() {}
+
+func (x *TLSConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TLSConfig.ProtoReflect.Descriptor instead.
+func (*TLSConfig) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *TLSConfig) GetServerCaCert() string {
+	if x != nil && x.ServerCaCert != nil {
+		return *x.ServerCaCert
+	}
+	return ""
+}
+
+func (x *TLSConfig) GetDisableTlsHostnameVerification() bool {
+	if x != nil {
+		return x.DisableTlsHostnameVerification
+	}
+	return false
+}
+
+func (x *TLSConfig) GetDisableCaValidation() bool {
+	if x != nil {
+		return x.DisableCaValidation
+	}
+	return false
+}
+
+type SQLServer struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this server.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	// Host is the host to connect to.
+	// Valid formats are "hostname", "hostname:port", and "/path/to/unix.socket".
+	Host string     `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
+	Kind ServerKind `protobuf:"varint,3,opt,name=kind,proto3,enum=encore.runtime.v1.ServerKind" json:"kind,omitempty"`
+	// TLS configuration to use when connecting.
+	TlsConfig *TLSConfig `protobuf:"bytes,4,opt,name=tls_config,json=tlsConfig,proto3,oneof" json:"tls_config,omitempty"`
+}
+
+func (x *SQLServer) Reset() {
+	*x = SQLServer{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLServer) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLServer) ProtoMessage() {}
+
+func (x *SQLServer) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLServer.ProtoReflect.Descriptor instead.
+func (*SQLServer) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *SQLServer) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *SQLServer) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *SQLServer) GetKind() ServerKind {
+	if x != nil {
+		return x.Kind
+	}
+	return ServerKind_SERVER_KIND_UNSPECIFIED
+}
+
+func (x *SQLServer) GetTlsConfig() *TLSConfig {
+	if x != nil {
+		return x.TlsConfig
+	}
+	return nil
+}
+
+type ClientCert struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this certificate.
+	Rid  string      `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	Cert string      `protobuf:"bytes,2,opt,name=cert,proto3" json:"cert,omitempty"`
+	Key  *SecretData `protobuf:"bytes,3,opt,name=key,proto3" json:"key,omitempty"`
+}
+
+func (x *ClientCert) Reset() {
+	*x = ClientCert{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ClientCert) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ClientCert) ProtoMessage() {}
+
+func (x *ClientCert) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ClientCert.ProtoReflect.Descriptor instead.
+func (*ClientCert) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ClientCert) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *ClientCert) GetCert() string {
+	if x != nil {
+		return x.Cert
+	}
+	return ""
+}
+
+func (x *ClientCert) GetKey() *SecretData {
+	if x != nil {
+		return x.Key
+	}
+	return nil
+}
+
+type SQLRole struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this role.
+	Rid      string      `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	Username string      `protobuf:"bytes,2,opt,name=username,proto3" json:"username,omitempty"`
+	Password *SecretData `protobuf:"bytes,3,opt,name=password,proto3" json:"password,omitempty"`
+	// The client cert to use to authenticate, if any.
+	ClientCertRid *string `protobuf:"bytes,4,opt,name=client_cert_rid,json=clientCertRid,proto3,oneof" json:"client_cert_rid,omitempty"`
+}
+
+func (x *SQLRole) Reset() {
+	*x = SQLRole{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLRole) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLRole) ProtoMessage() {}
+
+func (x *SQLRole) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLRole.ProtoReflect.Descriptor instead.
+func (*SQLRole) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *SQLRole) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *SQLRole) GetUsername() string {
+	if x != nil {
+		return x.Username
+	}
+	return ""
+}
+
+func (x *SQLRole) GetPassword() *SecretData {
+	if x != nil {
+		return x.Password
+	}
+	return nil
+}
+
+func (x *SQLRole) GetClientCertRid() string {
+	if x != nil && x.ClientCertRid != nil {
+		return *x.ClientCertRid
+	}
+	return ""
+}
+
+type SQLDatabase struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this database.
+	Rid        string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	EncoreName string `protobuf:"bytes,2,opt,name=encore_name,json=encoreName,proto3" json:"encore_name,omitempty"`
+	// The physical name of the database in the cluster.
+	CloudName string `protobuf:"bytes,3,opt,name=cloud_name,json=cloudName,proto3" json:"cloud_name,omitempty"`
+	// Connection pools to use for connecting to the database.
+	ConnPools []*SQLConnectionPool `protobuf:"bytes,4,rep,name=conn_pools,json=connPools,proto3" json:"conn_pools,omitempty"`
+}
+
+func (x *SQLDatabase) Reset() {
+	*x = SQLDatabase{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLDatabase) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLDatabase) ProtoMessage() {}
+
+func (x *SQLDatabase) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLDatabase.ProtoReflect.Descriptor instead.
+func (*SQLDatabase) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *SQLDatabase) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *SQLDatabase) GetEncoreName() string {
+	if x != nil {
+		return x.EncoreName
+	}
+	return ""
+}
+
+func (x *SQLDatabase) GetCloudName() string {
+	if x != nil {
+		return x.CloudName
+	}
+	return ""
+}
+
+func (x *SQLDatabase) GetConnPools() []*SQLConnectionPool {
+	if x != nil {
+		return x.ConnPools
+	}
+	return nil
+}
+
+type SQLConnectionPool struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Whether this connection pool is for read-only servers.
+	IsReadonly bool `protobuf:"varint,1,opt,name=is_readonly,json=isReadonly,proto3" json:"is_readonly,omitempty"`
+	// The role to use to authenticate.
+	RoleRid string `protobuf:"bytes,2,opt,name=role_rid,json=roleRid,proto3" json:"role_rid,omitempty"`
+	// The minimum and maximum number of connections to use.
+	MinConnections int32 `protobuf:"varint,3,opt,name=min_connections,json=minConnections,proto3" json:"min_connections,omitempty"`
+	MaxConnections int32 `protobuf:"varint,4,opt,name=max_connections,json=maxConnections,proto3" json:"max_connections,omitempty"`
+}
+
+func (x *SQLConnectionPool) Reset() {
+	*x = SQLConnectionPool{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SQLConnectionPool) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SQLConnectionPool) ProtoMessage() {}
+
+func (x *SQLConnectionPool) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SQLConnectionPool.ProtoReflect.Descriptor instead.
+func (*SQLConnectionPool) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *SQLConnectionPool) GetIsReadonly() bool {
+	if x != nil {
+		return x.IsReadonly
+	}
+	return false
+}
+
+func (x *SQLConnectionPool) GetRoleRid() string {
+	if x != nil {
+		return x.RoleRid
+	}
+	return ""
+}
+
+func (x *SQLConnectionPool) GetMinConnections() int32 {
+	if x != nil {
+		return x.MinConnections
+	}
+	return 0
+}
+
+func (x *SQLConnectionPool) GetMaxConnections() int32 {
+	if x != nil {
+		return x.MaxConnections
+	}
+	return 0
+}
+
+type RedisCluster struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this cluster.
+	Rid       string           `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	Servers   []*RedisServer   `protobuf:"bytes,2,rep,name=servers,proto3" json:"servers,omitempty"`
+	Databases []*RedisDatabase `protobuf:"bytes,3,rep,name=databases,proto3" json:"databases,omitempty"`
+}
+
+func (x *RedisCluster) Reset() {
+	*x = RedisCluster{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RedisCluster) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RedisCluster) ProtoMessage() {}
+
+func (x *RedisCluster) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RedisCluster.ProtoReflect.Descriptor instead.
+func (*RedisCluster) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *RedisCluster) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *RedisCluster) GetServers() []*RedisServer {
+	if x != nil {
+		return x.Servers
+	}
+	return nil
+}
+
+func (x *RedisCluster) GetDatabases() []*RedisDatabase {
+	if x != nil {
+		return x.Databases
+	}
+	return nil
+}
+
+type RedisServer struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this server.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	// Host is the host to connect to.
+	// Valid formats are "hostname", "hostname:port", and "/path/to/unix.socket".
+	Host string     `protobuf:"bytes,2,opt,name=host,proto3" json:"host,omitempty"`
+	Kind ServerKind `protobuf:"varint,3,opt,name=kind,proto3,enum=encore.runtime.v1.ServerKind" json:"kind,omitempty"`
+	// TLS configuration to use when connecting.
+	// If nil, TLS is not used.
+	TlsConfig *TLSConfig `protobuf:"bytes,4,opt,name=tls_config,json=tlsConfig,proto3,oneof" json:"tls_config,omitempty"`
+}
+
+func (x *RedisServer) Reset() {
+	*x = RedisServer{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RedisServer) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RedisServer) ProtoMessage() {}
+
+func (x *RedisServer) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RedisServer.ProtoReflect.Descriptor instead.
+func (*RedisServer) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *RedisServer) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *RedisServer) GetHost() string {
+	if x != nil {
+		return x.Host
+	}
+	return ""
+}
+
+func (x *RedisServer) GetKind() ServerKind {
+	if x != nil {
+		return x.Kind
+	}
+	return ServerKind_SERVER_KIND_UNSPECIFIED
+}
+
+func (x *RedisServer) GetTlsConfig() *TLSConfig {
+	if x != nil {
+		return x.TlsConfig
+	}
+	return nil
+}
+
+type RedisConnectionPool struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Whether this connection pool is for read-only servers.
+	IsReadonly bool `protobuf:"varint,1,opt,name=is_readonly,json=isReadonly,proto3" json:"is_readonly,omitempty"`
+	// The role to use to authenticate.
+	RoleRid string `protobuf:"bytes,2,opt,name=role_rid,json=roleRid,proto3" json:"role_rid,omitempty"`
+	// The minimum and maximum number of connections to use.
+	MinConnections int32 `protobuf:"varint,3,opt,name=min_connections,json=minConnections,proto3" json:"min_connections,omitempty"`
+	MaxConnections int32 `protobuf:"varint,4,opt,name=max_connections,json=maxConnections,proto3" json:"max_connections,omitempty"`
+}
+
+func (x *RedisConnectionPool) Reset() {
+	*x = RedisConnectionPool{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RedisConnectionPool) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RedisConnectionPool) ProtoMessage() {}
+
+func (x *RedisConnectionPool) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RedisConnectionPool.ProtoReflect.Descriptor instead.
+func (*RedisConnectionPool) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *RedisConnectionPool) GetIsReadonly() bool {
+	if x != nil {
+		return x.IsReadonly
+	}
+	return false
+}
+
+func (x *RedisConnectionPool) GetRoleRid() string {
+	if x != nil {
+		return x.RoleRid
+	}
+	return ""
+}
+
+func (x *RedisConnectionPool) GetMinConnections() int32 {
+	if x != nil {
+		return x.MinConnections
+	}
+	return 0
+}
+
+func (x *RedisConnectionPool) GetMaxConnections() int32 {
+	if x != nil {
+		return x.MaxConnections
+	}
+	return 0
+}
+
+type RedisRole struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this role.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	// The client cert to use to authenticate, if any.
+	ClientCertRid *string `protobuf:"bytes,2,opt,name=client_cert_rid,json=clientCertRid,proto3,oneof" json:"client_cert_rid,omitempty"`
+	// How to authenticate with Redis.
+	// If unset, no authentication is used.
+	//
+	// Types that are assignable to Auth:
+	//
+	//	*RedisRole_Acl
+	//	*RedisRole_AuthString
+	Auth isRedisRole_Auth `protobuf_oneof:"auth"`
+}
+
+func (x *RedisRole) Reset() {
+	*x = RedisRole{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RedisRole) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RedisRole) ProtoMessage() {}
+
+func (x *RedisRole) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RedisRole.ProtoReflect.Descriptor instead.
+func (*RedisRole) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *RedisRole) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *RedisRole) GetClientCertRid() string {
+	if x != nil && x.ClientCertRid != nil {
+		return *x.ClientCertRid
+	}
+	return ""
+}
+
+func (m *RedisRole) GetAuth() isRedisRole_Auth {
+	if m != nil {
+		return m.Auth
+	}
+	return nil
+}
+
+func (x *RedisRole) GetAcl() *RedisRole_AuthACL {
+	if x, ok := x.GetAuth().(*RedisRole_Acl); ok {
+		return x.Acl
+	}
+	return nil
+}
+
+func (x *RedisRole) GetAuthString() *SecretData {
+	if x, ok := x.GetAuth().(*RedisRole_AuthString); ok {
+		return x.AuthString
+	}
+	return nil
+}
+
+type isRedisRole_Auth interface {
+	isRedisRole_Auth()
+}
+
+type RedisRole_Acl struct {
+	Acl *RedisRole_AuthACL `protobuf:"bytes,10,opt,name=acl,proto3,oneof"` // Redis ACL
+}
+
+type RedisRole_AuthString struct {
+	AuthString *SecretData `protobuf:"bytes,11,opt,name=auth_string,json=authString,proto3,oneof"` // Redis AUTH string
+}
+
+func (*RedisRole_Acl) isRedisRole_Auth() {}
+
+func (*RedisRole_AuthString) isRedisRole_Auth() {}
+
+type RedisDatabase struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Unique resource id for this database.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	// The encore name of the database.
+	EncoreName string `protobuf:"bytes,2,opt,name=encore_name,json=encoreName,proto3" json:"encore_name,omitempty"`
+	// The database index to use, [0-15].
+	DatabaseIdx int32 `protobuf:"varint,3,opt,name=database_idx,json=databaseIdx,proto3" json:"database_idx,omitempty"`
+	// KeyPrefix specifies a prefix to add to all cache keys
+	// for this database. It exists to enable multiple cache clusters
+	// to use the same physical Redis database for local development
+	// without having to coordinate and persist database index ids.
+	KeyPrefix *string `protobuf:"bytes,4,opt,name=key_prefix,json=keyPrefix,proto3,oneof" json:"key_prefix,omitempty"`
+	// Connection pools to use for connecting to the database.
+	ConnPools []*RedisConnectionPool `protobuf:"bytes,5,rep,name=conn_pools,json=connPools,proto3" json:"conn_pools,omitempty"`
+}
+
+func (x *RedisDatabase) Reset() {
+	*x = RedisDatabase{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RedisDatabase) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RedisDatabase) ProtoMessage() {}
+
+func (x *RedisDatabase) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RedisDatabase.ProtoReflect.Descriptor instead.
+func (*RedisDatabase) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *RedisDatabase) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *RedisDatabase) GetEncoreName() string {
+	if x != nil {
+		return x.EncoreName
+	}
+	return ""
+}
+
+func (x *RedisDatabase) GetDatabaseIdx() int32 {
+	if x != nil {
+		return x.DatabaseIdx
+	}
+	return 0
+}
+
+func (x *RedisDatabase) GetKeyPrefix() string {
+	if x != nil && x.KeyPrefix != nil {
+		return *x.KeyPrefix
+	}
+	return ""
+}
+
+func (x *RedisDatabase) GetConnPools() []*RedisConnectionPool {
+	if x != nil {
+		return x.ConnPools
+	}
+	return nil
+}
+
+type AppSecret struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this secret.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	// The encore name of the secret.
+	EncoreName string `protobuf:"bytes,2,opt,name=encore_name,json=encoreName,proto3" json:"encore_name,omitempty"`
+	// The secret data.
+	Data *SecretData `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *AppSecret) Reset() {
+	*x = AppSecret{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *AppSecret) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AppSecret) ProtoMessage() {}
+
+func (x *AppSecret) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AppSecret.ProtoReflect.Descriptor instead.
+func (*AppSecret) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *AppSecret) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *AppSecret) GetEncoreName() string {
+	if x != nil {
+		return x.EncoreName
+	}
+	return ""
+}
+
+func (x *AppSecret) GetData() *SecretData {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+type PubSubCluster struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this cluster.
+	Rid           string                `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	Topics        []*PubSubTopic        `protobuf:"bytes,2,rep,name=topics,proto3" json:"topics,omitempty"`
+	Subscriptions []*PubSubSubscription `protobuf:"bytes,3,rep,name=subscriptions,proto3" json:"subscriptions,omitempty"`
+	// Types that are assignable to Provider:
+	//
+	//	*PubSubCluster_Encore
+	//	*PubSubCluster_Aws
+	//	*PubSubCluster_Gcp
+	//	*PubSubCluster_Azure
+	//	*PubSubCluster_Nsq
+	Provider isPubSubCluster_Provider `protobuf_oneof:"provider"`
+}
+
+func (x *PubSubCluster) Reset() {
+	*x = PubSubCluster{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubCluster) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubCluster) ProtoMessage() {}
+
+func (x *PubSubCluster) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubCluster.ProtoReflect.Descriptor instead.
+func (*PubSubCluster) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *PubSubCluster) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *PubSubCluster) GetTopics() []*PubSubTopic {
+	if x != nil {
+		return x.Topics
+	}
+	return nil
+}
+
+func (x *PubSubCluster) GetSubscriptions() []*PubSubSubscription {
+	if x != nil {
+		return x.Subscriptions
+	}
+	return nil
+}
+
+func (m *PubSubCluster) GetProvider() isPubSubCluster_Provider {
+	if m != nil {
+		return m.Provider
+	}
+	return nil
+}
+
+func (x *PubSubCluster) GetEncore() *PubSubCluster_EncoreCloud {
+	if x, ok := x.GetProvider().(*PubSubCluster_Encore); ok {
+		return x.Encore
+	}
+	return nil
+}
+
+func (x *PubSubCluster) GetAws() *PubSubCluster_AWSSqsSns {
+	if x, ok := x.GetProvider().(*PubSubCluster_Aws); ok {
+		return x.Aws
+	}
+	return nil
+}
+
+func (x *PubSubCluster) GetGcp() *PubSubCluster_GCPPubSub {
+	if x, ok := x.GetProvider().(*PubSubCluster_Gcp); ok {
+		return x.Gcp
+	}
+	return nil
+}
+
+func (x *PubSubCluster) GetAzure() *PubSubCluster_AzureServiceBus {
+	if x, ok := x.GetProvider().(*PubSubCluster_Azure); ok {
+		return x.Azure
+	}
+	return nil
+}
+
+func (x *PubSubCluster) GetNsq() *PubSubCluster_NSQ {
+	if x, ok := x.GetProvider().(*PubSubCluster_Nsq); ok {
+		return x.Nsq
+	}
+	return nil
+}
+
+type isPubSubCluster_Provider interface {
+	isPubSubCluster_Provider()
+}
+
+type PubSubCluster_Encore struct {
+	Encore *PubSubCluster_EncoreCloud `protobuf:"bytes,5,opt,name=encore,proto3,oneof"`
+}
+
+type PubSubCluster_Aws struct {
+	Aws *PubSubCluster_AWSSqsSns `protobuf:"bytes,6,opt,name=aws,proto3,oneof"`
+}
+
+type PubSubCluster_Gcp struct {
+	Gcp *PubSubCluster_GCPPubSub `protobuf:"bytes,7,opt,name=gcp,proto3,oneof"`
+}
+
+type PubSubCluster_Azure struct {
+	Azure *PubSubCluster_AzureServiceBus `protobuf:"bytes,8,opt,name=azure,proto3,oneof"`
+}
+
+type PubSubCluster_Nsq struct {
+	Nsq *PubSubCluster_NSQ `protobuf:"bytes,9,opt,name=nsq,proto3,oneof"`
+}
+
+func (*PubSubCluster_Encore) isPubSubCluster_Provider() {}
+
+func (*PubSubCluster_Aws) isPubSubCluster_Provider() {}
+
+func (*PubSubCluster_Gcp) isPubSubCluster_Provider() {}
+
+func (*PubSubCluster_Azure) isPubSubCluster_Provider() {}
+
+func (*PubSubCluster_Nsq) isPubSubCluster_Provider() {}
+
+type PubSubTopic struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this topic.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	// The encore name of the topic.
+	EncoreName string `protobuf:"bytes,2,opt,name=encore_name,json=encoreName,proto3" json:"encore_name,omitempty"`
+	// The cloud name of the topic.
+	CloudName string `protobuf:"bytes,3,opt,name=cloud_name,json=cloudName,proto3" json:"cloud_name,omitempty"`
+	// The delivery guarantee.
+	DeliveryGuarantee PubSubTopic_DeliveryGuarantee `protobuf:"varint,4,opt,name=delivery_guarantee,json=deliveryGuarantee,proto3,enum=encore.runtime.v1.PubSubTopic_DeliveryGuarantee" json:"delivery_guarantee,omitempty"`
+	// Optional ordering attribute. Specifies the attribute name
+	// to use for message ordering.
+	OrderingAttr *string `protobuf:"bytes,5,opt,name=ordering_attr,json=orderingAttr,proto3,oneof" json:"ordering_attr,omitempty"`
+	// Provider-specific configuration.
+	// Not all providers require this, but it must always be set
+	// for the providers that are present.
+	//
+	// Types that are assignable to ProviderConfig:
+	//
+	//	*PubSubTopic_GcpConfig
+	ProviderConfig isPubSubTopic_ProviderConfig `protobuf_oneof:"provider_config"`
+}
+
+func (x *PubSubTopic) Reset() {
+	*x = PubSubTopic{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubTopic) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubTopic) ProtoMessage() {}
+
+func (x *PubSubTopic) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubTopic.ProtoReflect.Descriptor instead.
+func (*PubSubTopic) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *PubSubTopic) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *PubSubTopic) GetEncoreName() string {
+	if x != nil {
+		return x.EncoreName
+	}
+	return ""
+}
+
+func (x *PubSubTopic) GetCloudName() string {
+	if x != nil {
+		return x.CloudName
+	}
+	return ""
+}
+
+func (x *PubSubTopic) GetDeliveryGuarantee() PubSubTopic_DeliveryGuarantee {
+	if x != nil {
+		return x.DeliveryGuarantee
+	}
+	return PubSubTopic_DELIVERY_GUARANTEE_UNSPECIFIED
+}
+
+func (x *PubSubTopic) GetOrderingAttr() string {
+	if x != nil && x.OrderingAttr != nil {
+		return *x.OrderingAttr
+	}
+	return ""
+}
+
+func (m *PubSubTopic) GetProviderConfig() isPubSubTopic_ProviderConfig {
+	if m != nil {
+		return m.ProviderConfig
+	}
+	return nil
+}
+
+func (x *PubSubTopic) GetGcpConfig() *PubSubTopic_GCPConfig {
+	if x, ok := x.GetProviderConfig().(*PubSubTopic_GcpConfig); ok {
+		return x.GcpConfig
+	}
+	return nil
+}
+
+type isPubSubTopic_ProviderConfig interface {
+	isPubSubTopic_ProviderConfig()
+}
+
+type PubSubTopic_GcpConfig struct {
+	GcpConfig *PubSubTopic_GCPConfig `protobuf:"bytes,10,opt,name=gcp_config,json=gcpConfig,proto3,oneof"` // Null: no provider-specific configuration.
+}
+
+func (*PubSubTopic_GcpConfig) isPubSubTopic_ProviderConfig() {}
+
+type PubSubSubscription struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this subscription.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	// The encore name of the topic this subscription is for.
+	TopicEncoreName string `protobuf:"bytes,2,opt,name=topic_encore_name,json=topicEncoreName,proto3" json:"topic_encore_name,omitempty"`
+	// The encore name of the subscription.
+	SubscriptionEncoreName string `protobuf:"bytes,3,opt,name=subscription_encore_name,json=subscriptionEncoreName,proto3" json:"subscription_encore_name,omitempty"`
+	// The cloud name of the subscription.
+	TopicCloudName string `protobuf:"bytes,4,opt,name=topic_cloud_name,json=topicCloudName,proto3" json:"topic_cloud_name,omitempty"`
+	// The cloud name of the subscription.
+	SubscriptionCloudName string `protobuf:"bytes,5,opt,name=subscription_cloud_name,json=subscriptionCloudName,proto3" json:"subscription_cloud_name,omitempty"`
+	// If true the application will not actively subscribe but wait
+	// for incoming messages to be pushed to it.
+	PushOnly bool `protobuf:"varint,6,opt,name=push_only,json=pushOnly,proto3" json:"push_only,omitempty"`
+	// Subscription-specific provider configuration.
+	// Not all providers require this, but it must always be set
+	// for the providers that are present.
+	//
+	// Types that are assignable to ProviderConfig:
+	//
+	//	*PubSubSubscription_GcpConfig
+	ProviderConfig isPubSubSubscription_ProviderConfig `protobuf_oneof:"provider_config"`
+}
+
+func (x *PubSubSubscription) Reset() {
+	*x = PubSubSubscription{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubSubscription) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubSubscription) ProtoMessage() {}
+
+func (x *PubSubSubscription) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubSubscription.ProtoReflect.Descriptor instead.
+func (*PubSubSubscription) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *PubSubSubscription) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *PubSubSubscription) GetTopicEncoreName() string {
+	if x != nil {
+		return x.TopicEncoreName
+	}
+	return ""
+}
+
+func (x *PubSubSubscription) GetSubscriptionEncoreName() string {
+	if x != nil {
+		return x.SubscriptionEncoreName
+	}
+	return ""
+}
+
+func (x *PubSubSubscription) GetTopicCloudName() string {
+	if x != nil {
+		return x.TopicCloudName
+	}
+	return ""
+}
+
+func (x *PubSubSubscription) GetSubscriptionCloudName() string {
+	if x != nil {
+		return x.SubscriptionCloudName
+	}
+	return ""
+}
+
+func (x *PubSubSubscription) GetPushOnly() bool {
+	if x != nil {
+		return x.PushOnly
+	}
+	return false
+}
+
+func (m *PubSubSubscription) GetProviderConfig() isPubSubSubscription_ProviderConfig {
+	if m != nil {
+		return m.ProviderConfig
+	}
+	return nil
+}
+
+func (x *PubSubSubscription) GetGcpConfig() *PubSubSubscription_GCPConfig {
+	if x, ok := x.GetProviderConfig().(*PubSubSubscription_GcpConfig); ok {
+		return x.GcpConfig
+	}
+	return nil
+}
+
+type isPubSubSubscription_ProviderConfig interface {
+	isPubSubSubscription_ProviderConfig()
+}
+
+type PubSubSubscription_GcpConfig struct {
+	GcpConfig *PubSubSubscription_GCPConfig `protobuf:"bytes,10,opt,name=gcp_config,json=gcpConfig,proto3,oneof"` // Null: no provider-specific configuration.
+}
+
+func (*PubSubSubscription_GcpConfig) isPubSubSubscription_ProviderConfig() {}
+
+type BucketCluster struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this cluster.
+	Rid     string    `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	Buckets []*Bucket `protobuf:"bytes,2,rep,name=buckets,proto3" json:"buckets,omitempty"`
+	// Types that are assignable to Provider:
+	//
+	//	*BucketCluster_S3_
+	//	*BucketCluster_Gcs
+	Provider isBucketCluster_Provider `protobuf_oneof:"provider"`
+}
+
+func (x *BucketCluster) Reset() {
+	*x = BucketCluster{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketCluster) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketCluster) ProtoMessage() {}
+
+func (x *BucketCluster) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketCluster.ProtoReflect.Descriptor instead.
+func (*BucketCluster) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *BucketCluster) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *BucketCluster) GetBuckets() []*Bucket {
+	if x != nil {
+		return x.Buckets
+	}
+	return nil
+}
+
+func (m *BucketCluster) GetProvider() isBucketCluster_Provider {
+	if m != nil {
+		return m.Provider
+	}
+	return nil
+}
+
+func (x *BucketCluster) GetS3() *BucketCluster_S3 {
+	if x, ok := x.GetProvider().(*BucketCluster_S3_); ok {
+		return x.S3
+	}
+	return nil
+}
+
+func (x *BucketCluster) GetGcs() *BucketCluster_GCS {
+	if x, ok := x.GetProvider().(*BucketCluster_Gcs); ok {
+		return x.Gcs
+	}
+	return nil
+}
+
+type isBucketCluster_Provider interface {
+	isBucketCluster_Provider()
+}
+
+type BucketCluster_S3_ struct {
+	S3 *BucketCluster_S3 `protobuf:"bytes,10,opt,name=s3,proto3,oneof"`
+}
+
+type BucketCluster_Gcs struct {
+	Gcs *BucketCluster_GCS `protobuf:"bytes,11,opt,name=gcs,proto3,oneof"`
+}
+
+func (*BucketCluster_S3_) isBucketCluster_Provider() {}
+
+func (*BucketCluster_Gcs) isBucketCluster_Provider() {}
+
+type Bucket struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this bucket.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	// The encore name of the bucket.
+	EncoreName string `protobuf:"bytes,2,opt,name=encore_name,json=encoreName,proto3" json:"encore_name,omitempty"`
+	// The cloud name of the bucket.
+	CloudName string `protobuf:"bytes,3,opt,name=cloud_name,json=cloudName,proto3" json:"cloud_name,omitempty"`
+	// Optional key prefix to prepend to all bucket keys.
+	//
+	// Note: make sure it ends with a slash ("/") if you want
+	// to group objects within a certain folder.
+	KeyPrefix *string `protobuf:"bytes,4,opt,name=key_prefix,json=keyPrefix,proto3,oneof" json:"key_prefix,omitempty"`
+	// Public base URL for accessing objects in this bucket.
+	// Must be set for public buckets.
+	PublicBaseUrl *string `protobuf:"bytes,5,opt,name=public_base_url,json=publicBaseUrl,proto3,oneof" json:"public_base_url,omitempty"`
+}
+
+func (x *Bucket) Reset() {
+	*x = Bucket{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Bucket) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Bucket) ProtoMessage() {}
+
+func (x *Bucket) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Bucket.ProtoReflect.Descriptor instead.
+func (*Bucket) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *Bucket) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *Bucket) GetEncoreName() string {
+	if x != nil {
+		return x.EncoreName
+	}
+	return ""
+}
+
+func (x *Bucket) GetCloudName() string {
+	if x != nil {
+		return x.CloudName
+	}
+	return ""
+}
+
+func (x *Bucket) GetKeyPrefix() string {
+	if x != nil && x.KeyPrefix != nil {
+		return *x.KeyPrefix
+	}
+	return ""
+}
+
+func (x *Bucket) GetPublicBaseUrl() string {
+	if x != nil && x.PublicBaseUrl != nil {
+		return *x.PublicBaseUrl
+	}
+	return ""
+}
+
+type Gateway struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique id for this resource.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	// The encore name of the gateway.
+	EncoreName string `protobuf:"bytes,2,opt,name=encore_name,json=encoreName,proto3" json:"encore_name,omitempty"`
+	// The base url for reaching this gateway, for returning to the application
+	// via e.g. the metadata APIs.
+	BaseUrl string `protobuf:"bytes,3,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"`
+	// The hostnames this gateway accepts requests for.
+	Hostnames []string `protobuf:"bytes,4,rep,name=hostnames,proto3" json:"hostnames,omitempty"`
+	// CORS is the CORS configuration for this gateway.
+	Cors *Gateway_CORS `protobuf:"bytes,5,opt,name=cors,proto3" json:"cors,omitempty"`
+}
+
+func (x *Gateway) Reset() {
+	*x = Gateway{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Gateway) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Gateway) ProtoMessage() {}
+
+func (x *Gateway) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Gateway.ProtoReflect.Descriptor instead.
+func (*Gateway) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *Gateway) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *Gateway) GetEncoreName() string {
+	if x != nil {
+		return x.EncoreName
+	}
+	return ""
+}
+
+func (x *Gateway) GetBaseUrl() string {
+	if x != nil {
+		return x.BaseUrl
+	}
+	return ""
+}
+
+func (x *Gateway) GetHostnames() []string {
+	if x != nil {
+		return x.Hostnames
+	}
+	return nil
+}
+
+func (x *Gateway) GetCors() *Gateway_CORS {
+	if x != nil {
+		return x.Cors
+	}
+	return nil
+}
+
+type Infrastructure_Credentials struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ClientCerts []*ClientCert `protobuf:"bytes,1,rep,name=client_certs,json=clientCerts,proto3" json:"client_certs,omitempty"`
+	SqlRoles    []*SQLRole    `protobuf:"bytes,2,rep,name=sql_roles,json=sqlRoles,proto3" json:"sql_roles,omitempty"`
+	RedisRoles  []*RedisRole  `protobuf:"bytes,3,rep,name=redis_roles,json=redisRoles,proto3" json:"redis_roles,omitempty"`
+}
+
+func (x *Infrastructure_Credentials) Reset() {
+	*x = Infrastructure_Credentials{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Infrastructure_Credentials) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Infrastructure_Credentials) ProtoMessage() {}
+
+func (x *Infrastructure_Credentials) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Infrastructure_Credentials.ProtoReflect.Descriptor instead.
+func (*Infrastructure_Credentials) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *Infrastructure_Credentials) GetClientCerts() []*ClientCert {
+	if x != nil {
+		return x.ClientCerts
+	}
+	return nil
+}
+
+func (x *Infrastructure_Credentials) GetSqlRoles() []*SQLRole {
+	if x != nil {
+		return x.SqlRoles
+	}
+	return nil
+}
+
+func (x *Infrastructure_Credentials) GetRedisRoles() []*RedisRole {
+	if x != nil {
+		return x.RedisRoles
+	}
+	return nil
+}
+
+type Infrastructure_Resources struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Gateways       []*Gateway       `protobuf:"bytes,1,rep,name=gateways,proto3" json:"gateways,omitempty"`
+	SqlClusters    []*SQLCluster    `protobuf:"bytes,2,rep,name=sql_clusters,json=sqlClusters,proto3" json:"sql_clusters,omitempty"`
+	PubsubClusters []*PubSubCluster `protobuf:"bytes,3,rep,name=pubsub_clusters,json=pubsubClusters,proto3" json:"pubsub_clusters,omitempty"`
+	RedisClusters  []*RedisCluster  `protobuf:"bytes,4,rep,name=redis_clusters,json=redisClusters,proto3" json:"redis_clusters,omitempty"`
+	AppSecrets     []*AppSecret     `protobuf:"bytes,5,rep,name=app_secrets,json=appSecrets,proto3" json:"app_secrets,omitempty"`
+	BucketClusters []*BucketCluster `protobuf:"bytes,6,rep,name=bucket_clusters,json=bucketClusters,proto3" json:"bucket_clusters,omitempty"`
+}
+
+func (x *Infrastructure_Resources) Reset() {
+	*x = Infrastructure_Resources{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Infrastructure_Resources) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Infrastructure_Resources) ProtoMessage() {}
+
+func (x *Infrastructure_Resources) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Infrastructure_Resources.ProtoReflect.Descriptor instead.
+func (*Infrastructure_Resources) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{0, 1}
+}
+
+func (x *Infrastructure_Resources) GetGateways() []*Gateway {
+	if x != nil {
+		return x.Gateways
+	}
+	return nil
+}
+
+func (x *Infrastructure_Resources) GetSqlClusters() []*SQLCluster {
+	if x != nil {
+		return x.SqlClusters
+	}
+	return nil
+}
+
+func (x *Infrastructure_Resources) GetPubsubClusters() []*PubSubCluster {
+	if x != nil {
+		return x.PubsubClusters
+	}
+	return nil
+}
+
+func (x *Infrastructure_Resources) GetRedisClusters() []*RedisCluster {
+	if x != nil {
+		return x.RedisClusters
+	}
+	return nil
+}
+
+func (x *Infrastructure_Resources) GetAppSecrets() []*AppSecret {
+	if x != nil {
+		return x.AppSecrets
+	}
+	return nil
+}
+
+func (x *Infrastructure_Resources) GetBucketClusters() []*BucketCluster {
+	if x != nil {
+		return x.BucketClusters
+	}
+	return nil
+}
+
+type RedisRole_AuthACL struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Username string      `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	Password *SecretData `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+}
+
+func (x *RedisRole_AuthACL) Reset() {
+	*x = RedisRole_AuthACL{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[22]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RedisRole_AuthACL) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RedisRole_AuthACL) ProtoMessage() {}
+
+func (x *RedisRole_AuthACL) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[22]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RedisRole_AuthACL.ProtoReflect.Descriptor instead.
+func (*RedisRole_AuthACL) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{11, 0}
+}
+
+func (x *RedisRole_AuthACL) GetUsername() string {
+	if x != nil {
+		return x.Username
+	}
+	return ""
+}
+
+func (x *RedisRole_AuthACL) GetPassword() *SecretData {
+	if x != nil {
+		return x.Password
+	}
+	return nil
+}
+
+type PubSubCluster_EncoreCloud struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *PubSubCluster_EncoreCloud) Reset() {
+	*x = PubSubCluster_EncoreCloud{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[23]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubCluster_EncoreCloud) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubCluster_EncoreCloud) ProtoMessage() {}
+
+func (x *PubSubCluster_EncoreCloud) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[23]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubCluster_EncoreCloud.ProtoReflect.Descriptor instead.
+func (*PubSubCluster_EncoreCloud) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{14, 0}
+}
+
+type PubSubCluster_AWSSqsSns struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *PubSubCluster_AWSSqsSns) Reset() {
+	*x = PubSubCluster_AWSSqsSns{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[24]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubCluster_AWSSqsSns) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubCluster_AWSSqsSns) ProtoMessage() {}
+
+func (x *PubSubCluster_AWSSqsSns) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[24]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubCluster_AWSSqsSns.ProtoReflect.Descriptor instead.
+func (*PubSubCluster_AWSSqsSns) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{14, 1}
+}
+
+type PubSubCluster_GCPPubSub struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *PubSubCluster_GCPPubSub) Reset() {
+	*x = PubSubCluster_GCPPubSub{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[25]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubCluster_GCPPubSub) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubCluster_GCPPubSub) ProtoMessage() {}
+
+func (x *PubSubCluster_GCPPubSub) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[25]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubCluster_GCPPubSub.ProtoReflect.Descriptor instead.
+func (*PubSubCluster_GCPPubSub) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{14, 2}
+}
+
+type PubSubCluster_NSQ struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The hosts to connect to NSQ. Must be non-empty.
+	Hosts []string `protobuf:"bytes,1,rep,name=hosts,proto3" json:"hosts,omitempty"`
+}
+
+func (x *PubSubCluster_NSQ) Reset() {
+	*x = PubSubCluster_NSQ{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[26]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubCluster_NSQ) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubCluster_NSQ) ProtoMessage() {}
+
+func (x *PubSubCluster_NSQ) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[26]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubCluster_NSQ.ProtoReflect.Descriptor instead.
+func (*PubSubCluster_NSQ) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{14, 3}
+}
+
+func (x *PubSubCluster_NSQ) GetHosts() []string {
+	if x != nil {
+		return x.Hosts
+	}
+	return nil
+}
+
+type PubSubCluster_AzureServiceBus struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+}
+
+func (x *PubSubCluster_AzureServiceBus) Reset() {
+	*x = PubSubCluster_AzureServiceBus{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[27]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubCluster_AzureServiceBus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubCluster_AzureServiceBus) ProtoMessage() {}
+
+func (x *PubSubCluster_AzureServiceBus) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[27]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubCluster_AzureServiceBus.ProtoReflect.Descriptor instead.
+func (*PubSubCluster_AzureServiceBus) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{14, 4}
+}
+
+func (x *PubSubCluster_AzureServiceBus) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+type PubSubTopic_GCPConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The GCP project id where the topic exists.
+	ProjectId string `protobuf:"bytes,1,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty"`
+}
+
+func (x *PubSubTopic_GCPConfig) Reset() {
+	*x = PubSubTopic_GCPConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[28]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubTopic_GCPConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubTopic_GCPConfig) ProtoMessage() {}
+
+func (x *PubSubTopic_GCPConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[28]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubTopic_GCPConfig.ProtoReflect.Descriptor instead.
+func (*PubSubTopic_GCPConfig) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{15, 0}
+}
+
+func (x *PubSubTopic_GCPConfig) GetProjectId() string {
+	if x != nil {
+		return x.ProjectId
+	}
+	return ""
+}
+
+type PubSubSubscription_GCPConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The GCP project id where the subscription exists.
+	ProjectId string `protobuf:"bytes,1,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty"`
+	// The service account used to authenticate messages being delivered over push.
+	// If unset, pushes are rejected.
+	PushServiceAccount *string `protobuf:"bytes,2,opt,name=push_service_account,json=pushServiceAccount,proto3,oneof" json:"push_service_account,omitempty"`
+	// The audience to use when validating JWTs delivered over push.
+	// If set, the JWT audience claim must match. If unset, any JWT audience is allowed.
+	PushJwtAudience *string `protobuf:"bytes,3,opt,name=push_jwt_audience,json=pushJwtAudience,proto3,oneof" json:"push_jwt_audience,omitempty"`
+}
+
+func (x *PubSubSubscription_GCPConfig) Reset() {
+	*x = PubSubSubscription_GCPConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[29]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PubSubSubscription_GCPConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PubSubSubscription_GCPConfig) ProtoMessage() {}
+
+func (x *PubSubSubscription_GCPConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[29]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PubSubSubscription_GCPConfig.ProtoReflect.Descriptor instead.
+func (*PubSubSubscription_GCPConfig) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{16, 0}
+}
+
+func (x *PubSubSubscription_GCPConfig) GetProjectId() string {
+	if x != nil {
+		return x.ProjectId
+	}
+	return ""
+}
+
+func (x *PubSubSubscription_GCPConfig) GetPushServiceAccount() string {
+	if x != nil && x.PushServiceAccount != nil {
+		return *x.PushServiceAccount
+	}
+	return ""
+}
+
+func (x *PubSubSubscription_GCPConfig) GetPushJwtAudience() string {
+	if x != nil && x.PushJwtAudience != nil {
+		return *x.PushJwtAudience
+	}
+	return ""
+}
+
+type BucketCluster_S3 struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Region to connect to.
+	Region string `protobuf:"bytes,1,opt,name=region,proto3" json:"region,omitempty"`
+	// Endpoint override, if any. Must be specified if using a non-standard AWS region.
+	Endpoint *string `protobuf:"bytes,2,opt,name=endpoint,proto3,oneof" json:"endpoint,omitempty"`
+	// Set these to use explicit credentials for this bucket,
+	// as opposed to resolving using AWS's default credential chain.
+	AccessKeyId     *string     `protobuf:"bytes,3,opt,name=access_key_id,json=accessKeyId,proto3,oneof" json:"access_key_id,omitempty"`
+	SecretAccessKey *SecretData `protobuf:"bytes,4,opt,name=secret_access_key,json=secretAccessKey,proto3,oneof" json:"secret_access_key,omitempty"`
+}
+
+func (x *BucketCluster_S3) Reset() {
+	*x = BucketCluster_S3{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[30]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketCluster_S3) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketCluster_S3) ProtoMessage() {}
+
+func (x *BucketCluster_S3) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[30]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketCluster_S3.ProtoReflect.Descriptor instead.
+func (*BucketCluster_S3) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{17, 0}
+}
+
+func (x *BucketCluster_S3) GetRegion() string {
+	if x != nil {
+		return x.Region
+	}
+	return ""
+}
+
+func (x *BucketCluster_S3) GetEndpoint() string {
+	if x != nil && x.Endpoint != nil {
+		return *x.Endpoint
+	}
+	return ""
+}
+
+func (x *BucketCluster_S3) GetAccessKeyId() string {
+	if x != nil && x.AccessKeyId != nil {
+		return *x.AccessKeyId
+	}
+	return ""
+}
+
+func (x *BucketCluster_S3) GetSecretAccessKey() *SecretData {
+	if x != nil {
+		return x.SecretAccessKey
+	}
+	return nil
+}
+
+type BucketCluster_GCS struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Endpoint override, if any. Defaults to https://storage.googleapis.com if unset.
+	Endpoint *string `protobuf:"bytes,1,opt,name=endpoint,proto3,oneof" json:"endpoint,omitempty"`
+	// Whether to connect anonymously or if a service account should be resolved.
+	Anonymous bool `protobuf:"varint,2,opt,name=anonymous,proto3" json:"anonymous,omitempty"`
+	// Additional options for signed URLs when running in local dev mode.
+	// Only use with anonymous mode.
+	LocalSign *BucketCluster_GCS_LocalSignOptions `protobuf:"bytes,3,opt,name=local_sign,json=localSign,proto3,oneof" json:"local_sign,omitempty"`
+}
+
+func (x *BucketCluster_GCS) Reset() {
+	*x = BucketCluster_GCS{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[31]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketCluster_GCS) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketCluster_GCS) ProtoMessage() {}
+
+func (x *BucketCluster_GCS) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[31]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketCluster_GCS.ProtoReflect.Descriptor instead.
+func (*BucketCluster_GCS) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{17, 1}
+}
+
+func (x *BucketCluster_GCS) GetEndpoint() string {
+	if x != nil && x.Endpoint != nil {
+		return *x.Endpoint
+	}
+	return ""
+}
+
+func (x *BucketCluster_GCS) GetAnonymous() bool {
+	if x != nil {
+		return x.Anonymous
+	}
+	return false
+}
+
+func (x *BucketCluster_GCS) GetLocalSign() *BucketCluster_GCS_LocalSignOptions {
+	if x != nil {
+		return x.LocalSign
+	}
+	return nil
+}
+
+type BucketCluster_GCS_LocalSignOptions struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Base prefix to use for presigned URLs.
+	BaseUrl string `protobuf:"bytes,1,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"`
+	// Use these credentials to sign local URLs. Only pass dummy credentials
+	// here, no actual secrets.
+	AccessId   string `protobuf:"bytes,2,opt,name=access_id,json=accessId,proto3" json:"access_id,omitempty"`
+	PrivateKey string `protobuf:"bytes,3,opt,name=private_key,json=privateKey,proto3" json:"private_key,omitempty"`
+}
+
+func (x *BucketCluster_GCS_LocalSignOptions) Reset() {
+	*x = BucketCluster_GCS_LocalSignOptions{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[32]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketCluster_GCS_LocalSignOptions) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketCluster_GCS_LocalSignOptions) ProtoMessage() {}
+
+func (x *BucketCluster_GCS_LocalSignOptions) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[32]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketCluster_GCS_LocalSignOptions.ProtoReflect.Descriptor instead.
+func (*BucketCluster_GCS_LocalSignOptions) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{17, 1, 0}
+}
+
+func (x *BucketCluster_GCS_LocalSignOptions) GetBaseUrl() string {
+	if x != nil {
+		return x.BaseUrl
+	}
+	return ""
+}
+
+func (x *BucketCluster_GCS_LocalSignOptions) GetAccessId() string {
+	if x != nil {
+		return x.AccessId
+	}
+	return ""
+}
+
+func (x *BucketCluster_GCS_LocalSignOptions) GetPrivateKey() string {
+	if x != nil {
+		return x.PrivateKey
+	}
+	return ""
+}
+
+// CORS describes the CORS configuration for a gateway.
+type Gateway_CORS struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Debug bool `protobuf:"varint,1,opt,name=debug,proto3" json:"debug,omitempty"`
+	// If true, causes Encore to respond to OPTIONS requests
+	// without setting Access-Control-Allow-Credentials: true.
+	DisableCredentials bool `protobuf:"varint,2,opt,name=disable_credentials,json=disableCredentials,proto3" json:"disable_credentials,omitempty"`
+	// Specifies the allowed origins for requests that include credentials.
+	// If a request is made from an Origin in this list
+	// Encore responds with Access-Control-Allow-Origin: <Origin>.
+	//
+	// If disable_credentials is true this field is not used.
+	//
+	// Types that are assignable to AllowedOriginsWithCredentials:
+	//
+	//	*Gateway_CORS_AllowedOrigins
+	//	*Gateway_CORS_UnsafeAllowAllOriginsWithCredentials
+	AllowedOriginsWithCredentials isGateway_CORS_AllowedOriginsWithCredentials `protobuf_oneof:"allowed_origins_with_credentials"`
+	// Specifies the allowed origins for requests
+	// that don't include credentials.
+	//
+	// The URLs in this list may include wildcards (e.g. "https://*.example.com"
+	// or "https://*-myapp.example.com").
+	AllowedOriginsWithoutCredentials *Gateway_CORSAllowedOrigins `protobuf:"bytes,5,opt,name=allowed_origins_without_credentials,json=allowedOriginsWithoutCredentials,proto3" json:"allowed_origins_without_credentials,omitempty"`
+	// Specifies extra headers to allow, beyond
+	// the default set always recognized by Encore.
+	// As a special case, if the list contains "*" all headers are allowed.
+	ExtraAllowedHeaders []string `protobuf:"bytes,6,rep,name=extra_allowed_headers,json=extraAllowedHeaders,proto3" json:"extra_allowed_headers,omitempty"`
+	// Specifies extra headers to expose, beyond
+	// the default set always recognized by Encore.
+	// As a special case, if the list contains "*" all headers are allowed.
+	ExtraExposedHeaders []string `protobuf:"bytes,7,rep,name=extra_exposed_headers,json=extraExposedHeaders,proto3" json:"extra_exposed_headers,omitempty"`
+	// If true, allows requests to Encore apps running
+	// on private networks from websites.
+	// See: https://wicg.github.io/private-network-access/
+	AllowPrivateNetworkAccess bool `protobuf:"varint,8,opt,name=allow_private_network_access,json=allowPrivateNetworkAccess,proto3" json:"allow_private_network_access,omitempty"`
+}
+
+func (x *Gateway_CORS) Reset() {
+	*x = Gateway_CORS{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[33]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Gateway_CORS) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Gateway_CORS) ProtoMessage() {}
+
+func (x *Gateway_CORS) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[33]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Gateway_CORS.ProtoReflect.Descriptor instead.
+func (*Gateway_CORS) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{19, 0}
+}
+
+func (x *Gateway_CORS) GetDebug() bool {
+	if x != nil {
+		return x.Debug
+	}
+	return false
+}
+
+func (x *Gateway_CORS) GetDisableCredentials() bool {
+	if x != nil {
+		return x.DisableCredentials
+	}
+	return false
+}
+
+func (m *Gateway_CORS) GetAllowedOriginsWithCredentials() isGateway_CORS_AllowedOriginsWithCredentials {
+	if m != nil {
+		return m.AllowedOriginsWithCredentials
+	}
+	return nil
+}
+
+func (x *Gateway_CORS) GetAllowedOrigins() *Gateway_CORSAllowedOrigins {
+	if x, ok := x.GetAllowedOriginsWithCredentials().(*Gateway_CORS_AllowedOrigins); ok {
+		return x.AllowedOrigins
+	}
+	return nil
+}
+
+func (x *Gateway_CORS) GetUnsafeAllowAllOriginsWithCredentials() bool {
+	if x, ok := x.GetAllowedOriginsWithCredentials().(*Gateway_CORS_UnsafeAllowAllOriginsWithCredentials); ok {
+		return x.UnsafeAllowAllOriginsWithCredentials
+	}
+	return false
+}
+
+func (x *Gateway_CORS) GetAllowedOriginsWithoutCredentials() *Gateway_CORSAllowedOrigins {
+	if x != nil {
+		return x.AllowedOriginsWithoutCredentials
+	}
+	return nil
+}
+
+func (x *Gateway_CORS) GetExtraAllowedHeaders() []string {
+	if x != nil {
+		return x.ExtraAllowedHeaders
+	}
+	return nil
+}
+
+func (x *Gateway_CORS) GetExtraExposedHeaders() []string {
+	if x != nil {
+		return x.ExtraExposedHeaders
+	}
+	return nil
+}
+
+func (x *Gateway_CORS) GetAllowPrivateNetworkAccess() bool {
+	if x != nil {
+		return x.AllowPrivateNetworkAccess
+	}
+	return false
+}
+
+type isGateway_CORS_AllowedOriginsWithCredentials interface {
+	isGateway_CORS_AllowedOriginsWithCredentials()
+}
+
+type Gateway_CORS_AllowedOrigins struct {
+	AllowedOrigins *Gateway_CORSAllowedOrigins `protobuf:"bytes,3,opt,name=allowed_origins,json=allowedOrigins,proto3,oneof"`
+}
+
+type Gateway_CORS_UnsafeAllowAllOriginsWithCredentials struct {
+	UnsafeAllowAllOriginsWithCredentials bool `protobuf:"varint,4,opt,name=unsafe_allow_all_origins_with_credentials,json=unsafeAllowAllOriginsWithCredentials,proto3,oneof"`
+}
+
+func (*Gateway_CORS_AllowedOrigins) isGateway_CORS_AllowedOriginsWithCredentials() {}
+
+func (*Gateway_CORS_UnsafeAllowAllOriginsWithCredentials) isGateway_CORS_AllowedOriginsWithCredentials() {
+}
+
+type Gateway_CORSAllowedOrigins struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The list of allowed origins.
+	// The URLs in this list may include wildcards (e.g. "https://*.example.com"
+	// or "https://*-myapp.example.com").
+	//
+	// The string "*" allows all origins, except for requests with credentials;
+	// use CORS.unsafe_allow_unsafe_all_origins_with_credentials for that.
+	AllowedOrigins []string `protobuf:"bytes,1,rep,name=allowed_origins,json=allowedOrigins,proto3" json:"allowed_origins,omitempty"`
+}
+
+func (x *Gateway_CORSAllowedOrigins) Reset() {
+	*x = Gateway_CORSAllowedOrigins{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_infra_proto_msgTypes[34]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Gateway_CORSAllowedOrigins) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Gateway_CORSAllowedOrigins) ProtoMessage() {}
+
+func (x *Gateway_CORSAllowedOrigins) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_infra_proto_msgTypes[34]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Gateway_CORSAllowedOrigins.ProtoReflect.Descriptor instead.
+func (*Gateway_CORSAllowedOrigins) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_infra_proto_rawDescGZIP(), []int{19, 1}
+}
+
+func (x *Gateway_CORSAllowedOrigins) GetAllowedOrigins() []string {
+	if x != nil {
+		return x.AllowedOrigins
+	}
+	return nil
+}
+
+var File_encore_runtime_v1_infra_proto protoreflect.FileDescriptor
+
+var file_encore_runtime_v1_infra_proto_rawDesc = []byte{
+	0x0a, 0x1d, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6e, 0x66, 0x72, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
+	0x11, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e,
+	0x76, 0x31, 0x1a, 0x22, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x75, 0x6e, 0x74, 0x69,
+	0x6d, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x64, 0x61, 0x74, 0x61,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x9b, 0x06, 0x0a, 0x0e, 0x49, 0x6e, 0x66, 0x72, 0x61,
+	0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x75, 0x72, 0x65, 0x12, 0x49, 0x0a, 0x09, 0x72, 0x65, 0x73,
+	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x49, 0x6e, 0x66, 0x72, 0x61, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x75, 0x72, 0x65, 0x2e,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x73, 0x12, 0x4f, 0x0a, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
+	0x61, 0x6c, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x49, 0x6e,
+	0x66, 0x72, 0x61, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x75, 0x72, 0x65, 0x2e, 0x43, 0x72, 0x65,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x52, 0x0b, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x73, 0x1a, 0xc7, 0x01, 0x0a, 0x0b, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e,
+	0x74, 0x69, 0x61, 0x6c, 0x73, 0x12, 0x40, 0x0a, 0x0c, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f,
+	0x63, 0x65, 0x72, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x52, 0x0b, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x73, 0x12, 0x37, 0x0a, 0x09, 0x73, 0x71, 0x6c, 0x5f, 0x72,
+	0x6f, 0x6c, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53,
+	0x51, 0x4c, 0x52, 0x6f, 0x6c, 0x65, 0x52, 0x08, 0x73, 0x71, 0x6c, 0x52, 0x6f, 0x6c, 0x65, 0x73,
+	0x12, 0x3d, 0x0a, 0x0b, 0x72, 0x65, 0x64, 0x69, 0x73, 0x5f, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x18,
+	0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72,
+	0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x64, 0x69, 0x73, 0x52,
+	0x6f, 0x6c, 0x65, 0x52, 0x0a, 0x72, 0x65, 0x64, 0x69, 0x73, 0x52, 0x6f, 0x6c, 0x65, 0x73, 0x1a,
+	0xa2, 0x03, 0x0a, 0x09, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x36, 0x0a,
+	0x08, 0x67, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x52, 0x08, 0x67, 0x61, 0x74,
+	0x65, 0x77, 0x61, 0x79, 0x73, 0x12, 0x40, 0x0a, 0x0c, 0x73, 0x71, 0x6c, 0x5f, 0x63, 0x6c, 0x75,
+	0x73, 0x74, 0x65, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x53, 0x51, 0x4c, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x0b, 0x73, 0x71, 0x6c, 0x43,
+	0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x12, 0x49, 0x0a, 0x0f, 0x70, 0x75, 0x62, 0x73, 0x75,
+	0x62, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x43, 0x6c, 0x75, 0x73, 0x74,
+	0x65, 0x72, 0x52, 0x0e, 0x70, 0x75, 0x62, 0x73, 0x75, 0x62, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65,
+	0x72, 0x73, 0x12, 0x46, 0x0a, 0x0e, 0x72, 0x65, 0x64, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52,
+	0x65, 0x64, 0x69, 0x73, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x52, 0x0d, 0x72, 0x65, 0x64,
+	0x69, 0x73, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x12, 0x3d, 0x0a, 0x0b, 0x61, 0x70,
+	0x70, 0x5f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x41, 0x70, 0x70, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x0a, 0x61,
+	0x70, 0x70, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x73, 0x12, 0x49, 0x0a, 0x0f, 0x62, 0x75, 0x63,
+	0x6b, 0x65, 0x74, 0x5f, 0x63, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x73, 0x18, 0x06, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74,
+	0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x43, 0x6c, 0x75,
+	0x73, 0x74, 0x65, 0x72, 0x52, 0x0e, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x43, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x73, 0x22, 0x94, 0x01, 0x0a, 0x0a, 0x53, 0x51, 0x4c, 0x43, 0x6c, 0x75, 0x73,
+	0x74, 0x65, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x36, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73,
+	0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x51, 0x4c, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x52, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x73, 0x12, 0x3c, 0x0a,
+	0x09, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x51, 0x4c, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65,
+	0x52, 0x09, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x73, 0x22, 0xc8, 0x01, 0x0a, 0x09,
+	0x54, 0x4c, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x29, 0x0a, 0x0e, 0x73, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x5f, 0x63, 0x61, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x48, 0x00, 0x52, 0x0c, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x61, 0x43, 0x65, 0x72,
+	0x74, 0x88, 0x01, 0x01, 0x12, 0x49, 0x0a, 0x21, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f,
+	0x74, 0x6c, 0x73, 0x5f, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65, 0x5f, 0x76, 0x65, 0x72,
+	0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x1e, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x54, 0x6c, 0x73, 0x48, 0x6f, 0x73, 0x74, 0x6e,
+	0x61, 0x6d, 0x65, 0x56, 0x65, 0x72, 0x69, 0x66, 0x69, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x32, 0x0a, 0x15, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x63, 0x61, 0x5f, 0x76, 0x61,
+	0x6c, 0x69, 0x64, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x13,
+	0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x43, 0x61, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x42, 0x11, 0x0a, 0x0f, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63,
+	0x61, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x22, 0xb5, 0x01, 0x0a, 0x09, 0x53, 0x51, 0x4c, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x31, 0x0a, 0x04, 0x6b, 0x69,
+	0x6e, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x4b, 0x69, 0x6e, 0x64, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x40, 0x0a,
+	0x0a, 0x74, 0x6c, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69,
+	0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x4c, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x48,
+	0x00, 0x52, 0x09, 0x74, 0x6c, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x88, 0x01, 0x01, 0x42,
+	0x0d, 0x0a, 0x0b, 0x5f, 0x74, 0x6c, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x63,
+	0x0a, 0x0a, 0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x12, 0x10, 0x0a, 0x03,
+	0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x12,
+	0x0a, 0x04, 0x63, 0x65, 0x72, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x63, 0x65,
+	0x72, 0x74, 0x12, 0x2f, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x44, 0x61, 0x74, 0x61, 0x52, 0x03,
+	0x6b, 0x65, 0x79, 0x22, 0xb3, 0x01, 0x0a, 0x07, 0x53, 0x51, 0x4c, 0x52, 0x6f, 0x6c, 0x65, 0x12,
+	0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69,
+	0x64, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x39, 0x0a,
+	0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x44, 0x61, 0x74, 0x61, 0x52, 0x08,
+	0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x12, 0x2b, 0x0a, 0x0f, 0x63, 0x6c, 0x69, 0x65,
+	0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x72, 0x69, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x09, 0x48, 0x00, 0x52, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x52,
+	0x69, 0x64, 0x88, 0x01, 0x01, 0x42, 0x12, 0x0a, 0x10, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x5f, 0x63, 0x65, 0x72, 0x74, 0x5f, 0x72, 0x69, 0x64, 0x22, 0xa4, 0x01, 0x0a, 0x0b, 0x53, 0x51,
+	0x4c, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0a, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a,
+	0x63, 0x6c, 0x6f, 0x75, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x43, 0x0a, 0x0a, 0x63,
+	0x6f, 0x6e, 0x6e, 0x5f, 0x70, 0x6f, 0x6f, 0x6c, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x53, 0x51, 0x4c, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x50, 0x6f, 0x6f, 0x6c, 0x52, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x50, 0x6f, 0x6f, 0x6c, 0x73,
+	0x22, 0xa1, 0x01, 0x0a, 0x11, 0x53, 0x51, 0x4c, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69,
+	0x6f, 0x6e, 0x50, 0x6f, 0x6f, 0x6c, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x73, 0x5f, 0x72, 0x65, 0x61,
+	0x64, 0x6f, 0x6e, 0x6c, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x69, 0x73, 0x52,
+	0x65, 0x61, 0x64, 0x6f, 0x6e, 0x6c, 0x79, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x6f, 0x6c, 0x65, 0x5f,
+	0x72, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x72, 0x6f, 0x6c, 0x65, 0x52,
+	0x69, 0x64, 0x12, 0x27, 0x0a, 0x0f, 0x6d, 0x69, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0e, 0x6d, 0x69, 0x6e,
+	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x6d,
+	0x61, 0x78, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x05, 0x52, 0x0e, 0x6d, 0x61, 0x78, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x22, 0x9a, 0x01, 0x0a, 0x0c, 0x52, 0x65, 0x64, 0x69, 0x73, 0x43, 0x6c,
+	0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x38, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x64,
+	0x69, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x52, 0x07, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x73, 0x12, 0x3e, 0x0a, 0x09, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x73, 0x18, 0x03,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75,
+	0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x64, 0x69, 0x73, 0x44, 0x61,
+	0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x52, 0x09, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65,
+	0x73, 0x22, 0xb7, 0x01, 0x0a, 0x0b, 0x52, 0x65, 0x64, 0x69, 0x73, 0x53, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x72, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x68, 0x6f, 0x73, 0x74, 0x12, 0x31, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72,
+	0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x4b, 0x69, 0x6e, 0x64, 0x52, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x12, 0x40, 0x0a, 0x0a, 0x74, 0x6c,
+	0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1c,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x54, 0x4c, 0x53, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x48, 0x00, 0x52, 0x09,
+	0x74, 0x6c, 0x73, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x88, 0x01, 0x01, 0x42, 0x0d, 0x0a, 0x0b,
+	0x5f, 0x74, 0x6c, 0x73, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xa3, 0x01, 0x0a, 0x13,
+	0x52, 0x65, 0x64, 0x69, 0x73, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x50,
+	0x6f, 0x6f, 0x6c, 0x12, 0x1f, 0x0a, 0x0b, 0x69, 0x73, 0x5f, 0x72, 0x65, 0x61, 0x64, 0x6f, 0x6e,
+	0x6c, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x69, 0x73, 0x52, 0x65, 0x61, 0x64,
+	0x6f, 0x6e, 0x6c, 0x79, 0x12, 0x19, 0x0a, 0x08, 0x72, 0x6f, 0x6c, 0x65, 0x5f, 0x72, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x72, 0x6f, 0x6c, 0x65, 0x52, 0x69, 0x64, 0x12,
+	0x27, 0x0a, 0x0f, 0x6d, 0x69, 0x6e, 0x5f, 0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0e, 0x6d, 0x69, 0x6e, 0x43, 0x6f, 0x6e,
+	0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x6d, 0x61, 0x78, 0x5f,
+	0x63, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x0e, 0x6d, 0x61, 0x78, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x22, 0xc4, 0x02, 0x0a, 0x09, 0x52, 0x65, 0x64, 0x69, 0x73, 0x52, 0x6f, 0x6c, 0x65, 0x12,
+	0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69,
+	0x64, 0x12, 0x2b, 0x0a, 0x0f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x63, 0x65, 0x72, 0x74,
+	0x5f, 0x72, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x0d, 0x63, 0x6c,
+	0x69, 0x65, 0x6e, 0x74, 0x43, 0x65, 0x72, 0x74, 0x52, 0x69, 0x64, 0x88, 0x01, 0x01, 0x12, 0x38,
+	0x0a, 0x03, 0x61, 0x63, 0x6c, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x52, 0x65, 0x64, 0x69, 0x73, 0x52, 0x6f, 0x6c, 0x65, 0x2e, 0x41, 0x75, 0x74, 0x68, 0x41, 0x43,
+	0x4c, 0x48, 0x00, 0x52, 0x03, 0x61, 0x63, 0x6c, 0x12, 0x40, 0x0a, 0x0b, 0x61, 0x75, 0x74, 0x68,
+	0x5f, 0x73, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x44, 0x61, 0x74, 0x61, 0x48, 0x00, 0x52, 0x0a,
+	0x61, 0x75, 0x74, 0x68, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x1a, 0x60, 0x0a, 0x07, 0x41, 0x75,
+	0x74, 0x68, 0x41, 0x43, 0x4c, 0x12, 0x1a, 0x0a, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x75, 0x73, 0x65, 0x72, 0x6e, 0x61, 0x6d,
+	0x65, 0x12, 0x39, 0x0a, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e,
+	0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x44, 0x61,
+	0x74, 0x61, 0x52, 0x08, 0x70, 0x61, 0x73, 0x73, 0x77, 0x6f, 0x72, 0x64, 0x42, 0x06, 0x0a, 0x04,
+	0x61, 0x75, 0x74, 0x68, 0x42, 0x12, 0x0a, 0x10, 0x5f, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f,
+	0x63, 0x65, 0x72, 0x74, 0x5f, 0x72, 0x69, 0x64, 0x22, 0xdf, 0x01, 0x0a, 0x0d, 0x52, 0x65, 0x64,
+	0x69, 0x73, 0x44, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x1f, 0x0a, 0x0b,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0a, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x21, 0x0a,
+	0x0c, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x69, 0x64, 0x78, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x05, 0x52, 0x0b, 0x64, 0x61, 0x74, 0x61, 0x62, 0x61, 0x73, 0x65, 0x49, 0x64, 0x78,
+	0x12, 0x22, 0x0a, 0x0a, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x6b, 0x65, 0x79, 0x50, 0x72, 0x65, 0x66, 0x69,
+	0x78, 0x88, 0x01, 0x01, 0x12, 0x45, 0x0a, 0x0a, 0x63, 0x6f, 0x6e, 0x6e, 0x5f, 0x70, 0x6f, 0x6f,
+	0x6c, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x65, 0x64,
+	0x69, 0x73, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x50, 0x6f, 0x6f, 0x6c,
+	0x52, 0x09, 0x63, 0x6f, 0x6e, 0x6e, 0x50, 0x6f, 0x6f, 0x6c, 0x73, 0x42, 0x0d, 0x0a, 0x0b, 0x5f,
+	0x6b, 0x65, 0x79, 0x5f, 0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x22, 0x71, 0x0a, 0x09, 0x41, 0x70,
+	0x70, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x31, 0x0a, 0x04, 0x64, 0x61,
+	0x74, 0x61, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x63,
+	0x72, 0x65, 0x74, 0x44, 0x61, 0x74, 0x61, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0xf5, 0x04,
+	0x0a, 0x0d, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12,
+	0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69,
+	0x64, 0x12, 0x36, 0x0a, 0x06, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69,
+	0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x54, 0x6f, 0x70, 0x69,
+	0x63, 0x52, 0x06, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x73, 0x12, 0x4b, 0x0a, 0x0d, 0x73, 0x75, 0x62,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x53, 0x75, 0x62, 0x73, 0x63,
+	0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0d, 0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x46, 0x0a, 0x06, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75,
+	0x62, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2e, 0x45, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x43,
+	0x6c, 0x6f, 0x75, 0x64, 0x48, 0x00, 0x52, 0x06, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x12, 0x3e,
+	0x0a, 0x03, 0x61, 0x77, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2e, 0x41, 0x57,
+	0x53, 0x53, 0x71, 0x73, 0x53, 0x6e, 0x73, 0x48, 0x00, 0x52, 0x03, 0x61, 0x77, 0x73, 0x12, 0x3e,
+	0x0a, 0x03, 0x67, 0x63, 0x70, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2e, 0x47, 0x43,
+	0x50, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x48, 0x00, 0x52, 0x03, 0x67, 0x63, 0x70, 0x12, 0x48,
+	0x0a, 0x05, 0x61, 0x7a, 0x75, 0x72, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2e,
+	0x41, 0x7a, 0x75, 0x72, 0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x42, 0x75, 0x73, 0x48,
+	0x00, 0x52, 0x05, 0x61, 0x7a, 0x75, 0x72, 0x65, 0x12, 0x38, 0x0a, 0x03, 0x6e, 0x73, 0x71, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72,
+	0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62,
+	0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2e, 0x4e, 0x53, 0x51, 0x48, 0x00, 0x52, 0x03, 0x6e,
+	0x73, 0x71, 0x1a, 0x0d, 0x0a, 0x0b, 0x45, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x43, 0x6c, 0x6f, 0x75,
+	0x64, 0x1a, 0x0b, 0x0a, 0x09, 0x41, 0x57, 0x53, 0x53, 0x71, 0x73, 0x53, 0x6e, 0x73, 0x1a, 0x0b,
+	0x0a, 0x09, 0x47, 0x43, 0x50, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x1a, 0x1b, 0x0a, 0x03, 0x4e,
+	0x53, 0x51, 0x12, 0x14, 0x0a, 0x05, 0x68, 0x6f, 0x73, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x09, 0x52, 0x05, 0x68, 0x6f, 0x73, 0x74, 0x73, 0x1a, 0x2f, 0x0a, 0x0f, 0x41, 0x7a, 0x75, 0x72,
+	0x65, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x42, 0x75, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x6e,
+	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x0a, 0x0a, 0x08, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x22, 0x8b, 0x04, 0x0a, 0x0b, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62,
+	0x54, 0x6f, 0x70, 0x69, 0x63, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x63, 0x6c, 0x6f, 0x75,
+	0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x6c,
+	0x6f, 0x75, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x5f, 0x0a, 0x12, 0x64, 0x65, 0x6c, 0x69, 0x76,
+	0x65, 0x72, 0x79, 0x5f, 0x67, 0x75, 0x61, 0x72, 0x61, 0x6e, 0x74, 0x65, 0x65, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x30, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e,
+	0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x54, 0x6f,
+	0x70, 0x69, 0x63, 0x2e, 0x44, 0x65, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x79, 0x47, 0x75, 0x61, 0x72,
+	0x61, 0x6e, 0x74, 0x65, 0x65, 0x52, 0x11, 0x64, 0x65, 0x6c, 0x69, 0x76, 0x65, 0x72, 0x79, 0x47,
+	0x75, 0x61, 0x72, 0x61, 0x6e, 0x74, 0x65, 0x65, 0x12, 0x28, 0x0a, 0x0d, 0x6f, 0x72, 0x64, 0x65,
+	0x72, 0x69, 0x6e, 0x67, 0x5f, 0x61, 0x74, 0x74, 0x72, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x48,
+	0x01, 0x52, 0x0c, 0x6f, 0x72, 0x64, 0x65, 0x72, 0x69, 0x6e, 0x67, 0x41, 0x74, 0x74, 0x72, 0x88,
+	0x01, 0x01, 0x12, 0x49, 0x0a, 0x0a, 0x67, 0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
+	0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75,
+	0x62, 0x54, 0x6f, 0x70, 0x69, 0x63, 0x2e, 0x47, 0x43, 0x50, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x48, 0x00, 0x52, 0x09, 0x67, 0x63, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x2a, 0x0a,
+	0x09, 0x47, 0x43, 0x50, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72,
+	0x6f, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09,
+	0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x49, 0x64, 0x22, 0x82, 0x01, 0x0a, 0x11, 0x44, 0x65,
+	0x6c, 0x69, 0x76, 0x65, 0x72, 0x79, 0x47, 0x75, 0x61, 0x72, 0x61, 0x6e, 0x74, 0x65, 0x65, 0x12,
+	0x22, 0x0a, 0x1e, 0x44, 0x45, 0x4c, 0x49, 0x56, 0x45, 0x52, 0x59, 0x5f, 0x47, 0x55, 0x41, 0x52,
+	0x41, 0x4e, 0x54, 0x45, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45,
+	0x44, 0x10, 0x00, 0x12, 0x24, 0x0a, 0x20, 0x44, 0x45, 0x4c, 0x49, 0x56, 0x45, 0x52, 0x59, 0x5f,
+	0x47, 0x55, 0x41, 0x52, 0x41, 0x4e, 0x54, 0x45, 0x45, 0x5f, 0x41, 0x54, 0x5f, 0x4c, 0x45, 0x41,
+	0x53, 0x54, 0x5f, 0x4f, 0x4e, 0x43, 0x45, 0x10, 0x01, 0x12, 0x23, 0x0a, 0x1f, 0x44, 0x45, 0x4c,
+	0x49, 0x56, 0x45, 0x52, 0x59, 0x5f, 0x47, 0x55, 0x41, 0x52, 0x41, 0x4e, 0x54, 0x45, 0x45, 0x5f,
+	0x45, 0x58, 0x41, 0x43, 0x54, 0x4c, 0x59, 0x5f, 0x4f, 0x4e, 0x43, 0x45, 0x10, 0x02, 0x42, 0x11,
+	0x0a, 0x0f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x6f, 0x72, 0x64, 0x65, 0x72, 0x69, 0x6e, 0x67, 0x5f, 0x61,
+	0x74, 0x74, 0x72, 0x22, 0xb4, 0x04, 0x0a, 0x12, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62, 0x53, 0x75,
+	0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x2a, 0x0a, 0x11,
+	0x74, 0x6f, 0x70, 0x69, 0x63, 0x5f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x5f, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x45, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x38, 0x0a, 0x18, 0x73, 0x75, 0x62, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x5f,
+	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x16, 0x73, 0x75, 0x62, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x4e, 0x61,
+	0x6d, 0x65, 0x12, 0x28, 0x0a, 0x10, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x5f, 0x63, 0x6c, 0x6f, 0x75,
+	0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f,
+	0x70, 0x69, 0x63, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x36, 0x0a, 0x17,
+	0x73, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x63, 0x6c, 0x6f,
+	0x75, 0x64, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x73,
+	0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x43, 0x6c, 0x6f, 0x75, 0x64,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x70, 0x75, 0x73, 0x68, 0x5f, 0x6f, 0x6e, 0x6c,
+	0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x70, 0x75, 0x73, 0x68, 0x4f, 0x6e, 0x6c,
+	0x79, 0x12, 0x50, 0x0a, 0x0a, 0x67, 0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
+	0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72,
+	0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x53, 0x75, 0x62,
+	0x53, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x47, 0x43, 0x50,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x48, 0x00, 0x52, 0x09, 0x67, 0x63, 0x70, 0x43, 0x6f, 0x6e,
+	0x66, 0x69, 0x67, 0x1a, 0xc1, 0x01, 0x0a, 0x09, 0x47, 0x43, 0x50, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x12, 0x1d, 0x0a, 0x0a, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x49, 0x64,
+	0x12, 0x35, 0x0a, 0x14, 0x70, 0x75, 0x73, 0x68, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x5f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00,
+	0x52, 0x12, 0x70, 0x75, 0x73, 0x68, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x63, 0x63,
+	0x6f, 0x75, 0x6e, 0x74, 0x88, 0x01, 0x01, 0x12, 0x2f, 0x0a, 0x11, 0x70, 0x75, 0x73, 0x68, 0x5f,
+	0x6a, 0x77, 0x74, 0x5f, 0x61, 0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x48, 0x01, 0x52, 0x0f, 0x70, 0x75, 0x73, 0x68, 0x4a, 0x77, 0x74, 0x41, 0x75, 0x64,
+	0x69, 0x65, 0x6e, 0x63, 0x65, 0x88, 0x01, 0x01, 0x42, 0x17, 0x0a, 0x15, 0x5f, 0x70, 0x75, 0x73,
+	0x68, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x61, 0x63, 0x63, 0x6f, 0x75, 0x6e,
+	0x74, 0x42, 0x14, 0x0a, 0x12, 0x5f, 0x70, 0x75, 0x73, 0x68, 0x5f, 0x6a, 0x77, 0x74, 0x5f, 0x61,
+	0x75, 0x64, 0x69, 0x65, 0x6e, 0x63, 0x65, 0x42, 0x11, 0x0a, 0x0f, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0xec, 0x05, 0x0a, 0x0d, 0x42,
+	0x75, 0x63, 0x6b, 0x65, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x12, 0x10, 0x0a, 0x03,
+	0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x33,
+	0x0a, 0x07, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x19, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x52, 0x07, 0x62, 0x75, 0x63, 0x6b,
+	0x65, 0x74, 0x73, 0x12, 0x35, 0x0a, 0x02, 0x73, 0x33, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x23, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65,
+	0x72, 0x2e, 0x53, 0x33, 0x48, 0x00, 0x52, 0x02, 0x73, 0x33, 0x12, 0x38, 0x0a, 0x03, 0x67, 0x63,
+	0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x75, 0x63, 0x6b,
+	0x65, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2e, 0x47, 0x43, 0x53, 0x48, 0x00, 0x52,
+	0x03, 0x67, 0x63, 0x73, 0x1a, 0xeb, 0x01, 0x0a, 0x02, 0x53, 0x33, 0x12, 0x16, 0x0a, 0x06, 0x72,
+	0x65, 0x67, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x72, 0x65, 0x67,
+	0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x08, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x88, 0x01, 0x01, 0x12, 0x27, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6b,
+	0x65, 0x79, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x0b, 0x61,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x4b, 0x65, 0x79, 0x49, 0x64, 0x88, 0x01, 0x01, 0x12, 0x4e, 0x0a,
+	0x11, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6b,
+	0x65, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x63,
+	0x72, 0x65, 0x74, 0x44, 0x61, 0x74, 0x61, 0x48, 0x02, 0x52, 0x0f, 0x73, 0x65, 0x63, 0x72, 0x65,
+	0x74, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x4b, 0x65, 0x79, 0x88, 0x01, 0x01, 0x42, 0x0b, 0x0a,
+	0x09, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x61,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6b, 0x65, 0x79, 0x5f, 0x69, 0x64, 0x42, 0x14, 0x0a, 0x12,
+	0x5f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x6b,
+	0x65, 0x79, 0x1a, 0xa8, 0x02, 0x0a, 0x03, 0x47, 0x43, 0x53, 0x12, 0x1f, 0x0a, 0x08, 0x65, 0x6e,
+	0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x08,
+	0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x88, 0x01, 0x01, 0x12, 0x1c, 0x0a, 0x09, 0x61,
+	0x6e, 0x6f, 0x6e, 0x79, 0x6d, 0x6f, 0x75, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09,
+	0x61, 0x6e, 0x6f, 0x6e, 0x79, 0x6d, 0x6f, 0x75, 0x73, 0x12, 0x59, 0x0a, 0x0a, 0x6c, 0x6f, 0x63,
+	0x61, 0x6c, 0x5f, 0x73, 0x69, 0x67, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x35, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x43, 0x6c, 0x75, 0x73, 0x74, 0x65, 0x72, 0x2e,
+	0x47, 0x43, 0x53, 0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x53, 0x69, 0x67, 0x6e, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x48, 0x01, 0x52, 0x09, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x53, 0x69, 0x67,
+	0x6e, 0x88, 0x01, 0x01, 0x1a, 0x6b, 0x0a, 0x10, 0x4c, 0x6f, 0x63, 0x61, 0x6c, 0x53, 0x69, 0x67,
+	0x6e, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x19, 0x0a, 0x08, 0x62, 0x61, 0x73, 0x65,
+	0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x62, 0x61, 0x73, 0x65,
+	0x55, 0x72, 0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x49, 0x64,
+	0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b, 0x65,
+	0x79, 0x42, 0x0b, 0x0a, 0x09, 0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x42, 0x0d,
+	0x0a, 0x0b, 0x5f, 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x5f, 0x73, 0x69, 0x67, 0x6e, 0x42, 0x0a, 0x0a,
+	0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x22, 0xce, 0x01, 0x0a, 0x06, 0x42, 0x75,
+	0x63, 0x6b, 0x65, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x63, 0x6c, 0x6f,
+	0x75, 0x64, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x22, 0x0a, 0x0a, 0x6b, 0x65, 0x79, 0x5f, 0x70, 0x72,
+	0x65, 0x66, 0x69, 0x78, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x6b, 0x65,
+	0x79, 0x50, 0x72, 0x65, 0x66, 0x69, 0x78, 0x88, 0x01, 0x01, 0x12, 0x2b, 0x0a, 0x0f, 0x70, 0x75,
+	0x62, 0x6c, 0x69, 0x63, 0x5f, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x0d, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x42, 0x61, 0x73,
+	0x65, 0x55, 0x72, 0x6c, 0x88, 0x01, 0x01, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x6b, 0x65, 0x79, 0x5f,
+	0x70, 0x72, 0x65, 0x66, 0x69, 0x78, 0x42, 0x12, 0x0a, 0x10, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69,
+	0x63, 0x5f, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x22, 0xb9, 0x06, 0x0a, 0x07, 0x47,
+	0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x62, 0x61, 0x73,
+	0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x62, 0x61, 0x73,
+	0x65, 0x55, 0x72, 0x6c, 0x12, 0x1c, 0x0a, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d, 0x65,
+	0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x09, 0x68, 0x6f, 0x73, 0x74, 0x6e, 0x61, 0x6d,
+	0x65, 0x73, 0x12, 0x33, 0x0a, 0x04, 0x63, 0x6f, 0x72, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x2e, 0x43, 0x4f, 0x52,
+	0x53, 0x52, 0x04, 0x63, 0x6f, 0x72, 0x73, 0x1a, 0xcd, 0x04, 0x0a, 0x04, 0x43, 0x4f, 0x52, 0x53,
+	0x12, 0x14, 0x0a, 0x05, 0x64, 0x65, 0x62, 0x75, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52,
+	0x05, 0x64, 0x65, 0x62, 0x75, 0x67, 0x12, 0x2f, 0x0a, 0x13, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c,
+	0x65, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x12, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x43, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x12, 0x58, 0x0a, 0x0f, 0x61, 0x6c, 0x6c, 0x6f, 0x77,
+	0x65, 0x64, 0x5f, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x2d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x2e, 0x43, 0x4f, 0x52,
+	0x53, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x4f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x73, 0x48,
+	0x00, 0x52, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x4f, 0x72, 0x69, 0x67, 0x69, 0x6e,
+	0x73, 0x12, 0x59, 0x0a, 0x29, 0x75, 0x6e, 0x73, 0x61, 0x66, 0x65, 0x5f, 0x61, 0x6c, 0x6c, 0x6f,
+	0x77, 0x5f, 0x61, 0x6c, 0x6c, 0x5f, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x73, 0x5f, 0x77, 0x69,
+	0x74, 0x68, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x08, 0x48, 0x00, 0x52, 0x24, 0x75, 0x6e, 0x73, 0x61, 0x66, 0x65, 0x41, 0x6c,
+	0x6c, 0x6f, 0x77, 0x41, 0x6c, 0x6c, 0x4f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x73, 0x57, 0x69, 0x74,
+	0x68, 0x43, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x12, 0x7c, 0x0a, 0x23,
+	0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x73, 0x5f,
+	0x77, 0x69, 0x74, 0x68, 0x6f, 0x75, 0x74, 0x5f, 0x63, 0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69,
+	0x61, 0x6c, 0x73, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x47, 0x61,
+	0x74, 0x65, 0x77, 0x61, 0x79, 0x2e, 0x43, 0x4f, 0x52, 0x53, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
+	0x64, 0x4f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x73, 0x52, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65,
+	0x64, 0x4f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x73, 0x57, 0x69, 0x74, 0x68, 0x6f, 0x75, 0x74, 0x43,
+	0x72, 0x65, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x12, 0x32, 0x0a, 0x15, 0x65, 0x78,
+	0x74, 0x72, 0x61, 0x5f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x68, 0x65, 0x61, 0x64,
+	0x65, 0x72, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x65, 0x78, 0x74, 0x72, 0x61,
+	0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x48, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x12, 0x32,
+	0x0a, 0x15, 0x65, 0x78, 0x74, 0x72, 0x61, 0x5f, 0x65, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x64, 0x5f,
+	0x68, 0x65, 0x61, 0x64, 0x65, 0x72, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x09, 0x52, 0x13, 0x65,
+	0x78, 0x74, 0x72, 0x61, 0x45, 0x78, 0x70, 0x6f, 0x73, 0x65, 0x64, 0x48, 0x65, 0x61, 0x64, 0x65,
+	0x72, 0x73, 0x12, 0x3f, 0x0a, 0x1c, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x70, 0x72, 0x69, 0x76,
+	0x61, 0x74, 0x65, 0x5f, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x5f, 0x61, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x19, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x50,
+	0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x42, 0x22, 0x0a, 0x20, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x6f,
+	0x72, 0x69, 0x67, 0x69, 0x6e, 0x73, 0x5f, 0x77, 0x69, 0x74, 0x68, 0x5f, 0x63, 0x72, 0x65, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x61, 0x6c, 0x73, 0x1a, 0x3d, 0x0a, 0x12, 0x43, 0x4f, 0x52, 0x53, 0x41,
+	0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x4f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x73, 0x12, 0x27, 0x0a,
+	0x0f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x5f, 0x6f, 0x72, 0x69, 0x67, 0x69, 0x6e, 0x73,
+	0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x65, 0x64, 0x4f,
+	0x72, 0x69, 0x67, 0x69, 0x6e, 0x73, 0x2a, 0x7d, 0x0a, 0x0a, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x4b, 0x69, 0x6e, 0x64, 0x12, 0x1b, 0x0a, 0x17, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x5f, 0x4b,
+	0x49, 0x4e, 0x44, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10,
+	0x00, 0x12, 0x17, 0x0a, 0x13, 0x53, 0x45, 0x52, 0x56, 0x45, 0x52, 0x5f, 0x4b, 0x49, 0x4e, 0x44,
+	0x5f, 0x50, 0x52, 0x49, 0x4d, 0x41, 0x52, 0x59, 0x10, 0x01, 0x12, 0x1b, 0x0a, 0x17, 0x53, 0x45,
+	0x52, 0x56, 0x45, 0x52, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x48, 0x4f, 0x54, 0x5f, 0x53, 0x54,
+	0x41, 0x4e, 0x44, 0x42, 0x59, 0x10, 0x02, 0x12, 0x1c, 0x0a, 0x18, 0x53, 0x45, 0x52, 0x56, 0x45,
+	0x52, 0x5f, 0x4b, 0x49, 0x4e, 0x44, 0x5f, 0x52, 0x45, 0x41, 0x44, 0x5f, 0x52, 0x45, 0x50, 0x4c,
+	0x49, 0x43, 0x41, 0x10, 0x03, 0x42, 0x2c, 0x5a, 0x2a, 0x65, 0x6e, 0x63, 0x72, 0x2e, 0x64, 0x65,
+	0x76, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x72,
+	0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x76, 0x31, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_encore_runtime_v1_infra_proto_rawDescOnce sync.Once
+	file_encore_runtime_v1_infra_proto_rawDescData = file_encore_runtime_v1_infra_proto_rawDesc
+)
+
+func file_encore_runtime_v1_infra_proto_rawDescGZIP() []byte {
+	file_encore_runtime_v1_infra_proto_rawDescOnce.Do(func() {
+		file_encore_runtime_v1_infra_proto_rawDescData = protoimpl.X.CompressGZIP(file_encore_runtime_v1_infra_proto_rawDescData)
+	})
+	return file_encore_runtime_v1_infra_proto_rawDescData
+}
+
+var file_encore_runtime_v1_infra_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_encore_runtime_v1_infra_proto_msgTypes = make([]protoimpl.MessageInfo, 35)
+var file_encore_runtime_v1_infra_proto_goTypes = []interface{}{
+	(ServerKind)(0),                            // 0: encore.runtime.v1.ServerKind
+	(PubSubTopic_DeliveryGuarantee)(0),         // 1: encore.runtime.v1.PubSubTopic.DeliveryGuarantee
+	(*Infrastructure)(nil),                     // 2: encore.runtime.v1.Infrastructure
+	(*SQLCluster)(nil),                         // 3: encore.runtime.v1.SQLCluster
+	(*TLSConfig)(nil),                          // 4: encore.runtime.v1.TLSConfig
+	(*SQLServer)(nil),                          // 5: encore.runtime.v1.SQLServer
+	(*ClientCert)(nil),                         // 6: encore.runtime.v1.ClientCert
+	(*SQLRole)(nil),                            // 7: encore.runtime.v1.SQLRole
+	(*SQLDatabase)(nil),                        // 8: encore.runtime.v1.SQLDatabase
+	(*SQLConnectionPool)(nil),                  // 9: encore.runtime.v1.SQLConnectionPool
+	(*RedisCluster)(nil),                       // 10: encore.runtime.v1.RedisCluster
+	(*RedisServer)(nil),                        // 11: encore.runtime.v1.RedisServer
+	(*RedisConnectionPool)(nil),                // 12: encore.runtime.v1.RedisConnectionPool
+	(*RedisRole)(nil),                          // 13: encore.runtime.v1.RedisRole
+	(*RedisDatabase)(nil),                      // 14: encore.runtime.v1.RedisDatabase
+	(*AppSecret)(nil),                          // 15: encore.runtime.v1.AppSecret
+	(*PubSubCluster)(nil),                      // 16: encore.runtime.v1.PubSubCluster
+	(*PubSubTopic)(nil),                        // 17: encore.runtime.v1.PubSubTopic
+	(*PubSubSubscription)(nil),                 // 18: encore.runtime.v1.PubSubSubscription
+	(*BucketCluster)(nil),                      // 19: encore.runtime.v1.BucketCluster
+	(*Bucket)(nil),                             // 20: encore.runtime.v1.Bucket
+	(*Gateway)(nil),                            // 21: encore.runtime.v1.Gateway
+	(*Infrastructure_Credentials)(nil),         // 22: encore.runtime.v1.Infrastructure.Credentials
+	(*Infrastructure_Resources)(nil),           // 23: encore.runtime.v1.Infrastructure.Resources
+	(*RedisRole_AuthACL)(nil),                  // 24: encore.runtime.v1.RedisRole.AuthACL
+	(*PubSubCluster_EncoreCloud)(nil),          // 25: encore.runtime.v1.PubSubCluster.EncoreCloud
+	(*PubSubCluster_AWSSqsSns)(nil),            // 26: encore.runtime.v1.PubSubCluster.AWSSqsSns
+	(*PubSubCluster_GCPPubSub)(nil),            // 27: encore.runtime.v1.PubSubCluster.GCPPubSub
+	(*PubSubCluster_NSQ)(nil),                  // 28: encore.runtime.v1.PubSubCluster.NSQ
+	(*PubSubCluster_AzureServiceBus)(nil),      // 29: encore.runtime.v1.PubSubCluster.AzureServiceBus
+	(*PubSubTopic_GCPConfig)(nil),              // 30: encore.runtime.v1.PubSubTopic.GCPConfig
+	(*PubSubSubscription_GCPConfig)(nil),       // 31: encore.runtime.v1.PubSubSubscription.GCPConfig
+	(*BucketCluster_S3)(nil),                   // 32: encore.runtime.v1.BucketCluster.S3
+	(*BucketCluster_GCS)(nil),                  // 33: encore.runtime.v1.BucketCluster.GCS
+	(*BucketCluster_GCS_LocalSignOptions)(nil), // 34: encore.runtime.v1.BucketCluster.GCS.LocalSignOptions
+	(*Gateway_CORS)(nil),                       // 35: encore.runtime.v1.Gateway.CORS
+	(*Gateway_CORSAllowedOrigins)(nil),         // 36: encore.runtime.v1.Gateway.CORSAllowedOrigins
+	(*SecretData)(nil),                         // 37: encore.runtime.v1.SecretData
+}
+var file_encore_runtime_v1_infra_proto_depIdxs = []int32{
+	23, // 0: encore.runtime.v1.Infrastructure.resources:type_name -> encore.runtime.v1.Infrastructure.Resources
+	22, // 1: encore.runtime.v1.Infrastructure.credentials:type_name -> encore.runtime.v1.Infrastructure.Credentials
+	5,  // 2: encore.runtime.v1.SQLCluster.servers:type_name -> encore.runtime.v1.SQLServer
+	8,  // 3: encore.runtime.v1.SQLCluster.databases:type_name -> encore.runtime.v1.SQLDatabase
+	0,  // 4: encore.runtime.v1.SQLServer.kind:type_name -> encore.runtime.v1.ServerKind
+	4,  // 5: encore.runtime.v1.SQLServer.tls_config:type_name -> encore.runtime.v1.TLSConfig
+	37, // 6: encore.runtime.v1.ClientCert.key:type_name -> encore.runtime.v1.SecretData
+	37, // 7: encore.runtime.v1.SQLRole.password:type_name -> encore.runtime.v1.SecretData
+	9,  // 8: encore.runtime.v1.SQLDatabase.conn_pools:type_name -> encore.runtime.v1.SQLConnectionPool
+	11, // 9: encore.runtime.v1.RedisCluster.servers:type_name -> encore.runtime.v1.RedisServer
+	14, // 10: encore.runtime.v1.RedisCluster.databases:type_name -> encore.runtime.v1.RedisDatabase
+	0,  // 11: encore.runtime.v1.RedisServer.kind:type_name -> encore.runtime.v1.ServerKind
+	4,  // 12: encore.runtime.v1.RedisServer.tls_config:type_name -> encore.runtime.v1.TLSConfig
+	24, // 13: encore.runtime.v1.RedisRole.acl:type_name -> encore.runtime.v1.RedisRole.AuthACL
+	37, // 14: encore.runtime.v1.RedisRole.auth_string:type_name -> encore.runtime.v1.SecretData
+	12, // 15: encore.runtime.v1.RedisDatabase.conn_pools:type_name -> encore.runtime.v1.RedisConnectionPool
+	37, // 16: encore.runtime.v1.AppSecret.data:type_name -> encore.runtime.v1.SecretData
+	17, // 17: encore.runtime.v1.PubSubCluster.topics:type_name -> encore.runtime.v1.PubSubTopic
+	18, // 18: encore.runtime.v1.PubSubCluster.subscriptions:type_name -> encore.runtime.v1.PubSubSubscription
+	25, // 19: encore.runtime.v1.PubSubCluster.encore:type_name -> encore.runtime.v1.PubSubCluster.EncoreCloud
+	26, // 20: encore.runtime.v1.PubSubCluster.aws:type_name -> encore.runtime.v1.PubSubCluster.AWSSqsSns
+	27, // 21: encore.runtime.v1.PubSubCluster.gcp:type_name -> encore.runtime.v1.PubSubCluster.GCPPubSub
+	29, // 22: encore.runtime.v1.PubSubCluster.azure:type_name -> encore.runtime.v1.PubSubCluster.AzureServiceBus
+	28, // 23: encore.runtime.v1.PubSubCluster.nsq:type_name -> encore.runtime.v1.PubSubCluster.NSQ
+	1,  // 24: encore.runtime.v1.PubSubTopic.delivery_guarantee:type_name -> encore.runtime.v1.PubSubTopic.DeliveryGuarantee
+	30, // 25: encore.runtime.v1.PubSubTopic.gcp_config:type_name -> encore.runtime.v1.PubSubTopic.GCPConfig
+	31, // 26: encore.runtime.v1.PubSubSubscription.gcp_config:type_name -> encore.runtime.v1.PubSubSubscription.GCPConfig
+	20, // 27: encore.runtime.v1.BucketCluster.buckets:type_name -> encore.runtime.v1.Bucket
+	32, // 28: encore.runtime.v1.BucketCluster.s3:type_name -> encore.runtime.v1.BucketCluster.S3
+	33, // 29: encore.runtime.v1.BucketCluster.gcs:type_name -> encore.runtime.v1.BucketCluster.GCS
+	35, // 30: encore.runtime.v1.Gateway.cors:type_name -> encore.runtime.v1.Gateway.CORS
+	6,  // 31: encore.runtime.v1.Infrastructure.Credentials.client_certs:type_name -> encore.runtime.v1.ClientCert
+	7,  // 32: encore.runtime.v1.Infrastructure.Credentials.sql_roles:type_name -> encore.runtime.v1.SQLRole
+	13, // 33: encore.runtime.v1.Infrastructure.Credentials.redis_roles:type_name -> encore.runtime.v1.RedisRole
+	21, // 34: encore.runtime.v1.Infrastructure.Resources.gateways:type_name -> encore.runtime.v1.Gateway
+	3,  // 35: encore.runtime.v1.Infrastructure.Resources.sql_clusters:type_name -> encore.runtime.v1.SQLCluster
+	16, // 36: encore.runtime.v1.Infrastructure.Resources.pubsub_clusters:type_name -> encore.runtime.v1.PubSubCluster
+	10, // 37: encore.runtime.v1.Infrastructure.Resources.redis_clusters:type_name -> encore.runtime.v1.RedisCluster
+	15, // 38: encore.runtime.v1.Infrastructure.Resources.app_secrets:type_name -> encore.runtime.v1.AppSecret
+	19, // 39: encore.runtime.v1.Infrastructure.Resources.bucket_clusters:type_name -> encore.runtime.v1.BucketCluster
+	37, // 40: encore.runtime.v1.RedisRole.AuthACL.password:type_name -> encore.runtime.v1.SecretData
+	37, // 41: encore.runtime.v1.BucketCluster.S3.secret_access_key:type_name -> encore.runtime.v1.SecretData
+	34, // 42: encore.runtime.v1.BucketCluster.GCS.local_sign:type_name -> encore.runtime.v1.BucketCluster.GCS.LocalSignOptions
+	36, // 43: encore.runtime.v1.Gateway.CORS.allowed_origins:type_name -> encore.runtime.v1.Gateway.CORSAllowedOrigins
+	36, // 44: encore.runtime.v1.Gateway.CORS.allowed_origins_without_credentials:type_name -> encore.runtime.v1.Gateway.CORSAllowedOrigins
+	45, // [45:45] is the sub-list for method output_type
+	45, // [45:45] is the sub-list for method input_type
+	45, // [45:45] is the sub-list for extension type_name
+	45, // [45:45] is the sub-list for extension extendee
+	0,  // [0:45] is the sub-list for field type_name
+}
+
+func init() { file_encore_runtime_v1_infra_proto_init() }
+func file_encore_runtime_v1_infra_proto_init() {
+	if File_encore_runtime_v1_infra_proto != nil {
+		return
+	}
+	file_encore_runtime_v1_secretdata_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_encore_runtime_v1_infra_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Infrastructure); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLCluster); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TLSConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLServer); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ClientCert); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLRole); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLDatabase); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SQLConnectionPool); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RedisCluster); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RedisServer); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RedisConnectionPool); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RedisRole); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RedisDatabase); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*AppSecret); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubCluster); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubTopic); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubSubscription); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketCluster); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Bucket); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Gateway); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Infrastructure_Credentials); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Infrastructure_Resources); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RedisRole_AuthACL); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubCluster_EncoreCloud); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubCluster_AWSSqsSns); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubCluster_GCPPubSub); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubCluster_NSQ); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[27].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubCluster_AzureServiceBus); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[28].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubTopic_GCPConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[29].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PubSubSubscription_GCPConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[30].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketCluster_S3); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[31].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketCluster_GCS); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[32].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketCluster_GCS_LocalSignOptions); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[33].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Gateway_CORS); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_infra_proto_msgTypes[34].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Gateway_CORSAllowedOrigins); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_encore_runtime_v1_infra_proto_msgTypes[2].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_infra_proto_msgTypes[3].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_infra_proto_msgTypes[5].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_infra_proto_msgTypes[9].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_infra_proto_msgTypes[11].OneofWrappers = []interface{}{
+		(*RedisRole_Acl)(nil),
+		(*RedisRole_AuthString)(nil),
+	}
+	file_encore_runtime_v1_infra_proto_msgTypes[12].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_infra_proto_msgTypes[14].OneofWrappers = []interface{}{
+		(*PubSubCluster_Encore)(nil),
+		(*PubSubCluster_Aws)(nil),
+		(*PubSubCluster_Gcp)(nil),
+		(*PubSubCluster_Azure)(nil),
+		(*PubSubCluster_Nsq)(nil),
+	}
+	file_encore_runtime_v1_infra_proto_msgTypes[15].OneofWrappers = []interface{}{
+		(*PubSubTopic_GcpConfig)(nil),
+	}
+	file_encore_runtime_v1_infra_proto_msgTypes[16].OneofWrappers = []interface{}{
+		(*PubSubSubscription_GcpConfig)(nil),
+	}
+	file_encore_runtime_v1_infra_proto_msgTypes[17].OneofWrappers = []interface{}{
+		(*BucketCluster_S3_)(nil),
+		(*BucketCluster_Gcs)(nil),
+	}
+	file_encore_runtime_v1_infra_proto_msgTypes[18].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_infra_proto_msgTypes[29].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_infra_proto_msgTypes[30].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_infra_proto_msgTypes[31].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_infra_proto_msgTypes[33].OneofWrappers = []interface{}{
+		(*Gateway_CORS_AllowedOrigins)(nil),
+		(*Gateway_CORS_UnsafeAllowAllOriginsWithCredentials)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_encore_runtime_v1_infra_proto_rawDesc,
+			NumEnums:      2,
+			NumMessages:   35,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_encore_runtime_v1_infra_proto_goTypes,
+		DependencyIndexes: file_encore_runtime_v1_infra_proto_depIdxs,
+		EnumInfos:         file_encore_runtime_v1_infra_proto_enumTypes,
+		MessageInfos:      file_encore_runtime_v1_infra_proto_msgTypes,
+	}.Build()
+	File_encore_runtime_v1_infra_proto = out.File
+	file_encore_runtime_v1_infra_proto_rawDesc = nil
+	file_encore_runtime_v1_infra_proto_goTypes = nil
+	file_encore_runtime_v1_infra_proto_depIdxs = nil
+}
diff --git a/proto/encore/runtime/v1/infra.proto b/proto/encore/runtime/v1/infra.proto
new file mode 100644
index 0000000000..d1da987f72
--- /dev/null
+++ b/proto/encore/runtime/v1/infra.proto
@@ -0,0 +1,448 @@
+syntax = "proto3";
+package encore.runtime.v1;
+
+import "encore/runtime/v1/secretdata.proto";
+
+option go_package = "encr.dev/proto/encore/runtime/v1;runtimev1";
+
+message Infrastructure {
+  Resources resources = 1;
+  Credentials credentials = 2;
+
+  message Credentials {
+    repeated ClientCert client_certs = 1;
+    repeated SQLRole sql_roles = 2;
+    repeated RedisRole redis_roles = 3;
+  }
+
+  message Resources {
+    repeated Gateway gateways = 1;
+    repeated SQLCluster sql_clusters = 2;
+    repeated PubSubCluster pubsub_clusters = 3;
+    repeated RedisCluster redis_clusters = 4;
+    repeated AppSecret app_secrets = 5;
+    repeated BucketCluster bucket_clusters = 6;
+  }
+}
+
+message SQLCluster {
+  // The unique resource id for this cluster.
+  string rid = 1;
+
+  repeated SQLServer servers = 2;
+  repeated SQLDatabase databases = 3;
+}
+
+enum ServerKind {
+  SERVER_KIND_UNSPECIFIED = 0;
+  SERVER_KIND_PRIMARY = 1;
+
+  // A hot-standby (a read replica designed to take over write traffic
+  // at a moment's notice).
+  SERVER_KIND_HOT_STANDBY = 2;
+
+  // A read-replica.
+  SERVER_KIND_READ_REPLICA = 3;
+}
+
+message TLSConfig {
+  // Server CA Cert PEM to use for verifying the server's certificate.
+  optional string server_ca_cert = 1;
+
+  // If true, skips hostname verification when connecting.
+  // If invalid hostnames are trusted, *any* valid certificate for *any* site will be trusted for use.
+  // This introduces significant vulnerabilities, and should only be used as a last resort.
+  bool disable_tls_hostname_verification = 2;
+
+  // If true, skips CA cert validation when connecting.
+  // This introduces significant vulnerabilities, and should only be used as a last resort.
+  bool disable_ca_validation = 3;
+}
+
+message SQLServer {
+  // The unique resource id for this server.
+  string rid = 1;
+
+  // Host is the host to connect to.
+  // Valid formats are "hostname", "hostname:port", and "/path/to/unix.socket".
+  string host = 2;
+  ServerKind kind = 3;
+
+  // TLS configuration to use when connecting.
+  optional TLSConfig tls_config = 4;
+}
+
+message ClientCert {
+  // The unique resource id for this certificate.
+  string rid = 1;
+
+  string cert = 2;
+  SecretData key = 3;
+}
+
+message SQLRole {
+  // The unique resource id for this role.
+  string rid = 1;
+
+  string username = 2;
+  SecretData password = 3;
+
+  // The client cert to use to authenticate, if any.
+  optional string client_cert_rid = 4;
+}
+
+message SQLDatabase {
+  // The unique resource id for this database.
+  string rid = 1;
+
+  string encore_name = 2;
+
+  // The physical name of the database in the cluster.
+  string cloud_name = 3;
+
+  // Connection pools to use for connecting to the database.
+  repeated SQLConnectionPool conn_pools = 4;
+}
+
+message SQLConnectionPool {
+  // Whether this connection pool is for read-only servers.
+  bool is_readonly = 1;
+
+  // The role to use to authenticate.
+  string role_rid = 2;
+
+  // The minimum and maximum number of connections to use.
+  int32 min_connections = 3;
+  int32 max_connections = 4;
+}
+
+message RedisCluster {
+  // The unique resource id for this cluster.
+  string rid = 1;
+
+  repeated RedisServer servers = 2;
+
+  repeated RedisDatabase databases = 3;
+}
+
+message RedisServer {
+  // The unique resource id for this server.
+  string rid = 1;
+
+  // Host is the host to connect to.
+  // Valid formats are "hostname", "hostname:port", and "/path/to/unix.socket".
+  string host = 2;
+  ServerKind kind = 3;
+
+  // TLS configuration to use when connecting.
+  // If nil, TLS is not used.
+  optional TLSConfig tls_config = 4;
+}
+
+message RedisConnectionPool {
+  // Whether this connection pool is for read-only servers.
+  bool is_readonly = 1;
+
+  // The role to use to authenticate.
+  string role_rid = 2;
+
+  // The minimum and maximum number of connections to use.
+  int32 min_connections = 3;
+  int32 max_connections = 4;
+}
+
+message RedisRole {
+  // The unique resource id for this role.
+  string rid = 1;
+
+  // The client cert to use to authenticate, if any.
+  optional string client_cert_rid = 2;
+
+  // How to authenticate with Redis.
+  // If unset, no authentication is used.
+  oneof auth {
+    AuthACL acl = 10; // Redis ACL
+    SecretData auth_string = 11; // Redis AUTH string
+  }
+
+  message AuthACL {
+    string username = 1;
+    SecretData password = 2;
+  }
+}
+
+message RedisDatabase {
+  // Unique resource id for this database.
+  string rid = 1;
+
+  // The encore name of the database.
+  string encore_name = 2;
+
+  // The database index to use, [0-15].
+  int32 database_idx = 3;
+
+  // KeyPrefix specifies a prefix to add to all cache keys
+  // for this database. It exists to enable multiple cache clusters
+  // to use the same physical Redis database for local development
+  // without having to coordinate and persist database index ids.
+  optional string key_prefix = 4;
+
+  // Connection pools to use for connecting to the database.
+  repeated RedisConnectionPool conn_pools = 5;
+}
+
+message AppSecret {
+  // The unique resource id for this secret.
+  string rid = 1;
+
+  // The encore name of the secret.
+  string encore_name = 2;
+
+  // The secret data.
+  SecretData data = 3;
+}
+
+message PubSubCluster {
+  // The unique resource id for this cluster.
+  string rid = 1;
+
+  repeated PubSubTopic topics = 2;
+  repeated PubSubSubscription subscriptions = 3;
+
+  oneof provider {
+    EncoreCloud encore = 5;
+    AWSSqsSns aws = 6;
+    GCPPubSub gcp = 7;
+    AzureServiceBus azure = 8;
+    NSQ nsq = 9;
+  }
+
+  message EncoreCloud {}
+  message AWSSqsSns {}
+  message GCPPubSub {}
+
+  message NSQ {
+    // The hosts to connect to NSQ. Must be non-empty.
+    repeated string hosts = 1;
+  }
+
+  message AzureServiceBus {
+    string namespace = 1;
+  }
+}
+
+message PubSubTopic {
+  // The unique resource id for this topic.
+  string rid = 1;
+
+  // The encore name of the topic.
+  string encore_name = 2;
+
+  // The cloud name of the topic.
+  string cloud_name = 3;
+
+  // The delivery guarantee.
+  DeliveryGuarantee delivery_guarantee = 4;
+
+  // Optional ordering attribute. Specifies the attribute name
+  // to use for message ordering.
+  optional string ordering_attr = 5;
+
+  // Provider-specific configuration.
+  // Not all providers require this, but it must always be set
+  // for the providers that are present.
+  oneof provider_config {
+    GCPConfig gcp_config = 10;
+    // Null: no provider-specific configuration.
+  }
+
+  message GCPConfig {
+    // The GCP project id where the topic exists.
+    string project_id = 1;
+  }
+
+  enum DeliveryGuarantee {
+    DELIVERY_GUARANTEE_UNSPECIFIED = 0;
+    DELIVERY_GUARANTEE_AT_LEAST_ONCE = 1; // All messages will be delivered to each subscription at least once
+    DELIVERY_GUARANTEE_EXACTLY_ONCE = 2; // All messages will be delivered to each subscription exactly once
+  }
+}
+
+message PubSubSubscription {
+  // The unique resource id for this subscription.
+  string rid = 1;
+
+  // The encore name of the topic this subscription is for.
+  string topic_encore_name = 2;
+
+  // The encore name of the subscription.
+  string subscription_encore_name = 3;
+
+  // The cloud name of the subscription.
+  string topic_cloud_name = 4;
+
+  // The cloud name of the subscription.
+  string subscription_cloud_name = 5;
+
+  // If true the application will not actively subscribe but wait
+  // for incoming messages to be pushed to it.
+  bool push_only = 6;
+
+  // Subscription-specific provider configuration.
+  // Not all providers require this, but it must always be set
+  // for the providers that are present.
+  oneof provider_config {
+    GCPConfig gcp_config = 10;
+    // Null: no provider-specific configuration.
+  }
+
+  message GCPConfig {
+    // The GCP project id where the subscription exists.
+    string project_id = 1;
+
+    // The service account used to authenticate messages being delivered over push.
+    // If unset, pushes are rejected.
+    optional string push_service_account = 2;
+
+    // The audience to use when validating JWTs delivered over push.
+    // If set, the JWT audience claim must match. If unset, any JWT audience is allowed.
+    optional string push_jwt_audience = 3;
+  }
+}
+
+message BucketCluster {
+  // The unique resource id for this cluster.
+  string rid = 1;
+
+  repeated Bucket buckets = 2;
+
+  oneof provider {
+    S3 s3 = 10;
+    GCS gcs = 11;
+  }
+
+  message S3 {
+    // Region to connect to.
+    string region = 1;
+
+    // Endpoint override, if any. Must be specified if using a non-standard AWS region.
+    optional string endpoint = 2;
+
+    // Set these to use explicit credentials for this bucket,
+    // as opposed to resolving using AWS's default credential chain.
+    optional string access_key_id = 3;
+    optional SecretData secret_access_key = 4;
+  }
+
+  message GCS {
+    // Endpoint override, if any. Defaults to https://storage.googleapis.com if unset.
+    optional string endpoint = 1;
+
+    // Whether to connect anonymously or if a service account should be resolved.
+    bool anonymous = 2;
+
+    // Additional options for signed URLs when running in local dev mode.
+    // Only use with anonymous mode.
+    optional LocalSignOptions local_sign = 3;
+
+    message LocalSignOptions {
+      // Base prefix to use for presigned URLs.
+      string base_url = 1;
+
+      // Use these credentials to sign local URLs. Only pass dummy credentials
+      // here, no actual secrets.
+      string access_id = 2;
+      string private_key = 3;
+    }
+  }
+}
+
+message Bucket {
+  // The unique resource id for this bucket.
+  string rid = 1;
+
+  // The encore name of the bucket.
+  string encore_name = 2;
+
+  // The cloud name of the bucket.
+  string cloud_name = 3;
+
+  // Optional key prefix to prepend to all bucket keys.
+  //
+  // Note: make sure it ends with a slash ("/") if you want
+  // to group objects within a certain folder.
+  optional string key_prefix = 4;
+
+  // Public base URL for accessing objects in this bucket.
+  // Must be set for public buckets.
+  optional string public_base_url = 5;
+}
+
+message Gateway {
+  // The unique id for this resource.
+  string rid = 1;
+
+  //  The encore name of the gateway.
+  string encore_name = 2;
+
+  // The base url for reaching this gateway, for returning to the application
+  // via e.g. the metadata APIs.
+  string base_url = 3;
+
+  // The hostnames this gateway accepts requests for.
+  repeated string hostnames = 4;
+
+  // CORS is the CORS configuration for this gateway.
+  CORS cors = 5;
+
+  // CORS describes the CORS configuration for a gateway.
+  message CORS {
+    bool debug = 1;
+
+    // If true, causes Encore to respond to OPTIONS requests
+    // without setting Access-Control-Allow-Credentials: true.
+    bool disable_credentials = 2;
+
+    // Specifies the allowed origins for requests that include credentials.
+    // If a request is made from an Origin in this list
+    // Encore responds with Access-Control-Allow-Origin: <Origin>.
+    //
+    // If disable_credentials is true this field is not used.
+    oneof allowed_origins_with_credentials {
+      CORSAllowedOrigins allowed_origins = 3;
+      bool unsafe_allow_all_origins_with_credentials = 4;
+    }
+
+    // Specifies the allowed origins for requests
+    // that don't include credentials.
+    //
+    // The URLs in this list may include wildcards (e.g. "https://*.example.com"
+    // or "https://*-myapp.example.com").
+    CORSAllowedOrigins allowed_origins_without_credentials = 5;
+
+    // Specifies extra headers to allow, beyond
+    // the default set always recognized by Encore.
+    // As a special case, if the list contains "*" all headers are allowed.
+    repeated string extra_allowed_headers = 6;
+
+    // Specifies extra headers to expose, beyond
+    // the default set always recognized by Encore.
+    // As a special case, if the list contains "*" all headers are allowed.
+    repeated string extra_exposed_headers = 7;
+
+    // If true, allows requests to Encore apps running
+    // on private networks from websites.
+    // See: https://wicg.github.io/private-network-access/
+    bool allow_private_network_access = 8;
+  }
+
+  message CORSAllowedOrigins {
+    // The list of allowed origins.
+    // The URLs in this list may include wildcards (e.g. "https://*.example.com"
+    // or "https://*-myapp.example.com").
+    //
+    // The string "*" allows all origins, except for requests with credentials;
+    // use CORS.unsafe_allow_unsafe_all_origins_with_credentials for that.
+    repeated string allowed_origins = 1;
+  }
+}
diff --git a/proto/encore/runtime/v1/runtime.pb.go b/proto/encore/runtime/v1/runtime.pb.go
new file mode 100644
index 0000000000..7c2da3106b
--- /dev/null
+++ b/proto/encore/runtime/v1/runtime.pb.go
@@ -0,0 +1,2497 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.23.4
+// source: encore/runtime/v1/runtime.proto
+
+package runtimev1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	durationpb "google.golang.org/protobuf/types/known/durationpb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Environment_Type int32
+
+const (
+	Environment_TYPE_UNSPECIFIED Environment_Type = 0
+	Environment_TYPE_DEVELOPMENT Environment_Type = 1
+	Environment_TYPE_PRODUCTION  Environment_Type = 2
+	Environment_TYPE_EPHEMERAL   Environment_Type = 3
+	Environment_TYPE_TEST        Environment_Type = 4
+)
+
+// Enum value maps for Environment_Type.
+var (
+	Environment_Type_name = map[int32]string{
+		0: "TYPE_UNSPECIFIED",
+		1: "TYPE_DEVELOPMENT",
+		2: "TYPE_PRODUCTION",
+		3: "TYPE_EPHEMERAL",
+		4: "TYPE_TEST",
+	}
+	Environment_Type_value = map[string]int32{
+		"TYPE_UNSPECIFIED": 0,
+		"TYPE_DEVELOPMENT": 1,
+		"TYPE_PRODUCTION":  2,
+		"TYPE_EPHEMERAL":   3,
+		"TYPE_TEST":        4,
+	}
+)
+
+func (x Environment_Type) Enum() *Environment_Type {
+	p := new(Environment_Type)
+	*p = x
+	return p
+}
+
+func (x Environment_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Environment_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_runtime_v1_runtime_proto_enumTypes[0].Descriptor()
+}
+
+func (Environment_Type) Type() protoreflect.EnumType {
+	return &file_encore_runtime_v1_runtime_proto_enumTypes[0]
+}
+
+func (x Environment_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Environment_Type.Descriptor instead.
+func (Environment_Type) EnumDescriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{1, 0}
+}
+
+type Environment_Cloud int32
+
+const (
+	Environment_CLOUD_UNSPECIFIED Environment_Cloud = 0
+	Environment_CLOUD_LOCAL       Environment_Cloud = 1
+	Environment_CLOUD_ENCORE      Environment_Cloud = 2
+	Environment_CLOUD_AWS         Environment_Cloud = 3
+	Environment_CLOUD_GCP         Environment_Cloud = 4
+	Environment_CLOUD_AZURE       Environment_Cloud = 5
+)
+
+// Enum value maps for Environment_Cloud.
+var (
+	Environment_Cloud_name = map[int32]string{
+		0: "CLOUD_UNSPECIFIED",
+		1: "CLOUD_LOCAL",
+		2: "CLOUD_ENCORE",
+		3: "CLOUD_AWS",
+		4: "CLOUD_GCP",
+		5: "CLOUD_AZURE",
+	}
+	Environment_Cloud_value = map[string]int32{
+		"CLOUD_UNSPECIFIED": 0,
+		"CLOUD_LOCAL":       1,
+		"CLOUD_ENCORE":      2,
+		"CLOUD_AWS":         3,
+		"CLOUD_GCP":         4,
+		"CLOUD_AZURE":       5,
+	}
+)
+
+func (x Environment_Cloud) Enum() *Environment_Cloud {
+	p := new(Environment_Cloud)
+	*p = x
+	return p
+}
+
+func (x Environment_Cloud) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Environment_Cloud) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_runtime_v1_runtime_proto_enumTypes[1].Descriptor()
+}
+
+func (Environment_Cloud) Type() protoreflect.EnumType {
+	return &file_encore_runtime_v1_runtime_proto_enumTypes[1]
+}
+
+func (x Environment_Cloud) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Environment_Cloud.Descriptor instead.
+func (Environment_Cloud) EnumDescriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{1, 1}
+}
+
+type RuntimeConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Environment    *Environment    `protobuf:"bytes,1,opt,name=environment,proto3" json:"environment,omitempty"`
+	Infra          *Infrastructure `protobuf:"bytes,2,opt,name=infra,proto3" json:"infra,omitempty"`
+	Deployment     *Deployment     `protobuf:"bytes,3,opt,name=deployment,proto3" json:"deployment,omitempty"`
+	EncorePlatform *EncorePlatform `protobuf:"bytes,5,opt,name=encore_platform,json=encorePlatform,proto3,oneof" json:"encore_platform,omitempty"`
+}
+
+func (x *RuntimeConfig) Reset() {
+	*x = RuntimeConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RuntimeConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeConfig) ProtoMessage() {}
+
+func (x *RuntimeConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeConfig.ProtoReflect.Descriptor instead.
+func (*RuntimeConfig) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *RuntimeConfig) GetEnvironment() *Environment {
+	if x != nil {
+		return x.Environment
+	}
+	return nil
+}
+
+func (x *RuntimeConfig) GetInfra() *Infrastructure {
+	if x != nil {
+		return x.Infra
+	}
+	return nil
+}
+
+func (x *RuntimeConfig) GetDeployment() *Deployment {
+	if x != nil {
+		return x.Deployment
+	}
+	return nil
+}
+
+func (x *RuntimeConfig) GetEncorePlatform() *EncorePlatform {
+	if x != nil {
+		return x.EncorePlatform
+	}
+	return nil
+}
+
+type Environment struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AppId   string            `protobuf:"bytes,1,opt,name=app_id,json=appId,proto3" json:"app_id,omitempty"`
+	AppSlug string            `protobuf:"bytes,2,opt,name=app_slug,json=appSlug,proto3" json:"app_slug,omitempty"`
+	EnvId   string            `protobuf:"bytes,3,opt,name=env_id,json=envId,proto3" json:"env_id,omitempty"`
+	EnvName string            `protobuf:"bytes,4,opt,name=env_name,json=envName,proto3" json:"env_name,omitempty"`
+	EnvType Environment_Type  `protobuf:"varint,5,opt,name=env_type,json=envType,proto3,enum=encore.runtime.v1.Environment_Type" json:"env_type,omitempty"`
+	Cloud   Environment_Cloud `protobuf:"varint,6,opt,name=cloud,proto3,enum=encore.runtime.v1.Environment_Cloud" json:"cloud,omitempty"`
+}
+
+func (x *Environment) Reset() {
+	*x = Environment{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Environment) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Environment) ProtoMessage() {}
+
+func (x *Environment) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Environment.ProtoReflect.Descriptor instead.
+func (*Environment) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *Environment) GetAppId() string {
+	if x != nil {
+		return x.AppId
+	}
+	return ""
+}
+
+func (x *Environment) GetAppSlug() string {
+	if x != nil {
+		return x.AppSlug
+	}
+	return ""
+}
+
+func (x *Environment) GetEnvId() string {
+	if x != nil {
+		return x.EnvId
+	}
+	return ""
+}
+
+func (x *Environment) GetEnvName() string {
+	if x != nil {
+		return x.EnvName
+	}
+	return ""
+}
+
+func (x *Environment) GetEnvType() Environment_Type {
+	if x != nil {
+		return x.EnvType
+	}
+	return Environment_TYPE_UNSPECIFIED
+}
+
+func (x *Environment) GetCloud() Environment_Cloud {
+	if x != nil {
+		return x.Cloud
+	}
+	return Environment_CLOUD_UNSPECIFIED
+}
+
+// Describes the configuration related to a specific deployment,
+// meaning a group of services deployed together (think a single k8s Deployment).
+type Deployment struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	DeployId   string                 `protobuf:"bytes,1,opt,name=deploy_id,json=deployId,proto3" json:"deploy_id,omitempty"`
+	DeployedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=deployed_at,json=deployedAt,proto3" json:"deployed_at,omitempty"`
+	// A list of experiments to enable at runtime.
+	DynamicExperiments []string `protobuf:"bytes,3,rep,name=dynamic_experiments,json=dynamicExperiments,proto3" json:"dynamic_experiments,omitempty"`
+	// The gateways hosted by this deployment, by rid.
+	HostedGateways []string `protobuf:"bytes,4,rep,name=hosted_gateways,json=hostedGateways,proto3" json:"hosted_gateways,omitempty"`
+	// The services hosted by this deployment.
+	HostedServices []*HostedService `protobuf:"bytes,5,rep,name=hosted_services,json=hostedServices,proto3" json:"hosted_services,omitempty"`
+	// The authentication method(s) that can be used when talking
+	// to this deployment for internal service-to-service calls.
+	//
+	// An empty list means no service-to-service calls can be made to this deployment.
+	AuthMethods []*ServiceAuth `protobuf:"bytes,6,rep,name=auth_methods,json=authMethods,proto3" json:"auth_methods,omitempty"`
+	// Observability-related configuration.
+	Observability *Observability `protobuf:"bytes,7,opt,name=observability,proto3" json:"observability,omitempty"`
+	// Service discovery configuration.
+	ServiceDiscovery *ServiceDiscovery `protobuf:"bytes,8,opt,name=service_discovery,json=serviceDiscovery,proto3" json:"service_discovery,omitempty"`
+	// Graceful shutdown behavior.
+	GracefulShutdown *GracefulShutdown `protobuf:"bytes,9,opt,name=graceful_shutdown,json=gracefulShutdown,proto3" json:"graceful_shutdown,omitempty"`
+}
+
+func (x *Deployment) Reset() {
+	*x = Deployment{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Deployment) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Deployment) ProtoMessage() {}
+
+func (x *Deployment) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Deployment.ProtoReflect.Descriptor instead.
+func (*Deployment) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *Deployment) GetDeployId() string {
+	if x != nil {
+		return x.DeployId
+	}
+	return ""
+}
+
+func (x *Deployment) GetDeployedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.DeployedAt
+	}
+	return nil
+}
+
+func (x *Deployment) GetDynamicExperiments() []string {
+	if x != nil {
+		return x.DynamicExperiments
+	}
+	return nil
+}
+
+func (x *Deployment) GetHostedGateways() []string {
+	if x != nil {
+		return x.HostedGateways
+	}
+	return nil
+}
+
+func (x *Deployment) GetHostedServices() []*HostedService {
+	if x != nil {
+		return x.HostedServices
+	}
+	return nil
+}
+
+func (x *Deployment) GetAuthMethods() []*ServiceAuth {
+	if x != nil {
+		return x.AuthMethods
+	}
+	return nil
+}
+
+func (x *Deployment) GetObservability() *Observability {
+	if x != nil {
+		return x.Observability
+	}
+	return nil
+}
+
+func (x *Deployment) GetServiceDiscovery() *ServiceDiscovery {
+	if x != nil {
+		return x.ServiceDiscovery
+	}
+	return nil
+}
+
+func (x *Deployment) GetGracefulShutdown() *GracefulShutdown {
+	if x != nil {
+		return x.GracefulShutdown
+	}
+	return nil
+}
+
+type Observability struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The observability providers to use.
+	Tracing []*TracingProvider `protobuf:"bytes,1,rep,name=tracing,proto3" json:"tracing,omitempty"`
+	Metrics []*MetricsProvider `protobuf:"bytes,2,rep,name=metrics,proto3" json:"metrics,omitempty"`
+	Logs    []*LogsProvider    `protobuf:"bytes,3,rep,name=logs,proto3" json:"logs,omitempty"`
+}
+
+func (x *Observability) Reset() {
+	*x = Observability{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Observability) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Observability) ProtoMessage() {}
+
+func (x *Observability) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Observability.ProtoReflect.Descriptor instead.
+func (*Observability) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *Observability) GetTracing() []*TracingProvider {
+	if x != nil {
+		return x.Tracing
+	}
+	return nil
+}
+
+func (x *Observability) GetMetrics() []*MetricsProvider {
+	if x != nil {
+		return x.Metrics
+	}
+	return nil
+}
+
+func (x *Observability) GetLogs() []*LogsProvider {
+	if x != nil {
+		return x.Logs
+	}
+	return nil
+}
+
+type HostedService struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The name of the service.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Number of worker threads to use.
+	// If unset it defaults to 1. If set to 0 the runtime
+	// automatically determines the number of threads to use
+	// based on the number of CPUs available.
+	WorkerThreads *int32 `protobuf:"varint,2,opt,name=worker_threads,json=workerThreads,proto3,oneof" json:"worker_threads,omitempty"`
+	// The log configuration to use for this service.
+	// If unset it defaults to "trace".
+	LogConfig *string `protobuf:"bytes,3,opt,name=log_config,json=logConfig,proto3,oneof" json:"log_config,omitempty"`
+}
+
+func (x *HostedService) Reset() {
+	*x = HostedService{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HostedService) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HostedService) ProtoMessage() {}
+
+func (x *HostedService) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HostedService.ProtoReflect.Descriptor instead.
+func (*HostedService) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *HostedService) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *HostedService) GetWorkerThreads() int32 {
+	if x != nil && x.WorkerThreads != nil {
+		return *x.WorkerThreads
+	}
+	return 0
+}
+
+func (x *HostedService) GetLogConfig() string {
+	if x != nil && x.LogConfig != nil {
+		return *x.LogConfig
+	}
+	return ""
+}
+
+type ServiceAuth struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The auth method to use.
+	//
+	// Types that are assignable to AuthMethod:
+	//
+	//	*ServiceAuth_Noop
+	//	*ServiceAuth_EncoreAuth_
+	AuthMethod isServiceAuth_AuthMethod `protobuf_oneof:"auth_method"`
+}
+
+func (x *ServiceAuth) Reset() {
+	*x = ServiceAuth{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceAuth) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceAuth) ProtoMessage() {}
+
+func (x *ServiceAuth) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceAuth.ProtoReflect.Descriptor instead.
+func (*ServiceAuth) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{5}
+}
+
+func (m *ServiceAuth) GetAuthMethod() isServiceAuth_AuthMethod {
+	if m != nil {
+		return m.AuthMethod
+	}
+	return nil
+}
+
+func (x *ServiceAuth) GetNoop() *ServiceAuth_NoopAuth {
+	if x, ok := x.GetAuthMethod().(*ServiceAuth_Noop); ok {
+		return x.Noop
+	}
+	return nil
+}
+
+func (x *ServiceAuth) GetEncoreAuth() *ServiceAuth_EncoreAuth {
+	if x, ok := x.GetAuthMethod().(*ServiceAuth_EncoreAuth_); ok {
+		return x.EncoreAuth
+	}
+	return nil
+}
+
+type isServiceAuth_AuthMethod interface {
+	isServiceAuth_AuthMethod()
+}
+
+type ServiceAuth_Noop struct {
+	// Messages start at 10 to allow for other fields on ServiceAuth.
+	Noop *ServiceAuth_NoopAuth `protobuf:"bytes,10,opt,name=noop,proto3,oneof"`
+}
+
+type ServiceAuth_EncoreAuth_ struct {
+	EncoreAuth *ServiceAuth_EncoreAuth `protobuf:"bytes,11,opt,name=encore_auth,json=encoreAuth,proto3,oneof"`
+}
+
+func (*ServiceAuth_Noop) isServiceAuth_AuthMethod() {}
+
+func (*ServiceAuth_EncoreAuth_) isServiceAuth_AuthMethod() {}
+
+type TracingProvider struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this provider.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	// Types that are assignable to Provider:
+	//
+	//	*TracingProvider_Encore
+	Provider isTracingProvider_Provider `protobuf_oneof:"provider"`
+}
+
+func (x *TracingProvider) Reset() {
+	*x = TracingProvider{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TracingProvider) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TracingProvider) ProtoMessage() {}
+
+func (x *TracingProvider) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TracingProvider.ProtoReflect.Descriptor instead.
+func (*TracingProvider) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *TracingProvider) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (m *TracingProvider) GetProvider() isTracingProvider_Provider {
+	if m != nil {
+		return m.Provider
+	}
+	return nil
+}
+
+func (x *TracingProvider) GetEncore() *TracingProvider_EncoreTracingProvider {
+	if x, ok := x.GetProvider().(*TracingProvider_Encore); ok {
+		return x.Encore
+	}
+	return nil
+}
+
+type isTracingProvider_Provider interface {
+	isTracingProvider_Provider()
+}
+
+type TracingProvider_Encore struct {
+	Encore *TracingProvider_EncoreTracingProvider `protobuf:"bytes,10,opt,name=encore,proto3,oneof"`
+}
+
+func (*TracingProvider_Encore) isTracingProvider_Provider() {}
+
+type MetricsProvider struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this provider.
+	Rid                string               `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	CollectionInterval *durationpb.Duration `protobuf:"bytes,2,opt,name=collection_interval,json=collectionInterval,proto3" json:"collection_interval,omitempty"`
+	// Types that are assignable to Provider:
+	//
+	//	*MetricsProvider_EncoreCloud
+	//	*MetricsProvider_Gcp
+	//	*MetricsProvider_Aws
+	//	*MetricsProvider_PromRemoteWrite
+	//	*MetricsProvider_Datadog_
+	Provider isMetricsProvider_Provider `protobuf_oneof:"provider"`
+}
+
+func (x *MetricsProvider) Reset() {
+	*x = MetricsProvider{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MetricsProvider) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MetricsProvider) ProtoMessage() {}
+
+func (x *MetricsProvider) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MetricsProvider.ProtoReflect.Descriptor instead.
+func (*MetricsProvider) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *MetricsProvider) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *MetricsProvider) GetCollectionInterval() *durationpb.Duration {
+	if x != nil {
+		return x.CollectionInterval
+	}
+	return nil
+}
+
+func (m *MetricsProvider) GetProvider() isMetricsProvider_Provider {
+	if m != nil {
+		return m.Provider
+	}
+	return nil
+}
+
+func (x *MetricsProvider) GetEncoreCloud() *MetricsProvider_GCPCloudMonitoring {
+	if x, ok := x.GetProvider().(*MetricsProvider_EncoreCloud); ok {
+		return x.EncoreCloud
+	}
+	return nil
+}
+
+func (x *MetricsProvider) GetGcp() *MetricsProvider_GCPCloudMonitoring {
+	if x, ok := x.GetProvider().(*MetricsProvider_Gcp); ok {
+		return x.Gcp
+	}
+	return nil
+}
+
+func (x *MetricsProvider) GetAws() *MetricsProvider_AWSCloudWatch {
+	if x, ok := x.GetProvider().(*MetricsProvider_Aws); ok {
+		return x.Aws
+	}
+	return nil
+}
+
+func (x *MetricsProvider) GetPromRemoteWrite() *MetricsProvider_PrometheusRemoteWrite {
+	if x, ok := x.GetProvider().(*MetricsProvider_PromRemoteWrite); ok {
+		return x.PromRemoteWrite
+	}
+	return nil
+}
+
+func (x *MetricsProvider) GetDatadog() *MetricsProvider_Datadog {
+	if x, ok := x.GetProvider().(*MetricsProvider_Datadog_); ok {
+		return x.Datadog
+	}
+	return nil
+}
+
+type isMetricsProvider_Provider interface {
+	isMetricsProvider_Provider()
+}
+
+type MetricsProvider_EncoreCloud struct {
+	EncoreCloud *MetricsProvider_GCPCloudMonitoring `protobuf:"bytes,10,opt,name=encore_cloud,json=encoreCloud,proto3,oneof"`
+}
+
+type MetricsProvider_Gcp struct {
+	Gcp *MetricsProvider_GCPCloudMonitoring `protobuf:"bytes,11,opt,name=gcp,proto3,oneof"`
+}
+
+type MetricsProvider_Aws struct {
+	Aws *MetricsProvider_AWSCloudWatch `protobuf:"bytes,12,opt,name=aws,proto3,oneof"`
+}
+
+type MetricsProvider_PromRemoteWrite struct {
+	PromRemoteWrite *MetricsProvider_PrometheusRemoteWrite `protobuf:"bytes,13,opt,name=prom_remote_write,json=promRemoteWrite,proto3,oneof"`
+}
+
+type MetricsProvider_Datadog_ struct {
+	Datadog *MetricsProvider_Datadog `protobuf:"bytes,14,opt,name=datadog,proto3,oneof"`
+}
+
+func (*MetricsProvider_EncoreCloud) isMetricsProvider_Provider() {}
+
+func (*MetricsProvider_Gcp) isMetricsProvider_Provider() {}
+
+func (*MetricsProvider_Aws) isMetricsProvider_Provider() {}
+
+func (*MetricsProvider_PromRemoteWrite) isMetricsProvider_Provider() {}
+
+func (*MetricsProvider_Datadog_) isMetricsProvider_Provider() {}
+
+type LogsProvider struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this provider.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+}
+
+func (x *LogsProvider) Reset() {
+	*x = LogsProvider{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LogsProvider) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LogsProvider) ProtoMessage() {}
+
+func (x *LogsProvider) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LogsProvider.ProtoReflect.Descriptor instead.
+func (*LogsProvider) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *LogsProvider) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+type EncoreAuthKey struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id   uint32      `protobuf:"varint,1,opt,name=id,proto3" json:"id,omitempty"`
+	Data *SecretData `protobuf:"bytes,2,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *EncoreAuthKey) Reset() {
+	*x = EncoreAuthKey{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EncoreAuthKey) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EncoreAuthKey) ProtoMessage() {}
+
+func (x *EncoreAuthKey) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EncoreAuthKey.ProtoReflect.Descriptor instead.
+func (*EncoreAuthKey) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *EncoreAuthKey) GetId() uint32 {
+	if x != nil {
+		return x.Id
+	}
+	return 0
+}
+
+func (x *EncoreAuthKey) GetData() *SecretData {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+// Describes service discovery configuration.
+type ServiceDiscovery struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Where services are located, keyed by the service name.
+	Services map[string]*ServiceDiscovery_Location `protobuf:"bytes,1,rep,name=services,proto3" json:"services,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *ServiceDiscovery) Reset() {
+	*x = ServiceDiscovery{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceDiscovery) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceDiscovery) ProtoMessage() {}
+
+func (x *ServiceDiscovery) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceDiscovery.ProtoReflect.Descriptor instead.
+func (*ServiceDiscovery) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *ServiceDiscovery) GetServices() map[string]*ServiceDiscovery_Location {
+	if x != nil {
+		return x.Services
+	}
+	return nil
+}
+
+// GracefulShutdown defines the graceful shutdown timings.
+type GracefulShutdown struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Total is how long we allow the total shutdown to take
+	// before the process forcibly exits.
+	Total *durationpb.Duration `protobuf:"bytes,1,opt,name=total,proto3" json:"total,omitempty"`
+	// ShutdownHooks is how long before [total] runs out that we cancel
+	// the context that is passed to the shutdown hooks.
+	//
+	// It is expected that ShutdownHooks is a larger value than Handlers.
+	ShutdownHooks *durationpb.Duration `protobuf:"bytes,2,opt,name=shutdown_hooks,json=shutdownHooks,proto3" json:"shutdown_hooks,omitempty"`
+	// Handlers is how long before [total] runs out that we cancel
+	// the context that is passed to API and PubSub Subscription handlers.
+	//
+	// For example, if [total] is 10 seconds and [handlers] is 2 seconds,
+	// then we will cancel the context passed to handlers 8 seconds after
+	// a graceful shutdown is initiated.
+	Handlers *durationpb.Duration `protobuf:"bytes,3,opt,name=handlers,proto3" json:"handlers,omitempty"`
+}
+
+func (x *GracefulShutdown) Reset() {
+	*x = GracefulShutdown{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GracefulShutdown) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GracefulShutdown) ProtoMessage() {}
+
+func (x *GracefulShutdown) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GracefulShutdown.ProtoReflect.Descriptor instead.
+func (*GracefulShutdown) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *GracefulShutdown) GetTotal() *durationpb.Duration {
+	if x != nil {
+		return x.Total
+	}
+	return nil
+}
+
+func (x *GracefulShutdown) GetShutdownHooks() *durationpb.Duration {
+	if x != nil {
+		return x.ShutdownHooks
+	}
+	return nil
+}
+
+func (x *GracefulShutdown) GetHandlers() *durationpb.Duration {
+	if x != nil {
+		return x.Handlers
+	}
+	return nil
+}
+
+type EncorePlatform struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Auth keys for validating signed requests from the Encore Platform.
+	PlatformSigningKeys []*EncoreAuthKey `protobuf:"bytes,1,rep,name=platform_signing_keys,json=platformSigningKeys,proto3" json:"platform_signing_keys,omitempty"`
+	// The Encore Cloud configuration to use, if running in Encore Cloud.
+	EncoreCloud *EncoreCloudProvider `protobuf:"bytes,2,opt,name=encore_cloud,json=encoreCloud,proto3,oneof" json:"encore_cloud,omitempty"`
+}
+
+func (x *EncorePlatform) Reset() {
+	*x = EncorePlatform{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EncorePlatform) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EncorePlatform) ProtoMessage() {}
+
+func (x *EncorePlatform) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EncorePlatform.ProtoReflect.Descriptor instead.
+func (*EncorePlatform) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *EncorePlatform) GetPlatformSigningKeys() []*EncoreAuthKey {
+	if x != nil {
+		return x.PlatformSigningKeys
+	}
+	return nil
+}
+
+func (x *EncorePlatform) GetEncoreCloud() *EncoreCloudProvider {
+	if x != nil {
+		return x.EncoreCloud
+	}
+	return nil
+}
+
+type RateLimiter struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Kind:
+	//
+	//	*RateLimiter_TokenBucket_
+	Kind isRateLimiter_Kind `protobuf_oneof:"kind"`
+}
+
+func (x *RateLimiter) Reset() {
+	*x = RateLimiter{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RateLimiter) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RateLimiter) ProtoMessage() {}
+
+func (x *RateLimiter) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RateLimiter.ProtoReflect.Descriptor instead.
+func (*RateLimiter) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{13}
+}
+
+func (m *RateLimiter) GetKind() isRateLimiter_Kind {
+	if m != nil {
+		return m.Kind
+	}
+	return nil
+}
+
+func (x *RateLimiter) GetTokenBucket() *RateLimiter_TokenBucket {
+	if x, ok := x.GetKind().(*RateLimiter_TokenBucket_); ok {
+		return x.TokenBucket
+	}
+	return nil
+}
+
+type isRateLimiter_Kind interface {
+	isRateLimiter_Kind()
+}
+
+type RateLimiter_TokenBucket_ struct {
+	TokenBucket *RateLimiter_TokenBucket `protobuf:"bytes,1,opt,name=token_bucket,json=tokenBucket,proto3,oneof"`
+}
+
+func (*RateLimiter_TokenBucket_) isRateLimiter_Kind() {}
+
+type EncoreCloudProvider struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The unique resource id for this provider.
+	Rid string `protobuf:"bytes,1,opt,name=rid,proto3" json:"rid,omitempty"`
+	// URL to use to authenticate with the server.
+	ServerUrl string           `protobuf:"bytes,2,opt,name=server_url,json=serverUrl,proto3" json:"server_url,omitempty"`
+	AuthKeys  []*EncoreAuthKey `protobuf:"bytes,3,rep,name=auth_keys,json=authKeys,proto3" json:"auth_keys,omitempty"`
+}
+
+func (x *EncoreCloudProvider) Reset() {
+	*x = EncoreCloudProvider{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *EncoreCloudProvider) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*EncoreCloudProvider) ProtoMessage() {}
+
+func (x *EncoreCloudProvider) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use EncoreCloudProvider.ProtoReflect.Descriptor instead.
+func (*EncoreCloudProvider) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *EncoreCloudProvider) GetRid() string {
+	if x != nil {
+		return x.Rid
+	}
+	return ""
+}
+
+func (x *EncoreCloudProvider) GetServerUrl() string {
+	if x != nil {
+		return x.ServerUrl
+	}
+	return ""
+}
+
+func (x *EncoreCloudProvider) GetAuthKeys() []*EncoreAuthKey {
+	if x != nil {
+		return x.AuthKeys
+	}
+	return nil
+}
+
+type ServiceAuth_NoopAuth struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *ServiceAuth_NoopAuth) Reset() {
+	*x = ServiceAuth_NoopAuth{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceAuth_NoopAuth) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceAuth_NoopAuth) ProtoMessage() {}
+
+func (x *ServiceAuth_NoopAuth) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceAuth_NoopAuth.ProtoReflect.Descriptor instead.
+func (*ServiceAuth_NoopAuth) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{5, 0}
+}
+
+type ServiceAuth_EncoreAuth struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	AuthKeys []*EncoreAuthKey `protobuf:"bytes,1,rep,name=auth_keys,json=authKeys,proto3" json:"auth_keys,omitempty"`
+}
+
+func (x *ServiceAuth_EncoreAuth) Reset() {
+	*x = ServiceAuth_EncoreAuth{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceAuth_EncoreAuth) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceAuth_EncoreAuth) ProtoMessage() {}
+
+func (x *ServiceAuth_EncoreAuth) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceAuth_EncoreAuth.ProtoReflect.Descriptor instead.
+func (*ServiceAuth_EncoreAuth) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{5, 1}
+}
+
+func (x *ServiceAuth_EncoreAuth) GetAuthKeys() []*EncoreAuthKey {
+	if x != nil {
+		return x.AuthKeys
+	}
+	return nil
+}
+
+type TracingProvider_EncoreTracingProvider struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	TraceEndpoint string `protobuf:"bytes,1,opt,name=trace_endpoint,json=traceEndpoint,proto3" json:"trace_endpoint,omitempty"`
+	// The sampling rate to use for traces, between [0, 1].
+	// If unset it defaults to 1 (meaning all requests are traced).
+	SamplingRate *float64 `protobuf:"fixed64,2,opt,name=sampling_rate,json=samplingRate,proto3,oneof" json:"sampling_rate,omitempty"`
+}
+
+func (x *TracingProvider_EncoreTracingProvider) Reset() {
+	*x = TracingProvider_EncoreTracingProvider{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TracingProvider_EncoreTracingProvider) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TracingProvider_EncoreTracingProvider) ProtoMessage() {}
+
+func (x *TracingProvider_EncoreTracingProvider) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TracingProvider_EncoreTracingProvider.ProtoReflect.Descriptor instead.
+func (*TracingProvider_EncoreTracingProvider) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{6, 0}
+}
+
+func (x *TracingProvider_EncoreTracingProvider) GetTraceEndpoint() string {
+	if x != nil {
+		return x.TraceEndpoint
+	}
+	return ""
+}
+
+func (x *TracingProvider_EncoreTracingProvider) GetSamplingRate() float64 {
+	if x != nil && x.SamplingRate != nil {
+		return *x.SamplingRate
+	}
+	return 0
+}
+
+type MetricsProvider_GCPCloudMonitoring struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The GCP project id to send metrics to.
+	ProjectId string `protobuf:"bytes,1,opt,name=project_id,json=projectId,proto3" json:"project_id,omitempty"`
+	// The enum value for the monitored resource this application is monitoring.
+	// See https://cloud.google.com/monitoring/api/resources for valid values.
+	MonitoredResourceType string `protobuf:"bytes,2,opt,name=monitored_resource_type,json=monitoredResourceType,proto3" json:"monitored_resource_type,omitempty"`
+	// The labels to specify for the monitored resource.
+	// Each monitored resource type has a pre-defined set of labels that must be set.
+	// See https://cloud.google.com/monitoring/api/resources for expected labels.
+	MonitoredResourceLabels map[string]string `protobuf:"bytes,3,rep,name=monitored_resource_labels,json=monitoredResourceLabels,proto3" json:"monitored_resource_labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// The mapping between metric names in Encore and metric names in GCP.
+	MetricNames map[string]string `protobuf:"bytes,4,rep,name=metric_names,json=metricNames,proto3" json:"metric_names,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *MetricsProvider_GCPCloudMonitoring) Reset() {
+	*x = MetricsProvider_GCPCloudMonitoring{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MetricsProvider_GCPCloudMonitoring) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MetricsProvider_GCPCloudMonitoring) ProtoMessage() {}
+
+func (x *MetricsProvider_GCPCloudMonitoring) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MetricsProvider_GCPCloudMonitoring.ProtoReflect.Descriptor instead.
+func (*MetricsProvider_GCPCloudMonitoring) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{7, 0}
+}
+
+func (x *MetricsProvider_GCPCloudMonitoring) GetProjectId() string {
+	if x != nil {
+		return x.ProjectId
+	}
+	return ""
+}
+
+func (x *MetricsProvider_GCPCloudMonitoring) GetMonitoredResourceType() string {
+	if x != nil {
+		return x.MonitoredResourceType
+	}
+	return ""
+}
+
+func (x *MetricsProvider_GCPCloudMonitoring) GetMonitoredResourceLabels() map[string]string {
+	if x != nil {
+		return x.MonitoredResourceLabels
+	}
+	return nil
+}
+
+func (x *MetricsProvider_GCPCloudMonitoring) GetMetricNames() map[string]string {
+	if x != nil {
+		return x.MetricNames
+	}
+	return nil
+}
+
+type MetricsProvider_AWSCloudWatch struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The namespace to use for metrics.
+	Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"`
+}
+
+func (x *MetricsProvider_AWSCloudWatch) Reset() {
+	*x = MetricsProvider_AWSCloudWatch{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MetricsProvider_AWSCloudWatch) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MetricsProvider_AWSCloudWatch) ProtoMessage() {}
+
+func (x *MetricsProvider_AWSCloudWatch) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MetricsProvider_AWSCloudWatch.ProtoReflect.Descriptor instead.
+func (*MetricsProvider_AWSCloudWatch) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{7, 1}
+}
+
+func (x *MetricsProvider_AWSCloudWatch) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+type MetricsProvider_PrometheusRemoteWrite struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The URL to send metrics to.
+	RemoteWriteUrl *SecretData `protobuf:"bytes,1,opt,name=remote_write_url,json=remoteWriteUrl,proto3" json:"remote_write_url,omitempty"`
+}
+
+func (x *MetricsProvider_PrometheusRemoteWrite) Reset() {
+	*x = MetricsProvider_PrometheusRemoteWrite{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MetricsProvider_PrometheusRemoteWrite) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MetricsProvider_PrometheusRemoteWrite) ProtoMessage() {}
+
+func (x *MetricsProvider_PrometheusRemoteWrite) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MetricsProvider_PrometheusRemoteWrite.ProtoReflect.Descriptor instead.
+func (*MetricsProvider_PrometheusRemoteWrite) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{7, 2}
+}
+
+func (x *MetricsProvider_PrometheusRemoteWrite) GetRemoteWriteUrl() *SecretData {
+	if x != nil {
+		return x.RemoteWriteUrl
+	}
+	return nil
+}
+
+type MetricsProvider_Datadog struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Site   string      `protobuf:"bytes,1,opt,name=site,proto3" json:"site,omitempty"`
+	ApiKey *SecretData `protobuf:"bytes,2,opt,name=api_key,json=apiKey,proto3" json:"api_key,omitempty"`
+}
+
+func (x *MetricsProvider_Datadog) Reset() {
+	*x = MetricsProvider_Datadog{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MetricsProvider_Datadog) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MetricsProvider_Datadog) ProtoMessage() {}
+
+func (x *MetricsProvider_Datadog) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MetricsProvider_Datadog.ProtoReflect.Descriptor instead.
+func (*MetricsProvider_Datadog) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{7, 3}
+}
+
+func (x *MetricsProvider_Datadog) GetSite() string {
+	if x != nil {
+		return x.Site
+	}
+	return ""
+}
+
+func (x *MetricsProvider_Datadog) GetApiKey() *SecretData {
+	if x != nil {
+		return x.ApiKey
+	}
+	return nil
+}
+
+type ServiceDiscovery_Location struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The base URL of the service (including scheme and port).
+	BaseUrl string `protobuf:"bytes,1,opt,name=base_url,json=baseUrl,proto3" json:"base_url,omitempty"`
+	// The auth methods to use when talking to this service.
+	AuthMethods []*ServiceAuth `protobuf:"bytes,2,rep,name=auth_methods,json=authMethods,proto3" json:"auth_methods,omitempty"`
+}
+
+func (x *ServiceDiscovery_Location) Reset() {
+	*x = ServiceDiscovery_Location{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[25]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ServiceDiscovery_Location) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ServiceDiscovery_Location) ProtoMessage() {}
+
+func (x *ServiceDiscovery_Location) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[25]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ServiceDiscovery_Location.ProtoReflect.Descriptor instead.
+func (*ServiceDiscovery_Location) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{10, 1}
+}
+
+func (x *ServiceDiscovery_Location) GetBaseUrl() string {
+	if x != nil {
+		return x.BaseUrl
+	}
+	return ""
+}
+
+func (x *ServiceDiscovery_Location) GetAuthMethods() []*ServiceAuth {
+	if x != nil {
+		return x.AuthMethods
+	}
+	return nil
+}
+
+type RateLimiter_TokenBucket struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// The rate (in events per per second) to allow.
+	Rate float64 `protobuf:"fixed64,1,opt,name=rate,proto3" json:"rate,omitempty"`
+	// The burst size to allow.
+	Burst uint32 `protobuf:"varint,2,opt,name=burst,proto3" json:"burst,omitempty"`
+}
+
+func (x *RateLimiter_TokenBucket) Reset() {
+	*x = RateLimiter_TokenBucket{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_runtime_proto_msgTypes[26]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RateLimiter_TokenBucket) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RateLimiter_TokenBucket) ProtoMessage() {}
+
+func (x *RateLimiter_TokenBucket) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_runtime_proto_msgTypes[26]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RateLimiter_TokenBucket.ProtoReflect.Descriptor instead.
+func (*RateLimiter_TokenBucket) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_runtime_proto_rawDescGZIP(), []int{13, 0}
+}
+
+func (x *RateLimiter_TokenBucket) GetRate() float64 {
+	if x != nil {
+		return x.Rate
+	}
+	return 0
+}
+
+func (x *RateLimiter_TokenBucket) GetBurst() uint32 {
+	if x != nil {
+		return x.Burst
+	}
+	return 0
+}
+
+var File_encore_runtime_v1_runtime_proto protoreflect.FileDescriptor
+
+var file_encore_runtime_v1_runtime_proto_rawDesc = []byte{
+	0x0a, 0x1f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2f, 0x76, 0x31, 0x2f, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x12, 0x11, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x2e, 0x76, 0x31, 0x1a, 0x1d, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x75, 0x6e,
+	0x74, 0x69, 0x6d, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6e, 0x66, 0x72, 0x61, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x1a, 0x22, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x75, 0x6e, 0x74,
+	0x69, 0x6d, 0x65, 0x2f, 0x76, 0x31, 0x2f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x64, 0x61, 0x74,
+	0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f,
+	0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xae, 0x02, 0x0a, 0x0d, 0x52, 0x75, 0x6e,
+	0x74, 0x69, 0x6d, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x40, 0x0a, 0x0b, 0x65, 0x6e,
+	0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x52,
+	0x0b, 0x65, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x37, 0x0a, 0x05,
+	0x69, 0x6e, 0x66, 0x72, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x49, 0x6e, 0x66, 0x72, 0x61, 0x73, 0x74, 0x72, 0x75, 0x63, 0x74, 0x75, 0x72, 0x65, 0x52, 0x05,
+	0x69, 0x6e, 0x66, 0x72, 0x61, 0x12, 0x3d, 0x0a, 0x0a, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x6d,
+	0x65, 0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x65,
+	0x70, 0x6c, 0x6f, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79,
+	0x6d, 0x65, 0x6e, 0x74, 0x12, 0x4f, 0x0a, 0x0f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x5f, 0x70,
+	0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x45, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x48, 0x00, 0x52, 0x0e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f,
+	0x72, 0x6d, 0x88, 0x01, 0x01, 0x42, 0x12, 0x0a, 0x10, 0x5f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x5f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x22, 0xcb, 0x03, 0x0a, 0x0b, 0x45, 0x6e,
+	0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x15, 0x0a, 0x06, 0x61, 0x70, 0x70,
+	0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x61, 0x70, 0x70, 0x49, 0x64,
+	0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x73, 0x6c, 0x75, 0x67, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x53, 0x6c, 0x75, 0x67, 0x12, 0x15, 0x0a, 0x06, 0x65,
+	0x6e, 0x76, 0x5f, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6e, 0x76,
+	0x49, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x76, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x3e, 0x0a,
+	0x08, 0x65, 0x6e, 0x76, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x23, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x2e,
+	0x54, 0x79, 0x70, 0x65, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x54, 0x79, 0x70, 0x65, 0x12, 0x3a, 0x0a,
+	0x05, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x24, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x45, 0x6e, 0x76, 0x69, 0x72, 0x6f, 0x6e, 0x6d, 0x65, 0x6e, 0x74, 0x2e, 0x43, 0x6c, 0x6f,
+	0x75, 0x64, 0x52, 0x05, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x22, 0x6a, 0x0a, 0x04, 0x54, 0x79, 0x70,
+	0x65, 0x12, 0x14, 0x0a, 0x10, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43,
+	0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x14, 0x0a, 0x10, 0x54, 0x59, 0x50, 0x45, 0x5f,
+	0x44, 0x45, 0x56, 0x45, 0x4c, 0x4f, 0x50, 0x4d, 0x45, 0x4e, 0x54, 0x10, 0x01, 0x12, 0x13, 0x0a,
+	0x0f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x50, 0x52, 0x4f, 0x44, 0x55, 0x43, 0x54, 0x49, 0x4f, 0x4e,
+	0x10, 0x02, 0x12, 0x12, 0x0a, 0x0e, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x45, 0x50, 0x48, 0x45, 0x4d,
+	0x45, 0x52, 0x41, 0x4c, 0x10, 0x03, 0x12, 0x0d, 0x0a, 0x09, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x54,
+	0x45, 0x53, 0x54, 0x10, 0x04, 0x22, 0x70, 0x0a, 0x05, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x12, 0x15,
+	0x0a, 0x11, 0x43, 0x4c, 0x4f, 0x55, 0x44, 0x5f, 0x55, 0x4e, 0x53, 0x50, 0x45, 0x43, 0x49, 0x46,
+	0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0f, 0x0a, 0x0b, 0x43, 0x4c, 0x4f, 0x55, 0x44, 0x5f, 0x4c,
+	0x4f, 0x43, 0x41, 0x4c, 0x10, 0x01, 0x12, 0x10, 0x0a, 0x0c, 0x43, 0x4c, 0x4f, 0x55, 0x44, 0x5f,
+	0x45, 0x4e, 0x43, 0x4f, 0x52, 0x45, 0x10, 0x02, 0x12, 0x0d, 0x0a, 0x09, 0x43, 0x4c, 0x4f, 0x55,
+	0x44, 0x5f, 0x41, 0x57, 0x53, 0x10, 0x03, 0x12, 0x0d, 0x0a, 0x09, 0x43, 0x4c, 0x4f, 0x55, 0x44,
+	0x5f, 0x47, 0x43, 0x50, 0x10, 0x04, 0x12, 0x0f, 0x0a, 0x0b, 0x43, 0x4c, 0x4f, 0x55, 0x44, 0x5f,
+	0x41, 0x5a, 0x55, 0x52, 0x45, 0x10, 0x05, 0x22, 0xba, 0x04, 0x0a, 0x0a, 0x44, 0x65, 0x70, 0x6c,
+	0x6f, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79,
+	0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x64, 0x65, 0x70, 0x6c, 0x6f,
+	0x79, 0x49, 0x64, 0x12, 0x3b, 0x0a, 0x0b, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x65, 0x64, 0x5f,
+	0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x52, 0x0a, 0x64, 0x65, 0x70, 0x6c, 0x6f, 0x79, 0x65, 0x64, 0x41, 0x74,
+	0x12, 0x2f, 0x0a, 0x13, 0x64, 0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x5f, 0x65, 0x78, 0x70, 0x65,
+	0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x64,
+	0x79, 0x6e, 0x61, 0x6d, 0x69, 0x63, 0x45, 0x78, 0x70, 0x65, 0x72, 0x69, 0x6d, 0x65, 0x6e, 0x74,
+	0x73, 0x12, 0x27, 0x0a, 0x0f, 0x68, 0x6f, 0x73, 0x74, 0x65, 0x64, 0x5f, 0x67, 0x61, 0x74, 0x65,
+	0x77, 0x61, 0x79, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0e, 0x68, 0x6f, 0x73, 0x74,
+	0x65, 0x64, 0x47, 0x61, 0x74, 0x65, 0x77, 0x61, 0x79, 0x73, 0x12, 0x49, 0x0a, 0x0f, 0x68, 0x6f,
+	0x73, 0x74, 0x65, 0x64, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x05, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e,
+	0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x6f, 0x73, 0x74, 0x65, 0x64, 0x53, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x52, 0x0e, 0x68, 0x6f, 0x73, 0x74, 0x65, 0x64, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x12, 0x41, 0x0a, 0x0c, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65,
+	0x74, 0x68, 0x6f, 0x64, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x52, 0x0b, 0x61, 0x75, 0x74,
+	0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x12, 0x46, 0x0a, 0x0d, 0x6f, 0x62, 0x73, 0x65,
+	0x72, 0x76, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x4f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74,
+	0x79, 0x52, 0x0d, 0x6f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x61, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79,
+	0x12, 0x50, 0x0a, 0x11, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x64, 0x69, 0x73, 0x63,
+	0x6f, 0x76, 0x65, 0x72, 0x79, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79,
+	0x52, 0x10, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65,
+	0x72, 0x79, 0x12, 0x50, 0x0a, 0x11, 0x67, 0x72, 0x61, 0x63, 0x65, 0x66, 0x75, 0x6c, 0x5f, 0x73,
+	0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x47, 0x72, 0x61, 0x63, 0x65, 0x66, 0x75, 0x6c, 0x53, 0x68, 0x75, 0x74, 0x64, 0x6f,
+	0x77, 0x6e, 0x52, 0x10, 0x67, 0x72, 0x61, 0x63, 0x65, 0x66, 0x75, 0x6c, 0x53, 0x68, 0x75, 0x74,
+	0x64, 0x6f, 0x77, 0x6e, 0x22, 0xc0, 0x01, 0x0a, 0x0d, 0x4f, 0x62, 0x73, 0x65, 0x72, 0x76, 0x61,
+	0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x12, 0x3c, 0x0a, 0x07, 0x74, 0x72, 0x61, 0x63, 0x69, 0x6e,
+	0x67, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x54, 0x72, 0x61, 0x63,
+	0x69, 0x6e, 0x67, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x07, 0x74, 0x72, 0x61,
+	0x63, 0x69, 0x6e, 0x67, 0x12, 0x3c, 0x0a, 0x07, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72,
+	0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63,
+	0x73, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x07, 0x6d, 0x65, 0x74, 0x72, 0x69,
+	0x63, 0x73, 0x12, 0x33, 0x0a, 0x04, 0x6c, 0x6f, 0x67, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x1f, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4c, 0x6f, 0x67, 0x73, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x52, 0x04, 0x6c, 0x6f, 0x67, 0x73, 0x22, 0x95, 0x01, 0x0a, 0x0d, 0x48, 0x6f, 0x73, 0x74,
+	0x65, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x2a, 0x0a,
+	0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x74, 0x68, 0x72, 0x65, 0x61, 0x64, 0x73, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x05, 0x48, 0x00, 0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x54,
+	0x68, 0x72, 0x65, 0x61, 0x64, 0x73, 0x88, 0x01, 0x01, 0x12, 0x22, 0x0a, 0x0a, 0x6c, 0x6f, 0x67,
+	0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52,
+	0x09, 0x6c, 0x6f, 0x67, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x88, 0x01, 0x01, 0x42, 0x11, 0x0a,
+	0x0f, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x65, 0x72, 0x5f, 0x74, 0x68, 0x72, 0x65, 0x61, 0x64, 0x73,
+	0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x6c, 0x6f, 0x67, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22,
+	0x82, 0x02, 0x0a, 0x0b, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x12,
+	0x3d, 0x0a, 0x04, 0x6e, 0x6f, 0x6f, 0x70, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74, 0x68, 0x2e, 0x4e, 0x6f,
+	0x6f, 0x70, 0x41, 0x75, 0x74, 0x68, 0x48, 0x00, 0x52, 0x04, 0x6e, 0x6f, 0x6f, 0x70, 0x12, 0x4c,
+	0x0a, 0x0b, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x18, 0x0b, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e,
+	0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41,
+	0x75, 0x74, 0x68, 0x2e, 0x45, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x48, 0x00,
+	0x52, 0x0a, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x1a, 0x0a, 0x0a, 0x08,
+	0x4e, 0x6f, 0x6f, 0x70, 0x41, 0x75, 0x74, 0x68, 0x1a, 0x4b, 0x0a, 0x0a, 0x45, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x12, 0x3d, 0x0a, 0x09, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b,
+	0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x08, 0x61, 0x75, 0x74,
+	0x68, 0x4b, 0x65, 0x79, 0x73, 0x42, 0x0d, 0x0a, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65,
+	0x74, 0x68, 0x6f, 0x64, 0x22, 0xff, 0x01, 0x0a, 0x0f, 0x54, 0x72, 0x61, 0x63, 0x69, 0x6e, 0x67,
+	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x52, 0x0a, 0x06, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x54,
+	0x72, 0x61, 0x63, 0x69, 0x6e, 0x67, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x2e, 0x45,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x54, 0x72, 0x61, 0x63, 0x69, 0x6e, 0x67, 0x50, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x48, 0x00, 0x52, 0x06, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x1a, 0x7a,
+	0x0a, 0x15, 0x45, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x54, 0x72, 0x61, 0x63, 0x69, 0x6e, 0x67, 0x50,
+	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x25, 0x0a, 0x0e, 0x74, 0x72, 0x61, 0x63, 0x65,
+	0x5f, 0x65, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0d, 0x74, 0x72, 0x61, 0x63, 0x65, 0x45, 0x6e, 0x64, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x28,
+	0x0a, 0x0d, 0x73, 0x61, 0x6d, 0x70, 0x6c, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x61, 0x74, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x01, 0x48, 0x00, 0x52, 0x0c, 0x73, 0x61, 0x6d, 0x70, 0x6c, 0x69, 0x6e,
+	0x67, 0x52, 0x61, 0x74, 0x65, 0x88, 0x01, 0x01, 0x42, 0x10, 0x0a, 0x0e, 0x5f, 0x73, 0x61, 0x6d,
+	0x70, 0x6c, 0x69, 0x6e, 0x67, 0x5f, 0x72, 0x61, 0x74, 0x65, 0x42, 0x0a, 0x0a, 0x08, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x22, 0xf6, 0x09, 0x0a, 0x0f, 0x4d, 0x65, 0x74, 0x72, 0x69,
+	0x63, 0x73, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69, 0x64, 0x12, 0x4a, 0x0a, 0x13,
+	0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x6e, 0x74, 0x65, 0x72,
+	0x76, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x12, 0x63, 0x6f, 0x6c, 0x6c, 0x65, 0x63, 0x74, 0x69, 0x6f, 0x6e,
+	0x49, 0x6e, 0x74, 0x65, 0x72, 0x76, 0x61, 0x6c, 0x12, 0x5a, 0x0a, 0x0c, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x35,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64,
+	0x65, 0x72, 0x2e, 0x47, 0x43, 0x50, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x4d, 0x6f, 0x6e, 0x69, 0x74,
+	0x6f, 0x72, 0x69, 0x6e, 0x67, 0x48, 0x00, 0x52, 0x0b, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x43,
+	0x6c, 0x6f, 0x75, 0x64, 0x12, 0x49, 0x0a, 0x03, 0x67, 0x63, 0x70, 0x18, 0x0b, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x35, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69,
+	0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x50, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x2e, 0x47, 0x43, 0x50, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x4d, 0x6f,
+	0x6e, 0x69, 0x74, 0x6f, 0x72, 0x69, 0x6e, 0x67, 0x48, 0x00, 0x52, 0x03, 0x67, 0x63, 0x70, 0x12,
+	0x44, 0x0a, 0x03, 0x61, 0x77, 0x73, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x2e, 0x41, 0x57, 0x53, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x57, 0x61, 0x74, 0x63, 0x68, 0x48, 0x00,
+	0x52, 0x03, 0x61, 0x77, 0x73, 0x12, 0x66, 0x0a, 0x11, 0x70, 0x72, 0x6f, 0x6d, 0x5f, 0x72, 0x65,
+	0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x77, 0x72, 0x69, 0x74, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x38, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x50, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x52,
+	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x57, 0x72, 0x69, 0x74, 0x65, 0x48, 0x00, 0x52, 0x0f, 0x70, 0x72,
+	0x6f, 0x6d, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x57, 0x72, 0x69, 0x74, 0x65, 0x12, 0x46, 0x0a,
+	0x07, 0x64, 0x61, 0x74, 0x61, 0x64, 0x6f, 0x67, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a,
+	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e,
+	0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64,
+	0x65, 0x72, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x64, 0x6f, 0x67, 0x48, 0x00, 0x52, 0x07, 0x64, 0x61,
+	0x74, 0x61, 0x64, 0x6f, 0x67, 0x1a, 0xf3, 0x03, 0x0a, 0x12, 0x47, 0x43, 0x50, 0x43, 0x6c, 0x6f,
+	0x75, 0x64, 0x4d, 0x6f, 0x6e, 0x69, 0x74, 0x6f, 0x72, 0x69, 0x6e, 0x67, 0x12, 0x1d, 0x0a, 0x0a,
+	0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x09, 0x70, 0x72, 0x6f, 0x6a, 0x65, 0x63, 0x74, 0x49, 0x64, 0x12, 0x36, 0x0a, 0x17, 0x6d,
+	0x6f, 0x6e, 0x69, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x15, 0x6d, 0x6f,
+	0x6e, 0x69, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x54,
+	0x79, 0x70, 0x65, 0x12, 0x8e, 0x01, 0x0a, 0x19, 0x6d, 0x6f, 0x6e, 0x69, 0x74, 0x6f, 0x72, 0x65,
+	0x64, 0x5f, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x6c, 0x61, 0x62, 0x65, 0x6c,
+	0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x52, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x74, 0x72,
+	0x69, 0x63, 0x73, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x2e, 0x47, 0x43, 0x50, 0x43,
+	0x6c, 0x6f, 0x75, 0x64, 0x4d, 0x6f, 0x6e, 0x69, 0x74, 0x6f, 0x72, 0x69, 0x6e, 0x67, 0x2e, 0x4d,
+	0x6f, 0x6e, 0x69, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x17, 0x6d, 0x6f, 0x6e,
+	0x69, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x4c, 0x61,
+	0x62, 0x65, 0x6c, 0x73, 0x12, 0x69, 0x0a, 0x0c, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x46, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x4d,
+	0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x2e, 0x47,
+	0x43, 0x50, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x4d, 0x6f, 0x6e, 0x69, 0x74, 0x6f, 0x72, 0x69, 0x6e,
+	0x67, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x52, 0x0b, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x1a,
+	0x4a, 0x0a, 0x1c, 0x4d, 0x6f, 0x6e, 0x69, 0x74, 0x6f, 0x72, 0x65, 0x64, 0x52, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
+	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x3e, 0x0a, 0x10, 0x4d,
+	0x65, 0x74, 0x72, 0x69, 0x63, 0x4e, 0x61, 0x6d, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
+	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x2d, 0x0a, 0x0d, 0x41,
+	0x57, 0x53, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x57, 0x61, 0x74, 0x63, 0x68, 0x12, 0x1c, 0x0a, 0x09,
+	0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x1a, 0x60, 0x0a, 0x15, 0x50, 0x72,
+	0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x57, 0x72,
+	0x69, 0x74, 0x65, 0x12, 0x47, 0x0a, 0x10, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x5f, 0x77, 0x72,
+	0x69, 0x74, 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x44, 0x61, 0x74, 0x61, 0x52, 0x0e, 0x72, 0x65,
+	0x6d, 0x6f, 0x74, 0x65, 0x57, 0x72, 0x69, 0x74, 0x65, 0x55, 0x72, 0x6c, 0x1a, 0x55, 0x0a, 0x07,
+	0x44, 0x61, 0x74, 0x61, 0x64, 0x6f, 0x67, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x69, 0x74, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x73, 0x69, 0x74, 0x65, 0x12, 0x36, 0x0a, 0x07, 0x61,
+	0x70, 0x69, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x44, 0x61, 0x74, 0x61, 0x52, 0x06, 0x61, 0x70, 0x69,
+	0x4b, 0x65, 0x79, 0x42, 0x0a, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x22,
+	0x20, 0x0a, 0x0c, 0x4c, 0x6f, 0x67, 0x73, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12,
+	0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x69,
+	0x64, 0x22, 0x52, 0x0a, 0x0d, 0x45, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b,
+	0x65, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x31, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1d, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x44, 0x61, 0x74, 0x61, 0x52,
+	0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0xb6, 0x02, 0x0a, 0x10, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
+	0x65, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79, 0x12, 0x4d, 0x0a, 0x08, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x31, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72,
+	0x79, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x08, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x1a, 0x69, 0x0a, 0x0d, 0x53, 0x65, 0x72,
+	0x76, 0x69, 0x63, 0x65, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x42, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x65, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e,
+	0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x44, 0x69, 0x73, 0x63, 0x6f, 0x76, 0x65, 0x72, 0x79,
+	0x2e, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x3a, 0x02, 0x38, 0x01, 0x1a, 0x68, 0x0a, 0x08, 0x4c, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x12, 0x19, 0x0a, 0x08, 0x62, 0x61, 0x73, 0x65, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x07, 0x62, 0x61, 0x73, 0x65, 0x55, 0x72, 0x6c, 0x12, 0x41, 0x0a, 0x0c, 0x61,
+	0x75, 0x74, 0x68, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x1e, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69,
+	0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x41, 0x75, 0x74,
+	0x68, 0x52, 0x0b, 0x61, 0x75, 0x74, 0x68, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x73, 0x22, 0xbc,
+	0x01, 0x0a, 0x10, 0x47, 0x72, 0x61, 0x63, 0x65, 0x66, 0x75, 0x6c, 0x53, 0x68, 0x75, 0x74, 0x64,
+	0x6f, 0x77, 0x6e, 0x12, 0x2f, 0x0a, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x05, 0x74,
+	0x6f, 0x74, 0x61, 0x6c, 0x12, 0x40, 0x0a, 0x0e, 0x73, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e,
+	0x5f, 0x68, 0x6f, 0x6f, 0x6b, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44,
+	0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x0d, 0x73, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77,
+	0x6e, 0x48, 0x6f, 0x6f, 0x6b, 0x73, 0x12, 0x35, 0x0a, 0x08, 0x68, 0x61, 0x6e, 0x64, 0x6c, 0x65,
+	0x72, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x44, 0x75, 0x72, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x08, 0x68, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x72, 0x73, 0x22, 0xc7, 0x01,
+	0x0a, 0x0e, 0x45, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x50, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x12, 0x54, 0x0a, 0x15, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x73, 0x69, 0x67,
+	0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x41, 0x75, 0x74, 0x68, 0x4b, 0x65,
+	0x79, 0x52, 0x13, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x53, 0x69, 0x67, 0x6e, 0x69,
+	0x6e, 0x67, 0x4b, 0x65, 0x79, 0x73, 0x12, 0x4e, 0x0a, 0x0c, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x65,
+	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31,
+	0x2e, 0x45, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x50, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x48, 0x00, 0x52, 0x0b, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x43, 0x6c,
+	0x6f, 0x75, 0x64, 0x88, 0x01, 0x01, 0x42, 0x0f, 0x0a, 0x0d, 0x5f, 0x65, 0x6e, 0x63, 0x6f, 0x72,
+	0x65, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x22, 0x9f, 0x01, 0x0a, 0x0b, 0x52, 0x61, 0x74, 0x65,
+	0x4c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x72, 0x12, 0x4f, 0x0a, 0x0c, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
+	0x5f, 0x62, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e,
+	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76,
+	0x31, 0x2e, 0x52, 0x61, 0x74, 0x65, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x65, 0x72, 0x2e, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x48, 0x00, 0x52, 0x0b, 0x74, 0x6f, 0x6b,
+	0x65, 0x6e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x1a, 0x37, 0x0a, 0x0b, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x61, 0x74, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x01, 0x52, 0x04, 0x72, 0x61, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x62,
+	0x75, 0x72, 0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x05, 0x62, 0x75, 0x72, 0x73,
+	0x74, 0x42, 0x06, 0x0a, 0x04, 0x6b, 0x69, 0x6e, 0x64, 0x22, 0x85, 0x01, 0x0a, 0x13, 0x45, 0x6e,
+	0x63, 0x6f, 0x72, 0x65, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x72, 0x69, 0x64, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x75, 0x72,
+	0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x55,
+	0x72, 0x6c, 0x12, 0x3d, 0x0a, 0x09, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6b, 0x65, 0x79, 0x73, 0x18,
+	0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72,
+	0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x63, 0x6f, 0x72, 0x65,
+	0x41, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79, 0x52, 0x08, 0x61, 0x75, 0x74, 0x68, 0x4b, 0x65, 0x79,
+	0x73, 0x42, 0x2c, 0x5a, 0x2a, 0x65, 0x6e, 0x63, 0x72, 0x2e, 0x64, 0x65, 0x76, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x75, 0x6e, 0x74, 0x69,
+	0x6d, 0x65, 0x2f, 0x76, 0x31, 0x3b, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x76, 0x31, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_encore_runtime_v1_runtime_proto_rawDescOnce sync.Once
+	file_encore_runtime_v1_runtime_proto_rawDescData = file_encore_runtime_v1_runtime_proto_rawDesc
+)
+
+func file_encore_runtime_v1_runtime_proto_rawDescGZIP() []byte {
+	file_encore_runtime_v1_runtime_proto_rawDescOnce.Do(func() {
+		file_encore_runtime_v1_runtime_proto_rawDescData = protoimpl.X.CompressGZIP(file_encore_runtime_v1_runtime_proto_rawDescData)
+	})
+	return file_encore_runtime_v1_runtime_proto_rawDescData
+}
+
+var file_encore_runtime_v1_runtime_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
+var file_encore_runtime_v1_runtime_proto_msgTypes = make([]protoimpl.MessageInfo, 27)
+var file_encore_runtime_v1_runtime_proto_goTypes = []interface{}{
+	(Environment_Type)(0),                         // 0: encore.runtime.v1.Environment.Type
+	(Environment_Cloud)(0),                        // 1: encore.runtime.v1.Environment.Cloud
+	(*RuntimeConfig)(nil),                         // 2: encore.runtime.v1.RuntimeConfig
+	(*Environment)(nil),                           // 3: encore.runtime.v1.Environment
+	(*Deployment)(nil),                            // 4: encore.runtime.v1.Deployment
+	(*Observability)(nil),                         // 5: encore.runtime.v1.Observability
+	(*HostedService)(nil),                         // 6: encore.runtime.v1.HostedService
+	(*ServiceAuth)(nil),                           // 7: encore.runtime.v1.ServiceAuth
+	(*TracingProvider)(nil),                       // 8: encore.runtime.v1.TracingProvider
+	(*MetricsProvider)(nil),                       // 9: encore.runtime.v1.MetricsProvider
+	(*LogsProvider)(nil),                          // 10: encore.runtime.v1.LogsProvider
+	(*EncoreAuthKey)(nil),                         // 11: encore.runtime.v1.EncoreAuthKey
+	(*ServiceDiscovery)(nil),                      // 12: encore.runtime.v1.ServiceDiscovery
+	(*GracefulShutdown)(nil),                      // 13: encore.runtime.v1.GracefulShutdown
+	(*EncorePlatform)(nil),                        // 14: encore.runtime.v1.EncorePlatform
+	(*RateLimiter)(nil),                           // 15: encore.runtime.v1.RateLimiter
+	(*EncoreCloudProvider)(nil),                   // 16: encore.runtime.v1.EncoreCloudProvider
+	(*ServiceAuth_NoopAuth)(nil),                  // 17: encore.runtime.v1.ServiceAuth.NoopAuth
+	(*ServiceAuth_EncoreAuth)(nil),                // 18: encore.runtime.v1.ServiceAuth.EncoreAuth
+	(*TracingProvider_EncoreTracingProvider)(nil), // 19: encore.runtime.v1.TracingProvider.EncoreTracingProvider
+	(*MetricsProvider_GCPCloudMonitoring)(nil),    // 20: encore.runtime.v1.MetricsProvider.GCPCloudMonitoring
+	(*MetricsProvider_AWSCloudWatch)(nil),         // 21: encore.runtime.v1.MetricsProvider.AWSCloudWatch
+	(*MetricsProvider_PrometheusRemoteWrite)(nil), // 22: encore.runtime.v1.MetricsProvider.PrometheusRemoteWrite
+	(*MetricsProvider_Datadog)(nil),               // 23: encore.runtime.v1.MetricsProvider.Datadog
+	nil,                                           // 24: encore.runtime.v1.MetricsProvider.GCPCloudMonitoring.MonitoredResourceLabelsEntry
+	nil,                                           // 25: encore.runtime.v1.MetricsProvider.GCPCloudMonitoring.MetricNamesEntry
+	nil,                                           // 26: encore.runtime.v1.ServiceDiscovery.ServicesEntry
+	(*ServiceDiscovery_Location)(nil),             // 27: encore.runtime.v1.ServiceDiscovery.Location
+	(*RateLimiter_TokenBucket)(nil),               // 28: encore.runtime.v1.RateLimiter.TokenBucket
+	(*Infrastructure)(nil),                        // 29: encore.runtime.v1.Infrastructure
+	(*timestamppb.Timestamp)(nil),                 // 30: google.protobuf.Timestamp
+	(*durationpb.Duration)(nil),                   // 31: google.protobuf.Duration
+	(*SecretData)(nil),                            // 32: encore.runtime.v1.SecretData
+}
+var file_encore_runtime_v1_runtime_proto_depIdxs = []int32{
+	3,  // 0: encore.runtime.v1.RuntimeConfig.environment:type_name -> encore.runtime.v1.Environment
+	29, // 1: encore.runtime.v1.RuntimeConfig.infra:type_name -> encore.runtime.v1.Infrastructure
+	4,  // 2: encore.runtime.v1.RuntimeConfig.deployment:type_name -> encore.runtime.v1.Deployment
+	14, // 3: encore.runtime.v1.RuntimeConfig.encore_platform:type_name -> encore.runtime.v1.EncorePlatform
+	0,  // 4: encore.runtime.v1.Environment.env_type:type_name -> encore.runtime.v1.Environment.Type
+	1,  // 5: encore.runtime.v1.Environment.cloud:type_name -> encore.runtime.v1.Environment.Cloud
+	30, // 6: encore.runtime.v1.Deployment.deployed_at:type_name -> google.protobuf.Timestamp
+	6,  // 7: encore.runtime.v1.Deployment.hosted_services:type_name -> encore.runtime.v1.HostedService
+	7,  // 8: encore.runtime.v1.Deployment.auth_methods:type_name -> encore.runtime.v1.ServiceAuth
+	5,  // 9: encore.runtime.v1.Deployment.observability:type_name -> encore.runtime.v1.Observability
+	12, // 10: encore.runtime.v1.Deployment.service_discovery:type_name -> encore.runtime.v1.ServiceDiscovery
+	13, // 11: encore.runtime.v1.Deployment.graceful_shutdown:type_name -> encore.runtime.v1.GracefulShutdown
+	8,  // 12: encore.runtime.v1.Observability.tracing:type_name -> encore.runtime.v1.TracingProvider
+	9,  // 13: encore.runtime.v1.Observability.metrics:type_name -> encore.runtime.v1.MetricsProvider
+	10, // 14: encore.runtime.v1.Observability.logs:type_name -> encore.runtime.v1.LogsProvider
+	17, // 15: encore.runtime.v1.ServiceAuth.noop:type_name -> encore.runtime.v1.ServiceAuth.NoopAuth
+	18, // 16: encore.runtime.v1.ServiceAuth.encore_auth:type_name -> encore.runtime.v1.ServiceAuth.EncoreAuth
+	19, // 17: encore.runtime.v1.TracingProvider.encore:type_name -> encore.runtime.v1.TracingProvider.EncoreTracingProvider
+	31, // 18: encore.runtime.v1.MetricsProvider.collection_interval:type_name -> google.protobuf.Duration
+	20, // 19: encore.runtime.v1.MetricsProvider.encore_cloud:type_name -> encore.runtime.v1.MetricsProvider.GCPCloudMonitoring
+	20, // 20: encore.runtime.v1.MetricsProvider.gcp:type_name -> encore.runtime.v1.MetricsProvider.GCPCloudMonitoring
+	21, // 21: encore.runtime.v1.MetricsProvider.aws:type_name -> encore.runtime.v1.MetricsProvider.AWSCloudWatch
+	22, // 22: encore.runtime.v1.MetricsProvider.prom_remote_write:type_name -> encore.runtime.v1.MetricsProvider.PrometheusRemoteWrite
+	23, // 23: encore.runtime.v1.MetricsProvider.datadog:type_name -> encore.runtime.v1.MetricsProvider.Datadog
+	32, // 24: encore.runtime.v1.EncoreAuthKey.data:type_name -> encore.runtime.v1.SecretData
+	26, // 25: encore.runtime.v1.ServiceDiscovery.services:type_name -> encore.runtime.v1.ServiceDiscovery.ServicesEntry
+	31, // 26: encore.runtime.v1.GracefulShutdown.total:type_name -> google.protobuf.Duration
+	31, // 27: encore.runtime.v1.GracefulShutdown.shutdown_hooks:type_name -> google.protobuf.Duration
+	31, // 28: encore.runtime.v1.GracefulShutdown.handlers:type_name -> google.protobuf.Duration
+	11, // 29: encore.runtime.v1.EncorePlatform.platform_signing_keys:type_name -> encore.runtime.v1.EncoreAuthKey
+	16, // 30: encore.runtime.v1.EncorePlatform.encore_cloud:type_name -> encore.runtime.v1.EncoreCloudProvider
+	28, // 31: encore.runtime.v1.RateLimiter.token_bucket:type_name -> encore.runtime.v1.RateLimiter.TokenBucket
+	11, // 32: encore.runtime.v1.EncoreCloudProvider.auth_keys:type_name -> encore.runtime.v1.EncoreAuthKey
+	11, // 33: encore.runtime.v1.ServiceAuth.EncoreAuth.auth_keys:type_name -> encore.runtime.v1.EncoreAuthKey
+	24, // 34: encore.runtime.v1.MetricsProvider.GCPCloudMonitoring.monitored_resource_labels:type_name -> encore.runtime.v1.MetricsProvider.GCPCloudMonitoring.MonitoredResourceLabelsEntry
+	25, // 35: encore.runtime.v1.MetricsProvider.GCPCloudMonitoring.metric_names:type_name -> encore.runtime.v1.MetricsProvider.GCPCloudMonitoring.MetricNamesEntry
+	32, // 36: encore.runtime.v1.MetricsProvider.PrometheusRemoteWrite.remote_write_url:type_name -> encore.runtime.v1.SecretData
+	32, // 37: encore.runtime.v1.MetricsProvider.Datadog.api_key:type_name -> encore.runtime.v1.SecretData
+	27, // 38: encore.runtime.v1.ServiceDiscovery.ServicesEntry.value:type_name -> encore.runtime.v1.ServiceDiscovery.Location
+	7,  // 39: encore.runtime.v1.ServiceDiscovery.Location.auth_methods:type_name -> encore.runtime.v1.ServiceAuth
+	40, // [40:40] is the sub-list for method output_type
+	40, // [40:40] is the sub-list for method input_type
+	40, // [40:40] is the sub-list for extension type_name
+	40, // [40:40] is the sub-list for extension extendee
+	0,  // [0:40] is the sub-list for field type_name
+}
+
+func init() { file_encore_runtime_v1_runtime_proto_init() }
+func file_encore_runtime_v1_runtime_proto_init() {
+	if File_encore_runtime_v1_runtime_proto != nil {
+		return
+	}
+	file_encore_runtime_v1_infra_proto_init()
+	file_encore_runtime_v1_secretdata_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_encore_runtime_v1_runtime_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RuntimeConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Environment); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Deployment); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Observability); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HostedService); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceAuth); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TracingProvider); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MetricsProvider); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LogsProvider); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EncoreAuthKey); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceDiscovery); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GracefulShutdown); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EncorePlatform); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RateLimiter); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*EncoreCloudProvider); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceAuth_NoopAuth); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceAuth_EncoreAuth); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TracingProvider_EncoreTracingProvider); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MetricsProvider_GCPCloudMonitoring); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MetricsProvider_AWSCloudWatch); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MetricsProvider_PrometheusRemoteWrite); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MetricsProvider_Datadog); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ServiceDiscovery_Location); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_encore_runtime_v1_runtime_proto_msgTypes[26].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RateLimiter_TokenBucket); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_encore_runtime_v1_runtime_proto_msgTypes[0].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_runtime_proto_msgTypes[4].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_runtime_proto_msgTypes[5].OneofWrappers = []interface{}{
+		(*ServiceAuth_Noop)(nil),
+		(*ServiceAuth_EncoreAuth_)(nil),
+	}
+	file_encore_runtime_v1_runtime_proto_msgTypes[6].OneofWrappers = []interface{}{
+		(*TracingProvider_Encore)(nil),
+	}
+	file_encore_runtime_v1_runtime_proto_msgTypes[7].OneofWrappers = []interface{}{
+		(*MetricsProvider_EncoreCloud)(nil),
+		(*MetricsProvider_Gcp)(nil),
+		(*MetricsProvider_Aws)(nil),
+		(*MetricsProvider_PromRemoteWrite)(nil),
+		(*MetricsProvider_Datadog_)(nil),
+	}
+	file_encore_runtime_v1_runtime_proto_msgTypes[12].OneofWrappers = []interface{}{}
+	file_encore_runtime_v1_runtime_proto_msgTypes[13].OneofWrappers = []interface{}{
+		(*RateLimiter_TokenBucket_)(nil),
+	}
+	file_encore_runtime_v1_runtime_proto_msgTypes[17].OneofWrappers = []interface{}{}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_encore_runtime_v1_runtime_proto_rawDesc,
+			NumEnums:      2,
+			NumMessages:   27,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_encore_runtime_v1_runtime_proto_goTypes,
+		DependencyIndexes: file_encore_runtime_v1_runtime_proto_depIdxs,
+		EnumInfos:         file_encore_runtime_v1_runtime_proto_enumTypes,
+		MessageInfos:      file_encore_runtime_v1_runtime_proto_msgTypes,
+	}.Build()
+	File_encore_runtime_v1_runtime_proto = out.File
+	file_encore_runtime_v1_runtime_proto_rawDesc = nil
+	file_encore_runtime_v1_runtime_proto_goTypes = nil
+	file_encore_runtime_v1_runtime_proto_depIdxs = nil
+}
diff --git a/proto/encore/runtime/v1/runtime.proto b/proto/encore/runtime/v1/runtime.proto
new file mode 100644
index 0000000000..ec860382df
--- /dev/null
+++ b/proto/encore/runtime/v1/runtime.proto
@@ -0,0 +1,250 @@
+syntax = "proto3";
+package encore.runtime.v1;
+
+import "encore/runtime/v1/infra.proto";
+import "encore/runtime/v1/secretdata.proto";
+import "google/protobuf/duration.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "encr.dev/proto/encore/runtime/v1;runtimev1";
+
+message RuntimeConfig {
+  Environment environment = 1;
+  Infrastructure infra = 2;
+  Deployment deployment = 3;
+  optional EncorePlatform encore_platform = 5;
+}
+
+message Environment {
+  string app_id = 1;
+  string app_slug = 2;
+  string env_id = 3;
+  string env_name = 4;
+  Type env_type = 5;
+  Cloud cloud = 6;
+
+  enum Type {
+    TYPE_UNSPECIFIED = 0;
+    TYPE_DEVELOPMENT = 1;
+    TYPE_PRODUCTION = 2;
+    TYPE_EPHEMERAL = 3;
+    TYPE_TEST = 4;
+  }
+
+  enum Cloud {
+    CLOUD_UNSPECIFIED = 0;
+    CLOUD_LOCAL = 1;
+    CLOUD_ENCORE = 2;
+    CLOUD_AWS = 3;
+    CLOUD_GCP = 4;
+    CLOUD_AZURE = 5;
+  }
+}
+
+// Describes the configuration related to a specific deployment,
+// meaning a group of services deployed together (think a single k8s Deployment).
+message Deployment {
+  string deploy_id = 1;
+  google.protobuf.Timestamp deployed_at = 2;
+
+  // A list of experiments to enable at runtime.
+  repeated string dynamic_experiments = 3;
+
+  // The gateways hosted by this deployment, by rid.
+  repeated string hosted_gateways = 4;
+
+  // The services hosted by this deployment.
+  repeated HostedService hosted_services = 5;
+
+  // The authentication method(s) that can be used when talking
+  // to this deployment for internal service-to-service calls.
+  //
+  // An empty list means no service-to-service calls can be made to this deployment.
+  repeated ServiceAuth auth_methods = 6;
+
+  // Observability-related configuration.
+  Observability observability = 7;
+
+  // Service discovery configuration.
+  ServiceDiscovery service_discovery = 8;
+
+  // Graceful shutdown behavior.
+  GracefulShutdown graceful_shutdown = 9;
+}
+
+message Observability {
+  // The observability providers to use.
+  repeated TracingProvider tracing = 1;
+  repeated MetricsProvider metrics = 2;
+  repeated LogsProvider logs = 3;
+}
+
+message HostedService {
+  // The name of the service.
+  string name = 1;
+
+  // Number of worker threads to use.
+  // If unset it defaults to 1. If set to 0 the runtime
+  // automatically determines the number of threads to use
+  // based on the number of CPUs available.
+  optional int32 worker_threads = 2;
+
+  // The log configuration to use for this service.
+  // If unset it defaults to "trace".
+  optional string log_config = 3;
+}
+
+message ServiceAuth {
+  // The auth method to use.
+  oneof auth_method {
+    // Messages start at 10 to allow for other fields on ServiceAuth.
+    NoopAuth noop = 10;
+    EncoreAuth encore_auth = 11;
+  }
+
+  message NoopAuth {}
+  message EncoreAuth {
+    repeated EncoreAuthKey auth_keys = 1;
+  }
+}
+
+message TracingProvider {
+  // The unique resource id for this provider.
+  string rid = 1;
+
+  oneof provider {
+    EncoreTracingProvider encore = 10;
+  }
+
+  message EncoreTracingProvider {
+    string trace_endpoint = 1;
+    // The sampling rate to use for traces, between [0, 1].
+    // If unset it defaults to 1 (meaning all requests are traced).
+    optional double sampling_rate = 2;
+  }
+}
+
+message MetricsProvider {
+  // The unique resource id for this provider.
+  string rid = 1;
+
+  google.protobuf.Duration collection_interval = 2;
+
+  oneof provider {
+    GCPCloudMonitoring encore_cloud = 10;
+    GCPCloudMonitoring gcp = 11;
+    AWSCloudWatch aws = 12;
+    PrometheusRemoteWrite prom_remote_write = 13;
+    Datadog datadog = 14;
+  }
+
+  message GCPCloudMonitoring {
+    // The GCP project id to send metrics to.
+    string project_id = 1;
+
+    // The enum value for the monitored resource this application is monitoring.
+    // See https://cloud.google.com/monitoring/api/resources for valid values.
+    string monitored_resource_type = 2;
+
+    // The labels to specify for the monitored resource.
+    // Each monitored resource type has a pre-defined set of labels that must be set.
+    // See https://cloud.google.com/monitoring/api/resources for expected labels.
+    map<string, string> monitored_resource_labels = 3;
+
+    // The mapping between metric names in Encore and metric names in GCP.
+    map<string, string> metric_names = 4;
+  }
+
+  message AWSCloudWatch {
+    // The namespace to use for metrics.
+    string namespace = 1;
+  }
+
+  message PrometheusRemoteWrite {
+    // The URL to send metrics to.
+    SecretData remote_write_url = 1;
+  }
+
+  message Datadog {
+    string site = 1;
+    SecretData api_key = 2;
+  }
+}
+
+message LogsProvider {
+  // The unique resource id for this provider.
+  string rid = 1;
+
+  // Not yet implemented.
+}
+
+message EncoreAuthKey {
+  uint32 id = 1;
+  SecretData data = 2;
+}
+
+// Describes service discovery configuration.
+message ServiceDiscovery {
+  // Where services are located, keyed by the service name.
+  map<string, Location> services = 1;
+
+  message Location {
+    // The base URL of the service (including scheme and port).
+    string base_url = 1;
+
+    // The auth methods to use when talking to this service.
+    repeated ServiceAuth auth_methods = 2;
+  }
+}
+
+// GracefulShutdown defines the graceful shutdown timings.
+message GracefulShutdown {
+  // Total is how long we allow the total shutdown to take
+  // before the process forcibly exits.
+  google.protobuf.Duration total = 1;
+
+  // ShutdownHooks is how long before [total] runs out that we cancel
+  // the context that is passed to the shutdown hooks.
+  //
+  // It is expected that ShutdownHooks is a larger value than Handlers.
+  google.protobuf.Duration shutdown_hooks = 2;
+
+  // Handlers is how long before [total] runs out that we cancel
+  // the context that is passed to API and PubSub Subscription handlers.
+  //
+  // For example, if [total] is 10 seconds and [handlers] is 2 seconds,
+  // then we will cancel the context passed to handlers 8 seconds after
+  // a graceful shutdown is initiated.
+  google.protobuf.Duration handlers = 3;
+}
+
+message EncorePlatform {
+  // Auth keys for validating signed requests from the Encore Platform.
+  repeated EncoreAuthKey platform_signing_keys = 1;
+
+  // The Encore Cloud configuration to use, if running in Encore Cloud.
+  optional EncoreCloudProvider encore_cloud = 2;
+}
+
+message RateLimiter {
+  oneof kind {
+    TokenBucket token_bucket = 1;
+  }
+
+  message TokenBucket {
+    // The rate (in events per per second) to allow.
+    double rate = 1;
+    // The burst size to allow.
+    uint32 burst = 2;
+  }
+}
+
+message EncoreCloudProvider {
+  // The unique resource id for this provider.
+  string rid = 1;
+
+  // URL to use to authenticate with the server.
+  string server_url = 2;
+
+  repeated EncoreAuthKey auth_keys = 3;
+}
diff --git a/proto/encore/runtime/v1/secretdata.pb.go b/proto/encore/runtime/v1/secretdata.pb.go
new file mode 100644
index 0000000000..a847beccb4
--- /dev/null
+++ b/proto/encore/runtime/v1/secretdata.pb.go
@@ -0,0 +1,307 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.31.0
+// 	protoc        v4.23.4
+// source: encore/runtime/v1/secretdata.proto
+
+package runtimev1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type SecretData_Encoding int32
+
+const (
+	// Indicates the value is used as-is.
+	SecretData_ENCODING_NONE SecretData_Encoding = 0
+	// Indicates the value is base64-encoded.
+	SecretData_ENCODING_BASE64 SecretData_Encoding = 1
+)
+
+// Enum value maps for SecretData_Encoding.
+var (
+	SecretData_Encoding_name = map[int32]string{
+		0: "ENCODING_NONE",
+		1: "ENCODING_BASE64",
+	}
+	SecretData_Encoding_value = map[string]int32{
+		"ENCODING_NONE":   0,
+		"ENCODING_BASE64": 1,
+	}
+)
+
+func (x SecretData_Encoding) Enum() *SecretData_Encoding {
+	p := new(SecretData_Encoding)
+	*p = x
+	return p
+}
+
+func (x SecretData_Encoding) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (SecretData_Encoding) Descriptor() protoreflect.EnumDescriptor {
+	return file_encore_runtime_v1_secretdata_proto_enumTypes[0].Descriptor()
+}
+
+func (SecretData_Encoding) Type() protoreflect.EnumType {
+	return &file_encore_runtime_v1_secretdata_proto_enumTypes[0]
+}
+
+func (x SecretData_Encoding) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use SecretData_Encoding.Descriptor instead.
+func (SecretData_Encoding) EnumDescriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_secretdata_proto_rawDescGZIP(), []int{0, 0}
+}
+
+// Defines how to resolve a secret value.
+type SecretData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// How to resolve the initial secret value.
+	// The output of this step is always a byte slice.
+	//
+	// Types that are assignable to Source:
+	//
+	//	*SecretData_Embedded
+	//	*SecretData_Env
+	Source isSecretData_Source `protobuf_oneof:"source"`
+	// How the value is encoded.
+	Encoding SecretData_Encoding `protobuf:"varint,20,opt,name=encoding,proto3,enum=encore.runtime.v1.SecretData_Encoding" json:"encoding,omitempty"`
+	// sub_path is an optional path to a sub-value within the secret data.
+	//
+	// Types that are assignable to SubPath:
+	//
+	//	*SecretData_JsonKey
+	SubPath isSecretData_SubPath `protobuf_oneof:"sub_path"`
+}
+
+func (x *SecretData) Reset() {
+	*x = SecretData{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_encore_runtime_v1_secretdata_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *SecretData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SecretData) ProtoMessage() {}
+
+func (x *SecretData) ProtoReflect() protoreflect.Message {
+	mi := &file_encore_runtime_v1_secretdata_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SecretData.ProtoReflect.Descriptor instead.
+func (*SecretData) Descriptor() ([]byte, []int) {
+	return file_encore_runtime_v1_secretdata_proto_rawDescGZIP(), []int{0}
+}
+
+func (m *SecretData) GetSource() isSecretData_Source {
+	if m != nil {
+		return m.Source
+	}
+	return nil
+}
+
+func (x *SecretData) GetEmbedded() []byte {
+	if x, ok := x.GetSource().(*SecretData_Embedded); ok {
+		return x.Embedded
+	}
+	return nil
+}
+
+func (x *SecretData) GetEnv() string {
+	if x, ok := x.GetSource().(*SecretData_Env); ok {
+		return x.Env
+	}
+	return ""
+}
+
+func (x *SecretData) GetEncoding() SecretData_Encoding {
+	if x != nil {
+		return x.Encoding
+	}
+	return SecretData_ENCODING_NONE
+}
+
+func (m *SecretData) GetSubPath() isSecretData_SubPath {
+	if m != nil {
+		return m.SubPath
+	}
+	return nil
+}
+
+func (x *SecretData) GetJsonKey() string {
+	if x, ok := x.GetSubPath().(*SecretData_JsonKey); ok {
+		return x.JsonKey
+	}
+	return ""
+}
+
+type isSecretData_Source interface {
+	isSecretData_Source()
+}
+
+type SecretData_Embedded struct {
+	// The secret data is embedded directly in the configuration.
+	// This is insecure unless `encrypted` is true, and should only
+	// be used for local development.
+	Embedded []byte `protobuf:"bytes,1,opt,name=embedded,proto3,oneof"`
+}
+
+type SecretData_Env struct {
+	// Look up the secret data in an env variable with the given name.
+	// Assumes the
+	Env string `protobuf:"bytes,2,opt,name=env,proto3,oneof"`
+}
+
+func (*SecretData_Embedded) isSecretData_Source() {}
+
+func (*SecretData_Env) isSecretData_Source() {}
+
+type isSecretData_SubPath interface {
+	isSecretData_SubPath()
+}
+
+type SecretData_JsonKey struct {
+	// json_key indicates the secret data is a JSON map,
+	// and the resolved secret value is a key in that map.
+	//
+	// The value is encoded differently based on its type.
+	// Supported types are utf-8 strings and raw bytes:
+	// - For strings, the value is the string itself, e.g. "foo".
+	// - For raw bytes, the value is a JSON object with a single key "bytes" and the value is the base64-encoded bytes.
+	//
+	// For example: '{"foo": "string-value", "bar": {"bytes": "aGVsbG8="}}'.
+	JsonKey string `protobuf:"bytes,10,opt,name=json_key,json=jsonKey,proto3,oneof"`
+}
+
+func (*SecretData_JsonKey) isSecretData_SubPath() {}
+
+var File_encore_runtime_v1_secretdata_proto protoreflect.FileDescriptor
+
+var file_encore_runtime_v1_secretdata_proto_rawDesc = []byte{
+	0x0a, 0x22, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2f, 0x76, 0x31, 0x2f, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x12, 0x11, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e,
+	0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x22, 0xf5, 0x01, 0x0a, 0x0a, 0x53, 0x65, 0x63, 0x72,
+	0x65, 0x74, 0x44, 0x61, 0x74, 0x61, 0x12, 0x1c, 0x0a, 0x08, 0x65, 0x6d, 0x62, 0x65, 0x64, 0x64,
+	0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x48, 0x00, 0x52, 0x08, 0x65, 0x6d, 0x62, 0x65,
+	0x64, 0x64, 0x65, 0x64, 0x12, 0x12, 0x0a, 0x03, 0x65, 0x6e, 0x76, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x48, 0x00, 0x52, 0x03, 0x65, 0x6e, 0x76, 0x12, 0x42, 0x0a, 0x08, 0x65, 0x6e, 0x63, 0x6f,
+	0x64, 0x69, 0x6e, 0x67, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x26, 0x2e, 0x65, 0x6e, 0x63,
+	0x6f, 0x72, 0x65, 0x2e, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2e, 0x76, 0x31, 0x2e, 0x53,
+	0x65, 0x63, 0x72, 0x65, 0x74, 0x44, 0x61, 0x74, 0x61, 0x2e, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x69,
+	0x6e, 0x67, 0x52, 0x08, 0x65, 0x6e, 0x63, 0x6f, 0x64, 0x69, 0x6e, 0x67, 0x12, 0x1b, 0x0a, 0x08,
+	0x6a, 0x73, 0x6f, 0x6e, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01,
+	0x52, 0x07, 0x6a, 0x73, 0x6f, 0x6e, 0x4b, 0x65, 0x79, 0x22, 0x32, 0x0a, 0x08, 0x45, 0x6e, 0x63,
+	0x6f, 0x64, 0x69, 0x6e, 0x67, 0x12, 0x11, 0x0a, 0x0d, 0x45, 0x4e, 0x43, 0x4f, 0x44, 0x49, 0x4e,
+	0x47, 0x5f, 0x4e, 0x4f, 0x4e, 0x45, 0x10, 0x00, 0x12, 0x13, 0x0a, 0x0f, 0x45, 0x4e, 0x43, 0x4f,
+	0x44, 0x49, 0x4e, 0x47, 0x5f, 0x42, 0x41, 0x53, 0x45, 0x36, 0x34, 0x10, 0x01, 0x42, 0x08, 0x0a,
+	0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x42, 0x0a, 0x0a, 0x08, 0x73, 0x75, 0x62, 0x5f, 0x70,
+	0x61, 0x74, 0x68, 0x4a, 0x04, 0x08, 0x03, 0x10, 0x0a, 0x4a, 0x04, 0x08, 0x0c, 0x10, 0x14, 0x42,
+	0x2c, 0x5a, 0x2a, 0x65, 0x6e, 0x63, 0x72, 0x2e, 0x64, 0x65, 0x76, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65,
+	0x2f, 0x76, 0x31, 0x3b, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x76, 0x31, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_encore_runtime_v1_secretdata_proto_rawDescOnce sync.Once
+	file_encore_runtime_v1_secretdata_proto_rawDescData = file_encore_runtime_v1_secretdata_proto_rawDesc
+)
+
+func file_encore_runtime_v1_secretdata_proto_rawDescGZIP() []byte {
+	file_encore_runtime_v1_secretdata_proto_rawDescOnce.Do(func() {
+		file_encore_runtime_v1_secretdata_proto_rawDescData = protoimpl.X.CompressGZIP(file_encore_runtime_v1_secretdata_proto_rawDescData)
+	})
+	return file_encore_runtime_v1_secretdata_proto_rawDescData
+}
+
+var file_encore_runtime_v1_secretdata_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_encore_runtime_v1_secretdata_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_encore_runtime_v1_secretdata_proto_goTypes = []interface{}{
+	(SecretData_Encoding)(0), // 0: encore.runtime.v1.SecretData.Encoding
+	(*SecretData)(nil),       // 1: encore.runtime.v1.SecretData
+}
+var file_encore_runtime_v1_secretdata_proto_depIdxs = []int32{
+	0, // 0: encore.runtime.v1.SecretData.encoding:type_name -> encore.runtime.v1.SecretData.Encoding
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_encore_runtime_v1_secretdata_proto_init() }
+func file_encore_runtime_v1_secretdata_proto_init() {
+	if File_encore_runtime_v1_secretdata_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_encore_runtime_v1_secretdata_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*SecretData); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_encore_runtime_v1_secretdata_proto_msgTypes[0].OneofWrappers = []interface{}{
+		(*SecretData_Embedded)(nil),
+		(*SecretData_Env)(nil),
+		(*SecretData_JsonKey)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_encore_runtime_v1_secretdata_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_encore_runtime_v1_secretdata_proto_goTypes,
+		DependencyIndexes: file_encore_runtime_v1_secretdata_proto_depIdxs,
+		EnumInfos:         file_encore_runtime_v1_secretdata_proto_enumTypes,
+		MessageInfos:      file_encore_runtime_v1_secretdata_proto_msgTypes,
+	}.Build()
+	File_encore_runtime_v1_secretdata_proto = out.File
+	file_encore_runtime_v1_secretdata_proto_rawDesc = nil
+	file_encore_runtime_v1_secretdata_proto_goTypes = nil
+	file_encore_runtime_v1_secretdata_proto_depIdxs = nil
+}
diff --git a/proto/encore/runtime/v1/secretdata.proto b/proto/encore/runtime/v1/secretdata.proto
new file mode 100644
index 0000000000..1b3bac8fa6
--- /dev/null
+++ b/proto/encore/runtime/v1/secretdata.proto
@@ -0,0 +1,48 @@
+syntax = "proto3";
+package encore.runtime.v1;
+
+option go_package = "encr.dev/proto/encore/runtime/v1;runtimev1";
+
+// Defines how to resolve a secret value.
+message SecretData {
+  // How to resolve the initial secret value.
+  // The output of this step is always a byte slice.
+  oneof source {
+    // The secret data is embedded directly in the configuration.
+    // This is insecure unless `encrypted` is true, and should only
+    // be used for local development.
+    bytes embedded = 1;
+
+    // Look up the secret data in an env variable with the given name.
+    // Assumes the
+    string env = 2;
+  }
+  reserved 3 to 9; // for future sources
+
+  // How the value is encoded.
+  Encoding encoding = 20;
+
+  // sub_path is an optional path to a sub-value within the secret data.
+  oneof sub_path {
+    // json_key indicates the secret data is a JSON map,
+    // and the resolved secret value is a key in that map.
+    //
+    // The value is encoded differently based on its type.
+    // Supported types are utf-8 strings and raw bytes:
+    // - For strings, the value is the string itself, e.g. "foo".
+    // - For raw bytes, the value is a JSON object with a single key "bytes" and the value is the base64-encoded bytes.
+    //
+    // For example: '{"foo": "string-value", "bar": {"bytes": "aGVsbG8="}}'.
+    string json_key = 10;
+
+    // null: the raw secret data is the resolved value.
+  }
+  reserved 12 to 19; // for future sub_paths
+
+  enum Encoding {
+    // Indicates the value is used as-is.
+    ENCODING_NONE = 0;
+    // Indicates the value is base64-encoded.
+    ENCODING_BASE64      = 1;
+  }
+}
diff --git a/proto/encore/server/remote/remote.pb.go b/proto/encore/server/remote/remote.pb.go
deleted file mode 100644
index 14e2e8bb2e..0000000000
--- a/proto/encore/server/remote/remote.pb.go
+++ /dev/null
@@ -1,1172 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.14.0
-// source: encore/server/remote/remote.proto
-
-package remote
-
-import (
-	v1 "encr.dev/proto/encore/parser/meta/v1"
-	tunnel "encr.dev/proto/encore/server/remote/tunnel"
-	proto "github.com/golang/protobuf/proto"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
-type SetSecretRequest_Type int32
-
-const (
-	SetSecretRequest_DEVELOPMENT SetSecretRequest_Type = 0
-	SetSecretRequest_PRODUCTION  SetSecretRequest_Type = 1
-)
-
-// Enum value maps for SetSecretRequest_Type.
-var (
-	SetSecretRequest_Type_name = map[int32]string{
-		0: "DEVELOPMENT",
-		1: "PRODUCTION",
-	}
-	SetSecretRequest_Type_value = map[string]int32{
-		"DEVELOPMENT": 0,
-		"PRODUCTION":  1,
-	}
-)
-
-func (x SetSecretRequest_Type) Enum() *SetSecretRequest_Type {
-	p := new(SetSecretRequest_Type)
-	*p = x
-	return p
-}
-
-func (x SetSecretRequest_Type) String() string {
-	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
-}
-
-func (SetSecretRequest_Type) Descriptor() protoreflect.EnumDescriptor {
-	return file_encore_server_remote_remote_proto_enumTypes[0].Descriptor()
-}
-
-func (SetSecretRequest_Type) Type() protoreflect.EnumType {
-	return &file_encore_server_remote_remote_proto_enumTypes[0]
-}
-
-func (x SetSecretRequest_Type) Number() protoreflect.EnumNumber {
-	return protoreflect.EnumNumber(x)
-}
-
-// Deprecated: Use SetSecretRequest_Type.Descriptor instead.
-func (SetSecretRequest_Type) EnumDescriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{8, 0}
-}
-
-type TunnelClientMsg struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Types that are assignable to Msg:
-	//	*TunnelClientMsg_Setup
-	//	*TunnelClientMsg_Rpc
-	Msg isTunnelClientMsg_Msg `protobuf_oneof:"msg"`
-}
-
-func (x *TunnelClientMsg) Reset() {
-	*x = TunnelClientMsg{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *TunnelClientMsg) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*TunnelClientMsg) ProtoMessage() {}
-
-func (x *TunnelClientMsg) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use TunnelClientMsg.ProtoReflect.Descriptor instead.
-func (*TunnelClientMsg) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{0}
-}
-
-func (m *TunnelClientMsg) GetMsg() isTunnelClientMsg_Msg {
-	if m != nil {
-		return m.Msg
-	}
-	return nil
-}
-
-func (x *TunnelClientMsg) GetSetup() *tunnel.SetupReq {
-	if x, ok := x.GetMsg().(*TunnelClientMsg_Setup); ok {
-		return x.Setup
-	}
-	return nil
-}
-
-func (x *TunnelClientMsg) GetRpc() *tunnel.RPCResp {
-	if x, ok := x.GetMsg().(*TunnelClientMsg_Rpc); ok {
-		return x.Rpc
-	}
-	return nil
-}
-
-type isTunnelClientMsg_Msg interface {
-	isTunnelClientMsg_Msg()
-}
-
-type TunnelClientMsg_Setup struct {
-	Setup *tunnel.SetupReq `protobuf:"bytes,1,opt,name=setup,proto3,oneof"`
-}
-
-type TunnelClientMsg_Rpc struct {
-	Rpc *tunnel.RPCResp `protobuf:"bytes,2,opt,name=rpc,proto3,oneof"`
-}
-
-func (*TunnelClientMsg_Setup) isTunnelClientMsg_Msg() {}
-
-func (*TunnelClientMsg_Rpc) isTunnelClientMsg_Msg() {}
-
-type TunnelServerMsg struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	// Types that are assignable to Msg:
-	//	*TunnelServerMsg_Setup
-	//	*TunnelServerMsg_Rpc
-	Msg isTunnelServerMsg_Msg `protobuf_oneof:"msg"`
-}
-
-func (x *TunnelServerMsg) Reset() {
-	*x = TunnelServerMsg{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *TunnelServerMsg) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*TunnelServerMsg) ProtoMessage() {}
-
-func (x *TunnelServerMsg) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use TunnelServerMsg.ProtoReflect.Descriptor instead.
-func (*TunnelServerMsg) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{1}
-}
-
-func (m *TunnelServerMsg) GetMsg() isTunnelServerMsg_Msg {
-	if m != nil {
-		return m.Msg
-	}
-	return nil
-}
-
-func (x *TunnelServerMsg) GetSetup() *tunnel.SetupResp {
-	if x, ok := x.GetMsg().(*TunnelServerMsg_Setup); ok {
-		return x.Setup
-	}
-	return nil
-}
-
-func (x *TunnelServerMsg) GetRpc() *tunnel.RPCReq {
-	if x, ok := x.GetMsg().(*TunnelServerMsg_Rpc); ok {
-		return x.Rpc
-	}
-	return nil
-}
-
-type isTunnelServerMsg_Msg interface {
-	isTunnelServerMsg_Msg()
-}
-
-type TunnelServerMsg_Setup struct {
-	Setup *tunnel.SetupResp `protobuf:"bytes,1,opt,name=setup,proto3,oneof"`
-}
-
-type TunnelServerMsg_Rpc struct {
-	Rpc *tunnel.RPCReq `protobuf:"bytes,2,opt,name=rpc,proto3,oneof"`
-}
-
-func (*TunnelServerMsg_Setup) isTunnelServerMsg_Msg() {}
-
-func (*TunnelServerMsg_Rpc) isTunnelServerMsg_Msg() {}
-
-type RecordTraceRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
-}
-
-func (x *RecordTraceRequest) Reset() {
-	*x = RecordTraceRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *RecordTraceRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*RecordTraceRequest) ProtoMessage() {}
-
-func (x *RecordTraceRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use RecordTraceRequest.ProtoReflect.Descriptor instead.
-func (*RecordTraceRequest) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *RecordTraceRequest) GetData() []byte {
-	if x != nil {
-		return x.Data
-	}
-	return nil
-}
-
-type RecordTraceResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-}
-
-func (x *RecordTraceResponse) Reset() {
-	*x = RecordTraceResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *RecordTraceResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*RecordTraceResponse) ProtoMessage() {}
-
-func (x *RecordTraceResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use RecordTraceResponse.ProtoReflect.Descriptor instead.
-func (*RecordTraceResponse) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{3}
-}
-
-type MetaRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	AppSlug string `protobuf:"bytes,1,opt,name=app_slug,json=appSlug,proto3" json:"app_slug,omitempty"`
-	EnvName string `protobuf:"bytes,2,opt,name=env_name,json=envName,proto3" json:"env_name,omitempty"`
-}
-
-func (x *MetaRequest) Reset() {
-	*x = MetaRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[4]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *MetaRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*MetaRequest) ProtoMessage() {}
-
-func (x *MetaRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[4]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use MetaRequest.ProtoReflect.Descriptor instead.
-func (*MetaRequest) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{4}
-}
-
-func (x *MetaRequest) GetAppSlug() string {
-	if x != nil {
-		return x.AppSlug
-	}
-	return ""
-}
-
-func (x *MetaRequest) GetEnvName() string {
-	if x != nil {
-		return x.EnvName
-	}
-	return ""
-}
-
-type GetSecretsRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	AppSlug string `protobuf:"bytes,1,opt,name=app_slug,json=appSlug,proto3" json:"app_slug,omitempty"`
-}
-
-func (x *GetSecretsRequest) Reset() {
-	*x = GetSecretsRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[5]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *GetSecretsRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetSecretsRequest) ProtoMessage() {}
-
-func (x *GetSecretsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[5]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetSecretsRequest.ProtoReflect.Descriptor instead.
-func (*GetSecretsRequest) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{5}
-}
-
-func (x *GetSecretsRequest) GetAppSlug() string {
-	if x != nil {
-		return x.AppSlug
-	}
-	return ""
-}
-
-type GetSecretsResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Secrets []*Secret `protobuf:"bytes,1,rep,name=secrets,proto3" json:"secrets,omitempty"`
-}
-
-func (x *GetSecretsResponse) Reset() {
-	*x = GetSecretsResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[6]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *GetSecretsResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*GetSecretsResponse) ProtoMessage() {}
-
-func (x *GetSecretsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[6]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use GetSecretsResponse.ProtoReflect.Descriptor instead.
-func (*GetSecretsResponse) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{6}
-}
-
-func (x *GetSecretsResponse) GetSecrets() []*Secret {
-	if x != nil {
-		return x.Secrets
-	}
-	return nil
-}
-
-type Secret struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Key   string `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
-	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
-}
-
-func (x *Secret) Reset() {
-	*x = Secret{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[7]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *Secret) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Secret) ProtoMessage() {}
-
-func (x *Secret) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[7]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Secret.ProtoReflect.Descriptor instead.
-func (*Secret) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{7}
-}
-
-func (x *Secret) GetKey() string {
-	if x != nil {
-		return x.Key
-	}
-	return ""
-}
-
-func (x *Secret) GetValue() string {
-	if x != nil {
-		return x.Value
-	}
-	return ""
-}
-
-type SetSecretRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	AppSlug string                `protobuf:"bytes,1,opt,name=app_slug,json=appSlug,proto3" json:"app_slug,omitempty"`
-	Key     string                `protobuf:"bytes,2,opt,name=key,proto3" json:"key,omitempty"`
-	Value   string                `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"`
-	Type    SetSecretRequest_Type `protobuf:"varint,4,opt,name=type,proto3,enum=encore.server.remote.SetSecretRequest_Type" json:"type,omitempty"`
-}
-
-func (x *SetSecretRequest) Reset() {
-	*x = SetSecretRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[8]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *SetSecretRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*SetSecretRequest) ProtoMessage() {}
-
-func (x *SetSecretRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[8]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use SetSecretRequest.ProtoReflect.Descriptor instead.
-func (*SetSecretRequest) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{8}
-}
-
-func (x *SetSecretRequest) GetAppSlug() string {
-	if x != nil {
-		return x.AppSlug
-	}
-	return ""
-}
-
-func (x *SetSecretRequest) GetKey() string {
-	if x != nil {
-		return x.Key
-	}
-	return ""
-}
-
-func (x *SetSecretRequest) GetValue() string {
-	if x != nil {
-		return x.Value
-	}
-	return ""
-}
-
-func (x *SetSecretRequest) GetType() SetSecretRequest_Type {
-	if x != nil {
-		return x.Type
-	}
-	return SetSecretRequest_DEVELOPMENT
-}
-
-type SetSecretResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Created bool `protobuf:"varint,1,opt,name=created,proto3" json:"created,omitempty"` // whether or not the secret was created (as opposed to updated)
-}
-
-func (x *SetSecretResponse) Reset() {
-	*x = SetSecretResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[9]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *SetSecretResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*SetSecretResponse) ProtoMessage() {}
-
-func (x *SetSecretResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[9]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use SetSecretResponse.ProtoReflect.Descriptor instead.
-func (*SetSecretResponse) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{9}
-}
-
-func (x *SetSecretResponse) GetCreated() bool {
-	if x != nil {
-		return x.Created
-	}
-	return false
-}
-
-type Data struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Data []byte `protobuf:"bytes,1,opt,name=data,proto3" json:"data,omitempty"`
-}
-
-func (x *Data) Reset() {
-	*x = Data{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[10]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *Data) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*Data) ProtoMessage() {}
-
-func (x *Data) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[10]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use Data.ProtoReflect.Descriptor instead.
-func (*Data) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{10}
-}
-
-func (x *Data) GetData() []byte {
-	if x != nil {
-		return x.Data
-	}
-	return nil
-}
-
-type LogsRequest struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	AppSlug string `protobuf:"bytes,1,opt,name=app_slug,json=appSlug,proto3" json:"app_slug,omitempty"`
-	EnvName string `protobuf:"bytes,2,opt,name=env_name,json=envName,proto3" json:"env_name,omitempty"`
-}
-
-func (x *LogsRequest) Reset() {
-	*x = LogsRequest{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[11]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *LogsRequest) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*LogsRequest) ProtoMessage() {}
-
-func (x *LogsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[11]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use LogsRequest.ProtoReflect.Descriptor instead.
-func (*LogsRequest) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{11}
-}
-
-func (x *LogsRequest) GetAppSlug() string {
-	if x != nil {
-		return x.AppSlug
-	}
-	return ""
-}
-
-func (x *LogsRequest) GetEnvName() string {
-	if x != nil {
-		return x.EnvName
-	}
-	return ""
-}
-
-type LogsResponse struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	Lines      [][]byte `protobuf:"bytes,1,rep,name=lines,proto3" json:"lines,omitempty"`
-	DropNotice bool     `protobuf:"varint,2,opt,name=drop_notice,json=dropNotice,proto3" json:"drop_notice,omitempty"`
-}
-
-func (x *LogsResponse) Reset() {
-	*x = LogsResponse{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_remote_proto_msgTypes[12]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *LogsResponse) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*LogsResponse) ProtoMessage() {}
-
-func (x *LogsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_remote_proto_msgTypes[12]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use LogsResponse.ProtoReflect.Descriptor instead.
-func (*LogsResponse) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_remote_proto_rawDescGZIP(), []int{12}
-}
-
-func (x *LogsResponse) GetLines() [][]byte {
-	if x != nil {
-		return x.Lines
-	}
-	return nil
-}
-
-func (x *LogsResponse) GetDropNotice() bool {
-	if x != nil {
-		return x.DropNotice
-	}
-	return false
-}
-
-var File_encore_server_remote_remote_proto protoreflect.FileDescriptor
-
-var file_encore_server_remote_remote_proto_rawDesc = []byte{
-	0x0a, 0x21, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2f,
-	0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2f, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x12, 0x14, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x1a, 0x20, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2f, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2f, 0x6d, 0x65, 0x74, 0x61, 0x2f, 0x76, 0x31,
-	0x2f, 0x6d, 0x65, 0x74, 0x61, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x28, 0x65, 0x6e, 0x63,
-	0x6f, 0x72, 0x65, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2f, 0x72, 0x65, 0x6d, 0x6f, 0x74,
-	0x65, 0x2f, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x2f, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x91, 0x01, 0x0a, 0x0f, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c,
-	0x43, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x4d, 0x73, 0x67, 0x12, 0x3d, 0x0a, 0x05, 0x73, 0x65, 0x74,
-	0x75, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e,
-	0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x2e, 0x53, 0x65, 0x74, 0x75, 0x70, 0x52, 0x65, 0x71, 0x48,
-	0x00, 0x52, 0x05, 0x73, 0x65, 0x74, 0x75, 0x70, 0x12, 0x38, 0x0a, 0x03, 0x72, 0x70, 0x63, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x74, 0x75, 0x6e,
-	0x6e, 0x65, 0x6c, 0x2e, 0x52, 0x50, 0x43, 0x52, 0x65, 0x73, 0x70, 0x48, 0x00, 0x52, 0x03, 0x72,
-	0x70, 0x63, 0x42, 0x05, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0x91, 0x01, 0x0a, 0x0f, 0x54, 0x75,
-	0x6e, 0x6e, 0x65, 0x6c, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4d, 0x73, 0x67, 0x12, 0x3e, 0x0a,
-	0x05, 0x73, 0x65, 0x74, 0x75, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26, 0x2e, 0x65,
-	0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d,
-	0x6f, 0x74, 0x65, 0x2e, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x2e, 0x53, 0x65, 0x74, 0x75, 0x70,
-	0x52, 0x65, 0x73, 0x70, 0x48, 0x00, 0x52, 0x05, 0x73, 0x65, 0x74, 0x75, 0x70, 0x12, 0x37, 0x0a,
-	0x03, 0x72, 0x70, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x65, 0x6e, 0x63,
-	0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74,
-	0x65, 0x2e, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x2e, 0x52, 0x50, 0x43, 0x52, 0x65, 0x71, 0x48,
-	0x00, 0x52, 0x03, 0x72, 0x70, 0x63, 0x42, 0x05, 0x0a, 0x03, 0x6d, 0x73, 0x67, 0x22, 0x28, 0x0a,
-	0x12, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75,
-	0x65, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0x15, 0x0a, 0x13, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x43,
-	0x0a, 0x0b, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a,
-	0x08, 0x61, 0x70, 0x70, 0x5f, 0x73, 0x6c, 0x75, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x61, 0x70, 0x70, 0x53, 0x6c, 0x75, 0x67, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e, 0x76, 0x5f,
-	0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x65, 0x6e, 0x76, 0x4e,
-	0x61, 0x6d, 0x65, 0x22, 0x2e, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74,
-	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f,
-	0x73, 0x6c, 0x75, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x53,
-	0x6c, 0x75, 0x67, 0x22, 0x4c, 0x0a, 0x12, 0x47, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x36, 0x0a, 0x07, 0x73, 0x65, 0x63,
-	0x72, 0x65, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1c, 0x2e, 0x65, 0x6e, 0x63,
-	0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74,
-	0x65, 0x2e, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x07, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74,
-	0x73, 0x22, 0x30, 0x0a, 0x06, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b,
-	0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a,
-	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x22, 0xbf, 0x01, 0x0a, 0x10, 0x53, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65,
-	0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f,
-	0x73, 0x6c, 0x75, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x53,
-	0x6c, 0x75, 0x67, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x3f, 0x0a, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x2b, 0x2e, 0x65, 0x6e, 0x63, 0x6f,
-	0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65,
-	0x2e, 0x53, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x27, 0x0a, 0x04,
-	0x54, 0x79, 0x70, 0x65, 0x12, 0x0f, 0x0a, 0x0b, 0x44, 0x45, 0x56, 0x45, 0x4c, 0x4f, 0x50, 0x4d,
-	0x45, 0x4e, 0x54, 0x10, 0x00, 0x12, 0x0e, 0x0a, 0x0a, 0x50, 0x52, 0x4f, 0x44, 0x55, 0x43, 0x54,
-	0x49, 0x4f, 0x4e, 0x10, 0x01, 0x22, 0x2d, 0x0a, 0x11, 0x53, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72,
-	0x65, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x63, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x64, 0x22, 0x1a, 0x0a, 0x04, 0x44, 0x61, 0x74, 0x61, 0x12, 0x12, 0x0a, 0x04,
-	0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61,
-	0x22, 0x43, 0x0a, 0x0b, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x73, 0x6c, 0x75, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x53, 0x6c, 0x75, 0x67, 0x12, 0x19, 0x0a, 0x08, 0x65, 0x6e,
-	0x76, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x65, 0x6e,
-	0x76, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x45, 0x0a, 0x0c, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x65, 0x73,
-	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x69, 0x6e, 0x65, 0x73, 0x18, 0x01,
-	0x20, 0x03, 0x28, 0x0c, 0x52, 0x05, 0x6c, 0x69, 0x6e, 0x65, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x64,
-	0x72, 0x6f, 0x70, 0x5f, 0x6e, 0x6f, 0x74, 0x69, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x08,
-	0x52, 0x0a, 0x64, 0x72, 0x6f, 0x70, 0x4e, 0x6f, 0x74, 0x69, 0x63, 0x65, 0x32, 0xe9, 0x04, 0x0a,
-	0x06, 0x52, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x12, 0x5a, 0x0a, 0x06, 0x54, 0x75, 0x6e, 0x6e, 0x65,
-	0x6c, 0x12, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65,
-	0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x43,
-	0x6c, 0x69, 0x65, 0x6e, 0x74, 0x4d, 0x73, 0x67, 0x1a, 0x25, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e,
-	0x54, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x4d, 0x73, 0x67, 0x28,
-	0x01, 0x30, 0x01, 0x12, 0x46, 0x0a, 0x04, 0x4d, 0x65, 0x74, 0x61, 0x12, 0x21, 0x2e, 0x65, 0x6e,
-	0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f,
-	0x74, 0x65, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b,
-	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x70, 0x61, 0x72, 0x73, 0x65, 0x72, 0x2e, 0x6d,
-	0x65, 0x74, 0x61, 0x2e, 0x76, 0x31, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x12, 0x47, 0x0a, 0x09, 0x44,
-	0x42, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x12, 0x1a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e,
-	0x44, 0x61, 0x74, 0x61, 0x1a, 0x1a, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x44, 0x61, 0x74, 0x61,
-	0x28, 0x01, 0x30, 0x01, 0x12, 0x62, 0x0a, 0x0b, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x72,
-	0x61, 0x63, 0x65, 0x12, 0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x54, 0x72, 0x61, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e,
-	0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65,
-	0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x72, 0x61, 0x63, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5f, 0x0a, 0x0a, 0x47, 0x65, 0x74, 0x53,
-	0x65, 0x63, 0x72, 0x65, 0x74, 0x73, 0x12, 0x27, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x47, 0x65,
-	0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
-	0x28, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e,
-	0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x47, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74,
-	0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x5c, 0x0a, 0x09, 0x53, 0x65, 0x74,
-	0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x26, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x53, 0x65,
-	0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27,
-	0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72,
-	0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x53, 0x65, 0x74, 0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x04, 0x4c, 0x6f, 0x67, 0x73, 0x12,
-	0x21, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e,
-	0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x22, 0x2e, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x4c, 0x6f, 0x67, 0x73, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x30, 0x01, 0x42, 0x25, 0x5a, 0x23, 0x65, 0x6e, 0x63, 0x72,
-	0x2e, 0x64, 0x65, 0x76, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72,
-	0x65, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2f, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x62,
-	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
-
-var (
-	file_encore_server_remote_remote_proto_rawDescOnce sync.Once
-	file_encore_server_remote_remote_proto_rawDescData = file_encore_server_remote_remote_proto_rawDesc
-)
-
-func file_encore_server_remote_remote_proto_rawDescGZIP() []byte {
-	file_encore_server_remote_remote_proto_rawDescOnce.Do(func() {
-		file_encore_server_remote_remote_proto_rawDescData = protoimpl.X.CompressGZIP(file_encore_server_remote_remote_proto_rawDescData)
-	})
-	return file_encore_server_remote_remote_proto_rawDescData
-}
-
-var file_encore_server_remote_remote_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_encore_server_remote_remote_proto_msgTypes = make([]protoimpl.MessageInfo, 13)
-var file_encore_server_remote_remote_proto_goTypes = []interface{}{
-	(SetSecretRequest_Type)(0),  // 0: encore.server.remote.SetSecretRequest.Type
-	(*TunnelClientMsg)(nil),     // 1: encore.server.remote.TunnelClientMsg
-	(*TunnelServerMsg)(nil),     // 2: encore.server.remote.TunnelServerMsg
-	(*RecordTraceRequest)(nil),  // 3: encore.server.remote.RecordTraceRequest
-	(*RecordTraceResponse)(nil), // 4: encore.server.remote.RecordTraceResponse
-	(*MetaRequest)(nil),         // 5: encore.server.remote.MetaRequest
-	(*GetSecretsRequest)(nil),   // 6: encore.server.remote.GetSecretsRequest
-	(*GetSecretsResponse)(nil),  // 7: encore.server.remote.GetSecretsResponse
-	(*Secret)(nil),              // 8: encore.server.remote.Secret
-	(*SetSecretRequest)(nil),    // 9: encore.server.remote.SetSecretRequest
-	(*SetSecretResponse)(nil),   // 10: encore.server.remote.SetSecretResponse
-	(*Data)(nil),                // 11: encore.server.remote.Data
-	(*LogsRequest)(nil),         // 12: encore.server.remote.LogsRequest
-	(*LogsResponse)(nil),        // 13: encore.server.remote.LogsResponse
-	(*tunnel.SetupReq)(nil),     // 14: encore.server.remote.tunnel.SetupReq
-	(*tunnel.RPCResp)(nil),      // 15: encore.server.remote.tunnel.RPCResp
-	(*tunnel.SetupResp)(nil),    // 16: encore.server.remote.tunnel.SetupResp
-	(*tunnel.RPCReq)(nil),       // 17: encore.server.remote.tunnel.RPCReq
-	(*v1.Data)(nil),             // 18: encore.parser.meta.v1.Data
-}
-var file_encore_server_remote_remote_proto_depIdxs = []int32{
-	14, // 0: encore.server.remote.TunnelClientMsg.setup:type_name -> encore.server.remote.tunnel.SetupReq
-	15, // 1: encore.server.remote.TunnelClientMsg.rpc:type_name -> encore.server.remote.tunnel.RPCResp
-	16, // 2: encore.server.remote.TunnelServerMsg.setup:type_name -> encore.server.remote.tunnel.SetupResp
-	17, // 3: encore.server.remote.TunnelServerMsg.rpc:type_name -> encore.server.remote.tunnel.RPCReq
-	8,  // 4: encore.server.remote.GetSecretsResponse.secrets:type_name -> encore.server.remote.Secret
-	0,  // 5: encore.server.remote.SetSecretRequest.type:type_name -> encore.server.remote.SetSecretRequest.Type
-	1,  // 6: encore.server.remote.Remote.Tunnel:input_type -> encore.server.remote.TunnelClientMsg
-	5,  // 7: encore.server.remote.Remote.Meta:input_type -> encore.server.remote.MetaRequest
-	11, // 8: encore.server.remote.Remote.DBConnect:input_type -> encore.server.remote.Data
-	3,  // 9: encore.server.remote.Remote.RecordTrace:input_type -> encore.server.remote.RecordTraceRequest
-	6,  // 10: encore.server.remote.Remote.GetSecrets:input_type -> encore.server.remote.GetSecretsRequest
-	9,  // 11: encore.server.remote.Remote.SetSecret:input_type -> encore.server.remote.SetSecretRequest
-	12, // 12: encore.server.remote.Remote.Logs:input_type -> encore.server.remote.LogsRequest
-	2,  // 13: encore.server.remote.Remote.Tunnel:output_type -> encore.server.remote.TunnelServerMsg
-	18, // 14: encore.server.remote.Remote.Meta:output_type -> encore.parser.meta.v1.Data
-	11, // 15: encore.server.remote.Remote.DBConnect:output_type -> encore.server.remote.Data
-	4,  // 16: encore.server.remote.Remote.RecordTrace:output_type -> encore.server.remote.RecordTraceResponse
-	7,  // 17: encore.server.remote.Remote.GetSecrets:output_type -> encore.server.remote.GetSecretsResponse
-	10, // 18: encore.server.remote.Remote.SetSecret:output_type -> encore.server.remote.SetSecretResponse
-	13, // 19: encore.server.remote.Remote.Logs:output_type -> encore.server.remote.LogsResponse
-	13, // [13:20] is the sub-list for method output_type
-	6,  // [6:13] is the sub-list for method input_type
-	6,  // [6:6] is the sub-list for extension type_name
-	6,  // [6:6] is the sub-list for extension extendee
-	0,  // [0:6] is the sub-list for field type_name
-}
-
-func init() { file_encore_server_remote_remote_proto_init() }
-func file_encore_server_remote_remote_proto_init() {
-	if File_encore_server_remote_remote_proto != nil {
-		return
-	}
-	if !protoimpl.UnsafeEnabled {
-		file_encore_server_remote_remote_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TunnelClientMsg); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*TunnelServerMsg); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RecordTraceRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RecordTraceResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MetaRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetSecretsRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetSecretsResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Secret); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetSecretRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetSecretResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*Data); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LogsRequest); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_remote_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*LogsResponse); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	file_encore_server_remote_remote_proto_msgTypes[0].OneofWrappers = []interface{}{
-		(*TunnelClientMsg_Setup)(nil),
-		(*TunnelClientMsg_Rpc)(nil),
-	}
-	file_encore_server_remote_remote_proto_msgTypes[1].OneofWrappers = []interface{}{
-		(*TunnelServerMsg_Setup)(nil),
-		(*TunnelServerMsg_Rpc)(nil),
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_encore_server_remote_remote_proto_rawDesc,
-			NumEnums:      1,
-			NumMessages:   13,
-			NumExtensions: 0,
-			NumServices:   1,
-		},
-		GoTypes:           file_encore_server_remote_remote_proto_goTypes,
-		DependencyIndexes: file_encore_server_remote_remote_proto_depIdxs,
-		EnumInfos:         file_encore_server_remote_remote_proto_enumTypes,
-		MessageInfos:      file_encore_server_remote_remote_proto_msgTypes,
-	}.Build()
-	File_encore_server_remote_remote_proto = out.File
-	file_encore_server_remote_remote_proto_rawDesc = nil
-	file_encore_server_remote_remote_proto_goTypes = nil
-	file_encore_server_remote_remote_proto_depIdxs = nil
-}
diff --git a/proto/encore/server/remote/remote.proto b/proto/encore/server/remote/remote.proto
deleted file mode 100644
index fa8fbea72f..0000000000
--- a/proto/encore/server/remote/remote.proto
+++ /dev/null
@@ -1,86 +0,0 @@
-syntax = "proto3";
-
-option go_package = "encr.dev/proto/encore/server/remote";
-
-import "encore/parser/meta/v1/meta.proto";
-import "encore/server/remote/tunnel/tunnel.proto";
-
-package encore.server.remote;
-
-service Remote {
-  rpc Tunnel (stream TunnelClientMsg) returns (stream TunnelServerMsg);
-  rpc Meta (MetaRequest) returns (encore.parser.meta.v1.Data);
-  rpc DBConnect (stream Data) returns (stream Data);
-  rpc RecordTrace (RecordTraceRequest) returns (RecordTraceResponse);
-  rpc GetSecrets (GetSecretsRequest) returns (GetSecretsResponse);
-  rpc SetSecret (SetSecretRequest) returns (SetSecretResponse);
-  rpc Logs (LogsRequest) returns (stream LogsResponse);
-}
-
-message TunnelClientMsg {
-  oneof msg {
-    tunnel.SetupReq setup = 1;
-    tunnel.RPCResp rpc = 2;
-  }
-}
-
-message TunnelServerMsg {
-  oneof msg {
-    tunnel.SetupResp setup = 1;
-    tunnel.RPCReq rpc = 2;
-  }
-}
-
-message RecordTraceRequest {
-  bytes data = 1;
-}
-
-message RecordTraceResponse {
-}
-
-message MetaRequest {
-  string app_slug = 1;
-  string env_name = 2;
-}
-
-message GetSecretsRequest {
-  string app_slug = 1;
-}
-
-message GetSecretsResponse {
-  repeated Secret secrets = 1;
-}
-
-message Secret {
-  string key = 1;
-  string value = 2;
-}
-
-message SetSecretRequest {
-  enum Type {
-      DEVELOPMENT = 0;
-      PRODUCTION = 1;
-  }
-  string app_slug = 1;
-  string key = 2;
-  string value = 3;
-  Type type = 4;
-}
-
-message SetSecretResponse {
-    bool created = 1; // whether or not the secret was created (as opposed to updated)
-}
-
-message Data {
-  bytes data = 1;
-}
-
-message LogsRequest {
-  string app_slug = 1;
-  string env_name = 2;
-}
-
-message LogsResponse {
-  repeated bytes lines = 1;
-  bool drop_notice = 2;
-}
\ No newline at end of file
diff --git a/proto/encore/server/remote/remote_grpc.pb.go b/proto/encore/server/remote/remote_grpc.pb.go
deleted file mode 100644
index e2034cc044..0000000000
--- a/proto/encore/server/remote/remote_grpc.pb.go
+++ /dev/null
@@ -1,399 +0,0 @@
-// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
-
-package remote
-
-import (
-	context "context"
-	v1 "encr.dev/proto/encore/parser/meta/v1"
-	grpc "google.golang.org/grpc"
-	codes "google.golang.org/grpc/codes"
-	status "google.golang.org/grpc/status"
-)
-
-// This is a compile-time assertion to ensure that this generated file
-// is compatible with the grpc package it is being compiled against.
-const _ = grpc.SupportPackageIsVersion6
-
-// RemoteClient is the client API for Remote service.
-//
-// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
-type RemoteClient interface {
-	Tunnel(ctx context.Context, opts ...grpc.CallOption) (Remote_TunnelClient, error)
-	Meta(ctx context.Context, in *MetaRequest, opts ...grpc.CallOption) (*v1.Data, error)
-	DBConnect(ctx context.Context, opts ...grpc.CallOption) (Remote_DBConnectClient, error)
-	RecordTrace(ctx context.Context, in *RecordTraceRequest, opts ...grpc.CallOption) (*RecordTraceResponse, error)
-	GetSecrets(ctx context.Context, in *GetSecretsRequest, opts ...grpc.CallOption) (*GetSecretsResponse, error)
-	SetSecret(ctx context.Context, in *SetSecretRequest, opts ...grpc.CallOption) (*SetSecretResponse, error)
-	Logs(ctx context.Context, in *LogsRequest, opts ...grpc.CallOption) (Remote_LogsClient, error)
-}
-
-type remoteClient struct {
-	cc grpc.ClientConnInterface
-}
-
-func NewRemoteClient(cc grpc.ClientConnInterface) RemoteClient {
-	return &remoteClient{cc}
-}
-
-func (c *remoteClient) Tunnel(ctx context.Context, opts ...grpc.CallOption) (Remote_TunnelClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Remote_serviceDesc.Streams[0], "/encore.server.remote.Remote/Tunnel", opts...)
-	if err != nil {
-		return nil, err
-	}
-	x := &remoteTunnelClient{stream}
-	return x, nil
-}
-
-type Remote_TunnelClient interface {
-	Send(*TunnelClientMsg) error
-	Recv() (*TunnelServerMsg, error)
-	grpc.ClientStream
-}
-
-type remoteTunnelClient struct {
-	grpc.ClientStream
-}
-
-func (x *remoteTunnelClient) Send(m *TunnelClientMsg) error {
-	return x.ClientStream.SendMsg(m)
-}
-
-func (x *remoteTunnelClient) Recv() (*TunnelServerMsg, error) {
-	m := new(TunnelServerMsg)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-func (c *remoteClient) Meta(ctx context.Context, in *MetaRequest, opts ...grpc.CallOption) (*v1.Data, error) {
-	out := new(v1.Data)
-	err := c.cc.Invoke(ctx, "/encore.server.remote.Remote/Meta", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *remoteClient) DBConnect(ctx context.Context, opts ...grpc.CallOption) (Remote_DBConnectClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Remote_serviceDesc.Streams[1], "/encore.server.remote.Remote/DBConnect", opts...)
-	if err != nil {
-		return nil, err
-	}
-	x := &remoteDBConnectClient{stream}
-	return x, nil
-}
-
-type Remote_DBConnectClient interface {
-	Send(*Data) error
-	Recv() (*Data, error)
-	grpc.ClientStream
-}
-
-type remoteDBConnectClient struct {
-	grpc.ClientStream
-}
-
-func (x *remoteDBConnectClient) Send(m *Data) error {
-	return x.ClientStream.SendMsg(m)
-}
-
-func (x *remoteDBConnectClient) Recv() (*Data, error) {
-	m := new(Data)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-func (c *remoteClient) RecordTrace(ctx context.Context, in *RecordTraceRequest, opts ...grpc.CallOption) (*RecordTraceResponse, error) {
-	out := new(RecordTraceResponse)
-	err := c.cc.Invoke(ctx, "/encore.server.remote.Remote/RecordTrace", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *remoteClient) GetSecrets(ctx context.Context, in *GetSecretsRequest, opts ...grpc.CallOption) (*GetSecretsResponse, error) {
-	out := new(GetSecretsResponse)
-	err := c.cc.Invoke(ctx, "/encore.server.remote.Remote/GetSecrets", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *remoteClient) SetSecret(ctx context.Context, in *SetSecretRequest, opts ...grpc.CallOption) (*SetSecretResponse, error) {
-	out := new(SetSecretResponse)
-	err := c.cc.Invoke(ctx, "/encore.server.remote.Remote/SetSecret", in, out, opts...)
-	if err != nil {
-		return nil, err
-	}
-	return out, nil
-}
-
-func (c *remoteClient) Logs(ctx context.Context, in *LogsRequest, opts ...grpc.CallOption) (Remote_LogsClient, error) {
-	stream, err := c.cc.NewStream(ctx, &_Remote_serviceDesc.Streams[2], "/encore.server.remote.Remote/Logs", opts...)
-	if err != nil {
-		return nil, err
-	}
-	x := &remoteLogsClient{stream}
-	if err := x.ClientStream.SendMsg(in); err != nil {
-		return nil, err
-	}
-	if err := x.ClientStream.CloseSend(); err != nil {
-		return nil, err
-	}
-	return x, nil
-}
-
-type Remote_LogsClient interface {
-	Recv() (*LogsResponse, error)
-	grpc.ClientStream
-}
-
-type remoteLogsClient struct {
-	grpc.ClientStream
-}
-
-func (x *remoteLogsClient) Recv() (*LogsResponse, error) {
-	m := new(LogsResponse)
-	if err := x.ClientStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-// RemoteServer is the server API for Remote service.
-// All implementations must embed UnimplementedRemoteServer
-// for forward compatibility
-type RemoteServer interface {
-	Tunnel(Remote_TunnelServer) error
-	Meta(context.Context, *MetaRequest) (*v1.Data, error)
-	DBConnect(Remote_DBConnectServer) error
-	RecordTrace(context.Context, *RecordTraceRequest) (*RecordTraceResponse, error)
-	GetSecrets(context.Context, *GetSecretsRequest) (*GetSecretsResponse, error)
-	SetSecret(context.Context, *SetSecretRequest) (*SetSecretResponse, error)
-	Logs(*LogsRequest, Remote_LogsServer) error
-	mustEmbedUnimplementedRemoteServer()
-}
-
-// UnimplementedRemoteServer must be embedded to have forward compatible implementations.
-type UnimplementedRemoteServer struct {
-}
-
-func (*UnimplementedRemoteServer) Tunnel(Remote_TunnelServer) error {
-	return status.Errorf(codes.Unimplemented, "method Tunnel not implemented")
-}
-func (*UnimplementedRemoteServer) Meta(context.Context, *MetaRequest) (*v1.Data, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method Meta not implemented")
-}
-func (*UnimplementedRemoteServer) DBConnect(Remote_DBConnectServer) error {
-	return status.Errorf(codes.Unimplemented, "method DBConnect not implemented")
-}
-func (*UnimplementedRemoteServer) RecordTrace(context.Context, *RecordTraceRequest) (*RecordTraceResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method RecordTrace not implemented")
-}
-func (*UnimplementedRemoteServer) GetSecrets(context.Context, *GetSecretsRequest) (*GetSecretsResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method GetSecrets not implemented")
-}
-func (*UnimplementedRemoteServer) SetSecret(context.Context, *SetSecretRequest) (*SetSecretResponse, error) {
-	return nil, status.Errorf(codes.Unimplemented, "method SetSecret not implemented")
-}
-func (*UnimplementedRemoteServer) Logs(*LogsRequest, Remote_LogsServer) error {
-	return status.Errorf(codes.Unimplemented, "method Logs not implemented")
-}
-func (*UnimplementedRemoteServer) mustEmbedUnimplementedRemoteServer() {}
-
-func RegisterRemoteServer(s *grpc.Server, srv RemoteServer) {
-	s.RegisterService(&_Remote_serviceDesc, srv)
-}
-
-func _Remote_Tunnel_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(RemoteServer).Tunnel(&remoteTunnelServer{stream})
-}
-
-type Remote_TunnelServer interface {
-	Send(*TunnelServerMsg) error
-	Recv() (*TunnelClientMsg, error)
-	grpc.ServerStream
-}
-
-type remoteTunnelServer struct {
-	grpc.ServerStream
-}
-
-func (x *remoteTunnelServer) Send(m *TunnelServerMsg) error {
-	return x.ServerStream.SendMsg(m)
-}
-
-func (x *remoteTunnelServer) Recv() (*TunnelClientMsg, error) {
-	m := new(TunnelClientMsg)
-	if err := x.ServerStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-func _Remote_Meta_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(MetaRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RemoteServer).Meta(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/encore.server.remote.Remote/Meta",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(RemoteServer).Meta(ctx, req.(*MetaRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Remote_DBConnect_Handler(srv interface{}, stream grpc.ServerStream) error {
-	return srv.(RemoteServer).DBConnect(&remoteDBConnectServer{stream})
-}
-
-type Remote_DBConnectServer interface {
-	Send(*Data) error
-	Recv() (*Data, error)
-	grpc.ServerStream
-}
-
-type remoteDBConnectServer struct {
-	grpc.ServerStream
-}
-
-func (x *remoteDBConnectServer) Send(m *Data) error {
-	return x.ServerStream.SendMsg(m)
-}
-
-func (x *remoteDBConnectServer) Recv() (*Data, error) {
-	m := new(Data)
-	if err := x.ServerStream.RecvMsg(m); err != nil {
-		return nil, err
-	}
-	return m, nil
-}
-
-func _Remote_RecordTrace_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(RecordTraceRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RemoteServer).RecordTrace(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/encore.server.remote.Remote/RecordTrace",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(RemoteServer).RecordTrace(ctx, req.(*RecordTraceRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Remote_GetSecrets_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(GetSecretsRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RemoteServer).GetSecrets(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/encore.server.remote.Remote/GetSecrets",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(RemoteServer).GetSecrets(ctx, req.(*GetSecretsRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Remote_SetSecret_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
-	in := new(SetSecretRequest)
-	if err := dec(in); err != nil {
-		return nil, err
-	}
-	if interceptor == nil {
-		return srv.(RemoteServer).SetSecret(ctx, in)
-	}
-	info := &grpc.UnaryServerInfo{
-		Server:     srv,
-		FullMethod: "/encore.server.remote.Remote/SetSecret",
-	}
-	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
-		return srv.(RemoteServer).SetSecret(ctx, req.(*SetSecretRequest))
-	}
-	return interceptor(ctx, in, info, handler)
-}
-
-func _Remote_Logs_Handler(srv interface{}, stream grpc.ServerStream) error {
-	m := new(LogsRequest)
-	if err := stream.RecvMsg(m); err != nil {
-		return err
-	}
-	return srv.(RemoteServer).Logs(m, &remoteLogsServer{stream})
-}
-
-type Remote_LogsServer interface {
-	Send(*LogsResponse) error
-	grpc.ServerStream
-}
-
-type remoteLogsServer struct {
-	grpc.ServerStream
-}
-
-func (x *remoteLogsServer) Send(m *LogsResponse) error {
-	return x.ServerStream.SendMsg(m)
-}
-
-var _Remote_serviceDesc = grpc.ServiceDesc{
-	ServiceName: "encore.server.remote.Remote",
-	HandlerType: (*RemoteServer)(nil),
-	Methods: []grpc.MethodDesc{
-		{
-			MethodName: "Meta",
-			Handler:    _Remote_Meta_Handler,
-		},
-		{
-			MethodName: "RecordTrace",
-			Handler:    _Remote_RecordTrace_Handler,
-		},
-		{
-			MethodName: "GetSecrets",
-			Handler:    _Remote_GetSecrets_Handler,
-		},
-		{
-			MethodName: "SetSecret",
-			Handler:    _Remote_SetSecret_Handler,
-		},
-	},
-	Streams: []grpc.StreamDesc{
-		{
-			StreamName:    "Tunnel",
-			Handler:       _Remote_Tunnel_Handler,
-			ServerStreams: true,
-			ClientStreams: true,
-		},
-		{
-			StreamName:    "DBConnect",
-			Handler:       _Remote_DBConnect_Handler,
-			ServerStreams: true,
-			ClientStreams: true,
-		},
-		{
-			StreamName:    "Logs",
-			Handler:       _Remote_Logs_Handler,
-			ServerStreams: true,
-		},
-	},
-	Metadata: "encore/server/remote/remote.proto",
-}
diff --git a/proto/encore/server/remote/tunnel/tunnel.pb.go b/proto/encore/server/remote/tunnel/tunnel.pb.go
deleted file mode 100644
index 67f7dc89e8..0000000000
--- a/proto/encore/server/remote/tunnel/tunnel.pb.go
+++ /dev/null
@@ -1,396 +0,0 @@
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.25.0
-// 	protoc        v3.14.0
-// source: encore/server/remote/tunnel/tunnel.proto
-
-package tunnel
-
-import (
-	proto "github.com/golang/protobuf/proto"
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	reflect "reflect"
-	sync "sync"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-// This is a compile-time assertion that a sufficiently up-to-date version
-// of the legacy proto package is being used.
-const _ = proto.ProtoPackageIsVersion4
-
-type SetupReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	AppSlug string `protobuf:"bytes,1,opt,name=app_slug,json=appSlug,proto3" json:"app_slug,omitempty"`
-}
-
-func (x *SetupReq) Reset() {
-	*x = SetupReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_tunnel_tunnel_proto_msgTypes[0]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *SetupReq) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*SetupReq) ProtoMessage() {}
-
-func (x *SetupReq) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_tunnel_tunnel_proto_msgTypes[0]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use SetupReq.ProtoReflect.Descriptor instead.
-func (*SetupReq) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_tunnel_tunnel_proto_rawDescGZIP(), []int{0}
-}
-
-func (x *SetupReq) GetAppSlug() string {
-	if x != nil {
-		return x.AppSlug
-	}
-	return ""
-}
-
-type SetupResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	AppSlug string `protobuf:"bytes,1,opt,name=app_slug,json=appSlug,proto3" json:"app_slug,omitempty"`
-	EnvId   string `protobuf:"bytes,2,opt,name=env_id,json=envId,proto3" json:"env_id,omitempty"`
-	EnvName string `protobuf:"bytes,3,opt,name=env_name,json=envName,proto3" json:"env_name,omitempty"`
-}
-
-func (x *SetupResp) Reset() {
-	*x = SetupResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_tunnel_tunnel_proto_msgTypes[1]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *SetupResp) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*SetupResp) ProtoMessage() {}
-
-func (x *SetupResp) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_tunnel_tunnel_proto_msgTypes[1]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use SetupResp.ProtoReflect.Descriptor instead.
-func (*SetupResp) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_tunnel_tunnel_proto_rawDescGZIP(), []int{1}
-}
-
-func (x *SetupResp) GetAppSlug() string {
-	if x != nil {
-		return x.AppSlug
-	}
-	return ""
-}
-
-func (x *SetupResp) GetEnvId() string {
-	if x != nil {
-		return x.EnvId
-	}
-	return ""
-}
-
-func (x *SetupResp) GetEnvName() string {
-	if x != nil {
-		return x.EnvName
-	}
-	return ""
-}
-
-type RPCReq struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	ReqId    int64  `protobuf:"varint,1,opt,name=req_id,json=reqId,proto3" json:"req_id,omitempty"`
-	Endpoint string `protobuf:"bytes,2,opt,name=endpoint,proto3" json:"endpoint,omitempty"`
-	Payload  []byte `protobuf:"bytes,3,opt,name=payload,proto3" json:"payload,omitempty"`
-}
-
-func (x *RPCReq) Reset() {
-	*x = RPCReq{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_tunnel_tunnel_proto_msgTypes[2]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *RPCReq) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*RPCReq) ProtoMessage() {}
-
-func (x *RPCReq) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_tunnel_tunnel_proto_msgTypes[2]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use RPCReq.ProtoReflect.Descriptor instead.
-func (*RPCReq) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_tunnel_tunnel_proto_rawDescGZIP(), []int{2}
-}
-
-func (x *RPCReq) GetReqId() int64 {
-	if x != nil {
-		return x.ReqId
-	}
-	return 0
-}
-
-func (x *RPCReq) GetEndpoint() string {
-	if x != nil {
-		return x.Endpoint
-	}
-	return ""
-}
-
-func (x *RPCReq) GetPayload() []byte {
-	if x != nil {
-		return x.Payload
-	}
-	return nil
-}
-
-type RPCResp struct {
-	state         protoimpl.MessageState
-	sizeCache     protoimpl.SizeCache
-	unknownFields protoimpl.UnknownFields
-
-	ReqId   int64  `protobuf:"varint,1,opt,name=req_id,json=reqId,proto3" json:"req_id,omitempty"`
-	Status  int32  `protobuf:"varint,2,opt,name=status,proto3" json:"status,omitempty"`
-	Payload []byte `protobuf:"bytes,3,opt,name=payload,proto3" json:"payload,omitempty"`
-}
-
-func (x *RPCResp) Reset() {
-	*x = RPCResp{}
-	if protoimpl.UnsafeEnabled {
-		mi := &file_encore_server_remote_tunnel_tunnel_proto_msgTypes[3]
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		ms.StoreMessageInfo(mi)
-	}
-}
-
-func (x *RPCResp) String() string {
-	return protoimpl.X.MessageStringOf(x)
-}
-
-func (*RPCResp) ProtoMessage() {}
-
-func (x *RPCResp) ProtoReflect() protoreflect.Message {
-	mi := &file_encore_server_remote_tunnel_tunnel_proto_msgTypes[3]
-	if protoimpl.UnsafeEnabled && x != nil {
-		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
-		if ms.LoadMessageInfo() == nil {
-			ms.StoreMessageInfo(mi)
-		}
-		return ms
-	}
-	return mi.MessageOf(x)
-}
-
-// Deprecated: Use RPCResp.ProtoReflect.Descriptor instead.
-func (*RPCResp) Descriptor() ([]byte, []int) {
-	return file_encore_server_remote_tunnel_tunnel_proto_rawDescGZIP(), []int{3}
-}
-
-func (x *RPCResp) GetReqId() int64 {
-	if x != nil {
-		return x.ReqId
-	}
-	return 0
-}
-
-func (x *RPCResp) GetStatus() int32 {
-	if x != nil {
-		return x.Status
-	}
-	return 0
-}
-
-func (x *RPCResp) GetPayload() []byte {
-	if x != nil {
-		return x.Payload
-	}
-	return nil
-}
-
-var File_encore_server_remote_tunnel_tunnel_proto protoreflect.FileDescriptor
-
-var file_encore_server_remote_tunnel_tunnel_proto_rawDesc = []byte{
-	0x0a, 0x28, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2f,
-	0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2f, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x2f, 0x74, 0x75,
-	0x6e, 0x6e, 0x65, 0x6c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1b, 0x65, 0x6e, 0x63, 0x6f,
-	0x72, 0x65, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x2e, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65,
-	0x2e, 0x74, 0x75, 0x6e, 0x6e, 0x65, 0x6c, 0x22, 0x25, 0x0a, 0x08, 0x53, 0x65, 0x74, 0x75, 0x70,
-	0x52, 0x65, 0x71, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x70, 0x70, 0x5f, 0x73, 0x6c, 0x75, 0x67, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x70, 0x70, 0x53, 0x6c, 0x75, 0x67, 0x22, 0x58,
-	0x0a, 0x09, 0x53, 0x65, 0x74, 0x75, 0x70, 0x52, 0x65, 0x73, 0x70, 0x12, 0x19, 0x0a, 0x08, 0x61,
-	0x70, 0x70, 0x5f, 0x73, 0x6c, 0x75, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61,
-	0x70, 0x70, 0x53, 0x6c, 0x75, 0x67, 0x12, 0x15, 0x0a, 0x06, 0x65, 0x6e, 0x76, 0x5f, 0x69, 0x64,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6e, 0x76, 0x49, 0x64, 0x12, 0x19, 0x0a,
-	0x08, 0x65, 0x6e, 0x76, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x07, 0x65, 0x6e, 0x76, 0x4e, 0x61, 0x6d, 0x65, 0x22, 0x55, 0x0a, 0x06, 0x52, 0x50, 0x43, 0x52,
-	0x65, 0x71, 0x12, 0x15, 0x0a, 0x06, 0x72, 0x65, 0x71, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x03, 0x52, 0x05, 0x72, 0x65, 0x71, 0x49, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x65, 0x6e, 0x64,
-	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x65, 0x6e, 0x64,
-	0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22,
-	0x52, 0x0a, 0x07, 0x52, 0x50, 0x43, 0x52, 0x65, 0x73, 0x70, 0x12, 0x15, 0x0a, 0x06, 0x72, 0x65,
-	0x71, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x05, 0x72, 0x65, 0x71, 0x49,
-	0x64, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x05, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x61, 0x79,
-	0x6c, 0x6f, 0x61, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x61, 0x79, 0x6c,
-	0x6f, 0x61, 0x64, 0x42, 0x2c, 0x5a, 0x2a, 0x65, 0x6e, 0x63, 0x72, 0x2e, 0x64, 0x65, 0x76, 0x2f,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2f, 0x73, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x2f, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2f, 0x74, 0x75, 0x6e, 0x6e, 0x65,
-	0x6c, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
-
-var (
-	file_encore_server_remote_tunnel_tunnel_proto_rawDescOnce sync.Once
-	file_encore_server_remote_tunnel_tunnel_proto_rawDescData = file_encore_server_remote_tunnel_tunnel_proto_rawDesc
-)
-
-func file_encore_server_remote_tunnel_tunnel_proto_rawDescGZIP() []byte {
-	file_encore_server_remote_tunnel_tunnel_proto_rawDescOnce.Do(func() {
-		file_encore_server_remote_tunnel_tunnel_proto_rawDescData = protoimpl.X.CompressGZIP(file_encore_server_remote_tunnel_tunnel_proto_rawDescData)
-	})
-	return file_encore_server_remote_tunnel_tunnel_proto_rawDescData
-}
-
-var file_encore_server_remote_tunnel_tunnel_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
-var file_encore_server_remote_tunnel_tunnel_proto_goTypes = []interface{}{
-	(*SetupReq)(nil),  // 0: encore.server.remote.tunnel.SetupReq
-	(*SetupResp)(nil), // 1: encore.server.remote.tunnel.SetupResp
-	(*RPCReq)(nil),    // 2: encore.server.remote.tunnel.RPCReq
-	(*RPCResp)(nil),   // 3: encore.server.remote.tunnel.RPCResp
-}
-var file_encore_server_remote_tunnel_tunnel_proto_depIdxs = []int32{
-	0, // [0:0] is the sub-list for method output_type
-	0, // [0:0] is the sub-list for method input_type
-	0, // [0:0] is the sub-list for extension type_name
-	0, // [0:0] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
-}
-
-func init() { file_encore_server_remote_tunnel_tunnel_proto_init() }
-func file_encore_server_remote_tunnel_tunnel_proto_init() {
-	if File_encore_server_remote_tunnel_tunnel_proto != nil {
-		return
-	}
-	if !protoimpl.UnsafeEnabled {
-		file_encore_server_remote_tunnel_tunnel_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetupReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_tunnel_tunnel_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*SetupResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_tunnel_tunnel_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RPCReq); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-		file_encore_server_remote_tunnel_tunnel_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RPCResp); i {
-			case 0:
-				return &v.state
-			case 1:
-				return &v.sizeCache
-			case 2:
-				return &v.unknownFields
-			default:
-				return nil
-			}
-		}
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_encore_server_remote_tunnel_tunnel_proto_rawDesc,
-			NumEnums:      0,
-			NumMessages:   4,
-			NumExtensions: 0,
-			NumServices:   0,
-		},
-		GoTypes:           file_encore_server_remote_tunnel_tunnel_proto_goTypes,
-		DependencyIndexes: file_encore_server_remote_tunnel_tunnel_proto_depIdxs,
-		MessageInfos:      file_encore_server_remote_tunnel_tunnel_proto_msgTypes,
-	}.Build()
-	File_encore_server_remote_tunnel_tunnel_proto = out.File
-	file_encore_server_remote_tunnel_tunnel_proto_rawDesc = nil
-	file_encore_server_remote_tunnel_tunnel_proto_goTypes = nil
-	file_encore_server_remote_tunnel_tunnel_proto_depIdxs = nil
-}
diff --git a/proto/encore/server/remote/tunnel/tunnel.proto b/proto/encore/server/remote/tunnel/tunnel.proto
deleted file mode 100644
index cb884354ca..0000000000
--- a/proto/encore/server/remote/tunnel/tunnel.proto
+++ /dev/null
@@ -1,27 +0,0 @@
-syntax = "proto3";
-
-option go_package = "encr.dev/proto/encore/server/remote/tunnel";
-
-package encore.server.remote.tunnel;
-
-message SetupReq {
-  string app_slug = 1;
-}
-
-message SetupResp {
-  string app_slug = 1;
-  string env_id = 2;
-  string env_name = 3;
-}
-
-message RPCReq {
-  int64 req_id = 1;
-  string endpoint = 2;
-  bytes payload = 3;
-}
-
-message RPCResp {
-  int64 req_id = 1;
-  int32 status = 2;
-  bytes payload = 3;
-}
\ No newline at end of file
diff --git a/proto/gen.sh b/proto/gen.sh
index 717924bb9e..1f0a7e0ef4 100755
--- a/proto/gen.sh
+++ b/proto/gen.sh
@@ -2,10 +2,32 @@
 
 set -e -x
 
-protoc -I . --go_out=. --go_opt=paths=source_relative ./encore/parser/meta/v1/meta.proto
-protoc -I . --go_out=. --go_opt=paths=source_relative ./encore/parser/schema/v1/schema.proto
-protoc -I . --go_out=. --go_opt=paths=source_relative ./encore/engine/trace/trace.proto
+GO_OPT=paths=source_relative
+GRPC_OPT=paths=source_relative
 
-protoc -I . --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative ./encore/daemon/daemon.proto
-protoc -I . --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative ./encore/server/remote/remote.proto
-protoc -I . --go_out=. --go_opt=paths=source_relative --go-grpc_out=. --go-grpc_opt=paths=source_relative ./encore/server/remote/tunnel/tunnel.proto
+protoc -I . --go_out=. --go_opt=$GO_OPT \
+  ./encore/parser/meta/v1/meta.proto
+
+protoc -I . --go_out=. --go_opt=$GO_OPT \
+  ./encore/parser/schema/v1/schema.proto
+
+protoc -I . --go_out=. --go_opt=$GO_OPT \
+  ./encore/engine/trace/trace.proto
+
+protoc -I . --go_out=. --go_opt=$GO_OPT \
+  ./encore/engine/trace2/trace2.proto
+
+protoc -I . --go_out=. --go_opt=$GO_OPT --go-grpc_out=. --go-grpc_opt=$GRPC_OPT \
+  ./encore/daemon/daemon.proto
+
+protoc -I . --go_out=. --go_opt=$GO_OPT \
+./encore/runtime/v1/infra.proto
+
+protoc -I . --go_out=. --go_opt=$GO_OPT \
+./encore/runtime/v1/runtime.proto
+
+protoc -I . --go_out=. --go_opt=$GO_OPT \
+./encore/runtime/v1/secretdata.proto
+
+protoc -I . --go_out=. --go_opt=$GO_OPT \
+./encore/runtime/v1/secretdata.proto
diff --git a/runtimes/core/Cargo.toml b/runtimes/core/Cargo.toml
new file mode 100644
index 0000000000..e1695dd0c1
--- /dev/null
+++ b/runtimes/core/Cargo.toml
@@ -0,0 +1,134 @@
+[package]
+name = "encore-runtime-core"
+version = "0.1.0"
+edition = "2021"
+
+[features]
+# Tracing of the Encore runtime itself.
+rttrace = []
+
+[dependencies]
+pingora = { version = "0.4", features = ["lb", "openssl"] }
+anyhow = "1.0.76"
+base64 = "0.21.5"
+gjson = "0.8.1"
+prost = "0.12.3"
+prost-types = "0.12.3"
+serde = "1.0.193"
+serde_json = { version = "1.0.108", features = ["raw_value"] }
+tokio = { version = "1.35.1", features = ["sync"] }
+tokio-stream = "0.1.17"
+tokio-nsq = "0.14.0"
+xid = "1.0.3"
+log = { version = "0.4.20", features = ["kv_unstable", "kv_unstable_serde"] }
+bytes = { version = "1.5.0", features = [] }
+postgres-protocol = "0.6.8"
+pgvector = { version = "0.4", features = ["postgres", "serde"] }
+tokio-postgres = { version = "0.7.13", features = [
+    "array-impls",
+    "with-serde_json-1",
+    "with-geo-types-0_7",
+    "with-uuid-1",
+    "with-chrono-0_4",
+    "with-cidr-0_3",
+] }
+cidr = "0.3.1"
+tokio-util = "0.7.10"
+tokio-tungstenite = { version = "0.21.0", features = [
+    "rustls-tls-native-roots",
+] }
+futures-util = "0.3.31"
+rand = "0.8.5"
+env_logger = "0.10.1"
+google-cloud-pubsub = "0.22.1"
+google-cloud-googleapis = "0.12.0"
+hyper = { version = "1.1.0", features = ["server", "http1", "http2", "client"] }
+http-body-util = "0.1.0"
+http = "1.0.0"
+matchit = "0.7.3"
+axum = { version = "0.7.5", features = ["ws"] }
+chrono = { version = "0.4.31", features = ["serde"] }
+once_cell = "1.19.0"
+colored = "2.1.0"
+backtrace = "0.3.69"
+serde_with = "3.4.0"
+mime = "0.3.17"
+futures = "0.3.30"
+native-tls = "0.2.11"
+postgres-native-tls = "0.5.0"
+reqwest = { version = "0.12.4", features = ["stream", "json"] }
+url = "2.5.0"
+futures-core = { version = "0.3.30", features = [] }
+serde_urlencoded = "0.7.1"
+form_urlencoded = "1.2.1"
+httpdate = "1.0.3"
+hmac = "0.12.1"
+sha2 = "0.10.8"
+sha3 = "0.10.8"
+hex = "0.4.3"
+subtle = "2.5.0"
+radix_fmt = "1.0.0"
+indexmap = { version = "2.2.1", features = ["serde"] }
+tower-service = "0.3.2"
+duct = "0.13.7"
+base32 = "0.4.0"
+
+# We need to vendor openssl to allow cross-compilation on our build systems
+openssl = { version = "0.10.57", features = ["vendored"] }
+bb8 = "0.8.3"
+bb8-postgres = "0.8.1"
+uuid = "1.7.0"
+openssl-probe = "0.1.5"
+jsonwebtoken = "9.2.0"
+google-cloud-gax = "0.17.0"
+aws-sdk-sns = "1.20.0"
+aws-config = "1.1.10"
+aws-sdk-sqs = "1.19.0"
+tokio-retry = "0.3.0"
+rsa = { version = "0.9.6", features = ["pem"] }
+flate2 = "1.0.30"
+urlencoding = "2.1.3"
+tower-http = { version = "0.5.2", features = ["fs"] }
+google-cloud-storage = "0.22.1"
+serde_path_to_error = "0.1.16"
+tracing = "0.1.40"
+tracing-subscriber = { version = "0.3.18", features = [
+    "alloc",
+    "ansi",
+    "env-filter",
+    "fmt",
+    "matchers",
+    "nu-ansi-term",
+    "once_cell",
+    "regex",
+    "registry",
+    "sharded-slab",
+    "smallvec",
+    "std",
+    "thread_local",
+    "tracing",
+], default-features = false }
+thiserror = "1.0.64"
+async-stream = "0.3.6"
+md5 = "0.7.0"
+aws-sdk-s3 = "1.58.0"
+aws-smithy-types = { version = "1.2.8", features = [
+    "byte-stream-poll-next",
+    "rt-tokio",
+] }
+percent-encoding = "2.3.1"
+aws-credential-types = "1.2.1"
+regex = "1.11.1"
+email_address = "0.2.9"
+cookie = "0.18.1"
+malachite = "0.6.1"
+byteorder = "1.5.0"
+
+[build-dependencies]
+prost-build = "0.12.3"
+
+[dev-dependencies]
+assert_matches = "1.5.0"
+insta = { version = "1.38.0", features = ["yaml"] }
+quickcheck = "1.0.3"
+proptest = "1.7.0"
diff --git a/runtimes/core/build.rs b/runtimes/core/build.rs
new file mode 100644
index 0000000000..94627339df
--- /dev/null
+++ b/runtimes/core/build.rs
@@ -0,0 +1,59 @@
+use std::path::{Path, PathBuf};
+
+fn main() -> std::io::Result<()> {
+    prost_build::compile_protos(
+        &[
+            "../../proto/encore/runtime/v1/runtime.proto",
+            "../../proto/encore/parser/meta/v1/meta.proto",
+        ],
+        &["../../proto/"],
+    )?;
+
+    // We add an extra compile time environment variable which allows our error module
+    // to know where the root of the workspace that we are compiling is - thus in stack traces
+    // we can show the relative path to the file that caused the error.
+    println!(
+        "cargo:rustc-env=ENCORE_BINARY_SRC_PATH={}",
+        workspace_dir().to_string_lossy()
+    );
+
+    println!("cargo:rustc-env=ENCORE_BINARY_GIT_HASH={}", get_git_hash());
+
+    Ok(())
+}
+
+fn workspace_dir() -> PathBuf {
+    let output = std::process::Command::new(env!("CARGO"))
+        .arg("locate-project")
+        .arg("--workspace")
+        .arg("--message-format=plain")
+        .output()
+        .unwrap()
+        .stdout;
+
+    let cargo_toml_file = Path::new(std::str::from_utf8(&output).unwrap().trim());
+    cargo_toml_file.parent().unwrap().to_path_buf()
+}
+
+use std::env;
+
+fn get_git_hash() -> String {
+    use std::process::Command;
+
+    let commit = Command::new("git")
+        .arg("rev-parse")
+        .arg("--verify")
+        .arg("HEAD")
+        .output();
+    if let Ok(commit_output) = commit {
+        let commit_string = String::from_utf8_lossy(&commit_output.stdout);
+
+        commit_string
+            .lines()
+            .next()
+            .unwrap_or("unknown")
+            .to_string()
+    } else {
+        "unknown".to_string()
+    }
+}
diff --git a/runtimes/core/resources/test/infra.config.json b/runtimes/core/resources/test/infra.config.json
new file mode 100644
index 0000000000..7de8f5f25f
--- /dev/null
+++ b/runtimes/core/resources/test/infra.config.json
@@ -0,0 +1,125 @@
+{
+  "$schema": "https://encore.dev/schemas/infra.schema.json",
+  "metadata": {
+    "app_id": "my-app",
+    "env_name": "my-env",
+    "env_type": "production",
+    "cloud": "gcp",
+    "base_url": "https://my-app.com"
+  },
+  "sql_servers": [
+    {
+      "host": "my-db-host:5432",
+      "tls_config": {
+        "ca": "test",
+        "client_cert": {
+          "cert": "test",
+          "key": "test"
+        },
+        "disable_tls_hostname_verification": false,
+        "disabled": false
+      },
+      "databases": {
+        "mydb": {
+          "client_cert": {
+            "cert": "test",
+            "key": "test"
+          },
+          "max_connections": 10,
+          "min_connections": 10,
+          "username": "my-db-owner",
+          "password": {"$env": "DB_PASSWORD"}
+
+        }
+      }
+    }
+  ],
+  "service_discovery": {
+    "myservice": {
+      "base_url": "https://my-service:8044"
+    },
+    "myservice2": {
+      "base_url": "https://my-service2:8044",
+      "auth": [{
+        "type": "key",
+        "key": {
+          "$env": "SVC_TO_SVC_KEY"
+        },
+        "id": 1
+      }]
+    }
+  },
+  "redis": {
+    "encoreredis": {
+      "database_index": 5,
+      "max_connections": 10,
+      "min_connections": 10,
+      "key_prefix": "my-app:my-env:",
+      "tls_config": {
+        "disable_tls_hostname_verification": false,
+        "disabled": false,
+        "ca": "test",
+        "client_cert": {
+          "cert": "test",
+          "key": "test"
+        }
+      },
+      "auth": {
+        "type": "acl",
+        "username": "encoreredis",
+        "password": {"$env": "REDIS_PASSWORD"}
+      },
+      "host": "my-redis-host"
+    }
+  },
+  "metrics": {
+    "type": "prometheus",
+    "remote_write_url": "https://my-remote-write-url"
+  },
+  "graceful_shutdown": {
+    "total": 30,
+    "handlers": 20,
+    "shutdown_hooks": 10
+  },
+  "auth": [
+    {
+      "type": "key",
+      "id": 1,
+      "key": {"$env": "SVC_TO_SVC_KEY"}
+    }
+  ],
+  "secrets": {
+    "AppSecret": {"$env": "APP_SECRET"}
+  },
+  "pubsub": [
+    {
+      "type": "gcp_pubsub",
+      "project_id": "my-project",
+      "topics": {
+        "encore-topic": {
+          "name": "gcp-topic-name",
+          "subscriptions": {
+            "encore-subscription": {
+              "name": "gcp-subscription-name",
+              "project_id": "test",
+              "push_config": {
+                "id": "test",
+                "jwt_audience": "test",
+                "service_account": "test"
+              }
+            }
+          }
+        }
+      }
+    }
+  ],
+  "cors": {
+    "debug": true,
+    "allow_headers": ["Authorization", "Content-Type"],
+    "expose_headers": ["*"],
+    "allow_origins_with_credentials": ["https://test.com"],
+    "allow_origins_without_credentials": ["https://test.com"]
+  },
+  "hosted_gateways": ["api-gateway"],
+  "hosted_services": ["my-service", "my-service2"]
+}
\ No newline at end of file
diff --git a/runtimes/core/resources/test/runtime.pb b/runtimes/core/resources/test/runtime.pb
new file mode 100644
index 0000000000..0a3d1ba753
Binary files /dev/null and b/runtimes/core/resources/test/runtime.pb differ
diff --git a/runtimes/core/src/api/auth/local.rs b/runtimes/core/src/api/auth/local.rs
new file mode 100644
index 0000000000..a9c88fad64
--- /dev/null
+++ b/runtimes/core/src/api/auth/local.rs
@@ -0,0 +1,173 @@
+use crate::api::auth::{AuthHandler, AuthPayload, AuthRequest, AuthResponse};
+use crate::api::schema::encoding::Schema;
+use crate::api::{APIResult, HandlerResponse, HandlerResponseInner, PValues};
+use crate::log::LogFromRust;
+use crate::model::{AuthRequestData, RequestData};
+use crate::trace::Tracer;
+use crate::{api, model, EndpointName};
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::{Arc, RwLock};
+
+pub struct LocalAuthHandler {
+    pub name: EndpointName,
+    pub schema: Schema,
+    pub handler: RwLock<Option<Arc<dyn api::TypedHandler>>>,
+    pub tracer: Tracer,
+}
+
+impl LocalAuthHandler {
+    pub fn set_handler(&self, handler: Option<Arc<dyn api::TypedHandler>>) {
+        let mut guard = self.handler.write().unwrap();
+        *guard = handler;
+    }
+}
+
+impl AuthHandler for LocalAuthHandler {
+    fn name(&self) -> &EndpointName {
+        &self.name
+    }
+
+    fn handle_auth(
+        self: Arc<Self>,
+        req: AuthRequest,
+    ) -> Pin<Box<dyn Future<Output = APIResult<AuthResponse>> + Send + 'static>> {
+        let this = self.clone();
+        Box::pin(async move {
+            let handler = {
+                let guard = this.handler.read().unwrap();
+                // If we don't have a handler set, return an error.
+                let Some(handler) = guard.as_ref() else {
+                    return Err(api::Error::internal(anyhow::anyhow!(
+                        "auth handler implementation not registered for {}",
+                        this.name
+                    )));
+                };
+                handler.clone()
+            };
+
+            let query = match &self.schema.query {
+                None => None,
+                Some(qry) => qry.parse(req.query.as_deref())?,
+            };
+            let header = match &self.schema.header {
+                None => None,
+                Some(hdr) => hdr.parse(&req.headers)?,
+            };
+            let cookie = match &self.schema.cookie {
+                None => None,
+                Some(c) => c.parse_req(&req.headers)?,
+            };
+
+            let meta = req.call_meta;
+            let span_id = meta.this_span_id.unwrap_or_else(model::SpanId::generate);
+            let span = model::SpanKey(meta.trace_id, span_id);
+            let parent_span = meta.parent_span_id.map(|sp| meta.trace_id.with_span(sp));
+
+            let req = Arc::new(model::Request {
+                span,
+                parent_trace: None,
+                parent_span,
+                caller_event_id: meta.parent_event_id,
+                ext_correlation_id: meta.ext_correlation_id,
+                is_platform_request: false, // TODO
+                internal_caller: None,      // TODO
+                start: tokio::time::Instant::now(),
+                start_time: std::time::SystemTime::now(),
+                data: RequestData::Auth(AuthRequestData {
+                    auth_handler: this.name().clone(),
+                    parsed_payload: AuthPayload {
+                        query,
+                        header,
+                        cookie,
+                    },
+                }),
+            });
+
+            let logger = crate::log::root();
+            logger.info(Some(&req), "running auth handler", None);
+
+            self.tracer.request_span_start(&req, false);
+            let auth_response: HandlerResponse = handler.call(req.clone()).await;
+            let duration = tokio::time::Instant::now().duration_since(req.start);
+
+            if let Err(e) = &auth_response {
+                logger.error(Some(&req), "auth handler failed", Some(e), None);
+            }
+            logger.info(Some(&req), "auth handler completed", {
+                let mut fields = crate::log::Fields::new();
+                let dur_ms = (duration.as_secs() as f64 * 1000f64)
+                    + (duration.subsec_nanos() as f64 / 1_000_000f64);
+                fields.insert(
+                    "duration".into(),
+                    serde_json::Value::Number(serde_json::Number::from_f64(dur_ms).unwrap_or_else(
+                        || {
+                            // Fall back to integer if the f64 conversion fails
+                            serde_json::Number::from(duration.as_millis() as u64)
+                        },
+                    )),
+                );
+                Some(fields)
+            });
+
+            let result: APIResult<(PValues, String)> = match auth_response {
+                Ok(HandlerResponseInner {
+                    payload: Some(payload),
+                    ..
+                }) => {
+                    let auth_uid = payload
+                        .get("userID")
+                        .and_then(|v| v.as_str())
+                        .map(String::from);
+                    match auth_uid {
+                        Some(uid) => Ok((payload, uid.to_string())),
+                        None => Err(api::Error {
+                            code: api::ErrCode::Unauthenticated,
+                            message: "unauthenticated".to_string(),
+                            internal_message: Some(
+                                "auth handler did not return a userID field".to_string(),
+                            ),
+                            stack: None,
+                            details: None,
+                        }),
+                    }
+                }
+                Ok(HandlerResponseInner { payload: None, .. }) => Err(api::Error {
+                    code: api::ErrCode::Unauthenticated,
+                    message: "unauthenticated".to_string(),
+                    internal_message: Some("auth handler returned null".to_string()),
+                    stack: None,
+                    details: None,
+                }),
+                Err(e) => Err(e),
+            };
+
+            match result {
+                Ok((auth_data, auth_uid)) => {
+                    let model_resp = model::Response {
+                        request: req.clone(),
+                        duration,
+                        data: model::ResponseData::Auth(Ok(model::AuthSuccessResponse {
+                            user_data: auth_data.clone(),
+                            user_id: auth_uid.clone(),
+                        })),
+                    };
+                    self.tracer.request_span_end(&model_resp, false);
+                    Ok(AuthResponse::Authenticated {
+                        auth_uid,
+                        auth_data,
+                    })
+                }
+                Err(e) => {
+                    let model_resp = model::Response {
+                        request: req.clone(),
+                        duration,
+                        data: model::ResponseData::Auth(Err(e.clone())),
+                    };
+                    self.tracer.request_span_end(&model_resp, false);
+                    Err(e)
+                }
+            }
+        })
+    }
+}
diff --git a/runtimes/core/src/api/auth/mod.rs b/runtimes/core/src/api/auth/mod.rs
new file mode 100644
index 0000000000..03a03087e8
--- /dev/null
+++ b/runtimes/core/src/api/auth/mod.rs
@@ -0,0 +1,265 @@
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+use http::header::COOKIE;
+use serde::Serialize;
+
+use crate::api::reqauth::CallMeta;
+use crate::api::APIResult;
+use crate::{api, EndpointName};
+
+use crate::api::schema::encoding::Schema;
+pub use local::LocalAuthHandler;
+pub use remote::RemoteAuthHandler;
+
+use super::jsonschema::JSONSchema;
+use super::PValues;
+
+mod local;
+mod remote;
+
+pub type AxumRequest = axum::http::Request<axum::body::Body>;
+
+#[derive(Debug)]
+pub struct AuthRequest {
+    pub headers: axum::http::HeaderMap,
+    pub query: Option<String>,
+    pub call_meta: CallMeta,
+}
+
+#[derive(Debug)]
+pub enum AuthResponse {
+    Authenticated {
+        auth_uid: String,
+        auth_data: PValues,
+    },
+    Unauthenticated {
+        error: api::Error,
+    },
+}
+
+/// A trait for handlers that accept auth parameters and return an auth result.
+pub trait AuthHandler: Sync + Send + 'static {
+    fn name(&self) -> &EndpointName;
+
+    fn handle_auth(
+        self: Arc<Self>,
+        req: AuthRequest,
+    ) -> Pin<Box<dyn Future<Output = APIResult<AuthResponse>> + Send + 'static>>;
+}
+
+pub struct Authenticator {
+    schema: Schema,
+    auth_data: JSONSchema,
+    auth_handler: AuthHandlerType,
+}
+
+#[derive(Clone)]
+pub enum AuthHandlerType {
+    Local(Arc<LocalAuthHandler>),
+    Remote(Arc<RemoteAuthHandler>),
+}
+
+impl AuthHandlerType {
+    fn set_local_handler(&self, handler: Option<Arc<dyn api::TypedHandler>>) {
+        if let Self::Local(local) = self {
+            local.set_handler(handler);
+        }
+    }
+}
+
+impl Authenticator {
+    pub fn new(
+        schema: Schema,
+        auth_data: JSONSchema,
+        auth_handler: AuthHandlerType,
+    ) -> anyhow::Result<Self> {
+        Ok(Self {
+            schema,
+            auth_data,
+            auth_handler,
+        })
+    }
+
+    pub fn local(
+        schema: Schema,
+        auth_data: JSONSchema,
+        local: LocalAuthHandler,
+    ) -> anyhow::Result<Self> {
+        Self::new(schema, auth_data, AuthHandlerType::Local(Arc::new(local)))
+    }
+
+    pub fn remote(
+        schema: Schema,
+        auth_data: JSONSchema,
+        remote: RemoteAuthHandler,
+    ) -> anyhow::Result<Self> {
+        Self::new(schema, auth_data, AuthHandlerType::Remote(Arc::new(remote)))
+    }
+
+    pub fn schema(&self) -> &Schema {
+        &self.schema
+    }
+
+    pub fn auth_data(&self) -> &JSONSchema {
+        &self.auth_data
+    }
+
+    pub async fn authenticate<R: InboundRequest>(
+        &self,
+        req: &R,
+        meta: CallMeta,
+    ) -> APIResult<AuthResponse> {
+        if !self.contains_auth_params(req) {
+            return Ok(AuthResponse::Unauthenticated {
+                error: api::Error::unauthenticated(),
+            });
+        }
+
+        let auth_req = self.build_auth_request(req, meta);
+        let resp = match &self.auth_handler {
+            AuthHandlerType::Local(local) => local.clone().handle_auth(auth_req).await,
+            AuthHandlerType::Remote(remote) => remote.clone().handle_auth(auth_req).await,
+        };
+        match resp {
+            Ok(resp) => Ok(resp),
+            Err(error) if error.code == api::ErrCode::Unauthenticated => {
+                Ok(AuthResponse::Unauthenticated { error })
+            }
+            Err(err) => Err(err),
+        }
+    }
+
+    pub fn set_local_handler_impl(&self, handler: Option<Arc<dyn api::TypedHandler>>) {
+        self.auth_handler.set_local_handler(handler);
+    }
+
+    fn build_auth_request<R: InboundRequest>(
+        &self,
+        inbound: &R,
+        mut call_meta: CallMeta,
+    ) -> AuthRequest {
+        // Ignore the parent span id as gateways don't currently record a span.
+        call_meta.parent_span_id = None;
+
+        // Headers.
+        let mut headers = match &self.schema.header {
+            None => axum::http::header::HeaderMap::new(),
+            Some(schema) => {
+                let mut dest = axum::http::header::HeaderMap::with_capacity(schema.len());
+                let inbound_headers = inbound.headers();
+                for (json_key, field) in schema.fields() {
+                    let header_name = field.name_override.as_deref().unwrap_or(json_key.as_ref());
+                    let Ok(header_name) =
+                        axum::http::HeaderName::from_bytes(header_name.as_bytes())
+                    else {
+                        continue;
+                    };
+                    for value in inbound_headers.get_all(&header_name) {
+                        dest.append(header_name.clone(), value.to_owned());
+                    }
+                }
+                dest
+            }
+        };
+
+        // Cookies.
+        if let Some(schema) = &self.schema.cookie {
+            let mut inbound_cookies = cookie::CookieJar::new();
+            inbound
+                .headers()
+                .get_all(COOKIE)
+                .iter()
+                .filter_map(|raw| raw.to_str().ok())
+                .flat_map(cookie::Cookie::split_parse)
+                .flatten()
+                .for_each(|c| inbound_cookies.add_original(c.into_owned()));
+
+            for (key, field) in schema.fields() {
+                let cookie_name = field.name_override.as_deref().unwrap_or(key.as_ref());
+                let Some(c) = inbound_cookies.get(cookie_name) else {
+                    continue;
+                };
+                let Ok(val) = axum::http::HeaderValue::from_bytes(c.to_string().as_bytes()) else {
+                    continue;
+                };
+
+                headers.append(http::header::COOKIE, val);
+            }
+        };
+
+        // Move query params.
+        let query = match &self.schema.query {
+            None => None,
+            Some(schema) => {
+                let query_data = inbound.query().unwrap_or_default().as_bytes();
+                let parsed = form_urlencoded::parse(query_data);
+
+                let mut dest = form_urlencoded::Serializer::new(String::new());
+                for (key, value) in parsed {
+                    if schema.contains_name(key.as_ref()) {
+                        dest.append_pair(key.as_ref(), value.as_ref());
+                    }
+                }
+
+                Some(dest.finish())
+            }
+        };
+
+        AuthRequest {
+            headers,
+            query,
+            call_meta,
+        }
+    }
+
+    fn contains_auth_params<R: InboundRequest>(&self, req: &R) -> bool {
+        if let Some(query) = &self.schema.query {
+            if query.contains_any(req.query().unwrap_or_default().as_bytes()) {
+                return true;
+            }
+        }
+
+        if let Some(header) = &self.schema.header {
+            if header.contains_any(&req.headers()) {
+                return true;
+            }
+        }
+
+        if let Some(cookie) = &self.schema.cookie {
+            if cookie.contains_any(&req.headers()) {
+                return true;
+            }
+        }
+
+        false
+    }
+}
+
+#[derive(Debug, Serialize, Clone)]
+pub struct AuthPayload {
+    #[serde(flatten)]
+    pub query: Option<PValues>,
+
+    #[serde(flatten)]
+    pub header: Option<PValues>,
+
+    #[serde(flatten)]
+    pub cookie: Option<PValues>,
+}
+
+pub trait InboundRequest {
+    fn headers(&self) -> &axum::http::HeaderMap;
+    fn query(&self) -> Option<&str>;
+}
+
+impl InboundRequest for axum::http::Request<axum::body::Body> {
+    fn headers(&self) -> &axum::http::HeaderMap {
+        self.headers()
+    }
+
+    fn query(&self) -> Option<&str> {
+        self.uri().query()
+    }
+}
diff --git a/runtimes/core/src/api/auth/remote.rs b/runtimes/core/src/api/auth/remote.rs
new file mode 100644
index 0000000000..ab67717783
--- /dev/null
+++ b/runtimes/core/src/api/auth/remote.rs
@@ -0,0 +1,190 @@
+use crate::api::auth::{AuthHandler, AuthRequest, AuthResponse};
+use crate::api::call::{CallDesc, ServiceRegistry};
+use crate::api::httputil::{convert_headers, join_url_path, merge_query};
+use crate::api::jsonschema::{DecodeConfig, JSONSchema};
+use crate::api::reqauth::caller::Caller;
+use crate::api::reqauth::meta::{MetaKey, MetaMap};
+use crate::api::reqauth::svcauth;
+use crate::api::{APIResult, PValues};
+use crate::{api, EndpointName};
+use anyhow::Context;
+use std::borrow::Cow;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+pub struct RemoteAuthHandler {
+    name: EndpointName,
+    svc_auth_method: Arc<dyn svcauth::ServiceAuthMethod>,
+    auth_handler_url: reqwest::Url,
+    http_client: reqwest::Client,
+    auth_data_schema: JSONSchema,
+}
+
+impl RemoteAuthHandler {
+    pub fn new(
+        name: EndpointName,
+        reg: &ServiceRegistry,
+        http_client: reqwest::Client,
+        auth_data_schema: JSONSchema,
+    ) -> anyhow::Result<Self> {
+        let svc_auth_method = reg
+            .service_auth_method(name.service())
+            .context("no service auth method found for auth handler")?;
+
+        let auth_handler_url = {
+            let mut base_url: reqwest::Url = reg
+                .service_base_url(name.service())
+                .context("no base url found for auth handler")?
+                .parse()
+                .context("invalid service base url")?;
+
+            let auth_path = format!("/__encore/authhandler/{}", name.endpoint());
+            let combined_path =
+                join_url_path(base_url.path(), &auth_path).context("invalid auth handler path")?;
+            base_url.set_path(&combined_path);
+            base_url
+        };
+
+        Ok(Self {
+            name,
+            svc_auth_method,
+            auth_handler_url,
+            http_client,
+            auth_data_schema,
+        })
+    }
+
+    fn build_req(&self, auth_req: &AuthRequest) -> APIResult<reqwest::Request> {
+        let dest = self.auth_handler_url.clone();
+        let mut req = self
+            .http_client
+            .post(dest)
+            .headers(convert_headers(&auth_req.headers))
+            .build()
+            .map_err(api::Error::internal)?;
+
+        if let Some(query) = merge_query(req.url().query(), auth_req.query.as_deref()) {
+            let query = query.as_ref();
+            req.url_mut().set_query(Some(query));
+        }
+
+        Ok(req)
+    }
+
+    async fn handle_auth(self: Arc<Self>, req: AuthRequest) -> APIResult<AuthResponse> {
+        // TODO this is copied from the Go version but should be better designed.
+        // We should have a way of identifying the gateway as the caller.
+        // There is Caller::Gateway but it means something else.
+        let caller = Caller::APIEndpoint(EndpointName::new("gateway", "__encore/authhandler"));
+
+        let meta = &req.call_meta;
+        let desc: CallDesc<()> = CallDesc {
+            caller: &caller,
+            parent_span: meta.parent_span_id.map(|sp| meta.trace_id.with_span(sp)),
+            parent_event_id: None,
+            ext_correlation_id: meta
+                .ext_correlation_id
+                .as_ref()
+                .map(|s| Cow::Borrowed(s.as_str())),
+            auth_user_id: None,
+            auth_data: None,
+            svc_auth_method: self.svc_auth_method.as_ref(),
+        };
+
+        let mut req = self.build_req(&req)?;
+        desc.add_meta(req.headers_mut())
+            .map_err(api::Error::internal)?;
+
+        let resp = self
+            .http_client
+            .execute(req)
+            .await
+            .map_err(api::Error::internal)?;
+
+        // Resolve the user id, if present, since parse_api_response consumes resp.
+        let user_id = resp
+            .headers()
+            .get_meta(MetaKey::UserId)
+            .map(|s| s.to_string());
+
+        match parse_auth_response(resp, &self.auth_data_schema).await {
+            Ok(data) => {
+                if let Some(user_id) = user_id {
+                    Ok(AuthResponse::Authenticated {
+                        auth_uid: user_id,
+                        auth_data: data,
+                    })
+                } else {
+                    Ok(AuthResponse::Unauthenticated {
+                        error: api::Error::unauthenticated(),
+                    })
+                }
+            }
+
+            // Map the unauthenticated error code to the unauthenticated result.
+            Err(error) if error.code == api::ErrCode::Unauthenticated => {
+                Ok(AuthResponse::Unauthenticated { error })
+            }
+
+            Err(err) => Err(err),
+        }
+    }
+}
+
+impl AuthHandler for RemoteAuthHandler {
+    fn name(&self) -> &EndpointName {
+        &self.name
+    }
+
+    fn handle_auth(
+        self: Arc<Self>,
+        req: AuthRequest,
+    ) -> Pin<Box<dyn Future<Output = APIResult<AuthResponse>> + Send + 'static>> {
+        Box::pin(self.handle_auth(req))
+    }
+}
+
+async fn parse_auth_response(resp: reqwest::Response, schema: &JSONSchema) -> APIResult<PValues> {
+    let status = resp.status();
+    if status.is_success() {
+        // Do we have a JSON response?
+        match resp.headers().get(reqwest::header::CONTENT_TYPE) {
+            Some(content_type) if content_type == "application/json" => {
+                let bytes = resp.bytes().await.map_err(api::Error::internal)?;
+                let mut jsonde = serde_json::Deserializer::from_slice(&bytes);
+                let cfg = DecodeConfig {
+                    coerce_strings: false,
+                    arrays_as_repeated_fields: false,
+                };
+                let value = schema.deserialize(&mut jsonde, cfg).map_err(|e| {
+                    api::Error::invalid_argument("unable to decode response body", e)
+                })?;
+                Ok(value)
+            }
+            _ => Err(api::Error::internal(anyhow::anyhow!(
+                "missing auth data from auth handler"
+            ))),
+        }
+    } else {
+        match resp.headers().get(reqwest::header::CONTENT_TYPE) {
+            Some(content_type) if content_type == "application/json" => {
+                match resp.json::<api::Error>().await {
+                    Ok(data) => Err(data),
+                    Err(e) => Err(api::Error::internal(e)),
+                }
+            }
+            _ => {
+                // We have some non-JSON error response.
+                let body = resp.text().await.unwrap_or_else(|_| "".into());
+                Err(api::Error {
+                    code: api::ErrCode::Internal,
+                    message: body,
+                    internal_message: None,
+                    stack: None,
+                    details: None,
+                })
+            }
+        }
+    }
+}
diff --git a/runtimes/core/src/api/call.rs b/runtimes/core/src/api/call.rs
new file mode 100644
index 0000000000..0aba885e13
--- /dev/null
+++ b/runtimes/core/src/api/call.rs
@@ -0,0 +1,576 @@
+use std::borrow::{Borrow, Cow};
+use std::collections::HashMap;
+use std::future::Future;
+use std::sync::Arc;
+use std::time::SystemTime;
+
+use anyhow::Context;
+use tokio_tungstenite::tungstenite::client::IntoClientRequest;
+use url::Url;
+
+use encore::runtime::v1 as pb;
+
+use crate::api::reqauth::caller::Caller;
+use crate::api::reqauth::meta::MetaKey;
+use crate::api::reqauth::{service_auth_method, svcauth};
+use crate::api::schema::{JSONPayload, ToOutgoingRequest};
+use crate::api::{schema, APIResult, Endpoint, EndpointMap};
+use crate::model::{SpanKey, TraceEventId};
+use crate::names::EndpointName;
+use crate::trace::Tracer;
+use crate::{api, encore, model, secrets, EncoreName, Hosted};
+
+use super::reqauth::meta::MetaMapMut;
+use super::websocket_client::WebSocketClient;
+use super::HandshakeSchema;
+use super::ResponsePayload;
+
+/// Tracks where services are located and how to call them.
+pub struct ServiceRegistry {
+    endpoints: Arc<EndpointMap>,
+    base_urls: HashMap<EncoreName, String>,
+    http_client: reqwest::Client,
+    tracer: Tracer,
+    service_auth: HashMap<EncoreName, Arc<dyn svcauth::ServiceAuthMethod>>,
+    deploy_id: String,
+}
+
+impl ServiceRegistry {
+    #[allow(clippy::too_many_arguments)]
+    pub fn new(
+        secrets: &secrets::Manager,
+        endpoints: Arc<EndpointMap>,
+        env: &pb::Environment,
+        sd: pb::ServiceDiscovery,
+        own_address: Option<&str>,
+        own_auth_methods: &[Arc<dyn svcauth::ServiceAuthMethod>],
+        hosted_services: &Hosted,
+        deploy_id: String,
+        http_client: reqwest::Client,
+        tracer: Tracer,
+    ) -> anyhow::Result<Self> {
+        let mut base_urls = HashMap::with_capacity(sd.services.len());
+        let mut service_auth = HashMap::with_capacity(sd.services.len());
+        for (svc, mut loc) in sd.services {
+            let svc = EncoreName::from(svc);
+            base_urls.insert(svc.clone(), loc.base_url);
+
+            let auth_method = if loc.auth_methods.is_empty() {
+                Arc::new(svcauth::Noop)
+            } else {
+                service_auth_method(secrets, env, loc.auth_methods.swap_remove(0))
+                    .context("compute service auth methods")?
+            };
+            service_auth.insert(svc, auth_method);
+        }
+
+        if let Some(own_address) = own_address {
+            let own_address = format!("http://{own_address}");
+            for svc_name in hosted_services.iter() {
+                if !base_urls.contains_key(svc_name) {
+                    let svc = EncoreName::from(svc_name);
+                    base_urls.insert(svc.clone(), own_address.clone());
+
+                    let auth_method = if own_auth_methods.is_empty() {
+                        Arc::new(svcauth::Noop)
+                    } else {
+                        own_auth_methods[0].clone()
+                    };
+                    service_auth.insert(svc, auth_method);
+                }
+            }
+        } else if !hosted_services.is_empty() {
+            // This shouldn't happen if things are configured correctly.
+            ::log::error!(
+                "internal encore error: cannot host services without provided own address"
+            );
+        }
+
+        Ok(Self {
+            endpoints,
+            base_urls,
+            http_client,
+            tracer,
+            service_auth,
+            deploy_id,
+        })
+    }
+
+    pub fn endpoints(&self) -> &EndpointMap {
+        self.endpoints.as_ref()
+    }
+
+    pub fn service_base_url<Q>(&self, service_name: &Q) -> Option<&String>
+    where
+        EncoreName: Borrow<Q>,
+        Q: Eq + std::hash::Hash + ?Sized,
+    {
+        self.base_urls.get(service_name)
+    }
+
+    pub fn service_auth_method<Q>(
+        &self,
+        service_name: &Q,
+    ) -> Option<Arc<dyn svcauth::ServiceAuthMethod>>
+    where
+        EncoreName: Borrow<Q>,
+        Q: Eq + std::hash::Hash + ?Sized,
+    {
+        self.service_auth.get(service_name).cloned()
+    }
+
+    pub fn api_call(
+        &self,
+        target: EndpointName,
+        data: JSONPayload,
+        source: Option<Arc<model::Request>>,
+        opts: Option<api::CallOpts>,
+    ) -> impl Future<Output = APIResult<ResponsePayload>> + 'static {
+        let tracer = self.tracer.clone();
+        let call = model::APICall { source, target };
+        let start_event_id = tracer.rpc_call_start(&call);
+
+        let fut = self.do_api_call(
+            &call.target,
+            data,
+            call.source.as_deref(),
+            start_event_id,
+            opts.as_ref(),
+        );
+        async move {
+            let result = fut.await;
+            if let Some(start_event_id) = start_event_id {
+                tracer.rpc_call_end(&call, start_event_id, result.as_ref().err());
+            }
+            result
+        }
+    }
+
+    pub fn connect_stream(
+        &self,
+        target: EndpointName,
+        data: JSONPayload,
+        source: Option<Arc<model::Request>>,
+        opts: Option<api::CallOpts>,
+    ) -> impl Future<Output = APIResult<WebSocketClient>> + 'static {
+        let tracer = self.tracer.clone();
+        let call = model::APICall { source, target };
+        let start_event_id = tracer.rpc_call_start(&call);
+
+        let fut = self.do_connect_stream(
+            &call.target,
+            data,
+            call.source.as_deref(),
+            start_event_id,
+            opts.as_ref(),
+        );
+
+        async move {
+            let result = fut.await;
+            if let Some(start_event_id) = start_event_id {
+                tracer.rpc_call_end(&call, start_event_id, result.as_ref().err());
+            }
+            result
+        }
+    }
+
+    fn do_api_call(
+        &self,
+        target: &EndpointName,
+        data: JSONPayload,
+        source: Option<&model::Request>,
+        start_event_id: Option<TraceEventId>,
+        opts: Option<&api::CallOpts>,
+    ) -> impl Future<Output = APIResult<ResponsePayload>> + 'static {
+        let http_client = self.http_client.clone();
+        let req = self.prepare_api_call_request(target, data, source, start_event_id, opts);
+        async move {
+            match req {
+                Ok((req, resp_schema)) => {
+                    let fut = http_client.execute(req);
+                    match fut.await {
+                        Ok(resp) => {
+                            if !resp.status().is_success() {
+                                return Err(extract_error(resp).await);
+                            }
+                            resp_schema.extract(resp).await
+                        }
+                        Err(e) => Err(api::Error::internal(e)),
+                    }
+                }
+                Err(e) => Err(e),
+            }
+        }
+    }
+
+    fn prepare_api_call_request(
+        &self,
+        target: &EndpointName,
+        mut data: JSONPayload,
+        source: Option<&model::Request>,
+        start_event_id: Option<TraceEventId>,
+        opts: Option<&api::CallOpts>,
+    ) -> APIResult<(reqwest::Request, Arc<schema::Response>)> {
+        let base_url = self
+            .base_urls
+            .get(target.service())
+            .ok_or_else(|| api::Error {
+                code: api::ErrCode::NotFound,
+                message: "service not found".into(),
+                internal_message: Some(format!(
+                    "no service discovery configuration found for service {}",
+                    target.service()
+                )),
+                stack: None,
+                details: None,
+            })?;
+
+        let Some(endpoint) = self.endpoints.get(target).cloned() else {
+            return Err(api::Error {
+                code: api::ErrCode::NotFound,
+                message: "endpoint not found".into(),
+                internal_message: Some(format!(
+                    "endpoint {target} not found in application metadata"
+                )),
+                stack: None,
+                details: None,
+            });
+        };
+
+        let req_schema = &endpoint.request[0];
+        let method = req_schema.methods[0];
+        let req_path = req_schema.path.to_request_path(&mut data)?;
+        let req_url = format!("{base_url}{req_path}");
+        let req_url = Url::parse(&req_url).map_err(|_| api::Error {
+            code: api::ErrCode::Internal,
+            message: "failed to build endpoint url".into(),
+            internal_message: Some(format!(
+                "failed to build endpoint url for endpoint {target}"
+            )),
+            stack: None,
+            details: None,
+        })?;
+
+        let mut req = self
+            .http_client
+            .request(method.into(), req_url)
+            .build()
+            .map_err(api::Error::internal)?;
+
+        if let Some(qry) = &req_schema.query {
+            qry.to_outgoing_request(&mut data, &mut req)?;
+        }
+        if let Some(hdr) = &req_schema.header {
+            hdr.to_outgoing_request(&mut data, &mut req)?;
+        }
+        if let Some(c) = &req_schema.cookie {
+            c.to_outgoing_request(&mut data, &mut req)?;
+        }
+
+        match &req_schema.body {
+            schema::RequestBody::Typed(Some(body)) => {
+                body.to_outgoing_request(&mut data, &mut req)?
+            }
+            schema::RequestBody::Typed(None) => {}
+
+            schema::RequestBody::Raw => {
+                return Err(api::Error {
+                    code: api::ErrCode::Internal,
+                    message: "internal error".into(),
+                    internal_message: Some("cannot make api calls to raw endpoints".to_string()),
+                    stack: None,
+                    details: None,
+                });
+            }
+        }
+
+        // Add call metadata.
+        let headers = req.headers_mut();
+        self.propagate_call_meta(headers, &endpoint, source, start_event_id, opts)
+            .map_err(api::Error::internal)?;
+
+        let resp_schema = endpoint.response.clone();
+
+        Ok((req, resp_schema))
+    }
+
+    fn do_connect_stream(
+        &self,
+        target: &EndpointName,
+        data: JSONPayload,
+        source: Option<&model::Request>,
+        start_event_id: Option<TraceEventId>,
+        opts: Option<&api::CallOpts>,
+    ) -> impl Future<Output = APIResult<WebSocketClient>> + 'static {
+        let req = self.prepare_stream_request(target, data, source, start_event_id, opts);
+        async move {
+            match req {
+                Ok((req, outgoing, incoming)) => {
+                    let schema = schema::Stream::new(incoming, outgoing);
+                    WebSocketClient::connect(req, schema).await
+                }
+                Err(e) => Err(e),
+            }
+        }
+    }
+
+    fn prepare_stream_request(
+        &self,
+        target: &EndpointName,
+        mut data: JSONPayload,
+        source: Option<&model::Request>,
+        start_event_id: Option<TraceEventId>,
+        opts: Option<&api::CallOpts>,
+    ) -> APIResult<(
+        http::Request<()>,
+        Arc<schema::Request>,
+        Arc<schema::Response>,
+    )> {
+        let base_url = self
+            .base_urls
+            .get(target.service())
+            .ok_or_else(|| api::Error {
+                code: api::ErrCode::NotFound,
+                message: "service not found".into(),
+                internal_message: Some(format!(
+                    "no service discovery configuration found for service {}",
+                    target.service()
+                )),
+                stack: None,
+                details: None,
+            })?;
+
+        let Some(endpoint) = self.endpoints.get(target) else {
+            return Err(api::Error {
+                code: api::ErrCode::NotFound,
+                message: "endpoint not found".into(),
+                internal_message: Some(format!(
+                    "endpoint {target} not found in application metadata"
+                )),
+                stack: None,
+                details: None,
+            });
+        };
+
+        let Some(handshake) = &endpoint.handshake else {
+            return Err(api::Error {
+                code: api::ErrCode::NotFound,
+                message: "no handshake schema found".into(),
+                internal_message: Some(format!(
+                    "endpoint {target} doesn't have a handshake schema specified"
+                )),
+                stack: None,
+                details: None,
+            });
+        };
+
+        let req_path = handshake.path().to_request_path(&mut data)?;
+
+        let base_url = base_url
+            .replace("http://", "ws://")
+            .replace("https://", "wss://");
+
+        let req_url = Url::parse(&format!("{base_url}{req_path}")).map_err(|_| api::Error {
+            code: api::ErrCode::Internal,
+            message: "failed to build endpoint url".into(),
+            internal_message: Some(format!(
+                "failed to build endpoint url for endpoint {target}"
+            )),
+            stack: None,
+            details: None,
+        })?;
+
+        let mut req = req_url
+            .into_client_request()
+            .map_err(|e| api::Error::invalid_argument("unable to create request", e))?;
+
+        if let HandshakeSchema::Request(req_schema) = handshake.as_ref() {
+            if let Some(qry) = &req_schema.query {
+                qry.to_outgoing_request(&mut data, &mut req)?;
+            }
+
+            if let Some(hdr) = &req_schema.header {
+                hdr.to_outgoing_request(&mut data, &mut req)?;
+            }
+
+            if let Some(c) = &req_schema.cookie {
+                c.to_outgoing_request(&mut data, &mut req)?;
+            }
+        }
+
+        self.propagate_call_meta(req.headers_mut(), endpoint, source, start_event_id, opts)
+            .map_err(api::Error::internal)?;
+
+        let outgoing = endpoint.request[0].clone();
+        let incoming = endpoint.response.clone();
+        Ok((req, outgoing, incoming))
+    }
+
+    fn propagate_call_meta(
+        &self,
+        headers: &mut reqwest::header::HeaderMap,
+        endpoint: &Endpoint,
+        source: Option<&model::Request>,
+        parent_event_id: Option<TraceEventId>,
+        opts: Option<&api::CallOpts>,
+    ) -> anyhow::Result<()> {
+        let svc_auth_method = self
+            .service_auth_method(endpoint.name.service())
+            .ok_or_else(|| api::Error {
+                code: api::ErrCode::NotFound,
+                message: "not found".into(),
+                internal_message: Some(format!(
+                    "no service auth method found for service {}",
+                    endpoint.name.service()
+                )),
+                stack: None,
+                details: None,
+            })?;
+
+        let caller = match source {
+            Some(source) => match source.data {
+                model::RequestData::RPC(ref data) => {
+                    Caller::APIEndpoint(data.endpoint.name.clone())
+                }
+                model::RequestData::Auth(ref data) => {
+                    Caller::APIEndpoint(data.auth_handler.clone())
+                }
+                model::RequestData::PubSub(ref data) => Caller::PubSubMessage {
+                    topic: data.topic.clone(),
+                    subscription: data.subscription.clone(),
+                    message_id: data.message_id.clone(),
+                },
+                model::RequestData::Stream(ref data) => {
+                    Caller::APIEndpoint(data.endpoint.name.clone())
+                }
+            },
+            None => Caller::App {
+                deploy_id: self.deploy_id.clone(),
+            },
+        };
+
+        let auth_opts = opts.as_ref().and_then(|o| o.auth.as_ref());
+
+        let auth_data = auth_opts.map(|o| &o.data).or_else(|| {
+            source.and_then(|r| match &r.data {
+                model::RequestData::RPC(data) => data.auth_data.as_ref(),
+                model::RequestData::Stream(data) => data.auth_data.as_ref(),
+                model::RequestData::Auth(_) => None,
+                model::RequestData::PubSub(_) => None,
+            })
+        });
+
+        let auth_user_id = auth_opts
+            .map(|o| &o.user_id)
+            .or_else(|| {
+                source.and_then(|r| match &r.data {
+                    model::RequestData::RPC(data) => data.auth_user_id.as_ref(),
+                    model::RequestData::Stream(data) => data.auth_user_id.as_ref(),
+                    model::RequestData::Auth(_) => None,
+                    model::RequestData::PubSub(_) => None,
+                })
+            })
+            .map(|id| Cow::Borrowed(id.as_str()));
+
+        let desc = CallDesc {
+            caller: &caller,
+            svc_auth_method: svc_auth_method.as_ref(),
+            parent_span: source.map(|r| r.span),
+            parent_event_id,
+            ext_correlation_id: source.and_then(|r| {
+                r.ext_correlation_id
+                    .as_ref()
+                    .map(|id| Cow::Borrowed(id.as_str()))
+            }),
+            auth_user_id,
+            auth_data,
+        };
+
+        desc.add_meta(headers)?;
+
+        Ok(())
+    }
+}
+
+pub struct CallDesc<'a, AuthData> {
+    pub caller: &'a Caller,
+
+    pub parent_span: Option<SpanKey>,
+    pub parent_event_id: Option<TraceEventId>,
+    pub ext_correlation_id: Option<Cow<'a, str>>,
+
+    pub auth_user_id: Option<Cow<'a, str>>,
+    pub auth_data: Option<AuthData>,
+
+    pub svc_auth_method: &'a dyn svcauth::ServiceAuthMethod,
+}
+
+impl<'a, AuthData> CallDesc<'a, AuthData>
+where
+    AuthData: serde::ser::Serialize + 'a,
+{
+    pub fn add_meta<R: MetaMapMut>(self, headers: &mut R) -> anyhow::Result<()> {
+        headers.set(MetaKey::Version, "1".to_string())?;
+
+        if let Some(span) = self.parent_span {
+            headers.set(
+                MetaKey::TraceParent,
+                format!(
+                    "00-{}-{}-01",
+                    span.0.serialize_std(),
+                    span.1.serialize_std(),
+                ),
+            )?;
+
+            let mut trace_state = format!("encore/span-id={}", span.1.serialize_std());
+
+            if let Some(event_id) = self.parent_event_id.map(|id| id.serialize()) {
+                trace_state.push_str(",encore/event-id=");
+                trace_state.push_str(event_id.to_string().as_str());
+            }
+            headers.set(MetaKey::TraceState, trace_state)?;
+        }
+
+        // TODO handle GCP span propagation with tracestate key.
+        // headers.set(MetaKey::TraceState, "")?;
+
+        if let Some(corr_id) = self.ext_correlation_id {
+            headers.set(MetaKey::XCorrelationId, corr_id.into_owned())?;
+        }
+
+        // Add auth data.
+        if let Some(auth_uid) = self.auth_user_id {
+            headers.set(MetaKey::UserId, auth_uid.into_owned())?;
+            if let Some(auth_data) = self.auth_data {
+                if let Ok(auth_data) = serde_json::to_string(&auth_data) {
+                    headers.set(MetaKey::UserData, auth_data)?;
+                }
+            }
+        }
+
+        // Caller.
+        headers.set(MetaKey::Caller, self.caller.serialize())?;
+
+        let now = SystemTime::now();
+
+        self.svc_auth_method
+            .sign(headers, now)
+            .map_err(api::Error::internal)?;
+
+        headers.set(
+            MetaKey::SvcAuthMethod,
+            self.svc_auth_method.name().to_string(),
+        )?;
+
+        Ok(())
+    }
+}
+
+async fn extract_error(resp: reqwest::Response) -> api::Error {
+    match resp.bytes().await {
+        Ok(bytes) => serde_json::from_slice(&bytes).unwrap_or_else(|err| {
+            api::Error::invalid_argument("unable to parse error response", err)
+        }),
+        Err(err) => api::Error::invalid_argument("unable to read response body", err),
+    }
+}
diff --git a/runtimes/core/src/api/cors/cors_headers_config/LICENSE b/runtimes/core/src/api/cors/cors_headers_config/LICENSE
new file mode 100644
index 0000000000..352c2cfa8e
--- /dev/null
+++ b/runtimes/core/src/api/cors/cors_headers_config/LICENSE
@@ -0,0 +1,25 @@
+Copyright (c) 2019-2021 Tower Contributors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
diff --git a/runtimes/core/src/api/cors/cors_headers_config/allow_credentials.rs b/runtimes/core/src/api/cors/cors_headers_config/allow_credentials.rs
new file mode 100644
index 0000000000..b5614ca66b
--- /dev/null
+++ b/runtimes/core/src/api/cors/cors_headers_config/allow_credentials.rs
@@ -0,0 +1,97 @@
+use std::{fmt, sync::Arc};
+
+use http::{
+    header::{self, HeaderName, HeaderValue},
+    request::Parts as RequestParts,
+};
+
+/// Holds configuration for how to set the [`Access-Control-Allow-Credentials`][mdn] header.
+///
+/// See [`CorsLayer::allow_credentials`] for more details.
+///
+/// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials
+/// [`CorsLayer::allow_credentials`]: super::CorsLayer::allow_credentials
+#[derive(Clone, Default)]
+#[must_use]
+pub struct AllowCredentials(AllowCredentialsInner);
+
+impl AllowCredentials {
+    /// Allow credentials for all requests
+    ///
+    /// See [`CorsLayer::allow_credentials`] for more details.
+    ///
+    /// [`CorsLayer::allow_credentials`]: super::CorsLayer::allow_credentials
+    pub fn yes() -> Self {
+        Self(AllowCredentialsInner::Yes)
+    }
+
+    /// Allow credentials for some requests, based on a given predicate
+    ///
+    /// The first argument to the predicate is the request origin.
+    ///
+    /// See [`CorsLayer::allow_credentials`] for more details.
+    ///
+    /// [`CorsLayer::allow_credentials`]: super::CorsLayer::allow_credentials
+    pub fn predicate<F>(f: F) -> Self
+    where
+        F: Fn(&HeaderValue, &RequestParts) -> bool + Send + Sync + 'static,
+    {
+        Self(AllowCredentialsInner::Predicate(Arc::new(f)))
+    }
+
+    pub(super) fn is_true(&self) -> bool {
+        matches!(&self.0, AllowCredentialsInner::Yes)
+    }
+
+    pub(super) fn to_header(
+        &self,
+        origin: Option<&HeaderValue>,
+        parts: &RequestParts,
+    ) -> Option<(HeaderName, HeaderValue)> {
+        #[allow(clippy::declare_interior_mutable_const)]
+        const TRUE: HeaderValue = HeaderValue::from_static("true");
+
+        let allow_creds = match &self.0 {
+            AllowCredentialsInner::Yes => true,
+            AllowCredentialsInner::No => false,
+            AllowCredentialsInner::Predicate(c) => c(origin?, parts),
+        };
+
+        allow_creds.then_some((header::ACCESS_CONTROL_ALLOW_CREDENTIALS, TRUE))
+    }
+}
+
+impl From<bool> for AllowCredentials {
+    fn from(v: bool) -> Self {
+        match v {
+            true => Self(AllowCredentialsInner::Yes),
+            false => Self(AllowCredentialsInner::No),
+        }
+    }
+}
+
+impl fmt::Debug for AllowCredentials {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self.0 {
+            AllowCredentialsInner::Yes => f.debug_tuple("Yes").finish(),
+            AllowCredentialsInner::No => f.debug_tuple("No").finish(),
+            AllowCredentialsInner::Predicate(_) => f.debug_tuple("Predicate").finish(),
+        }
+    }
+}
+
+type PredicateFn =
+    Arc<dyn for<'a> Fn(&'a HeaderValue, &'a RequestParts) -> bool + Send + Sync + 'static>;
+
+#[derive(Clone)]
+enum AllowCredentialsInner {
+    Yes,
+    No,
+    Predicate(PredicateFn),
+}
+
+impl Default for AllowCredentialsInner {
+    fn default() -> Self {
+        Self::No
+    }
+}
diff --git a/runtimes/core/src/api/cors/cors_headers_config/allow_headers.rs b/runtimes/core/src/api/cors/cors_headers_config/allow_headers.rs
new file mode 100644
index 0000000000..8e49e78055
--- /dev/null
+++ b/runtimes/core/src/api/cors/cors_headers_config/allow_headers.rs
@@ -0,0 +1,111 @@
+use std::fmt;
+
+use http::{
+    header::{self, HeaderName, HeaderValue},
+    request::Parts as RequestParts,
+};
+
+use super::{separated_by_commas, Any, WILDCARD};
+
+/// Holds configuration for how to set the [`Access-Control-Allow-Headers`][mdn] header.
+///
+/// See [`CorsLayer::allow_headers`] for more details.
+///
+/// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
+/// [`CorsLayer::allow_headers`]: super::CorsLayer::allow_headers
+#[derive(Clone, Default)]
+#[must_use]
+pub struct AllowHeaders(AllowHeadersInner);
+
+impl AllowHeaders {
+    /// Allow any headers by sending a wildcard (`*`)
+    ///
+    /// See [`CorsLayer::allow_headers`] for more details.
+    ///
+    /// [`CorsLayer::allow_headers`]: super::CorsLayer::allow_headers
+    pub fn any() -> Self {
+        Self(AllowHeadersInner::Const(Some(WILDCARD)))
+    }
+
+    /// Set multiple allowed headers
+    ///
+    /// See [`CorsLayer::allow_headers`] for more details.
+    ///
+    /// [`CorsLayer::allow_headers`]: super::CorsLayer::allow_headers
+    pub fn list<I>(headers: I) -> Self
+    where
+        I: IntoIterator<Item = HeaderName>,
+    {
+        Self(AllowHeadersInner::Const(separated_by_commas(
+            headers.into_iter().map(Into::into),
+        )))
+    }
+
+    /// Allow any headers, by mirroring the preflight [`Access-Control-Request-Headers`][mdn]
+    /// header.
+    ///
+    /// See [`CorsLayer::allow_headers`] for more details.
+    ///
+    /// [`CorsLayer::allow_headers`]: super::CorsLayer::allow_headers
+    ///
+    /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers
+    pub fn mirror_request() -> Self {
+        Self(AllowHeadersInner::MirrorRequest)
+    }
+
+    #[allow(clippy::borrow_interior_mutable_const)]
+    pub(super) fn is_wildcard(&self) -> bool {
+        matches!(&self.0, AllowHeadersInner::Const(Some(v)) if v == WILDCARD)
+    }
+
+    pub(super) fn to_header(&self, parts: &RequestParts) -> Option<(HeaderName, HeaderValue)> {
+        let allow_headers = match &self.0 {
+            AllowHeadersInner::Const(v) => v.clone()?,
+            AllowHeadersInner::MirrorRequest => parts
+                .headers
+                .get(header::ACCESS_CONTROL_REQUEST_HEADERS)?
+                .clone(),
+        };
+
+        Some((header::ACCESS_CONTROL_ALLOW_HEADERS, allow_headers))
+    }
+}
+
+impl fmt::Debug for AllowHeaders {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match &self.0 {
+            AllowHeadersInner::Const(inner) => f.debug_tuple("Const").field(inner).finish(),
+            AllowHeadersInner::MirrorRequest => f.debug_tuple("MirrorRequest").finish(),
+        }
+    }
+}
+
+impl From<Any> for AllowHeaders {
+    fn from(_: Any) -> Self {
+        Self::any()
+    }
+}
+
+impl<const N: usize> From<[HeaderName; N]> for AllowHeaders {
+    fn from(arr: [HeaderName; N]) -> Self {
+        Self::list(arr)
+    }
+}
+
+impl From<Vec<HeaderName>> for AllowHeaders {
+    fn from(vec: Vec<HeaderName>) -> Self {
+        Self::list(vec)
+    }
+}
+
+#[derive(Clone)]
+enum AllowHeadersInner {
+    Const(Option<HeaderValue>),
+    MirrorRequest,
+}
+
+impl Default for AllowHeadersInner {
+    fn default() -> Self {
+        Self::Const(None)
+    }
+}
diff --git a/runtimes/core/src/api/cors/cors_headers_config/allow_methods.rs b/runtimes/core/src/api/cors/cors_headers_config/allow_methods.rs
new file mode 100644
index 0000000000..a2aeb64201
--- /dev/null
+++ b/runtimes/core/src/api/cors/cors_headers_config/allow_methods.rs
@@ -0,0 +1,131 @@
+use std::fmt;
+
+use http::{
+    header::{self, HeaderName, HeaderValue},
+    request::Parts as RequestParts,
+    Method,
+};
+
+use super::{separated_by_commas, Any, WILDCARD};
+
+/// Holds configuration for how to set the [`Access-Control-Allow-Methods`][mdn] header.
+///
+/// See [`CorsLayer::allow_methods`] for more details.
+///
+/// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
+/// [`CorsLayer::allow_methods`]: super::CorsLayer::allow_methods
+#[derive(Clone, Default)]
+#[must_use]
+pub struct AllowMethods(AllowMethodsInner);
+
+impl AllowMethods {
+    /// Allow any method by sending a wildcard (`*`)
+    ///
+    /// See [`CorsLayer::allow_methods`] for more details.
+    ///
+    /// [`CorsLayer::allow_methods`]: super::CorsLayer::allow_methods
+    pub fn any() -> Self {
+        Self(AllowMethodsInner::Const(Some(WILDCARD)))
+    }
+
+    /// Set a single allowed method
+    ///
+    /// See [`CorsLayer::allow_methods`] for more details.
+    ///
+    /// [`CorsLayer::allow_methods`]: super::CorsLayer::allow_methods
+    pub fn exact(method: Method) -> Self {
+        Self(AllowMethodsInner::Const(Some(
+            HeaderValue::from_str(method.as_str()).unwrap(),
+        )))
+    }
+
+    /// Set multiple allowed methods
+    ///
+    /// See [`CorsLayer::allow_methods`] for more details.
+    ///
+    /// [`CorsLayer::allow_methods`]: super::CorsLayer::allow_methods
+    pub fn list<I>(methods: I) -> Self
+    where
+        I: IntoIterator<Item = Method>,
+    {
+        Self(AllowMethodsInner::Const(separated_by_commas(
+            methods
+                .into_iter()
+                .map(|m| HeaderValue::from_str(m.as_str()).unwrap()),
+        )))
+    }
+
+    /// Allow any method, by mirroring the preflight [`Access-Control-Request-Method`][mdn]
+    /// header.
+    ///
+    /// See [`CorsLayer::allow_methods`] for more details.
+    ///
+    /// [`CorsLayer::allow_methods`]: super::CorsLayer::allow_methods
+    ///
+    /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method
+    pub fn mirror_request() -> Self {
+        Self(AllowMethodsInner::MirrorRequest)
+    }
+
+    #[allow(clippy::borrow_interior_mutable_const)]
+    pub(super) fn is_wildcard(&self) -> bool {
+        matches!(&self.0, AllowMethodsInner::Const(Some(v)) if v == WILDCARD)
+    }
+
+    pub(super) fn to_header(&self, parts: &RequestParts) -> Option<(HeaderName, HeaderValue)> {
+        let allow_methods = match &self.0 {
+            AllowMethodsInner::Const(v) => v.clone()?,
+            AllowMethodsInner::MirrorRequest => parts
+                .headers
+                .get(header::ACCESS_CONTROL_REQUEST_METHOD)?
+                .clone(),
+        };
+
+        Some((header::ACCESS_CONTROL_ALLOW_METHODS, allow_methods))
+    }
+}
+
+impl fmt::Debug for AllowMethods {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match &self.0 {
+            AllowMethodsInner::Const(inner) => f.debug_tuple("Const").field(inner).finish(),
+            AllowMethodsInner::MirrorRequest => f.debug_tuple("MirrorRequest").finish(),
+        }
+    }
+}
+
+impl From<Any> for AllowMethods {
+    fn from(_: Any) -> Self {
+        Self::any()
+    }
+}
+
+impl From<Method> for AllowMethods {
+    fn from(method: Method) -> Self {
+        Self::exact(method)
+    }
+}
+
+impl<const N: usize> From<[Method; N]> for AllowMethods {
+    fn from(arr: [Method; N]) -> Self {
+        Self::list(arr)
+    }
+}
+
+impl From<Vec<Method>> for AllowMethods {
+    fn from(vec: Vec<Method>) -> Self {
+        Self::list(vec)
+    }
+}
+
+#[derive(Clone)]
+enum AllowMethodsInner {
+    Const(Option<HeaderValue>),
+    MirrorRequest,
+}
+
+impl Default for AllowMethodsInner {
+    fn default() -> Self {
+        Self::Const(None)
+    }
+}
diff --git a/runtimes/core/src/api/cors/cors_headers_config/allow_origin.rs b/runtimes/core/src/api/cors/cors_headers_config/allow_origin.rs
new file mode 100644
index 0000000000..244bf86563
--- /dev/null
+++ b/runtimes/core/src/api/cors/cors_headers_config/allow_origin.rs
@@ -0,0 +1,156 @@
+use http::{
+    header::{self, HeaderValue},
+    request::Parts as RequestParts,
+    HeaderName,
+};
+use std::{fmt, sync::Arc};
+
+use super::{Any, WILDCARD};
+
+/// Holds configuration for how to set the [`Access-Control-Allow-Origin`][mdn] header.
+///
+/// See [`CorsLayer::allow_origin`] for more details.
+///
+/// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
+/// [`CorsLayer::allow_origin`]: super::CorsLayer::allow_origin
+#[derive(Clone, Default)]
+#[must_use]
+pub struct AllowOrigin(OriginInner);
+
+impl AllowOrigin {
+    /// Allow any origin by sending a wildcard (`*`)
+    ///
+    /// See [`CorsLayer::allow_origin`] for more details.
+    ///
+    /// [`CorsLayer::allow_origin`]: super::CorsLayer::allow_origin
+    pub fn any() -> Self {
+        Self(OriginInner::Const(WILDCARD))
+    }
+
+    /// Set a single allowed origin
+    ///
+    /// See [`CorsLayer::allow_origin`] for more details.
+    ///
+    /// [`CorsLayer::allow_origin`]: super::CorsLayer::allow_origin
+    pub fn exact(origin: HeaderValue) -> Self {
+        Self(OriginInner::Const(origin))
+    }
+
+    /// Set multiple allowed origins
+    ///
+    /// See [`CorsLayer::allow_origin`] for more details.
+    ///
+    /// # Panics
+    ///
+    /// If the iterator contains a wildcard (`*`).
+    ///
+    /// [`CorsLayer::allow_origin`]: super::CorsLayer::allow_origin
+    #[allow(clippy::borrow_interior_mutable_const)]
+    pub fn list<I>(origins: I) -> Self
+    where
+        I: IntoIterator<Item = HeaderValue>,
+    {
+        let origins = origins.into_iter().collect::<Vec<_>>();
+        if origins.contains(&WILDCARD) {
+            panic!(
+                "Wildcard origin (`*`) cannot be passed to `AllowOrigin::list`. \
+                 Use `AllowOrigin::any()` instead"
+            );
+        }
+
+        Self(OriginInner::List(origins))
+    }
+
+    /// Set the allowed origins from a predicate
+    ///
+    /// See [`CorsLayer::allow_origin`] for more details.
+    ///
+    /// [`CorsLayer::allow_origin`]: super::CorsLayer::allow_origin
+    pub fn predicate<F>(f: F) -> Self
+    where
+        F: Fn(&HeaderValue, &RequestParts) -> bool + Send + Sync + 'static,
+    {
+        Self(OriginInner::Predicate(Arc::new(f)))
+    }
+
+    /// Allow any origin, by mirroring the request origin
+    ///
+    /// This is equivalent to
+    /// [`AllowOrigin::predicate(|_, _| true)`][Self::predicate].
+    ///
+    /// See [`CorsLayer::allow_origin`] for more details.
+    ///
+    /// [`CorsLayer::allow_origin`]: super::CorsLayer::allow_origin
+    pub fn mirror_request() -> Self {
+        Self::predicate(|_, _| true)
+    }
+
+    #[allow(clippy::borrow_interior_mutable_const)]
+    pub(super) fn is_wildcard(&self) -> bool {
+        matches!(&self.0, OriginInner::Const(v) if v == WILDCARD)
+    }
+
+    pub(super) fn to_header(
+        &self,
+        origin: Option<&HeaderValue>,
+        parts: &RequestParts,
+    ) -> Option<(HeaderName, HeaderValue)> {
+        let name = header::ACCESS_CONTROL_ALLOW_ORIGIN;
+
+        match &self.0 {
+            OriginInner::Const(v) => Some((name, v.clone())),
+            OriginInner::List(l) => origin.filter(|o| l.contains(o)).map(|o| (name, o.clone())),
+            OriginInner::Predicate(c) => origin.filter(|o| c(o, parts)).map(|o| (name, o.clone())),
+        }
+    }
+}
+
+impl fmt::Debug for AllowOrigin {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match &self.0 {
+            OriginInner::Const(inner) => f.debug_tuple("Const").field(inner).finish(),
+            OriginInner::List(inner) => f.debug_tuple("List").field(inner).finish(),
+            OriginInner::Predicate(_) => f.debug_tuple("Predicate").finish(),
+        }
+    }
+}
+
+impl From<Any> for AllowOrigin {
+    fn from(_: Any) -> Self {
+        Self::any()
+    }
+}
+
+impl From<HeaderValue> for AllowOrigin {
+    fn from(val: HeaderValue) -> Self {
+        Self::exact(val)
+    }
+}
+
+impl<const N: usize> From<[HeaderValue; N]> for AllowOrigin {
+    fn from(arr: [HeaderValue; N]) -> Self {
+        Self::list(arr)
+    }
+}
+
+impl From<Vec<HeaderValue>> for AllowOrigin {
+    fn from(vec: Vec<HeaderValue>) -> Self {
+        Self::list(vec)
+    }
+}
+
+type PredicateFn =
+    Arc<dyn for<'a> Fn(&'a HeaderValue, &'a RequestParts) -> bool + Send + Sync + 'static>;
+
+#[derive(Clone)]
+enum OriginInner {
+    Const(HeaderValue),
+    List(Vec<HeaderValue>),
+    Predicate(PredicateFn),
+}
+
+impl Default for OriginInner {
+    fn default() -> Self {
+        Self::List(Vec::new())
+    }
+}
diff --git a/runtimes/core/src/api/cors/cors_headers_config/allow_private_network.rs b/runtimes/core/src/api/cors/cors_headers_config/allow_private_network.rs
new file mode 100644
index 0000000000..5008a5e8bd
--- /dev/null
+++ b/runtimes/core/src/api/cors/cors_headers_config/allow_private_network.rs
@@ -0,0 +1,188 @@
+use std::{fmt, sync::Arc};
+
+use http::{
+    header::{HeaderName, HeaderValue},
+    request::Parts as RequestParts,
+};
+
+/// Holds configuration for how to set the [`Access-Control-Allow-Private-Network`][wicg] header.
+///
+/// See [`CorsLayer::allow_private_network`] for more details.
+///
+/// [wicg]: https://wicg.github.io/private-network-access/
+/// [`CorsLayer::allow_private_network`]: super::CorsLayer::allow_private_network
+#[derive(Clone, Default)]
+#[must_use]
+pub struct AllowPrivateNetwork(AllowPrivateNetworkInner);
+
+impl AllowPrivateNetwork {
+    /// Allow requests via a more private network than the one used to access the origin
+    ///
+    /// See [`CorsLayer::allow_private_network`] for more details.
+    ///
+    /// [`CorsLayer::allow_private_network`]: super::CorsLayer::allow_private_network
+    pub fn yes() -> Self {
+        Self(AllowPrivateNetworkInner::Yes)
+    }
+
+    /// Allow requests via private network for some requests, based on a given predicate
+    ///
+    /// The first argument to the predicate is the request origin.
+    ///
+    /// See [`CorsLayer::allow_private_network`] for more details.
+    ///
+    /// [`CorsLayer::allow_private_network`]: super::CorsLayer::allow_private_network
+    pub fn predicate<F>(f: F) -> Self
+    where
+        F: Fn(&HeaderValue, &RequestParts) -> bool + Send + Sync + 'static,
+    {
+        Self(AllowPrivateNetworkInner::Predicate(Arc::new(f)))
+    }
+
+    #[allow(
+        clippy::declare_interior_mutable_const,
+        clippy::borrow_interior_mutable_const
+    )]
+    pub(super) fn to_header(
+        &self,
+        origin: Option<&HeaderValue>,
+        parts: &RequestParts,
+    ) -> Option<(HeaderName, HeaderValue)> {
+        #[allow(clippy::declare_interior_mutable_const)]
+        const REQUEST_PRIVATE_NETWORK: HeaderName =
+            HeaderName::from_static("access-control-request-private-network");
+
+        #[allow(clippy::declare_interior_mutable_const)]
+        const ALLOW_PRIVATE_NETWORK: HeaderName =
+            HeaderName::from_static("access-control-allow-private-network");
+
+        const TRUE: HeaderValue = HeaderValue::from_static("true");
+
+        // Cheapest fallback: allow_private_network hasn't been set
+        if let AllowPrivateNetworkInner::No = &self.0 {
+            return None;
+        }
+
+        // Access-Control-Allow-Private-Network is only relevant if the request
+        // has the Access-Control-Request-Private-Network header set, else skip
+        if parts.headers.get(REQUEST_PRIVATE_NETWORK) != Some(&TRUE) {
+            return None;
+        }
+
+        let allow_private_network = match &self.0 {
+            AllowPrivateNetworkInner::Yes => true,
+            AllowPrivateNetworkInner::No => false, // unreachable, but not harmful
+            AllowPrivateNetworkInner::Predicate(c) => c(origin?, parts),
+        };
+
+        allow_private_network.then_some((ALLOW_PRIVATE_NETWORK, TRUE))
+    }
+}
+
+impl From<bool> for AllowPrivateNetwork {
+    fn from(v: bool) -> Self {
+        match v {
+            true => Self(AllowPrivateNetworkInner::Yes),
+            false => Self(AllowPrivateNetworkInner::No),
+        }
+    }
+}
+
+impl fmt::Debug for AllowPrivateNetwork {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self.0 {
+            AllowPrivateNetworkInner::Yes => f.debug_tuple("Yes").finish(),
+            AllowPrivateNetworkInner::No => f.debug_tuple("No").finish(),
+            AllowPrivateNetworkInner::Predicate(_) => f.debug_tuple("Predicate").finish(),
+        }
+    }
+}
+type PredicateFn =
+    Arc<dyn for<'a> Fn(&'a HeaderValue, &'a RequestParts) -> bool + Send + Sync + 'static>;
+
+#[derive(Clone)]
+enum AllowPrivateNetworkInner {
+    Yes,
+    No,
+    Predicate(PredicateFn),
+}
+
+impl Default for AllowPrivateNetworkInner {
+    fn default() -> Self {
+        Self::No
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #![allow(
+        clippy::declare_interior_mutable_const,
+        clippy::borrow_interior_mutable_const
+    )]
+
+    use super::AllowPrivateNetwork;
+    use crate::api::cors::cors_headers_config::CorsHeadersConfig;
+
+    use http::{header::ORIGIN, request::Parts, HeaderName, HeaderValue};
+    use pingora::http::{RequestHeader, ResponseHeader};
+
+    const REQUEST_PRIVATE_NETWORK: HeaderName =
+        HeaderName::from_static("access-control-request-private-network");
+
+    const ALLOW_PRIVATE_NETWORK: HeaderName =
+        HeaderName::from_static("access-control-allow-private-network");
+
+    const TRUE: HeaderValue = HeaderValue::from_static("true");
+
+    #[tokio::test]
+    async fn cors_private_network_header_is_added_correctly() {
+        let conf = CorsHeadersConfig::new().allow_private_network(true);
+
+        let mut req = RequestHeader::build(http::Method::POST, b"/some/path", None).unwrap();
+        req.insert_header(REQUEST_PRIVATE_NETWORK, TRUE).unwrap();
+        let mut resp = ResponseHeader::build(200, None).unwrap();
+
+        conf.apply(&req, &mut resp).unwrap();
+        assert_eq!(resp.headers.get(ALLOW_PRIVATE_NETWORK).unwrap(), TRUE);
+
+        let req = RequestHeader::build(http::Method::POST, b"/some/path", None).unwrap();
+        let mut resp = ResponseHeader::build(200, None).unwrap();
+
+        conf.apply(&req, &mut resp).unwrap();
+        assert!(resp.headers.get(ALLOW_PRIVATE_NETWORK).is_none());
+    }
+
+    #[tokio::test]
+    async fn cors_private_network_header_is_added_correctly_with_predicate() {
+        let allow_private_network =
+            AllowPrivateNetwork::predicate(|origin: &HeaderValue, parts: &Parts| {
+                parts.uri.path() == "/allow-private" && origin == "localhost"
+            });
+
+        let conf = CorsHeadersConfig::new().allow_private_network(allow_private_network);
+
+        let mut req = RequestHeader::build(http::Method::POST, b"/allow-private", None).unwrap();
+        req.insert_header(ORIGIN, "localhost").unwrap();
+        req.insert_header(REQUEST_PRIVATE_NETWORK, TRUE).unwrap();
+        let mut resp = ResponseHeader::build(200, None).unwrap();
+
+        conf.apply(&req, &mut resp).unwrap();
+        assert_eq!(resp.headers.get(ALLOW_PRIVATE_NETWORK).unwrap(), TRUE);
+
+        let mut req = RequestHeader::build(http::Method::POST, b"/other", None).unwrap();
+        req.insert_header(ORIGIN, "localhost").unwrap();
+        req.insert_header(REQUEST_PRIVATE_NETWORK, TRUE).unwrap();
+        let mut resp = ResponseHeader::build(200, None).unwrap();
+
+        conf.apply(&req, &mut resp).unwrap();
+        assert!(resp.headers.get(ALLOW_PRIVATE_NETWORK).is_none());
+
+        let mut req = RequestHeader::build(http::Method::POST, b"/allow-private", None).unwrap();
+        req.insert_header(ORIGIN, "not-localhost").unwrap();
+        req.insert_header(REQUEST_PRIVATE_NETWORK, TRUE).unwrap();
+        let mut resp = ResponseHeader::build(200, None).unwrap();
+
+        conf.apply(&req, &mut resp).unwrap();
+        assert!(resp.headers.get(ALLOW_PRIVATE_NETWORK).is_none());
+    }
+}
diff --git a/runtimes/core/src/api/cors/cors_headers_config/expose_headers.rs b/runtimes/core/src/api/cors/cors_headers_config/expose_headers.rs
new file mode 100644
index 0000000000..e6b904246b
--- /dev/null
+++ b/runtimes/core/src/api/cors/cors_headers_config/expose_headers.rs
@@ -0,0 +1,90 @@
+use std::fmt;
+
+use http::header::{self, HeaderName, HeaderValue};
+
+use super::{separated_by_commas, Any, WILDCARD};
+
+/// Holds configuration for how to set the [`Access-Control-Expose-Headers`][mdn] header.
+///
+/// See [`CorsLayer::expose_headers`] for more details.
+///
+/// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers
+/// [`CorsLayer::expose_headers`]: super::CorsLayer::expose_headers
+#[derive(Clone, Default)]
+#[must_use]
+pub struct ExposeHeaders(ExposeHeadersInner);
+
+impl ExposeHeaders {
+    /// Expose any / all headers by sending a wildcard (`*`)
+    ///
+    /// See [`CorsLayer::expose_headers`] for more details.
+    ///
+    /// [`CorsLayer::expose_headers`]: super::CorsLayer::expose_headers
+    pub fn any() -> Self {
+        Self(ExposeHeadersInner::Const(Some(WILDCARD)))
+    }
+
+    /// Set multiple exposed header names
+    ///
+    /// See [`CorsLayer::expose_headers`] for more details.
+    ///
+    /// [`CorsLayer::expose_headers`]: super::CorsLayer::expose_headers
+    pub fn list<I>(headers: I) -> Self
+    where
+        I: IntoIterator<Item = HeaderName>,
+    {
+        Self(ExposeHeadersInner::Const(separated_by_commas(
+            headers.into_iter().map(Into::into),
+        )))
+    }
+
+    #[allow(clippy::borrow_interior_mutable_const)]
+    pub(super) fn is_wildcard(&self) -> bool {
+        matches!(&self.0, ExposeHeadersInner::Const(Some(v)) if v == WILDCARD)
+    }
+
+    pub(super) fn to_header(&self) -> Option<(HeaderName, HeaderValue)> {
+        let expose_headers = match &self.0 {
+            ExposeHeadersInner::Const(v) => v.clone()?,
+        };
+
+        Some((header::ACCESS_CONTROL_EXPOSE_HEADERS, expose_headers))
+    }
+}
+
+impl fmt::Debug for ExposeHeaders {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match &self.0 {
+            ExposeHeadersInner::Const(inner) => f.debug_tuple("Const").field(inner).finish(),
+        }
+    }
+}
+
+impl From<Any> for ExposeHeaders {
+    fn from(_: Any) -> Self {
+        Self::any()
+    }
+}
+
+impl<const N: usize> From<[HeaderName; N]> for ExposeHeaders {
+    fn from(arr: [HeaderName; N]) -> Self {
+        Self::list(arr)
+    }
+}
+
+impl From<Vec<HeaderName>> for ExposeHeaders {
+    fn from(vec: Vec<HeaderName>) -> Self {
+        Self::list(vec)
+    }
+}
+
+#[derive(Clone)]
+enum ExposeHeadersInner {
+    Const(Option<HeaderValue>),
+}
+
+impl Default for ExposeHeadersInner {
+    fn default() -> Self {
+        ExposeHeadersInner::Const(None)
+    }
+}
diff --git a/runtimes/core/src/api/cors/cors_headers_config/max_age.rs b/runtimes/core/src/api/cors/cors_headers_config/max_age.rs
new file mode 100644
index 0000000000..591f0e6fe6
--- /dev/null
+++ b/runtimes/core/src/api/cors/cors_headers_config/max_age.rs
@@ -0,0 +1,77 @@
+use std::{fmt, sync::Arc, time::Duration};
+
+use http::{
+    header::{self, HeaderName, HeaderValue},
+    request::Parts as RequestParts,
+};
+
+/// Holds configuration for how to set the [`Access-Control-Max-Age`][mdn] header.
+///
+/// See [`CorsLayer::max_age`][super::CorsLayer::max_age] for more details.
+///
+/// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
+#[derive(Clone, Default)]
+#[must_use]
+pub struct MaxAge(MaxAgeInner);
+
+impl MaxAge {
+    /// Set a static max-age value
+    ///
+    /// See [`CorsLayer::max_age`][super::CorsLayer::max_age] for more details.
+    pub fn exact(max_age: Duration) -> Self {
+        Self(MaxAgeInner::Exact(Some(max_age.as_secs().into())))
+    }
+
+    /// Set the max-age based on the preflight request parts
+    ///
+    /// See [`CorsLayer::max_age`][super::CorsLayer::max_age] for more details.
+    pub fn dynamic<F>(f: F) -> Self
+    where
+        F: Fn(&HeaderValue, &RequestParts) -> Duration + Send + Sync + 'static,
+    {
+        Self(MaxAgeInner::Fn(Arc::new(f)))
+    }
+
+    pub(super) fn to_header(
+        &self,
+        origin: Option<&HeaderValue>,
+        parts: &RequestParts,
+    ) -> Option<(HeaderName, HeaderValue)> {
+        let max_age = match &self.0 {
+            MaxAgeInner::Exact(v) => v.clone()?,
+            MaxAgeInner::Fn(c) => c(origin?, parts).as_secs().into(),
+        };
+
+        Some((header::ACCESS_CONTROL_MAX_AGE, max_age))
+    }
+}
+
+impl fmt::Debug for MaxAge {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match &self.0 {
+            MaxAgeInner::Exact(inner) => f.debug_tuple("Exact").field(inner).finish(),
+            MaxAgeInner::Fn(_) => f.debug_tuple("Fn").finish(),
+        }
+    }
+}
+
+impl From<Duration> for MaxAge {
+    fn from(max_age: Duration) -> Self {
+        Self::exact(max_age)
+    }
+}
+
+type MaxAgeFn =
+    Arc<dyn for<'a> Fn(&'a HeaderValue, &'a RequestParts) -> Duration + Send + Sync + 'static>;
+
+#[derive(Clone)]
+enum MaxAgeInner {
+    Exact(Option<HeaderValue>),
+    Fn(MaxAgeFn),
+}
+
+impl Default for MaxAgeInner {
+    fn default() -> Self {
+        Self::Exact(None)
+    }
+}
diff --git a/runtimes/core/src/api/cors/cors_headers_config/mod.rs b/runtimes/core/src/api/cors/cors_headers_config/mod.rs
new file mode 100644
index 0000000000..0a36c6f663
--- /dev/null
+++ b/runtimes/core/src/api/cors/cors_headers_config/mod.rs
@@ -0,0 +1,327 @@
+#![allow(clippy::enum_variant_names)]
+
+use bytes::{BufMut, BytesMut};
+use http::{
+    header::{self, HeaderName},
+    HeaderValue, Method,
+};
+use pingora::http::{RequestHeader, ResponseHeader};
+
+mod allow_credentials;
+mod allow_headers;
+mod allow_methods;
+mod allow_origin;
+mod allow_private_network;
+mod expose_headers;
+mod max_age;
+mod vary;
+
+pub use self::{
+    allow_credentials::AllowCredentials, allow_headers::AllowHeaders, allow_methods::AllowMethods,
+    allow_origin::AllowOrigin, allow_private_network::AllowPrivateNetwork,
+    expose_headers::ExposeHeaders, max_age::MaxAge, vary::Vary,
+};
+
+/// Configuration for how cors headers should be appied
+///
+/// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS
+#[derive(Debug, Clone)]
+#[must_use]
+pub struct CorsHeadersConfig {
+    allow_credentials: AllowCredentials,
+    allow_headers: AllowHeaders,
+    allow_methods: AllowMethods,
+    allow_origin: AllowOrigin,
+    allow_private_network: AllowPrivateNetwork,
+    expose_headers: ExposeHeaders,
+    max_age: MaxAge,
+    vary: Vary,
+}
+
+#[allow(clippy::declare_interior_mutable_const)]
+const WILDCARD: HeaderValue = HeaderValue::from_static("*");
+
+impl CorsHeadersConfig {
+    /// Create a new `CorsHeadersConfig`.
+    ///
+    /// No headers are sent by default. Use the builder methods to customize
+    /// the behavior.
+    ///
+    /// You need to set at least an allowed origin for browsers to make
+    /// successful cross-origin requests to your service.
+    pub fn new() -> Self {
+        Self {
+            allow_credentials: Default::default(),
+            allow_headers: Default::default(),
+            allow_methods: Default::default(),
+            allow_origin: Default::default(),
+            allow_private_network: Default::default(),
+            expose_headers: Default::default(),
+            max_age: Default::default(),
+            vary: Default::default(),
+        }
+    }
+
+    /// A permissive configuration:
+    ///
+    /// - All request headers allowed.
+    /// - All methods allowed.
+    /// - All origins allowed.
+    /// - All headers exposed.
+    pub fn permissive() -> Self {
+        Self::new()
+            .allow_headers(Any)
+            .allow_methods(Any)
+            .allow_origin(Any)
+            .expose_headers(Any)
+    }
+
+    /// A very permissive configuration:
+    ///
+    /// - **Credentials allowed.**
+    /// - The method received in `Access-Control-Request-Method` is sent back
+    ///   as an allowed method.
+    /// - The origin of the preflight request is sent back as an allowed origin.
+    /// - The header names received in `Access-Control-Request-Headers` are sent
+    ///   back as allowed headers.
+    /// - No headers are currently exposed, but this may change in the future.
+    pub fn very_permissive() -> Self {
+        Self::new()
+            .allow_credentials(true)
+            .allow_headers(AllowHeaders::mirror_request())
+            .allow_methods(AllowMethods::mirror_request())
+            .allow_origin(AllowOrigin::mirror_request())
+    }
+
+    /// Set the [`Access-Control-Allow-Credentials`][mdn] header.
+    ///
+    /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials
+    pub fn allow_credentials<T>(mut self, allow_credentials: T) -> Self
+    where
+        T: Into<AllowCredentials>,
+    {
+        self.allow_credentials = allow_credentials.into();
+        self
+    }
+
+    /// Set the value of the [`Access-Control-Allow-Headers`][mdn] header.
+    ///
+    /// Note that multiple calls to this method will override any previous
+    /// calls.
+    ///
+    /// Also note that `Access-Control-Allow-Headers` is required for requests that have
+    /// `Access-Control-Request-Headers`.
+    ///
+    /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Headers
+    pub fn allow_headers<T>(mut self, headers: T) -> Self
+    where
+        T: Into<AllowHeaders>,
+    {
+        self.allow_headers = headers.into();
+        self
+    }
+
+    /// Set the value of the [`Access-Control-Max-Age`][mdn] header.
+    ///
+    /// By default the header will not be set which disables caching and will
+    /// require a preflight call for all requests.
+    ///
+    /// Note that each browser has a maximum internal value that takes
+    /// precedence when the Access-Control-Max-Age is greater. For more details
+    /// see [mdn].
+    ///
+    /// If you need more flexibility, you can use supply a function which can
+    /// dynamically decide the max-age based on the origin and other parts of
+    /// each preflight request, using `MaxAge::dynamic`.
+    ///
+    /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Max-Age
+    pub fn max_age<T>(mut self, max_age: T) -> Self
+    where
+        T: Into<MaxAge>,
+    {
+        self.max_age = max_age.into();
+        self
+    }
+
+    /// Set the value of the [`Access-Control-Allow-Methods`][mdn] header.
+    ///
+    /// Note that multiple calls to this method will override any previous
+    /// calls.
+    ///
+    /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Methods
+    pub fn allow_methods<T>(mut self, methods: T) -> Self
+    where
+        T: Into<AllowMethods>,
+    {
+        self.allow_methods = methods.into();
+        self
+    }
+
+    /// Set the value of the [`Access-Control-Allow-Origin`][mdn] header.
+    ///
+    /// You can also use a closure with `AllowOrigin::predicate`
+    ///
+    /// Note that multiple calls to this method will override any previous
+    /// calls.
+    ///
+    /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin
+    pub fn allow_origin<T>(mut self, origin: T) -> Self
+    where
+        T: Into<AllowOrigin>,
+    {
+        self.allow_origin = origin.into();
+        self
+    }
+
+    /// Set the value of the [`Access-Control-Expose-Headers`][mdn] header.
+    ///
+    /// Note that multiple calls to this method will override any previous
+    /// calls.
+    ///
+    /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Expose-Headers
+    pub fn expose_headers<T>(mut self, headers: T) -> Self
+    where
+        T: Into<ExposeHeaders>,
+    {
+        self.expose_headers = headers.into();
+        self
+    }
+
+    /// Set the value of the [`Access-Control-Allow-Private-Network`][wicg] header.
+    ///
+    /// [wicg]: https://wicg.github.io/private-network-access/
+    pub fn allow_private_network<T>(mut self, allow_private_network: T) -> Self
+    where
+        T: Into<AllowPrivateNetwork>,
+    {
+        self.allow_private_network = allow_private_network.into();
+        self
+    }
+
+    /// Set the value(s) of the [`Vary`][mdn] header.
+    ///
+    /// In contrast to the other headers, this one has a non-empty default of
+    /// [`preflight_request_headers()`].
+    ///
+    /// You only need to set this is you want to remove some of these defaults,
+    /// or if you use a closure for one of the other headers and want to add a
+    /// vary header accordingly.
+    ///
+    /// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Vary
+    pub fn vary<T>(mut self, headers: T) -> Self
+    where
+        T: Into<Vary>,
+    {
+        self.vary = headers.into();
+        self
+    }
+}
+
+/// Represents a wildcard value (`*`) used with some CORS headers such as
+/// [`CorsHeadersConfig::allow_methods`].
+#[derive(Debug, Clone, Copy)]
+#[must_use]
+pub struct Any;
+
+fn separated_by_commas<I>(mut iter: I) -> Option<HeaderValue>
+where
+    I: Iterator<Item = HeaderValue>,
+{
+    match iter.next() {
+        Some(fst) => {
+            let mut result = BytesMut::from(fst.as_bytes());
+            for val in iter {
+                result.reserve(val.len() + 1);
+                result.put_u8(b',');
+                result.extend_from_slice(val.as_bytes());
+            }
+
+            Some(HeaderValue::from_maybe_shared(result.freeze()).unwrap())
+        }
+        None => None,
+    }
+}
+
+impl Default for CorsHeadersConfig {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl CorsHeadersConfig {
+    pub fn apply(&self, req: &RequestHeader, resp: &mut ResponseHeader) -> pingora::Result<()> {
+        let origin = req.headers.get(&header::ORIGIN);
+
+        // These headers are applied to both preflight and subsequent regular CORS requests:
+        // https://fetch.spec.whatwg.org/#http-responses
+
+        append_response_header(resp, self.allow_credentials.to_header(origin, req))?;
+        append_response_header(resp, self.allow_private_network.to_header(origin, req))?;
+        append_response_header(resp, self.vary.to_header())?;
+        append_response_header(resp, self.allow_origin.to_header(origin, req))?;
+
+        // Return results immediately upon preflight request
+        if req.method == Method::OPTIONS {
+            // These headers are applied only to preflight requests
+            append_response_header(resp, self.allow_methods.to_header(req))?;
+            append_response_header(resp, self.allow_headers.to_header(req))?;
+            append_response_header(resp, self.max_age.to_header(origin, req))?;
+        } else {
+            // This header is applied only to non-preflight requests
+            append_response_header(resp, self.expose_headers.to_header())?;
+        }
+
+        Ok(())
+    }
+}
+
+fn append_response_header(
+    resp: &mut ResponseHeader,
+    header: Option<(HeaderName, HeaderValue)>,
+) -> pingora::Result<()> {
+    if let Some((key, value)) = header {
+        resp.append_header(key, value)?;
+    }
+
+    Ok(())
+}
+
+pub fn ensure_usable_cors_rules(config: &CorsHeadersConfig) {
+    if config.allow_credentials.is_true() {
+        assert!(
+            !config.allow_headers.is_wildcard(),
+            "Invalid CORS configuration: Cannot combine `Access-Control-Allow-Credentials: true` \
+             with `Access-Control-Allow-Headers: *`"
+        );
+
+        assert!(
+            !config.allow_methods.is_wildcard(),
+            "Invalid CORS configuration: Cannot combine `Access-Control-Allow-Credentials: true` \
+             with `Access-Control-Allow-Methods: *`"
+        );
+
+        assert!(
+            !config.allow_origin.is_wildcard(),
+            "Invalid CORS configuration: Cannot combine `Access-Control-Allow-Credentials: true` \
+             with `Access-Control-Allow-Origin: *`"
+        );
+
+        assert!(
+            !config.expose_headers.is_wildcard(),
+            "Invalid CORS configuration: Cannot combine `Access-Control-Allow-Credentials: true` \
+             with `Access-Control-Expose-Headers: *`"
+        );
+    }
+}
+
+/// Returns an iterator over the three request headers that may be involved in a CORS preflight request.
+///
+/// This is the default set of header names returned in the `vary` header
+pub fn preflight_request_headers() -> impl Iterator<Item = HeaderName> {
+    [
+        header::ORIGIN,
+        header::ACCESS_CONTROL_REQUEST_METHOD,
+        header::ACCESS_CONTROL_REQUEST_HEADERS,
+    ]
+    .into_iter()
+}
diff --git a/runtimes/core/src/api/cors/cors_headers_config/vary.rs b/runtimes/core/src/api/cors/cors_headers_config/vary.rs
new file mode 100644
index 0000000000..3ebe4a2753
--- /dev/null
+++ b/runtimes/core/src/api/cors/cors_headers_config/vary.rs
@@ -0,0 +1,57 @@
+use http::header::{self, HeaderName, HeaderValue};
+
+use super::preflight_request_headers;
+
+/// Holds configuration for how to set the [`Vary`][mdn] header.
+///
+/// See [`CorsLayer::vary`] for more details.
+///
+/// [mdn]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Vary
+/// [`CorsLayer::vary`]: super::CorsLayer::vary
+#[derive(Clone, Debug)]
+pub struct Vary(Vec<HeaderValue>);
+
+impl Vary {
+    /// Set the list of header names to return as vary header values
+    ///
+    /// See [`CorsLayer::vary`] for more details.
+    ///
+    /// [`CorsLayer::vary`]: super::CorsLayer::vary
+    pub fn list<I>(headers: I) -> Self
+    where
+        I: IntoIterator<Item = HeaderName>,
+    {
+        Self(headers.into_iter().map(Into::into).collect())
+    }
+
+    pub(super) fn to_header(&self) -> Option<(HeaderName, HeaderValue)> {
+        let values = &self.0;
+        let mut res = values.first()?.as_bytes().to_owned();
+        for val in &values[1..] {
+            res.extend_from_slice(b", ");
+            res.extend_from_slice(val.as_bytes());
+        }
+
+        let header_val = HeaderValue::from_bytes(&res)
+            .expect("comma-separated list of HeaderValues is always a valid HeaderValue");
+        Some((header::VARY, header_val))
+    }
+}
+
+impl Default for Vary {
+    fn default() -> Self {
+        Self::list(preflight_request_headers())
+    }
+}
+
+impl<const N: usize> From<[HeaderName; N]> for Vary {
+    fn from(arr: [HeaderName; N]) -> Self {
+        Self::list(arr)
+    }
+}
+
+impl From<Vec<HeaderName>> for Vary {
+    fn from(vec: Vec<HeaderName>) -> Self {
+        Self::list(vec)
+    }
+}
diff --git a/runtimes/core/src/api/cors/mod.rs b/runtimes/core/src/api/cors/mod.rs
new file mode 100644
index 0000000000..562a493815
--- /dev/null
+++ b/runtimes/core/src/api/cors/mod.rs
@@ -0,0 +1,224 @@
+use crate::api::{auth, EndpointMap};
+use crate::encore::runtime::v1 as pb;
+use crate::encore::runtime::v1::gateway::CorsAllowedOrigins;
+use anyhow::Context;
+use axum::http::{HeaderName, HeaderValue};
+use http::header::{ACCESS_CONTROL_REQUEST_HEADERS, AUTHORIZATION, COOKIE};
+use std::collections::HashSet;
+use std::str::FromStr;
+
+use self::cors_headers_config::{ensure_usable_cors_rules, CorsHeadersConfig};
+
+pub mod cors_headers_config;
+
+#[cfg(test)]
+mod tests;
+
+/// The default set of allowed headers.
+#[allow(clippy::declare_interior_mutable_const)]
+const ALWAYS_ALLOWED_HEADERS: [HeaderName; 8] = [
+    HeaderName::from_static("accept"),
+    HeaderName::from_static("authorization"),
+    HeaderName::from_static("content-type"),
+    HeaderName::from_static("origin"),
+    HeaderName::from_static("user-agent"),
+    HeaderName::from_static("x-correlation-id"),
+    HeaderName::from_static("x-request-id"),
+    HeaderName::from_static("x-requested-with"),
+];
+
+#[allow(clippy::declare_interior_mutable_const)]
+pub const ALWAYS_EXPOSED_HEADERS: [HeaderName; 3] = [
+    HeaderName::from_static("x-request-id"),
+    HeaderName::from_static("x-correlation-id"),
+    HeaderName::from_static("x-encore-trace-id"),
+];
+
+pub fn config(cfg: &pb::gateway::Cors, meta: MetaHeaders) -> anyhow::Result<CorsHeadersConfig> {
+    let allow_any_headers = cfg.extra_allowed_headers.iter().any(|val| val == "*");
+
+    let allow_headers = if allow_any_headers {
+        cors_headers_config::AllowHeaders::mirror_request()
+    } else {
+        let mut allowed_headers = cfg
+            .extra_allowed_headers
+            .iter()
+            .map(|s| HeaderName::from_str(s))
+            .collect::<Result<Vec<_>, _>>()
+            .context("failed to parse extra allowed headers")?;
+        #[allow(clippy::borrow_interior_mutable_const)]
+        allowed_headers.extend_from_slice(&ALWAYS_ALLOWED_HEADERS);
+        allowed_headers.extend(meta.allow_headers);
+
+        cors_headers_config::AllowHeaders::list(allowed_headers)
+    };
+
+    let mut exposed_headers = cfg
+        .extra_exposed_headers
+        .iter()
+        .map(|s| HeaderName::from_str(s))
+        .collect::<Result<Vec<_>, _>>()
+        .context("failed to parse extra exposed headers")?;
+    #[allow(clippy::borrow_interior_mutable_const)]
+    exposed_headers.extend_from_slice(&ALWAYS_EXPOSED_HEADERS);
+    exposed_headers.extend(meta.expose_headers);
+
+    // Compute the allowed origins.
+    let allow_origin = {
+        use pb::gateway::cors::AllowedOriginsWithCredentials;
+        let with_creds = match &cfg.allowed_origins_with_credentials {
+            Some(AllowedOriginsWithCredentials::UnsafeAllowAllOriginsWithCredentials(true)) => {
+                OriginSet::All
+            }
+            Some(AllowedOriginsWithCredentials::AllowedOrigins(list)) => {
+                OriginSet::new(list.allowed_origins.clone())
+            }
+            _ => OriginSet::Some(vec![]),
+        };
+        let without_creds = {
+            if let Some(CorsAllowedOrigins { allowed_origins }) =
+                &cfg.allowed_origins_without_credentials
+            {
+                OriginSet::new(allowed_origins.to_vec())
+            } else {
+                OriginSet::All
+            }
+        };
+
+        let request_has_creds = |req: &axum::http::request::Parts| -> bool {
+            if req.headers.contains_key(AUTHORIZATION) || req.headers.contains_key(COOKIE) {
+                return true;
+            }
+
+            if req.method == http::method::Method::OPTIONS {
+                return req
+                    .headers
+                    .get_all(ACCESS_CONTROL_REQUEST_HEADERS)
+                    .iter()
+                    .any(|val| {
+                        val.to_str()
+                            .map(|val| {
+                                val.split(",")
+                                    .map(|val| val.trim())
+                                    .any(|val| val == "authorization" || val == "cookie")
+                            })
+                            .unwrap_or(false)
+                    });
+            }
+
+            false
+        };
+
+        let pred = move |origin: &HeaderValue, req: &axum::http::request::Parts| {
+            let Ok(origin) = origin.to_str() else {
+                return false;
+            };
+            if request_has_creds(req) {
+                with_creds.allows(origin)
+            } else {
+                without_creds.allows(origin)
+            }
+        };
+        pred
+    };
+
+    let config = CorsHeadersConfig::new()
+        .allow_private_network(cfg.allow_private_network_access)
+        .allow_headers(allow_headers)
+        .expose_headers(cors_headers_config::ExposeHeaders::list(exposed_headers))
+        .allow_credentials(!cfg.disable_credentials)
+        .allow_methods(cors_headers_config::AllowMethods::mirror_request())
+        .allow_origin(cors_headers_config::AllowOrigin::predicate(allow_origin));
+
+    ensure_usable_cors_rules(&config);
+    Ok(config)
+}
+
+enum OriginSet {
+    All,
+    Some(Vec<Origin>),
+}
+
+impl OriginSet {
+    fn new(origins: Vec<String>) -> Self {
+        let mut set = Vec::with_capacity(origins.len());
+        for o in origins {
+            if o == "*" {
+                return Self::All;
+            }
+            set.push(crate::api::cors::Origin::new(o));
+        }
+        Self::Some(set)
+    }
+
+    fn allows(&self, origin: &str) -> bool {
+        let origin = origin.to_lowercase();
+        match self {
+            Self::All => true,
+            Self::Some(origins) => origins.iter().any(|o| o.matches(&origin)),
+        }
+    }
+}
+
+enum Origin {
+    Exact(String),
+    Wildcard { prefix: String, suffix: String },
+}
+
+impl Origin {
+    fn new(origin: String) -> Self {
+        match origin.split_once('*') {
+            Some((prefix, suffix)) => Self::Wildcard {
+                prefix: prefix.to_string(),
+                suffix: suffix.to_string(),
+            },
+            None => Self::Exact(origin),
+        }
+    }
+
+    fn matches(&self, origin: &str) -> bool {
+        match self {
+            Self::Exact(exact) => origin == exact,
+            Self::Wildcard { prefix, suffix } => {
+                // Length must be greater than the prefix and suffix combined,
+                // to ensure the wildcard matches at least one character.
+                origin.len() > (prefix.len() + suffix.len())
+                    && origin.starts_with(prefix)
+                    && origin.ends_with(suffix)
+            }
+        }
+    }
+}
+
+/// Additional CORS configuration based on the app metadata.
+pub struct MetaHeaders {
+    pub allow_headers: HashSet<HeaderName>,
+    pub expose_headers: HashSet<HeaderName>,
+}
+
+impl MetaHeaders {
+    pub fn from_schema(endpoints: &EndpointMap, auth: Option<&auth::Authenticator>) -> Self {
+        let mut allow_headers = HashSet::new();
+        let mut expose_headers = HashSet::new();
+
+        for ep in endpoints.values() {
+            if !ep.exposed {
+                continue;
+            }
+            for h in ep.request.iter().flat_map(|req| req.header.iter()) {
+                allow_headers.extend(h.header_names());
+            }
+            expose_headers.extend(ep.response.header.iter().flat_map(|h| h.header_names()));
+        }
+
+        // If we have an auth handler, add the auth headers to the allow list.
+        if let Some(auth) = auth {
+            allow_headers.extend(auth.schema().header.iter().flat_map(|h| h.header_names()));
+        }
+
+        Self {
+            allow_headers,
+            expose_headers,
+        }
+    }
+}
diff --git a/runtimes/core/src/api/cors/tests.rs b/runtimes/core/src/api/cors/tests.rs
new file mode 100644
index 0000000000..534fe9bf8e
--- /dev/null
+++ b/runtimes/core/src/api/cors/tests.rs
@@ -0,0 +1,491 @@
+use http::header::{
+    ACCESS_CONTROL_ALLOW_HEADERS, ACCESS_CONTROL_ALLOW_ORIGIN, ACCESS_CONTROL_REQUEST_HEADERS,
+    ACCESS_CONTROL_REQUEST_METHOD, AUTHORIZATION, CONTENT_TYPE, ORIGIN,
+};
+use pingora::http::{RequestHeader, ResponseHeader};
+
+use super::*;
+
+fn check_origins(cors: &CorsHeadersConfig, creds: bool, good: bool, origins: &[HeaderValue]) {
+    for origin in origins {
+        let mut req = RequestHeader::build("OPTIONS", b"/", None).expect("construct request");
+        req.insert_header(ORIGIN, origin)
+            .expect("insert origin header");
+
+        if creds {
+            req.insert_header(ACCESS_CONTROL_REQUEST_HEADERS, AUTHORIZATION)
+                .expect("insert access-control-request-headers");
+        }
+
+        let mut resp = ResponseHeader::build(200, None).expect("construct response");
+
+        cors.apply(&req, &mut resp).expect("apply cors config");
+
+        let allow_origin = resp.headers.get(ACCESS_CONTROL_ALLOW_ORIGIN);
+        let allowed = allow_origin.map(|val| val == origin).unwrap_or(false);
+
+        if allowed != good {
+            panic!("origin={origin:?} creds={creds}: got allowed={allowed}, want {good}");
+        } else {
+            println!("origin={origin:?} creds={creds}: ok allowed={allowed}");
+        }
+    }
+}
+
+fn check_headers(cors: &CorsHeadersConfig, allowed_headers: &[HeaderName], want_ok: bool) {
+    let mut req = RequestHeader::build("OPTIONS", b"/", None).expect("construct request");
+
+    req.insert_header(ORIGIN, HeaderValue::from_static("https://example.org"))
+        .expect("insert origin header");
+
+    req.insert_header(
+        ACCESS_CONTROL_REQUEST_METHOD,
+        HeaderValue::from_static("GET"),
+    )
+    .expect("insert access-control-request-method");
+
+    let allowed_headers_val = HeaderValue::from_bytes(allowed_headers.join(", ").as_bytes())
+        .expect("create access-control-request-headers value");
+    req.insert_header(ACCESS_CONTROL_REQUEST_HEADERS, allowed_headers_val)
+        .expect("insert access-control-request-headers");
+
+    let mut resp = ResponseHeader::build(200, None).expect("construct response");
+
+    cors.apply(&req, &mut resp).expect("apply cors headers");
+
+    if !allowed_headers.is_empty() && want_ok {
+        // check that the CORS response is valid (e.g if its a request with credentials)
+        assert!(
+            resp.headers.get(ACCESS_CONTROL_ALLOW_ORIGIN).is_some(),
+            "expected cors request to be valid, but access-control-allow-origin is not set"
+        )
+    }
+
+    // check allowed headers.
+    let allow_headers_val = resp
+        .headers
+        .get(ACCESS_CONTROL_ALLOW_HEADERS)
+        .expect("access-control-allow-headers to be present")
+        .to_str()
+        .expect("convert to str");
+    let allow_headers: HashSet<HeaderName> = allow_headers_val
+        .split(",")
+        .map(|val| HeaderName::from_bytes(val.trim().as_bytes()).expect("construct header name"))
+        .collect();
+
+    if want_ok {
+        for val in allowed_headers {
+            assert!(
+                allow_headers.contains(val),
+                "want header {val:?} to be allowed, got false; resp header={allow_headers_val}"
+            )
+        }
+    } else {
+        assert_ne!(
+            allow_headers_val, "",
+            "want headers not to be allowed, got {allow_headers_val}"
+        );
+    }
+}
+
+struct TestCase<'a> {
+    cors_cfg: pb::gateway::Cors,
+    creds_good_origins: &'a [HeaderValue],
+    creds_bad_origins: &'a [HeaderValue],
+    nocreds_good_origins: &'a [HeaderValue],
+    nocreds_bad_origins: &'a [HeaderValue],
+    good_headers: &'a [HeaderName],
+    bad_headers: &'a [HeaderName],
+}
+
+fn run_test_case(test_case: TestCase) {
+    let meta = MetaHeaders {
+        allow_headers: [HeaderName::from_static("x-static-test")].into(),
+        expose_headers: [HeaderName::from_static("x-exposed-test")].into(),
+    };
+
+    let cors = config(&test_case.cors_cfg, meta).expect("run cors config");
+
+    check_origins(&cors, true, true, test_case.creds_good_origins);
+    check_origins(&cors, true, false, test_case.creds_bad_origins);
+
+    check_origins(&cors, false, true, test_case.nocreds_good_origins);
+    check_origins(&cors, false, false, test_case.nocreds_bad_origins);
+
+    check_headers(&cors, test_case.good_headers, true);
+
+    for header in test_case.bad_headers {
+        let mut test_headers = test_case.good_headers.to_vec();
+        test_headers.push(header.clone());
+
+        check_headers(&cors, &test_headers, false);
+    }
+}
+
+#[test]
+fn test_empty() {
+    run_test_case(TestCase {
+        cors_cfg: pb::gateway::Cors {
+            debug: false,
+            disable_credentials: false,
+            allowed_origins_with_credentials: None,
+            allowed_origins_without_credentials: None,
+            extra_allowed_headers: vec![],
+            extra_exposed_headers: vec![],
+            allow_private_network_access: false,
+        },
+        creds_good_origins: &[],
+        creds_bad_origins: &[
+            HeaderValue::from_static("foo.com"),
+            HeaderValue::from_static("evil.com"),
+            HeaderValue::from_static("localhost"),
+        ],
+        nocreds_good_origins: &[
+            HeaderValue::from_static("foo.com"),
+            HeaderValue::from_static("localhost"),
+            HeaderValue::from_static(""),
+            HeaderValue::from_static("icanhazcheezburger.com"),
+        ],
+        nocreds_bad_origins: &[],
+        good_headers: &[CONTENT_TYPE, ORIGIN],
+        bad_headers: &[
+            HeaderName::from_static("x-requested-with"),
+            HeaderName::from_static("x-forwarded-for"),
+        ],
+    });
+}
+
+#[test]
+fn test_allowed_creds() {
+    run_test_case(TestCase {
+        cors_cfg: pb::gateway::Cors {
+            debug: false,
+            disable_credentials: false,
+            allowed_origins_with_credentials: Some(
+                pb::gateway::cors::AllowedOriginsWithCredentials::AllowedOrigins(
+                    pb::gateway::CorsAllowedOrigins {
+                        allowed_origins: vec![String::from("localhost"), String::from("ok.org")],
+                    },
+                ),
+            ),
+            allowed_origins_without_credentials: None,
+            extra_allowed_headers: vec![],
+            extra_exposed_headers: vec![],
+            allow_private_network_access: false,
+        },
+        creds_good_origins: &[
+            HeaderValue::from_static("localhost"),
+            HeaderValue::from_static("ok.org"),
+        ],
+        creds_bad_origins: &[
+            HeaderValue::from_static("foo.com"),
+            HeaderValue::from_static("evil.com"),
+        ],
+        nocreds_good_origins: &[
+            HeaderValue::from_static("foo.com"),
+            HeaderValue::from_static("localhost"),
+            HeaderValue::from_static(""),
+            HeaderValue::from_static("icanhazcheezburger.com"),
+            HeaderValue::from_static("ok.org"),
+        ],
+        nocreds_bad_origins: &[],
+        good_headers: &[],
+        bad_headers: &[],
+    });
+}
+
+#[test]
+fn test_allowed_glob_creds() {
+    run_test_case(TestCase {
+        cors_cfg: pb::gateway::Cors {
+            debug: false,
+            disable_credentials: false,
+            allowed_origins_with_credentials: Some(
+                pb::gateway::cors::AllowedOriginsWithCredentials::AllowedOrigins(
+                    pb::gateway::CorsAllowedOrigins {
+                        allowed_origins: vec![
+                            String::from("https://*.example.com"),
+                            String::from("wss://ok1-*.example.com"),
+                            String::from("https://*-ok2.example.com"),
+                        ],
+                    },
+                ),
+            ),
+            allowed_origins_without_credentials: None,
+            extra_allowed_headers: vec![],
+            extra_exposed_headers: vec![],
+            allow_private_network_access: false,
+        },
+        creds_good_origins: &[
+            HeaderValue::from_static("https://foo.example.com"),
+            HeaderValue::from_static("wss://ok1-foo.example.com"),
+            HeaderValue::from_static("https://foo-ok2.example.com"),
+        ],
+        creds_bad_origins: &[
+            HeaderValue::from_static("http://foo.example.com"), // Wrong scheme
+            HeaderValue::from_static("htts://.example.com"),    // No subdomain
+            HeaderValue::from_static("ws://ok1-foo.example.com"), // Wrong scheme
+            HeaderValue::from_static(".example.com"),           // No scheme
+            HeaderValue::from_static("https://evil.com"),       // bad domain
+        ],
+        nocreds_good_origins: &[],
+        nocreds_bad_origins: &[],
+        good_headers: &[],
+        bad_headers: &[],
+    });
+}
+
+#[test]
+fn test_allowed_nocreds() {
+    run_test_case(TestCase {
+        cors_cfg: pb::gateway::Cors {
+            debug: false,
+            disable_credentials: false,
+            allowed_origins_with_credentials: None,
+            allowed_origins_without_credentials: Some(pb::gateway::CorsAllowedOrigins {
+                allowed_origins: vec![String::from("localhost"), String::from("ok.org")],
+            }),
+            extra_allowed_headers: vec![],
+            extra_exposed_headers: vec![],
+            allow_private_network_access: false,
+        },
+        creds_good_origins: &[],
+        creds_bad_origins: &[
+            HeaderValue::from_static("localhost"),
+            HeaderValue::from_static("ok.org"),
+            HeaderValue::from_static("foo.com"),
+            HeaderValue::from_static("evil.com"),
+        ],
+        nocreds_good_origins: &[
+            HeaderValue::from_static("localhost"),
+            HeaderValue::from_static("ok.org"),
+        ],
+        nocreds_bad_origins: &[
+            HeaderValue::from_static("foo.com"),
+            HeaderValue::from_static(""),
+            HeaderValue::from_static("icanhazcheezburger.com"),
+        ],
+        good_headers: &[],
+        bad_headers: &[],
+    });
+}
+
+#[test]
+fn test_allowed_disjoint_sets() {
+    run_test_case(TestCase {
+        cors_cfg: pb::gateway::Cors {
+            debug: false,
+            disable_credentials: false,
+            allowed_origins_with_credentials: Some(
+                pb::gateway::cors::AllowedOriginsWithCredentials::AllowedOrigins(
+                    pb::gateway::CorsAllowedOrigins {
+                        allowed_origins: vec![String::from("foo.com")],
+                    },
+                ),
+            ),
+            allowed_origins_without_credentials: Some(pb::gateway::CorsAllowedOrigins {
+                allowed_origins: vec![String::from("bar.org")],
+            }),
+            extra_allowed_headers: vec![],
+            extra_exposed_headers: vec![],
+            allow_private_network_access: false,
+        },
+        creds_good_origins: &[HeaderValue::from_static("foo.com")],
+        creds_bad_origins: &[
+            HeaderValue::from_static("bar.org"),
+            HeaderValue::from_static(""),
+            HeaderValue::from_static("localhost"),
+        ],
+        nocreds_good_origins: &[HeaderValue::from_static("bar.org")],
+        nocreds_bad_origins: &[
+            HeaderValue::from_static("foo.com"),
+            HeaderValue::from_static(""),
+            HeaderValue::from_static("localhost"),
+        ],
+        good_headers: &[],
+        bad_headers: &[],
+    });
+}
+
+#[test]
+fn test_allowed_wildcard_without_creds() {
+    run_test_case(TestCase {
+        cors_cfg: pb::gateway::Cors {
+            debug: false,
+            disable_credentials: false,
+            allowed_origins_with_credentials: None,
+            allowed_origins_without_credentials: Some(pb::gateway::CorsAllowedOrigins {
+                allowed_origins: vec![String::from("*")],
+            }),
+            extra_allowed_headers: vec![],
+            extra_exposed_headers: vec![],
+            allow_private_network_access: false,
+        },
+        creds_good_origins: &[],
+        creds_bad_origins: &[
+            HeaderValue::from_static("bar.org"),
+            HeaderValue::from_static(""),
+            HeaderValue::from_static("localhost"),
+        ],
+        nocreds_good_origins: &[
+            HeaderValue::from_static("bar.org"),
+            HeaderValue::from_static("bar.com"),
+            HeaderValue::from_static(""),
+            HeaderValue::from_static("localhost"),
+        ],
+        nocreds_bad_origins: &[],
+        good_headers: &[],
+        bad_headers: &[],
+    });
+}
+
+#[test]
+fn test_allowed_unsafe_wildcard_with_creds() {
+    run_test_case(TestCase {
+            cors_cfg: pb::gateway::Cors {
+                debug: false,
+                disable_credentials: false,
+                allowed_origins_with_credentials: Some(
+                    pb::gateway::cors::AllowedOriginsWithCredentials::UnsafeAllowAllOriginsWithCredentials(true),
+                ),
+                allowed_origins_without_credentials: None,
+                extra_allowed_headers: vec![],
+                extra_exposed_headers: vec![],
+                allow_private_network_access: false,
+            },
+            creds_good_origins: &[
+                HeaderValue::from_static("bar.org"),
+                HeaderValue::from_static("bar.com"),
+                HeaderValue::from_static(""),
+                HeaderValue::from_static("localhost"),
+                HeaderValue::from_static("unsafe.evil.com"),
+            ],
+            creds_bad_origins: &[],
+            nocreds_good_origins: &[],
+            nocreds_bad_origins: &[],
+            good_headers: &[],
+            bad_headers: &[],
+        });
+}
+
+#[test]
+fn test_extra_headers() {
+    run_test_case(TestCase {
+        cors_cfg: pb::gateway::Cors {
+            debug: false,
+            disable_credentials: false,
+            allowed_origins_with_credentials: None,
+            allowed_origins_without_credentials: None,
+            extra_allowed_headers: vec![
+                "Not-Authorization".to_string(),
+                "X-Forwarded-For".to_string(),
+                "X-Real-Ip".to_string(),
+            ],
+            extra_exposed_headers: vec![],
+            allow_private_network_access: false,
+        },
+        creds_good_origins: &[],
+        creds_bad_origins: &[],
+        nocreds_good_origins: &[],
+        nocreds_bad_origins: &[],
+        good_headers: &[
+            CONTENT_TYPE,
+            ORIGIN,
+            HeaderName::from_static("x-requested-with"),
+            HeaderName::from_static("x-real-ip"),
+            HeaderName::from_static("not-authorization"),
+        ],
+        bad_headers: &[
+            HeaderName::from_static("x-forwarded-for"),
+            HeaderName::from_static("x-evil-header"),
+            HeaderName::from_static("authorization"),
+        ],
+    });
+}
+
+#[test]
+fn test_extra_headers_wildcard() {
+    run_test_case(TestCase {
+        cors_cfg: pb::gateway::Cors {
+            debug: false,
+            disable_credentials: false,
+            allowed_origins_with_credentials: None,
+            allowed_origins_without_credentials: None,
+            extra_allowed_headers: vec![
+                "X-Forwarded-For".to_string(),
+                "*".to_string(),
+                "X-Real-Ip".to_string(),
+            ],
+            extra_exposed_headers: vec![],
+            allow_private_network_access: false,
+        },
+        creds_good_origins: &[],
+        creds_bad_origins: &[],
+        nocreds_good_origins: &[],
+        nocreds_bad_origins: &[],
+        good_headers: &[
+            CONTENT_TYPE,
+            ORIGIN,
+            HeaderName::from_static("x-requested-with"),
+            HeaderName::from_static("x-real-ip"),
+            HeaderName::from_static("x-forwarded-for"),
+            HeaderName::from_static("x-evil-header"),
+            HeaderName::from_static("not-authorization"),
+        ],
+        bad_headers: &[HeaderName::from_static("authorization")],
+    });
+}
+
+#[test]
+fn test_static_headers() {
+    run_test_case(TestCase {
+        cors_cfg: pb::gateway::Cors {
+            debug: false,
+            disable_credentials: false,
+            allowed_origins_with_credentials: None,
+            allowed_origins_without_credentials: None,
+            extra_allowed_headers: vec![],
+            extra_exposed_headers: vec![],
+            allow_private_network_access: false,
+        },
+        creds_good_origins: &[],
+        creds_bad_origins: &[],
+        nocreds_good_origins: &[],
+        nocreds_bad_origins: &[],
+        good_headers: &[
+            CONTENT_TYPE,
+            ORIGIN,
+            HeaderName::from_static("x-static-test"),
+        ],
+        bad_headers: &[],
+    });
+}
+
+#[test]
+fn test_wildcard_without_creds() {
+    run_test_case(TestCase {
+        cors_cfg: pb::gateway::Cors {
+            debug: false,
+            disable_credentials: false,
+            allowed_origins_with_credentials: Some(
+                pb::gateway::cors::AllowedOriginsWithCredentials::AllowedOrigins(
+                    pb::gateway::CorsAllowedOrigins {
+                        allowed_origins: vec![String::from("https://vercel.app")],
+                    },
+                ),
+            ),
+            allowed_origins_without_credentials: Some(pb::gateway::CorsAllowedOrigins {
+                allowed_origins: vec![String::from("https://*-foo.vercel.app")],
+            }),
+            extra_allowed_headers: vec![],
+            extra_exposed_headers: vec![],
+            allow_private_network_access: false,
+        },
+        creds_good_origins: &[],
+        creds_bad_origins: &[HeaderValue::from_static("https://blah-foo.vercel.app")],
+        nocreds_good_origins: &[HeaderValue::from_static("https://blah-foo.vercel.app")],
+        nocreds_bad_origins: &[],
+        good_headers: &[],
+        bad_headers: &[],
+    });
+}
diff --git a/runtimes/core/src/api/encore_routes/healthz.rs b/runtimes/core/src/api/encore_routes/healthz.rs
new file mode 100644
index 0000000000..801517872b
--- /dev/null
+++ b/runtimes/core/src/api/encore_routes/healthz.rs
@@ -0,0 +1,61 @@
+use axum::extract::Request;
+use axum::response::{IntoResponse, Json};
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Clone)]
+pub struct Handler {
+    pub app_revision: String,
+    pub deploy_id: String,
+}
+
+impl Handler {
+    pub fn health_check(self) -> Response {
+        log::trace!(code = "ok"; "handling incoming health check request");
+        Response {
+            code: "ok".into(),
+            message: "Your Encore app is up and running!".into(),
+            details: Details {
+                app_revision: self.app_revision,
+                encore_compiler: "".into(),
+                deploy_id: self.deploy_id,
+                checks: vec![],
+                enabled_experiments: vec![],
+            },
+        }
+    }
+}
+
+impl axum::handler::Handler<(), ()> for Handler {
+    type Future = std::pin::Pin<
+        Box<dyn std::future::Future<Output = axum::response::Response<axum::body::Body>> + Send>,
+    >;
+
+    fn call(self, _req: Request, _state: ()) -> Self::Future {
+        let resp = self.health_check();
+        Box::pin(async move { Json(resp).into_response() })
+    }
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct Response {
+    pub code: String,
+    pub message: String,
+    pub details: Details,
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct Details {
+    pub app_revision: String,
+    pub encore_compiler: String,
+    pub deploy_id: String,
+    pub checks: Vec<CheckResult>,
+    pub enabled_experiments: Vec<String>,
+}
+
+#[derive(Serialize, Deserialize)]
+pub struct CheckResult {
+    pub name: String,
+    pub passed: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
diff --git a/runtimes/core/src/api/encore_routes/mod.rs b/runtimes/core/src/api/encore_routes/mod.rs
new file mode 100644
index 0000000000..73a6d044c7
--- /dev/null
+++ b/runtimes/core/src/api/encore_routes/mod.rs
@@ -0,0 +1,21 @@
+use axum::routing;
+
+use crate::pubsub;
+
+pub mod healthz;
+
+pub struct Desc {
+    pub healthz: healthz::Handler,
+    pub push_registry: pubsub::PushHandlerRegistry,
+}
+
+impl Desc {
+    pub fn router(self) -> axum::Router<()> {
+        axum::Router::new()
+            .route("/__encore/healthz", routing::any(self.healthz))
+            .route(
+                "/__encore/pubsub/push/:subscription_id",
+                routing::any(self.push_registry),
+            )
+    }
+}
diff --git a/runtimes/core/src/api/endpoint.rs b/runtimes/core/src/api/endpoint.rs
new file mode 100644
index 0000000000..83f8697f03
--- /dev/null
+++ b/runtimes/core/src/api/endpoint.rs
@@ -0,0 +1,745 @@
+use std::collections::HashMap;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::{Arc, Mutex};
+
+use anyhow::Context;
+use axum::extract::{FromRequestParts, WebSocketUpgrade};
+use axum::http::HeaderValue;
+use axum::response::IntoResponse;
+use bytes::{BufMut, BytesMut};
+use http::HeaderMap;
+use indexmap::IndexMap;
+use percent_encoding::percent_decode_str;
+use serde::Serialize;
+
+use crate::api::reqauth::{platform, svcauth, CallMeta};
+use crate::api::schema::encoding::{
+    handshake_encoding, request_encoding, response_encoding, HandshakeSchemaUnderConstruction,
+    ReqSchemaUnderConstruction, SchemaUnderConstruction,
+};
+use crate::api::schema::{JSONPayload, Method};
+use crate::api::{jsonschema, schema, ErrCode, Error};
+use crate::encore::parser::meta::v1::rpc;
+use crate::encore::parser::meta::v1::{self as meta, selector};
+use crate::log::LogFromRust;
+use crate::model::StreamDirection;
+use crate::names::EndpointName;
+use crate::trace;
+use crate::{model, Hosted};
+
+use super::pvalue::{PValue, PValues};
+use super::reqauth::caller::Caller;
+
+/// Cached environment variable for whether to include error stacks in error response logs.
+static ENCORE_LOG_INCLUDE_ERROR_STACK: once_cell::sync::Lazy<bool> =
+    once_cell::sync::Lazy::new(|| {
+        std::env::var("ENCORE_LOG_INCLUDE_ERROR_STACK")
+            .map(|v| !v.is_empty() && v != "0")
+            .unwrap_or(false)
+    });
+
+#[derive(Debug)]
+pub struct SuccessResponse {
+    pub status: axum::http::StatusCode,
+    pub headers: axum::http::HeaderMap,
+    pub body: Option<PValue>,
+}
+
+/// Represents the result of calling an API endpoint.
+pub type Response = APIResult<SuccessResponse>;
+
+pub type APIResult<T> = Result<T, Error>;
+
+impl IntoResponse for SuccessResponse {
+    fn into_response(self) -> axum::http::Response<axum::body::Body> {
+        // Serialize the response body.
+        // Use a small initial capacity of 128 bytes like serde_json::to_vec
+        // https://docs.rs/serde_json/1.0.82/src/serde_json/ser.rs.html#2189
+        let bld = {
+            let mut bld = axum::http::Response::builder();
+            *(bld.headers_mut().unwrap()) = self.headers;
+            bld
+        }
+        .status(self.status);
+
+        match self.body {
+            Some(body) => {
+                let bld = bld.header(
+                    axum::http::header::CONTENT_TYPE,
+                    HeaderValue::from_static(mime::APPLICATION_JSON.as_ref()),
+                );
+                let mut buf = BytesMut::with_capacity(128).writer();
+                match serde_json::to_writer(&mut buf, &body) {
+                    Ok(()) => bld
+                        .body(axum::body::Body::from(buf.into_inner().freeze()))
+                        .unwrap(),
+                    Err(err) => Error::internal(err).to_response(None),
+                }
+            }
+            None => bld.body(axum::body::Body::empty()).unwrap(),
+        }
+    }
+}
+
+pub trait ToResponse {
+    fn to_response(&self, caller: Option<Caller>) -> axum::response::Response;
+}
+
+impl ToResponse for Error {
+    fn to_response(&self, caller: Option<Caller>) -> axum::http::Response<axum::body::Body> {
+        // considure response to be external if caller is gateway, or if the caller is
+        // unknown
+        let internal_call = caller.map(|caller| !caller.is_gateway()).unwrap_or(false);
+
+        let mut buf = BytesMut::with_capacity(128).writer();
+
+        if internal_call {
+            serde_json::to_writer(&mut buf, &self).unwrap();
+        } else {
+            serde_json::to_writer(&mut buf, &self.as_external()).unwrap();
+        }
+
+        axum::http::Response::builder()
+            .status::<axum::http::status::StatusCode>(self.code.into())
+            .header(
+                axum::http::header::CONTENT_TYPE,
+                HeaderValue::from_static(mime::APPLICATION_JSON.as_ref()),
+            )
+            .body(axum::body::Body::from(buf.into_inner().freeze()))
+            .unwrap()
+    }
+}
+
+pub type HandlerRequest = Arc<model::Request>;
+pub type HandlerResponse = APIResult<HandlerResponseInner>;
+
+pub struct HandlerResponseInner {
+    pub payload: JSONPayload,
+    pub extra_headers: Option<HeaderMap>,
+    pub status: Option<u16>,
+}
+
+/// A trait for handlers that accept a request and return a response.
+pub trait TypedHandler: Send + Sync + 'static {
+    fn call(
+        self: Arc<Self>,
+        req: HandlerRequest,
+    ) -> Pin<Box<dyn Future<Output = HandlerResponse> + Send + 'static>>;
+}
+
+/// A trait for handlers that accept a request and return a response.
+pub trait BoxedHandler: Send + Sync + 'static {
+    fn call(
+        self: Arc<Self>,
+        req: HandlerRequest,
+    ) -> Pin<Box<dyn Future<Output = ResponseData> + Send + 'static>>;
+}
+
+pub enum ResponseData {
+    Typed(HandlerResponse),
+    Raw(axum::http::Response<axum::body::Body>),
+}
+
+/// Schema variations for stream handshake
+#[derive(Debug)]
+pub enum HandshakeSchema {
+    // Handshake with only a path, no parseable data
+    Path(schema::Path),
+    // Handshake with a request schema
+    Request(schema::Request),
+}
+
+impl HandshakeSchema {
+    pub fn path(&self) -> &schema::Path {
+        match self {
+            HandshakeSchema::Path(path) => path,
+            HandshakeSchema::Request(schema::Request { path, .. }) => path,
+        }
+    }
+}
+
+/// Represents a single API Endpoint.
+#[derive(Debug)]
+pub struct Endpoint {
+    pub name: EndpointName,
+    pub path: meta::Path,
+    pub handshake: Option<Arc<HandshakeSchema>>,
+    pub request: Vec<Arc<schema::Request>>,
+    pub response: Arc<schema::Response>,
+
+    /// Whether this is a raw endpoint.
+    pub raw: bool,
+
+    /// Whether the service is exposed publicly.
+    pub exposed: bool,
+
+    /// Whether the service requires authentication data.
+    pub requires_auth: bool,
+
+    /// The maximum size of the request body.
+    /// If None, no limits are applied.
+    pub body_limit: Option<u64>,
+
+    /// The static assets to serve from this endpoint.
+    /// Set only for static asset endpoints.
+    pub static_assets: Option<meta::rpc::StaticAssets>,
+
+    /// The tags for this endpoint.
+    pub tags: Vec<String>,
+
+    /// Treat endpoint as sensitive and redact details from traces.
+    pub sensitive: bool,
+}
+
+impl Endpoint {
+    pub fn methods(&self) -> impl Iterator<Item = Method> + '_ {
+        self.request
+            .iter()
+            .flat_map(|schema| schema.methods.iter().copied())
+    }
+}
+
+#[derive(Debug, Serialize, Clone)]
+pub struct RequestPayload {
+    #[serde(flatten)]
+    pub path: Option<IndexMap<String, PValue>>,
+
+    #[serde(flatten)]
+    pub query: Option<PValues>,
+
+    #[serde(flatten)]
+    pub header: Option<PValues>,
+
+    #[serde(flatten)]
+    pub cookie: Option<PValues>,
+
+    #[serde(flatten, skip_serializing_if = "Body::is_raw")]
+    pub body: Body,
+}
+
+#[derive(Debug, Serialize, Clone)]
+#[serde(untagged)]
+pub enum Body {
+    Typed(Option<PValues>),
+    #[serde(skip)]
+    Raw(Arc<std::sync::Mutex<Option<axum::body::Body>>>),
+}
+
+impl Body {
+    pub fn is_raw(&self) -> bool {
+        matches!(self, Body::Raw(_))
+    }
+}
+
+#[derive(Debug, Serialize, Clone)]
+pub struct ResponsePayload {
+    #[serde(flatten)]
+    pub header: Option<PValues>,
+
+    #[serde(flatten)]
+    pub cookie: Option<PValues>,
+
+    #[serde(flatten, skip_serializing_if = "Body::is_raw")]
+    pub body: Body,
+}
+
+pub type EndpointMap = HashMap<EndpointName, Arc<Endpoint>>;
+
+/// Compute a set of endpoint descriptions based on metadata
+/// and a list of which endpoints are hosted by this runtime.
+pub fn endpoints_from_meta(
+    md: &meta::Data,
+    hosted_services: &Hosted,
+) -> anyhow::Result<(Arc<EndpointMap>, Vec<EndpointName>)> {
+    let mut registry_builder = jsonschema::Builder::new(md);
+
+    struct EndpointUnderConstruction<'a> {
+        svc: &'a meta::Service,
+        ep: &'a meta::Rpc,
+        handshake_schema: Option<HandshakeSchemaUnderConstruction>,
+        request_schemas: Vec<ReqSchemaUnderConstruction>,
+        response_schema: SchemaUnderConstruction,
+    }
+
+    // Compute the schemas for each endpoint.
+    let mut endpoints = Vec::new();
+    let mut hosted_endpoints = Vec::new();
+    for svc in &md.svcs {
+        let is_hosted = hosted_services.contains(&svc.name);
+        for ep in &svc.rpcs {
+            // If this endpoint is hosted, mark it as such.
+            if is_hosted {
+                hosted_endpoints.push(EndpointName::new(&svc.name, &ep.name));
+            }
+
+            let handshake_schema = handshake_encoding(&mut registry_builder, md, ep)?;
+            let request_schemas = request_encoding(&mut registry_builder, md, ep)?;
+            let response_schema = response_encoding(&mut registry_builder, md, ep)?;
+
+            endpoints.push(EndpointUnderConstruction {
+                svc,
+                ep,
+                handshake_schema,
+                request_schemas,
+                response_schema,
+            });
+        }
+    }
+
+    let registry = registry_builder.build();
+
+    let mut endpoint_map = EndpointMap::with_capacity(endpoints.len());
+
+    for ep in endpoints {
+        let mut request_schemas = Vec::with_capacity(ep.request_schemas.len());
+        let raw = rpc::Protocol::try_from(ep.ep.proto).is_ok_and(|p| p == rpc::Protocol::Raw);
+
+        let handshake_schema = ep
+            .handshake_schema
+            .map(|schema| schema.build(&registry))
+            .transpose()?;
+
+        let handshake = handshake_schema
+            .map(|handshake_schema| -> anyhow::Result<Arc<HandshakeSchema>> {
+                let path = handshake_schema
+                    .schema
+                    .path
+                    .context("endpoint must have a path defined")?;
+
+                let handshake_schema = if handshake_schema.parse_data {
+                    let handshake_schema = schema::Request {
+                        methods: vec![],
+                        path,
+                        header: handshake_schema.schema.header,
+                        query: handshake_schema.schema.query,
+                        body: schema::RequestBody::Typed(None),
+                        cookie: handshake_schema.schema.cookie,
+                        stream: false,
+                    };
+
+                    HandshakeSchema::Request(handshake_schema)
+                } else {
+                    HandshakeSchema::Path(path)
+                };
+
+                Ok(Arc::new(handshake_schema))
+            })
+            .transpose()?;
+
+        for req_schema in ep.request_schemas {
+            let req_schema = req_schema.build(&registry)?;
+            let path = req_schema
+                .schema
+                .path
+                .or_else(|| handshake.as_ref().map(|hs| hs.path().clone()))
+                .context("endpoint must have path defined")?;
+
+            request_schemas.push(Arc::new(schema::Request {
+                methods: req_schema.methods,
+                path,
+                header: req_schema.schema.header,
+                query: req_schema.schema.query,
+                cookie: req_schema.schema.cookie,
+                body: if raw {
+                    schema::RequestBody::Raw
+                } else {
+                    schema::RequestBody::Typed(req_schema.schema.body)
+                },
+                stream: ep.ep.streaming_request,
+            }));
+        }
+        let resp_schema = ep.response_schema.build(&registry)?;
+
+        // We only support a single gateway right now.
+        let exposed = ep.ep.expose.contains_key("api-gateway");
+        let raw =
+            rpc::Protocol::try_from(ep.ep.proto).is_ok_and(|proto| proto == rpc::Protocol::Raw);
+
+        let tags = ep
+            .ep
+            .tags
+            .iter()
+            .filter(|item| item.r#type() == selector::Type::Tag)
+            .map(|item| item.value.clone())
+            .collect();
+
+        let endpoint = Endpoint {
+            name: EndpointName::new(ep.svc.name.clone(), ep.ep.name.clone()),
+            path: ep.ep.path.clone().unwrap_or_else(|| meta::Path {
+                r#type: meta::path::Type::Url as i32,
+                segments: vec![meta::PathSegment {
+                    r#type: meta::path_segment::SegmentType::Literal as i32,
+                    value_type: meta::path_segment::ParamType::String as i32,
+                    value: format!("/{}.{}", ep.ep.service_name, ep.ep.name),
+                    validation: None,
+                }],
+            }),
+            handshake,
+            request: request_schemas,
+            response: Arc::new(schema::Response {
+                header: resp_schema.header,
+                cookie: resp_schema.cookie,
+                body: resp_schema.body,
+                http_status: resp_schema.http_status,
+                stream: ep.ep.streaming_response,
+            }),
+            raw,
+            exposed,
+            requires_auth: !ep.ep.allow_unauthenticated,
+            body_limit: ep.ep.body_limit,
+            static_assets: ep.ep.static_assets.clone(),
+            tags,
+            sensitive: ep.ep.sensitive,
+        };
+
+        endpoint_map.insert(
+            EndpointName::new(&ep.svc.name, &ep.ep.name),
+            Arc::new(endpoint),
+        );
+    }
+
+    Ok((Arc::new(endpoint_map), hosted_endpoints))
+}
+
+pub(super) struct EndpointHandler {
+    pub endpoint: Arc<Endpoint>,
+    pub handler: Arc<dyn BoxedHandler>,
+    pub shared: Arc<SharedEndpointData>,
+}
+
+#[derive(Debug)]
+pub(super) struct SharedEndpointData {
+    pub tracer: trace::Tracer,
+    pub platform_auth: Arc<platform::RequestValidator>,
+    pub inbound_svc_auth: Vec<Arc<dyn svcauth::ServiceAuthMethod>>,
+
+    /// The schema to use when parsing auth data, if any.
+    /// NOTE: This assumes there's at most a single API Gateway.
+    /// When we support multiple this needs to be made into a map, and the
+    /// correct schema looked up based on the gateway being used.
+    pub auth_data_schemas: HashMap<String, Option<jsonschema::JSONSchema>>,
+}
+
+impl Clone for EndpointHandler {
+    fn clone(&self) -> Self {
+        Self {
+            endpoint: self.endpoint.clone(),
+            handler: self.handler.clone(),
+            shared: self.shared.clone(),
+        }
+    }
+}
+
+impl EndpointHandler {
+    async fn parse_request(
+        &self,
+        axum_req: axum::extract::Request,
+    ) -> APIResult<Arc<model::Request>> {
+        let method = axum_req.method();
+        // Method conversion should never fail since we only register valid methods.
+        let api_method = Method::try_from(method.clone()).expect("invalid method");
+
+        let req_schema = self
+            .endpoint
+            .request
+            .iter()
+            .find(|schema| schema.methods.contains(&api_method))
+            .expect("request schema must exist for all endpoints");
+
+        let streaming_request = req_schema.stream;
+        let streaming_response = self.endpoint.response.stream;
+
+        let stream_direction = match (streaming_request, streaming_response) {
+            (true, true) => Some(StreamDirection::InOut),
+            (true, false) => Some(StreamDirection::In),
+            (false, true) => Some(StreamDirection::Out),
+            (false, false) => None,
+        };
+
+        let (mut parts, body) = axum_req
+            .map(|b| match self.endpoint.body_limit {
+                None => b,
+                Some(limit) => {
+                    axum::body::Body::new(http_body_util::Limited::new(b, limit as usize))
+                }
+            })
+            .into_parts();
+
+        // Authenticate the request from the platform, if applicable.
+        #[allow(clippy::manual_unwrap_or_default)]
+        let platform_seal_of_approval = match self.authenticate_platform(&parts) {
+            Ok(seal) => seal,
+            Err(_err) => None,
+        };
+
+        let meta = CallMeta::parse_with_caller(
+            &self.shared.inbound_svc_auth,
+            &parts.headers,
+            &self.shared.auth_data_schemas,
+        )?;
+
+        let parsed_payload = if let Some(handshake_schema) = &self.endpoint.handshake {
+            match handshake_schema.as_ref() {
+                HandshakeSchema::Request(req_schema) => {
+                    req_schema.extract(&mut parts, body).await?
+                }
+                HandshakeSchema::Path(_) => None,
+            }
+        } else {
+            req_schema.extract(&mut parts, body).await?
+        };
+
+        // Extract caller information.
+        let (internal_caller, auth_user_id, auth_data) = match meta.internal {
+            Some(internal) => (Some(internal.caller), internal.auth_uid, internal.auth_data),
+            None => (None, None, None),
+        };
+
+        let trace_id = meta.trace_id;
+        let span_id = meta.this_span_id.unwrap_or_else(model::SpanId::generate);
+        let span = trace_id.with_span(span_id);
+        let parent_span = meta.parent_span_id.map(|sp| trace_id.with_span(sp));
+
+        let data = if let Some(direction) = stream_direction {
+            let websocket_upgrade = Mutex::new(Some(
+                WebSocketUpgrade::from_request_parts(&mut parts, &()).await?,
+            ));
+
+            model::RequestData::Stream(model::StreamRequestData {
+                endpoint: self.endpoint.clone(),
+                path: parts.uri.path().to_string(),
+                path_and_query: parts
+                    .uri
+                    .path_and_query()
+                    .map(|q| q.to_string())
+                    .unwrap_or_default(),
+                path_params: parsed_payload.as_ref().and_then(|p| p.path.clone()),
+                req_headers: parts.headers,
+                auth_user_id,
+                auth_data,
+                parsed_payload,
+                websocket_upgrade,
+                direction,
+            })
+        } else {
+            model::RequestData::RPC(model::RPCRequestData {
+                endpoint: self.endpoint.clone(),
+                method: api_method,
+                path: parts.uri.path().to_string(),
+                path_and_query: parts
+                    .uri
+                    .path_and_query()
+                    .map(|q| q.to_string())
+                    .unwrap_or_default(),
+                path_params: parsed_payload.as_ref().and_then(|p| p.path.clone()),
+                req_headers: parts.headers,
+                auth_user_id,
+                auth_data,
+                parsed_payload,
+            })
+        };
+
+        let request = Arc::new(model::Request {
+            span,
+            parent_trace: None,
+            parent_span,
+            caller_event_id: meta.parent_event_id,
+            ext_correlation_id: meta.ext_correlation_id,
+            start: tokio::time::Instant::now(),
+            start_time: std::time::SystemTime::now(),
+            is_platform_request: platform_seal_of_approval.is_some(),
+            internal_caller,
+            data,
+        });
+
+        Ok(request)
+    }
+
+    fn handle(
+        self,
+        axum_req: axum::extract::Request,
+    ) -> Pin<Box<dyn Future<Output = axum::http::Response<axum::body::Body>> + Send + 'static>>
+    {
+        Box::pin(async move {
+            let request = match self.parse_request(axum_req).await {
+                Ok(req) => req,
+                Err(err) => return err.to_response(None),
+            };
+
+            let internal_caller = request.internal_caller.clone();
+            let sensitive = self.endpoint.sensitive;
+
+            // If the endpoint isn't exposed, return a 404.
+            if !self.endpoint.exposed && !request.allows_private_endpoint_call() {
+                return Error {
+                    code: ErrCode::NotFound,
+                    message: "endpoint not found".into(),
+                    internal_message: Some("the endpoint was found, but is not exposed".into()),
+                    stack: None,
+                    details: None,
+                }
+                .to_response(internal_caller);
+            } else if self.endpoint.requires_auth && !request.has_authenticated_user() {
+                return Error {
+                    code: ErrCode::Unauthenticated,
+                    message: "endpoint requires auth but none provided".into(),
+                    internal_message: None,
+                    stack: None,
+                    details: None,
+                }
+                .to_response(internal_caller);
+            }
+
+            let logger = crate::log::root();
+            logger.info(Some(&request), "starting request", None);
+
+            self.shared.tracer.request_span_start(&request, sensitive);
+
+            let resp: ResponseData = self.handler.call(request.clone()).await;
+
+            let duration = tokio::time::Instant::now().duration_since(request.start);
+
+            // If we had a request failure, log that separately.
+
+            if let ResponseData::Typed(Err(err)) = &resp {
+                logger.error(Some(&request), "request failed", Some(err), {
+                    let mut fields = crate::log::Fields::new();
+                    fields.insert(
+                        "code".into(),
+                        serde_json::Value::String(err.code.to_string()),
+                    );
+
+                    if let Some(internal_message) = &err.internal_message {
+                        fields.insert(
+                            "internal_message".into(),
+                            serde_json::Value::String(internal_message.clone()),
+                        );
+                    }
+
+                    if *ENCORE_LOG_INCLUDE_ERROR_STACK {
+                        if let Some(stack) = &err.stack {
+                            if let Ok(value) = serde_json::to_value(stack) {
+                                fields.insert("stack".into(), value);
+                            }
+                        }
+                    }
+
+                    Some(fields)
+                });
+            }
+
+            logger.info(Some(&request), "request completed", {
+                let mut fields = crate::log::Fields::new();
+                let dur_ms = (duration.as_secs() as f64 * 1000f64)
+                    + (duration.subsec_nanos() as f64 / 1_000_000f64);
+
+                fields.insert(
+                    "duration".into(),
+                    serde_json::Value::Number(serde_json::Number::from_f64(dur_ms).unwrap_or_else(
+                        || {
+                            // Fall back to integer if the f64 conversion fails
+                            serde_json::Number::from(duration.as_millis() as u64)
+                        },
+                    )),
+                );
+
+                let code = match &resp {
+                    ResponseData::Typed(Ok(_)) => "ok".to_string(),
+                    ResponseData::Typed(Err(err)) => err.code.to_string(),
+                    ResponseData::Raw(resp) => ErrCode::from(resp.status()).to_string(),
+                };
+
+                fields.insert("code".into(), serde_json::Value::String(code));
+                Some(fields)
+            });
+
+            let (mut encoded_resp, resp_payload, extra_headers, error) = match resp {
+                ResponseData::Raw(resp) => (resp, None, None, None),
+                ResponseData::Typed(Ok(response)) => (
+                    self.endpoint
+                        .response
+                        .encode(&response.payload, response.status.unwrap_or(200))
+                        .unwrap_or_else(|err| err.to_response(internal_caller)),
+                    Some(response.payload),
+                    response.extra_headers,
+                    None,
+                ),
+                ResponseData::Typed(Err(err)) => (
+                    err.as_ref().to_response(internal_caller),
+                    None,
+                    None,
+                    Some(err),
+                ),
+            };
+
+            {
+                let model_resp = model::Response {
+                    request: request.clone(),
+                    duration,
+                    data: model::ResponseData::RPC(model::RPCResponseData {
+                        status_code: encoded_resp.status().as_u16(),
+                        resp_payload,
+                        error,
+                        resp_headers: encoded_resp.headers().clone(),
+                    }),
+                };
+                self.shared.tracer.request_span_end(&model_resp, sensitive);
+            }
+
+            if let Ok(val) = HeaderValue::from_str(request.span.0.serialize_encore().as_str()) {
+                encoded_resp.headers_mut().insert("x-encore-trace-id", val);
+            }
+
+            if let Some(extra_headers) = extra_headers {
+                encoded_resp.headers_mut().extend(extra_headers)
+            }
+
+            encoded_resp
+        })
+    }
+
+    fn authenticate_platform(
+        &self,
+        req: &axum::http::request::Parts,
+    ) -> Result<Option<platform::SealOfApproval>, platform::ValidationError> {
+        let Some(x_encore_auth_header) = req.headers.get("x-encore-auth") else {
+            return Ok(None);
+        };
+        let x_encore_auth_header = x_encore_auth_header
+            .to_str()
+            .map_err(|_| platform::ValidationError::InvalidMac)?;
+
+        let Some(date_header) = req.headers.get("Date") else {
+            return Err(platform::ValidationError::InvalidDateHeader);
+        };
+        let date_header = date_header
+            .to_str()
+            .map_err(|_| platform::ValidationError::InvalidDateHeader)?;
+
+        let request_path = percent_decode_str(req.uri.path()).decode_utf8_lossy();
+        let req = platform::ValidationData {
+            request_path: &request_path,
+            date_header,
+            x_encore_auth_header,
+        };
+
+        self.shared
+            .platform_auth
+            .validate_platform_request(&req)
+            .map(Some)
+    }
+}
+
+impl axum::handler::Handler<(), ()> for EndpointHandler {
+    type Future =
+        Pin<Box<dyn Future<Output = axum::http::Response<axum::body::Body>> + Send + 'static>>;
+
+    fn call(self, axum_req: axum::extract::Request, _state: ()) -> Self::Future {
+        self.handle(axum_req)
+    }
+}
+
+pub fn path_supports_tsr(path: &str) -> bool {
+    path != "/" && !path.ends_with('/') && !path.contains("/*")
+}
diff --git a/runtimes/core/src/api/error.rs b/runtimes/core/src/api/error.rs
new file mode 100644
index 0000000000..0280c91e36
--- /dev/null
+++ b/runtimes/core/src/api/error.rs
@@ -0,0 +1,489 @@
+use std::fmt::{Debug, Display};
+use std::str::FromStr;
+
+use crate::api::jsonschema;
+use crate::error::{AppError, StackTrace};
+use axum::extract::ws::rejection::WebSocketUpgradeRejection;
+use serde::ser::SerializeStruct;
+use serde::{Deserialize, Deserializer, Serialize};
+use serde_with::{DeserializeFromStr, SerializeDisplay};
+
+use super::jsonschema::JSONSchema;
+use super::PValues;
+
+/// Represents an API Error.
+#[derive(Serialize, Deserialize, Debug, Clone)]
+pub struct Error {
+    pub code: ErrCode,
+    pub message: String,
+    pub internal_message: Option<String>,
+    #[serde(deserialize_with = "deserialize_details_as_any")]
+    pub details: ErrDetails,
+
+    #[serde(skip_serializing)]
+    pub stack: Option<StackTrace>,
+}
+
+pub type ErrDetails = Option<Box<PValues>>;
+
+// We don't have a schema for error details, so we do best effort to deserialize them.
+// Special types like Date will be lost, as we can't know if its a Date or a string.
+fn deserialize_details_as_any<'de, D>(deserializer: D) -> Result<ErrDetails, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    Ok(JSONSchema::any()
+        .deserialize(deserializer, jsonschema::DecodeConfig::default())
+        .map(|pvalues| Some(Box::new(pvalues)))
+        .unwrap_or(None))
+}
+
+/// ErrorExternal hides internal information on `Error` when it serializes
+#[derive(Debug)]
+pub struct ExternalError<'a>(&'a Error);
+
+/// Cached environment variable for whether to include internal message in all errors.
+static ENCORE_API_INCLUDE_INTERNAL_MESSAGE: once_cell::sync::Lazy<bool> =
+    once_cell::sync::Lazy::new(|| {
+        std::env::var("ENCORE_API_INCLUDE_INTERNAL_MESSAGE")
+            .map(|v| !v.is_empty() && v != "0")
+            .unwrap_or(false)
+    });
+
+/// Cached environment variable for whether to include the stack in error responses.
+static ENCORE_API_INCLUDE_ERROR_STACK: once_cell::sync::Lazy<bool> =
+    once_cell::sync::Lazy::new(|| {
+        std::env::var("ENCORE_API_INCLUDE_ERROR_STACK")
+            .map(|v| !v.is_empty() && v != "0")
+            .unwrap_or(false)
+    });
+
+impl Serialize for ExternalError<'_> {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: serde::Serializer,
+    {
+        let mut error = serializer.serialize_struct("Error", 3)?;
+        error.serialize_field("code", &self.0.code)?;
+        error.serialize_field("message", &self.0.message)?;
+        error.serialize_field("details", &self.0.details)?;
+
+        // Include internal message even in external errors iff the environment variable is set.
+        if *ENCORE_API_INCLUDE_INTERNAL_MESSAGE {
+            error.serialize_field("internal_message", &self.0.internal_message)?;
+        }
+
+        // Do the same for stack traces.
+        if *ENCORE_API_INCLUDE_ERROR_STACK {
+            error.serialize_field("stack", &self.0.stack)?;
+        }
+
+        error.end()
+    }
+}
+
+impl Error {
+    pub fn as_external(&self) -> ExternalError<'_> {
+        ExternalError(self)
+    }
+
+    pub fn internal<E>(cause: E) -> Self
+    where
+        E: Into<anyhow::Error>,
+    {
+        Self {
+            code: ErrCode::Internal,
+            message: ErrCode::Internal.default_public_message().into(),
+            internal_message: Some(format!("{:#?}", cause.into())),
+            stack: None,
+            details: None,
+        }
+    }
+
+    pub fn invalid_argument<S, E>(public_msg: S, cause: E) -> Self
+    where
+        S: Into<String>,
+        E: Into<anyhow::Error>,
+    {
+        Self {
+            code: ErrCode::InvalidArgument,
+            message: format!("{}: {:?}", public_msg.into(), cause.into()),
+            internal_message: None,
+            stack: None,
+            details: None,
+        }
+    }
+
+    pub fn not_found<S>(public_msg: S) -> Self
+    where
+        S: Into<String>,
+    {
+        Self {
+            code: ErrCode::NotFound,
+            message: public_msg.into(),
+            internal_message: None,
+            stack: None,
+            details: None,
+        }
+    }
+
+    pub fn unauthenticated() -> Self {
+        Self {
+            code: ErrCode::Unauthenticated,
+            message: ErrCode::Unauthenticated.default_public_message().into(),
+            internal_message: None,
+            stack: None,
+            details: None,
+        }
+    }
+}
+
+impl From<WebSocketUpgradeRejection> for Error {
+    fn from(value: WebSocketUpgradeRejection) -> Self {
+        Error {
+            code: value.status().into(),
+            message: value.body_text(),
+            internal_message: Some(value.body_text()),
+            stack: None,
+            details: None,
+        }
+    }
+}
+
+impl From<Error> for AppError {
+    fn from(val: Error) -> Self {
+        let message = match val.internal_message {
+            Some(ref internal_msg) => format!("{}: {}", val.message, internal_msg),
+            None => val.message,
+        };
+        AppError::new(message)
+    }
+}
+
+impl From<&Error> for AppError {
+    fn from(val: &Error) -> Self {
+        let message = match val.internal_message {
+            Some(ref internal_msg) => format!("{}: {}", val.message, internal_msg),
+            None => val.message.clone(),
+        };
+
+        // TODO: capture the JS stack trace for this error
+        AppError {
+            message,
+            stack: vec![],
+            cause: None,
+        }
+    }
+}
+
+impl From<Error> for Box<pingora::Error> {
+    fn from(err: Error) -> Self {
+        pingora::Error::because(
+            pingora::ErrorType::HTTPStatus(err.code.status_code().into()),
+            err.code.to_string(),
+            err,
+        )
+    }
+}
+
+impl std::error::Error for Error {}
+
+impl Display for Error {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match &self.internal_message {
+            Some(msg) => write!(f, "{msg}"),
+            None => write!(f, "{}", self.message),
+        }
+    }
+}
+
+impl AsRef<Error> for Error {
+    fn as_ref(&self) -> &Self {
+        self
+    }
+}
+
+/// Represents an API Error.
+#[derive(SerializeDisplay, DeserializeFromStr, Debug, Copy, Clone, PartialEq, Eq)]
+pub enum ErrCode {
+    /// Canceled indicates the operation was canceled (typically by the caller).
+    ///
+    /// Encore will generate this error code when cancellation is requested.
+    Canceled,
+
+    /// Unknown error. An example of where this error may be returned is
+    /// if a Status value received from another address space belongs to
+    /// an error-space that is not known in this address space. Also
+    /// errors raised by APIs that do not return enough error information
+    /// may be converted to this error.
+    ///
+    /// Encore will generate this error code in the above two mentioned cases.
+    Unknown,
+
+    /// InvalidArgument indicates client specified an invalid argument.
+    /// Note that this differs from FailedPrecondition. It indicates arguments
+    /// that are problematic regardless of the state of the system
+    /// (e.g., a malformed file name).
+    ///
+    /// Encore will generate this error code if the request data cannot be parsed.
+    InvalidArgument,
+
+    /// DeadlineExceeded means operation expired before completion.
+    /// For operations that change the state of the system, this error may be
+    /// returned even if the operation has completed successfully. For
+    /// example, a successful response from a server could have been delayed
+    /// long enough for the deadline to expire.
+    ///
+    /// Encore will generate this error code when the deadline is exceeded.
+    DeadlineExceeded,
+
+    /// NotFound means some requested entity (e.g., file or directory) was
+    /// not found.
+    ///
+    /// Encore will not generate this error code.
+    NotFound,
+
+    /// AlreadyExists means an attempt to create an entity failed because one
+    /// already exists.
+    ///
+    /// Encore will not generate this error code.
+    AlreadyExists,
+
+    /// PermissionDenied indicates the caller does not have permission to
+    /// execute the specified operation. It must not be used for rejections
+    /// caused by exhausting some resource (use ResourceExhausted
+    /// instead for those errors). It must not be
+    /// used if the caller cannot be identified (use Unauthenticated
+    /// instead for those errors).
+    ///
+    /// Encore will not generate this error code.
+    PermissionDenied,
+
+    /// ResourceExhausted indicates some resource has been exhausted, perhaps
+    /// a per-user quota, or perhaps the entire file system is out of space.
+    ///
+    /// Encore will generate this error code in out-of-memory and server overload
+    /// situations, or when a message is larger than the configured maximum size.
+    ResourceExhausted,
+
+    /// FailedPrecondition indicates operation was rejected because the
+    /// system is not in a state required for the operation's execution.
+    /// For example, directory to be deleted may be non-empty, an rmdir
+    /// operation is applied to a non-directory, etc.
+    ///
+    /// A litmus test that may help a service implementor in deciding
+    /// between FailedPrecondition, Aborted, and Unavailable:
+    ///  (a) Use Unavailable if the client can retry just the failing call.
+    ///  (b) Use Aborted if the client should retry at a higher-level
+    ///      (e.g., restarting a read-modify-write sequence).
+    ///  (c) Use FailedPrecondition if the client should not retry until
+    ///      the system state has been explicitly fixed. E.g., if an "rmdir"
+    ///      fails because the directory is non-empty, FailedPrecondition
+    ///      should be returned since the client should not retry unless
+    ///      they have first fixed up the directory by deleting files from it.
+    ///  (d) Use FailedPrecondition if the client performs conditional
+    ///      Get/Update/Delete on a resource and the resource on the
+    ///      server does not match the condition. E.g., conflicting
+    ///      read-modify-write on the same resource.
+    ///
+    /// Encore will not generate this error code.
+    FailedPrecondition,
+
+    /// Aborted indicates the operation was aborted, typically due to a
+    /// concurrency issue like sequencer check failures, transaction aborts,
+    /// etc.
+    ///
+    /// See litmus test above for deciding between FailedPrecondition,
+    /// Aborted, and Unavailable.
+    Aborted,
+
+    /// OutOfRange means operation was attempted past the valid range.
+    /// E.g., seeking or reading past end of file.
+    ///
+    /// Unlike InvalidArgument, this error indicates a problem that may
+    /// be fixed if the system state changes. For example, a 32-bit file
+    /// system will generate InvalidArgument if asked to read at an
+    /// offset that is not in the range [0,2^32-1], but it will generate
+    /// OutOfRange if asked to read from an offset past the current
+    /// file size.
+    ///
+    /// There is a fair bit of overlap between FailedPrecondition and
+    /// OutOfRange. We recommend using OutOfRange (the more specific
+    /// error) when it applies so that callers who are iterating through
+    /// a space can easily look for an OutOfRange error to detect when
+    /// they are done.
+    ///
+    /// Encore will not generate this error code.
+    OutOfRange,
+
+    /// Unimplemented indicates operation is not implemented or not
+    /// supported/enabled in this service.
+    ///
+    /// Encore will generate this error code when an endpoint does not exist.
+    Unimplemented,
+
+    /// Internal errors. Means some invariants expected by underlying
+    /// system has been broken. If you see one of these errors,
+    /// something is very broken.
+    ///
+    /// Encore will generate this error code in several internal error conditions.
+    Internal,
+
+    /// Unavailable indicates the service is currently unavailable.
+    /// This is a most likely a transient condition and may be corrected
+    /// by retrying with a backoff. Note that it is not always safe to retry
+    /// non-idempotent operations.
+    ///
+    /// See litmus test above for deciding between FailedPrecondition,
+    /// Aborted, and Unavailable.
+    ///
+    /// Encore will generate this error code in aubrupt shutdown of a server process
+    /// or network connection.
+    Unavailable,
+
+    /// DataLoss indicates unrecoverable data loss or corruption.
+    ///
+    /// Encore will not generate this error code.
+    DataLoss,
+
+    /// Unauthenticated indicates the request does not have valid
+    /// authentication credentials for the operation.
+    ///
+    /// Encore will generate this error code when the authentication metadata
+    /// is invalid or missing, and expects auth handlers to return errors with
+    /// this code when the auth token is not valid.
+    Unauthenticated,
+}
+
+impl ErrCode {
+    pub fn default_public_message(&self) -> &'static str {
+        match self {
+            ErrCode::Canceled => "the operation was canceled",
+            ErrCode::Unknown => "an unknown error occurred",
+            ErrCode::InvalidArgument => "the request is invalid",
+            ErrCode::DeadlineExceeded => "the operation timed out",
+            ErrCode::NotFound => "the requested resource was not found",
+            ErrCode::AlreadyExists => "the resource already exists",
+            ErrCode::PermissionDenied => "the caller does not have permission to execute the specified operation",
+            ErrCode::ResourceExhausted => "the resource has been exhausted",
+            ErrCode::FailedPrecondition => "the operation was rejected because the system is not in a state required for the operation's execution",
+            ErrCode::Aborted => "the operation was aborted",
+            ErrCode::OutOfRange => "the operation was attempted past the valid range",
+            ErrCode::Unimplemented => "the operation is not implemented or not supported/enabled in this service",
+            ErrCode::Internal => "an internal error occurred",
+            ErrCode::Unavailable => "the service is currently unavailable",
+            ErrCode::DataLoss => "unrecoverable data loss or corruption occurred",
+            ErrCode::Unauthenticated => "the request does not have valid authentication credentials for the operation",
+        }
+    }
+
+    pub fn status_code(&self) -> axum::http::StatusCode {
+        match self {
+            ErrCode::Canceled => axum::http::StatusCode::from_u16(499).unwrap(),
+            ErrCode::Unknown => axum::http::StatusCode::INTERNAL_SERVER_ERROR,
+            ErrCode::InvalidArgument => axum::http::StatusCode::BAD_REQUEST,
+            ErrCode::DeadlineExceeded => axum::http::StatusCode::GATEWAY_TIMEOUT,
+            ErrCode::NotFound => axum::http::StatusCode::NOT_FOUND,
+            ErrCode::AlreadyExists => axum::http::StatusCode::CONFLICT,
+            ErrCode::PermissionDenied => axum::http::StatusCode::FORBIDDEN,
+            ErrCode::ResourceExhausted => axum::http::StatusCode::TOO_MANY_REQUESTS,
+            ErrCode::FailedPrecondition => axum::http::StatusCode::BAD_REQUEST,
+            ErrCode::Aborted => axum::http::StatusCode::CONFLICT,
+            ErrCode::OutOfRange => axum::http::StatusCode::BAD_REQUEST,
+            ErrCode::Unimplemented => axum::http::StatusCode::NOT_IMPLEMENTED,
+            ErrCode::Internal => axum::http::StatusCode::INTERNAL_SERVER_ERROR,
+            ErrCode::Unavailable => axum::http::StatusCode::SERVICE_UNAVAILABLE,
+            ErrCode::DataLoss => axum::http::StatusCode::INTERNAL_SERVER_ERROR,
+            ErrCode::Unauthenticated => axum::http::StatusCode::UNAUTHORIZED,
+        }
+    }
+}
+
+impl Display for ErrCode {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ErrCode::Canceled => write!(f, "canceled"),
+            ErrCode::Unknown => write!(f, "unknown"),
+            ErrCode::InvalidArgument => write!(f, "invalid_argument"),
+            ErrCode::DeadlineExceeded => write!(f, "deadline_exceeded"),
+            ErrCode::NotFound => write!(f, "not_found"),
+            ErrCode::AlreadyExists => write!(f, "already_exists"),
+            ErrCode::PermissionDenied => write!(f, "permission_denied"),
+            ErrCode::ResourceExhausted => write!(f, "resource_exhausted"),
+            ErrCode::FailedPrecondition => write!(f, "failed_precondition"),
+            ErrCode::Aborted => write!(f, "aborted"),
+            ErrCode::OutOfRange => write!(f, "out_of_range"),
+            ErrCode::Unimplemented => write!(f, "unimplemented"),
+            ErrCode::Internal => write!(f, "internal"),
+            ErrCode::Unavailable => write!(f, "unavailable"),
+            ErrCode::DataLoss => write!(f, "data_loss"),
+            ErrCode::Unauthenticated => write!(f, "unauthenticated"),
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct UnknownErrCode {
+    pub code: String,
+}
+
+impl Display for UnknownErrCode {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{} (unknown)", self.code)
+    }
+}
+
+impl std::error::Error for UnknownErrCode {}
+
+impl FromStr for ErrCode {
+    type Err = UnknownErrCode;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        match s {
+            "canceled" => Ok(ErrCode::Canceled),
+            "unknown" => Ok(ErrCode::Unknown),
+            "invalid_argument" => Ok(ErrCode::InvalidArgument),
+            "deadline_exceeded" => Ok(ErrCode::DeadlineExceeded),
+            "not_found" => Ok(ErrCode::NotFound),
+            "already_exists" => Ok(ErrCode::AlreadyExists),
+            "permission_denied" => Ok(ErrCode::PermissionDenied),
+            "resource_exhausted" => Ok(ErrCode::ResourceExhausted),
+            "failed_precondition" => Ok(ErrCode::FailedPrecondition),
+            "aborted" => Ok(ErrCode::Aborted),
+            "out_of_range" => Ok(ErrCode::OutOfRange),
+            "unimplemented" => Ok(ErrCode::Unimplemented),
+            "internal" => Ok(ErrCode::Internal),
+            "unavailable" => Ok(ErrCode::Unavailable),
+            "data_loss" => Ok(ErrCode::DataLoss),
+            "unauthenticated" => Ok(ErrCode::Unauthenticated),
+            other => Err(UnknownErrCode {
+                code: other.to_owned(),
+            }),
+        }
+    }
+}
+
+impl From<ErrCode> for axum::http::status::StatusCode {
+    fn from(val: ErrCode) -> Self {
+        val.status_code()
+    }
+}
+
+impl From<axum::http::status::StatusCode> for ErrCode {
+    fn from(status: axum::http::status::StatusCode) -> Self {
+        match status.as_u16() {
+            400 => ErrCode::InvalidArgument,
+            401 => ErrCode::Unauthenticated,
+            403 => ErrCode::PermissionDenied,
+            404 => ErrCode::NotFound,
+            409 => ErrCode::AlreadyExists,
+            429 => ErrCode::ResourceExhausted,
+            499 => ErrCode::Canceled,
+            500 => ErrCode::Internal,
+            501 => ErrCode::Unimplemented,
+            503 => ErrCode::Unavailable,
+            504 => ErrCode::DeadlineExceeded,
+            _ => ErrCode::Unknown,
+        }
+    }
+}
diff --git a/runtimes/core/src/api/gateway/mod.rs b/runtimes/core/src/api/gateway/mod.rs
new file mode 100644
index 0000000000..9753a57bf8
--- /dev/null
+++ b/runtimes/core/src/api/gateway/mod.rs
@@ -0,0 +1,530 @@
+mod router;
+mod websocket;
+
+use std::borrow::Cow;
+use std::collections::HashMap;
+use std::net::SocketAddr;
+use std::sync::Arc;
+
+use anyhow::Context;
+use axum::async_trait;
+use bytes::{BufMut, Bytes, BytesMut};
+use http::uri::Scheme;
+use hyper::header;
+use pingora::http::{RequestHeader, ResponseHeader};
+use pingora::protocols::http::error_resp;
+use pingora::proxy::{http_proxy_service, ProxyHttp, Session};
+use pingora::server::configuration::{Opt, ServerConf};
+use pingora::services::Service;
+use pingora::upstreams::peer::HttpPeer;
+use pingora::{Error, ErrorSource, ErrorType, OkOrErr, OrErr};
+use router::Target;
+use tokio::sync::watch;
+use url::Url;
+
+use crate::api::auth;
+use crate::api::call::{CallDesc, ServiceRegistry};
+use crate::api::paths::PathSet;
+use crate::api::reqauth::caller::Caller;
+use crate::api::reqauth::{svcauth, CallMeta};
+use crate::{api, model, EncoreName};
+
+use super::cors::cors_headers_config::CorsHeadersConfig;
+use super::encore_routes::healthz;
+
+#[derive(Clone)]
+pub struct Gateway {
+    inner: Arc<Inner>,
+}
+
+struct Inner {
+    shared: Arc<SharedGatewayData>,
+    service_registry: Arc<ServiceRegistry>,
+    router: router::Router,
+    cors_config: CorsHeadersConfig,
+    healthz: healthz::Handler,
+    own_api_address: Option<SocketAddr>,
+    proxied_push_subs: HashMap<String, EncoreName>,
+}
+
+pub struct GatewayCtx {
+    upstream_service_name: EncoreName,
+    upstream_base_path: String,
+    upstream_host: Option<String>,
+    upstream_require_auth: bool,
+}
+
+impl GatewayCtx {
+    fn prepend_base_path(&self, uri: &http::Uri) -> anyhow::Result<http::Uri> {
+        let mut builder = http::Uri::builder();
+        if let Some(scheme) = uri.scheme() {
+            builder = builder.scheme(scheme.clone());
+        }
+        if let Some(authority) = uri.authority() {
+            builder = builder.authority(authority.clone());
+        }
+
+        let base_path = self.upstream_base_path.trim_end_matches('/');
+        builder = builder.path_and_query(format!(
+            "{}{}",
+            base_path,
+            uri.path_and_query().map_or("", |pq| pq.as_str())
+        ));
+
+        builder.build().context("failed to build uri")
+    }
+}
+
+impl Gateway {
+    #[allow(clippy::too_many_arguments)]
+    pub fn new(
+        name: EncoreName,
+        service_registry: Arc<ServiceRegistry>,
+        service_routes: PathSet<EncoreName, Arc<api::Endpoint>>,
+        auth_handler: Option<auth::Authenticator>,
+        cors_config: CorsHeadersConfig,
+        healthz: healthz::Handler,
+        own_api_address: Option<SocketAddr>,
+        proxied_push_subs: HashMap<String, EncoreName>,
+    ) -> anyhow::Result<Self> {
+        let shared = Arc::new(SharedGatewayData {
+            name,
+            auth: auth_handler,
+        });
+
+        let mut router = router::Router::new();
+        router.add_routes(&service_routes)?;
+
+        Ok(Gateway {
+            inner: Arc::new(Inner {
+                shared,
+                service_registry,
+                router,
+                cors_config,
+                healthz,
+                own_api_address,
+                proxied_push_subs,
+            }),
+        })
+    }
+
+    pub fn auth_handler(&self) -> Option<&auth::Authenticator> {
+        self.inner.shared.auth.as_ref()
+    }
+
+    pub async fn serve(self, listen_addr: &str) -> anyhow::Result<()> {
+        let conf = Arc::new(
+            ServerConf::new_with_opt_override(&Opt {
+                upgrade: false,
+                daemon: false,
+                nocapture: false,
+                test: false,
+                conf: None,
+            })
+            .unwrap(),
+        );
+        let mut proxy = http_proxy_service(&conf, self);
+
+        proxy.add_tcp(listen_addr);
+
+        let (_tx, rx) = watch::channel(false);
+        proxy
+            .start_service(
+                #[cfg(unix)]
+                None,
+                rx,
+            )
+            .await;
+
+        Ok(())
+    }
+}
+
+#[async_trait]
+impl ProxyHttp for Gateway {
+    type CTX = Option<GatewayCtx>;
+
+    fn new_ctx(&self) -> Self::CTX {
+        None
+    }
+
+    // see https://github.com/cloudflare/pingora/blob/main/docs/user_guide/internals.md for
+    // details on when different filters are called.
+
+    async fn request_filter(
+        &self,
+        session: &mut Session,
+        _ctx: &mut Self::CTX,
+    ) -> pingora::Result<bool>
+    where
+        Self::CTX: Send + Sync,
+    {
+        if session.req_header().uri.path() == "/__encore/healthz" {
+            let healthz_resp = self.inner.healthz.clone().health_check();
+            let healthz_bytes: Vec<u8> = serde_json::to_vec(&healthz_resp)
+                .or_err(ErrorType::HTTPStatus(500), "could not encode response")?;
+
+            let mut header = ResponseHeader::build(200, None)?;
+            header.insert_header(header::CONTENT_LENGTH, healthz_bytes.len())?;
+            header.insert_header(header::CONTENT_TYPE, "application/json")?;
+            session
+                .write_response_header(Box::new(header), false)
+                .await?;
+            session
+                .write_response_body(Some(Bytes::from(healthz_bytes)), true)
+                .await?;
+
+            return Ok(true);
+        }
+
+        // preflight request, return early with cors headers
+        if axum::http::Method::OPTIONS == session.req_header().method {
+            let mut resp = ResponseHeader::build(200, None)?;
+            self.inner
+                .cors_config
+                .apply(session.req_header(), &mut resp)?;
+            resp.insert_header(header::CONTENT_LENGTH, 0)?;
+            session.write_response_header(Box::new(resp), true).await?;
+
+            return Ok(true);
+        }
+
+        Ok(false)
+    }
+
+    async fn upstream_peer(
+        &self,
+        session: &mut Session,
+        ctx: &mut Self::CTX,
+    ) -> pingora::Result<Box<HttpPeer>> {
+        let path = session.req_header().uri.path();
+
+        // Check if this is a pubsub push request and if we need to proxy it to another service
+        let push_proxy_svc = path
+            .strip_prefix("/__encore/pubsub/push/")
+            .and_then(|sub_id| self.inner.proxied_push_subs.get(sub_id))
+            .map(|svc| Target {
+                service_name: svc.clone(),
+                requires_auth: false,
+            });
+
+        if let Some(own_api_addr) = &self.inner.own_api_address {
+            if push_proxy_svc.is_none() && path.starts_with("/__encore/") {
+                return Ok(Box::new(HttpPeer::new(own_api_addr, false, "".to_string())));
+            }
+        }
+        let target = push_proxy_svc.map_or_else(
+            || {
+                // Find which service handles the path route
+                session
+                    .req_header()
+                    .method
+                    .as_ref()
+                    .try_into()
+                    .map_err(|e: anyhow::Error| api::Error {
+                        code: api::ErrCode::InvalidArgument,
+                        message: "invalid method".to_string(),
+                        internal_message: Some(e.to_string()),
+                        stack: None,
+                        details: None,
+                    })
+                    .and_then(|method| self.inner.router.route_to_service(method, path))
+                    .cloned()
+            },
+            Ok,
+        )?;
+
+        let upstream = self
+            .inner
+            .service_registry
+            .service_base_url(&target.service_name)
+            .or_err(ErrorType::InternalError, "couldn't find upstream")?;
+
+        let upstream_url: Url = upstream
+            .parse()
+            .or_err(ErrorType::InternalError, "upstream not a valid url")?;
+
+        let upstream_addrs = upstream_url
+            .socket_addrs(|| match upstream_url.scheme() {
+                "https" => Some(443),
+                "http" => Some(80),
+                _ => None,
+            })
+            .or_err(
+                ErrorType::InternalError,
+                "couldn't lookup upstream ip address",
+            )?;
+
+        let upstream_addr = upstream_addrs.first().or_err(
+            ErrorType::InternalError,
+            "didn't find any upstream ip addresses",
+        )?;
+
+        let tls = upstream_url.scheme() == "https";
+        let host = upstream_url.host().map(|h| h.to_string());
+        let peer = HttpPeer::new(upstream_addr, tls, host.clone().unwrap_or_default());
+
+        ctx.replace(GatewayCtx {
+            upstream_base_path: upstream_url.path().to_string(),
+            upstream_host: host,
+            upstream_service_name: target.service_name.clone(),
+            upstream_require_auth: target.requires_auth,
+        });
+
+        Ok(Box::new(peer))
+    }
+
+    async fn response_filter(
+        &self,
+        session: &mut Session,
+        upstream_response: &mut ResponseHeader,
+        ctx: &mut Self::CTX,
+    ) -> pingora::Result<()>
+    where
+        Self::CTX: Send + Sync,
+    {
+        if ctx.is_some() {
+            self.inner
+                .cors_config
+                .apply(session.req_header(), upstream_response)?;
+        }
+
+        Ok(())
+    }
+
+    async fn upstream_request_filter(
+        &self,
+        session: &mut Session,
+        upstream_request: &mut RequestHeader,
+        ctx: &mut Self::CTX,
+    ) -> pingora::Result<()>
+    where
+        Self::CTX: Send + Sync,
+    {
+        if let Some(gateway_ctx) = ctx.as_ref() {
+            let new_uri = gateway_ctx
+                .prepend_base_path(&upstream_request.uri)
+                .or_err(
+                    ErrorType::InternalError,
+                    "failed to prepend upstream base path",
+                )?;
+
+            upstream_request.set_uri(new_uri);
+
+            if let Some(ref host) = gateway_ctx.upstream_host {
+                upstream_request.insert_header(header::HOST, host)?;
+            }
+
+            if session.is_upgrade_req() {
+                websocket::update_headers_from_websocket_protocol(upstream_request).or_err(
+                    ErrorType::HTTPStatus(400),
+                    "invalid auth data passed in websocket protocol header",
+                )?;
+            }
+
+            // Set X-Forwarded-* headers, based on https://cs.opensource.google/go/go/+/refs/tags/go1.24.3:src/net/http/httputil/reverseproxy.go;l=78
+            if let Some(client_addr) = session.client_addr().and_then(|addr| addr.as_inet()) {
+                let client_ip = client_addr.ip().to_string();
+
+                let prior_headers = upstream_request
+                    .headers
+                    .get_all("x-forwarded-for")
+                    .iter()
+                    .filter_map(|v| std::str::from_utf8(v.as_bytes()).ok())
+                    .fold(String::new(), |mut acc, header| {
+                        if !acc.is_empty() {
+                            acc.push_str(", ");
+                        }
+                        acc.push_str(header);
+                        acc
+                    });
+
+                if !prior_headers.is_empty() {
+                    let combined = format!("{prior_headers}, {client_ip}");
+                    upstream_request.insert_header("x-forwarded-for", combined)?;
+                } else {
+                    upstream_request.insert_header("x-forwarded-for", client_ip)?;
+                }
+            } else {
+                upstream_request.remove_header("x-forwarded-for");
+            }
+
+            if let Some(host) = session.req_header().headers.get(header::HOST) {
+                upstream_request.insert_header("x-forwarded-host", host)?;
+            }
+
+            upstream_request.insert_header(
+                "x-forwarded-proto",
+                match session.req_header().uri.scheme() == Some(&Scheme::HTTPS) {
+                    true => "https",
+                    false => "http",
+                },
+            )?;
+
+            let svc_auth_method = self
+                .inner
+                .service_registry
+                .service_auth_method(&gateway_ctx.upstream_service_name)
+                .unwrap_or_else(|| Arc::new(svcauth::Noop));
+
+            let headers = &upstream_request.headers;
+
+            let mut call_meta = CallMeta::parse_without_caller(headers).or_err(
+                ErrorType::InternalError,
+                "couldn't parse CallMeta from request",
+            )?;
+            if call_meta.parent_span_id.is_none() {
+                call_meta.parent_span_id = Some(model::SpanId::generate());
+            }
+
+            let caller = Caller::Gateway {
+                gateway: self.inner.shared.name.clone(),
+            };
+            let mut desc = CallDesc {
+                caller: &caller,
+                parent_span: call_meta
+                    .parent_span_id
+                    .map(|sp| call_meta.trace_id.with_span(sp)),
+                parent_event_id: None,
+                ext_correlation_id: call_meta
+                    .ext_correlation_id
+                    .as_ref()
+                    .map(|s| Cow::Borrowed(s.as_str())),
+                auth_user_id: None,
+                auth_data: None,
+                svc_auth_method: svc_auth_method.as_ref(),
+            };
+
+            if let Some(auth_handler) = &self.inner.shared.auth {
+                let auth_response = auth_handler
+                    .authenticate(upstream_request, call_meta.clone())
+                    .await
+                    .or_err(ErrorType::InternalError, "couldn't authenticate request")?;
+
+                match auth_response {
+                    auth::AuthResponse::Authenticated {
+                        auth_uid,
+                        auth_data,
+                    } => {
+                        desc.auth_user_id = Some(Cow::Owned(auth_uid));
+                        desc.auth_data = Some(auth_data);
+                    }
+                    auth::AuthResponse::Unauthenticated { error } => {
+                        if gateway_ctx.upstream_require_auth {
+                            return Err(error.into());
+                        }
+                    }
+                };
+            }
+
+            desc.add_meta(upstream_request)
+                .or_err(ErrorType::InternalError, "couldn't set request meta")?;
+        }
+
+        Ok(())
+    }
+
+    async fn fail_to_proxy(&self, session: &mut Session, e: &Error, _ctx: &mut Self::CTX) -> u16
+    where
+        Self::CTX: Send + Sync,
+    {
+        // modified version of `Session::respond_error` that adds cors headers,
+        // and handles specific errors
+
+        let code = match e.etype() {
+            ErrorType::HTTPStatus(code) => *code,
+            _ => {
+                match e.esource() {
+                    ErrorSource::Upstream => 502,
+                    ErrorSource::Downstream => {
+                        match e.etype() {
+                            ErrorType::WriteError
+                            | ErrorType::ReadError
+                            | ErrorType::ConnectionClosed => {
+                                /* conn already dead */
+                                return 0;
+                            }
+                            _ => 400,
+                        }
+                    }
+                    ErrorSource::Internal | ErrorSource::Unset => 500,
+                }
+            }
+        };
+
+        let (mut resp, body) = if let Some(api_error) = as_api_error(e) {
+            let (resp, body) = api_error_response(api_error);
+            (resp, Some(body))
+        } else {
+            (
+                match code {
+                    /* common error responses are pre-generated */
+                    502 => error_resp::HTTP_502_RESPONSE.clone(),
+                    400 => error_resp::HTTP_400_RESPONSE.clone(),
+                    _ => error_resp::gen_error_response(code),
+                },
+                None,
+            )
+        };
+
+        if let Err(e) = self
+            .inner
+            .cors_config
+            .apply(session.req_header(), &mut resp)
+        {
+            log::error!("failed setting cors header in error response: {e}");
+        }
+        session.set_keepalive(None);
+        session
+            .write_response_header(Box::new(resp), false)
+            .await
+            .unwrap_or_else(|e| {
+                log::error!("failed to send error response to downstream: {e}");
+            });
+
+        session
+            .write_response_body(body, true)
+            .await
+            .unwrap_or_else(|e| log::error!("failed to write body: {e}"));
+
+        code
+    }
+}
+
+fn as_api_error(err: &pingora::Error) -> Option<&api::Error> {
+    err.root_cause().downcast_ref::<api::Error>()
+}
+
+fn api_error_response(err: &api::Error) -> (ResponseHeader, bytes::Bytes) {
+    let mut buf = BytesMut::with_capacity(128).writer();
+    serde_json::to_writer(&mut buf, &err.as_external()).unwrap();
+
+    let mut resp = ResponseHeader::build(err.code.status_code(), Some(5)).unwrap();
+    resp.insert_header(header::SERVER, &pingora::protocols::http::SERVER_NAME[..])
+        .unwrap();
+    resp.insert_header(header::DATE, "Sun, 06 Nov 1994 08:49:37 GMT")
+        .unwrap(); // placeholder
+    resp.insert_header(header::CONTENT_LENGTH, buf.get_ref().len())
+        .unwrap();
+    resp.insert_header(header::CACHE_CONTROL, "private, no-store")
+        .unwrap();
+    resp.insert_header(header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+        .unwrap();
+
+    (resp, buf.into_inner().into())
+}
+
+impl crate::api::auth::InboundRequest for RequestHeader {
+    fn headers(&self) -> &axum::http::HeaderMap {
+        &self.headers
+    }
+
+    fn query(&self) -> Option<&str> {
+        self.uri.query()
+    }
+}
+
+struct SharedGatewayData {
+    name: EncoreName,
+    auth: Option<auth::Authenticator>,
+}
diff --git a/runtimes/core/src/api/gateway/router.rs b/runtimes/core/src/api/gateway/router.rs
new file mode 100644
index 0000000000..7354c6b0f9
--- /dev/null
+++ b/runtimes/core/src/api/gateway/router.rs
@@ -0,0 +1,149 @@
+use std::sync::Arc;
+
+use crate::{
+    api::{self, paths::PathSet, schema::Method},
+    EncoreName,
+};
+
+#[derive(Clone)]
+pub struct Router {
+    main: matchit::Router<MethodRoute>,
+    fallback: matchit::Router<MethodRoute>,
+}
+
+impl Router {
+    pub fn new() -> Self {
+        let main = matchit::Router::new();
+        let fallback = matchit::Router::new();
+        Router { main, fallback }
+    }
+
+    pub fn add_routes(
+        &mut self,
+        routes: &PathSet<EncoreName, Arc<api::Endpoint>>,
+    ) -> anyhow::Result<()> {
+        for (router, routes) in [
+            (&mut self.main, &routes.main),
+            (&mut self.fallback, &routes.fallback),
+        ] {
+            fn register_methods(
+                mr: &mut MethodRoute,
+                path: &str,
+                service: &EncoreName,
+                endpoint: &api::Endpoint,
+            ) {
+                for method in endpoint.methods() {
+                    let dst = match method {
+                        Method::GET => &mut mr.get,
+                        Method::HEAD => &mut mr.head,
+                        Method::POST => &mut mr.post,
+                        Method::PUT => &mut mr.put,
+                        Method::DELETE => &mut mr.delete,
+                        Method::OPTIONS => &mut mr.option,
+                        Method::TRACE => &mut mr.trace,
+                        Method::PATCH => &mut mr.patch,
+                    };
+                    log::trace!(path = path, method = method.as_str(); "registering route");
+                    if dst.is_some() {
+                        ::log::error!(method = method.as_str(), path = path; "tried to register same route twice, skipping");
+                        continue;
+                    }
+                    dst.replace(Target {
+                        service_name: service.clone(),
+                        requires_auth: endpoint.requires_auth,
+                    });
+                }
+            }
+
+            for (service, routes) in routes {
+                for (endpoint, paths) in routes {
+                    for path in paths {
+                        // Create a method route where we register each method the endpoint supports.
+                        let mut mr = MethodRoute::default();
+                        register_methods(&mut mr, path, service, endpoint);
+                        match router.insert(path, mr) {
+                            Ok(()) => {}
+                            Err(matchit::InsertError::Conflict { .. }) => {
+                                // If we have a conflict, we need to merge the method routes.
+                                let mr = router.at_mut(path).unwrap().value;
+                                register_methods(mr, path, service, endpoint);
+                            }
+                            Err(e) => return Err(e.into()),
+                        }
+                    }
+                }
+            }
+        }
+
+        Ok(())
+    }
+
+    pub fn route_to_service(
+        &self,
+        method: api::schema::Method,
+        path: &str,
+    ) -> Result<&Target, api::Error> {
+        let mut found_path_match = false;
+        for router in [&self.main, &self.fallback] {
+            if let Ok(service) = router.at(path) {
+                found_path_match = true;
+                let service = service.value.for_method(method);
+                if let Some(service) = service {
+                    return Ok(service);
+                }
+            }
+        }
+
+        // We couldn't find a matching route.
+        Err(if found_path_match {
+            api::Error {
+                code: api::ErrCode::NotFound,
+                message: "no route for method".to_string(),
+                internal_message: Some(format!("no route for method {method:?}: {path}")),
+                stack: None,
+                details: None,
+            }
+        } else {
+            api::Error {
+                code: api::ErrCode::NotFound,
+                message: "endpoint not found".to_string(),
+                internal_message: Some(format!("no such endpoint exists: {path}")),
+                stack: None,
+                details: None,
+            }
+        })
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct Target {
+    pub service_name: EncoreName,
+    pub requires_auth: bool,
+}
+
+#[derive(Clone, Default)]
+pub struct MethodRoute {
+    get: Option<Target>,
+    head: Option<Target>,
+    post: Option<Target>,
+    put: Option<Target>,
+    delete: Option<Target>,
+    option: Option<Target>,
+    trace: Option<Target>,
+    patch: Option<Target>,
+}
+
+impl MethodRoute {
+    fn for_method(&self, method: api::schema::Method) -> Option<&Target> {
+        match method {
+            Method::GET => self.get.as_ref(),
+            Method::HEAD => self.head.as_ref(),
+            Method::POST => self.post.as_ref(),
+            Method::PUT => self.put.as_ref(),
+            Method::DELETE => self.delete.as_ref(),
+            Method::OPTIONS => self.option.as_ref(),
+            Method::TRACE => self.trace.as_ref(),
+            Method::PATCH => self.patch.as_ref(),
+        }
+    }
+}
diff --git a/runtimes/core/src/api/gateway/websocket.rs b/runtimes/core/src/api/gateway/websocket.rs
new file mode 100644
index 0000000000..5c0ca1fe31
--- /dev/null
+++ b/runtimes/core/src/api/gateway/websocket.rs
@@ -0,0 +1,328 @@
+use std::{collections::HashMap, str::FromStr};
+
+use anyhow::anyhow;
+use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
+use http::{header::SEC_WEBSOCKET_PROTOCOL, HeaderName, HeaderValue};
+use pingora::http::RequestHeader;
+use serde::{
+    de::{self, Visitor},
+    Deserialize,
+};
+
+const ENCORE_DEV_HEADERS: &str = "encore.dev.headers.";
+
+// hack to be able to have browsers send request headers when setting up a websocket
+// inspired by https://github.com/kubernetes/kubernetes/commit/714f97d7baf4975ad3aa47735a868a81a984d1f0
+pub fn update_headers_from_websocket_protocol(
+    upstream_request: &mut RequestHeader,
+) -> anyhow::Result<()> {
+    let headers = upstream_request
+        .headers
+        .get_all(SEC_WEBSOCKET_PROTOCOL)
+        .into_iter()
+        .cloned()
+        .collect::<Vec<_>>();
+
+    if upstream_request
+        .remove_header(&SEC_WEBSOCKET_PROTOCOL)
+        .is_none()
+    {
+        return Ok(());
+    }
+
+    for header_value in headers {
+        let mut filterd_protocols = Vec::new();
+
+        for protocol in header_value.to_str()?.split(',') {
+            let protocol = protocol.trim();
+            if protocol.starts_with(ENCORE_DEV_HEADERS) {
+                let data = protocol.strip_prefix(ENCORE_DEV_HEADERS).unwrap();
+                let decoded = URL_SAFE_NO_PAD.decode(data)?;
+                let auth_data: AuthHeaderMap = serde_json::from_slice(&decoded)?;
+
+                for (name, value) in auth_data.0 {
+                    if is_forbidden_request_header(&name) {
+                        return Err(anyhow!("header {name} not allowed to be set"));
+                    }
+                    upstream_request.append_header(name, value)?;
+                }
+            } else {
+                filterd_protocols.push(protocol);
+            }
+        }
+
+        if !filterd_protocols.is_empty() {
+            upstream_request.append_header(SEC_WEBSOCKET_PROTOCOL, filterd_protocols.join(", "))?;
+        }
+    }
+
+    Ok(())
+}
+
+struct AuthHeaderMap(HashMap<HeaderName, HeaderValue>);
+
+impl<'de> Deserialize<'de> for AuthHeaderMap {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        deserializer.deserialize_map(AuthHeaderMapVisitor)
+    }
+}
+
+struct AuthHeaderMapVisitor;
+
+impl<'de> Visitor<'de> for AuthHeaderMapVisitor {
+    type Value = AuthHeaderMap;
+
+    fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {
+        formatter.write_str("AuthHeaderMap")
+    }
+
+    fn visit_map<A>(self, mut access: A) -> Result<Self::Value, A::Error>
+    where
+        A: serde::de::MapAccess<'de>,
+    {
+        let mut map = HashMap::with_capacity(access.size_hint().unwrap_or_default());
+
+        while let Some((key, value)) = access.next_entry::<&str, &str>()? {
+            let name = HeaderName::from_str(key).map_err(de::Error::custom)?;
+            let value = HeaderValue::from_str(value).map_err(de::Error::custom)?;
+
+            map.insert(name, value);
+        }
+
+        Ok(AuthHeaderMap(map))
+    }
+}
+
+// see https://developer.mozilla.org/en-US/docs/Glossary/Forbidden_header_name
+fn is_forbidden_request_header(name: &HeaderName) -> bool {
+    use http::header::*;
+    match *name {
+        ACCEPT_CHARSET
+        | ACCEPT_ENCODING
+        | ACCESS_CONTROL_REQUEST_HEADERS
+        | ACCESS_CONTROL_REQUEST_METHOD
+        | CONNECTION
+        | CONTENT_LENGTH
+        | COOKIE
+        | DATE
+        | DNT
+        | EXPECT
+        | HOST
+        | ORIGIN
+        | REFERER
+        | TE
+        | TRAILER
+        | TRANSFER_ENCODING
+        | UPGRADE
+        | VIA => true,
+        ref n if n == HeaderName::from_static("keep-alive") => true,
+        ref n if n == HeaderName::from_static("permissions-policy") => true,
+        ref n if n.as_str().starts_with("sec-") => true,
+        ref n if n.as_str().starts_with("proxy-") => true,
+        _ => false,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use http::{header::AUTHORIZATION, HeaderMap, HeaderName, HeaderValue};
+    use serde_json::json;
+
+    use super::*;
+
+    #[test]
+    fn test_headers_from_websocket_protocol_preserve_order() {
+        let mut req = RequestHeader::build(http::Method::GET, b"/some/path", None).unwrap();
+
+        req.append_header(
+            SEC_WEBSOCKET_PROTOCOL,
+            HeaderValue::from_static("protocol-a"),
+        )
+        .unwrap();
+        req.append_header(
+            SEC_WEBSOCKET_PROTOCOL,
+            HeaderValue::from_static("protocol-b1, protocol-b2"),
+        )
+        .unwrap();
+        req.append_header(
+            SEC_WEBSOCKET_PROTOCOL,
+            HeaderValue::from_static("protocol-c"),
+        )
+        .unwrap();
+
+        let expected = req.headers.clone();
+
+        update_headers_from_websocket_protocol(&mut req)
+            .expect("update headers from websocket protocol");
+
+        assert_eq!(expected, req.headers);
+    }
+
+    #[test]
+    fn test_filter_encore_headers() {
+        let mut req = RequestHeader::build(http::Method::GET, b"/some/path", None).unwrap();
+
+        req.append_header(
+            SEC_WEBSOCKET_PROTOCOL,
+            HeaderValue::from_static("main-protocol"),
+        )
+        .unwrap();
+        req.append_header(
+            SEC_WEBSOCKET_PROTOCOL,
+            HeaderValue::from_static("protocol-1, encore.dev.headers.e30K, protocol-2"),
+        )
+        .unwrap();
+        req.append_header(
+            SEC_WEBSOCKET_PROTOCOL,
+            HeaderValue::from_static("encore.dev.headers.e30K"),
+        )
+        .unwrap();
+
+        update_headers_from_websocket_protocol(&mut req)
+            .expect("update headers from websocket protocol");
+
+        let expected = HeaderMap::from_iter(vec![
+            (
+                SEC_WEBSOCKET_PROTOCOL,
+                HeaderValue::from_static("main-protocol"),
+            ),
+            (
+                SEC_WEBSOCKET_PROTOCOL,
+                HeaderValue::from_static("protocol-1, protocol-2"),
+            ),
+        ]);
+        assert_eq!(expected, req.headers);
+    }
+
+    #[test]
+    fn test_adds_auth_data_headers() {
+        let mut req = RequestHeader::build(http::Method::GET, b"/some/path", None).unwrap();
+
+        let data = json!({
+            "authorization": "token",
+            "x-other-header": "value"
+        });
+
+        let bytes = serde_json::to_vec(&data).unwrap();
+        let encoded = URL_SAFE_NO_PAD.encode(bytes);
+
+        req.append_header(
+            SEC_WEBSOCKET_PROTOCOL,
+            HeaderValue::from_str(&format!("main-protocol, encore.dev.headers.{encoded}")).unwrap(),
+        )
+        .unwrap();
+
+        update_headers_from_websocket_protocol(&mut req)
+            .expect("update headers from websocket protocol");
+
+        let expected = HeaderMap::from_iter(vec![
+            (
+                SEC_WEBSOCKET_PROTOCOL,
+                HeaderValue::from_static("main-protocol"),
+            ),
+            (AUTHORIZATION, HeaderValue::from_static("token")),
+            (
+                HeaderName::from_static("x-other-header"),
+                HeaderValue::from_static("value"),
+            ),
+        ]);
+        assert_eq!(expected, req.headers);
+    }
+
+    #[test]
+    fn test_appends_auth_data_headers() {
+        let mut req = RequestHeader::build(http::Method::GET, b"/some/path", None).unwrap();
+
+        let data = json!({
+            "x-other-header": "new-value"
+        });
+
+        let bytes = serde_json::to_vec(&data).unwrap();
+        let encoded = URL_SAFE_NO_PAD.encode(bytes);
+
+        req.append_header(
+            SEC_WEBSOCKET_PROTOCOL,
+            HeaderValue::from_str(&format!("main-protocol, encore.dev.headers.{encoded}")).unwrap(),
+        )
+        .unwrap();
+        req.append_header(
+            HeaderName::from_static("x-other-header"),
+            HeaderValue::from_static("prev-value"),
+        )
+        .unwrap();
+
+        update_headers_from_websocket_protocol(&mut req)
+            .expect("update headers from websocket protocol");
+
+        let expected = HeaderMap::from_iter(vec![
+            (
+                SEC_WEBSOCKET_PROTOCOL,
+                HeaderValue::from_static("main-protocol"),
+            ),
+            (
+                HeaderName::from_static("x-other-header"),
+                HeaderValue::from_static("prev-value"),
+            ),
+            (
+                HeaderName::from_static("x-other-header"),
+                HeaderValue::from_static("new-value"),
+            ),
+        ]);
+        assert_eq!(expected, req.headers);
+    }
+
+    #[test]
+    fn test_invalid_auth_data_header() {
+        let mut req = RequestHeader::build(http::Method::GET, b"/some/path", None).unwrap();
+
+        req.append_header(
+            SEC_WEBSOCKET_PROTOCOL,
+            HeaderValue::from_static("main-protocol, encore.dev.headers.invalid"),
+        )
+        .unwrap();
+
+        assert!(update_headers_from_websocket_protocol(&mut req).is_err());
+    }
+
+    #[test]
+    fn test_forbidden_request_headers() {
+        let mut req = RequestHeader::build(http::Method::GET, b"/some/path", None).unwrap();
+
+        let data = json!({
+            "cOOkie": "xyz",
+        });
+
+        let bytes = serde_json::to_vec(&data).unwrap();
+        let encoded = URL_SAFE_NO_PAD.encode(bytes);
+
+        req.append_header(
+            SEC_WEBSOCKET_PROTOCOL,
+            HeaderValue::from_str(&format!("main-protocol, encore.dev.headers.{encoded}")).unwrap(),
+        )
+        .unwrap();
+
+        assert!(update_headers_from_websocket_protocol(&mut req).is_err());
+    }
+    #[test]
+    fn test_forbidden_prefix_request_headers() {
+        let mut req = RequestHeader::build(http::Method::GET, b"/some/path", None).unwrap();
+
+        let data = json!({
+            "SEC-anything": "xyz",
+        });
+
+        let bytes = serde_json::to_vec(&data).unwrap();
+        let encoded = URL_SAFE_NO_PAD.encode(bytes);
+
+        req.append_header(
+            SEC_WEBSOCKET_PROTOCOL,
+            HeaderValue::from_str(&format!("main-protocol, encore.dev.headers.{encoded}")).unwrap(),
+        )
+        .unwrap();
+
+        assert!(update_headers_from_websocket_protocol(&mut req).is_err());
+    }
+}
diff --git a/runtimes/core/src/api/http.rs b/runtimes/core/src/api/http.rs
new file mode 100644
index 0000000000..da5e6a1502
--- /dev/null
+++ b/runtimes/core/src/api/http.rs
@@ -0,0 +1,70 @@
+#[derive(Debug, Copy, Clone, Hash, Eq, PartialEq)]
+pub enum Method {
+    GET,
+    HEAD,
+    POST,
+    PUT,
+    DELETE,
+    // CONNECT,
+    OPTIONS,
+    TRACE,
+    PATCH,
+}
+
+impl TryFrom<&str> for Method {
+    type Error = anyhow::Error;
+
+    fn try_from(s: &str) -> Result<Self, Self::Error> {
+        match s {
+            "GET" => Ok(Method::GET),
+            "HEAD" => Ok(Method::HEAD),
+            "POST" => Ok(Method::POST),
+            "PUT" => Ok(Method::PUT),
+            "DELETE" => Ok(Method::DELETE),
+            // "CONNECT" => Ok(Method::CONNECT),
+            "OPTIONS" => Ok(Method::OPTIONS),
+            "TRACE" => Ok(Method::TRACE),
+            "PATCH" => Ok(Method::PATCH),
+            _ => Err(anyhow::anyhow!("invalid method: {}", s)),
+        }
+    }
+}
+
+impl Into<axum::http::Method> for Method {
+    fn into(self) -> axum::http::Method {
+        match self {
+            Method::GET => axum::http::Method::GET,
+            Method::HEAD => axum::http::Method::HEAD,
+            Method::POST => axum::http::Method::POST,
+            Method::PUT => axum::http::Method::PUT,
+            Method::DELETE => axum::http::Method::DELETE,
+            // Method::CONNECT => axum::http::Method::CONNECT,
+            Method::OPTIONS => axum::http::Method::OPTIONS,
+            Method::TRACE => axum::http::Method::TRACE,
+            Method::PATCH => axum::http::Method::PATCH,
+        }
+    }
+}
+
+pub(super) fn method_filter<M>(methods: M) -> Option<axum::routing::MethodFilter>
+where
+    M: Iterator<Item = Method>,
+{
+    use axum::routing::MethodFilter;
+    let mut filter = None;
+    for method in methods {
+        let method_filter = match method {
+            Method::GET => MethodFilter::GET,
+            Method::HEAD => MethodFilter::HEAD,
+            Method::POST => MethodFilter::POST,
+            Method::PUT => MethodFilter::PUT,
+            Method::DELETE => MethodFilter::DELETE,
+            // Method::CONNECT => MethodFilter::CONNECT,
+            Method::OPTIONS => MethodFilter::OPTIONS,
+            Method::TRACE => MethodFilter::TRACE,
+            Method::PATCH => MethodFilter::PATCH,
+        };
+        filter = Some(filter.unwrap_or(method_filter).or(method_filter));
+    }
+    filter
+}
diff --git a/runtimes/core/src/api/http_server.rs b/runtimes/core/src/api/http_server.rs
new file mode 100644
index 0000000000..d87fe0a953
--- /dev/null
+++ b/runtimes/core/src/api/http_server.rs
@@ -0,0 +1,71 @@
+use std::convert::Infallible;
+use std::task::{Context, Poll};
+
+use axum::body::HttpBody;
+use axum::http::Request;
+use axum::response::Response;
+use axum::routing::future::RouteFuture;
+use axum::serve::IncomingStream;
+use axum::Router;
+use tower_service::Service;
+
+#[derive(Clone)]
+pub struct HttpServer {
+    encore_routes: Router,
+    api: Option<Router>,
+    fallback: Router,
+}
+
+impl HttpServer {
+    pub fn new(encore_routes: Router, api: Option<Router>, fallback: Router) -> Self {
+        Self {
+            encore_routes,
+            api,
+            fallback,
+        }
+    }
+}
+
+impl Service<IncomingStream<'_>> for HttpServer {
+    type Response = Self;
+    type Error = Infallible;
+    type Future = std::future::Ready<Result<Self::Response, Self::Error>>;
+
+    #[inline]
+    fn poll_ready(&mut self, _cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+        Poll::Ready(Ok(()))
+    }
+
+    #[inline]
+    fn call(&mut self, _req: IncomingStream<'_>) -> Self::Future {
+        std::future::ready(Ok(self.clone()))
+    }
+}
+
+impl<B> Service<Request<B>> for HttpServer
+where
+    B: HttpBody<Data = bytes::Bytes> + Send + 'static,
+    B::Error: Into<axum::BoxError>,
+{
+    type Response = Response;
+    type Error = Infallible;
+    type Future = RouteFuture<Infallible>;
+
+    #[inline]
+    fn poll_ready(&mut self, _cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+        Poll::Ready(Ok(()))
+    }
+
+    #[inline]
+    fn call(&mut self, req: Request<B>) -> Self::Future {
+        if req.uri().path().starts_with("/__encore/") {
+            return self.encore_routes.call(req);
+        }
+
+        let router = match self.api.as_mut() {
+            Some(api) => api,
+            None => &mut self.fallback,
+        };
+        router.call(req)
+    }
+}
diff --git a/runtimes/core/src/api/httputil.rs b/runtimes/core/src/api/httputil.rs
new file mode 100644
index 0000000000..9b51a63378
--- /dev/null
+++ b/runtimes/core/src/api/httputil.rs
@@ -0,0 +1,71 @@
+use std::borrow::Cow;
+
+use anyhow::Context;
+
+pub fn convert_headers(headers: &axum::http::HeaderMap) -> reqwest::header::HeaderMap {
+    let mut out = reqwest::header::HeaderMap::with_capacity(headers.len());
+    for (k, v) in headers {
+        let Ok((k, v)) = convert_header(k, v) else {
+            continue;
+        };
+        out.insert(k, v);
+    }
+    out
+}
+
+pub fn convert_header(
+    key: &axum::http::HeaderName,
+    value: &axum::http::HeaderValue,
+) -> anyhow::Result<(reqwest::header::HeaderName, reqwest::header::HeaderValue)> {
+    let k = reqwest::header::HeaderName::from_bytes(key.as_str().as_bytes())
+        .context("invalid header name")?;
+    let v = reqwest::header::HeaderValue::from_bytes(value.as_bytes())
+        .context("invalid header value")?;
+    Ok((k, v))
+}
+
+pub fn merge_query<'b>(target: Option<&str>, inbound: Option<&'b str>) -> Option<Cow<'b, str>> {
+    match (target, inbound) {
+        (Some(a), Some(b)) => {
+            let mut s = String::with_capacity(a.len() + b.len() + 1);
+            s.push_str(a);
+            s.push('&');
+            s.push_str(b);
+            Some(Cow::Owned(s))
+        }
+        (None, Some(b)) => Some(Cow::Borrowed(b)),
+        (_, None) => None,
+    }
+}
+
+pub fn join_url_path<'b>(target: &str, inbound: &'b str) -> Option<Cow<'b, str>> {
+    if inbound.is_empty() {
+        return None;
+    } else if target.is_empty() {
+        return Some(Cow::Borrowed(inbound));
+    }
+
+    let a_slash = target.ends_with('/');
+    let b_slash = inbound.starts_with('/');
+    Some(match (a_slash, b_slash) {
+        (true, true) => {
+            let mut s = String::with_capacity(target.len() + inbound.len() - 1);
+            s.push_str(target);
+            s.push_str(&inbound[1..]);
+            Cow::Owned(s)
+        }
+        (false, false) => {
+            let mut s = String::with_capacity(target.len() + inbound.len() + 1);
+            s.push_str(target);
+            s.push('/');
+            s.push_str(inbound);
+            Cow::Owned(s)
+        }
+        _ => {
+            let mut s = String::with_capacity(target.len() + inbound.len());
+            s.push_str(target);
+            s.push_str(inbound);
+            Cow::Owned(s)
+        }
+    })
+}
diff --git a/runtimes/core/src/api/jsonschema/de.rs b/runtimes/core/src/api/jsonschema/de.rs
new file mode 100644
index 0000000000..e78aa8f4c0
--- /dev/null
+++ b/runtimes/core/src/api/jsonschema/de.rs
@@ -0,0 +1,1481 @@
+use std::borrow::Cow;
+use std::collections::{BTreeMap, HashMap, HashSet};
+use std::fmt;
+use std::fmt::Display;
+use std::marker::PhantomData;
+use std::str::FromStr;
+
+use serde::de::{DeserializeSeed, MapAccess, SeqAccess, Unexpected, Visitor};
+use serde::Deserializer;
+
+use crate::api::jsonschema::{validation::Validation, Registry};
+use crate::api::{self, PValue, PValues};
+
+use serde_json::Number as JSONNumber;
+use serde_json::Value as JVal;
+
+#[derive(Debug, Clone)]
+pub enum Value {
+    // A JSON primitive (e.g. string, number, boolean, null).
+    Basic(Basic),
+
+    // A literal value.
+    Literal(Literal),
+
+    /// Consume a value if present.
+    Option(BasicOrValue),
+
+    /// Consume a map of key-value pairs (the keys are always strings in JSON).
+    Map(BasicOrValue),
+
+    /// A struct with a set of known fields.
+    Struct(Struct),
+
+    /// Consume an array of values.
+    Array(BasicOrValue),
+
+    /// Consume a single value, one of a union of possible types.
+    Union(Vec<BasicOrValue>),
+
+    /// Reference to another value.
+    Ref(usize),
+
+    /// A value with additional value-based validation.
+    Validation(Validation),
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct Struct {
+    pub fields: HashMap<String, Field>,
+}
+
+impl Struct {
+    pub fn is_empty(&self) -> bool {
+        self.fields.is_empty()
+    }
+
+    pub fn contains_name(&self, name: &str) -> bool {
+        self.fields
+            .iter()
+            .any(|(field_name, field)| field.name_override.as_deref().unwrap_or(field_name) == name)
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct Field {
+    pub value: BasicOrValue,
+    pub optional: bool,
+    pub name_override: Option<String>,
+}
+
+impl Value {
+    pub fn is_basic(&self) -> bool {
+        matches!(self, Value::Basic(_))
+    }
+
+    pub fn is_option(&self) -> bool {
+        matches!(self, Value::Option(_))
+    }
+
+    pub fn is_map(&self) -> bool {
+        matches!(self, Value::Map(_))
+    }
+
+    pub fn is_struct(&self) -> bool {
+        matches!(self, Value::Struct { .. })
+    }
+
+    pub fn is_array(&self) -> bool {
+        matches!(self, Value::Array(_))
+    }
+
+    pub fn is_ref(&self) -> bool {
+        matches!(self, Value::Ref(_))
+    }
+
+    pub fn expecting<'a>(&'a self, reg: &'a Registry) -> Cow<'a, str> {
+        match self {
+            Value::Array(_) => Cow::Borrowed("a JSON array"),
+            Value::Basic(basic) => Cow::Borrowed(basic.expecting()),
+            Value::Map(_) => Cow::Borrowed("a JSON map"),
+            Value::Literal(lit) => Cow::Owned(lit.expecting()),
+            Value::Option(bov) => bov.expecting(reg),
+            Value::Ref(idx) => reg.get(*idx).expecting(reg),
+            Value::Struct { .. } => Cow::Borrowed("a JSON object"),
+            Value::Validation(v) => v.bov.expecting(reg),
+            Value::Union(types) => {
+                let mut s = String::new();
+                let num = types.len();
+                for (i, typ) in types.iter().enumerate() {
+                    if i > 0 {
+                        if i == (num - 1) && num > 2 {
+                            s.push_str(", or ");
+                        } else if i == (num - 1) {
+                            s.push_str(" or ");
+                        } else {
+                            s.push_str(", ");
+                        }
+                    }
+                    s.push_str(&typ.expecting(reg));
+                }
+                Cow::Owned(s)
+            }
+        }
+    }
+}
+
+#[derive(Debug, Copy, Clone)]
+pub enum Basic {
+    Any, // Any valid JSON value.
+    Null,
+    Bool,
+    Number,
+    String,
+    DateTime,
+    Decimal,
+}
+
+impl Basic {
+    pub fn expecting(&self) -> &'static str {
+        match self {
+            Basic::Any => "any valid JSON value",
+            Basic::Null => "null",
+            Basic::Bool => "a boolean",
+            Basic::Number => "a number",
+            Basic::String => "a string",
+            Basic::DateTime => "a datetime string",
+            Basic::Decimal => "a decimal",
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub enum Literal {
+    Str(String), // A literal string
+    Bool(bool),
+    Int(i64),
+    Float(f64),
+}
+
+impl Literal {
+    pub fn expecting(&self) -> String {
+        match self {
+            Literal::Str(lit) => format!("{lit:#?}"),
+            Literal::Bool(lit) => format!("{lit:#?}"),
+            Literal::Int(lit) => format!("{lit:#?}"),
+            Literal::Float(lit) => format!("{lit:#?}"),
+        }
+    }
+
+    pub fn expecting_type(&self) -> &'static str {
+        match self {
+            Literal::Str(_) => "string",
+            Literal::Bool(_) => "boolean",
+            Literal::Int(_) => "integer",
+            Literal::Float(_) => "number",
+        }
+    }
+}
+
+#[derive(Debug, Copy, Clone)]
+pub enum BasicOrValue {
+    Basic(Basic),
+    Value(usize),
+}
+
+impl BasicOrValue {
+    pub fn expecting<'a>(&'a self, reg: &'a Registry) -> Cow<'a, str> {
+        match self {
+            BasicOrValue::Basic(basic) => Cow::Borrowed(basic.expecting()),
+            BasicOrValue::Value(idx) => reg.get(*idx).expecting(reg),
+        }
+    }
+}
+
+#[derive(Debug, Default, Clone)]
+pub struct DecodeConfig {
+    // If true, attempts to parse strings as other primitive types
+    // when there's a type mismatch.
+    pub coerce_strings: bool,
+
+    // Set to true if arrays are serialized into repeated fields
+    // (e.g query string parameters)
+    pub arrays_as_repeated_fields: bool,
+}
+
+#[derive(Copy, Clone, Debug)]
+pub(super) struct DecodeValue<'a> {
+    pub(super) cfg: &'a DecodeConfig,
+    pub(super) reg: &'a Registry,
+    pub(super) value: &'a Value,
+}
+
+impl<'a> DecodeValue<'a> {
+    fn resolve(&'a self, idx: usize) -> DecodeValue<'a> {
+        DecodeValue {
+            cfg: self.cfg,
+            reg: self.reg,
+            value: &self.reg.values[idx],
+        }
+    }
+}
+
+impl<'de: 'a, 'a> DeserializeSeed<'de> for DecodeValue<'a> {
+    type Value = PValue;
+
+    fn deserialize<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        deserializer.deserialize_any(self)
+    }
+}
+
+macro_rules! recurse_ref {
+    ($self:ident, $idx:expr, $method:ident, $value:expr) => {{
+        let visitor = DecodeValue {
+            cfg: $self.cfg,
+            reg: $self.reg,
+            value: &$self.reg.values[*$idx],
+        };
+        visitor.$method($value)
+    }};
+}
+
+macro_rules! recurse_ref0 {
+    ($self:ident, $idx:expr, $method:ident) => {{
+        let visitor = DecodeValue {
+            cfg: $self.cfg,
+            reg: $self.reg,
+            value: &$self.reg.values[*$idx],
+        };
+        visitor.$method()
+    }};
+}
+
+macro_rules! recurse {
+    ($self:ident, $bov:expr, $method:ident, $value:expr) => {{
+        match $bov {
+            BasicOrValue::Basic(basic) => {
+                let basic_val = Value::Basic(*basic);
+                let visitor = DecodeValue {
+                    cfg: $self.cfg,
+                    reg: $self.reg,
+                    value: &basic_val,
+                };
+                visitor.$method($value)
+            }
+            BasicOrValue::Value(idx) => {
+                let visitor = DecodeValue {
+                    cfg: $self.cfg,
+                    reg: $self.reg,
+                    value: &$self.reg.values[*idx],
+                };
+                visitor.$method($value)
+            }
+        }
+    }};
+}
+
+macro_rules! validate_pval {
+    ($self:ident, $v:ident, $method:ident, $value:expr) => {{
+        let inner = recurse!($self, &$v.bov, $method, $value)?;
+        match $v.validate_pval(&inner) {
+            Ok(()) => Ok(inner),
+            Err(err) => Err(serde::de::Error::custom(err)),
+        }
+    }};
+}
+
+macro_rules! validate_jval {
+    ($self:ident, $v:ident, $method:ident, $value:expr) => {{
+        recurse!($self, &$v.bov, $method, $value)?;
+        match $v.validate_jval($value) {
+            Ok(()) => Ok(()),
+            Err(err) => Err(serde::de::Error::custom(err)),
+        }
+    }};
+}
+
+macro_rules! recurse0 {
+    ($self:ident, $bov:expr, $method:ident) => {{
+        match $bov {
+            BasicOrValue::Basic(basic) => {
+                let basic_val = Value::Basic(*basic);
+                let visitor = DecodeValue {
+                    cfg: $self.cfg,
+                    reg: $self.reg,
+                    value: &basic_val,
+                };
+                visitor.$method()
+            }
+            BasicOrValue::Value(idx) => {
+                let visitor = DecodeValue {
+                    cfg: $self.cfg,
+                    reg: &$self.reg,
+                    value: &$self.reg.values[*idx],
+                };
+                visitor.$method()
+            }
+        }
+    }};
+}
+
+impl<'de> Visitor<'de> for DecodeValue<'_> {
+    type Value = PValue;
+
+    fn expecting(&self, formatter: &mut std::fmt::Formatter) -> std::fmt::Result {
+        match self.value {
+            Value::Literal(lit) => {
+                let s = lit.expecting();
+                formatter.write_str(&s)
+            }
+            Value::Basic(b) => formatter.write_str(match b {
+                Basic::Any => "any valid JSON value",
+                Basic::Null => "null",
+                Basic::Bool => "a boolean",
+                Basic::Number => "a number",
+                Basic::String => "a string",
+                Basic::DateTime => "a datetime string",
+                Basic::Decimal => "a decimal",
+            }),
+            Value::Map(_) => formatter.write_str("a JSON object"),
+            Value::Array(_) => formatter.write_str("a JSON array"),
+            Value::Union(union) => {
+                let num = union.len();
+                let mut s = String::new();
+                for (i, typ) in union.iter().enumerate() {
+                    if i > 0 {
+                        if num > 2 && i == (num - 1) {
+                            s.push_str(", or ");
+                        } else if i == (num - 1) {
+                            s.push_str(" or ");
+                        } else {
+                            s.push_str(", ");
+                        }
+                    }
+                    let expecting = typ.expecting(self.reg);
+                    s.push_str(&expecting);
+                }
+                formatter.write_str(&s)
+            }
+            Value::Option(_) => formatter.write_str("any valid JSON value or null"),
+            Value::Struct { .. } => formatter.write_str("a JSON object"),
+            Value::Ref(_) => formatter.write_str("a JSON value"),
+            Value::Validation(v) => formatter.write_str(v.bov.expecting(self.reg).as_ref()),
+        }
+    }
+
+    #[inline]
+    fn visit_bool<E>(self, value: bool) -> Result<PValue, E>
+    where
+        E: serde::de::Error,
+    {
+        match &self.value {
+            Value::Basic(Basic::Any | Basic::Bool) => Ok(PValue::Bool(value)),
+            Value::Ref(idx) => recurse_ref!(self, idx, visit_bool, value),
+            Value::Option(val) => {
+                recurse!(self, val, visit_bool, value)
+            }
+            Value::Literal(Literal::Bool(bool)) if *bool == value => Ok(PValue::Bool(value)),
+            Value::Validation(v) => validate_pval!(self, v, visit_bool, value),
+            Value::Union(types) => {
+                for typ in types {
+                    let res: Result<_, E> = recurse!(self, typ, visit_bool, value);
+                    if let Ok(val) = res {
+                        return Ok(val);
+                    }
+                }
+                Err(serde::de::Error::invalid_type(
+                    Unexpected::Bool(value),
+                    &self,
+                ))
+            }
+            _ => Err(serde::de::Error::invalid_type(
+                Unexpected::Bool(value),
+                &self,
+            )),
+        }
+    }
+
+    #[inline]
+    fn visit_i64<E>(self, value: i64) -> Result<PValue, E>
+    where
+        E: serde::de::Error,
+    {
+        match self.value {
+            Value::Basic(Basic::Any | Basic::Number) => Ok(PValue::Number(value.into())),
+            Value::Ref(idx) => recurse_ref!(self, idx, visit_i64, value),
+            Value::Option(val) => {
+                recurse!(self, val, visit_i64, value)
+            }
+            Value::Literal(Literal::Int(val)) if *val == value => Ok(PValue::Number(value.into())),
+            Value::Validation(v) => validate_pval!(self, v, visit_i64, value),
+            Value::Union(types) => {
+                for typ in types {
+                    let res: Result<_, E> = recurse!(self, typ, visit_i64, value);
+                    if let Ok(val) = res {
+                        return Ok(val);
+                    }
+                }
+                Err(serde::de::Error::invalid_type(
+                    Unexpected::Signed(value),
+                    &self,
+                ))
+            }
+            _ => Err(serde::de::Error::invalid_type(
+                Unexpected::Signed(value),
+                &self,
+            )),
+        }
+    }
+
+    #[inline]
+    fn visit_u64<E>(self, value: u64) -> Result<PValue, E>
+    where
+        E: serde::de::Error,
+    {
+        match self.value {
+            Value::Basic(Basic::Any | Basic::Number) => Ok(PValue::Number(value.into())),
+            Value::Ref(idx) => recurse_ref!(self, idx, visit_u64, value),
+            Value::Option(val) => {
+                recurse!(self, val, visit_u64, value)
+            }
+            Value::Literal(Literal::Int(val)) if *val == value as i64 => {
+                Ok(PValue::Number(value.into()))
+            }
+            Value::Validation(v) => validate_pval!(self, v, visit_u64, value),
+            Value::Union(types) => {
+                for typ in types {
+                    let res: Result<_, E> = recurse!(self, typ, visit_u64, value);
+                    if let Ok(val) = res {
+                        return Ok(val);
+                    }
+                }
+                Err(serde::de::Error::invalid_type(
+                    Unexpected::Unsigned(value),
+                    &self,
+                ))
+            }
+            _ => Err(serde::de::Error::invalid_type(
+                Unexpected::Unsigned(value),
+                &self,
+            )),
+        }
+    }
+
+    #[inline]
+    fn visit_f64<E>(self, value: f64) -> Result<PValue, E>
+    where
+        E: serde::de::Error,
+    {
+        match self.value {
+            Value::Basic(Basic::Any | Basic::Number) => {
+                Ok(JSONNumber::from_f64(value).map_or(PValue::Null, PValue::Number))
+            }
+            Value::Ref(idx) => recurse_ref!(self, idx, visit_f64, value),
+            Value::Option(bov) => {
+                recurse!(self, bov, visit_f64, value)
+            }
+            Value::Literal(Literal::Float(val)) if *val == value => {
+                if let Some(num) = JSONNumber::from_f64(value) {
+                    Ok(PValue::Number(num))
+                } else {
+                    Err(serde::de::Error::custom(format_args!(
+                        "expected {val}, got {value}"
+                    )))
+                }
+            }
+            Value::Validation(v) => validate_pval!(self, v, visit_f64, value),
+            Value::Union(types) => {
+                for typ in types {
+                    let res: Result<_, E> = recurse!(self, typ, visit_f64, value);
+                    if let Ok(val) = res {
+                        return Ok(val);
+                    }
+                }
+                Err(serde::de::Error::invalid_type(
+                    Unexpected::Float(value),
+                    &self,
+                ))
+            }
+            _ => Err(serde::de::Error::invalid_type(
+                Unexpected::Float(value),
+                &self,
+            )),
+        }
+    }
+
+    #[inline]
+    fn visit_str<E>(self, value: &str) -> Result<PValue, E>
+    where
+        E: serde::de::Error,
+    {
+        self.visit_string(String::from(value))
+    }
+
+    #[inline]
+    #[cfg_attr(
+        feature = "rttrace",
+        tracing::instrument(skip(self), ret, level = "trace")
+    )]
+    fn visit_string<E>(self, value: String) -> Result<PValue, E>
+    where
+        E: serde::de::Error,
+    {
+        match self.value {
+            Value::Array(bov) if self.cfg.arrays_as_repeated_fields => match bov {
+                BasicOrValue::Basic(basic) => {
+                    let basic_val = Value::Basic(*basic);
+                    let visitor = DecodeValue {
+                        cfg: self.cfg,
+                        reg: self.reg,
+                        value: &basic_val,
+                    };
+                    Ok(PValue::Array(vec![visitor.visit_string(value)?]))
+                }
+                BasicOrValue::Value(idx) => {
+                    let visitor = DecodeValue {
+                        cfg: self.cfg,
+                        reg: self.reg,
+                        value: &self.reg.values[*idx],
+                    };
+                    Ok(PValue::Array(vec![visitor.visit_string(value)?]))
+                }
+            },
+
+            Value::Basic(b) => match b {
+                Basic::Any | Basic::String => Ok(PValue::String(value)),
+                Basic::DateTime => api::DateTime::parse_from_rfc3339(&value)
+                    .map(PValue::DateTime)
+                    .map_err(|e| serde::de::Error::custom(format_args!("invalid datetime: {e}",))),
+                Basic::Decimal => api::Decimal::from_str(&value)
+                    .map(PValue::Decimal)
+                    .map_err(|e| serde::de::Error::custom(format_args!("invalid decimal: {e}",))),
+                Basic::Bool if self.cfg.coerce_strings => {
+                    if value == "true" {
+                        Ok(PValue::Bool(true))
+                    } else if value == "false" {
+                        Ok(PValue::Bool(false))
+                    } else {
+                        Err(serde::de::Error::custom(format_args!(
+                            "expected a boolean, got {value}"
+                        )))
+                    }
+                }
+                Basic::Number if self.cfg.coerce_strings => {
+                    if let Ok(num) = value.parse::<i64>() {
+                        Ok(PValue::Number(num.into()))
+                    } else if let Ok(num) = value.parse::<f64>() {
+                        Ok(JSONNumber::from_f64(num).map_or(PValue::Null, PValue::Number))
+                    } else {
+                        Err(serde::de::Error::custom(format_args!(
+                            "expected a number, got {value}"
+                        )))
+                    }
+                }
+                Basic::Null if self.cfg.coerce_strings => {
+                    if value == "null" {
+                        Ok(PValue::Null)
+                    } else {
+                        Err(serde::de::Error::custom(format_args!(
+                            "expected null, got {value}"
+                        )))
+                    }
+                }
+                _ => Err(serde::de::Error::invalid_type(
+                    Unexpected::Str(&value),
+                    &self,
+                )),
+            },
+            Value::Ref(idx) => recurse_ref!(self, idx, visit_string, value),
+            Value::Option(bov) => {
+                recurse!(self, bov, visit_string, value)
+            }
+
+            Value::Literal(Literal::Str(val)) if val.as_str() == value => Ok(PValue::String(value)),
+            Value::Literal(lit) => match lit {
+                Literal::Str(val) if val.as_str() == value => Ok(PValue::String(value)),
+                Literal::Bool(_) if self.cfg.coerce_strings => {
+                    if let Ok(got) = value.parse::<bool>() {
+                        self.visit_bool(got)
+                    } else {
+                        Err(serde::de::Error::custom(format_args!(
+                            "expected {}, got {}",
+                            lit.expecting(),
+                            value,
+                        )))
+                    }
+                }
+                Literal::Int(_) if self.cfg.coerce_strings => {
+                    if let Ok(got) = value.parse::<i64>() {
+                        self.visit_i64(got)
+                    } else {
+                        Err(serde::de::Error::custom(format_args!(
+                            "expected {}, got {}",
+                            lit.expecting(),
+                            value,
+                        )))
+                    }
+                }
+                Literal::Float(_) if self.cfg.coerce_strings => {
+                    if let Ok(got) = value.parse::<f64>() {
+                        self.visit_f64(got)
+                    } else {
+                        Err(serde::de::Error::custom(format_args!(
+                            "expected {}, got {}",
+                            lit.expecting(),
+                            value,
+                        )))
+                    }
+                }
+                _ => Err(serde::de::Error::custom(format_args!(
+                    "expected {}, got {}",
+                    lit.expecting(),
+                    value,
+                ))),
+            },
+            Value::Validation(v) => validate_pval!(self, v, visit_string, value),
+
+            Value::Union(types) => {
+                for typ in types {
+                    let res: Result<_, E> = recurse!(self, typ, visit_string, value.clone());
+                    if let Ok(val) = res {
+                        return Ok(val);
+                    }
+                }
+                Err(serde::de::Error::invalid_type(
+                    Unexpected::Str(&value),
+                    &self,
+                ))
+            }
+            _ => Err(serde::de::Error::invalid_type(
+                Unexpected::Str(&value),
+                &self,
+            )),
+        }
+    }
+
+    #[inline]
+    fn visit_none<E>(self) -> Result<PValue, E>
+    where
+        E: serde::de::Error,
+    {
+        match self.value {
+            Value::Basic(Basic::Any | Basic::Null) | Value::Option(_) => Ok(PValue::Null),
+            Value::Ref(idx) => recurse_ref0!(self, idx, visit_none),
+            Value::Union(types) => {
+                for typ in types {
+                    let res: Result<_, E> = recurse0!(self, typ, visit_none);
+                    if let Ok(val) = res {
+                        return Ok(val);
+                    }
+                }
+                Err(serde::de::Error::invalid_type(Unexpected::Option, &self))
+            }
+            _ => Err(serde::de::Error::invalid_type(Unexpected::Option, &self)),
+        }
+    }
+
+    #[inline]
+    fn visit_some<D>(self, deserializer: D) -> Result<PValue, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        DeserializeSeed::deserialize(self, deserializer)
+    }
+
+    #[inline]
+    fn visit_unit<E>(self) -> Result<PValue, E>
+    where
+        E: serde::de::Error,
+    {
+        self.visit_none()
+    }
+
+    #[inline]
+    #[cfg_attr(
+        feature = "rttrace",
+        tracing::instrument(skip(self, seq), ret, level = "trace")
+    )]
+    fn visit_seq<A>(self, mut seq: A) -> Result<PValue, A::Error>
+    where
+        A: SeqAccess<'de>,
+    {
+        match &self.value {
+            Value::Basic(Basic::Any) => visit_seq(self, seq),
+            Value::Array(bov) => match bov {
+                BasicOrValue::Basic(basic) => {
+                    let basic_val = Value::Basic(*basic);
+                    let visitor = DecodeValue {
+                        cfg: self.cfg,
+                        reg: self.reg,
+                        value: &basic_val,
+                    };
+                    visit_seq(visitor, seq)
+                }
+                BasicOrValue::Value(idx) => {
+                    let visitor = DecodeValue {
+                        cfg: self.cfg,
+                        reg: self.reg,
+                        value: &self.reg.values[*idx],
+                    };
+                    visit_seq(visitor, seq)
+                }
+            },
+            Value::Ref(idx) => recurse_ref!(self, idx, visit_seq, seq),
+            Value::Option(bov) => recurse!(self, bov, visit_seq, seq),
+            Value::Validation(v) => validate_pval!(self, v, visit_seq, seq),
+            Value::Union(candidates) => {
+                let mut vec: Vec<serde_json::Value> = Vec::new();
+                while let Some(val) = seq.next_element()? {
+                    vec.push(val);
+                }
+                let arr = JVal::Array(vec);
+
+                for c in candidates {
+                    match c {
+                        BasicOrValue::Basic(basic) => {
+                            let basic_val = Value::Basic(*basic);
+                            let visitor = DecodeValue {
+                                cfg: self.cfg,
+                                reg: self.reg,
+                                value: &basic_val,
+                            };
+                            if visitor.validate::<A::Error>(&arr).is_ok() {
+                                return visitor.transform(arr);
+                            }
+                        }
+                        BasicOrValue::Value(idx) => {
+                            let visitor = DecodeValue {
+                                cfg: self.cfg,
+                                reg: self.reg,
+                                value: &self.reg.values[*idx],
+                            };
+                            if visitor.validate::<A::Error>(&arr).is_ok() {
+                                return visitor.transform(arr);
+                            }
+                        }
+                    }
+                }
+
+                Err(serde::de::Error::invalid_type(Unexpected::Seq, &self))
+            }
+
+            _ => Err(serde::de::Error::invalid_type(Unexpected::Seq, &self)),
+        }
+    }
+
+    #[cfg_attr(
+        feature = "rttrace",
+        tracing::instrument(skip(self, map), ret, level = "trace")
+    )]
+    fn visit_map<A>(self, mut map: A) -> Result<PValue, A::Error>
+    where
+        A: MapAccess<'de>,
+    {
+        match &self.value {
+            Value::Basic(Basic::Any) => visit_map(self, map),
+            Value::Map(bov) => match bov {
+                BasicOrValue::Basic(basic) => {
+                    let basic_val = Value::Basic(*basic);
+                    let visitor = DecodeValue {
+                        cfg: self.cfg,
+                        reg: self.reg,
+                        value: &basic_val,
+                    };
+                    visit_map(visitor, map)
+                }
+                BasicOrValue::Value(idx) => {
+                    let visitor = DecodeValue {
+                        cfg: self.cfg,
+                        reg: self.reg,
+                        value: &self.reg.values[*idx],
+                    };
+                    visit_map(visitor, map)
+                }
+            },
+
+            Value::Struct(Struct { fields }) => {
+                let mut values = PValues::new();
+                let mut seen = HashSet::new();
+                while let Some(key) = map.next_key::<String>()? {
+                    // Get the corresponding value from the schema.
+                    match fields.get(&key) {
+                        Some(entry) => {
+                            // Resolve the field value.
+                            let value = match &entry.value {
+                                BasicOrValue::Value(field_idx) => {
+                                    let field = self.resolve(*field_idx);
+                                    map.next_value_seed(field)?
+                                }
+                                BasicOrValue::Basic(basic) => {
+                                    let field = DecodeValue {
+                                        cfg: self.cfg,
+                                        reg: self.reg,
+                                        value: &Value::Basic(*basic),
+                                    };
+                                    map.next_value_seed(field)?
+                                }
+                            };
+
+                            let allow_duplicate_fields =
+                                self.cfg.arrays_as_repeated_fields && value.is_array();
+                            let duplicate = !seen.insert(key.clone());
+
+                            // Check for duplicate keys.
+                            if duplicate && !allow_duplicate_fields {
+                                return Err(serde::de::Error::custom(format_args!(
+                                    "duplicate field {key}"
+                                )));
+                            }
+
+                            // Insert it into our map.
+                            if self.cfg.arrays_as_repeated_fields && value.is_array() {
+                                if let PValue::Array(vec) = value {
+                                    values
+                                        .entry(key)
+                                        .and_modify(|prev| {
+                                            if let PValue::Array(prev) = prev {
+                                                prev.extend(vec.clone());
+                                            }
+                                        })
+                                        .or_insert_with(|| PValue::Array(vec));
+                                }
+                            } else {
+                                values.insert(key, value);
+                            }
+                        }
+                        None => {
+                            // Unknown field; ignore it.
+                            map.next_value::<serde::de::IgnoredAny>()?;
+                        }
+                    }
+                }
+
+                // Report any missing fields.
+                if seen.len() != fields.len() {
+                    let missing = fields
+                        .iter()
+                        .filter_map(|(key, field)| {
+                            if seen.contains(key) {
+                                return None;
+                            }
+
+                            // If the field is optional, don't consider it missing.
+                            if field.optional {
+                                return None;
+                            } else if let BasicOrValue::Value(idx) = &field.value {
+                                if matches!(self.resolve(*idx).value, Value::Option(_)) {
+                                    return None;
+                                }
+                            }
+
+                            Some(key.as_str())
+                        })
+                        .collect::<Vec<_>>();
+
+                    match missing.len() {
+                        0 => {} // do nothing
+                        1 => {
+                            return Err(serde::de::Error::custom(format_args!(
+                                "missing field {}",
+                                missing[0]
+                            )))
+                        }
+                        _ => {
+                            return Err(serde::de::Error::custom(format_args!(
+                                "missing fields {}",
+                                FieldList { names: &missing }
+                            )))
+                        }
+                    }
+                }
+
+                Ok(PValue::Object(values))
+            }
+
+            Value::Ref(idx) => recurse_ref!(self, idx, visit_map, map),
+            Value::Option(bov) => recurse!(self, bov, visit_map, map),
+            Value::Validation(v) => validate_pval!(self, v, visit_map, map),
+            Value::Union(candidates) => {
+                let mut values = serde_json::Map::new();
+                while let Some((key, value)) = map.next_entry()? {
+                    values.insert(key, value);
+                }
+                let map = JVal::Object(values);
+                for c in candidates {
+                    match c {
+                        BasicOrValue::Basic(basic) => {
+                            let basic_val = Value::Basic(*basic);
+                            let visitor = DecodeValue {
+                                cfg: self.cfg,
+                                reg: self.reg,
+                                value: &basic_val,
+                            };
+                            if visitor.validate::<A::Error>(&map).is_ok() {
+                                return visitor.transform(map);
+                            }
+                        }
+                        BasicOrValue::Value(idx) => {
+                            let visitor = DecodeValue {
+                                cfg: self.cfg,
+                                reg: self.reg,
+                                value: &self.reg.values[*idx],
+                            };
+                            if visitor.validate::<A::Error>(&map).is_ok() {
+                                return visitor.transform(map);
+                            }
+                        }
+                    }
+                }
+                Err(serde::de::Error::invalid_type(Unexpected::Map, &self))
+            }
+            _ => Err(serde::de::Error::invalid_type(Unexpected::Map, &self)),
+        }
+    }
+}
+
+fn visit_seq<'de, A>(elem: DecodeValue, mut seq: A) -> Result<PValue, A::Error>
+where
+    A: SeqAccess<'de>,
+{
+    let mut vec = Vec::new();
+    // TODO optimize to stop using JSONValueVisitor and use serde_json's visitor directly?
+    while let Some(elem) = seq.next_element_seed(elem)? {
+        vec.push(elem);
+    }
+    Ok(PValue::Array(vec))
+}
+
+fn visit_map<'de, A>(elem: DecodeValue, mut map: A) -> Result<PValue, A::Error>
+where
+    A: MapAccess<'de>,
+{
+    let mut values = PValues::new();
+    while let Some((key, value)) = map.next_entry_seed(PhantomData, elem)? {
+        values.insert(key, value);
+    }
+    Ok(PValue::Object(values))
+}
+
+struct FieldList<'a> {
+    names: &'a [&'a str],
+}
+
+impl DecodeValue<'_> {
+    #[cfg_attr(
+        feature = "rttrace",
+        tracing::instrument(skip(self), ret, level = "trace")
+    )]
+    pub fn validate<E>(&self, value: &JVal) -> Result<(), E>
+    where
+        E: serde::de::Error,
+    {
+        match value {
+            JVal::Null => match self.value {
+                Value::Basic(Basic::Any | Basic::Null) => Ok(()),
+                Value::Option(_) => Ok(()),
+                Value::Ref(idx) => recurse_ref!(self, idx, validate, value),
+                Value::Validation(v) => validate_jval!(self, v, validate, value),
+                Value::Union(types) => {
+                    for typ in types {
+                        let res: Result<_, E> = recurse!(self, typ, validate, value);
+                        if res.is_ok() {
+                            return res;
+                        }
+                    }
+                    Err(serde::de::Error::invalid_type(Unexpected::Option, self))
+                }
+                _ => Err(serde::de::Error::invalid_type(Unexpected::Option, self)),
+            },
+            JVal::Bool(bool) => match self.value {
+                Value::Basic(Basic::Any | Basic::Bool) => Ok(()),
+                Value::Ref(idx) => recurse_ref!(self, idx, validate, value),
+                Value::Option(val) => {
+                    recurse!(self, val, validate, value)
+                }
+                Value::Literal(lit) => match lit {
+                    Literal::Bool(val) if *bool == *val => Ok(()),
+                    _ => Err(serde::de::Error::custom(format_args!(
+                        "expected {}, got {}",
+                        lit.expecting(),
+                        bool,
+                    ))),
+                },
+                Value::Validation(v) => validate_jval!(self, v, validate, value),
+                Value::Union(types) => {
+                    for typ in types {
+                        let res: Result<_, E> = recurse!(self, typ, validate, value);
+                        if res.is_ok() {
+                            return res;
+                        }
+                    }
+                    Err(serde::de::Error::invalid_type(
+                        Unexpected::Bool(*bool),
+                        self,
+                    ))
+                }
+                _ => Err(serde::de::Error::invalid_type(
+                    Unexpected::Bool(*bool),
+                    self,
+                )),
+            },
+            JVal::Number(num) => match self.value {
+                Value::Basic(Basic::Any | Basic::Number) => Ok(()),
+                Value::Ref(idx) => recurse_ref!(self, idx, validate, value),
+                Value::Option(val) => {
+                    recurse!(self, val, validate, value)
+                }
+                Value::Literal(lit) => match lit {
+                    Literal::Int(val) if num.as_i64() == Some(*val) => Ok(()),
+                    Literal::Float(val) if num.as_f64() == Some(*val) => Ok(()),
+                    _ => Err(serde::de::Error::custom(format_args!(
+                        "expected {}, got {}",
+                        lit.expecting(),
+                        num,
+                    ))),
+                },
+                Value::Validation(v) => validate_jval!(self, v, validate, value),
+                Value::Union(types) => {
+                    for typ in types {
+                        let res: Result<_, E> = recurse!(self, typ, validate, value);
+                        if res.is_ok() {
+                            return res;
+                        }
+                    }
+                    Err(serde::de::Error::invalid_type(
+                        Unexpected::Other("number"),
+                        self,
+                    ))
+                }
+                _ => Err(serde::de::Error::invalid_type(
+                    Unexpected::Other("number"),
+                    self,
+                )),
+            },
+
+            JVal::String(string) => match self.value {
+                Value::Basic(Basic::Any | Basic::String) => Ok(()),
+                Value::Basic(Basic::DateTime) => api::DateTime::parse_from_rfc3339(string)
+                    .map(|_| ())
+                    .map_err(|e| serde::de::Error::custom(format_args!("invalid datetime: {e}",))),
+                Value::Basic(Basic::Decimal) => api::Decimal::from_str(string)
+                    .map(|_| ())
+                    .map_err(|e| serde::de::Error::custom(format_args!("invalid decimal: {e}",))),
+                Value::Ref(idx) => recurse_ref!(self, idx, validate, value),
+                Value::Option(val) => {
+                    recurse!(self, val, validate, value)
+                }
+                Value::Literal(lit) => match lit {
+                    Literal::Str(val) if string.as_str() == *val => Ok(()),
+                    _ => Err(serde::de::Error::custom(format_args!(
+                        "expected {}, got {}",
+                        lit.expecting(),
+                        string,
+                    ))),
+                },
+                Value::Validation(v) => validate_jval!(self, v, validate, value),
+                Value::Union(types) => {
+                    for typ in types {
+                        let res: Result<_, E> = recurse!(self, typ, validate, value);
+                        if res.is_ok() {
+                            return res;
+                        }
+                    }
+                    Err(serde::de::Error::invalid_type(
+                        Unexpected::Str(string),
+                        self,
+                    ))
+                }
+                _ => Err(serde::de::Error::invalid_type(
+                    Unexpected::Str(string),
+                    self,
+                )),
+            },
+
+            JVal::Array(array) => match self.value {
+                Value::Basic(Basic::Any) => Ok(()),
+                Value::Array(bov) => match bov {
+                    BasicOrValue::Basic(basic) => {
+                        let basic_val = Value::Basic(*basic);
+                        let visitor = DecodeValue {
+                            cfg: self.cfg,
+                            reg: self.reg,
+                            value: &basic_val,
+                        };
+                        for elem in array {
+                            visitor.validate(elem)?;
+                        }
+                        Ok(())
+                    }
+                    BasicOrValue::Value(idx) => {
+                        let visitor = DecodeValue {
+                            cfg: self.cfg,
+                            reg: self.reg,
+                            value: &self.reg.values[*idx],
+                        };
+                        for elem in array {
+                            visitor.validate(elem)?;
+                        }
+                        Ok(())
+                    }
+                },
+                Value::Ref(idx) => recurse_ref!(self, idx, validate, value),
+                Value::Option(bov) => {
+                    for elem in array {
+                        recurse!(self, bov, validate, elem)?;
+                    }
+                    Ok(())
+                }
+                Value::Validation(v) => validate_jval!(self, v, validate, value),
+                Value::Union(types) => {
+                    for typ in types {
+                        let res: Result<_, E> = recurse!(self, typ, validate, value);
+                        if res.is_ok() {
+                            return res;
+                        }
+                    }
+                    Err(serde::de::Error::invalid_type(Unexpected::Seq, self))
+                }
+                _ => Err(serde::de::Error::invalid_type(Unexpected::Seq, self)),
+            },
+
+            JVal::Object(map) => match self.value {
+                Value::Ref(idx) => recurse_ref!(self, idx, validate, value),
+                Value::Option(bov) => recurse!(self, bov, validate, value),
+                Value::Basic(Basic::Any) => Ok(()),
+
+                Value::Union(types) => {
+                    for typ in types {
+                        let res: Result<_, E> = recurse!(self, typ, validate, value);
+                        if res.is_ok() {
+                            return res;
+                        }
+                    }
+                    Err(serde::de::Error::invalid_type(Unexpected::Map, self))
+                }
+                Value::Map(bov) => match bov {
+                    BasicOrValue::Basic(basic) => {
+                        let basic_val = Value::Basic(*basic);
+                        let visitor = DecodeValue {
+                            cfg: self.cfg,
+                            reg: self.reg,
+                            value: &basic_val,
+                        };
+                        for (_key, value) in map {
+                            visitor.validate(value)?;
+                        }
+                        Ok(())
+                    }
+                    BasicOrValue::Value(idx) => {
+                        let visitor = DecodeValue {
+                            cfg: self.cfg,
+                            reg: self.reg,
+                            value: &self.reg.values[*idx],
+                        };
+                        for (_key, value) in map {
+                            visitor.validate(value)?;
+                        }
+                        Ok(())
+                    }
+                },
+                Value::Struct(Struct { fields }) => {
+                    let mut seen = HashSet::new();
+                    for (key, value) in map {
+                        match fields.get(key.as_str()) {
+                            Some(entry) => {
+                                seen.insert(key.clone());
+
+                                match &entry.value {
+                                    BasicOrValue::Value(field_idx) => {
+                                        let field = self.resolve(*field_idx);
+                                        field.validate(value)?
+                                    }
+                                    BasicOrValue::Basic(basic) => {
+                                        let field = DecodeValue {
+                                            cfg: self.cfg,
+                                            reg: self.reg,
+                                            value: &Value::Basic(*basic),
+                                        };
+                                        field.validate(value)?
+                                    }
+                                }
+                            }
+                            None => {
+                                // Unknown field; ignore it.
+                            }
+                        }
+                    }
+
+                    // Report any missing fields.
+                    if seen.len() != fields.len() {
+                        let missing = fields
+                            .iter()
+                            .filter_map(|(key, field)| {
+                                if seen.contains(key) {
+                                    return None;
+                                }
+
+                                if field.optional {
+                                    return None;
+                                } else if let BasicOrValue::Value(idx) = &field.value {
+                                    if matches!(self.resolve(*idx).value, Value::Option(_)) {
+                                        return None;
+                                    }
+                                }
+
+                                Some(key.as_str())
+                            })
+                            .collect::<Vec<_>>();
+
+                        match missing.len() {
+                            0 => {} // do nothing
+                            1 => {
+                                return Err(serde::de::Error::custom(format_args!(
+                                    "missing field {}",
+                                    missing[0]
+                                )))
+                            }
+                            _ => {
+                                return Err(serde::de::Error::custom(format_args!(
+                                    "missing fields {}",
+                                    FieldList { names: &missing }
+                                )))
+                            }
+                        }
+                    }
+
+                    Ok(())
+                }
+                Value::Validation(v) => validate_jval!(self, v, validate, value),
+
+                _ => Err(serde::de::Error::invalid_type(Unexpected::Map, self)),
+            },
+        }
+    }
+
+    #[cfg_attr(
+        feature = "rttrace",
+        tracing::instrument(skip(self), ret, level = "trace")
+    )]
+    fn transform<E>(&self, value: JVal) -> Result<PValue, E>
+    where
+        E: serde::de::Error,
+    {
+        Ok(match value {
+            JVal::Null => PValue::Null,
+            JVal::Bool(val) => PValue::Bool(val),
+            JVal::Number(num) => PValue::Number(num),
+            JVal::Array(vals) => match self.value {
+                Value::Ref(idx) => return recurse_ref!(self, idx, transform, JVal::Array(vals)),
+                Value::Option(bov) => return recurse!(self, bov, transform, JVal::Array(vals)),
+                Value::Validation(v) => {
+                    return recurse!(self, &v.bov, transform, JVal::Array(vals))
+                }
+                Value::Basic(Basic::Any) => {
+                    let mut new_vals = Vec::with_capacity(vals.len());
+                    for val in vals {
+                        new_vals.push(self.transform(val)?);
+                    }
+                    PValue::Array(new_vals)
+                }
+                Value::Array(bov) => {
+                    let mut new_vals = Vec::with_capacity(vals.len());
+                    for val in vals {
+                        let val = recurse!(self, bov, transform, val)?;
+                        new_vals.push(val);
+                    }
+                    PValue::Array(new_vals)
+                }
+                Value::Union(candidates) => {
+                    let val = JVal::Array(vals);
+                    for c in candidates {
+                        match c {
+                            BasicOrValue::Basic(basic) => {
+                                let basic_val = Value::Basic(*basic);
+                                let visitor = DecodeValue {
+                                    cfg: self.cfg,
+                                    reg: self.reg,
+                                    value: &basic_val,
+                                };
+                                if visitor.validate::<E>(&val).is_ok() {
+                                    return visitor.transform(val);
+                                }
+                            }
+                            BasicOrValue::Value(idx) => {
+                                let visitor = DecodeValue {
+                                    cfg: self.cfg,
+                                    reg: self.reg,
+                                    value: &self.reg.values[*idx],
+                                };
+                                if visitor.validate::<E>(&val).is_ok() {
+                                    return visitor.transform(val);
+                                }
+                            }
+                        }
+                    }
+                    return Err(serde::de::Error::invalid_type(Unexpected::Seq, self));
+                }
+                Value::Basic(basic) => {
+                    return Err(serde::de::Error::invalid_type(
+                        Unexpected::Other(basic.expecting()),
+                        self,
+                    ))
+                }
+                Value::Literal(lit) => {
+                    return Err(serde::de::Error::invalid_type(
+                        Unexpected::Other(lit.expecting_type()),
+                        self,
+                    ))
+                }
+                Value::Map(_) | Value::Struct(_) => {
+                    return Err(serde::de::Error::invalid_type(Unexpected::Map, self))
+                }
+            },
+            JVal::Object(obj) => match self.value {
+                Value::Ref(idx) => return recurse_ref!(self, idx, transform, JVal::Object(obj)),
+                Value::Option(bov) => return recurse!(self, bov, transform, JVal::Object(obj)),
+                Value::Validation(v) => {
+                    return recurse!(self, &v.bov, transform, JVal::Object(obj))
+                }
+                Value::Basic(Basic::Any) => {
+                    let mut new_obj = BTreeMap::new();
+                    for (key, val) in obj {
+                        new_obj.insert(key, self.transform(val)?);
+                    }
+                    PValue::Object(new_obj)
+                }
+                Value::Map(bov) => {
+                    let mut new_obj = BTreeMap::new();
+                    for (key, val) in obj {
+                        let val = recurse!(self, bov, transform, val)?;
+                        new_obj.insert(key, val);
+                    }
+                    PValue::Object(new_obj)
+                }
+                Value::Struct(Struct { fields }) => {
+                    let mut new_obj = BTreeMap::new();
+                    for (key, value) in obj {
+                        match fields.get(key.as_str()) {
+                            Some(entry) => {
+                                let val = recurse!(self, &entry.value, transform, value)?;
+                                new_obj.insert(key, val);
+                            }
+                            None => {
+                                // Unknown field; ignore it.
+                            }
+                        }
+                    }
+                    PValue::Object(new_obj)
+                }
+                Value::Union(candidates) => {
+                    let val = JVal::Object(obj);
+                    for c in candidates {
+                        match c {
+                            BasicOrValue::Basic(basic) => {
+                                let basic_val = Value::Basic(*basic);
+                                let visitor = DecodeValue {
+                                    cfg: self.cfg,
+                                    reg: self.reg,
+                                    value: &basic_val,
+                                };
+                                if visitor.validate::<E>(&val).is_ok() {
+                                    return visitor.transform(val);
+                                }
+                            }
+                            BasicOrValue::Value(idx) => {
+                                let visitor = DecodeValue {
+                                    cfg: self.cfg,
+                                    reg: self.reg,
+                                    value: &self.reg.values[*idx],
+                                };
+                                if visitor.validate::<E>(&val).is_ok() {
+                                    return visitor.transform(val);
+                                }
+                            }
+                        }
+                    }
+
+                    return Err(serde::de::Error::invalid_type(Unexpected::Map, self));
+                }
+                Value::Basic(basic) => {
+                    return Err(serde::de::Error::invalid_type(
+                        Unexpected::Other(basic.expecting()),
+                        self,
+                    ))
+                }
+                Value::Literal(lit) => {
+                    return Err(serde::de::Error::invalid_type(
+                        Unexpected::Other(lit.expecting_type()),
+                        self,
+                    ))
+                }
+                Value::Array(_) => {
+                    return Err(serde::de::Error::invalid_type(Unexpected::Seq, self))
+                }
+            },
+            JVal::String(str) => match self.value {
+                Value::Ref(idx) => return recurse_ref!(self, idx, transform, JVal::String(str)),
+                Value::Option(bov) => return recurse!(self, bov, transform, JVal::String(str)),
+                Value::Validation(v) => {
+                    return recurse!(self, &v.bov, transform, JVal::String(str))
+                }
+                Value::Basic(Basic::DateTime) => api::DateTime::parse_from_rfc3339(&str)
+                    .map(PValue::DateTime)
+                    .map_err(|e| {
+                        serde::de::Error::custom(format_args!("invalid datetime: {e}",))
+                    })?,
+
+                Value::Basic(Basic::Decimal) => api::Decimal::from_str(&str)
+                    .map(PValue::Decimal)
+                    .map_err(|e| {
+                    serde::de::Error::custom(format_args!("invalid decimal: {e}",))
+                })?,
+
+                // Any non-datetime, non-decimal basic value gets transformed into a string.
+                Value::Basic(_) => PValue::String(str),
+
+                Value::Literal(_) => PValue::String(str),
+                Value::Union(types) => {
+                    let val = JVal::String(str);
+                    for typ in types {
+                        let res: Result<_, E> = recurse!(self, typ, transform, val.clone());
+                        if res.is_ok() {
+                            return res;
+                        }
+                    }
+                    return Err(serde::de::Error::invalid_type(
+                        Unexpected::Other("string"),
+                        self,
+                    ));
+                }
+                Value::Map(_) | Value::Struct(_) | Value::Array(_) => {
+                    return Err(serde::de::Error::invalid_type(Unexpected::Str(&str), self))
+                }
+            },
+        })
+    }
+}
+
+impl Display for FieldList<'_> {
+    fn fmt(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+        match self.names.len() {
+            0 => panic!(), // special case elsewhere
+            1 => write!(formatter, "`{}`", self.names[0]),
+            2 => write!(formatter, "`{}` and `{}`", self.names[0], self.names[1]),
+            _ => {
+                for (i, alt) in self.names.iter().enumerate() {
+                    if i > 0 {
+                        write!(formatter, ", ")?;
+                    }
+                    if i == self.names.len() - 1 {
+                        write!(formatter, "and ")?;
+                    }
+                    write!(formatter, "`{alt}`")?;
+                }
+                Ok(())
+            }
+        }
+    }
+}
diff --git a/runtimes/core/src/api/jsonschema/meta.rs b/runtimes/core/src/api/jsonschema/meta.rs
new file mode 100644
index 0000000000..adf3d26df5
--- /dev/null
+++ b/runtimes/core/src/api/jsonschema/meta.rs
@@ -0,0 +1,360 @@
+use std::collections::HashMap;
+use std::ops::Deref;
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+
+use crate::api::jsonschema::de::{Basic, BasicOrValue, Field, Literal, Struct};
+use crate::api::jsonschema::{JSONSchema, Registry, Value};
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::parser::schema::v1 as schema;
+use crate::encore::parser::schema::v1::r#type::Typ;
+
+use super::validation;
+
+impl Registry {
+    pub fn schema(self: &Arc<Self>, id: usize) -> JSONSchema {
+        JSONSchema {
+            registry: self.clone(),
+            root: id,
+        }
+    }
+}
+
+/// Builder builds a JSONSchema registry.
+pub struct Builder<'a> {
+    md: &'a meta::Data,
+
+    /// Values that have been computed so far.
+    /// None indicates a declaration that's being computed;
+    /// it's stored as None until it's computed to be able to handle
+    /// recursive references.
+    values: Vec<Option<Value>>,
+
+    /// Map of declaration ids to value indices.
+    decls: HashMap<u32, usize>,
+}
+
+struct BuilderCtx<'a, 'b: 'a> {
+    builder: &'a mut Builder<'b>,
+
+    /// The ids of computed type arguments, for the current declaration being processed.
+    type_args: &'a [usize],
+}
+
+impl<'a> Builder<'a> {
+    pub fn new(md: &'a meta::Data) -> Self {
+        Self {
+            md,
+            values: Vec::new(),
+            decls: HashMap::new(),
+        }
+    }
+
+    pub fn build(self) -> Arc<Registry> {
+        // Ensure all values have been computed.
+        let mut values = Vec::with_capacity(self.values.len());
+        for v in self.values {
+            values.push(v.expect("missing value"));
+        }
+
+        Arc::new(Registry { values })
+    }
+
+    #[inline]
+    pub fn get(&self, idx: usize) -> Option<&Value> {
+        self.values.get(idx).and_then(|v| v.as_ref())
+    }
+
+    #[inline]
+    pub fn register_value(&mut self, val: Value) -> usize {
+        match val {
+            // If it's already a ref, return it unmodified.
+            Value::Ref(idx) => idx,
+            val => {
+                let mut ctx = BuilderCtx {
+                    builder: self,
+                    type_args: &[],
+                };
+                ctx.reg(val)
+            }
+        }
+    }
+
+    #[inline]
+    pub fn register_type(&mut self, typ: &schema::Type) -> Result<usize> {
+        let mut ctx = BuilderCtx {
+            builder: self,
+            type_args: &[],
+        };
+        let val = ctx.typ(typ)?;
+
+        Ok(match val {
+            // If it's a ref, return its index directly.
+            Value::Ref(idx) => idx,
+            val => ctx.reg(val),
+        })
+    }
+
+    pub fn struct_field<'b>(&mut self, f: &'b schema::Field) -> Result<(&'b String, Field)> {
+        // This should be safe to do because it's only called for schema types,
+        // and schema types don't include any type arguments, so we shouldn't need to worry
+        // about missing type arguments.
+        let ctx = &mut BuilderCtx {
+            builder: self,
+            type_args: &[],
+        };
+        ctx.struct_field(f)
+    }
+}
+
+impl BuilderCtx<'_, '_> {
+    /// Computes the JSONSchema value for the given type.
+    #[inline]
+    fn typ<T: ToType>(&mut self, typ: T) -> Result<Value> {
+        let tt = typ.tt()?;
+
+        let val = match tt {
+            Typ::Named(named) => self.named(named),
+            Typ::Builtin(builtin) => {
+                let builtin = schema::Builtin::try_from(*builtin).context("invalid builtin")?;
+                Ok(self.builtin(builtin))
+            }
+
+            Typ::Pointer(ptr) => self.ptr(ptr),
+            Typ::Struct(st) => Ok(Value::Struct(self.struct_val(st)?)),
+            Typ::Map(map) => self.map(map),
+            Typ::List(list) => self.list(list),
+            Typ::Union(union) => self.union(union),
+            Typ::Literal(lit) => self.literal(lit),
+            Typ::Config(_) => anyhow::bail!("config not yet supported"),
+            Typ::TypeParameter(param) => {
+                let idx = self
+                    .type_args
+                    .get(param.param_idx as usize)
+                    .ok_or_else(|| anyhow::anyhow!("missing type argument"))?;
+                Ok(Value::Ref(*idx))
+            }
+        }?;
+
+        if let Some(expr) = typ.validation() {
+            let bov = self.bov(val);
+            Ok(Value::Validation(validation::Validation {
+                expr: expr.try_into()?,
+                bov,
+            }))
+        } else {
+            Ok(val)
+        }
+    }
+
+    #[inline]
+    fn named(&mut self, named: &schema::Named) -> Result<Value> {
+        let decl = self
+            .builder
+            .md
+            .decls
+            .get(named.id as usize)
+            .context("missing decl")?;
+
+        // Compute indices for the type arguments.
+        let type_args: Result<Vec<usize>> = named
+            .type_arguments
+            .iter()
+            .map(|t| self.typ(t).map(|v| self.reg(v)))
+            .collect();
+        let type_args = type_args?;
+
+        // Create a nested context that includes the type arguments.
+        let mut nested = BuilderCtx {
+            builder: self.builder,
+            type_args: &type_args,
+        };
+
+        let idx = nested.decl(decl)?;
+        Ok(Value::Ref(idx))
+    }
+
+    #[inline]
+    fn decl(&mut self, decl: &schema::Decl) -> Result<usize> {
+        // Do we have a value for this decl already?
+        if let Some(idx) = self.builder.decls.get(&decl.id) {
+            return Ok(*idx);
+        }
+
+        // Allocate an index first to handle recursive references.
+        let idx = self.builder.values.len();
+        self.builder.values.push(None);
+        self.builder.decls.insert(decl.id, idx);
+
+        // Then compute the type and update the stored value.
+        let typ = self.typ(&decl.r#type)?;
+        self.builder.values[idx] = Some(typ);
+        Ok(idx)
+    }
+
+    #[inline]
+    fn ptr(&mut self, ptr: &schema::Pointer) -> Result<Value> {
+        self.typ(&ptr.base)
+    }
+
+    #[inline]
+    fn builtin(&mut self, b: schema::Builtin) -> Value {
+        use schema::Builtin;
+        Value::Basic(match b {
+            Builtin::Any | Builtin::Json => Basic::Any,
+            Builtin::Bool => Basic::Bool,
+            Builtin::String | Builtin::Bytes | Builtin::Uuid | Builtin::UserId => Basic::String,
+            Builtin::Time => Basic::DateTime,
+            Builtin::Decimal => Basic::Decimal,
+
+            Builtin::Int
+            | Builtin::Uint
+            | Builtin::Int8
+            | Builtin::Int16
+            | Builtin::Int32
+            | Builtin::Int64
+            | Builtin::Uint8
+            | Builtin::Uint16
+            | Builtin::Uint32
+            | Builtin::Uint64
+            | Builtin::Float32
+            | Builtin::Float64 => Basic::Number,
+        })
+    }
+
+    #[inline]
+    pub fn struct_val(&mut self, st: &schema::Struct) -> Result<Struct> {
+        Ok(Struct {
+            fields: {
+                let mut map = HashMap::with_capacity(st.fields.len());
+                for f in &st.fields {
+                    let (k, v) = self.struct_field(f)?;
+                    map.insert(k.to_owned(), v);
+                }
+                map
+            },
+        })
+    }
+
+    #[inline]
+    fn struct_field<'c>(&mut self, f: &'c schema::Field) -> Result<(&'c String, Field)> {
+        let typ = self.typ(&f.typ)?;
+        let value = match typ {
+            Value::Basic(basic) => BasicOrValue::Basic(basic),
+            val => self.bov(val),
+        };
+
+        Ok((
+            &f.name,
+            Field {
+                value,
+                optional: f.optional,
+                name_override: None,
+            },
+        ))
+    }
+
+    #[inline]
+    fn map(&mut self, map: &schema::Map) -> Result<Value> {
+        // Note: JSON doesn't support anything but string keys,
+        // so we don't actually track the key type for the purpose
+        // of JSON schemas. Ignore it here.
+        let value = self.typ(&map.value)?;
+        Ok(Value::Map(self.bov(value)))
+    }
+
+    #[inline]
+    fn list(&mut self, list: &schema::List) -> Result<Value> {
+        let value = self.typ(&list.elem)?;
+        Ok(Value::Array(self.bov(value)))
+    }
+
+    #[inline]
+    fn union(&mut self, union: &schema::Union) -> Result<Value> {
+        let values: Result<Vec<BasicOrValue>> = union
+            .types
+            .iter()
+            .map(|t| self.typ(t).map(|v| self.bov(v)))
+            .collect();
+        Ok(Value::Union(values?))
+    }
+
+    #[inline]
+    fn literal(&mut self, literal: &schema::Literal) -> Result<Value> {
+        Ok(match literal.value.clone() {
+            Some(schema::literal::Value::Str(val)) => Value::Literal(Literal::Str(val)),
+            Some(schema::literal::Value::Boolean(val)) => Value::Literal(Literal::Bool(val)),
+            Some(schema::literal::Value::Int(val)) => Value::Literal(Literal::Int(val)),
+            Some(schema::literal::Value::Float(val)) => Value::Literal(Literal::Float(val)),
+            Some(schema::literal::Value::Null(_)) => Value::Basic(Basic::Null),
+            None => anyhow::bail!("missing literal value"),
+        })
+    }
+
+    #[inline]
+    fn bov(&mut self, value: Value) -> BasicOrValue {
+        match value {
+            Value::Basic(basic) => BasicOrValue::Basic(basic),
+            val => BasicOrValue::Value(self.reg(val)),
+        }
+    }
+
+    #[inline]
+    fn reg(&mut self, value: Value) -> usize {
+        let idx = self.builder.values.len();
+        self.builder.values.push(Some(value));
+        idx
+    }
+}
+
+trait ToType: std::fmt::Debug {
+    fn tt(&self) -> Result<&Typ>;
+    fn validation(&self) -> Option<&schema::ValidationExpr>;
+}
+
+impl<T> ToType for Option<T>
+where
+    T: ToType,
+{
+    fn tt(&self) -> Result<&Typ> {
+        self.as_ref().context("missing type")?.tt()
+    }
+
+    fn validation(&self) -> Option<&schema::ValidationExpr> {
+        self.as_ref().and_then(|t| t.validation())
+    }
+}
+
+impl<T> ToType for Box<T>
+where
+    T: ToType,
+{
+    fn tt(&self) -> Result<&Typ> {
+        self.deref().tt()
+    }
+
+    fn validation(&self) -> Option<&schema::ValidationExpr> {
+        self.deref().validation()
+    }
+}
+
+impl ToType for schema::Type {
+    fn tt(&self) -> Result<&Typ> {
+        self.typ.as_ref().context("missing type")
+    }
+
+    fn validation(&self) -> Option<&schema::ValidationExpr> {
+        self.validation.as_ref()
+    }
+}
+
+impl<T: ToType> ToType for &T {
+    fn tt(&self) -> Result<&Typ> {
+        (*self).tt()
+    }
+
+    fn validation(&self) -> Option<&schema::ValidationExpr> {
+        (*self).validation()
+    }
+}
diff --git a/runtimes/core/src/api/jsonschema/mod.rs b/runtimes/core/src/api/jsonschema/mod.rs
new file mode 100644
index 0000000000..e739cfea21
--- /dev/null
+++ b/runtimes/core/src/api/jsonschema/mod.rs
@@ -0,0 +1,214 @@
+use std::fmt;
+use std::sync::Arc;
+
+use serde::de::{DeserializeSeed, Deserializer};
+
+pub use de::{Basic, BasicOrValue, Field, Struct, Value};
+
+pub use crate::api::jsonschema::de::DecodeConfig;
+use crate::api::jsonschema::de::DecodeValue;
+
+mod de;
+mod meta;
+mod parse;
+mod ser;
+pub mod validation;
+
+use crate::api::jsonschema::parse::ParseWithSchema;
+use crate::api::APIResult;
+pub use meta::Builder;
+
+use super::{PValue, PValues};
+
+#[derive(Clone)]
+pub struct JSONSchema {
+    registry: Arc<Registry>,
+    root: usize,
+}
+
+pub struct Registry {
+    /// Vector of allocated values.
+    values: Vec<Value>,
+}
+
+impl Registry {
+    pub fn get(&self, mut idx: usize) -> &Value {
+        loop {
+            match &self.values[idx] {
+                Value::Ref(i) => idx = *i,
+                other => return other,
+            }
+        }
+    }
+}
+
+impl fmt::Debug for Registry {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        // Don't render the list of values since it's too large.
+        f.debug_struct("Registry").finish()
+    }
+}
+
+impl JSONSchema {
+    pub fn root_value(&self) -> &Value {
+        &self.registry.values[self.root]
+    }
+
+    #[inline]
+    pub fn root(&self) -> &Struct {
+        let Value::Struct(str) = &self.registry.values[self.root] else {
+            panic!("root is not a struct");
+        };
+        str
+    }
+
+    pub fn parse<P, O>(&self, payload: P) -> APIResult<O>
+    where
+        P: ParseWithSchema<O>,
+        O: Sized,
+    {
+        payload.parse_with_schema(self)
+    }
+
+    pub fn seed_deserializer<'de: 'a, 'a>(
+        &'a self,
+        cfg: DecodeConfig,
+    ) -> impl DeserializeSeed<'de> + 'a {
+        SchemaDeserializer { cfg, schema: self }
+    }
+
+    pub fn deserialize<'de, T>(
+        &self,
+        de: T,
+        cfg: DecodeConfig,
+    ) -> Result<PValues, serde_path_to_error::Error<T::Error>>
+    where
+        T: Deserializer<'de>,
+    {
+        let seed = SchemaDeserializer { cfg, schema: self };
+        let mut track = serde_path_to_error::Track::new();
+        let de = serde_path_to_error::Deserializer::new(de, &mut track);
+        match seed.deserialize(de) {
+            Ok(t) => Ok(t),
+            Err(err) => Err(serde_path_to_error::Error::new(track.path(), err)),
+        }
+    }
+
+    pub fn null() -> Self {
+        JSONSchema {
+            registry: Arc::new(Registry {
+                values: vec![Value::Basic(Basic::Null)],
+            }),
+            root: 0,
+        }
+    }
+
+    pub fn any() -> Self {
+        JSONSchema {
+            registry: Arc::new(Registry {
+                values: vec![Value::Basic(Basic::Any)],
+            }),
+            root: 0,
+        }
+    }
+}
+
+impl fmt::Debug for JSONSchema {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self.registry.values.get(self.root) {
+            Some(v) => v.write_debug(&self.registry, f),
+            None => write!(f, "Ref({})", self.root),
+        }
+    }
+}
+
+impl Value {
+    fn write_debug(&self, reg: &Registry, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Value::Basic(b) => write!(f, "{b:?}"),
+            Value::Struct(Struct { fields }) => {
+                f.debug_struct("Struct").field("fields", &fields).finish()
+            }
+            Value::Option(v) => f.debug_struct("Option").field("value", &v).finish(),
+            Value::Array(v) => f.debug_struct("Array").field("value", &v).finish(),
+            Value::Map(v) => f.debug_struct("Map").field("value", &v).finish(),
+            Value::Union(v) => f.debug_struct("Union").field("types", &v).finish(),
+            Value::Literal(v) => f.debug_struct("Literal").field("value", &v).finish(),
+            Value::Ref(idx) => match reg.values.get(*idx) {
+                Some(v) => v.write_debug(reg, f),
+                None => write!(f, "Ref({idx})"),
+            },
+            Value::Validation(v) => f
+                .debug_struct("Validation")
+                .field("bov", &v.bov)
+                .field("expr", &v.expr)
+                .finish(),
+        }
+    }
+}
+
+impl<'de: 'a, 'a> DeserializeSeed<'de> for SchemaDeserializer<'a> {
+    type Value = PValues;
+
+    fn deserialize<D>(self, deserializer: D) -> Result<Self::Value, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let visitor = DecodeValue {
+            cfg: &self.cfg,
+            reg: &self.schema.registry,
+            value: &self.schema.registry.values[self.schema.root],
+        };
+        let value = deserializer.deserialize_any(visitor)?;
+        match value {
+            PValue::Object(map) => Ok(map),
+            _ => Err(serde::de::Error::custom("expected object")),
+        }
+    }
+}
+
+pub struct SchemaDeserializer<'a> {
+    cfg: DecodeConfig,
+    schema: &'a JSONSchema,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::api::jsonschema::de::*;
+    use std::collections::HashMap;
+
+    #[test]
+    fn test() {
+        let reg = Arc::new(Registry {
+            values: vec![
+                Value::Struct(Struct {
+                    fields: {
+                        let mut fields = HashMap::new();
+                        fields.insert(
+                            "bar".to_string(),
+                            Field {
+                                value: BasicOrValue::Value(1),
+                                optional: false,
+                                name_override: None,
+                            },
+                        );
+                        fields
+                    },
+                }),
+                Value::Option(BasicOrValue::Value(2)),
+                Value::Basic(Basic::Any),
+            ],
+        });
+
+        let schema = JSONSchema {
+            registry: reg.clone(),
+            root: 0,
+        };
+
+        let str = r#"{"foo": "bar", "blah": "baz"}"#;
+        let mut jsonde = serde_json::Deserializer::from_str(str);
+        let res = schema.deserialize(&mut jsonde, DecodeConfig::default());
+        println!("{res:?}");
+    }
+}
diff --git a/runtimes/core/src/api/jsonschema/parse.rs b/runtimes/core/src/api/jsonschema/parse.rs
new file mode 100644
index 0000000000..72f52d87fc
--- /dev/null
+++ b/runtimes/core/src/api/jsonschema/parse.rs
@@ -0,0 +1,602 @@
+use crate::api::jsonschema::{Basic, BasicOrValue, JSONSchema, Registry, Struct, Value};
+use crate::api::{self, Cookie, PValue, PValues, SameSite};
+use crate::api::{schema, APIResult};
+use schema::ToHeaderStr;
+
+use std::str::FromStr;
+
+use crate::api::jsonschema::de::Literal;
+
+pub trait ParseWithSchema<Output> {
+    fn parse_with_schema(self, schema: &JSONSchema) -> APIResult<Output>;
+}
+
+macro_rules! header_to_str {
+    ($header_value:expr) => {
+        $header_value.to_str().map_err(|err| api::Error {
+            code: api::ErrCode::InvalidArgument,
+            message: "invalid header value".to_string(),
+            internal_message: Some(format!("invalid header value: {}", err)),
+            stack: None,
+            details: None,
+        })
+    };
+}
+
+impl<H> ParseWithSchema<PValues> for H
+where
+    H: schema::HTTPHeaders,
+{
+    fn parse_with_schema(self, schema: &JSONSchema) -> APIResult<PValues> {
+        let mut result = PValues::new();
+        let reg = schema.registry.as_ref();
+
+        for (field_key, field) in schema.root().fields.iter() {
+            let header_name = field.name_override.as_deref().unwrap_or(field_key.as_str());
+            let mut values = self.get_all(header_name);
+            let Some(header_value) = values.next() else {
+                if field.optional {
+                    continue;
+                } else {
+                    return Err(api::Error {
+                        code: api::ErrCode::InvalidArgument,
+                        message: format!("missing required header: {header_name}"),
+                        internal_message: None,
+                        stack: None,
+                        details: None,
+                    });
+                }
+            };
+
+            result.insert(
+                field_key.clone(),
+                match &field.value {
+                    BasicOrValue::Basic(basic) => {
+                        let basic = Value::Basic(*basic);
+
+                        parse_header_value(header_to_str!(header_value)?, reg, &basic)?
+                    }
+                    BasicOrValue::Value(idx) => {
+                        // Determine the type of the value(s).
+                        let basic_val: Value; // for borrowing below
+                        let (value_type, is_array) = match reg.get(*idx) {
+                            Value::Array(bov) => (
+                                match bov {
+                                    BasicOrValue::Value(idx) => reg.get(*idx),
+                                    BasicOrValue::Basic(basic) => {
+                                        basic_val = Value::Basic(*basic);
+                                        &basic_val
+                                    }
+                                },
+                                true,
+                            ),
+                            val => (val, false),
+                        };
+
+                        if is_array {
+                            let values = std::iter::once(header_value).chain(values);
+                            let mut arr = Vec::new();
+                            for header_value in values {
+                                let value = parse_header_value(
+                                    header_to_str!(header_value)?,
+                                    reg,
+                                    value_type,
+                                )?;
+                                arr.push(value);
+                            }
+                            PValue::Array(arr)
+                        } else {
+                            parse_header_value(header_to_str!(header_value)?, reg, value_type)?
+                        }
+                    }
+                },
+            );
+        }
+
+        Ok(result)
+    }
+}
+
+#[derive(Clone, Copy)]
+enum ValueType {
+    Header,
+    Cookie,
+}
+
+impl ValueType {
+    fn error_message(&self) -> &'static str {
+        match self {
+            ValueType::Header => "invalid header value",
+            ValueType::Cookie => "invalid cookie value",
+        }
+    }
+}
+
+fn parse_str_value(
+    value_str: &str,
+    reg: &Registry,
+    schema: &Value,
+    value_type: ValueType,
+) -> APIResult<PValue> {
+    match schema {
+        // Recurse
+        Value::Ref(idx) => parse_str_value(value_str, reg, &reg.values[*idx], value_type),
+
+        Value::Validation(v) => {
+            let inner = match &v.bov {
+                BasicOrValue::Basic(basic) => parse_basic_str(basic, value_str),
+                BasicOrValue::Value(idx) => {
+                    parse_str_value(value_str, reg, &reg.values[*idx], value_type)
+                }
+            }?;
+            match v.validate_pval(&inner) {
+                Ok(()) => Ok(inner),
+                Err(err) => Err(api::Error {
+                    code: api::ErrCode::InvalidArgument,
+                    message: value_type.error_message().to_string(),
+                    internal_message: Some(format!("{}: {}", value_type.error_message(), err)),
+                    stack: None,
+                    details: None,
+                }),
+            }
+        }
+
+        // If we have an empty value for an option, that's fine.
+        Value::Option(_) if value_str.is_empty() => Ok(PValue::Null),
+
+        // Otherwise recurse.
+        Value::Option(opt) => match opt {
+            BasicOrValue::Basic(basic) => parse_basic_str(basic, value_str),
+            BasicOrValue::Value(idx) => {
+                parse_str_value(value_str, reg, &reg.values[*idx], value_type)
+            }
+        },
+
+        Value::Basic(basic) => parse_basic_str(basic, value_str),
+
+        Value::Struct { .. } | Value::Map(_) | Value::Array(_) => unsupported(reg, schema),
+
+        Value::Literal(lit) => match lit {
+            Literal::Str(want) if value_str == want => Ok(PValue::String(want.to_string())),
+            Literal::Bool(true) if value_str == "true" => Ok(PValue::Bool(true)),
+            Literal::Bool(false) if value_str == "false" => Ok(PValue::Bool(false)),
+            Literal::Int(want) if value_str.parse() == Ok(*want) => {
+                Ok(PValue::Number(serde_json::Number::from(*want)))
+            }
+            Literal::Float(want) if value_str.parse() == Ok(*want) => {
+                if let Some(num) = serde_json::Number::from_f64(*want) {
+                    Ok(PValue::Number(num))
+                } else {
+                    Err(api::Error {
+                        code: api::ErrCode::InvalidArgument,
+                        message: value_type.error_message().to_string(),
+                        internal_message: Some(format!("invalid float value: {value_str}")),
+                        stack: None,
+                        details: None,
+                    })
+                }
+            }
+
+            want => Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: value_type.error_message().to_string(),
+                internal_message: Some(format!("expected {}, got {}", want.expecting(), value_str)),
+                stack: None,
+                details: None,
+            }),
+        },
+
+        Value::Union(union) => {
+            // Find the first value that matches.
+            for value in union {
+                let result = match value {
+                    BasicOrValue::Basic(basic) => parse_basic_str(basic, value_str),
+                    BasicOrValue::Value(idx) => {
+                        let value = reg.get(*idx);
+                        parse_str_value(value_str, reg, value, value_type)
+                    }
+                };
+                match result {
+                    Ok(value) => return Ok(value),
+                    Err(_) => continue,
+                }
+            }
+            Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: value_type.error_message().to_string(),
+                internal_message: Some(format!("no union value matched: {value_str}")),
+                stack: None,
+                details: None,
+            })
+        }
+    }
+}
+
+fn parse_header_value(header: &str, reg: &Registry, schema: &Value) -> APIResult<PValue> {
+    parse_str_value(header, reg, schema, ValueType::Header)
+}
+
+fn parse_cookie_value(cookie_value: &str, reg: &Registry, schema: &Value) -> APIResult<PValue> {
+    parse_str_value(cookie_value, reg, schema, ValueType::Cookie)
+}
+
+impl ParseWithSchema<PValue> for PValue {
+    fn parse_with_schema(self, schema: &JSONSchema) -> APIResult<PValue> {
+        let reg = schema.registry.as_ref();
+        let fields = &schema.root().fields;
+        match self {
+            PValue::Object(obj) => {
+                let mut result = PValues::new();
+                for (key, value) in obj {
+                    let value = match fields.get(&key) {
+                        // Not known to schema; pass it unmodified.
+                        None => value,
+
+                        Some(field) => match &field.value {
+                            BasicOrValue::Basic(basic) => parse_basic_json(reg, basic, value)?,
+
+                            BasicOrValue::Value(idx) => {
+                                parse_json_value(value, reg, &reg.values[*idx])?
+                            }
+                        },
+                    };
+                    result.insert(key, value);
+                }
+                Ok(PValue::Object(result))
+            }
+
+            _ => unexpected_json(reg, schema.root_value(), &self),
+        }
+    }
+}
+
+impl ParseWithSchema<PValues> for cookie::CookieJar {
+    fn parse_with_schema(self, schema: &JSONSchema) -> APIResult<PValues> {
+        let mut result = PValues::new();
+        let reg = schema.registry.as_ref();
+
+        for (field_key, field) in schema.root().fields.iter() {
+            let name = field.name_override.as_deref().unwrap_or(field_key.as_str());
+            let Some(cookie) = self.get(name) else {
+                if field.optional {
+                    continue;
+                } else {
+                    return Err(api::Error {
+                        code: api::ErrCode::InvalidArgument,
+                        message: format!("missing required cookie: {name}"),
+                        internal_message: None,
+                        stack: None,
+                        details: None,
+                    });
+                }
+            };
+
+            let cookie_value = match field.value {
+                BasicOrValue::Basic(basic) => parse_basic_str(&basic, cookie.value())?,
+                BasicOrValue::Value(idx) => parse_cookie_value(cookie.value(), reg, reg.get(idx))?,
+            };
+
+            let cookie = Cookie {
+                name: name.to_string(),
+                value: Box::new(cookie_value),
+                path: cookie.path().map(|s| s.to_string()),
+                domain: cookie.domain().map(|s| s.to_string()),
+                secure: cookie.secure(),
+                http_only: cookie.http_only(),
+                expires: cookie.expires_datetime().map(|dt| {
+                    let system_time: std::time::SystemTime = dt.into();
+                    let utc: chrono::DateTime<chrono::Utc> = chrono::DateTime::from(system_time);
+                    utc.into()
+                }),
+                max_age: cookie
+                    .max_age()
+                    .map(|duration| duration.whole_seconds() as u64),
+                same_site: cookie.same_site().map(|ss| match ss {
+                    cookie::SameSite::Strict => SameSite::Strict,
+                    cookie::SameSite::Lax => SameSite::Lax,
+                    cookie::SameSite::None => SameSite::None,
+                }),
+                partitioned: cookie.partitioned(),
+            };
+
+            result.insert(field_key.clone(), PValue::Cookie(cookie));
+        }
+
+        Ok(result)
+    }
+}
+
+#[cfg_attr(
+    feature = "rttrace",
+    tracing::instrument(skip(reg), ret, level = "trace")
+)]
+fn parse_json_value(this: PValue, reg: &Registry, schema: &Value) -> APIResult<PValue> {
+    match schema {
+        // Recurse
+        Value::Ref(idx) => parse_json_value(this, reg, &reg.values[*idx]),
+
+        Value::Validation(v) => {
+            let inner = match &v.bov {
+                BasicOrValue::Basic(basic) => parse_basic_json(reg, basic, this),
+                BasicOrValue::Value(idx) => parse_json_value(this, reg, &reg.values[*idx]),
+            }?;
+            match v.validate_pval(&inner) {
+                Ok(()) => Ok(inner),
+                Err(err) => Err(api::Error {
+                    code: api::ErrCode::InvalidArgument,
+                    message: err.to_string(),
+                    internal_message: None,
+                    stack: None,
+                    details: None,
+                }),
+            }
+        }
+
+        // If we have a null value for an option, that's fine.
+        Value::Option(_) if this.is_null() => Ok(PValue::Null),
+
+        // Otherwise recurse.
+        Value::Option(opt) => match opt {
+            BasicOrValue::Basic(basic) => parse_basic_json(reg, basic, this),
+            BasicOrValue::Value(idx) => parse_json_value(this, reg, &reg.values[*idx]),
+        },
+
+        Value::Basic(basic) => parse_basic_json(reg, basic, this),
+
+        Value::Literal(lit) => {
+            let invalid = |got| {
+                Err(api::Error {
+                    code: api::ErrCode::InvalidArgument,
+                    message: "invalid value".to_string(),
+                    internal_message: Some(format!("expected {}, got {:#?}", lit.expecting(), got)),
+                    stack: None,
+                    details: None,
+                })
+            };
+
+            match (this, lit) {
+                (PValue::String(got), Literal::Str(want)) if &got == want => {
+                    Ok(PValue::String(got))
+                }
+                (PValue::Bool(got), Literal::Bool(want)) if &got == want => Ok(PValue::Bool(got)),
+                (PValue::Number(got), Literal::Int(want)) => {
+                    if got.as_i64() == Some(*want) {
+                        Ok(PValue::Number(got))
+                    } else {
+                        invalid(PValue::Number(got))
+                    }
+                }
+                (PValue::Number(got), Literal::Float(want)) => {
+                    if got.as_f64() == Some(*want) {
+                        Ok(PValue::Number(got))
+                    } else {
+                        invalid(PValue::Number(got))
+                    }
+                }
+                (got, _) => invalid(got),
+            }
+        }
+
+        Value::Struct(Struct { fields }) => match this {
+            PValue::Object(obj) => {
+                let mut result = PValues::new();
+                for (key, value) in obj {
+                    let value = match fields.get(&key) {
+                        // Not known to schema; pass it unmodified.
+                        None => value,
+
+                        Some(field) => match &field.value {
+                            BasicOrValue::Basic(basic) => parse_basic_json(reg, basic, value)?,
+
+                            BasicOrValue::Value(idx) => {
+                                parse_json_value(value, reg, &reg.values[*idx])?
+                            }
+                        },
+                    };
+                    result.insert(key, value);
+                }
+                Ok(PValue::Object(result))
+            }
+
+            _ => unexpected_json(reg, schema, &this),
+        },
+
+        Value::Map(value_type) => match this {
+            PValue::Object(obj) => {
+                let mut result = PValues::new();
+                for (key, value) in obj {
+                    let value = match value_type {
+                        BasicOrValue::Basic(basic) => parse_basic_json(reg, basic, value)?,
+                        BasicOrValue::Value(idx) => {
+                            parse_json_value(value, reg, &reg.values[*idx])?
+                        }
+                    };
+                    result.insert(key, value);
+                }
+                Ok(PValue::Object(result))
+            }
+
+            _ => unexpected_json(reg, schema, &this),
+        },
+
+        Value::Array(value_type) => match this {
+            PValue::Array(arr) => {
+                let mut result = Vec::with_capacity(arr.len());
+                for val in arr {
+                    let value = match value_type {
+                        BasicOrValue::Basic(basic) => parse_basic_json(reg, basic, val)?,
+                        BasicOrValue::Value(idx) => parse_json_value(val, reg, &reg.values[*idx])?,
+                    };
+                    result.push(value);
+                }
+                Ok(PValue::Array(result))
+            }
+
+            _ => unexpected_json(reg, schema, &this),
+        },
+
+        Value::Union(types) => {
+            // Find the first type that matches.
+            for candidate in types {
+                let result = match candidate {
+                    BasicOrValue::Basic(basic) => parse_basic_json(reg, basic, this.clone()),
+                    BasicOrValue::Value(idx) => {
+                        parse_json_value(this.clone(), reg, &reg.values[*idx])
+                    }
+                };
+                if let Ok(value) = result {
+                    return Ok(value);
+                }
+            }
+
+            // Couldn't find a match.
+            Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "invalid value".to_string(),
+                internal_message: Some(format!("no union type matched: {}", describe_json(&this),)),
+                stack: None,
+                details: None,
+            })
+        }
+    }
+}
+
+fn unexpected_json(reg: &Registry, schema: &Value, value: &PValue) -> APIResult<PValue> {
+    Err(api::Error {
+        code: api::ErrCode::InvalidArgument,
+        message: "invalid value".to_string(),
+        internal_message: Some(format!(
+            "expected {}, got {}",
+            schema.expecting(reg),
+            describe_json(value),
+        )),
+        stack: None,
+        details: None,
+    })
+}
+
+fn unsupported<T>(reg: &Registry, schema: &Value) -> APIResult<T> {
+    Err(api::Error {
+        code: api::ErrCode::InvalidArgument,
+        message: "unsupported schema type".to_string(),
+        internal_message: Some(format!(
+            "got an unsupported schema type: {}",
+            schema.expecting(reg),
+        )),
+        stack: None,
+        details: None,
+    })
+}
+
+fn describe_json(value: &PValue) -> &'static str {
+    match value {
+        PValue::Null => "null",
+        PValue::Bool(_) => "a boolean",
+        PValue::Number(_) => "a number",
+        PValue::Decimal(_) => "a decimal",
+        PValue::String(_) => "a string",
+        PValue::DateTime(_) => "a datetime",
+        PValue::Array(_) => "an array",
+        PValue::Object(_) => "an object",
+        PValue::Cookie(_) => "a cookie",
+    }
+}
+
+fn parse_basic_json(reg: &Registry, basic: &Basic, value: PValue) -> APIResult<PValue> {
+    match (basic, &value) {
+        (Basic::Any, _) => Ok(value),
+
+        (Basic::Null, PValue::Null) => Ok(value),
+        (Basic::Bool, PValue::Bool(_)) => Ok(value),
+        (Basic::Number, PValue::Number(_)) => Ok(value),
+        (Basic::String, PValue::String(_)) => Ok(value),
+
+        (Basic::String, PValue::Number(num)) => Ok(PValue::String(num.to_string())),
+        (Basic::String, PValue::Bool(bool)) => Ok(PValue::String(bool.to_string())),
+
+        (_, PValue::String(str)) => match basic {
+            Basic::Bool => match str.as_str() {
+                "true" => Ok(PValue::Bool(true)),
+                "false" => Ok(PValue::Bool(false)),
+                _ => Err(api::Error {
+                    code: api::ErrCode::InvalidArgument,
+                    message: format!("invalid boolean value: {str}"),
+                    internal_message: None,
+                    stack: None,
+                    details: None,
+                }),
+            },
+            Basic::Number => serde_json::Number::from_str(str)
+                .map(PValue::Number)
+                .map_err(|_err| api::Error {
+                    code: api::ErrCode::InvalidArgument,
+                    message: format!("invalid number value: {str}"),
+                    internal_message: None,
+                    stack: None,
+                    details: None,
+                }),
+            Basic::Null if str == "null" => Ok(PValue::Null),
+
+            _ => unexpected_json(reg, &Value::Basic(*basic), &value),
+        },
+
+        _ => unexpected_json(reg, &Value::Basic(*basic), &value),
+    }
+}
+
+fn parse_basic_str(basic: &Basic, str: &str) -> APIResult<PValue> {
+    match basic {
+        Basic::Any | Basic::String => Ok(PValue::String(str.to_string())),
+
+        Basic::Null if str.is_empty() || str == "null" => Ok(PValue::Null),
+        Basic::Null => Err(api::Error {
+            code: api::ErrCode::InvalidArgument,
+            message: "invalid value".to_string(),
+            internal_message: Some(format!("expected {}, got {:#?}", basic.expecting(), str)),
+            stack: None,
+            details: None,
+        }),
+
+        Basic::Bool => match str {
+            "true" => Ok(PValue::Bool(true)),
+            "false" => Ok(PValue::Bool(false)),
+            _ => Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: format!("invalid boolean value: {str}"),
+                internal_message: None,
+                stack: None,
+                details: None,
+            }),
+        },
+
+        Basic::Number => serde_json::Number::from_str(str)
+            .map(PValue::Number)
+            .map_err(|_err| api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: format!("invalid number value: {str}"),
+                internal_message: None,
+                stack: None,
+                details: None,
+            }),
+
+        Basic::DateTime => api::DateTime::parse_from_rfc3339(str)
+            .map(PValue::DateTime)
+            .map_err(|_err| api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "invalid datetime".to_string(),
+                internal_message: Some(format!("invalid datetime string {str:?}")),
+                stack: None,
+                details: None,
+            }),
+
+        Basic::Decimal => api::Decimal::from_str(str)
+            .map(PValue::Decimal)
+            .map_err(|_err| api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: format!("invalid decimal value: {str}"),
+                internal_message: None,
+                stack: None,
+                details: None,
+            }),
+    }
+}
diff --git a/runtimes/core/src/api/jsonschema/ser.rs b/runtimes/core/src/api/jsonschema/ser.rs
new file mode 100644
index 0000000000..6bc4dc1862
--- /dev/null
+++ b/runtimes/core/src/api/jsonschema/ser.rs
@@ -0,0 +1,50 @@
+use crate::api::jsonschema::{JSONSchema, Struct};
+use crate::api::schema::JSONPayload;
+use serde::{ser::SerializeMap, Serialize, Serializer};
+
+struct SchemaSerializeWrapper<'a> {
+    schema: &'a Struct,
+    payload: &'a JSONPayload,
+}
+
+impl Serialize for SchemaSerializeWrapper<'_> {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        let mut map = serializer.serialize_map(None)?;
+        if let Some(payload) = self.payload {
+            for (key, _value) in self.schema.fields.iter() {
+                if let Some(value) = payload.get(key) {
+                    map.serialize_entry(key, value)?;
+                }
+            }
+        }
+        map.end()
+    }
+}
+
+impl JSONSchema {
+    pub fn to_json(&self, payload: &JSONPayload) -> serde_json::Result<String> {
+        serde_json::to_string(&self.serialize(payload))
+    }
+
+    pub fn to_json_pretty(&self, payload: &JSONPayload) -> serde_json::Result<String> {
+        serde_json::to_string_pretty(&self.serialize(payload))
+    }
+
+    pub fn to_vec(&self, payload: &JSONPayload) -> serde_json::Result<Vec<u8>> {
+        serde_json::to_vec(&self.serialize(payload))
+    }
+
+    pub fn to_vec_pretty(&self, payload: &JSONPayload) -> serde_json::Result<Vec<u8>> {
+        serde_json::to_vec_pretty(&self.serialize(payload))
+    }
+
+    pub fn serialize<'a>(&'a self, payload: &'a JSONPayload) -> impl Serialize + 'a {
+        SchemaSerializeWrapper {
+            schema: self.root(),
+            payload,
+        }
+    }
+}
diff --git a/runtimes/core/src/api/jsonschema/validation.rs b/runtimes/core/src/api/jsonschema/validation.rs
new file mode 100644
index 0000000000..148d40b061
--- /dev/null
+++ b/runtimes/core/src/api/jsonschema/validation.rs
@@ -0,0 +1,569 @@
+use std::fmt::Display;
+
+use crate::{
+    api::{Decimal, PValue},
+    encore::parser::schema::v1 as schema,
+};
+use thiserror::Error;
+
+use super::BasicOrValue;
+
+#[derive(Debug, Clone)]
+pub struct Validation {
+    pub bov: BasicOrValue,
+    pub expr: Expr,
+}
+
+impl Validation {
+    pub fn validate_pval<'a>(&'a self, val: &'a PValue) -> Result<(), Error<'a>> {
+        self.expr.validate_pval(val)
+    }
+
+    pub fn validate_jval<'a>(&'a self, val: &'a serde_json::Value) -> Result<(), Error<'a>> {
+        self.expr.validate_jval(val)
+    }
+}
+
+#[derive(Debug, Clone)]
+pub enum Expr {
+    Rule(Rule),
+    And(Vec<Expr>),
+    Or(Vec<Expr>),
+}
+
+macro_rules! impl_validate {
+    ($method:ident, $typ:ty) => {
+        pub fn $method<'a>(&'a self, val: &'a $typ) -> Result<(), Error<'a>> {
+            match self {
+                Expr::Rule(rule) => rule.$method(val),
+                Expr::And(exprs) => {
+                    for expr in exprs {
+                        expr.$method(val)?;
+                    }
+                    Ok(())
+                }
+                Expr::Or(exprs) => {
+                    let mut first_err = None;
+                    for expr in exprs {
+                        match expr.$method(val) {
+                            Ok(()) => return Ok(()),
+                            Err(err) => {
+                                if first_err.is_none() {
+                                    first_err = Some(err);
+                                }
+                            }
+                        }
+                    }
+                    match first_err {
+                        Some(err) => Err(err),
+                        None => Ok(()),
+                    }
+                }
+            }
+        }
+    };
+}
+
+impl Expr {
+    impl_validate!(validate_pval, PValue);
+    impl_validate!(validate_jval, serde_json::Value);
+}
+
+#[derive(Debug, Clone)]
+pub enum Rule {
+    MinLen(u64),
+    MaxLen(u64),
+    MinVal(f64),
+    MaxVal(f64),
+    StartsWith(String),
+    EndsWith(String),
+    MatchesRegexp(regex::Regex),
+    Is(Is),
+}
+
+#[derive(Debug, Clone)]
+pub enum Is {
+    Email,
+    Url,
+}
+
+#[derive(Debug)]
+pub enum Num<'a> {
+    Number(&'a serde_json::Number),
+    Decimal(&'a Decimal),
+}
+
+impl<'a> Display for Num<'a> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Num::Number(number) => write!(f, "{number}"),
+            Num::Decimal(decimal) => write!(f, "{decimal}"),
+        }
+    }
+}
+
+#[derive(Error, Debug)]
+pub enum Error<'a> {
+    #[error("length too short (got {got}, expected at least {min})")]
+    MinLen { got: usize, min: usize },
+    #[error("length too long (got {got}, expected at most {max})")]
+    MaxLen { got: usize, max: usize },
+
+    #[error("value must be at least {min} (got {got})")]
+    MinVal { got: Num<'a>, min: f64 },
+    #[error("value must be at most {max} (got {got})")]
+    MaxVal { got: Num<'a>, max: f64 },
+
+    #[error("value does not match the regexp {regexp:#?}")]
+    MatchesRegexp { regexp: &'a str },
+
+    #[error("value does not start with {prefix:#?}")]
+    StartsWith { prefix: &'a str },
+
+    #[error("value does not end with {suffix:#?}")]
+    EndsWith { suffix: &'a str },
+
+    #[error("value is not {expected}")]
+    Is { expected: &'a str },
+
+    #[error("unexpected type (expected {want})")]
+    UnexpectedType { want: &'a str },
+}
+
+impl Rule {
+    #[cfg_attr(
+        feature = "rttrace",
+        tracing::instrument(skip(self), ret, level = "trace")
+    )]
+    pub fn validate_pval<'a>(&'a self, val: &'a PValue) -> Result<(), Error<'a>> {
+        match self {
+            Rule::MinLen(min_len) => match val {
+                PValue::Array(arr) => {
+                    if arr.len() < *min_len as usize {
+                        Err(Error::MinLen {
+                            got: arr.len(),
+                            min: *min_len as usize,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+                PValue::String(str) => {
+                    if str.len() < *min_len as usize {
+                        Err(Error::MinLen {
+                            got: str.len(),
+                            min: *min_len as usize,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType {
+                    want: "string or array",
+                }),
+            },
+
+            Rule::MaxLen(max_len) => match val {
+                PValue::Array(arr) => {
+                    if arr.len() > *max_len as usize {
+                        Err(Error::MaxLen {
+                            got: arr.len(),
+                            max: *max_len as usize,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+                PValue::String(str) => {
+                    if str.len() > *max_len as usize {
+                        Err(Error::MaxLen {
+                            got: str.len(),
+                            max: *max_len as usize,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType {
+                    want: "string or array",
+                }),
+            },
+
+            Rule::MinVal(min_val) => match val {
+                PValue::Number(num) => {
+                    let bad = if num.is_i64() {
+                        num.as_i64().unwrap() < *min_val as i64
+                    } else if num.is_u64() {
+                        num.as_u64().unwrap() < *min_val as u64
+                    } else if num.is_f64() {
+                        num.as_f64().unwrap() < *min_val
+                    } else {
+                        return Err(Error::UnexpectedType { want: "number" });
+                    };
+                    if bad {
+                        Err(Error::MinVal {
+                            got: Num::Number(num),
+                            min: *min_val,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+                PValue::Decimal(d) => {
+                    let bad = d < *min_val;
+                    if bad {
+                        Err(Error::MinVal {
+                            got: Num::Decimal(d),
+                            min: *min_val,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "number" }),
+            },
+
+            Rule::MaxVal(max_val) => match val {
+                PValue::Number(num) => {
+                    let bad = if num.is_i64() {
+                        num.as_i64().unwrap() > *max_val as i64
+                    } else if num.is_u64() {
+                        num.as_u64().unwrap() > *max_val as u64
+                    } else if num.is_f64() {
+                        num.as_f64().unwrap() > *max_val
+                    } else {
+                        return Err(Error::UnexpectedType { want: "number" });
+                    };
+                    if bad {
+                        Err(Error::MaxVal {
+                            got: Num::Number(num),
+                            max: *max_val,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+                PValue::Decimal(d) => {
+                    let bad = d > *max_val;
+                    if bad {
+                        Err(Error::MaxVal {
+                            got: Num::Decimal(d),
+                            max: *max_val,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "number" }),
+            },
+
+            Rule::StartsWith(prefix) => match val {
+                PValue::String(str) => {
+                    if str.starts_with(prefix) {
+                        Ok(())
+                    } else {
+                        Err(Error::StartsWith { prefix })
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "string" }),
+            },
+
+            Rule::EndsWith(suffix) => match val {
+                PValue::String(str) => {
+                    if str.ends_with(suffix) {
+                        Ok(())
+                    } else {
+                        Err(Error::EndsWith { suffix })
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "string" }),
+            },
+
+            Rule::MatchesRegexp(re) => match val {
+                PValue::String(str) => {
+                    if re.is_match(str) {
+                        Ok(())
+                    } else {
+                        Err(Error::MatchesRegexp {
+                            regexp: re.as_str(),
+                        })
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "string" }),
+            },
+
+            Rule::Is(Is::Email) => match val {
+                PValue::String(str) => {
+                    let email = email_address::EmailAddress::parse_with_options(
+                        str,
+                        email_address::Options::default().without_display_text(),
+                    );
+                    match email {
+                        Ok(_) => Ok(()),
+                        Err(_) => Err(Error::Is {
+                            expected: "an email",
+                        }),
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "string" }),
+            },
+
+            Rule::Is(Is::Url) => match val {
+                PValue::String(str) => {
+                    let u = url::Url::parse(str);
+                    match u {
+                        Ok(_) => Ok(()),
+                        Err(_) => Err(Error::Is { expected: "a url" }),
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "string" }),
+            },
+        }
+    }
+
+    #[cfg_attr(
+        feature = "rttrace",
+        tracing::instrument(skip(self), ret, level = "trace")
+    )]
+    pub fn validate_jval<'a>(&'a self, val: &'a serde_json::Value) -> Result<(), Error<'a>> {
+        use serde_json::Value as JVal;
+
+        match self {
+            Rule::MinLen(min_len) => match val {
+                JVal::Array(arr) => {
+                    if arr.len() < *min_len as usize {
+                        Err(Error::MinLen {
+                            got: arr.len(),
+                            min: *min_len as usize,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+                JVal::String(str) => {
+                    if str.len() < *min_len as usize {
+                        Err(Error::MinLen {
+                            got: str.len(),
+                            min: *min_len as usize,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType {
+                    want: "string or array",
+                }),
+            },
+
+            Rule::MaxLen(max_len) => match val {
+                JVal::Array(arr) => {
+                    if arr.len() > *max_len as usize {
+                        Err(Error::MaxLen {
+                            got: arr.len(),
+                            max: *max_len as usize,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+                JVal::String(str) => {
+                    if str.len() > *max_len as usize {
+                        Err(Error::MaxLen {
+                            got: str.len(),
+                            max: *max_len as usize,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType {
+                    want: "string or array",
+                }),
+            },
+
+            Rule::MinVal(min_val) => match val {
+                JVal::Number(num) => {
+                    let bad = if num.is_i64() {
+                        num.as_i64().unwrap() < *min_val as i64
+                    } else if num.is_u64() {
+                        num.as_u64().unwrap() < *min_val as u64
+                    } else if num.is_f64() {
+                        num.as_f64().unwrap() < *min_val
+                    } else {
+                        return Err(Error::UnexpectedType { want: "number" });
+                    };
+                    if bad {
+                        Err(Error::MinVal {
+                            got: Num::Number(num),
+                            min: *min_val,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "number" }),
+            },
+
+            Rule::MaxVal(max_val) => match val {
+                JVal::Number(num) => {
+                    let bad = if num.is_i64() {
+                        num.as_i64().unwrap() > *max_val as i64
+                    } else if num.is_u64() {
+                        num.as_u64().unwrap() > *max_val as u64
+                    } else if num.is_f64() {
+                        num.as_f64().unwrap() > *max_val
+                    } else {
+                        return Err(Error::UnexpectedType { want: "number" });
+                    };
+                    if bad {
+                        Err(Error::MaxVal {
+                            got: Num::Number(num),
+                            max: *max_val,
+                        })
+                    } else {
+                        Ok(())
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "number" }),
+            },
+
+            Rule::StartsWith(want) => match val {
+                JVal::String(got) => {
+                    if got.starts_with(got) {
+                        Ok(())
+                    } else {
+                        Err(Error::StartsWith { prefix: want })
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "string" }),
+            },
+
+            Rule::EndsWith(want) => match val {
+                JVal::String(got) => {
+                    if got.ends_with(got) {
+                        Ok(())
+                    } else {
+                        Err(Error::EndsWith { suffix: want })
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "string" }),
+            },
+
+            Rule::MatchesRegexp(re) => match val {
+                JVal::String(str) => {
+                    if re.is_match(str) {
+                        Ok(())
+                    } else {
+                        Err(Error::MatchesRegexp {
+                            regexp: re.as_str(),
+                        })
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "string" }),
+            },
+
+            Rule::Is(Is::Email) => match val {
+                JVal::String(str) => {
+                    let email = email_address::EmailAddress::parse_with_options(
+                        str,
+                        email_address::Options::default().without_display_text(),
+                    );
+                    match email {
+                        Ok(_) => Ok(()),
+                        Err(_) => Err(Error::Is { expected: "email" }),
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "string" }),
+            },
+
+            Rule::Is(Is::Url) => match val {
+                JVal::String(str) => {
+                    let u = url::Url::parse(str);
+                    match u {
+                        Ok(_) => Ok(()),
+                        Err(_) => Err(Error::Is { expected: "url" }),
+                    }
+                }
+
+                _ => Err(Error::UnexpectedType { want: "string" }),
+            },
+        }
+    }
+}
+
+impl TryFrom<&schema::ValidationExpr> for Expr {
+    type Error = anyhow::Error;
+
+    fn try_from(expr: &schema::ValidationExpr) -> Result<Self, Self::Error> {
+        let Some(expr) = &expr.expr else {
+            return Err(anyhow::anyhow!("missing expr"));
+        };
+
+        use schema::validation_expr::Expr as PbExpr;
+
+        match expr {
+            PbExpr::Rule(rule) => Ok(Expr::Rule(rule.try_into()?)),
+            PbExpr::And(expr) => {
+                let mut and = Vec::new();
+                for expr in &expr.exprs {
+                    and.push(expr.try_into()?);
+                }
+                Ok(Expr::And(and))
+            }
+            PbExpr::Or(expr) => {
+                let mut or = Vec::new();
+                for expr in &expr.exprs {
+                    or.push(expr.try_into()?);
+                }
+                Ok(Expr::Or(or))
+            }
+        }
+    }
+}
+
+impl TryFrom<&schema::ValidationRule> for Rule {
+    type Error = anyhow::Error;
+
+    fn try_from(rule: &schema::ValidationRule) -> Result<Self, Self::Error> {
+        let Some(rule) = &rule.rule else {
+            return Err(anyhow::anyhow!("missing validation rule"));
+        };
+
+        use schema::validation_rule::Is as PbIs;
+        use schema::validation_rule::Rule as PbRule;
+        match rule {
+            PbRule::MinLen(val) => Ok(Rule::MinLen(*val)),
+            PbRule::MaxLen(val) => Ok(Rule::MaxLen(*val)),
+            PbRule::MinVal(val) => Ok(Rule::MinVal(*val)),
+            PbRule::MaxVal(val) => Ok(Rule::MaxVal(*val)),
+            PbRule::StartsWith(val) => Ok(Rule::StartsWith(val.clone())),
+            PbRule::EndsWith(val) => Ok(Rule::EndsWith(val.clone())),
+            PbRule::MatchesRegexp(val) => {
+                let re = regex::Regex::new(val)?;
+                Ok(Rule::MatchesRegexp(re))
+            }
+            PbRule::Is(is) => Ok(Rule::Is(match PbIs::try_from(*is)? {
+                PbIs::Unknown => anyhow::bail!("unknown 'is' rule"),
+                PbIs::Email => Is::Email,
+                PbIs::Url => Is::Url,
+            })),
+        }
+    }
+}
diff --git a/runtimes/core/src/api/manager.rs b/runtimes/core/src/api/manager.rs
new file mode 100644
index 0000000000..f4f2fe2fb4
--- /dev/null
+++ b/runtimes/core/src/api/manager.rs
@@ -0,0 +1,452 @@
+use std::collections::HashMap;
+use std::future::{Future, IntoFuture};
+use std::sync::{Arc, Mutex};
+
+use anyhow::Context;
+
+use crate::api::auth::{LocalAuthHandler, RemoteAuthHandler};
+use crate::api::call::ServiceRegistry;
+use crate::api::gateway::Gateway;
+use crate::api::http_server::HttpServer;
+use crate::api::paths::Pather;
+use crate::api::reqauth::platform;
+use crate::api::schema::encoding::EncodingConfig;
+use crate::api::schema::JSONPayload;
+use crate::api::{
+    auth, cors, encore_routes, endpoints_from_meta, jsonschema, paths, reqauth, server, APIResult,
+    Endpoint, ToResponse,
+};
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::runtime::v1 as runtime;
+use crate::trace::Tracer;
+use crate::{api, model, pubsub, secrets, EncoreName, EndpointName, Hosted};
+
+use super::encore_routes::healthz;
+use super::websocket_client::WebSocketClient;
+use super::{PValues, ResponsePayload};
+
+pub struct ManagerConfig<'a> {
+    pub meta: &'a meta::Data,
+    pub environment: &'a runtime::Environment,
+    pub gateways: Vec<runtime::Gateway>,
+    pub hosted_services: Vec<runtime::HostedService>,
+    pub hosted_gateway_rids: Vec<String>,
+    pub svc_auth_methods: Vec<runtime::ServiceAuth>,
+    pub deploy_id: String,
+    pub platform: &'a runtime::EncorePlatform,
+    pub secrets: &'a secrets::Manager,
+    pub service_discovery: runtime::ServiceDiscovery,
+    pub http_client: reqwest::Client,
+    pub tracer: Tracer,
+    pub platform_validator: Arc<platform::RequestValidator>,
+    pub pubsub_push_registry: pubsub::PushHandlerRegistry,
+    pub runtime: tokio::runtime::Handle,
+    pub testing: bool,
+    pub proxied_push_subs: HashMap<String, EncoreName>,
+}
+
+pub struct Manager {
+    gateway_listen_addr: Option<String>,
+    api_listener: Mutex<Option<std::net::TcpListener>>,
+    service_registry: Arc<ServiceRegistry>,
+    healthz: healthz::Handler,
+    pubsub_push_registry: pubsub::PushHandlerRegistry,
+
+    api_server: Option<server::Server>,
+    runtime: tokio::runtime::Handle,
+
+    gateways: HashMap<EncoreName, Gateway>,
+    testing: bool,
+}
+
+impl ManagerConfig<'_> {
+    pub fn build(mut self) -> anyhow::Result<Manager> {
+        let gateway_listen_addr = if !self.hosted_gateway_rids.is_empty() {
+            // We have a gateway. Have the gateway listen on the provided listen_addr.
+            Some(listen_addr())
+        } else {
+            None
+        };
+
+        let api_listener = if !self.hosted_services.is_empty() {
+            // If we already have a gateway, it's listening on the externally provided listen addr.
+            // Use a random local port in that case.
+            let addr = if gateway_listen_addr.is_some() {
+                "127.0.0.1:0".to_string()
+            } else {
+                listen_addr()
+            };
+            let ln = std::net::TcpListener::bind(addr).context("unable to bind to port")?;
+            Some(ln)
+        } else {
+            None
+        };
+
+        // Get the local address for use by the service registry
+        // for calling services hosted by this instance.
+        let own_api_address = match api_listener {
+            None => None,
+            Some(ref ln) => {
+                let addr = ln
+                    .local_addr()
+                    .context("unable to determine listen address")?;
+                Some(addr)
+            }
+        };
+
+        let healthz_handler = encore_routes::healthz::Handler {
+            app_revision: self.meta.app_revision.clone(),
+            // Remove the "roll_" prefix from the deploy_id.
+            deploy_id: self
+                .deploy_id
+                .strip_prefix("roll_")
+                .unwrap_or(&self.deploy_id)
+                .to_string(),
+        };
+
+        let hosted_services = Hosted::from_iter(self.hosted_services.into_iter().map(|s| s.name));
+        let (endpoints, hosted_endpoints) = endpoints_from_meta(self.meta, &hosted_services)
+            .context("unable to compute endpoints descriptions")?;
+
+        let inbound_svc_auth = {
+            let mut entries = Vec::with_capacity(self.svc_auth_methods.len());
+            for auth in self.svc_auth_methods.drain(..) {
+                let auth_method =
+                    reqauth::service_auth_method(self.secrets, self.environment, auth)
+                        .context("unable to initialize service auth method")?;
+                entries.push(auth_method);
+            }
+            entries
+        };
+
+        let service_registry = ServiceRegistry::new(
+            self.secrets,
+            endpoints.clone(),
+            self.environment,
+            self.service_discovery,
+            own_api_address
+                .as_ref()
+                .map(|addr| addr.to_string())
+                .as_deref(),
+            &inbound_svc_auth,
+            &hosted_services,
+            self.deploy_id.clone(),
+            self.http_client.clone(),
+            self.tracer.clone(),
+        )
+        .context("unable to create service registry")?;
+        let service_registry = Arc::new(service_registry);
+
+        let gateways_by_rid: HashMap<String, runtime::Gateway> =
+            HashMap::from_iter(self.gateways.drain(..).map(|gw| (gw.rid.clone(), gw)));
+
+        let hosted_gateways: HashMap<&str, &runtime::Gateway> =
+            HashMap::from_iter(self.hosted_gateway_rids.iter().filter_map(|rid| {
+                gateways_by_rid
+                    .get(rid)
+                    .map(|gw| (gw.encore_name.as_str(), gw))
+            }));
+        let mut gateways = HashMap::new();
+        let routes = paths::compute(endpoints.values().map(|ep| RoutePerService(ep.to_owned())));
+
+        let mut auth_data_schemas = HashMap::new();
+        for gw in &self.meta.gateways {
+            let Some(gw_cfg) = hosted_gateways.get(gw.encore_name.as_str()) else {
+                continue;
+            };
+            let Some(cors_cfg) = &gw_cfg.cors else {
+                anyhow::bail!("missing CORS configuration for gateway {}", gw.encore_name);
+            };
+
+            let auth_handler = build_auth_handler(
+                self.meta,
+                gw,
+                &service_registry,
+                self.http_client.clone(),
+                self.tracer.clone(),
+            )
+            .context("unable to build authenticator")?;
+
+            let meta_headers = cors::MetaHeaders::from_schema(&endpoints, auth_handler.as_ref());
+            let cors_config = cors::config(cors_cfg, meta_headers)
+                .context("failed to parse CORS configuration")?;
+
+            auth_data_schemas.insert(
+                gw.encore_name.clone(),
+                auth_handler.as_ref().map(|ah| ah.auth_data().clone()),
+            );
+
+            gateways.insert(
+                gw.encore_name.clone().into(),
+                Gateway::new(
+                    gw.encore_name.clone().into(),
+                    service_registry.clone(),
+                    routes.clone(),
+                    auth_handler,
+                    cors_config,
+                    healthz_handler.clone(),
+                    own_api_address,
+                    self.proxied_push_subs.clone(),
+                )
+                .context("couldn't create gateway")?,
+            );
+        }
+
+        let api_server = if !hosted_services.is_empty() {
+            let server = server::Server::new(
+                endpoints.clone(),
+                hosted_endpoints,
+                self.platform_validator,
+                inbound_svc_auth,
+                self.tracer.clone(),
+                auth_data_schemas,
+            )
+            .context("unable to create API server")?;
+            Some(server)
+        } else {
+            None
+        };
+
+        Ok(Manager {
+            gateway_listen_addr,
+            api_listener: Mutex::new(api_listener),
+            service_registry,
+            api_server,
+            gateways,
+            pubsub_push_registry: self.pubsub_push_registry,
+            runtime: self.runtime,
+            healthz: healthz_handler,
+            testing: self.testing,
+        })
+    }
+}
+
+#[derive(Debug)]
+struct RoutePerService(Arc<Endpoint>);
+
+impl Pather for RoutePerService {
+    type Key = EncoreName;
+    type Value = Arc<Endpoint>;
+
+    fn key(&self) -> Self::Key {
+        self.0.name.service().into()
+    }
+    fn value(&self) -> Self::Value {
+        self.0.clone()
+    }
+    fn path(&self) -> &meta::Path {
+        &self.0.path
+    }
+}
+
+fn build_auth_handler(
+    meta: &meta::Data,
+    gw: &meta::Gateway,
+    service_registry: &ServiceRegistry,
+    http_client: reqwest::Client,
+    tracer: Tracer,
+) -> anyhow::Result<Option<auth::Authenticator>> {
+    let Some(explicit) = &gw.explicit else {
+        return Ok(None);
+    };
+    let Some(auth) = &explicit.auth_handler else {
+        return Ok(None);
+    };
+
+    let auth_params = auth.params.as_ref().context("missing auth params")?;
+    let mut builder = jsonschema::Builder::new(meta);
+    let schema = {
+        let mut cfg = EncodingConfig {
+            meta,
+            registry_builder: &mut builder,
+            default_loc: None,
+            rpc_path: None,
+            supports_body: false,
+            supports_query: true,
+            supports_header: true,
+            supports_path: false,
+            supports_http_status: false,
+        };
+
+        cfg.compute(auth_params)
+            .context("unable to compute auth handler schema")?
+    };
+
+    let auth_data_schema_idx =
+        builder.register_type(auth.auth_data.as_ref().context("missing auth data")?)?;
+
+    let registry = builder.build();
+    let schema = schema
+        .build(&registry)
+        .context("unable to build auth handler schema")?;
+
+    // let is_local = hosted_services.contains(&explicit.service_name);
+    let is_local = true;
+    let name = EndpointName::new(explicit.service_name.clone(), auth.name.clone());
+
+    let auth_data = registry.schema(auth_data_schema_idx);
+    let auth_handler = if is_local {
+        auth::Authenticator::local(
+            schema.clone(),
+            auth_data,
+            LocalAuthHandler {
+                name,
+                schema,
+                handler: Default::default(),
+                tracer,
+            },
+        )?
+    } else {
+        auth::Authenticator::remote(
+            schema,
+            auth_data.clone(),
+            RemoteAuthHandler::new(name, service_registry, http_client, auth_data)?,
+        )?
+    };
+
+    Ok(Some(auth_handler))
+}
+
+impl Manager {
+    pub fn gateway(&self, name: &EncoreName) -> Option<&Gateway> {
+        self.gateways.get(name)
+    }
+
+    pub fn server(&self) -> Option<&server::Server> {
+        self.api_server.as_ref()
+    }
+
+    pub fn call(
+        &self,
+        target: EndpointName,
+        data: JSONPayload,
+        source: Option<Arc<model::Request>>,
+        opts: Option<CallOpts>,
+    ) -> impl Future<Output = APIResult<ResponsePayload>> + 'static {
+        self.service_registry.api_call(target, data, source, opts)
+    }
+
+    pub fn endpoints(&self) -> &api::EndpointMap {
+        self.service_registry.endpoints()
+    }
+
+    pub fn stream(
+        &self,
+        endpoint_name: EndpointName,
+        data: JSONPayload,
+        source: Option<Arc<model::Request>>,
+        opts: Option<api::CallOpts>,
+    ) -> impl Future<Output = APIResult<WebSocketClient>> + 'static {
+        self.service_registry
+            .connect_stream(endpoint_name, data, source, opts)
+    }
+
+    /// Starts serving the API.
+    pub fn start_serving(&self) -> tokio::task::JoinHandle<anyhow::Result<()>> {
+        let api = self.api_server.as_ref().map(|srv| srv.router());
+
+        async fn fallback(
+            req: axum::http::Request<axum::body::Body>,
+        ) -> axum::response::Response<axum::body::Body> {
+            api::Error {
+                code: api::ErrCode::NotFound,
+                message: "endpoint not found".to_string(),
+                internal_message: Some(format!("no such endpoint exists: {}", req.uri().path())),
+                stack: None,
+                details: None,
+            }
+            .to_response(None)
+        }
+
+        let encore_routes = encore_routes::Desc {
+            healthz: self.healthz.clone(),
+            push_registry: self.pubsub_push_registry.clone(),
+        }
+        .router();
+
+        let fallback = axum::Router::new().fallback(fallback);
+        let server = HttpServer::new(encore_routes, api, fallback);
+
+        let api_listener = self.api_listener.lock().unwrap().take();
+        let gateway_listener = self.gateway_listen_addr.clone();
+
+        // TODO handle multiple gateways
+        let gateway = self.gateways.values().next().cloned();
+        let testing = self.testing;
+
+        self.runtime.spawn(async move {
+            let gateway_parts = (gateway, gateway_listener);
+            let gateway_fut = match gateway_parts {
+                (Some(gw), Some(ref ln)) => {
+                    if !testing {
+                        log::debug!(addr=ln; "gateway listening for incoming requests");
+                        Some(gw.serve(ln))
+                    } else {
+                        // No need running the gateway in tests
+                        None
+                    }
+                },
+                (Some(_), None) => {
+                    ::log::error!("internal encore error: misconfigured api gateway (missing listener), skipping");
+                    None
+                }
+                (None, Some(_)) => {
+                    ::log::error!("internal encore error: misconfigured api gateway (missing gateway config), skipping");
+                    None
+                }
+                (None, None) => None,
+            };
+
+            let api_fut = match api_listener {
+                Some(ln) => {
+                    let addr = ln.local_addr().map(|addr| addr.to_string()).unwrap_or_default();
+                    log::debug!(addr = addr; "api server listening for incoming requests");
+
+                    ln
+                        .set_nonblocking(true)
+                        .context("unable to set nonblocking")?;
+                    let axum_listener = tokio::net::TcpListener::from_std(ln)
+                        .context("unable to convert listener to tokio")?;
+                    let fut = axum::serve(axum_listener, server).into_future();
+                    Some(fut)
+                }
+                None => None,
+            };
+
+            tokio::select! {
+                res = async { gateway_fut.unwrap().await }, if gateway_fut.is_some() => {
+                    res.context("serve gateway").inspect_err(|err| log::error!("api gateway failed: {:?}", err))?;
+                },
+                res = async { api_fut.unwrap().await }, if api_fut.is_some() => {
+                    res.context("serve api").inspect_err(|err| log::error!("api server failed: {:?}", err))?;
+                },
+                else => {
+                    // Nothing to serve.
+                    ::log::debug!("no api server or gateway to serve");
+                }
+            };
+            Ok(())
+        })
+    }
+}
+
+fn listen_addr() -> String {
+    if let Ok(addr) = std::env::var("ENCORE_LISTEN_ADDR") {
+        return addr;
+    }
+    if let Ok(port) = std::env::var("PORT") {
+        return format!("0.0.0.0:{port}");
+    }
+    "0.0.0.0:8080".to_string()
+}
+
+#[derive(Debug)]
+pub struct CallOpts {
+    pub auth: Option<AuthOpts>,
+}
+
+#[derive(Debug)]
+pub struct AuthOpts {
+    pub data: PValues,
+    pub user_id: String,
+}
diff --git a/runtimes/core/src/api/mod.rs b/runtimes/core/src/api/mod.rs
new file mode 100644
index 0000000000..5254179b1a
--- /dev/null
+++ b/runtimes/core/src/api/mod.rs
@@ -0,0 +1,24 @@
+pub mod auth;
+pub mod call;
+mod cors;
+mod encore_routes;
+mod endpoint;
+mod error;
+pub mod gateway;
+mod http_server;
+mod httputil;
+pub mod jsonschema;
+mod manager;
+mod paths;
+mod pvalue;
+pub mod reqauth;
+pub mod schema;
+mod server;
+mod static_assets;
+pub mod websocket;
+pub mod websocket_client;
+
+pub use endpoint::*;
+pub use error::*;
+pub use manager::*;
+pub use pvalue::*;
diff --git a/runtimes/core/src/api/paths.rs b/runtimes/core/src/api/paths.rs
new file mode 100644
index 0000000000..22ada19bd6
--- /dev/null
+++ b/runtimes/core/src/api/paths.rs
@@ -0,0 +1,260 @@
+use crate::encore::parser::meta::v1 as meta;
+use serde::Serialize;
+use std::collections::{HashMap, HashSet};
+
+pub trait Pather {
+    type Key;
+    type Value;
+
+    fn key(&self) -> Self::Key;
+    fn value(&self) -> Self::Value;
+    fn path(&self) -> &meta::Path;
+}
+
+#[derive(Debug, Serialize, Clone)]
+pub struct PathSet<K, V> {
+    pub main: HashMap<K, Vec<(V, Vec<String>)>>,
+    pub fallback: HashMap<K, Vec<(V, Vec<String>)>>,
+}
+
+/// Computes paths to register, grouped by the given key for easier correlation.
+pub fn compute<P, K, V>(endpoints: impl Iterator<Item = P>) -> PathSet<K, V>
+where
+    P: Pather<Key = K, Value = V>,
+    K: Eq + Clone + std::hash::Hash,
+{
+    use crate::encore::parser::meta::v1::path_segment::SegmentType;
+
+    let mut main: HashMap<K, Vec<(V, Vec<String>)>> = HashMap::new();
+    let mut fallback: HashMap<K, Vec<(V, Vec<String>)>> = HashMap::new();
+    for ep in endpoints {
+        let path = ep.path();
+        let mut entries = Vec::with_capacity(2);
+
+        // Compute the axum path.
+        let mut result = String::new();
+        for seg in &path.segments {
+            let typ = SegmentType::try_from(seg.r#type).unwrap_or(SegmentType::Literal);
+            match typ {
+                SegmentType::Literal => {
+                    result.push('/');
+                    result.push_str(&seg.value)
+                }
+                SegmentType::Param => {
+                    result.push_str("/:");
+                    result.push_str(&seg.value)
+                }
+                SegmentType::Wildcard => {
+                    // The wildcard is the last segment.
+                    // Axum doesn't match e.g. "/" for "/*wildcard", so we need to register both.
+                    result.push('/');
+                    entries.push(result.clone());
+
+                    result.push('*');
+                    result.push_str(&seg.value);
+                }
+                SegmentType::Fallback => {
+                    // Axum doesn't match e.g. "/" for "/*wildcard", so we need to register both.
+                    result.push('/');
+                    entries.push(result.clone());
+
+                    result.push('*');
+                    result.push_str(&seg.value);
+                }
+            }
+        }
+        entries.push(result);
+
+        let is_fallback = path
+            .segments
+            .last()
+            .is_some_and(|seg| seg.r#type == SegmentType::Fallback as i32);
+
+        let key = ep.key();
+        let routes = (ep.value(), entries);
+        if is_fallback {
+            fallback.entry(key).or_default().push(routes);
+        } else {
+            main.entry(key).or_default().push(routes);
+        }
+    }
+
+    // Add paths for TSR redirects.
+    {
+        for paths in [&mut main, &mut fallback] {
+            let path_set: HashSet<String> = HashSet::from_iter(
+                paths
+                    .values()
+                    .flatten()
+                    .flat_map(|(_, routes)| routes.iter())
+                    .cloned(),
+            );
+            for entries in paths.values_mut() {
+                for (_, endpoint_routes) in entries {
+                    let mut tsr_routes = Vec::new();
+                    for route in endpoint_routes.iter() {
+                        // Is this entry incompatible with TSR?
+                        if route == "/" || route.contains("/*") || route.ends_with('/') {
+                            continue;
+                        }
+
+                        let tsr = format!("{route}/");
+                        if !path_set.contains(&tsr) {
+                            tsr_routes.push(tsr);
+                        }
+                    }
+                    endpoint_routes.extend(tsr_routes);
+                }
+            }
+        }
+    }
+
+    PathSet { main, fallback }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::encore::parser::meta::v1::path_segment::SegmentType;
+    use serde::ser::SerializeStruct;
+
+    #[test]
+    fn test_basic() {
+        let endpoints = vec![
+            ep("one", "a", &[lit("foo")]),
+            ep("two", "a", &[lit("foo"), lit("bar")]),
+        ];
+
+        let paths = compute(endpoints.into_iter());
+        insta::with_settings!({sort_maps => true}, {
+            insta::assert_yaml_snapshot!(paths);
+        });
+    }
+
+    #[test]
+    fn test_tsr_conflict() {
+        let endpoints = vec![
+            ep("one", "a", &[lit("foo"), lit("")]),
+            ep("two", "b", &[lit("foo")]),
+        ];
+
+        let paths = compute(endpoints.into_iter());
+        insta::with_settings!({sort_maps => true}, {
+            insta::assert_yaml_snapshot!(paths);
+        });
+    }
+
+    #[test]
+    fn test_wildcard() {
+        let endpoints = vec![ep("one", "a", &[wildcard("foo")])];
+
+        let paths = compute(endpoints.into_iter());
+        insta::with_settings!({sort_maps => true}, {
+            insta::assert_yaml_snapshot!(paths);
+        });
+    }
+
+    #[test]
+    fn test_fallback() {
+        let endpoints = vec![ep("one", "a", &[fallback("foo")])];
+
+        let paths = compute(endpoints.into_iter());
+        insta::with_settings!({sort_maps => true}, {
+            insta::assert_yaml_snapshot!(paths);
+        });
+    }
+
+    fn path(segs: &[meta::PathSegment]) -> meta::Path {
+        meta::Path {
+            segments: segs.to_vec(),
+            r#type: meta::path::Type::Url as i32,
+        }
+    }
+
+    fn seg(typ: SegmentType, value: &str) -> meta::PathSegment {
+        meta::PathSegment {
+            r#type: typ as i32,
+            value: value.to_string(),
+            value_type: meta::path_segment::ParamType::String as i32,
+            validation: None,
+        }
+    }
+
+    fn lit(str: &str) -> meta::PathSegment {
+        seg(SegmentType::Literal, str)
+    }
+
+    fn wildcard(str: &str) -> meta::PathSegment {
+        seg(SegmentType::Wildcard, str)
+    }
+
+    fn fallback(str: &str) -> meta::PathSegment {
+        seg(SegmentType::Fallback, str)
+    }
+
+    #[derive(Clone, Debug)]
+    struct TestEndpoint {
+        name: &'static str,
+        key: &'static str,
+        path: meta::Path,
+    }
+
+    impl Serialize for TestEndpoint {
+        fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+        where
+            S: serde::Serializer,
+        {
+            let mut state = serializer.serialize_struct("TestEndpoint", 2)?;
+            let path = path_to_str(&self.path);
+            state.serialize_field("key", &self.key)?;
+            state.serialize_field("path", &path)?;
+            state.end()
+        }
+    }
+
+    fn ep(name: &'static str, key: &'static str, segs: &[meta::PathSegment]) -> TestEndpoint {
+        TestEndpoint {
+            name,
+            key,
+            path: path(segs),
+        }
+    }
+
+    impl Pather for TestEndpoint {
+        type Key = String;
+        type Value = String;
+
+        fn key(&self) -> Self::Key {
+            self.key.to_string()
+        }
+        fn value(&self) -> Self::Value {
+            self.name.to_string()
+        }
+
+        fn path(&self) -> &meta::Path {
+            &self.path
+        }
+    }
+
+    fn path_to_str(path: &meta::Path) -> String {
+        let mut result = String::new();
+        for seg in &path.segments {
+            result.push('/');
+
+            use meta::path_segment::SegmentType;
+            match SegmentType::try_from(seg.r#type).unwrap() {
+                SegmentType::Literal => result.push_str(&seg.value),
+                SegmentType::Param => {
+                    result.push(':');
+                    result.push_str(&seg.value)
+                }
+                SegmentType::Wildcard | SegmentType::Fallback => {
+                    result.push('*');
+                    result.push_str(&seg.value)
+                }
+            }
+        }
+
+        result
+    }
+}
diff --git a/runtimes/core/src/api/pvalue.rs b/runtimes/core/src/api/pvalue.rs
new file mode 100644
index 0000000000..ef7e3ed032
--- /dev/null
+++ b/runtimes/core/src/api/pvalue.rs
@@ -0,0 +1,376 @@
+use std::{
+    collections::BTreeMap,
+    fmt::{Debug, Display},
+    ops::{Add, Div, Mul, Sub},
+    str::FromStr,
+};
+
+use bytes::BytesMut;
+use malachite::rational::{conversion::primitive_int_from_rational, Rational};
+use malachite::{
+    base::num::conversion::{
+        string::options::ToSciOptions,
+        traits::{FromSciString, ToSci},
+    },
+    rational::conversion::primitive_float_from_rational,
+};
+use serde::{Serialize, Serializer};
+
+use crate::sqldb;
+
+/// Represents any valid value in a request/response payload.
+///
+/// It is a more type-safe version of JSON, where we support additional
+/// semantic types like timestamps.
+#[derive(Clone, Eq, PartialEq, Debug)]
+pub enum PValue {
+    /// Represents a JSON null value.
+    Null,
+
+    /// Represents a JSON boolean.
+    Bool(bool),
+
+    /// Represents a JSON number, whether integer or floating point.
+    Number(serde_json::Number),
+
+    /// Represents a Decimal type with arbitrary precision.
+    Decimal(Decimal),
+
+    /// Represents a JSON string.
+    String(String),
+
+    /// Represents a JSON array.
+    Array(Vec<PValue>),
+
+    /// Represents a JSON object.
+    Object(PValues),
+
+    // Represents a datetime value.
+    DateTime(DateTime),
+
+    // Represents a cookie.
+    Cookie(Cookie),
+}
+
+impl PValue {
+    pub fn is_null(&self) -> bool {
+        matches!(self, PValue::Null)
+    }
+
+    pub fn is_array(&self) -> bool {
+        matches!(self, PValue::Array(..))
+    }
+
+    /// If the `PValue` is a String, returns the associated str.
+    /// Returns None otherwise.
+    pub fn as_str(&self) -> Option<&str> {
+        match self {
+            PValue::String(s) => Some(s),
+            _ => None,
+        }
+    }
+
+    pub fn type_name(&self) -> &'static str {
+        match self {
+            PValue::Null => "null",
+            PValue::Bool(_) => "boolean",
+            PValue::Number(_) => "number",
+            PValue::String(_) => "string",
+            PValue::Array(_) => "array",
+            PValue::Object(_) => "object",
+            PValue::DateTime(_) => "datetime",
+            PValue::Cookie(_) => "cookie",
+            PValue::Decimal(_) => "decimal",
+        }
+    }
+}
+
+pub type PValues = BTreeMap<String, PValue>;
+
+pub type DateTime = chrono::DateTime<chrono::FixedOffset>;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Cookie {
+    pub name: String,
+    pub value: Box<PValue>,
+    pub path: Option<String>,
+    pub domain: Option<String>,
+    pub secure: Option<bool>,
+    pub http_only: Option<bool>,
+    pub expires: Option<DateTime>,
+    pub max_age: Option<u64>,
+    pub same_site: Option<SameSite>,
+    pub partitioned: Option<bool>,
+}
+
+impl<'a> From<&'a Cookie> for cookie::Cookie<'a> {
+    fn from(value: &'a Cookie) -> Self {
+        let mut builder = cookie::CookieBuilder::new(&value.name, value.value.to_string());
+        if let Some(path) = &value.path {
+            builder = builder.path(path);
+        }
+        if let Some(domain) = &value.domain {
+            builder = builder.domain(domain);
+        }
+        if let Some(secure) = &value.secure {
+            builder = builder.secure(*secure);
+        }
+        if let Some(http_only) = &value.http_only {
+            builder = builder.http_only(*http_only);
+        }
+        if let Some(expires) = &value.expires {
+            let system_time: std::time::SystemTime = (*expires).into();
+            let expire = cookie::time::OffsetDateTime::from(system_time);
+            builder = builder.expires(expire);
+        }
+        if let Some(max_age) = &value.max_age {
+            builder = builder.max_age(cookie::time::Duration::seconds(*max_age as i64));
+        }
+        if let Some(same_site) = &value.same_site {
+            let same_site = match same_site {
+                SameSite::Strict => cookie::SameSite::Strict,
+                SameSite::Lax => cookie::SameSite::Lax,
+                SameSite::None => cookie::SameSite::None,
+            };
+            builder = builder.same_site(same_site);
+        }
+        if let Some(partitioned) = &value.partitioned {
+            builder = builder.partitioned(*partitioned);
+        }
+
+        builder.build()
+    }
+}
+
+impl Display for Cookie {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let c: cookie::Cookie<'_> = self.into();
+        write!(f, "{c}")
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum SameSite {
+    Strict,
+    Lax,
+    None,
+}
+
+impl Display for SameSite {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            SameSite::Strict => write!(f, "Strict"),
+            SameSite::Lax => write!(f, "Lax"),
+            SameSite::None => write!(f, "None"),
+        }
+    }
+}
+
+#[derive(Clone, Hash, Eq, PartialEq, Debug)]
+pub struct Decimal(Rational);
+
+impl Add for &Decimal {
+    type Output = Decimal;
+
+    fn add(self, rhs: Self) -> Self::Output {
+        Decimal((&self.0).add(&rhs.0))
+    }
+}
+impl Sub for &Decimal {
+    type Output = Decimal;
+
+    fn sub(self, rhs: Self) -> Self::Output {
+        Decimal((&self.0).sub(&rhs.0))
+    }
+}
+impl Mul for &Decimal {
+    type Output = Decimal;
+
+    fn mul(self, rhs: Self) -> Self::Output {
+        Decimal((&self.0).mul(&rhs.0))
+    }
+}
+impl Div for &Decimal {
+    type Output = Decimal;
+
+    fn div(self, rhs: Self) -> Self::Output {
+        Decimal((&self.0).div(&rhs.0))
+    }
+}
+
+impl TryFrom<&Decimal> for i64 {
+    type Error = primitive_int_from_rational::SignedFromRationalError;
+
+    fn try_from(value: &Decimal) -> Result<Self, Self::Error> {
+        i64::try_from(&value.0)
+    }
+}
+
+impl TryFrom<&Decimal> for i32 {
+    type Error = primitive_int_from_rational::SignedFromRationalError;
+
+    fn try_from(value: &Decimal) -> Result<Self, Self::Error> {
+        i32::try_from(&value.0)
+    }
+}
+
+impl TryFrom<&Decimal> for i16 {
+    type Error = primitive_int_from_rational::SignedFromRationalError;
+
+    fn try_from(value: &Decimal) -> Result<Self, Self::Error> {
+        i16::try_from(&value.0)
+    }
+}
+
+impl TryFrom<&Decimal> for f64 {
+    type Error = primitive_float_from_rational::FloatConversionError;
+
+    fn try_from(value: &Decimal) -> Result<Self, Self::Error> {
+        f64::try_from(&value.0)
+    }
+}
+
+impl TryFrom<&Decimal> for f32 {
+    type Error = primitive_float_from_rational::FloatConversionError;
+
+    fn try_from(value: &Decimal) -> Result<Self, Self::Error> {
+        f32::try_from(&value.0)
+    }
+}
+
+impl PartialEq<f64> for &Decimal {
+    fn eq(&self, other: &f64) -> bool {
+        self.0 == *other
+    }
+}
+
+impl PartialOrd<f64> for &Decimal {
+    fn partial_cmp(&self, other: &f64) -> Option<std::cmp::Ordering> {
+        self.0.partial_cmp(other)
+    }
+}
+
+impl FromStr for Decimal {
+    type Err = anyhow::Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let r = Rational::from_sci_string(s)
+            .ok_or_else(|| anyhow::anyhow!("Failed to parse decimal from string: {s}"))?;
+        Ok(Decimal(r))
+    }
+}
+
+impl Display for Decimal {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let mut opts = ToSciOptions::default();
+        opts.set_size_complete();
+        opts.set_include_trailing_zeros(true);
+        if !self.0.fmt_sci_valid(opts) {
+            // e.g the number is 1/3
+            opts.set_scale(10);
+        }
+        self.0.fmt_sci(f, opts)
+    }
+}
+
+impl From<Rational> for Decimal {
+    fn from(r: Rational) -> Self {
+        Decimal(r)
+    }
+}
+
+impl tokio_postgres::types::ToSql for Decimal {
+    fn to_sql(
+        &self,
+        _ty: &tokio_postgres::types::Type,
+        out: &mut BytesMut,
+    ) -> Result<tokio_postgres::types::IsNull, Box<dyn std::error::Error + Sync + Send>> {
+        let n = sqldb::numeric::Numeric::from_str(&self.to_string())?;
+        sqldb::numeric::numeric_to_sql(n, out);
+        Ok(tokio_postgres::types::IsNull::No)
+    }
+
+    tokio_postgres::types::accepts!(NUMERIC);
+    tokio_postgres::types::to_sql_checked!();
+}
+
+impl<'a> tokio_postgres::types::FromSql<'a> for Decimal {
+    fn from_sql(
+        _ty: &tokio_postgres::types::Type,
+        raw: &[u8],
+    ) -> Result<Self, Box<dyn std::error::Error + Sync + Send>> {
+        let n = sqldb::numeric::numeric_from_sql(raw)?;
+        let d = Decimal::from_str(&n.to_string())?;
+        Ok(d)
+    }
+
+    tokio_postgres::types::accepts!(NUMERIC);
+}
+
+impl Serialize for PValue {
+    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        match self {
+            PValue::Null => serializer.serialize_unit(),
+            PValue::Bool(b) => serializer.serialize_bool(*b),
+            PValue::Number(n) => n.serialize(serializer),
+            PValue::String(s) => serializer.serialize_str(s),
+            PValue::Array(a) => a.serialize(serializer),
+            PValue::Object(o) => o.serialize(serializer),
+            PValue::DateTime(dt) => dt.serialize(serializer),
+            PValue::Cookie(c) => serializer.serialize_str(&c.to_string()),
+            PValue::Decimal(d) => serializer.serialize_str(&d.to_string()),
+        }
+    }
+}
+
+impl Display for PValue {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            PValue::Null => write!(f, "null"),
+            PValue::Bool(b) => write!(f, "{b}"),
+            PValue::Number(n) => write!(f, "{n}"),
+            PValue::String(s) => write!(f, "{s}"),
+            PValue::DateTime(dt) => write!(f, "{}", dt.to_rfc3339()),
+            PValue::Array(a) => {
+                write!(f, "[")?;
+                for (i, v) in a.iter().enumerate() {
+                    if i > 0 {
+                        write!(f, ", ")?;
+                    }
+                    write!(f, "{v}")?;
+                }
+                write!(f, "]")
+            }
+            PValue::Object(o) => {
+                write!(f, "{{")?;
+                for (i, (k, v)) in o.iter().enumerate() {
+                    if i > 0 {
+                        write!(f, ", ")?;
+                    }
+                    write!(f, "{k}: {v}")?;
+                }
+                write!(f, "}}")
+            }
+            PValue::Cookie(c) => write!(f, "{c}"),
+            PValue::Decimal(d) => write!(f, "{d}",),
+        }
+    }
+}
+
+impl From<serde_json::Value> for PValue {
+    fn from(value: serde_json::Value) -> Self {
+        match value {
+            serde_json::Value::Null => PValue::Null,
+            serde_json::Value::Bool(b) => PValue::Bool(b),
+            serde_json::Value::Number(n) => PValue::Number(n),
+            serde_json::Value::String(s) => PValue::String(s),
+            serde_json::Value::Array(a) => PValue::Array(a.into_iter().map(PValue::from).collect()),
+            serde_json::Value::Object(o) => {
+                PValue::Object(o.into_iter().map(|(k, v)| (k, PValue::from(v))).collect())
+            }
+        }
+    }
+}
diff --git a/runtimes/core/src/api/reqauth/caller.rs b/runtimes/core/src/api/reqauth/caller.rs
new file mode 100644
index 0000000000..c41dc968ac
--- /dev/null
+++ b/runtimes/core/src/api/reqauth/caller.rs
@@ -0,0 +1,95 @@
+use crate::{EncoreName, EndpointName};
+use std::str::FromStr;
+
+#[derive(Debug, Clone)]
+pub enum Caller {
+    APIEndpoint(EndpointName),
+    PubSubMessage {
+        topic: EncoreName,
+        subscription: EncoreName,
+        message_id: String,
+    },
+    App {
+        deploy_id: String,
+    },
+    Gateway {
+        /// The name of the gateway.
+        gateway: EncoreName,
+    },
+    EncorePrincipal(String),
+}
+
+impl Caller {
+    pub fn serialize(&self) -> String {
+        match self {
+            Caller::APIEndpoint(name) => format!("api:{}.{}", name.service(), name.endpoint()),
+            Caller::PubSubMessage {
+                topic,
+                subscription,
+                message_id,
+            } => format!("pubsub:{topic}:{subscription}:{message_id}"),
+            Caller::Gateway { gateway } => {
+                format!("gateway:{gateway}")
+            }
+            Caller::App { deploy_id } => format!("app:{deploy_id}"),
+            Caller::EncorePrincipal(name) => format!("encore:{name}"),
+        }
+    }
+
+    /// Whether private APIs can be called
+    pub fn private_api_access(&self) -> bool {
+        use Caller::*;
+        match self {
+            APIEndpoint(_) | PubSubMessage { .. } | App { .. } | EncorePrincipal(_) => true,
+
+            Gateway { .. } => false,
+        }
+    }
+
+    pub fn is_gateway(&self) -> bool {
+        matches!(&self, Caller::Gateway { .. })
+    }
+}
+
+impl FromStr for Caller {
+    type Err = anyhow::Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        fn parse(s: &str) -> Option<Caller> {
+            let (kind, rest) = s.split_once(':')?;
+
+            Some(match kind {
+                "api" => {
+                    let (service, endpoint) = rest.split_once('.')?;
+
+                    Caller::APIEndpoint(EndpointName::new(service, endpoint))
+                }
+                "pubsub" => {
+                    let mut parts = rest.splitn(3, ':');
+                    let topic = parts.next()?;
+                    let subscription = parts.next()?;
+                    let message_id = parts.next()?;
+                    Caller::PubSubMessage {
+                        topic: EncoreName::from(topic),
+                        subscription: EncoreName::from(subscription),
+                        message_id: message_id.to_string(),
+                    }
+                }
+                "app" => Caller::App {
+                    deploy_id: rest.to_string(),
+                },
+                "gateway" => {
+                    let mut parts = rest.splitn(2, '.');
+                    let gateway = parts.next()?;
+                    Caller::Gateway {
+                        gateway: EncoreName::from(gateway),
+                    }
+                }
+                "encore" => Caller::EncorePrincipal(rest.to_string()),
+                _ => return None,
+            })
+        }
+
+        parse(s).ok_or_else(|| anyhow::anyhow!("invalid caller string"))
+    }
+}
diff --git a/runtimes/core/src/api/reqauth/encoreauth/mod.rs b/runtimes/core/src/api/reqauth/encoreauth/mod.rs
new file mode 100644
index 0000000000..6932214711
--- /dev/null
+++ b/runtimes/core/src/api/reqauth/encoreauth/mod.rs
@@ -0,0 +1,5 @@
+mod ophash;
+mod sign;
+
+pub use ophash::OperationHash;
+pub use sign::{sign, sign_for_verification, InvalidSignature, SignatureComponents};
diff --git a/runtimes/core/src/api/reqauth/encoreauth/ophash.rs b/runtimes/core/src/api/reqauth/encoreauth/ophash.rs
new file mode 100644
index 0000000000..b878f9fa33
--- /dev/null
+++ b/runtimes/core/src/api/reqauth/encoreauth/ophash.rs
@@ -0,0 +1,60 @@
+use anyhow::Context;
+use sha3::{Digest, Sha3_256};
+use std::str::FromStr;
+
+pub struct OperationHash {
+    output: sha3::digest::Output<Sha3_256>,
+    hex: String,
+}
+
+impl OperationHash {
+    pub fn new<'a>(
+        obj: &[u8],
+        action: &[u8],
+        payload: Option<&[u8]>,
+        additional_context: impl Iterator<Item = &'a [u8]>,
+    ) -> Self {
+        let mut hasher = <Sha3_256 as Digest>::new();
+        hasher.update(obj);
+        hasher.update(action);
+
+        if let Some(payload) = payload {
+            hasher.update(b"\0");
+            hasher.update((payload.len() as u32).to_le_bytes());
+            hasher.update(payload);
+        }
+
+        for c in additional_context {
+            hasher.update(b"\0");
+            hasher.update((c.len() as u32).to_le_bytes());
+            hasher.update(c);
+        }
+
+        let output = hasher.finalize();
+        let hex = hex::encode(output.as_slice());
+        Self { output, hex }
+    }
+
+    pub fn as_hex(&self) -> &str {
+        &self.hex
+    }
+
+    pub fn ct_eq(&self, other: &Self) -> bool {
+        use subtle::ConstantTimeEq;
+        self.output.ct_eq(&other.output).into()
+    }
+}
+
+impl FromStr for OperationHash {
+    type Err = anyhow::Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let raw = hex::decode(s).context("invalid hex")?;
+        let output = <sha3::digest::Output<Sha3_256>>::from_exact_iter(raw.into_iter())
+            .context("invalid hash length")?;
+        Ok(Self {
+            output,
+            hex: s.to_string(),
+        })
+    }
+}
diff --git a/runtimes/core/src/api/reqauth/encoreauth/sign.rs b/runtimes/core/src/api/reqauth/encoreauth/sign.rs
new file mode 100644
index 0000000000..462dd34c21
--- /dev/null
+++ b/runtimes/core/src/api/reqauth/encoreauth/sign.rs
@@ -0,0 +1,280 @@
+use std::fmt::{Display, Formatter};
+use std::str::FromStr;
+use std::time::SystemTime;
+
+use bytes::{BufMut, BytesMut};
+use chrono::{DateTime, SecondsFormat, Utc};
+use hmac::{Hmac, Mac};
+
+use crate::api::reqauth::encoreauth::ophash::OperationHash;
+
+const SIGNATURE_VERSION: &str = "ENCORE1";
+const _HASH_IMPL: &str = "HMAC-SHA3-256";
+
+// This must match the values of the constants above.
+const AUTH_SCHEME: &str = "ENCORE1-HMAC-SHA3-256";
+
+/// Sign creates the authorization headers for a new request.
+///
+/// The signature algorithm is based on the AWS Signature Version 4 signing process and is valid for 2 minutes
+/// from the time the request is signed.
+pub fn sign(
+    key: (u32, &[u8]),
+    app_slug: &str,
+    env_name: &str,
+    timestamp: SystemTime,
+    operation: &OperationHash,
+) -> String {
+    sign_for_verification(key, app_slug, env_name, timestamp, operation)
+}
+
+pub fn sign_for_verification(
+    key: (u32, &[u8]),
+    app_slug: &str,
+    env_name: &str,
+    timestamp: SystemTime,
+    operation: &OperationHash,
+) -> String {
+    let credentials = create_credential_string(timestamp, app_slug, env_name, key.0);
+    let request_digest = build_request_digest(timestamp, &credentials, operation);
+    let signing_key = derive_signing_key(key.1, timestamp, app_slug, env_name).into_bytes();
+
+    let signature = hash_hmac(&signing_key, request_digest.as_bytes()).into_bytes();
+    let signature = hex::encode(signature);
+
+    format!(
+        "{} cred=\"{}\", op={}, sig={}",
+        AUTH_SCHEME,
+        credentials,
+        operation.as_hex(),
+        signature
+    )
+}
+
+pub struct SignatureComponents {
+    pub key_id: u32,
+    pub app_slug: String,
+    pub env_name: String,
+    pub timestamp: SystemTime,
+    pub operation_hash: OperationHash,
+}
+
+#[derive(Debug)]
+pub enum InvalidSignature {
+    InvalidAuthorizationHeader,
+    InvalidDateHeader,
+
+    InvalidAuthScheme,
+    InvalidCredentialString,
+    InvalidOperationHash,
+    UnknownParameter(String),
+}
+
+impl Display for InvalidSignature {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        use InvalidSignature::*;
+        match self {
+            InvalidAuthorizationHeader => write!(f, "invalid authorization header"),
+            InvalidDateHeader => write!(f, "invalid date header"),
+            InvalidAuthScheme => write!(f, "invalid auth scheme"),
+            InvalidCredentialString => write!(f, "invalid credential string"),
+            InvalidOperationHash => write!(f, "invalid operation hash"),
+            UnknownParameter(name) => write!(f, "unknown parameter: {name}"),
+        }
+    }
+}
+
+impl std::error::Error for InvalidSignature {}
+
+impl SignatureComponents {
+    pub fn parse(authorization: &str, date: &str) -> Result<Self, InvalidSignature> {
+        let http_date =
+            httpdate::parse_http_date(date).map_err(|_| InvalidSignature::InvalidDateHeader)?;
+        let date_str = <DateTime<Utc>>::from(http_date)
+            .format("%Y%m%d")
+            .to_string();
+
+        let mut auth_components = authorization.splitn(2, ' ');
+        let scheme = auth_components
+            .next()
+            .ok_or(InvalidSignature::InvalidAuthorizationHeader)?;
+        if scheme != AUTH_SCHEME {
+            return Err(InvalidSignature::InvalidAuthScheme);
+        }
+
+        let parameters = auth_components
+            .next()
+            .ok_or(InvalidSignature::InvalidAuthorizationHeader)?;
+
+        let mut op_hash = None;
+        let mut creds = None;
+        for param in parameters.split(", ") {
+            let (name, value) = param
+                .split_once('=')
+                .ok_or(InvalidSignature::InvalidAuthorizationHeader)?;
+            match name {
+                "cred" => {
+                    if creds.is_some() {
+                        return Err(InvalidSignature::InvalidAuthorizationHeader);
+                    }
+
+                    // Unquote the value.
+                    let value = value
+                        .strip_prefix('"')
+                        .and_then(|v| v.strip_suffix('"'))
+                        .ok_or(InvalidSignature::InvalidCredentialString)?;
+
+                    let parsed = parse_credential_string(value)?;
+                    if parsed.date != date_str {
+                        return Err(InvalidSignature::InvalidDateHeader);
+                    }
+                    creds = Some(parsed);
+                }
+                "op" => {
+                    if op_hash.is_some() {
+                        return Err(InvalidSignature::InvalidAuthorizationHeader);
+                    }
+                    op_hash = Some(
+                        OperationHash::from_str(value)
+                            .map_err(|_| InvalidSignature::InvalidOperationHash)?,
+                    );
+                }
+                "sig" => {
+                    // No need to do anything with the signature
+                }
+                _ => {
+                    return Err(InvalidSignature::UnknownParameter(name.to_string()));
+                }
+            }
+        }
+
+        let Some(creds) = creds else {
+            return Err(InvalidSignature::InvalidAuthorizationHeader);
+        };
+
+        Ok(Self {
+            key_id: creds.key_id,
+            app_slug: creds.app_slug,
+            env_name: creds.env_name,
+            timestamp: http_date,
+            operation_hash: op_hash.ok_or(InvalidSignature::InvalidAuthorizationHeader)?,
+        })
+    }
+}
+
+fn create_credential_string(
+    timestamp: SystemTime,
+    app_slug: &str,
+    env_name: &str,
+    key_id: u32,
+) -> String {
+    let dt: DateTime<Utc> = timestamp.into();
+    let date = dt.format("%Y%m%d");
+    format!("{date}/{app_slug}/{env_name}/{key_id}")
+}
+
+struct CredentialComponents {
+    key_id: u32,
+    app_slug: String,
+    env_name: String,
+    date: String,
+}
+
+fn parse_credential_string(s: &str) -> Result<CredentialComponents, InvalidSignature> {
+    let mut parts = s.split('/');
+    let date = parts
+        .next()
+        .ok_or(InvalidSignature::InvalidCredentialString)?
+        .to_string();
+    let app_slug = parts
+        .next()
+        .ok_or(InvalidSignature::InvalidCredentialString)?
+        .to_string();
+    let env_name = parts
+        .next()
+        .ok_or(InvalidSignature::InvalidCredentialString)?
+        .to_string();
+    let key_id = parts
+        .next()
+        .ok_or(InvalidSignature::InvalidCredentialString)?
+        .parse::<u32>()
+        .map_err(|_| InvalidSignature::InvalidCredentialString)?;
+
+    if parts.next().is_some() {
+        return Err(InvalidSignature::InvalidCredentialString);
+    }
+
+    Ok(CredentialComponents {
+        key_id,
+        app_slug,
+        env_name,
+        date,
+    })
+}
+
+/// The request digest represents the request that we want to make
+/// and is the data we will sign.
+///
+/// It is a newline separated string of the following:
+///
+/// - The auth scheme being used.
+/// - Timestamp in RFC3339 format.
+/// - App slug and environment name.
+/// - The operation hash.
+fn build_request_digest(
+    timestamp: SystemTime,
+    credentials: &str,
+    operation: &OperationHash,
+) -> String {
+    let dt: DateTime<Utc> = timestamp.into();
+    let timestamp = dt.to_rfc3339_opts(SecondsFormat::Secs, true);
+    format!(
+        "{}\n{}\n{}\n{}",
+        AUTH_SCHEME,
+        timestamp,
+        credentials,
+        operation.as_hex(),
+    )
+}
+
+/// The signing key is a HMAC-SHA3-256 hash of the following, where each component is hashed in order,
+/// and the result of each hash is used as the key for the next hash:
+/// - Signature version.
+/// - The shared secret between the app and Encore.
+/// - The date in YYYYMMDD format.
+/// - The application slug.
+/// - The environment name.
+/// - The string "encore_request".
+fn derive_signing_key(
+    key_data: &[u8],
+    timestamp: SystemTime,
+    app_slug: &str,
+    env_name: &str,
+) -> hmac::digest::CtOutput<HmacSha3_256> {
+    let base_key = {
+        let mut bytes = BytesMut::with_capacity(SIGNATURE_VERSION.len() + key_data.len());
+        bytes.put_slice(SIGNATURE_VERSION.as_bytes());
+        bytes.put_slice(key_data);
+        bytes.to_vec()
+    };
+
+    let date_key = {
+        let dt: DateTime<Utc> = timestamp.into();
+        let timestamp = dt.format("%Y%m%d").to_string();
+        hash_hmac(&base_key, timestamp.as_bytes()).into_bytes()
+    };
+
+    let app_key = hash_hmac(&date_key, app_slug.as_bytes()).into_bytes();
+    let env_key = hash_hmac(&app_key, env_name.as_bytes()).into_bytes();
+
+    hash_hmac(&env_key, b"encore_request")
+}
+
+type HmacSha3_256 = Hmac<sha3::Sha3_256>;
+
+fn hash_hmac(key: &[u8], data: &[u8]) -> hmac::digest::CtOutput<HmacSha3_256> {
+    HmacSha3_256::new_from_slice(key)
+        .expect("hmac can accept keys of any size")
+        .chain_update(data)
+        .finalize()
+}
diff --git a/runtimes/core/src/api/reqauth/meta.rs b/runtimes/core/src/api/reqauth/meta.rs
new file mode 100644
index 0000000000..3cfd30bbfe
--- /dev/null
+++ b/runtimes/core/src/api/reqauth/meta.rs
@@ -0,0 +1,149 @@
+use std::str::{self, FromStr};
+
+use http::HeaderValue;
+
+pub trait HeaderValueExt {
+    fn to_utf8_str(&self) -> Result<&str, std::str::Utf8Error>;
+}
+
+impl HeaderValueExt for HeaderValue {
+    // Some header values may contain utf8 characters (e.g authdata) so we use `str::from_utf8`
+    // rather than using `HeaderValues::to_str` which errors on non-visible ASCII characters.
+    fn to_utf8_str(&self) -> Result<&str, std::str::Utf8Error> {
+        std::str::from_utf8(self.as_bytes())
+    }
+}
+
+#[derive(Debug, Copy, Clone, Hash, Eq, PartialEq)]
+pub enum MetaKey {
+    TraceParent,
+    TraceState,
+    XCorrelationId,
+    Version,
+    UserId,
+    UserData,
+    Caller,
+    Callee,
+    SvcAuthMethod,
+    SvcAuthEncoreAuthHash,
+    SvcAuthEncoreAuthDate,
+}
+
+impl MetaKey {
+    pub fn header_key(&self) -> &'static str {
+        use MetaKey::*;
+        match self {
+            TraceParent => "traceparent",
+            TraceState => "tracestate",
+            XCorrelationId => "x-correlation-id",
+            Version => "x-encore-meta-version",
+            UserId => "x-encore-meta-userid",
+            UserData => "x-encore-meta-authdata",
+            Caller => "x-encore-meta-caller",
+            Callee => "x-encore-meta-callee",
+            SvcAuthMethod => "x-encore-meta-svc-auth-method",
+            SvcAuthEncoreAuthHash => "x-encore-meta-svc-auth",
+            SvcAuthEncoreAuthDate => "x-encore-meta-date",
+        }
+    }
+}
+
+pub struct NotMetaKey;
+
+impl FromStr for MetaKey {
+    type Err = NotMetaKey;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        use MetaKey::*;
+        Ok(match value {
+            "traceparent" => TraceParent,
+            "tracestate" => TraceState,
+            "x-correlation-id" => XCorrelationId,
+            "x-encore-meta-version" => Version,
+            "x-encore-meta-userid" => UserId,
+            "x-encore-meta-authdata" => UserData,
+            "x-encore-meta-caller" => Caller,
+            "x-encore-meta-callee" => Callee,
+            "x-encore-meta-svc-auth-method" => SvcAuthMethod,
+            "x-encore-meta-svc-auth" => SvcAuthEncoreAuthHash,
+            "x-encore-meta-date" => SvcAuthEncoreAuthDate,
+            _ => return Err(NotMetaKey),
+        })
+    }
+}
+pub trait MetaMapMut: MetaMap {
+    fn set(&mut self, key: MetaKey, value: String) -> anyhow::Result<()>;
+}
+
+pub trait MetaMap {
+    fn get_meta(&self, key: MetaKey) -> Option<&str>;
+    fn meta_values<'a>(&'a self, key: MetaKey) -> Box<dyn Iterator<Item = &'a str> + 'a>;
+
+    /// Returns all meta keys, sorted alphabetically based on MetaKey::header_key.
+    fn sorted_meta_keys(&self) -> Vec<MetaKey>;
+}
+
+impl MetaMapMut for reqwest::header::HeaderMap {
+    fn set(&mut self, key: MetaKey, value: String) -> anyhow::Result<()> {
+        self.insert(key.header_key(), value.parse()?);
+        Ok(())
+    }
+}
+
+impl MetaMap for axum::http::HeaderMap {
+    fn get_meta(&self, key: MetaKey) -> Option<&str> {
+        self.get(key.header_key())
+            .and_then(|val| val.to_utf8_str().ok())
+    }
+
+    fn meta_values<'a>(&'a self, key: MetaKey) -> Box<dyn Iterator<Item = &'a str> + 'a> {
+        Box::new(
+            self.get_all(key.header_key())
+                .iter()
+                .filter_map(|v| v.to_utf8_str().ok()),
+        )
+    }
+
+    fn sorted_meta_keys(&self) -> Vec<MetaKey> {
+        let mut keys: Vec<_> = self
+            .keys()
+            .filter_map(|k| MetaKey::from_str(k.as_str()).ok())
+            .collect();
+        keys.sort_by_key(|k| k.header_key());
+        keys
+    }
+}
+
+impl MetaMapMut for pingora::http::RequestHeader {
+    fn set(&mut self, key: MetaKey, value: String) -> anyhow::Result<()> {
+        self.insert_header(key.header_key(), value)?;
+        Ok(())
+    }
+}
+
+impl MetaMap for pingora::http::RequestHeader {
+    fn get_meta(&self, key: MetaKey) -> Option<&str> {
+        self.headers
+            .get(key.header_key())
+            .and_then(|v| v.to_utf8_str().ok())
+    }
+
+    fn meta_values<'a>(&'a self, key: MetaKey) -> Box<dyn Iterator<Item = &'a str> + 'a> {
+        Box::new(
+            self.headers
+                .get_all(key.header_key())
+                .iter()
+                .filter_map(|v| v.to_utf8_str().ok()),
+        )
+    }
+
+    fn sorted_meta_keys(&self) -> Vec<MetaKey> {
+        let mut keys: Vec<_> = self
+            .headers
+            .keys()
+            .filter_map(|k| MetaKey::from_str(k.as_str()).ok())
+            .collect();
+        keys.sort_by_key(|k| k.header_key());
+        keys
+    }
+}
diff --git a/runtimes/core/src/api/reqauth/mod.rs b/runtimes/core/src/api/reqauth/mod.rs
new file mode 100644
index 0000000000..631657592c
--- /dev/null
+++ b/runtimes/core/src/api/reqauth/mod.rs
@@ -0,0 +1,311 @@
+use crate::api::jsonschema::DecodeConfig;
+use crate::api::reqauth::caller::Caller;
+use crate::api::reqauth::meta::MetaMap;
+use crate::api::APIResult;
+use crate::encore::runtime::v1 as pb;
+use crate::{api, model, secrets};
+use anyhow::Context;
+use std::collections::HashMap;
+use std::sync::Arc;
+use std::time::SystemTime;
+
+use super::{jsonschema, PValues};
+
+pub mod caller;
+mod encoreauth;
+pub mod meta;
+pub mod platform;
+pub mod svcauth;
+
+/// Computes the service auth method to use for communicating with a given service.
+pub fn service_auth_method(
+    secrets: &secrets::Manager,
+    env: &pb::Environment,
+    auth_method: pb::ServiceAuth,
+) -> anyhow::Result<Arc<dyn svcauth::ServiceAuthMethod>> {
+    let obj: Arc<dyn svcauth::ServiceAuthMethod> = match auth_method.auth_method {
+        None | Some(pb::service_auth::AuthMethod::Noop(_)) => Arc::new(svcauth::Noop),
+        Some(pb::service_auth::AuthMethod::EncoreAuth(ea)) => {
+            let auth_keys = ea
+                .auth_keys
+                .into_iter()
+                .filter_map(|k| {
+                    let data = k.data?;
+                    Some(svcauth::EncoreAuthKey {
+                        key_id: k.id,
+                        data: secrets.load(data),
+                    })
+                })
+                .collect::<Vec<_>>();
+
+            if auth_keys.is_empty() {
+                anyhow::bail!("no auth keys provided for encore-auth method");
+            }
+
+            Arc::new(svcauth::EncoreAuth::new(
+                env.app_slug.clone(),
+                env.env_name.clone(),
+                auth_keys,
+            ))
+        }
+    };
+    Ok(obj)
+}
+
+#[derive(Debug, Clone)]
+pub struct CallMeta {
+    /// The trace id to use. Equal to caller_trace_id if set, and generated otherwise.
+    pub trace_id: model::TraceId,
+
+    /// The trace id of the caller; None if not traced.
+    pub caller_trace_id: Option<model::TraceId>,
+
+    /// The span id of the caller (None if there's no parent).
+    pub parent_span_id: Option<model::SpanId>,
+
+    /// The span id of THIS request, if predefined by the caller (None in most cases).
+    pub this_span_id: Option<model::SpanId>,
+
+    /// The event id which started the API call (None if there's no parent).
+    pub parent_event_id: Option<model::TraceEventId>,
+
+    /// Correlation id to use.
+    pub ext_correlation_id: Option<String>,
+
+    /// Information about an internal call, if any.
+    /// If set it can be trusted as it has been authenticated.
+    pub internal: Option<InternalCallMeta>,
+}
+
+#[derive(Debug, Clone)]
+pub struct InternalCallMeta {
+    /// The source of the call.
+    pub caller: Caller,
+
+    /// The authenticated user id, if any.
+    pub auth_uid: Option<String>,
+
+    /// The user data, if any.
+    pub auth_data: Option<PValues>,
+}
+
+impl CallMeta {
+    pub fn parse_with_caller(
+        auth: &[Arc<dyn svcauth::ServiceAuthMethod>],
+        headers: &axum::http::HeaderMap,
+        auth_data_schemas: &HashMap<String, Option<jsonschema::JSONSchema>>,
+    ) -> APIResult<Self> {
+        Self::parse(headers, auth, true, Some(auth_data_schemas))
+    }
+
+    pub fn parse_without_caller(headers: &axum::http::HeaderMap) -> APIResult<Self> {
+        Self::parse(headers, &[], false, None)
+    }
+
+    fn parse(
+        headers: &axum::http::HeaderMap,
+        auth: &[Arc<dyn svcauth::ServiceAuthMethod>],
+        parse_caller: bool,
+        auth_data_schemas: Option<&HashMap<String, Option<jsonschema::JSONSchema>>>,
+    ) -> APIResult<Self> {
+        let do_parse = move || -> anyhow::Result<CallMeta> {
+            use meta::MetaKey;
+
+            if let Some(version) = headers.get_meta(MetaKey::Version) {
+                if version != "1" {
+                    anyhow::bail!("unknown encore meta version");
+                }
+            }
+
+            let mut meta = CallMeta {
+                trace_id: model::TraceId::generate(),
+                caller_trace_id: None,
+                parent_span_id: None,
+                this_span_id: None,
+                parent_event_id: None,
+                ext_correlation_id: None,
+                internal: None,
+            };
+
+            // If it was an internal call, parse it.
+            if parse_caller {
+                if let Some(caller) = headers.get_meta(MetaKey::Caller) {
+                    // Find the auth method.
+                    let auth_method = headers.get_meta(MetaKey::SvcAuthMethod);
+                    let Some(auth) = auth.iter().find(|a| auth_method == Some(a.name())) else {
+                        anyhow::bail!("unknown service auth method");
+                    };
+
+                    // Verify the caller's signature.
+                    auth.verify(headers, SystemTime::now())
+                        .context("invalid service authentication data")?;
+
+                    let caller = caller.parse().context("invalid meta caller")?;
+
+                    // TODO: Currently we assume a single auth data schema.
+                    // When we support multiple gateways with distinct schemas we'll need to change this.
+                    let auth_data_schema = auth_data_schemas
+                        .and_then(|s| s.values().filter_map(|s| s.as_ref()).next());
+
+                    // Parse the auth data, if provided.
+                    let auth_data = match (headers.get_meta(MetaKey::UserData), &auth_data_schema) {
+                        (None, _) => None,
+                        (Some(data), None) => {
+                            // Hack: temporarily work around the absence of a schema in certain situations.
+                            let any_schema = {
+                                use crate::encore::parser::meta::v1 as meta;
+                                let md = meta::Data::default();
+                                let mut builder = jsonschema::Builder::new(&md);
+                                let idx = builder.register_value(jsonschema::Value::Basic(
+                                    jsonschema::Basic::Any,
+                                ));
+                                let registry = builder.build();
+                                registry.schema(idx)
+                            };
+                            let mut jsonde = serde_json::Deserializer::from_str(data);
+                            let data = any_schema
+                                .deserialize(&mut jsonde, DecodeConfig::default())
+                                .context("invalid auth data")?;
+                            Some(data)
+                        }
+                        (Some(data), Some(schema)) => {
+                            let mut jsonde = serde_json::Deserializer::from_str(data);
+                            let data = schema
+                                .deserialize(&mut jsonde, DecodeConfig::default())
+                                .context("invalid auth data")?;
+                            Some(data)
+                        }
+                    };
+
+                    meta.internal = Some(InternalCallMeta {
+                        caller,
+                        auth_uid: headers.get_meta(MetaKey::UserId).map(|s| s.to_string()),
+                        auth_data,
+                    });
+                };
+            }
+
+            // For now we only read the traceparent for internal-to-internal calls, this is because CloudRun
+            // is adding a traceparent header to all requests, which is causing our trace system to get confused
+            // and think that the initial request is a child of another already traced request
+            //
+            // In the future we should be able to remove this check and read the traceparent header for all requests
+            // to interopt with other tracing systems.
+            if let Some(traceparent) = headers.get_meta(MetaKey::TraceParent) {
+                // Parse the traceparent.
+                if let Ok((trace_id, parent_span_id)) = parse_traceparent(traceparent) {
+                    meta.trace_id = trace_id;
+                    meta.caller_trace_id = Some(trace_id);
+                    meta.parent_span_id = Some(parent_span_id);
+                };
+
+                // If the caller is a gateway, ignore the parent span id as gateways don't currently record a span.
+                // If we include it the root request won't be tagged as such.
+                if let Some(internal) = &meta.internal {
+                    if matches!(internal.caller, Caller::Gateway { .. }) {
+                        meta.parent_span_id = None;
+                    }
+                }
+
+                // Parse the trace state.
+                if let (Some(event_id), parent_span) =
+                    parse_tracestate(headers.meta_values(MetaKey::TraceState))
+                {
+                    meta.parent_event_id = Some(event_id);
+                    // If we where given a parent span ID, use that instead of the one from the traceparent header
+                    // This is because GCP Cloud Run will add it's own spans in before the application code is run
+                    // and thus we lose the parent span ID from the traceparent header
+                    if let Some(parent_span) = parent_span {
+                        meta.parent_span_id = Some(parent_span);
+                    }
+                }
+            }
+
+            meta.ext_correlation_id = headers.get_meta(MetaKey::XCorrelationId).map(|s| {
+                // Limit the maximum length the correlation id can have.
+                s[..s.len().min(64)].to_string()
+            });
+
+            Ok(meta)
+        };
+
+        do_parse().map_err(|e| api::Error::invalid_argument("unable to parse request", e))
+    }
+}
+
+fn parse_traceparent(s: &str) -> anyhow::Result<(model::TraceId, model::SpanId)> {
+    let version = "00";
+    let trace_id_len = 32;
+    let span_id_len = 16;
+    let trace_flags_len = 2;
+
+    let ver_start = 0;
+    let ver_end = ver_start + version.len();
+    let ver_sep = ver_end;
+
+    let trace_id_start = ver_sep + 1;
+    let trace_id_end = trace_id_start + trace_id_len;
+    let trace_id_sep = trace_id_end;
+
+    let span_id_start = trace_id_sep + 1;
+    let span_id_end = span_id_start + span_id_len;
+    let span_id_sep = span_id_end;
+
+    let trace_flags_start = span_id_sep + 1;
+    let trace_flags_end = trace_flags_start + trace_flags_len;
+    let total_len = trace_flags_end;
+
+    if s.len() != total_len {
+        anyhow::bail!("invalid traceparent length");
+    } else if &s[ver_start..ver_end] != version {
+        anyhow::bail!("invalid traceparent version");
+    } else if &s[ver_sep..ver_sep + 1] != "-" {
+        anyhow::bail!("invalid traceparent version separator");
+    } else if &s[trace_id_sep..trace_id_sep + 1] != "-" {
+        anyhow::bail!("invalid traceparent trace id separator");
+    } else if &s[span_id_sep..span_id_sep + 1] != "-" {
+        anyhow::bail!("invalid traceparent span id separator");
+    }
+
+    let trace_id = &s[trace_id_start..trace_id_end];
+    let trace_id = model::TraceId::parse_std(trace_id).context("invalid trace id")?;
+
+    let span_id = &s[span_id_start..span_id_end];
+    let span_id = model::SpanId::parse_std(span_id).context("invalid span id")?;
+
+    Ok((trace_id, span_id))
+}
+
+fn parse_tracestate<'a>(
+    vals: impl Iterator<Item = &'a str>,
+) -> (Option<model::TraceEventId>, Option<model::SpanId>) {
+    enum Data {
+        EventId(model::TraceEventId),
+        SpanId(model::SpanId),
+    }
+
+    let parse_entry = |val: &str| -> Option<Data> {
+        let (key, val) = val.split_once('=')?;
+
+        match key {
+            "encore/event-id" => Some(Data::EventId(val.parse().ok()?)),
+            "encore/span-id" => Some(Data::SpanId(model::SpanId::parse_std(val).ok()?)),
+            _ => None,
+        }
+    };
+
+    let mut event_id = None;
+    let mut span_id = None;
+
+    for val in vals {
+        for field in val.split(',') {
+            match parse_entry(field) {
+                Some(Data::EventId(id)) => event_id = Some(id),
+                Some(Data::SpanId(id)) => span_id = Some(id),
+                None => (),
+            }
+        }
+    }
+
+    (event_id, span_id)
+}
diff --git a/runtimes/core/src/api/reqauth/platform.rs b/runtimes/core/src/api/reqauth/platform.rs
new file mode 100644
index 0000000000..d895ae7130
--- /dev/null
+++ b/runtimes/core/src/api/reqauth/platform.rs
@@ -0,0 +1,181 @@
+use crate::{encore, secrets};
+use anyhow::Context;
+use base64::engine::general_purpose;
+use base64::Engine;
+use encore::runtime::v1 as pb;
+use hmac::Mac;
+use percent_encoding::percent_decode_str;
+use std::fmt::Display;
+use std::time::SystemTime;
+
+pub struct RequestValidator {
+    keys: Box<[SigningKey]>,
+}
+
+impl std::fmt::Debug for RequestValidator {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("RequestValidator").finish()
+    }
+}
+
+pub struct ValidationData<'a> {
+    pub request_path: &'a str,
+    pub date_header: &'a str,
+    pub x_encore_auth_header: &'a str,
+}
+
+/// A seal of approval is a record that the request originated from the Encore Platform.
+#[derive(Debug)]
+pub struct SealOfApproval;
+
+impl RequestValidator {
+    pub fn new(secrets: &secrets::Manager, keys: Vec<pb::EncoreAuthKey>) -> Self {
+        let keys = keys
+            .into_iter()
+            .filter_map(|k| match k.data {
+                Some(data) => Some(SigningKey {
+                    id: k.id,
+                    data: secrets.load(data),
+                }),
+                None => None,
+            })
+            .collect();
+        Self { keys }
+    }
+
+    #[cfg(test)]
+    pub fn new_mock() -> Self {
+        use crate::secrets::Secret;
+
+        Self {
+            keys: [SigningKey {
+                id: 123,
+                data: Secret::new_for_test("secret data"),
+            }]
+            .into(),
+        }
+    }
+
+    pub fn validate_platform_request(
+        &self,
+        req: &ValidationData,
+    ) -> Result<SealOfApproval, ValidationError> {
+        let decoded_auth_header = BASE64
+            .decode(req.x_encore_auth_header.as_bytes())
+            .map_err(|_| ValidationError::InvalidMac)?;
+
+        // Pull out key ID from hmac prefix
+        const KEY_ID_LEN: usize = 4;
+        if decoded_auth_header.len() < KEY_ID_LEN {
+            return Err(ValidationError::InvalidMac);
+        }
+
+        let key_id = u32::from_be_bytes(decoded_auth_header[..KEY_ID_LEN].try_into().unwrap());
+        let received_mac = &decoded_auth_header[KEY_ID_LEN..];
+        for k in self.keys.iter() {
+            if k.id == key_id {
+                let secret_data = k.data.get().map_err(ValidationError::SecretResolve)?;
+                return check_auth_key(secret_data, req, received_mac);
+            }
+        }
+
+        Err(ValidationError::UnknownMacKey)
+    }
+
+    pub fn sign_outgoing_request(&self, req: &mut reqwest::Request) -> anyhow::Result<()> {
+        let path = percent_decode_str(req.url().path())
+            .decode_utf8_lossy()
+            .to_string();
+
+        let date_str = req
+            .headers_mut()
+            .entry(reqwest::header::DATE)
+            .or_insert_with(|| {
+                let date_str = httpdate::fmt_http_date(SystemTime::now());
+                date_str.parse().unwrap()
+            });
+
+        let key = &self.keys[0];
+        let key_data = key.data.get().context("unable to resolve signing key")?;
+        let mut mac = hmac::Hmac::<sha2::Sha256>::new_from_slice(key_data).unwrap();
+        mac.update(date_str.as_bytes());
+        mac.update(b"\x00");
+        mac.update(path.as_bytes());
+
+        let mac_bytes = mac.finalize().into_bytes();
+        let combined = [key.id.to_be_bytes().as_slice(), mac_bytes.as_slice()].concat();
+        let auth_header = BASE64.encode(combined);
+        req.headers_mut().insert(
+            reqwest::header::HeaderName::from_static("x-encore-auth"),
+            reqwest::header::HeaderValue::from_str(&auth_header).context("invalid auth header")?,
+        );
+        Ok(())
+    }
+}
+
+struct SigningKey {
+    id: u32,
+    data: secrets::Secret,
+}
+
+const BASE64: general_purpose::GeneralPurpose = general_purpose::STANDARD_NO_PAD;
+
+fn check_auth_key(
+    decryption_key: &[u8],
+    req: &ValidationData,
+    received_mac: &[u8],
+) -> Result<SealOfApproval, ValidationError> {
+    let request_date = httpdate::parse_http_date(req.date_header)
+        .map_err(|_| ValidationError::InvalidDateHeader)?;
+
+    let now = SystemTime::now();
+    let diff = now
+        .duration_since(request_date)
+        .unwrap_or_else(|e| e.duration());
+
+    const THRESHOLD: u64 = 15 * 60;
+    if diff.as_secs() > THRESHOLD {
+        return Err(ValidationError::TimeSkew);
+    }
+
+    // Compute the MAC.
+    type HmacSha256 = hmac::Hmac<sha2::Sha256>;
+    let mut computed_mac =
+        HmacSha256::new_from_slice(decryption_key).map_err(|_| ValidationError::InvalidMacKey)?;
+    computed_mac.update(req.date_header.as_bytes());
+    computed_mac.update(b"\x00");
+    computed_mac.update(req.request_path.as_bytes());
+
+    computed_mac
+        .verify_slice(received_mac)
+        .map_err(|_| ValidationError::InvalidMac)?;
+
+    Ok(SealOfApproval)
+}
+
+#[derive(Debug)]
+pub enum ValidationError {
+    InvalidMac,
+    UnknownMacKey,
+    InvalidMacKey,
+    InvalidDateHeader,
+    TimeSkew,
+    SecretResolve(secrets::ResolveError),
+}
+
+impl Display for ValidationError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ValidationError::InvalidMac => write!(f, "invalid mac"),
+            ValidationError::UnknownMacKey => write!(f, "unknown mac key"),
+            ValidationError::InvalidMacKey => write!(f, "invalid mac key"),
+            ValidationError::InvalidDateHeader => write!(f, "invalid or missing date header"),
+            ValidationError::TimeSkew => write!(f, "time skew"),
+            ValidationError::SecretResolve(e) => {
+                write!(f, "resolve secret: {e}")
+            }
+        }
+    }
+}
+
+impl std::error::Error for ValidationError {}
diff --git a/runtimes/core/src/api/reqauth/svcauth.rs b/runtimes/core/src/api/reqauth/svcauth.rs
new file mode 100644
index 0000000000..e0510b6e67
--- /dev/null
+++ b/runtimes/core/src/api/reqauth/svcauth.rs
@@ -0,0 +1,300 @@
+use std::fmt::{Debug, Display};
+use std::time::SystemTime;
+
+use anyhow::Context;
+use sha3::digest::Digest;
+use subtle::ConstantTimeEq;
+
+use crate::api::reqauth::encoreauth;
+use crate::api::reqauth::encoreauth::{OperationHash, SignatureComponents};
+use crate::api::reqauth::meta::{MetaKey, MetaMapMut};
+use crate::secrets;
+use crate::secrets::Secret;
+
+use super::meta::MetaMap;
+
+pub trait ServiceAuthMethod: Debug + Send + Sync + 'static {
+    fn name(&self) -> &'static str;
+    fn sign(&self, headers: &mut dyn MetaMapMut, now: SystemTime) -> anyhow::Result<()>;
+    fn verify(&self, headers: &dyn MetaMap, now: SystemTime) -> Result<(), VerifyError>;
+}
+
+#[derive(Debug)]
+pub struct Noop;
+
+impl ServiceAuthMethod for Noop {
+    fn name(&self) -> &'static str {
+        "noop"
+    }
+
+    fn sign(&self, _headers: &mut dyn MetaMapMut, _now: SystemTime) -> anyhow::Result<()> {
+        Ok(())
+    }
+
+    fn verify(&self, _headers: &dyn MetaMap, _now: SystemTime) -> Result<(), VerifyError> {
+        Ok(())
+    }
+}
+
+pub struct EncoreAuthKey {
+    pub key_id: u32,
+    pub data: Secret,
+}
+
+pub struct EncoreAuth {
+    app_slug: String,
+    env_name: String,
+    keys: Vec<EncoreAuthKey>,
+    latest_idx: usize, // index into keys
+}
+
+impl Debug for EncoreAuth {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("EncoreAuth")
+            .field("app_slug", &self.app_slug)
+            .field("env_name", &self.env_name)
+            .finish()
+    }
+}
+
+impl EncoreAuth {
+    pub fn new(app_slug: String, env_name: String, keys: Vec<EncoreAuthKey>) -> Self {
+        if keys.is_empty() {
+            panic!("auth keys must not be empty");
+        }
+
+        let latest_idx = {
+            let mut max_id = keys[0].key_id;
+            let mut max_idx = 0;
+            for (idx, k) in keys.iter().enumerate() {
+                if k.key_id > max_id {
+                    max_idx = idx;
+                    max_id = k.key_id;
+                }
+            }
+            max_idx
+        };
+
+        Self {
+            app_slug,
+            env_name,
+            keys,
+            latest_idx,
+        }
+    }
+}
+
+#[derive(Debug)]
+pub enum VerifyError {
+    NoAuthorizationHeader,
+    NoDateHeader,
+    InvalidHeader(encoreauth::InvalidSignature),
+    SignatureMismatch,
+    DateSkew,
+    UnknownKey,
+    ResolveKeyData(secrets::ResolveError),
+}
+
+impl Display for VerifyError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        use VerifyError::*;
+        match self {
+            NoAuthorizationHeader => write!(f, "no authorization header"),
+            NoDateHeader => write!(f, "no date header"),
+            InvalidHeader(e) => write!(f, "invalid header: {e}"),
+            SignatureMismatch => write!(f, "signature mismatch"),
+            DateSkew => write!(f, "date skew"),
+            UnknownKey => write!(f, "unknown key"),
+            ResolveKeyData(e) => write!(f, "unable to resolve secret key data: {e}"),
+        }
+    }
+}
+
+impl std::error::Error for VerifyError {}
+
+impl ServiceAuthMethod for EncoreAuth {
+    fn name(&self) -> &'static str {
+        "encore-auth"
+    }
+
+    fn sign(&self, headers: &mut dyn MetaMapMut, now: SystemTime) -> anyhow::Result<()> {
+        let op_hash = self.build_op_hash(headers);
+
+        let key = &self.keys[self.latest_idx];
+        let key_data = key.data.get().context("unable to resolve auth key data")?;
+
+        let hash = encoreauth::sign(
+            (key.key_id, key_data),
+            &self.app_slug,
+            &self.env_name,
+            now,
+            &op_hash,
+        );
+
+        headers
+            .set(MetaKey::SvcAuthEncoreAuthHash, hash)
+            .context("set auth hash header")?;
+        headers
+            .set(MetaKey::SvcAuthEncoreAuthDate, httpdate::fmt_http_date(now))
+            .context("set auth date header")?;
+
+        Ok(())
+    }
+
+    fn verify(&self, headers: &dyn MetaMap, now: SystemTime) -> Result<(), VerifyError> {
+        let auth_header = headers
+            .get_meta(MetaKey::SvcAuthEncoreAuthHash)
+            .ok_or(VerifyError::NoAuthorizationHeader)?;
+        let date_header = headers
+            .get_meta(MetaKey::SvcAuthEncoreAuthDate)
+            .ok_or(VerifyError::NoDateHeader)?;
+
+        let components = SignatureComponents::parse(auth_header, date_header)
+            .map_err(VerifyError::InvalidHeader)?;
+
+        let diff = now
+            .duration_since(components.timestamp)
+            .unwrap_or_else(|e| e.duration());
+        if diff.as_secs() > 120 {
+            return Err(VerifyError::DateSkew);
+        }
+
+        let key = self
+            .keys
+            .iter()
+            .find(|k| k.key_id == components.key_id)
+            .ok_or(VerifyError::UnknownKey)?;
+
+        let key_data = key.data.get().map_err(VerifyError::ResolveKeyData)?;
+        let expected_signature = encoreauth::sign_for_verification(
+            (key.key_id, key_data),
+            &components.app_slug,
+            &components.env_name,
+            components.timestamp,
+            &components.operation_hash,
+        );
+
+        let signature_match: bool = expected_signature
+            .as_bytes()
+            .ct_eq(auth_header.as_bytes())
+            .into();
+        if !signature_match {
+            return Err(VerifyError::SignatureMismatch);
+        }
+
+        let expected_op_hash = self.build_op_hash(headers);
+        if !expected_op_hash.ct_eq(&components.operation_hash) {
+            return Err(VerifyError::SignatureMismatch);
+        }
+
+        Ok(())
+    }
+}
+
+impl EncoreAuth {
+    fn build_op_hash<R: MetaMap + ?Sized>(&self, req: &R) -> OperationHash {
+        // Build a deterministic hash of the meta keys and values.
+        let mut hash = <sha3::Sha3_256 as Digest>::new();
+        for key in req.sorted_meta_keys() {
+            use MetaKey::*;
+            match key {
+                SvcAuthMethod | SvcAuthEncoreAuthHash | SvcAuthEncoreAuthDate => {
+                    // Skip these headers, as they are part of the auth mechanism itself.
+                }
+
+                TraceParent | TraceState => {
+                    // Skip these headers, as they are part of the tracing mechanism and could be changed
+                    // by things like load balancers.
+                }
+
+                XCorrelationId | Version | UserId | UserData | Caller | Callee => {
+                    // Read all values for this key, and sort them.
+                    let mut values = req.meta_values(key).collect::<Vec<_>>();
+                    values.sort();
+
+                    for value in values {
+                        hash.update(key.header_key());
+                        hash.update(b"=");
+                        hash.update(value.as_bytes());
+                        hash.update(b"\n");
+                    }
+                }
+            }
+        }
+
+        let payload = hash.finalize();
+        OperationHash::new(
+            "internal-api".as_bytes(),
+            "call".as_bytes(),
+            Some(payload.as_slice()),
+            std::iter::empty(),
+        )
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::api::reqauth::meta::MetaMap;
+
+    use super::*;
+
+    fn metas<R: MetaMap>(req: &R) -> Vec<(MetaKey, Vec<String>)> {
+        let keys = req.sorted_meta_keys();
+        keys.into_iter()
+            .map(|k| {
+                (
+                    k,
+                    req.meta_values(k)
+                        .map(|s| s.to_string())
+                        .collect::<Vec<_>>(),
+                )
+            })
+            .collect()
+    }
+
+    fn convert_header_map(src: reqwest::header::HeaderMap) -> axum::http::HeaderMap {
+        let mut dst = axum::http::HeaderMap::new();
+        for entry in src.iter() {
+            let key: axum::http::HeaderName = entry.0.as_str().parse().unwrap();
+            let value = entry.1.to_str().unwrap().parse().unwrap();
+            dst.insert(key, value);
+        }
+        dst
+    }
+
+    #[test]
+    fn test_encore_auth() -> anyhow::Result<()> {
+        let mut headers = reqwest::header::HeaderMap::new();
+
+        let auth = EncoreAuth {
+            app_slug: "app".into(),
+            env_name: "env".into(),
+            keys: vec![EncoreAuthKey {
+                key_id: 123,
+                data: Secret::new_for_test("secret data"),
+            }],
+            latest_idx: 0,
+        };
+
+        let now = SystemTime::UNIX_EPOCH + std::time::Duration::from_secs(1234567890);
+        auth.sign(&mut headers, now)
+            .context("unable to sign request")?;
+
+        let out_headers = convert_header_map(headers);
+        auth.verify(&out_headers, now)
+            .context("unable to verify request")?;
+
+        assert_eq!(
+            metas(&out_headers),
+            vec![
+                (
+                    MetaKey::SvcAuthEncoreAuthDate,
+                    vec!["Fri, 13 Feb 2009 23:31:30 GMT".to_string()]
+                ),
+                (MetaKey::SvcAuthEncoreAuthHash, vec![r#"ENCORE1-HMAC-SHA3-256 cred="20090213/app/env/123", op=f3c70a419394ce9d56efafad2208154b92c8596d7396b3a2b4ea7fd925d28dc2, sig=fc0c88b47c13d999353ecc8681d91d9c03209a1f05583b92d84e429fedfe387a"#.to_string()]),
+            ]
+        );
+
+        Ok(())
+    }
+}
diff --git a/runtimes/core/src/api/schema/body.rs b/runtimes/core/src/api/schema/body.rs
new file mode 100644
index 0000000000..13fa4516cb
--- /dev/null
+++ b/runtimes/core/src/api/schema/body.rs
@@ -0,0 +1,118 @@
+use axum::http::HeaderValue;
+use bytes::Bytes;
+
+use crate::api::jsonschema::DecodeConfig;
+use crate::api::schema::{JSONPayload, ToOutgoingRequest};
+use crate::api::{self, PValues};
+use crate::api::{jsonschema, APIResult};
+use http_body_util::BodyExt;
+use reqwest::header::CONTENT_TYPE;
+
+#[derive(Debug, Clone)]
+pub struct Body {
+    schema: jsonschema::JSONSchema,
+}
+
+impl Body {
+    pub fn new(schema: jsonschema::JSONSchema) -> Self {
+        Self { schema }
+    }
+
+    pub async fn parse_incoming_request_body(
+        &self,
+        body: axum::body::Body,
+    ) -> APIResult<Option<PValues>> {
+        // Collect the bytes of the request body.
+        // Serde doesn't support async streaming reads (at least not yet).
+        let bytes = body
+            .collect()
+            .await
+            .map_err(|e| api::Error::invalid_argument("unable to read request body", e))?
+            .to_bytes();
+
+        let mut jsonde = serde_json::Deserializer::from_slice(&bytes);
+        let cfg = DecodeConfig {
+            coerce_strings: false,
+            arrays_as_repeated_fields: false,
+        };
+        let value = self
+            .schema
+            .deserialize(&mut jsonde, cfg)
+            .map_err(|e| api::Error::invalid_argument("unable to decode request body", e))?;
+        Ok(Some(value))
+    }
+
+    pub async fn parse_response_body(&self, body: Bytes) -> APIResult<Option<PValues>> {
+        let mut jsonde = serde_json::Deserializer::from_slice(&body);
+        let cfg = DecodeConfig {
+            coerce_strings: false,
+            arrays_as_repeated_fields: false,
+        };
+        let value = self
+            .schema
+            .deserialize(&mut jsonde, cfg)
+            .map_err(|e| api::Error::invalid_argument("unable to decode response body", e))?;
+        Ok(Some(value))
+    }
+}
+
+impl ToOutgoingRequest<reqwest::Request> for Body {
+    fn to_outgoing_request(
+        &self,
+        payload: &mut JSONPayload,
+        req: &mut reqwest::Request,
+    ) -> APIResult<()> {
+        if payload.is_none() {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "missing body payload".to_string(),
+                internal_message: None,
+                stack: None,
+                details: None,
+            });
+        };
+
+        let body = self.schema.to_vec(payload).map_err(api::Error::internal)?;
+        if !req.headers().contains_key(CONTENT_TYPE) {
+            req.headers_mut().insert(
+                CONTENT_TYPE,
+                reqwest::header::HeaderValue::from_static("application/json"),
+            );
+        }
+        *req.body_mut() = Some(body.into());
+        Ok(())
+    }
+}
+
+impl Body {
+    pub fn to_outgoing_payload(&self, payload: &JSONPayload) -> APIResult<Vec<u8>> {
+        if payload.is_none() {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "missing body payload".to_string(),
+                internal_message: None,
+                stack: None,
+                details: None,
+            });
+        };
+
+        let body = self.schema.to_vec(payload).map_err(api::Error::internal)?;
+        Ok(body)
+    }
+    pub fn to_response(
+        &self,
+        payload: &JSONPayload,
+        resp: axum::http::response::Builder,
+    ) -> APIResult<axum::http::Response<axum::body::Body>> {
+        let buf = self.schema.to_vec(payload).map_err(api::Error::internal)?;
+        let resp = resp
+            .header(
+                axum::http::header::CONTENT_TYPE,
+                HeaderValue::from_static(mime::APPLICATION_JSON.as_ref()),
+            )
+            .body(axum::body::Body::from(buf))
+            .map_err(api::Error::internal)?;
+
+        Ok(resp)
+    }
+}
diff --git a/runtimes/core/src/api/schema/cookie.rs b/runtimes/core/src/api/schema/cookie.rs
new file mode 100644
index 0000000000..c1fc46019f
--- /dev/null
+++ b/runtimes/core/src/api/schema/cookie.rs
@@ -0,0 +1,193 @@
+use http::{
+    header::{COOKIE, SET_COOKIE},
+    HeaderValue,
+};
+
+use crate::api::{self, jsonschema, schema::ToResponse, APIResult, PValue, PValues};
+
+use super::{HTTPHeaders, JSONPayload, ToHeaderStr, ToOutgoingRequest};
+
+#[derive(Debug, Clone)]
+pub struct Cookie {
+    schema: jsonschema::JSONSchema,
+}
+
+impl Cookie {
+    pub fn new(schema: jsonschema::JSONSchema) -> Self {
+        Self { schema }
+    }
+
+    pub fn contains_any(&self, headers: &impl HTTPHeaders) -> bool {
+        let mut jar = cookie::CookieJar::new();
+        for raw in headers.get_all(axum::http::header::COOKIE.as_str()) {
+            if let Ok(raw) = raw.to_str() {
+                for c in cookie::Cookie::split_parse(raw).flatten() {
+                    jar.add_original(c.into_owned());
+                }
+            }
+        }
+
+        for (name, field) in self.schema.root().fields.iter() {
+            let cookie_name = field.name_override.as_deref().unwrap_or(name.as_str());
+
+            if let Some(c) = jar.get(cookie_name) {
+                // Only consider non-empty values to be present.
+                if !c.value().is_empty() {
+                    return true;
+                }
+            }
+        }
+        false
+    }
+
+    pub fn fields(&self) -> impl Iterator<Item = (&String, &jsonschema::Field)> {
+        self.schema.root().fields.iter()
+    }
+
+    pub fn parse_incoming_request_parts(
+        &self,
+        req: &axum::http::request::Parts,
+    ) -> APIResult<Option<PValues>> {
+        self.parse_req(&req.headers)
+    }
+
+    pub fn parse_req(&self, headers: &axum::http::HeaderMap) -> APIResult<Option<PValues>> {
+        if self.schema.root().is_empty() {
+            return Ok(None);
+        }
+
+        let mut jar = cookie::CookieJar::new();
+        headers
+            .get_all(COOKIE)
+            .iter()
+            .filter_map(|raw| raw.to_str().ok())
+            .flat_map(cookie::Cookie::split_parse)
+            .flatten()
+            .for_each(|c| jar.add_original(c.into_owned()));
+
+        match self.schema.parse(jar) {
+            Ok(decoded) => Ok(Some(decoded)),
+            Err(err) => Err(err),
+        }
+    }
+
+    pub fn parse_resp(&self, headers: &axum::http::HeaderMap) -> APIResult<Option<PValues>> {
+        if self.schema.root().is_empty() {
+            return Ok(None);
+        }
+
+        let mut jar = cookie::CookieJar::new();
+        headers
+            .get_all(SET_COOKIE)
+            .iter()
+            .filter_map(|raw| raw.to_str().ok())
+            .flat_map(cookie::Cookie::parse)
+            .for_each(|c| jar.add_original(c.into_owned()));
+
+        match self.schema.parse(jar) {
+            Ok(decoded) => Ok(Some(decoded)),
+            Err(err) => Err(err),
+        }
+    }
+}
+
+impl ToOutgoingRequest<http::HeaderMap> for Cookie {
+    fn to_outgoing_request(
+        &self,
+        payload: &mut JSONPayload,
+        headers: &mut http::HeaderMap,
+    ) -> APIResult<()> {
+        if self.schema.root().is_empty() {
+            return Ok(());
+        }
+
+        let Some(payload) = payload else {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "missing cookie parameters".to_string(),
+                internal_message: Some("missing cookie parameters".to_string()),
+                stack: None,
+                details: None,
+            });
+        };
+
+        for (key, field) in self.schema.root().fields.iter() {
+            let Some(PValue::Cookie(c)) = payload.get(key) else {
+                if field.optional {
+                    continue;
+                }
+                return Err(api::Error {
+                    code: api::ErrCode::InvalidArgument,
+                    message: format!("missing cookie parameter: {key}"),
+                    internal_message: Some(format!("missing cookie parameter: {key}")),
+                    stack: None,
+                    details: None,
+                });
+            };
+
+            let header_value =
+                HeaderValue::from_str(&c.to_string()).map_err(api::Error::internal)?;
+
+            headers.append(http::header::COOKIE, header_value);
+        }
+
+        Ok(())
+    }
+}
+
+impl ToOutgoingRequest<reqwest::Request> for Cookie {
+    fn to_outgoing_request(
+        &self,
+        payload: &mut JSONPayload,
+        req: &mut reqwest::Request,
+    ) -> APIResult<()> {
+        let headers = req.headers_mut();
+        self.to_outgoing_request(payload, headers)
+    }
+}
+
+impl<B> ToOutgoingRequest<http::Request<B>> for Cookie {
+    fn to_outgoing_request(
+        &self,
+        payload: &mut JSONPayload,
+        req: &mut http::Request<B>,
+    ) -> APIResult<()> {
+        let headers = req.headers_mut();
+        self.to_outgoing_request(payload, headers)
+    }
+}
+
+impl ToResponse for Cookie {
+    fn to_response(
+        &self,
+        payload: &super::JSONPayload,
+        mut resp: axum::http::response::Builder,
+    ) -> APIResult<axum::http::response::Builder> {
+        if self.schema.root().is_empty() {
+            return Ok(resp);
+        }
+
+        let Some(payload) = payload else {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "missing cookie parameters".to_string(),
+                internal_message: Some("missing cookie parameters".to_string()),
+                stack: None,
+                details: None,
+            });
+        };
+
+        let schema = self.schema.root();
+        for (key, value) in payload.iter() {
+            let key = key.as_str();
+            if !schema.fields.contains_key(key) {
+                continue;
+            };
+            let PValue::Cookie(c) = value else {
+                continue;
+            };
+            resp = resp.header(SET_COOKIE, c.to_string());
+        }
+        Ok(resp)
+    }
+}
diff --git a/runtimes/core/src/api/schema/encoding.rs b/runtimes/core/src/api/schema/encoding.rs
new file mode 100644
index 0000000000..82c22e2ff4
--- /dev/null
+++ b/runtimes/core/src/api/schema/encoding.rs
@@ -0,0 +1,623 @@
+use crate::api::jsonschema;
+use crate::api::schema::{Body, Cookie, Header, HttpStatus, Method, Path, Query};
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::parser::meta::v1::path_segment::SegmentType;
+use crate::encore::parser::schema::v1 as schema;
+use crate::encore::parser::schema::v1::r#type::Typ;
+use anyhow::Context;
+use std::borrow::Cow;
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+
+#[derive(Debug, Clone, Copy, PartialOrd, Ord, PartialEq, Eq, Hash)]
+pub enum DefaultLoc {
+    Body,
+    Query,
+}
+
+impl DefaultLoc {
+    pub fn into_wire_loc(self) -> WireLoc {
+        match self {
+            DefaultLoc::Body => WireLoc::Body,
+            DefaultLoc::Query => WireLoc::Query,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialOrd, Ord, PartialEq, Eq, Hash)]
+pub enum WireLoc {
+    Body,
+    Query,
+    Header(String),
+    Path,
+    Cookie(String),
+}
+
+pub struct EncodingConfig<'a, 'b> {
+    pub meta: &'a meta::Data,
+    pub registry_builder: &'a mut jsonschema::Builder<'b>,
+    pub default_loc: Option<DefaultLoc>,
+    pub rpc_path: Option<&'a meta::Path>,
+    pub supports_body: bool,
+    pub supports_query: bool,
+    pub supports_header: bool,
+    pub supports_path: bool,
+    pub supports_http_status: bool,
+}
+
+#[derive(Debug)]
+pub struct SchemaUnderConstruction {
+    combined: Option<usize>,
+    body: Option<usize>,
+    query: Option<usize>,
+    header: Option<usize>,
+    cookie: Option<usize>,
+    http_status: Option<HttpStatus>,
+    rpc_path: Option<meta::Path>,
+}
+
+impl SchemaUnderConstruction {
+    pub fn build(self, reg: &Arc<jsonschema::Registry>) -> anyhow::Result<Schema> {
+        Ok(Schema {
+            combined: self.combined.map(|v| reg.schema(v)),
+            body: self.body.map(|v| Body::new(reg.schema(v))),
+            query: self.query.map(|v| Query::new(reg.schema(v))),
+            header: self.header.map(|v| Header::new(reg.schema(v))),
+            cookie: self.cookie.map(|v| Cookie::new(reg.schema(v))),
+            http_status: self.http_status,
+            path: self.rpc_path.as_ref().map(Path::from_meta).transpose()?,
+        })
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct Schema {
+    pub combined: Option<jsonschema::JSONSchema>,
+    pub query: Option<Query>,
+    pub header: Option<Header>,
+    pub body: Option<Body>,
+    pub path: Option<Path>,
+    pub cookie: Option<Cookie>,
+    pub http_status: Option<HttpStatus>,
+}
+
+impl EncodingConfig<'_, '_> {
+    pub fn compute(&mut self, typ: &schema::Type) -> anyhow::Result<SchemaUnderConstruction> {
+        let typ = typ.typ.as_ref().context("type without type")?;
+        let typ = resolve_type(self.meta, typ)?;
+
+        let Typ::Struct(st) = typ.as_ref() else {
+            return Ok(SchemaUnderConstruction {
+                combined: None,
+                body: None,
+                query: None,
+                header: None,
+                cookie: None,
+                http_status: None,
+                rpc_path: self.rpc_path.cloned(),
+            });
+        };
+
+        // Determine which fields belong to the path, if any.
+        let path_fields = {
+            let mut path_fields = HashSet::new();
+            if let Some(rpc_path) = self.rpc_path {
+                for seg in &rpc_path.segments {
+                    let typ = SegmentType::try_from(seg.r#type).context("invalid segment type")?;
+                    match typ {
+                        SegmentType::Literal => {}
+                        SegmentType::Param | SegmentType::Wildcard | SegmentType::Fallback => {
+                            path_fields.insert(seg.value.as_str());
+                        }
+                    }
+                }
+            }
+            path_fields
+        };
+
+        let mut combined = jsonschema::Struct::default();
+        let mut body: Option<jsonschema::Struct> = None;
+        let mut query: Option<jsonschema::Struct> = None;
+        let mut header: Option<jsonschema::Struct> = None;
+        let mut cookie: Option<jsonschema::Struct> = None;
+        let mut http_status: Option<HttpStatus> = None;
+
+        for f in &st.fields {
+            // If it's a path field, skip it. We handle it separately in Path::from_meta.
+            if path_fields.contains(f.name.as_str()) {
+                continue;
+            }
+
+            let (name, mut field) = self.registry_builder.struct_field(f)?;
+            combined.fields.insert(name.to_owned(), field.clone());
+
+            let default_loc = || -> anyhow::Result<DefaultLoc> {
+                self.default_loc
+                    .with_context(|| format!("no location defined for field {}", f.name))
+            };
+
+            // Resolve which location the field should be in.
+            let loc = f.wire.as_ref().and_then(|w| w.location.as_ref());
+            let wire_loc = match loc {
+                None => default_loc()?.into_wire_loc(),
+                Some(schema::wire_spec::Location::Header(hdr)) => {
+                    WireLoc::Header(hdr.name.as_ref().unwrap_or(&f.name).clone())
+                }
+                Some(schema::wire_spec::Location::Query(_)) => WireLoc::Query,
+                Some(schema::wire_spec::Location::Cookie(c)) => {
+                    WireLoc::Cookie(c.name.as_ref().unwrap_or(&f.name).clone())
+                }
+                Some(schema::wire_spec::Location::HttpStatus(_)) => {
+                    if self.supports_http_status {
+                        http_status = Some(HttpStatus::new(f.name.clone()));
+                        continue;
+                    } else {
+                        default_loc()?.into_wire_loc()
+                    }
+                }
+            };
+
+            // Add the field to the appropriate struct.
+            let (dst, name_override) = match wire_loc {
+                WireLoc::Body => (&mut body, None),
+                WireLoc::Query => (&mut query, None),
+                WireLoc::Header(s) => (&mut header, Some(s)),
+                WireLoc::Path => unreachable!(),
+                WireLoc::Cookie(s) => (&mut cookie, Some(s)),
+            };
+            field.name_override = name_override;
+
+            match dst {
+                Some(dst) => {
+                    dst.fields.insert(name.to_owned(), field);
+                }
+                None => {
+                    *dst = Some(jsonschema::Struct {
+                        fields: {
+                            let mut fields = HashMap::new();
+                            fields.insert(name.to_owned(), field);
+                            fields
+                        },
+                    });
+                }
+            }
+        }
+
+        let mut build = |s| {
+            self.registry_builder
+                .register_value(jsonschema::Value::Struct(s))
+        };
+
+        Ok(SchemaUnderConstruction {
+            combined: Some(build(combined)),
+            body: body.map(&mut build),
+            query: query.map(&mut build),
+            header: header.map(&mut build),
+            cookie: cookie.map(&mut build),
+            http_status,
+            rpc_path: self.rpc_path.cloned(),
+        })
+    }
+
+    #[allow(dead_code)]
+    fn resolve_struct<'b>(
+        &'b self,
+        typ: &'b schema::Type,
+    ) -> anyhow::Result<Cow<'b, schema::Struct>> {
+        let typ = typ.typ.as_ref().context("type without type")?;
+        match typ {
+            Typ::Struct(s) => Ok(Cow::Borrowed(s)),
+            Typ::Pointer(ptr) => {
+                let base = ptr.base.as_ref().context("pointer without base")?;
+                self.resolve_struct(base)
+            }
+            Typ::Named(named) => {
+                let decl = &self.meta.decls[named.id as usize];
+                let typ = decl.r#type.as_ref().context("decl without type")?;
+                self.resolve_struct(typ)
+            }
+            _ => anyhow::bail!("expected struct, got {:?}", typ),
+        }
+    }
+}
+
+fn resolve_type<'a>(meta: &'a meta::Data, typ: &'a Typ) -> anyhow::Result<Cow<'a, Typ>> {
+    let resolver = TypeArgResolver {
+        meta,
+        resolved_args: vec![],
+        decls: vec![],
+    };
+    resolver.resolve(typ)
+}
+
+struct TypeArgResolver<'a> {
+    meta: &'a meta::Data,
+    resolved_args: Vec<Cow<'a, Typ>>,
+
+    /// List of declarations being processed.
+    /// Used to detect cycles.
+    decls: Vec<u32>,
+}
+
+impl<'a> TypeArgResolver<'a> {
+    fn resolve(&self, typ: &'a Typ) -> anyhow::Result<Cow<'a, Typ>> {
+        match typ {
+            Typ::Named(named) => {
+                let decl = &self.meta.decls[named.id as usize];
+                if self.decls.contains(&decl.id) {
+                    // Return it unmodified.
+                    return Ok(Cow::Borrowed(typ));
+                }
+
+                let args = self.resolve_types(&named.type_arguments)?;
+                let nested = TypeArgResolver {
+                    meta: self.meta,
+                    resolved_args: args,
+                    decls: {
+                        let mut decls = self.decls.clone();
+                        decls.push(decl.id);
+                        decls
+                    },
+                };
+                let typ = decl.r#type.as_ref().context("decl without type")?;
+                let typ = typ.typ.as_ref().context("type without type")?;
+                nested.resolve(typ)
+            }
+
+            Typ::Struct(strukt) => {
+                let mut cows = Vec::with_capacity(strukt.fields.len());
+                for field in &strukt.fields {
+                    let t = field.typ.as_ref().context("field without type")?;
+                    let typ = t.typ.as_ref().context("type without type")?;
+                    let resolved = self.resolve(typ)?;
+                    cows.push((resolved, t.validation.as_ref()));
+                }
+
+                let mut fields = Vec::with_capacity(strukt.fields.len());
+                for (field, (typ, v)) in strukt.fields.iter().zip(cows) {
+                    fields.push(schema::Field {
+                        typ: Some(schema::Type {
+                            typ: Some(typ.into_owned()),
+                            validation: v.cloned(),
+                        }),
+                        ..field.clone()
+                    });
+                }
+                Ok(Cow::Owned(Typ::Struct(schema::Struct { fields })))
+            }
+
+            Typ::Map(map) => {
+                let key = map.key.as_ref().context("map without key")?;
+                let key_typ = key.typ.as_ref().context("key without type")?;
+                let value = map.value.as_ref().context("map without value")?;
+                let val_typ = value.typ.as_ref().context("value without type")?;
+                let key_typ = self.resolve(key_typ)?;
+                let val_typ = self.resolve(val_typ)?;
+
+                if matches!((&key_typ, &val_typ), (Cow::Borrowed(_), Cow::Borrowed(_))) {
+                    Ok(Cow::Borrowed(typ))
+                } else {
+                    Ok(Cow::Owned(Typ::Map(Box::new(schema::Map {
+                        key: Some(Box::new(schema::Type {
+                            typ: Some(key_typ.into_owned()),
+                            validation: key.validation.clone(),
+                        })),
+                        value: Some(Box::new(schema::Type {
+                            typ: Some(val_typ.into_owned()),
+                            validation: value.validation.clone(),
+                        })),
+                    }))))
+                }
+            }
+
+            Typ::List(list) => {
+                let elem = list.elem.as_ref().context("list without elem")?;
+                let elem_typ = elem.typ.as_ref().context("elem without type")?;
+                let elem_typ = self.resolve(elem_typ)?;
+                if matches!(elem_typ, Cow::Borrowed(_)) {
+                    Ok(Cow::Borrowed(typ))
+                } else {
+                    Ok(Cow::Owned(Typ::List(Box::new(schema::List {
+                        elem: Some(Box::new(schema::Type {
+                            typ: Some(elem_typ.into_owned()),
+                            validation: elem.validation.clone(),
+                        })),
+                    }))))
+                }
+            }
+
+            Typ::Union(union) => {
+                let types = self.resolve_types(&union.types)?;
+                let types = types
+                    .into_iter()
+                    .zip(&union.types)
+                    .map(|(typ, t)| schema::Type {
+                        typ: Some(typ.into_owned()),
+                        validation: t.validation.clone(),
+                    })
+                    .collect::<Vec<_>>();
+
+                Ok(Cow::Owned(Typ::Union(schema::Union { types })))
+            }
+
+            Typ::Builtin(_) => Ok(Cow::Borrowed(typ)),
+
+            Typ::Literal(_) => Ok(Cow::Borrowed(typ)),
+
+            Typ::Pointer(ptr) => {
+                let base = ptr.base.as_ref().context("pointer without base")?;
+                let typ = base.typ.as_ref().context("base without type")?;
+                self.resolve(typ)
+            }
+
+            Typ::TypeParameter(param) => {
+                let idx = param.param_idx as usize;
+                let typ = &self.resolved_args[idx];
+                Ok(typ.clone())
+            }
+
+            Typ::Config(_cfg) => {
+                anyhow::bail!("config types are not supported")
+            }
+        }
+    }
+
+    fn resolve_types(&self, types: &'a [schema::Type]) -> anyhow::Result<Vec<Cow<'a, Typ>>> {
+        types
+            .iter()
+            .map(|typ| {
+                let typ = typ.typ.as_ref().context("type without type")?;
+                self.resolve(typ)
+            })
+            .collect()
+    }
+}
+
+pub struct ReqSchemaUnderConstruction {
+    pub methods: Vec<Method>,
+    pub schema: SchemaUnderConstruction,
+}
+
+impl ReqSchemaUnderConstruction {
+    pub fn build(self, reg: &Arc<jsonschema::Registry>) -> anyhow::Result<ReqSchema> {
+        Ok(ReqSchema {
+            methods: self.methods,
+            schema: self.schema.build(reg)?,
+        })
+    }
+}
+
+pub struct ReqSchema {
+    pub methods: Vec<Method>,
+    pub schema: Schema,
+}
+
+pub struct HandshakeSchemaUnderConstruction {
+    pub parse_data: bool,
+    pub schema: SchemaUnderConstruction,
+}
+
+impl HandshakeSchemaUnderConstruction {
+    pub fn build(self, reg: &Arc<jsonschema::Registry>) -> anyhow::Result<HandshakeSchema> {
+        Ok(HandshakeSchema {
+            parse_data: self.parse_data,
+            schema: self.schema.build(reg)?,
+        })
+    }
+}
+pub struct HandshakeSchema {
+    pub parse_data: bool,
+    pub schema: Schema,
+}
+
+/// Computes the handshake encoding for the given rpc.
+pub fn handshake_encoding(
+    registry_builder: &mut jsonschema::Builder,
+    meta: &meta::Data,
+    rpc: &meta::Rpc,
+) -> anyhow::Result<Option<HandshakeSchemaUnderConstruction>> {
+    // Only streaming endpoints have a handshake schema
+    if !rpc.streaming_request && !rpc.streaming_response {
+        return Ok(None);
+    }
+
+    let default_path = meta::Path {
+        segments: vec![meta::PathSegment {
+            value: format!("{}.{}", rpc.service_name, rpc.name),
+            r#type: SegmentType::Literal as i32,
+            value_type: meta::path_segment::ParamType::String as i32,
+            validation: None,
+        }],
+        r#type: meta::path::Type::Url as i32,
+    };
+    let rpc_path = rpc.path.as_ref().unwrap_or(&default_path);
+
+    let Some(handshake_schema) = &rpc.handshake_schema else {
+        let parse_data = rpc.path.as_ref().is_some_and(|path| {
+            path.segments
+                .iter()
+                .any(|segment| segment.r#type() != SegmentType::Literal)
+        });
+
+        return Ok(Some(HandshakeSchemaUnderConstruction {
+            parse_data,
+            schema: SchemaUnderConstruction {
+                combined: None,
+                http_status: None,
+                body: None,
+                query: None,
+                header: None,
+                cookie: None,
+                rpc_path: Some(rpc_path.clone()),
+            },
+        }));
+    };
+
+    let mut config = EncodingConfig {
+        meta,
+        registry_builder,
+        default_loc: Some(DefaultLoc::Query),
+        rpc_path: Some(rpc_path),
+        supports_body: false,
+        supports_query: true,
+        supports_header: true,
+        supports_path: true,
+        supports_http_status: false,
+    };
+
+    let schema = config.compute(handshake_schema)?;
+
+    Ok(Some(HandshakeSchemaUnderConstruction {
+        parse_data: true,
+        schema,
+    }))
+}
+
+/// Computes the request encoding for the given rpc.
+pub fn request_encoding(
+    registry_builder: &mut jsonschema::Builder,
+    meta: &meta::Data,
+    rpc: &meta::Rpc,
+) -> anyhow::Result<Vec<ReqSchemaUnderConstruction>> {
+    // Streaming request can only have a body schema
+    if rpc.streaming_request || rpc.streaming_response {
+        let Some(request_schema) = &rpc.request_schema else {
+            return Ok(vec![ReqSchemaUnderConstruction {
+                methods: vec![Method::GET],
+                schema: SchemaUnderConstruction {
+                    combined: None,
+                    http_status: None,
+                    body: None,
+                    query: None,
+                    header: None,
+                    cookie: None,
+                    rpc_path: None,
+                },
+            }]);
+        };
+
+        let mut config = EncodingConfig {
+            meta,
+            registry_builder,
+            default_loc: Some(DefaultLoc::Body),
+            rpc_path: None,
+            supports_body: true,
+            supports_query: false,
+            supports_header: false,
+            supports_path: false,
+            supports_http_status: false,
+        };
+
+        let schema = config.compute(request_schema)?;
+        return Ok(vec![ReqSchemaUnderConstruction {
+            methods: vec![Method::GET],
+            schema,
+        }]);
+    }
+
+    // Compute the set of methods.
+    let methods = {
+        let methods: anyhow::Result<Vec<Method>> = rpc
+            .http_methods
+            .iter()
+            .map(|m| Method::try_from(m.as_str()))
+            .collect();
+        methods.context("unable to parse http methods")?
+    };
+
+    let default_path = meta::Path {
+        segments: vec![meta::PathSegment {
+            value: format!("{}.{}", rpc.service_name, rpc.name),
+            r#type: SegmentType::Literal as i32,
+            value_type: meta::path_segment::ParamType::String as i32,
+            validation: None,
+        }],
+        r#type: meta::path::Type::Url as i32,
+    };
+    let rpc_path = rpc.path.as_ref().unwrap_or(&default_path);
+
+    // If there is no request schema, use the same encoding for all methods.
+    let Some(request_schema) = &rpc.request_schema else {
+        return Ok(vec![ReqSchemaUnderConstruction {
+            methods,
+            schema: SchemaUnderConstruction {
+                combined: None,
+                http_status: None,
+                body: None,
+                query: None,
+                header: None,
+                cookie: None,
+                rpc_path: Some(rpc_path.clone()),
+            },
+        }]);
+    };
+
+    let mut schemas = Vec::new();
+
+    for default_loc in split_by_loc(&methods) {
+        let mut config = EncodingConfig {
+            meta,
+            registry_builder,
+            default_loc: Some(default_loc.0),
+            rpc_path: Some(rpc_path),
+            supports_body: true,
+            supports_query: true,
+            supports_header: true,
+            supports_path: true,
+            supports_http_status: false,
+        };
+        let schema = config.compute(request_schema)?;
+        schemas.push(ReqSchemaUnderConstruction {
+            methods: default_loc.1.clone(),
+            schema,
+        });
+    }
+
+    Ok(schemas)
+}
+
+/// Computes the request encoding for the given rpc.
+pub fn response_encoding(
+    registry_builder: &mut jsonschema::Builder,
+    meta: &meta::Data,
+    rpc: &meta::Rpc,
+) -> anyhow::Result<SchemaUnderConstruction> {
+    let Some(response_schema) = &rpc.response_schema else {
+        return Ok(SchemaUnderConstruction {
+            combined: None,
+            body: None,
+            query: None,
+            header: None,
+            cookie: None,
+            http_status: None,
+            rpc_path: None,
+        });
+    };
+
+    let mut config = EncodingConfig {
+        meta,
+        registry_builder,
+        default_loc: Some(DefaultLoc::Body),
+        rpc_path: None,
+        supports_body: true,
+        supports_query: false,
+        supports_header: true,
+        supports_path: false,
+        supports_http_status: true,
+    };
+    config.compute(response_schema)
+}
+
+fn split_by_loc(methods: &[Method]) -> impl Iterator<Item = (DefaultLoc, Vec<Method>)> {
+    let mut locs = HashMap::new();
+    for m in methods {
+        let loc = if m.supports_body() {
+            DefaultLoc::Body
+        } else {
+            DefaultLoc::Query
+        };
+        locs.entry(loc).or_insert(Vec::new()).push(*m);
+    }
+
+    locs.into_iter()
+}
diff --git a/runtimes/core/src/api/schema/header.rs b/runtimes/core/src/api/schema/header.rs
new file mode 100644
index 0000000000..687eaadff4
--- /dev/null
+++ b/runtimes/core/src/api/schema/header.rs
@@ -0,0 +1,465 @@
+use crate::api::reqauth::meta::HeaderValueExt;
+use crate::api::schema::{JSONPayload, ParseResponse, ToOutgoingRequest, ToResponse};
+use crate::api::{self, PValue, PValues};
+use crate::api::{jsonschema, APIResult};
+use std::str::FromStr;
+
+#[derive(Debug, Clone)]
+pub struct Header {
+    schema: jsonschema::JSONSchema,
+}
+
+impl Header {
+    pub fn new(schema: jsonschema::JSONSchema) -> Self {
+        Self { schema }
+    }
+
+    pub fn contains_any(&self, headers: &impl HTTPHeaders) -> bool {
+        for (name, field) in self.schema.root().fields.iter() {
+            let header_name = field.name_override.as_deref().unwrap_or(name.as_str());
+
+            if let Some(val) = headers.get(header_name) {
+                // Only consider non-empty values to be present.
+                if !val.is_empty() {
+                    return true;
+                }
+            }
+        }
+        false
+    }
+
+    pub fn contains_key(&self, key: &str) -> bool {
+        self.schema.root().fields.contains_key(key)
+    }
+
+    pub fn len(&self) -> usize {
+        self.schema.root().fields.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    pub fn fields(&self) -> impl Iterator<Item = (&String, &jsonschema::Field)> {
+        self.schema.root().fields.iter()
+    }
+
+    /// Returns an iterator that yields the header names that are expected by the schema.
+    pub fn header_names(&self) -> impl Iterator<Item = axum::http::HeaderName> + '_ {
+        self.schema
+            .root()
+            .fields
+            .iter()
+            .filter_map(|(name, field)| {
+                let header_name = field.name_override.as_deref().unwrap_or(name.as_str());
+                axum::http::HeaderName::from_str(header_name).ok()
+            })
+    }
+}
+
+pub trait AsStr {
+    fn as_str(&self) -> &str;
+}
+
+pub trait ToHeaderStr {
+    type Error: std::error::Error;
+
+    fn to_str(&self) -> Result<&str, Self::Error>;
+    fn is_empty(&self) -> bool;
+}
+
+impl AsStr for &axum::http::header::HeaderName {
+    fn as_str(&self) -> &str {
+        <axum::http::header::HeaderName>::as_str(self)
+    }
+}
+
+impl ToHeaderStr for &axum::http::header::HeaderValue {
+    type Error = std::str::Utf8Error;
+
+    fn to_str(&self) -> Result<&str, Self::Error> {
+        <axum::http::header::HeaderValue>::to_utf8_str(self)
+    }
+    fn is_empty(&self) -> bool {
+        <axum::http::header::HeaderValue>::is_empty(self)
+    }
+}
+
+pub trait HTTPHeaders {
+    type Name: AsStr;
+    type Value: ToHeaderStr;
+    type Iter: Iterator<Item = (Self::Name, Self::Value)>;
+    type GetAll: Iterator<Item = Self::Value>;
+
+    fn headers(&self) -> Self::Iter;
+    fn get(&self, key: &str) -> Option<Self::Value>;
+    fn get_all(&self, key: &str) -> Self::GetAll;
+    fn contains_key(&self, key: &str) -> bool;
+}
+
+impl<'a> HTTPHeaders for &'a axum::http::HeaderMap {
+    type Name = &'a axum::http::header::HeaderName;
+    type Value = &'a axum::http::header::HeaderValue;
+    type Iter = axum::http::header::Iter<'a, axum::http::header::HeaderValue>;
+    type GetAll = axum::http::header::ValueIter<'a, axum::http::header::HeaderValue>;
+
+    fn headers(&self) -> Self::Iter {
+        self.iter()
+    }
+
+    fn get(&self, key: &str) -> Option<Self::Value> {
+        <axum::http::HeaderMap>::get(self, key)
+    }
+
+    fn get_all(&self, key: &str) -> Self::GetAll {
+        <axum::http::HeaderMap>::get_all(self, key).iter()
+    }
+
+    fn contains_key(&self, key: &str) -> bool {
+        <axum::http::HeaderMap>::contains_key(self, key)
+    }
+}
+
+impl Header {
+    pub fn parse_incoming_request_parts(
+        &self,
+        req: &axum::http::request::Parts,
+    ) -> APIResult<Option<PValues>> {
+        self.parse(&req.headers)
+    }
+
+    pub fn parse(&self, headers: &axum::http::HeaderMap) -> APIResult<Option<PValues>> {
+        if self.schema.root().is_empty() {
+            return Ok(None);
+        }
+
+        match self.schema.parse(headers) {
+            Ok(decoded) => Ok(Some(decoded)),
+            Err(err) => Err(err),
+        }
+    }
+}
+
+impl ParseResponse for Header {
+    type Output = Option<PValues>;
+
+    fn parse_response(&self, resp: &mut reqwest::Response) -> APIResult<Self::Output> {
+        if self.schema.root().is_empty() {
+            return Ok(None);
+        }
+
+        match self.schema.parse(resp.headers()) {
+            Ok(decoded) => Ok(Some(decoded)),
+            Err(err) => Err(err),
+        }
+    }
+}
+
+impl ToOutgoingRequest<http::HeaderMap> for Header {
+    fn to_outgoing_request(
+        &self,
+        payload: &mut JSONPayload,
+        headers: &mut http::HeaderMap,
+    ) -> APIResult<()> {
+        if self.schema.root().is_empty() {
+            return Ok(());
+        }
+
+        let Some(payload) = payload else {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "missing header parameters".to_string(),
+                internal_message: Some("missing header parameters".to_string()),
+                stack: None,
+                details: None,
+            });
+        };
+
+        for (key, field) in self.schema.root().fields.iter() {
+            let Some(value) = payload.get(key) else {
+                if field.optional {
+                    continue;
+                }
+                return Err(api::Error {
+                    code: api::ErrCode::InvalidArgument,
+                    message: format!("missing header parameter: {key}"),
+                    internal_message: Some(format!("missing header parameter: {key}")),
+                    stack: None,
+                    details: None,
+                });
+            };
+
+            let header_name = field.name_override.as_deref().unwrap_or(key);
+            let header_name =
+                reqwest::header::HeaderName::from_str(header_name).map_err(api::Error::internal)?;
+            match to_reqwest_header_value(value)? {
+                ReqwestHeaders::Single(value) => {
+                    headers.append(header_name, value);
+                }
+                ReqwestHeaders::Multi(values) => {
+                    for value in values {
+                        headers.append(header_name.clone(), value);
+                    }
+                }
+            }
+        }
+
+        Ok(())
+    }
+}
+
+impl ToOutgoingRequest<reqwest::Request> for Header {
+    fn to_outgoing_request(
+        &self,
+        payload: &mut JSONPayload,
+        req: &mut reqwest::Request,
+    ) -> APIResult<()> {
+        let headers = req.headers_mut();
+        self.to_outgoing_request(payload, headers)
+    }
+}
+
+impl<B> ToOutgoingRequest<http::Request<B>> for Header {
+    fn to_outgoing_request(
+        &self,
+        payload: &mut JSONPayload,
+        req: &mut http::Request<B>,
+    ) -> APIResult<()> {
+        let headers = req.headers_mut();
+        self.to_outgoing_request(payload, headers)
+    }
+}
+
+impl ToResponse for Header {
+    fn to_response(
+        &self,
+        payload: &JSONPayload,
+        mut resp: axum::http::response::Builder,
+    ) -> APIResult<axum::http::response::Builder> {
+        if self.schema.root().is_empty() {
+            return Ok(resp);
+        }
+
+        let Some(payload) = payload else {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "missing header parameters".to_string(),
+                internal_message: Some("missing header parameters".to_string()),
+                stack: None,
+                details: None,
+            });
+        };
+
+        let schema = self.schema.root();
+        for (key, value) in payload.iter() {
+            let key = key.as_str();
+            let Some(field) = schema.fields.get(key) else {
+                continue; // Not a header.
+            };
+            let header_name = field.name_override.as_deref().unwrap_or(key);
+            let header_name = axum::http::header::HeaderName::from_str(header_name)
+                .map_err(api::Error::internal)?;
+
+            match to_axum_header_value(value)? {
+                AxumHeaders::Single(value) => resp = resp.header(header_name, value),
+                AxumHeaders::Multi(values) => {
+                    for value in values {
+                        resp = resp.header(header_name.clone(), value);
+                    }
+                }
+            }
+        }
+
+        Ok(resp)
+    }
+}
+
+enum ReqwestHeaders {
+    Single(reqwest::header::HeaderValue),
+    Multi(Vec<reqwest::header::HeaderValue>),
+}
+
+fn to_reqwest_header_value(value: &PValue) -> APIResult<ReqwestHeaders> {
+    use PValue::*;
+    use ReqwestHeaders::*;
+
+    Ok(Single(match value {
+        Null => reqwest::header::HeaderValue::from_static("null"),
+
+        Bool(bool) => {
+            reqwest::header::HeaderValue::from_static(if *bool { "true" } else { "false" })
+        }
+
+        String(str) => reqwest::header::HeaderValue::from_str(str).map_err(|e| api::Error {
+            code: api::ErrCode::InvalidArgument,
+            message: "unable to convert string to header value".to_string(),
+            internal_message: Some(format!("unable to convert string to header value: {e}")),
+            stack: None,
+            details: None,
+        })?,
+
+        DateTime(dt) => {
+            let s = dt.to_rfc3339();
+            reqwest::header::HeaderValue::from_str(&s).map_err(|e| api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "unable to convert datetime to header value".to_string(),
+                internal_message: Some(format!("unable to convert datetime to header value: {e}")),
+                stack: None,
+                details: None,
+            })?
+        }
+
+        Number(num) => {
+            let str = num.to_string();
+            reqwest::header::HeaderValue::from_str(&str).map_err(|e| api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "unable to convert number to header value".to_string(),
+                internal_message: Some(format!("unable to convert number to header value: {e}")),
+                stack: None,
+                details: None,
+            })?
+        }
+
+        Decimal(d) => {
+            reqwest::header::HeaderValue::from_str(&d.to_string()).map_err(|e| api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "unable to convert decimal to header value".to_string(),
+                internal_message: Some(format!("unable to convert decimal to header value: {e}")),
+                stack: None,
+                details: None,
+            })?
+        }
+
+        Array(arr) => {
+            let mut values = Vec::with_capacity(arr.len());
+            for value in arr.iter() {
+                match to_reqwest_header_value(value)? {
+                    Single(value) => values.push(value),
+                    Multi(_) => {
+                        return Err(api::Error {
+                            code: api::ErrCode::InvalidArgument,
+                            message: "nested array type unsupported as header value".into(),
+                            internal_message: None,
+                            stack: None,
+                            details: None,
+                        })
+                    }
+                }
+            }
+            return Ok(Multi(values));
+        }
+
+        Object(_) => {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "map type unsupported as header value".into(),
+                internal_message: None,
+                stack: None,
+                details: None,
+            });
+        }
+        Cookie(_) => {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "cookie type unsupported as header value".into(),
+                internal_message: None,
+                stack: None,
+                details: None,
+            })
+        }
+    }))
+}
+
+enum AxumHeaders {
+    Single(axum::http::HeaderValue),
+    Multi(Vec<axum::http::HeaderValue>),
+}
+
+fn to_axum_header_value(value: &PValue) -> APIResult<AxumHeaders> {
+    use PValue::*;
+
+    Ok(AxumHeaders::Single(match value {
+        Null => axum::http::HeaderValue::from_static("null"),
+
+        Bool(bool) => axum::http::HeaderValue::from_static(if *bool { "true" } else { "false" }),
+
+        String(str) => axum::http::HeaderValue::from_str(str).map_err(|e| api::Error {
+            code: api::ErrCode::InvalidArgument,
+            message: "unable to convert string to header value".to_string(),
+            internal_message: Some(format!("unable to convert string to header value: {e}")),
+            stack: None,
+            details: None,
+        })?,
+
+        DateTime(dt) => {
+            let s = dt.to_rfc3339();
+            axum::http::HeaderValue::from_str(&s).map_err(|e| api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "unable to convert datetime to header value".to_string(),
+                internal_message: Some(format!("unable to convert datetime to header value: {e}")),
+                stack: None,
+                details: None,
+            })?
+        }
+
+        Number(num) => {
+            let str = num.to_string();
+            axum::http::HeaderValue::from_str(&str).map_err(|e| api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "unable to convert number to header value".to_string(),
+                internal_message: Some(format!("unable to convert number to header value: {e}")),
+                stack: None,
+                details: None,
+            })?
+        }
+
+        Decimal(d) => {
+            axum::http::HeaderValue::from_str(&d.to_string()).map_err(|e| api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "unable to convert decimal to header value".to_string(),
+                internal_message: Some(format!("unable to convert decimal to header value: {e}")),
+                stack: None,
+                details: None,
+            })?
+        }
+
+        Array(arr) => {
+            let mut values = Vec::with_capacity(arr.len());
+            for value in arr.iter() {
+                match to_axum_header_value(value)? {
+                    AxumHeaders::Single(value) => values.push(value),
+                    AxumHeaders::Multi(_) => {
+                        return Err(api::Error {
+                            code: api::ErrCode::InvalidArgument,
+                            message: "nested array type unsupported as header value".into(),
+                            internal_message: None,
+                            stack: None,
+                            details: None,
+                        })
+                    }
+                }
+            }
+            return Ok(AxumHeaders::Multi(values));
+        }
+
+        Object(_) => {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "map type unsupported as header value".into(),
+                internal_message: None,
+                stack: None,
+                details: None,
+            });
+        }
+
+        Cookie(_) => {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "cookie type unsupported as header value".into(),
+                internal_message: None,
+                stack: None,
+                details: None,
+            })
+        }
+    }))
+}
diff --git a/runtimes/core/src/api/schema/httpstatus.rs b/runtimes/core/src/api/schema/httpstatus.rs
new file mode 100644
index 0000000000..891fc1d167
--- /dev/null
+++ b/runtimes/core/src/api/schema/httpstatus.rs
@@ -0,0 +1,76 @@
+use crate::api::{APIResult, PValues};
+use axum::http::response::Builder as ResponseBuilder;
+
+/// HTTP status code parameter specification.
+#[derive(Debug, Clone)]
+pub struct HttpStatus {
+    pub name: String,
+}
+
+impl HttpStatus {
+    pub fn new(name: String) -> Self {
+        Self { name }
+    }
+
+    /// Extract HTTP status code from response payload and apply it to the response builder.
+    pub fn to_response(
+        &self,
+        payload: &Option<PValues>,
+        mut resp_builder: ResponseBuilder,
+    ) -> APIResult<ResponseBuilder> {
+        if let Some(payload) = payload {
+            if let Some(status_value) = payload.get(&self.name) {
+                let status_code = self.extract_status_code(status_value)?;
+                resp_builder = resp_builder.status(status_code);
+            }
+        }
+        Ok(resp_builder)
+    }
+
+    /// Extract and validate HTTP status code from a PValue.
+    fn extract_status_code(&self, status_value: &crate::api::PValue) -> APIResult<u16> {
+        let status_code = match status_value {
+            crate::api::PValue::Number(n) => n.as_u64().ok_or_else(|| {
+                crate::api::Error::invalid_argument(
+                    "invalid http status code",
+                    anyhow::anyhow!(
+                        "HTTP status field '{}' must be a positive integer",
+                        self.name
+                    ),
+                )
+            })?,
+            _ => {
+                return Err(crate::api::Error::invalid_argument(
+                    "invalid http status code",
+                    anyhow::anyhow!(
+                        "HTTP status field '{}' must be a number, got: {}",
+                        self.name,
+                        status_value.type_name()
+                    ),
+                ));
+            }
+        };
+
+        if !(100..=599).contains(&status_code) {
+            return Err(crate::api::Error::invalid_argument(
+                "invalid http status code",
+                anyhow::anyhow!(
+                    "HTTP status field '{}' must be a between 100 and 599, got: {status_code}",
+                    self.name,
+                ),
+            ));
+        }
+
+        Ok(status_code as u16)
+    }
+}
+
+impl super::ToResponse for HttpStatus {
+    fn to_response(
+        &self,
+        payload: &super::JSONPayload,
+        resp: axum::http::response::Builder,
+    ) -> APIResult<axum::http::response::Builder> {
+        self.to_response(payload, resp)
+    }
+}
diff --git a/runtimes/core/src/api/schema/method.rs b/runtimes/core/src/api/schema/method.rs
new file mode 100644
index 0000000000..4532bf49db
--- /dev/null
+++ b/runtimes/core/src/api/schema/method.rs
@@ -0,0 +1,112 @@
+#[derive(Debug, Copy, Clone, Hash, Eq, PartialEq, Ord, PartialOrd)]
+pub enum Method {
+    GET,
+    HEAD,
+    POST,
+    PUT,
+    DELETE,
+    // CONNECT,
+    OPTIONS,
+    TRACE,
+    PATCH,
+}
+
+impl Method {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Method::GET => "GET",
+            Method::HEAD => "HEAD",
+            Method::POST => "POST",
+            Method::PUT => "PUT",
+            Method::DELETE => "DELETE",
+            // Method::CONNECT => "CONNECT",
+            Method::OPTIONS => "OPTIONS",
+            Method::TRACE => "TRACE",
+            Method::PATCH => "PATCH",
+        }
+    }
+
+    /// Whether the method supports a request body.
+    pub fn supports_body(&self) -> bool {
+        match self {
+            Self::POST | Self::PUT | Self::PATCH /* | Self::CONNECT */ => true,
+            Self::GET | Self::DELETE | Self::HEAD | Self::OPTIONS | Self::TRACE => false,
+        }
+    }
+}
+
+impl TryFrom<&str> for Method {
+    type Error = anyhow::Error;
+
+    fn try_from(s: &str) -> Result<Self, Self::Error> {
+        match s {
+            "GET" => Ok(Method::GET),
+            "HEAD" => Ok(Method::HEAD),
+            "POST" => Ok(Method::POST),
+            "PUT" => Ok(Method::PUT),
+            "DELETE" => Ok(Method::DELETE),
+            // "CONNECT" => Ok(Method::CONNECT),
+            "OPTIONS" => Ok(Method::OPTIONS),
+            "TRACE" => Ok(Method::TRACE),
+            "PATCH" => Ok(Method::PATCH),
+            _ => Err(anyhow::anyhow!("invalid method: {}", s)),
+        }
+    }
+}
+
+impl From<Method> for axum::http::Method {
+    fn from(val: Method) -> Self {
+        match val {
+            Method::GET => axum::http::Method::GET,
+            Method::HEAD => axum::http::Method::HEAD,
+            Method::POST => axum::http::Method::POST,
+            Method::PUT => axum::http::Method::PUT,
+            Method::DELETE => axum::http::Method::DELETE,
+            // Method::CONNECT => http::Method::CONNECT,
+            Method::OPTIONS => axum::http::Method::OPTIONS,
+            Method::TRACE => axum::http::Method::TRACE,
+            Method::PATCH => axum::http::Method::PATCH,
+        }
+    }
+}
+
+impl TryFrom<axum::http::Method> for Method {
+    type Error = anyhow::Error;
+    fn try_from(m: axum::http::Method) -> anyhow::Result<Self> {
+        Ok(match m.as_str() {
+            "GET" => Method::GET,
+            "HEAD" => Method::HEAD,
+            "POST" => Method::POST,
+            "PUT" => Method::PUT,
+            "DELETE" => Method::DELETE,
+            // "CONNECT" => Method::CONNECT,
+            "OPTIONS" => Method::OPTIONS,
+            "TRACE" => Method::TRACE,
+            "PATCH" => Method::PATCH,
+            x => anyhow::bail!("invalid method: {}", x),
+        })
+    }
+}
+
+pub fn method_filter<M>(methods: M) -> Option<axum::routing::MethodFilter>
+where
+    M: Iterator<Item = Method>,
+{
+    use axum::routing::MethodFilter;
+    let mut filter = None;
+    for method in methods {
+        let method_filter = match method {
+            Method::GET => MethodFilter::GET,
+            Method::HEAD => MethodFilter::HEAD,
+            Method::POST => MethodFilter::POST,
+            Method::PUT => MethodFilter::PUT,
+            Method::DELETE => MethodFilter::DELETE,
+            // Method::CONNECT => MethodFilter::CONNECT,
+            Method::OPTIONS => MethodFilter::OPTIONS,
+            Method::TRACE => MethodFilter::TRACE,
+            Method::PATCH => MethodFilter::PATCH,
+        };
+        filter = Some(filter.unwrap_or(method_filter).or(method_filter));
+    }
+    filter
+}
diff --git a/runtimes/core/src/api/schema/mod.rs b/runtimes/core/src/api/schema/mod.rs
new file mode 100644
index 0000000000..55330426f6
--- /dev/null
+++ b/runtimes/core/src/api/schema/mod.rs
@@ -0,0 +1,267 @@
+use crate::api;
+pub use body::*;
+pub use cookie::*;
+pub use header::*;
+pub use httpstatus::*;
+pub use method::*;
+pub use path::*;
+pub use query::*;
+use std::sync::Arc;
+
+use crate::api::{endpoint, APIResult, PValues, RequestPayload};
+
+use super::ResponsePayload;
+
+mod body;
+mod cookie;
+pub mod encoding;
+mod header;
+mod httpstatus;
+mod method;
+mod path;
+mod query;
+
+pub type JSONPayload = Option<PValues>;
+
+pub trait ToOutgoingRequest<Request> {
+    fn to_outgoing_request(&self, payload: &mut JSONPayload, req: &mut Request) -> APIResult<()>;
+}
+
+pub trait ToResponse {
+    fn to_response(
+        &self,
+        payload: &JSONPayload,
+        resp: axum::http::response::Builder,
+    ) -> APIResult<axum::http::response::Builder>;
+}
+
+pub trait ParseResponse {
+    type Output: Sized;
+    fn parse_response(&self, resp: &mut reqwest::Response) -> APIResult<Self::Output>;
+}
+
+/// The request schema for a set of methods.
+#[derive(Debug)]
+pub struct Request {
+    /// The methods the schema is applicable for.
+    pub methods: Vec<Method>,
+
+    /// Path to reach the endpoint.
+    pub path: Path,
+
+    /// Header names used by the endpoint.
+    pub header: Option<Header>,
+
+    /// Cookie names used by the endpoint.
+    pub cookie: Option<Cookie>,
+
+    /// Query string names used by the endpoint.
+    pub query: Option<Query>,
+
+    /// Request body.
+    pub body: RequestBody,
+
+    /// If this is a streamed request
+    pub stream: bool,
+}
+
+#[derive(Debug)]
+pub enum RequestBody {
+    Typed(Option<Body>),
+    Raw,
+}
+
+impl Request {
+    pub async fn extract(
+        &self,
+        parts: &mut axum::http::request::Parts,
+        body: axum::body::Body,
+    ) -> APIResult<Option<RequestPayload>> {
+        let path = self.path.parse_incoming_request_parts(parts)?;
+        let query = match &self.query {
+            None => None,
+            Some(q) => q.parse_incoming_request_parts(parts)?,
+        };
+        let header = match &self.header {
+            None => None,
+            Some(h) => h.parse_incoming_request_parts(parts)?,
+        };
+        let cookie = match &self.cookie {
+            None => None,
+            Some(c) => c.parse_incoming_request_parts(parts)?,
+        };
+
+        let body = match &self.body {
+            RequestBody::Raw => endpoint::Body::Raw(Arc::new(std::sync::Mutex::new(Some(body)))),
+            RequestBody::Typed(None) => endpoint::Body::Typed(None),
+            RequestBody::Typed(Some(b)) => {
+                endpoint::Body::Typed(b.parse_incoming_request_body(body).await?)
+            }
+        };
+
+        Ok(Some(RequestPayload {
+            path,
+            query,
+            header,
+            cookie,
+            body,
+        }))
+    }
+}
+
+/// The response schema for an endpoint.
+#[derive(Debug)]
+pub struct Response {
+    /// Response header names returned by the endpoint.
+    pub header: Option<Header>,
+
+    /// Response cookie names returned by the endpoint.
+    pub cookie: Option<Cookie>,
+
+    /// Response body, if any.
+    pub body: Option<Body>,
+
+    /// HTTP status code field, if any.
+    pub http_status: Option<HttpStatus>,
+
+    /// If this is a streamed response
+    pub stream: bool,
+}
+
+impl Response {
+    pub fn encode(
+        &self,
+        payload: &JSONPayload,
+        status: u16,
+    ) -> APIResult<axum::http::Response<axum::body::Body>> {
+        let mut bld = axum::http::Response::builder().status(status);
+
+        if let Some(hdr) = &self.header {
+            bld = hdr.to_response(payload, bld)?
+        };
+        if let Some(c) = &self.cookie {
+            bld = c.to_response(payload, bld)?;
+        }
+        if let Some(hs) = &self.http_status {
+            bld = hs.to_response(payload, bld)?;
+        }
+        match &self.body {
+            Some(body) => body.to_response(payload, bld),
+            None => bld
+                .body(axum::body::Body::empty())
+                .map_err(api::Error::internal),
+        }
+    }
+
+    pub async fn extract(&self, resp: reqwest::Response) -> APIResult<ResponsePayload> {
+        let header = match &self.header {
+            None => None,
+            Some(h) => h.parse(resp.headers())?,
+        };
+
+        let cookie = match &self.cookie {
+            None => None,
+            Some(c) => c.parse_resp(resp.headers())?,
+        };
+
+        // Do we have a body schema?
+        let body = endpoint::Body::Typed(match &self.body {
+            None => None,
+            Some(body_schema) => {
+                // If so we expect a JSON body.
+                match resp.headers().get(axum::http::header::CONTENT_TYPE) {
+                    Some(content_type) if content_type == "application/json" => {
+                        // Collect the bytes of the request body.
+                        // Serde doesn't support async streaming reads (at least not yet).
+                        let bytes = resp.bytes().await.map_err(|e| {
+                            api::Error::invalid_argument("unable to read response body", e)
+                        })?;
+
+                        body_schema.parse_response_body(bytes).await?
+                    }
+                    _ => {
+                        // We didn't get a JSON body, so return an error.
+                        return Err(api::Error::internal(anyhow::anyhow!("expected json body")));
+                    }
+                }
+            }
+        });
+
+        Ok(ResponsePayload {
+            header,
+            body,
+            cookie,
+        })
+    }
+}
+
+pub struct Stream {
+    incoming: Box<dyn StreamMessage>,
+    outgoing: Box<dyn StreamMessage>,
+}
+
+impl Stream {
+    pub fn new<I, O>(incoming: I, outgoing: O) -> Self
+    where
+        I: StreamMessage,
+        O: StreamMessage,
+    {
+        Stream {
+            incoming: Box::new(incoming),
+            outgoing: Box::new(outgoing),
+        }
+    }
+
+    pub fn to_outgoing_message(&self, msg: PValues) -> APIResult<Vec<u8>> {
+        let body_schema = self.outgoing.body().ok_or_else(|| {
+            super::Error::internal(anyhow::anyhow!("outgoing message body can't be empty"))
+        })?;
+
+        body_schema.to_outgoing_payload(&Some(msg))
+    }
+
+    pub async fn parse_incoming_message(&self, bytes: &[u8]) -> APIResult<PValues> {
+        let Some(body) = self.incoming.body() else {
+            return Err(super::Error {
+                code: super::ErrCode::InvalidArgument,
+                message: "invalid streaming body type in schema".to_string(),
+                internal_message: None,
+                stack: None,
+                details: None,
+            });
+        };
+
+        let value = body
+            .parse_incoming_request_body(bytes.to_vec().into())
+            .await?
+            .ok_or_else(|| super::Error {
+                code: super::ErrCode::InvalidArgument,
+                message: "missing payload".to_string(),
+                internal_message: None,
+                stack: None,
+                details: None,
+            })?;
+
+        Ok(value)
+    }
+}
+
+pub trait StreamMessage: Send + Sync + 'static {
+    fn body(&self) -> Option<&Body>;
+}
+
+impl StreamMessage for Arc<Response> {
+    fn body(&self) -> Option<&Body> {
+        self.body.as_ref()
+    }
+}
+
+impl StreamMessage for Arc<Request> {
+    fn body(&self) -> Option<&Body> {
+        if let RequestBody::Typed(body) = &self.body {
+            body.as_ref()
+        } else {
+            None
+        }
+    }
+}
diff --git a/runtimes/core/src/api/schema/path.rs b/runtimes/core/src/api/schema/path.rs
new file mode 100644
index 0000000000..9ed1cc4c4d
--- /dev/null
+++ b/runtimes/core/src/api/schema/path.rs
@@ -0,0 +1,383 @@
+use std::future::Future;
+use std::pin::Pin;
+use std::ptr;
+use std::str::FromStr;
+use std::task::{Poll, RawWaker, RawWakerVTable, Waker};
+
+use anyhow::Context;
+use axum::extract::rejection::PathRejection;
+use axum::extract::FromRequestParts;
+use axum::http::request::Parts;
+use indexmap::IndexMap;
+
+use crate::api::jsonschema::Basic;
+use crate::api::schema::JSONPayload;
+use crate::api::{self, pvalue::PValue};
+use crate::api::{jsonschema, APIResult};
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::parser::meta::v1::path_segment::ParamType;
+
+/// The URL path to an endpoint, e.g. ("/foo/bar/:id").
+#[derive(Debug, Clone)]
+pub struct Path {
+    /// The path segments.
+    segments: Vec<Segment>,
+    dynamic_segments: Vec<(Basic, Option<jsonschema::validation::Expr>)>,
+
+    /// The capacity to use for generating requests.
+    capacity: usize,
+}
+
+impl Path {
+    pub fn from_meta(path: &meta::Path) -> anyhow::Result<Self> {
+        let mut segments = Vec::with_capacity(path.segments.len());
+        for seg in &path.segments {
+            use meta::path_segment::SegmentType;
+            let validation = seg
+                .validation
+                .as_ref()
+                .map(|v| {
+                    jsonschema::validation::Expr::try_from(v)
+                        .context("invalid path segment validation")
+                })
+                .transpose()?;
+
+            match SegmentType::try_from(seg.r#type).context("invalid path segment type")? {
+                SegmentType::Literal => {
+                    segments.push(Segment::Literal(seg.value.clone().into_boxed_str()))
+                }
+                SegmentType::Param => {
+                    let name = &seg.value;
+                    let typ = match ParamType::try_from(seg.value_type)
+                        .context("invalid path parameter type")?
+                    {
+                        ParamType::String => Basic::String,
+                        ParamType::Bool => Basic::Bool,
+                        ParamType::Uuid => Basic::String,
+                        ParamType::Int
+                        | ParamType::Int8
+                        | ParamType::Int16
+                        | ParamType::Int32
+                        | ParamType::Int64
+                        | ParamType::Uint
+                        | ParamType::Uint8
+                        | ParamType::Uint16
+                        | ParamType::Uint32
+                        | ParamType::Uint64 => Basic::Number,
+                    };
+
+                    segments.push(Segment::Param {
+                        name: name.clone().into_boxed_str(),
+                        typ,
+                        validation,
+                    });
+                }
+
+                SegmentType::Wildcard => segments.push(Segment::Wildcard {
+                    name: seg.clone().value.into_boxed_str(),
+                    validation,
+                }),
+                SegmentType::Fallback => segments.push(Segment::Fallback {
+                    name: seg.clone().value.into_boxed_str(),
+                    validation,
+                }),
+            }
+        }
+
+        Ok(Self::from_segments(segments))
+    }
+
+    pub fn from_segments(segments: Vec<Segment>) -> Self {
+        let mut capacity = 0;
+        let mut dynamic_segments = Vec::new();
+        for seg in segments.iter() {
+            use Segment::*;
+            capacity += 1; // slash
+            match seg {
+                Literal(lit) => capacity += lit.len(),
+                Param {
+                    typ, validation, ..
+                } => {
+                    capacity += 10; // assume path parameters on average are 10 characters long
+                    dynamic_segments.push((*typ, validation.clone()));
+                }
+                Wildcard { validation, .. } | Fallback { validation, .. } => {
+                    // Assume path parameters on average are 10 characters long.
+                    capacity += 10;
+                    dynamic_segments.push((jsonschema::Basic::String, validation.clone()));
+                }
+            }
+        }
+
+        Self {
+            segments,
+            dynamic_segments,
+            capacity,
+        }
+    }
+}
+
+/// Represents a path segment.
+#[derive(Debug, Clone)]
+pub enum Segment {
+    Literal(Box<str>),
+    Param {
+        name: Box<str>,
+        /// The type of the path parameter.
+        typ: jsonschema::Basic,
+        validation: Option<jsonschema::validation::Expr>,
+    },
+    Wildcard {
+        name: Box<str>,
+        validation: Option<jsonschema::validation::Expr>,
+    },
+    Fallback {
+        name: Box<str>,
+        validation: Option<jsonschema::validation::Expr>,
+    },
+}
+
+impl Path {
+    /// Computes the request path to use for making an API call to this path with the given payload.
+    pub fn to_request_path(&self, payload: &mut JSONPayload) -> Result<String, api::Error> {
+        let mut path = String::with_capacity(self.capacity);
+        for seg in self.segments.iter() {
+            path.push('/');
+
+            use Segment::*;
+            match seg {
+                Literal(lit) => path.push_str(lit),
+                Param { name, .. } | Wildcard { name, .. } | Fallback { name, .. } => {
+                    let Some(payload) = payload else {
+                        return Err(api::Error {
+                            code: api::ErrCode::InvalidArgument,
+                            message: "missing field in request payload".into(),
+                            internal_message: Some(format!(
+                                "missing field in request payload: {}",
+                                &name
+                            )),
+                            stack: None,
+                            details: None,
+                        });
+                    };
+
+                    // Find the data in the payload.
+                    let Some(value) = payload.get(name.as_ref()) else {
+                        return Err(api::Error {
+                            code: api::ErrCode::InvalidArgument,
+                            message: "missing field in request payload".into(),
+                            internal_message: Some(format!(
+                                "missing field in request payload: {}",
+                                &name
+                            )),
+                            stack: None,
+                            details: None,
+                        });
+                    };
+
+                    match value {
+                        PValue::String(str) => {
+                            // URL-encode the string, so it doesn't get reinterpreted
+                            // as multiple path segments.
+                            let encoded = urlencoding::encode(str);
+                            path.push_str(&encoded);
+                        }
+                        PValue::Null => path.push_str("null"),
+                        PValue::Bool(bool) => path.push_str(if *bool { "true" } else { "false" }),
+                        PValue::Number(num) => {
+                            let str = num.to_string();
+                            path.push_str(&str);
+                        }
+                        PValue::Decimal(d) => {
+                            let str = d.to_string();
+                            path.push_str(&str);
+                        }
+                        PValue::DateTime(dt) => {
+                            let encoded = dt.to_rfc3339();
+                            path.push_str(&encoded);
+                        }
+                        PValue::Array(_) | PValue::Object(_) | PValue::Cookie(_) => {
+                            return Err(api::Error {
+                                code: api::ErrCode::InvalidArgument,
+                                message: "unsupported type in request payload".into(),
+                                internal_message: Some(format!(
+                                    "unsupported type in request payload for field {}",
+                                    &name
+                                )),
+                                stack: None,
+                                details: None,
+                            })
+                        }
+                    }
+                }
+            }
+        }
+
+        Ok(path)
+    }
+}
+
+impl Path {
+    pub fn parse_incoming_request_parts(
+        &self,
+        req: &mut Parts,
+    ) -> APIResult<Option<IndexMap<String, PValue>>> {
+        if self.dynamic_segments.is_empty() {
+            return Ok(None);
+        }
+
+        let fut = axum::extract::Path::<Vec<(String, String)>>::from_request_parts(req, &());
+
+        let result = resolve_immediate_future(fut).map_err(|_| api::Error {
+            code: api::ErrCode::InvalidArgument,
+            message: "unable to parse path params".into(),
+            internal_message: Some("polling path params returned pending".into()),
+            stack: None,
+            details: None,
+        })?;
+
+        match result {
+            Ok(axum::extract::Path(params)) => {
+                let mut map = IndexMap::with_capacity(params.len());
+
+                // For each param, find the corresponding segment and deserialize it.
+                for (idx, (name, val)) in params.into_iter().enumerate() {
+                    if let Some((typ, validation)) = self.dynamic_segments.get(idx) {
+                        // Decode it into the correct type based on the type.
+                        let val = match &typ {
+                            // For strings and any, use the value directly.
+                            Basic::String | Basic::Any => PValue::String(val),
+
+                            // For numbers and booleans, use the JSON parser.
+                            Basic::Number => {
+                                let val = serde_json::from_str::<serde_json::Number>(&val)
+                                    .map_err(|err| api::Error {
+                                        code: api::ErrCode::InvalidArgument,
+                                        message: "path parameter is not a valid number".into(),
+                                        internal_message: Some(err.to_string()),
+                                        stack: None,
+                                        details: None,
+                                    })?;
+                                PValue::Number(val)
+                            }
+                            Basic::Bool => {
+                                let val = serde_json::from_str::<bool>(&val).map_err(|err| {
+                                    api::Error {
+                                        code: api::ErrCode::InvalidArgument,
+                                        message: "path parameter is not a valid boolean".into(),
+                                        internal_message: Some(err.to_string()),
+                                        stack: None,
+                                        details: None,
+                                    }
+                                })?;
+                                PValue::Bool(val)
+                            }
+
+                            Basic::DateTime => {
+                                let val =
+                                    api::DateTime::parse_from_rfc3339(&val).map_err(|err| {
+                                        api::Error {
+                                            code: api::ErrCode::InvalidArgument,
+                                            message: "path parameter is not a valid datetime"
+                                                .into(),
+                                            internal_message: Some(err.to_string()),
+                                            stack: None,
+                                            details: None,
+                                        }
+                                    })?;
+                                PValue::DateTime(val)
+                            }
+
+                            Basic::Decimal => {
+                                let val =
+                                    api::Decimal::from_str(&val).map_err(|err| api::Error {
+                                        code: api::ErrCode::InvalidArgument,
+                                        message: "path parameter is not a valid decimal".into(),
+                                        internal_message: Some(err.to_string()),
+                                        stack: None,
+                                        details: None,
+                                    })?;
+                                PValue::Decimal(val)
+                            }
+
+                            // We shouldn't have null here, but handle it just in case.
+                            Basic::Null => PValue::Null,
+                        };
+
+                        // Validate the value, if we have a validation expression.
+                        if let Some(validation) = validation.as_ref() {
+                            if let Err(err) = validation.validate_pval(&val) {
+                                return Err(api::Error {
+                                    code: api::ErrCode::InvalidArgument,
+                                    message: format!("invalid path parameter {name}: {err}"),
+                                    internal_message: None,
+                                    stack: None,
+                                    details: None,
+                                });
+                            }
+                        }
+
+                        map.insert(name, val);
+                    }
+                }
+
+                Ok(Some(map))
+            }
+            Err(err) => Err(match err {
+                PathRejection::FailedToDeserializePathParams(err) => api::Error {
+                    code: api::ErrCode::InvalidArgument,
+                    message: "unable to parse path params".into(),
+                    internal_message: Some(err.to_string()),
+                    stack: None,
+                    details: None,
+                },
+                PathRejection::MissingPathParams(err) => api::Error {
+                    code: api::ErrCode::InvalidArgument,
+                    message: "missing path params".into(),
+                    internal_message: Some(err.to_string()),
+                    stack: None,
+                    details: None,
+                },
+                err => api::Error {
+                    code: api::ErrCode::Internal,
+                    message: "unable to parse path params".into(),
+                    internal_message: Some(err.to_string()),
+                    stack: None,
+                    details: None,
+                },
+            }),
+        }
+    }
+}
+
+struct FuturePendingError;
+
+fn resolve_immediate_future<F, T>(mut fut: F) -> Result<T, FuturePendingError>
+where
+    F: Future<Output = T> + Unpin,
+{
+    let waker = noop_waker();
+    let mut cx = std::task::Context::from_waker(&waker);
+
+    match Pin::new(&mut fut).poll(&mut cx) {
+        Poll::Ready(value) => Ok(value),
+        Poll::Pending => Err(FuturePendingError),
+    }
+}
+
+fn noop_waker() -> Waker {
+    const VTABLE: RawWakerVTable = RawWakerVTable::new(
+        // Cloning just returns a new no-op raw waker
+        |_| RAW,
+        // `wake` does nothing
+        |_| {},
+        // `wake_by_ref` does nothing
+        |_| {},
+        // Dropping does nothing as we don't allocate anything
+        |_| {},
+    );
+    const RAW: RawWaker = RawWaker::new(ptr::null(), &VTABLE);
+
+    // SAFETY: This is copied from https://github.com/rust-lang/rust/pull/96875.
+    unsafe { Waker::from_raw(RAW) }
+}
diff --git a/runtimes/core/src/api/schema/query.rs b/runtimes/core/src/api/schema/query.rs
new file mode 100644
index 0000000000..df543fffe3
--- /dev/null
+++ b/runtimes/core/src/api/schema/query.rs
@@ -0,0 +1,163 @@
+use std::str::FromStr;
+
+use crate::api::jsonschema::DecodeConfig;
+use crate::api::schema::{JSONPayload, ToOutgoingRequest};
+use crate::api::{self, PValues};
+use crate::api::{jsonschema, APIResult};
+use serde::Serialize;
+use url::Url;
+
+#[derive(Debug, Clone)]
+pub struct Query {
+    schema: jsonschema::JSONSchema,
+}
+
+impl Query {
+    pub fn new(schema: jsonschema::JSONSchema) -> Self {
+        Self { schema }
+    }
+
+    pub fn parse_incoming_request_parts(
+        &self,
+        req: &axum::http::request::Parts,
+    ) -> APIResult<Option<PValues>> {
+        self.parse(req.uri.query())
+    }
+
+    pub fn parse(&self, query: Option<&str>) -> APIResult<Option<PValues>> {
+        let parsed = form_urlencoded::parse(query.unwrap_or_default().as_bytes());
+        let de = serde_urlencoded::Deserializer::new(parsed);
+        let cfg = DecodeConfig {
+            coerce_strings: true,
+            arrays_as_repeated_fields: true,
+        };
+
+        let decoded = self
+            .schema
+            .deserialize(de, cfg)
+            .map_err(|e| api::Error::invalid_argument("unable to decode query string", e))?;
+
+        Ok(Some(decoded))
+    }
+
+    pub fn contains_name(&self, name: &str) -> bool {
+        self.schema.root().contains_name(name)
+    }
+
+    pub fn contains_any(&self, query: &[u8]) -> bool {
+        let schema = &self.schema.root();
+        if schema.is_empty() {
+            return false;
+        }
+
+        let parsed = form_urlencoded::parse(query);
+        for (key, val) in parsed {
+            // Only consider non-empty values to be present.
+            if !val.is_empty() && schema.contains_name(key.as_ref()) {
+                return true;
+            }
+        }
+
+        false
+    }
+
+    pub fn len(&self) -> usize {
+        self.schema.root().fields.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    pub fn fields(&self) -> impl Iterator<Item = (&String, &jsonschema::Field)> {
+        self.schema.root().fields.iter()
+    }
+}
+
+impl ToOutgoingRequest<http::Request<()>> for Query {
+    fn to_outgoing_request(
+        &self,
+        payload: &mut JSONPayload,
+        req: &mut http::Request<()>,
+    ) -> APIResult<()> {
+        let Some(payload) = payload else {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "missing query parameters".to_string(),
+                internal_message: Some("missing query parameters".to_string()),
+                stack: None,
+                details: None,
+            });
+        };
+
+        // Serialize the payload.
+        let mut url = Url::parse(&req.uri().to_string()).map_err(api::Error::internal)?;
+
+        {
+            let mut pairs = url.query_pairs_mut();
+            let serializer = serde_urlencoded::Serializer::new(&mut pairs);
+
+            flatten_payload(payload)
+                .serialize(serializer)
+                .map_err(api::Error::internal)?;
+        }
+
+        *req.uri_mut() = http::Uri::from_str(url.as_str()).map_err(api::Error::internal)?;
+
+        Ok(())
+    }
+}
+
+impl ToOutgoingRequest<reqwest::Request> for Query {
+    fn to_outgoing_request(
+        &self,
+        payload: &mut JSONPayload,
+        req: &mut reqwest::Request,
+    ) -> APIResult<()> {
+        if self.schema.root().is_empty() {
+            return Ok(());
+        }
+
+        let Some(payload) = payload else {
+            return Err(api::Error {
+                code: api::ErrCode::InvalidArgument,
+                message: "missing query parameters".to_string(),
+                internal_message: Some("missing query parameters".to_string()),
+                stack: None,
+                details: None,
+            });
+        };
+
+        // Serialize the payload.
+        {
+            let url = req.url_mut();
+            let mut pairs = url.query_pairs_mut();
+            let serializer = serde_urlencoded::Serializer::new(&mut pairs);
+
+            flatten_payload(payload)
+                .serialize(serializer)
+                .map_err(api::Error::internal)?;
+        }
+
+        // If the query string is now empty, set it to None.
+        if let Some("") = req.url().query() {
+            req.url_mut().set_query(None);
+        }
+
+        Ok(())
+    }
+}
+
+// Flatten arrays into multi-fields for serde_urlencoded
+fn flatten_payload(payload: &PValues) -> Vec<(&String, &api::PValue)> {
+    payload
+        .iter()
+        .flat_map(|(k, v)| {
+            if let api::PValue::Array(vec) = v {
+                vec.iter().map(|val| (k, val)).collect()
+            } else {
+                vec![(k, v)]
+            }
+        })
+        .collect()
+}
diff --git a/runtimes/core/src/api/server.rs b/runtimes/core/src/api/server.rs
new file mode 100644
index 0000000000..3c922fbf49
--- /dev/null
+++ b/runtimes/core/src/api/server.rs
@@ -0,0 +1,327 @@
+use std::collections::HashMap;
+use std::fmt::Debug;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::atomic::AtomicUsize;
+use std::sync::{Arc, Mutex, RwLock};
+
+use crate::api::endpoint::{EndpointHandler, SharedEndpointData};
+use crate::api::paths::Pather;
+use crate::api::reqauth::svcauth;
+use crate::api::static_assets::StaticAssetsHandler;
+use crate::api::{self, ToResponse};
+use crate::api::{paths, reqauth, schema, BoxedHandler, EndpointMap};
+use crate::encore::parser::meta::v1 as meta;
+use crate::names::EndpointName;
+use crate::trace;
+
+use super::jsonschema::JSONSchema;
+
+/// An alias for the concrete type of a server handler.
+type ServerHandler = ReplaceableHandler<EndpointHandler>;
+
+/// Server is an API server. It serves the registered API endpoints.
+///
+/// When running tests there's not a single entrypoint, so the server
+/// is designed to support incrementally adding endpoints.
+///
+/// We handle this by registering all handlers with axum up-front, and add
+/// the handler once it has been registered.
+#[derive(Debug)]
+pub struct Server {
+    endpoints: Arc<EndpointMap>,
+
+    hosted_endpoints: Mutex<HashMap<EndpointName, ServerHandler>>,
+
+    router: Mutex<Option<axum::Router>>,
+
+    /// Data shared between all endpoints.
+    shared: Arc<SharedEndpointData>,
+}
+
+impl Server {
+    pub fn new(
+        endpoints: Arc<EndpointMap>,
+        hosted_endpoints: Vec<EndpointName>,
+        platform_auth: Arc<reqauth::platform::RequestValidator>,
+        inbound_svc_auth: Vec<Arc<dyn svcauth::ServiceAuthMethod>>,
+        tracer: trace::Tracer,
+        auth_data_schemas: HashMap<String, Option<JSONSchema>>,
+    ) -> anyhow::Result<Self> {
+        // Register the routes, and track the handlers in a map so we can easily
+        // set the request handler when registered.
+        let mut router = axum::Router::new();
+
+        async fn not_found_handler(
+            req: axum::http::Request<axum::body::Body>,
+        ) -> axum::response::Response<axum::body::Body> {
+            api::Error {
+                code: api::ErrCode::NotFound,
+                message: "endpoint not found".to_string(),
+                internal_message: Some(format!("no such endpoint exists: {}", req.uri().path())),
+                stack: None,
+                details: None,
+            }
+            .to_response(None)
+        }
+
+        let mut fallback_router = axum::Router::new();
+        fallback_router = fallback_router.fallback(not_found_handler);
+
+        let mut handler_map = HashMap::with_capacity(hosted_endpoints.len());
+        let path_set = paths::compute(hosted_endpoints.iter().map(|ep| EndpointPathResolver {
+            ep: endpoints.get(ep).unwrap().to_owned(),
+        }));
+
+        let shared = Arc::new(SharedEndpointData {
+            tracer,
+            platform_auth,
+            inbound_svc_auth,
+            auth_data_schemas,
+        });
+
+        let mut register = |paths: &[(Arc<api::Endpoint>, Vec<String>)],
+                            mut router: axum::Router|
+         -> axum::Router {
+            for (ep, paths) in paths {
+                match schema::method_filter(ep.methods()) {
+                    Some(filter) => {
+                        let server_handler = ServerHandler::default();
+
+                        if let Some(assets) = &ep.static_assets {
+                            // For static asset routes, configure the static asset handler directly.
+                            // There's no need to defer it for dynamic runtime registration.
+                            let static_handler = StaticAssetsHandler::new(assets);
+
+                            let handler = EndpointHandler {
+                                endpoint: ep.clone(),
+                                handler: Arc::new(static_handler),
+                                shared: shared.clone(),
+                            };
+                            server_handler.set(handler);
+                        }
+
+                        let handler = axum::routing::on(filter, server_handler.clone());
+                        for path in paths {
+                            router = router.route(path, handler.clone());
+                        }
+                        handler_map.insert(ep.name.clone(), server_handler);
+                    }
+                    None => {
+                        log::warn!("no methods for endpoint {}, skipping", ep.name,);
+                    }
+                }
+            }
+            router
+        };
+
+        if let Some(main_paths) = path_set.main.get(&()) {
+            router = register(main_paths, router);
+        }
+        if let Some(fallback_paths) = path_set.fallback.get(&()) {
+            fallback_router = register(fallback_paths, fallback_router);
+        }
+
+        // Register our fallback route.
+        router = router.fallback_service(fallback_router);
+
+        Ok(Self {
+            endpoints,
+            hosted_endpoints: Mutex::new(handler_map),
+            router: Mutex::new(Some(router)),
+            shared,
+        })
+    }
+
+    pub fn router(&self) -> axum::Router {
+        self.router.lock().unwrap().as_ref().unwrap().clone()
+    }
+
+    /// Registers a handler for the given endpoint.
+    /// Reports an error if the handler was not found.
+    pub fn register_handler(
+        &self,
+        endpoint_name: EndpointName,
+        handler: Arc<dyn BoxedHandler>,
+    ) -> anyhow::Result<()> {
+        match self
+            .hosted_endpoints
+            .lock()
+            .unwrap()
+            .get_mut(&endpoint_name)
+        {
+            None => Ok(()), // anyhow::bail!("no handler found for endpoint: {}", endpoint_name),
+            Some(h) => {
+                let endpoint = self.endpoints.get(&endpoint_name).unwrap().to_owned();
+
+                let handler = EndpointHandler {
+                    endpoint,
+                    handler,
+                    shared: self.shared.clone(),
+                };
+
+                h.add(handler);
+                Ok(())
+            }
+        }
+    }
+}
+
+struct EndpointPathResolver {
+    ep: Arc<api::Endpoint>,
+}
+
+impl Pather for EndpointPathResolver {
+    type Key = ();
+    type Value = Arc<api::Endpoint>;
+
+    fn key(&self) {}
+
+    fn value(&self) -> Self::Value {
+        self.ep.clone()
+    }
+
+    fn path(&self) -> &meta::Path {
+        &self.ep.path
+    }
+}
+
+#[derive(Debug)]
+struct LoadBalancingHandler<H> {
+    handlers: Vec<H>,
+    counter: AtomicUsize,
+}
+
+impl<H> Default for LoadBalancingHandler<H> {
+    fn default() -> Self {
+        Self {
+            handlers: Vec::new(),
+            counter: AtomicUsize::new(0),
+        }
+    }
+}
+
+impl<H> LoadBalancingHandler<H> {
+    pub fn single(handler: H) -> Self {
+        Self {
+            handlers: vec![handler],
+            counter: AtomicUsize::new(1),
+        }
+    }
+
+    pub fn add(&mut self, handler: H) {
+        self.handlers.push(handler);
+    }
+
+    pub fn len(&self) -> usize {
+        self.handlers.len()
+    }
+
+    pub fn next(&self) -> &H {
+        let n = self.handlers.len();
+        // If we have a single handler, skip the increment and modulo steps.
+        if n == 1 {
+            return &self.handlers[0];
+        }
+
+        // Atomically increment the counter, and then get the next handler.
+        let idx = self
+            .counter
+            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        &self.handlers[idx % n]
+    }
+}
+
+/// A replaceable handler is a handler that can be replaced at runtime.
+/// It is used to support incremental registration of endpoints.
+#[derive(Clone)]
+struct ReplaceableHandler<H> {
+    /// Underlying handler. The RwLock is used to be able to inject the underlying handler.
+    handler: Arc<RwLock<LoadBalancingHandler<H>>>,
+}
+
+impl<H> Debug for ReplaceableHandler<H> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ReplaceableHandler").finish()
+    }
+}
+
+impl<H> Default for ReplaceableHandler<H> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<H> ReplaceableHandler<H> {
+    pub fn new() -> Self {
+        Self {
+            handler: Arc::new(RwLock::default()),
+        }
+    }
+
+    /// Set sets the handler.
+    pub fn set(&self, handler: H) {
+        *self.handler.write().unwrap() = LoadBalancingHandler::single(handler);
+    }
+
+    /// Set sets the handler.
+    pub fn add(&self, handler: H) {
+        self.handler.write().unwrap().add(handler);
+    }
+}
+
+impl<H> axum::handler::Handler<(), ()> for ReplaceableHandler<H>
+where
+    H: axum::handler::Handler<(), ()> + Sync,
+{
+    type Future = MaybeHandlerFuture<H::Future>;
+
+    fn call(self, req: axum::extract::Request, state: ()) -> Self::Future {
+        let handlers = self.handler.read().unwrap();
+        match handlers.len() {
+            0 => MaybeHandlerFuture { fut: None },
+            _ => {
+                let handler = handlers.next().clone();
+                MaybeHandlerFuture {
+                    fut: Some(Box::pin(handler.call(req, state))),
+                }
+            }
+        }
+    }
+}
+
+/// A MaybeHandlerFuture is a future that may or may not have a future.
+/// If there is no future, it returns a 404 response.
+struct MaybeHandlerFuture<F> {
+    fut: Option<Pin<Box<F>>>,
+}
+
+impl<F> Future for MaybeHandlerFuture<F>
+where
+    F: Future<Output = axum::response::Response> + Send + 'static,
+{
+    type Output = axum::response::Response;
+
+    fn poll(
+        mut self: Pin<&mut Self>,
+        cx: &mut std::task::Context<'_>,
+    ) -> std::task::Poll<axum::response::Response> {
+        match self.fut.as_mut() {
+            // If we have a future, poll it.
+            Some(fut) => fut.as_mut().poll(cx),
+
+            // Otherwise we return a 404 response.
+            None => {
+                let resp = api::Error {
+                    code: api::ErrCode::NotFound,
+                    message: "endpoint not found".to_string(),
+                    internal_message: Some("no handler registered for endpoint".to_string()),
+                    stack: None,
+                    details: None,
+                }
+                .to_response(None);
+                std::task::Poll::Ready(resp)
+            }
+        }
+    }
+}
diff --git a/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__basic.snap b/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__basic.snap
new file mode 100644
index 0000000000..7b7054da16
--- /dev/null
+++ b/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__basic.snap
@@ -0,0 +1,13 @@
+---
+source: runtimes/core/src/api/paths.rs
+expression: paths
+---
+main:
+  a:
+    - - one
+      - - /foo
+        - /foo/
+    - - two
+      - - /foo/bar
+        - /foo/bar/
+fallback: {}
diff --git a/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__fallback.snap b/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__fallback.snap
new file mode 100644
index 0000000000..c04c6ec9e2
--- /dev/null
+++ b/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__fallback.snap
@@ -0,0 +1,10 @@
+---
+source: runtimes/core/src/api/paths.rs
+expression: paths
+---
+main: {}
+fallback:
+  a:
+    - - one
+      - - /
+        - /*foo
diff --git a/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__paths_to_register.snap b/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__paths_to_register.snap
new file mode 100644
index 0000000000..ca4c18dc53
--- /dev/null
+++ b/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__paths_to_register.snap
@@ -0,0 +1,13 @@
+---
+source: runtimes/core/src/api/paths.rs
+expression: paths
+---
+main:
+  a:
+    - endpoint:
+        key: a
+        path: /a
+      routes:
+        - /a
+        - /a/
+fallback: {}
diff --git a/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__tsr_conflict.snap b/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__tsr_conflict.snap
new file mode 100644
index 0000000000..12f8c63b08
--- /dev/null
+++ b/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__tsr_conflict.snap
@@ -0,0 +1,12 @@
+---
+source: runtimes/core/src/api/paths.rs
+expression: paths
+---
+main:
+  a:
+    - - one
+      - - /foo/
+  b:
+    - - two
+      - - /foo
+fallback: {}
diff --git a/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__wildcard.snap b/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__wildcard.snap
new file mode 100644
index 0000000000..4199debc80
--- /dev/null
+++ b/runtimes/core/src/api/snapshots/encore_runtime_core__api__paths__tests__wildcard.snap
@@ -0,0 +1,10 @@
+---
+source: runtimes/core/src/api/paths.rs
+expression: paths
+---
+main:
+  a:
+    - - one
+      - - /
+        - /*foo
+fallback: {}
diff --git a/runtimes/core/src/api/static_assets.rs b/runtimes/core/src/api/static_assets.rs
new file mode 100644
index 0000000000..3bba8e48ec
--- /dev/null
+++ b/runtimes/core/src/api/static_assets.rs
@@ -0,0 +1,167 @@
+use std::{convert::Infallible, future::Future, path::PathBuf, pin::Pin, sync::Arc};
+
+use http::StatusCode;
+use http_body_util::Empty;
+use std::fmt::Debug;
+use std::io;
+use tower_http::services::{fs::ServeDir, ServeFile};
+use tower_service::Service;
+
+use crate::{encore::parser::meta::v1 as meta, model::RequestData};
+
+use super::{BoxedHandler, Error, HandlerRequest, ResponseData};
+
+#[derive(Clone, Debug)]
+pub struct StaticAssetsHandler {
+    service: Arc<dyn FileServer>,
+    not_found_handler: bool,
+    not_found_status: StatusCode,
+}
+
+impl StaticAssetsHandler {
+    pub fn new(cfg: &meta::rpc::StaticAssets) -> Self {
+        let service = ServeDir::new(PathBuf::from(&cfg.dir_rel_path));
+
+        let not_found_status = cfg
+            .not_found_status
+            .and_then(|c| StatusCode::from_u16(c as u16).ok())
+            .unwrap_or(StatusCode::NOT_FOUND);
+
+        let not_found = cfg
+            .not_found_rel_path
+            .as_ref()
+            .map(|p| ServeFile::new(PathBuf::from(p)));
+        let not_found_handler = not_found.is_some();
+        let service: Arc<dyn FileServer> = match not_found {
+            Some(not_found) => Arc::new(service.not_found_service(not_found)),
+            None => Arc::new(service),
+        };
+        StaticAssetsHandler {
+            service,
+            not_found_handler,
+            not_found_status,
+        }
+    }
+}
+
+impl BoxedHandler for StaticAssetsHandler {
+    fn call(
+        self: Arc<Self>,
+        req: HandlerRequest,
+    ) -> Pin<Box<dyn Future<Output = ResponseData> + Send + 'static>> {
+        Box::pin(async move {
+            let RequestData::RPC(data) = &req.data else {
+                return ResponseData::Typed(Err(Error::internal(anyhow::anyhow!(
+                    "invalid request data type"
+                ))));
+            };
+
+            // Find the file path from the request.
+            let file_path = match &data.path_params {
+                Some(params) => params
+                    .values()
+                    .next()
+                    .and_then(|v| v.as_str())
+                    .map(|s| format!("/{s}"))
+                    .unwrap_or("/".to_string()),
+                None => "/".to_string(),
+            };
+
+            let httpreq = {
+                let mut b = axum::http::request::Request::builder();
+                {
+                    // Copy headers into request.
+                    let headers = b.headers_mut().unwrap();
+                    for (k, v) in &data.req_headers {
+                        headers.append(k.clone(), v.clone());
+                    }
+                }
+                match b
+                    .method(data.method)
+                    .uri(file_path)
+                    .body(Empty::<bytes::Bytes>::new())
+                {
+                    Ok(req) => req,
+                    Err(e) => {
+                        return ResponseData::Typed(Err(Error::invalid_argument(
+                            "invalid file path",
+                            e,
+                        )));
+                    }
+                }
+            };
+
+            match self.service.serve(httpreq).await {
+                Ok(mut resp) => match resp.status() {
+                    // 1xx, 2xx, 3xx are all considered successful.
+                    code if code.is_informational()
+                        || code.is_success()
+                        || code.is_redirection() =>
+                    {
+                        ResponseData::Raw(resp.map(axum::body::Body::new))
+                    }
+                    axum::http::StatusCode::NOT_FOUND => {
+                        // If we have a not found handler, use that directly.
+                        if self.not_found_handler {
+                            *resp.status_mut() = self.not_found_status;
+                            ResponseData::Raw(resp.map(axum::body::Body::new))
+                        } else {
+                            // Otherwise return our standard not found error.
+                            ResponseData::Typed(Err(Error::not_found("file not found")))
+                        }
+                    }
+                    axum::http::StatusCode::METHOD_NOT_ALLOWED => ResponseData::Typed(Err(Error {
+                        code: super::ErrCode::InvalidArgument,
+                        internal_message: None,
+                        message: "method not allowed".to_string(),
+                        stack: None,
+                        details: None,
+                    })),
+                    axum::http::StatusCode::INTERNAL_SERVER_ERROR => {
+                        ResponseData::Typed(Err(Error {
+                            code: super::ErrCode::Internal,
+                            internal_message: None,
+                            message: "failed to serve static asset".to_string(),
+                            stack: None,
+                            details: None,
+                        }))
+                    }
+                    code => ResponseData::Typed(Err(Error::internal(anyhow::anyhow!(
+                        "failed to serve static asset: {}",
+                        code,
+                    )))),
+                },
+                Err(e) => ResponseData::Typed(Err(Error::internal(e))),
+            }
+        })
+    }
+}
+
+trait FileServer: Sync + Send + Debug {
+    fn serve(
+        &self,
+        req: axum::http::Request<Empty<bytes::Bytes>>,
+    ) -> Pin<Box<dyn Future<Output = Result<FileRes, io::Error>> + Send + 'static>>;
+}
+
+type FileReq = axum::http::Request<Empty<bytes::Bytes>>;
+type FileRes = axum::http::Response<tower_http::services::fs::ServeFileSystemResponseBody>;
+
+impl<F> FileServer for ServeDir<F>
+where
+    F: Service<FileReq, Response = FileRes, Error = Infallible>
+        + Debug
+        + Clone
+        + Sync
+        + Send
+        + 'static,
+    F::Future: Send + 'static,
+{
+    fn serve(
+        &self,
+        req: axum::http::Request<Empty<bytes::Bytes>>,
+    ) -> Pin<Box<dyn Future<Output = Result<FileRes, io::Error>> + Send + 'static>> {
+        let mut this = self.clone();
+        Box::pin(async move { this.try_call(req).await })
+    }
+}
diff --git a/runtimes/core/src/api/websocket.rs b/runtimes/core/src/api/websocket.rs
new file mode 100644
index 0000000000..00c573d112
--- /dev/null
+++ b/runtimes/core/src/api/websocket.rs
@@ -0,0 +1,281 @@
+use std::sync::Arc;
+
+use anyhow::{anyhow, Context};
+use axum::extract::ws::{Message, WebSocket};
+use futures::Future;
+use tokio::sync::{
+    mpsc::{self, UnboundedReceiver, UnboundedSender},
+    watch,
+};
+
+use crate::model::{self, Request, RequestData};
+
+use super::{schema, APIResult, HandlerResponse, HandlerResponseInner, PValues};
+
+pub enum StreamMessagePayload {
+    InOut(Socket),
+    Out(Sink),
+    In(Stream),
+}
+
+pub fn upgrade_request<C, Fut>(
+    req: Arc<Request>,
+    callback: C,
+) -> APIResult<axum::response::Response>
+where
+    C: FnOnce(Arc<Request>, StreamMessagePayload, UnboundedSender<HandlerResponse>) -> Fut
+        + Send
+        + 'static,
+    Fut: Future<Output = ()> + Send + 'static,
+{
+    let RequestData::Stream(ref data) = req.data else {
+        return Err(super::Error::internal(anyhow!(
+            "wrong request data type for stream"
+        )));
+    };
+
+    let req_schema = data
+        .endpoint
+        .request
+        .first()
+        .context("no request schema")
+        .map_err(super::Error::internal)?
+        .clone();
+
+    let resp_schema = data.endpoint.response.clone();
+
+    let upgrade = {
+        if let Some(upgrade) = data
+            .websocket_upgrade
+            .lock()
+            .expect("mutex poisoned")
+            .take()
+        {
+            upgrade
+        } else {
+            return Err(super::Error::internal(anyhow!(
+                "websocket already upgraded"
+            )));
+        }
+    };
+
+    let (tx, mut rx) = mpsc::unbounded_channel::<HandlerResponse>();
+
+    let direction = data.direction;
+    Ok(upgrade
+        .protocols(["encore-ws"])
+        .on_failed_upgrade(|err| log::debug!("websocket upgrade failed: {err}"))
+        .on_upgrade(move |ws| async move {
+            let socket = Socket::new(ws, schema::Stream::new(req_schema, resp_schema).into());
+
+            let payload = match direction {
+                model::StreamDirection::InOut => StreamMessagePayload::InOut(socket),
+                model::StreamDirection::In => {
+                    let (sink, stream) = socket.split();
+
+                    tokio::spawn(async move {
+                        match rx.recv().await {
+                            Some(resp) => match resp {
+                                Ok(HandlerResponseInner {
+                                    payload: Some(resp),
+                                    ..
+                                }) => {
+                                    if sink.send(resp).is_err() {
+                                        log::debug!("sink channel closed");
+                                    }
+                                }
+                                Ok(HandlerResponseInner { payload: None, .. }) => {
+                                    log::warn!("responded with empty response")
+                                }
+                                Err(err) => log::warn!("responded with error: {err:?}"),
+                            },
+                            None => log::debug!("response channel closed"),
+                        };
+                    });
+
+                    StreamMessagePayload::In(stream)
+                }
+                model::StreamDirection::Out => {
+                    let (sink, _stream) = socket.split();
+                    StreamMessagePayload::Out(sink)
+                }
+            };
+
+            (callback)(req, payload, tx).await
+        }))
+}
+
+pub struct Socket {
+    outgoing_message_tx: UnboundedSender<PValues>,
+    incoming_message_rx: tokio::sync::Mutex<UnboundedReceiver<PValues>>,
+    shutdown: watch::Sender<bool>,
+}
+
+impl Socket {
+    fn new(mut websocket: WebSocket, schema: Arc<schema::Stream>) -> Self {
+        let (shutdown, mut shutdown_watch) = watch::channel(false);
+
+        let (outgoing_message_tx, mut outgoing_messages_rx) = mpsc::unbounded_channel();
+        let (incoming_messages_tx, incoming_message_rx) = mpsc::unbounded_channel();
+
+        tokio::spawn({
+            async move {
+                loop {
+                    tokio::select! {
+                        msg = websocket.recv() => match msg {
+                            None => {
+                                log::trace!("websocket closed");
+                                break
+                            },
+                            Some(Ok(msg)) => {
+                                if let Err(e) = Socket::handle_incoming_message(
+                                    &schema,
+                                    &incoming_messages_tx,
+                                    msg,
+                                )
+                                .await
+                                {
+                                    log::warn!("failed handling incoming message: {e}");
+                                    break;
+                                }
+                            },
+                            Some(Err(e)) => {
+                                log::debug!("websocket receive failed: {e}");
+                                break;
+                            }
+                        },
+                        msg = outgoing_messages_rx.recv() => {
+                            match msg {
+                                None => {
+                                    _ = websocket.close().await;
+                                    log::trace!("websocket closed");
+                                    break;
+                                }
+                                Some(msg) => Socket::handle_outgoing_message(&schema, &mut websocket, msg).await
+                            }
+                        },
+                        _ = shutdown_watch.changed() => {
+                            // gracefully shutdown, wait for all messages to be read on out channel
+                            // before closing the websocket
+                            outgoing_messages_rx.close();
+                        }
+                    }
+                }
+
+                log::trace!("socket closed");
+            }
+        });
+
+        Socket {
+            outgoing_message_tx,
+            incoming_message_rx: tokio::sync::Mutex::new(incoming_message_rx),
+            shutdown,
+        }
+    }
+
+    pub fn send(&self, msg: PValues) -> anyhow::Result<()> {
+        self.outgoing_message_tx.send(msg)?;
+        Ok(())
+    }
+
+    pub async fn recv(&self) -> Option<PValues> {
+        self.incoming_message_rx.lock().await.recv().await
+    }
+
+    pub fn close(&self) {
+        _ = self.shutdown.send(true);
+    }
+
+    pub fn split(self) -> (Sink, Stream) {
+        let Self {
+            outgoing_message_tx: tx,
+            incoming_message_rx: rx,
+            shutdown,
+        } = self;
+
+        let sink = Sink { tx, shutdown };
+        let stream = Stream { rx };
+
+        (sink, stream)
+    }
+
+    async fn handle_outgoing_message(
+        schema: &schema::Stream,
+        websocket: &mut WebSocket,
+        msg: PValues,
+    ) {
+        let msg = schema
+            .to_outgoing_message(msg)
+            .and_then(|msg| String::from_utf8(msg).map_err(super::Error::internal));
+
+        match msg {
+            Ok(msg) => {
+                if let Err(e) = websocket.send(Message::Text(msg)).await {
+                    log::debug!("failed to send message to socket: {e}")
+                }
+            }
+            Err(e) => log::warn!("failed to send message to socket: {e}"),
+        }
+    }
+
+    async fn handle_incoming_message<M>(
+        schema: &schema::Stream,
+        incoming: &UnboundedSender<PValues>,
+        msg: M,
+    ) -> anyhow::Result<()>
+    where
+        M: MessagePayload,
+    {
+        if let Some(data) = msg.payload() {
+            match schema.parse_incoming_message(data).await {
+                Ok(msg) => {
+                    if let Err(e) = incoming.send(msg) {
+                        return Err(anyhow!("tried to send on closed channel: {e}"));
+                    }
+                }
+                Err(e) => log::warn!("failed to parse incoming message: {e}"),
+            };
+        }
+
+        Ok(())
+    }
+}
+
+trait MessagePayload {
+    fn payload(&self) -> Option<&[u8]>;
+}
+
+impl MessagePayload for axum::extract::ws::Message {
+    fn payload(&self) -> Option<&[u8]> {
+        match self {
+            Message::Text(text) => Some(text.as_bytes()),
+            Message::Binary(data) => Some(data),
+            // these message types are handled by axum
+            Message::Ping(_) | Message::Pong(_) | Message::Close(_) => None,
+        }
+    }
+}
+pub struct Sink {
+    tx: UnboundedSender<PValues>,
+    shutdown: watch::Sender<bool>,
+}
+
+impl Sink {
+    pub fn send(&self, msg: PValues) -> anyhow::Result<()> {
+        self.tx.send(msg)?;
+        Ok(())
+    }
+
+    pub fn close(&self) {
+        _ = self.shutdown.send(true);
+    }
+}
+
+pub struct Stream {
+    rx: tokio::sync::Mutex<UnboundedReceiver<PValues>>,
+}
+impl Stream {
+    pub async fn recv(&self) -> Option<PValues> {
+        self.rx.lock().await.recv().await
+    }
+}
diff --git a/runtimes/core/src/api/websocket_client.rs b/runtimes/core/src/api/websocket_client.rs
new file mode 100644
index 0000000000..475f004b53
--- /dev/null
+++ b/runtimes/core/src/api/websocket_client.rs
@@ -0,0 +1,147 @@
+use std::sync::Arc;
+
+use futures::sink::SinkExt;
+use futures::stream::SplitSink;
+use futures::stream::SplitStream;
+use futures::stream::StreamExt;
+use tokio::net::TcpStream;
+use tokio::sync::mpsc::UnboundedReceiver;
+use tokio::sync::mpsc::UnboundedSender;
+use tokio::sync::watch;
+use tokio::sync::Mutex;
+use tokio_tungstenite::MaybeTlsStream;
+use tokio_tungstenite::{tungstenite::Message, WebSocketStream};
+
+use super::schema;
+use super::APIResult;
+use super::PValues;
+
+pub struct WebSocketClient {
+    send_channel: UnboundedSender<Message>,
+    receive_channel: Mutex<UnboundedReceiver<Message>>,
+    shutdown: watch::Sender<bool>,
+    schema: Arc<schema::Stream>,
+}
+
+impl WebSocketClient {
+    pub async fn connect(
+        request: http::Request<()>,
+        schema: schema::Stream,
+    ) -> APIResult<WebSocketClient> {
+        let (connection, _resp) = tokio_tungstenite::connect_async(request)
+            .await
+            .map_err(|e| super::Error {
+                code: super::ErrCode::Unknown,
+                message: "failed connecting to websocket endpoint".to_string(),
+                internal_message: Some(e.to_string()),
+                stack: None,
+                details: None,
+            })?;
+
+        let (ws_write, ws_read) = connection.split();
+
+        let (send_channel_tx, send_channel_rx) = tokio::sync::mpsc::unbounded_channel();
+        let (receive_channel_tx, receive_channel_rx) = tokio::sync::mpsc::unbounded_channel();
+
+        let (shutdown, shutdown_watch) = watch::channel(false);
+
+        tokio::spawn(send_to_ws(send_channel_rx, ws_write, shutdown_watch));
+        tokio::spawn(ws_to_receive(ws_read, receive_channel_tx));
+
+        Ok(WebSocketClient {
+            send_channel: send_channel_tx,
+            receive_channel: Mutex::new(receive_channel_rx),
+            shutdown,
+            schema: schema.into(),
+        })
+    }
+
+    pub fn send(&self, msg: PValues) -> APIResult<()> {
+        let msg = self.schema.to_outgoing_message(msg)?;
+        let msg = String::from_utf8(msg).map_err(super::Error::internal)?;
+
+        self.send_channel
+            .send(Message::Text(msg))
+            .map_err(super::Error::internal)?;
+
+        Ok(())
+    }
+
+    pub async fn recv(&self) -> Option<APIResult<PValues>> {
+        loop {
+            let msg = self.receive_channel.lock().await.recv().await;
+
+            let bytes: bytes::Bytes = match msg {
+                Some(Message::Text(msg)) => msg.into(),
+                Some(Message::Binary(vec)) => vec.into(),
+                Some(_msg) => continue,
+                None => return None,
+            };
+
+            return Some(self.schema.parse_incoming_message(&bytes).await);
+        }
+    }
+
+    pub fn close(&self) {
+        if let Err(err) = self.shutdown.send(true) {
+            log::trace!("error sending shutdown signal: {err}");
+        }
+    }
+}
+
+async fn send_to_ws(
+    mut rx: UnboundedReceiver<Message>,
+    mut ws: SplitSink<WebSocketStream<MaybeTlsStream<TcpStream>>, Message>,
+    mut shutdown: watch::Receiver<bool>,
+) {
+    loop {
+        tokio::select! {
+            _ = shutdown.changed() => {
+                rx.close()
+            },
+            msg = rx.recv() => match msg {
+                Some(msg) => {
+                    if let Err(err) = ws.send(msg).await {
+                        log::debug!("failed sending over websocket: {err}");
+                    }
+                },
+                None => {
+                    log::trace!("receive channel closed, shutting down");
+
+                    if let Err(err) = ws.close().await {
+                        log::trace!("closing websocket failed: {err}");
+                    }
+
+                    break;
+                },
+
+            },
+        }
+    }
+}
+
+async fn ws_to_receive(
+    mut ws: SplitStream<WebSocketStream<MaybeTlsStream<TcpStream>>>,
+    tx: UnboundedSender<Message>,
+) {
+    loop {
+        let msg = ws.next().await;
+
+        match msg {
+            Some(Ok(msg)) => {
+                if let Err(err) = tx.send(msg) {
+                    log::warn!("failed sending to receive channel: {err}");
+                    break;
+                }
+            }
+            Some(Err(err)) => {
+                log::debug!("received an error from websocket: {err}");
+                break;
+            }
+            None => {
+                log::trace!("websocket closed, shutting down");
+                break;
+            }
+        }
+    }
+}
diff --git a/runtimes/core/src/base32.rs b/runtimes/core/src/base32.rs
new file mode 100644
index 0000000000..399fb93076
--- /dev/null
+++ b/runtimes/core/src/base32.rs
@@ -0,0 +1,296 @@
+use std::cmp::min;
+
+#[derive(Copy, Clone)]
+pub enum Alphabet {
+    #[allow(dead_code)]
+    RFC4648 {
+        padding: bool,
+    },
+    #[allow(dead_code)]
+    Crockford,
+    Encore,
+}
+
+const RFC4648_ALPHABET: &[u8] = b"ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+const CROCKFORD_ALPHABET: &[u8] = b"0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+const ENCORE_ALPHABET: &[u8] = b"0123456789abcdefghijklmnopqrstuv";
+
+pub fn encode(alphabet: Alphabet, data: &[u8]) -> String {
+    let (alphabet, padding) = match alphabet {
+        Alphabet::RFC4648 { padding } => (RFC4648_ALPHABET, padding),
+        Alphabet::Crockford => (CROCKFORD_ALPHABET, false),
+        Alphabet::Encore => (ENCORE_ALPHABET, false),
+    };
+    let mut ret = Vec::with_capacity(data.len().div_ceil(4) * 5);
+
+    for chunk in data.chunks(5) {
+        let buf = {
+            let mut buf = [0u8; 5];
+            for (i, &b) in chunk.iter().enumerate() {
+                buf[i] = b;
+            }
+            buf
+        };
+        ret.push(alphabet[((buf[0] & 0xF8) >> 3) as usize]);
+        ret.push(alphabet[(((buf[0] & 0x07) << 2) | ((buf[1] & 0xC0) >> 6)) as usize]);
+        ret.push(alphabet[((buf[1] & 0x3E) >> 1) as usize]);
+        ret.push(alphabet[(((buf[1] & 0x01) << 4) | ((buf[2] & 0xF0) >> 4)) as usize]);
+        ret.push(alphabet[(((buf[2] & 0x0F) << 1) | (buf[3] >> 7)) as usize]);
+        ret.push(alphabet[((buf[3] & 0x7C) >> 2) as usize]);
+        ret.push(alphabet[(((buf[3] & 0x03) << 3) | ((buf[4] & 0xE0) >> 5)) as usize]);
+        ret.push(alphabet[(buf[4] & 0x1F) as usize]);
+    }
+
+    if !data.len().is_multiple_of(5) {
+        let len = ret.len();
+        let num_extra = 8 - (data.len() % 5 * 8).div_ceil(5);
+        if padding {
+            for i in 1..num_extra + 1 {
+                ret[len - i] = b'=';
+            }
+        } else {
+            ret.truncate(len - num_extra);
+        }
+    }
+
+    String::from_utf8(ret).unwrap()
+}
+
+const RFC4648_INV_ALPHABET: [i8; 43] = [
+    -1, -1, 26, 27, 28, 29, 30, 31, -1, -1, -1, -1, -1, 0, -1, -1, -1, 0, 1, 2, 3, 4, 5, 6, 7, 8,
+    9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25,
+];
+const CROCKFORD_INV_ALPHABET: [i8; 43] = [
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, -1, -1, -1, -1, -1, -1, -1, 10, 11, 12, 13, 14, 15, 16, 17, 1,
+    18, 19, 1, 20, 21, 0, 22, 23, 24, 25, 26, -1, 27, 28, 29, 30, 31,
+];
+const ENCORE_INV_ALPHABET: [i8; 43] = [
+    0, 1, 2, 3, 4, 5, 6, 7, 8, 9, -1, -1, -1, -1, -1, -1, -1, 10, 11, 12, 13, 14, 15, 16, 17, 18,
+    19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, -1, -1, -1, -1,
+];
+
+pub fn decode(alphabet: Alphabet, data: &str) -> Option<Vec<u8>> {
+    if !data.is_ascii() {
+        return None;
+    }
+    let data = data.as_bytes();
+    let alphabet = match alphabet {
+        Alphabet::RFC4648 { .. } => RFC4648_INV_ALPHABET,
+        Alphabet::Crockford => CROCKFORD_INV_ALPHABET,
+        Alphabet::Encore => ENCORE_INV_ALPHABET,
+    };
+    let mut unpadded_data_length = data.len();
+    for i in 1..min(6, data.len()) + 1 {
+        if data[data.len() - i] != b'=' {
+            break;
+        }
+        unpadded_data_length -= 1;
+    }
+    let output_length = unpadded_data_length * 5 / 8;
+    let mut ret = Vec::with_capacity(output_length.div_ceil(5) * 5);
+    for chunk in data.chunks(8) {
+        let buf = {
+            let mut buf = [0u8; 8];
+            for (i, &c) in chunk.iter().enumerate() {
+                match alphabet.get(c.to_ascii_uppercase().wrapping_sub(b'0') as usize) {
+                    Some(&-1) | None => return None,
+                    Some(&value) => buf[i] = value as u8,
+                };
+            }
+            buf
+        };
+        ret.push((buf[0] << 3) | (buf[1] >> 2));
+        ret.push((buf[1] << 6) | (buf[2] << 1) | (buf[3] >> 4));
+        ret.push((buf[3] << 4) | (buf[4] >> 1));
+        ret.push((buf[4] << 7) | (buf[5] << 2) | (buf[6] >> 3));
+        ret.push((buf[6] << 5) | buf[7]);
+    }
+    ret.truncate(output_length);
+    Some(ret)
+}
+
+#[cfg(test)]
+#[allow(dead_code, unused_attributes)]
+mod test {
+    use super::Alphabet::{Crockford, Encore, RFC4648};
+    use super::{decode, encode};
+
+    #[derive(Clone)]
+    struct B32 {
+        c: u8,
+    }
+
+    impl quickcheck::Arbitrary for B32 {
+        fn arbitrary(g: &mut quickcheck::Gen) -> B32 {
+            let alphabet = b"0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+            B32 {
+                c: *g.choose(alphabet).unwrap(),
+            }
+        }
+    }
+
+    impl std::fmt::Debug for B32 {
+        fn fmt(&self, f: &mut std::fmt::Formatter) -> Result<(), std::fmt::Error> {
+            (self.c as char).fmt(f)
+        }
+    }
+
+    #[test]
+    fn masks_crockford() {
+        assert_eq!(
+            encode(Crockford, &[0xF8, 0x3E, 0x0F, 0x83, 0xE0]),
+            "Z0Z0Z0Z0"
+        );
+        assert_eq!(
+            encode(Crockford, &[0x07, 0xC1, 0xF0, 0x7C, 0x1F]),
+            "0Z0Z0Z0Z"
+        );
+        assert_eq!(
+            decode(Crockford, "Z0Z0Z0Z0").unwrap(),
+            [0xF8, 0x3E, 0x0F, 0x83, 0xE0]
+        );
+        assert_eq!(
+            decode(Crockford, "0Z0Z0Z0Z").unwrap(),
+            [0x07, 0xC1, 0xF0, 0x7C, 0x1F]
+        );
+    }
+
+    #[test]
+    fn masks_rfc4648() {
+        assert_eq!(
+            encode(RFC4648 { padding: true }, &[0xF8, 0x3E, 0x7F, 0x83, 0xE7]),
+            "7A7H7A7H"
+        );
+        assert_eq!(
+            encode(RFC4648 { padding: true }, &[0x77, 0xC1, 0xF7, 0x7C, 0x1F]),
+            "O7A7O7A7"
+        );
+        assert_eq!(
+            decode(RFC4648 { padding: true }, "7A7H7A7H").unwrap(),
+            [0xF8, 0x3E, 0x7F, 0x83, 0xE7]
+        );
+        assert_eq!(
+            decode(RFC4648 { padding: true }, "O7A7O7A7").unwrap(),
+            [0x77, 0xC1, 0xF7, 0x7C, 0x1F]
+        );
+        assert_eq!(
+            encode(RFC4648 { padding: true }, &[0xF8, 0x3E, 0x7F, 0x83]),
+            "7A7H7AY="
+        );
+    }
+
+    #[test]
+    fn masks_unpadded_rfc4648() {
+        assert_eq!(
+            encode(RFC4648 { padding: false }, &[0xF8, 0x3E, 0x7F, 0x83, 0xE7]),
+            "7A7H7A7H"
+        );
+        assert_eq!(
+            encode(RFC4648 { padding: false }, &[0x77, 0xC1, 0xF7, 0x7C, 0x1F]),
+            "O7A7O7A7"
+        );
+        assert_eq!(
+            decode(RFC4648 { padding: false }, "7A7H7A7H").unwrap(),
+            [0xF8, 0x3E, 0x7F, 0x83, 0xE7]
+        );
+        assert_eq!(
+            decode(RFC4648 { padding: false }, "O7A7O7A7").unwrap(),
+            [0x77, 0xC1, 0xF7, 0x7C, 0x1F]
+        );
+        assert_eq!(
+            encode(RFC4648 { padding: false }, &[0xF8, 0x3E, 0x7F, 0x83]),
+            "7A7H7AY"
+        );
+    }
+
+    #[test]
+    fn padding() {
+        let num_padding = [0, 6, 4, 3, 1];
+        for i in 1..6 {
+            let encoded = encode(
+                RFC4648 { padding: true },
+                (0..(i as u8)).collect::<Vec<u8>>().as_ref(),
+            );
+            assert_eq!(encoded.len(), 8);
+            for j in 0..(num_padding[i % 5]) {
+                assert_eq!(encoded.as_bytes()[encoded.len() - j - 1], b'=');
+            }
+            for j in 0..(8 - num_padding[i % 5]) {
+                assert!(encoded.as_bytes()[j] != b'=');
+            }
+        }
+    }
+
+    #[test]
+    fn invertible_encore() {
+        fn test(data: Vec<u8>) -> bool {
+            decode(Encore, encode(Encore, data.as_ref()).as_ref()).unwrap() == data
+        }
+        quickcheck::quickcheck(test as fn(Vec<u8>) -> bool)
+    }
+
+    #[test]
+    fn invertible_crockford() {
+        fn test(data: Vec<u8>) -> bool {
+            decode(Crockford, encode(Crockford, data.as_ref()).as_ref()).unwrap() == data
+        }
+        quickcheck::quickcheck(test as fn(Vec<u8>) -> bool)
+    }
+
+    #[test]
+    fn invertible_rfc4648() {
+        fn test(data: Vec<u8>) -> bool {
+            decode(
+                RFC4648 { padding: true },
+                encode(RFC4648 { padding: true }, data.as_ref()).as_ref(),
+            )
+            .unwrap()
+                == data
+        }
+        quickcheck::quickcheck(test as fn(Vec<u8>) -> bool)
+    }
+
+    #[test]
+    fn invertible_unpadded_rfc4648() {
+        fn test(data: Vec<u8>) -> bool {
+            decode(
+                RFC4648 { padding: false },
+                encode(RFC4648 { padding: false }, data.as_ref()).as_ref(),
+            )
+            .unwrap()
+                == data
+        }
+        quickcheck::quickcheck(test as fn(Vec<u8>) -> bool)
+    }
+
+    #[test]
+    fn lower_case() {
+        fn test(data: Vec<B32>) -> bool {
+            let data: String = data.iter().map(|e| e.c as char).collect();
+            decode(Crockford, data.as_ref())
+                == decode(Crockford, data.to_ascii_lowercase().as_ref())
+        }
+        quickcheck::quickcheck(test as fn(Vec<B32>) -> bool)
+    }
+
+    #[test]
+    #[allow(non_snake_case)]
+    fn iIlL1_oO0() {
+        assert_eq!(decode(Crockford, "IiLlOo"), decode(Crockford, "111100"));
+    }
+
+    #[test]
+    fn invalid_chars_crockford() {
+        assert_eq!(decode(Crockford, ","), None)
+    }
+
+    #[test]
+    fn invalid_chars_rfc4648() {
+        assert_eq!(decode(RFC4648 { padding: true }, ","), None)
+    }
+
+    #[test]
+    fn invalid_chars_unpadded_rfc4648() {
+        assert_eq!(decode(RFC4648 { padding: false }, ","), None)
+    }
+}
diff --git a/runtimes/core/src/error/conversions.rs b/runtimes/core/src/error/conversions.rs
new file mode 100644
index 0000000000..0e01314404
--- /dev/null
+++ b/runtimes/core/src/error/conversions.rs
@@ -0,0 +1,33 @@
+use crate::error::AppError;
+
+impl From<&str> for AppError {
+    fn from(message: &str) -> Self {
+        AppError::new(message)
+    }
+}
+impl From<String> for AppError {
+    fn from(message: String) -> Self {
+        AppError::new(message)
+    }
+}
+impl From<anyhow::Error> for AppError {
+    fn from(error: anyhow::Error) -> Self {
+        let message = error.to_string();
+
+        // Create a chain of causes
+        let mut cause: Option<Box<AppError>> = None;
+        while let Some(err) = error.chain().next_back() {
+            cause = Some(Box::new(Self {
+                message: err.to_string(),
+                stack: vec![],
+                cause,
+            }));
+        }
+
+        Self {
+            message,
+            stack: vec![],
+            cause,
+        }
+    }
+}
diff --git a/runtimes/core/src/error/mod.rs b/runtimes/core/src/error/mod.rs
new file mode 100644
index 0000000000..6053b62141
--- /dev/null
+++ b/runtimes/core/src/error/mod.rs
@@ -0,0 +1,314 @@
+mod conversions;
+
+use backtrace::SymbolName;
+use colored::Colorize;
+use serde::{Deserialize, Serialize};
+use std::fmt::Display;
+
+/// AppError represents an error that occurred in the application langauge
+/// (i.e. in TypeScript code, not the rust runtime).
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct AppError {
+    /// The error message
+    pub message: String,
+
+    /// The stack trace
+    pub stack: StackTrace,
+
+    /// The cause of the error (if any)
+    pub cause: Option<Box<AppError>>,
+}
+
+impl AppError {
+    /// Create a new AppError with the given message.
+    ///
+    /// Note: The stack trace will be set to the rust stack trace at the time this function is called.
+    /// If you want to set the stack trace to something else, use `AppError::with_stack`.
+    #[track_caller]
+    pub fn new<S: Into<String>>(message: S) -> Self {
+        Self {
+            message: message.into(),
+            stack: capture_stack_trace(),
+            cause: None,
+        }
+    }
+
+    /// Wrap an existing error with a new message.
+    ///
+    /// Note: The stack trace will be set to the rust stack trace at the time this function is called.
+    /// If you want to set the stack trace to something else, use `AppError::with_stack`.
+    #[track_caller]
+    pub fn wrap<Err: Into<AppError>, S: Into<String>>(error: Err, message: S) -> Self {
+        Self {
+            message: message.into(),
+            stack: capture_stack_trace(),
+            cause: Some(Box::new(error.into())),
+        }
+    }
+
+    /// Updates the stack trace of the error to the given stack trace
+    pub fn with_stack(self, stack: StackTrace) -> Self {
+        Self { stack, ..self }
+    }
+
+    /// Updates the cause of the error to the given error
+    pub fn with_cause<Err: Into<AppError>>(self, cause: Err) -> Self {
+        Self {
+            cause: Some(Box::new(cause.into())),
+            ..self
+        }
+    }
+
+    /// Trims the stack trace to remove any frames from before
+    /// the given file and line number.
+    ///
+    /// This is useful for removing frames caused by a conversion into an AppError.
+    /// If the given file and line number are not found in the stack trace, then the original
+    /// stack trace is returned.
+    pub fn trim_stack(self, file: &str, line: u32, drop_extra: usize) -> Self {
+        let idx = self
+            .stack
+            .iter()
+            .position(|frame| frame.file == file && frame.line == line)
+            .map(|idx| idx + 1 + drop_extra); // + 1 for the frame we called this on
+
+        match idx {
+            Some(idx) => Self {
+                stack: self.stack.into_iter().skip(idx).collect(),
+                ..self
+            },
+            None => self,
+        }
+    }
+}
+
+const MAX_FRAMES_TO_DISPLAY: usize = 6;
+const STACK_TAB_SIZE: &str = "  ";
+
+/// Write the stack trace to the given formatter.
+pub fn write_stack_trace<W: std::fmt::Write>(stack: &StackTrace, f: &mut W) -> std::fmt::Result {
+    // If we have a stack trace add it
+    if !stack.is_empty() {
+        write!(f, "\n{}{}", STACK_TAB_SIZE, "Stack:".magenta())?;
+
+        // What's the longest function name including module name (for modules not named "main")
+        let mut longest_func = 0;
+        for frame in stack.iter().take(MAX_FRAMES_TO_DISPLAY + 1) {
+            if let Some(func) = &frame.function {
+                longest_func = longest_func.max(
+                    func.len() + // Function name length
+                        frame.module.as_ref().map(|s| s.len() + 1).unwrap_or(0), // plus "[module]." if module is present
+                );
+            }
+        }
+
+        for (index, frame) in stack.iter().enumerate() {
+            let (module_and_function, readable_len) = match (&frame.module, &frame.function) {
+                (Some(module), Some(function)) => (
+                    format!("{}.{}", module.bright_black(), function.magenta()),
+                    module.len() + function.len() + 1,
+                ),
+                (None, Some(function)) => (format!("{}", function.magenta()), function.len()),
+                (Some(_), None) => ("".to_string(), 0),
+                (None, None) => ("".to_string(), 0),
+            };
+
+            let spacing_after_function = if longest_func >= readable_len {
+                " ".repeat(longest_func - readable_len)
+            } else {
+                "".to_string()
+            };
+
+            let line_and_column = frame
+                .column
+                .map(|col| format!("{}:{}", frame.line, col))
+                .unwrap_or(format!("{}", frame.line));
+
+            write!(
+                f,
+                "\n{}{}at {}{} {}:{}",
+                STACK_TAB_SIZE,
+                STACK_TAB_SIZE,
+                module_and_function,
+                spacing_after_function,
+                frame.file,
+                line_and_column
+            )?;
+
+            // Only print the first 6 frames
+            if index >= MAX_FRAMES_TO_DISPLAY {
+                write!(
+                    f,
+                    "\n{}{}... remaining {} frames omitted...",
+                    STACK_TAB_SIZE,
+                    STACK_TAB_SIZE,
+                    stack.len() - index
+                )?;
+                break;
+            }
+        }
+    }
+
+    Ok(())
+}
+
+/// Display the error in a human readable format.
+impl Display for AppError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(
+            f,
+            "{} {}",
+            "Error:".red(),
+            self.message.replace('\n', "\n\t")
+        )?;
+        write_stack_trace(&self.stack, f)?;
+
+        // While there are more causes, print them
+        let mut cause = &self.cause;
+        while cause.is_some() {
+            let error = cause.as_ref().expect("cause should not be None");
+
+            write!(f, "\n\n\t{} {}", "Caused by:".red(), error.message)?;
+            write_stack_trace(&error.stack, f)?;
+            cause = &error.cause;
+        }
+
+        Ok(())
+    }
+}
+
+/// A stack trace from an error.
+pub type StackTrace = Vec<StackFrame>;
+
+/// A stack frame in a backtrace from an error.
+///
+/// Note: The serde field names, match those used in our Go `errinsrc` package.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct StackFrame {
+    /// The name of the file on the file system
+    #[serde(rename = "file")]
+    pub file: String,
+
+    /// The line number in that file
+    #[serde(rename = "line")]
+    pub line: u32,
+
+    /// The column number in that file (if available)
+    #[serde(skip_serializing)]
+    pub column: Option<u32>,
+
+    /// The name of the module containing the line (if available)
+    #[serde(skip_serializing)]
+    pub module: Option<String>,
+
+    /// The name of the function or method containing the line (if available)
+    #[serde(rename = "func")]
+    pub function: Option<String>,
+}
+
+/// capture_stack_trace captures a stack trace from the current location in the rust code base
+#[track_caller]
+fn capture_stack_trace() -> StackTrace {
+    let caller = std::panic::Location::caller();
+
+    let backtrace = backtrace::Backtrace::new();
+
+    let stacktrace: StackTrace = convert_backtrace_to_stack_trace(&backtrace)
+        .into_iter()
+        .skip_while(|frame| {
+            // Skip all the frames before the caller
+            !(frame.file.ends_with(caller.file()) && frame.line == caller.line())
+        })
+        .collect();
+
+    // If the backtrace is empty, then we just return the caller which thanks to the
+    // track_caller macro means we will always have at least one frame to report
+    if stacktrace.is_empty() {
+        vec![StackFrame {
+            file: caller.file().to_string(),
+            line: caller.line(),
+            column: None,
+            module: None,
+            function: None,
+        }]
+    } else {
+        // otherwise we can report the full trace
+        stacktrace
+    }
+}
+
+/// convert_backtrace_to_stack_trace converts a rust backtrace to a stack trace
+fn convert_backtrace_to_stack_trace(backtrace: &backtrace::Backtrace) -> StackTrace {
+    let mut stack_trace = Vec::new();
+
+    for frame in backtrace.frames() {
+        if let Some(symbol) = frame.symbols().first() {
+            match (symbol.filename(), symbol.lineno()) {
+                (Some(filename), Some(line)) => {
+                    let (module, function) = split_symbol_into_module_function(symbol.name());
+
+                    let frame = StackFrame {
+                        file: trim_file_path(filename.to_string_lossy().to_string()),
+                        line,
+                        column: symbol.colno(),
+                        module,
+                        function,
+                    };
+
+                    if !is_common_rust_frame(&frame) {
+                        stack_trace.push(frame);
+                    }
+                }
+                _ => continue,
+            }
+        }
+    }
+
+    stack_trace
+}
+
+fn split_symbol_into_module_function(
+    symbol: Option<SymbolName>,
+) -> (Option<String>, Option<String>) {
+    match symbol {
+        Some(symbol) => {
+            let symbol_str = symbol.to_string();
+            let parts: Vec<&str> = symbol_str.split("::").collect();
+            if parts.len() < 3 {
+                return (None, Some(symbol.to_string()));
+            }
+
+            let function_idx = parts
+                .iter()
+                .rposition(|s| s.starts_with(|c: char| c.is_uppercase()))
+                .unwrap_or_else(|| {
+                    parts
+                        .iter()
+                        .rposition(|s| (*s).eq("{{closure}}"))
+                        .map(|idx| idx - 1)
+                        .unwrap_or_else(|| parts.len() - 2)
+                });
+
+            let module = parts[..function_idx].join("::");
+            let function = parts[function_idx..parts.len() - 1].join("::");
+
+            (Some(module), Some(function))
+        }
+        None => (None, None),
+    }
+}
+
+/// trim_file_path trims the file path to be relative to the root of the binary being compiled
+fn trim_file_path(full_path: String) -> String {
+    let compile_target = env!("ENCORE_BINARY_SRC_PATH");
+
+    full_path
+        .strip_prefix(compile_target)
+        .map(|str| str[1..].to_string())
+        .unwrap_or(full_path)
+        .to_string()
+}
+
+fn is_common_rust_frame(frame: &StackFrame) -> bool {
+    frame.file.starts_with("/rustc/")
+}
diff --git a/runtimes/core/src/infracfg.rs b/runtimes/core/src/infracfg.rs
new file mode 100644
index 0000000000..f6eb296b05
--- /dev/null
+++ b/runtimes/core/src/infracfg.rs
@@ -0,0 +1,1051 @@
+use crate::encore::runtime::v1::infrastructure::{Credentials, Resources};
+use crate::encore::runtime::v1::{
+    self as pbruntime, environment, gateway, metrics_provider, pub_sub_cluster,
+    pub_sub_subscription, pub_sub_topic, redis_role, secret_data, service_auth, service_discovery,
+    AppSecret, Deployment, Environment, Infrastructure, MetricsProvider, Observability,
+    PubSubCluster, PubSubSubscription, PubSubTopic, RedisCluster, RedisConnectionPool,
+    RedisDatabase, RedisRole, RedisServer, RuntimeConfig, SqlCluster, SqlConnectionPool,
+    SqlDatabase, SqlRole, SqlServer, TlsConfig,
+};
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct InfraConfig {
+    pub metadata: Option<Metadata>,
+    pub graceful_shutdown: Option<GracefulShutdown>,
+    pub auth: Option<Vec<Auth>>,
+    pub service_discovery: Option<HashMap<String, ServiceDiscovery>>,
+    pub metrics: Option<Metrics>,
+    pub sql_servers: Option<Vec<SQLServer>>,
+    pub redis: Option<HashMap<String, Redis>>,
+    pub pubsub: Option<Vec<PubSub>>,
+    pub secrets: Option<Secrets>,
+    pub hosted_services: Option<Vec<String>>,
+    pub hosted_gateways: Option<Vec<String>>,
+    pub cors: Option<CORS>,
+    pub object_storage: Option<Vec<ObjectStorage>>,
+    pub worker_threads: Option<i32>,
+    pub log_config: Option<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(tag = "type")]
+pub enum ObjectStorage {
+    #[serde(rename = "gcs")]
+    GCS(GCS),
+    #[serde(rename = "s3")]
+    S3(S3),
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct GCS {
+    pub endpoint: Option<String>,
+    pub buckets: HashMap<String, Bucket>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct S3 {
+    pub region: String,
+    pub endpoint: Option<String>,
+    pub access_key_id: Option<String>,
+    pub secret_access_key: Option<EnvString>,
+    pub buckets: HashMap<String, Bucket>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct Bucket {
+    pub name: String,
+    pub key_prefix: Option<String>,
+    pub public_base_url: Option<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize, Default)]
+pub struct Metadata {
+    pub app_id: Option<String>,
+    pub env_name: Option<String>,
+    pub env_type: Option<String>,
+    pub cloud: Option<String>,
+    pub base_url: Option<String>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct CORS {
+    pub debug: Option<bool>,
+    pub allow_headers: Option<Vec<String>>,
+    pub expose_headers: Option<Vec<String>>,
+    pub allow_origins_without_credentials: Option<Vec<String>>,
+    pub allow_origins_with_credentials: Option<Vec<String>>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct GracefulShutdown {
+    pub total: Option<i32>,
+
+    pub shutdown_hooks: Option<i32>,
+
+    pub handlers: Option<i32>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(tag = "type")]
+pub enum Auth {
+    #[serde(rename = "key")]
+    Key(KeyAuth),
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct KeyAuth {
+    pub id: i32,
+    pub key: EnvString,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct ServiceDiscovery {
+    pub base_url: String,
+
+    pub auth: Option<Vec<Auth>>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(tag = "type")]
+pub enum Metrics {
+    #[serde(rename = "prometheus")]
+    Prometheus(PrometheusMetrics),
+    #[serde(rename = "datadog")]
+    Datadog(DatadogMetrics),
+    #[serde(rename = "gcp_cloud_monitoring")]
+    GCPCloudMonitoring(GCPCloudMonitoringMetrics),
+    #[serde(rename = "aws_cloudwatch")]
+    AWSCloudWatch(AWSCloudWatchMetrics),
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct PrometheusMetrics {
+    pub collection_interval: Option<i32>,
+    pub remote_write_url: EnvString,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct DatadogMetrics {
+    pub collection_interval: Option<i32>,
+    pub site: String,
+    pub api_key: EnvString,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct GCPCloudMonitoringMetrics {
+    pub collection_interval: Option<i32>,
+    pub project_id: String,
+    pub monitored_resource_type: String,
+    pub monitored_resource_labels: Option<HashMap<String, String>>,
+    pub metric_names: Option<HashMap<String, String>>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct AWSCloudWatchMetrics {
+    pub collection_interval: Option<i32>,
+    pub namespace: String,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum Secrets {
+    Map(HashMap<String, EnvString>),
+    EnvRef(EnvRef),
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct EnvRef {
+    #[serde(rename = "$env")]
+    pub env: String,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(untagged)]
+pub enum EnvString {
+    String(String),
+    EnvRef(EnvRef),
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct SQLServer {
+    pub host: String,
+    pub tls_config: Option<TLSConfig>,
+    pub databases: HashMap<String, SQLDatabase>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct TLSConfig {
+    #[serde(default)]
+    pub disabled: bool,
+    pub ca: Option<String>,
+    pub client_cert: Option<ClientCert>,
+    #[serde(default)]
+    pub disable_tls_hostname_verification: bool,
+    #[serde(default)]
+    pub disable_ca_validation: bool,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct SQLDatabase {
+    pub name: Option<String>,
+    pub max_connections: Option<i32>,
+    pub min_connections: Option<i32>,
+    pub username: String,
+    pub password: EnvString,
+    pub client_cert: Option<ClientCert>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct Redis {
+    pub host: String,
+    pub database_index: i32,
+
+    pub auth: Option<RedisAuth>,
+
+    pub key_prefix: Option<String>,
+
+    pub tls_config: Option<TLSConfig>,
+
+    pub max_connections: Option<i32>,
+
+    pub min_connections: Option<i32>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct RedisAuth {
+    pub r#type: String,
+
+    pub username: Option<String>,
+
+    pub password: Option<EnvString>,
+
+    pub auth_string: Option<EnvString>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct ClientCert {
+    pub cert: String,
+    pub key: EnvString,
+}
+
+// PubSub-related structures
+
+#[derive(Debug, Serialize, Deserialize)]
+#[serde(tag = "type")]
+pub enum PubSub {
+    #[serde(rename = "gcp_pubsub")]
+    GCPPubsub(GCPPubsub),
+    #[serde(rename = "aws_sns_sqs")]
+    AWSSnsSqs(AWSSnsSqs),
+    #[serde(rename = "nsq")]
+    NSQ(NSQPubsub),
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct GCPPubsub {
+    pub project_id: String,
+    pub topics: HashMap<String, GCPTopic>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct GCPTopic {
+    pub name: String,
+    pub project_id: Option<String>,
+    #[serde(skip_serializing_if = "HashMap::is_empty", default)]
+    pub subscriptions: HashMap<String, GCPSub>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct GCPSub {
+    pub name: String,
+
+    pub project_id: Option<String>,
+
+    pub push_config: Option<PushConfig>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct PushConfig {
+    pub service_account: String,
+    pub jwt_audience: String,
+    pub id: String,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct AWSSnsSqs {
+    pub topics: HashMap<String, AWSTopic>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct AWSTopic {
+    pub arn: String,
+    #[serde(skip_serializing_if = "HashMap::is_empty", default)]
+    pub subscriptions: HashMap<String, AWSSub>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct AWSSub {
+    pub arn: String,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct NSQPubsub {
+    pub hosts: String,
+    pub topics: HashMap<String, NSQTopic>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct NSQTopic {
+    pub name: String,
+    #[serde(skip_serializing_if = "HashMap::is_empty", default)]
+    pub subscriptions: HashMap<String, NSQSub>,
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub struct NSQSub {
+    pub name: String,
+}
+
+pub fn map_infra_to_runtime(infra: InfraConfig) -> RuntimeConfig {
+    let mut next_rid = 0;
+    let mut get_next_rid = || {
+        let rid = next_rid;
+        next_rid += 1;
+        rid.to_string()
+    };
+
+    let metadata = infra.metadata.unwrap_or_default();
+    // Map the Environment
+    let environment = Some(Environment {
+        app_id: "".to_string(),
+        app_slug: metadata.app_id.unwrap_or_default(),
+        env_id: "".to_string(),
+        env_name: metadata.env_name.unwrap_or_default(),
+        env_type: metadata
+            .env_type
+            .as_ref()
+            .map(|t| match t.as_str() {
+                "development" => environment::Type::Development as i32,
+                "production" => environment::Type::Production as i32,
+                "ephemeral" => environment::Type::Ephemeral as i32,
+                "test" => environment::Type::Test as i32,
+                _ => environment::Type::Unspecified as i32,
+            })
+            .unwrap_or(environment::Type::Unspecified as i32),
+        cloud: metadata
+            .cloud
+            .as_ref()
+            .map(|c| match c.as_str() {
+                "local" => environment::Cloud::Local as i32,
+                "encore" => environment::Cloud::Encore as i32,
+                "aws" => environment::Cloud::Aws as i32,
+                "gcp" => environment::Cloud::Gcp as i32,
+                "azure" => environment::Cloud::Azure as i32,
+                _ => environment::Cloud::Unspecified as i32,
+            })
+            .unwrap_or(environment::Cloud::Unspecified as i32),
+    });
+
+    // Map GracefulShutdown
+    let graceful_shutdown =
+        infra
+            .graceful_shutdown
+            .as_ref()
+            .map(|gs| pbruntime::GracefulShutdown {
+                total: gs.total.map(|t| prost_types::Duration {
+                    seconds: t as i64,
+                    nanos: 0,
+                }),
+                shutdown_hooks: gs.shutdown_hooks.map(|t| prost_types::Duration {
+                    seconds: t as i64,
+                    nanos: 0,
+                }),
+                handlers: gs.handlers.map(|t| prost_types::Duration {
+                    seconds: t as i64,
+                    nanos: 0,
+                }),
+            });
+
+    // Map Auth methods
+    let auth_methods = infra
+        .auth
+        .as_ref()
+        .map(|auths| {
+            auths
+                .iter()
+                .map(|auth| {
+                    let auth_method = match auth {
+                        Auth::Key(k) => {
+                            service_auth::AuthMethod::EncoreAuth(service_auth::EncoreAuth {
+                                auth_keys: vec![pbruntime::EncoreAuthKey {
+                                    id: k.id as u32,
+                                    data: Some(map_env_string_to_secret_data(&k.key)),
+                                }],
+                            })
+                        }
+                    };
+                    pbruntime::ServiceAuth {
+                        auth_method: Some(auth_method),
+                    }
+                })
+                .collect()
+        })
+        .unwrap_or_else(|| {
+            vec![pbruntime::ServiceAuth {
+                auth_method: Some(service_auth::AuthMethod::Noop(service_auth::NoopAuth {})),
+            }]
+        });
+
+    // Map ServiceDiscovery
+    let service_discovery = infra.service_discovery.map(|services| {
+        let services_mapped = services
+            .into_iter()
+            .map(|(name, sd)| {
+                let svc_auth_methods = sd
+                    .auth
+                    .map(|auths| {
+                        auths
+                            .into_iter()
+                            .map(|auth| match auth {
+                                Auth::Key(k) => pbruntime::ServiceAuth {
+                                    auth_method: Some(service_auth::AuthMethod::EncoreAuth(
+                                        service_auth::EncoreAuth {
+                                            auth_keys: vec![pbruntime::EncoreAuthKey {
+                                                id: k.id as u32,
+                                                data: Some(map_env_string_to_secret_data(&k.key)),
+                                            }],
+                                        },
+                                    )),
+                                },
+                            })
+                            .collect()
+                    })
+                    .unwrap_or(auth_methods.clone());
+                (
+                    name,
+                    service_discovery::Location {
+                        base_url: sd.base_url,
+                        auth_methods: svc_auth_methods,
+                    },
+                )
+            })
+            .collect();
+
+        pbruntime::ServiceDiscovery {
+            services: services_mapped,
+        }
+    });
+
+    // Map Buckets
+    let buckets = infra.object_storage.map(|object_storages| {
+        object_storages
+            .into_iter()
+            .map(|os| match os {
+                ObjectStorage::GCS(gcs) => pbruntime::BucketCluster {
+                    rid: get_next_rid(),
+                    provider: Some(pbruntime::bucket_cluster::Provider::Gcs(
+                        pbruntime::bucket_cluster::Gcs {
+                            endpoint: gcs.endpoint,
+                            anonymous: false,
+                            local_sign: None,
+                        },
+                    )),
+                    buckets: gcs
+                        .buckets
+                        .into_iter()
+                        .map(|(name, bucket)| pbruntime::Bucket {
+                            encore_name: name,
+                            cloud_name: bucket.name,
+                            key_prefix: bucket.key_prefix,
+                            public_base_url: bucket.public_base_url,
+                            rid: get_next_rid(),
+                        })
+                        .collect(),
+                },
+                ObjectStorage::S3(s3) => pbruntime::BucketCluster {
+                    rid: get_next_rid(),
+                    provider: Some(pbruntime::bucket_cluster::Provider::S3(
+                        pbruntime::bucket_cluster::S3 {
+                            region: s3.region,
+                            endpoint: s3.endpoint,
+                            access_key_id: s3.access_key_id,
+                            secret_access_key: s3
+                                .secret_access_key
+                                .as_ref()
+                                .map(map_env_string_to_secret_data),
+                        },
+                    )),
+                    buckets: s3
+                        .buckets
+                        .into_iter()
+                        .map(|(name, bucket)| pbruntime::Bucket {
+                            encore_name: name,
+                            cloud_name: bucket.name,
+                            key_prefix: bucket.key_prefix,
+                            public_base_url: bucket.public_base_url,
+                            rid: get_next_rid(),
+                        })
+                        .collect(),
+                },
+            })
+            .collect()
+    });
+
+    // Map Metrics
+    let metrics = infra.metrics.map(|metrics| {
+        let (provider, interval) = match metrics {
+            Metrics::Prometheus(pm) => (
+                metrics_provider::Provider::PromRemoteWrite(
+                    metrics_provider::PrometheusRemoteWrite {
+                        remote_write_url: Some(map_env_string_to_secret_data(&pm.remote_write_url)),
+                    },
+                ),
+                pm.collection_interval,
+            ),
+            Metrics::Datadog(dd) => (
+                metrics_provider::Provider::Datadog(metrics_provider::Datadog {
+                    site: dd.site,
+                    api_key: Some(map_env_string_to_secret_data(&dd.api_key)),
+                }),
+                dd.collection_interval,
+            ),
+            Metrics::GCPCloudMonitoring(gcp) => (
+                metrics_provider::Provider::Gcp(metrics_provider::GcpCloudMonitoring {
+                    project_id: gcp.project_id,
+                    monitored_resource_type: gcp.monitored_resource_type,
+                    monitored_resource_labels: gcp.monitored_resource_labels.unwrap_or_default(),
+                    metric_names: gcp.metric_names.unwrap_or_default(),
+                }),
+                gcp.collection_interval,
+            ),
+            Metrics::AWSCloudWatch(aws) => (
+                metrics_provider::Provider::Aws(metrics_provider::AwsCloudWatch {
+                    namespace: aws.namespace,
+                }),
+                aws.collection_interval,
+            ),
+        };
+
+        vec![MetricsProvider {
+            rid: get_next_rid(),
+            collection_interval: interval.map(|i| prost_types::Duration {
+                seconds: i as i64,
+                nanos: 0,
+            }),
+            provider: Some(provider),
+        }]
+    });
+
+    // Map Observability
+    let observability = Some(Observability {
+        metrics: metrics.unwrap_or_default(),
+        tracing: Vec::new(),
+        logs: Vec::new(),
+    });
+
+    let cors = infra.cors.map(|cors| gateway::Cors {
+        debug: cors.debug.unwrap_or(false),
+        disable_credentials: false,
+        allowed_origins_without_credentials: cors
+            .allow_origins_without_credentials
+            .map(|f| gateway::CorsAllowedOrigins { allowed_origins: f }),
+        allowed_origins_with_credentials: cors.allow_origins_with_credentials.map(|f| {
+            gateway::cors::AllowedOriginsWithCredentials::AllowedOrigins(
+                gateway::CorsAllowedOrigins { allowed_origins: f },
+            )
+        }),
+        extra_allowed_headers: cors.allow_headers.unwrap_or_default(),
+        extra_exposed_headers: cors.expose_headers.unwrap_or_default(),
+        allow_private_network_access: true,
+    });
+
+    let gateways = infra
+        .hosted_gateways
+        .map(|gateways| {
+            gateways
+                .into_iter()
+                .map(|gateway| pbruntime::Gateway {
+                    rid: get_next_rid(),
+                    encore_name: gateway,
+                    base_url: metadata.base_url.clone().unwrap_or_default(),
+                    hostnames: vec![],
+                    cors: cors.clone(),
+                })
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default();
+
+    // Map Deployment
+    let deployment = Some(Deployment {
+        deploy_id: String::new(),
+        deployed_at: None,
+        dynamic_experiments: Vec::new(),
+        hosted_gateways: gateways.iter().map(|g| g.rid.clone()).collect(),
+        hosted_services: infra
+            .hosted_services
+            .map(|services| {
+                services
+                    .iter()
+                    .map(|service| pbruntime::HostedService {
+                        name: service.clone(),
+                        worker_threads: infra.worker_threads,
+                        log_config: infra.log_config.clone(),
+                    })
+                    .collect()
+            })
+            .unwrap_or_default(),
+        auth_methods,
+        observability,
+        service_discovery,
+        graceful_shutdown,
+    });
+
+    let mut credentials = Credentials {
+        client_certs: Vec::new(),
+        sql_roles: Vec::new(),
+        redis_roles: Vec::new(),
+    };
+
+    // Map SQL Servers
+    let sql_clusters = infra.sql_servers.map(|servers| {
+        servers
+            .into_iter()
+            .map(|server| {
+                let default_client_cert = server
+                    .tls_config
+                    .as_ref()
+                    .and_then(|tls| tls.client_cert.as_ref())
+                    .map(|f| {
+                        let rid = get_next_rid();
+                        let client_cert = pbruntime::ClientCert {
+                            rid: rid.clone(),
+                            cert: f.cert.clone(),
+                            key: Some(map_env_string_to_secret_data(&f.key)),
+                        };
+                        credentials.client_certs.push(client_cert);
+                        rid
+                    });
+
+                let databases = server
+                    .databases
+                    .into_iter()
+                    .map(|(name, db)| {
+                        let client_cert = db
+                            .client_cert
+                            .map(|f| {
+                                let rid = get_next_rid();
+                                let client_cert = pbruntime::ClientCert {
+                                    rid: rid.clone(),
+                                    cert: f.cert,
+                                    key: Some(map_env_string_to_secret_data(&f.key)),
+                                };
+                                credentials.client_certs.push(client_cert);
+                                rid
+                            })
+                            .or_else(|| default_client_cert.clone());
+                        let role_rid = get_next_rid();
+                        let role = SqlRole {
+                            rid: role_rid.clone(),
+                            client_cert_rid: client_cert,
+                            username: db.username,
+                            password: Some(map_env_string_to_secret_data(&db.password)),
+                        };
+                        credentials.sql_roles.push(role);
+                        SqlDatabase {
+                            rid: get_next_rid(),
+                            encore_name: name.clone(),
+                            cloud_name: db.name.unwrap_or(name),
+                            conn_pools: vec![SqlConnectionPool {
+                                is_readonly: false,
+                                role_rid,
+                                min_connections: db.min_connections.unwrap_or(0),
+                                max_connections: db.max_connections.unwrap_or(100),
+                            }],
+                        }
+                    })
+                    .collect();
+
+                SqlCluster {
+                    rid: get_next_rid(),
+                    servers: vec![SqlServer {
+                        rid: get_next_rid(),
+                        host: server.host,
+                        kind: pbruntime::ServerKind::Primary as i32,
+                        tls_config: server.tls_config.map_or_else(
+                            || Some(TlsConfig::default()),
+                            |tls| match tls.disabled {
+                                true => None,
+                                false => Some(TlsConfig {
+                                    server_ca_cert: tls.ca,
+                                    disable_tls_hostname_verification: tls
+                                        .disable_tls_hostname_verification,
+                                    disable_ca_validation: tls.disable_ca_validation,
+                                }),
+                            },
+                        ),
+                    }],
+                    databases,
+                }
+            })
+            .collect()
+    });
+
+    // Map Redis
+    let redis_clusters = infra.redis.map(|redis_map| {
+        redis_map
+            .into_iter()
+            .map(|(name, redis)| {
+                let client_cert = redis
+                    .tls_config
+                    .as_ref()
+                    .and_then(|tls| tls.client_cert.as_ref())
+                    .map(|f| {
+                        let rid = get_next_rid();
+                        let client_cert = pbruntime::ClientCert {
+                            rid: rid.clone(),
+                            cert: f.cert.clone(),
+                            key: Some(map_env_string_to_secret_data(&f.key)),
+                        };
+                        credentials.client_certs.push(client_cert);
+                        rid
+                    });
+                let auth = redis.auth.map(|ra| match ra.r#type.as_str() {
+                    "auth_string" => redis_role::Auth::AuthString(map_env_string_to_secret_data(
+                        ra.auth_string.as_ref().unwrap(),
+                    )),
+                    "acl" => redis_role::Auth::Acl(redis_role::AuthAcl {
+                        username: ra.username.unwrap(),
+                        password: Some(map_env_string_to_secret_data(
+                            ra.password.as_ref().unwrap(),
+                        )),
+                    }),
+                    _ => redis_role::Auth::AuthString(map_env_string_to_secret_data(
+                        ra.auth_string.as_ref().unwrap(),
+                    )),
+                });
+
+                let role_rid = get_next_rid();
+                let role = RedisRole {
+                    rid: role_rid.clone(),
+                    client_cert_rid: client_cert,
+                    auth,
+                };
+                credentials.redis_roles.push(role);
+                let database = RedisDatabase {
+                    rid: get_next_rid(),
+                    encore_name: name, // Use the key as the name
+                    database_idx: redis.database_index,
+                    key_prefix: redis.key_prefix,
+                    conn_pools: vec![RedisConnectionPool {
+                        is_readonly: false,
+                        role_rid,
+                        min_connections: redis.min_connections.unwrap_or(0),
+                        max_connections: redis.max_connections.unwrap_or(100),
+                    }],
+                };
+
+                RedisCluster {
+                    rid: String::new(), // Assign a unique RID
+                    servers: vec![RedisServer {
+                        rid: String::new(), // Assign a unique RID
+                        host: redis.host,
+                        kind: pbruntime::ServerKind::Primary as i32,
+                        tls_config: redis.tls_config.map_or_else(
+                            || Some(TlsConfig::default()),
+                            |tls| match tls.disabled {
+                                true => None,
+                                false => Some(TlsConfig {
+                                    server_ca_cert: tls.ca,
+                                    disable_tls_hostname_verification: tls
+                                        .disable_tls_hostname_verification,
+                                    disable_ca_validation: tls.disable_ca_validation,
+                                }),
+                            },
+                        ),
+                    }],
+                    databases: vec![database],
+                }
+            })
+            .collect()
+    });
+
+    // Map PubSub
+    let pubsub_clusters = infra.pubsub.map(|pubsubs| {
+        pubsubs
+            .into_iter()
+            .map(|pubsub| {
+                // Handle different PubSub types
+                let (provider, topics, subscriptions) = match pubsub {
+                    PubSub::GCPPubsub(gcp) => {
+                        let topics = gcp
+                            .topics
+                            .iter()
+                            .map(|(name, topic)| PubSubTopic {
+                                rid: String::new(),
+                                encore_name: name.clone(),
+                                cloud_name: topic.name.clone(),
+                                delivery_guarantee: pub_sub_topic::DeliveryGuarantee::AtLeastOnce
+                                    as i32,
+                                ordering_attr: None,
+                                provider_config: Some(pub_sub_topic::ProviderConfig::GcpConfig(
+                                    pub_sub_topic::GcpConfig {
+                                        project_id: topic
+                                            .project_id
+                                            .clone()
+                                            .unwrap_or_else(|| gcp.project_id.clone()),
+                                    },
+                                )),
+                            })
+                            .collect();
+                        let subscriptions = gcp
+                            .topics
+                            .iter()
+                            .flat_map(|(topic_name, topic)| {
+                                topic.subscriptions.iter().map(|(sub_name, sub)| {
+                                    PubSubSubscription {
+                                        rid: String::new(),
+                                        topic_encore_name: topic_name.clone(),
+                                        subscription_encore_name: sub_name.clone(),
+                                        topic_cloud_name: topic.name.clone(),
+                                        subscription_cloud_name: sub.name.clone(),
+                                        push_only: sub.push_config.is_some(),
+                                        provider_config: Some(
+                                            pub_sub_subscription::ProviderConfig::GcpConfig(
+                                                pub_sub_subscription::GcpConfig {
+                                                    project_id: sub
+                                                        .project_id
+                                                        .clone()
+                                                        .unwrap_or_else(|| gcp.project_id.clone()),
+                                                    push_service_account: sub
+                                                        .push_config
+                                                        .as_ref()
+                                                        .map(|pc| pc.service_account.clone()),
+                                                    push_jwt_audience: sub
+                                                        .push_config
+                                                        .as_ref()
+                                                        .map(|pc| pc.jwt_audience.clone()),
+                                                },
+                                            ),
+                                        ),
+                                    }
+                                })
+                            })
+                            .collect();
+
+                        let provider =
+                            pub_sub_cluster::Provider::Gcp(pub_sub_cluster::GcpPubSub {});
+                        (Some(provider), topics, subscriptions)
+                    }
+                    PubSub::AWSSnsSqs(aws) => {
+                        let topics = aws
+                            .topics
+                            .iter()
+                            .map(|(name, topic)| PubSubTopic {
+                                rid: String::new(),
+                                encore_name: name.clone(),
+                                cloud_name: topic.arn.clone(),
+                                delivery_guarantee: pub_sub_topic::DeliveryGuarantee::AtLeastOnce
+                                    as i32, // AWS typically provides at-least-once delivery
+                                ordering_attr: None, // Add ordering if necessary
+                                provider_config: None, // AWS doesn't need additional provider config here
+                            })
+                            .collect();
+
+                        let subscriptions = aws
+                            .topics
+                            .iter()
+                            .flat_map(|(topic_name, topic)| {
+                                topic.subscriptions.iter().map(|(sub_name, sub)| {
+                                    PubSubSubscription {
+                                        rid: String::new(),
+                                        topic_encore_name: topic_name.clone(),
+                                        subscription_encore_name: sub_name.clone(),
+                                        topic_cloud_name: topic.arn.clone(),
+                                        subscription_cloud_name: sub.arn.clone(),
+                                        push_only: false, // AWS SQS doesn't typically use push config
+                                        provider_config: None, // AWS doesn't need additional provider config
+                                    }
+                                })
+                            })
+                            .collect();
+
+                        let provider =
+                            pub_sub_cluster::Provider::Aws(pub_sub_cluster::AwsSqsSns {});
+
+                        (Some(provider), topics, subscriptions)
+                    }
+                    PubSub::NSQ(nsq) => {
+                        let topics = nsq
+                            .topics
+                            .iter()
+                            .map(|(name, topic)| PubSubTopic {
+                                rid: String::new(),
+                                encore_name: name.clone(),
+                                cloud_name: topic.name.clone(), // NSQ doesn't have cloud-specific names, using the topic name
+                                delivery_guarantee: pub_sub_topic::DeliveryGuarantee::AtLeastOnce
+                                    as i32, // NSQ typically guarantees at-least-once delivery
+                                ordering_attr: None, // NSQ doesn't handle message ordering natively
+                                provider_config: None, // No additional provider config for NSQ
+                            })
+                            .collect();
+
+                        let subscriptions = nsq
+                            .topics
+                            .iter()
+                            .flat_map(|(topic_name, topic)| {
+                                topic.subscriptions.iter().map(|(sub_name, sub)| {
+                                    PubSubSubscription {
+                                        rid: String::new(),
+                                        topic_encore_name: topic_name.clone(),
+                                        subscription_encore_name: sub_name.clone(),
+                                        topic_cloud_name: topic.name.clone(), // Using topic name for simplicity
+                                        subscription_cloud_name: sub.name.clone(),
+                                        push_only: false, // NSQ is pull-based, no push config
+                                        provider_config: None, // No additional provider config for NSQ
+                                    }
+                                })
+                            })
+                            .collect();
+
+                        let provider = pub_sub_cluster::Provider::Nsq(pub_sub_cluster::Nsq {
+                            hosts: vec![nsq.hosts.clone()], // Mapping NSQ hosts
+                        });
+
+                        (Some(provider), topics, subscriptions)
+                    }
+                };
+
+                PubSubCluster {
+                    rid: get_next_rid(),
+                    topics,
+                    subscriptions,
+                    provider,
+                }
+            })
+            .collect()
+    });
+
+    // Map Secrets
+    let app_secrets: Vec<AppSecret> = match infra.secrets {
+        Some(Secrets::Map(secrets_map)) => secrets_map
+            .into_iter()
+            .map(|(name, value)| AppSecret {
+                rid: get_next_rid(),
+                encore_name: name.clone(),
+                data: Some(map_env_string_to_secret_data(&value)),
+            })
+            .collect(),
+        Some(Secrets::EnvRef(env_ref)) => {
+            // Fetch the environment variable
+            match std::env::var(env_ref.env) {
+                Ok(secrets_json) => {
+                    // Parse the JSON string into a HashMap
+                    match serde_json::from_str::<HashMap<String, String>>(&secrets_json) {
+                        Ok(secrets_map) => secrets_map
+                            .into_iter()
+                            .map(|(name, value)| AppSecret {
+                                rid: get_next_rid(),
+                                encore_name: name,
+                                data: Some(pbruntime::SecretData {
+                                    encoding: secret_data::Encoding::None as i32,
+                                    source: Some(secret_data::Source::Embedded(value.into_bytes())),
+                                    sub_path: None,
+                                }),
+                            })
+                            .collect(),
+                        Err(_) => {
+                            ::log::error!(
+                                "Failed to parse secrets JSON from secret environment variable"
+                            );
+                            Vec::new()
+                        }
+                    }
+                }
+                Err(_) => {
+                    ::log::error!("Failed to read secrets from environment variable");
+                    Vec::new()
+                }
+            }
+        }
+        None => Vec::new(),
+    };
+
+    // Map Infrastructure Resources
+    let resources = Some(Resources {
+        gateways,
+        sql_clusters: sql_clusters.unwrap_or_default(),
+        pubsub_clusters: pubsub_clusters.unwrap_or_default(),
+        redis_clusters: redis_clusters.unwrap_or_default(),
+        app_secrets,
+        bucket_clusters: buckets.unwrap_or_default(),
+    });
+
+    let infra_struct = Some(Infrastructure {
+        resources,
+        credentials: Some(credentials),
+    });
+
+    // Construct the final RuntimeConfig
+    RuntimeConfig {
+        environment,
+        infra: infra_struct,
+        deployment,
+        encore_platform: None,
+    }
+}
+
+// Helper function to map EnvString to SecretData
+fn map_env_string_to_secret_data(env_string: &EnvString) -> pbruntime::SecretData {
+    match env_string {
+        EnvString::String(s) => pbruntime::SecretData {
+            encoding: secret_data::Encoding::None as i32,
+            source: Some(secret_data::Source::Embedded(s.clone().into_bytes())),
+            sub_path: None,
+        },
+        EnvString::EnvRef(env_ref) => pbruntime::SecretData {
+            encoding: secret_data::Encoding::None as i32,
+            source: Some(secret_data::Source::Env(env_ref.env.clone())),
+            sub_path: None,
+        },
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use prost::Message;
+    use serde_json;
+    use std::fs;
+
+    #[test]
+    fn test_map_infra_to_runtime() {
+        // Load and parse the infra.config.json fixture
+        let infra_json = fs::read_to_string(format!(
+            "{}/resources/test/infra.config.json",
+            env!("CARGO_MANIFEST_DIR")
+        ))
+        .expect("Failed to read infra.config.json");
+        let infra_config: InfraConfig =
+            serde_json::from_str(&infra_json).expect("Failed to parse infra.config.json");
+
+        // Convert InfraConfig to Runtime
+        let runtime: RuntimeConfig = map_infra_to_runtime(infra_config);
+
+        // Load and parse the runtime.json fixture
+        let runtime_data = fs::read(format!(
+            "{}/resources/test/runtime.pb",
+            env!("CARGO_MANIFEST_DIR")
+        ))
+        .expect("Failed to read runtime.json");
+        let expected_runtime =
+            RuntimeConfig::decode(runtime_data.as_slice()).expect("Failed to parse runtime.json");
+
+        // Compare the converted runtime with the expected runtime
+        assert_eq!(
+            runtime, expected_runtime,
+            "Converted runtime does not match expected runtime"
+        );
+    }
+}
diff --git a/runtimes/core/src/lib.rs b/runtimes/core/src/lib.rs
new file mode 100644
index 0000000000..150cd6e126
--- /dev/null
+++ b/runtimes/core/src/lib.rs
@@ -0,0 +1,680 @@
+use std::borrow::Borrow;
+use std::collections::{HashMap, HashSet};
+use std::fmt::Display;
+use std::hash::Hash;
+use std::io::Read;
+
+use std::path::Path;
+use std::sync::Arc;
+
+use anyhow::Context;
+use base64::Engine;
+use duct::cmd;
+use prost::Message;
+
+use crate::api::reqauth::platform;
+pub use names::{CloudName, EncoreName, EndpointName};
+
+use crate::encore::parser::meta::v1 as metapb;
+use crate::encore::runtime::v1 as runtimepb;
+
+pub mod api;
+mod base32;
+pub mod error;
+pub mod infracfg;
+pub mod log;
+pub mod meta;
+pub mod model;
+mod names;
+pub mod objects;
+pub mod proccfg;
+pub mod pubsub;
+pub mod secrets;
+pub mod sqldb;
+mod trace;
+
+pub mod encore {
+    pub mod runtime {
+        pub mod v1 {
+            include!(concat!(env!("OUT_DIR"), "/encore.runtime.v1.rs"));
+        }
+    }
+
+    pub mod parser {
+        pub mod meta {
+            pub mod v1 {
+                include!(concat!(env!("OUT_DIR"), "/encore.parser.meta.v1.rs"));
+            }
+        }
+
+        pub mod schema {
+            pub mod v1 {
+                include!(concat!(env!("OUT_DIR"), "/encore.parser.schema.v1.rs"));
+            }
+        }
+    }
+}
+
+pub struct RuntimeBuilder {
+    cfg: Option<runtimepb::RuntimeConfig>,
+    proc_cfg: Option<proccfg::ProcessConfig>,
+    md: Option<metapb::Data>,
+    err: Option<anyhow::Error>,
+    test_mode: bool,
+    is_worker: bool,
+}
+
+impl Default for RuntimeBuilder {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl RuntimeBuilder {
+    pub fn new() -> Self {
+        Self {
+            cfg: None,
+            proc_cfg: None,
+            md: None,
+            err: None,
+            test_mode: false,
+            is_worker: false,
+        }
+    }
+
+    pub fn with_test_mode(mut self, enabled: bool) -> Self {
+        self.test_mode = enabled;
+        if enabled {
+            enable_test_mode().unwrap();
+        }
+        self
+    }
+
+    pub fn with_worker(mut self, enabled: bool) -> Self {
+        self.is_worker = enabled;
+        self
+    }
+
+    pub fn with_runtime_config(mut self, cfg: runtimepb::RuntimeConfig) -> Self {
+        self.cfg = Some(cfg);
+        self
+    }
+
+    pub fn with_proc_config(mut self, proc_cfg: proccfg::ProcessConfig) -> Self {
+        self.proc_cfg = Some(proc_cfg);
+        self
+    }
+
+    pub fn with_runtime_config_from_env(mut self) -> Self {
+        if self.err.is_none() {
+            match infra_config_from_env() {
+                Ok(opt_cfg) => match opt_cfg {
+                    Some(cfg) => self.cfg = Some(cfg),
+                    None => match runtime_config_from_env() {
+                        Ok(cfg) => self.cfg = Some(cfg),
+                        Err(e) => {
+                            self.err = Some(
+                                anyhow::Error::new(e).context("unable to parse runtime config"),
+                            )
+                        }
+                    },
+                },
+                Err(e) => {
+                    self.err = Some(anyhow::Error::new(e).context("unable to parse infra config"))
+                }
+            }
+            match proc_config_from_env() {
+                Ok(cfg) => self.proc_cfg = cfg,
+                Err(e) => {
+                    self.err = Some(anyhow::Error::new(e).context("unable to parse process config"))
+                }
+            }
+        }
+        self
+    }
+
+    pub fn with_meta(mut self, md: metapb::Data) -> Self {
+        self.md = Some(md);
+        self
+    }
+
+    pub fn with_meta_autodetect(mut self) -> Self {
+        fn auto_detect() -> Result<metapb::Data, anyhow::Error> {
+            match meta_from_env() {
+                Ok(md) => Ok(md),
+                Err(ParseError::EnvNotPresent) => {
+                    let path = Path::new("/encore/meta");
+                    parse_meta(path).context("unable to parse app metadata file")
+                }
+                Err(e) => {
+                    Err(anyhow::Error::new(e)
+                        .context("unable to parse app metadata from environment"))
+                }
+            }
+        }
+
+        if self.err.is_none() {
+            match auto_detect() {
+                Ok(md) => self.md = Some(md),
+                Err(e) => self.err = Some(e),
+            }
+        }
+        self
+    }
+
+    pub fn with_meta_from_env(mut self) -> Self {
+        if self.err.is_none() {
+            match meta_from_env() {
+                Ok(md) => self.md = Some(md),
+                Err(e) => {
+                    self.err = Some(anyhow::Error::new(e).context("unable to parse app metadata"))
+                }
+            }
+        }
+        self
+    }
+
+    pub fn with_meta_from_path(mut self, meta_path: &Path) -> Self {
+        if self.err.is_none() {
+            match parse_meta(meta_path) {
+                Ok(md) => self.md = Some(md),
+                Err(e) => {
+                    self.err = Some(anyhow::Error::new(e).context("unable to parse app metadata"))
+                }
+            }
+        }
+        self
+    }
+
+    pub fn build(self) -> anyhow::Result<Runtime> {
+        if let Some(err) = self.err {
+            return Err(err);
+        }
+        let mut cfg = self.cfg.context("runtime config not provided")?;
+        let md = self.md.context("metadata not provided")?;
+        if let Some(proc_config) = self.proc_cfg {
+            proc_config.apply(&mut cfg)?;
+        }
+        Runtime::new(cfg, md, self.test_mode)
+    }
+}
+
+pub struct Runtime {
+    md: metapb::Data,
+    pubsub: pubsub::Manager,
+    secrets: secrets::Manager,
+    sqldb: sqldb::Manager,
+    objects: objects::Manager,
+    api: api::Manager,
+    app_meta: meta::AppMeta,
+    compute: ComputeConfig,
+    runtime: tokio::runtime::Runtime,
+}
+
+impl Runtime {
+    pub fn builder() -> RuntimeBuilder {
+        RuntimeBuilder::new()
+    }
+
+    pub fn new(
+        mut cfg: runtimepb::RuntimeConfig,
+        md: metapb::Data,
+        testing: bool,
+    ) -> anyhow::Result<Self> {
+        // Initialize OpenSSL system root certificates, so that libraries can find them.
+        openssl_probe::init_ssl_cert_env_vars();
+
+        let tokio_rt = tokio::runtime::Builder::new_multi_thread()
+            .enable_all()
+            .build()
+            .context("failed to build tokio runtime")?;
+
+        let app_meta = meta::AppMeta::new(&cfg, &md);
+        let environment = cfg.environment.take().unwrap_or_default();
+        let mut infra = cfg.infra.take().unwrap_or_default();
+        let resources = infra.resources.take().unwrap_or_default();
+        let creds = infra.credentials.take().unwrap_or_default();
+        let encore_platform = cfg.encore_platform.take().unwrap_or_default();
+
+        let mut deployment = cfg.deployment.take().unwrap_or_default();
+        let service_discovery = deployment.service_discovery.take().unwrap_or_default();
+
+        let http_client = reqwest::Client::builder()
+            .build()
+            .context("failed to build http client")?;
+
+        let secrets = secrets::Manager::new(resources.app_secrets);
+        let platform_validator = platform::RequestValidator::new(
+            &secrets,
+            encore_platform.platform_signing_keys.clone(),
+        );
+        let platform_validator = Arc::new(platform_validator);
+
+        // Set up observability.
+        let disable_tracing =
+            testing || std::env::var("ENCORE_NOTRACE").is_ok_and(|v| !v.is_empty());
+        let tracer = if !disable_tracing {
+            let observability = deployment.observability.take().unwrap_or_default();
+            let trace_endpoint = observability
+                .tracing
+                .into_iter()
+                .find_map(|p| match p.provider {
+                    Some(runtimepb::tracing_provider::Provider::Encore(encore)) => {
+                        Some(encore.trace_endpoint)
+                    }
+                    _ => None,
+                })
+                .and_then(|ep| match reqwest::Url::parse(&ep) {
+                    Ok(ep) => Some(ep),
+                    Err(err) => {
+                        ::log::warn!("disabling tracing: invalid trace endpoint {}: {}", ep, err);
+                        None
+                    }
+                });
+
+            match trace_endpoint {
+                Some(trace_endpoint) => {
+                    let config = trace::ReporterConfig {
+                        app_id: environment.app_id.clone(),
+                        env_id: environment.env_id.clone(),
+                        deploy_id: deployment.deploy_id.clone(),
+                        app_commit: md.app_revision.clone(),
+                        trace_endpoint,
+                        platform_validator: platform_validator.clone(),
+                    };
+
+                    let (tracer, reporter) = trace::streaming_tracer(http_client.clone(), config);
+                    tokio_rt.spawn(reporter.start_reporting());
+                    tracer
+                }
+                None => trace::Tracer::noop(),
+            }
+        } else {
+            trace::Tracer::noop()
+        };
+
+        log::set_tracer(tracer.clone());
+
+        // Find push subscriptions which should be proxied to the subscribing service by the gateway
+        let proxied_push_subs = resources
+            .pubsub_clusters
+            .iter()
+            .flat_map(|c| c.subscriptions.iter())
+            .filter(|s| s.push_only)
+            .filter_map(|s| {
+                let svc_name = (|| -> Result<String, anyhow::Error> {
+                    Ok(md
+                        .pubsub_topics
+                        .iter()
+                        .find(|t| t.name == s.topic_encore_name)
+                        .context("could not find topic")?
+                        .subscriptions
+                        .iter()
+                        .find(|ms| ms.name == s.subscription_encore_name)
+                        .context("could not find sub")?
+                        .service_name
+                        .clone())
+                })();
+                if svc_name.is_err() {
+                    return None;
+                }
+                match deployment
+                    .hosted_services
+                    .iter()
+                    .any(|s| s.name == *svc_name.as_ref().unwrap())
+                {
+                    true => None,
+                    false => Some(Ok((s.rid.clone(), EncoreName::from(svc_name.unwrap())))),
+                }
+            })
+            .collect::<Result<HashMap<_, _>, anyhow::Error>>()
+            .context("failed to resolve gateway push subscriptions")?;
+
+        let pubsub = pubsub::Manager::new(tracer.clone(), resources.pubsub_clusters, &md)?;
+        let objects =
+            objects::Manager::new(&secrets, tracer.clone(), resources.bucket_clusters, &md);
+        let sqldb = sqldb::ManagerConfig {
+            clusters: resources.sql_clusters,
+            creds: &creds,
+            secrets: &secrets,
+            tracer: tracer.clone(),
+            runtime: tokio_rt.handle().clone(),
+        }
+        .build()
+        .context("unable to initialize sqldb proxy")?;
+
+        // Determine the compute configuration.
+        let compute = {
+            let mut cfg = ComputeConfig::default();
+            for svc in deployment.hosted_services.iter() {
+                if let Some(log_config) = &svc.log_config {
+                    cfg.log_level = Some(log_config.clone());
+                }
+                if let Some(worker_threads) = svc.worker_threads {
+                    // If we have worker threads already configured on the compute config,
+                    // determine the new value.
+                    cfg.worker_threads = Some(match (cfg.worker_threads, worker_threads) {
+                        // If either explicitly wants 1 worker threads (disabling it), set it to 1.
+                        (Some(1), _) | (_, 1) => 1,
+
+                        // If we have worker threads enabled on both, set it to the minimum.
+                        (Some(a), b) if a > 1 && b > 1 => a.min(b),
+
+                        // Otherwise use the existing value, if any.
+                        (Some(a), _) => a,
+                        // If we don't have an existing value, use the new value.
+                        (None, b) => b,
+                    });
+                }
+            }
+            cfg
+        };
+
+        let api = api::ManagerConfig {
+            meta: &md,
+            environment: &environment,
+            gateways: resources.gateways,
+            hosted_services: deployment.hosted_services,
+            hosted_gateway_rids: deployment.hosted_gateways,
+            svc_auth_methods: deployment.auth_methods,
+            deploy_id: deployment.deploy_id,
+            platform: &encore_platform,
+            secrets: &secrets,
+            service_discovery,
+            http_client: http_client.clone(),
+            tracer,
+            platform_validator,
+            pubsub_push_registry: pubsub.push_registry(),
+            runtime: tokio_rt.handle().clone(),
+            testing,
+            proxied_push_subs,
+        }
+        .build()
+        .context("unable to initialize api manager")?;
+
+        let sqldb_handle = sqldb.start_serving();
+        tokio_rt.spawn(async move {
+            if let Err(err) = sqldb_handle.await {
+                ::log::error!("sqldb proxy failed: {err}");
+            }
+        });
+
+        ::log::debug!("encore runtime successfully initialized");
+
+        Ok(Self {
+            md,
+            pubsub,
+            secrets,
+            sqldb,
+            objects,
+            api,
+            app_meta,
+            compute,
+            runtime: tokio_rt,
+        })
+    }
+
+    #[inline]
+    pub fn pubsub(&self) -> &pubsub::Manager {
+        &self.pubsub
+    }
+
+    #[inline]
+    pub fn secrets(&self) -> &secrets::Manager {
+        &self.secrets
+    }
+
+    #[inline]
+    pub fn sqldb(&self) -> &sqldb::Manager {
+        &self.sqldb
+    }
+
+    #[inline]
+    pub fn objects(&self) -> &objects::Manager {
+        &self.objects
+    }
+
+    #[inline]
+    pub fn metadata(&self) -> &metapb::Data {
+        &self.md
+    }
+
+    #[inline]
+    pub fn api(&self) -> &api::Manager {
+        &self.api
+    }
+
+    #[inline]
+    pub fn endpoints(&self) -> &api::EndpointMap {
+        self.api.endpoints()
+    }
+
+    #[inline]
+    pub fn tokio_handle(&self) -> &tokio::runtime::Handle {
+        self.runtime.handle()
+    }
+
+    #[inline]
+    pub fn run_blocking(&self) {
+        self.runtime.block_on(async move {
+            let api_handle = self.api().start_serving();
+
+            if let Err(err) = api_handle.await {
+                ::log::error!("failed to start serving: {:?}", err);
+            }
+        });
+    }
+
+    #[inline]
+    pub fn app_meta(&self) -> &meta::AppMeta {
+        &self.app_meta
+    }
+
+    #[inline]
+    pub fn compute(&self) -> &ComputeConfig {
+        &self.compute
+    }
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct ComputeConfig {
+    pub log_level: Option<String>,
+    pub worker_threads: Option<i32>,
+}
+
+#[derive(Debug)]
+enum ParseError {
+    EnvNotPresent,
+    EnvVar(std::env::VarError),
+    Base64(base64::DecodeError),
+    Proto(prost::DecodeError),
+    IO(std::io::Error),
+}
+
+impl Display for ParseError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ParseError::EnvNotPresent => write!(f, "environment variable not present"),
+            ParseError::EnvVar(e) => write!(f, "failed to read environment variable: {e}"),
+            ParseError::Base64(e) => write!(f, "failed to decode environment variable: {e}"),
+            ParseError::Proto(e) => write!(f, "failed to parse environment variable: {e}"),
+            ParseError::IO(e) => write!(f, "failed to read file: {e}"),
+        }
+    }
+}
+
+impl std::error::Error for ParseError {}
+
+fn infra_config_from_env() -> Result<Option<runtimepb::RuntimeConfig>, ParseError> {
+    let cfg_path = match std::env::var("ENCORE_INFRA_CONFIG_PATH") {
+        Ok(cfg) => cfg,
+        Err(std::env::VarError::NotPresent) => return Ok(None),
+        Err(e) => return Err(ParseError::EnvVar(e)),
+    };
+    let file_content = std::fs::read_to_string(cfg_path).map_err(ParseError::IO)?;
+    let infra_config: infracfg::InfraConfig = serde_json::from_str(&file_content)
+        .map_err(|e| ParseError::IO(std::io::Error::new(std::io::ErrorKind::InvalidData, e)))?;
+    let runtime_config = infracfg::map_infra_to_runtime(infra_config);
+    Ok(Some(runtime_config))
+}
+
+fn runtime_config_from_env() -> Result<runtimepb::RuntimeConfig, ParseError> {
+    let cfg = match std::env::var("ENCORE_RUNTIME_CONFIG") {
+        Ok(cfg) => cfg,
+        Err(std::env::VarError::NotPresent) => return Err(ParseError::EnvNotPresent),
+        Err(e) => return Err(ParseError::EnvVar(e)),
+    };
+
+    if cfg.starts_with("gzip:") {
+        // Parse the remainder as base64-encoded gzip data.
+        let cfg = cfg.as_bytes();
+        let cfg = &cfg["gzip:".len()..];
+        let gzip_data = base64::engine::general_purpose::STANDARD
+            .decode(cfg)
+            .map_err(ParseError::Base64)?;
+
+        let mut decoder = flate2::read::GzDecoder::new(&gzip_data[..]);
+        let mut raw_data = Vec::new();
+        decoder.read_to_end(&mut raw_data).map_err(ParseError::IO)?;
+        runtimepb::RuntimeConfig::decode(&raw_data[..]).map_err(ParseError::Proto)
+    } else {
+        let decoded = base64::engine::general_purpose::STANDARD
+            .decode(cfg.as_bytes())
+            .map_err(ParseError::Base64)?;
+        runtimepb::RuntimeConfig::decode(&decoded[..]).map_err(ParseError::Proto)
+    }
+}
+
+fn proc_config_from_env() -> Result<Option<proccfg::ProcessConfig>, ParseError> {
+    let encoded_config = match std::env::var("ENCORE_PROCESS_CONFIG") {
+        Ok(config) => config,
+        Err(std::env::VarError::NotPresent) => return Ok(None),
+        Err(e) => return Err(ParseError::EnvVar(e)),
+    };
+
+    let decoded = base64::engine::general_purpose::STANDARD
+        .decode(encoded_config)
+        .map_err(ParseError::Base64)?;
+
+    let json_str = String::from_utf8(decoded)
+        .map_err(|e| ParseError::IO(std::io::Error::new(std::io::ErrorKind::InvalidData, e)))?;
+
+    let config = serde_json::from_str(&json_str)
+        .map_err(|e| ParseError::IO(std::io::Error::new(std::io::ErrorKind::InvalidData, e)))?;
+
+    Ok(Some(config))
+}
+
+fn meta_from_env() -> Result<metapb::Data, ParseError> {
+    let cfg = match std::env::var("ENCORE_APP_META") {
+        Ok(cfg) => cfg,
+        Err(std::env::VarError::NotPresent) => {
+            // Not present. Check the ENCORE_APP_META_PATH environment variable.
+            match std::env::var("ENCORE_APP_META_PATH") {
+                Ok(path) => {
+                    let path = Path::new(&path);
+                    return parse_meta(path);
+                }
+                Err(std::env::VarError::NotPresent) => return Err(ParseError::EnvNotPresent),
+                Err(e) => return Err(ParseError::EnvVar(e)),
+            }
+        }
+        Err(e) => return Err(ParseError::EnvVar(e)),
+    };
+
+    if cfg.starts_with("gzip:") {
+        // Parse the remainder as base64-encoded gzip data.
+        let cfg = cfg.as_bytes();
+        let cfg = &cfg["gzip:".len()..];
+        let gzip_data = base64::engine::general_purpose::STANDARD
+            .decode(cfg)
+            .map_err(ParseError::Base64)?;
+
+        let mut decoder = flate2::read::GzDecoder::new(&gzip_data[..]);
+        let mut raw_data = Vec::new();
+        decoder.read_to_end(&mut raw_data).map_err(ParseError::IO)?;
+        metapb::Data::decode(&raw_data[..]).map_err(ParseError::Proto)
+    } else {
+        let decoded = base64::engine::general_purpose::STANDARD
+            .decode(cfg.as_bytes())
+            .map_err(ParseError::Base64)?;
+        metapb::Data::decode(&decoded[..]).map_err(ParseError::Proto)
+    }
+}
+
+fn parse_meta(path: &Path) -> Result<metapb::Data, ParseError> {
+    let data = std::fs::read(path).map_err(ParseError::IO)?;
+    metapb::Data::decode(&data[..]).map_err(ParseError::Proto)
+}
+
+fn enable_test_mode() -> Result<(), ParseError> {
+    if std::env::var("ENCORE_APP_META").is_ok() || std::env::var("ENCORE_APP_META_PATH").is_ok() {
+        return Ok(());
+    }
+
+    let out = cmd!("encore", "test", "--prepare")
+        .stdout_capture()
+        .stderr_capture()
+        .run()
+        .map_err(ParseError::IO)?;
+    if !out.status.success() {
+        return Err(ParseError::IO(std::io::Error::other(
+            String::from_utf8(out.stderr).unwrap(),
+        )));
+    }
+
+    let data =
+        String::from_utf8(out.stdout).map_err(|e| ParseError::IO(std::io::Error::other(e)))?;
+
+    for line in data.split('\n') {
+        let Some((name, value)) = line.split_once('=') else {
+            continue;
+        };
+        match name {
+            "ENCORE_APP_META" => std::env::set_var("ENCORE_APP_META", value),
+            "ENCORE_RUNTIME_CONFIG" => std::env::set_var("ENCORE_RUNTIME_CONFIG", value),
+            _ => (),
+        }
+    }
+
+    Ok(())
+}
+
+/// Describes which services or gateways are hosted by this server.
+#[derive(Debug, Clone)]
+pub struct Hosted(pub HashSet<String>);
+
+impl Hosted {
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    pub fn iter(&self) -> impl Iterator<Item = &String> {
+        self.0.iter()
+    }
+
+    /// Reports whether the given service/entity is hosted by this runtime.
+    pub fn contains<Q>(&self, name: &Q) -> bool
+    where
+        String: Borrow<Q>,
+        Q: Eq + Hash + ?Sized,
+    {
+        self.0.contains(name)
+    }
+}
+
+impl FromIterator<String> for Hosted {
+    fn from_iter<I: IntoIterator<Item = String>>(iter: I) -> Self {
+        Self(iter.into_iter().collect())
+    }
+}
+
+/// Returns the version of the Encore runtime.
+pub fn version() -> &'static str {
+    option_env!("ENCORE_VERSION").unwrap_or(env!("CARGO_PKG_VERSION"))
+}
+
+/// Returns the git commit used to build the Encore runtime.
+pub fn build_commit() -> &'static str {
+    env!("ENCORE_BINARY_GIT_HASH")
+}
diff --git a/runtimes/core/src/log/consolewriter.rs b/runtimes/core/src/log/consolewriter.rs
new file mode 100644
index 0000000000..a1c08e887a
--- /dev/null
+++ b/runtimes/core/src/log/consolewriter.rs
@@ -0,0 +1,213 @@
+use crate::error::{write_stack_trace, StackFrame};
+use crate::log::fields::FieldConfig;
+use crate::log::writers::Writer;
+use anyhow::Context;
+use chrono::Timelike;
+use colored::Colorize;
+use serde_json::Value;
+use std::cell::RefCell;
+use std::collections::BTreeMap;
+use std::io::Write;
+use std::sync::Mutex;
+
+pub struct ConsoleWriter<W: Write + Sync + Send + 'static> {
+    field_config: &'static FieldConfig,
+    mu: Mutex<RefCell<Box<W>>>,
+}
+
+impl<W: Write + Sync + Send + 'static> ConsoleWriter<W> {
+    pub fn new(field_config: &'static FieldConfig, w: W) -> Self {
+        Self {
+            field_config,
+            mu: Mutex::new(RefCell::new(Box::new(w))),
+        }
+    }
+
+    fn write_fields(
+        &self,
+        buf: &mut Vec<u8>,
+        values: &BTreeMap<String, Value>,
+    ) -> anyhow::Result<()> {
+        // error field is always first
+        if let Some(err) = values.get(self.field_config.error_field_name) {
+            if !buf.is_empty() {
+                buf.push(b' ');
+            }
+            write!(
+                buf,
+                "{}{}",
+                format!("{}=", self.field_config.error_field_name).cyan(),
+                format!("{err}").red()
+            )
+            .context("unable to write error field value")?;
+        }
+
+        for key in values.keys() {
+            if key == self.field_config.timestamp_field_name
+                || key == self.field_config.level_field_name
+                || key == self.field_config.caller_field_name
+                || key == self.field_config.message_field_name
+                || key == self.field_config.error_field_name
+                || key == self.field_config.stack_trace_field_name
+            {
+                continue;
+            }
+
+            if !buf.is_empty() {
+                buf.push(b' ');
+            }
+            write!(buf, "{}", format!("{key}=").cyan())
+                .context(format!("unable to write field key {key}"))?;
+
+            let value = values.get(key).expect("key not found");
+
+            let value_to_print = match value {
+                // Strings have special handling, as if the string does not contain any special characters or whitespace
+                // we just print the string, otherwise we print the string as a JSON string (i.e. wrapped in quotes and escaped)
+                Value::String(s) => {
+                    if s.contains(' ')
+                        || s.contains('\t')
+                        || s.contains('\n')
+                        || s.contains('\r')
+                        || s.contains('\\')
+                        || s.contains('"')
+                    {
+                        format!("{value}")
+                    } else {
+                        s.to_string()
+                    }
+                }
+                _ => format!("{value}"),
+            };
+
+            write!(buf, "{value_to_print}")
+                .context(format!("unable to write field value {key}"))?;
+        }
+
+        // Finally, write the stack trace to the log
+        if let Some(stack) = values.get(self.field_config.stack_trace_field_name) {
+            let stack: Result<Vec<StackFrame>, serde_json::Error> =
+                serde_json::from_value(stack.clone());
+            if let Ok(stack) = stack {
+                let mut writer = VecWriter { buf };
+                write_stack_trace(&stack, &mut writer).context("unable to write stack trace")?;
+            }
+        }
+
+        Ok(())
+    }
+}
+
+struct VecWriter<'a> {
+    buf: &'a mut Vec<u8>,
+}
+impl std::fmt::Write for VecWriter<'_> {
+    fn write_str(&mut self, s: &str) -> std::fmt::Result {
+        self.buf.extend_from_slice(s.as_bytes());
+        Ok(())
+    }
+}
+
+impl<W: Write + Sync + Send + 'static> Writer for ConsoleWriter<W> {
+    fn write(&self, level: log::Level, values: &BTreeMap<String, Value>) -> anyhow::Result<()> {
+        let mut buf = Vec::with_capacity(256);
+
+        write_part(
+            &mut buf,
+            self.field_config.timestamp_field_name,
+            values,
+            format_timestamp,
+        )?;
+        write_level(&mut buf, level)?;
+        write_part(
+            &mut buf,
+            self.field_config.caller_field_name,
+            values,
+            format_caller,
+        )?;
+        write_part(
+            &mut buf,
+            self.field_config.message_field_name,
+            values,
+            format_message,
+        )?;
+
+        self.write_fields(&mut buf, values)?;
+
+        buf.write_all(b"\n").context("new line")?;
+
+        match self.mu.lock() {
+            Ok(guard) => {
+                let mut w = guard
+                    .try_borrow_mut()
+                    .context("unable to borrow console output")?;
+                w.write_all(&buf).context("write")?;
+                Ok(())
+            }
+            Err(poisoned) => Err(anyhow::anyhow!("poisoned mutex: {:?}", poisoned)),
+        }
+    }
+}
+
+fn write_part(
+    buf: &mut Vec<u8>,
+    field: &'static str,
+    values: &BTreeMap<String, Value>,
+    mapper: fn(&str) -> anyhow::Result<String>,
+) -> anyhow::Result<()> {
+    if let Some(value) = values.get(field) {
+        if let Some(value) = value.as_str() {
+            let value = mapper(value).context(format!("unable to map part {field}"))?;
+            if !buf.is_empty() {
+                buf.push(b' ');
+            }
+            write!(buf, "{value}").context(format!("unable to write part {field}"))?;
+        }
+    }
+    Ok(())
+}
+
+fn format_timestamp(timestamp: &str) -> anyhow::Result<String> {
+    let timestamp = chrono::DateTime::parse_from_rfc3339(timestamp)
+        .context(format!("unable to parse timestamp: {timestamp}"))?;
+    let datetime: chrono::DateTime<chrono::Local> = timestamp.into();
+
+    let (is_pm, hour) = datetime.hour12();
+    let minute = datetime.minute();
+
+    let mut timestamp = String::with_capacity(32);
+    timestamp.push_str(&format!("{hour:02}:{minute:02}"));
+
+    if is_pm {
+        timestamp.push_str("PM");
+    } else {
+        timestamp.push_str("AM");
+    }
+
+    Ok(format!("{}", timestamp.bright_black()))
+}
+
+fn write_level(buf: &mut Vec<u8>, level: log::Level) -> anyhow::Result<()> {
+    let level_str = match level {
+        log::Level::Trace => "TRC".magenta(),
+        log::Level::Debug => "DBG".yellow(),
+        log::Level::Info => "INF".green(),
+        log::Level::Warn => "WRN".red(),
+        log::Level::Error => "ERR".red().bold(),
+    };
+
+    if !buf.is_empty() {
+        buf.push(b' ');
+    }
+    write!(buf, "{level_str}").context("unable to write log level")?;
+
+    Ok(())
+}
+
+fn format_caller(caller: &str) -> anyhow::Result<String> {
+    Ok(format!("{} {}", caller.bold(), ">".cyan()))
+}
+
+fn format_message(message: &str) -> anyhow::Result<String> {
+    Ok(message.to_string())
+}
diff --git a/runtimes/core/src/log/fields.rs b/runtimes/core/src/log/fields.rs
new file mode 100644
index 0000000000..84fb9c10e3
--- /dev/null
+++ b/runtimes/core/src/log/fields.rs
@@ -0,0 +1,77 @@
+/// Fields control the names of the fields that are used in the log output.
+#[derive(Debug)]
+pub struct FieldConfig {
+    pub timestamp_field_name: &'static str,
+
+    pub level_field_name: &'static str,
+    pub level_trace_value: &'static str,
+    pub level_debug_value: &'static str,
+    pub level_info_value: &'static str,
+    pub level_warn_value: &'static str,
+    pub level_error_value: &'static str,
+    pub level_fatal_value: &'static str,
+
+    pub message_field_name: &'static str,
+
+    pub error_field_name: &'static str,
+
+    pub caller_field_name: &'static str,
+
+    pub stack_trace_field_name: &'static str,
+}
+
+pub static DEFAULT_FIELDS: FieldConfig = FieldConfig {
+    timestamp_field_name: "time",
+
+    level_field_name: "level",
+    level_trace_value: "trace",
+    level_debug_value: "debug",
+    level_info_value: "info",
+    level_warn_value: "warn",
+    level_error_value: "error",
+    level_fatal_value: "fatal",
+
+    message_field_name: "message",
+
+    error_field_name: "error",
+
+    caller_field_name: "caller",
+
+    stack_trace_field_name: "stack",
+};
+
+pub static GCP_FIELDS: FieldConfig = FieldConfig {
+    timestamp_field_name: "timestamp",
+
+    level_field_name: "severity",
+    level_trace_value: "DEBUG",
+    level_debug_value: "DEBUG",
+    level_info_value: "INFO",
+    level_warn_value: "WARNING",
+    level_error_value: "ERROR",
+    level_fatal_value: "CRITICAL",
+
+    message_field_name: "message",
+
+    error_field_name: "error",
+
+    caller_field_name: "caller",
+
+    stack_trace_field_name: "stacktrace",
+};
+
+impl FieldConfig {
+    pub fn default() -> &'static FieldConfig {
+        // If we're running in GCP, then we'll use the GCP fields.
+        for var in &[
+            "GCP_PROJECT",
+            "GOOGLE_CLOUD_PROJECT",
+            "GCP_METADATA_PROJECT",
+        ] {
+            if std::env::var(var).is_ok() {
+                return &GCP_FIELDS;
+            }
+        }
+        &DEFAULT_FIELDS
+    }
+}
diff --git a/runtimes/core/src/log/logger.rs b/runtimes/core/src/log/logger.rs
new file mode 100644
index 0000000000..b42f43c8dc
--- /dev/null
+++ b/runtimes/core/src/log/logger.rs
@@ -0,0 +1,519 @@
+use crate::error::AppError;
+use crate::log::fields::FieldConfig;
+use crate::log::writers::{default_writer, Writer};
+use crate::model::{self, LogField};
+use crate::trace::protocol::LogMessageData;
+use crate::trace::Tracer;
+use anyhow::Context;
+use env_logger::filter::Filter;
+use log::{Log, Metadata, Record};
+use std::collections::BTreeMap;
+use std::sync::{Arc, RwLock};
+use std::time::SystemTime;
+
+pub type Fields = BTreeMap<String, serde_json::Value>;
+
+/// Logger is a structured JSON logger that can be used to emit structured logs to stderr
+#[derive(Debug, Clone)]
+pub struct Logger {
+    filter: Arc<Filter>,
+    app_level: log::LevelFilter,
+    field_config: &'static FieldConfig,
+    writer: Arc<dyn Writer>,
+    extra_fields: Fields,
+    tracer: Arc<RwLock<Tracer>>,
+}
+
+impl Logger {
+    /// New returns a new logger with the given field config.
+    pub fn new(
+        app_level: log::LevelFilter,
+        filter: Filter,
+        field_config: &'static FieldConfig,
+    ) -> Self {
+        Self {
+            filter: Arc::new(filter),
+            app_level,
+            field_config,
+            writer: default_writer(field_config),
+            extra_fields: Fields::new(),
+            tracer: Arc::new(RwLock::new(Tracer::noop())),
+        }
+    }
+
+    /// Sets the loggers tracer
+    pub fn set_tracer(&self, tracer: Tracer) {
+        let mut t = self.tracer.write().expect("tracer lock poisoned");
+        *t = tracer;
+    }
+
+    /// Returns a new logger with the given log level.
+    pub fn with_level(&self, level: log::LevelFilter) -> Self {
+        Self {
+            app_level: level,
+            ..self.clone()
+        }
+    }
+
+    /// Returns a new logger with the given writer.
+    pub fn with_writer(&self, writer: Arc<dyn Writer>) -> Self {
+        Self {
+            writer,
+            ..self.clone()
+        }
+    }
+
+    /// Returns a new logger with the given fields added to the context
+    /// that the logger will use when emitting logs as extra fields
+    pub fn with(&self, fields: Fields) -> Self {
+        let mut replacement = self.clone();
+
+        for (key, value) in fields.iter() {
+            replacement
+                .extra_fields
+                .insert(key.to_string(), value.clone());
+        }
+
+        replacement
+    }
+
+    /// Returns the current log level as expected by the `log` crate.
+    fn level_to_value(&self, level: ::log::Level) -> serde_json::Value {
+        serde_json::Value::from(match level {
+            ::log::Level::Trace => self.field_config.level_trace_value,
+            ::log::Level::Debug => self.field_config.level_debug_value,
+            ::log::Level::Info => self.field_config.level_info_value,
+            ::log::Level::Warn => self.field_config.level_warn_value,
+            ::log::Level::Error => self.field_config.level_error_value,
+        })
+    }
+
+    /// Takes the given message and attempts to log it to the configured writer.
+    fn try_log(
+        &self,
+        request: Option<&model::Request>,
+        level: log::Level,
+        msg: String,
+        error: Option<AppError>,
+        caller: Option<String>,
+        fields: Option<Fields>,
+    ) -> anyhow::Result<()> {
+        self.write_to_trace(request, level, &msg, &fields);
+
+        let mut values = Fields::new();
+
+        // Copy the extra fields into the values map.
+        for (key, value) in self.extra_fields.iter() {
+            values.insert(key.to_string(), value.clone());
+        }
+
+        // Copy the fields from the logger into the values map.
+        if let Some(fields) = fields {
+            values.extend(fields);
+        }
+
+        // If we have a caller field, add it to the values map.
+        if let Some(caller) = caller {
+            values.insert(
+                self.field_config.caller_field_name.to_string(),
+                serde_json::Value::from(caller),
+            );
+        }
+
+        // If we have an error field, then let's add it
+        if let Some(error) = error {
+            values.insert(
+                self.field_config.error_field_name.to_string(),
+                serde_json::Value::from(error.message),
+            );
+
+            if !error.stack.is_empty() {
+                values.insert(
+                    self.field_config.stack_trace_field_name.to_string(),
+                    serde_json::to_value(error.stack)?,
+                );
+            }
+        }
+
+        // Now add the standard fields.
+        values.insert(
+            self.field_config.level_field_name.to_string(),
+            self.level_to_value(level),
+        );
+        values.insert(
+            self.field_config.timestamp_field_name.to_string(),
+            iso8601_now(),
+        );
+        values.insert(
+            self.field_config.message_field_name.to_string(),
+            serde_json::Value::from(msg),
+        );
+
+        if let Some(req) = request {
+            match &req.data {
+                model::RequestData::RPC(rpc) => {
+                    let ep = &rpc.endpoint.name;
+                    values.insert(
+                        "service".into(),
+                        serde_json::Value::String(ep.service().to_string()),
+                    );
+                    values.insert(
+                        "endpoint".into(),
+                        serde_json::Value::String(ep.endpoint().to_string()),
+                    );
+                    if let Some(uid) = &rpc.auth_user_id {
+                        values.insert("uid".into(), serde_json::Value::String(uid.clone()));
+                    }
+                }
+                model::RequestData::Auth(auth) => {
+                    let ep = &auth.auth_handler;
+                    values.insert(
+                        "service".into(),
+                        serde_json::Value::String(ep.service().to_string()),
+                    );
+                    values.insert(
+                        "endpoint".into(),
+                        serde_json::Value::String(ep.endpoint().to_string()),
+                    );
+                }
+                model::RequestData::PubSub(msg) => {
+                    values.insert(
+                        "service".into(),
+                        serde_json::Value::String(msg.service.to_string()),
+                    );
+                    values.insert(
+                        "topic".into(),
+                        serde_json::Value::String(msg.topic.to_string()),
+                    );
+                    values.insert(
+                        "subscription".into(),
+                        serde_json::Value::String(msg.subscription.to_string()),
+                    );
+                }
+                model::RequestData::Stream(data) => {
+                    let ep = &data.endpoint.name;
+                    values.insert(
+                        "service".into(),
+                        serde_json::Value::String(ep.service().to_string()),
+                    );
+                    values.insert(
+                        "endpoint".into(),
+                        serde_json::Value::String(ep.endpoint().to_string()),
+                    );
+                }
+            };
+
+            values.insert(
+                "trace_id".into(),
+                serde_json::Value::String(req.span.0.serialize_encore()),
+            );
+            values.insert(
+                "span_id".into(),
+                serde_json::Value::String(req.span.1.serialize_encore()),
+            );
+
+            if let Some(corr_id) = &req.ext_correlation_id {
+                values.insert(
+                    "x_correlation_id".into(),
+                    serde_json::Value::String(corr_id.clone()),
+                );
+            } else if let Some(parent_trace) = &req.parent_trace {
+                values.insert(
+                    "x_correlation_id".into(),
+                    serde_json::Value::String(parent_trace.serialize_encore()),
+                );
+            }
+        }
+
+        // Now write the log to the configured writer.
+        self.writer
+            .write(level, &values)
+            .context("unable to write")?;
+
+        Ok(())
+    }
+
+    /// Takes a `log::Record` and attempts to log it to the configured writer.
+    fn try_log_record(&self, record: &Record) -> anyhow::Result<()> {
+        let kvs = record.key_values();
+        let mut visitor = KeyValueVisitor(BTreeMap::new());
+        let _ = kvs.visit(&mut visitor);
+
+        let msg = match record.args().as_str() {
+            Some(msg) => msg.to_string(),
+            None => record.args().to_string(),
+        };
+
+        let caller = match (record.module_path(), record.file(), record.line()) {
+            (Some(module), _, _) => Some(module.to_string()),
+            (_, Some(file), Some(line)) => Some(format!("{file}:{line}")),
+            _ => None,
+        };
+
+        self.try_log(None, record.level(), msg, None, caller, Some(visitor.0))
+    }
+
+    /// Writes the log to trace
+    fn write_to_trace(
+        &self,
+        request: Option<&model::Request>,
+        level: log::Level,
+        msg: &str,
+        fields: &Option<Fields>,
+    ) {
+        let fields = fields.as_ref().map(|fields| {
+            fields.iter().map(|(key, val)| match val {
+                serde_json::Value::Number(num) => {
+                    if num.is_i64() {
+                        LogField {
+                            key,
+                            value: model::LogFieldValue::I64(num.as_i64().unwrap()),
+                        }
+                    } else if num.is_u64() {
+                        LogField {
+                            key,
+                            value: model::LogFieldValue::U64(num.as_u64().unwrap()),
+                        }
+                    } else if num.is_f64() {
+                        LogField {
+                            key,
+                            value: model::LogFieldValue::F64(num.as_f64().unwrap()),
+                        }
+                    } else {
+                        // this can't happen as we have handle all the cases above,
+                        // but we need to handle this case for the iterator to function
+                        LogField {
+                            key,
+                            value: model::LogFieldValue::Json(&serde_json::Value::Null),
+                        }
+                    }
+                }
+                serde_json::Value::Bool(b) => LogField {
+                    key,
+                    value: model::LogFieldValue::Bool(b.to_owned()),
+                },
+                serde_json::Value::String(ref str) => LogField {
+                    key,
+                    value: model::LogFieldValue::String(str),
+                },
+                serde_json::Value::Array(_)
+                | serde_json::Value::Object(_)
+                | serde_json::Value::Null => LogField {
+                    key,
+                    value: model::LogFieldValue::Json(val),
+                },
+            })
+        });
+
+        self.tracer
+            .read()
+            .expect("tracer lock poisoned")
+            .log_message(LogMessageData {
+                source: request,
+                msg,
+                level,
+                fields,
+            });
+    }
+}
+
+/// This trait defines the logging functions that are available on the `Logger` type.
+///
+/// It is used to allow Rust code to emit structured logs via our `Logger` implementation
+/// as it will automatically capture the caller location.
+pub trait LogFromRust<T: std::fmt::Display> {
+    fn trace(&self, req: Option<&model::Request>, msg: T, fields: Option<Fields>);
+    fn debug(&self, req: Option<&model::Request>, msg: T, fields: Option<Fields>);
+
+    fn info(&self, req: Option<&model::Request>, msg: T, fields: Option<Fields>);
+
+    fn warn<Err: Into<AppError>>(
+        &self,
+        req: Option<&model::Request>,
+        msg: T,
+        error: Option<Err>,
+        fields: Option<Fields>,
+    );
+
+    fn error<Err: Into<AppError>>(
+        &self,
+        req: Option<&model::Request>,
+        msg: T,
+        error: Option<Err>,
+        fields: Option<Fields>,
+    );
+}
+
+/// This trait defines the logging functions that are available on the `Logger` type.
+///
+/// It is used to allow other languages to emit structured logs via our `Logger` implementation
+/// with them passing in their own caller location.
+pub trait LogFromExternalRuntime<T: std::fmt::Display> {
+    fn log<Err: Into<AppError>>(
+        &self,
+        request: Option<&model::Request>,
+        level: log::Level,
+        msg: T,
+        error: Option<Err>,
+        caller: Option<String>,
+        fields: Option<Fields>,
+    ) -> anyhow::Result<()>;
+}
+
+impl<T> LogFromExternalRuntime<T> for Logger
+where
+    T: std::fmt::Display,
+{
+    /// Logs the given message at the trace level
+    fn log<Err: Into<AppError>>(
+        &self,
+        request: Option<&model::Request>,
+        level: log::Level,
+        msg: T,
+        error: Option<Err>,
+        caller: Option<String>,
+        fields: Option<Fields>,
+    ) -> anyhow::Result<()> {
+        if level > self.app_level {
+            return Ok(());
+        }
+
+        self.try_log(
+            request,
+            level,
+            msg.to_string(),
+            error.map(|e| e.into().trim_stack(file!(), line!(), 1)),
+            caller,
+            fields,
+        )
+    }
+}
+
+impl<T> LogFromRust<T> for Logger
+where
+    T: std::fmt::Display,
+{
+    #[track_caller]
+    fn trace(&self, req: Option<&model::Request>, msg: T, fields: Option<Fields>) {
+        if log::Level::Trace > self.app_level {
+            return;
+        }
+
+        self.try_log(req, log::Level::Trace, msg.to_string(), None, None, fields)
+            .expect("failed to log");
+    }
+
+    #[track_caller]
+    fn debug(&self, req: Option<&model::Request>, msg: T, fields: Option<Fields>) {
+        if log::Level::Debug > self.app_level {
+            return;
+        }
+
+        self.try_log(req, log::Level::Debug, msg.to_string(), None, None, fields)
+            .expect("failed to log");
+    }
+
+    #[track_caller]
+    fn info(&self, req: Option<&model::Request>, msg: T, fields: Option<Fields>) {
+        if log::Level::Info > self.app_level {
+            return;
+        }
+
+        self.try_log(req, log::Level::Info, msg.to_string(), None, None, fields)
+            .expect("failed to log");
+    }
+
+    #[track_caller]
+    fn warn<Err: Into<AppError>>(
+        &self,
+        req: Option<&model::Request>,
+        msg: T,
+        error: Option<Err>,
+        fields: Option<Fields>,
+    ) {
+        if log::Level::Warn > self.app_level {
+            return;
+        }
+
+        self.try_log(
+            req,
+            log::Level::Warn,
+            msg.to_string(),
+            error.map(|e| e.into().trim_stack(file!(), line!(), 1)),
+            None,
+            fields,
+        )
+        .expect("failed to log");
+    }
+
+    #[track_caller]
+    fn error<Err: Into<AppError>>(
+        &self,
+        req: Option<&model::Request>,
+        msg: T,
+        error: Option<Err>,
+        fields: Option<Fields>,
+    ) {
+        if log::Level::Error > self.app_level {
+            return;
+        }
+
+        self.try_log(
+            req,
+            log::Level::Error,
+            msg.to_string(),
+            error.map(|e| e.into().trim_stack(file!(), line!(), 1)),
+            None,
+            fields,
+        )
+        .expect("failed to log");
+    }
+}
+
+/// Returns the current unix timestamp in milliseconds.
+#[inline]
+pub fn iso8601_now() -> serde_json::Value {
+    let now = SystemTime::now();
+    let date = chrono::DateTime::<chrono::Utc>::from(now);
+
+    serde_json::Value::from(date.to_rfc3339_opts(chrono::SecondsFormat::Millis, true))
+}
+
+/// Implement the `Log` trait for `Logger` which allows other creates which use the `log` facade
+/// crate to emit structured logs via our `Logger` implementation.
+impl Log for Logger {
+    fn enabled(&self, metadata: &Metadata) -> bool {
+        self.filter.enabled(metadata)
+    }
+
+    fn log(&self, record: &Record) {
+        if self.enabled(record.metadata()) {
+            self.try_log_record(record).unwrap_or_else(|e| {
+                eprintln!("failed to log: {e}");
+            });
+        }
+    }
+
+    fn flush(&self) {}
+}
+
+/// A visitor that can be used to visit key-value pairs and insert them into a `BTreeMap`.
+/// after converting them from the `log::kv::Value` type to `serde_json::Value`.
+struct KeyValueVisitor(BTreeMap<String, serde_json::Value>);
+
+impl log::kv::Visitor<'_> for KeyValueVisitor {
+    #[inline]
+    fn visit_pair(
+        &mut self,
+        key: log::kv::Key,
+        value: log::kv::Value,
+    ) -> Result<(), log::kv::Error> {
+        match serde_json::to_value(value) {
+            Ok(value) => {
+                self.0.insert(key.to_string(), value);
+                Ok(())
+            }
+            Err(e) => Err(log::kv::Error::boxed(e)),
+        }
+    }
+}
diff --git a/runtimes/core/src/log/mod.rs b/runtimes/core/src/log/mod.rs
new file mode 100644
index 0000000000..5d3965d2d2
--- /dev/null
+++ b/runtimes/core/src/log/mod.rs
@@ -0,0 +1,82 @@
+use once_cell::sync::OnceCell;
+
+mod consolewriter;
+mod fields;
+mod logger;
+mod writers;
+
+use crate::log::fields::FieldConfig;
+pub use logger::{Fields, LogFromExternalRuntime, LogFromRust, Logger};
+
+use crate::trace::Tracer;
+
+/// The global root logger instance that is used by both the `log` crate
+/// and all other code in the Encore runtime.
+static ROOT: OnceCell<&Logger> = OnceCell::new();
+
+/// Initialize the global logger with the `root()` instance
+///
+/// This function is idempotent and will not re-initialize the logger
+/// if it has already been initialized.
+pub fn init() {
+    _ = root();
+}
+
+/// Set the tracer on the global logger
+pub fn set_tracer(tracer: Tracer) {
+    root().set_tracer(tracer);
+}
+
+/// Returns a reference to the global root logger instance.
+pub fn root() -> &'static Logger {
+    ROOT.get_or_init(|| {
+        let logger = {
+            let fields = FieldConfig::default();
+
+            // Construct our rust log filter.
+            let filter = {
+                // If RUST_LOG is set, use that.
+                let level = std::env::var("RUST_LOG").unwrap_or_else(|_| {
+                    // Otherwise use ENCORE_RUNTIME_LOG to set the Encore runtime log level,
+                    // which defaults
+                    let level = std::env::var("ENCORE_RUNTIME_LOG").unwrap_or("debug".to_string());
+                    format!("encore_={level},pingora_core::listeners=warn,pingora_core::services::listening=warn,tokio_postgres::proxy={level},tokio_postgres::connect_proxy={level}")
+                });
+                env_logger::filter::Builder::new().parse(&level).build()
+            };
+
+            // Construct our app log level.
+            let app_level: log::LevelFilter = std::env::var("ENCORE_LOG")
+                .ok()
+                .and_then(|v| v.parse().ok())
+                .unwrap_or(log::LevelFilter::Trace);
+
+            Logger::new(app_level, filter, fields)
+        };
+
+        // Leak the logger to ensure it has a static lifetime.
+        // We only do this once.
+        let logger = Box::leak(Box::new(logger));
+
+        let disable_logging = std::env::var("ENCORE_NOLOG").is_ok_and(|v| !v.is_empty());
+        let filter = if disable_logging {
+            log::LevelFilter::Off
+        } else {
+            log::LevelFilter::Trace
+        };
+
+        #[cfg(feature = "rttrace")]
+        {
+            let filter = tracing_subscriber::EnvFilter::from_env("ENCORE_RUNTIME_TRACE");
+            tracing_subscriber::fmt()
+                .with_span_events(tracing_subscriber::fmt::format::FmtSpan::ENTER)
+                .with_env_filter(filter)
+                .with_writer(std::io::stderr)
+                .init();
+        }
+
+        log::set_max_level(filter);
+        log::set_logger(logger).expect("unable to set global logger instance");
+        logger
+    })
+}
diff --git a/runtimes/core/src/log/writers.rs b/runtimes/core/src/log/writers.rs
new file mode 100644
index 0000000000..a919d315c2
--- /dev/null
+++ b/runtimes/core/src/log/writers.rs
@@ -0,0 +1,132 @@
+use crate::log::consolewriter::ConsoleWriter;
+use crate::log::fields::FieldConfig;
+use anyhow::Context;
+use serde_json::Value;
+use std::collections::BTreeMap;
+use std::env;
+use std::fmt::Debug;
+use std::io::{IoSlice, Write};
+use std::sync::mpsc::{self, Receiver, RecvError, SyncSender, TryRecvError};
+use std::sync::Arc;
+use std::time::Duration;
+
+/// A log writer.
+pub trait Writer: Send + Sync + 'static {
+    /// Write the given key-value pairs to the log.
+    fn write(&self, level: log::Level, values: &BTreeMap<String, Value>) -> anyhow::Result<()>;
+}
+
+impl Debug for dyn Writer {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Writer").finish()
+    }
+}
+
+/// default_writer returns the default writer based on the environment.
+///
+/// If the `ENCORE_LOG_FORMAT` environment variable is set to `console` then
+/// the pretty console writer will be used to write logs to stderr, otherwise
+/// JSONL logs will be written to stderr.
+///
+/// For JSONL logs, if a tokio runtime is detected then the async writer
+/// will be used, otherwise a blocking writer will be used, resulting
+/// in blocking writes to stderr.
+pub fn default_writer(fields: &'static FieldConfig) -> Arc<dyn Writer> {
+    // Check if the user has set the `ENCORE_LOG_FORMAT` environment variable to `console`.
+    // if so we'll use the pretty console writer.
+    for var in &["ENCORE_LOG_FORMAT"] {
+        if let Ok(format) = env::var(var) {
+            if format == "console" {
+                return Arc::new(ConsoleWriter::new(fields, std::io::stderr()));
+            }
+        }
+    }
+
+    Arc::new(ActorWriter::default())
+}
+
+// ActorWriter creates a bounded channel that sends log data to a separate thread that handles the writing.
+pub struct ActorWriter {
+    sender: SyncSender<Vec<u8>>,
+}
+impl ActorWriter {
+    pub fn new<W: Write + Sync + Send + 'static>(mut writer: W) -> Self {
+        let (sender, recv) = mpsc::sync_channel::<Vec<u8>>(10_000);
+        std::thread::spawn(move || {
+            while let Ok(bytes) = Self::recv_batch(&recv) {
+                Self::write_batch_with_retry(&mut writer, &bytes);
+            }
+        });
+        Self { sender }
+    }
+
+    fn recv_batch(recv: &Receiver<Vec<u8>>) -> Result<Vec<Vec<u8>>, RecvError> {
+        const MAX_BATCH_SIZE: usize = 256;
+
+        // wait for a log message
+        let mut bufs = vec![recv.recv()?];
+
+        // receive logs until channel is empty or max batch size is reached
+        loop {
+            match recv.try_recv() {
+                Ok(log) => {
+                    bufs.push(log);
+
+                    if bufs.len() >= MAX_BATCH_SIZE {
+                        break;
+                    }
+                }
+                // on error, break the loop and return the bufs that we have already collected.
+                Err(TryRecvError::Disconnected) => break,
+                Err(TryRecvError::Empty) => break,
+            }
+        }
+        Ok(bufs)
+    }
+
+    fn write_batch_with_retry<W: Write>(writer: &mut W, bufs: &[Vec<u8>]) {
+        const INITIAL_DELAY_MS: u64 = 1;
+        const MAX_DELAY_MS: u64 = 1000;
+
+        let mut io_slices = bufs
+            .iter()
+            .map(|buf| IoSlice::new(buf))
+            .collect::<Vec<IoSlice>>();
+        let mut bufs = &mut io_slices[..];
+
+        // Guarantee that bufs is empty if it contains no data,
+        // to avoid calling write_vectored if there is no data to be written.
+        IoSlice::advance_slices(&mut bufs, 0);
+        let mut delay_ms = INITIAL_DELAY_MS;
+        while !bufs.is_empty() {
+            match writer.write_vectored(bufs) {
+                Ok(0) | Err(_) => {
+                    std::thread::sleep(Duration::from_millis(delay_ms));
+                    delay_ms = u64::min(delay_ms * 2, MAX_DELAY_MS);
+                }
+                Ok(n) => {
+                    delay_ms = INITIAL_DELAY_MS;
+                    IoSlice::advance_slices(&mut bufs, n)
+                }
+            }
+        }
+    }
+}
+impl Writer for ActorWriter {
+    fn write(&self, _: log::Level, values: &BTreeMap<String, Value>) -> anyhow::Result<()> {
+        let mut buf = Vec::with_capacity(256);
+        serde_json::to_writer(&mut buf, values)
+            .map_err(std::io::Error::from)
+            .context("serde_writer")?;
+        buf.extend_from_slice(b"\n");
+
+        self.sender.send(buf)?;
+        Ok(())
+    }
+}
+
+impl Default for ActorWriter {
+    fn default() -> Self {
+        Self::new(std::io::stderr())
+    }
+}
diff --git a/runtimes/core/src/meta/mod.rs b/runtimes/core/src/meta/mod.rs
new file mode 100644
index 0000000000..72bb3a685a
--- /dev/null
+++ b/runtimes/core/src/meta/mod.rs
@@ -0,0 +1,199 @@
+use serde::Serialize;
+
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::runtime::v1 as rt;
+
+#[derive(Debug, Clone, Default, Serialize)]
+pub struct AppMeta {
+    /// The Encore application ID. If the application is not linked to the Encore platform this will be an empty string.
+    /// To link to the Encore platform run `encore app link` from your terminal in the root directory of the Encore app.
+    pub app_id: String,
+
+    /// The base URL which can be used to call the API of this running application.
+    ///
+    /// For local development it is "http://localhost:<port>", typically "http://localhost:4000".
+    ///
+    /// If a custom domain is used for this environment it is returned here, but note that
+    /// changes only take effect at the time of deployment while custom domains can be updated at any time.
+    pub api_base_url: String,
+
+    /// Information about the environment the app is running in.
+    pub environment: EnvironmentMeta,
+
+    /// Information about the build.
+    pub build: BuildMeta,
+
+    /// Information about the deployment.
+    pub deploy: DeployMeta,
+}
+
+impl AppMeta {
+    pub fn new(rt: &rt::RuntimeConfig, md: &meta::Data) -> AppMeta {
+        let env = rt.environment.as_ref();
+
+        let app_id = env.map(|e| e.app_id.clone()).unwrap_or_default();
+
+        let api_base_url = rt
+            .infra
+            .as_ref()
+            .and_then(|infra| infra.resources.as_ref())
+            .and_then(|res| res.gateways.first())
+            .map(|gw| gw.base_url.clone())
+            .unwrap_or_default();
+
+        AppMeta {
+            app_id,
+            api_base_url,
+            environment: env.map_or_else(EnvironmentMeta::default, EnvironmentMeta::from),
+            build: BuildMeta::from(md),
+            deploy: rt
+                .deployment
+                .as_ref()
+                .map_or_else(DeployMeta::default, DeployMeta::from),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Default, Serialize)]
+pub struct EnvironmentMeta {
+    /// The name of environment that this application.
+    /// For local development it is "local".
+    pub name: String,
+
+    /// The type of environment is this application running in.
+    /// For local development it is "development".
+    pub r#type: EnvironmentType,
+
+    /// The cloud this is running in.
+    /// For local development it is "local".
+    pub cloud: CloudProvider,
+}
+
+impl From<&rt::Environment> for EnvironmentMeta {
+    fn from(env: &rt::Environment) -> Self {
+        let env_type = rt::environment::Type::try_from(env.env_type)
+            .unwrap_or(rt::environment::Type::Unspecified);
+        let cloud = rt::environment::Cloud::try_from(env.cloud)
+            .unwrap_or(rt::environment::Cloud::Unspecified);
+        EnvironmentMeta {
+            name: env.env_name.clone(),
+            r#type: EnvironmentType::from(&env_type),
+            cloud: CloudProvider::from(&cloud),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "lowercase")]
+#[derive(Default)]
+pub enum EnvironmentType {
+    // A production environment.
+    Production,
+    // A long-lived cloud-hosted, non-production environment, such as test environments, or local development.
+    #[default]
+    Development,
+    // A short-lived cloud-hosted, non-production environments, such as preview environments
+    Ephemeral,
+    // When running automated tests.
+    Test,
+}
+
+impl From<&rt::environment::Type> for EnvironmentType {
+    fn from(env: &rt::environment::Type) -> Self {
+        use rt::environment::Type::*;
+        match env {
+            Production => Self::Production,
+            Ephemeral => Self::Ephemeral,
+            Test => Self::Test,
+            Development | Unspecified => Self::Development,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "lowercase")]
+#[derive(Default)]
+pub enum CloudProvider {
+    AWS,
+    GCP,
+    Azure,
+    Encore,
+    #[default]
+    Local,
+}
+
+impl From<&rt::environment::Cloud> for CloudProvider {
+    fn from(cloud: &rt::environment::Cloud) -> Self {
+        use rt::environment::Cloud::*;
+        match cloud {
+            Aws => Self::AWS,
+            Gcp => Self::GCP,
+            Azure => Self::Azure,
+            Encore => Self::Encore,
+            Local | Unspecified => Self::Local,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Default, Serialize)]
+pub struct BuildMeta {
+    // The git commit that formed the base of this build.
+    pub revision: String,
+    // Whether there were uncommitted changes on top of the commit.
+    pub uncommitted_changes: bool,
+}
+
+impl From<&meta::Data> for BuildMeta {
+    fn from(md: &meta::Data) -> Self {
+        BuildMeta {
+            revision: md.app_revision.clone(),
+            uncommitted_changes: md.uncommitted_changes,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct HostedService {
+    // The name of the service
+    pub name: String,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct DeployMeta {
+    // The unique id of the deployment. Generated by the Encore Platform.
+    pub id: String,
+    // The time the deployment was made.
+    pub deploy_time: chrono::DateTime<chrono::Utc>,
+    // The services hosted by this deployment.
+    pub hosted_services: Vec<HostedService>,
+}
+
+impl From<&rt::Deployment> for DeployMeta {
+    fn from(rt: &rt::Deployment) -> Self {
+        DeployMeta {
+            id: rt.deploy_id.clone(),
+            deploy_time: rt
+                .deployed_at
+                .as_ref()
+                .and_then(|d| chrono::DateTime::from_timestamp(d.seconds, d.nanos as u32))
+                .unwrap_or_else(chrono::Utc::now),
+            hosted_services: rt
+                .hosted_services
+                .iter()
+                .map(|s| HostedService {
+                    name: s.name.clone(),
+                })
+                .collect(),
+        }
+    }
+}
+
+impl Default for DeployMeta {
+    fn default() -> Self {
+        DeployMeta {
+            id: "".into(),
+            deploy_time: chrono::Utc::now(),
+            hosted_services: vec![],
+        }
+    }
+}
diff --git a/runtimes/core/src/model/mod.rs b/runtimes/core/src/model/mod.rs
new file mode 100644
index 0000000000..8fea81a859
--- /dev/null
+++ b/runtimes/core/src/model/mod.rs
@@ -0,0 +1,359 @@
+use axum::extract::WebSocketUpgrade;
+use chrono::Utc;
+use indexmap::IndexMap;
+use std::fmt::Debug;
+use std::str::FromStr;
+use std::sync::{Arc, Mutex};
+use std::time::SystemTime;
+
+use rand::RngCore;
+use tokio::time::Instant;
+
+use crate::api::reqauth::caller::Caller;
+use crate::api::schema::JSONPayload;
+use crate::api::{auth, Endpoint, PValue, PValues};
+use crate::{api, EncoreName, EndpointName};
+
+#[derive(Clone, Copy, Debug, Hash, Eq, PartialEq)]
+pub struct TraceId(pub [u8; 16]);
+
+#[derive(Clone, Copy, Debug, Hash, Eq, PartialEq)]
+pub struct SpanId(pub [u8; 8]);
+
+/// Uniquely identifies a span.
+#[derive(Clone, Copy, Debug, Hash, Eq, PartialEq)]
+pub struct SpanKey(pub TraceId, pub SpanId);
+
+/// Uniquely identifies an event within a trace.
+#[derive(Clone, Copy, Debug, Hash, Eq, PartialEq)]
+#[must_use]
+pub struct TraceEventId(pub u64);
+
+impl FromStr for TraceEventId {
+    type Err = std::num::ParseIntError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        let id = u64::from_str_radix(s, 32)?;
+        Ok(TraceEventId(id))
+    }
+}
+
+impl TraceEventId {
+    pub fn serialize(&self) -> String {
+        radix_fmt::radix(self.0, 32).to_string()
+    }
+}
+
+impl TraceId {
+    pub fn generate() -> Self {
+        let mut trace_id = [0u8; 16];
+        rand::thread_rng().fill_bytes(&mut trace_id);
+        TraceId(trace_id)
+    }
+
+    pub fn serialize_encore(&self) -> String {
+        crate::base32::encode(crate::base32::Alphabet::Encore, &self.0)
+    }
+
+    pub fn serialize_std(&self) -> String {
+        hex::encode(self.0)
+    }
+
+    pub fn parse_encore(s: &str) -> Result<Self, InvalidBase32> {
+        let Some(bytes) = crate::base32::decode(crate::base32::Alphabet::Encore, s) else {
+            return Err(InvalidBase32);
+        };
+        let trace_id: [u8; 16] = bytes.try_into().map_err(|_| InvalidBase32)?;
+        Ok(TraceId(trace_id))
+    }
+
+    pub fn parse_std(s: &str) -> Result<Self, hex::FromHexError> {
+        let bytes = hex::decode(s)?;
+        let trace_id: [u8; 16] = bytes
+            .try_into()
+            .map_err(|_| hex::FromHexError::InvalidStringLength)?;
+        Ok(TraceId(trace_id))
+    }
+
+    pub fn with_span(&self, span_id: SpanId) -> SpanKey {
+        SpanKey(*self, span_id)
+    }
+}
+
+pub struct InvalidBase32;
+
+impl SpanId {
+    pub fn generate() -> Self {
+        let mut span_id = [0u8; 8];
+        rand::thread_rng().fill_bytes(&mut span_id);
+        SpanId(span_id)
+    }
+
+    pub fn serialize_encore(&self) -> String {
+        crate::base32::encode(crate::base32::Alphabet::Encore, &self.0)
+    }
+
+    pub fn serialize_std(&self) -> String {
+        hex::encode(self.0)
+    }
+
+    pub fn parse_encore(s: &str) -> Result<Self, InvalidBase32> {
+        let Some(bytes) = crate::base32::decode(crate::base32::Alphabet::Encore, s) else {
+            return Err(InvalidBase32);
+        };
+        let span_id: [u8; 8] = bytes.try_into().map_err(|_| InvalidBase32)?;
+        Ok(SpanId(span_id))
+    }
+
+    pub fn parse_std(s: &str) -> Result<Self, hex::FromHexError> {
+        let bytes = hex::decode(s)?;
+        let span_id: [u8; 8] = bytes
+            .try_into()
+            .map_err(|_| hex::FromHexError::InvalidStringLength)?;
+        Ok(SpanId(span_id))
+    }
+}
+
+pub struct APICall {
+    pub source: Option<Arc<Request>>,
+    pub target: EndpointName,
+}
+
+#[derive(Debug)]
+pub struct Request {
+    /// The span for this request.
+    /// Always set even if the request is not traced, as it's used for request tracking.
+    pub span: SpanKey,
+
+    /// The trace that generated this trace.
+    pub parent_trace: Option<TraceId>,
+
+    /// The parent span for this request.
+    pub parent_span: Option<SpanKey>,
+
+    /// The event ID of the caller, if any.
+    pub caller_event_id: Option<TraceEventId>,
+
+    /// The externally-provided correlation ID, if any.
+    pub ext_correlation_id: Option<String>,
+
+    /// True if the request originated from the Encore Platform.
+    pub is_platform_request: bool,
+
+    /// Who's making the request, if any.
+    pub internal_caller: Option<Caller>,
+
+    /// When the request started.
+    pub start: Instant,
+    pub start_time: SystemTime,
+
+    /// Type-specific data.
+    pub data: RequestData,
+}
+
+impl Request {
+    pub fn allows_private_endpoint_call(&self) -> bool {
+        if self.is_platform_request {
+            true
+        } else if let Some(caller) = &self.internal_caller {
+            caller.private_api_access()
+        } else {
+            false
+        }
+    }
+
+    pub fn has_authenticated_user(&self) -> bool {
+        match &self.data {
+            RequestData::RPC(data) => data.auth_user_id.is_some(),
+            RequestData::Stream(data) => data.auth_user_id.is_some(),
+            RequestData::Auth(_) => false,
+            RequestData::PubSub(_) => false,
+        }
+    }
+
+    pub fn take_raw_body(&self) -> Option<axum::body::Body> {
+        if let RequestData::RPC(data) = &self.data {
+            if let Some(data) = data.parsed_payload.as_ref() {
+                if let api::Body::Raw(body) = &data.body {
+                    return body.lock().unwrap().take();
+                }
+            }
+        }
+        None
+    }
+}
+
+#[derive(Debug)]
+#[allow(clippy::large_enum_variant)]
+pub enum RequestData {
+    RPC(RPCRequestData),
+    Stream(StreamRequestData),
+    Auth(AuthRequestData),
+    PubSub(PubSubRequestData),
+}
+
+#[derive(Debug, Copy, Clone)]
+pub enum StreamDirection {
+    InOut,
+    In,
+    Out,
+}
+
+#[derive(Debug)]
+pub struct StreamRequestData {
+    /// The description of the endpoint.
+    pub endpoint: Arc<Endpoint>,
+
+    /// WebSocket Upgrade
+    pub websocket_upgrade: Mutex<Option<WebSocketUpgrade>>,
+
+    /// The request path.
+    pub path: String,
+    pub path_and_query: String,
+
+    /// The request path params, if any.
+    pub path_params: Option<IndexMap<String, PValue>>,
+
+    /// The request headers
+    pub req_headers: axum::http::HeaderMap,
+
+    /// The authenticated user id, if any.
+    pub auth_user_id: Option<String>,
+
+    /// The user data for the authenticated user, if any.
+    pub auth_data: Option<PValues>,
+
+    /// The parsed application payload.
+    pub parsed_payload: Option<api::RequestPayload>,
+
+    /// Stream direction
+    pub direction: StreamDirection,
+}
+
+#[derive(Debug)]
+pub struct RPCRequestData {
+    /// The description of the endpoint.
+    pub endpoint: Arc<Endpoint>,
+
+    /// The request method.
+    pub method: api::schema::Method,
+
+    /// The request path.
+    pub path: String,
+    pub path_and_query: String,
+
+    /// The request path params, if any.
+    pub path_params: Option<IndexMap<String, PValue>>,
+
+    /// The request headers
+    pub req_headers: axum::http::HeaderMap,
+
+    /// The authenticated user id, if any.
+    pub auth_user_id: Option<String>,
+
+    /// The user data for the authenticated user, if any.
+    pub auth_data: Option<PValues>,
+
+    /// The parsed application payload.
+    pub parsed_payload: Option<api::RequestPayload>,
+}
+
+pub struct AuthRequestData {
+    /// The name of the auth handler.
+    pub auth_handler: EndpointName,
+
+    /// The parsed authentication payload.
+    pub parsed_payload: auth::AuthPayload,
+}
+
+impl Debug for AuthRequestData {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("AuthRequestData")
+            .field("auth_handler", &self.auth_handler)
+            .field("parsed_payload", &self.parsed_payload)
+            .finish()
+    }
+}
+
+#[derive(Debug)]
+pub struct PubSubRequestData {
+    /// The service processing the message.
+    pub service: EncoreName,
+    pub topic: EncoreName,
+    pub subscription: EncoreName,
+    pub message_id: String,
+    pub published: chrono::DateTime<Utc>,
+    pub attempt: u32,
+    pub payload: Vec<u8>,
+    pub parsed_payload: Option<PValues>,
+}
+
+#[derive(Debug)]
+pub struct Response {
+    /// The request this response is for.
+    pub request: Arc<Request>,
+
+    /// How long the request took.
+    pub duration: std::time::Duration,
+
+    /// The result of the response.
+    pub data: ResponseData,
+}
+
+#[derive(Debug)]
+pub enum ResponseData {
+    RPC(RPCResponseData),
+    Auth(Result<AuthSuccessResponse, api::Error>),
+    PubSub(Result<(), api::Error>),
+}
+
+#[derive(Debug)]
+pub struct RPCResponseData {
+    /// The response status code.
+    pub status_code: u16,
+
+    /// The response payload.
+    pub resp_payload: Option<JSONPayload>,
+
+    /// The response headers.
+    pub resp_headers: axum::http::HeaderMap,
+
+    /// Any error that occurred.
+    pub error: Option<api::Error>,
+}
+
+#[derive(Debug)]
+pub struct AuthSuccessResponse {
+    /// The resolved user id.
+    pub user_id: String,
+
+    /// The user data.
+    pub user_data: PValues,
+}
+
+pub enum LogFieldValue<'a> {
+    String(&'a str),
+    U64(u64),
+    I64(i64),
+    F64(f64),
+    Bool(bool),
+    Json(&'a serde_json::Value),
+}
+
+pub struct LogField<'a> {
+    pub key: &'a str,
+    pub value: LogFieldValue<'a>,
+}
+
+impl LogField<'_> {
+    pub fn type_byte(&self) -> u8 {
+        match self.value {
+            LogFieldValue::String(_) => 2,
+            LogFieldValue::Bool(_) => 3,
+            LogFieldValue::I64(_) => 8,
+            LogFieldValue::Json(_) => 7,
+            LogFieldValue::U64(_) => 9,
+            LogFieldValue::F64(_) => 11,
+        }
+    }
+}
diff --git a/runtimes/core/src/names.rs b/runtimes/core/src/names.rs
new file mode 100644
index 0000000000..d9232d38f3
--- /dev/null
+++ b/runtimes/core/src/names.rs
@@ -0,0 +1,207 @@
+use anyhow::Context;
+use std::borrow::Borrow;
+use std::fmt::Display;
+use std::hash::Hash;
+use std::ops::Deref;
+
+#[derive(Debug, Clone, Eq, Hash, PartialEq)]
+pub struct EncoreName(String);
+
+impl Deref for EncoreName {
+    type Target = str;
+    fn deref(&self) -> &str {
+        &self.0
+    }
+}
+
+impl AsRef<str> for EncoreName {
+    fn as_ref(&self) -> &str {
+        &self.0
+    }
+}
+
+impl From<String> for EncoreName {
+    fn from(value: String) -> Self {
+        Self(value)
+    }
+}
+
+impl From<&str> for EncoreName {
+    fn from(value: &str) -> Self {
+        Self(value.to_string())
+    }
+}
+
+impl From<&String> for EncoreName {
+    fn from(value: &String) -> Self {
+        Self(value.clone())
+    }
+}
+
+impl Borrow<str> for EncoreName {
+    fn borrow(&self) -> &str {
+        &self.0
+    }
+}
+impl Borrow<str> for &EncoreName {
+    fn borrow(&self) -> &str {
+        &self.0
+    }
+}
+
+impl Borrow<String> for EncoreName {
+    fn borrow(&self) -> &String {
+        &self.0
+    }
+}
+
+impl Borrow<String> for &EncoreName {
+    fn borrow(&self) -> &String {
+        &self.0
+    }
+}
+
+impl Display for EncoreName {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl From<EncoreName> for String {
+    fn from(value: EncoreName) -> Self {
+        value.0
+    }
+}
+
+impl From<&EncoreName> for String {
+    fn from(value: &EncoreName) -> Self {
+        value.0.clone()
+    }
+}
+
+#[derive(Debug, Clone, Eq, Hash, PartialEq)]
+pub struct CloudName(String);
+
+impl Borrow<String> for &CloudName {
+    fn borrow(&self) -> &String {
+        &self.0
+    }
+}
+
+impl Borrow<String> for CloudName {
+    fn borrow(&self) -> &String {
+        &self.0
+    }
+}
+
+impl AsRef<str> for CloudName {
+    fn as_ref(&self) -> &str {
+        &self.0
+    }
+}
+
+impl Deref for CloudName {
+    type Target = str;
+    fn deref(&self) -> &str {
+        &self.0
+    }
+}
+
+impl Display for CloudName {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.0)
+    }
+}
+
+impl From<String> for CloudName {
+    fn from(value: String) -> Self {
+        Self(value)
+    }
+}
+
+impl From<CloudName> for String {
+    fn from(val: CloudName) -> Self {
+        val.0
+    }
+}
+
+impl From<&CloudName> for String {
+    fn from(value: &CloudName) -> Self {
+        value.0.clone()
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct EndpointName {
+    /// The full name ("service.endpoint")
+    name: String,
+
+    /// Cached length of the service name.
+    service_len: usize,
+}
+
+impl Hash for EndpointName {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.name.hash(state)
+    }
+}
+
+impl PartialEq for EndpointName {
+    fn eq(&self, other: &Self) -> bool {
+        self.name == other.name
+    }
+}
+
+impl Eq for EndpointName {}
+
+impl Deref for EndpointName {
+    type Target = str;
+
+    fn deref(&self) -> &str {
+        &self.name
+    }
+}
+
+impl Display for EndpointName {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.name)
+    }
+}
+
+impl EndpointName {
+    pub fn new<S: Into<String>>(service: S, endpoint: S) -> Self {
+        let mut name = service.into();
+        let service_len = name.len();
+        name.push('.');
+        name.push_str(&endpoint.into());
+
+        Self { name, service_len }
+    }
+
+    pub fn service(&self) -> &str {
+        &self.name[..self.service_len]
+    }
+
+    pub fn endpoint(&self) -> &str {
+        &self.name[self.service_len + 1..]
+    }
+}
+
+impl TryFrom<String> for EndpointName {
+    type Error = anyhow::Error;
+
+    fn try_from(value: String) -> Result<Self, Self::Error> {
+        // Find the '.'.
+        let idx = value.find('.').context("missing '.'")?;
+        if idx == 0 {
+            anyhow::bail!("missing service name");
+        } else if idx == value.len() - 1 {
+            anyhow::bail!("missing endpoint name");
+        }
+
+        Ok(Self {
+            name: value,
+            service_len: idx,
+        })
+    }
+}
diff --git a/runtimes/core/src/objects/gcs/bucket.rs b/runtimes/core/src/objects/gcs/bucket.rs
new file mode 100644
index 0000000000..de4da74457
--- /dev/null
+++ b/runtimes/core/src/objects/gcs/bucket.rs
@@ -0,0 +1,533 @@
+use async_stream::try_stream;
+use futures::TryStreamExt;
+use google_cloud_storage::http::objects::download::Range;
+use google_cloud_storage::http::objects::get::GetObjectRequest;
+use google_cloud_storage::http::objects::upload::{Media, UploadObjectRequest, UploadType};
+use google_cloud_storage::sign::SignBy;
+use google_cloud_storage::sign::SignedURLOptions;
+use std::borrow::Cow;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+use std::time::SystemTime;
+use tokio::io::AsyncRead;
+
+use crate::encore::runtime::v1 as pb;
+use crate::objects::{
+    AttrsOptions, DeleteOptions, DownloadOptions, DownloadStream, DownloadUrlOptions, Error,
+    ExistsOptions, ListEntry, ListOptions, ObjectAttrs, PublicUrlError, UploadOptions,
+    UploadUrlOptions,
+};
+use crate::{objects, CloudName, EncoreName};
+use google_cloud_storage as gcs;
+
+use super::LazyGCSClient;
+
+#[derive(Debug)]
+pub struct Bucket {
+    client: Arc<LazyGCSClient>,
+    encore_name: EncoreName,
+    cloud_name: CloudName,
+    public_base_url: Option<String>,
+    key_prefix: Option<String>,
+    local_sign: Option<LocalSignOptions>,
+}
+
+#[derive(Debug)]
+pub struct LocalSignOptions {
+    base_url: String,
+    access_id: String,
+    private_key: String,
+}
+
+fn local_sign_config_from_client(client: &LazyGCSClient) -> Option<LocalSignOptions> {
+    client.cfg.local_sign.as_ref().map(|cfg| LocalSignOptions {
+        base_url: cfg.base_url.clone(),
+        access_id: cfg.access_id.clone(),
+        private_key: cfg.private_key.clone(),
+    })
+}
+
+impl Bucket {
+    pub(super) fn new(client: Arc<LazyGCSClient>, cfg: &pb::Bucket) -> Self {
+        let local_sign = local_sign_config_from_client(&client);
+        Self {
+            client,
+            encore_name: cfg.encore_name.clone().into(),
+            cloud_name: cfg.cloud_name.clone().into(),
+            public_base_url: cfg.public_base_url.clone(),
+            key_prefix: cfg.key_prefix.clone(),
+            local_sign,
+        }
+    }
+
+    /// Computes the object name, including the key prefix if present.
+    fn obj_name<'a>(&'_ self, name: Cow<'a, str>) -> Cow<'a, str> {
+        match &self.key_prefix {
+            Some(prefix) => {
+                let mut key = prefix.to_owned();
+                key.push_str(&name);
+                Cow::Owned(key)
+            }
+            None => name,
+        }
+    }
+
+    /// Returns the name with the key prefix stripped, if present.
+    fn strip_prefix<'a>(&'_ self, name: Cow<'a, str>) -> Cow<'a, str> {
+        match &self.key_prefix {
+            Some(prefix) => name
+                .as_ref()
+                .strip_prefix(prefix)
+                .map(|s| Cow::Owned(s.to_string()))
+                .unwrap_or(name),
+            None => name,
+        }
+    }
+}
+
+impl objects::BucketImpl for Bucket {
+    fn name(&self) -> &EncoreName {
+        &self.encore_name
+    }
+
+    fn object(self: Arc<Self>, name: String) -> Arc<dyn objects::ObjectImpl> {
+        Arc::new(Object {
+            bkt: self,
+            key: name,
+        })
+    }
+
+    fn list(
+        self: Arc<Self>,
+        options: ListOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<objects::ListStream, objects::Error>> + Send + 'static>>
+    {
+        Box::pin(async move {
+            match self.client.get().await {
+                Ok(client) => {
+                    let client = client.clone();
+
+                    let mut total_seen = 0;
+                    const DEFAULT_MAX_RESULTS: u64 = 1000;
+                    let s: objects::ListStream = Box::new(try_stream! {
+                        let max_results = if let Some(limit) = options.limit {
+                            limit.min(DEFAULT_MAX_RESULTS) as i32
+                        } else {
+                            DEFAULT_MAX_RESULTS as i32
+                        };
+
+                        let mut req = gcs::http::objects::list::ListObjectsRequest {
+                            bucket: self.cloud_name.to_string(),
+                            max_results: Some(max_results),
+                            ..Default::default()
+                        };
+
+
+                        // Filter by key prefix, if provided.
+                        if let Some(key_prefix) = &self.key_prefix {
+                            req.prefix = Some(key_prefix.clone());
+                        }
+
+                        if let Some(key_prefix) = &options.prefix {
+                            req.prefix = Some(req.prefix.unwrap_or_default().clone() + key_prefix);
+                        }
+
+                        'PageLoop:
+                        loop {
+                            let resp = client.list_objects(&req).await.map_err(|e| Error::Other(e.into()))?;
+                            if let Some(items) = resp.items {
+                                for obj in items {
+                                    total_seen += 1;
+                                    if let Some(limit) = options.limit {
+                                        if total_seen > limit {
+                                            break 'PageLoop;
+                                        }
+                                    }
+
+                                    let entry = ListEntry {
+                                        name: self.strip_prefix(Cow::Owned(obj.name)).into_owned(),
+                                        size: obj.size as u64,
+                                        etag: obj.etag,
+                                    };
+                                    yield entry;
+                                }
+                            }
+
+                            req.page_token = resp.next_page_token;
+
+                            // Are we close to being done? If so, adjust the max_results
+                            // to avoid over-fetching.
+                            if let Some(limit) = options.limit {
+                                if total_seen >= limit {
+                                    break 'PageLoop;
+                                }
+                                let remaining = limit - total_seen;
+                                req.max_results = Some(remaining.min(DEFAULT_MAX_RESULTS) as i32);
+                            }
+
+                            if req.page_token.is_none() {
+                                break;
+                            }
+                        }
+                    });
+
+                    Ok(s)
+                }
+
+                Err(err) => Err(Error::Internal(anyhow::anyhow!(
+                    "unable to resolve client: {}",
+                    err
+                ))),
+            }
+        })
+    }
+}
+
+#[derive(Debug)]
+struct Object {
+    bkt: Arc<Bucket>,
+    key: String,
+}
+
+impl objects::ObjectImpl for Object {
+    fn bucket_name(&self) -> &EncoreName {
+        &self.bkt.encore_name
+    }
+
+    fn key(&self) -> &str {
+        &self.key
+    }
+
+    fn attrs(
+        self: Arc<Self>,
+        options: AttrsOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<ObjectAttrs, Error>> + Send>> {
+        Box::pin(async move {
+            match self.bkt.client.get().await {
+                Ok(client) => {
+                    let mut req = gcs::http::objects::get::GetObjectRequest {
+                        bucket: self.bkt.cloud_name.to_string(),
+                        object: self.bkt.obj_name(Cow::Borrowed(&self.key)).into_owned(),
+                        ..Default::default()
+                    };
+
+                    if let Some(version) = options.version {
+                        req.generation = Some(parse_version(version)?);
+                    }
+
+                    let obj = client.get_object(&req).await.map_err(map_err)?;
+                    Ok(ObjectAttrs {
+                        name: obj.name,
+                        version: Some(obj.generation.to_string()),
+                        size: obj.size as u64,
+                        content_type: obj.content_type,
+                        etag: obj.etag,
+                    })
+                }
+                Err(err) => Err(Error::Internal(anyhow::anyhow!(
+                    "unable to resolve client: {}",
+                    err
+                ))),
+            }
+        })
+    }
+
+    fn signed_upload_url(
+        self: Arc<Self>,
+        options: UploadUrlOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<String, Error>> + Send>> {
+        let gcs_opts = SignedURLOptions {
+            method: gcs::sign::SignedURLMethod::PUT,
+            expires: options.ttl,
+            start_time: Some(SystemTime::now()),
+            ..Default::default()
+        };
+        self.signed_url(gcs_opts)
+    }
+
+    fn signed_download_url(
+        self: Arc<Self>,
+        options: DownloadUrlOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<String, Error>> + Send>> {
+        let gcs_opts = SignedURLOptions {
+            method: gcs::sign::SignedURLMethod::GET,
+            expires: options.ttl,
+            start_time: Some(SystemTime::now()),
+            ..Default::default()
+        };
+        self.signed_url(gcs_opts)
+    }
+
+    fn exists(
+        self: Arc<Self>,
+        options: ExistsOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, Error>> + Send>> {
+        Box::pin(async move {
+            match self.bkt.client.get().await {
+                Ok(client) => {
+                    let mut req = gcs::http::objects::get::GetObjectRequest {
+                        bucket: self.bkt.cloud_name.to_string(),
+                        object: self.bkt.obj_name(Cow::Borrowed(&self.key)).into_owned(),
+                        ..Default::default()
+                    };
+
+                    if let Some(version) = options.version {
+                        req.generation = Some(parse_version(version)?);
+                    }
+
+                    match client.get_object(&req).await.map_err(map_err) {
+                        Ok(_obj) => Ok(true),
+                        Err(Error::NotFound) => Ok(false),
+                        Err(err) => Err(err),
+                    }
+                }
+                Err(err) => Err(Error::Internal(anyhow::anyhow!(
+                    "unable to resolve client: {}",
+                    err
+                ))),
+            }
+        })
+    }
+
+    fn upload(
+        self: Arc<Self>,
+        data: Box<dyn AsyncRead + Unpin + Send + Sync + 'static>,
+        opts: objects::UploadOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<ObjectAttrs, Error>> + Send>> {
+        Box::pin(async move {
+            match self.bkt.client.get().await {
+                Ok(client) => {
+                    let mut req = UploadObjectRequest {
+                        bucket: self.bkt.cloud_name.to_string(),
+                        ..Default::default()
+                    };
+
+                    let cloud_name = self.bkt.obj_name(Cow::Borrowed(&self.key));
+                    let mut media = Media::new(cloud_name.into_owned());
+
+                    apply_upload_opts(opts, &mut req, &mut media);
+
+                    let upload_type = UploadType::Simple(media);
+                    let stream = tokio_util::io::ReaderStream::new(data);
+
+                    match client
+                        .upload_streamed_object(&req, stream, &upload_type)
+                        .await
+                    {
+                        Ok(obj) => Ok(ObjectAttrs {
+                            name: obj.name,
+                            version: Some(obj.generation.to_string()),
+                            size: obj.size as u64,
+                            content_type: obj.content_type,
+                            etag: obj.etag,
+                        }),
+                        Err(err) => Err(map_err(err)),
+                    }
+                }
+                Err(err) => Err(Error::Internal(anyhow::anyhow!(
+                    "unable to resolve client: {}",
+                    err
+                ))),
+            }
+        })
+    }
+
+    fn download(
+        self: Arc<Self>,
+        options: DownloadOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<DownloadStream, Error>> + Send>> {
+        fn convert_err(err: gcs::http::Error) -> Error {
+            use gcs::http::error::ErrorResponse;
+            match err {
+                gcs::http::Error::Response(ErrorResponse { code: 404, .. }) => Error::NotFound,
+                gcs::http::Error::HttpClient(err)
+                    if err.status().map(|s| s.as_u16()) == Some(404) =>
+                {
+                    Error::NotFound
+                }
+                err => Error::Other(err.into()),
+            }
+        }
+
+        Box::pin(async move {
+            match self.bkt.client.get().await {
+                Ok(client) => {
+                    let mut req = GetObjectRequest {
+                        bucket: self.bkt.cloud_name.to_string(),
+                        object: self.bkt.obj_name(Cow::Borrowed(&self.key)).into_owned(),
+                        ..Default::default()
+                    };
+
+                    if let Some(version) = options.version {
+                        req.generation = Some(parse_version(version)?);
+                    }
+
+                    let resp = client
+                        .download_streamed_object(&req, &Range::default())
+                        .await;
+
+                    let stream = resp.map_err(convert_err)?;
+                    let stream: DownloadStream = Box::pin(stream.map_err(convert_err));
+                    Ok(stream)
+                }
+                Err(err) => Err(Error::Internal(anyhow::anyhow!(
+                    "unable to resolve client: {}",
+                    err
+                ))),
+            }
+        })
+    }
+
+    fn delete(
+        self: Arc<Self>,
+        options: DeleteOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<(), Error>> + Send>> {
+        Box::pin(async move {
+            match self.bkt.client.get().await {
+                Ok(client) => {
+                    let mut req = gcs::http::objects::delete::DeleteObjectRequest {
+                        bucket: self.bkt.cloud_name.to_string(),
+                        object: self.bkt.obj_name(Cow::Borrowed(&self.key)).into_owned(),
+                        ..Default::default()
+                    };
+
+                    if let Some(version) = options.version {
+                        req.generation = Some(parse_version(version)?);
+                    }
+
+                    match client.delete_object(&req).await.map_err(map_err) {
+                        Ok(_) => Ok(()),
+                        Err(Error::NotFound) => Err(Error::NotFound),
+                        Err(err) => Err(err),
+                    }
+                }
+                Err(err) => Err(Error::Internal(anyhow::anyhow!(
+                    "unable to resolve client: {}",
+                    err
+                ))),
+            }
+        })
+    }
+
+    fn public_url(&self) -> Result<String, PublicUrlError> {
+        let Some(base_url) = self.bkt.public_base_url.clone() else {
+            return Err(PublicUrlError::PrivateBucket);
+        };
+
+        let url = objects::public_url(base_url, &self.key);
+        Ok(url)
+    }
+}
+
+impl Object {
+    fn signed_url(
+        self: Arc<Self>,
+        gcs_opts: SignedURLOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<String, Error>> + Send>> {
+        Box::pin(async move {
+            match self.bkt.client.get().await {
+                Ok(client) => {
+                    // We use a fake GCS service for local development. Ideally, the runtime
+                    // code would be oblivious to this once the GCS client is set up. But that
+                    // turns out to be difficult for URL signing, so we add a special case
+                    // here.
+                    let local_sign = &self.bkt.local_sign;
+                    let (access_id, sign_by) = match local_sign {
+                        Some(opt) => (
+                            Some(opt.access_id.clone()),
+                            Some(SignBy::PrivateKey(opt.private_key.as_bytes().to_vec())),
+                        ),
+                        None => (None, None),
+                    };
+
+                    let name = self.bkt.obj_name(Cow::Borrowed(&self.key)).into_owned();
+                    let mut url = client
+                        .signed_url(&self.bkt.cloud_name, &name, access_id, sign_by, gcs_opts)
+                        .await
+                        .map_err(|e| Error::Internal(e.into()))?;
+
+                    // More special handling for the local dev case.
+                    if let Some(cfg) = local_sign {
+                        url = replace_url_prefix(&url, &cfg.base_url)
+                            .into_owned()
+                            .to_string();
+                    }
+
+                    Ok(url)
+                }
+                Err(err) => Err(Error::Internal(anyhow::anyhow!(
+                    "unable to resolve client: {}",
+                    err
+                ))),
+            }
+        })
+    }
+}
+
+fn replace_url_prefix<'a>(orig_url: &'a str, base: &str) -> Cow<'a, str> {
+    match url::Url::parse(orig_url) {
+        Ok(url) => {
+            let mut out = match url.path().is_empty() {
+                true => base.to_string(),
+                false => {
+                    format!(
+                        "{}/{}",
+                        base.trim_end_matches('/'),
+                        url.path().trim_start_matches("/")
+                    )
+                }
+            };
+            if let Some(query) = url.query() {
+                out.push('?');
+                out.push_str(query);
+            }
+            Cow::Owned(out)
+        }
+        Err(_) => {
+            // If the input URL fails parsing, just don't do the replace
+            Cow::Borrowed(orig_url)
+        }
+    }
+}
+
+fn apply_upload_opts(opts: UploadOptions, req: &mut UploadObjectRequest, media: &mut Media) {
+    if let Some(content_type) = opts.content_type {
+        media.content_type = Cow::Owned(content_type);
+    }
+    if let Some(pre) = opts.preconditions {
+        if pre.not_exists == Some(true) {
+            req.if_generation_match = Some(0);
+        }
+    }
+}
+
+fn parse_version(version: String) -> Result<i64, Error> {
+    version.parse().map_err(|err| {
+        Error::Other(anyhow::anyhow!(
+            "invalid version number {}: {}",
+            version,
+            err
+        ))
+    })
+}
+
+fn map_err(err: gcs::http::Error) -> Error {
+    use gcs::http::error::ErrorResponse;
+    match err {
+        gcs::http::Error::Response(ErrorResponse { code, .. }) => match code {
+            404 => Error::NotFound,
+            412 => Error::PreconditionFailed,
+            _ => Error::Other(err.into()),
+        },
+        gcs::http::Error::HttpClient(err) => {
+            let status = err.status().map(|s| s.as_u16());
+            match status {
+                Some(404) => Error::NotFound,
+                Some(412) => Error::PreconditionFailed,
+                _ => Error::Other(err.into()),
+            }
+        }
+        err => Error::Other(err.into()),
+    }
+}
diff --git a/runtimes/core/src/objects/gcs/mod.rs b/runtimes/core/src/objects/gcs/mod.rs
new file mode 100644
index 0000000000..f250282ef7
--- /dev/null
+++ b/runtimes/core/src/objects/gcs/mod.rs
@@ -0,0 +1,79 @@
+use std::fmt::Debug;
+use std::sync::Arc;
+
+use crate::encore::runtime::v1 as pb;
+use crate::objects;
+use crate::objects::gcs::bucket::Bucket;
+use anyhow::Context;
+use google_cloud_storage as gcs;
+
+mod bucket;
+
+#[derive(Debug)]
+pub struct Cluster {
+    client: Arc<LazyGCSClient>,
+}
+
+impl Cluster {
+    pub fn new(cfg: pb::bucket_cluster::Gcs) -> Self {
+        let client = Arc::new(LazyGCSClient::new(cfg));
+
+        // Begin initializing the client in the background.
+        tokio::spawn(client.clone().begin_initialize());
+
+        Self { client }
+    }
+}
+
+impl objects::ClusterImpl for Cluster {
+    fn bucket(self: Arc<Self>, cfg: &pb::Bucket) -> Arc<dyn objects::BucketImpl + 'static> {
+        Arc::new(Bucket::new(self.client.clone(), cfg))
+    }
+}
+
+struct LazyGCSClient {
+    cfg: pb::bucket_cluster::Gcs,
+    cell: tokio::sync::OnceCell<anyhow::Result<Arc<gcs::client::Client>>>,
+}
+
+impl Debug for LazyGCSClient {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LazyGCPClient").finish()
+    }
+}
+
+impl LazyGCSClient {
+    fn new(cfg: pb::bucket_cluster::Gcs) -> Self {
+        Self {
+            cfg,
+            cell: tokio::sync::OnceCell::new(),
+        }
+    }
+
+    async fn get(&self) -> &anyhow::Result<Arc<gcs::client::Client>> {
+        self.cell.get_or_init(|| initialize(&self.cfg)).await
+    }
+
+    async fn begin_initialize(self: Arc<Self>) {
+        self.get().await;
+    }
+}
+
+async fn initialize(cfg: &pb::bucket_cluster::Gcs) -> anyhow::Result<Arc<gcs::client::Client>> {
+    let mut config = gcs::client::ClientConfig::default();
+    if let Some(endpoint) = &cfg.endpoint {
+        config.storage_endpoint.clone_from(endpoint);
+    }
+
+    if cfg.anonymous {
+        config = config.anonymous();
+    } else {
+        config = config
+            .with_auth()
+            .await
+            .inspect_err(|e| log::error!("unable to resolve client config: {e:?}"))
+            .context("unable to resolve client config")?;
+    }
+
+    Ok(Arc::new(gcs::client::Client::new(config)))
+}
diff --git a/runtimes/core/src/objects/manager.rs b/runtimes/core/src/objects/manager.rs
new file mode 100644
index 0000000000..625ddbb2c0
--- /dev/null
+++ b/runtimes/core/src/objects/manager.rs
@@ -0,0 +1,103 @@
+use std::collections::HashMap;
+use std::sync::{Arc, RwLock};
+
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::runtime::v1 as pb;
+use crate::names::EncoreName;
+use crate::objects::{gcs, noop, s3, BucketImpl, ClusterImpl};
+use crate::secrets;
+use crate::trace::Tracer;
+
+use super::Bucket;
+
+pub struct Manager {
+    tracer: Tracer,
+    bucket_cfg: HashMap<EncoreName, (Arc<dyn ClusterImpl>, pb::Bucket)>,
+
+    buckets: Arc<RwLock<HashMap<EncoreName, Arc<dyn BucketImpl>>>>,
+}
+
+impl Manager {
+    pub fn new(
+        secrets: &secrets::Manager,
+        tracer: Tracer,
+        clusters: Vec<pb::BucketCluster>,
+        md: &meta::Data,
+    ) -> Self {
+        let bucket_cfg = make_cfg_maps(secrets, clusters, md);
+
+        Self {
+            tracer,
+            bucket_cfg,
+            buckets: Arc::default(),
+        }
+    }
+
+    pub fn bucket(&self, name: EncoreName) -> Option<Bucket> {
+        let imp = self.bucket_impl(name)?;
+        Some(Bucket {
+            imp,
+            tracer: self.tracer.clone(),
+        })
+    }
+
+    fn bucket_impl(&self, name: EncoreName) -> Option<Arc<dyn BucketImpl>> {
+        if let Some(bkt) = self.buckets.read().unwrap().get(&name) {
+            return Some(bkt.clone());
+        }
+
+        let bkt = {
+            if let Some((cluster, bucket_cfg)) = self.bucket_cfg.get(&name) {
+                cluster.clone().bucket(bucket_cfg)
+            } else {
+                Arc::new(noop::Bucket::new(name.clone()))
+            }
+        };
+
+        self.buckets.write().unwrap().insert(name, bkt.clone());
+        Some(bkt)
+    }
+}
+
+fn make_cfg_maps(
+    secrets: &secrets::Manager,
+    clusters: Vec<pb::BucketCluster>,
+    _md: &meta::Data,
+) -> HashMap<EncoreName, (Arc<dyn ClusterImpl>, pb::Bucket)> {
+    let mut bucket_map = HashMap::new();
+
+    for cluster_cfg in clusters {
+        let cluster = match cluster_cfg.provider {
+            Some(provider) => new_cluster(secrets, provider),
+            None => {
+                log::error!("missing bucket cluster provider: {}", cluster_cfg.rid);
+                Arc::new(noop::Cluster)
+            }
+        };
+
+        for bucket_cfg in cluster_cfg.buckets {
+            bucket_map.insert(
+                bucket_cfg.encore_name.clone().into(),
+                (cluster.clone(), bucket_cfg),
+            );
+        }
+    }
+
+    bucket_map
+}
+
+fn new_cluster(
+    secrets: &secrets::Manager,
+    provider: pb::bucket_cluster::Provider,
+) -> Arc<dyn ClusterImpl> {
+    match provider {
+        pb::bucket_cluster::Provider::S3(s3cfg) => {
+            let secret_access_key = s3cfg
+                .secret_access_key
+                .as_ref()
+                .map(|k| secrets.load(k.clone()));
+            Arc::new(s3::Cluster::new(s3cfg, secret_access_key))
+        }
+        pb::bucket_cluster::Provider::Gcs(gcscfg) => Arc::new(gcs::Cluster::new(gcscfg.clone())),
+    }
+}
diff --git a/runtimes/core/src/objects/mod.rs b/runtimes/core/src/objects/mod.rs
new file mode 100644
index 0000000000..8f40456f3e
--- /dev/null
+++ b/runtimes/core/src/objects/mod.rs
@@ -0,0 +1,553 @@
+use bytes::Bytes;
+use futures::{Stream, StreamExt};
+use std::borrow::Cow;
+use std::future::Future;
+use std::sync::Arc;
+use std::time::Duration;
+use std::{fmt::Debug, pin::Pin};
+use thiserror::Error;
+use tokio::io::AsyncRead;
+
+pub use manager::Manager;
+
+use crate::encore::runtime::v1 as pb;
+use crate::trace::{protocol, Tracer};
+use crate::{model, EncoreName};
+
+mod gcs;
+mod manager;
+mod noop;
+mod s3;
+
+trait ClusterImpl: Debug + Send + Sync {
+    fn bucket(self: Arc<Self>, cfg: &pb::Bucket) -> Arc<dyn BucketImpl + 'static>;
+}
+
+trait BucketImpl: Debug + Send + Sync {
+    #[allow(dead_code)]
+    fn name(&self) -> &EncoreName;
+
+    fn object(self: Arc<Self>, name: String) -> Arc<dyn ObjectImpl + 'static>;
+
+    fn list(
+        self: Arc<Self>,
+        options: ListOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<ListStream, Error>> + Send + 'static>>;
+}
+
+type ListStream = Box<dyn Stream<Item = Result<ListEntry, Error>> + Send>;
+
+trait ObjectImpl: Debug + Send + Sync {
+    fn bucket_name(&self) -> &EncoreName;
+    fn key(&self) -> &str;
+
+    fn exists(
+        self: Arc<Self>,
+        options: ExistsOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, Error>> + Send>>;
+
+    fn upload(
+        self: Arc<Self>,
+        data: Box<dyn AsyncRead + Unpin + Send + Sync + 'static>,
+        options: UploadOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<ObjectAttrs, Error>> + Send>>;
+
+    fn signed_upload_url(
+        self: Arc<Self>,
+        options: UploadUrlOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<String, Error>> + Send>>;
+
+    fn signed_download_url(
+        self: Arc<Self>,
+        options: DownloadUrlOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<String, Error>> + Send>>;
+
+    fn download(
+        self: Arc<Self>,
+        options: DownloadOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<DownloadStream, Error>> + Send>>;
+
+    fn attrs(
+        self: Arc<Self>,
+        options: AttrsOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<ObjectAttrs, Error>> + Send>>;
+
+    fn delete(
+        self: Arc<Self>,
+        options: DeleteOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<(), Error>> + Send>>;
+
+    fn public_url(&self) -> Result<String, PublicUrlError>;
+}
+
+#[derive(Debug)]
+pub struct Bucket {
+    tracer: Tracer,
+    imp: Arc<dyn BucketImpl>,
+}
+
+impl Bucket {
+    pub fn object(&self, name: String) -> Object {
+        Object {
+            imp: self.imp.clone().object(name),
+            tracer: self.tracer.clone(),
+        }
+    }
+
+    pub async fn list(
+        &self,
+        options: ListOptions,
+        source: Option<Arc<model::Request>>,
+    ) -> Result<ListIterator, Error> {
+        let (stream, start_id) = if let Some(source) = source.as_deref() {
+            let start_id =
+                self.tracer
+                    .bucket_list_objects_start(protocol::BucketListObjectsStart {
+                        source,
+                        bucket: self.imp.name(),
+                        prefix: options.prefix.as_deref(),
+                    });
+
+            let res = self.imp.clone().list(options).await;
+
+            match res {
+                Ok(stream) => (stream, Some(start_id)),
+                Err(err) => {
+                    self.tracer
+                        .bucket_list_objects_end(protocol::BucketListObjectsEnd {
+                            source,
+                            start_id,
+                            result: protocol::BucketListObjectsEndResult::Err(&err),
+                        });
+                    return Err(err);
+                }
+            }
+        } else {
+            let stream = self.imp.clone().list(options).await?;
+            (stream, None)
+        };
+
+        Ok(ListIterator {
+            stream: stream.into(),
+            source,
+            start_id,
+            tracer: self.tracer.clone(),
+
+            yielded_entries: 0,
+            seen_end: false,
+            err: None,
+        })
+    }
+}
+
+#[derive(Debug)]
+pub struct Object {
+    tracer: Tracer,
+    imp: Arc<dyn ObjectImpl>,
+}
+
+#[derive(Debug, Error)]
+pub enum PublicUrlError {
+    #[error("bucket is not public")]
+    PrivateBucket,
+    #[error("invalid object name")]
+    InvalidObjectName,
+    #[error("public url not supported in noop bucket")]
+    NoopBucket,
+}
+
+impl Object {
+    pub async fn exists(
+        &self,
+        options: ExistsOptions,
+        source: Option<Arc<model::Request>>,
+    ) -> Result<bool, Error> {
+        if let Some(source) = source.as_deref() {
+            let start_id =
+                self.tracer
+                    .bucket_object_get_attrs_start(protocol::BucketObjectGetAttrsStart {
+                        source,
+                        bucket: self.imp.bucket_name(),
+                        object: self.imp.key(),
+                        version: options.version.as_deref(),
+                    });
+            let res = self.imp.clone().exists(options).await;
+
+            self.tracer
+                .bucket_object_get_attrs_end(protocol::BucketObjectGetAttrsEnd {
+                    start_id,
+                    source,
+                    result: match &res {
+                        Ok(true) => {
+                            protocol::BucketObjectGetAttrsEndResult::Success(Default::default())
+                        }
+                        Ok(false) => protocol::BucketObjectGetAttrsEndResult::Err(&Error::NotFound),
+                        Err(err) => protocol::BucketObjectGetAttrsEndResult::Err(err),
+                    },
+                });
+            res
+        } else {
+            self.imp.clone().exists(options).await
+        }
+    }
+
+    pub fn upload(
+        &self,
+        data: Box<dyn AsyncRead + Unpin + Send + Sync + 'static>,
+        options: UploadOptions,
+        source: Option<Arc<model::Request>>,
+    ) -> impl Future<Output = Result<ObjectAttrs, Error>> + Send + 'static {
+        let tracer = self.tracer.clone();
+        let imp = self.imp.clone();
+
+        async move {
+            if let Some(source) = source.as_deref() {
+                let start_id =
+                    tracer.bucket_object_upload_start(protocol::BucketObjectUploadStart {
+                        source,
+                        bucket: imp.bucket_name(),
+                        object: imp.key(),
+                        attrs: protocol::BucketObjectAttributes {
+                            content_type: options.content_type.as_deref(),
+                            ..Default::default()
+                        },
+                    });
+
+                let res = imp.upload(data, options).await;
+
+                tracer.bucket_object_upload_end(protocol::BucketObjectUploadEnd {
+                    start_id,
+                    source,
+                    result: match &res {
+                        Ok(attrs) => protocol::BucketObjectUploadEndResult::Success {
+                            size: attrs.size,
+                            version: attrs.version.as_deref(),
+                        },
+                        Err(err) => protocol::BucketObjectUploadEndResult::Err(err),
+                    },
+                });
+
+                res
+            } else {
+                imp.upload(data, options).await
+            }
+        }
+    }
+
+    pub async fn signed_upload_url(
+        &self,
+        options: UploadUrlOptions,
+        _source: Option<Arc<model::Request>>,
+    ) -> Result<String, Error> {
+        const SEVEN_DAYS: Duration = Duration::new(7 * 86400, 0);
+        if options.ttl > SEVEN_DAYS {
+            return Err(Error::InvalidArgument);
+        }
+        self.imp.clone().signed_upload_url(options).await
+    }
+
+    pub async fn signed_download_url(
+        &self,
+        options: DownloadUrlOptions,
+        _source: Option<Arc<model::Request>>,
+    ) -> Result<String, Error> {
+        const SEVEN_DAYS: Duration = Duration::new(7 * 86400, 0);
+        if options.ttl > SEVEN_DAYS {
+            return Err(Error::InvalidArgument);
+        }
+        self.imp.clone().signed_download_url(options).await
+    }
+
+    pub fn download_stream(
+        &self,
+        options: DownloadOptions,
+        _source: Option<Arc<model::Request>>,
+    ) -> impl Future<Output = Result<DownloadStream, Error>> + Send + 'static {
+        self.imp.clone().download(options)
+    }
+
+    pub fn download_all(
+        &self,
+        options: DownloadOptions,
+        source: Option<Arc<model::Request>>,
+    ) -> impl Future<Output = Result<Vec<u8>, Error>> + Send + 'static {
+        let tracer = self.tracer.clone();
+        let imp = self.imp.clone();
+        let start_id = if let Some(source) = source.as_deref() {
+            Some(
+                tracer.bucket_object_download_start(protocol::BucketObjectDownloadStart {
+                    source,
+                    bucket: imp.bucket_name(),
+                    object: imp.key(),
+                    version: options.version.as_deref(),
+                }),
+            )
+        } else {
+            None
+        };
+
+        let fut = self.do_download_all(options);
+        async move {
+            let res = fut.await;
+
+            if let (Some(start_id), Some(source)) = (start_id, source.as_deref()) {
+                tracer.bucket_object_download_end(protocol::BucketObjectDownloadEnd {
+                    start_id,
+                    source,
+                    result: match &res {
+                        Ok(bytes) => protocol::BucketObjectDownloadEndResult::Success {
+                            size: bytes.len() as u64,
+                        },
+                        Err(err) => protocol::BucketObjectDownloadEndResult::Err(err),
+                    },
+                });
+            }
+
+            res
+        }
+    }
+
+    fn do_download_all(
+        &self,
+        options: DownloadOptions,
+    ) -> impl Future<Output = Result<Vec<u8>, Error>> + Send + 'static {
+        let stream = self.imp.clone().download(options);
+        async move {
+            let mut bytes = Vec::new();
+            let mut stream = stream.await?;
+
+            while let Some(chunk) = stream.next().await {
+                bytes.extend_from_slice(&chunk?);
+            }
+            Ok(bytes)
+        }
+    }
+
+    pub async fn attrs(
+        &self,
+        options: AttrsOptions,
+        source: Option<Arc<model::Request>>,
+    ) -> Result<ObjectAttrs, Error> {
+        if let Some(source) = source.as_deref() {
+            let start_id =
+                self.tracer
+                    .bucket_object_get_attrs_start(protocol::BucketObjectGetAttrsStart {
+                        source,
+                        bucket: self.imp.bucket_name(),
+                        object: self.imp.key(),
+                        version: options.version.as_deref(),
+                    });
+            let res = self.imp.clone().attrs(options).await;
+
+            self.tracer
+                .bucket_object_get_attrs_end(protocol::BucketObjectGetAttrsEnd {
+                    start_id,
+                    source,
+                    result: match &res {
+                        Ok(attrs) => protocol::BucketObjectGetAttrsEndResult::Success(attrs.into()),
+                        Err(err) => protocol::BucketObjectGetAttrsEndResult::Err(err),
+                    },
+                });
+            res
+        } else {
+            self.imp.clone().attrs(options).await
+        }
+    }
+
+    pub async fn delete(
+        &self,
+        options: DeleteOptions,
+        source: Option<Arc<model::Request>>,
+    ) -> Result<(), Error> {
+        if let Some(source) = source.as_deref() {
+            let start_id =
+                self.tracer
+                    .bucket_delete_objects_start(protocol::BucketDeleteObjectsStart {
+                        source,
+                        bucket: self.imp.bucket_name(),
+                        objects: [protocol::BucketDeleteObjectEntry {
+                            object: self.imp.key(),
+                            version: options.version.as_deref(),
+                        }]
+                        .into_iter(),
+                    });
+
+            let res = self.imp.clone().delete(options).await;
+
+            self.tracer
+                .bucket_delete_objects_end(protocol::BucketDeleteObjectsEnd {
+                    start_id,
+                    source,
+                    result: match &res {
+                        Ok(()) => protocol::BucketDeleteObjectsEndResult::Success,
+                        Err(err) => protocol::BucketDeleteObjectsEndResult::Err(err),
+                    },
+                });
+
+            res
+        } else {
+            self.imp.clone().delete(options).await
+        }
+    }
+
+    /// Returns the public URL of the object, if available.
+    /// If the bucket is not public, it reports None.
+    pub fn public_url(&self) -> Result<String, PublicUrlError> {
+        self.imp.public_url()
+    }
+}
+
+#[derive(thiserror::Error, Debug)]
+pub enum Error {
+    #[error("object not found")]
+    NotFound,
+
+    #[error("precondition failed")]
+    PreconditionFailed,
+
+    #[error("invalid argument")]
+    InvalidArgument,
+
+    #[error("internal error: {0:?}")]
+    Internal(anyhow::Error),
+
+    #[error("{0:?}")]
+    Other(anyhow::Error),
+}
+
+pub type DownloadStream = Pin<Box<dyn Stream<Item = Result<Bytes, Error>> + Send>>;
+
+pub struct ObjectAttrs {
+    pub name: String,
+    pub version: Option<String>,
+    pub size: u64,
+    pub content_type: Option<String>,
+    pub etag: String,
+}
+
+pub struct ListEntry {
+    pub name: String,
+    pub size: u64,
+    pub etag: String,
+}
+
+#[derive(Debug, Default)]
+pub struct ExistsOptions {
+    pub version: Option<String>,
+}
+
+#[derive(Debug, Default)]
+pub struct UploadOptions {
+    pub content_type: Option<String>,
+    pub preconditions: Option<UploadPreconditions>,
+}
+
+#[derive(Debug, Default)]
+pub struct UploadPreconditions {
+    pub not_exists: Option<bool>,
+}
+
+#[derive(Debug, Default)]
+pub struct DownloadOptions {
+    pub version: Option<String>,
+}
+
+#[derive(Debug, Default)]
+pub struct AttrsOptions {
+    pub version: Option<String>,
+}
+
+#[derive(Debug, Default)]
+pub struct UploadUrlOptions {
+    pub ttl: Duration,
+}
+
+#[derive(Debug, Default)]
+pub struct DownloadUrlOptions {
+    pub ttl: Duration,
+}
+
+#[derive(Debug, Default)]
+pub struct DeleteOptions {
+    pub version: Option<String>,
+}
+
+#[derive(Debug, Default)]
+pub struct ListOptions {
+    pub prefix: Option<String>,
+    pub limit: Option<u64>,
+}
+
+pub struct ListIterator {
+    stream: Pin<Box<dyn Stream<Item = Result<ListEntry, Error>> + Send>>,
+    tracer: Tracer,
+    start_id: Option<model::TraceEventId>,
+    source: Option<Arc<model::Request>>,
+    err: Option<String>,
+
+    yielded_entries: u64,
+    seen_end: bool,
+}
+
+impl ListIterator {
+    pub async fn next(&mut self) -> Option<Result<ListEntry, Error>> {
+        let res = self.stream.next().await;
+
+        match &res {
+            None => {
+                self.seen_end = true;
+            }
+            Some(Ok(_)) => {
+                self.yielded_entries += 1;
+            }
+            Some(Err(err)) => {
+                if self.err.is_none() {
+                    self.err = Some(err.to_string());
+                }
+            }
+        }
+
+        res
+    }
+}
+
+impl Drop for ListIterator {
+    fn drop(&mut self) {
+        if let (Some(start_id), Some(source)) = (self.start_id, self.source.as_deref()) {
+            self.tracer
+                .bucket_list_objects_end(protocol::BucketListObjectsEnd {
+                    start_id,
+                    source,
+                    result: match self.err {
+                        Some(ref err) => protocol::BucketListObjectsEndResult::Err(err),
+                        None => protocol::BucketListObjectsEndResult::Success {
+                            observed: self.yielded_entries,
+                            has_more: !self.seen_end,
+                        },
+                    },
+                });
+        }
+    }
+}
+
+use percent_encoding::{AsciiSet, CONTROLS};
+
+// From https://url.spec.whatwg.org/#c0-control-percent-encode-set
+
+const QUERY: &AsciiSet = &CONTROLS.add(b' ').add(b'"').add(b'#').add(b'<').add(b'>');
+const PATH: &AsciiSet = &QUERY.add(b'?').add(b'`').add(b'{').add(b'}');
+
+fn escape_path(s: &str) -> Cow<'_, str> {
+    percent_encoding::percent_encode(s.as_bytes(), PATH).into()
+}
+
+/// Computes the public url given a base url and object name.
+fn public_url(base_url: String, name: &str) -> String {
+    let mut url = base_url;
+
+    if !url.ends_with('/') {
+        url.push('/');
+    }
+    url.push_str(&escape_path(name));
+    url
+}
diff --git a/runtimes/core/src/objects/noop/mod.rs b/runtimes/core/src/objects/noop/mod.rs
new file mode 100644
index 0000000000..ef8170a505
--- /dev/null
+++ b/runtimes/core/src/objects/noop/mod.rs
@@ -0,0 +1,147 @@
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+use futures::future;
+use tokio::io::AsyncRead;
+
+use crate::objects;
+use crate::{encore::runtime::v1 as pb, EncoreName};
+
+use super::{
+    AttrsOptions, DeleteOptions, DownloadOptions, DownloadUrlOptions, ExistsOptions, ListOptions,
+    PublicUrlError, UploadUrlOptions,
+};
+
+#[derive(Debug)]
+pub struct Cluster;
+
+#[derive(Debug)]
+pub struct Bucket {
+    name: EncoreName,
+}
+
+impl Bucket {
+    pub fn new(name: EncoreName) -> Self {
+        Self { name }
+    }
+}
+
+#[derive(Debug)]
+pub struct Object {
+    bkt: Arc<Bucket>,
+    name: String,
+}
+
+impl objects::ClusterImpl for Cluster {
+    fn bucket(self: Arc<Self>, cfg: &pb::Bucket) -> Arc<dyn objects::BucketImpl> {
+        Arc::new(Bucket {
+            name: cfg.encore_name.clone().into(),
+        })
+    }
+}
+
+impl objects::BucketImpl for Bucket {
+    fn name(&self) -> &EncoreName {
+        &self.name
+    }
+
+    fn object(self: Arc<Self>, name: String) -> Arc<dyn objects::ObjectImpl> {
+        Arc::new(Object {
+            name,
+            bkt: self.clone(),
+        })
+    }
+
+    fn list(
+        self: Arc<Self>,
+        _options: ListOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<objects::ListStream, objects::Error>> + Send + 'static>>
+    {
+        Box::pin(async move {
+            Err(objects::Error::Internal(anyhow::anyhow!(
+                "noop bucket does not support list"
+            )))
+        })
+    }
+}
+
+impl objects::ObjectImpl for Object {
+    fn bucket_name(&self) -> &EncoreName {
+        &self.bkt.name
+    }
+
+    fn key(&self) -> &str {
+        &self.name
+    }
+
+    fn attrs(
+        self: Arc<Self>,
+        _options: AttrsOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<objects::ObjectAttrs, objects::Error>> + Send>> {
+        Box::pin(future::ready(Err(objects::Error::Internal(
+            anyhow::anyhow!("noop bucket does not support attrs"),
+        ))))
+    }
+
+    fn signed_upload_url(
+        self: Arc<Self>,
+        _options: UploadUrlOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<String, objects::Error>> + Send>> {
+        Box::pin(future::ready(Err(objects::Error::Internal(
+            anyhow::anyhow!("noop bucket does not support getting upload URL"),
+        ))))
+    }
+
+    fn signed_download_url(
+        self: Arc<Self>,
+        _options: DownloadUrlOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<String, objects::Error>> + Send>> {
+        Box::pin(future::ready(Err(objects::Error::Internal(
+            anyhow::anyhow!("noop bucket does not support getting download URL"),
+        ))))
+    }
+
+    fn exists(
+        self: Arc<Self>,
+        _options: ExistsOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, objects::Error>> + Send>> {
+        Box::pin(future::ready(Err(objects::Error::Internal(
+            anyhow::anyhow!("noop bucket does not support exists"),
+        ))))
+    }
+
+    fn upload(
+        self: Arc<Self>,
+        _data: Box<dyn AsyncRead + Unpin + Send + Sync + 'static>,
+        _options: objects::UploadOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<objects::ObjectAttrs, objects::Error>> + Send>> {
+        Box::pin(future::ready(Err(objects::Error::Other(anyhow::anyhow!(
+            "noop bucket does not support upload"
+        )))))
+    }
+
+    fn download(
+        self: Arc<Self>,
+        _options: DownloadOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<objects::DownloadStream, objects::Error>> + Send>> {
+        Box::pin(async move {
+            Err(objects::Error::Internal(anyhow::anyhow!(
+                "noop bucket does not support download"
+            )))
+        })
+    }
+
+    fn delete(
+        self: Arc<Self>,
+        _options: DeleteOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<(), objects::Error>> + Send>> {
+        Box::pin(future::ready(Err(objects::Error::Internal(
+            anyhow::anyhow!("noop bucket does not support delete"),
+        ))))
+    }
+
+    fn public_url(&self) -> Result<String, PublicUrlError> {
+        Err(PublicUrlError::NoopBucket)
+    }
+}
diff --git a/runtimes/core/src/objects/s3/bucket.rs b/runtimes/core/src/objects/s3/bucket.rs
new file mode 100644
index 0000000000..fd59ce280c
--- /dev/null
+++ b/runtimes/core/src/objects/s3/bucket.rs
@@ -0,0 +1,596 @@
+use async_stream::{stream, try_stream};
+use aws_sdk_s3 as s3;
+use aws_sdk_s3::error::SdkError;
+use aws_sdk_s3::presigning::PresigningConfig;
+use aws_smithy_types::byte_stream::ByteStream;
+use base64::Engine;
+use bytes::{Bytes, BytesMut};
+use std::borrow::Cow;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+use tokio::io::{AsyncRead, AsyncReadExt};
+
+use crate::encore::runtime::v1 as pb;
+use crate::objects::{
+    self, AttrsOptions, DeleteOptions, DownloadOptions, DownloadUrlOptions, Error, ExistsOptions,
+    ListEntry, ListOptions, ObjectAttrs, PublicUrlError, UploadUrlOptions,
+};
+use crate::{CloudName, EncoreName};
+
+use super::LazyS3Client;
+
+const CHUNK_SIZE: usize = 8_388_608; // 8 Mebibytes, min is 5 (5_242_880);
+
+#[derive(Debug)]
+pub struct Bucket {
+    client: Arc<LazyS3Client>,
+    encore_name: EncoreName,
+    cloud_name: CloudName,
+    public_base_url: Option<String>,
+    key_prefix: Option<String>,
+}
+
+impl Bucket {
+    pub(super) fn new(client: Arc<LazyS3Client>, cfg: &pb::Bucket) -> Self {
+        Self {
+            client,
+            encore_name: cfg.encore_name.clone().into(),
+            cloud_name: cfg.cloud_name.clone().into(),
+            public_base_url: cfg.public_base_url.clone(),
+            key_prefix: cfg.key_prefix.clone(),
+        }
+    }
+
+    /// Computes the object name, including the key prefix if present.
+    fn obj_name<'a>(&'_ self, name: Cow<'a, str>) -> Cow<'a, str> {
+        match &self.key_prefix {
+            Some(prefix) => {
+                let mut key = prefix.to_owned();
+                key.push_str(&name);
+                Cow::Owned(key)
+            }
+            None => name,
+        }
+    }
+
+    /// Returns the name with the key prefix stripped, if present.
+    fn strip_prefix<'a>(&'_ self, name: Cow<'a, str>) -> Cow<'a, str> {
+        match &self.key_prefix {
+            Some(prefix) => name
+                .as_ref()
+                .strip_prefix(prefix)
+                .map(|s| Cow::Owned(s.to_string()))
+                .unwrap_or(name),
+            None => name,
+        }
+    }
+}
+
+impl objects::BucketImpl for Bucket {
+    fn name(&self) -> &EncoreName {
+        &self.encore_name
+    }
+
+    fn object(self: Arc<Self>, name: String) -> Arc<dyn objects::ObjectImpl> {
+        Arc::new(Object {
+            bkt: self.clone(),
+            name,
+        })
+    }
+
+    fn list(
+        self: Arc<Self>,
+        options: ListOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<objects::ListStream, objects::Error>> + Send + 'static>>
+    {
+        Box::pin(async move {
+            let mut total_seen = 0;
+            let client = self.client.get().await.clone();
+            let s: objects::ListStream = Box::new(try_stream! {
+                let mut req = client.list_objects_v2()
+                    .bucket(&self.cloud_name);
+
+                if let Some(key_prefix) = self.key_prefix.clone() {
+                    req = req.prefix(key_prefix);
+                }
+
+                if let Some(key_prefix) = &options.prefix {
+                    let current_prefix = req.get_prefix().as_deref().unwrap_or_default();
+                    let new_prefix = format!("{current_prefix}{key_prefix}");
+                    req = req.prefix(new_prefix);
+                }
+
+                let page_size = if let Some(limit) = options.limit {
+                    limit.min(1000) as i32
+                } else {
+                    1000
+                };
+
+                let mut stream = req.into_paginator()
+                    .page_size(page_size)
+                    .send();
+
+                'PageLoop:
+                while let Some(resp) = stream.try_next().await.map_err(|e| Error::Other(e.into()))? {
+                    for obj in resp.contents.unwrap_or_default() {
+                        total_seen += 1;
+                        if let Some(limit) = options.limit {
+                            if total_seen > limit {
+                                // We've reached the limit, stop the stream.
+                                break 'PageLoop;
+                            }
+                        }
+
+                        let entry = ListEntry {
+                            name: self.strip_prefix(Cow::Owned(obj.key.unwrap_or_default())).into_owned(),
+                            size: obj.size.unwrap_or_default() as u64,
+                            etag: parse_etag(obj.e_tag),
+                        };
+                        yield entry;
+                    }
+                }
+            });
+
+            Ok(s)
+        })
+    }
+}
+
+#[derive(Debug)]
+struct Object {
+    bkt: Arc<Bucket>,
+    name: String,
+}
+
+impl objects::ObjectImpl for Object {
+    fn bucket_name(&self) -> &EncoreName {
+        &self.bkt.encore_name
+    }
+
+    fn key(&self) -> &str {
+        &self.name
+    }
+
+    fn attrs(
+        self: Arc<Self>,
+        options: AttrsOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<ObjectAttrs, Error>> + Send>> {
+        Box::pin(async move {
+            let client = self.bkt.client.get().await.clone();
+            let cloud_name = self.bkt.obj_name(Cow::Borrowed(&self.name));
+            let res = client
+                .head_object()
+                .bucket(&self.bkt.cloud_name)
+                .key(cloud_name)
+                .set_version_id(options.version)
+                .send()
+                .await;
+
+            match res {
+                Ok(obj) => Ok(ObjectAttrs {
+                    name: self.name.clone(),
+                    version: obj.version_id,
+                    size: obj.content_length.unwrap_or_default() as u64,
+                    content_type: obj.content_type,
+                    etag: parse_etag(obj.e_tag),
+                }),
+                Err(SdkError::ServiceError(err)) if err.err().is_not_found() => {
+                    Err(Error::NotFound)
+                }
+                Err(err) => Err(Error::Other(err.into())),
+            }
+        })
+    }
+
+    fn signed_upload_url(
+        self: Arc<Self>,
+        options: UploadUrlOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<String, Error>> + Send>> {
+        Box::pin(async move {
+            let client = self.bkt.client.get().await.clone();
+            let obj_name = self.bkt.obj_name(Cow::Borrowed(&self.name));
+
+            let res = client
+                .put_object()
+                .bucket(&self.bkt.cloud_name)
+                .key(obj_name)
+                .presigned(
+                    PresigningConfig::expires_in(options.ttl)
+                        .map_err(|e| Error::Other(e.into()))?,
+                )
+                .await;
+            match res {
+                Ok(req) => Ok(String::from(req.uri())),
+                Err(err) => Err(Error::Other(err.into())),
+            }
+        })
+    }
+
+    fn signed_download_url(
+        self: Arc<Self>,
+        options: DownloadUrlOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<String, Error>> + Send>> {
+        Box::pin(async move {
+            let client = self.bkt.client.get().await.clone();
+            let obj_name = self.bkt.obj_name(Cow::Borrowed(&self.name));
+
+            let res = client
+                .get_object()
+                .bucket(&self.bkt.cloud_name)
+                .key(obj_name)
+                .presigned(
+                    PresigningConfig::expires_in(options.ttl)
+                        .map_err(|e| Error::Other(e.into()))?,
+                )
+                .await;
+            match res {
+                Ok(req) => Ok(String::from(req.uri())),
+                Err(err) => Err(Error::Other(err.into())),
+            }
+        })
+    }
+
+    fn exists(
+        self: Arc<Self>,
+        options: ExistsOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<bool, Error>> + Send>> {
+        Box::pin(async move {
+            let client = self.bkt.client.get().await.clone();
+            let cloud_name = self.bkt.obj_name(Cow::Borrowed(&self.name));
+            let res = client
+                .head_object()
+                .bucket(&self.bkt.cloud_name)
+                .key(cloud_name)
+                .set_version_id(options.version)
+                .send()
+                .await;
+            match res {
+                Ok(_) => Ok(true),
+                Err(SdkError::ServiceError(err)) if err.err().is_not_found() => Ok(false),
+                Err(err) => Err(Error::Other(err.into())),
+            }
+        })
+    }
+
+    fn upload(
+        self: Arc<Self>,
+        mut data: Box<dyn AsyncRead + Unpin + Send + Sync + 'static>,
+        options: objects::UploadOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<ObjectAttrs, Error>> + Send>> {
+        Box::pin(async move {
+            let client = self.bkt.client.get().await.clone();
+            let cloud_name = self.bkt.obj_name(Cow::Borrowed(&self.name));
+            let first_chunk = read_chunk_async(&mut data).await.map_err(|e| {
+                Error::Other(anyhow::anyhow!("uable to read from data source: {}", e))
+            })?;
+
+            match first_chunk {
+                Chunk::Complete(chunk) => {
+                    // The file is small; do a regular upload.
+                    let chunk = chunk.freeze();
+                    let total_size = chunk.len();
+                    let content_md5 = base64::engine::general_purpose::STANDARD
+                        .encode(md5::compute(&chunk).as_ref());
+
+                    let mut req = client
+                        .put_object()
+                        .bucket(&self.bkt.cloud_name)
+                        .key(cloud_name)
+                        .content_length(total_size as i64)
+                        .content_md5(content_md5)
+                        .set_content_type(options.content_type.clone())
+                        .body(ByteStream::from(chunk));
+
+                    if let Some(precond) = options.preconditions {
+                        if precond.not_exists == Some(true) {
+                            req = req.if_none_match("*");
+                        }
+                    }
+
+                    let resp = req.send().await.map_err(map_upload_err)?;
+                    Ok(ObjectAttrs {
+                        name: self.name.clone(),
+                        version: resp.version_id,
+                        size: total_size as u64,
+                        content_type: options.content_type,
+                        etag: resp.e_tag.unwrap_or_default(),
+                    })
+                }
+
+                Chunk::Part(chunk) => {
+                    // Large file; do a multipart upload.
+                    let upload = client
+                        .create_multipart_upload()
+                        .bucket(&self.bkt.cloud_name)
+                        .key(cloud_name.to_string())
+                        .set_content_type(options.content_type.clone())
+                        .send()
+                        .await
+                        .map_err(|err| {
+                            Error::Other(anyhow::anyhow!(
+                                "unable to begin streaming upload: {}",
+                                err
+                            ))
+                        })?;
+
+                    let Some(upload_id) = upload.upload_id else {
+                        return Err(Error::Other(anyhow::anyhow!(
+                            "missing upload_id in streaming_upload"
+                        )));
+                    };
+
+                    let res = upload_multipart_chunks(
+                        &client,
+                        &mut data,
+                        chunk.freeze(),
+                        &upload_id,
+                        &self.bkt.cloud_name,
+                        &cloud_name,
+                        &options,
+                    )
+                    .await;
+
+                    if let UploadMultipartResult::CompleteSuccess { total_size, output } = res {
+                        return Ok(ObjectAttrs {
+                            name: self.name.clone(),
+                            version: output.version_id,
+                            size: total_size,
+                            content_type: options.content_type,
+                            etag: parse_etag(output.e_tag),
+                        });
+                    }
+
+                    // Abort the upload.
+                    let fut = client
+                        .abort_multipart_upload()
+                        .bucket(&self.bkt.cloud_name)
+                        .key(cloud_name)
+                        .upload_id(upload_id)
+                        .send();
+                    tokio::spawn(async move {
+                        let _ = fut.await;
+                    });
+
+                    Err(match res {
+                        UploadMultipartResult::CompleteSuccess { .. } => unreachable!(),
+                        UploadMultipartResult::UploadError(err) => Error::Other(err.into()),
+                        UploadMultipartResult::CompleteError(err) => map_upload_err(err),
+                        UploadMultipartResult::ReadContents(err) => Error::Other(anyhow::anyhow!(
+                            "unable to read from data source: {}",
+                            err
+                        )),
+                    })
+                }
+            }
+        })
+    }
+
+    fn download(
+        self: Arc<Self>,
+        options: DownloadOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<objects::DownloadStream, objects::Error>> + Send>> {
+        Box::pin(async move {
+            let client = self.bkt.client.get().await.clone();
+            let cloud_name = self.bkt.obj_name(Cow::Borrowed(&self.name));
+            let res = client
+                .get_object()
+                .bucket(&self.bkt.cloud_name)
+                .key(cloud_name.into_owned())
+                .set_version_id(options.version)
+                .send()
+                .await;
+
+            match res {
+                Ok(mut resp) => {
+                    let result = stream! {
+                        while let Some(chunk) = resp.body.next().await {
+                            yield chunk.map_err(|e| objects::Error::Other(e.into()));
+                        }
+                    };
+                    let result: objects::DownloadStream = Box::pin(result);
+                    Ok(result)
+                }
+                Err(SdkError::ServiceError(err)) if err.err().is_no_such_key() => {
+                    Err(objects::Error::NotFound)
+                }
+                Err(err) => Err(objects::Error::Other(err.into())),
+            }
+        })
+    }
+
+    fn delete(
+        self: Arc<Self>,
+        options: DeleteOptions,
+    ) -> Pin<Box<dyn Future<Output = Result<(), Error>> + Send>> {
+        Box::pin(async move {
+            let client = self.bkt.client.get().await.clone();
+            let cloud_name = self.bkt.obj_name(Cow::Borrowed(&self.name));
+            let res = client
+                .delete_object()
+                .bucket(&self.bkt.cloud_name)
+                .key(cloud_name.into_owned())
+                .set_version_id(options.version)
+                .send()
+                .await;
+            match res {
+                Ok(_) => Ok(()),
+                Err(SdkError::ServiceError(err)) if err.raw().status().as_u16() == 404 => {
+                    Err(Error::NotFound)
+                }
+                Err(err) => Err(Error::Other(err.into())),
+            }
+        })
+    }
+
+    fn public_url(&self) -> Result<String, PublicUrlError> {
+        let Some(base_url) = self.bkt.public_base_url.clone() else {
+            return Err(PublicUrlError::PrivateBucket);
+        };
+
+        let url = objects::public_url(base_url, &self.name);
+        Ok(url)
+    }
+}
+
+enum Chunk {
+    Part(BytesMut),
+    Complete(BytesMut),
+}
+
+impl Chunk {
+    fn into_bytes(self) -> BytesMut {
+        match self {
+            Chunk::Part(buf) => buf,
+            Chunk::Complete(buf) => buf,
+        }
+    }
+}
+
+async fn read_chunk_async<R: AsyncRead + Unpin + ?Sized>(reader: &mut R) -> std::io::Result<Chunk> {
+    // Use an initial capacity of 10KiB.
+    let mut buf = BytesMut::with_capacity(10 * 1024);
+    while buf.len() < CHUNK_SIZE {
+        // If the buf has no available capacity, we need to allocate more.
+        if buf.len() == buf.capacity() {
+            buf.reserve(buf.capacity());
+        }
+
+        let n = reader.read_buf(&mut buf).await?;
+        if n == 0 {
+            // We've reached the end of the stream.
+            // This is guaranteed to be the case since in the case
+            // where the buffer was full we reserved
+            // additional capacity in the buffer before reading.
+            return Ok(Chunk::Complete(buf));
+        }
+    }
+
+    Ok(Chunk::Part(buf))
+}
+
+#[allow(clippy::large_enum_variant)]
+enum UploadMultipartResult {
+    CompleteSuccess {
+        total_size: u64,
+        output: s3::operation::complete_multipart_upload::CompleteMultipartUploadOutput,
+    },
+    CompleteError(
+        s3::error::SdkError<s3::operation::complete_multipart_upload::CompleteMultipartUploadError>,
+    ),
+    UploadError(s3::error::SdkError<s3::operation::upload_part::UploadPartError>),
+    ReadContents(std::io::Error),
+}
+
+async fn upload_multipart_chunks<R: AsyncRead + Unpin + ?Sized>(
+    client: &s3::Client,
+    reader: &mut R,
+    first_chunk: Bytes,
+    upload_id: &str,
+    bucket: &CloudName,
+    key: &str,
+    options: &objects::UploadOptions,
+) -> UploadMultipartResult {
+    let mut handles = Vec::new();
+    let mut part_numbers = Vec::new();
+    let mut part_number = 0;
+    let mut total_size = 0;
+    let mut upload_part = |chunk: Bytes| {
+        part_number += 1;
+        let content_md5 =
+            base64::engine::general_purpose::STANDARD.encode(md5::compute(&chunk).as_ref());
+        total_size += chunk.len() as u64;
+        let handle = client
+            .upload_part()
+            .bucket(bucket)
+            .key(key)
+            .upload_id(upload_id)
+            .part_number(part_number)
+            .content_length(chunk.len() as i64)
+            .content_md5(content_md5)
+            .body(ByteStream::from(chunk))
+            .send();
+        handles.push(handle);
+        part_numbers.push(part_number);
+    };
+
+    upload_part(first_chunk);
+    loop {
+        let bytes = match read_chunk_async(reader).await {
+            Ok(chunk) => chunk.into_bytes(),
+            Err(err) => return UploadMultipartResult::ReadContents(err),
+        };
+        if bytes.is_empty() {
+            break;
+        }
+        upload_part(bytes.freeze());
+    }
+
+    // Wait for all the parts to finish uploading.
+    let responses = futures::future::join_all(handles).await;
+
+    // Check for errors and collect the completed parts.
+    let mut completed_parts = Vec::new();
+    for (i, res) in responses.into_iter().enumerate() {
+        match res {
+            Ok(output) => {
+                let part = s3::types::CompletedPart::builder()
+                    .part_number(part_numbers[i])
+                    .set_e_tag(output.e_tag)
+                    .build();
+                completed_parts.push(part);
+            }
+            Err(err) => return UploadMultipartResult::UploadError(err),
+        }
+    }
+
+    let multipart_upload = s3::types::CompletedMultipartUpload::builder()
+        .set_parts(Some(completed_parts))
+        .build();
+
+    let mut req = client
+        .complete_multipart_upload()
+        .bucket(bucket)
+        .key(key)
+        .upload_id(upload_id)
+        .multipart_upload(multipart_upload);
+
+    if let Some(precond) = &options.preconditions {
+        if precond.not_exists == Some(true) {
+            req = req.if_none_match("*");
+        }
+    }
+
+    let resp = req.send().await;
+    match resp {
+        Ok(output) => UploadMultipartResult::CompleteSuccess { total_size, output },
+        Err(err) => UploadMultipartResult::CompleteError(err),
+    }
+}
+
+fn parse_etag(s: Option<String>) -> String {
+    match s {
+        Some(s) => {
+            if s.starts_with('"') && s.ends_with('"') {
+                s[1..s.len() - 1].to_string()
+            } else {
+                s
+            }
+        }
+        None => "".to_string(),
+    }
+}
+
+fn map_upload_err<E>(err: s3::error::SdkError<E>) -> objects::Error
+where
+    E: std::fmt::Debug,
+{
+    if err
+        .raw_response()
+        .is_some_and(|r| r.status().as_u16() == 412)
+    {
+        Error::PreconditionFailed
+    } else {
+        Error::Other(anyhow::anyhow!("failed to upload: {:?}", err))
+    }
+}
diff --git a/runtimes/core/src/objects/s3/mod.rs b/runtimes/core/src/objects/s3/mod.rs
new file mode 100644
index 0000000000..c31dc3bbdd
--- /dev/null
+++ b/runtimes/core/src/objects/s3/mod.rs
@@ -0,0 +1,85 @@
+use std::sync::Arc;
+
+use crate::encore::runtime::v1 as pb;
+use crate::objects;
+use crate::objects::s3::bucket::Bucket;
+use crate::secrets::Secret;
+use aws_sdk_s3 as s3;
+
+mod bucket;
+
+#[derive(Debug)]
+pub struct Cluster {
+    client: Arc<LazyS3Client>,
+}
+
+impl Cluster {
+    pub fn new(cfg: pb::bucket_cluster::S3, secret_access_key: Option<Secret>) -> Self {
+        let client = Arc::new(LazyS3Client::new(cfg, secret_access_key));
+        Self { client }
+    }
+}
+
+impl objects::ClusterImpl for Cluster {
+    fn bucket(self: Arc<Self>, cfg: &pb::Bucket) -> Arc<dyn objects::BucketImpl + 'static> {
+        Arc::new(Bucket::new(self.client.clone(), cfg))
+    }
+}
+
+struct LazyS3Client {
+    cfg: pb::bucket_cluster::S3,
+    secret_access_key: Option<Secret>,
+    cell: tokio::sync::OnceCell<Arc<s3::Client>>,
+}
+
+impl std::fmt::Debug for LazyS3Client {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LazyS3Client").finish()
+    }
+}
+
+impl LazyS3Client {
+    fn new(cfg: pb::bucket_cluster::S3, secret_access_key: Option<Secret>) -> Self {
+        Self {
+            cfg,
+            secret_access_key,
+            cell: tokio::sync::OnceCell::new(),
+        }
+    }
+
+    async fn get(&self) -> &Arc<s3::Client> {
+        self.cell
+            .get_or_init(|| async {
+                let region = aws_config::Region::new(self.cfg.region.clone());
+                let mut builder =
+                    aws_config::defaults(aws_config::BehaviorVersion::v2024_03_28()).region(region);
+                if let Some(endpoint) = self.cfg.endpoint.as_ref() {
+                    builder = builder.endpoint_url(endpoint.clone());
+                }
+
+                if let (Some(access_key_id), Some(secret_access_key)) = (
+                    self.cfg.access_key_id.as_ref(),
+                    self.secret_access_key.as_ref(),
+                ) {
+                    use aws_credential_types::Credentials;
+                    let secret_access_key = secret_access_key
+                        .get()
+                        .expect("unable to resolve s3 secret access key");
+                    let secret_access_key = std::str::from_utf8(secret_access_key)
+                        .expect("unable to parse s3 secret access key as utf-8");
+
+                    builder = builder.credentials_provider(Credentials::new(
+                        access_key_id,
+                        secret_access_key,
+                        None,
+                        None,
+                        "encore-runtime",
+                    ));
+                }
+
+                let cfg = builder.load().await;
+                Arc::new(s3::Client::new(&cfg))
+            })
+            .await
+    }
+}
diff --git a/runtimes/core/src/proccfg.rs b/runtimes/core/src/proccfg.rs
new file mode 100644
index 0000000000..4bcea4f663
--- /dev/null
+++ b/runtimes/core/src/proccfg.rs
@@ -0,0 +1,74 @@
+use std::collections::HashMap;
+
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+
+use crate::encore::runtime::v1 as runtimepb;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ProcessConfig {
+    hosted_services: Vec<String>,
+    hosted_gateways: Vec<String>,
+    local_service_ports: HashMap<String, u16>,
+}
+
+impl ProcessConfig {
+    pub fn apply(&self, cfg: &mut runtimepb::RuntimeConfig) -> Result<()> {
+        let deployment = cfg.deployment.get_or_insert_with(Default::default);
+
+        // Construct a map of existing hosted services, keyed by name.
+        let hosted_services = deployment
+            .hosted_services
+            .iter()
+            .map(|s| (s.name.clone(), s.clone()))
+            .collect::<HashMap<_, _>>();
+
+        deployment.hosted_services = self
+            .hosted_services
+            .iter()
+            .map(|s| {
+                hosted_services
+                    .get(s)
+                    .cloned()
+                    .unwrap_or_else(|| runtimepb::HostedService {
+                        name: s.clone(),
+                        log_config: None,
+                        worker_threads: None,
+                    })
+            })
+            .collect();
+        deployment.hosted_gateways = self
+            .hosted_gateways
+            .iter()
+            .map(|s| {
+                cfg.infra
+                    .as_ref()
+                    .context("gateway not found in infra resources")
+                    .and_then(|r| r.resources.as_ref().context("resources not found in infra"))
+                    .and_then(|r| {
+                        r.gateways
+                            .iter()
+                            .find(|g| g.encore_name == *s)
+                            .context("gateway not found in infra resources")
+                            .map(|r| r.rid.clone())
+                    })
+            })
+            .collect::<Result<Vec<_>>>()?;
+
+        let svc_discovery = deployment
+            .service_discovery
+            .get_or_insert_with(Default::default);
+        // Iterate through service_ports and add service_discovery entries
+        for (service_name, port) in &self.local_service_ports {
+            let base_url = format!("http://127.0.0.1:{port}");
+            svc_discovery.services.insert(
+                service_name.clone(),
+                runtimepb::service_discovery::Location {
+                    base_url: base_url.clone(),
+                    auth_methods: deployment.auth_methods.clone(),
+                },
+            );
+        }
+        Ok(())
+    }
+}
diff --git a/runtimes/core/src/pubsub/gcp/jwk.rs b/runtimes/core/src/pubsub/gcp/jwk.rs
new file mode 100644
index 0000000000..6595fe5c97
--- /dev/null
+++ b/runtimes/core/src/pubsub/gcp/jwk.rs
@@ -0,0 +1,179 @@
+use std::{collections::HashMap, str::FromStr, sync::Arc, time::Duration};
+
+use anyhow::Context;
+use jsonwebtoken::jwk::{Jwk, JwkSet, KeyAlgorithm};
+use serde::Deserialize;
+
+/// Implements a client that fetches and caches JWK sets from a URL.
+#[derive(Debug)]
+pub struct CachingClient {
+    /// The cached JWK set, keyed by the URL.
+    cached: tokio::sync::RwLock<HashMap<&'static str, CachedJwkSet>>,
+}
+
+impl CachingClient {
+    pub fn new() -> Self {
+        Self {
+            cached: tokio::sync::RwLock::default(),
+        }
+    }
+
+    /// Returns the cached JWK set, fetching it if necessary.
+    pub async fn get(&self, url: &'static str) -> anyhow::Result<Arc<JwkSet>> {
+        // Do we already have a cached JWK set that's still valid?
+        if let Some(cached) = self.get_if_cached(url).await {
+            return Ok(cached);
+        }
+
+        // Fetch the JWK set from the URL.
+        let response = fetch(url).await?;
+        let set = response.set.clone();
+
+        // Update the cache.
+        {
+            let mut write_guard = self.cached.write().await;
+            write_guard.insert(url, response);
+        }
+
+        Ok(set)
+    }
+
+    /// Reports the cached JWK set if it's still valid.
+    async fn get_if_cached(&self, url: &str) -> Option<Arc<JwkSet>> {
+        let read_guard = self.cached.read().await;
+        if let Some(cached) = read_guard.get(url) {
+            if cached.is_valid() {
+                return Some(cached.set.clone());
+            }
+        }
+        None
+    }
+}
+
+#[derive(Debug)]
+struct CachedJwkSet {
+    /// The JWK set.
+    set: Arc<JwkSet>,
+
+    /// The time the JWK set cache expires.
+    /// None if the response should not be cached.
+    exp: Option<std::time::Instant>,
+}
+
+impl CachedJwkSet {
+    pub fn is_valid(&self) -> bool {
+        self.exp
+            .map(|exp| exp > std::time::Instant::now())
+            .unwrap_or(false)
+    }
+}
+
+/// Fetches a JWK set from a URL and returns it.
+async fn fetch(url: &str) -> anyhow::Result<CachedJwkSet> {
+    // Fetch the JWK set from the URL.
+    let response = reqwest::get(url).await?;
+
+    // If the status is not 200, return an error.
+    if !response.status().is_success() {
+        return Err(anyhow::anyhow!(
+            "failed to fetch JWK set: {}",
+            response.status()
+        ));
+    }
+
+    // Determine the expiration time from the cache headers.
+    let exp = response_cache_exp_time(response.headers());
+    let exp = exp.map(|dur| std::time::Instant::now() + dur);
+
+    #[derive(Deserialize)]
+    struct RawKeyList {
+        keys: Vec<serde_json::Value>,
+    }
+    let key_list: RawKeyList = response.json().await.context("unable to parse key list")?;
+    let keys = key_list
+        .keys
+        .into_iter()
+        .filter_map(parse_key)
+        .collect::<Vec<Jwk>>();
+
+    Ok(CachedJwkSet {
+        set: Arc::new(JwkSet { keys }),
+        exp,
+    })
+}
+
+fn parse_key(val: serde_json::Value) -> Option<Jwk> {
+    if let serde_json::Value::Object(map) = &val {
+        if let Some(serde_json::Value::String(alg)) = map.get("alg") {
+            if KeyAlgorithm::from_str(alg).is_err() {
+                return None;
+            }
+            // We have an algorithm that can be parsed, so parse the whole JWT.
+            return serde_json::from_value(val).ok();
+        }
+    }
+
+    None
+}
+
+fn response_cache_exp_time(resp: &reqwest::header::HeaderMap) -> Option<Duration> {
+    let cache_control = resp.get("cache-control").and_then(|v| v.to_str().ok());
+    let age = resp.get("age").and_then(|v| v.to_str().ok());
+
+    cache_exp_time(cache_control, age)
+}
+
+fn cache_exp_time(
+    cache_control_header: Option<&str>,
+    age_header: Option<&str>,
+) -> Option<Duration> {
+    let mut max_age = None;
+    if let Some(cache_control) = cache_control_header {
+        let parts = cache_control.split(',');
+        for part in parts {
+            let directive = part.trim();
+            if directive.starts_with("max-age=") {
+                if let Some(eq_idx) = directive.find('=') {
+                    let age_value = directive[eq_idx + 1..].trim();
+                    if let Ok(seconds) = age_value.parse::<u64>() {
+                        max_age = Some(Duration::from_secs(seconds));
+                    }
+                }
+            }
+        }
+    }
+
+    let mut age = Duration::from_secs(0);
+    if let Some(age_header) = age_header {
+        if let Ok(age_secs) = age_header.parse::<u64>() {
+            age = Duration::from_secs(age_secs);
+        }
+    }
+
+    max_age.and_then(|ma| if ma >= age { Some(ma - age) } else { None })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_cache_exp_time() {
+        assert_eq!(cache_exp_time(None, None), None);
+        assert_eq!(
+            cache_exp_time(Some("max-age=60"), None),
+            Some(Duration::from_secs(60))
+        );
+        assert_eq!(
+            cache_exp_time(Some("max-age=60"), Some("30")),
+            Some(Duration::from_secs(30))
+        );
+        assert_eq!(
+            cache_exp_time(Some("max-age=60, stale-while-revalidate=30"), Some("30")),
+            Some(Duration::from_secs(30))
+        );
+
+        // Test when max-age is below age.
+        assert_eq!(cache_exp_time(Some("max-age=30"), Some("60")), None);
+    }
+}
diff --git a/runtimes/core/src/pubsub/gcp/mod.rs b/runtimes/core/src/pubsub/gcp/mod.rs
new file mode 100644
index 0000000000..88ec89cedc
--- /dev/null
+++ b/runtimes/core/src/pubsub/gcp/mod.rs
@@ -0,0 +1,82 @@
+use std::sync::Arc;
+
+use anyhow::Context;
+use google_cloud_pubsub as gcp;
+
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::runtime::v1 as pb;
+use crate::pubsub;
+use crate::pubsub::gcp::sub::Subscription;
+use crate::pubsub::gcp::topic::Topic;
+
+mod jwk;
+mod push_sub;
+mod sub;
+mod topic;
+#[derive(Debug)]
+pub struct Cluster {
+    client: Arc<LazyGCPClient>,
+}
+
+impl Cluster {
+    pub fn new() -> Self {
+        let client = Arc::new(LazyGCPClient::new());
+        Self { client }
+    }
+}
+
+impl pubsub::Cluster for Cluster {
+    fn topic(
+        &self,
+        cfg: &pb::PubSubTopic,
+        _publisher_id: xid::Id,
+    ) -> Arc<dyn pubsub::Topic + 'static> {
+        Arc::new(Topic::new(self.client.clone(), cfg))
+    }
+
+    fn subscription(
+        &self,
+        cfg: &pb::PubSubSubscription,
+        meta: &meta::pub_sub_topic::Subscription,
+    ) -> Arc<dyn pubsub::Subscription + 'static> {
+        // If this is a push-based subscription, return that implementation.
+        if let Some(pb::pub_sub_subscription::ProviderConfig::GcpConfig(gcp_cfg)) =
+            cfg.provider_config.as_ref()
+        {
+            if gcp_cfg.push_service_account.is_some() {
+                return Arc::new(push_sub::PushSubscription::new(cfg));
+            }
+        }
+
+        Arc::new(Subscription::new(self.client.clone(), cfg, meta))
+    }
+}
+
+#[derive(Debug)]
+struct LazyGCPClient {
+    cell: tokio::sync::OnceCell<anyhow::Result<gcp::client::Client>>,
+}
+
+impl LazyGCPClient {
+    fn new() -> Self {
+        Self {
+            cell: tokio::sync::OnceCell::new(),
+        }
+    }
+
+    async fn get(&self) -> &anyhow::Result<gcp::client::Client> {
+        self.cell
+            .get_or_init(|| async {
+                let config = gcp::client::ClientConfig::default()
+                    .with_auth()
+                    .await
+                    .inspect_err(|e| log::error!("failed to get client config: {e:?}"))
+                    .context("get client config")?;
+                gcp::client::Client::new(config)
+                    .await
+                    .inspect_err(|e| log::error!("failed to get client: {e:?}"))
+                    .context("get client")
+            })
+            .await
+    }
+}
diff --git a/runtimes/core/src/pubsub/gcp/push_sub.rs b/runtimes/core/src/pubsub/gcp/push_sub.rs
new file mode 100644
index 0000000000..fa35d09041
--- /dev/null
+++ b/runtimes/core/src/pubsub/gcp/push_sub.rs
@@ -0,0 +1,289 @@
+use std::collections::HashMap;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::{Arc, RwLock};
+
+use anyhow::Context;
+use axum::extract::Request;
+use axum::RequestExt;
+use chrono::{DateTime, Utc};
+use http_body_util::BodyExt;
+use serde::Deserialize;
+
+use crate::api::{self, APIResult, ToResponse};
+use crate::encore::runtime::v1 as pb;
+use crate::pubsub::manager::SubHandler;
+use crate::pubsub::{self, MessageId};
+
+use super::jwk::{self, CachingClient};
+
+#[derive(Debug, Clone)]
+pub struct PushSubscription {
+    inner: Arc<Inner>,
+}
+
+#[derive(Debug)]
+struct Inner {
+    subscription_id: String,
+    handler: RwLock<Option<Arc<SubHandler>>>,
+    validator: GoogleJWTValidator,
+}
+
+impl PushSubscription {
+    pub(super) fn new(cfg: &pb::PubSubSubscription) -> Self {
+        let Some(pb::pub_sub_subscription::ProviderConfig::GcpConfig(gcp_cfg)) =
+            cfg.provider_config.as_ref()
+        else {
+            panic!("missing gcp config for subscription")
+        };
+
+        let Some(service_account) = &gcp_cfg.push_service_account else {
+            panic!("missing push_service_account for subscription")
+        };
+
+        let google_validator = GoogleJWTValidator {
+            client: CachingClient::new(),
+            push_service_account: service_account.clone(),
+            audience: gcp_cfg.push_jwt_audience.clone(),
+        };
+
+        Self {
+            inner: Arc::new(Inner {
+                subscription_id: cfg.rid.clone(),
+                handler: RwLock::new(None),
+                validator: google_validator,
+            }),
+        }
+    }
+}
+
+impl pubsub::Subscription for PushSubscription {
+    fn subscribe(
+        &self,
+        handler: Arc<SubHandler>,
+    ) -> Pin<Box<dyn Future<Output = APIResult<()>> + Send + 'static>> {
+        self.inner.handler.write().unwrap().replace(handler);
+
+        // Block forever; the handler is called from the HTTP handler.
+        Box::pin(futures::future::pending())
+    }
+
+    fn push_handler(&self) -> Option<(String, Arc<dyn pubsub::PushRequestHandler>)> {
+        Some((
+            self.inner.subscription_id.clone(),
+            Arc::new(PushHandler {
+                inner: self.inner.clone(),
+            }),
+        ))
+    }
+}
+
+#[derive(Debug, Clone)]
+struct PushHandler {
+    inner: Arc<Inner>,
+}
+
+impl pubsub::PushRequestHandler for PushHandler {
+    fn handle_push(
+        &self,
+        req: Request,
+    ) -> Pin<Box<dyn Future<Output = axum::response::Response<axum::body::Body>> + Send + 'static>>
+    {
+        let inner = self.inner.clone();
+        Box::pin(async move {
+            match inner.handle_req(req).await {
+                Ok(()) => axum::response::Response::new(axum::body::Body::empty()),
+                Err(e) => {
+                    log::error!("push handler returned error: {:?}", e);
+                    e.to_response(None)
+                }
+            }
+        })
+    }
+}
+
+/// Payload of a push message from GCP Pub/Sub.
+/// This is documented in https://cloud.google.com/pubsub/docs/push
+#[derive(Debug, Deserialize)]
+struct PushPayload {
+    message: PushMessage,
+    #[allow(dead_code)]
+    subscription: String,
+    #[serde(rename = "deliveryAttempt")]
+    delivery_attempt: Option<u32>,
+}
+
+#[derive(Debug, Deserialize)]
+struct PushMessage {
+    #[serde(default)]
+    attributes: HashMap<String, String>,
+    #[serde(with = "base64")]
+    data: Vec<u8>,
+    #[serde(rename = "messageId")]
+    message_id: String,
+    #[serde(rename = "publishTime")]
+    publish_time: DateTime<Utc>,
+}
+
+impl Inner {
+    async fn handle_req(&self, req: Request) -> APIResult<()> {
+        // Do we have a handler registered yet? If not, there's no point in proceeding.
+        let handler = {
+            let read_guard = self.handler.read().unwrap();
+            let Some(handler) = (*read_guard).clone() else {
+                return Err(api::Error {
+                    code: api::ErrCode::Internal,
+                    message: "no handler registered for subscription".to_string(),
+                    internal_message: None,
+                    stack: None,
+                    details: None,
+                });
+            };
+            handler
+        };
+
+        // Validate the JWT token.
+        self.validator
+            .validate_google_jwt(req.headers())
+            .await
+            .map_err(api::Error::internal)?;
+
+        // Parse the request payload.
+        let bytes = req
+            .into_limited_body()
+            .collect()
+            .await
+            .map_err(api::Error::internal)?
+            .to_bytes();
+        let msg: PushPayload = serde_json::from_slice(&bytes).map_err(api::Error::internal)?;
+
+        let msg = pubsub::Message {
+            id: msg.message.message_id as MessageId,
+            publish_time: Some(msg.message.publish_time),
+            attempt: msg.delivery_attempt.unwrap_or(1),
+            data: pubsub::MessageData {
+                attrs: msg.message.attributes,
+                raw_body: msg.message.data,
+            },
+        };
+
+        match handler.handle_message(msg).await {
+            Ok(()) => Ok(()),
+            Err(err) => {
+                log::info!("message handler failed, nacking message: {:?}", err);
+                Err(err)
+            }
+        }
+    }
+}
+
+#[derive(Debug)]
+struct GoogleJWTValidator {
+    client: jwk::CachingClient,
+    audience: Option<String>,
+    push_service_account: String,
+}
+
+/// The certs URL for RSA keys.
+const GOOGLE_SA_CERTS_URL: &str = "https://www.googleapis.com/oauth2/v3/certs";
+
+/// The certs URL for other keys.
+const GOOGLE_IAP_CERTS_URL: &str = "https://www.gstatic.com/iap/verify/public_key-jwk";
+
+impl GoogleJWTValidator {
+    pub async fn validate_google_jwt(&self, req: &axum::http::HeaderMap) -> anyhow::Result<()> {
+        // Extract the JWT from the header
+        let auth_header = req
+            .get("Authorization")
+            .ok_or_else(|| anyhow::anyhow!("missing auth header"))?;
+        let token = auth_header
+            .to_str()
+            .map_err(|_| anyhow::anyhow!("invalid auth header"))?;
+        let token = token
+            .strip_prefix("Bearer ")
+            .ok_or_else(|| anyhow::anyhow!("invalid auth header"))?;
+
+        let token_header = jsonwebtoken::decode_header(token)?;
+        let Some(token_key_id) = token_header.kid.as_ref() else {
+            return Err(anyhow::anyhow!("missing kid in token header"));
+        };
+
+        let url = match token_header.alg {
+            jsonwebtoken::Algorithm::RS256
+            | jsonwebtoken::Algorithm::RS384
+            | jsonwebtoken::Algorithm::RS512 => GOOGLE_SA_CERTS_URL,
+            _ => GOOGLE_IAP_CERTS_URL,
+        };
+
+        // Get the JWK set to validate the token against.
+        let jwks = self
+            .client
+            .get(url)
+            .await
+            .context("unable to fetch JWK keys")?;
+
+        // Find the key that matches the token.
+        let jwk_key = jwks.find(token_key_id).ok_or_else(|| {
+            anyhow::anyhow!("unable to find JWK key for token: {:?}", token_key_id)
+        })?;
+
+        // Decode all the claims.
+        #[derive(Deserialize)]
+        struct Claims {
+            // Custom claims from GCP
+            email: String,
+            email_verified: bool,
+        }
+
+        let decoding_key = jsonwebtoken::DecodingKey::from_jwk(jwk_key)
+            .context("unable to create JWT decoding key")?;
+
+        // Per the Go GCP library, the only supported algorithms are RS256 and ES256.
+        let alg = match token_header.alg {
+            jsonwebtoken::Algorithm::RS256 | jsonwebtoken::Algorithm::ES256 => token_header.alg,
+            _ => {
+                return Err(anyhow::anyhow!(
+                    "unexpected algorithm: {:?}",
+                    token_header.alg
+                ));
+            }
+        };
+
+        let mut validation = jsonwebtoken::Validation::new(alg);
+        if let Some(aud) = &self.audience {
+            validation.set_audience(&[aud]);
+        }
+        validation.set_issuer(&["accounts.google.com", "https://accounts.google.com"]);
+        validation.set_required_spec_claims(&["exp", "iss", "aud"]);
+
+        let jwt = jsonwebtoken::decode::<Claims>(token, &decoding_key, &validation)
+            .context("unable to decode JWT claims")?;
+        if jwt.claims.email != self.push_service_account {
+            return Err(anyhow::anyhow!("invalid email"));
+        }
+        if !jwt.claims.email_verified {
+            return Err(anyhow::anyhow!("email not verified"));
+        }
+
+        Ok(())
+    }
+}
+
+mod base64 {
+    use base64::engine::{general_purpose::STANDARD, Engine};
+    use serde::{Deserialize, Serialize};
+    use serde::{Deserializer, Serializer};
+
+    #[allow(dead_code)]
+    pub fn serialize<S: Serializer>(v: &Vec<u8>, s: S) -> Result<S::Ok, S::Error> {
+        let base64 = STANDARD.encode(v);
+        String::serialize(&base64, s)
+    }
+
+    pub fn deserialize<'de, D: Deserializer<'de>>(d: D) -> Result<Vec<u8>, D::Error> {
+        let base64 = String::deserialize(d)?;
+        STANDARD
+            .decode(base64.as_bytes())
+            .map_err(serde::de::Error::custom)
+    }
+}
diff --git a/runtimes/core/src/pubsub/gcp/sub.rs b/runtimes/core/src/pubsub/gcp/sub.rs
new file mode 100644
index 0000000000..a3bd603387
--- /dev/null
+++ b/runtimes/core/src/pubsub/gcp/sub.rs
@@ -0,0 +1,170 @@
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+use anyhow::Result;
+use google_cloud_pubsub as gcp;
+use google_cloud_pubsub::apiv1::default_retry_setting;
+use tokio_util::sync::CancellationToken;
+
+use crate::api::{self, APIResult};
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::runtime::v1 as pb;
+use crate::pubsub::gcp::LazyGCPClient;
+use crate::pubsub::manager::SubHandler;
+use crate::pubsub::{self, MessageId};
+
+#[derive(Debug)]
+pub struct Subscription {
+    inner: Arc<InnerSubscription>,
+}
+
+impl Subscription {
+    pub(super) fn new(
+        client: Arc<LazyGCPClient>,
+        cfg: &pb::PubSubSubscription,
+        meta: &meta::pub_sub_topic::Subscription,
+    ) -> Self {
+        let inner = InnerSubscription::new(client, cfg, meta);
+        Self {
+            inner: Arc::new(inner),
+        }
+    }
+}
+
+impl pubsub::Subscription for Subscription {
+    fn subscribe(
+        &self,
+        handler: Arc<SubHandler>,
+    ) -> Pin<Box<dyn Future<Output = APIResult<()>> + Send + 'static>> {
+        let inner = self.inner.clone();
+        Box::pin(async move {
+            let sub = inner.get_sub().await.map_err(api::Error::internal)?;
+            let cancel = CancellationToken::new();
+            sub.receive(
+                move |message, cancel| {
+                    let handler = handler.clone();
+                    handle_message(handler, message, cancel)
+                },
+                cancel,
+                Some(inner.receive_cfg.clone()),
+            )
+            .await
+            .map_err(api::Error::internal)?;
+            Ok(())
+        })
+    }
+}
+
+#[derive(Debug)]
+struct InnerSubscription {
+    client: Arc<LazyGCPClient>,
+    project_id: String,
+    sub_name: String,
+    receive_cfg: gcp::subscription::ReceiveConfig,
+    cell: tokio::sync::OnceCell<Result<gcp::subscription::Subscription>>,
+}
+
+impl InnerSubscription {
+    pub(super) fn new(
+        client: Arc<LazyGCPClient>,
+        cfg: &pb::PubSubSubscription,
+        meta: &meta::pub_sub_topic::Subscription,
+    ) -> Self {
+        let Some(pb::pub_sub_subscription::ProviderConfig::GcpConfig(gcp_cfg)) =
+            cfg.provider_config.as_ref()
+        else {
+            panic!("missing gcp config for subscription")
+        };
+
+        let receive_cfg = gcp::subscription::ReceiveConfig {
+            subscriber_config: gcp::subscriber::SubscriberConfig {
+                max_outstanding_messages: meta.max_concurrency.map_or(100, |v| v as i64),
+                retry_setting: Some(google_cloud_gax::retry::RetrySetting {
+                    from_millis: meta.retry_policy.as_ref().map_or(10, |retry| {
+                        let min_backoff = retry.min_backoff.max(0) as u64;
+                        min_backoff / 1_000_000 // nanos to millis
+                    }),
+                    max_delay: meta.retry_policy.as_ref().map(|retry| {
+                        let max_backoff = retry.max_backoff.max(0) as u64;
+                        std::time::Duration::from_nanos(max_backoff)
+                    }),
+                    ..default_retry_setting()
+                }),
+                ..Default::default()
+            },
+            ..Default::default()
+        };
+
+        Self {
+            client,
+            project_id: gcp_cfg.project_id.clone(),
+            sub_name: cfg.subscription_cloud_name.clone(),
+            receive_cfg,
+            cell: tokio::sync::OnceCell::new(),
+        }
+    }
+
+    async fn get_sub(&self) -> Result<&gcp::subscription::Subscription> {
+        let res = self
+            .cell
+            .get_or_init(|| async {
+                match self.client.get().await {
+                    Ok(client) => {
+                        let fqdn = format!(
+                            "projects/{}/subscriptions/{}",
+                            self.project_id, self.sub_name
+                        );
+                        Ok(client.subscription(&fqdn))
+                    }
+                    Err(e) => anyhow::bail!("failed to get gcp client: {}", e),
+                }
+            })
+            .await;
+        match res {
+            Ok(sub) => Ok(sub),
+            Err(e) => anyhow::bail!("failed to get topic: {}", e),
+        }
+    }
+}
+
+async fn handle_message(
+    handler: Arc<SubHandler>,
+    mut message: gcp::subscriber::ReceivedMessage,
+    _cancel: CancellationToken,
+) {
+    let attempt = message.delivery_attempt().unwrap_or(1) as u32;
+    let publish_time = message
+        .message
+        .publish_time
+        .as_ref()
+        .and_then(|ts| chrono::DateTime::from_timestamp(ts.seconds, ts.nanos as u32));
+
+    let raw_body = message.message.data.drain(..).collect();
+
+    let msg = pubsub::Message {
+        id: message.message.message_id.clone() as MessageId,
+        publish_time,
+        attempt,
+        data: pubsub::MessageData {
+            attrs: message.message.attributes.clone().into_iter().collect(),
+            raw_body,
+        },
+    };
+
+    // Process the message asynchronously.
+    match handler.handle_message(msg).await {
+        Ok(()) => {
+            // Acknowledge the message.
+            if let Err(err) = message.ack().await {
+                log::error!("failed to ack message: {:?}", err);
+            }
+        }
+        Err(err) => {
+            log::info!("message handler failed, nacking message: {:?}", err);
+            if let Err(err) = message.nack().await {
+                log::error!("failed to nack message: {:?}", err);
+            }
+        }
+    }
+}
diff --git a/runtimes/core/src/pubsub/gcp/topic.rs b/runtimes/core/src/pubsub/gcp/topic.rs
new file mode 100644
index 0000000000..e6c4b84880
--- /dev/null
+++ b/runtimes/core/src/pubsub/gcp/topic.rs
@@ -0,0 +1,83 @@
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+use anyhow::Result;
+use google_cloud_googleapis::pubsub::v1::PubsubMessage;
+use google_cloud_pubsub as gcp;
+
+use crate::encore::runtime::v1 as pb;
+use crate::names::CloudName;
+use crate::pubsub::gcp::LazyGCPClient;
+use crate::pubsub::{self, MessageData, MessageId};
+
+#[derive(Debug)]
+pub struct Topic {
+    client: Arc<LazyGCPClient>,
+    project_id: String,
+    cloud_name: CloudName,
+    cell: tokio::sync::OnceCell<Result<(gcp::topic::Topic, gcp::publisher::Publisher)>>,
+}
+
+impl Topic {
+    pub(super) fn new(client: Arc<LazyGCPClient>, cfg: &pb::PubSubTopic) -> Self {
+        let Some(pb::pub_sub_topic::ProviderConfig::GcpConfig(gcp_cfg)) =
+            cfg.provider_config.as_ref()
+        else {
+            panic!("missing gcp config for topic")
+        };
+
+        Self {
+            client,
+            project_id: gcp_cfg.project_id.clone(),
+            cloud_name: cfg.cloud_name.clone().into(),
+            cell: tokio::sync::OnceCell::new(),
+        }
+    }
+
+    async fn get_topic(&self) -> Result<(&gcp::topic::Topic, &gcp::publisher::Publisher)> {
+        let res = self
+            .cell
+            .get_or_init(|| async {
+                match self.client.get().await {
+                    Ok(client) => {
+                        let fqtn =
+                            format!("projects/{}/topics/{}", self.project_id, self.cloud_name);
+                        let topic = client.topic(&fqtn);
+                        let publisher = topic.new_publisher(None);
+                        Ok((topic, publisher))
+                    }
+                    Err(e) => anyhow::bail!("failed to get gcp client: {}", e),
+                }
+            })
+            .await;
+        match res {
+            Ok((topic, publisher)) => Ok((topic, publisher)),
+            Err(e) => anyhow::bail!("failed to get topic: {}", e),
+        }
+    }
+}
+
+impl pubsub::Topic for Topic {
+    fn publish(
+        &self,
+        msg: MessageData,
+        ordering_key: Option<String>,
+    ) -> Pin<Box<dyn Future<Output = Result<MessageId>> + Send + '_>> {
+        Box::pin(async move {
+            let (_, publisher) = self.get_topic().await?;
+            let awaiter = publisher
+                .publish(PubsubMessage {
+                    data: msg.raw_body,
+                    attributes: msg.attrs.into_iter().collect(),
+                    ordering_key: ordering_key.unwrap_or_default(),
+                    ..Default::default()
+                })
+                .await;
+            match awaiter.get().await {
+                Ok(id) => Ok(id as MessageId),
+                Err(e) => Err(e.into()),
+            }
+        })
+    }
+}
diff --git a/runtimes/core/src/pubsub/manager.rs b/runtimes/core/src/pubsub/manager.rs
new file mode 100644
index 0000000000..797d33be24
--- /dev/null
+++ b/runtimes/core/src/pubsub/manager.rs
@@ -0,0 +1,565 @@
+use std::collections::HashMap;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::atomic::AtomicUsize;
+use std::sync::{Arc, OnceLock, RwLock};
+
+use anyhow::Context;
+use chrono::Utc;
+use futures::future::Shared;
+use futures::FutureExt;
+
+use crate::api::jsonschema::{self, JSONSchema};
+use crate::api::{APIResult, PValues};
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::parser::schema::v1 as schema;
+use crate::encore::runtime::v1 as pb;
+use crate::log::LogFromRust;
+use crate::model::{PubSubRequestData, RequestData, ResponseData, SpanId, SpanKey, TraceId};
+use crate::names::EncoreName;
+use crate::pubsub::noop::NoopCluster;
+use crate::pubsub::{
+    gcp, noop, nsq, sqs_sns, Cluster, Message, MessageData, MessageId, SubName, Subscription,
+    SubscriptionHandler, Topic,
+};
+use crate::trace::{protocol, Tracer};
+use crate::{api, model};
+
+use super::push_registry::PushHandlerRegistry;
+
+pub struct Manager {
+    tracer: Tracer,
+    topic_cfg: HashMap<EncoreName, TopicConfig>,
+    sub_cfg: HashMap<SubName, SubConfig>,
+    publisher_id: xid::Id,
+
+    topics: Arc<RwLock<HashMap<EncoreName, Arc<TopicInner>>>>,
+    subs: Arc<RwLock<HashMap<SubName, Arc<SubscriptionObj>>>>,
+    push_registry: PushHandlerRegistry,
+}
+
+#[derive(Debug)]
+pub struct TopicObj {
+    inner: Arc<TopicInner>,
+}
+
+#[derive(Debug)]
+struct TopicInner {
+    name: EncoreName,
+    tracer: Tracer,
+    imp: Arc<dyn Topic>,
+    attr_fields: Arc<Vec<String>>,
+    ordering_attr: Option<String>,
+}
+
+impl TopicObj {
+    pub fn publish(
+        &self,
+        payload: PValues,
+        source: Option<Arc<model::Request>>,
+    ) -> impl Future<Output = anyhow::Result<MessageId>> + 'static {
+        self.inner.publish(payload, source)
+    }
+}
+
+impl TopicInner {
+    pub fn publish(
+        &self,
+        payload: PValues,
+        source: Option<Arc<model::Request>>,
+    ) -> impl Future<Output = anyhow::Result<MessageId>> + 'static {
+        let tracer = self.tracer.clone();
+        let inner = self.imp.clone();
+        let name = self.name.clone();
+        let attr_fields = self.attr_fields.clone();
+        let ordering_attr = self.ordering_attr.clone();
+        async move {
+            let raw_body = serde_json::to_vec_pretty(&payload)
+                .context("unable to serialize message payload")?;
+            let mut msg = MessageData {
+                attrs: HashMap::new(),
+                raw_body,
+            };
+
+            for name in attr_fields.iter() {
+                if let Some(val) = payload.get(name) {
+                    msg.attrs.insert(name.clone(), val.to_string());
+                }
+            }
+
+            let ordering_key: Option<String> = if let Some(attr) = ordering_attr {
+                Some(
+                    msg.attrs
+                        .get(&attr)
+                        .with_context(|| format!("ordering attribute {attr} not found"))?
+                        .clone(),
+                )
+            } else {
+                None
+            };
+
+            if let Some(source) = source.as_deref() {
+                msg.attrs.insert(
+                    ATTR_PARENT_TRACE_ID.to_string(),
+                    source.span.0.serialize_encore(),
+                );
+                if let Some(ext_correlation_id) = &source.ext_correlation_id {
+                    msg.attrs.insert(
+                        ATTR_EXT_CORRELATION_ID.to_string(),
+                        ext_correlation_id.clone(),
+                    );
+                }
+
+                let start_id = tracer.pubsub_publish_start(protocol::PublishStartData {
+                    source,
+                    topic: &name,
+                    payload: &msg.raw_body,
+                });
+                let result = inner.publish(msg, ordering_key).await;
+                tracer.pubsub_publish_end(protocol::PublishEndData {
+                    start_id,
+                    source,
+                    result: &result,
+                });
+                result
+            } else {
+                inner.publish(msg, ordering_key).await
+            }
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct SubscriptionObj {
+    inner: Arc<dyn Subscription>,
+    tracer: Tracer,
+    service: EncoreName,
+    topic: EncoreName,
+    subscription: EncoreName,
+    schema: JSONSchema,
+
+    handler: OnceLock<Arc<SubHandler>>,
+    subscribe_fut: OnceLock<Shared<SubscribeFut>>,
+}
+
+type SubscribeFut = Pin<Box<dyn Future<Output = APIResult<()>> + Send>>;
+
+impl SubscriptionObj {
+    pub async fn subscribe(
+        self: &Arc<Self>,
+        handler: Arc<dyn SubscriptionHandler>,
+    ) -> APIResult<()> {
+        let h = self.handler.get_or_init(|| {
+            Arc::new(SubHandler {
+                obj: self.clone(),
+                handlers: RwLock::new(Vec::new()),
+                counter: AtomicUsize::new(0),
+            })
+        });
+        h.add_handler(handler);
+
+        self.subscribe_fut
+            .get_or_init(|| self.inner.subscribe(h.clone()).shared())
+            .clone()
+            .await
+    }
+}
+
+#[derive(Debug)]
+pub struct SubHandler {
+    obj: Arc<SubscriptionObj>,
+    handlers: RwLock<Vec<Arc<dyn SubscriptionHandler>>>,
+    counter: AtomicUsize,
+}
+
+const ATTR_PARENT_TRACE_ID: &str = "encore_parent_trace_id";
+const ATTR_EXT_CORRELATION_ID: &str = "encore_ext_correlation_id";
+
+impl SubHandler {
+    fn add_handler(&self, h: Arc<dyn SubscriptionHandler>) {
+        self.handlers.write().unwrap().push(h);
+    }
+
+    pub(super) fn handle_message(
+        &self,
+        msg: Message,
+    ) -> Pin<Box<dyn Future<Output = Result<(), api::Error>> + Send + '_>> {
+        Box::pin(async move {
+            let span = SpanKey(TraceId::generate(), SpanId::generate());
+
+            let parent_trace_id: Option<TraceId> = msg
+                .data
+                .attrs
+                .get(ATTR_PARENT_TRACE_ID)
+                .and_then(|s| TraceId::parse_encore(s).ok());
+            let ext_correlation_id = msg.data.attrs.get(ATTR_EXT_CORRELATION_ID);
+
+            let mut de = serde_json::Deserializer::from_slice(&msg.data.raw_body);
+            let parsed_payload = self.obj.schema.deserialize(
+                &mut de,
+                jsonschema::DecodeConfig {
+                    coerce_strings: false,
+                    arrays_as_repeated_fields: false,
+                },
+            );
+            let (parsed_payload, parse_error) = match parsed_payload {
+                Ok(parsed_payload) => (Some(parsed_payload), None),
+                Err(e) => (
+                    None,
+                    Some(api::Error::invalid_argument(
+                        "unable to parse message payload",
+                        e,
+                    )),
+                ),
+            };
+
+            let start = tokio::time::Instant::now();
+            let start_time = std::time::SystemTime::now();
+            let req = Arc::new(model::Request {
+                span,
+                parent_trace: parent_trace_id,
+                parent_span: None,
+                caller_event_id: None,
+                ext_correlation_id: ext_correlation_id.cloned(),
+                is_platform_request: false,
+                internal_caller: None,
+                start,
+                start_time,
+                data: RequestData::PubSub(PubSubRequestData {
+                    service: self.obj.service.clone(),
+                    topic: self.obj.topic.clone(),
+                    subscription: self.obj.subscription.clone(),
+                    message_id: msg.id.to_string(),
+                    published: msg.publish_time.unwrap_or_else(Utc::now),
+                    attempt: msg.attempt,
+                    payload: msg.data.raw_body.clone(),
+                    parsed_payload,
+                }),
+            });
+
+            let logger = crate::log::root();
+            logger.info(Some(&req), "starting request", None);
+
+            self.obj.tracer.request_span_start(&req, false);
+
+            let result = {
+                // If we have a parse error, use that as the result immediately.
+                if let Some(parse_error) = parse_error {
+                    Err(parse_error)
+                } else {
+                    let handler = self.next_handler();
+                    handler.handle_message(req.clone()).await
+                }
+            };
+
+            logger.info(Some(&req), "request completed", None);
+
+            let resp = model::Response {
+                request: req,
+                duration: tokio::time::Instant::now().duration_since(start),
+                data: ResponseData::PubSub(result.clone()),
+            };
+            self.obj.tracer.request_span_end(&resp, false);
+            result
+        })
+    }
+
+    fn next_handler(&self) -> Arc<dyn SubscriptionHandler> {
+        let handlers = self.handlers.read().unwrap();
+        let n = handlers.len();
+        // If we have a single handler, skip the increment and modulo steps.
+        if n == 1 {
+            return handlers[0].clone();
+        }
+
+        // Atomically increment the counter, and then get the next handler.
+        let idx = self
+            .counter
+            .fetch_add(1, std::sync::atomic::Ordering::Relaxed);
+        handlers[idx % n].clone()
+    }
+}
+
+impl Manager {
+    pub fn new(
+        tracer: Tracer,
+        clusters: Vec<pb::PubSubCluster>,
+        md: &meta::Data,
+    ) -> anyhow::Result<Self> {
+        let (topic_cfg, sub_cfg) = make_cfg_maps(clusters, md)?;
+
+        Ok(Self {
+            publisher_id: xid::new(),
+            tracer,
+            topic_cfg,
+            sub_cfg,
+            topics: Arc::default(),
+            subs: Arc::default(),
+            push_registry: PushHandlerRegistry::new(),
+        })
+    }
+
+    pub fn topic(&self, name: EncoreName) -> Option<TopicObj> {
+        let inner = self.topic_impl(name)?;
+        Some(TopicObj { inner })
+    }
+
+    fn topic_impl(&self, name: EncoreName) -> Option<Arc<TopicInner>> {
+        if let Some(topic) = self.topics.read().unwrap().get(&name) {
+            return Some(topic.clone());
+        }
+
+        let topic = Arc::new({
+            if let Some(cfg) = self.topic_cfg.get(&name) {
+                let imp = cfg.cluster.topic(&cfg.cfg, self.publisher_id);
+                TopicInner {
+                    name: name.clone(),
+                    imp,
+                    tracer: self.tracer.clone(),
+                    attr_fields: cfg.attr_fields.clone(),
+                    ordering_attr: cfg.cfg.ordering_attr.clone(),
+                }
+            } else {
+                TopicInner {
+                    name: name.clone(),
+                    imp: Arc::new(noop::NoopTopic),
+                    tracer: self.tracer.clone(),
+                    attr_fields: Arc::new(vec![]),
+                    ordering_attr: None,
+                }
+            }
+        });
+
+        self.topics.write().unwrap().insert(name, topic.clone());
+        Some(topic)
+    }
+
+    pub fn subscription(&self, name: SubName) -> Option<Arc<SubscriptionObj>> {
+        if let Some(sub) = self.subs.read().unwrap().get(&name) {
+            return Some(sub.clone());
+        }
+
+        let sub = {
+            if let Some(cfg) = self.sub_cfg.get(&name) {
+                let inner = cfg.cluster.subscription(&cfg.cfg, &cfg.meta);
+
+                // If we have a push handler, register it.
+                if let Some((sub_id, push_handler)) = inner.push_handler() {
+                    self.push_registry.register(sub_id, push_handler);
+                }
+
+                Arc::new(SubscriptionObj {
+                    inner,
+                    tracer: self.tracer.clone(),
+                    service: cfg.meta.service_name.clone().into(),
+                    topic: name.topic.clone(),
+                    subscription: name.subscription.clone(),
+                    schema: cfg.schema.clone(),
+                    handler: OnceLock::new(),
+                    subscribe_fut: Default::default(),
+                })
+            } else {
+                let inner = Arc::new(noop::NoopSubscription);
+                Arc::new(SubscriptionObj {
+                    inner,
+                    tracer: self.tracer.clone(),
+                    topic: name.topic.clone(),
+                    subscription: name.subscription.clone(),
+
+                    // We don't have a service if there is no sub config, but that's fine
+                    // since it's only used by tracing, and a no-op subscription won't
+                    // generate any traces.
+                    service: "".into(),
+
+                    // We don't have a schema since it's an unknown subscription.
+                    // Use a null schema.
+                    schema: JSONSchema::null(),
+
+                    handler: OnceLock::new(),
+                    subscribe_fut: Default::default(),
+                })
+            }
+        };
+
+        self.subs.write().unwrap().insert(name, sub.clone());
+
+        Some(sub)
+    }
+
+    pub fn push_registry(&self) -> PushHandlerRegistry {
+        self.push_registry.clone()
+    }
+}
+
+#[derive(Debug)]
+struct TopicConfig {
+    cluster: Arc<dyn Cluster>,
+    cfg: pb::PubSubTopic,
+
+    /// Names of fields in the payload that should be copied into
+    /// the PubSub message attributes.
+    attr_fields: Arc<Vec<String>>,
+}
+
+#[derive(Debug)]
+struct SubConfig {
+    cluster: Arc<dyn Cluster>,
+    cfg: pb::PubSubSubscription,
+    meta: meta::pub_sub_topic::Subscription,
+    schema: JSONSchema,
+}
+
+fn make_cfg_maps(
+    clusters: Vec<pb::PubSubCluster>,
+    md: &meta::Data,
+) -> anyhow::Result<(
+    HashMap<EncoreName, TopicConfig>,
+    HashMap<SubName, SubConfig>,
+)> {
+    let mut topic_map = HashMap::new();
+    let mut sub_map = HashMap::new();
+
+    let mut schema_builder = jsonschema::Builder::new(md);
+    let (meta_topics, meta_subs) = {
+        let mut topic_map = HashMap::new();
+        let mut sub_map = HashMap::new();
+
+        for topic in &md.pubsub_topics {
+            let Some(schema_type) = &topic.message_type else {
+                anyhow::bail!("topic {} has no message type", topic.name);
+            };
+            let attr_fields = message_attr_fields(&md.decls, schema_type, 0)?;
+            let schema_idx = schema_builder
+                .register_type(schema_type)
+                .with_context(|| format!("invalid schema for topic {}", topic.name))?;
+
+            topic_map.insert(topic.name.clone(), Arc::new(attr_fields));
+            for sub in &topic.subscriptions {
+                let name = SubName {
+                    topic: topic.name.clone().into(),
+                    subscription: sub.name.clone().into(),
+                };
+                sub_map.insert(name, (sub, schema_idx));
+            }
+        }
+        (topic_map, sub_map)
+    };
+
+    let schemas = schema_builder.build();
+    for cluster_cfg in clusters {
+        let cluster = new_cluster(&cluster_cfg);
+
+        for topic_cfg in cluster_cfg.topics {
+            let Some(attr_fields) = meta_topics.get(&topic_cfg.encore_name) else {
+                anyhow::bail!("topic {} not found in metadata", topic_cfg.encore_name);
+            };
+            topic_map.insert(
+                topic_cfg.encore_name.clone().into(),
+                TopicConfig {
+                    cluster: cluster.clone(),
+                    cfg: topic_cfg,
+                    attr_fields: attr_fields.clone(),
+                },
+            );
+        }
+
+        for sub_cfg in cluster_cfg.subscriptions {
+            let topic_name = sub_cfg.topic_encore_name.clone().into();
+            let sub_name = sub_cfg.subscription_encore_name.clone().into();
+            let name = SubName {
+                topic: topic_name,
+                subscription: sub_name,
+            };
+            let Some(&(meta_sub, idx)) = meta_subs.get(&name) else {
+                continue;
+            };
+
+            let schema = schemas.schema(idx);
+            sub_map.insert(
+                name,
+                SubConfig {
+                    cluster: cluster.clone(),
+                    cfg: sub_cfg,
+                    meta: meta_sub.to_owned(),
+                    schema,
+                },
+            );
+        }
+    }
+
+    Ok((topic_map, sub_map))
+}
+
+fn new_cluster(cluster: &pb::PubSubCluster) -> Arc<dyn Cluster> {
+    let Some(provider) = &cluster.provider else {
+        log::error!("missing PubSub cluster provider: {}", cluster.rid);
+        return Arc::new(NoopCluster);
+    };
+
+    match provider {
+        pb::pub_sub_cluster::Provider::Gcp(_) => return Arc::new(gcp::Cluster::new()),
+        pb::pub_sub_cluster::Provider::Nsq(cfg) => {
+            return Arc::new(nsq::Cluster::new(cfg.hosts[0].clone()));
+        }
+        pb::pub_sub_cluster::Provider::Aws(_) => return Arc::new(sqs_sns::Cluster::new()),
+        pb::pub_sub_cluster::Provider::Encore(_) => {
+            log::error!("Encore Cloud Pub/Sub not yet supported: {}", cluster.rid);
+        }
+        pb::pub_sub_cluster::Provider::Azure(_) => {
+            log::error!("Azure Pub/Sub not yet supported: {}", cluster.rid);
+        }
+    }
+
+    Arc::new(NoopCluster)
+}
+
+fn message_attr_fields(
+    decls: &[schema::Decl],
+    typ: &schema::Type,
+    depth: u16,
+) -> anyhow::Result<Vec<String>> {
+    if depth > 100 {
+        anyhow::bail!("pubsub message attribute computation: recursion depth exceeded");
+    }
+    let Some(typ) = &typ.typ else {
+        return Ok(vec![]);
+    };
+
+    use schema::r#type::Typ;
+    match typ {
+        Typ::Named(named) => {
+            let Some(decl) = decls.get(named.id as usize) else {
+                anyhow::bail!("missing decl for named type");
+            };
+            let Some(decl_typ) = decl.r#type.as_ref() else {
+                anyhow::bail!("missing type for named decl");
+            };
+            message_attr_fields(decls, decl_typ, depth + 1)
+        }
+        Typ::Struct(st) => {
+            let names: Vec<String> = st
+                .fields
+                .iter()
+                .filter_map(|f| {
+                    f.tags.iter().find_map(|tag| {
+                        if tag.key == "pubsub-attr" {
+                            Some(tag.name.clone())
+                        } else {
+                            None
+                        }
+                    })
+                })
+                .collect();
+            Ok(names)
+        }
+
+        Typ::Map(_)
+        | Typ::List(_)
+        | Typ::Builtin(_)
+        | Typ::Pointer(_)
+        | Typ::Union(_)
+        | Typ::Literal(_)
+        | Typ::TypeParameter(_)
+        | Typ::Config(_) => Ok(vec![]),
+    }
+}
diff --git a/runtimes/core/src/pubsub/mod.rs b/runtimes/core/src/pubsub/mod.rs
new file mode 100644
index 0000000000..f8910ad3ba
--- /dev/null
+++ b/runtimes/core/src/pubsub/mod.rs
@@ -0,0 +1,85 @@
+use std::collections::HashMap;
+use std::fmt::Debug;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+pub use manager::{Manager, SubscriptionObj, TopicObj};
+pub use push_registry::PushHandlerRegistry;
+
+use crate::api::APIResult;
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::runtime::v1 as pb;
+use crate::names::EncoreName;
+use crate::pubsub::manager::SubHandler;
+use crate::{api, model};
+
+mod gcp;
+mod manager;
+mod noop;
+mod nsq;
+mod push_registry;
+mod sqs_sns;
+
+pub type MessageId = String;
+
+pub struct MessageData {
+    pub attrs: HashMap<String, String>,
+    pub raw_body: Vec<u8>,
+}
+
+pub struct Message {
+    pub id: MessageId,
+    pub publish_time: Option<chrono::DateTime<chrono::Utc>>,
+    /// starts at 1
+    pub attempt: u32,
+    pub data: MessageData,
+}
+
+trait Cluster: Debug + Send + Sync {
+    fn topic(&self, cfg: &pb::PubSubTopic, publisher_id: xid::Id) -> Arc<dyn Topic + 'static>;
+    fn subscription(
+        &self,
+        cfg: &pb::PubSubSubscription,
+        meta: &meta::pub_sub_topic::Subscription,
+    ) -> Arc<dyn Subscription + 'static>;
+}
+
+trait Topic: Debug + Send + Sync {
+    fn publish(
+        &self,
+        msg: MessageData,
+        ordering_key: Option<String>,
+    ) -> Pin<Box<dyn Future<Output = anyhow::Result<MessageId>> + Send + '_>>;
+}
+
+trait Subscription: Debug + Send + Sync {
+    fn subscribe(
+        &self,
+        handler: Arc<SubHandler>,
+    ) -> Pin<Box<dyn Future<Output = APIResult<()>> + Send + 'static>>;
+
+    fn push_handler(&self) -> Option<(String, Arc<dyn PushRequestHandler>)> {
+        None
+    }
+}
+
+trait PushRequestHandler: Debug + Sync + Send + 'static {
+    fn handle_push(
+        &self,
+        req: axum::extract::Request,
+    ) -> Pin<Box<dyn Future<Output = axum::response::Response<axum::body::Body>> + Send + 'static>>;
+}
+
+pub trait SubscriptionHandler: Debug + Send + Sync {
+    fn handle_message(
+        &self,
+        msg: Arc<model::Request>,
+    ) -> Pin<Box<dyn Future<Output = Result<(), api::Error>> + Send + '_>>;
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct SubName {
+    pub topic: EncoreName,
+    pub subscription: EncoreName,
+}
diff --git a/runtimes/core/src/pubsub/noop/mod.rs b/runtimes/core/src/pubsub/noop/mod.rs
new file mode 100644
index 0000000000..6be33d0f52
--- /dev/null
+++ b/runtimes/core/src/pubsub/noop/mod.rs
@@ -0,0 +1,54 @@
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+use anyhow::Result;
+
+use crate::api::APIResult;
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::runtime::v1 as pb;
+use crate::pubsub;
+use crate::pubsub::manager::SubHandler;
+
+#[derive(Debug)]
+pub struct NoopCluster;
+
+#[derive(Debug)]
+pub struct NoopTopic;
+#[derive(Debug)]
+pub struct NoopSubscription;
+
+impl pubsub::Cluster for NoopCluster {
+    fn topic(&self, _cfg: &pb::PubSubTopic, _publisher_id: xid::Id) -> Arc<dyn pubsub::Topic> {
+        Arc::new(NoopTopic)
+    }
+
+    fn subscription(
+        &self,
+        _cfg: &pb::PubSubSubscription,
+        _meta: &meta::pub_sub_topic::Subscription,
+    ) -> Arc<dyn pubsub::Subscription> {
+        Arc::new(NoopSubscription)
+    }
+}
+
+impl pubsub::Topic for NoopTopic {
+    fn publish(
+        &self,
+        _: pubsub::MessageData,
+        _: Option<String>,
+    ) -> Pin<Box<dyn Future<Output = Result<pubsub::MessageId>> + Send + '_>> {
+        Box::pin(async {
+            anyhow::bail!("topic not configured");
+        })
+    }
+}
+
+impl pubsub::Subscription for NoopSubscription {
+    fn subscribe(
+        &self,
+        _: Arc<SubHandler>,
+    ) -> Pin<Box<dyn Future<Output = APIResult<()>> + Send + 'static>> {
+        Box::pin(futures::future::pending())
+    }
+}
diff --git a/runtimes/core/src/pubsub/nsq/mod.rs b/runtimes/core/src/pubsub/nsq/mod.rs
new file mode 100644
index 0000000000..4d226df394
--- /dev/null
+++ b/runtimes/core/src/pubsub/nsq/mod.rs
@@ -0,0 +1,40 @@
+use std::sync::Arc;
+
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::runtime::v1 as pb;
+use crate::pubsub;
+use crate::pubsub::nsq::sub::NsqSubscription;
+use crate::pubsub::nsq::topic::NsqTopic;
+
+mod sub;
+mod topic;
+
+#[derive(Debug)]
+pub struct Cluster {
+    /// Address to the NSQ server.
+    address: String,
+}
+
+impl Cluster {
+    pub fn new(address: String) -> Self {
+        Self { address }
+    }
+}
+
+impl pubsub::Cluster for Cluster {
+    fn topic(
+        &self,
+        cfg: &pb::PubSubTopic,
+        _publisher_id: xid::Id,
+    ) -> Arc<dyn pubsub::Topic + 'static> {
+        Arc::new(NsqTopic::new(self.address.clone(), cfg))
+    }
+
+    fn subscription(
+        &self,
+        cfg: &pb::PubSubSubscription,
+        meta: &meta::pub_sub_topic::Subscription,
+    ) -> Arc<dyn pubsub::Subscription + 'static> {
+        Arc::new(NsqSubscription::new(self.address.clone(), cfg, meta))
+    }
+}
diff --git a/runtimes/core/src/pubsub/nsq/sub.rs b/runtimes/core/src/pubsub/nsq/sub.rs
new file mode 100644
index 0000000000..e91b991e38
--- /dev/null
+++ b/runtimes/core/src/pubsub/nsq/sub.rs
@@ -0,0 +1,166 @@
+use std::fmt::Debug;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use tokio_nsq::{
+    NSQChannel, NSQConsumerConfig, NSQConsumerConfigSources, NSQMessage, NSQRequeueDelay, NSQTopic,
+};
+
+use crate::api::APIResult;
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::runtime::v1 as pb;
+use crate::pubsub;
+use crate::pubsub::manager::SubHandler;
+use crate::pubsub::nsq::topic::EncodedMessage;
+use crate::pubsub::Subscription;
+
+pub struct NsqSubscription {
+    addr: String,
+    config: NSQConsumerConfig,
+    max_retries: i64,
+}
+
+impl Debug for NsqSubscription {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("NsqSubscription")
+            .field("addr", &self.addr)
+            .finish()
+    }
+}
+
+impl NsqSubscription {
+    pub(super) fn new(
+        addr: String,
+        cfg: &pb::PubSubSubscription,
+        meta: &meta::pub_sub_topic::Subscription,
+    ) -> Self {
+        let topic = NSQTopic::new(cfg.topic_cloud_name.clone()).unwrap();
+        let channel = NSQChannel::new(cfg.subscription_cloud_name.clone()).unwrap();
+
+        let mut config = NSQConsumerConfig::new(topic, channel)
+            .set_sources(NSQConsumerConfigSources::Daemons(vec![addr.clone()]))
+            .set_max_in_flight(meta.max_concurrency.map_or(100, |v| v as u32));
+
+        // For local development, default to 2 retries if we don't have a retry policy.
+        // We don't want to retry forever but zero retries might cause surprises when suddenly
+        // things start retrying in other environments.
+        let mut max_retries = 2;
+
+        if let Some(retry) = &meta.retry_policy {
+            let min_backoff = Duration::from_nanos(retry.min_backoff.max(0) as u64);
+            config = config.set_base_requeue_interval(clamp(
+                min_backoff,
+                Duration::from_secs(0),
+                Duration::from_secs(60 * 60),
+            ));
+
+            let max_backoff = Duration::from_nanos(retry.max_backoff.max(0) as u64);
+            config = config.set_max_requeue_interval(clamp(
+                max_backoff,
+                Duration::from_secs(0),
+                Duration::from_secs(60 * 60),
+            ));
+            max_retries = retry.max_retries;
+        }
+
+        NsqSubscription {
+            addr,
+            config,
+            max_retries,
+        }
+    }
+}
+
+impl Subscription for NsqSubscription {
+    fn subscribe(
+        &self,
+        handler: Arc<SubHandler>,
+    ) -> Pin<Box<dyn Future<Output = APIResult<()>> + Send + 'static>> {
+        let mut consumer = self.config.clone().build();
+        let max_retries = self.max_retries;
+
+        Box::pin(async move {
+            loop {
+                let Some(msg) = consumer.consume_filtered().await else {
+                    continue;
+                };
+
+                // If the attempt exceeds the max retries, drop it.
+                // Attempt starts at 1 for the first delivery, which means
+                // the retry count is (attempt-1).
+                let retry = msg.attempt as i64 - 1;
+                if retry > max_retries {
+                    msg.finish().await;
+                    continue;
+                }
+
+                // Process the message asynchronously.
+                let h = handler.clone();
+                tokio::spawn(async move { process_message(msg, h).await });
+            }
+        })
+    }
+}
+
+async fn process_message(mut msg: NSQMessage, handler: Arc<SubHandler>) {
+    let body: Vec<u8> = msg.body.drain(..).collect();
+    let result = handle_message(body, msg.timestamp, msg.attempt, handler).await;
+    match result {
+        Ok(()) => msg.finish().await,
+        Err(err) => {
+            log::info!("message handler failed, requeueing message: {:?}", err);
+            msg.requeue(NSQRequeueDelay::DefaultDelay).await;
+        }
+    }
+}
+
+async fn handle_message(
+    body: Vec<u8>,
+    timestamp: u64,
+    attempt: u16,
+    handler: Arc<SubHandler>,
+) -> Result<()> {
+    let encoded =
+        serde_json::from_slice::<EncodedMessage>(&body).context("failed to decode message")?;
+
+    let publish_time = nano_timestamp(timestamp);
+    let raw_body = serde_json::to_vec_pretty(&encoded.body).unwrap_or_default();
+    let pubsub_msg = pubsub::Message {
+        id: encoded.id,
+        publish_time,
+        attempt: attempt as u32,
+        data: pubsub::MessageData {
+            attrs: encoded.attrs,
+            raw_body,
+        },
+    };
+
+    handler
+        .handle_message(pubsub_msg)
+        .await
+        .context("message handler failed")
+}
+
+fn nano_timestamp(mut nsec: u64) -> Option<chrono::DateTime<chrono::Utc>> {
+    // From Go's time.Unix.
+    let mut sec: i64 = 0;
+    if nsec >= 1_000_000_000 {
+        let n = nsec / 1_000_000_000;
+        sec += n as i64;
+        nsec -= n * 1_000_000_000;
+    }
+    chrono::DateTime::from_timestamp(sec, nsec as u32)
+}
+
+fn clamp<T: PartialOrd>(val: T, min: T, max: T) -> T {
+    if val < min {
+        min
+    } else if val > max {
+        max
+    } else {
+        val
+    }
+}
diff --git a/runtimes/core/src/pubsub/nsq/topic.rs b/runtimes/core/src/pubsub/nsq/topic.rs
new file mode 100644
index 0000000000..7ceee79b26
--- /dev/null
+++ b/runtimes/core/src/pubsub/nsq/topic.rs
@@ -0,0 +1,101 @@
+use std::collections::HashMap;
+use std::future::Future;
+use std::pin::Pin;
+
+use anyhow::{Context, Result};
+use serde::{Deserialize, Serialize};
+use tokio::sync::{mpsc, oneshot};
+use tokio_nsq::{NSQEvent, NSQProducerConfig, NSQTopic};
+
+use crate::encore::runtime::v1 as pb;
+use crate::pubsub::{MessageData, MessageId, Topic};
+
+struct PublishRequest {
+    msg: MessageData,
+    resp: oneshot::Sender<Result<MessageId>>,
+}
+
+#[derive(Debug)]
+pub struct NsqTopic {
+    tx: mpsc::Sender<PublishRequest>,
+}
+
+impl NsqTopic {
+    pub(super) fn new(addr: String, cfg: &pb::PubSubTopic) -> Self {
+        let cloud_name = cfg.cloud_name.clone();
+        let (tx, mut rx) = mpsc::channel::<PublishRequest>(32);
+        tokio::spawn(async move {
+            let topic = NSQTopic::new(&cloud_name).unwrap();
+            let mut producer = NSQProducerConfig::new(addr).build();
+
+            // Wait for the producer to send a Ready event.
+            loop {
+                if let Some(NSQEvent::Healthy()) = producer.consume().await {
+                    break;
+                }
+            }
+
+            loop {
+                // Wait for either a publish request or an acknowledgement from the producer.
+                tokio::select! {
+                    req = rx.recv() => {
+                        let Some(req) = req else {
+                            break;
+                        };
+
+                        // Serialize the message body.
+                        let encoded = EncodedMessage::new_for_data(req.msg);
+                        let bytes = serde_json::to_vec(&encoded).expect("unable to serialize request");
+
+                        // TODO handle error
+                        producer
+                            .publish(&topic, bytes)
+                            .await
+                            .expect("failed to publish message");
+
+                        // Ignore error.
+                        _ = req.resp.send(Ok(encoded.id));
+                    }
+                    _ = producer.consume() => {}
+                }
+            }
+        });
+
+        NsqTopic { tx }
+    }
+}
+
+impl Topic for NsqTopic {
+    fn publish(
+        &self,
+        msg: MessageData,
+        _ordering_key: Option<String>,
+    ) -> Pin<Box<dyn Future<Output = Result<MessageId>> + Send + '_>> {
+        let tx = self.tx.clone();
+        Box::pin(async move {
+            let (resp_tx, resp_rx) = oneshot::channel::<Result<MessageId>>();
+            let req = PublishRequest { msg, resp: resp_tx };
+            tx.send(req).await.context("failed to send message")?;
+
+            resp_rx.await.context("failed to receive response")?
+        })
+    }
+}
+
+#[derive(Debug, Serialize, Deserialize)]
+pub(super) struct EncodedMessage {
+    pub id: MessageId,
+    pub attrs: HashMap<String, String>,
+    pub body: Option<serde_json::Value>,
+}
+
+impl EncodedMessage {
+    pub fn new_for_data(msg: MessageData) -> Self {
+        let body = serde_json::from_slice(&msg.raw_body).unwrap_or_default();
+        Self {
+            id: xid::new().to_string(),
+            attrs: msg.attrs,
+            body,
+        }
+    }
+}
diff --git a/runtimes/core/src/pubsub/push_registry.rs b/runtimes/core/src/pubsub/push_registry.rs
new file mode 100644
index 0000000000..0d7d6e063c
--- /dev/null
+++ b/runtimes/core/src/pubsub/push_registry.rs
@@ -0,0 +1,79 @@
+use std::{collections::HashMap, pin::Pin, sync::Arc};
+
+use axum::{extract::Path, RequestExt};
+use futures::Future;
+use std::sync::RwLock;
+
+use crate::api::{self, ToResponse};
+
+use super::PushRequestHandler;
+
+#[derive(Debug, Clone)]
+pub struct PushHandlerRegistry {
+    inner: Arc<Inner>,
+}
+
+impl Default for PushHandlerRegistry {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl PushHandlerRegistry {
+    pub fn new() -> Self {
+        Self {
+            inner: Arc::new(Inner {
+                handlers: Arc::new(RwLock::new(HashMap::new())),
+            }),
+        }
+    }
+}
+
+#[derive(Debug)]
+struct Inner {
+    handlers: Arc<RwLock<HashMap<String, Arc<dyn PushRequestHandler>>>>,
+}
+
+impl PushHandlerRegistry {
+    pub(super) fn register(&self, subscription_id: String, handler: Arc<dyn PushRequestHandler>) {
+        self.inner
+            .handlers
+            .write()
+            .unwrap()
+            .insert(subscription_id, handler);
+    }
+
+    async fn handle(
+        self,
+        mut req: axum::extract::Request,
+    ) -> axum::response::Response<axum::body::Body> {
+        let id: String = match req.extract_parts().await {
+            Ok(Path(id)) => id,
+            Err(e) => {
+                ::log::error!(
+                    "encore pub/sub push handler: unable to extract push id from path: {:?}",
+                    e
+                );
+                return api::Error::internal(e).to_response(None);
+            }
+        };
+
+        ::log::trace!("encore pub/sub push handler: handling push request");
+
+        let handler = self.inner.handlers.read().unwrap().get(&id).cloned();
+
+        match handler {
+            Some(handler) => handler.handle_push(req).await,
+            None => api::Error::not_found("no handler registered for push subscription")
+                .to_response(None),
+        }
+    }
+}
+
+impl axum::handler::Handler<(), ()> for PushHandlerRegistry {
+    type Future = Pin<Box<dyn Future<Output = axum::response::Response<axum::body::Body>> + Send>>;
+
+    fn call(self, req: axum::extract::Request, _state: ()) -> Self::Future {
+        Box::pin(self.handle(req))
+    }
+}
diff --git a/runtimes/core/src/pubsub/sqs_sns/fetcher.rs b/runtimes/core/src/pubsub/sqs_sns/fetcher.rs
new file mode 100644
index 0000000000..31f191cd14
--- /dev/null
+++ b/runtimes/core/src/pubsub/sqs_sns/fetcher.rs
@@ -0,0 +1,96 @@
+use std::fmt::Debug;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+pub trait Fetcher: Clone + Sync + Send {
+    type Item;
+    type Error: Debug;
+
+    #[allow(clippy::type_complexity)]
+    fn fetch(
+        self,
+        max_items: usize,
+    ) -> Pin<Box<dyn Future<Output = Result<Vec<Self::Item>, Self::Error>> + Send + 'static>>;
+    fn process(self, item: Self::Item) -> Pin<Box<dyn Future<Output = ()> + Send + 'static>>;
+}
+
+#[derive(Debug, Clone)]
+pub struct Config {
+    /// The maximum number of items to process at once.
+    pub max_concurrency: usize,
+
+    /// The maximum number of items to fetch at once.
+    pub max_batch_size: usize,
+}
+
+pub async fn process_concurrently<F: Fetcher>(cfg: Config, fetcher: F) {
+    // Semaphore representing work being processed.
+    let sem = Arc::new(tokio::sync::Semaphore::new(cfg.max_concurrency));
+
+    // The effective max batch size is the minimum of the maximum concurrency
+    // and the maximum batch size.
+    let max_batch = cfg.max_concurrency.min(cfg.max_batch_size);
+
+    // Retry policy configuration.
+    let (base_sleep, max_sleep, mut err_sleep) = {
+        use tokio::time::Duration;
+        let base = Duration::from_millis(150);
+        let max = Duration::from_secs(5);
+        (base, max, base)
+    };
+
+    // Fetch work.
+    loop {
+        // How many items shall we fetch?
+        let (to_fetch, permit) = {
+            // Wait for at least one permit.
+            let mut permit = sem.acquire().await.expect("semaphore is closed");
+
+            // Do we have any additional available permits and the max batch size allows for it?
+            let extra = sem.available_permits().min(max_batch - 1);
+            if extra > 0 {
+                // Acquire additional permits. Guaranteed to succeed since we've checked
+                // the available permits, and there's no race since this task is the only one
+                // acquiring permits.
+                let extra_permit = sem
+                    .acquire_many(extra as u32)
+                    .await
+                    .expect("semaphore is closed");
+                permit.merge(extra_permit);
+            }
+            (1 + extra, permit)
+        };
+
+        let fetch_result = fetcher.clone().fetch(to_fetch).await;
+        match fetch_result {
+            Ok(work) => {
+                err_sleep = base_sleep;
+
+                // Process the work. We forget the permit here,
+                // and release individual items back to the semaphore as we process them.
+                let unused_permits = permit.num_permits() - work.len();
+                permit.forget();
+
+                // Add back any permits that were not used, in case we fetched fewer items than the max.
+                if unused_permits > 0 {
+                    sem.add_permits(unused_permits);
+                }
+
+                for item in work {
+                    let fut = fetcher.clone().process(item);
+                    let sem = sem.clone();
+                    tokio::spawn(async move {
+                        fut.await;
+                        sem.add_permits(1);
+                    });
+                }
+            }
+            Err(err) => {
+                log::error!("encore: pub/sub fetch error, retrying: {err:#?}");
+                tokio::time::sleep(err_sleep).await;
+                err_sleep = err_sleep.mul_f32(1.5).min(max_sleep);
+            }
+        }
+    }
+}
diff --git a/runtimes/core/src/pubsub/sqs_sns/mod.rs b/runtimes/core/src/pubsub/sqs_sns/mod.rs
new file mode 100644
index 0000000000..2c91257bdd
--- /dev/null
+++ b/runtimes/core/src/pubsub/sqs_sns/mod.rs
@@ -0,0 +1,93 @@
+use std::sync::Arc;
+
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::runtime::v1 as pb;
+use crate::pubsub;
+use crate::pubsub::sqs_sns::sub::Subscription;
+use crate::pubsub::sqs_sns::topic::Topic;
+
+mod fetcher;
+mod sub;
+mod topic;
+
+#[derive(Debug)]
+pub struct Cluster {
+    /// publisher_id is a unique ID for this Encore app instance, used as the Message Group ID
+    /// for topics which don't specify a grouping field. This is based on [AWS's recommendation]
+    /// that each producer should have a unique message group ID to send all it's messages.
+    ///
+    /// [AWS's recommendation]: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/FIFO-queues-understanding-logic.html
+    _publisher_id: xid::Id,
+
+    client: Arc<LazyClient>,
+}
+
+impl Cluster {
+    pub fn new() -> Self {
+        let publisher_id = xid::new();
+        let client = Arc::new(LazyClient::new());
+        Self {
+            _publisher_id: publisher_id,
+            client,
+        }
+    }
+}
+
+impl pubsub::Cluster for Cluster {
+    fn topic(
+        &self,
+        cfg: &pb::PubSubTopic,
+        publisher_id: xid::Id,
+    ) -> Arc<dyn pubsub::Topic + 'static> {
+        Arc::new(Topic::new(self.client.clone(), cfg, publisher_id))
+    }
+
+    fn subscription(
+        &self,
+        cfg: &pb::PubSubSubscription,
+        meta: &meta::pub_sub_topic::Subscription,
+    ) -> Arc<dyn pubsub::Subscription + 'static> {
+        Arc::new(Subscription::new(self.client.clone(), cfg, meta))
+    }
+}
+
+#[derive(Debug)]
+struct LazyClient {
+    sns_cell: tokio::sync::OnceCell<aws_sdk_sns::Client>,
+    sqs_cell: tokio::sync::OnceCell<aws_sdk_sqs::Client>,
+}
+
+impl LazyClient {
+    fn new() -> Self {
+        Self {
+            sns_cell: tokio::sync::OnceCell::new(),
+            sqs_cell: tokio::sync::OnceCell::new(),
+        }
+    }
+
+    async fn config(&self) -> aws_config::SdkConfig {
+        let provider = aws_config::meta::region::RegionProviderChain::default_provider();
+        aws_config::defaults(aws_config::BehaviorVersion::latest())
+            .region(provider)
+            .load()
+            .await
+    }
+
+    async fn get_sns(&self) -> &aws_sdk_sns::Client {
+        self.sns_cell
+            .get_or_init(|| async {
+                let cfg = self.config().await;
+                aws_sdk_sns::Client::new(&cfg)
+            })
+            .await
+    }
+
+    async fn get_sqs(&self) -> &aws_sdk_sqs::Client {
+        self.sqs_cell
+            .get_or_init(|| async {
+                let cfg = self.config().await;
+                aws_sdk_sqs::Client::new(&cfg)
+            })
+            .await
+    }
+}
diff --git a/runtimes/core/src/pubsub/sqs_sns/sub.rs b/runtimes/core/src/pubsub/sqs_sns/sub.rs
new file mode 100644
index 0000000000..c345ef3149
--- /dev/null
+++ b/runtimes/core/src/pubsub/sqs_sns/sub.rs
@@ -0,0 +1,333 @@
+use std::collections::HashMap;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+use std::time::Duration;
+
+use anyhow::{Context, Result};
+use aws_sdk_sqs::types::MessageSystemAttributeName;
+use serde::Deserialize;
+use tokio_retry::strategy::ExponentialBackoff;
+use tokio_retry::{Action, Retry};
+
+use crate::api::APIResult;
+use crate::encore::parser::meta::v1 as meta;
+use crate::encore::runtime::v1 as pb;
+use crate::names::CloudName;
+use crate::pubsub::manager::SubHandler;
+use crate::pubsub::sqs_sns::{fetcher, LazyClient};
+use crate::pubsub::{self};
+
+#[derive(Debug)]
+pub struct Subscription {
+    client: Arc<LazyClient>,
+    cloud_name: CloudName,
+    ack_deadline: Duration,
+    fetcher_cfg: fetcher::Config,
+    requeue_policy: ExponentialBackoff,
+}
+
+impl Subscription {
+    pub(super) fn new(
+        client: Arc<LazyClient>,
+        cfg: &pb::PubSubSubscription,
+        meta: &meta::pub_sub_topic::Subscription,
+    ) -> Self {
+        let mut requeue_policy = ExponentialBackoff::from_millis(
+            meta.retry_policy
+                .as_ref()
+                .map(|retry| retry.min_backoff / 1_000_000)
+                .unwrap_or(1000) as u64,
+        )
+        .factor(2);
+
+        if let Some(retry) = &meta.retry_policy {
+            requeue_policy =
+                requeue_policy.max_delay(Duration::from_nanos(retry.max_backoff as u64));
+        }
+
+        let fetcher_cfg = fetcher::Config {
+            max_concurrency: meta.max_concurrency.unwrap_or(100) as usize,
+            max_batch_size: 10, // AWS SQS max batch size
+        };
+
+        // Clamp the ack deadline to between [1s, 12h].
+        let ack_deadline = Duration::from_nanos(
+            meta.ack_deadline
+                .clamp(1_000_000_000, 12 * 3600 * 1_000_000_000) as u64,
+        );
+
+        Self {
+            client,
+            cloud_name: cfg.subscription_cloud_name.clone().into(),
+            ack_deadline,
+            fetcher_cfg,
+            requeue_policy,
+        }
+    }
+}
+
+impl pubsub::Subscription for Subscription {
+    fn subscribe(
+        &self,
+        handler: Arc<SubHandler>,
+    ) -> Pin<Box<dyn Future<Output = APIResult<()>> + Send + 'static>> {
+        let client = self.client.clone();
+        let cloud_name = self.cloud_name.clone();
+        let ack_deadline = self.ack_deadline;
+        let requeue_policy = self.requeue_policy.clone();
+        let fetcher_cfg = self.fetcher_cfg.clone();
+
+        Box::pin(async move {
+            let client = client.get_sqs().await.clone();
+
+            let sqs_fetcher = Arc::new(SqsFetcher {
+                handler,
+                client,
+                queue_url: cloud_name.into(),
+                ack_deadline,
+                requeue_policy,
+            });
+            fetcher::process_concurrently(fetcher_cfg.clone(), sqs_fetcher).await;
+
+            Ok(())
+        })
+    }
+}
+
+struct SqsFetcher {
+    client: aws_sdk_sqs::Client,
+    queue_url: String,
+    ack_deadline: Duration,
+    requeue_policy: ExponentialBackoff,
+    handler: Arc<SubHandler>,
+}
+
+impl fetcher::Fetcher for Arc<SqsFetcher> {
+    type Item = aws_sdk_sqs::types::Message;
+    type Error = anyhow::Error;
+
+    fn fetch(
+        self,
+        max_items: usize,
+    ) -> Pin<
+        Box<
+            dyn Future<Output = std::result::Result<Vec<Self::Item>, Self::Error>> + Send + 'static,
+        >,
+    > {
+        let client = self.client.clone();
+        let queue_url = self.queue_url.clone();
+        let ack_deadline = self.ack_deadline;
+
+        Box::pin(async move {
+            let result = client
+                .receive_message()
+                .queue_url(queue_url)
+                .message_system_attribute_names(MessageSystemAttributeName::ApproximateReceiveCount)
+                .visibility_timeout(ack_deadline.as_secs() as i32)
+                .wait_time_seconds(20) // maximum allowed time
+                .max_number_of_messages(max_items as i32)
+                .send()
+                .await;
+            result
+                .map(|res| res.messages.unwrap_or_default())
+                .context("unable to receive messages")
+        })
+    }
+
+    fn process(self, item: Self::Item) -> Pin<Box<dyn Future<Output = ()> + Send + 'static>> {
+        Box::pin(async move {
+            let receipt_handle = item.receipt_handle.clone().expect("missing receipt handle");
+            let attempt = parse_attempt(&item);
+
+            let result = match parse_message(item, attempt) {
+                Ok(msg) => self
+                    .handler
+                    .handle_message(msg)
+                    .await
+                    .map_err(|err| err.into()),
+                Err(err) => {
+                    log::error!(
+                        "encore: internal error: failed to parse message from SQS: {:#?}",
+                        err
+                    );
+                    Err(err)
+                }
+            };
+
+            match result {
+                Ok(()) => {
+                    let delete_action = DeleteMessageAction {
+                        fetcher: self.clone(),
+                        receipt_handle,
+                    };
+
+                    // Retry deleting a few times.
+                    // If we can't delete the message, it'll be redelivered. Not much we can do.
+                    let retry = ExponentialBackoff::from_millis(100).factor(2).take(5);
+                    if let Err(err) = Retry::spawn(retry, delete_action).await {
+                        log::error!(
+                            "encore: internal error: failed to delete aws pub/sub message: {}",
+                            err
+                        );
+                    }
+                }
+                Err(_) => {
+                    // Determine the requeue delay.
+                    let requeue_delay = self
+                        .requeue_policy
+                        .clone()
+                        .nth((attempt.max(1) - 1) as usize)
+                        .unwrap_or(Duration::from_secs(1));
+
+                    let requeue_action = RequeueMessageAction {
+                        fetcher: self.clone(),
+                        receipt_handle,
+                        visibility_timeout: requeue_delay,
+                    };
+
+                    // Retry requeuing a few times.
+                    let retry = ExponentialBackoff::from_millis(100).factor(2).take(5);
+                    if let Err(err) = Retry::spawn(retry, requeue_action).await {
+                        log::error!(
+                            "encore: internal error: failed to requeue aws pub/sub message: {}",
+                            err
+                        );
+                    }
+                }
+            }
+        })
+    }
+}
+
+struct RequeueMessageAction {
+    fetcher: Arc<SqsFetcher>,
+    receipt_handle: String,
+    visibility_timeout: Duration,
+}
+
+impl Action for RequeueMessageAction {
+    type Future = Pin<Box<dyn Future<Output = Result<()>> + Send>>;
+    type Item = ();
+    type Error = anyhow::Error;
+
+    fn run(&mut self) -> Self::Future {
+        let fetcher = self.fetcher.clone();
+        let receipt_handle = self.receipt_handle.clone();
+        let visibility_timeout = self.visibility_timeout;
+
+        Box::pin(async move {
+            fetcher
+                .client
+                .change_message_visibility()
+                .queue_url(fetcher.queue_url.clone())
+                .receipt_handle(receipt_handle)
+                .visibility_timeout(visibility_timeout.as_secs() as i32)
+                .send()
+                .await
+                .map(|_| ())
+                .context("unable to requeue message")
+        })
+    }
+}
+
+struct DeleteMessageAction {
+    fetcher: Arc<SqsFetcher>,
+    receipt_handle: String,
+}
+
+impl Action for DeleteMessageAction {
+    type Future = Pin<Box<dyn Future<Output = Result<()>> + Send>>;
+    type Item = ();
+    type Error = anyhow::Error;
+
+    fn run(&mut self) -> Self::Future {
+        let fetcher = self.fetcher.clone();
+        let receipt_handle = self.receipt_handle.clone();
+
+        Box::pin(async move {
+            fetcher
+                .client
+                .delete_message()
+                .queue_url(fetcher.queue_url.clone())
+                .receipt_handle(receipt_handle)
+                .send()
+                .await
+                .map(|_| ())
+                .context("unable to delete message")
+        })
+    }
+}
+
+fn parse_attempt(message: &aws_sdk_sqs::types::Message) -> u32 {
+    message
+        .attributes
+        .as_ref()
+        .and_then(|attrs| attrs.get(&MessageSystemAttributeName::ApproximateReceiveCount))
+        .and_then(|s| s.parse::<u32>().ok())
+        .unwrap_or(1)
+}
+
+fn parse_message(message: aws_sdk_sqs::types::Message, attempt: u32) -> Result<pubsub::Message> {
+    // We currently have to clone the message data because we can't move it out of the
+    // ReceivedMessage as we need to call ack/nack afterwards.
+    let sns_message: SNSMessageWrapper =
+        serde_json::from_str(message.body.as_deref().unwrap_or_default())
+            .context("failed to decode SNS message body")?;
+
+    let publish_time = chrono::DateTime::parse_from_rfc3339(&sns_message.timestamp)
+        .context("failed to parse publish timestamp")?
+        .with_timezone(&chrono::Utc);
+
+    let attrs = sns_message
+        .message_attributes
+        .into_iter()
+        .filter_map(|(k, v)| {
+            if v.r#type == "String" {
+                Some((k, v.value))
+            } else {
+                None
+            }
+        })
+        .collect::<HashMap<_, _>>();
+
+    let raw_body = sns_message.message.as_bytes().to_vec();
+    Ok(pubsub::Message {
+        id: sns_message.message_id,
+        publish_time: Some(publish_time),
+        attempt,
+        data: pubsub::MessageData { attrs, raw_body },
+    })
+}
+
+/// SNSMessageWrapper matches the JSON that is sent to SQS from an SNS subscription
+#[derive(Debug, Deserialize)]
+#[allow(dead_code)]
+struct SNSMessageWrapper {
+    #[serde(rename = "Type")]
+    r#type: String,
+    #[serde(rename = "MessageId")]
+    message_id: String,
+    #[serde(rename = "TopicArn")]
+    topic_arn: String,
+    #[serde(rename = "Message")]
+    message: String,
+    #[serde(rename = "Timestamp")]
+    timestamp: String,
+    #[serde(rename = "SignatureVersion", default)]
+    signature_version: String,
+    #[serde(rename = "SigningCertURL", default)]
+    signing_cert_url: String,
+    #[serde(rename = "UnsubscribeURL")]
+    unsubscribe_url: String,
+    #[serde(rename = "MessageAttributes")]
+    message_attributes: HashMap<String, MessageAttribute>,
+}
+
+#[derive(Debug, Deserialize)]
+struct MessageAttribute {
+    #[serde(rename = "Type")]
+    r#type: String,
+    #[serde(rename = "Value")]
+    value: String,
+}
diff --git a/runtimes/core/src/pubsub/sqs_sns/topic.rs b/runtimes/core/src/pubsub/sqs_sns/topic.rs
new file mode 100644
index 0000000000..abeb156e73
--- /dev/null
+++ b/runtimes/core/src/pubsub/sqs_sns/topic.rs
@@ -0,0 +1,83 @@
+use std::collections::HashMap;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+use anyhow::{Context, Result};
+
+use crate::encore::runtime::v1 as pb;
+use crate::encore::runtime::v1::pub_sub_topic::DeliveryGuarantee;
+use crate::names::CloudName;
+use crate::pubsub::sqs_sns::LazyClient;
+use crate::pubsub::{self, MessageData, MessageId};
+
+#[derive(Debug)]
+pub struct Topic {
+    client: Arc<LazyClient>,
+    cloud_name: CloudName,
+    delivery_guarantee: DeliveryGuarantee,
+    publisher_id: xid::Id,
+}
+
+impl Topic {
+    pub(super) fn new(
+        client: Arc<LazyClient>,
+        cfg: &pb::PubSubTopic,
+        publisher_id: xid::Id,
+    ) -> Self {
+        Self {
+            client,
+            cloud_name: cfg.cloud_name.clone().into(),
+            delivery_guarantee: cfg.delivery_guarantee(),
+            publisher_id,
+        }
+    }
+}
+
+impl pubsub::Topic for Topic {
+    fn publish(
+        &self,
+        msg: MessageData,
+        ordering_key: Option<String>,
+    ) -> Pin<Box<dyn Future<Output = Result<MessageId>> + Send + '_>> {
+        Box::pin(async move {
+            // The raw body is JSON, so it's valid UTF8.
+            let data =
+                String::from_utf8(msg.raw_body).context("failed to serialize message body")?;
+
+            let attrs: Result<HashMap<String, aws_sdk_sns::types::MessageAttributeValue>, _> = msg
+                .attrs
+                .into_iter()
+                .map(|(k, v)| {
+                    aws_sdk_sns::types::MessageAttributeValue::builder()
+                        .data_type("String".to_string())
+                        .string_value(v)
+                        .build()
+                        .map(|val| (k, val))
+                })
+                .collect();
+            let attrs = attrs.context("failed to build message attributes")?;
+
+            let client = self.client.get_sns().await;
+            let mut params = client
+                .publish()
+                .topic_arn(self.cloud_name.to_string())
+                .message(data);
+
+            if let Some(ordering_key) = ordering_key {
+                params = params.message_group_id(ordering_key);
+                params = params.message_deduplication_id(format!("msg_{}", xid::new()));
+            } else if self.delivery_guarantee == DeliveryGuarantee::ExactlyOnce {
+                params = params.message_group_id(format!("inst_{}", self.publisher_id));
+                params = params.message_deduplication_id(format!("msg_{}", xid::new()));
+            }
+
+            let result = params.set_message_attributes(Some(attrs)).send().await;
+
+            match result {
+                Ok(id) => Ok(id.message_id.unwrap_or("".to_string()) as MessageId),
+                Err(e) => Err(e.into()),
+            }
+        })
+    }
+}
diff --git a/runtimes/core/src/secrets/mod.rs b/runtimes/core/src/secrets/mod.rs
new file mode 100644
index 0000000000..0cb02c2def
--- /dev/null
+++ b/runtimes/core/src/secrets/mod.rs
@@ -0,0 +1,267 @@
+use std::collections::HashMap;
+use std::fmt::Display;
+use std::sync::{Arc, OnceLock};
+
+use base64::{engine::general_purpose, Engine as _};
+
+use crate::encore::runtime::v1 as pb;
+use encore::runtime::v1::secret_data::{Source, SubPath};
+use encore::runtime::v1::SecretData;
+
+use crate::encore;
+use crate::encore::runtime::v1::secret_data::Encoding;
+use crate::names::EncoreName;
+
+pub struct Manager {
+    app_secrets: HashMap<EncoreName, Arc<Secret>>,
+}
+
+impl Manager {
+    pub fn new(app_secrets: Vec<pb::AppSecret>) -> Self {
+        let app_secrets = app_secrets
+            .into_iter()
+            .filter_map(|s| match s.data {
+                Some(data) => Some((s.encore_name.into(), Arc::new(Secret::new(data)))),
+                None => None,
+            })
+            .collect();
+        Self { app_secrets }
+    }
+
+    pub fn load(&self, data: SecretData) -> Secret {
+        Secret::new(data)
+    }
+
+    /// Retrieve the secret for the given encore name.
+    /// If the secret is not found, returns None.
+    pub fn app_secret(&self, name: EncoreName) -> Option<Arc<Secret>> {
+        self.app_secrets.get(&name).cloned()
+    }
+}
+
+pub struct Secret {
+    data: SecretData,
+    resolved: OnceLock<ResolveResult<Vec<u8>>>,
+}
+
+impl Secret {
+    fn new(data: SecretData) -> Self {
+        Self {
+            data,
+            resolved: OnceLock::new(),
+        }
+    }
+
+    pub fn new_for_test(plaintext: &'static str) -> Self {
+        Self::new(SecretData {
+            source: Some(Source::Embedded(plaintext.as_bytes().to_vec())),
+            sub_path: None,
+            encoding: Encoding::None as i32,
+        })
+    }
+
+    pub fn get(&self) -> Result<&[u8], ResolveError> {
+        let result = self.resolved.get_or_init(|| resolve(&self.data)).as_deref();
+        match result {
+            Ok(bytes) => Ok(bytes),
+            Err(err) => Err(*err),
+        }
+    }
+}
+
+const BASE64: general_purpose::GeneralPurpose = general_purpose::STANDARD;
+
+#[derive(Debug, Copy, Clone)]
+pub enum ResolveError {
+    EnvVarNotFound,
+    JsonKeyNotFound,
+    JsonValueNotString,
+    InvalidBase64,
+    InvalidJSON,
+    InvalidJSONValue,
+    InvalidSecretSource,
+    UnknownEncoding,
+}
+
+impl std::error::Error for ResolveError {}
+
+impl Display for ResolveError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            ResolveError::EnvVarNotFound => write!(f, "environment variable not found"),
+            ResolveError::JsonKeyNotFound => write!(f, "JSON key not found"),
+            ResolveError::JsonValueNotString => write!(f, "JSON value is not a string"),
+            ResolveError::InvalidBase64 => write!(f, "invalid base64"),
+            ResolveError::InvalidJSON => write!(f, "invalid JSON"),
+            ResolveError::InvalidJSONValue => write!(f, "invalid JSON value encoding"),
+            ResolveError::InvalidSecretSource => write!(f, "invalid secret source"),
+            ResolveError::UnknownEncoding => write!(f, "unknown encoding"),
+        }
+    }
+}
+
+type ResolveResult<T> = Result<T, ResolveError>;
+
+fn resolve(data: &SecretData) -> ResolveResult<Vec<u8>> {
+    let value = match &data.source {
+        Some(Source::Embedded(data)) => data.clone(),
+        Some(Source::Env(name)) => {
+            let value = std::env::var(name).map_err(|_| ResolveError::EnvVarNotFound)?;
+            value.into_bytes()
+        }
+        None => Err(ResolveError::InvalidSecretSource)?,
+    };
+
+    // Shall we decode this?
+    let encoding = Encoding::try_from(data.encoding).map_err(|_| ResolveError::UnknownEncoding)?;
+    let value = match encoding {
+        Encoding::None => value,
+        Encoding::Base64 => BASE64
+            .decode(&value)
+            .map_err(|_| ResolveError::InvalidBase64)?,
+    };
+
+    // Is there a subpath?
+    match &data.sub_path {
+        None => Ok(value),
+
+        Some(SubPath::JsonKey(json_key)) => {
+            // Escape the JSON key since we use gjson.
+            let json_key = escape_gjson_key(json_key);
+
+            let str_value = std::str::from_utf8(&value).map_err(|_| ResolveError::InvalidJSON)?;
+            let value = gjson::get(str_value, &json_key);
+            match value.kind() {
+                gjson::Kind::String => {
+                    // Use the string as-is.
+                    Ok(value.str().as_bytes().to_vec())
+                }
+
+                gjson::Kind::Object => {
+                    // Iterate over the keys to find the first "bytes" or "string" key.
+                    let mut result: Option<ResolveResult<Vec<u8>>> = None;
+                    let iter = |key: gjson::Value, value: gjson::Value| {
+                        match key.str() {
+                            "bytes" => {
+                                // Decode the bytes from base64.
+                                let res = BASE64
+                                    .decode(value.str())
+                                    .map_err(|_| ResolveError::InvalidBase64);
+                                result = Some(res);
+                            }
+                            "string" => {
+                                // Use the string as-is.
+                                result = Some(Ok(value.str().as_bytes().to_vec()));
+                            }
+                            _ => {}
+                        }
+                        result.is_some()
+                    };
+                    value.each(iter);
+                    result.unwrap_or(Err(ResolveError::InvalidJSONValue))
+                }
+
+                gjson::Kind::Null => Err(ResolveError::JsonKeyNotFound),
+                _ => Err(ResolveError::JsonValueNotString),
+            }
+        }
+    }
+}
+
+fn escape_gjson_key(key: &str) -> String {
+    fn is_safe_path_key_char(c: char) -> bool {
+        c.is_ascii_lowercase()
+            || c.is_ascii_uppercase()
+            || c.is_ascii_digit()
+            || c <= ' '
+            || c > '~'
+            || c == '_'
+            || c == '-'
+            || c == ':'
+    }
+
+    let mut escaped = String::with_capacity(key.len());
+    for c in key.chars() {
+        if is_safe_path_key_char(c) {
+            escaped.push(c);
+        } else {
+            escaped.push('\\');
+            escaped.push(c);
+        }
+    }
+    escaped
+}
+
+#[cfg(test)]
+mod tests {
+    use assert_matches::assert_matches;
+
+    #[test]
+    fn test_resolve() {
+        use super::*;
+        use encore::runtime::v1::{secret_data::Source, SecretData};
+
+        let secret = Secret::new(SecretData {
+            source: Some(Source::Embedded(b"hello".to_vec())),
+            sub_path: None,
+            encoding: Encoding::None as i32,
+        });
+        assert_eq!(secret.get().unwrap(), b"hello");
+
+        let secret = Secret::new(SecretData {
+            source: Some(Source::Embedded(b"aGVsbG8=".to_vec())),
+            sub_path: None,
+            encoding: Encoding::Base64 as i32,
+        });
+        assert_eq!(secret.get().unwrap(), b"hello");
+
+        let secret = Secret::new(SecretData {
+            source: Some(Source::Embedded(b"aGVsbG8=".to_vec())),
+            sub_path: None,
+            encoding: Encoding::None as i32,
+        });
+        assert_eq!(secret.get().unwrap(), b"aGVsbG8=");
+
+        {
+            let data = SecretData {
+                source: Some(Source::Env("TEST_SECRET".to_string())),
+                sub_path: None,
+                encoding: Encoding::None as i32,
+            };
+            let secret = Secret::new(data.clone());
+            assert_matches!(secret.get(), Err(ResolveError::EnvVarNotFound));
+
+            std::env::set_var("TEST_SECRET", "hello");
+            let secret = Secret::new(data);
+            assert_eq!(secret.get().unwrap(), b"hello");
+        }
+
+        // Test json_key.
+        {
+            let secret = Secret::new(SecretData {
+                source: Some(Source::Embedded(br#"{"foo": "hello"}"#.to_vec())),
+                sub_path: Some(SubPath::JsonKey("foo".to_string())),
+                encoding: Encoding::None as i32,
+            });
+            assert_eq!(secret.get().unwrap(), b"hello");
+
+            let secret = Secret::new(SecretData {
+                source: Some(Source::Embedded(
+                    br#"{"foo": {"bytes": "aGVsbG8="}}"#.to_vec(),
+                )),
+                sub_path: Some(SubPath::JsonKey("bar".to_string())),
+                encoding: Encoding::None as i32,
+            });
+            assert_matches!(secret.get(), Err(ResolveError::JsonKeyNotFound));
+
+            let secret = Secret::new(SecretData {
+                source: Some(Source::Embedded(
+                    br#"{"foo": {"bytes": "aGVsbG8="}}"#.to_vec(),
+                )),
+                sub_path: Some(SubPath::JsonKey("foo".to_string())),
+                encoding: Encoding::None as i32,
+            });
+            assert_matches!(secret.get().unwrap(), b"hello");
+        }
+    }
+}
diff --git a/runtimes/core/src/sqldb/client.rs b/runtimes/core/src/sqldb/client.rs
new file mode 100644
index 0000000000..c2a123f426
--- /dev/null
+++ b/runtimes/core/src/sqldb/client.rs
@@ -0,0 +1,280 @@
+use std::collections::HashMap;
+use std::future::Future;
+use std::pin::Pin;
+
+use bb8::{ErrorSink, PooledConnection, RunError};
+use bb8_postgres::PostgresConnectionManager;
+use futures_util::StreamExt;
+
+use tokio_postgres::types::BorrowToSql;
+
+use crate::sqldb::val::RowValue;
+use crate::trace::{protocol, Tracer};
+use crate::{model, sqldb};
+
+use super::transaction::Transaction;
+
+type Mgr = PostgresConnectionManager<postgres_native_tls::MakeTlsConnector>;
+
+pub struct Pool {
+    pool: bb8::Pool<Mgr>,
+    tracer: QueryTracer,
+}
+
+impl Pool {
+    pub fn new<DB: sqldb::Database>(db: &DB, tracer: Tracer) -> anyhow::Result<Self> {
+        let tls = db.tls()?.clone();
+        let mgr = Mgr::new(db.config()?.clone(), tls);
+
+        let pool_cfg = db.pool_config()?;
+        let mut pool = bb8::Pool::builder()
+            .error_sink(Box::new(RustLoggerSink {
+                db_name: db.name().to_string(),
+            }))
+            .max_size(if pool_cfg.max_conns > 0 {
+                pool_cfg.max_conns
+            } else {
+                30
+            });
+
+        if pool_cfg.min_conns > 0 {
+            pool = pool.min_idle(Some(pool_cfg.min_conns));
+        }
+
+        let pool = pool.build_unchecked(mgr);
+        Ok(Self {
+            pool,
+            tracer: QueryTracer(tracer),
+        })
+    }
+}
+
+#[derive(Debug, Clone)]
+struct RustLoggerSink {
+    db_name: String,
+}
+
+impl ErrorSink<tokio_postgres::Error> for RustLoggerSink {
+    fn sink(&self, err: tokio_postgres::Error) {
+        log::error!(
+            "database {}: connection pool error: {:?}",
+            self.db_name,
+            err
+        );
+    }
+
+    fn boxed_clone(&self) -> Box<dyn ErrorSink<tokio_postgres::Error>> {
+        Box::new(self.clone())
+    }
+}
+
+impl Pool {
+    pub async fn query_raw<P, I>(
+        &self,
+        query: &str,
+        params: I,
+        source: Option<&model::Request>,
+    ) -> Result<Cursor, Error>
+    where
+        P: BorrowToSql,
+        I: IntoIterator<Item = P>,
+        I::IntoIter: ExactSizeIterator,
+    {
+        self.tracer
+            .trace(source, query, || async {
+                let conn = self.pool.get().await.map_err(|e| match e {
+                    RunError::User(err) => Error::DB(err),
+                    RunError::TimedOut => Error::ConnectTimeout,
+                })?;
+                conn.query_raw(query, params).await.map_err(Error::from)
+            })
+            .await
+    }
+
+    pub async fn acquire(&self) -> Result<Connection, tokio_postgres::Error> {
+        let conn = self.pool.get_owned().await.map_err(|e| match e {
+            RunError::User(err) => err,
+            RunError::TimedOut => tokio_postgres::Error::__private_api_timeout(),
+        })?;
+        Ok(Connection {
+            conn: tokio::sync::RwLock::new(Some(conn)),
+            tracer: self.tracer.clone(),
+        })
+    }
+
+    pub async fn begin(&self, source: Option<&model::Request>) -> Result<Transaction, Error> {
+        let conn = self.pool.get_owned().await.map_err(|e| match e {
+            RunError::User(err) => err,
+            RunError::TimedOut => tokio_postgres::Error::__private_api_timeout(),
+        })?;
+        Transaction::begin(conn, self.tracer.clone(), source).await
+    }
+}
+
+pub struct Cursor {
+    stream: Pin<Box<tokio_postgres::RowStream>>,
+}
+
+impl Cursor {
+    pub async fn next(&mut self) -> Option<Result<Row, tokio_postgres::Error>> {
+        match self.stream.next().await {
+            Some(Ok(row)) => Some(Ok(Row { row })),
+            Some(Err(err)) => Some(Err(err)),
+            None => None,
+        }
+    }
+}
+
+pub struct Row {
+    row: tokio_postgres::Row,
+}
+
+impl Row {
+    pub fn values(&self) -> anyhow::Result<HashMap<String, RowValue>> {
+        let cols = self.row.columns();
+        let mut map = HashMap::with_capacity(cols.len());
+        for (i, col) in cols.iter().enumerate() {
+            let name = col.name().to_string();
+            let value: RowValue = self
+                .row
+                .try_get(i)
+                .map_err(|e| anyhow::anyhow!("unable to parse column {}: {:#?}", name, e))?;
+            map.insert(name, value);
+        }
+        Ok(map)
+    }
+}
+
+pub(crate) type PooledConn =
+    PooledConnection<'static, PostgresConnectionManager<postgres_native_tls::MakeTlsConnector>>;
+
+pub struct Connection {
+    conn: tokio::sync::RwLock<Option<PooledConn>>,
+    tracer: QueryTracer,
+}
+
+impl Connection {
+    pub async fn close(&self) {
+        let mut guard = self.conn.write().await;
+        if let Some(conn) = guard.take() {
+            drop(conn);
+        }
+    }
+
+    pub async fn query_raw<P, I>(
+        &self,
+        query: &str,
+        params: I,
+        source: Option<&model::Request>,
+    ) -> Result<Cursor, Error>
+    where
+        P: BorrowToSql,
+        I: IntoIterator<Item = P>,
+        I::IntoIter: ExactSizeIterator,
+    {
+        self.tracer
+            .trace(source, query, || async {
+                let guard = self.conn.read().await;
+                let Some(conn) = guard.as_ref() else {
+                    return Err(Error::Closed);
+                };
+                conn.query_raw(query, params).await.map_err(Error::from)
+            })
+            .await
+    }
+}
+
+#[derive(Debug)]
+pub enum Error {
+    DB(tokio_postgres::Error),
+    Closed,
+    ConnectTimeout,
+}
+
+impl std::fmt::Display for Error {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Error::DB(err) => <tokio_postgres::Error as std::fmt::Display>::fmt(err, f),
+            Error::Closed => f.write_str("connection_closed"),
+            Error::ConnectTimeout => f.write_str("timeout establishing connection"),
+        }
+    }
+}
+
+impl From<tokio_postgres::Error> for Error {
+    fn from(err: tokio_postgres::Error) -> Self {
+        Error::DB(err)
+    }
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct QueryTracer(Tracer);
+
+impl QueryTracer {
+    pub(crate) async fn trace<F, Fut>(
+        &self,
+        source: Option<&model::Request>,
+        query: &str,
+        exec: F,
+    ) -> Result<Cursor, Error>
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = Result<tokio_postgres::RowStream, Error>>,
+    {
+        let start_id = if let Some(source) = source {
+            let id = self
+                .0
+                .db_query_start(protocol::DBQueryStartData { source, query });
+            Some(id)
+        } else {
+            None
+        };
+
+        let result = exec().await;
+
+        if let Some(start_id) = start_id {
+            self.0.db_query_end(protocol::DBQueryEndData {
+                start_id,
+                source: source.unwrap(),
+                error: result.as_ref().err(),
+            });
+        }
+
+        let stream = result?;
+        Ok(Cursor {
+            stream: Box::pin(stream),
+        })
+    }
+
+    pub(crate) async fn trace_batch_execute<F, Fut>(
+        &self,
+        source: Option<&model::Request>,
+        query: &str,
+        exec: F,
+    ) -> Result<(), Error>
+    where
+        F: FnOnce() -> Fut,
+        Fut: Future<Output = Result<(), Error>>,
+    {
+        let start_id = if let Some(source) = source {
+            let id = self
+                .0
+                .db_query_start(protocol::DBQueryStartData { source, query });
+            Some(id)
+        } else {
+            None
+        };
+
+        let result = exec().await;
+
+        if let Some(start_id) = start_id {
+            self.0.db_query_end(protocol::DBQueryEndData {
+                start_id,
+                source: source.unwrap(),
+                error: result.as_ref().err(),
+            });
+        }
+
+        result
+    }
+}
diff --git a/runtimes/core/src/sqldb/manager.rs b/runtimes/core/src/sqldb/manager.rs
new file mode 100644
index 0000000000..6409770fad
--- /dev/null
+++ b/runtimes/core/src/sqldb/manager.rs
@@ -0,0 +1,404 @@
+use anyhow::Context;
+use std::borrow::Cow;
+use std::collections::HashMap;
+use std::sync::{Arc, Mutex};
+use tokio_postgres::proxy;
+
+use tokio_postgres::proxy::{AcceptConn, AuthMethod, ClientBouncer, RejectConn};
+
+use crate::encore::runtime::v1 as pb;
+use crate::names::EncoreName;
+use crate::secrets;
+use crate::sqldb::Pool;
+use crate::trace::Tracer;
+
+pub struct Manager {
+    databases: Arc<HashMap<EncoreName, Arc<DatabaseImpl>>>,
+    proxy_port: u16,
+    listener: Mutex<Option<std::net::TcpListener>>,
+    runtime: tokio::runtime::Handle,
+}
+
+pub struct ManagerConfig<'a> {
+    pub clusters: Vec<pb::SqlCluster>,
+    pub creds: &'a pb::infrastructure::Credentials,
+    pub secrets: &'a secrets::Manager,
+    pub tracer: Tracer,
+    pub runtime: tokio::runtime::Handle,
+}
+
+impl ManagerConfig<'_> {
+    pub fn build(self) -> anyhow::Result<Manager> {
+        // Start listening so we can tell which port it is when we generate configuration.
+        let listener =
+            std::net::TcpListener::bind("127.0.0.1:0").context("unable to bind to sqldb port")?;
+        let proxy_port = listener
+            .local_addr()
+            .context("unable to get local address")?
+            .port();
+
+        let databases = databases_from_cfg(
+            self.clusters,
+            self.creds,
+            self.secrets,
+            proxy_port,
+            self.tracer,
+        )
+        .context("failed to parse SQL clusters")?;
+        let databases = Arc::new(databases);
+
+        Ok(Manager {
+            databases,
+            proxy_port,
+            runtime: self.runtime,
+            listener: Mutex::new(Some(listener)),
+        })
+    }
+}
+
+impl Manager {
+    pub fn database(&self, name: &EncoreName) -> Arc<dyn Database> {
+        match self.databases.get(name) {
+            Some(db) => db.clone(),
+            None => {
+                let proxy_conn_string = proxy_conn_string(name, self.proxy_port);
+                Arc::new(NoopDatabase {
+                    name: name.clone(),
+                    proxy_conn_string,
+                })
+            }
+        }
+    }
+
+    pub fn start_serving(&self) -> tokio::task::JoinHandle<anyhow::Result<()>> {
+        let manager = proxy::ProxyManager::new(Bouncer {
+            databases: self.databases.clone(),
+        });
+
+        let listener = self.listener.lock().unwrap().take();
+        let runtime = self.runtime.clone();
+        self.runtime.spawn(async move {
+            let listener = listener.context("sqldb server already started")?;
+            listener
+                .set_nonblocking(true)
+                .context("unable to set nonblocking")?;
+            let listener = tokio::net::TcpListener::from_std(listener)
+                .context("unable to convert listener to tokio")?;
+
+            let addr = listener
+                .local_addr()
+                .map(|a| a.to_string())
+                .unwrap_or("unknown".to_string());
+
+            log::debug!(addr=addr; "encore runtime database proxy listening for incoming requests");
+
+            loop {
+                let (stream, _) = listener.accept().await?;
+                let mgr = manager.clone();
+                runtime.spawn(mgr.handle_conn(stream));
+            }
+        })
+    }
+}
+
+pub trait Database: Send + Sync {
+    // The name of the database.
+    fn name(&self) -> &EncoreName;
+
+    fn pool_config(&self) -> anyhow::Result<PoolConfig>;
+    fn config(&self) -> anyhow::Result<&tokio_postgres::Config>;
+    fn tls(&self) -> anyhow::Result<&postgres_native_tls::MakeTlsConnector>;
+    fn new_pool(&self) -> anyhow::Result<Pool>;
+
+    /// Returns the connection string for connecting to this database via the proxy.
+    fn proxy_conn_string(&self) -> &str;
+}
+
+/// Represents a SQL Database available to the runtime.
+pub struct DatabaseImpl {
+    name: EncoreName,
+    config: Arc<tokio_postgres::Config>,
+    tls: postgres_native_tls::MakeTlsConnector,
+    proxy_conn_string: String,
+    tracer: Tracer,
+
+    min_conns: u32,
+    max_conns: u32,
+}
+
+#[derive(Debug, Clone)]
+pub struct PoolConfig {
+    pub min_conns: u32,
+    pub max_conns: u32,
+}
+
+impl Database for DatabaseImpl {
+    fn name(&self) -> &EncoreName {
+        &self.name
+    }
+
+    fn pool_config(&self) -> anyhow::Result<PoolConfig> {
+        Ok(PoolConfig {
+            min_conns: self.min_conns,
+            max_conns: self.max_conns,
+        })
+    }
+
+    fn config(&self) -> anyhow::Result<&tokio_postgres::Config> {
+        Ok(&self.config)
+    }
+
+    fn tls(&self) -> anyhow::Result<&postgres_native_tls::MakeTlsConnector> {
+        Ok(&self.tls)
+    }
+
+    fn new_pool(&self) -> anyhow::Result<Pool> {
+        Pool::new(self, self.tracer.clone())
+    }
+
+    fn proxy_conn_string(&self) -> &str {
+        &self.proxy_conn_string
+    }
+}
+
+struct NoopDatabase {
+    name: EncoreName,
+    proxy_conn_string: String,
+}
+
+impl Database for NoopDatabase {
+    fn name(&self) -> &EncoreName {
+        &self.name
+    }
+
+    fn pool_config(&self) -> anyhow::Result<PoolConfig> {
+        anyhow::bail!("this database is not configured for use by this process")
+    }
+
+    fn config(&self) -> anyhow::Result<&tokio_postgres::Config> {
+        anyhow::bail!("this database is not configured for use by this process")
+    }
+
+    fn tls(&self) -> anyhow::Result<&postgres_native_tls::MakeTlsConnector> {
+        anyhow::bail!("this database is not configured for use by this process")
+    }
+
+    fn new_pool(&self) -> anyhow::Result<Pool> {
+        anyhow::bail!("this database is not configured for use by this process")
+    }
+
+    fn proxy_conn_string(&self) -> &str {
+        // We need to return a valid connection string here,
+        // as this is typically called during initialization.
+        // The proxy will reject any connections to the database.
+        &self.proxy_conn_string
+    }
+}
+
+#[derive(Clone)]
+struct Bouncer {
+    databases: Arc<HashMap<EncoreName, Arc<DatabaseImpl>>>,
+}
+
+impl ClientBouncer for Bouncer {
+    // TODO support TLS
+    type Tls = postgres_native_tls::MakeTlsConnector;
+    type Future = futures::future::Ready<Result<AcceptConn<Self::Tls>, RejectConn>>;
+
+    fn handle_startup(
+        &self,
+        info: &postgres_protocol::message::startup::StartupData,
+    ) -> Self::Future {
+        let resolve = move || {
+            let db_name = info
+                .parameters
+                .get("database")
+                .ok_or(RejectConn::UnknownDatabase)?;
+            let db_name =
+                String::from_utf8(db_name.to_vec()).map_err(|_| RejectConn::UnknownDatabase)?;
+            let db = self
+                .databases
+                .get(&db_name)
+                .ok_or(RejectConn::UnknownDatabase)?;
+
+            Ok(AcceptConn {
+                auth_method: AuthMethod::Trust,
+                tls: db.tls.clone(),
+                backend_config: db.config.clone(),
+            })
+        };
+        futures::future::ready(resolve())
+    }
+}
+
+/// Returns the connection string for connecting to the database via the proxy.
+fn proxy_conn_string(db_encore_name: &str, proxy_port: u16) -> String {
+    format!("postgresql://encore:password@127.0.0.1:{proxy_port}/{db_encore_name}?sslmode=disable",)
+}
+
+/// Computes the database configuration for the given clusters.
+fn databases_from_cfg(
+    clusters: Vec<pb::SqlCluster>,
+    creds: &pb::infrastructure::Credentials,
+    secrets: &secrets::Manager,
+    proxy_port: u16,
+    tracer: Tracer,
+) -> anyhow::Result<HashMap<EncoreName, Arc<DatabaseImpl>>> {
+    let mut databases = HashMap::new();
+    for c in clusters {
+        // Get the primary server.
+        let server = c
+            .servers
+            .into_iter()
+            .find(|s| s.kind() == pb::ServerKind::Primary);
+        let Some(server) = server else {
+            log::warn!("no primary server found for cluster {}, skipping", c.rid);
+            continue;
+        };
+
+        for db in c.databases {
+            // Get the read-write pool for this db.
+            let pool = db.conn_pools.into_iter().find(|p| !p.is_readonly);
+            let Some(pool) = pool else {
+                log::warn!(
+                    "no read-write pool found for database {}, skipping",
+                    db.encore_name
+                );
+                continue;
+            };
+
+            // Get the role to authenticate with.
+            let role = creds
+                .sql_roles
+                .iter()
+                .find(|r| r.rid == pool.role_rid)
+                .with_context(|| {
+                    format!(
+                        "no role found with rid {} for database {}",
+                        pool.role_rid, db.encore_name
+                    )
+                })?;
+
+            let mut config = tokio_postgres::Config::new();
+
+            // Add host/port configuration
+            if server.host.starts_with('/') {
+                // Unix socket
+                config.host(&server.host);
+            } else if let Some((host, port)) = server.host.split_once(':') {
+                config.host(host);
+                config.port(port.parse::<u16>().context("invalid port")?);
+            } else {
+                config.host(&server.host);
+                config.port(5432);
+            }
+
+            config.user(&role.username);
+            if let Some(password) = &role.password {
+                let sec = secrets.load(password.clone());
+                let password = sec.get().context("failed to resolve password")?;
+                config.password(password);
+            }
+
+            config.dbname(&db.cloud_name);
+            config.application_name("encore");
+
+            let mut tls_builder = native_tls::TlsConnector::builder();
+            if let Some(tls_config) = &server.tls_config {
+                if let Some(server_ca_cert) = &tls_config.server_ca_cert {
+                    let cert = native_tls::Certificate::from_pem(server_ca_cert.as_bytes())
+                        .context("unable to parse server ca certificate")?;
+                    tls_builder.add_root_certificate(cert);
+                    config.ssl_mode(tokio_postgres::config::SslMode::Require);
+                } else {
+                    config.ssl_mode(tokio_postgres::config::SslMode::Prefer);
+                }
+
+                if tls_config.disable_tls_hostname_verification {
+                    tls_builder.danger_accept_invalid_hostnames(true);
+                }
+                if tls_config.disable_ca_validation {
+                    tls_builder.danger_accept_invalid_certs(true);
+                }
+            } else {
+                config.ssl_mode(tokio_postgres::config::SslMode::Disable);
+            }
+
+            if let Some(client_cert_rid) = &role.client_cert_rid {
+                // Add a client certificate.
+                let client_cert = creds
+                    .client_certs
+                    .iter()
+                    .find(|c| c.rid == *client_cert_rid)
+                    .with_context(|| {
+                        format!(
+                            "no client certificate found with rid {} for database {}",
+                            client_cert_rid, db.encore_name
+                        )
+                    })?;
+
+                // Parse the client key secret.
+                let client_key = client_cert
+                    .key
+                    .as_ref()
+                    .context("client certificate has no key")?;
+                let client_key = secrets.load(client_key.clone());
+                let client_key = client_key.get().context("failed to resolve client key")?;
+
+                let client_key = convert_client_key_if_necessary(client_key)
+                    .context("failed to convert client key to PKCS#8")?;
+                let identity = native_tls::Identity::from_pkcs8(
+                    client_cert.cert.as_bytes(),
+                    client_key.as_ref(),
+                )
+                .context("failed to parse client certificate")?;
+                tls_builder.identity(identity);
+            }
+
+            let tls = tls_builder
+                .build()
+                .context("failed to build TLS connector")?;
+            let tls = postgres_native_tls::MakeTlsConnector::new(tls);
+
+            let proxy_conn_string = proxy_conn_string(&db.encore_name, proxy_port);
+
+            let name: EncoreName = db.encore_name.into();
+            databases.insert(
+                name.clone(),
+                Arc::new(DatabaseImpl {
+                    name,
+                    config: Arc::new(config),
+                    tls,
+                    proxy_conn_string,
+                    tracer: tracer.clone(),
+
+                    min_conns: pool.min_connections as u32,
+                    max_conns: pool.max_connections as u32,
+                }),
+            );
+        }
+    }
+
+    Ok(databases)
+}
+
+/// Converts the client key from PKCS#1 to PKCS#8 if necessary.
+fn convert_client_key_if_necessary(pem: &[u8]) -> anyhow::Result<Cow<'_, [u8]>> {
+    let Ok(pem_str) = std::str::from_utf8(pem) else {
+        // Assume the key is already in PKCS#8 format.
+        return Ok(Cow::Borrowed(pem));
+    };
+    if !pem_str.starts_with("-----BEGIN RSA PRIVATE KEY-----") {
+        // Key is not in PKCS#1 format, assume it's already in PKCS#8 format.
+        return Ok(Cow::Borrowed(pem));
+    }
+
+    use rsa::{pkcs1::DecodeRsaPrivateKey, pkcs8::EncodePrivateKey};
+
+    let pkey = rsa::RsaPrivateKey::from_pkcs1_pem(pem_str)
+        .context("failed to parse PKCS#1 private key")?;
+    let pkcs8 = pkey
+        .to_pkcs8_pem(rsa::pkcs8::LineEnding::LF)
+        .context("failed to convert PKCS#1 private key to PKCS#8")?;
+    Ok(Cow::Owned(pkcs8.as_bytes().to_owned()))
+}
diff --git a/runtimes/core/src/sqldb/mod.rs b/runtimes/core/src/sqldb/mod.rs
new file mode 100644
index 0000000000..b61096e86e
--- /dev/null
+++ b/runtimes/core/src/sqldb/mod.rs
@@ -0,0 +1,10 @@
+mod client;
+mod manager;
+pub mod numeric;
+mod transaction;
+mod val;
+
+pub use client::{Connection, Cursor, Pool, Row};
+pub use manager::{Database, DatabaseImpl, Manager, ManagerConfig};
+pub use transaction::Transaction;
+pub use val::RowValue;
diff --git a/runtimes/core/src/sqldb/numeric.rs b/runtimes/core/src/sqldb/numeric.rs
new file mode 100644
index 0000000000..750d5935a7
--- /dev/null
+++ b/runtimes/core/src/sqldb/numeric.rs
@@ -0,0 +1,1571 @@
+//! Conversions to and from Postgres's binary format for the numeric type.
+use byteorder::{BigEndian, ReadBytesExt};
+use bytes::{BufMut, BytesMut};
+use std::boxed::Box as StdBox;
+use std::error::Error;
+use std::str::{self, FromStr};
+
+/// Serializes a `NUMERIC` value.
+#[inline]
+pub fn numeric_to_sql(v: Numeric, buf: &mut BytesMut) {
+    let num_digits = v.digits.len() as u16;
+    buf.put_u16(num_digits);
+    buf.put_i16(v.weight);
+    buf.put_u16(v.sign.into_u16());
+    buf.put_u16(v.scale);
+
+    for digit in v.digits {
+        buf.put_i16(digit);
+    }
+}
+
+/// Deserializes a `NUMERIC` value.
+#[inline]
+pub fn numeric_from_sql(mut buf: &[u8]) -> Result<Numeric, StdBox<dyn Error + Sync + Send>> {
+    let num_digits = buf.read_u16::<BigEndian>()?;
+    let mut digits = Vec::with_capacity(num_digits.into());
+
+    let weight = buf.read_i16::<BigEndian>()?;
+    let sign = NumericSign::try_from_u16(buf.read_u16::<BigEndian>()?)?;
+
+    let scale = buf.read_u16::<BigEndian>()?;
+
+    for _ in 0..num_digits {
+        digits.push(buf.read_i16::<BigEndian>()?);
+    }
+
+    Ok(Numeric {
+        sign,
+        scale,
+        weight,
+        digits,
+    })
+}
+
+/// Numeric sign
+#[derive(Debug, Copy, Clone, PartialEq, Eq)]
+pub enum NumericSign {
+    /// Positive number
+    Positive,
+    /// Negative number
+    Negative,
+    /// Not a number
+    NaN,
+    /// Positive infinity
+    PositiveInfinity,
+    /// Negative infinity
+    NegativeInfinity,
+}
+
+impl NumericSign {
+    #[inline]
+    fn try_from_u16(sign: u16) -> Result<NumericSign, StdBox<dyn Error + Sync + Send>> {
+        match sign {
+            0x0000 => Ok(NumericSign::Positive),
+            0x4000 => Ok(NumericSign::Negative),
+            0xC000 => Ok(NumericSign::NaN),
+            0xD000 => Ok(NumericSign::PositiveInfinity),
+            0xF000 => Ok(NumericSign::NegativeInfinity),
+            _ => Err("invalid sign in numeric value".into()),
+        }
+    }
+
+    #[inline]
+    fn into_u16(self) -> u16 {
+        match self {
+            NumericSign::Positive => 0x0000,
+            NumericSign::Negative => 0x4000,
+            NumericSign::NaN => 0xC000,
+            NumericSign::PositiveInfinity => 0xD000,
+            NumericSign::NegativeInfinity => 0xF000,
+        }
+    }
+}
+
+/// A Posgres numeric
+#[derive(Debug, PartialEq, Eq)]
+pub struct Numeric {
+    sign: NumericSign,
+    scale: u16,
+    weight: i16,
+    digits: Vec<i16>,
+}
+
+impl Numeric {
+    /// Returns the weight of the numeric value.
+    #[inline]
+    pub fn weight(&self) -> i16 {
+        self.weight
+    }
+
+    /// Returns the scale of the numeric value.
+    #[inline]
+    pub fn scale(&self) -> u16 {
+        self.scale
+    }
+
+    fn nan() -> Self {
+        Self {
+            sign: NumericSign::NaN,
+            scale: 0,
+            weight: 0,
+            digits: vec![],
+        }
+    }
+
+    fn infinity() -> Self {
+        Self {
+            sign: NumericSign::PositiveInfinity,
+            scale: 0,
+            weight: 0,
+            digits: vec![],
+        }
+    }
+
+    fn negative_infinity() -> Self {
+        Self {
+            sign: NumericSign::NegativeInfinity,
+            scale: 0,
+            weight: 0,
+            digits: vec![],
+        }
+    }
+}
+
+impl std::fmt::Display for Numeric {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self.sign {
+            NumericSign::NaN => write!(f, "NaN"),
+            NumericSign::PositiveInfinity => write!(f, "Infinity"),
+            NumericSign::NegativeInfinity => write!(f, "-Infinity"),
+            NumericSign::Negative => {
+                write!(f, "-")?;
+                format_positive_number(self, f)
+            }
+            NumericSign::Positive => format_positive_number(self, f),
+        }
+    }
+}
+
+impl FromStr for Numeric {
+    type Err = ParseError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        if let Some(special) = parse_special_values(value)? {
+            return Ok(special);
+        }
+
+        let components = parse_number_components(value)?;
+
+        if components.exponent == 0 {
+            parse_simple_number(&components)
+        } else {
+            parse_scientific_number(&components)
+        }
+    }
+}
+
+/// Parse a simple number without scientific notation (fast path)
+fn parse_simple_number(components: &ParsedComponents<'_>) -> Result<Numeric, ParseError> {
+    let mut digits = Vec::new();
+    let mut weight;
+    let scale = components.decimal_part.len() as u16;
+
+    let integer_digits = build_integer_digits_from_bytes(components.integer_part)?;
+    let has_integer = !integer_digits.is_empty();
+
+    if has_integer {
+        // Calculate weight from non-zero integer digits
+        let non_zero_start = components
+            .integer_part
+            .iter()
+            .position(|&b| b != b'0')
+            .unwrap_or(0);
+        let significant_len = components.integer_part.len() - non_zero_start;
+        weight = ((significant_len - 1) / 4) as i16;
+        digits.extend(integer_digits);
+    } else {
+        weight = if !components.decimal_part.is_empty() {
+            -1
+        } else {
+            0
+        };
+    }
+
+    if !components.decimal_part.is_empty() {
+        if has_integer {
+            let decimal_digits = build_decimal_digits_from_bytes(components.decimal_part)?;
+            digits.extend(decimal_digits);
+        } else {
+            process_decimal_digits(components.decimal_part, &mut digits, &mut weight)?;
+        }
+    }
+
+    // Normalize zeros
+    normalize_leading_zeros(&mut digits, &mut weight);
+    normalize_trailing_zeros(&mut digits);
+
+    Ok(Numeric {
+        sign: components.sign,
+        scale,
+        weight,
+        digits,
+    })
+}
+
+/// Parse a number with scientific notation
+fn parse_scientific_number(components: &ParsedComponents<'_>) -> Result<Numeric, ParseError> {
+    let layout = ScientificLayout::new(
+        components.integer_part,
+        components.decimal_part,
+        components.exponent,
+    );
+
+    // Get digit vectors from the scientific layout
+    let effective_integer = layout.integer_digits();
+    let effective_decimal = layout.decimal_digits();
+
+    let mut digits = Vec::new();
+    let mut weight;
+
+    // Calculate scale based on decimal digits from the layout
+    let effective_scale = effective_decimal.len() as u16;
+
+    let scale = components.calculate_scale(effective_scale);
+
+    // Process integer and decimal parts
+    let integer_digits = build_integer_digits_from_bytes(&effective_integer)?;
+    let has_integer = !integer_digits.is_empty();
+
+    if has_integer {
+        // Calculate weight from non-zero integer digits
+        let non_zero_start = effective_integer
+            .iter()
+            .position(|&b| b != b'0')
+            .unwrap_or(0);
+        let significant_len = effective_integer.len() - non_zero_start;
+        weight = ((significant_len - 1) / 4) as i16;
+        digits.extend(integer_digits);
+    } else {
+        weight = if !effective_decimal.is_empty() { -1 } else { 0 };
+    }
+
+    // Process decimal part
+    if !effective_decimal.is_empty() {
+        if has_integer {
+            // Mixed number - just add decimal digits
+            let decimal_digits = build_decimal_digits_from_bytes(&effective_decimal)?;
+            digits.extend(decimal_digits);
+        } else {
+            process_decimal_digits(&effective_decimal, &mut digits, &mut weight)?;
+        }
+    }
+
+    // Normalize zeros
+    normalize_leading_zeros(&mut digits, &mut weight);
+    normalize_trailing_zeros(&mut digits);
+
+    Ok(Numeric {
+        sign: components.sign,
+        scale,
+        weight,
+        digits,
+    })
+}
+
+fn format_positive_number(n: &Numeric, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+    format_integer_part(n, f)?;
+    format_decimal_part(n, f)?;
+    Ok(())
+}
+
+fn format_integer_part(n: &Numeric, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+    if n.weight() < 0 {
+        write!(f, "0")?;
+        return Ok(());
+    }
+
+    for i in 0..=n.weight() {
+        let d = n.digits.get(i as usize).unwrap_or(&0);
+        if i == 0 {
+            write!(f, "{d}")?;
+        } else {
+            write!(f, "{d:04}")?;
+        }
+    }
+
+    Ok(())
+}
+
+fn format_decimal_part(n: &Numeric, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+    if n.scale() == 0 {
+        return Ok(());
+    }
+
+    write!(f, ".")?;
+
+    let mut remaining_decimals = n.scale();
+
+    let mut curr_weight = -1;
+    while curr_weight > n.weight() {
+        write!(f, "0000")?;
+        curr_weight -= 1;
+        remaining_decimals = remaining_decimals.saturating_sub(4);
+    }
+
+    if remaining_decimals == 0 {
+        return Ok(());
+    }
+
+    let decimal_idx = if n.weight() < 0 { 0 } else { n.weight() + 1 } as usize;
+    for i in decimal_idx..n.digits.len() {
+        let d = n.digits.get(i).unwrap_or(&0);
+        if remaining_decimals >= 4 {
+            write!(f, "{d:04}")?;
+            remaining_decimals -= 4;
+        } else {
+            let truncated = d / 10_i16.pow(4 - remaining_decimals as u32);
+            write!(
+                f,
+                "{:0width$}",
+                truncated,
+                width = remaining_decimals as usize
+            )?;
+
+            remaining_decimals = 0;
+            break;
+        }
+    }
+
+    if remaining_decimals > 0 {
+        write!(f, "{:0width$}", 0, width = remaining_decimals as usize)?;
+    }
+
+    Ok(())
+}
+
+type ParseError = StdBox<dyn Error + Sync + Send>;
+
+/// Components of a parsed numeric string
+struct ParsedComponents<'a> {
+    sign: NumericSign,
+    integer_part: &'a [u8],
+    decimal_part: &'a [u8],
+    exponent: i32,
+}
+
+impl<'a> ParsedComponents<'a> {
+    /// Calculate the scale for a numeric value, handling scientific notation
+    fn calculate_scale(&self, effective_scale: u16) -> u16 {
+        // Check if the original number is zero
+        let is_zero = self.integer_part.iter().all(|&b| b == b'0')
+            && (self.decimal_part.is_empty() || self.decimal_part.iter().all(|&b| b == b'0'));
+        if is_zero {
+            if self.exponent < 0 {
+                // For "0e-10", preserve the scale implied by the exponent
+                (-self.exponent as u16).max(self.decimal_part.len() as u16)
+            } else {
+                // For "0.0e5", preserve the original decimal scale
+                self.decimal_part.len() as u16
+            }
+        } else if self.exponent < 0 {
+            // For negative exponents, calculate implied decimal places
+            let implied = self.decimal_part.len() as i32 + (-self.exponent);
+            implied.max(0).min(u16::MAX as i32) as u16
+        } else {
+            // For positive exponents, use the effective scale
+            effective_scale
+        }
+    }
+}
+
+fn parse_special_values(s: &str) -> Result<Option<Numeric>, ParseError> {
+    if s.eq_ignore_ascii_case("NaN") {
+        return Ok(Some(Numeric::nan()));
+    }
+    if s.eq_ignore_ascii_case("Infinity") || s.eq_ignore_ascii_case("Inf") {
+        return Ok(Some(Numeric::infinity()));
+    }
+    if s.eq_ignore_ascii_case("-Infinity") || s.eq_ignore_ascii_case("-Inf") {
+        return Ok(Some(Numeric::negative_infinity()));
+    }
+    Ok(None)
+}
+
+fn parse_scientific_component(s: &[u8]) -> Result<(&[u8], Option<i32>), ParseError> {
+    let (s, e) = split_e(s);
+
+    let exp = if let Some(mut e) = e {
+        if e.is_empty() {
+            return Err("empty scientific notation string".into());
+        }
+
+        let mut positive = true;
+        let mut exp: i32 = 0;
+
+        if let Some(&b'-') = e.first() {
+            positive = false;
+            e = &e[1..];
+        } else if let Some(&b'+') = e.first() {
+            e = &e[1..];
+        }
+
+        if e.is_empty() {
+            return Err("empty scientific notation exponent".into());
+        }
+
+        for &b in e {
+            if !b.is_ascii_digit() {
+                return Err("scientific notation string contain non-digit character".into());
+            }
+            // Prevent integer overflow in exponent
+            exp = exp.saturating_mul(10).saturating_add((b - b'0') as i32);
+            if exp > 1000000 {
+                // Reasonable limit for exponents
+                return Err("scientific notation exponent too large".into());
+            }
+        }
+
+        Some(if positive { exp } else { -exp })
+    } else {
+        None
+    };
+
+    Ok((s, exp))
+}
+
+fn parse_number_components(s: &str) -> Result<ParsedComponents<'_>, ParseError> {
+    let mut sign = NumericSign::Positive;
+
+    let mut s = s.as_bytes();
+    if let Some(&b'-') = s.first() {
+        sign = NumericSign::Negative;
+        s = &s[1..];
+    };
+
+    // Check for completely empty input after removing sign
+    if s.is_empty() {
+        return Err("empty numeric string".into());
+    }
+
+    let (s, exp) = parse_scientific_component(s)?;
+    let (integer_part, decimal_part) = split_decimal(s);
+    let decimal_part = decimal_part.unwrap_or_default();
+
+    if integer_part.is_empty() && decimal_part.is_empty() {
+        return Err("invalid numeric string".into());
+    }
+
+    Ok(ParsedComponents {
+        sign,
+        integer_part,
+        decimal_part,
+        exponent: exp.unwrap_or(0),
+    })
+}
+
+/// Represents the layout of digits after applying scientific notation transformation,
+/// calculating positions and zero-padding.
+#[derive(Debug)]
+struct ScientificLayout<'a> {
+    integer_part: &'a [u8],
+    decimal_part: &'a [u8],
+    decimal_point_pos: i32,
+    leading_zeros: usize,
+    trailing_zeros: usize,
+}
+
+impl<'a> ScientificLayout<'a> {
+    fn new(integer: &'a [u8], decimal: &'a [u8], exponent: i32) -> Self {
+        let decimal_point_pos = integer.len() as i32 + exponent;
+
+        let total_original_digits = integer.len() + decimal.len();
+
+        let (leading_zeros, trailing_zeros) = if exponent > 0 {
+            let total_needed = decimal_point_pos as usize;
+            let trailing_zeros = total_needed.saturating_sub(total_original_digits);
+            (0, trailing_zeros)
+        } else if decimal_point_pos <= 0 {
+            let leading_zeros = (-decimal_point_pos) as usize;
+            (leading_zeros, 0)
+        } else {
+            (0, 0)
+        };
+
+        Self {
+            integer_part: integer,
+            decimal_part: decimal,
+            decimal_point_pos,
+            leading_zeros,
+            trailing_zeros,
+        }
+    }
+
+    /// Returns the effective integer digits
+    fn integer_digits(&self) -> Vec<u8> {
+        if self.decimal_point_pos <= 0 {
+            return vec![];
+        }
+
+        let split_pos = (self.decimal_point_pos as usize)
+            .min(self.integer_part.len() + self.decimal_part.len());
+
+        let total_len = split_pos + self.trailing_zeros;
+        let mut result = Vec::with_capacity(total_len);
+
+        result.extend_from_slice(self.integer_part);
+
+        // Add from decimal part if needed
+        if split_pos > self.integer_part.len() {
+            let decimal_count = split_pos - self.integer_part.len();
+            result.extend(self.decimal_part.iter().take(decimal_count));
+        }
+
+        // Add trailing zeros
+        result.resize(total_len, b'0');
+
+        result
+    }
+
+    /// Returns the effective decimal digits
+    fn decimal_digits(&self) -> Vec<u8> {
+        if self.decimal_point_pos <= 0 {
+            // All digits become decimal with leading zeros
+            let total_len = self.leading_zeros + self.integer_part.len() + self.decimal_part.len();
+            let mut result = Vec::with_capacity(total_len);
+            result.resize(self.leading_zeros, b'0');
+            result.extend_from_slice(self.integer_part);
+            result.extend_from_slice(self.decimal_part);
+            result
+        } else {
+            let split_pos = (self.decimal_point_pos as usize)
+                .min(self.integer_part.len() + self.decimal_part.len());
+
+            if split_pos >= self.integer_part.len() + self.decimal_part.len() {
+                // No decimal digits
+                Vec::new()
+            } else if split_pos >= self.integer_part.len() {
+                // Split within decimal part
+                let skip_decimal = split_pos - self.integer_part.len();
+                self.decimal_part[skip_decimal..].to_vec()
+            } else {
+                // Split within integer part
+                let mut result = Vec::new();
+                result.extend_from_slice(&self.integer_part[split_pos..]);
+                result.extend_from_slice(self.decimal_part);
+                result
+            }
+        }
+    }
+}
+
+/// Process decimal-only numbers, setting weight based on leading zeros
+fn process_decimal_digits(
+    decimal_bytes: &[u8],
+    digits: &mut Vec<i16>,
+    weight: &mut i16,
+) -> Result<(), ParseError> {
+    let leading_zeros = decimal_bytes.iter().take_while(|&&b| b == b'0').count();
+
+    if leading_zeros < decimal_bytes.len() {
+        // Calculate weight based on position of first significant digit group
+        *weight = -(((leading_zeros / 4) + 1) as i16);
+
+        // Process from the start of the significant digit group
+        let group_start = (leading_zeros / 4) * 4;
+        let decimal_digits = build_decimal_digits_from_bytes(&decimal_bytes[group_start..])?;
+        digits.extend(decimal_digits);
+    } else {
+        // All zeros
+        *weight = 0;
+    }
+    Ok(())
+}
+
+/// Builds base-10000 digits from integer digit bytes.
+/// Returns digits in most-significant-first order.
+fn build_integer_digits_from_bytes(digits: &[u8]) -> Result<Vec<i16>, ParseError> {
+    // Skip leading zeros
+    let trimmed_start = digits
+        .iter()
+        .position(|&b| b != b'0')
+        .unwrap_or(digits.len());
+
+    if trimmed_start == digits.len() {
+        return Ok(Vec::new());
+    }
+
+    let trimmed = &digits[trimmed_start..];
+
+    // Process in chunks of 4 from the right, converting directly to base-10000
+    let mut result = Vec::with_capacity(trimmed.len().div_ceil(4));
+
+    for chunk in trimmed.rchunks(4) {
+        let mut digit = 0i16;
+        for &b in chunk {
+            if !b.is_ascii_digit() {
+                return Err("invalid digit character".into());
+            }
+            digit = digit * 10 + (b - b'0') as i16;
+        }
+        result.push(digit);
+    }
+
+    result.reverse(); // Reverse to get most-significant-first order
+    Ok(result)
+}
+
+/// Builds base-10000 digits from decimal part bytes.
+fn build_decimal_digits_from_bytes(digits: &[u8]) -> Result<Vec<i16>, ParseError> {
+    if digits.is_empty() {
+        return Ok(Vec::new());
+    }
+
+    // Process in 4-digit chunks, padding the last chunk
+    let mut result = Vec::with_capacity(digits.len().div_ceil(4));
+
+    for chunk in digits.chunks(4) {
+        let mut digit = 0i16;
+        for &b in chunk {
+            if !b.is_ascii_digit() {
+                return Err("invalid digit character".into());
+            }
+            digit = digit * 10 + (b - b'0') as i16;
+        }
+
+        // Pad to 4 digits for proper base-10000 representation
+        if chunk.len() < 4 {
+            digit *= 10i16.pow((4 - chunk.len()) as u32);
+        }
+
+        result.push(digit);
+    }
+
+    Ok(result)
+}
+
+/// Normalize leading zeros
+fn normalize_leading_zeros(digits: &mut Vec<i16>, weight: &mut i16) {
+    let leading_zero_count = digits.iter().take_while(|&&d| d == 0).count();
+
+    if leading_zero_count > 0 {
+        if leading_zero_count == digits.len() {
+            // All digits are zero
+            *weight = 0;
+            digits.clear();
+        } else {
+            // Remove leading zeros
+            digits.drain(0..leading_zero_count);
+            *weight -= leading_zero_count as i16;
+        }
+    }
+}
+
+/// Remove trailing zeros
+fn normalize_trailing_zeros(digits: &mut Vec<i16>) {
+    // Find last non-zero position
+    if let Some(last_nonzero) = digits.iter().rposition(|&d| d != 0) {
+        digits.truncate(last_nonzero + 1);
+    } else {
+        digits.clear();
+    }
+}
+
+fn split_e(s: &[u8]) -> (&[u8], Option<&[u8]>) {
+    let mut s = s.splitn(2, |&b| b == b'e' || b == b'E');
+    let first = s.next().unwrap();
+    let second = s.next();
+    (first, second)
+}
+
+fn split_decimal(s: &[u8]) -> (&[u8], Option<&[u8]>) {
+    let mut s = s.splitn(2, |&b| b == b'.');
+    let first = s.next().unwrap();
+    let second = s.next();
+    (first, second)
+}
+
+#[cfg(test)]
+mod test {
+    use super::*;
+
+    #[test]
+    fn test_string_deserialization_and_serialization() {
+        let cases = &[
+            (
+                "0",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 0,
+                    digits: vec![],
+                },
+            ),
+            (
+                "1",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 0,
+                    digits: vec![1],
+                },
+            ),
+            (
+                "-1",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 0,
+                    digits: vec![1],
+                },
+            ),
+            (
+                "10",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 0,
+                    digits: vec![10],
+                },
+            ),
+            (
+                "-10",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 0,
+                    digits: vec![10],
+                },
+            ),
+            (
+                "20000",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "-20000",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "20001",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![2, 1],
+                },
+            ),
+            (
+                "-20001",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![2, 1],
+                },
+            ),
+            (
+                "200000000",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 2,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "2.0",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 1,
+                    weight: 0,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "2.1",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 1,
+                    weight: 0,
+                    digits: vec![2, 1000],
+                },
+            ),
+            (
+                "2.10",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 2,
+                    weight: 0,
+                    digits: vec![2, 1000],
+                },
+            ),
+            (
+                "200000000.0001",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 4,
+                    weight: 2,
+                    digits: vec![2, 0, 0, 1],
+                },
+            ),
+            (
+                "-200000000.0001",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 4,
+                    weight: 2,
+                    digits: vec![2, 0, 0, 1],
+                },
+            ),
+            (
+                "0.1",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 1,
+                    weight: -1,
+                    digits: vec![1000],
+                },
+            ),
+            (
+                "-0.1",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 1,
+                    weight: -1,
+                    digits: vec![1000],
+                },
+            ),
+            (
+                "123.456",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 3,
+                    weight: 0,
+                    digits: vec![123, 4560],
+                },
+            ),
+            (
+                "-123.456",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 3,
+                    weight: 0,
+                    digits: vec![123, 4560],
+                },
+            ),
+            (
+                "-123.0456",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 4,
+                    weight: 0,
+                    digits: vec![123, 456],
+                },
+            ),
+            (
+                "0.1000000000000000",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 16,
+                    weight: -1,
+                    digits: vec![1000],
+                },
+            ),
+            (
+                "-0.1000000000000000",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 16,
+                    weight: -1,
+                    digits: vec![1000],
+                },
+            ),
+            (
+                "0.003159370000000000",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 18,
+                    weight: -1,
+                    digits: vec![31, 5937],
+                },
+            ),
+            (
+                "-0.003159370000000000",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 18,
+                    weight: -1,
+                    digits: vec![31, 5937],
+                },
+            ),
+            (
+                "0.0000000000000002",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 16,
+                    weight: -4,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "-0.0000000000000002",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 16,
+                    weight: -4,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 35,
+                    digits: vec![
+                        1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                        0, 0, 0, 0, 0, 0, 0, 1,
+                    ],
+                },
+            ),
+            (
+                "-100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 35,
+                    digits: vec![
+                        1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                        0, 0, 0, 0, 0, 0, 0, 1,
+                    ],
+                },
+            ),
+        ];
+
+        for (str, n) in cases {
+            assert_eq!(*str, n.to_string(), "numeric to string");
+            let num = str.parse::<Numeric>().expect("parse numeric");
+            assert_eq!(num, *n, "numeric from string");
+        }
+    }
+
+    #[test]
+    fn test_from_scientific_notation() {
+        let cases = &[
+            (
+                "2e4",
+                "20000",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "2e+4",
+                "20000",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "-2e4",
+                "-20000",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "-2e-4",
+                "-0.0002",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 4,
+                    weight: -1,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "1.234e4",
+                "12340",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![1, 2340],
+                },
+            ),
+            (
+                "-1.234e4",
+                "-12340",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![1, 2340],
+                },
+            ),
+            (
+                "1.234e5",
+                "123400",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![12, 3400],
+                },
+            ),
+            (
+                "-1.234e5",
+                "-123400",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![12, 3400],
+                },
+            ),
+            (
+                "1.234e8",
+                "123400000",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 2,
+                    digits: vec![1, 2340],
+                },
+            ),
+            (
+                "-1.234e8",
+                "-123400000",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 2,
+                    digits: vec![1, 2340],
+                },
+            ),
+            (
+                "0.0001e4",
+                "1",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 0,
+                    digits: vec![1],
+                },
+            ),
+            (
+                "-0.0001e4",
+                "-1",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 0,
+                    digits: vec![1],
+                },
+            ),
+            (
+                "0.0001e5",
+                "10",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 0,
+                    digits: vec![10],
+                },
+            ),
+            (
+                "-0.0001e5",
+                "-10",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 0,
+                    digits: vec![10],
+                },
+            ),
+            (
+                "2e16",
+                "20000000000000000",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 4,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "-2e16",
+                "-20000000000000000",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 0,
+                    weight: 4,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "2e-16",
+                "0.0000000000000002",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 16,
+                    weight: -4,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "-2e-16",
+                "-0.0000000000000002",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 16,
+                    weight: -4,
+                    digits: vec![2],
+                },
+            ),
+            (
+                "2e-17",
+                "0.00000000000000002",
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 17,
+                    weight: -5,
+                    digits: vec![2000],
+                },
+            ),
+            (
+                "-2e-17",
+                "-0.00000000000000002",
+                Numeric {
+                    sign: NumericSign::Negative,
+                    scale: 17,
+                    weight: -5,
+                    digits: vec![2000],
+                },
+            ),
+        ];
+
+        for (e, str, n) in cases {
+            let num = e.parse::<Numeric>().expect("parse numeric");
+            assert_eq!(num, *n, "{e} to numeric");
+            assert_eq!(num.to_string(), *str, "{e} back to string");
+        }
+    }
+
+    #[test]
+    fn test_error_conditions() {
+        // Test inputs that should definitely be errors
+        let definitely_invalid = &[
+            "",        // Empty string
+            ".",       // Just a decimal sign
+            "-",       // Just minus sign
+            "+",       // Just plus sign
+            "abc",     // Non-numeric characters
+            "1.2.3",   // Multiple decimal points
+            "1.2.3e4", // Multiple decimals with scientific
+            "1e2e3",   // Multiple scientific notations
+            "∞",       // Unicode infinity (not ASCII)
+            "1ee2",    // Double e
+            "1e",      // Scientific notation without exponent
+            "1e+",     // Scientific notation with just +
+            "1e-",     // Scientific notation with just -
+        ];
+
+        for &invalid in definitely_invalid {
+            assert!(
+                invalid.parse::<Numeric>().is_err(),
+                "Should fail to parse: '{}'",
+                invalid
+            );
+        }
+
+        // Test that some edge cases are actually valid
+        let valid_edge_cases = &[
+            ("-.1", "-0.1"), // Negative with no integer part
+            ("1.", "1"),     // Trailing decimal point
+            ("0.", "0"),     // Zero with trailing decimal
+            (".1", "0.1"),   // Decimal point prefix
+            (".0", "0.0"),   // Zero with decimal point prefix
+        ];
+
+        for (input, expected) in valid_edge_cases {
+            let num = input
+                .parse::<Numeric>()
+                .unwrap_or_else(|_| panic!("Should parse: '{}'", input));
+            assert_eq!(
+                num.to_string(),
+                *expected,
+                "Edge case: {} -> {}",
+                input,
+                expected
+            );
+        }
+    }
+
+    #[test]
+    fn test_scientific_notation_edge_cases() {
+        let cases = &[
+            // Zero with various scientific notations - scale is preserved
+            ("0e0", "0"),
+            ("0e10", "0"),
+            ("0e-10", "0.0000000000"), // Scale preserved from scientific notation
+            ("0.0e5", "0.0"),
+            ("0.000e100", "0.000"),
+            // Very large positive exponents
+            (
+                "1e50",
+                "100000000000000000000000000000000000000000000000000",
+            ),
+            ("2e20", "200000000000000000000"),
+            // Very large negative exponents
+            (
+                "1e-50",
+                "0.00000000000000000000000000000000000000000000000001",
+            ),
+            ("5e-25", "0.0000000000000000000000005"),
+            // Leading zeros in mantissa with scientific notation
+            ("000123e2", "12300"),
+            ("0.000123e3", "0.123"),
+            ("0.000123e6", "123"),
+            // Trailing zeros
+            ("1230e-2", "12.30"),
+            ("1000e3", "1000000"),
+        ];
+
+        for (input, expected) in cases {
+            let num = input
+                .parse::<Numeric>()
+                .unwrap_or_else(|_| panic!("Failed to parse: {}", input));
+            let result = num.to_string();
+            assert_eq!(
+                result, *expected,
+                "Scientific notation: {} -> {}",
+                input, expected
+            );
+        }
+    }
+
+    #[test]
+    fn test_normalization_edge_cases() {
+        let cases = &[
+            // Various patterns of leading zeros
+            ("000", "0"),
+            ("000.000", "0.000"),
+            ("0001", "1"),
+            ("0001.0010", "1.0010"), // Trailing zeros in scale are preserved
+            // Trailing zeros in different positions
+            ("1.000", "1.000"),
+            ("1.100", "1.100"),
+            ("1.010", "1.010"),
+            ("10.000", "10.000"),
+            // All zeros in digit groups
+            ("10000", "10000"),         // This becomes weight=1, digits=[1]
+            ("100000000", "100000000"), // This becomes weight=2, digits=[1]
+        ];
+
+        for (input, expected) in cases {
+            let num = input
+                .parse::<Numeric>()
+                .unwrap_or_else(|_| panic!("Failed to parse: {}", input));
+            let result = num.to_string();
+            assert_eq!(
+                result, *expected,
+                "Normalization: {} -> {}",
+                input, expected
+            );
+        }
+    }
+
+    #[test]
+    fn test_weight_boundary_conditions() {
+        let cases = &[
+            // Test numbers that fall on base-10000 digit boundaries
+            ("1", 0),         // Single digit -> weight 0
+            ("9999", 0),      // Max single group -> weight 0
+            ("10000", 1),     // Min double group -> weight 1
+            ("99999999", 1),  // Max double group -> weight 1
+            ("100000000", 2), // Min triple group -> weight 2
+            ("0.1", -1),
+            ("0.0001", -1),
+            ("0.00001", -2),
+            ("0.000000001", -3),
+        ];
+
+        for (input, expected_weight) in cases {
+            let num = input
+                .parse::<Numeric>()
+                .unwrap_or_else(|_| panic!("Failed to parse: {}", input));
+            assert_eq!(
+                num.weight(),
+                *expected_weight,
+                "Weight for {}: expected {}, got {}",
+                input,
+                expected_weight,
+                num.weight()
+            );
+        }
+    }
+
+    #[test]
+    fn test_precision_limits() {
+        // Test very high precision numbers
+        let high_precision_cases = &[
+            "0.123456789012345678901234567890123456789012345678901234567890",
+            "123456789012345678901234567890.123456789012345678901234567890",
+            "0.000000000000000000000000000000000000000000000000000000000123456789",
+        ];
+
+        for input in high_precision_cases {
+            let num = input
+                .parse::<Numeric>()
+                .unwrap_or_else(|_| panic!("Failed to parse: {}", input));
+            let result = num.to_string();
+            // Should be able to round-trip, though might lose trailing zeros
+            let reparsed = result
+                .parse::<Numeric>()
+                .unwrap_or_else(|_| panic!("Failed to reparse: {}", result));
+            assert_eq!(num, reparsed, "Round-trip failed for: {}", input);
+        }
+    }
+
+    #[test]
+    fn test_display_formatting_edge_cases() {
+        let cases = &[
+            // Numbers that test decimal formatting boundaries
+            (
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 4,
+                    weight: -1,
+                    digits: vec![1],
+                },
+                "0.0001",
+            ),
+            (
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 4,
+                    weight: -2,
+                    digits: vec![1],
+                },
+                "0.0000",
+            ), // Only 4 decimal places due to scale
+            (
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 8,
+                    weight: -2,
+                    digits: vec![1],
+                },
+                "0.00000001",
+            ), // 8 decimal places
+            (
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 1,
+                    weight: -1,
+                    digits: vec![5000],
+                },
+                "0.5",
+            ),
+            (
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 8,
+                    weight: -2,
+                    digits: vec![1234],
+                },
+                "0.00001234",
+            ),
+            // Numbers that test weight group boundaries
+            (
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![1],
+                },
+                "10000",
+            ),
+            (
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 2,
+                    digits: vec![1],
+                },
+                "100000000",
+            ),
+            (
+                Numeric {
+                    sign: NumericSign::Positive,
+                    scale: 0,
+                    weight: 1,
+                    digits: vec![1, 2345],
+                },
+                "12345",
+            ),
+        ];
+
+        for (numeric, expected) in cases {
+            let result = numeric.to_string();
+            assert_eq!(
+                result, *expected,
+                "Display formatting failed for {:?}",
+                numeric
+            );
+        }
+    }
+
+    #[test]
+    fn test_various_corner_cases() {
+        // Scientific notation bounds - exponent limits
+        let exponent_bounds = &[
+            "1e1000000",  // At exponent limit (should work)
+            "1e1000001",  // Above exponent limit (should error)
+            "1e-1000000", // At negative limit (should work)
+            "1e-1000001", // Above negative limit (should error)
+        ];
+
+        // First and third should work, second and fourth should error
+        assert!(
+            exponent_bounds[0].parse::<Numeric>().is_ok(),
+            "Should parse: {}",
+            exponent_bounds[0]
+        );
+        assert!(
+            exponent_bounds[1].parse::<Numeric>().is_err(),
+            "Should error: {}",
+            exponent_bounds[1]
+        );
+        assert!(
+            exponent_bounds[2].parse::<Numeric>().is_ok(),
+            "Should parse: {}",
+            exponent_bounds[2]
+        );
+        assert!(
+            exponent_bounds[3].parse::<Numeric>().is_err(),
+            "Should error: {}",
+            exponent_bounds[3]
+        );
+
+        // Scale calculation u16 boundary
+        let scale_boundary = &[
+            ("1e-65535", 65535_u16),     // Maximum u16 scale
+            ("1.234e-65533", 65535_u16), // Should cap at u16::MAX
+        ];
+        for (input, expected_scale) in scale_boundary {
+            let parsed = input.parse::<Numeric>().unwrap();
+            assert_eq!(parsed.scale(), *expected_scale, "Scale boundary: {}", input);
+        }
+
+        // Weight boundary conditions - very deep decimals
+        let weight_boundaries = &[
+            ("0.0001", -1_i16),      // Basic negative weight
+            ("0.00001", -2_i16),     // Weight -2
+            ("0.000000001", -3_i16), // Weight -3 (9 zeros, 3rd group)
+        ];
+        for (input, expected_weight) in weight_boundaries {
+            let parsed = input.parse::<Numeric>().unwrap();
+            assert_eq!(
+                parsed.weight(),
+                *expected_weight,
+                "Weight boundary: {}",
+                input
+            );
+        }
+
+        // Digit processing - 4-digit boundary cases
+        let digit_boundaries = &[
+            ("0.0000123", -2_i16),      // 4 leading zeros -> 2nd group
+            ("0.00000001", -2_i16),     // 7 leading zeros -> 2nd group
+            ("0.000000000001", -3_i16), // 11 leading zeros -> 3rd group
+        ];
+        for (input, expected_weight) in digit_boundaries {
+            let parsed = input.parse::<Numeric>().unwrap();
+            assert_eq!(
+                parsed.weight(),
+                *expected_weight,
+                "Digit boundary: {}",
+                input
+            );
+        }
+
+        // ScientificLayout split logic edge cases
+        let split_cases = &[
+            ("12.34e-2", "0.1234"),     // Split within decimal
+            ("123.45e-5", "0.0012345"), // Split creates leading zeros
+            ("123e-1", "12.3"),         // Split exactly at boundary
+            ("1e0", "1"),               // No-op scientific notation
+        ];
+        for (input, expected) in split_cases {
+            let parsed = input.parse::<Numeric>().unwrap();
+            assert_eq!(format!("{}", parsed), *expected, "Split case: {}", input);
+        }
+
+        // Error conditions with detailed messages
+        let detailed_errors = &[
+            "1e1000001", // scientific notation exponent too large
+            "1e+",       // empty scientific notation exponent
+            "1e-",       // empty scientific notation exponent
+            "1e",        // empty scientific notation string
+            "",          // empty numeric string
+        ];
+        for input in detailed_errors {
+            assert!(input.parse::<Numeric>().is_err(), "Should error: {}", input);
+        }
+
+        // Zero with various scales to test calculate_scale zero handling
+        let zero_scale_cases = &[
+            ("0e-10", 10_u16),  // Zero with implied scale
+            ("0.0e5", 1_u16),   // Zero preserving original scale
+            ("0.000e3", 3_u16), // Zero with decimal scale
+        ];
+        for (input, expected_scale) in zero_scale_cases {
+            let parsed = input.parse::<Numeric>().unwrap();
+            assert_eq!(
+                parsed.scale(),
+                *expected_scale,
+                "Zero scale case: {}",
+                input
+            );
+        }
+    }
+
+    use proptest::prelude::*;
+    proptest! {
+        #[test]
+        fn test_arbitrary_f64_from_string_and_back(value in any::<f64>()) {
+            let prop_val = value.to_string();
+            let numeric = Numeric::from_str(&prop_val).expect("parse numeric");
+            let str_val = numeric.to_string();
+            assert_eq!(prop_val, str_val, "proprty test value {value}");
+        }
+        #[test]
+        fn test_arbitrary_i64_from_string_and_back(value in any::<i64>()) {
+            let prop_val = value.to_string();
+            let numeric = Numeric::from_str(&prop_val).expect("parse numeric");
+            let str_val = numeric.to_string();
+            assert_eq!(prop_val, str_val, "proprty test value {value}");
+        }
+    }
+}
diff --git a/runtimes/core/src/sqldb/transaction.rs b/runtimes/core/src/sqldb/transaction.rs
new file mode 100644
index 0000000000..50c82d8652
--- /dev/null
+++ b/runtimes/core/src/sqldb/transaction.rs
@@ -0,0 +1,122 @@
+use tokio_postgres::types::BorrowToSql;
+
+use crate::model;
+
+use super::{
+    client::{Error, PooledConn, QueryTracer},
+    Cursor,
+};
+
+// Heavily inspired by rust-postgres, but where the transaction doesnt have a lifetime, so it can
+// be shared via napi-rs.
+//
+// https://github.com/sfackler/rust-postgres/blob/720ffe83216714bf9716a03122c547a2e8e9bfd9/tokio-postgres/src/transaction.rs
+
+pub struct Transaction {
+    conn: PooledConn,
+    tracer: QueryTracer,
+    done: bool,
+}
+
+impl Transaction {
+    pub(crate) async fn begin(
+        conn: PooledConn,
+        tracer: QueryTracer,
+        source: Option<&model::Request>,
+    ) -> Result<Self, Error> {
+        struct RollbackIfNotDone<'me> {
+            client: &'me tokio_postgres::Client,
+            done: bool,
+        }
+
+        impl Drop for RollbackIfNotDone<'_> {
+            fn drop(&mut self) {
+                if self.done {
+                    return;
+                }
+
+                self.client.__private_api_rollback(None);
+            }
+        }
+
+        // This is done, as `Future` created by this method can be dropped after
+        // `RequestMessages` is synchronously send to the `Connection` by
+        // `batch_execute()`, but before `Responses` is asynchronously polled to
+        // completion. In that case `Transaction` won't be created and thus
+        // won't be rolled back.
+        {
+            let mut cleaner = RollbackIfNotDone {
+                client: &conn,
+                done: false,
+            };
+
+            tracer
+                .trace_batch_execute(source, "BEGIN", || async {
+                    conn.batch_execute("BEGIN").await.map_err(Error::from)
+                })
+                .await?;
+
+            cleaner.done = true;
+        }
+
+        Ok(Transaction {
+            conn,
+            tracer,
+            done: false,
+        })
+    }
+
+    pub async fn commit(mut self, source: Option<&model::Request>) -> Result<(), Error> {
+        self.done = true;
+        self.batch_execute("COMMIT", source).await
+    }
+
+    pub async fn rollback(mut self, source: Option<&model::Request>) -> Result<(), Error> {
+        self.done = true;
+        self.batch_execute("ROLLBACK", source).await
+    }
+
+    async fn batch_execute(
+        &self,
+        query: &str,
+        source: Option<&model::Request>,
+    ) -> Result<(), Error> {
+        self.tracer
+            .trace_batch_execute(source, query, || async {
+                self.conn.batch_execute(query).await.map_err(Error::from)
+            })
+            .await
+    }
+
+    pub async fn query_raw<P, I>(
+        &self,
+        query: &str,
+        params: I,
+        source: Option<&model::Request>,
+    ) -> Result<Cursor, Error>
+    where
+        P: BorrowToSql,
+        I: IntoIterator<Item = P>,
+        I::IntoIter: ExactSizeIterator,
+    {
+        self.tracer
+            .trace(source, query, || async {
+                self.conn
+                    .query_raw(query, params)
+                    .await
+                    .map_err(Error::from)
+            })
+            .await
+    }
+}
+
+impl Drop for Transaction {
+    fn drop(&mut self) {
+        if self.done {
+            return;
+        }
+
+        log::warn!("transaction not completed, forcing rollback");
+        self.conn.__private_api_rollback(None);
+    }
+}
diff --git a/runtimes/core/src/sqldb/val.rs b/runtimes/core/src/sqldb/val.rs
new file mode 100644
index 0000000000..b8b00667a1
--- /dev/null
+++ b/runtimes/core/src/sqldb/val.rs
@@ -0,0 +1,988 @@
+use anyhow::Context;
+use bytes::{BufMut, BytesMut};
+use serde::Serialize;
+use std::{error::Error, str::FromStr};
+use tokio_postgres::types::{to_sql_checked, FromSql, IsNull, Kind, ToSql, Type};
+use uuid::Uuid;
+
+use crate::api::{DateTime, Decimal, PValue};
+
+#[derive(Debug)]
+pub enum RowValue {
+    PVal(PValue),
+    Bytes(Vec<u8>),
+    Uuid(uuid::Uuid),
+    Inet(cidr::IpInet),
+    Cidr(cidr::IpCidr),
+}
+
+fn is_pgvector(ty: &Type) -> bool {
+    ty.name() == "vector"
+}
+
+impl ToSql for RowValue {
+    fn to_sql(&self, ty: &Type, out: &mut BytesMut) -> Result<IsNull, Box<dyn Error + Sync + Send>>
+    where
+        Self: Sized,
+    {
+        match self {
+            Self::Bytes(val) => val.to_sql(ty, out),
+            Self::Uuid(val) => match *ty {
+                Type::UUID => val.to_sql(ty, out),
+                Type::TEXT | Type::VARCHAR => val.to_string().to_sql(ty, out),
+                _ => Err(format!("uuid not supported for column of type {ty}").into()),
+            },
+            Self::Cidr(val) => match *ty {
+                Type::CIDR => val.to_sql(ty, out),
+                Type::TEXT | Type::VARCHAR => val.to_string().to_sql(ty, out),
+                _ => Err(format!("cidr not supported for column of type {ty}").into()),
+            },
+            Self::Inet(val) => match *ty {
+                Type::INET => val.to_sql(ty, out),
+                Type::TEXT | Type::VARCHAR => val.to_string().to_sql(ty, out),
+                _ => Err(format!("inet not supported for column of type {ty}").into()),
+            },
+
+            Self::PVal(val) => val.to_sql(ty, out),
+        }
+    }
+
+    fn accepts(ty: &Type) -> bool {
+        matches!(
+            *ty,
+            Type::BYTEA | Type::UUID | Type::TEXT | Type::VARCHAR | Type::CIDR | Type::INET
+        ) || matches!(ty.kind(), Kind::Array(ty) if <RowValue as ToSql>::accepts(ty))
+            || <PValue as ToSql>::accepts(ty)
+    }
+
+    to_sql_checked!();
+}
+
+impl ToSql for PValue {
+    fn to_sql(
+        &self,
+        ty: &Type,
+        out: &mut BytesMut,
+    ) -> Result<IsNull, Box<dyn Error + Sync + Send>> {
+        match *ty {
+            Type::JSON | Type::JSONB => {
+                if *ty == Type::JSONB {
+                    out.put_u8(1);
+                }
+
+                let mut ser = serde_json::ser::Serializer::new(out.writer());
+                self.serialize(&mut ser)?;
+                Ok(IsNull::No)
+            }
+
+            _ => match self {
+                PValue::Null => Ok(IsNull::Yes),
+                PValue::Bool(bool) => match *ty {
+                    Type::BOOL => bool.to_sql(ty, out),
+                    Type::TEXT | Type::VARCHAR => bool.to_string().to_sql(ty, out),
+                    _ => Err(format!("bool not supported for column of type {ty}").into()),
+                },
+
+                PValue::String(str) => match *ty {
+                    Type::TEXT | Type::VARCHAR | Type::NAME => str.to_sql(ty, out),
+                    Type::BYTEA => {
+                        let val = str.as_bytes();
+                        val.to_sql(ty, out)
+                    }
+                    Type::TIMESTAMP => {
+                        let val = str.parse::<chrono::NaiveDateTime>().map_err(Box::new)?;
+                        val.to_sql(ty, out)
+                    }
+                    Type::TIMESTAMPTZ => {
+                        let val = chrono::DateTime::parse_from_rfc3339(str).map_err(Box::new)?;
+                        val.with_timezone(&chrono::Utc).to_sql(ty, out)
+                    }
+                    Type::DATE => {
+                        let val =
+                            chrono::NaiveDate::parse_from_str(str, "%Y-%m-%d").map_err(Box::new)?;
+                        val.to_sql(ty, out)
+                    }
+                    Type::TIME => {
+                        let val =
+                            chrono::NaiveTime::parse_from_str(str, "%H:%M:%S").map_err(Box::new)?;
+                        val.to_sql(ty, out)
+                    }
+                    Type::UUID => {
+                        let val = Uuid::parse_str(str).context("unable to parse uuid")?;
+                        val.to_sql(ty, out)
+                    }
+                    Type::CIDR => {
+                        let val = cidr::IpCidr::from_str(str).context("unable to parse cidr")?;
+                        val.to_sql(ty, out)
+                    }
+                    Type::INET => {
+                        let val = cidr::IpInet::from_str(str).context("unable to parse inet")?;
+                        val.to_sql(ty, out)
+                    }
+                    Type::NUMERIC => {
+                        let d = Decimal::from_str(str)?;
+                        d.to_sql(ty, out)
+                    }
+                    _ => {
+                        if let Kind::Enum(_) = ty.kind() {
+                            str.to_sql(ty, out)
+                        } else if is_pgvector(ty) {
+                            let val: pgvector::Vector =
+                                serde_json::from_str(str).context("unable to parse vector")?;
+                            val.to_sql(ty, out)
+                        } else {
+                            Err(format!("string not supported for column of type {ty}").into())
+                        }
+                    }
+                },
+
+                PValue::Number(num) => match *ty {
+                    Type::INT2 => {
+                        let val: Result<i16, _> = if num.is_i64() {
+                            num.as_i64().unwrap().try_into()
+                        } else if num.is_u64() {
+                            num.as_u64().unwrap().try_into()
+                        } else if num.is_f64() {
+                            let float = num.as_f64().unwrap();
+                            let res = float as i16;
+                            if res as f64 == float {
+                                Ok(res)
+                            } else {
+                                return Err(format!("number {float} is not an i16").into());
+                            }
+                        } else {
+                            return Err(format!("unsupported number: {num:?}").into());
+                        };
+                        val.map_err(Box::new)?.to_sql(ty, out)
+                    }
+                    Type::INT4 => {
+                        let val: Result<i32, _> = if num.is_i64() {
+                            num.as_i64().unwrap().try_into()
+                        } else if num.is_u64() {
+                            num.as_u64().unwrap().try_into()
+                        } else if num.is_f64() {
+                            let float = num.as_f64().unwrap();
+                            let res = float as i32;
+                            if res as f64 == float {
+                                Ok(res)
+                            } else {
+                                return Err(format!("number {float} is not an i32").into());
+                            }
+                        } else {
+                            return Err(format!("unsupported number: {num:?}").into());
+                        };
+                        val.map_err(Box::new)?.to_sql(ty, out)
+                    }
+                    Type::INT8 => {
+                        let val: Result<i64, _> = if num.is_i64() {
+                            Ok(num.as_i64().unwrap())
+                        } else if num.is_u64() {
+                            num.as_u64().unwrap().try_into()
+                        } else if num.is_f64() {
+                            let float = num.as_f64().unwrap();
+                            let res = float as i64;
+                            if res as f64 == float {
+                                Ok(res)
+                            } else {
+                                return Err(format!("number {float} is not an i64").into());
+                            }
+                        } else {
+                            return Err(format!("unsupported number: {num:?}").into());
+                        };
+                        val.map_err(Box::new)?.to_sql(ty, out)
+                    }
+                    Type::FLOAT4 => {
+                        let val: f32 = if num.is_i64() {
+                            num.as_i64().unwrap() as f32
+                        } else if num.is_u64() {
+                            num.as_u64().unwrap() as f32
+                        } else if num.is_f64() {
+                            num.as_f64().unwrap() as f32
+                        } else {
+                            return Err(format!("unsupported number: {num:?}").into());
+                        };
+                        val.to_sql(ty, out)
+                    }
+                    Type::FLOAT8 => {
+                        let val: f64 = if num.is_i64() {
+                            num.as_i64().unwrap() as f64
+                        } else if num.is_u64() {
+                            num.as_u64().unwrap() as f64
+                        } else if num.is_f64() {
+                            num.as_f64().unwrap()
+                        } else {
+                            return Err(format!("unsupported number: {num:?}").into());
+                        };
+                        val.to_sql(ty, out)
+                    }
+                    Type::OID => {
+                        let val: Result<u32, _> = if num.is_i64() {
+                            num.as_i64().unwrap().try_into()
+                        } else if num.is_u64() {
+                            num.as_u64().unwrap().try_into()
+                        } else if num.is_f64() {
+                            let float = num.as_f64().unwrap();
+                            let res = float as u32;
+                            if res as f64 == float {
+                                Ok(res)
+                            } else {
+                                return Err(format!("number {float} is not an u32").into());
+                            }
+                        } else {
+                            return Err(format!("unsupported number: {num:?}").into());
+                        };
+                        val.map_err(Box::new)?.to_sql(ty, out)
+                    }
+                    Type::NUMERIC => {
+                        let num_str = num.to_string();
+                        let d = Decimal::from_str(&num_str)?;
+                        d.to_sql(ty, out)
+                    }
+                    Type::TEXT | Type::VARCHAR => self.to_string().to_sql(ty, out),
+                    _ => {
+                        if num.is_i64() {
+                            num.as_i64().unwrap().to_sql(ty, out)
+                        } else if num.is_u64() {
+                            (num.as_u64().unwrap() as i64).to_sql(ty, out)
+                        } else if num.is_f64() {
+                            num.as_f64().unwrap().to_sql(ty, out)
+                        } else {
+                            Err(format!("unsupported number: {num:?}").into())
+                        }
+                    }
+                },
+                PValue::Decimal(d) => match *ty {
+                    Type::NUMERIC => d.to_sql(ty, out),
+                    Type::FLOAT4 => {
+                        let val =
+                            f32::try_from(d).map_err(|_| "Cannot convert decimal to FLOAT4")?;
+                        val.to_sql(ty, out)
+                    }
+                    Type::FLOAT8 => {
+                        let val =
+                            f64::try_from(d).map_err(|_| "Cannot convert decimal to FLOAT8")?;
+                        val.to_sql(ty, out)
+                    }
+                    Type::INT2 => {
+                        let val = i16::try_from(d).map_err(|_| "Cannot convert decimal to INT2")?;
+                        val.to_sql(ty, out)
+                    }
+                    Type::INT4 => {
+                        let val = i32::try_from(d).map_err(|_| "Cannot convert decimal to INT4")?;
+                        val.to_sql(ty, out)
+                    }
+                    Type::INT8 => {
+                        let val = i64::try_from(d).map_err(|_| "Cannot convert decimal to INT8")?;
+                        val.to_sql(ty, out)
+                    }
+                    Type::TEXT | Type::VARCHAR => {
+                        let decimal_str = d.to_string();
+                        decimal_str.to_sql(ty, out)
+                    }
+
+                    _ => Err(format!("unsupported type for Decimal: {ty}").into()),
+                },
+                PValue::DateTime(dt) => match *ty {
+                    Type::DATE => dt.naive_utc().date().to_sql(ty, out),
+                    Type::TIMESTAMP => dt.naive_utc().to_sql(ty, out),
+                    Type::TIMESTAMPTZ => dt.to_sql(ty, out),
+                    Type::TEXT | Type::VARCHAR => dt.to_rfc3339().to_sql(ty, out),
+                    _ => Err(format!("unsupported type for DateTime: {ty}").into()),
+                },
+                PValue::Array(arr) => {
+                    if is_pgvector(ty) {
+                        let floats = arr
+                            .iter()
+                            .map(|v| match v {
+                                PValue::Number(n) => n
+                                    .as_f64()
+                                    .or_else(|| n.as_i64().map(|i| i as f64))
+                                    .or_else(|| n.as_u64().map(|u| u as f64))
+                                    .map(|f| f as f32)
+                                    .ok_or_else(|| "vector element must be a number".into()),
+                                _ => Err("vector element must be a number".into()),
+                            })
+                            .collect::<Result<Vec<f32>, Box<dyn Error + Sync + Send>>>()?;
+                        pgvector::Vector::from(floats).to_sql(ty, out)
+                    } else {
+                        arr.to_sql(ty, out)
+                    }
+                }
+                PValue::Object(_) => {
+                    Err(format!("object not supported for column of type {ty}").into())
+                }
+                PValue::Cookie(_) => {
+                    Err(format!("cookie not supported for column of type {ty}").into())
+                }
+            },
+        }
+    }
+
+    fn accepts(ty: &Type) -> bool {
+        matches!(
+            *ty,
+            Type::BOOL
+                | Type::BYTEA
+                | Type::TEXT
+                | Type::VARCHAR
+                | Type::INT2
+                | Type::INT4
+                | Type::INT8
+                | Type::OID
+                | Type::JSONB
+                | Type::JSON
+                | Type::UUID
+                | Type::FLOAT4
+                | Type::FLOAT8
+                | Type::TIMESTAMP
+                | Type::TIMESTAMPTZ
+                | Type::DATE
+                | Type::TIME
+                | Type::INET
+                | Type::CIDR
+                | Type::NAME
+                | Type::NUMERIC
+        ) || matches!(ty.kind(), Kind::Enum(_))
+            || matches!(ty.kind(), Kind::Array(ty) if <PValue as ToSql>::accepts(ty))
+            || is_pgvector(ty)
+    }
+    to_sql_checked!();
+}
+
+impl<'a> FromSql<'a> for RowValue {
+    fn from_sql(ty: &Type, raw: &'a [u8]) -> Result<Self, Box<dyn Error + Sync + Send>> {
+        Ok(match *ty {
+            Type::BYTEA => {
+                let val: Vec<u8> = FromSql::from_sql(ty, raw)?;
+                Self::Bytes(val)
+            }
+            Type::UUID => {
+                let val: uuid::Uuid = FromSql::from_sql(ty, raw)?;
+                Self::Uuid(val)
+            }
+            Type::CIDR => {
+                let val: cidr::IpCidr = FromSql::from_sql(ty, raw)?;
+                Self::Cidr(val)
+            }
+            Type::INET => {
+                let val: cidr::IpInet = FromSql::from_sql(ty, raw)?;
+                Self::Inet(val)
+            }
+            _ => {
+                if <PValue as FromSql>::accepts(ty) {
+                    Self::PVal(FromSql::from_sql(ty, raw)?)
+                } else {
+                    return Err(format!("unsupported type: {ty:?}").into());
+                }
+            }
+        })
+    }
+
+    fn from_sql_null(_: &Type) -> Result<Self, Box<dyn Error + Sync + Send>> {
+        Ok(Self::PVal(PValue::Null))
+    }
+
+    fn accepts(ty: &Type) -> bool {
+        matches!(*ty, Type::BYTEA | Type::UUID | Type::CIDR | Type::INET)
+            || matches!(ty.kind(), Kind::Array(ty) if <RowValue as FromSql>::accepts(ty))
+            || <PValue as FromSql>::accepts(ty)
+    }
+}
+
+impl<'a> FromSql<'a> for PValue {
+    fn from_sql(ty: &Type, raw: &'a [u8]) -> Result<Self, Box<dyn Error + Sync + Send>> {
+        Ok(match *ty {
+            Type::BOOL => {
+                let val: bool = FromSql::from_sql(ty, raw)?;
+                PValue::Bool(val)
+            }
+            Type::TEXT | Type::VARCHAR | Type::NAME => {
+                let val: String = FromSql::from_sql(ty, raw)?;
+                PValue::String(val)
+            }
+            Type::INT2 => {
+                let val: i16 = FromSql::from_sql(ty, raw)?;
+                PValue::Number(serde_json::Number::from(val))
+            }
+            Type::INT4 => {
+                let val: i32 = FromSql::from_sql(ty, raw)?;
+                PValue::Number(serde_json::Number::from(val))
+            }
+            Type::INT8 => {
+                let val: i64 = FromSql::from_sql(ty, raw)?;
+                PValue::Number(serde_json::Number::from(val))
+            }
+            Type::OID => {
+                let val: u32 = FromSql::from_sql(ty, raw)?;
+                PValue::Number(serde_json::Number::from(val))
+            }
+            Type::JSON | Type::JSONB => {
+                let val: serde_json::Value = FromSql::from_sql(ty, raw)?;
+                val.into()
+            }
+            Type::FLOAT4 => {
+                let val: f32 = FromSql::from_sql(ty, raw)?;
+                match serde_json::Number::from_f64(val as f64) {
+                    Some(num) => PValue::Number(num),
+                    None => PValue::Null,
+                }
+            }
+            Type::FLOAT8 => {
+                let val: f64 = FromSql::from_sql(ty, raw)?;
+                match serde_json::Number::from_f64(val) {
+                    Some(num) => PValue::Number(num),
+                    None => PValue::Null,
+                }
+            }
+            Type::NUMERIC => {
+                let d = Decimal::from_sql(ty, raw)?;
+                PValue::Decimal(d)
+            }
+            Type::TIMESTAMP => {
+                let val: DateTime = FromSql::from_sql(ty, raw)?;
+                PValue::DateTime(val)
+            }
+            Type::TIMESTAMPTZ => {
+                let val: DateTime = FromSql::from_sql(ty, raw)?;
+                PValue::DateTime(val)
+            }
+            Type::DATE => {
+                let val: chrono::NaiveDate = FromSql::from_sql(ty, raw)?;
+                PValue::String(val.to_string())
+            }
+            Type::TIME => {
+                let val: chrono::NaiveTime = FromSql::from_sql(ty, raw)?;
+                PValue::String(val.to_string())
+            }
+            Type::CIDR => {
+                let val: cidr::IpCidr = FromSql::from_sql(ty, raw)?;
+                PValue::String(val.to_string())
+            }
+            Type::INET => {
+                let val: cidr::IpInet = FromSql::from_sql(ty, raw)?;
+                PValue::String(val.to_string())
+            }
+
+            _ => {
+                if let Kind::Array(_) = ty.kind() {
+                    let val: Vec<_> = FromSql::from_sql(ty, raw)?;
+                    PValue::Array(val)
+                } else if let Kind::Enum(_) = ty.kind() {
+                    let val = std::str::from_utf8(raw)?;
+                    PValue::String(val.to_string())
+                } else if is_pgvector(ty) {
+                    let val: pgvector::Vector = FromSql::from_sql(ty, raw)?;
+                    let arr = val
+                        .as_slice()
+                        .iter()
+                        .map(|n| match serde_json::Number::from_f64(*n as f64) {
+                            Some(num) => PValue::Number(num),
+                            None => PValue::Null,
+                        })
+                        .collect();
+                    PValue::Array(arr)
+                } else {
+                    return Err(format!("unsupported type: {ty:?}").into());
+                }
+            }
+        })
+    }
+
+    fn from_sql_null(_: &Type) -> Result<Self, Box<dyn Error + Sync + Send>> {
+        Ok(PValue::Null)
+    }
+
+    fn accepts(ty: &Type) -> bool {
+        matches!(
+            *ty,
+            Type::BOOL
+                | Type::TEXT
+                | Type::VARCHAR
+                | Type::INT2
+                | Type::INT4
+                | Type::INT8
+                | Type::OID
+                | Type::JSONB
+                | Type::JSON
+                | Type::FLOAT4
+                | Type::FLOAT8
+                | Type::TIMESTAMP
+                | Type::TIMESTAMPTZ
+                | Type::DATE
+                | Type::TIME
+                | Type::CIDR
+                | Type::INET
+                | Type::NAME
+                | Type::NUMERIC
+        ) || matches!(ty.kind(), Kind::Enum(_))
+            || matches!(ty.kind(), Kind::Array(ty) if <PValue as FromSql>::accepts(ty))
+            || is_pgvector(ty)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use bytes::BytesMut;
+    use serde_json::json;
+    use tokio_postgres::types::Type;
+
+    #[test]
+    fn test_rowvalue_to_sql_bytes() {
+        let value = RowValue::Bytes(vec![1, 2, 3]);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&Type::BYTEA, &mut buf);
+        assert!(result.is_ok());
+        assert_eq!(buf, vec![1, 2, 3]);
+    }
+
+    #[test]
+    fn test_rowvalue_to_sql_uuid() {
+        let uuid = Uuid::nil();
+        let value = RowValue::Uuid(uuid);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&Type::UUID, &mut buf);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_rowvalue_to_sql_pval() {
+        let value = RowValue::PVal(PValue::String("test".to_string()));
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&Type::TEXT, &mut buf);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_pvalue_to_sql_json() {
+        let value: PValue = json!({"key": "value"}).into();
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&Type::JSONB, &mut buf);
+        assert!(result.is_ok());
+        assert_eq!(buf[0], 1); // JSONB prefix
+    }
+
+    #[test]
+    fn test_pvalue_to_sql_number() {
+        let value = PValue::Number(serde_json::Number::from(42));
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&Type::INT4, &mut buf);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_rowvalue_from_sql_bytes() {
+        let raw = &[1, 2, 3];
+        let result = RowValue::from_sql(&Type::BYTEA, raw);
+        assert!(result.is_ok());
+        if let RowValue::Bytes(val) = result.unwrap() {
+            assert_eq!(val, vec![1, 2, 3]);
+        } else {
+            panic!("Expected RowValue::Bytes");
+        }
+    }
+
+    #[test]
+    fn test_rowvalue_from_sql_uuid() {
+        let uuid = Uuid::nil();
+        let raw = uuid.as_bytes();
+        let result = RowValue::from_sql(&Type::UUID, raw);
+        assert!(result.is_ok());
+        if let RowValue::Uuid(val) = result.unwrap() {
+            assert_eq!(val, uuid);
+        } else {
+            panic!("Expected RowValue::Uuid");
+        }
+    }
+
+    #[test]
+    fn test_rowvalue_to_sql_cidr() {
+        let cidr = cidr::IpCidr::new(std::net::Ipv4Addr::new(192, 168, 0, 0).into(), 16).unwrap();
+        let value = RowValue::Cidr(cidr);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&Type::CIDR, &mut buf);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_rowvalue_from_sql_cidr() {
+        let cidr = cidr::IpCidr::new(std::net::Ipv4Addr::new(192, 168, 0, 0).into(), 16).unwrap();
+        let mut buf = BytesMut::new();
+        cidr.to_sql(&Type::CIDR, &mut buf).unwrap();
+        let result = RowValue::from_sql(&Type::CIDR, &buf);
+        assert!(result.is_ok());
+        if let RowValue::Cidr(val) = result.unwrap() {
+            assert_eq!(val, cidr);
+        } else {
+            panic!("Expected RowValue::Cidr");
+        }
+    }
+
+    #[test]
+    fn test_rowvalue_to_sql_inet() {
+        let inet = cidr::IpInet::new_host(std::net::Ipv4Addr::new(192, 168, 1, 1).into());
+        let value = RowValue::Inet(inet);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&Type::INET, &mut buf);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_rowvalue_from_sql_inet() {
+        let inet = cidr::IpInet::new_host(std::net::Ipv4Addr::new(192, 168, 1, 1).into());
+        let mut buf = BytesMut::new();
+        inet.to_sql(&Type::INET, &mut buf).unwrap();
+        let result = RowValue::from_sql(&Type::INET, &buf);
+        assert!(result.is_ok());
+        if let RowValue::Inet(val) = result.unwrap() {
+            assert_eq!(val, inet);
+        } else {
+            panic!("Expected RowValue::Inet");
+        }
+    }
+
+    #[test]
+    fn test_pvalue_from_sql_bool() {
+        let raw = &[1]; // true
+        let result = PValue::from_sql(&Type::BOOL, raw);
+        assert!(result.is_ok());
+        if let PValue::Bool(val) = result.unwrap() {
+            assert!(val);
+        } else {
+            panic!("Expected PValue::Bool");
+        }
+    }
+
+    #[test]
+    fn test_pvalue_from_sql_string() {
+        let raw = b"test";
+        let result = PValue::from_sql(&Type::TEXT, raw);
+        assert!(result.is_ok());
+        if let PValue::String(val) = result.unwrap() {
+            assert_eq!(val, "test");
+        } else {
+            panic!("Expected PValue::String");
+        }
+    }
+
+    #[test]
+    fn test_pvalue_from_sql_name() {
+        let raw = b"test";
+        let result = PValue::from_sql(&Type::NAME, raw);
+        assert!(result.is_ok());
+        if let PValue::String(val) = result.unwrap() {
+            assert_eq!(val, "test");
+        } else {
+            panic!("Expected PValue::String");
+        }
+    }
+
+    #[test]
+    fn test_pvalue_from_sql_number() {
+        let raw = &[0, 0, 0, 42]; // INT4 representation of 42
+        let result = PValue::from_sql(&Type::INT4, raw);
+        assert!(result.is_ok());
+        if let PValue::Number(val) = result.unwrap() {
+            assert_eq!(val.as_i64().unwrap(), 42);
+        } else {
+            panic!("Expected PValue::Number");
+        }
+    }
+
+    #[test]
+    fn test_pvalue_to_sql_invalid_type() {
+        let value = PValue::String("test".to_string());
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&Type::BOOL, &mut buf); // Invalid type
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_rowvalue_from_sql_invalid_type() {
+        let raw = &[1, 2, 3];
+        let result = RowValue::from_sql(&Type::BOOL, raw); // Invalid type
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_pvalue_from_sql_null() {
+        let result = PValue::from_sql_null(&Type::TEXT);
+        assert!(result.is_ok());
+        if let PValue::Null = result.unwrap() {
+            // Expected null value
+        } else {
+            panic!("Expected PValue::Null");
+        }
+    }
+
+    #[test]
+    fn test_rowvalue_from_sql_null() {
+        let result = RowValue::from_sql_null(&Type::TEXT);
+        assert!(result.is_ok());
+        if let RowValue::PVal(PValue::Null) = result.unwrap() {
+            // Expected null value
+        } else {
+            panic!("Expected RowValue::PVal(PValue::Null)");
+        }
+    }
+
+    #[test]
+    fn test_pvalue_to_sql_array() {
+        let value = PValue::Array(vec![
+            PValue::Number(serde_json::Number::from(1)),
+            PValue::Number(serde_json::Number::from(2)),
+        ]);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&Type::INT4_ARRAY, &mut buf);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_pvalue_from_sql_array() {
+        // raw representation of INT4_ARRAY with values 1,2,3
+        let raw: &[u8] = &[
+            0, 0, 0, 1, // dimentions
+            0, 0, 0, 0, // has nulls
+            0, 0, 0, 23, // element type
+            0, 0, 0, 3, // array length
+            0, 0, 0, 1, // lower bound
+            0, 0, 0, 4, // value length
+            0, 0, 0, 1, // value
+            0, 0, 0, 4, // value length
+            0, 0, 0, 2, // value
+            0, 0, 0, 4, // value length
+            0, 0, 0, 3, // value
+        ];
+
+        let result = PValue::from_sql(&Type::INT4_ARRAY, raw);
+        assert!(result.is_ok());
+        if let PValue::Array(val) = result.unwrap() {
+            assert_eq!(val.len(), 3);
+            assert_eq!(
+                val,
+                vec![
+                    PValue::Number(1.into()),
+                    PValue::Number(2.into()),
+                    PValue::Number(3.into())
+                ]
+            );
+        } else {
+            panic!("Expected PValue::Array");
+        }
+    }
+
+    #[test]
+    fn test_pvalue_to_sql_pgvector_from_string() {
+        // Create a mock vector type
+        let vector_type = Type::new("vector".to_string(), 0, Kind::Simple, "".to_string());
+
+        // Test valid vector string
+        let value = PValue::String("[1.0, 2.0, 3.0]".to_string());
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&vector_type, &mut buf);
+        assert!(result.is_ok());
+
+        // Test invalid vector string
+        let value = PValue::String("invalid".to_string());
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&vector_type, &mut buf);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_pvalue_to_sql_pgvector_from_array() {
+        // Create a mock vector type
+        let vector_type = Type::new("vector".to_string(), 0, Kind::Simple, "".to_string());
+
+        // Test valid array of numbers
+        let value = PValue::Array(vec![
+            PValue::Number(serde_json::Number::from_f64(1.0).unwrap()),
+            PValue::Number(serde_json::Number::from_f64(2.5).unwrap()),
+            PValue::Number(serde_json::Number::from_f64(3.75).unwrap()),
+        ]);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&vector_type, &mut buf);
+        assert!(result.is_ok());
+
+        // Test array with integer numbers (should convert to f32)
+        let value = PValue::Array(vec![
+            PValue::Number(serde_json::Number::from(1)),
+            PValue::Number(serde_json::Number::from(2)),
+            PValue::Number(serde_json::Number::from(3)),
+        ]);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&vector_type, &mut buf);
+        assert!(result.is_ok());
+
+        // Test array with non-number elements
+        let value = PValue::Array(vec![
+            PValue::Number(serde_json::Number::from(1)),
+            PValue::String("not a number".to_string()),
+        ]);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&vector_type, &mut buf);
+        assert!(result.is_err());
+
+        // Test array with null
+        let value = PValue::Array(vec![
+            PValue::Number(serde_json::Number::from(1)),
+            PValue::Null,
+        ]);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&vector_type, &mut buf);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_pvalue_from_sql_pgvector() {
+        // Create a mock vector type
+        let vector_type = Type::new("vector".to_string(), 0, Kind::Simple, "".to_string());
+
+        // Create a pgvector and serialize it
+        let vector = pgvector::Vector::from(vec![1.0f32, 2.5f32, 3.75f32]);
+        let mut buf = BytesMut::new();
+        vector.to_sql(&vector_type, &mut buf).unwrap();
+
+        // Test deserialization
+        let result = PValue::from_sql(&vector_type, &buf);
+        assert!(result.is_ok());
+
+        if let PValue::Array(arr) = result.unwrap() {
+            assert_eq!(arr.len(), 3);
+
+            // Check values (allowing for float precision)
+            if let PValue::Number(n) = &arr[0] {
+                assert_eq!(n.as_f64().unwrap(), 1.0);
+            } else {
+                panic!("Expected PValue::Number");
+            }
+
+            if let PValue::Number(n) = &arr[1] {
+                assert_eq!(n.as_f64().unwrap(), 2.5);
+            } else {
+                panic!("Expected PValue::Number");
+            }
+
+            if let PValue::Number(n) = &arr[2] {
+                assert_eq!(n.as_f64().unwrap(), 3.75);
+            } else {
+                panic!("Expected PValue::Number");
+            }
+        } else {
+            panic!("Expected PValue::Array");
+        }
+    }
+
+    #[test]
+    fn test_pgvector_roundtrip() {
+        // Create a mock vector type
+        let vector_type = Type::new("vector".to_string(), 0, Kind::Simple, "".to_string());
+
+        // Test roundtrip with array input
+        let original = PValue::Array(vec![
+            PValue::Number(serde_json::Number::from_f64(1.1).unwrap()),
+            PValue::Number(serde_json::Number::from_f64(2.2).unwrap()),
+            PValue::Number(serde_json::Number::from_f64(3.3).unwrap()),
+        ]);
+
+        // Serialize
+        let mut buf = BytesMut::new();
+        original.to_sql(&vector_type, &mut buf).unwrap();
+
+        // Deserialize
+        let deserialized = PValue::from_sql(&vector_type, &buf).unwrap();
+
+        // Verify
+        if let PValue::Array(arr) = deserialized {
+            assert_eq!(arr.len(), 3);
+            if let (PValue::Number(n1), PValue::Number(n2), PValue::Number(n3)) =
+                (&arr[0], &arr[1], &arr[2])
+            {
+                assert!((n1.as_f64().unwrap() - 1.1).abs() < 0.01);
+                assert!((n2.as_f64().unwrap() - 2.2).abs() < 0.01);
+                assert!((n3.as_f64().unwrap() - 3.3).abs() < 0.01);
+            } else {
+                panic!("Expected all elements to be numbers");
+            }
+        } else {
+            panic!("Expected PValue::Array");
+        }
+    }
+
+    #[test]
+    fn test_pgvector_edge_cases() {
+        // Create a mock vector type
+        let vector_type = Type::new("vector".to_string(), 0, Kind::Simple, "".to_string());
+
+        // Test empty vector
+        let value = PValue::Array(vec![]);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&vector_type, &mut buf);
+        assert!(result.is_ok());
+
+        // Test single element vector
+        let value = PValue::Array(vec![PValue::Number(
+            serde_json::Number::from_f64(42.0).unwrap(),
+        )]);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&vector_type, &mut buf);
+        assert!(result.is_ok());
+
+        // Test with special float values
+        let value = PValue::Array(vec![
+            PValue::Number(serde_json::Number::from_f64(0.0).unwrap()),
+            PValue::Number(serde_json::Number::from_f64(-1.0).unwrap()),
+            PValue::Number(serde_json::Number::from_f64(f64::MAX).unwrap()),
+        ]);
+        let mut buf = BytesMut::new();
+        let result = value.to_sql(&vector_type, &mut buf);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn test_pgvector_nan_infinity_handling() {
+        // Create a mock vector type
+        let vector_type = Type::new("vector".to_string(), 0, Kind::Simple, "".to_string());
+
+        // Test that NaN values result in PValue::Null when deserializing
+        let vector = pgvector::Vector::from(vec![1.0f32, f32::NAN, 3.0f32]);
+        let mut buf = BytesMut::new();
+        vector.to_sql(&vector_type, &mut buf).unwrap();
+
+        let result = PValue::from_sql(&vector_type, &buf).unwrap();
+        if let PValue::Array(arr) = result {
+            assert_eq!(arr.len(), 3);
+            assert!(matches!(&arr[0], PValue::Number(_)));
+            assert!(matches!(&arr[1], PValue::Null)); // NaN becomes Null
+            assert!(matches!(&arr[2], PValue::Number(_)));
+        } else {
+            panic!("Expected PValue::Array");
+        }
+
+        // Test positive infinity
+        let vector = pgvector::Vector::from(vec![f32::INFINITY]);
+        let mut buf = BytesMut::new();
+        vector.to_sql(&vector_type, &mut buf).unwrap();
+
+        let result = PValue::from_sql(&vector_type, &buf).unwrap();
+        if let PValue::Array(arr) = result {
+            assert_eq!(arr.len(), 1);
+            assert!(matches!(&arr[0], PValue::Null)); // Infinity becomes Null
+        } else {
+            panic!("Expected PValue::Array");
+        }
+
+        // Test negative infinity
+        let vector = pgvector::Vector::from(vec![f32::NEG_INFINITY]);
+        let mut buf = BytesMut::new();
+        vector.to_sql(&vector_type, &mut buf).unwrap();
+
+        let result = PValue::from_sql(&vector_type, &buf).unwrap();
+        if let PValue::Array(arr) = result {
+            assert_eq!(arr.len(), 1);
+            assert!(matches!(&arr[0], PValue::Null)); // Negative infinity becomes Null
+        } else {
+            panic!("Expected PValue::Array");
+        }
+    }
+}
diff --git a/runtimes/core/src/trace/eventbuf.rs b/runtimes/core/src/trace/eventbuf.rs
new file mode 100644
index 0000000000..97109a1ef9
--- /dev/null
+++ b/runtimes/core/src/trace/eventbuf.rs
@@ -0,0 +1,254 @@
+#![allow(dead_code)]
+
+use crate::{api, error::StackTrace};
+
+use bytes::{BufMut, Bytes, BytesMut};
+
+/// A buffer for encoding trace events.
+pub struct EventBuffer {
+    scratch: [u8; 10],
+    buf: BytesMut,
+}
+
+impl AsRef<[u8]> for EventBuffer {
+    fn as_ref(&self) -> &[u8] {
+        &self.buf
+    }
+}
+
+impl EventBuffer {
+    pub fn with_capacity(size: usize) -> Self {
+        EventBuffer {
+            scratch: [0; 10],
+            buf: BytesMut::with_capacity(size),
+        }
+    }
+
+    pub(super) fn freeze(self) -> Bytes {
+        self.buf.freeze()
+    }
+
+    /// Writes a single byte.
+    #[inline]
+    pub fn byte(&mut self, byte: u8) {
+        self.buf.reserve(1);
+        self.buf.put_u8(byte);
+    }
+
+    /// Writes a known number of bytes.
+    #[inline]
+    pub fn bytes<const N: usize>(&mut self, bytes: &[u8; N]) {
+        self.buf.reserve(N);
+        self.buf.put_slice(bytes);
+    }
+
+    /// Ensures the buffer has enough capacity for `additional` bytes.
+    /// Used to avoid additional allocations.
+    #[inline]
+    pub fn reserve(&mut self, additional: usize) {
+        self.buf.reserve(additional);
+    }
+
+    /// Writes a variable-length string.
+    #[inline]
+    pub fn str<S: AsRef<str>>(&mut self, str: S) {
+        self.byte_string(str.as_ref().as_bytes());
+    }
+
+    /// Writes a variable-length byte string.
+    #[inline]
+    pub fn byte_string(&mut self, bytes: &[u8]) {
+        // 10 bytes is the maximum length of a uvarint.
+        self.buf.reserve(10 + bytes.len());
+
+        self.uvarint(bytes.len() as u64);
+        self.buf.extend_from_slice(bytes);
+    }
+
+    /// Writes a variable-length truncated byte string.
+    /// If truncation is necessary, the `truncation_suffix` is appended to the end of the string,
+    /// leading to the final length being `max_len + truncation_suffix.len()`.
+    #[inline]
+    pub fn truncated_byte_string(
+        &mut self,
+        bytes: &[u8],
+        max_len: usize,
+        truncation_suffix: &[u8],
+    ) {
+        if bytes.len() <= max_len {
+            self.byte_string(bytes);
+        } else {
+            let combined_len = max_len + truncation_suffix.len();
+            self.uvarint(combined_len as u64);
+            self.buf.reserve(combined_len);
+            self.buf.put_slice(&bytes[..max_len]);
+            self.buf.put_slice(truncation_suffix);
+        }
+    }
+
+    /// Writes a single boolean bit.
+    #[inline]
+    pub fn bool(&mut self, b: bool) {
+        self.byte(if b { 1 } else { 0 });
+    }
+
+    /// Writes the current system time.
+    #[inline]
+    pub fn system_time_now(&mut self) {
+        self.system_time(std::time::SystemTime::now());
+    }
+
+    /// Writes a system time.
+    #[inline]
+    pub fn system_time(&mut self, time: std::time::SystemTime) {
+        let duration = time
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("time is before UNIX_EPOCH");
+        self.buf.reserve(8 + 4);
+        self.i64(duration.as_secs() as i64);
+        self.i32(duration.subsec_nanos() as i32);
+    }
+
+    /// Writes an UTC timestamp.
+    #[inline]
+    pub fn time(&mut self, time: &chrono::DateTime<chrono::Utc>) {
+        self.buf.reserve(8 + 4);
+        self.i64(time.timestamp());
+        self.i32(time.timestamp_subsec_nanos() as i32);
+    }
+
+    /// Writes a variable-length signed integer.
+    #[inline]
+    pub fn ivarint<I: Into<i64>>(&mut self, i: I) {
+        self.uvarint(signed_to_unsigned_i64(i.into()));
+    }
+
+    /// Writes a variable-length unsigned integer.
+    #[inline]
+    pub fn uvarint<U: Into<u64>>(&mut self, u: U) {
+        let mut u: u64 = u.into();
+        let mut i = 0;
+        while u >= 0x80 {
+            self.scratch[i] = (u as u8) | 0x80;
+            u >>= 7;
+            i += 1;
+        }
+        self.scratch[i] = u as u8;
+        i += 1;
+        self.buf.extend_from_slice(&self.scratch[..i]);
+    }
+
+    /// Writes a float, always as 8 bytes.
+    #[inline]
+    pub fn f64(&mut self, f: f64) {
+        let data: [u8; 8] = f.to_le_bytes();
+        self.buf.extend_from_slice(&data);
+    }
+
+    /// Writes a signed integer, always as 8 bytes.
+    #[inline]
+    pub fn i64(&mut self, i: i64) {
+        self.u64(signed_to_unsigned_i64(i));
+    }
+
+    /// Writes an unsigned integer, always as 8 bytes.
+    #[inline]
+    pub fn u64(&mut self, u: u64) {
+        let data: [u8; 8] = u.to_le_bytes();
+        self.buf.extend_from_slice(&data);
+    }
+
+    /// Writes a signed integer, always as 4 bytes.
+    #[inline]
+    pub fn i32(&mut self, i: i32) {
+        self.u32(signed_to_unsigned_i32(i));
+    }
+
+    /// Writes an unsigned integer, always as 4 bytes.
+    #[inline]
+    pub fn u32(&mut self, u: u32) {
+        let data: [u8; 4] = u.to_le_bytes();
+        self.buf.extend_from_slice(&data);
+    }
+
+    /// Writes a duration.
+    #[inline]
+    pub fn duration(&mut self, duration: std::time::Duration) {
+        // The current trace protocol only supports durations that fit in an i64.
+        // If the duration exceeds that, truncate it to the maximum value.
+        //
+        // Note: Rust's duration type is for positive durations only, so we only consider
+        // the positive range of i64 here.
+        let nanos = duration.as_nanos();
+        let nanos: i64 = if nanos > i64::MAX as u128 {
+            i64::MAX
+        } else {
+            nanos as i64
+        };
+        self.ivarint(nanos);
+    }
+
+    #[inline]
+    pub fn api_err_with_legacy_stack(&mut self, err: Option<&api::Error>) {
+        match err {
+            Some(err) => {
+                let err = serde_json::to_string_pretty(err).unwrap_or("unknown error".to_string());
+                self.str(err);
+                self.nyi_stack_pcs()
+            }
+            None => self.str(""),
+        }
+    }
+
+    #[inline]
+    pub fn err_with_legacy_stack<E: std::fmt::Display>(&mut self, err: Option<&E>) {
+        match err {
+            Some(err) => {
+                let err = err.to_string();
+                self.str(&err);
+                self.nyi_stack_pcs()
+            }
+            None => self.str(""),
+        }
+    }
+
+    /// Adds the stack pcs to the buffer.
+    /// It's not supported for the new runtime yet, so it just writes 0 frames.
+    #[inline]
+    pub fn nyi_stack_pcs(&mut self) {
+        self.byte(0);
+    }
+
+    #[inline]
+    pub fn formatted_stack(&mut self, stack: Option<&StackTrace>) {
+        match stack {
+            Some(frames) => {
+                self.byte(frames.len().min(256) as u8);
+                for frame in frames.iter().take(256) {
+                    self.str(&frame.file);
+                    self.uvarint(frame.line);
+                    self.str(frame.function.as_deref().unwrap_or("unknown"));
+                }
+            }
+            None => self.byte(0),
+        }
+    }
+}
+
+#[inline]
+pub(super) fn signed_to_unsigned_i64(i: i64) -> u64 {
+    if i < 0 {
+        ((!(i as u64)) << 1) | 1 // complement i, bit 0 is 1
+    } else {
+        (i as u64) << 1 // do not complement i, bit 0 is 0
+    }
+}
+
+#[inline]
+pub(super) fn signed_to_unsigned_i32(i: i32) -> u32 {
+    if i < 0 {
+        ((!(i as u32)) << 1) | 1 // complement i, bit 0 is 1
+    } else {
+        (i as u32) << 1 // do not complement i, bit 0 is 0
+    }
+}
diff --git a/runtimes/core/src/trace/log.rs b/runtimes/core/src/trace/log.rs
new file mode 100644
index 0000000000..d5ccb40e97
--- /dev/null
+++ b/runtimes/core/src/trace/log.rs
@@ -0,0 +1,691 @@
+use std::sync::Arc;
+
+use crate::api::reqauth::platform;
+use bytes::Bytes;
+use futures::StreamExt;
+use tokio::sync::mpsc::UnboundedReceiver;
+use tokio_stream::wrappers::UnboundedReceiverStream;
+
+use crate::model;
+use crate::trace::eventbuf::signed_to_unsigned_i64;
+use crate::trace::protocol::{EventType, TRACE_VERSION};
+use crate::trace::time_anchor::TimeAnchor;
+use crate::trace::Tracer;
+
+pub struct ReporterConfig {
+    pub app_id: String,
+    pub env_id: String,
+    pub deploy_id: String,
+    pub app_commit: String,
+    pub trace_endpoint: reqwest::Url,
+    pub platform_validator: Arc<platform::RequestValidator>,
+}
+
+/// Sends traces to the trace server.
+#[must_use]
+pub struct Reporter {
+    rx: tokio::sync::mpsc::UnboundedReceiver<TraceEvent>,
+    anchor: TimeAnchor,
+    http_client: reqwest::Client,
+    config: ReporterConfig,
+}
+
+pub fn streaming_tracer(
+    http_client: reqwest::Client,
+    config: ReporterConfig,
+) -> (Tracer, Reporter) {
+    let (tx, rx) = tokio::sync::mpsc::unbounded_channel();
+    let tracer = Tracer::new(tx);
+
+    let anchor = TimeAnchor::new();
+    let reporter = Reporter {
+        rx,
+        anchor,
+        http_client,
+        config,
+    };
+    (tracer, reporter)
+}
+
+#[derive(Debug)]
+pub(super) struct TraceEvent {
+    pub typ: EventType,
+    pub id: model::TraceEventId,
+    pub data: Bytes,
+    pub span: model::SpanKey,
+    pub ts: tokio::time::Instant,
+}
+
+impl Reporter {
+    /// Starts reporting trace events to the trace server.
+    ///
+    /// This method runs in an infinite loop until all senders are dropped,
+    /// continuously collecting trace events and sending them to the trace server.
+    pub async fn start_reporting(mut self) {
+        let trace_headers = match self.create_trace_headers(self.anchor.trace_header().as_str()) {
+            Ok(trace_headers) => trace_headers,
+            Err(err) => {
+                log::error!("couldn't setup headers for tracing requests, exiting. Error: {err}");
+                return;
+            }
+        };
+
+        loop {
+            let mut body_sender = None;
+
+            let timeout_duration = std::time::Duration::from_millis(1000);
+            let mut no_data_timeout = Box::pin(tokio::time::sleep(timeout_duration));
+
+            loop {
+                tokio::select! {
+                    event = self.rx.recv() => {
+                        match event {
+                            Some(event) => {
+                                // Wait for at least one entry on rx before we open a HTTP request.
+                                if body_sender.is_none() {
+                                    match self.setup_trace_request(&trace_headers) {
+                                        Ok(sender) => body_sender = Some(sender),
+                                        Err(err) => {
+                                            log::error!("failed to create request: {err}");
+                                            break;
+                                        }
+                                    }
+                                }
+
+                                // Add the event to the stream
+                                if let Some(sender) = &body_sender {
+                                    if let Err(err) = sender.send(event) {
+                                        log::error!("failed to stream event: {err}");
+                                        break;
+                                    }
+                                }
+
+                                // Reset the timeout
+                                no_data_timeout = Box::pin(tokio::time::sleep(timeout_duration));
+                            }
+                            None => {
+                                // The stream is closed. This only happens if all senders have been dropped,
+                                // which should never happen in regular use.
+                                return;
+                            }
+                        }
+                    }
+                    _ = &mut no_data_timeout => {
+                        // Timeout reached with no new events
+                        if let Some(sender) = body_sender {
+                            // Close the stream and wait for a new event
+                            drop(sender);
+                        }
+                        break;
+                    }
+                }
+            }
+        }
+    }
+
+    fn create_body_stream(
+        &self,
+        rx: UnboundedReceiver<TraceEvent>,
+    ) -> impl futures::Stream<Item = Result<Bytes, std::io::Error>> {
+        let anchor = self.anchor.clone();
+        UnboundedReceiverStream::new(rx).flat_map(move |event| {
+            let streaming_event = StreamingTraceEvent { event };
+            futures::stream::iter(vec![
+                Ok::<_, std::io::Error>(streaming_event.header(&anchor)),
+                Ok::<_, std::io::Error>(streaming_event.event.data),
+            ])
+        })
+    }
+
+    fn setup_trace_request(
+        &self,
+        trace_headers: &reqwest::header::HeaderMap,
+    ) -> Result<tokio::sync::mpsc::UnboundedSender<TraceEvent>, String> {
+        {
+            let http_client: &reqwest::Client = &self.http_client;
+            let endpoint: &reqwest::Url = &self.config.trace_endpoint;
+            let validator: &Arc<platform::RequestValidator> = &self.config.platform_validator;
+            // Create a channel for the streaming body
+            let (tx, rx) = tokio::sync::mpsc::unbounded_channel::<TraceEvent>();
+
+            let mut req = match http_client
+                .post(endpoint.clone())
+                .headers(trace_headers.clone())
+                .body(reqwest::Body::wrap_stream(self.create_body_stream(rx)))
+                .build()
+            {
+                Ok(req) => req,
+                Err(err) => {
+                    return Err(format!("failed to build trace request: {err:?}"));
+                }
+            };
+
+            if let Err(err) = validator.sign_outgoing_request(&mut req) {
+                return Err(format!("failed to sign trace request: {err:?}"));
+            }
+
+            // Start the request
+            let request = http_client.execute(req);
+            tokio::spawn(async move {
+                match request.await {
+                    Ok(resp) if !resp.status().is_success() => {
+                        let status = resp.status();
+                        let body = resp.text().await.unwrap_or_else(|_| String::new());
+                        log::error!("failed to send trace: HTTP {}: {}", status, body);
+                    }
+                    Err(err) => {
+                        log::error!("failed to send trace: {}", err);
+                    }
+                    _ => {}
+                }
+            });
+
+            Ok(tx)
+        }
+    }
+
+    fn create_trace_headers(
+        &self,
+        trace_time_anchor: &str,
+    ) -> Result<reqwest::header::HeaderMap, reqwest::header::InvalidHeaderValue> {
+        use reqwest::header::*;
+        let mut headers = HeaderMap::new();
+
+        headers.insert(
+            "X-Encore-App-Id",
+            HeaderValue::from_str(&self.config.app_id)?,
+        );
+        headers.insert(
+            "X-Encore-Env-Id",
+            HeaderValue::from_str(&self.config.env_id)?,
+        );
+        headers.insert(
+            "X-Encore-Deploy-Id",
+            HeaderValue::from_str(&self.config.deploy_id)?,
+        );
+        headers.insert(
+            "X-Encore-App-Commit",
+            HeaderValue::from_str(&self.config.app_commit)?,
+        );
+        headers.insert("X-Encore-Trace-Version", HeaderValue::from(TRACE_VERSION));
+        headers.insert(
+            "X-Encore-Trace-TimeAnchor",
+            HeaderValue::from_str(trace_time_anchor)?,
+        );
+
+        Ok(headers)
+    }
+}
+
+/// Represents a trace event that is being streamed.
+#[derive(Debug)]
+struct StreamingTraceEvent {
+    /// The event itself.
+    event: TraceEvent,
+}
+
+impl StreamingTraceEvent {
+    fn header(&self, anchor: &TimeAnchor) -> Bytes {
+        let event_type = self.event.typ;
+        let event_id = self.event.id.0;
+        let trace_id = &self.event.span.0 .0;
+        let span_id = &self.event.span.1 .0;
+        let ln = self.event.data.len();
+
+        // Compute the timestamp, relative to the anchor's timestamp.
+        let ts = self
+            .event
+            .ts
+            .saturating_duration_since(anchor.instant)
+            .as_nanos() as i64;
+        let ts = signed_to_unsigned_i64(ts);
+
+        Bytes::from(vec![
+            // Event type, 1 byte
+            event_type as u8,
+            // Event ID, 8 bytes
+            event_id as u8,
+            (event_id >> 8) as u8,
+            (event_id >> 16) as u8,
+            (event_id >> 24) as u8,
+            (event_id >> 32) as u8,
+            (event_id >> 40) as u8,
+            (event_id >> 48) as u8,
+            (event_id >> 56) as u8,
+            // Timestamp, 8 bytes
+            ts as u8,
+            (ts >> 8) as u8,
+            (ts >> 16) as u8,
+            (ts >> 24) as u8,
+            (ts >> 32) as u8,
+            (ts >> 40) as u8,
+            (ts >> 48) as u8,
+            (ts >> 56) as u8,
+            // Trace ID, 16 bytes
+            trace_id[0],
+            trace_id[1],
+            trace_id[2],
+            trace_id[3],
+            trace_id[4],
+            trace_id[5],
+            trace_id[6],
+            trace_id[7],
+            trace_id[8],
+            trace_id[9],
+            trace_id[10],
+            trace_id[11],
+            trace_id[12],
+            trace_id[13],
+            trace_id[14],
+            trace_id[15],
+            // Span ID, 8 bytes
+            span_id[0],
+            span_id[1],
+            span_id[2],
+            span_id[3],
+            span_id[4],
+            span_id[5],
+            span_id[6],
+            span_id[7],
+            // Event data length, 4 bytes
+            ln as u8,
+            (ln >> 8) as u8,
+            (ln >> 16) as u8,
+            (ln >> 24) as u8,
+        ])
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::api::reqauth::platform::RequestValidator;
+
+    use tokio_stream::StreamExt;
+    use url::Url;
+
+    fn setup_reporter() -> Reporter {
+        let (_tx, rx) = tokio::sync::mpsc::unbounded_channel();
+
+        Reporter {
+            rx,
+            anchor: TimeAnchor::new(),
+            http_client: reqwest::Client::new(),
+            config: ReporterConfig {
+                app_id: "test-app".to_string(),
+                env_id: "test-env".to_string(),
+                deploy_id: "test-deploy".to_string(),
+                app_commit: "test-commit".to_string(),
+                trace_endpoint: Url::parse("http://localhost:8080").unwrap(),
+                platform_validator: RequestValidator::new_mock().into(),
+            },
+        }
+    }
+
+    #[tokio::test]
+    async fn test_event_to_stream_empty_payload() {
+        let reporter = setup_reporter();
+        let (body_tx, body_rx) = tokio::sync::mpsc::unbounded_channel();
+        let mut body_stream = Box::pin(reporter.create_body_stream(body_rx));
+
+        // Create an event with empty data payload
+        let event = TraceEvent {
+            typ: EventType::LogMessage,
+            id: model::TraceEventId(100),
+            data: Bytes::from(vec![]), // Empty payload
+            span: model::SpanKey(model::TraceId([5; 16]), model::SpanId([6; 8])),
+            ts: tokio::time::Instant::now(),
+        };
+
+        // Send the event with empty payload
+        body_tx
+            .send(event)
+            .expect("Failed to send event with empty payload");
+
+        // Verify header was received
+        let header = body_stream
+            .next()
+            .await
+            .expect("Failed to receive header for empty payload")
+            .expect("Header should be Ok");
+        assert_eq!(header[0], EventType::LogMessage as u8);
+
+        // Verify data length in header is zero
+        let data_length = (header[41] as u32)
+            | ((header[42] as u32) << 8)
+            | ((header[43] as u32) << 16)
+            | ((header[44] as u32) << 24);
+        assert_eq!(data_length, 0, "Data length in header should be zero");
+
+        // Verify empty data was received
+        let data = body_stream
+            .next()
+            .await
+            .expect("Failed to receive empty data payload")
+            .expect("Data should be Ok");
+        assert_eq!(data.len(), 0, "Data payload should be empty");
+
+        drop(body_tx);
+
+        // Verify stream is now empty
+        assert!(
+            body_stream.next().await.is_none(),
+            "Stream should be empty after receiving header and data"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_event_to_stream() {
+        let reporter = setup_reporter();
+        let (body_tx, body_rx) = tokio::sync::mpsc::unbounded_channel();
+        let mut body_stream = Box::pin(reporter.create_body_stream(body_rx));
+
+        // Use specific test values that we can verify in the header
+        let event_id = 42u64;
+        let trace_id = [
+            0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xAA, 0xBB, 0xCC, 0xDD, 0xEE,
+            0xFF, 0x00,
+        ];
+        let span_id = [0xAA, 0xBB, 0xCC, 0xDD, 0xEE, 0xFF, 0x11, 0x22];
+        let test_data = "hello world";
+        let data_bytes = Bytes::from(test_data);
+
+        let event = TraceEvent {
+            typ: EventType::HTTPCallStart,
+            id: model::TraceEventId(event_id),
+            data: data_bytes.clone(),
+            span: model::SpanKey(model::TraceId(trace_id), model::SpanId(span_id)),
+            ts: tokio::time::Instant::now(),
+        };
+
+        body_tx.send(event).expect("Failed to send event to stream");
+
+        let header = body_stream
+            .next()
+            .await
+            .expect("Failed to receive header from stream")
+            .expect("Header should be Ok");
+        let data = body_stream
+            .next()
+            .await
+            .expect("Failed to receive data from stream")
+            .expect("Data should be Ok");
+
+        // Verify that header has correct format and size
+        assert_eq!(header.len(), 45, "Header should be exactly 45 bytes");
+
+        // Verify event type
+        assert_eq!(
+            header[0],
+            EventType::HTTPCallStart as u8,
+            "Event type should match"
+        );
+
+        // Verify event ID (bytes 1-8)
+        let header_event_id = (header[1] as u64)
+            | ((header[2] as u64) << 8)
+            | ((header[3] as u64) << 16)
+            | ((header[4] as u64) << 24)
+            | ((header[5] as u64) << 32)
+            | ((header[6] as u64) << 40)
+            | ((header[7] as u64) << 48)
+            | ((header[8] as u64) << 56);
+        assert_eq!(header_event_id, event_id, "Event ID in header should match");
+
+        // Verify trace ID (bytes 17-32)
+        for i in 0..16 {
+            assert_eq!(
+                header[17 + i],
+                trace_id[i],
+                "Trace ID byte {i} should match"
+            );
+        }
+
+        // Verify span ID (bytes 33-40)
+        for i in 0..8 {
+            assert_eq!(header[33 + i], span_id[i], "Span ID byte {i} should match");
+        }
+
+        // Verify data length (bytes 41-44)
+        let data_length = (header[41] as u32)
+            | ((header[42] as u32) << 8)
+            | ((header[43] as u32) << 16)
+            | ((header[44] as u32) << 24);
+        assert_eq!(
+            data_length,
+            test_data.len() as u32,
+            "Data length in header should match"
+        );
+
+        // Verify data content
+        assert_eq!(data, data_bytes, "Data payload should match original");
+        assert_eq!(data.len(), test_data.len(), "Data length should match");
+
+        drop(body_tx);
+        // Verify channel is now empty
+        assert!(
+            body_stream.next().await.is_none(),
+            "Channel should be empty after receiving header and data"
+        );
+    }
+
+    #[tokio::test]
+    async fn test_event_to_stream_large_payload() {
+        let reporter = setup_reporter();
+        let (body_tx, body_rx) = tokio::sync::mpsc::unbounded_channel();
+        let mut body_stream = Box::pin(reporter.create_body_stream(body_rx));
+
+        // Create a large payload (1MB)
+        let large_data_size = 1024 * 1024;
+        let large_data = vec![0xAA; large_data_size];
+
+        let event = TraceEvent {
+            typ: EventType::DBQueryStart,
+            id: model::TraceEventId(42),
+            data: Bytes::from(large_data.clone()),
+            span: model::SpanKey(model::TraceId([3; 16]), model::SpanId([4; 8])),
+            ts: tokio::time::Instant::now(),
+        };
+
+        // Send the event with large payload
+        body_tx.send(event).expect("Failed to send event to stream");
+
+        // Verify header was received
+        let header = body_stream
+            .next()
+            .await
+            .expect("Failed to receive header for large payload")
+            .expect("Header should be Ok");
+        assert_eq!(header[0], EventType::DBQueryStart as u8);
+
+        // Extract the data length from the header (last 4 bytes)
+        let data_length = (header[41] as u32)
+            | ((header[42] as u32) << 8)
+            | ((header[43] as u32) << 16)
+            | ((header[44] as u32) << 24);
+
+        // Verify the header correctly indicates the large size
+        assert_eq!(data_length, large_data_size as u32);
+
+        // Verify data was received and matches the original
+        let data = body_stream
+            .next()
+            .await
+            .expect("Failed to receive large payload data")
+            .expect("Data should be Ok");
+        assert_eq!(data.len(), large_data_size);
+        assert_eq!(data[0], 0xAA);
+        assert_eq!(data[large_data_size - 1], 0xAA);
+
+        drop(body_tx);
+        // Verify channel is now empty
+        assert!(body_stream.next().await.is_none());
+    }
+
+    #[test]
+    fn test_streaming_trace_event_header_format() {
+        // Create a time anchor
+        let anchor = TimeAnchor::new();
+
+        // Create a trace event
+        let event_type = EventType::LogMessage;
+        let event_id = 42u64;
+        let trace_id = model::TraceId([5; 16]);
+        let span_id = model::SpanId([6; 8]);
+        let data = Bytes::from(vec![10, 20, 30]);
+
+        let event = TraceEvent {
+            typ: event_type,
+            id: model::TraceEventId(event_id),
+            data: data.clone(),
+            span: model::SpanKey(trace_id, span_id),
+            ts: anchor.instant + std::time::Duration::from_nanos(123456789),
+        };
+
+        // Create a StreamingTraceEvent and get the header
+        let streaming_event = StreamingTraceEvent { event };
+        let header = streaming_event.header(&anchor);
+
+        // Header should be exactly 45 bytes
+        // 1 (type) + 8 (event id) + 8 (timestamp) + 16 (trace id) + 8 (span id) + 4 (data length)
+        assert_eq!(header.len(), 45);
+
+        // Check event type
+        assert_eq!(header[0], event_type as u8);
+
+        // Check event ID (little endian)
+        assert_eq!(header[1], (event_id & 0xFF) as u8);
+        assert_eq!(header[2], ((event_id >> 8) & 0xFF) as u8);
+        assert_eq!(header[3], ((event_id >> 16) & 0xFF) as u8);
+        assert_eq!(header[4], ((event_id >> 24) & 0xFF) as u8);
+        assert_eq!(header[5], ((event_id >> 32) & 0xFF) as u8);
+        assert_eq!(header[6], ((event_id >> 40) & 0xFF) as u8);
+        assert_eq!(header[7], ((event_id >> 48) & 0xFF) as u8);
+        assert_eq!(header[8], ((event_id >> 56) & 0xFF) as u8);
+
+        // Check trace ID
+        for i in 0..16 {
+            assert_eq!(header[17 + i], 5);
+        }
+
+        // Check span ID
+        for i in 0..8 {
+            assert_eq!(header[33 + i], 6);
+        }
+
+        // Check data length (3 bytes, little endian)
+        assert_eq!(header[41], 3);
+        assert_eq!(header[42], 0);
+        assert_eq!(header[43], 0);
+        assert_eq!(header[44], 0);
+    }
+
+    #[test]
+    fn test_streaming_trace_event_timestamp_encoding() {
+        // Create a time anchor
+        let anchor = TimeAnchor::new();
+
+        // Create events with different timestamps
+        let time_offsets = [
+            0,             // Same as anchor
+            1000,          // 1 microsecond
+            1_000_000,     // 1 millisecond
+            1_000_000_000, // 1 second
+        ];
+
+        for &offset_nanos in &time_offsets {
+            let ts = anchor.instant + std::time::Duration::from_nanos(offset_nanos as u64);
+
+            let event = TraceEvent {
+                typ: EventType::LogMessage,
+                id: model::TraceEventId(1),
+                data: Bytes::from(vec![]),
+                span: model::SpanKey(model::TraceId([0; 16]), model::SpanId([0; 8])),
+                ts,
+            };
+
+            // Create a StreamingTraceEvent and get the header
+            let streaming_event = StreamingTraceEvent { event };
+            let header = streaming_event.header(&anchor);
+
+            // Extract the timestamp from the header (bytes 9-16)
+            let encoded_ts = (header[9] as u64)
+                | ((header[10] as u64) << 8)
+                | ((header[11] as u64) << 16)
+                | ((header[12] as u64) << 24)
+                | ((header[13] as u64) << 32)
+                | ((header[14] as u64) << 40)
+                | ((header[15] as u64) << 48)
+                | ((header[16] as u64) << 56);
+
+            // For non-negative timestamps, the encoded value should be the offset * 2
+            assert_eq!(encoded_ts, (offset_nanos as u64) << 1);
+        }
+    }
+
+    #[test]
+    fn test_streaming_trace_event_different_event_types() {
+        // Create a time anchor
+        let anchor = TimeAnchor::new();
+
+        // Test different event types
+        let event_types = [
+            EventType::RequestSpanStart,
+            EventType::DBQueryStart,
+            EventType::RPCCallEnd,
+            EventType::LogMessage,
+            EventType::TestEnd,
+        ];
+
+        for &event_type in &event_types {
+            let event = TraceEvent {
+                typ: event_type,
+                id: model::TraceEventId(1),
+                data: Bytes::from(vec![]),
+                span: model::SpanKey(model::TraceId([0; 16]), model::SpanId([0; 8])),
+                ts: anchor.instant,
+            };
+
+            // Create a StreamingTraceEvent and get the header
+            let streaming_event = StreamingTraceEvent { event };
+            let header = streaming_event.header(&anchor);
+
+            // First byte should be the event type
+            assert_eq!(header[0], event_type as u8);
+        }
+    }
+
+    #[test]
+    fn test_streaming_trace_event_data_length() {
+        // Create a time anchor
+        let anchor = TimeAnchor::new();
+
+        // Test different data lengths
+        let data_lengths = [0, 1, 10, 255, 256, 65535, 16777215];
+
+        for &length in &data_lengths {
+            // Create data of the specified length
+            let data = Bytes::from(vec![0; length]);
+
+            let event = TraceEvent {
+                typ: EventType::LogMessage,
+                id: model::TraceEventId(1),
+                data,
+                span: model::SpanKey(model::TraceId([0; 16]), model::SpanId([0; 8])),
+                ts: anchor.instant,
+            };
+
+            // Create a StreamingTraceEvent and get the header
+            let streaming_event = StreamingTraceEvent { event };
+            let header = streaming_event.header(&anchor);
+
+            // Last 4 bytes should contain the length in little-endian format
+            let encoded_length = (header[41] as u32)
+                | ((header[42] as u32) << 8)
+                | ((header[43] as u32) << 16)
+                | ((header[44] as u32) << 24);
+
+            assert_eq!(encoded_length, length as u32);
+        }
+    }
+}
diff --git a/runtimes/core/src/trace/mod.rs b/runtimes/core/src/trace/mod.rs
new file mode 100644
index 0000000000..948914e504
--- /dev/null
+++ b/runtimes/core/src/trace/mod.rs
@@ -0,0 +1,7 @@
+mod eventbuf;
+mod log;
+pub mod protocol;
+mod time_anchor;
+
+pub use log::{streaming_tracer, ReporterConfig};
+pub use protocol::Tracer;
diff --git a/runtimes/core/src/trace/protocol.rs b/runtimes/core/src/trace/protocol.rs
new file mode 100644
index 0000000000..d9deef8330
--- /dev/null
+++ b/runtimes/core/src/trace/protocol.rs
@@ -0,0 +1,1006 @@
+#![allow(dead_code)]
+//! Implements the trace protocol.
+
+use std::sync::atomic::{AtomicU64, Ordering};
+
+use crate::api::reqauth::meta::HeaderValueExt;
+use crate::api::{self, PValue};
+use crate::model::{LogField, LogFieldValue, Request, TraceEventId};
+use crate::trace::eventbuf::EventBuffer;
+use crate::trace::log::TraceEvent;
+use crate::{model, objects, EncoreName};
+
+/// Represents a type of trace event.
+#[derive(Debug, Clone, Copy)]
+#[repr(u8)]
+pub enum EventType {
+    RequestSpanStart = 0x01,
+    RequestSpanEnd = 0x02,
+    AuthSpanStart = 0x03,
+    AuthSpanEnd = 0x04,
+    PubsubMessageSpanStart = 0x05,
+    PubsubMessageSpanEnd = 0x06,
+    DBTransactionStart = 0x07,
+    DBTransactionEnd = 0x08,
+    DBQueryStart = 0x09,
+    DBQueryEnd = 0x0A,
+    RPCCallStart = 0x0B,
+    RPCCallEnd = 0x0C,
+    HTTPCallStart = 0x0D,
+    HTTPCallEnd = 0x0E,
+    LogMessage = 0x0F,
+    PubsubPublishStart = 0x10,
+    PubsubPublishEnd = 0x11,
+    ServiceInitStart = 0x12,
+    ServiceInitEnd = 0x13,
+    CacheCallStart = 0x14,
+    CacheCallEnd = 0x15,
+    BodyStream = 0x16,
+    TestStart = 0x17,
+    TestEnd = 0x18,
+    BucketObjectUploadStart = 0x19,
+    BucketObjectUploadEnd = 0x1A,
+    BucketObjectDownloadStart = 0x1B,
+    BucketObjectDownloadEnd = 0x1C,
+    BucketObjectGetAttrsStart = 0x1D,
+    BucketObjectGetAttrsEnd = 0x1E,
+    BucketListObjectsStart = 0x1F,
+    BucketListObjectsEnd = 0x20,
+    BucketDeleteObjectsStart = 0x21,
+    BucketDeleteObjectsEnd = 0x22,
+}
+
+// A global event id counter.
+static EVENT_ID: AtomicU64 = AtomicU64::new(1);
+
+#[derive(Debug, Clone)]
+pub struct Tracer {
+    tx: Option<tokio::sync::mpsc::UnboundedSender<TraceEvent>>,
+}
+
+pub static TRACE_VERSION: u16 = 14;
+
+impl Tracer {
+    pub(super) fn new(tx: tokio::sync::mpsc::UnboundedSender<TraceEvent>) -> Self {
+        Self { tx: Some(tx) }
+    }
+
+    pub fn noop() -> Self {
+        Self { tx: None }
+    }
+}
+
+pub struct LogMessageData<'a, I> {
+    pub source: Option<&'a Request>,
+    pub msg: &'a str,
+    pub level: log::Level,
+    pub fields: Option<I>,
+}
+
+impl<I> LogMessageData<'_, I> {
+    fn level_byte(&self) -> u8 {
+        match self.level {
+            log::Level::Error => 4,
+            log::Level::Warn => 3,
+            log::Level::Info => 2,
+            log::Level::Debug => 1,
+            log::Level::Trace => 0,
+        }
+    }
+}
+
+impl Tracer {
+    #[inline]
+    pub fn log_message<'a, I>(&self, data: LogMessageData<I>)
+    where
+        I: ExactSizeIterator<Item = LogField<'a>>,
+    {
+        let Some(source) = data.source else {
+            return;
+        };
+
+        let fields_count = data.fields.as_ref().map(|fields| fields.len()).unwrap_or(0);
+
+        let mut eb = BasicEventData {
+            correlation_event_id: None,
+            extra_space: 4 + 4 + data.msg.len() + 1 + 64 * fields_count,
+        }
+        .into_eb();
+
+        eb.byte(data.level_byte());
+        eb.str(data.msg);
+        eb.uvarint(fields_count as u64);
+
+        if let Some(fields) = data.fields {
+            for field in fields {
+                eb.byte(field.type_byte());
+                eb.str(field.key);
+
+                match field.value {
+                    LogFieldValue::String(str) => eb.str(str),
+                    LogFieldValue::U64(n) => eb.uvarint(n),
+                    LogFieldValue::I64(n) => eb.ivarint(n),
+                    LogFieldValue::F64(n) => eb.f64(n),
+                    LogFieldValue::Bool(b) => eb.bool(b),
+                    LogFieldValue::Json(json) => match serde_json::to_vec(json) {
+                        Ok(bytes) => {
+                            eb.byte_string(&bytes);
+                            eb.nyi_stack_pcs()
+                        }
+                        Err(err) => {
+                            eb.byte_string(&[]);
+                            eb.err_with_legacy_stack(Some(&err))
+                        }
+                    },
+                }
+            }
+        }
+
+        eb.nyi_stack_pcs();
+
+        _ = self.send(EventType::LogMessage, source.span, eb);
+    }
+}
+
+impl Tracer {
+    #[inline]
+    pub fn request_span_start(&self, req: &model::Request, redact_details: bool) {
+        let mut eb = SpanStartEventData {
+            parent: Parent::from(req),
+            caller_event_id: req.caller_event_id,
+            ext_correlation_id: req.ext_correlation_id.as_deref(),
+            extra_space: 100,
+        }
+        .into_eb();
+
+        let event_type = match &req.data {
+            model::RequestData::RPC(rpc) => {
+                eb.str(rpc.endpoint.name.service());
+                eb.str(rpc.endpoint.name.endpoint());
+                eb.str(rpc.method.as_str());
+                eb.str(&rpc.path);
+
+                // Encode path params. We only encode the values since the keys are known in metadata.
+                let path_params = if !redact_details {
+                    rpc.parsed_payload.as_ref().and_then(|p| p.path.as_ref())
+                } else {
+                    None
+                };
+
+                if let Some(path_params) = path_params {
+                    eb.uvarint(path_params.len() as u64);
+                    for (_, v) in path_params {
+                        match &v {
+                            PValue::String(s) => eb.str(s.as_str()),
+                            other => eb.str(other.to_string().as_str()),
+                        }
+                    }
+                } else {
+                    eb.uvarint(0u64);
+                }
+
+                // Encode request headers. If a header has multiple values it is encoded multiple times.
+                if !redact_details {
+                    eb.headers(&rpc.req_headers);
+                } else {
+                    eb.uvarint(0u64);
+                }
+
+                if !redact_details {
+                    let payload = rpc
+                        .parsed_payload
+                        .as_ref()
+                        .and_then(|p| serde_json::to_vec_pretty(p).ok());
+                    eb.opt_byte_string(payload.as_deref());
+                } else {
+                    eb.byte_string(b"<redacted>");
+                };
+
+                eb.opt_str(req.ext_correlation_id.as_deref()); // yes, this is repeated for some reason
+                eb.opt_str(rpc.auth_user_id.as_deref());
+
+                EventType::RequestSpanStart
+            }
+
+            model::RequestData::Auth(auth) => {
+                let name = &auth.auth_handler;
+                eb.str(name.service());
+                eb.str(name.endpoint());
+
+                // TODO: non-raw payload.
+                eb.byte_string(&[]);
+
+                EventType::AuthSpanStart
+            }
+            model::RequestData::PubSub(msg_data) => {
+                eb.str(&msg_data.service);
+                eb.str(&msg_data.topic);
+                eb.str(&msg_data.subscription);
+                eb.str(&msg_data.message_id);
+                eb.uvarint(msg_data.attempt as u64);
+                eb.time(&msg_data.published);
+                eb.byte_string(&msg_data.payload);
+
+                EventType::PubsubMessageSpanStart
+            }
+            model::RequestData::Stream(data) => {
+                eb.str(data.endpoint.name.service());
+                eb.str(data.endpoint.name.endpoint());
+                eb.str("GET");
+                eb.str(&data.path);
+
+                // Encode path params. We only encode the values since the keys are known in metadata.
+                let path_params = if !redact_details {
+                    data.parsed_payload.as_ref().and_then(|p| p.path.as_ref())
+                } else {
+                    None
+                };
+
+                if let Some(path_params) = path_params {
+                    eb.uvarint(path_params.len() as u64);
+                    for (_, v) in path_params {
+                        match &v {
+                            PValue::String(s) => eb.str(s.as_str()),
+                            other => eb.str(other.to_string().as_str()),
+                        }
+                    }
+                } else {
+                    eb.uvarint(0u64);
+                }
+
+                // Encode request headers. If a header has multiple values it is encoded multiple times.
+                if !redact_details {
+                    eb.headers(&data.req_headers);
+                } else {
+                    eb.uvarint(0u64);
+                }
+
+                if !redact_details {
+                    let payload = data
+                        .parsed_payload
+                        .as_ref()
+                        .and_then(|p| serde_json::to_vec_pretty(p).ok());
+                    eb.opt_byte_string(payload.as_deref());
+                } else {
+                    eb.byte_string(b"<redacted>");
+                };
+
+                eb.opt_str(req.ext_correlation_id.as_deref()); // yes, this is repeated for some reason
+                eb.opt_str(data.auth_user_id.as_deref());
+
+                EventType::RequestSpanStart
+            }
+        };
+
+        _ = self.send(event_type, req.span, eb);
+    }
+
+    #[inline]
+    pub fn request_span_end(&self, resp: &model::Response, redact_details: bool) {
+        // If the request has no span, we don't need to do anything.
+        let req = resp.request.as_ref();
+
+        let mut eb = SpanEndEventData {
+            parent: Parent::from(req),
+            duration: resp.duration,
+            err: match &resp.data {
+                model::ResponseData::RPC(rpc) => rpc.error.as_ref(),
+                model::ResponseData::Auth(res) => res.as_ref().err(),
+                model::ResponseData::PubSub(res) => res.as_ref().err(),
+            },
+            extra_space: 100,
+        }
+        .into_eb();
+
+        match &req.data {
+            model::RequestData::RPC(req_data) => {
+                eb.str(req_data.endpoint.name.service());
+                eb.str(req_data.endpoint.name.endpoint());
+            }
+            model::RequestData::Auth(auth_data) => {
+                let name = &auth_data.auth_handler;
+                eb.str(name.service());
+                eb.str(name.endpoint());
+            }
+            model::RequestData::PubSub(msg_data) => {
+                eb.str(&msg_data.service);
+                eb.str(&msg_data.topic);
+                eb.str(&msg_data.subscription);
+            }
+            model::RequestData::Stream(data) => {
+                eb.str(data.endpoint.name.service());
+                eb.str(data.endpoint.name.endpoint());
+            }
+        }
+
+        let event_type = match &resp.data {
+            model::ResponseData::RPC(resp_data) => {
+                eb.uvarint(resp_data.status_code);
+                if !redact_details {
+                    eb.headers(&resp_data.resp_headers);
+                } else {
+                    eb.uvarint(0u64);
+                }
+
+                if !redact_details {
+                    let payload = resp_data
+                        .resp_payload
+                        .as_ref()
+                        .and_then(|p| serde_json::to_vec_pretty(p).ok());
+                    eb.opt_byte_string(payload.as_deref());
+                } else {
+                    eb.byte_string(b"<redacted>");
+                };
+
+                EventType::RequestSpanEnd
+            }
+            model::ResponseData::Auth(auth_result) => {
+                match auth_result {
+                    Ok(auth_success) => {
+                        eb.str(auth_success.user_id.as_str());
+                        let user_data = serde_json::to_string(&auth_success.user_data)
+                            .unwrap_or_else(|_| String::new());
+                        eb.str(&user_data);
+                    }
+                    Err(_) => {
+                        eb.str(""); // auth uid
+                        eb.str(""); // response payload
+                    }
+                }
+
+                EventType::AuthSpanEnd
+            }
+
+            model::ResponseData::PubSub(_) => EventType::PubsubMessageSpanEnd,
+        };
+
+        _ = self.send(event_type, req.span, eb);
+    }
+}
+
+impl Tracer {
+    #[inline]
+    pub fn rpc_call_start(&self, call: &model::APICall) -> Option<TraceEventId> {
+        let source = call.source.as_ref()?;
+
+        let (service, endpoint) = (call.target.service(), call.target.endpoint());
+        let mut eb = BasicEventData {
+            correlation_event_id: None,
+            extra_space: 4 + 4 + service.len() + endpoint.len(),
+        }
+        .into_eb();
+
+        eb.str(service);
+        eb.str(endpoint);
+        eb.nyi_stack_pcs();
+
+        Some(self.send(EventType::RPCCallStart, source.span, eb))
+    }
+
+    #[inline]
+    pub fn rpc_call_end(
+        &self,
+        call: &model::APICall,
+        start_event_id: TraceEventId,
+        err: Option<&api::Error>,
+    ) {
+        let Some(source) = &call.source else {
+            return;
+        };
+
+        let (service, endpoint) = (call.target.service(), call.target.endpoint());
+        let mut eb = BasicEventData {
+            correlation_event_id: Some(start_event_id),
+            extra_space: 4 + 4 + service.len() + endpoint.len(),
+        }
+        .into_eb();
+
+        eb.api_err_with_legacy_stack(err);
+
+        _ = self.send(EventType::RPCCallEnd, source.span, eb);
+    }
+}
+
+pub struct PublishStartData<'a> {
+    pub source: &'a Request,
+    pub topic: &'a EncoreName,
+    pub payload: &'a [u8],
+}
+
+pub struct PublishEndData<'a> {
+    pub start_id: TraceEventId,
+    pub source: &'a Request,
+    pub result: &'a anyhow::Result<String>,
+}
+
+impl Tracer {
+    #[inline]
+    pub fn pubsub_publish_start(&self, data: PublishStartData) -> TraceEventId {
+        let mut eb = BasicEventData {
+            correlation_event_id: None,
+            extra_space: 4 + 4 + 8 + data.topic.len() + data.payload.len(),
+        }
+        .into_eb();
+
+        eb.str(data.topic);
+        eb.byte_string(data.payload);
+        eb.nyi_stack_pcs();
+
+        self.send(EventType::PubsubPublishStart, data.source.span, eb)
+    }
+
+    #[inline]
+    pub fn pubsub_publish_end(&self, data: PublishEndData) {
+        let mut eb = BasicEventData {
+            correlation_event_id: Some(data.start_id),
+            extra_space: 4 + 4 + 8,
+        }
+        .into_eb();
+
+        eb.str(data.result.as_deref().unwrap_or(""));
+        eb.err_with_legacy_stack(data.result.as_ref().err());
+
+        _ = self.send(EventType::PubsubPublishEnd, data.source.span, eb);
+    }
+}
+
+pub struct DBQueryStartData<'a> {
+    pub source: &'a Request,
+    pub query: &'a str,
+}
+
+pub struct DBQueryEndData<'a, E> {
+    pub start_id: TraceEventId,
+    pub source: &'a Request,
+    pub error: Option<&'a E>,
+}
+
+impl Tracer {
+    #[inline]
+    pub fn db_query_start(&self, data: DBQueryStartData) -> TraceEventId {
+        let mut eb = BasicEventData {
+            correlation_event_id: None,
+            extra_space: 4 + 4 + data.query.len() + 32,
+        }
+        .into_eb();
+
+        eb.str(data.query);
+        eb.nyi_stack_pcs();
+
+        self.send(EventType::DBQueryStart, data.source.span, eb)
+    }
+
+    #[inline]
+    pub fn db_query_end<E>(&self, data: DBQueryEndData<E>)
+    where
+        E: std::fmt::Display,
+    {
+        let mut eb = BasicEventData {
+            correlation_event_id: Some(data.start_id),
+            extra_space: 4 + 4 + 8,
+        }
+        .into_eb();
+
+        eb.err_with_legacy_stack(data.error);
+
+        _ = self.send(EventType::DBQueryEnd, data.source.span, eb);
+    }
+}
+
+pub struct BucketObjectUploadStart<'a> {
+    pub source: &'a Request,
+    pub bucket: &'a EncoreName,
+    pub object: &'a str,
+    pub attrs: BucketObjectAttributes<'a>,
+}
+
+pub struct BucketObjectUploadEnd<'a, E> {
+    pub start_id: TraceEventId,
+    pub source: &'a Request,
+    pub result: BucketObjectUploadEndResult<'a, E>,
+}
+
+pub enum BucketObjectUploadEndResult<'a, E> {
+    Success { size: u64, version: Option<&'a str> },
+    Err(&'a E),
+}
+
+#[derive(Default, Debug)]
+pub struct BucketObjectAttributes<'a> {
+    pub size: Option<u64>,
+    pub version: Option<&'a str>,
+    pub etag: Option<&'a str>,
+    pub content_type: Option<&'a str>,
+}
+
+impl<'a> From<&'a objects::ObjectAttrs> for BucketObjectAttributes<'a> {
+    fn from(attrs: &'a objects::ObjectAttrs) -> Self {
+        Self {
+            size: Some(attrs.size),
+            version: attrs.version.as_deref(),
+            etag: Some(&attrs.etag),
+            content_type: attrs.content_type.as_deref(),
+        }
+    }
+}
+
+impl EventBuffer {
+    fn bucket_object_attrs(&mut self, attrs: &BucketObjectAttributes) {
+        self.uvarint(attrs.size.unwrap_or(0));
+        self.opt_str(attrs.version);
+        self.opt_str(attrs.etag);
+        self.opt_str(attrs.content_type);
+    }
+}
+
+impl Tracer {
+    #[inline]
+    pub fn bucket_object_upload_start(&self, data: BucketObjectUploadStart) -> TraceEventId {
+        let mut eb = BasicEventData {
+            correlation_event_id: None,
+            extra_space: 4 + 4 + 8 + data.bucket.len() + data.object.len(),
+        }
+        .into_eb();
+
+        eb.str(data.bucket);
+        eb.str(data.object);
+        eb.bucket_object_attrs(&data.attrs);
+        eb.nyi_stack_pcs();
+
+        self.send(EventType::BucketObjectUploadStart, data.source.span, eb)
+    }
+
+    #[inline]
+    pub fn bucket_object_upload_end<E>(&self, data: BucketObjectUploadEnd<E>)
+    where
+        E: std::fmt::Display,
+    {
+        let mut eb = BasicEventData {
+            correlation_event_id: Some(data.start_id),
+            extra_space: 4 + 4 + 8,
+        }
+        .into_eb();
+
+        match data.result {
+            BucketObjectUploadEndResult::Success { size, version } => {
+                eb.uvarint(size);
+                eb.opt_str(version);
+                eb.err_with_legacy_stack::<E>(None);
+            }
+            BucketObjectUploadEndResult::Err(err) => {
+                eb.uvarint(0u64);
+                eb.err_with_legacy_stack(Some(err));
+            }
+        }
+
+        _ = self.send(EventType::BucketObjectUploadEnd, data.source.span, eb);
+    }
+}
+
+pub struct BucketObjectDownloadStart<'a> {
+    pub source: &'a Request,
+    pub bucket: &'a EncoreName,
+    pub object: &'a str,
+    pub version: Option<&'a str>,
+}
+
+pub struct BucketObjectDownloadEnd<'a, E> {
+    pub start_id: TraceEventId,
+    pub source: &'a Request,
+    pub result: BucketObjectDownloadEndResult<'a, E>,
+}
+
+pub enum BucketObjectDownloadEndResult<'a, E> {
+    Success { size: u64 },
+    Err(&'a E),
+}
+
+impl Tracer {
+    #[inline]
+    pub fn bucket_object_download_start(&self, data: BucketObjectDownloadStart) -> TraceEventId {
+        let mut eb = BasicEventData {
+            correlation_event_id: None,
+            extra_space: 4 + 4 + 8 + data.bucket.len() + data.object.len(),
+        }
+        .into_eb();
+
+        eb.str(data.bucket);
+        eb.str(data.object);
+        eb.opt_str(data.version);
+        eb.nyi_stack_pcs();
+
+        self.send(EventType::BucketObjectDownloadStart, data.source.span, eb)
+    }
+
+    #[inline]
+    pub fn bucket_object_download_end<E>(&self, data: BucketObjectDownloadEnd<E>)
+    where
+        E: std::fmt::Display,
+    {
+        let mut eb = BasicEventData {
+            correlation_event_id: Some(data.start_id),
+            extra_space: 4 + 4 + 8,
+        }
+        .into_eb();
+
+        match data.result {
+            BucketObjectDownloadEndResult::Success { size } => {
+                eb.uvarint(size);
+                eb.err_with_legacy_stack::<E>(None);
+            }
+            BucketObjectDownloadEndResult::Err(err) => {
+                eb.uvarint(0u64);
+                eb.err_with_legacy_stack(Some(err));
+            }
+        }
+
+        _ = self.send(EventType::BucketObjectDownloadEnd, data.source.span, eb);
+    }
+}
+
+pub struct BucketDeleteObjectsStart<'a, O> {
+    pub source: &'a Request,
+    pub bucket: &'a EncoreName,
+    pub objects: O,
+}
+
+pub struct BucketDeleteObjectEntry<'a> {
+    pub object: &'a str,
+    pub version: Option<&'a str>,
+}
+
+pub struct BucketDeleteObjectsEnd<'a, E> {
+    pub start_id: TraceEventId,
+    pub source: &'a Request,
+    pub result: BucketDeleteObjectsEndResult<'a, E>,
+}
+
+pub enum BucketDeleteObjectsEndResult<'a, E> {
+    Success,
+    Err(&'a E),
+}
+
+impl Tracer {
+    #[inline]
+    pub fn bucket_delete_objects_start<'a, O>(
+        &self,
+        data: BucketDeleteObjectsStart<'a, O>,
+    ) -> TraceEventId
+    where
+        O: ExactSizeIterator<Item = BucketDeleteObjectEntry<'a>>,
+    {
+        let mut eb = BasicEventData {
+            correlation_event_id: None,
+            extra_space: 4 + 4 + 8 + data.bucket.len() + data.objects.len() * 8,
+        }
+        .into_eb();
+
+        eb.str(data.bucket);
+        eb.nyi_stack_pcs();
+        eb.uvarint(data.objects.len() as u64);
+        for obj in data.objects {
+            eb.str(obj.object);
+            eb.opt_str(obj.version);
+        }
+
+        self.send(EventType::BucketDeleteObjectsStart, data.source.span, eb)
+    }
+
+    #[inline]
+    pub fn bucket_delete_objects_end<E>(&self, data: BucketDeleteObjectsEnd<E>)
+    where
+        E: std::fmt::Display,
+    {
+        let mut eb = BasicEventData {
+            correlation_event_id: Some(data.start_id),
+            extra_space: 4 + 4 + 8,
+        }
+        .into_eb();
+
+        match data.result {
+            BucketDeleteObjectsEndResult::Success => {
+                eb.err_with_legacy_stack::<E>(None);
+            }
+            BucketDeleteObjectsEndResult::Err(err) => {
+                eb.err_with_legacy_stack(Some(err));
+            }
+        }
+
+        _ = self.send(EventType::BucketDeleteObjectsEnd, data.source.span, eb);
+    }
+}
+
+pub struct BucketListObjectsStart<'a> {
+    pub source: &'a Request,
+    pub bucket: &'a EncoreName,
+    pub prefix: Option<&'a str>,
+}
+
+pub struct BucketListObjectsEnd<'a, E> {
+    pub start_id: TraceEventId,
+    pub source: &'a Request,
+    pub result: BucketListObjectsEndResult<'a, E>,
+}
+
+pub enum BucketListObjectsEndResult<'a, E> {
+    Success { observed: u64, has_more: bool },
+    Err(&'a E),
+}
+
+impl Tracer {
+    #[inline]
+    pub fn bucket_list_objects_start(&self, data: BucketListObjectsStart) -> TraceEventId {
+        let mut eb = BasicEventData {
+            correlation_event_id: None,
+            extra_space: 4
+                + 4
+                + 8
+                + data.bucket.len()
+                + data.prefix.map(|p| p.len()).unwrap_or_default(),
+        }
+        .into_eb();
+
+        eb.str(data.bucket);
+        eb.opt_str(data.prefix);
+        eb.nyi_stack_pcs();
+
+        self.send(EventType::BucketListObjectsStart, data.source.span, eb)
+    }
+
+    #[inline]
+    pub fn bucket_list_objects_end<E>(&self, data: BucketListObjectsEnd<E>)
+    where
+        E: std::fmt::Display,
+    {
+        let mut eb = BasicEventData {
+            correlation_event_id: Some(data.start_id),
+            extra_space: 4 + 4 + 8,
+        }
+        .into_eb();
+
+        match data.result {
+            BucketListObjectsEndResult::Success { observed, has_more } => {
+                eb.err_with_legacy_stack::<E>(None);
+                eb.uvarint(observed);
+                eb.bool(has_more);
+            }
+            BucketListObjectsEndResult::Err(err) => {
+                eb.err_with_legacy_stack(Some(err));
+                eb.uvarint(0u64);
+                eb.bool(false);
+            }
+        }
+
+        _ = self.send(EventType::BucketListObjectsEnd, data.source.span, eb);
+    }
+}
+
+pub struct BucketObjectGetAttrsStart<'a> {
+    pub source: &'a Request,
+    pub bucket: &'a EncoreName,
+    pub object: &'a str,
+    pub version: Option<&'a str>,
+}
+
+pub struct BucketObjectGetAttrsEnd<'a, E> {
+    pub start_id: TraceEventId,
+    pub source: &'a Request,
+    pub result: BucketObjectGetAttrsEndResult<'a, E>,
+}
+
+pub enum BucketObjectGetAttrsEndResult<'a, E> {
+    Success(BucketObjectAttributes<'a>),
+    Err(&'a E),
+}
+
+impl Tracer {
+    #[inline]
+    pub fn bucket_object_get_attrs_start(&self, data: BucketObjectGetAttrsStart) -> TraceEventId {
+        let mut eb = BasicEventData {
+            correlation_event_id: None,
+            extra_space: 4 + 4 + 8 + data.bucket.len() + data.object.len(),
+        }
+        .into_eb();
+
+        eb.str(data.bucket);
+        eb.str(data.object);
+        eb.opt_str(data.version);
+        eb.nyi_stack_pcs();
+
+        self.send(EventType::BucketObjectGetAttrsStart, data.source.span, eb)
+    }
+
+    #[inline]
+    pub fn bucket_object_get_attrs_end<E>(&self, data: BucketObjectGetAttrsEnd<E>)
+    where
+        E: std::fmt::Display,
+    {
+        let mut eb = BasicEventData {
+            correlation_event_id: Some(data.start_id),
+            extra_space: 4 + 4 + 8,
+        }
+        .into_eb();
+
+        match data.result {
+            BucketObjectGetAttrsEndResult::Success(attrs) => {
+                eb.err_with_legacy_stack::<E>(None);
+                eb.bucket_object_attrs(&attrs);
+            }
+            BucketObjectGetAttrsEndResult::Err(err) => {
+                eb.err_with_legacy_stack(Some(err));
+            }
+        }
+
+        _ = self.send(EventType::BucketObjectGetAttrsEnd, data.source.span, eb);
+    }
+}
+
+impl Tracer {
+    #[inline]
+    fn send(&self, typ: EventType, span: model::SpanKey, eb: EventBuffer) -> model::TraceEventId {
+        // Make sure the event id is never 0, as it's used to indicate "no event" in the protocol.
+        let mut id = EVENT_ID.fetch_add(1, Ordering::SeqCst);
+        if id == 0 {
+            id = EVENT_ID.fetch_add(1, Ordering::SeqCst);
+        }
+        let id = model::TraceEventId(id);
+
+        // If we have a sender, send the event. Otherwise this is a no-op tracer.
+        if let Some(tx) = &self.tx {
+            _ = tx.send(TraceEvent {
+                typ,
+                span,
+                id,
+                data: eb.freeze(),
+                ts: tokio::time::Instant::now(),
+            });
+        }
+
+        id
+    }
+}
+
+impl EventBuffer {
+    fn parent(&mut self, parent: Option<&Parent>) {
+        self.reserve(16 + 8);
+
+        if let Some(parent) = parent {
+            match parent {
+                Parent::Trace(trace) => {
+                    self.bytes(&trace.0);
+                    self.bytes(&[0; 8]);
+                }
+                Parent::Span(span) => {
+                    self.bytes(&span.0 .0);
+                    self.bytes(&span.1 .0);
+                }
+            }
+        } else {
+            self.bytes(&[0; 16]);
+            self.bytes(&[0; 8]);
+        }
+    }
+
+    /// Writes a span key to the buffer.
+    /// Writes 0 bytes if key is None.
+    fn span_key(&mut self, key: Option<model::SpanKey>) {
+        self.reserve(16 + 8);
+        match key {
+            Some(key) => {
+                self.bytes(&key.0 .0);
+                self.bytes(&key.1 .0);
+            }
+            None => {
+                self.bytes(&[0; 16]);
+                self.bytes(&[0; 8]);
+            }
+        }
+    }
+
+    fn event_id(&mut self, event_id: Option<model::TraceEventId>) {
+        self.uvarint(match event_id {
+            Some(event_id) => event_id.0,
+            None => 0,
+        });
+    }
+
+    fn opt_str(&mut self, s: Option<&str>) {
+        let str = s.unwrap_or("");
+        self.str(str);
+    }
+
+    fn opt_byte_string(&mut self, s: Option<&[u8]>) {
+        let bytes = s.unwrap_or(&[]);
+        self.byte_string(bytes);
+    }
+
+    fn headers(&mut self, headers: &axum::http::HeaderMap) {
+        self.uvarint(headers.len() as u64);
+        for (k, v) in headers.iter() {
+            self.str(k.as_str());
+            self.str(v.to_utf8_str().unwrap_or(""));
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+enum Parent {
+    Trace(model::TraceId),
+    Span(model::SpanKey),
+}
+
+impl Parent {
+    fn from(req: &model::Request) -> Option<Self> {
+        if let Some(span) = req.parent_span {
+            Some(Parent::Span(span))
+        } else {
+            req.parent_trace.map(Parent::Trace)
+        }
+    }
+}
+
+struct SpanStartEventData<'a> {
+    parent: Option<Parent>,
+    caller_event_id: Option<model::TraceEventId>,
+    ext_correlation_id: Option<&'a str>,
+
+    /// Additional extra space to allocate in the buffer.
+    extra_space: usize,
+}
+
+impl SpanStartEventData<'_> {
+    pub fn into_eb(self) -> EventBuffer {
+        let correlation_len = self.ext_correlation_id.map(|s| s.len()).unwrap_or(0);
+        let mut eb =
+            EventBuffer::with_capacity(4 + 16 + 8 + 4 + correlation_len + 2 + self.extra_space);
+
+        eb.uvarint(0u64); // TODO: GOID
+        eb.parent(self.parent.as_ref());
+        eb.uvarint(0u64); // TODO: def loc
+        eb.event_id(self.caller_event_id);
+        eb.opt_str(self.ext_correlation_id);
+
+        eb
+    }
+}
+
+struct SpanEndEventData<'a> {
+    parent: Option<Parent>,
+    duration: std::time::Duration,
+    err: Option<&'a api::Error>,
+
+    /// Additional extra space to allocate in the buffer.
+    extra_space: usize,
+}
+
+impl SpanEndEventData<'_> {
+    pub fn into_eb(self) -> EventBuffer {
+        let mut eb = EventBuffer::with_capacity(8 + 12 + 8 + self.extra_space);
+
+        eb.duration(self.duration);
+        eb.api_err_with_legacy_stack(self.err);
+        eb.formatted_stack(self.err.as_ref().and_then(|err| err.stack.as_ref()));
+        eb.parent(self.parent.as_ref());
+
+        eb
+    }
+}
+
+struct BasicEventData {
+    correlation_event_id: Option<model::TraceEventId>,
+
+    /// Additional extra space to allocate in the buffer.
+    extra_space: usize,
+}
+
+impl BasicEventData {
+    pub fn into_eb(self) -> EventBuffer {
+        let mut eb = EventBuffer::with_capacity(4 + 4 + self.extra_space);
+
+        eb.uvarint(0u64); // TODO: def loc
+        eb.uvarint(0u64); // TODO: GOID
+        eb.event_id(self.correlation_event_id);
+
+        eb
+    }
+}
diff --git a/runtimes/core/src/trace/time_anchor.rs b/runtimes/core/src/trace/time_anchor.rs
new file mode 100644
index 0000000000..2fd7d7f05e
--- /dev/null
+++ b/runtimes/core/src/trace/time_anchor.rs
@@ -0,0 +1,27 @@
+/// Correlates a system time with a time instant.
+#[derive(Debug, Clone)]
+pub struct TimeAnchor {
+    /// The system time.
+    pub system_time: chrono::DateTime<chrono::Utc>,
+
+    /// The time instant.
+    pub instant: tokio::time::Instant,
+}
+
+impl TimeAnchor {
+    pub fn new() -> Self {
+        TimeAnchor {
+            system_time: chrono::Utc::now(),
+            instant: tokio::time::Instant::now(),
+        }
+    }
+
+    pub fn trace_header(&self) -> String {
+        // Format the system as with RFC3339Nano.
+        let dt = self
+            .system_time
+            .to_rfc3339_opts(chrono::SecondsFormat::AutoSi, true);
+
+        format!("0 {dt}")
+    }
+}
diff --git a/runtimes/go/README.md b/runtimes/go/README.md
new file mode 100644
index 0000000000..b4a963da71
--- /dev/null
+++ b/runtimes/go/README.md
@@ -0,0 +1,13 @@
+# Encore Runtime
+
+This is the Encore runtime module that provides APIs and internal runtime components
+for running Encore applications.
+
+Using [the Public API generator tool](../tools/publicapigen) the [encore.dev Public API](https://github.com/encoredev/encore.dev)
+is generated from this package. However, the following are not included in the public API:
+- The [runtime](./runtime) package, as that is considered to be an internal implementation detail of Encore and it's API is considered unstable.
+- Any internal packages, such as [pubsub/internal](./pubsub/internal), as those can't be accessed outside the Encore runtime.
+- Any files with the suffix of `_internal.go` as those are implementation details and not expected to be called from outside an Encore application
+- Any files with the suffix of `_test.go` as those simply form the testsuite for the runtime's implementation
+- Any functions, types or variables which are not exported from the package (unless the comment `//publicapigen:keep` is present)
+- The body of any functions, each body is replaced with a `panic()` call.
diff --git a/runtimes/go/appruntime/apisdk/api/auth.go b/runtimes/go/appruntime/apisdk/api/auth.go
new file mode 100644
index 0000000000..ecdc593846
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/auth.go
@@ -0,0 +1,203 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"sync"
+
+	jsoniter "github.com/json-iterator/go"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/shared/cloudtrace"
+	"encore.dev/beta/errs"
+	"encore.dev/internal/platformauth"
+)
+
+type AuthHandlerDesc[Params any] struct {
+	// Service and Endpoint name the auth handler this description is for.
+	Service     string
+	SvcNum      uint16
+	Endpoint    string
+	DefLoc      uint32
+	HasAuthData bool // whether the handler returns custom auth data
+
+	DecodeAuth  func(*http.Request) (Params, error)
+	AuthHandler func(context.Context, Params) (model.AuthInfo, error)
+
+	rpcDescOnce   sync.Once
+	cachedRPCDesc *model.RPCDesc
+}
+
+// AuthHandler is an interface that is either implemented by [AuthHandlerDesc[Params]] or [remoteAuthHandler]
+// depending on whether the auth handler is hosted in this container or not.
+type AuthHandler interface {
+	// Authenticate authenticates the request.
+	// If err != nil it should be written back as the response.
+	Authenticate(IncomingContext) (model.AuthInfo, error)
+
+	// HostedByService returns the name of the service that hosts the auth handler.
+	HostedByService() string
+
+	// ParseAuthData parses the auth data from the request and returns nil if successful.
+	// and data is present, otherwise it returns an error.
+	ParseAuthData(c IncomingContext) error
+}
+
+func (d *AuthHandlerDesc[Params]) Authenticate(c IncomingContext) (model.AuthInfo, error) {
+	param, err := d.DecodeAuth(c.req)
+	var info model.AuthInfo
+	if err != nil {
+		return model.AuthInfo{}, err
+	}
+
+	done := make(chan struct{})
+	call, err := c.server.beginAuth(d.DefLoc)
+	if err != nil {
+		return model.AuthInfo{}, err
+	}
+
+	var authErr error
+	go func() {
+		defer close(done)
+		_, authErr = c.server.beginRequest(c.req.Context(), &beginRequestParams{
+			TraceID:       c.callMeta.TraceID,
+			ParentSpanID:  c.callMeta.ParentSpanID,
+			ParentSampled: c.callMeta.TraceSampled,
+			SpanID:        call.SpanID,
+			DefLoc:        d.DefLoc,
+			Type:          model.AuthHandler,
+			Data: &model.RPCData{
+				Desc:               d.rpcDesc(),
+				NonRawPayload:      d.marshalParams(c.server.json, param),
+				TypedPayload:       param,
+				RequestHeaders:     c.req.Header,
+				FromEncorePlatform: platformauth.IsEncorePlatformRequest(c.req.Context()),
+			},
+			ExtCorrelationID:    clampTo64Chars(c.req.Header.Get("X-Correlation-ID")),
+			AdditionalLogFields: cloudtrace.StructuredLogFields(c.req),
+		})
+		if authErr != nil {
+			return
+		}
+		defer func() {
+			if err2 := recover(); err2 != nil {
+				panicStack := stack.Build(0)
+				authErr = errs.B().Code(errs.Internal).Meta("panic_stack", panicStack).Msgf(
+					"auth handler panicked: %v", err2).Err()
+				c.server.finishRequest(newErrResp(authErr, 0))
+			}
+		}()
+
+		if err := runValidate(param); err != nil {
+			authErr = err
+			c.server.finishRequest(newErrResp(authErr, 0))
+			return
+		}
+
+		info, authErr = d.AuthHandler(c.req.Context(), param)
+
+		if authErr != nil {
+			authErr = errs.RoundTrip(authErr)
+			c.server.finishRequest(newErrResp(authErr, 0))
+		} else {
+			resp := d.newAuthResp(info, authErr, c.server.json)
+			c.server.finishRequest(resp)
+		}
+	}()
+	<-done
+
+	return info, authErr
+}
+
+func (d *AuthHandlerDesc[Params]) HostedByService() string {
+	return d.Service
+}
+
+func (d *AuthHandlerDesc[Params]) ParseAuthData(c IncomingContext) error {
+	_, err := d.DecodeAuth(c.req)
+	return err
+}
+
+// runAuthHandler runs the auth handler, if provided.
+// It reports whether to proceed with calling the handler.
+func (s *Server) runAuthHandler(h Handler, c IncomingContext) (info model.AuthInfo, proceed bool) {
+	requiresAuth := h.AccessType() == RequiresAuth
+	if s.authHandler == nil {
+		if requiresAuth {
+			panic(fmt.Sprintf("internal error: API %s.%s requires auth but no auth handler set",
+				h.ServiceName(), h.EndpointName()))
+		}
+		return model.AuthInfo{}, true
+	}
+
+	// If this is a service to service call, we use the existing auth info.
+	if c.callMeta.IsServiceToService() {
+		if c.auth.UID == "" && requiresAuth {
+			// Unless there isn't some and we need it, in which case we error.
+			err := errs.B().Code(errs.Unauthenticated).Msg("no auth info provided").Err()
+			returnError(c, err, 0, nil)
+			return model.AuthInfo{}, false
+		}
+
+		return c.auth, true
+	}
+
+	var err error
+	info, err = s.authHandler.Authenticate(c)
+	if err != nil {
+		// If the auth handler returned Unauthenticated and the endpoint doesn't actually require auth,
+		// continue as if no auth information was provided.
+		if errs.Code(err) == errs.Unauthenticated && !requiresAuth {
+			return model.AuthInfo{}, true
+		} else {
+			returnError(c, err, 0, nil)
+			return model.AuthInfo{}, false
+		}
+	}
+
+	return info, true
+}
+
+// rpcDesc returns the RPC description for this endpoint,
+// computing and caching the first time it's called.
+func (d *AuthHandlerDesc[Params]) rpcDesc() *model.RPCDesc {
+	d.rpcDescOnce.Do(func() {
+		desc := &model.RPCDesc{
+			Service:     d.Service,
+			SvcNum:      d.SvcNum,
+			Endpoint:    d.Endpoint,
+			AuthHandler: true,
+			Raw:         false,
+
+			// TODO would be nice to support these for auth handlers in the future.
+			RequestType:  nil,
+			ResponseType: nil,
+			Tags:         nil,
+		}
+		d.cachedRPCDesc = desc
+	})
+	return d.cachedRPCDesc
+}
+
+func (d *AuthHandlerDesc[Params]) marshalParams(json jsoniter.API, p Params) []byte {
+	data, _ := json.Marshal(p)
+	return data
+}
+
+// newAuthResp returns an *model.Response for an auth response.
+func (d *AuthHandlerDesc[Params]) newAuthResp(info model.AuthInfo, authErr error, json jsoniter.API) *model.Response {
+	var payload []byte
+	if d.HasAuthData {
+		payload = marshalParams(json, info.UserData)
+	}
+
+	return &model.Response{
+		HTTPStatus:   errs.HTTPStatus(authErr),
+		Err:          authErr,
+		AuthUID:      info.UID,
+		TypedPayload: info.UserData,
+		Payload:      payload,
+	}
+}
diff --git a/runtimes/go/appruntime/apisdk/api/auth_remote.go b/runtimes/go/appruntime/apisdk/api/auth_remote.go
new file mode 100644
index 0000000000..d816f556fe
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/auth_remote.go
@@ -0,0 +1,156 @@
+package api
+
+import (
+	"maps"
+	"net/http"
+
+	"github.com/julienschmidt/httprouter"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/apisdk/api/transport"
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/beta/errs"
+)
+
+// remoteAuthHandler is an AuthHandler that calls a remotely hosted auth handler.
+//
+// This is used when the auth handler is not being hosted in this container, but in
+// another container somewhere else in the cluster.
+type remoteAuthHandler struct {
+	server         *Server        // The server we're running in
+	hostingService config.Service // The service name of the remote auth handler
+	authURL        string         // The URL of the remote auth handler
+	original       AuthHandler
+	logger         zerolog.Logger
+	traceLogs      bool
+}
+
+var _ AuthHandler = (*remoteAuthHandler)(nil)
+
+func (r *remoteAuthHandler) Authenticate(c IncomingContext) (model.AuthInfo, error) {
+	// Quickly check if the auth data is parsable here, if it isn't we can return early
+	// without making a remote call.
+	if err := r.original.ParseAuthData(c); err != nil {
+		return model.AuthInfo{}, err
+	}
+
+	if r.traceLogs {
+		r.logger.Trace().Msg("calling auth handler")
+	}
+
+	// Create the auth request
+	authReq, err := http.NewRequestWithContext(c.ctx, http.MethodPost, r.authURL, nil)
+	if err != nil {
+		r.logger.Err(err).Msg("unable to create auth request")
+		return model.AuthInfo{}, errs.Wrap(err, "unable to create auth request")
+	}
+
+	// Copy over any data which might be needed by the auth handler (query string, headers and cookies)
+	authReq.URL.RawQuery = c.req.URL.RawQuery
+	authReq.Header = maps.Clone(c.req.Header)
+	delete(authReq.Header, "X-Encore-Auth") // Don't copy the platform auth key across
+
+	// Add call meta data to the request, so the receiving service can use to allow access to the auth handler
+	// This also passes a shared TraceID to the auth handler, so it and the service called after the gateway
+	// can both be traced as part of the same trace.
+	meta := CallMetaFromContext(c.ctx)
+	meta.Internal = &InternalCallMeta{
+		// Note we're acting as a ApiCaller here so we can access the __encore/auth_handler endpoint and
+		// also receive full marshalled errors back from the auth handler (as ApiCaller's are allowed PrivateAPIAccess)
+		Caller: ApiCaller{ServiceName: "gateway", Endpoint: "__encore/authhandler"},
+	}
+	if err := meta.AddToRequest(r.server, r.hostingService, transport.HTTPRequest(authReq)); err != nil {
+		r.logger.Err(err).Msg("unable to add call metadata to auth request")
+		return model.AuthInfo{}, errs.Wrap(err, "unable to add call metadata to auth request")
+	}
+
+	// Call the auth handler
+	resp, err := r.server.httpClient.Do(authReq)
+	if err != nil {
+		return model.AuthInfo{}, errs.Wrap(err, "unable to make auth request")
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	// Handle the response
+	switch resp.StatusCode {
+	case http.StatusOK:
+		// user was authenticated, let's decode it
+		t := transport.HTTPResponse(resp)
+		uid, found := t.ReadMeta("UserID")
+		if !found {
+			return model.AuthInfo{}, errs.B().Code(errs.Unauthenticated).Msg("no uid").Err()
+		}
+
+		authData := newAuthDataObj()
+		if err := authJSON.NewDecoder(resp.Body).Decode(authData); err != nil {
+			return model.AuthInfo{}, errs.Wrap(err, "unable to decode auth data")
+		}
+
+		return model.AuthInfo{
+			UID:      model.UID(uid),
+			UserData: authData,
+		}, nil
+
+	default:
+		// the user was not authenticated, let's return the error
+		err := unmarshalErrorResponse(resp)
+		if errs.Code(err) != errs.Unauthenticated && r.traceLogs {
+			r.logger.Trace().Err(err).Msg("auth handler returned error")
+		}
+
+		return model.AuthInfo{}, err
+	}
+}
+
+// handleRemoteAuthCall is the server side of remoteAuthHandler.Authenticate
+func (s *Server) handleRemoteAuthCall(w http.ResponseWriter, req *http.Request, _ httprouter.Params) {
+	// Parse the incoming call metadata
+	meta := CallMetaFromContext(req.Context())
+
+	// Check if the caller was the gateway, if not return an error
+	if meta.Internal == nil || meta.Internal.Caller == nil {
+		errs.HTTPErrorWithCode(w, errs.B().Code(errs.PermissionDenied).Msg("permission denied").Err(), 0)
+		return
+	}
+	caller, ok := meta.Internal.Caller.(ApiCaller)
+	if !ok || caller.ServiceName != "gateway" || caller.Endpoint != "__encore/authhandler" {
+		errs.HTTPErrorWithCode(w, errs.B().Code(errs.PermissionDenied).Msg("permission denied").Err(), 0)
+		return
+	}
+
+	// originalC captures the meta _before_ we removed the internal call metadata
+	// this is used for returnError to marshal the full error
+	originalC := s.NewIncomingContext(w, req, nil, meta)
+
+	// Remove the internal call metadata, so it doesn't get passed to the auth handler
+	meta.Internal = nil
+
+	// Create a new IncomingContext
+	c := s.NewIncomingContext(w, req, nil, meta)
+
+	// Call the original auth handler
+	authInfo, err := s.authHandler.Authenticate(c)
+	if err != nil {
+		returnError(originalC, err, 0, nil)
+		return
+	}
+
+	// Add the user ID to the response metadata
+	t := transport.HTTPResponseWriter(w)
+	t.SetMeta("UserID", string(authInfo.UID))
+
+	// Write the auth info to the response
+	if err := authJSON.NewEncoder(w).Encode(authInfo.UserData); err != nil {
+		returnError(originalC, err, 0, nil)
+		return
+	}
+}
+
+func (r *remoteAuthHandler) HostedByService() string {
+	return r.hostingService.Name
+}
+
+func (r *remoteAuthHandler) ParseAuthData(c IncomingContext) error {
+	return r.original.ParseAuthData(c)
+}
diff --git a/runtimes/go/appruntime/apisdk/api/call_context.go b/runtimes/go/appruntime/apisdk/api/call_context.go
new file mode 100644
index 0000000000..3ad758e79f
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/call_context.go
@@ -0,0 +1,11 @@
+//go:build encore_app
+
+package api
+
+import (
+	"context"
+)
+
+func NewCallContext(ctx context.Context) CallContext {
+	return Singleton.NewCallContext(ctx)
+}
diff --git a/runtimes/go/appruntime/apisdk/api/call_meta.go b/runtimes/go/appruntime/apisdk/api/call_meta.go
new file mode 100644
index 0000000000..fbeb4ecde1
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/call_meta.go
@@ -0,0 +1,367 @@
+package api
+
+import (
+	"context"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+
+	jsoniter "github.com/json-iterator/go"
+
+	"encore.dev/appruntime/apisdk/api/svcauth"
+	"encore.dev/appruntime/apisdk/api/transport"
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/shared/cloud"
+	"encore.dev/beta/errs"
+)
+
+var (
+	// authJSON can not be pretty printed, as new lines are not allowed in HTTP headers
+	authJSON = jsoniter.Config{
+		IndentionStep:          0,
+		ValidateJsonRawMessage: true,
+		TagKey:                 "auth-json",
+	}.Froze()
+)
+
+const (
+	callerMetaName = "Caller"
+	calleeMetaName = "Callee"
+)
+
+type metaContextKey string
+
+var (
+	metaContextKeyAuthInfo metaContextKey = "requestMeta"
+)
+
+// CallMeta is metadata for an RPC call
+type CallMeta struct {
+	// Untrusted fields
+	// (i.e. we allow these fields to be passed in from anywhere, including external requests)
+	TraceID       model.TraceID      // The trace ID of the calling request (zero if not tracing)
+	SpanID        model.SpanID       // The span ID of _this_ request if predefined by the caller (zero in most cases)
+	ParentSpanID  model.SpanID       // The span ID of the calling request (zero if there's no parent)
+	ParentEventID model.TraceEventID // The event ID which started the RPC call (zero if there's no parent)
+	CorrelationID string             // The correlation ID of the calling request
+	TraceSampled  bool               // Whether the caller sampled trace info
+
+	// Internal meta data which gets populated by Encore on service to service calls
+	//
+	// If set, the values can be trusted as they would have been authenticated to be correct
+	Internal *InternalCallMeta
+}
+
+// InternalCallMeta is metadata for an RPC call which is being made
+// between two Encore services within the same application.
+type InternalCallMeta struct {
+	Caller   Caller // The name of the service which is making the call
+	AuthUID  string // The UID of the authenticated user
+	AuthData any    // The data of the authenticated user
+}
+
+// addInternalCallMeta adds internal metadata to the external request
+// we're about to make.
+//
+// It does this in a transport agnostic way, allowing us to add metadata
+// to any transport request supported by Encore.
+func (s *Server) metaFromAPICall(call *model.APICall) (meta CallMeta, err error) {
+	// Check the auth data before we marshal
+	// this is because auth.WithContext can set the auth data to any type
+	// and we want to ensure it's the expected type before we marshal it
+	if err := CheckAuthData(call.UserID, call.AuthData); err != nil {
+		return meta, err
+	}
+
+	// Default the caller to the current app deployment
+	var caller Caller
+	caller = AppCaller{s.runtime.DeployID}
+
+	// Trace the source data if we're tracing
+	if call != nil && call.Source != nil {
+		meta.TraceID = call.Source.TraceID
+		meta.ParentSpanID = call.Source.SpanID
+		meta.ParentEventID = call.StartEventID
+		meta.CorrelationID = call.Source.ExtCorrelationID
+		meta.TraceSampled = call.Source.Traced
+
+		if call.Source.RPCData != nil && call.Source.RPCData.Desc != nil {
+			// If we're processing an API call, let's update the caller
+			caller = ApiCaller{
+				ServiceName: call.Source.RPCData.Desc.Service,
+				Endpoint:    call.Source.RPCData.Desc.Endpoint,
+			}
+		} else if call.Source.MsgData != nil && call.Source.MsgData.MessageID != "" {
+			// If we're processing a PubSub message, let's update the caller
+			caller = PubSubCaller{
+				Topic:        call.Source.MsgData.Topic,
+				Subscription: call.Source.MsgData.Subscription,
+				MessageID:    call.Source.MsgData.MessageID,
+			}
+		}
+	}
+
+	meta.Internal = &InternalCallMeta{
+		Caller:   caller,
+		AuthUID:  string(call.UserID),
+		AuthData: call.AuthData,
+	}
+
+	return meta, nil
+}
+
+// AddToRequest adds the metadata to the given request
+func (meta CallMeta) AddToRequest(server *Server, targetService config.Service, req transport.Transport) error {
+	// Future proofing: if we ever create a breaking change to the transport meta
+	// we can use this version number to indicate which version of the meta we're using
+	req.SetMeta("Version", "1")
+
+	// If we're tracing, pass the trace ID, span ID and event ID to the downstream service
+	if !meta.TraceID.IsZero() {
+		// Encode Encore's trace ID and span ID as the traceparent header
+		sampled := "00"
+		if meta.TraceSampled {
+			sampled = "01"
+		}
+		req.SetMeta(transport.TraceParentKey, fmt.Sprintf("00-%x-%x-%s", meta.TraceID[:], meta.ParentSpanID[:], sampled))
+
+		if !meta.ParentSpanID.IsZero() {
+			// Because Encore does not count an RPC call as a span, but rather a set of events within a span
+			// we also need to pass the event ID which started the RPC call in the tracestate header
+			eventID := strconv.FormatUint(uint64(meta.ParentEventID), 36)
+			if server.runtime.EnvCloud == cloud.GCP || server.runtime.EnvCloud == cloud.Encore {
+				// In GCP they add their own span's into the "trace", which breaks our parent span link
+				// so we need to add the parent span ID to the tracestate header so we can track our own parent span
+				req.SetMeta(transport.TraceStateKey, fmt.Sprintf("%s=%x,%s=%s", eventTraceStateSpanIDKey, meta.ParentSpanID[:], eventTraceStateEventIDKey, eventID))
+			} else {
+				// Otherwise all we need to know is our event ID
+				req.SetMeta(transport.TraceStateKey, fmt.Sprintf("%s=%s", eventTraceStateEventIDKey, eventID))
+			}
+		}
+	}
+
+	// Pass the correlation ID to the downstream service.
+	// However, we do _not_ pass the X-Request-ID down, as it is not meant to be propagated through request chains
+	if meta.CorrelationID != "" {
+		req.SetMeta(transport.CorrelationIDKey, meta.CorrelationID)
+	}
+
+	// If we're making an internal call, add the internal metadata to the request
+	if meta.Internal != nil {
+		// Add a marker to the request to indicate that this is an internal call
+		req.SetMeta(callerMetaName, meta.Internal.Caller.CallerString())
+
+		// Add the auth data
+		if meta.Internal.AuthUID != "" {
+			req.SetMeta("UserID", meta.Internal.AuthUID)
+
+			if meta.Internal.AuthData != nil {
+				authData, err := authJSON.Marshal(meta.Internal.AuthData)
+				if err != nil {
+					return errs.B().Cause(err).Msg("failed to marshal auth data").Err()
+				}
+				req.SetMeta("AuthData", string(authData))
+			}
+		}
+
+		// If we're making an internal call, sign the request
+		targetAuth := server.outboundSvcAuth[targetService.ServiceAuth.Method]
+		if targetAuth == nil {
+			return errs.B().Msg("no internal auth method configured to talk with target service").Err()
+		}
+		if err := svcauth.Sign(targetAuth, req); err != nil {
+			return errs.B().Cause(err).Msg("failed to sign internal call").Err()
+		}
+	}
+
+	return nil
+}
+
+func (meta CallMeta) IsServiceToService() bool {
+	return meta.Internal != nil && meta.Internal.Caller != nil
+}
+
+func (meta CallMeta) PrivateAPIAccess() bool {
+	return meta.Internal != nil && meta.Internal.Caller != nil && meta.Internal.Caller.PrivateAPIAccess()
+}
+
+// MetaFromRequest reads the metadata from the given request and returns it
+func (s *Server) MetaFromRequest(req transport.Transport) (meta CallMeta, err error) {
+	// Read the meta version if set and check it's only version 1
+	// as that's the only version we support
+	if metaVersion, found := req.ReadMeta("Version"); found && metaVersion != "1" {
+		return CallMeta{}, errors.New("unknown encore meta version")
+	}
+
+	// If it was an internal call, read the internal metadata
+	if callerStr, found := req.ReadMeta(callerMetaName); found {
+		isInternalCall, err := svcauth.Verify(req, s.inboundSvcAuth)
+		if err != nil {
+			return CallMeta{}, fmt.Errorf("failed to verify internal call: %w", err)
+		}
+		if !isInternalCall {
+			return CallMeta{}, errors.New("no internal call auth found")
+		}
+
+		caller, err := ParseCallerString(callerStr)
+		if err != nil {
+			return CallMeta{}, fmt.Errorf("failed to parse caller string: %w", err)
+		}
+
+		meta.Internal = &InternalCallMeta{
+			Caller: caller,
+		}
+
+		// Pull the auth data out of the request
+		if uid, found := req.ReadMeta("UserID"); found && uid != "" {
+			meta.Internal.AuthUID = uid
+
+			if data, found := req.ReadMeta("AuthData"); found && data != "" {
+				meta.Internal.AuthData = newAuthDataObj()
+
+				if err := authJSON.Unmarshal([]byte(data), meta.Internal.AuthData); err != nil {
+					return CallMeta{}, errs.B().Cause(err).Msg("failed to unmarshal auth data").Err()
+				}
+			}
+		}
+	}
+
+	// If we where tracing read the trace ID, span ID
+	if traceParent, found := req.ReadMeta(transport.TraceParentKey); found &&
+		// For now we only read the traceparent for internal-to-internal calls, this is because CloudRun
+		// is adding a traceparent header to all requests, which is causing our trace system to get confused
+		// and think that the initial request is a child of another already traced request
+		//
+		// In the future we should be able to remove this check and read the traceparent header for all requests
+		// to interopt with other tracing systems.
+		meta.Internal != nil {
+
+		meta.TraceID, meta.ParentSpanID, meta.TraceSampled, _ = parseTraceParent(traceParent)
+
+		// If the caller is a gateway, ignore the parent span id as gateways don't currently record a span.
+		// If we include it the root request won't be tagged as such.
+		if _, isGateway := meta.Internal.Caller.(GatewayCaller); isGateway {
+			meta.ParentSpanID = model.SpanID{}
+		}
+
+		if traceState, found := req.ReadMetaValues(transport.TraceStateKey); found {
+			parentEventID, parentSpanID, ok := parseTraceState(traceState)
+			if ok {
+				meta.ParentEventID = parentEventID
+
+				// If we where given a parent span ID, use that instead of the one from the traceparent header
+				// This is because GCP Cloud Run will add it's own spans in before the application code is run
+				// and thus we lose the parent span ID from the traceparent header
+				if !parentSpanID.IsZero() {
+					meta.ParentSpanID = parentSpanID
+				}
+			}
+		}
+	}
+
+	if correlationID, found := req.ReadMeta(transport.CorrelationIDKey); found {
+		// Don't allow arbitrary correlation IDs to be passed through
+		if len(meta.CorrelationID) > 64 {
+			meta.CorrelationID = correlationID[:64]
+		} else {
+			meta.CorrelationID = correlationID
+		}
+	}
+
+	return meta, nil
+}
+
+// parseTraceParent parses the trace and span ids from s, which is assumed
+// to be in the format of the traceparent header (see https://www.w3.org/TR/trace-context/).
+// If it's not a valid traceparent header it returns zero ids and ok == false.
+func parseTraceParent(s string) (traceID model.TraceID, spanID model.SpanID, sampled, ok bool) {
+	const (
+		version       = "00"
+		traceIDLen    = 32
+		spanIDLen     = 16
+		traceFlagsLen = 2
+
+		verStart     = 0
+		verEnd       = verStart + len(version)
+		verSep       = verEnd
+		traceIDStart = verSep + 1
+		traceIDEnd   = traceIDStart + traceIDLen
+		traceIDSep   = traceIDEnd
+		spanIDStart  = traceIDSep + 1
+		spanIDEnd    = spanIDStart + spanIDLen
+		spanIDSep    = spanIDEnd
+		flagsStart   = spanIDSep + 1
+		flagsEnd     = flagsStart + traceFlagsLen
+		totalLen     = flagsEnd
+	)
+
+	if len(s) != totalLen || s[verStart:verEnd] != version || s[verSep] != '-' || s[traceIDSep] != '-' || s[spanIDSep] != '-' {
+		return model.TraceID{}, model.SpanID{}, false, false
+	}
+
+	_, err := hex.Decode(traceID[:], []byte(s[traceIDStart:traceIDEnd]))
+	if err != nil {
+		return model.TraceID{}, model.SpanID{}, false, false
+	}
+
+	_, err = hex.Decode(spanID[:], []byte(s[spanIDStart:spanIDEnd]))
+	if err != nil {
+		return model.TraceID{}, model.SpanID{}, false, false
+	}
+
+	var flags [1]byte
+	_, err = hex.Decode(flags[:], []byte(s[flagsStart:flagsEnd]))
+	if err != nil {
+		return model.TraceID{}, model.SpanID{}, false, false
+	}
+
+	sampled = flags[0]&1 == 1
+
+	return traceID, spanID, sampled, true
+}
+
+// parseTraceState parses the trace event id from the tracestate header (see https://www.w3.org/TR/trace-context/).
+// If no valid Encore event ID can be parsed it returns zero and ok == false.
+//
+// Note the spec allows for multiple `tracestate` headers to be sent, so we need to check all of them.
+func parseTraceState(headerValues []string) (eventID model.TraceEventID, parentSpanID model.SpanID, ok bool) {
+	for _, thisHeader := range headerValues {
+		theseFields := strings.Split(thisHeader, ",")
+		for _, field := range theseFields {
+			parts := strings.Split(field, "=")
+			if len(parts) != 2 {
+				continue
+			}
+
+			switch parts[0] {
+			case eventTraceStateSpanIDKey:
+				spanIDBytes, err := hex.DecodeString(parts[1])
+				if err != nil || len(spanIDBytes) != 8 {
+					return 0, model.SpanID{}, false
+				}
+				copy(parentSpanID[:], spanIDBytes)
+
+			case eventTraceStateEventIDKey:
+				eventIDUint, err := strconv.ParseUint(parts[1], 36, 64)
+				if err != nil {
+					return 0, model.SpanID{}, false
+				}
+
+				eventID = model.TraceEventID(eventIDUint)
+			}
+		}
+	}
+
+	return eventID, parentSpanID, eventID != 0
+}
+
+func SetCallMetaInContext(ctx context.Context, meta CallMeta) context.Context {
+	return context.WithValue(ctx, metaContextKeyAuthInfo, meta)
+}
+
+func CallMetaFromContext(ctx context.Context) CallMeta {
+	return ctx.Value(metaContextKeyAuthInfo).(CallMeta)
+}
diff --git a/runtimes/go/appruntime/apisdk/api/call_meta_test.go b/runtimes/go/appruntime/apisdk/api/call_meta_test.go
new file mode 100644
index 0000000000..4e2b0b0822
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/call_meta_test.go
@@ -0,0 +1,24 @@
+package api
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/frankban/quicktest"
+
+	"encore.dev/appruntime/exported/model"
+)
+
+func TestParseTraceParent(t *testing.T) {
+	q := quicktest.New(t)
+
+	expTraceID, _ := model.GenTraceID()
+	expSpanID, _ := model.GenSpanID()
+	expSampled := "01"
+
+	traceID, spanID, sampled, ok := parseTraceParent(fmt.Sprintf("00-%x-%x-%s", expTraceID[:], expSpanID[:], expSampled))
+	q.Assert(ok, quicktest.IsTrue)
+	q.Assert(traceID, quicktest.DeepEquals, expTraceID)
+	q.Assert(spanID, quicktest.DeepEquals, expSpanID)
+	q.Assert(sampled, quicktest.Equals, true)
+}
diff --git a/runtimes/go/appruntime/apisdk/api/callers.go b/runtimes/go/appruntime/apisdk/api/callers.go
new file mode 100644
index 0000000000..532f90b83e
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/callers.go
@@ -0,0 +1,120 @@
+package api
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+)
+
+// Caller is an interface which can be used to identify the caller of an RPC call.
+// if the caller is an authenticated source.
+type Caller interface {
+	CallerString() string   // What is the caller wireformat?
+	PrivateAPIAccess() bool // Is this caller allowed to access private APIs?
+}
+
+// ApiCaller is a caller which represents an RPC which made a service-to-service API call
+type ApiCaller struct {
+	ServiceName string
+	Endpoint    string
+}
+
+func (s ApiCaller) CallerString() string {
+	return fmt.Sprintf("api:%s.%s", s.ServiceName, s.Endpoint)
+}
+
+func (s ApiCaller) PrivateAPIAccess() bool {
+	return true
+}
+
+// PubSubCaller is a caller which represents a PubSub subscription which made a service-to-service API call
+type PubSubCaller struct {
+	Topic        string
+	Subscription string
+	MessageID    string
+}
+
+func (p PubSubCaller) CallerString() string {
+	return fmt.Sprintf("pubsub:%s:%s:%s", p.Topic, p.Subscription, p.MessageID)
+}
+
+func (p PubSubCaller) PrivateAPIAccess() bool {
+	return true
+}
+
+// AppCaller is a caller which represents the app itself made a service-to-service API call, but outside any traced process
+// - This most likely means the call was made from a background process or init function
+type AppCaller struct {
+	DeployID string
+}
+
+func (a AppCaller) CallerString() string {
+	return fmt.Sprintf("app:%s", a.DeployID)
+}
+
+func (a AppCaller) PrivateAPIAccess() bool {
+	return true
+}
+
+// GatewayCaller is a caller which represents an API gateway within the application made a service-to-service API call
+// This is used to identify the fact that the call was made from a gateway, and not from a background process or init function
+// and should not be allowed access to the private routes
+type GatewayCaller struct {
+	GatewayName string // The encore name of the gateway
+}
+
+func (g GatewayCaller) CallerString() string {
+	// Return the string with ".none" for backwards compatibility.
+	// This can be removed later when all services support the new format.
+	return fmt.Sprintf("gateway:%s.none", g.GatewayName)
+}
+
+func (g GatewayCaller) PrivateAPIAccess() bool {
+	return false
+}
+
+// EncoreCaller represents an RPC call made from Encore's central systems (such as the Cloud dashboard)
+type EncoreCaller struct {
+	Principal string // The principal which made the call, could be an end user or a service
+}
+
+func (e EncoreCaller) CallerString() string {
+	return fmt.Sprintf("encore:%s", e.Principal)
+}
+
+func (e EncoreCaller) PrivateAPIAccess() bool {
+	return true
+}
+
+// ParseCallerString parses a caller string into a Caller object
+func ParseCallerString(callerStr string) (Caller, error) {
+	switch {
+	case strings.HasPrefix(callerStr, "api:"):
+		service, endpoint, found := strings.Cut(callerStr[len("api:"):], ".")
+		if !found {
+			return nil, errors.New("invalid api caller")
+		}
+		return ApiCaller{service, endpoint}, nil
+	case strings.HasPrefix(callerStr, "pubsub:"):
+		topic, subscriptionAndMsgId, found := strings.Cut(callerStr[len("pubsub:"):], ":")
+		if !found {
+			return nil, errors.New("invalid pubsub caller")
+		}
+		subscription, msgId, found := strings.Cut(subscriptionAndMsgId, ":")
+		if !found {
+			return nil, errors.New("invalid pubsub caller")
+		}
+		return PubSubCaller{topic, subscription, msgId}, nil
+	case strings.HasPrefix(callerStr, "app:"):
+		return AppCaller{callerStr[len("app:"):]}, nil
+	case strings.HasPrefix(callerStr, "gateway:"):
+		// We used to have "service.endpoint" but now we only have the gateway name.
+		// Still parse the old format for backwards compatibility.
+		gateway, _, _ := strings.Cut(callerStr[len("gateway:"):], ".")
+		return GatewayCaller{gateway}, nil
+	case strings.HasPrefix(callerStr, "encore:"):
+		return EncoreCaller{callerStr[len("encore:"):]}, nil
+	default:
+		return nil, errors.New("invalid caller")
+	}
+}
diff --git a/runtimes/go/appruntime/apisdk/api/capture.go b/runtimes/go/appruntime/apisdk/api/capture.go
new file mode 100644
index 0000000000..7bdd8dc39f
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/capture.go
@@ -0,0 +1,368 @@
+package api
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+
+	"github.com/felixge/httpsnoop"
+)
+
+// rawRequestBodyCapturer is an io.ReadCloser that can be substituted for
+// (*http.Request).Body to capture its payload for tracing raw requests.
+//
+// It only parses requests matching certain mime types and only
+// a limited amount of data suitable for displaying in traces.
+type rawRequestBodyCapturer struct {
+	state      captureState
+	underlying io.ReadCloser
+
+	bufMu      sync.Mutex
+	buf        *bytes.Buffer
+	overflowed bool // whether the buffer overflowed
+}
+
+func newRawRequestBodyCapturer(req *http.Request) *rawRequestBodyCapturer {
+	buf := captureBufferPool.Get().(*bytes.Buffer)
+	buf.Reset()
+
+	var state captureState
+	// Don't capture WebSockets etc
+	if isUpgradeRequest(req) {
+		state = notCapturing
+	} else {
+		state = shouldCaptureContentType(req.Header.Get("Content-Type"), false)
+	}
+
+	return &rawRequestBodyCapturer{
+		state:      state,
+		underlying: req.Body,
+		buf:        buf,
+	}
+}
+
+// captureState defines whether the capturer is actively capturing.
+type captureState uint8
+
+const (
+	notCapturing captureState = 0
+	capturing    captureState = 1
+
+	// peeking means the capturer is evaluating whether or not to capture
+	// the full request, based on peeking at the first few bytes of
+	// the request. It's used when the Content-Type is missing or vague.
+	peeking captureState = 2
+)
+
+const (
+	// MaxRawRequestCaptureLen is the maximum buffer size to keep for
+	// captured request payloads.
+	MaxRawRequestCaptureLen  = 10 << 10  // 10 KiB
+	MaxRawResponseCaptureLen = 100 << 10 // 100 KiB
+)
+
+// Read implements io.Reader.
+func (c *rawRequestBodyCapturer) Read(b []byte) (int, error) {
+	n, err := c.underlying.Read(b)
+
+	if n > 0 && c.state != notCapturing && !c.overflowed {
+		c.bufMu.Lock()
+		defer c.bufMu.Unlock()
+
+		// Guard against the buffer having been disposed of.
+		if c.buf != nil {
+			remaining := MaxRawRequestCaptureLen - c.buf.Len()
+			toWrite := n
+			// If we can write less than we read, mark the buffer as having overflowed.
+			if remaining < n {
+				toWrite = remaining
+				c.overflowed = true
+			}
+			c.buf.Write(b[:toWrite])
+
+			if c.state == peeking && c.buf.Len() >= 512 {
+				contentType := http.DetectContentType(c.buf.Bytes())
+				c.state = shouldCaptureContentType(contentType, true)
+			}
+		}
+	}
+
+	return n, err
+}
+
+// Close implements io.Closer.
+func (c *rawRequestBodyCapturer) Close() error {
+	return c.underlying.Close()
+}
+
+// FinishCapturing finishes the capturing, returning the captured bytes thus far.
+// The returned buf may be used until Dispose is called but not after that.
+//
+// If c is nil it reports nil, false.
+func (c *rawRequestBodyCapturer) FinishCapturing() (data []byte, overflowed bool) {
+	if c == nil {
+		return nil, false
+	}
+
+	c.bufMu.Lock()
+	defer c.bufMu.Unlock()
+
+	// If we're definitely not capturing, return no data.
+	if c.state == notCapturing {
+		return nil, false
+	}
+
+	// If we're peeking, make a decision.
+	data = c.buf.Bytes()
+	if c.state == peeking {
+		contentType := http.DetectContentType(data)
+		c.state = shouldCaptureContentType(contentType, true)
+		if c.state != capturing {
+			// Not capturing after all; return no data.
+			return nil, false
+		}
+	}
+
+	// Stop capturing.
+	c.state = notCapturing
+	return data, c.overflowed
+}
+
+// Dispose disposes of the capturer, returning the
+// resources to the pool for use by future requests.
+//
+// The capturer may not be used after calling Dispose.
+func (c *rawRequestBodyCapturer) Dispose() {
+	c.bufMu.Lock()
+	defer c.bufMu.Unlock()
+	if c.buf != nil {
+		captureBufferPool.Put(c.buf)
+		c.buf = nil
+	}
+}
+
+var captureBufferPool = sync.Pool{
+	New: func() any {
+		return new(bytes.Buffer)
+	},
+}
+
+func shouldCaptureContentType(contentType string, didPeek bool) captureState {
+	if idx := strings.IndexByte(contentType, ';'); idx >= 0 {
+		contentType = contentType[:idx]
+	}
+
+	switch contentType {
+	case "application/json", "text/plain", "application/x-www-form-urlencoded", "text/csv",
+		"text/javascript", "application/ld+json", "application/xml", "text/xml", "application/atom+xml":
+		return capturing
+
+	// Unknown content type; peek at the data to decide what to do.
+	case "", "application/octet-stream":
+		// If we already peeked, don't capture these.
+		if didPeek {
+			return notCapturing
+		}
+		return peeking
+
+	default:
+		return notCapturing
+	}
+}
+
+func isUpgradeRequest(req *http.Request) bool {
+	return req.Header.Get("Upgrade") != ""
+}
+
+type rawResponseCapturer struct {
+	state captureState
+	w     http.ResponseWriter
+	hooks httpsnoop.Hooks
+
+	Code          int
+	HeaderWritten bool
+	BytesWritten  int64
+
+	// Header is a snapshot of the HTTP headers when they get written.
+	Header http.Header
+
+	bufMu      sync.Mutex
+	buf        *bytes.Buffer
+	overflowed bool // whether the buffer overflowed
+}
+
+func newRawResponseCapturer(w http.ResponseWriter, req *http.Request) *rawResponseCapturer {
+	buf := captureBufferPool.Get().(*bytes.Buffer)
+	buf.Reset()
+
+	var state captureState
+	// Don't capture WebSockets etc
+	if isUpgradeRequest(req) {
+		state = notCapturing
+	} else {
+		state = peeking
+	}
+
+	c := &rawResponseCapturer{
+		state: state,
+		w:     w,
+		buf:   buf,
+	}
+	c.hooks = httpsnoop.Hooks{
+		WriteHeader: func(next httpsnoop.WriteHeaderFunc) httpsnoop.WriteHeaderFunc {
+			return func(code int) {
+				c.onWriteHeader(code, next)
+			}
+		},
+
+		Write: func(next httpsnoop.WriteFunc) httpsnoop.WriteFunc {
+			return func(p []byte) (int, error) {
+				return c.onWrite(p, next)
+			}
+		},
+
+		ReadFrom: func(next httpsnoop.ReadFromFunc) httpsnoop.ReadFromFunc {
+			return func(src io.Reader) (int64, error) {
+				return c.onReadFrom(src, next)
+			}
+		},
+	}
+	return c
+}
+
+// InvokeHandler invokes the given HTTP handler, using the response capturer to
+// capture information about the response.
+func (c *rawResponseCapturer) InvokeHandler(h http.Handler, req *http.Request) {
+	c.Code = 200 // by default
+	w := httpsnoop.Wrap(c.w, c.hooks)
+	h.ServeHTTP(w, req)
+}
+
+func (c *rawResponseCapturer) onWriteHeader(code int, next httpsnoop.WriteHeaderFunc) {
+	next(code)
+	c.markHeadersWritten(code)
+}
+
+func (c *rawResponseCapturer) onWrite(p []byte, next httpsnoop.WriteFunc) (int, error) {
+	n, err := next(p)
+	c.markHeadersWritten(200)
+	c.BytesWritten += int64(n)
+	c.writeToBuf(p[:n])
+	return n, err
+}
+
+func (c *rawResponseCapturer) onReadFrom(src io.Reader, next httpsnoop.ReadFromFunc) (int64, error) {
+	if c.state != notCapturing {
+		// If we're capturing data,
+		src = io.TeeReader(src, rawResponseCapturerTeeWriter{c})
+	}
+	n, err := next(src)
+	c.markHeadersWritten(200)
+	c.BytesWritten += n
+	return n, err
+}
+
+// writeToBuf writes data to the capture buffer, if we're capturing data.
+func (c *rawResponseCapturer) writeToBuf(b []byte) {
+	n := len(b)
+
+	if n > 0 && c.state != notCapturing && !c.overflowed {
+		c.bufMu.Lock()
+		defer c.bufMu.Unlock()
+
+		// Guard against the buffer having been disposed of.
+		if c.buf != nil {
+			remaining := MaxRawResponseCaptureLen - c.buf.Len()
+			toWrite := n
+			// If we can write less than we read, mark the buffer as having overflowed.
+			if remaining < n {
+				toWrite = remaining
+				c.overflowed = true
+			}
+			c.buf.Write(b[:toWrite])
+
+			if c.state == peeking && c.buf.Len() >= 512 {
+				contentType := http.DetectContentType(c.buf.Bytes())
+				c.state = shouldCaptureContentType(contentType, true)
+			}
+		}
+	}
+}
+
+// markHeadersWritten marks the headers as written, using the given status code
+// and snapshotting the HTTP headers written.
+// If the headers have already been written, this is a no-op.
+func (c *rawResponseCapturer) markHeadersWritten(code int) {
+	if c.HeaderWritten {
+		return
+	}
+	c.Code = code
+	c.HeaderWritten = true
+
+	// Snapshot the headers
+	src := c.w.Header()
+	c.Header = make(http.Header, len(src))
+	for k, v := range src {
+		c.Header[k] = v
+	}
+}
+
+// FinishCapturing finishes the capturing, returning the captured bytes thus far.
+// The returned buf may be used until Dispose is called but not after that.
+//
+// If c is nil it reports nil, false.
+func (c *rawResponseCapturer) FinishCapturing() (data []byte, overflowed bool) {
+	if c == nil {
+		return nil, false
+	}
+
+	c.bufMu.Lock()
+	defer c.bufMu.Unlock()
+
+	// If we're definitely not capturing, return no data.
+	if c.state == notCapturing {
+		return nil, false
+	}
+
+	// If we're peeking, make a decision.
+	data = c.buf.Bytes()
+	if c.state == peeking {
+		contentType := http.DetectContentType(data)
+		c.state = shouldCaptureContentType(contentType, true)
+		if c.state != capturing {
+			// Not capturing after all; return no data.
+			return nil, false
+		}
+	}
+
+	// Stop capturing.
+	c.state = notCapturing
+	return data, c.overflowed
+}
+
+// Dispose disposes of the capturer, returning the
+// resources to the pool for use by future requests.
+//
+// The capturer may not be used after calling Dispose.
+func (c *rawResponseCapturer) Dispose() {
+	c.bufMu.Lock()
+	defer c.bufMu.Unlock()
+	if c.buf != nil {
+		captureBufferPool.Put(c.buf)
+		c.buf = nil
+	}
+}
+
+type rawResponseCapturerTeeWriter struct {
+	c *rawResponseCapturer
+}
+
+// Write implements io.Writer, for the use with onReadFrom.
+func (w rawResponseCapturerTeeWriter) Write(p []byte) (int, error) {
+	// onReadFrom is handling the updating of status code, headers, and bytes written,
+	// so we only write to our buffer here.
+	w.c.writeToBuf(p)
+	return len(p), nil
+}
diff --git a/runtimes/go/appruntime/apisdk/api/encore_routes.go b/runtimes/go/appruntime/apisdk/api/encore_routes.go
new file mode 100644
index 0000000000..a96f43b4a3
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/encore_routes.go
@@ -0,0 +1,92 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/julienschmidt/httprouter"
+
+	"encore.dev/appruntime/shared/jsonapi"
+	"encore.dev/beta/errs"
+)
+
+func (s *Server) registerEncoreRoutes() {
+	s.encore.HandlerFunc(wildcardMethod, "/healthz", s.handleHealthz)
+	s.encore.Handle("POST", "/pubsub/push/:subscription_id", s.handlePubsubPush)
+	s.encore.Handle("POST", "/authhandler", s.handleRemoteAuthCall)
+}
+
+// handleHealthz returns the current health and deployment details of the running Encore application
+func (s *Server) handleHealthz(w http.ResponseWriter, req *http.Request) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+
+	statusStr := "ok"
+	statusCode := http.StatusOK
+
+	// Run all health checks
+	type checkResult struct {
+		Name   string `json:"name"`
+		Passed bool   `json:"passed"`
+		Error  string `json:"error,omitempty"`
+	}
+	var checkResults []checkResult
+	for _, result := range s.healthMgr.RunAll(req.Context()) {
+		errStr := ""
+		if result.Err != nil {
+			statusStr = "unhealthy"
+			statusCode = http.StatusInternalServerError
+			errStr = result.Err.Error()
+		}
+
+		checkResults = append(checkResults, checkResult{
+			Name:   result.Name,
+			Passed: result.Err == nil,
+			Error:  errStr,
+		})
+	}
+
+	w.WriteHeader(statusCode)
+	bytes, _ := jsonapi.Default.Marshal(struct {
+		Code    string `json:"code"`
+		Message string `json:"message"`
+		Details any    `json:"details"`
+	}{
+		Code:    statusStr,
+		Message: "Your Encore app is up and running!",
+		Details: struct {
+			AppRevision        string        `json:"app_revision"`
+			EncoreCompiler     string        `json:"encore_compiler"`
+			DeployId           string        `json:"deploy_id"`
+			Checks             []checkResult `json:"checks"`
+			EnabledExperiments []string      `json:"enabled_experiments"`
+		}{
+			AppRevision:        s.static.AppCommit.AsRevisionString(),
+			EncoreCompiler:     s.static.EncoreCompiler,
+			DeployId:           s.runtime.DeployID,
+			Checks:             checkResults,
+			EnabledExperiments: s.experiments.StringList(),
+		},
+	})
+	// nosemgrep
+	_, _ = w.Write(bytes)
+}
+
+// handlePubsubPush acts like an internal router from the Encore push route, to a registered handler for the given
+// subscription
+func (s *Server) handlePubsubPush(w http.ResponseWriter, req *http.Request, ps httprouter.Params) {
+	subscriptionID := ps.ByName("subscription_id")
+	if subscriptionID == "" {
+		err := errs.B().Code(errs.InvalidArgument).Msg("missing subscription ID").Err()
+		s.rt.Logger().Err(err).Str("subscription_id", subscriptionID).Msg("invalid PubSub push request")
+		errs.HTTPError(w, err)
+		return
+	}
+	// Is this a gateway and the pubsub subscription isn't hosted here?
+	// If so forward the request to the target service instead.
+	if remoteSubHandler, ok := s.remotePubSubPush[subscriptionID]; ok {
+		remoteSubHandler.ServeHTTP(w, req)
+		return
+	}
+
+	s.pubsubMgr.HandlePubSubPush(w, req, subscriptionID)
+}
diff --git a/runtimes/go/appruntime/apisdk/api/errmarshalling/fallback.go b/runtimes/go/appruntime/apisdk/api/errmarshalling/fallback.go
new file mode 100644
index 0000000000..e05cfbf4c8
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/errmarshalling/fallback.go
@@ -0,0 +1,148 @@
+package errmarshalling
+
+import (
+	"errors"
+	"fmt"
+	"reflect"
+	"unsafe"
+
+	jsoniter "github.com/json-iterator/go"
+	"github.com/modern-go/reflect2"
+)
+
+func init() {
+	marshaller := &jsonMarshaller{
+		unmarshal: fallbackUnmarshal,
+		decoder: func(ptr unsafe.Pointer, iter *jsoniter.Iterator) {
+			err := fallbackUnmarshal(iter)
+			fmt.Println("here with ", err)
+		},
+	}
+	serdeByName["error"] = marshaller
+}
+
+func fallbackUnmarshal(itr *jsoniter.Iterator) error {
+	var errMsg string
+	var wrapped error
+	var wrappedList []error
+
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case MessageKey:
+			errMsg = itr.ReadString()
+		case WrappedKey:
+			switch itr.WhatIsNext() {
+			case jsoniter.ArrayValue:
+				itr.ReadArrayCB(func(itr *jsoniter.Iterator) bool {
+					wrappedList = append(wrappedList, UnmarshalError(itr))
+					return true
+				})
+			case jsoniter.ObjectValue:
+				wrapped = UnmarshalError(itr)
+			default:
+				itr.ReportError("unmarshal", "expected array or object")
+				itr.Skip()
+			}
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+
+	switch {
+	case len(wrappedList) > 0:
+		return &fallbackMultiWrapErr{
+			msg:     errMsg,
+			wrapped: wrappedList,
+		}
+	case wrapped != nil:
+		return &fallbackSingleWrapErr{
+			msg:     errMsg,
+			wrapped: wrapped,
+		}
+	default:
+		return errors.New(errMsg)
+	}
+}
+
+func createFallbackEncoder(typ reflect2.Type) jsoniter.ValEncoder {
+	return &jsonMarshaller{
+		encoder: func(ptr unsafe.Pointer, stream *jsoniter.Stream) {
+			pointerToVal := typ.PackEFace(ptr)                        // *[error type]
+			iface := reflect.ValueOf(pointerToVal).Elem().Interface() // [error type]
+			err := iface.(error)                                      // error
+
+			// check if we have a custom marshaller for this type
+			// if we do then use it.
+			//
+			// this path can occur if the field is strongly typed as `error`
+			_, found := serdeByType[reflect2.TypeOf(iface)]
+			if found {
+				// this will go via the custom marshaller now
+				stream.WriteVal(iface)
+				return
+			}
+
+			stream.WriteObjectStart()
+
+			stream.WriteObjectField(TypeKey)
+			stream.WriteString("error")
+			stream.WriteMore()
+
+			stream.WriteObjectField(MessageKey)
+			stream.WriteString(err.Error())
+
+			switch err := err.(type) {
+			case interface{ Unwrap() error }:
+				wrapped := err.Unwrap()
+				if wrapped != nil {
+					stream.WriteMore()
+					stream.WriteObjectField(WrappedKey)
+					stream.WriteVal(wrapped)
+				}
+
+			case interface{ Unwrap() []error }:
+				wrapped := err.Unwrap()
+				if len(wrapped) > 0 {
+					stream.WriteMore()
+					stream.WriteObjectField(WrappedKey)
+					stream.WriteVal(wrapped)
+				}
+			}
+
+			stream.WriteObjectEnd()
+		},
+	}
+}
+
+// fallbackSingleWrapErr is a fallback error type that wraps a single error.
+type fallbackSingleWrapErr struct {
+	msg     string
+	wrapped error
+}
+
+var _ error = (*fallbackSingleWrapErr)(nil)
+
+func (f *fallbackSingleWrapErr) Error() string {
+	return f.msg
+}
+
+func (f *fallbackSingleWrapErr) Unwrap() error {
+	return f.wrapped
+}
+
+// fallbackMultiWrapErr is a fallback error type that wraps multiple errors.
+type fallbackMultiWrapErr struct {
+	msg     string
+	wrapped []error
+}
+
+var _ error = (*fallbackMultiWrapErr)(nil)
+
+func (f *fallbackMultiWrapErr) Error() string {
+	return f.msg
+}
+
+func (f *fallbackMultiWrapErr) Unwrap() []error {
+	return f.wrapped
+}
diff --git a/runtimes/go/appruntime/apisdk/api/errmarshalling/jsonextension.go b/runtimes/go/appruntime/apisdk/api/errmarshalling/jsonextension.go
new file mode 100644
index 0000000000..ae57373e65
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/errmarshalling/jsonextension.go
@@ -0,0 +1,159 @@
+package errmarshalling
+
+import (
+	"fmt"
+	"reflect"
+	"unsafe"
+
+	jsoniter "github.com/json-iterator/go"
+	"github.com/modern-go/reflect2"
+)
+
+var (
+	// jsonMarshaller by reflect2 type (we use this for speed in the extension)
+	serdeByType = map[reflect2.Type]*jsonMarshaller{}
+
+	// jsonMarshaller by name (we use this for use in Unmarshal)
+	serdeByName = map[string]*jsonMarshaller{}
+
+	// errType is the reflect2 type of the error interface
+	errType = reflect2.Type2(reflect.TypeOf((*error)(nil)).Elem())
+)
+
+const (
+	// TypeKey is the key used to identify the type of an error
+	// used to unmarshal the correct error type
+	TypeKey = "@type"
+
+	// MessageKey is the key used to identify the message of an error
+	// we use a common name, which allows the fallback unmarshaler to work
+	MessageKey = "msg"
+
+	// WrappedKey is the key used to identify the wrapped error(s) of an error
+	// it can be either a single object or an array of objects
+	// again we use a common name, which allows the fallback unmarshaler to work
+	WrappedKey = "wraps"
+)
+
+// RegisterErrorMarshaller registers a custom marshaller for a specific error type
+//
+// The error type has to be used as a pointer, and must be registered before any
+// calls to [Marshal] or [Unmarshal] are made.
+//
+// The encoder and decoder functions are responsible for encoding and decoding
+// the error object.
+//
+// Encoder will be passed a *jsoniter.Stream which is already in object mode.
+// so fields can be written directly to it without needing to call WriteObjectStart or WriteObjectEnd.
+//
+// Decoder will be passed a *jsoniter.Iterator before the object has been read.
+// allowing calls to ReadObjectCB to read the fields of the object.
+func RegisterErrorMarshaller[T error](encoder func(T, *jsoniter.Stream), decoder func(T, *jsoniter.Iterator)) {
+	var zero T
+	typ := reflect2.TypeOf(zero)
+	if !typ.LikePtr() {
+		panic(fmt.Errorf("error type %s must be a pointer", typ.String()))
+	}
+	baseType := reflect2.TypeOfPtr(zero).Elem()
+	typeName := baseType.Type1().PkgPath() + "." + baseType.Type1().Name()
+
+	marshaller := &jsonMarshaller{
+		unmarshal: func(itr *jsoniter.Iterator) error {
+			zero := baseType.New()
+			itr.ReadVal(&zero)
+			return zero.(error)
+		},
+		encoder: func(ptr unsafe.Pointer, stream *jsoniter.Stream) {
+			stream.WriteObjectStart()
+
+			// Write the type name
+			stream.WriteObjectField(TypeKey)
+			stream.WriteString(typeName)
+			stream.WriteMore()
+
+			// Hand over to the encoder provided
+			encoder(*(*T)(ptr), stream)
+
+			stream.WriteObjectEnd()
+		},
+		decoder: func(ptr unsafe.Pointer, iter *jsoniter.Iterator) {
+			// Create a new instance of the error object
+			obj := baseType.UnsafeNew()
+
+			// let the passed in decoder do it's job
+			decoder(baseType.PackEFace(obj).(T), iter)
+
+			// set the pointer to the new object that we just unmarhsalled
+			baseType.UnsafeSet(ptr, obj)
+		},
+	}
+
+	serdeByName[typeName] = marshaller
+	serdeByType[typ] = marshaller
+}
+
+// jsonExtension is a jsoniter extension that allows us to register custom
+// error encoder and decoders using [RegisterErrorMarshaller]
+type jsonExtension struct {
+	jsoniter.DummyExtension
+}
+
+func (extension *jsonExtension) CreateDecoder(typ reflect2.Type) jsoniter.ValDecoder {
+	// If somebody is trying to unmarshal an error directly
+	// we know how to do that
+	if typ == errType {
+		return &jsonMarshaller{decoder: func(ptr unsafe.Pointer, iter *jsoniter.Iterator) {
+			err := UnmarshalError(iter)
+			errType.UnsafeSet(ptr, unsafe.Pointer(&err))
+		}}
+	}
+
+	// jsoniter is asking if we know how to decode this value
+	// we index by the base type, but we get a pointer type here - hence the "PtrTo" call.
+	if f, ok := serdeByType[reflect2.PtrTo(typ)]; ok {
+		return f
+	}
+	return nil
+}
+
+func (extension *jsonExtension) CreateEncoder(typ reflect2.Type) jsoniter.ValEncoder {
+	// jsoniter is asking if we know how to encode this value
+	// we'll be passed a pointer type here, so we can index directly
+	if f, ok := serdeByType[typ]; ok {
+		return f
+	}
+
+	// However if we don't have a marshaller for this type, we can check if it implements the error interface
+	// and if it does, we can create a fallback marshaller for it.
+	if typ.Implements(errType) {
+		return createFallbackEncoder(typ)
+	}
+
+	return nil
+}
+
+// jsonMarshaller is a simple struct which implements jsoniter's ValEncoder and ValDecoder interfaces
+// allowing us to use it as a single object without having to create multiple objects
+type jsonMarshaller struct {
+	// unmarshal takes an iterator, creates a new version of the error object, and returns it
+	unmarshal func(itr *jsoniter.Iterator) error
+	encoder   jsoniter.EncoderFunc
+	decoder   jsoniter.DecoderFunc
+}
+
+var (
+	_ jsoniter.ValEncoder = (*jsonMarshaller)(nil)
+	_ jsoniter.ValDecoder = (*jsonMarshaller)(nil)
+)
+
+func (j *jsonMarshaller) Encode(ptr unsafe.Pointer, stream *jsoniter.Stream) {
+	j.encoder(ptr, stream)
+}
+
+func (j *jsonMarshaller) IsEmpty(ptr unsafe.Pointer) bool {
+	return false
+}
+
+func (j *jsonMarshaller) Decode(value unsafe.Pointer, iter *jsoniter.Iterator) {
+	j.decoder(value, iter)
+}
diff --git a/runtimes/go/appruntime/apisdk/api/errmarshalling/marshal.go b/runtimes/go/appruntime/apisdk/api/errmarshalling/marshal.go
new file mode 100644
index 0000000000..9f54863555
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/errmarshalling/marshal.go
@@ -0,0 +1,157 @@
+package errmarshalling
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"strconv"
+	"unsafe"
+
+	jsoniter "github.com/json-iterator/go"
+)
+
+var json = JsonAPI()
+
+// JsonAPI returns a jsoniter.API instance that can be used to marshal
+// errors
+//
+// It is only exported for use in tests!
+func JsonAPI() jsoniter.API {
+	api := jsoniter.Config{
+		EscapeHTML:             false,
+		IndentionStep:          2,
+		SortMapKeys:            true,
+		ValidateJsonRawMessage: true,
+		TagKey:                 "err_json", // ignore `json` tags (as we use them to hide stuff sometimes)
+	}.Froze()
+
+	// Register the JSON extension to allow us to register custom marshallers
+	// For our error types
+	api.RegisterExtension(&jsonExtension{})
+
+	return api
+}
+
+// Marshal will marshal the given error into a JSON byte slice
+//
+// If the error is nil, the return value will be the JSON null value.
+//
+// If an error or panic occurs while marshalling the error,
+// a generic error will be marshalled instead
+func Marshal(err error) (rtn []byte) {
+	// Recover from any panics that may occur while marshalling and
+	// return a generic error message around the panic
+	defer func() {
+		if r := recover(); r != nil {
+			// because we don't know the cause of the panic, let's write
+			// the bytes manually to avoid any further panics if it's being caused by
+			// jsoniter
+			rtn = []byte(
+				fmt.Sprintf(
+					"{ \"%s\": \"error\", \"%s\": \"%s\"}",
+					TypeKey, MessageKey,
+					strconv.Quote(fmt.Sprintf("panic occured while marshalling error: %v", r)),
+				),
+			)
+		}
+	}()
+
+	// No error, nothing to marshal
+	if err == nil {
+		return []byte{'n', 'u', 'l', 'l'}
+	}
+
+	// Try to marshal the error using the registered marshallers
+	wf, err := json.Marshal(err)
+	if err == nil {
+		return wf
+	}
+
+	// Otherwise fall back and marshal the error as a super generic error
+	var buf bytes.Buffer
+	stream := json.BorrowStream(&buf)
+	defer json.ReturnStream(stream)
+
+	stream.WriteObjectStart()
+	stream.WriteObjectField(TypeKey)
+	stream.WriteString("error")
+	stream.WriteMore()
+	stream.WriteObjectField(MessageKey)
+	stream.WriteString(err.Error())
+	stream.WriteObjectEnd()
+	_ = stream.Flush()
+
+	return buf.Bytes()
+}
+
+// Unmarshal attempts to unmarshal an error from the given bytes,
+//
+// On success, the unmarshalled error will be returned, and the error will be nil
+// On failure, unmarshalled will be nil and the error will be non-nil
+func Unmarshal(bytes []byte) (unmarshalled error, err error) {
+	// Read the type name lazily (we will only read enough bytes to get the type name)
+	typeName := json.Get(bytes, TypeKey).ToString()
+
+	marshallers, found := serdeByName[typeName]
+	if !found {
+		return nil, fmt.Errorf("error type %s not registered", typeName)
+	}
+
+	itr := json.BorrowIterator(bytes)
+	defer json.ReturnIterator(itr)
+
+	unmarshalledError := marshallers.unmarshal(itr)
+
+	return unmarshalledError, itr.Error
+}
+
+// UnmarshalError attempts to unmarshal an error from the given iterator,
+// returning the unmarshalled error if successful, or nil if not.
+func UnmarshalError(itr *jsoniter.Iterator) (unmarshalledError error) {
+	unmarshalled, err := Unmarshal(itr.SkipAndReturnBytes())
+	if err != nil {
+		itr.ReportError("unmarshal", err.Error())
+		return nil
+	} else {
+		return unmarshalled
+	}
+}
+
+// TryWriteValue attempts to marshal the given value into JSON, returning the
+// marshalled bytes if successful, or false if not.
+func TryWriteValue(stream *jsoniter.Stream, fieldName string, value any) error {
+	if value == nil {
+		stream.WriteNil()
+		return nil
+	}
+
+	// Create a sub-stream to write the value into
+	// which we can then check for errors on without affecting the main stream
+	var buf bytes.Buffer
+	subStream := stream.Pool().BorrowStream(&buf)
+	defer stream.Pool().ReturnStream(subStream)
+
+	// Update the substream's indent level to match the main stream
+	// we need to use reflection to do this as the indent level is not exported
+	// by the jsoniter.Stream type
+	//
+	// (We could have simply used the subtream to check for errors, and then rewritten
+	// the same object into the main stream, but this would be less efficient)
+	currentPtr := unsafe.Pointer(reflect.Indirect(reflect.ValueOf(stream)).FieldByName("indention").UnsafeAddr())
+	subStreamPtr := unsafe.Pointer(reflect.Indirect(reflect.ValueOf(subStream)).FieldByName("indention").UnsafeAddr())
+	indent := *(*int)(currentPtr)
+	*((*int)(subStreamPtr)) = indent
+
+	// Write the value into the substream & flush it
+	subStream.WriteVal(value)
+	if err := subStream.Flush(); err != nil {
+		return err
+	}
+
+	// Write the substream's bytes into the main stream
+	stream.WriteMore()
+	stream.WriteObjectField(fieldName)
+	_, err := stream.Write(buf.Bytes())
+
+	return err
+}
diff --git a/runtimes/go/appruntime/apisdk/api/errmarshalling/marshal_test.go b/runtimes/go/appruntime/apisdk/api/errmarshalling/marshal_test.go
new file mode 100644
index 0000000000..e922b4b8e5
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/errmarshalling/marshal_test.go
@@ -0,0 +1,132 @@
+package errmarshalling_test
+
+import (
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/modern-go/reflect2"
+
+	"encore.dev/appruntime/apisdk/api/errmarshalling"
+	"encore.dev/beta/errs"
+	"encore.dev/storage/cache"
+	"encore.dev/storage/sqldb"
+	"encore.dev/storage/sqldb/sqlerr"
+)
+
+type SomeRandomType struct {
+	Foo string
+	Bar bool
+	Err error
+}
+
+func TestMarshal(t *testing.T) {
+	params := []struct {
+		name string
+		err  error
+	}{
+		{"basic", errors.New("blah")},
+		{"joined errors", errors.Join(errors.New("error a"), errors.New("error b"))},
+		{"single wrapped error", fmt.Errorf("outer error: %w", errors.New("inner issue"))},
+		{"3 deep single wrapped error", fmt.Errorf("outer error: %w", fmt.Errorf("inner issue: %w", errors.New("inner inner issue")))},
+		{"multiple wrapped errors", fmt.Errorf("outer error: %w", errors.Join(errors.New("inner issue"), errors.New("inner issue 2")))},
+		{"encore errs", errs.B().Code(errs.OutOfRange).Meta("foo", "bar", "x", 123, "y", false).Msg("out of range in foo").Err()},
+		{"encore err wrapped in Go error", fmt.Errorf("outer: %w", errs.B().Code(errs.OutOfRange).Msg("out of range in foo").Err())},
+		{"sqldb error", &sqldb.Error{
+			Code:           sqlerr.NotNullViolation,
+			Severity:       sqlerr.SeverityError,
+			DatabaseCode:   "PG2341",
+			Message:        "Not null happened matey",
+			SchemaName:     "your_database",
+			TableName:      "in_this_table",
+			ColumnName:     "on_this_column",
+			DataTypeName:   "string",
+			ConstraintName: "not_null",
+		}},
+		{"cache operror", &cache.OpError{
+			Operation: "get",
+			RawKey:    "foo",
+			Err:       errors.New("some error"),
+		}},
+	}
+
+	for _, p := range params {
+		p := p
+		t.Run(p.name, func(t *testing.T) {
+			_ = roundTrip(t, p.err)
+		})
+	}
+
+	t.Run("encore err with underlying", func(t *testing.T) {
+		inner := errs.B().Code(errs.OutOfRange).Msg("out of range in foo").Err()
+		errIn := errs.B().Code(errs.Internal).
+			Cause(inner).
+			Meta("hello", 1, "goodbye", 2).
+			Msg("blah10").
+			Err()
+		errOut := roundTrip(t, errIn)
+
+		fmt.Println("Error In: ", errIn)
+		fmt.Println("Error Out:", errOut)
+	})
+}
+
+func roundTrip(t *testing.T, err error) error {
+	bytes := errmarshalling.Marshal(err)
+	fmt.Println(string(bytes))
+
+	unmarshalled, unmarshallingErr := errmarshalling.Unmarshal(bytes)
+	if unmarshallingErr != nil {
+		t.Fatalf(
+			"Failed to unmarshal error\n\nGot: %v\n\nErr: %v", err, unmarshallingErr)
+		return nil
+	}
+
+	if unmarshalled == nil {
+		t.Fatalf("Expected error %v, got nil", err)
+	}
+
+	if unmarshalled.Error() != err.Error() {
+		t.Errorf("Expected error %v, got %v", err, unmarshalled)
+	}
+
+	originalType := reflect2.TypeOf(err)
+	unmarshalledType := reflect2.TypeOf(unmarshalled)
+
+	if originalType.String() != unmarshalledType.String() &&
+		originalType.String() != "*errors.joinError" &&
+		originalType.String() != "*fmt.wrapError" {
+		fmt.Println("Original type:", originalType.Type1().PkgPath())
+		t.Errorf("Expected error type %v, got %v", originalType, unmarshalledType)
+	}
+
+	return unmarshalled
+}
+
+func TestMarshalWithCustomData(t *testing.T) {
+	data := SomeRandomType{
+		Foo: "hello",
+		Bar: true,
+		Err: errs.B().Code(errs.OutOfRange).Meta("a", "b").Msg("out of range in foo").Err(),
+	}
+
+	json := errmarshalling.JsonAPI()
+
+	bytes, err := json.Marshal(data)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	data2 := SomeRandomType{}
+	if err := json.Unmarshal(bytes, &data2); err != nil {
+		t.Fatalf("unable to unmarshal: %v", err)
+	}
+
+	unmarshalledMeta := errs.Meta(data2.Err)
+	if len(unmarshalledMeta) == 0 {
+		t.Fatalf("expected metadata to be unmarshalled")
+	}
+	if unmarshalledMeta["a"] != "b" {
+		t.Fatalf("unmarshalled metadata is incorrect: %v", unmarshalledMeta)
+	}
+}
diff --git a/runtimes/go/appruntime/apisdk/api/gateway.go b/runtimes/go/appruntime/apisdk/api/gateway.go
new file mode 100644
index 0000000000..95783e77ee
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/gateway.go
@@ -0,0 +1,117 @@
+package api
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+
+	"github.com/julienschmidt/httprouter"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/apisdk/api/transport"
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/beta/errs"
+)
+
+// IsGateway returns true if this instance of the container is acting as an API
+// gateway
+func (s *Server) IsGateway() bool {
+	return len(s.runtime.Gateways) > 0
+}
+
+// createGatewayHandlerAdapter creates a httprouter.Handle that proxies requests
+// on top of the given handler to the service that is hosting the handler.
+func (s *Server) createGatewayHandlerAdapter(h Handler) httprouter.Handle {
+	service, found := s.runtime.ServiceDiscovery[h.ServiceName()]
+	if !found {
+		panic(fmt.Sprintf("service %q not found in service discovery when hosted in gateway", h.ServiceName()))
+	}
+
+	serviceBaseURL, err := url.Parse(service.URL)
+	if err != nil {
+		panic(fmt.Sprintf("failed to parse service URL %q: %v", service.URL, err))
+	}
+
+	// On cloud environments, we want to log the proxying of requests to services
+	// but locally we don't want the overhead of logging every request.
+	logger := s.rootLogger.With().Str("service", service.Name).Str("endpoint", h.EndpointName()).Str("base_url", serviceBaseURL.String()).Logger()
+
+	proxy := s.createProxyToService(service, h.EndpointName(), serviceBaseURL, logger)
+	return func(w http.ResponseWriter, req *http.Request, ps httprouter.Params) {
+		s.beginOperation()
+		defer s.finishOperation()
+
+		meta := CallMetaFromContext(req.Context())
+
+		info, proceed := s.runAuthHandler(h, s.NewIncomingContext(w, req, toUnnamedParams(ps), meta))
+		if proceed {
+			meta.Internal = &InternalCallMeta{
+				Caller: GatewayCaller{
+					GatewayName: "api-gateway",
+				},
+				AuthUID:  string(info.UID),
+				AuthData: info.UserData,
+			}
+			req = req.WithContext(SetCallMetaInContext(req.Context(), meta))
+
+			if s.runtime.EnvCloud != "local" {
+				logger.Trace().Msg("proxying request to service")
+			}
+			proxy.ServeHTTP(w, req)
+		}
+	}
+}
+
+// createProxyToService creates a httputil.ReverseProxy that proxies requests onto the target service.
+func (s *Server) createProxyToService(service config.Service, endpointName string, serviceBaseURL *url.URL, logger zerolog.Logger) *httputil.ReverseProxy {
+	callee := fmt.Sprintf("%s.%s", service.Name, endpointName)
+
+	proxy := &httputil.ReverseProxy{
+		// Rewrite the inbound request
+		Rewrite: func(req *httputil.ProxyRequest) {
+			req.SetURL(serviceBaseURL)
+
+			t := transport.HTTPRequest(req.Out)
+			t.SetMeta(calleeMetaName, callee) // required by the Handler which verifies we wanted to call this endpoint
+
+			meta := CallMetaFromContext(req.In.Context())
+			if err := meta.AddToRequest(s, service, t); err != nil {
+				logger.Err(err).Msg("failed to add call metadata to request")
+			}
+			req.Out.Header["X-Forwarded-For"] = req.In.Header["X-Forwarded-For"]
+			req.SetXForwarded()
+		},
+		// Have the reverse proxy log errors to our logger.
+		ErrorLog: newZeroLogAdapter(logger, zerolog.ErrorLevel),
+		// Handle proxy errors using our error handler output
+		ErrorHandler: func(w http.ResponseWriter, req *http.Request, err error) {
+			logger.Err(err).Msg("error proxying request to service")
+			errs.HTTPError(w, errs.B().Cause(err).Code(errs.Unavailable).Err())
+		},
+	}
+
+	// If the service is served without TLS, we need to configure the proxy to allow forwarding
+	// HTTP2 in clear text to make sure grpc requests are forwarded correctly.
+	if serviceBaseURL.Scheme == "http" {
+		proxy.Transport = transport.NewH2CTransport(http.DefaultTransport)
+	}
+	return proxy
+}
+
+type zeroLogWriter struct {
+	logger zerolog.Logger
+	level  zerolog.Level
+}
+
+func (z *zeroLogWriter) Write(p []byte) (n int, err error) {
+	z.logger.WithLevel(z.level).CallerSkipFrame(3).Msg(string(p))
+	return len(p), nil
+}
+
+// NewZeroLogAdapter returns a new log.Logger that writes to the given zerolog.Logger at the given level.
+func newZeroLogAdapter(logger zerolog.Logger, level zerolog.Level) *log.Logger {
+	zlw := &zeroLogWriter{logger, level}
+	return log.New(zlw, "", 0)
+}
diff --git a/runtimes/go/appruntime/apisdk/api/handler.go b/runtimes/go/appruntime/apisdk/api/handler.go
new file mode 100644
index 0000000000..38fad065b1
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/handler.go
@@ -0,0 +1,956 @@
+package api
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"reflect"
+	"strconv"
+	"sync"
+
+	jsoniter "github.com/json-iterator/go"
+
+	encore "encore.dev"
+	"encore.dev/appruntime/apisdk/api/errmarshalling"
+	"encore.dev/appruntime/apisdk/api/transport"
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/experiments"
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/shared/cfgutil"
+	"encore.dev/appruntime/shared/cloudtrace"
+	"encore.dev/appruntime/shared/jsonapi"
+	"encore.dev/beta/errs"
+	"encore.dev/internal/platformauth"
+	"encore.dev/middleware"
+)
+
+// NamedParams are named path parameters.
+type NamedParams = model.PathParams
+
+// UnnamedParams are unnamed parameters from an incoming request.
+type UnnamedParams []string
+
+type Void struct{}
+
+// SerializeVoid serializes the Void type. It's called by generated code.
+func SerializeVoid(json jsoniter.API, _ Void) ([][]byte, error) {
+	return [][]byte{[]byte("{}")}, nil
+}
+
+// CloneVoid clones the Void type. It's called by generated code.
+func CloneVoid(Void) (Void, error) {
+	return Void{}, nil
+}
+
+// isVoid reports whether a generic type is Void.
+func isVoid[T any]() bool {
+	var zero T
+	_, ok := any(zero).(Void)
+	return ok
+}
+
+// Desc is a description of an API handler.
+type Desc[Req, Resp any] struct {
+	// SvcNum is the 1-based index into the list of services.
+	SvcNum uint16
+
+	// Service and Endpoint name the API this description is for.
+	Service  string
+	Endpoint string
+
+	Methods []string
+	Path    string
+	RawPath string
+	DefLoc  uint32
+
+	// PathParamNames are the names of the path params, in order.
+	PathParamNames []string
+
+	// Tags are the tags for this API, excluding the "tag:" prefix.
+	Tags []string
+
+	// Access describes the access type for this API.
+	Access Access
+
+	// If raw is true, RawHandler is set and AppHandler and EncodeResp are nil.
+	Raw bool
+
+	// If Fallback is true, the handler is a fallback handler
+	// for when other routes don't match.
+	Fallback bool
+
+	DecodeReq      func(*http.Request, UnnamedParams, jsoniter.API) (Req, UnnamedParams, error)
+	CloneReq       func(Req) (Req, error)
+	ReqPath        func(Req) (path string, params UnnamedParams, err error)
+	ReqUserPayload func(Req) any
+
+	AppHandler func(context.Context, Req) (Resp, error)
+	RawHandler func(http.ResponseWriter, *http.Request)
+
+	EncodeResp func(http.ResponseWriter, jsoniter.API, Resp, int) error
+	CloneResp  func(Resp) (Resp, error)
+
+	// EncodeExternalReq encodes a request, writing the payload to the stream
+	// and headers and query strings to the returned maps.
+	EncodeExternalReq func(Req, *jsoniter.Stream) (http.Header, url.Values, error)
+
+	// DecodeExternalResp decodes the response, reading the payload into the response object.
+	DecodeExternalResp func(*http.Response, jsoniter.API) (Resp, error)
+
+	// GlobalMiddlewareIDs is the ordered list of global middleware IDs
+	// to invoke before calling the API handler.
+	GlobalMiddlewareIDs []string
+
+	// ServiceMiddleware is the ordered list of middleware to invoke before
+	// calling the API handler.
+	ServiceMiddleware []*Middleware
+
+	rpcDescOnce   sync.Once
+	cachedRPCDesc *model.RPCDesc
+
+	mockCacheMu   sync.RWMutex
+	mockObjCache  map[any]reflectedAPIMethod[Req, Resp]    // map of object to reflected method
+	mockFuncCache map[uint64]reflectedAPIMethod[Req, Resp] // map of model.ApiMock.ID to reflected method
+}
+
+func (d *Desc[Req, Resp]) AccessType() Access     { return d.Access }
+func (d *Desc[Req, Resp]) ServiceName() string    { return d.Service }
+func (d *Desc[Req, Resp]) EndpointName() string   { return d.Endpoint }
+func (d *Desc[Req, Resp]) HTTPMethods() []string  { return d.Methods }
+func (d *Desc[Req, Resp]) SemanticPath() string   { return d.Path }
+func (d *Desc[Req, Resp]) HTTPRouterPath() string { return d.RawPath }
+func (d *Desc[Req, Resp]) IsFallback() bool       { return d.Fallback }
+
+func (d *Desc[Req, Resp]) Handle(c IncomingContext) {
+	if d.Raw {
+		c.capturer = newRawRequestBodyCapturer(c.req)
+		c.req.Body = c.capturer
+		defer c.capturer.Dispose()
+	}
+
+	// If this is an internal encore-to-encore call, we need to verify the caller is allowed to make this call.
+	if c.callMeta.IsServiceToService() {
+		t := transport.HTTPRequest(c.req)
+		targetAPI, _ := t.ReadMeta(calleeMetaName)
+
+		if targetAPI != fmt.Sprintf("%s.%s", d.Service, d.Endpoint) {
+			returnError(c, errs.B().Code(errs.PermissionDenied).Msg("internal call auth did not align with API").Err(), 0, nil)
+			return
+		}
+	}
+
+	reqData, beginErr := d.begin(c)
+	if beginErr != nil {
+		returnError(c, beginErr, 0, nil)
+		return
+	}
+
+	resp, respData := d.handleIncoming(c, reqData)
+	if resp.Err != nil {
+		c.server.finishRequest(resp)
+
+		// If the endpoint is raw it has already written its response;
+		// don't write another.
+		if !d.Raw {
+			returnError(c, resp.Err, resp.HTTPStatus, resp.Headers)
+		}
+		return
+	}
+
+	if !d.Raw {
+		// Apply any custom headers from middleware
+		for key, values := range resp.Headers {
+			for _, value := range values {
+				c.w.Header().Add(key, value)
+			}
+		}
+
+		c.w.Header().Set("Content-Type", "application/json")
+		c.w.Header().Set("X-Content-Type-Options", "nosniff")
+		resp.Err = d.EncodeResp(c.w, c.server.json, respData, resp.HTTPStatus)
+	}
+	c.server.finishRequest(resp)
+}
+
+// returnError is a helper function which will return an error to the client when we handle
+// an incoming request.
+//
+// If the requests is an internal service to service request, we will return an error
+// in a full unabridged format, allowing the calling code to unmarshal the error without
+// loss of information.
+//
+// If the request is an external request, we will return a more user friendly error
+// message, which will be more suitable for display to the end user and not include
+// any internal details.
+//
+// If statusCodeToUse is 0, we will use the default status code for the error using
+// the [errs] package.
+//
+// headers will be applied to the response if provided.
+func returnError(c IncomingContext, err error, statusCodeToUse int, headers http.Header) {
+	// Apply any custom headers from middleware
+	for key, values := range headers {
+		for _, value := range values {
+			c.w.Header().Add(key, value)
+		}
+	}
+
+	if c.callMeta.PrivateAPIAccess() {
+		// If this is an internal service to service call, we want to return the full error
+		// we'll add a header to the response to indicate that the error is a full error
+		// and the calling code can use this to determine how to unmarshal the response object.
+		c.w.Header().Set("X-Encore-Full-Error", "1")
+
+		c.w.Header().Set("Content-Type", "application/json")
+		c.w.Header().Set("X-Content-Type-Options", "nosniff")
+
+		// Write the status code out
+		if statusCodeToUse == 0 {
+			statusCodeToUse = errs.HTTPStatus(err)
+		}
+		c.w.WriteHeader(statusCodeToUse)
+
+		// Use our internal error marshalling package to marshal the error
+		errBytes := errmarshalling.Marshal(err)
+		_, _ = c.w.Write(errBytes)
+
+	} else {
+		errs.HTTPErrorWithCode(c.w, err, statusCodeToUse)
+	}
+}
+
+func (d *Desc[Req, Resp]) begin(c IncomingContext) (reqData Req, beginErr error) {
+	reqData, params, decodeErr := d.DecodeReq(c.req, c.ps, c.server.json)
+
+	if d.Access == RequiresAuth && c.auth.UID == "" {
+		beginErr = errs.B().
+			Code(errs.Unauthenticated).
+			Meta("service", d.Service, "endpoint", d.Endpoint).
+			Msg("endpoint requires auth but none provided").
+			Err()
+		return
+	}
+
+	// Only compute inputs and payload if we have valid reqData.
+	var payload any
+	var nonRawPayload []byte
+	if decodeErr == nil {
+		payload = d.ReqUserPayload(reqData)
+		if !d.Raw {
+			nonRawPayload = marshalParams(c.server.json, payload)
+		}
+	}
+
+	_, err := c.server.beginRequest(c.ctx, &beginRequestParams{
+		Type:          model.RPCCall,
+		DefLoc:        d.DefLoc,
+		TraceID:       c.callMeta.TraceID,
+		SpanID:        c.callMeta.SpanID,
+		ParentSpanID:  c.callMeta.ParentSpanID,
+		CallerEventID: c.callMeta.ParentEventID,
+		ParentSampled: c.callMeta.TraceSampled,
+
+		Data: &model.RPCData{
+			Desc:                 d.rpcDesc(),
+			HTTPMethod:           c.req.Method,
+			Path:                 c.req.URL.Path,
+			PathParams:           d.toNamedParams(params),
+			TypedPayload:         payload,
+			NonRawPayload:        nonRawPayload,
+			UserID:               c.auth.UID,
+			AuthData:             c.auth.UserData,
+			RequestHeaders:       c.req.Header,
+			FromEncorePlatform:   platformauth.IsEncorePlatformRequest(c.req.Context()),
+			ServiceToServiceCall: c.callMeta.IsServiceToService(),
+		},
+
+		ExtRequestID:        clampTo64Chars(c.req.Header.Get("X-Request-ID")),
+		ExtCorrelationID:    clampTo64Chars(c.req.Header.Get("X-Correlation-ID")),
+		AdditionalLogFields: cloudtrace.StructuredLogFields(c.req),
+	})
+	if err != nil {
+		beginErr = errs.B().Code(errs.Internal).Msg("internal error").Err()
+		return
+	}
+
+	// If we fail after having begun the request, mark it as completed.
+	defer func() {
+		if beginErr != nil {
+			c.server.finishRequest(newErrResp(beginErr, 0))
+		}
+	}()
+
+	if decodeErr != nil {
+		beginErr = errs.WrapCode(decodeErr, errs.InvalidArgument, "decode request")
+		return
+	}
+
+	return reqData, nil
+}
+
+// handleIncoming executes the given handler, running middleware in the process.
+func (d *Desc[Req, Resp]) handleIncoming(c IncomingContext, reqData Req) (resp *model.Response, respData Resp) {
+	if err := d.validate(reqData); err != nil {
+		return newErrResp(err, 0), respData
+	}
+
+	var respCapturer *rawResponseCapturer
+
+	invokeHandler := func(mwReq middleware.Request) (mwResp middleware.Response) {
+		if d.Raw {
+			respCapturer = newRawResponseCapturer(c.w, c.req)
+			return d.invokeHandlerRaw(mwReq, c, respCapturer)
+		} else {
+			return d.invokeHandlerNonRaw(mwReq, reqData, d.AppHandler)
+		}
+	}
+
+	respData, httpStatus, headers, err := d.executeEndpoint(c.execContext, invokeHandler)
+
+	resp = newRespWithHeaders(respData, httpStatus, err, headers, d.Raw, c.capturer, respCapturer, c.server.json)
+	return resp, respData
+}
+
+// executeEndpoint executes the given handler, running middleware in the process.
+func (d *Desc[Req, Resp]) executeEndpoint(c execContext, invokeHandler func(middleware.Request) middleware.Response) (resp Resp, httpStatus int, headers http.Header, respErr error) {
+	var counter int
+	var nextFn middleware.Next
+
+	var (
+		globalMiddleware = c.server.getGlobalMiddleware(d.GlobalMiddlewareIDs)
+		svcMiddleware    = d.ServiceMiddleware
+
+		numGlobalMiddleware  = len(globalMiddleware)
+		numServiceMiddleware = len(svcMiddleware)
+		numTotalMiddleware   = numGlobalMiddleware + numServiceMiddleware
+	)
+
+	nextFn = func(req middleware.Request) (resp middleware.Response) {
+		// Ensure the HTTP status code is correctly set in the response
+		defer func() {
+			// If no explicit HTTP status has been set, then we use the default for the type of error
+			// or if Err is nil, we'll set 200
+			if resp.HTTPStatus == 0 {
+				resp.HTTPStatus = errs.HTTPStatus(resp.Err)
+			}
+		}()
+
+		idx := counter
+		counter++
+
+		switch {
+		case idx < numTotalMiddleware:
+			var mw *Middleware
+			if idx < numGlobalMiddleware {
+				mw = globalMiddleware[idx]
+			} else {
+				mw = svcMiddleware[idx-numGlobalMiddleware]
+			}
+
+			defer func() {
+				// Catch middleware panic
+				if e := recover(); e != nil {
+					panicStack := stack.BuildWithoutGoRuntime(2)
+					resp.Err = errs.B().Code(errs.Internal).Stack(panicStack).Meta("panic_stack", panicStack).Msgf("panic executing middleware %s.%s: %v",
+						mw.PkgName, mw.Name, e).Err()
+					resp.HTTPStatus = 500
+				}
+			}()
+			return mw.Invoke(req, nextFn)
+
+		case idx == numTotalMiddleware:
+			defer func() {
+				// Catch handler panic
+				if e := recover(); e != nil {
+					panicStack := stack.BuildWithoutGoRuntime(2)
+					resp.Err = errs.B().Code(errs.Internal).Stack(panicStack).Meta("panic_stack", panicStack).Msgf(
+						"panic handling request: %v", e).Err()
+					resp.HTTPStatus = 500
+				}
+			}()
+			return invokeHandler(req)
+
+		default:
+			return middleware.Response{
+				Err:        errs.B().Code(errs.Internal).Msg("middleware called next() too many times").Err(),
+				HTTPStatus: 500,
+			}
+		}
+	}
+
+	// Only create the middleware.Request object if we actually have middleware.
+	mwReq := middleware.NewLazyRequest(c.ctx, func() *encore.Request {
+		return c.server.encoreMgr.CurrentRequest()
+	})
+	mwResp := nextFn(mwReq)
+
+	if mwResp.Err != nil {
+		return resp, mwResp.HTTPStatus, mwResp.GetHeaders(), mwResp.Err
+	} else {
+		if resp, ok := mwResp.Payload.(Resp); ok || isVoid[Resp]() {
+			return resp, mwResp.HTTPStatus, mwResp.GetHeaders(), mwResp.Err
+		}
+	}
+
+	return resp, 500, mwResp.GetHeaders(), errs.B().Code(errs.Internal).Msgf(
+		"invalid middleware: cannot return payload of type %T for endpoint %s.%s (expected type %T)",
+		mwResp.Payload, d.Service, d.Endpoint, resp,
+	).Err()
+}
+
+// invokeHandlerNonRaw invokes the handler for a regular (non-raw) endpoint. If the endpoint is raw, it panics.
+func (d *Desc[Req, Resp]) invokeHandlerNonRaw(mwReq middleware.Request, reqData Req, handler func(context.Context, Req) (Resp, error)) (mwResp middleware.Response) {
+	if d.Raw {
+		panic("invokeHandlerNonRaw called on Raw endpoint")
+	}
+
+	handlerResp, handlerErr := handler(mwReq.Context(), reqData)
+	if handlerErr != nil {
+		mwResp.Err = errs.Convert(handlerErr)
+		mwResp.HTTPStatus = errs.HTTPStatus(mwResp.Err)
+	} else {
+		// Only assign the payload if we're not dealing with *Void,
+		// otherwise we would end up making Payload a "typed nil".
+		if !isVoid[Resp]() {
+			mwResp.Payload = handlerResp
+		}
+		mwResp.HTTPStatus = 200
+	}
+	return mwResp
+}
+
+// invokeHandlerRaw invokes the handler for a raw endpoint. If the endpoint is not raw, it panics.
+func (d *Desc[Req, Resp]) invokeHandlerRaw(mwReq middleware.Request, c IncomingContext, capturer *rawResponseCapturer) (mwResp middleware.Response) {
+	if !d.Raw {
+		panic("invokeHandlerRaw called on non-Raw endpoint")
+	}
+
+	// Middleware can override the context, so check if the context is different
+	// and if so change the request context.
+	httpReq := c.req
+	if ctx := mwReq.Context(); ctx != c.req.Context() {
+		httpReq = httpReq.WithContext(ctx)
+	}
+
+	capturer.InvokeHandler(http.HandlerFunc(d.RawHandler), httpReq)
+
+	if capturer.Code >= 400 {
+		statusText := http.StatusText(capturer.Code)
+		if statusText == "" {
+			statusText = "HTTP " + strconv.Itoa(capturer.Code)
+		}
+		mwResp.Err = errs.B().Code(errs.HTTPStatusToCode(capturer.Code)).Msg(statusText).Err()
+	}
+
+	mwResp.HTTPStatus = capturer.Code
+	return mwResp
+}
+
+func (d *Desc[Req, Resp]) toNamedParams(ps UnnamedParams) NamedParams {
+	named := make(NamedParams, len(ps))
+	for i, p := range ps {
+		named[i].Name = d.PathParamNames[i]
+		named[i].Value = p
+	}
+	return named
+}
+
+type CallContext struct {
+	ctx    context.Context
+	server *Server
+}
+
+func (d *Desc[Req, Resp]) Call(c CallContext, req Req) (respData Resp, respErr error) {
+	// If we're inside a test, we need to check if the target service has been mocked
+	// and if it has, we need to route the call to the mock, otherwise
+	// we'll make an internal call to the API
+	if c.server.static.Testing {
+		if mockedAPI, found := c.server.testingMgr.GetAPIMock(d.Service, d.Endpoint); found && mockedAPI.Function != nil {
+			function, err := d.getMockFunction(mockedAPI)
+			if err != nil {
+				return respData, errs.Wrap(err, "unable to call mocked API due to an issue with the mock")
+			}
+			return d.mockedCall(c, function, req, mockedAPI.RunMiddleware)
+		} else if mockedService, found := c.server.testingMgr.GetServiceMock(d.Service); found && mockedService.Service != nil {
+			method, err := d.getMockMethod(mockedService)
+			if err != nil {
+				return respData, errs.Wrap(err, "unable to call mocked API due to an issue with the mock")
+			}
+			return d.mockedCall(c, method, req, mockedService.RunMiddleware)
+		} else {
+			return d.internalCall(c, req)
+		}
+	}
+
+	if cfgutil.IsHostedService(c.server.runtime, d.Service) {
+		// If we're calling a hosted service, we can route via the
+		// internal process
+		return d.internalCall(c, req)
+	}
+
+	// Otherwise we need to route via the service discovery mechanism
+	service, found := c.server.runtime.ServiceDiscovery[d.Service]
+	if !found {
+		// Any service we need to talk to should be in the service discovery map, if it is not
+		// that implies the code is doing something unexpected and we should fail fast.
+		return respData, errs.B().Code(errs.Internal).Meta("service", d.Service).Msg("no route to service found").Err()
+	} else {
+		return d.externalCall(c, service, req)
+	}
+}
+
+// getMockMethod returns a reflected method for the given object, caching the result.
+// so subsequent calls will be faster.
+func (d *Desc[Req, Resp]) getMockMethod(svcMock model.ServiceMock) (reflectedAPIMethod[Req, Resp], error) {
+	d.mockCacheMu.RLock()
+	method, found := d.mockObjCache[svcMock.Service]
+	d.mockCacheMu.RUnlock()
+
+	if !found {
+		d.mockCacheMu.Lock()
+		defer d.mockCacheMu.Unlock()
+
+		// Get a reflected value of the object
+		val := reflect.ValueOf(svcMock.Service)
+		if !val.IsValid() {
+			return nil, errs.B().Code(errs.Internal).Msgf("object %T is not valid", svcMock).Err()
+		}
+
+		// Get the method
+		// nosemgrep
+		methodVal := val.MethodByName(d.Endpoint)
+		if !methodVal.IsValid() {
+			return nil, errs.B().Code(errs.Internal).Msgf("method %s not found on object %T", d.Endpoint, svcMock.Service).Err()
+		}
+
+		m, err := createReflectionCaller[Req, Resp](methodVal)
+		if err != nil {
+			return nil, errs.Wrap(err, "unable to create mock caller")
+		}
+
+		// Cache the method
+		if len(d.mockObjCache) == 0 {
+			d.mockObjCache = make(map[any]reflectedAPIMethod[Req, Resp])
+		}
+		d.mockObjCache[svcMock.Service] = m
+		return m, nil
+	}
+
+	return method, nil
+}
+
+// getMockFunction returns a reflected method for the given function, caching the result.
+// so subsequent calls will be faster.
+func (d *Desc[Req, Resp]) getMockFunction(apiMock model.ApiMock) (reflectedAPIMethod[Req, Resp], error) {
+	d.mockCacheMu.RLock()
+	method, found := d.mockFuncCache[apiMock.ID]
+	d.mockCacheMu.RUnlock()
+
+	if !found {
+		d.mockCacheMu.Lock()
+		defer d.mockCacheMu.Unlock()
+
+		// Get a reflected value of the object
+		val := reflect.ValueOf(apiMock.Function)
+		if !val.IsValid() {
+			return nil, errs.B().Code(errs.Internal).Msgf("function %T is not valid", apiMock.Function).Err()
+		}
+
+		m, err := createReflectionCaller[Req, Resp](val)
+		if err != nil {
+			return nil, errs.Wrap(err, "unable to create mock caller")
+		}
+
+		// Cache the method
+		if len(d.mockFuncCache) == 0 {
+			d.mockFuncCache = make(map[uint64]reflectedAPIMethod[Req, Resp])
+		}
+		d.mockFuncCache[apiMock.ID] = m
+		return m, nil
+	}
+
+	return method, nil
+}
+
+func (d *Desc[Req, Resp]) mockedCall(c CallContext, mock reflectedAPIMethod[Req, Resp], req Req, runMiddleware bool) (respData Resp, respErr error) {
+	return d.runCall(c, req, true, func(ec execContext, req Req) (Resp, int, error) {
+		// If we want to run middleware, use the same code path as internalCall but switch out the handler
+		// to our mock.
+		if runMiddleware {
+			resp, status, _, err := d.executeEndpoint(ec, func(mwReq middleware.Request) (mwResp middleware.Response) {
+				return d.invokeHandlerNonRaw(mwReq, req, mock)
+			})
+			return resp, status, err
+		}
+
+		respData, err := mock(ec.ctx, req)
+		if err != nil {
+			return respData, errs.HTTPStatus(err), err
+		}
+		return respData, 200, nil
+	})
+}
+
+func (d *Desc[Req, Resp]) internalCall(c CallContext, req Req) (respData Resp, respErr error) {
+	return d.runCall(c, req, false, func(ec execContext, req Req) (Resp, int, error) {
+		resp, status, _, err := d.executeEndpoint(ec, func(mwReq middleware.Request) middleware.Response {
+			return d.invokeHandlerNonRaw(mwReq, req, d.AppHandler)
+		})
+		return resp, status, err
+	})
+}
+
+func (d *Desc[Req, Resp]) runCall(c CallContext, req Req, mocked bool, executor func(ec execContext, req Req) (Resp, int, error)) (respData Resp, respErr error) {
+	// TODO: we don't currently support service-to-service calls of raw endpoints.
+	// To fix this we need to improve our request serialization and DI support to
+	// separate the signature for outgoing calls versus handlers.
+	if d.Raw {
+		respErr = errs.B().Code(errs.Internal).Msg("internal encore error: cannot call raw endpoints in service-to-service calls").Err()
+		return
+	}
+
+	req, err := d.CloneReq(req)
+	if err != nil {
+		c.server.rootLogger.Err(err).Msg("unable to clone request")
+		respErr = errs.Convert(err)
+		return
+	}
+
+	path, params, err := d.ReqPath(req)
+	if err != nil {
+		c.server.rootLogger.Err(err).Msg("unable to compute request path")
+		respErr = errs.Convert(err)
+		return
+	}
+
+	call, meta, err := c.server.beginCall(c.ctx, d.Service, d.Endpoint, d.DefLoc)
+	if err != nil {
+		c.server.rootLogger.Err(err).Msg("unable to begin call")
+		respErr = errs.Convert(err)
+		return
+	}
+
+	// Run the request in a different goroutine
+	done := make(chan struct{})
+	go func() {
+		defer close(done)
+
+		// Default to GET if there are no methods available (or it's a wildcard)
+		httpMethod := "GET"
+		if len(d.Methods) > 0 && d.Methods[0] != "*" {
+			httpMethod = d.Methods[0]
+		}
+
+		userPayload := d.ReqUserPayload(req)
+		var nonRawPayload []byte
+		if !d.Raw {
+			nonRawPayload = marshalParams(c.server.json, userPayload)
+		}
+
+		reqModel, beginErr := c.server.beginRequest(c.ctx, &beginRequestParams{
+			Type:          model.RPCCall,
+			DefLoc:        d.DefLoc,
+			CallerEventID: call.StartEventID,
+
+			Data: &model.RPCData{
+				HTTPMethod:    httpMethod,
+				Path:          path,
+				PathParams:    d.toNamedParams(params),
+				TypedPayload:  userPayload,
+				Desc:          d.rpcDesc(),
+				NonRawPayload: nonRawPayload,
+
+				FromEncorePlatform:   false,
+				RequestHeaders:       nil, // not set right now for internal requests
+				ServiceToServiceCall: true,
+				Mocked:               mocked,
+			},
+		})
+
+		// Now round-trip any auth data that was set on the request
+		// to emulate what happens in the HTTP case.
+		if experiments.AuthDataRoundTrip.Enabled(c.server.experiments) && reqModel.RPCData.AuthData != nil {
+			jsonBytes, err := jsonapi.Default.Marshal(reqModel.RPCData.AuthData)
+			if err != nil {
+				c.server.rootLogger.Err(err).Msg("unable to marshal auth data")
+				respErr = errs.B().Cause(err).Code(errs.Internal).Msg("internal error").Err()
+				return
+			}
+
+			reqModel.RPCData.AuthData = newAuthDataObj()
+			if err := jsonapi.Default.Unmarshal(jsonBytes, reqModel.RPCData.AuthData); err != nil {
+				c.server.rootLogger.Err(err).Msg("unable to unmarshal auth data")
+				respErr = errs.B().Cause(err).Code(errs.Internal).Msg("internal error").Err()
+				return
+			}
+		}
+
+		if beginErr != nil {
+			respErr = errs.B().Cause(beginErr).Code(errs.Internal).Msg("internal error").Err()
+			return
+		}
+
+		if err := d.validate(req); err != nil {
+			respErr = err
+			return
+		}
+
+		ec := c.server.newExecContext(c.ctx, params, meta)
+		r, httpStatus, rpcErr := executor(ec, req)
+
+		if rpcErr == nil {
+			r, rpcErr = d.CloneResp(r)
+			if rpcErr != nil {
+				// only override the http status if an error occurred trying to clone the response
+				httpStatus = errs.HTTPStatus(errs.Convert(rpcErr))
+			}
+		}
+		if rpcErr != nil {
+			respErr = errs.RoundTrip(rpcErr)
+			c.server.finishRequest(newErrResp(respErr, httpStatus))
+		} else {
+			respData, respErr = r, nil
+			// Always nil for now since we don't support raw endpoints in service-to-service calls.
+			var (
+				reqCapture  *rawRequestBodyCapturer
+				respCapture *rawResponseCapturer
+			)
+			modelResp := newResp(respData, httpStatus, respErr, d.Raw, reqCapture, respCapture, c.server.json)
+			c.server.finishRequest(modelResp)
+		}
+	}()
+	<-done
+
+	if respErr != nil {
+		c.server.rootLogger.Err(respErr).Msg("call failed")
+	}
+	c.server.finishCall(call, respErr)
+	return
+}
+
+func (d *Desc[Req, Resp]) externalCall(c CallContext, service config.Service, req Req) (respData Resp, respErr error) {
+	// TODO: we don't currently support service-to-service calls of raw endpoints.
+	// To fix this we need to improve our request serialization and DI support to
+	// separate the signature for outgoing calls versus handlers.
+	if d.Raw {
+		respErr = errs.B().Code(errs.Internal).Msg("internal encore error: cannot call raw endpoints in service-to-service calls").Err()
+		return
+	}
+
+	// Lookup the service
+	if service.Protocol != config.Http {
+		// For now we only support HTTP services
+		respErr = errs.B().Code(errs.Internal).Msg("internal encore error: unsupported service protocol").Err()
+		return
+	}
+
+	path, _, err := d.ReqPath(req)
+	if err != nil {
+		c.server.rootLogger.Err(err).Msg("unable to compute request path")
+		respErr = errs.Convert(err)
+		return
+	}
+
+	// Default to POST if there are no methods available (or it's a wildcard)
+	httpMethod := "POST"
+	if len(d.Methods) > 0 && d.Methods[0] != "*" {
+		httpMethod = d.Methods[0]
+	}
+
+	// Encode the request payload
+	var buf bytes.Buffer
+	stream := c.server.json.BorrowStream(&buf)
+	header, queryString, err := d.EncodeExternalReq(req, stream)
+	if err2 := stream.Flush(); err == nil {
+		err = err2
+	}
+	c.server.json.ReturnStream(stream)
+	if err != nil {
+		c.server.rootLogger.Err(err).Msg("unable to marshal request")
+		respErr = errs.Convert(err)
+		return
+	}
+
+	reqURL := service.URL + path
+	if len(queryString) > 0 {
+		reqURL += "?" + queryString.Encode()
+	}
+	httpReq, err := http.NewRequestWithContext(c.ctx, httpMethod, reqURL, &buf)
+	if err != nil {
+		c.server.rootLogger.Err(err).Msg("unable to create HTTP request")
+		respErr = errs.Convert(err)
+		return
+	}
+	for key, val := range header {
+		httpReq.Header[key] = val
+	}
+	reqTransport := transport.HTTPRequest(httpReq)
+
+	// Set the name of the API we want to call
+	reqTransport.SetMeta(calleeMetaName, fmt.Sprintf("%s.%s", d.Service, d.Endpoint))
+
+	call, meta, err := c.server.beginCall(c.ctx, d.Service, d.Endpoint, d.DefLoc)
+	if err != nil {
+		c.server.rootLogger.Err(err).Msg("unable to begin call")
+		respErr = errs.Convert(err)
+		return
+	}
+
+	if err := meta.AddToRequest(c.server, service, reqTransport); err != nil {
+		c.server.rootLogger.Err(err).Msg("unable to add metadata to request")
+		respErr = errs.Convert(err)
+		return
+	}
+
+	respData, respErr = (func() (resp Resp, err error) {
+		httpResp, err := c.server.httpClient.Do(httpReq)
+		if err != nil {
+			return resp, err
+		}
+		defer func() { _ = httpResp.Body.Close() }()
+
+		if httpResp.StatusCode >= 400 {
+			return resp, unmarshalErrorResponse(httpResp)
+		}
+
+		return d.DecodeExternalResp(httpResp, c.server.json)
+	})()
+
+	if respErr != nil {
+		c.server.rootLogger.Err(respErr).Str("target", fmt.Sprintf("%s.%s", d.Service, d.Endpoint)).Str("url", reqURL).Msg("call failed")
+	}
+
+	c.server.finishCall(call, respErr)
+	return
+}
+
+// unmarshalErrorResponse unmarshals an error response from an HTTP response.
+//
+// If the error sent back from the server was an Encore encoded error, we unmashal that to restore the original
+// error types. Otherwise, we return a internal server generic error.
+func unmarshalErrorResponse(httpResp *http.Response) error {
+	if httpResp.Header.Get("X-Encore-Full-Error") == "1" {
+		errBytes, err := io.ReadAll(httpResp.Body)
+		if err != nil {
+			return errs.B().Code(errs.Internal).Msg("request failed: unable to read response").Err()
+		}
+
+		respErr, marshallingErr := errmarshalling.Unmarshal(errBytes)
+		if marshallingErr != nil {
+			return errs.B().Code(errs.Internal).Cause(err).Msg("request failed: unable to unmarshal response").Err()
+		}
+
+		return respErr
+	} else {
+		bodyBytes, err := io.ReadAll(httpResp.Body)
+		if err != nil {
+			return errs.B().Code(errs.Internal).Msg("request failed: unable to read response").Err()
+		}
+
+		if len(bodyBytes) == 0 {
+			return errs.B().Code(errs.Internal).Msgf("request failed: status %s", httpResp.Status).Err()
+		} else {
+			return errs.B().Code(errs.Internal).Msgf("request failed: status %s: %s", httpResp.Status, string(bodyBytes)).Err()
+		}
+	}
+}
+
+// validate validates the request, and returns a validation error on failure.
+// If the user payload does not implement Validator, it returns nil.
+func (d *Desc[Req, Resp]) validate(req Req) error {
+	return runValidate(d.ReqUserPayload(req))
+}
+
+// runValidate validates the request, and returns a validation error on failure.
+// If the user payload does not implement Validator, it returns nil.
+func runValidate(userPayload any) error {
+	if v, ok := userPayload.(Validator); ok {
+		if err := v.Validate(); err != nil {
+			// If we already have an *errs.Error, return it directly.
+			if _, ok := err.(*errs.Error); ok {
+				return err
+			}
+			return errs.WrapCode(err, errs.InvalidArgument, "validation failed")
+		}
+	}
+	return nil
+}
+
+// rpcDesc returns the RPC description for this endpoint,
+// computing and caching the first time it's called.
+func (d *Desc[Req, Resp]) rpcDesc() *model.RPCDesc {
+	d.rpcDescOnce.Do(func() {
+		var reqTyp Req
+		desc := &model.RPCDesc{
+			Service:     d.Service,
+			SvcNum:      d.SvcNum,
+			Endpoint:    d.Endpoint,
+			Raw:         d.Raw,
+			RequestType: reflect.TypeOf(reqTyp),
+			Tags:        d.Tags,
+		}
+
+		if !isVoid[Resp]() {
+			var typ Resp
+			desc.ResponseType = reflect.TypeOf(typ)
+		}
+		d.cachedRPCDesc = desc
+	})
+	return d.cachedRPCDesc
+}
+
+func marshalParams[Resp any](json jsoniter.API, resp Resp) []byte {
+	if isVoid[Resp]() {
+		return nil
+	}
+	data, _ := json.Marshal(resp)
+	return data
+}
+
+// newResp returns an *model.Response for a response.
+func newResp[Resp any](respData Resp, httpStatus int, err error, isRaw bool,
+	reqCapture *rawRequestBodyCapturer, respCapture *rawResponseCapturer, json jsoniter.API,
+) *model.Response {
+	return newRespWithHeaders(respData, httpStatus, err, nil, isRaw, reqCapture, respCapture, json)
+}
+
+// newRespWithHeaders returns an *model.Response for a response with custom headers.
+func newRespWithHeaders[Resp any](respData Resp, httpStatus int, err error, headers http.Header, isRaw bool,
+	reqCapture *rawRequestBodyCapturer, respCapture *rawResponseCapturer, json jsoniter.API,
+) *model.Response {
+	resp := &model.Response{
+		HTTPStatus: httpStatus,
+		Err:        err,
+		Headers:    headers,
+	}
+
+	if isRaw {
+		if reqCapture != nil {
+			resp.RawRequestPayload, resp.RawRequestPayloadOverflowed = reqCapture.FinishCapturing()
+		}
+		if respCapture != nil {
+			resp.RawResponseHeaders = respCapture.Header
+			resp.RawResponsePayload, resp.RawResponsePayloadOverflowed = respCapture.FinishCapturing()
+		}
+	} else {
+		resp.TypedPayload = respData
+		resp.Payload = marshalParams(json, respData)
+	}
+	return resp
+}
+
+// newErrResp returns an *model.Response for an error.
+// If httpStatus is 0 it's inferred from the error.
+func newErrResp(err error, httpStatus int) *model.Response {
+	if httpStatus == 0 {
+		httpStatus = errs.HTTPStatus(err)
+	}
+	return &model.Response{
+		HTTPStatus: httpStatus,
+		Err:        err,
+	}
+}
diff --git a/runtimes/go/appruntime/apisdk/api/handler_test.go b/runtimes/go/appruntime/apisdk/api/handler_test.go
new file mode 100644
index 0000000000..f8004e94b7
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/handler_test.go
@@ -0,0 +1,663 @@
+package api_test
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/benbjohnson/clock"
+	"github.com/golang/mock/gomock"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	jsoniter "github.com/json-iterator/go"
+	"github.com/rs/zerolog"
+
+	encore "encore.dev"
+	"encore.dev/appruntime/apisdk/api"
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/appruntime/shared/health"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/testsupport"
+	"encore.dev/appruntime/shared/traceprovider"
+	"encore.dev/appruntime/shared/traceprovider/mock_trace"
+	"encore.dev/beta/errs"
+	usermetrics "encore.dev/metrics"
+	"encore.dev/middleware"
+	"encore.dev/pubsub"
+)
+
+type mockReq struct {
+	Body string
+}
+
+type mockResp struct {
+	Message string
+}
+
+func TestDesc_EndToEnd(t *testing.T) {
+	server, _, metricsRegistry := testServer(t, clock.New(), false)
+
+	tests := []struct {
+		name        string
+		access      api.Access
+		reqBody     string
+		respBody    string
+		status      int
+		respHeaders http.Header
+	}{
+		{
+			name:        "echo",
+			access:      api.Public,
+			reqBody:     `{"Body": "foo"}`,
+			respBody:    `{"Message":"foo"}`,
+			status:      200,
+			respHeaders: http.Header{"Content-Type": []string{"application/json"}},
+		},
+		{
+			name:        "invalid",
+			access:      api.Public,
+			reqBody:     `invalid json`,
+			respBody:    ``,
+			status:      400,
+			respHeaders: http.Header{"Content-Type": []string{"application/json"}},
+		},
+		{
+			name:        "unauthenticated",
+			access:      api.RequiresAuth,
+			reqBody:     `{}`,
+			respBody:    ``,
+			status:      401,
+			respHeaders: http.Header{"Content-Type": []string{"application/json"}},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("POST", "/", strings.NewReader(test.reqBody))
+			ps := api.UnnamedParams{"value"}
+			desc := newMockAPIDesc(test.access)
+			desc.Handle(server.NewIncomingContext(w, req, ps, api.CallMeta{}))
+			if w.Code != test.status {
+				t.Errorf("got code %d, want %d", w.Code, test.status)
+				return
+			}
+			if test.respBody != "" {
+				if got := w.Body.String(); got != test.respBody {
+					t.Errorf("got body %q, want %q", got, test.respBody)
+				}
+			}
+			if test.respHeaders != nil {
+				for key, val := range test.respHeaders {
+					if diff := cmp.Diff(val, w.Header()[key]); diff != "" {
+						t.Errorf("header %s: unexpected response header value (-want +got):\n%s", key, diff)
+					}
+				}
+			}
+
+		})
+	}
+
+	collected := metricsRegistry.Collect()
+	if len(collected) != 2 {
+		t.Fatalf("got %d metrics, want 2", len(collected))
+	}
+
+	okLabels := []usermetrics.KeyValue{
+		{
+			Key:   "endpoint",
+			Value: "endpoint",
+		},
+		{
+			Key:   "code",
+			Value: "ok",
+		},
+	}
+	requestsTotalOk := findMetric(collected, "e_requests_total", okLabels)
+	if requestsTotalOk == nil {
+		t.Log(`e_requests_total{endpoint="endpoint",code="ok"} metric not found`)
+		t.FailNow()
+	}
+
+	if _, ok := requestsTotalOk.Val.([]uint64); !ok {
+		t.Log(`expected e_requests_total{endpoint="endpoint",code="ok"} value to be []uint64`)
+		t.FailNow()
+	}
+
+	invalidArgLabels := []usermetrics.KeyValue{
+		{
+			Key:   "endpoint",
+			Value: "endpoint",
+		},
+		{
+			Key:   "code",
+			Value: errs.InvalidArgument.String(),
+		},
+	}
+	requestsTotalInvalidArg := findMetric(collected, "e_requests_total", invalidArgLabels)
+	if requestsTotalInvalidArg == nil {
+		t.Log(`e_requests_total{endpoint="endpoint",code="invalid_argument"} metric not found`)
+		t.FailNow()
+	}
+
+	if _, ok := requestsTotalInvalidArg.Val.([]uint64); !ok {
+		t.Log(`expected e_requests_total{endpoint="endpoint",code="invalid_argument"} value to be []uint64`)
+		t.FailNow()
+	}
+}
+
+func findMetric(collected []usermetrics.CollectedMetric, name string, labels []usermetrics.KeyValue) *usermetrics.CollectedMetric {
+	for _, metric := range collected {
+		if metric.Info.Name() == name &&
+			reflect.DeepEqual(metric.Labels, labels) {
+			return &metric
+		}
+	}
+	return nil
+}
+
+func TestDescGeneratesTrace(t *testing.T) {
+	model.EnableTestMode(t)
+	klock := clock.NewMock()
+	klock.Set(time.Now())
+
+	tests := []struct {
+		name       string
+		access     api.Access
+		raw        bool
+		reqBody    string
+		reqHeaders http.Header
+		want       *model.Request
+	}{
+		{
+			name:       "echo",
+			access:     api.Public,
+			reqBody:    `{"Body": "foo"}`,
+			reqHeaders: http.Header{"Content-Type": []string{"application/json"}},
+			want: &model.Request{
+				Type:         model.RPCCall,
+				TraceID:      model.TraceID{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1},
+				SpanID:       model.SpanID{0, 0, 0, 0, 0, 0, 0, 1},
+				ParentSpanID: model.SpanID{},
+				Start:        klock.Now(),
+				Traced:       true,
+				RPCData: &model.RPCData{
+					Desc: &model.RPCDesc{
+						Service:      "service",
+						Endpoint:     "endpoint",
+						Raw:          false,
+						RequestType:  reflect.TypeOf(&mockReq{}),
+						ResponseType: reflect.TypeOf(&mockResp{}),
+					},
+					HTTPMethod:     "POST",
+					Path:           "/path/hello",
+					PathParams:     model.PathParams{{Name: "one", Value: "hello"}},
+					UserID:         "",
+					AuthData:       nil,
+					TypedPayload:   &mockReq{Body: "foo"},
+					NonRawPayload:  []byte(`{"Body":"foo"}`),
+					RequestHeaders: http.Header{"Content-Type": []string{"application/json"}},
+				},
+			},
+		},
+		{
+			name:    "invalid",
+			access:  api.Public,
+			reqBody: `invalid json`,
+			want: &model.Request{
+				Type:         model.RPCCall,
+				TraceID:      model.TraceID{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1},
+				SpanID:       model.SpanID{0, 0, 0, 0, 0, 0, 0, 1},
+				ParentSpanID: model.SpanID{},
+				Start:        klock.Now(),
+				Traced:       true,
+				RPCData: &model.RPCData{
+					Desc: &model.RPCDesc{
+						Service:      "service",
+						Endpoint:     "endpoint",
+						Raw:          false,
+						RequestType:  reflect.TypeOf(&mockReq{}),
+						ResponseType: reflect.TypeOf(&mockResp{}),
+					},
+					HTTPMethod:     "POST",
+					Path:           "/path/hello",
+					PathParams:     model.PathParams{{Name: "one", Value: "hello"}},
+					UserID:         "",
+					AuthData:       nil,
+					TypedPayload:   nil,
+					RequestHeaders: nil,
+				},
+			},
+		},
+		{
+			name:    "unauthenticated",
+			access:  api.RequiresAuth,
+			reqBody: `{}`,
+			want:    nil,
+		},
+		{
+			name:       "raw",
+			access:     api.Public,
+			raw:        true,
+			reqBody:    `{}`,
+			reqHeaders: http.Header{"Content-Type": []string{"application/json"}},
+			want: &model.Request{
+				Type:         model.RPCCall,
+				TraceID:      model.TraceID{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1},
+				SpanID:       model.SpanID{0, 0, 0, 0, 0, 0, 0, 1},
+				ParentSpanID: model.SpanID{},
+				Start:        klock.Now(),
+				Traced:       true,
+				RPCData: &model.RPCData{
+					Desc: &model.RPCDesc{
+						Service:      "service",
+						Endpoint:     "raw",
+						Raw:          true,
+						RequestType:  reflect.TypeOf(&rawMockReq{}),
+						ResponseType: nil,
+					},
+					HTTPMethod:     "POST",
+					Path:           "/path/hello",
+					PathParams:     model.PathParams{{Name: "one", Value: "hello"}},
+					UserID:         "",
+					AuthData:       nil,
+					TypedPayload:   nil,
+					RequestHeaders: http.Header{"Content-Type": []string{"application/json"}},
+				},
+			},
+		},
+	}
+
+	opts := []cmp.Option{
+		cmpopts.IgnoreFields(model.Request{}, "Logger"),
+		cmp.Comparer(func(a, b reflect.Type) bool { return a == b }),
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			server, traceMock, _ := testServer(t, klock, true)
+
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("POST", "/path/hello", strings.NewReader(test.reqBody))
+			req.Header = test.reqHeaders
+			ps := api.UnnamedParams{"hello"}
+
+			var handler api.Handler
+			if test.raw {
+				handler = newRawMockAPIDesc(test.access, nil)
+			} else {
+				handler = newMockAPIDesc(test.access)
+			}
+
+			var (
+				beginReq *model.Request
+			)
+
+			traceMock.
+				EXPECT().RequestSpanStart(gomock.Any(), gomock.Any()).Do(
+				func(req *model.Request, _ uint32) {
+					beginReq = req
+				}).MaxTimes(1)
+
+			traceMock.
+				EXPECT().
+				RequestSpanEnd(gomock.Any()).MaxTimes(1)
+
+			traceMock.EXPECT().WaitAndClear().AnyTimes()
+			traceMock.EXPECT().WaitUntilDone().AnyTimes()
+			traceMock.EXPECT().MarkDone().MaxTimes(1)
+
+			handler.Handle(server.NewIncomingContext(w, req, ps, api.CallMeta{}))
+
+			if diff := cmp.Diff(test.want, beginReq, opts...); diff != "" {
+				t.Errorf("beginReq mismatch (-want +got):\n%s", diff)
+			}
+		})
+	}
+}
+
+// TestRawEndpointOverflow tests that raw endpoint capturing
+// is limited to the max capture size.
+func TestRawEndpointOverflow(t *testing.T) {
+	model.EnableTestMode(t)
+	klock := clock.NewMock()
+	klock.Set(time.Now())
+
+	server, traceMock, _ := testServer(t, klock, true)
+
+	var (
+		reqBody           = strings.Repeat("a", 2*api.MaxRawRequestCaptureLen)
+		respBody          = strings.Repeat("b", 2*api.MaxRawResponseCaptureLen)
+		wantTraceReqData  = reqBody[:api.MaxRawRequestCaptureLen]
+		wantTraceRespData = respBody[:api.MaxRawResponseCaptureLen]
+	)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/path/hello", strings.NewReader(reqBody))
+	ps := api.UnnamedParams{"hello"}
+
+	handler := newRawMockAPIDesc(api.Public, func(w http.ResponseWriter, r *http.Request) {
+		_, _ = io.ReadAll(r.Body) // consume the body
+		_, _ = w.Write([]byte(respBody))
+	})
+
+	var params []trace2.BodyStreamParams
+
+	traceMock.
+		EXPECT().
+		RequestSpanStart(gomock.Any(), gomock.Any()).
+		MaxTimes(1)
+
+	traceMock.
+		EXPECT().
+		RequestSpanEnd(gomock.Any()).
+		MaxTimes(1)
+
+	traceMock.
+		EXPECT().
+		BodyStream(gomock.Any()).Do(
+		func(p trace2.BodyStreamParams) {
+			params = append(params, p)
+		}).AnyTimes()
+
+	traceMock.EXPECT().WaitAndClear().MinTimes(1)
+	traceMock.EXPECT().MarkDone().Times(1)
+
+	handler.Handle(server.NewIncomingContext(w, req, ps, api.CallMeta{}))
+
+	if len(params) != 2 {
+		t.Fatalf("got %d BodyStream events, want %d", len(params), 2)
+	}
+	want := []trace2.BodyStreamParams{
+		{
+			EventParams: trace2.EventParams{
+				TraceID: params[0].TraceID,
+				SpanID:  params[0].SpanID,
+			},
+			IsResponse: false,
+			Overflowed: true,
+			Data:       []byte(wantTraceReqData),
+		},
+		{
+			EventParams: trace2.EventParams{
+				TraceID: params[0].TraceID,
+				SpanID:  params[0].SpanID,
+			},
+			IsResponse: true,
+			Overflowed: true,
+			Data:       []byte(wantTraceRespData),
+		},
+	}
+	if diff := cmp.Diff(want, params); diff != "" {
+		t.Errorf("BodyStream params mismatch (-want +got):\n%s", diff)
+	}
+}
+
+func testServer(t *testing.T, klock clock.Clock, mockTraces bool) (*api.Server, *mock_trace.MockLogger, *usermetrics.Registry) {
+	ctrl := gomock.NewController(t)
+
+	var tf traceprovider.Factory
+	traceMock := mock_trace.NewMockLogger(ctrl)
+	if mockTraces {
+		tf = mock_trace.NewMockFactory(traceMock)
+	} else {
+		tf = &traceprovider.DefaultFactory{}
+	}
+
+	static := &config.Static{}
+	runtime := &config.Runtime{}
+
+	logger := zerolog.New(os.Stdout)
+	rt := reqtrack.New(logger, nil, tf)
+	metricsRegistry := usermetrics.NewRegistry(rt, len(static.BundledServices))
+	json := jsoniter.ConfigCompatibleWithStandardLibrary
+	encoreMgr := encore.NewManager(static, runtime, rt)
+	tsMgr := testsupport.NewManager(static, rt, logger)
+	pubsubMgr := pubsub.NewManager(static, runtime, rt, tsMgr, logger, json)
+	healthMgr := health.NewCheckRegistry()
+	testingMgr := testsupport.NewManager(static, rt, logger)
+	server := api.NewServer(static, runtime, rt, nil, encoreMgr, pubsubMgr, logger, metricsRegistry, healthMgr, testingMgr, json, klock)
+	return server, traceMock, metricsRegistry
+}
+
+func newMockAPIDesc(access api.Access) *api.Desc[*mockReq, *mockResp] {
+	return &api.Desc[*mockReq, *mockResp]{
+		Service:        "service",
+		Endpoint:       "endpoint",
+		Path:           "/path/:one",
+		Access:         access,
+		PathParamNames: []string{"one"},
+		Raw:            false,
+
+		DecodeReq: func(req *http.Request, ps api.UnnamedParams, json jsoniter.API) (*mockReq, api.UnnamedParams, error) {
+			var reqData mockReq
+			if err := json.NewDecoder(req.Body).Decode(&reqData); err != nil {
+				return nil, ps, err
+			}
+			return &reqData, ps, nil
+		},
+		CloneReq: func(req *mockReq) (*mockReq, error) {
+			if req == nil {
+				return nil, nil
+			}
+			clone := *req
+			return &clone, nil
+		},
+		ReqPath: func(req *mockReq) (string, api.UnnamedParams, error) {
+			return "/path/TODO", nil, nil
+		},
+		ReqUserPayload: func(req *mockReq) any {
+			return req
+		},
+		AppHandler: func(ctx context.Context, req *mockReq) (*mockResp, error) {
+			return &mockResp{Message: req.Body}, nil
+		},
+		EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp *mockResp, status int) error {
+			data, err := json.Marshal(resp)
+			_, _ = w.Write(data)
+			return err
+		},
+		CloneResp: func(resp *mockResp) (*mockResp, error) {
+			if resp == nil {
+				return nil, nil
+			}
+			clone := *resp
+			return &clone, nil
+		},
+	}
+}
+
+type rawMockReq struct{}
+
+func newRawMockAPIDesc(access api.Access, handler http.HandlerFunc) *api.Desc[*rawMockReq, api.Void] {
+	return &api.Desc[*rawMockReq, api.Void]{
+		Service:        "service",
+		Endpoint:       "raw",
+		Path:           "/path/:one",
+		Access:         access,
+		PathParamNames: []string{"one"},
+		Raw:            true,
+
+		DecodeReq: func(req *http.Request, ps api.UnnamedParams, json jsoniter.API) (*rawMockReq, api.UnnamedParams, error) {
+			return &rawMockReq{}, ps, nil
+		},
+		CloneReq: func(req *rawMockReq) (*rawMockReq, error) {
+			if req == nil {
+				return nil, nil
+			}
+			clone := *req
+			return &clone, nil
+		},
+		ReqPath: func(req *rawMockReq) (string, api.UnnamedParams, error) {
+			return "/foo", nil, nil
+		},
+		ReqUserPayload: func(req *rawMockReq) any {
+			return nil
+		},
+		RawHandler: func(w http.ResponseWriter, req *http.Request) {
+			if handler != nil {
+				handler.ServeHTTP(w, req)
+			}
+		},
+		EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp api.Void, status int) error {
+			return nil
+		},
+		CloneResp: func(resp api.Void) (api.Void, error) {
+			return resp, nil
+		},
+	}
+}
+
+// TestMiddlewareHeaders tests that middleware can set headers and they are properly
+// written to the HTTP response.
+func TestMiddlewareHeaders(t *testing.T) {
+	model.EnableTestMode(t)
+
+	server, _, _ := testServer(t, clock.New(), false)
+
+	// Create a middleware that sets headers
+	headerMiddleware := &api.Middleware{
+		ID:      "test-middleware",
+		PkgName: "test",
+		Name:    "HeaderMiddleware",
+		Global:  false,
+		Invoke: func(req middleware.Request, next middleware.Next) middleware.Response {
+			resp := next(req)
+
+			// Set various types of headers
+			resp.Header().Set("X-Custom-Header", "custom-value")
+			resp.Header().Add("X-Multi-Header", "value1")
+			resp.Header().Add("X-Multi-Header", "value2")
+			resp.Header().Set("X-Middleware-Applied", "true")
+
+			return resp
+		},
+	}
+
+	// Create API desc with the middleware
+	desc := newMockAPIDesc(api.Public)
+	desc.ServiceMiddleware = []*api.Middleware{headerMiddleware}
+
+	tests := []struct {
+		name            string
+		expectSuccess   bool
+		expectedBody    string
+		expectedHeaders map[string][]string
+	}{
+		{
+			name:          "success_with_headers",
+			expectSuccess: true,
+			expectedBody:  `{"Message":"test"}`,
+			expectedHeaders: map[string][]string{
+				"X-Custom-Header":        {"custom-value"},
+				"X-Multi-Header":         {"value1", "value2"},
+				"X-Middleware-Applied":   {"true"},
+				"Content-Type":           {"application/json"},
+				"X-Content-Type-Options": {"nosniff"},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			w := httptest.NewRecorder()
+			req := httptest.NewRequest("POST", "/path/hello", strings.NewReader(`{"Body":"test"}`))
+			req.Header.Set("Content-Type", "application/json")
+			ps := api.UnnamedParams{"hello"}
+
+			desc.Handle(server.NewIncomingContext(w, req, ps, api.CallMeta{}))
+
+			// Check status code
+			if test.expectSuccess && w.Code != 200 {
+				t.Errorf("expected success (200), got %d", w.Code)
+			}
+
+			// Check response body
+			if test.expectedBody != "" {
+				if got := w.Body.String(); got != test.expectedBody {
+					t.Errorf("got body %q, want %q", got, test.expectedBody)
+				}
+			}
+
+			// Check headers
+			for expectedHeader, expectedValues := range test.expectedHeaders {
+				gotValues := w.Header().Values(expectedHeader)
+				if len(gotValues) != len(expectedValues) {
+					t.Errorf("header %s: got %d values %v, want %d values %v",
+						expectedHeader, len(gotValues), gotValues, len(expectedValues), expectedValues)
+					continue
+				}
+				for i, expectedValue := range expectedValues {
+					if gotValues[i] != expectedValue {
+						t.Errorf("header %s[%d]: got %q, want %q",
+							expectedHeader, i, gotValues[i], expectedValue)
+					}
+				}
+			}
+		})
+	}
+}
+
+// TestMiddlewareHeadersOnError tests that middleware headers are applied even when an error occurs.
+func TestMiddlewareHeadersOnError(t *testing.T) {
+	model.EnableTestMode(t)
+
+	server, _, _ := testServer(t, clock.New(), false)
+
+	// Create a middleware that sets headers
+	headerMiddleware := &api.Middleware{
+		ID:      "test-middleware",
+		PkgName: "test",
+		Name:    "HeaderMiddleware",
+		Global:  false,
+		Invoke: func(req middleware.Request, next middleware.Next) middleware.Response {
+			resp := next(req)
+
+			// Set headers regardless of success/error
+			resp.Header().Set("X-Error-Header", "error-value")
+			resp.Header().Set("X-Always-Present", "always")
+
+			return resp
+		},
+	}
+
+	// Create API desc with the middleware that returns an error
+	desc := newMockAPIDesc(api.Public)
+	desc.ServiceMiddleware = []*api.Middleware{headerMiddleware}
+	desc.AppHandler = func(ctx context.Context, req *mockReq) (*mockResp, error) {
+		return nil, errs.B().Code(errs.Internal).Msg("test error").Err()
+	}
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest("POST", "/path/hello", strings.NewReader(`{"Body":"test"}`))
+	req.Header.Set("Content-Type", "application/json")
+	ps := api.UnnamedParams{"hello"}
+
+	desc.Handle(server.NewIncomingContext(w, req, ps, api.CallMeta{}))
+
+	// Check that error status is returned
+	if w.Code != 500 {
+		t.Errorf("expected error status 500, got %d", w.Code)
+	}
+
+	// Check that middleware headers are still applied
+	expectedHeaders := map[string]string{
+		"X-Error-Header":   "error-value",
+		"X-Always-Present": "always",
+	}
+
+	for expectedHeader, expectedValue := range expectedHeaders {
+		gotValue := w.Header().Get(expectedHeader)
+		if gotValue != expectedValue {
+			t.Errorf("header %s: got %q, want %q", expectedHeader, gotValue, expectedValue)
+		}
+	}
+}
diff --git a/runtimes/go/appruntime/apisdk/api/middleware.go b/runtimes/go/appruntime/apisdk/api/middleware.go
new file mode 100644
index 0000000000..d5f36a4872
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/middleware.go
@@ -0,0 +1,18 @@
+package api
+
+import "encore.dev/middleware"
+
+type Middleware struct {
+	ID      string
+	PkgName string
+	Name    string
+	Global  bool
+	DefLoc  uint32
+	Invoke  middleware.Signature
+}
+
+// Validator is the interface implemented by types
+// that can validate incoming requests.
+type Validator interface {
+	Validate() error
+}
diff --git a/runtimes/go/appruntime/apisdk/api/pubsub_push_proxy.go b/runtimes/go/appruntime/apisdk/api/pubsub_push_proxy.go
new file mode 100644
index 0000000000..a57c18095b
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/pubsub_push_proxy.go
@@ -0,0 +1,41 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/apisdk/api/transport"
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/beta/errs"
+)
+
+func (s *Server) createPubsubPushProxy(target config.Service) (*httputil.ReverseProxy, error) {
+	targetUrl, err := url.Parse(target.URL)
+
+	if err != nil {
+		return nil, err
+	}
+	logger := s.rootLogger.With().Str("remote_push_url", target.URL).Logger()
+
+	return &httputil.ReverseProxy{
+		// Rewrite the inbound request
+		Rewrite: func(req *httputil.ProxyRequest) {
+			req.SetURL(targetUrl)
+			t := transport.HTTPRequest(req.Out)
+			meta := CallMetaFromContext(req.In.Context())
+			if err := meta.AddToRequest(s, target, t); err != nil {
+				logger.Err(err).Msg("failed to add call metadata to request")
+			}
+		},
+		// Have the reverse proxy log errors to our logger.
+		ErrorLog: newZeroLogAdapter(logger, zerolog.ErrorLevel),
+		// Handle proxy errors using our error handler output
+		ErrorHandler: func(w http.ResponseWriter, req *http.Request, err error) {
+			logger.Err(err).Msg("error proxying request to service")
+			errs.HTTPError(w, errs.B().Cause(err).Code(errs.Unavailable).Err())
+		},
+	}, nil
+}
diff --git a/runtimes/go/appruntime/apisdk/api/reflection.go b/runtimes/go/appruntime/apisdk/api/reflection.go
new file mode 100644
index 0000000000..a568e20e1f
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/reflection.go
@@ -0,0 +1,154 @@
+package api
+
+import (
+	"context"
+	"reflect"
+	"strings"
+
+	"encore.dev/beta/errs"
+)
+
+var (
+	voidType    = reflect.TypeOf((*Void)(nil)).Elem()
+	contextType = reflect.TypeOf((*context.Context)(nil)).Elem()
+	errorType   = reflect.TypeOf((*error)(nil)).Elem()
+)
+
+type reflectedAPIMethod[Req any, Resp any] func(ctx context.Context, req Req) (Resp, error)
+
+// createReflectionCaller takes a reflected function which should match the signature of an API method which is
+// described by the Req and Resp types, and returns a function which can be used to call that function using
+// the provided request and response types.
+//
+// It will return an error if the function does not match the expected signature.
+func createReflectionCaller[Req any, Resp any](function reflect.Value) (reflectedAPIMethod[Req, Resp], error) {
+	// Sanity check that the function is a function
+	if function.Kind() != reflect.Func {
+		return nil, errs.B().Code(errs.Internal).Msgf("expected a function, got %s", function.Kind()).Err()
+	}
+	typ := function.Type()
+
+	// Get the request type
+	requestType := reflect.TypeOf((*Req)(nil)).Elem()
+	if requestType.Kind() != reflect.Pointer {
+		return nil, errs.B().Code(errs.Internal).Msgf("expected request type to be a pointer, got %s", requestType.Kind()).Err()
+	}
+	requestType = requestType.Elem()
+	if requestType.Kind() != reflect.Struct {
+		return nil, errs.B().Code(errs.Internal).Msgf("expected request type to be a struct, got %s", requestType.Kind()).Err()
+	}
+
+	expectedNumInParams := 1 + requestType.NumField()
+
+	// Build up the list of parameters we expect in the order they should be passed to the function
+	expectedParamTypes := make([]reflect.Type, 1, expectedNumInParams)
+	paramFieldIndexes := make([]int, 1, expectedNumInParams)
+
+	// All API's must always have a context as the first parameter
+	expectedParamTypes[0] = contextType
+	paramFieldIndexes[0] = -1 // -1 means it's not a field on the request struct
+
+	// Now dynamically add the rest of the parameters both the payload and any path parameters
+	var payloadType reflect.Type
+	var payloadFieldIndex int
+	for i := 0; i < requestType.NumField(); i++ {
+		if requestType.Field(i).Name == "Payload" {
+			payloadType = requestType.Field(i).Type
+			payloadFieldIndex = i
+		} else {
+			expectedParamTypes = append(expectedParamTypes, requestType.Field(i).Type)
+			paramFieldIndexes = append(paramFieldIndexes, i)
+		}
+	}
+	if payloadType != nil {
+		expectedParamTypes = append(expectedParamTypes, payloadType)
+		paramFieldIndexes = append(paramFieldIndexes, payloadFieldIndex)
+	}
+
+	// Check the number of parameters is correct, if not return an error
+	numInParams := typ.NumIn()
+	if numInParams != expectedNumInParams {
+		expectedParams := make([]string, expectedNumInParams)
+		expectedParams[0] = "context.Context"
+		for i := 0; i < requestType.NumField(); i++ {
+			expectedParams[i+1] = requestType.Field(i).Type.String()
+		}
+
+		return nil, errs.B().Code(errs.Internal).Msgf("expected %d parameters (%s), got %d parameters", expectedNumInParams, strings.Join(expectedParams, ", "), numInParams).Err()
+	}
+
+	// Check all the parameters are of the correct type, if not return an error
+	for i, expected := range expectedParamTypes {
+		actual := typ.In(i)
+		if actual != expected {
+			return nil, errs.B().Code(errs.Internal).Msgf("expected parameter %d to be %s, got %s", i+1, expected, actual).Err()
+		}
+	}
+
+	// If Resp is of type Void, then we expect 1 return value, otherwise 2
+	responseType := reflect.TypeOf((*Resp)(nil)).Elem()
+	numReturnValues := typ.NumOut()
+	isVoidResponse := responseType == voidType
+	var errResponseIdx int
+
+	if isVoidResponse {
+		errResponseIdx = 0
+
+		if numReturnValues != 1 {
+			return nil, errs.B().Code(errs.Internal).Msgf("expected one return value (error), got %d return values", numReturnValues).Err()
+		}
+
+		if typ.Out(0) != errorType {
+			return nil, errs.B().Code(errs.Internal).Msgf("expected the return value to be an error, got %s", typ.Out(0)).Err()
+		}
+	} else {
+		errResponseIdx = 1
+
+		if numReturnValues != 2 {
+			return nil, errs.B().Code(errs.Internal).Msgf("expected two return values (%s, error), got %d return values", responseType, numReturnValues).Err()
+		}
+
+		if typ.Out(0) != responseType {
+			return nil, errs.B().Code(errs.Internal).Msgf("expected first return value to be %s, got %s", responseType, typ.Out(0)).Err()
+		}
+
+		if typ.Out(1) != errorType {
+			return nil, errs.B().Code(errs.Internal).Msgf("expected second return value to be an error, got %s", typ.Out(1)).Err()
+		}
+	}
+
+	return func(ctx context.Context, req Req) (respObj Resp, respErr error) {
+		inParams := make([]reflect.Value, 1, expectedNumInParams)
+		inParams[0] = reflect.ValueOf(ctx)
+
+		// If we have parameters on the request, then we need to pass them to the function
+		reqValue := reflect.ValueOf(req)
+		if !reqValue.IsNil() {
+			reqValue = reqValue.Elem() // deference the pointer that Encore always sets here
+
+			for i := 1; i < expectedNumInParams; i++ {
+				inParams = append(inParams, reqValue.Field(paramFieldIndexes[i]))
+			}
+		} else {
+			// If we don't have an `EncoreInteral_FoobarRequest` object, then we need to pass in the zero value for each
+			// parameter - this shouldn't happen as all Encore generated API calls will always pass in a request object
+			for i := 1; i < expectedNumInParams; i++ {
+				inParams = append(inParams, reflect.Zero(expectedParamTypes[i]))
+			}
+		}
+
+		outParams := function.Call(inParams)
+
+		// These two casts are safe because we've already checked the types above
+		respParam := outParams[0]
+		if !isVoidResponse && respParam.IsValid() && !respParam.IsZero() {
+			respObj = respParam.Interface().(Resp)
+		}
+
+		outErr := outParams[errResponseIdx]
+		if outErr.IsValid() && !outErr.IsZero() {
+			respErr = outErr.Interface().(error)
+		}
+		return
+	}, nil
+}
diff --git a/runtimes/go/appruntime/apisdk/api/reflection_test.go b/runtimes/go/appruntime/apisdk/api/reflection_test.go
new file mode 100644
index 0000000000..49fdd10847
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/reflection_test.go
@@ -0,0 +1,305 @@
+package api
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+)
+
+func Test_createReflectionCaller(t *testing.T) {
+	c := qt.New(t)
+	c.Parallel()
+
+	c.Run("test parameter types are type checked", func(c *qt.C) {
+		c.Run("missing context param", func(c *qt.C) {
+			c.Parallel()
+			_, err := createReflectionCaller[*EncoreEmptyReq, Void](reflect.ValueOf(func() {}))
+			c.Assert(err, qt.ErrorMatches, ".*expected 1 parameters \\(context.Context\\), got 0 parameters")
+		})
+
+		c.Run("context param is wrong type", func(c *qt.C) {
+			c.Parallel()
+			_, err := createReflectionCaller[*EncoreEmptyReq, Void](reflect.ValueOf(func(int) {}))
+			c.Assert(err, qt.ErrorMatches, ".*expected parameter 1 to be context.Context, got int")
+		})
+
+		c.Run("missing parameter type", func(c *qt.C) {
+			c.Parallel()
+			_, err := createReflectionCaller[*EncoreExampleParamsRequest, Void](reflect.ValueOf(func(context.Context) {}))
+			c.Assert(err, qt.ErrorMatches, ".*expected 2 parameters \\(context.Context, \\*api.ExampleParams\\), got 1 parameters")
+		})
+
+		c.Run("parameter type is wrong", func(c *qt.C) {
+			c.Parallel()
+			_, err := createReflectionCaller[*EncoreExampleParamsRequest, Void](reflect.ValueOf(func(context.Context, int) {}))
+			c.Assert(err, qt.ErrorMatches, ".*expected parameter 2 to be \\*api.ExampleParams, got int")
+		})
+
+		c.Run("path params are type checks", func(c *qt.C) {
+			c.Parallel()
+			_, err := createReflectionCaller[*EncoreExampleWithPathParams, Void](reflect.ValueOf(func(context.Context, *ExampleParams, string, int, []string) {}))
+			c.Assert(err, qt.ErrorMatches, ".*expected parameter 2 to be string, got \\*api.ExampleParams")
+		})
+	})
+
+	c.Run("test response types are type checked", func(c *qt.C) {
+		c.Run("void api doesn't return error", func(c *qt.C) {
+			c.Parallel()
+			_, err := createReflectionCaller[*EncoreEmptyReq, Void](reflect.ValueOf(func(context.Context) {}))
+			c.Assert(err, qt.ErrorMatches, ".*expected one return value \\(error\\), got 0 return values")
+		})
+
+		c.Run("void api returns too many values", func(c *qt.C) {
+			c.Parallel()
+			_, err := createReflectionCaller[*EncoreEmptyReq, Void](reflect.ValueOf(func(context.Context) (error, Void) { return nil, Void{} }))
+			c.Assert(err, qt.ErrorMatches, ".*expected one return value \\(error\\), got 2 return values")
+		})
+
+		c.Run("api returns nothing", func(c *qt.C) {
+			c.Parallel()
+			_, err := createReflectionCaller[*EncoreEmptyReq, *ExampleResponse](reflect.ValueOf(func(context.Context) {}))
+			c.Assert(err, qt.ErrorMatches, ".*expected two return values \\(\\*api.ExampleResponse, error\\), got 0 return values")
+		})
+
+		c.Run("api response type is wrong", func(c *qt.C) {
+			c.Parallel()
+			_, err := createReflectionCaller[*EncoreEmptyReq, *ExampleResponse](reflect.ValueOf(func(context.Context) (int, error) { return 0, nil }))
+			c.Assert(err, qt.ErrorMatches, ".*expected first return value to be \\*api.ExampleResponse, got int")
+		})
+
+		c.Run("api error type is wrong", func(c *qt.C) {
+			c.Parallel()
+			_, err := createReflectionCaller[*EncoreEmptyReq, *ExampleResponse](reflect.ValueOf(func(context.Context) (*ExampleResponse, int) { return nil, 0 }))
+			c.Assert(err, qt.ErrorMatches, ".*expected second return value to be an error, got int")
+		})
+
+		c.Run("api returns too many values", func(c *qt.C) {
+			c.Parallel()
+			_, err := createReflectionCaller[*EncoreEmptyReq, *ExampleResponse](reflect.ValueOf(func(context.Context) (*ExampleResponse, error, int) { return nil, nil, 0 }))
+			c.Assert(err, qt.ErrorMatches, ".*expected two return values \\(\\*api.ExampleResponse, error\\), got 3 return values")
+		})
+	})
+
+	c.Run("test calling the returned functions", func(c *qt.C) {
+		c.Run("basic api only returning an error", func(c *qt.C) {
+			c.Parallel()
+			called := false
+			shouldError := false
+
+			method, err := createReflectionCaller[*EncoreEmptyReq, Void](reflect.ValueOf(func(ctx context.Context) error {
+				if shouldError {
+					return errors.New("test error")
+				}
+				called = true
+				return nil
+			}))
+			c.Assert(err, qt.IsNil, qt.Commentf("unable to create the reflection caller"))
+
+			// Test the method works and actually gets called
+			resp, err := method(context.Background(), nil)
+			c.Assert(err, qt.IsNil, qt.Commentf("api should return no error"))
+			c.Assert(resp, qt.Equals, Void{}, qt.Commentf("api should return Void{}"))
+			c.Assert(called, qt.Equals, true, qt.Commentf("api should have been called"))
+
+			// Test the error is returned if the API errors
+			shouldError = true
+			resp, err = method(context.Background(), nil)
+			c.Assert(err, qt.ErrorMatches, "test error", qt.Commentf("api should return an error now"))
+		})
+
+		c.Run("api that takes parameters but returns nothing", func(c *qt.C) {
+			c.Parallel()
+			calledWith := "<not called>"
+
+			method, err := createReflectionCaller[*EncoreExampleParamsRequest, Void](reflect.ValueOf(func(ctx context.Context, params *ExampleParams) error {
+				if params.Param2 == "error" {
+					return errors.New(params.Param1)
+				}
+
+				calledWith = params.Param1
+				return nil
+			}))
+			c.Assert(err, qt.IsNil, qt.Commentf("unable to create the reflection caller"))
+
+			// Test the method works and actually gets called
+			resp, err := method(context.Background(), &EncoreExampleParamsRequest{
+				Payload: &ExampleParams{
+					Param1: "this value",
+					Param2: "ignored",
+				},
+			})
+			c.Assert(err, qt.IsNil, qt.Commentf("didn't expect an error form the api"))
+			c.Assert(resp, qt.Equals, Void{}, qt.Commentf("api should return Void{}"))
+			c.Assert(calledWith, qt.Equals, "this value", qt.Commentf("api should have been called with the correct value"))
+
+			// Test the error is returned if the API errors
+			resp, err = method(context.Background(), &EncoreExampleParamsRequest{
+				Payload: &ExampleParams{
+					Param1: "my amazing error message",
+					Param2: "error",
+				},
+			})
+			c.Assert(err, qt.ErrorMatches, "my amazing error message", qt.Commentf("api should return an error now"))
+		})
+
+		c.Run("api that takes path parameters", func(c *qt.C) {
+			c.Parallel()
+
+			calledWith := "<not called>"
+			method, err := createReflectionCaller[*EncoreExampleWithPathParams, Void](reflect.ValueOf(func(ctx context.Context, name string, age int, tags []string, params *ExampleParams) error {
+				calledWith = fmt.Sprintf("%s - %s=%d %v", params.Param1, name, age, tags)
+				return nil
+			}))
+			c.Assert(err, qt.IsNil, qt.Commentf("unable to create the reflection caller"))
+
+			// Test the method works and actually gets called
+			resp, err := method(context.Background(), &EncoreExampleWithPathParams{
+				Payload: &ExampleParams{
+					Param1: "this value",
+					Param2: "ignored",
+				},
+				P0: "first param",
+				P1: 1337,
+				P2: []string{"a", "b", "c"},
+			})
+			c.Assert(err, qt.IsNil, qt.Commentf("didn't expect an error form the api"))
+			c.Assert(resp, qt.Equals, Void{}, qt.Commentf("api should return Void{}"))
+			c.Assert(calledWith, qt.Equals, "this value - first param=1337 [a b c]", qt.Commentf("api should have been called with the correct value"))
+		})
+
+		c.Run("api that returns a response", func(c *qt.C) {
+			c.Parallel()
+
+			returnNil := false
+			returnErr := false
+			method, err := createReflectionCaller[*EncoreEmptyReq, *ExampleResponse](reflect.ValueOf(func(ctx context.Context) (*ExampleResponse, error) {
+				if returnErr {
+					return nil, errors.New("test error")
+				}
+				if returnNil {
+					return nil, nil
+				}
+				return &ExampleResponse{Value: "hello"}, nil
+			}))
+			c.Assert(err, qt.IsNil, qt.Commentf("unable to create the reflection caller"))
+
+			// Test the method works and actually gets called
+			resp, err := method(context.Background(), nil)
+			c.Assert(err, qt.IsNil, qt.Commentf("didn't expect an error form the api"))
+			c.Assert(resp, qt.DeepEquals, &ExampleResponse{Value: "hello"}, qt.Commentf("api should return the correct response"))
+
+			// Test nil, nil is handled correctly
+			returnNil = true
+			resp, err = method(context.Background(), nil)
+			c.Assert(err, qt.IsNil, qt.Commentf("didn't expect an error form the api"))
+			c.Assert(resp, qt.IsNil, qt.Commentf("api should return nil"))
+
+			// Test error is returned correctly
+			returnErr = true
+			resp, err = method(context.Background(), nil)
+			c.Assert(err, qt.ErrorMatches, "test error", qt.Commentf("api should return an error"))
+			c.Assert(resp, qt.IsNil, qt.Commentf("api should return nil"))
+		})
+
+		c.Run("test receiver methods work too", func(c *qt.C) {
+			c.Parallel()
+
+			obj := &ExampleMockService{value: "hello", calledWith: "<not called>"}
+			method, err := createReflectionCaller[*EncoreExampleParamsRequest, *ExampleResponse](reflect.ValueOf(obj.ExampleMethod))
+			c.Assert(err, qt.IsNil, qt.Commentf("unable to create the reflection caller"))
+
+			// Test the method works and actually gets called, and can reference the struct instance
+			resp, err := method(context.Background(), &EncoreExampleParamsRequest{
+				Payload: &ExampleParams{
+					Param1: "this value",
+					Param2: "ignored",
+				},
+			})
+			c.Assert(err, qt.IsNil, qt.Commentf("didn't expect an error form the api"))
+			c.Assert(resp, qt.DeepEquals, &ExampleResponse{Value: "hello"}, qt.Commentf("api should return the correct response"))
+			c.Assert(obj.calledWith, qt.Equals, "this value - ignored", qt.Commentf("api should have been called with the correct value"))
+
+			// Test nil, nil is handled correctly
+			resp, err = method(context.Background(), &EncoreExampleParamsRequest{Payload: &ExampleParams{
+				Param1: "foobar",
+				Param2: "nil",
+			}})
+			c.Assert(err, qt.IsNil, qt.Commentf("didn't expect an error form the api"))
+			c.Assert(resp, qt.IsNil, qt.Commentf("api should return nil"))
+			c.Assert(obj.calledWith, qt.Equals, "foobar - nil", qt.Commentf("api should have been called with the correct value"))
+
+			// Test error is returned correctly
+			resp, err = method(context.Background(), &EncoreExampleParamsRequest{Payload: &ExampleParams{
+				Param1: "error",
+				Param2: "test error value",
+			}})
+			c.Assert(err, qt.ErrorMatches, "test error value", qt.Commentf("api should return an error"))
+			c.Assert(resp, qt.IsNil, qt.Commentf("api should return nil"))
+			c.Assert(obj.calledWith, qt.Equals, "error - test error value", qt.Commentf("api should have been called with the correct value"))
+
+			// Test nil request is handled correctly
+			resp, err = method(context.Background(), &EncoreExampleParamsRequest{Payload: nil})
+			c.Assert(err, qt.IsNil, qt.Commentf("didn't expect an error form the api"))
+			c.Assert(resp, qt.DeepEquals, &ExampleResponse{Value: "you gave me nil!"}, qt.Commentf("api should return the correct response"))
+			c.Assert(obj.calledWith, qt.Equals, "got nil", qt.Commentf("api should have been called with the correct value"))
+
+			// And finally test a nil Encore internal param is handled correctly
+			obj.calledWith = "<not called>"
+			resp, err = method(context.Background(), nil)
+			c.Assert(err, qt.IsNil, qt.Commentf("didn't expect an error form the api"))
+			c.Assert(resp, qt.DeepEquals, &ExampleResponse{Value: "you gave me nil!"}, qt.Commentf("api should return the correct response"))
+			c.Assert(obj.calledWith, qt.Equals, "got nil", qt.Commentf("api should have been called with the correct value"))
+		})
+	})
+}
+
+type ExampleMockService struct {
+	value      string
+	calledWith string
+}
+
+func (e *ExampleMockService) ExampleMethod(_ context.Context, p *ExampleParams) (*ExampleResponse, error) {
+	if p == nil {
+		e.calledWith = "got nil"
+		return &ExampleResponse{Value: "you gave me nil!"}, nil
+	}
+
+	e.calledWith = fmt.Sprintf("%s - %s", p.Param1, p.Param2)
+
+	if p.Param1 == "error" {
+		return nil, errors.New(p.Param2)
+	} else if p.Param2 == "nil" {
+		return nil, nil
+	}
+	return &ExampleResponse{Value: e.value}, nil
+}
+
+type EncoreEmptyReq struct{}
+
+type EncoreExampleParamsRequest struct {
+	Payload *ExampleParams
+}
+
+// Note: this is how Encore generates the request struct for an API
+//
+// The parameter type is always called `Payload` and placed first
+// then each path parameter is added in order after that
+type EncoreExampleWithPathParams struct {
+	Payload *ExampleParams
+	P0      string
+	P1      int
+	P2      []string
+}
+
+type ExampleParams struct {
+	Param1 string
+	Param2 string
+}
+
+type ExampleResponse struct {
+	Value string
+}
diff --git a/runtimes/go/appruntime/apisdk/api/registry.go b/runtimes/go/appruntime/apisdk/api/registry.go
new file mode 100644
index 0000000000..26bbf3a6ee
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/registry.go
@@ -0,0 +1,27 @@
+//go:build encore_app
+
+package api
+
+import "reflect"
+
+func RegisterEndpoint(handler Handler, function any) {
+	Singleton.registerEndpoint(handler, function)
+}
+
+func RegisterAuthHandler(handler AuthHandler) {
+	Singleton.setAuthHandler(handler)
+}
+
+// RegisterAuthDataType registers the type of the auth data that will be
+// returned by the auth handler. This is used to verify that the auth data
+// returned by the auth handler is of the correct type.
+//
+// Note type T is required to be a pointer type.
+func RegisterAuthDataType[T any]() {
+	var zero T
+	RegisteredAuthDataType = reflect.TypeOf(zero)
+}
+
+func RegisterGlobalMiddleware(mw *Middleware) {
+	Singleton.registerGlobalMiddleware(mw)
+}
diff --git a/runtimes/go/appruntime/apisdk/api/reqtrack.go b/runtimes/go/appruntime/apisdk/api/reqtrack.go
new file mode 100644
index 0000000000..4feffebf18
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/reqtrack.go
@@ -0,0 +1,399 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+	"sync/atomic"
+	"time"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/beta/errs"
+)
+
+func (s *Server) beginOperation() {
+	s.rt.BeginOperation()
+}
+
+func (s *Server) finishOperation() {
+	s.rt.FinishOperation()
+}
+
+type beginRequestParams struct {
+	Type   model.RequestType
+	DefLoc uint32
+	Data   *model.RPCData
+
+	// TraceID is the trace ID to use.
+	// If it is the zero value it will be copied from the parent request.
+	TraceID model.TraceID
+
+	// SpanID is the span ID to use.
+	// If it is the zero value a new span id is generated.
+	SpanID model.SpanID
+
+	// ParentTraceID is the parent trace ID to use for correlation.
+	// It is copied from the parent request if it is empty.
+	ParentTraceID model.TraceID
+
+	// ParentSpanID is the parent's span ID to use for correlation.
+	// It is copied from the parent request if it is empty.
+	ParentSpanID model.SpanID
+
+	// ParentSampled indicates whether the parent span sampled trace information.
+	ParentSampled bool
+
+	// CallerEventID is the event ID in the parent span that triggered this request.
+	// It's used to correlate the request with the originating call.
+	CallerEventID model.TraceEventID
+
+	// ExtRequestID specifies the externally-provided request id, if any.
+	// If not empty, it will be recorded as part of the "starting request" log message
+	// to facilitate request correlation.
+	ExtRequestID string
+
+	// ExtCorrelationID is the externally-provided correlation ID, if any.
+	// If not empty, it will be recorded on each log message with "correlation_id" key.
+	// to facilitate request correlation.
+	ExtCorrelationID string
+
+	// AdditionalLogFields is a map of additional fields to be added to all the log message.
+	// This is mainly used to add the trace identifiers to the log messages
+	// so the clouds logging can correlate the logs with the trace.
+	AdditionalLogFields map[string]string
+}
+
+func (s *Server) beginRequest(ctx context.Context, p *beginRequestParams) (*model.Request, error) {
+	traceID := p.TraceID
+	if traceID.IsZero() {
+		id, err := model.GenTraceID()
+		if err != nil {
+			return nil, err
+		}
+		traceID = id
+	}
+
+	spanID := p.SpanID
+	if spanID.IsZero() {
+		id, err := model.GenSpanID()
+		if err != nil {
+			return nil, err
+		}
+		spanID = id
+	}
+
+	var traced bool
+	if p.ParentSpanID.IsZero() {
+		traced = s.rt.SampleTrace()
+	} else {
+		traced = p.ParentSampled
+	}
+
+	req := &model.Request{
+		Type:             p.Type,
+		TraceID:          traceID,
+		SpanID:           spanID,
+		ParentSpanID:     p.ParentSpanID,
+		ParentTraceID:    p.ParentTraceID,
+		CallerEventID:    p.CallerEventID,
+		ExtCorrelationID: p.ExtCorrelationID,
+		DefLoc:           p.DefLoc,
+		SvcNum:           p.Data.Desc.SvcNum,
+		Start:            s.clock.Now(),
+		Traced:           traced,
+		RPCData:          p.Data,
+	}
+
+	data := req.RPCData
+
+	// Update request data based on call options, if any
+	if opts, _ := ctx.Value(callOptionsKey).(*CallOptions); opts != nil {
+		if a := opts.Auth; a != nil {
+			if err := CheckAuthData(a.UID, a.UserData); err != nil {
+				return nil, fmt.Errorf("invalid API call options: %v", err)
+			}
+			data.UserID = a.UID
+			data.AuthData = a.UserData
+		}
+	}
+
+	// Begin the request, copying data over from the previous request.
+	s.rt.BeginRequest(req)
+	if curr := s.rt.Current(); curr.Trace != nil {
+		switch req.Type {
+		case model.RPCCall:
+			curr.Trace.RequestSpanStart(req, curr.Goctr)
+		case model.AuthHandler:
+			curr.Trace.AuthSpanStart(req, curr.Goctr)
+		case model.PubSubMessage:
+			curr.Trace.PubsubMessageSpanStart(req, curr.Goctr)
+		}
+	}
+
+	// Now that we have up-to-date information in req (possibly copied from
+	// the parent request), construct our logger.
+	desc := req.RPCData.Desc
+	logCtx := s.rootLogger.With().Str("service", desc.Service).Str("endpoint", desc.Endpoint)
+	if data.UserID != "" {
+		logCtx = logCtx.Str("uid", string(data.UserID))
+	}
+
+	if req.Test != nil {
+		logCtx = logCtx.Str("test", req.Test.Current.Name())
+	}
+
+	if req.TraceID != (model.TraceID{}) {
+		logCtx = logCtx.Str("trace_id", req.TraceID.String())
+	}
+
+	if req.ExtCorrelationID != "" {
+		logCtx = logCtx.Str("x_correlation_id", req.ExtCorrelationID)
+	} else if req.ParentTraceID != (model.TraceID{}) {
+		logCtx = logCtx.Str("x_correlation_id", req.ParentTraceID.String())
+	}
+
+	// Add additional log fields, if any
+	for k, v := range p.AdditionalLogFields {
+		logCtx = logCtx.Str(k, v)
+	}
+
+	reqLogger := logCtx.Logger()
+	req.Logger = &reqLogger
+
+	switch req.Type {
+	case model.AuthHandler:
+		req.Logger.Info().Msg("running auth handler")
+	default:
+		ev := req.Logger.Info()
+		if p.ExtRequestID != "" {
+			ev = ev.Str("ext_request_id", p.ExtRequestID)
+		}
+		ev.Msg("starting request")
+	}
+
+	return req, nil
+}
+
+func (s *Server) finishRequest(resp *model.Response) {
+	curr := s.rt.Current()
+	req := curr.Req
+	if req == nil {
+		panic("encore: no current request running")
+	}
+
+	if resp.Err != nil {
+		switch req.Type {
+		case model.AuthHandler:
+			req.Logger.Error().Err(resp.Err).Msg("auth handler failed")
+		default:
+			e := errs.Convert(resp.Err).(*errs.Error)
+			ev := req.Logger.Error()
+
+			var panicStack *stack.Stack
+			for k, v := range e.Meta {
+				if k == "panic_stack" {
+					if st, ok := v.(stack.Stack); ok {
+						panicStack = &st
+					}
+					continue
+				}
+				ev = ev.Interface(k, v)
+			}
+
+			if panicStack != nil {
+				ev = ev.Interface("stack", stack.Format(*panicStack))
+			}
+
+			ev.Str("error", e.ErrorMessage()).Str("code", e.Code.String()).Msg("request failed")
+		}
+	}
+
+	resp.Duration = time.Since(req.Start)
+	switch req.Type {
+	case model.AuthHandler:
+		req.Logger.Info().Dur("duration", resp.Duration).Msg("auth handler completed")
+	default:
+		if resp.HTTPStatus != errs.HTTPStatus(resp.Err) {
+			code := errs.HTTPStatusToCode(resp.HTTPStatus).String()
+			req.Logger.Info().Dur("duration", resp.Duration).Str("code", code).Int("http_code", resp.HTTPStatus).Msg("request completed")
+		} else {
+			code := errs.Code(resp.Err).String()
+			req.Logger.Info().Dur("duration", resp.Duration).Str("code", code).Msg("request completed")
+		}
+	}
+
+	if curr.Trace != nil {
+		// Capture the recorded bytes from the request and response body, if any.
+		if len(resp.RawRequestPayload) > 0 {
+			curr.Trace.BodyStream(trace2.BodyStreamParams{
+				EventParams: trace2.EventParams{
+					TraceID: req.TraceID,
+					SpanID:  req.SpanID,
+				},
+				IsResponse: false,
+				Overflowed: resp.RawRequestPayloadOverflowed,
+				Data:       resp.RawRequestPayload,
+			})
+		}
+
+		if len(resp.RawResponsePayload) > 0 {
+			curr.Trace.BodyStream(trace2.BodyStreamParams{
+				EventParams: trace2.EventParams{
+					TraceID: req.TraceID,
+					SpanID:  req.SpanID,
+				},
+				IsResponse: true,
+				Overflowed: resp.RawResponsePayloadOverflowed,
+				Data:       resp.RawResponsePayload,
+			})
+		}
+
+		ep := trace2.EventParams{TraceID: req.TraceID, SpanID: req.SpanID}
+		switch req.Type {
+		case model.RPCCall:
+			curr.Trace.RequestSpanEnd(trace2.RequestSpanEndParams{
+				EventParams: ep,
+				Req:         req,
+				Resp:        resp,
+			})
+		case model.AuthHandler:
+			curr.Trace.AuthSpanEnd(trace2.AuthSpanEndParams{
+				EventParams: ep,
+				Req:         req,
+				Resp:        resp,
+			})
+		case model.PubSubMessage:
+			curr.Trace.PubsubMessageSpanEnd(trace2.PubsubMessageSpanEndParams{
+				EventParams: ep,
+				Req:         req,
+				Resp:        resp,
+			})
+		}
+	}
+
+	s.requestsTotal.With(requestsTotalLabels{
+		endpoint: req.RPCData.Desc.Endpoint,
+		code:     Code(resp.Err, resp.HTTPStatus),
+	}).Increment()
+	s.rt.FinishRequest(false)
+}
+
+type CallOptions struct {
+	Auth *model.AuthInfo
+}
+
+type ctxKey string
+
+const callOptionsKey ctxKey = "call"
+
+func WithCallOptions(ctx context.Context, opts *CallOptions) context.Context {
+	return context.WithValue(ctx, callOptionsKey, opts)
+}
+
+func GetCallOptions(ctx context.Context) *CallOptions {
+	if opts, _ := ctx.Value(callOptionsKey).(*CallOptions); opts != nil {
+		return opts
+	}
+	return &CallOptions{}
+}
+
+// RegisteredAuthDataType is the reflect type of the auth handler's data type.
+//
+// If no auth handler is configured, this is nil.
+// If an auth handler is configured, this is a pointer to the auth handler's data type.
+var RegisteredAuthDataType reflect.Type
+
+// newAuthDataObj returns a new instance of the configured auth handler's data type.
+// If no auth handler is configured, nil is returned.
+func newAuthDataObj() any {
+	if RegisteredAuthDataType == nil {
+		return nil
+	}
+	return reflect.New(RegisteredAuthDataType.Elem()).Interface()
+}
+
+// CheckAuthData checks whether the given auth information is valid
+// based on the configured auth handler's data type.
+func CheckAuthData(uid model.UID, userData any) error {
+	if uid == "" && userData != nil {
+		return fmt.Errorf("empty uid and non-empty auth data")
+	}
+
+	if RegisteredAuthDataType != nil {
+		tt := reflect.TypeOf(userData)
+		if uid != "" && userData == nil {
+			return fmt.Errorf("missing auth data (auth handler specifies auth data of type %s)", tt)
+		} else if userData != nil {
+			if tt != RegisteredAuthDataType {
+				return fmt.Errorf("wrong type for auth data (got %s, expected %s)",
+					tt, RegisteredAuthDataType)
+			}
+		}
+	} else {
+		if userData != nil {
+			return fmt.Errorf("unexpected auth data provided (auth handler specifies no auth data)")
+		}
+	}
+
+	return nil
+}
+
+func (s *Server) beginCall(ctx context.Context, serviceName, endpointName string, defLoc uint32) (*model.APICall, CallMeta, error) {
+	call := &model.APICall{
+		TargetServiceName:  serviceName,
+		TargetEndpointName: endpointName,
+		DefLoc:             defLoc,
+	}
+
+	curr := s.rt.Current()
+	call.Source = curr.Req
+
+	// Add  auth data to the call, if any
+	if curr.Req != nil && curr.Req.RPCData != nil {
+		call.UserID = curr.Req.RPCData.UserID
+		call.AuthData = curr.Req.RPCData.AuthData
+	}
+
+	// Update request data based on call options, if any
+	if opts, _ := ctx.Value(callOptionsKey).(*CallOptions); opts != nil {
+		if a := opts.Auth; a != nil {
+			call.UserID = a.UID
+			call.AuthData = a.UserData
+		}
+	}
+
+	if curr.Trace != nil {
+		call.StartEventID = curr.Trace.RPCCallStart(call, curr.Goctr)
+	}
+
+	meta, err := s.metaFromAPICall(call)
+	if err != nil {
+		return nil, CallMeta{}, err
+	}
+
+	return call, meta, nil
+}
+
+func (s *Server) finishCall(call *model.APICall, err error) {
+	if curr := s.rt.Current(); curr.Trace != nil && call.StartEventID != 0 {
+		curr.Trace.RPCCallEnd(call, curr.Goctr, err)
+	}
+}
+
+func (s *Server) beginAuth(defLoc uint32) (*model.AuthCall, error) {
+	spanID, err := model.GenSpanID()
+	if err != nil {
+		return nil, fmt.Errorf("could not generate request id: %v", err)
+	}
+	callID := atomic.AddUint64(&s.callCtr, 1)
+
+	call := &model.AuthCall{
+		ID:     callID,
+		SpanID: spanID,
+		DefLoc: defLoc,
+	}
+
+	return call, nil
+}
diff --git a/runtimes/go/appruntime/apisdk/api/server.go b/runtimes/go/appruntime/apisdk/api/server.go
new file mode 100644
index 0000000000..0c8264c9e8
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/server.go
@@ -0,0 +1,634 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"net/url"
+	"reflect"
+	"slices"
+	"strings"
+	"sync"
+
+	"github.com/benbjohnson/clock"
+	jsoniter "github.com/json-iterator/go"
+	"github.com/julienschmidt/httprouter"
+	"github.com/rs/zerolog"
+	"golang.org/x/net/http2"
+	"golang.org/x/net/http2/h2c"
+
+	encore "encore.dev"
+	"encore.dev/appruntime/apisdk/api/svcauth"
+	"encore.dev/appruntime/apisdk/api/transport"
+	"encore.dev/appruntime/apisdk/cors"
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/experiments"
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/shared/cfgutil"
+	"encore.dev/appruntime/shared/cloudtrace"
+	"encore.dev/appruntime/shared/health"
+	"encore.dev/appruntime/shared/platform"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/appruntime/shared/testsupport"
+	"encore.dev/beta/errs"
+	"encore.dev/internal/platformauth"
+	"encore.dev/metrics"
+	"encore.dev/pubsub"
+)
+
+type Access string
+
+const (
+	Public       Access = "public"
+	RequiresAuth Access = "auth"
+	Private      Access = "private"
+)
+
+const (
+	// eventTraceStateEventIDKey is the key used to store the event ID in the trace state passed between instances
+	// It is encoded as a base36 string of the underlying uint64.
+	eventTraceStateEventIDKey = "encore/event-id"
+
+	// eventTraceStateSpanIDKey is the key used to store the span ID in the trace state passed between instances
+	// We require this on GCP because the traceparent gets a new span ID inserted by GCP's own Trace implementation
+	// (I suspect for the load balancers) and so the span ID in the traceparent is not the same as the span ID
+	// need to create a child span.
+	eventTraceStateSpanIDKey = "encore/span-id"
+)
+
+// execContext contains the data needed for executing a request.
+type execContext struct {
+	server *Server
+	ctx    context.Context
+	ps     UnnamedParams
+	auth   model.AuthInfo
+
+	callMeta CallMeta
+}
+
+type IncomingContext struct {
+	execContext
+	w   http.ResponseWriter
+	req *http.Request
+
+	// capturer is set in handleIncoming for raw requests
+	// to capture the request body
+	capturer *rawRequestBodyCapturer
+}
+
+type Handler interface {
+	ServiceName() string
+	EndpointName() string
+	AccessType() Access
+	SemanticPath() string
+	HTTPRouterPath() string
+	HTTPMethods() []string
+	IsFallback() bool
+	Handle(c IncomingContext)
+}
+
+type requestsTotalLabels struct {
+	endpoint string // Endpoint name.
+	code     string // Human-readable HTTP status code.
+}
+
+type Server struct {
+	static         *config.Static
+	runtime        *config.Runtime
+	rt             *reqtrack.RequestTracker
+	pc             *platform.Client // if nil, requests are not authenticated against platform
+	encoreMgr      *encore.Manager
+	pubsubMgr      *pubsub.Manager
+	requestsTotal  *metrics.CounterGroup[requestsTotalLabels, uint64]
+	httpClient     *http.Client
+	clock          clock.Clock
+	rootLogger     zerolog.Logger
+	json           jsoniter.API
+	tracingEnabled bool
+	experiments    *experiments.Set // The set of experiments enabled for this runtime
+
+	authHandler AuthHandler
+
+	globalMiddleware    map[string]*Middleware
+	registeredHandlers  []Handler
+	functionsToHandlers map[uintptr]Handler
+
+	public           *httprouter.Router
+	publicFallback   *httprouter.Router
+	private          *httprouter.Router
+	privateFallback  *httprouter.Router
+	encore           *httprouter.Router
+	inboundSvcAuth   map[string]svcauth.ServiceAuth // auth methods used to accept inbound service-to-service calls
+	outboundSvcAuth  map[string]svcauth.ServiceAuth // auth methods used to make outbound service-to-service calls
+	httpsrv          *http.Server
+	httpCtx          context.Context
+	httpCtxCancel    context.CancelFunc
+	runningHandlers  sync.WaitGroup
+	remotePubSubPush map[string]*httputil.ReverseProxy
+
+	callCtr uint64
+
+	pubsubSubscriptions map[string]func(r *http.Request) error
+	healthMgr           *health.CheckRegistry
+	testingMgr          *testsupport.Manager
+}
+
+func NewServer(static *config.Static, runtime *config.Runtime, rt *reqtrack.RequestTracker, pc *platform.Client, encoreMgr *encore.Manager, pubsubMgr *pubsub.Manager, rootLogger zerolog.Logger, reg *metrics.Registry, healthMgr *health.CheckRegistry, testingMgr *testsupport.Manager, json jsoniter.API, clock clock.Clock) *Server {
+	requestsTotal := metrics.NewCounterGroupInternal[requestsTotalLabels, uint64](reg, "e_requests_total", metrics.CounterConfig{
+		EncoreInternal_LabelMapper: func(labels requestsTotalLabels) []metrics.KeyValue {
+			return []metrics.KeyValue{
+				{Key: "endpoint", Value: labels.endpoint},
+				{Key: "code", Value: labels.code},
+			}
+		},
+	})
+
+	newRouter := func() *httprouter.Router {
+		router := httprouter.New()
+		router.HandleOPTIONS = false
+		router.RedirectFixedPath = false
+		router.RedirectTrailingSlash = false
+		return router
+	}
+
+	inboundSvcAuth, outboundSvcAuth, err := svcauth.LoadMethods(clock, runtime)
+	if err != nil {
+		panic(fmt.Errorf("error loading service auth methods: %w", err))
+	}
+
+	s := &Server{
+		static:              static,
+		runtime:             runtime,
+		pc:                  pc,
+		rt:                  rt,
+		encoreMgr:           encoreMgr,
+		pubsubMgr:           pubsubMgr,
+		healthMgr:           healthMgr,
+		testingMgr:          testingMgr,
+		requestsTotal:       requestsTotal,
+		httpClient:          &http.Client{},
+		clock:               clock,
+		rootLogger:          rootLogger,
+		json:                json,
+		tracingEnabled:      rt.TracingEnabled(),
+		experiments:         experiments.FromConfig(static, runtime),
+		functionsToHandlers: make(map[uintptr]Handler),
+
+		public:           newRouter(),
+		publicFallback:   newRouter(),
+		private:          newRouter(),
+		privateFallback:  newRouter(),
+		encore:           newRouter(),
+		inboundSvcAuth:   inboundSvcAuth,
+		outboundSvcAuth:  outboundSvcAuth,
+		remotePubSubPush: make(map[string]*httputil.ReverseProxy),
+	}
+
+	// Create our HTTP server handler chain
+
+	// Start with the underlying router
+	var baseHandler http.Handler = http.HandlerFunc(s.handler)
+
+	// If we're acting as an API Gateway, then we need to add CORS support
+	if s.IsGateway() {
+		corsCfg := &config.CORS{}
+		if runtime.CORS != nil {
+			corsCfg = runtime.CORS
+		}
+		baseHandler = cors.Wrap(
+			corsCfg,
+			static.CORSAllowHeaders,
+			static.CORSExposeHeaders,
+			baseHandler,
+			rootLogger,
+		)
+	}
+
+	// Finally, this handler is used to track the number of running handlers
+	// on the server so we can wait for them to finish before shutting down
+	//
+	// It must be the first handler in the chain to ensure the runningHandlers
+	// count is always correct
+	activeHandlersWrapper := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if s.httpCtx.Err() != nil {
+			// We are shutting down, return 503 with a retry-after header to tell clients to back off
+			// we shouldn't ever see this as `httpCtx` is only cancelled after the server has already
+			// started shutting down, but this is here as a safety net just in case
+			w.Header().Set("Retry-After", "2")
+			errs.HTTPErrorWithCode(
+				w,
+				errs.B().Code(errs.Unavailable).Msg("server is shutting down").Err(),
+				http.StatusServiceUnavailable,
+			)
+
+			return
+		}
+
+		// Now we can call the next handler in the chain
+		s.runningHandlers.Add(1)
+		defer s.runningHandlers.Done()
+
+		baseHandler.ServeHTTP(w, r)
+	})
+
+	// Now we have the handler chain setup, create the HTTP server object
+	s.httpCtx, s.httpCtxCancel = context.WithCancel(context.Background())
+	s.httpsrv = &http.Server{
+		Handler: h2c.NewHandler(activeHandlersWrapper, &http2.Server{}),
+		BaseContext: func(_ net.Listener) context.Context {
+			// We set the base context which allows us to cancel it when the server is shutting down
+			return s.httpCtx
+		},
+	}
+
+	s.configureRemotePubsubPush()
+	s.registerEncoreRoutes()
+
+	return s
+}
+
+// configureRemotePubsubPush adds pubsub push handlers for push subscriptions that are not hosted by this service.
+// This is only done for gateway services.
+func (s *Server) configureRemotePubsubPush() {
+	if !s.IsGateway() {
+		return
+	}
+	for _, topic := range s.runtime.PubsubTopics {
+		statTop, ok := s.static.PubsubTopics[topic.EncoreName]
+		if !ok {
+			panic(fmt.Errorf("runtime topic %s not found in static config", topic.EncoreName))
+		}
+		for _, sub := range topic.Subscriptions {
+			statSub, ok := statTop.Subscriptions[sub.EncoreName]
+			if !ok {
+				panic(fmt.Errorf("runtime sub %s/%s not found in static config", topic.EncoreName, sub.EncoreName))
+			}
+			if slices.Contains(s.runtime.HostedServices, statSub.Service) {
+				continue
+			}
+			service, found := s.runtime.ServiceDiscovery[statSub.Service]
+			if !found {
+				panic(fmt.Errorf("service %q not found in service discovery, but needed for the remote push handler", statSub.Service))
+			}
+			var err error
+			s.remotePubSubPush[sub.ID], err = s.createPubsubPushProxy(service)
+			if err != nil {
+				panic(fmt.Errorf("error creating remote pubsub push proxy: %w", err))
+			}
+		}
+	}
+}
+
+// setAuthHandler sets the auth handler to use.
+// If h is nil it means no auth handler is used.
+func (s *Server) setAuthHandler(h AuthHandler) {
+	authService := h.HostedByService()
+
+	if !cfgutil.IsHostedService(s.runtime, authService) {
+		service, found := s.runtime.ServiceDiscovery[authService]
+		if !found {
+			panic(fmt.Errorf("service %q not found in service discovery, but needed for the auth handler", authService))
+		}
+
+		authURL := fmt.Sprintf("%s/__encore/authhandler", service.URL)
+
+		s.authHandler = &remoteAuthHandler{
+			server:         s,
+			hostingService: service,
+			authURL:        authURL,
+			original:       h,
+			logger:         s.rootLogger.With().Str("auth_url", authURL).Logger(),
+			traceLogs:      s.runtime.EnvCloud != "local", // log auth calls in prod containers only
+		}
+	} else {
+		s.authHandler = h
+	}
+}
+
+func (s *Server) RegisteredHandlers() []Handler {
+	return s.registeredHandlers
+}
+
+// wildcardMethod is an internal method name we register wildcard methods under.
+const wildcardMethod = "__ENCORE_WILDCARD__"
+
+func (s *Server) registerEndpoint(h Handler, function any) {
+	routerPath := h.HTTPRouterPath()
+
+	// Decide which routers to use.
+	private, public := s.private, s.public
+	if h.IsFallback() {
+		private, public = s.privateFallback, s.publicFallback
+	}
+
+	var adapter httprouter.Handle
+
+	switch {
+	case cfgutil.IsHostedService(s.runtime, h.ServiceName()):
+		adapter = s.createServiceHandlerAdapter(h)
+
+	case s.IsGateway():
+		adapter = s.createGatewayHandlerAdapter(h)
+
+	default:
+		// not hosted do nothing
+		return
+	}
+
+	s.registeredHandlers = append(s.registeredHandlers, h)
+
+	// Register the adapter
+	for _, m := range h.HTTPMethods() {
+		if m == "*" {
+			m = wildcardMethod
+		}
+
+		private.Handle(m, routerPath, adapter)
+		if access := h.AccessType(); access == Public || access == RequiresAuth {
+			public.Handle(m, routerPath, adapter)
+		}
+	}
+
+	// Register the function mapped to the handler - this allows `et.MockEndpoint` to lookup the Handler
+	// for a given function
+	if s.static.Testing {
+		if reflect.TypeOf(function).Kind() == reflect.Func {
+			s.functionsToHandlers[reflect.ValueOf(function).Pointer()] = h
+		} else {
+			s.rootLogger.Warn().Str("service", h.ServiceName()).Str("endpoint", h.EndpointName()).Msgf("not registering function as lookup for API handler as it is not a function: %T", function)
+		}
+	}
+}
+
+// HandlerForFunc returns the Handler for the given function or nil if it does not exist.
+func (s *Server) HandlerForFunc(function any) Handler {
+	return s.functionsToHandlers[reflect.ValueOf(function).Pointer()]
+}
+
+// ServiceExists returns true if the given service exists and has at least one endpoint.
+func (s *Server) ServiceExists(serviceName string) bool {
+	for _, h := range s.registeredHandlers {
+		if strings.EqualFold(h.ServiceName(), serviceName) {
+			return true
+		}
+	}
+	return false
+}
+
+func (s *Server) registerGlobalMiddleware(mw *Middleware) {
+	if s.globalMiddleware == nil {
+		s.globalMiddleware = make(map[string]*Middleware)
+	}
+	s.globalMiddleware[mw.ID] = mw
+}
+
+func (s *Server) getGlobalMiddleware(ids []string) []*Middleware {
+	// Don't add global middleware when tests are executing,
+	// as it's not possible to guarantee all global middleware
+	// have actually been imported when the tests run.
+	if s.static.Testing {
+		return nil
+	}
+
+	result := make([]*Middleware, 0, len(ids))
+	for _, id := range ids {
+		mw, ok := s.globalMiddleware[id]
+		if !ok {
+			panic(fmt.Sprintf("middleware %q not registered", id))
+		}
+		result = append(result, mw)
+	}
+	return result
+}
+
+func (s *Server) Serve(ln net.Listener) error {
+	if s.runtime.EnvCloud != "local" || s.IsGateway() {
+		s.rootLogger.Info().Msg("listening for incoming HTTP requests")
+	}
+	return s.httpsrv.Serve(ln)
+}
+
+// Shutdown gracefully shuts down the server.
+func (s *Server) Shutdown(p *shutdown.Process) error {
+	// Once it's time to force-close tasks, cancel the base context.
+	go func() {
+		<-p.ForceCloseTasks.Done()
+		s.httpCtxCancel()
+	}()
+
+	// Begin shutting down the server
+	shutdownErr := make(chan error, 1)
+	go func() { shutdownErr <- s.httpsrv.Shutdown(p.ForceShutdown) }()
+
+	// Wait for the running handlers to finish.
+	s.runningHandlers.Wait()
+	p.MarkOutstandingRequestsCompleted()
+
+	return <-shutdownErr
+}
+
+func (s *Server) handler(w http.ResponseWriter, req *http.Request) {
+	// Select a router based on access
+	router, fallbackRouter := s.public, s.publicFallback
+
+	// The Encore platform is authorised to call private APIs directly, thus if we have this header set,
+	// and authenticate it, then we can switch over to the private router which contains all APIs not just
+	// the publicly accessible ones.
+	if sig := req.Header.Get("X-Encore-Auth"); sig != "" && s.pc != nil {
+		if ok, err := s.pc.ValidatePlatformRequest(req, sig); err == nil && ok {
+			// Successfully authenticated
+			req = req.WithContext(platformauth.WithEncorePlatformSealOfApproval(req.Context()))
+			router, fallbackRouter = s.private, s.privateFallback
+		} else if err != nil {
+			http.Error(w, "could not authenticate request", http.StatusBadGateway)
+			return
+		} else {
+			http.Error(w, "invalid request signature", http.StatusUnauthorized)
+			return
+		}
+	}
+
+	// Extract the call meta from the request
+	req, internalCaller, ok := s.extractCallMeta(w, req)
+	if !ok {
+		// extractCallMeta has already written the response
+		return
+	}
+	if internalCaller != nil && internalCaller.PrivateAPIAccess() {
+		// If this request is from another service running in this app, allow it access to the private API routes
+		router, fallbackRouter = s.private, s.privateFallback
+	}
+
+	path := determineRequestPath(req.URL)
+
+	// Switch to the Encore internal router if we are on the Encore internal path
+	const internalPrefix = "/__encore"
+	if strings.HasPrefix(path, internalPrefix+"/") {
+		router, fallbackRouter = s.encore, nil
+		path = path[len(internalPrefix):] // keep leading slash
+	}
+
+	findRoute := func(r *httprouter.Router) (h httprouter.Handle, p httprouter.Params, handledTSR bool) {
+		h, p, _ = r.Lookup(req.Method, path)
+		if h == nil {
+			h, p, _ = r.Lookup(wildcardMethod, path)
+		}
+
+		if h == nil {
+			// If we still couldn't find a handler, check if there is one
+			// with a trailing slash redirect.
+			if handleTrailingSlashRedirect(r, w, req, path) {
+				return nil, nil, true
+			}
+		}
+
+		return h, p, false
+	}
+
+	// Find the route. Try first with the chosen router and otherwise check the fallback router.
+	h, p, handled := findRoute(router)
+	if !handled && h == nil && fallbackRouter != nil {
+		h, p, handled = findRoute(fallbackRouter)
+	}
+
+	// If the router already handled the request via a trailing-slash redirect, we're done.
+	if handled {
+		return
+	}
+
+	if h != nil {
+		// Found an endpoint.
+		h(w, req, p)
+		return
+	}
+
+	// Endpoint not found
+	s.rootLogger.Trace().Str("path", path).Bool("gateway", s.IsGateway()).Strs("hosting", s.runtime.HostedServices).Msg("endpoint not found")
+	errs.HTTPError(w, errs.B().Code(errs.NotFound).Msg("endpoint not found").Err())
+}
+
+func (s *Server) extractCallMeta(w http.ResponseWriter, req *http.Request) (updatedReq *http.Request, internalCaller Caller, ok bool) {
+	// Extract the metadata from the request so we can allow access to the private router.
+	// If the metadata is not present, then we assume this is a public request.
+	meta, err := s.MetaFromRequest(transport.HTTPRequest(req))
+	if err != nil {
+		s.rootLogger.Error().Err(err).Msg("failed to extract metadata from request")
+		http.Error(w, http.StatusText(http.StatusInternalServerError), http.StatusInternalServerError)
+		return nil, nil, false
+	}
+
+	// Extract any cloud generated Trace identifiers from the request.
+	// and use them if we don't have any trace information in the metadata already
+	cloudGeneratedTraceIDs := cloudtrace.ExtractCloudTraceIDs(s.rootLogger, req)
+	if meta.TraceID.IsZero() {
+		meta.TraceID = cloudGeneratedTraceIDs.TraceID
+	}
+
+	// SpanID will be zero already, so if our Cloud generated one for us, we should
+	// use it as the SpanID for this request
+	meta.SpanID = cloudGeneratedTraceIDs.SpanID
+
+	// If we still don't have a trace id, generate one.
+	if meta.TraceID.IsZero() {
+		meta.TraceID, _ = model.GenTraceID()
+		meta.ParentSpanID = model.SpanID{} // no parent span if we have no trace id
+	}
+
+	var caller Caller
+	if meta.Internal != nil {
+		caller = meta.Internal.Caller
+	}
+
+	return req.WithContext(SetCallMetaInContext(req.Context(), meta)), caller, true
+}
+
+func (s *Server) newExecContext(ctx context.Context, ps UnnamedParams, callMeta CallMeta) execContext {
+	var auth model.AuthInfo
+	if callMeta.Internal != nil {
+		auth = model.AuthInfo{
+			UID:      model.UID(callMeta.Internal.AuthUID),
+			UserData: callMeta.Internal.AuthData,
+		}
+	}
+	return execContext{s, ctx, ps, auth, callMeta}
+}
+
+func (s *Server) NewIncomingContext(w http.ResponseWriter, req *http.Request, ps UnnamedParams, callMeta CallMeta) IncomingContext {
+	ec := s.newExecContext(req.Context(), ps, callMeta)
+	return IncomingContext{ec, w, req, nil}
+}
+
+func (s *Server) NewCallContext(ctx context.Context) CallContext {
+	return CallContext{ctx, s}
+}
+
+func toUnnamedParams(ps httprouter.Params) UnnamedParams {
+	params := make(UnnamedParams, len(ps))
+	for i, p := range ps {
+		params[i] = p.Value
+	}
+	return params
+}
+
+// handleTrailingSlashRedirect checks if there's a matching handler
+// with (without) a trailing slash and redirects to it if there is.
+//
+// This is a modified version of the built-in support in httprouter.
+// We can't use the built-in one due to how we handle multiple methods
+// for the same route using Lookup instead of Handle.
+func handleTrailingSlashRedirect(r *httprouter.Router, w http.ResponseWriter, req *http.Request, path string) (handled bool) {
+	// CONNECT does not support redirects.
+	if req.Method == http.MethodConnect {
+		return false
+	}
+
+	// Modify the path to include (exclude) the trailing slash.
+	if len(path) > 1 && path[len(path)-1] == '/' {
+		path = path[:len(path)-1]
+	} else {
+		path += "/"
+	}
+
+	// Check if there is a handler for the modified path.
+	h, _, _ := r.Lookup(req.Method, path)
+	if h == nil {
+		h, _, _ = r.Lookup(wildcardMethod, path)
+	}
+
+	if h == nil {
+		// Couldn't find a handler.
+		return false
+	}
+
+	// Moved Permanently, request with GET method
+	code := http.StatusMovedPermanently
+	if req.Method != http.MethodGet {
+		// Permanent Redirect, request with same method
+		code = http.StatusPermanentRedirect
+	}
+
+	http.Redirect(w, req, path, code)
+	return true
+}
+
+// determineRequestPath determines the path to use for routing
+// based on the incoming request URL u.
+func determineRequestPath(u *url.URL) string {
+	// To support use cases like routing "/foo%2Fbar/baz" to "/:a/*b" as a = "foo/bar", b = "baz"
+	// we need to be careful about the escaping.
+	//
+	// The way the net/url package works is a bit subtle, but URL.RawPath is non-empty if and only if
+	// the default encoding of Path differs from the incoming request.
+	// However, we don't want to always use RawPath (or EscapedPath(), in practice) because
+	// it over-escapes: it turns '{foo}' into '%7Bfoo%7D' which we don't want.
+	//
+	// So, use req.URL.Path when possible, and only use EscapedPath() when necessary.
+	path := u.Path
+	if u.RawPath != "" {
+		path = u.EscapedPath()
+	}
+	return path
+}
diff --git a/runtimes/go/appruntime/apisdk/api/server_test.go b/runtimes/go/appruntime/apisdk/api/server_test.go
new file mode 100644
index 0000000000..2f4e6050a2
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/server_test.go
@@ -0,0 +1,84 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+
+	"github.com/julienschmidt/httprouter"
+)
+
+func Test_handleTrailingSlashRedirect(t *testing.T) {
+	r := httprouter.New()
+	dummy := func(w http.ResponseWriter, r *http.Request, ps httprouter.Params) {}
+	r.GET("/foo", dummy)
+	r.GET("/bar/", dummy)
+	r.POST("/post", dummy)
+
+	tests := []struct {
+		// inputs
+		method, path string
+		// outputs
+		handled bool
+		code    int
+		dest    string
+	}{
+		// Matches existing routes
+		{"GET", "/foo", false, 0, ""},
+		{"GET", "/bar/", false, 0, ""},
+
+		// Redirect to with (without) trailing slash
+		{"GET", "/foo/", true, http.StatusMovedPermanently, "/foo"},
+		{"GET", "/bar", true, http.StatusMovedPermanently, "/bar/"},
+		{"POST", "/post/", true, http.StatusPermanentRedirect, "/post"},
+
+		// Unknown routes
+		{"GET", "/baz", false, 0, ""},
+		{"GET", "/baz/", false, 0, ""},
+	}
+
+	for _, test := range tests {
+		w := httptest.NewRecorder()
+		req := httptest.NewRequest(test.method, test.path, nil)
+		handled := handleTrailingSlashRedirect(r, w, req, test.path)
+		if !handled && !test.handled {
+			continue
+		} else if handled != test.handled {
+			t.Errorf("%s %s: got handled=%v, want %v", test.method, test.path, handled, test.handled)
+			continue
+		}
+
+		if w.Code != test.code {
+			t.Errorf("%s %s: got code=%d, want %d", test.method, test.path, w.Code, test.code)
+		} else if w.Header().Get("Location") != test.dest {
+			t.Errorf("%s %s: got dest=%s, want %s", test.method, test.path, w.Header().Get("Location"), test.dest)
+		}
+	}
+}
+
+func Test_determineRequestPath(t *testing.T) {
+	tests := []struct {
+		path    string
+		rawPath string
+		want    string
+	}{
+		{
+			path:    "/{foo}",
+			rawPath: "",
+			want:    "/{foo}",
+		},
+		{
+			path:    "/foo/bar/baz",
+			rawPath: "/foo/bar%2Fbaz",
+			want:    "/foo/bar%2Fbaz",
+		},
+	}
+	for _, tt := range tests {
+		u := &url.URL{Path: tt.path, RawPath: tt.rawPath}
+		if got := determineRequestPath(u); got != tt.want {
+			t.Errorf("determineRequestPath(&url.URL{Path: %q, RawPath: %q}) = %q, want %q",
+				tt.path, tt.rawPath, got, tt.want)
+		}
+	}
+}
diff --git a/runtimes/go/appruntime/apisdk/api/services.go b/runtimes/go/appruntime/apisdk/api/services.go
new file mode 100644
index 0000000000..03150a507b
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/services.go
@@ -0,0 +1,53 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/julienschmidt/httprouter"
+)
+
+func (s *Server) createServiceHandlerAdapter(h Handler) httprouter.Handle {
+	return func(w http.ResponseWriter, req *http.Request, ps httprouter.Params) {
+		// Delete the header so it can't be accessed.
+		req.Header.Del("X-Encore-Auth")
+
+		params := toUnnamedParams(ps)
+
+		// Extract metadata from the request.
+		meta := CallMetaFromContext(req.Context())
+
+		// Always send the trace id back.
+		traceIDStr := meta.TraceID.String()
+		w.Header().Set("X-Encore-Trace-ID", traceIDStr)
+
+		// Echo the X-Request-ID back to the caller if present,
+		// otherwise send back the trace id.
+		reqID := req.Header.Get("X-Request-ID")
+		if reqID == "" {
+			reqID = traceIDStr
+		} else if len(reqID) > 64 {
+			// Don't allow arbitrarily long request IDs.
+			s.rootLogger.Warn().Int("length", len(reqID)).Msg("X-Request-ID was too long and is being truncated to 64 characters")
+			reqID = reqID[:64]
+		}
+		w.Header().Set("X-Request-ID", reqID)
+
+		// Read the correlation ID from the request.
+		if meta.CorrelationID != "" {
+			w.Header().Set("X-Correlation-ID", meta.CorrelationID)
+		}
+
+		s.processRequest(h, s.NewIncomingContext(w, req, params, meta))
+	}
+}
+
+func (s *Server) processRequest(h Handler, c IncomingContext) {
+	c.server.beginOperation()
+	defer c.server.finishOperation()
+
+	info, proceed := s.runAuthHandler(h, c)
+	if proceed {
+		c.auth = info
+		h.Handle(c)
+	}
+}
diff --git a/runtimes/go/appruntime/apisdk/api/singleton.go b/runtimes/go/appruntime/apisdk/api/singleton.go
new file mode 100644
index 0000000000..0dceadcaac
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/singleton.go
@@ -0,0 +1,25 @@
+//go:build encore_app
+
+package api
+
+import (
+	"github.com/benbjohnson/clock"
+
+	encore "encore.dev"
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/health"
+	"encore.dev/appruntime/shared/jsonapi"
+	"encore.dev/appruntime/shared/logging"
+	"encore.dev/appruntime/shared/platform"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/testsupport"
+	"encore.dev/metrics"
+	"encore.dev/pubsub"
+)
+
+var Singleton = NewServer(
+	appconf.Static, appconf.Runtime, reqtrack.Singleton, platform.Singleton,
+	encore.Singleton, pubsub.Singleton, logging.RootLogger, metrics.Singleton,
+	health.Singleton, testsupport.Singleton,
+	jsonapi.Default, clock.New(),
+)
diff --git a/runtimes/go/appruntime/apisdk/api/svcauth/doc.go b/runtimes/go/appruntime/apisdk/api/svcauth/doc.go
new file mode 100644
index 0000000000..c82c44baf4
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/svcauth/doc.go
@@ -0,0 +1,4 @@
+// Package svcauth provides various authentication mechanisms for Encore services
+// to use verify the identity of incoming requests from other Encore services within
+// the same application.
+package svcauth
diff --git a/runtimes/go/appruntime/apisdk/api/svcauth/encoreauth.go b/runtimes/go/appruntime/apisdk/api/svcauth/encoreauth.go
new file mode 100644
index 0000000000..b4ceea1f0a
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/svcauth/encoreauth.go
@@ -0,0 +1,164 @@
+package svcauth
+
+import (
+	"fmt"
+	"sort"
+	"time"
+
+	"github.com/benbjohnson/clock"
+	"go.encore.dev/platform-sdk/pkg/auth"
+	"golang.org/x/crypto/sha3"
+
+	"encore.dev/appruntime/apisdk/api/transport"
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/beta/errs"
+)
+
+const ecAuthHashHeader = "Svc-Auth"
+const ecDateHeader = "Date"
+
+// encoreAuth is a ServiceAuth implementation that uses the Encore auth package to sign requests.
+type encoreAuth struct {
+	appSlug   string
+	envName   string
+	keys      []auth.Key
+	latestKey auth.Key
+	clock     clock.Clock
+}
+
+func newEncoreAuth(clock clock.Clock, appSlug string, envName string, keys []config.EncoreAuthKey) ServiceAuth {
+	var keySet []auth.Key
+	var latestKey auth.Key
+	for _, key := range keys {
+		keySet = append(keySet, auth.Key{
+			KeyID: key.KeyID,
+			Data:  key.Data,
+		})
+		if latestKey.KeyID < key.KeyID {
+			latestKey = auth.Key{
+				KeyID: key.KeyID,
+				Data:  key.Data,
+			}
+		}
+	}
+
+	return &encoreAuth{
+		appSlug:   appSlug,
+		envName:   envName,
+		keys:      keySet,
+		latestKey: latestKey,
+		clock:     clock,
+	}
+}
+
+func (ea *encoreAuth) method() string {
+	return "encore-auth"
+}
+
+func (ea *encoreAuth) verify(req transport.Transport) error {
+	headers := &auth.Headers{}
+	if authStr, found := req.ReadMeta(ecAuthHashHeader); !found {
+		return auth.ErrNoAuthorizationHeader
+	} else {
+		headers.Authorization = authStr
+	}
+	if dateStr, found := req.ReadMeta(ecDateHeader); !found {
+		return auth.ErrNoDateHeader
+	} else {
+		headers.Date = dateStr
+	}
+
+	keyID, appSlug, envName, timestamp, opHash, err := headers.SigningComponents()
+	if err != nil {
+		return err
+	}
+
+	// First the timestamp, and don't do any work if it's too old or too new
+	const allowedClockSkew = 2 * time.Minute
+	if diff := ea.clock.Since(timestamp); diff > allowedClockSkew || diff < -allowedClockSkew {
+		return auth.ErrAuthenticationExpired
+	}
+
+	// Find the key
+	var key auth.Key
+	for _, k := range ea.keys {
+		if k.KeyID == keyID {
+			key = k
+			break
+		}
+	}
+	if key.KeyID == 0 {
+		return auth.ErrAuthenticationFailed
+	}
+
+	// Rebuild the signature
+	expectedHeaders := auth.SignForVerification(&key, appSlug, envName, timestamp, opHash)
+
+	// Verify the signature
+	if !expectedHeaders.Equal(headers) {
+		return auth.ErrAuthenticationFailed
+	}
+
+	// Now we're verified the signature - now let's compare the OpHash received
+	// against the OpHash we would have generated for this request.
+	// We do this here to minimize the risk of timing attacks.
+	expectedOpHash, err := ea.buildOpHash(req)
+	if err != nil {
+		return err
+	}
+	if expectedOpHash != opHash {
+		return auth.ErrAuthenticationFailed
+	}
+
+	return nil
+}
+
+func (ea *encoreAuth) sign(req transport.Transport) error {
+	opHash, err := ea.buildOpHash(req)
+	if err != nil {
+		return err
+	}
+
+	headers := auth.Sign(&ea.latestKey, ea.appSlug, ea.envName, ea.clock, opHash)
+
+	req.SetMeta(ecAuthHashHeader, headers.Authorization)
+	req.SetMeta(ecDateHeader, headers.Date)
+	return nil
+}
+
+// buildOpHash builds the operation hash for the request.
+func (ea *encoreAuth) buildOpHash(req transport.Transport) (auth.OperationHash, error) {
+	// Build a deterministic hash of the meta keys and values
+	hash := sha3.New256()
+	for _, key := range req.ListMetaKeys() {
+		switch key {
+		case AuthMethodMetaKey, ecAuthHashHeader, ecDateHeader:
+			// Skip these headers, as they are part of the auth mechanism itself
+
+		case transport.TraceParentKey, transport.TraceStateKey:
+			// Skip these headers, as they are part of the tracing mechanism and could be changed
+			// by things like load balancers
+
+		default:
+			// Read all values for this key, and sort them
+			values, found := req.ReadMetaValues(key)
+			if !found {
+				return "", errs.B().Code(errs.Internal).Msg("failed to read metadata value").Err()
+			}
+			sort.Strings(values)
+
+			for _, value := range values {
+				if _, err := fmt.Fprintf(hash, "%s=%s\n", key, value); err != nil {
+					return "", errs.B().Code(errs.Internal).Cause(err).Msg("failed to write to hash").Err()
+				}
+			}
+		}
+	}
+
+	// Generate the operation hash
+	opHash, err := auth.NewOperationHash("internal-api", "call", auth.BytesPayload(hash.Sum(nil)))
+	if err != nil {
+		return "", errs.B().Code(errs.Internal).Cause(err).Msg("failed to create operation hash for internal API call").Err()
+	}
+	return opHash, nil
+}
diff --git a/runtimes/go/appruntime/apisdk/api/svcauth/noop.go b/runtimes/go/appruntime/apisdk/api/svcauth/noop.go
new file mode 100644
index 0000000000..25800b39ef
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/svcauth/noop.go
@@ -0,0 +1,27 @@
+package svcauth
+
+import (
+	"encore.dev/appruntime/apisdk/api/transport"
+)
+
+// noop is a ServiceAuth implementation that does not perform any authentication.
+//
+// It is intended to be used for local development or where services are running within their own
+// private network and there is no threat model resulting in the need to authenticate requests.
+type noop struct{}
+
+var Noop noop
+
+var _ ServiceAuth = noop{}
+
+func (n noop) method() string {
+	return "noop"
+}
+
+func (n noop) verify(transport.Transport) error {
+	return nil
+}
+
+func (n noop) sign(transport.Transport) error {
+	return nil
+}
diff --git a/runtimes/go/appruntime/apisdk/api/svcauth/pkgfn.go b/runtimes/go/appruntime/apisdk/api/svcauth/pkgfn.go
new file mode 100644
index 0000000000..bdf2d55d1d
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/svcauth/pkgfn.go
@@ -0,0 +1,81 @@
+package svcauth
+
+import (
+	"fmt"
+
+	"github.com/benbjohnson/clock"
+
+	"encore.dev/appruntime/apisdk/api/transport"
+	"encore.dev/appruntime/exported/config"
+)
+
+const (
+	AuthMethodMetaKey = "Svc-Auth-Method"
+)
+
+// Sign signs the request using the given authentication method.
+func Sign(method ServiceAuth, req transport.Transport) error {
+	if err := method.sign(req); err != nil {
+		return fmt.Errorf("failed to sign request: %w", err)
+	}
+	req.SetMeta(AuthMethodMetaKey, method.method())
+
+	return nil
+}
+
+// Verify verifies the authenticity of the request using the given authentication methods.
+func Verify(req transport.Transport, loadedAuthMethods map[string]ServiceAuth) (internalCall bool, err error) {
+	method, found := req.ReadMeta(AuthMethodMetaKey)
+	if !found {
+		// If this is not set, it means that the request is not an internal service to service call.
+		return false, nil
+	}
+
+	for _, authMethod := range loadedAuthMethods {
+		if authMethod.method() == method {
+			if err := authMethod.verify(req); err != nil {
+				return false, fmt.Errorf("failed to verify request: %w", err)
+			}
+			return true, nil
+		}
+	}
+
+	return false, fmt.Errorf("unknown service to service authentication method: %s", method)
+}
+
+// LoadMethods loads the service to service authentication methods from the given config.
+func LoadMethods(clock clock.Clock, cfg *config.Runtime) (inbound, outbound map[string]ServiceAuth, err error) {
+	inbound = make(map[string]ServiceAuth)
+	outbound = make(map[string]ServiceAuth)
+
+	load := func(authCfg config.ServiceAuth) (ServiceAuth, error) {
+		switch authCfg.Method {
+		case "noop":
+			return &noop{}, nil
+		case "encore-auth":
+			return newEncoreAuth(clock, cfg.AppSlug, cfg.EnvName, cfg.AuthKeys), nil
+		default:
+			return nil, fmt.Errorf("unknown service to service authentication method: %s", authCfg.Method)
+		}
+	}
+
+	// Load all the inbound auth methods.
+	for _, authCfg := range cfg.ServiceAuth {
+		inbound[authCfg.Method], err = load(authCfg)
+		if err != nil {
+			return nil, nil, err
+		}
+	}
+
+	// Load all the outbound auth methods.
+	for _, svc := range cfg.ServiceDiscovery {
+		if _, found := outbound[svc.ServiceAuth.Method]; !found {
+			outbound[svc.ServiceAuth.Method], err = load(svc.ServiceAuth)
+			if err != nil {
+				return nil, nil, err
+			}
+		}
+	}
+
+	return inbound, outbound, nil
+}
diff --git a/runtimes/go/appruntime/apisdk/api/svcauth/svcauth.go b/runtimes/go/appruntime/apisdk/api/svcauth/svcauth.go
new file mode 100644
index 0000000000..2aace6212b
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/svcauth/svcauth.go
@@ -0,0 +1,20 @@
+package svcauth
+
+import (
+	"encore.dev/appruntime/apisdk/api/transport"
+)
+
+// ServiceAuth is an interface that provides authentication for internal service to service
+// calls within the same Encore application.
+type ServiceAuth interface {
+	// Method returns the name of the authentication method.
+	method() string
+
+	// Verify verifies the authenticity of the request.
+	// If the request is not authentic, an error is returned.
+	verify(req transport.Transport) error
+
+	// Sign signs the request.
+	// If the request cannot be signed, an error is returned.
+	sign(req transport.Transport) error
+}
diff --git a/runtimes/go/appruntime/apisdk/api/transport/doc.go b/runtimes/go/appruntime/apisdk/api/transport/doc.go
new file mode 100644
index 0000000000..9c83857be9
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/transport/doc.go
@@ -0,0 +1,4 @@
+// Package transport provides an abstraction over the transport layer
+// which allows us to add and read metadata from the transport without
+// having to know the underlying transport implementation.
+package transport
diff --git a/runtimes/go/appruntime/apisdk/api/transport/eh2c.go b/runtimes/go/appruntime/apisdk/api/transport/eh2c.go
new file mode 100644
index 0000000000..fd0065f543
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/transport/eh2c.go
@@ -0,0 +1,37 @@
+package transport
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+	"net/http"
+
+	"golang.org/x/net/http2"
+)
+
+func NewH2CTransport(defaultTransport http.RoundTripper) http.RoundTripper {
+	return &H2CTransport{
+		h2c: &http2.Transport{
+			AllowHTTP: true,
+			DialTLSContext: func(ctx context.Context, network, addr string, _ *tls.Config) (net.Conn, error) {
+				var d net.Dialer
+				return d.DialContext(ctx, network, addr)
+			},
+		},
+		def: defaultTransport,
+	}
+}
+
+type H2CTransport struct {
+	h2c http.RoundTripper
+	def http.RoundTripper
+}
+
+func (h *H2CTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	if request.URL.Scheme == "http" && request.ProtoMajor == 2 {
+		return h.h2c.RoundTrip(request)
+	}
+	return h.def.RoundTrip(request)
+}
+
+var _ http.RoundTripper = (*H2CTransport)(nil)
diff --git a/runtimes/go/appruntime/apisdk/api/transport/http.go b/runtimes/go/appruntime/apisdk/api/transport/http.go
new file mode 100644
index 0000000000..63dbb96fa1
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/transport/http.go
@@ -0,0 +1,82 @@
+package transport
+
+import (
+	"net/http"
+	"sort"
+	"strings"
+)
+
+// HTTPRequest returns a Transport implementation for the given HTTP request.
+func HTTPRequest(req *http.Request) Transport {
+	return &httpHeaders{headers: req.Header}
+}
+
+// HTTPResponse returns a Transport implementation for the given HTTP response.
+func HTTPResponse(resp *http.Response) Transport {
+	return &httpHeaders{headers: resp.Header}
+}
+
+// HTTPResponseWriter returns a Transport implementation for the given HTTP response.
+func HTTPResponseWriter(w http.ResponseWriter) Transport {
+	return &httpHeaders{headers: w.Header()}
+}
+
+// httpHeaders is a Transport implementation for HTTP requests and responses.
+// which gives us a uniform way to add and read the headers from the either
+// a [http.Request] or a [http.ResponseWriter].
+type httpHeaders struct {
+	headers http.Header
+}
+
+var _ Transport = (*httpHeaders)(nil)
+
+func metaKeyToHTTPHeader(key string) string {
+	switch key {
+	case TraceParentKey:
+		return "traceparent"
+	case TraceStateKey:
+		return "tracestate"
+	case CorrelationIDKey:
+		return "X-Correlation-ID"
+	default:
+		return "X-Encore-Meta-" + key
+	}
+}
+
+func (h *httpHeaders) SetMeta(key string, value string) {
+	h.headers.Set(metaKeyToHTTPHeader(key), value)
+}
+
+func (h *httpHeaders) ReadMeta(key string) (value string, found bool) {
+	value = h.headers.Get(metaKeyToHTTPHeader(key))
+	return value, value != ""
+}
+
+func (h *httpHeaders) ReadMetaValues(key string) (values []string, found bool) {
+	values = h.headers.Values(metaKeyToHTTPHeader(key))
+	return values, len(values) > 0
+}
+
+func (h *httpHeaders) ListMetaKeys() []string {
+	rtn := make([]string, 0, len(h.headers))
+
+	// List all keys
+	for key := range h.headers {
+		key := http.CanonicalHeaderKey(key)
+
+		switch {
+		case key == "Traceparent":
+			rtn = append(rtn, TraceParentKey)
+		case key == "Tracestate":
+			rtn = append(rtn, TraceStateKey)
+		case key == "X-Correlation-Id":
+			rtn = append(rtn, CorrelationIDKey)
+		case strings.HasPrefix(key, "X-Encore-Meta-"):
+			rtn = append(rtn, key[14:])
+		}
+	}
+
+	sort.Strings(rtn)
+
+	return rtn
+}
diff --git a/runtimes/go/appruntime/apisdk/api/transport/meta.go b/runtimes/go/appruntime/apisdk/api/transport/meta.go
new file mode 100644
index 0000000000..abdeef215c
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/transport/meta.go
@@ -0,0 +1,11 @@
+package transport
+
+// These are predefined keys for metadata that we use in Encore.
+//
+// which allow each transport method know about them and handle them
+// in a transport specific way if needed (including renaming them)
+const (
+	TraceParentKey   = "Traceparent"
+	TraceStateKey    = "Tracestate"
+	CorrelationIDKey = "Correlation-ID"
+)
diff --git a/runtimes/go/appruntime/apisdk/api/transport/transport.go b/runtimes/go/appruntime/apisdk/api/transport/transport.go
new file mode 100644
index 0000000000..e7c4c3e732
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/transport/transport.go
@@ -0,0 +1,25 @@
+package transport
+
+// Transport is the interface for the transport layer which allows us to add
+// and read metadata from the transport without having to know the underlying
+// transport implementation.
+type Transport interface {
+	// SetMeta sets a key-value pair to the metadata of the transport.
+	SetMeta(key string, value string)
+
+	// ReadMeta reads a metadata key off the transport.
+	// If there are multiple values for the key, the first value is returned.
+	ReadMeta(key string) (value string, found bool)
+
+	// ReadMetaValues reads all values for a metadata key off the transport.
+	ReadMetaValues(key string) (values []string, found bool)
+
+	// ListMetaKeys lists all metadata keys on the transport.
+	//
+	// The keys returned will be ordered alphabetically and will
+	// not contain duplicates (i.e. if a key is set multiple times).
+	//
+	// Keys will be normalized, such that they look the same on
+	// both send and receive sides.
+	ListMetaKeys() []string
+}
diff --git a/runtimes/go/appruntime/apisdk/api/util.go b/runtimes/go/appruntime/apisdk/api/util.go
new file mode 100644
index 0000000000..d5e278332b
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/api/util.go
@@ -0,0 +1,30 @@
+package api
+
+import (
+	"strconv"
+
+	"encore.dev/beta/errs"
+)
+
+func clampTo64Chars(str string) string {
+	if len(str) > 64 {
+		return str[:64]
+	}
+	return str
+}
+
+func Code(err error, httpStatus int) string {
+	if err != nil {
+		e := errs.Convert(err).(*errs.Error)
+		return e.Code.String()
+	}
+
+	if httpStatus == 0 {
+		return errs.OK.String()
+	}
+
+	if code := errs.HTTPStatusToCode(httpStatus); code != errs.Unknown {
+		return code.String()
+	}
+	return "http_" + strconv.Itoa(httpStatus)
+}
diff --git a/runtimes/go/appruntime/apisdk/app/app.go b/runtimes/go/appruntime/apisdk/app/app.go
new file mode 100644
index 0000000000..ea58fc8ae8
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/app/app.go
@@ -0,0 +1,116 @@
+package app
+
+import (
+	"github.com/rs/zerolog"
+	"go.uber.org/automaxprocs/maxprocs"
+
+	"encore.dev/appruntime/apisdk/api"
+	"encore.dev/appruntime/apisdk/service"
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/shutdown"
+
+	// Initialize the metric subsystem
+	_ "encore.dev/appruntime/infrasdk/metrics"
+)
+
+type App struct {
+	runtime  *config.Runtime
+	service  *service.Manager
+	api      *api.Server
+	shutdown *shutdown.Tracker
+	logger   zerolog.Logger
+}
+
+func New(runtime *config.Runtime, service *service.Manager, api *api.Server, shutdown *shutdown.Tracker, logger zerolog.Logger) *App {
+	app := &App{
+		runtime:  runtime,
+		service:  service,
+		api:      api,
+		shutdown: shutdown,
+		logger:   logger,
+	}
+
+	return app
+}
+
+func (app *App) Run() error {
+	if app.runtime.EnvCloud != "local" {
+		// Set the maximum number of processes to use based on the enviroment we're running inside
+		// and what we can detect. Note this is required because the default value of GOMAXPROCS is
+		// the number of logical CPUs on the machine, which inside a kubernetes environment is not
+		// the same as the number of CPUs allocated to the container. This can lead to CPU throttling
+		// by the kernel and high tail latencies.
+		//
+		// We only do this when the app starts up, rather than using the automaxprocs magic import
+		// so it does not impact anything else which imports the Encore runtime (such as the CLI tooling).
+		undoMaxProcs, err := maxprocs.Set(maxprocs.Logger(func(s string, args ...interface{}) {
+			app.logger.Debug().Msgf(s, args...)
+		}))
+		if err != nil {
+			app.logger.Err(err).Msg("failed to set GOMAXPROCS")
+		} else {
+			defer undoMaxProcs()
+		}
+	}
+
+	ln, err := Listen()
+	if err != nil {
+		return err
+	}
+	defer func() { _ = ln.Close() }()
+
+	app.Start()
+
+	// Begin serving requests.
+	serveCh := make(chan error, 1)
+	go func() {
+		serveCh <- app.api.Serve(ln)
+	}()
+
+	if err := app.service.InitializeServices(); err != nil {
+		app.shutdown.Shutdown(nil, err)
+		return err
+	}
+
+	// Wait for the Serve to return before triggering shutdown.
+	serveErr := <-serveCh
+
+	isGraceful := app.shutdown.ShutdownInitiated()
+	app.shutdown.Shutdown(nil, serveErr)
+
+	// If Serve returned due to graceful shutdown, ignore the error from serve.
+	if isGraceful {
+		serveErr = nil
+	}
+	return serveErr
+}
+
+func (app *App) Start() {
+	app.logStartupInfo()
+	app.shutdown.RegisterShutdownHandler(app.api.Shutdown)
+}
+
+func (app *App) logStartupInfo() {
+	switch {
+	case app.runtime.EnvType == "test":
+		// Don't log during tests.
+	case app.runtime.EnvCloud == "local" && len(app.runtime.Gateways) == 0:
+		// The gateway will log this for us
+	default:
+		// If we have a lot of handlers, don't log each one being registered.
+		handlers := app.api.RegisteredHandlers()
+		logEachRegistration := len(handlers) < 8 // chosen by a fair dice roll
+
+		if logEachRegistration {
+			for _, h := range handlers {
+				app.logger.Info().
+					Str("service", h.ServiceName()).
+					Str("endpoint", h.EndpointName()).
+					Str("path", h.SemanticPath()).
+					Msg("registered API endpoint")
+			}
+		} else {
+			app.logger.Info().Msgf("registered %d API endpoints", len(handlers))
+		}
+	}
+}
diff --git a/runtimes/go/appruntime/apisdk/app/appinit/appinit.go b/runtimes/go/appruntime/apisdk/app/appinit/appinit.go
new file mode 100644
index 0000000000..08d14b0d08
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/app/appinit/appinit.go
@@ -0,0 +1,22 @@
+//go:build encore_app
+
+package appinit
+
+import (
+	"io"
+
+	"encore.dev/appruntime/apisdk/api"
+	"encore.dev/appruntime/apisdk/app"
+	"encore.dev/appruntime/apisdk/service"
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/logging"
+	"encore.dev/appruntime/shared/shutdown"
+)
+
+// AppMain is the entrypoint to the Encore Application.
+func AppMain() {
+	inst := app.New(appconf.Runtime, service.Singleton, api.Singleton, shutdown.Singleton, logging.RootLogger)
+	if err := inst.Run(); err != nil && err != io.EOF {
+		logging.RootLogger.Fatal().Err(err).Msg("could not run")
+	}
+}
diff --git a/runtimes/go/appruntime/apisdk/app/setup.go b/runtimes/go/appruntime/apisdk/app/setup.go
new file mode 100644
index 0000000000..c0ee0182e5
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/app/setup.go
@@ -0,0 +1,27 @@
+package app
+
+import (
+	"net"
+	"net/netip"
+	"os"
+	"strconv"
+
+	"encore.dev/appruntime/shared/encoreenv"
+)
+
+func Listen() (net.Listener, error) {
+	listenAddr := encoreenv.Get("ENCORE_LISTEN_ADDR")
+	if listenAddr != "" {
+		addrPort, err := netip.ParseAddrPort(listenAddr)
+		if err != nil {
+			return nil, err
+		}
+		return net.Listen("tcp", addrPort.String())
+	}
+
+	port, _ := strconv.Atoi(os.Getenv("PORT"))
+	if port == 0 {
+		port = 8080
+	}
+	return net.Listen("tcp", ":"+strconv.Itoa(port))
+}
diff --git a/runtimes/go/appruntime/apisdk/cors/cors.go b/runtimes/go/appruntime/apisdk/cors/cors.go
new file mode 100644
index 0000000000..aba8c97177
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/cors/cors.go
@@ -0,0 +1,189 @@
+package cors
+
+import (
+	"net/http"
+	"net/url"
+	"path/filepath"
+	"slices"
+	"sort"
+	"strings"
+
+	"github.com/rs/cors"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+)
+
+func Wrap(cfg *config.CORS, staticAllowedHeaders, staticExposedHeaders []string, handler http.Handler, logger zerolog.Logger) http.Handler {
+	c := cors.New(Options(cfg, staticAllowedHeaders, staticExposedHeaders))
+	if cfg.Debug {
+		logger := logger.With().Str("subsystem", "cors").Logger()
+		logger.Debug().Msg("CORS system running in debug mode. All requests will be logged.")
+		c.Log = &logger
+	}
+	return c.Handler(handler)
+}
+
+func Options(cfg *config.CORS, staticAllowedHeaders, staticExposedHeaders []string) cors.Options {
+	// Sort origins to allow for binary search
+	originsCreds := sortedSliceCopy(cfg.AllowOriginsWithCredentials)
+	originsWithoutCreds := sortedSliceCopy(cfg.AllowOriginsWithoutCredentials)
+	globCreds := getGlobOrigins(cfg.AllowOriginsWithCredentials)
+	globWithoutCreds := getGlobOrigins(cfg.AllowOriginsWithoutCredentials)
+
+	// Determine if we have a wildcard origins
+	hasWildcardOriginWithoutCreds := cfg.AllowOriginsWithoutCredentials == nil || sortedSliceContains(originsWithoutCreds, "*")
+	hasUnsafeWildcardOriginWithCreds := sortedSliceContains(originsCreds, config.UnsafeAllOriginWithCredentials)
+
+	// allowedHeaders are the headers allowed through CORS.
+	allowedHeaders := []string{
+		"Authorization",
+		"Content-Type",
+		"User-Agent",
+		"X-Request-ID",
+		"X-Correlation-ID",
+	}
+	allowedHeaders = append(allowedHeaders, cfg.ExtraAllowedHeaders...)
+	allowedHeaders = append(allowedHeaders, staticAllowedHeaders...)
+
+	exposedHeaders := []string{
+		"X-Request-ID",
+		"X-Correlation-ID",
+		"X-Encore-Trace-ID",
+	}
+	exposedHeaders = append(exposedHeaders, cfg.ExtraExposedHeaders...)
+	exposedHeaders = append(exposedHeaders, staticExposedHeaders...)
+
+	// Sort the slices so the output looks nicer.
+	sort.Strings(allowedHeaders)
+	sort.Strings(exposedHeaders)
+
+	return cors.Options{
+		Debug:               cfg.Debug,
+		AllowCredentials:    !cfg.DisableCredentials,
+		AllowedMethods:      []string{"GET", "POST", "PUT", "PATCH", "HEAD", "DELETE", "OPTIONS", "TRACE", "CONNECT"},
+		AllowedHeaders:      allowedHeaders,
+		ExposedHeaders:      exposedHeaders,
+		AllowPrivateNetwork: cfg.AllowPrivateNetworkAccess,
+		AllowOriginRequestFunc: func(r *http.Request, origin string) bool {
+			// If the request has credentials, look up origins in AllowOriginsWithCredentials.
+			// Credentials are cookies, authorization headers, or TLS client certificates.
+			hasCreds := func(r *http.Request) bool {
+				if len(r.Cookies()) > 0 || len(r.Header.Values("Authorization")) > 0 || (r.TLS != nil && len(r.TLS.PeerCertificates) > 0) {
+					return true
+				}
+
+				if r.Method == http.MethodOptions {
+					return slices.ContainsFunc(
+						r.Header.Values("Access-Control-Request-Headers"),
+						func(val string) bool {
+							return slices.ContainsFunc(
+								strings.Split(val, ","),
+								func(val string) bool {
+									val = strings.TrimSpace(val)
+									return val == "authorization" || val == "cookie"
+								},
+							)
+						},
+					)
+				}
+
+				return false
+			}
+			if hasCreds(r) {
+				ok := hasUnsafeWildcardOriginWithCreds || sortedSliceContains(originsCreds, origin)
+				if !ok {
+					// Not an exact match. Check any glob origins.
+					ok = globCreds.Matches(origin)
+				}
+				return ok
+			}
+			// Post-condition: request is without credentials
+
+			ok := hasWildcardOriginWithoutCreds || sortedSliceContains(originsWithoutCreds, origin)
+			if !ok {
+				// Not an exact match. Check any glob origins.
+				ok = globWithoutCreds.Matches(origin)
+			}
+			return ok
+		},
+	}
+}
+
+func sortedSliceContains(haystack []string, needle string) bool {
+	idx := sort.SearchStrings(haystack, needle)
+	return idx < len(haystack) && haystack[idx] == needle
+}
+
+func sortedSliceCopy(src []string) []string {
+	if src == nil {
+		return nil
+	}
+
+	dst := make([]string, len(src))
+	copy(dst, src)
+	sort.Strings(dst)
+	return dst
+}
+
+type globOriginSet []*url.URL
+
+func (s globOriginSet) Matches(origin string) bool {
+	if u, err := url.Parse(origin); err == nil {
+		for _, allow := range s {
+			if globMatch(allow, u) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func globMatch(pattern, origin *url.URL) bool {
+	// For it to be a match, the schemes, hostname and port must all match.
+	if pattern.Scheme != origin.Scheme {
+		return false
+	}
+
+	// Make sure the port matches. If there is no port, the port is
+	// the standard port for the scheme. See https://developer.mozilla.org/en-US/docs/Glossary/Origin.
+	normalizedPort := func(u *url.URL) string {
+		if u.Port() == "" {
+			switch u.Scheme {
+			case "http":
+				return "80"
+			case "https":
+				return "443"
+			default:
+				return ""
+			}
+		}
+		return u.Port()
+	}
+	if normalizedPort(pattern) != normalizedPort(origin) {
+		return false
+	}
+
+	// Make sure the hostname matches. Since we are only checking the hostname,
+	// it's fine to use filepath.Match
+	matched, err := filepath.Match(pattern.Hostname(), origin.Hostname())
+	return matched && err == nil
+}
+
+func getGlobOrigins(origins []string) globOriginSet {
+	var globs []*url.URL
+	for _, o := range origins {
+		if o == "*" {
+			// The literal "*" string means something else and is not
+			// covered by the glob-matching support.
+			continue
+		}
+
+		if o != "*" && strings.Contains(o, "*") {
+			if u, err := url.Parse(o); err == nil {
+				globs = append(globs, u)
+			}
+		}
+	}
+	return globs
+}
diff --git a/runtimes/go/appruntime/apisdk/cors/cors_test.go b/runtimes/go/appruntime/apisdk/cors/cors_test.go
new file mode 100644
index 0000000000..4f3ba583a6
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/cors/cors_test.go
@@ -0,0 +1,210 @@
+package cors
+
+import (
+	"log"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+	_ "unsafe"
+
+	"github.com/rs/cors"
+
+	"encore.dev/appruntime/exported/config"
+)
+
+func TestOptions(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name               string
+		cfg                config.CORS
+		credsGoodOrigins   []string
+		credsBadOrigins    []string
+		nocredsGoodOrigins []string
+		nocredsBadOrigins  []string
+		goodHeaders        []string
+		badHeaders         []string
+	}{
+		{
+			name:               "empty",
+			cfg:                config.CORS{},
+			credsGoodOrigins:   []string{},
+			credsBadOrigins:    []string{"foo.com", "evil.com", "localhost"},
+			nocredsGoodOrigins: []string{"foo.com", "localhost", "", "icanhazcheezburger.com"},
+			nocredsBadOrigins:  []string{},
+			goodHeaders:        []string{"Content-Type", "Origin"},
+			badHeaders:         []string{"X-Requested-With", "X-Forwarded-For"},
+		},
+		{
+			name: "allowed_creds",
+			cfg: config.CORS{
+				AllowOriginsWithCredentials: []string{"localhost", "ok.org"},
+			},
+			credsGoodOrigins:   []string{"localhost", "ok.org"},
+			credsBadOrigins:    []string{"foo.com", "evil.com"},
+			nocredsGoodOrigins: []string{"foo.com", "localhost", "", "icanhazcheezburger.com", "ok.org"},
+			nocredsBadOrigins:  []string{},
+		},
+		{
+			name: "allowed_glob_creds",
+			cfg: config.CORS{
+				AllowOriginsWithCredentials: []string{"https://*.example.com", "wss://ok1-*.example.com", "https://*-ok2.example.com"},
+			},
+			credsGoodOrigins: []string{"https://foo.example.com", "wss://ok1-foo.example.com", "https://foo-ok2.example.com"},
+			credsBadOrigins: []string{
+				"http://foo.example.com",   // Wrong scheme
+				"htts://.example.com",      // No subdomain
+				"ws://ok1-foo.example.com", // Wrong scheme
+				".example.com",             // No scheme
+				"https://evil.com",         // bad domain
+			},
+			nocredsGoodOrigins: []string{},
+			nocredsBadOrigins:  []string{},
+		},
+		{
+			name: "allowed_nocreds",
+			cfg: config.CORS{
+				AllowOriginsWithoutCredentials: []string{"localhost", "ok.org"},
+			},
+			credsGoodOrigins:   []string{},
+			credsBadOrigins:    []string{"localhost", "ok.org", "foo.com", "evil.com"},
+			nocredsGoodOrigins: []string{"localhost", "ok.org"},
+			nocredsBadOrigins:  []string{"foo.com", "", "icanhazcheezburger.com"},
+		},
+		{
+			name: "allowed_disjoint_sets",
+			cfg: config.CORS{
+				AllowOriginsWithCredentials:    []string{"foo.com"},
+				AllowOriginsWithoutCredentials: []string{"bar.org"},
+			},
+			credsGoodOrigins:   []string{"foo.com"},
+			credsBadOrigins:    []string{"bar.org", "", "localhost"},
+			nocredsGoodOrigins: []string{"bar.org"},
+			nocredsBadOrigins:  []string{"foo.com", "", "localhost"},
+		},
+		{
+			name: "allowed_wildcard_without_creds",
+			cfg: config.CORS{
+				AllowOriginsWithoutCredentials: []string{"*"},
+			},
+			credsGoodOrigins:   []string{},
+			credsBadOrigins:    []string{"bar.org", "", "localhost"},
+			nocredsGoodOrigins: []string{"bar.org", "bar.com", "", "localhost"},
+		},
+		{
+			name: "allowed_unsafe_wildcard_with_creds",
+			cfg: config.CORS{
+				AllowOriginsWithCredentials: []string{config.UnsafeAllOriginWithCredentials},
+			},
+			credsGoodOrigins: []string{"bar.org", "bar.com", "", "localhost", "unsafe.evil.com"},
+		},
+		{
+			name: "extra_headers",
+			cfg: config.CORS{
+				ExtraAllowedHeaders: []string{"Not-Authorization", "X-Forwarded-For", "X-Real-Ip"},
+			},
+			goodHeaders: []string{"Not-Authorization", "Content-Type", "Origin", "X-Forwarded-For", "X-Real-Ip"},
+			badHeaders:  []string{"X-Requested-With", "X-Evil-Header", "Authorization"},
+		},
+		{
+			name: "extra_headers_wildcard",
+			cfg: config.CORS{
+				ExtraAllowedHeaders: []string{"X-Forwarded-For", "*", "X-Real-Ip"},
+			},
+			goodHeaders: []string{"Not-Authorization", "Content-Type", "Origin", "X-Forwarded-For", "X-Real-Ip", "X-Requested-With", "X-Evil-Header"},
+			badHeaders:  []string{"Authorization"},
+		},
+		{
+			name:        "static_headers",
+			cfg:         config.CORS{},
+			goodHeaders: []string{"Content-Type", "Origin", "X-Static-Test"},
+		},
+		{
+			name: "wildcard_without_creds",
+			cfg: config.CORS{
+				AllowOriginsWithCredentials:    []string{"https://vercel.app"},
+				AllowOriginsWithoutCredentials: []string{"https://*-foo.vercel.app"},
+			},
+			credsBadOrigins:    []string{"https://blah-foo.vercel.app"},
+			nocredsGoodOrigins: []string{"https://blah-foo.vercel.app"},
+		},
+	}
+
+	checkOrigins := func(t *testing.T, c *cors.Cors, creds, good bool, origins []string) {
+		for _, o := range origins {
+			h := make(http.Header)
+			h.Set("Origin", o)
+			if creds {
+				h.Set("Access-Control-Request-Headers", "authorization")
+			}
+			allowed := c.OriginAllowed(&http.Request{Header: h, Method: "OPTIONS"})
+			if allowed != good {
+				t.Fatalf("origin=%s creds=%v: got allowed=%v, want %v", o, creds, allowed, good)
+			} else {
+				t.Logf("origin=%s creds=%v: ok allowed=%v", o, creds, allowed)
+			}
+		}
+	}
+
+	checkHeaders := func(t *testing.T, c *cors.Cors, allowedHeaders []string, wantOK bool) {
+		req := httptest.NewRequest("OPTIONS", "/", nil)
+		req.Header.Set("Origin", "https://example.org")
+		req.Header.Set("Access-Control-Request-Method", "GET")
+		req.Header.Set("Access-Control-Request-Headers", strings.ToLower(strings.Join(allowedHeaders, ",")))
+		w := httptest.NewRecorder()
+		c.ServeHTTP(w, req, nil)
+
+		if w.Code != http.StatusNoContent {
+			t.Fatalf("got OPTIONS response code %d, want 204", w.Code)
+		}
+
+		// Check allowed headers.
+		{
+			rawAllowedHeaders := w.Header().Get("Access-Control-Allow-Headers")
+			allowHeaders := strings.Split(rawAllowedHeaders, ", ")
+			allowed := make(map[string]bool)
+			for _, val := range allowHeaders {
+				allowed[strings.TrimSpace(val)] = true
+			}
+
+			if wantOK {
+				for _, val := range allowedHeaders {
+					if !allowed[val] {
+						t.Fatalf("want header %q to be allowed, got false; resp header=%q", val, rawAllowedHeaders)
+					}
+				}
+			} else {
+				if rawAllowedHeaders != "" {
+					t.Fatalf("want headers not to be allowed, got %q", rawAllowedHeaders)
+				}
+			}
+		}
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			got := Options(&tt.cfg, []string{"X-Static-Test"}, []string{"X-Exposed-Test"})
+			got.Debug = true
+			c := cors.New(got)
+			c.Log = log.New(os.Stdout, "cors: ", 0)
+
+			checkOrigins(t, c, true, true, tt.credsGoodOrigins)
+			checkOrigins(t, c, true, false, tt.credsBadOrigins)
+			checkOrigins(t, c, false, true, tt.nocredsGoodOrigins)
+			checkOrigins(t, c, false, false, tt.nocredsBadOrigins)
+
+			// Only good headers should always be ok
+			checkHeaders(t, c, tt.goodHeaders, true)
+
+			// Make sure all the bad headers are invalid, one by one
+			for _, vad := range tt.badHeaders {
+				headers := append(tt.goodHeaders, vad)
+				checkHeaders(t, c, headers, false)
+			}
+		})
+	}
+}
diff --git a/runtimes/go/appruntime/apisdk/service/service.go b/runtimes/go/appruntime/apisdk/service/service.go
new file mode 100644
index 0000000000..629788240c
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/service/service.go
@@ -0,0 +1,265 @@
+package service
+
+import (
+	"context"
+	"fmt"
+	"sort"
+	"strings"
+	"sync"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/appruntime/shared/cfgutil"
+	"encore.dev/appruntime/shared/health"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/appruntime/shared/syncutil"
+	"encore.dev/appruntime/shared/testsupport"
+	"encore.dev/beta/errs"
+	eshutdown "encore.dev/shutdown"
+)
+
+// Initializer is a service initializer.
+type Initializer interface {
+	// ServiceName reports the name of the service.
+	ServiceName() string
+
+	// InitService initializes the service.
+	InitService() error
+
+	// GetDecl returns the service declaration,
+	// initializing it if necessary.
+	GetDecl() (any, error)
+}
+
+type Decl[T any] struct {
+	Service string
+	Name    string
+
+	// Setup sets up the service instance.
+	// If nil, the service is initialized with new(T).
+	Setup func() (*T, error)
+
+	// SetupDefLoc is the location of the Setup function.
+	// It is 0 if Setup is nil.
+	SetupDefLoc uint32
+
+	holder InstanceHolder[T]
+}
+
+type InstanceHolder[T any] struct {
+	setupOnce syncutil.Once
+	instance  *T
+}
+
+func (g *Decl[T]) ServiceName() string {
+	return g.Service
+}
+
+func doSetupService[T any](mgr *Manager, decl *Decl[T], holder *InstanceHolder[T]) (err error) {
+	curr := mgr.rt.Current()
+	if curr.Trace != nil && curr.Req != nil && decl.SetupDefLoc != 0 {
+		eventParams := trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  decl.SetupDefLoc,
+		}
+		startID := curr.Trace.ServiceInitStart(trace2.ServiceInitStartParams{
+			EventParams: eventParams,
+			Service:     decl.Service,
+		})
+		defer curr.Trace.ServiceInitEnd(eventParams, startID, err)
+	}
+
+	setupFn := decl.Setup
+	if setupFn == nil {
+		setupFn = func() (*T, error) { return new(T), nil }
+	}
+
+	instance, err := setupFn()
+	if err != nil {
+		mgr.rt.Logger().Error().Err(err).Str("service", decl.Service).Msg("service initialization failed")
+		return errs.B().Code(errs.Internal).Msgf("service %s: initialization failed", decl.Service).Err()
+	}
+	holder.instance = instance
+
+	// If the API Decl supports graceful shutdown, register that with the server.
+	if gs, ok := any(instance).(shutdowner); ok {
+		mgr.registerShutdownHandler(serviceShutdown{decl.Service, gs})
+	} else if legacy, ok := any(instance).(legacyShutdowner); ok {
+		adapter := legacyShutdownAdapter{legacy}
+		mgr.registerShutdownHandler(serviceShutdown{decl.Service, adapter})
+	}
+	return nil
+}
+
+// shutdowner is the interface for service structs that
+// support graceful shutdown.
+type shutdowner interface {
+	Shutdown(p eshutdown.Progress) error
+}
+
+// legacyShutdowner is the old-style interface for service structs that
+// support graceful shutdown.
+type legacyShutdowner interface {
+	Shutdown(force context.Context)
+}
+
+type legacyShutdownAdapter struct {
+	s legacyShutdowner
+}
+
+func (a legacyShutdownAdapter) Shutdown(p eshutdown.Progress) error {
+	a.s.Shutdown(p.ForceShutdown)
+	return nil
+}
+
+type serviceShutdown struct {
+	name     string
+	instance shutdowner
+}
+
+func NewManager(static *config.Static, runtime *config.Runtime, rt *reqtrack.RequestTracker, healthChecks *health.CheckRegistry, rootLogger zerolog.Logger, testMgr *testsupport.Manager) *Manager {
+	mgr := &Manager{static: static, rt: rt, runtime: runtime, rootLogger: rootLogger, testMgr: testMgr, svcMap: make(map[string]Initializer), initialisedServices: make(map[string]struct{})}
+
+	// Register with the health check service.
+	healthChecks.Register(mgr)
+
+	return mgr
+}
+
+type Manager struct {
+	static     *config.Static
+	runtime    *config.Runtime
+	rt         *reqtrack.RequestTracker
+	rootLogger zerolog.Logger
+	testMgr    *testsupport.Manager
+	svcInit    []Initializer
+	svcMap     map[string]Initializer
+
+	initialisedMu       sync.RWMutex
+	initialisedServices map[string]struct{}
+
+	shutdownMu       sync.Mutex
+	shutdownHandlers []serviceShutdown
+}
+
+func (mgr *Manager) RegisterService(i Initializer) {
+	name := i.ServiceName()
+	if !cfgutil.IsHostedService(mgr.runtime, name) {
+		return
+	}
+
+	if _, ok := mgr.svcMap[name]; ok {
+		panic(fmt.Sprintf("service %s: already registered", name))
+	}
+	mgr.svcMap[name] = i
+	mgr.svcInit = append(mgr.svcInit, i)
+}
+
+func (mgr *Manager) InitializeServices() error {
+	num := len(mgr.svcInit)
+	results := make(chan error, num)
+
+	for _, svc := range mgr.svcInit {
+		svc := svc
+		go func() {
+			err := svc.InitService()
+			if err == nil {
+				mgr.initialisedMu.Lock()
+				defer mgr.initialisedMu.Unlock()
+				mgr.initialisedServices[svc.ServiceName()] = struct{}{}
+			}
+			results <- err
+		}()
+	}
+
+	for i := 0; i < num; i++ {
+		if err := <-results; err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+// HealthCheck returns a failure if any services have not yet been initialized.
+//
+// This allows the health check service to report that the server is not yet
+// ready to serve requests.
+func (mgr *Manager) HealthCheck(ctx context.Context) []health.CheckResult {
+	mgr.initialisedMu.RLock()
+	defer mgr.initialisedMu.RUnlock()
+
+	// If all services have been initialized, return a single check result.
+	if len(mgr.initialisedServices) == len(mgr.svcMap) {
+		return []health.CheckResult{{Name: "services.initialized"}}
+	}
+
+	// Build a list of services that have not been initialized.
+	uninitializedServices := make([]string, 0, len(mgr.svcMap)-len(mgr.initialisedServices))
+	for svc := range mgr.svcMap {
+		if _, ok := mgr.initialisedServices[svc]; !ok {
+			uninitializedServices = append(uninitializedServices, svc)
+		}
+	}
+	sort.Strings(uninitializedServices)
+
+	// Return an error listing the names of each service not yet initialized.
+	return []health.CheckResult{{
+		Name: "services.initialized",
+		Err:  fmt.Errorf("the following services have not returned from their initService functions: %s", strings.Join(uninitializedServices, ", ")),
+	}}
+}
+
+func (mgr *Manager) GetService(name string) (i Initializer, ok bool) {
+	i, ok = mgr.svcMap[name]
+	return i, ok
+}
+
+func (mgr *Manager) Shutdown(p *shutdown.Process) (err error) {
+	defer p.MarkServicesShutdownCompleted(err)
+	doLog := true
+
+	mgr.shutdownMu.Lock()
+	handlers := mgr.shutdownHandlers
+	mgr.shutdownMu.Unlock()
+
+	progress := p.Progress()
+
+	var wg sync.WaitGroup
+	wg.Add(len(handlers))
+	for _, h := range handlers {
+		h := h
+		go func() {
+			defer wg.Done()
+
+			if doLog {
+				mgr.rootLogger.Trace().Str("service", h.name).Msg("shutting down service...")
+				defer func() {
+					if r := recover(); r != nil {
+						mgr.rootLogger.Error().Str("service", h.name).Interface("panic", r).Msg("service shutdown panicked")
+					} else if mgr.runtime.EnvCloud != "local" {
+						mgr.rootLogger.Trace().Str("service", h.name).Msg("service shutdown complete")
+					}
+				}()
+			}
+
+			if err := h.instance.Shutdown(progress); err != nil {
+				mgr.rootLogger.Error().Err(err).Str("service", h.name).Msg("service reported unclean shutdown")
+			}
+		}()
+	}
+
+	wg.Wait()
+	return nil
+}
+
+func (mgr *Manager) registerShutdownHandler(h serviceShutdown) {
+	mgr.shutdownMu.Lock()
+	defer mgr.shutdownMu.Unlock()
+	mgr.shutdownHandlers = append(mgr.shutdownHandlers, h)
+}
diff --git a/runtimes/go/appruntime/apisdk/service/singleton.go b/runtimes/go/appruntime/apisdk/service/singleton.go
new file mode 100644
index 0000000000..bf42a9d675
--- /dev/null
+++ b/runtimes/go/appruntime/apisdk/service/singleton.go
@@ -0,0 +1,106 @@
+//go:build encore_app
+
+package service
+
+import (
+	"fmt"
+
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/health"
+	"encore.dev/appruntime/shared/logging"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/appruntime/shared/testsupport"
+)
+
+var Singleton *Manager
+
+func init() {
+	Singleton = NewManager(appconf.Static, appconf.Runtime, reqtrack.Singleton, health.Singleton, logging.RootLogger, testsupport.Singleton)
+	shutdown.Singleton.RegisterShutdownHandler(Singleton.Shutdown)
+}
+
+func Register(i Initializer) {
+	Singleton.RegisterService(i)
+}
+
+// Get returns the API Decl, initializing it if necessary.
+func (g *Decl[T]) Get() (*T, error) {
+	if Singleton.static.Testing {
+		// Do we have a mock registered?
+		if mock, ok := Singleton.testMgr.GetServiceMock(g.Service); ok {
+			return mock.Service.(*T), nil
+		}
+
+		if Singleton.testMgr.GetIsolatedServices() {
+			testData := Singleton.rt.Current().Req.Test
+
+			// Get the instance holder while under lock, but then
+			// unlock the mutex before calling doSetupService - as if the service
+			// init calls another service which we need to initialize, we would
+			// otherwise deadlock.
+			testData.ServiceInstancesMu.Lock()
+			holderAny, ok := testData.ServiceInstances[g.Service]
+			if !ok {
+				holderAny = &InstanceHolder[T]{}
+				testData.ServiceInstances[g.Service] = holderAny
+			}
+			testData.ServiceInstancesMu.Unlock()
+
+			// This is a bit of a hack, but we need to cast the holder to the
+			// correct type as the TestData struct is in our model package, which
+			// we don't want to introduce complex types to
+			holder, ok := holderAny.(*InstanceHolder[T])
+			if !ok {
+				var zero *InstanceHolder[T]
+				return nil, fmt.Errorf("failed to cast service instance holder to correct type for service %s. Found %T expected %T", g.Name, holderAny, zero)
+			}
+			err := holder.setupOnce.Do(func() error {
+				return doSetupService(Singleton, g, holder)
+			})
+			if err != nil {
+				return nil, err
+			}
+
+			return holder.instance, nil
+		}
+	}
+
+	err := g.InitService()
+	return g.holder.instance, err
+}
+
+// GetDecl returns the API Decl, initializing it if necessary.
+func (g *Decl[T]) GetDecl() (any, error) {
+	return g.Get()
+}
+
+func (g *Decl[T]) InitService() error {
+	return g.holder.setupOnce.Do(func() error {
+		return doSetupService(Singleton, g, &g.holder)
+	})
+}
+
+// Get returns the service initializer with the given name.
+// The declaration is cast to the given type T.
+func Get[T any](name string) (T, error) {
+	svc, ok := Singleton.GetService(name)
+	if !ok {
+		var zero T
+		return zero, fmt.Errorf("service.Get(%q): unknown service", name)
+	}
+
+	decl, err := svc.GetDecl()
+	if err != nil {
+		var zero T
+		return zero, err
+	}
+
+	s, ok := decl.(T)
+	if !ok {
+		var zero T
+		return zero, fmt.Errorf("service.Get(%q): service is of type %T, not %T", name, decl, zero)
+	}
+
+	return s, nil
+}
diff --git a/runtimes/go/appruntime/doc.go b/runtimes/go/appruntime/doc.go
new file mode 100644
index 0000000000..deee6aabed
--- /dev/null
+++ b/runtimes/go/appruntime/doc.go
@@ -0,0 +1,6 @@
+// Package appruntime provides internal functionality for use by
+// Encore to run Encore applications. Packages within this directory
+// are intended exclusively for use by the Encore compiler and should
+// not be called directly from Encore applications. The APIs can change
+// at any time.
+package appruntime
diff --git a/runtimes/go/appruntime/exported/config/config.go b/runtimes/go/appruntime/exported/config/config.go
new file mode 100644
index 0000000000..c427eea338
--- /dev/null
+++ b/runtimes/go/appruntime/exported/config/config.go
@@ -0,0 +1,501 @@
+package config
+
+import (
+	"fmt"
+	"time"
+
+	"go.encore.dev/platform-sdk/pkg/auth"
+)
+
+type Static struct {
+	// The version of Encore which the app was compiled with.
+	// This is string is for informational use only, and it's format should not be relied on.
+	EncoreCompiler string
+	AppCommit      CommitInfo // The commit which this service was built from
+
+	CORSAllowHeaders  []string // Headers to be allowed by cors
+	CORSExposeHeaders []string // Headers to be exposed by cors
+	PubsubTopics      map[string]*StaticPubsubTopic
+
+	Testing         bool
+	TestServiceMap  map[string]string // map of service names to their filesystem root
+	TestAppRootPath string            // the root path of the app when running tests
+
+	// PrettyPrintLogs indicates whether logs should be pretty-printed.
+	// It's set when building a separate test binary, for example.
+	PrettyPrintLogs bool
+
+	// BundledServices are the services bundled in this binary.
+	BundledServices []string
+
+	// EnabledExperiments is a list of experiments that are enabled for this app
+	// which where enabled at compile time.
+	EnabledExperiments []string `json:"experiments,omitempty"`
+
+	// EmbeddedEnvs is a set of embedded environment variables.
+	EmbeddedEnvs map[string]string
+}
+
+type Runtime struct {
+	AppID             string          `json:"app_id"`
+	AppSlug           string          `json:"app_slug"`
+	APIBaseURL        string          `json:"api_base_url"`
+	EnvID             string          `json:"env_id"`
+	EnvName           string          `json:"env_name"`
+	EnvType           string          `json:"env_type"`
+	EnvCloud          string          `json:"env_cloud"`
+	DeployID          string          `json:"deploy_id"` // Overridden by ENCORE_DEPLOY_ID env var if set
+	DeployedAt        time.Time       `json:"deploy_time"`
+	TraceEndpoint     string          `json:"trace_endpoint,omitempty"`
+	TraceSamplingRate *float64        `json:"trace_sampling_rate,omitempty"`
+	AuthKeys          []EncoreAuthKey `json:"auth_keys,omitempty"`
+	CORS              *CORS           `json:"cors,omitempty"`
+	EncoreCloudAPI    *EncoreCloudAPI `json:"ec_api,omitempty"` // If nil, the app is not running in Encore Cloud
+
+	SQLDatabases     []*SQLDatabase          `json:"sql_databases,omitempty"`
+	SQLServers       []*SQLServer            `json:"sql_servers,omitempty"`
+	PubsubProviders  []*PubsubProvider       `json:"pubsub_providers,omitempty"`
+	PubsubTopics     map[string]*PubsubTopic `json:"pubsub_topics,omitempty"`
+	RedisServers     []*RedisServer          `json:"redis_servers,omitempty"`
+	RedisDatabases   []*RedisDatabase        `json:"redis_databases,omitempty"`
+	BucketProviders  []*BucketProvider       `json:"bucket_providers,omitempty"`
+	Buckets          map[string]*Bucket      `json:"buckets,omitempty"`
+	Metrics          *Metrics                `json:"metrics,omitempty"`
+	Gateways         []Gateway               `json:"gateways,omitempty"`          // Gateways defines the gateways which should be served by the container
+	HostedServices   []string                `json:"hosted_services,omitempty"`   // List of services to be hosted within this container (zero length means all services, unless there's a gateway running)
+	ServiceDiscovery map[string]Service      `json:"service_discovery,omitempty"` // ServiceDiscovery lists where all the services are being hosted if not in this container
+
+	// ServiceAuth defines which authentication method can be used
+	// when talking to this runtime for internal service-to-service
+	// calls.
+	//
+	// An empty slice means that no service-to-service calls can be made
+	ServiceAuth []ServiceAuth `json:"service_auth,omitempty"`
+
+	// ShutdownTimeout is the duration before non-graceful shutdown is initiated,
+	// meaning connections are closed even if outstanding requests are still in flight.
+	// If zero, it shuts down immediately.
+	//
+	// Deprecated: Use GracefulShutdown.Total instead.
+	ShutdownTimeout time.Duration `json:"shutdown_timeout"`
+
+	// GracefulShutdown defines the timings for the graceful shutdown process.
+	GracefulShutdown *GracefulShutdownTimings `json:"graceful_shutdown,omitempty"`
+
+	// DynamicExperiments is a list of experiments that are enabled for this app
+	// which impact runtime behaviour, but which were not enabled at compile time.
+	//
+	// Experiments which impact compilation should be handled by the compiler
+	// and added to the static config.
+	DynamicExperiments []string `json:"dynamic_experiments,omitempty"`
+
+	// Log configuration to set for the application.
+	// If empty it defaults to "trace".
+	LogConfig string `json:"log_config"`
+}
+
+// GracefulShutdownTimings defines the timings for the graceful shutdown process.
+type GracefulShutdownTimings struct {
+	// Total is how long we allow the total shutdown to take
+	// before we simply kill the process using [os.Exit]
+	//
+	// If not set, it will default to [Runtime.ShutdownTimeout] during
+	// the migration period to this config.
+	//
+	// If [Runtime.ShutdownTimeout] is also not set, it will default to
+	// 500ms.
+	Total *time.Duration `json:"total,omitempty"`
+
+	// ShutdownHooks is how long before [Total] runs out that we cancel
+	// the context that is passed to the shutdown hooks.
+	//
+	// If not set, it will default to 1 second.
+	//
+	// It is expected that ShutdownHooks is a larger value than Handlers.
+	ShutdownHooks *time.Duration `json:"shutdown_hooks,omitempty"`
+
+	// Handlers is how long before [Total] runs out that we cancel
+	// the context that is passed to API and PubSub Subscription handlers.
+	//
+	// If not set, it will default to 1 second.
+	//
+	// For example, if [Total] is 10 seconds and [Handlers] is 2 seconds,
+	// then we will cancel the context passed to handlers 8 seconds after
+	// a graceful shutdown is initiated.
+	Handlers *time.Duration `json:"handlers,omitempty"`
+}
+
+// Gateway defines the configuration of a gateway which should be served
+// by the container
+type Gateway struct {
+	// Name is the name of the gateway
+	Name string `json:"name"`
+	// Host is the hostname of the gateway
+	Host string `json:"host"`
+}
+
+// Service defines the service discovery configuration for a service
+type Service struct {
+	// Name is the name of the service
+	Name string `json:"name"`
+	// URL is the base URL of the service (including protocol and port)
+	URL string `json:"url"`
+	// Protocol is the protocol that the service talks
+	Protocol SvcProtocol `json:"protocol"`
+
+	// ServiceAuth is the authentication configuration required for
+	// internal service to service calls being made to this service.
+	ServiceAuth ServiceAuth `json:"service_auth"`
+}
+
+type SvcProtocol string
+
+const (
+	Http SvcProtocol = "http"
+)
+
+type ServiceAuth struct {
+	// Method is the name of the authentication method.
+	Method string `json:"method"`
+}
+
+// UnsafeAllOriginWithCredentials can be used to specify that all origins are
+// allowed to call this API with credentials. It is unsafe and misuse can lead
+// to security issues. Only use if you know what you're doing.
+const UnsafeAllOriginWithCredentials = "UNSAFE_ALL_ORIGINS_WITH_CREDENTIALS"
+
+type CORS struct {
+	// Debug enables debug logging of all requests passing through the CORS system
+	Debug bool `json:"debug"`
+
+	// DisableCredentials, if true, causes Encore to respond to OPTIONS requests
+	// without setting Access-Control-Allow-Credentials: true.
+	DisableCredentials bool `json:"disable_credentials,omitempty"`
+
+	// AllowOriginsWithCredentials specifies the allowed origins for requests
+	// that include credentials. If a request is made from an Origin in this list
+	// Encore responds with Access-Control-Allow-Origin: <Origin>.
+	// If DisableCredentials is true this field is not used.
+	//
+	// The URLs in this list may include wildcards (e.g. "https://*.example.com"
+	// or "https://*-myapp.example.com").
+	AllowOriginsWithCredentials []string `json:"allow_origins_with_credentials,omitempty"`
+
+	// AllowOriginsWithoutCredentials specifies the allowed origins for requests
+	// that don't include credentials. If nil it defaults to allowing all domains
+	// (equivalent to []string{"*"}).
+	AllowOriginsWithoutCredentials []string `json:"allow_origins_without_credentials,omitempty"`
+
+	// ExtraAllowedHeaders specifies extra headers to allow, beyond
+	// the default set always recognized by Encore.
+	// As a special case, if the list contains "*" all headers are allowed.
+	ExtraAllowedHeaders []string `json:"raw_allowed_headers,omitempty"`
+
+	// ExtraExposedHeaders specifies extra headers to expose, beyond
+	// the default set always recognized by Encore.
+	// As a special case, if the list contains "*" all headers are allowed.
+	ExtraExposedHeaders []string `json:"raw_exposed_headers,omitempty"`
+
+	// AllowAccessWhenOnPrivateNetwork, if true, allows requests to Encore apps running
+	// on private networks from websites.
+	//
+	// See: https://wicg.github.io/private-network-access/
+	AllowPrivateNetworkAccess bool `json:"allow_private_network_access,omitempty"`
+}
+
+type CommitInfo struct {
+	Revision    string `json:"revision"`
+	Uncommitted bool   `json:"uncommitted"`
+}
+
+func (ci CommitInfo) AsRevisionString() string {
+	if ci.Uncommitted {
+		return fmt.Sprintf("%s-modified", ci.Revision)
+	}
+	return ci.Revision
+}
+
+func (r *Runtime) Copy() *Runtime {
+	cfg := *r
+	cfg.AuthKeys = make([]EncoreAuthKey, len(r.AuthKeys))
+	for i, authKey := range r.AuthKeys {
+		cfg.AuthKeys[i] = authKey.Copy()
+	}
+	copy(cfg.SQLDatabases, r.SQLDatabases)
+
+	return &cfg
+}
+
+// EncoreCloudAPI is the configuration for the Encore Cloud API
+// which the runtime uses to communicate with infrastructure
+// services when running on Encore Cloud.
+type EncoreCloudAPI struct {
+	Server string `json:"server"` // The Encore Cloud server we're using
+
+	// The auth keys to use when authenticating with the Encore Cloud API server, either for signing requests or
+	// authenticating requests from the Encore Cloud API server.
+	//
+	// Note: these are not the same as the auth keys used to authenticate requests from Encore's central platform.
+	AuthKeys []auth.Key `json:"auth_keys"`
+}
+
+type EncoreAuthKey struct {
+	KeyID uint32 `json:"kid"`
+	Data  []byte `json:"data"`
+}
+
+func (eak EncoreAuthKey) Copy() EncoreAuthKey {
+	c := eak
+	copy(c.Data, eak.Data)
+	return c
+}
+
+type PubsubProvider struct {
+	NSQ         *NSQProvider               `json:"nsq,omitempty"`          // set if the provider is NSQ
+	GCP         *GCPPubsubProvider         `json:"gcp,omitempty"`          // set if the provider is GCP
+	AWS         *AWSPubsubProvider         `json:"aws,omitempty"`          // set if the provider is AWS
+	Azure       *AzureServiceBusProvider   `json:"azure,omitempty"`        // set if the provider is Azure
+	EncoreCloud *EncoreCloudPubsubProvider `json:"encore_cloud,omitempty"` // set if the provider is Encore Cloud
+}
+
+type AzureServiceBusProvider struct {
+	Namespace string `json:"namespace"`
+}
+type NSQProvider struct {
+	Host string `json:"host"`
+}
+
+type EncoreCloudPubsubProvider struct{}
+
+// GCPPubsubProvider currently has no specific configuration.
+type GCPPubsubProvider struct {
+}
+
+// AWSPubsubProvider currently has no specific configuration.
+type AWSPubsubProvider struct {
+}
+
+type PubsubTopic struct {
+	EncoreName   string   `json:"encore_name"`       // the Encore name for the pubsub topic
+	ProviderID   int      `json:"provider_id"`       // The index into (*Runtime).PubsubProviders.
+	ProviderName string   `json:"provider_name"`     // the name for the pubsub topic as defined by the provider
+	Limiter      *Limiter `json:"limiter,omitempty"` // the rate limiter for the topic
+
+	// Subscriptions contains the subscriptions to this topic,
+	// keyed by the Encore name.
+	Subscriptions map[string]*PubsubSubscription `json:"subscriptions"`
+
+	// GCP contains GCP-specific configuration.
+	// It is set if the provider is GCP.
+	GCP *PubsubTopicGCPData `json:"gcp,omitempty"`
+}
+
+type PubsubSubscription struct {
+	ID           string `json:"id"`            // the subscription ID
+	EncoreName   string `json:"encore_name"`   // the Encore name for the subscription
+	ProviderName string `json:"provider_name"` // the name for the pubsub subscription as defined by the provider
+	PushOnly     bool   `json:"push_only"`     // if true the application will not actively subscribe to the pub, but instead will rely on HTTP push messages
+
+	// GCP contains GCP-specific configuration.
+	// It is set if the subscription exists in GCP.
+	GCP *PubsubSubscriptionGCPData `json:"gcp,omitempty"`
+}
+
+type PubsubTopicGCPData struct {
+	// ProjectID is the GCP project id where the topic exists.
+	ProjectID string `json:"project_id"`
+}
+
+type PubsubSubscriptionGCPData struct {
+	// ProjectID is the GCP project id where the subscription exists.
+	ProjectID string `json:"project_id"`
+
+	// PushServiceAccount is the service account used to authenticate
+	// messages being delivered over push.
+	// If empty pushes are not accepted.
+	PushServiceAccount string `json:"push_service_account"`
+}
+
+type StaticPubsubTopic struct {
+	Subscriptions map[string]*StaticPubsubSubscription
+}
+
+type StaticPubsubSubscription struct {
+	Service  string // the service that subscription is in
+	SvcNum   uint16 // the service number the subscription is in
+	TraceIdx uint32 // The trace Idx of the subscription
+}
+
+type SQLServer struct {
+	// Host is the host to connect to.
+	// Valid formats are "hostname", "hostname:port", and "/path/to/unix.socket".
+	Host string `json:"host"`
+
+	// ServerCACert is the PEM-encoded server CA cert, or "" if not required.
+	ServerCACert string `json:"server_ca_cert,omitempty"`
+	// ClientCert is the PEM-encoded client cert, or "" if not required.
+	ClientCert string `json:"client_cert,omitempty"`
+	// ClientKey is the PEM-encoded client key, or "" if not required.
+	ClientKey string `json:"client_key,omitempty"`
+}
+
+type SQLDatabase struct {
+	ServerID     int    `json:"server_id"`     // the index into (*Runtime).SQLServers
+	EncoreName   string `json:"encore_name"`   // the Encore name for the database
+	DatabaseName string `json:"database_name"` // the actual database name as known by the SQL server.
+	User         string `json:"user"`
+	Password     string `json:"password"`
+
+	// MinConnections is the minimum number of open connections to use
+	// for this database. If zero it defaults to 2.
+	MinConnections int `json:"min_connections"`
+
+	// MaxConnections is the maximum number of open connections to use
+	// for this database. If zero it defaults to 30.
+	MaxConnections int `json:"max_connections"`
+}
+
+type RedisServer struct {
+	// Host is the host to connect to.
+	// Valid formats are "hostname", "hostname:port", and "/path/to/unix.socket".
+	Host string `json:"host"`
+
+	// User and password specify the authentication behavior to redis.
+	// If both are provided, it uses Redis v6's ACL support.
+	// If a password but no username is provided, it uses Redis's AUTH string support.
+	// If neither is supplied it uses no authentication.
+	User     string `json:"user,omitempty"`
+	Password string `json:"password,omitempty"`
+
+	// EnableTLS specifies whether or not to use TLS to connect.
+	// If ServerCACert, ClientCert, or ClientKey are provided it is
+	// automatically enabled regardless of the value.
+	EnableTLS bool `json:"enable_tls"`
+	// ServerCACert is the PEM-encoded server CA cert, or "" if not required.
+	ServerCACert string `json:"server_ca_cert,omitempty"`
+	// ClientCert is the PEM-encoded client cert, or "" if not required.
+	ClientCert string `json:"client_cert,omitempty"`
+	// ClientKey is the PEM-encoded client key, or "" if not required.
+	ClientKey string `json:"client_key,omitempty"`
+}
+
+type RedisDatabase struct {
+	ServerID   int    `json:"server_id"`   // the index into (*Runtime).RedisServers
+	EncoreName string `json:"encore_name"` // the Encore name for the database
+
+	// Database is the database index to use, from 0-15.
+	Database int `json:"database"`
+
+	// MinConnections is the minimum number of open connections to use
+	// for this database. It defaults to 1.
+	MinConnections int `json:"min_connections"`
+
+	// MaxConnections is the maximum number of open connections to use
+	// for this database. If zero it defaults to 10*GOMAXPROCS.
+	MaxConnections int `json:"max_connections"`
+
+	// KeyPrefix specifies a prefix to add to all cache keys
+	// for this database. It exists to enable multiple cache clusters
+	// to use the same physical Redis database for local development
+	// without having to coordinate and persist database index ids.
+	KeyPrefix string `json:"key_prefix"`
+}
+
+type BucketProvider struct {
+	S3  *S3BucketProvider  `json:"s3,omitempty"`  // set if the provider is S3
+	GCS *GCSBucketProvider `json:"gcs,omitempty"` // set if the provider is GCS
+}
+
+type S3BucketProvider struct {
+	Region string `json:"region"`
+	// The endpoint to use. If nil, the default endpoint for the region is used.
+	// Must be set for non-AWS endpoints.
+	Endpoint *string `json:"endpoint"`
+
+	// The access key to use. If either is nil, the default credentials are used.
+	AccessKeyID     *string `json:"access_key_id"`
+	SecretAccessKey *string `json:"secret_access_key"`
+}
+
+type GCSBucketProvider struct {
+	Endpoint  string `json:"endpoint"`
+	Anonymous bool   `json:"anonymous"`
+
+	// Additional options for signed URLs when running in local dev mode.
+	// Only use with anonymous mode.
+	LocalSign *GCSLocalSignOptions `json:"local_sign,omitempty"`
+}
+
+type GCSLocalSignOptions struct {
+	BaseURL    string `json:"base_url"`
+	AccessID   string `json:"access_id"`
+	PrivateKey string `json:"private_key"`
+}
+
+type Bucket struct {
+	ProviderID int    `json:"cluster_id"`  // the index into (*Runtime).BucketProviders
+	EncoreName string `json:"encore_name"` // the Encore name for the bucket
+	CloudName  string `json:"cloud_name"`  // the cloud name for the bucket
+	KeyPrefix  string `json:"key_prefix"`  // the prefix to use for all keys in the bucket
+
+	// The public base url for the bucket.
+	// Only set if the bucket is public.
+	PublicBaseURL string `json:"public_base_url"`
+}
+
+type Metrics struct {
+	CollectionInterval time.Duration                  `json:"collection_interval,omitempty"`
+	EncoreCloud        *GCPCloudMonitoringProvider    `json:"encore_cloud,omitempty"`
+	CloudMonitoring    *GCPCloudMonitoringProvider    `json:"gcp_cloud_monitoring,omitempty"`
+	CloudWatch         *AWSCloudWatchMetricsProvider  `json:"aws_cloud_watch,omitempty"`
+	LogsBased          *LogsBasedMetricsProvider      `json:"logs_based,omitempty"`
+	Prometheus         *PrometheusRemoteWriteProvider `json:"prometheus,omitempty"`
+	Datadog            *DatadogProvider               `json:"datadog,omitempty"`
+}
+
+type GCPCloudMonitoringProvider struct {
+	// ProjectID is the GCP project id to send metrics to.
+	ProjectID string
+
+	// MonitoredResourceType is the enum value for the monitored resource this application is monitoring.
+	// See https://cloud.google.com/monitoring/api/resources for valid values.
+	MonitoredResourceType string
+	// MonitoredResourceLabels are the labels to specify for the monitored resource.
+	// Each monitored resource type has a pre-defined set of labels that must be set.
+	// See https://cloud.google.com/monitoring/api/resources for expected labels.
+	MonitoredResourceLabels map[string]string
+
+	// MetricNames contains the mapping between metric names in Encore and metric
+	// names in GCP.
+	MetricNames map[string]string
+}
+
+type AWSCloudWatchMetricsProvider struct {
+	// Namespace is the namespace to use for metrics.
+	Namespace string
+}
+
+type PrometheusRemoteWriteProvider struct {
+	// The URL of the endpoint to send samples to.
+	RemoteWriteURL string
+}
+
+type DatadogProvider struct {
+	Site   string
+	APIKey string
+}
+
+type LogsBasedMetricsProvider struct{}
+
+// Limiter represents a rate limiter that can be used for certain types of operations
+//
+// The fields are mutually exclusive, which ever is not nil is the limiter that will be used,
+// if all are nil, then no limit is enforced.
+type Limiter struct {
+	TokenBucket *TokenBucketLimiter `json:"token_bucket"` // A token bucket limiter
+}
+
+type TokenBucketLimiter struct {
+	PerSecondRate float64 `json:"rate"` // The rate at which to allow requests to pass through.
+	BucketSize    int     `json:"size"` // The size of the token bucket (starts full)
+}
diff --git a/runtimes/go/appruntime/exported/config/infra/config.go b/runtimes/go/appruntime/exported/config/infra/config.go
new file mode 100644
index 0000000000..91e5cdf028
--- /dev/null
+++ b/runtimes/go/appruntime/exported/config/infra/config.go
@@ -0,0 +1,922 @@
+package infra
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log"
+	"net/url"
+	"os"
+)
+
+type InfraConfig struct {
+	Metadata         Metadata                     `json:"metadata,omitempty"`
+	GracefulShutdown *GracefulShutdown            `json:"graceful_shutdown,omitempty"`
+	Auth             []*Auth                      `json:"auth,omitempty"`
+	ServiceDiscovery map[string]*ServiceDiscovery `json:"service_discovery,omitempty"`
+	Metrics          *Metrics                     `json:"metrics,omitempty"`
+	SQLServers       []*SQLServer                 `json:"sql_servers,omitempty"`
+	Redis            map[string]*Redis            `json:"redis,omitempty"`
+	PubSub           []*PubSub                    `json:"pubsub,omitempty"`
+	Secrets          Secrets                      `json:"secrets,omitempty"`
+	ObjectStorage    []*ObjectStorage             `json:"object_storage,omitempty"`
+
+	// Log configuration for the application.
+	// If empty it defaults to "trace".
+	LogConfig string `json:"log_config,omitemty"`
+
+	// Number of worker threads to use for the application.
+	// If unset it defaults to a single worker thread.
+	// If set to 0 it defaults to the number of CPUs.
+	WorkerThreads *int `json:"worker_threads,omitempty"`
+
+	// These fields are not defined in the json schema and should not be
+	// set by the user. They're computed during the build/eject process.
+	HostedServices []string `json:"hosted_services,omitempty"`
+	HostedGateways []string `json:"hosted_gateways,omitempty"`
+	CORS           *CORS    `json:"cors,omitempty"`
+}
+
+type ObjectStorage struct {
+	Type string `json:"type"`
+	GCS  *GCS   `json:"gcs,omitempty"`
+	S3   *S3    `json:"s3,omitempty"`
+}
+
+func (o *ObjectStorage) GetBuckets() map[string]*Bucket {
+	switch o.Type {
+	case "gcs":
+		return o.GCS.Buckets
+	case "s3":
+		return o.S3.Buckets
+	default:
+		panic("unsupported object storage type")
+	}
+}
+
+func (o *ObjectStorage) DeleteBucket(name string) {
+	switch o.Type {
+	case "gcs":
+		delete(o.GCS.Buckets, name)
+	case "s3":
+		delete(o.S3.Buckets, name)
+	default:
+		panic("unsupported object storage type")
+	}
+
+}
+
+func (a *ObjectStorage) Validate(v *validator) {
+	v.ValidateField("Type", OneOf(a.Type, "gcs", "s3"))
+	switch a.Type {
+	case "gcs":
+		a.GCS.Validate(v)
+	case "s3":
+		a.S3.Validate(v)
+	default:
+		v.ValidateField("type", Err("unsupported object storage type"))
+	}
+}
+
+func (p *ObjectStorage) MarshalJSON() ([]byte, error) {
+	// Create a map to hold the JSON structure
+	m := make(map[string]interface{})
+
+	// Always add the type
+	m["type"] = p.Type
+
+	// Add the specific object storage configuration based on the type
+	switch p.Type {
+	case "gcs":
+		if p.GCS != nil {
+			for k, v := range structToMap(p.GCS) {
+				m[k] = v
+			}
+		}
+	case "s3":
+		if p.S3 != nil {
+			for k, v := range structToMap(p.S3) {
+				m[k] = v
+			}
+		}
+	default:
+		return nil, errors.New("unsupported object storage type")
+	}
+
+	return json.Marshal(m)
+}
+
+// UnmarshalJSON custom unmarshaller for PubSub.
+func (p *ObjectStorage) UnmarshalJSON(data []byte) error {
+	// Anonymous struct to capture the "type" field first.
+	var aux struct {
+		Type string `json:"type,omitempty"`
+	}
+	if err := json.Unmarshal(data, &aux); err != nil {
+		return err
+	}
+
+	// Set the Type field.
+	p.Type = aux.Type
+
+	// Unmarshal based on the "type" field.
+	switch aux.Type {
+	case "gcs":
+		var g GCS
+		if err := json.Unmarshal(data, &g); err != nil {
+			return err
+		}
+		p.GCS = &g
+	case "s3":
+		var a S3
+		if err := json.Unmarshal(data, &a); err != nil {
+			return err
+		}
+		p.S3 = &a
+	default:
+		return errors.New("unsupported object storage type")
+	}
+
+	return nil
+}
+
+type S3 struct {
+	Region   string `json:"region"`
+	Endpoint string `json:"endpoint,omitempty"`
+
+	AccessKeyID     string    `json:"access_key_id,omitempty"`
+	SecretAccessKey EnvString `json:"secret_access_key,omitempty"`
+
+	Buckets map[string]*Bucket `json:"buckets,omitempty"`
+}
+
+func (a *S3) Validate(v *validator) {
+	v.ValidateField("region", NotZero(a.Region))
+	if a.AccessKeyID != "" {
+		v.ValidatePtrEnvRef("secret_access_key", &a.SecretAccessKey, "S3 Secret Access Key", NotZero[string])
+	}
+	ValidateChildMap(v, "buckets", a.Buckets)
+}
+
+type GCS struct {
+	Endpoint string             `json:"endpoint,omitempty"`
+	Buckets  map[string]*Bucket `json:"buckets,omitempty"`
+}
+
+func (a *GCS) Validate(v *validator) {
+	ValidateChildMap(v, "buckets", a.Buckets)
+}
+
+type Bucket struct {
+	Name          string `json:"name,omitempty"`
+	KeyPrefix     string `json:"key_prefix,omitempty"`
+	PublicBaseURL string `json:"public_base_url,omitempty"`
+}
+
+func (a *Bucket) Validate(v *validator) {
+	v.ValidateField("name", NotZero(a.Name))
+
+	v.ValidateField("public_base_url", func() error {
+		if a.PublicBaseURL != "" {
+			if _, err := url.Parse(a.PublicBaseURL); err != nil {
+				return fmt.Errorf("Not a valid URL: %v", err)
+			}
+		}
+		return nil
+	})
+}
+
+type Metadata struct {
+	AppID   string `json:"app_id,omitempty"`
+	EnvName string `json:"env_name,omitempty"`
+	EnvType string `json:"env_type,omitempty"`
+	Cloud   string `json:"cloud,omitempty"`
+	BaseURL string `json:"base_url,omitempty"`
+}
+
+// Copy of the CORS struct from the appfile
+type CORS struct {
+	Debug                          bool     `json:"debug,omitempty"`
+	AllowHeaders                   []string `json:"allow_headers,omitempty"`
+	ExposeHeaders                  []string `json:"expose_headers,omitempty"`
+	AllowOriginsWithoutCredentials []string `json:"allow_origins_without_credentials,omitempty"`
+	AllowOriginsWithCredentials    []string `json:"allow_origins_with_credentials,omitempty"`
+}
+
+func (i *InfraConfig) Validate(v *validator) {
+	v.ValidateChild("graceful_shutdown", i.GracefulShutdown)
+	ValidateChildList(v, "auth", i.Auth)
+	ValidateChildMap(v, "service_discovery", i.ServiceDiscovery)
+	ValidateChildList(v, "object_storage", i.ObjectStorage)
+	v.ValidateChild("metrics", i.Metrics)
+	ValidateChildList(v, "sql_servers", i.SQLServers)
+	ValidateChildMap(v, "redis", i.Redis)
+	ValidateChildList(v, "pubsub", i.PubSub)
+	v.ValidateChild("secrets", i.Secrets)
+}
+
+type Secrets struct {
+	SecretsMap map[string]EnvString
+	EnvRef     *EnvRef
+}
+
+func (s Secrets) Validate(v *validator) {
+	if s.EnvRef != nil {
+		v.ValidateEnvRef("env_ref", *s.EnvRef, "An environment variable containing a JSON object of secrets")
+		return
+	}
+	for name, value := range s.SecretsMap {
+		v.ValidateEnvString(name, value, "Secret", nil)
+	}
+}
+
+func (s *Secrets) GetSecrets() map[string]string {
+	if s.EnvRef != nil {
+		refs := make(map[string]string)
+		envValue := os.Getenv(s.EnvRef.Env)
+		if err := json.Unmarshal([]byte(envValue), &refs); err != nil {
+			log.Fatalf("Error unmarshalling secrets")
+		}
+		return refs
+	}
+	return MapValues(s.SecretsMap, func(k string, v EnvString) string {
+		return v.Value()
+	})
+}
+
+// UnmarshalJSON is a custom JSON unmarshaller for the Secrets type.
+func (s *Secrets) UnmarshalJSON(data []byte) error {
+	// Try unmarshalling as an EnvRef.
+	var ref EnvRef
+	if err := json.Unmarshal(data, &ref); err == nil && ref.Env != "" {
+		s.EnvRef = &ref
+		return nil
+	}
+
+	// Try unmarshalling as a map of strings to EnvString.
+	var m map[string]EnvString
+	if err := json.Unmarshal(data, &m); err == nil {
+		s.SecretsMap = m
+		return nil
+	}
+	return errors.New("invalid Secrets structure")
+}
+
+// MarshalJSON is a custom JSON marshaller for the Secrets type.
+func (s Secrets) MarshalJSON() ([]byte, error) {
+	if s.EnvRef == nil {
+		return json.Marshal(s.SecretsMap)
+	}
+	return json.Marshal(s.EnvRef)
+}
+
+type GracefulShutdown struct {
+	Total         *int `json:"total,omitempty"`
+	ShutdownHooks *int `json:"shutdown_hooks,omitempty"`
+	Handlers      *int `json:"handlers,omitempty"`
+}
+
+func (g *GracefulShutdown) Validate(v *validator) {
+	v.ValidateField("total", NilOr(g.Total, GreaterOrEqual(0)))
+	v.ValidateField("shutdown_hooks", NilOr(g.ShutdownHooks, GreaterOrEqual(0)))
+	v.ValidateField("handlers", NilOr(g.Handlers, GreaterOrEqual(0)))
+}
+
+type Auth struct {
+	Type string    `json:"type,omitempty"`
+	ID   int       `json:"id,omitempty"`
+	Key  EnvString `json:"key,omitempty"`
+}
+
+func (a *Auth) Validate(v *validator) {
+	v.ValidateField("type", OneOf(a.Type, "key"))
+	v.ValidateEnvString("key", a.Key, "Service Authorization Key", NotZero[string])
+}
+
+type ServiceDiscovery struct {
+	BaseURL string  `json:"base_url,omitempty"`
+	Auth    []*Auth `json:"auth,omitempty"`
+}
+
+func (s *ServiceDiscovery) Validate(v *validator) {
+	v.ValidateField("base_url", NotZero(s.BaseURL))
+	ValidateChildList(v, "auth", s.Auth)
+}
+
+// Main Metrics struct which embeds the different metric types.
+type Metrics struct {
+	Type               string `json:"type,omitempty"`
+	CollectionInterval int    `json:"collection_interval,omitempty"`
+	Prometheus         *Prometheus
+	Datadog            *Datadog
+	GCPCloudMonitoring *GCPCloudMonitoring
+	AWSCloudWatch      *AWSCloudWatch
+}
+
+// MarshalJSON custom marshaller to handle dynamic types in Metrics.
+func (m *Metrics) MarshalJSON() ([]byte, error) {
+	// Create a map to hold the JSON structure
+	data := make(map[string]interface{})
+
+	data["type"] = m.Type
+	data["collection_interval"] = m.CollectionInterval
+
+	switch m.Type {
+	case "prometheus":
+		if m.Prometheus != nil {
+			for k, v := range structToMap(m.Prometheus) {
+				data[k] = v
+			}
+		}
+	case "datadog":
+		if m.Datadog != nil {
+			for k, v := range structToMap(m.Datadog) {
+				data[k] = v
+			}
+		}
+	case "gcp_cloud_monitoring":
+		if m.GCPCloudMonitoring != nil {
+			for k, v := range structToMap(m.GCPCloudMonitoring) {
+				data[k] = v
+			}
+		}
+	case "aws_cloudwatch":
+		if m.AWSCloudWatch != nil {
+			for k, v := range structToMap(m.AWSCloudWatch) {
+				data[k] = v
+			}
+		}
+	default:
+		return nil, errors.New("unsupported metrics type")
+	}
+
+	return json.Marshal(data)
+}
+
+// UnmarshalJSON custom unmarshaller to handle dynamic types in Metrics.
+func (m *Metrics) UnmarshalJSON(data []byte) error {
+	// Anonymous struct to capture the "type" field first
+	var aux struct {
+		Type string `json:"type,omitempty"`
+	}
+	if err := json.Unmarshal(data, &aux); err != nil {
+		return err
+	}
+
+	// Set the Type field
+	m.Type = aux.Type
+
+	// Unmarshal based on the "type" field
+	switch aux.Type {
+	case "prometheus":
+		var p Prometheus
+		if err := json.Unmarshal(data, &p); err != nil {
+			return err
+		}
+		m.Prometheus = &p
+	case "datadog":
+		var d Datadog
+		if err := json.Unmarshal(data, &d); err != nil {
+			return err
+		}
+		m.Datadog = &d
+	case "gcp_cloud_monitoring":
+		var g GCPCloudMonitoring
+		if err := json.Unmarshal(data, &g); err != nil {
+			return err
+		}
+		m.GCPCloudMonitoring = &g
+	case "aws_cloudwatch":
+		var a AWSCloudWatch
+		if err := json.Unmarshal(data, &a); err != nil {
+			return err
+		}
+		m.AWSCloudWatch = &a
+	default:
+		return errors.New("unsupported metrics type")
+	}
+
+	return nil
+}
+
+func (m *Metrics) Validate(v *validator) {
+	switch m.Type {
+	case "prometheus":
+		m.Prometheus.Validate(v)
+	case "datadog":
+		m.Datadog.Validate(v)
+	case "gcp_cloud_monitoring":
+		m.GCPCloudMonitoring.Validate(v)
+	case "aws_cloudwatch":
+		m.AWSCloudWatch.Validate(v)
+	default:
+		v.ValidateField("type", Err("unsupported metrics type"))
+	}
+}
+
+// Prometheus-specific metric configuration.
+type Prometheus struct {
+	RemoteWriteURL EnvString `json:"remote_write_url,omitempty"`
+}
+
+func (p *Prometheus) Validate(v *validator) {
+	v.ValidateEnvString("remote_write_url", p.RemoteWriteURL, "Prometheus Remote Write URL", NotZero[string])
+}
+
+// Datadog-specific metric configuration.
+type Datadog struct {
+	Site   string    `json:"site,omitempty"`
+	APIKey EnvString `json:"api_key,omitempty"`
+}
+
+func (d *Datadog) Validate(v *validator) {
+	v.ValidateField("site", NotZero(d.Site))
+	v.ValidateEnvString("api_key", d.APIKey, "Datadog API Key", NotZero[string])
+}
+
+// GCP Cloud Monitoring-specific metric configuration.
+type GCPCloudMonitoring struct {
+	ProjectID               string            `json:"project_id,omitempty"`
+	MonitoredResourceType   string            `json:"monitored_resource_type,omitempty"`
+	MonitoredResourceLabels map[string]string `json:"monitored_resource_labels,omitempty"`
+	MetricNames             map[string]string `json:"metric_names,omitempty"`
+}
+
+func (g *GCPCloudMonitoring) Validate(v *validator) {
+	v.ValidateField("project_id", NotZero(g.ProjectID))
+	v.ValidateField("monitored_resource_type", NotZero(g.MonitoredResourceType))
+}
+
+// AWS CloudWatch-specific metric configuration.
+type AWSCloudWatch struct {
+	Namespace string `json:"namespace,omitempty"`
+}
+
+func (a *AWSCloudWatch) Validate(v *validator) {
+	v.ValidateField("namespace", NotZero(a.Namespace))
+}
+
+type SQLServer struct {
+	Host      string                  `json:"host,omitempty"`
+	TLSConfig *TLSConfig              `json:"tls_config,omitempty"`
+	Databases map[string]*SQLDatabase `json:"databases,omitempty"`
+}
+
+func (s *SQLServer) Validate(v *validator) {
+	v.ValidateField("host", NotZero(s.Host))
+	v.ValidateChild("tls_config", s.TLSConfig)
+	ValidateChildMap(v, "databases", s.Databases)
+}
+
+type TLSConfig struct {
+	CA                             string      `json:"ca,omitempty"`
+	ClientCert                     *ClientCert `json:"client_cert,omitempty"`
+	DisableTLSHostnameVerification bool        `json:"disable_tls_hostname_verification,omitempty"`
+	DisableCAValidation            bool        `json:"disable_ca_validation,omitempty"`
+}
+
+func (t *TLSConfig) Validate(v *validator) {
+	v.ValidateChild("client_cert", t.ClientCert)
+}
+
+type SQLDatabase struct {
+	Name           string      `json:"name,omitempty"`
+	MaxConnections int         `json:"max_connections,omitempty"`
+	MinConnections int         `json:"min_connections,omitempty"`
+	Username       EnvString   `json:"username,omitempty"`
+	Password       EnvString   `json:"password,omitempty"`
+	ClientCert     *ClientCert `json:"client_cert,omitempty"`
+}
+
+func (s *SQLDatabase) Validate(v *validator) {
+	v.ValidateField("max_connections", GreaterOrEqual(s.MinConnections)(s.MaxConnections))
+	v.ValidateField("min_connections", GreaterOrEqual(0)(s.MinConnections))
+	v.ValidateEnvString("username", s.Username, "Database Username", NotZero[string])
+	v.ValidateEnvString("password", s.Password, "Database Password", NotZero[string])
+	v.ValidateChild("client_cert", s.ClientCert)
+}
+
+type Redis struct {
+	Host           string     `json:"host,omitempty"`
+	DatabaseIndex  int        `json:"database_index,omitempty"`
+	Auth           *RedisAuth `json:"auth,omitempty"`
+	KeyPrefix      *string    `json:"key_prefix,omitempty"`
+	TLSConfig      *TLSConfig `json:"tls_config,omitempty"`
+	MaxConnections *int       `json:"max_connections,omitempty"`
+	MinConnections *int       `json:"min_connections,omitempty"`
+}
+
+func (r *Redis) Validate(v *validator) {
+	v.ValidateField("host", NotZero(r.Host))
+	v.ValidateField("database_index", Between(0, 15)(r.DatabaseIndex))
+	v.ValidateChild("auth", r.Auth)
+	v.ValidateChild("tls_config", r.TLSConfig)
+	v.ValidateField("max_connections", NilOr(r.MaxConnections, GreaterOrEqual(0)))
+	v.ValidateField("min_connections", NilOr(r.MinConnections, GreaterOrEqual(0)))
+}
+
+type RedisAuth struct {
+	Type       string     `json:"type,omitempty"`
+	Username   *EnvString `json:"username,omitempty"`
+	Password   *EnvString `json:"password,omitempty"`
+	AuthString *EnvString `json:"auth_string,omitempty"`
+}
+
+func (r *RedisAuth) Validate(v *validator) {
+	v.ValidateField("type", NotZero(r.Type))
+	switch r.Type {
+	case "acl":
+		v.ValidatePtrEnvRef("username", r.Username, "Redis Username", NotZero[string])
+		v.ValidatePtrEnvRef("password", r.Password, "Redis Password", NotZero[string])
+	case "auth_string":
+		v.ValidatePtrEnvRef("auth_string", r.AuthString, "Redis Auth String", NotZero[string])
+	default:
+		v.ValidateField("type", Err("unsupported Redis auth type"))
+	}
+}
+
+type ClientCert struct {
+	Cert string    `json:"cert,omitempty"`
+	Key  EnvString `json:"key,omitempty"`
+}
+
+func (c *ClientCert) Validate(v *validator) {
+	v.ValidateField("cert", NotZero(c.Cert))
+	v.ValidateEnvString("key", c.Key, "Client Certificate Key", NotZero[string])
+}
+
+// Main PubSub struct which embeds different PubSub types.
+type PubSub struct {
+	Type string `json:"type,omitempty"`
+	GCP  *GCPPubsub
+	AWS  *AWSSNS_SQS
+	NSQ  *NSQPubsub
+}
+
+func (p *PubSub) Validate(v *validator) {
+	switch p.Type {
+	case "gcp_pubsub":
+		p.GCP.Validate(v)
+	case "aws_sns_sqs":
+		p.AWS.Validate(v)
+	case "nsq":
+		p.NSQ.Validate(v)
+	default:
+		v.ValidateField("type", Err("unsupported pubsub type"))
+	}
+}
+
+func (p *PubSub) DeleteTopic(name string) {
+	switch p.Type {
+	case "gcp_pubsub":
+		p.GCP.DeleteTopic(name)
+	case "aws_sns_sqs":
+		p.AWS.DeleteTopic(name)
+	case "nsq":
+		p.NSQ.DeleteTopic(name)
+	}
+}
+
+func (p *PubSub) GetTopics() map[string]PubsubTopic {
+	switch p.Type {
+	case "gcp_pubsub":
+		return p.GCP.GetTopics()
+	case "aws_sns_sqs":
+		return p.AWS.GetTopics()
+	case "nsq":
+		return p.NSQ.GetTopics()
+	default:
+		panic("unsupported pubsub type")
+	}
+}
+
+type PubsubTopic interface {
+	GetSubscriptions() map[string]PubsubSubscription
+	DeleteSubscription(name string)
+}
+
+type PubsubSubscription interface{}
+
+type PubsubProvider interface {
+	GetTopics() map[string]PubsubTopic
+	DeleteTopic(name string)
+}
+
+// GCPPubsub specific configuration.
+type GCPPubsub struct {
+	ProjectID string               `json:"project_id,omitempty"`
+	Topics    map[string]*GCPTopic `json:"topics,omitempty"`
+}
+
+func (g *GCPPubsub) Validate(v *validator) {
+	ValidateChildMap(v, "topics", g.Topics)
+}
+
+func (g *GCPPubsub) GetTopics() map[string]PubsubTopic {
+	return MapValues(g.Topics, func(k string, v *GCPTopic) PubsubTopic {
+		return v
+	})
+}
+
+func (g *GCPPubsub) DeleteTopic(name string) {
+	delete(g.Topics, name)
+}
+
+type GCPTopic struct {
+	Name          string             `json:"name,omitempty"`
+	ProjectID     string             `json:"project_id,omitempty"`
+	Subscriptions map[string]*GCPSub `json:"subscriptions,omitempty"`
+}
+
+func (g *GCPTopic) Validate(v *validator) {
+	v.ValidateField("name", NotZero(g.Name))
+	pubsub := Ancestor[*PubSub](v)
+	v.ValidateField("project_id", AnyNonZero(g.ProjectID, pubsub.GCP.ProjectID))
+	ValidateChildMap(v, "subscriptions", g.Subscriptions)
+}
+
+func (g *GCPTopic) GetSubscriptions() map[string]PubsubSubscription {
+	return MapValues(g.Subscriptions, func(k string, v *GCPSub) PubsubSubscription {
+		return v
+	})
+}
+
+func (g *GCPTopic) DeleteSubscription(name string) {
+	delete(g.Subscriptions, name)
+}
+
+type GCPSub struct {
+	Name       string      `json:"name,omitempty"`
+	ProjectID  string      `json:"project_id,omitempty"`
+	PushConfig *PushConfig `json:"push_config,omitempty"`
+}
+
+func (g *GCPSub) Validate(v *validator) {
+	v.ValidateField("name", NotZero(g.Name))
+	pubsub := Ancestor[*PubSub](v)
+	v.ValidateField("project_id", AnyNonZero(g.ProjectID, pubsub.GCP.ProjectID))
+	v.ValidateChild("push_config", g.PushConfig)
+}
+
+type PushConfig struct {
+	ServiceAccount string `json:"service_account,omitempty"`
+	JWTAudience    string `json:"jwt_audience,omitempty"`
+	ID             string `json:"id,omitempty"`
+}
+
+func (p *PushConfig) Validate(v *validator) {
+	v.ValidateField("service_account", NotZero(p.ServiceAccount))
+	v.ValidateField("jwt_audience", NotZero(p.JWTAudience))
+	v.ValidateField("id", NotZero(p.ID))
+}
+
+// AWSSNS_SQS specific configuration.
+type AWSSNS_SQS struct {
+	Topics map[string]*AWSTopic `json:"topics,omitempty"`
+}
+
+func (a *AWSSNS_SQS) Validate(v *validator) {
+	ValidateChildMap(v, "topics", a.Topics)
+}
+
+func (a *AWSSNS_SQS) GetTopics() map[string]PubsubTopic {
+	return MapValues(a.Topics, func(k string, v *AWSTopic) PubsubTopic {
+		return v
+	})
+}
+
+func (a *AWSSNS_SQS) DeleteTopic(name string) {
+	delete(a.Topics, name)
+}
+
+type AWSTopic struct {
+	ARN           string             `json:"arn,omitempty"`
+	Subscriptions map[string]*AWSSub `json:"subscriptions,omitempty"`
+}
+
+func (a *AWSTopic) Validate(v *validator) {
+	v.ValidateField("arn", NotZero(a.ARN))
+	ValidateChildMap(v, "subscriptions", a.Subscriptions)
+}
+
+func (a *AWSTopic) GetSubscriptions() map[string]PubsubSubscription {
+	return MapValues(a.Subscriptions, func(k string, v *AWSSub) PubsubSubscription {
+		return v
+	})
+}
+
+func (a *AWSTopic) DeleteSubscription(name string) {
+	delete(a.Subscriptions, name)
+}
+
+type AWSSub struct {
+	ARN string `json:"arn,omitempty"`
+}
+
+func (a *AWSSub) Validate(v *validator) {
+	v.ValidateField("arn", NotZero(a.ARN))
+}
+
+// NSQPubsub specific configuration.
+type NSQPubsub struct {
+	Hosts  string               `json:"hosts,omitempty"`
+	Topics map[string]*NSQTopic `json:"topics,omitempty"`
+}
+
+func (n *NSQPubsub) Validate(v *validator) {
+	v.ValidateField("hosts", NotZero(n.Hosts))
+	ValidateChildMap(v, "topics", n.Topics)
+}
+
+func (n *NSQPubsub) GetTopics() map[string]PubsubTopic {
+	return MapValues(n.Topics, func(k string, v *NSQTopic) PubsubTopic {
+		return v
+	})
+}
+
+func (n *NSQPubsub) DeleteTopic(name string) {
+	delete(n.Topics, name)
+}
+
+type NSQTopic struct {
+	Name          string             `json:"name,omitempty"`
+	Subscriptions map[string]*NSQSub `json:"subscriptions,omitempty"`
+}
+
+func (n *NSQTopic) Validate(v *validator) {
+	v.ValidateField("name", NotZero(n.Name))
+	ValidateChildMap(v, "subscriptions", n.Subscriptions)
+}
+
+func (n *NSQTopic) GetSubscriptions() map[string]PubsubSubscription {
+	return MapValues(n.Subscriptions, func(k string, v *NSQSub) PubsubSubscription {
+		return v
+	})
+}
+
+func (n *NSQTopic) DeleteSubscription(name string) {
+	delete(n.Subscriptions, name)
+}
+
+type NSQSub struct {
+	Name string `json:"name,omitempty"`
+}
+
+func (n *NSQSub) Validate(v *validator) {
+	v.ValidateField("name", NotZero(n.Name))
+}
+
+// MarshalJSON custom marshaller for PubSub.
+func (p *PubSub) MarshalJSON() ([]byte, error) {
+	// Create a map to hold the JSON structure
+	m := make(map[string]interface{})
+
+	// Always add the type
+	m["type"] = p.Type
+
+	// Add the specific pubsub configuration based on the type
+	switch p.Type {
+	case "gcp_pubsub":
+		if p.GCP != nil {
+			for k, v := range structToMap(p.GCP) {
+				m[k] = v
+			}
+		}
+	case "aws_sns_sqs":
+		if p.AWS != nil {
+			for k, v := range structToMap(p.AWS) {
+				m[k] = v
+			}
+		}
+	case "nsq":
+		if p.NSQ != nil {
+			for k, v := range structToMap(p.NSQ) {
+				m[k] = v
+			}
+		}
+	default:
+		return nil, errors.New("unsupported pubsub type")
+	}
+
+	return json.Marshal(m)
+}
+
+// structToMap converts a struct to a map[string]interface{}
+// It uses json.Marshal and json.Unmarshal to avoid reflection
+func structToMap(v interface{}) map[string]interface{} {
+	data, _ := json.Marshal(v)
+	var m map[string]interface{}
+	_ = json.Unmarshal(data, &m)
+	return m
+}
+
+// UnmarshalJSON custom unmarshaller for PubSub.
+func (p *PubSub) UnmarshalJSON(data []byte) error {
+	// Anonymous struct to capture the "type" field first.
+	var aux struct {
+		Type string `json:"type,omitempty"`
+	}
+	if err := json.Unmarshal(data, &aux); err != nil {
+		return err
+	}
+
+	// Set the Type field.
+	p.Type = aux.Type
+
+	// Unmarshal based on the "type" field.
+	switch aux.Type {
+	case "gcp_pubsub":
+		var g GCPPubsub
+		if err := json.Unmarshal(data, &g); err != nil {
+			return err
+		}
+		p.GCP = &g
+	case "aws_sns_sqs":
+		var a AWSSNS_SQS
+		if err := json.Unmarshal(data, &a); err != nil {
+			return err
+		}
+		p.AWS = &a
+	case "nsq":
+		var n NSQPubsub
+		if err := json.Unmarshal(data, &n); err != nil {
+			return err
+		}
+		p.NSQ = &n
+	default:
+		return errors.New("unsupported pubsub type")
+	}
+
+	return nil
+}
+
+// Definitions of env_string and env_ref
+type EnvString struct {
+	Str string  `json:"string,omitempty"`
+	Env *EnvRef `json:"env,omitempty"`
+}
+
+func (e *EnvString) IsEnvRef() bool {
+	return e.Env != nil
+}
+
+// Value returns the resolved value of the EnvString.
+// If Env is set, it returns the value of the environment variable.
+// Otherwise, it returns the Str value.
+func (e EnvString) Value() string {
+	if e.Env != nil {
+		return os.Getenv(e.Env.Env)
+	}
+	return e.Str
+}
+
+type EnvRef struct {
+	Env string `json:"$env,omitempty"`
+}
+
+func (e *EnvRef) Describe(desc string) EnvDesc {
+	return EnvDesc{
+		Name:        e.Env,
+		Description: desc,
+	}
+}
+
+// UnmarshalJSON is the custom unmarshalling function for the EnvString type.
+func (e *EnvString) UnmarshalJSON(data []byte) error {
+	// Try unmarshalling into a simple string first.
+	var simpleString string
+	if err := json.Unmarshal(data, &simpleString); err == nil {
+		e.Str = simpleString
+		e.Env = nil
+		return nil
+	}
+
+	// If it isn't a string, try unmarshalling into an EnvRef object.
+	var envRef EnvRef
+	if err := json.Unmarshal(data, &envRef); err == nil {
+		e.Str = ""
+		e.Env = &envRef
+		return nil
+	}
+
+	// If neither works, return an error.
+	return errors.New("invalid EnvString format")
+}
+
+// MarshalJSON is the custom marshaller function for the EnvString type (optional if needed).
+func (e EnvString) MarshalJSON() ([]byte, error) {
+	// If EnvRef is set, marshal as an object.
+	if e.Env != nil {
+		return json.Marshal(e.Env)
+	}
+	// Otherwise, marshal as a simple string.
+	return json.Marshal(e.Str)
+}
+
+func MapValues[T comparable, V any, V2 any](m map[T]V, fn func(T, V) V2) map[T]V2 {
+	res := make(map[T]V2)
+	for k, v := range m {
+		res[k] = fn(k, v)
+	}
+	return res
+}
diff --git a/runtimes/go/appruntime/exported/config/infra/config_test.go b/runtimes/go/appruntime/exported/config/infra/config_test.go
new file mode 100644
index 0000000000..b7fe243361
--- /dev/null
+++ b/runtimes/go/appruntime/exported/config/infra/config_test.go
@@ -0,0 +1,32 @@
+package infra
+
+import (
+	"encoding/json"
+	"os"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+)
+
+func TestInfraConfigMarshalUnmarshal(t *testing.T) {
+	c := qt.New(t)
+	// Read the test data file
+	data, err := os.ReadFile("testdata/infra.config.json")
+	c.Assert(err, qt.IsNil)
+
+	// Unmarshal the JSON data into InfraConfig
+	var config InfraConfig
+	err = json.Unmarshal(data, &config)
+	c.Assert(err, qt.IsNil)
+
+	// Marshal the InfraConfig back to JSON
+	marshaledData, err := json.Marshal(config)
+	c.Assert(err, qt.IsNil)
+
+	// Unmarshal the marshaled JSON data back to InfraConfig and compare the two objects
+	var newConfig InfraConfig
+	err = json.Unmarshal(marshaledData, &newConfig)
+	c.Assert(err, qt.IsNil)
+
+	c.Assert(newConfig, qt.DeepEquals, config)
+}
diff --git a/runtimes/go/appruntime/exported/config/infra/testdata/infra.config.json b/runtimes/go/appruntime/exported/config/infra/testdata/infra.config.json
new file mode 100644
index 0000000000..7de8f5f25f
--- /dev/null
+++ b/runtimes/go/appruntime/exported/config/infra/testdata/infra.config.json
@@ -0,0 +1,125 @@
+{
+  "$schema": "https://encore.dev/schemas/infra.schema.json",
+  "metadata": {
+    "app_id": "my-app",
+    "env_name": "my-env",
+    "env_type": "production",
+    "cloud": "gcp",
+    "base_url": "https://my-app.com"
+  },
+  "sql_servers": [
+    {
+      "host": "my-db-host:5432",
+      "tls_config": {
+        "ca": "test",
+        "client_cert": {
+          "cert": "test",
+          "key": "test"
+        },
+        "disable_tls_hostname_verification": false,
+        "disabled": false
+      },
+      "databases": {
+        "mydb": {
+          "client_cert": {
+            "cert": "test",
+            "key": "test"
+          },
+          "max_connections": 10,
+          "min_connections": 10,
+          "username": "my-db-owner",
+          "password": {"$env": "DB_PASSWORD"}
+
+        }
+      }
+    }
+  ],
+  "service_discovery": {
+    "myservice": {
+      "base_url": "https://my-service:8044"
+    },
+    "myservice2": {
+      "base_url": "https://my-service2:8044",
+      "auth": [{
+        "type": "key",
+        "key": {
+          "$env": "SVC_TO_SVC_KEY"
+        },
+        "id": 1
+      }]
+    }
+  },
+  "redis": {
+    "encoreredis": {
+      "database_index": 5,
+      "max_connections": 10,
+      "min_connections": 10,
+      "key_prefix": "my-app:my-env:",
+      "tls_config": {
+        "disable_tls_hostname_verification": false,
+        "disabled": false,
+        "ca": "test",
+        "client_cert": {
+          "cert": "test",
+          "key": "test"
+        }
+      },
+      "auth": {
+        "type": "acl",
+        "username": "encoreredis",
+        "password": {"$env": "REDIS_PASSWORD"}
+      },
+      "host": "my-redis-host"
+    }
+  },
+  "metrics": {
+    "type": "prometheus",
+    "remote_write_url": "https://my-remote-write-url"
+  },
+  "graceful_shutdown": {
+    "total": 30,
+    "handlers": 20,
+    "shutdown_hooks": 10
+  },
+  "auth": [
+    {
+      "type": "key",
+      "id": 1,
+      "key": {"$env": "SVC_TO_SVC_KEY"}
+    }
+  ],
+  "secrets": {
+    "AppSecret": {"$env": "APP_SECRET"}
+  },
+  "pubsub": [
+    {
+      "type": "gcp_pubsub",
+      "project_id": "my-project",
+      "topics": {
+        "encore-topic": {
+          "name": "gcp-topic-name",
+          "subscriptions": {
+            "encore-subscription": {
+              "name": "gcp-subscription-name",
+              "project_id": "test",
+              "push_config": {
+                "id": "test",
+                "jwt_audience": "test",
+                "service_account": "test"
+              }
+            }
+          }
+        }
+      }
+    }
+  ],
+  "cors": {
+    "debug": true,
+    "allow_headers": ["Authorization", "Content-Type"],
+    "expose_headers": ["*"],
+    "allow_origins_with_credentials": ["https://test.com"],
+    "allow_origins_without_credentials": ["https://test.com"]
+  },
+  "hosted_gateways": ["api-gateway"],
+  "hosted_services": ["my-service", "my-service2"]
+}
\ No newline at end of file
diff --git a/runtimes/go/appruntime/exported/config/infra/testdata/runtime.json b/runtimes/go/appruntime/exported/config/infra/testdata/runtime.json
new file mode 100644
index 0000000000..00d91d90d3
--- /dev/null
+++ b/runtimes/go/appruntime/exported/config/infra/testdata/runtime.json
@@ -0,0 +1,145 @@
+{
+  "app_id": "",
+  "app_slug": "my-app",
+  "api_base_url": "https://my-app.com",
+  "env_id": "",
+  "env_name": "my-env",
+  "env_type": "production",
+  "env_cloud": "gcp",
+  "deploy_id": "",
+  "deploy_time": "0001-01-01T00:00:00Z",
+  "auth_keys": [
+    {
+      "kid": 1,
+      "data": ""
+    }
+  ],
+  "cors": {
+    "debug": true,
+    "allow_origins_with_credentials": [
+      "https://test.com"
+    ],
+    "allow_origins_without_credentials": [
+      "https://test.com"
+    ],
+    "raw_allowed_headers": [
+      "Authorization",
+      "Content-Type"
+    ],
+    "raw_exposed_headers": [
+      "*"
+    ],
+    "allow_private_network_access": true
+  },
+  "sql_databases": [
+    {
+      "server_id": 0,
+      "encore_name": "mydb",
+      "database_name": "mydb",
+      "user": "my-db-owner",
+      "password": "",
+      "min_connections": 10,
+      "max_connections": 10
+    }
+  ],
+  "sql_servers": [
+    {
+      "host": "my-db-host:5432",
+      "server_ca_cert": "test",
+      "client_cert": "test",
+      "client_key": "test"
+    }
+  ],
+  "pubsub_providers": [
+    {
+      "gcp": {}
+    }
+  ],
+  "pubsub_topics": {
+    "encore-topic": {
+      "encore_name": "encore-topic",
+      "provider_id": 0,
+      "provider_name": "gcp-topic-name",
+      "subscriptions": {
+        "encore-subscription": {
+          "id": "test",
+          "encore_name": "encore-subscription",
+          "provider_name": "gcp-subscription-name",
+          "push_only": true,
+          "gcp": {
+            "project_id": "test",
+            "push_service_account": "test"
+          }
+        }
+      },
+      "gcp": {
+        "project_id": "my-project"
+      }
+    }
+  },
+  "bucket_providers": [],
+  "redis_servers": [
+    {
+      "host": "my-redis-host",
+      "user": "encoreredis",
+      "enable_tls": true,
+      "server_ca_cert": "test",
+      "client_cert": "test",
+      "client_key": "test"
+    }
+  ],
+  "redis_databases": [
+    {
+      "server_id": 0,
+      "encore_name": "encoreredis",
+      "database": 5,
+      "min_connections": 10,
+      "max_connections": 10,
+      "key_prefix": "my-app:my-env:"
+    }
+  ],
+  "metrics": {
+    "prometheus": {
+      "RemoteWriteURL": "https://my-remote-write-url"
+    }
+  },
+  "gateways": [
+    {
+      "name": "api-gateway",
+      "host": ""
+    }
+  ],
+  "hosted_services": [
+    "my-service",
+    "my-service2"
+  ],
+  "service_discovery": {
+    "myservice": {
+      "name": "myservice",
+      "url": "https://my-service:8044",
+      "protocol": "http",
+      "service_auth": {
+        "method": "encore-auth"
+      }
+    },
+    "myservice2": {
+      "name": "myservice2",
+      "url": "https://my-service2:8044",
+      "protocol": "http",
+      "service_auth": {
+        "method": "encore-auth"
+      }
+    }
+  },
+  "service_auth": [
+    {
+      "method": "encore-auth"
+    }
+  ],
+  "shutdown_timeout": 0,
+  "graceful_shutdown": {
+    "total": 30000000000,
+    "shutdown_hooks": 10000000000,
+    "handlers": 20000000000
+  }
+}
diff --git a/runtimes/go/appruntime/exported/config/infra/validation.go b/runtimes/go/appruntime/exported/config/infra/validation.go
new file mode 100644
index 0000000000..4946ad6003
--- /dev/null
+++ b/runtimes/go/appruntime/exported/config/infra/validation.go
@@ -0,0 +1,199 @@
+package infra
+
+import (
+	"cmp"
+	"errors"
+	"fmt"
+	"slices"
+
+	"github.com/modern-go/reflect2"
+)
+
+type JSONPath string
+
+func (j JSONPath) String() string {
+	return string(j)
+}
+
+func (j JSONPath) Append(path JSONPath) JSONPath {
+	return JSONPath(fmt.Sprintf("%s.%s", j, path))
+}
+
+func Ancestor[T any](a *validator) T {
+	for a != nil {
+		if v, ok := a.instance.(T); ok {
+			return v
+		}
+		a = a.parent
+	}
+	var t T
+	return t
+}
+
+type Predicate func() error
+
+func Err(err string) Predicate {
+	return func() error {
+		return errors.New(err)
+	}
+}
+
+func AnyNonZero[T comparable](v ...T) Predicate {
+	return func() error {
+		var zero T
+		for _, val := range v {
+			if zero != val {
+				return nil
+			}
+		}
+		return errors.New("Must not be empty")
+	}
+}
+
+func OneOf[T comparable](v T, vals ...T) Predicate {
+	return func() error {
+		if !slices.Contains(vals, v) {
+			return errors.New("Must be one of: " + fmt.Sprint(vals))
+		}
+		return nil
+	}
+}
+
+func NotZero[T comparable](v T) Predicate {
+	return func() error {
+		var zero T
+		if zero == v {
+			return errors.New("Must not be empty")
+		}
+		return nil
+	}
+}
+
+func NilOr[T any](v *T, predFns ...func(T) Predicate) Predicate {
+	return func() error {
+		if v == nil {
+			return nil
+		}
+		for _, predFn := range predFns {
+			if err := predFn(*v)(); err != nil {
+				return err
+			}
+		}
+		return nil
+	}
+}
+
+func Between[T cmp.Ordered](from, to T) func(T) Predicate {
+	return func(t T) Predicate {
+		return func() error {
+			if t < from || t > to {
+				return fmt.Errorf("Must be between %v and %v (inclusive)", from, to)
+			}
+			return nil
+		}
+	}
+}
+
+func GreaterOrEqual[T cmp.Ordered](than T) func(T) Predicate {
+	return func(t T) Predicate {
+		return func() error {
+			if t < than {
+				return fmt.Errorf("Must be greater than or equal to %v", than)
+			}
+			return nil
+		}
+	}
+}
+
+type EnvDesc struct {
+	Name        string `json:"name,omitempty"`
+	Description string `json:"description,omitempty"`
+}
+
+func Validate(v Validatable) (map[JSONPath]EnvDesc, map[JSONPath]error) {
+	root := &validator{instance: v, envDescs: make(map[string]EnvDesc), errors: make(map[string]error)}
+	v.Validate(root)
+	return root.Collect()
+}
+
+func ValidateChildList[T Validatable](v *validator, name string, items []T) {
+	for i, item := range items {
+		v.ValidateChild(fmt.Sprintf("%s[%d]", name, i), item)
+	}
+}
+
+func ValidateChildMap[T Validatable](v *validator, name string, items map[string]T) {
+	for k, item := range items {
+		v.ValidateChild(fmt.Sprintf("%s.%s", name, k), item)
+	}
+}
+
+type validator struct {
+	parent   *validator
+	name     string
+	instance Validatable
+	envDescs map[string]EnvDesc
+	errors   map[string]error
+	children []*validator
+}
+
+func (val *validator) Collect() (map[JSONPath]EnvDesc, map[JSONPath]error) {
+	envDescs := map[JSONPath]EnvDesc{}
+	errors := map[JSONPath]error{}
+	for k, v := range val.envDescs {
+		envDescs[JSONPath(val.name).Append(JSONPath(k))] = v
+	}
+	for k, v := range val.errors {
+		errors[JSONPath(val.name).Append(JSONPath(k))] = v
+	}
+	for _, child := range val.children {
+		childEnvDescs, childErrors := child.Collect()
+		for k, v := range childEnvDescs {
+			envDescs[JSONPath(val.name).Append(k)] = v
+		}
+		for k, v := range childErrors {
+			errors[JSONPath(val.name).Append(k)] = v
+		}
+	}
+	return envDescs, errors
+}
+
+func (v *validator) ValidatePtrEnvRef(name string, ref *EnvString, envDesc string, predFn func(string) Predicate) {
+	if ref == nil {
+		return
+	}
+	v.ValidateEnvString(name, *ref, envDesc, predFn)
+}
+
+func (v *validator) ValidateEnvRef(name string, ref EnvRef, envDesc string) {
+	v.envDescs[name] = ref.Describe(envDesc)
+}
+
+func (v *validator) ValidateEnvString(name string, envStr EnvString, envDesc string, predFn func(string) Predicate) {
+	if envStr.IsEnvRef() {
+		v.ValidateEnvRef(name, *envStr.Env, envDesc)
+	} else if predFn != nil {
+		v.ValidateField(name, predFn(envStr.Str))
+	}
+}
+
+func (v *validator) ValidateField(name string, pred Predicate) {
+	err := pred()
+	if err == nil {
+		return
+	}
+	v.errors[name] = err
+}
+
+func (v *validator) ValidateChild(name string, instance Validatable) {
+	if reflect2.IsNil(instance) {
+		return
+	}
+	child := &validator{name: name, instance: instance, parent: v, envDescs: make(map[string]EnvDesc), errors: make(map[string]error)}
+	instance.Validate(child)
+	v.children = append(v.children, child)
+}
+
+type Validatable interface {
+	Validate(validator *validator)
+}
diff --git a/runtimes/go/appruntime/exported/config/parse.go b/runtimes/go/appruntime/exported/config/parse.go
new file mode 100644
index 0000000000..539a2ef3a0
--- /dev/null
+++ b/runtimes/go/appruntime/exported/config/parse.go
@@ -0,0 +1,480 @@
+package config
+
+import (
+	"bytes"
+	"compress/gzip"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/url"
+	"os"
+	"slices"
+	"strings"
+	"time"
+
+	"encore.dev/appruntime/exported/config/infra"
+)
+
+func gunzip(data []byte) ([]byte, error) {
+	gz, err := gzip.NewReader(bytes.NewReader(data))
+	if err != nil {
+		return nil, err
+	}
+	return io.ReadAll(gz)
+}
+
+type ProcessConfig struct {
+	HostedServices    []string       `json:"hosted_services"`
+	HostedGateways    []string       `json:"hosted_gateways"`
+	LocalServicePorts map[string]int `json:"local_service_ports"`
+}
+
+func parseRuntimeConfigEnv(config string) *Runtime {
+	var cfg Runtime
+	// We used to support RawURLEncoding, but now we use StdEncoding.
+	// Try both if StdEncoding fails.
+	var (
+		bytes []byte
+		err   error
+	)
+	config, isGzipped := strings.CutPrefix(config, "gzip:")
+	// nosemgrep
+	if bytes, err = base64.StdEncoding.DecodeString(config); err != nil {
+		bytes, err = base64.RawURLEncoding.DecodeString(config)
+	}
+	if err != nil {
+		log.Fatalln("encore runtime: fatal error: could not decode encore runtime config:", err)
+	}
+	if isGzipped {
+		if bytes, err = gunzip(bytes); err != nil {
+			log.Fatalln("encore runtime: fatal error: could not gunzip encore runtime config:", err)
+		}
+	}
+	if err := json.Unmarshal(bytes, &cfg); err != nil {
+		log.Fatalln("encore runtime: fatal error: could not parse encore runtime config:", err)
+	}
+
+	if _, err := url.Parse(cfg.APIBaseURL); err != nil {
+		log.Fatalln("encore runtime: fatal error: could not parse api base url from encore runtime config:", err)
+	}
+	return &cfg
+}
+
+func parseProcessConfigEnv(processCfg string, cfg *Runtime) {
+	if processCfg == "" {
+		return
+	}
+	bytes, err := base64.StdEncoding.DecodeString(processCfg)
+	if err != nil {
+		log.Fatalln("encore runtime: fatal error: could not decode encore process config:", err)
+	}
+	var procCfg ProcessConfig
+	if err := json.Unmarshal(bytes, &procCfg); err != nil {
+		log.Fatalln("encore runtime: fatal error: could not parse encore process config:", err)
+	}
+	cfg.HostedServices = procCfg.HostedServices
+	var hostedGateways []Gateway
+	for _, name := range procCfg.HostedGateways {
+		i := slices.IndexFunc(cfg.Gateways, func(gw Gateway) bool { return gw.Name == name })
+		if i == -1 {
+			log.Fatalf("encore runtime: fatal error: gateway %q not found in runtime config", name)
+		}
+		hostedGateways = append(hostedGateways, cfg.Gateways[i])
+	}
+	cfg.Gateways = hostedGateways
+
+	// Use noop service auth method if not specified
+	svcAuth := ServiceAuth{"noop"}
+	if len(cfg.ServiceAuth) > 0 {
+		// Use the first service auth method from the runtime config
+		svcAuth = cfg.ServiceAuth[0]
+	}
+
+	for name, port := range procCfg.LocalServicePorts {
+		if cfg.ServiceDiscovery == nil {
+			cfg.ServiceDiscovery = make(map[string]Service)
+		}
+		cfg.ServiceDiscovery[name] = Service{
+			Name:        name,
+			URL:         fmt.Sprintf("http://localhost:%d", port),
+			Protocol:    Http,
+			ServiceAuth: svcAuth,
+		}
+	}
+}
+
+func toPtr[T any](t T) *T {
+	return &t
+}
+
+func LoadInfraConfig(infraCfgPath string) (*infra.InfraConfig, error) {
+	var envCfg infra.InfraConfig
+	file, err := os.Open(infraCfgPath)
+	if err != nil {
+		return nil, fmt.Errorf("could not open infra config: %w", err)
+	}
+	defer func() { _ = file.Close() }()
+
+	decoder := json.NewDecoder(file)
+	err = decoder.Decode(&envCfg)
+	if err != nil {
+		return nil, fmt.Errorf("could not decode infra config: %w", err)
+	}
+	return &envCfg, nil
+}
+
+func parseInfraConfigEnv(infraCfgPath string) *Runtime {
+	var cfg Runtime
+	infraCfg, err := LoadInfraConfig(infraCfgPath)
+	if err != nil {
+		log.Fatalf("encore runtime: fatal error: %v", err)
+	}
+
+	cfg.AppSlug = infraCfg.Metadata.AppID
+	cfg.EnvName = infraCfg.Metadata.EnvName
+	cfg.EnvType = infraCfg.Metadata.EnvType
+	cfg.EnvCloud = infraCfg.Metadata.Cloud
+	cfg.APIBaseURL = infraCfg.Metadata.BaseURL
+	cfg.LogConfig = infraCfg.LogConfig
+
+	// Map graceful shutdown configuration
+	if infraCfg.GracefulShutdown != nil {
+		cfg.GracefulShutdown = &GracefulShutdownTimings{}
+		if infraCfg.GracefulShutdown.Total != nil {
+			cfg.GracefulShutdown.Total = toPtr(time.Duration(*infraCfg.GracefulShutdown.Total) * time.Second)
+		}
+		if infraCfg.GracefulShutdown.ShutdownHooks != nil {
+			cfg.GracefulShutdown.ShutdownHooks = toPtr(time.Duration(*infraCfg.GracefulShutdown.ShutdownHooks) * time.Second)
+		}
+		if infraCfg.GracefulShutdown.Handlers != nil {
+			cfg.GracefulShutdown.Handlers = toPtr(time.Duration(*infraCfg.GracefulShutdown.Handlers) * time.Second)
+		}
+	}
+
+	// Map authentication configuration
+	cfg.ServiceAuth = make([]ServiceAuth, len(infraCfg.Auth))
+	if len(infraCfg.Auth) == 0 {
+		cfg.ServiceAuth = []ServiceAuth{{Method: "noop"}}
+	}
+	for i, auth := range infraCfg.Auth {
+		switch auth.Type {
+		case "key":
+			cfg.ServiceAuth[i] = ServiceAuth{
+				Method: "encore-auth",
+			}
+			cfg.AuthKeys = append(cfg.AuthKeys, EncoreAuthKey{
+				KeyID: uint32(auth.ID),
+				Data:  []byte(auth.Key.Value()),
+			})
+		default:
+			log.Fatalf("encore runtime: fatal error: unsupported auth type %q", auth.Type)
+		}
+	}
+
+	// Map metrics configuration
+	if infraCfg.Metrics != nil {
+		cfg.Metrics = &Metrics{
+			CollectionInterval: time.Duration(infraCfg.Metrics.CollectionInterval) * time.Second,
+		}
+		switch infraCfg.Metrics.Type {
+		case "prometheus":
+			if infraCfg.Metrics.Prometheus != nil {
+				cfg.Metrics.Prometheus = &PrometheusRemoteWriteProvider{
+					infraCfg.Metrics.Prometheus.RemoteWriteURL.Value(),
+				}
+			}
+		case "datadog":
+			if infraCfg.Metrics.Datadog != nil {
+				cfg.Metrics.Datadog = &DatadogProvider{
+					infraCfg.Metrics.Datadog.Site,
+					infraCfg.Metrics.Datadog.APIKey.Value(),
+				}
+			}
+		case "gcp_cloud_monitoring":
+			if infraCfg.Metrics.GCPCloudMonitoring != nil {
+				cfg.Metrics.CloudMonitoring = &GCPCloudMonitoringProvider{
+					infraCfg.Metrics.GCPCloudMonitoring.ProjectID,
+					infraCfg.Metrics.GCPCloudMonitoring.MonitoredResourceType,
+					infraCfg.Metrics.GCPCloudMonitoring.MonitoredResourceLabels,
+					infraCfg.Metrics.GCPCloudMonitoring.MetricNames,
+				}
+			}
+		case "aws_cloudwatch":
+			if infraCfg.Metrics.AWSCloudWatch != nil {
+				cfg.Metrics.CloudWatch = &AWSCloudWatchMetricsProvider{
+					infraCfg.Metrics.AWSCloudWatch.Namespace,
+				}
+			}
+		}
+	}
+
+	// Map SQL servers configuration
+	cfg.SQLServers = make([]*SQLServer, len(infraCfg.SQLServers))
+	for i, sqlServer := range infraCfg.SQLServers {
+		cfg.SQLServers[i] = &SQLServer{
+			Host: sqlServer.Host,
+		}
+		if sqlServer.TLSConfig != nil {
+			cfg.SQLServers[i].ServerCACert = sqlServer.TLSConfig.CA
+			if sqlServer.TLSConfig.ClientCert != nil {
+				cfg.SQLServers[i].ClientCert = sqlServer.TLSConfig.ClientCert.Cert
+				cfg.SQLServers[i].ClientKey = sqlServer.TLSConfig.ClientCert.Key.Value()
+			}
+		}
+
+		for dbName, db := range sqlServer.Databases {
+			cfg.SQLDatabases = append(cfg.SQLDatabases, &SQLDatabase{
+				ServerID:       i,
+				EncoreName:     orDefault(db.Name, dbName),
+				DatabaseName:   dbName,
+				User:           db.Username.Value(),
+				Password:       db.Password.Value(),
+				MinConnections: db.MinConnections,
+				MaxConnections: db.MaxConnections,
+			})
+		}
+	}
+
+	// Map Redis configuration
+	cfg.RedisServers = make([]*RedisServer, len(infraCfg.Redis))
+	var i int
+	for name, redis := range infraCfg.Redis {
+		cfg.RedisServers[i] = &RedisServer{
+			Host: redis.Host,
+		}
+		if redis.TLSConfig != nil {
+			cfg.RedisServers[i].EnableTLS = true
+			cfg.RedisServers[i].ServerCACert = redis.TLSConfig.CA
+			if redis.TLSConfig.ClientCert != nil {
+				cfg.RedisServers[i].ClientCert = redis.TLSConfig.ClientCert.Cert
+				cfg.RedisServers[i].ClientKey = redis.TLSConfig.ClientCert.Key.Value()
+			}
+		}
+		if redis.Auth != nil {
+			switch redis.Auth.Type {
+			case "acl":
+				cfg.RedisServers[i].User = redis.Auth.Username.Value()
+				cfg.RedisServers[i].Password = redis.Auth.Password.Value()
+			case "auth":
+				cfg.RedisServers[i].Password = redis.Auth.AuthString.Value()
+			default:
+				log.Fatalf("encore runtime: fatal error: unsupported redis auth type %q", redis.Auth.Type)
+			}
+		}
+		cfg.RedisDatabases = append(cfg.RedisDatabases, &RedisDatabase{
+			ServerID:       i,
+			EncoreName:     name,
+			Database:       redis.DatabaseIndex,
+			MinConnections: orDefaultPtr(redis.MinConnections, 0),
+			MaxConnections: orDefaultPtr(redis.MaxConnections, 0),
+			KeyPrefix:      orDefaultPtr(redis.KeyPrefix, ""),
+		})
+		i++
+	}
+
+	// Map PubSub configuration
+	cfg.PubsubProviders = make([]*PubsubProvider, len(infraCfg.PubSub))
+	for i, pubsub := range infraCfg.PubSub {
+		switch pubsub.Type {
+		case "gcp_pubsub":
+			cfg.PubsubProviders[i] = &PubsubProvider{
+				GCP: &GCPPubsubProvider{},
+			}
+		case "aws_sns_sqs":
+			cfg.PubsubProviders[i] = &PubsubProvider{
+				AWS: &AWSPubsubProvider{},
+			}
+		case "nsq":
+			cfg.PubsubProviders[i] = &PubsubProvider{
+				NSQ: &NSQProvider{
+					Host: pubsub.NSQ.Hosts,
+				},
+			}
+		}
+		cfg.PubsubTopics = map[string]*PubsubTopic{}
+		for topicName, topic := range pubsub.GetTopics() {
+			switch topic := topic.(type) {
+			case *infra.GCPTopic:
+				cfg.PubsubTopics[topicName] = &PubsubTopic{
+					EncoreName:    topicName,
+					ProviderID:    i,
+					ProviderName:  topic.Name,
+					Subscriptions: map[string]*PubsubSubscription{},
+					GCP: &PubsubTopicGCPData{
+						ProjectID: orDefault(topic.ProjectID, pubsub.GCP.ProjectID),
+					},
+				}
+			case *infra.AWSTopic:
+				cfg.PubsubTopics[topicName] = &PubsubTopic{
+					EncoreName:    topicName,
+					ProviderID:    i,
+					ProviderName:  topic.ARN,
+					Subscriptions: map[string]*PubsubSubscription{},
+				}
+			case *infra.NSQTopic:
+				cfg.PubsubTopics[topicName] = &PubsubTopic{
+					EncoreName:    topicName,
+					ProviderID:    i,
+					ProviderName:  topic.Name,
+					Subscriptions: map[string]*PubsubSubscription{},
+				}
+			}
+
+			for subName, subscription := range topic.GetSubscriptions() {
+				switch subscription := subscription.(type) {
+				case *infra.GCPSub:
+					sub := &PubsubSubscription{
+						EncoreName:   subName,
+						ProviderName: subscription.Name,
+						PushOnly:     subscription.PushConfig != nil,
+						GCP:          &PubsubSubscriptionGCPData{ProjectID: orDefault(subscription.ProjectID, pubsub.GCP.ProjectID)},
+					}
+					if subscription.PushConfig != nil {
+						sub.ID = subscription.PushConfig.ID
+						sub.GCP.PushServiceAccount = subscription.PushConfig.ServiceAccount
+					}
+					cfg.PubsubTopics[topicName].Subscriptions[subName] = sub
+				case *infra.AWSSub:
+					cfg.PubsubTopics[topicName].Subscriptions[subName] = &PubsubSubscription{
+						EncoreName:   subName,
+						ProviderName: subscription.ARN,
+						PushOnly:     false,
+					}
+				case *infra.NSQSub:
+					cfg.PubsubTopics[topicName].Subscriptions[subName] = &PubsubSubscription{
+						EncoreName:   subName,
+						ProviderName: subscription.Name,
+						PushOnly:     false,
+					}
+				}
+			}
+		}
+	}
+
+	// Map Service Discovery configuration
+	cfg.ServiceDiscovery = make(map[string]Service)
+	for name, service := range infraCfg.ServiceDiscovery {
+		cfg.ServiceDiscovery[name] = Service{
+			Name:        name,
+			URL:         service.BaseURL,
+			Protocol:    Http,
+			ServiceAuth: cfg.ServiceAuth[0],
+		}
+	}
+
+	// Map Buckets
+	cfg.BucketProviders = make([]*BucketProvider, len(infraCfg.ObjectStorage))
+	for i, storage := range infraCfg.ObjectStorage {
+		switch storage.Type {
+		case "gcs":
+			cfg.BucketProviders[i] = &BucketProvider{
+				GCS: &GCSBucketProvider{
+					Endpoint: storage.GCS.Endpoint,
+				},
+			}
+		case "s3":
+			cfg.BucketProviders[i] = &BucketProvider{
+				S3: &S3BucketProvider{
+					Region:          storage.S3.Region,
+					Endpoint:        nilOr(storage.S3.Endpoint),
+					AccessKeyID:     nilOr(storage.S3.AccessKeyID),
+					SecretAccessKey: nilOr(storage.S3.SecretAccessKey.Value()),
+				},
+			}
+		}
+		cfg.Buckets = map[string]*Bucket{}
+		for bucketName, bucket := range storage.GetBuckets() {
+			cfg.Buckets[bucketName] = &Bucket{
+				ProviderID:    i,
+				EncoreName:    bucketName,
+				CloudName:     bucket.Name,
+				KeyPrefix:     bucket.KeyPrefix,
+				PublicBaseURL: bucket.PublicBaseURL,
+			}
+		}
+	}
+
+	if infraCfg.CORS != nil {
+		cfg.CORS = &CORS{
+			Debug:                          infraCfg.CORS.Debug,
+			DisableCredentials:             false,
+			AllowOriginsWithCredentials:    infraCfg.CORS.AllowOriginsWithCredentials,
+			AllowOriginsWithoutCredentials: infraCfg.CORS.AllowOriginsWithoutCredentials,
+			ExtraAllowedHeaders:            infraCfg.CORS.AllowHeaders,
+			ExtraExposedHeaders:            infraCfg.CORS.ExposeHeaders,
+			AllowPrivateNetworkAccess:      true,
+		}
+	}
+	// Map hosted services
+	cfg.HostedServices = infraCfg.HostedServices
+	cfg.Gateways = make([]Gateway, len(infraCfg.HostedGateways))
+	for i, gw := range infraCfg.HostedGateways {
+		cfg.Gateways[i] = Gateway{
+			Name: gw,
+		}
+	}
+	return &cfg
+}
+
+func nilOr[T comparable](val T) *T {
+	var zero T
+	if val == zero {
+		return nil
+	}
+	return &val
+
+}
+
+func orDefaultPtr[T any](val *T, def T) T {
+	if val == nil {
+		return def
+	}
+	return *val
+}
+
+func orDefault[T comparable](val T, def T) T {
+	var zero T
+	if val == zero {
+		return def
+	}
+	return val
+}
+
+// ParseRuntime parses the Encore runtime config.
+func ParseRuntime(runtimeConfig, processCfg, infraCfgPath, deployID string) *Runtime {
+	var cfg *Runtime
+	if infraCfgPath != "" {
+		cfg = parseInfraConfigEnv(infraCfgPath)
+	} else if runtimeConfig != "" {
+		cfg = parseRuntimeConfigEnv(runtimeConfig)
+	} else {
+		log.Fatalln("encore runtime: fatal error: no encore runtime or infra config provided")
+	}
+	parseProcessConfigEnv(processCfg, cfg)
+
+	// If the environment deploy ID is set, use that instead of the one
+	// embedded in the runtime config
+	if deployID != "" {
+		cfg.DeployID = deployID
+	}
+
+	return cfg
+}
+
+// ParseStatic parses the Encore static config.
+func ParseStatic(config string) *Static {
+	if config == "" {
+		log.Fatalln("encore runtime: fatal error: no encore static config provided")
+	}
+	bytes, err := base64.StdEncoding.DecodeString(config)
+	if err != nil {
+		log.Fatalln("encore runtime: fatal error: could not decode encore static config:", err)
+	}
+	var cfg Static
+	if err := json.Unmarshal(bytes, &cfg); err != nil {
+		log.Fatalln("encore runtime: fatal error: could not parse encore static config:", err)
+	}
+	return &cfg
+}
diff --git a/runtimes/go/appruntime/exported/config/parse_test.go b/runtimes/go/appruntime/exported/config/parse_test.go
new file mode 100644
index 0000000000..df0f575b11
--- /dev/null
+++ b/runtimes/go/appruntime/exported/config/parse_test.go
@@ -0,0 +1,151 @@
+package config
+
+import (
+	"bytes"
+	"compress/gzip"
+	"encoding/base64"
+	"encoding/json"
+	"os"
+	"reflect"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+)
+
+func gzipData(data []byte) ([]byte, error) {
+	var b bytes.Buffer
+	gz := gzip.NewWriter(&b)
+	if _, err := gz.Write(data); err != nil {
+		return nil, err
+	}
+	if err := gz.Close(); err != nil {
+		return nil, err
+	}
+	return b.Bytes(), nil
+}
+
+func TestGZippedContent(t *testing.T) {
+	var tests = map[string]struct {
+		GZip          bool
+		Config        *Runtime
+		ProcessConfig *ProcessConfig
+		MergedConfig  *Runtime
+	}{
+		"zipped": {
+			GZip: true,
+			Config: &Runtime{
+				AppSlug: "no-env-ref",
+				PubsubTopics: map[string]*PubsubTopic{
+					"one": {
+						EncoreName: "testTopic1",
+					},
+				},
+			},
+		},
+		"unzipped": {
+			GZip: false,
+			Config: &Runtime{
+				AppSlug: "test",
+				PubsubTopics: map[string]*PubsubTopic{
+					"one": {
+						EncoreName: "testTopic1",
+					},
+					"two": {
+						EncoreName: "testTopic2",
+					},
+				},
+			},
+		},
+		"process-config-wo-gw": {
+			GZip: false,
+			Config: &Runtime{
+				AppSlug:        "test",
+				HostedServices: []string{"one", "two", "three"},
+				Gateways: []Gateway{{
+					Name: "test",
+				}},
+			},
+			ProcessConfig: &ProcessConfig{
+				HostedServices: []string{"one"},
+			},
+			MergedConfig: &Runtime{
+				AppSlug:        "test",
+				HostedServices: []string{"one"},
+			},
+		},
+		"process-config-w-gw": {
+			GZip: false,
+			Config: &Runtime{
+				AppSlug:        "test",
+				HostedServices: []string{"one", "two", "three"},
+				Gateways: []Gateway{{
+					Name: "test",
+					Host: "test",
+				}},
+			},
+			ProcessConfig: &ProcessConfig{
+				HostedGateways: []string{"test"},
+			},
+			MergedConfig: &Runtime{
+				AppSlug: "test",
+				Gateways: []Gateway{{
+					Name: "test",
+					Host: "test",
+				}},
+			},
+		},
+	}
+
+	for name, test := range tests {
+		t.Run(name, func(t *testing.T) {
+			rawData, err := json.Marshal(test.Config)
+			if err != nil {
+				t.Fatalf("could not marshal test data: %v", err)
+			}
+			var cfgString string
+			if test.GZip {
+				data, err := gzipData(rawData)
+				if err != nil {
+					t.Fatalf("could not gzip data: %v", err)
+				}
+				cfgString = "gzip:" + base64.StdEncoding.EncodeToString(data)
+			} else {
+				cfgString = base64.StdEncoding.EncodeToString(rawData)
+			}
+
+			expected := test.Config
+			procCfg := ""
+			if test.ProcessConfig != nil {
+				expected = test.MergedConfig
+				rawData, err := json.Marshal(test.ProcessConfig)
+				if err != nil {
+					t.Fatalf("could not marshal process config: %v", err)
+				}
+				procCfg = base64.StdEncoding.EncodeToString(rawData)
+			}
+			resp := ParseRuntime(cfgString, procCfg, "", "")
+			if !reflect.DeepEqual(resp, expected) {
+				t.Fatalf("expected %+v, got %+v", test.Config, resp)
+			}
+		})
+	}
+}
+
+func TestParseInfraConfigEnv(t *testing.T) {
+	c := qt.New(t)
+
+	// Parse the infra config using parseInfraConfigEnv
+	parsedRuntime := parseInfraConfigEnv("infra/testdata/infra.config.json")
+
+	// Read the runtime test data file
+	runtimeData, err := os.ReadFile("infra/testdata/runtime.json")
+	c.Assert(err, qt.IsNil)
+
+	// Unmarshal the runtime JSON data into Runtime
+	var expectedRuntime Runtime
+	err = json.Unmarshal(runtimeData, &expectedRuntime)
+	c.Assert(err, qt.IsNil)
+
+	// Compare the parsed runtime with the expected runtime
+	c.Assert(parsedRuntime, qt.DeepEquals, &expectedRuntime)
+}
diff --git a/runtimes/go/appruntime/exported/experiments/cli.go b/runtimes/go/appruntime/exported/experiments/cli.go
new file mode 100644
index 0000000000..0ed9a2bac1
--- /dev/null
+++ b/runtimes/go/appruntime/exported/experiments/cli.go
@@ -0,0 +1,74 @@
+//go:build !encore_app
+
+// Note this file is only included by the CLI and not by the app runtime.
+
+package experiments
+
+import (
+	"os"
+	"strings"
+)
+
+// FromAppFileAndEnviron creates an experiment set which represents the enabled experiments
+// within a particular run of Encore.
+//
+// All errors reported by FromAppFileAndEnviron are due to unknown experiment names.
+// The error type is of type *UnknownExperimentError.
+func FromAppFileAndEnviron(fromAppFile []Name, environ []string) (*Set, error) {
+	const envName = "ENCORE_EXPERIMENT"
+
+	set := &Set{make(map[Name]struct{})}
+
+	// Add experiments enabled in the app file
+	if err := set.add(fromAppFile...); err != nil {
+		return nil, err
+	}
+
+	// Grab experiments from the environmental variables of this process.
+	if val := os.Getenv(envName); val != "" {
+		if err := set.add(parseEnvVal(val)...); err != nil {
+			return nil, err
+		}
+	}
+
+	// Grab experiments from the environmental variables of the caller
+	const prefix = envName + "="
+	for _, env := range environ {
+		if strings.HasPrefix(env, prefix) {
+			val := env[len(prefix):]
+			if err := set.add(parseEnvVal(val)...); err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	return set, nil
+}
+
+func (s *Set) add(keys ...Name) error {
+	for _, key := range keys {
+		if key == "" {
+			continue
+		}
+
+		if !key.Valid() {
+			return &UnknownExperimentError{key}
+		}
+		s.enabled[key] = struct{}{}
+	}
+	return nil
+}
+
+func parseEnvVal(val string) []Name {
+	if val == "" {
+		return nil
+	}
+
+	val = strings.Trim(val, `"'`)
+	strs := strings.Split(val, ",")
+	names := make([]Name, len(strs))
+	for i, s := range strs {
+		names[i] = Name(s)
+	}
+	return names
+}
diff --git a/runtimes/go/appruntime/exported/experiments/errors.go b/runtimes/go/appruntime/exported/experiments/errors.go
new file mode 100644
index 0000000000..413dd55069
--- /dev/null
+++ b/runtimes/go/appruntime/exported/experiments/errors.go
@@ -0,0 +1,11 @@
+package experiments
+
+// UnknownExperimentError is an error returned when an app tries to use
+// an experiment that is not known to the current version of Encore.
+type UnknownExperimentError struct {
+	Name Name
+}
+
+func (e *UnknownExperimentError) Error() string {
+	return "unknown experiment: " + string(e.Name)
+}
diff --git a/runtimes/go/appruntime/exported/experiments/names.go b/runtimes/go/appruntime/exported/experiments/names.go
new file mode 100644
index 0000000000..c67a527a54
--- /dev/null
+++ b/runtimes/go/appruntime/exported/experiments/names.go
@@ -0,0 +1,79 @@
+package experiments
+
+// Name is the name of an experiment
+type Name string
+
+const (
+	/* Current experiments are listed here */
+
+	// LocalSecretsOverride is an experiment to allow for secrets
+	// to be overridden with values from a ".secrets.local" file.
+	LocalSecretsOverride Name = "local-secrets-override"
+
+	// Metrics is an experiment to enable metrics.
+	Metrics Name = "metrics"
+
+	// V2 enables the new parser and compiler.
+	V2 Name = "v2"
+
+	// BetaRuntime enables the beta runtime.
+	BetaRuntime Name = "beta-runtime"
+
+	// LocalMultiProcess forces each Encore service to run as it's own independent process locally
+	// without being able to share memory which emulates the behaviour that will be seen in production
+	// in a multi process setup.
+	LocalMultiProcess Name = "local-multi-process"
+
+	// AuthDataRoundTrip forces auth data to be round-tripped through the wireformat
+	// when internal API calls are made.
+	AuthDataRoundTrip Name = "auth-data-round-trip"
+
+	// TypeScript enables building the app with TypeScript support.
+	TypeScript Name = "typescript"
+
+	// StreamTraces enables streaming traces to the Encore platform as they're happening,
+	// as opposed to waiting for the request to finish before starting the upload.
+	StreamTraces Name = "stream-traces"
+
+	// AdaptiveGCPPubSubGoroutines enables adaptive configuration of the number of
+	// goroutines to use on GCP. Useful for applications with a large number of subscriptions.
+	AdaptiveGCPPubSubGoroutines Name = "adaptive-gcp-pubsub-goroutines"
+
+	// TSWorkerThreads enables multiple worker threads for Encore.ts.
+	TSWorkerThreads Name = "ts-worker-threads"
+
+	// BunRuntime enables bun as the nodejs runtime
+	BunRuntime Name = "bun-runtime"
+)
+
+// Valid reports whether the given name is a known experiment.
+func (x Name) Valid() bool {
+	switch x {
+	case LocalSecretsOverride,
+		Metrics,
+		V2,
+		BetaRuntime,
+		LocalMultiProcess,
+		AuthDataRoundTrip,
+		TypeScript,
+		StreamTraces,
+		AdaptiveGCPPubSubGoroutines,
+		TSWorkerThreads,
+		BunRuntime:
+		return true
+	default:
+		return false
+	}
+}
+
+// Enabled returns true if this experiment enabled in the given set
+func (x Name) Enabled(set *Set) bool {
+	if set == nil {
+		// If there's no set, then it's not enabled
+		return false
+	}
+
+	// Does the release set contain this?
+	_, ok := set.enabled[x]
+	return ok
+}
diff --git a/runtimes/go/appruntime/exported/experiments/set.go b/runtimes/go/appruntime/exported/experiments/set.go
new file mode 100644
index 0000000000..3856a857ae
--- /dev/null
+++ b/runtimes/go/appruntime/exported/experiments/set.go
@@ -0,0 +1,62 @@
+package experiments
+
+import (
+	"slices"
+
+	"encore.dev/appruntime/exported/config"
+)
+
+// Set is a set of experiments enabled within this app
+type Set struct {
+	enabled map[Name]struct{}
+}
+
+// FromConfig constructs a new Experiments object from both the static and runtime configs.
+//
+// It is used by the Encore runtime to construct the Experiments set in a running application.
+//
+// Unknown experiments are ignored.
+func FromConfig(static *config.Static, runtime *config.Runtime) *Set {
+	e := &Set{make(map[Name]struct{})}
+
+	// Note we don't check for valid experiments here, because the static and runtime configs
+	// are already validated by the compiler, and from the platform side
+	// we might have enabled experiments that are not yet known to the compiler which this
+	// binary was compiled with.
+	if static != nil {
+		for _, exp := range static.EnabledExperiments {
+			e.enabled[Name(exp)] = struct{}{}
+		}
+	}
+
+	if runtime != nil {
+		for _, exp := range runtime.DynamicExperiments {
+			e.enabled[Name(exp)] = struct{}{}
+		}
+	}
+
+	return e
+}
+
+// List returns a list of all experiments enabled in this set.
+func (s *Set) List() []Name {
+	if s == nil {
+		return nil
+	}
+	names := make([]Name, 0, len(s.enabled))
+	for key := range s.enabled {
+		names = append(names, key)
+	}
+	slices.Sort(names)
+	return names
+}
+
+// StringList returns a list of all experiments enabled in this set.
+func (s *Set) StringList() []string {
+	names := s.List()
+	rtn := make([]string, len(names))
+	for i, n := range names {
+		rtn[i] = string(n)
+	}
+	return rtn
+}
diff --git a/runtimes/go/appruntime/exported/model/request.go b/runtimes/go/appruntime/exported/model/request.go
new file mode 100644
index 0000000000..6dddf1b01f
--- /dev/null
+++ b/runtimes/go/appruntime/exported/model/request.go
@@ -0,0 +1,282 @@
+package model
+
+import (
+	"context"
+	"net/http"
+	"reflect"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/rs/zerolog"
+)
+
+type TraceEventID uint64
+
+type RequestType byte
+
+const (
+	RPCCall       RequestType = 0x01
+	AuthHandler   RequestType = 0x02
+	PubSubMessage RequestType = 0x03
+	Test          RequestType = 0x04
+)
+
+type RPCDesc struct {
+	Service      string
+	SvcNum       uint16
+	Endpoint     string
+	AuthHandler  bool // true if this is an auth handler
+	Raw          bool
+	RequestType  reflect.Type // nil if no payload
+	ResponseType reflect.Type // nil if no payload
+	Tags         []string
+}
+
+type PathParams []PathParam
+
+// PathParam represents a parsed path parameter.
+type PathParam struct {
+	Name  string // the name of the path parameter, without leading ':' or '*'.
+	Value string // the parsed path parameter value.
+}
+
+type Request struct {
+	Type             RequestType
+	TraceID          TraceID
+	SpanID           SpanID
+	ParentSpanID     SpanID
+	ParentTraceID    TraceID
+	CallerEventID    TraceEventID // the event that triggered this request
+	ExtCorrelationID string       // The externally-provided correlation ID, if any.
+
+	Start  time.Time
+	Logger *zerolog.Logger
+	Traced bool
+	DefLoc uint32
+
+	// SvcNum is the 1-based index of the service into the service list.
+	// It's here instead of within RPCData/MsgData/Test for performance.
+	SvcNum uint16
+
+	// Set if Type == RPCCall
+	RPCData *RPCData
+
+	// Set if Type == PubSubMessage
+	MsgData *PubSubMsgData
+
+	// If we're running a test, this contains the test information.
+	Test *TestData
+}
+
+// Service reports the current service, if any.
+// It checks the appropriate sub-structure based on the request type.
+func (req *Request) Service() string {
+	switch req.Type {
+	case RPCCall, AuthHandler:
+		return req.RPCData.Desc.Service
+	case PubSubMessage:
+		return req.MsgData.Service
+	default:
+		if req.Test != nil {
+			return req.Test.Service
+		}
+		return ""
+	}
+}
+
+type RPCData struct {
+	Desc *RPCDesc
+
+	// HTTPMethod is the HTTP method used to call the endpoint.
+	// It is not set for auth handlers.
+	HTTPMethod string
+
+	Path       string
+	PathParams PathParams
+
+	// UserID and AuthData are the authentication information
+	// provided for this endpoint. It is not set for auth handlers
+	// as the information is not available yet.
+	UserID   UID
+	AuthData any
+
+	// Decoded request payload, for non-raw requests
+	TypedPayload any
+
+	// NonRawPayload is the JSON-marshalled request payload, if any, or nil.
+	// This is never set for raw requests, as the body hasn't been read yet.
+	NonRawPayload []byte
+
+	// RequestHeaders contains the HTTP headers from the incoming request.
+	RequestHeaders http.Header
+
+	// FromEncorePlatform specifies whether the request was an
+	// authenticated request from the Encore Platform.
+	FromEncorePlatform bool
+
+	// ServiceToServiceCall is true if the request was a service-to-service call.
+	// otherwise it is false if the request originates from outside the Encore application.
+	ServiceToServiceCall bool
+
+	// Mocked is true if the request was handled by a mock.
+	Mocked bool
+}
+
+type PubSubMsgData struct {
+	Service        string
+	Topic          string
+	Subscription   string
+	MessageID      string
+	Published      time.Time
+	Attempt        int
+	DecodedPayload any
+	// Payload is the JSON-encoded payload.
+	Payload []byte
+}
+
+type TestData struct {
+	Ctx     context.Context    // The context we're running for this test
+	Cancel  context.CancelFunc // The function to cancel this tests context
+	Current *testing.T         // The current test running
+	Parent  *Request           // The parent request (if we're looking at sub-tests)
+	Service string             // the service being tested, if any
+	Config  *TestConfig        // The test config (should always be set) and managed by the testsupport Manager
+
+	TestFile string // The file the test is in
+	TestLine uint32 // The line the test is on
+
+	// UserID and AuthData are the test-level auth information,
+	// if overridden.
+	UserID   UID
+	AuthData any
+
+	ServiceInstancesMu sync.Mutex
+	ServiceInstances   map[string]any // The service instances isolated to this test
+
+	Wait sync.WaitGroup // If we're spun up async go routines, this wait allows to the test to wait for them to end
+}
+
+// TestConfig contains configuration for testing,
+//
+// It can either be the global test config, or a per-test config.
+type TestConfig struct {
+	// The parent test config, if any.
+	//
+	// If this is not set, then this test config exists at the global level.
+	Parent *TestConfig
+
+	// Lock for the below fields
+	Mu sync.RWMutex
+
+	ServiceMocks     map[string]ServiceMock
+	APIMocks         map[string]map[string]ApiMock
+	IsolatedServices *bool                // Whether to isolate services for this test
+	EndCallbacks     []func(t *testing.T) // Callbacks to run when the test ends
+}
+
+type ServiceMock struct {
+	Service       any
+	RunMiddleware bool
+}
+
+type ApiMock struct {
+	ID            uint64
+	Function      any
+	RunMiddleware bool
+}
+
+type Response struct {
+	// HTTPStatus is the HTTP status to respond with.
+	HTTPStatus int
+
+	// Duration is how long the request took.
+	Duration time.Duration
+
+	// Err is the error returned from the handler or middleware, or nil.
+	Err error
+
+	// Typed response payload, for non-raw requests.
+	TypedPayload any
+
+	// Payload is the response payload, if any, or nil.
+	// It is used for non-raw endpoints as well as auth handlers.
+	Payload []byte
+
+	// AuthUID is the resolved user id if this is an auth handler.
+	AuthUID UID
+
+	// Headers are HTTP headers to add to the response, set by middleware.
+	// For non-raw endpoints, these will be merged with the standard headers.
+	Headers http.Header
+
+	// RawRequestPayload contains the captured request payload, for raw requests.
+	// It is nil if nothing was captured.
+	RawRequestPayload           []byte
+	RawRequestPayloadOverflowed bool // whether the payload overflowed
+
+	// RawResponsePayload contains the captured response payload, for raw requests.
+	// It is nil if nothing was captured.
+	RawResponsePayload           []byte
+	RawResponsePayloadOverflowed bool // whether the payload overflowed
+
+	// RawResponseHeaders specifies the HTTP headers for the outgoing response,
+	// for raw endpoints only.
+	RawResponseHeaders http.Header
+}
+
+type APICall struct {
+	ID     uint64 // call id
+	Source *Request
+	SpanID SpanID // deprecated: this is not used
+	DefLoc uint32
+
+	// Service/endpoint being called
+	TargetServiceName  string
+	TargetEndpointName string
+
+	// Auth info for the target endpoint
+	UserID   UID
+	AuthData any
+
+	StartEventID TraceEventID
+}
+
+type AuthCall struct {
+	ID     uint64 // call id
+	SpanID SpanID
+	DefLoc uint32
+}
+
+type UID string
+
+type AuthInfo struct {
+	UID      UID
+	UserData any
+}
+
+type LogLevel byte
+
+const (
+	LevelTrace LogLevel = 0 // unused; reserve for future use
+	LevelDebug LogLevel = 1
+	LevelInfo  LogLevel = 2
+	LevelWarn  LogLevel = 3
+	LevelError LogLevel = 4
+)
+
+type LogFieldType byte
+
+const (
+	ErrField      LogFieldType = 1
+	StringField   LogFieldType = 2
+	BoolField     LogFieldType = 3
+	TimeField     LogFieldType = 4
+	DurationField LogFieldType = 5
+	UUIDField     LogFieldType = 6
+	JSONField     LogFieldType = 7
+	IntField      LogFieldType = 8
+	UintField     LogFieldType = 9
+	Float32Field  LogFieldType = 10
+	Float64Field  LogFieldType = 11
+)
diff --git a/runtimes/go/appruntime/exported/model/trace.go b/runtimes/go/appruntime/exported/model/trace.go
new file mode 100644
index 0000000000..62475085a0
--- /dev/null
+++ b/runtimes/go/appruntime/exported/model/trace.go
@@ -0,0 +1,78 @@
+package model
+
+import (
+	"crypto/rand"
+	"encoding/base32"
+	"testing"
+	_ "unsafe"
+)
+
+type (
+	TraceID [16]byte
+	SpanID  [8]byte
+)
+
+func (id TraceID) String() string {
+	if id.IsZero() {
+		return ""
+	}
+	return b32.EncodeToString(id[:])
+}
+
+func (id TraceID) IsZero() bool {
+	return id == TraceID{}
+}
+
+func (id SpanID) String() string {
+	if id.IsZero() {
+		return ""
+	}
+	return b32.EncodeToString(id[:])
+}
+
+func (id SpanID) IsZero() bool {
+	return id == SpanID{}
+}
+
+const encodeHex = "0123456789abcdefghijklmnopqrstuv"
+
+var b32 = base32.NewEncoding(encodeHex).WithPadding(base32.NoPadding)
+
+// GenerateConstantValsForTests if true causes GenTraceID and GenSpanID
+// to always generate the constant {0, 0, 0, ..., 1} byte sequence for testing.
+var GenerateConstantValsForTests = false
+
+// GenTraceID generates a new trace id.
+func GenTraceID() (TraceID, error) {
+	if GenerateConstantValsForTests {
+		return TraceID{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1}, nil
+	}
+
+	var traceID TraceID
+	_, err := rand.Read(traceID[:])
+	return traceID, err
+}
+
+// ParseTraceID takes the hex encoded string form of a trace id and returns the bytes
+func ParseTraceID(str string) (TraceID, error) {
+	var traceID TraceID
+	_, err := b32.Decode(traceID[:], []byte(str))
+	return traceID, err
+}
+
+// GenSpanID generates a span id.
+func GenSpanID() (SpanID, error) {
+	if GenerateConstantValsForTests {
+		return SpanID{0, 0, 0, 0, 0, 0, 0, 1}, nil
+	}
+
+	var span SpanID
+	_, err := rand.Read(span[:])
+	return span, err
+}
+
+// EnableTestMode enables generation of sequential trace/span ids for the duration of the test.
+func EnableTestMode(t *testing.T) {
+	GenerateConstantValsForTests = true
+	t.Cleanup(func() { GenerateConstantValsForTests = false })
+}
diff --git a/runtimes/go/appruntime/exported/stack/stack.go b/runtimes/go/appruntime/exported/stack/stack.go
new file mode 100644
index 0000000000..1b524efc7c
--- /dev/null
+++ b/runtimes/go/appruntime/exported/stack/stack.go
@@ -0,0 +1,126 @@
+// Package stack collects stack traces.
+package stack
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"runtime"
+	"strings"
+	"sync"
+)
+
+type Stack struct {
+	Frames []uintptr
+	Off    uintptr
+}
+
+func Build(skip int) Stack {
+	return BuildWithFilters(skip+1, nil)
+}
+
+func BuildWithoutGoRuntime(skip int) Stack {
+	return BuildWithFilters(skip+1, func(pc uintptr) bool {
+		fn := runtime.FuncForPC(pc)
+		if fn == nil {
+			return true
+		}
+		name := fn.Name()
+		return !strings.HasPrefix(name, "runtime.") && !strings.HasPrefix(name, "testing.")
+	})
+}
+
+func BuildWithFilters(skip int, filter func(pcs uintptr) bool) Stack {
+	pcs := make([]uintptr, 101)
+	idx, off := encoreCallers(skip+1, pcs)
+	pcs = pcs[:idx]
+	if idx == 0 {
+		return Stack{}
+	}
+
+	// Apply filters
+	if filter != nil {
+		newPcs := make([]uintptr, 0, len(pcs))
+		for _, pc := range pcs {
+			if filter(pc) {
+				newPcs = append(newPcs, pc)
+			}
+		}
+
+		pcs = newPcs
+	}
+
+	// Go through our PCs and see if we reached a stop PC.
+	stopMu.RLock()
+	for i, pc := range pcs {
+		if stopPCs[pc] {
+			stopMu.RUnlock()
+			return Stack{Frames: pcs[:i], Off: off}
+		}
+	}
+	stopMu.RUnlock()
+
+	for i, p := range pcs {
+		fn := runtime.FuncForPC(p)
+		// Is this a new stop point?
+		if fn != nil && strings.Contains(fn.Name(), "__encore_") {
+			stopMu.Lock()
+			stopPCs[p] = true
+			stopMu.Unlock()
+			return Stack{Frames: pcs[:i], Off: off}
+		}
+	}
+	return Stack{Frames: pcs, Off: off}
+}
+
+func Print(s Stack) {
+	var b bytes.Buffer
+	cf := runtime.CallersFrames(s.Frames)
+	i := 0
+	for {
+		f, more := cf.Next()
+		pc := s.Frames[i] - s.Off
+		fmt.Fprintf(&b, "%d: %s:%d: %s\n", pc, f.File, f.Line, f.Function)
+		if !more {
+			break
+		}
+		i++
+	}
+	if s := b.Bytes(); len(s) > 0 {
+		_, _ = os.Stdout.Write(s)
+	}
+}
+
+type FormattedFrame struct {
+	File string
+	Line int
+	Func string
+}
+
+func Format(s Stack) []FormattedFrame {
+	if len(s.Frames) == 0 {
+		return nil
+	}
+
+	var frames []FormattedFrame
+	cf := runtime.CallersFrames(s.Frames)
+	i := 0
+	for {
+		f, more := cf.Next()
+		frames = append(frames, FormattedFrame{
+			File: f.File,
+			Line: f.Line,
+			Func: f.Function,
+		})
+		if !more {
+			break
+		}
+		i++
+	}
+	return frames
+}
+
+var (
+	stopMu  sync.RWMutex
+	stopPCs = make(map[uintptr]bool)
+)
diff --git a/runtimes/go/appruntime/exported/stack/stack_app.go b/runtimes/go/appruntime/exported/stack/stack_app.go
new file mode 100644
index 0000000000..e38a18e950
--- /dev/null
+++ b/runtimes/go/appruntime/exported/stack/stack_app.go
@@ -0,0 +1,8 @@
+//go:build encore_app
+
+package stack
+
+import _ "unsafe" // for go:linkname
+
+//go:linkname encoreCallers runtime.encoreCallers
+func encoreCallers(skip int, pc []uintptr) (n int, off uintptr)
diff --git a/runtimes/go/appruntime/exported/stack/stack_noapp.go b/runtimes/go/appruntime/exported/stack/stack_noapp.go
new file mode 100644
index 0000000000..951837cfda
--- /dev/null
+++ b/runtimes/go/appruntime/exported/stack/stack_noapp.go
@@ -0,0 +1,18 @@
+//go:build !encore_app
+
+package stack
+
+import "runtime"
+
+func encoreCallers(skip int, pc []uintptr) (n int, off uintptr) {
+	n = runtime.Callers(skip, pc)
+
+	// Outside of an Encore app we can't easily determine the offset.
+	// This is only relevant to be able to construct ASLR-independent
+	// program counters for doing PC lookups from other processes,
+	// such as during trace rendering. This is not something we need
+	// to worry about when not running inside an Encore app.
+	off = 0
+
+	return
+}
diff --git a/runtimes/go/appruntime/exported/stack/stack_test.go b/runtimes/go/appruntime/exported/stack/stack_test.go
new file mode 100644
index 0000000000..7ec33709aa
--- /dev/null
+++ b/runtimes/go/appruntime/exported/stack/stack_test.go
@@ -0,0 +1,23 @@
+package stack
+
+import (
+	"testing"
+)
+
+func BenchmarkBuild(b *testing.B) {
+	sum := 0
+	for i := 0; i < b.N; i++ {
+		n := __encore_foo()
+		sum += n
+	}
+	b.Log(sum)
+}
+
+func __encore_foo() int {
+	return userCode()
+}
+
+func userCode() int {
+	s := Build(2)
+	return len(s.Frames)
+}
diff --git a/runtimes/go/appruntime/exported/trace/events.go b/runtimes/go/appruntime/exported/trace/events.go
new file mode 100644
index 0000000000..202afe599b
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace/events.go
@@ -0,0 +1,530 @@
+package trace
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/beta/errs"
+)
+
+type EventType byte
+
+const (
+	RequestStart       EventType = 0x01
+	RequestEnd         EventType = 0x02
+	GoStart            EventType = 0x03
+	GoEnd              EventType = 0x04
+	GoClear            EventType = 0x05
+	TxStart            EventType = 0x06
+	TxEnd              EventType = 0x07
+	QueryStart         EventType = 0x08
+	QueryEnd           EventType = 0x09
+	CallStart          EventType = 0x0A
+	CallEnd            EventType = 0x0B
+	AuthStart          EventType = 0x0C
+	AuthEnd            EventType = 0x0D
+	HTTPCallStart      EventType = 0x0E
+	HTTPCallEnd        EventType = 0x0F
+	HTTPCallBodyClosed EventType = 0x10
+	LogMessage         EventType = 0x11
+	PublishStart       EventType = 0x12
+	PublishEnd         EventType = 0x13
+	ServiceInitStart   EventType = 0x14
+	ServiceInitEnd     EventType = 0x15
+	CacheOpStart       EventType = 0x16
+	CacheOpEnd         EventType = 0x17
+	BodyStream         EventType = 0x18
+)
+
+func (te EventType) String() string {
+	switch te {
+	case RequestStart:
+		return "RequestStart"
+	case RequestEnd:
+		return "RequestEnd"
+	case GoStart:
+		return "GoStart"
+	case GoEnd:
+		return "GoEnd"
+	case GoClear:
+		return "GoClear"
+	case TxStart:
+		return "TxStart"
+	case TxEnd:
+		return "TxEnd"
+	case QueryStart:
+		return "QueryStart"
+	case QueryEnd:
+		return "QueryEnd"
+	case CallStart:
+		return "CallStart"
+	case CallEnd:
+		return "CallEnd"
+	case AuthStart:
+		return "AuthStart"
+	case AuthEnd:
+		return "AuthEnd"
+	case HTTPCallStart:
+		return "HTTPCallStart"
+	case HTTPCallEnd:
+		return "HTTPCallEnd"
+	case HTTPCallBodyClosed:
+		return "HTTPCallBodyClosed"
+	case LogMessage:
+		return "LogMessage"
+	case PublishStart:
+		return "PublishStart"
+	case PublishEnd:
+		return "PublishEnd"
+	case ServiceInitStart:
+		return "ServiceInitStart"
+	case ServiceInitEnd:
+		return "ServiceInitEnd"
+	case CacheOpStart:
+		return "CacheOpStart"
+	case CacheOpEnd:
+		return "CacheOpEnd"
+	case BodyStream:
+		return "BodyStream"
+	default:
+		return fmt.Sprintf("Unknown(%x)", byte(te))
+	}
+}
+
+func (l *Log) BeginRequest(req *model.Request, goid uint32) {
+	tb := NewBuffer(1 + 8 + 8 + 8 + 8 + 8 + 8 + 64)
+	tb.Byte(byte(req.Type))
+	tb.Now()
+	tb.Bytes(req.TraceID[:])
+	tb.Bytes(req.ParentTraceID[:])
+	tb.Bytes(req.SpanID[:])
+	tb.Bytes(req.ParentSpanID[:])
+	tb.UVarint(uint64(goid))
+	tb.UVarint(uint64(req.DefLoc)) // endpoint expr idx
+
+	switch req.Type {
+	case model.RPCCall:
+		data := req.RPCData
+		desc := data.Desc
+		tb.Bool(desc.Raw)
+		tb.String(desc.Service)
+		tb.String(desc.Endpoint)
+		tb.String(data.HTTPMethod)
+
+		tb.String(data.Path)
+		tb.UVarint(uint64(len(data.PathParams)))
+		for _, pp := range data.PathParams {
+			tb.String(pp.Value)
+		}
+		tb.String(string(data.UserID))
+		tb.String(data.RequestHeaders.Get("X-Request-ID"))
+		tb.String(req.ExtCorrelationID)
+
+		if desc.Raw {
+			l.logHeaders(&tb, data.RequestHeaders)
+		} else {
+			tb.ByteString(data.NonRawPayload)
+		}
+
+	case model.AuthHandler:
+		data := req.RPCData
+		desc := data.Desc
+		tb.String(desc.Service)
+		tb.String(desc.Endpoint)
+		tb.ByteString(data.NonRawPayload)
+
+	case model.PubSubMessage:
+		data := req.MsgData
+		tb.String(data.Service)
+		tb.String(data.Topic)
+		tb.String(data.Subscription)
+		tb.String(data.MessageID)
+		tb.Uint32(uint32(data.Attempt))
+		tb.Time(data.Published)
+		tb.ByteString(data.Payload)
+	}
+
+	l.Add(RequestStart, tb.Buf())
+}
+
+func (l *Log) FinishRequest(req *model.Request, resp *model.Response) {
+	tb := NewBuffer(64)
+	tb.Byte(byte(req.Type))
+	tb.Bytes(req.SpanID[:])
+
+	tb.Err(resp.Err)
+	if resp.Err != nil {
+		tb.Stack(errs.Stack(resp.Err))
+
+		if panicStack, ok := errs.Meta(resp.Err)["panic_stack"].(stack.Stack); ok {
+			tb.FormattedStack(panicStack)
+		} else {
+			tb.FormattedStack(stack.Stack{})
+		}
+	}
+
+	switch req.Type {
+	case model.RPCCall:
+		isRaw := req.RPCData.Desc.Raw
+		tb.Bool(isRaw)
+		if isRaw {
+			l.logHeaders(&tb, resp.RawResponseHeaders)
+		} else {
+			tb.ByteString(resp.Payload)
+		}
+	case model.AuthHandler:
+		tb.String(string(resp.AuthUID))
+		tb.ByteString(resp.Payload)
+	case model.PubSubMessage:
+		tb.ByteString(resp.Payload)
+	}
+
+	l.Add(RequestEnd, tb.Buf())
+}
+
+func (l *Log) BeginCall(call *model.APICall, goid uint32) {
+	tb := NewBuffer(8 + 4 + 4 + 4)
+	tb.UVarint(call.ID)
+	tb.Bytes(call.Source.SpanID[:])
+	tb.Bytes(call.SpanID[:])
+	tb.UVarint(uint64(goid))
+	tb.UVarint(0)                   // call expr idx; no longer used
+	tb.UVarint(uint64(call.DefLoc)) // endpoint expr idx
+	tb.Stack(stack.Build(3))
+	l.Add(CallStart, tb.Buf())
+}
+
+func (l *Log) FinishCall(call *model.APICall, err error) {
+	tb := NewBuffer(8 + 4 + 4 + 4)
+	tb.UVarint(call.ID)
+	if err != nil {
+		msg := err.Error()
+		if msg == "" {
+			msg = "unknown error"
+		}
+		tb.String(msg)
+	} else {
+		tb.String("")
+	}
+	l.Add(CallEnd, tb.Buf())
+}
+
+func (l *Log) BeginAuth(call *model.AuthCall, goid uint32) {
+	tb := NewBuffer(8 + 4 + 4 + 4)
+	tb.UVarint(call.ID)
+	tb.Bytes(call.SpanID[:])
+	tb.UVarint(uint64(goid))
+	tb.UVarint(uint64(call.DefLoc)) // auth handler expr idx
+	l.Add(AuthStart, tb.Buf())
+}
+
+func (l *Log) FinishAuth(call *model.AuthCall, uid model.UID, err error) {
+	tb := NewBuffer(64)
+	tb.UVarint(call.ID)
+	tb.String(string(uid))
+	if err != nil {
+		msg := err.Error()
+		if msg == "" {
+			msg = "unknown error"
+		}
+		tb.String(msg)
+		tb.Stack(errs.Stack(err))
+	} else {
+		tb.String("")
+		tb.Stack(stack.Stack{}) // no stack
+	}
+	l.Add(AuthEnd, tb.Buf())
+}
+
+type DBQueryStartParams struct {
+	Query   string
+	SpanID  model.SpanID
+	Goid    uint32
+	QueryID uint64
+	TxID    uint64
+	Stack   stack.Stack
+}
+
+func (l *Log) DBQueryStart(p DBQueryStartParams) {
+	var tb Buffer
+	tb.UVarint(p.QueryID)
+	tb.Bytes(p.SpanID[:])
+	tb.UVarint(p.TxID)
+	tb.UVarint(uint64(p.Goid))
+	tb.String(p.Query)
+	tb.Stack(p.Stack)
+	l.Add(QueryStart, tb.Buf())
+}
+
+func (l *Log) DBQueryEnd(queryID uint64, err error) {
+	var tb Buffer
+	tb.UVarint(queryID)
+	if err != nil {
+		tb.String(err.Error())
+	} else {
+		tb.String("")
+	}
+	l.Add(QueryEnd, tb.Buf())
+}
+
+type DBTxStartParams struct {
+	SpanID model.SpanID
+	Goid   uint32
+	TxID   uint64
+	Stack  stack.Stack
+}
+
+func (l *Log) DBTxStart(p DBTxStartParams) {
+	var tb Buffer
+	tb.UVarint(p.TxID)
+	tb.Bytes(p.SpanID[:])
+	tb.UVarint(uint64(p.Goid))
+	tb.Stack(p.Stack)
+	l.Add(TxStart, tb.Buf())
+}
+
+type DBTxEndParams struct {
+	SpanID model.SpanID
+	Goid   uint32
+	TxID   uint64
+	Commit bool
+	Err    error
+	Stack  stack.Stack
+}
+
+func (l *Log) DBTxEnd(p DBTxEndParams) {
+	var tb Buffer
+	tb.UVarint(p.TxID)
+	tb.Bytes(p.SpanID[:])
+	tb.UVarint(uint64(p.Goid))
+	if p.Commit {
+		tb.Byte(1)
+	} else {
+		tb.Byte(0)
+	}
+	if p.Err != nil {
+		tb.String(p.Err.Error())
+	} else {
+		tb.String("")
+	}
+	tb.Stack(p.Stack)
+	l.Add(TxEnd, tb.Buf())
+}
+
+func (l *Log) PublishStart(topic string, msg []byte, spanID model.SpanID, goid uint32, publishID uint64, skipFrames int) {
+	var tb Buffer
+	tb.UVarint(publishID)
+	tb.Bytes(spanID[:])
+	tb.UVarint(uint64(goid))
+	tb.String(topic)
+	tb.ByteString(msg)
+	tb.Stack(stack.Build(skipFrames))
+	l.Add(PublishStart, tb.Buf())
+}
+
+func (l *Log) PublishEnd(publishID uint64, messageID string, err error) {
+	var tb Buffer
+	tb.UVarint(publishID)
+	tb.String(messageID)
+	tb.Err(err)
+	l.Add(PublishEnd, tb.Buf())
+}
+
+func (l *Log) GoStart(spanID model.SpanID, goctr uint32) {
+	l.Add(GoStart, []byte{
+		spanID[0],
+		spanID[1],
+		spanID[2],
+		spanID[3],
+		spanID[4],
+		spanID[5],
+		spanID[6],
+		spanID[7],
+		byte(goctr),
+		byte(goctr >> 8),
+		byte(goctr >> 16),
+		byte(goctr >> 24),
+	})
+}
+
+func (l *Log) GoClear(spanID model.SpanID, goctr uint32) {
+	l.Add(GoClear, []byte{
+		spanID[0],
+		spanID[1],
+		spanID[2],
+		spanID[3],
+		spanID[4],
+		spanID[5],
+		spanID[6],
+		spanID[7],
+		byte(goctr),
+		byte(goctr >> 8),
+		byte(goctr >> 16),
+		byte(goctr >> 24),
+	})
+}
+
+func (l *Log) GoEnd(spanID model.SpanID, goctr uint32) {
+	l.Add(GoEnd, []byte{
+		spanID[0],
+		spanID[1],
+		spanID[2],
+		spanID[3],
+		spanID[4],
+		spanID[5],
+		spanID[6],
+		spanID[7],
+		byte(goctr),
+		byte(goctr >> 8),
+		byte(goctr >> 16),
+		byte(goctr >> 24),
+	})
+}
+
+type ServiceInitStartParams struct {
+	InitCtr uint64
+	SpanID  model.SpanID
+	Goctr   uint32
+	DefLoc  int32
+	Service string
+}
+
+func (l *Log) ServiceInitStart(p ServiceInitStartParams) {
+	var tb Buffer
+	tb.Bytes(p.SpanID[:])
+	tb.UVarint(p.InitCtr)
+	tb.UVarint(uint64(p.Goctr))
+	tb.UVarint(uint64(p.DefLoc))
+	tb.String(p.Service)
+	l.Add(ServiceInitStart, tb.Buf())
+}
+
+func (l *Log) ServiceInitEnd(initCtr uint64, err error) {
+	var tb Buffer
+	tb.UVarint(initCtr)
+	tb.Err(err)
+	if err != nil {
+		tb.Stack(errs.Stack(err))
+	}
+	l.Add(ServiceInitEnd, tb.Buf())
+}
+
+type CacheOpStartParams struct {
+	DefLoc    int32
+	Operation string
+	IsWrite   bool
+	Keys      []string
+	Inputs    [][]byte
+	SpanID    model.SpanID
+	Goid      uint32
+	OpID      uint64
+	Stack     stack.Stack
+}
+
+func (l *Log) CacheOpStart(p CacheOpStartParams) {
+	var tb Buffer
+	tb.UVarint(p.OpID)
+	tb.Bytes(p.SpanID[:])
+	tb.UVarint(uint64(p.Goid))
+	tb.UVarint(uint64(p.DefLoc))
+	tb.String(p.Operation)
+	tb.Bool(p.IsWrite)
+	tb.Stack(p.Stack)
+
+	tb.UVarint(uint64(len(p.Keys)))
+	for _, k := range p.Keys {
+		tb.String(k)
+	}
+
+	tb.UVarint(uint64(len(p.Inputs)))
+	suffix := []byte("...")
+	for _, val := range p.Inputs {
+		const maxLen = 4 * 1024 // 4KiB
+		tb.TruncatedByteString(val, maxLen, suffix)
+	}
+
+	l.Add(CacheOpStart, tb.Buf())
+}
+
+type CacheOpEndParams struct {
+	OpID    uint64
+	Res     CacheOpResult
+	Err     error // must be set iff Res == CacheErr
+	Outputs [][]byte
+}
+
+func (l *Log) CacheOpEnd(p CacheOpEndParams) {
+	var tb Buffer
+	tb.UVarint(p.OpID)
+	tb.Byte(byte(p.Res))
+	if p.Res == CacheErr {
+		err := p.Err
+		if err == nil {
+			err = errors.New("unknown error")
+		}
+		tb.Err(err)
+	}
+
+	tb.UVarint(uint64(len(p.Outputs)))
+	suffix := []byte("...")
+	for _, val := range p.Outputs {
+		const maxLen = 4 * 1024 // 4KiB
+		tb.TruncatedByteString(val, maxLen, suffix)
+	}
+	l.Add(CacheOpEnd, tb.Buf())
+}
+
+type CacheOpResult uint8
+
+const (
+	CacheOK        CacheOpResult = 1
+	CacheNoSuchKey CacheOpResult = 2
+	CacheConflict  CacheOpResult = 3
+	CacheErr       CacheOpResult = 4
+)
+
+type BodyStreamParams struct {
+	SpanID model.SpanID
+
+	// IsResponse specifies whether the stream was a response body
+	// or a request body.
+	IsResponse bool
+
+	// Overflowed specifies whether the capturing overflowed.
+	Overflowed bool
+
+	// Data is the data read.
+	Data []byte
+}
+
+func (l *Log) BodyStream(p BodyStreamParams) {
+	var tb Buffer
+	tb.Bytes(p.SpanID[:])
+
+	var flags byte = 0
+	if p.IsResponse {
+		flags |= 1 << 0
+	}
+	if p.Overflowed {
+		flags |= 1 << 1
+	}
+	tb.Byte(flags)
+
+	tb.ByteString(p.Data)
+	l.Add(BodyStream, tb.Buf())
+}
+
+func (l *Log) logHeaders(tb *Buffer, headers http.Header) {
+	tb.UVarint(uint64(len(headers)))
+	for k, v := range headers {
+		firstVal := ""
+		if len(v) > 0 {
+			firstVal = v[0]
+		}
+		tb.String(k)
+		tb.String(firstVal)
+	}
+}
diff --git a/runtimes/go/appruntime/exported/trace/http.go b/runtimes/go/appruntime/exported/trace/http.go
new file mode 100644
index 0000000000..ea8c5f7e05
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace/http.go
@@ -0,0 +1,359 @@
+package trace
+
+import (
+	"context"
+	"crypto/tls"
+	"io"
+	"net/http"
+	"net/http/httptrace"
+	"net/textproto"
+	"sync"
+	"sync/atomic"
+	_ "unsafe" // for go:linkname
+
+	model2 "encore.dev/appruntime/exported/model"
+)
+
+func (l *Log) HTTPBeginRoundTrip(httpReq *http.Request, req *model2.Request, goid uint32) (context.Context, error) {
+	if l == nil {
+		return httpReq.Context(), nil
+	}
+
+	spanID, err := model2.GenSpanID()
+	if err != nil {
+		return nil, err
+	}
+
+	reqID := atomic.AddUint64(&httpReqIDCtr, 1)
+
+	tb := NewBuffer(8 + 4 + 4 + 4 + len(httpReq.Method) + 128)
+	tb.UVarint(reqID)
+	tb.Bytes(req.SpanID[:])
+	tb.Bytes(spanID[:])
+	tb.UVarint(uint64(goid))
+	tb.String(httpReq.Method)
+	tb.String(httpReq.URL.String())
+
+	l.Add(HTTPCallStart, tb.Buf())
+
+	rt := &httpRoundTrip{
+		ReqID:  reqID,
+		SpanID: spanID,
+		log:    l,
+	}
+	ctx := context.WithValue(httpReq.Context(), rtKey, rt)
+	tr := &httptrace.ClientTrace{
+		GetConn:              rt.getConn,
+		GotConn:              rt.gotConn,
+		GotFirstResponseByte: rt.gotFirstResponseByte,
+		Got1xxResponse:       rt.got1xxResponse,
+		DNSStart:             rt.dnsStart,
+		DNSDone:              rt.dnsDone,
+		ConnectStart:         rt.connectStart,
+		ConnectDone:          rt.connectDone,
+		TLSHandshakeStart:    rt.tlsHandshakeStart,
+		TLSHandshakeDone:     rt.tlsHandshakeDone,
+		WroteHeaders:         rt.wroteHeaders,
+		Wait100Continue:      rt.wait100Continue,
+		WroteRequest:         rt.wroteRequest,
+	}
+	return httptrace.WithClientTrace(ctx, tr), nil
+}
+
+func (l *Log) HTTPCompleteRoundTrip(req *http.Request, resp *http.Response, err error) {
+	rt, ok := req.Context().Value(rtKey).(*httpRoundTrip)
+	if !ok {
+		return
+	}
+
+	tb := NewBuffer(8 + 4 + 4 + 4)
+	tb.UVarint(rt.ReqID)
+	if err != nil {
+		msg := err.Error()
+		if msg == "" {
+			msg = "unknown error"
+		}
+		tb.String(msg)
+		tb.UVarint(0)
+	} else {
+		tb.String("")
+		tb.UVarint(uint64(resp.StatusCode))
+	}
+	rt.encodeEvents(&tb)
+	rt.log.Add(HTTPCallEnd, tb.Buf())
+
+	if req.Method != "HEAD" && resp != nil {
+		resp.Body = wrapRespBody(resp.Body, rt)
+	}
+}
+
+var httpReqIDCtr uint64
+
+type httpRoundTrip struct {
+	ReqID  uint64
+	SpanID model2.SpanID
+
+	log Logger
+
+	mu     sync.Mutex
+	events []httpEvent
+}
+
+func (rt *httpRoundTrip) getConn(hostPort string) {
+	rt.addEvent(getConn, &getConnEvent{hostPort: hostPort})
+}
+
+func (rt *httpRoundTrip) gotConn(info httptrace.GotConnInfo) {
+	rt.addEvent(gotConn, &gotConnEvent{info: info})
+}
+
+func (rt *httpRoundTrip) gotFirstResponseByte() {
+	rt.addEvent(gotFirstResponseByte, nil)
+}
+
+func (rt *httpRoundTrip) got1xxResponse(code int, header textproto.MIMEHeader) error {
+	rt.addEvent(got1xxResponse, &got1xxResponseEvent{code: code, header: header})
+	return nil
+}
+
+func (rt *httpRoundTrip) dnsStart(info httptrace.DNSStartInfo) {
+	rt.addEvent(dnsStart, &dnsStartEvent{info: info})
+}
+
+func (rt *httpRoundTrip) dnsDone(info httptrace.DNSDoneInfo) {
+	rt.addEvent(dnsDone, &dnsDoneEvent{info: info})
+}
+
+func (rt *httpRoundTrip) connectStart(network, addr string) {
+	rt.addEvent(connectStart, &connectStartEvent{network: network, addr: addr})
+}
+
+func (rt *httpRoundTrip) connectDone(network, addr string, err error) {
+	rt.addEvent(connectDone, &connectDoneEvent{network: network, addr: addr, err: err})
+}
+
+func (rt *httpRoundTrip) tlsHandshakeStart() {
+	rt.addEvent(tlsHandshakeStart, nil)
+}
+
+func (rt *httpRoundTrip) tlsHandshakeDone(state tls.ConnectionState, err error) {
+	rt.addEvent(tlsHandshakeDone, &tlsHandshakeDoneEvent{info: state, err: err})
+}
+
+func (rt *httpRoundTrip) wroteHeaders() {
+	rt.addEvent(wroteHeaders, nil)
+}
+
+func (rt *httpRoundTrip) wroteRequest(info httptrace.WroteRequestInfo) {
+	rt.addEvent(wroteRequest, &wroteRequestEvent{info: info})
+}
+
+func (rt *httpRoundTrip) wait100Continue() {
+	rt.addEvent(wait100Continue, nil)
+}
+
+func (rt *httpRoundTrip) addEvent(code httpEventCode, data httpEventData) {
+	ts := nanotime()
+	rt.mu.Lock()
+	defer rt.mu.Unlock()
+
+	rt.events = append(rt.events, httpEvent{
+		code: code,
+		ts:   ts,
+		data: data,
+	})
+}
+
+func (rt *httpRoundTrip) encodeEvents(tb *Buffer) {
+	rt.mu.Lock()
+	n := len(rt.events)
+	evs := rt.events[:]
+	rt.mu.Unlock()
+
+	tb.UVarint(uint64(n))
+	for _, e := range evs {
+		tb.Bytes([]byte{byte(e.code)})
+		tb.Int64(e.ts)
+		if e.data != nil {
+			e.data.Encode(tb)
+		}
+	}
+}
+
+func (rt *httpRoundTrip) ClosedBody(err error) {
+	tb := NewBuffer(8 + 4)
+	tb.UVarint(rt.ReqID)
+	if err != nil {
+		msg := err.Error()
+		if msg == "" {
+			msg = "unknown error"
+		}
+		tb.String(msg)
+	} else {
+		tb.String("")
+	}
+
+	rt.log.Add(HTTPCallBodyClosed, tb.Buf())
+}
+
+func wrapRespBody(body io.ReadCloser, rt *httpRoundTrip) io.ReadCloser {
+	if readWriteCloser, ok := body.(io.ReadWriteCloser); ok {
+		return writerCloseTracker{readWriteCloser, rt}
+	}
+	return closeTracker{body, rt}
+}
+
+type closeTracker struct {
+	io.ReadCloser
+	rt *httpRoundTrip
+}
+
+func (c closeTracker) Close() error {
+	err := c.ReadCloser.Close()
+	c.rt.ClosedBody(err)
+	return err
+}
+
+type writerCloseTracker struct {
+	io.ReadWriteCloser
+	rt *httpRoundTrip
+}
+
+func (c writerCloseTracker) Close() error {
+	err := c.ReadWriteCloser.Close()
+	c.rt.ClosedBody(err)
+	return err
+}
+
+type httpEvent struct {
+	code httpEventCode
+	ts   int64
+	data httpEventData // or nil
+}
+
+type httpEventData interface {
+	Encode(tb *Buffer)
+}
+
+type httpEventCode byte
+
+const (
+	getConn              = 0x01
+	gotConn              = 0x02
+	gotFirstResponseByte = 0x03
+	got1xxResponse       = 0x04
+	dnsStart             = 0x05
+	dnsDone              = 0x06
+	connectStart         = 0x07
+	connectDone          = 0x08
+	tlsHandshakeStart    = 0x09
+	tlsHandshakeDone     = 0x0A
+	wroteHeaders         = 0x0B
+	wroteRequest         = 0x0C
+	wait100Continue      = 0x0D
+)
+
+type getConnEvent struct {
+	hostPort string
+}
+
+func (e *getConnEvent) Encode(tb *Buffer) {
+	tb.String(e.hostPort)
+}
+
+type gotConnEvent struct {
+	info httptrace.GotConnInfo
+}
+
+func (e *gotConnEvent) Encode(tb *Buffer) {
+	tb.Bool(e.info.Reused)
+	tb.Bool(e.info.WasIdle)
+	tb.Int64(int64(e.info.IdleTime))
+}
+
+type got1xxResponseEvent struct {
+	code   int
+	header textproto.MIMEHeader
+}
+
+func (e *got1xxResponseEvent) Encode(tb *Buffer) {
+	tb.Varint(int64(e.code))
+	// TODO: write header as well?
+}
+
+type dnsStartEvent struct {
+	info httptrace.DNSStartInfo
+}
+
+func (e *dnsStartEvent) Encode(tb *Buffer) {
+	tb.String(e.info.Host)
+}
+
+type dnsDoneEvent struct {
+	info httptrace.DNSDoneInfo
+}
+
+func (e *dnsDoneEvent) Encode(tb *Buffer) {
+	if err := e.info.Err; err != nil {
+		msg := err.Error()
+		if msg == "" {
+			msg = "unknown error"
+		}
+		tb.String(msg)
+	} else {
+		tb.String("")
+	}
+	tb.UVarint(uint64(len(e.info.Addrs)))
+	for _, a := range e.info.Addrs {
+		tb.ByteString(a.IP)
+	}
+}
+
+type connectStartEvent struct {
+	network string
+	addr    string
+}
+
+func (e *connectStartEvent) Encode(tb *Buffer) {
+	tb.String(e.network)
+	tb.String(e.addr)
+}
+
+type connectDoneEvent struct {
+	network string
+	addr    string
+	err     error
+}
+
+func (e *connectDoneEvent) Encode(tb *Buffer) {
+	tb.String(e.network)
+	tb.String(e.addr)
+	tb.Err(e.err)
+}
+
+type tlsHandshakeDoneEvent struct {
+	info tls.ConnectionState
+	err  error
+}
+
+func (e *tlsHandshakeDoneEvent) Encode(tb *Buffer) {
+	tb.Err(e.err)
+	tb.Uint32(uint32(e.info.Version))
+	tb.Uint32(uint32(e.info.CipherSuite))
+	tb.String(e.info.ServerName)
+	tb.String(e.info.NegotiatedProtocol)
+}
+
+type wroteRequestEvent struct {
+	info httptrace.WroteRequestInfo
+}
+
+func (e *wroteRequestEvent) Encode(tb *Buffer) {
+	tb.Err(e.info.Err)
+}
+
+type contextKey int
+
+const (
+	rtKey contextKey = iota
+)
diff --git a/runtimes/go/appruntime/exported/trace/log.go b/runtimes/go/appruntime/exported/trace/log.go
new file mode 100644
index 0000000000..54e51d675b
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace/log.go
@@ -0,0 +1,260 @@
+package trace
+
+import (
+	"math"
+	"time"
+	_ "unsafe" // for go:linkname
+
+	"encore.dev/appruntime/exported/stack"
+)
+
+type Log struct {
+	// mu must be the runtime mutex and not a regular sync.Mutex,
+	// as certain events (Go{Start,Clear,End}) are sometimes executed by system goroutines,
+	// which do not support sync.Mutex.
+	mu mutex
+
+	data []byte
+}
+
+// Ensure Log implements Logger.
+var _ Logger = (*Log)(nil)
+
+// Add adds a new event in the trace log.
+// If l is nil, it does nothing.
+func (l *Log) Add(event EventType, data []byte) {
+	if l == nil {
+		return
+	}
+	ln := len(data)
+	if ln > (1<<32 - 1) {
+		println("encore.traceEvent: event too large, dropping")
+		return
+	}
+
+	mutexLock(&l.mu)
+	defer mutexUnlock(&l.mu)
+
+	// Do this in the critical section to ensure we don't get
+	// out-of-order timestamps.
+	t := nanotime()
+	var b [13]byte
+	b[0] = byte(event)
+	b[1] = byte(t)
+	b[2] = byte(t >> 8)
+	b[3] = byte(t >> 16)
+	b[4] = byte(t >> 24)
+	b[5] = byte(t >> 32)
+	b[6] = byte(t >> 40)
+	b[7] = byte(t >> 48)
+	b[8] = byte(t >> 56)
+	b[9] = byte(ln)
+	b[10] = byte(ln >> 8)
+	b[11] = byte(ln >> 16)
+	b[12] = byte(ln >> 24)
+	l.data = append(l.data, append(b[:], data...)...)
+}
+
+// GetAndClear gets the data and clears the buffer.
+func (l *Log) GetAndClear() []byte {
+	mutexLock(&l.mu)
+	data := l.data
+	l.data = l.data[len(l.data):]
+	mutexUnlock(&l.mu)
+	return data
+}
+
+// Buffer is a performant, low-overhead, growable buffer
+// for buffering trace data in a compact way.
+//
+// The zero value is ready to be used, but NewBuffer
+// can be used to provide an initial size hint.
+type Buffer struct {
+	scratch [10]byte
+	buf     []byte
+}
+
+func NewBuffer(size int) Buffer {
+	return Buffer{buf: make([]byte, 0, size)}
+}
+
+func (tb *Buffer) Buf() []byte {
+	return tb.buf
+}
+
+func (tb *Buffer) Byte(b byte) {
+	tb.buf = append(tb.buf, b)
+}
+
+func (tb *Buffer) Bytes(b []byte) {
+	tb.buf = append(tb.buf, b...)
+}
+
+func (tb *Buffer) String(s string) {
+	tb.UVarint(uint64(len(s)))
+	tb.Bytes([]byte(s))
+}
+
+func (tb *Buffer) ByteString(b []byte) {
+	tb.UVarint(uint64(len(b)))
+	tb.Bytes(b)
+}
+
+// TruncatedByteString is like ByteString except it truncates b to maximum of maxLen.
+// If truncationSuffix is provided, it is appended after truncating, leading to
+// the final length being maxLen+len(truncationSuffix).
+func (tb *Buffer) TruncatedByteString(b []byte, maxLen int, truncationSuffix []byte) {
+	if size := len(b); size > maxLen {
+		tb.UVarint(uint64(maxLen + len(truncationSuffix)))
+		tb.Bytes(b[:maxLen])
+		tb.Bytes(truncationSuffix)
+	} else {
+		tb.ByteString(b)
+	}
+}
+
+func (tb *Buffer) Now() {
+	now := time.Now()
+	tb.Time(now)
+}
+
+func (tb *Buffer) Bool(b bool) {
+	if b {
+		tb.Bytes([]byte{1})
+	} else {
+		tb.Bytes([]byte{0})
+	}
+}
+
+func (tb *Buffer) Err(err error) {
+	msg := ""
+	if err != nil {
+		msg = err.Error()
+		if msg == "" {
+			msg = "unknown error"
+		}
+	}
+	tb.String(msg)
+}
+
+func (tb *Buffer) Time(t time.Time) {
+	tb.Int64(t.Unix())
+	tb.Int32(int32(t.Nanosecond()))
+}
+
+func (tb *Buffer) Int32(x int32) {
+	var u uint32
+	if x < 0 {
+		u = (^uint32(x) << 1) | 1 // complement i, bit 0 is 1
+	} else {
+		u = (uint32(x) << 1) // do not complement i, bit 0 is 0
+	}
+	tb.Uint32(u)
+}
+
+func (tb *Buffer) Uint32(x uint32) {
+	tb.buf = append(tb.buf,
+		byte(x),
+		byte(x>>8),
+		byte(x>>16),
+		byte(x>>24),
+	)
+}
+
+func (tb *Buffer) Int64(x int64) {
+	var u uint64
+	if x < 0 {
+		u = (^uint64(x) << 1) | 1 // complement i, bit 0 is 1
+	} else {
+		u = (uint64(x) << 1) // do not complement i, bit 0 is 0
+	}
+	tb.Uint64(u)
+}
+
+func (tb *Buffer) Uint64(x uint64) {
+	tb.buf = append(tb.buf,
+		byte(x),
+		byte(x>>8),
+		byte(x>>16),
+		byte(x>>24),
+		byte(x>>32),
+		byte(x>>40),
+		byte(x>>48),
+		byte(x>>56),
+	)
+}
+
+func (tb *Buffer) Varint(x int64) {
+	var u uint64
+	if x < 0 {
+		u = (^uint64(x) << 1) | 1 // complement i, bit 0 is 1
+	} else {
+		u = (uint64(x) << 1) // do not complement i, bit 0 is 0
+	}
+	tb.UVarint(u)
+}
+
+func (tb *Buffer) UVarint(u uint64) {
+	i := 0
+	for u >= 0x80 {
+		tb.scratch[i] = byte(u) | 0x80
+		u >>= 7
+		i++
+	}
+	tb.scratch[i] = byte(u)
+	i++
+	tb.Bytes(tb.scratch[:i])
+}
+
+func (tb *Buffer) Float32(f float32) {
+	tb.Uint32(math.Float32bits(f))
+}
+
+func (tb *Buffer) Float64(f float64) {
+	tb.Uint64(math.Float64bits(f))
+}
+
+func (tb *Buffer) Stack(s stack.Stack) {
+	n := len(s.Frames)
+	if n > 0xFF {
+		// Should never happen (the runtime caps it at 100),
+		// but be defensive about it.
+		n = 0xFF
+	}
+	tb.Byte(byte(n))
+	if n == 0 {
+		return
+	}
+
+	var prev int64 = 0
+	for _, pc := range s.Frames[:n] {
+		p := int64(pc - s.Off)
+		diff := p - prev
+		tb.Varint(diff)
+		prev = p
+	}
+}
+
+func (tb *Buffer) FormattedStack(s stack.Stack) {
+	frames := stack.Format(s)
+	n := len(frames)
+	if n > 0xFF {
+		// Should never happen (the runtime caps it at 100),
+		// but be defensive about it.
+		n = 0xFF
+	}
+
+	tb.Byte(byte(n))
+	if n == 0 {
+		return
+	}
+
+	for _, f := range frames[:n] {
+		tb.String(f.File)
+		tb.UVarint(uint64(f.Line))
+		tb.String(f.Func)
+	}
+}
+
+//go:linkname nanotime runtime.nanotime
+func nanotime() int64
diff --git a/runtimes/go/appruntime/exported/trace/logger.go b/runtimes/go/appruntime/exported/trace/logger.go
new file mode 100644
index 0000000000..d5cae848bc
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace/logger.go
@@ -0,0 +1,37 @@
+package trace
+
+import (
+	"context"
+	"net/http"
+
+	model2 "encore.dev/appruntime/exported/model"
+)
+
+//go:generate mockgen -source=./logger.go -destination ./mock_trace/mock_trace.go Logger
+
+type Logger interface {
+	Add(event EventType, data []byte)
+	GetAndClear() []byte
+	BeginRequest(req *model2.Request, goid uint32)
+	FinishRequest(req *model2.Request, resp *model2.Response)
+	BeginCall(call *model2.APICall, goid uint32)
+	FinishCall(call *model2.APICall, err error)
+	BeginAuth(call *model2.AuthCall, goid uint32)
+	FinishAuth(call *model2.AuthCall, uid model2.UID, err error)
+	DBQueryStart(p DBQueryStartParams)
+	DBQueryEnd(queryID uint64, err error)
+	DBTxStart(p DBTxStartParams)
+	DBTxEnd(p DBTxEndParams)
+	PublishStart(topic string, msg []byte, spanID model2.SpanID, goid uint32, publishID uint64, skipFrames int)
+	PublishEnd(publishID uint64, messageID string, err error)
+	GoStart(spanID model2.SpanID, goctr uint32)
+	GoClear(spanID model2.SpanID, goctr uint32)
+	GoEnd(spanID model2.SpanID, goctr uint32)
+	ServiceInitStart(p ServiceInitStartParams)
+	ServiceInitEnd(initCtr uint64, err error)
+	CacheOpStart(p CacheOpStartParams)
+	CacheOpEnd(p CacheOpEndParams)
+	BodyStream(p BodyStreamParams)
+	HTTPBeginRoundTrip(httpReq *http.Request, req *model2.Request, goid uint32) (context.Context, error)
+	HTTPCompleteRoundTrip(req *http.Request, resp *http.Response, err error)
+}
diff --git a/runtimes/go/appruntime/exported/trace/mock_trace/mock_trace.go b/runtimes/go/appruntime/exported/trace/mock_trace/mock_trace.go
new file mode 100644
index 0000000000..ef1cdbd983
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace/mock_trace/mock_trace.go
@@ -0,0 +1,331 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./logger.go
+
+// Package mock_trace is a generated GoMock package.
+package mock_trace
+
+import (
+	context "context"
+	http "net/http"
+	reflect "reflect"
+
+	model "encore.dev/appruntime/exported/model"
+	trace "encore.dev/appruntime/exported/trace"
+	gomock "github.com/golang/mock/gomock"
+)
+
+// MockLogger is a mock of Logger interface.
+type MockLogger struct {
+	ctrl     *gomock.Controller
+	recorder *MockLoggerMockRecorder
+}
+
+// MockLoggerMockRecorder is the mock recorder for MockLogger.
+type MockLoggerMockRecorder struct {
+	mock *MockLogger
+}
+
+// NewMockLogger creates a new mock instance.
+func NewMockLogger(ctrl *gomock.Controller) *MockLogger {
+	mock := &MockLogger{ctrl: ctrl}
+	mock.recorder = &MockLoggerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
+	return m.recorder
+}
+
+// Add mocks base method.
+func (m *MockLogger) Add(event trace.EventType, data []byte) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "Add", event, data)
+}
+
+// Add indicates an expected call of Add.
+func (mr *MockLoggerMockRecorder) Add(event, data interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Add", reflect.TypeOf((*MockLogger)(nil).Add), event, data)
+}
+
+// BeginAuth mocks base method.
+func (m *MockLogger) BeginAuth(call *model.AuthCall, goid uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "BeginAuth", call, goid)
+}
+
+// BeginAuth indicates an expected call of BeginAuth.
+func (mr *MockLoggerMockRecorder) BeginAuth(call, goid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BeginAuth", reflect.TypeOf((*MockLogger)(nil).BeginAuth), call, goid)
+}
+
+// BeginCall mocks base method.
+func (m *MockLogger) BeginCall(call *model.APICall, goid uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "BeginCall", call, goid)
+}
+
+// BeginCall indicates an expected call of BeginCall.
+func (mr *MockLoggerMockRecorder) BeginCall(call, goid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BeginCall", reflect.TypeOf((*MockLogger)(nil).BeginCall), call, goid)
+}
+
+// BeginRequest mocks base method.
+func (m *MockLogger) BeginRequest(req *model.Request, goid uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "BeginRequest", req, goid)
+}
+
+// BeginRequest indicates an expected call of BeginRequest.
+func (mr *MockLoggerMockRecorder) BeginRequest(req, goid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BeginRequest", reflect.TypeOf((*MockLogger)(nil).BeginRequest), req, goid)
+}
+
+// BodyStream mocks base method.
+func (m *MockLogger) BodyStream(p trace.BodyStreamParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "BodyStream", p)
+}
+
+// BodyStream indicates an expected call of BodyStream.
+func (mr *MockLoggerMockRecorder) BodyStream(p interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BodyStream", reflect.TypeOf((*MockLogger)(nil).BodyStream), p)
+}
+
+// CacheOpEnd mocks base method.
+func (m *MockLogger) CacheOpEnd(p trace.CacheOpEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "CacheOpEnd", p)
+}
+
+// CacheOpEnd indicates an expected call of CacheOpEnd.
+func (mr *MockLoggerMockRecorder) CacheOpEnd(p interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CacheOpEnd", reflect.TypeOf((*MockLogger)(nil).CacheOpEnd), p)
+}
+
+// CacheOpStart mocks base method.
+func (m *MockLogger) CacheOpStart(p trace.CacheOpStartParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "CacheOpStart", p)
+}
+
+// CacheOpStart indicates an expected call of CacheOpStart.
+func (mr *MockLoggerMockRecorder) CacheOpStart(p interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CacheOpStart", reflect.TypeOf((*MockLogger)(nil).CacheOpStart), p)
+}
+
+// DBQueryEnd mocks base method.
+func (m *MockLogger) DBQueryEnd(queryID uint64, err error) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "DBQueryEnd", queryID, err)
+}
+
+// DBQueryEnd indicates an expected call of DBQueryEnd.
+func (mr *MockLoggerMockRecorder) DBQueryEnd(queryID, err interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DBQueryEnd", reflect.TypeOf((*MockLogger)(nil).DBQueryEnd), queryID, err)
+}
+
+// DBQueryStart mocks base method.
+func (m *MockLogger) DBQueryStart(p trace.DBQueryStartParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "DBQueryStart", p)
+}
+
+// DBQueryStart indicates an expected call of DBQueryStart.
+func (mr *MockLoggerMockRecorder) DBQueryStart(p interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DBQueryStart", reflect.TypeOf((*MockLogger)(nil).DBQueryStart), p)
+}
+
+// DBTxEnd mocks base method.
+func (m *MockLogger) DBTxEnd(p trace.DBTxEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "DBTxEnd", p)
+}
+
+// DBTxEnd indicates an expected call of DBTxEnd.
+func (mr *MockLoggerMockRecorder) DBTxEnd(p interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DBTxEnd", reflect.TypeOf((*MockLogger)(nil).DBTxEnd), p)
+}
+
+// DBTxStart mocks base method.
+func (m *MockLogger) DBTxStart(p trace.DBTxStartParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "DBTxStart", p)
+}
+
+// DBTxStart indicates an expected call of DBTxStart.
+func (mr *MockLoggerMockRecorder) DBTxStart(p interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DBTxStart", reflect.TypeOf((*MockLogger)(nil).DBTxStart), p)
+}
+
+// FinishAuth mocks base method.
+func (m *MockLogger) FinishAuth(call *model.AuthCall, uid model.UID, err error) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "FinishAuth", call, uid, err)
+}
+
+// FinishAuth indicates an expected call of FinishAuth.
+func (mr *MockLoggerMockRecorder) FinishAuth(call, uid, err interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FinishAuth", reflect.TypeOf((*MockLogger)(nil).FinishAuth), call, uid, err)
+}
+
+// FinishCall mocks base method.
+func (m *MockLogger) FinishCall(call *model.APICall, err error) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "FinishCall", call, err)
+}
+
+// FinishCall indicates an expected call of FinishCall.
+func (mr *MockLoggerMockRecorder) FinishCall(call, err interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FinishCall", reflect.TypeOf((*MockLogger)(nil).FinishCall), call, err)
+}
+
+// FinishRequest mocks base method.
+func (m *MockLogger) FinishRequest(req *model.Request, resp *model.Response) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "FinishRequest", req, resp)
+}
+
+// FinishRequest indicates an expected call of FinishRequest.
+func (mr *MockLoggerMockRecorder) FinishRequest(req, resp interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "FinishRequest", reflect.TypeOf((*MockLogger)(nil).FinishRequest), req, resp)
+}
+
+// GetAndClear mocks base method.
+func (m *MockLogger) GetAndClear() []byte {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAndClear")
+	ret0, _ := ret[0].([]byte)
+	return ret0
+}
+
+// GetAndClear indicates an expected call of GetAndClear.
+func (mr *MockLoggerMockRecorder) GetAndClear() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAndClear", reflect.TypeOf((*MockLogger)(nil).GetAndClear))
+}
+
+// GoClear mocks base method.
+func (m *MockLogger) GoClear(spanID model.SpanID, goctr uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "GoClear", spanID, goctr)
+}
+
+// GoClear indicates an expected call of GoClear.
+func (mr *MockLoggerMockRecorder) GoClear(spanID, goctr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GoClear", reflect.TypeOf((*MockLogger)(nil).GoClear), spanID, goctr)
+}
+
+// GoEnd mocks base method.
+func (m *MockLogger) GoEnd(spanID model.SpanID, goctr uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "GoEnd", spanID, goctr)
+}
+
+// GoEnd indicates an expected call of GoEnd.
+func (mr *MockLoggerMockRecorder) GoEnd(spanID, goctr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GoEnd", reflect.TypeOf((*MockLogger)(nil).GoEnd), spanID, goctr)
+}
+
+// GoStart mocks base method.
+func (m *MockLogger) GoStart(spanID model.SpanID, goctr uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "GoStart", spanID, goctr)
+}
+
+// GoStart indicates an expected call of GoStart.
+func (mr *MockLoggerMockRecorder) GoStart(spanID, goctr interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GoStart", reflect.TypeOf((*MockLogger)(nil).GoStart), spanID, goctr)
+}
+
+// HTTPBeginRoundTrip mocks base method.
+func (m *MockLogger) HTTPBeginRoundTrip(httpReq *http.Request, req *model.Request, goid uint32) (context.Context, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HTTPBeginRoundTrip", httpReq, req, goid)
+	ret0, _ := ret[0].(context.Context)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// HTTPBeginRoundTrip indicates an expected call of HTTPBeginRoundTrip.
+func (mr *MockLoggerMockRecorder) HTTPBeginRoundTrip(httpReq, req, goid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HTTPBeginRoundTrip", reflect.TypeOf((*MockLogger)(nil).HTTPBeginRoundTrip), httpReq, req, goid)
+}
+
+// HTTPCompleteRoundTrip mocks base method.
+func (m *MockLogger) HTTPCompleteRoundTrip(req *http.Request, resp *http.Response, err error) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "HTTPCompleteRoundTrip", req, resp, err)
+}
+
+// HTTPCompleteRoundTrip indicates an expected call of HTTPCompleteRoundTrip.
+func (mr *MockLoggerMockRecorder) HTTPCompleteRoundTrip(req, resp, err interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HTTPCompleteRoundTrip", reflect.TypeOf((*MockLogger)(nil).HTTPCompleteRoundTrip), req, resp, err)
+}
+
+// PublishEnd mocks base method.
+func (m *MockLogger) PublishEnd(publishID uint64, messageID string, err error) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "PublishEnd", publishID, messageID, err)
+}
+
+// PublishEnd indicates an expected call of PublishEnd.
+func (mr *MockLoggerMockRecorder) PublishEnd(publishID, messageID, err interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PublishEnd", reflect.TypeOf((*MockLogger)(nil).PublishEnd), publishID, messageID, err)
+}
+
+// PublishStart mocks base method.
+func (m *MockLogger) PublishStart(topic string, msg []byte, spanID model.SpanID, goid uint32, publishID uint64, skipFrames int) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "PublishStart", topic, msg, spanID, goid, publishID, skipFrames)
+}
+
+// PublishStart indicates an expected call of PublishStart.
+func (mr *MockLoggerMockRecorder) PublishStart(topic, msg, spanID, goid, publishID, skipFrames interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PublishStart", reflect.TypeOf((*MockLogger)(nil).PublishStart), topic, msg, spanID, goid, publishID, skipFrames)
+}
+
+// ServiceInitEnd mocks base method.
+func (m *MockLogger) ServiceInitEnd(initCtr uint64, err error) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "ServiceInitEnd", initCtr, err)
+}
+
+// ServiceInitEnd indicates an expected call of ServiceInitEnd.
+func (mr *MockLoggerMockRecorder) ServiceInitEnd(initCtr, err interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ServiceInitEnd", reflect.TypeOf((*MockLogger)(nil).ServiceInitEnd), initCtr, err)
+}
+
+// ServiceInitStart mocks base method.
+func (m *MockLogger) ServiceInitStart(p trace.ServiceInitStartParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "ServiceInitStart", p)
+}
+
+// ServiceInitStart indicates an expected call of ServiceInitStart.
+func (mr *MockLoggerMockRecorder) ServiceInitStart(p interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ServiceInitStart", reflect.TypeOf((*MockLogger)(nil).ServiceInitStart), p)
+}
diff --git a/runtimes/go/appruntime/exported/trace/mutex_app.go b/runtimes/go/appruntime/exported/trace/mutex_app.go
new file mode 100644
index 0000000000..d8aa82d54e
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace/mutex_app.go
@@ -0,0 +1,16 @@
+//go:build encore_app
+
+package trace
+
+import _ "unsafe" // for go:linkname
+
+// mutex must exactly match implementation in the runtime.
+type mutex struct {
+	key uintptr
+}
+
+//go:linkname mutexLock runtime.lock
+func mutexLock(mut *mutex)
+
+//go:linkname mutexUnlock runtime.unlock
+func mutexUnlock(mut *mutex)
diff --git a/runtimes/go/appruntime/exported/trace/mutex_noapp.go b/runtimes/go/appruntime/exported/trace/mutex_noapp.go
new file mode 100644
index 0000000000..c05b3784fb
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace/mutex_noapp.go
@@ -0,0 +1,13 @@
+//go:build !encore_app
+
+package trace
+
+import "sync"
+
+type mutex struct {
+	mut sync.Mutex
+}
+
+func mutexLock(m *mutex) { m.mut.Lock() }
+
+func mutexUnlock(m *mutex) { m.mut.Unlock() }
diff --git a/runtimes/go/appruntime/exported/trace/version.go b/runtimes/go/appruntime/exported/trace/version.go
new file mode 100644
index 0000000000..ebcf8816b9
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace/version.go
@@ -0,0 +1,6 @@
+package trace
+
+type Version int
+
+// CurrentVersion is the trace protocol version this package produces traces in.
+const CurrentVersion Version = 13
diff --git a/runtimes/go/appruntime/exported/trace2/events.go b/runtimes/go/appruntime/exported/trace2/events.go
new file mode 100644
index 0000000000..6211b872c8
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace2/events.go
@@ -0,0 +1,1174 @@
+package trace2
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/http"
+	"time"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/beta/errs"
+	"encore.dev/types/uuid"
+)
+
+type EventType byte
+
+const (
+	RequestSpanStart          EventType = 0x01
+	RequestSpanEnd            EventType = 0x02
+	AuthSpanStart             EventType = 0x03
+	AuthSpanEnd               EventType = 0x04
+	PubsubMessageSpanStart    EventType = 0x05
+	PubsubMessageSpanEnd      EventType = 0x06
+	DBTransactionStart        EventType = 0x07
+	DBTransactionEnd          EventType = 0x08
+	DBQueryStart              EventType = 0x09
+	DBQueryEnd                EventType = 0x0A
+	RPCCallStart              EventType = 0x0B
+	RPCCallEnd                EventType = 0x0C
+	HTTPCallStart             EventType = 0x0D
+	HTTPCallEnd               EventType = 0x0E
+	LogMessage                EventType = 0x0F
+	PubsubPublishStart        EventType = 0x10
+	PubsubPublishEnd          EventType = 0x11
+	ServiceInitStart          EventType = 0x12
+	ServiceInitEnd            EventType = 0x13
+	CacheCallStart            EventType = 0x14
+	CacheCallEnd              EventType = 0x15
+	BodyStream                EventType = 0x16
+	TestStart                 EventType = 0x17
+	TestEnd                   EventType = 0x18
+	BucketObjectUploadStart   EventType = 0x19
+	BucketObjectUploadEnd     EventType = 0x1A
+	BucketObjectDownloadStart EventType = 0x1B
+	BucketObjectDownloadEnd   EventType = 0x1C
+	BucketObjectGetAttrsStart EventType = 0x1D
+	BucketObjectGetAttrsEnd   EventType = 0x1E
+	BucketListObjectsStart    EventType = 0x1F
+	BucketListObjectsEnd      EventType = 0x20
+	BucketDeleteObjectsStart  EventType = 0x21
+	BucketDeleteObjectsEnd    EventType = 0x22
+)
+
+func (te EventType) String() string {
+	switch te {
+	case RequestSpanStart:
+		return "RequestSpanStart"
+	case RequestSpanEnd:
+		return "RequestSpanEnd"
+	case AuthSpanStart:
+		return "AuthSpanStart"
+	case AuthSpanEnd:
+		return "AuthSpanEnd"
+	case PubsubMessageSpanStart:
+		return "PubsubMessageSpanStart"
+	case PubsubMessageSpanEnd:
+		return "PubsubMessageSpanEnd"
+	case DBTransactionStart:
+		return "DBTransactionStart"
+	case DBTransactionEnd:
+		return "DBTransactionEnd"
+	case DBQueryStart:
+		return "QueryStart"
+	case DBQueryEnd:
+		return "QueryEnd"
+	case RPCCallStart:
+		return "RPCCallStart"
+	case RPCCallEnd:
+		return "RPCCallEnd"
+	case HTTPCallStart:
+		return "HTTPCallStart"
+	case HTTPCallEnd:
+		return "HTTPCallEnd"
+	case LogMessage:
+		return "LogMessage"
+	case PubsubPublishStart:
+		return "PubsubPublishStart"
+	case PubsubPublishEnd:
+		return "PubsubPublishEnd"
+	case ServiceInitStart:
+		return "ServiceInitStart"
+	case ServiceInitEnd:
+		return "ServiceInitEnd"
+	case CacheCallStart:
+		return "CacheCallStart"
+	case CacheCallEnd:
+		return "CacheCallEnd"
+	case BodyStream:
+		return "BodyStream"
+	case TestStart:
+		return "TestStart"
+	case TestEnd:
+		return "TestEnd"
+	case BucketObjectUploadStart:
+		return "BucketObjectUploadStart"
+	case BucketObjectUploadEnd:
+		return "BucketObjectUploadEnd"
+	case BucketObjectDownloadStart:
+		return "BucketObjectDownloadStart"
+	case BucketObjectDownloadEnd:
+		return "BucketObjectDownloadEnd"
+	case BucketObjectGetAttrsStart:
+		return "BucketObjectGetAttrsStart"
+	case BucketObjectGetAttrsEnd:
+		return "BucketObjectGetAttrsEnd"
+	case BucketListObjectsStart:
+		return "BucketListObjectsStart"
+	case BucketListObjectsEnd:
+		return "BucketListObjectsEnd"
+	case BucketDeleteObjectsStart:
+		return "BucketDeleteObjectsStart"
+	case BucketDeleteObjectsEnd:
+		return "BucketDeleteObjectsEnd"
+
+	default:
+		return fmt.Sprintf("Unknown(%x)", byte(te))
+	}
+}
+
+type EventParams struct {
+	TraceID model.TraceID
+	SpanID  model.SpanID
+	Goid    uint32
+	DefLoc  uint32
+}
+
+type spanStartEventData struct {
+	Goid             uint32
+	ParentTraceID    model.TraceID
+	ParentSpanID     model.SpanID
+	DefLoc           uint32
+	CallerEventID    model.TraceEventID
+	ExtCorrelationID string
+
+	ExtraSpace int
+}
+
+func (l *Log) newSpanStartEvent(data spanStartEventData) EventBuffer {
+	tb := NewEventBuffer(4 + 16 + 8 + 4 + len(data.ExtCorrelationID) + 2 + data.ExtraSpace)
+	tb.UVarint(uint64(data.Goid))
+	tb.Bytes(data.ParentTraceID[:])
+	tb.Bytes(data.ParentSpanID[:])
+	tb.UVarint(uint64(data.DefLoc))
+	tb.UVarint(uint64(data.CallerEventID))
+	tb.String(data.ExtCorrelationID)
+	return tb
+}
+
+type spanEndEventData struct {
+	Duration      time.Duration
+	Err           error
+	ParentTraceID model.TraceID
+	ParentSpanID  model.SpanID
+	ExtraSpace    int
+}
+
+func (l *Log) newSpanEndEvent(data spanEndEventData) EventBuffer {
+	tb := NewEventBuffer(8 + 12 + 8 + data.ExtraSpace)
+	tb.Duration(data.Duration)
+	tb.ErrWithStack(data.Err)
+	if panicStack, ok := errs.Meta(data.Err)["panic_stack"].(stack.Stack); ok {
+		tb.FormattedStack(panicStack)
+	} else {
+		tb.FormattedStack(stack.Stack{})
+	}
+
+	tb.Bytes(data.ParentTraceID[:])
+	tb.Bytes(data.ParentSpanID[:])
+	return tb
+}
+
+type eventData struct {
+	Common             EventParams
+	CorrelationEventID EventID
+	ExtraSpace         int
+}
+
+func (l *Log) newEvent(data eventData) EventBuffer {
+	tb := NewEventBuffer(4 + 4 + data.ExtraSpace)
+	tb.UVarint(uint64(data.Common.DefLoc))
+	tb.UVarint(uint64(data.Common.Goid))
+	tb.EventID(data.CorrelationEventID)
+	return tb
+}
+
+func (l *Log) RequestSpanStart(req *model.Request, goid uint32) {
+	data := req.RPCData
+	desc := data.Desc
+	tb := l.newSpanStartEvent(spanStartEventData{
+		ParentTraceID:    req.ParentTraceID,
+		ParentSpanID:     req.ParentSpanID,
+		DefLoc:           req.DefLoc,
+		Goid:             goid,
+		CallerEventID:    req.CallerEventID,
+		ExtCorrelationID: req.ExtCorrelationID,
+		ExtraSpace:       100,
+	})
+
+	tb.String(desc.Service)
+	tb.String(desc.Endpoint)
+	tb.String(data.HTTPMethod)
+
+	tb.String(data.Path)
+	tb.UVarint(uint64(len(data.PathParams)))
+	for _, pp := range data.PathParams {
+		tb.String(pp.Value)
+	}
+
+	l.logHeaders(&tb, data.RequestHeaders)
+	tb.ByteString(data.NonRawPayload)
+	tb.String(req.ExtCorrelationID)
+	tb.String(string(data.UserID))
+	tb.Bool(data.Mocked)
+
+	l.Add(Event{
+		Type:    RequestSpanStart,
+		TraceID: req.TraceID,
+		SpanID:  req.SpanID,
+		Data:    tb,
+	})
+}
+
+type RequestSpanEndParams struct {
+	EventParams
+	Req  *model.Request
+	Resp *model.Response
+}
+
+func (l *Log) RequestSpanEnd(p RequestSpanEndParams) {
+	desc := p.Req.RPCData.Desc
+	tb := l.newSpanEndEvent(spanEndEventData{
+		Duration:      p.Resp.Duration,
+		Err:           p.Resp.Err,
+		ParentTraceID: p.Req.ParentTraceID,
+		ParentSpanID:  p.Req.ParentSpanID,
+		ExtraSpace:    len(desc.Service) + len(desc.Endpoint) + 64 + len(p.Resp.Payload),
+	})
+
+	tb.String(desc.Service)
+	tb.String(desc.Endpoint)
+
+	tb.UVarint(uint64(p.Resp.HTTPStatus))
+	l.logHeaders(&tb, p.Resp.RawResponseHeaders)
+	tb.ByteString(p.Resp.Payload)
+
+	l.Add(Event{
+		Type:    RequestSpanEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+func (l *Log) AuthSpanStart(req *model.Request, goid uint32) {
+	data := req.RPCData
+	desc := data.Desc
+	tb := l.newSpanStartEvent(spanStartEventData{
+		ParentTraceID:    req.ParentTraceID,
+		ParentSpanID:     req.ParentSpanID,
+		DefLoc:           req.DefLoc,
+		Goid:             goid,
+		CallerEventID:    req.CallerEventID,
+		ExtCorrelationID: req.ExtCorrelationID,
+		ExtraSpace:       len(desc.Service) + len(desc.Endpoint) + len(data.NonRawPayload) + 5,
+	})
+
+	tb.String(desc.Service)
+	tb.String(desc.Endpoint)
+	tb.ByteString(data.NonRawPayload)
+
+	l.Add(Event{
+		Type:    AuthSpanStart,
+		TraceID: req.TraceID,
+		SpanID:  req.SpanID,
+		Data:    tb,
+	})
+}
+
+type AuthSpanEndParams struct {
+	EventParams
+	Req  *model.Request
+	Resp *model.Response
+}
+
+func (l *Log) AuthSpanEnd(p AuthSpanEndParams) {
+	desc := p.Req.RPCData.Desc
+	tb := l.newSpanEndEvent(spanEndEventData{
+		Duration:      p.Resp.Duration,
+		Err:           p.Resp.Err,
+		ParentTraceID: p.Req.ParentTraceID,
+		ParentSpanID:  p.Req.ParentSpanID,
+		ExtraSpace:    len(desc.Service) + len(desc.Endpoint) + 64 + len(p.Resp.Payload),
+	})
+
+	tb.String(desc.Service)
+	tb.String(desc.Endpoint)
+	tb.String(string(p.Resp.AuthUID))
+	tb.ByteString(p.Resp.Payload)
+
+	l.Add(Event{
+		Type:    AuthSpanEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+func (l *Log) PubsubMessageSpanStart(req *model.Request, goid uint32) {
+	data := req.MsgData
+	tb := l.newSpanStartEvent(spanStartEventData{
+		ParentTraceID:    req.ParentTraceID,
+		ParentSpanID:     req.ParentSpanID,
+		DefLoc:           req.DefLoc,
+		Goid:             goid,
+		CallerEventID:    req.CallerEventID,
+		ExtCorrelationID: req.ExtCorrelationID,
+		ExtraSpace:       len(data.Service) + len(data.Topic) + len(data.Subscription) + len(data.Payload) + 20,
+	})
+
+	tb.String(data.Service)
+	tb.String(data.Topic)
+	tb.String(data.Subscription)
+	tb.String(data.MessageID)
+	tb.UVarint(uint64(data.Attempt))
+	tb.Time(data.Published)
+	tb.ByteString(data.Payload)
+
+	l.Add(Event{
+		Type:    PubsubMessageSpanStart,
+		TraceID: req.TraceID,
+		SpanID:  req.SpanID,
+		Data:    tb,
+	})
+}
+
+type PubsubMessageSpanEndParams struct {
+	EventParams
+	Req  *model.Request
+	Resp *model.Response
+}
+
+func (l *Log) PubsubMessageSpanEnd(p PubsubMessageSpanEndParams) {
+	msg := p.Req.MsgData
+	tb := l.newSpanEndEvent(spanEndEventData{
+		Duration:      p.Resp.Duration,
+		Err:           p.Resp.Err,
+		ParentTraceID: p.Req.ParentTraceID,
+		ParentSpanID:  p.Req.ParentSpanID,
+		ExtraSpace:    len(msg.Service) + len(msg.Topic) + len(msg.Subscription) + 4,
+	})
+
+	tb.String(msg.Service)
+	tb.String(msg.Topic)
+	tb.String(msg.Subscription)
+
+	l.Add(Event{
+		Type:    PubsubMessageSpanEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+func (l *Log) TestSpanStart(req *model.Request, goid uint32) {
+	data := req.Test
+	tb := l.newSpanStartEvent(spanStartEventData{
+		ParentTraceID:    req.ParentTraceID,
+		ParentSpanID:     req.ParentSpanID,
+		DefLoc:           req.DefLoc,
+		Goid:             goid,
+		CallerEventID:    req.CallerEventID,
+		ExtCorrelationID: req.ExtCorrelationID,
+		ExtraSpace:       len(data.Service) + len(data.Current.Name()) + len(data.UserID) + len(data.TestFile) + 30,
+	})
+
+	tb.String(data.Service)
+	tb.String(data.Current.Name())
+	tb.String(string(data.UserID))
+	tb.String(data.TestFile)
+	tb.Uint32(data.TestLine)
+
+	l.Add(Event{
+		Type:    TestStart,
+		TraceID: req.TraceID,
+		SpanID:  req.SpanID,
+		Data:    tb,
+	})
+}
+
+type TestSpanEndParams struct {
+	EventParams
+	Req     *model.Request
+	Failed  bool
+	Skipped bool
+}
+
+func (l *Log) TestSpanEnd(p TestSpanEndParams) {
+	desc := p.Req.Test
+	var err error
+	if desc.Current.Failed() {
+		err = errors.New("test failed")
+	}
+	tb := l.newSpanEndEvent(spanEndEventData{
+		Duration:      time.Since(p.Req.Start),
+		Err:           err,
+		ParentTraceID: p.Req.ParentTraceID,
+		ParentSpanID:  p.Req.ParentSpanID,
+		ExtraSpace:    len(desc.Service) + len(desc.Current.Name()) + 20,
+	})
+
+	tb.String(desc.Service)
+	tb.String(desc.Current.Name())
+	tb.Bool(p.Failed)
+	tb.Bool(p.Skipped)
+
+	l.Add(Event{
+		Type:    TestEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+func (l *Log) RPCCallStart(call *model.APICall, goid uint32) EventID {
+	tb := l.newEvent(eventData{
+		Common: EventParams{
+			Goid:   goid,
+			DefLoc: call.DefLoc,
+		},
+		ExtraSpace: len(call.TargetServiceName) + len(call.TargetServiceName) + 4 + 64,
+	})
+	tb.String(call.TargetServiceName)
+	tb.String(call.TargetEndpointName)
+	tb.Stack(stack.Build(3))
+	return l.Add(Event{
+		Type:    RPCCallStart,
+		TraceID: call.Source.TraceID,
+		SpanID:  call.Source.SpanID,
+		Data:    tb,
+	})
+}
+
+func (l *Log) RPCCallEnd(call *model.APICall, goid uint32, err error) {
+	tb := l.newEvent(eventData{
+		Common:             EventParams{Goid: goid},
+		ExtraSpace:         64,
+		CorrelationEventID: call.StartEventID,
+	})
+
+	tb.ErrWithStack(err)
+
+	l.Add(Event{
+		Type:    RPCCallEnd,
+		TraceID: call.Source.TraceID,
+		SpanID:  call.Source.SpanID,
+		Data:    tb,
+	})
+}
+
+type DBQueryStartParams struct {
+	EventParams
+	TxStartID EventID // zero if not in a transaction
+	Stack     stack.Stack
+	Query     string
+}
+
+func (l *Log) DBQueryStart(p DBQueryStartParams) EventID {
+	tb := l.newEvent(eventData{
+		Common:             p.EventParams,
+		CorrelationEventID: p.TxStartID,
+		ExtraSpace:         64,
+	})
+
+	tb.String(p.Query)
+	tb.Stack(p.Stack)
+
+	return l.Add(Event{
+		Type:    DBQueryStart,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+func (l *Log) DBQueryEnd(p EventParams, startID EventID, err error) {
+	tb := l.newEvent(eventData{
+		Common:             p,
+		ExtraSpace:         64,
+		CorrelationEventID: startID,
+	})
+	tb.ErrWithStack(err)
+	l.Add(Event{
+		Type:    DBQueryEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+func (l *Log) DBTransactionStart(p EventParams, stack stack.Stack) EventID {
+	tb := l.newEvent(eventData{
+		Common:     p,
+		ExtraSpace: 64,
+	})
+
+	tb.Stack(stack)
+
+	return l.Add(Event{
+		Type:    DBTransactionStart,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type DBTransactionEndParams struct {
+	EventParams
+	StartID EventID
+	Commit  bool
+	Err     error
+	Stack   stack.Stack
+}
+
+func (l *Log) DBTransactionEnd(p DBTransactionEndParams) {
+	tb := l.newEvent(eventData{
+		Common:             p.EventParams,
+		CorrelationEventID: p.StartID,
+		ExtraSpace:         64,
+	})
+
+	tb.Bool(p.Commit)
+	tb.Stack(p.Stack)
+	tb.ErrWithStack(p.Err)
+
+	l.Add(Event{
+		Type:    DBTransactionEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type PubsubPublishStartParams struct {
+	EventParams
+	Topic   string
+	Message []byte
+	Stack   stack.Stack
+}
+
+func (l *Log) PubsubPublishStart(p PubsubPublishStartParams) EventID {
+	tb := l.newEvent(eventData{
+		Common:     p.EventParams,
+		ExtraSpace: 64,
+	})
+
+	tb.String(p.Topic)
+	tb.ByteString(p.Message)
+	tb.Stack(p.Stack)
+
+	return l.Add(Event{
+		Type:    PubsubPublishStart,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type PubsubPublishEndParams struct {
+	EventParams
+	StartID   EventID
+	MessageID string
+	Err       error
+}
+
+func (l *Log) PubsubPublishEnd(p PubsubPublishEndParams) {
+	tb := l.newEvent(eventData{
+		Common:             p.EventParams,
+		CorrelationEventID: p.StartID,
+		ExtraSpace:         64,
+	})
+
+	tb.String(p.MessageID)
+	tb.ErrWithStack(p.Err)
+
+	l.Add(Event{
+		Type:    PubsubPublishEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type ServiceInitStartParams struct {
+	EventParams
+	Service string
+}
+
+func (l *Log) ServiceInitStart(p ServiceInitStartParams) EventID {
+	tb := l.newEvent(eventData{
+		Common:     p.EventParams,
+		ExtraSpace: 64,
+	})
+	tb.String(p.Service)
+
+	return l.Add(Event{
+		Type:    ServiceInitStart,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+func (l *Log) ServiceInitEnd(p EventParams, start EventID, err error) {
+	tb := l.newEvent(eventData{
+		Common:             p,
+		ExtraSpace:         64,
+		CorrelationEventID: start,
+	})
+
+	tb.ErrWithStack(err)
+
+	l.Add(Event{
+		Type:    ServiceInitEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type CacheCallStartParams struct {
+	EventParams
+	Operation string
+	IsWrite   bool
+	Keys      []string
+	Stack     stack.Stack
+}
+
+func (l *Log) CacheCallStart(p CacheCallStartParams) EventID {
+	tb := l.newEvent(eventData{
+		Common:     p.EventParams,
+		ExtraSpace: 64,
+	})
+
+	tb.String(p.Operation)
+	tb.Bool(p.IsWrite)
+	tb.Stack(p.Stack)
+
+	tb.UVarint(uint64(len(p.Keys)))
+	for _, k := range p.Keys {
+		tb.String(k)
+	}
+
+	return l.Add(Event{
+		Type:    CacheCallStart,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type CacheCallEndParams struct {
+	EventParams
+	StartID EventID
+	Res     CacheCallResult
+	Err     error
+}
+
+func (l *Log) CacheCallEnd(p CacheCallEndParams) {
+	tb := l.newEvent(eventData{
+		Common:             p.EventParams,
+		ExtraSpace:         64,
+		CorrelationEventID: p.StartID,
+	})
+
+	tb.Byte(byte(p.Res))
+	tb.ErrWithStack(p.Err)
+
+	l.Add(Event{
+		Type:    CacheCallEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type CacheCallResult uint8
+
+const (
+	CacheOK        CacheCallResult = 1
+	CacheNoSuchKey CacheCallResult = 2
+	CacheConflict  CacheCallResult = 3
+	CacheErr       CacheCallResult = 4
+)
+
+type BodyStreamParams struct {
+	EventParams
+
+	// IsResponse specifies whether the stream was a response body
+	// or a request body.
+	IsResponse bool
+
+	// Overflowed specifies whether the capturing overflowed.
+	Overflowed bool
+
+	// Data is the data read.
+	Data []byte
+}
+
+func (l *Log) BodyStream(p BodyStreamParams) {
+	tb := l.newEvent(eventData{
+		Common:     p.EventParams,
+		ExtraSpace: 64,
+	})
+
+	var flags byte = 0
+	if p.IsResponse {
+		flags |= 1 << 0
+	}
+	if p.Overflowed {
+		flags |= 1 << 1
+	}
+	tb.Byte(flags)
+	tb.ByteString(p.Data)
+
+	l.Add(Event{
+		Type:    BodyStream,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type BucketObjectUploadStartParams struct {
+	EventParams
+	Bucket string
+	Object string
+	Attrs  BucketObjectAttributes
+	Stack  stack.Stack
+}
+
+type BucketObjectAttributes struct {
+	Size        *uint64
+	Version     *string
+	ETag        *string
+	ContentType *string
+}
+
+func (l *Log) BucketObjectUploadStart(p BucketObjectUploadStartParams) EventID {
+	tb := l.newEvent(eventData{
+		Common:     p.EventParams,
+		ExtraSpace: 64,
+	})
+
+	tb.String(p.Bucket)
+	tb.String(p.Object)
+	tb.bucketObjectAttrs(&p.Attrs)
+	tb.Stack(p.Stack)
+
+	return l.Add(Event{
+		Type:    BucketObjectUploadStart,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+func (tb *EventBuffer) bucketObjectAttrs(attrs *BucketObjectAttributes) {
+	tb.OptUVarint(attrs.Size)
+	tb.OptString(attrs.Version)
+	tb.OptString(attrs.ETag)
+	tb.OptString(attrs.ContentType)
+}
+
+type BucketObjectUploadEndParams struct {
+	EventParams
+	StartID EventID
+
+	Err error
+	// Set iff err == nil
+	Size    uint64
+	Version *string
+}
+
+func (l *Log) BucketObjectUploadEnd(p BucketObjectUploadEndParams) {
+	tb := l.newEvent(eventData{
+		Common:             p.EventParams,
+		CorrelationEventID: p.StartID,
+		ExtraSpace:         64,
+	})
+
+	tb.UVarint(p.Size)
+	tb.OptString(p.Version)
+	tb.ErrWithStack(p.Err)
+
+	l.Add(Event{
+		Type:    BucketObjectUploadEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type BucketObjectDownloadStartParams struct {
+	EventParams
+	Bucket  string
+	Object  string
+	Version *string
+	Stack   stack.Stack
+}
+
+func (l *Log) BucketObjectDownloadStart(p BucketObjectDownloadStartParams) EventID {
+	tb := l.newEvent(eventData{
+		Common:     p.EventParams,
+		ExtraSpace: 64,
+	})
+
+	tb.String(p.Bucket)
+	tb.String(p.Object)
+	tb.OptString(p.Version)
+	tb.Stack(p.Stack)
+
+	return l.Add(Event{
+		Type:    BucketObjectDownloadStart,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type BucketObjectDownloadEndParams struct {
+	EventParams
+	StartID EventID
+
+	Err error
+	// Set iff err == nil
+	Size uint64
+}
+
+func (l *Log) BucketObjectDownloadEnd(p BucketObjectDownloadEndParams) {
+	tb := l.newEvent(eventData{
+		Common:             p.EventParams,
+		CorrelationEventID: p.StartID,
+		ExtraSpace:         4 + 4 + 8,
+	})
+
+	tb.UVarint(p.Size)
+	tb.ErrWithStack(p.Err)
+
+	l.Add(Event{
+		Type:    BucketObjectDownloadEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type BucketObjectGetAttrsStartParams struct {
+	EventParams
+	Bucket  string
+	Object  string
+	Version *string
+	Stack   stack.Stack
+}
+
+func (l *Log) BucketObjectGetAttrsStart(p BucketObjectGetAttrsStartParams) EventID {
+	tb := l.newEvent(eventData{
+		Common:     p.EventParams,
+		ExtraSpace: 64,
+	})
+
+	tb.String(p.Bucket)
+	tb.String(p.Object)
+	tb.OptString(p.Version)
+	tb.Stack(p.Stack)
+
+	return l.Add(Event{
+		Type:    BucketObjectGetAttrsStart,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type BucketObjectGetAttrsEndParams struct {
+	EventParams
+	StartID EventID
+
+	Err error
+	// Set iff err == nil
+	Attrs *BucketObjectAttributes
+}
+
+func (l *Log) BucketObjectGetAttrsEnd(p BucketObjectGetAttrsEndParams) {
+	tb := l.newEvent(eventData{
+		Common:             p.EventParams,
+		CorrelationEventID: p.StartID,
+		ExtraSpace:         4 + 4 + 8,
+	})
+
+	tb.ErrWithStack(p.Err)
+	if p.Err == nil {
+		tb.bucketObjectAttrs(p.Attrs)
+	}
+
+	l.Add(Event{
+		Type:    BucketObjectGetAttrsEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type BucketListObjectsStartParams struct {
+	EventParams
+	Bucket string
+	Prefix *string
+	Stack  stack.Stack
+}
+
+func (l *Log) BucketListObjectsStart(p BucketListObjectsStartParams) EventID {
+	tb := l.newEvent(eventData{
+		Common:     p.EventParams,
+		ExtraSpace: 64,
+	})
+
+	tb.String(p.Bucket)
+	tb.OptString(p.Prefix)
+	tb.Stack(p.Stack)
+
+	return l.Add(Event{
+		Type:    BucketListObjectsStart,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type BucketListObjectsEndParams struct {
+	EventParams
+	StartID EventID
+
+	Err error
+	// Set iff err == nil
+	Observed uint64
+	HasMore  bool
+}
+
+func (l *Log) BucketListObjectsEnd(p BucketListObjectsEndParams) {
+	tb := l.newEvent(eventData{
+		Common:             p.EventParams,
+		CorrelationEventID: p.StartID,
+		ExtraSpace:         4 + 4 + 8,
+	})
+
+	tb.ErrWithStack(p.Err)
+	tb.UVarint(p.Observed)
+	tb.Bool(p.HasMore)
+
+	l.Add(Event{
+		Type:    BucketListObjectsEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type BucketDeleteObjectsStartParams struct {
+	EventParams
+	Bucket  string
+	Objects []BucketDeleteObjectsEntry
+	Stack   stack.Stack
+}
+
+type BucketDeleteObjectsEntry struct {
+	Object  string
+	Version *string
+}
+
+func (l *Log) BucketDeleteObjectsStart(p BucketDeleteObjectsStartParams) EventID {
+	tb := l.newEvent(eventData{
+		Common:     p.EventParams,
+		ExtraSpace: 64,
+	})
+
+	tb.String(p.Bucket)
+	tb.Stack(p.Stack)
+	tb.UVarint(uint64(len(p.Objects)))
+	for _, e := range p.Objects {
+		tb.String(e.Object)
+		tb.OptString(e.Version)
+	}
+
+	return l.Add(Event{
+		Type:    BucketDeleteObjectsStart,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+type BucketDeleteObjectsEndParams struct {
+	EventParams
+	StartID EventID
+
+	Err error
+}
+
+func (l *Log) BucketDeleteObjectsEnd(p BucketDeleteObjectsEndParams) {
+	tb := l.newEvent(eventData{
+		Common:             p.EventParams,
+		CorrelationEventID: p.StartID,
+		ExtraSpace:         4 + 4 + 8,
+	})
+
+	tb.ErrWithStack(p.Err)
+
+	l.Add(Event{
+		Type:    BucketDeleteObjectsEnd,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+func (l *Log) logHeaders(tb *EventBuffer, headers http.Header) {
+	tb.UVarint(uint64(len(headers)))
+	for k, v := range headers {
+		firstVal := ""
+		if len(v) > 0 {
+			firstVal = v[0]
+		}
+		tb.String(k)
+		tb.String(firstVal)
+	}
+}
+
+type LogMessageParams struct {
+	EventParams
+	Level  model.LogLevel
+	Msg    string
+	Stack  stack.Stack
+	Fields []LogField
+}
+
+type LogField struct {
+	Key   string
+	Value any
+}
+
+func (l *Log) LogMessage(p LogMessageParams) {
+	tb := l.newEvent(eventData{
+		Common:     p.EventParams,
+		ExtraSpace: len(p.Msg) + 1 + 64*len(p.Fields),
+	})
+
+	tb.Byte(byte(p.Level))
+	tb.String(p.Msg)
+
+	tb.UVarint(uint64(len(p.Fields)))
+	for _, f := range p.Fields {
+		addLogField(&tb, f.Key, f.Value)
+	}
+	tb.Stack(p.Stack)
+
+	l.Add(Event{
+		Type:    LogMessage,
+		TraceID: p.TraceID,
+		SpanID:  p.SpanID,
+		Data:    tb,
+	})
+}
+
+func addLogField(tb *EventBuffer, key string, val any) {
+	switch val := val.(type) {
+	case error:
+		tb.Byte(byte(model.ErrField))
+		tb.String(key)
+		tb.ErrWithStack(val)
+	case string:
+		tb.Byte(byte(model.StringField))
+		tb.String(key)
+		tb.String(val)
+	case bool:
+		tb.Byte(byte(model.BoolField))
+		tb.String(key)
+		tb.Bool(val)
+	case time.Time:
+		tb.Byte(byte(model.TimeField))
+		tb.String(key)
+		tb.Time(val)
+	case time.Duration:
+		tb.Byte(byte(model.DurationField))
+		tb.String(key)
+		tb.Int64(int64(val))
+	case uuid.UUID:
+		tb.Byte(byte(model.UUIDField))
+		tb.String(key)
+		tb.Bytes(val[:])
+
+	default:
+		tb.Byte(byte(model.JSONField))
+		tb.String(key)
+		data, err := json.Marshal(val)
+		if err != nil {
+			tb.ByteString(nil)
+			tb.ErrWithStack(err)
+		} else {
+			tb.ByteString(data)
+			tb.ErrWithStack(nil)
+		}
+
+	case int8:
+		tb.Byte(byte(model.IntField))
+		tb.String(key)
+		tb.Varint(int64(val))
+	case int16:
+		tb.Byte(byte(model.IntField))
+		tb.String(key)
+		tb.Varint(int64(val))
+	case int32:
+		tb.Byte(byte(model.IntField))
+		tb.String(key)
+		tb.Varint(int64(val))
+	case int64:
+		tb.Byte(byte(model.IntField))
+		tb.String(key)
+		tb.Varint(int64(val))
+	case int:
+		tb.Byte(byte(model.IntField))
+		tb.String(key)
+		tb.Varint(int64(val))
+
+	case uint8:
+		tb.Byte(byte(model.UintField))
+		tb.String(key)
+		tb.UVarint(uint64(val))
+	case uint16:
+		tb.Byte(byte(model.UintField))
+		tb.String(key)
+		tb.UVarint(uint64(val))
+	case uint32:
+		tb.Byte(byte(model.UintField))
+		tb.String(key)
+		tb.UVarint(uint64(val))
+	case uint64:
+		tb.Byte(byte(model.UintField))
+		tb.String(key)
+		tb.UVarint(uint64(val))
+	case uint:
+		tb.Byte(byte(model.UintField))
+		tb.String(key)
+		tb.UVarint(uint64(val))
+
+	case float32:
+		tb.Byte(byte(model.Float32Field))
+		tb.String(key)
+		tb.Float32(val)
+	case float64:
+		tb.Byte(byte(model.Float64Field))
+		tb.String(key)
+		tb.Float64(val)
+	}
+}
diff --git a/runtimes/go/appruntime/exported/trace2/http.go b/runtimes/go/appruntime/exported/trace2/http.go
new file mode 100644
index 0000000000..f1d740caf9
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace2/http.go
@@ -0,0 +1,372 @@
+package trace2
+
+import (
+	"context"
+	"crypto/tls"
+	"io"
+	"net/http"
+	"net/http/httptrace"
+	"net/textproto"
+	"sync"
+	_ "unsafe" // for go:linkname
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+)
+
+func (l *Log) HTTPBeginRoundTrip(httpReq *http.Request, req *model.Request, goid uint32) (context.Context, error) {
+	if l == nil {
+		return httpReq.Context(), nil
+	}
+
+	callCorrelationParentSpanID, err := model.GenSpanID()
+	if err != nil {
+		return nil, err
+	}
+
+	requestURL := httpReq.URL.String()
+
+	tb := l.newEvent(eventData{
+		Common:     EventParams{Goid: goid},
+		ExtraSpace: 8 + len(httpReq.Method) + len(requestURL) + 4,
+	})
+
+	tb.Bytes(callCorrelationParentSpanID[:])
+	tb.String(httpReq.Method)
+	tb.String(requestURL)
+	tb.Stack(stack.Build(4))
+	tb.Int64(nanotime())
+
+	eventID := l.Add(Event{
+		Type:    HTTPCallStart,
+		TraceID: req.TraceID,
+		SpanID:  req.SpanID,
+		Data:    tb,
+	})
+
+	rt := &httpRoundTrip{
+		TraceID:                 req.TraceID,
+		SpanID:                  req.SpanID,
+		StartID:                 eventID,
+		CorrelationParentSpanID: callCorrelationParentSpanID,
+		log:                     l,
+	}
+
+	ctx := context.WithValue(httpReq.Context(), rtKey, rt)
+	tr := &httptrace.ClientTrace{
+		GetConn:              rt.getConn,
+		GotConn:              rt.gotConn,
+		GotFirstResponseByte: rt.gotFirstResponseByte,
+		Got1xxResponse:       rt.got1xxResponse,
+		DNSStart:             rt.dnsStart,
+		DNSDone:              rt.dnsDone,
+		ConnectStart:         rt.connectStart,
+		ConnectDone:          rt.connectDone,
+		TLSHandshakeStart:    rt.tlsHandshakeStart,
+		TLSHandshakeDone:     rt.tlsHandshakeDone,
+		WroteHeaders:         rt.wroteHeaders,
+		Wait100Continue:      rt.wait100Continue,
+		WroteRequest:         rt.wroteRequest,
+	}
+	return httptrace.WithClientTrace(ctx, tr), nil
+}
+
+func (l *Log) HTTPCompleteRoundTrip(req *http.Request, resp *http.Response, goid uint32, err error) {
+	rt, ok := req.Context().Value(rtKey).(*httpRoundTrip)
+	if !ok {
+		return
+	}
+
+	tb := l.newEvent(eventData{
+		Common:             EventParams{Goid: goid},
+		CorrelationEventID: rt.StartID,
+		ExtraSpace:         64,
+	})
+
+	if resp != nil {
+		tb.UVarint(uint64(resp.StatusCode))
+	} else {
+		tb.UVarint(0)
+	}
+	tb.ErrWithStack(err)
+
+	rt.encodeEvents(&tb)
+	rt.log.Add(Event{
+		Type:    HTTPCallEnd,
+		TraceID: rt.TraceID,
+		SpanID:  rt.SpanID,
+		Data:    tb,
+	})
+
+	if req.Method != "HEAD" && resp != nil {
+		resp.Body = wrapRespBody(resp.Body, rt)
+	}
+}
+
+type httpRoundTrip struct {
+	TraceID                 model.TraceID
+	SpanID                  model.SpanID
+	StartID                 EventID
+	CorrelationParentSpanID model.SpanID
+
+	log Logger
+
+	mu     sync.Mutex
+	events []httpEvent
+}
+
+func (rt *httpRoundTrip) getConn(hostPort string) {
+	rt.addEvent(GetConn, &getConnEvent{hostPort: hostPort})
+}
+
+func (rt *httpRoundTrip) gotConn(info httptrace.GotConnInfo) {
+	rt.addEvent(GotConn, &gotConnEvent{info: info})
+}
+
+func (rt *httpRoundTrip) gotFirstResponseByte() {
+	rt.addEvent(GotFirstResponseByte, nil)
+}
+
+func (rt *httpRoundTrip) got1xxResponse(code int, header textproto.MIMEHeader) error {
+	rt.addEvent(Got1xxResponse, &got1xxResponseEvent{code: code, header: header})
+	return nil
+}
+
+func (rt *httpRoundTrip) dnsStart(info httptrace.DNSStartInfo) {
+	rt.addEvent(DNSStart, &dnsStartEvent{info: info})
+}
+
+func (rt *httpRoundTrip) dnsDone(info httptrace.DNSDoneInfo) {
+	rt.addEvent(DNSDone, &dnsDoneEvent{info: info})
+}
+
+func (rt *httpRoundTrip) connectStart(network, addr string) {
+	rt.addEvent(ConnectStart, &connectStartEvent{network: network, addr: addr})
+}
+
+func (rt *httpRoundTrip) connectDone(network, addr string, err error) {
+	rt.addEvent(ConnectDone, &connectDoneEvent{network: network, addr: addr, err: err})
+}
+
+func (rt *httpRoundTrip) tlsHandshakeStart() {
+	rt.addEvent(TLSHandshakeStart, nil)
+}
+
+func (rt *httpRoundTrip) tlsHandshakeDone(state tls.ConnectionState, err error) {
+	rt.addEvent(TLSHandshakeDone, &tlsHandshakeDoneEvent{info: state, err: err})
+}
+
+func (rt *httpRoundTrip) wroteHeaders() {
+	rt.addEvent(WroteHeaders, nil)
+}
+
+func (rt *httpRoundTrip) wroteRequest(info httptrace.WroteRequestInfo) {
+	rt.addEvent(WroteRequest, &wroteRequestEvent{info: info})
+}
+
+func (rt *httpRoundTrip) wait100Continue() {
+	rt.addEvent(Wait100Continue, nil)
+}
+
+func (rt *httpRoundTrip) addEvent(code HTTPEventCode, data httpEventData) {
+	ts := nanotime()
+	rt.mu.Lock()
+	defer rt.mu.Unlock()
+
+	rt.events = append(rt.events, httpEvent{
+		code: code,
+		ts:   ts,
+		data: data,
+	})
+}
+
+func (rt *httpRoundTrip) encodeEvents(tb *EventBuffer) {
+	rt.mu.Lock()
+	n := len(rt.events)
+	evs := rt.events[:]
+	rt.mu.Unlock()
+
+	tb.UVarint(uint64(n))
+	for _, e := range evs {
+		tb.Bytes([]byte{byte(e.code)})
+		tb.Int64(e.ts)
+		if e.data != nil {
+			e.data.Encode(tb)
+		}
+	}
+}
+
+func (rt *httpRoundTrip) closedBody(err error) {
+	rt.addEvent(ClosedBody, &closedBodyEvent{err: err})
+}
+
+func wrapRespBody(body io.ReadCloser, rt *httpRoundTrip) io.ReadCloser {
+	if readWriteCloser, ok := body.(io.ReadWriteCloser); ok {
+		return writerCloseTracker{readWriteCloser, rt}
+	}
+	return closeTracker{body, rt}
+}
+
+type closeTracker struct {
+	io.ReadCloser
+	rt *httpRoundTrip
+}
+
+func (c closeTracker) Close() error {
+	err := c.ReadCloser.Close()
+	c.rt.closedBody(err)
+	return err
+}
+
+type writerCloseTracker struct {
+	io.ReadWriteCloser
+	rt *httpRoundTrip
+}
+
+func (c writerCloseTracker) Close() error {
+	err := c.ReadWriteCloser.Close()
+	c.rt.closedBody(err)
+	return err
+}
+
+type httpEvent struct {
+	code HTTPEventCode
+	ts   int64
+	data httpEventData // or nil
+}
+
+type httpEventData interface {
+	Encode(tb *EventBuffer)
+}
+
+type HTTPEventCode byte
+
+const (
+	GetConn              = 1
+	GotConn              = 2
+	GotFirstResponseByte = 3
+	Got1xxResponse       = 4
+	DNSStart             = 5
+	DNSDone              = 6
+	ConnectStart         = 7
+	ConnectDone          = 8
+	TLSHandshakeStart    = 9
+	TLSHandshakeDone     = 10
+	WroteHeaders         = 11
+	WroteRequest         = 12
+	Wait100Continue      = 13
+	ClosedBody           = 14
+)
+
+type getConnEvent struct {
+	hostPort string
+}
+
+func (e *getConnEvent) Encode(tb *EventBuffer) {
+	tb.String(e.hostPort)
+}
+
+type gotConnEvent struct {
+	info httptrace.GotConnInfo
+}
+
+func (e *gotConnEvent) Encode(tb *EventBuffer) {
+	tb.Bool(e.info.Reused)
+	tb.Bool(e.info.WasIdle)
+	tb.Int64(int64(e.info.IdleTime))
+}
+
+type got1xxResponseEvent struct {
+	code   int
+	header textproto.MIMEHeader
+}
+
+func (e *got1xxResponseEvent) Encode(tb *EventBuffer) {
+	tb.Varint(int64(e.code))
+	// TODO: write header as well?
+}
+
+type dnsStartEvent struct {
+	info httptrace.DNSStartInfo
+}
+
+func (e *dnsStartEvent) Encode(tb *EventBuffer) {
+	tb.String(e.info.Host)
+}
+
+type dnsDoneEvent struct {
+	info httptrace.DNSDoneInfo
+}
+
+func (e *dnsDoneEvent) Encode(tb *EventBuffer) {
+	if err := e.info.Err; err != nil {
+		msg := err.Error()
+		if msg == "" {
+			msg = "unknown error"
+		}
+		tb.String(msg)
+	} else {
+		tb.String("")
+	}
+	tb.UVarint(uint64(len(e.info.Addrs)))
+	for _, a := range e.info.Addrs {
+		tb.ByteString(a.IP)
+	}
+}
+
+type connectStartEvent struct {
+	network string
+	addr    string
+}
+
+func (e *connectStartEvent) Encode(tb *EventBuffer) {
+	tb.String(e.network)
+	tb.String(e.addr)
+}
+
+type connectDoneEvent struct {
+	network string
+	addr    string
+	err     error
+}
+
+func (e *connectDoneEvent) Encode(tb *EventBuffer) {
+	tb.String(e.network)
+	tb.String(e.addr)
+	tb.Err(e.err)
+}
+
+type tlsHandshakeDoneEvent struct {
+	info tls.ConnectionState
+	err  error
+}
+
+func (e *tlsHandshakeDoneEvent) Encode(tb *EventBuffer) {
+	tb.Err(e.err)
+	tb.Uint32(uint32(e.info.Version))
+	tb.Uint32(uint32(e.info.CipherSuite))
+	tb.String(e.info.ServerName)
+	tb.String(e.info.NegotiatedProtocol)
+}
+
+type wroteRequestEvent struct {
+	info httptrace.WroteRequestInfo
+}
+
+func (e *wroteRequestEvent) Encode(tb *EventBuffer) {
+	tb.Err(e.info.Err)
+}
+
+type closedBodyEvent struct {
+	err error
+}
+
+func (e *closedBodyEvent) Encode(tb *EventBuffer) {
+	tb.Err(e.err)
+}
+
+type contextKey int
+
+const (
+	rtKey contextKey = iota
+)
diff --git a/runtimes/go/appruntime/exported/trace2/log.go b/runtimes/go/appruntime/exported/trace2/log.go
new file mode 100644
index 0000000000..d5fead49c7
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace2/log.go
@@ -0,0 +1,413 @@
+package trace2
+
+import (
+	"math"
+	"sync"
+	"sync/atomic"
+	"time"
+	_ "unsafe" // for go:linkname
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/beta/errs"
+)
+
+type EventID = model.TraceEventID
+
+// nextEventID is an atomic counter for event IDs.
+var nextEventID atomic.Uint64
+
+func NewLog() *Log {
+	l := &Log{}
+	l.cond = sync.NewCond(&l.mu)
+	return l
+}
+
+type Log struct {
+	mu   sync.Mutex
+	data []byte
+	done bool
+	cond *sync.Cond
+}
+
+// Ensure Log implements Logger.
+var _ Logger = (*Log)(nil)
+
+type Event struct {
+	Type    EventType
+	TraceID model.TraceID
+	SpanID  model.SpanID
+	Data    EventBuffer
+}
+
+// Add adds a new event in the trace log.
+// If l is nil, it does nothing.
+func (l *Log) Add(e Event) EventID {
+	if l == nil {
+		return 0
+	}
+
+	eventData := e.Data.Buf()
+	ln := len(eventData)
+	if ln > (1<<32 - 1) {
+		println("encore.traceEvent: event too large, dropping")
+		return 0
+	}
+
+	eventID := nextEventID.Add(1)
+	if eventID == 0 {
+		// We use 0 to indicate "no event" in several places,
+		// so don't use that value.
+		eventID = nextEventID.Add(1)
+	}
+
+	ts := signedToUnsigned(nanotime())
+	header := [...]byte{
+		// Event type, 1 byte
+		byte(e.Type),
+
+		// Event ID, 8 bytes
+		byte(eventID),
+		byte(eventID >> 8),
+		byte(eventID >> 16),
+		byte(eventID >> 24),
+		byte(eventID >> 32),
+		byte(eventID >> 40),
+		byte(eventID >> 48),
+		byte(eventID >> 56),
+
+		// Timestamp, 8 bytes
+		byte(ts),
+		byte(ts >> 8),
+		byte(ts >> 16),
+		byte(ts >> 24),
+		byte(ts >> 32),
+		byte(ts >> 40),
+		byte(ts >> 48),
+		byte(ts >> 56),
+
+		// Trace ID, 16 bytes
+		e.TraceID[0], e.TraceID[1], e.TraceID[2], e.TraceID[3],
+		e.TraceID[4], e.TraceID[5], e.TraceID[6], e.TraceID[7],
+		e.TraceID[8], e.TraceID[9], e.TraceID[10], e.TraceID[11],
+		e.TraceID[12], e.TraceID[13], e.TraceID[14], e.TraceID[15],
+
+		// Span ID, 8 bytes
+		e.SpanID[0], e.SpanID[1], e.SpanID[2], e.SpanID[3],
+		e.SpanID[4], e.SpanID[5], e.SpanID[6], e.SpanID[7],
+
+		// Event data length, 4 bytes
+		byte(ln),
+		byte(ln >> 8),
+		byte(ln >> 16),
+		byte(ln >> 24),
+	}
+
+	l.mu.Lock()
+	l.data = append(l.data, append(header[:], eventData...)...)
+	l.mu.Unlock()
+	l.cond.Broadcast()
+
+	return EventID(eventID)
+}
+
+func (l *Log) WaitUntilDone() {
+	l.mu.Lock()
+	for !l.done {
+		l.cond.Wait()
+	}
+	l.mu.Unlock()
+}
+
+// WaitAtLeast waits for at least dur to pass or for the log to be done.
+// If no trace data is being written it can block for longer than dur.
+// It reports whether the trace is done at the time of returning.
+func (l *Log) WaitAtLeast(dur time.Duration) (done bool) {
+	now := time.Now()
+	l.mu.Lock()
+	for !l.done && time.Since(now) < dur {
+		l.cond.Wait()
+	}
+	done = l.done
+	l.mu.Unlock()
+	return done
+}
+
+// WaitAndClear blocks for data to arrive and then returns the data
+// and whether the log has been completed. It also clears the log from
+// any data it returns.
+func (l *Log) WaitAndClear() (data []byte, done bool) {
+	l.mu.Lock()
+	for len(l.data) == 0 && !l.done {
+		l.cond.Wait()
+	}
+	done = l.done
+	data = l.data
+	l.clearDataBuf()
+	l.mu.Unlock()
+	return data, done
+}
+
+// MarkDone marks the log as done.
+func (l *Log) MarkDone() {
+	l.mu.Lock()
+	l.done = true
+	l.mu.Unlock()
+	l.cond.Broadcast()
+}
+
+const (
+	maxBufferSize     = 100 * (10 << 20) // 100 MiB
+	initialBufferSize = 10 * (10 << 20)  // 10 MiB
+)
+
+// GetAndClear gets the data and clears the buffer.
+func (l *Log) GetAndClear() (data []byte, done bool) {
+	l.mu.Lock()
+	data, done = l.data, l.done
+	l.clearDataBuf()
+	l.mu.Unlock()
+	return data, done
+}
+
+// clearDataBuf clears the data buf, either allocating a new buffer
+// or by setting its length to 0 (keeping its capacity).
+func (l *Log) clearDataBuf() {
+	// Determine if we should keep growing the buffer or if it's time to
+	// create a new one to allow the old one to be GC'd.
+	if cap(l.data) > maxBufferSize {
+		l.data = make([]byte, 0, initialBufferSize)
+	} else {
+		l.data = l.data[len(l.data):]
+	}
+}
+
+// EventBuffer is a performant, low-overhead, growable buffer
+// for buffering trace data in a compact way.
+//
+// The zero value is ready to be used, but NewEventBuffer
+// can be used to provide an initial size hint.
+type EventBuffer struct {
+	scratch [10]byte
+	buf     []byte
+}
+
+func NewEventBuffer(size int) EventBuffer {
+	return EventBuffer{buf: make([]byte, 0, size)}
+}
+
+func (tb *EventBuffer) Buf() []byte {
+	return tb.buf
+}
+
+func (tb *EventBuffer) Byte(b byte) {
+	tb.buf = append(tb.buf, b)
+}
+
+func (tb *EventBuffer) Bytes(b []byte) {
+	tb.buf = append(tb.buf, b...)
+}
+
+func (tb *EventBuffer) String(s string) {
+	tb.UVarint(uint64(len(s)))
+	tb.Bytes([]byte(s))
+}
+
+func (tb *EventBuffer) ByteString(b []byte) {
+	tb.UVarint(uint64(len(b)))
+	tb.Bytes(b)
+}
+
+// TruncatedByteString is like ByteString except it truncates b to maximum of maxLen.
+// If truncationSuffix is provided, it is appended after truncating, leading to
+// the final length being maxLen+len(truncationSuffix).
+func (tb *EventBuffer) TruncatedByteString(b []byte, maxLen int, truncationSuffix []byte) {
+	if size := len(b); size > maxLen {
+		tb.UVarint(uint64(maxLen + len(truncationSuffix)))
+		tb.Bytes(b[:maxLen])
+		tb.Bytes(truncationSuffix)
+	} else {
+		tb.ByteString(b)
+	}
+}
+
+func (tb *EventBuffer) Now() {
+	now := time.Now()
+	tb.Time(now)
+}
+
+func (tb *EventBuffer) Bool(b bool) {
+	if b {
+		tb.Bytes([]byte{1})
+	} else {
+		tb.Bytes([]byte{0})
+	}
+}
+
+func (tb *EventBuffer) Err(err error) {
+	msg := ""
+	if err != nil {
+		msg = err.Error()
+		if msg == "" {
+			msg = "unknown error"
+		}
+	}
+	tb.String(msg)
+}
+
+func (tb *EventBuffer) ErrWithStack(err error) {
+	if err == nil {
+		tb.String("")
+		return
+	}
+
+	msg := err.Error()
+	if msg == "" {
+		msg = "unknown error"
+	}
+	tb.String(msg)
+	tb.Stack(errs.Stack(err))
+}
+
+func (tb *EventBuffer) Time(t time.Time) {
+	tb.Int64(t.Unix())
+	tb.Int32(int32(t.Nanosecond()))
+}
+
+func (tb *EventBuffer) Int32(x int32) {
+	var u uint32
+	if x < 0 {
+		u = (^uint32(x) << 1) | 1 // complement i, bit 0 is 1
+	} else {
+		u = (uint32(x) << 1) // do not complement i, bit 0 is 0
+	}
+	tb.Uint32(u)
+}
+
+func (tb *EventBuffer) Uint32(x uint32) {
+	tb.buf = append(tb.buf,
+		byte(x),
+		byte(x>>8),
+		byte(x>>16),
+		byte(x>>24),
+	)
+}
+
+func (tb *EventBuffer) Int64(i int64) {
+	tb.Uint64(signedToUnsigned(i))
+}
+
+func (tb *EventBuffer) EventID(id EventID) {
+	tb.UVarint(uint64(id))
+}
+
+func (tb *EventBuffer) OptString(s *string) {
+	if s != nil {
+		tb.String(*s)
+	} else {
+		tb.String("")
+	}
+}
+
+func (tb *EventBuffer) OptUVarint(i *uint64) {
+	if i != nil {
+		tb.UVarint(*i)
+	} else {
+		tb.UVarint(0)
+	}
+}
+
+func (tb *EventBuffer) Uint64(x uint64) {
+	tb.buf = append(tb.buf,
+		byte(x),
+		byte(x>>8),
+		byte(x>>16),
+		byte(x>>24),
+		byte(x>>32),
+		byte(x>>40),
+		byte(x>>48),
+		byte(x>>56),
+	)
+}
+
+func (tb *EventBuffer) Varint(i int64) {
+	tb.UVarint(signedToUnsigned(i))
+}
+
+func (tb *EventBuffer) UVarint(u uint64) {
+	i := 0
+	for u >= 0x80 {
+		tb.scratch[i] = byte(u) | 0x80
+		u >>= 7
+		i++
+	}
+	tb.scratch[i] = byte(u)
+	i++
+	tb.Bytes(tb.scratch[:i])
+}
+
+func (tb *EventBuffer) Float32(f float32) {
+	tb.Uint32(math.Float32bits(f))
+}
+
+func (tb *EventBuffer) Float64(f float64) {
+	tb.Uint64(math.Float64bits(f))
+}
+
+func (tb *EventBuffer) Duration(dur time.Duration) {
+	tb.Varint(int64(dur))
+}
+
+func (tb *EventBuffer) Stack(s stack.Stack) {
+	n := len(s.Frames)
+	if n > 0xFF {
+		// Should never happen (the runtime caps it at 100),
+		// but be defensive about it.
+		n = 0xFF
+	}
+	tb.Byte(byte(n))
+	if n == 0 {
+		return
+	}
+
+	var prev int64 = 0
+	for _, pc := range s.Frames {
+		p := int64(pc - s.Off)
+		diff := p - prev
+		tb.Varint(diff)
+		prev = p
+	}
+}
+
+// FormattedStack is like Stack but includes the formatted frames.
+func (tb *EventBuffer) FormattedStack(s stack.Stack) {
+	frames := stack.Format(s)
+	n := len(frames)
+	if n > 0xFF {
+		// Should never happen (the runtime caps it at 100),
+		// but be defensive about it.
+		n = 0xFF
+	}
+
+	tb.Byte(byte(n))
+	if n == 0 {
+		return
+	}
+
+	for _, f := range frames[:n] {
+		tb.String(f.File)
+		tb.UVarint(uint64(f.Line))
+		tb.String(f.Func)
+	}
+}
+
+func signedToUnsigned(i int64) uint64 {
+	if i < 0 {
+		return (^uint64(i) << 1) | 1 // complement i, bit 0 is 1
+	} else {
+		return (uint64(i) << 1) // do not complement i, bit 0 is 0
+	}
+}
+
+//go:linkname nanotime runtime.nanotime
+func nanotime() int64
diff --git a/runtimes/go/appruntime/exported/trace2/logger.go b/runtimes/go/appruntime/exported/trace2/logger.go
new file mode 100644
index 0000000000..5e0c26f915
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace2/logger.go
@@ -0,0 +1,58 @@
+package trace2
+
+import (
+	"context"
+	"net/http"
+	"time"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+)
+
+//go:generate mockgen -source=./logger.go -package=mock_trace -destination ../../shared/traceprovider/mock_trace/mock_trace.go Logger
+
+type Logger interface {
+	MarkDone()
+	Add(Event) EventID
+
+	WaitUntilDone()
+	WaitAtLeast(time.Duration) bool
+	GetAndClear() (data []byte, done bool)
+	WaitAndClear() (data []byte, done bool)
+
+	RequestSpanStart(req *model.Request, goid uint32)
+	RequestSpanEnd(params RequestSpanEndParams)
+	AuthSpanStart(req *model.Request, goid uint32)
+	AuthSpanEnd(params AuthSpanEndParams)
+	PubsubMessageSpanStart(req *model.Request, goid uint32)
+	PubsubMessageSpanEnd(params PubsubMessageSpanEndParams)
+	TestSpanStart(req *model.Request, goid uint32)
+	TestSpanEnd(params TestSpanEndParams)
+	RPCCallStart(call *model.APICall, goid uint32) EventID
+	RPCCallEnd(call *model.APICall, goid uint32, err error)
+	DBQueryStart(p DBQueryStartParams) EventID
+	DBQueryEnd(EventParams, EventID, error)
+	DBTransactionStart(EventParams, stack.Stack) EventID
+	DBTransactionEnd(DBTransactionEndParams)
+	PubsubPublishStart(PubsubPublishStartParams) EventID
+	PubsubPublishEnd(PubsubPublishEndParams)
+	ServiceInitStart(ServiceInitStartParams) EventID
+	ServiceInitEnd(EventParams, EventID, error)
+	CacheCallStart(CacheCallStartParams) EventID
+	CacheCallEnd(CacheCallEndParams)
+	BodyStream(BodyStreamParams)
+	LogMessage(LogMessageParams)
+	HTTPBeginRoundTrip(httpReq *http.Request, req *model.Request, goid uint32) (context.Context, error)
+	HTTPCompleteRoundTrip(req *http.Request, resp *http.Response, goid uint32, err error)
+
+	BucketObjectUploadStart(BucketObjectUploadStartParams) EventID
+	BucketObjectUploadEnd(BucketObjectUploadEndParams)
+	BucketObjectDownloadStart(BucketObjectDownloadStartParams) EventID
+	BucketObjectDownloadEnd(BucketObjectDownloadEndParams)
+	BucketObjectGetAttrsStart(BucketObjectGetAttrsStartParams) EventID
+	BucketObjectGetAttrsEnd(BucketObjectGetAttrsEndParams)
+	BucketListObjectsStart(BucketListObjectsStartParams) EventID
+	BucketListObjectsEnd(BucketListObjectsEndParams)
+	BucketDeleteObjectsStart(BucketDeleteObjectsStartParams) EventID
+	BucketDeleteObjectsEnd(BucketDeleteObjectsEndParams)
+}
diff --git a/runtimes/go/appruntime/exported/trace2/mutex_app.go b/runtimes/go/appruntime/exported/trace2/mutex_app.go
new file mode 100644
index 0000000000..9bf6eb4e6d
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace2/mutex_app.go
@@ -0,0 +1,16 @@
+//go:build encore_app
+
+package trace2
+
+import _ "unsafe" // for go:linkname
+
+// mutex must exactly match implementation in the runtime.
+type mutex struct {
+	key uintptr
+}
+
+//go:linkname mutexLock runtime.lock
+func mutexLock(mut *mutex)
+
+//go:linkname mutexUnlock runtime.unlock
+func mutexUnlock(mut *mutex)
diff --git a/runtimes/go/appruntime/exported/trace2/mutex_noapp.go b/runtimes/go/appruntime/exported/trace2/mutex_noapp.go
new file mode 100644
index 0000000000..4984163a98
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace2/mutex_noapp.go
@@ -0,0 +1,13 @@
+//go:build !encore_app
+
+package trace2
+
+import "sync"
+
+type mutex struct {
+	mut sync.Mutex
+}
+
+func mutexLock(m *mutex) { m.mut.Lock() }
+
+func mutexUnlock(m *mutex) { m.mut.Unlock() }
diff --git a/runtimes/go/appruntime/exported/trace2/timeanchor.go b/runtimes/go/appruntime/exported/trace2/timeanchor.go
new file mode 100644
index 0000000000..96e5aac4fc
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace2/timeanchor.go
@@ -0,0 +1,58 @@
+package trace2
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// NewTimeAnchor constructs a new TimeAnchor.
+func NewTimeAnchor(nano int64, real time.Time) TimeAnchor {
+	return TimeAnchor{nano: nano, real: real}
+}
+
+// NewTimeAnchorNow constructs a new TimeAnchor based on the current time.
+func NewTimeAnchorNow() TimeAnchor {
+	now := time.Now()
+	nano := nanotime()
+	return NewTimeAnchor(nano, now)
+}
+
+// TimeAnchor represents a mapping between nanotime() timestamps
+// and real-world time.Time instants.
+type TimeAnchor struct {
+	nano int64
+	real time.Time
+}
+
+// ToReal converts a nanotime() timestamp to a real-world time.Time instant.
+func (ta TimeAnchor) ToReal(nano int64) time.Time {
+	return ta.real.Add(time.Duration(nano - ta.nano))
+}
+
+// MarshalText marshals the anchor as text. It never fails.
+func (ta TimeAnchor) MarshalText() ([]byte, error) {
+	nano := strconv.FormatInt(ta.nano, 10)
+	return []byte(nano + " " + ta.real.Format(time.RFC3339Nano)), nil
+}
+
+// UnmarshalText unmarshals the anchor from text.
+func (ta *TimeAnchor) UnmarshalText(text []byte) error {
+	a, b, ok := strings.Cut(string(text), " ")
+	if !ok {
+		return fmt.Errorf("invalid time anchor format: %q", text)
+	}
+	nano, err := strconv.ParseInt(a, 10, 64)
+	if err != nil {
+		return err
+	}
+	real, err := time.Parse(time.RFC3339Nano, b)
+	if err != nil {
+		return err
+	}
+
+	ta.nano = nano
+	ta.real = real
+	return nil
+}
diff --git a/runtimes/go/appruntime/exported/trace2/version.go b/runtimes/go/appruntime/exported/trace2/version.go
new file mode 100644
index 0000000000..b7b80d17b2
--- /dev/null
+++ b/runtimes/go/appruntime/exported/trace2/version.go
@@ -0,0 +1,6 @@
+package trace2
+
+type Version int
+
+// CurrentVersion is the trace protocol version this package produces traces in.
+const CurrentVersion Version = 15
diff --git a/runtimes/go/appruntime/infrasdk/metadata/aws_collector.go b/runtimes/go/appruntime/infrasdk/metadata/aws_collector.go
new file mode 100644
index 0000000000..f28dce4dba
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metadata/aws_collector.go
@@ -0,0 +1,71 @@
+//go:build !encore_no_aws
+
+package metadata
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"time"
+
+	encore "encore.dev"
+)
+
+func init() {
+	registerCollector(collectorDesc{
+		name: "aws",
+		matches: func(envCloud string) bool {
+			return envCloud == encore.CloudAWS
+		},
+		collect: func() (*ContainerMetadata, error) {
+			// Encore supports running on both ECS Fargate and EKS.
+			// For Fargate, we can get the metadata from the ECS metadata service.
+			// For EKS there doesn't appear to be a standard way to get the metadata, so skip it in that case.
+			metadataURI, ok := os.LookupEnv("ECS_CONTAINER_METADATA_URI_V4")
+			if !ok {
+				return &ContainerMetadata{
+					ServiceID:  "",
+					RevisionID: "",
+					InstanceID: "",
+				}, nil
+			}
+
+			ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+			defer cancel()
+			req, err := http.NewRequestWithContext(ctx, http.MethodGet, metadataURI+"/task", nil)
+			if err != nil {
+				return nil, fmt.Errorf("unable to create metadata request: %w", err)
+			}
+
+			resp, err := http.DefaultClient.Do(req)
+			if err != nil {
+				return nil, fmt.Errorf("error sending metadata request: %w", err)
+			}
+			defer func() { _ = resp.Body.Close() }()
+
+			body, err := io.ReadAll(resp.Body)
+			if err != nil {
+				return nil, fmt.Errorf("error reading metadata response: %w", err)
+			}
+
+			taskMetadata := &struct {
+				ServiceName string `json:"ServiceName"`
+				Revision    string `json:"Revision"`
+				TaskARN     string `json:"TaskARN"`
+			}{}
+			err = json.Unmarshal(body, &taskMetadata)
+			if err != nil {
+				return nil, fmt.Errorf("error unmarshaling metadata response body: %w", err)
+			}
+
+			return &ContainerMetadata{
+				ServiceID:  taskMetadata.ServiceName,
+				RevisionID: taskMetadata.Revision,
+				InstanceID: taskMetadata.TaskARN[len(taskMetadata.TaskARN)-8:],
+			}, nil
+		},
+	})
+}
diff --git a/runtimes/go/appruntime/infrasdk/metadata/cloud_run_collector.go b/runtimes/go/appruntime/infrasdk/metadata/cloud_run_collector.go
new file mode 100644
index 0000000000..7ac3a6cc70
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metadata/cloud_run_collector.go
@@ -0,0 +1,61 @@
+//go:build !encore_no_gcp
+
+package metadata
+
+import (
+	"fmt"
+	"os"
+	"strings"
+
+	gcemetadata "cloud.google.com/go/compute/metadata"
+
+	encore "encore.dev"
+)
+
+func init() {
+	registerCollector(collectorDesc{
+		name: "cloud_run",
+		matches: func(envCloud string) bool {
+			return envCloud == encore.EncoreCloud || envCloud == encore.CloudGCP
+		},
+		collect: func() (*ContainerMetadata, error) {
+			service, ok := os.LookupEnv("K_SERVICE")
+			if !ok {
+				return nil, fmt.Errorf("unable to get service ID: env variable '%s' unset", "K_SERVICE")
+			}
+
+			revision, ok := os.LookupEnv("K_REVISION")
+			if !ok {
+				return nil, fmt.Errorf("unable to get revision ID: env variable '%s' unset", "K_REVISION")
+			}
+			revision = strings.TrimPrefix(revision, service+"-")
+
+			instanceID, ok := os.LookupEnv("K_POD")
+			if !ok {
+				// If we don't have a K8s POD name, we're running on Cloud Run and can get the instance ID from the metadata server
+				var err error
+				instanceID, err = gcemetadata.InstanceID()
+				if err != nil {
+					return nil, fmt.Errorf("unable to get instance ID: %w", err)
+				}
+				instanceID = instanceID[len(instanceID)-8:]
+			} else {
+				// If we have a K8s POD name, take the last part of it which is the random pod ID
+				// On GKE, the InstanceID appears to be the Node, so if the multiple replicas are running
+				// on the same InstanceID then we'd have a collision. This is unlikely, but possible -
+				// hence why we use the pod ID instead.
+				idx := strings.LastIndex(instanceID, "-")
+				if idx == -1 {
+					return nil, fmt.Errorf("invalid instance ID '%s'", instanceID)
+				}
+				instanceID = instanceID[idx+1:]
+			}
+
+			return &ContainerMetadata{
+				ServiceID:  service,
+				RevisionID: revision,
+				InstanceID: instanceID,
+			}, nil
+		},
+	})
+}
diff --git a/runtimes/go/appruntime/infrasdk/metadata/metadata.go b/runtimes/go/appruntime/infrasdk/metadata/metadata.go
new file mode 100644
index 0000000000..5b07e6758a
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metadata/metadata.go
@@ -0,0 +1,78 @@
+package metadata
+
+import (
+	"fmt"
+
+	"encore.dev/appruntime/exported/config"
+)
+
+type collectorDesc struct {
+	name    string
+	matches func(envCloud string) bool
+	collect func() (*ContainerMetadata, error)
+}
+
+var collectorRegistry []collectorDesc
+
+func registerCollector(desc collectorDesc) {
+	collectorRegistry = append(collectorRegistry, desc)
+}
+
+type Label struct {
+	key, value string
+}
+
+type Labels []Label
+
+func (l Labels) AsMap() map[string]string {
+	m := make(map[string]string)
+	for _, kv := range l {
+		m[kv.key] = kv.value
+	}
+	return m
+}
+
+func (l *Labels) AddNonEmpty(key, value string) *Labels {
+	if value != "" {
+		*l = append(*l, Label{key, value})
+	}
+	return l
+}
+
+type ContainerMetadata struct {
+	ServiceID  string
+	RevisionID string
+	InstanceID string
+	EnvName    string
+}
+
+func (md *ContainerMetadata) Labels() Labels {
+	var labels Labels
+	labels.AddNonEmpty("service_id", md.ServiceID)
+	labels.AddNonEmpty("revision_id", md.RevisionID)
+	labels.AddNonEmpty("instance_id", md.InstanceID)
+	labels.AddNonEmpty("env_name", md.EnvName)
+	return labels
+}
+
+func MapMetadataLabels[T any](md *ContainerMetadata, fn func(k, v string) T) []T {
+	var labels []T
+	for _, v := range md.Labels() {
+		labels = append(labels, fn(v.key, v.value))
+	}
+	return labels
+}
+
+func GetContainerMetadata(cfg *config.Runtime) (*ContainerMetadata, error) {
+	for _, collector := range collectorRegistry {
+		if collector.matches(cfg.EnvCloud) {
+			md, err := collector.collect()
+			if err != nil {
+				return nil, err
+			}
+			md.EnvName = cfg.EnvName
+			return md, nil
+		}
+	}
+	return nil, fmt.Errorf("no metadata collector found for environment cloud '%s'", cfg.EnvCloud)
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/README.md b/runtimes/go/appruntime/infrasdk/metrics/README.md
new file mode 100644
index 0000000000..5ff5feaf89
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/README.md
@@ -0,0 +1,16 @@
+# `metrics`
+
+This package allows an Encore app to export custom metrics to metric providers.
+
+We have two types of custom metrics: a predefined set of custom metrics which are enabled for all Encore apps and
+user-defined custom metrics.
+
+## Predefined Encore metrics
+
+These are the metrics all Encore apps export to metric providers:
+
+- `e_requests_total` measures the number of requests and has three labels `service`, `endpoint` and `code`. `code` is a
+  human-readable HTTP status code (e.g. `ok`, `not_found`).
+- `e_sys_memory_heap_objects_bytes` measures the memory occupied by live objects and dead objects that have not yet been
+  marked free by the garbage collector.
+- `e_sys_sched_goroutines` measures the number of live goroutines.
\ No newline at end of file
diff --git a/runtimes/go/appruntime/infrasdk/metrics/aws/cloudwatch.go b/runtimes/go/appruntime/infrasdk/metrics/aws/cloudwatch.go
new file mode 100644
index 0000000000..9b22bf93a3
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/aws/cloudwatch.go
@@ -0,0 +1,193 @@
+//go:build !encore_no_aws
+
+package aws
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awsconfig "github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/cloudwatch"
+	"github.com/aws/aws-sdk-go-v2/service/cloudwatch/types"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/infrasdk/metadata"
+	"encore.dev/appruntime/infrasdk/metrics/system"
+	"encore.dev/appruntime/shared/nativehist"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/metrics"
+)
+
+func New(svcs []string, cfg *config.AWSCloudWatchMetricsProvider, meta *metadata.ContainerMetadata, rootLogger zerolog.Logger) *Exporter {
+	// Precompute container metadata dimensions.
+	exporter := &Exporter{
+		svcs:       svcs,
+		cfg:        cfg,
+		rootLogger: rootLogger,
+		containerMetadataDims: metadata.MapMetadataLabels(meta, func(key, value string) types.Dimension {
+			return types.Dimension{
+				Name:  aws.String(key),
+				Value: aws.String(value),
+			}
+		}),
+	}
+
+	return exporter
+}
+
+type Exporter struct {
+	svcs                  []string
+	cfg                   *config.AWSCloudWatchMetricsProvider
+	containerMetadataDims []types.Dimension
+	rootLogger            zerolog.Logger
+
+	clientMu sync.Mutex
+	client   *cloudwatch.Client
+}
+
+func (x *Exporter) Shutdown(p *shutdown.Process) error {
+	return nil
+}
+
+func (x *Exporter) Export(ctx context.Context, collected []metrics.CollectedMetric) error {
+	now := time.Now()
+	data := x.getMetricData(now, collected)
+	data = append(data, x.getSysMetrics(now)...)
+	_, err := x.getClient().PutMetricData(ctx, &cloudwatch.PutMetricDataInput{
+		MetricData: data,
+		Namespace:  aws.String(x.cfg.Namespace),
+	})
+	if err != nil {
+		return fmt.Errorf("unable to send metrics to AWS CloudWatch: %v", err)
+	}
+	return nil
+}
+
+func (x *Exporter) getMetricData(now time.Time, collected []metrics.CollectedMetric) []types.MetricDatum {
+	data := make([]types.MetricDatum, 0, len(collected))
+
+	doAdd := func(val float64, metricName string, baseDims []types.Dimension, svcIdx uint16) {
+		dims := make([]types.Dimension, len(baseDims)+1)
+		copy(dims, baseDims)
+		dims[len(baseDims)] = types.Dimension{
+			Name:  aws.String("service"),
+			Value: aws.String(x.svcs[svcIdx]),
+		}
+		data = append(data, types.MetricDatum{
+			MetricName: aws.String(metricName),
+			Timestamp:  aws.Time(now),
+			Value:      aws.Float64(val),
+			Dimensions: dims,
+		})
+	}
+
+	for _, m := range collected {
+		dims := make([]types.Dimension, len(x.containerMetadataDims), len(x.containerMetadataDims)+len(m.Labels))
+		copy(dims, x.containerMetadataDims)
+		for _, label := range m.Labels {
+			if label.Value == "" {
+				x.rootLogger.Warn().Str("label", label.Key).Msg("metrics: aws cloudwatch does not support empty label values, skipping")
+				continue
+			}
+			dims = append(dims, types.Dimension{
+				Name:  aws.String(label.Key),
+				Value: aws.String(label.Value),
+			})
+		}
+
+		svcNum := m.Info.SvcNum()
+		switch vals := m.Val.(type) {
+		case []float64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(vals[0], m.Info.Name(), dims, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(val, m.Info.Name(), dims, uint16(i))
+					}
+				}
+			}
+		case []int64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(float64(vals[0]), m.Info.Name(), dims, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(float64(val), m.Info.Name(), dims, uint16(i))
+					}
+				}
+			}
+		case []uint64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(float64(vals[0]), m.Info.Name(), dims, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(float64(val), m.Info.Name(), dims, uint16(i))
+					}
+				}
+			}
+		case []time.Duration:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(float64(vals[0]/time.Second), m.Info.Name(), dims, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(float64(val/time.Second), m.Info.Name(), dims, uint16(i))
+					}
+				}
+			}
+		case []*nativehist.Histogram:
+			// TODO implement support
+		default:
+			x.rootLogger.Error().Msgf("encore: internal error: unknown value type %T for metric %s",
+				m.Val, m.Info.Name())
+		}
+	}
+
+	return data
+}
+
+func (x *Exporter) getSysMetrics(now time.Time) []types.MetricDatum {
+	sysMetrics := system.ReadSysMetrics(x.rootLogger)
+	return []types.MetricDatum{
+		{
+			MetricName: aws.String(system.MetricNameHeapObjectsBytes),
+			Timestamp:  aws.Time(now),
+			Value:      aws.Float64(float64(sysMetrics[system.MetricNameHeapObjectsBytes])),
+			Dimensions: x.containerMetadataDims,
+		},
+		{
+			MetricName: aws.String(system.MetricNameGoroutines),
+			Timestamp:  aws.Time(now),
+			Value:      aws.Float64(float64(sysMetrics[system.MetricNameGoroutines])),
+			Dimensions: x.containerMetadataDims,
+		},
+	}
+}
+
+func (x *Exporter) getClient() *cloudwatch.Client {
+	x.clientMu.Lock()
+	defer x.clientMu.Unlock()
+	if x.client == nil {
+		cfg, err := awsconfig.LoadDefaultConfig(context.Background())
+		if err != nil {
+			panic(fmt.Sprintf("unable to load AWS config: %v", err))
+		}
+		cl := cloudwatch.NewFromConfig(cfg)
+		x.client = cl
+	}
+	return x.client
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/aws/cloudwatch_test.go b/runtimes/go/appruntime/infrasdk/metrics/aws/cloudwatch_test.go
new file mode 100644
index 0000000000..9bd88c5971
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/aws/cloudwatch_test.go
@@ -0,0 +1,144 @@
+//go:build !encore_no_aws
+
+package aws
+
+import (
+	"io"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/cloudwatch/types"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/rs/zerolog"
+	"google.golang.org/protobuf/testing/protocmp"
+
+	"encore.dev/appruntime/infrasdk/metadata"
+	"encore.dev/metrics"
+)
+
+type metricInfo struct {
+	name   string
+	typ    metrics.MetricType
+	svcNum uint16
+}
+
+func (m metricInfo) Name() string             { return m.name }
+func (m metricInfo) Type() metrics.MetricType { return m.typ }
+func (m metricInfo) SvcNum() uint16           { return m.svcNum }
+
+func TestGetMetricData(t *testing.T) {
+	now := time.Now()
+	svcs := []string{"foo", "bar"}
+	meta := &metadata.ContainerMetadata{
+		ServiceID:  "a-fargate-task",
+		RevisionID: "43",
+		InstanceID: "a-fargate-task-instance",
+	}
+
+	baseDimensions := []types.Dimension{
+		{Name: aws.String("service_id"), Value: aws.String("a-fargate-task")},
+		{Name: aws.String("revision_id"), Value: aws.String("43")},
+		{Name: aws.String("instance_id"), Value: aws.String("a-fargate-task-instance")},
+	}
+
+	makeDimensions := func(dims ...types.Dimension) []types.Dimension {
+		rtn := make([]types.Dimension, len(baseDimensions)+len(dims))
+		i := 0
+		for _, dim := range baseDimensions {
+			rtn[i] = dim
+			i++
+		}
+		for _, dim := range dims {
+			rtn[i] = dim
+			i++
+		}
+		return rtn
+	}
+
+	tests := []struct {
+		name   string
+		metric metrics.CollectedMetric
+		data   []types.MetricDatum
+	}{
+		{
+			name: "counter",
+			metric: metrics.CollectedMetric{
+				Info: metricInfo{"test_counter", metrics.CounterType, 1},
+				Val:  []int64{10},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 1)
+					valid[0].Store(true)
+					return valid
+				}(),
+			},
+			data: []types.MetricDatum{{
+				MetricName: aws.String("test_counter"),
+				Dimensions: makeDimensions(
+					types.Dimension{Name: aws.String("service"), Value: aws.String("foo")},
+				),
+				Timestamp: aws.Time(now),
+				Value:     aws.Float64(10),
+			}},
+		},
+		{
+			name: "gauge",
+			metric: metrics.CollectedMetric{
+				Info: metricInfo{"test_gauge", metrics.GaugeType, 2},
+				Val:  []float64{0.5},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 1)
+					valid[0].Store(true)
+					return valid
+				}(),
+			},
+			data: []types.MetricDatum{{
+				MetricName: aws.String("test_gauge"),
+				Dimensions: makeDimensions(
+					types.Dimension{Name: aws.String("service"), Value: aws.String("bar")},
+				),
+				Timestamp: aws.Time(now),
+				Value:     aws.Float64(0.5),
+			}},
+		},
+		{
+			name: "labels",
+			metric: metrics.CollectedMetric{
+				Info:   metricInfo{"test_labels", metrics.GaugeType, 1},
+				Labels: []metrics.KeyValue{{"key", "value"}},
+				Val:    []float64{-1.5},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 1)
+					valid[0].Store(true)
+					return valid
+				}(),
+			},
+			data: []types.MetricDatum{{
+				MetricName: aws.String("test_labels"),
+				Dimensions: makeDimensions(
+					types.Dimension{Name: aws.String("key"), Value: aws.String("value")},
+					types.Dimension{Name: aws.String("service"), Value: aws.String("foo")},
+				),
+				Timestamp: aws.Time(now),
+				Value:     aws.Float64(-1.5),
+			}},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			x := New(svcs, nil, meta, zerolog.New(io.Discard))
+
+			got := x.getMetricData(now, []metrics.CollectedMetric{test.metric})
+			if diff := cmp.Diff(
+				got, test.data,
+				protocmp.Transform(),
+				cmpopts.IgnoreUnexported(types.Dimension{}, types.MetricDatum{}),
+			); diff != "" {
+				t.Errorf("getMetricData() mismatch (-got +want):\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/aws_cloudwatch_exporter.go b/runtimes/go/appruntime/infrasdk/metrics/aws_cloudwatch_exporter.go
new file mode 100644
index 0000000000..84d57ef438
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/aws_cloudwatch_exporter.go
@@ -0,0 +1,27 @@
+//go:build !encore_no_aws
+
+package metrics
+
+import (
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/infrasdk/metadata"
+	"encore.dev/appruntime/infrasdk/metrics/aws"
+)
+
+func init() {
+	registerProvider(providerDesc{
+		name: "aws_cloudwatch",
+		matches: func(cfg *config.Metrics) bool {
+			return cfg.CloudWatch != nil
+		},
+		newExporter: func(m *Manager) exporter {
+			containerMetadata, err := metadata.GetContainerMetadata(m.runtime)
+			if err != nil {
+				m.rootLogger.Err(err).Msg("unable to initialize metrics exporter: error getting container metadata")
+				return nil
+			}
+
+			return aws.New(m.static.BundledServices, m.runtime.Metrics.CloudWatch, containerMetadata, m.rootLogger)
+		},
+	})
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/datadog/datadog.go b/runtimes/go/appruntime/infrasdk/metrics/datadog/datadog.go
new file mode 100644
index 0000000000..8c3ca5ffac
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/datadog/datadog.go
@@ -0,0 +1,210 @@
+//go:build !encore_no_datadog
+
+package datadog
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/DataDog/datadog-api-client-go/v2/api/datadog"
+	"github.com/DataDog/datadog-api-client-go/v2/api/datadogV2"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/infrasdk/metadata"
+	"encore.dev/appruntime/infrasdk/metrics/system"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/metrics"
+)
+
+func New(svcs []string, cfg *config.DatadogProvider, meta *metadata.ContainerMetadata, rootLogger zerolog.Logger) *Exporter {
+	configuration := datadog.NewConfiguration()
+	apiClient := datadog.NewAPIClient(configuration)
+	api := datadogV2.NewMetricsApi(apiClient)
+
+	// Precompute container metadata labels.
+	return &Exporter{
+		client: api,
+		svcs:   svcs,
+		cfg:    cfg,
+		containerMetadataLabels: metadata.MapMetadataLabels(meta, func(k, v string) string {
+			return fmt.Sprintf("%s:%s", k, v)
+		}),
+		rootLogger: rootLogger,
+		lastExport: time.Now().Unix(),
+		lastValue:  map[tsSvcKey]float64{},
+	}
+}
+
+type tsSvcKey struct {
+	tsID uint64
+	svc  uint16
+}
+
+type Exporter struct {
+	client                  *datadogV2.MetricsApi
+	svcs                    []string
+	cfg                     *config.DatadogProvider
+	containerMetadataLabels []string
+	rootLogger              zerolog.Logger
+	lastExport              int64
+	lastValue               map[tsSvcKey]float64
+}
+
+func (x *Exporter) Shutdown(p *shutdown.Process) error {
+	return nil
+}
+
+func (x *Exporter) Export(ctx context.Context, collected []metrics.CollectedMetric) error {
+	now := time.Now()
+	data := x.getMetricData(now, collected)
+	data = append(data, x.getSysMetrics(now)...)
+	body := datadogV2.MetricPayload{Series: data}
+
+	ctx = x.newContext(ctx)
+	_, _, err := x.client.SubmitMetrics(ctx, body, *datadogV2.NewSubmitMetricsOptionalParameters())
+	if err != nil {
+		return fmt.Errorf("unable to send metrics to Datadog: %v", err)
+	}
+	return nil
+}
+
+func (x *Exporter) getMetricData(now time.Time, collected []metrics.CollectedMetric) []datadogV2.MetricSeries {
+	data := make([]datadogV2.MetricSeries, 0, len(collected))
+	for _, m := range collected {
+		var metricType *datadogV2.MetricIntakeType
+		switch m.Info.Type() {
+		case metrics.CounterType:
+			metricType = datadogV2.METRICINTAKETYPE_COUNT.Ptr()
+		case metrics.GaugeType:
+			metricType = datadogV2.METRICINTAKETYPE_GAUGE.Ptr()
+		default:
+			x.rootLogger.Error().Msgf("encore: internal error: unknown metric type %v for metric %s", m.Info.Type(), m.Info.Name())
+			continue
+		}
+
+		labels := make([]string, len(x.containerMetadataLabels))
+		copy(labels, x.containerMetadataLabels)
+		for _, label := range m.Labels {
+			labels = append(labels, label.Key+":"+label.Value)
+		}
+
+		doAdd := func(val float64, metricName string, baseLabels []string, svcIdx uint16) {
+			labels := make([]string, len(baseLabels)+1)
+			copy(labels, baseLabels)
+			labels[len(baseLabels)] = "service:" + x.svcs[svcIdx]
+			if m.Info.Type() == metrics.CounterType {
+				key := tsSvcKey{tsID: m.TimeSeriesID, svc: svcIdx}
+				lastVal := x.lastValue[key]
+				x.lastValue[key] = val
+				val = val - lastVal
+			}
+			data = append(data, datadogV2.MetricSeries{
+				Interval: datadog.PtrInt64(now.Unix() - x.lastExport),
+				Metric:   metricName,
+				Points: []datadogV2.MetricPoint{{
+					Timestamp: datadog.PtrInt64(now.Unix()),
+					Value:     datadog.PtrFloat64(val),
+				}},
+				Tags: labels,
+				Type: metricType,
+			})
+		}
+
+		svcNum := m.Info.SvcNum()
+		switch vals := m.Val.(type) {
+		case []float64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(vals[0], m.Info.Name(), labels, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(val, m.Info.Name(), labels, uint16(i))
+					}
+				}
+			}
+		case []int64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(float64(vals[0]), m.Info.Name(), labels, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(float64(val), m.Info.Name(), labels, uint16(i))
+					}
+				}
+			}
+		case []uint64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(float64(vals[0]), m.Info.Name(), labels, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(float64(val), m.Info.Name(), labels, uint16(i))
+					}
+				}
+			}
+		case []time.Duration:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(float64(vals[0]/time.Second), m.Info.Name(), labels, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(float64(val/time.Second), m.Info.Name(), labels, uint16(i))
+					}
+				}
+			}
+		default:
+			x.rootLogger.Error().Msgf("encore: internal error: unknown value type %T for metric %s", m.Val, m.Info.Name())
+		}
+	}
+
+	x.lastExport = now.Unix()
+	return data
+}
+
+func (x *Exporter) getSysMetrics(now time.Time) []datadogV2.MetricSeries {
+	sysMetrics := system.ReadSysMetrics(x.rootLogger)
+	return []datadogV2.MetricSeries{
+		{
+			Metric: system.MetricNameHeapObjectsBytes,
+			Points: []datadogV2.MetricPoint{{
+				Timestamp: datadog.PtrInt64(now.Unix()),
+				Value:     datadog.PtrFloat64(float64(sysMetrics[system.MetricNameHeapObjectsBytes])),
+			}},
+			Tags: x.containerMetadataLabels,
+			Type: datadogV2.METRICINTAKETYPE_GAUGE.Ptr(),
+		},
+		{
+			Metric: system.MetricNameGoroutines,
+			Points: []datadogV2.MetricPoint{{
+				Timestamp: datadog.PtrInt64(now.Unix()),
+				Value:     datadog.PtrFloat64(float64(sysMetrics[system.MetricNameGoroutines])),
+			}},
+			Tags: x.containerMetadataLabels,
+			Type: datadogV2.METRICINTAKETYPE_GAUGE.Ptr(),
+		},
+	}
+}
+
+func (x *Exporter) newContext(parent context.Context) context.Context {
+	return context.WithValue(
+		context.WithValue(
+			parent,
+			datadog.ContextServerVariables,
+			map[string]string{"site": x.cfg.Site},
+		),
+		datadog.ContextAPIKeys,
+		map[string]datadog.APIKey{
+			"apiKeyAuth": {Key: x.cfg.APIKey},
+		},
+	)
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/datadog_exporter.go b/runtimes/go/appruntime/infrasdk/metrics/datadog_exporter.go
new file mode 100644
index 0000000000..bf60f22eb1
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/datadog_exporter.go
@@ -0,0 +1,27 @@
+//go:build !encore_no_datadog
+
+package metrics
+
+import (
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/infrasdk/metadata"
+	"encore.dev/appruntime/infrasdk/metrics/datadog"
+)
+
+func init() {
+	registerProvider(providerDesc{
+		name: "datadog",
+		matches: func(cfg *config.Metrics) bool {
+			return cfg.Datadog != nil
+		},
+		newExporter: func(m *Manager) exporter {
+			containerMetadata, err := metadata.GetContainerMetadata(m.runtime)
+			if err != nil {
+				m.rootLogger.Err(err).Msg("unable to initialize metrics exporter: error getting container metadata")
+				return nil
+			}
+
+			return datadog.New(m.static.BundledServices, m.runtime.Metrics.Datadog, containerMetadata, m.rootLogger)
+		},
+	})
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/encore_cloud_exporter.go b/runtimes/go/appruntime/infrasdk/metrics/encore_cloud_exporter.go
new file mode 100644
index 0000000000..2b297c919c
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/encore_cloud_exporter.go
@@ -0,0 +1,34 @@
+//go:build !encore_no_gcp
+
+package metrics
+
+import (
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/infrasdk/metadata"
+	"encore.dev/appruntime/infrasdk/metrics/gcp"
+)
+
+func init() {
+	registerProvider(providerDesc{
+		name: "encore_cloud",
+		matches: func(cfg *config.Metrics) bool {
+			return cfg.EncoreCloud != nil
+		},
+		newExporter: func(mgr *Manager) exporter {
+			containerMetadata, err := metadata.GetContainerMetadata(mgr.runtime)
+			if err != nil {
+				mgr.rootLogger.Err(err).Msg("unable to initialize metrics exporter: error getting container metadata")
+				return nil
+			}
+
+			metricsCfg := mgr.runtime.Metrics
+			nodeID, ok := metricsCfg.EncoreCloud.MonitoredResourceLabels["node_id"]
+			if !ok {
+				mgr.rootLogger.Err(err).Msg("unable to initialize metrics exporter: missing node_id")
+				return nil
+			}
+			metricsCfg.EncoreCloud.MonitoredResourceLabels["node_id"] = nodeID + "-" + containerMetadata.InstanceID
+			return gcp.New(mgr.static.BundledServices, metricsCfg.EncoreCloud, containerMetadata, mgr.rootLogger)
+		},
+	})
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/gcp/cloud_monitoring.go b/runtimes/go/appruntime/infrasdk/metrics/gcp/cloud_monitoring.go
new file mode 100644
index 0000000000..79ac828eaa
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/gcp/cloud_monitoring.go
@@ -0,0 +1,353 @@
+//go:build !encore_no_gcp
+
+package gcp
+
+import (
+	"context"
+	"fmt"
+	"math"
+	"sync"
+	"time"
+
+	monitoring "cloud.google.com/go/monitoring/apiv3/v2"
+	"cloud.google.com/go/monitoring/apiv3/v2/monitoringpb"
+	"github.com/rs/zerolog"
+	metricpb "google.golang.org/genproto/googleapis/api/metric"
+	monitoredrespb "google.golang.org/genproto/googleapis/api/monitoredres"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/infrasdk/metadata"
+	"encore.dev/appruntime/infrasdk/metrics/system"
+	"encore.dev/appruntime/shared/nativehist"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/metrics"
+)
+
+func New(svcs []string, cfg *config.GCPCloudMonitoringProvider, meta *metadata.ContainerMetadata, rootLogger zerolog.Logger) *Exporter {
+	// Precompute container metadata labels.
+	return &Exporter{
+		svcs:                    svcs,
+		cfg:                     cfg,
+		containerMetadataLabels: meta.Labels().AsMap(),
+		rootLogger:              rootLogger,
+
+		firstSeenCounter: make(map[uint64]*timestamppb.Timestamp),
+
+		metricNames: cfg.MetricNames,
+	}
+}
+
+type Exporter struct {
+	svcs                    []string
+	cfg                     *config.GCPCloudMonitoringProvider
+	containerMetadataLabels map[string]string
+	rootLogger              zerolog.Logger
+
+	clientMu sync.Mutex
+	client   *monitoring.MetricClient
+
+	firstSeenCounter map[uint64]*timestamppb.Timestamp
+
+	dummyStart, dummyEnd time.Time
+
+	metricNames map[string]string
+}
+
+func (x *Exporter) Shutdown(p *shutdown.Process) error {
+	x.clientMu.Lock()
+	defer x.clientMu.Unlock()
+	if x.client != nil {
+		_ = x.client.Close()
+	}
+	return nil
+}
+
+func (x *Exporter) Export(ctx context.Context, collected []metrics.CollectedMetric) error {
+	// Call time.Now twice so we don't get identical timestamps,
+	// which is not allowed for cumulative metrics.
+	newCounterStart := time.Now().Add(-time.Microsecond)
+	endTime := time.Now()
+
+	data := x.getMetricData(newCounterStart, endTime, collected)
+	data = append(data, x.getSysMetrics(endTime)...)
+	if len(data) == 0 {
+		return nil
+	}
+
+	err := x.getClient().CreateTimeSeries(ctx, &monitoringpb.CreateTimeSeriesRequest{
+		Name:       "projects/" + x.cfg.ProjectID,
+		TimeSeries: data,
+	})
+	if err != nil {
+		return fmt.Errorf("write metrics to GCP Cloud Monitoring: %v", err)
+	}
+	return nil
+}
+
+func (x *Exporter) getMetricData(newCounterStart, endTime time.Time, collected []metrics.CollectedMetric) []*monitoringpb.TimeSeries {
+	pbNewCounterStart := timestamppb.New(newCounterStart)
+	pbEndTime := timestamppb.New(endTime)
+
+	monitoredResource := &monitoredrespb.MonitoredResource{
+		Type:   x.cfg.MonitoredResourceType,
+		Labels: x.cfg.MonitoredResourceLabels,
+	}
+
+	data := make([]*monitoringpb.TimeSeries, 0, len(collected))
+	for _, m := range collected {
+		baseLabels := make(map[string]string, len(x.containerMetadataLabels)+len(m.Labels))
+		for k, v := range x.containerMetadataLabels {
+			baseLabels[k] = v
+		}
+		for _, v := range m.Labels {
+			baseLabels[v.Key] = v.Value
+		}
+
+		var kind metricpb.MetricDescriptor_MetricKind
+		interval := &monitoringpb.TimeInterval{EndTime: pbEndTime}
+		switch m.Info.Type() {
+		case metrics.CounterType:
+			// Determine when we first saw this time series.
+			startTime := x.firstSeenCounter[m.TimeSeriesID]
+			if startTime == nil {
+				startTime = pbNewCounterStart
+				x.firstSeenCounter[m.TimeSeriesID] = startTime
+			}
+			interval.StartTime = startTime
+
+			kind = metricpb.MetricDescriptor_CUMULATIVE
+		case metrics.GaugeType:
+			kind = metricpb.MetricDescriptor_GAUGE
+		default:
+			x.rootLogger.Error().Msgf("encore: internal error: unknown metric type %v for metric %s", m.Info.Type(), m.Info.Name())
+			continue
+		}
+
+		svcNum := m.Info.SvcNum()
+		metricType := "custom.googleapis.com/" + m.Info.Name()
+		cloudMetricName, ok := x.metricNames[m.Info.Name()]
+		if !ok {
+			x.rootLogger.Error().Msgf("encore: internal error: metric %s not found in config", m.Info.Name())
+			continue
+		}
+		metricType = "custom.googleapis.com/" + cloudMetricName
+
+		doAdd := func(val *monitoringpb.TypedValue, svcIdx uint16) {
+			labels := make(map[string]string, len(baseLabels)+1)
+			for k, v := range baseLabels {
+				labels[k] = v
+			}
+			labels["service"] = x.svcs[svcIdx]
+
+			data = append(data, &monitoringpb.TimeSeries{
+				MetricKind: kind,
+				Metric: &metricpb.Metric{
+					Type:   metricType,
+					Labels: labels,
+				},
+				Resource: monitoredResource,
+				Points: []*monitoringpb.Point{{
+					Interval: interval,
+					Value:    val,
+				}},
+			})
+		}
+
+		switch vals := m.Val.(type) {
+		case []float64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(floatVal(vals[0]), svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(floatVal(val), uint16(i))
+					}
+				}
+			}
+
+		case []int64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(int64Val(vals[0]), svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(int64Val(val), uint16(i))
+					}
+				}
+			}
+
+		case []uint64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(uint64Val(vals[0]), svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(uint64Val(val), uint16(i))
+					}
+				}
+			}
+
+		case []time.Duration:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(floatVal(float64(vals[0]/time.Second)), svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(floatVal(float64(val/time.Second)), uint16(i))
+					}
+				}
+			}
+
+		case []*nativehist.Histogram:
+			// TODO implement support
+
+		default:
+			x.rootLogger.Error().Msgf("encore: internal error: unknown value type %T for metric %s",
+				m.Val, m.Info.Name())
+		}
+
+	}
+
+	return data
+}
+
+func (x *Exporter) getPoint(newCounterStart, endTime *timestamppb.Timestamp, m *metrics.CollectedMetric) (point *monitoringpb.Point, kind metricpb.MetricDescriptor_MetricKind) {
+	value := &monitoringpb.TypedValue{}
+	switch v := m.Val.(type) {
+	case float64:
+		value.Value = &monitoringpb.TypedValue_DoubleValue{DoubleValue: v}
+	case int64:
+		value.Value = &monitoringpb.TypedValue_Int64Value{Int64Value: v}
+	default:
+		panic(fmt.Sprintf("unhandled value type %T", v))
+	}
+
+	switch m.Info.Type() {
+	case metrics.CounterType:
+		// Determine when we first saw this time series.
+		startTime := x.firstSeenCounter[m.TimeSeriesID]
+		if startTime == nil {
+			startTime = newCounterStart
+			x.firstSeenCounter[m.TimeSeriesID] = startTime
+		}
+
+		kind = metricpb.MetricDescriptor_CUMULATIVE
+		point = &monitoringpb.Point{
+			Interval: &monitoringpb.TimeInterval{
+				StartTime: startTime,
+				EndTime:   endTime,
+			},
+			Value: value,
+		}
+
+	case metrics.GaugeType:
+		kind = metricpb.MetricDescriptor_GAUGE
+		point = &monitoringpb.Point{
+			Interval: &monitoringpb.TimeInterval{
+				EndTime: endTime,
+			},
+			Value: value,
+		}
+	default:
+		panic(fmt.Sprintf("unhandled metric type %v", m.Info.Type()))
+	}
+	return point, kind
+}
+
+func floatVal(val float64) *monitoringpb.TypedValue {
+	return &monitoringpb.TypedValue{
+		Value: &monitoringpb.TypedValue_DoubleValue{
+			DoubleValue: val,
+		},
+	}
+}
+
+func int64Val(val int64) *monitoringpb.TypedValue {
+	return &monitoringpb.TypedValue{
+		Value: &monitoringpb.TypedValue_Int64Value{
+			Int64Value: val,
+		},
+	}
+}
+func uint64Val(val uint64) *monitoringpb.TypedValue {
+	// Return a float if this value exceeds the range of int64.
+	if val > math.MaxInt64 {
+		return &monitoringpb.TypedValue{
+			Value: &monitoringpb.TypedValue_DoubleValue{
+				DoubleValue: float64(val),
+			},
+		}
+	}
+	return &monitoringpb.TypedValue{
+		Value: &monitoringpb.TypedValue_Int64Value{
+			Int64Value: int64(val),
+		},
+	}
+}
+
+func (x *Exporter) getSysMetrics(now time.Time) []*monitoringpb.TimeSeries {
+	var output []*monitoringpb.TimeSeries
+	monitoredResource := &monitoredrespb.MonitoredResource{
+		Type:   x.cfg.MonitoredResourceType,
+		Labels: x.cfg.MonitoredResourceLabels,
+	}
+	sysMetrics := system.ReadSysMetrics(x.rootLogger)
+
+	if cloudMetricName, ok := x.metricNames[system.MetricNameHeapObjectsBytes]; !ok {
+		x.rootLogger.Error().Msgf("encore: internal error: metric %s not found in config", system.MetricNameHeapObjectsBytes)
+	} else {
+		output = append(output, &monitoringpb.TimeSeries{
+			MetricKind: metricpb.MetricDescriptor_GAUGE,
+			Metric: &metricpb.Metric{
+				Type:   "custom.googleapis.com/" + cloudMetricName,
+				Labels: x.containerMetadataLabels,
+			},
+			Resource: monitoredResource,
+			Points: []*monitoringpb.Point{{
+				Interval: &monitoringpb.TimeInterval{EndTime: timestamppb.New(now)},
+				Value:    uint64Val(sysMetrics[system.MetricNameHeapObjectsBytes]),
+			}},
+		})
+	}
+
+	if cloudMetricName, ok := x.metricNames[system.MetricNameGoroutines]; !ok {
+		x.rootLogger.Error().Msgf("encore: internal error: metric %s not found in config", system.MetricNameGoroutines)
+	} else {
+		output = append(output, &monitoringpb.TimeSeries{
+			MetricKind: metricpb.MetricDescriptor_GAUGE,
+			Metric: &metricpb.Metric{
+				Type:   "custom.googleapis.com/" + cloudMetricName,
+				Labels: x.containerMetadataLabels,
+			},
+			Resource: monitoredResource,
+			Points: []*monitoringpb.Point{{
+				Interval: &monitoringpb.TimeInterval{EndTime: timestamppb.New(now)},
+				Value:    uint64Val(sysMetrics[system.MetricNameGoroutines]),
+			}},
+		})
+	}
+
+	return output
+}
+
+func (x *Exporter) getClient() *monitoring.MetricClient {
+	x.clientMu.Lock()
+	defer x.clientMu.Unlock()
+	if x.client == nil {
+		cl, err := monitoring.NewMetricClient(context.Background())
+		if err != nil {
+			panic(fmt.Sprintf("failed to create metrics client: %s", err))
+		}
+		x.client = cl
+	}
+	return x.client
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/gcp/cloud_monitoring_test.go b/runtimes/go/appruntime/infrasdk/metrics/gcp/cloud_monitoring_test.go
new file mode 100644
index 0000000000..96936eccb2
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/gcp/cloud_monitoring_test.go
@@ -0,0 +1,234 @@
+//go:build !encore_no_gcp
+
+package gcp
+
+import (
+	"io"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"cloud.google.com/go/monitoring/apiv3/v2/monitoringpb"
+	"github.com/google/go-cmp/cmp"
+	"github.com/rs/zerolog"
+	metricpb "google.golang.org/genproto/googleapis/api/metric"
+	monitoredres "google.golang.org/genproto/googleapis/api/monitoredres"
+	"google.golang.org/protobuf/testing/protocmp"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/infrasdk/metadata"
+	"encore.dev/metrics"
+)
+
+type metricInfo struct {
+	name   string
+	typ    metrics.MetricType
+	svcNum uint16
+}
+
+func (m metricInfo) Name() string             { return m.name }
+func (m metricInfo) Type() metrics.MetricType { return m.typ }
+func (m metricInfo) SvcNum() uint16           { return m.svcNum }
+
+func TestGetMetricData(t *testing.T) {
+	newCounterStart := time.Now()
+	now := time.Now()
+	cfg := &config.GCPCloudMonitoringProvider{
+		ProjectID:               "test-project",
+		MonitoredResourceType:   "resource-type",
+		MonitoredResourceLabels: map[string]string{"key": "value"},
+	}
+
+	meta := &metadata.ContainerMetadata{
+		ServiceID:  "a_cloudrun_instance",
+		RevisionID: "32",
+		InstanceID: "cloudrun_asd24dsc2",
+	}
+
+	addContainerLabels := func(labels map[string]string) map[string]string {
+		labels["service_id"] = meta.ServiceID
+		labels["revision_id"] = meta.RevisionID
+		labels["instance_id"] = meta.InstanceID
+
+		return labels
+	}
+
+	monitoredRes := &monitoredres.MonitoredResource{
+		Type:   "resource-type",
+		Labels: map[string]string{"key": "value"},
+	}
+	pbStart := timestamppb.New(newCounterStart)
+	pbEnd := timestamppb.New(now)
+
+	svcs := []string{"foo", "bar"}
+	tests := []struct {
+		name   string
+		metric metrics.CollectedMetric
+		data   []*monitoringpb.TimeSeries
+	}{
+		{
+			name: "counter",
+			metric: metrics.CollectedMetric{
+				Info: metricInfo{"test_counter", metrics.CounterType, 1},
+				Val:  []int64{10},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 1)
+					valid[0].Store(true)
+					return valid
+				}(),
+			},
+			data: []*monitoringpb.TimeSeries{{
+				Metric: &metricpb.Metric{
+					Type:   "custom.googleapis.com/test_counter",
+					Labels: addContainerLabels(map[string]string{"service": "foo"}),
+				},
+				Resource:   monitoredRes,
+				MetricKind: metricpb.MetricDescriptor_CUMULATIVE,
+				Points: []*monitoringpb.Point{{
+					Interval: &monitoringpb.TimeInterval{StartTime: pbStart, EndTime: pbEnd},
+					Value:    int64Val(10),
+				}},
+			}},
+		},
+		{
+			name: "gauge",
+			metric: metrics.CollectedMetric{
+				Info: metricInfo{"test_gauge", metrics.GaugeType, 2},
+				Val:  []float64{0.5},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 1)
+					valid[0].Store(true)
+					return valid
+				}(),
+			},
+			data: []*monitoringpb.TimeSeries{{
+				Metric: &metricpb.Metric{
+					Type:   "custom.googleapis.com/test_gauge",
+					Labels: addContainerLabels(map[string]string{"service": "bar"}),
+				},
+				Resource:   monitoredRes,
+				MetricKind: metricpb.MetricDescriptor_GAUGE,
+				Points: []*monitoringpb.Point{{
+					Interval: &monitoringpb.TimeInterval{EndTime: pbEnd},
+					Value:    floatVal(0.5),
+				}},
+			}},
+		},
+		{
+			name: "labels",
+			metric: metrics.CollectedMetric{
+				Info:   metricInfo{"test_labels", metrics.GaugeType, 1},
+				Labels: []metrics.KeyValue{{"key", "value"}},
+				Val:    []uint64{2},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 1)
+					valid[0].Store(true)
+					return valid
+				}(),
+			},
+			data: []*monitoringpb.TimeSeries{{
+				Metric: &metricpb.Metric{
+					Type:   "custom.googleapis.com/test_labels",
+					Labels: addContainerLabels(map[string]string{"service": "foo", "key": "value"}),
+				},
+				Resource:   monitoredRes,
+				MetricKind: metricpb.MetricDescriptor_GAUGE,
+				Points: []*monitoringpb.Point{{
+					Interval: &monitoringpb.TimeInterval{EndTime: pbEnd},
+					Value:    int64Val(2),
+				}},
+			}},
+		},
+		{
+			name: "labels_multi_svcs",
+			metric: metrics.CollectedMetric{
+				Info:   metricInfo{"test_labels", metrics.GaugeType, 0},
+				Labels: []metrics.KeyValue{{"key", "value"}},
+				Val:    []time.Duration{2 * time.Second, 4 * time.Second},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 2)
+					valid[0].Store(true)
+					valid[1].Store(true)
+					return valid
+				}(),
+			},
+			data: []*monitoringpb.TimeSeries{
+				{
+					Metric: &metricpb.Metric{
+						Type:   "custom.googleapis.com/test_labels",
+						Labels: addContainerLabels(map[string]string{"service": "foo", "key": "value"}),
+					},
+					Resource:   monitoredRes,
+					MetricKind: metricpb.MetricDescriptor_GAUGE,
+					Points: []*monitoringpb.Point{{
+						Interval: &monitoringpb.TimeInterval{EndTime: pbEnd},
+						Value:    floatVal(2),
+					}},
+				},
+				{
+					Metric: &metricpb.Metric{
+						Type:   "custom.googleapis.com/test_labels",
+						Labels: addContainerLabels(map[string]string{"service": "bar", "key": "value"}),
+					},
+					Resource:   monitoredRes,
+					MetricKind: metricpb.MetricDescriptor_GAUGE,
+					Points: []*monitoringpb.Point{{
+						Interval: &monitoringpb.TimeInterval{EndTime: pbEnd},
+						Value:    floatVal(4),
+					}},
+				},
+			},
+		},
+		{
+			name: "invalid_counter",
+			metric: metrics.CollectedMetric{
+				Info:  metricInfo{"test_counter", metrics.CounterType, 1},
+				Val:   make([]int64, 1),
+				Valid: make([]atomic.Bool, 1),
+			},
+			data: []*monitoringpb.TimeSeries{},
+		},
+		{
+			name: "unset_gauges",
+			metric: metrics.CollectedMetric{
+				Info:   metricInfo{"test_gauges", metrics.GaugeType, 0},
+				Labels: []metrics.KeyValue{{"key", "value"}},
+				Val:    []uint64{1, 0},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 2)
+					valid[0].Store(true)
+					valid[1].Store(false)
+					return valid
+				}(),
+			},
+			data: []*monitoringpb.TimeSeries{
+				{
+					Metric: &metricpb.Metric{
+						Type:   "custom.googleapis.com/test_gauges",
+						Labels: addContainerLabels(map[string]string{"service": "foo", "key": "value"}),
+					},
+					Resource:   monitoredRes,
+					MetricKind: metricpb.MetricDescriptor_GAUGE,
+					Points: []*monitoringpb.Point{{
+						Interval: &monitoringpb.TimeInterval{EndTime: pbEnd},
+						Value:    uint64Val(1),
+					}},
+				},
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cfg.MetricNames = map[string]string{
+				test.metric.Info.Name(): test.metric.Info.Name(),
+			}
+			x := New(svcs, cfg, meta, zerolog.New(io.Discard))
+			got := x.getMetricData(newCounterStart, now, []metrics.CollectedMetric{test.metric})
+			if diff := cmp.Diff(got, test.data, protocmp.Transform()); diff != "" {
+				t.Errorf("getMetricData() mismatch (-got +want):\n%s", diff)
+			}
+		})
+	}
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/gcp_cloud_monitoring_exporter.go b/runtimes/go/appruntime/infrasdk/metrics/gcp_cloud_monitoring_exporter.go
new file mode 100644
index 0000000000..2237296c76
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/gcp_cloud_monitoring_exporter.go
@@ -0,0 +1,44 @@
+//go:build !encore_no_gcp
+
+package metrics
+
+import (
+	"os"
+	"strings"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/infrasdk/metadata"
+	"encore.dev/appruntime/infrasdk/metrics/gcp"
+)
+
+func init() {
+	registerProvider(providerDesc{
+		name: "gcp_cloud_monitoring",
+		matches: func(cfg *config.Metrics) bool {
+			return cfg.CloudMonitoring != nil
+		},
+		newExporter: func(mgr *Manager) exporter {
+			containerMetadata, err := metadata.GetContainerMetadata(mgr.runtime)
+			if err != nil {
+				mgr.rootLogger.Err(err).Msg("unable to initialize metrics exporter: error getting container metadata")
+				return nil
+			}
+
+			metricsCfg := mgr.runtime.Metrics
+
+			nodeID, ok := metricsCfg.CloudMonitoring.MonitoredResourceLabels["node_id"]
+			if ok {
+				metricsCfg.CloudMonitoring.MonitoredResourceLabels["node_id"] = nodeID + "-" + containerMetadata.InstanceID
+			}
+
+			// Replace $ENV: prefix with the actual environment variable value
+			for k, v := range metricsCfg.CloudMonitoring.MonitoredResourceLabels {
+				if strings.HasPrefix(v, "$ENV:") {
+					metricsCfg.CloudMonitoring.MonitoredResourceLabels[k] = os.Getenv(v[5:])
+				}
+			}
+
+			return gcp.New(mgr.static.BundledServices, metricsCfg.CloudMonitoring, containerMetadata, mgr.rootLogger)
+		},
+	})
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/logs_based_exporter.go b/runtimes/go/appruntime/infrasdk/metrics/logs_based_exporter.go
new file mode 100644
index 0000000000..ee63878d97
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/logs_based_exporter.go
@@ -0,0 +1,74 @@
+package metrics
+
+import (
+	"github.com/rs/zerolog"
+
+	"encore.dev/rlog"
+)
+
+// AWS CloudWatch logs-based metrics support up to three dimensions:
+//
+// https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/FilterAndPatternSyntax.html#logs-metric-filters-dimensions
+//
+// For this reason, we check that the number of tags passed in by the caller
+// isn't greater than three. This doesn't cover the case where the same metric is
+// published with different sets of tags over multiple calls to the functions
+// defined in this file.
+//
+// GCP Cloud Monitoring logs-based metrics support up to ten dimensions (referred
+// to as 'labels'):
+//
+// https://cloud.google.com/logging/docs/logs-based-metrics/labels#limitations
+//
+// However, since logs-based metrics with more than three dimensions aren't
+// supported by AWS CloudWatch, we support only up to three dimensions per metric
+// in GCP too.
+
+const encoreMetricKey = rlog.InternalKeyPrefix + "metric_name"
+
+type logsBasedEmitter struct {
+	logger zerolog.Logger
+}
+
+func newLogsBasedEmitter(logger zerolog.Logger) *logsBasedEmitter {
+	return &logsBasedEmitter{logger: logger}
+}
+
+func (e *logsBasedEmitter) IncCounter(name string, tags ...string) {
+	// See comment above.
+	if len(tags) > 6 {
+		panic("emitting metric with more than 3 dimensions is not supported")
+	}
+
+	e.logCounter(name, tags...)
+}
+
+func (e *logsBasedEmitter) Observe(name string, key string, value float64, tags ...string) {
+	// See comment above.
+	if len(tags) > 6 {
+		panic("emitting metric with more than 3 dimensions is not supported")
+	}
+
+	e.logValue(name, key, value, tags...)
+}
+
+func (e *logsBasedEmitter) logCounter(name string, tags ...string) {
+	ev := e.logger.Trace().Str(encoreMetricKey, name)
+	ev = addTags(ev, tags...)
+	ev.Send()
+}
+
+func (e *logsBasedEmitter) logValue(name string, observationKey string, observationValue float64, tags ...string) {
+	ev := e.logger.Trace().Str(encoreMetricKey, name).Float64(observationKey, observationValue)
+	ev = addTags(ev, tags...)
+	ev.Send()
+}
+
+func addTags(ev *zerolog.Event, tags ...string) *zerolog.Event {
+	for i := 0; i < len(tags); i += 2 {
+		if i+1 < len(tags) {
+			ev = ev.Str(tags[i], tags[i+1])
+		}
+	}
+	return ev
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/logs_based_exporter_test.go b/runtimes/go/appruntime/infrasdk/metrics/logs_based_exporter_test.go
new file mode 100644
index 0000000000..353315bba3
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/logs_based_exporter_test.go
@@ -0,0 +1,60 @@
+package metrics
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/rs/zerolog"
+)
+
+func TestLogCounter(t *testing.T) {
+	testCases := []struct {
+		Name    string
+		Counter string
+		Tags    []string
+		Want    string
+	}{
+		{
+			Name:    "Increase counter with one dimension",
+			Counter: "test_counter",
+			Tags:    []string{"tag", "value"},
+			Want: `{"level":"trace","encore_metric_name":"test_counter","tag":"value"}
+`,
+		},
+		{
+			Name:    "Increase counter with two dimensions",
+			Counter: "test_counter",
+			Tags:    []string{"tag_1", "value_1", "tag_2", "value_2"},
+			Want: `{"level":"trace","encore_metric_name":"test_counter","tag_1":"value_1","tag_2":"value_2"}
+`,
+		},
+		{
+			Name:    "Increase counter with three dimensions",
+			Counter: "test_counter",
+			Tags:    []string{"tag_1", "value_1", "tag_2", "value_2", "tag_3", "value_3"},
+			Want: `{"level":"trace","encore_metric_name":"test_counter","tag_1":"value_1","tag_2":"value_2","tag_3":"value_3"}
+`,
+		},
+		{
+			Name:    "Drop tag without value",
+			Counter: "test_counter",
+			Tags:    []string{"tag_1", "value_1", "tag_2"},
+			Want: `{"level":"trace","encore_metric_name":"test_counter","tag_1":"value_1"}
+`,
+		},
+	}
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.Name, func(t *testing.T) {
+			t.Parallel()
+
+			var buf bytes.Buffer
+			logger := zerolog.New(&buf)
+			newLogsBasedEmitter(logger).logCounter(testCase.Counter, testCase.Tags...)
+			actual := buf.String()
+			if actual != testCase.Want {
+				t.Fatalf("\nwant:\n\t%q\ngot:\n\t%q\n", testCase.Want, actual)
+			}
+		})
+	}
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/metrics.go b/runtimes/go/appruntime/infrasdk/metrics/metrics.go
new file mode 100644
index 0000000000..d3d5e87fb9
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/metrics.go
@@ -0,0 +1,125 @@
+package metrics
+
+import (
+	"context"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/metrics"
+)
+
+type Manager struct {
+	ctx    context.Context
+	cancel func()
+
+	static     *config.Static
+	runtime    *config.Runtime
+	reg        *metrics.Registry
+	rootLogger zerolog.Logger
+	exp        exporter
+
+	logsEmitter *logsBasedEmitter
+}
+
+func NewManager(reg *metrics.Registry, static *config.Static, rtConf *config.Runtime, rootLogger zerolog.Logger) *Manager {
+	ctx, cancel := context.WithCancel(context.Background())
+	mgr := &Manager{
+		ctx:        ctx,
+		cancel:     cancel,
+		reg:        reg,
+		static:     static,
+		runtime:    rtConf,
+		rootLogger: rootLogger,
+	}
+
+	// Metrics aren't configured, return.
+	if rtConf.Metrics == nil {
+		return mgr
+	}
+
+	for _, desc := range providerRegistry {
+		if desc.matches(rtConf.Metrics) {
+			mgr.exp = desc.newExporter(mgr)
+			break
+		}
+	}
+
+	if rtConf.Metrics.LogsBased != nil {
+		mgr.logsEmitter = newLogsBasedEmitter(rootLogger)
+	}
+
+	return mgr
+}
+
+func (mgr *Manager) Shutdown(p *shutdown.Process) error {
+	// Wait for all services and all tasks to shut down before we shut down metrics.
+	<-p.ServicesShutdownCompleted.Done()
+	<-p.OutstandingTasks.Done()
+
+	mgr.cancel()
+
+	if mgr.exp != nil {
+		return mgr.exp.Shutdown(p)
+	}
+	return nil
+}
+
+func (mgr *Manager) BeginCollection() {
+	if mgr.exp == nil {
+		return
+	} else if mgr.runtime.EnvType == "test" {
+		// Don't collect metrics when running tests.
+		return
+	}
+
+	interval := mgr.runtime.Metrics.CollectionInterval
+	if interval <= 0 {
+		interval = time.Minute
+	}
+	timeoutDur := interval / 2
+
+	ticker := time.NewTicker(interval)
+	for {
+		select {
+		case <-mgr.ctx.Done():
+			ticker.Stop()
+		case <-ticker.C:
+			ctx, cancel := context.WithTimeout(context.Background(), timeoutDur)
+			mgr.collectNow(ctx)
+			cancel()
+		}
+	}
+}
+
+func (mgr *Manager) collectNow(ctx context.Context) {
+	if mgr.exp == nil {
+		return
+	}
+
+	m := mgr.reg.Collect()
+	if err := mgr.exp.Export(ctx, m); err != nil {
+		mgr.rootLogger.Error().Err(err).Msg("unable to emit metrics")
+	} else {
+		mgr.rootLogger.Trace().Int("num_metrics", len(m)).Msg("successfully emitted metrics")
+	}
+}
+
+type exporter interface {
+	Export(context.Context, []metrics.CollectedMetric) error
+	Shutdown(p *shutdown.Process) error
+}
+
+type providerDesc struct {
+	name        string
+	matches     func(cfg *config.Metrics) bool
+	newExporter func(m *Manager) exporter
+}
+
+var providerRegistry []providerDesc
+
+func registerProvider(desc providerDesc) {
+	providerRegistry = append(providerRegistry, desc)
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/metrics_test.go b/runtimes/go/appruntime/infrasdk/metrics/metrics_test.go
new file mode 100644
index 0000000000..6a8e39c6b7
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/metrics_test.go
@@ -0,0 +1,59 @@
+package metrics
+
+import (
+	"errors"
+	"net/http"
+	"testing"
+
+	"encore.dev/appruntime/apisdk/api"
+	"encore.dev/beta/errs"
+)
+
+func TestCode(t *testing.T) {
+	testCases := []struct {
+		err        error
+		httpStatus int
+		want       string
+	}{
+		{
+			err:        nil,
+			httpStatus: 0,
+			want:       "ok",
+		},
+		{
+			err:  &errs.Error{Code: errs.OK},
+			want: errs.OK.String(),
+		},
+		{
+			err:  &errs.Error{Code: errs.Internal},
+			want: errs.Internal.String(),
+		},
+		{
+			err:  errors.New("unknown error"),
+			want: errs.Unknown.String(),
+		},
+		{
+			httpStatus: http.StatusOK,
+			want:       "ok",
+		},
+		{
+			httpStatus: http.StatusCreated,
+			want:       "http_201",
+		},
+		{
+			httpStatus: http.StatusTeapot,
+			want:       "http_418",
+		},
+	}
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.want, func(t *testing.T) {
+			t.Parallel()
+
+			code := api.Code(testCase.err, testCase.httpStatus)
+			if code != testCase.want {
+				t.Errorf("got '%s', want '%s'", code, testCase.want)
+			}
+		})
+	}
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/metricstest/test_exporter.go b/runtimes/go/appruntime/infrasdk/metrics/metricstest/test_exporter.go
new file mode 100644
index 0000000000..733ddcd75c
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/metricstest/test_exporter.go
@@ -0,0 +1,136 @@
+package metricstest
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/rs/zerolog"
+)
+
+// TestMetricsExporter is meant to be used in tests. It mimics the behavior of
+// other metrics exporters in production in that it panics when the caller passes
+// in a metric with more than three dimensions.
+//
+// Also, it keeps track of which metrics have been exported. This is useful in
+// tests when you want to assert that the code under test has emitted metrics.
+type TestMetricsExporter struct {
+	logger          zerolog.Logger
+	ExportedMetrics []*ExportedMetric
+}
+
+type MetricType string
+
+const (
+	MetricTypeCounter     MetricType = "counter"
+	MetricTypeObservation MetricType = "observation"
+)
+
+type ExportedMetric struct {
+	metricType MetricType
+	name       string
+	key        string // Only populated for 'observation' metric types
+	value      float64
+	tags       map[string]string
+}
+
+func NewTestMetricsExporter(logger zerolog.Logger) *TestMetricsExporter {
+	return &TestMetricsExporter{logger: logger}
+}
+
+func (e *TestMetricsExporter) IncCounter(name string, tags ...string) {
+	// See comment above.
+	if len(tags) > 6 {
+		panic("emitting metric with more than 3 dimensions is not supported")
+	}
+
+	tagMap := tagMap(tags...)
+	metric := e.find(MetricTypeCounter, name, tagMap)
+	if metric != nil {
+		metric.value += 1
+		return
+	}
+
+	e.ExportedMetrics = append(e.ExportedMetrics, &ExportedMetric{
+		metricType: MetricTypeCounter,
+		name:       name,
+		value:      1,
+		tags:       tagMap,
+	})
+}
+
+func (e *TestMetricsExporter) Observe(name string, key string, value float64, tags ...string) {
+	// See comment above.
+	if len(tags) > 6 {
+		panic("emitting metric with more than 3 dimensions is not supported")
+	}
+
+	tagMap := tagMap(tags...)
+	e.ExportedMetrics = append(e.ExportedMetrics, &ExportedMetric{
+		metricType: MetricTypeObservation,
+		name:       name,
+		key:        key,
+		value:      value,
+		tags:       tagMap,
+	})
+}
+
+func tagMap(tags ...string) map[string]string {
+	tagMap := make(map[string]string, len(tags))
+	for i := 0; i < len(tags); i += 2 {
+		if i+1 < len(tags) {
+			tagMap[tags[i]] = tags[i+1]
+		}
+	}
+	return tagMap
+}
+
+func (e *TestMetricsExporter) AssertCounter(t *testing.T, name string, value int, tags map[string]string) {
+	t.Helper()
+
+	actual := e.find(MetricTypeCounter, name, tags)
+	if actual == nil {
+		t.Errorf("counter assertion failed: counter metric '%s' with tags %s not emitted", name, tags)
+		return
+	}
+
+	if int(actual.value) != value {
+		t.Errorf("counter assertion failed: expected counter value %d, got %d", value, int(actual.value))
+	}
+	return
+}
+
+func (e *TestMetricsExporter) AssertObservation(
+	t *testing.T,
+	name string,
+	key string,
+	assert func(value float64) bool,
+	tags map[string]string,
+) {
+	t.Helper()
+
+	actual := e.find(MetricTypeObservation, name, tags)
+	if actual == nil {
+		t.Errorf("observation assertion failed: observation metric '%s' with tags %s not emitted", name, tags)
+		return
+	}
+
+	if actual.key != key {
+		t.Errorf("observation assertion failed: expected %s, got %s", key, actual.key)
+	}
+
+	if !assert(actual.value) {
+		t.Errorf("observation assertion failed: unexpected metric value %f", actual.value)
+	}
+	return
+}
+
+func (e *TestMetricsExporter) find(metricType MetricType, metricName string, tags map[string]string) *ExportedMetric {
+	for _, metric := range e.ExportedMetrics {
+		if metric.metricType == metricType &&
+			metric.name == metricName &&
+			reflect.DeepEqual(metric.tags, tags) {
+			return metric
+		}
+	}
+	return nil
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/null_exporter.go b/runtimes/go/appruntime/infrasdk/metrics/null_exporter.go
new file mode 100644
index 0000000000..96302fea5a
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/null_exporter.go
@@ -0,0 +1,20 @@
+package metrics
+
+import (
+	"context"
+
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/metrics"
+)
+
+type NullMetricsExporter struct{}
+
+func NewNullMetricsExporter() *NullMetricsExporter {
+	return &NullMetricsExporter{}
+}
+
+func (e *NullMetricsExporter) Export(ctx context.Context, metrics []metrics.CollectedMetric) error {
+	return nil
+}
+
+func (e *NullMetricsExporter) Shutdown(p *shutdown.Process) error { return nil }
diff --git a/runtimes/go/appruntime/infrasdk/metrics/prometheus/prometheus.go b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prometheus.go
new file mode 100644
index 0000000000..cd24c2d972
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prometheus.go
@@ -0,0 +1,194 @@
+//go:build !encore_no_prometheus
+
+package prometheus
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/golang/protobuf/proto"
+	"github.com/golang/snappy"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/infrasdk/metadata"
+	"encore.dev/appruntime/infrasdk/metrics/prometheus/prompb"
+	"encore.dev/appruntime/infrasdk/metrics/system"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/metrics"
+)
+
+func New(svcs []string, cfg *config.PrometheusRemoteWriteProvider, meta *metadata.ContainerMetadata, rootLogger zerolog.Logger) *Exporter {
+	// Precompute container metadata labels.
+	return &Exporter{
+		svcs: svcs,
+		cfg:  cfg,
+		containerMetadataLabels: metadata.MapMetadataLabels(meta, func(k, v string) *prompb.Label {
+			return &prompb.Label{Name: k, Value: v}
+		}),
+		rootLogger: rootLogger,
+	}
+}
+
+type Exporter struct {
+	svcs                    []string
+	cfg                     *config.PrometheusRemoteWriteProvider
+	containerMetadataLabels []*prompb.Label
+	rootLogger              zerolog.Logger
+}
+
+func (x *Exporter) Shutdown(p *shutdown.Process) error { return nil }
+
+func (x *Exporter) Export(ctx context.Context, collected []metrics.CollectedMetric) error {
+	now := time.Now()
+	data := x.getMetricData(now, collected)
+	data = append(data, x.getSysMetrics(now)...)
+	proto, err := proto.Marshal(&prompb.WriteRequest{Timeseries: data})
+	if err != nil {
+		return fmt.Errorf("unable to marshal metrics into Protobuf: %v", err)
+	}
+
+	encoded := snappy.Encode(nil, proto)
+	body := bytes.NewReader(encoded)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, x.cfg.RemoteWriteURL, body)
+	if err != nil {
+		return fmt.Errorf("unable to create HTTP request: %v", err)
+	}
+
+	req.Header.Set("Content-Type", "application/x-protobuf")
+	req.Header.Set("Content-Encoding", "snappy")
+	req.Header.Set("User-Agent", "encore")
+	req.Header.Set("X-Prometheus-Remote-Write-Version", "0.1.0")
+	_, err = http.DefaultClient.Do(req)
+	if err != nil {
+		return fmt.Errorf("unable to send metrics to Prometheus remote write destination: %v", err)
+	}
+
+	return nil
+}
+
+func (x *Exporter) getMetricData(now time.Time, collected []metrics.CollectedMetric) []*prompb.TimeSeries {
+	data := make([]*prompb.TimeSeries, 0, len(collected))
+
+	doAdd := func(val float64, metricName string, baseLabels []*prompb.Label, svcIdx uint16) {
+		labels := make([]*prompb.Label, len(baseLabels)+2)
+		copy(labels, baseLabels)
+		labels[len(baseLabels)] = &prompb.Label{Name: "__name__", Value: metricName}
+		labels[len(baseLabels)+1] = &prompb.Label{Name: "service", Value: x.svcs[svcIdx]}
+		data = append(data, &prompb.TimeSeries{
+			Labels: labels,
+			Samples: []*prompb.Sample{
+				{
+					Value:     val,
+					Timestamp: FromTime(now),
+				},
+			},
+		})
+	}
+
+	for _, m := range collected {
+		labels := make([]*prompb.Label, len(x.containerMetadataLabels))
+		copy(labels, x.containerMetadataLabels)
+		for _, label := range m.Labels {
+			labels = append(labels, &prompb.Label{
+				Name:  label.Key,
+				Value: label.Value,
+			})
+		}
+
+		svcNum := m.Info.SvcNum()
+		switch vals := m.Val.(type) {
+		case []float64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(vals[0], m.Info.Name(), labels, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(val, m.Info.Name(), labels, uint16(i))
+					}
+				}
+			}
+		case []int64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(float64(vals[0]), m.Info.Name(), labels, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(float64(val), m.Info.Name(), labels, uint16(i))
+					}
+				}
+			}
+		case []uint64:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(float64(vals[0]), m.Info.Name(), labels, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(float64(val), m.Info.Name(), labels, uint16(i))
+					}
+				}
+			}
+		case []time.Duration:
+			if svcNum > 0 {
+				if m.Valid[0].Load() {
+					doAdd(float64(vals[0]/time.Second), m.Info.Name(), labels, svcNum-1)
+				}
+			} else {
+				for i, val := range vals {
+					if m.Valid[i].Load() {
+						doAdd(float64(val/time.Second), m.Info.Name(), labels, uint16(i))
+					}
+				}
+			}
+		default:
+			x.rootLogger.Error().Msgf("encore: internal error: unknown value type %T for metric %s",
+				m.Val, m.Info.Name())
+		}
+	}
+
+	return data
+}
+
+func (x *Exporter) getSysMetrics(now time.Time) []*prompb.TimeSeries {
+	addMetricNameLabel := func(metricName string) []*prompb.Label {
+		labels := make([]*prompb.Label, len(x.containerMetadataLabels)+1)
+		copy(labels, x.containerMetadataLabels)
+		labels[len(x.containerMetadataLabels)] = &prompb.Label{
+			Name:  "__name__",
+			Value: metricName,
+		}
+		return labels
+	}
+
+	sysMetrics := system.ReadSysMetrics(x.rootLogger)
+	return []*prompb.TimeSeries{
+		{
+			Labels: addMetricNameLabel(system.MetricNameHeapObjectsBytes),
+			Samples: []*prompb.Sample{{
+				Value:     float64(sysMetrics[system.MetricNameHeapObjectsBytes]),
+				Timestamp: FromTime(now),
+			}},
+		},
+		{
+			Labels: addMetricNameLabel(system.MetricNameGoroutines),
+			Samples: []*prompb.Sample{{
+				Value:     float64(sysMetrics[system.MetricNameGoroutines]),
+				Timestamp: FromTime(now),
+			}},
+		},
+	}
+}
+
+// FromTime returns a new millisecond timestamp from a time.
+func FromTime(t time.Time) int64 {
+	return t.Unix()*1000 + int64(t.Nanosecond())/int64(time.Millisecond)
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/prometheus/prometheus_test.go b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prometheus_test.go
new file mode 100644
index 0000000000..63e5849e4e
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prometheus_test.go
@@ -0,0 +1,195 @@
+package prometheus
+
+import (
+	"reflect"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"encore.dev/appruntime/infrasdk/metrics/prometheus/prompb"
+	"encore.dev/metrics"
+)
+
+type metricInfo struct {
+	name   string
+	typ    metrics.MetricType
+	svcNum uint16
+}
+
+func (m metricInfo) Name() string             { return m.name }
+func (m metricInfo) Type() metrics.MetricType { return m.typ }
+func (m metricInfo) SvcNum() uint16           { return m.svcNum }
+
+func TestGetMetricData(t *testing.T) {
+	now := time.Now()
+	svcs := []string{"foo", "bar"}
+	tests := []struct {
+		name   string
+		metric metrics.CollectedMetric
+		data   []*prompb.TimeSeries
+	}{
+		{
+			name: "counter",
+			metric: metrics.CollectedMetric{
+				Info: metricInfo{"test_counter", metrics.CounterType, 1},
+				Val:  []int64{10},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 1)
+					valid[0].Store(true)
+					return valid
+				}(),
+			},
+			data: []*prompb.TimeSeries{
+				{
+					Labels: []*prompb.Label{
+						{
+							Name:  "__name__",
+							Value: "test_counter",
+						},
+						{
+							Name:  "service",
+							Value: "foo",
+						},
+					},
+					Samples: []*prompb.Sample{
+						{
+							Value:     10,
+							Timestamp: FromTime(now),
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "gauge",
+			metric: metrics.CollectedMetric{
+				Info: metricInfo{"test_gauge", metrics.GaugeType, 2},
+				Val:  []float64{0.5},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 1)
+					valid[0].Store(true)
+					return valid
+				}(),
+			},
+			data: []*prompb.TimeSeries{
+				{
+					Labels: []*prompb.Label{
+						{
+							Name:  "__name__",
+							Value: "test_gauge",
+						},
+						{
+							Name:  "service",
+							Value: "bar",
+						},
+					},
+					Samples: []*prompb.Sample{
+						{
+							Value:     0.5,
+							Timestamp: FromTime(now),
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "labels",
+			metric: metrics.CollectedMetric{
+				Info:   metricInfo{"test_labels", metrics.GaugeType, 1},
+				Labels: []metrics.KeyValue{{"key", "value"}},
+				Val:    []float64{-1.5},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 1)
+					valid[0].Store(true)
+					return valid
+				}(),
+			},
+			data: []*prompb.TimeSeries{
+				{
+					Labels: []*prompb.Label{
+						{
+							Name:  "key",
+							Value: "value",
+						},
+						{
+							Name:  "__name__",
+							Value: "test_labels",
+						},
+						{
+							Name:  "service",
+							Value: "foo",
+						},
+					},
+					Samples: []*prompb.Sample{
+						{
+							Value:     -1.5,
+							Timestamp: FromTime(now),
+						},
+					},
+				},
+			},
+		},
+		{
+			name: "multiple services",
+			metric: metrics.CollectedMetric{
+				Info: metricInfo{"test_counter", metrics.CounterType, 0},
+				Val:  []int64{1, 1},
+				Valid: func() []atomic.Bool {
+					valid := make([]atomic.Bool, 2)
+					valid[0].Store(true)
+					valid[1].Store(true)
+					return valid
+				}(),
+			},
+			data: []*prompb.TimeSeries{
+				{
+					Labels: []*prompb.Label{
+						{
+							Name:  "__name__",
+							Value: "test_counter",
+						},
+						{
+							Name:  "service",
+							Value: "foo",
+						},
+					},
+					Samples: []*prompb.Sample{
+						{
+							Value:     1,
+							Timestamp: FromTime(now),
+						},
+					},
+				},
+				{
+					Labels: []*prompb.Label{
+						{
+							Name:  "__name__",
+							Value: "test_counter",
+						},
+						{
+							Name:  "service",
+							Value: "bar",
+						},
+					},
+					Samples: []*prompb.Sample{
+						{
+							Value:     1,
+							Timestamp: FromTime(now),
+						},
+					},
+				},
+			},
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			x := &Exporter{svcs: svcs}
+			got := x.getMetricData(now, []metrics.CollectedMetric{test.metric})
+			if len(got) != len(test.data) {
+				t.Errorf("got %d items, want %d", len(got), len(test.data))
+			} else if !reflect.DeepEqual(got, test.data) {
+				t.Errorf("got %+v, want %+v", got, test.data)
+			}
+		})
+	}
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/remote.pb.go b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/remote.pb.go
new file mode 100644
index 0000000000..a2e3f6d2d6
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/remote.pb.go
@@ -0,0 +1,646 @@
+// Copyright 2016 Prometheus Team
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        v3.21.7
+// source: remote.proto
+
+package prompb
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type ReadRequest_ResponseType int32
+
+const (
+	// Server will return a single ReadResponse message with matched series that includes list of raw samples.
+	// It's recommended to use streamed response types instead.
+	//
+	// Response headers:
+	// Content-Type: "application/x-protobuf"
+	// Content-Encoding: "snappy"
+	ReadRequest_SAMPLES ReadRequest_ResponseType = 0
+	// Server will stream a delimited ChunkedReadResponse message that
+	// contains XOR or HISTOGRAM(!) encoded chunks for a single series.
+	// Each message is following varint size and fixed size bigendian
+	// uint32 for CRC32 Castagnoli checksum.
+	//
+	// Response headers:
+	// Content-Type: "application/x-streamed-protobuf; proto=prometheus.ChunkedReadResponse"
+	// Content-Encoding: ""
+	ReadRequest_STREAMED_XOR_CHUNKS ReadRequest_ResponseType = 1
+)
+
+// Enum value maps for ReadRequest_ResponseType.
+var (
+	ReadRequest_ResponseType_name = map[int32]string{
+		0: "SAMPLES",
+		1: "STREAMED_XOR_CHUNKS",
+	}
+	ReadRequest_ResponseType_value = map[string]int32{
+		"SAMPLES":             0,
+		"STREAMED_XOR_CHUNKS": 1,
+	}
+)
+
+func (x ReadRequest_ResponseType) Enum() *ReadRequest_ResponseType {
+	p := new(ReadRequest_ResponseType)
+	*p = x
+	return p
+}
+
+func (x ReadRequest_ResponseType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ReadRequest_ResponseType) Descriptor() protoreflect.EnumDescriptor {
+	return file_remote_proto_enumTypes[0].Descriptor()
+}
+
+func (ReadRequest_ResponseType) Type() protoreflect.EnumType {
+	return &file_remote_proto_enumTypes[0]
+}
+
+func (x ReadRequest_ResponseType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ReadRequest_ResponseType.Descriptor instead.
+func (ReadRequest_ResponseType) EnumDescriptor() ([]byte, []int) {
+	return file_remote_proto_rawDescGZIP(), []int{1, 0}
+}
+
+type WriteRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Timeseries []*TimeSeries     `protobuf:"bytes,1,rep,name=timeseries,proto3" json:"timeseries,omitempty"`
+	Metadata   []*MetricMetadata `protobuf:"bytes,3,rep,name=metadata,proto3" json:"metadata,omitempty"`
+}
+
+func (x *WriteRequest) Reset() {
+	*x = WriteRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_remote_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WriteRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WriteRequest) ProtoMessage() {}
+
+func (x *WriteRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_remote_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WriteRequest.ProtoReflect.Descriptor instead.
+func (*WriteRequest) Descriptor() ([]byte, []int) {
+	return file_remote_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *WriteRequest) GetTimeseries() []*TimeSeries {
+	if x != nil {
+		return x.Timeseries
+	}
+	return nil
+}
+
+func (x *WriteRequest) GetMetadata() []*MetricMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+// ReadRequest represents a remote read request.
+type ReadRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Queries []*Query `protobuf:"bytes,1,rep,name=queries,proto3" json:"queries,omitempty"`
+	// accepted_response_types allows negotiating the content type of the response.
+	//
+	// Response types are taken from the list in the FIFO order. If no response type in `accepted_response_types` is
+	// implemented by server, error is returned.
+	// For request that do not contain `accepted_response_types` field the SAMPLES response type will be used.
+	AcceptedResponseTypes []ReadRequest_ResponseType `protobuf:"varint,2,rep,packed,name=accepted_response_types,json=acceptedResponseTypes,proto3,enum=prometheus.ReadRequest_ResponseType" json:"accepted_response_types,omitempty"`
+}
+
+func (x *ReadRequest) Reset() {
+	*x = ReadRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_remote_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ReadRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ReadRequest) ProtoMessage() {}
+
+func (x *ReadRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_remote_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ReadRequest.ProtoReflect.Descriptor instead.
+func (*ReadRequest) Descriptor() ([]byte, []int) {
+	return file_remote_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ReadRequest) GetQueries() []*Query {
+	if x != nil {
+		return x.Queries
+	}
+	return nil
+}
+
+func (x *ReadRequest) GetAcceptedResponseTypes() []ReadRequest_ResponseType {
+	if x != nil {
+		return x.AcceptedResponseTypes
+	}
+	return nil
+}
+
+// ReadResponse is a response when response_type equals SAMPLES.
+type ReadResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// In same order as the request's queries.
+	Results []*QueryResult `protobuf:"bytes,1,rep,name=results,proto3" json:"results,omitempty"`
+}
+
+func (x *ReadResponse) Reset() {
+	*x = ReadResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_remote_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ReadResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ReadResponse) ProtoMessage() {}
+
+func (x *ReadResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_remote_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ReadResponse.ProtoReflect.Descriptor instead.
+func (*ReadResponse) Descriptor() ([]byte, []int) {
+	return file_remote_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ReadResponse) GetResults() []*QueryResult {
+	if x != nil {
+		return x.Results
+	}
+	return nil
+}
+
+type Query struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	StartTimestampMs int64           `protobuf:"varint,1,opt,name=start_timestamp_ms,json=startTimestampMs,proto3" json:"start_timestamp_ms,omitempty"`
+	EndTimestampMs   int64           `protobuf:"varint,2,opt,name=end_timestamp_ms,json=endTimestampMs,proto3" json:"end_timestamp_ms,omitempty"`
+	Matchers         []*LabelMatcher `protobuf:"bytes,3,rep,name=matchers,proto3" json:"matchers,omitempty"`
+	Hints            *ReadHints      `protobuf:"bytes,4,opt,name=hints,proto3" json:"hints,omitempty"`
+}
+
+func (x *Query) Reset() {
+	*x = Query{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_remote_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Query) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Query) ProtoMessage() {}
+
+func (x *Query) ProtoReflect() protoreflect.Message {
+	mi := &file_remote_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Query.ProtoReflect.Descriptor instead.
+func (*Query) Descriptor() ([]byte, []int) {
+	return file_remote_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *Query) GetStartTimestampMs() int64 {
+	if x != nil {
+		return x.StartTimestampMs
+	}
+	return 0
+}
+
+func (x *Query) GetEndTimestampMs() int64 {
+	if x != nil {
+		return x.EndTimestampMs
+	}
+	return 0
+}
+
+func (x *Query) GetMatchers() []*LabelMatcher {
+	if x != nil {
+		return x.Matchers
+	}
+	return nil
+}
+
+func (x *Query) GetHints() *ReadHints {
+	if x != nil {
+		return x.Hints
+	}
+	return nil
+}
+
+type QueryResult struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Samples within a time series must be ordered by time.
+	Timeseries []*TimeSeries `protobuf:"bytes,1,rep,name=timeseries,proto3" json:"timeseries,omitempty"`
+}
+
+func (x *QueryResult) Reset() {
+	*x = QueryResult{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_remote_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *QueryResult) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*QueryResult) ProtoMessage() {}
+
+func (x *QueryResult) ProtoReflect() protoreflect.Message {
+	mi := &file_remote_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use QueryResult.ProtoReflect.Descriptor instead.
+func (*QueryResult) Descriptor() ([]byte, []int) {
+	return file_remote_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *QueryResult) GetTimeseries() []*TimeSeries {
+	if x != nil {
+		return x.Timeseries
+	}
+	return nil
+}
+
+// ChunkedReadResponse is a response when response_type equals STREAMED_XOR_CHUNKS.
+// We strictly stream full series after series, optionally split by time. This means that a single frame can contain
+// partition of the single series, but once a new series is started to be streamed it means that no more chunks will
+// be sent for previous one. Series are returned sorted in the same way TSDB block are internally.
+type ChunkedReadResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ChunkedSeries []*ChunkedSeries `protobuf:"bytes,1,rep,name=chunked_series,json=chunkedSeries,proto3" json:"chunked_series,omitempty"`
+	// query_index represents an index of the query from ReadRequest.queries these chunks relates to.
+	QueryIndex int64 `protobuf:"varint,2,opt,name=query_index,json=queryIndex,proto3" json:"query_index,omitempty"`
+}
+
+func (x *ChunkedReadResponse) Reset() {
+	*x = ChunkedReadResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_remote_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ChunkedReadResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ChunkedReadResponse) ProtoMessage() {}
+
+func (x *ChunkedReadResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_remote_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ChunkedReadResponse.ProtoReflect.Descriptor instead.
+func (*ChunkedReadResponse) Descriptor() ([]byte, []int) {
+	return file_remote_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *ChunkedReadResponse) GetChunkedSeries() []*ChunkedSeries {
+	if x != nil {
+		return x.ChunkedSeries
+	}
+	return nil
+}
+
+func (x *ChunkedReadResponse) GetQueryIndex() int64 {
+	if x != nil {
+		return x.QueryIndex
+	}
+	return 0
+}
+
+var File_remote_proto protoreflect.FileDescriptor
+
+var file_remote_proto_rawDesc = []byte{
+	0x0a, 0x0c, 0x72, 0x65, 0x6d, 0x6f, 0x74, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0a,
+	0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x1a, 0x0b, 0x74, 0x79, 0x70, 0x65,
+	0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x84, 0x01, 0x0a, 0x0c, 0x57, 0x72, 0x69, 0x74,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x36, 0x0a, 0x0a, 0x74, 0x69, 0x6d, 0x65,
+	0x73, 0x65, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70,
+	0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x53, 0x65,
+	0x72, 0x69, 0x65, 0x73, 0x52, 0x0a, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x69, 0x65, 0x73,
+	0x12, 0x36, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x03, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e,
+	0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x4a, 0x04, 0x08, 0x02, 0x10, 0x03, 0x22, 0xce,
+	0x01, 0x0a, 0x0b, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2b,
+	0x0a, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x11, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x51, 0x75, 0x65,
+	0x72, 0x79, 0x52, 0x07, 0x71, 0x75, 0x65, 0x72, 0x69, 0x65, 0x73, 0x12, 0x5c, 0x0a, 0x17, 0x61,
+	0x63, 0x63, 0x65, 0x70, 0x74, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x5f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0e, 0x32, 0x24, 0x2e, 0x70,
+	0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x54, 0x79,
+	0x70, 0x65, 0x52, 0x15, 0x61, 0x63, 0x63, 0x65, 0x70, 0x74, 0x65, 0x64, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x54, 0x79, 0x70, 0x65, 0x73, 0x22, 0x34, 0x0a, 0x0c, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x53, 0x41, 0x4d,
+	0x50, 0x4c, 0x45, 0x53, 0x10, 0x00, 0x12, 0x17, 0x0a, 0x13, 0x53, 0x54, 0x52, 0x45, 0x41, 0x4d,
+	0x45, 0x44, 0x5f, 0x58, 0x4f, 0x52, 0x5f, 0x43, 0x48, 0x55, 0x4e, 0x4b, 0x53, 0x10, 0x01, 0x22,
+	0x41, 0x0a, 0x0c, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x31, 0x0a, 0x07, 0x72, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x17, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x51, 0x75,
+	0x65, 0x72, 0x79, 0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x52, 0x07, 0x72, 0x65, 0x73, 0x75, 0x6c,
+	0x74, 0x73, 0x22, 0xc2, 0x01, 0x0a, 0x05, 0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x2c, 0x0a, 0x12,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x5f,
+	0x6d, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x10, 0x73, 0x74, 0x61, 0x72, 0x74, 0x54,
+	0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x4d, 0x73, 0x12, 0x28, 0x0a, 0x10, 0x65, 0x6e,
+	0x64, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x5f, 0x6d, 0x73, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x03, 0x52, 0x0e, 0x65, 0x6e, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x4d, 0x73, 0x12, 0x34, 0x0a, 0x08, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x72, 0x73,
+	0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68,
+	0x65, 0x75, 0x73, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x72,
+	0x52, 0x08, 0x6d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x72, 0x73, 0x12, 0x2b, 0x0a, 0x05, 0x68, 0x69,
+	0x6e, 0x74, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x6d,
+	0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x52, 0x65, 0x61, 0x64, 0x48, 0x69, 0x6e, 0x74, 0x73,
+	0x52, 0x05, 0x68, 0x69, 0x6e, 0x74, 0x73, 0x22, 0x45, 0x0a, 0x0b, 0x51, 0x75, 0x65, 0x72, 0x79,
+	0x52, 0x65, 0x73, 0x75, 0x6c, 0x74, 0x12, 0x36, 0x0a, 0x0a, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x65,
+	0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x72, 0x6f,
+	0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x69,
+	0x65, 0x73, 0x52, 0x0a, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x65, 0x72, 0x69, 0x65, 0x73, 0x22, 0x78,
+	0x0a, 0x13, 0x43, 0x68, 0x75, 0x6e, 0x6b, 0x65, 0x64, 0x52, 0x65, 0x61, 0x64, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x0e, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x65, 0x64,
+	0x5f, 0x73, 0x65, 0x72, 0x69, 0x65, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x19, 0x2e,
+	0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x43, 0x68, 0x75, 0x6e, 0x6b,
+	0x65, 0x64, 0x53, 0x65, 0x72, 0x69, 0x65, 0x73, 0x52, 0x0d, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x65,
+	0x64, 0x53, 0x65, 0x72, 0x69, 0x65, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x71, 0x75, 0x65, 0x72, 0x79,
+	0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0a, 0x71, 0x75,
+	0x65, 0x72, 0x79, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x42, 0x31, 0x5a, 0x2f, 0x65, 0x6e, 0x63, 0x6f,
+	0x72, 0x65, 0x2e, 0x64, 0x65, 0x76, 0x2f, 0x61, 0x70, 0x70, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x2f, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x2f, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74,
+	0x68, 0x65, 0x75, 0x73, 0x2f, 0x70, 0x72, 0x6f, 0x6d, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
+}
+
+var (
+	file_remote_proto_rawDescOnce sync.Once
+	file_remote_proto_rawDescData = file_remote_proto_rawDesc
+)
+
+func file_remote_proto_rawDescGZIP() []byte {
+	file_remote_proto_rawDescOnce.Do(func() {
+		file_remote_proto_rawDescData = protoimpl.X.CompressGZIP(file_remote_proto_rawDescData)
+	})
+	return file_remote_proto_rawDescData
+}
+
+var file_remote_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_remote_proto_msgTypes = make([]protoimpl.MessageInfo, 6)
+var file_remote_proto_goTypes = []interface{}{
+	(ReadRequest_ResponseType)(0), // 0: prometheus.ReadRequest.ResponseType
+	(*WriteRequest)(nil),          // 1: prometheus.WriteRequest
+	(*ReadRequest)(nil),           // 2: prometheus.ReadRequest
+	(*ReadResponse)(nil),          // 3: prometheus.ReadResponse
+	(*Query)(nil),                 // 4: prometheus.Query
+	(*QueryResult)(nil),           // 5: prometheus.QueryResult
+	(*ChunkedReadResponse)(nil),   // 6: prometheus.ChunkedReadResponse
+	(*TimeSeries)(nil),            // 7: prometheus.TimeSeries
+	(*MetricMetadata)(nil),        // 8: prometheus.MetricMetadata
+	(*LabelMatcher)(nil),          // 9: prometheus.LabelMatcher
+	(*ReadHints)(nil),             // 10: prometheus.ReadHints
+	(*ChunkedSeries)(nil),         // 11: prometheus.ChunkedSeries
+}
+var file_remote_proto_depIdxs = []int32{
+	7,  // 0: prometheus.WriteRequest.timeseries:type_name -> prometheus.TimeSeries
+	8,  // 1: prometheus.WriteRequest.metadata:type_name -> prometheus.MetricMetadata
+	4,  // 2: prometheus.ReadRequest.queries:type_name -> prometheus.Query
+	0,  // 3: prometheus.ReadRequest.accepted_response_types:type_name -> prometheus.ReadRequest.ResponseType
+	5,  // 4: prometheus.ReadResponse.results:type_name -> prometheus.QueryResult
+	9,  // 5: prometheus.Query.matchers:type_name -> prometheus.LabelMatcher
+	10, // 6: prometheus.Query.hints:type_name -> prometheus.ReadHints
+	7,  // 7: prometheus.QueryResult.timeseries:type_name -> prometheus.TimeSeries
+	11, // 8: prometheus.ChunkedReadResponse.chunked_series:type_name -> prometheus.ChunkedSeries
+	9,  // [9:9] is the sub-list for method output_type
+	9,  // [9:9] is the sub-list for method input_type
+	9,  // [9:9] is the sub-list for extension type_name
+	9,  // [9:9] is the sub-list for extension extendee
+	0,  // [0:9] is the sub-list for field type_name
+}
+
+func init() { file_remote_proto_init() }
+func file_remote_proto_init() {
+	if File_remote_proto != nil {
+		return
+	}
+	file_types_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_remote_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WriteRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_remote_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ReadRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_remote_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ReadResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_remote_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Query); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_remote_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*QueryResult); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_remote_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ChunkedReadResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_remote_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   6,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_remote_proto_goTypes,
+		DependencyIndexes: file_remote_proto_depIdxs,
+		EnumInfos:         file_remote_proto_enumTypes,
+		MessageInfos:      file_remote_proto_msgTypes,
+	}.Build()
+	File_remote_proto = out.File
+	file_remote_proto_rawDesc = nil
+	file_remote_proto_goTypes = nil
+	file_remote_proto_depIdxs = nil
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/remote.proto b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/remote.proto
new file mode 100644
index 0000000000..3c791320e4
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/remote.proto
@@ -0,0 +1,87 @@
+// Copyright 2016 Prometheus Team
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+package prometheus;
+
+option go_package = "encore.dev/appruntime/metrics/prometheus/prompb";
+
+import "types.proto";
+
+message WriteRequest {
+  repeated prometheus.TimeSeries timeseries = 1;
+  // Cortex uses this field to determine the source of the write request.
+  // We reserve it to avoid any compatibility issues.
+  reserved  2;
+  repeated prometheus.MetricMetadata metadata = 3;
+}
+
+// ReadRequest represents a remote read request.
+message ReadRequest {
+  repeated Query queries = 1;
+
+  enum ResponseType {
+    // Server will return a single ReadResponse message with matched series that includes list of raw samples.
+    // It's recommended to use streamed response types instead.
+    //
+    // Response headers:
+    // Content-Type: "application/x-protobuf"
+    // Content-Encoding: "snappy"
+    SAMPLES = 0;
+    // Server will stream a delimited ChunkedReadResponse message that
+    // contains XOR or HISTOGRAM(!) encoded chunks for a single series.
+    // Each message is following varint size and fixed size bigendian
+    // uint32 for CRC32 Castagnoli checksum.
+    //
+    // Response headers:
+    // Content-Type: "application/x-streamed-protobuf; proto=prometheus.ChunkedReadResponse"
+    // Content-Encoding: ""
+    STREAMED_XOR_CHUNKS = 1;
+  }
+
+  // accepted_response_types allows negotiating the content type of the response.
+  //
+  // Response types are taken from the list in the FIFO order. If no response type in `accepted_response_types` is
+  // implemented by server, error is returned.
+  // For request that do not contain `accepted_response_types` field the SAMPLES response type will be used.
+  repeated ResponseType accepted_response_types = 2;
+}
+
+// ReadResponse is a response when response_type equals SAMPLES.
+message ReadResponse {
+  // In same order as the request's queries.
+  repeated QueryResult results = 1;
+}
+
+message Query {
+  int64 start_timestamp_ms = 1;
+  int64 end_timestamp_ms = 2;
+  repeated prometheus.LabelMatcher matchers = 3;
+  prometheus.ReadHints hints = 4;
+}
+
+message QueryResult {
+  // Samples within a time series must be ordered by time.
+  repeated prometheus.TimeSeries timeseries = 1;
+}
+
+// ChunkedReadResponse is a response when response_type equals STREAMED_XOR_CHUNKS.
+// We strictly stream full series after series, optionally split by time. This means that a single frame can contain
+// partition of the single series, but once a new series is started to be streamed it means that no more chunks will
+// be sent for previous one. Series are returned sorted in the same way TSDB block are internally.
+message ChunkedReadResponse {
+  repeated prometheus.ChunkedSeries chunked_series = 1;
+
+  // query_index represents an index of the query from ReadRequest.queries these chunks relates to.
+  int64 query_index = 2;
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/types.pb.go b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/types.pb.go
new file mode 100644
index 0000000000..a748ac4c33
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/types.pb.go
@@ -0,0 +1,1584 @@
+// Copyright 2017 Prometheus Team
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        v3.21.7
+// source: types.proto
+
+package prompb
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type MetricMetadata_MetricType int32
+
+const (
+	MetricMetadata_UNKNOWN        MetricMetadata_MetricType = 0
+	MetricMetadata_COUNTER        MetricMetadata_MetricType = 1
+	MetricMetadata_GAUGE          MetricMetadata_MetricType = 2
+	MetricMetadata_HISTOGRAM      MetricMetadata_MetricType = 3
+	MetricMetadata_GAUGEHISTOGRAM MetricMetadata_MetricType = 4
+	MetricMetadata_SUMMARY        MetricMetadata_MetricType = 5
+	MetricMetadata_INFO           MetricMetadata_MetricType = 6
+	MetricMetadata_STATESET       MetricMetadata_MetricType = 7
+)
+
+// Enum value maps for MetricMetadata_MetricType.
+var (
+	MetricMetadata_MetricType_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "COUNTER",
+		2: "GAUGE",
+		3: "HISTOGRAM",
+		4: "GAUGEHISTOGRAM",
+		5: "SUMMARY",
+		6: "INFO",
+		7: "STATESET",
+	}
+	MetricMetadata_MetricType_value = map[string]int32{
+		"UNKNOWN":        0,
+		"COUNTER":        1,
+		"GAUGE":          2,
+		"HISTOGRAM":      3,
+		"GAUGEHISTOGRAM": 4,
+		"SUMMARY":        5,
+		"INFO":           6,
+		"STATESET":       7,
+	}
+)
+
+func (x MetricMetadata_MetricType) Enum() *MetricMetadata_MetricType {
+	p := new(MetricMetadata_MetricType)
+	*p = x
+	return p
+}
+
+func (x MetricMetadata_MetricType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MetricMetadata_MetricType) Descriptor() protoreflect.EnumDescriptor {
+	return file_types_proto_enumTypes[0].Descriptor()
+}
+
+func (MetricMetadata_MetricType) Type() protoreflect.EnumType {
+	return &file_types_proto_enumTypes[0]
+}
+
+func (x MetricMetadata_MetricType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MetricMetadata_MetricType.Descriptor instead.
+func (MetricMetadata_MetricType) EnumDescriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type Histogram_ResetHint int32
+
+const (
+	Histogram_UNKNOWN Histogram_ResetHint = 0 // Need to test for a counter reset explicitly.
+	Histogram_YES     Histogram_ResetHint = 1 // This is the 1st histogram after a counter reset.
+	Histogram_NO      Histogram_ResetHint = 2 // There was no counter reset between this and the previous Histogram.
+	Histogram_GAUGE   Histogram_ResetHint = 3 // This is a gauge histogram where counter resets don't happen.
+)
+
+// Enum value maps for Histogram_ResetHint.
+var (
+	Histogram_ResetHint_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "YES",
+		2: "NO",
+		3: "GAUGE",
+	}
+	Histogram_ResetHint_value = map[string]int32{
+		"UNKNOWN": 0,
+		"YES":     1,
+		"NO":      2,
+		"GAUGE":   3,
+	}
+)
+
+func (x Histogram_ResetHint) Enum() *Histogram_ResetHint {
+	p := new(Histogram_ResetHint)
+	*p = x
+	return p
+}
+
+func (x Histogram_ResetHint) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Histogram_ResetHint) Descriptor() protoreflect.EnumDescriptor {
+	return file_types_proto_enumTypes[1].Descriptor()
+}
+
+func (Histogram_ResetHint) Type() protoreflect.EnumType {
+	return &file_types_proto_enumTypes[1]
+}
+
+func (x Histogram_ResetHint) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Histogram_ResetHint.Descriptor instead.
+func (Histogram_ResetHint) EnumDescriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{3, 0}
+}
+
+type LabelMatcher_Type int32
+
+const (
+	LabelMatcher_EQ  LabelMatcher_Type = 0
+	LabelMatcher_NEQ LabelMatcher_Type = 1
+	LabelMatcher_RE  LabelMatcher_Type = 2
+	LabelMatcher_NRE LabelMatcher_Type = 3
+)
+
+// Enum value maps for LabelMatcher_Type.
+var (
+	LabelMatcher_Type_name = map[int32]string{
+		0: "EQ",
+		1: "NEQ",
+		2: "RE",
+		3: "NRE",
+	}
+	LabelMatcher_Type_value = map[string]int32{
+		"EQ":  0,
+		"NEQ": 1,
+		"RE":  2,
+		"NRE": 3,
+	}
+)
+
+func (x LabelMatcher_Type) Enum() *LabelMatcher_Type {
+	p := new(LabelMatcher_Type)
+	*p = x
+	return p
+}
+
+func (x LabelMatcher_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (LabelMatcher_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_types_proto_enumTypes[2].Descriptor()
+}
+
+func (LabelMatcher_Type) Type() protoreflect.EnumType {
+	return &file_types_proto_enumTypes[2]
+}
+
+func (x LabelMatcher_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use LabelMatcher_Type.Descriptor instead.
+func (LabelMatcher_Type) EnumDescriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{8, 0}
+}
+
+// We require this to match chunkenc.Encoding.
+type Chunk_Encoding int32
+
+const (
+	Chunk_UNKNOWN   Chunk_Encoding = 0
+	Chunk_XOR       Chunk_Encoding = 1
+	Chunk_HISTOGRAM Chunk_Encoding = 2
+)
+
+// Enum value maps for Chunk_Encoding.
+var (
+	Chunk_Encoding_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "XOR",
+		2: "HISTOGRAM",
+	}
+	Chunk_Encoding_value = map[string]int32{
+		"UNKNOWN":   0,
+		"XOR":       1,
+		"HISTOGRAM": 2,
+	}
+)
+
+func (x Chunk_Encoding) Enum() *Chunk_Encoding {
+	p := new(Chunk_Encoding)
+	*p = x
+	return p
+}
+
+func (x Chunk_Encoding) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Chunk_Encoding) Descriptor() protoreflect.EnumDescriptor {
+	return file_types_proto_enumTypes[3].Descriptor()
+}
+
+func (Chunk_Encoding) Type() protoreflect.EnumType {
+	return &file_types_proto_enumTypes[3]
+}
+
+func (x Chunk_Encoding) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Chunk_Encoding.Descriptor instead.
+func (Chunk_Encoding) EnumDescriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{10, 0}
+}
+
+type MetricMetadata struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Represents the metric type, these match the set from Prometheus.
+	// Refer to model/textparse/interface.go for details.
+	Type             MetricMetadata_MetricType `protobuf:"varint,1,opt,name=type,proto3,enum=prometheus.MetricMetadata_MetricType" json:"type,omitempty"`
+	MetricFamilyName string                    `protobuf:"bytes,2,opt,name=metric_family_name,json=metricFamilyName,proto3" json:"metric_family_name,omitempty"`
+	Help             string                    `protobuf:"bytes,4,opt,name=help,proto3" json:"help,omitempty"`
+	Unit             string                    `protobuf:"bytes,5,opt,name=unit,proto3" json:"unit,omitempty"`
+}
+
+func (x *MetricMetadata) Reset() {
+	*x = MetricMetadata{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MetricMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MetricMetadata) ProtoMessage() {}
+
+func (x *MetricMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MetricMetadata.ProtoReflect.Descriptor instead.
+func (*MetricMetadata) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *MetricMetadata) GetType() MetricMetadata_MetricType {
+	if x != nil {
+		return x.Type
+	}
+	return MetricMetadata_UNKNOWN
+}
+
+func (x *MetricMetadata) GetMetricFamilyName() string {
+	if x != nil {
+		return x.MetricFamilyName
+	}
+	return ""
+}
+
+func (x *MetricMetadata) GetHelp() string {
+	if x != nil {
+		return x.Help
+	}
+	return ""
+}
+
+func (x *MetricMetadata) GetUnit() string {
+	if x != nil {
+		return x.Unit
+	}
+	return ""
+}
+
+type Sample struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Value float64 `protobuf:"fixed64,1,opt,name=value,proto3" json:"value,omitempty"`
+	// timestamp is in ms format, see model/timestamp/timestamp.go for
+	// conversion from time.Time to Prometheus timestamp.
+	Timestamp int64 `protobuf:"varint,2,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+}
+
+func (x *Sample) Reset() {
+	*x = Sample{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Sample) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Sample) ProtoMessage() {}
+
+func (x *Sample) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Sample.ProtoReflect.Descriptor instead.
+func (*Sample) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *Sample) GetValue() float64 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+func (x *Sample) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+type Exemplar struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Optional, can be empty.
+	Labels []*Label `protobuf:"bytes,1,rep,name=labels,proto3" json:"labels,omitempty"`
+	Value  float64  `protobuf:"fixed64,2,opt,name=value,proto3" json:"value,omitempty"`
+	// timestamp is in ms format, see model/timestamp/timestamp.go for
+	// conversion from time.Time to Prometheus timestamp.
+	Timestamp int64 `protobuf:"varint,3,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+}
+
+func (x *Exemplar) Reset() {
+	*x = Exemplar{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Exemplar) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Exemplar) ProtoMessage() {}
+
+func (x *Exemplar) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Exemplar.ProtoReflect.Descriptor instead.
+func (*Exemplar) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *Exemplar) GetLabels() []*Label {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *Exemplar) GetValue() float64 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+func (x *Exemplar) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+// A native histogram, also known as a sparse histogram.
+// Original design doc:
+// https://docs.google.com/document/d/1cLNv3aufPZb3fNfaJgdaRBZsInZKKIHo9E6HinJVbpM/edit
+// The appendix of this design doc also explains the concept of float
+// histograms. This Histogram message can represent both, the usual
+// integer histogram as well as a float histogram.
+type Histogram struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Count:
+	//	*Histogram_CountInt
+	//	*Histogram_CountFloat
+	Count isHistogram_Count `protobuf_oneof:"count"`
+	Sum   float64           `protobuf:"fixed64,3,opt,name=sum,proto3" json:"sum,omitempty"` // Sum of observations in the histogram.
+	// The schema defines the bucket schema. Currently, valid numbers
+	// are -4 <= n <= 8. They are all for base-2 bucket schemas, where 1
+	// is a bucket boundary in each case, and then each power of two is
+	// divided into 2^n logarithmic buckets. Or in other words, each
+	// bucket boundary is the previous boundary times 2^(2^-n). In the
+	// future, more bucket schemas may be added using numbers < -4 or >
+	// 8.
+	Schema        int32   `protobuf:"zigzag32,4,opt,name=schema,proto3" json:"schema,omitempty"`
+	ZeroThreshold float64 `protobuf:"fixed64,5,opt,name=zero_threshold,json=zeroThreshold,proto3" json:"zero_threshold,omitempty"` // Breadth of the zero bucket.
+	// Types that are assignable to ZeroCount:
+	//	*Histogram_ZeroCountInt
+	//	*Histogram_ZeroCountFloat
+	ZeroCount isHistogram_ZeroCount `protobuf_oneof:"zero_count"`
+	// Negative Buckets.
+	NegativeSpans []*BucketSpan `protobuf:"bytes,8,rep,name=negative_spans,json=negativeSpans,proto3" json:"negative_spans,omitempty"`
+	// Use either "negative_deltas" or "negative_counts", the former for
+	// regular histograms with integer counts, the latter for float
+	// histograms.
+	NegativeDeltas []int64   `protobuf:"zigzag64,9,rep,packed,name=negative_deltas,json=negativeDeltas,proto3" json:"negative_deltas,omitempty"` // Count delta of each bucket compared to previous one (or to zero for 1st bucket).
+	NegativeCounts []float64 `protobuf:"fixed64,10,rep,packed,name=negative_counts,json=negativeCounts,proto3" json:"negative_counts,omitempty"` // Absolute count of each bucket.
+	// Positive Buckets.
+	PositiveSpans []*BucketSpan `protobuf:"bytes,11,rep,name=positive_spans,json=positiveSpans,proto3" json:"positive_spans,omitempty"`
+	// Use either "positive_deltas" or "positive_counts", the former for
+	// regular histograms with integer counts, the latter for float
+	// histograms.
+	PositiveDeltas []int64             `protobuf:"zigzag64,12,rep,packed,name=positive_deltas,json=positiveDeltas,proto3" json:"positive_deltas,omitempty"` // Count delta of each bucket compared to previous one (or to zero for 1st bucket).
+	PositiveCounts []float64           `protobuf:"fixed64,13,rep,packed,name=positive_counts,json=positiveCounts,proto3" json:"positive_counts,omitempty"`  // Absolute count of each bucket.
+	ResetHint      Histogram_ResetHint `protobuf:"varint,14,opt,name=reset_hint,json=resetHint,proto3,enum=prometheus.Histogram_ResetHint" json:"reset_hint,omitempty"`
+	// timestamp is in ms format, see model/timestamp/timestamp.go for
+	// conversion from time.Time to Prometheus timestamp.
+	Timestamp int64 `protobuf:"varint,15,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+}
+
+func (x *Histogram) Reset() {
+	*x = Histogram{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Histogram) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Histogram) ProtoMessage() {}
+
+func (x *Histogram) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Histogram.ProtoReflect.Descriptor instead.
+func (*Histogram) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{3}
+}
+
+func (m *Histogram) GetCount() isHistogram_Count {
+	if m != nil {
+		return m.Count
+	}
+	return nil
+}
+
+func (x *Histogram) GetCountInt() uint64 {
+	if x, ok := x.GetCount().(*Histogram_CountInt); ok {
+		return x.CountInt
+	}
+	return 0
+}
+
+func (x *Histogram) GetCountFloat() float64 {
+	if x, ok := x.GetCount().(*Histogram_CountFloat); ok {
+		return x.CountFloat
+	}
+	return 0
+}
+
+func (x *Histogram) GetSum() float64 {
+	if x != nil {
+		return x.Sum
+	}
+	return 0
+}
+
+func (x *Histogram) GetSchema() int32 {
+	if x != nil {
+		return x.Schema
+	}
+	return 0
+}
+
+func (x *Histogram) GetZeroThreshold() float64 {
+	if x != nil {
+		return x.ZeroThreshold
+	}
+	return 0
+}
+
+func (m *Histogram) GetZeroCount() isHistogram_ZeroCount {
+	if m != nil {
+		return m.ZeroCount
+	}
+	return nil
+}
+
+func (x *Histogram) GetZeroCountInt() uint64 {
+	if x, ok := x.GetZeroCount().(*Histogram_ZeroCountInt); ok {
+		return x.ZeroCountInt
+	}
+	return 0
+}
+
+func (x *Histogram) GetZeroCountFloat() float64 {
+	if x, ok := x.GetZeroCount().(*Histogram_ZeroCountFloat); ok {
+		return x.ZeroCountFloat
+	}
+	return 0
+}
+
+func (x *Histogram) GetNegativeSpans() []*BucketSpan {
+	if x != nil {
+		return x.NegativeSpans
+	}
+	return nil
+}
+
+func (x *Histogram) GetNegativeDeltas() []int64 {
+	if x != nil {
+		return x.NegativeDeltas
+	}
+	return nil
+}
+
+func (x *Histogram) GetNegativeCounts() []float64 {
+	if x != nil {
+		return x.NegativeCounts
+	}
+	return nil
+}
+
+func (x *Histogram) GetPositiveSpans() []*BucketSpan {
+	if x != nil {
+		return x.PositiveSpans
+	}
+	return nil
+}
+
+func (x *Histogram) GetPositiveDeltas() []int64 {
+	if x != nil {
+		return x.PositiveDeltas
+	}
+	return nil
+}
+
+func (x *Histogram) GetPositiveCounts() []float64 {
+	if x != nil {
+		return x.PositiveCounts
+	}
+	return nil
+}
+
+func (x *Histogram) GetResetHint() Histogram_ResetHint {
+	if x != nil {
+		return x.ResetHint
+	}
+	return Histogram_UNKNOWN
+}
+
+func (x *Histogram) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+type isHistogram_Count interface {
+	isHistogram_Count()
+}
+
+type Histogram_CountInt struct {
+	CountInt uint64 `protobuf:"varint,1,opt,name=count_int,json=countInt,proto3,oneof"`
+}
+
+type Histogram_CountFloat struct {
+	CountFloat float64 `protobuf:"fixed64,2,opt,name=count_float,json=countFloat,proto3,oneof"`
+}
+
+func (*Histogram_CountInt) isHistogram_Count() {}
+
+func (*Histogram_CountFloat) isHistogram_Count() {}
+
+type isHistogram_ZeroCount interface {
+	isHistogram_ZeroCount()
+}
+
+type Histogram_ZeroCountInt struct {
+	ZeroCountInt uint64 `protobuf:"varint,6,opt,name=zero_count_int,json=zeroCountInt,proto3,oneof"`
+}
+
+type Histogram_ZeroCountFloat struct {
+	ZeroCountFloat float64 `protobuf:"fixed64,7,opt,name=zero_count_float,json=zeroCountFloat,proto3,oneof"`
+}
+
+func (*Histogram_ZeroCountInt) isHistogram_ZeroCount() {}
+
+func (*Histogram_ZeroCountFloat) isHistogram_ZeroCount() {}
+
+// A BucketSpan defines a number of consecutive buckets with their
+// offset. Logically, it would be more straightforward to include the
+// bucket counts in the Span. However, the protobuf representation is
+// more compact in the way the data is structured here (with all the
+// buckets in a single array separate from the Spans).
+type BucketSpan struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Offset int32  `protobuf:"zigzag32,1,opt,name=offset,proto3" json:"offset,omitempty"` // Gap to previous span, or starting point for 1st span (which can be negative).
+	Length uint32 `protobuf:"varint,2,opt,name=length,proto3" json:"length,omitempty"`   // Length of consecutive buckets.
+}
+
+func (x *BucketSpan) Reset() {
+	*x = BucketSpan{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BucketSpan) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BucketSpan) ProtoMessage() {}
+
+func (x *BucketSpan) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BucketSpan.ProtoReflect.Descriptor instead.
+func (*BucketSpan) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *BucketSpan) GetOffset() int32 {
+	if x != nil {
+		return x.Offset
+	}
+	return 0
+}
+
+func (x *BucketSpan) GetLength() uint32 {
+	if x != nil {
+		return x.Length
+	}
+	return 0
+}
+
+// TimeSeries represents samples and labels for a single time series.
+type TimeSeries struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// For a timeseries to be valid, and for the samples and exemplars
+	// to be ingested by the remote system properly, the labels field is required.
+	Labels     []*Label     `protobuf:"bytes,1,rep,name=labels,proto3" json:"labels,omitempty"`
+	Samples    []*Sample    `protobuf:"bytes,2,rep,name=samples,proto3" json:"samples,omitempty"`
+	Exemplars  []*Exemplar  `protobuf:"bytes,3,rep,name=exemplars,proto3" json:"exemplars,omitempty"`
+	Histograms []*Histogram `protobuf:"bytes,4,rep,name=histograms,proto3" json:"histograms,omitempty"`
+}
+
+func (x *TimeSeries) Reset() {
+	*x = TimeSeries{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *TimeSeries) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*TimeSeries) ProtoMessage() {}
+
+func (x *TimeSeries) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use TimeSeries.ProtoReflect.Descriptor instead.
+func (*TimeSeries) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *TimeSeries) GetLabels() []*Label {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *TimeSeries) GetSamples() []*Sample {
+	if x != nil {
+		return x.Samples
+	}
+	return nil
+}
+
+func (x *TimeSeries) GetExemplars() []*Exemplar {
+	if x != nil {
+		return x.Exemplars
+	}
+	return nil
+}
+
+func (x *TimeSeries) GetHistograms() []*Histogram {
+	if x != nil {
+		return x.Histograms
+	}
+	return nil
+}
+
+type Label struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name  string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Value string `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *Label) Reset() {
+	*x = Label{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Label) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Label) ProtoMessage() {}
+
+func (x *Label) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Label.ProtoReflect.Descriptor instead.
+func (*Label) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *Label) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Label) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+type Labels struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Labels []*Label `protobuf:"bytes,1,rep,name=labels,proto3" json:"labels,omitempty"`
+}
+
+func (x *Labels) Reset() {
+	*x = Labels{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Labels) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Labels) ProtoMessage() {}
+
+func (x *Labels) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Labels.ProtoReflect.Descriptor instead.
+func (*Labels) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *Labels) GetLabels() []*Label {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+// Matcher specifies a rule, which can match or set of labels or not.
+type LabelMatcher struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Type  LabelMatcher_Type `protobuf:"varint,1,opt,name=type,proto3,enum=prometheus.LabelMatcher_Type" json:"type,omitempty"`
+	Name  string            `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Value string            `protobuf:"bytes,3,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *LabelMatcher) Reset() {
+	*x = LabelMatcher{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LabelMatcher) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LabelMatcher) ProtoMessage() {}
+
+func (x *LabelMatcher) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LabelMatcher.ProtoReflect.Descriptor instead.
+func (*LabelMatcher) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *LabelMatcher) GetType() LabelMatcher_Type {
+	if x != nil {
+		return x.Type
+	}
+	return LabelMatcher_EQ
+}
+
+func (x *LabelMatcher) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *LabelMatcher) GetValue() string {
+	if x != nil {
+		return x.Value
+	}
+	return ""
+}
+
+type ReadHints struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	StepMs   int64    `protobuf:"varint,1,opt,name=step_ms,json=stepMs,proto3" json:"step_ms,omitempty"`    // Query step size in milliseconds.
+	Func     string   `protobuf:"bytes,2,opt,name=func,proto3" json:"func,omitempty"`                       // String representation of surrounding function or aggregation.
+	StartMs  int64    `protobuf:"varint,3,opt,name=start_ms,json=startMs,proto3" json:"start_ms,omitempty"` // Start time in milliseconds.
+	EndMs    int64    `protobuf:"varint,4,opt,name=end_ms,json=endMs,proto3" json:"end_ms,omitempty"`       // End time in milliseconds.
+	Grouping []string `protobuf:"bytes,5,rep,name=grouping,proto3" json:"grouping,omitempty"`               // List of label names used in aggregation.
+	By       bool     `protobuf:"varint,6,opt,name=by,proto3" json:"by,omitempty"`                          // Indicate whether it is without or by.
+	RangeMs  int64    `protobuf:"varint,7,opt,name=range_ms,json=rangeMs,proto3" json:"range_ms,omitempty"` // Range vector selector range in milliseconds.
+}
+
+func (x *ReadHints) Reset() {
+	*x = ReadHints{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ReadHints) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ReadHints) ProtoMessage() {}
+
+func (x *ReadHints) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ReadHints.ProtoReflect.Descriptor instead.
+func (*ReadHints) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *ReadHints) GetStepMs() int64 {
+	if x != nil {
+		return x.StepMs
+	}
+	return 0
+}
+
+func (x *ReadHints) GetFunc() string {
+	if x != nil {
+		return x.Func
+	}
+	return ""
+}
+
+func (x *ReadHints) GetStartMs() int64 {
+	if x != nil {
+		return x.StartMs
+	}
+	return 0
+}
+
+func (x *ReadHints) GetEndMs() int64 {
+	if x != nil {
+		return x.EndMs
+	}
+	return 0
+}
+
+func (x *ReadHints) GetGrouping() []string {
+	if x != nil {
+		return x.Grouping
+	}
+	return nil
+}
+
+func (x *ReadHints) GetBy() bool {
+	if x != nil {
+		return x.By
+	}
+	return false
+}
+
+func (x *ReadHints) GetRangeMs() int64 {
+	if x != nil {
+		return x.RangeMs
+	}
+	return 0
+}
+
+// Chunk represents a TSDB chunk.
+// Time range [min, max] is inclusive.
+type Chunk struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MinTimeMs int64          `protobuf:"varint,1,opt,name=min_time_ms,json=minTimeMs,proto3" json:"min_time_ms,omitempty"`
+	MaxTimeMs int64          `protobuf:"varint,2,opt,name=max_time_ms,json=maxTimeMs,proto3" json:"max_time_ms,omitempty"`
+	Type      Chunk_Encoding `protobuf:"varint,3,opt,name=type,proto3,enum=prometheus.Chunk_Encoding" json:"type,omitempty"`
+	Data      []byte         `protobuf:"bytes,4,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *Chunk) Reset() {
+	*x = Chunk{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Chunk) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Chunk) ProtoMessage() {}
+
+func (x *Chunk) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Chunk.ProtoReflect.Descriptor instead.
+func (*Chunk) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *Chunk) GetMinTimeMs() int64 {
+	if x != nil {
+		return x.MinTimeMs
+	}
+	return 0
+}
+
+func (x *Chunk) GetMaxTimeMs() int64 {
+	if x != nil {
+		return x.MaxTimeMs
+	}
+	return 0
+}
+
+func (x *Chunk) GetType() Chunk_Encoding {
+	if x != nil {
+		return x.Type
+	}
+	return Chunk_UNKNOWN
+}
+
+func (x *Chunk) GetData() []byte {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+// ChunkedSeries represents single, encoded time series.
+type ChunkedSeries struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Labels should be sorted.
+	Labels []*Label `protobuf:"bytes,1,rep,name=labels,proto3" json:"labels,omitempty"`
+	// Chunks will be in start time order and may overlap.
+	Chunks []*Chunk `protobuf:"bytes,2,rep,name=chunks,proto3" json:"chunks,omitempty"`
+}
+
+func (x *ChunkedSeries) Reset() {
+	*x = ChunkedSeries{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ChunkedSeries) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ChunkedSeries) ProtoMessage() {}
+
+func (x *ChunkedSeries) ProtoReflect() protoreflect.Message {
+	mi := &file_types_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ChunkedSeries.ProtoReflect.Descriptor instead.
+func (*ChunkedSeries) Descriptor() ([]byte, []int) {
+	return file_types_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *ChunkedSeries) GetLabels() []*Label {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *ChunkedSeries) GetChunks() []*Chunk {
+	if x != nil {
+		return x.Chunks
+	}
+	return nil
+}
+
+var File_types_proto protoreflect.FileDescriptor
+
+var file_types_proto_rawDesc = []byte{
+	0x0a, 0x0b, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x0a, 0x70,
+	0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x22, 0x9c, 0x02, 0x0a, 0x0e, 0x4d, 0x65,
+	0x74, 0x72, 0x69, 0x63, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x39, 0x0a, 0x04,
+	0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x25, 0x2e, 0x70, 0x72, 0x6f,
+	0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x2e, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x54, 0x79, 0x70,
+	0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12, 0x2c, 0x0a, 0x12, 0x6d, 0x65, 0x74, 0x72, 0x69,
+	0x63, 0x5f, 0x66, 0x61, 0x6d, 0x69, 0x6c, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x10, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x46, 0x61, 0x6d, 0x69, 0x6c,
+	0x79, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x65, 0x6c, 0x70, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x68, 0x65, 0x6c, 0x70, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x6e, 0x69,
+	0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x75, 0x6e, 0x69, 0x74, 0x22, 0x79, 0x0a,
+	0x0a, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x55,
+	0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07, 0x43, 0x4f, 0x55, 0x4e,
+	0x54, 0x45, 0x52, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x47, 0x41, 0x55, 0x47, 0x45, 0x10, 0x02,
+	0x12, 0x0d, 0x0a, 0x09, 0x48, 0x49, 0x53, 0x54, 0x4f, 0x47, 0x52, 0x41, 0x4d, 0x10, 0x03, 0x12,
+	0x12, 0x0a, 0x0e, 0x47, 0x41, 0x55, 0x47, 0x45, 0x48, 0x49, 0x53, 0x54, 0x4f, 0x47, 0x52, 0x41,
+	0x4d, 0x10, 0x04, 0x12, 0x0b, 0x0a, 0x07, 0x53, 0x55, 0x4d, 0x4d, 0x41, 0x52, 0x59, 0x10, 0x05,
+	0x12, 0x08, 0x0a, 0x04, 0x49, 0x4e, 0x46, 0x4f, 0x10, 0x06, 0x12, 0x0c, 0x0a, 0x08, 0x53, 0x54,
+	0x41, 0x54, 0x45, 0x53, 0x45, 0x54, 0x10, 0x07, 0x22, 0x3c, 0x0a, 0x06, 0x53, 0x61, 0x6d, 0x70,
+	0x6c, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x01, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x74, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x22, 0x69, 0x0a, 0x08, 0x45, 0x78, 0x65, 0x6d, 0x70, 0x6c,
+	0x61, 0x72, 0x12, 0x29, 0x0a, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e,
+	0x4c, 0x61, 0x62, 0x65, 0x6c, 0x52, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x12, 0x14, 0x0a,
+	0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x01, 0x52, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d,
+	0x70, 0x22, 0xbf, 0x05, 0x0a, 0x09, 0x48, 0x69, 0x73, 0x74, 0x6f, 0x67, 0x72, 0x61, 0x6d, 0x12,
+	0x1d, 0x0a, 0x09, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x69, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x04, 0x48, 0x00, 0x52, 0x08, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x6e, 0x74, 0x12, 0x21,
+	0x0a, 0x0b, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x66, 0x6c, 0x6f, 0x61, 0x74, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x01, 0x48, 0x00, 0x52, 0x0a, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x46, 0x6c, 0x6f, 0x61,
+	0x74, 0x12, 0x10, 0x0a, 0x03, 0x73, 0x75, 0x6d, 0x18, 0x03, 0x20, 0x01, 0x28, 0x01, 0x52, 0x03,
+	0x73, 0x75, 0x6d, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x11, 0x52, 0x06, 0x73, 0x63, 0x68, 0x65, 0x6d, 0x61, 0x12, 0x25, 0x0a, 0x0e, 0x7a,
+	0x65, 0x72, 0x6f, 0x5f, 0x74, 0x68, 0x72, 0x65, 0x73, 0x68, 0x6f, 0x6c, 0x64, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x01, 0x52, 0x0d, 0x7a, 0x65, 0x72, 0x6f, 0x54, 0x68, 0x72, 0x65, 0x73, 0x68, 0x6f,
+	0x6c, 0x64, 0x12, 0x26, 0x0a, 0x0e, 0x7a, 0x65, 0x72, 0x6f, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74,
+	0x5f, 0x69, 0x6e, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x04, 0x48, 0x01, 0x52, 0x0c, 0x7a, 0x65,
+	0x72, 0x6f, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x49, 0x6e, 0x74, 0x12, 0x2a, 0x0a, 0x10, 0x7a, 0x65,
+	0x72, 0x6f, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74, 0x5f, 0x66, 0x6c, 0x6f, 0x61, 0x74, 0x18, 0x07,
+	0x20, 0x01, 0x28, 0x01, 0x48, 0x01, 0x52, 0x0e, 0x7a, 0x65, 0x72, 0x6f, 0x43, 0x6f, 0x75, 0x6e,
+	0x74, 0x46, 0x6c, 0x6f, 0x61, 0x74, 0x12, 0x3d, 0x0a, 0x0e, 0x6e, 0x65, 0x67, 0x61, 0x74, 0x69,
+	0x76, 0x65, 0x5f, 0x73, 0x70, 0x61, 0x6e, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16,
+	0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x42, 0x75, 0x63, 0x6b,
+	0x65, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x52, 0x0d, 0x6e, 0x65, 0x67, 0x61, 0x74, 0x69, 0x76, 0x65,
+	0x53, 0x70, 0x61, 0x6e, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x6e, 0x65, 0x67, 0x61, 0x74, 0x69, 0x76,
+	0x65, 0x5f, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x73, 0x18, 0x09, 0x20, 0x03, 0x28, 0x12, 0x52, 0x0e,
+	0x6e, 0x65, 0x67, 0x61, 0x74, 0x69, 0x76, 0x65, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x73, 0x12, 0x27,
+	0x0a, 0x0f, 0x6e, 0x65, 0x67, 0x61, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x63, 0x6f, 0x75, 0x6e, 0x74,
+	0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x01, 0x52, 0x0e, 0x6e, 0x65, 0x67, 0x61, 0x74, 0x69, 0x76,
+	0x65, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x12, 0x3d, 0x0a, 0x0e, 0x70, 0x6f, 0x73, 0x69, 0x74,
+	0x69, 0x76, 0x65, 0x5f, 0x73, 0x70, 0x61, 0x6e, 0x73, 0x18, 0x0b, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x16, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x42, 0x75, 0x63,
+	0x6b, 0x65, 0x74, 0x53, 0x70, 0x61, 0x6e, 0x52, 0x0d, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76,
+	0x65, 0x53, 0x70, 0x61, 0x6e, 0x73, 0x12, 0x27, 0x0a, 0x0f, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x69,
+	0x76, 0x65, 0x5f, 0x64, 0x65, 0x6c, 0x74, 0x61, 0x73, 0x18, 0x0c, 0x20, 0x03, 0x28, 0x12, 0x52,
+	0x0e, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x44, 0x65, 0x6c, 0x74, 0x61, 0x73, 0x12,
+	0x27, 0x0a, 0x0f, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x63, 0x6f, 0x75, 0x6e,
+	0x74, 0x73, 0x18, 0x0d, 0x20, 0x03, 0x28, 0x01, 0x52, 0x0e, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x69,
+	0x76, 0x65, 0x43, 0x6f, 0x75, 0x6e, 0x74, 0x73, 0x12, 0x3e, 0x0a, 0x0a, 0x72, 0x65, 0x73, 0x65,
+	0x74, 0x5f, 0x68, 0x69, 0x6e, 0x74, 0x18, 0x0e, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1f, 0x2e, 0x70,
+	0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x48, 0x69, 0x73, 0x74, 0x6f, 0x67,
+	0x72, 0x61, 0x6d, 0x2e, 0x52, 0x65, 0x73, 0x65, 0x74, 0x48, 0x69, 0x6e, 0x74, 0x52, 0x09, 0x72,
+	0x65, 0x73, 0x65, 0x74, 0x48, 0x69, 0x6e, 0x74, 0x12, 0x1c, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x74, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x22, 0x34, 0x0a, 0x09, 0x52, 0x65, 0x73, 0x65, 0x74, 0x48,
+	0x69, 0x6e, 0x74, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00,
+	0x12, 0x07, 0x0a, 0x03, 0x59, 0x45, 0x53, 0x10, 0x01, 0x12, 0x06, 0x0a, 0x02, 0x4e, 0x4f, 0x10,
+	0x02, 0x12, 0x09, 0x0a, 0x05, 0x47, 0x41, 0x55, 0x47, 0x45, 0x10, 0x03, 0x42, 0x07, 0x0a, 0x05,
+	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x42, 0x0c, 0x0a, 0x0a, 0x7a, 0x65, 0x72, 0x6f, 0x5f, 0x63, 0x6f,
+	0x75, 0x6e, 0x74, 0x22, 0x3c, 0x0a, 0x0a, 0x42, 0x75, 0x63, 0x6b, 0x65, 0x74, 0x53, 0x70, 0x61,
+	0x6e, 0x12, 0x16, 0x0a, 0x06, 0x6f, 0x66, 0x66, 0x73, 0x65, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x11, 0x52, 0x06, 0x6f, 0x66, 0x66, 0x73, 0x65, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x6c, 0x65, 0x6e,
+	0x67, 0x74, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x06, 0x6c, 0x65, 0x6e, 0x67, 0x74,
+	0x68, 0x22, 0xd0, 0x01, 0x0a, 0x0a, 0x54, 0x69, 0x6d, 0x65, 0x53, 0x65, 0x72, 0x69, 0x65, 0x73,
+	0x12, 0x29, 0x0a, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x11, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x4c, 0x61,
+	0x62, 0x65, 0x6c, 0x52, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x12, 0x2c, 0x0a, 0x07, 0x73,
+	0x61, 0x6d, 0x70, 0x6c, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x70,
+	0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x53, 0x61, 0x6d, 0x70, 0x6c, 0x65,
+	0x52, 0x07, 0x73, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x73, 0x12, 0x32, 0x0a, 0x09, 0x65, 0x78, 0x65,
+	0x6d, 0x70, 0x6c, 0x61, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x70,
+	0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x45, 0x78, 0x65, 0x6d, 0x70, 0x6c,
+	0x61, 0x72, 0x52, 0x09, 0x65, 0x78, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x72, 0x73, 0x12, 0x35, 0x0a,
+	0x0a, 0x68, 0x69, 0x73, 0x74, 0x6f, 0x67, 0x72, 0x61, 0x6d, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x48,
+	0x69, 0x73, 0x74, 0x6f, 0x67, 0x72, 0x61, 0x6d, 0x52, 0x0a, 0x68, 0x69, 0x73, 0x74, 0x6f, 0x67,
+	0x72, 0x61, 0x6d, 0x73, 0x22, 0x31, 0x0a, 0x05, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x12, 0x12, 0x0a,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d,
+	0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x33, 0x0a, 0x06, 0x4c, 0x61, 0x62, 0x65, 0x6c,
+	0x73, 0x12, 0x29, 0x0a, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x11, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x4c,
+	0x61, 0x62, 0x65, 0x6c, 0x52, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x22, 0x95, 0x01, 0x0a,
+	0x0c, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x4d, 0x61, 0x74, 0x63, 0x68, 0x65, 0x72, 0x12, 0x31, 0x0a,
+	0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1d, 0x2e, 0x70, 0x72,
+	0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x4d, 0x61,
+	0x74, 0x63, 0x68, 0x65, 0x72, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65,
+	0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04,
+	0x6e, 0x61, 0x6d, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x28, 0x0a, 0x04, 0x54, 0x79,
+	0x70, 0x65, 0x12, 0x06, 0x0a, 0x02, 0x45, 0x51, 0x10, 0x00, 0x12, 0x07, 0x0a, 0x03, 0x4e, 0x45,
+	0x51, 0x10, 0x01, 0x12, 0x06, 0x0a, 0x02, 0x52, 0x45, 0x10, 0x02, 0x12, 0x07, 0x0a, 0x03, 0x4e,
+	0x52, 0x45, 0x10, 0x03, 0x22, 0xb1, 0x01, 0x0a, 0x09, 0x52, 0x65, 0x61, 0x64, 0x48, 0x69, 0x6e,
+	0x74, 0x73, 0x12, 0x17, 0x0a, 0x07, 0x73, 0x74, 0x65, 0x70, 0x5f, 0x6d, 0x73, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x03, 0x52, 0x06, 0x73, 0x74, 0x65, 0x70, 0x4d, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x66,
+	0x75, 0x6e, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x66, 0x75, 0x6e, 0x63, 0x12,
+	0x19, 0x0a, 0x08, 0x73, 0x74, 0x61, 0x72, 0x74, 0x5f, 0x6d, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28,
+	0x03, 0x52, 0x07, 0x73, 0x74, 0x61, 0x72, 0x74, 0x4d, 0x73, 0x12, 0x15, 0x0a, 0x06, 0x65, 0x6e,
+	0x64, 0x5f, 0x6d, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x05, 0x65, 0x6e, 0x64, 0x4d,
+	0x73, 0x12, 0x1a, 0x0a, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x69, 0x6e, 0x67, 0x18, 0x05, 0x20,
+	0x03, 0x28, 0x09, 0x52, 0x08, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x0e, 0x0a,
+	0x02, 0x62, 0x79, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x02, 0x62, 0x79, 0x12, 0x19, 0x0a,
+	0x08, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x5f, 0x6d, 0x73, 0x18, 0x07, 0x20, 0x01, 0x28, 0x03, 0x52,
+	0x07, 0x72, 0x61, 0x6e, 0x67, 0x65, 0x4d, 0x73, 0x22, 0xbc, 0x01, 0x0a, 0x05, 0x43, 0x68, 0x75,
+	0x6e, 0x6b, 0x12, 0x1e, 0x0a, 0x0b, 0x6d, 0x69, 0x6e, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x5f, 0x6d,
+	0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x6d, 0x69, 0x6e, 0x54, 0x69, 0x6d, 0x65,
+	0x4d, 0x73, 0x12, 0x1e, 0x0a, 0x0b, 0x6d, 0x61, 0x78, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x5f, 0x6d,
+	0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x03, 0x52, 0x09, 0x6d, 0x61, 0x78, 0x54, 0x69, 0x6d, 0x65,
+	0x4d, 0x73, 0x12, 0x2e, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0e,
+	0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x43, 0x68,
+	0x75, 0x6e, 0x6b, 0x2e, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x69, 0x6e, 0x67, 0x52, 0x04, 0x74, 0x79,
+	0x70, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x22, 0x2f, 0x0a, 0x08, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x69,
+	0x6e, 0x67, 0x12, 0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12,
+	0x07, 0x0a, 0x03, 0x58, 0x4f, 0x52, 0x10, 0x01, 0x12, 0x0d, 0x0a, 0x09, 0x48, 0x49, 0x53, 0x54,
+	0x4f, 0x47, 0x52, 0x41, 0x4d, 0x10, 0x02, 0x22, 0x65, 0x0a, 0x0d, 0x43, 0x68, 0x75, 0x6e, 0x6b,
+	0x65, 0x64, 0x53, 0x65, 0x72, 0x69, 0x65, 0x73, 0x12, 0x29, 0x0a, 0x06, 0x6c, 0x61, 0x62, 0x65,
+	0x6c, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65,
+	0x74, 0x68, 0x65, 0x75, 0x73, 0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x52, 0x06, 0x6c, 0x61, 0x62,
+	0x65, 0x6c, 0x73, 0x12, 0x29, 0x0a, 0x06, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x73, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73,
+	0x2e, 0x43, 0x68, 0x75, 0x6e, 0x6b, 0x52, 0x06, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x73, 0x42, 0x31,
+	0x5a, 0x2f, 0x65, 0x6e, 0x63, 0x6f, 0x72, 0x65, 0x2e, 0x64, 0x65, 0x76, 0x2f, 0x61, 0x70, 0x70,
+	0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2f, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x2f,
+	0x70, 0x72, 0x6f, 0x6d, 0x65, 0x74, 0x68, 0x65, 0x75, 0x73, 0x2f, 0x70, 0x72, 0x6f, 0x6d, 0x70,
+	0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_types_proto_rawDescOnce sync.Once
+	file_types_proto_rawDescData = file_types_proto_rawDesc
+)
+
+func file_types_proto_rawDescGZIP() []byte {
+	file_types_proto_rawDescOnce.Do(func() {
+		file_types_proto_rawDescData = protoimpl.X.CompressGZIP(file_types_proto_rawDescData)
+	})
+	return file_types_proto_rawDescData
+}
+
+var file_types_proto_enumTypes = make([]protoimpl.EnumInfo, 4)
+var file_types_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_types_proto_goTypes = []interface{}{
+	(MetricMetadata_MetricType)(0), // 0: prometheus.MetricMetadata.MetricType
+	(Histogram_ResetHint)(0),       // 1: prometheus.Histogram.ResetHint
+	(LabelMatcher_Type)(0),         // 2: prometheus.LabelMatcher.Type
+	(Chunk_Encoding)(0),            // 3: prometheus.Chunk.Encoding
+	(*MetricMetadata)(nil),         // 4: prometheus.MetricMetadata
+	(*Sample)(nil),                 // 5: prometheus.Sample
+	(*Exemplar)(nil),               // 6: prometheus.Exemplar
+	(*Histogram)(nil),              // 7: prometheus.Histogram
+	(*BucketSpan)(nil),             // 8: prometheus.BucketSpan
+	(*TimeSeries)(nil),             // 9: prometheus.TimeSeries
+	(*Label)(nil),                  // 10: prometheus.Label
+	(*Labels)(nil),                 // 11: prometheus.Labels
+	(*LabelMatcher)(nil),           // 12: prometheus.LabelMatcher
+	(*ReadHints)(nil),              // 13: prometheus.ReadHints
+	(*Chunk)(nil),                  // 14: prometheus.Chunk
+	(*ChunkedSeries)(nil),          // 15: prometheus.ChunkedSeries
+}
+var file_types_proto_depIdxs = []int32{
+	0,  // 0: prometheus.MetricMetadata.type:type_name -> prometheus.MetricMetadata.MetricType
+	10, // 1: prometheus.Exemplar.labels:type_name -> prometheus.Label
+	8,  // 2: prometheus.Histogram.negative_spans:type_name -> prometheus.BucketSpan
+	8,  // 3: prometheus.Histogram.positive_spans:type_name -> prometheus.BucketSpan
+	1,  // 4: prometheus.Histogram.reset_hint:type_name -> prometheus.Histogram.ResetHint
+	10, // 5: prometheus.TimeSeries.labels:type_name -> prometheus.Label
+	5,  // 6: prometheus.TimeSeries.samples:type_name -> prometheus.Sample
+	6,  // 7: prometheus.TimeSeries.exemplars:type_name -> prometheus.Exemplar
+	7,  // 8: prometheus.TimeSeries.histograms:type_name -> prometheus.Histogram
+	10, // 9: prometheus.Labels.labels:type_name -> prometheus.Label
+	2,  // 10: prometheus.LabelMatcher.type:type_name -> prometheus.LabelMatcher.Type
+	3,  // 11: prometheus.Chunk.type:type_name -> prometheus.Chunk.Encoding
+	10, // 12: prometheus.ChunkedSeries.labels:type_name -> prometheus.Label
+	14, // 13: prometheus.ChunkedSeries.chunks:type_name -> prometheus.Chunk
+	14, // [14:14] is the sub-list for method output_type
+	14, // [14:14] is the sub-list for method input_type
+	14, // [14:14] is the sub-list for extension type_name
+	14, // [14:14] is the sub-list for extension extendee
+	0,  // [0:14] is the sub-list for field type_name
+}
+
+func init() { file_types_proto_init() }
+func file_types_proto_init() {
+	if File_types_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_types_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MetricMetadata); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Sample); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Exemplar); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Histogram); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BucketSpan); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*TimeSeries); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Label); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Labels); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LabelMatcher); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ReadHints); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Chunk); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ChunkedSeries); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_types_proto_msgTypes[3].OneofWrappers = []interface{}{
+		(*Histogram_CountInt)(nil),
+		(*Histogram_CountFloat)(nil),
+		(*Histogram_ZeroCountInt)(nil),
+		(*Histogram_ZeroCountFloat)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_types_proto_rawDesc,
+			NumEnums:      4,
+			NumMessages:   12,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_types_proto_goTypes,
+		DependencyIndexes: file_types_proto_depIdxs,
+		EnumInfos:         file_types_proto_enumTypes,
+		MessageInfos:      file_types_proto_msgTypes,
+	}.Build()
+	File_types_proto = out.File
+	file_types_proto_rawDesc = nil
+	file_types_proto_goTypes = nil
+	file_types_proto_depIdxs = nil
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/types.proto b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/types.proto
new file mode 100644
index 0000000000..e85f0f9449
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/prometheus/prompb/types.proto
@@ -0,0 +1,184 @@
+// Copyright 2017 Prometheus Team
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+syntax = "proto3";
+package prometheus;
+
+option go_package = "encore.dev/appruntime/metrics/prometheus/prompb";
+
+message MetricMetadata {
+  enum MetricType {
+    UNKNOWN        = 0;
+    COUNTER        = 1;
+    GAUGE          = 2;
+    HISTOGRAM      = 3;
+    GAUGEHISTOGRAM = 4;
+    SUMMARY        = 5;
+    INFO           = 6;
+    STATESET       = 7;
+  }
+
+  // Represents the metric type, these match the set from Prometheus.
+  // Refer to model/textparse/interface.go for details.
+  MetricType type = 1;
+  string metric_family_name = 2;
+  string help = 4;
+  string unit = 5;
+}
+
+message Sample {
+  double value    = 1;
+  // timestamp is in ms format, see model/timestamp/timestamp.go for
+  // conversion from time.Time to Prometheus timestamp.
+  int64 timestamp = 2;
+}
+
+message Exemplar {
+  // Optional, can be empty.
+  repeated Label labels = 1;
+  double value = 2;
+  // timestamp is in ms format, see model/timestamp/timestamp.go for
+  // conversion from time.Time to Prometheus timestamp.
+  int64 timestamp = 3;
+}
+
+// A native histogram, also known as a sparse histogram.
+// Original design doc:
+// https://docs.google.com/document/d/1cLNv3aufPZb3fNfaJgdaRBZsInZKKIHo9E6HinJVbpM/edit
+// The appendix of this design doc also explains the concept of float
+// histograms. This Histogram message can represent both, the usual
+// integer histogram as well as a float histogram.
+message Histogram {
+  enum ResetHint {
+    UNKNOWN = 0; // Need to test for a counter reset explicitly.
+    YES     = 1; // This is the 1st histogram after a counter reset.
+    NO      = 2; // There was no counter reset between this and the previous Histogram.
+    GAUGE   = 3; // This is a gauge histogram where counter resets don't happen.
+  }
+
+  oneof count { // Count of observations in the histogram.
+    uint64 count_int   = 1;
+    double count_float = 2;
+  }
+  double sum = 3; // Sum of observations in the histogram.
+  // The schema defines the bucket schema. Currently, valid numbers
+  // are -4 <= n <= 8. They are all for base-2 bucket schemas, where 1
+  // is a bucket boundary in each case, and then each power of two is
+  // divided into 2^n logarithmic buckets. Or in other words, each
+  // bucket boundary is the previous boundary times 2^(2^-n). In the
+  // future, more bucket schemas may be added using numbers < -4 or >
+  // 8.
+  sint32 schema             = 4;
+  double zero_threshold     = 5; // Breadth of the zero bucket.
+  oneof zero_count { // Count in zero bucket.
+    uint64 zero_count_int     = 6;
+    double zero_count_float   = 7;
+  }
+  
+  // Negative Buckets.
+  repeated BucketSpan negative_spans =  8;
+  // Use either "negative_deltas" or "negative_counts", the former for
+  // regular histograms with integer counts, the latter for float
+  // histograms.
+  repeated sint64 negative_deltas    =  9; // Count delta of each bucket compared to previous one (or to zero for 1st bucket).
+  repeated double negative_counts    = 10; // Absolute count of each bucket.
+
+  // Positive Buckets.
+  repeated BucketSpan positive_spans = 11;
+  // Use either "positive_deltas" or "positive_counts", the former for
+  // regular histograms with integer counts, the latter for float
+  // histograms.
+  repeated sint64 positive_deltas    = 12; // Count delta of each bucket compared to previous one (or to zero for 1st bucket).
+  repeated double positive_counts    = 13; // Absolute count of each bucket.
+
+  ResetHint reset_hint               = 14;
+  // timestamp is in ms format, see model/timestamp/timestamp.go for
+  // conversion from time.Time to Prometheus timestamp.
+  int64 timestamp = 15;
+} 
+
+// A BucketSpan defines a number of consecutive buckets with their
+// offset. Logically, it would be more straightforward to include the
+// bucket counts in the Span. However, the protobuf representation is
+// more compact in the way the data is structured here (with all the
+// buckets in a single array separate from the Spans).
+message BucketSpan {
+  sint32 offset = 1; // Gap to previous span, or starting point for 1st span (which can be negative).
+  uint32 length = 2; // Length of consecutive buckets.
+}
+
+// TimeSeries represents samples and labels for a single time series.
+message TimeSeries {
+  // For a timeseries to be valid, and for the samples and exemplars
+  // to be ingested by the remote system properly, the labels field is required.
+  repeated Label labels         = 1;
+  repeated Sample samples       = 2;
+  repeated Exemplar exemplars   = 3;
+  repeated Histogram histograms = 4;
+}
+
+message Label {
+  string name  = 1;
+  string value = 2;
+}
+
+message Labels {
+  repeated Label labels = 1;
+}
+
+// Matcher specifies a rule, which can match or set of labels or not.
+message LabelMatcher {
+  enum Type {
+    EQ  = 0;
+    NEQ = 1;
+    RE  = 2;
+    NRE = 3;
+  }
+  Type type    = 1;
+  string name  = 2;
+  string value = 3;
+}
+
+message ReadHints {
+  int64 step_ms = 1;  // Query step size in milliseconds.
+  string func = 2;    // String representation of surrounding function or aggregation.
+  int64 start_ms = 3; // Start time in milliseconds.
+  int64 end_ms = 4;   // End time in milliseconds.
+  repeated string grouping = 5; // List of label names used in aggregation.
+  bool by = 6; // Indicate whether it is without or by.
+  int64 range_ms = 7; // Range vector selector range in milliseconds.
+}
+
+// Chunk represents a TSDB chunk.
+// Time range [min, max] is inclusive.
+message Chunk {
+  int64 min_time_ms = 1;
+  int64 max_time_ms = 2;
+
+  // We require this to match chunkenc.Encoding.
+  enum Encoding {
+    UNKNOWN   = 0;
+    XOR       = 1;
+    HISTOGRAM = 2;
+  }
+  Encoding type  = 3;
+  bytes data     = 4;
+}
+
+// ChunkedSeries represents single, encoded time series.
+message ChunkedSeries {
+  // Labels should be sorted.
+  repeated Label labels = 1;
+  // Chunks will be in start time order and may overlap.
+  repeated Chunk chunks = 2;
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/prometheus_exporter.go b/runtimes/go/appruntime/infrasdk/metrics/prometheus_exporter.go
new file mode 100644
index 0000000000..06dfc4fbe8
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/prometheus_exporter.go
@@ -0,0 +1,27 @@
+//go:build !encore_no_prometheus
+
+package metrics
+
+import (
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/infrasdk/metadata"
+	"encore.dev/appruntime/infrasdk/metrics/prometheus"
+)
+
+func init() {
+	registerProvider(providerDesc{
+		name: "prometheus",
+		matches: func(cfg *config.Metrics) bool {
+			return cfg.Prometheus != nil
+		},
+		newExporter: func(m *Manager) exporter {
+			containerMetadata, err := metadata.GetContainerMetadata(m.runtime)
+			if err != nil {
+				m.rootLogger.Err(err).Msg("unable to initialize metrics exporter: error getting container metadata")
+				return nil
+			}
+
+			return prometheus.New(m.static.BundledServices, m.runtime.Metrics.Prometheus, containerMetadata, m.rootLogger)
+		},
+	})
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/system/system.go b/runtimes/go/appruntime/infrasdk/metrics/system/system.go
new file mode 100644
index 0000000000..cc1a33df17
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/system/system.go
@@ -0,0 +1,50 @@
+package system
+
+import (
+	"runtime/metrics"
+
+	"github.com/rs/zerolog"
+)
+
+// These are the metrics exposed by Go we currently track. Once we update our
+// fork to Go 1.20, we should add:
+//
+// - /cpu/classes/gc/pause:cpu-seconds
+// - /cpu/classes/idle:cpu-seconds
+// - /cpu/classes/total:cpu-seconds
+// - /sync/mutex/wait/total:seconds
+const (
+	MetricNameHeapObjectsBytes = "e_sys_memory_heap_objects_bytes"
+	MetricNameGoroutines       = "e_sys_sched_goroutines"
+
+	goMetricHeapObjectsBytes = "/memory/classes/heap/objects:bytes"
+	goMetricGoroutines       = "/sched/goroutines:goroutines"
+)
+
+var encoreMetricNames = map[string]string{
+	goMetricHeapObjectsBytes: MetricNameHeapObjectsBytes,
+	goMetricGoroutines:       MetricNameGoroutines,
+}
+
+func ReadSysMetrics(logger zerolog.Logger) map[string]uint64 {
+	samples := []metrics.Sample{
+		{Name: goMetricHeapObjectsBytes},
+		{Name: goMetricGoroutines},
+	}
+	metrics.Read(samples)
+
+	output := make(map[string]uint64, len(samples))
+	for _, sample := range samples {
+		switch sample.Value.Kind() {
+		case metrics.KindUint64:
+			output[encoreMetricNames[sample.Name]] = sample.Value.Uint64()
+		case metrics.KindBad:
+			// This means the metric is unsupported. It's expected to happen very rarely
+			// possibly due to a large change in a particular Go implementation.
+			logger.Warn().Str("metric", sample.Name).Msg("metric no longer supported")
+		default:
+			logger.Warn().Str("metric", sample.Name).Msg("unexpected metric kind")
+		}
+	}
+	return output
+}
diff --git a/runtimes/go/appruntime/infrasdk/metrics/zzz_singleton_internal.go b/runtimes/go/appruntime/infrasdk/metrics/zzz_singleton_internal.go
new file mode 100644
index 0000000000..511c725de6
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/metrics/zzz_singleton_internal.go
@@ -0,0 +1,23 @@
+//go:build encore_app
+
+package metrics
+
+import (
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/logging"
+	"encore.dev/appruntime/shared/shutdown"
+	usermetrics "encore.dev/metrics"
+)
+
+// This file is named "zzz_singleton_internal.go" so that it is the last file
+// in the package, to ensure all other init functions are run before
+// we instantiate the manager.
+
+// publicapigen:drop
+var Singleton *Manager
+
+func init() {
+	Singleton = NewManager(usermetrics.Singleton, appconf.Static, appconf.Runtime, logging.RootLogger)
+	shutdown.Singleton.RegisterShutdownHandler(Singleton.Shutdown)
+	go Singleton.BeginCollection()
+}
diff --git a/runtimes/go/appruntime/infrasdk/secrets/manager_internal.go b/runtimes/go/appruntime/infrasdk/secrets/manager_internal.go
new file mode 100644
index 0000000000..9343d56629
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/secrets/manager_internal.go
@@ -0,0 +1,65 @@
+package secrets
+
+import (
+	"encoding/base64"
+	"fmt"
+	"log"
+	"maps"
+	"os"
+	"strings"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/cfgutil"
+)
+
+type Manager struct {
+	cfg     *config.Runtime
+	secrets map[string]string
+}
+
+func NewManager(cfg *config.Runtime, infraCfgEnv, appSecretsEnv string) *Manager {
+	secrets := parse(appSecretsEnv)
+	if infraCfgEnv != "" {
+		cfg, err := config.LoadInfraConfig(infraCfgEnv)
+		if err != nil {
+			log.Fatalln("encore: could not read infra config", err)
+		}
+		maps.Copy(secrets, cfg.Secrets.GetSecrets())
+	}
+	return &Manager{cfg: cfg, secrets: secrets}
+}
+
+// Load loads a secret.
+func (mgr *Manager) Load(key string, inService string) string {
+	if val, ok := mgr.secrets[key]; ok {
+		return val
+	}
+
+	// For anything but local development or a gateway, a missing secret is a fatal error.
+	if mgr.cfg.EnvCloud != "local" && cfgutil.IsHostedService(mgr.cfg, inService) {
+		fmt.Fprintln(os.Stderr, "encore: could not find secret", key)
+		os.Exit(2)
+	}
+
+	return ""
+}
+
+// parse parses secrets in "key1=base64(val1),key2=base64(val2)" format into a map.
+func parse(s string) map[string]string {
+	m := make(map[string]string)
+	if s == "" {
+		return m
+	}
+	for _, part := range strings.Split(s, ",") {
+		kv := strings.SplitN(part, "=", 2)
+		if len(kv) != 2 {
+			log.Fatalln("encore runtime: fatal error: invalid secret value")
+		}
+		val, err := base64.RawURLEncoding.DecodeString(kv[1])
+		if err != nil {
+			log.Fatalln("encore runtime: fatal error: invalid secret value")
+		}
+		m[kv[0]] = string(val)
+	}
+	return m
+}
diff --git a/runtimes/go/appruntime/infrasdk/secrets/secrets.go b/runtimes/go/appruntime/infrasdk/secrets/secrets.go
new file mode 100644
index 0000000000..0142792c78
--- /dev/null
+++ b/runtimes/go/appruntime/infrasdk/secrets/secrets.go
@@ -0,0 +1,18 @@
+//go:build encore_app
+
+package secrets
+
+import (
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/encoreenv"
+)
+
+var singleton = NewManager(
+	appconf.Runtime,
+	encoreenv.Get("ENCORE_INFRA_CONFIG_PATH"),
+	encoreenv.Get("ENCORE_APP_SECRETS"),
+)
+
+func Load(key string, inService string) string {
+	return singleton.Load(key, inService)
+}
diff --git a/runtimes/go/appruntime/shared/appconf/appconf.go b/runtimes/go/appruntime/shared/appconf/appconf.go
new file mode 100644
index 0000000000..6cb64a83f2
--- /dev/null
+++ b/runtimes/go/appruntime/shared/appconf/appconf.go
@@ -0,0 +1,35 @@
+//go:build encore_app
+
+package appconf
+
+import (
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/encoreenv"
+)
+
+// static is set using linker flags.
+var static string
+
+var (
+	// Static is embedded at compile time using overlays.
+	Static *config.Static
+
+	// Runtime is injected at runtime using environment variables.
+	Runtime *config.Runtime
+)
+
+func init() {
+	Static = config.ParseStatic(static)
+
+	// Set the embedded environment variables.
+	for k, v := range Static.EmbeddedEnvs {
+		encoreenv.Set(k, v)
+	}
+
+	Runtime = config.ParseRuntime(
+		encoreenv.Get("ENCORE_RUNTIME_CONFIG"),
+		encoreenv.Get("ENCORE_PROCESS_CONFIG"),
+		encoreenv.Get("ENCORE_INFRA_CONFIG_PATH"),
+		encoreenv.Get("ENCORE_DEPLOY_ID"),
+	)
+}
diff --git a/runtimes/go/appruntime/shared/cfgutil/svc.go b/runtimes/go/appruntime/shared/cfgutil/svc.go
new file mode 100644
index 0000000000..e36a006c06
--- /dev/null
+++ b/runtimes/go/appruntime/shared/cfgutil/svc.go
@@ -0,0 +1,32 @@
+package cfgutil
+
+import (
+	"encore.dev/appruntime/exported/config"
+)
+
+// IsHostedService returns true if the given service is hosted in this container
+// or false otherwise.
+//
+// If no service name is passed in, then this function returns true if any service
+// code is running in this container
+func IsHostedService(runtime *config.Runtime, serviceName string) bool {
+	// No runtime configured services or gateways means all services are running here
+	if len(runtime.HostedServices) == 0 && len(runtime.Gateways) == 0 {
+		return true
+	}
+
+	// If we're not hosting a gateway and no service name is passed in
+	// then we're checking if we're running any service code
+	if serviceName == "" && len(runtime.HostedServices) > 0 {
+		return true
+	}
+
+	// Otherwise check if we're hosting this
+	for _, service := range runtime.HostedServices {
+		if service == serviceName {
+			return true
+		}
+	}
+
+	return false
+}
diff --git a/runtimes/go/appruntime/shared/cloud/clouds.go b/runtimes/go/appruntime/shared/cloud/clouds.go
new file mode 100644
index 0000000000..795ce70102
--- /dev/null
+++ b/runtimes/go/appruntime/shared/cloud/clouds.go
@@ -0,0 +1,19 @@
+// Package cloud contains some helpers for referring to different cloud implementations
+package cloud
+
+// CloudProvider represents the cloud provider this application is running in.
+//
+// Additional cloud providers may be added in the future.
+type CloudProvider = string
+
+const (
+	AWS   CloudProvider = "aws"
+	GCP   CloudProvider = "gcp"
+	Azure CloudProvider = "azure"
+
+	// Encore is Encore's own cloud offering, and the default provider for new Environments.
+	Encore CloudProvider = "encore"
+
+	// Local is used when an application is running from the Encore CLI by using either 'encore run' or 'encore test'
+	Local CloudProvider = "local"
+)
diff --git a/runtimes/go/appruntime/shared/cloudtrace/extractors.go b/runtimes/go/appruntime/shared/cloudtrace/extractors.go
new file mode 100644
index 0000000000..9ad3e7d874
--- /dev/null
+++ b/runtimes/go/appruntime/shared/cloudtrace/extractors.go
@@ -0,0 +1,226 @@
+package cloudtrace
+
+import (
+	"encoding/binary"
+	"encoding/hex"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/model"
+)
+
+type TraceContext struct {
+	TraceID model.TraceID // The trace ID we are in (zero if not set yet)
+	SpanID  model.SpanID  // The span ID that represents this request (zero if not set by the cloud provider)
+}
+
+// parseB3Headers parses the B3 headers from the request and returns the trace context.
+func parseB3Headers(logger zerolog.Logger, r *http.Request) *TraceContext {
+	traceIDHex := r.Header.Get("X-B3-TraceId")
+	spanIDHex := r.Header.Get("X-B3-SpanId") // Note: ParentSpanId is used to denote the parent span ID in the B3 spec
+
+	if traceIDHex == "" || spanIDHex == "" {
+		return nil
+	}
+
+	// Extract
+	traceID, err := hex.DecodeString(traceIDHex)
+	if err != nil {
+		logger.Warn().Err(err).Str("header", traceIDHex).Msg("Failed to decode X-B3-TraceId header")
+		return nil
+	}
+	spanID, err := hex.DecodeString(spanIDHex)
+	if err != nil {
+		logger.Warn().Err(err).Str("header", spanIDHex).Msg("Failed to decode X-B3-SpanId header")
+		return nil
+	}
+
+	// Validate
+	if len(traceID) != 16 {
+		logger.Warn().Str("header", traceIDHex).Msg("X-B3-TraceId header was not 16 bytes")
+		return nil
+	}
+	if len(spanID) != 8 {
+		logger.Warn().Str("header", spanIDHex).Msg("X-B3-SpanId header was not 8 bytes")
+		return nil
+	}
+
+	// Return
+	var traceContext TraceContext
+	copy(traceContext.TraceID[:], traceID)
+	copy(traceContext.SpanID[:], spanID)
+	return &traceContext
+}
+
+// parseB3SingleHeader parses the B3 single header from the request and returns the trace context.
+func parseB3SingleHeader(logger zerolog.Logger, r *http.Request) *TraceContext {
+	b3Header := r.Header.Get("b3")
+	parts := strings.Split(b3Header, "-")
+	if len(parts) < 2 {
+		return nil
+	}
+
+	// Extract
+	traceID, err := hex.DecodeString(parts[0])
+	if err != nil {
+		logger.Warn().Err(err).Str("header", b3Header).Msg("Failed to decode b3 header, trace ID was not hex encoded")
+		return nil
+	}
+	spanID, err := hex.DecodeString(parts[1])
+	if err != nil {
+		logger.Warn().Err(err).Str("header", b3Header).Msg("Failed to decode b3 header, span ID was not hex encoded")
+		return nil
+	}
+
+	// Validate
+	if len(traceID) != 16 {
+		logger.Warn().Str("header", b3Header).Msg("Failed to decode b3 header, trace ID was not 16 bytes")
+		return nil
+	}
+	if len(spanID) != 8 {
+		logger.Warn().Str("header", b3Header).Msg("Failed to decode b3 header, span ID was not 8 bytes")
+		return nil
+	}
+
+	// Return
+	var traceContext TraceContext
+	copy(traceContext.TraceID[:], traceID)
+	copy(traceContext.SpanID[:], spanID)
+	return &traceContext
+}
+
+// parseGCloudTraceContext parses the Google Cloud Trace header from the request and returns the trace context.
+func parseGCloudTraceContext(logger zerolog.Logger, r *http.Request) *TraceContext {
+	traceHeader := r.Header.Get("X-Cloud-Trace-Context")
+	parts := strings.SplitN(traceHeader, "/", 2)
+	if len(parts) < 2 {
+		return nil
+	}
+
+	// Extract
+	traceIDHex := parts[0]
+	spanIDParts := strings.SplitN(parts[1], ";", 2)
+	spanIDDecStr := spanIDParts[0] // Split on semicolon to ignore optional fields (like ;o=1)
+
+	traceID, err := hex.DecodeString(traceIDHex)
+	if err != nil {
+		logger.Warn().Err(err).Str("header", traceHeader).Msg("Failed to decode X-Cloud-Trace-Context header, trace ID was not hex encoded")
+		return nil
+	}
+	spanIDDec, err := strconv.ParseUint(spanIDDecStr, 10, 64)
+	if err != nil {
+		logger.Warn().Err(err).Str("header", traceHeader).Msg("Failed to decode X-Cloud-Trace-Context header, span ID was not a decimal number")
+		return nil
+	}
+
+	// Validate
+	if len(traceID) != 16 {
+		logger.Warn().Str("header", traceHeader).Msg("Failed to decode X-Cloud-Trace-Context header, trace ID was not 16 bytes")
+		return nil
+	}
+
+	// Return
+	var traceContext TraceContext
+	copy(traceContext.TraceID[:], traceID)
+	binary.BigEndian.PutUint64(traceContext.SpanID[:], spanIDDec)
+	return &traceContext
+}
+
+// parseAWSXRayTraceContext returns the Trace ID
+func parseAWSXRayTraceContext(logger zerolog.Logger, r *http.Request) *TraceContext {
+	traceHeader := r.Header.Get("X-Amzn-Trace-Id")
+	parts := strings.Split(traceHeader, ";")
+	traceIDHex := ""
+
+	// Extract
+	for _, part := range parts {
+		keyValue := strings.Split(part, "=")
+		if len(keyValue) != 2 {
+			continue
+		}
+
+		switch keyValue[0] {
+		case "Root":
+			traceParts := strings.Split(keyValue[1], "-")
+			if len(traceParts) != 3 {
+				continue
+			}
+			traceIDHex = traceParts[2]
+		}
+	}
+
+	if traceIDHex == "" {
+		return nil
+	}
+
+	traceID, err := hex.DecodeString(traceIDHex)
+	if err != nil {
+		logger.Warn().Str("header", traceHeader).Msg("Failed to decode X-Amzn-Trace-Id header, trace ID was not hex")
+		return nil
+	}
+
+	// Validate
+	if len(traceID) != 16 {
+		logger.Warn().Str("header", traceHeader).Msg("Failed to decode X-Amzn-Trace-Id header, trace ID was not 16 bytes")
+		return nil
+	}
+
+	// Return
+	var traceContext TraceContext
+	copy(traceContext.TraceID[:], traceID)
+	// AWS does not generate a SpanID for us
+	return nil
+}
+
+// parseTraceParent returns the standardised trace parent header, which doesn't give us an ID for this span
+// but does given us a trace ID
+func parseTraceParent(logger zerolog.Logger, r *http.Request) *TraceContext {
+	traceHeader := r.Header.Get("traceparent")
+
+	// Extract
+	parts := strings.Split(traceHeader, "-")
+	if len(parts) < 3 {
+		return nil
+	}
+	traceID, err := hex.DecodeString(parts[1])
+	if err != nil {
+		logger.Warn().Str("header", traceHeader).Msg("Failed to decode traceparent header, trace ID was not hex")
+		return nil
+	}
+
+	// Validate
+	if len(traceID) != 16 {
+		logger.Warn().Str("header", traceHeader).Msg("Failed to decode traceparent header, trace ID was not 16 bytes")
+		return nil
+	}
+
+	// Return
+	var traceContext TraceContext
+	copy(traceContext.TraceID[:], traceID)
+	// traceparent doesn't tell give us a span ID for this request
+	return &traceContext
+}
+
+// ExtractCloudTraceIDs extracts the clouds expected Trace ID and Span ID for this request.
+//
+// This function will never return nil
+func ExtractCloudTraceIDs(logger zerolog.Logger, req *http.Request) *TraceContext {
+	extractors := []func(zerolog.Logger, *http.Request) *TraceContext{
+		// parseGCloudTraceContext, // GCP specific and gives us _our_ span ID
+		// parseAWSXRayTraceContext, // AWS specific and does not given us a span ID
+		parseB3Headers,      // Older standard which does give us a span ID, but is cloud agnostic
+		parseB3SingleHeader, // Different variant of the B3 standard, which gives us a cloud ID
+		parseTraceParent,    // We do this last, as ideally we want a span ID which the cloud already knows about for this request
+	}
+
+	for _, extractor := range extractors {
+		if traceContext := extractor(logger, req); traceContext != nil {
+			return traceContext
+		}
+	}
+
+	return &TraceContext{}
+}
diff --git a/runtimes/go/appruntime/shared/cloudtrace/gcp.go b/runtimes/go/appruntime/shared/cloudtrace/gcp.go
new file mode 100644
index 0000000000..10598f8a75
--- /dev/null
+++ b/runtimes/go/appruntime/shared/cloudtrace/gcp.go
@@ -0,0 +1,131 @@
+package cloudtrace
+
+import (
+	"encoding/json"
+	"io"
+	"net/http"
+	"os"
+	"sync"
+)
+
+// gcpProjectID is the GCP Project ID for this process.
+var (
+	gcpProjectID   = ""
+	gcpProjectLoad sync.Once
+)
+
+// GcpProjectID returns the GCP Project ID for this process.
+//
+// In order of precdecence:
+// 1. Look for GCP_PROJECT environment variable
+// 2. Look for GCLOUD_PROJECT environment variable
+// 3. Look for GOOGLE_CLOUD_PROJECT environment variable
+// 4. Check for GOOGLE_APPLICATION_CREDENTIALS JSON file
+// 5. GCE project ID from metadata server
+//
+// This code is derived from: https://github.com/googleapis/google-auth-library-nodejs/blob/070ec96b78dc26791bacb452ebef13d0a5ae6b18/src/auth/googleauth.ts#L245
+//
+// If it fails or panics, it will return an empty string and will not attempt to load again.
+func GcpProjectID() string {
+	gcpProjectLoad.Do(func() {
+		defer func() {
+			if r := recover(); r != nil {
+				gcpProjectID = ""
+			}
+		}()
+
+		gcpProjectID = gcpProjectIDFromEnv()
+
+		if gcpProjectID == "" {
+			gcpProjectID = gcpProjectIDFromCredsFile()
+		}
+
+		if gcpProjectID == "" {
+			gcpProjectID = gcpProjectIDFromMetadata()
+		}
+	})
+
+	return gcpProjectID
+}
+
+func gcpProjectIDFromEnv() string {
+	switch {
+	case os.Getenv("GCP_PROJECT") != "":
+		return os.Getenv("GCP_PROJECT")
+	case os.Getenv("GCLOUD_PROJECT") != "":
+		return os.Getenv("GCLOUD_PROJECT")
+	case os.Getenv("GOOGLE_CLOUD_PROJECT") != "":
+		return os.Getenv("GOOGLE_CLOUD_PROJECT")
+	case os.Getenv("gcp_project") != "":
+		return os.Getenv("gcp_project")
+	case os.Getenv("gcloud_project") != "":
+		return os.Getenv("gcloud_project")
+	case os.Getenv("google_cloud_project") != "":
+		return os.Getenv("google_cloud_project")
+	default:
+		return ""
+	}
+}
+
+func gcpProjectIDFromCredsFile() string {
+	creds := os.Getenv("GOOGLE_APPLICATION_CREDENTIALS")
+	if creds == "" {
+		creds = os.Getenv("google_application_credentials")
+	}
+	if creds == "" {
+		return ""
+	}
+
+	// Read the file
+	contents, err := os.ReadFile(creds)
+	if err != nil {
+		return ""
+	}
+
+	// Unmarshal the JSON
+	type Creds struct {
+		ProjectID      string `json:"project_id,omitempty"`
+		QuotaProjectID string `json:"quota_project_id,omitempty"`
+	}
+	var c Creds
+	if err := json.Unmarshal(contents, &c); err != nil {
+		return ""
+	}
+
+	// Return the ProjectID if set
+	switch {
+	case c.ProjectID != "":
+		return c.ProjectID
+	case c.QuotaProjectID != "":
+		return c.QuotaProjectID
+	}
+
+	return ""
+}
+
+func gcpProjectIDFromMetadata() string {
+	const url = "http://metadata.google.internal/computeMetadata/v1/project/project-id"
+	// nosemgrep
+	req, err := http.NewRequest("GET", url, nil)
+	if err != nil {
+		return ""
+	}
+	req.Header.Add("Metadata-Flavor", "Google")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return ""
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode != http.StatusOK {
+		return ""
+	}
+
+	projectIDBytes, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return ""
+	}
+
+	return string(projectIDBytes)
+}
diff --git a/runtimes/go/appruntime/shared/cloudtrace/logfields.go b/runtimes/go/appruntime/shared/cloudtrace/logfields.go
new file mode 100644
index 0000000000..0d7f70a0c8
--- /dev/null
+++ b/runtimes/go/appruntime/shared/cloudtrace/logfields.go
@@ -0,0 +1,44 @@
+package cloudtrace
+
+import (
+	"fmt"
+	"net/http"
+
+	"github.com/rs/zerolog/log"
+)
+
+// StructuredLogFields returns a map of structured log fields that should be
+// added to the log entry for the given request such that the cloud's native
+// tracing system can pick up the log entry and associate it with the trace.
+func StructuredLogFields(req *http.Request) map[string]string {
+	// No request, no fields
+	if req == nil {
+		return nil
+	}
+
+	additionalLogFields := make(map[string]string)
+
+	// On GCP if we add their trace context to a specific log field
+	// then it will automatically be picked up by Stackdriver and
+	// associated with the trace.
+	if gcpTraceContext := req.Header.Get("X-Cloud-Trace-Context"); gcpTraceContext != "" {
+		gcpProjectID := GcpProjectID()
+		if gcpProjectID != "" {
+			ctx := parseGCloudTraceContext(log.Logger, req)
+
+			// Add the trace and span fields to the log entry
+			if !ctx.TraceID.IsZero() {
+				additionalLogFields["logging.googleapis.com/trace"] = fmt.Sprintf("projects/%s/traces/%x", gcpProjectID, ctx.TraceID[:])
+
+				if !ctx.SpanID.IsZero() {
+					// Google specifies we should use hex encoding for the span ID on these logs so the Trace Explorer can pick them up.
+					// (even though the span ID is a uint64 when passed in the header & Google's own access logging using the integer version
+					// the UI expects a hex string)
+					additionalLogFields["logging.googleapis.com/spanId"] = fmt.Sprintf("%x", ctx.SpanID[:])
+				}
+			}
+		}
+	}
+
+	return additionalLogFields
+}
diff --git a/runtimes/go/appruntime/shared/encoreenv/app.go b/runtimes/go/appruntime/shared/encoreenv/app.go
new file mode 100644
index 0000000000..03d416a51f
--- /dev/null
+++ b/runtimes/go/appruntime/shared/encoreenv/app.go
@@ -0,0 +1,6 @@
+//go:build encore_app
+
+package encoreenv
+
+// isApp is true if the current build is an app build.
+const isApp = true
diff --git a/runtimes/go/appruntime/shared/encoreenv/encoreenv.go b/runtimes/go/appruntime/shared/encoreenv/encoreenv.go
new file mode 100644
index 0000000000..352e8ee661
--- /dev/null
+++ b/runtimes/go/appruntime/shared/encoreenv/encoreenv.go
@@ -0,0 +1,32 @@
+package encoreenv
+
+import (
+	"os"
+	"strings"
+)
+
+func Get(env string) string {
+	return envs[env]
+}
+
+func Set(env, val string) {
+	envs[env] = val
+}
+
+var envs map[string]string
+
+func init() {
+	envs = make(map[string]string)
+	for _, e := range os.Environ() {
+		if strings.HasPrefix(e, "ENCORE_") {
+			key, val, _ := strings.Cut(e, "=")
+			envs[key] = val
+
+			// Unset ENCORE_ environment variables if we're running
+			// inside the Encore application.
+			if isApp {
+				_ = os.Unsetenv(key)
+			}
+		}
+	}
+}
diff --git a/runtimes/go/appruntime/shared/encoreenv/noapp.go b/runtimes/go/appruntime/shared/encoreenv/noapp.go
new file mode 100644
index 0000000000..404b5e36a6
--- /dev/null
+++ b/runtimes/go/appruntime/shared/encoreenv/noapp.go
@@ -0,0 +1,6 @@
+//go:build !encore_app
+
+package encoreenv
+
+// isApp is true if the current build is an app build.
+const isApp = false
diff --git a/runtimes/go/appruntime/shared/etype/marshal.go b/runtimes/go/appruntime/shared/etype/marshal.go
new file mode 100644
index 0000000000..9a27d8046a
--- /dev/null
+++ b/runtimes/go/appruntime/shared/etype/marshal.go
@@ -0,0 +1,101 @@
+package etype
+
+import (
+	"encoding/base64"
+	stdjson "encoding/json"
+	"strconv"
+	"time"
+
+	"encore.dev/beta/auth"
+	"encore.dev/types/uuid"
+)
+
+type ElemMarshaller[T any] func(T) string
+
+func MarshalOne[T any](fn ElemMarshaller[T], data T) string {
+	return fn(data)
+}
+
+func MarshalList[T any](fn ElemMarshaller[T], data []T) []string {
+	result := make([]string, len(data))
+	for i, x := range data {
+		result[i] = fn(x)
+	}
+	return result
+}
+
+func MarshalInt16(s int16) (v string) {
+	return strconv.FormatInt(int64(s), 10)
+}
+
+func MarshalUint16(s uint16) (v string) {
+	return strconv.FormatUint(uint64(s), 10)
+}
+
+func MarshalFloat64(s float64) (v string) {
+	return strconv.FormatFloat(s, uint8(0x66), -1, 64)
+}
+
+func MarshalBytes(s []byte) (v string) {
+	return base64.URLEncoding.EncodeToString(s)
+}
+
+func MarshalUserID(s auth.UID) (v string) {
+	return string(s)
+}
+
+func MarshalUint32(s uint32) (v string) {
+	return strconv.FormatUint(uint64(s), 10)
+}
+
+func MarshalString(s string) (v string) {
+	return s
+}
+
+func MarshalUUID(s uuid.UUID) (v string) {
+	return s.String()
+}
+
+func MarshalJSON(s stdjson.RawMessage) (v string) {
+	return string(s)
+}
+
+func MarshalInt(s int) (v string) {
+	return strconv.FormatInt(int64(s), 10)
+}
+
+func MarshalUint(s uint) (v string) {
+	return strconv.FormatUint(uint64(s), 10)
+}
+
+func MarshalBool(s bool) (v string) {
+	return strconv.FormatBool(s)
+}
+
+func MarshalUint8(s uint8) (v string) {
+	return strconv.FormatUint(uint64(s), 10)
+}
+
+func MarshalUint64(s uint64) (v string) {
+	return strconv.FormatUint(s, 10)
+}
+
+func MarshalFloat32(s float32) (v string) {
+	return strconv.FormatFloat(float64(s), uint8(0x66), -1, 32)
+}
+
+func MarshalTime(s time.Time) (v string) {
+	return s.Format(time.RFC3339)
+}
+
+func MarshalInt8(s int8) (v string) {
+	return strconv.FormatInt(int64(s), 10)
+}
+
+func MarshalInt32(s int32) (v string) {
+	return strconv.FormatInt(int64(s), 10)
+}
+
+func MarshalInt64(s int64) (v string) {
+	return strconv.FormatInt(s, 10)
+}
diff --git a/runtimes/go/appruntime/shared/etype/unmarshal.go b/runtimes/go/appruntime/shared/etype/unmarshal.go
new file mode 100644
index 0000000000..77b94ad705
--- /dev/null
+++ b/runtimes/go/appruntime/shared/etype/unmarshal.go
@@ -0,0 +1,174 @@
+package etype
+
+import (
+	"encoding/base64"
+	stdjson "encoding/json"
+	"fmt"
+	"io"
+	"strconv"
+	"time"
+
+	jsoniter "github.com/json-iterator/go"
+
+	"encore.dev/beta/auth"
+	"encore.dev/types/uuid"
+)
+
+type ElemUnmarshaller[T any] func(s string) (T, error)
+
+func UnmarshalOne[T any](u *Unmarshaller, fn ElemUnmarshaller[T], field, data string, required bool) (val T) {
+	if !required && data == "" {
+		return val
+	}
+
+	u.NonEmptyValues++
+	val, err := fn(data)
+	if err != nil {
+		u.setErr("invalid parameter", field, err)
+	}
+	return val
+}
+
+func UnmarshalList[T any](u *Unmarshaller, fn ElemUnmarshaller[T], field string, data []string, required bool) []T {
+	if !required && len(data) == 0 {
+		return nil
+	}
+	u.NonEmptyValues++
+	var list []T
+	for _, x := range data {
+		val, err := fn(x)
+		if err != nil {
+			u.setErr("invalid parameter", field, err)
+			break
+		}
+		list = append(list, val)
+	}
+	return list
+}
+
+// IncNonEmpty increments the number of non-empty values this decoder has decoded.
+// It's useful when decoding something that doesn't go through the unmarshaller
+// but still was present, so that code that checks NonEmptyValues is correct.
+func (u *Unmarshaller) IncNonEmpty() {
+	u.NonEmptyValues++
+}
+
+// Unmarshaller is used to serialize request data into strings and deserialize response data from strings
+type Unmarshaller struct {
+	Error          error // The last error that occurred
+	NonEmptyValues int   // The number of values this decoder has decoded
+}
+
+func UnmarshalInt16(s string) (int16, error) {
+	x, err := strconv.ParseInt(s, 10, 16)
+	return int16(x), err
+}
+
+func UnmarshalUint16(s string) (uint16, error) {
+	x, err := strconv.ParseUint(s, 10, 16)
+	return uint16(x), err
+}
+
+func UnmarshalFloat64(s string) (v float64, err error) {
+	x, err := strconv.ParseFloat(s, 64)
+	return x, err
+}
+
+func UnmarshalBytes(s string) ([]byte, error) {
+	v, err := base64.URLEncoding.DecodeString(s)
+	return v, err
+}
+
+func UnmarshalUserID(s string) (auth.UID, error) {
+	return auth.UID(s), nil
+}
+
+func UnmarshalUint32(s string) (uint32, error) {
+	x, err := strconv.ParseUint(s, 10, 32)
+	return uint32(x), err
+}
+
+func UnmarshalString(s string) (string, error) {
+	return s, nil
+}
+
+func UnmarshalUUID(s string) (uuid.UUID, error) {
+	v, err := uuid.FromString(s)
+	return v, err
+}
+
+func UnmarshalJSON(s string) (stdjson.RawMessage, error) {
+	return stdjson.RawMessage(s), nil
+}
+
+func UnmarshalInt(s string) (int, error) {
+	x, err := strconv.ParseInt(s, 10, 64)
+	return int(x), err
+}
+
+func UnmarshalUint(s string) (uint, error) {
+	x, err := strconv.ParseUint(s, 10, 64)
+	return uint(x), err
+}
+
+func UnmarshalBool(s string) (bool, error) {
+	v, err := strconv.ParseBool(s)
+	return v, err
+}
+
+func UnmarshalUint8(s string) (uint8, error) {
+	x, err := strconv.ParseUint(s, 10, 8)
+	return uint8(x), err
+}
+
+func UnmarshalUint64(s string) (uint64, error) {
+	x, err := strconv.ParseUint(s, 10, 64)
+	return x, err
+}
+
+func UnmarshalFloat32(s string) (float32, error) {
+	x, err := strconv.ParseFloat(s, 32)
+	return float32(x), err
+}
+
+func UnmarshalTime(s string) (time.Time, error) {
+	v, err := time.Parse(time.RFC3339, s)
+	return v, err
+}
+
+func UnmarshalInt8(s string) (int8, error) {
+	x, err := strconv.ParseInt(s, 10, 8)
+	return int8(x), err
+}
+
+func UnmarshalInt32(s string) (int32, error) {
+	x, err := strconv.ParseInt(s, 10, 32)
+	return int32(x), err
+}
+
+func UnmarshalInt64(s string) (int64, error) {
+	x, err := strconv.ParseInt(s, 10, 64)
+	return x, err
+}
+
+// setErr sets the error within the object if one is not already set
+func (u *Unmarshaller) setErr(msg, field string, err error) {
+	if err != nil && u.Error == nil {
+		u.Error = fmt.Errorf("%s: %s: %w", field, msg, err)
+	}
+}
+
+func (u *Unmarshaller) ReadBody(body io.Reader) (payload []byte) {
+	payload, err := io.ReadAll(body)
+	if err == nil && len(payload) == 0 {
+		u.setErr("missing request body", "request_body", fmt.Errorf("missing request body"))
+	} else if err != nil {
+		u.setErr("could not parse request body", "request_body", err)
+	}
+	return payload
+}
+
+func (u *Unmarshaller) ParseJSON(field string, iter *jsoniter.Iterator, dst any) {
+	iter.ReadVal(dst)
+	u.setErr("invalid json parameter", field, iter.Error)
+}
diff --git a/runtimes/go/appruntime/shared/health/check.go b/runtimes/go/appruntime/shared/health/check.go
new file mode 100644
index 0000000000..f71547fcfb
--- /dev/null
+++ b/runtimes/go/appruntime/shared/health/check.go
@@ -0,0 +1,29 @@
+package health
+
+import (
+	"context"
+)
+
+// Check is an interface that can be implemented by any type that wants to be
+// registered as a health check.
+type Check interface {
+	// HealthCheck returns a slice of CheckResult structs, one for each check
+	// that was performed.
+	HealthCheck(ctx context.Context) []CheckResult
+}
+
+// CheckResult is a struct that contains the result of a health check.
+type CheckResult struct {
+	Name string // Name is the name of the check.
+	Err  error  // Err is the error returned by the check (nil for healthy)
+}
+
+// checkFunc is a type that implements the Check interface.
+type checkFunc struct {
+	name  string
+	check func(ctx context.Context) error
+}
+
+func (c *checkFunc) HealthCheck(ctx context.Context) []CheckResult {
+	return []CheckResult{{Name: c.name, Err: c.check(ctx)}}
+}
diff --git a/runtimes/go/appruntime/shared/health/health.go b/runtimes/go/appruntime/shared/health/health.go
new file mode 100644
index 0000000000..59eac92ab6
--- /dev/null
+++ b/runtimes/go/appruntime/shared/health/health.go
@@ -0,0 +1,113 @@
+package health
+
+import (
+	"cmp"
+	"context"
+	"slices"
+	"sync"
+	"time"
+
+	"github.com/rs/zerolog/log"
+)
+
+// CheckRegistry is a registry of health checks from the API and Infra SDKs
+// and other parts of the runtime.
+type CheckRegistry struct {
+	m      sync.Mutex
+	checks []Check
+}
+
+// NewCheckRegistry creates a new CheckRegistry.
+//
+// If running in an app there is a [Singleton]
+func NewCheckRegistry() *CheckRegistry {
+	return &CheckRegistry{}
+}
+
+// Register registers a new health check.
+//
+// Checks must complete within 5 seconds, otherwise
+// they will be terminated and considered failed.
+//
+// Checks can be called at any time and could have
+// multiple goroutines calling them concurrently.
+func (c *CheckRegistry) Register(check Check) {
+	c.m.Lock()
+	defer c.m.Unlock()
+	c.checks = append(c.checks, check)
+}
+
+// RegisterFunc registers a new health check from a function with a given name
+//
+// This is a convince wrapper over [CheckRegistry.Register], see that function
+// for more details and expected behavior.
+func (c *CheckRegistry) RegisterFunc(name string, check func(ctx context.Context) error) {
+	c.m.Lock()
+	defer c.m.Unlock()
+	c.Register(&checkFunc{name, check})
+}
+
+// GetChecks returns all registered health checks.
+func (c *CheckRegistry) GetChecks() []Check {
+	c.m.Lock()
+	defer c.m.Unlock()
+	return c.checks
+}
+
+// RunAll runs all health checks and returns the results.
+func (c *CheckRegistry) RunAll(ctx context.Context) []CheckResult {
+	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+
+	checks := c.GetChecks()
+
+	// Run all checks in parallel.
+	results := make(chan []CheckResult, len(checks))
+	var wg sync.WaitGroup
+	wg.Add(len(checks))
+	for _, check := range checks {
+		check := check
+		go func() {
+			defer wg.Done()
+			defer func() {
+				if r := recover(); r != nil {
+					log.Error().Any("panic", r).Msg("health check resulted in a panic")
+				}
+			}()
+
+			results <- check.HealthCheck(ctx)
+		}()
+	}
+
+	// Wait for all checks to complete for the context to be cancelled.
+	var allResults []CheckResult
+
+	done := make(chan struct{})
+	go func() {
+		wg.Wait()
+		close(done)
+	}()
+
+	// Wait for all checks to complete or the context to be cancelled.
+	select {
+	case <-done:
+	case <-ctx.Done():
+		allResults = append(allResults, CheckResult{
+			Name: "health-checks.run",
+			Err:  ctx.Err(),
+		})
+	}
+	close(results) // then close the results channel
+
+	// Collect results.
+	for results := range results {
+		allResults = append(allResults, results...)
+	}
+
+	// Sort results by name.
+	slices.SortFunc(allResults, func(a, b CheckResult) int {
+		return cmp.Compare(a.Name, b.Name)
+	})
+
+	return allResults
+}
diff --git a/runtimes/go/appruntime/shared/health/singleton.go b/runtimes/go/appruntime/shared/health/singleton.go
new file mode 100644
index 0000000000..8d2bc5acff
--- /dev/null
+++ b/runtimes/go/appruntime/shared/health/singleton.go
@@ -0,0 +1,7 @@
+//go:build encore_app
+
+package health
+
+// Singleton is the singleton instance of the health check registry
+// for a running Encore application.
+var Singleton = NewCheckRegistry()
diff --git a/runtimes/go/appruntime/shared/jsonapi/jsonapi.go b/runtimes/go/appruntime/shared/jsonapi/jsonapi.go
new file mode 100644
index 0000000000..78422df79e
--- /dev/null
+++ b/runtimes/go/appruntime/shared/jsonapi/jsonapi.go
@@ -0,0 +1,25 @@
+//go:build encore_app
+
+package jsonapi
+
+import (
+	jsoniter "github.com/json-iterator/go"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/appconf"
+)
+
+var Default = jsonAPI(appconf.Runtime)
+
+func jsonAPI(rt *config.Runtime) jsoniter.API {
+	indentStep := 2
+	if rt.EnvType == "production" {
+		indentStep = 0
+	}
+	return jsoniter.Config{
+		EscapeHTML:             false,
+		IndentionStep:          indentStep,
+		SortMapKeys:            true,
+		ValidateJsonRawMessage: true,
+	}.Froze()
+}
diff --git a/runtimes/go/appruntime/shared/jsonapi/jsonapi_nonapp.go b/runtimes/go/appruntime/shared/jsonapi/jsonapi_nonapp.go
new file mode 100644
index 0000000000..aa3bbe4c6d
--- /dev/null
+++ b/runtimes/go/appruntime/shared/jsonapi/jsonapi_nonapp.go
@@ -0,0 +1,23 @@
+//go:build !encore_app
+
+package jsonapi
+
+// Note: This version of the file exists so we can run `go test` on the runtime module.
+// This is because during those test we skip anything flagged as `encore_app` as we are
+// not running inside an Encore application and so don't have access to things like
+// configuration or compiled overlays.
+
+import (
+	jsoniter "github.com/json-iterator/go"
+)
+
+var Default = jsonAPI()
+
+func jsonAPI() jsoniter.API {
+	return jsoniter.Config{
+		EscapeHTML:             false,
+		IndentionStep:          2,
+		SortMapKeys:            true,
+		ValidateJsonRawMessage: true,
+	}.Froze()
+}
diff --git a/runtimes/go/appruntime/shared/logging/logging.go b/runtimes/go/appruntime/shared/logging/logging.go
new file mode 100644
index 0000000000..ec0212d60a
--- /dev/null
+++ b/runtimes/go/appruntime/shared/logging/logging.go
@@ -0,0 +1,49 @@
+//go:build encore_app
+
+package logging
+
+import (
+	"io"
+	"os"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/cloud"
+)
+
+var RootLogger = configure(appconf.Static, appconf.Runtime)
+
+func configure(static *config.Static, runtime *config.Runtime) zerolog.Logger {
+	var logOutput io.Writer = os.Stderr
+	if static.PrettyPrintLogs {
+		logOutput = zerolog.NewConsoleWriter(func(w *zerolog.ConsoleWriter) {
+			w.Out = logOutput
+		})
+	}
+
+	level := zerolog.TraceLevel
+	if runtime.LogConfig != "" {
+		if l, err := zerolog.ParseLevel(runtime.LogConfig); err == nil {
+			level = l
+		}
+	}
+
+	reconfigureZerologFormat(runtime)
+	return zerolog.New(logOutput).Level(level).With().Timestamp().Logger()
+}
+
+func reconfigureZerologFormat(runtime *config.Runtime) {
+	// Note: if updating this function, also update
+	// mapCloudFieldNamesToExpected in cli/cmd/encore/logs.go
+	// as that reverses this for log streaming
+	switch runtime.EnvCloud {
+	case cloud.GCP, cloud.Encore:
+		zerolog.LevelFieldName = "severity"
+		zerolog.TimestampFieldName = "timestamp"
+		zerolog.TimeFieldFormat = time.RFC3339Nano
+	default:
+	}
+}
diff --git a/runtimes/go/appruntime/shared/nativehist/PROMETHEUS_LICENSE.txt b/runtimes/go/appruntime/shared/nativehist/PROMETHEUS_LICENSE.txt
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/runtimes/go/appruntime/shared/nativehist/PROMETHEUS_LICENSE.txt
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/runtimes/go/appruntime/shared/nativehist/nativehist.go b/runtimes/go/appruntime/shared/nativehist/nativehist.go
new file mode 100644
index 0000000000..123c98e999
--- /dev/null
+++ b/runtimes/go/appruntime/shared/nativehist/nativehist.go
@@ -0,0 +1,326 @@
+// This file is originally from Prometheus, which is licensed under the Apache License 2.0.
+// See PROMETHEUS_LICENSE.txt for its license.
+
+package nativehist
+
+import (
+	"fmt"
+	"math"
+	"sort"
+	"sync"
+	"sync/atomic"
+)
+
+func New(bucketFactor float64) *Histogram {
+	return &Histogram{
+		Schema: pickSchema(bucketFactor),
+	}
+}
+
+type Histogram struct {
+	// Order in this struct matters for the alignment required by atomic
+	// operations, see http://golang.org/pkg/sync/atomic/#pkg-note-BUG
+	Count uint64
+
+	// NumZeroValues counts the number of observations in the zero bucket.
+	NumZeroValues uint64
+
+	// Schema is the Histogram bucket Schema. It's decided on creation.
+	Schema int32
+
+	// PostiveVals and NegativeVals are the buckets for non-zero observations.
+	PositiveVals, NegativeVals sync.Map
+}
+
+// Observe records an observation in the histogram.
+func (h *Histogram) Observe(v float64) {
+	var (
+		key    int
+		schema = atomic.LoadInt32(&h.Schema)
+		isInf  bool
+	)
+	if math.IsInf(v, 0) {
+		// Pretend v is MaxFloat64 but later increment key by one.
+		if math.IsInf(v, +1) {
+			v = math.MaxFloat64
+		} else {
+			v = -math.MaxFloat64
+		}
+		isInf = true
+	}
+	frac, exp := math.Frexp(math.Abs(v))
+	if schema > 0 {
+		bounds := nativeHistogramBounds[schema]
+		key = sort.SearchFloat64s(bounds, frac) + (exp-1)*len(bounds)
+	} else {
+		key = exp
+		if frac == 0.5 {
+			key--
+		}
+		div := 1 << -schema
+		key = (key + div - 1) / div
+	}
+	if isInf {
+		key++
+	}
+	switch {
+	case v > histogramZeroThreshold:
+		addToBucket(&h.PositiveVals, key, 1)
+	case v < -histogramZeroThreshold:
+		addToBucket(&h.NegativeVals, key, 1)
+	default:
+		atomic.AddUint64(&h.NumZeroValues, 1)
+	}
+}
+
+func (h *Histogram) reset() {
+	atomic.StoreUint64(&h.Count, 0)
+	atomic.StoreUint64(&h.NumZeroValues, 0)
+	clearSyncMap(&h.PositiveVals)
+	clearSyncMap(&h.NegativeVals)
+}
+
+// addToBucket increments the sparse bucket at key by the provided amount. It
+// returns true if a new sparse bucket had to be created for that.
+func addToBucket(buckets *sync.Map, key int, increment int64) bool {
+	if existingBucket, ok := buckets.Load(key); ok {
+		// Fast path without allocation.
+		atomic.AddInt64(existingBucket.(*int64), increment)
+		return false
+	}
+	// Bucket doesn't exist yet. Slow path allocating new counter.
+	newBucket := increment // TODO(beorn7): Check if this is sufficient to not let increment escape.
+	if actualBucket, loaded := buckets.LoadOrStore(key, &newBucket); loaded {
+		// The bucket was created concurrently in another goroutine.
+		// Have to increment after all.
+		atomic.AddInt64(actualBucket.(*int64), increment)
+		return false
+	}
+	return true
+}
+
+func clearSyncMap(m *sync.Map) {
+	m.Range(func(k, v interface{}) bool {
+		m.Delete(k)
+		return true
+	})
+}
+
+// nativeHistogramBounds for the frac of observed values. Only relevant for
+// schema > 0. The position in the slice is the schema. (0 is never used, just
+// here for convenience of using the schema directly as the index.)
+//
+// TODO(beorn7): Currently, we do a binary search into these slices. There are
+// ways to turn it into a small number of simple array lookups. It probably only
+// matters for schema 5 and beyond, but should be investigated. See this comment
+// as a starting point:
+// https://github.com/open-telemetry/opentelemetry-specification/issues/1776#issuecomment-870164310
+var nativeHistogramBounds = [][]float64{
+	// Schema "0":
+	{0.5},
+	// Schema 1:
+	{0.5, 0.7071067811865475},
+	// Schema 2:
+	{0.5, 0.5946035575013605, 0.7071067811865475, 0.8408964152537144},
+	// Schema 3:
+	{
+		0.5, 0.5452538663326288, 0.5946035575013605, 0.6484197773255048,
+		0.7071067811865475, 0.7711054127039704, 0.8408964152537144, 0.9170040432046711,
+	},
+	// Schema 4:
+	{
+		0.5, 0.5221368912137069, 0.5452538663326288, 0.5693943173783458,
+		0.5946035575013605, 0.620928906036742, 0.6484197773255048, 0.6771277734684463,
+		0.7071067811865475, 0.7384130729697496, 0.7711054127039704, 0.805245165974627,
+		0.8408964152537144, 0.8781260801866495, 0.9170040432046711, 0.9576032806985735,
+	},
+	// Schema 5:
+	{
+		0.5, 0.5109485743270583, 0.5221368912137069, 0.5335702003384117,
+		0.5452538663326288, 0.5571933712979462, 0.5693943173783458, 0.5818624293887887,
+		0.5946035575013605, 0.6076236799902344, 0.620928906036742, 0.6345254785958666,
+		0.6484197773255048, 0.6626183215798706, 0.6771277734684463, 0.6919549409819159,
+		0.7071067811865475, 0.7225904034885232, 0.7384130729697496, 0.7545822137967112,
+		0.7711054127039704, 0.7879904225539431, 0.805245165974627, 0.8228777390769823,
+		0.8408964152537144, 0.8593096490612387, 0.8781260801866495, 0.8973545375015533,
+		0.9170040432046711, 0.9370838170551498, 0.9576032806985735, 0.9785720620876999,
+	},
+	// Schema 6:
+	{
+		0.5, 0.5054446430258502, 0.5109485743270583, 0.5165124395106142,
+		0.5221368912137069, 0.5278225891802786, 0.5335702003384117, 0.5393803988785598,
+		0.5452538663326288, 0.5511912916539204, 0.5571933712979462, 0.5632608093041209,
+		0.5693943173783458, 0.5755946149764913, 0.5818624293887887, 0.5881984958251406,
+		0.5946035575013605, 0.6010783657263515, 0.6076236799902344, 0.6142402680534349,
+		0.620928906036742, 0.6276903785123455, 0.6345254785958666, 0.6414350080393891,
+		0.6484197773255048, 0.6554806057623822, 0.6626183215798706, 0.6698337620266515,
+		0.6771277734684463, 0.6845012114872953, 0.6919549409819159, 0.6994898362691555,
+		0.7071067811865475, 0.7148066691959849, 0.7225904034885232, 0.7304588970903234,
+		0.7384130729697496, 0.7464538641456323, 0.7545822137967112, 0.762799075372269,
+		0.7711054127039704, 0.7795022001189185, 0.7879904225539431, 0.7965710756711334,
+		0.805245165974627, 0.8140137109286738, 0.8228777390769823, 0.8318382901633681,
+		0.8408964152537144, 0.8500531768592616, 0.8593096490612387, 0.8686669176368529,
+		0.8781260801866495, 0.8876882462632604, 0.8973545375015533, 0.9071260877501991,
+		0.9170040432046711, 0.9269895625416926, 0.9370838170551498, 0.9472879907934827,
+		0.9576032806985735, 0.9680308967461471, 0.9785720620876999, 0.9892280131939752,
+	},
+	// Schema 7:
+	{
+		0.5, 0.5027149505564014, 0.5054446430258502, 0.5081891574554764,
+		0.5109485743270583, 0.5137229745593818, 0.5165124395106142, 0.5193170509806894,
+		0.5221368912137069, 0.5249720429003435, 0.5278225891802786, 0.5306886136446309,
+		0.5335702003384117, 0.5364674337629877, 0.5393803988785598, 0.5423091811066545,
+		0.5452538663326288, 0.5482145409081883, 0.5511912916539204, 0.5541842058618393,
+		0.5571933712979462, 0.5602188762048033, 0.5632608093041209, 0.5663192597993595,
+		0.5693943173783458, 0.572486072215902, 0.5755946149764913, 0.5787200368168754,
+		0.5818624293887887, 0.585021884841625, 0.5881984958251406, 0.5913923554921704,
+		0.5946035575013605, 0.5978321960199137, 0.6010783657263515, 0.6043421618132907,
+		0.6076236799902344, 0.6109230164863786, 0.6142402680534349, 0.6175755319684665,
+		0.620928906036742, 0.6243004885946023, 0.6276903785123455, 0.6310986751971253,
+		0.6345254785958666, 0.637970889198196, 0.6414350080393891, 0.6449179367033329,
+		0.6484197773255048, 0.6519406325959679, 0.6554806057623822, 0.659039800633032,
+		0.6626183215798706, 0.6662162735415805, 0.6698337620266515, 0.6734708931164728,
+		0.6771277734684463, 0.6808045103191123, 0.6845012114872953, 0.688217985377265,
+		0.6919549409819159, 0.6957121878859629, 0.6994898362691555, 0.7032879969095076,
+		0.7071067811865475, 0.7109463010845827, 0.7148066691959849, 0.718687998724491,
+		0.7225904034885232, 0.7265139979245261, 0.7304588970903234, 0.7344252166684908,
+		0.7384130729697496, 0.7424225829363761, 0.7464538641456323, 0.7505070348132126,
+		0.7545822137967112, 0.7586795205991071, 0.762799075372269, 0.7669409989204777,
+		0.7711054127039704, 0.7752924388424999, 0.7795022001189185, 0.7837348199827764,
+		0.7879904225539431, 0.7922691326262467, 0.7965710756711334, 0.8008963778413465,
+		0.805245165974627, 0.8096175675974316, 0.8140137109286738, 0.8184337248834821,
+		0.8228777390769823, 0.8273458838280969, 0.8318382901633681, 0.8363550898207981,
+		0.8408964152537144, 0.8454623996346523, 0.8500531768592616, 0.8546688815502312,
+		0.8593096490612387, 0.8639756154809185, 0.8686669176368529, 0.8733836930995842,
+		0.8781260801866495, 0.8828942179666361, 0.8876882462632604, 0.8925083056594671,
+		0.8973545375015533, 0.9022270839033115, 0.9071260877501991, 0.9120516927035263,
+		0.9170040432046711, 0.9219832844793128, 0.9269895625416926, 0.9320230241988943,
+		0.9370838170551498, 0.9421720895161669, 0.9472879907934827, 0.9524316709088368,
+		0.9576032806985735, 0.9628029718180622, 0.9680308967461471, 0.9732872087896164,
+		0.9785720620876999, 0.9838856116165875, 0.9892280131939752, 0.9945994234836328,
+	},
+	// Schema 8:
+	{
+		0.5, 0.5013556375251013, 0.5027149505564014, 0.5040779490592088,
+		0.5054446430258502, 0.5068150424757447, 0.5081891574554764, 0.509566998038869,
+		0.5109485743270583, 0.5123338964485679, 0.5137229745593818, 0.5151158188430205,
+		0.5165124395106142, 0.5179128468009786, 0.5193170509806894, 0.520725062344158,
+		0.5221368912137069, 0.5235525479396449, 0.5249720429003435, 0.526395386502313,
+		0.5278225891802786, 0.5292536613972564, 0.5306886136446309, 0.5321274564422321,
+		0.5335702003384117, 0.5350168559101208, 0.5364674337629877, 0.5379219445313954,
+		0.5393803988785598, 0.5408428074966075, 0.5423091811066545, 0.5437795304588847,
+		0.5452538663326288, 0.5467321995364429, 0.5482145409081883, 0.549700901315111,
+		0.5511912916539204, 0.5526857228508706, 0.5541842058618393, 0.5556867516724088,
+		0.5571933712979462, 0.5587040757836845, 0.5602188762048033, 0.5617377836665098,
+		0.5632608093041209, 0.564787964283144, 0.5663192597993595, 0.5678547070789026,
+		0.5693943173783458, 0.5709381019847808, 0.572486072215902, 0.5740382394200894,
+		0.5755946149764913, 0.5771552102951081, 0.5787200368168754, 0.5802891060137493,
+		0.5818624293887887, 0.5834400184762408, 0.585021884841625, 0.5866080400818185,
+		0.5881984958251406, 0.5897932637314379, 0.5913923554921704, 0.5929957828304968,
+		0.5946035575013605, 0.5962156912915756, 0.5978321960199137, 0.5994530835371903,
+		0.6010783657263515, 0.6027080545025619, 0.6043421618132907, 0.6059806996384005,
+		0.6076236799902344, 0.6092711149137041, 0.6109230164863786, 0.6125793968185725,
+		0.6142402680534349, 0.6159056423670379, 0.6175755319684665, 0.6192499490999082,
+		0.620928906036742, 0.622612415087629, 0.6243004885946023, 0.6259931389331581,
+		0.6276903785123455, 0.6293922197748583, 0.6310986751971253, 0.6328097572894031,
+		0.6345254785958666, 0.6362458516947014, 0.637970889198196, 0.6397006037528346,
+		0.6414350080393891, 0.6431741147730128, 0.6449179367033329, 0.6466664866145447,
+		0.6484197773255048, 0.6501778216898253, 0.6519406325959679, 0.6537082229673385,
+		0.6554806057623822, 0.6572577939746774, 0.659039800633032, 0.6608266388015788,
+		0.6626183215798706, 0.6644148621029772, 0.6662162735415805, 0.6680225691020727,
+		0.6698337620266515, 0.6716498655934177, 0.6734708931164728, 0.6752968579460171,
+		0.6771277734684463, 0.6789636531064505, 0.6808045103191123, 0.6826503586020058,
+		0.6845012114872953, 0.6863570825438342, 0.688217985377265, 0.690083933630119,
+		0.6919549409819159, 0.6938310211492645, 0.6957121878859629, 0.6975984549830999,
+		0.6994898362691555, 0.7013863456101023, 0.7032879969095076, 0.7051948041086352,
+		0.7071067811865475, 0.7090239421602076, 0.7109463010845827, 0.7128738720527471,
+		0.7148066691959849, 0.7167447066838943, 0.718687998724491, 0.7206365595643126,
+		0.7225904034885232, 0.7245495448210174, 0.7265139979245261, 0.7284837772007218,
+		0.7304588970903234, 0.7324393720732029, 0.7344252166684908, 0.7364164454346837,
+		0.7384130729697496, 0.7404151139112358, 0.7424225829363761, 0.7444354947621984,
+		0.7464538641456323, 0.7484777058836176, 0.7505070348132126, 0.7525418658117031,
+		0.7545822137967112, 0.7566280937263048, 0.7586795205991071, 0.7607365094544071,
+		0.762799075372269, 0.7648672334736434, 0.7669409989204777, 0.7690203869158282,
+		0.7711054127039704, 0.7731960915705107, 0.7752924388424999, 0.7773944698885442,
+		0.7795022001189185, 0.7816156449856788, 0.7837348199827764, 0.7858597406461707,
+		0.7879904225539431, 0.7901268813264122, 0.7922691326262467, 0.7944171921585818,
+		0.7965710756711334, 0.7987307989543135, 0.8008963778413465, 0.8030678282083853,
+		0.805245165974627, 0.8074284071024302, 0.8096175675974316, 0.8118126635086642,
+		0.8140137109286738, 0.8162207259936375, 0.8184337248834821, 0.820652723822003,
+		0.8228777390769823, 0.8251087869603088, 0.8273458838280969, 0.8295890460808079,
+		0.8318382901633681, 0.8340936325652911, 0.8363550898207981, 0.8386226785089391,
+		0.8408964152537144, 0.8431763167241966, 0.8454623996346523, 0.8477546807446661,
+		0.8500531768592616, 0.8523579048290255, 0.8546688815502312, 0.8569861239649629,
+		0.8593096490612387, 0.8616394738731368, 0.8639756154809185, 0.8663180910111553,
+		0.8686669176368529, 0.871022112577578, 0.8733836930995842, 0.8757516765159389,
+		0.8781260801866495, 0.8805069215187917, 0.8828942179666361, 0.8852879870317771,
+		0.8876882462632604, 0.890095013257712, 0.8925083056594671, 0.8949281411607002,
+		0.8973545375015533, 0.8997875124702672, 0.9022270839033115, 0.9046732696855155,
+		0.9071260877501991, 0.909585556079304, 0.9120516927035263, 0.9145245157024483,
+		0.9170040432046711, 0.9194902933879467, 0.9219832844793128, 0.9244830347552253,
+		0.9269895625416926, 0.92950288621441, 0.9320230241988943, 0.9345499949706191,
+		0.9370838170551498, 0.93962450902828, 0.9421720895161669, 0.9447265771954693,
+		0.9472879907934827, 0.9498563490882775, 0.9524316709088368, 0.9550139751351947,
+		0.9576032806985735, 0.9601996065815236, 0.9628029718180622, 0.9654133954938133,
+		0.9680308967461471, 0.9706554947643201, 0.9732872087896164, 0.9759260581154889,
+		0.9785720620876999, 0.9812252401044634, 0.9838856116165875, 0.9865531961276168,
+		0.9892280131939752, 0.9919100824251095, 0.9945994234836328, 0.9972960560854698,
+	},
+}
+
+// The nativeHistogramBounds above can be generated with the code below.
+//
+// TODO(beorn7): It's tempting to actually use `go generate` to generate the
+// code above. However, this could lead to slightly different numbers on
+// different architectures. We still need to come to terms if we are fine with
+// that, or if we might prefer to specify precise numbers in the standard.
+//
+// var nativeHistogramBounds [][]float64 = make([][]float64, 9)
+//
+// func init() {
+// 	// Populate nativeHistogramBounds.
+// 	numBuckets := 1
+// 	for i := range nativeHistogramBounds {
+// 		bounds := []float64{0.5}
+// 		factor := math.Exp2(math.Exp2(float64(-i)))
+// 		for j := 0; j < numBuckets-1; j++ {
+// 			var bound float64
+// 			if (j+1)%2 == 0 {
+// 				// Use previously calculated value for increased precision.
+// 				bound = nativeHistogramBounds[i-1][j/2+1]
+// 			} else {
+// 				bound = bounds[j] * factor
+// 			}
+// 			bounds = append(bounds, bound)
+// 		}
+// 		numBuckets *= 2
+// 		nativeHistogramBounds[i] = bounds
+// 	}
+// }
+
+// histogramZeroThreshold is the absolute value threshold at which values are considered zero.
+//
+// The value is 2^-128 (or 0.5*2^-127 in the actual IEEE 754 representation),
+// which is a bucket boundary at all possible resolutions.
+const histogramZeroThreshold = 2.938735877055719e-39
+
+// pickSchema returns the largest number n between -4 and 8 such that
+// 2^(2^-n) is less or equal the provided bucketFactor.
+//
+// Special cases:
+//   - bucketFactor <= 1: panics.
+//   - bucketFactor < 2^(2^-8) (but > 1): still returns 8.
+func pickSchema(bucketFactor float64) int32 {
+	if bucketFactor <= 1 {
+		panic(fmt.Errorf("bucketFactor %f is <=1", bucketFactor))
+	}
+	floor := math.Floor(math.Log2(math.Log2(bucketFactor)))
+	switch {
+	case floor <= -8:
+		return 8
+	case floor >= 4:
+		return -4
+	default:
+		return -int32(floor)
+	}
+}
diff --git a/runtimes/go/appruntime/shared/platform/platform.go b/runtimes/go/appruntime/shared/platform/platform.go
new file mode 100644
index 0000000000..16c39674b3
--- /dev/null
+++ b/runtimes/go/appruntime/shared/platform/platform.go
@@ -0,0 +1,85 @@
+// Package platform handles communication with the Encore Platform.
+package platform
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"encoding/binary"
+	"fmt"
+	"net/http"
+	"time"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/experiments"
+)
+
+func NewClient(static *config.Static, rt *config.Runtime) *Client {
+	exp := experiments.FromConfig(static, rt)
+	return &Client{static, rt, exp}
+}
+
+type Client struct {
+	static  *config.Static
+	runtime *config.Runtime
+	exp     *experiments.Set
+}
+
+func (c *Client) addAuthKey(req *http.Request) {
+	k := c.runtime.AuthKeys[0]
+	date := time.Now().UTC().Format(http.TimeFormat)
+	req.Header.Set("Date", date)
+
+	mac := hmac.New(sha256.New, k.Data)
+	_, _ = fmt.Fprintf(mac, "%s\x00%s", date, req.URL.Path)
+
+	bytes := make([]byte, 4, 4+sha256.Size)
+	binary.BigEndian.PutUint32(bytes[0:4], k.KeyID)
+	bytes = mac.Sum(bytes)
+	auth := base64.RawStdEncoding.EncodeToString(bytes)
+	req.Header.Set("X-Encore-Auth", auth)
+}
+
+// ValidatePlatformRequest validates whether a request originated from the platform.
+func (c *Client) ValidatePlatformRequest(req *http.Request, macSig string) (bool, error) {
+	macBytes, err := base64.RawStdEncoding.DecodeString(macSig)
+	if err != nil {
+		return false, nil
+	}
+
+	// Pull out key ID from hmac prefix
+	const keyIDLen = 4
+	if len(macBytes) < keyIDLen {
+		return false, nil
+	}
+
+	keyID := binary.BigEndian.Uint32(macBytes[:keyIDLen])
+	mac := macBytes[keyIDLen:]
+	for _, k := range c.runtime.AuthKeys {
+		if k.KeyID == keyID {
+			return checkAuthKey(k, req, mac), nil
+		}
+	}
+
+	return false, nil
+}
+
+func checkAuthKey(key config.EncoreAuthKey, req *http.Request, gotMac []byte) bool {
+	dateStr := req.Header.Get("Date")
+	if dateStr == "" {
+		return false
+	}
+	date, err := http.ParseTime(dateStr)
+	if err != nil {
+		return false
+	}
+	const threshold = 15 * time.Minute
+	if diff := time.Since(date); diff > threshold || diff < -threshold {
+		return false
+	}
+
+	mac := hmac.New(sha256.New, key.Data)
+	_, _ = fmt.Fprintf(mac, "%s\x00%s", dateStr, req.URL.Path)
+	expected := mac.Sum(nil)
+	return hmac.Equal(expected, gotMac)
+}
diff --git a/runtimes/go/appruntime/shared/platform/singleton.go b/runtimes/go/appruntime/shared/platform/singleton.go
new file mode 100644
index 0000000000..d3b8c73603
--- /dev/null
+++ b/runtimes/go/appruntime/shared/platform/singleton.go
@@ -0,0 +1,7 @@
+//go:build encore_app
+
+package platform
+
+import "encore.dev/appruntime/shared/appconf"
+
+var Singleton = NewClient(appconf.Static, appconf.Runtime)
diff --git a/runtimes/go/appruntime/shared/platform/streaming_trace.go b/runtimes/go/appruntime/shared/platform/streaming_trace.go
new file mode 100644
index 0000000000..be44d17b8c
--- /dev/null
+++ b/runtimes/go/appruntime/shared/platform/streaming_trace.go
@@ -0,0 +1,131 @@
+package platform
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"strconv"
+	"time"
+
+	"encore.dev/appruntime/exported/trace2"
+)
+
+func (c *Client) StreamTrace(log trace2.Logger) error {
+	if c.static.Testing {
+		// In testing we want to block the test until the trace is done.
+		return c.blockingTrace(log)
+	} else {
+		return c.streamingTrace(log)
+	}
+}
+
+// streamingTrace streams a trace to the platform.
+func (c *Client) streamingTrace(log trace2.Logger) error {
+	// Wait a bit for the trace to start, so we can avoid the overhead
+	// of small chunk streaming if the trace is short.
+	done := log.WaitAtLeast(1 * time.Second)
+	var body io.Reader
+	if done {
+		data, _ := log.GetAndClear()
+		if len(data) == 0 {
+			return nil
+		}
+
+		// Use a bytes.Reader so net/http knows the Content-Length.
+		body = bytes.NewReader(data)
+	} else {
+		r := &traceLogReader{log: log}
+		if r.IsDoneAndEmpty() {
+			// We didn't get any trace data; don't bother streaming.
+			return nil
+		}
+		body = r
+	}
+
+	// Use a background context since the trace is streaming,
+	// and we don't know how long it will take to complete.
+	ctx := context.Background()
+	return c.sendTraceRequest(ctx, body)
+}
+
+// blockingTrace waits for the trace to complete before sending it.
+func (c *Client) blockingTrace(log trace2.Logger) error {
+	// Wait for the trace to complete
+	log.WaitUntilDone()
+	data, _ := log.GetAndClear()
+	if len(data) == 0 {
+		return nil // optimization
+	}
+	body := bytes.NewReader(data)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	defer cancel()
+	return c.sendTraceRequest(ctx, body)
+}
+
+func (c *Client) sendTraceRequest(ctx context.Context, body io.Reader) error {
+	req, err := http.NewRequestWithContext(ctx, "POST", c.runtime.TraceEndpoint, body)
+	if err != nil {
+		return err
+	}
+
+	ta, err := trace2.NewTimeAnchorNow().MarshalText()
+	if err != nil {
+		return err
+	}
+
+	req.Header.Set("X-Encore-App-ID", c.runtime.AppID)
+	req.Header.Set("X-Encore-Env-ID", c.runtime.EnvID)
+	req.Header.Set("X-Encore-Deploy-ID", c.runtime.DeployID)
+	req.Header.Set("X-Encore-App-Commit", c.static.AppCommit.AsRevisionString())
+	req.Header.Set("X-Encore-Trace-Version", strconv.Itoa(int(trace2.CurrentVersion)))
+	req.Header.Set("X-Encore-Trace-TimeAnchor", string(ta))
+	c.addAuthKey(req)
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(resp.Body)
+		return fmt.Errorf("http %s: %s", resp.Status, body)
+	}
+	return nil
+}
+
+// traceLogReader implements io.Reader by reading from a trace log.
+type traceLogReader struct {
+	log  trace2.Logger
+	data []byte // current buffer
+	done bool
+}
+
+func (r *traceLogReader) Read(b []byte) (int, error) {
+	r.readMoreIfNeeded()
+	// Post-condition: we have data, or we're done (or both).
+
+	if len(r.data) > 0 {
+		n := copy(b, r.data)
+		r.data = r.data[n:]
+		return n, nil
+	} else {
+		return 0, io.EOF
+	}
+}
+
+// IsDoneAndEmpty blocks until we have some trace data, and then
+// reports whether the trace is done and empty.
+func (r *traceLogReader) IsDoneAndEmpty() bool {
+	r.readMoreIfNeeded()
+	return len(r.data) == 0 && r.done
+}
+
+func (r *traceLogReader) readMoreIfNeeded() {
+	for len(r.data) == 0 && !r.done {
+		r.data, r.done = r.log.WaitAndClear()
+	}
+	// Post-condition: we have data, or we're done (or both).
+}
diff --git a/runtimes/go/appruntime/shared/reqtrack/impl.go b/runtimes/go/appruntime/shared/reqtrack/impl.go
new file mode 100644
index 0000000000..61179978e1
--- /dev/null
+++ b/runtimes/go/appruntime/shared/reqtrack/impl.go
@@ -0,0 +1,209 @@
+package reqtrack
+
+import (
+	"sync/atomic"
+	_ "unsafe" // for go:linkname
+
+	model2 "encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/trace2"
+)
+
+type reqTrackImpl interface {
+	get() *encoreG
+	set(e *encoreG)
+}
+
+// encoreG tracks per-goroutine Encore-specific data.
+// This must match the definition in the encore-go runtime.
+type encoreG struct {
+	// op is the current operation the goroutine is a part of.
+	op *encoreOp
+
+	// req is request-specific data defined in the Encore runtime.
+	req *encoreReq
+
+	// goctr is the per-op goroutine counter.
+	goctr uint32
+}
+
+// encoreOp represents an Encore operation.
+// This must match the definition in the encore-go runtime.
+type encoreOp struct {
+	// t is the RequestTracker this is part of.
+	t *RequestTracker
+
+	// start is the start time of the operation
+	start int64 // start time of trace from nanotime()
+
+	// trace is the trace log; it is nil if the op is not traced.
+	trace atomic.Pointer[lazyTraceInit]
+
+	// refs is the op refcount. It is 1 + number of requests
+	// that reference this op (see doc comment above).
+	// It is accessed atomically.
+	refs int32
+
+	// goidCtr is a per-operation goroutine counter, for telling
+	// apart goroutines participating in the operation.
+	goidCtr uint32
+}
+
+func (op *encoreOp) beginTracing() {
+	op.trace.CompareAndSwap(nil, newLazyTrace(op.t))
+}
+
+// encoreReq represents an Encore API request.
+type encoreReq struct {
+	// spanID is the request span id.
+	spanID model2.SpanID
+	// data is request-specific data defined in the Encore runtime.
+	data *model2.Request
+}
+
+// beginOp begins a new Encore operation.
+// The trace parameter determines if the op is traced.
+//
+// It tags the current goroutine with the op.
+// It panics if the goroutine is already part of an op.
+func (t *RequestTracker) beginOp(trace bool) *encoreOp {
+	op := t.newOp(trace)
+	t.tagG(op, nil)
+	return op
+}
+
+// newOp creates a new encoreOp.
+func (t *RequestTracker) newOp(trace bool) *encoreOp {
+	op := &encoreOp{
+		t:     t,
+		start: nanotime(),
+		refs:  1,
+	}
+	if trace && t.trace != nil {
+		op.beginTracing()
+	}
+	return op
+}
+
+// encoreTagG tags the g as participating in op, and with req
+// as its request data.
+// It does not increment the ref count, which means req
+// must already be an active request.
+// g must not already be part of an op.
+func (t *RequestTracker) tagG(op *encoreOp, req *encoreReq) (goctr uint32) {
+	if t.impl.get() != nil {
+		panic("encore.tagG: goroutine already part of another operation")
+	}
+	goctr = atomic.AddUint32(&op.goidCtr, 1)
+	t.impl.set(&encoreG{
+		op:    op,
+		req:   req,
+		goctr: goctr,
+	})
+	return goctr
+}
+
+// finishOp marks an operation as finished
+// and unsets the operation tag on the g.
+// It must be part of an operation.
+func (t *RequestTracker) finishOp() {
+	e := t.impl.get()
+	if e == nil {
+		panic("encore.finishOp: goroutine not in an operation")
+	}
+	e.op.decRef(false)
+	t.impl.set(nil)
+}
+
+// incRef increases the op's refcount by one.
+func (op *encoreOp) incRef() int32 {
+	return atomic.AddInt32(&op.refs, 1)
+}
+
+// decRef decreases the op's refcount by one.
+// If it reaches zero and the op is traced, it sends off the trace.
+func (op *encoreOp) decRef(blockOnTraceSend bool) int32 {
+	n := atomic.AddInt32(&op.refs, -1)
+	if n == 0 {
+		if trace := op.trace.Load(); trace != nil {
+			trace.MarkDone()
+
+			if blockOnTraceSend {
+				trace.WaitForStreamSent()
+			}
+		}
+	}
+	return n
+}
+
+// beginReq sets the request data for the current g,
+// and increases the ref count on the operation.
+// If the g is not part of an op, it creates a new op
+// that is bound to the request lifetime.
+func (t *RequestTracker) beginReq(data *model2.Request, trace bool) {
+	e := t.impl.get()
+	req := &encoreReq{spanID: data.SpanID, data: data}
+	if e == nil {
+		op := t.newOp(trace)
+		t.tagG(op, req)
+		// Don't increment the op refcount since it starts at one,
+		// and this is not a standalone op.
+	} else {
+		if e.req != nil {
+			panic("encore.beginReq: request already running")
+		}
+		e.op.incRef()
+		e.req = req
+
+		// Begin tracing if we haven't, already.
+		if trace && e.op.trace.Load() == nil {
+			e.op.beginTracing()
+		}
+	}
+}
+
+// finishReq completes the request and decreases the
+// ref count on the operation.
+// The g must be processing a request.
+func (t *RequestTracker) finishReq(blockOnTraceSend bool) {
+	e := t.impl.get()
+	if e == nil {
+		panic("encore.finishReq: goroutine not in an operation")
+	} else if e.req == nil {
+		panic("encore.finishReq: no current request")
+	}
+	e.op.decRef(blockOnTraceSend)
+	e.req = nil
+}
+
+func (t *RequestTracker) currentReq() (req *model2.Request, tr trace2.Logger, goctr uint32, svcNum uint16) {
+	if g := t.impl.get(); g != nil {
+		var tr trace2.Logger
+		if g.op != nil {
+			if trace := g.op.trace.Load(); trace != nil {
+				tr = trace.Logger()
+			}
+		}
+		if g.req != nil {
+			req = g.req.data
+			svcNum = req.SvcNum
+		}
+		return req, tr, g.goctr, svcNum
+	}
+	return nil, nil, 0, 0
+}
+
+// encoreClearReq clears request data from the running g
+// without decrementing the ref count.
+// The g must be processing a request.
+func (t *RequestTracker) clearReq() {
+	e := t.impl.get()
+	if e == nil {
+		panic("encore.replaceReq: goroutine not in an operation")
+	} else if e.req == nil {
+		panic("encore.replaceReq: no current request")
+	}
+	e.req = nil
+}
+
+//go:linkname nanotime runtime.nanotime
+func nanotime() int64
diff --git a/runtimes/go/appruntime/shared/reqtrack/impl_app.go b/runtimes/go/appruntime/shared/reqtrack/impl_app.go
new file mode 100644
index 0000000000..2c84a0682b
--- /dev/null
+++ b/runtimes/go/appruntime/shared/reqtrack/impl_app.go
@@ -0,0 +1,81 @@
+//go:build encore_app
+
+package reqtrack
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"sync/atomic"
+	_ "unsafe" // for go:linkname
+)
+
+func newImpl() reqTrackImpl {
+	return appImpl{}
+}
+
+type appImpl struct{}
+
+var _ reqTrackImpl = appImpl{}
+
+func (appImpl) get() *encoreG {
+	return getEncoreG()
+}
+
+func (appImpl) set(val *encoreG) {
+	setEncoreG(val)
+}
+
+// getEncoreG gets the encore data for the current g, or nil.
+//
+//go:linkname getEncoreG runtime.getEncoreG
+func getEncoreG() *encoreG
+
+// setEncoreG sets the encore data for the current g to val.
+//
+//go:linkname setEncoreG runtime.setEncoreG
+func setEncoreG(val *encoreG)
+
+//go:linkname startEncoreG runtime.startEncoreG
+func startEncoreG(src *encoreG) *encoreG {
+	if src == nil {
+		return nil
+	}
+
+	goctr := atomic.AddUint32(&src.op.goidCtr, 1)
+	dst := &encoreG{
+		op:    src.op,
+		req:   src.req,
+		goctr: goctr,
+	}
+
+	return dst
+}
+
+//go:linkname exitEncoreG runtime.exitEncoreG
+func exitEncoreG(e *encoreG) {}
+
+//go:linkname beginHTTPRoundTrip net/http.encoreBeginRoundTrip
+func beginHTTPRoundTrip(req *http.Request) (context.Context, error) {
+	g := getEncoreG()
+	if g == nil || g.req == nil || !g.req.data.Traced {
+		return req.Context(), nil
+	} else if req.URL == nil {
+		return nil, fmt.Errorf("http: nil Request.URL")
+	}
+
+	if trace := g.op.trace.Load(); trace != nil {
+		return trace.Logger().HTTPBeginRoundTrip(req, g.req.data, g.goctr)
+	}
+
+	return req.Context(), nil
+}
+
+//go:linkname finishHTTPRoundTrip net/http.encoreFinishRoundTrip
+func finishHTTPRoundTrip(req *http.Request, resp *http.Response, err error) {
+	if g := getEncoreG(); g != nil && g.req != nil {
+		if trace := g.op.trace.Load(); trace != nil {
+			trace.Logger().HTTPCompleteRoundTrip(req, resp, g.goctr, err)
+		}
+	}
+}
diff --git a/runtimes/go/appruntime/shared/reqtrack/impl_noapp.go b/runtimes/go/appruntime/shared/reqtrack/impl_noapp.go
new file mode 100644
index 0000000000..13591118fd
--- /dev/null
+++ b/runtimes/go/appruntime/shared/reqtrack/impl_noapp.go
@@ -0,0 +1,94 @@
+//go:build !encore_app
+
+package reqtrack
+
+import (
+	"bytes"
+	"fmt"
+	"runtime"
+	"strconv"
+	"sync"
+)
+
+func newImpl() reqTrackImpl {
+	return &noappImpl{
+		gmap: make(map[int64]*encoreG),
+	}
+}
+
+type noappImpl struct {
+	mu   sync.Mutex
+	gmap map[int64]*encoreG
+}
+
+var _ reqTrackImpl = (*noappImpl)(nil)
+
+func (i *noappImpl) get() *encoreG {
+	id := goroutineID()
+
+	i.mu.Lock()
+	defer i.mu.Unlock()
+	return i.gmap[id]
+}
+
+func (i *noappImpl) set(val *encoreG) {
+	id := goroutineID()
+
+	i.mu.Lock()
+	defer i.mu.Unlock()
+	i.gmap[id] = val
+}
+
+// The below code snippet is copied from go4.org/syncutil/syncdebug.
+//
+// Copyright 2013 The Perkeep Authors
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//      http://www.apache.org/licenses/LICENSE-2.0
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+const stackBufSize = 16 << 20
+
+var stackBuf = make(chan []byte, 8)
+
+func getBuf() []byte {
+	select {
+	case b := <-stackBuf:
+		return b[:stackBufSize]
+	default:
+		return make([]byte, stackBufSize)
+	}
+}
+
+func putBuf(b []byte) {
+	select {
+	case stackBuf <- b:
+	default:
+	}
+}
+
+var goroutineSpace = []byte("goroutine ")
+
+func goroutineID() int64 {
+	b := getBuf()
+	defer putBuf(b)
+	b = b[:runtime.Stack(b, false)]
+	// Parse the 4707 out of "goroutine 4707 ["
+	b = bytes.TrimPrefix(b, goroutineSpace)
+	i := bytes.IndexByte(b, ' ')
+	if i < 0 {
+		panic(fmt.Sprintf("No space found in %q", b))
+	}
+	b = b[:i]
+	// nosemgrep
+	n, err := strconv.ParseUint(string(b), 10, 64)
+	if err != nil {
+		panic(fmt.Sprintf("Failed to parse goroutine ID out of %q: %v", b, err))
+	}
+	return int64(n)
+}
diff --git a/runtimes/go/appruntime/shared/reqtrack/reqtrack.go b/runtimes/go/appruntime/shared/reqtrack/reqtrack.go
new file mode 100644
index 0000000000..82d52eb71b
--- /dev/null
+++ b/runtimes/go/appruntime/shared/reqtrack/reqtrack.go
@@ -0,0 +1,117 @@
+package reqtrack
+
+import (
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/appruntime/shared/traceprovider"
+)
+
+// New creates a new RequestTracker.
+//
+// If traceProvider is nil no traces are generated.
+// If streamer is nil no traces are streamed to the platform.
+func New(rootLogger zerolog.Logger, streamer TraceStreamer, traceProvider traceprovider.Factory) *RequestTracker {
+	if streamer == nil {
+		streamer = &noopTraceStreamer{}
+	}
+
+	return &RequestTracker{
+		streamer:   streamer,
+		impl:       newImpl(),
+		trace:      traceProvider,
+		rootLogger: rootLogger,
+	}
+}
+
+type RequestTracker struct {
+	streamer   TraceStreamer
+	impl       reqTrackImpl
+	trace      traceprovider.Factory // nil if tracing is not enabled
+	rootLogger zerolog.Logger
+}
+
+func (t *RequestTracker) BeginOperation() {
+	t.beginOp(false)
+}
+
+func (t *RequestTracker) FinishOperation() {
+	t.finishOp()
+}
+
+func (t *RequestTracker) BeginRequest(req *model.Request) {
+	if prev, _, _, _ := t.currentReq(); prev != nil {
+		copyReqInfoFromParent(req, prev)
+		t.clearReq()
+	}
+	t.beginReq(req, req.Traced)
+}
+
+// copyReqInfoFromParent copies over relevant request from the parent request.
+// If the relevant fields are already set on next they are not copied over.
+func copyReqInfoFromParent(next, prev *model.Request) {
+	if prevData, nextData := prev.RPCData, next.RPCData; prevData != nil && nextData != nil {
+		if nextData.UserID == "" {
+			nextData.UserID = prevData.UserID
+		}
+		if nextData.AuthData == nil {
+			nextData.AuthData = prevData.AuthData
+		}
+	} else if nextData != nil && prev.Test != nil {
+		if nextData.UserID == "" {
+			nextData.UserID = prev.Test.UserID
+		}
+		if nextData.AuthData == nil {
+			nextData.AuthData = prev.Test.AuthData
+		}
+	}
+
+	if !prev.TraceID.IsZero() {
+		next.TraceID = prev.TraceID
+	}
+	if next.ParentSpanID.IsZero() {
+		next.ParentSpanID = prev.SpanID
+	}
+	if next.ParentTraceID.IsZero() {
+		next.ParentTraceID = prev.ParentTraceID
+	}
+	if next.ExtCorrelationID == "" {
+		next.ExtCorrelationID = prev.ExtCorrelationID
+	}
+	if next.Test == nil {
+		next.Test = prev.Test
+	}
+	next.Traced = prev.Traced
+}
+
+func (t *RequestTracker) FinishRequest(blockOnTraceSend bool) {
+	t.finishReq(blockOnTraceSend)
+}
+
+type Current struct {
+	Req    *model.Request // can be nil
+	Trace  trace2.Logger  // can be nil
+	Goctr  uint32         // zero if Req == nil && Trace == nil
+	SvcNum uint16         // 0 if not in a service
+}
+
+func (t *RequestTracker) Current() Current {
+	req, tr, goid, svc := t.currentReq()
+	return Current{req, tr, goid, svc}
+}
+
+func (t *RequestTracker) Logger() *zerolog.Logger {
+	if curr := t.Current(); curr.Req != nil && curr.Req.Logger != nil {
+		return curr.Req.Logger
+	}
+	return &t.rootLogger
+}
+
+func (t *RequestTracker) TracingEnabled() bool {
+	return t.trace != nil
+}
+
+func (t *RequestTracker) SampleTrace() bool {
+	return t.trace != nil && t.trace.SampleTrace()
+}
diff --git a/runtimes/go/appruntime/shared/reqtrack/singleton.go b/runtimes/go/appruntime/shared/reqtrack/singleton.go
new file mode 100644
index 0000000000..338c411cb9
--- /dev/null
+++ b/runtimes/go/appruntime/shared/reqtrack/singleton.go
@@ -0,0 +1,24 @@
+//go:build encore_app
+
+package reqtrack
+
+import (
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/logging"
+	"encore.dev/appruntime/shared/platform"
+	"encore.dev/appruntime/shared/traceprovider"
+)
+
+var Singleton *RequestTracker
+
+func init() {
+	var traceFactory traceprovider.Factory
+	tracingEnabled := appconf.Runtime.TraceEndpoint != "" && len(appconf.Runtime.AuthKeys) > 0
+	if tracingEnabled {
+		traceFactory = &traceprovider.DefaultFactory{
+			SampleRate: appconf.Runtime.TraceSamplingRate,
+		}
+	}
+
+	Singleton = New(logging.RootLogger, platform.Singleton, traceFactory)
+}
diff --git a/runtimes/go/appruntime/shared/reqtrack/trace_stream.go b/runtimes/go/appruntime/shared/reqtrack/trace_stream.go
new file mode 100644
index 0000000000..a645a3c530
--- /dev/null
+++ b/runtimes/go/appruntime/shared/reqtrack/trace_stream.go
@@ -0,0 +1,66 @@
+package reqtrack
+
+import (
+	"sync"
+
+	"encore.dev/appruntime/exported/trace2"
+)
+
+type TraceStreamer interface {
+	StreamTrace(trace2.Logger) error
+}
+
+type noopTraceStreamer struct{}
+
+// StreamTrace implements TraceStreamer by consuming the trace log
+// but not doing anything with it.
+func (noopTraceStreamer) StreamTrace(log trace2.Logger) error {
+	for {
+		_, done := log.WaitAndClear()
+		if done {
+			return nil
+		}
+	}
+}
+
+func newLazyTrace(rt *RequestTracker) *lazyTraceInit {
+	log := rt.trace.NewLogger()
+	return &lazyTraceInit{rt: rt, log: log}
+}
+
+// lazyTraceInit is a lazily initialized trace logger.
+// It is used to defer trace streaming until the trace is actually used.
+type lazyTraceInit struct {
+	rt       *RequestTracker
+	log      trace2.Logger
+	initOnce sync.Once
+	sent     sync.WaitGroup
+}
+
+func (l *lazyTraceInit) MarkDone() {
+	l.log.MarkDone()
+	l.initStream()
+}
+
+func (l *lazyTraceInit) Logger() trace2.Logger {
+	l.initStream()
+	return l.log
+}
+
+func (l *lazyTraceInit) WaitForStreamSent() {
+	l.sent.Wait()
+}
+
+func (l *lazyTraceInit) initStream() {
+	l.initOnce.Do(func() {
+		l.sent.Add(1)
+
+		go func() {
+			defer l.sent.Done()
+
+			if err := l.rt.streamer.StreamTrace(l.log); err != nil {
+				l.rt.rootLogger.Error().Err(err).Msg("failed to stream trace")
+			}
+		}()
+	})
+}
diff --git a/runtimes/go/appruntime/shared/serde/utils.go b/runtimes/go/appruntime/shared/serde/utils.go
new file mode 100644
index 0000000000..9687e832aa
--- /dev/null
+++ b/runtimes/go/appruntime/shared/serde/utils.go
@@ -0,0 +1,53 @@
+package serde
+
+import (
+	"bytes"
+	"reflect"
+
+	jsoniter "github.com/json-iterator/go"
+)
+
+type JSONSerializer struct {
+	buffer        *bytes.Buffer
+	stream        *jsoniter.Stream
+	writtenFields int
+}
+
+// SerializeJSONFunc is used by generated code to serialize JSON.
+func SerializeJSONFunc(cfg jsoniter.API, fn func(serializer *JSONSerializer)) ([]byte, error) {
+	s := &JSONSerializer{}
+	s.buffer = new(bytes.Buffer)
+	s.stream = jsoniter.NewStream(cfg, s.buffer, 1024)
+	s.stream.WriteObjectStart()
+	fn(s)
+	s.stream.WriteObjectEnd()
+	err := s.stream.Flush()
+	if err != nil {
+		return nil, err
+	}
+	return s.buffer.Bytes(), s.stream.Error
+}
+
+func (s *JSONSerializer) WriteField(name string, val any, omitEmpty bool) {
+	if omitEmpty && reflect.ValueOf(val).IsZero() {
+		return
+	}
+	if s.writtenFields > 0 {
+		s.stream.WriteMore()
+	}
+	s.stream.WriteObjectField(name)
+	s.stream.WriteVal(val)
+	s.writtenFields++
+}
+
+func SerializeInputs(json jsoniter.API, inputs ...any) ([][]byte, error) {
+	outputs := make([][]byte, len(inputs))
+	for i, input := range inputs {
+		out, err := json.Marshal(input)
+		if err != nil {
+			return nil, err
+		}
+		outputs[i] = out
+	}
+	return outputs, nil
+}
diff --git a/runtimes/go/appruntime/shared/shutdown/shutdown.go b/runtimes/go/appruntime/shared/shutdown/shutdown.go
new file mode 100644
index 0000000000..90e41c32b0
--- /dev/null
+++ b/runtimes/go/appruntime/shared/shutdown/shutdown.go
@@ -0,0 +1,536 @@
+package shutdown
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/signal"
+	"reflect"
+	"runtime"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/encoreenv"
+	"encore.dev/appruntime/shared/health"
+	"encore.dev/beta/errs"
+	"encore.dev/shutdown"
+)
+
+type Handler func(p *Process) error
+
+type Tracker struct {
+	logger zerolog.Logger
+
+	watchSignals bool
+
+	timings processTimings
+
+	initiated chan struct{} // closed when graceful shutdown is initiated
+	once      sync.Once     // to trigger shutdown logic only once
+
+	mu       sync.Mutex
+	handlers []Handler
+}
+
+func NewTracker(runtime *config.Runtime, logger zerolog.Logger) *Tracker {
+	t := &Tracker{
+		watchSignals: runtime.EnvType != "test",
+		initiated:    make(chan struct{}),
+		timings:      timingsFromConfig(runtime),
+	}
+
+	// Determine the appropriate log level.
+	switch {
+	case encoreenv.Get("ENCORE_SHUTDOWN_TRACE") != "":
+		t.logger = logger.Level(zerolog.TraceLevel)
+	case runtime.EnvCloud == "local":
+		// For local development only show errors
+		t.logger = logger.Level(zerolog.ErrorLevel)
+	default:
+		t.logger = logger.Level(zerolog.InfoLevel)
+	}
+
+	return t
+}
+
+type processTimings struct {
+	// keepAcceptingFor is the duration from the moment we receive a SIGTERM
+	// after which we stop accepting new requests. However we will will
+	// report being unhealthy to the load balancer immediately.
+	//
+	// This is needed as in a Kubernetes environment, the pod sent a SIGTERM
+	// once it's replacement is ready, however it will take some time for that
+	// to propagate to the load balancer. If we stop accepting requests immediately
+	// we will have a period of time where the load balancer will still send
+	// requests to the pod, which will be rejected. This will cause the load
+	// balancer to report 502 errors.
+	//
+	// See: https://cloud.google.com/kubernetes-engine/docs/how-to/container-native-load-balancing#traffic_does_not_reach_endpoints
+	keepAcceptingFor time.Duration
+
+	// cancelRunningTasksAfter is the duration (measured from shutdown initiation)
+	// after which running tasks (outstanding API calls & PubSub messages) have
+	// their contexts canceled.
+	cancelRunningTasksAfter time.Duration
+
+	// forceCloseTasksGrace is the duration (measured from when canceling running tasks)
+	// after which the tasks are considered done, even if they're still running.
+	forceCloseTasksGrace time.Duration
+
+	// forceShutdownAfter is the duration (measured from shutdown initiation)
+	// after which the shutdown process enters the "force shutdown" phase,
+	// tearing down infrastructure resources.
+	forceShutdownAfter time.Duration
+
+	// forceShutdownGrace is the grace period after beginning the force shutdown
+	// before the shutdown is marked as completed, causing the process to exit.
+	forceShutdownGrace time.Duration
+}
+
+func timingsFromConfig(runtime *config.Runtime) processTimings {
+	// Setup the config
+	var cfg config.GracefulShutdownTimings
+	if runtime.GracefulShutdown != nil {
+		cfg = *runtime.GracefulShutdown
+	}
+
+	t := processTimings{
+		keepAcceptingFor:     0,
+		forceCloseTasksGrace: 1 * time.Second,
+		forceShutdownGrace:   1 * time.Second,
+	}
+
+	// Handle the migration from ShutdownTimout to GracefulShutdown configuration
+	var totalTime time.Duration
+	if cfg.Total == nil {
+		t.forceShutdownAfter = runtime.ShutdownTimeout
+		if t.forceShutdownAfter <= 0 {
+			t.forceShutdownAfter = 5 * time.Second
+		}
+		totalTime = runtime.ShutdownTimeout
+	} else {
+		t.forceShutdownAfter = *cfg.Total - t.forceShutdownGrace
+		if t.forceShutdownAfter <= 0 {
+			t.forceShutdownAfter = 500 * time.Millisecond
+		}
+		totalTime = *cfg.Total
+	}
+
+	// Get the handler timeout
+	if cfg.Handlers == nil {
+		t.cancelRunningTasksAfter = t.forceShutdownAfter - t.forceCloseTasksGrace
+	} else {
+		t.cancelRunningTasksAfter = *cfg.Handlers
+	}
+	if t.cancelRunningTasksAfter < 0 {
+		t.cancelRunningTasksAfter = 0
+	}
+
+	k8sGraceTimeSecs := encoreenv.Get("ENCORE_K8S_GRACE_TERMINATION_SECONDS")
+	if k8sGraceTimeSecs != "" {
+		if graceSecs, err := strconv.Atoi(k8sGraceTimeSecs); err != nil {
+			panic(fmt.Sprintf("invalid value for ENCORE_K8S_GRACE_TERMINATION_SECONDS (sepected an interger): %s", err))
+		} else {
+			// If we know what the grace termination is for the kubernetes pods, we want to keep accepting new traffic
+			// for almost all of that duration - minus what the Encore runtime needs to perform a graceful shutdown.
+			//
+			// We'll immediately report a health failure when SIGTERM is received, however we'll still accept new
+			// traffic as we wait for routers and load balancers to update have propergated that we're trying
+			// to cleanly shutdown.
+			t.keepAcceptingFor = (time.Duration(graceSecs) * time.Second) - totalTime
+			if t.keepAcceptingFor < 0 {
+				t.keepAcceptingFor = 0
+			}
+		}
+	}
+
+	return t
+}
+
+// WatchForShutdownSignals watches for shutdown signals (SIGTERM, SIGINT)
+// and triggers the graceful shutdown when such a signal is received.
+func (t *Tracker) WatchForShutdownSignals() {
+	if !t.watchSignals {
+		return
+	}
+
+	gracefulSignal := make(chan os.Signal, 1)
+	signal.Notify(gracefulSignal, syscall.SIGTERM, syscall.SIGINT)
+
+	go func() {
+		signalReceived := <-gracefulSignal
+		t.Shutdown(signalReceived, nil)
+	}()
+}
+
+// RegisterShutdownHandler registers a shutdown handler that will be called when the app
+// is gracefully shutting down.
+//
+// The given context is closed when the graceful shutdown window is closed and it's
+// time to forcefully shut down. force.Deadline() can be inspected to learn when this
+// will happen in advance.
+//
+// The shutdown is cooperative: the process will not exit until all shutdown hooks
+// have returned, unless the process is forcefully killed by a signal (which may happen
+// in certain cloud environments if the graceful shutdown takes longer than its timeout).
+//
+// If t is nil this function is a no-op.
+func (t *Tracker) RegisterShutdownHandler(fn Handler) {
+	if t == nil {
+		return
+	}
+
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	t.handlers = append(t.handlers, fn)
+}
+
+// ShutdownInitiated reports whether graceful shutdown has been initiated.
+func (t *Tracker) ShutdownInitiated() bool {
+	select {
+	case <-t.initiated:
+		return true
+	default:
+		return false
+	}
+}
+
+func functionName(fn any) (rtn string) {
+	defer func() {
+		if r := recover(); r != nil && rtn == "" {
+			rtn = fmt.Sprintf("<panic getting function name: %v>", r)
+		}
+	}()
+
+	return strings.TrimSuffix(runtime.FuncForPC(reflect.ValueOf(fn).Pointer()).Name(), "-fm")
+}
+
+// HealthCheck returns an health check failure once a SIGTERM has been received.
+//
+// This is to allow load balancers to detect this instance is shutting down
+// and should not be routed to for new traffic.
+func (t *Tracker) HealthCheck(_ context.Context) []health.CheckResult {
+	var reportError error
+	if t.ShutdownInitiated() {
+		reportError = errors.New("SIGTERM has been received, graceful shutdown started")
+	}
+
+	return []health.CheckResult{{
+		Name: "shutdown-signal-monitoring",
+		Err:  reportError,
+	}}
+}
+
+// Shutdown triggers the shutdown logic.
+// If it has already been triggered, it does nothing and returns immediately.
+func (t *Tracker) Shutdown(reasonSignal os.Signal, reasonError error) {
+	t.once.Do(func() {
+		close(t.initiated)
+
+		if reasonError != nil {
+			t.logger.Err(reasonError).Msg("a fatal error occurred, initiating graceful shutdown")
+		} else if reasonSignal != nil {
+			t.logger.Info().Str("signal", reasonSignal.String()).Msg("got shutdown signal, initiating graceful shutdown")
+		} else {
+			t.logger.Trace().Msg("initiating graceful shutdown")
+		}
+
+		// If we received a SIGTERM and have a configured keepAcceptingFor duration
+		// then log the fact we're going to continue accepting new requests and then
+		// sleep for that time before begining to graceful shutdown.
+		if reasonSignal == syscall.SIGTERM && t.timings.keepAcceptingFor > 0 {
+			t.logger.Info().Str("duration", t.timings.keepAcceptingFor.String()).Msg("continuing to accept requests for a short period of time to allow the load balancer to update")
+			time.Sleep(t.timings.keepAcceptingFor)
+			t.logger.Info().Msg("stopping to accept new requests and continuing graceful shutdown")
+		}
+
+		p := t.beginShutdownProcess()
+		go t.runShutdownHandlers(p)
+		t.exitOnCompletion(p)
+	})
+}
+
+// Process mirrors [encore.dev/shutdown.Progress] but has internal fields
+// for controlling the behavior.
+type Process struct {
+	Log                       *zerolog.Logger
+	OutstandingRequests       context.Context
+	cancelOutstandingRequests context.CancelFunc
+
+	OutstandingPubSubMessages       context.Context
+	cancelOutstandingPubSubMessages context.CancelFunc
+
+	OutstandingTasks       context.Context
+	cancelOutstandingTasks context.CancelFunc
+
+	ForceCloseTasks       context.Context
+	cancelForceCloseTasks context.CancelFunc
+
+	ServicesShutdownCompleted     context.Context
+	markServicesShutdownCompleted context.CancelCauseFunc
+
+	ForceShutdown       context.Context
+	cancelForceShutdown context.CancelFunc
+
+	handlersCompleted     context.Context
+	markHandlersCompleted context.CancelCauseFunc
+
+	// ShutdownCompleted is closed when all shutdown hooks have returned.
+	ShutdownCompleted     context.Context
+	markShutdownCompleted context.CancelCauseFunc
+}
+
+// cleanShutdown is a sentinel error used by the shutdown logic to indicate
+// a clean shutdown, via context.Cause.
+var cleanShutdown = errors.New("clean shutdown")
+
+func (t *Tracker) beginShutdownProcess() *Process {
+	start := time.Now()
+
+	tt := t.timings
+	outstandingTasks, cancelOutstandingTasks := context.WithDeadline(context.Background(), start.Add(tt.cancelRunningTasksAfter+tt.forceCloseTasksGrace))
+	outstandingRequests, cancelOutstandingRequests := context.WithCancel(outstandingTasks)
+	outstandingPubSubMessages, cancelOutstandingPubSubMessages := context.WithCancel(outstandingTasks)
+
+	forceCloseTasks, cancelForceCloseTasks := context.WithDeadline(outstandingTasks, start.Add(tt.cancelRunningTasksAfter))
+
+	forceShutdown, cancelForceShutdown := context.WithDeadline(context.Background(), start.Add(tt.forceShutdownAfter))
+
+	serviceShutdownCompleted, cancelServiceShutdownCompleted := context.WithCancelCause(context.Background())
+	handlersCompleted, cancelHandlersCompleted := context.WithCancelCause(context.Background())
+
+	shutdownCompleted, cancelShutdownCompleted := context.WithCancelCause(context.Background())
+
+	// Close the runningHandlers context when both
+	// outstandingRequests and outstandingPubSubMessages are done.
+	go func() {
+		<-outstandingRequests.Done()
+		<-outstandingPubSubMessages.Done()
+		cancelOutstandingTasks()
+
+		// This is redundant (the context is derived from runningTasks),
+		// but it makes the linter happy.
+		cancelForceCloseTasks()
+	}()
+
+	// Cancel forceShutdown early if running tasks and handlers complete.
+	go func() {
+		<-outstandingTasks.Done()
+		<-handlersCompleted.Done()
+		cancelForceShutdown()
+	}()
+
+	// Mark the shutdown completed.
+	go func() {
+		<-forceShutdown.Done()
+		// When forceShutdown is done, see if it was due to reaching the deadline (unclean shutdown)
+		// or if we canceled the context early (clean shutdown).
+		if errors.Is(forceShutdown.Err(), context.Canceled) {
+			cancelShutdownCompleted(cleanShutdown)
+			return
+		} else {
+			// We reached the deadline. The ForceShutdown context was canceled just now,
+			// so give it another second to let the shutdown handlers finish.
+			timeout, cancel := context.WithTimeout(handlersCompleted, tt.forceShutdownGrace)
+			defer cancel()
+			<-timeout.Done()
+
+			if errors.Is(timeout.Err(), context.Canceled) {
+				// The handlers did eventually complete, so this is a clean shutdown.
+				cancelShutdownCompleted(cleanShutdown)
+			} else {
+				cancelShutdownCompleted(timeout.Err())
+			}
+		}
+	}()
+
+	return &Process{
+		Log:                       &t.logger,
+		OutstandingRequests:       outstandingRequests,
+		cancelOutstandingRequests: cancelOutstandingRequests,
+
+		OutstandingPubSubMessages:       outstandingPubSubMessages,
+		cancelOutstandingPubSubMessages: cancelOutstandingPubSubMessages,
+
+		OutstandingTasks:       outstandingTasks,
+		cancelOutstandingTasks: cancelOutstandingTasks,
+
+		ForceCloseTasks:       forceCloseTasks,
+		cancelForceCloseTasks: cancelForceCloseTasks,
+
+		ForceShutdown:       forceShutdown,
+		cancelForceShutdown: cancelForceShutdown,
+
+		ServicesShutdownCompleted:     serviceShutdownCompleted,
+		markServicesShutdownCompleted: cancelServiceShutdownCompleted,
+
+		handlersCompleted:     handlersCompleted,
+		markHandlersCompleted: cancelHandlersCompleted,
+
+		ShutdownCompleted:     shutdownCompleted,
+		markShutdownCompleted: cancelShutdownCompleted,
+	}
+}
+
+// Progress converts p into the public shutdown.Progress type.
+func (p *Process) Progress() shutdown.Progress {
+	return shutdown.Progress{
+		OutstandingRequests:       p.OutstandingRequests,
+		OutstandingPubSubMessages: p.OutstandingPubSubMessages,
+		OutstandingTasks:          p.OutstandingTasks,
+		ForceCloseTasks:           p.ForceCloseTasks,
+		ForceShutdown:             p.ForceShutdown,
+	}
+}
+
+func (p *Process) MarkOutstandingRequestsCompleted() {
+	p.cancelOutstandingRequests()
+}
+
+func (p *Process) MarkOutstandingPubSubMessagesCompleted() {
+	p.cancelOutstandingPubSubMessages()
+}
+
+func (p *Process) MarkServicesShutdownCompleted(err error) {
+	// TODO change error type to capture where the service came from
+	if err != nil {
+		p.markServicesShutdownCompleted(err)
+	} else {
+		p.markServicesShutdownCompleted(cleanShutdown)
+	}
+}
+
+// WasCleanShutdown reports whether the shutdown was clean.
+// Its return value is undefined before p.shutdownCompleted is closed.
+func (p *Process) WasCleanShutdown() bool {
+	return errors.Is(context.Cause(p.ShutdownCompleted), cleanShutdown)
+}
+
+type shutdownError struct {
+	handlerName string
+	err         error
+}
+
+func (e shutdownError) Error() string {
+	return fmt.Sprintf("shutdown handler %q: %v", e.handlerName, e.err)
+}
+
+func (e shutdownError) Unwrap() error {
+	return e.err
+}
+
+type shutdownErrors struct {
+	errors []error
+}
+
+func (e shutdownErrors) Unwrap() []error {
+	return e.errors
+}
+
+func (e shutdownErrors) Error() string {
+	switch len(e.errors) {
+	case 0:
+		return "no shutdown errors"
+	case 1:
+		return e.errors[0].Error()
+	default:
+		var buf strings.Builder
+		buf.WriteString("multiple shutdown errors: ")
+		for i, err := range e.errors {
+			if i > 0 {
+				buf.WriteString("; ")
+			}
+			buf.WriteString(err.Error())
+		}
+		return buf.String()
+	}
+}
+
+// runShutdownHandlers runs the registered shutdown handlers.
+func (t *Tracker) runShutdownHandlers(p *Process) {
+	var (
+		shutdownErrorMu sync.Mutex
+		shutdownErrs    []error
+	)
+	addShutdownErr := func(err shutdownError) {
+		shutdownErrorMu.Lock()
+		defer shutdownErrorMu.Unlock()
+		shutdownErrs = append(shutdownErrs, err)
+	}
+
+	// Mark the handlers as completed when we're done.
+	defer func() {
+		shutdownErrorMu.Lock()
+		errList := shutdownErrs
+		shutdownErrorMu.Unlock()
+
+		// Determine the error to use.
+		var shutdownErr error
+		if len(errList) > 0 {
+			shutdownErr = shutdownErrors{errors: errList}
+		}
+
+		t.logger.Trace().Err(shutdownErr).Msg("all shutdown hooks completed")
+
+		if shutdownErr != nil {
+			p.markHandlersCompleted(shutdownErr)
+		} else {
+			p.markHandlersCompleted(cleanShutdown)
+		}
+	}()
+
+	t.mu.Lock()
+	handlers := t.handlers
+	t.mu.Unlock()
+
+	var wg sync.WaitGroup
+	wg.Add(len(handlers))
+
+	for _, fn := range handlers {
+		fn := fn
+		name := functionName(fn)
+		go func() {
+			defer wg.Done()
+			defer func() {
+				if r := recover(); r != nil {
+					err := shutdownError{
+						handlerName: name,
+						err:         errs.B().Msgf("panic: %s", r).Err(),
+					}
+					addShutdownErr(err)
+					t.logger.Err(err).Interface("panic", r).Msg("panic encountered during shutdown hook")
+				}
+			}()
+
+			defer t.logger.Trace().Str("hook", name).Msg("shutdown hook completed")
+			t.logger.Trace().Str("hook", name).Msg("running shutdown hook...")
+			if err := fn(p); err != nil {
+				shutdownErr := shutdownError{handlerName: name, err: err}
+				t.logger.Error().Err(shutdownErr).Str("hook", name).Msg("shutdown handler returned an error")
+				addShutdownErr(shutdownErr)
+			}
+		}()
+	}
+
+	wg.Wait()
+}
+
+// exitOnCompletion exits the process when the shutdown is completed.
+func (t *Tracker) exitOnCompletion(p *Process) {
+	<-p.ShutdownCompleted.Done()
+
+	if p.WasCleanShutdown() {
+		t.logger.Trace().Msg("graceful shutdown completed")
+		os.Exit(0)
+	} else {
+		t.logger.Trace().Msg("graceful shutdown window closed, forcing shutdown")
+		os.Exit(1)
+	}
+}
diff --git a/runtimes/go/appruntime/shared/shutdown/singleton.go b/runtimes/go/appruntime/shared/shutdown/singleton.go
new file mode 100644
index 0000000000..8582f33e06
--- /dev/null
+++ b/runtimes/go/appruntime/shared/shutdown/singleton.go
@@ -0,0 +1,18 @@
+//go:build encore_app
+
+package shutdown
+
+import (
+	"encore.dev/appruntime/shared/health"
+
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/logging"
+)
+
+var Singleton *Tracker
+
+func init() {
+	Singleton = NewTracker(appconf.Runtime, logging.RootLogger)
+	health.Singleton.Register(Singleton)
+	Singleton.WatchForShutdownSignals()
+}
diff --git a/runtimes/go/appruntime/shared/syncutil/once.go b/runtimes/go/appruntime/shared/syncutil/once.go
new file mode 100644
index 0000000000..a3858268c9
--- /dev/null
+++ b/runtimes/go/appruntime/shared/syncutil/once.go
@@ -0,0 +1,63 @@
+/*
+Copyright 2014 The Perkeep Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package syncutil
+
+import (
+	"sync"
+	"sync/atomic"
+)
+
+// A Once will perform a successful action exactly once.
+//
+// Unlike a sync.Once, this Once's func returns an error
+// and is re-armed on failure.
+type Once struct {
+	m    sync.Mutex
+	done uint32
+}
+
+// Do calls the function f if and only if Do has not been invoked
+// without error for this instance of Once.  In other words, given
+//
+//	var once Once
+//
+// if once.Do(f) is called multiple times, only the first call will
+// invoke f, even if f has a different value in each invocation unless
+// f returns an error.  A new instance of Once is required for each
+// function to execute.
+//
+// Do is intended for initialization that must be run exactly once.  Since f
+// is niladic, it may be necessary to use a function literal to capture the
+// arguments to a function to be invoked by Do:
+//
+//	err := config.once.Do(func() error { return config.init(filename) })
+func (o *Once) Do(f func() error) error {
+	if atomic.LoadUint32(&o.done) == 1 {
+		return nil
+	}
+	// Slow-path.
+	o.m.Lock()
+	defer o.m.Unlock()
+	var err error
+	if o.done == 0 {
+		err = f()
+		if err == nil {
+			atomic.StoreUint32(&o.done, 1)
+		}
+	}
+	return err
+}
diff --git a/runtimes/go/appruntime/shared/syncutil/once_test.go b/runtimes/go/appruntime/shared/syncutil/once_test.go
new file mode 100644
index 0000000000..7efaea13a8
--- /dev/null
+++ b/runtimes/go/appruntime/shared/syncutil/once_test.go
@@ -0,0 +1,73 @@
+package syncutil
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestOnce(t *testing.T) {
+	timesRan := 0
+	f := func() error {
+		timesRan++
+		return nil
+	}
+
+	once := Once{}
+
+	const numCalls = 10
+	results := make(chan error, numCalls)
+
+	for i := 0; i < numCalls; i++ {
+		go func() {
+			results <- once.Do(f)
+		}()
+	}
+
+	for i := 0; i < numCalls; i++ {
+		if err := <-results; err != nil {
+			t.Errorf("Expected no errors, got %v", err)
+		}
+	}
+
+	if timesRan != 1 {
+		t.Errorf("Expected to run one time, ran %d", timesRan)
+	}
+}
+
+// TestOnceErroring verifies we retry on every error, but stop after
+// the first success.
+func TestOnceErroring(t *testing.T) {
+	timesRan := 0
+	f := func() error {
+		timesRan++
+		if timesRan < 3 {
+			return errors.New("retry")
+		}
+		return nil
+	}
+
+	once := Once{}
+	const numCalls = 10
+	results := make(chan error, numCalls)
+
+	for i := 0; i < numCalls; i++ {
+		go func() {
+			results <- once.Do(f)
+		}()
+	}
+
+	numErrs := 0
+	for i := 0; i < numCalls; i++ {
+		if err := <-results; err != nil {
+			numErrs++
+		}
+	}
+
+	if numErrs != 2 {
+		t.Errorf("Expected two errors, got %d", numErrs)
+	}
+
+	if timesRan != 3 {
+		t.Errorf("Expected to run two times, ran %d", timesRan)
+	}
+}
diff --git a/runtimes/go/appruntime/shared/syncutil/syncutil.go b/runtimes/go/appruntime/shared/syncutil/syncutil.go
new file mode 100644
index 0000000000..424150a1a1
--- /dev/null
+++ b/runtimes/go/appruntime/shared/syncutil/syncutil.go
@@ -0,0 +1,20 @@
+// Package syncutil is a vendored version of go4.org/syncutil.Once.
+
+/*
+Copyright 2014 The Perkeep Authors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package syncutil provides various synchronization utilities.
+package syncutil
diff --git a/runtimes/go/appruntime/shared/testsupport/runtimehooks_app.go b/runtimes/go/appruntime/shared/testsupport/runtimehooks_app.go
new file mode 100644
index 0000000000..82c1e70ba1
--- /dev/null
+++ b/runtimes/go/appruntime/shared/testsupport/runtimehooks_app.go
@@ -0,0 +1,76 @@
+//go:build encore_app
+
+package testsupport
+
+import (
+	"strings"
+	"testing"
+	_ "unsafe" // for go:linkname
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/logging"
+	"encore.dev/appruntime/shared/reqtrack"
+)
+
+var Singleton = NewManager(appconf.Static, reqtrack.Singleton, logging.RootLogger)
+
+func isGeneratedWrapperTest(t *testing.T) bool {
+	// A test with an empty name is the generated wrapper test that Go adds around all the users tests.
+	// we don't want to treat this as a real test, so we ignore it.
+	return t.Name() == ""
+}
+
+//go:linkname encoreStartTest testing.encoreStartTest
+func encoreStartTest(t *testing.T, fn func(t *testing.T)) {
+	if isGeneratedWrapperTest(t) {
+		return
+	}
+	Singleton.StartTest(t, fn)
+}
+
+//go:linkname encorePauseTest testing.encorePauseTest
+func encorePauseTest(t *testing.T) {
+	if isGeneratedWrapperTest(t) {
+		return
+	}
+	Singleton.PauseTest(t)
+}
+
+//go:linkname encoreResumeTest testing.encoreResumeTest
+func encoreResumeTest(t *testing.T) {
+	if isGeneratedWrapperTest(t) {
+		return
+	}
+	Singleton.ResumeTest(t)
+}
+
+//go:linkname encoreEndTest testing.encoreEndTest
+func encoreEndTest(t *testing.T) {
+	if isGeneratedWrapperTest(t) {
+		return
+	}
+	Singleton.EndTest(t)
+}
+
+//go:linkname encoreTestLog testing.encoreTestLog
+func encoreTestLog(line string, frameSkip int) {
+	curr := Singleton.rt.Current()
+	if curr.Req != nil && curr.Trace != nil {
+		curr.Trace.LogMessage(trace2.LogMessageParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+			},
+			Level: model.LevelTrace,
+
+			// Note all trace logs have 4 spaces added to every line, so we don't want "trimspace"
+			Msg:    strings.TrimRight(line, " \n\r\t"),
+			Stack:  stack.Build(frameSkip + 1),
+			Fields: nil,
+		})
+	}
+}
diff --git a/runtimes/go/appruntime/shared/testsupport/testconfig.go b/runtimes/go/appruntime/shared/testsupport/testconfig.go
new file mode 100644
index 0000000000..1976d80ce2
--- /dev/null
+++ b/runtimes/go/appruntime/shared/testsupport/testconfig.go
@@ -0,0 +1,44 @@
+package testsupport
+
+import (
+	"sync/atomic"
+
+	"encore.dev/appruntime/exported/model"
+)
+
+type TestConfig = model.TestConfig
+
+var (
+	nextApiMockID atomic.Uint64
+)
+
+func newTestConfig(parent *model.TestConfig) *model.TestConfig {
+	return &model.TestConfig{
+		Parent:       parent,
+		ServiceMocks: make(map[string]model.ServiceMock),
+		APIMocks:     make(map[string]map[string]model.ApiMock),
+	}
+}
+
+// walkConfig walks the test config hierarchy, starting from the given config, and calls the given function on each
+// until the function returns true.
+//
+// walkConfig takes care to lock and unlock the read mutex on the config hierarchy as it walks it.
+func walkConfig[T any](config *model.TestConfig, f func(*model.TestConfig) (value T, found bool)) (value T, found bool) {
+	exec := func(config *model.TestConfig) (value T, found bool) {
+		config.Mu.RLock()
+		defer config.Mu.RUnlock()
+		return f(config)
+	}
+
+	for config != nil {
+		value, found := exec(config)
+		if found {
+			return value, found
+		}
+
+		config = config.Parent
+	}
+
+	return value, false
+}
diff --git a/runtimes/go/appruntime/shared/testsupport/testsupport.go b/runtimes/go/appruntime/shared/testsupport/testsupport.go
new file mode 100644
index 0000000000..65c44d7296
--- /dev/null
+++ b/runtimes/go/appruntime/shared/testsupport/testsupport.go
@@ -0,0 +1,346 @@
+package testsupport
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"reflect"
+	"runtime"
+	"runtime/debug"
+	"slices"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+	_ "unsafe" // for go:linkname
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/appruntime/shared/reqtrack"
+)
+
+type Manager struct {
+	static         *config.Static
+	rt             *reqtrack.RequestTracker
+	rootLogger     zerolog.Logger
+	rootTestConfig *TestConfig
+
+	wd              string
+	testServiceOnce sync.Once
+	testService     string
+	testServiceNum  uint16
+}
+
+func NewManager(static *config.Static, rt *reqtrack.RequestTracker, rootLogger zerolog.Logger) *Manager {
+	wd, _ := os.Getwd()
+	return &Manager{static: static, rt: rt, rootLogger: rootLogger, wd: wd, rootTestConfig: newTestConfig(nil)}
+}
+
+// StartTest is called when a test starts running. This allows Encore's testing framework to
+// isolate behavior between different tests on global state.
+func (mgr *Manager) StartTest(t *testing.T, fn func(*testing.T)) {
+	var parent *model.Request
+	parentConfig := mgr.rootTestConfig
+
+	// Convert the fn pointer to a file/line number if possible
+	// This is useful for debugging tests that are hanging
+	var testFile string
+	var testLine int
+	fnPtr := reflect.ValueOf(fn).Pointer()
+	if f := runtime.FuncForPC(fnPtr); f != nil {
+		testFile, testLine = f.FileLine(fnPtr)
+
+		if mgr.static.TestAppRootPath != "" {
+			testFile = strings.TrimPrefix(testFile, mgr.static.TestAppRootPath+string(filepath.Separator))
+		}
+	}
+
+	var traceID model.TraceID
+	var parentSpanID model.SpanID
+	if curr := mgr.rt.Current(); curr.Req != nil {
+		parent = curr.Req
+		traceID = curr.Req.TraceID
+		parentSpanID = curr.Req.ParentSpanID
+		parentConfig = curr.Req.Test.Config
+	}
+
+	spanID, err := model.GenSpanID()
+	if err != nil {
+		t.Fatalf("encoreStartTest: failed to generate span ID: %v", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	logger := mgr.rootLogger.With().Str("test", t.Name()).Logger()
+
+	testService, svcNum := mgr.TestService()
+
+	if traceID.IsZero() {
+		id, err := model.GenTraceID()
+		if err != nil {
+			t.Fatalf("encoreStartTest: failed to generate trace ID: %v", err)
+		}
+		traceID = id
+	}
+
+	req := &model.Request{
+		Type:         model.Test,
+		TraceID:      traceID,
+		SpanID:       spanID,
+		ParentSpanID: parentSpanID,
+		Start:        time.Now(),
+		Traced:       mgr.rt.TracingEnabled(),
+		Test: &model.TestData{
+			Ctx:              ctx,
+			Cancel:           cancel,
+			Current:          t,
+			Parent:           parent,
+			Service:          testService,
+			TestFile:         testFile,
+			TestLine:         uint32(testLine),
+			Config:           newTestConfig(parentConfig),
+			ServiceInstances: make(map[string]any),
+		},
+		Logger: &logger,
+		SvcNum: svcNum,
+	}
+	mgr.rt.BeginRequest(req)
+	if curr := mgr.rt.Current(); curr.Trace != nil {
+		curr.Trace.TestSpanStart(req, curr.Goctr)
+	}
+}
+
+// PauseTest is called when a test is paused. This allows Encore's testing framework to
+// isolate behavior between different tests on global state.
+func (mgr *Manager) PauseTest(t *testing.T) {
+}
+
+// ResumeTest is called when a test is resumed after being paused. This allows Encore's testing framework to clear down any state from the test
+// and to perform any assertions on that state that it needs to.
+func (mgr *Manager) ResumeTest(t *testing.T) {
+	req := mgr.rt.Current().Req
+	if req == nil || req.Test == nil {
+		panic("encoreResumeTest: no active test")
+	}
+	if req.Test.Current != t {
+		panic("encoreResumeTest: active test is not this test")
+	}
+
+	// Tests get paused when they call `t.Parallel()` and are held there until the parent test
+	// completes, at which case all parallel child tests are resumed.
+	// As such, we assume that the test actually "starts" from now
+	req.Start = time.Now()
+}
+
+// EndTest is called when a test ends. This allows Encore's testing framework to clear down any state from the test
+// and to perform any assertions on that state that it needs to.
+func (mgr *Manager) EndTest(t *testing.T) {
+	curr := mgr.rt.Current()
+	req := curr.Req
+	if req == nil || req.Test == nil {
+		panic("encoreEndTest: no active test")
+	}
+	if req.Test.Current != t {
+		panic("encoreEndTest: active test is not this test")
+	}
+	testData := req.Test
+
+	// Wait for any async code to finish up-to 30 seconds
+	// if any async code is still running after 30 seconds, we'll fail the test
+	done := make(chan struct{})
+	go func() {
+		testData.Wait.Wait()
+		done <- struct{}{}
+	}()
+	select {
+	case <-time.After(30 * time.Second):
+		t.Errorf("test timed out waiting for async code to finish after 30 seconds")
+		t.Fail()
+
+		// Now cancel to context to try and force those go-routines to exit
+		testData.Cancel()
+	case <-done:
+	}
+
+	// Run end callbacks.
+	(func() {
+		defer func() {
+			if err := recover(); err != nil {
+				t.Errorf("encore: internal error: panic occured running test end callback: %v\n\n%s", err, debug.Stack())
+			}
+		}()
+		for _, cb := range testData.Config.EndCallbacks {
+			cb(t)
+		}
+	})()
+
+	if curr.Trace != nil {
+		curr.Trace.TestSpanEnd(trace2.TestSpanEndParams{
+			EventParams: trace2.EventParams{TraceID: req.TraceID, SpanID: req.SpanID},
+			Req:         req,
+			Failed:      t.Failed(),
+			Skipped:     t.Skipped(),
+		})
+	}
+
+	mgr.rt.FinishRequest(true)
+}
+
+// CurrentTest returns the currently running test.
+// If no test is running, it panics.
+func (mgr *Manager) CurrentTest() *testing.T {
+	td := mgr.current()
+	return td.Current
+}
+
+// current returns the currently running test data.
+// If no test is running, it panics.
+func (mgr *Manager) current() *model.TestData {
+	req := mgr.rt.Current().Req
+	if req == nil || req.Test == nil {
+		panic("CurrentTest: no active test")
+	}
+	return req.Test
+}
+
+func (mgr *Manager) TestService() (svcName string, svcNum uint16) {
+	mgr.testServiceOnce.Do(func() {
+		for svc, path := range mgr.static.TestServiceMap {
+			if mgr.wd == path || strings.HasPrefix(mgr.wd, path+string(filepath.Separator)) {
+				mgr.testService = svc
+				mgr.testServiceNum = uint16(slices.Index(mgr.static.BundledServices, svc) + 1)
+				break
+			}
+		}
+	})
+
+	return mgr.testService, mgr.testServiceNum
+}
+
+// RunAsyncCodeInTest allows us to trigger code to run asynchronously in a test
+// to emulate real world async race scenarios.
+//
+// This works by running `f` in a new Go routine which can process the "request"
+// however, the test will not be able to finish until the go runtime exits
+func (mgr *Manager) RunAsyncCodeInTest(t *testing.T, f func(ctx context.Context)) {
+	td := mgr.current()
+	if td.Current != t {
+		panic("RunAsyncCodeInTest: active test is not this test")
+	}
+	td.Wait.Add(1)
+
+	go func() {
+		defer func() {
+			if err := recover(); err != nil {
+				t.Errorf("panic occured: %v\n\n%s", err, debug.Stack())
+				t.Fail()
+			}
+
+			td.Wait.Done()
+		}()
+
+		f(td.Ctx)
+	}()
+}
+
+// currentConfig returns the current test config object
+func (mgr *Manager) currentConfig() *TestConfig {
+	req := mgr.rt.Current().Req
+	if req == nil || req.Test == nil {
+		return mgr.rootTestConfig
+	}
+
+	if req.Test.Config == nil {
+		panic("currentConfig: no active test config even though in test")
+	}
+
+	return req.Test.Config
+}
+
+// SetIsolatedServices sets whether isolated services should be enabled for the current test
+func (mgr *Manager) SetIsolatedServices(enabled bool) {
+	cfg := mgr.currentConfig()
+	cfg.Mu.Lock()
+	defer cfg.Mu.Unlock()
+	cfg.IsolatedServices = &enabled
+}
+
+// GetIsolatedServices returns whether isolated services are enabled for the current test
+func (mgr *Manager) GetIsolatedServices() bool {
+	result, _ := walkConfig(mgr.currentConfig(), func(cfg *TestConfig) (value *bool, found bool) {
+		value, found = cfg.IsolatedServices, cfg.IsolatedServices != nil
+		return
+	})
+
+	if result == nil {
+		return false
+	}
+	return *result
+}
+
+// SetServiceMock allows us to set a mock for a service for the current test
+func (mgr *Manager) SetServiceMock(service string, mock any, runMiddleware bool) {
+	service = strings.TrimSpace(strings.ToLower(service))
+
+	cfg := mgr.currentConfig()
+	cfg.Mu.Lock()
+	defer cfg.Mu.Unlock()
+	cfg.ServiceMocks[service] = model.ServiceMock{
+		Service:       mock,
+		RunMiddleware: runMiddleware,
+	}
+}
+
+// GetServiceMock allows us to get a mock for a service for the current test
+// or any parent tests - returning the lowest level mock available.
+func (mgr *Manager) GetServiceMock(service string) (model.ServiceMock, bool) {
+	service = strings.TrimSpace(strings.ToLower(service))
+
+	return walkConfig(mgr.currentConfig(), func(cfg *TestConfig) (value model.ServiceMock, found bool) {
+		value, found = cfg.ServiceMocks[service]
+		return
+	})
+}
+
+// SetAPIMock allows us to set a mock for an API for the current test
+func (mgr *Manager) SetAPIMock(service string, api string, mock any, runMiddleware bool) {
+	service = strings.TrimSpace(strings.ToLower(service))
+	api = strings.TrimSpace(strings.ToLower(api))
+
+	cfg := mgr.currentConfig()
+	cfg.Mu.Lock()
+	defer cfg.Mu.Unlock()
+
+	if cfg.APIMocks[service] == nil {
+		cfg.APIMocks[service] = make(map[string]model.ApiMock)
+	}
+	cfg.APIMocks[service][api] = model.ApiMock{
+		ID:            nextApiMockID.Add(1),
+		Function:      mock,
+		RunMiddleware: runMiddleware,
+	}
+}
+
+// GetAPIMock allows us to get a mock for an API for the current test
+// or any parent tests - returning the lowest level mock available.
+func (mgr *Manager) GetAPIMock(service string, api string) (model.ApiMock, bool) {
+	service = strings.TrimSpace(strings.ToLower(service))
+	api = strings.TrimSpace(strings.ToLower(api))
+
+	return walkConfig(mgr.currentConfig(), func(cfg *TestConfig) (value model.ApiMock, found bool) {
+		if cfg.APIMocks[service] == nil {
+			return
+		}
+		value, found = cfg.APIMocks[service][api]
+		return
+	})
+}
+
+func (mgr *Manager) AddEndCallback(fn func(t *testing.T)) {
+	cfg := mgr.currentConfig()
+	cfg.Mu.Lock()
+	defer cfg.Mu.Unlock()
+	cfg.EndCallbacks = append(cfg.EndCallbacks, fn)
+}
diff --git a/runtimes/go/appruntime/shared/traceprovider/mock_trace/factory.go b/runtimes/go/appruntime/shared/traceprovider/mock_trace/factory.go
new file mode 100644
index 0000000000..a14952cbe9
--- /dev/null
+++ b/runtimes/go/appruntime/shared/traceprovider/mock_trace/factory.go
@@ -0,0 +1,22 @@
+package mock_trace
+
+import (
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/appruntime/shared/traceprovider"
+)
+
+func NewMockFactory(log *MockLogger) traceprovider.Factory {
+	return &mockFactory{log}
+}
+
+type mockFactory struct {
+	log *MockLogger
+}
+
+func (f *mockFactory) NewLogger() trace2.Logger {
+	return f.log
+}
+
+func (f *mockFactory) SampleTrace() bool {
+	return true
+}
diff --git a/runtimes/go/appruntime/shared/traceprovider/mock_trace/mock_trace.go b/runtimes/go/appruntime/shared/traceprovider/mock_trace/mock_trace.go
new file mode 100644
index 0000000000..7e05c7c1d2
--- /dev/null
+++ b/runtimes/go/appruntime/shared/traceprovider/mock_trace/mock_trace.go
@@ -0,0 +1,555 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./logger.go
+
+// Package mock_trace is a generated GoMock package.
+package mock_trace
+
+import (
+	context "context"
+	http "net/http"
+	reflect "reflect"
+	time "time"
+
+	model "encore.dev/appruntime/exported/model"
+	stack "encore.dev/appruntime/exported/stack"
+	trace2 "encore.dev/appruntime/exported/trace2"
+	gomock "github.com/golang/mock/gomock"
+)
+
+// MockLogger is a mock of Logger interface.
+type MockLogger struct {
+	ctrl     *gomock.Controller
+	recorder *MockLoggerMockRecorder
+}
+
+// MockLoggerMockRecorder is the mock recorder for MockLogger.
+type MockLoggerMockRecorder struct {
+	mock *MockLogger
+}
+
+// NewMockLogger creates a new mock instance.
+func NewMockLogger(ctrl *gomock.Controller) *MockLogger {
+	mock := &MockLogger{ctrl: ctrl}
+	mock.recorder = &MockLoggerMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *MockLogger) EXPECT() *MockLoggerMockRecorder {
+	return m.recorder
+}
+
+// Add mocks base method.
+func (m *MockLogger) Add(arg0 trace2.Event) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "Add", arg0)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// Add indicates an expected call of Add.
+func (mr *MockLoggerMockRecorder) Add(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Add", reflect.TypeOf((*MockLogger)(nil).Add), arg0)
+}
+
+// AuthSpanEnd mocks base method.
+func (m *MockLogger) AuthSpanEnd(params trace2.AuthSpanEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "AuthSpanEnd", params)
+}
+
+// AuthSpanEnd indicates an expected call of AuthSpanEnd.
+func (mr *MockLoggerMockRecorder) AuthSpanEnd(params interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AuthSpanEnd", reflect.TypeOf((*MockLogger)(nil).AuthSpanEnd), params)
+}
+
+// AuthSpanStart mocks base method.
+func (m *MockLogger) AuthSpanStart(req *model.Request, goid uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "AuthSpanStart", req, goid)
+}
+
+// AuthSpanStart indicates an expected call of AuthSpanStart.
+func (mr *MockLoggerMockRecorder) AuthSpanStart(req, goid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AuthSpanStart", reflect.TypeOf((*MockLogger)(nil).AuthSpanStart), req, goid)
+}
+
+// BodyStream mocks base method.
+func (m *MockLogger) BodyStream(arg0 trace2.BodyStreamParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "BodyStream", arg0)
+}
+
+// BodyStream indicates an expected call of BodyStream.
+func (mr *MockLoggerMockRecorder) BodyStream(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BodyStream", reflect.TypeOf((*MockLogger)(nil).BodyStream), arg0)
+}
+
+// BucketDeleteObjectsEnd mocks base method.
+func (m *MockLogger) BucketDeleteObjectsEnd(arg0 trace2.BucketDeleteObjectsEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "BucketDeleteObjectsEnd", arg0)
+}
+
+// BucketDeleteObjectsEnd indicates an expected call of BucketDeleteObjectsEnd.
+func (mr *MockLoggerMockRecorder) BucketDeleteObjectsEnd(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BucketDeleteObjectsEnd", reflect.TypeOf((*MockLogger)(nil).BucketDeleteObjectsEnd), arg0)
+}
+
+// BucketDeleteObjectsStart mocks base method.
+func (m *MockLogger) BucketDeleteObjectsStart(arg0 trace2.BucketDeleteObjectsStartParams) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "BucketDeleteObjectsStart", arg0)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// BucketDeleteObjectsStart indicates an expected call of BucketDeleteObjectsStart.
+func (mr *MockLoggerMockRecorder) BucketDeleteObjectsStart(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BucketDeleteObjectsStart", reflect.TypeOf((*MockLogger)(nil).BucketDeleteObjectsStart), arg0)
+}
+
+// BucketListObjectsEnd mocks base method.
+func (m *MockLogger) BucketListObjectsEnd(arg0 trace2.BucketListObjectsEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "BucketListObjectsEnd", arg0)
+}
+
+// BucketListObjectsEnd indicates an expected call of BucketListObjectsEnd.
+func (mr *MockLoggerMockRecorder) BucketListObjectsEnd(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BucketListObjectsEnd", reflect.TypeOf((*MockLogger)(nil).BucketListObjectsEnd), arg0)
+}
+
+// BucketListObjectsStart mocks base method.
+func (m *MockLogger) BucketListObjectsStart(arg0 trace2.BucketListObjectsStartParams) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "BucketListObjectsStart", arg0)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// BucketListObjectsStart indicates an expected call of BucketListObjectsStart.
+func (mr *MockLoggerMockRecorder) BucketListObjectsStart(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BucketListObjectsStart", reflect.TypeOf((*MockLogger)(nil).BucketListObjectsStart), arg0)
+}
+
+// BucketObjectDownloadEnd mocks base method.
+func (m *MockLogger) BucketObjectDownloadEnd(arg0 trace2.BucketObjectDownloadEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "BucketObjectDownloadEnd", arg0)
+}
+
+// BucketObjectDownloadEnd indicates an expected call of BucketObjectDownloadEnd.
+func (mr *MockLoggerMockRecorder) BucketObjectDownloadEnd(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BucketObjectDownloadEnd", reflect.TypeOf((*MockLogger)(nil).BucketObjectDownloadEnd), arg0)
+}
+
+// BucketObjectDownloadStart mocks base method.
+func (m *MockLogger) BucketObjectDownloadStart(arg0 trace2.BucketObjectDownloadStartParams) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "BucketObjectDownloadStart", arg0)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// BucketObjectDownloadStart indicates an expected call of BucketObjectDownloadStart.
+func (mr *MockLoggerMockRecorder) BucketObjectDownloadStart(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BucketObjectDownloadStart", reflect.TypeOf((*MockLogger)(nil).BucketObjectDownloadStart), arg0)
+}
+
+// BucketObjectGetAttrsEnd mocks base method.
+func (m *MockLogger) BucketObjectGetAttrsEnd(arg0 trace2.BucketObjectGetAttrsEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "BucketObjectGetAttrsEnd", arg0)
+}
+
+// BucketObjectGetAttrsEnd indicates an expected call of BucketObjectGetAttrsEnd.
+func (mr *MockLoggerMockRecorder) BucketObjectGetAttrsEnd(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BucketObjectGetAttrsEnd", reflect.TypeOf((*MockLogger)(nil).BucketObjectGetAttrsEnd), arg0)
+}
+
+// BucketObjectGetAttrsStart mocks base method.
+func (m *MockLogger) BucketObjectGetAttrsStart(arg0 trace2.BucketObjectGetAttrsStartParams) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "BucketObjectGetAttrsStart", arg0)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// BucketObjectGetAttrsStart indicates an expected call of BucketObjectGetAttrsStart.
+func (mr *MockLoggerMockRecorder) BucketObjectGetAttrsStart(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BucketObjectGetAttrsStart", reflect.TypeOf((*MockLogger)(nil).BucketObjectGetAttrsStart), arg0)
+}
+
+// BucketObjectUploadEnd mocks base method.
+func (m *MockLogger) BucketObjectUploadEnd(arg0 trace2.BucketObjectUploadEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "BucketObjectUploadEnd", arg0)
+}
+
+// BucketObjectUploadEnd indicates an expected call of BucketObjectUploadEnd.
+func (mr *MockLoggerMockRecorder) BucketObjectUploadEnd(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BucketObjectUploadEnd", reflect.TypeOf((*MockLogger)(nil).BucketObjectUploadEnd), arg0)
+}
+
+// BucketObjectUploadStart mocks base method.
+func (m *MockLogger) BucketObjectUploadStart(arg0 trace2.BucketObjectUploadStartParams) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "BucketObjectUploadStart", arg0)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// BucketObjectUploadStart indicates an expected call of BucketObjectUploadStart.
+func (mr *MockLoggerMockRecorder) BucketObjectUploadStart(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BucketObjectUploadStart", reflect.TypeOf((*MockLogger)(nil).BucketObjectUploadStart), arg0)
+}
+
+// CacheCallEnd mocks base method.
+func (m *MockLogger) CacheCallEnd(arg0 trace2.CacheCallEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "CacheCallEnd", arg0)
+}
+
+// CacheCallEnd indicates an expected call of CacheCallEnd.
+func (mr *MockLoggerMockRecorder) CacheCallEnd(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CacheCallEnd", reflect.TypeOf((*MockLogger)(nil).CacheCallEnd), arg0)
+}
+
+// CacheCallStart mocks base method.
+func (m *MockLogger) CacheCallStart(arg0 trace2.CacheCallStartParams) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CacheCallStart", arg0)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// CacheCallStart indicates an expected call of CacheCallStart.
+func (mr *MockLoggerMockRecorder) CacheCallStart(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CacheCallStart", reflect.TypeOf((*MockLogger)(nil).CacheCallStart), arg0)
+}
+
+// DBQueryEnd mocks base method.
+func (m *MockLogger) DBQueryEnd(arg0 trace2.EventParams, arg1 trace2.EventID, arg2 error) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "DBQueryEnd", arg0, arg1, arg2)
+}
+
+// DBQueryEnd indicates an expected call of DBQueryEnd.
+func (mr *MockLoggerMockRecorder) DBQueryEnd(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DBQueryEnd", reflect.TypeOf((*MockLogger)(nil).DBQueryEnd), arg0, arg1, arg2)
+}
+
+// DBQueryStart mocks base method.
+func (m *MockLogger) DBQueryStart(p trace2.DBQueryStartParams) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DBQueryStart", p)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// DBQueryStart indicates an expected call of DBQueryStart.
+func (mr *MockLoggerMockRecorder) DBQueryStart(p interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DBQueryStart", reflect.TypeOf((*MockLogger)(nil).DBQueryStart), p)
+}
+
+// DBTransactionEnd mocks base method.
+func (m *MockLogger) DBTransactionEnd(arg0 trace2.DBTransactionEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "DBTransactionEnd", arg0)
+}
+
+// DBTransactionEnd indicates an expected call of DBTransactionEnd.
+func (mr *MockLoggerMockRecorder) DBTransactionEnd(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DBTransactionEnd", reflect.TypeOf((*MockLogger)(nil).DBTransactionEnd), arg0)
+}
+
+// DBTransactionStart mocks base method.
+func (m *MockLogger) DBTransactionStart(arg0 trace2.EventParams, arg1 stack.Stack) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DBTransactionStart", arg0, arg1)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// DBTransactionStart indicates an expected call of DBTransactionStart.
+func (mr *MockLoggerMockRecorder) DBTransactionStart(arg0, arg1 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DBTransactionStart", reflect.TypeOf((*MockLogger)(nil).DBTransactionStart), arg0, arg1)
+}
+
+// GetAndClear mocks base method.
+func (m *MockLogger) GetAndClear() ([]byte, bool) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetAndClear")
+	ret0, _ := ret[0].([]byte)
+	ret1, _ := ret[1].(bool)
+	return ret0, ret1
+}
+
+// GetAndClear indicates an expected call of GetAndClear.
+func (mr *MockLoggerMockRecorder) GetAndClear() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetAndClear", reflect.TypeOf((*MockLogger)(nil).GetAndClear))
+}
+
+// HTTPBeginRoundTrip mocks base method.
+func (m *MockLogger) HTTPBeginRoundTrip(httpReq *http.Request, req *model.Request, goid uint32) (context.Context, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "HTTPBeginRoundTrip", httpReq, req, goid)
+	ret0, _ := ret[0].(context.Context)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// HTTPBeginRoundTrip indicates an expected call of HTTPBeginRoundTrip.
+func (mr *MockLoggerMockRecorder) HTTPBeginRoundTrip(httpReq, req, goid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HTTPBeginRoundTrip", reflect.TypeOf((*MockLogger)(nil).HTTPBeginRoundTrip), httpReq, req, goid)
+}
+
+// HTTPCompleteRoundTrip mocks base method.
+func (m *MockLogger) HTTPCompleteRoundTrip(req *http.Request, resp *http.Response, goid uint32, err error) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "HTTPCompleteRoundTrip", req, resp, goid, err)
+}
+
+// HTTPCompleteRoundTrip indicates an expected call of HTTPCompleteRoundTrip.
+func (mr *MockLoggerMockRecorder) HTTPCompleteRoundTrip(req, resp, goid, err interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "HTTPCompleteRoundTrip", reflect.TypeOf((*MockLogger)(nil).HTTPCompleteRoundTrip), req, resp, goid, err)
+}
+
+// LogMessage mocks base method.
+func (m *MockLogger) LogMessage(arg0 trace2.LogMessageParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "LogMessage", arg0)
+}
+
+// LogMessage indicates an expected call of LogMessage.
+func (mr *MockLoggerMockRecorder) LogMessage(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "LogMessage", reflect.TypeOf((*MockLogger)(nil).LogMessage), arg0)
+}
+
+// MarkDone mocks base method.
+func (m *MockLogger) MarkDone() {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "MarkDone")
+}
+
+// MarkDone indicates an expected call of MarkDone.
+func (mr *MockLoggerMockRecorder) MarkDone() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "MarkDone", reflect.TypeOf((*MockLogger)(nil).MarkDone))
+}
+
+// PubsubMessageSpanEnd mocks base method.
+func (m *MockLogger) PubsubMessageSpanEnd(params trace2.PubsubMessageSpanEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "PubsubMessageSpanEnd", params)
+}
+
+// PubsubMessageSpanEnd indicates an expected call of PubsubMessageSpanEnd.
+func (mr *MockLoggerMockRecorder) PubsubMessageSpanEnd(params interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PubsubMessageSpanEnd", reflect.TypeOf((*MockLogger)(nil).PubsubMessageSpanEnd), params)
+}
+
+// PubsubMessageSpanStart mocks base method.
+func (m *MockLogger) PubsubMessageSpanStart(req *model.Request, goid uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "PubsubMessageSpanStart", req, goid)
+}
+
+// PubsubMessageSpanStart indicates an expected call of PubsubMessageSpanStart.
+func (mr *MockLoggerMockRecorder) PubsubMessageSpanStart(req, goid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PubsubMessageSpanStart", reflect.TypeOf((*MockLogger)(nil).PubsubMessageSpanStart), req, goid)
+}
+
+// PubsubPublishEnd mocks base method.
+func (m *MockLogger) PubsubPublishEnd(arg0 trace2.PubsubPublishEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "PubsubPublishEnd", arg0)
+}
+
+// PubsubPublishEnd indicates an expected call of PubsubPublishEnd.
+func (mr *MockLoggerMockRecorder) PubsubPublishEnd(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PubsubPublishEnd", reflect.TypeOf((*MockLogger)(nil).PubsubPublishEnd), arg0)
+}
+
+// PubsubPublishStart mocks base method.
+func (m *MockLogger) PubsubPublishStart(arg0 trace2.PubsubPublishStartParams) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "PubsubPublishStart", arg0)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// PubsubPublishStart indicates an expected call of PubsubPublishStart.
+func (mr *MockLoggerMockRecorder) PubsubPublishStart(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PubsubPublishStart", reflect.TypeOf((*MockLogger)(nil).PubsubPublishStart), arg0)
+}
+
+// RPCCallEnd mocks base method.
+func (m *MockLogger) RPCCallEnd(call *model.APICall, goid uint32, err error) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "RPCCallEnd", call, goid, err)
+}
+
+// RPCCallEnd indicates an expected call of RPCCallEnd.
+func (mr *MockLoggerMockRecorder) RPCCallEnd(call, goid, err interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RPCCallEnd", reflect.TypeOf((*MockLogger)(nil).RPCCallEnd), call, goid, err)
+}
+
+// RPCCallStart mocks base method.
+func (m *MockLogger) RPCCallStart(call *model.APICall, goid uint32) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RPCCallStart", call, goid)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// RPCCallStart indicates an expected call of RPCCallStart.
+func (mr *MockLoggerMockRecorder) RPCCallStart(call, goid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RPCCallStart", reflect.TypeOf((*MockLogger)(nil).RPCCallStart), call, goid)
+}
+
+// RequestSpanEnd mocks base method.
+func (m *MockLogger) RequestSpanEnd(params trace2.RequestSpanEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "RequestSpanEnd", params)
+}
+
+// RequestSpanEnd indicates an expected call of RequestSpanEnd.
+func (mr *MockLoggerMockRecorder) RequestSpanEnd(params interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RequestSpanEnd", reflect.TypeOf((*MockLogger)(nil).RequestSpanEnd), params)
+}
+
+// RequestSpanStart mocks base method.
+func (m *MockLogger) RequestSpanStart(req *model.Request, goid uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "RequestSpanStart", req, goid)
+}
+
+// RequestSpanStart indicates an expected call of RequestSpanStart.
+func (mr *MockLoggerMockRecorder) RequestSpanStart(req, goid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RequestSpanStart", reflect.TypeOf((*MockLogger)(nil).RequestSpanStart), req, goid)
+}
+
+// ServiceInitEnd mocks base method.
+func (m *MockLogger) ServiceInitEnd(arg0 trace2.EventParams, arg1 trace2.EventID, arg2 error) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "ServiceInitEnd", arg0, arg1, arg2)
+}
+
+// ServiceInitEnd indicates an expected call of ServiceInitEnd.
+func (mr *MockLoggerMockRecorder) ServiceInitEnd(arg0, arg1, arg2 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ServiceInitEnd", reflect.TypeOf((*MockLogger)(nil).ServiceInitEnd), arg0, arg1, arg2)
+}
+
+// ServiceInitStart mocks base method.
+func (m *MockLogger) ServiceInitStart(arg0 trace2.ServiceInitStartParams) trace2.EventID {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ServiceInitStart", arg0)
+	ret0, _ := ret[0].(trace2.EventID)
+	return ret0
+}
+
+// ServiceInitStart indicates an expected call of ServiceInitStart.
+func (mr *MockLoggerMockRecorder) ServiceInitStart(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ServiceInitStart", reflect.TypeOf((*MockLogger)(nil).ServiceInitStart), arg0)
+}
+
+// TestSpanEnd mocks base method.
+func (m *MockLogger) TestSpanEnd(params trace2.TestSpanEndParams) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "TestSpanEnd", params)
+}
+
+// TestSpanEnd indicates an expected call of TestSpanEnd.
+func (mr *MockLoggerMockRecorder) TestSpanEnd(params interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TestSpanEnd", reflect.TypeOf((*MockLogger)(nil).TestSpanEnd), params)
+}
+
+// TestSpanStart mocks base method.
+func (m *MockLogger) TestSpanStart(req *model.Request, goid uint32) {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "TestSpanStart", req, goid)
+}
+
+// TestSpanStart indicates an expected call of TestSpanStart.
+func (mr *MockLoggerMockRecorder) TestSpanStart(req, goid interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "TestSpanStart", reflect.TypeOf((*MockLogger)(nil).TestSpanStart), req, goid)
+}
+
+// WaitAndClear mocks base method.
+func (m *MockLogger) WaitAndClear() ([]byte, bool) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WaitAndClear")
+	ret0, _ := ret[0].([]byte)
+	ret1, _ := ret[1].(bool)
+	return ret0, ret1
+}
+
+// WaitAndClear indicates an expected call of WaitAndClear.
+func (mr *MockLoggerMockRecorder) WaitAndClear() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WaitAndClear", reflect.TypeOf((*MockLogger)(nil).WaitAndClear))
+}
+
+// WaitAtLeast mocks base method.
+func (m *MockLogger) WaitAtLeast(arg0 time.Duration) bool {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "WaitAtLeast", arg0)
+	ret0, _ := ret[0].(bool)
+	return ret0
+}
+
+// WaitAtLeast indicates an expected call of WaitAtLeast.
+func (mr *MockLoggerMockRecorder) WaitAtLeast(arg0 interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WaitAtLeast", reflect.TypeOf((*MockLogger)(nil).WaitAtLeast), arg0)
+}
+
+// WaitUntilDone mocks base method.
+func (m *MockLogger) WaitUntilDone() {
+	m.ctrl.T.Helper()
+	m.ctrl.Call(m, "WaitUntilDone")
+}
+
+// WaitUntilDone indicates an expected call of WaitUntilDone.
+func (mr *MockLoggerMockRecorder) WaitUntilDone() *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "WaitUntilDone", reflect.TypeOf((*MockLogger)(nil).WaitUntilDone))
+}
diff --git a/runtimes/go/appruntime/shared/traceprovider/traceprovider.go b/runtimes/go/appruntime/shared/traceprovider/traceprovider.go
new file mode 100644
index 0000000000..2dd7a446a8
--- /dev/null
+++ b/runtimes/go/appruntime/shared/traceprovider/traceprovider.go
@@ -0,0 +1,31 @@
+package traceprovider
+
+import (
+	"math/rand/v2"
+
+	"encore.dev/appruntime/exported/trace2"
+)
+
+type Factory interface {
+	NewLogger() trace2.Logger
+	SampleTrace() bool
+}
+
+type DefaultFactory struct {
+	// SampleRate is the rate at which to sample traces, between [0, 1].
+	// If nil, 100% of traces are sampled.
+	SampleRate *float64
+}
+
+func (f *DefaultFactory) NewLogger() trace2.Logger {
+	return trace2.NewLog()
+}
+
+func (f *DefaultFactory) SampleTrace() bool {
+	if f.SampleRate == nil {
+		return true
+	} else {
+		sample := rand.Float64() < *f.SampleRate
+		return sample
+	}
+}
diff --git a/runtimes/go/beta/auth/auth.go b/runtimes/go/beta/auth/auth.go
new file mode 100644
index 0000000000..a91af1f13b
--- /dev/null
+++ b/runtimes/go/beta/auth/auth.go
@@ -0,0 +1,67 @@
+// Package auth provides the APIs to get information about the authenticated users.
+//
+// For more information about how authentication works with Encore applications see https://encore.dev/docs/develop/auth.
+package auth
+
+import (
+	"context"
+
+	"encore.dev/appruntime/apisdk/api"
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/shared/reqtrack"
+)
+
+// UID is a unique identifier representing a user (a user id).
+type UID = model.UID
+
+//publicapigen:drop
+type Manager struct {
+	rt *reqtrack.RequestTracker
+}
+
+//publicapigen:drop
+func NewManager(rt *reqtrack.RequestTracker) *Manager {
+	return &Manager{rt}
+}
+
+func (mgr *Manager) UserID() (UID, bool) {
+	if curr := mgr.rt.Current(); curr.Req != nil {
+		if curr.Req.RPCData != nil {
+			uid := curr.Req.RPCData.UserID
+			return uid, uid != ""
+		} else if curr.Req.Test != nil {
+			uid := curr.Req.Test.UserID
+			return uid, uid != ""
+		}
+	}
+	return "", false
+}
+
+func (mgr *Manager) Data() interface{} {
+	if curr := mgr.rt.Current(); curr.Req != nil {
+		if curr.Req.RPCData != nil {
+			return curr.Req.RPCData.AuthData
+		} else if curr.Req.Test != nil {
+			return curr.Req.Test.AuthData
+		}
+	}
+	return nil
+}
+
+// WithContext returns a new context that sets the auth information for outgoing API calls.
+// It does not affect the auth information for the current request.
+//
+// Passing in an empty string as the uid results in unsetting the auth information,
+// causing future API calls to behave as if there was no authenticated user.
+//
+// If the application's auth handler returns custom auth data, two additional
+// requirements exist. First, the data parameter passed to WithContext must be of
+// the same type as the auth handler returns. Second, if the uid argument is not
+// the empty string then data may not be nil. If these requirements are not met,
+// API calls made with these options will not be made and will immediately return
+// a client-side error.
+func WithContext(ctx context.Context, uid UID, data interface{}) context.Context {
+	opts := *api.GetCallOptions(ctx) // make a copy
+	opts.Auth = &model.AuthInfo{UID: uid, UserData: data}
+	return api.WithCallOptions(ctx, &opts)
+}
diff --git a/runtimes/go/beta/auth/pkgfn.go b/runtimes/go/beta/auth/pkgfn.go
new file mode 100644
index 0000000000..38e54383e2
--- /dev/null
+++ b/runtimes/go/beta/auth/pkgfn.go
@@ -0,0 +1,27 @@
+//go:build encore_app
+
+package auth
+
+import "encore.dev/appruntime/shared/reqtrack"
+
+//publicapigen:drop
+var Singleton = NewManager(reqtrack.Singleton)
+
+// UserID reports the uid of the user making the request.
+// The second result is true if there is a user and false
+// if the request was made without authentication details.
+func UserID() (UID, bool) {
+	return Singleton.UserID()
+}
+
+// Data returns the structured auth data for the request.
+// It returns nil if the request was made without authentication details,
+// and the API endpoint does not require them.
+//
+// Expected usage is to immediately cast it to the registered auth data type:
+//
+//	usr, ok := auth.Data().(*user.Data)
+//	if !ok { /* ... */ }
+func Data() any {
+	return Singleton.Data()
+}
diff --git a/runtimes/go/beta/errs/builder.go b/runtimes/go/beta/errs/builder.go
new file mode 100644
index 0000000000..f622f904e1
--- /dev/null
+++ b/runtimes/go/beta/errs/builder.go
@@ -0,0 +1,117 @@
+package errs
+
+import (
+	"fmt"
+
+	"encore.dev/appruntime/exported/stack"
+)
+
+// A Builder allows for gradual construction of an error.
+// The zero value is ready for use.
+//
+// Use Err() to construct the error.
+type Builder struct {
+	code     ErrCode
+	codeSet  bool
+	det      ErrDetails
+	detSet   bool
+	stack    stack.Stack
+	stackSet bool
+
+	msg  string
+	meta []interface{}
+	err  error
+}
+
+// B is a shorthand for creating a new Builder.
+func B() *Builder { return &Builder{} }
+
+// Code sets the error code.
+func (b *Builder) Code(c ErrCode) *Builder {
+	b.code = c
+	b.codeSet = true
+	return b
+}
+
+// Msg sets the error message.
+func (b *Builder) Msg(msg string) *Builder {
+	b.msg = msg
+	return b
+}
+
+// Msgf is like Msg but uses fmt.Sprintf to construct the message.
+func (b *Builder) Msgf(format string, args ...interface{}) *Builder {
+	b.msg = fmt.Sprintf(format, args...)
+	return b
+}
+
+// Meta appends metadata key-value pairs.
+func (b *Builder) Meta(metaPairs ...interface{}) *Builder {
+	b.meta = append(b.meta, metaPairs...)
+	return b
+}
+
+// Details sets the details.
+func (b *Builder) Details(det ErrDetails) *Builder {
+	b.det = det
+	b.detSet = true
+	return b
+}
+
+// Cause sets the underlying error cause.
+func (b *Builder) Cause(err error) *Builder {
+	b.err = err
+	if e, ok := err.(*Error); ok {
+		if !b.codeSet {
+			b.code = e.Code
+		}
+		if !b.detSet {
+			b.det = e.Details
+		}
+		if !b.stackSet {
+			b.stack = e.stack
+			b.stackSet = true
+		}
+	}
+	return b
+}
+
+// Err returns the constructed error.
+// It never returns nil.
+//
+// If Code has not been set or has been set to OK,
+// the Code is set to Unknown.
+//
+// If Msg has not been set and Cause is nil,
+// the Msg is set to "unknown error".
+func (b *Builder) Err() error {
+	code := b.code
+	if code == OK {
+		code = Unknown
+	}
+
+	msg := b.msg
+	if msg == "" && b.err == nil {
+		msg = "unknown error"
+	}
+
+	var errMeta Metadata
+	var s stack.Stack
+	if b.stackSet {
+		s = b.stack
+	} else if e, ok := b.err.(*Error); ok {
+		errMeta = e.Meta
+		s = e.stack
+	} else {
+		s = stack.Build(2)
+	}
+
+	return &Error{
+		Code:       code,
+		Message:    msg,
+		Meta:       mergeMeta(errMeta, b.meta),
+		Details:    b.det,
+		underlying: b.err,
+		stack:      s,
+	}
+}
diff --git a/runtimes/go/beta/errs/codes.go b/runtimes/go/beta/errs/codes.go
new file mode 100644
index 0000000000..f4107d202f
--- /dev/null
+++ b/runtimes/go/beta/errs/codes.go
@@ -0,0 +1,220 @@
+package errs
+
+// ErrCode is an RPC error code.
+type ErrCode int
+
+const (
+	// OK indicates the operation was successful.
+	OK ErrCode = 0
+
+	// Canceled indicates the operation was canceled (typically by the caller).
+	//
+	// Encore will generate this error code when cancellation is requested.
+	Canceled ErrCode = 1
+
+	// Unknown error. An example of where this error may be returned is
+	// if a Status value received from another address space belongs to
+	// an error-space that is not known in this address space. Also
+	// errors raised by APIs that do not return enough error information
+	// may be converted to this error.
+	//
+	// Encore will generate this error code in the above two mentioned cases.
+	Unknown ErrCode = 2
+
+	// InvalidArgument indicates client specified an invalid argument.
+	// Note that this differs from FailedPrecondition. It indicates arguments
+	// that are problematic regardless of the state of the system
+	// (e.g., a malformed file name).
+	//
+	// Encore will generate this error code if the request data cannot be parsed.
+	InvalidArgument ErrCode = 3
+
+	// DeadlineExceeded means operation expired before completion.
+	// For operations that change the state of the system, this error may be
+	// returned even if the operation has completed successfully. For
+	// example, a successful response from a server could have been delayed
+	// long enough for the deadline to expire.
+	//
+	// Encore will generate this error code when the deadline is exceeded.
+	DeadlineExceeded ErrCode = 4
+
+	// NotFound means some requested entity (e.g., file or directory) was
+	// not found.
+	//
+	// Encore will not generate this error code.
+	NotFound ErrCode = 5
+
+	// AlreadyExists means an attempt to create an entity failed because one
+	// already exists.
+	//
+	// Encore will not generate this error code.
+	AlreadyExists ErrCode = 6
+
+	// PermissionDenied indicates the caller does not have permission to
+	// execute the specified operation. It must not be used for rejections
+	// caused by exhausting some resource (use ResourceExhausted
+	// instead for those errors). It must not be
+	// used if the caller cannot be identified (use Unauthenticated
+	// instead for those errors).
+	//
+	// Encore will not generate this error code.
+	PermissionDenied ErrCode = 7
+
+	// ResourceExhausted indicates some resource has been exhausted, perhaps
+	// a per-user quota, or perhaps the entire file system is out of space.
+	//
+	// Encore will generate this error code in out-of-memory and server overload
+	// situations, or when a message is larger than the configured maximum size.
+	ResourceExhausted ErrCode = 8
+
+	// FailedPrecondition indicates operation was rejected because the
+	// system is not in a state required for the operation's execution.
+	// For example, directory to be deleted may be non-empty, an rmdir
+	// operation is applied to a non-directory, etc.
+	//
+	// A litmus test that may help a service implementor in deciding
+	// between FailedPrecondition, Aborted, and Unavailable:
+	//  (a) Use Unavailable if the client can retry just the failing call.
+	//  (b) Use Aborted if the client should retry at a higher-level
+	//      (e.g., restarting a read-modify-write sequence).
+	//  (c) Use FailedPrecondition if the client should not retry until
+	//      the system state has been explicitly fixed. E.g., if an "rmdir"
+	//      fails because the directory is non-empty, FailedPrecondition
+	//      should be returned since the client should not retry unless
+	//      they have first fixed up the directory by deleting files from it.
+	//  (d) Use FailedPrecondition if the client performs conditional
+	//      Get/Update/Delete on a resource and the resource on the
+	//      server does not match the condition. E.g., conflicting
+	//      read-modify-write on the same resource.
+	//
+	// Encore will not generate this error code.
+	FailedPrecondition ErrCode = 9
+
+	// Aborted indicates the operation was aborted, typically due to a
+	// concurrency issue like sequencer check failures, transaction aborts,
+	// etc.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	Aborted ErrCode = 10
+
+	// OutOfRange means operation was attempted past the valid range.
+	// E.g., seeking or reading past end of file.
+	//
+	// Unlike InvalidArgument, this error indicates a problem that may
+	// be fixed if the system state changes. For example, a 32-bit file
+	// system will generate InvalidArgument if asked to read at an
+	// offset that is not in the range [0,2^32-1], but it will generate
+	// OutOfRange if asked to read from an offset past the current
+	// file size.
+	//
+	// There is a fair bit of overlap between FailedPrecondition and
+	// OutOfRange. We recommend using OutOfRange (the more specific
+	// error) when it applies so that callers who are iterating through
+	// a space can easily look for an OutOfRange error to detect when
+	// they are done.
+	//
+	// Encore will not generate this error code.
+	OutOfRange ErrCode = 11
+
+	// Unimplemented indicates operation is not implemented or not
+	// supported/enabled in this service.
+	//
+	// Encore will generate this error code when an endpoint does not exist.
+	Unimplemented ErrCode = 12
+
+	// Internal errors. Means some invariants expected by underlying
+	// system has been broken. If you see one of these errors,
+	// something is very broken.
+	//
+	// Encore will generate this error code in several internal error conditions.
+	Internal ErrCode = 13
+
+	// Unavailable indicates the service is currently unavailable.
+	// This is a most likely a transient condition and may be corrected
+	// by retrying with a backoff. Note that it is not always safe to retry
+	// non-idempotent operations.
+	//
+	// See litmus test above for deciding between FailedPrecondition,
+	// Aborted, and Unavailable.
+	//
+	// Encore will generate this error code in aubrupt shutdown of a server process
+	// or network connection.
+	Unavailable ErrCode = 14
+
+	// DataLoss indicates unrecoverable data loss or corruption.
+	//
+	// Encore will not generate this error code.
+	DataLoss ErrCode = 15
+
+	// Unauthenticated indicates the request does not have valid
+	// authentication credentials for the operation.
+	//
+	// Encore will generate this error code when the authentication metadata
+	// is invalid or missing, and expects auth handlers to return errors with
+	// this code when the auth token is not valid.
+	Unauthenticated ErrCode = 16
+)
+
+// String returns the string representation of c.
+//
+//publicapigen:keep
+func (c ErrCode) String() string {
+	return codeNames[c]
+}
+
+// HTTPStatus reports a suitable HTTP status code for an error, based on its code.
+// If err is nil it reports 200. If it's not an *Error it reports 500.
+//
+//publicapigen:keep
+func (c ErrCode) HTTPStatus() int {
+	return codeStatus[c]
+}
+
+//publicapigen:keep
+func (c ErrCode) MarshalJSON() ([]byte, error) {
+	s := c.String()
+	return []byte("\"" + s + "\""), nil
+}
+
+//publicapigen:keep
+var codeNames = [...]string{
+	OK:                 "ok",
+	Canceled:           "canceled",
+	Unknown:            "unknown",
+	InvalidArgument:    "invalid_argument",
+	DeadlineExceeded:   "deadline_exceeded",
+	NotFound:           "not_found",
+	AlreadyExists:      "already_exists",
+	PermissionDenied:   "permission_denied",
+	ResourceExhausted:  "resource_exhausted",
+	FailedPrecondition: "failed_precondition",
+	Aborted:            "aborted",
+	OutOfRange:         "out_of_range",
+	Unimplemented:      "unimplemented",
+	Internal:           "internal",
+	Unavailable:        "unavailable",
+	DataLoss:           "data_loss",
+	Unauthenticated:    "unauthenticated",
+}
+
+//publicapigen:keep
+var codeStatus = [...]int{
+	OK:                 200,
+	Canceled:           499,
+	Unknown:            500,
+	InvalidArgument:    400,
+	DeadlineExceeded:   504,
+	NotFound:           404,
+	AlreadyExists:      409,
+	PermissionDenied:   403,
+	ResourceExhausted:  429,
+	FailedPrecondition: 400,
+	Aborted:            409,
+	OutOfRange:         400,
+	Unimplemented:      501,
+	Internal:           500,
+	Unavailable:        503,
+	DataLoss:           500,
+	Unauthenticated:    401,
+}
diff --git a/runtimes/go/beta/errs/details.go b/runtimes/go/beta/errs/details.go
new file mode 100644
index 0000000000..f4c5c38328
--- /dev/null
+++ b/runtimes/go/beta/errs/details.go
@@ -0,0 +1,11 @@
+package errs
+
+// ErrDetails is a marker interface for telling Encore
+// the type is used for reporting error details.
+//
+// We require a marker method (as opposed to using interface{})
+// to facilitate static analysis and to ensure the type
+// can be properly serialized across the network.
+type ErrDetails interface {
+	ErrDetails() // marker method; it need not do anything
+}
diff --git a/runtimes/go/beta/errs/error.go b/runtimes/go/beta/errs/error.go
new file mode 100644
index 0000000000..33d23a87f8
--- /dev/null
+++ b/runtimes/go/beta/errs/error.go
@@ -0,0 +1,258 @@
+// Package errs provides structured error handling for Encore applications.
+//
+// See https://encore.dev/docs/develop/errors for more information about how errors work within Encore applications.
+package errs
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+	"strings"
+	"unsafe"
+
+	jsoniter "github.com/json-iterator/go"
+
+	"encore.dev/appruntime/exported/stack"
+)
+
+var json = jsoniter.Config{
+	EscapeHTML:             false,
+	SortMapKeys:            false,
+	ValidateJsonRawMessage: true,
+}.Froze()
+
+// An Error is an error that provides structured information
+// about the error. It includes an error code, a message,
+// optionally additional structured details about the error
+// and arbitrary key-value metadata.
+//
+// The Details field is returned to external clients.
+// The Meta field is only exposed to internal calls within Encore.
+//
+// Internally it captures an underlying error for printing
+// and for use with errors.Is/As and call stack information.
+//
+// To provide accurate stack information, users are expected
+// to convert non-Error errors into *Error as close to the
+// root cause as possible. This is made simple with Wrap.
+type Error struct {
+	// Code is the error code to return.
+	Code ErrCode `json:"code"`
+	// Message is a descriptive message of the error.
+	Message string `json:"message"`
+	// Details are user-defined additional details.
+	Details ErrDetails `json:"details"`
+	// Meta are arbitrary key-value pairs for use within
+	// the Encore application. They are not exposed to external clients.
+	Meta Metadata `json:"-"`
+
+	// underlying is the underlying error,
+	// for use with errors.Is and errors.As.
+	// It is not propagated across RPC boundaries.
+	underlying error
+
+	stack stack.Stack
+}
+
+// Metadata represents structured key-value pairs, for attaching arbitrary
+// metadata to errors. The metadata is propagated between internal services
+// but is not exposed to external clients.
+type Metadata map[string]interface{}
+
+// Wrap wraps the err, adding additional error information.
+// If err is nil it returns nil.
+//
+// If err is already an *Error its code, message, and details
+// are copied over to the new error.
+func Wrap(err error, msg string, metaPairs ...interface{}) error {
+	if err == nil {
+		return nil
+	}
+
+	e := &Error{Code: Unknown, Message: msg, underlying: err}
+	var ee *Error
+	if errors.As(err, &ee) {
+		e.Details = ee.Details
+		e.Code = ee.Code
+		e.Meta = mergeMeta(ee.Meta, metaPairs)
+		e.stack = ee.stack
+	} else {
+		e.Meta = mergeMeta(nil, metaPairs)
+		e.stack = stack.Build(2)
+	}
+	return e
+}
+
+// WrapCode is like Wrap but also sets the error code.
+// If code is OK it reports nil.
+func WrapCode(err error, code ErrCode, msg string, metaPairs ...interface{}) error {
+	if err == nil || code == OK {
+		return nil
+	}
+
+	e := &Error{Code: code, Message: msg, underlying: err}
+	var ee *Error
+	if errors.As(err, &ee) {
+		e.Details = ee.Details
+		e.Meta = mergeMeta(ee.Meta, metaPairs)
+		e.stack = ee.stack
+	} else {
+		e.Meta = mergeMeta(nil, metaPairs)
+		e.stack = stack.Build(2)
+	}
+	return e
+}
+
+// Convert converts an error to an *Error.
+// If the error is already an *Error it returns it unmodified.
+// If err is nil it returns nil.
+func Convert(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	if e, ok := err.(*Error); ok {
+		// If the parent is already an *Error we can return it directly.
+		return e
+	}
+
+	var e *Error
+	if errors.As(err, &e) {
+		// The error itself isn't an *Error, but it wraps one somewhere in the chain. Create a new *Error that preserves
+		// the outer error but takes properties from inner *Error
+		return &Error{
+			Code:       e.Code,
+			Message:    err.Error(),
+			Details:    e.Details,
+			Meta:       e.Meta,
+			underlying: err,
+			stack:      e.stack,
+		}
+	}
+
+	return &Error{
+		Code:       Unknown,
+		underlying: err,
+		stack:      stack.Build(2),
+	}
+}
+
+// Code reports the error code from an error.
+// If err is nil it reports OK.
+// Otherwise if err is not an *Error it reports Unknown.
+func Code(err error) ErrCode {
+	if err == nil {
+		return OK
+	}
+
+	var e *Error
+	if errors.As(err, &e) {
+		return e.Code
+	}
+	return Unknown
+}
+
+// Meta reports the metadata included in the error.
+// If err is nil or the error lacks metadata it reports nil.
+func Meta(err error) Metadata {
+	var e *Error
+	if errors.As(err, &e) {
+		return e.Meta
+	}
+	return nil
+}
+
+// Details reports the error details included in the error.
+// If err is nil or the error lacks details it reports nil.
+func Details(err error) ErrDetails {
+	var e *Error
+	if errors.As(err, &e) {
+		return e.Details
+	}
+	return nil
+}
+
+// Error reports the error code and message.
+func (e *Error) Error() string {
+	if e.Code == Unknown {
+		return "unknown code: " + e.ErrorMessage()
+	}
+	return e.Code.String() + ": " + e.ErrorMessage()
+}
+
+// ErrorMessage reports the error message, joining this
+// error's message with the messages from any underlying errors.
+func (e *Error) ErrorMessage() string {
+	if e.underlying == nil {
+		return e.Message
+	}
+
+	var b strings.Builder
+	b.WriteString(e.Message)
+
+	next := e.underlying
+	for next != nil {
+		var msg string
+		if e, ok := next.(*Error); ok {
+			msg = e.Message
+			next = e.underlying
+		} else {
+			msg = next.Error()
+			next = nil
+		}
+		if b.Len() > 0 && msg != "" {
+			b.WriteString(": ")
+		}
+		b.WriteString(msg)
+	}
+	return b.String()
+}
+
+// Unwrap returns the underlying error, if any.
+func (e *Error) Unwrap() error {
+	return e.underlying
+}
+
+// HTTPError writes structured error information to w using JSON encoding.
+// The status code is computed with HTTPStatus.
+//
+// If err is nil it writes:
+//
+//	{"code": "ok", "message": "", "details": null}
+func HTTPError(w http.ResponseWriter, err error) {
+	HTTPErrorWithCode(w, err, 0)
+}
+
+func mergeMeta(md Metadata, pairs []interface{}) Metadata {
+	n := len(pairs)
+	if n%2 != 0 {
+		panic(fmt.Sprintf("got uneven number (%d) of metadata key-values", n))
+	}
+	if md == nil && n > 0 {
+		md = make(Metadata, n/2)
+	}
+	for i := 0; i < n; i += 2 {
+		key, ok := pairs[i].(string)
+		if !ok {
+			panic(fmt.Sprintf("metadata key-value pair #%d key is not a string (is %T)", i/2, pairs[i]))
+		}
+		md[key] = pairs[i+1]
+	}
+	return md
+}
+
+func init() {
+	jsoniter.RegisterTypeEncoderFunc("errs.Error", func(ptr unsafe.Pointer, stream *jsoniter.Stream) {
+		e := (*Error)(ptr)
+		stream.WriteObjectStart()
+		stream.WriteObjectField("code")
+		stream.WriteString(e.Code.String())
+		stream.WriteMore()
+		stream.WriteObjectField("message")
+		stream.WriteString(e.ErrorMessage())
+		stream.WriteMore()
+		stream.WriteObjectField("details")
+		stream.WriteVal(e.Details)
+		stream.WriteObjectEnd()
+	}, nil)
+}
diff --git a/runtimes/go/beta/errs/errs_internal.go b/runtimes/go/beta/errs/errs_internal.go
new file mode 100644
index 0000000000..86152abdf3
--- /dev/null
+++ b/runtimes/go/beta/errs/errs_internal.go
@@ -0,0 +1,263 @@
+package errs
+
+import (
+	"bytes"
+	"encoding/gob"
+	"errors"
+	"fmt"
+	"log"
+	"net/http"
+
+	jsoniter "github.com/json-iterator/go"
+
+	"encore.dev/appruntime/apisdk/api/errmarshalling"
+	"encore.dev/appruntime/exported/stack"
+)
+
+var statusToCode = map[int]ErrCode{
+	200: OK,
+	499: Canceled,
+	500: Internal,
+	400: InvalidArgument,
+	401: Unauthenticated,
+	403: PermissionDenied,
+	404: NotFound,
+	409: AlreadyExists,
+	429: ResourceExhausted,
+	501: Unimplemented,
+	503: Unavailable,
+	504: DeadlineExceeded,
+}
+
+func HTTPStatusToCode(status int) ErrCode {
+	if c, ok := statusToCode[status]; ok {
+		return c
+	}
+	return Unknown
+}
+
+func Stack(err error) stack.Stack {
+	if e, ok := err.(*Error); ok {
+		return e.stack
+	}
+	return stack.Stack{}
+}
+
+func DropStackFrame(err error) error {
+	if e, ok := err.(*Error); ok && len(e.stack.Frames) > 0 {
+		e.stack.Frames = e.stack.Frames[1:]
+	}
+	return err
+}
+
+// Stack sets the stack of the new error.
+func (b *Builder) Stack(s stack.Stack) *Builder {
+	b.stack = s
+	b.stackSet = true
+	return b
+}
+
+// RoundTrip copies an error, returning an equivalent error
+// for replicating across RPC boundaries.
+func RoundTrip(err error) error {
+	if err == nil {
+		return nil
+	} else if e, ok := err.(*Error); ok {
+		e2 := &Error{
+			Code:    e.Code,
+			Message: e.Message,
+			stack:   stack.Build(3), // skip caller of RoundTrip as well
+		}
+
+		// Register the stack type, even though we don't use it here as
+		// we pass "panic_stack" via the meta data and gob will error
+		// if the type hasn't been registered.
+		gob.Register(e2.stack)
+
+		if e.underlying != nil {
+			e2.underlying = errors.New(func() (rtn string) {
+				defer func() {
+					if r := recover(); r != nil {
+						rtn = fmt.Sprintf("panic in calling underlying.Error(): %+v", r)
+					}
+				}()
+				return e.underlying.Error()
+			}())
+		}
+
+		// Copy details
+		if e.Details != nil {
+			var buf bytes.Buffer
+			gob.Register(e.Details)
+			enc := gob.NewEncoder(&buf)
+			if err := enc.Encode(struct{ Details ErrDetails }{Details: e.Details}); err != nil {
+				log.Printf("failed to encode error details: %v", err)
+			} else {
+				dec := gob.NewDecoder(&buf)
+				var dst struct{ Details ErrDetails }
+				if err := dec.Decode(&dst); err != nil {
+					log.Printf("failed to decode error details: %v", err)
+				} else {
+					e2.Details = dst.Details
+				}
+			}
+		}
+
+		// Copy meta
+		if e.Meta != nil {
+			var buf bytes.Buffer
+			enc := gob.NewEncoder(&buf)
+			if err := enc.Encode(e.Meta); err != nil {
+				log.Printf("failed to encode error metadata: %v", err)
+			} else {
+				dec := gob.NewDecoder(&buf)
+				if err := dec.Decode(&e2.Meta); err != nil {
+					log.Printf("failed to decode error metadata: %v", err)
+				}
+			}
+		}
+
+		return e2
+	} else {
+		return &Error{
+			Code:    Unknown,
+			Message: err.Error(),
+			stack:   stack.Build(3), // skip caller of RoundTrip as well
+		}
+	}
+}
+
+func HTTPStatus(err error) int {
+	code := Code(err)
+	switch code {
+	case OK:
+		return 200
+	case Canceled:
+		return 499
+	case Unknown:
+		return 500
+	case InvalidArgument:
+		return 400
+	case DeadlineExceeded:
+		return 504
+	case NotFound:
+		return 404
+	case AlreadyExists:
+		return 409
+	case PermissionDenied:
+		return 403
+	case ResourceExhausted:
+		return 429
+	case FailedPrecondition:
+		return 400
+	case Aborted:
+		return 409
+	case OutOfRange:
+		return 400
+	case Unimplemented:
+		return 501
+	case Internal:
+		return 500
+	case Unavailable:
+		return 503
+	case DataLoss:
+		return 500
+	case Unauthenticated:
+		return 401
+	default:
+		return 500
+	}
+}
+
+// HTTPErrorWithCode writes structured error information to w using JSON encoding.
+// The given status code is used if it is non-zero, and otherwise
+// it is computed with HTTPStatus.
+//
+// If err is nil it writes:
+//
+//	{"code": "ok", "message": "", "details": null}
+func HTTPErrorWithCode(w http.ResponseWriter, err error, code int) {
+	if code == 0 {
+		code = HTTPStatus(err)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("X-Content-Type-Options", "nosniff")
+
+	if err == nil {
+		w.WriteHeader(code)
+		_, _ = w.Write([]byte(`{
+  "code": "ok",
+  "message": "",
+  "details": null
+}
+`))
+		return
+	}
+
+	e := Convert(err).(*Error)
+	data, err2 := json.MarshalIndent(e, "", "  ")
+	if err2 != nil {
+		// Must be the details; drop them
+		e2 := &Error{Code: e.Code, Message: e.Message}
+		data, _ = json.MarshalIndent(e2, "", "  ")
+	}
+	w.WriteHeader(code)
+	// nosemgrep
+	_, _ = w.Write(data)
+}
+
+// writeErrorFieldsToInternalStream writes the error fields to the given stream
+// for passing between running Encore services.
+//
+// Note we do not marshal the Details object as we would need to allow
+// for reflection loading of the type by name, which is not safe and could
+// lead to arbitrary code execution.
+func writeErrorFieldsToInternalStream(e *Error, stream *jsoniter.Stream) {
+	stream.WriteObjectField("code")
+	stream.WriteInt(int(e.Code))
+
+	stream.WriteMore()
+	stream.WriteObjectField(errmarshalling.MessageKey)
+	stream.WriteString(e.Message)
+
+	if len(e.Meta) > 0 {
+		if err := errmarshalling.TryWriteValue(stream, "meta", e.Meta); err != nil {
+			// Only report the error in the JSON stream
+			// don't error out the whole marshal as it's critical
+			// that we marshal the error.
+			stream.WriteMore()
+			stream.WriteObjectField("meta_marshal_error")
+			stream.WriteString(err.Error())
+		}
+	}
+
+	if e.underlying != nil {
+		stream.WriteMore()
+		stream.WriteObjectField(errmarshalling.WrappedKey)
+		stream.WriteVal(e.underlying)
+	}
+}
+
+func unmarshalFromInternalIterator(e *Error, itr *jsoniter.Iterator) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "code":
+			e.Code = ErrCode(itr.ReadInt())
+		case errmarshalling.MessageKey:
+			e.Message = itr.ReadString()
+		case "meta":
+			itr.ReadVal(&e.Meta)
+		case errmarshalling.WrappedKey:
+			e.underlying = errmarshalling.UnmarshalError(itr)
+		default:
+			itr.Skip()
+		}
+
+		return true
+	})
+}
+
+func init() {
+	errmarshalling.RegisterErrorMarshaller(writeErrorFieldsToInternalStream, unmarshalFromInternalIterator)
+}
diff --git a/runtimes/go/beta/package.go b/runtimes/go/beta/package.go
new file mode 100644
index 0000000000..2fb01d8edb
--- /dev/null
+++ b/runtimes/go/beta/package.go
@@ -0,0 +1,3 @@
+// Package beta contains packages which can be used in Encore applications, however their APIs are not stable
+// and may change in future releases.
+package beta
diff --git a/runtimes/go/config/helpers_internal.go b/runtimes/go/config/helpers_internal.go
new file mode 100644
index 0000000000..9d8995a25e
--- /dev/null
+++ b/runtimes/go/config/helpers_internal.go
@@ -0,0 +1,96 @@
+//go:build encore_app
+
+package config
+
+import (
+	"fmt"
+
+	jsoniter "github.com/json-iterator/go"
+)
+
+type Unmarshaler[T any] func(itr *jsoniter.Iterator, path []string) T
+
+// CreateValue creates a new Value on the given path with the given value
+func CreateValue[T any](value T, pathToValue ValuePath) Value[T] {
+	valueID := Singleton.nextID()
+	return func() T {
+		Singleton.valueMeta(valueID, pathToValue)
+		return testOverrideOrValue(valueID, value)
+	}
+}
+
+// CreateValueList creates a new Value Slice on the given path with the given values
+func CreateValueList[T any](value []T, pathToValue ValuePath) Values[T] {
+	valueID := Singleton.nextID()
+	return func() []T {
+		Singleton.valueMeta(valueID, pathToValue)
+		return testOverrideOrValue(valueID, value)
+	}
+}
+
+// GetMetaForValue returns the ValueID and ValuePath for the given Value
+func GetMetaForValue[T any](value func() T) (ValueID, ValuePath) {
+	// Get the current request
+	req := Singleton.rt.Current()
+
+	// Lock so we're the only running extraction
+	Singleton.extraction.mutex.Lock()
+	defer Singleton.extraction.mutex.Unlock()
+
+	// Scope the extraction to the current goroutine
+	Singleton.extraction.scopeMutex.Lock()
+	Singleton.extraction.forSpan = req.Req.SpanID
+	Singleton.extraction.forGoRoutine = req.Goctr
+	Singleton.extraction.scopeMutex.Unlock()
+
+	// Now flag that we're running extract and need to go via the slow path in Manager.valueMeta
+	Singleton.extraction.running.Store(true)
+	defer func() {
+		Singleton.extraction.count = 0
+
+		// Reset the scoping
+		Singleton.extraction.scopeMutex.Lock()
+		Singleton.extraction.forSpan = [8]byte{0, 0, 0, 0, 0, 0, 0, 0}
+		Singleton.extraction.forGoRoutine = 0
+		Singleton.extraction.scopeMutex.Unlock()
+
+		// Release the locks
+		Singleton.extraction.running.Store(false)
+	}()
+
+	// Call the value, which will trigger the extraction inside Manager.valueMeta
+	value()
+
+	// Expect exactly 1 extraction
+	if Singleton.extraction.count != 1 {
+		panic(fmt.Sprintf("config.Value metadata extraction failed, got %d extractions, expected 1", Singleton.extraction.count))
+	}
+
+	// Return the extracted values
+	return Singleton.extraction.ExtractedID, Singleton.extraction.ExtractedPath
+}
+
+// ReadArray is a helper function that generated code can use to read an array from the JSON iterator
+func ReadArray[T any](itr *jsoniter.Iterator, cb func(itr *jsoniter.Iterator, idx int) T) []T {
+	rtn := make([]T, 0)
+
+	itr.ReadArrayCB(func(iterator *jsoniter.Iterator) bool {
+		rtn = append(rtn, cb(iterator, len(rtn)))
+		return true
+	})
+
+	return rtn
+}
+
+// ReadMap is a helper function that generated code can use to read an map from the JSON iterator
+func ReadMap[K comparable, V any](itr *jsoniter.Iterator, cb func(itr *jsoniter.Iterator, key string) (K, V)) map[K]V {
+	rtn := make(map[K]V)
+
+	itr.ReadObjectCB(func(iterator *jsoniter.Iterator, key string) bool {
+		k, v := cb(iterator, key)
+		rtn[k] = v
+		return true
+	})
+
+	return rtn
+}
diff --git a/runtimes/go/config/manager_internal.go b/runtimes/go/config/manager_internal.go
new file mode 100644
index 0000000000..f5372ce9e6
--- /dev/null
+++ b/runtimes/go/config/manager_internal.go
@@ -0,0 +1,109 @@
+package config
+
+import (
+	"encoding/base64"
+	"fmt"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"testing"
+
+	jsoniter "github.com/json-iterator/go"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/shared/encoreenv"
+	"encore.dev/appruntime/shared/reqtrack"
+)
+
+type ValueID uint64
+type ValuePath []string
+
+type Manager struct {
+	// Runtime components we need for config
+	rt   *reqtrack.RequestTracker
+	json jsoniter.API
+
+	// config tracking systems
+	nextValueID atomic.Uint64
+	extraction  struct {
+		mutex         sync.Mutex   // Used only by GetMetaForValue
+		running       atomic.Bool  // Only store when under mutex
+		scopeMutex    sync.RWMutex // Mutex for the forSpan / forGoRoutine
+		forSpan       model.SpanID // Which span are we extracting for?
+		forGoRoutine  uint32       // Which go routine within the span are we extracting for
+		count         int          // How many extractions have we done?
+		ExtractedID   ValueID      // What's the ValueID we extracted?
+		ExtractedPath ValuePath    // What's the path we extracted?
+	}
+
+	// Test support
+	testMutex     sync.RWMutex
+	testOverrides map[*testing.T]map[ValueID]any
+}
+
+func NewManager(rt *reqtrack.RequestTracker, json jsoniter.API) *Manager {
+	return &Manager{
+		rt:            rt,
+		json:          json,
+		testOverrides: make(map[*testing.T]map[ValueID]any),
+	}
+}
+
+func (m *Manager) getComputedCUE(serviceName string) (jsonBytes []byte, found bool, err error) {
+	if m == nil {
+		return nil, true, fmt.Errorf("config subsystem has not been initialized")
+	}
+
+	// Fetch the raw JSON config for this service
+	envVar := encoreenv.Get(envName(serviceName))
+	if envVar == "" {
+		return nil, false, fmt.Errorf("configuration for service `%s` not found, expected it in environmental variable %s", serviceName, envName(serviceName))
+	}
+	cfgBytes, err := base64.RawURLEncoding.DecodeString(envVar)
+	if err != nil {
+		return nil, true, fmt.Errorf("failed to decode configuration for service `%s`: %v", serviceName, err)
+	}
+	return cfgBytes, true, nil
+}
+
+// nextID returns the next unique ID for a config value to use to be tracked
+func (m *Manager) nextID() ValueID {
+	if m == nil {
+		panic("config subsystem has not been initialized")
+	}
+	return ValueID(m.nextValueID.Add(1))
+}
+
+// valueMeta is used by Values to provide their ID and path to GetMetaForValue
+//
+// It is called by the Value function itself, and so is called in the context of the
+// of a goroutine that is running the GetMetaForValue function. If we are not in
+// that goroutine this method has no effect and the value is returned as normal.
+func (m *Manager) valueMeta(id ValueID, path ValuePath) {
+	// Fast pass if we're not extracting
+	if !m.extraction.running.Load() {
+		return
+	}
+
+	// Check if we're the right Goroutine that we want to extract from
+	req := m.rt.Current()
+	m.extraction.scopeMutex.RLock()
+	defer m.extraction.scopeMutex.RUnlock()
+	if req.Req.SpanID != m.extraction.forSpan || req.Goctr != m.extraction.forGoRoutine {
+		return
+	}
+
+	// We're the right goroutine, so we can store the value
+	m.extraction.ExtractedID = id
+	m.extraction.ExtractedPath = path
+	m.extraction.count++
+}
+
+// envName takes a service name and converts it to an environment variable name in which
+// the service's configuration JSON is stored at runtime
+func envName(serviceName string) string {
+	// normalise the name
+	serviceName = strings.ToUpper(serviceName)
+
+	return fmt.Sprintf("ENCORE_CFG_%s", serviceName)
+}
diff --git a/runtimes/go/config/pkgfn.go b/runtimes/go/config/pkgfn.go
new file mode 100644
index 0000000000..5b29d8768c
--- /dev/null
+++ b/runtimes/go/config/pkgfn.go
@@ -0,0 +1,54 @@
+//go:build encore_app
+
+// Package config provides a simple way to access configuration values for a
+// service using the Load function.
+//
+// # By default configuration is pulled at build time from CUE files in each service directory
+//
+// For more information about configuration see https://encore.dev/docs/develop/config.
+package config
+
+import (
+	"fmt"
+
+	"encore.dev/appruntime/shared/jsonapi"
+	"encore.dev/appruntime/shared/reqtrack"
+)
+
+//publicapigen:drop
+var Singleton = NewManager(reqtrack.Singleton, jsonapi.Default)
+
+// Load returns the fully loaded configuration for this service.
+//
+// The configuration is loaded from the CUE files in the service directory and
+// will be validated by Encore at compile time, which ensures this function will
+// return a valid configuration at runtime.
+//
+// Encore will generate a `encore.gen.cue` file in the service directory which
+// will contain generated CUE matching the configuration type T.
+//
+// Note: This function can only be called from within services and cannot be
+// referenced from other services.
+func Load[T any](__serviceName string, __unmarshaler Unmarshaler[T]) T {
+	// Get the computed cfg
+	cfgBytes, found, err := Singleton.getComputedCUE(__serviceName)
+	if err != nil {
+		// If the config is not found, return a zero value
+		if !found {
+			var zero T
+			return zero
+		}
+
+		panic(err.Error())
+	}
+
+	// Create an iterator for the JSON config
+	itr := Singleton.json.BorrowIterator(cfgBytes)
+	defer Singleton.json.ReturnIterator(itr)
+	if itr.Error != nil {
+		panic(fmt.Sprintf("failed to unmarshal config for service %s: %v", __serviceName, itr.Error))
+	}
+
+	// Now unmarshal the root object
+	return __unmarshaler(itr, nil)
+}
diff --git a/runtimes/go/config/test_internal.go b/runtimes/go/config/test_internal.go
new file mode 100644
index 0000000000..76653d5542
--- /dev/null
+++ b/runtimes/go/config/test_internal.go
@@ -0,0 +1,62 @@
+//go:build encore_app
+
+package config
+
+// SetValueForTest changes the value of cfg to newValue within the current test and any subtests.
+func SetValueForTest[T any](value Value[T], newValue T) {
+	// Check we're running in a test
+	req := Singleton.rt.Current().Req
+	if req == nil || req.Test == nil {
+		panic("et.SetCfg called outside of a unit test")
+	}
+
+	// Get the value ID
+	valueID, _ := GetMetaForValue(value)
+
+	Singleton.testMutex.Lock()
+	defer Singleton.testMutex.Unlock()
+
+	// Get the overrides map for this test
+	overrides, found := Singleton.testOverrides[req.Test.Current]
+	if !found {
+		overrides = make(map[ValueID]any)
+		Singleton.testOverrides[req.Test.Current] = overrides
+	}
+
+	overrides[valueID] = newValue
+}
+
+// testOverrideOrValue returns an overridden value if one exists for this test or it's parents
+// otherwise it returns the originalValue.
+//
+// If we're not in a unit test, it returns the originalValue.
+func testOverrideOrValue[T any](valueID ValueID, originalValue T) T {
+	req := Singleton.rt.Current().Req
+	if req == nil || req.Test == nil {
+		// Not in a unit test
+		return originalValue
+	}
+	testData := req.Test
+
+	Singleton.testMutex.RLock()
+	defer Singleton.testMutex.RUnlock()
+
+	// Get the overrides map for this test or any of the parent tests
+	for testData != nil && testData.Current != nil {
+		// Check if this test has overrides
+		overrides, found := Singleton.testOverrides[testData.Current]
+		if found {
+			if overriddenValue, found := overrides[valueID]; found {
+				return overriddenValue.(T)
+			}
+		}
+
+		// Iterate up the test parents
+		if testData.Parent == nil {
+			break
+		}
+		testData = testData.Parent.Test
+	}
+
+	return originalValue
+}
diff --git a/runtimes/go/config/types.go b/runtimes/go/config/types.go
new file mode 100644
index 0000000000..155b4e3ec2
--- /dev/null
+++ b/runtimes/go/config/types.go
@@ -0,0 +1,47 @@
+package config
+
+import (
+	"time"
+
+	"encore.dev/types/uuid"
+)
+
+// Value represents a value in the configuration for this application
+// which can be any value represented in the configuration files.
+//
+// It is a function because the underlying value could change while
+// the application is still running due to unit tests providing
+// overrides to test different behaviours. To change the value within
+// a single unit test, use the et.SetCfg function.
+type Value[T any] func() T
+
+// Values represents a list of values in the configuration for this
+// application which can be any value represented in the configuration files.
+//
+// It is a function because the underlying value could change while
+// the application is still running due to unit tests providing
+// overrides to test different behaviours.
+type Values[T any] func() []T
+
+/*
+The following types represent syntax sugar and are all just shorthand for
+Value[T]
+*/
+
+type Bool = Value[bool]
+type Int8 = Value[int8]
+type Int16 = Value[int16]
+type Int32 = Value[int32]
+type Int64 = Value[int64]
+type Uint8 = Value[uint8]
+type Uint16 = Value[uint16]
+type Uint32 = Value[uint32]
+type Uint64 = Value[uint64]
+type Float32 = Value[float32]
+type Float64 = Value[float64]
+type String = Value[string]
+type Bytes = Value[[]byte]
+type Time = Value[time.Time]
+type UUID = Value[uuid.UUID]
+type Int = Value[int]
+type Uint = Value[uint]
diff --git a/runtimes/go/cron/cron.go b/runtimes/go/cron/cron.go
new file mode 100644
index 0000000000..0e00a00f34
--- /dev/null
+++ b/runtimes/go/cron/cron.go
@@ -0,0 +1,98 @@
+// Package cron provides support for cron jobs: recurring tasks that run on a schedule.
+//
+// For more information about Encore's cron job support, see https://encore.dev/docs/develop/cron-jobs.
+package cron
+
+// NewJob defines a new cron job. It is specially recognized by the Encore Parser
+// and results in the Encore Platform provisioning the cron job on next deploy.
+// Note that cron jobs do not automatically execute when running the application locally.
+// To test the cron job implementation, test the target endpoint directly.
+//
+// The id argument is a unique identifier you give to each cron job. If you later
+// refactor the code and move the cron job definition to another package, Encore uses
+// this ID to keep track that it's the same cron job and not a different one.
+//
+// The ID must be defined in kebab-case, be no longer than 63 characters, start with
+// a letter and end with either a letter or number.
+//
+// The fields provided in the JobConfig must be constant literals, as they are parsed
+// directly by the Encore Platform and are not actually executed at runtime.
+//
+// To define a new cron job, call NewJob and assign it a package-level variable:
+//
+//	import "encore.dev/cron"
+//
+//	// Send a welcome email to everyone who signed up in the last two hours.
+//	var _ = cron.NewJob("welcome-email", cron.JobConfig{
+//		Title:    "Send welcome emails",
+//		Every:    2 * cron.Hour,
+//		Endpoint: SendWelcomeEmail,
+//	})
+//
+//	// SendWelcomeEmail emails everyone who signed up recently.
+//	// It's idempotent: it only sends a welcome email to each person once.
+//	//encore:api private
+//	func SendWelcomeEmail(ctx context.Context) error {
+//		// ...
+//		return nil
+//	}
+func NewJob(id string, jobConfig JobConfig) *Job {
+	return &Job{
+		ID:       id,
+		Title:    jobConfig.Title,
+		Every:    jobConfig.Every,
+		Schedule: jobConfig.Schedule,
+		Endpoint: jobConfig.Endpoint,
+	}
+}
+
+// JobConfig represents the configuration of a single cron job.
+//
+// The fields provided in the JobConfig must be constant literals, as they are parsed
+// directly by the Encore Platform and are not actually executed at runtime.
+type JobConfig struct {
+	// Title is the descriptive title of the cron job, typically a short sentence like "Send welcome emails".
+	Title string
+
+	// Endpoint is the Encore API endpoint that should be called when the cron job executes.
+	// It must not take any parameters other than context.Context; that is, its signature must be
+	// either "func(context.Context) error" or "func(context.Context) (T, error)" for any type T.
+	Endpoint any
+
+	// Every defines how often the cron job should execute.
+	// You must either specify either Every or Schedule (but not both).
+	//
+	// In order to ensure a consistent delay between each run, the interval used must divide 24 hours evenly.
+	// For example, 10 * cron.Minute and 6 * cron.Hour are both allowed (since 24 hours is evenly divisible by both),
+	// whereas 7 * cron.Hour is not (since 24 is not evenly divisible by 7).
+	//
+	// The Encore compiler will catch this and give you a helpful error at compile-time if you try to use an invalid interval.
+	Every Duration
+
+	// Schedule defines when the cron job should execute, using a Cron Expression.
+	// You must either specify either Every or Schedule (but not both).
+	//
+	// For more information on cron expressions, see https://en.wikipedia.org/wiki/Cron.
+	Schedule string
+}
+
+// Job represents a created cron job. It can be inspected at runtime to determine information
+// about the cron job.
+type Job struct {
+	ID       string
+	Title    string
+	Every    Duration
+	Schedule string
+	Endpoint interface{}
+}
+
+// Duration represents the duration between cron execution intervals, expressed in seconds.
+// Specific durations can easily be achieved using constant expressions, such as:
+//
+//	cron.Hour + 30*cron.Minute // 90 minutes
+type Duration int64
+
+const (
+	Minute Duration = 60
+	Hour   Duration = 60 * Minute
+)
diff --git a/runtimes/go/et/auth.go b/runtimes/go/et/auth.go
new file mode 100644
index 0000000000..9bf0206537
--- /dev/null
+++ b/runtimes/go/et/auth.go
@@ -0,0 +1,23 @@
+package et
+
+import (
+	"fmt"
+
+	"encore.dev/appruntime/apisdk/api"
+	"encore.dev/beta/auth"
+)
+
+func (mgr *Manager) OverrideAuthInfo(uid auth.UID, authData any) {
+	if curr := mgr.rt.Current(); curr.Req != nil {
+		if err := api.CheckAuthData(uid, authData); err != nil {
+			panic(fmt.Errorf("override auth info: %v", err))
+		}
+		if rpcData := curr.Req.RPCData; rpcData != nil {
+			rpcData.UserID = uid
+			rpcData.AuthData = authData
+		} else if testData := curr.Req.Test; testData != nil {
+			testData.UserID = uid
+			testData.AuthData = authData
+		}
+	}
+}
diff --git a/runtimes/go/et/config.go b/runtimes/go/et/config.go
new file mode 100644
index 0000000000..4b2df12ac9
--- /dev/null
+++ b/runtimes/go/et/config.go
@@ -0,0 +1,29 @@
+//go:build encore_app
+
+package et
+
+import (
+	"reflect"
+
+	"encore.dev/config"
+)
+
+// SetCfg changes the value of cfg to newValue within the current test and any subtests.
+// Other tests running will not be affected.
+//
+// It does not support setting slices and panics if given a config value that is a slice.
+func SetCfg[T any](cfg config.Value[T], newValue T) {
+	if Singleton.runtime.EnvType != "test" {
+		panic("et: cannot set config in non-test environment")
+	}
+
+	rt := reflect.TypeOf(newValue)
+	switch rt.Kind() {
+	case reflect.Slice:
+		panic("et.SetCfg does not support setting slices")
+	case reflect.Array:
+		panic("et.SetCfg does not support setting arrays")
+	}
+
+	config.SetValueForTest[T](cfg, newValue)
+}
diff --git a/runtimes/go/et/manager_internal.go b/runtimes/go/et/manager_internal.go
new file mode 100644
index 0000000000..9f7052a191
--- /dev/null
+++ b/runtimes/go/et/manager_internal.go
@@ -0,0 +1,28 @@
+package et
+
+import (
+	"encore.dev/appruntime/apisdk/api"
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/testsupport"
+	"encore.dev/storage/sqldb"
+)
+
+//publicapigen:drop
+type Manager struct {
+	static  *config.Static
+	runtime *config.Runtime
+	rt      *reqtrack.RequestTracker
+	testMgr *testsupport.Manager
+	server  *api.Server
+	db      *sqldb.Manager
+}
+
+//publicapigen:drop
+func NewManager(static *config.Static, runtime *config.Runtime, rt *reqtrack.RequestTracker, testMgr *testsupport.Manager, server *api.Server, db *sqldb.Manager) *Manager {
+	if runtime.EnvType != "test" {
+		panic("et: cannot create manager in non-test environment")
+	}
+
+	return &Manager{static, runtime, rt, testMgr, server, db}
+}
diff --git a/runtimes/go/et/mocking.go b/runtimes/go/et/mocking.go
new file mode 100644
index 0000000000..1dd0b81c90
--- /dev/null
+++ b/runtimes/go/et/mocking.go
@@ -0,0 +1,115 @@
+//go:build encore_app
+
+package et
+
+import (
+	"fmt"
+	"reflect"
+)
+
+// MockOption is a function that can be passed to MockEndpoint or MockService to configure the mocking behavior.
+type MockOption func(*mockOptions)
+
+//publicapigen:keep
+type mockOptions struct {
+	runMiddleware bool
+}
+
+// RunMiddleware is a MockOption that sets whether to run the middleware chain
+// prior to invoking the mock.
+func RunMiddleware(enabled bool) MockOption {
+	return func(options *mockOptions) {
+		options.runMiddleware = enabled
+	}
+}
+
+// MockEndpoint allows you to mock out an endpoint in your tests; Any calls made to the endpoint
+// during this test or any of its sub-tests will be routed to the mock you provide.
+//
+// Your mocked function must match the signature of the endpoint you are mocking.
+//
+// For example, if you have an endpoint defined as:
+//
+//	//encore:api public
+//	func MyAPI(ctx context.Context, req *MyAPIRequest) (*MyAPIResponse, error) {
+//		...
+//	}
+//
+// You can mock it out in your test as:
+//
+//	et.MockEndpoint(mysvc.MyAPI, func(ctx context.Context, req *MyAPIRequest) (*MyAPIResponse, error) {
+//		...
+//	})
+//
+// If you want to mock out a single endpoint method on a service, you can use the generated helper
+// package function as the `originalEndpoint` argument to this function, however if you want to
+// mock out more than one API method on a service, consider using [MockService].
+//
+// Note: if you use [MockService] to mock a service and then use this function to mock
+// an endpoint on that service, the endpoint mock will take precedence over the service mock.
+//
+// Setting the mock to nil will remove the endpoint mock.
+func MockEndpoint[T any](originalEndpoint T, mock T, opts ...MockOption) {
+	if Singleton.runtime.EnvType != "test" {
+		panic("et: cannot mock endpoint in non-test environment")
+	}
+	options := &mockOptions{}
+	for _, opt := range opts {
+		opt(options)
+	}
+
+	handler := Singleton.server.HandlerForFunc(originalEndpoint)
+	if handler == nil {
+		panic(fmt.Sprintf("the function %T does not appear to be labelled as an Encore API.", originalEndpoint))
+	}
+
+	// This code ensures if the user set a `nil` mock, we get an untyped nil
+	// instead of a typed nil - which we can't check without reflecting and given
+	// that is checked in the hot path pf the Desc.Call method, it's better to do it here
+	var mockFunctionAsAny any
+	if reflect.ValueOf(mock).IsValid() && !reflect.ValueOf(mock).IsNil() {
+		mockFunctionAsAny = mock
+	}
+
+	Singleton.testMgr.SetAPIMock(handler.ServiceName(), handler.EndpointName(), mockFunctionAsAny, options.runMiddleware)
+}
+
+// MockService allows you to mock out a service in your tests; Any calls made to the service
+// during this test or any of its sub-tests will be routed to the mock you provide.
+//
+// Your mock must implement the all the API methods of the service which are used during the
+// test(s). If you do not implement a method, it will panic when that method is called.
+//
+// If you want to ensure compile time safety, you can use the Interface type generated for
+// the service, which will ensure that you implement all the methods. For example:
+//
+//	package svca
+//
+//	import (
+//		"testing"
+//		"encore.dev/et"
+//
+//		"encore.app/svcb"
+//	)
+//
+//	func TestServiceA(t *testing.T) {
+//		et.MockService[svcb.Interface]("svcb", &myMockType{})
+//		SomeFuncInThisPackageWhichUltimatelyCallsServiceB()
+//	}
+//
+// Setting the mock to nil will remove the service mock.
+func MockService[T any](serviceName string, mock T, opts ...MockOption) {
+	if Singleton.runtime.EnvType != "test" {
+		panic("et: cannot mock service in non-test environment")
+	}
+	options := &mockOptions{}
+	for _, opt := range opts {
+		opt(options)
+	}
+
+	if !Singleton.server.ServiceExists(serviceName) {
+		panic(fmt.Sprintf("cannot mock service %s: service does not exist", serviceName))
+	}
+
+	Singleton.testMgr.SetServiceMock(serviceName, mock, options.runMiddleware)
+}
diff --git a/runtimes/go/et/package.go b/runtimes/go/et/package.go
new file mode 100644
index 0000000000..fa410a839b
--- /dev/null
+++ b/runtimes/go/et/package.go
@@ -0,0 +1,3 @@
+// Package et stands for Encore Tests and provides a number of functions and tools for writing fully integrated
+// test suites for Encore applications.
+package et
diff --git a/runtimes/go/et/pkgfn.go b/runtimes/go/et/pkgfn.go
new file mode 100644
index 0000000000..55a10e532f
--- /dev/null
+++ b/runtimes/go/et/pkgfn.go
@@ -0,0 +1,73 @@
+//go:build encore_app
+
+package et
+
+import (
+	"context"
+	"fmt"
+
+	"encore.dev/beta/auth"
+	"encore.dev/storage/sqldb"
+)
+
+// OverrideAuthInfo overrides the auth information for the current request.
+// Subsequent calls to auth.UserID and auth.Data() within the same request
+// will return the given uid and data, and API calls made from the request
+// will propagate the newly set user info.
+//
+// Passing in an empty string as the uid results in unsetting the auth information,
+// causing future API calls to behave as if there was no authenticated user.
+//
+// If the application's auth handler returns custom auth data, two additional
+// requirements exist. First, the data parameter passed to WithContext must be of
+// the same type as the auth handler returns. Second, if the uid argument is not
+// the empty string then data may not be nil. If these requirements are not met,
+// API calls made with these options will not be made and will immediately return
+// a client-side error.
+//
+// OverrideAuthInfo is not safe for concurrent use with code that invokes
+// auth.UserID or auth.Data() within the same request.
+func OverrideAuthInfo(uid auth.UID, data any) {
+	if Singleton.runtime.EnvType != "test" {
+		panic("et: cannot override auth info in non-test environment")
+	}
+	Singleton.OverrideAuthInfo(uid, data)
+}
+
+// EnableServiceInstanceIsolation will causes all Service singletons to be isolated to each test
+// from this test and on any of its sub-tests. (Calling this in a TestMain has the impact
+// of isolating all tests in the package.)
+//
+// By default, Service singletons are shared across all tests and initialized on
+// the first call to that service by any test, which results in faster tests as you
+// are not re-initializing the service for each test, however if your service structs
+// contain state that is not reset between tests, this can cause issues. In that case,
+// you can call this function to isolate the services for the impacted tests.
+func EnableServiceInstanceIsolation() {
+	if Singleton.runtime.EnvType != "test" {
+		panic("et: cannot enable service instance isolation in non-test environment")
+	}
+	Singleton.testMgr.SetIsolatedServices(true)
+}
+
+//publicapigen:keep
+type stringLiteral string
+
+// NewTestDatabase creates a new, fresh database for the database with the given name.
+// The database name must be a database known to Encore (via `sqldb.NewDatabase`),
+// otherwise it reports an error.
+//
+// The new database is cloned from a template database that has had all migrations applied to it,
+// but excludes any of the changes applied to the given db.
+//
+// The returned database is isolated to the current test and any sub-tests,
+// and is automatically dropped at the end of the test, and any
+// open connections are automatically closed.
+//
+// The provided name must be a constant string literal (like "mydb").
+func NewTestDatabase(ctx context.Context, name stringLiteral) (*sqldb.Database, error) {
+	if Singleton.runtime.EnvType != "test" {
+		return nil, fmt.Errorf("et: cannot create test database in non-test environment")
+	}
+	return Singleton.db.NewTestDatabase(ctx, string(name))
+}
diff --git a/runtimes/go/et/pubsub.go b/runtimes/go/et/pubsub.go
new file mode 100644
index 0000000000..32fd0799b9
--- /dev/null
+++ b/runtimes/go/et/pubsub.go
@@ -0,0 +1,25 @@
+//go:build encore_app
+
+package et
+
+import (
+	"encore.dev/pubsub"
+)
+
+// Topic returns a TopicHelper for the given topic.
+func Topic[T any](topic *pubsub.Topic[T]) TopicHelpers[T] {
+	if Singleton.runtime.EnvType != "test" {
+		panic("et: cannot mock topic in non-test environment")
+	}
+	return pubsub.GetTestTopicInstance(topic).(TopicHelpers[T])
+}
+
+// TopicHelpers provides functions for interacting with the backing topic implementation
+// during unit tests. It is designed to help test code that uses the pubsub.Topic
+//
+// Note all functions on this TopicHelpers are scoped to the current test
+// and will only impact and observe state from the current test
+type TopicHelpers[T any] interface {
+	// PublishedMessages returns a slice of all messages published during this test on this topic.
+	PublishedMessages() []T
+}
diff --git a/runtimes/go/et/singleton_internal.go b/runtimes/go/et/singleton_internal.go
new file mode 100644
index 0000000000..f9cbd5b3b8
--- /dev/null
+++ b/runtimes/go/et/singleton_internal.go
@@ -0,0 +1,14 @@
+//go:build encore_app
+
+package et
+
+import (
+	"encore.dev/appruntime/apisdk/api"
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/testsupport"
+	"encore.dev/storage/sqldb"
+)
+
+//publicapigen:drop
+var Singleton = NewManager(appconf.Static, appconf.Runtime, reqtrack.Singleton, testsupport.Singleton, api.Singleton, sqldb.Singleton)
diff --git a/runtimes/go/et/sqldb.go b/runtimes/go/et/sqldb.go
new file mode 100644
index 0000000000..7325006d7d
--- /dev/null
+++ b/runtimes/go/et/sqldb.go
@@ -0,0 +1,11 @@
+package et
+
+import (
+	"context"
+
+	"encore.dev/storage/sqldb"
+)
+
+func (mgr *Manager) NewTestDatabase(ctx context.Context, name string) (*sqldb.Database, error) {
+	return mgr.db.NewTestDatabase(ctx, name)
+}
diff --git a/runtimes/go/example_test.go b/runtimes/go/example_test.go
new file mode 100644
index 0000000000..282c81bdbc
--- /dev/null
+++ b/runtimes/go/example_test.go
@@ -0,0 +1,52 @@
+//go:build encore_app
+
+package encore_test
+
+import (
+	"fmt"
+	"time"
+
+	"encore.dev"
+)
+
+type Client interface{}
+
+var client Client
+
+func NewRedshiftClient() Client         { return nil }
+func NewBigQueryClient() Client         { return nil }
+func LocalFileWriter(dir string) Client { return nil }
+
+// Change the implementation of some code based on which cloud provider is being used.
+func ExampleMeta() {
+	switch encore.Meta().Environment.Cloud {
+	case encore.CloudAWS:
+		client = NewRedshiftClient()
+	case encore.CloudGCP:
+		client = NewBigQueryClient()
+	case encore.CloudLocal:
+		client = LocalFileWriter("/tmp/app-writes.txt")
+	default:
+		panic("unsupported cloud provider")
+	}
+}
+
+// Check if the application is running in production
+func ExampleMeta_2() {
+	if encore.Meta().Environment.Type != encore.EnvProduction {
+		fmt.Println("running in development")
+	} else {
+		fmt.Println("running in production")
+	}
+	// Output: running in development
+}
+
+func ExampleCurrentRequest() {
+	req := encore.CurrentRequest()
+	elapsed := time.Since(req.Started)
+
+	if req.Type == encore.APICall {
+		fmt.Printf("%s.%s has been running for %.3f seconds", req.Service, req.Endpoint, elapsed.Seconds())
+	}
+	// Output: myservice.api has been running for 0.543 seconds
+}
diff --git a/runtimes/go/go.mod b/runtimes/go/go.mod
new file mode 100644
index 0000000000..f69df96184
--- /dev/null
+++ b/runtimes/go/go.mod
@@ -0,0 +1,113 @@
+module encore.dev
+
+go 1.23.0
+
+require (
+	cloud.google.com/go/compute/metadata v0.5.0
+	cloud.google.com/go/monitoring v1.20.4
+	cloud.google.com/go/pubsub v1.41.0
+	cloud.google.com/go/storage v1.41.0
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.1.3
+	github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.1.0
+	github.com/Azure/azure-sdk-for-go/sdk/messaging/azservicebus v1.1.0
+	github.com/DataDog/datadog-api-client-go/v2 v2.9.0
+	github.com/alicebob/miniredis/v2 v2.23.0
+	github.com/aws/aws-sdk-go-v2 v1.32.4
+	github.com/aws/aws-sdk-go-v2/config v1.26.6
+	github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.32.2
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.66.3
+	github.com/aws/aws-sdk-go-v2/service/sns v1.26.7
+	github.com/aws/aws-sdk-go-v2/service/sqs v1.29.7
+	github.com/aws/smithy-go v1.22.0
+	github.com/benbjohnson/clock v1.3.3
+	github.com/felixge/httpsnoop v1.0.4
+	github.com/frankban/quicktest v1.14.5
+	github.com/go-redis/redis/v8 v8.11.5
+	github.com/golang/mock v1.6.0
+	github.com/golang/protobuf v1.5.4
+	github.com/golang/snappy v0.0.4
+	github.com/google/go-cmp v0.6.0
+	github.com/jackc/pgx/v5 v5.4.3
+	github.com/json-iterator/go v1.1.12
+	github.com/julienschmidt/httprouter v1.3.0
+	github.com/modern-go/reflect2 v1.0.2
+	github.com/nsqio/go-nsq v1.1.0
+	github.com/rs/cors v1.8.3-0.20221003140808-fcebdb403f4d
+	github.com/rs/xid v1.5.0
+	github.com/rs/zerolog v1.31.0
+	go.encore.dev/platform-sdk v1.1.0
+	go.uber.org/automaxprocs v1.5.3
+	golang.org/x/crypto v0.25.0
+	golang.org/x/net v0.27.0
+	golang.org/x/sync v0.8.0
+	golang.org/x/time v0.6.0
+	google.golang.org/api v0.191.0
+	google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f
+	google.golang.org/grpc v1.64.1
+	google.golang.org/protobuf v1.34.2
+)
+
+require (
+	cloud.google.com/go v0.115.0 // indirect
+	cloud.google.com/go/auth v0.8.0 // indirect
+	cloud.google.com/go/auth/oauth2adapt v0.2.3 // indirect
+	cloud.google.com/go/iam v1.1.12 // indirect
+	github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.1 // indirect
+	github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0 // indirect
+	github.com/DataDog/zstd v1.5.0 // indirect
+	github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.6 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.16.16 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.23 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.18.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/dnaeon/go-vcr v1.2.0 // indirect
+	github.com/fsnotify/fsnotify v1.6.0 // indirect
+	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
+	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/google/s2a-go v0.1.8 // indirect
+	github.com/google/uuid v1.6.0 // indirect
+	github.com/googleapis/enterprise-certificate-proxy v0.3.2 // indirect
+	github.com/googleapis/gax-go/v2 v2.13.0 // indirect
+	github.com/jackc/pgpassfile v1.0.0 // indirect
+	github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a // indirect
+	github.com/jackc/puddle/v2 v2.2.1 // indirect
+	github.com/jmespath/go-jmespath v0.4.0 // indirect
+	github.com/klauspost/compress v1.17.0 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
+	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mattn/go-isatty v0.0.19 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/onsi/gomega v1.30.0 // indirect
+	github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 // indirect
+	github.com/rogpeppe/go-internal v1.11.0 // indirect
+	github.com/stretchr/testify v1.9.0 // indirect
+	github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64 // indirect
+	go.opencensus.io v0.24.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
+	go.opentelemetry.io/otel v1.24.0 // indirect
+	go.opentelemetry.io/otel/metric v1.24.0 // indirect
+	go.opentelemetry.io/otel/trace v1.24.0 // indirect
+	golang.org/x/oauth2 v0.22.0 // indirect
+	golang.org/x/sys v0.22.0 // indirect
+	golang.org/x/text v0.16.0 // indirect
+	google.golang.org/genproto v0.0.0-20240730163845-b1a4ccb954bf // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf // indirect
+	nhooyr.io/websocket v1.8.7 // indirect
+)
diff --git a/runtimes/go/go.sum b/runtimes/go/go.sum
new file mode 100644
index 0000000000..26989ba848
--- /dev/null
+++ b/runtimes/go/go.sum
@@ -0,0 +1,392 @@
+cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
+cloud.google.com/go v0.115.0 h1:CnFSK6Xo3lDYRoBKEcAtia6VSC837/ZkJuRduSFnr14=
+cloud.google.com/go v0.115.0/go.mod h1:8jIM5vVgoAEoiVxQ/O4BFTfHqulPZgs/ufEzMcFMdWU=
+cloud.google.com/go/auth v0.8.0 h1:y8jUJLl/Fg+qNBWxP/Hox2ezJvjkrPb952PC1p0G6A4=
+cloud.google.com/go/auth v0.8.0/go.mod h1:qGVp/Y3kDRSDZ5gFD/XPUfYQ9xW1iI7q8RIRoCyBbJc=
+cloud.google.com/go/auth/oauth2adapt v0.2.3 h1:MlxF+Pd3OmSudg/b1yZ5lJwoXCEaeedAguodky1PcKI=
+cloud.google.com/go/auth/oauth2adapt v0.2.3/go.mod h1:tMQXOfZzFuNuUxOypHlQEXgdfX5cuhwU+ffUuXRJE8I=
+cloud.google.com/go/compute/metadata v0.5.0 h1:Zr0eK8JbFv6+Wi4ilXAR8FJ3wyNdpxHKJNPos6LTZOY=
+cloud.google.com/go/compute/metadata v0.5.0/go.mod h1:aHnloV2TPI38yx4s9+wAZhHykWvVCfu7hQbF+9CWoiY=
+cloud.google.com/go/iam v1.1.12 h1:JixGLimRrNGcxvJEQ8+clfLxPlbeZA6MuRJ+qJNQ5Xw=
+cloud.google.com/go/iam v1.1.12/go.mod h1:9LDX8J7dN5YRyzVHxwQzrQs9opFFqn0Mxs9nAeB+Hhg=
+cloud.google.com/go/kms v1.18.4 h1:dYN3OCsQ6wJLLtOnI8DGUwQ5shMusXsWCCC+s09ATsk=
+cloud.google.com/go/kms v1.18.4/go.mod h1:SG1bgQ3UWW6/KdPo9uuJnzELXY5YTTMJtDYvajiQ22g=
+cloud.google.com/go/longrunning v0.5.11 h1:Havn1kGjz3whCfoD8dxMLP73Ph5w+ODyZB9RUsDxtGk=
+cloud.google.com/go/longrunning v0.5.11/go.mod h1:rDn7//lmlfWV1Dx6IB4RatCPenTwwmqXuiP0/RgoEO4=
+cloud.google.com/go/monitoring v1.20.4 h1:zwcViK7mT9SV0kzKqLOI3spRadvsmvw/R9z1MHNeC0E=
+cloud.google.com/go/monitoring v1.20.4/go.mod h1:v7F/UcLRw15EX7xq565N7Ae5tnYEE28+Cl717aTXG4c=
+cloud.google.com/go/pubsub v1.41.0 h1:ZPaM/CvTO6T+1tQOs/jJ4OEMpjtel0PTLV7j1JK+ZrI=
+cloud.google.com/go/pubsub v1.41.0/go.mod h1:g+YzC6w/3N91tzG66e2BZtp7WrpBBMXVa3Y9zVoOGpk=
+cloud.google.com/go/storage v1.41.0 h1:RusiwatSu6lHeEXe3kglxakAmAbfV+rhtPqA6i8RBx0=
+cloud.google.com/go/storage v1.41.0/go.mod h1:J1WCa/Z2FcgdEDuPUY8DxT5I+d9mFKsCepp5vR6Sq80=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.1.3 h1:8LoU8N2lIUzkmstvwXvVfniMZlFbesfT2AmA1aqvRr8=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.1.3/go.mod h1:uGG2W01BaETf0Ozp+QxxKJdMBNRWPdstHG0Fmdwn1/U=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.1.0 h1:QkAcEIAKbNL4KoFr4SathZPhDhF4mVwpBMFlYjyAqy8=
+github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.1.0/go.mod h1:bhXu1AjYL+wutSL/kpSq6s7733q2Rb0yuot9Zgfqa/0=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.1 h1:XUNQ4mw+zJmaA2KXzP9JlQiecy1SI+Eog7xVkPiqIbg=
+github.com/Azure/azure-sdk-for-go/sdk/internal v1.0.1/go.mod h1:eWRD7oawr1Mu1sLCawqVc0CUiF43ia3qQMxLscsKQ9w=
+github.com/Azure/azure-sdk-for-go/sdk/messaging/azservicebus v1.1.0 h1:ebO2jmZyctLSMBTvjsxZv/Ml3rGsvnJHUImVWotBl7I=
+github.com/Azure/azure-sdk-for-go/sdk/messaging/azservicebus v1.1.0/go.mod h1:LH9XQnMr2ZYxQdVdCrzLO9mxeDyrDFa6wbSI3x5zCZk=
+github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0 h1:VgSJlZH5u0k2qxSpqyghcFQKmvYckj46uymKK5XzkBM=
+github.com/AzureAD/microsoft-authentication-library-for-go v0.7.0/go.mod h1:BDJ5qMFKx9DugEg3+uQSDCdbYPr5s9vBTrL9P8TpqOU=
+github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
+github.com/DataDog/datadog-api-client-go/v2 v2.9.0 h1:1Cz3mqj95iqnQPykEovq2p52rrU26XvLC2Fz6hPE+TU=
+github.com/DataDog/datadog-api-client-go/v2 v2.9.0/go.mod h1:sHt3EuVMN8PSYJu065qwp3pZxCwR3RZP4sJnYwj/ZQY=
+github.com/DataDog/zstd v1.5.0 h1:+K/VEwIAaPcHiMtQvpLD4lqW7f0Gk3xdYZmI1hD+CXo=
+github.com/DataDog/zstd v1.5.0/go.mod h1:g4AWEaM3yOg3HYfnJ3YIawPnVdXJh9QME85blwSAmyw=
+github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a h1:HbKu58rmZpUGpz5+4FfNmIU+FmZg2P3Xaj2v2bfNWmk=
+github.com/alicebob/gopher-json v0.0.0-20200520072559-a9ecdc9d1d3a/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
+github.com/alicebob/miniredis/v2 v2.23.0 h1:+lwAJYjvvdIVg6doFHuotFjueJ/7KY10xo/vm3X3Scw=
+github.com/alicebob/miniredis/v2 v2.23.0/go.mod h1:XNqvJdQJv5mSuVMc0ynneafpnL/zv52acZ6kqeS0t88=
+github.com/aws/aws-sdk-go-v2 v1.32.4 h1:S13INUiTxgrPueTmrm5DZ+MiAo99zYzHEFh1UNkOxNE=
+github.com/aws/aws-sdk-go-v2 v1.32.4/go.mod h1:2SK5n0a2karNTv5tbP1SjsX0uhttou00v/HpXKM1ZUo=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.6 h1:pT3hpW0cOHRJx8Y0DfJUEQuqPild8jRGmSFmBgvydr0=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.6/go.mod h1:j/I2++U0xX+cr44QjHay4Cvxj6FUbnxrgmqN3H1jTZA=
+github.com/aws/aws-sdk-go-v2/config v1.26.6 h1:Z/7w9bUqlRI0FFQpetVuFYEsjzE3h7fpU6HuGmfPL/o=
+github.com/aws/aws-sdk-go-v2/config v1.26.6/go.mod h1:uKU6cnDmYCvJ+pxO9S4cWDb2yWWIH5hra+32hVh1MI4=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.16 h1:8q6Rliyv0aUFAVtzaldUEcS+T5gbadPbWdV1WcAddK8=
+github.com/aws/aws-sdk-go-v2/credentials v1.16.16/go.mod h1:UHVZrdUsv63hPXFo1H7c5fEneoVo9UXiz36QG1GEPi0=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11 h1:c5I5iH+DZcH3xOIMlz3/tCKJDaHFwYEmxvlh2fAcFo8=
+github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11/go.mod h1:cRrYDYAMUohBJUtUnOhydaMHtiK/1NZ0Otc9lIb6O0Y=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23 h1:A2w6m6Tmr+BNXjDsr7M90zkWjsu4JXHwrzPg235STs4=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.23/go.mod h1:35EVp9wyeANdujZruvHiQUAo9E3vbhnIO1mTCAxMlY0=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23 h1:pgYW9FCabt2M25MoHYCfMrVY2ghiiBKYWUVXfwZs+sU=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.23/go.mod h1:c48kLgzO19wAu3CPkDWC28JbaJ+hfQlsdl7I2+oqIbk=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3 h1:n3GDfwqF2tzEkXlv5cuy4iy7LpKDtqDMcNLfZDu9rls=
+github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3/go.mod h1:6fQQgfuGmw8Al/3M2IgIllycxV7ZW7WCdVSqfBeUiCY=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.23 h1:1SZBDiRzzs3sNhOMVApyWPduWYGAX0imGy06XiBnCAM=
+github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.23/go.mod h1:i9TkxgbZmHVh2S0La6CAXtnyFhlCX/pJ0JsOvBAS6Mk=
+github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.32.2 h1:vQfCIHSDouEvbE4EuDrlCGKcrtABEqF3cMt61nGEV4g=
+github.com/aws/aws-sdk-go-v2/service/cloudwatch v1.32.2/go.mod h1:3ToKMEhVj+Q+HzZ8Hqin6LdAKtsi3zVXVNUPpQMd+Xk=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0 h1:TToQNkvGguu209puTojY/ozlqy2d/SFNcoLIqTFi42g=
+github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.0/go.mod h1:0jp+ltwkf+SwG2fm/PKo8t4y8pJSgOCO4D8Lz3k0aHQ=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.4 h1:aaPpoG15S2qHkWm4KlEyF01zovK1nW4BBbyXuHNSE90=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.4.4/go.mod h1:eD9gS2EARTKgGr/W5xwgY/ik9z/zqpW+m/xOQbVxrMk=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4 h1:tHxQi/XHPK0ctd/wdOw0t7Xrc2OxcRCnVzv8lwWPu0c=
+github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.4/go.mod h1:4GQbF1vJzG60poZqWatZlhP31y8PGCCVTvIGPdaaYJ0=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.4 h1:E5ZAVOmI2apR8ADb72Q63KqwwwdW1XcMeXIlrZ1Psjg=
+github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.4/go.mod h1:wezzqVUOVVdk+2Z/JzQT4NxAU0NbhRe5W8pIE72jsWI=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.66.3 h1:neNOYJl72bHrz9ikAEED4VqWyND/Po0DnEx64RW6YM4=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.66.3/go.mod h1:TMhLIyRIyoGVlaEMAt+ITMbwskSTpcGsCPDq91/ihY0=
+github.com/aws/aws-sdk-go-v2/service/sns v1.26.7 h1:DylmW2c1Z7qGxN3Y02k+voPbtM1mh7Rp+gV+7maG5io=
+github.com/aws/aws-sdk-go-v2/service/sns v1.26.7/go.mod h1:mLFiISZfiZAqZEfPWUsZBK8gD4dYCKuKAfapV+KrIVQ=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.29.7 h1:tRNrFDGRm81e6nTX5Q4CFblea99eAfm0dxXazGpLceU=
+github.com/aws/aws-sdk-go-v2/service/sqs v1.29.7/go.mod h1:8GWUDux5Z2h6z2efAtr54RdHXtLm8sq7Rg85ZNY/CZM=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.7 h1:eajuO3nykDPdYicLlP3AGgOyVN3MOlFmZv7WGTuJPow=
+github.com/aws/aws-sdk-go-v2/service/sso v1.18.7/go.mod h1:+mJNDdF+qiUlNKNC3fxn74WWNN+sOiGOEImje+3ScPM=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7 h1:QPMJf+Jw8E1l7zqhZmMlFw6w1NmfkfiSK8mS4zOx3BA=
+github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7/go.mod h1:ykf3COxYI0UJmxcfcxcVuz7b6uADi1FkiUz6Eb7AgM8=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.7 h1:NzO4Vrau795RkUdSHKEwiR01FaGzGOH1EETJ+5QHnm0=
+github.com/aws/aws-sdk-go-v2/service/sts v1.26.7/go.mod h1:6h2YuIoxaMSCFf5fi1EgZAwdfkGMgDY+DVfa61uLe4U=
+github.com/aws/smithy-go v1.22.0 h1:uunKnWlcoL3zO7q+gG2Pk53joueEOsnNB28QdMsmiMM=
+github.com/aws/smithy-go v1.22.0/go.mod h1:irrKGvNn1InZwb2d7fkIRNucdfwR8R+Ts3wxYa/cJHg=
+github.com/benbjohnson/clock v1.3.3 h1:g+rSsSaAzhHJYcIQE78hJ3AhyjjtQvleKDjlhdBnIhc=
+github.com/benbjohnson/clock v1.3.3/go.mod h1:J11/hYXuz8f4ySSvYwY0FKfm+ezbsZBKZxNJlLklBHA=
+github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
+github.com/cespare/xxhash/v2 v2.2.0 h1:DC2CZ1Ep5Y4k3ZQ899DldepgrayRUGE6BBZ/cd9Cj44=
+github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
+github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
+github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
+github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
+github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
+github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
+github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
+github.com/dnaeon/go-vcr v1.2.0 h1:zHCHvJYTMh1N7xnV7zf1m1GPBF9Ad0Jk/whtQ1663qI=
+github.com/dnaeon/go-vcr v1.2.0/go.mod h1:R4UdLID7HZT3taECzJs4YgbbH6PIGXB6W/sc5OLb6RQ=
+github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
+github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
+github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
+github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
+github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
+github.com/frankban/quicktest v1.14.5 h1:dfYrrRyLtiqT9GyKXgdh+k4inNeTvmGbuSgZ3lx3GhA=
+github.com/frankban/quicktest v1.14.5/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
+github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY=
+github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw=
+github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
+github.com/gin-gonic/gin v1.6.3/go.mod h1:75u5sXoLsGZoRN5Sgbi1eraJ4GU3++wFwWzhwvtwp4M=
+github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
+github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
+github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
+github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-playground/assert/v2 v2.0.1/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.13.0/go.mod h1:taPMhCMXrRLJO55olJkUXHZBHCxTMfnGwq/HNwmWNS8=
+github.com/go-playground/universal-translator v0.17.0/go.mod h1:UkSxE5sNxxRwHyU+Scu5vgOQjsIJAF8j9muTVoKLVtA=
+github.com/go-playground/validator/v10 v10.2.0/go.mod h1:uOYAAleCW8F/7oMFd6aG0GOhaH6EGOAJShg8Id5JGkI=
+github.com/go-redis/redis/v8 v8.11.5 h1:AcZZR7igkdvfVmQTPnu9WE37LRrO/YrBH5zWyjDC0oI=
+github.com/go-redis/redis/v8 v8.11.5/go.mod h1:gREzHqY1hg6oD9ngVRbLStwAWKhA0FEgq8Jd4h5lpwo=
+github.com/gobwas/httphead v0.0.0-20180130184737-2c6c146eadee/go.mod h1:L0fX3K22YWvt/FAX9NnzrNzcI4wNYi9Yku4O0LKYflo=
+github.com/gobwas/pool v0.2.0/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6WezmKEw=
+github.com/gobwas/ws v1.0.2/go.mod h1:szmBTxLgaFppYjEmNtny/v3w89xOydFnnZMcgRRu/EM=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/golang-jwt/jwt/v4 v4.5.0 h1:7cYmW1XlMY7h7ii7UhUyChSgS5wUJEnm9uZVTGqOWzg=
+github.com/golang-jwt/jwt/v4 v4.5.0/go.mod h1:m21LjoU+eqJr34lmDMbreY2eSTRJ1cv77w39/MY0Ch0=
+github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
+github.com/golang/groupcache v0.0.0-20200121045136-8c9f03a8e57e/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da h1:oI5xCqsCo564l8iNU+DwB5epxmsaqB+rhGL0m5jtYqE=
+github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
+github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
+github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
+github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
+github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
+github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
+github.com/golang/protobuf v1.3.5/go.mod h1:6O5/vntMXwX2lRkT1hjjk0nAC1IDOTvTlVgjlRvqsdk=
+github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
+github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
+github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
+github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
+github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
+github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
+github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/golang/snappy v0.0.1/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
+github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
+github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
+github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.3/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/google/martian/v3 v3.3.3 h1:DIhPTQrbPkgs2yJYdXU/eNACCG5DVQjySNRNlflZ9Fc=
+github.com/google/martian/v3 v3.3.3/go.mod h1:iEPrYcgCF7jA9OtScMFQyAlZZ4YXTKEtJ1E6RWzmBA0=
+github.com/google/s2a-go v0.1.8 h1:zZDs9gcbt9ZPLV0ndSyQk6Kacx2g/X+SKYovpnz3SMM=
+github.com/google/s2a-go v0.1.8/go.mod h1:6iNWHTpQ+nfNRN5E00MSdfDwVesa8hhS32PhPO8deJA=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
+github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2 h1:Vie5ybvEvT75RniqhfFxPRy3Bf7vr3h0cechB90XaQs=
+github.com/googleapis/enterprise-certificate-proxy v0.3.2/go.mod h1:VLSiSSBs/ksPL8kq3OBOQ6WRI2QnaFynd1DCjZ62+V0=
+github.com/googleapis/gax-go/v2 v2.13.0 h1:yitjD5f7jQHhyDsnhKEBU52NdvvdSeGzlAnDPT0hH1s=
+github.com/googleapis/gax-go/v2 v2.13.0/go.mod h1:Z/fvTZXF8/uw7Xu5GuslPw+bplx6SS338j1Is2S+B7A=
+github.com/gorilla/websocket v1.4.1/go.mod h1:YR8l580nyteQvAITg2hZ9XVh4b55+EU/adAjf1fMHhE=
+github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsIM=
+github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a h1:bbPeKD0xmW/Y25WS6cokEszi5g+S0QxI/d45PkRi7Nk=
+github.com/jackc/pgservicefile v0.0.0-20221227161230-091c0ba34f0a/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
+github.com/jackc/pgx/v5 v5.4.3 h1:cxFyXhxlvAifxnkKKdlxv8XqUf59tDlYjnV5YYfsJJY=
+github.com/jackc/pgx/v5 v5.4.3/go.mod h1:Ig06C2Vu0t5qXC60W8sqIthScaEnFvojjj9dSljmHRA=
+github.com/jackc/puddle/v2 v2.2.1 h1:RhxXJtFG022u4ibrCSMSiu5aOq1i77R3OHKNJj77OAk=
+github.com/jackc/puddle/v2 v2.2.1/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
+github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
+github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
+github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
+github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
+github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
+github.com/json-iterator/go v1.1.9/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
+github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
+github.com/klauspost/compress v1.10.3/go.mod h1:aoV0uJVorq1K+umq18yTdKaF57EivdYsUV+/s2qKfXs=
+github.com/klauspost/compress v1.17.0 h1:Rnbp4K9EjcDuVuHtd0dgA4qNuv9yKDYKK1ulpJwgrqM=
+github.com/klauspost/compress v1.17.0/go.mod h1:ntbaceVETuRiXiv4DpjP66DpAtAGkEQskQzEyD//IeE=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
+github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/leodido/go-urn v1.2.0/go.mod h1:+8+nEpDfqqsY+g338gtMEUOtuK+4dEMhiQEgxpxOKII=
+github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
+github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg=
+github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
+github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM=
+github.com/mattn/go-isatty v0.0.19 h1:JITubQf0MOLdlGRuRq+jtsDlekdYPia9ZFsB8h/APPA=
+github.com/mattn/go-isatty v0.0.19/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v0.0.0-20180701023420-4b7aa43c6742/go.mod h1:bx2lNnkwVCuqBIxFjflWJWanXIb3RllmbCylyMrvgv0=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modocache/gover v0.0.0-20171022184752-b58185e213c5/go.mod h1:caMODM3PzxT8aQXRPkAt8xlV/e7d7w8GM5g0fa5F0D8=
+github.com/nsqio/go-nsq v1.1.0 h1:PQg+xxiUjA7V+TLdXw7nVrJ5Jbl3sN86EhGCQj4+FYE=
+github.com/nsqio/go-nsq v1.1.0/go.mod h1:vKq36oyeVXgsS5Q8YEO7WghqidAVXQlcFxzQbQTuDEY=
+github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
+github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
+github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
+github.com/onsi/ginkgo v1.16.5/go.mod h1:+E8gABHa3K6zRBolWtd+ROzc/U5bkGt0FwiG042wbpU=
+github.com/onsi/gomega v1.30.0 h1:hvMK7xYz4D3HapigLTeGdId/NcfQx1VHMJc60ew99+8=
+github.com/onsi/gomega v1.30.0/go.mod h1:9sxs+SwGrKI0+PWe4Fxa9tFQQBG5xSsSbMXOI8PPpoQ=
+github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU=
+github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
+github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
+github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.11.0 h1:cWPaGQEPrBb5/AsnsZesgZZ9yb1OQ+GOISoDNXVBh4M=
+github.com/rogpeppe/go-internal v1.11.0/go.mod h1:ddIwULY96R17DhadqLgMfk9H9tvdUzkipdSkR5nkCZA=
+github.com/rs/cors v1.8.3-0.20221003140808-fcebdb403f4d h1:gNEXs+4IbftZmT6WnAJbBWgbPrjDjqaMfuNeKODqBhc=
+github.com/rs/cors v1.8.3-0.20221003140808-fcebdb403f4d/go.mod h1:XyqrcTp5zjWr1wsJ8PIRZssZ8b/WMcMf71DJnit4EMU=
+github.com/rs/xid v1.5.0 h1:mKX4bl4iPYJtEIxp6CYiUuLQ/8DYMoz0PUdtGgMFRVc=
+github.com/rs/xid v1.5.0/go.mod h1:trrq9SKmegXys3aeAKXMUTdJsYXVwGY3RLcfgqegfbg=
+github.com/rs/zerolog v1.31.0 h1:FcTR3NnLWW+NnTwwhFWiJSZr4ECLpqCm6QsEnyvbV4A=
+github.com/rs/zerolog v1.31.0/go.mod h1:/7mN4D5sKwJLZQ2b/znpjC3/GQWY/xaDXUM0kKWRHss=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/ugorji/go v1.1.7/go.mod h1:kZn38zHttfInRq0xu/PH0az30d+z6vm202qpg1oXVMw=
+github.com/ugorji/go/codec v1.1.7/go.mod h1:Ax+UKWsSmolVDwsd+7N3ZtXu+yMGCf907BLYF3GoBXY=
+github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1Zlc8k=
+github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9/go.mod h1:E1AXubJBdNmFERAOucpDIxNzeGfLzg0mYh+UfMWdChA=
+github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64 h1:5mLPGnFdSsevFRFc9q3yYbBkB6tsm4aCwwQV/j1JQAQ=
+github.com/yuin/gopher-lua v0.0.0-20220504180219-658193537a64/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
+go.einride.tech/aip v0.67.1 h1:d/4TW92OxXBngkSOwWS2CH5rez869KpKMaN44mdxkFI=
+go.einride.tech/aip v0.67.1/go.mod h1:ZGX4/zKw8dcgzdLsrvpOOGxfxI2QSk12SlP7d6c0/XI=
+go.encore.dev/platform-sdk v1.1.0 h1:0BYLt7ZAoPje3KMLee6/gA2FECHwzi1sKgp3SqC+QRo=
+go.encore.dev/platform-sdk v1.1.0/go.mod h1:ImcJU8p0V3bSXb+d++Ni/8hFDwVZaFpUAAySTY2x6FY=
+go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
+go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 h1:4Pp6oUg3+e/6M4C0A/3kJ2VYa++dsWVTtGgLVj5xtHg=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0/go.mod h1:Mjt1i1INqiaoZOMGR1RIUJN+i3ChKoFRqzrRQhlkbs0=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 h1:jq9TW8u3so/bN+JPT166wjOI6/vQPF6Xe7nMNIltagk=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0/go.mod h1:p8pYQP+m5XfbZm9fxtSKAbM6oIllS7s2AfxrChvc7iw=
+go.opentelemetry.io/otel v1.24.0 h1:0LAOdjNmQeSTzGBzduGe/rU4tZhMwL5rWgtp9Ku5Jfo=
+go.opentelemetry.io/otel v1.24.0/go.mod h1:W7b9Ozg4nkF5tWI5zsXkaKKDjdVjpD4oAt9Qi/MArHo=
+go.opentelemetry.io/otel/metric v1.24.0 h1:6EhoGWWK28x1fbpA4tYTOWBkPefTDQnb8WSGXlc88kI=
+go.opentelemetry.io/otel/metric v1.24.0/go.mod h1:VYhLe1rFfxuTXLgj4CBiyz+9WYBA8pNGJgDcSFRKBco=
+go.opentelemetry.io/otel/sdk v1.24.0 h1:YMPPDNymmQN3ZgczicBY3B6sf9n62Dlj9pWD3ucgoDw=
+go.opentelemetry.io/otel/sdk v1.24.0/go.mod h1:KVrIYw6tEubO9E96HQpcmpTKDVn9gdv35HoYiQWGDFg=
+go.opentelemetry.io/otel/trace v1.24.0 h1:CsKnnL4dUAr/0llH9FKuc698G04IrpWV0MQA/Y1YELI=
+go.opentelemetry.io/otel/trace v1.24.0/go.mod h1:HPc3Xr/cOApsBI154IU0OI0HJexz+aw5uPdbs3UCjNU=
+go.uber.org/automaxprocs v1.5.3 h1:kWazyxZUrS3Gs4qUpbwo5kEIMGe/DAvi5Z4tl2NW4j8=
+go.uber.org/automaxprocs v1.5.3/go.mod h1:eRbA25aqJrxAbsLO0xy5jVwPt7FQnRgjW+efnwa1WM0=
+golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30=
+golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
+golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
+golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
+golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
+golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
+golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
+golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
+golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
+golang.org/x/net v0.27.0 h1:5K3Njcw06/l2y9vpGCSdcxWOYHOUk3dVNGDXN+FvAys=
+golang.org/x/net v0.27.0/go.mod h1:dDi0PyhWNoiUOrAS8uXv/vnScO4wnHQO4mj9fn/RytE=
+golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
+golang.org/x/oauth2 v0.22.0 h1:BzDx2FehcG7jJwgWLELCdmLuxk2i+x9UDpSiss2u0ZA=
+golang.org/x/oauth2 v0.22.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
+golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
+golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190204203706-41f3e6584952/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
+golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
+golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
+golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
+golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
+golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
+golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
+golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+google.golang.org/api v0.191.0 h1:cJcF09Z+4HAB2t5qTQM1ZtfL/PemsLFkcFG67qq2afk=
+google.golang.org/api v0.191.0/go.mod h1:tD5dsFGxFza0hnQveGfVk9QQYKcfp+VzgRqyXFxE0+E=
+google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
+google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
+google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
+google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
+google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
+google.golang.org/genproto v0.0.0-20240730163845-b1a4ccb954bf h1:OqdXDEakZCVtDiZTjcxfwbHPCT11ycCEsTKesBVKvyY=
+google.golang.org/genproto v0.0.0-20240730163845-b1a4ccb954bf/go.mod h1:mCr1K1c8kX+1iSBREvU3Juo11CB+QOEWxbRS01wWl5M=
+google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f h1:b1Ln/PG8orm0SsBbHZWke8dDp2lrCD4jSmfglFpTZbk=
+google.golang.org/genproto/googleapis/api v0.0.0-20240725223205-93522f1f2a9f/go.mod h1:AHT0dDg3SoMOgZGnZk29b5xTbPHMoEC8qthmBLJCpys=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf h1:liao9UHurZLtiEwBgT9LMOnKYsHze6eA6w1KQCMVN2Q=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240730163845-b1a4ccb954bf/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
+google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
+google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
+google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
+google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
+google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
+google.golang.org/grpc v1.64.1 h1:LKtvyfbX3UGVPFcGqJ9ItpVWW6oN/2XqTxfAnwRRXiA=
+google.golang.org/grpc v1.64.1/go.mod h1:hiQF4LFZelK2WKaP6W0L92zGHtiQdZxk8CrSdvyjeP0=
+google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
+google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
+google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
+google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
+google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
+google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
+google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
+gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
+gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
+nhooyr.io/websocket v1.8.7 h1:usjR2uOr/zjjkVMy0lW+PPohFok7PCow5sDjLgX4P4g=
+nhooyr.io/websocket v1.8.7/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
diff --git a/runtimes/go/internal/limiter/limiter.go b/runtimes/go/internal/limiter/limiter.go
new file mode 100644
index 0000000000..9beded6ab8
--- /dev/null
+++ b/runtimes/go/internal/limiter/limiter.go
@@ -0,0 +1,37 @@
+// Package limiter provides a simple interface for rate limiting requests.
+package limiter
+
+import (
+	"context"
+
+	"golang.org/x/time/rate"
+
+	"encore.dev/appruntime/exported/config"
+)
+
+// Limiter is an interface for rate limiting requests.
+//
+// We're using an interface here instead of [golang.org/x/time/rate.Limiter] so that
+// we can easily swap out the implementation in the future for something like doorman.
+type Limiter interface {
+	// Wait blocks until the limiter is ready to accept a new request, or the context is canceled.
+	//
+	// If an error is returned, the request being limited should be aborted.
+	Wait(ctx context.Context) error
+}
+
+// New creates a new [Limiter] based on the given configuration.
+//
+// A nil configuration will result in a no-op limiter which allows all requests.
+func New(cfg *config.Limiter) Limiter {
+	if cfg == nil {
+		return noopLimiter{}
+	}
+
+	switch {
+	case cfg.TokenBucket != nil:
+		return rate.NewLimiter(rate.Limit(cfg.TokenBucket.PerSecondRate), cfg.TokenBucket.BucketSize)
+	default:
+		return noopLimiter{}
+	}
+}
diff --git a/runtimes/go/internal/limiter/noop.go b/runtimes/go/internal/limiter/noop.go
new file mode 100644
index 0000000000..92dedac358
--- /dev/null
+++ b/runtimes/go/internal/limiter/noop.go
@@ -0,0 +1,16 @@
+package limiter
+
+import (
+	"context"
+)
+
+// noopLimiter is a Limiter that never limits the request
+type noopLimiter struct{}
+
+var _ Limiter = noopLimiter{}
+
+func (n noopLimiter) Wait(ctx context.Context) error {
+	// We return the context error here, so if the context was cancelled, we'll
+	// behave the same as a rate limiter would.
+	return ctx.Err()
+}
diff --git a/runtimes/go/internal/platformauth/platformauth.go b/runtimes/go/internal/platformauth/platformauth.go
new file mode 100644
index 0000000000..213a22eb9f
--- /dev/null
+++ b/runtimes/go/internal/platformauth/platformauth.go
@@ -0,0 +1,28 @@
+// Package platformauth contains contexts for marking a request
+// as being authenticated to come from the Encore platform.
+//
+// It's an internal package to ensure only the Encore runtime can
+// mark requests as such.
+package platformauth
+
+import "context"
+
+type ctxKey string
+
+const platformAuthCtxKey ctxKey = "platformAuthCtxKey"
+
+func WithEncorePlatformSealOfApproval(ctx context.Context) context.Context {
+	return context.WithValue(ctx, platformAuthCtxKey, true)
+}
+
+// IsEncorePlatformRequest returns true if the given context originated from
+// a request from the Encore Platform.
+func IsEncorePlatformRequest(ctx context.Context) bool {
+	value := ctx.Value(platformAuthCtxKey)
+	if value == nil {
+		return false
+	}
+
+	v, ok := value.(bool)
+	return ok && v
+}
diff --git a/runtimes/go/meta.go b/runtimes/go/meta.go
new file mode 100644
index 0000000000..649b43163f
--- /dev/null
+++ b/runtimes/go/meta.go
@@ -0,0 +1,154 @@
+package encore
+
+import (
+	"net/url"
+	"time"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/cloud"
+	"encore.dev/appruntime/shared/reqtrack"
+)
+
+//publicapigen:drop
+type Manager struct {
+	static     *config.Static
+	runtime    *config.Runtime
+	rt         *reqtrack.RequestTracker
+	apiBaseURL *url.URL
+}
+
+//publicapigen:drop
+func NewManager(static *config.Static, rtConf *config.Runtime, rt *reqtrack.RequestTracker) *Manager {
+	baseURL, err := url.Parse(rtConf.APIBaseURL)
+	if err != nil {
+		panic("invalid APIBaseURL: " + err.Error())
+	}
+	return &Manager{static, rtConf, rt, baseURL}
+}
+
+// Meta returns metadata about the running application.
+//
+// Meta will never return nil.
+func (mgr *Manager) Meta() *AppMetadata {
+	return &AppMetadata{
+		AppID:      mgr.runtime.AppSlug,
+		APIBaseURL: *mgr.apiBaseURL,
+		Environment: EnvironmentMeta{
+			Name:  mgr.runtime.EnvName,
+			Type:  EnvironmentType(mgr.runtime.EnvType),
+			Cloud: CloudProvider(mgr.runtime.EnvCloud),
+		},
+		Build: BuildMeta{
+			Revision:           mgr.static.AppCommit.Revision,
+			UncommittedChanges: mgr.static.AppCommit.Uncommitted,
+		},
+		Deploy: DeployMeta{
+			ID:   mgr.runtime.DeployID,
+			Time: mgr.runtime.DeployedAt,
+		},
+	}
+}
+
+// AppMetadata contains metadata about the running Encore application.
+type AppMetadata struct {
+	// The application ID, if the application is not linked to the Encore platform this will be an empty string.
+	//
+	// To link to the Encore platform run `encore app link` from your terminal in the root directory of the Encore app.
+	AppID string
+
+	// The base URL which can be used to call the API of this running application.
+	//
+	// For local development it is "http://localhost:<port>", typically "http://localhost:4000".
+	//
+	// If a custom domain is used for this environment it is returned here, but note that
+	// changes only take effect at the time of deployment while custom domains can be updated at any time.
+	APIBaseURL url.URL
+
+	// Information about the environment the app is running in.
+	Environment EnvironmentMeta
+
+	// Information about the running binary itself.
+	Build BuildMeta
+
+	// Information about this deployment of the binary
+	Deploy DeployMeta
+}
+
+type EnvironmentMeta struct {
+	// The name of environment that this application.
+	// For local development it is "local".
+	Name string
+
+	// The type of environment is this application running in
+	// For local development this will be EnvLocal
+	Type EnvironmentType
+
+	// The cloud that this environment is running on
+	// For local development this is CloudLocal
+	Cloud CloudProvider
+}
+
+type BuildMeta struct {
+	// The git commit that formed the base of this build.
+	Revision string
+
+	// true if there were uncommitted changes on top of the Commit.
+	UncommittedChanges bool
+}
+
+type DeployMeta struct {
+	// The deployment ID created by the Encore Platform.
+	ID string
+
+	// The time the Encore Platform deployed this build to the environment.
+	Time time.Time
+}
+
+// EnvironmentType represents the type of environment.
+//
+// For more information on environment types see https://encore.dev/docs/deploy/environments#environment-types
+//
+// Additional environment types may be added in the future.
+type EnvironmentType string
+
+const (
+	// EnvProduction represents a production environment.
+	EnvProduction EnvironmentType = "production"
+
+	// EnvDevelopment represents a long-lived cloud-hosted, non-production environment, such as test environments.
+	EnvDevelopment EnvironmentType = "development"
+
+	// EnvEphemeral represents short-lived cloud-hosted, non-production environments, such as preview environments
+	// that only exist while a particular pull request is open.
+	EnvEphemeral EnvironmentType = "ephemeral"
+
+	// EnvLocal represents the local development environment when using 'encore run' or `encore test`.
+	//
+	// Deprecated: EnvLocal is deprecated and Encore will no longer return this value. A locally running environment
+	// can be identified by the combination of EnvDevelopment && CloudLocal. This constant will be removed in a future
+	// version of Encore.
+	EnvLocal EnvironmentType = "local"
+
+	// EnvTest represents a running unit test
+	EnvTest EnvironmentType = "test"
+)
+
+// CloudProvider represents the cloud provider this application is running in.
+//
+// For more information about how Cloud Providers work with Encore, see https://encore.dev/docs/deploy/own-cloud
+//
+// Additional cloud providers may be added in the future.
+type CloudProvider = cloud.CloudProvider
+
+const (
+	CloudAWS   CloudProvider = cloud.AWS
+	CloudGCP   CloudProvider = cloud.GCP
+	CloudAzure CloudProvider = cloud.Azure
+
+	// EncoreCloud is Encore's own cloud offering, and the default provider for new Environments.
+	EncoreCloud CloudProvider = cloud.Encore
+
+	// CloudLocal is used when an application is running from the Encore CLI by using either
+	// 'encore run' or 'encore test'
+	CloudLocal CloudProvider = cloud.Local
+)
diff --git a/runtimes/go/metrics/bits_internal.go b/runtimes/go/metrics/bits_internal.go
new file mode 100644
index 0000000000..eca1ae8c79
--- /dev/null
+++ b/runtimes/go/metrics/bits_internal.go
@@ -0,0 +1,116 @@
+package metrics
+
+import (
+	"fmt"
+	"math"
+	"sync"
+	"sync/atomic"
+	"unsafe"
+)
+
+func getAtomicAdder[V Value]() func(addr *V, delta V) {
+	var typ V
+	switch any(typ).(type) {
+	case int64:
+		return func(addr *V, delta V) {
+			a := (*int64)(unsafe.Pointer(addr))
+			atomic.AddInt64(a, int64(delta))
+		}
+	case uint64:
+		return func(addr *V, delta V) {
+			a := (*uint64)(unsafe.Pointer(addr))
+			atomic.AddUint64(a, uint64(delta))
+		}
+	case float64:
+		return func(addr *V, delta V) {
+			a := (*float64)(unsafe.Pointer(addr))
+			atomicAddFloat64(a, float64(delta))
+		}
+	default:
+		panic(fmt.Sprintf("unhandled value type %T", typ))
+	}
+}
+
+func getAtomicSetter[V Value]() func(addr *V, new V) {
+	var typ V
+	switch any(typ).(type) {
+	case int64:
+		return func(addr *V, new V) {
+			a := (*int64)(unsafe.Pointer(addr))
+			atomic.StoreInt64(a, int64(new))
+		}
+	case uint64:
+		return func(addr *V, new V) {
+			a := (*uint64)(unsafe.Pointer(addr))
+			atomic.StoreUint64(a, uint64(new))
+		}
+	case float64:
+		return func(addr *V, new V) {
+			a := (*float64)(unsafe.Pointer(addr))
+			atomicStoreFloat64(a, float64(new))
+		}
+	default:
+		panic(fmt.Sprintf("unhandled value type %T", typ))
+	}
+}
+
+func getAtomicIncrementer[V Value](adder func(addr *V, delta V)) func(addr *V) {
+	return func(addr *V) {
+		adder(addr, 1)
+	}
+}
+
+func atomicAddFloat64(addr *float64, delta float64) float64 {
+	for {
+		oldBits := atomic.LoadUint64((*uint64)(unsafe.Pointer(addr)))
+		newFloat := math.Float64frombits(oldBits) + delta
+		newBits := math.Float64bits(newFloat)
+		if atomic.CompareAndSwapUint64((*uint64)(unsafe.Pointer(addr)), oldBits, newBits) {
+			return newFloat
+		}
+	}
+}
+
+func atomicStoreFloat64(addr *float64, value float64) {
+	atomic.StoreUint64((*uint64)(unsafe.Pointer(addr)), math.Float64bits(value))
+}
+
+func atomicLoadFloat64(addr *float64) float64 {
+	return math.Float64frombits(atomic.LoadUint64((*uint64)(unsafe.Pointer(addr))))
+}
+
+type initGate struct {
+	state uint32
+	mu    sync.Mutex
+}
+
+func (g *initGate) Start() {
+	g.mu.Lock()
+	if !atomic.CompareAndSwapUint32(&g.state, 0, 1) {
+		g.mu.Unlock() // don't leave the mutex in a locked state if we panic
+		panic("initGate: already started")
+	}
+}
+
+func (g *initGate) Done() {
+	if !atomic.CompareAndSwapUint32(&g.state, 1, 2) {
+		panic("initGate: not in state initing")
+	}
+	g.mu.Unlock()
+}
+
+func (g *initGate) Wait() {
+	for {
+		switch atomic.LoadUint32(&g.state) {
+		case 0:
+			continue // not started yet
+		case 1:
+			// It's running, block on the mutex before returning.
+			g.mu.Lock()
+			g.mu.Unlock()
+			return
+		case 2:
+			return // done
+		}
+	}
+}
diff --git a/runtimes/go/metrics/histogram_internal.go b/runtimes/go/metrics/histogram_internal.go
new file mode 100644
index 0000000000..bb5c8135c7
--- /dev/null
+++ b/runtimes/go/metrics/histogram_internal.go
@@ -0,0 +1,135 @@
+//go:build encore_app
+
+package metrics
+
+import (
+	"math"
+
+	"encore.dev/appruntime/shared/nativehist"
+)
+
+// HistogramConfig configures a histogram.
+// It's currently a placeholder as there is not yet any additional configuration.
+type HistogramConfig struct {
+	//publicapigen:drop
+	EncoreInternal_LabelMapper any // func(L) []KeyValue
+
+	//publicapigen:drop
+	EncoreInternal_SvcNum uint16
+}
+
+// NewHistogram creates a new histogram metric, without any labels.
+// Use NewHistogramGroup for histograms with labels.
+func NewHistogram[V Value](name string, cfg HistogramConfig) *Histogram[V] {
+	return newHistogramInternal[V](newMetricInfo[V](Singleton, name, HistogramType, cfg.EncoreInternal_SvcNum))
+}
+
+func newHistogramInternal[V Value](m *metricInfo[V]) *Histogram[V] {
+	ts, setup := getTS[*nativehist.Histogram](m.reg, m.name, nil, m)
+
+	// Initialize the values if they haven't yet been set up.
+	if !setup {
+		n := m.reg.numSvcs
+		if m.svcNum > 0 {
+			n = 1
+		}
+		ts.value = make([]*nativehist.Histogram, n)
+		for i := range ts.value {
+			ts.value[i] = nativehist.New(bucketFactor)
+		}
+	}
+
+	return &Histogram[V]{
+		metricInfo: m,
+		ts:         ts,
+		toFloat:    makeToFloat[V](),
+	}
+}
+
+type Histogram[V Value] struct {
+	*metricInfo[V]
+	ts      *timeseries[*nativehist.Histogram]
+	toFloat func(V) float64
+}
+
+func (h *Histogram[V]) Observe(val V) {
+	f := h.toFloat(val)
+	if math.IsNaN(f) {
+		return
+	}
+	if idx, ok := h.svcIdx(); ok {
+		h.ts.value[idx].Observe(f)
+	}
+}
+
+// NewHistogramGroup creates a new histogram group with a set of labels,
+// where each unique combination of labels becomes its own histogram.
+//
+// The Labels type must be a named struct, where each field corresponds to
+// a single label. Each field must be of type string.
+func NewHistogramGroup[L Labels, V Value](name string, cfg HistogramConfig) *HistogramGroup[L, V] {
+	return newHistogramGroup[L, V](Singleton, name, cfg)
+}
+
+func newHistogramGroup[L Labels, V Value](mgr *Registry, name string, cfg HistogramConfig) *HistogramGroup[L, V] {
+	labelMapper := cfg.EncoreInternal_LabelMapper.(func(L) []KeyValue)
+	m := newMetricInfo[V](mgr, name, HistogramType, cfg.EncoreInternal_SvcNum)
+	return &HistogramGroup[L, V]{
+		metricInfo:  m,
+		labelMapper: labelMapper,
+		toFloat:     makeToFloat[V](),
+	}
+}
+
+type HistogramGroup[L Labels, V Value] struct {
+	*metricInfo[V]
+	labelMapper func(L) []KeyValue
+	toFloat     func(V) float64
+}
+
+func (c *HistogramGroup[L, V]) With(labels L) *Histogram[V] {
+	ts := c.get(labels)
+	return &Histogram[V]{
+		metricInfo: c.metricInfo,
+		ts:         ts,
+		toFloat:    c.toFloat,
+	}
+}
+
+func (c *HistogramGroup[L, V]) get(labels L) *timeseries[*nativehist.Histogram] {
+	ts, setup := getTS[*nativehist.Histogram](c.reg, c.name, labels, c.metricInfo)
+
+	if !setup {
+		// Initialize this histogram timeseries on first use.
+		ts.init.Start()
+		defer ts.init.Done()
+
+		n := c.reg.numSvcs
+		if c.svcNum > 0 {
+			n = 1
+		}
+		ts.value = make([]*nativehist.Histogram, n)
+		for i := range ts.value {
+			ts.value[i] = nativehist.New(bucketFactor)
+		}
+	} else {
+		// Wait for the timeseries to be initialized before we continue.
+		ts.init.Wait()
+	}
+
+	return ts
+}
+
+func makeToFloat[V Value]() func(V) float64 {
+	var zero V
+	switch any(zero).(type) {
+	case int64:
+		return func(val V) float64 { return float64(val) }
+	case float64:
+		return func(val V) float64 { return float64(val) }
+	default:
+		panic("invalid unit")
+	}
+}
+
+const bucketFactor = 1.1
diff --git a/runtimes/go/metrics/metrics.go b/runtimes/go/metrics/metrics.go
new file mode 100644
index 0000000000..bd6efa7766
--- /dev/null
+++ b/runtimes/go/metrics/metrics.go
@@ -0,0 +1,209 @@
+package metrics
+
+import (
+	"fmt"
+	"sync/atomic"
+)
+
+type Labels interface {
+	comparable
+}
+
+// CounterConfig configures a counter.
+// It's currently a placeholder as there is not yet any additional configuration.
+type CounterConfig struct {
+	//publicapigen:drop
+	EncoreInternal_LabelMapper any // func(L) []KeyValue
+
+	//publicapigen:drop
+	EncoreInternal_SvcNum uint16
+}
+
+func newCounterInternal[V Value](m *metricInfo[V]) *Counter[V] {
+	ts, setup := m.getTS(nil)
+	if !setup {
+		ts.setup(nil)
+	}
+	return &Counter[V]{metricInfo: m, ts: ts}
+}
+
+type Counter[V Value] struct {
+	*metricInfo[V]
+	ts *timeseries[V]
+}
+
+// Increment increments the counter by 1.
+func (c *Counter[V]) Increment() {
+	if idx, ok := c.svcIdx(); ok {
+		c.inc(&c.ts.value[idx])
+		c.ts.valid[idx].Store(true)
+	}
+}
+
+// Add adds an arbitrary, non-negative value to the counter.
+// It panics if the delta is < 0.
+func (c *Counter[V]) Add(delta V) {
+	if delta < 0 {
+		panic(fmt.Sprintf("metrics: cannot add negative value %v to counter", delta))
+	}
+	if idx, ok := c.svcIdx(); ok {
+		c.add(&c.ts.value[idx], delta)
+		c.ts.valid[idx].Store(true)
+	}
+}
+
+//publicapigen:drop
+func NewCounterGroupInternal[L Labels, V Value](reg *Registry, name string, cfg CounterConfig) *CounterGroup[L, V] {
+	return newCounterGroup[L, V](reg, name, cfg)
+}
+
+func newCounterGroup[L Labels, V Value](mgr *Registry, name string, cfg CounterConfig) *CounterGroup[L, V] {
+	labelMapper := cfg.EncoreInternal_LabelMapper.(func(L) []KeyValue)
+	m := newMetricInfo[V](mgr, name, CounterType, cfg.EncoreInternal_SvcNum)
+	return &CounterGroup[L, V]{metricInfo: m, labelMapper: labelMapper}
+}
+
+type CounterGroup[L Labels, V Value] struct {
+	*metricInfo[V]
+	labelMapper func(L) []KeyValue
+}
+
+func (c *CounterGroup[L, V]) With(labels L) *Counter[V] {
+	ts := c.get(labels)
+	return &Counter[V]{metricInfo: c.metricInfo, ts: ts}
+}
+
+func (c *CounterGroup[L, V]) get(labels L) *timeseries[V] {
+	ts, setup := c.metricInfo.getTS(labels)
+	if !setup {
+		ts.setup(c.labelMapper(labels))
+	} else {
+		// Wait for the timeseries to be initialized before we continue.
+		ts.init.Wait()
+	}
+	return ts
+}
+
+func newGauge[V Value](m *metricInfo[V]) *Gauge[V] {
+	ts, setup := m.getTS(nil)
+	if !setup {
+		ts.setup(nil)
+	}
+
+	return &Gauge[V]{metricInfo: m, ts: ts}
+}
+
+// GaugeConfig configures a gauge.
+// It's currently a placeholder as there is not yet any additional configuration.
+type GaugeConfig struct {
+	//publicapigen:drop
+	EncoreInternal_LabelMapper any // func(L) any) []KeyValue
+
+	//publicapigen:drop
+	EncoreInternal_SvcNum uint16
+}
+
+type Gauge[V Value] struct {
+	*metricInfo[V]
+	ts *timeseries[V]
+}
+
+func (g *Gauge[V]) Set(val V) {
+	if idx, ok := g.svcIdx(); ok {
+		g.set(&g.ts.value[idx], val)
+		g.ts.valid[idx].Store(true)
+	}
+}
+
+func (g *Gauge[V]) Add(val V) {
+	if idx, ok := g.svcIdx(); ok {
+		g.add(&g.ts.value[idx], val)
+		g.ts.valid[idx].Store(true)
+	}
+}
+
+func newGaugeGroup[L Labels, V Value](mgr *Registry, name string, cfg GaugeConfig) *GaugeGroup[L, V] {
+	labelMapper := cfg.EncoreInternal_LabelMapper.(func(L) []KeyValue)
+	m := newMetricInfo[V](mgr, name, GaugeType, cfg.EncoreInternal_SvcNum)
+	return &GaugeGroup[L, V]{metricInfo: m, labelMapper: labelMapper}
+}
+
+type GaugeGroup[L Labels, V Value] struct {
+	*metricInfo[V]
+	labelMapper func(L) []KeyValue
+}
+
+func (g *GaugeGroup[L, V]) With(labels L) *Gauge[V] {
+	ts := g.get(labels)
+	return &Gauge[V]{metricInfo: g.metricInfo, ts: ts}
+}
+
+func (g *GaugeGroup[L, V]) get(labels L) *timeseries[V] {
+	ts, setup := g.metricInfo.getTS(labels)
+	if !setup {
+		ts.setup(g.labelMapper(labels))
+	} else {
+		// Wait for the timeseries to be initialized before we continue.
+		ts.init.Wait()
+	}
+	return ts
+}
+
+func newMetricInfo[V Value](mgr *Registry, name string, typ MetricType, svcNum uint16) *metricInfo[V] {
+	add := getAtomicAdder[V]()
+	set := getAtomicSetter[V]()
+	inc := getAtomicIncrementer[V](add)
+
+	return &metricInfo[V]{
+		reg:    mgr,
+		name:   name,
+		typ:    typ,
+		svcNum: svcNum,
+
+		add: add,
+		set: set,
+		inc: inc,
+	}
+}
+
+type metricInfo[V Value] struct {
+	reg    *Registry
+	name   string
+	typ    MetricType
+	svcNum uint16
+
+	add func(addr *V, val V)
+	set func(addr *V, val V)
+	inc func(addr *V)
+}
+
+func (m *metricInfo[V]) svcIdx() (idx uint16, ok bool) {
+	if m.svcNum > 0 {
+		return 0, true
+	} else if curr := m.reg.rt.Current(); curr.SvcNum > 0 {
+		return curr.SvcNum - 1, true
+	}
+	return 0, false
+}
+
+func (m *metricInfo[V]) getTS(labels any) (ts *timeseries[V], setup bool) {
+	ts, setup = getTS[V](m.reg, m.name, labels, m)
+
+	// Initialize the values if they haven't yet been set up.
+	if !setup {
+		if m.svcNum > 0 {
+			ts.value = make([]V, 1)
+			ts.valid = make([]atomic.Bool, 1)
+		} else {
+			n := m.reg.numSvcs
+			ts.value = make([]V, n)
+			ts.valid = make([]atomic.Bool, n)
+		}
+	}
+
+	return ts, setup
+}
+
+func (m *metricInfo[V]) Name() string     { return m.name }
+func (m *metricInfo[V]) Type() MetricType { return m.typ }
+func (m *metricInfo[V]) SvcNum() uint16   { return m.svcNum }
diff --git a/runtimes/go/metrics/metrics_test.go b/runtimes/go/metrics/metrics_test.go
new file mode 100644
index 0000000000..4aa93716b9
--- /dev/null
+++ b/runtimes/go/metrics/metrics_test.go
@@ -0,0 +1,286 @@
+package metrics
+
+import (
+	"reflect"
+	"strconv"
+	"sync"
+	"testing"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/shared/reqtrack"
+)
+
+func TestCounter(t *testing.T) {
+	rt := reqtrack.New(zerolog.Logger{}, nil, nil)
+	mgr := NewRegistry(rt, 1)
+	m := newMetricInfo[int64](mgr, "foo", CounterType, 1)
+	c := newCounterInternal(m)
+
+	ts, loaded := m.getTS(nil)
+	eq(t, loaded, true)
+	eq(t, ts.init.state, 2)
+	eq(t, ts.info.Name(), "foo")
+	if ts.labels != nil {
+		t.Fatalf("got labels %+v, want nil", ts.labels)
+	}
+
+	eq(t, ts.value[0], 0)
+	c.Increment()
+	c.Add(2)
+	eq(t, ts.value[0], 3)
+
+	c2 := newCounterInternal(m)
+	ts2, loaded2 := c2.getTS(nil)
+	eq(t, loaded2, true)
+	eq(t, ts2, ts)
+
+	c2.Increment()
+	eq(t, ts.value[0], 4)
+	eq(t, countryRegistry(&mgr.registry), 1)
+}
+
+func TestCounter_MultipleServices(t *testing.T) {
+	rt := reqtrack.New(zerolog.Logger{}, nil, nil)
+	mgr := NewRegistry(rt, 2)
+	m := newMetricInfo[int64](mgr, "foo", CounterType, 0)
+	c := newCounterInternal(m)
+
+	ts, loaded := m.getTS(nil)
+	eq(t, loaded, true)
+	eq(t, ts.init.state, 2)
+	eq(t, ts.info.Name(), "foo")
+	if ts.labels != nil {
+		t.Fatalf("got labels %+v, want nil", ts.labels)
+	}
+
+	eq(t, len(ts.value), 2)
+	eq(t, ts.value[0], 0)
+	eq(t, ts.value[1], 0)
+
+	// Without a service running these should be no-ops.
+	c.Increment()
+	c.Add(2)
+	eq(t, ts.value[0], 0)
+	eq(t, ts.value[1], 0)
+
+	// Inside a request they should work.
+	{
+		rt.BeginRequest(&model.Request{SvcNum: 1})
+		c.Increment()
+		c.Add(2)
+		eq(t, ts.value[0], 3)
+		eq(t, ts.value[1], 0)
+		rt.FinishRequest(false)
+	}
+
+	// Without a service running these should be no-ops again.
+	c.Increment()
+	c.Add(2)
+	eq(t, ts.value[0], 3)
+	eq(t, ts.value[1], 0)
+
+	// Inside a request they should work.
+	{
+		rt.BeginRequest(&model.Request{SvcNum: 2})
+		c.Increment()
+		eq(t, ts.value[0], 3)
+		eq(t, ts.value[1], 1)
+		rt.FinishRequest(false)
+	}
+
+	// Without a service running these should be no-ops again.
+	c.Increment()
+	c.Add(2)
+	eq(t, ts.value[0], 3)
+	eq(t, ts.value[1], 1)
+}
+
+func TestGauge(t *testing.T) {
+	rt := reqtrack.New(zerolog.Logger{}, nil, nil)
+	mgr := NewRegistry(rt, 1)
+	m := newMetricInfo[float64](mgr, "foo", GaugeType, 1)
+	c := newGauge(m)
+
+	ts, loaded := m.getTS(nil)
+	eq(t, loaded, true)
+	eq(t, ts.init.state, 2)
+	eq(t, ts.info.Name(), "foo")
+	if ts.labels != nil {
+		t.Fatalf("got labels %+v, want nil", ts.labels)
+	}
+
+	eq(t, ts.value[0], 0)
+	c.Set(1.5)
+	eq(t, ts.value[0], 1.5)
+
+	c2 := newGauge(m)
+	ts2, loaded2 := c2.getTS(nil)
+	eq(t, loaded2, true)
+	eq(t, ts2, ts)
+
+	c2.Set(2)
+	eq(t, ts.value[0], 2)
+
+	eq(t, countryRegistry(&mgr.registry), 1)
+}
+
+func TestCounterGroup(t *testing.T) {
+	type myLabels struct {
+		key string
+	}
+
+	rt := reqtrack.New(zerolog.Logger{}, nil, nil)
+	mgr := NewRegistry(rt, 1)
+	c := newCounterGroup[myLabels, int64](mgr, "foo", CounterConfig{
+		EncoreInternal_SvcNum: 1,
+		EncoreInternal_LabelMapper: func(labels myLabels) []KeyValue {
+			return []KeyValue{{Key: "Key", Value: labels.key}}
+		},
+	})
+
+	// GaugeGroup loads time series on-demand.
+	eq(t, countryRegistry(&mgr.registry), 0)
+	c.With(myLabels{key: "foo"}).Increment()
+	eq(t, countryRegistry(&mgr.registry), 1)
+	c.With(myLabels{key: "foo"}).Add(2)
+	eq(t, countryRegistry(&mgr.registry), 1)
+	c.With(myLabels{key: "bar"}).Add(5)
+	eq(t, countryRegistry(&mgr.registry), 2)
+
+	ts := c.get(myLabels{key: "foo"})
+	eq(t, ts.init.state, 2)
+	eq(t, ts.info.Name(), "foo")
+	if !reflect.DeepEqual(ts.labels, []KeyValue{{Key: "Key", Value: "foo"}}) {
+		t.Fatalf("got labels %+v, want [{Key foo}]", ts.labels)
+	}
+
+	eq(t, ts.value[0], 3)
+
+	ts2 := c.get(myLabels{key: "foo"})
+	eq(t, ts2, ts)
+	eq(t, countryRegistry(&mgr.registry), 2)
+
+}
+
+func TestGaugeGroup(t *testing.T) {
+	type myLabels struct {
+		key string
+	}
+	rt := reqtrack.New(zerolog.Logger{}, nil, nil)
+	mgr := NewRegistry(rt, 1)
+	c := newGaugeGroup[myLabels, float64](mgr, "foo", GaugeConfig{
+		EncoreInternal_SvcNum: 1,
+		EncoreInternal_LabelMapper: func(labels myLabels) []KeyValue {
+			return []KeyValue{{Key: "Key", Value: labels.key}}
+		},
+	})
+
+	// GaugeGroup loads time series on-demand.
+	eq(t, countryRegistry(&mgr.registry), 0)
+	c.With(myLabels{key: "foo"}).Set(1.5)
+	eq(t, countryRegistry(&mgr.registry), 1)
+	c.With(myLabels{key: "foo"}).Set(2.5)
+	eq(t, countryRegistry(&mgr.registry), 1)
+	c.With(myLabels{key: "bar"}).Set(3.5)
+	eq(t, countryRegistry(&mgr.registry), 2)
+
+	ts := c.get(myLabels{key: "foo"})
+	eq(t, ts.init.state, 2)
+	eq(t, ts.info.Name(), "foo")
+	if !reflect.DeepEqual(ts.labels, []KeyValue{{Key: "Key", Value: "foo"}}) {
+		t.Fatalf("got labels %+v, want [{Key foo}]", ts.labels)
+	}
+
+	eq(t, ts.value[0], 2.5)
+
+	ts2 := c.get(myLabels{key: "foo"})
+	eq(t, ts2, ts)
+	eq(t, countryRegistry(&mgr.registry), 2)
+}
+
+func BenchmarkCounter_Inc(b *testing.B) {
+	b.ReportAllocs()
+	rt := reqtrack.New(zerolog.Logger{}, nil, nil)
+	mgr := NewRegistry(rt, 1)
+	m := newMetricInfo[int64](mgr, "foo", CounterType, 1)
+	c := newCounterInternal(m)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		c.Increment()
+	}
+	eq(b, c.ts.value[0], int64(b.N))
+}
+
+func BenchmarkCounter_NewLabel(b *testing.B) {
+	type myLabels struct {
+		key string
+	}
+	rt := reqtrack.New(zerolog.Logger{}, nil, nil)
+	mgr := NewRegistry(rt, 1)
+	c := newCounterGroup[myLabels, int64](mgr, "foo", CounterConfig{
+		EncoreInternal_SvcNum: 1,
+		EncoreInternal_LabelMapper: func(labels myLabels) []KeyValue {
+			return []KeyValue{{Key: "Key", Value: labels.key}}
+		},
+	})
+
+	keys := make([]string, b.N)
+	for i := 0; i < b.N; i++ {
+		keys[i] = strconv.Itoa(i)
+	}
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		c.With(myLabels{key: keys[i]}).Increment()
+	}
+}
+
+func BenchmarkCounter_NewLabelSometimes(b *testing.B) {
+	type myLabels struct {
+		key string
+	}
+	rt := reqtrack.New(zerolog.Logger{}, nil, nil)
+	mgr := NewRegistry(rt, 1)
+	c := newCounterGroup[myLabels, int64](mgr, "foo", CounterConfig{
+		EncoreInternal_SvcNum: 1,
+		EncoreInternal_LabelMapper: func(labels myLabels) []KeyValue {
+			return []KeyValue{{Key: "Key", Value: labels.key}}
+		},
+	})
+
+	denom := 10
+	numLabels := b.N / denom
+
+	keys := make([]string, numLabels)
+	for i := 0; i < numLabels; i++ {
+		keys[i] = strconv.Itoa(i)
+	}
+
+	b.ReportAllocs()
+	b.ResetTimer()
+	for i := 0; i < numLabels; i++ {
+		for j := 0; j < denom; j++ {
+			c.With(myLabels{key: keys[i]}).Increment()
+		}
+	}
+}
+
+func eq[Val comparable](t testing.TB, got, want Val) {
+	t.Helper()
+	if got != want {
+		t.Fatalf("got %v, want %v", got, want)
+	}
+}
+
+func countryRegistry(reg *sync.Map) int {
+	var count int
+	reg.Range(func(key, value interface{}) bool {
+		count++
+		return true
+	})
+	return count
+}
diff --git a/runtimes/go/metrics/pkgfn.go b/runtimes/go/metrics/pkgfn.go
new file mode 100644
index 0000000000..88068c0cdc
--- /dev/null
+++ b/runtimes/go/metrics/pkgfn.go
@@ -0,0 +1,33 @@
+//go:build encore_app
+
+package metrics
+
+// NewCounter creates a new counter metric, without any labels.
+// Use NewCounterGroup for metrics with labels.
+func NewCounter[V Value](name string, cfg CounterConfig) *Counter[V] {
+	return newCounterInternal[V](newMetricInfo[V](Singleton, name, CounterType, cfg.EncoreInternal_SvcNum))
+}
+
+// NewCounterGroup creates a new counter group with a set of labels,
+// where each unique combination of labels becomes its own counter.
+//
+// The Labels type must be a named struct, where each field corresponds to
+// a single label. Each field must be of type string.
+func NewCounterGroup[L Labels, V Value](name string, cfg CounterConfig) *CounterGroup[L, V] {
+	return newCounterGroup[L, V](Singleton, name, cfg)
+}
+
+// NewGauge creates a new counter metric, without any labels.
+// Use NewGaugeGroup for metrics with labels.
+func NewGauge[V Value](name string, cfg GaugeConfig) *Gauge[V] {
+	return newGauge[V](newMetricInfo[V](Singleton, name, GaugeType, cfg.EncoreInternal_SvcNum))
+}
+
+// NewGaugeGroup creates a new gauge group with a set of labels,
+// where each unique combination of labels becomes its own gauge.
+//
+// The Labels type must be a named struct, where each field corresponds to
+// a single label. Each field must be of type string.
+func NewGaugeGroup[L Labels, V Value](name string, cfg GaugeConfig) *GaugeGroup[L, V] {
+	return newGaugeGroup[L, V](Singleton, name, cfg)
+}
diff --git a/runtimes/go/metrics/registry_internal.go b/runtimes/go/metrics/registry_internal.go
new file mode 100644
index 0000000000..f544daf49f
--- /dev/null
+++ b/runtimes/go/metrics/registry_internal.go
@@ -0,0 +1,124 @@
+package metrics
+
+import (
+	"fmt"
+	"sync"
+	"sync/atomic"
+
+	"encore.dev/appruntime/shared/nativehist"
+	"encore.dev/appruntime/shared/reqtrack"
+)
+
+type Registry struct {
+	rt       *reqtrack.RequestTracker
+	numSvcs  uint16
+	tsid     uint64
+	registry sync.Map // map[registryKey]*timeseries
+}
+
+func NewRegistry(rt *reqtrack.RequestTracker, numServicesInBinary int) *Registry {
+	return &Registry{rt: rt, numSvcs: uint16(numServicesInBinary)}
+}
+
+func (r *Registry) Collect() []CollectedMetric {
+	metrics := make([]CollectedMetric, 0, 128)
+	r.registry.Range(func(key, value any) bool {
+		switch val := value.(type) {
+		case *timeseries[int64]:
+			metrics = append(metrics, CollectedMetric{
+				Info:         val.info,
+				TimeSeriesID: val.id,
+				Labels:       val.labels,
+				Val:          val.value,
+				Valid:        val.valid,
+			})
+		case *timeseries[uint64]:
+			metrics = append(metrics, CollectedMetric{
+				Info:         val.info,
+				TimeSeriesID: val.id,
+				Labels:       val.labels,
+				Val:          val.value,
+				Valid:        val.valid,
+			})
+		case *timeseries[float64]:
+			metrics = append(metrics, CollectedMetric{
+				Info:         val.info,
+				TimeSeriesID: val.id,
+				Labels:       val.labels,
+				Val:          val.value,
+				Valid:        val.valid,
+			})
+		case *timeseries[*nativehist.Histogram]:
+			metrics = append(metrics, CollectedMetric{
+				Info:         val.info,
+				TimeSeriesID: val.id,
+				Labels:       val.labels,
+				Val:          val.value,
+				Valid:        val.valid,
+			})
+		default:
+			panic(fmt.Sprintf("unhandled timeseries type %T", val))
+		}
+		return true
+	})
+	return metrics
+}
+
+type MetricType int
+
+const (
+	CounterType MetricType = iota
+	GaugeType
+	HistogramType
+)
+
+type MetricInfo interface {
+	Name() string
+	Type() MetricType
+	SvcNum() uint16
+}
+
+type CollectedMetric struct {
+	Info         MetricInfo
+	TimeSeriesID uint64
+	Labels       []KeyValue
+	Val          any // []T where T is any of Value
+	Valid        []atomic.Bool
+}
+
+type registryKey struct {
+	metricName string
+	labels     any // guaranteed to be comparable
+}
+
+type timeseries[T any] struct {
+	info   MetricInfo
+	id     uint64
+	init   initGate
+	labels []KeyValue
+	value  []T
+	valid  []atomic.Bool
+}
+
+func (ts *timeseries[V]) setup(labels []KeyValue) {
+	ts.init.Start()
+	defer ts.init.Done()
+	ts.labels = labels
+}
+
+type KeyValue struct {
+	Key   string
+	Value string
+}
+
+func getTS[T any](r *Registry, name string, labels any, info MetricInfo) (ts *timeseries[T], loaded bool) {
+	key := registryKey{metricName: name, labels: labels}
+	if val, ok := r.registry.Load(key); ok {
+		return val.(*timeseries[T]), true
+	}
+	val, loaded := r.registry.LoadOrStore(key, &timeseries[T]{
+		info: info,
+		id:   atomic.AddUint64(&r.tsid, 1),
+	})
+	return val.(*timeseries[T]), loaded
+}
diff --git a/runtimes/go/metrics/singleton_internal.go b/runtimes/go/metrics/singleton_internal.go
new file mode 100644
index 0000000000..f5ff83a13b
--- /dev/null
+++ b/runtimes/go/metrics/singleton_internal.go
@@ -0,0 +1,10 @@
+//go:build encore_app
+
+package metrics
+
+import (
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/reqtrack"
+)
+
+var Singleton = NewRegistry(reqtrack.Singleton, len(appconf.Static.BundledServices))
diff --git a/runtimes/go/metrics/units.go b/runtimes/go/metrics/units.go
new file mode 100644
index 0000000000..ed3a253fbf
--- /dev/null
+++ b/runtimes/go/metrics/units.go
@@ -0,0 +1,7 @@
+package metrics
+
+// TODO Document
+
+type Value interface {
+	uint64 | int64 | float64
+}
diff --git a/runtimes/go/middleware/middleware.go b/runtimes/go/middleware/middleware.go
new file mode 100644
index 0000000000..297ca225fd
--- /dev/null
+++ b/runtimes/go/middleware/middleware.go
@@ -0,0 +1,130 @@
+// Package middleware provides middleware functionality for defining
+// generic processing across multiple API endpoints, typically for
+// cross-cutting concerns like validation, caching, or error monitoring.
+//
+// For documentation on how to use middleware in Encore see https://encore.dev/docs/develop/middleware.
+package middleware
+
+import (
+	"context"
+	"net/http"
+
+	encore "encore.dev"
+)
+
+// Signature is the signature a middleware should have.
+// The implementation must return a Response which then
+// becomes the API's response.
+//
+// Middleware processing forms a chain, where the first
+// defined middleware is called first. The provided next
+// function is used to invoke the next middleware in the
+// chain, or the actual API handler if it's the last middleware.
+//
+// The implementation should call next at most once.
+// If the middleware encounters an error it is permissible to
+// not call next and directly return a Response with Err set
+// to a non-nil value.
+//
+// The type exists solely for documentation purposes;
+// it is otherwise not used.
+type Signature func(req Request, next Next) Response
+
+// Next is the function to invoke the next middleware in the chain,
+// or the actual API handler if the middleware is the last one.
+type Next func(Request) Response
+
+// A Request provides information about the incoming request that
+// the middleware is processing.
+type Request struct {
+	ctx   context.Context
+	cache *reqCache
+}
+
+// WithContext returns a new Request with the context set to ctx.
+func (r *Request) WithContext(ctx context.Context) Request {
+	r2 := *r
+	r2.ctx = ctx
+	return r2
+}
+
+// Context reports the request's context.
+func (r *Request) Context() context.Context {
+	return r.ctx
+}
+
+// Data returns information about the request.
+func (r *Request) Data() *encore.Request {
+	return r.cache.Get()
+}
+
+// Response represents the API handler's response.
+// It can be modified by each middleware to customize
+// the API response.
+//
+// The Payload's type must not be changed: it is not permissible
+// to return a payload with a different type than the API returns.
+//
+// If Err is non-nil it becomes serialized as the response.
+//
+// For Raw endpoints neither Payload nor Err are used.
+type Response struct {
+	// Payload is the API's response payload.
+	// It is nil if the API handler returned an error or if
+	// the API is a raw endpoint.
+	//
+	// The payload can be mutated by middleware but the type must not be changed;
+	// it must always be of the same type as the API handler's return type.
+	// Otherwise, an error is returned.
+	Payload any
+
+	// Err is the error returned from the API handler or another middleware.
+	// It is written as output for non-raw endpoints.
+	Err error
+
+	// HTTPStatus is the HTTP status code the response is written with.
+	//
+	// If zero is returned from middleware, Encore will choose an appropriate status code based
+	// status code depending on the type of error being returned (or 200 for success).
+	//
+	// If a non-zero value is returned from a middleware, Encore will use that status code
+	// regardless of what Err is set to.
+	//
+	// For raw handlers middleware cannot modify this as it has already
+	// been written to the network.
+	HTTPStatus int
+
+	// headers are HTTP headers to add to the response, lazily initialized.
+	// Use Header() method to access.
+	headers http.Header
+}
+
+// Header returns the header map that will be sent by the response.
+// The returned map is lazily initialized on first call.
+// Changing the header map after a call to WriteHeader has no effect.
+//
+// For raw handlers middleware cannot modify headers as the response has already
+// been written to the network.
+func (r *Response) Header() http.Header {
+	if r.headers == nil {
+		r.headers = make(http.Header)
+	}
+	return r.headers
+}
+
+// GetHeaders returns the headers map, or nil if no headers have been set.
+// This method is used internally by the Encore runtime.
+//
+//publicapigen:drop
+func (r *Response) GetHeaders() http.Header {
+	return r.headers
+}
+
+// NewRequest constructs a new Request that returns the given context and request data.
+// It is primarily used for testing middleware.
+func NewRequest(ctx context.Context, data *encore.Request) Request {
+	return Request{
+		ctx:   ctx,
+		cache: newReqCache(func() *encore.Request { return data }),
+	}
+}
diff --git a/runtimes/go/middleware/middleware_internal.go b/runtimes/go/middleware/middleware_internal.go
new file mode 100644
index 0000000000..91c8aff5f1
--- /dev/null
+++ b/runtimes/go/middleware/middleware_internal.go
@@ -0,0 +1,27 @@
+package middleware
+
+import (
+	"context"
+	"sync"
+
+	encore "encore.dev"
+)
+
+func newReqCache(fn func() *encore.Request) *reqCache {
+	return &reqCache{load: fn}
+}
+
+type reqCache struct {
+	loadOnce sync.Once
+	load     func() *encore.Request
+	req      *encore.Request
+}
+
+func (r *reqCache) Get() *encore.Request {
+	r.loadOnce.Do(func() { r.req = r.load() })
+	return r.req
+}
+
+func NewLazyRequest(ctx context.Context, fn func() *encore.Request) Request {
+	return Request{ctx: ctx, cache: newReqCache(fn)}
+}
diff --git a/runtimes/go/package.go b/runtimes/go/package.go
new file mode 100644
index 0000000000..87ade22e8b
--- /dev/null
+++ b/runtimes/go/package.go
@@ -0,0 +1,25 @@
+// Package encore provides the runtime API contract, which Encore applications are build against.
+//
+// # Encore – The Backend Development Engine
+//
+// https://encore.dev
+//
+// Encore makes it incredibly simple to create distributed systems, backend services and APIs. While still deploying to
+// your own cloud account, Encore helps you escape the maze of cloud complexity:
+//
+// - No endless repetition of boilerplate.
+//
+// - No infrastructure to worry about.
+//
+// - No reinventing the wheel.
+//
+// Start building with a fantastic flow state experience that unlocks your creative potential.
+// All of this is freely available, based on the Open Source Encore Go Framework.
+//
+// For more information visit the website https://encore.dev or the documentation at https://encore.dev/docs.
+//
+// # Package encore
+//
+// This package provides the APIs for getting AppMetadata about the current application and the CurrentRequest.
+// For more information see https://encore.dev/docs/develop/metadata.
+package encore
diff --git a/runtimes/go/pkgfn.go b/runtimes/go/pkgfn.go
new file mode 100644
index 0000000000..abd6c80296
--- /dev/null
+++ b/runtimes/go/pkgfn.go
@@ -0,0 +1,28 @@
+//go:build encore_app
+
+package encore
+
+import (
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/reqtrack"
+)
+
+//publicapigen:drop
+var Singleton = NewManager(appconf.Static, appconf.Runtime, reqtrack.Singleton)
+
+// Meta returns metadata about the running application.
+//
+// Meta will never return nil.
+func Meta() *AppMetadata {
+	return Singleton.Meta()
+}
+
+// CurrentRequest returns the Request that is currently being handled by the calling goroutine
+//
+// It is safe for concurrent use and will return a new Request on each evocation, so can be mutated by the
+// calling code without impacting future calls.
+//
+// CurrentRequest never returns nil.
+func CurrentRequest() *Request {
+	return Singleton.CurrentRequest()
+}
diff --git a/runtimes/go/pubsub/internal/aws/manager.go b/runtimes/go/pubsub/internal/aws/manager.go
new file mode 100644
index 0000000000..4bf1a7033d
--- /dev/null
+++ b/runtimes/go/pubsub/internal/aws/manager.go
@@ -0,0 +1,90 @@
+package aws
+
+import (
+	"context"
+	"fmt"
+	"sync"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awsConfig "github.com/aws/aws-sdk-go-v2/config"
+	"github.com/aws/aws-sdk-go-v2/service/sns"
+	"github.com/aws/aws-sdk-go-v2/service/sqs"
+	"github.com/rs/xid"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/pubsub/internal/types"
+	"encore.dev/pubsub/internal/utils"
+)
+
+type Manager struct {
+	ctxs *utils.Contexts
+
+	// publisherID is a unique ID for this Encore app instance, used as the Message Group ID
+	// for topics which don't specify a grouping field. This is based on [AWS's recommendation]
+	// that each producer should have a unique message group ID to send all it's messages.
+	//
+	// We use an XID here as we've already got the library included within the runtime and it has an excellent
+	// way of generating unique IDs in a distributed system without needing to talk to a central service.
+	//
+	// [AWS's recommendation]: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/FIFO-queues-understanding-logic.html
+	publisherID xid.ID
+
+	cfgOnce   sync.Once
+	awsCfg    aws.Config
+	snsClient *sns.Client
+	sqsClient *sqs.Client
+}
+
+func NewManager(ctxs *utils.Contexts) *Manager {
+	return &Manager{ctxs: ctxs, publisherID: xid.New()}
+}
+
+func (mgr *Manager) ProviderName() string { return "aws" }
+
+func (mgr *Manager) Matches(cfg *config.PubsubProvider) bool {
+	return cfg.AWS != nil
+}
+
+// getConfig loads the required AWS config to connect to AWS
+func (mgr *Manager) getConfig(ctx context.Context) aws.Config {
+	mgr.cfgOnce.Do(func() {
+		cfg, err := awsConfig.LoadDefaultConfig(ctx)
+		if err != nil {
+			panic(fmt.Sprintf("unable to load AWS config: %v", err))
+		}
+		mgr.awsCfg = cfg
+
+	})
+
+	return mgr.awsCfg
+}
+
+func (mgr *Manager) getSNSClient(ctx context.Context) *sns.Client {
+	if mgr.snsClient == nil {
+		mgr.snsClient = sns.NewFromConfig(mgr.getConfig(ctx))
+	}
+	return mgr.snsClient
+}
+
+func (mgr *Manager) getSQSClient(ctx context.Context) *sqs.Client {
+	if mgr.sqsClient == nil {
+		mgr.sqsClient = sqs.NewFromConfig(mgr.getConfig(ctx))
+	}
+	return mgr.sqsClient
+}
+
+func (mgr *Manager) NewTopic(_ *config.PubsubProvider, staticCfg types.TopicConfig, runtimeCfg *config.PubsubTopic) types.TopicImplementation {
+	snsClient := mgr.getSNSClient(mgr.ctxs.Connection)
+	sqsClient := mgr.getSQSClient(mgr.ctxs.Connection)
+
+	// Check we have permissions to interact with the given topic
+	// otherwise the first time we will find out is when we try and publish to it
+	_, err := snsClient.GetTopicAttributes(mgr.ctxs.Connection, &sns.GetTopicAttributesInput{
+		TopicArn: aws.String(runtimeCfg.ProviderName),
+	})
+	if err != nil {
+		panic(fmt.Sprintf("unable to verify SNS topic attributes (may be missing IAM role allowing access): %v", err))
+	}
+
+	return &topic{mgr.ctxs, mgr.publisherID, snsClient, sqsClient, staticCfg, runtimeCfg}
+}
diff --git a/runtimes/go/pubsub/internal/aws/topic.go b/runtimes/go/pubsub/internal/aws/topic.go
new file mode 100644
index 0000000000..bec9f717a5
--- /dev/null
+++ b/runtimes/go/pubsub/internal/aws/topic.go
@@ -0,0 +1,219 @@
+package aws
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"strconv"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/sns"
+	snsTypes "github.com/aws/aws-sdk-go-v2/service/sns/types"
+	"github.com/aws/aws-sdk-go-v2/service/sqs"
+	sqsTypes "github.com/aws/aws-sdk-go-v2/service/sqs/types"
+	"github.com/rs/xid"
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/pubsub/internal/types"
+	"encore.dev/pubsub/internal/utils"
+)
+
+type topic struct {
+	ctxs        *utils.Contexts
+	publisherID xid.ID
+	snsClient   *sns.Client
+	sqsClient   *sqs.Client
+	staticCfg   types.TopicConfig
+	runtimeCfg  *config.PubsubTopic
+}
+
+var _ types.TopicImplementation = (*topic)(nil)
+
+func (t *topic) PublishMessage(ctx context.Context, orderingKey string, attrs map[string]string, data []byte) (id string, err error) {
+	attributes := make(map[string]snsTypes.MessageAttributeValue)
+	for key, value := range attrs {
+		attributes[key] = snsTypes.MessageAttributeValue{
+			DataType:    aws.String("String"),
+			StringValue: aws.String(value),
+		}
+	}
+
+	params := &sns.PublishInput{
+		Message:           aws.String(string(data)),
+		MessageAttributes: attributes,
+		TopicArn:          aws.String(t.runtimeCfg.ProviderName),
+	}
+
+	// For exactly-once delivery on AWS we need to:
+	//
+	// 1. Set a message group ID (as this is a requirement for FIFO queues)
+	// 2. Set a message deduplication ID as this is required to enable exactly-once delivery
+	if t.staticCfg.DeliveryGuarantee == types.ExactlyOnce {
+		params.MessageGroupId = aws.String(fmt.Sprintf("inst_%s", t.publisherID.String()))
+		params.MessageDeduplicationId = aws.String(fmt.Sprintf("msg_%s", xid.New().String()))
+	}
+
+	// If we have an explicit ordering key, use that as the message group ID and mark the topic as FIFO
+	if orderingKey != "" {
+		params.MessageGroupId = aws.String(orderingKey)
+		params.MessageDeduplicationId = aws.String(fmt.Sprintf("msg_%s", xid.New().String()))
+	}
+
+	result, err := t.snsClient.Publish(ctx, params)
+	if err != nil {
+		return "", err
+	}
+	return aws.ToString(result.MessageId), nil
+}
+
+func (t *topic) Subscribe(logger *zerolog.Logger, maxConcurrency int, ackDeadline time.Duration, retryPolicy *types.RetryPolicy, implCfg *config.PubsubSubscription, f types.RawSubscriptionCallback) {
+	ackDeadline = utils.Clamp(ackDeadline, time.Second, 12*time.Hour)
+
+	if maxConcurrency == 0 {
+		maxConcurrency = 1 // FIXME(domblack): This retains the old behaviour, but allows user customisation - in a future release we should remove this
+	}
+
+	go func() {
+		defer func() {
+			if r := recover(); r != nil {
+				logger.Error().Interface("panic", r).Msg("panic in subscriber, no longer processing messages")
+			} else {
+				logger.Info().Msg("subscriber stopped due to context cancellation")
+			}
+		}()
+
+		for t.ctxs.Fetch.Err() == nil {
+			err := utils.WorkConcurrently(
+				t.ctxs,
+				maxConcurrency, 10,
+				func(ctx context.Context, maxToFetch int) ([]sqsTypes.Message, error) {
+					// We should only long poll for 20 seconds, so if this takes more than
+					// 30 seconds we should cancel the context and try again
+					//
+					// We do this in case the ReceiveMessage call gets stuck on the server
+					// and doesn't return
+					ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
+					defer cancel()
+
+					resp, err := t.sqsClient.ReceiveMessage(ctx, &sqs.ReceiveMessageInput{
+						QueueUrl:              aws.String(implCfg.ProviderName),
+						AttributeNames:        []sqsTypes.QueueAttributeName{"ApproximateReceiveCount"},
+						MaxNumberOfMessages:   int32(maxToFetch),
+						MessageAttributeNames: []string{"All"},
+						VisibilityTimeout:     int32(ackDeadline.Seconds()),
+						WaitTimeSeconds:       20, // Maximum allowed time
+					})
+					if err != nil {
+						return nil, err
+					}
+
+					return resp.Messages, nil
+				},
+				func(ctx context.Context, msg sqsTypes.Message) error {
+					// Parse the message body
+					msgWrapper := &SNSMessageWrapper{}
+					if err := json.Unmarshal([]byte(aws.ToString(msg.Body)), msgWrapper); err != nil {
+						logger.Err(err).Str("sqs_msg_id", aws.ToString(msg.MessageId)).Msg("unable to parse message")
+						return nil
+					}
+
+					// Get the delivery attempt number
+					deliveryAttempt, err := parseInt(msg.Attributes, "ApproximateReceiveCount")
+					if err != nil {
+						logger.Warn().Err(err).Str("msg_id", msgWrapper.MessageId).Msg("unable to parse receive count")
+					}
+
+					// Extract the attributes
+					attributes := make(map[string]string)
+					for key, value := range msgWrapper.MessageAttributes {
+						switch value.Type {
+						case "String":
+							attributes[key] = value.Value
+						default:
+							logger.Warn().Err(err).Str("msg_id", msgWrapper.MessageId).Str("attr_name", key).Str("attr_type", value.Type).Msg("unsupported attribute data type")
+						}
+					}
+
+					// Call the callback, and if there was no error, then we can delete the message
+					msgCtx, cancel := context.WithTimeout(ctx, ackDeadline)
+					defer cancel()
+					err = f(msgCtx, msgWrapper.MessageId, msgWrapper.Timestamp, int(deliveryAttempt), attributes, []byte(msgWrapper.Message))
+					cancel()
+
+					// Check if the context has been cancelled, and if so, return the error
+					if ctx.Err() != nil {
+						return ctx.Err()
+					}
+
+					// We want to wait a maximum of 30 seconds for the callback to complete
+					// otherwise we assume it has failed and we should retry
+					//
+					// We do this in case the callback gets stuck and doesn't return
+					ctx, responseCancel := context.WithTimeout(ctx, 30*time.Second)
+					defer responseCancel()
+
+					if err != nil {
+						logger.Err(err).Str("msg_id", msgWrapper.MessageId).Msg("unable to process message")
+
+						// If there was an error processing the message, apply the backoff policy
+						_, delay := utils.GetDelay(retryPolicy.MaxRetries, retryPolicy.MinBackoff, retryPolicy.MaxBackoff, uint16(deliveryAttempt))
+						_, visibilityChangeErr := t.sqsClient.ChangeMessageVisibility(t.ctxs.Connection, &sqs.ChangeMessageVisibilityInput{
+							QueueUrl:          aws.String(implCfg.ProviderName),
+							ReceiptHandle:     msg.ReceiptHandle,
+							VisibilityTimeout: int32(utils.Clamp(delay, time.Second, 12*time.Hour).Seconds()),
+						})
+						if visibilityChangeErr != nil {
+							log.Warn().Err(visibilityChangeErr).Str("msg_id", msgWrapper.MessageId).Msg("unable to change message visibility to apply backoff rules")
+						}
+					} else {
+						// If the message was processed successfully, delete it from the queue
+						_, err = t.sqsClient.DeleteMessage(t.ctxs.Connection, &sqs.DeleteMessageInput{
+							QueueUrl:      aws.String(implCfg.ProviderName),
+							ReceiptHandle: msg.ReceiptHandle,
+						})
+						if err != nil {
+							logger.Err(err).Str("msg_id", msgWrapper.MessageId).Msg("unable to delete message from SQS queue")
+						}
+					}
+
+					return nil
+				},
+			)
+
+			if err != nil && t.ctxs.Fetch.Err() == nil {
+				logger.Warn().Err(err).Msg("pubsub subscription failed, retrying in 5 seconds")
+				time.Sleep(5 * time.Second)
+				continue
+			}
+		}
+	}()
+}
+
+func parseInt(m map[string]string, key string) (int64, error) {
+	value, ok := m[key]
+	if !ok {
+		return 0, errors.New("attribute was not received")
+	}
+
+	return strconv.ParseInt(value, 10, 64)
+}
+
+// SNSMessageWrapper matches the JSON that is sent to SQS from an SNS subscription
+type SNSMessageWrapper struct {
+	Type              string    `json:"Type"`
+	MessageId         string    `json:"MessageId"`
+	TopicArn          string    `json:"TopicArn"`
+	Message           string    `json:"Message"`
+	Timestamp         time.Time `json:"Timestamp"`
+	SignatureVersion  string    `json:"SignatureVersion"`
+	SigningCertURL    string    `json:"SigningCertURL"`
+	UnsubscribeURL    string    `json:"UnsubscribeURL"`
+	MessageAttributes map[string]struct {
+		Type  string `json:"Type"`
+		Value string `json:"Value"`
+	} `json:"MessageAttributes"`
+}
diff --git a/runtimes/go/pubsub/internal/aws/topic_test.go b/runtimes/go/pubsub/internal/aws/topic_test.go
new file mode 100644
index 0000000000..7d371d2131
--- /dev/null
+++ b/runtimes/go/pubsub/internal/aws/topic_test.go
@@ -0,0 +1,103 @@
+package aws
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"github.com/aws/aws-sdk-go-v2/aws"
+	"github.com/aws/aws-sdk-go-v2/service/sqs"
+	"github.com/rs/zerolog/log"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/pubsub/internal/types"
+	"encore.dev/pubsub/internal/utils"
+)
+
+const (
+	testTopicARN = "arn:aws:sns:us-west-2:406859400861:test-app-1-test-env-1-doms-test-topic"
+	testQueueURL = "https://sqs.us-west-2.amazonaws.com/406859400861/test-app-1-test-env-1-doms-test-topic_test-subscriber"
+)
+
+func Test_AWS_PubSub_E2E(t *testing.T) {
+	// Skip this test if the access keys needed are not set
+	if os.Getenv("AWS_ACCESS_KEY_ID") == "" {
+		t.Skip("AWS_ACCESS_KEY_ID is not set")
+	}
+	if os.Getenv("AWS_SECRET_ACCESS_KEY") == "" {
+		t.Skip("AWS_SECRET_ACCESS_KEY is not set")
+	}
+
+	runtime := &config.Runtime{
+		PubsubProviders: []*config.PubsubProvider{
+			{AWS: &config.AWSPubsubProvider{}},
+		},
+		PubsubTopics: map[string]*config.PubsubTopic{
+			"test-topic": {
+				EncoreName:   "test-topic",
+				ProviderID:   0,
+				ProviderName: testTopicARN,
+				Subscriptions: map[string]*config.PubsubSubscription{
+					"test-subscription": {
+						EncoreName:   "test-subscription",
+						ProviderName: testQueueURL,
+					},
+				},
+			},
+		},
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 15*time.Second)
+	ctxs := utils.NewContexts(ctx)
+	defer cancel()
+	mgr := NewManager(ctxs)
+
+	topic := mgr.NewTopic(runtime.PubsubProviders[0], types.TopicConfig{DeliveryGuarantee: types.AtLeastOnce}, runtime.PubsubTopics["test-topic"])
+
+	// Purge the queue of any messages from previous failed tests
+	_, err := mgr.getSQSClient(ctx).PurgeQueue(ctx, &sqs.PurgeQueueInput{
+		QueueUrl: aws.String(testQueueURL),
+	})
+	if err != nil {
+		t.Fatalf("failed to purge queue: %s", err)
+	}
+
+	// Subscribe to the queue
+	msgChan := make(chan string)
+	var sentMessageID string
+	topic.Subscribe(&log.Logger, 0, time.Second, nil, runtime.PubsubTopics["test-topic"].Subscriptions["test-subscription"], func(ctx context.Context, msgID string, publishTime time.Time, deliveryAttempt int, attrs map[string]string, data []byte) error {
+		if attrs["attr-1"] != "foo" {
+			t.Errorf("expected attr-1 to be foo, got %s", attrs["attr-1"])
+		}
+		if msgID != sentMessageID {
+			t.Errorf("expected message ID to be %s, got %s", sentMessageID, msgID)
+		}
+		if deliveryAttempt != 1 {
+			t.Errorf("expected delivery attempt to be 1, got %d", deliveryAttempt)
+		}
+		if publishTime.Before(time.Now().Add(-1 * time.Minute)) {
+			t.Errorf("expected publish time to be within the last minute, got %s", publishTime)
+		}
+		msgChan <- string(data)
+		return nil
+	})
+
+	// Publish a message on the queue
+	sentMessageID, err = topic.PublishMessage(context.Background(), "", map[string]string{"attr-1": "foo"}, []byte("{\"hello\":\"world\"}"))
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	// Verify receipt of the message
+	select {
+	case msg := <-msgChan:
+		if msg != "{\"hello\":\"world\"}" {
+			t.Errorf("expected message to be {\"hello\":\"world\"}, got %s", msg)
+		}
+
+		// Sleep to allow time for the subscription go routine to delete the message
+		time.Sleep(1 * time.Second)
+	case <-ctx.Done():
+		t.Errorf("timed out waiting for message")
+	}
+}
diff --git a/runtimes/go/pubsub/internal/azure/clients.go b/runtimes/go/pubsub/internal/azure/clients.go
new file mode 100644
index 0000000000..8df2996c17
--- /dev/null
+++ b/runtimes/go/pubsub/internal/azure/clients.go
@@ -0,0 +1,36 @@
+package azure
+
+import (
+	"fmt"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
+	"github.com/Azure/azure-sdk-for-go/sdk/messaging/azservicebus"
+
+	"encore.dev/appruntime/exported/config"
+)
+
+// getClient returns a singleton azure servicebus client for the given project or panics if it cannot be created.
+func (mgr *Manager) getClient(cfg *config.AzureServiceBusProvider) *azservicebus.Client {
+	mgr.clientMu.RLock()
+	client, ok := mgr._clients[cfg.Namespace]
+	mgr.clientMu.RUnlock()
+	if ok {
+		return client
+	}
+	mgr.clientMu.Lock()
+	defer mgr.clientMu.Unlock()
+	// Create a new client
+	credential, err := azidentity.NewDefaultAzureCredential(nil)
+	if err != nil {
+		panic(fmt.Sprintf("failed to create azure credential: %v", err))
+	}
+	azclient, err := azservicebus.NewClient(
+		fmt.Sprintf("%s.servicebus.windows.net",
+			cfg.Namespace), credential, nil)
+	if err != nil {
+		panic(fmt.Sprintf("failed to create azure client: %s", err))
+	}
+	mgr._clients[cfg.Namespace] = azclient
+
+	return azclient
+}
diff --git a/runtimes/go/pubsub/internal/azure/topic.go b/runtimes/go/pubsub/internal/azure/topic.go
new file mode 100644
index 0000000000..69e521d307
--- /dev/null
+++ b/runtimes/go/pubsub/internal/azure/topic.go
@@ -0,0 +1,190 @@
+package azure
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"sync"
+	"time"
+
+	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
+	"github.com/Azure/azure-sdk-for-go/sdk/messaging/azservicebus"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/pubsub/internal/types"
+	"encore.dev/pubsub/internal/utils"
+	"encore.dev/types/uuid"
+)
+
+const RetryCountAttribute = "encore-retry-count"
+const TargetSubAttribute = "encore-target-sub"
+
+type Manager struct {
+	ctxs *utils.Contexts
+
+	clientMu sync.RWMutex
+	_clients map[string]*azservicebus.Client // access via getClient()
+}
+
+func NewManager(ctxs *utils.Contexts) *Manager {
+	return &Manager{ctxs: ctxs, _clients: map[string]*azservicebus.Client{}}
+}
+
+func (mgr *Manager) ProviderName() string { return "azure" }
+
+func (mgr *Manager) Matches(cfg *config.PubsubProvider) bool {
+	return cfg.Azure != nil
+}
+
+type topic struct {
+	mgr        *Manager
+	client     *azservicebus.Client
+	topicCfg   *config.PubsubTopic
+	senderOnce sync.Once
+	_sender    *azservicebus.Sender
+}
+
+var _ types.TopicImplementation = (*topic)(nil)
+
+func (mgr *Manager) NewTopic(providerCfg *config.PubsubProvider, _ types.TopicConfig, runtimeCfg *config.PubsubTopic) types.TopicImplementation {
+	// Create the topic
+	client := mgr.getClient(providerCfg.Azure)
+	return &topic{mgr: mgr, client: client, topicCfg: runtimeCfg}
+}
+
+func (t *topic) sender() *azservicebus.Sender {
+	t.senderOnce.Do(func() {
+		sender, err := t.client.NewSender(t.topicCfg.ProviderName, nil)
+		if err != nil {
+			panic(fmt.Sprintf("failed to create pubsub sender for topic %s: %s", t.topicCfg.EncoreName, err))
+		}
+		t._sender = sender
+	})
+	return t._sender
+}
+
+func (t *topic) PublishMessage(ctx context.Context, groupingKey string, attrs map[string]string, data []byte) (id string, err error) {
+
+	messageID, err := uuid.NewV4()
+	if err != nil {
+		return "", fmt.Errorf("failed to generate message ID: %v", err.Error())
+	}
+	msg := &azservicebus.Message{
+		MessageID:             to.Ptr(messageID.String()),
+		Body:                  data,
+		ApplicationProperties: map[string]interface{}{},
+	}
+	for k, v := range attrs {
+		msg.ApplicationProperties[k] = v
+	}
+
+	// Attempt to publish the message
+	err = t.sender().SendMessage(ctx, msg, nil)
+	return *msg.MessageID, err
+}
+
+func (t *topic) scheduleRetry(subName string, msg *azservicebus.ReceivedMessage, backoff time.Duration) error {
+	retryCount, _ := strconv.ParseInt(fmt.Sprintf("%v", msg.ApplicationProperties[RetryCountAttribute]), 10, 64)
+	msg.ApplicationProperties[RetryCountAttribute] = retryCount + 1
+	msg.ApplicationProperties[TargetSubAttribute] = subName
+
+	reMsg := &azservicebus.Message{
+		ApplicationProperties: msg.ApplicationProperties,
+		Body:                  msg.Body,
+		ContentType:           msg.ContentType,
+		CorrelationID:         msg.CorrelationID,
+		MessageID:             &msg.MessageID,
+		PartitionKey:          msg.PartitionKey,
+		ReplyTo:               msg.ReplyTo,
+		ReplyToSessionID:      msg.ReplyToSessionID,
+		SessionID:             msg.SessionID,
+		Subject:               msg.Subject,
+		TimeToLive:            msg.TimeToLive,
+		To:                    msg.To,
+	}
+	_, err := t.sender().ScheduleMessages(
+		t.mgr.ctxs.Connection, []*azservicebus.Message{reMsg}, time.Now().Add(backoff), nil)
+	return err
+}
+
+func (t *topic) processMessage(
+	ctx context.Context,
+	logger *zerolog.Logger, receiver *azservicebus.Receiver, ackDeadline time.Duration, subCfg *config.PubsubSubscription,
+	msg *azservicebus.ReceivedMessage, rp *types.RetryPolicy, f types.RawSubscriptionCallback) (err error) {
+
+	ctx, cancel := context.WithTimeout(ctx, ackDeadline)
+	defer cancel()
+
+	attrs := make(map[string]string, len(msg.ApplicationProperties))
+	for k, v := range msg.ApplicationProperties {
+		attrs[k] = fmt.Sprintf("%v", v)
+	}
+	retryCount, _ := strconv.ParseInt(fmt.Sprintf("%v", msg.ApplicationProperties[RetryCountAttribute]), 10, 64)
+	deliveryAttempt := retryCount + 1
+	err = f(ctx, msg.MessageID, *msg.EnqueuedTime, int(deliveryAttempt), attrs, msg.Body)
+	if err != nil {
+		logger.Warn().Err(err).Msg("failed to process messsage")
+		shouldRetry, backoff := utils.GetDelay(
+			rp.MaxRetries, rp.MinBackoff, rp.MaxBackoff, uint16(deliveryAttempt))
+		if !shouldRetry {
+			logger.Warn().Msg("deadlettering msg")
+			err = receiver.DeadLetterMessage(t.mgr.ctxs.Connection, msg, &azservicebus.DeadLetterOptions{
+				ErrorDescription:   to.Ptr(fmt.Sprintf("failed to process message after %v retries", deliveryAttempt)),
+				Reason:             to.Ptr("ExhaustedRetries"),
+				PropertiesToModify: map[string]interface{}{RetryCountAttribute: 0},
+			})
+		} else {
+			logger.Warn().Msgf("scheduling msg retry in %v (attempt %v)", backoff, deliveryAttempt)
+			err = t.scheduleRetry(subCfg.ProviderName, msg, backoff)
+		}
+	}
+	// if err == nil we have either successfully processed the message or we have scheduled/deadlettered it
+	if err == nil {
+		err = receiver.CompleteMessage(t.mgr.ctxs.Connection, msg, nil)
+		if err != nil {
+			logger.Warn().Err(err).Msg("failed to complete message")
+		}
+	}
+	return err
+}
+
+func (t *topic) Subscribe(logger *zerolog.Logger, maxConcurrency int, ackDeadline time.Duration, retryPolicy *types.RetryPolicy, subCfg *config.PubsubSubscription, f types.RawSubscriptionCallback) {
+	receiver, err := t.client.NewReceiverForSubscription(t.topicCfg.ProviderName, subCfg.ProviderName, nil)
+	if err != nil {
+		panic(fmt.Sprintf("failed to create pubsub receiver for subscription %s: %s", subCfg.EncoreName, err))
+	}
+
+	if maxConcurrency == 0 {
+		maxConcurrency = 1 // FIXME(domblack): This retains the old behaviour, but allows user customisation - in a future release we should remove this
+	}
+
+	// Start the subscription
+	go func() {
+		for t.mgr.ctxs.Fetch.Err() == nil {
+			err := utils.WorkConcurrently(
+				t.mgr.ctxs, maxConcurrency, 0,
+				func(ctx context.Context, maxToFetch int) ([]*azservicebus.ReceivedMessage, error) {
+					// Subscribe to the topic to receive messages
+					messages, err := receiver.ReceiveMessages(ctx, maxToFetch, nil)
+					if err != nil {
+						return nil, err
+					}
+
+					return messages, nil
+				},
+				func(ctx context.Context, work *azservicebus.ReceivedMessage) error {
+					return t.processMessage(ctx, logger, receiver, ackDeadline, subCfg, work, retryPolicy, f)
+				},
+			)
+
+			// If there was an error and we're not shutting down, log it and then sleep for a bit before trying again
+			if err != nil && t.mgr.ctxs.Fetch.Err() == nil {
+				logger.Warn().Err(err).Msg("pubsub subscription failed, retrying in 5 seconds")
+				time.Sleep(5 * time.Second)
+			}
+		}
+
+	}()
+
+}
diff --git a/runtimes/go/pubsub/internal/encorecloud/manager.go b/runtimes/go/pubsub/internal/encorecloud/manager.go
new file mode 100644
index 0000000000..68b2640961
--- /dev/null
+++ b/runtimes/go/pubsub/internal/encorecloud/manager.go
@@ -0,0 +1,47 @@
+package encorecloud
+
+import (
+	"go.encore.dev/platform-sdk"
+	"go.encore.dev/platform-sdk/encorecloud"
+	"go.encore.dev/platform-sdk/pkg/auth"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/pubsub/internal/types"
+	"encore.dev/pubsub/internal/utils"
+)
+
+type Manager struct {
+	ctxs         *utils.Contexts
+	client       *encorecloud.Client
+	pushRegistry types.PushEndpointRegistry
+}
+
+func NewManager(ctxs *utils.Contexts, runtime *config.Runtime, pushRegistry types.PushEndpointRegistry) *Manager {
+	// It's possible that the runtime is nil, for example if the app isn't using this manager
+	// so we need to check for that.
+	server := ""
+	var authKeys []auth.Key
+	if runtime.EncoreCloudAPI != nil {
+		server = runtime.EncoreCloudAPI.Server
+		authKeys = runtime.EncoreCloudAPI.AuthKeys
+	}
+
+	sdk := platform.NewSDK(
+		platform.WithHost(server),
+		platform.WithAppDetails(runtime.AppSlug, runtime.EnvName),
+		platform.WithAuthKeys(authKeys...),
+	)
+	return &Manager{ctxs: ctxs, client: sdk.EncoreCloud, pushRegistry: pushRegistry}
+}
+
+func (mgr *Manager) ProviderName() string {
+	return "encorecloud"
+}
+
+func (mgr *Manager) Matches(providerCfg *config.PubsubProvider) bool {
+	return providerCfg.EncoreCloud != nil
+}
+
+func (mgr *Manager) NewTopic(_ *config.PubsubProvider, _ types.TopicConfig, runtimeCfg *config.PubsubTopic) types.TopicImplementation {
+	return &topic{mgr, runtimeCfg}
+}
diff --git a/runtimes/go/pubsub/internal/encorecloud/topic.go b/runtimes/go/pubsub/internal/encorecloud/topic.go
new file mode 100644
index 0000000000..0e311ca46f
--- /dev/null
+++ b/runtimes/go/pubsub/internal/encorecloud/topic.go
@@ -0,0 +1,32 @@
+package encorecloud
+
+import (
+	"context"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/pubsub/internal/types"
+)
+
+type topic struct {
+	mgr *Manager
+	cfg *config.PubsubTopic
+}
+
+func (t *topic) PublishMessage(ctx context.Context, orderingKey string, attrs map[string]string, data []byte) (id string, err error) {
+	return t.mgr.client.PublishToTopic(ctx, t.cfg.ProviderName, orderingKey, attrs, data)
+}
+
+func (t *topic) Subscribe(logger *zerolog.Logger, maxConcurrency int, ackDeadline time.Duration, retryPolicy *types.RetryPolicy, subCfg *config.PubsubSubscription, f types.RawSubscriptionCallback) {
+	if subCfg.ID == "" {
+		panic("encorecloud pubsub subscriptions must have an ID")
+	}
+
+	// registerPushEndpoint registers a push endpoint for a subscription from Encore Cloud
+	t.mgr.pushRegistry.RegisterPushSubscriptionHandler(
+		types.SubscriptionID(subCfg.ID),
+		t.mgr.client.CreateSubscriptionHandler(subCfg.ID, logger, f),
+	)
+}
diff --git a/runtimes/go/pubsub/internal/gcp/clients.go b/runtimes/go/pubsub/internal/gcp/clients.go
new file mode 100644
index 0000000000..52af7c45e0
--- /dev/null
+++ b/runtimes/go/pubsub/internal/gcp/clients.go
@@ -0,0 +1,42 @@
+package gcp
+
+import (
+	"fmt"
+	"runtime"
+
+	"cloud.google.com/go/pubsub"
+)
+
+// getClientForProject returns a singleton pubsub client for the given project or panics if it cannot be created.
+func (mgr *Manager) getClientForProject(projectID string) *pubsub.Client {
+	mgr.clientsMu.Lock()
+	defer mgr.clientsMu.Unlock()
+
+	client, ok := mgr.clients[projectID]
+	if !ok {
+		// Create a new client
+		cl, err := pubsub.NewClient(mgr.ctxs.Connection, projectID)
+		if err != nil {
+			panic(fmt.Sprintf("failed to create pubsub client: %s", err))
+		}
+		client = cl
+		mgr.clients[projectID] = cl
+	}
+
+	return client
+}
+
+// numGoroutines computes the number of goroutines to use for the subscription,
+// by adaptively taking into account gRPC stream limits and the number of subscriptions.
+func numGoroutines(numSubs int) int {
+	if numSubs < 1 {
+		numSubs = 1 // avoid division by zero
+	}
+
+	maxProcs := runtime.GOMAXPROCS(0)
+	numConns := min(4, maxProcs)
+	maxStreams := numConns * 90
+
+	// Clamp to [1, 10].
+	return max(min(maxStreams/numSubs, 10), 1)
+}
diff --git a/runtimes/go/pubsub/internal/gcp/push_handler.go b/runtimes/go/pubsub/internal/gcp/push_handler.go
new file mode 100644
index 0000000000..fa0de2270b
--- /dev/null
+++ b/runtimes/go/pubsub/internal/gcp/push_handler.go
@@ -0,0 +1,89 @@
+package gcp
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/rs/zerolog"
+	"google.golang.org/api/idtoken"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/beta/errs"
+	"encore.dev/internal/platformauth"
+	"encore.dev/pubsub/internal/types"
+)
+
+// This is documented in https://cloud.google.com/pubsub/docs/push
+type pushPayload struct {
+	Message struct {
+		Attributes  map[string]string `json:"attributes"`
+		Data        []byte            `json:"data"`
+		MessageID   string            `json:"messageId"`
+		PublishTime time.Time         `json:"publishTime"`
+	} `json:"message"`
+	Subscription    string `json:"subscription"`
+	DeliveryAttempt int    `json:"deliveryAttempt,omitempty"` // Field documented in: https://cloud.google.com/pubsub/docs/handling-failures#track_delivery_attempts
+}
+
+func (mgr *Manager) registerPushEndpoint(logger *zerolog.Logger, subscriptionConfig *config.PubsubSubscription, f types.RawSubscriptionCallback) {
+	handler := func(req *http.Request) error {
+		// If the request has not come from the Encore platform it must have
+		// a valid JWT set by Google.
+		if !platformauth.IsEncorePlatformRequest(req.Context()) {
+			if err := mgr.validateGoogleJWT(req, subscriptionConfig.GCP.PushServiceAccount); err != nil {
+				return errs.Wrap(err, "unable to validate JWT")
+			}
+		}
+
+		// Decode the payload
+		payload := &pushPayload{}
+		if err := json.NewDecoder(req.Body).Decode(payload); err != nil {
+			return errs.WrapCode(err, errs.InvalidArgument, "invalid push payload")
+		}
+
+		// Call the subscription callback
+		return f(
+			req.Context(),
+			payload.Message.MessageID, payload.Message.PublishTime, payload.DeliveryAttempt,
+			payload.Message.Attributes, payload.Message.Data,
+		)
+	}
+
+	mgr.pushRegistry.RegisterPushSubscriptionHandler(
+		types.SubscriptionID(subscriptionConfig.ID),
+		func(w http.ResponseWriter, request *http.Request) {
+			err := handler(request)
+			if err != nil {
+				logger.Err(err).Msg("error while handling PubSub subscription message")
+			}
+			errs.HTTPError(w, err)
+		},
+	)
+}
+
+func (mgr *Manager) validateGoogleJWT(req *http.Request, serviceAccountEmail string) error {
+	// Extract the JWT from the header
+	authType, token, _ := strings.Cut(req.Header.Get("Authorization"), " ")
+	if authType != "Bearer" {
+		return errs.B().Code(errs.InvalidArgument).Msg("invalid auth header").Err()
+	}
+
+	// Validate it
+	jwt, err := idtoken.Validate(req.Context(), token, mgr.runtime.AppID+"-"+mgr.runtime.EnvID)
+	if err != nil {
+		return errs.B().Code(errs.InvalidArgument).Msg("unable to validate authorization").Err()
+	}
+	if jwt.Issuer != "accounts.google.com" && jwt.Issuer != "https://accounts.google.com" {
+		return errs.B().Code(errs.InvalidArgument).Msg("invalid issuer").Err()
+	}
+	if jwt.Claims["email"] != serviceAccountEmail || jwt.Claims["email_verified"] != true {
+		return errs.B().Code(errs.Unauthenticated).Meta(
+			"expected_email", serviceAccountEmail,
+			"got_email", jwt.Claims["email"],
+		).Msg("invalid email").Err()
+	}
+
+	return nil
+}
diff --git a/runtimes/go/pubsub/internal/gcp/topic.go b/runtimes/go/pubsub/internal/gcp/topic.go
new file mode 100644
index 0000000000..bc08124d3f
--- /dev/null
+++ b/runtimes/go/pubsub/internal/gcp/topic.go
@@ -0,0 +1,167 @@
+package gcp
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"time"
+
+	"cloud.google.com/go/pubsub"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/experiments"
+	"encore.dev/pubsub/internal/types"
+	"encore.dev/pubsub/internal/utils"
+)
+
+type Manager struct {
+	ctxs         *utils.Contexts
+	runtime      *config.Runtime
+	pushRegistry types.PushEndpointRegistry
+	experiments  *experiments.Set // The set of experiments enabled for this runtime
+
+	clientsMu sync.Mutex                // clientsMu protects access to the clients map
+	clients   map[string]*pubsub.Client // A map of project ID to pubsub client
+}
+
+func NewManager(ctxs *utils.Contexts, static *config.Static, runtime *config.Runtime, pushRegistry types.PushEndpointRegistry) *Manager {
+	experiments := experiments.FromConfig(static, runtime)
+	return &Manager{ctxs: ctxs, runtime: runtime, pushRegistry: pushRegistry, experiments: experiments, clients: make(map[string]*pubsub.Client)}
+}
+
+type topic struct {
+	mgr      *Manager
+	gcpTopic *pubsub.Topic
+	topicCfg *config.PubsubTopic
+}
+
+func (mgr *Manager) ProviderName() string { return "gcp" }
+
+func (mgr *Manager) Matches(cfg *config.PubsubProvider) bool {
+	return cfg.GCP != nil
+}
+
+func (mgr *Manager) NewTopic(_ *config.PubsubProvider, staticCfg types.TopicConfig, runtimeCfg *config.PubsubTopic) types.TopicImplementation {
+	// Create the topic
+	gcpTopic := mgr.getClientForProject(runtimeCfg.GCP.ProjectID).Topic(runtimeCfg.ProviderName)
+
+	// Enable message ordering if we have an ordering key set
+	gcpTopic.EnableMessageOrdering = staticCfg.OrderingAttribute != ""
+
+	// Check we have permissions to interact with the given topic
+	// (note: the call to Topic() above only creates the object, it doesn't verify that we have permissions to interact with it)
+	_, err := gcpTopic.Config(mgr.ctxs.Connection)
+	if err != nil {
+		panic(fmt.Sprintf("pubsub topic %s status call failed: %s", runtimeCfg.EncoreName, err))
+	}
+
+	return &topic{mgr, gcpTopic, runtimeCfg}
+}
+
+func (t *topic) PublishMessage(ctx context.Context, orderingKey string, attrs map[string]string, data []byte) (id string, err error) {
+	gcpMsg := &pubsub.Message{
+		Data:        data,
+		Attributes:  attrs,
+		OrderingKey: orderingKey,
+	}
+
+	// Attempt to publish the message
+	id, err = t.gcpTopic.Publish(ctx, gcpMsg).Get(ctx)
+
+	if t.gcpTopic.EnableMessageOrdering && err != nil {
+		t.gcpTopic.ResumePublish(orderingKey)
+	}
+	return id, err
+}
+
+func (t *topic) Subscribe(logger *zerolog.Logger, maxConcurrency int, ackDeadline time.Duration, retryPolicy *types.RetryPolicy, subCfg *config.PubsubSubscription, f types.RawSubscriptionCallback) {
+	if subCfg.PushOnly && subCfg.ID == "" {
+		panic("push-only subscriptions must have a subscription ID")
+	}
+	gcpCfg := subCfg.GCP
+	if gcpCfg == nil {
+		panic("GCP subscriptions must have GCP-specific configuration provided, got nil")
+	}
+
+	// If we have a subscription ID, register a push endpoint for it
+	if subCfg.ID != "" {
+		if gcpCfg.PushServiceAccount != "" {
+			t.mgr.registerPushEndpoint(logger, subCfg, f)
+		} else if subCfg.PushOnly {
+			panic("push-only subscriptions require a push service account to be configured for the PubSub server config")
+		}
+	}
+
+	// If we're not push only, then also set up the subscription
+	if !subCfg.PushOnly {
+		// Create the subscription object (and then check it exists on GCP's side)
+		subscription := t.mgr.getClientForProject(gcpCfg.ProjectID).Subscription(subCfg.ProviderName)
+
+		// Set the concurrency
+		if maxConcurrency == 0 {
+			maxConcurrency = 1000 // FIXME(domblack): This retains the old behaviour, but allows user customisation - in a future release we should remove this
+		}
+		subscription.ReceiveSettings.MaxOutstandingMessages = maxConcurrency
+
+		if experiments.AdaptiveGCPPubSubGoroutines.Enabled(t.mgr.experiments) {
+			// Compute the number of goroutines to use for this subscription.
+			streamingSubsInProject := 0
+			for _, topic := range t.mgr.runtime.PubsubTopics {
+				for _, sub := range topic.Subscriptions {
+					if !sub.PushOnly && sub.GCP != nil && sub.GCP.ProjectID == gcpCfg.ProjectID {
+						streamingSubsInProject++
+					}
+				}
+			}
+			subscription.ReceiveSettings.NumGoroutines = numGoroutines(streamingSubsInProject)
+		}
+
+		// Start the subscription with the GCP library
+		go func() {
+			for t.mgr.ctxs.Fetch.Err() == nil {
+				// Subscribe to the topic to receive messages
+				err := subscription.Receive(t.mgr.ctxs.Fetch, func(_ context.Context, msg *pubsub.Message) {
+					deliveryAttempt := 1
+					if msg.DeliveryAttempt != nil {
+						deliveryAttempt = *msg.DeliveryAttempt
+					}
+
+					// Create a context from the handler context with a deadline of the ackdeadline
+					ctx, cancel := context.WithTimeout(t.mgr.ctxs.Handler, ackDeadline)
+					defer cancel()
+
+					var result *pubsub.AckResult
+					if err := f(ctx, msg.ID, msg.PublishTime, deliveryAttempt, msg.Attributes, msg.Data); err != nil {
+						result = msg.NackWithResult()
+					} else {
+						result = msg.AckWithResult()
+					}
+
+					res, err := result.Get(t.mgr.ctxs.Connection)
+					if err != nil {
+						logger.Warn().Err(err).Str("msg_id", msg.ID).Msg("failed to ack/nack message")
+					} else {
+						switch res {
+						case pubsub.AcknowledgeStatusSuccess:
+						case pubsub.AcknowledgeStatusPermissionDenied:
+							logger.Error().Str("msg_id", msg.ID).Msg("failed to ack/nack message due to permissions")
+						case pubsub.AcknowledgeStatusFailedPrecondition:
+							logger.Error().Str("msg_id", msg.ID).Msg("failed to ack/nack message due to precondition")
+						case pubsub.AcknowledgeStatusInvalidAckID:
+							logger.Error().Str("msg_id", msg.ID).Msg("failed to ack/nack message due to invalid ack ID")
+						default:
+							logger.Error().Str("msg_id", msg.ID).Msg("failed to ack/nack message due to unknown error")
+						}
+					}
+				})
+
+				// If there was an error and we're not shutting down, log it and then sleep for a bit before trying again
+				if err != nil && t.mgr.ctxs.Fetch.Err() == nil {
+					logger.Warn().Err(err).Msg("pubsub subscription failed, retrying in 5 seconds")
+					time.Sleep(5 * time.Second)
+				}
+			}
+		}()
+	}
+}
diff --git a/runtimes/go/pubsub/internal/noop/topic.go b/runtimes/go/pubsub/internal/noop/topic.go
new file mode 100644
index 0000000000..129cf6f6ee
--- /dev/null
+++ b/runtimes/go/pubsub/internal/noop/topic.go
@@ -0,0 +1,29 @@
+package noop
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/pubsub/internal/types"
+)
+
+type Topic struct{}
+
+var _ types.TopicImplementation = (*Topic)(nil)
+
+var ErrNoop = errors.New(
+	"pubsub: this service is not configured to use this topic. " +
+		"Use pubsub.TopicRef in the service to get a reference and access to the topic from this service",
+)
+
+func (t *Topic) PublishMessage(ctx context.Context, orderingKey string, attrs map[string]string, data []byte) (id string, err error) {
+	return "", ErrNoop
+}
+
+func (t *Topic) Subscribe(logger *zerolog.Logger, maxConcurrency int, _ time.Duration, _ *types.RetryPolicy, subCfg *config.PubsubSubscription, f types.RawSubscriptionCallback) {
+	// no-op
+}
diff --git a/runtimes/go/pubsub/internal/nsq/log_adapter.go b/runtimes/go/pubsub/internal/nsq/log_adapter.go
new file mode 100644
index 0000000000..acb7df674c
--- /dev/null
+++ b/runtimes/go/pubsub/internal/nsq/log_adapter.go
@@ -0,0 +1,54 @@
+package nsq
+
+import (
+	"strings"
+
+	"github.com/rs/zerolog"
+)
+
+type LogAdapter struct{ Logger *zerolog.Logger }
+
+func (l *LogAdapter) Output(maxdepth int, s string) error {
+	// Attempt to extract the level, start with cutting on ":"
+	lvl, logMsg, found := strings.Cut(s, ":")
+	if !found || strings.Contains(lvl, " ") {
+		// then if that fails or we have a space in that cut, try cutting on the first space
+		newLvl, suffix, _ := strings.Cut(lvl, " ")
+		lvl = newLvl
+
+		if found {
+			logMsg = suffix + ":" + logMsg
+		}
+	}
+
+	// Attempt to convert the level string to a zerolog level
+	logLevel := l.OutputLevel(lvl)
+	if logLevel == zerolog.NoLevel {
+		// and if that fails, then just log the message
+		logMsg = s
+	}
+
+	logMsg = strings.TrimSpace(logMsg)
+	if logMsg != "" {
+		l.Logger.WithLevel(logLevel).Msg(logMsg)
+	}
+
+	return nil
+}
+
+func (l *LogAdapter) OutputLevel(lvl string) zerolog.Level {
+	switch strings.ToLower(lvl) {
+	case "debug", "dbg":
+		return zerolog.DebugLevel
+	case "info", "inf":
+		return zerolog.InfoLevel
+	case "warn", "wrn":
+		return zerolog.WarnLevel
+	case "error", "err":
+		return zerolog.ErrorLevel
+	case "fatal":
+		return zerolog.FatalLevel
+	default:
+		return zerolog.NoLevel
+	}
+}
diff --git a/runtimes/go/pubsub/internal/nsq/topic.go b/runtimes/go/pubsub/internal/nsq/topic.go
new file mode 100644
index 0000000000..3bf63c68e8
--- /dev/null
+++ b/runtimes/go/pubsub/internal/nsq/topic.go
@@ -0,0 +1,209 @@
+package nsq
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/nsqio/go-nsq"
+	"github.com/rs/xid"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/beta/errs"
+	"encore.dev/pubsub/internal/types"
+	"encore.dev/pubsub/internal/utils"
+)
+
+type Manager struct {
+	ctxs *utils.Contexts
+	rt   *reqtrack.RequestTracker
+}
+
+func NewManager(ctxs *utils.Contexts, rt *reqtrack.RequestTracker) *Manager {
+	return &Manager{ctxs, rt}
+}
+
+// topic is the nsq implementation of pubsub.Topic. It exposes methods to publish
+// and subscribe to messages of a topic
+type topic struct {
+	mgr       *Manager
+	name      string
+	addr      string
+	m         sync.Mutex
+	producer  *nsq.Producer
+	consumers map[string]*nsq.Consumer
+}
+
+func (mgr *Manager) ProviderName() string { return "nsq" }
+
+func (mgr *Manager) Matches(cfg *config.PubsubProvider) bool {
+	return cfg.NSQ != nil
+}
+
+func (mgr *Manager) NewTopic(providerCfg *config.PubsubProvider, _ types.TopicConfig, runtimeCfg *config.PubsubTopic) types.TopicImplementation {
+	return &topic{
+		mgr:       mgr,
+		name:      runtimeCfg.EncoreName,
+		addr:      providerCfg.NSQ.Host,
+		producer:  nil,
+		consumers: make(map[string]*nsq.Consumer),
+	}
+}
+
+// messageWrapper is a local representation of a topic published to NSQ.
+// it wraps the raw data with an ID and an Attribute map.
+// It must be synchronized with the e2e-tests/testscript_test.go file.
+type messageWrapper struct {
+	ID         string
+	Attributes map[string]string
+	Data       json.RawMessage
+}
+
+func (l *topic) Subscribe(logger *zerolog.Logger, maxConcurrency int, ackDeadline time.Duration, retryPolicy *types.RetryPolicy, implCfg *config.PubsubSubscription, f types.RawSubscriptionCallback) {
+	if implCfg.PushOnly {
+		panic("push-only subscriptions are not supported by nsq")
+	}
+
+	l.m.Lock()
+	defer l.m.Unlock()
+
+	if _, ok := l.consumers[implCfg.EncoreName]; ok {
+		panic("NewSubscription must use a unique subscription name")
+	}
+
+	if maxConcurrency == 0 {
+		maxConcurrency = 1 // FIXME(domblack): This retains the old behaviour, but allows user customisation - in a future release we should remove this
+	}
+
+	if maxConcurrency < 0 {
+		// nsq does not support the concept of unlimited concurrency, so we set it to a high number here
+		// (value of 0 will pause consumption)
+		maxConcurrency = 100
+	}
+
+	conCfg := getConsumerConfig(maxConcurrency, ackDeadline, retryPolicy)
+	consumer, err := nsq.NewConsumer(l.name, implCfg.EncoreName, conCfg)
+	if err != nil {
+		panic(fmt.Sprintf("unable to setup subscription %s for topic %s: %v", implCfg.EncoreName, l.name, err))
+	}
+	// only log warnings and above from the NSQ library
+	consumer.SetLogger(&LogAdapter{Logger: logger}, nsq.LogLevelWarning)
+
+	// create a dedicated handler which forwards messages to the encore subscription
+	consumer.AddConcurrentHandlers(nsq.HandlerFunc(func(m *nsq.Message) error {
+		// create a message to unmarshal the raw nsq body into
+		msg := &messageWrapper{}
+
+		defer func() {
+			if !m.HasResponded() {
+				retry, delay := utils.GetDelay(retryPolicy.MaxRetries, retryPolicy.MinBackoff, retryPolicy.MaxBackoff, m.Attempts)
+				if !retry {
+
+					logger.Error().Str("msg_id", msg.ID).Int("retry", int(m.Attempts)-1).Msg("depleted message retries. Dropping message")
+					// TODO; offload this to the dead letter queue
+					m.Finish()
+					return
+				}
+				m.RequeueWithoutBackoff(delay)
+			}
+		}()
+
+		err = json.Unmarshal(m.Body, msg)
+		if err != nil {
+			return errs.B().Cause(err).Code(errs.InvalidArgument).Msg("failed to unmarshal message wrapper").Err()
+		}
+
+		// forward the message to the subscriber
+		msgCtx, cancel := context.WithTimeout(l.mgr.ctxs.Handler, ackDeadline)
+		defer cancel()
+
+		err = f(msgCtx, msg.ID, time.Unix(0, m.Timestamp), int(m.Attempts), msg.Attributes, msg.Data)
+		if err != nil {
+			return err
+		}
+		m.Finish()
+		return nil
+	}), maxConcurrency)
+
+	// add the consumer to the known consumers
+	l.consumers[implCfg.EncoreName] = consumer
+
+	go func() {
+		// Allow the rest of the service to initialize before we connect to NSQD.
+		// This is necessary because NSQD is so fast the receiver can process messages
+		// before all package-level initialization functions have been called.
+		time.Sleep(100 * time.Millisecond)
+		err = consumer.ConnectToNSQD(l.addr)
+		if err != nil {
+			panic(fmt.Sprintf("failed to connect %s to nsqd for topic %s: %v", implCfg.EncoreName, l.name, err))
+		}
+	}()
+
+	// Stop the consumer when the the fetch context is done
+	go func() {
+		<-l.mgr.ctxs.Fetch.Done()
+		consumer.Stop()
+	}()
+}
+
+// PublishMessage publishes a message to an nsq Topic
+func (l *topic) PublishMessage(ctx context.Context, orderingKey string, attrs map[string]string, data []byte) (id string, err error) {
+	// instantiate a Producer if there isn;t one already
+	if l.producer == nil {
+		l.m.Lock()
+		defer l.m.Unlock()
+		if l.producer == nil {
+			cfg := nsq.NewConfig()
+			producer, err := nsq.NewProducer(l.addr, cfg)
+			if err != nil {
+				return "", errs.B().Cause(err).Code(errs.Internal).Msg("failed to connect to NSQD").Err()
+			}
+			// only log warnings and above from the NSQ library
+			log := l.mgr.rt.Logger().With().Str("topic", l.name).Logger()
+			producer.SetLogger(&LogAdapter{Logger: &log}, nsq.LogLevelWarning)
+			l.producer = producer
+		}
+	}
+
+	// generate a new message ID
+	msgID := xid.New().String()
+
+	// create and publish the message wrapper
+	data, err = json.Marshal(&messageWrapper{ID: msgID, Data: data, Attributes: attrs})
+	if err != nil {
+		return "", errs.B().Cause(err).Code(errs.Internal).Msg("failed to marshal message").Err()
+	}
+	err = l.producer.Publish(l.name, data)
+	if err != nil {
+		return "", errs.B().Cause(err).Code(errs.Internal).Msg("failed to connect to NSQD").Err()
+	}
+	return msgID, nil
+}
+
+func getConsumerConfig(maxConcurrency int, ackDeadline time.Duration, retryPolicy *types.RetryPolicy) *nsq.Config {
+	conCfg := nsq.NewConfig()
+	conCfg.MsgTimeout = utils.Clamp(ackDeadline, 0, 15*time.Minute)
+	conCfg.MaxInFlight = maxConcurrency
+	conCfg.DefaultRequeueDelay = utils.Clamp(retryPolicy.MinBackoff, 0, 60*time.Minute)
+	conCfg.MaxRequeueDelay = utils.Clamp(retryPolicy.MaxBackoff, 0, 60*time.Minute)
+
+	switch retryPolicy.MaxRetries {
+	case 0:
+		conCfg.MaxAttempts = 100
+	case types.InfiniteRetries:
+		conCfg.MaxAttempts = 65535
+	default:
+		const maxVal = 65535 // from the nsq library config
+		if retryPolicy.MaxRetries > maxVal {
+			conCfg.MaxAttempts = maxVal
+		} else {
+			conCfg.MaxAttempts = uint16(retryPolicy.MaxRetries)
+		}
+	}
+
+	return conCfg
+}
diff --git a/runtimes/go/pubsub/internal/test/topic.go b/runtimes/go/pubsub/internal/test/topic.go
new file mode 100644
index 0000000000..2eda99e3da
--- /dev/null
+++ b/runtimes/go/pubsub/internal/test/topic.go
@@ -0,0 +1,139 @@
+package test
+
+import (
+	"context"
+	"fmt"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/testsupport"
+	"encore.dev/pubsub/internal/types"
+	"encore.dev/pubsub/internal/utils"
+)
+
+// TestTopic is used during a "encore test" call.
+//
+// It records all published messages on a per-test basis, allowing a unit test
+// to assert that the correct messages were published.
+//
+// Any messages published to this type of topic _will not_ be passed to subscribers.
+type TestTopic[T any] struct {
+	ts          *testsupport.Manager
+	name        string
+	m           sync.RWMutex
+	instances   map[*testing.T]*testInstance[T]
+	subscribers map[string]types.RawSubscriptionCallback
+}
+
+func NewTopic[T any](ts *testsupport.Manager, name string) types.TopicImplementation {
+	return &TestTopic[T]{
+		ts:          ts,
+		name:        name,
+		instances:   make(map[*testing.T]*testInstance[T]),
+		subscribers: make(map[string]types.RawSubscriptionCallback),
+	}
+}
+
+// PublishMessage will record the message against the test instance
+// and if subscribers are enabled for the test instance, it will also trigger
+// those subscribers. (The default behaviour is subscribers are disabled in tests)
+func (t *TestTopic[T]) PublishMessage(ctx context.Context, orderingKey string, attrs map[string]string, data []byte) (id string, err error) {
+	if err := ctx.Err(); err != nil {
+		return "", err
+	}
+
+	test := t.ts.CurrentTest()
+	unmarshalled, err := utils.UnmarshalMessage[T](attrs, data)
+	if err != nil {
+		test.Fatalf("failed to unmarshal published message: %s", err)
+	}
+
+	instance := t.TestInstance(test)
+
+	msgID, err := instance.publishMessage(unmarshalled)
+	if err != nil {
+		return "", err
+	}
+
+	// If subscriptions are enabled for this test, then trigger those subscribers asynchronously
+	// allowing the publishing code to continue as it would in a real system
+	if instance.subscriptionsEnabled {
+		published := time.Now()
+
+		for name, sub := range t.subscribers {
+			name := name
+			sub := sub
+			t.ts.RunAsyncCodeInTest(test, func(ctx context.Context) {
+				if err := sub(ctx, msgID, published, 1, attrs, data); err != nil {
+					test.Errorf("an error was returned while processing subscription %s for message %s: %s", name, msgID, err)
+					test.Fail()
+				}
+			})
+		}
+	}
+
+	return msgID, nil
+}
+
+// Subscribe will register a new subscriber for the pub sub topic. By default these will not be called during tests
+func (t *TestTopic[T]) Subscribe(logger *zerolog.Logger, maxConcurrency int, ackDeadline time.Duration, retryPolicy *types.RetryPolicy, implCfg *config.PubsubSubscription, f types.RawSubscriptionCallback) {
+	t.m.Lock()
+	defer t.m.Unlock()
+	t.subscribers[implCfg.EncoreName] = f
+}
+
+// TestInstance returns this tests specific instance of the topic and creates it if it does not exist
+func (t *TestTopic[T]) TestInstance(test *testing.T) *testInstance[T] {
+	t.m.RLock()
+	instance, found := t.instances[test]
+	t.m.RUnlock()
+	if found {
+		return instance
+	}
+
+	t.m.Lock()
+	defer t.m.Unlock()
+	if _, found := t.instances[test]; !found {
+		t.instances[test] = &testInstance[T]{
+			topicName: t.name,
+			t:         test,
+		}
+	}
+
+	return t.instances[test]
+}
+
+// testInstance represents a topic, as it is seen from a test
+// This struct implements test.TestTopic[T] to allow the testing package to interface with it
+type testInstance[T any] struct {
+	topicName            string     // The topic name
+	t                    *testing.T // The test we're running against
+	msgID                int32      // The last message ID we sent (updated atomically)
+	m                    sync.Mutex // Mutex for the published messages
+	messages             []T        // What messages have been published
+	subscriptionsEnabled bool       // If subscriptions are enabled for this test
+}
+
+// publishMessage records the message which was sent, and generates a deterministic message ID
+// which is guaranteed to be unique across all tests
+func (t *testInstance[T]) publishMessage(unmarshalled T) (id string, err error) {
+	msgID := atomic.AddInt32(&t.msgID, 1)
+
+	t.m.Lock()
+	defer t.m.Unlock()
+	t.messages = append(t.messages, unmarshalled)
+
+	// we use "/" as the separator to mirror the behaviour of tests and sub tests
+	return fmt.Sprintf("%s/%s/%d", t.t.Name(), t.topicName, msgID), nil
+}
+
+func (t *testInstance[T]) PublishedMessages() []T {
+	t.m.Lock()
+	defer t.m.Unlock()
+	return t.messages
+}
diff --git a/runtimes/go/pubsub/internal/types/private.go b/runtimes/go/pubsub/internal/types/private.go
new file mode 100644
index 0000000000..96500d230f
--- /dev/null
+++ b/runtimes/go/pubsub/internal/types/private.go
@@ -0,0 +1,19 @@
+package types
+
+import (
+	"context"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+)
+
+// RawSubscriptionCallback represents a unified callback structure allowing us to create a standardised callback for each implementation
+type RawSubscriptionCallback func(ctx context.Context, msgID string, publishTime time.Time, deliveryAttempt int, attrs map[string]string, data []byte) error
+
+// TopicImplementation gives us a private API to implementing topics, which we can change without impacting the public API
+type TopicImplementation interface {
+	PublishMessage(ctx context.Context, orderingKey string, attrs map[string]string, data []byte) (id string, err error)
+	Subscribe(logger *zerolog.Logger, maxConcurrency int, ackDeadline time.Duration, retryPolicy *RetryPolicy, implCfg *config.PubsubSubscription, f RawSubscriptionCallback)
+}
diff --git a/runtimes/go/pubsub/internal/types/public.go b/runtimes/go/pubsub/internal/types/public.go
new file mode 100644
index 0000000000..da9ddb8005
--- /dev/null
+++ b/runtimes/go/pubsub/internal/types/public.go
@@ -0,0 +1,136 @@
+package types
+
+import (
+	"time"
+)
+
+// RetryPolicy defines how a subscription should handle retries
+// after errors either delivering the message or processing the message.
+//
+// The values given to this structure are parsed at compile time, such that
+// the correct Cloud resources can be provisioned to support the queue.
+//
+// As such the values given here may be clamped to the supported values by
+// the target cloud. (i.e. min/max values brought within the supported range
+// by the target cloud).
+type RetryPolicy struct {
+	// The minimum time to wait between retries. Defaults to 10 seconds.
+	MinBackoff time.Duration
+
+	// The maximum time to wait between retries. Defaults to 10 minutes.
+	MaxBackoff time.Duration
+
+	// MaxRetries is used to control deadletter queuing logic, when:
+	//   n == 0: A default value of 100 retries will be used
+	//   n > 0:  Encore will forward a message to a dead letter queue after n retries
+	//   n == pubsub.InfiniteRetries: Messages will not be forwarded to the dead letter queue by the Encore framework
+	MaxRetries int
+}
+
+const (
+	// NoRetries is used to control deadletter queuing logic, when set as the MaxRetires within the RetryPolicy
+	// it will attempt to immediately forward a message to the dead letter queue if the subscription Handler
+	// returns any error or panics.
+	//
+	// Note: With some cloud providers, having no retries may not be supported, in which case the minimum number of
+	// retries permitted by the provider will be used.
+	NoRetries = -2
+
+	// InfiniteRetries is used to control deadletter queuing logic, when set as the MaxRetires within the RetryPolicy
+	// it will attempt to always retry a message without ever sending it to the dead letter queue.
+	//
+	// Note: With some cloud providers, infinite retries may not be supported, in which case the maximum number of
+	// retries permitted by the provider will be used.
+	InfiniteRetries = -1
+)
+
+// DeliveryGuarantee is used to configure the delivery contract for a topic
+type DeliveryGuarantee int
+
+const (
+	// AtLeastOnce guarantees that a message for a subscription is delivered to
+	// a consumer at least once.
+	//
+	// On AWS and GCP there is no limit to the throughput for a topic.
+	AtLeastOnce DeliveryGuarantee = iota + 1
+
+	// ExactlyOnce guarantees that a message for a subscription is delivered to
+	// a consumer exactly once, to the best of the system's ability.
+	//
+	// However, there are edge cases when a message might be redelivered.
+	// For example, if a networking issue causes the acknowledgement of success
+	// processing the message to be lost before the cloud provider receives it.
+	//
+	// It is also important to note that the ExactlyOnce delivery guarantee only
+	// applies to the delivery of the message to the consumer, and not to the
+	// original publishing of the message, such that if a message is published twice,
+	// such as due to an retry within the application logic, it will be delivered twice.
+	// (i.e. ExactlyOnce delivery does not imply message deduplication on publish)
+	//
+	// As such it's recommended that the subscription handler function is idempotent
+	// and is able to handle duplicate messages.
+	//
+	// Subscriptions attached to ExactlyOnce topics have higher message delivery latency compared to AtLeastOnce.
+	//
+	// By using ExactlyOnce semantics on a topic, the throughput will be limited depending on the cloud provider:
+	//
+	// - AWS: 300 messages per second for the topic (see [AWS SQS Quotas]).
+	// - GCP: At least 3,000 messages per second across all topics in the region
+	// 		  (can be higher on the region see [GCP PubSub Quotas]).
+	//
+	// [AWS SQS Quotas]: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/quotas-messages.html
+	// [GCP PubSub Quotas]: https://cloud.google.com/pubsub/quotas#quotas
+	ExactlyOnce
+)
+
+// TopicConfig is used when creating a Topic
+type TopicConfig struct {
+	// DeliveryGuarantee is used to configure the delivery guarantee of a Topic
+	//
+	// This field is required.
+	DeliveryGuarantee DeliveryGuarantee
+
+	// OrderingAttribute is the message attribute to use as a ordering key for
+	// messages and delivery will ensure that messages with the same value will
+	// be delivered in the order they where published.
+	//
+	// If OrderingAttribute is not set, messages can be delivered in any order.
+	//
+	// It is important to note, that in the case of an error being returned by a
+	// subscription handler, the message will be retried before any subsequent
+	// messages for that ordering key are delivered. This means depending on the
+	// retry configuration, a large backlog of messages for a given ordering key
+	// may build up. When using OrderingAttribute, it is recommended to use reason
+	// about your failure modes and set the retry configuration appropriately.
+	//
+	// Once the maximum number of retries has been reached, the message will be
+	// forwarded to the dead letter queue, and the next message for that ordering
+	// key will be delivered.
+	//
+	// To create attributes on a message, use the `pubsub-attr` struct tag:
+	//
+	//	type UserEvent struct {
+	//		UserID string `pubsub-attr:"user-id"`
+	//		Action string
+	//	}
+	//
+	//  var topic = pubsub.NewTopic[UserEvent]("user-events", pubsub.TopicConfig{
+	// 		DeliveryGuarantee: pubsub.AtLeastOnce,
+	//		OrderingAttribute: "user-id", // Messages with the same user-id will be delivered in the order they where published
+	//	})
+	//
+	//  topic.Publish(ctx, &UserEvent{UserID: "1", Action: "login"})  // This message will be delivered before the logout
+	//  topic.Publish(ctx, &UserEvent{UserID: "2", Action: "login"})  // This could be delivered at any time because it has a different user id
+	//  topic.Publish(ctx, &UserEvent{UserID: "1", Action: "logout"}) // This message will be delivered after the first message
+	//
+	// By using OrderingAttribute, the throughput will be limited depending on the cloud provider:
+	//
+	// - AWS: 300 messages per second for the topic (see [AWS SQS Quotas]).
+	// - GCP: 1MB/s for each ordering key (see [GCP PubSub Quotas]).
+	//
+	// Note: OrderingAttribute currently has no effect during local development.
+	//
+	// [AWS SQS Quotas]: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/quotas-messages.html
+	// [GCP PubSub Quotas]: https://cloud.google.com/pubsub/quotas#resource_limits
+	OrderingAttribute string
+}
diff --git a/runtimes/go/pubsub/internal/types/push_registry.go b/runtimes/go/pubsub/internal/types/push_registry.go
new file mode 100644
index 0000000000..66c55c62e2
--- /dev/null
+++ b/runtimes/go/pubsub/internal/types/push_registry.go
@@ -0,0 +1,11 @@
+package types
+
+import "net/http"
+
+type SubscriptionID string
+
+type PushEndpointHandler func(req *http.Request) error
+
+type PushEndpointRegistry interface {
+	RegisterPushSubscriptionHandler(id SubscriptionID, handler http.HandlerFunc)
+}
diff --git a/runtimes/go/pubsub/internal/utils/contexts.go b/runtimes/go/pubsub/internal/utils/contexts.go
new file mode 100644
index 0000000000..434a65894a
--- /dev/null
+++ b/runtimes/go/pubsub/internal/utils/contexts.go
@@ -0,0 +1,49 @@
+package utils
+
+import (
+	"context"
+)
+
+// Contexts is a struct containing all the contexts used by the pubsub package
+type Contexts struct {
+	// Fetch is the context used for fetching messages from the pubsub provider
+	//
+	// It is cancelled when the manager is shutdown and is used to indicate that
+	// no more messages should be fetched from the provider.
+	//
+	// The fetch context is always the first context to be cancelled.
+	Fetch                 context.Context
+	StopFetchingNewEvents context.CancelFunc
+
+	// Handler is the context used for handling messages from the pubsub provider
+	//
+	// It is cancelled when the manager is told to stop any active handlers.
+	//
+	// If cancelled before the fetch context, it will also cancel the fetch context.
+	Handler       context.Context
+	CancelHandler context.CancelFunc
+
+	// Connection is the context used for the connection to the pubsub provider
+	//
+	// If cancelled, it will cancel both the fetch and handler contexts.
+	Connection       context.Context
+	CloseConnections context.CancelFunc
+}
+
+// NewContexts creates a new set of contexts for the pubsub package
+func NewContexts(base context.Context) *Contexts {
+	connection, cancelConnection := context.WithCancel(base)
+	handler, cancelHandler := context.WithCancel(connection)
+	fetch, cancelFetch := context.WithCancel(handler)
+
+	ctxs := &Contexts{
+		Fetch:                 fetch,
+		StopFetchingNewEvents: cancelFetch,
+		Handler:               handler,
+		CancelHandler:         cancelHandler,
+		Connection:            connection,
+		CloseConnections:      cancelConnection,
+	}
+
+	return ctxs
+}
diff --git a/runtimes/go/pubsub/internal/utils/utils.go b/runtimes/go/pubsub/internal/utils/utils.go
new file mode 100644
index 0000000000..7159e6e7e1
--- /dev/null
+++ b/runtimes/go/pubsub/internal/utils/utils.go
@@ -0,0 +1,258 @@
+package utils
+
+import (
+	"cmp"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"math"
+	"reflect"
+	"strconv"
+	"sync"
+	"time"
+
+	"encore.dev/beta/errs"
+	"encore.dev/pubsub/internal/types"
+)
+
+const AttrTag = "pubsub-attr"
+
+// UnmarshalMessage unmarshals a message into a struct. The message must be a JSON object.
+func UnmarshalMessage[T any](attrs map[string]string, data []byte) (msg T, err error) {
+	if err = json.Unmarshal(data, &msg); err != nil {
+		err = errs.B().Cause(err).Code(errs.InvalidArgument).Msg("failed to unmarshal message").Err()
+		return
+	}
+
+	if err = UnmarshalFields(attrs, &msg, AttrTag); err != nil {
+		err = errs.B().Cause(err).Code(errs.InvalidArgument).Msg("failed to unmarshal attributes").Err()
+		return
+	}
+
+	return
+}
+
+// MarshalFields creates a map[string]string of fields in `msg` tagged with `tag`. The name of the tag
+// will be used as map key, and values are converted to strings using fmt.Sprintf. Pointers will be dereferenced
+// and ignored if nil. Only basic types (bool, numeric, string) and pointers to those types are supported fields.
+// Fields without a tag will not be marshalled. `msg` must be a struct or pointer to a struct
+func MarshalFields[T any](msg T, tag string) (map[string]string, error) {
+	// Create a map to return
+	rtn := map[string]string{}
+	msgVal := reflect.ValueOf(msg)
+	// Dereference the input msg
+	for msgVal.Kind() == reflect.Ptr {
+		msgVal = msgVal.Elem()
+	}
+	// Only support structs, or pointers to structs
+	if msgVal.Kind() != reflect.Struct {
+		return nil, errors.New("pubsub messages must be structs or a pointer to struct")
+	}
+
+	// Iterate through the message fields and look for `tag` tags, marshal if found
+	for i := 0; i < msgVal.NumField(); i++ {
+		msgField := msgVal.Field(i)
+		if name, ok := msgVal.Type().Field(i).Tag.Lookup(tag); ok {
+			isNil := false
+			// We need to dereference pointers to get the value
+			for msgField.Kind() == reflect.Pointer {
+				// If it's a nil pointer we want to skip the field
+				if msgField.IsNil() {
+					isNil = true
+					break
+				}
+				msgField = msgField.Elem()
+			}
+			if isNil {
+				continue
+			}
+			// if the dereferenced type is not a basic type, return an error
+			if msgField.Kind() >= reflect.Array && msgField.Kind() != reflect.String {
+				return nil, errors.New(fmt.Sprintf("unsupported kind: %s", msgField.Kind()))
+			}
+			// serialize the value using string formatting
+			rtn[name] = fmt.Sprintf("%v", msgField.Interface())
+		}
+	}
+	return rtn, nil
+}
+
+var decodeCache = sync.Map{}
+
+// UnmarshalFields copies values from the attrs map to val the struct. The attrs key to copy the value from is
+// retrieved from the name of the field tag with key `tag`. The string value is parsed to the target type before
+// being assigned. Invalid values will return an error. Only basic types (bool, numeric, string) and pointers
+// to those types are supported fields. Fields without a tag will not be touched. `val` must be a pointer to a struct,
+// otherwise we cannot populate the fields
+func UnmarshalFields[T any](attrs map[string]string, val T, tag string) error {
+	v := reflect.ValueOf(val)
+	// target type must be a pointer for us to set fields
+	if v.Kind() != reflect.Pointer {
+		return errors.New("target must be a pointer to a struct")
+	}
+	// Dereference the pointer
+	for v.Kind() == reflect.Ptr {
+		v = v.Elem()
+	}
+	// We only support structs for now
+	if v.Kind() != reflect.Struct {
+		return errors.New(fmt.Sprintf("unsupported kind, fields can only be unmarshaled into a struct. Got a %s", v.Kind()))
+	}
+
+	// Loop through the fields of the struct and look for `tag`s
+	for i := 0; i < v.NumField(); i++ {
+		if name, ok := v.Type().Field(i).Tag.Lookup(tag); ok {
+			// If the attributes contain an element with the tag name, unmarshal it into target
+			if attrVal, ok := attrs[name]; ok {
+				dataField := v.Field(i)
+				dataType := dataField.Type()
+				ptrDepth := 0
+				// Dereference the type (we can't use the value here because it might be nil)
+				// Keep track of the pointer depth which is used later to create a pointer to
+				// the value
+				for ; dataType.Kind() == reflect.Ptr; ptrDepth++ {
+					dataType = dataType.Elem()
+				}
+
+				assigner, _ := decodeCache.LoadOrStore(dataType.Kind(), func() fieldAssigner {
+					// Parse and set the value. If the target type is a pointer, we need to
+					// create a pointer. We use the type specific setter (e.g. SetInt) to handle
+					// int bitsize conversions, and the generic setter (Set) to set pointers
+					switch dataType.Kind() {
+					case reflect.String:
+						return getFieldAssigner(
+							func(v string) (string, error) {
+								return v, nil
+							}, reflect.Value.SetString)
+					case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+						return getFieldAssigner(
+							func(v string) (int64, error) {
+								return strconv.ParseInt(v, 10, 64)
+							}, reflect.Value.SetInt)
+					case reflect.Float32, reflect.Float64:
+						return getFieldAssigner(
+							func(v string) (float64, error) {
+								return strconv.ParseFloat(v, 64)
+							}, reflect.Value.SetFloat)
+					case reflect.Bool:
+						return getFieldAssigner(
+							func(v string) (bool, error) {
+								return strconv.ParseBool(v)
+							}, reflect.Value.SetBool)
+					case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+						return getFieldAssigner(
+							func(v string) (uint64, error) {
+								return strconv.ParseUint(v, 10, 64)
+							}, reflect.Value.SetUint)
+					case reflect.Complex64, reflect.Complex128:
+						return getFieldAssigner(
+							func(v string) (complex128, error) {
+								return strconv.ParseComplex(v, 128)
+							}, reflect.Value.SetComplex)
+					default:
+						return func(val string, ptrDepth int, dataField reflect.Value) error {
+							return errors.New(fmt.Sprintf("unsupported kind: %s", dataField.Kind()))
+						}
+					}
+				}())
+				assignFunc := assigner.(fieldAssigner)
+				err := assignFunc(attrVal, ptrDepth, dataField)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+	return nil
+}
+
+type fieldAssigner = func(val string, ptrDepth int, dataField reflect.Value) error
+type valueSetter[T any] func(reflect.Value, T)
+type fieldParser[T any] func(string) (T, error)
+
+func getFieldAssigner[T any](parser fieldParser[T], setter valueSetter[T]) fieldAssigner {
+	return func(val string, ptrDepth int, dataField reflect.Value) error {
+		v, err := parser(val)
+		if err != nil {
+			return err
+		}
+		setValue(v, ptrDepth, dataField, setter)
+		return nil
+	}
+}
+
+// setValue assigns a value or a (nested) pointer to a value to f
+func setValue[T any](val T, ptrDepth int, f reflect.Value, valSetter func(reflect.Value, T)) {
+	// if the type is not a pointer, we can set the value directly on the field
+	if ptrDepth == 0 {
+		valSetter(f, val)
+	} else {
+		// otherwise we need to create a stack of `ptrDepth` pointers and assign val
+		// to a new value instance
+		root := f.Type()
+		// Find the dereferenced type
+		for root.Kind() == reflect.Pointer {
+			root = root.Elem()
+		}
+		// Create a new value of the dereferenced type (and dereference it)
+		rval := reflect.New(root).Elem()
+		// Set the content of the new Value
+		valSetter(rval, val)
+		// Wrap it in pointers and set the target field to the wrapped value
+		f.Set(pointify(rval, ptrDepth))
+	}
+}
+
+// pointify wraps a value in `ptrDepth` pointers
+func pointify(rval reflect.Value, ptrDepth int) reflect.Value {
+	for i := 0; i < ptrDepth; i++ {
+		v := reflect.New(rval.Type())
+		v.Elem().Set(rval)
+		rval = v
+	}
+	return rval
+}
+
+// GetDelay returns whether a message should be retried and if so the backoff duration based on the
+// configuration in the RetryPolicy
+func GetDelay(maxRetries int, minDelay, maxDelay time.Duration, attempt uint16) (shouldRetry bool, backoff time.Duration) {
+	if maxRetries == types.NoRetries || (int(attempt) > maxRetries && maxRetries != types.InfiniteRetries) {
+		// return the max delay here, so if we can't dead letter a message
+		// the could will at least apply the largest allowed backoff
+		return false, maxDelay
+	}
+	if maxDelay < minDelay {
+		return true, maxDelay
+	}
+	backoff = time.Duration( /**/ math.Max(float64(1*time.Second), float64(minDelay))) // backoff at least 1 second
+
+	for i := uint16(0); i < attempt; i++ {
+		backoff *= 2
+		if backoff > maxDelay {
+			return true, maxDelay
+		}
+	}
+	return true, backoff
+}
+
+// WithDefaultValue returns setValue if it is a non zero value, otherwise it returns defaultValue
+func WithDefaultValue[T comparable](setValue, defaultValue T) T {
+	var zeroValue T
+
+	if setValue == zeroValue {
+		return defaultValue
+	}
+
+	return setValue
+}
+
+// Clamp returns the value clamped to the range [min, max].
+func Clamp[T cmp.Ordered](d T, min T, max T) T {
+	if d < min {
+		return min
+	}
+	if d > max {
+		return max
+	}
+	return d
+}
diff --git a/runtimes/go/pubsub/internal/utils/utils_test.go b/runtimes/go/pubsub/internal/utils/utils_test.go
new file mode 100644
index 0000000000..ad90d236dc
--- /dev/null
+++ b/runtimes/go/pubsub/internal/utils/utils_test.go
@@ -0,0 +1,208 @@
+package utils
+
+import (
+	"fmt"
+	"reflect"
+	"runtime/debug"
+	"strconv"
+	"testing"
+	"time"
+)
+
+type EmbedStruct struct {
+	Val1 string
+	Val2 string
+}
+
+type TestStruct struct {
+	StringAttr    string    `pubsub-attr:"string"`
+	StringPtrAttr ***string `pubsub-attr:"stringptr"`
+	ComplexAttr   complex64 `pubsub-attr:"complex"`
+	UintAttr      uint8     `pubsub-attr:"uint"`
+	UintPtrAttr   *uint8    `pubsub-attr:"uintptr"`
+	Struct        EmbedStruct
+	String        string
+}
+
+func TestSetAttributes(t *testing.T) {
+	testStruct := TestStruct{}
+	err := UnmarshalFields(
+		map[string]string{
+			"string":    "stringval",
+			"stringptr": "stringptrval",
+			"uint":      "8",
+			"complex":   "(12+8i)",
+			"uintptr":   "88",
+		}, &testStruct, "pubsub-attr")
+	Assert(t, err, IsNil)
+	Assert(t, testStruct.StringAttr, Equals, "stringval")
+	Assert(t, testStruct.StringPtrAttr, DeepEquals, createTriplePointer("stringptrval"))
+	Assert(t, testStruct.UintAttr, Equals, uint8(8))
+	Assert(t, testStruct.ComplexAttr, Equals, complex64(12+8i))
+	Assert(t, testStruct.UintPtrAttr, DeepEquals, createPointer(uint8(88)))
+}
+
+type CheckType int
+
+const (
+	IsNil CheckType = iota
+	Equals
+	DeepEquals
+	LessThanEqual
+	IsTrue
+)
+
+func Assert(t *testing.T, val any, check CheckType, want ...any) {
+	switch check {
+	case IsNil:
+		if val != nil {
+			stack := debug.Stack()
+			t.Fatalf("%v is not nil\n%s", val, stack)
+		}
+	case Equals:
+		if fmt.Sprintf("%v", val) != fmt.Sprintf("%v", want[0]) {
+			stack := debug.Stack()
+			t.Fatalf("%v != %v\n%s", val, want[0], stack)
+		}
+	case DeepEquals:
+		derefVal := deref(val)
+		derefWant := deref(want[0])
+		if derefVal != derefWant {
+			stack := debug.Stack()
+			t.Fatalf("%v != %v\n%s", derefVal, derefWant, stack)
+		}
+	case LessThanEqual:
+		fVal, err1 := strconv.ParseFloat(fmt.Sprintf("%d", val), 64)
+		if err1 != nil {
+			stack := debug.Stack()
+			t.Fatalf("%v is not numeric\n%s", val, stack)
+		}
+		fWant, err2 := strconv.ParseFloat(fmt.Sprintf("%d", want[0]), 64)
+		if err2 != nil {
+			stack := debug.Stack()
+			t.Fatalf("%v is not numeric\n%s", want[0], stack)
+		}
+		if fVal > fWant {
+			stack := debug.Stack()
+			t.Fatalf("%v > %v\n%s", val, want[0], stack)
+		}
+	case IsTrue:
+		bVal, ok := val.(bool)
+		if !ok {
+			stack := debug.Stack()
+			t.Fatalf("%v is not a boolv\n%s", val, stack)
+		}
+		if !bVal {
+			stack := debug.Stack()
+			t.Fatalf("%v is not True\n%s", val, stack)
+		}
+	}
+}
+
+func deref(val interface{}) interface{} {
+	v := reflect.ValueOf(val)
+	for v.Kind() == reflect.Pointer {
+		v = v.Elem()
+	}
+	return v.Interface()
+}
+
+func createPointer[T any](val T) *T {
+	return &val
+}
+
+func createTriplePointer[T any](val T) ***T {
+	ptr := &val
+	ptr2 := &ptr
+	return &ptr2
+}
+
+func TestGetAttributes(t *testing.T) {
+	testStruct := &TestStruct{
+		StringAttr:    "stringattrval",
+		StringPtrAttr: createTriplePointer("stringptrval"),
+		UintAttr:      8,
+		UintPtrAttr:   createPointer(uint8(88)),
+		ComplexAttr:   12 + 8i,
+	}
+
+	attrs, err := MarshalFields(testStruct, "pubsub-attr")
+	Assert(t, err, IsNil)
+	Assert(t, attrs["string"], Equals, "stringattrval")
+	Assert(t, attrs["stringptr"], Equals, "stringptrval")
+	Assert(t, attrs["uint"], Equals, "8")
+	Assert(t, attrs["complex"], Equals, "(12+8i)")
+	Assert(t, attrs["uintptr"], Equals, "88")
+}
+
+const maxAttempt = 100
+
+func TestGetDelay(t *testing.T) {
+	tests := map[string]*struct {
+		MinRetryDelay time.Duration
+		MaxRetryDelay time.Duration
+		MaxRetries    int
+	}{
+		"limited retries": {
+			MinRetryDelay: 2 * time.Second,
+			MaxRetryDelay: 10 * time.Second,
+			MaxRetries:    15,
+		},
+		"unlimited retries": {
+			MinRetryDelay: 2 * time.Second,
+			MaxRetryDelay: 10 * time.Second,
+			MaxRetries:    -1,
+		},
+		"0 retries": {
+			MinRetryDelay: 2 * time.Second,
+			MaxRetryDelay: 10 * time.Second,
+			MaxRetries:    0,
+		},
+		"min > max": {
+			MinRetryDelay: 10 * time.Second,
+			MaxRetryDelay: 2 * time.Second,
+			MaxRetries:    10,
+		},
+		"min == max": {
+			MinRetryDelay: 10 * time.Second,
+			MaxRetryDelay: 10 * time.Second,
+			MaxRetries:    10,
+		},
+		"negative delay": {
+			MinRetryDelay: -10 * time.Second,
+			MaxRetryDelay: 10 * time.Second,
+			MaxRetries:    10,
+		},
+	}
+
+	for name, policy := range tests {
+		t.Run(name, func(t *testing.T) {
+			retry := true
+			attempt := uint16(0)
+			prevDelay := 0 * time.Second
+			for ; retry && attempt < maxAttempt; attempt++ {
+				var delay time.Duration
+				retry, delay = GetDelay(policy.MaxRetries, policy.MinRetryDelay, policy.MaxRetryDelay, attempt)
+				if !retry {
+					continue
+				}
+				Assert(t, delay > prevDelay || delay == policy.MaxRetryDelay, IsTrue)
+				if policy.MinRetryDelay > policy.MaxRetryDelay {
+					Assert(t, delay, Equals, policy.MaxRetryDelay)
+				} else if policy.MinRetryDelay < 1 && attempt == 0 {
+					Assert(t, delay, Equals, 1*time.Second)
+				} else if attempt == 0 {
+					Assert(t, delay, Equals, policy.MinRetryDelay)
+				}
+				Assert(t, delay, LessThanEqual, policy.MaxRetryDelay)
+				prevDelay = delay
+			}
+			if policy.MaxRetries == -1 {
+				Assert(t, attempt, Equals, maxAttempt)
+			} else {
+				Assert(t, attempt, Equals, policy.MaxRetries+2) // +2 as delivery attempts are not 0 index, they start at 1
+			}
+		})
+
+	}
+}
diff --git a/runtimes/go/pubsub/internal/utils/workers.go b/runtimes/go/pubsub/internal/utils/workers.go
new file mode 100644
index 0000000000..05945a5bf3
--- /dev/null
+++ b/runtimes/go/pubsub/internal/utils/workers.go
@@ -0,0 +1,274 @@
+package utils
+
+import (
+	"context"
+	"errors"
+	"sync/atomic"
+	"time"
+
+	"encore.dev/beta/errs"
+)
+
+const (
+	// Between work processors finishing a work item, how long we debounce before fetching more work
+	// (this is to avoid fetching work items in batches of 1)
+	workFetchDebounce = 25 * time.Millisecond
+
+	// What is the maximum amount of time we wait before fetching work items when debouncing
+	maxFetchDebounce = 250 * time.Millisecond
+
+	noWorkDebounce = 500 * time.Millisecond
+)
+
+// WorkFetcher is a function that fetches work from a queue, it should fetch at most maxToFetch items
+// and block until it has at least one item to return.
+type WorkFetcher[Work any] func(ctx context.Context, maxToFetch int) ([]Work, error)
+
+// WorkProcessor is a function that processes a single work item, it should block until the work item is processed
+type WorkProcessor[Work any] func(ctx context.Context, work Work) error
+
+// WorkConcurrently fetches work using the given fetch function and then passes it to the worker function
+//
+// It will fetch at most maxBatchSize items at a time and guarantees that at most maxConcurrency items have been fetched
+// and are being processed at any given time.
+//
+// If maxBatchSize >= 1, will fetch at most maxBatchSize items at a time
+// If maxBatchSize <= 0, will fetch as most maxConcurrency items at a time
+//
+// If maxConcurrency <= 0 then there is no limit on the number of items being processed at a time
+//
+// This function will block until an error is returned from either the fetcher or the worker functions or until
+// the context is cancelled.
+//
+// In the event of an error occurring, calls to worker will be allowed to continue in the background until the
+// context is cancelled however, this function will still return immediately with the error. Thus if you immediately call
+// this again you could end up with 2x maxConcurrency workers running at the same time. (1x from the original run who
+// are still processing work and 1x from the new run).
+func WorkConcurrently[Work any](ctxs *Contexts, maxConcurrency int, maxBatchSize int, fetch WorkFetcher[Work], worker WorkProcessor[Work]) error {
+	fetchWithPanicHandling := func(ctx context.Context, maxToFetch int) (work []Work, err error) {
+		defer func() {
+			if r := recover(); r != nil {
+				err = errs.B().Msgf("panic: %v", r).Err()
+			}
+		}()
+		return fetch(ctx, maxToFetch)
+	}
+
+	workWithPanicHandling := func(ctx context.Context, work Work) (err error) {
+		defer func() {
+			if r := recover(); r != nil {
+				err = errs.B().Msgf("panic: %v", r).Err()
+			}
+		}()
+		return worker(ctx, work)
+	}
+
+	if maxConcurrency == 1 {
+		// If there's no concurrency, we can just do everything synchronously within this goroutine
+		// This avoids the overhead of creating mutexes being used
+		return workInSingleRoutine(ctxs, fetchWithPanicHandling, workWithPanicHandling)
+
+	} else if maxConcurrency <= 0 {
+		// If there's infinite concurrency, we can just do everything by spawning goroutines
+		// for each work item
+		return workInInfiniteRoutines(ctxs, maxBatchSize, fetchWithPanicHandling, workWithPanicHandling)
+
+	} else {
+		// Else there's a cap on concurrency, we need to use channels to communicate between the fetcher and the workers
+		return workInWorkPool(ctxs, maxConcurrency, maxBatchSize, fetchWithPanicHandling, workWithPanicHandling)
+	}
+}
+
+func workInSingleRoutine[Work any](ctxs *Contexts, fetch func(ctx context.Context, maxToFetch int) (work []Work, err error), worker func(ctx context.Context, work Work) (err error)) error {
+	for {
+		// check if the context has been cancelled before fetching work
+		if err := ctxs.Fetch.Err(); err != nil {
+			return nil
+		}
+
+		// fetch 1 item
+		work, err := fetch(ctxs.Fetch, 1)
+		if err != nil {
+			return err
+		}
+
+		// loop over the items (we might get zero, and a buggy implementation might return more than 1, so a loop is safer)
+		for _, w := range work {
+			// check if the context has been cancelled before processing the work
+			if err := ctxs.Handler.Err(); err != nil {
+				return nil
+			}
+
+			// process the work
+			if err := worker(ctxs.Handler, w); err != nil {
+				return err
+			}
+		}
+	}
+}
+
+func workInInfiniteRoutines[Work any](ctxs *Contexts, maxBatchSize int, fetch func(ctx context.Context, maxToFetch int) (work []Work, err error), worker func(ctx context.Context, work Work) (err error)) error {
+	fetchCtx, cancel := context.WithCancelCause(ctxs.Fetch)
+	defer cancel(nil)
+
+	if maxBatchSize <= 0 {
+		maxBatchSize = 100
+	}
+
+	for fetchCtx.Err() == nil {
+		work, err := fetch(fetchCtx, maxBatchSize)
+		if err != nil {
+			cancel(err)
+			break
+		}
+
+		for _, w := range work {
+			w := w
+			go func() {
+				// the worker uses the parent context, such that if we have a fetch error, the existing workers will
+				// continue to run until they finish processing their work
+				if err := worker(ctxs.Handler, w); err != nil {
+					cancel(err)
+				}
+			}()
+		}
+	}
+
+	// Return the reason for cancellation if it wasn't due to the parent context being cancelled
+	cancelCause := context.Cause(fetchCtx)
+	if errors.Is(cancelCause, context.Canceled) {
+		return nil
+	}
+	return cancelCause
+}
+
+func workInWorkPool[Work any](ctxs *Contexts, maxConcurrency int, maxBatchSize int, doFetch func(ctx context.Context, maxToFetch int) (work []Work, err error), doProcessWork func(ctx context.Context, work Work) (err error)) error {
+	fetchCtx, cancelFetch := context.WithCancelCause(ctxs.Fetch)
+	defer cancelFetch(nil)
+
+	// workChan is a channel that is used to pass work from the fetcher to the workers
+	workChan := make(chan Work)
+	defer close(workChan) // close the channel when we're done so the workers know to stop
+
+	numWorkers := maxConcurrency
+
+	// workDone is a channel that is used to signal that a worker has finished processing an item
+	workDone := make(chan struct{})
+
+	var workItemsBeingProcessed atomic.Int64
+
+	// processWorkItem is a small wrapper around the worker function that tracks the number of items being processed
+	// and cancels the context if an error is returned
+	processWorkItem := func(work Work) {
+		workItemsBeingProcessed.Add(1)
+
+		defer func() {
+			// Decrement the number of items being processed.
+			// Note: it's important this happens BEFORE we
+			// try to unblock the fetcher, otherwise we can end up
+			// with a race where we unblock the fetcher but it doesn't
+			// find any work to do and deadlocks.
+			workItemsBeingProcessed.Add(-1)
+
+			// Attempt to unblock the fetcher if they're
+			// waiting for a work item to complete.
+			select {
+			case workDone <- struct{}{}:
+			default:
+			}
+		}()
+
+		// We use the parent context here, such that if we have a fetch error, the existing workers will
+		// continue to run until they finish processing any work already have started on
+		if err := doProcessWork(ctxs.Handler, work); err != nil {
+			cancelFetch(err)
+		}
+	}
+	worker := func() {
+		for work := range workChan {
+			processWorkItem(work)
+		}
+	}
+
+	// Start the workers
+	for i := 0; i < numWorkers; i++ {
+		go worker()
+	}
+
+	// spuriousWakeup is a ticker used to periodically wake the fetcher
+	// even in the absence of any work being completed. This is here
+	// because there's a (theoretical) race condition in the fetcher logic
+	// in cases where all the workers are busy:
+	//
+	//    1. The fetcher detects all workers are busy
+	//    2. Before getting to the select {} statement, all workers complete
+	//       their work, and fail to send on the workDone channel because
+	//       the fetcher isn't yet waiting on it.
+	//    3. The fetcher gets stuck waiting indefinitely for a work item to complete,
+	//       but there is no work being done.
+	//
+	// Guard against this by having a spurious periodic wakeup. In normal circumstances
+	// this won't ever be used.
+	spuriousWakeup := time.NewTicker(1 * time.Second)
+	defer spuriousWakeup.Stop()
+
+	// Start fetching work
+FetchLoop:
+	for fetchCtx.Err() == nil {
+		// Determine how many items to fetch
+		toFetch := maxConcurrency - int(workItemsBeingProcessed.Load())
+		if maxBatchSize > 0 && toFetch > maxBatchSize {
+			toFetch = maxBatchSize
+		}
+
+		if toFetch == 0 {
+			// All our workers are busy, so we can't fetch any more work right now.
+			// Wait until there's more work.
+			select {
+			case <-fetchCtx.Done():
+				// We're done; stop fetching.
+				break FetchLoop
+			case <-workDone:
+				// A work item has been completed. Wait for a little bit
+				// before we retry the loop to "debounce" and allow for a few
+				// more work items to complete so we can fetch bigger batches.
+				time.Sleep(workFetchDebounce)
+				continue FetchLoop
+			case <-spuriousWakeup.C:
+				// See comment on spuriousWakeup above for motivation.
+				continue FetchLoop
+			}
+		}
+
+		// We have some work to fetch.
+		work, err := doFetch(fetchCtx, toFetch)
+		if err != nil {
+			cancelFetch(err)
+			break FetchLoop
+		}
+
+		// If we didn't get any items, sleep before we try again
+		// to avoid hammering the server.
+		if len(work) == 0 {
+			time.Sleep(noWorkDebounce)
+			continue FetchLoop
+		}
+
+		// Pass the work to workers
+		for _, w := range work {
+			select {
+			case workChan <- w:
+				// success, we passed the work to a worker
+			case <-fetchCtx.Done():
+				break FetchLoop
+			}
+		}
+	}
+
+	// Return the reason for cancellation, unless it was due to the parent context being cancelled.
+	cause := context.Cause(fetchCtx)
+	if errors.Is(cause, context.Canceled) {
+		cause = nil
+	}
+	return cause
+}
diff --git a/runtimes/go/pubsub/internal/utils/workers_test.go b/runtimes/go/pubsub/internal/utils/workers_test.go
new file mode 100644
index 0000000000..5081b543c7
--- /dev/null
+++ b/runtimes/go/pubsub/internal/utils/workers_test.go
@@ -0,0 +1,310 @@
+package utils
+
+import (
+	"context"
+	"fmt"
+	"math/rand"
+	"slices"
+	"sort"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	qt "github.com/frankban/quicktest"
+)
+
+func TestWorkConcurrently(t *testing.T) {
+	t.Parallel()
+
+	params := []struct {
+		concurrency  int
+		maxBatchSize int
+		fetchErr     error
+		processErr   error
+	}{
+		// Simple concurrency tests
+		{1, 10, nil, nil},
+		{10, 10, nil, nil},
+		{50, 50, nil, nil},
+
+		// Test batch sizes
+		{50, 0, nil, nil}, // Unlimited batch size
+		{50, 1, nil, nil},
+		{50, 10, nil, nil},
+
+		// Unlimited concurrency
+		{-1, 0, nil, nil},  // No batch size and unlimited concurrency
+		{-1, 10, nil, nil}, // Unlimited concurrency, but a batch size
+
+		// Test errors
+		{50, 10, fmt.Errorf("fetch error"), nil},
+		{50, 10, nil, fmt.Errorf("process error")},
+	}
+
+	for _, tt := range params {
+		tt := tt
+		t.Run(fmt.Sprintf("c%d_b%d", tt.concurrency, tt.maxBatchSize), func(t *testing.T) {
+			t.Parallel()
+			c := qt.New(t)
+
+			// Create a context which will timeout the test
+			timeoutCtx, timeoutCancel := context.WithTimeout(context.Background(), 15*time.Second)
+			defer timeoutCancel()
+
+			// Then create a context which will cancel the work generator off that
+			// (which we use to break out of the work generator loop)
+			ctx, cancel := context.WithCancel(timeoutCtx)
+			defer cancel()
+
+			// The number of items we've generated
+			toGenerate := tt.concurrency * 3 // We want to generate enough work to fill the workers plus test other outcomes
+			if toGenerate <= 0 {
+				toGenerate = 2_000 // If we have unlimited concurrency, we need to generate a lot of work
+			}
+			toReturnFromFetcher := make([]int, toGenerate)
+			for i := 0; i < toGenerate; i++ {
+				toReturnFromFetcher[i] = i
+			}
+			type fetchReq struct {
+				toFetch     int
+				numReturned int
+			}
+			var fetchRequests []*fetchReq // We want to test that the fetcher is called the correct number of times
+
+			// We want to test that the concurrency is respected and the max concurrency is reached
+			// so this section setups a counter and max counter to track the number of active workers
+			var counterMu sync.Mutex
+			var activeWorkers int
+			var maxActiveWorkers int
+			incActiveWorkers := func() {
+				counterMu.Lock()
+				defer counterMu.Unlock()
+				activeWorkers++
+				if activeWorkers > maxActiveWorkers {
+					maxActiveWorkers = activeWorkers
+				}
+			}
+			decActiveWorkers := func() {
+				counterMu.Lock()
+				defer counterMu.Unlock()
+				activeWorkers--
+			}
+
+			// We want to test that all the work was received by the processor
+			// so we'll track the work received in a slice protected by a mutex
+			var workMu sync.Mutex
+			var receivedWork []int
+
+			// Create the fetcher function
+			fetcher := func(ctx context.Context, toFetch int) ([]int, error) {
+				// No work to fetch return nothing
+				if len(toReturnFromFetcher) == 0 {
+					return nil, nil
+				}
+
+				// record this fetch request
+				req := &fetchReq{
+					toFetch: toFetch,
+				}
+				fetchRequests = append(fetchRequests, req)
+
+				// One of the fetches should return no data
+				switch len(fetchRequests) {
+				case 2:
+					// simulate only one piece of data on fetch 1
+					toFetch = 1
+				case 3:
+					// simulate no data on fetch 2
+					time.Sleep(500 * time.Millisecond)
+					return nil, nil
+				case 4:
+					// simulate only half the data is available on fetch 3
+					toFetch = toFetch / 2
+				case 5:
+					// If we have a fetch error, return it on fetch 4
+					if tt.fetchErr != nil {
+						return nil, tt.fetchErr
+					}
+				}
+
+				if toFetch > len(toReturnFromFetcher) {
+					toFetch = len(toReturnFromFetcher)
+				}
+				rtn := make([]int, toFetch)
+				copy(rtn, toReturnFromFetcher[0:toFetch])
+				toReturnFromFetcher = toReturnFromFetcher[toFetch:]
+
+				// If we've generated enough work to fill the workers, cancel the context in a little bit
+				// giving time for the workers to process the work
+				if len(toReturnFromFetcher) == 0 {
+					go func() {
+						// Wait a little bit to give the workers time to process the work
+						// before cancelling the context as on a slow machine, the workers
+						// might not have started processing the work yet
+						time.Sleep(5 * time.Second)
+						cancel()
+					}()
+				}
+
+				req.numReturned = len(rtn)
+				return rtn, nil
+			}
+
+			// Create the processor function
+			processor := func(ctx context.Context, work int) error {
+				incActiveWorkers()
+				defer decActiveWorkers()
+
+				// simulate some work
+				time.Sleep(10 * time.Millisecond)
+
+				workMu.Lock()
+				defer workMu.Unlock()
+				receivedWork = append(receivedWork, work)
+
+				// If we have a process error, return it around half way through the work
+				if tt.processErr != nil && len(receivedWork) > (toGenerate/2) {
+					return tt.processErr
+				}
+
+				if len(receivedWork) == toGenerate {
+					// If we've received all the work, cancel the context
+					cancel()
+				}
+
+				return nil
+			}
+
+			err := WorkConcurrently(NewContexts(ctx), tt.concurrency, tt.maxBatchSize, fetcher, processor)
+
+			workMu.Lock()
+			defer workMu.Unlock()
+
+			// Run assertions on the exit conditions
+			c.Assert(timeoutCtx.Err(), qt.IsNil, qt.Commentf("test timed out - not all work was fetched within the timeout"))
+			switch {
+			case tt.fetchErr != nil:
+				c.Assert(err, qt.ErrorIs, tt.fetchErr, qt.Commentf("unexpected error from work concurrently"))
+				c.Assert(len(receivedWork) < toGenerate, qt.IsTrue, qt.Commentf("all the work was fetched even though there was a fetch error"))
+				return
+			case tt.processErr != nil:
+				c.Assert(err, qt.ErrorIs, tt.processErr, qt.Commentf("unexpected error from work concurrently"))
+				c.Assert(len(receivedWork) < toGenerate, qt.IsTrue, qt.Commentf("all the work was fetched even though there was a process error"))
+				return
+			default:
+				c.Assert(err, qt.IsNil, qt.Commentf("unexpected error from work concurrently"))
+			}
+
+			// Run assertions on the processed data
+			c.Assert(receivedWork, qt.HasLen, toGenerate, qt.Commentf("not all work was received/processed"))
+			if tt.concurrency > 0 {
+				c.Assert(maxActiveWorkers <= tt.concurrency, qt.IsTrue, qt.Commentf("max concurrency was not respected; reached %d workers", maxActiveWorkers))
+				c.Assert(maxActiveWorkers == tt.concurrency, qt.IsTrue, qt.Commentf("max concurrency was not reached; only got %d workers at one time", maxActiveWorkers))
+			}
+			sort.Ints(receivedWork)
+			for i, work := range receivedWork {
+				c.Assert(work, qt.Equals, i, qt.Commentf("unexpected work received (once sorted); expected %d, got %d", i, work))
+			}
+
+			// Run assertions on the fetch requests
+			maxBatchSize := tt.maxBatchSize
+			if maxBatchSize <= 0 || (maxBatchSize > tt.concurrency && tt.concurrency > 0) {
+				if tt.concurrency > 0 {
+					maxBatchSize = tt.concurrency
+				} else {
+					maxBatchSize = 100
+				}
+			}
+			c.Assert(fetchRequests[0].toFetch, qt.Equals, maxBatchSize, qt.Commentf("first fetch request was not the max batch size"))
+			c.Assert(fetchRequests[0].numReturned, qt.Equals, maxBatchSize, qt.Commentf("first fetch request did not return a full batch"))
+			for i, req := range fetchRequests {
+				c.Assert(req.toFetch, qt.Not(qt.Equals), 0, qt.Commentf("fetch request %d was 0", i))
+				c.Assert(req.toFetch <= maxBatchSize, qt.IsTrue, qt.Commentf("max batch size was not respected; requested %d items on fetch %d", req, i))
+				c.Assert(req.toFetch >= req.numReturned, qt.IsTrue, qt.Commentf("test function returned too many items"))
+			}
+		})
+	}
+}
+
+func TestWorkConcurrentlyLoad(t *testing.T) {
+	const load = 2000
+	allMessages := make([]string, load)
+	for i := 0; i < load; i++ {
+		allMessages[i] = fmt.Sprintf("msg %d", i)
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
+	defer cancel()
+
+	var err error
+
+	var (
+		numFetched        atomic.Int64
+		numProcessed      atomic.Int64
+		processedMessages sync.Map
+	)
+
+	const (
+		maxConcurrency = 25
+		maxBatchSize   = 10
+	)
+
+	for ctx.Err() == nil {
+		err = WorkConcurrently(NewContexts(ctx), maxConcurrency, maxBatchSize, func(ctx context.Context, numToFetch int) ([]string, error) {
+			// Introduce random behavior
+			switch rand.Intn(10) {
+			case 0:
+				panic("random panic")
+			case 1:
+				return nil, fmt.Errorf("random error")
+			}
+
+			// Determine which slice of messages we should fetch
+			end := numFetched.Add(int64(numToFetch))
+			start := end - int64(numToFetch)
+
+			if numToFetch < 0 {
+				panic(fmt.Sprintf("negative numToFetch: %d", numToFetch))
+			} else if numToFetch > maxBatchSize {
+				panic(fmt.Sprintf("numToFetch too large: %d", numToFetch))
+			}
+
+			// Clamp start and end to the bounds of the message slice
+			if start > load {
+				start = load
+			}
+			if end > load {
+				end = load
+			}
+
+			fetched := slices.Clone(allMessages[start:end])
+
+			// If we didn't find enough items to fetch, decrease the num fetched again.
+			if diff := numToFetch - len(fetched); diff > 0 {
+				numFetched.Add(-int64(diff))
+			}
+
+			return fetched, nil
+		}, func(ctx context.Context, work string) error {
+			processedMessages.Store(work, true)
+
+			if numProcessed.Add(1) == load {
+				cancel()
+			}
+			return nil
+		})
+
+		fmt.Printf("published %v / consumed %v / target %v / err %v\n",
+			numFetched.Load(), numProcessed.Load(), load, err)
+	}
+
+	if numProcessed.Load() != load {
+		t.Fatalf("expected %d processed items, got %d", load, numProcessed.Load())
+	}
+	for _, msg := range allMessages {
+		if _, ok := processedMessages.Load(msg); !ok {
+			t.Fatalf("message %q was not processed", msg)
+		}
+	}
+}
diff --git a/runtimes/go/pubsub/manager_internal.go b/runtimes/go/pubsub/manager_internal.go
new file mode 100644
index 0000000000..944d3f71d5
--- /dev/null
+++ b/runtimes/go/pubsub/manager_internal.go
@@ -0,0 +1,111 @@
+package pubsub
+
+import (
+	"context"
+	"net/http"
+	"sync"
+
+	jsoniter "github.com/json-iterator/go"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/appruntime/shared/testsupport"
+	"encore.dev/beta/errs"
+	"encore.dev/pubsub/internal/types"
+	"encore.dev/pubsub/internal/utils"
+)
+
+type Manager struct {
+	ctxs       *utils.Contexts
+	static     *config.Static
+	runtime    *config.Runtime
+	rt         *reqtrack.RequestTracker
+	ts         *testsupport.Manager
+	rootLogger zerolog.Logger
+	json       jsoniter.API
+	providers  []provider
+
+	publishCounter  uint64
+	pushHandlers    map[types.SubscriptionID]http.HandlerFunc
+	runningFetches  sync.WaitGroup
+	runningHandlers sync.WaitGroup
+}
+
+func NewManager(static *config.Static, runtime *config.Runtime, rt *reqtrack.RequestTracker,
+	ts *testsupport.Manager, rootLogger zerolog.Logger, json jsoniter.API) *Manager {
+	mgr := &Manager{
+		ctxs:         utils.NewContexts(context.Background()),
+		static:       static,
+		runtime:      runtime,
+		rt:           rt,
+		ts:           ts,
+		rootLogger:   rootLogger,
+		json:         json,
+		pushHandlers: make(map[types.SubscriptionID]http.HandlerFunc),
+	}
+
+	for _, p := range providerRegistry {
+		mgr.providers = append(mgr.providers, p(mgr))
+	}
+
+	return mgr
+}
+
+// Shutdown stops the manager from fetching new messages and processing them.
+func (mgr *Manager) Shutdown(p *shutdown.Process) error {
+	// Once it's time to force-close tasks, cancel the base context.
+	go func() {
+		<-p.ForceCloseTasks.Done()
+		mgr.ctxs.CancelHandler()
+	}()
+
+	p.Log.Trace().Msg("pubsub: stop fetching new events")
+
+	// Immediately fetching new events.
+	mgr.ctxs.StopFetchingNewEvents()
+	p.Log.Trace().Msg("pubsub: waiting on running fetches")
+	mgr.runningFetches.Wait()
+
+	// Wait for running handlers to finish.
+	mgr.runningHandlers.Wait()
+	p.MarkOutstandingPubSubMessagesCompleted()
+
+	// Finally, close all connections to the PubSub providers.
+	mgr.ctxs.CloseConnections()
+
+	return nil
+}
+
+type provider interface {
+	ProviderName() string
+	Matches(providerCfg *config.PubsubProvider) bool
+	NewTopic(providerCfg *config.PubsubProvider, staticCfg TopicConfig, runtimeCfg *config.PubsubTopic) types.TopicImplementation
+}
+
+var providerRegistry []func(*Manager) provider
+
+func registerProvider(p func(mgr *Manager) provider) {
+	providerRegistry = append(providerRegistry, p)
+}
+
+var _ types.PushEndpointRegistry = (*Manager)(nil)
+
+func (mgr *Manager) RegisterPushSubscriptionHandler(id types.SubscriptionID, handler http.HandlerFunc) {
+	mgr.pushHandlers[id] = handler
+}
+
+// HandlePubSubPush is an HTTP handler that accepts PubSub push HTTP requests
+// and routes them to the appropriate push handler.
+func (mgr *Manager) HandlePubSubPush(w http.ResponseWriter, req *http.Request, subscriptionID string) {
+	handler, found := mgr.pushHandlers[types.SubscriptionID(subscriptionID)]
+	if !found {
+		err := errs.B().Code(errs.NotFound).Msg("unknown pubsub subscription").Err()
+		mgr.rootLogger.Err(err).Str("subscription_id", subscriptionID).Msg("invalid PubSub push request")
+		errs.HTTPError(w, err)
+		return
+	}
+
+	handler(w, req)
+}
diff --git a/runtimes/go/pubsub/package.go b/runtimes/go/pubsub/package.go
new file mode 100644
index 0000000000..fbe6fff092
--- /dev/null
+++ b/runtimes/go/pubsub/package.go
@@ -0,0 +1,6 @@
+// Package pubsub provides Encore applications with the ability
+// to create Pub/Sub Topics and multiple Subscriptions on those
+// topics in a cloud-agnostic manner.
+//
+// For more information see https://encore.dev/docs/develop/pubsub
+package pubsub
diff --git a/runtimes/go/pubsub/pkgfn.go b/runtimes/go/pubsub/pkgfn.go
new file mode 100644
index 0000000000..38795a1938
--- /dev/null
+++ b/runtimes/go/pubsub/pkgfn.go
@@ -0,0 +1,41 @@
+//go:build encore_app
+
+package pubsub
+
+// NewTopic is used to declare a Topic. Encore will use static
+// analysis to identify Topics and automatically provision them
+// for you.
+//
+// A call to NewTopic can only be made when declaring a package level variable. Any
+// calls to this function made outside a package level variable declaration will result
+// in a compiler error.
+//
+// The topic name must be unique within an Encore application. Topic names must be defined
+// in kebab-case (lowercase alphanumerics and hyphen seperated). The topic name must start with a letter
+// and end with either a letter or number. It cannot be longer than 63 characters. Once created and deployed never
+// change the topic name. When refactoring the topic name must stay the same.
+// This allows for messages already on the topic to continue to be received after the refactored
+// code is deployed.
+//
+// Example:
+//
+//	 import "encore.dev/pubsub"
+//
+//	 type MyEvent struct {
+//	   Foo string
+//	 }
+//
+//	 var MyTopic = pubsub.NewTopic[*MyEvent]("my-topic", pubsub.TopicConfig{
+//	   DeliveryGuarantee: pubsub.AtLeastOnce,
+//	 })
+//
+//	//encore:api public
+//	func DoFoo(ctx context.Context) error {
+//	  msgID, err := MyTopic.Publish(ctx, &MyEvent{Foo: "bar"})
+//	  if err != nil { return err }
+//	  rlog.Info("foo published", "message_id", msgID)
+//	  return nil
+//	}
+func NewTopic[T any](name string, cfg TopicConfig) *Topic[T] {
+	return newTopic[T](Singleton, name, cfg)
+}
diff --git a/runtimes/go/pubsub/provider_aws.go b/runtimes/go/pubsub/provider_aws.go
new file mode 100644
index 0000000000..abcafbdf1b
--- /dev/null
+++ b/runtimes/go/pubsub/provider_aws.go
@@ -0,0 +1,11 @@
+//go:build !encore_no_aws
+
+package pubsub
+
+import "encore.dev/pubsub/internal/aws"
+
+func init() {
+	registerProvider(func(mgr *Manager) provider {
+		return aws.NewManager(mgr.ctxs)
+	})
+}
diff --git a/runtimes/go/pubsub/provider_azure.go b/runtimes/go/pubsub/provider_azure.go
new file mode 100644
index 0000000000..eeb3febf08
--- /dev/null
+++ b/runtimes/go/pubsub/provider_azure.go
@@ -0,0 +1,11 @@
+//go:build !encore_no_azure
+
+package pubsub
+
+import "encore.dev/pubsub/internal/azure"
+
+func init() {
+	registerProvider(func(mgr *Manager) provider {
+		return azure.NewManager(mgr.ctxs)
+	})
+}
diff --git a/runtimes/go/pubsub/provider_encorecloud.go b/runtimes/go/pubsub/provider_encorecloud.go
new file mode 100644
index 0000000000..2784295990
--- /dev/null
+++ b/runtimes/go/pubsub/provider_encorecloud.go
@@ -0,0 +1,13 @@
+//go:build !encore_no_encorecloud
+
+package pubsub
+
+import (
+	"encore.dev/pubsub/internal/encorecloud"
+)
+
+func init() {
+	registerProvider(func(mgr *Manager) provider {
+		return encorecloud.NewManager(mgr.ctxs, mgr.runtime, mgr)
+	})
+}
diff --git a/runtimes/go/pubsub/provider_gcp.go b/runtimes/go/pubsub/provider_gcp.go
new file mode 100644
index 0000000000..44629f5ff7
--- /dev/null
+++ b/runtimes/go/pubsub/provider_gcp.go
@@ -0,0 +1,13 @@
+//go:build !encore_no_gcp
+
+package pubsub
+
+import (
+	"encore.dev/pubsub/internal/gcp"
+)
+
+func init() {
+	registerProvider(func(mgr *Manager) provider {
+		return gcp.NewManager(mgr.ctxs, mgr.static, mgr.runtime, mgr)
+	})
+}
diff --git a/runtimes/go/pubsub/provider_nsq.go b/runtimes/go/pubsub/provider_nsq.go
new file mode 100644
index 0000000000..11703417ad
--- /dev/null
+++ b/runtimes/go/pubsub/provider_nsq.go
@@ -0,0 +1,13 @@
+//go:build !encore_no_local
+
+package pubsub
+
+import (
+	"encore.dev/pubsub/internal/nsq"
+)
+
+func init() {
+	registerProvider(func(mgr *Manager) provider {
+		return nsq.NewManager(mgr.ctxs, mgr.rt)
+	})
+}
diff --git a/runtimes/go/pubsub/refs.go b/runtimes/go/pubsub/refs.go
new file mode 100644
index 0000000000..cbb37ee3a1
--- /dev/null
+++ b/runtimes/go/pubsub/refs.go
@@ -0,0 +1,53 @@
+package pubsub
+
+import "context"
+
+// TopicPerms is the type constraint for all permission-declaring
+// interfaces that can be used with TopicRef.
+type TopicPerms[T any] interface {
+	Meta() TopicMeta
+}
+
+// Publisher is the interface for publishing messages to a topic.
+// It can be used in conjunction with [TopicRef] to declare
+// a reference that can publish messages to the topic.
+//
+// For example:
+//
+//	var MyTopic = pubsub.NewTopic[Msg](...)
+//	var ref = pubsub.TopicRef[pubsub.Publisher[Msg]](MyTopic)
+//
+// The ref object can then be used to publish messages and can be
+// passed around freely within the service, without being subject
+// to Encore's static analysis restrictions that apply to MyTopic.
+type Publisher[T any] interface {
+	// Publish publishes a message to the topic.
+	Publish(ctx context.Context, msg T) (id string, err error)
+
+	// Meta returns metadata about the topic.
+	Meta() TopicMeta
+}
+
+// TopicRef returns an interface reference to a topic,
+// that can be freely passed around within a service
+// without being subject to Encore's typical static analysis
+// restrictions that normally apply to *Topic objects.
+//
+// This works because using TopicRef effectively declares
+// which operations you want to be able to perform since the
+// type argument P must be a permission-declaring interface (TopicPerms[T]).
+//
+// The returned reference is scoped down to those permissions.
+//
+// For example:
+//
+//	var MyTopic = pubsub.NewTopic[Msg](...)
+//	var ref = pubsub.TopicRef[pubsub.Publisher[Msg]](MyTopic)
+//	// ref.Publish(...) can now be used to publish messages to MyTopic.
+func TopicRef[P TopicPerms[T], T any](topic *Topic[T]) P {
+	return any(topicRef[T]{Topic: topic}).(P)
+}
+
+type topicRef[T any] struct {
+	*Topic[T]
+}
diff --git a/runtimes/go/pubsub/subscription.go b/runtimes/go/pubsub/subscription.go
new file mode 100644
index 0000000000..51e2573147
--- /dev/null
+++ b/runtimes/go/pubsub/subscription.go
@@ -0,0 +1,333 @@
+package pubsub
+
+import (
+	"context"
+	"fmt"
+	"strconv"
+	"time"
+
+	jsoniter "github.com/json-iterator/go"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/appruntime/shared/cfgutil"
+	"encore.dev/beta/errs"
+	"encore.dev/pubsub/internal/noop"
+	"encore.dev/pubsub/internal/utils"
+)
+
+// Subscription represents a subscription to a Topic.
+type Subscription[T any] struct {
+	topic *Topic[T]
+	name  string
+	cfg   SubscriptionConfig[T]
+	mgr   *Manager
+}
+
+// NewSubscription is used to declare a Subscription to a topic. The passed in handler will be called
+// for each message published to the topic.
+//
+// A call to NewSubscription can only be made when declaring a package level variable. Any
+// calls to this function made outside a package level variable declaration will result
+// in a compiler error.
+//
+// The subscription name must be unique for that topic. Subscription names must be defined
+// in kebab-case (lowercase alphanumerics and hyphen separated). The subscription name must start with a letter
+// and end with either a letter or number. It cannot be longer than 63 characters.
+//
+// Once created and deployed never change the subscription name, or the topic name otherwise messages will be lost which
+// could be in flight.
+//
+// Example:
+//
+//		import "encore.dev/pubsub"
+//
+//		type MyEvent struct {
+//		  Foo string
+//		}
+//
+//		var MyTopic = pubsub.NewTopic[*MyEvent]("my-topic", pubsub.TopicConfig{
+//		  DeliveryGuarantee: pubsub.AtLeastOnce,
+//		})
+//
+//		var Subscription = pubsub.NewSubscription(MyTopic, "my-subscription", pubsub.SubscriptionConfig[*MyEvent]{
+//		  Handler:     HandleEvent,
+//		  RetryPolicy: &pubsub.RetryPolicy{MaxRetries: 10},
+//	      MaxConcurrency: 5,
+//		})
+//
+//		func HandleEvent(ctx context.Context, event *MyEvent) error {
+//		  rlog.Info("received foo")
+//		  return nil
+//		}
+func NewSubscription[T any](topic *Topic[T], name string, cfg SubscriptionConfig[T]) *Subscription[T] {
+	if topic.runtimeCfg == nil || topic.topic == nil || topic.mgr == nil {
+		panic("pubsub topic was not created using pubsub.NewTopic")
+	}
+
+	mgr := topic.mgr
+	if _, isNoop := topic.topic.(*noop.Topic); isNoop {
+		// no-op means no-op!
+		return &Subscription[T]{topic: topic, name: name, cfg: cfg, mgr: mgr}
+	}
+
+	// Set default config values for missing values
+	if cfg.RetryPolicy == nil {
+		cfg.RetryPolicy = &RetryPolicy{
+			MaxRetries: 100,
+		}
+	}
+	if cfg.RetryPolicy.MinBackoff < 0 {
+		panic("MinRetryDelay cannot be negative")
+	}
+	if cfg.RetryPolicy.MaxBackoff < 0 {
+		panic("MaxRetryDelay cannot be negative")
+	}
+	cfg.RetryPolicy.MinBackoff = utils.WithDefaultValue(cfg.RetryPolicy.MinBackoff, 10*time.Second)
+	cfg.RetryPolicy.MaxBackoff = utils.WithDefaultValue(cfg.RetryPolicy.MaxBackoff, 10*time.Minute)
+
+	if cfg.AckDeadline == 0 {
+		cfg.AckDeadline = 30 * time.Second
+	} else if cfg.AckDeadline < 0 {
+		panic("AckDeadline cannot be negative")
+	}
+
+	subscription, staticCfg, exists := topic.getSubscriptionConfig(name)
+	if !exists {
+		// Noop subscription
+		return &Subscription[T]{topic: topic, name: name, cfg: cfg, mgr: mgr}
+	}
+
+	// If the service isn't hosted, return a noop subscription.
+	if !cfgutil.IsHostedService(mgr.runtime, staticCfg.Service) {
+		return &Subscription[T]{topic: topic, name: name, cfg: cfg, mgr: mgr}
+	}
+
+	panicCatchWrapper := func(ctx context.Context, msg T) (err error) {
+		defer func() {
+			if err2 := recover(); err2 != nil {
+				err = errs.B().Code(errs.Internal).Msgf("subscriber panicked: %s", err2).Err()
+			}
+		}()
+
+		return cfg.Handler(ctx, msg)
+	}
+
+	log := mgr.rootLogger.With().
+		Str("service", staticCfg.Service).
+		Str("topic", topic.runtimeCfg.EncoreName).
+		Str("subscription", name).
+		Logger()
+
+	// Subscribe to the topic
+	topic.topic.Subscribe(&log, cfg.MaxConcurrency, cfg.AckDeadline, cfg.RetryPolicy, subscription, func(ctx context.Context, msgID string, publishTime time.Time, deliveryAttempt int, attrs map[string]string, data []byte) (err error) {
+		if ctx.Err() != nil {
+			return ctx.Err()
+		}
+		mgr.runningHandlers.Add(1)
+		defer mgr.runningHandlers.Done()
+
+		if !mgr.static.Testing {
+			// Under test we're already inside an operation
+			mgr.rt.BeginOperation()
+			defer mgr.rt.FinishOperation()
+		}
+
+		msg, err := utils.UnmarshalMessage[T](attrs, data)
+		if err != nil {
+			log.Err(err).Str("msg_id", msgID).Int("delivery_attempt", deliveryAttempt).Msg("failed to unmarshal message")
+			return errs.B().Code(errs.Internal).Cause(err).Msg("failed to unmarshal message").Err()
+		}
+
+		logCtx := log.With()
+
+		traceID, err := model.GenTraceID()
+		if err != nil {
+			log.Err(err).Str("msg_id", msgID).Int("delivery_attempt", deliveryAttempt).Msg("failed to generate trace id")
+			return errs.B().Code(errs.Internal).Cause(err).Msg("failed to generate trace id").Err()
+		} else if traceID != (model.TraceID{}) {
+			logCtx = logCtx.Str("trace_id", traceID.String())
+		}
+
+		spanID, err := model.GenSpanID()
+		if err != nil {
+			log.Err(err).Str("msg_id", msgID).Int("delivery_attempt", deliveryAttempt).Msg("failed to generate span id")
+			return errs.B().Code(errs.Internal).Cause(err).Msg("failed to generate span id").Err()
+		}
+
+		var parentTraceID model.TraceID
+		if parentTraceIDStr := attrs[parentTraceIDAttribute]; parentTraceIDStr != "" {
+			parentTraceID, err = model.ParseTraceID(parentTraceIDStr)
+			if err != nil {
+				log.Err(err).Str("msg_id", msgID).Int("delivery_attempt", deliveryAttempt).Msg("failed to parse parent trace id")
+			}
+		}
+
+		// Default to logging with the external correlation id if present
+		extCorrelationID := attrs[extCorrelationIDAttribute]
+		if extCorrelationID != "" {
+			logCtx = logCtx.Str("x_correlation_id", extCorrelationID)
+		} else if parentTraceID != (model.TraceID{}) {
+			logCtx = logCtx.Str("x_correlation_id", parentTraceID.String())
+		}
+
+		traced := false
+		if val, ok := attrs[parentSampledAttribute]; ok {
+			traced, _ = strconv.ParseBool(val)
+		} else {
+			traced = mgr.rt.SampleTrace()
+		}
+
+		// Start the request tracing span
+		req := &model.Request{
+			Type:             model.PubSubMessage,
+			TraceID:          traceID,
+			SpanID:           spanID,
+			ParentTraceID:    parentTraceID,
+			ExtCorrelationID: extCorrelationID,
+			Start:            time.Now(),
+			MsgData: &model.PubSubMsgData{
+				Service:        staticCfg.Service,
+				Topic:          topic.runtimeCfg.EncoreName,
+				Subscription:   subscription.EncoreName,
+				MessageID:      msgID,
+				Attempt:        deliveryAttempt,
+				Published:      publishTime,
+				DecodedPayload: msg,
+				Payload:        marshalParams(mgr.json, msg),
+			},
+			DefLoc: staticCfg.TraceIdx,
+			SvcNum: staticCfg.SvcNum,
+			Traced: traced,
+		}
+		reqLogger := logCtx.Logger()
+		req.Logger = &reqLogger
+
+		// Copy the previous request information over, if any
+		{
+			prev := mgr.rt.Current()
+			if prevReq := prev.Req; prevReq != nil {
+				// TODO(andre) is this correct, or should it be prevReq.SpanID?
+				// Maybe it doesn't matter since subscriptions are always root spans anyway.
+				req.ParentSpanID = prevReq.ParentSpanID
+
+				req.Test = prevReq.Test
+			}
+		}
+
+		mgr.rt.BeginRequest(req)
+		curr := mgr.rt.Current()
+		if curr.Trace != nil {
+			curr.Trace.PubsubMessageSpanStart(req, curr.Goctr)
+		}
+
+		err = panicCatchWrapper(ctx, msg)
+
+		if curr.Trace != nil {
+			resp := &model.Response{
+				Duration:   time.Since(req.Start),
+				Err:        err,
+				HTTPStatus: errs.HTTPStatus(err),
+			}
+			curr.Trace.PubsubMessageSpanEnd(trace2.PubsubMessageSpanEndParams{
+				EventParams: trace2.EventParams{
+					TraceID: req.TraceID,
+					SpanID:  req.SpanID,
+				},
+				Req:  req,
+				Resp: resp,
+			})
+		}
+		mgr.rt.FinishRequest(false)
+
+		return err
+	})
+
+	if !mgr.static.Testing {
+		// Log the subscription registration - unless we're in unit tests
+		log.Info().Msg("registered subscription")
+	}
+
+	return &Subscription[T]{topic: topic, name: name, cfg: cfg, mgr: mgr}
+}
+
+// SubscriptionMeta contains metadata about a subscription.
+// The fields should not be modified by the caller.
+// Additional fields may be added in the future.
+type SubscriptionMeta[T any] struct {
+	// Name is the name of the subscription, as provided in the constructor to NewSubscription.
+	Name string
+
+	// Config is the subscriptions's configuration.
+	Config SubscriptionConfig[T]
+
+	// Topic provides metadata about the topic it subscribes to.
+	Topic TopicMeta
+}
+
+// Meta returns metadata about the topic.
+func (t *Subscription[T]) Meta() SubscriptionMeta[T] {
+	return SubscriptionMeta[T]{
+		Name:   t.name,
+		Config: t.cfg,
+		Topic:  t.topic.Meta(),
+	}
+}
+
+// Config returns the subscription's configuration.
+// It must not be modified by the caller.
+func (s *Subscription[T]) Config() SubscriptionConfig[T] {
+	return s.cfg
+}
+
+func (t *Topic[T]) getSubscriptionConfig(name string) (cfg *config.PubsubSubscription, staticCfg *config.StaticPubsubSubscription, ok bool) {
+	if t.mgr.static.Testing {
+		// No subscriptions occur in testing
+		svcName, svcNum := t.mgr.ts.TestService()
+		return &config.PubsubSubscription{EncoreName: name}, &config.StaticPubsubSubscription{
+			Service: svcName,
+			SvcNum:  svcNum,
+		}, true
+	}
+
+	// Fetch the subscription configuration
+	subscription, ok := t.runtimeCfg.Subscriptions[name]
+	if !ok {
+		return nil, nil, false
+	}
+
+	staticCfg, ok = t.mgr.static.PubsubTopics[t.runtimeCfg.EncoreName].Subscriptions[name]
+	if !ok {
+		return nil, nil, false
+	}
+
+	return subscription, staticCfg, true
+}
+
+func marshalParams[Resp any](json jsoniter.API, resp Resp) []byte {
+	data, _ := json.Marshal(resp)
+	return data
+}
+
+// MethodHandler is used to define a subscription Handler that references a service struct method.
+//
+// Example Usage:
+//
+//	//encore:service
+//	type Service struct {}
+//
+//	func (s *Service) Method(ctx context.Context, msg *Event) error { /* ... */ }
+//
+//	var _ = pubsub.NewSubscription(Topic, "subscription-name", pubsub.SubscriptionConfig[*Event]{
+//		Handler: pubsub.MethodHandler((*MyService).MyMethod),
+//		// ...
+//	})
+func MethodHandler[T, SvcStruct any](handler func(s SvcStruct, ctx context.Context, msg T) error) func(ctx context.Context, msg T) error {
+	// The use of MethodHandler acts as a sentinel for the code generator,
+	// which replaces the call with some generated code to initialize the service struct.
+	// As such this function should never be called in practice.
+	return func(ctx context.Context, msg T) error {
+		return fmt.Errorf("pubsub.MethodHandler is not usable in this context")
+	}
+}
diff --git a/runtimes/go/pubsub/test_internal.go b/runtimes/go/pubsub/test_internal.go
new file mode 100644
index 0000000000..72378116aa
--- /dev/null
+++ b/runtimes/go/pubsub/test_internal.go
@@ -0,0 +1,21 @@
+package pubsub
+
+import (
+	"encore.dev/pubsub/internal/test"
+)
+
+// GetTestTopicInstance is an internal API for Encore. This function should
+// never be directly called as it is considered an unstable API and Encore
+// can change it at any time
+func GetTestTopicInstance[T any](topic *Topic[T]) any {
+	testTopic, ok := topic.topic.(*test.TestTopic[T])
+	if !ok {
+		panic("testTopic not called with a test topic")
+	}
+
+	req := topic.mgr.rt.Current().Req
+	if req == nil || req.Test == nil {
+		panic("testTopic called outside of test")
+	}
+	return testTopic.TestInstance(req.Test.Current)
+}
diff --git a/runtimes/go/pubsub/topic.go b/runtimes/go/pubsub/topic.go
new file mode 100644
index 0000000000..f10c7f4437
--- /dev/null
+++ b/runtimes/go/pubsub/topic.go
@@ -0,0 +1,202 @@
+package pubsub
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/beta/errs"
+	"encore.dev/internal/limiter"
+	"encore.dev/pubsub/internal/noop"
+	"encore.dev/pubsub/internal/test"
+	"encore.dev/pubsub/internal/types"
+	"encore.dev/pubsub/internal/utils"
+)
+
+// Topic presents a flow of events of type T from any number of publishers to
+// any number of subscribers.
+//
+// Each subscription will receive a copy of each message published to the topic.
+//
+// See NewTopic for more information on how to declare a Topic.
+type Topic[T any] struct {
+	mgr            *Manager
+	staticCfg      TopicConfig         // The config as defined in the applications source code
+	runtimeCfg     *config.PubsubTopic // The config for this running instance of the application
+	topic          types.TopicImplementation
+	publishLimiter limiter.Limiter
+}
+
+func newTopic[T any](mgr *Manager, name string, cfg TopicConfig) *Topic[T] {
+	if mgr.static.Testing {
+		return &Topic[T]{
+			staticCfg:      cfg,
+			mgr:            mgr,
+			runtimeCfg:     &config.PubsubTopic{EncoreName: name},
+			topic:          test.NewTopic[T](mgr.ts, name),
+			publishLimiter: limiter.New(nil), // Create a no-op limiter
+		}
+	}
+
+	// Look up the topic configuration
+	topic, ok := mgr.runtime.PubsubTopics[name]
+	if !ok {
+		// If we don't have a topic configuration for this topic, it means that the topic was not registered for this instance
+		// thus we should default to the noop implementation.
+		return &Topic[T]{
+			staticCfg:      cfg,
+			mgr:            mgr,
+			runtimeCfg:     &config.PubsubTopic{EncoreName: name},
+			topic:          &noop.Topic{},
+			publishLimiter: limiter.New(nil), // Create a no-op limiter
+		}
+	}
+
+	// Look up the server config
+	provider := mgr.runtime.PubsubProviders[topic.ProviderID]
+
+	tried := make([]string, 0, len(mgr.providers))
+	for _, p := range mgr.providers {
+		if p.Matches(provider) {
+			impl := p.NewTopic(provider, cfg, topic)
+			return &Topic[T]{
+				staticCfg:      cfg,
+				mgr:            mgr,
+				runtimeCfg:     topic,
+				topic:          impl,
+				publishLimiter: limiter.New(topic.Limiter),
+			}
+		}
+		tried = append(tried, p.ProviderName())
+	}
+
+	mgr.rootLogger.Fatal().Msgf("unsupported PubSub provider for server[%d], tried: %v",
+		topic.ProviderID, tried)
+	panic("unreachable")
+}
+
+// TopicMeta contains metadata about a topic.
+// The fields should not be modified by the caller.
+// Additional fields may be added in the future.
+type TopicMeta struct {
+	// Name is the name of the topic, as provided in the constructor to NewTopic.
+	Name string
+	// Config is the topic's configuration.
+	Config TopicConfig
+}
+
+// Meta returns metadata about the topic.
+func (t *Topic[T]) Meta() TopicMeta {
+	return TopicMeta{
+		Name:   t.runtimeCfg.EncoreName,
+		Config: t.staticCfg,
+	}
+}
+
+// Publish will publish a message to the topic and returns a unique message ID for the message.
+//
+// This function will not return until the message has been successfully accepted by the topic.
+//
+// If an error is returned, it is probable that the message failed to be published, however it is possible
+// that the message could still be received by subscriptions to the topic.
+func (t *Topic[T]) Publish(ctx context.Context, msg T) (id string, err error) {
+	if ctx.Err() != nil {
+		return "", ctx.Err()
+	}
+
+	if t.runtimeCfg == nil || t.topic == nil {
+		return "", errs.B().Code(errs.Unimplemented).Msg("pubsub topic was not created using pubsub.NewTopic").Err()
+	}
+
+	// Extract the message attributes
+	attrs, err := utils.MarshalFields(msg, utils.AttrTag)
+	if err != nil {
+		return "", errs.B().Cause(err).Code(errs.InvalidArgument).Msgf("failed to extract message attributes for topic %s", t.runtimeCfg.EncoreName).Err()
+	}
+
+	// Marshal the message to JSON
+	data, err := json.Marshal(msg)
+	if err != nil {
+		return "", errs.B().Cause(err).Code(errs.InvalidArgument).Msgf("failed to marshal message to JSON for topic %s", t.runtimeCfg.EncoreName).Err()
+	}
+
+	// Add the ordering attribute if it is set
+	var orderingKey string
+	if t.staticCfg.OrderingAttribute != "" {
+		value, found := attrs[t.staticCfg.OrderingAttribute]
+		if !found {
+			// This is checked statically, so this should never happen
+			return "", errs.B().Code(errs.InvalidArgument).Msgf("ordering attribute %s not found in message for topic %s", t.staticCfg.OrderingAttribute, t.runtimeCfg.EncoreName).Err()
+		}
+
+		if value == "" {
+			return "", errs.B().Code(errs.InvalidArgument).Msgf("ordering attribute %s cannot be an empty string for topic %s", t.staticCfg.OrderingAttribute, t.runtimeCfg.EncoreName).Err()
+		}
+
+		orderingKey = value
+	}
+
+	// Add the correlation ID to the attributes
+	if req := t.mgr.rt.Current().Req; req != nil {
+		// Pass our trace ID through, so the subscribers can mark their traces as children of this trace
+		if req.TraceID != (model.TraceID{}) {
+			attrs[parentTraceIDAttribute] = req.TraceID.String()
+		}
+
+		if req.ExtCorrelationID != "" {
+			// If we have a correlation ID from the request, use that
+			attrs[extCorrelationIDAttribute] = req.ExtCorrelationID
+		} else if req.TraceID != (model.TraceID{}) {
+			// Otherwise this is the first request in the event chain, so this trace ID becomes the correlation ID
+			attrs[extCorrelationIDAttribute] = req.TraceID.String()
+		}
+
+		attrs[parentSampledAttribute] = strconv.FormatBool(req.Traced)
+	}
+
+	// Start the trace span
+	curr := t.mgr.rt.Current()
+	var startEventID trace2.EventID
+	if curr.Req != nil && curr.Trace != nil {
+		startEventID = curr.Trace.PubsubPublishStart(trace2.PubsubPublishStartParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+			},
+			Topic:   t.runtimeCfg.EncoreName,
+			Message: data,
+			Stack:   stack.Build(1),
+		})
+	}
+
+	// Publish once the rate limiter allows it
+	if err = t.publishLimiter.Wait(ctx); err == nil {
+		// Publish to the clouds topic
+		id, err = t.topic.PublishMessage(ctx, orderingKey, attrs, data)
+	}
+
+	// End the trace span
+	if curr.Req != nil && curr.Trace != nil {
+		curr.Trace.PubsubPublishEnd(trace2.PubsubPublishEndParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+			},
+			StartID:   startEventID,
+			MessageID: id,
+			Err:       err,
+		})
+	}
+
+	if err != nil {
+		return "", errs.B().Cause(err).Code(errs.Unavailable).Msgf("failed to publish message to %s", t.runtimeCfg.EncoreName).Err()
+	}
+
+	return id, nil
+}
diff --git a/runtimes/go/pubsub/types.go b/runtimes/go/pubsub/types.go
new file mode 100644
index 0000000000..9c3f4ac2b4
--- /dev/null
+++ b/runtimes/go/pubsub/types.go
@@ -0,0 +1,111 @@
+package pubsub
+
+import (
+	"context"
+	"time"
+
+	"encore.dev/pubsub/internal/types"
+)
+
+// parentTraceIDAttribute is the attribute name we use to track request correlation IDs
+const parentTraceIDAttribute = "encore_parent_trace_id"
+
+// extCorrelationIDAttribute is the attribute name we use to track externally provided correlation IDs
+const extCorrelationIDAttribute = "encore_ext_correlation_id"
+
+// parentSampledAttribute is the attribute name for determining if the parent was sampled.
+const parentSampledAttribute = "encore_parent_sampled"
+
+// SubscriptionConfig is used when creating a subscription
+//
+// The values given here may be clamped to the supported values by
+// the target cloud. (i.e. ack deadline may be brought within the supported range
+// by the target cloud pubsub implementation).
+type SubscriptionConfig[T any] struct {
+	// Handler is the function which will be called to process a message
+	// sent on the topic.
+	//
+	// To reference a method on an [Encore service struct]
+	// you can use the [MethodHandler] function. For example:
+	//
+	//	Handler: pubsub.MethodHandler((*MyService).MyMethod)
+	//
+	// It is important for the Handler function to block and not return
+	// until all processing relating to the message has been completed.
+	//
+	// When the handler returns a nil error the message will be
+	// acknowledged (acked) from the topic, and should not be redelivered.
+	//
+	// When this function returns a non-nil error the message will be
+	// negatively acknowledged (nacked), which will cause a redelivery
+	// attempt to be made (unless the retry policy's MaxRetries has been reached).
+	//
+	// The ctx passed to the handler will be cancelled when
+	// the AckDeadline passes.
+	//
+	// This field is required.
+	//
+	// [Encore service struct]: https://encore.dev/docs/primitives/services-and-apis/service-structs
+	Handler func(ctx context.Context, msg T) error
+
+	// MaxConcurrency is the maximum number of messages which will be processed
+	// simultaneously per instance of the service for this subscription.
+	//
+	// Note that this is per instance of the service, so if your service has
+	// scaled to 10 instances and this is set to 10, then 100 messages could be
+	// processed simultaneously.
+	//
+	// If the value is negative, then there will be no limit on the number
+	// of messages processed simultaneously.
+	//
+	// Note: This is not supported by all cloud providers; specifically on GCP
+	// when using Cloud Run instances on a topic with at-least-once delivery, the
+	// subscription will be configured as a Push Subscription and will have an adaptive
+	// concurrency. See [GCP Push Delivery Rate].
+	//
+	// This setting also has no effect on Encore Cloud environments.
+	//
+	// If not set, it uses a reasonable default based on the cloud provider.
+	//
+	// [GCP Push Delivery Rate]: https://cloud.google.com/pubsub/docs/push#push_delivery_rate
+	MaxConcurrency int
+
+	// Filter is a boolean expression using =, !=, IN, &&
+	// It is used to filter which messages are forwarded from the
+	// topic to a subscription
+	// Filter string - Filters are not currently supported
+
+	// AckDeadline is the time a consumer has to process a message
+	// before it's returned to the subscription
+	//
+	// Default is 30 seconds, however the ack deadline must be at least
+	// 1 second.
+	AckDeadline time.Duration
+
+	// MessageRetention is how long an undelivered message is kept
+	// on the topic before it's purged
+	// Default is 7 days.
+	MessageRetention time.Duration
+
+	// RetryPolicy defines how a message should be retried when
+	// the subscriber returns an error
+	RetryPolicy *RetryPolicy
+}
+
+type RetryPolicy = types.RetryPolicy
+
+const (
+	NoRetries = types.NoRetries
+
+	InfiniteRetries = types.InfiniteRetries
+)
+
+type DeliveryGuarantee = types.DeliveryGuarantee
+
+const (
+	AtLeastOnce = types.AtLeastOnce
+
+	ExactlyOnce = types.ExactlyOnce
+)
+
+type TopicConfig = types.TopicConfig
diff --git a/runtimes/go/pubsub/zzz_singleton_internal.go b/runtimes/go/pubsub/zzz_singleton_internal.go
new file mode 100644
index 0000000000..bf0898df2a
--- /dev/null
+++ b/runtimes/go/pubsub/zzz_singleton_internal.go
@@ -0,0 +1,28 @@
+//go:build encore_app
+
+package pubsub
+
+import (
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/jsonapi"
+	"encore.dev/appruntime/shared/logging"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/appruntime/shared/testsupport"
+)
+
+// Initialize the singleton instance.
+// NOTE: This file is named zzz_singleton_internal.go so that
+// the init function is initialized after all the providers
+// have been registered.
+
+//publicapigen:drop
+var Singleton *Manager
+
+func init() {
+	Singleton = NewManager(
+		appconf.Static, appconf.Runtime, reqtrack.Singleton, testsupport.Singleton,
+		logging.RootLogger, jsonapi.Default,
+	)
+	shutdown.Singleton.RegisterShutdownHandler(Singleton.Shutdown)
+}
diff --git a/runtimes/go/request.go b/runtimes/go/request.go
new file mode 100644
index 0000000000..6bccf8feb6
--- /dev/null
+++ b/runtimes/go/request.go
@@ -0,0 +1,219 @@
+package encore
+
+import (
+	"net/http"
+	"reflect"
+	"slices"
+	"time"
+
+	"encore.dev/appruntime/exported/model"
+)
+
+var applicationStartTime = time.Now()
+
+// APIDesc describes the API endpoint being called.
+type APIDesc struct {
+	// RequestType specifies the type of the request payload,
+	// or nil if the endpoint has no request payload or is Raw.
+	RequestType reflect.Type
+
+	// ResponseType specifies the type of the response payload,
+	// or nil if the endpoint has no response payload or is Raw.
+	ResponseType reflect.Type
+
+	// Raw specifies whether the endpoint is a Raw endpoint.
+	Raw bool
+
+	// Tags describes what tags are attached to the endpoint.
+	Tags Tags
+}
+
+// Request provides metadata about how and why the currently running code was started.
+//
+// The current request can be returned by calling CurrentRequest()
+type Request struct {
+	Type    RequestType // What caused this request to start
+	Started time.Time   // What time the trigger occurred
+
+	// Trace contains the trace information for the current request.
+	Trace *TraceData
+
+	// APICall specific parameters.
+	// These will be empty for operations with a type not APICall
+	API        *APIDesc   // Metadata about the API endpoint being called
+	Service    string     // Which service is processing this request
+	Endpoint   string     // Which API endpoint is being called
+	Path       string     // What was the path made to the API server
+	PathParams PathParams // If there are path parameters, what are they?
+	Method     string     // What HTTP method was used
+
+	// Headers contains the request headers sent with the request, if any.
+	//
+	// It is currently empty for service-to-service API calls when the caller
+	// and callee are both running within the same process.
+	// This behavior may change in the future.
+	Headers http.Header
+
+	// PubSubMessage specific parameters.
+	// Message contains information about the PubSub message,
+	Message *MessageData
+
+	// Payload is the decoded request payload or Pub/Sub message payload,
+	// or nil if the API endpoint has no request payload or the endpoint is raw.
+	Payload any
+
+	// CronIdempotencyKey contains a unique id for a particular cron job execution
+	// if this request was triggered by a Cron Job.
+	//
+	// It can be used to uniquely identify a particular Cron Job execution event,
+	// and also serves as a way to distinguish between Cron Job-triggered requests
+	// and other requests.
+	//
+	// If the request was not triggered by a Cron Job the value is the empty string.
+	CronIdempotencyKey string
+}
+
+// TraceData describes the trace information for a request.
+type TraceData struct {
+	TraceID          string
+	SpanID           string
+	ParentTraceID    string // empty if no parent trace
+	ParentSpanID     string // empty if no parent span
+	ExtCorrelationID string // empty if no correlation id
+	Recorded         bool   // true if this trace is being recorded
+}
+
+// MessageData describes the request data for a Pub/Sub message.
+type MessageData struct {
+	// Service is the name of the service with the subscription.
+	Service string
+
+	// Topic is the name of the topic the message was published to.
+	Topic string
+
+	// Subscription is the name of the subscription the message was received on.
+	Subscription string
+
+	// ID is the unique ID of the message assigned by the messaging service.
+	// It is the same value returned by topic.Publish() and is the same
+	// across delivery attempts.
+	ID string
+
+	// Published is the time the message was first published.
+	Published time.Time
+
+	// DeliveryAttempt is a counter for how many times the messages
+	// has been attempted to be delivered.
+	DeliveryAttempt int
+}
+
+// RequestType describes how the currently running code was triggered
+type RequestType string
+
+const (
+	None          RequestType = "none"           // There was no external trigger which caused this code to run. Most likely it was triggered by a package level init function.
+	APICall       RequestType = "api-call"       // The code was triggered via an API call to a service
+	PubSubMessage RequestType = "pubsub-message" // The code was triggered by a PubSub subscriber
+)
+
+// PathParams contains the path parameters parsed from the request path.
+// The ordering of the parameters in the path will be maintained from the URL.
+type PathParams []PathParam
+
+// PathParam represents a parsed path parameter.
+type PathParam struct {
+	Name  string // the name of the path parameter, without leading ':' or '*'.
+	Value string // the parsed path parameter value.
+}
+
+// Get returns the value of the path parameter with the given name.
+// If no such parameter exists it reports "".
+func (p PathParams) Get(name string) string {
+	for _, param := range p {
+		if param.Name == name {
+			return param.Value
+		}
+	}
+
+	return ""
+}
+
+func (mgr *Manager) CurrentRequest() *Request {
+	req := mgr.rt.Current().Req
+	if req == nil {
+		return &Request{
+			Type:    None,
+			Started: applicationStartTime,
+		}
+	}
+
+	result := &Request{
+		Started: req.Start,
+		Trace: &TraceData{
+			TraceID:          req.TraceID.String(),
+			SpanID:           req.SpanID.String(),
+			ParentTraceID:    req.ParentTraceID.String(),
+			ParentSpanID:     req.ParentSpanID.String(),
+			ExtCorrelationID: req.ExtCorrelationID,
+			Recorded:         req.Traced,
+		},
+	}
+
+	switch req.Type {
+	case model.RPCCall, model.AuthHandler:
+		data := req.RPCData
+		desc := data.Desc
+
+		result.Type = APICall
+		result.Service = desc.Service
+		result.Endpoint = desc.Endpoint
+		result.Payload = data.TypedPayload
+
+		result.Path = data.Path
+		result.PathParams = make(PathParams, len(data.PathParams))
+		for i, param := range data.PathParams {
+			result.PathParams[i].Name = param.Name
+			result.PathParams[i].Value = param.Value
+		}
+		result.Method = data.HTTPMethod
+		result.Headers = data.RequestHeaders
+
+		result.API = &APIDesc{
+			RequestType:  desc.RequestType,
+			ResponseType: desc.ResponseType,
+			Raw:          desc.Raw,
+			Tags:         data.Desc.Tags,
+		}
+
+		if data.FromEncorePlatform {
+			result.CronIdempotencyKey = data.RequestHeaders.Get("X-Encore-Cron-Execution")
+		}
+
+	case model.PubSubMessage:
+		result.Type = PubSubMessage
+		result.Service = req.MsgData.Service
+		result.Payload = req.MsgData.DecodedPayload
+		result.Message = &MessageData{
+			Service:         req.MsgData.Service,
+			Topic:           req.MsgData.Topic,
+			Subscription:    req.MsgData.Subscription,
+			ID:              req.MsgData.MessageID,
+			Published:       req.MsgData.Published,
+			DeliveryAttempt: req.MsgData.Attempt,
+		}
+	}
+
+	return result
+}
+
+// Tags describes a set of tags an endpoint is tagged with,
+// without the "tag:" prefix.
+//
+// The ordering is unspecified.
+type Tags []string
+
+// Has reports whether the set contains the given tag.
+// The provided value should not contain the "tag:" prefix.
+func (tags Tags) Has(tag string) bool {
+	return slices.Contains(tags, tag)
+}
diff --git a/runtimes/go/rlog/pkgfn.go b/runtimes/go/rlog/pkgfn.go
new file mode 100644
index 0000000000..a5b986396d
--- /dev/null
+++ b/runtimes/go/rlog/pkgfn.go
@@ -0,0 +1,38 @@
+//go:build encore_app
+
+package rlog
+
+import "encore.dev/appruntime/shared/reqtrack"
+
+//publicapigen:drop
+var Singleton = NewManager(reqtrack.Singleton)
+
+// Debug logs a debug-level message.
+// The variadic key-value pairs are treated as they are in With.
+func Debug(msg string, keysAndValues ...any) {
+	Singleton.Debug(msg, keysAndValues...)
+}
+
+// Info logs an info-level message.
+// The variadic key-value pairs are treated as they are in With.
+func Info(msg string, keysAndValues ...any) {
+	Singleton.Info(msg, keysAndValues...)
+}
+
+// Warn logs a warn-level message.
+// The variadic key-value pairs are treated as they are in With.
+func Warn(msg string, keysAndValues ...any) {
+	Singleton.Warn(msg, keysAndValues...)
+}
+
+// Error logs an error-level message.
+// The variadic key-value pairs are treated as they are in With.
+func Error(msg string, keysAndValues ...any) {
+	Singleton.Error(msg, keysAndValues...)
+}
+
+// With adds a variadic number of fields to the logging context.
+// The keysAndValues must be pairs of string keys and arbitrary data.
+func With(keysAndValues ...any) Ctx {
+	return Singleton.With(keysAndValues...)
+}
diff --git a/runtimes/go/rlog/rlog.go b/runtimes/go/rlog/rlog.go
new file mode 100644
index 0000000000..cf98d26ae5
--- /dev/null
+++ b/runtimes/go/rlog/rlog.go
@@ -0,0 +1,295 @@
+// Package rlog provides a simple logging interface which is integrated with Encore's
+// inbuilt distributed tracing.
+//
+// For more information about logging inside Encore applications see https://encore.dev/docs/observability/logging.
+package rlog
+
+import (
+	"strings"
+	"time"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/types/uuid"
+)
+
+// InternalKeyPrefix is the prefix of log field keys that are reserved for
+// internal use only. Log fields starting with this value have an additional "x_"
+// prefix prepended to avoid interference with reserved names.
+//
+//publicapigen:drop
+const InternalKeyPrefix = "encore_"
+
+//publicapigen:drop
+type Manager struct {
+	rt *reqtrack.RequestTracker
+}
+
+//publicapigen:drop
+func NewManager(rt *reqtrack.RequestTracker) *Manager {
+	return &Manager{rt}
+}
+
+// Ctx holds additional logging context for use with the Infoc and family
+// of logging functions.
+type Ctx struct {
+	logger zerolog.Logger
+	mgr    *Manager
+	fields []any
+}
+
+func (l *Manager) Debug(msg string, keysAndValues ...any) {
+	fields := pairs(keysAndValues)
+	l.doLog(model.LevelDebug, l.rt.Logger().Debug(), msg, nil, fields)
+}
+
+func (l *Manager) Info(msg string, keysAndValues ...any) {
+	fields := pairs(keysAndValues)
+	l.doLog(model.LevelInfo, l.rt.Logger().Info(), msg, nil, fields)
+}
+
+func (l *Manager) Warn(msg string, keysAndValues ...any) {
+	fields := pairs(keysAndValues)
+	l.doLog(model.LevelWarn, l.rt.Logger().Warn(), msg, nil, fields)
+}
+
+func (l *Manager) Error(msg string, keysAndValues ...any) {
+	fields := pairs(keysAndValues)
+	l.doLog(model.LevelError, l.rt.Logger().Error(), msg, nil, fields)
+}
+
+func (l *Manager) With(keysAndValues ...any) Ctx {
+	ctx := l.rt.Logger().With()
+	fields := pairs(keysAndValues)
+	for i := 0; i < len(fields); i += 2 {
+		key := fields[i].(string)
+		val := fields[i+1]
+		ctx = addContext(ctx, key, val)
+	}
+	return Ctx{logger: ctx.Logger(), mgr: l, fields: fields}
+}
+
+// Debug logs a debug-level message, merging the context from ctx
+// with the additional context provided as key-value pairs.
+// The variadic key-value pairs are treated as they are in With.
+func (ctx Ctx) Debug(msg string, keysAndValues ...any) {
+	l := ctx.logger
+	fields := pairs(keysAndValues)
+	ctx.mgr.doLog(model.LevelDebug, l.Debug(), msg, ctx.fields, fields)
+}
+
+// Info logs an info-level message, merging the context from ctx
+// with the additional context provided as key-value pairs.
+// The variadic key-value pairs are treated as they are in With.
+func (ctx Ctx) Info(msg string, keysAndValues ...any) {
+	l := ctx.logger
+	fields := pairs(keysAndValues)
+	ctx.mgr.doLog(model.LevelInfo, l.Info(), msg, ctx.fields, fields)
+}
+
+// Warn logs a warn-level message, merging the context from ctx
+// with the additional context provided as key-value pairs.
+// The variadic key-value pairs are treated as they are in With.
+func (ctx Ctx) Warn(msg string, keysAndValues ...any) {
+	l := ctx.logger
+	fields := pairs(keysAndValues)
+	ctx.mgr.doLog(model.LevelWarn, l.Warn(), msg, ctx.fields, fields)
+}
+
+// Error logs an error-level message, merging the context from ctx
+// with the additional context provided as key-value pairs.
+// The variadic key-value pairs are treated as they are in With.
+func (ctx Ctx) Error(msg string, keysAndValues ...any) {
+	l := ctx.logger
+	fields := pairs(keysAndValues)
+	ctx.mgr.doLog(model.LevelError, l.Error(), msg, ctx.fields, fields)
+}
+
+// With creates a new logging context that inherits the context
+// from the original ctx and adds additional context on top.
+// The original ctx is not affected.
+func (ctx Ctx) With(keysAndValues ...any) Ctx {
+	c := ctx.logger.With()
+	fields := pairs(keysAndValues)
+	for i := 0; i < len(fields); i += 2 {
+		key := fields[i].(string)
+		val := fields[i+1]
+		c = addContext(c, key, val)
+	}
+
+	newFields := make([]any, len(ctx.fields)+len(fields))
+	copy(newFields, ctx.fields)
+	copy(newFields[len(ctx.fields):], fields)
+
+	return Ctx{logger: c.Logger(), mgr: ctx.mgr, fields: newFields}
+}
+
+func (l *Manager) doLog(level model.LogLevel, ev *zerolog.Event, msg string, ctxFields, logFields []any) {
+	var (
+		tp     trace2.LogMessageParams
+		traced bool
+	)
+	curr := l.rt.Current()
+	numFields := len(ctxFields)/2 + len(logFields)/2
+
+	if curr.Req != nil && curr.Trace != nil {
+		traced = true
+		tp = trace2.LogMessageParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+			},
+			Level:  level,
+			Msg:    msg,
+			Stack:  stack.Build(3),
+			Fields: make([]trace2.LogField, 0, numFields),
+		}
+
+		for i := 0; i < len(ctxFields); i += 2 {
+			key := ctxFields[i].(string)
+			val := ctxFields[i+1]
+			tp.Fields = append(tp.Fields, trace2.LogField{Key: key, Value: val})
+		}
+	}
+
+	for i := 0; i < len(logFields); i += 2 {
+		key := logFields[i].(string)
+		val := logFields[i+1]
+		addEventEntry(ev, key, val)
+		if traced {
+			tp.Fields = append(tp.Fields, trace2.LogField{Key: key, Value: val})
+		}
+	}
+
+	ev.Msg(msg)
+
+	if traced {
+		curr.Trace.LogMessage(tp)
+	}
+}
+
+func addEventEntry(ev *zerolog.Event, key string, val any) {
+	if reserved(key) {
+		key = "x_" + key
+	}
+
+	switch val := val.(type) {
+	case error:
+		ev.AnErr(key, val)
+	case string:
+		ev.Str(key, val)
+	case bool:
+		ev.Bool(key, val)
+
+	case time.Time:
+		ev.Time(key, val)
+	case time.Duration:
+		ev.Dur(key, val)
+	case uuid.UUID:
+		ev.Str(key, val.String())
+
+	default:
+		ev.Interface(key, val)
+
+	case int8:
+		ev.Int8(key, val)
+	case int16:
+		ev.Int16(key, val)
+	case int32:
+		ev.Int32(key, val)
+	case int64:
+		ev.Int64(key, val)
+	case int:
+		ev.Int(key, val)
+
+	case uint8:
+		ev.Uint8(key, val)
+	case uint16:
+		ev.Uint16(key, val)
+	case uint32:
+		ev.Uint32(key, val)
+	case uint64:
+		ev.Uint64(key, val)
+	case uint:
+		ev.Uint(key, val)
+
+	case float32:
+		ev.Float32(key, val)
+	case float64:
+		ev.Float64(key, val)
+	}
+}
+
+func addContext(ctx zerolog.Context, key string, val any) zerolog.Context {
+	if reserved(key) {
+		key = "x_" + key
+	}
+
+	switch val := val.(type) {
+	case error:
+		return ctx.AnErr(key, val)
+	case string:
+		return ctx.Str(key, val)
+	case bool:
+		return ctx.Bool(key, val)
+
+	case time.Time:
+		return ctx.Time(key, val)
+	case time.Duration:
+		return ctx.Dur(key, val)
+	case uuid.UUID:
+		return ctx.Str(key, val.String())
+
+	default:
+		return ctx.Interface(key, val)
+
+	case int8:
+		return ctx.Int8(key, val)
+	case int16:
+		return ctx.Int16(key, val)
+	case int32:
+		return ctx.Int32(key, val)
+	case int64:
+		return ctx.Int64(key, val)
+	case int:
+		return ctx.Int(key, val)
+
+	case uint8:
+		return ctx.Uint8(key, val)
+	case uint16:
+		return ctx.Uint16(key, val)
+	case uint32:
+		return ctx.Uint32(key, val)
+	case uint64:
+		return ctx.Uint64(key, val)
+	case uint:
+		return ctx.Uint(key, val)
+
+	case float32:
+		return ctx.Float32(key, val)
+	case float64:
+		return ctx.Float64(key, val)
+	}
+}
+
+func reserved(key string) bool {
+	return strings.HasPrefix(key, InternalKeyPrefix)
+}
+
+// pairs ensures the key-values are in pairs.
+// It drops the last entry if there's an odd number of entries.
+func pairs(keysAndValues []any) []any {
+	fields := keysAndValues
+	num := len(fields)
+	if num%2 == 1 {
+		// Odd number of key-values, drop the last one
+		num--
+		fields = fields[:num]
+	}
+	return fields
+}
diff --git a/runtimes/go/rlog/rlog_test.go b/runtimes/go/rlog/rlog_test.go
new file mode 100644
index 0000000000..97e8a2dde7
--- /dev/null
+++ b/runtimes/go/rlog/rlog_test.go
@@ -0,0 +1,59 @@
+package rlog
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/rs/zerolog"
+)
+
+func TestReserveEncoreKey(t *testing.T) {
+	testCases := []struct {
+		Key  string
+		Want string
+	}{
+		{
+			Key: "key",
+			Want: `{"level":"info","key":"value"}
+`,
+		},
+		{
+			Key: "encore_key",
+			Want: `{"level":"info","x_encore_key":"value"}
+`,
+		},
+		{
+			Key: "encorekey",
+			Want: `{"level":"info","encorekey":"value"}
+`,
+		},
+	}
+	for _, testCase := range testCases {
+		testCase := testCase
+		t.Run(testCase.Key, func(t *testing.T) {
+			t.Parallel()
+
+			var buf bytes.Buffer
+			logger := zerolog.New(&buf)
+			ev := logger.Info()
+			addEventEntry(ev, testCase.Key, "value")
+			ev.Send()
+			actual := buf.String()
+			if actual != testCase.Want {
+				t.Fatalf("\nwant:\n\t%q\ngot:\n\t%q\n", testCase.Want, actual)
+			}
+		})
+		t.Run(testCase.Key, func(t *testing.T) {
+			t.Parallel()
+
+			var buf bytes.Buffer
+			logger := zerolog.New(&buf)
+			logger = addContext(logger.With(), testCase.Key, "value").Logger()
+			logger.Info().Send()
+			actual := buf.String()
+			if actual != testCase.Want {
+				t.Fatalf("\nwant:\n\t%q\ngot:\n\t%q\n", testCase.Want, actual)
+			}
+		})
+	}
+}
diff --git a/runtimes/go/shutdown/shutdown.go b/runtimes/go/shutdown/shutdown.go
new file mode 100644
index 0000000000..b4b42efb9b
--- /dev/null
+++ b/runtimes/go/shutdown/shutdown.go
@@ -0,0 +1,93 @@
+package shutdown
+
+import "context"
+
+// Progress provides progress information about an ongoing graceful shutdown process.
+//
+// The process broadly consists of two phases:
+//
+// 1. Drain active tasks
+//
+// As soon as the graceful shutdown process is initiated, the service will stop accepting new
+// incoming API calls and Pub/Sub messages. It will continue to process already running tasks
+// until they complete (or the ForceCloseTasks deadline is reached).
+//
+// Additionally, all service structs that implement [Handler] will have their [Handler.Shutdown]
+// function called when this phase begins. The [Handler.Shutdown] method receives a [Progress]
+// struct that can be used to monitor the progress of the shutdown process, and allows the service
+// to perform any necessary cleanup at the right time.
+//
+// This phase continues until all active tasks and handlers have completed or the ForceCloseTasks deadline
+// is reached, whichever happens first. The OutstandingRequests, OutstandingPubSubMessages, and
+// OutstandingTasks contexts provide insight into what tasks are still active.
+//
+// 2. Shut down infrastructure resources
+//
+// When all active tasks and [Handler.Shutdown] calls have completed, Encore begins shutting down
+// infrastructure resources. Encore automatically closes all open database connections, cache connections,
+// Pub/Sub connections, and other infrastructure resources.
+//
+// This phase continues until all infrastructure resources have been closed or the ForceShutdown deadline
+// is reached, whichever happens first.
+//
+// 3. Exit
+//
+// Once phase two has completed, the process will exit.
+// The exit code is 0 if the graceful shutdown completed successfully (meaning all resources
+// returned before the exit deadline), or 1 otherwise.
+type Progress struct {
+	// OutstandingRequests is canceled when the service is no longer processing any incoming API calls.
+	OutstandingRequests context.Context
+
+	// OutstandingPubSubMessages is canceled when the service is no longer processing any Pub/Sub messages.
+	OutstandingPubSubMessages context.Context
+
+	// ForceCloseTasks is canceled when the graceful shutdown deadline is reached and it's time to
+	// forcibly close active tasks (outstanding incoming API requests and Pub/Sub subscription messages).
+	//
+	// When ForceCloseTasks is closed, the contexts for all outstanding tasks are canceled.
+	//
+	// It is canceled early if all active tasks are done.
+	ForceCloseTasks context.Context
+
+	// OutstandingTasks is canceled when the service is no longer actively processing any tasks,
+	// which includes both incoming API calls and Pub/Sub messages.
+	//
+	// It is canceled as soon as both OutstandingRequests and OutstandingPubSubMessages have been canceled.
+	OutstandingTasks context.Context
+
+	// ForceShutdown is closed when the graceful shutdown window has closed and it's time to
+	// forcefully shut down.
+	//
+	// If the graceful shutdown window lapses before the cooperative shutdown is complete,
+	// the ForceShutdown channel may be closed before RunningHandlers is canceled.
+	//
+	// It is canceled early if all running tasks have completed, all infrastructure resources are closed,
+	// and all registered service Handler.Shutdown methods have returned.
+	ForceShutdown context.Context
+}
+
+// Handler is the interface for resources that participate in the graceful shutdown process.
+type Handler interface {
+	// Shutdown is called by Encore when the graceful shutdown process is initiated.
+	//
+	// The provided Progress struct provides information about the graceful shutdown progress,
+	// which can be used to determine at what point in time it's appropriate to close certain resources.
+	//
+	// For example, a service struct may want to wait for all incoming requests to complete
+	// before it closes its client to a third-party service:
+	//
+	// 			func (s *MyService) Shutdown(p *shutdown.Progress) error {
+	//				<-p.OutstandingRequests.Done()
+	//				return s.client.Close()
+	//			}
+	//
+	// The shutdown process is cooperative (to the extent it is possible),
+	// and Encore will wait for all Handlers to return before closing
+	// infrastructure resources and exiting the process,
+	// until the ForceShutdown deadline is reached.
+	//
+	// The return value of Shutdown is used to report shutdown errors only,
+	// and has no effect on the shutdown process.
+	Shutdown(Progress) error
+}
diff --git a/runtimes/go/storage/cache/basic.go b/runtimes/go/storage/cache/basic.go
new file mode 100644
index 0000000000..b1b2156afb
--- /dev/null
+++ b/runtimes/go/storage/cache/basic.go
@@ -0,0 +1,651 @@
+package cache
+
+import (
+	"context"
+	"errors"
+	"strconv"
+	"time"
+
+	"github.com/go-redis/redis/v8"
+)
+
+// NewStringKeyspace creates a keyspace that stores string values in the given cluster.
+//
+// The type parameter K specifies the key type, which can either be a
+// named struct type or a basic type (string, int, etc).
+func NewStringKeyspace[K any](cluster *Cluster, cfg KeyspaceConfig) *StringKeyspace[K] {
+	fromRedis := func(val string) (string, error) { return val, nil }
+	toRedis := func(val string) (any, error) { return val, nil }
+
+	return &StringKeyspace[K]{
+		&basicKeyspace[K, string]{
+			newClient[K, string](cluster, cfg, fromRedis, toRedis),
+		},
+	}
+}
+
+// StringKeyspace represents a set of cache keys that hold string values.
+type StringKeyspace[K any] struct {
+	*basicKeyspace[K, string]
+}
+
+// Get gets the value stored at key.
+// If the key does not exist, it returns an error matching Miss.
+//
+// See https://redis.io/commands/get/ for more information.
+func (s *StringKeyspace[K]) Get(ctx context.Context, key K) (string, error) {
+	return s.basicKeyspace.Get(ctx, key)
+}
+
+// Set updates the value stored at key to val.
+//
+// See https://redis.io/commands/set/ for more information.
+func (s *StringKeyspace[K]) Set(ctx context.Context, key K, val string) error {
+	return s.basicKeyspace.Set(ctx, key, val)
+}
+
+// SetIfNotExists sets the value stored at key to val, but only if the key does not exist beforehand.
+// If the key already exists, it reports an error matching KeyExists.
+//
+// See https://redis.io/commands/setnx/ for more information.
+func (s *StringKeyspace[K]) SetIfNotExists(ctx context.Context, key K, val string) error {
+	return s.basicKeyspace.SetIfNotExists(ctx, key, val)
+}
+
+// Replace replaces the existing value stored at key to val.
+// If the key does not already exist, it reports an error matching Miss.
+//
+// See https://redis.io/commands/set/ for more information.
+func (s *StringKeyspace[K]) Replace(ctx context.Context, key K, val string) error {
+	return s.basicKeyspace.Replace(ctx, key, val)
+}
+
+// GetAndSet updates the value of key to val and returns the previously stored value.
+// If the key does not already exist, it sets it and returns "", nil.
+//
+// See https://redis.io/commands/getset/ for more information.
+func (s *StringKeyspace[K]) GetAndSet(ctx context.Context, key K, val string) (oldVal string, err error) {
+	return s.basicKeyspace.GetAndSet(ctx, key, val)
+}
+
+// GetAndDelete deletes the key and returns the previously stored value.
+// If the key does not already exist, it does nothing and returns "", nil.
+//
+// See https://redis.io/commands/getdel/ for more information.
+func (s *StringKeyspace[K]) GetAndDelete(ctx context.Context, key K) (oldVal string, err error) {
+	return s.basicKeyspace.GetAndDelete(ctx, key)
+}
+
+// Delete deletes the specified keys.
+//
+// If a key does not exist it is ignored.
+//
+// It reports the number of keys that were deleted.
+//
+// See https://redis.io/commands/del/ for more information.
+func (s *StringKeyspace[K]) Delete(ctx context.Context, keys ...K) (deleted int, err error) {
+	return s.client.Delete(ctx, keys...)
+}
+
+// With returns a reference to the same keyspace but with customized write options.
+// The primary use case is for overriding the expiration time for certain cache operations.
+//
+// It is intended to be used with method chaining:
+//
+//	myKeyspace.With(cache.ExpireIn(3 * time.Second)).Set(...)
+func (k *StringKeyspace[K]) With(opts ...WriteOption) *StringKeyspace[K] {
+	return &StringKeyspace[K]{k.with(opts)}
+}
+
+// Append appends to the string with the given key.
+//
+// If the key does not exist it is first created and set as the empty string,
+// causing Append to behave like Set.
+//
+// It returns the new string length.
+//
+// See https://redis.io/commands/append/ for more information.
+func (s *StringKeyspace[K]) Append(ctx context.Context, key K, val string) (newLen int64, err error) {
+	const op = "append"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := do(s.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.Append(ctx, k, val)
+	}).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// GetRange returns a substring of the string value stored in key.
+//
+// The from and to values are zero-based indices, but unlike Go slicing
+// the 'to' value is inclusive.
+//
+// Negative values can be used in order to provide an offset starting
+// from the end of the string, so -1 means the last character
+// and -len(str) the first character, and so forth.
+//
+// If the string does not exist it returns the empty string.
+//
+// See https://redis.io/commands/setrange/ for more information.
+func (s *StringKeyspace[K]) GetRange(ctx context.Context, key K, from, to int64) (val string, err error) {
+	const op = "get range"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return "", err
+	}
+
+	res, err := s.client.redis.GetRange(ctx, k, from, to).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// SetRange overwrites part of the string stored at key, starting at
+// the zero-based offset and for the entire length of val, extending
+// the string if necessary to make room for val.
+//
+// If the offset is larger than the current string length stored at key,
+// the string is first padded with zero-bytes to make offset fit.
+//
+// Non-existing keys are considered as empty strings.
+//
+// See https://redis.io/commands/setrange/ for more information.
+func (s *StringKeyspace[K]) SetRange(ctx context.Context, key K, offset int64, val string) (newLen int64, err error) {
+	const op = "set range"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := do[K, string, *redis.IntCmd](s.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.SetRange(ctx, k, offset, val)
+	}).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// Len reports the length of the string value stored at key.
+//
+// Non-existing keys are considered as empty strings.
+//
+// See https://redis.io/commands/strlen/ for more information.
+func (s *StringKeyspace[K]) Len(ctx context.Context, key K) (length int64, err error) {
+	const op = "len"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := s.client.redis.StrLen(ctx, k).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// NewIntKeyspace creates a keyspace that stores int64 values in the given cluster.
+//
+// The type parameter K specifies the key type, which can either be a
+// named struct type or a basic type (string, int, etc).
+func NewIntKeyspace[K any](cluster *Cluster, cfg KeyspaceConfig) *IntKeyspace[K] {
+	fromRedis := func(val string) (int64, error) { return strconv.ParseInt(val, 10, 64) }
+	toRedis := func(val int64) (any, error) { return val, nil }
+
+	return &IntKeyspace[K]{
+		&basicKeyspace[K, int64]{
+			newClient[K, int64](cluster, cfg, fromRedis, toRedis),
+		},
+	}
+}
+
+// IntKeyspace is a cache keyspace that stores int64 values.
+type IntKeyspace[K any] struct {
+	*basicKeyspace[K, int64]
+}
+
+// With returns a reference to the same keyspace but with customized write options.
+// The primary use case is for overriding the expiration time for certain cache operations.
+//
+// It is intended to be used with method chaining:
+//
+//	myKeyspace.With(cache.ExpireIn(3 * time.Second)).Set(...)
+func (k *IntKeyspace[K]) With(opts ...WriteOption) *IntKeyspace[K] {
+	return &IntKeyspace[K]{k.basicKeyspace.with(opts)}
+}
+
+// Get gets the value stored at key.
+// If the key does not exist, it returns an error matching Miss.
+//
+// See https://redis.io/commands/get/ for more information.
+func (s *IntKeyspace[K]) Get(ctx context.Context, key K) (int64, error) {
+	return s.basicKeyspace.Get(ctx, key)
+}
+
+// Set updates the value stored at key to val.
+//
+// See https://redis.io/commands/set/ for more information.
+func (s *IntKeyspace[K]) Set(ctx context.Context, key K, val int64) error {
+	return s.basicKeyspace.Set(ctx, key, val)
+}
+
+// SetIfNotExists sets the value stored at key to val, but only if the key does not exist beforehand.
+// If the key already exists, it reports an error matching KeyExists.
+//
+// See https://redis.io/commands/setnx/ for more information.
+func (s *IntKeyspace[K]) SetIfNotExists(ctx context.Context, key K, val int64) error {
+	return s.basicKeyspace.SetIfNotExists(ctx, key, val)
+}
+
+// Replace replaces the existing value stored at key to val.
+// If the key does not already exist, it reports an error matching Miss.
+//
+// See https://redis.io/commands/set/ for more information.
+func (s *IntKeyspace[K]) Replace(ctx context.Context, key K, val int64) error {
+	return s.basicKeyspace.Replace(ctx, key, val)
+}
+
+// GetAndSet updates the value of key to val and returns the previously stored value.
+// If the key does not already exist, it sets it and returns 0, nil.
+//
+// See https://redis.io/commands/getset/ for more information.
+func (s *IntKeyspace[K]) GetAndSet(ctx context.Context, key K, val int64) (oldVal int64, err error) {
+	return s.basicKeyspace.GetAndSet(ctx, key, val)
+}
+
+// GetAndDelete deletes the key and returns the previously stored value.
+// If the key does not already exist, it does nothing and returns 0, nil.
+//
+// See https://redis.io/commands/getdel/ for more information.
+func (s *IntKeyspace[K]) GetAndDelete(ctx context.Context, key K) (oldVal int64, err error) {
+	return s.basicKeyspace.GetAndDelete(ctx, key)
+}
+
+// Delete deletes the specified keys.
+//
+// If a key does not exist it is ignored.
+//
+// It reports the number of keys that were deleted.
+//
+// See https://redis.io/commands/del/ for more information.
+func (s *IntKeyspace[K]) Delete(ctx context.Context, keys ...K) (deleted int, err error) {
+	return s.client.Delete(ctx, keys...)
+}
+
+// Increment increments the number stored in key by delta,
+// and returns the new value.
+//
+// If the key does not exist it is first created with a value of 0
+// before incrementing.
+//
+// Negative values can be used to decrease the value,
+// but typically you want to use the Decrement method for that.
+//
+// See https://redis.io/commands/incrby/ for more information.
+func (s *IntKeyspace[K]) Increment(ctx context.Context, key K, delta int64) (newVal int64, err error) {
+	const op = "increment"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := do(s.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.IncrBy(ctx, k, delta)
+	}).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// Decrement decrements the number stored in key by delta,
+// and returns the new value.
+//
+// If the key does not exist it is first created with a value of 0
+// before decrementing.
+//
+// Negative values can be used to increase the value,
+// but typically you want to use the Increment method for that.
+//
+// See https://redis.io/commands/decrby/ for more information.
+func (s *IntKeyspace[K]) Decrement(ctx context.Context, key K, delta int64) (newVal int64, err error) {
+	const op = "decrement"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := do(s.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.DecrBy(ctx, k, delta)
+	}).Result()
+
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// NewFloatKeyspace creates a keyspace that stores float64 values in the given cluster.
+//
+// The type parameter K specifies the key type, which can either be a
+// named struct type or a basic type (string, int, etc).
+func NewFloatKeyspace[K any](cluster *Cluster, cfg KeyspaceConfig) *FloatKeyspace[K] {
+	fromRedis := func(val string) (float64, error) { return strconv.ParseFloat(val, 64) }
+	toRedis := func(val float64) (any, error) { return val, nil }
+
+	return &FloatKeyspace[K]{
+		&basicKeyspace[K, float64]{
+			newClient[K, float64](cluster, cfg, fromRedis, toRedis),
+		},
+	}
+}
+
+// FloatKeyspace is a cache keyspace that stores float64 values.
+type FloatKeyspace[K any] struct {
+	*basicKeyspace[K, float64]
+}
+
+// With returns a reference to the same keyspace but with customized write options.
+// The primary use case is for overriding the expiration time for certain cache operations.
+//
+// It is intended to be used with method chaining:
+//
+//	myKeyspace.With(cache.ExpireIn(3 * time.Second)).Set(...)
+func (k *FloatKeyspace[K]) With(opts ...WriteOption) *FloatKeyspace[K] {
+	return &FloatKeyspace[K]{k.basicKeyspace.with(opts)}
+}
+
+// Get gets the value stored at key.
+// If the key does not exist, it returns an error matching Miss.
+//
+// See https://redis.io/commands/get/ for more information.
+func (s *FloatKeyspace[K]) Get(ctx context.Context, key K) (float64, error) {
+	return s.basicKeyspace.Get(ctx, key)
+}
+
+// Set updates the value stored at key to val.
+//
+// See https://redis.io/commands/set/ for more information.
+func (s *FloatKeyspace[K]) Set(ctx context.Context, key K, val float64) error {
+	return s.basicKeyspace.Set(ctx, key, val)
+}
+
+// SetIfNotExists sets the value stored at key to val, but only if the key does not exist beforehand.
+// If the key already exists, it reports an error matching KeyExists.
+//
+// See https://redis.io/commands/setnx/ for more information.
+func (s *FloatKeyspace[K]) SetIfNotExists(ctx context.Context, key K, val float64) error {
+	return s.basicKeyspace.SetIfNotExists(ctx, key, val)
+}
+
+// Replace replaces the existing value stored at key to val.
+// If the key does not already exist, it reports an error matching Miss.
+//
+// See https://redis.io/commands/set/ for more information.
+func (s *FloatKeyspace[K]) Replace(ctx context.Context, key K, val float64) error {
+	return s.basicKeyspace.Replace(ctx, key, val)
+}
+
+// GetAndSet updates the value of key to val and returns the previously stored value.
+// If the key does not already exist, it sets it and returns 0, nil.
+//
+// See https://redis.io/commands/getset/ for more information.
+func (s *FloatKeyspace[K]) GetAndSet(ctx context.Context, key K, val float64) (oldVal float64, err error) {
+	return s.basicKeyspace.GetAndSet(ctx, key, val)
+}
+
+// GetAndDelete deletes the key and returns the previously stored value.
+// If the key does not already exist, it does nothing and returns 0, nil.
+//
+// See https://redis.io/commands/getdel/ for more information.
+func (s *FloatKeyspace[K]) GetAndDelete(ctx context.Context, key K) (oldVal float64, err error) {
+	return s.basicKeyspace.GetAndDelete(ctx, key)
+}
+
+// Delete deletes the specified keys.
+//
+// If a key does not exist it is ignored.
+//
+// It reports the number of keys that were deleted.
+//
+// See https://redis.io/commands/del/ for more information.
+func (s *FloatKeyspace[K]) Delete(ctx context.Context, keys ...K) (deleted int, err error) {
+	return s.client.Delete(ctx, keys...)
+}
+
+// Increment increments the number stored in key by delta,
+// and returns the new value.
+//
+// If the key does not exist it is first created with a value of 0
+// before incrementing.
+//
+// Negative values can be used to decrease the value,
+// but typically you want to use the Decrement method for that.
+//
+// See https://redis.io/commands/incrbyfloat/ for more information.
+func (s *FloatKeyspace[K]) Increment(ctx context.Context, key K, delta float64) (newVal float64, err error) {
+	const op = "increment"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := do[K, float64, *redis.FloatCmd](s.client, ctx, k, func(c cmdable) *redis.FloatCmd {
+		return c.IncrByFloat(ctx, k, delta)
+	}).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// Decrement decrements the number stored in key by delta,
+// and returns the new value.
+//
+// If the key does not exist it is first created with a value of 0
+// before decrementing.
+//
+// Negative values can be used to increase the value,
+// but typically you want to use the Increment method for that.
+//
+// See https://redis.io/commands/incrbyfloat/ for more information.
+func (s *FloatKeyspace[K]) Decrement(ctx context.Context, key K, delta float64) (newVal float64, err error) {
+	const op = "decrement"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := do[K, float64, *redis.FloatCmd](s.client, ctx, k, func(c cmdable) *redis.FloatCmd {
+		return c.IncrByFloat(ctx, k, -delta)
+	}).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+type basicKeyspace[K, V any] struct {
+	*client[K, V]
+}
+
+func (s *basicKeyspace[K, V]) with(opts []WriteOption) *basicKeyspace[K, V] {
+	return &basicKeyspace[K, V]{s.client.with(opts)}
+}
+
+func (s *basicKeyspace[K, V]) Get(ctx context.Context, key K) (val V, err error) {
+	const op = "get"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return val, err
+	}
+
+	res, err := s.redis.Get(ctx, k).Result()
+	if err == nil {
+		val, err = s.fromRedis(res)
+	}
+	err = toErr(err, op, k)
+	return val, err
+}
+
+func (s *basicKeyspace[K, V]) Set(ctx context.Context, key K, val V) error {
+	_, _, err := s.set(ctx, key, val, 0, "set")
+	return err
+}
+
+func (s *basicKeyspace[K, V]) SetIfNotExists(ctx context.Context, key K, val V) error {
+	const op = "set if not exists"
+	_, _, err := s.set(ctx, key, val, setNX, op)
+	return err
+}
+
+func (s *basicKeyspace[K, V]) Replace(ctx context.Context, key K, val V) error {
+	_, _, err := s.set(ctx, key, val, setXX, "replace")
+	return err
+}
+
+func (s *basicKeyspace[K, V]) GetAndSet(ctx context.Context, key K, val V) (prev V, err error) {
+	const op = "get and set"
+	res, k, err := s.set(ctx, key, val, setGet, op)
+	if err == nil {
+		val, err = s.fromRedis(res)
+		err = toErr(err, op, k)
+	}
+	return val, err
+}
+
+func (s *basicKeyspace[K, V]) GetAndDelete(ctx context.Context, key K) (val V, err error) {
+	const op = "get and delete"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return val, err
+	}
+
+	// When deleting we don't need to deal with expiry
+	res, err := s.redis.GetDel(ctx, k).Result()
+	if err == nil {
+		val, err = s.fromRedis(res)
+	}
+	err = toErr(err, op, k)
+	return val, err
+}
+
+func (s *client[K, V]) Delete(ctx context.Context, keys ...K) (deleted int, err error) {
+	const op = "delete"
+	ks, err := s.keys(keys, op)
+	endTrace := s.doTrace(op, true, ks...)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	var firstKey string
+	if len(ks) > 0 {
+		firstKey = ks[0]
+	}
+
+	// When deleting we don't need to deal with expiry
+	res, err := s.redis.Del(ctx, ks...).Result()
+	err = toErr(err, op, firstKey)
+	return int(res), err
+}
+
+type setFlag uint8
+
+const (
+	setGet setFlag = 1 << iota
+	setNX
+	setXX
+)
+
+func (s *basicKeyspace[K, V]) set(ctx context.Context, key K, val V, flag setFlag, op string) (strVal, k string, err error) {
+	k, err = s.key(key, op)
+	if err != nil {
+		return "", "", err
+	}
+
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+
+	get := (flag & setGet) == setGet
+	nx := (flag & setNX) == setNX
+	xx := (flag & setXX) == setXX
+
+	if nx {
+		// If this is a setNX, convert Miss to KeyExists.
+		defer func() {
+			if errors.Is(err, Miss) {
+				err = toErr(KeyExists, op, k)
+			}
+		}()
+	}
+
+	redisVal, err := s.toRedis(val)
+	if err != nil {
+		return "", k, toErr(err, op, k)
+	}
+
+	args := make([]any, 3, 7)
+	args[0] = "set"
+	args[1] = k
+	args[2] = redisVal
+	if nx {
+		args = append(args, "nx")
+	} else if xx {
+		args = append(args, "xx")
+	}
+	if get {
+		args = append(args, "get")
+	}
+
+	now := time.Now()
+	exp := s.expiry(now)
+	switch exp {
+	case neverExpire:
+		// do nothing; default Redis behavior
+	case keepTTL:
+		args = append(args, "keepttl")
+	default:
+		dur := exp.Sub(now)
+		if dur < 0 {
+			// The expiry is in the past; use a very old unix timestamp to
+			// delete the key immediately. Note that we can't use timestamp 0
+			// or else [Mini]redis complains.
+			args = append(args, "exat", 1)
+		} else {
+			if usePreciseDur(dur) {
+				args = append(args, "px", int64(dur/time.Millisecond))
+			} else {
+				args = append(args, "ex", int64(dur/time.Second))
+			}
+		}
+	}
+
+	if get {
+		cmd := redis.NewStringCmd(ctx, args...)
+		_ = s.redis.Process(ctx, cmd)
+		res, err := cmd.Result()
+		err = toErr(err, op, k)
+		return res, k, err
+	}
+
+	cmd := redis.NewStatusCmd(ctx, args...)
+	_ = s.redis.Process(ctx, cmd)
+	return "", k, toErr(cmd.Err(), op, k)
+}
+
+func usePreciseDur(dur time.Duration) bool {
+	return dur < time.Second || dur%time.Second != 0
+}
diff --git a/runtimes/go/storage/cache/basic_test.go b/runtimes/go/storage/cache/basic_test.go
new file mode 100644
index 0000000000..6700a6afc0
--- /dev/null
+++ b/runtimes/go/storage/cache/basic_test.go
@@ -0,0 +1,205 @@
+package cache
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+)
+
+func TestBasicKeyspace(t *testing.T) {
+	kt := newStringTest(t)
+	ks, ctx := kt.ks, kt.ctx
+
+	kt.Set("one", "alpha")
+	kt.Val("one", "alpha")
+
+	check(ks.With(ExpireIn(time.Second)).Set(ctx, "one", "beta"))
+	kt.Val("one", "beta")
+	kt.TTL("one", time.Second)
+
+	check(ks.With(ExpireIn(-time.Second)).Set(ctx, "one", "charlie"))
+	kt.Missing("one")
+
+	kt.Set("one", "delta")
+	kt.Val("one", "delta")
+	must(ks.Delete(ctx, "one"))
+	kt.Missing("one")
+
+	// Replace should fail if the key is missing
+	if err := ks.Replace(ctx, "one", "test"); !errors.Is(err, Miss) {
+		t.Errorf("replace: unexpected error: %v", err)
+	}
+	check(ks.SetIfNotExists(ctx, "one", "added"))
+
+	// Add should fail if the key is already present.
+	if err := ks.SetIfNotExists(ctx, "one", "added twice"); !errors.Is(err, KeyExists) {
+		t.Errorf("add: unexpected error: %v", err)
+	}
+	kt.Val("one", "added")
+
+	check(ks.Replace(ctx, "one", "replaced"))
+	kt.Val("one", "replaced")
+
+	old := must(ks.GetAndSet(ctx, "one", "updated"))
+	if old != "replaced" {
+		t.Errorf("get and set: want old value %q, got %v", "replaced", old)
+	}
+
+	old = must(ks.GetAndDelete(ctx, "one"))
+	if old != "updated" {
+		t.Errorf("get and delete: want old value %q, got %v", "updated", old)
+	}
+	kt.Missing("one")
+}
+
+func TestStringKeyspace(t *testing.T) {
+	kt := newStringTest(t)
+	ks, ctx := kt.ks, kt.ctx
+
+	kt.Set("one", "alpha")
+
+	newLen := must(ks.Append(ctx, "one", " bravo"))
+	want := "alpha bravo"
+	kt.Val("one", want)
+	if newLen != int64(len(want)) {
+		t.Errorf("append: got resulting length %d, want %d", newLen, len(want))
+	}
+
+	newLen = must(ks.SetRange(ctx, "one", 6, "ch"))
+	want = "alpha chavo"
+	kt.Val("one", want)
+	if newLen != int64(len(want)) {
+		t.Errorf("setrange: got resulting length %d, want %d", newLen, len(want))
+	}
+
+	newLen = must(ks.SetRange(ctx, "one", 13, "pad"))
+	want = "alpha chavo\x00\x00pad"
+	kt.Val("one", want)
+	if newLen != int64(len(want)) {
+		t.Errorf("setrange: got resulting length %d, want %d", newLen, len(want))
+	}
+
+	got := must(ks.GetRange(ctx, "one", 2, 4))
+	if want := "pha"; got != want {
+		t.Errorf("getrange: got %q, want %q", got, want)
+	}
+
+	gotLen := int(must(ks.Len(ctx, "one")))
+	if want := len(must(ks.Get(ctx, "one"))); gotLen != want {
+		t.Errorf("len: got %v, want %v", got, want)
+	}
+}
+
+func TestIntKeyspace(t *testing.T) {
+	ks := newIntTest(t)
+	ctx := context.Background()
+
+	check(ks.Set(ctx, "one", 1))
+	if got, want := must(ks.Get(ctx, "one")), int64(1); got != want {
+		t.Errorf("set/get: got %v, want %v", got, want)
+	}
+
+	if got, want := must(ks.Increment(ctx, "one", 3)), int64(4); got != want {
+		t.Errorf("incr: got %v, want %v", got, want)
+	}
+
+	if got, want := must(ks.Decrement(ctx, "one", 1)), int64(3); got != want {
+		t.Errorf("decr: got %v, want %v", got, want)
+	}
+}
+
+func TestFloatKeyspace(t *testing.T) {
+	ks := newFloatTest(t)
+	ctx := context.Background()
+
+	// We may need to change these to approximate comparisons, but it's
+	// at least passing for me right now.
+	check(ks.Set(ctx, "one", 1))
+	if got, want := must(ks.Get(ctx, "one")), float64(1); got != want {
+		t.Errorf("set/get: got %v, want %v", got, want)
+	}
+
+	if got, want := must(ks.Increment(ctx, "one", 3)), float64(4); got != want {
+		t.Errorf("incr: got %v, want %v", got, want)
+	}
+
+	if got, want := must(ks.Decrement(ctx, "one", 1)), float64(3); got != want {
+		t.Errorf("decr: got %v, want %v", got, want)
+	}
+}
+
+func newStringTest(t *testing.T) *stringTester {
+	cluster, srv := newTestCluster(t)
+	ks := NewStringKeyspace[string](cluster, KeyspaceConfig{
+		EncoreInternal_KeyMapper: func(s string) string { return s },
+	})
+
+	ctx := context.Background()
+	return &stringTester{t: t, ctx: ctx, ks: ks, srv: srv}
+}
+
+func newIntTest(t *testing.T) *IntKeyspace[string] {
+	cluster, _ := newTestCluster(t)
+	ks := NewIntKeyspace[string](cluster, KeyspaceConfig{
+		EncoreInternal_KeyMapper: func(s string) string { return s },
+	})
+	return ks
+}
+
+func newFloatTest(t *testing.T) *FloatKeyspace[string] {
+	cluster, _ := newTestCluster(t)
+	ks := NewFloatKeyspace[string](cluster, KeyspaceConfig{
+		EncoreInternal_KeyMapper: func(s string) string { return s },
+	})
+	return ks
+}
+
+type stringTester struct {
+	t   *testing.T
+	ctx context.Context
+	ks  *StringKeyspace[string]
+	srv *miniredis.Miniredis
+}
+
+func (t *stringTester) Set(key, val string) {
+	t.t.Helper()
+	if err := t.ks.Set(t.ctx, key, val); err != nil {
+		t.t.Errorf("Set(%q, %q) = %v, want nil", key, val, err)
+	}
+}
+
+func (t *stringTester) Val(key, want string) {
+	t.t.Helper()
+	if got, err := t.ks.Get(t.ctx, key); err != nil {
+		if err == Miss {
+			t.t.Errorf("key %s: key not in cache", key)
+		} else {
+			t.t.Errorf("key %s: got err %v, want nil", key, err)
+		}
+	} else if got != want {
+		t.t.Errorf("key %s: got value %q, want %q", key, got, want)
+	}
+}
+
+func (t *stringTester) TTL(key string, want time.Duration) {
+	t.t.Helper()
+	if !t.srv.Exists(key) {
+		t.t.Errorf("key %s: key not in cache", key)
+	}
+	got := t.srv.TTL(key)
+	if got != want {
+		t.t.Errorf("key %s: got ttl %v, want %v", key, got, want)
+	}
+}
+
+func (t *stringTester) Missing(key string) {
+	t.t.Helper()
+	if _, err := t.ks.Get(t.ctx, key); err == nil {
+		t.t.Errorf("key %s: key still in cache", key)
+	} else if !errors.Is(err, Miss) {
+		t.t.Errorf("key %s: got err %v, want Miss", key, err)
+	}
+}
diff --git a/runtimes/go/storage/cache/cache.go b/runtimes/go/storage/cache/cache.go
new file mode 100644
index 0000000000..7829fe8f4b
--- /dev/null
+++ b/runtimes/go/storage/cache/cache.go
@@ -0,0 +1,271 @@
+// Package cache provides the ability to define distributed Redis cache clusters
+// and functionality to use them in a fully type-safe manner.
+//
+// For more information see https://encore.dev/docs/develop/caching
+package cache
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"time"
+
+	"github.com/go-redis/redis/v8"
+)
+
+// ClusterConfig represents the configuration of cache clusters.
+type ClusterConfig struct {
+	// EvictionPolicy decides how the cache evicts existing keys
+	// to make room for new data when the max memory limit is reached.
+	//
+	// If not specified the cache defaults to AllKeysLRU.
+	EvictionPolicy EvictionPolicy
+}
+
+// An EvictionPolicy describes how the cache evicts keys to make room for new data
+// when the maximum memory limit is reached.
+//
+// See https://redis.io/docs/manual/eviction/#eviction-policies for more information.
+type EvictionPolicy string
+
+// NOTE: These values need to be added to the runtimeconstants package
+// and the parser package for the parser to be aware of them.
+
+// The eviction policies Encore supports.
+// See https://redis.io/docs/manual/eviction/#eviction-policies for more information.
+const (
+	// AllKeysLRU keeps most recently used keys and removes least recently used (LRU) keys.
+	// This is a good default choice for most cache use cases if you're not sure.
+	AllKeysLRU EvictionPolicy = "allkeys-lru"
+
+	// AllKeysLFU keeps frequently used keys and removes least frequently used (LFU) keys.
+	AllKeysLFU EvictionPolicy = "allkeys-lfu"
+
+	// AllKeysRandom randomly removes keys as needed.
+	AllKeysRandom EvictionPolicy = "allkeys-random"
+
+	// VolatileLRU removes least recently used keys with an expiration set.
+	// It behaves like NoEviction if there are no keys to evict with an expiration set.
+	VolatileLRU EvictionPolicy = "volatile-lru"
+
+	// VolatileLFU removes least frequently used keys with an expiration set.
+	// It behaves like NoEviction if there are no keys to evict with an expiration set.
+	VolatileLFU EvictionPolicy = "volatile-lfu"
+
+	// VolatileTTL removes keys with an expiration set and the shortest time to live (TTL).
+	// It behaves like NoEviction if there are no keys to evict with an expiration set.
+	VolatileTTL EvictionPolicy = "volatile-ttl"
+
+	// VolatileRandom randomly removes keys with an expiration set.
+	// It behaves like NoEviction if there are no keys to evict with an expiration set.
+	VolatileRandom EvictionPolicy = "volatile-random"
+
+	// NoEviction does not evict any keys, and instead returns an error to the client
+	// when the max memory limit is reached.
+	NoEviction EvictionPolicy = "noeviction"
+)
+
+//publicapigen:keep
+type constStr string
+
+// Cluster represents a Redis cache cluster.
+type Cluster struct {
+	cfg ClusterConfig
+	mgr *Manager
+	cl  *redis.Client
+}
+
+// KeyspaceConfig specifies the configuration options for a cache keyspace.
+type KeyspaceConfig struct {
+	// KeyPattern is a string literal representing the
+	// cache key pattern for this keyspace.
+	KeyPattern constStr
+
+	// DefaultExpiry specifies the default key expiry for cache items
+	// in this keyspace.
+	//
+	// When set, all write operations set (for new keys)
+	// or update (for existing keys) the expiration time.
+	//
+	// When updating the expiration time Encore always
+	// performs the combined operation atomically.
+	//
+	// If nil, cache items have no expiry date by default.
+	//
+	// The default behavior can be overridden by passing in
+	// an ExpiryFunc or KeepTTL as a WriteOption to a specific operation.
+	DefaultExpiry ExpiryFunc
+
+	// EncoreInternal_DefLoc specifies where the keyspace is defined.
+	// It's an internal field set by Encore's compiler.
+	//publicapigen:drop
+	EncoreInternal_DefLoc uint32
+
+	// EncoreInternal_KeyMapper specifies how typed keys are translated
+	// to a string. It's of type any to avoid making KeyspaceConfig
+	// a generic type. It's an internal field set by Encore's compiler.
+	//
+	// The type must be func(K) string.
+	//publicapigen:drop
+	EncoreInternal_KeyMapper any
+}
+
+// An OpError describes the operation that failed.
+type OpError struct {
+	Operation string
+	RawKey    string
+	Err       error
+}
+
+func (e *OpError) Error() string {
+	return fmt.Sprintf("cache: %s %q: %v", e.Operation, e.RawKey, e.Err)
+}
+
+func (e *OpError) Unwrap() error {
+	return e.Err
+}
+
+// Miss is the error value reported when a key is missing from the cache.
+// It must be checked against with errors.Is.
+var Miss = errors.New("cache miss")
+
+// KeyExists is the error reported when a key already exists
+// and the requested operation is specified to only apply to
+// keys that do not already exist.
+// It must be checked against with errors.Is.
+var KeyExists = errors.New("key already exists")
+
+// An WriteOption customizes the behavior of a single cache write operation.
+type WriteOption interface {
+	//publicapigen:keep
+	writeOption() // ensure only our package can implement
+}
+
+type expiryOption interface {
+	WriteOption
+	expiry(now time.Time) time.Time
+}
+
+// ExpiryFunc is a function that reports when a key should expire
+// given the current time. It can be used as a WriteOption to customize
+// the expiration for that particular operation.
+type ExpiryFunc func(now time.Time) time.Time
+
+// option implements WriteOption.
+//
+//publicapigen:keep
+func (ExpiryFunc) writeOption() {}
+
+// expiry implements expiryOption.
+func (fn ExpiryFunc) expiry(now time.Time) time.Time {
+	return fn(now)
+}
+
+var _ expiryOption = (ExpiryFunc)(nil)
+
+// ExpireIn returns an ExpiryFunc that expires keys after a constant duration.
+func ExpireIn(dur time.Duration) ExpiryFunc {
+	return func(now time.Time) time.Time { return now.Add(dur) }
+}
+
+// ExpireDailyAt returns an ExpiryFunc that expires keys daily at the given time of day in loc.
+// ExpireDailyAt panics if loc is nil.
+func ExpireDailyAt(hour, minute, second int, loc *time.Location) ExpiryFunc {
+	return func(now time.Time) time.Time {
+		year, month, day := now.Date()
+		next := time.Date(year, month, day, hour, minute, second, 0, loc)
+		// If next has already passed today, move it to tomorrow.
+		if next.Before(now) {
+			next = next.AddDate(0, 0, 1)
+		}
+		return next
+	}
+}
+
+// expiryTime is a type for time constants that are also WriteOptions.
+//
+//publicapigen:keep
+type expiryTime time.Time
+
+//publicapigen:keep
+func (expiryTime) writeOption() {}
+
+func (et expiryTime) expiry(_ time.Time) time.Time {
+	return time.Time(et)
+}
+
+var _ expiryOption = (expiryTime)(time.Time{})
+
+var (
+	// NeverExpire is a WriteOption indicating the key should never expire.
+	NeverExpire = expiryTime(neverExpire)
+
+	// KeepTTL is a WriteOption indicating the key's TTL should be kept the same.
+	KeepTTL = expiryTime(keepTTL)
+)
+
+//publicapigen:keep
+var (
+	neverExpire = time.Unix(0, 1)
+	keepTTL     = time.Unix(0, 2)
+)
+
+func fnMap[A, B any](src []A, fn func(A) B) []B {
+	dst := make([]B, len(src))
+	for i, v := range src {
+		dst[i] = fn(v)
+	}
+	return dst
+}
+
+// do executes a Redis command, by invoking fn.
+//
+// Depending on the keyspace's expiration logic it either calls fn with
+// a plain Redis client or with a transactional pipeline, in order to ensure
+// the command executes atomically with the expiration update.
+func do[K, V, Res any](cl *client[K, V], ctx context.Context, key string, fn func(cmdable) Res) Res {
+	exp := cl.expiryCmd(ctx, key)
+	if exp == nil {
+		return fn(cl.redis)
+	}
+
+	pipe := cl.redis.TxPipeline()
+	res := fn(pipe)
+	_ = pipe.Process(ctx, exp)
+	_, _ = pipe.Exec(ctx)
+	return res
+}
+
+// do2 is like do, except it operates on two keys instead of one.
+func do2[K, V, Res any](
+	cl *client[K, V],
+	ctx context.Context,
+	keyA, keyB string,
+	fn func(cmdable) Res,
+) Res {
+	expA := cl.expiryCmd(ctx, keyA)
+	expB := cl.expiryCmd(ctx, keyB)
+
+	// If we don't have any expiry commands, process the command directly.
+	if expA == nil && expB == nil {
+		return fn(cl.redis)
+	}
+
+	// Otherwise use a pipeline.
+	pipe := cl.redis.TxPipeline()
+	res := fn(pipe)
+	if expA != nil {
+		_ = pipe.Process(ctx, expA)
+	}
+	if expB != nil {
+		_ = pipe.Process(ctx, expB)
+	}
+	_, _ = pipe.Exec(ctx)
+
+	return res
+}
+
+type cmdable interface {
+	redis.Cmdable
+	Process(context.Context, redis.Cmder) error
+}
diff --git a/runtimes/go/storage/cache/cache_test.go b/runtimes/go/storage/cache/cache_test.go
new file mode 100644
index 0000000000..38e17e0eb1
--- /dev/null
+++ b/runtimes/go/storage/cache/cache_test.go
@@ -0,0 +1,43 @@
+package cache
+
+import (
+	"os"
+	"testing"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/go-redis/redis/v8"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/reqtrack"
+)
+
+func newTestCluster(t *testing.T) (*Cluster, *miniredis.Miniredis) {
+	srv := miniredis.RunT(t)
+	redisClient := redis.NewClient(&redis.Options{Addr: srv.Addr()})
+
+	rt := reqtrack.New(zerolog.New(os.Stdout), nil, nil)
+	mgr := &Manager{
+		static: &config.Static{
+			// We're testing the "production mode" of the cache, not the test mode.
+			Testing: false,
+		},
+		rt: rt,
+	}
+	cluster := &Cluster{
+		mgr: mgr,
+		cl:  redisClient,
+	}
+	return cluster, srv
+}
+
+func must[T any](val T, err error) T {
+	check(err)
+	return val
+}
+
+func check(err error) {
+	if err != nil {
+		panic(err)
+	}
+}
diff --git a/runtimes/go/storage/cache/error_internal.go b/runtimes/go/storage/cache/error_internal.go
new file mode 100644
index 0000000000..d287470ba4
--- /dev/null
+++ b/runtimes/go/storage/cache/error_internal.go
@@ -0,0 +1,42 @@
+package cache
+
+import (
+	jsoniter "github.com/json-iterator/go"
+
+	"encore.dev/appruntime/apisdk/api/errmarshalling"
+)
+
+// Register an internal error marshaller for the cache.OpError
+func init() {
+	errmarshalling.RegisterErrorMarshaller(
+		func(err *OpError, stream *jsoniter.Stream) {
+			stream.WriteObjectField("op")
+			stream.WriteString(err.Operation)
+
+			stream.WriteMore()
+			stream.WriteObjectField("raw_key")
+			stream.WriteString(err.RawKey)
+
+			if err.Err != nil {
+				stream.WriteMore()
+				stream.WriteObjectField(errmarshalling.WrappedKey)
+				stream.WriteVal(err.Err)
+			}
+		},
+		func(err *OpError, iter *jsoniter.Iterator) {
+			iter.ReadObjectCB(func(iter *jsoniter.Iterator, field string) bool {
+				switch field {
+				case "op":
+					err.Operation = iter.ReadString()
+				case "raw_key":
+					err.RawKey = iter.ReadString()
+				case errmarshalling.WrappedKey:
+					err.Err = errmarshalling.UnmarshalError(iter)
+				default:
+					iter.Skip()
+				}
+				return true
+			})
+		},
+	)
+}
diff --git a/runtimes/go/storage/cache/list.go b/runtimes/go/storage/cache/list.go
new file mode 100644
index 0000000000..eae8678fdd
--- /dev/null
+++ b/runtimes/go/storage/cache/list.go
@@ -0,0 +1,509 @@
+package cache
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"strconv"
+
+	"github.com/go-redis/redis/v8"
+)
+
+// BasicType is a constraint for basic types that
+// can be used as element types in Redis lists and sets.
+type BasicType interface {
+	string | int | int64 | float64
+}
+
+// NewListKeyspace creates a keyspace that stores ordered lists in the given cluster.
+//
+// The type parameter K specifies the key type, which can either be a
+// named struct type or a basic type (string, int, etc).
+//
+// The type parameter V specifies the value type, which is the type
+// of the elements in each list. It must be a basic type (string, int, int64, or float64).
+func NewListKeyspace[K any, V BasicType](cluster *Cluster, cfg KeyspaceConfig) *ListKeyspace[K, V] {
+	fromRedis := basicFromRedisFactory[V]()
+	toRedis := basicToRedisFactory[V]()
+
+	return &ListKeyspace[K, V]{
+		client: newClient[K, V](cluster, cfg, fromRedis, toRedis),
+	}
+}
+
+// ListKeyspace represents a set of cache keys,
+// each containing an ordered list of values of type V.
+type ListKeyspace[K any, V BasicType] struct {
+	*client[K, V]
+}
+
+// With returns a reference to the same keyspace but with customized write options.
+// The primary use case is for overriding the expiration time for certain cache operations.
+//
+// It is intended to be used with method chaining:
+//
+//	myKeyspace.With(cache.ExpireIn(3 * time.Second)).Set(...)
+func (k *ListKeyspace[K, V]) With(opts ...WriteOption) *ListKeyspace[K, V] {
+	return &ListKeyspace[K, V]{k.client.with(opts)}
+}
+
+// Delete deletes the specified keys.
+//
+// If a key does not exist it is ignored.
+//
+// It reports the number of keys that were deleted.
+//
+// See https://redis.io/commands/del/ for more information.
+func (s *ListKeyspace[K, V]) Delete(ctx context.Context, keys ...K) (deleted int, err error) {
+	return s.client.Delete(ctx, keys...)
+}
+
+// PushLeft pushes one or more values at the head of the list stored at key.
+// If the key does not already exist, it is first created as an empty list.
+//
+// If multiple values are given, they are inserted one after another,
+// starting with the leftmost value. For instance,
+//
+//	PushLeft(ctx, "mylist", "a", "b", "c")
+//
+// will result in a list containing "c" as its first element,
+// "b" as its second element, and "a" as its third element.
+//
+// See https://redis.io/commands/lpush/ for more information.
+func (l *ListKeyspace[K, V]) PushLeft(ctx context.Context, key K, values ...V) (newLen int64, err error) {
+	const op = "push left"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	// Convert []V to []any since that's what the Redis library expects.
+	vals := fnMap(values, func(v V) any { return v })
+	res, err := do(l.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.LPush(ctx, k, vals...)
+	}).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// PushRight pushes one or more values at the tail of the list stored at key.
+// If the key does not already exist, it is first created as an empty list.
+//
+// If multiple values are given, they are inserted one after another,
+// starting with the leftmost value. For instance,
+//
+//	PushRight(ctx, "mylist", "a", "b", "c")
+//
+// will result in a list containing "c" as its last element,
+// "b" as its second to last element, and "a" as its third-to-last element.
+//
+// See https://redis.io/commands/rpush/ for more information.
+func (l *ListKeyspace[K, V]) PushRight(ctx context.Context, key K, values ...V) (newLen int64, err error) {
+	const op = "push right"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	// Convert []V to []any since that's what the Redis library expects.
+	vals := fnMap(values, func(v V) any { return v })
+	res, err := do(l.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.RPush(ctx, k, vals...)
+	}).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// PopLeft pops a single element off the head of the list stored at key and returns it.
+// If the key does not exist, it returns an error matching Miss.
+//
+// See https://redis.io/commands/lpop/ for more information.
+func (l *ListKeyspace[K, V]) PopLeft(ctx context.Context, key K) (val V, err error) {
+	const op = "pop left"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return val, err
+	}
+
+	res, err := do(l.client, ctx, k, func(c cmdable) *redis.StringCmd {
+		return c.LPop(ctx, k)
+	}).Result()
+
+	if err == nil {
+		val, err = l.fromRedis(res)
+	}
+	err = toErr(err, op, k)
+	return val, err
+}
+
+// PopRight pops a single element off the tail of the list stored at key and returns it.
+// If the key does not exist, it returns an error matching Miss.
+//
+// See https://redis.io/commands/rpop/ for more information.
+func (l *ListKeyspace[K, V]) PopRight(ctx context.Context, key K) (val V, err error) {
+	const op = "pop right"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return val, err
+	}
+
+	res, err := do(l.client, ctx, k, func(c cmdable) *redis.StringCmd {
+		return c.RPop(ctx, k)
+	}).Result()
+	if err == nil {
+		val, err = l.fromRedis(res)
+	}
+	err = toErr(err, op, k)
+	return val, err
+}
+
+// Len reports the length of the list stored at key.
+//
+// Non-existing keys are considered as empty lists.
+//
+// See https://redis.io/commands/llen/ for more information.
+func (l *ListKeyspace[K, V]) Len(ctx context.Context, key K) (length int64, err error) {
+	const op = "list len"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := l.redis.LLen(ctx, k).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// Trim trims the list stored at key to only contain the elements between the indices
+// start and stop (inclusive). Both start and stop are zero-based indices.
+//
+// Negative indices can be used to indicate offsets from the end of the list,
+// where -1 is the last element of the list, -2 the penultimate element, and so on.
+//
+// Out of range indices are valid and are treated as if they specify the start or end of the list,
+// respectively. If start > stop the end result is an empty list.
+//
+// See https://redis.io/commands/ltrim/ for more information.
+func (l *ListKeyspace[K, V]) Trim(ctx context.Context, key K, start, stop int64) error {
+	const op = "list trim"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return err
+	}
+	res := do(l.client, ctx, k, func(c cmdable) *redis.StatusCmd {
+		return c.LTrim(ctx, k, start, stop)
+	})
+	return toErr(res.Err(), op, k)
+}
+
+// Set updates the list element with the given idx to val.
+//
+// Negative indices can be used to indicate offsets from the end of the list,
+// where -1 is the last element of the list, -2 the penultimate element, and so on.
+//
+// An error is returned for out of bounds indices.
+//
+// See https://redis.io/commands/lset/ for more information.
+func (l *ListKeyspace[K, V]) Set(ctx context.Context, key K, idx int64, val V) (err error) {
+	const op = "list set"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return err
+	}
+
+	res := do(l.client, ctx, k, func(c cmdable) *redis.StatusCmd {
+		return c.LSet(ctx, k, idx, val)
+	})
+	return toErr(res.Err(), op, k)
+}
+
+// Get returns the value of list element with the given idx.
+//
+// Negative indices can be used to indicate offsets from the end of the list,
+// where -1 is the last element of the list, -2 the penultimate element, and so on.
+//
+// For out of bounds indices or the key not existing in the cache, an error matching Miss is returned.
+//
+// See https://redis.io/commands/lget/ for more information.
+func (l *ListKeyspace[K, V]) Get(ctx context.Context, key K, idx int64) (val V, err error) {
+	const op = "list get"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return val, err
+	}
+	res, err := l.redis.LIndex(ctx, k, idx).Result()
+
+	if err == nil {
+		val, err = l.fromRedis(res)
+	}
+	err = toErr(err, op, k)
+	return val, err
+}
+
+// Items returns all the elements in the list stored at key.
+//
+// If the key does not exist it returns an empty list.
+//
+// See https://redis.io/commands/lrange/ for more information.
+func (l *ListKeyspace[K, V]) Items(ctx context.Context, key K) ([]V, error) {
+	return l.getRange(ctx, key, 0, -1, "items")
+}
+
+// GetRange returns all the elements in the list stored at key between start and stop.
+//
+// Negative indices can be used to indicate offsets from the end of the list,
+// where -1 is the last element of the list, -2 the penultimate element, and so on.
+//
+// If the key does not exist it returns an empty list.
+//
+// See https://redis.io/commands/lrange/ for more information.
+func (l *ListKeyspace[K, V]) GetRange(ctx context.Context, key K, start, stop int64) ([]V, error) {
+	return l.getRange(ctx, key, start, stop, "get range")
+}
+
+func (l *ListKeyspace[K, V]) getRange(ctx context.Context, key K, from, to int64, op string) (vals []V, err error) {
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return nil, err
+	}
+	res, err := l.redis.LRange(ctx, k, from, to).Result()
+	if err != nil {
+		return nil, toErr(err, op, k)
+	}
+
+	ret := make([]V, len(res))
+	for i, s := range res {
+		val, err := l.fromRedis(s)
+		if err != nil {
+			return nil, toErr(err, op, k)
+		}
+		ret[i] = val
+	}
+	return ret, nil
+}
+
+// InsertBefore inserts newVal into the list stored at key, at the position just before needle.
+//
+// If the list stored at key does not contain needle the value is not inserted,
+// and an error matching Miss is returned.
+//
+// It returns the new list length.
+//
+// See https://redis.io/commands/linsert/ for more information.
+func (l *ListKeyspace[K, V]) InsertBefore(ctx context.Context, key K, needle, newVal V) (newLen int64, err error) {
+	const op = "insert before"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	newLen, err = do(l.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.LInsertBefore(ctx, k, needle, newVal)
+	}).Result()
+
+	if err == nil && newLen == -1 {
+		return 0, toErr(Miss, op, k)
+	}
+	return newLen, toErr(err, op, k)
+}
+
+// InsertAfter inserts newVal into the list stored at key, at the position just after needle.
+//
+// It reports the new list length.
+//
+// If the list stored at key does not contain needle the value is not inserted,
+// and an error matching Miss is returned.
+//
+// See https://redis.io/commands/linsert/ for more information.
+func (l *ListKeyspace[K, V]) InsertAfter(ctx context.Context, key K, needle, newVal V) (newLen int64, err error) {
+	const op = "insert after"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	newLen, err = do(l.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.LInsertAfter(ctx, k, needle, newVal)
+	}).Result()
+
+	if err == nil && newLen == -1 {
+		return 0, toErr(Miss, op, k)
+	}
+	return newLen, toErr(err, op, k)
+}
+
+// RemoveAll removes all values equal to needle in the list stored at key.
+//
+// It reports the number of elements removed.
+//
+// If the list does not contain needle, or the list does not exist, it reports 0, nil.
+//
+// See https://redis.io/commands/lrem/ for more information.
+func (l *ListKeyspace[K, V]) RemoveAll(ctx context.Context, key K, needle V) (removed int64, err error) {
+	const op = "remove all"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := do(l.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.LRem(ctx, k, 0, needle)
+	}).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// RemoveFirst removes the first 'count' values equal to needle in the list stored at key.
+//
+// It reports the number of elements removed.
+//
+// If the list does not contain needle, or the list does not exist, it reports 0, nil.
+//
+// See https://redis.io/commands/lrem/ for more information.
+func (l *ListKeyspace[K, V]) RemoveFirst(ctx context.Context, key K, count int64, needle V) (removed int64, err error) {
+	const op = "remove first"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	if count < 0 {
+		err = toErr(errors.New("negative count"), op, k)
+		return 0, err
+	} else if count == 0 {
+		return 0, nil
+	}
+
+	res, err := do(l.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.LRem(ctx, k, count, needle)
+	}).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// RemoveLast removes the last 'count' values equal to needle in the list stored at key.
+//
+// It reports the number of elements removed.
+//
+// If the list does not contain needle, or the list does not exist, it reports 0, nil.
+//
+// See https://redis.io/commands/lrem/ for more information.
+func (l *ListKeyspace[K, V]) RemoveLast(ctx context.Context, key K, count int64, needle V) (removed int64, err error) {
+	const op = "remove last"
+	k, err := l.key(key, op)
+	endTrace := l.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	if count < 0 {
+		err = toErr(errors.New("negative count"), op, k)
+		return 0, err
+	} else if count == 0 {
+		return 0, nil
+	}
+
+	res, err := do(l.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.LRem(ctx, k, -count, needle)
+	}).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+type ListPos string
+
+const (
+	Left  ListPos = "LEFT"
+	Right ListPos = "RIGHT"
+)
+
+// Move atomically moves an element from the list stored at src to the list stored at dst.
+//
+// The value moved can be either the head (fromPos == Left) or tail (fromPos == Right) of the list at src.
+// Similarly, the value can be placed either at the head (toPos == Left) or tail (toPos == Right) of the list at dst.
+//
+// If src does not exist it reports an error matching Miss.
+//
+// If src and dst are the same list, the value is atomically rotated from one end to the other when fromPos != toPos,
+// or if fromPos == toPos nothing happens.
+func (l *ListKeyspace[K, V]) Move(ctx context.Context, src, dst K, fromPos, toPos ListPos) (moved V, err error) {
+	const op = "list move"
+	ks, err := l.keys([]K{src, dst}, op)
+	endTrace := l.doTrace(op, true, ks...)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return moved, err
+	}
+	srcKey, dstKey := ks[0], ks[1]
+
+	res, err := do2(l.client, ctx, srcKey, dstKey, func(c cmdable) *redis.StringCmd {
+		return c.LMove(ctx, srcKey, dstKey, string(fromPos), string(toPos))
+	}).Result()
+
+	if err == nil {
+		moved, err = l.fromRedis(res)
+	}
+	err = toErr(err, op, srcKey)
+	return moved, err
+}
+
+func basicFromRedisFactory[V BasicType]() func(val string) (V, error) {
+	var zero V
+	typ := any(zero)
+
+	var fn any
+	switch typ.(type) {
+	case string:
+		fn = func(val string) (string, error) {
+			return val, nil
+		}
+	case int:
+		fn = func(val string) (int, error) {
+			res, err := strconv.ParseInt(val, 10, 64)
+			return int(res), err
+		}
+	case int64:
+		fn = func(val string) (int64, error) {
+			return strconv.ParseInt(val, 10, 64)
+		}
+	case float64:
+		fn = func(val string) (float64, error) {
+			return strconv.ParseFloat(val, 64)
+		}
+	default:
+		panic(fmt.Sprintf("unsupported BasicType %T", typ))
+	}
+
+	return fn.(func(val string) (V, error))
+}
+
+func basicToRedisFactory[V BasicType]() func(val V) (any, error) {
+	return func(val V) (any, error) { return val, nil }
+}
diff --git a/runtimes/go/storage/cache/list_test.go b/runtimes/go/storage/cache/list_test.go
new file mode 100644
index 0000000000..d946ffc210
--- /dev/null
+++ b/runtimes/go/storage/cache/list_test.go
@@ -0,0 +1,134 @@
+package cache
+
+import (
+	"context"
+	"reflect"
+	"testing"
+
+	"github.com/alicebob/miniredis/v2"
+)
+
+func TestListKeyspace(t *testing.T) {
+	kt := newListTest(t)
+	ks, ctx := kt.ks, kt.ctx
+
+	if got, want := kt.PushLeft("one", "a"), int64(1); got != want {
+		t.Errorf("lpush: got len %v, want %v", got, want)
+	}
+	kt.Val("one", "a")
+
+	if got, want := kt.PushLeft("one", "b"), int64(2); got != want {
+		t.Errorf("lpush: got len %v, want %v", got, want)
+	}
+	kt.Val("one", "b", "a")
+
+	if got, want := kt.PushRight("one", "c"), int64(3); got != want {
+		t.Errorf("rpush: got len %v, want %v", got, want)
+	}
+	kt.Val("one", "b", "a", "c")
+
+	kt.Set("one", 1, "d")
+	kt.Val("one", "b", "d", "c")
+
+	kt.Trim("one", 1, 1)
+	kt.Val("one", "d")
+
+	if got, want := must(ks.InsertBefore(ctx, "one", "d", "e")), int64(2); got != want {
+		t.Errorf("insertbefore: got len %v, want %v", got, want)
+	}
+	kt.Val("one", "e", "d")
+	if got, want := must(ks.InsertAfter(ctx, "one", "e", "f")), int64(3); got != want {
+		t.Errorf("insertafter: got len %v, want %v", got, want)
+	}
+	kt.Val("one", "e", "f", "d")
+
+	kt.PushRight("one", "e")
+	kt.PushRight("one", "e")
+	kt.PushRight("one", "f")
+	kt.Val("one", "e", "f", "d", "e", "e", "f")
+
+	if got, want := must(ks.RemoveFirst(ctx, "one", 2, "e")), int64(2); got != want {
+		t.Errorf("removefirst: got %v, want %v", got, want)
+	}
+	kt.Val("one", "f", "d", "e", "f")
+	if got, want := must(ks.RemoveLast(ctx, "one", 1, "f")), int64(1); got != want {
+		t.Errorf("removelast: got %v, want %v", got, want)
+	}
+	kt.Val("one", "f", "d", "e")
+
+	if got, want := must(ks.Move(ctx, "one", "one", Left, Right)), "f"; got != want {
+		t.Errorf("move: got %q, want %q", got, want)
+	}
+	kt.Val("one", "d", "e", "f")
+
+	kt.PushRight("one", "d")
+	kt.Val("one", "d", "e", "f", "d")
+	must(ks.RemoveAll(ctx, "one", "d"))
+	kt.Val("one", "e", "f")
+
+	kt.PushLeft("one", "a", "b")
+	kt.PushRight("one", "c", "d")
+	kt.Val("one", "b", "a", "e", "f", "c", "d")
+}
+
+func newListTest(t *testing.T) *listTester {
+	cluster, srv := newTestCluster(t)
+	ks := NewListKeyspace[string, string](cluster, KeyspaceConfig{
+		EncoreInternal_KeyMapper: func(s string) string { return s },
+	})
+	ctx := context.Background()
+	return &listTester{t: t, ctx: ctx, ks: ks, srv: srv}
+}
+
+type listTester struct {
+	t   *testing.T
+	ctx context.Context
+	ks  *ListKeyspace[string, string]
+	srv *miniredis.Miniredis
+}
+
+func (t *listTester) PushLeft(key string, val ...string) int64 {
+	t.t.Helper()
+	newLen, err := t.ks.PushLeft(t.ctx, key, val...)
+	if err != nil {
+		t.t.Errorf("LPush(%q, %q) = %v, want nil", key, val, err)
+	}
+	return newLen
+}
+
+func (t *listTester) PushRight(key string, val ...string) int64 {
+	t.t.Helper()
+	newLen, err := t.ks.PushRight(t.ctx, key, val...)
+	if err != nil {
+		t.t.Errorf("RPush(%q, %q) = %v, want nil", key, val, err)
+	}
+	return newLen
+}
+
+func (t *listTester) Set(key string, idx int, val string) {
+	t.t.Helper()
+	err := t.ks.Set(t.ctx, key, int64(idx), val)
+	if err != nil {
+		t.t.Errorf("Set(%q, %v, %q) = %v, want nil", key, idx, val, err)
+	}
+}
+
+func (t *listTester) Trim(key string, from, to int) {
+	t.t.Helper()
+	err := t.ks.Trim(t.ctx, key, int64(from), int64(to))
+	if err != nil {
+		t.t.Errorf("Trim(%q, %v, %v) = %v, want nil", key, from, to, err)
+	}
+}
+
+func (t *listTester) Val(key string, want ...string) {
+	t.t.Helper()
+	got := must(t.ks.GetRange(t.ctx, key, 0, -1))
+	if !reflect.DeepEqual(got, want) {
+		t.t.Errorf("key %s: got %+v, want %+v", key, got, want)
+	}
+	num := must(t.ks.Len(t.ctx, key))
+	if num != int64(len(got)) {
+		t.t.Errorf("got len %d, expected %d (from getRange)", num, len(got))
+	}
+}
diff --git a/runtimes/go/storage/cache/manager_internal.go b/runtimes/go/storage/cache/manager_internal.go
new file mode 100644
index 0000000000..67e3126649
--- /dev/null
+++ b/runtimes/go/storage/cache/manager_internal.go
@@ -0,0 +1,452 @@
+package cache
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"errors"
+	"fmt"
+	mathrand "math/rand" // nosemgrep
+	"runtime"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/alicebob/miniredis/v2"
+	"github.com/go-redis/redis/v8"
+	jsoniter "github.com/json-iterator/go"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/appruntime/shared/syncutil"
+	"encore.dev/appruntime/shared/testsupport"
+)
+
+// Manager manages cache clients.
+type Manager struct {
+	static  *config.Static
+	runtime *config.Runtime
+	rt      *reqtrack.RequestTracker
+	ts      *testsupport.Manager
+	json    jsoniter.API
+
+	initTestSrv syncutil.Once
+	testSrv     *miniredis.Miniredis
+
+	clientMu sync.RWMutex
+	clients  map[string]*redis.Client
+}
+
+func NewManager(static *config.Static, runtime *config.Runtime, rt *reqtrack.RequestTracker, ts *testsupport.Manager, json jsoniter.API) *Manager {
+	return &Manager{
+		static:  static,
+		runtime: runtime,
+		rt:      rt,
+		ts:      ts,
+		json:    json,
+		clients: make(map[string]*redis.Client),
+	}
+}
+
+func (mgr *Manager) getClient(clusterName string) *redis.Client {
+	mgr.clientMu.RLock()
+	cl := mgr.clients[clusterName]
+	mgr.clientMu.RUnlock()
+	if cl != nil {
+		return cl
+	}
+
+	// Client not found; acquire a write lock and set up the client
+	mgr.clientMu.Lock()
+	defer mgr.clientMu.Unlock()
+
+	// Did we race someone else and they set up the client first?
+	if cl := mgr.clients[clusterName]; cl != nil {
+		return cl
+	}
+
+	// Are we in a test or running in Encore Cloud? If so, use the redismock library.
+	if mgr.static.Testing || mgr.runningInEncoreCloud() {
+		cl, err := mgr.newMiniredisClient()
+		if err != nil {
+			panic(fmt.Sprintf("cache: unable to start redis mock: %v", err))
+		}
+		mgr.clients[clusterName] = cl
+		return cl
+	}
+
+	for _, rdb := range mgr.runtime.RedisDatabases {
+		if rdb.EncoreName == clusterName {
+			cl, err := mgr.newClient(rdb)
+			if err != nil {
+				panic(fmt.Sprintf("cache: unable to create redis client: %v", err))
+			}
+			mgr.clients[clusterName] = cl
+			return cl
+		}
+	}
+
+	return newNoopClient()
+}
+
+func (mgr *Manager) runningInEncoreCloud() bool {
+	if mgr.runtime != nil && mgr.runtime.EnvCloud == "encore" {
+		return true
+	}
+	return false
+}
+
+func (mgr *Manager) newClient(rdb *config.RedisDatabase) (*redis.Client, error) {
+	srv := mgr.runtime.RedisServers[rdb.ServerID]
+	opts := &redis.Options{
+		Network:      "tcp",
+		Addr:         srv.Host,
+		Username:     srv.User,
+		Password:     srv.Password,
+		DB:           rdb.Database,
+		MinIdleConns: orDefault(rdb.MinConnections, 1),
+		PoolSize:     orDefault(rdb.MaxConnections, runtime.GOMAXPROCS(0)*10),
+	}
+	if strings.HasPrefix(srv.Host, "/") {
+		opts.Network = "unix"
+	}
+
+	if srv.EnableTLS || srv.ServerCACert != "" || srv.ClientCert != "" {
+		opts.TLSConfig = &tls.Config{MinVersion: tls.VersionTLS12}
+		if srv.ServerCACert != "" {
+			caCertPool := x509.NewCertPool()
+			if !caCertPool.AppendCertsFromPEM([]byte(srv.ServerCACert)) {
+				return nil, fmt.Errorf("invalid server ca cert")
+			}
+			opts.TLSConfig.RootCAs = caCertPool
+		}
+		if srv.ClientCert != "" {
+			cert, err := tls.X509KeyPair([]byte(srv.ClientCert), []byte(srv.ClientKey))
+			if err != nil {
+				return nil, fmt.Errorf("parse client cert: %v", err)
+			}
+			opts.TLSConfig.Certificates = []tls.Certificate{cert}
+		}
+	}
+
+	return redis.NewClient(opts), nil
+}
+
+func (mgr *Manager) newMiniredisClient() (*redis.Client, error) {
+	err := mgr.initTestSrv.Do(func() error {
+		var err error
+		mgr.testSrv, err = miniredis.Run()
+
+		// Periodically clean up cache keys if running in Encore Cloud.
+		if err == nil && mgr.runningInEncoreCloud() {
+			go miniredisCleanup(mgr.testSrv, 15*time.Second, 100)
+		}
+
+		return err
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	opts := &redis.Options{
+		Network:      "tcp",
+		Addr:         mgr.testSrv.Addr(),
+		DB:           0,
+		MinIdleConns: 1,
+		PoolSize:     runtime.GOMAXPROCS(0) * 10,
+	}
+	cl := redis.NewClient(opts)
+
+	ctx, cancel := context.WithTimeout(context.Background(), 1*time.Second)
+	err = cl.Ping(ctx).Err()
+	cancel()
+	return cl, err
+}
+
+func (mgr *Manager) Shutdown(p *shutdown.Process) error {
+	// The redis client does not have the concept of graceful shutdown,
+	// so wait for user code to shut down first.
+	<-p.ServicesShutdownCompleted.Done()
+	<-p.OutstandingTasks.Done()
+
+	mgr.clientMu.Lock()
+	mgr.clientMu.Unlock()
+	for _, c := range mgr.clients {
+		_ = c.Close()
+	}
+	return nil
+}
+
+func newClient[K, V any](cluster *Cluster, cfg KeyspaceConfig,
+	fromRedis func(string) (V, error),
+	toRedis func(V) (any, error),
+) *client[K, V] {
+	keyMapper := cfg.EncoreInternal_KeyMapper.(func(K) string)
+	if mgr := cluster.mgr; mgr.static.Testing {
+		// If we're running tests, map keys to a test-specific key.
+		orig := keyMapper
+		keyMapper = func(k K) string {
+			key := orig(k)
+			if t := mgr.ts.CurrentTest(); t != nil {
+				key = t.Name() + "::" + key
+			}
+			return key
+		}
+	}
+
+	// Determine the default expiry function.
+	defaultExpiry := cfg.DefaultExpiry
+	if defaultExpiry == nil {
+		defaultExpiry = func(now time.Time) time.Time {
+			return neverExpire
+		}
+	}
+
+	return &client[K, V]{
+		rt:        cluster.mgr.rt,
+		redis:     cluster.cl,
+		cfg:       cfg,
+		expiry:    defaultExpiry,
+		keyMapper: keyMapper,
+		toRedis:   toRedis,
+		fromRedis: fromRedis,
+	}
+}
+
+type client[K, V any] struct {
+	rt        *reqtrack.RequestTracker
+	redis     *redis.Client
+	cfg       KeyspaceConfig
+	expiry    ExpiryFunc
+	keyMapper func(K) string
+	toRedis   func(V) (any, error)
+	fromRedis func(string) (V, error)
+}
+
+func (c *client[K, V]) with(opts []WriteOption) *client[K, V] {
+	expFunc := c.expiry
+	for _, opt := range opts {
+		if eo, ok := opt.(expiryOption); ok {
+			expFunc = eo.expiry
+		}
+	}
+
+	c2 := *c
+	c2.expiry = expFunc
+	return &c2
+}
+
+func (s *client[K, V]) key(k K, op string) (string, error) {
+	res := s.keyMapper(k)
+	if strings.HasPrefix(res, "__encore") {
+		return "", &OpError{
+			Operation: op,
+			RawKey:    res,
+			Err:       errors.New(`use of reserved key prefix "encore"`),
+		}
+	}
+	return res, nil
+}
+
+func (s *client[K, V]) keys(keys []K, op string) ([]string, error) {
+	strs := make([]string, len(keys))
+	var err error
+	for i, k := range keys {
+		strs[i], err = s.key(k, op)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return strs, nil
+}
+
+func (s *client[K, V]) fromRedisMulti(res []string) ([]V, error) {
+	vals := make([]V, len(res))
+	for i, r := range res {
+		v, err := s.fromRedis(r)
+		if err != nil {
+			return nil, err
+		}
+		vals[i] = v
+	}
+	return vals, nil
+}
+
+func (s *client[K, V]) valPtr(res string) (*V, error) {
+	vv, err := s.fromRedis(res)
+	if err != nil {
+		return nil, err
+	}
+	return &vv, nil
+}
+
+func (s *client[K, V]) valOrNil(res string, err error) (*V, error) {
+	if err == redis.Nil || errors.Is(err, Miss) {
+		return nil, nil
+	} else if err != nil {
+		return nil, err
+	}
+	return s.valPtr(res)
+}
+
+func (s *client[K, V]) expiryCmd(ctx context.Context, key string) *redis.BoolCmd {
+	now := time.Now()
+	expTime := s.expiry(now)
+	if expTime == keepTTL {
+		return nil
+	} else if expTime == neverExpire {
+		return redis.NewBoolCmd(ctx, "persist", key)
+	}
+
+	expMs := expTime.UnixNano() / int64(time.Millisecond)
+	return redis.NewBoolCmd(ctx, "pexpireat", key, expMs)
+}
+
+func (s *client[K, V]) expiryDur() time.Duration {
+	now := time.Now()
+	expTime := s.expiry(now)
+
+	var exp time.Duration
+	switch {
+	case expTime == neverExpire:
+		exp = 0
+	case expTime == keepTTL:
+		exp = redis.KeepTTL
+	default:
+		exp = expTime.Sub(now)
+	}
+	return exp
+}
+
+func (c *client[K, V]) doTrace(op string, write bool, keys ...string) func(error) {
+	eventID := c.traceStart(op, write, keys...)
+	return func(err error) {
+		c.traceEnd(eventID, err)
+	}
+}
+
+func (c *client[K, V]) traceStart(op string, write bool, keys ...string) (eventID model.TraceEventID) {
+	if curr := c.rt.Current(); curr.Trace != nil && curr.Req != nil {
+		eventID = curr.Trace.CacheCallStart(trace2.CacheCallStartParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+				DefLoc:  c.cfg.EncoreInternal_DefLoc,
+			},
+			Operation: op,
+			IsWrite:   write,
+			Keys:      keys,
+			Stack:     stack.Build(3),
+		})
+	}
+
+	return eventID
+}
+
+func (c *client[K, V]) traceEnd(startEventID model.TraceEventID, err error, values ...any) {
+	if startEventID == 0 { // indicates the operation start was not traced
+		return
+	}
+
+	if curr := c.rt.Current(); curr.Trace != nil && curr.Req != nil {
+		var cacheErr error
+		var res trace2.CacheCallResult
+		switch {
+		case err == nil:
+			res = trace2.CacheOK
+		case errors.Is(err, Miss):
+			res = trace2.CacheNoSuchKey
+		case errors.Is(err, KeyExists):
+			res = trace2.CacheConflict
+		case err != nil:
+			res = trace2.CacheErr
+			cacheErr = err
+		}
+
+		curr.Trace.CacheCallEnd(trace2.CacheCallEndParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+			},
+			StartID: startEventID,
+			Res:     res,
+			Err:     cacheErr,
+		})
+	}
+}
+
+type errWrapper struct {
+	err error
+}
+
+func (ew errWrapper) Error() string {
+	return ew.err.Error()
+}
+
+func (ew errWrapper) Unwrap() error {
+	return ew.err
+}
+
+func toErr(err error, op, key string) error {
+	if err == nil {
+		return nil
+	}
+
+	// Convert redis.Nil to cache.Miss.
+	if errors.Is(err, redis.Nil) {
+		err = Miss
+	}
+
+	// Is it already an OpError? If so, do nothing.
+	var opErr *OpError
+	if errors.As(err, &opErr) {
+		return err
+	}
+
+	err = &OpError{Operation: op, RawKey: key, Err: err}
+
+	// Wrap the error in an opaque type to ensure callers check for errors
+	// with errors.Is and errors.As.
+	return errWrapper{err}
+}
+
+func toErr2[T any](val T, err error, op, key string) (T, error) {
+	return val, toErr(err, op, key)
+}
+
+func orDefault[T comparable](val, orDefault T) T {
+	var zero T
+	if val == zero {
+		return orDefault
+	}
+	return val
+}
+
+func miniredisCleanup(srv *miniredis.Miniredis, every time.Duration, maxKeys int) {
+	var acc time.Duration
+	ticker := time.NewTicker(time.Second)
+	for range ticker.C {
+		srv.FastForward(time.Second)
+
+		// Clean up keys every so often
+		acc += every
+		if acc > every {
+			acc -= every
+
+			keys := srv.Keys()
+			for len(keys) > 100 {
+				id := mathrand.Intn(len(keys))
+				if keys[id] != "" {
+					srv.Del(keys[id])
+					keys[id] = "" // mark it as deleted
+				}
+			}
+		}
+	}
+}
diff --git a/runtimes/go/storage/cache/noop_internal.go b/runtimes/go/storage/cache/noop_internal.go
new file mode 100644
index 0000000000..bba3a6c065
--- /dev/null
+++ b/runtimes/go/storage/cache/noop_internal.go
@@ -0,0 +1,47 @@
+package cache
+
+import (
+	"context"
+	"errors"
+	"net"
+
+	"github.com/go-redis/redis/v8"
+)
+
+var ErrNoopClient = errors.New(
+	"cache: this service is not configured to use this cache",
+)
+
+func newNoopClient() *redis.Client {
+	client := redis.NewClient(&redis.Options{
+		MinIdleConns: 0,
+		Dialer: func(ctx context.Context, network, addr string) (net.Conn, error) {
+			return nil, ErrNoopClient
+		},
+		OnConnect: func(ctx context.Context, cn *redis.Conn) error {
+			return ErrNoopClient
+		},
+	})
+
+	client.AddHook(&noopHook{})
+
+	return client
+}
+
+type noopHook struct{}
+
+func (n *noopHook) BeforeProcess(ctx context.Context, cmd redis.Cmder) (context.Context, error) {
+	return nil, ErrNoopClient
+}
+
+func (n *noopHook) AfterProcess(ctx context.Context, cmd redis.Cmder) error {
+	return ErrNoopClient
+}
+
+func (n *noopHook) BeforeProcessPipeline(ctx context.Context, cmds []redis.Cmder) (context.Context, error) {
+	return nil, ErrNoopClient
+}
+
+func (n *noopHook) AfterProcessPipeline(ctx context.Context, cmds []redis.Cmder) error {
+	return ErrNoopClient
+}
diff --git a/runtimes/go/storage/cache/pkgfn.go b/runtimes/go/storage/cache/pkgfn.go
new file mode 100644
index 0000000000..1e511f361a
--- /dev/null
+++ b/runtimes/go/storage/cache/pkgfn.go
@@ -0,0 +1,14 @@
+//go:build encore_app
+
+package cache
+
+// NewCluster declares a new cache cluster.
+//
+// See https://encore.dev/docs/develop/caching for more information.
+func NewCluster(name string, cfg ClusterConfig) *Cluster {
+	return &Cluster{
+		cfg: cfg,
+		mgr: Singleton,
+		cl:  Singleton.getClient(name),
+	}
+}
diff --git a/runtimes/go/storage/cache/set.go b/runtimes/go/storage/cache/set.go
new file mode 100644
index 0000000000..993f937a6d
--- /dev/null
+++ b/runtimes/go/storage/cache/set.go
@@ -0,0 +1,583 @@
+package cache
+
+import (
+	"context"
+	"errors"
+
+	"github.com/go-redis/redis/v8"
+)
+
+// NewSetKeyspace creates a keyspace that stores unordered sets in the given cluster.
+//
+// The type parameter K specifies the key type, which can either be a
+// named struct type or a basic type (string, int, etc).
+//
+// The type parameter V specifies the value type, which is the type
+// of the elements in each set. It must be a basic type (string, int, int64, or float64).
+func NewSetKeyspace[K any, V BasicType](cluster *Cluster, cfg KeyspaceConfig) *SetKeyspace[K, V] {
+	fromRedis := basicFromRedisFactory[V]()
+	toRedis := basicToRedisFactory[V]()
+
+	return &SetKeyspace[K, V]{
+		newClient[K, V](cluster, cfg, fromRedis, toRedis),
+	}
+}
+
+// SetKeyspace represents a set of cache keys,
+// each containing an unordered set of values of type V.
+type SetKeyspace[K any, V BasicType] struct {
+	*client[K, V]
+}
+
+// With returns a reference to the same keyspace but with customized write options.
+// The primary use case is for overriding the expiration time for certain cache operations.
+//
+// It is intended to be used with method chaining:
+//
+//	myKeyspace.With(cache.ExpireIn(3 * time.Second)).Set(...)
+func (k *SetKeyspace[K, V]) With(opts ...WriteOption) *SetKeyspace[K, V] {
+	return &SetKeyspace[K, V]{k.client.with(opts)}
+}
+
+// Delete deletes the specified keys.
+//
+// If a key does not exist it is ignored.
+//
+// It reports the number of keys that were deleted.
+//
+// See https://redis.io/commands/del/ for more information.
+func (s *SetKeyspace[K, V]) Delete(ctx context.Context, keys ...K) (deleted int, err error) {
+	return s.client.Delete(ctx, keys...)
+}
+
+// Add adds one or more values to the set stored at key.
+// If the key does not already exist, it is first created as an empty set.
+//
+// It reports the number of values that were added to the set,
+// not including values already present beforehand.
+//
+// See https://redis.io/commands/sadd/ for more information.
+func (s *SetKeyspace[K, V]) Add(ctx context.Context, key K, values ...V) (added int, err error) {
+	const op = "set add"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	vals := fnMap(values, func(v V) any { return v })
+	res, err := do(s.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.SAdd(ctx, k, vals...)
+	}).Result()
+
+	err = toErr(err, op, k)
+	return int(res), err
+}
+
+// Remove removes one or more values from the set stored at key.
+//
+// If a value is not present in the set is it ignored.
+//
+// Remove reports the number of values that were removed from the set.
+// If the key does not already exist, it is a no-op and reports 0, nil.
+//
+// See https://redis.io/commands/srem/ for more information.
+func (s *SetKeyspace[K, V]) Remove(ctx context.Context, key K, values ...V) (removed int, err error) {
+	const op = "set remove"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	vals := fnMap(values, func(v V) any { return v })
+	res, err := do(s.client, ctx, k, func(c cmdable) *redis.IntCmd {
+		return c.SRem(ctx, k, vals...)
+	}).Result()
+
+	err = toErr(err, op, k)
+	return int(res), err
+}
+
+// PopOne removes a random element from the set stored at key and returns it.
+//
+// If the set is empty it reports an error matching Miss.
+//
+// See https://redis.io/commands/spop/ for more information.
+func (s *SetKeyspace[K, V]) PopOne(ctx context.Context, key K) (val V, err error) {
+	const op = "set pop one"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return val, err
+	}
+
+	res, err := do(s.client, ctx, k, func(c cmdable) *redis.StringCmd {
+		return c.SPop(ctx, k)
+	}).Result()
+
+	if err == nil {
+		val, err = s.fromRedis(res)
+	}
+	err = toErr(err, op, k)
+	return val, err
+}
+
+// Pop removes up to 'count' random elements (bounded by the set's size)
+// from the set stored at key and returns them.
+//
+// If the set is empty it returns an empty slice and no error.
+//
+// See https://redis.io/commands/spop/ for more information.
+func (s *SetKeyspace[K, V]) Pop(ctx context.Context, key K, count int) (values []V, err error) {
+	const op = "set pop"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, true, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := do(s.client, ctx, k, func(c cmdable) *redis.StringSliceCmd {
+		return c.SPopN(ctx, k, int64(count))
+	}).Result()
+
+	if err == nil {
+		values, err = s.fromRedisMulti(res)
+	}
+	err = toErr(err, op, k)
+	return values, err
+}
+
+// Contains reports whether the set stored at key contains the given value.
+//
+// If the key does not exist it reports false, nil.
+//
+// See https://redis.io/commands/sismember/ for more information.
+func (s *SetKeyspace[K, V]) Contains(ctx context.Context, key K, val V) (contains bool, err error) {
+	const op = "set contains"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return false, err
+	}
+
+	res, err := s.redis.SIsMember(ctx, k, val).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// Len reports the number of elements in the set stored at key.
+//
+// If the key does not exist it reports 0, nil.
+//
+// See https://redis.io/commands/slen/ for more information.
+func (s *SetKeyspace[K, V]) Len(ctx context.Context, key K) (length int64, err error) {
+	const op = "set len"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := s.redis.SCard(ctx, k).Result()
+	err = toErr(err, op, k)
+	return res, err
+}
+
+// Items returns the elements in the set stored at key.
+//
+// If the key does not exist it returns an empty slice and no error.
+//
+// See https://redis.io/commands/smembers/ for more information.
+func (s *SetKeyspace[K, V]) Items(ctx context.Context, key K) (values []V, err error) {
+	const op = "set items"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return nil, err
+	}
+	res, err := s.items(ctx, op, k)
+	if err != nil {
+		return nil, err
+	}
+	return s.toSlice(res, op, k)
+}
+
+// ItemsMap is identical to Items except it returns the values as a map.
+//
+// If the key does not exist it returns an empty (but non-nil) map and no error.
+//
+// See https://redis.io/commands/smembers/ for more information.
+func (s *SetKeyspace[K, V]) ItemsMap(ctx context.Context, key K) (values map[V]struct{}, err error) {
+	const op = "set items"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return nil, err
+	}
+
+	res, err := s.items(ctx, op, k)
+	if err != nil {
+		return nil, err
+	}
+	return s.toMap(res, op, k)
+}
+
+func (s *SetKeyspace[K, V]) items(ctx context.Context, op, key string) ([]string, error) {
+	res, err := s.redis.SMembers(ctx, key).Result()
+	err = toErr(err, op, key)
+	return res, err
+}
+
+// Diff computes the set difference, between the first set and all the consecutive sets.
+//
+// Set difference means the values present in the first set that are not present
+// in any of the other sets.
+//
+// Keys that do not exist are considered as empty sets.
+//
+// At least one key must be provided: if no keys are provided an error is reported.
+//
+// See https://redis.io/commands/sdiff/ for more information.
+func (s *SetKeyspace[K, V]) Diff(ctx context.Context, keys ...K) ([]V, error) {
+	const op = "set diff"
+	res, firstKey, err := s.diff(ctx, op, keys)
+	if err != nil {
+		return nil, err
+	}
+	return s.toSlice(res, op, firstKey)
+}
+
+// DiffMap is identical to Diff except it returns the values as a map.
+//
+// See https://redis.io/commands/sdiff/ for more information.
+func (s *SetKeyspace[K, V]) DiffMap(ctx context.Context, keys ...K) (map[V]struct{}, error) {
+	const op = "set diff"
+	res, firstKey, err := s.diff(ctx, op, keys)
+	if err != nil {
+		return nil, err
+	}
+	return s.toMap(res, op, firstKey)
+}
+
+func (s *SetKeyspace[K, V]) diff(ctx context.Context, op string, keys []K) (vals []string, firstKey string, err error) {
+	ks, err := s.keys(keys, op)
+	endTrace := s.doTrace(op, false, ks...)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return nil, "", err
+	}
+	if len(ks) > 0 {
+		firstKey = ks[0]
+	}
+
+	vals, err = s.redis.SDiff(ctx, ks...).Result()
+	return vals, firstKey, toErr(err, op, firstKey)
+}
+
+// DiffStore computes the set difference between keys (like Diff) and stores the result in destination.
+//
+// It reports the size of the resulting set.
+//
+// See https://redis.io/commands/sdiffstore/ for more information.
+func (s *SetKeyspace[K, V]) DiffStore(ctx context.Context, destination K, keys ...K) (size int64, err error) {
+	const op = "store set diff"
+	dst, err := s.key(destination, op)
+	endTrace := s.doTrace(op, true, dst)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+
+	ks, err := s.keys(keys, op)
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := do(s.client, ctx, dst, func(c cmdable) *redis.IntCmd {
+		return c.SDiffStore(ctx, dst, ks...)
+	}).Result()
+
+	err = toErr(err, op, dst)
+	return res, err
+}
+
+// Intersect computes the set intersection between the sets stored at the given keys.
+//
+// Set intersection means the values common to all the provided sets.
+//
+// Keys that do not exist are considered to be empty sets.
+// As a result, if any key is missing the final result is the empty set.
+//
+// At least one key must be provided: if no keys are provided an error is reported.
+//
+// See https://redis.io/commands/sinter/ for more information.
+func (s *SetKeyspace[K, V]) Intersect(ctx context.Context, keys ...K) ([]V, error) {
+	const op = "intersect"
+	res, firstKey, err := s.intersect(ctx, op, keys)
+	if err != nil {
+		return nil, err
+	}
+	return s.toSlice(res, op, firstKey)
+}
+
+// IntersectMap is identical to Intersect except it returns the values as a map.
+//
+// See https://redis.io/commands/sinter/ for more information.
+func (s *SetKeyspace[K, V]) IntersectMap(ctx context.Context, keys ...K) (map[V]struct{}, error) {
+	const op = "intersect"
+	res, firstKey, err := s.intersect(ctx, op, keys)
+	if err != nil {
+		return nil, err
+	}
+	return s.toMap(res, op, firstKey)
+}
+
+func (s *SetKeyspace[K, V]) intersect(ctx context.Context, op string, keys []K) (vals []string, firstKey string, err error) {
+	ks, err := s.keys(keys, op)
+	endTrace := s.doTrace(op, false, ks...)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return nil, "", err
+	}
+	if len(ks) > 0 {
+		firstKey = ks[0]
+	}
+
+	res, err := s.redis.SInter(ctx, ks...).Result()
+	err = toErr(err, op, firstKey)
+	return res, firstKey, err
+}
+
+// IntersectStore computes the set intersection between keys (like Intersect) and stores the result in destination.
+//
+// It reports the size of the resulting set.
+//
+// See https://redis.io/commands/sinterstore/ for more information.
+func (s *SetKeyspace[K, V]) IntersectStore(ctx context.Context, destination K, keys ...K) (size int64, err error) {
+	const op = "store set intersect"
+	dst, err := s.key(destination, op)
+	endTrace := s.doTrace(op, true, dst)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+	ks, err := s.keys(keys, op)
+	if err != nil {
+		return 0, err
+	}
+
+	res, err := do(s.client, ctx, dst, func(c cmdable) *redis.IntCmd {
+		return c.SInterStore(ctx, dst, ks...)
+	}).Result()
+	err = toErr(err, op, dst)
+	return res, err
+}
+
+// Union computes the set union between the sets stored at the given keys.
+//
+// Set union means the values present in at least one of the provided sets.
+//
+// Keys that do not exist are considered to be empty sets.
+//
+// At least one key must be provided: if no keys are provided an error is reported.
+//
+// See https://redis.io/commands/sunion/ for more information.
+func (s *SetKeyspace[K, V]) Union(ctx context.Context, keys ...K) ([]V, error) {
+	const op = "union"
+	res, firstKey, err := s.union(ctx, op, keys)
+	if err != nil {
+		return nil, err
+	}
+	return s.toSlice(res, op, firstKey)
+}
+
+// UnionMap is identical to Union except it returns the values as a map.
+//
+// See https://redis.io/commands/sunion/ for more information.
+func (s *SetKeyspace[K, V]) UnionMap(ctx context.Context, keys ...K) (map[V]struct{}, error) {
+	const op = "union"
+	res, firstKey, err := s.union(ctx, op, keys)
+	if err != nil {
+		return nil, err
+	}
+	return s.toMap(res, op, firstKey)
+}
+
+func (s *SetKeyspace[K, V]) union(ctx context.Context, op string, keys []K) (vals []string, firstKey string, err error) {
+	ks, err := s.keys(keys, op)
+	endTrace := s.doTrace(op, false, ks...)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return nil, "", err
+	}
+
+	if len(ks) > 0 {
+		firstKey = ks[0]
+	}
+
+	res, err := s.redis.SUnion(ctx, ks...).Result()
+	err = toErr(err, op, firstKey)
+	return res, firstKey, err
+}
+
+// UnionStore computes the set union between sets (like Union) and stores the result in destination.
+//
+// It reports the size of the resulting set.
+//
+// See https://redis.io/commands/sunionstore/ for more information.
+func (s *SetKeyspace[K, V]) UnionStore(ctx context.Context, destination K, keys ...K) (size int64, err error) {
+	const op = "store set union"
+	dst, err := s.key(destination, op)
+	endTrace := s.doTrace(op, true, dst)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return 0, err
+	}
+	ks, err := s.keys(keys, op)
+	if err != nil {
+		return 0, err
+	}
+	res, err := do(s.client, ctx, dst, func(c cmdable) *redis.IntCmd {
+		return c.SUnionStore(ctx, dst, ks...)
+	}).Result()
+	err = toErr(err, op, dst)
+	return res, err
+}
+
+// SampleOne returns a random member from the set stored at key.
+//
+// If the key does not exist it reports an error matching Miss.
+//
+// See https://redis.io/commands/srandmember/ for more information.
+func (s *SetKeyspace[K, V]) SampleOne(ctx context.Context, key K) (val V, err error) {
+	const op = "set sample one"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return val, err
+	}
+
+	res, err := s.redis.SRandMember(ctx, k).Result()
+	if err == nil {
+		val, err = s.fromRedis(res)
+	}
+	err = toErr(err, op, k)
+	return val, err
+}
+
+// Sample returns up to 'count' distinct random elements from the set stored at key.
+// The same element is never returned multiple times.
+//
+// If the key does not exist it returns an empty slice and no error.
+//
+// See https://redis.io/commands/srandmember/ for more information.
+func (s *SetKeyspace[K, V]) Sample(ctx context.Context, key K, count int) (values []V, err error) {
+	const op = "set sample one"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return nil, err
+	}
+
+	if count < 0 {
+		err = toErr(errors.New("negative count"), op, k)
+		return nil, err
+	} else if count == 0 {
+		return nil, nil
+	}
+
+	res, err := s.redis.SRandMemberN(ctx, k, int64(count)).Result()
+	if err == nil {
+		values, err = s.fromRedisMulti(res)
+	}
+	err = toErr(err, op, k)
+	return values, err
+}
+
+// SampleWithReplacement returns count random elements from the set stored at key.
+// The same element may be returned multiple times.
+//
+// If the key does not exist it returns an empty slice and no error.
+//
+// See https://redis.io/commands/srandmember/ for more information.
+func (s *SetKeyspace[K, V]) SampleWithReplacement(ctx context.Context, key K, count int) (values []V, err error) {
+	const op = "set sample with replacement"
+	k, err := s.key(key, op)
+	endTrace := s.doTrace(op, false, k)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return nil, err
+	}
+
+	if count < 0 {
+		err = toErr(errors.New("negative count"), op, k)
+		return nil, err
+	} else if count == 0 {
+		return nil, nil
+	}
+
+	res, err := s.redis.SRandMemberN(ctx, k, -int64(count)).Result()
+	if err == nil {
+		values, err = s.fromRedisMulti(res)
+	}
+	err = toErr(err, op, k)
+	return values, err
+}
+
+// Move atomically moves the given value from the set stored at src
+// to the set stored at dst.
+//
+// If the element does not exist in src it reports false, nil.
+//
+// If the element already exists in dst it is still removed from src
+// and Move still reports true, nil.
+func (s *SetKeyspace[K, V]) Move(ctx context.Context, src, dst K, val V) (moved bool, err error) {
+	const op = "move"
+	ks, err := s.keys([]K{src, dst}, op)
+	endTrace := s.doTrace(op, true, ks...)
+	defer func() { endTrace(err) }()
+	if err != nil {
+		return false, err
+	}
+
+	srcKey, dstKey := ks[0], ks[1]
+	res, err := do2(s.client, ctx, srcKey, dstKey, func(c cmdable) *redis.BoolCmd {
+		return c.SMove(ctx, srcKey, dstKey, val)
+	}).Result()
+	return res, toErr(err, op, srcKey)
+}
+
+func (s *SetKeyspace[K, V]) toSlice(res []string, op, key string) ([]V, error) {
+	ret := make([]V, len(res))
+	for i, r := range res {
+		val, err := s.fromRedis(r)
+		if err != nil {
+			return nil, toErr(err, op, key)
+		}
+		ret[i] = val
+	}
+	return ret, nil
+}
+
+func (s *SetKeyspace[K, V]) toMap(res []string, op, key string) (map[V]struct{}, error) {
+	ret := make(map[V]struct{}, len(res))
+	for _, r := range res {
+		val, err := s.fromRedis(r)
+		if err != nil {
+			return nil, toErr(err, op, key)
+		}
+		ret[val] = struct{}{}
+	}
+	return ret, nil
+}
diff --git a/runtimes/go/storage/cache/set_test.go b/runtimes/go/storage/cache/set_test.go
new file mode 100644
index 0000000000..f824ebd33b
--- /dev/null
+++ b/runtimes/go/storage/cache/set_test.go
@@ -0,0 +1,201 @@
+package cache
+
+import (
+	"context"
+	"errors"
+	"reflect"
+	"sort"
+	"testing"
+
+	"github.com/alicebob/miniredis/v2"
+)
+
+func TestSets(t *testing.T) {
+	kt := newSetTest(t)
+	ks, ctx := kt.ks, kt.ctx
+
+	if got, want := kt.Add("one", "a", "b"), 2; got != want {
+		t.Errorf("Add() = %d, want %d", got, want)
+	}
+	kt.Val("one", "a", "b")
+	if got, want := kt.Remove("one", "b", "c"), 1; got != want {
+		t.Errorf("Remove() = %d, want %d", got, want)
+	}
+	kt.Val("one", "a")
+
+	{
+		got := must(ks.SampleWithReplacement(ctx, "one", 3))
+		checkSorted(t, got, "a", "a", "a")
+	}
+
+	if got, want := must(ks.SampleOne(ctx, "one")), "a"; got != want {
+		t.Errorf("SampleOne: got %v, want %v", got, want)
+	}
+	if got, want := must(ks.PopOne(ctx, "one")), "a"; got != want {
+		t.Errorf("PopOne: got %v, want %v", got, want)
+	}
+	if _, err := ks.SampleOne(ctx, "one"); !errors.Is(err, Miss) {
+		t.Errorf("SampleOne: got err %v, want %v", err, Miss)
+	}
+	if _, err := ks.PopOne(ctx, "one"); !errors.Is(err, Miss) {
+		t.Errorf("PopOne: got err %v, want %v", err, Miss)
+	}
+
+	kt.Add("one", "a", "b")
+	kt.Contains("one", "a")
+	kt.Missing("one", "c")
+	if got, want := kt.Add("one", "a", "b", "c"), 1; got != want {
+		t.Errorf("Add() = %d, want %d", got, want)
+	}
+
+	checkSetMap(t, must(ks.ItemsMap(ctx, "one")), "a", "b", "c")
+
+	if got, want := must(ks.Len(ctx, "one")), int64(3); got != want {
+		t.Errorf("Len() = %d, want %d", got, want)
+	}
+
+	{
+		got := must(ks.Sample(ctx, "one", 3))
+		checkSorted(t, got, "a", "b", "c")
+	}
+
+	{
+		got := must(ks.Pop(ctx, "one", 3))
+		checkSorted(t, got, "a", "b", "c")
+	}
+
+	{
+		kt.Add("D1", "a", "b", "c")
+		kt.Add("D2", "c", "d", "e")
+		got := must(ks.Diff(ctx, "D1", "D2"))
+		want := []string{"a", "b"}
+		checkSorted(t, got, want...)
+		checkSetMap(t, must(ks.DiffMap(ctx, "D1", "D2")), want...)
+		if got, want := must(ks.DiffStore(ctx, "D3", "D1", "D2")), int64(len(want)); got != want {
+			t.Errorf("DiffStore: got %v, want %v", got, want)
+		}
+		kt.Val("D3", want...)
+	}
+
+	{
+		kt.Add("I1", "a", "b", "c")
+		kt.Add("I2", "c", "d", "e")
+		got := must(ks.Intersect(ctx, "I1", "I2"))
+		want := []string{"c"}
+		checkSorted(t, got, want...)
+		checkSetMap(t, must(ks.IntersectMap(ctx, "I1", "I2")), want...)
+		if got, want := must(ks.IntersectStore(ctx, "I3", "I1", "I2")), int64(len(want)); got != want {
+			t.Errorf("IntersectStore: got %v, want %v", got, want)
+		}
+		kt.Val("I3", want...)
+	}
+
+	{
+		kt.Add("U1", "a", "b", "c")
+		kt.Add("U2", "c", "d", "e")
+		got := must(ks.Union(ctx, "U1", "U2"))
+		want := []string{"a", "b", "c", "d", "e"}
+		checkSorted(t, got, want...)
+		checkSetMap(t, must(ks.UnionMap(ctx, "U1", "U2")), want...)
+		if got, want := must(ks.UnionStore(ctx, "U3", "U1", "U2")), int64(len(want)); got != want {
+			t.Errorf("UnionStore: got %v, want %v", got, want)
+		}
+		kt.Val("U3", want...)
+	}
+
+	{
+		kt.Add("M1", "a", "b", "c")
+		kt.Add("M2", "a")
+
+		must(ks.Move(ctx, "M1", "M2", "a"))
+		kt.Val("M1", "b", "c")
+		kt.Val("M2", "a")
+
+		must(ks.Move(ctx, "M1", "M2", "b"))
+		kt.Val("M1", "c")
+		kt.Val("M2", "a", "b")
+	}
+}
+
+func checkSorted(t *testing.T, got []string, want ...string) {
+	t.Helper()
+	sort.Strings(got)
+	if !reflect.DeepEqual(got, want) {
+		t.Errorf("got %v, want %v", got, want)
+	}
+}
+
+func checkSetMap(t *testing.T, got map[string]struct{}, want ...string) {
+	t.Helper()
+	if len(got) != len(want) {
+		t.Errorf("got %d items, want %d", len(got), len(want))
+		return
+	}
+	for _, w := range want {
+		if _, ok := got[w]; !ok {
+			t.Errorf("wanted key %q, not found", w)
+		}
+	}
+}
+
+func newSetTest(t *testing.T) *setTester {
+	cluster, srv := newTestCluster(t)
+	ks := NewSetKeyspace[string, string](cluster, KeyspaceConfig{
+		EncoreInternal_KeyMapper: func(s string) string { return s },
+	})
+	ctx := context.Background()
+	return &setTester{t: t, ctx: ctx, ks: ks, srv: srv}
+}
+
+type setTester struct {
+	t   *testing.T
+	ctx context.Context
+	ks  *SetKeyspace[string, string]
+	srv *miniredis.Miniredis
+}
+
+func (t *setTester) Add(key string, val ...string) int {
+	t.t.Helper()
+	numAdded, err := t.ks.Add(t.ctx, key, val...)
+	if err != nil {
+		t.t.Errorf("Add(%q, %v+) = %v, want nil", key, val, err)
+	}
+	return numAdded
+}
+
+func (t *setTester) Remove(key string, val ...string) int {
+	t.t.Helper()
+	numRemoved, err := t.ks.Remove(t.ctx, key, val...)
+	if err != nil {
+		t.t.Errorf("Remove(%q, %+v) = %v, want nil", key, val, err)
+	}
+	return int(numRemoved)
+}
+
+func (t *setTester) Contains(key string, val string) {
+	t.t.Helper()
+	if ok, err := t.ks.Contains(t.ctx, key, val); err != nil {
+		t.t.Errorf("Contains(%q, %q) = %v, want nil", key, val, err)
+	} else if !ok {
+		t.t.Errorf("key %q: value %q is missing in the set", key, val)
+	}
+}
+
+func (t *setTester) Missing(key string, val string) {
+	t.t.Helper()
+	if ok, err := t.ks.Contains(t.ctx, key, val); err != nil {
+		t.t.Errorf("Contains(%q, %q) = %v, want nil", key, val, err)
+	} else if ok {
+		t.t.Errorf("key %q: value %q is present in the set", key, val)
+	}
+}
+
+func (t *setTester) Val(key string, want ...string) {
+	t.t.Helper()
+	got := must(t.ks.Items(t.ctx, key))
+	sort.Strings(want)
+	sort.Strings(got)
+	if !reflect.DeepEqual(got, want) {
+		t.t.Errorf("key %s: got %+v, want %+v", key, got, want)
+	}
+}
diff --git a/runtimes/go/storage/cache/struct.go b/runtimes/go/storage/cache/struct.go
new file mode 100644
index 0000000000..7dd797e113
--- /dev/null
+++ b/runtimes/go/storage/cache/struct.go
@@ -0,0 +1,100 @@
+package cache
+
+import "context"
+
+// NewStructKeyspace creates a keyspace that stores structs in the given cluster.
+//
+// The type parameter K specifies the key type, which can either be a
+// named struct type or a basic type (string, int, etc).
+//
+// The value parameter V specifies the named struct type that should be stored.
+func NewStructKeyspace[K, V any](cluster *Cluster, cfg KeyspaceConfig) *StructKeyspace[K, V] {
+	json := cluster.mgr.json
+	fromRedis := func(val string) (V, error) {
+		var v V
+		err := json.UnmarshalFromString(val, &v)
+		return v, err
+	}
+	toRedis := func(val V) (any, error) {
+		return json.MarshalToString(val)
+	}
+
+	return &StructKeyspace[K, V]{
+		&basicKeyspace[K, V]{
+			newClient[K, V](cluster, cfg, fromRedis, toRedis),
+		},
+	}
+}
+
+// StructKeyspace represents a set of cache keys that hold struct values.
+type StructKeyspace[K, V any] struct {
+	*basicKeyspace[K, V]
+}
+
+// With returns a reference to the same keyspace but with customized write options.
+// The primary use case is for overriding the expiration time for certain cache operations.
+//
+// It is intended to be used with method chaining:
+//
+//	myKeyspace.With(cache.ExpireIn(3 * time.Second)).Set(...)
+func (k *StructKeyspace[K, V]) With(opts ...WriteOption) *StructKeyspace[K, V] {
+	return &StructKeyspace[K, V]{k.basicKeyspace.with(opts)}
+}
+
+// Get gets the value stored at key.
+// If the key does not exist, it returns an error matching Miss.
+//
+// See https://redis.io/commands/get/ for more information.
+func (s *StructKeyspace[K, V]) Get(ctx context.Context, key K) (V, error) {
+	return s.basicKeyspace.Get(ctx, key)
+}
+
+// Set updates the value stored at key to val.
+//
+// See https://redis.io/commands/set/ for more information.
+func (s *StructKeyspace[K, V]) Set(ctx context.Context, key K, val V) error {
+	return s.basicKeyspace.Set(ctx, key, val)
+}
+
+// SetIfNotExists sets the value stored at key to val, but only if the key does not exist beforehand.
+// If the key already exists, it reports an error matching KeyExists.
+//
+// See https://redis.io/commands/setnx/ for more information.
+func (s *StructKeyspace[K, V]) SetIfNotExists(ctx context.Context, key K, val V) error {
+	return s.basicKeyspace.SetIfNotExists(ctx, key, val)
+}
+
+// Replace replaces the existing value stored at key to val.
+// If the key does not already exist, it reports an error matching Miss.
+//
+// See https://redis.io/commands/set/ for more information.
+func (s *StructKeyspace[K, V]) Replace(ctx context.Context, key K, val V) error {
+	return s.basicKeyspace.Replace(ctx, key, val)
+}
+
+// GetAndSet updates the value of key to val and returns the previously stored value.
+// If the key does not already exist, it sets it and returns 0, nil.
+//
+// See https://redis.io/commands/getset/ for more information.
+func (s *StructKeyspace[K, V]) GetAndSet(ctx context.Context, key K, val V) (oldVal V, err error) {
+	return s.basicKeyspace.GetAndSet(ctx, key, val)
+}
+
+// GetAndDelete deletes the key and returns the previously stored value.
+// If the key does not already exist, it does nothing and returns the zero value of V and nil.
+//
+// See https://redis.io/commands/getdel/ for more information.
+func (s *StructKeyspace[K, V]) GetAndDelete(ctx context.Context, key K) (oldVal V, err error) {
+	return s.basicKeyspace.GetAndDelete(ctx, key)
+}
+
+// Delete deletes the specified keys.
+//
+// If a key does not exist it is ignored.
+//
+// It reports the number of keys that were deleted.
+//
+// See https://redis.io/commands/del/ for more information.
+func (s *StructKeyspace[K, V]) Delete(ctx context.Context, keys ...K) (deleted int, err error) {
+	return s.client.Delete(ctx, keys...)
+}
diff --git a/runtimes/go/storage/cache/zzz_singleton_internal.go b/runtimes/go/storage/cache/zzz_singleton_internal.go
new file mode 100644
index 0000000000..0ae1244093
--- /dev/null
+++ b/runtimes/go/storage/cache/zzz_singleton_internal.go
@@ -0,0 +1,24 @@
+//go:build encore_app
+
+package cache
+
+import (
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/jsonapi"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/appruntime/shared/testsupport"
+)
+
+// Initialize the singleton instance.
+// NOTE: This file is named zzz_singleton_internal.go so that
+// the init function is initialized after all the providers
+// have been registered.
+
+//publicapigen:drop
+var Singleton *Manager
+
+func init() {
+	Singleton = NewManager(appconf.Static, appconf.Runtime, reqtrack.Singleton, testsupport.Singleton, jsonapi.Default)
+	shutdown.Singleton.RegisterShutdownHandler(Singleton.Shutdown)
+}
diff --git a/runtimes/go/storage/objects/bucket.go b/runtimes/go/storage/objects/bucket.go
new file mode 100644
index 0000000000..434fb12106
--- /dev/null
+++ b/runtimes/go/storage/objects/bucket.go
@@ -0,0 +1,734 @@
+package objects
+
+import (
+	"context"
+	"errors"
+	"iter"
+	"net/url"
+	"strings"
+	"time"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/storage/objects/internal/providers/noop"
+	"encore.dev/storage/objects/internal/types"
+)
+
+// Bucket represents an object storage bucket, containing a set of files.
+//
+// See NewBucket for more information on how to declare a Bucket.
+type Bucket struct {
+	mgr        *Manager
+	runtimeCfg *config.Bucket // The config for this running instance of the application
+	impl       types.BucketImpl
+	name       string
+
+	// Prefix to prepend to all cloud names.
+	baseCloudPrefix string
+
+	// publicBaseURL, if the bucket is public
+	publicBaseURL *url.URL
+}
+
+// BucketConfig is the configuration for a Bucket.
+type BucketConfig struct {
+	// Whether objects in the bucket should be publicly accessible, via CDN.
+	Public bool
+
+	// Whether objects stored in the bucket should be versioned.
+	//
+	// If true, the bucket will store multiple versions of each object
+	// whenever it changes, as opposed to overwriting the old version.
+	Versioned bool
+}
+
+func newBucket(mgr *Manager, name string) *Bucket {
+	// Look up the bkt configuration
+	bkt, ok := mgr.runtime.Buckets[name]
+	if !ok {
+		// No runtime config; return the noop implementation.
+		return &Bucket{
+			mgr:        mgr,
+			runtimeCfg: &config.Bucket{EncoreName: name},
+			impl:       &noop.BucketImpl{},
+			name:       name,
+		}
+	}
+
+	// Look up the provider config
+	provider := mgr.runtime.BucketProviders[bkt.ProviderID]
+
+	tried := make([]string, 0, len(mgr.providers))
+	for _, p := range mgr.providers {
+		if p.Matches(provider) {
+			impl := p.NewBucket(provider, bkt)
+
+			var publicBaseURL *url.URL
+			if bkt.PublicBaseURL != "" {
+				var err error
+				publicBaseURL, err = url.Parse(bkt.PublicBaseURL)
+				if err != nil {
+					mgr.rootLogger.Fatal().Msgf("invalid public base url for bucket %s: %v", name, err)
+				}
+			}
+
+			return &Bucket{
+				mgr:             mgr,
+				runtimeCfg:      bkt,
+				impl:            impl,
+				name:            name,
+				baseCloudPrefix: bkt.KeyPrefix,
+				publicBaseURL:   publicBaseURL,
+			}
+		}
+
+		tried = append(tried, p.ProviderName())
+	}
+
+	mgr.rootLogger.Fatal().Msgf("unsupported Object Storage provider for provider[%d], tried: %v",
+		bkt.ProviderID, tried)
+	panic("unreachable")
+}
+
+// Upload uploads a new object to the bucket.
+//
+// The returned writer must be successfully closed for the upload to complete.
+// To abort the upload, call (*Writer).Abort or cancel the provided context.
+func (b *Bucket) Upload(ctx context.Context, object string, options ...UploadOption) *Writer {
+	var opt uploadOptions
+	for _, o := range options {
+		o.applyUpload(&opt)
+	}
+
+	w := &Writer{
+		bkt: b,
+		ctx: ctx,
+		obj: object,
+		opt: opt,
+	}
+
+	curr := b.mgr.rt.Current()
+	if curr.Req != nil && curr.Trace != nil {
+		w.curr = curr
+		w.startEventID = curr.Trace.BucketObjectUploadStart(trace2.BucketObjectUploadStartParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+			},
+			Bucket: b.name,
+			Object: object,
+			Attrs: trace2.BucketObjectAttributes{
+				ContentType: ptrOrNil(opt.attrs.ContentType),
+			},
+			Stack: stack.Build(1),
+		})
+	}
+
+	return w
+}
+
+// PublicURL returns the public URL for accessing an object in the bucket.
+func (b *Bucket) PublicURL(object string, options ...PublicURLOption) *url.URL {
+	if b.publicBaseURL == nil {
+		// This should never happen, since access to this method is controlled
+		// by static analysis.
+		panic("internal encore error: missing publicBaseURL for bucket " + b.name)
+	}
+
+	// Clone the base url
+	u := *b.publicBaseURL
+
+	if !strings.HasSuffix(u.Path, "/") {
+		u.Path += "/"
+	}
+	u.Path += escape(object, encodePath)
+
+	return &u
+}
+
+// Writer is the writer for an object being uploaded to a bucket.
+type Writer struct {
+	bkt *Bucket
+
+	ctx context.Context
+	obj string
+
+	opt uploadOptions
+
+	// Initialized on first write
+	u types.Uploader
+
+	// Set if tracing
+	curr         reqtrack.Current
+	startEventID trace2.EventID
+}
+
+// Write writes data to the object being uploaded.
+func (w *Writer) Write(p []byte) (int, error) {
+	u := w.initUpload()
+	return u.Write(p)
+}
+
+// Abort aborts the upload.
+func (w *Writer) Abort(err error) {
+	if err == nil {
+		err = errors.New("upload aborted")
+	}
+	u := w.initUpload()
+	u.Abort(err)
+}
+
+// Close closes the upload, completing the upload if no errors occurred.
+func (w *Writer) Close() error {
+	u := w.initUpload()
+	attrs, err := u.Complete()
+
+	if w.curr.Trace != nil {
+		params := trace2.BucketObjectUploadEndParams{
+			StartID: w.startEventID,
+			EventParams: trace2.EventParams{
+				TraceID: w.curr.Req.TraceID,
+				SpanID:  w.curr.Req.SpanID,
+				Goid:    w.curr.Goctr,
+			},
+			Err: err,
+		}
+
+		if attrs != nil {
+			params.Size = uint64(attrs.Size)
+			params.Version = ptrOrNil(attrs.Version)
+		}
+		w.curr.Trace.BucketObjectUploadEnd(params)
+	}
+
+	return err
+}
+
+func (w *Writer) initUpload() types.Uploader {
+	if w.u == nil {
+		u, err := w.bkt.impl.Upload(types.UploadData{
+			Ctx:    w.ctx,
+			Object: w.bkt.toCloudObject(w.obj),
+			Attrs:  w.opt.attrs,
+			Pre: types.Preconditions{
+				NotExists: w.opt.pre.NotExists,
+			},
+		})
+		if err != nil {
+			w.u = &errUploader{err: err}
+		} else {
+			w.u = u
+		}
+	}
+
+	return w.u
+}
+
+type errUploader struct {
+	err error
+}
+
+func (e *errUploader) Write(p []byte) (int, error) {
+	return 0, e.err
+}
+func (e *errUploader) Abort(err error) {}
+func (e *errUploader) Complete() (*types.ObjectAttrs, error) {
+	return nil, e.err
+}
+
+var _ types.Uploader = &errUploader{}
+
+// Download downloads an object from the bucket.
+// Any error is encountered is reported by the methods on *Reader.
+// To check if the operation failed, call (*Reader).Err.
+//
+// If the object does not exist, the error may be checked with errors.Is(err, ErrObjectNotFound).
+func (b *Bucket) Download(ctx context.Context, object string, options ...DownloadOption) *Reader {
+	var opt downloadOptions
+	for _, o := range options {
+		o.applyDownload(&opt)
+	}
+
+	var startEventID trace2.EventID
+	curr := b.mgr.rt.Current()
+	if curr.Req != nil && curr.Trace != nil {
+		startEventID = curr.Trace.BucketObjectDownloadStart(trace2.BucketObjectDownloadStartParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+			},
+			Bucket:  b.name,
+			Object:  object,
+			Version: ptrOrNil(opt.version),
+			Stack:   stack.Build(1),
+		})
+	}
+
+	r, err := b.impl.Download(types.DownloadData{
+		Ctx:     ctx,
+		Object:  b.toCloudObject(object),
+		Version: opt.version,
+	})
+	return &Reader{r: r, err: err, curr: curr, startEventID: startEventID}
+}
+
+// Reader is the reader for an object being downloaded from a bucket.
+type Reader struct {
+	err       error // any error encountered
+	r         types.Downloader
+	totalRead uint64
+
+	// Set if traced
+	traceCompleted bool
+	curr           reqtrack.Current
+	startEventID   trace2.EventID
+}
+
+// Err returns the error encountered during reading, if any.
+func (r *Reader) Err() error {
+	return r.err
+}
+
+// Read reads data from the object being downloaded.
+func (r *Reader) Read(p []byte) (int, error) {
+	if r.err != nil {
+		return 0, r.err
+	}
+
+	n, err := r.r.Read(p)
+	r.err = err
+	r.totalRead += uint64(n)
+	return n, err
+}
+
+// Close closes the reader.
+// It must be called to release resources.
+func (r *Reader) Close() error {
+	defer r.completeTrace()
+	if r.err != nil {
+		return r.err
+	}
+
+	r.err = r.r.Close()
+	return r.err
+}
+
+func (r *Reader) completeTrace() {
+	if r.traceCompleted {
+		return
+	}
+
+	r.traceCompleted = true
+	if r.curr.Trace != nil && r.startEventID != 0 {
+		r.curr.Trace.BucketObjectDownloadEnd(trace2.BucketObjectDownloadEndParams{
+			StartID: r.startEventID,
+			EventParams: trace2.EventParams{
+				TraceID: r.curr.Req.TraceID,
+				SpanID:  r.curr.Req.SpanID,
+				Goid:    r.curr.Goctr,
+			},
+			Err:  r.err,
+			Size: r.totalRead,
+		})
+	}
+}
+
+// Query describes the set of objects to query for using List.
+type Query struct {
+	// Prefix indicates to only return objects
+	// whose name starts with the given prefix.
+	Prefix string
+
+	// Maximum number of objects to return. Zero means no limit.
+	Limit int64
+}
+
+func (b *Bucket) mapQuery(ctx context.Context, q *Query) types.ListData {
+	return types.ListData{
+		Ctx:    ctx,
+		Prefix: b.baseCloudPrefix + q.Prefix,
+		Limit:  ptrOrNil(q.Limit),
+	}
+}
+
+// ObjectAttrs describes the attributes of an object.
+type ObjectAttrs struct {
+	// The name of the object.
+	Name string
+
+	// The version of the object, if bucket versioning is enabled.
+	Version string
+
+	// The content type of the object, if set during upload.
+	ContentType string
+
+	// The size of the object, in bytes.
+	Size int64
+
+	// The computed ETag of the object.
+	ETag string
+}
+
+func (b *Bucket) mapAttrs(attrs *types.ObjectAttrs) *ObjectAttrs {
+	return &ObjectAttrs{
+		Name:        b.fromCloudObject(attrs.Object),
+		Version:     attrs.Version,
+		ContentType: attrs.ContentType,
+		Size:        attrs.Size,
+		ETag:        attrs.ETag,
+	}
+}
+
+// ListEntry describes an objects during listing.
+type ListEntry struct {
+	// The name of the object.
+	Name string
+	// The size of the object, in bytes.
+	Size int64
+	// The computed ETag of the object.
+	ETag string
+}
+
+func (b *Bucket) mapListEntry(entry *types.ListEntry) *ListEntry {
+	return &ListEntry{
+		Name: b.fromCloudObject(entry.Object),
+		Size: entry.Size,
+		ETag: entry.ETag,
+	}
+}
+
+type SignedUploadURL struct {
+	// The signed URL
+	URL string
+}
+
+type SignedDownloadURL struct {
+	// The signed URL
+	URL string
+}
+
+// List lists objects in the bucket.
+func (b *Bucket) List(ctx context.Context, query *Query, options ...ListOption) iter.Seq2[*ListEntry, error] {
+	return func(yield func(*ListEntry, error) bool) {
+		// Tracing state
+		var (
+			listErr  error
+			observed uint64
+			hasMore  bool
+		)
+
+		curr := b.mgr.rt.Current()
+		if curr.Req != nil && curr.Trace != nil {
+			startEventID := curr.Trace.BucketListObjectsStart(trace2.BucketListObjectsStartParams{
+				EventParams: trace2.EventParams{
+					TraceID: curr.Req.TraceID,
+					SpanID:  curr.Req.SpanID,
+					Goid:    curr.Goctr,
+				},
+				Bucket: b.name,
+				Prefix: ptrOrNil(query.Prefix),
+				Stack:  stack.Build(1),
+			})
+
+			defer curr.Trace.BucketListObjectsEnd(trace2.BucketListObjectsEndParams{
+				StartID: startEventID,
+				EventParams: trace2.EventParams{
+					TraceID: curr.Req.TraceID,
+					SpanID:  curr.Req.SpanID,
+					Goid:    curr.Goctr,
+				},
+				Err:      listErr,
+				Observed: observed,
+				HasMore:  hasMore,
+			})
+		}
+
+		iter := b.impl.List(b.mapQuery(ctx, query))
+		for entry, err := range iter {
+			if err != nil {
+				listErr = err
+				if !yield(nil, err) {
+					return
+				}
+			}
+
+			observed++
+			if !yield(b.mapListEntry(entry), nil) {
+				// Consumer didn't want any more entries; set hasMore = true
+				hasMore = true
+				return
+			}
+		}
+	}
+}
+
+// Remove removes an object from the bucket.
+func (b *Bucket) Remove(ctx context.Context, object string, options ...RemoveOption) error {
+	var opts removeOptions
+	for _, o := range options {
+		o.applyRemove(&opts)
+	}
+
+	var removeErr error
+	curr := b.mgr.rt.Current()
+	if curr.Req != nil && curr.Trace != nil {
+		startEventID := curr.Trace.BucketDeleteObjectsStart(trace2.BucketDeleteObjectsStartParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+			},
+			Bucket: b.name,
+			Objects: []trace2.BucketDeleteObjectsEntry{
+				{
+					Object:  object,
+					Version: ptrOrNil(opts.version),
+				},
+			},
+			Stack: stack.Build(1),
+		})
+
+		defer curr.Trace.BucketDeleteObjectsEnd(trace2.BucketDeleteObjectsEndParams{
+			StartID: startEventID,
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+			},
+			Err: removeErr,
+		})
+	}
+
+	removeErr = b.impl.Remove(types.RemoveData{
+		Ctx:     ctx,
+		Object:  b.toCloudObject(object),
+		Version: opts.version,
+	})
+
+	return removeErr
+}
+
+var (
+	// ErrObjectNotFound is returned when requested object does not exist in the bucket.
+	ErrObjectNotFound = types.ErrObjectNotExist
+
+	// ErrPreconditionFailed is returned when a precondition for an operation is not met,
+	// such as when an object already exists and Preconditions.NotExists is true.
+	ErrPreconditionFailed = types.ErrPreconditionFailed
+
+	// ErrInvalidArgument is returned when an argument for an operation is invalid or out
+	// of bounds. Such as when a too long time-to-live is passed to a sign URL operation.
+	ErrInvalidArgument = types.ErrInvalidArgument
+)
+
+// Attrs returns the attributes of an object in the bucket.
+// If the object does not exist, it returns ErrObjectNotFound.
+func (b *Bucket) Attrs(ctx context.Context, object string, options ...AttrsOption) (*ObjectAttrs, error) {
+	var opt attrsOptions
+	for _, o := range options {
+		o.applyAttrs(&opt)
+	}
+
+	var (
+		attrs    *types.ObjectAttrs
+		attrsErr error
+	)
+
+	curr := b.mgr.rt.Current()
+	if curr.Req != nil && curr.Trace != nil {
+		startEventID := curr.Trace.BucketObjectGetAttrsStart(trace2.BucketObjectGetAttrsStartParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+			},
+			Bucket:  b.name,
+			Object:  object,
+			Version: ptrOrNil(opt.version),
+			Stack:   stack.Build(1),
+		})
+
+		defer func() {
+			params := trace2.BucketObjectGetAttrsEndParams{
+				StartID: startEventID,
+				EventParams: trace2.EventParams{
+					TraceID: curr.Req.TraceID,
+					SpanID:  curr.Req.SpanID,
+					Goid:    curr.Goctr,
+				},
+				Err: attrsErr,
+			}
+			if attrs != nil {
+				size := uint64(attrs.Size)
+				params.Attrs = &trace2.BucketObjectAttributes{
+					Size:        &size,
+					Version:     ptrOrNil(attrs.Version),
+					ETag:        ptrOrNil(attrs.ETag),
+					ContentType: ptrOrNil(attrs.ContentType),
+				}
+			}
+			curr.Trace.BucketObjectGetAttrsEnd(params)
+		}()
+	}
+
+	attrs, attrsErr = b.impl.Attrs(types.AttrsData{
+		Ctx:     ctx,
+		Object:  b.toCloudObject(object),
+		Version: opt.version,
+	})
+	if attrsErr != nil {
+		return nil, attrsErr
+	}
+
+	return b.mapAttrs(attrs), nil
+}
+
+// Generates an external URL to allow uploading an object to the bucket.
+//
+// Anyone with possession of the URL can write to the given object name
+// without any additional auth.
+func (b *Bucket) SignedUploadURL(ctx context.Context, object string, options ...UploadURLOption) (*SignedUploadURL, error) {
+	var opt uploadURLOptions
+	for _, o := range options {
+		o.applyUploadURL(&opt)
+	}
+	if opt.TTL == 0 {
+		opt.TTL = time.Hour
+	}
+	if opt.TTL > 7*24*time.Hour {
+		return nil, types.ErrInvalidArgument
+	}
+	url, err := b.impl.SignedUploadURL(types.UploadURLData{
+		Ctx:    ctx,
+		Object: b.toCloudObject(object),
+		TTL:    opt.TTL,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &SignedUploadURL{URL: url}, nil
+}
+
+// Generates an external URL to allow downloading an object from the bucket.
+//
+// Anyone with possession of the URL can read the given object
+// without any additional auth.
+func (b *Bucket) SignedDownloadURL(ctx context.Context, object string, options ...DownloadURLOption) (*SignedDownloadURL, error) {
+	var opt downloadURLOptions
+	for _, o := range options {
+		o.applyDownloadURL(&opt)
+	}
+	if opt.TTL == 0 {
+		opt.TTL = time.Hour
+	}
+	if opt.TTL > 7*24*time.Hour {
+		return nil, types.ErrInvalidArgument
+	}
+	url, err := b.impl.SignedDownloadURL(types.DownloadURLData{
+		Ctx:    ctx,
+		Object: b.toCloudObject(object),
+		TTL:    opt.TTL,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &SignedDownloadURL{URL: url}, nil
+}
+
+// Exists reports whether an object exists in the bucket.
+func (b *Bucket) Exists(ctx context.Context, object string, options ...ExistsOption) (bool, error) {
+	var opt existsOptions
+	for _, o := range options {
+		o.applyExists(&opt)
+	}
+
+	var (
+		attrs    *types.ObjectAttrs
+		attrsErr error
+	)
+
+	curr := b.mgr.rt.Current()
+	if curr.Req != nil && curr.Trace != nil {
+		startEventID := curr.Trace.BucketObjectGetAttrsStart(trace2.BucketObjectGetAttrsStartParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+			},
+			Bucket:  b.name,
+			Object:  object,
+			Version: ptrOrNil(opt.version),
+			Stack:   stack.Build(1),
+		})
+
+		defer func() {
+			params := trace2.BucketObjectGetAttrsEndParams{
+				StartID: startEventID,
+				EventParams: trace2.EventParams{
+					TraceID: curr.Req.TraceID,
+					SpanID:  curr.Req.SpanID,
+					Goid:    curr.Goctr,
+				},
+				Err: attrsErr,
+			}
+			if attrs != nil {
+				size := uint64(attrs.Size)
+				params.Attrs = &trace2.BucketObjectAttributes{
+					Size:        &size,
+					Version:     ptrOrNil(attrs.Version),
+					ETag:        ptrOrNil(attrs.ETag),
+					ContentType: ptrOrNil(attrs.ContentType),
+				}
+			}
+			curr.Trace.BucketObjectGetAttrsEnd(params)
+		}()
+	}
+
+	attrs, attrsErr = b.impl.Attrs(types.AttrsData{
+		Ctx:     ctx,
+		Object:  b.toCloudObject(object),
+		Version: opt.version,
+	})
+	if errors.Is(attrsErr, ErrObjectNotFound) {
+		return false, nil
+	} else if attrsErr != nil {
+		return false, attrsErr
+	}
+	return true, nil
+}
+
+func (b *Bucket) toCloudObject(object string) types.CloudObject {
+	return types.CloudObject(b.cloudPrefix() + object)
+}
+
+// cloudPrefix computes the cloud prefix to use.
+// It adds the current test name as a prefix when running tests, for test isolation.
+func (b *Bucket) cloudPrefix() string {
+	prefix := b.baseCloudPrefix
+
+	if b.mgr.static.Testing {
+		test := b.mgr.ts.CurrentTest()
+		if prefix != "" {
+			prefix += "/"
+		}
+		prefix += test.Name() + "/__test__/"
+	}
+
+	return prefix
+}
+
+func (b *Bucket) fromCloudObject(object types.CloudObject) string {
+	return strings.TrimPrefix(string(object), b.cloudPrefix())
+}
+
+func ptrOrNil[V comparable](val V) *V {
+	var zero V
+	if val != zero {
+		return &val
+	}
+	return nil
+}
diff --git a/runtimes/go/storage/objects/internal/providers/gcs/bucket.go b/runtimes/go/storage/objects/internal/providers/gcs/bucket.go
new file mode 100644
index 0000000000..1e33d61b7a
--- /dev/null
+++ b/runtimes/go/storage/objects/internal/providers/gcs/bucket.go
@@ -0,0 +1,306 @@
+package gcs
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"iter"
+	"net/http"
+	"net/url"
+	"strconv"
+	"strings"
+	"time"
+
+	"cloud.google.com/go/storage"
+	"google.golang.org/api/googleapi"
+	"google.golang.org/api/iterator"
+	"google.golang.org/api/option"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/storage/objects/internal/types"
+)
+
+type Manager struct {
+	ctx     context.Context
+	runtime *config.Runtime
+	clients map[*config.BucketProvider]*storage.Client
+}
+
+func NewManager(ctx context.Context, runtime *config.Runtime) *Manager {
+	return &Manager{ctx: ctx, runtime: runtime, clients: make(map[*config.BucketProvider]*storage.Client)}
+}
+
+type localSignOptions struct {
+	baseURL    string
+	accessID   string
+	privateKey string
+}
+
+type bucket struct {
+	client    *storage.Client
+	cfg       *config.Bucket
+	handle    *storage.BucketHandle
+	localSign *localSignOptions
+}
+
+func (mgr *Manager) ProviderName() string { return "gcs" }
+
+func (mgr *Manager) Matches(cfg *config.BucketProvider) bool {
+	return cfg.GCS != nil
+}
+
+func (mgr *Manager) NewBucket(provider *config.BucketProvider, runtimeCfg *config.Bucket) types.BucketImpl {
+	client := mgr.clientForProvider(provider)
+
+	localSign := localSignOptionsForProvider(provider)
+	handle := client.Bucket(runtimeCfg.CloudName)
+	return &bucket{client, runtimeCfg, handle, localSign}
+}
+
+func (b *bucket) Download(data types.DownloadData) (types.Downloader, error) {
+	obj := b.handle.Object(data.Object.String())
+	if data.Version != "" {
+		if gen, err := strconv.ParseInt(data.Version, 10, 64); err == nil {
+			obj = obj.Generation(gen)
+		}
+	}
+	r, err := obj.NewReader(data.Ctx)
+	return r, mapErr(err)
+}
+
+func (b *bucket) Upload(data types.UploadData) (types.Uploader, error) {
+	ctx, cancel := context.WithCancelCause(data.Ctx)
+	obj := b.handle.Object(data.Object.String())
+
+	if data.Pre.NotExists {
+		obj = obj.If(storage.Conditions{
+			DoesNotExist: true,
+		})
+	}
+
+	w := obj.NewWriter(ctx)
+	w.ContentType = data.Attrs.ContentType
+
+	u := &uploader{
+		cancel: cancel,
+		w:      w,
+	}
+	return u, nil
+}
+
+type uploader struct {
+	cancel context.CancelCauseFunc
+	w      *storage.Writer
+}
+
+func (u *uploader) Write(p []byte) (int, error) {
+	n, err := u.w.Write(p)
+	return n, mapErr(err)
+}
+
+func (u *uploader) Complete() (*types.ObjectAttrs, error) {
+	if err := u.w.Close(); err != nil {
+		return nil, mapErr(err)
+	}
+
+	attrs := u.w.Attrs()
+	return mapAttrs(attrs), nil
+}
+
+func (u *uploader) Abort(err error) {
+	u.cancel(err)
+}
+
+func mapAttrs(attrs *storage.ObjectAttrs) *types.ObjectAttrs {
+	if attrs == nil {
+		return nil
+	}
+	return &types.ObjectAttrs{
+		Object:      types.CloudObject(attrs.Name),
+		Version:     strconv.FormatInt(attrs.Generation, 10),
+		ContentType: attrs.ContentType,
+		Size:        attrs.Size,
+		ETag:        attrs.Etag,
+	}
+}
+
+func mapListEntry(attrs *storage.ObjectAttrs) *types.ListEntry {
+	return &types.ListEntry{
+		Object: types.CloudObject(attrs.Name),
+		Size:   attrs.Size,
+		ETag:   attrs.Etag,
+	}
+}
+
+func (b *bucket) List(data types.ListData) iter.Seq2[*types.ListEntry, error] {
+	iter := b.handle.Objects(data.Ctx, &storage.Query{
+		Prefix: data.Prefix,
+	})
+	var n int64
+	return func(yield func(*types.ListEntry, error) bool) {
+		for {
+			res, err := iter.Next()
+			if err == iterator.Done {
+				return
+			}
+
+			// Are we over the limit?
+			if data.Limit != nil && n >= *data.Limit {
+				return
+			}
+			n++
+
+			var entry *types.ListEntry
+			if res != nil {
+				entry = mapListEntry(res)
+			}
+
+			if !yield(entry, mapErr(err)) {
+				return
+			}
+		}
+	}
+}
+
+func (b *bucket) Remove(data types.RemoveData) error {
+	obj := b.handle.Object(data.Object.String())
+
+	if data.Version != "" {
+		if gen, err := strconv.ParseInt(data.Version, 10, 64); err == nil {
+			obj = obj.Generation(gen)
+		}
+	}
+
+	err := obj.Delete(data.Ctx)
+	return mapErr(err)
+}
+
+func (b *bucket) Attrs(data types.AttrsData) (*types.ObjectAttrs, error) {
+	obj := b.handle.Object(data.Object.String())
+
+	if data.Version != "" {
+		if gen, err := strconv.ParseInt(data.Version, 10, 64); err == nil {
+			obj = obj.Generation(gen)
+		}
+	}
+
+	resp, err := obj.Attrs(data.Ctx)
+	return mapAttrs(resp), mapErr(err)
+}
+
+func (b *bucket) SignedUploadURL(data types.UploadURLData) (string, error) {
+	opts := &storage.SignedURLOptions{
+		Scheme:  storage.SigningSchemeV4,
+		Method:  "PUT",
+		Expires: time.Now().Add(data.TTL),
+	}
+	return b.signedURL(data.Object.String(), opts)
+}
+
+func (b *bucket) SignedDownloadURL(data types.DownloadURLData) (string, error) {
+	opts := &storage.SignedURLOptions{
+		Scheme:  storage.SigningSchemeV4,
+		Method:  "GET",
+		Expires: time.Now().Add(data.TTL),
+	}
+	return b.signedURL(data.Object.String(), opts)
+}
+
+func (b *bucket) signedURL(object string, opts *storage.SignedURLOptions) (string, error) {
+	// We use a fake GCS service for local development. Ideally, the runtime
+	// code would be oblivious to this once the GCS client is set up. But that
+	// turns out to be difficult for URL signing, so we add a special case
+	// here.
+	if b.localSign != nil {
+		opts.GoogleAccessID = b.localSign.accessID
+		opts.PrivateKey = []byte(b.localSign.privateKey)
+	}
+
+	url, err := b.handle.SignedURL(object, opts)
+	if err != nil {
+		return "", mapErr(err)
+	}
+
+	// More special handling for the local dev case.
+	if b.localSign != nil {
+		url = replaceURLPrefix(url, b.localSign.baseURL)
+	}
+
+	return url, nil
+}
+
+func replaceURLPrefix(origUrl string, base string) string {
+	u, err := url.Parse(origUrl)
+	if err != nil {
+		return origUrl // If the input URL is not valid, just return it as-is
+	}
+	out := base
+	if u.Path != "" {
+		out = strings.TrimRight(out, "/") + "/" + strings.TrimLeft(u.Path, "/")
+	}
+	if u.RawQuery != "" {
+		out += "?" + u.RawQuery
+	}
+	return out
+}
+
+func (mgr *Manager) clientForProvider(prov *config.BucketProvider) *storage.Client {
+	if client, ok := mgr.clients[prov]; ok {
+		return client
+	}
+
+	var opts []option.ClientOption
+	if prov.GCS.Anonymous {
+		opts = append(opts, option.WithoutAuthentication())
+	}
+	if prov.GCS.Endpoint != "" {
+		opts = append(opts, option.WithEndpoint(prov.GCS.Endpoint))
+	}
+
+	client, err := storage.NewClient(mgr.ctx, opts...)
+	if err != nil {
+		panic(fmt.Sprintf("failed to create object storage client: %s", err))
+	}
+
+	mgr.clients[prov] = client
+	return client
+}
+
+func localSignOptionsForProvider(prov *config.BucketProvider) *localSignOptions {
+	if opts := prov.GCS.LocalSign; opts == nil {
+		return nil
+	} else {
+		return &localSignOptions{
+			baseURL:    opts.BaseURL,
+			accessID:   opts.AccessID,
+			privateKey: opts.PrivateKey,
+		}
+	}
+}
+
+func mapErr(err error) error {
+	switch {
+	case err == nil:
+		return nil
+	case errors.Is(err, storage.ErrObjectNotExist):
+		return types.ErrObjectNotExist
+	default:
+		// Handle precondition failures
+		{
+			var e *googleapi.Error
+			if ok := errors.As(err, &e); ok && e.Code == http.StatusPreconditionFailed {
+				return types.ErrPreconditionFailed
+			}
+		}
+
+		{
+			if s, ok := status.FromError(err); ok && s.Code() == codes.AlreadyExists || s.Code() == codes.FailedPrecondition {
+				return types.ErrPreconditionFailed
+			}
+		}
+
+		return err
+	}
+}
diff --git a/runtimes/go/storage/objects/internal/providers/noop/noop.go b/runtimes/go/storage/objects/internal/providers/noop/noop.go
new file mode 100644
index 0000000000..475aaaa557
--- /dev/null
+++ b/runtimes/go/storage/objects/internal/providers/noop/noop.go
@@ -0,0 +1,42 @@
+package noop
+
+import (
+	"fmt"
+	"iter"
+
+	"encore.dev/storage/objects/internal/types"
+)
+
+type BucketImpl struct {
+	EncoreName string
+}
+
+func (b *BucketImpl) Download(data types.DownloadData) (types.Downloader, error) {
+	return nil, fmt.Errorf("cannot download from noop bucket")
+}
+
+func (b *BucketImpl) Upload(data types.UploadData) (types.Uploader, error) {
+	return nil, fmt.Errorf("cannot upload to noop bucket")
+}
+
+func (b *BucketImpl) List(data types.ListData) iter.Seq2[*types.ListEntry, error] {
+	return func(yield func(*types.ListEntry, error) bool) {
+		yield(nil, fmt.Errorf("cannot list objects from noop bucket"))
+	}
+}
+
+func (b *BucketImpl) Remove(data types.RemoveData) error {
+	return fmt.Errorf("cannot remove from noop bucket")
+}
+
+func (b *BucketImpl) Attrs(data types.AttrsData) (*types.ObjectAttrs, error) {
+	return nil, fmt.Errorf("cannot get attributes from noop bucket")
+}
+
+func (b *BucketImpl) SignedUploadURL(data types.UploadURLData) (string, error) {
+	return "", fmt.Errorf("cannot get upload url from noop bucket")
+}
+
+func (b *BucketImpl) SignedDownloadURL(data types.DownloadURLData) (string, error) {
+	return "", fmt.Errorf("cannot get download url from noop bucket")
+}
diff --git a/runtimes/go/storage/objects/internal/providers/s3/bucket.go b/runtimes/go/storage/objects/internal/providers/s3/bucket.go
new file mode 100644
index 0000000000..b05c064d3c
--- /dev/null
+++ b/runtimes/go/storage/objects/internal/providers/s3/bucket.go
@@ -0,0 +1,282 @@
+package s3
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"iter"
+	"sync"
+
+	"cloud.google.com/go/storage"
+	"github.com/aws/aws-sdk-go-v2/aws"
+	awsConfig "github.com/aws/aws-sdk-go-v2/config"
+	awsCreds "github.com/aws/aws-sdk-go-v2/credentials"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	s3types "github.com/aws/aws-sdk-go-v2/service/s3/types"
+	"github.com/aws/smithy-go"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/storage/objects/internal/types"
+)
+
+type Manager struct {
+	ctx     context.Context
+	runtime *config.Runtime
+	clients map[*config.BucketProvider]*clientSet
+
+	cfgOnce          sync.Once
+	awsDefaultConfig aws.Config
+}
+
+func NewManager(ctx context.Context, runtime *config.Runtime) *Manager {
+	return &Manager{ctx: ctx, runtime: runtime, clients: make(map[*config.BucketProvider]*clientSet)}
+}
+
+type bucket struct {
+	client        *s3.Client
+	presignClient *s3.PresignClient
+	cfg           *config.Bucket
+}
+
+type clientSet struct {
+	client        *s3.Client
+	presignClient *s3.PresignClient
+}
+
+func (mgr *Manager) ProviderName() string { return "s3" }
+
+func (mgr *Manager) Matches(cfg *config.BucketProvider) bool {
+	return cfg.S3 != nil
+}
+
+func (mgr *Manager) NewBucket(provider *config.BucketProvider, runtimeCfg *config.Bucket) types.BucketImpl {
+	clients := mgr.clientForProvider(provider)
+	return &bucket{
+		client:        clients.client,
+		presignClient: clients.presignClient,
+		cfg:           runtimeCfg,
+	}
+}
+
+func (b *bucket) Download(data types.DownloadData) (types.Downloader, error) {
+	object := string(data.Object)
+	resp, err := b.client.GetObject(data.Ctx, &s3.GetObjectInput{
+		Bucket:    &b.cfg.CloudName,
+		Key:       &object,
+		VersionId: ptrOrNil(data.Version),
+	})
+	if err != nil {
+		return nil, mapErr(err)
+	}
+	return resp.Body, nil
+}
+
+func (b *bucket) Upload(data types.UploadData) (types.Uploader, error) {
+	return newUploader(b.client, b.cfg.CloudName, data), nil
+}
+
+func mapListEntry(attrs *storage.ObjectAttrs) *types.ListEntry {
+	return &types.ListEntry{
+		Object: types.CloudObject(attrs.Name),
+		Size:   attrs.Size,
+		ETag:   attrs.Etag,
+	}
+}
+
+func (b *bucket) List(data types.ListData) iter.Seq2[*types.ListEntry, error] {
+	return func(yield func(*types.ListEntry, error) bool) {
+		var n int64
+		var continuationToken string
+		for data.Limit == nil || n < *data.Limit {
+			// Abort early if the context is canceled.
+			if err := data.Ctx.Err(); err != nil {
+				yield(nil, err)
+				return
+			}
+
+			maxKeys := int32(1000)
+			if data.Limit != nil {
+				maxKeys = min(int32(*data.Limit-n), 1000)
+			}
+			resp, err := b.client.ListObjectsV2(data.Ctx, &s3.ListObjectsV2Input{
+				Bucket:            &b.cfg.CloudName,
+				MaxKeys:           &maxKeys,
+				ContinuationToken: ptrOrNil(continuationToken),
+				Prefix:            ptrOrNil(data.Prefix),
+			})
+			if err != nil {
+				yield(nil, mapErr(err))
+				return
+			}
+
+			for _, obj := range resp.Contents {
+				if !yield(&types.ListEntry{
+					Object: types.CloudObject(*obj.Key),
+					Size:   *obj.Size,
+					ETag:   *obj.ETag,
+				}, nil) {
+					return
+				}
+				n++
+			}
+
+			// Are we done?
+			if !valOrZero(resp.IsTruncated) {
+				return
+			}
+			continuationToken = valOrZero(resp.NextContinuationToken)
+		}
+	}
+}
+
+func (b *bucket) Remove(data types.RemoveData) error {
+	object := string(data.Object)
+	_, err := b.client.DeleteObject(data.Ctx, &s3.DeleteObjectInput{
+		Bucket:    &b.cfg.CloudName,
+		Key:       &object,
+		VersionId: ptrOrNil(data.Version),
+	})
+	return mapErr(err)
+}
+
+func (b *bucket) Attrs(data types.AttrsData) (*types.ObjectAttrs, error) {
+	object := string(data.Object)
+	resp, err := b.client.HeadObject(data.Ctx, &s3.HeadObjectInput{
+		Bucket:    &b.cfg.CloudName,
+		Key:       &object,
+		VersionId: ptrOrNil(data.Version),
+	})
+	if err != nil {
+		return nil, mapErr(err)
+	}
+	return &types.ObjectAttrs{
+		Object:      data.Object,
+		Version:     valOrZero(resp.VersionId),
+		ContentType: valOrZero(resp.ContentType),
+		Size:        valOrZero(resp.ContentLength),
+		ETag:        valOrZero(resp.ETag),
+	}, nil
+}
+
+func (b *bucket) SignedUploadURL(data types.UploadURLData) (string, error) {
+	object := string(data.Object)
+	params := s3.PutObjectInput{
+		Bucket: &b.cfg.CloudName,
+		Key:    &object,
+	}
+	sign_opts := func(opts *s3.PresignOptions) {
+		opts.Expires = data.TTL
+	}
+	req, err := b.presignClient.PresignPutObject(data.Ctx, &params, sign_opts)
+	if err != nil {
+		return "", mapErr(err)
+	}
+	// TODO: add check/warn against unexpected method and headers
+	// (we expect PUT and host:<> but nothing else.)
+	return req.URL, nil
+}
+
+func (b *bucket) SignedDownloadURL(data types.DownloadURLData) (string, error) {
+	object := string(data.Object)
+	params := s3.GetObjectInput{
+		Bucket: &b.cfg.CloudName,
+		Key:    &object,
+	}
+	sign_opts := func(opts *s3.PresignOptions) {
+		opts.Expires = data.TTL
+	}
+	req, err := b.presignClient.PresignGetObject(data.Ctx, &params, sign_opts)
+	if err != nil {
+		return "", mapErr(err)
+	}
+	// TODO: add check/warn against unexpected method and headers
+	// (we expect PUT and host:<> but nothing else.)
+	return req.URL, nil
+}
+
+func (mgr *Manager) clientForProvider(prov *config.BucketProvider) *clientSet {
+	if cs, ok := mgr.clients[prov]; ok {
+		return cs
+	}
+
+	// If we have a custom access key and secret, use them instead of the default config.
+	var cfg aws.Config
+	if prov.S3.AccessKeyID != nil && prov.S3.SecretAccessKey != nil {
+		var err error
+		cfg, err = awsConfig.LoadDefaultConfig(context.Background(),
+			awsConfig.WithCredentialsProvider(awsCreds.NewStaticCredentialsProvider(*prov.S3.AccessKeyID, *prov.S3.SecretAccessKey, "")),
+		)
+		if err != nil {
+			panic(fmt.Sprintf("unable to load AWS config: %v", err))
+		}
+	} else {
+		cfg = mgr.defaultConfig()
+	}
+
+	client := s3.New(s3.Options{
+		Region:       prov.S3.Region,
+		BaseEndpoint: prov.S3.Endpoint,
+		Credentials:  cfg.Credentials,
+	})
+
+	clients := &clientSet{
+		client:        client,
+		presignClient: s3.NewPresignClient(client),
+	}
+
+	mgr.clients[prov] = clients
+	return clients
+}
+
+// defaultConfig loads the required AWS config to connect to AWS
+func (mgr *Manager) defaultConfig() aws.Config {
+	mgr.cfgOnce.Do(func() {
+		cfg, err := awsConfig.LoadDefaultConfig(context.Background())
+		if err != nil {
+			panic(fmt.Sprintf("unable to load AWS config: %v", err))
+		}
+		mgr.awsDefaultConfig = cfg
+	})
+	return mgr.awsDefaultConfig
+}
+
+func mapErr(err error) error {
+	var (
+		noSuchKey *s3types.NoSuchKey
+		generic   smithy.APIError
+	)
+	switch {
+	case err == nil:
+		return nil
+	case errors.As(err, &noSuchKey):
+		return types.ErrObjectNotExist
+	case errors.As(err, &generic):
+		if generic.ErrorCode() == "PreconditionFailed" {
+			return types.ErrPreconditionFailed
+		}
+		return err
+	default:
+		return err
+
+	}
+}
+
+func ptrOrNil[T comparable](val T) *T {
+	var zero T
+	if val != zero {
+		return &val
+	}
+	return nil
+}
+
+func valOrZero[T comparable](val *T) T {
+	if val != nil {
+		return *val
+	}
+	var zero T
+	return zero
+}
+
+func ptr[T any](val T) *T {
+	return &val
+}
diff --git a/runtimes/go/storage/objects/internal/providers/s3/mock_client_test.go b/runtimes/go/storage/objects/internal/providers/s3/mock_client_test.go
new file mode 100644
index 0000000000..ffe2538016
--- /dev/null
+++ b/runtimes/go/storage/objects/internal/providers/s3/mock_client_test.go
@@ -0,0 +1,136 @@
+// Code generated by MockGen. DO NOT EDIT.
+// Source: ./uploader.go
+
+// Package s3 is a generated GoMock package.
+package s3
+
+import (
+	context "context"
+	reflect "reflect"
+
+	s3 "github.com/aws/aws-sdk-go-v2/service/s3"
+	gomock "github.com/golang/mock/gomock"
+)
+
+// Mocks3Client is a mock of s3Client interface.
+type Mocks3Client struct {
+	ctrl     *gomock.Controller
+	recorder *Mocks3ClientMockRecorder
+}
+
+// Mocks3ClientMockRecorder is the mock recorder for Mocks3Client.
+type Mocks3ClientMockRecorder struct {
+	mock *Mocks3Client
+}
+
+// NewMocks3Client creates a new mock instance.
+func NewMocks3Client(ctrl *gomock.Controller) *Mocks3Client {
+	mock := &Mocks3Client{ctrl: ctrl}
+	mock.recorder = &Mocks3ClientMockRecorder{mock}
+	return mock
+}
+
+// EXPECT returns an object that allows the caller to indicate expected use.
+func (m *Mocks3Client) EXPECT() *Mocks3ClientMockRecorder {
+	return m.recorder
+}
+
+// AbortMultipartUpload mocks base method.
+func (m *Mocks3Client) AbortMultipartUpload(ctx context.Context, params *s3.AbortMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.AbortMultipartUploadOutput, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{ctx, params}
+	for _, a := range optFns {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "AbortMultipartUpload", varargs...)
+	ret0, _ := ret[0].(*s3.AbortMultipartUploadOutput)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// AbortMultipartUpload indicates an expected call of AbortMultipartUpload.
+func (mr *Mocks3ClientMockRecorder) AbortMultipartUpload(ctx, params interface{}, optFns ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{ctx, params}, optFns...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "AbortMultipartUpload", reflect.TypeOf((*Mocks3Client)(nil).AbortMultipartUpload), varargs...)
+}
+
+// CompleteMultipartUpload mocks base method.
+func (m *Mocks3Client) CompleteMultipartUpload(ctx context.Context, params *s3.CompleteMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CompleteMultipartUploadOutput, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{ctx, params}
+	for _, a := range optFns {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "CompleteMultipartUpload", varargs...)
+	ret0, _ := ret[0].(*s3.CompleteMultipartUploadOutput)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CompleteMultipartUpload indicates an expected call of CompleteMultipartUpload.
+func (mr *Mocks3ClientMockRecorder) CompleteMultipartUpload(ctx, params interface{}, optFns ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{ctx, params}, optFns...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CompleteMultipartUpload", reflect.TypeOf((*Mocks3Client)(nil).CompleteMultipartUpload), varargs...)
+}
+
+// CreateMultipartUpload mocks base method.
+func (m *Mocks3Client) CreateMultipartUpload(ctx context.Context, params *s3.CreateMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CreateMultipartUploadOutput, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{ctx, params}
+	for _, a := range optFns {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "CreateMultipartUpload", varargs...)
+	ret0, _ := ret[0].(*s3.CreateMultipartUploadOutput)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CreateMultipartUpload indicates an expected call of CreateMultipartUpload.
+func (mr *Mocks3ClientMockRecorder) CreateMultipartUpload(ctx, params interface{}, optFns ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{ctx, params}, optFns...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CreateMultipartUpload", reflect.TypeOf((*Mocks3Client)(nil).CreateMultipartUpload), varargs...)
+}
+
+// PutObject mocks base method.
+func (m *Mocks3Client) PutObject(ctx context.Context, params *s3.PutObjectInput, optFns ...func(*s3.Options)) (*s3.PutObjectOutput, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{ctx, params}
+	for _, a := range optFns {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "PutObject", varargs...)
+	ret0, _ := ret[0].(*s3.PutObjectOutput)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// PutObject indicates an expected call of PutObject.
+func (mr *Mocks3ClientMockRecorder) PutObject(ctx, params interface{}, optFns ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{ctx, params}, optFns...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "PutObject", reflect.TypeOf((*Mocks3Client)(nil).PutObject), varargs...)
+}
+
+// UploadPart mocks base method.
+func (m *Mocks3Client) UploadPart(ctx context.Context, params *s3.UploadPartInput, optFns ...func(*s3.Options)) (*s3.UploadPartOutput, error) {
+	m.ctrl.T.Helper()
+	varargs := []interface{}{ctx, params}
+	for _, a := range optFns {
+		varargs = append(varargs, a)
+	}
+	ret := m.ctrl.Call(m, "UploadPart", varargs...)
+	ret0, _ := ret[0].(*s3.UploadPartOutput)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UploadPart indicates an expected call of UploadPart.
+func (mr *Mocks3ClientMockRecorder) UploadPart(ctx, params interface{}, optFns ...interface{}) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	varargs := append([]interface{}{ctx, params}, optFns...)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UploadPart", reflect.TypeOf((*Mocks3Client)(nil).UploadPart), varargs...)
+}
diff --git a/runtimes/go/storage/objects/internal/providers/s3/uploader.go b/runtimes/go/storage/objects/internal/providers/s3/uploader.go
new file mode 100644
index 0000000000..068d17d5ae
--- /dev/null
+++ b/runtimes/go/storage/objects/internal/providers/s3/uploader.go
@@ -0,0 +1,312 @@
+package s3
+
+import (
+	"bytes"
+	"context"
+	"crypto/md5"
+	"encoding/base64"
+	"errors"
+	"sync"
+	"time"
+
+	"encore.dev/storage/objects/internal/types"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	"golang.org/x/sync/errgroup"
+)
+
+type uploader struct {
+	client s3Client
+	bucket string
+	data   types.UploadData
+	ctx    context.Context
+	out    chan uploadEvent
+
+	init  sync.Once
+	done  chan struct{}
+	attrs *types.ObjectAttrs
+	err   error
+
+	curr *buffer
+}
+
+type uploadEvent struct {
+	data  *buffer
+	abort error
+	done  bool
+}
+
+type buffer struct {
+	buf []byte
+	n   int // number of bytes in buf
+}
+
+func newUploader(client s3Client, bucket string, data types.UploadData) *uploader {
+	return &uploader{
+		bucket: bucket,
+		client: client,
+		ctx:    data.Ctx,
+		data:   data,
+		out:    make(chan uploadEvent, 10),
+		done:   make(chan struct{}),
+	}
+}
+
+func (u *uploader) Write(p []byte) (n int, err error) {
+	u.initUpload()
+	for len(p) > 0 {
+		curr := u.curr
+		if curr == nil {
+			curr = getBuf()
+		}
+
+		copied := copy(curr.buf[curr.n:], p)
+		n += copied
+		curr.n += copied
+
+		if copied < len(p) {
+			// Buffer is full, send it.
+			p = p[copied:]
+			select {
+			case u.out <- uploadEvent{data: curr}:
+			case <-u.done:
+				return n, u.err
+			}
+
+			u.curr, curr = nil, nil
+		} else {
+			// We've written all the data. Keep track
+			// of the buffer for the next call.
+			u.curr = curr
+			return n, nil
+		}
+	}
+
+	return n, nil
+}
+
+func (u *uploader) Complete() (*types.ObjectAttrs, error) {
+	u.initUpload()
+	// If we have a current buffer, send it.
+	if curr := u.curr; curr != nil && curr.n > 0 {
+		select {
+		case u.out <- uploadEvent{data: curr, done: true}:
+		case <-u.done:
+		}
+		u.curr = nil
+	} else {
+		select {
+		case u.out <- uploadEvent{done: true}:
+		case <-u.done:
+		}
+	}
+
+	// Wait for the upload to finish.
+	<-u.done
+	return u.attrs, u.err
+}
+
+func (u *uploader) Abort(err error) {
+	u.initUpload()
+	// Ensure err is non-nil
+	if err == nil {
+		err = errors.New("upload aborted")
+	}
+
+	select {
+	case u.out <- uploadEvent{abort: err}:
+	case <-u.done:
+	}
+}
+
+func (u *uploader) initUpload() {
+	u.init.Do(func() {
+		go func() {
+			defer close(u.done)
+			attrs, err := u.doUpload()
+			u.attrs, u.err = attrs, mapErr(err)
+		}()
+	})
+}
+
+func (u *uploader) doUpload() (*types.ObjectAttrs, error) {
+	ev := <-u.out
+	if ev.abort != nil {
+		// Nothing to do.
+		return nil, ev.abort
+	} else if ev.done {
+		// First buffer is the final one; we can do a single-part upload.
+		var buf []byte
+		if ev.data != nil {
+			buf = ev.data.buf[:ev.data.n]
+		}
+		return u.singlePartUpload(buf)
+	}
+
+	return u.multiPartUpload(ev.data)
+}
+
+type s3Client interface {
+	PutObject(ctx context.Context, params *s3.PutObjectInput, optFns ...func(*s3.Options)) (*s3.PutObjectOutput, error)
+	CreateMultipartUpload(ctx context.Context, params *s3.CreateMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CreateMultipartUploadOutput, error)
+	UploadPart(ctx context.Context, params *s3.UploadPartInput, optFns ...func(*s3.Options)) (*s3.UploadPartOutput, error)
+	CompleteMultipartUpload(ctx context.Context, params *s3.CompleteMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.CompleteMultipartUploadOutput, error)
+	AbortMultipartUpload(ctx context.Context, params *s3.AbortMultipartUploadInput, optFns ...func(*s3.Options)) (*s3.AbortMultipartUploadOutput, error)
+}
+
+func (u *uploader) singlePartUpload(buf []byte) (*types.ObjectAttrs, error) {
+	key := ptr(u.data.Object.String())
+	md5sum := md5.Sum(buf)
+	contentMD5 := base64.StdEncoding.EncodeToString(md5sum[:])
+
+	var ifNoneMatch *string
+	if u.data.Pre.NotExists {
+		ifNoneMatch = ptr("*")
+	}
+
+	resp, err := u.client.PutObject(u.ctx, &s3.PutObjectInput{
+		Bucket:        &u.bucket,
+		Key:           key,
+		Body:          bytes.NewReader(buf),
+		ContentType:   ptrOrNil(u.data.Attrs.ContentType),
+		ContentMD5:    &contentMD5,
+		ContentLength: ptr(int64(len(buf))),
+		IfNoneMatch:   ifNoneMatch,
+	})
+	if err != nil {
+		return nil, err
+	}
+
+	return &types.ObjectAttrs{
+		Object:      u.data.Object,
+		Version:     valOrZero(resp.VersionId),
+		ContentType: u.data.Attrs.ContentType,
+		Size:        int64(len(buf)),
+		ETag:        valOrZero(resp.ETag),
+	}, nil
+}
+
+func (u *uploader) multiPartUpload(initial *buffer) (attrs *types.ObjectAttrs, err error) {
+	key := ptr(u.data.Object.String())
+	resp, err := u.client.CreateMultipartUpload(u.ctx, &s3.CreateMultipartUploadInput{
+		Bucket:      &u.bucket,
+		Key:         key,
+		ContentType: ptrOrNil(u.data.Attrs.ContentType),
+	})
+	if err != nil {
+		return nil, err
+	}
+	uploadID := valOrZero(resp.UploadId)
+
+	defer func() {
+		if err != nil {
+			// The upload failed. Abort the multipart upload.
+			go func() {
+				ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+				defer cancel()
+				_, _ = u.client.AbortMultipartUpload(ctx, &s3.AbortMultipartUploadInput{
+					Bucket:   &u.bucket,
+					Key:      key,
+					UploadId: &uploadID,
+				})
+			}()
+		}
+	}()
+
+	g, groupCtx := errgroup.WithContext(u.ctx)
+	partNumber := int32(1)
+	var totalSize int64
+	uploadPart := func(buf *buffer) {
+		if buf == nil {
+			// No data to upload.
+			return
+		}
+
+		totalSize += int64(buf.n)
+		part := partNumber
+		partNumber++
+		g.Go(func() error {
+			data := buf.buf[:buf.n]
+			defer putBuf(buf)
+
+			md5sum := md5.Sum(data)
+			contentMD5 := base64.StdEncoding.EncodeToString(md5sum[:])
+			_, err := u.client.UploadPart(groupCtx, &s3.UploadPartInput{
+				Bucket:        &u.bucket,
+				UploadId:      &uploadID,
+				PartNumber:    &part,
+				Body:          bytes.NewReader(data),
+				ContentLength: ptr(int64(len(data))),
+				ContentMD5:    ptr(contentMD5),
+			})
+			return err
+		})
+	}
+
+	// Upload the first part, if given.
+	uploadPart(initial)
+	for {
+		ev := <-u.out
+		if ev.abort != nil {
+			return nil, ev.abort
+		}
+
+		if ev.data != nil {
+			uploadPart(ev.data)
+		}
+
+		if ev.done {
+			break
+		}
+	}
+
+	// Wait for the uploads to complete.
+	if err := g.Wait(); err != nil {
+		return nil, err
+	}
+
+	// Complete the multipart upload.
+	var ifNoneMatch *string
+	if u.data.Pre.NotExists {
+		ifNoneMatch = ptr("*")
+	}
+
+	var completeResp *s3.CompleteMultipartUploadOutput
+	completeResp, err = u.client.CompleteMultipartUpload(u.ctx, &s3.CompleteMultipartUploadInput{
+		Bucket:      &u.bucket,
+		Key:         key,
+		UploadId:    &uploadID,
+		IfNoneMatch: ifNoneMatch,
+	})
+	if err != nil {
+		return nil, err
+	}
+	return &types.ObjectAttrs{
+		Object:      u.data.Object,
+		Version:     valOrZero(completeResp.VersionId),
+		ContentType: u.data.Attrs.ContentType,
+		Size:        totalSize,
+		ETag:        valOrZero(completeResp.ETag),
+	}, nil
+}
+
+// bufSize is the size of buffers allocated by bufPool.
+// It's a variable for testing purposes.
+var bufSize = 10 * 1024 * 1024
+
+var bufPool = sync.Pool{
+	New: func() any {
+		return &buffer{
+			buf: make([]byte, bufSize),
+		}
+	},
+}
+
+func getBuf() *buffer {
+	buf := bufPool.Get().(*buffer)
+	buf.n = 0
+	return buf
+}
+
+func putBuf(buf *buffer) {
+	bufPool.Put(buf)
+}
diff --git a/runtimes/go/storage/objects/internal/providers/s3/uploader_test.go b/runtimes/go/storage/objects/internal/providers/s3/uploader_test.go
new file mode 100644
index 0000000000..54c1181d4e
--- /dev/null
+++ b/runtimes/go/storage/objects/internal/providers/s3/uploader_test.go
@@ -0,0 +1,196 @@
+package s3
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"strings"
+	"testing"
+
+	"encore.dev/storage/objects/internal/types"
+	"github.com/aws/aws-sdk-go-v2/service/s3"
+	qt "github.com/frankban/quicktest"
+	"github.com/golang/mock/gomock"
+)
+
+//go:generate mockgen -source=./uploader.go -destination ./mock_client_test.go -package s3 s3Client
+
+func TestUploader_Sync(t *testing.T) {
+	c := qt.New(t)
+
+	ctrl := gomock.NewController(c)
+	client := NewMocks3Client(ctrl)
+
+	const (
+		bucket      = "bucket"
+		object      = "object"
+		contentType = "text/plain"
+	)
+	u := newUploader(client, bucket, types.UploadData{
+		Ctx:    context.Background(),
+		Object: object,
+		Attrs: types.UploadAttrs{
+			ContentType: contentType,
+		},
+		Pre: types.Preconditions{},
+	})
+
+	const (
+		version = "version"
+		etag    = "etag"
+	)
+	client.EXPECT().PutObject(gomock.Any(), gomock.Any()).Return(&s3.PutObjectOutput{
+		VersionId: ptr(version),
+		ETag:      ptr(etag),
+	}, nil)
+
+	content := []byte("test")
+	n, err := u.Write(content)
+	c.Assert(n, qt.Equals, 4)
+	c.Assert(err, qt.Equals, nil)
+
+	attrs, err := u.Complete()
+	c.Assert(err, qt.Equals, nil)
+	c.Assert(attrs, qt.DeepEquals, &types.ObjectAttrs{
+		Object:      types.CloudObject(object),
+		Version:     version,
+		ContentType: contentType,
+		ETag:        etag,
+		Size:        int64(len(content)),
+	})
+}
+
+func TestUploader_MultipleWrites(t *testing.T) {
+	c := qt.New(t)
+
+	ctrl := gomock.NewController(c)
+	client := NewMocks3Client(ctrl)
+
+	const (
+		bucket      = "bucket"
+		object      = "object"
+		contentType = "text/plain"
+	)
+	u := newUploader(client, bucket, types.UploadData{
+		Ctx:    context.Background(),
+		Object: object,
+		Attrs: types.UploadAttrs{
+			ContentType: contentType,
+		},
+		Pre: types.Preconditions{},
+	})
+
+	const (
+		version = "version"
+		etag    = "etag"
+	)
+	client.EXPECT().PutObject(gomock.Any(), gomock.Any()).Return(&s3.PutObjectOutput{
+		VersionId: ptr(version),
+		ETag:      ptr(etag),
+	}, nil)
+
+	baseContent := "test"
+	totalContent := strings.Repeat(baseContent, 10)
+	for i := 0; i < 10; i++ {
+		n, err := u.Write([]byte(baseContent))
+		c.Assert(n, qt.Equals, len(baseContent))
+		c.Assert(err, qt.Equals, nil)
+	}
+
+	attrs, err := u.Complete()
+	c.Assert(err, qt.Equals, nil)
+	c.Assert(attrs, qt.DeepEquals, &types.ObjectAttrs{
+		Object:      types.CloudObject(object),
+		Version:     version,
+		ContentType: contentType,
+		ETag:        etag,
+		Size:        int64(len(totalContent)),
+	})
+}
+
+func TestUploader_MultipartUpload(t *testing.T) {
+	c := qt.New(t)
+
+	ctrl := gomock.NewController(c)
+	client := NewMocks3Client(ctrl)
+
+	const (
+		bucket      = "bucket"
+		object      = "object"
+		contentType = "text/plain"
+	)
+	u := newUploader(client, bucket, types.UploadData{
+		Ctx:    context.Background(),
+		Object: object,
+		Attrs: types.UploadAttrs{
+			ContentType: contentType,
+		},
+		Pre: types.Preconditions{},
+	})
+
+	withBufSize(c, 10)
+	const (
+		version  = "version"
+		etag     = "etag"
+		uploadID = "uploadID"
+	)
+	client.EXPECT().CreateMultipartUpload(gomock.Any(), gomock.Any()).Return(&s3.CreateMultipartUploadOutput{
+		UploadId: ptr(uploadID),
+	}, nil)
+	client.EXPECT().UploadPart(gomock.Any(), &partMatcher{num: 1, data: "abcdefghij"}).Return(&s3.UploadPartOutput{}, nil)
+	client.EXPECT().UploadPart(gomock.Any(), &partMatcher{num: 2, data: "klmabcdefg"}).Return(&s3.UploadPartOutput{}, nil)
+	client.EXPECT().UploadPart(gomock.Any(), &partMatcher{num: 3, data: "hijklmabcd"}).Return(&s3.UploadPartOutput{}, nil)
+	client.EXPECT().UploadPart(gomock.Any(), &partMatcher{num: 4, data: "efghijklm"}).Return(&s3.UploadPartOutput{}, nil)
+	client.EXPECT().CompleteMultipartUpload(gomock.Any(), gomock.Any()).Return(&s3.CompleteMultipartUploadOutput{
+		VersionId: ptr(version),
+		ETag:      ptr(etag),
+	}, nil)
+
+	baseContent := "abcdefghijklm"
+	totalContent := strings.Repeat(baseContent, 3)
+	for i := 0; i < 3; i++ {
+		n, err := u.Write([]byte(baseContent))
+		c.Assert(n, qt.Equals, len(baseContent))
+		c.Assert(err, qt.Equals, nil)
+	}
+
+	attrs, err := u.Complete()
+	c.Assert(err, qt.Equals, nil)
+	c.Assert(attrs, qt.DeepEquals, &types.ObjectAttrs{
+		Object:      types.CloudObject(object),
+		Version:     version,
+		ContentType: contentType,
+		ETag:        etag,
+		Size:        int64(len(totalContent)),
+	})
+}
+
+func withBufSize(c *qt.C, n int) {
+	orig := bufSize
+	bufSize = n
+	c.Cleanup(func() { bufSize = orig })
+}
+
+type partMatcher struct {
+	num  int
+	data string
+}
+
+func (m *partMatcher) Matches(x interface{}) bool {
+	part, ok := x.(*s3.UploadPartInput)
+	if !ok {
+		return false
+	}
+	data, err := io.ReadAll(part.Body)
+	if err != nil {
+		panic(err)
+	}
+	part.Body = bytes.NewReader(data)
+	fmt.Printf("part %d: %q\n", valOrZero(part.PartNumber), data)
+	return valOrZero(part.PartNumber) == int32(m.num) && string(data) == m.data
+}
+
+func (m *partMatcher) String() string {
+	return fmt.Sprintf("is part %d with data %q", m.num, m.data)
+}
diff --git a/runtimes/go/storage/objects/internal/types/types.go b/runtimes/go/storage/objects/internal/types/types.go
new file mode 100644
index 0000000000..8baa49333d
--- /dev/null
+++ b/runtimes/go/storage/objects/internal/types/types.go
@@ -0,0 +1,118 @@
+package types
+
+import (
+	"context"
+	"errors"
+	"io"
+	"iter"
+	"time"
+)
+
+type BucketImpl interface {
+	Upload(data UploadData) (Uploader, error)
+	Download(data DownloadData) (Downloader, error)
+	List(data ListData) iter.Seq2[*ListEntry, error]
+	Remove(data RemoveData) error
+	Attrs(data AttrsData) (*ObjectAttrs, error)
+	SignedUploadURL(data UploadURLData) (string, error)
+	SignedDownloadURL(data DownloadURLData) (string, error)
+}
+
+// CloudObject is the cloud name for an object.
+// It can differ from the logical name when using a prefix bucket.
+type CloudObject string
+
+func (o CloudObject) String() string { return string(o) }
+
+type UploadData struct {
+	Ctx    context.Context
+	Object CloudObject
+
+	Attrs UploadAttrs
+	Pre   Preconditions
+}
+
+type Preconditions struct {
+	NotExists bool
+}
+
+type UploadAttrs struct {
+	ContentType string
+}
+
+type Uploader interface {
+	io.Writer
+	Abort(err error)
+	Complete() (*ObjectAttrs, error)
+}
+
+type DownloadData struct {
+	Ctx    context.Context
+	Object CloudObject
+
+	// Non-zero to download a specific version
+	Version string
+}
+
+type Downloader interface {
+	io.Reader
+	io.Closer
+}
+
+type ObjectAttrs struct {
+	Object      CloudObject
+	Version     string
+	ContentType string
+	Size        int64
+	ETag        string
+}
+
+type ListData struct {
+	Ctx    context.Context
+	Prefix string
+	Limit  *int64
+}
+
+type ListEntry struct {
+	Object CloudObject
+	Size   int64
+	ETag   string
+}
+
+type RemoveData struct {
+	Ctx    context.Context
+	Object CloudObject
+
+	Version string // non-zero means specific version
+}
+
+type AttrsData struct {
+	Ctx    context.Context
+	Object CloudObject
+
+	Version string // non-zero means specific version
+}
+
+type UploadURLData struct {
+	Ctx    context.Context
+	Object CloudObject
+
+	TTL time.Duration
+}
+
+type DownloadURLData struct {
+	Ctx    context.Context
+	Object CloudObject
+
+	TTL time.Duration
+}
+
+//publicapigen:keep
+var (
+	//publicapigen:keep
+	ErrObjectNotExist = errors.New("objects: object doesn't exist")
+	//publicapigen:keep
+	ErrPreconditionFailed = errors.New("objects: precondition failed")
+	//publicapigen:keep
+	ErrInvalidArgument = errors.New("objects: invalid argument")
+)
diff --git a/runtimes/go/storage/objects/manager_internal.go b/runtimes/go/storage/objects/manager_internal.go
new file mode 100644
index 0000000000..e45f92d868
--- /dev/null
+++ b/runtimes/go/storage/objects/manager_internal.go
@@ -0,0 +1,54 @@
+package objects
+
+import (
+	"context"
+
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/appruntime/shared/testsupport"
+)
+
+type Manager struct {
+	ctx        context.Context
+	cancelCtx  func()
+	static     *config.Static
+	runtime    *config.Runtime
+	rt         *reqtrack.RequestTracker
+	ts         *testsupport.Manager
+	rootLogger zerolog.Logger
+	providers  []provider
+}
+
+func NewManager(static *config.Static, runtime *config.Runtime, rt *reqtrack.RequestTracker,
+	ts *testsupport.Manager, rootLogger zerolog.Logger) *Manager {
+	ctx, cancel := context.WithCancel(context.Background())
+	mgr := &Manager{
+		ctx:        ctx,
+		cancelCtx:  cancel,
+		static:     static,
+		runtime:    runtime,
+		rt:         rt,
+		ts:         ts,
+		rootLogger: rootLogger,
+	}
+
+	for _, p := range providerRegistry {
+		mgr.providers = append(mgr.providers, p(mgr.ctx, mgr.runtime))
+	}
+
+	return mgr
+}
+
+// Shutdown stops the manager from fetching new messages and processing them.
+func (mgr *Manager) Shutdown(p *shutdown.Process) error {
+	// Once it's time to force-close tasks, cancel the base context.
+	go func() {
+		<-p.ForceCloseTasks.Done()
+		mgr.cancelCtx()
+	}()
+
+	return nil
+}
diff --git a/runtimes/go/storage/objects/objects.go b/runtimes/go/storage/objects/objects.go
new file mode 100644
index 0000000000..f7037cdd83
--- /dev/null
+++ b/runtimes/go/storage/objects/objects.go
@@ -0,0 +1,22 @@
+//go:build encore_app
+
+package objects
+
+// NewBucket declares a new object storage bucket.
+//
+// See https://encore.dev/docs/primitives/object-storage for more information.
+func NewBucket(name string, cfg BucketConfig) *Bucket {
+	return newBucket(Singleton, name)
+}
+
+// constStr is a string that can only be provided as a constant.
+//
+//publicapigen:keep
+type constStr string
+
+// Named returns a database object connected to the database with the given name.
+//
+// The name must be a string literal constant, to facilitate static analysis.
+func Named(name constStr) *Bucket {
+	return newBucket(Singleton, string(name))
+}
diff --git a/runtimes/go/storage/objects/options.go b/runtimes/go/storage/objects/options.go
new file mode 100644
index 0000000000..78d525de4d
--- /dev/null
+++ b/runtimes/go/storage/objects/options.go
@@ -0,0 +1,211 @@
+package objects
+
+import (
+	"time"
+
+	"encore.dev/storage/objects/internal/types"
+)
+
+// DownloadOption describes available options for the Download operation.
+type DownloadOption interface {
+	//publicapigen:keep
+	downloadOption()
+
+	applyDownload(*downloadOptions)
+}
+
+// WithVersion specifies that the operation should be performed
+// against the provided version of the object.
+func WithVersion(version string) withVersionOption {
+	return withVersionOption{version: version}
+}
+
+//publicapigen:keep
+type withVersionOption struct {
+	version string
+}
+
+//publicapigen:keep
+func (o withVersionOption) downloadOption() {}
+
+//publicapigen:keep
+func (o withVersionOption) removeOption() {}
+
+//publicapigen:keep
+func (o withVersionOption) attrsOption() {}
+
+//publicapigen:keep
+func (o withVersionOption) existsOption() {}
+
+//publicapigen:keep
+func (o withTTLOption) uploadURLOption() {}
+
+//publicapigen:keep
+func (o withTTLOption) downloadURLOption() {}
+
+func (o withVersionOption) applyDownload(opts *downloadOptions)   { opts.version = o.version }
+func (o withVersionOption) applyRemove(opts *removeOptions)       { opts.version = o.version }
+func (o withVersionOption) applyAttrs(opts *attrsOptions)         { opts.version = o.version }
+func (o withVersionOption) applyExists(opts *existsOptions)       { opts.version = o.version }
+func (o withTTLOption) applyUploadURL(opts *uploadURLOptions)     { opts.TTL = o.TTL }
+func (o withTTLOption) applyDownloadURL(opts *downloadURLOptions) { opts.TTL = o.TTL }
+
+// WithTTL is used for signed URLs, to specify the lifetime of the generated
+// URL. The max value is seven days. The default lifetime, if this
+// option is missing, is one hour.
+func WithTTL(TTL time.Duration) withTTLOption {
+	return withTTLOption{TTL: TTL}
+}
+
+//publicapigen:keep
+type withTTLOption struct {
+	TTL time.Duration
+}
+
+//publicapigen:keep
+type downloadOptions struct {
+	version string
+}
+
+// UploadOption describes available options for the Upload operation.
+type UploadOption interface {
+	uploadOption()
+
+	applyUpload(*uploadOptions)
+}
+
+// WithPreconditions is an UploadOption for only uploading an object
+// if certain preconditions are met.
+func WithPreconditions(pre Preconditions) withPreconditionsOption {
+	return withPreconditionsOption{pre: pre}
+}
+
+// Preconditions are the available preconditions for an upload operation.
+type Preconditions struct {
+	// NotExists specifies that the object must not exist prior to uploading.
+	NotExists bool
+}
+
+//publicapigen:keep
+type withPreconditionsOption struct {
+	pre Preconditions
+}
+
+//publicapigen:keep
+func (o withPreconditionsOption) uploadOption() {}
+
+func (o withPreconditionsOption) applyUpload(opts *uploadOptions) {
+	opts.pre = o.pre
+}
+
+// UploadAttrs specifies additional object attributes to set during upload.
+type UploadAttrs struct {
+	// ContentType specifies the content type of the object.
+	ContentType string
+}
+
+// WithUploadAttrs is an UploadOption for specifying additional object attributes
+// to set during upload.
+func WithUploadAttrs(attrs UploadAttrs) withUploadAttrsOption {
+	return withUploadAttrsOption{attrs: attrs}
+}
+
+//publicapigen:keep
+type withUploadAttrsOption struct {
+	attrs UploadAttrs
+}
+
+//publicapigen:keep
+func (o withUploadAttrsOption) uploadOption() {}
+
+func (o withUploadAttrsOption) applyUpload(opts *uploadOptions) {
+	opts.attrs = types.UploadAttrs{
+		ContentType: o.attrs.ContentType,
+	}
+}
+
+type uploadOptions struct {
+	attrs types.UploadAttrs
+	pre   Preconditions
+}
+
+// ListOption describes available options for the List operation.
+type ListOption interface {
+	//publicapigen:keep
+	listOption()
+
+	applyList(*listOptions)
+}
+
+type listOptions struct{}
+
+// RemoveOption describes available options for the Remove operation.
+type RemoveOption interface {
+	//publicapigen:keep
+	removeOption()
+
+	applyRemove(*removeOptions)
+}
+
+type removeOptions struct {
+	version string
+}
+
+// AttrsOption describes available options for the Attrs operation.
+type AttrsOption interface {
+	//publicapigen:keep
+	attrsOption()
+
+	applyAttrs(*attrsOptions)
+}
+
+type attrsOptions struct {
+	version string
+}
+
+// UploadURLOption describes available options for the SignedUploadURL operation.
+type UploadURLOption interface {
+	//publicapigen:keep
+	uploadURLOption()
+
+	applyUploadURL(*uploadURLOptions)
+}
+
+type uploadURLOptions struct {
+	TTL time.Duration
+}
+
+// DownloadURLOption describes available options for the SignedDownloadURL operation.
+type DownloadURLOption interface {
+	//publicapigen:keep
+	downloadURLOption()
+
+	applyDownloadURL(*downloadURLOptions)
+}
+
+type downloadURLOptions struct {
+	TTL time.Duration
+}
+
+// ExistsOption describes available options for the Exists operation.
+type ExistsOption interface {
+	//publicapigen:keep
+	existsOption()
+
+	applyExists(*existsOptions)
+}
+
+type existsOptions struct {
+	version string
+}
+
+// PublicURLOption describes available options for the PublicURL operation.
+type PublicURLOption interface {
+	//publicapigen:keep
+	publicURLOption()
+
+	applyPublicURL(*publicURLOptions)
+}
+
+// No options yet
+type publicURLOptions struct{}
diff --git a/runtimes/go/storage/objects/package.go b/runtimes/go/storage/objects/package.go
new file mode 100644
index 0000000000..1056da6e9c
--- /dev/null
+++ b/runtimes/go/storage/objects/package.go
@@ -0,0 +1,6 @@
+// Package objects provides Encore applications with the ability
+// to create and use Object Storage buckets (like for example Amazon S3)
+// for storing and retrieving files in a cloud-agnostic manner.
+//
+// For more information see https://encore.dev/docs/primitives/object-storage
+package objects
diff --git a/runtimes/go/storage/objects/path_escape.go b/runtimes/go/storage/objects/path_escape.go
new file mode 100644
index 0000000000..d1db681126
--- /dev/null
+++ b/runtimes/go/storage/objects/path_escape.go
@@ -0,0 +1,161 @@
+package objects
+
+// The code below is copied from the Go standard library's net/url package.
+//
+// Copyright 2009 The Go Authors. All rights reserved.
+//
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file at
+// https://github.com/golang/go.
+
+const upperhex = "0123456789ABCDEF"
+
+type encoding int
+
+const (
+	encodePath encoding = 1 + iota
+	encodePathSegment
+	encodeHost
+	encodeZone
+	encodeUserPassword
+	encodeQueryComponent
+	encodeFragment
+)
+
+func escape(s string, mode encoding) string {
+	spaceCount, hexCount := 0, 0
+	for i := 0; i < len(s); i++ {
+		c := s[i]
+		if shouldEscape(c, mode) {
+			if c == ' ' && mode == encodeQueryComponent {
+				spaceCount++
+			} else {
+				hexCount++
+			}
+		}
+	}
+
+	if spaceCount == 0 && hexCount == 0 {
+		return s
+	}
+
+	var buf [64]byte
+	var t []byte
+
+	required := len(s) + 2*hexCount
+	if required <= len(buf) {
+		t = buf[:required]
+	} else {
+		t = make([]byte, required)
+	}
+
+	if hexCount == 0 {
+		copy(t, s)
+		for i := 0; i < len(s); i++ {
+			if s[i] == ' ' {
+				t[i] = '+'
+			}
+		}
+		return string(t)
+	}
+
+	j := 0
+	for i := 0; i < len(s); i++ {
+		switch c := s[i]; {
+		case c == ' ' && mode == encodeQueryComponent:
+			t[j] = '+'
+			j++
+		case shouldEscape(c, mode):
+			t[j] = '%'
+			t[j+1] = upperhex[c>>4]
+			t[j+2] = upperhex[c&15]
+			j += 3
+		default:
+			t[j] = s[i]
+			j++
+		}
+	}
+	return string(t)
+}
+
+// Return true if the specified character should be escaped when
+// appearing in a URL string, according to RFC 3986.
+//
+// Please be informed that for now shouldEscape does not check all
+// reserved characters correctly. See golang.org/issue/5684.
+func shouldEscape(c byte, mode encoding) bool {
+	// §2.3 Unreserved characters (alphanum)
+	if 'a' <= c && c <= 'z' || 'A' <= c && c <= 'Z' || '0' <= c && c <= '9' {
+		return false
+	}
+
+	if mode == encodeHost || mode == encodeZone {
+		// §3.2.2 Host allows
+		//	sub-delims = "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "="
+		// as part of reg-name.
+		// We add : because we include :port as part of host.
+		// We add [ ] because we include [ipv6]:port as part of host.
+		// We add < > because they're the only characters left that
+		// we could possibly allow, and Parse will reject them if we
+		// escape them (because hosts can't use %-encoding for
+		// ASCII bytes).
+		switch c {
+		case '!', '$', '&', '\'', '(', ')', '*', '+', ',', ';', '=', ':', '[', ']', '<', '>', '"':
+			return false
+		}
+	}
+
+	switch c {
+	case '-', '_', '.', '~': // §2.3 Unreserved characters (mark)
+		return false
+
+	case '$', '&', '+', ',', '/', ':', ';', '=', '?', '@': // §2.2 Reserved characters (reserved)
+		// Different sections of the URL allow a few of
+		// the reserved characters to appear unescaped.
+		switch mode {
+		case encodePath: // §3.3
+			// The RFC allows : @ & = + $ but saves / ; , for assigning
+			// meaning to individual path segments. This package
+			// only manipulates the path as a whole, so we allow those
+			// last three as well. That leaves only ? to escape.
+			return c == '?'
+
+		case encodePathSegment: // §3.3
+			// The RFC allows : @ & = + $ but saves / ; , for assigning
+			// meaning to individual path segments.
+			return c == '/' || c == ';' || c == ',' || c == '?'
+
+		case encodeUserPassword: // §3.2.1
+			// The RFC allows ';', ':', '&', '=', '+', '$', and ',' in
+			// userinfo, so we must escape only '@', '/', and '?'.
+			// The parsing of userinfo treats ':' as special so we must escape
+			// that too.
+			return c == '@' || c == '/' || c == '?' || c == ':'
+
+		case encodeQueryComponent: // §3.4
+			// The RFC reserves (so we must escape) everything.
+			return true
+
+		case encodeFragment: // §4.1
+			// The RFC text is silent but the grammar allows
+			// everything, so escape nothing.
+			return false
+		}
+	}
+
+	if mode == encodeFragment {
+		// RFC 3986 §2.2 allows not escaping sub-delims. A subset of sub-delims are
+		// included in reserved from RFC 2396 §2.2. The remaining sub-delims do not
+		// need to be escaped. To minimize potential breakage, we apply two restrictions:
+		// (1) we always escape sub-delims outside of the fragment, and (2) we always
+		// escape single quote to avoid breaking callers that had previously assumed that
+		// single quotes would be escaped. See issue #19917.
+		switch c {
+		case '!', '(', ')', '*':
+			return false
+		}
+	}
+
+	// Everything else must be escaped.
+	return true
+}
diff --git a/runtimes/go/storage/objects/provider_gcs.go b/runtimes/go/storage/objects/provider_gcs.go
new file mode 100644
index 0000000000..8cedb43c29
--- /dev/null
+++ b/runtimes/go/storage/objects/provider_gcs.go
@@ -0,0 +1,16 @@
+//go:build !encore_no_gcp || !encore_no_encorecloud || !encore_no_local
+
+package objects
+
+import (
+	"context"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/storage/objects/internal/providers/gcs"
+)
+
+func init() {
+	registerProvider(func(ctx context.Context, runtimeCfg *config.Runtime) provider {
+		return gcs.NewManager(ctx, runtimeCfg)
+	})
+}
diff --git a/runtimes/go/storage/objects/provider_s3.go b/runtimes/go/storage/objects/provider_s3.go
new file mode 100644
index 0000000000..c3c33be18b
--- /dev/null
+++ b/runtimes/go/storage/objects/provider_s3.go
@@ -0,0 +1,16 @@
+//go:build !encore_no_aws
+
+package objects
+
+import (
+	"context"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/storage/objects/internal/providers/s3"
+)
+
+func init() {
+	registerProvider(func(ctx context.Context, runtimeCfg *config.Runtime) provider {
+		return s3.NewManager(ctx, runtimeCfg)
+	})
+}
diff --git a/runtimes/go/storage/objects/refs.go b/runtimes/go/storage/objects/refs.go
new file mode 100644
index 0000000000..e56a8f7d0f
--- /dev/null
+++ b/runtimes/go/storage/objects/refs.go
@@ -0,0 +1,214 @@
+package objects
+
+import (
+	"context"
+	"iter"
+	"net/url"
+)
+
+// BucketPerms is the type constraint for all permission-declaring
+// interfaces that can be used with BucketRef.
+type BucketPerms interface {
+	perms()
+}
+
+// ReadWriter is a utility permission interface that provides
+// all the read-write permissions.
+type ReadWriter interface {
+	Uploader
+	SignedUploader
+	Downloader
+	SignedDownloader
+	Remover
+	Lister
+	Attrser
+}
+
+// Uploader is the interface for uploading objects to a bucket.
+// It can be used in conjunction with [BucketRef] to declare
+// a reference that can upload objects to the bucket.
+//
+// For example:
+//
+//	var MyBucket = objects.NewBucket(...)
+//	var ref = objects.BucketRef[objects.Uploader](MyBucket)
+//
+// The ref object can then be used to upload objects and can be
+// passed around freely within the service, without being subject
+// to Encore's static analysis restrictions that apply to MyBucket.
+type Uploader interface {
+	// Upload begins uploading an object to the bucket.
+	Upload(ctx context.Context, object string, options ...UploadOption) *Writer
+
+	perms()
+}
+
+// SignedUploader is the interface for creating external URLs to upload objects
+// to a bucket. It can be used in conjunction with [BucketRef] to declare
+// a reference that can generate upload URLs to the bucket.
+//
+// For example:
+//
+//	var MyBucket = objects.NewBucket(...)
+//	var ref = objects.BucketRef[objects.SignedUploader](MyBucket)
+//
+// The ref object can then be used to generate upload URLs and can be
+// passed around freely within the service, without being subject
+// to Encore's static analysis restrictions that apply to MyBucket.
+type SignedUploader interface {
+	// SignedUploadURL returns a signed URL that can be used to upload directly to
+	// storage, without any other authentication.
+	SignedUploadURL(ctx context.Context, object string, options ...UploadURLOption) (*SignedUploadURL, error)
+
+	perms()
+}
+
+// Downloader is the interface for downloading objects from a bucket.
+// It can be used in conjunction with [BucketRef] to declare
+// a reference that can download objects from the bucket.
+//
+// For example:
+//
+//	var MyBucket = objects.NewBucket(...)
+//	var ref = objects.BucketRef[objects.Downloader](MyBucket)
+//
+// The ref object can then be used to download objects and can be
+// passed around freely within the service, without being subject
+// to Encore's static analysis restrictions that apply to MyBucket.
+type Downloader interface {
+	// Download downloads an object from the bucket.
+	Download(ctx context.Context, object string, options ...DownloadOption) *Reader
+
+	perms()
+}
+
+// SignedDownloader is the interface for creating external URLs to download objects
+// from a bucket.
+// It can be used in conjunction with [BucketRef] to declare
+// a reference that can generate download URLs for the bucket.
+//
+// For example:
+//
+//	var MyBucket = objects.NewBucket(...)
+//	var ref = objects.BucketRef[objects.SignedDownloader](MyBucket)
+//
+// The ref object can then be used to generate download URLs and can be
+// passed around freely within the service, without being subject
+// to Encore's static analysis restrictions that apply to MyBucket.
+type SignedDownloader interface {
+	// SignedDownloadURL returns a signed URL that can be used to download directly
+	// from storage, without any other authentication.
+	SignedDownloadURL(ctx context.Context, object string, options ...DownloadURLOption) (*SignedDownloadURL, error)
+
+	perms()
+}
+
+// Lister is the interface for listing objects in a bucket.
+// It can be used in conjunction with [BucketRef] to declare
+// a reference that can list objects in the bucket.
+//
+// For example:
+//
+//	var MyBucket = objects.NewBucket(...)
+//	var ref = objects.BucketRef[objects.Lister](MyBucket)
+//
+// The ref object can then be used to list objects and can be
+// passed around freely within the service, without being subject
+// to Encore's static analysis restrictions that apply to MyBucket.
+type Lister interface {
+	// List lists objects in the bucket.
+	List(ctx context.Context, query *Query, options ...ListOption) iter.Seq2[*ListEntry, error]
+
+	perms()
+}
+
+// Remove is the interface for removing objects from a bucket.
+// It can be used in conjunction with [BucketRef] to declare
+// a reference that can remove objects from the bucket.
+//
+// For example:
+//
+//	var MyBucket = objects.NewBucket(...)
+//	var ref = objects.BucketRef[objects.Remover](MyBucket)
+//
+// The ref object can then be used to remove objects and can be
+// passed around freely within the service, without being subject
+// to Encore's static analysis restrictions that apply to MyBucket.
+type Remover interface {
+	// Remove removes an object from the bucket.
+	Remove(ctx context.Context, object string, options ...RemoveOption) error
+
+	perms()
+}
+
+// Attrser is the interface for resolving objects' attributes in a bucket.
+// It can be used in conjunction with [BucketRef] to declare
+// a reference that can check object attributes in a bucket.
+//
+// For example:
+//
+//	var MyBucket = objects.NewBucket(...)
+//	var ref = objects.BucketRef[objects.Attrser](MyBucket)
+//
+// The ref object can then be used to remove objects and can be
+// passed around freely within the service, without being subject
+// to Encore's static analysis restrictions that apply to MyBucket.
+type Attrser interface {
+	// Attrs resolves the attributes of an object.
+	Attrs(ctx context.Context, object string, options ...AttrsOption) (*ObjectAttrs, error)
+
+	// Exists checks whether an object exists in the bucket.
+	Exists(ctx context.Context, object string, options ...ExistsOption) (bool, error)
+
+	perms()
+}
+
+// PublicURLer is the interface for resolving the public URL for an object.
+// It can be used in conjunction with [BucketRef] to declare
+// a reference that can resolve an object's public URL.
+//
+// For example:
+//
+//	var MyBucket = objects.NewBucket(...)
+//	var ref = objects.BucketRef[objects.PublicURLer](MyBucket)
+//
+// The ref object can then be used to remove objects and can be
+// passed around freely within the service, without being subject
+// to Encore's static analysis restrictions that apply to MyBucket.
+type PublicURLer interface {
+	// PublicURL resolves the public URL for retrieving an object.
+	PublicURL(object string, options ...PublicURLOption) *url.URL
+
+	perms()
+}
+
+// BucketRef returns an interface reference to a bucket,
+// that can be freely passed around within a service
+// without being subject to Encore's typical static analysis
+// restrictions that normally apply to *Bucket objects.
+//
+// This works because using BucketRef effectively declares
+// which operations you want to be able to perform since the
+// type argument P must be a permission-declaring interface (implementing BucketPerms).
+//
+// The returned reference is scoped down to those permissions.
+//
+// For example:
+//
+//	var MyBucket = objects.NewBucket(...)
+//	var ref = objects.BucketRef[objects.ReadWriter](MyBucket)
+//	// ref.Upload(...) can now be used to upload objects to MyBucket.
+//
+// Multiple permissions can be combined by defining a custom interface
+// that embeds multiple permission interfaces:
+//
+//	var ref = objects.BucketRef[interface { objects.Uploader; objects.Downloader }](MyBucket)
+func BucketRef[P BucketPerms](bucket *Bucket) P {
+	return any(bucketRef{Bucket: bucket}).(P)
+}
+
+type bucketRef struct {
+	*Bucket
+}
+
+func (r bucketRef) perms() {}
diff --git a/runtimes/go/storage/objects/registry_internal.go b/runtimes/go/storage/objects/registry_internal.go
new file mode 100644
index 0000000000..51451815f7
--- /dev/null
+++ b/runtimes/go/storage/objects/registry_internal.go
@@ -0,0 +1,20 @@
+package objects
+
+import (
+	"context"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/storage/objects/internal/types"
+)
+
+type provider interface {
+	ProviderName() string
+	Matches(providerCfg *config.BucketProvider) bool
+	NewBucket(providerCfg *config.BucketProvider, runtimeCfg *config.Bucket) types.BucketImpl
+}
+
+var providerRegistry []func(context.Context, *config.Runtime) provider
+
+func registerProvider(p func(context.Context, *config.Runtime) provider) {
+	providerRegistry = append(providerRegistry, p)
+}
diff --git a/runtimes/go/storage/objects/zzz_singleton_internal.go b/runtimes/go/storage/objects/zzz_singleton_internal.go
new file mode 100644
index 0000000000..eb057ebcdb
--- /dev/null
+++ b/runtimes/go/storage/objects/zzz_singleton_internal.go
@@ -0,0 +1,25 @@
+//go:build encore_app
+
+package objects
+
+import (
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/logging"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/appruntime/shared/testsupport"
+)
+
+// Initialize the singleton instance.
+// NOTE: This file is named zzz_singleton_internal.go so that
+// the init function is initialized after all the providers
+// have been registered.
+
+//publicapigen:drop
+var Singleton *Manager
+
+func init() {
+	Singleton = NewManager(appconf.Static, appconf.Runtime, reqtrack.Singleton,
+		testsupport.Singleton, logging.RootLogger)
+	shutdown.Singleton.RegisterShutdownHandler(Singleton.Shutdown)
+}
diff --git a/runtimes/go/storage/sqldb/db.go b/runtimes/go/storage/sqldb/db.go
new file mode 100644
index 0000000000..a8c9abcd34
--- /dev/null
+++ b/runtimes/go/storage/sqldb/db.go
@@ -0,0 +1,378 @@
+package sqldb
+
+import (
+	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"database/sql"
+	"database/sql/driver"
+	"errors"
+	"fmt"
+	"net"
+	"strings"
+	"sync"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/storage/sqldb/internal/stdlibdriver"
+)
+
+type Database struct {
+	name     string
+	origName string // original name if this was cloned.
+	mgr      *Manager
+
+	noopDB bool // true if this is a dummy database that does nothing and returns errors for all operations
+
+	initOnce sync.Once
+	pool     *pgxpool.Pool
+	connStr  string
+
+	stdlibOnce sync.Once
+	stdlib     *sql.DB
+}
+
+var errNoopDB = errors.New("sqldb: this service is not configured to use this database. Use sqldb.Named in this service to get a reference and access to the database from this service")
+
+func (db *Database) init() {
+	if db.noopDB {
+		return
+	}
+
+	db.initOnce.Do(func() {
+		if db.pool == nil {
+			pool, found := db.mgr.getPool(db.origName, db.name)
+			db.pool, db.noopDB = pool, !found
+		}
+
+		if !db.noopDB {
+			db.connStr = stdlibdriver.RegisterConnConfig(db.pool.Config().ConnConfig)
+		}
+	})
+}
+
+// Stdlib returns a *sql.DB object that is connected to the same db,
+// for use with libraries that expect a *sql.DB.
+func (db *Database) Stdlib() *sql.DB {
+	// If this is a noop database, return a dummy *sql.DB that returns errors for all operations.
+	if db.noopDB {
+		registerNoopDriverOnce.Do(func() {
+			sql.Register(noopDriverName, noopDriver{})
+		})
+
+		return sql.OpenDB(noopConnector{})
+	}
+
+	db.init()
+
+	var openErr error
+	db.stdlibOnce.Do(func() {
+		c, err := registerStdlibDriver(db.mgr).(driver.DriverContext).OpenConnector(db.connStr)
+		if err == nil {
+			db.stdlib = sql.OpenDB(c)
+
+			// Set the pool size based on the config.
+			cfg := db.pool.Config()
+			maxConns := int(cfg.MaxConns)
+			db.stdlib.SetMaxOpenConns(maxConns)
+			db.stdlib.SetConnMaxIdleTime(cfg.MaxConnIdleTime)
+			db.stdlib.SetMaxIdleConns(maxConns)
+		}
+		openErr = err
+	})
+	if openErr != nil {
+		// This should never happen as (*stdlib.Driver).OpenConnector is hard-coded to never return nil.
+		// Guard it with a panic so we detect it as early as possible in case this changes.
+		panic("sqldb: stdlib.OpenConnector failed: " + openErr.Error())
+	}
+	return db.stdlib
+}
+
+func (db *Database) shutdown() {
+	if db.pool != nil {
+		db.pool.Close()
+	}
+	if db.stdlib != nil {
+		_ = db.stdlib.Close()
+	}
+}
+
+// dbConf computes a suitable pgxpool config given a database config.
+// If dbNameOverride is provided, it overrides the database name used when connecting,
+// for testing purposes.
+func dbConf(srv *config.SQLServer, db *config.SQLDatabase, dbNameOverride string) (*pgxpool.Config, error) {
+	dbName := dbNameOverride
+	if dbName == "" {
+		dbName = db.DatabaseName
+	}
+	uri := fmt.Sprintf("user=%s password=%s dbname=%s", db.User, db.Password, dbName)
+
+	// Handle different ways of expressing the host
+	if strings.HasPrefix(srv.Host, "/") {
+		uri += " host=" + srv.Host // unix socket
+	} else if host, port, err := net.SplitHostPort(srv.Host); err == nil {
+		uri += fmt.Sprintf(" host=%s port=%s", host, port) // host:port
+	} else {
+		uri += " host=" + srv.Host // hostname
+	}
+
+	if srv.ServerCACert != "" {
+		uri += " sslmode=verify-ca"
+	} else {
+		uri += " sslmode=prefer"
+	}
+
+	cfg, err := pgxpool.ParseConfig(uri)
+	if err != nil {
+		return nil, fmt.Errorf("invalid database uri: %v", err)
+	}
+
+	// Set the pool size based on the config.
+	cfg.MaxConns = 30
+	if n := db.MaxConnections; n > 0 {
+		cfg.MaxConns = int32(n)
+	}
+
+	// If we have a server CA, set it in the TLS config.
+	if srv.ServerCACert != "" {
+		caCertPool := x509.NewCertPool()
+		if !caCertPool.AppendCertsFromPEM([]byte(srv.ServerCACert)) {
+			return nil, fmt.Errorf("invalid server ca cert")
+		}
+		cfg.ConnConfig.TLSConfig.RootCAs = caCertPool
+		cfg.ConnConfig.TLSConfig.ClientCAs = caCertPool
+	}
+
+	// If we have a client cert, set it in the TLS config.
+	if srv.ClientCert != "" {
+		cert, err := tls.X509KeyPair([]byte(srv.ClientCert), []byte(srv.ClientKey))
+		if err != nil {
+			return nil, fmt.Errorf("parse client cert: %v", err)
+		}
+		cfg.ConnConfig.TLSConfig.Certificates = []tls.Certificate{cert}
+	}
+
+	return cfg, nil
+}
+
+// Exec executes a query without returning any rows.
+// The args are for any placeholder parameters in the query.
+//
+// See (*database/sql.DB).ExecContext() for additional documentation.
+func (db *Database) Exec(ctx context.Context, query string, args ...interface{}) (ExecResult, error) {
+	if db.noopDB {
+		return nil, errNoopDB
+	}
+
+	db.init()
+
+	var (
+		startEventID model.TraceEventID
+		eventParams  trace2.EventParams
+	)
+
+	curr := db.mgr.rt.Current()
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams = trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		startEventID = curr.Trace.DBQueryStart(trace2.DBQueryStartParams{
+			EventParams: eventParams,
+			Query:       query,
+			TxStartID:   0,
+			Stack:       stack.Build(4),
+		})
+	}
+
+	res, err := db.pool.Exec(markTraced(ctx), query, args...)
+	err = convertErr(err)
+
+	if curr.Trace != nil {
+		curr.Trace.DBQueryEnd(eventParams, startEventID, err)
+	}
+
+	return res, err
+}
+
+// Query executes a query that returns rows, typically a SELECT.
+// The args are for any placeholder parameters in the query.
+//
+// See (*database/sql.DB).QueryContext() for additional documentation.
+func (db *Database) Query(ctx context.Context, query string, args ...interface{}) (*Rows, error) {
+	if db.noopDB {
+		return nil, errNoopDB
+	}
+
+	db.init()
+
+	var (
+		startEventID model.TraceEventID
+		eventParams  trace2.EventParams
+	)
+
+	curr := db.mgr.rt.Current()
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams = trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		startEventID = curr.Trace.DBQueryStart(trace2.DBQueryStartParams{
+			EventParams: eventParams,
+			Query:       query,
+			Stack:       stack.Build(4),
+		})
+	}
+
+	rows, err := db.pool.Query(markTraced(ctx), query, args...)
+	err = convertErr(err)
+
+	if curr.Trace != nil {
+		curr.Trace.DBQueryEnd(eventParams, startEventID, err)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+	return &Rows{std: rows}, nil
+}
+
+// QueryRow executes a query that is expected to return at most one row.
+//
+// See (*database/sql.DB).QueryRowContext() for additional documentation.
+func (db *Database) QueryRow(ctx context.Context, query string, args ...interface{}) *Row {
+	if db.noopDB {
+		return &Row{err: errNoopDB}
+	}
+
+	db.init()
+
+	var (
+		startEventID model.TraceEventID
+		eventParams  trace2.EventParams
+	)
+
+	curr := db.mgr.rt.Current()
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams = trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		startEventID = curr.Trace.DBQueryStart(trace2.DBQueryStartParams{
+			EventParams: eventParams,
+			Query:       query,
+			Stack:       stack.Build(4),
+		})
+	}
+
+	rows, err := db.pool.Query(markTraced(ctx), query, args...)
+	err = convertErr(err)
+	r := &Row{rows: rows, err: err}
+
+	if curr.Trace != nil {
+		curr.Trace.DBQueryEnd(eventParams, startEventID, err)
+	}
+
+	return r
+}
+
+// Begin opens a new database transaction.
+//
+// See (*database/sql.DB).Begin() for additional documentation.
+func (db *Database) Begin(ctx context.Context) (*Tx, error) {
+	if db.noopDB {
+		return nil, errNoopDB
+	}
+
+	db.init()
+	tx, err := db.pool.Begin(markTraced(ctx))
+	err = convertErr(err)
+	if err != nil {
+		return nil, err
+	}
+
+	var startID model.TraceEventID
+	curr := db.mgr.rt.Current()
+	if curr.Req != nil && curr.Trace != nil {
+		startID = curr.Trace.DBTransactionStart(trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+		}, stack.Build(4))
+	}
+
+	return &Tx{mgr: db.mgr, std: tx, startID: startID}, nil
+}
+
+// Driver returns the underlying database driver for this database connection pool.
+//
+//	var db = sqldb.Driver[*pgxpool.Pool](sqldb.Named("mydatabase"))
+//
+// This is defined as a generic function to allow compile-time type checking
+// that the Encore application is expecting a driver that is supported.
+//
+// At some point in the future where Encore adds support for a different database driver
+// this will be made with backwards compatibility in mind, providing ample notice and
+// time to migrate in an opt-in fashion.
+func Driver[T SupportedDrivers](db *Database) T {
+	db.init()
+	if db.noopDB {
+		var zero T
+		return zero
+	}
+
+	return any(db.pool).(T)
+}
+
+// SupportedDrivers is a type list of all supported database drivers.
+// Currently only [*pgxpool.Pool] is supported.
+type SupportedDrivers interface {
+	*pgxpool.Pool
+}
+
+// DriverConn provides access to the underlying driver connection given a stdlib
+// *sql.Conn connection. The driverConn must not be used outside of f, and conn
+// must be a *sql.Conn originating from sqldb.Database or this function panics.
+//
+//	conn, _ := db.Stdlib().Conn(ctx) // Checkout a connection from the pool
+//	sqldb.DriverConn(conn, func(driverConn *pgx.Conn) error) error {
+//	  // do stuff with *pgx.Conn
+//	}
+//
+// This is defined as a generic function to allow compile-time type checking
+// that the Encore application is expecting a driver that is supported.
+//
+// At some point in the future where Encore adds support for a different
+// database driver this will be made with backwards compatibility in mind,
+// providing ample notice and time to migrate in an opt-in fashion.
+func DriverConn[T SupportedDriverConns](conn *sql.Conn, f func(driverConn T) error) error {
+	return conn.Raw(func(c any) error {
+		switch c := c.(type) {
+		case wrappedConn:
+			parentConn := c.parent
+			rawConn := (parentConn).(*stdlibdriver.Conn).Conn()
+			return f(rawConn)
+		case noopConn:
+			return errNoopDB
+		default:
+			panic(fmt.Sprintf("sqldb.DriverConn: unsupported connection type %T", c))
+		}
+	})
+}
+
+// SupportedDriverConns is a type list of all supported database drivers
+// connections. Currently only [*pgx.Conn] is supported.
+type SupportedDriverConns interface {
+	*pgx.Conn
+}
diff --git a/runtimes/go/storage/sqldb/errors.go b/runtimes/go/storage/sqldb/errors.go
new file mode 100644
index 0000000000..4bd2ca9ffe
--- /dev/null
+++ b/runtimes/go/storage/sqldb/errors.go
@@ -0,0 +1,116 @@
+package sqldb
+
+import (
+	"database/sql"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+
+	"encore.dev/beta/errs"
+	"encore.dev/storage/sqldb/sqlerr"
+)
+
+// ErrCode reports the error code for a given error.
+// If the error is nil or is not of type *Error it reports sqlerr.Other.
+func ErrCode(err error) sqlerr.Code {
+	var pgerr *Error
+	if errors.As(err, &pgerr) {
+		return pgerr.Code
+	}
+	return sqlerr.Other
+}
+
+// Error represents an error reported by the database server.
+// It's not guaranteed all errors reported by sqldb functions will be of this type;
+// it is only returned when the database reports an error.
+//
+// Note that the fields for schema name, table name, column name, data type name,
+// and constraint name are supplied only for a limited number of error types;
+// see https://www.postgresql.org/docs/current/errcodes-appendix.html.
+//
+// You should not assume that the presence of any of these fields guarantees
+// the presence of another field.
+type Error struct {
+	// Code defines the general class of the error.
+	// See [sqlerr.Code] for a list of possible values.
+	Code sqlerr.Code
+
+	// Severity is the severity of the error.
+	Severity sqlerr.Severity
+
+	// DatabaseCode is the database server-specific error code.
+	// It is specific to the underlying database server.
+	DatabaseCode string
+
+	// Message: the primary human-readable error message. This should be accurate
+	// but terse (typically one line). Always present.
+	Message string
+
+	// SchemaName: if the error was associated with a specific database object,
+	// the name of the schema containing that object, if any.
+	SchemaName string
+
+	// TableName: if the error was associated with a specific table, the name of the table.
+	// (Refer to the schema name field for the name of the table's schema.)
+	TableName string
+
+	// ColumnName: if the error was associated with a specific table column,
+	// the name of the column. (Refer to the schema and table name fields to identify the table.)
+	ColumnName string
+
+	// Data type name: if the error was associated with a specific data type,
+	// the name of the data type. (Refer to the schema name field for the name of the data type's schema.)
+	DataTypeName string
+
+	// Constraint name: if the error was associated with a specific constraint,
+	// the name of the constraint. Refer to fields listed above for the associated
+	// table or domain. (For this purpose, indexes are treated as constraints,
+	// even if they weren't created with constraint syntax.)
+	ConstraintName string
+
+	// driverErr is the underlying error from the driver.
+	// It's used to support errors.As and errors.Is to preserve
+	// backwards compatibility.
+	driverErr error
+}
+
+func (pe *Error) Error() string {
+	return string(pe.Severity) + ": " + pe.Message + " (Code " + string(pe.Code) + ": SQLSTATE " + pe.DatabaseCode + ")"
+}
+
+func (pe *Error) Unwrap() error {
+	return pe.driverErr
+}
+
+func convertErr(err error) error {
+	var pgerr *pgconn.PgError
+	if errors.As(err, &pgerr) {
+		err = convertPgError(pgerr)
+	}
+
+	switch err {
+	case pgx.ErrNoRows, sql.ErrNoRows:
+		err = errs.WrapCode(sql.ErrNoRows, errs.NotFound, "")
+	case pgx.ErrTxClosed, pgx.ErrTxCommitRollback, sql.ErrTxDone, sql.ErrConnDone:
+		err = errs.WrapCode(err, errs.Internal, "")
+	default:
+		err = errs.WrapCode(err, errs.Unavailable, "")
+	}
+	return errs.DropStackFrame(err)
+}
+
+func convertPgError(src *pgconn.PgError) error {
+	return &Error{
+		Code:           sqlerr.MapCode(src.Code),
+		Severity:       sqlerr.MapSeverity(src.Severity),
+		DatabaseCode:   src.Code,
+		Message:        src.Message,
+		SchemaName:     src.SchemaName,
+		TableName:      src.TableName,
+		ColumnName:     src.ColumnName,
+		DataTypeName:   src.DataTypeName,
+		ConstraintName: src.ConstraintName,
+		driverErr:      src,
+	}
+}
diff --git a/runtimes/go/storage/sqldb/errors_internal.go b/runtimes/go/storage/sqldb/errors_internal.go
new file mode 100644
index 0000000000..08ccf8e0d7
--- /dev/null
+++ b/runtimes/go/storage/sqldb/errors_internal.go
@@ -0,0 +1,95 @@
+package sqldb
+
+import (
+	jsoniter "github.com/json-iterator/go"
+
+	"encore.dev/appruntime/apisdk/api/errmarshalling"
+	"encore.dev/storage/sqldb/sqlerr"
+)
+
+// Register an internal error marshaller for the sqldb.Error
+func init() {
+	errmarshalling.RegisterErrorMarshaller(
+		func(err *Error, stream *jsoniter.Stream) {
+			stream.WriteObjectField("code")
+			stream.WriteString(string(err.Code))
+
+			stream.WriteMore()
+			stream.WriteObjectField("severity")
+			stream.WriteString(string(err.Severity))
+
+			stream.WriteMore()
+			stream.WriteObjectField("db_code")
+			stream.WriteString(err.DatabaseCode)
+
+			stream.WriteMore()
+			stream.WriteObjectField(errmarshalling.MessageKey)
+			stream.WriteString(err.Message)
+
+			if err.SchemaName != "" {
+				stream.WriteMore()
+				stream.WriteObjectField("schema")
+				stream.WriteString(err.SchemaName)
+			}
+
+			if err.TableName != "" {
+				stream.WriteMore()
+				stream.WriteObjectField("table")
+				stream.WriteString(err.TableName)
+			}
+
+			if err.ColumnName != "" {
+				stream.WriteMore()
+				stream.WriteObjectField("column")
+				stream.WriteString(err.ColumnName)
+			}
+
+			if err.DataTypeName != "" {
+				stream.WriteMore()
+				stream.WriteObjectField("data_type")
+				stream.WriteString(err.DataTypeName)
+			}
+
+			if err.ConstraintName != "" {
+				stream.WriteMore()
+				stream.WriteObjectField("constraint")
+				stream.WriteString(err.ConstraintName)
+			}
+
+			if err.driverErr != nil {
+				stream.WriteMore()
+				stream.WriteObjectField(errmarshalling.WrappedKey)
+				stream.WriteVal(err.driverErr)
+			}
+		},
+		func(err *Error, iter *jsoniter.Iterator) {
+			iter.ReadObjectCB(func(iter *jsoniter.Iterator, field string) bool {
+				switch field {
+				case "code":
+					err.Code = sqlerr.Code(iter.ReadString())
+				case "severity":
+					err.Severity = sqlerr.Severity(iter.ReadString())
+				case "db_code":
+					err.DatabaseCode = iter.ReadString()
+				case errmarshalling.MessageKey:
+					err.Message = iter.ReadString()
+				case "schema":
+					err.SchemaName = iter.ReadString()
+				case "table":
+					err.TableName = iter.ReadString()
+				case "column":
+					err.ColumnName = iter.ReadString()
+				case "data_type":
+					err.DataTypeName = iter.ReadString()
+				case "constraint":
+					err.ConstraintName = iter.ReadString()
+				case errmarshalling.WrappedKey:
+					err.driverErr = errmarshalling.UnmarshalError(iter)
+				default:
+					iter.Skip()
+				}
+				return true
+			})
+		},
+	)
+}
diff --git a/runtimes/go/storage/sqldb/errors_test.go b/runtimes/go/storage/sqldb/errors_test.go
new file mode 100644
index 0000000000..a3e8862fe3
--- /dev/null
+++ b/runtimes/go/storage/sqldb/errors_test.go
@@ -0,0 +1,28 @@
+package sqldb
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"testing"
+
+	"encore.dev/storage/sqldb/sqlerr"
+)
+
+func TestErrCode(t *testing.T) {
+	tests := []struct {
+		err  error
+		want sqlerr.Code
+	}{
+		{err: nil, want: sqlerr.Other},
+		{err: io.EOF, want: sqlerr.Other},
+		{err: errors.New("some error"), want: sqlerr.Other},
+		{err: &Error{Code: sqlerr.UniqueViolation}, want: sqlerr.UniqueViolation},
+		{err: fmt.Errorf("wrapped: %w", &Error{Code: sqlerr.UniqueViolation}), want: sqlerr.UniqueViolation},
+	}
+	for _, tt := range tests {
+		if got := ErrCode(tt.err); got != tt.want {
+			t.Errorf("ErrCode(%v) = %v, want %v", tt.err, got, tt.want)
+		}
+	}
+}
diff --git a/runtimes/go/storage/sqldb/internal/stdlibdriver/LICENSE b/runtimes/go/storage/sqldb/internal/stdlibdriver/LICENSE
new file mode 100644
index 0000000000..5c486c39a2
--- /dev/null
+++ b/runtimes/go/storage/sqldb/internal/stdlibdriver/LICENSE
@@ -0,0 +1,22 @@
+Copyright (c) 2013-2021 Jack Christensen
+
+MIT License
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to
+permit persons to whom the Software is furnished to do so, subject to
+the following conditions:
+
+The above copyright notice and this permission notice shall be
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/runtimes/go/storage/sqldb/internal/stdlibdriver/stdlibdriver.go b/runtimes/go/storage/sqldb/internal/stdlibdriver/stdlibdriver.go
new file mode 100644
index 0000000000..c7c7a9a07d
--- /dev/null
+++ b/runtimes/go/storage/sqldb/internal/stdlibdriver/stdlibdriver.go
@@ -0,0 +1,601 @@
+// Package stdlibdriver is a vendored version of github.com/jackc/pgx/v5/stdlib,
+// skipping the stdlib driver registration since we use OpenDB and pass in a driver.
+// Its license can be found in ./LICENSE.
+package stdlibdriver
+
+import (
+	"context"
+	"database/sql"
+	"database/sql/driver"
+	"errors"
+	"fmt"
+	"io"
+	"math"
+	"reflect"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+// Only intrinsic types should be binary format with database/sql.
+var databaseSQLResultFormats pgx.QueryResultFormatsByOID
+
+var pgxDriver *Driver
+
+func init() {
+	pgxDriver = &Driver{
+		configs: make(map[string]*pgx.ConnConfig),
+	}
+
+	databaseSQLResultFormats = pgx.QueryResultFormatsByOID{
+		pgtype.BoolOID:        1,
+		pgtype.ByteaOID:       1,
+		pgtype.CIDOID:         1,
+		pgtype.DateOID:        1,
+		pgtype.Float4OID:      1,
+		pgtype.Float8OID:      1,
+		pgtype.Int2OID:        1,
+		pgtype.Int4OID:        1,
+		pgtype.Int8OID:        1,
+		pgtype.OIDOID:         1,
+		pgtype.TimestampOID:   1,
+		pgtype.TimestamptzOID: 1,
+		pgtype.XIDOID:         1,
+	}
+}
+
+// GetDefaultDriver returns the driver initialized in the init function
+// and used when the pgx driver is registered.
+func GetDefaultDriver() driver.Driver {
+	return pgxDriver
+}
+
+type Driver struct {
+	configMutex sync.Mutex
+	configs     map[string]*pgx.ConnConfig
+	sequence    int
+}
+
+func (d *Driver) Open(name string) (driver.Conn, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second) // Ensure eventual timeout
+	defer cancel()
+
+	connector, err := d.OpenConnector(name)
+	if err != nil {
+		return nil, err
+	}
+	return connector.Connect(ctx)
+}
+
+func (d *Driver) OpenConnector(name string) (driver.Connector, error) {
+	return &driverConnector{driver: d, name: name}, nil
+}
+
+func (d *Driver) registerConnConfig(c *pgx.ConnConfig) string {
+	d.configMutex.Lock()
+	connStr := fmt.Sprintf("registeredConnConfig%d", d.sequence)
+	d.sequence++
+	d.configs[connStr] = c
+	d.configMutex.Unlock()
+	return connStr
+}
+
+func (d *Driver) unregisterConnConfig(connStr string) {
+	d.configMutex.Lock()
+	delete(d.configs, connStr)
+	d.configMutex.Unlock()
+}
+
+type driverConnector struct {
+	driver *Driver
+	name   string
+}
+
+func (dc *driverConnector) Connect(ctx context.Context) (driver.Conn, error) {
+	var connConfig *pgx.ConnConfig
+
+	dc.driver.configMutex.Lock()
+	connConfig = dc.driver.configs[dc.name]
+	dc.driver.configMutex.Unlock()
+
+	if connConfig == nil {
+		var err error
+		connConfig, err = pgx.ParseConfig(dc.name)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	conn, err := pgx.ConnectConfig(ctx, connConfig)
+	if err != nil {
+		return nil, err
+	}
+
+	c := &Conn{
+		conn:             conn,
+		driver:           dc.driver,
+		connConfig:       *connConfig,
+		resetSessionFunc: func(context.Context, *pgx.Conn) error { return nil },
+	}
+
+	return c, nil
+}
+
+func (dc *driverConnector) Driver() driver.Driver {
+	return dc.driver
+}
+
+// RegisterConnConfig registers a ConnConfig and returns the connection string to use with Open.
+func RegisterConnConfig(c *pgx.ConnConfig) string {
+	return pgxDriver.registerConnConfig(c)
+}
+
+// UnregisterConnConfig removes the ConnConfig registration for connStr.
+func UnregisterConnConfig(connStr string) {
+	pgxDriver.unregisterConnConfig(connStr)
+}
+
+type Conn struct {
+	conn                 *pgx.Conn
+	psCount              int64 // Counter used for creating unique prepared statement names
+	driver               *Driver
+	connConfig           pgx.ConnConfig
+	resetSessionFunc     func(context.Context, *pgx.Conn) error // Function is called before a connection is reused
+	lastResetSessionTime time.Time
+}
+
+// Conn returns the underlying *pgx.Conn
+func (c *Conn) Conn() *pgx.Conn {
+	return c.conn
+}
+
+func (c *Conn) Prepare(query string) (driver.Stmt, error) {
+	return c.PrepareContext(context.Background(), query)
+}
+
+func (c *Conn) PrepareContext(ctx context.Context, query string) (driver.Stmt, error) {
+	if c.conn.IsClosed() {
+		return nil, driver.ErrBadConn
+	}
+
+	name := fmt.Sprintf("pgx_%d", c.psCount)
+	c.psCount++
+
+	sd, err := c.conn.Prepare(ctx, name, query)
+	if err != nil {
+		return nil, err
+	}
+
+	return &Stmt{sd: sd, conn: c}, nil
+}
+
+func (c *Conn) Close() error {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+	return c.conn.Close(ctx)
+}
+
+func (c *Conn) Begin() (driver.Tx, error) {
+	return c.BeginTx(context.Background(), driver.TxOptions{})
+}
+
+func (c *Conn) BeginTx(ctx context.Context, opts driver.TxOptions) (driver.Tx, error) {
+	if c.conn.IsClosed() {
+		return nil, driver.ErrBadConn
+	}
+
+	var pgxOpts pgx.TxOptions
+	switch sql.IsolationLevel(opts.Isolation) {
+	case sql.LevelDefault:
+	case sql.LevelReadUncommitted:
+		pgxOpts.IsoLevel = pgx.ReadUncommitted
+	case sql.LevelReadCommitted:
+		pgxOpts.IsoLevel = pgx.ReadCommitted
+	case sql.LevelRepeatableRead, sql.LevelSnapshot:
+		pgxOpts.IsoLevel = pgx.RepeatableRead
+	case sql.LevelSerializable:
+		pgxOpts.IsoLevel = pgx.Serializable
+	default:
+		return nil, fmt.Errorf("unsupported isolation: %v", opts.Isolation)
+	}
+
+	if opts.ReadOnly {
+		pgxOpts.AccessMode = pgx.ReadOnly
+	}
+
+	tx, err := c.conn.BeginTx(ctx, pgxOpts)
+	if err != nil {
+		return nil, err
+	}
+
+	return wrapTx{ctx: ctx, tx: tx}, nil
+}
+
+func (c *Conn) ExecContext(ctx context.Context, query string, argsV []driver.NamedValue) (driver.Result, error) {
+	if c.conn.IsClosed() {
+		return nil, driver.ErrBadConn
+	}
+
+	args := namedValueToInterface(argsV)
+
+	commandTag, err := c.conn.Exec(ctx, query, args...)
+	// if we got a network error before we had a chance to send the query, retry
+	if err != nil {
+		if pgconn.SafeToRetry(err) {
+			return nil, driver.ErrBadConn
+		}
+	}
+	return driver.RowsAffected(commandTag.RowsAffected()), err
+}
+
+func (c *Conn) QueryContext(ctx context.Context, query string, argsV []driver.NamedValue) (driver.Rows, error) {
+	if c.conn.IsClosed() {
+		return nil, driver.ErrBadConn
+	}
+
+	args := []any{databaseSQLResultFormats}
+	args = append(args, namedValueToInterface(argsV)...)
+
+	rows, err := c.conn.Query(ctx, query, args...)
+	if err != nil {
+		if pgconn.SafeToRetry(err) {
+			return nil, driver.ErrBadConn
+		}
+		return nil, err
+	}
+
+	// Preload first row because otherwise we won't know what columns are available when database/sql asks.
+	more := rows.Next()
+	if err = rows.Err(); err != nil {
+		rows.Close()
+		return nil, err
+	}
+	return &Rows{conn: c, rows: rows, skipNext: true, skipNextMore: more}, nil
+}
+
+func (c *Conn) Ping(ctx context.Context) error {
+	if c.conn.IsClosed() {
+		return driver.ErrBadConn
+	}
+
+	err := c.conn.Ping(ctx)
+	if err != nil {
+		// A Ping failure implies some sort of fatal state. The connection is almost certainly already closed by the
+		// failure, but manually close it just to be sure.
+		_ = c.Close()
+		return driver.ErrBadConn
+	}
+
+	return nil
+}
+
+func (c *Conn) CheckNamedValue(*driver.NamedValue) error {
+	// Underlying pgx supports sql.Scanner and driver.Valuer interfaces natively. So everything can be passed through directly.
+	return nil
+}
+
+func (c *Conn) ResetSession(ctx context.Context) error {
+	if c.conn.IsClosed() {
+		return driver.ErrBadConn
+	}
+
+	now := time.Now()
+	if now.Sub(c.lastResetSessionTime) > time.Second {
+		if err := c.conn.PgConn().CheckConn(); err != nil {
+			return driver.ErrBadConn
+		}
+	}
+	c.lastResetSessionTime = now
+
+	return c.resetSessionFunc(ctx, c.conn)
+}
+
+type Stmt struct {
+	sd   *pgconn.StatementDescription
+	conn *Conn
+}
+
+func (s *Stmt) Close() error {
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	defer cancel()
+	return s.conn.conn.Deallocate(ctx, s.sd.Name)
+}
+
+func (s *Stmt) NumInput() int {
+	return len(s.sd.ParamOIDs)
+}
+
+func (s *Stmt) Exec(argsV []driver.Value) (driver.Result, error) {
+	return nil, errors.New("Stmt.Exec deprecated and not implemented")
+}
+
+func (s *Stmt) ExecContext(ctx context.Context, argsV []driver.NamedValue) (driver.Result, error) {
+	return s.conn.ExecContext(ctx, s.sd.Name, argsV)
+}
+
+func (s *Stmt) Query(argsV []driver.Value) (driver.Rows, error) {
+	return nil, errors.New("Stmt.Query deprecated and not implemented")
+}
+
+func (s *Stmt) QueryContext(ctx context.Context, argsV []driver.NamedValue) (driver.Rows, error) {
+	return s.conn.QueryContext(ctx, s.sd.Name, argsV)
+}
+
+type rowValueFunc func(src []byte) (driver.Value, error)
+
+type Rows struct {
+	conn         *Conn
+	rows         pgx.Rows
+	valueFuncs   []rowValueFunc
+	skipNext     bool
+	skipNextMore bool
+
+	columnNames []string
+}
+
+func (r *Rows) Columns() []string {
+	if r.columnNames == nil {
+		fields := r.rows.FieldDescriptions()
+		r.columnNames = make([]string, len(fields))
+		for i, fd := range fields {
+			r.columnNames[i] = string(fd.Name)
+		}
+	}
+
+	return r.columnNames
+}
+
+// ColumnTypeDatabaseTypeName returns the database system type name. If the name is unknown the OID is returned.
+func (r *Rows) ColumnTypeDatabaseTypeName(index int) string {
+	if dt, ok := r.conn.conn.TypeMap().TypeForOID(r.rows.FieldDescriptions()[index].DataTypeOID); ok {
+		return strings.ToUpper(dt.Name)
+	}
+
+	return strconv.FormatInt(int64(r.rows.FieldDescriptions()[index].DataTypeOID), 10)
+}
+
+const varHeaderSize = 4
+
+// ColumnTypeLength returns the length of the column type if the column is a
+// variable length type. If the column is not a variable length type ok
+// should return false.
+func (r *Rows) ColumnTypeLength(index int) (int64, bool) {
+	fd := r.rows.FieldDescriptions()[index]
+
+	switch fd.DataTypeOID {
+	case pgtype.TextOID, pgtype.ByteaOID:
+		return math.MaxInt64, true
+	case pgtype.VarcharOID, pgtype.BPCharArrayOID:
+		return int64(fd.TypeModifier - varHeaderSize), true
+	default:
+		return 0, false
+	}
+}
+
+// ColumnTypePrecisionScale should return the precision and scale for decimal
+// types. If not applicable, ok should be false.
+func (r *Rows) ColumnTypePrecisionScale(index int) (precision, scale int64, ok bool) {
+	fd := r.rows.FieldDescriptions()[index]
+
+	switch fd.DataTypeOID {
+	case pgtype.NumericOID:
+		mod := fd.TypeModifier - varHeaderSize
+		precision = int64((mod >> 16) & 0xffff)
+		scale = int64(mod & 0xffff)
+		return precision, scale, true
+	default:
+		return 0, 0, false
+	}
+}
+
+// ColumnTypeScanType returns the value type that can be used to scan types into.
+func (r *Rows) ColumnTypeScanType(index int) reflect.Type {
+	fd := r.rows.FieldDescriptions()[index]
+
+	switch fd.DataTypeOID {
+	case pgtype.Float8OID:
+		return reflect.TypeOf(float64(0))
+	case pgtype.Float4OID:
+		return reflect.TypeOf(float32(0))
+	case pgtype.Int8OID:
+		return reflect.TypeOf(int64(0))
+	case pgtype.Int4OID:
+		return reflect.TypeOf(int32(0))
+	case pgtype.Int2OID:
+		return reflect.TypeOf(int16(0))
+	case pgtype.BoolOID:
+		return reflect.TypeOf(false)
+	case pgtype.NumericOID:
+		return reflect.TypeOf(float64(0))
+	case pgtype.DateOID, pgtype.TimestampOID, pgtype.TimestamptzOID:
+		return reflect.TypeOf(time.Time{})
+	case pgtype.ByteaOID:
+		return reflect.TypeOf([]byte(nil))
+	default:
+		return reflect.TypeOf("")
+	}
+}
+
+func (r *Rows) Close() error {
+	r.rows.Close()
+	return r.rows.Err()
+}
+
+func (r *Rows) Next(dest []driver.Value) error {
+	m := r.conn.conn.TypeMap()
+	fieldDescriptions := r.rows.FieldDescriptions()
+
+	if r.valueFuncs == nil {
+		r.valueFuncs = make([]rowValueFunc, len(fieldDescriptions))
+
+		for i, fd := range fieldDescriptions {
+			dataTypeOID := fd.DataTypeOID
+			format := fd.Format
+
+			switch fd.DataTypeOID {
+			case pgtype.BoolOID:
+				var d bool
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					return d, err
+				}
+			case pgtype.ByteaOID:
+				var d []byte
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					return d, err
+				}
+			case pgtype.CIDOID, pgtype.OIDOID, pgtype.XIDOID:
+				var d pgtype.Uint32
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					if err != nil {
+						return nil, err
+					}
+					return d.Value()
+				}
+			case pgtype.DateOID:
+				var d pgtype.Date
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					if err != nil {
+						return nil, err
+					}
+					return d.Value()
+				}
+			case pgtype.Float4OID:
+				var d float32
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					return float64(d), err
+				}
+			case pgtype.Float8OID:
+				var d float64
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					return d, err
+				}
+			case pgtype.Int2OID:
+				var d int16
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					return int64(d), err
+				}
+			case pgtype.Int4OID:
+				var d int32
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					return int64(d), err
+				}
+			case pgtype.Int8OID:
+				var d int64
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					return d, err
+				}
+			case pgtype.JSONOID, pgtype.JSONBOID:
+				var d []byte
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					if err != nil {
+						return nil, err
+					}
+					return d, nil
+				}
+			case pgtype.TimestampOID:
+				var d pgtype.Timestamp
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					if err != nil {
+						return nil, err
+					}
+					return d.Value()
+				}
+			case pgtype.TimestamptzOID:
+				var d pgtype.Timestamptz
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					if err != nil {
+						return nil, err
+					}
+					return d.Value()
+				}
+			default:
+				var d string
+				scanPlan := m.PlanScan(dataTypeOID, format, &d)
+				r.valueFuncs[i] = func(src []byte) (driver.Value, error) {
+					err := scanPlan.Scan(src, &d)
+					return d, err
+				}
+			}
+		}
+	}
+
+	var more bool
+	if r.skipNext {
+		more = r.skipNextMore
+		r.skipNext = false
+	} else {
+		more = r.rows.Next()
+	}
+
+	if !more {
+		if r.rows.Err() == nil {
+			return io.EOF
+		} else {
+			return r.rows.Err()
+		}
+	}
+
+	for i, rv := range r.rows.RawValues() {
+		if rv != nil {
+			var err error
+			dest[i], err = r.valueFuncs[i](rv)
+			if err != nil {
+				return fmt.Errorf("convert field %d failed: %v", i, err)
+			}
+		} else {
+			dest[i] = nil
+		}
+	}
+
+	return nil
+}
+
+func namedValueToInterface(argsV []driver.NamedValue) []any {
+	args := make([]any, 0, len(argsV))
+	for _, v := range argsV {
+		if v.Value != nil {
+			args = append(args, v.Value.(any))
+		} else {
+			args = append(args, nil)
+		}
+	}
+	return args
+}
+
+type wrapTx struct {
+	ctx context.Context
+	tx  pgx.Tx
+}
+
+func (wtx wrapTx) Commit() error { return wtx.tx.Commit(wtx.ctx) }
+
+func (wtx wrapTx) Rollback() error { return wtx.tx.Rollback(wtx.ctx) }
diff --git a/runtimes/go/storage/sqldb/manager_internal.go b/runtimes/go/storage/sqldb/manager_internal.go
new file mode 100644
index 0000000000..169ac3e307
--- /dev/null
+++ b/runtimes/go/storage/sqldb/manager_internal.go
@@ -0,0 +1,128 @@
+package sqldb
+
+import (
+	"context"
+	"sync"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/appruntime/shared/testsupport"
+)
+
+// Manager manages database connections.
+type Manager struct {
+	runtime    *config.Runtime
+	rt         *reqtrack.RequestTracker
+	ts         *testsupport.Manager
+	rootLogger zerolog.Logger
+
+	mu  sync.RWMutex
+	dbs map[string]*Database
+}
+
+func NewManager(runtime *config.Runtime, rt *reqtrack.RequestTracker, ts *testsupport.Manager, rootLogger zerolog.Logger) *Manager {
+	return &Manager{
+		runtime:    runtime,
+		rt:         rt,
+		ts:         ts,
+		rootLogger: rootLogger,
+		dbs:        make(map[string]*Database),
+	}
+}
+
+// GetCurrentDB gets the database for the current request.
+func (mgr *Manager) GetCurrentDB() *Database {
+	var dbName string
+	if curr := mgr.rt.Current(); curr.Req != nil {
+		dbName = curr.Req.Service()
+	} else if testSvc, _ := mgr.ts.TestService(); testSvc != "" {
+		dbName = testSvc
+	} else {
+		panic("sqldb: no current request")
+	}
+	return mgr.GetDB(dbName)
+}
+
+func (mgr *Manager) GetDB(dbName string) *Database {
+	mgr.mu.RLock()
+	db, ok := mgr.dbs[dbName]
+	mgr.mu.RUnlock()
+	if ok {
+		return db
+	}
+
+	mgr.mu.Lock()
+	defer mgr.mu.Unlock()
+	// Check again now that we've re-acquired the mutex
+	if db, ok := mgr.dbs[dbName]; ok {
+		return db
+	}
+	pool, found := mgr.getPool(dbName, "")
+	db = &Database{
+		name:     dbName,
+		origName: dbName,
+		mgr:      mgr,
+		noopDB:   !found,
+		pool:     pool,
+	}
+	mgr.dbs[dbName] = db
+	return db
+}
+
+// getPool returns a database connection pool for the given database name.
+// Each time it's called it returns a new pool.
+func (mgr *Manager) getPool(encoreName, dbNameOverride string) (pool *pgxpool.Pool, found bool) {
+	var db *config.SQLDatabase
+	for _, d := range mgr.runtime.SQLDatabases {
+		if d.EncoreName == encoreName {
+			db = d
+			break
+		}
+	}
+	if db == nil {
+		return nil, false
+	}
+
+	srv := mgr.runtime.SQLServers[db.ServerID]
+	cfg, err := dbConf(srv, db, dbNameOverride)
+	if err != nil {
+		panic("sqldb: " + err.Error())
+	}
+
+	cfg.ConnConfig.Tracer = &pgxTracer{mgr: mgr}
+	pool, err = pgxpool.NewWithConfig(context.Background(), cfg)
+	if err != nil {
+		panic("sqldb: setup db: " + err.Error())
+	}
+
+	return pool, true
+}
+
+func (mgr *Manager) Shutdown(p *shutdown.Process) error {
+	// Wait for all user code to finish before shutting down databases.
+	<-p.ServicesShutdownCompleted.Done()
+	<-p.OutstandingTasks.Done()
+
+	var wg sync.WaitGroup
+	mgr.mu.RLock()
+	defer mgr.mu.RUnlock()
+
+	wg.Add(len(mgr.dbs))
+	for _, db := range mgr.dbs {
+		db := db
+		go func() {
+			defer wg.Done()
+			db.shutdown()
+		}()
+	}
+	wg.Wait()
+	return nil
+}
+
+func (mgr *Manager) Named(name string) *Database {
+	return mgr.GetDB(name)
+}
diff --git a/runtimes/go/storage/sqldb/pgx_tracer_internal.go b/runtimes/go/storage/sqldb/pgx_tracer_internal.go
new file mode 100644
index 0000000000..bd9cf64381
--- /dev/null
+++ b/runtimes/go/storage/sqldb/pgx_tracer_internal.go
@@ -0,0 +1,73 @@
+package sqldb
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/exported/trace2"
+)
+
+type pgxTracer struct {
+	mgr *Manager
+}
+
+type ctxKey string
+
+const (
+	pgxQueryKey ctxKey = "pgx_query"
+
+	// pgxAlreadyTracedKey is a context key that indicates
+	// that the query is already traced through the sqldb integration.
+	pgxAlreadyTracedKey ctxKey = "pgx_query"
+)
+
+func markTraced(ctx context.Context) context.Context {
+	return context.WithValue(ctx, pgxAlreadyTracedKey, true)
+}
+
+type queryValue struct {
+	trace       trace2.Logger
+	eventParams trace2.EventParams
+	startID     model.TraceEventID
+}
+
+func (t *pgxTracer) TraceQueryStart(ctx context.Context, conn *pgx.Conn, data pgx.TraceQueryStartData) context.Context {
+	if ctx.Value(pgxAlreadyTracedKey) != nil {
+		return ctx
+	}
+
+	curr := t.mgr.rt.Current()
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams := trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		startID := curr.Trace.DBQueryStart(trace2.DBQueryStartParams{
+			EventParams: eventParams,
+			Query:       data.SQL,
+			Stack:       stack.Build(5),
+		})
+		ctx = context.WithValue(ctx, pgxQueryKey, &queryValue{
+			trace:       curr.Trace,
+			eventParams: eventParams,
+			startID:     startID,
+		})
+	}
+	return ctx
+}
+
+func (t *pgxTracer) TraceQueryEnd(ctx context.Context, conn *pgx.Conn, data pgx.TraceQueryEndData) {
+	if qv, ok := ctx.Value(pgxQueryKey).(*queryValue); ok {
+		qv.trace.DBQueryEnd(qv.eventParams, qv.startID, data.Err)
+	}
+}
+
+var (
+	_ pgx.QueryTracer = (*pgxTracer)(nil)
+	_ pgx.QueryTracer = (*pgxTracer)(nil)
+)
diff --git a/runtimes/go/storage/sqldb/pkgfn.go b/runtimes/go/storage/sqldb/pkgfn.go
new file mode 100644
index 0000000000..85519a06a2
--- /dev/null
+++ b/runtimes/go/storage/sqldb/pkgfn.go
@@ -0,0 +1,122 @@
+//go:build encore_app
+
+package sqldb
+
+import (
+	"context"
+)
+
+// NewDatabase declares a new SQL database.
+//
+// Encore uses static analysis to identify databases and their configuration,
+// so all parameters passed to this function must be constant literals.
+//
+// A call to NewDatabase can only be made when declaring a package level variable. Any
+// calls to this function made outside a package level variable declaration will result
+// in a compiler error.
+//
+// The database name must be unique within the Encore application. Database names must be defined
+// in kebab-case (lowercase alphanumerics and hyphen separated). Once created and deployed never
+// change the database name, or else a new database will be created.
+func NewDatabase(name string, config DatabaseConfig) *Database {
+	return Singleton.GetDB(name)
+}
+
+// DatabaseConfig specifies configuration for declaring a new database.
+type DatabaseConfig struct {
+	// Migrations is the directory containing the migration files
+	// for this database.
+	//
+	// The path must be slash-separated relative path, and must be rooted within
+	// the package directory (it cannot contain "../").
+	// Valid paths are, for example, "migrations" or "db/migrations".
+	//
+	// Migrations are an ordered sequence of sql files of the format <number>_<description>.up.sql.
+	Migrations string
+}
+
+// Exec executes a query without returning any rows.
+// The args are for any placeholder parameters in the query.
+//
+// See (*database/sql.DB).ExecContext() for additional documentation.
+func Exec(ctx context.Context, query string, args ...interface{}) (ExecResult, error) {
+	return getCurrentDB().Exec(ctx, query, args...)
+}
+
+// Query executes a query that returns rows, typically a SELECT.
+// The args are for any placeholder parameters in the query.
+//
+// See (*database/sql.DB).QueryContext() for additional documentation.
+func Query(ctx context.Context, query string, args ...interface{}) (*Rows, error) {
+	return getCurrentDB().Query(ctx, query, args...)
+}
+
+// QueryRow executes a query that is expected to return at most one row.
+//
+// See (*database/sql.DB).QueryRowContext() for additional documentation.
+func QueryRow(ctx context.Context, query string, args ...interface{}) *Row {
+	return getCurrentDB().QueryRow(ctx, query, args...)
+}
+
+// Begin opens a new database transaction.
+//
+// See (*database/sql.DB).Begin() for additional documentation.
+func Begin(ctx context.Context) (*Tx, error) {
+	return getCurrentDB().Begin(ctx)
+}
+
+// Commit commits the given transaction.
+//
+// See (*database/sql.Tx).Commit() for additional documentation.
+// Deprecated: use tx.Commit() instead.
+func Commit(tx *Tx) error {
+	return tx.Commit()
+}
+
+// Rollback rolls back the given transaction.
+//
+// See (*database/sql.Tx).Rollback() for additional documentation.
+// Deprecated: use tx.Rollback() instead.
+func Rollback(tx *Tx) error {
+	return tx.Rollback()
+}
+
+// ExecTx is like Exec but executes the query in the given transaction.
+//
+// See (*database/sql.Tx).ExecContext() for additional documentation.
+// Deprecated: use tx.Exec() instead.
+func ExecTx(tx *Tx, ctx context.Context, query string, args ...interface{}) (ExecResult, error) {
+	return tx.Exec(ctx, query, args...)
+}
+
+// QueryTx is like Query but executes the query in the given transaction.
+//
+// See (*database/sql.Tx).QueryContext() for additional documentation.
+// Deprecated: use tx.Query() instead.
+func QueryTx(tx *Tx, ctx context.Context, query string, args ...interface{}) (*Rows, error) {
+	return tx.Query(ctx, query, args...)
+}
+
+// QueryRowTx is like QueryRow but executes the query in the given transaction.
+//
+// See (*database/sql.Tx).QueryRowContext() for additional documentation.
+// Deprecated: use tx.QueryRow() instead.
+func QueryRowTx(tx *Tx, ctx context.Context, query string, args ...interface{}) *Row {
+	return tx.QueryRow(ctx, query, args...)
+}
+
+// constStr is a string that can only be provided as a constant.
+//
+//publicapigen:keep
+type constStr string
+
+// Named returns a database object connected to the database with the given name.
+//
+// The name must be a string literal constant, to facilitate static analysis.
+func Named(name constStr) *Database {
+	return Singleton.GetDB(string(name))
+}
+
+func getCurrentDB() *Database {
+	return Singleton.GetCurrentDB()
+}
diff --git a/runtimes/go/storage/sqldb/sqldb.go b/runtimes/go/storage/sqldb/sqldb.go
new file mode 100644
index 0000000000..8ef206b1d9
--- /dev/null
+++ b/runtimes/go/storage/sqldb/sqldb.go
@@ -0,0 +1,270 @@
+// Package sqldb provides Encore services direct access to their databases.
+//
+// For the documentation on how to use databases within Encore see https://encore.dev/docs/develop/databases.
+package sqldb
+
+import (
+	"context"
+	"database/sql"
+
+	"github.com/jackc/pgx/v5"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/exported/trace2"
+	"encore.dev/beta/errs"
+)
+
+// ErrNoRows is an error reported by Scan when QueryRow doesn't return a row.
+// It must be tested against with errors.Is.
+var ErrNoRows = sql.ErrNoRows
+
+// ExecResult is the result of an Exec query.
+type ExecResult interface {
+	// RowsAffected returns the number of rows affected. If the result was not
+	// for a row affecting command (e.g. "CREATE TABLE") then it returns 0.
+	RowsAffected() int64
+}
+
+// Tx is a handle to a database transaction.
+//
+// See *database/sql.Tx for additional documentation.
+type Tx struct {
+	mgr *Manager
+	std pgx.Tx
+
+	startID model.TraceEventID
+}
+
+// Commit commits the given transaction.
+//
+// See (*database/sql.Tx).Commit() for additional documentation.
+func (tx *Tx) Commit() error { return tx.commit() }
+
+// Rollback rolls back the given transaction.
+//
+// See (*database/sql.Tx).Rollback() for additional documentation.
+func (tx *Tx) Rollback() error { return tx.rollback() }
+
+func (tx *Tx) commit() error {
+	err := tx.std.Commit(markTraced(context.Background()))
+	err = convertErr(err)
+
+	if curr := tx.mgr.rt.Current(); curr.Req != nil && curr.Trace != nil {
+		curr.Trace.DBTransactionEnd(trace2.DBTransactionEndParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+				DefLoc:  0,
+			},
+			StartID: tx.startID,
+			Commit:  true,
+			Err:     err,
+			Stack:   stack.Build(4),
+		})
+	}
+
+	return err
+}
+
+func (tx *Tx) rollback() error {
+	err := tx.std.Rollback(markTraced(context.Background()))
+	err = convertErr(err)
+
+	if curr := tx.mgr.rt.Current(); curr.Req != nil && curr.Trace != nil {
+		curr.Trace.DBTransactionEnd(trace2.DBTransactionEndParams{
+			EventParams: trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+				DefLoc:  0,
+			},
+			StartID: tx.startID,
+			Commit:  false,
+			Err:     err,
+			Stack:   stack.Build(4),
+		})
+	}
+
+	return err
+}
+
+func (tx *Tx) Exec(ctx context.Context, query string, args ...interface{}) (ExecResult, error) {
+	return tx.exec(ctx, query, args...)
+}
+
+func (tx *Tx) exec(ctx context.Context, query string, args ...interface{}) (ExecResult, error) {
+	curr := tx.mgr.rt.Current()
+
+	var (
+		startEventID model.TraceEventID
+		eventParams  trace2.EventParams
+	)
+
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams = trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		startEventID = curr.Trace.DBQueryStart(trace2.DBQueryStartParams{
+			EventParams: eventParams,
+			TxStartID:   tx.startID,
+			Query:       query,
+			Stack:       stack.Build(4),
+		})
+	}
+
+	res, err := tx.std.Exec(markTraced(ctx), query, args...)
+	err = convertErr(err)
+
+	if startEventID > 0 {
+		curr.Trace.DBQueryEnd(eventParams, startEventID, err)
+	}
+
+	return res, err
+}
+
+func (tx *Tx) Query(ctx context.Context, query string, args ...interface{}) (*Rows, error) {
+	curr := tx.mgr.rt.Current()
+
+	var (
+		startEventID model.TraceEventID
+		eventParams  trace2.EventParams
+	)
+
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams = trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		startEventID = curr.Trace.DBQueryStart(trace2.DBQueryStartParams{
+			EventParams: eventParams,
+			Query:       query,
+			TxStartID:   tx.startID,
+			Stack:       stack.Build(4),
+		})
+	}
+
+	rows, err := tx.std.Query(markTraced(ctx), query, args...)
+	err = convertErr(err)
+
+	if startEventID > 0 {
+		curr.Trace.DBQueryEnd(eventParams, startEventID, err)
+	}
+
+	if err != nil {
+		return nil, err
+	}
+	return &Rows{std: rows}, nil
+}
+
+func (tx *Tx) QueryRow(ctx context.Context, query string, args ...interface{}) *Row {
+	curr := tx.mgr.rt.Current()
+
+	var (
+		startEventID model.TraceEventID
+		eventParams  trace2.EventParams
+	)
+
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams = trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		curr.Trace.DBQueryStart(trace2.DBQueryStartParams{
+			EventParams: eventParams,
+			Query:       query,
+			TxStartID:   tx.startID,
+			Stack:       stack.Build(4),
+		})
+	}
+
+	// pgx currently does not support .Err() on Row.
+	// Work around this by using Query.
+	rows, err := tx.std.Query(markTraced(ctx), query, args...)
+	err = convertErr(err)
+	r := &Row{rows: rows, err: err}
+
+	if startEventID > 0 {
+		curr.Trace.DBQueryEnd(eventParams, startEventID, err)
+	}
+
+	return r
+}
+
+// Rows is the result of a query. Its cursor starts before the first row
+// of the result set. Use Next to advance from row to row.
+//
+// See *database/sql.Rows for additional documentation.
+type Rows struct {
+	std pgx.Rows
+}
+
+// Close closes the Rows, preventing further enumeration.
+//
+// See (*database/sql.Rows).Close() for additional documentation.
+func (r *Rows) Close() { r.std.Close() }
+
+// Scan copies the columns in the current row into the values pointed
+// at by dest. The number of values in dest must be the same as the
+// number of columns in Rows.
+//
+// See (*database/sql.Rows).Scan() for additional documentation.
+func (r *Rows) Scan(dest ...interface{}) error { return r.std.Scan(dest...) }
+
+// Err returns the error, if any, that was encountered during iteration.
+// Err may be called after an explicit or implicit Close.
+//
+// See (*database/sql.Rows).Err() for additional documentation.
+func (r *Rows) Err() error { return r.std.Err() }
+
+// Next prepares the next result row for reading with the Scan method. It
+// returns true on success, or false if there is no next result row or an error
+// happened while preparing it. Err should be consulted to distinguish between
+// the two cases.
+//
+// Every call to Scan, even the first one, must be preceded by a call to Next.
+//
+// See (*database/sql.Rows).Next() for additional documentation.
+func (r *Rows) Next() bool { return r.std.Next() }
+
+// Row is the result of calling QueryRow to select a single row.
+//
+// See *database/sql.Row for additional documentation.
+type Row struct {
+	rows pgx.Rows
+	err  error
+}
+
+// Scan copies the columns from the matched row into the values
+// pointed at by dest.
+//
+// See (*database/sql.Row).Scan() for additional documentation.
+func (r *Row) Scan(dest ...interface{}) error {
+	if r.err != nil {
+		return r.err
+	}
+	if !r.rows.Next() {
+		if err := r.rows.Err(); err != nil {
+			return convertErr(err)
+		}
+		return errs.DropStackFrame(errs.WrapCode(sql.ErrNoRows, errs.NotFound, ""))
+	}
+	_ = r.rows.Scan(dest...)
+	r.rows.Close()
+	return convertErr(r.rows.Err())
+}
+
+func (r *Row) Err() error {
+	if r.err != nil {
+		return r.err
+	}
+	return convertErr(r.rows.Err())
+}
diff --git a/runtimes/go/storage/sqldb/sqldb_test.go b/runtimes/go/storage/sqldb/sqldb_test.go
new file mode 100644
index 0000000000..f5fb382f2f
--- /dev/null
+++ b/runtimes/go/storage/sqldb/sqldb_test.go
@@ -0,0 +1,93 @@
+package sqldb
+
+import (
+	"os"
+	"strings"
+	"testing"
+	_ "unsafe" // for go:linkname
+
+	"encore.dev/appruntime/exported/config"
+)
+
+func TestDBConf(t *testing.T) {
+	// Unset all the "PG*" variables that may affect the test.
+	for _, env := range os.Environ() {
+		key, _, _ := strings.Cut(env, "=")
+		if strings.HasPrefix(key, "PG") {
+			_ = os.Unsetenv(key)
+		}
+	}
+
+	tests := []struct {
+		Srv      *config.SQLServer
+		DB       *config.SQLDatabase
+		Host     string
+		Port     uint16
+		MaxConns uint32
+	}{
+		{
+			Srv: &config.SQLServer{
+				Host: "/cloudsql/foo",
+			},
+			DB: &config.SQLDatabase{
+				EncoreName:     "ignore",
+				DatabaseName:   "dbname",
+				User:           "user",
+				Password:       "password",
+				MaxConnections: 10,
+			},
+			Host:     "/cloudsql/foo",
+			Port:     5432,
+			MaxConns: 10,
+		},
+		{
+			Srv: &config.SQLServer{
+				Host: "test:123",
+			},
+			DB: &config.SQLDatabase{
+				EncoreName:     "ignore",
+				DatabaseName:   "dbname",
+				User:           "user",
+				Password:       "password",
+				MaxConnections: 0,
+			},
+			Host:     "test",
+			Port:     123,
+			MaxConns: 30,
+		},
+		{
+			Srv: &config.SQLServer{
+				Host: "hostname",
+			},
+			DB: &config.SQLDatabase{
+				EncoreName:     "ignore",
+				DatabaseName:   "dbname",
+				User:           "user",
+				Password:       "password",
+				MaxConnections: 100,
+			},
+			Host:     "hostname",
+			Port:     5432,
+			MaxConns: 100,
+		},
+	}
+
+	for i, test := range tests {
+		cfg, err := dbConf(test.Srv, test.DB, "")
+		if err != nil {
+			t.Fatalf("test %d: unexpected error: %v", i, err)
+		}
+
+		if cfg.ConnConfig.Host != test.Host {
+			t.Fatalf("test %d: got host %s, want %q", i, cfg.ConnConfig.Host, test.Host)
+		} else if cfg.ConnConfig.Port != test.Port {
+			t.Fatalf("test %d: got port %d, want %d", i, cfg.ConnConfig.Port, test.Port)
+		} else if cfg.ConnConfig.Database != test.DB.DatabaseName {
+			t.Fatalf("test %d: got db %s, want %q", i, cfg.ConnConfig.Database, test.DB.DatabaseName)
+		} else if cfg.ConnConfig.User != test.DB.User {
+			t.Fatalf("test %d: got user %s, want %q", i, cfg.ConnConfig.User, test.DB.User)
+		} else if cfg.ConnConfig.Password != test.DB.Password {
+			t.Fatalf("test %d: got password %s, want %q", i, cfg.ConnConfig.Password, test.DB.Password)
+		}
+	}
+}
diff --git a/runtimes/go/storage/sqldb/sqlerr/sqlerr.go b/runtimes/go/storage/sqldb/sqlerr/sqlerr.go
new file mode 100644
index 0000000000..8f9cedca2b
--- /dev/null
+++ b/runtimes/go/storage/sqldb/sqlerr/sqlerr.go
@@ -0,0 +1,120 @@
+// Package sqlerr provides a set of common error codes for SQL datbaases.
+//
+// Not all error codes are supported by all databases, and multiple
+// underlying database errors may map to the same error code if the
+// meaning overlaps.
+//
+// In future releases additional error codes may be added to this
+// package, and the mapping of underlying database errors to these
+// error codes may change.
+package sqlerr
+
+// Code describes a specific type of database error.
+// The value Other is reported when an error does not map to any of the defined codes.
+//
+// Not all error codes are supported by all databases, and multiple
+// underlying database errors may map to the same error code if the
+// meaning overlaps.
+type Code string
+
+const (
+	// Other is reported when an error does not map to any of the defined codes.
+	// Consult the underlying database error for more information.
+	Other Code = "other"
+
+	// NotNullViolation is reported when a not null constraint would be violated.
+	NotNullViolation Code = "not_null_violation"
+
+	// ForeignKeyViolation is reported when a foreign key constraint would be violated.
+	ForeignKeyViolation Code = "foreign_key_violation"
+
+	// UniqueViolation is reported when a unique constraint would be violated.
+	UniqueViolation Code = "unique_violation"
+
+	// CheckViolation is reported when a check constraint would be violated.
+	CheckViolation Code = "check_violation"
+
+	// ExcludeViolation is reported when an exclusion constraint would be violated.
+	ExcludeViolation Code = "exclude_violation"
+
+	// TransactionFailed is reported when running a command in a failed transaction,
+	// due to some previous command failure.
+	TransactionFailed Code = "transaction_failed"
+
+	// DeadlockDetected is reported when a deadlock is detected.
+	// Deadlock detection is done on a best-effort basis and not all deadlocks
+	// can be detected.
+	DeadlockDetected Code = "deadlock_detected"
+
+	// TooManyConnections is reported when the database rejects a connection request
+	// due to reaching the maximum number of connections.
+	// This is different from blocking waiting on a connection pool.
+	TooManyConnections Code = "too_many_connections"
+)
+
+// MapCode maps an underlying database error to an Code.
+//
+//publicapigen:drop
+func MapCode(code string) Code {
+	switch code {
+	case "23502":
+		return NotNullViolation
+	case "23503":
+		return ForeignKeyViolation
+	case "23505":
+		return UniqueViolation
+	case "23514":
+		return CheckViolation
+	case "23P01":
+		return ExcludeViolation
+	case "25P02":
+		return TransactionFailed
+	case "40P01":
+		return DeadlockDetected
+	case "53300":
+		return TooManyConnections
+	default:
+		return Other
+	}
+}
+
+// Severity defines the severity of a database error.
+type Severity string
+
+const (
+	SeverityError   Severity = "ERROR"
+	SeverityFatal   Severity = "FATAL"
+	SeverityPanic   Severity = "PANIC"
+	SeverityWarning Severity = "WARNING"
+	SeverityNotice  Severity = "NOTICE"
+	SeverityDebug   Severity = "DEBUG"
+	SeverityInfo    Severity = "INFO"
+	SeverityLog     Severity = "LOG"
+)
+
+// MapSeverity maps the severity string from the underlying database
+// to a Severity.
+//
+//publicapigen:drop
+func MapSeverity(severity string) Severity {
+	switch severity {
+	case "ERROR":
+		return SeverityError
+	case "FATAL":
+		return SeverityFatal
+	case "PANIC":
+		return SeverityPanic
+	case "WARNING":
+		return SeverityWarning
+	case "NOTICE":
+		return SeverityNotice
+	case "DEBUG":
+		return SeverityDebug
+	case "INFO":
+		return SeverityInfo
+	case "LOG":
+		return SeverityLog
+	default:
+		return SeverityError
+	}
+}
diff --git a/runtimes/go/storage/sqldb/stdlib.go b/runtimes/go/storage/sqldb/stdlib.go
new file mode 100644
index 0000000000..5c22255bfb
--- /dev/null
+++ b/runtimes/go/storage/sqldb/stdlib.go
@@ -0,0 +1,138 @@
+package sqldb
+
+import (
+	"database/sql"
+	"database/sql/driver"
+	"fmt"
+	"sync"
+
+	"encore.dev/storage/sqldb/internal/stdlibdriver"
+)
+
+// RegisterStdlibDriver returns a connection string that can be used with
+// the standard library's sql.Open function to connect to the same db.
+//
+// The connection string should be used with the "encore" driver name:
+//
+//	connStr := sqldb.RegisterStdlibDriver(myDB)
+//	db, err := sql.Open("encore", connStr)
+//
+// The main use case is to support libraries that expect to call sql.Open
+// themselves without exposing the underlying database credentials.
+func RegisterStdlibDriver(db *Database) string {
+	if db == nil {
+		panic("sqldb.StdlibDriver: received nil db")
+	}
+
+	// Initialize the standard library integration for this db.
+	_ = db.Stdlib()
+
+	return registeredAdapters.Register(db)
+}
+
+// combinedDriver combines driver.Driver and driver.DriverContext into a single interface,
+// for drivers that support both interfaces.
+type combinedDriver interface {
+	driver.Driver
+	driver.DriverContext
+}
+
+var (
+	stdlibDriverOnce      sync.Once
+	stdlibDriverSingleton combinedDriver
+)
+
+// stdlibDriver registers the stdlib driver.
+// It uses a sync.Once so it's safe to call multiple times.
+func registerStdlibDriver(mgr *Manager) combinedDriver {
+	stdlibDriverOnce.Do(func() {
+		d := &wrappedDriver{
+			parent: stdlibdriver.GetDefaultDriver(),
+			mw:     &interceptor{mgr: mgr},
+		}
+		sql.Register(stdlibDriverName, d)
+		stdlibDriverSingleton = d
+	})
+	return stdlibDriverSingleton
+}
+
+const stdlibDriverName = "__encore_stdlib"
+
+// registeredAdapters is the singleton registry of all databases that have been
+// registered for stdlib adapters.
+var registeredAdapters = &adapterRegistry{
+	nameToID: make(map[string]string),
+	idToDB:   make(map[string]*Database),
+}
+
+type adapterRegistry struct {
+	mu       sync.Mutex
+	nameToID map[string]string
+	idToDB   map[string]*Database
+}
+
+func (r *adapterRegistry) Register(db *Database) string {
+	registerAdapterDriver(db.mgr)
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	// If it's already registered, return the same identifier.
+	if id, ok := r.nameToID[db.name]; ok {
+		return id
+	}
+
+	ident := fmt.Sprintf("encore/stdlibdriver/%s", db.name)
+	r.nameToID[db.name] = ident
+	r.idToDB[ident] = db
+	return ident
+}
+
+func (r *adapterRegistry) Get(ident string) (*Database, bool) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+	db, ok := r.idToDB[ident]
+	return db, ok
+}
+
+const adapterDriverName = "encore"
+
+type adapterDriver struct{}
+
+func (adapterDriver) Open(ident string) (driver.Conn, error) {
+	db, ok := registeredAdapters.Get(ident)
+	if !ok {
+		return nil, fmt.Errorf("sqldb: unknown database %q (did you register it with sqldb.StdlibDriver?)", ident)
+	} else if db.noopDB {
+		return nil, errNoopDB
+	}
+	return registerStdlibDriver(db.mgr).Open(db.connStr)
+}
+
+func (adapterDriver) OpenConnector(ident string) (driver.Connector, error) {
+	db, ok := registeredAdapters.Get(ident)
+	if !ok {
+		return nil, fmt.Errorf("sqldb: unknown database %q (did you register it with sqldb.StdlibDriver?)", ident)
+	} else if db.noopDB {
+		return nil, errNoopDB
+	}
+	return registerStdlibDriver(db.mgr).OpenConnector(db.connStr)
+}
+
+var (
+	adapterDriverOnce      sync.Once
+	adapterDriverSingleton combinedDriver
+)
+
+// stdlibDriver registers the stdlib driver.
+// It uses a sync.Once so it's safe to call multiple times.
+func registerAdapterDriver(mgr *Manager) combinedDriver {
+	adapterDriverOnce.Do(func() {
+		d := &wrappedDriver{
+			parent: adapterDriver{},
+			mw:     &interceptor{mgr: mgr},
+		}
+		sql.Register(adapterDriverName, d)
+		adapterDriverSingleton = d
+	})
+	return adapterDriverSingleton
+}
diff --git a/runtimes/go/storage/sqldb/stdlib_noop_internal.go b/runtimes/go/storage/sqldb/stdlib_noop_internal.go
new file mode 100644
index 0000000000..9e28739ed6
--- /dev/null
+++ b/runtimes/go/storage/sqldb/stdlib_noop_internal.go
@@ -0,0 +1,105 @@
+package sqldb
+
+import (
+	"context"
+	"database/sql/driver"
+	"sync"
+)
+
+var (
+	registerNoopDriverOnce sync.Once
+)
+
+const noopDriverName = "__encore_noop"
+
+// noopDriver is a driver.Driver that returns will "connect" and manage
+// a connection to a database without an error, however whenever you try and use
+// the database, it will return a noop error.
+//
+// This is because we expect people to use drivers as package level variables,
+// but some services may not be running
+type noopDriver struct{}
+
+var (
+	_ driver.Driver        = noopDriver{}
+	_ driver.DriverContext = noopDriver{}
+)
+
+func (n noopDriver) Open(name string) (driver.Conn, error) {
+	return noopConn{}, nil
+}
+
+func (n noopDriver) OpenConnector(name string) (driver.Connector, error) {
+	return noopConnector{}, nil
+}
+
+// noopConnector is a driver.Connector that returns will "connect" and
+// manage a connection to a database without an error using the noopConn
+type noopConnector struct{}
+
+var (
+	_ driver.Connector = noopConnector{}
+)
+
+func (n noopConnector) Connect(ctx context.Context) (driver.Conn, error) {
+	return noopConn{}, nil
+}
+
+func (n noopConnector) Driver() driver.Driver {
+	return noopDriver{}
+}
+
+// noopConn is a driver.Conn that will error on any operation not
+// related to managing the connection
+type noopConn struct{}
+
+var (
+	_ driver.Conn               = noopConn{}
+	_ driver.ConnBeginTx        = noopConn{}
+	_ driver.ConnPrepareContext = noopConn{}
+	_ driver.ExecerContext      = noopConn{}
+	_ driver.Pinger             = noopConn{}
+	_ driver.QueryerContext     = noopConn{}
+	_ driver.SessionResetter    = noopConn{}
+	_ driver.NamedValueChecker  = noopConn{}
+)
+
+func (n noopConn) Prepare(query string) (driver.Stmt, error) {
+	return nil, errNoopDB
+}
+
+func (n noopConn) Close() error {
+	return nil // Don't return an error here as we want "connections" to act normal until they are used
+}
+
+func (n noopConn) Begin() (driver.Tx, error) {
+	return nil, errNoopDB
+}
+
+func (n noopConn) BeginTx(ctx context.Context, opts driver.TxOptions) (driver.Tx, error) {
+	return nil, errNoopDB
+}
+
+func (n noopConn) PrepareContext(ctx context.Context, query string) (driver.Stmt, error) {
+	return nil, errNoopDB
+}
+
+func (n noopConn) ExecContext(ctx context.Context, query string, args []driver.NamedValue) (driver.Result, error) {
+	return nil, errNoopDB
+}
+
+func (n noopConn) Ping(ctx context.Context) error {
+	return nil // Don't return an error here as we want "connections" to act normal until they are used
+}
+
+func (n noopConn) QueryContext(ctx context.Context, query string, args []driver.NamedValue) (driver.Rows, error) {
+	return nil, errNoopDB
+}
+
+func (n noopConn) ResetSession(ctx context.Context) error {
+	return nil // Don't return an error here as we want "connections" to act normal until they are used
+}
+
+func (n noopConn) CheckNamedValue(value *driver.NamedValue) error {
+	return errNoopDB
+}
diff --git a/runtimes/go/storage/sqldb/stdlib_wrapper_internal.go b/runtimes/go/storage/sqldb/stdlib_wrapper_internal.go
new file mode 100644
index 0000000000..483874ae42
--- /dev/null
+++ b/runtimes/go/storage/sqldb/stdlib_wrapper_internal.go
@@ -0,0 +1,652 @@
+/*
+
+This file is adapted from of github.com/ngrok/sqlmw, with license:
+
+MIT License
+
+Copyright (c) 2017 Expansive Worlds
+Copyright (c) 2017 Avalanche Studios
+Copyright (c) 2020 Alan Shreve
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+*/
+
+package sqldb
+
+import (
+	"context"
+	"database/sql/driver"
+	"errors"
+
+	"encore.dev/appruntime/exported/model"
+	"encore.dev/appruntime/exported/stack"
+	"encore.dev/appruntime/exported/trace2"
+)
+
+type middleware interface {
+	ConnExec(context.Context, driver.ExecerContext, string, []driver.NamedValue) (driver.Result, error)
+	ConnQuery(context.Context, driver.QueryerContext, string, []driver.NamedValue) (driver.Rows, error)
+	StmtExec(context.Context, driver.StmtExecContext, string, []driver.NamedValue) (driver.Result, error)
+	StmtQuery(context.Context, driver.StmtQueryContext, string, []driver.NamedValue) (driver.Rows, error)
+
+	ConnBegin(tx driver.Tx) (driver.Tx, error)
+	TxCommit(context.Context, driver.Tx) error
+	TxRollback(context.Context, driver.Tx) error
+}
+
+type interceptor struct {
+	mgr *Manager
+}
+
+var _ middleware = (*interceptor)(nil)
+
+func (i *interceptor) ConnQuery(ctx context.Context, conn driver.QueryerContext, query string, args []driver.NamedValue) (driver.Rows, error) {
+	curr := i.mgr.rt.Current()
+
+	var (
+		startEventID model.TraceEventID
+		eventParams  trace2.EventParams
+	)
+
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams = trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		startEventID = curr.Trace.DBQueryStart(trace2.DBQueryStartParams{
+			EventParams: eventParams,
+			Query:       query,
+			Stack:       stack.Build(5),
+		})
+	}
+
+	rows, err := conn.QueryContext(markTraced(ctx), query, args)
+
+	if curr.Req != nil && curr.Trace != nil {
+		curr.Trace.DBQueryEnd(eventParams, startEventID, err)
+	}
+
+	return rows, err
+}
+
+func (i *interceptor) ConnExec(ctx context.Context, conn driver.ExecerContext, query string, args []driver.NamedValue) (driver.Result, error) {
+	curr := i.mgr.rt.Current()
+
+	var (
+		startEventID model.TraceEventID
+		eventParams  trace2.EventParams
+	)
+
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams = trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+
+		startEventID = curr.Trace.DBQueryStart(trace2.DBQueryStartParams{
+			EventParams: eventParams,
+			Query:       query,
+			Stack:       stack.Build(5),
+		})
+	}
+
+	res, err := conn.ExecContext(markTraced(ctx), query, args)
+
+	if curr.Req != nil && curr.Trace != nil {
+		curr.Trace.DBQueryEnd(eventParams, startEventID, err)
+	}
+
+	return res, err
+}
+
+func (i *interceptor) StmtQuery(ctx context.Context, conn driver.StmtQueryContext, query string, args []driver.NamedValue) (driver.Rows, error) {
+	curr := i.mgr.rt.Current()
+
+	var (
+		startEventID model.TraceEventID
+		eventParams  trace2.EventParams
+	)
+
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams = trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		curr.Trace.DBQueryStart(trace2.DBQueryStartParams{
+			EventParams: eventParams,
+			Query:       query,
+			Stack:       stack.Build(5),
+		})
+	}
+
+	rows, err := conn.QueryContext(markTraced(ctx), args)
+
+	if curr.Req != nil && curr.Trace != nil {
+		curr.Trace.DBQueryEnd(eventParams, startEventID, err)
+	}
+
+	return rows, err
+}
+
+func (i *interceptor) StmtExec(ctx context.Context, conn driver.StmtExecContext, query string, args []driver.NamedValue) (driver.Result, error) {
+	curr := i.mgr.rt.Current()
+
+	var (
+		startEventID model.TraceEventID
+		eventParams  trace2.EventParams
+	)
+
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams = trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		curr.Trace.DBQueryStart(trace2.DBQueryStartParams{
+			EventParams: eventParams,
+			Query:       query,
+			Stack:       stack.Build(5),
+		})
+	}
+
+	res, err := conn.ExecContext(markTraced(ctx), args)
+
+	if curr.Req != nil && curr.Trace != nil {
+		curr.Trace.DBQueryEnd(eventParams, startEventID, err)
+	}
+
+	return res, err
+}
+
+func (i *interceptor) ConnBegin(tx driver.Tx) (driver.Tx, error) {
+	curr := i.mgr.rt.Current()
+
+	var startEventID model.TraceEventID
+
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams := trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		startEventID = curr.Trace.DBTransactionStart(eventParams, stack.Build(5))
+	}
+
+	return stdlibTx{Tx: tx, startID: startEventID}, nil
+}
+
+func (i *interceptor) ConnBeginTx(ctx context.Context, conn driver.ConnBeginTx, opts driver.TxOptions) (driver.Tx, error) {
+	tx, err := conn.BeginTx(markTraced(ctx), opts)
+	if err != nil {
+		return nil, err
+	}
+
+	curr := i.mgr.rt.Current()
+
+	var startEventID model.TraceEventID
+
+	if curr.Req != nil && curr.Trace != nil {
+		eventParams := trace2.EventParams{
+			TraceID: curr.Req.TraceID,
+			SpanID:  curr.Req.SpanID,
+			Goid:    curr.Goctr,
+			DefLoc:  0,
+		}
+		startEventID = curr.Trace.DBTransactionStart(eventParams, stack.Build(5))
+	}
+
+	return stdlibTx{Tx: tx, startID: startEventID}, nil
+}
+
+type stdlibTx struct {
+	driver.Tx
+
+	startID model.TraceEventID
+}
+
+func (i *interceptor) TxCommit(ctx context.Context, tx driver.Tx) error {
+	err := tx.Commit()
+
+	if s, ok := tx.(stdlibTx); ok {
+		curr := i.mgr.rt.Current()
+		if curr.Req != nil && curr.Trace != nil {
+			eventParams := trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+				DefLoc:  0,
+			}
+			curr.Trace.DBTransactionEnd(trace2.DBTransactionEndParams{
+				EventParams: eventParams,
+				StartID:     s.startID,
+				Commit:      true,
+				Err:         err,
+				Stack:       stack.Build(5),
+			})
+		}
+	}
+
+	return err
+}
+
+func (i *interceptor) TxRollback(ctx context.Context, tx driver.Tx) error {
+	err := tx.Rollback()
+
+	if s, ok := tx.(stdlibTx); ok {
+		curr := i.mgr.rt.Current()
+		if curr.Req != nil && curr.Trace != nil {
+			eventParams := trace2.EventParams{
+				TraceID: curr.Req.TraceID,
+				SpanID:  curr.Req.SpanID,
+				Goid:    curr.Goctr,
+				DefLoc:  0,
+			}
+			curr.Trace.DBTransactionEnd(trace2.DBTransactionEndParams{
+				EventParams: eventParams,
+				StartID:     s.startID,
+				Commit:      false,
+				Err:         err,
+				Stack:       stack.Build(5),
+			})
+		}
+	}
+	return err
+}
+
+type wrappedDriver struct {
+	parent driver.Driver
+	mw     middleware
+}
+
+var (
+	_ driver.Driver        = wrappedDriver{}
+	_ driver.DriverContext = wrappedDriver{}
+)
+
+func (d wrappedDriver) Open(name string) (driver.Conn, error) {
+	conn, err := d.parent.Open(name)
+	if err != nil {
+		return nil, err
+	}
+	return wrappedConn{mw: d.mw, parent: conn}, nil
+}
+
+func (d wrappedDriver) OpenConnector(name string) (driver.Connector, error) {
+	driver, ok := d.parent.(driver.DriverContext)
+	if !ok {
+		return wrappedConnector{
+			parent:    dsnConnector{dsn: name, driver: d.parent},
+			driverRef: &d,
+		}, nil
+	}
+	conn, err := driver.OpenConnector(name)
+	if err != nil {
+		return nil, err
+	}
+
+	return wrappedConnector{parent: conn, driverRef: &d}, nil
+}
+
+type wrappedConnector struct {
+	parent    driver.Connector
+	driverRef *wrappedDriver
+}
+
+var (
+	_ driver.Connector = wrappedConnector{}
+)
+
+func (c wrappedConnector) Connect(ctx context.Context) (conn driver.Conn, err error) {
+	conn, err = c.parent.Connect(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	return wrappedConn{mw: c.driverRef.mw, parent: conn}, nil
+}
+
+func (c wrappedConnector) Driver() driver.Driver {
+	return c.driverRef
+}
+
+// dsnConnector is a fallback connector placed in position of wrappedConnector.parent
+// when given Driver does not comply with DriverContext interface.
+type dsnConnector struct {
+	dsn    string
+	driver driver.Driver
+}
+
+func (t dsnConnector) Connect(_ context.Context) (driver.Conn, error) {
+	return t.driver.Open(t.dsn)
+}
+
+func (t dsnConnector) Driver() driver.Driver {
+	return t.driver
+}
+
+type wrappedConn struct {
+	mw     middleware
+	parent driver.Conn
+}
+
+// Compile time validation that our types implement the expected interfaces
+var (
+	_ driver.Conn               = wrappedConn{}
+	_ driver.ConnBeginTx        = wrappedConn{}
+	_ driver.ConnPrepareContext = wrappedConn{}
+	_ driver.ExecerContext      = wrappedConn{}
+	_ driver.Pinger             = wrappedConn{}
+	_ driver.QueryerContext     = wrappedConn{}
+	_ driver.SessionResetter    = wrappedConn{}
+	_ driver.NamedValueChecker  = wrappedConn{}
+)
+
+func (c wrappedConn) Prepare(query string) (driver.Stmt, error) {
+	stmt, err := c.parent.Prepare(query)
+	if err != nil {
+		return nil, err
+	}
+	return wrappedStmt{mw: c.mw, query: query, parent: stmt, conn: c}, nil
+}
+
+func (c wrappedConn) Close() error {
+	return c.parent.Close()
+}
+
+func (c wrappedConn) Begin() (tx driver.Tx, err error) {
+	tx, err = c.parent.Begin()
+	if err != nil {
+		return nil, err
+	}
+	tx, err = c.mw.ConnBegin(tx)
+	if err != nil {
+		return nil, err
+	}
+	return wrappedTx{mw: c.mw, parent: tx}, nil
+}
+
+func (c wrappedConn) BeginTx(ctx context.Context, opts driver.TxOptions) (tx driver.Tx, err error) {
+	wrappedParent := wrappedParentConn{c.parent}
+	tx, err = wrappedParent.BeginTx(ctx, opts)
+	if err != nil {
+		return nil, err
+	}
+	tx, err = c.mw.ConnBegin(tx)
+	if err != nil {
+		return nil, err
+	}
+	return wrappedTx{mw: c.mw, ctx: ctx, parent: tx}, nil
+}
+
+func (c wrappedConn) PrepareContext(ctx context.Context, query string) (stmt driver.Stmt, err error) {
+	wrappedParent := wrappedParentConn{c.parent}
+	stmt, err = wrappedParent.PrepareContext(ctx, query)
+	if err != nil {
+		return nil, err
+	}
+	return wrappedStmt{mw: c.mw, ctx: ctx, query: query, parent: stmt, conn: c}, nil
+}
+
+func (c wrappedConn) ExecContext(ctx context.Context, query string, args []driver.NamedValue) (r driver.Result, err error) {
+	wrappedParent := wrappedParentConn{c.parent}
+	return c.mw.ConnExec(ctx, wrappedParent, query, args)
+}
+
+func (c wrappedConn) Ping(ctx context.Context) (err error) {
+	if pinger, ok := c.parent.(driver.Pinger); ok {
+		return pinger.Ping(ctx)
+	}
+	return nil
+}
+
+func (c wrappedConn) QueryContext(ctx context.Context, query string, args []driver.NamedValue) (rows driver.Rows, err error) {
+	// Quick skip path: If the wrapped connection implements neither QueryerContext nor Queryer, we have absolutely nothing to do
+	_, hasQueryerContext := c.parent.(driver.QueryerContext)
+	_, hasQueryer := c.parent.(driver.Queryer)
+	if !hasQueryerContext && !hasQueryer {
+		return nil, driver.ErrSkip
+	}
+	wrappedParent := wrappedParentConn{c.parent}
+	return c.mw.ConnQuery(ctx, wrappedParent, query, args)
+}
+
+func (c wrappedConn) ResetSession(ctx context.Context) error {
+	if conn, ok := c.parent.(driver.SessionResetter); ok {
+		return conn.ResetSession(ctx)
+	}
+	return nil
+}
+
+func defaultCheckNamedValue(nv *driver.NamedValue) (err error) {
+	nv.Value, err = driver.DefaultParameterConverter.ConvertValue(nv.Value)
+	return err
+}
+
+func (c wrappedConn) CheckNamedValue(v *driver.NamedValue) error {
+	if checker, ok := c.parent.(driver.NamedValueChecker); ok {
+		return checker.CheckNamedValue(v)
+	}
+
+	return defaultCheckNamedValue(v)
+}
+
+type wrappedParentConn struct {
+	driver.Conn
+}
+
+func (c wrappedParentConn) BeginTx(ctx context.Context, opts driver.TxOptions) (tx driver.Tx, err error) {
+	if connBeginTx, ok := c.Conn.(driver.ConnBeginTx); ok {
+		return connBeginTx.BeginTx(ctx, opts)
+	}
+	// Fallback implementation
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+		return c.Conn.Begin()
+	}
+}
+
+func (c wrappedParentConn) PrepareContext(ctx context.Context, query string) (driver.Stmt, error) {
+	if connPrepareCtx, ok := c.Conn.(driver.ConnPrepareContext); ok {
+		return connPrepareCtx.PrepareContext(ctx, query)
+	}
+	// Fallback implementation
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+		return c.Conn.Prepare(query)
+	}
+}
+
+func (c wrappedParentConn) ExecContext(ctx context.Context, query string, args []driver.NamedValue) (r driver.Result, err error) {
+	if execContext, ok := c.Conn.(driver.ExecerContext); ok {
+		return execContext.ExecContext(ctx, query, args)
+	}
+	// Fallback implementation
+	dargs, err := namedValueToValue(args)
+	if err != nil {
+		return nil, err
+	}
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+		return c.Conn.(driver.Execer).Exec(query, dargs)
+	}
+}
+
+func (c wrappedParentConn) QueryContext(ctx context.Context, query string, args []driver.NamedValue) (rows driver.Rows, err error) {
+	if queryerContext, ok := c.Conn.(driver.QueryerContext); ok {
+		return queryerContext.QueryContext(ctx, query, args)
+	}
+	// Fallback implementation
+	dargs, err := namedValueToValue(args)
+	if err != nil {
+		return nil, err
+	}
+	select {
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	default:
+		return c.Conn.(driver.Queryer).Query(query, dargs)
+	}
+}
+
+// namedValueToValue is a helper function copied from the database/sql package
+func namedValueToValue(named []driver.NamedValue) ([]driver.Value, error) {
+	dargs := make([]driver.Value, len(named))
+	for n, param := range named {
+		if len(param.Name) > 0 {
+			return nil, errors.New("sql: driver does not support the use of Named Parameters")
+		}
+		dargs[n] = param.Value
+	}
+	return dargs, nil
+}
+
+type wrappedStmt struct {
+	mw     middleware
+	ctx    context.Context
+	query  string
+	parent driver.Stmt
+	conn   wrappedConn
+}
+
+// Compile time validation that our types implement the expected interfaces
+var (
+	_ driver.Stmt              = wrappedStmt{}
+	_ driver.StmtExecContext   = wrappedStmt{}
+	_ driver.StmtQueryContext  = wrappedStmt{}
+	_ driver.ColumnConverter   = wrappedStmt{}
+	_ driver.NamedValueChecker = wrappedStmt{}
+)
+
+func (s wrappedStmt) Close() (err error) {
+	return s.parent.Close()
+}
+
+func (s wrappedStmt) NumInput() int {
+	return s.parent.NumInput()
+}
+
+func (s wrappedStmt) Exec(args []driver.Value) (res driver.Result, err error) {
+	return s.parent.Exec(args)
+}
+
+func (s wrappedStmt) Query(args []driver.Value) (rows driver.Rows, err error) {
+	return s.parent.Query(args)
+}
+
+func (s wrappedStmt) ExecContext(ctx context.Context, args []driver.NamedValue) (res driver.Result, err error) {
+	wrappedParent := wrappedParentStmt{Stmt: s.parent}
+	return s.mw.StmtExec(ctx, wrappedParent, s.query, args)
+}
+
+func (s wrappedStmt) QueryContext(ctx context.Context, args []driver.NamedValue) (rows driver.Rows, err error) {
+	wrappedParent := wrappedParentStmt{Stmt: s.parent}
+	return s.mw.StmtQuery(ctx, wrappedParent, s.query, args)
+}
+
+func (s wrappedStmt) ColumnConverter(idx int) driver.ValueConverter {
+	if converter, ok := s.parent.(driver.ColumnConverter); ok {
+		return converter.ColumnConverter(idx)
+	}
+
+	return driver.DefaultParameterConverter
+}
+
+func (s wrappedStmt) CheckNamedValue(v *driver.NamedValue) error {
+	if checker, ok := s.parent.(driver.NamedValueChecker); ok {
+		return checker.CheckNamedValue(v)
+	}
+
+	if checker, ok := s.conn.parent.(driver.NamedValueChecker); ok {
+		return checker.CheckNamedValue(v)
+	}
+
+	return defaultCheckNamedValue(v)
+}
+
+type wrappedParentStmt struct {
+	driver.Stmt
+}
+
+func (s wrappedParentStmt) QueryContext(ctx context.Context, args []driver.NamedValue) (rows driver.Rows, err error) {
+	if stmtQueryContext, ok := s.Stmt.(driver.StmtQueryContext); ok {
+		return stmtQueryContext.QueryContext(ctx, args)
+	}
+	// Fallback implementation
+	dargs, err := namedValueToValue(args)
+	if err != nil {
+		return nil, err
+	}
+	select {
+	default:
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+	return s.Stmt.Query(dargs)
+}
+
+func (s wrappedParentStmt) ExecContext(ctx context.Context, args []driver.NamedValue) (res driver.Result, err error) {
+	if stmtExecContext, ok := s.Stmt.(driver.StmtExecContext); ok {
+		return stmtExecContext.ExecContext(ctx, args)
+	}
+	// Fallback implementation
+	dargs, err := namedValueToValue(args)
+	if err != nil {
+		return nil, err
+	}
+	select {
+	default:
+	case <-ctx.Done():
+		return nil, ctx.Err()
+	}
+	return s.Stmt.Exec(dargs)
+}
+
+type wrappedTx struct {
+	mw     middleware
+	ctx    context.Context
+	parent driver.Tx
+}
+
+// Compile time validation that our types implement the expected interfaces
+var (
+	_ driver.Tx = wrappedTx{}
+)
+
+func (t wrappedTx) Commit() (err error) {
+	return t.mw.TxCommit(t.ctx, t.parent)
+}
+
+func (t wrappedTx) Rollback() (err error) {
+	return t.mw.TxRollback(t.ctx, t.parent)
+}
diff --git a/runtimes/go/storage/sqldb/test_db.go b/runtimes/go/storage/sqldb/test_db.go
new file mode 100644
index 0000000000..38bd4e01ad
--- /dev/null
+++ b/runtimes/go/storage/sqldb/test_db.go
@@ -0,0 +1,44 @@
+package sqldb
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/rs/xid"
+)
+
+//publicapigen:drop
+func (mgr *Manager) NewTestDatabase(ctx context.Context, name string) (*Database, error) {
+	db := mgr.GetDB(name)
+	if db.noopDB {
+		return nil, fmt.Errorf("et: unknown database name: %q", name)
+	}
+
+	dbName := db.origName + "_" + xid.New().String()
+	templateName := db.origName + "_template"
+	if _, err := db.Exec(ctx, fmt.Sprintf("CREATE DATABASE %s TEMPLATE %s",
+		pgx.Identifier{dbName}.Sanitize(),
+		pgx.Identifier{templateName}.Sanitize(),
+	)); err != nil {
+		return nil, err
+	}
+
+	clone := &Database{
+		name:     dbName,
+		origName: db.origName,
+		mgr:      mgr,
+	}
+
+	mgr.ts.AddEndCallback(func(t *testing.T) {
+		// Shut down the connection pools and attempt to drop the database.
+		clone.shutdown()
+		_, err := db.Exec(context.Background(), fmt.Sprintf("DROP DATABASE %s WITH (FORCE)",
+			pgx.Identifier{dbName}.Sanitize()))
+		if err != nil {
+			mgr.rootLogger.Error().Err(err).Str("database", dbName).Msg("failed to clean up test database")
+		}
+	})
+	return clone, nil
+}
diff --git a/runtimes/go/storage/sqldb/zzz_singleton_internal.go b/runtimes/go/storage/sqldb/zzz_singleton_internal.go
new file mode 100644
index 0000000000..64116981f1
--- /dev/null
+++ b/runtimes/go/storage/sqldb/zzz_singleton_internal.go
@@ -0,0 +1,24 @@
+//go:build encore_app
+
+package sqldb
+
+import (
+	"encore.dev/appruntime/shared/appconf"
+	"encore.dev/appruntime/shared/logging"
+	"encore.dev/appruntime/shared/reqtrack"
+	"encore.dev/appruntime/shared/shutdown"
+	"encore.dev/appruntime/shared/testsupport"
+)
+
+// Initialize the singleton instance.
+// NOTE: This file is named zzz_singleton_internal.go so that
+// the init function is initialized after all the providers
+// have been registered.
+
+//publicapigen:drop
+var Singleton *Manager
+
+func init() {
+	Singleton = NewManager(appconf.Runtime, reqtrack.Singleton, testsupport.Singleton, logging.RootLogger)
+	shutdown.Singleton.RegisterShutdownHandler(Singleton.Shutdown)
+}
diff --git a/compiler/runtime/types/uuid/codec.go b/runtimes/go/types/uuid/codec.go
similarity index 80%
rename from compiler/runtime/types/uuid/codec.go
rename to runtimes/go/types/uuid/codec.go
index e3014c68c6..d4da321bc5 100644
--- a/compiler/runtime/types/uuid/codec.go
+++ b/runtimes/go/types/uuid/codec.go
@@ -72,37 +72,36 @@ func (u UUID) MarshalText() ([]byte, error) {
 // UnmarshalText implements the encoding.TextUnmarshaler interface.
 // Following formats are supported:
 //
-//   "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
-//   "{6ba7b810-9dad-11d1-80b4-00c04fd430c8}",
-//   "urn:uuid:6ba7b810-9dad-11d1-80b4-00c04fd430c8"
-//   "6ba7b8109dad11d180b400c04fd430c8"
-//   "{6ba7b8109dad11d180b400c04fd430c8}",
-//   "urn:uuid:6ba7b8109dad11d180b400c04fd430c8"
+//	"6ba7b810-9dad-11d1-80b4-00c04fd430c8",
+//	"{6ba7b810-9dad-11d1-80b4-00c04fd430c8}",
+//	"urn:uuid:6ba7b810-9dad-11d1-80b4-00c04fd430c8"
+//	"6ba7b8109dad11d180b400c04fd430c8"
+//	"{6ba7b8109dad11d180b400c04fd430c8}",
+//	"urn:uuid:6ba7b8109dad11d180b400c04fd430c8"
 //
 // ABNF for supported UUID text representation follows:
 //
-//   URN := 'urn'
-//   UUID-NID := 'uuid'
+//	URN := 'urn'
+//	UUID-NID := 'uuid'
 //
-//   hexdig := '0' | '1' | '2' | '3' | '4' | '5' | '6' | '7' | '8' | '9' |
-//             'a' | 'b' | 'c' | 'd' | 'e' | 'f' |
-//             'A' | 'B' | 'C' | 'D' | 'E' | 'F'
+//	hexdig := '0' | '1' | '2' | '3' | '4' | '5' | '6' | '7' | '8' | '9' |
+//	          'a' | 'b' | 'c' | 'd' | 'e' | 'f' |
+//	          'A' | 'B' | 'C' | 'D' | 'E' | 'F'
 //
-//   hexoct := hexdig hexdig
-//   2hexoct := hexoct hexoct
-//   4hexoct := 2hexoct 2hexoct
-//   6hexoct := 4hexoct 2hexoct
-//   12hexoct := 6hexoct 6hexoct
+//	hexoct := hexdig hexdig
+//	2hexoct := hexoct hexoct
+//	4hexoct := 2hexoct 2hexoct
+//	6hexoct := 4hexoct 2hexoct
+//	12hexoct := 6hexoct 6hexoct
 //
-//   hashlike := 12hexoct
-//   canonical := 4hexoct '-' 2hexoct '-' 2hexoct '-' 6hexoct
+//	hashlike := 12hexoct
+//	canonical := 4hexoct '-' 2hexoct '-' 2hexoct '-' 6hexoct
 //
-//   plain := canonical | hashlike
-//   uuid := canonical | hashlike | braced | urn
-//
-//   braced := '{' plain '}' | '{' hashlike  '}'
-//   urn := URN ':' UUID-NID ':' plain
+//	plain := canonical | hashlike
+//	uuid := canonical | hashlike | braced | urn
 //
+//	braced := '{' plain '}' | '{' hashlike  '}'
+//	urn := URN ':' UUID-NID ':' plain
 func (u *UUID) UnmarshalText(text []byte) error {
 	switch len(text) {
 	case 32:
@@ -144,7 +143,8 @@ func (u *UUID) decodeCanonical(t []byte) error {
 }
 
 // decodeHashLike decodes UUID strings that are using the following format:
-//  "6ba7b8109dad11d180b400c04fd430c8".
+//
+//	"6ba7b8109dad11d180b400c04fd430c8".
 func (u *UUID) decodeHashLike(t []byte) error {
 	src := t[:]
 	dst := u[:]
@@ -154,8 +154,9 @@ func (u *UUID) decodeHashLike(t []byte) error {
 }
 
 // decodeBraced decodes UUID strings that are using the following formats:
-//  "{6ba7b810-9dad-11d1-80b4-00c04fd430c8}"
-//  "{6ba7b8109dad11d180b400c04fd430c8}".
+//
+//	"{6ba7b810-9dad-11d1-80b4-00c04fd430c8}"
+//	"{6ba7b8109dad11d180b400c04fd430c8}".
 func (u *UUID) decodeBraced(t []byte) error {
 	l := len(t)
 
@@ -167,8 +168,9 @@ func (u *UUID) decodeBraced(t []byte) error {
 }
 
 // decodeURN decodes UUID strings that are using the following formats:
-//  "urn:uuid:6ba7b810-9dad-11d1-80b4-00c04fd430c8"
-//  "urn:uuid:6ba7b8109dad11d180b400c04fd430c8".
+//
+//	"urn:uuid:6ba7b810-9dad-11d1-80b4-00c04fd430c8"
+//	"urn:uuid:6ba7b8109dad11d180b400c04fd430c8".
 func (u *UUID) decodeURN(t []byte) error {
 	total := len(t)
 
@@ -182,8 +184,9 @@ func (u *UUID) decodeURN(t []byte) error {
 }
 
 // decodePlain decodes UUID strings that are using the following formats:
-//  "6ba7b810-9dad-11d1-80b4-00c04fd430c8" or in hash-like format
-//  "6ba7b8109dad11d180b400c04fd430c8".
+//
+//	"6ba7b810-9dad-11d1-80b4-00c04fd430c8" or in hash-like format
+//	"6ba7b8109dad11d180b400c04fd430c8".
 func (u *UUID) decodePlain(t []byte) error {
 	switch len(t) {
 	case 32:
diff --git a/compiler/runtime/types/uuid/codec_test.go b/runtimes/go/types/uuid/codec_test.go
similarity index 95%
rename from compiler/runtime/types/uuid/codec_test.go
rename to runtimes/go/types/uuid/codec_test.go
index f156d1c2ac..6fa5943762 100644
--- a/compiler/runtime/types/uuid/codec_test.go
+++ b/runtimes/go/types/uuid/codec_test.go
@@ -25,7 +25,6 @@ import (
 	"bytes"
 	"flag"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -242,37 +241,37 @@ func BenchmarkString(b *testing.B) {
 
 func BenchmarkFromBytes(b *testing.B) {
 	for i := 0; i < b.N; i++ {
-		FromBytes(codecTestData)
+		_, _ = FromBytes(codecTestData)
 	}
 }
 
 func BenchmarkFromString(b *testing.B) {
 	b.Run("canonical", func(b *testing.B) {
 		for i := 0; i < b.N; i++ {
-			FromString("6ba7b810-9dad-11d1-80b4-00c04fd430c8")
+			_, _ = FromString("6ba7b810-9dad-11d1-80b4-00c04fd430c8")
 		}
 	})
 	b.Run("urn", func(b *testing.B) {
 		for i := 0; i < b.N; i++ {
-			FromString("urn:uuid:6ba7b810-9dad-11d1-80b4-00c04fd430c8")
+			_, _ = FromString("urn:uuid:6ba7b810-9dad-11d1-80b4-00c04fd430c8")
 		}
 	})
 	b.Run("braced", func(b *testing.B) {
 		for i := 0; i < b.N; i++ {
-			FromString("{6ba7b810-9dad-11d1-80b4-00c04fd430c8}")
+			_, _ = FromString("{6ba7b810-9dad-11d1-80b4-00c04fd430c8}")
 		}
 	})
 }
 
 func BenchmarkMarshalBinary(b *testing.B) {
 	for i := 0; i < b.N; i++ {
-		codecTestUUID.MarshalBinary()
+		_, _ = codecTestUUID.MarshalBinary()
 	}
 }
 
 func BenchmarkMarshalText(b *testing.B) {
 	for i := 0; i < b.N; i++ {
-		codecTestUUID.MarshalText()
+		_, _ = codecTestUUID.MarshalText()
 	}
 }
 
@@ -286,7 +285,7 @@ func TestSeedFuzzCorpus(t *testing.T) {
 	corpusDir := filepath.Join(".", "testdata", "corpus")
 	writeSeedFile := func(name, data string) error {
 		path := filepath.Join(corpusDir, name)
-		return ioutil.WriteFile(path, []byte(data), os.ModePerm)
+		return os.WriteFile(path, []byte(data), os.ModePerm)
 	}
 	for _, fst := range fromStringTests {
 		name := "seed_valid_" + fst.variant
diff --git a/compiler/runtime/types/uuid/fuzz.go b/runtimes/go/types/uuid/fuzz.go
similarity index 86%
rename from compiler/runtime/types/uuid/fuzz.go
rename to runtimes/go/types/uuid/fuzz.go
index afaefbc8e3..8bd81b0c3c 100644
--- a/compiler/runtime/types/uuid/fuzz.go
+++ b/runtimes/go/types/uuid/fuzz.go
@@ -19,6 +19,7 @@
 // OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
+//go:build gofuzz
 // +build gofuzz
 
 package uuid
@@ -27,17 +28,18 @@ package uuid
 //
 // To run:
 //
-//     $ go get github.com/dvyukov/go-fuzz/...
-//     $ cd $GOPATH/src/github.com/gofrs/uuid
-//     $ go-fuzz-build github.com/gofrs/uuid
-//     $ go-fuzz -bin=uuid-fuzz.zip -workdir=./testdata
+//	$ go get github.com/dvyukov/go-fuzz/...
+//	$ cd $GOPATH/src/github.com/gofrs/uuid
+//	$ go-fuzz-build github.com/gofrs/uuid
+//	$ go-fuzz -bin=uuid-fuzz.zip -workdir=./testdata
 //
 // If you make significant changes to FromString / UnmarshalText and add
 // new cases to fromStringTests (in codec_test.go), please run
 //
-//    $ go test -seed_fuzz_corpus
+//	$ go test -seed_fuzz_corpus
 //
 // to seed the corpus with the new interesting inputs, then run the fuzzer.
+// nosemgrep
 func Fuzz(data []byte) int {
 	_, err := FromString(string(data))
 	if err != nil {
diff --git a/runtimes/go/types/uuid/generator.go b/runtimes/go/types/uuid/generator.go
new file mode 100644
index 0000000000..0bda4592c0
--- /dev/null
+++ b/runtimes/go/types/uuid/generator.go
@@ -0,0 +1,164 @@
+// Copyright (C) 2013-2018 by Maxim Bublis <b@codemonkey.ru>
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+package uuid
+
+import (
+	"crypto/md5"
+	"crypto/rand"
+	"crypto/sha1"
+	"encoding/binary"
+	"hash"
+	"io"
+	"os"
+	"sync"
+	"time"
+)
+
+// Difference in 100-nanosecond intervals between
+// UUID epoch (October 15, 1582) and Unix epoch (January 1, 1970).
+const epochStart = 122192928000000000
+
+type epochFunc func() time.Time
+
+var (
+	posixUID = uint32(os.Getuid())
+	posixGID = uint32(os.Getgid())
+)
+
+// NewV3 returns a UUID based on the MD5 hash of the namespace UUID and name.
+func NewV3(ns UUID, name string) UUID {
+	return g.NewV3(ns, name)
+}
+
+// NewV4 returns a randomly generated UUID.
+func NewV4() (UUID, error) {
+	return g.NewV4()
+}
+
+// NewV5 returns a UUID based on SHA-1 hash of the namespace UUID and name.
+func NewV5(ns UUID, name string) UUID {
+	return g.NewV5(ns, name)
+}
+
+// gen is a reference UUID generator based on the specifications laid out in
+// RFC-4122 and DCE 1.1: Authentication and Security Services. This type
+// satisfies the Generator interface as defined in this package.
+//
+// For consumers who are generating V1 UUIDs, but don't want to expose the MAC
+// address of the node generating the UUIDs, the NewGenWithHWAF() function has been
+// provided as a convenience. See the function's documentation for more info.
+//
+// The authors of this package do not feel that the majority of users will need
+// to obfuscate their MAC address, and so we recommend using NewGen() to create
+// a new generator.
+type gen struct {
+	clockSequenceOnce sync.Once
+	storageMutex      sync.Mutex
+
+	rand io.Reader
+
+	epochFunc     epochFunc
+	lastTime      uint64
+	clockSequence uint16
+}
+
+// newGen returns a new instance of gen with some default values set.
+var g = &gen{
+	epochFunc: time.Now,
+	rand:      rand.Reader,
+}
+
+// NewV3 returns a UUID based on the MD5 hash of the namespace UUID and name.
+func (g *gen) NewV3(ns UUID, name string) UUID {
+	// nosemgrep
+	u := newFromHash(md5.New(), ns, name)
+	u.SetVersion(V3)
+	u.setVariant(variantRFC4122)
+
+	return u
+}
+
+// NewV4 returns a randomly generated UUID.
+func (g *gen) NewV4() (UUID, error) {
+	u := UUID{}
+	if _, err := io.ReadFull(g.rand, u[:]); err != nil {
+		return Nil, err
+	}
+	u.SetVersion(V4)
+	u.setVariant(variantRFC4122)
+
+	return u, nil
+}
+
+// NewV5 returns a UUID based on SHA-1 hash of the namespace UUID and name.
+func (g *gen) NewV5(ns UUID, name string) UUID {
+	// nosemgrep
+	u := newFromHash(sha1.New(), ns, name)
+	u.SetVersion(V5)
+	u.setVariant(variantRFC4122)
+
+	return u
+}
+
+// Returns the epoch and clock sequence.
+func (g *gen) getClockSequence() (uint64, uint16, error) {
+	var err error
+	g.clockSequenceOnce.Do(func() {
+		buf := make([]byte, 2)
+		if _, err = io.ReadFull(g.rand, buf); err != nil {
+			return
+		}
+		g.clockSequence = binary.BigEndian.Uint16(buf)
+	})
+	if err != nil {
+		return 0, 0, err
+	}
+
+	g.storageMutex.Lock()
+	defer g.storageMutex.Unlock()
+
+	timeNow := g.getEpoch()
+	// Clock didn't change since last UUID generation.
+	// Should increase clock sequence.
+	if timeNow <= g.lastTime {
+		g.clockSequence++
+	}
+	g.lastTime = timeNow
+
+	return timeNow, g.clockSequence, nil
+}
+
+// Returns the difference between UUID epoch (October 15, 1582)
+// and current time in 100-nanosecond intervals.
+func (g *gen) getEpoch() uint64 {
+	return epochStart + uint64(g.epochFunc().UnixNano()/100)
+}
+
+// Returns the UUID based on the hashing of the namespace UUID and name.
+func newFromHash(h hash.Hash, ns UUID, name string) UUID {
+	u := UUID{}
+	h.Write(ns[:])
+	h.Write([]byte(name))
+	copy(u[:], h.Sum(nil))
+
+	return u
+}
diff --git a/runtimes/go/types/uuid/generator_test.go b/runtimes/go/types/uuid/generator_test.go
new file mode 100644
index 0000000000..419e672ad2
--- /dev/null
+++ b/runtimes/go/types/uuid/generator_test.go
@@ -0,0 +1,213 @@
+// Copyright (C) 2013-2018 by Maxim Bublis <b@codemonkey.ru>
+//
+// Permission is hereby granted, free of charge, to any person obtaining
+// a copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to
+// permit persons to whom the Software is furnished to do so, subject to
+// the following conditions:
+//
+// The above copyright notice and this permission notice shall be
+// included in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
+// LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
+// WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+package uuid
+
+import (
+	"bytes"
+	"crypto/rand"
+	"fmt"
+	"testing"
+	"time"
+)
+
+func TestGenerator(t *testing.T) {
+	t.Run("NewV3", testNewV3)
+	t.Run("NewV4", testNewV4)
+	t.Run("NewV5", testNewV5)
+}
+
+func testNewV3(t *testing.T) {
+	t.Run("Basic", testNewV3Basic)
+	t.Run("EqualNames", testNewV3EqualNames)
+	t.Run("DifferentNamespaces", testNewV3DifferentNamespaces)
+}
+
+func testNewV3Basic(t *testing.T) {
+	ns := namespaceDNS
+	name := "www.example.com"
+	u := NewV3(ns, name)
+	if got, want := u.Version(), V3; got != want {
+		t.Errorf("NewV3(%v, %q): got version %d, want %d", ns, name, got, want)
+	}
+	if got, want := u.variant(), variantRFC4122; got != want {
+		t.Errorf("NewV3(%v, %q): got variant %d, want %d", ns, name, got, want)
+	}
+	want := "5df41881-3aed-3515-88a7-2f4a814cf09e"
+	if got := u.String(); got != want {
+		t.Errorf("NewV3(%v, %q) = %q, want %q", ns, name, got, want)
+	}
+}
+
+func testNewV3EqualNames(t *testing.T) {
+	ns := namespaceDNS
+	name := "example.com"
+	u1 := NewV3(ns, name)
+	u2 := NewV3(ns, name)
+	if u1 != u2 {
+		t.Errorf("NewV3(%v, %q) generated %v and %v across two calls", ns, name, u1, u2)
+	}
+}
+
+func testNewV3DifferentNamespaces(t *testing.T) {
+	name := "example.com"
+	ns1 := namespaceDNS
+	ns2 := namespaceURL
+	u1 := NewV3(ns1, name)
+	u2 := NewV3(ns2, name)
+	if u1 == u2 {
+		t.Errorf("NewV3(%v, %q) == NewV3(%d, %q) (%v)", ns1, name, ns2, name, u1)
+	}
+}
+
+func testNewV4(t *testing.T) {
+	t.Run("Basic", testNewV4Basic)
+	t.Run("DifferentAcrossCalls", testNewV4DifferentAcrossCalls)
+	t.Run("FaultyRand", testNewV4FaultyRand)
+	t.Run("ShortRandomRead", testNewV4ShortRandomRead)
+}
+
+func testNewV4Basic(t *testing.T) {
+	u, err := NewV4()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got, want := u.Version(), V4; got != want {
+		t.Errorf("got version %d, want %d", got, want)
+	}
+	if got, want := u.variant(), variantRFC4122; got != want {
+		t.Errorf("got variant %d, want %d", got, want)
+	}
+}
+
+func testNewV4DifferentAcrossCalls(t *testing.T) {
+	u1, err := NewV4()
+	if err != nil {
+		t.Fatal(err)
+	}
+	u2, err := NewV4()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if u1 == u2 {
+		t.Errorf("generated identical UUIDs across calls: %v", u1)
+	}
+}
+
+func testNewV4FaultyRand(t *testing.T) {
+	g := &gen{
+		epochFunc: time.Now,
+		rand: &faultyReader{
+			readToFail: 0, // fail immediately
+		},
+	}
+	u, err := g.NewV4()
+	if err == nil {
+		t.Errorf("got %v, nil error", u)
+	}
+}
+
+func testNewV4ShortRandomRead(t *testing.T) {
+	g := &gen{
+		epochFunc: time.Now,
+		rand:      bytes.NewReader([]byte{42}),
+	}
+	u, err := g.NewV4()
+	if err == nil {
+		t.Errorf("got %v, nil error", u)
+	}
+}
+
+func testNewV5(t *testing.T) {
+	t.Run("Basic", testNewV5Basic)
+	t.Run("EqualNames", testNewV5EqualNames)
+	t.Run("DifferentNamespaces", testNewV5DifferentNamespaces)
+}
+
+func testNewV5Basic(t *testing.T) {
+	ns := namespaceDNS
+	name := "www.example.com"
+	u := NewV5(ns, name)
+	if got, want := u.Version(), V5; got != want {
+		t.Errorf("NewV5(%v, %q): got version %d, want %d", ns, name, got, want)
+	}
+	if got, want := u.variant(), variantRFC4122; got != want {
+		t.Errorf("NewV5(%v, %q): got variant %d, want %d", ns, name, got, want)
+	}
+	want := "2ed6657d-e927-568b-95e1-2665a8aea6a2"
+	if got := u.String(); got != want {
+		t.Errorf("NewV5(%v, %q) = %q, want %q", ns, name, got, want)
+	}
+}
+
+func testNewV5EqualNames(t *testing.T) {
+	ns := namespaceDNS
+	name := "example.com"
+	u1 := NewV5(ns, name)
+	u2 := NewV5(ns, name)
+	if u1 != u2 {
+		t.Errorf("NewV5(%v, %q) generated %v and %v across two calls", ns, name, u1, u2)
+	}
+}
+
+func testNewV5DifferentNamespaces(t *testing.T) {
+	name := "example.com"
+	ns1 := namespaceDNS
+	ns2 := namespaceURL
+	u1 := NewV5(ns1, name)
+	u2 := NewV5(ns2, name)
+	if u1 == u2 {
+		t.Errorf("NewV5(%v, %q) == NewV5(%v, %q) (%v)", ns1, name, ns2, name, u1)
+	}
+}
+
+func BenchmarkGenerator(b *testing.B) {
+	b.Run("NewV3", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			NewV3(namespaceDNS, "www.example.com")
+		}
+	})
+	b.Run("NewV4", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			if _, err := NewV4(); err != nil {
+				b.Fatalf("NewV4() failed: %s", err)
+			}
+		}
+	})
+	b.Run("NewV5", func(b *testing.B) {
+		for i := 0; i < b.N; i++ {
+			NewV5(namespaceDNS, "www.example.com")
+		}
+	})
+}
+
+type faultyReader struct {
+	callsNum   int
+	readToFail int // Read call number to fail
+}
+
+func (r *faultyReader) Read(dest []byte) (int, error) {
+	r.callsNum++
+	if (r.callsNum - 1) == r.readToFail {
+		return 0, fmt.Errorf("io: reader is faulty")
+	}
+	return rand.Read(dest)
+}
diff --git a/compiler/runtime/types/uuid/sql.go b/runtimes/go/types/uuid/sql.go
similarity index 100%
rename from compiler/runtime/types/uuid/sql.go
rename to runtimes/go/types/uuid/sql.go
diff --git a/compiler/runtime/types/uuid/sql_test.go b/runtimes/go/types/uuid/sql_test.go
similarity index 99%
rename from compiler/runtime/types/uuid/sql_test.go
rename to runtimes/go/types/uuid/sql_test.go
index 4aa22f7d12..68d7ee190b 100644
--- a/compiler/runtime/types/uuid/sql_test.go
+++ b/runtimes/go/types/uuid/sql_test.go
@@ -22,7 +22,6 @@
 package uuid
 
 import (
-	"encoding/json"
 	"fmt"
 	"testing"
 )
diff --git a/compiler/runtime/types/uuid/uuid.go b/runtimes/go/types/uuid/uuid.go
similarity index 97%
rename from compiler/runtime/types/uuid/uuid.go
rename to runtimes/go/types/uuid/uuid.go
index a904c49924..79419b7963 100644
--- a/compiler/runtime/types/uuid/uuid.go
+++ b/runtimes/go/types/uuid/uuid.go
@@ -149,7 +149,7 @@ func (u UUID) Format(f fmt.State, c rune) {
 		_, _ = io.WriteString(f, `"`+u.String()+`"`)
 	default:
 		// invalid/unsupported format verb
-		fmt.Fprintf(f, "%%!%c(uuid.UUID=%s)", c, u.String())
+		_, _ = fmt.Fprintf(f, "%%!%c(uuid.UUID=%s)", c, u.String())
 	}
 }
 
@@ -197,7 +197,8 @@ func (u *UUID) setVariant(v byte) {
 // Must is a helper that wraps a call to a function returning (UUID, error)
 // and panics if the error is non-nil. It is intended for use in variable
 // initializations such as
-//  var packageUUID = uuid.Must(uuid.FromString("123e4567-e89b-12d3-a456-426655440000"))
+//
+//	var packageUUID = uuid.Must(uuid.FromString("123e4567-e89b-12d3-a456-426655440000"))
 func Must(u UUID, err error) UUID {
 	if err != nil {
 		panic(err)
diff --git a/compiler/runtime/types/uuid/uuid_test.go b/runtimes/go/types/uuid/uuid_test.go
similarity index 100%
rename from compiler/runtime/types/uuid/uuid_test.go
rename to runtimes/go/types/uuid/uuid_test.go
diff --git a/runtimes/js/.gitignore b/runtimes/js/.gitignore
new file mode 100644
index 0000000000..73dbdcac29
--- /dev/null
+++ b/runtimes/js/.gitignore
@@ -0,0 +1,4 @@
+encore-runtime.node*
+node_modules
+dist
+.turbo
diff --git a/runtimes/js/Cargo.toml b/runtimes/js/Cargo.toml
new file mode 100644
index 0000000000..2ff3fca9a6
--- /dev/null
+++ b/runtimes/js/Cargo.toml
@@ -0,0 +1,35 @@
+[package]
+name = "encore-js-runtime"
+version = "0.1.0"
+edition = "2021"
+
+[lib]
+crate-type = ["cdylib"]
+
+[dependencies]
+napi = { version = "2.12.2", default-features = false, features = [
+    "napi8",
+    "tokio_rt",
+    "serde-json",
+    "anyhow",
+    "async",
+] }
+napi-derive = "2.12.2"
+encore-runtime-core = { path = "../core" }
+axum = { version = "0.7.5" }
+tokio = "1.35.1"
+log = "0.4.20"
+serde_json = { version = "1.0.111", features = [] }
+anyhow = "1.0.76"
+bytes = "1.5.0"
+prost = "0.12.3"
+prost-types = "0.12.3"
+futures = "0.3.30"
+mappable-rc = "0.1.1"
+tokio-util = { version = "0.7.10", features = ["io"] }
+chrono = "0.4.38"
+num_cpus = "1.16.0"
+malachite = "0.6.1"
+
+[build-dependencies]
+napi-build = "2.0.1"
diff --git a/runtimes/js/build.rs b/runtimes/js/build.rs
new file mode 100644
index 0000000000..6f176d3ae1
--- /dev/null
+++ b/runtimes/js/build.rs
@@ -0,0 +1,6 @@
+extern crate napi_build;
+
+fn main() -> std::io::Result<()> {
+    napi_build::setup();
+    Ok(())
+}
diff --git a/runtimes/js/encore.dev/LICENSE b/runtimes/js/encore.dev/LICENSE
new file mode 100644
index 0000000000..652c01fc80
--- /dev/null
+++ b/runtimes/js/encore.dev/LICENSE
@@ -0,0 +1,362 @@
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. "Contributor"
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+
+     means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the terms of
+        a Secondary License.
+
+1.6. "Executable Form"
+
+     means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+
+     means a work that combines Covered Software with other material, in a
+     separate file or files, that is not Covered Software.
+
+1.8. "License"
+
+     means this document.
+
+1.9. "Licensable"
+
+     means having the right to grant, to the maximum extent possible, whether
+     at the time of the initial grant or subsequently, any and all of the
+     rights conveyed by this License.
+
+1.10. "Modifications"
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. "Patent Claims" of a Contributor
+
+      means any patent claim(s), including without limitation, method,
+      process, and apparatus claims, in any patent Licensable by such
+      Contributor that would be infringed, but for the grant of the License,
+      by the making, using, selling, offering for sale, having made, import,
+      or transfer of either its Contributions or its Contributor Version.
+
+1.12. "Secondary License"
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. "Source Code Form"
+
+      means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, "You" includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, "control" means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or
+        as part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its
+        Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution
+     become effective for each Contribution on the date the Contributor first
+     distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under
+     this License. No additional rights or licenses will be implied from the
+     distribution or licensing of Covered Software under this License.
+     Notwithstanding Section 2.1(b) above, no patent license is granted by a
+     Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party's
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of
+        its Contributions.
+
+     This License does not grant any rights in the trademarks, service marks,
+     or logos of any Contributor (except as may be necessary to comply with
+     the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this
+     License (see Section 10.2) or under the terms of a Secondary License (if
+     permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its
+     Contributions are its original creation(s) or it has sufficient rights to
+     grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under
+     applicable copyright doctrines of fair use, fair dealing, or other
+     equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under
+     the terms of this License. You must inform recipients that the Source
+     Code Form of the Covered Software is governed by the terms of this
+     License, and how they can obtain a copy of this License. You may not
+     attempt to alter or restrict the recipients' rights in the Source Code
+     Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this
+        License, or sublicense it under different terms, provided that the
+        license for the Executable Form does not attempt to limit or alter the
+        recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for
+     the Covered Software. If the Larger Work is a combination of Covered
+     Software with a work governed by one or more Secondary Licenses, and the
+     Covered Software is not Incompatible With Secondary Licenses, this
+     License permits You to additionally distribute such Covered Software
+     under the terms of such Secondary License(s), so that the recipient of
+     the Larger Work may, at their option, further distribute the Covered
+     Software under the terms of either this License or such Secondary
+     License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices
+     (including copyright notices, patent notices, disclaimers of warranty, or
+     limitations of liability) contained within the Source Code Form of the
+     Covered Software, except that You may alter any license notices to the
+     extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on
+     behalf of any Contributor. You must make it absolutely clear that any
+     such warranty, support, indemnity, or liability obligation is offered by
+     You alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute,
+   judicial order, or regulation then You must: (a) comply with the terms of
+   this License to the maximum extent possible; and (b) describe the
+   limitations and the code they affect. Such description must be placed in a
+   text file included with all distributions of the Covered Software under
+   this License. Except to the extent prohibited by statute or regulation,
+   such description must be sufficiently detailed for a recipient of ordinary
+   skill to be able to understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+fail to comply with any of its terms. However, if You become compliant,
+then the rights granted under this License from a particular Contributor
+are reinstated (a) provisionally, unless and until such Contributor
+explicitly and finally terminates Your grants, and (b) on an ongoing
+basis, if such Contributor fails to notify You of the non-compliance by
+some reasonable means prior to 60 days after You have come back into
+compliance. Moreover, Your grants from a particular Contributor are
+reinstated on an ongoing basis if such Contributor notifies You of the
+non-compliance by some reasonable means, this is the first time You have
+received notice of non-compliance with this License from such
+Contributor, and You become compliant prior to 30 days after Your receipt
+of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+license agreements (excluding distributors and resellers) which have been
+validly granted by You or Your distributors under this License prior to
+termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an "as is" basis,
+   without warranty of any kind, either expressed, implied, or statutory,
+   including, without limitation, warranties that the Covered Software is free
+   of defects, merchantable, fit for a particular purpose or non-infringing.
+   The entire risk as to the quality and performance of the Covered Software
+   is with You. Should any Covered Software prove defective in any respect,
+   You (not any Contributor) assume the cost of any necessary servicing,
+   repair, or correction. This disclaimer of warranty constitutes an essential
+   part of this License. No use of  any Covered Software is authorized under
+   this License except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from
+   such party's negligence to the extent applicable law prohibits such
+   limitation. Some jurisdictions do not allow the exclusion or limitation of
+   incidental or consequential damages, so this exclusion and limitation may
+   not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts
+   of a jurisdiction where the defendant maintains its principal place of
+   business and such litigation shall be governed by laws of that
+   jurisdiction, without reference to its conflict-of-law provisions. Nothing
+   in this Section shall prevent a party's ability to bring cross-claims or
+   counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject
+   matter hereof. If any provision of this License is held to be
+   unenforceable, such provision shall be reformed only to the extent
+   necessary to make it enforceable. Any law or regulation which provides that
+   the language of a contract shall be construed against the drafter shall not
+   be used to construe this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version
+      of the License under which You originally received the Covered Software,
+      or under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a
+      modified version of this License if you rename the license and remove
+      any references to the name of the license steward (except to note that
+      such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses If You choose to distribute Source Code Form that is
+Incompatible With Secondary Licenses under the terms of this version of
+the License, the notice described in Exhibit B of this License must be
+attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file,
+then You may include the notice in a location (such as a LICENSE file in a
+relevant directory) where a recipient would be likely to look for such a
+notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+
+      This Source Code Form is "Incompatible
+      With Secondary Licenses", as defined by
+      the Mozilla Public License, v. 2.0.
diff --git a/runtimes/js/encore.dev/README.md b/runtimes/js/encore.dev/README.md
new file mode 100644
index 0000000000..5a0b7a0977
--- /dev/null
+++ b/runtimes/js/encore.dev/README.md
@@ -0,0 +1,4 @@
+# Encore JavaScript/TypeScript SDK
+
+This package contains the Encore JavaScript/TypeScript SDK, it is intended for you to use in your applications to develop
+against the Encore API.
diff --git a/runtimes/js/encore.dev/api/error.ts b/runtimes/js/encore.dev/api/error.ts
new file mode 100644
index 0000000000..af61e474d2
--- /dev/null
+++ b/runtimes/js/encore.dev/api/error.ts
@@ -0,0 +1,309 @@
+export class APIError extends Error {
+  /**
+   * The error code.
+   */
+  public readonly code: ErrCode;
+  public readonly details?: ErrDetails;
+
+  // Constructs an APIError with the Canceled error code.
+  static canceled(msg: string, cause?: Error) {
+    return new APIError(ErrCode.Canceled, msg, cause);
+  }
+
+  // Constructs an APIError with the Unknown error code.
+  static unknown(msg: string, cause?: Error) {
+    return new APIError(ErrCode.Unknown, msg, cause);
+  }
+
+  // Constructs an APIError with the InvalidArgument error code.
+  static invalidArgument(msg: string, cause?: Error) {
+    return new APIError(ErrCode.InvalidArgument, msg, cause);
+  }
+
+  // Constructs an APIError with the DeadlineExceeded error code.
+  static deadlineExceeded(msg: string, cause?: Error) {
+    return new APIError(ErrCode.DeadlineExceeded, msg, cause);
+  }
+
+  // Constructs an APIError with the NotFound error code.
+  static notFound(msg: string, cause?: Error) {
+    return new APIError(ErrCode.NotFound, msg, cause);
+  }
+
+  // Constructs an APIError with the AlreadyExists error code.
+  static alreadyExists(msg: string, cause?: Error) {
+    return new APIError(ErrCode.AlreadyExists, msg, cause);
+  }
+
+  // Constructs an APIError with the PermissionDenied error code.
+  static permissionDenied(msg: string, cause?: Error) {
+    return new APIError(ErrCode.PermissionDenied, msg, cause);
+  }
+
+  // Constructs an APIError with the ResourceExhausted error code.
+  static resourceExhausted(msg: string, cause?: Error) {
+    return new APIError(ErrCode.ResourceExhausted, msg, cause);
+  }
+
+  // Constructs an APIError with the FailedPrecondition error code.
+  static failedPrecondition(msg: string, cause?: Error) {
+    return new APIError(ErrCode.FailedPrecondition, msg, cause);
+  }
+
+  // Constructs an APIError with the Aborted error code.
+  static aborted(msg: string, cause?: Error) {
+    return new APIError(ErrCode.Aborted, msg, cause);
+  }
+
+  // Constructs an APIError with the OutOfRange error code.
+  static outOfRange(msg: string, cause?: Error) {
+    return new APIError(ErrCode.OutOfRange, msg, cause);
+  }
+
+  // Constructs an APIError with the Unimplemented error code.
+  static unimplemented(msg: string, cause?: Error) {
+    return new APIError(ErrCode.Unimplemented, msg, cause);
+  }
+
+  // Constructs an APIError with the Internal error code.
+  static internal(msg: string, cause?: Error) {
+    return new APIError(ErrCode.Internal, msg, cause);
+  }
+
+  // Constructs an APIError with the Unavailable error code.
+  static unavailable(msg: string, cause?: Error) {
+    return new APIError(ErrCode.Unavailable, msg, cause);
+  }
+
+  // Constructs an APIError with the DataLoss error code.
+  static dataLoss(msg: string, cause?: Error) {
+    return new APIError(ErrCode.DataLoss, msg, cause);
+  }
+
+  // Constructs an APIError with the Unauthenticated error code.
+  static unauthenticated(msg: string, cause?: Error) {
+    return new APIError(ErrCode.Unauthenticated, msg, cause);
+  }
+
+  // Constructs a new APIError from the previous one with the provided details
+  withDetails(details: ErrDetails): APIError {
+    return new APIError(this.code, this.message, this.cause as Error, details);
+  }
+
+  // Constructs an APIError with the given error code, message, and (optionally) cause.
+  constructor(code: ErrCode, msg: string, cause?: Error, details?: ErrDetails) {
+    // extending errors causes issues after you construct them, unless you apply the following fixes
+    super(msg, { cause });
+    this.code = code;
+    this.details = details;
+
+    // set error name as constructor name, make it not enumerable to keep native Error behavior
+    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+    Object.defineProperty(this, "name", {
+      value: "APIError",
+      enumerable: false,
+      configurable: true
+    });
+
+    // Fix the prototype chain, capture stack trace.
+    Object.setPrototypeOf(this, APIError.prototype);
+    Error.captureStackTrace(this, this.constructor);
+  }
+}
+
+export type ErrDetails = Record<string, any>;
+
+export enum ErrCode {
+  /**
+   * OK indicates the operation was successful.
+   */
+  OK = "ok",
+
+  /**
+   * Canceled indicates the operation was canceled (typically by the caller).
+   *
+   * Encore will generate this error code when cancellation is requested.
+   */
+  Canceled = "canceled",
+
+  /**
+   * Unknown error. An example of where this error may be returned is
+   * if a Status value received from another address space belongs to
+   * an error-space that is not known in this address space. Also
+   * errors raised by APIs that do not return enough error information
+   * may be converted to this error.
+   *
+   * Encore will generate this error code in the above two mentioned cases.
+   */
+  Unknown = "unknown",
+
+  /**
+   * InvalidArgument indicates client specified an invalid argument.
+   * Note that this differs from FailedPrecondition. It indicates arguments
+   * that are problematic regardless of the state of the system
+   * (e.g., a malformed file name).
+   *
+   * This error code will not be generated by the gRPC framework.
+   */
+  InvalidArgument = "invalid_argument",
+
+  /**
+   * DeadlineExceeded means operation expired before completion.
+   * For operations that change the state of the system, this error may be
+   * returned even if the operation has completed successfully. For
+   * example, a successful response from a server could have been delayed
+   * long enough for the deadline to expire.
+   *
+   * The gRPC framework will generate this error code when the deadline is
+   * exceeded.
+   */
+  DeadlineExceeded = "deadline_exceeded",
+
+  /**
+   * NotFound means some requested entity (e.g., file or directory) was
+   * not found.
+   *
+   * This error code will not be generated by the gRPC framework.
+   */
+  NotFound = "not_found",
+
+  /**
+   * AlreadyExists means an attempt to create an entity failed because one
+   * already exists.
+   *
+   * This error code will not be generated by the gRPC framework.
+   */
+  AlreadyExists = "already_exists",
+
+  /**
+   * PermissionDenied indicates the caller does not have permission to
+   * execute the specified operation. It must not be used for rejections
+   * caused by exhausting some resource (use ResourceExhausted
+   * instead for those errors). It must not be
+   * used if the caller cannot be identified (use Unauthenticated
+   * instead for those errors).
+   *
+   * This error code will not be generated by the gRPC core framework,
+   * but expect authentication middleware to use it.
+   */
+  PermissionDenied = "permission_denied",
+
+  /**
+   * ResourceExhausted indicates some resource has been exhausted, perhaps
+   * a per-user quota, or perhaps the entire file system is out of space.
+   *
+   * This error code will be generated by the gRPC framework in
+   * out-of-memory and server overload situations, or when a message is
+   * larger than the configured maximum size.
+   */
+  ResourceExhausted = "resource_exhausted",
+
+  /**
+   * FailedPrecondition indicates operation was rejected because the
+   * system is not in a state required for the operation's execution.
+   * For example, directory to be deleted may be non-empty, an rmdir
+   * operation is applied to a non-directory, etc.
+   *
+   * A litmus test that may help a service implementor in deciding
+   * between FailedPrecondition, Aborted, and Unavailable:
+   *  (a) Use Unavailable if the client can retry just the failing call.
+   *  (b) Use Aborted if the client should retry at a higher-level
+   *      (e.g., restarting a read-modify-write sequence).
+   *  (c) Use FailedPrecondition if the client should not retry until
+   *      the system state has been explicitly fixed. E.g., if an "rmdir"
+   *      fails because the directory is non-empty, FailedPrecondition
+   *      should be returned since the client should not retry unless
+   *      they have first fixed up the directory by deleting files from it.
+   *  (d) Use FailedPrecondition if the client performs conditional
+   *      REST Get/Update/Delete on a resource and the resource on the
+   *      server does not match the condition. E.g., conflicting
+   *      read-modify-write on the same resource.
+   *
+   * This error code will not be generated by the gRPC framework.
+   */
+  FailedPrecondition = "failed_precondition",
+
+  /**
+   * Aborted indicates the operation was aborted, typically due to a
+   * concurrency issue like sequencer check failures, transaction aborts,
+   * etc.
+   *
+   * See litmus test above for deciding between FailedPrecondition,
+   * Aborted, and Unavailable.
+   */
+  Aborted = "aborted",
+
+  /**
+   * OutOfRange means operation was attempted past the valid range.
+   * E.g., seeking or reading past end of file.
+   *
+   * Unlike InvalidArgument, this error indicates a problem that may
+   * be fixed if the system state changes. For example, a 32-bit file
+   * system will generate InvalidArgument if asked to read at an
+   * offset that is not in the range [0,2^32-1], but it will generate
+   * OutOfRange if asked to read from an offset past the current
+   * file size.
+   *
+   * There is a fair bit of overlap between FailedPrecondition and
+   * OutOfRange. We recommend using OutOfRange (the more specific
+   * error) when it applies so that callers who are iterating through
+   * a space can easily look for an OutOfRange error to detect when
+   * they are done.
+   *
+   * This error code will not be generated by the gRPC framework.
+   */
+  OutOfRange = "out_of_range",
+
+  /**
+   * Unimplemented indicates operation is not implemented or not
+   * supported/enabled in this service.
+   *
+   * This error code will be generated by the gRPC framework. Most
+   * commonly, you will see this error code when a method implementation
+   * is missing on the server. It can also be generated for unknown
+   * compression algorithms or a disagreement as to whether an RPC should
+   * be streaming.
+   */
+  Unimplemented = "unimplemented",
+
+  /**
+   * Internal errors. Means some invariants expected by underlying
+   * system has been broken. If you see one of these errors,
+   * something is very broken.
+   *
+   * This error code will be generated by the gRPC framework in several
+   * internal error conditions.
+   */
+  Internal = "internal",
+
+  /**
+   * Unavailable indicates the service is currently unavailable.
+   * This is a most likely a transient condition and may be corrected
+   * by retrying with a backoff. Note that it is not always safe to retry
+   * non-idempotent operations.
+   *
+   * See litmus test above for deciding between FailedPrecondition,
+   * Aborted, and Unavailable.
+   *
+   * This error code will be generated by the gRPC framework during
+   * abrupt shutdown of a server process or network connection.
+   */
+  Unavailable = "unavailable",
+
+  /**
+   * DataLoss indicates unrecoverable data loss or corruption.
+   *
+   * This error code will not be generated by the gRPC framework.
+   */
+  DataLoss = "data_loss",
+
+  /**
+   * Unauthenticated indicates the request does not have valid
+   * authentication credentials for the operation.
+   *
+   * The gRPC framework will generate this error code when the
+   * authentication metadata is invalid or a Credentials callback fails,
+   * but also expect authentication middleware to generate it.
+   */
+  Unauthenticated = "unauthenticated"
+}
diff --git a/runtimes/js/encore.dev/api/gateway.ts b/runtimes/js/encore.dev/api/gateway.ts
new file mode 100644
index 0000000000..4ea71c4aa9
--- /dev/null
+++ b/runtimes/js/encore.dev/api/gateway.ts
@@ -0,0 +1,31 @@
+import { AuthHandlerBrand } from "../auth/mod";
+import * as runtime from "../internal/runtime/mod";
+import { setCurrentRequest } from "../internal/reqtrack/mod";
+
+export class Gateway {
+  public readonly name: string;
+  public readonly cfg: GatewayConfig;
+  private impl: runtime.Gateway;
+
+  constructor(cfg: GatewayConfig) {
+    this.name = "api-gateway";
+    this.cfg = cfg;
+
+    let auth: any = cfg.authHandler;
+    if (auth) {
+      const handler = auth;
+      auth = (req: runtime.Request) => {
+        setCurrentRequest(req);
+        return handler(req.payload());
+      };
+    }
+
+    this.impl = runtime.RT.gateway("api-gateway", {
+      auth,
+    });
+  }
+}
+
+export interface GatewayConfig {
+  authHandler?: AuthHandlerBrand;
+}
diff --git a/runtimes/js/encore.dev/api/httpstatus.ts b/runtimes/js/encore.dev/api/httpstatus.ts
new file mode 100644
index 0000000000..2eb2144f88
--- /dev/null
+++ b/runtimes/js/encore.dev/api/httpstatus.ts
@@ -0,0 +1,74 @@
+export const HttpStatusValues = {
+  // 1xx Informational responses
+  Continue: 100,
+  SwitchingProtocols: 101,
+  Processing: 102,
+  EarlyHints: 103,
+
+  // 2xx Success
+  OK: 200,
+  Created: 201,
+  Accepted: 202,
+  NonAuthoritativeInformation: 203,
+  NoContent: 204,
+  ResetContent: 205,
+  PartialContent: 206,
+  MultiStatus: 207,
+  AlreadyReported: 208,
+  IMUsed: 226,
+
+  // 3xx Redirection
+  MultipleChoices: 300,
+  MovedPermanently: 301,
+  Found: 302,
+  SeeOther: 303,
+  NotModified: 304,
+  UseProxy: 305,
+  SwitchProxy: 306,
+  TemporaryRedirect: 307,
+  PermanentRedirect: 308,
+
+  // 4xx Client Error
+  BadRequest: 400,
+  Unauthorized: 401,
+  PaymentRequired: 402,
+  Forbidden: 403,
+  NotFound: 404,
+  MethodNotAllowed: 405,
+  NotAcceptable: 406,
+  ProxyAuthenticationRequired: 407,
+  RequestTimeout: 408,
+  Conflict: 409,
+  Gone: 410,
+  LengthRequired: 411,
+  PreconditionFailed: 412,
+  PayloadTooLarge: 413,
+  URITooLong: 414,
+  UnsupportedMediaType: 415,
+  RangeNotSatisfiable: 416,
+  ExpectationFailed: 417,
+  ImATeapot: 418,
+  MisdirectedRequest: 421,
+  UnprocessableEntity: 422,
+  Locked: 423,
+  FailedDependency: 424,
+  TooEarly: 425,
+  UpgradeRequired: 426,
+  PreconditionRequired: 428,
+  TooManyRequests: 429,
+  RequestHeaderFieldsTooLarge: 431,
+  UnavailableForLegalReasons: 451,
+
+  // 5xx Server Error
+  InternalServerError: 500,
+  NotImplemented: 501,
+  BadGateway: 502,
+  ServiceUnavailable: 503,
+  GatewayTimeout: 504,
+  HTTPVersionNotSupported: 505,
+  VariantAlsoNegotiates: 506,
+  InsufficientStorage: 507,
+  LoopDetected: 508,
+  NotExtended: 510,
+  NetworkAuthenticationRequired: 511
+} as const;
diff --git a/runtimes/js/encore.dev/api/mod.ts b/runtimes/js/encore.dev/api/mod.ts
new file mode 100644
index 0000000000..5b4d0f0f86
--- /dev/null
+++ b/runtimes/js/encore.dev/api/mod.ts
@@ -0,0 +1,545 @@
+/* eslint-disable */
+
+import type { IncomingMessage, ServerResponse } from "http";
+import { RequestMeta, currentRequest } from "../mod";
+import { RawResponse } from "./mod";
+import { RawRequest } from "./mod";
+import { InternalHandlerResponse } from "../internal/appinit/mod";
+import { IterableSocket, IterableStream, Sink } from "./stream";
+export { RawRequest, RawResponse } from "../internal/api/node_http";
+
+export type Method =
+  | "GET"
+  | "POST"
+  | "PUT"
+  | "DELETE"
+  | "PATCH"
+  | "HEAD"
+  | "OPTIONS"
+  | "TRACE"
+  | "CONNECT";
+
+export type Header<
+  TypeOrName extends string | number | boolean | Date = string,
+  Name extends string = ""
+> = TypeOrName extends string ? string : TypeOrName;
+
+export type Query<
+  TypeOrName extends
+    | string
+    | string[]
+    | number
+    | number[]
+    | boolean
+    | boolean[]
+    | Date
+    | Date[] = string,
+  Name extends string = ""
+> = TypeOrName extends string ? string : TypeOrName;
+
+export type CookieWithOptions<T> = {
+  value: T;
+  expires?: Date;
+  sameSite?: "Strict" | "Lax" | "None";
+  domain?: string;
+  path?: string;
+  maxAge?: number;
+  secure?: boolean;
+  httpOnly?: boolean;
+  partitioned?: boolean;
+};
+
+export type Cookie<
+  TypeOrName extends string | number | boolean | Date = string,
+  Name extends string = ""
+> = TypeOrName extends string
+  ? CookieWithOptions<string>
+  : CookieWithOptions<TypeOrName>;
+
+export interface APIOptions {
+  /**
+   * The HTTP method(s) to match for this endpoint.
+   * Use "*" to match any method.
+   */
+  method?: Method | Method[] | "*";
+
+  /**
+   * The request path to match for this endpoint.
+   *
+   * Use `:` to define single-segment parameters, e.g. `/users/:id`.
+   * Use `*` to match any number of segments, e.g. `/files/*path`.
+   *
+   * If not specified, it defaults to `/<service-name>.<endpoint-name>`.
+   */
+  path?: string;
+
+  /**
+   * Whether or not to make this endpoint publicly accessible.
+   * If false, the endpoint is only accessible from the internal network.
+   *
+   * Defaults to false if not specified.
+   */
+  expose?: boolean;
+
+  /**
+   * Whether or not the request must contain valid authentication credentials.
+   * If set to true and the request is not authenticated,
+   * Encore returns a 401 Unauthorized error.
+   *
+   * Defaults to false if not specified.
+   */
+  auth?: boolean;
+
+  /**
+   * The maximum body size, in bytes. If the request body exceeds this value,
+   * Encore stops request processing and returns an error.
+   *
+   * If left unspecified it defaults to a reasonable default (currently 2MiB).
+   * If set to `null`, the body size is unlimited.
+   **/
+  bodyLimit?: number | null;
+
+  /**
+   * Tags to filter endpoints when generating clients and in middlewares.
+   */
+  tags?: string[];
+
+  /**
+   * When set to true, request information such as payloads and headers will be excluded from traces.
+   */
+  sensitive?: boolean;
+}
+
+export interface StreamOptions {
+  /**
+   * The request path to match for this endpoint.
+   *
+   * Use `:` to define single-segment parameters, e.g. `/users/:id`.
+   * Use `*` to match any number of segments, e.g. `/files/*path`.
+   *
+   * If not specified, it defaults to `/<service-name>.<endpoint-name>`.
+   */
+  path?: string;
+
+  /**
+   * Whether or not to make this endpoint publicly accessible.
+   * If false, the endpoint is only accessible from the internal network.
+   *
+   * Defaults to false if not specified.
+   */
+  expose?: boolean;
+
+  /**
+   * Whether or not the request must contain valid authentication credentials.
+   * If set to true and the request is not authenticated,
+   * Encore returns a 401 Unauthorized error.
+   *
+   * Defaults to false if not specified.
+   */
+  auth?: boolean;
+
+  /**
+   * Tags to filter endpoints when generating clients and in middlewares.
+   */
+  tags?: string[];
+
+  /**
+   * When set to true, request information such as payloads and headers will be excluded from traces.
+   */
+  sensitive?: boolean;
+}
+
+type HandlerFn<Params, Response> = Params extends void
+  ? () => Promise<Response>
+  : (params: Params) => Promise<Response>;
+
+export function api<
+  Params extends object | void = void,
+  Response extends object | void = void
+>(
+  options: APIOptions,
+  fn: (params: Params) => Promise<Response>
+): HandlerFn<Params, Response>;
+
+export function api<
+  Params extends object | void = void,
+  Response extends object | void = void
+>(
+  options: APIOptions,
+  fn: (params: Params) => Response
+): HandlerFn<Params, Response>;
+export function api(options: APIOptions, fn: any): typeof fn {
+  return fn;
+}
+
+export type RawHandler = (req: IncomingMessage, resp: ServerResponse) => void;
+
+api.raw = function raw(options: APIOptions, fn: RawHandler) {
+  return fn;
+};
+
+export interface StreamIn<Request> extends AsyncIterable<Request> {
+  recv: () => Promise<Request>;
+}
+export interface StreamOutWithResponse<Request, Response>
+  extends StreamOut<Request> {
+  response: () => Promise<Response>;
+}
+
+export interface StreamOut<Response> {
+  send: (msg: Response) => Promise<void>;
+  close: () => Promise<void>;
+}
+
+export type StreamInOutHandlerFn<HandshakeData, Request, Response> =
+  HandshakeData extends void
+    ? (stream: StreamInOut<Request, Response>) => Promise<void>
+    : (
+        data: HandshakeData,
+        stream: StreamInOut<Request, Response>
+      ) => Promise<void>;
+
+export type StreamOutHandlerFn<HandshakeData, Response> =
+  HandshakeData extends void
+    ? (stream: StreamOut<Response>) => Promise<void>
+    : (data: HandshakeData, stream: StreamOut<Response>) => Promise<void>;
+
+export type StreamInHandlerFn<HandshakeData, Request, Response> =
+  HandshakeData extends void
+    ? (stream: StreamIn<Request>) => Promise<Response>
+    : (data: HandshakeData, stream: StreamIn<Request>) => Promise<Response>;
+
+export type StreamInOut<Request, Response> = StreamIn<Request> &
+  StreamOut<Response>;
+
+function streamInOut<HandshakeData, Request, Response>(
+  options: StreamOptions,
+  fn: (
+    data: HandshakeData,
+    stream: StreamInOut<Request, Response>
+  ) => Promise<void>
+): StreamInOutHandlerFn<HandshakeData, Request, Response>;
+function streamInOut<Request, Response>(
+  options: StreamOptions,
+  fn: (stream: StreamInOut<Request, Response>) => Promise<void>
+): StreamInOutHandlerFn<void, Request, Response>;
+function streamInOut(options: StreamOptions, fn: any): typeof fn {
+  return fn;
+}
+
+function streamIn<Request>(
+  options: StreamOptions,
+  fn: (stream: StreamIn<Request>) => Promise<void>
+): StreamInHandlerFn<void, Request, void>;
+function streamIn<Request, Response>(
+  options: StreamOptions,
+  fn: (stream: StreamIn<Request>) => Promise<Response>
+): StreamInHandlerFn<void, Request, Response>;
+function streamIn<HandshakeData, Request, Response>(
+  options: StreamOptions,
+  fn: (data: HandshakeData, stream: StreamIn<Request>) => Promise<Response>
+): StreamInHandlerFn<HandshakeData, Request, Response>;
+function streamIn(options: StreamOptions, fn: any): typeof fn {
+  return fn;
+}
+
+function streamOut<HandshakeData, Response>(
+  options: StreamOptions,
+  fn: (data: HandshakeData, stream: StreamOut<Response>) => Promise<void>
+): StreamOutHandlerFn<HandshakeData, Response>;
+function streamOut<Response>(
+  options: StreamOptions,
+  fn: (stream: StreamOut<Response>) => Promise<void>
+): StreamOutHandlerFn<void, Response>;
+function streamOut(options: StreamOptions, fn: any): typeof fn {
+  return fn;
+}
+
+api.streamInOut = streamInOut;
+api.streamIn = streamIn;
+api.streamOut = streamOut;
+
+export interface StaticOptions {
+  /**
+   * The request path to match for this endpoint.
+   *
+   * Use `:` to define single-segment parameters, e.g. `/users/:id`.
+   * Use `*` to match any number of segments, e.g. `/files/*path`.
+   *
+   * If not specified, it defaults to `/<service-name>.<endpoint-name>`.
+   */
+  path?: string;
+
+  /**
+   * Whether or not to make this endpoint publicly accessible.
+   * If false, the endpoint is only accessible from the internal network.
+   *
+   * Defaults to false if not specified.
+   */
+  expose?: boolean;
+
+  /**
+   * Whether or not the request must contain valid authentication credentials.
+   * If set to true and the request is not authenticated,
+   * Encore returns a 401 Unauthorized error.
+   *
+   * Defaults to false if not specified.
+   */
+  auth?: boolean;
+
+  /**
+   * The relative path to the directory containing the static files to serve.
+   *
+   * The provided path must be a subdirectory from the calling file's directory.
+   */
+  dir: string;
+
+  /**
+   * Path to the file to serve when the requested file is not found.
+   * The path must be a relative path to within the calling file's directory.
+   */
+  notFound?: string;
+
+  /**
+   * Http Status code used when serving notFound fallback.
+   * Defaults to 404.
+   */
+  notFoundStatus?: number;
+}
+
+export class StaticAssets {
+  public readonly options: StaticOptions;
+
+  constructor(options: StaticOptions) {
+    this.options = options;
+  }
+}
+
+api.static = function staticAssets(options: StaticOptions) {
+  return new StaticAssets(options);
+};
+
+export interface MiddlewareOptions {
+  /**
+   * Configuration for what endpoints that should be targeted by the middleware
+   */
+  target?: {
+    /**
+     * If set, only run middleware on endpoints that are either exposed or not
+     * exposed.
+     */
+    expose?: boolean;
+
+    /**
+     * If set, only run middleware on endpoints that either require or not
+     * requires auth.
+     */
+    auth?: boolean;
+
+    /**
+     * If set, only run middleware on endpoints that are raw endpoints.
+     */
+    isRaw?: boolean;
+
+    /**
+     * If set, only run middleware on endpoints that are stream endpoints.
+     */
+    isStream?: boolean;
+
+    /**
+     * If set, only run middleware on endpoints that have specific tags.
+     * These tags are evaluated with OR, meaning the middleware applies to an
+     * API if the API has at least one of those tags.
+     */
+    tags?: string[];
+  };
+}
+
+export class MiddlewareRequest {
+  private _reqMeta?: RequestMeta;
+  private _stream?: IterableStream | IterableSocket | Sink;
+  private _rawReq?: RawRequest;
+  private _rawResp?: RawResponse;
+  private _data?: Record<string, any>;
+
+  constructor(
+    stream?: IterableStream | IterableSocket | Sink,
+    rawReq?: RawRequest,
+    rawResp?: RawResponse
+  ) {
+    this._stream = stream;
+    this._rawReq = rawReq;
+    this._rawResp = rawResp;
+  }
+
+  /**
+   * requestMeta is set when the handler is a typed handler or a stream handler.
+   * for raw handlers, see rawRequest and rawResponse.
+   */
+  public get requestMeta(): RequestMeta | undefined {
+    return this._reqMeta || (this._reqMeta = currentRequest());
+  }
+
+  /**
+   * stream is set when the handler is a stream handler.
+   */
+  public get stream(): IterableStream | IterableSocket | Sink | undefined {
+    return this._stream;
+  }
+
+  /**
+   * rawRequest is set when the handler is a raw request handler.
+   */
+  public get rawRequest(): RawRequest | undefined {
+    return this._rawReq;
+  }
+
+  /**
+   * rawResponse is set when the handler is a raw request handler.
+   */
+  public get rawResponse(): RawResponse | undefined {
+    return this._rawResp;
+  }
+
+  /**
+   * data can be used to pass data from middlewares to the handler.
+   * The data will be available via `currentRequest()`
+   */
+  public get data(): Record<string, any> {
+    if (this._data === undefined) {
+      this._data = {};
+    }
+    return this._data;
+  }
+}
+
+export class ResponseHeader {
+  headers: Record<string, string | string[]>;
+
+  constructor() {
+    this.headers = {};
+  }
+
+  /**
+   * set will set a header value for a key, if a previous middleware has
+   * already set a value, it will be overridden.
+   */
+  public set(key: string, value: string | string[]) {
+    this.headers[key] = value;
+  }
+
+  /**
+   * add adds a header value to a key, if a previous middleware has
+   * already set a value, they will be appended.
+   */
+  public add(key: string, value: string | string[]) {
+    const prev = this.headers[key];
+
+    if (prev === undefined) {
+      this.headers[key] = value;
+    } else {
+      this.headers[key] = [prev, value].flat();
+    }
+  }
+}
+
+export class HandlerResponse {
+  /**
+   * The payload returned by the handler when the handler is either
+   * a typed handler or stream handler.
+   */
+  payload: any;
+
+  private _headers?: ResponseHeader;
+  private _status?: number;
+
+  constructor(payload: any) {
+    this.payload = payload;
+  }
+
+  /**
+   * header can be used by middlewares to set headers to the
+   * response. This only works for typed handler. For raw handlers
+   * see MiddlewareRequest.rawResponse.
+   */
+  public get header(): ResponseHeader {
+    if (this._headers === undefined) {
+      this._headers = new ResponseHeader();
+    }
+
+    return this._headers;
+  }
+
+  /**
+   * Override the http status code for successful requests for typed endpoints.
+   */
+  public set status(s: number) {
+    this._status = s;
+  }
+
+  /**
+   * __internalToResponse converts a response to the internal representation
+   */
+  __internalToResponse(): InternalHandlerResponse {
+    return {
+      payload: this.payload,
+      extraHeaders: this._headers?.headers,
+      status: this._status
+    };
+  }
+}
+
+export type Next = (req: MiddlewareRequest) => Promise<HandlerResponse>;
+
+export type MiddlewareFn = (
+  req: MiddlewareRequest,
+  next: Next
+) => Promise<HandlerResponse>;
+
+export interface Middleware extends MiddlewareFn {
+  options?: MiddlewareOptions;
+}
+
+export function middleware(m: MiddlewareFn): Middleware;
+export function middleware(
+  options: MiddlewareOptions,
+  fn: MiddlewareFn
+): Middleware;
+
+export function middleware(
+  a: MiddlewareFn | MiddlewareOptions,
+  b?: MiddlewareFn
+): Middleware {
+  if (b === undefined) {
+    return a as Middleware;
+  } else {
+    const opts = a as MiddlewareOptions;
+    // Wrap the middleware function to delegate calls and preserve the original options.
+    // The options object is stored separately and made immutable to prevent accidental mutation.
+    const mw: Middleware = (req: MiddlewareRequest, next: Next) => {
+      return b(req, next);
+    };
+    mw.options = Object.freeze({ ...opts });
+
+    return mw;
+  }
+}
+
+/**
+ * Options when making api calls.
+ *
+ * This interface will be extended with additional fields from
+ * app's generated code.
+ */
+export interface CallOpts {
+  /* authData?: AuthData */
+}
+
+import { HttpStatusValues } from "./httpstatus";
+export const HttpStatus = HttpStatusValues;
+export type HttpStatus =
+  (typeof HttpStatusValues)[keyof typeof HttpStatusValues];
+
+export { APIError, ErrCode } from "./error";
+export { Gateway, type GatewayConfig } from "./gateway";
+export { IterableSocket, IterableStream, Sink } from "./stream";
diff --git a/runtimes/js/encore.dev/api/stream.ts b/runtimes/js/encore.dev/api/stream.ts
new file mode 100644
index 0000000000..b8ae5800b9
--- /dev/null
+++ b/runtimes/js/encore.dev/api/stream.ts
@@ -0,0 +1,68 @@
+import * as runtime from "../internal/runtime/mod";
+
+export class IterableStream {
+  private stream: runtime.Stream;
+
+  constructor(stream: runtime.Stream) {
+    this.stream = stream;
+  }
+
+  recv(): Promise<Record<string, any>> {
+    return this.stream.recv();
+  }
+
+  async *[Symbol.asyncIterator]() {
+    while (true) {
+      try {
+        yield await this.stream.recv();
+      } catch (e) {
+        break;
+      }
+    }
+  }
+}
+
+export class IterableSocket {
+  private socket: runtime.Socket;
+
+  constructor(socket: runtime.Socket) {
+    this.socket = socket;
+  }
+
+  send(msg: Record<string, any>): void {
+    return this.socket.send(msg);
+  }
+  recv(): Promise<Record<string, any>> {
+    return this.socket.recv();
+  }
+
+  close(): void {
+    this.socket.close();
+  }
+
+  async *[Symbol.asyncIterator]() {
+    while (true) {
+      try {
+        yield await this.socket.recv();
+      } catch (e) {
+        break;
+      }
+    }
+  }
+}
+
+export class Sink {
+  private sink: runtime.Sink;
+
+  constructor(sink: runtime.Sink) {
+    this.sink = sink;
+  }
+
+  send(msg: Record<string, any>): void {
+    return this.sink.send(msg);
+  }
+
+  close(): void {
+    this.sink.close();
+  }
+}
diff --git a/runtimes/js/encore.dev/app_meta.ts b/runtimes/js/encore.dev/app_meta.ts
new file mode 100644
index 0000000000..e8481aecdc
--- /dev/null
+++ b/runtimes/js/encore.dev/app_meta.ts
@@ -0,0 +1,147 @@
+import * as runtime from "./internal/runtime/mod";
+
+// Describes the running Encore application.
+export interface AppMeta {
+  // The Encore application ID. If the application is not linked to the Encore platform this will be an empty string.
+  // To link to the Encore platform run `encore app link` from your terminal in the root directory of the Encore app.
+  appId: string;
+
+  // The base URL which can be used to call the API of this running application.
+  //
+  // For local development it is "http://localhost:<port>", typically "http://localhost:4000".
+  //
+  // If a custom domain is used for this environment it is returned here, but note that
+  // changes only take effect at the time of deployment while custom domains can be updated at any time.
+  apiBaseUrl: string;
+
+  // Information about the environment the app is running in.
+  environment: EnvironmentMeta;
+
+  // Information about the build.
+  build: BuildMeta;
+
+  // Information about the deployment.
+  deploy: DeployMeta;
+}
+
+// Describes the environment the Encore application is running in.
+export interface EnvironmentMeta {
+  // The name of environment that this application.
+  // For local development it is "local".
+  name: string;
+
+  // The type of environment is this application running in.
+  // For local development it is "development".
+  type: EnvironmentType;
+
+  // The cloud this is running in.
+  // For local development it is "local".
+  cloud: CloudProvider;
+}
+
+// Describes what type of environment the application is running in.
+export type EnvironmentType =
+  // A production environment.
+  | "production"
+  // A long-lived cloud-hosted, non-production environment, such as test environments, or local development.
+  | "development"
+  // A short-lived cloud-hosted, non-production environments, such as preview environments
+  | "ephemeral"
+  // When running automated tests.
+  | "test";
+
+// Describes what cloud provider the application is running in.
+export type CloudProvider =
+  | "aws" // Amazon Web Services
+  | "gcp" // Google Cloud Platform
+  | "azure" // Microsoft Azure
+  | "encore" // Encore Cloud.
+  | "local"; // Local development
+
+// Information about the build that formed the running application.
+export interface BuildMeta {
+  // The git commit that formed the base of this build.
+  revision: string;
+
+  // Whether there were uncommitted changes on top of the commit.
+  uncommittedChanges: boolean;
+}
+
+// Information about the deployment of the running application.
+export interface DeployMeta {
+  // The unique id of the deployment. Generated by the Encore Platform.
+  id: string;
+
+  // The services hosted by this deployment, keyed by the service name. 
+  hostedServices: Record<string, HostedService>;
+}
+
+export interface HostedService {
+  // The name of the service
+  name: string;
+}
+
+// Returns metadata about the running Encore application.
+//
+// The metadata is cached and is the same object each call,
+// and therefore must not be modified by the caller.
+export function appMeta(): AppMeta {
+  // Compute the metadata on first use.
+  if (cached === null) {
+    let rt = runtime.RT.appMeta();
+    cached = {
+      appId: rt.appId,
+      apiBaseUrl: rt.apiBaseUrl,
+      environment: {
+        name: rt.environment.name,
+        type: envType(rt.environment.type),
+        cloud: cloudProvider(rt.environment.cloud)
+      },
+      build: {
+        revision: rt.build.revision,
+        uncommittedChanges: rt.build.uncommittedChanges
+      },
+      deploy: {
+        id: rt.deploy.id,
+        hostedServices: rt.deploy.hostedServices
+      }
+    };
+  }
+
+  return cached;
+}
+
+function envType(rtType: runtime.EnvironmentType): EnvironmentType {
+  switch (rtType) {
+    case runtime.EnvironmentType.Production:
+      return "production";
+    case runtime.EnvironmentType.Development:
+      return "development";
+    case runtime.EnvironmentType.Ephemeral:
+      return "ephemeral";
+    case runtime.EnvironmentType.Test:
+      return "test";
+    default:
+      return "development";
+  }
+}
+
+function cloudProvider(rtType: runtime.CloudProvider): CloudProvider {
+  switch (rtType) {
+    case runtime.CloudProvider.AWS:
+      return "aws";
+    case runtime.CloudProvider.GCP:
+      return "gcp";
+    case runtime.CloudProvider.Azure:
+      return "azure";
+    case runtime.CloudProvider.Encore:
+      return "encore";
+    case runtime.CloudProvider.Local:
+      return "local";
+    default:
+      return "local";
+  }
+}
+
+// The cached app metadata. Set on first use.
+let cached: AppMeta | null = null;
diff --git a/runtimes/js/encore.dev/auth/mod.ts b/runtimes/js/encore.dev/auth/mod.ts
new file mode 100644
index 0000000000..5c4e80a653
--- /dev/null
+++ b/runtimes/js/encore.dev/auth/mod.ts
@@ -0,0 +1,15 @@
+export type AuthHandler<
+  Params extends object,
+  AuthData extends { userID: string },
+> = ((params: Params) => Promise<AuthData | null>) & AuthHandlerBrand;
+
+export type AuthHandlerBrand = { readonly __authHandlerBrand: unique symbol };
+
+export function authHandler<
+  Params extends object,
+  AuthData extends { userID: string },
+>(
+  fn: (params: Params) => Promise<AuthData | null>,
+): AuthHandler<Params, AuthData> {
+  return fn as any;
+}
diff --git a/runtimes/js/encore.dev/config/mod.ts b/runtimes/js/encore.dev/config/mod.ts
new file mode 100644
index 0000000000..8e10500989
--- /dev/null
+++ b/runtimes/js/encore.dev/config/mod.ts
@@ -0,0 +1,2 @@
+export type { Secret, AnySecret } from "./secrets";
+export { secret } from "./secrets";
diff --git a/runtimes/js/encore.dev/config/secrets.ts b/runtimes/js/encore.dev/config/secrets.ts
new file mode 100644
index 0000000000..2ce3c7c4d7
--- /dev/null
+++ b/runtimes/js/encore.dev/config/secrets.ts
@@ -0,0 +1,72 @@
+import * as runtime from "../internal/runtime/mod";
+import { StringLiteral } from "../internal/utils/constraints";
+
+/**
+ * Secret represents a single secret value that is loaded
+ * into the application. It is strongly typed for that secret,
+ * so that you can write functions which expect a specific one.
+ *
+ * You can use {@link AnySecret} to represent any secret without knowing
+ * it's name.
+ *
+ * @example
+ *
+ * function doFoo(s: Secret<"foo">): void {
+ *   const foo = s();
+ * }
+ */
+export interface Secret<Name extends string> {
+  /**
+   * Returns the current value of the secret.
+   *
+   * Encore will periodically refresh the value of the secret, so this
+   * value may change over time and could be stale for upto a couple of
+   * minutes. If you need to ensure you have the latest value, use
+   * {@link latest}.
+   */
+  (): string;
+
+  /**
+   * The name of the secret.
+   */
+  readonly name: Name;
+}
+
+/**
+ * AnySecret is a type which can be used to represent any {@link Secret}
+ * without knowing its name.
+ */
+export type AnySecret = Secret<string>;
+
+/**
+ * secret is used to load a single {@link Secret} into the application.
+ *
+ * If you wish to load multiple secrets at once, see {@link secrets}.
+ *
+ * @example loading a single secret
+ *  import {secret} from "encore.dev/config/secrets";
+ *  const foo = secret<"foo">();
+ */
+export function secret<Name extends string>(
+  name: StringLiteral<Name>,
+): Secret<Name> {
+  // Get the secret implementation from the runtime.
+  // It reports null if the secret isn't in the runtime config.
+  const impl = runtime.RT.secret(name);
+  const secretObj = () => {
+    if (impl === null) {
+      throw new Error(`secret ${name} is not set`);
+    }
+    return impl.cached();
+  };
+
+  secretObj.toString = () => {
+    if (impl === null) {
+      return `Secret<${name}>(not set)`;
+    }
+    return `Secret<${name}>(*********)`;
+  };
+  Object.defineProperty(secretObj, "name", { value: name });
+
+  return secretObj as unknown as Secret<Name>;
+}
diff --git a/runtimes/js/encore.dev/cron/mod.ts b/runtimes/js/encore.dev/cron/mod.ts
new file mode 100644
index 0000000000..54fea4f28c
--- /dev/null
+++ b/runtimes/js/encore.dev/cron/mod.ts
@@ -0,0 +1,17 @@
+/* eslint-disable */
+
+import { DurationString } from "../internal/types/mod";
+
+export class CronJob {
+  public readonly name: string;
+  public readonly cfg: CronJobConfig;
+  constructor(name: string, cfg: CronJobConfig) {
+    this.name = name;
+    this.cfg = cfg;
+  }
+}
+
+export type CronJobConfig = {
+  endpoint: () => Promise<unknown>;
+  title?: string;
+} & ({ every: DurationString } | { schedule: string });
diff --git a/runtimes/js/encore.dev/internal/api/mod.ts b/runtimes/js/encore.dev/internal/api/mod.ts
new file mode 100644
index 0000000000..fdfca5ebaa
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/api/mod.ts
@@ -0,0 +1,115 @@
+import * as runtime from "../runtime/mod";
+import { getCurrentRequest } from "../reqtrack/mod";
+import { APIError, ErrCode } from "../../api/error";
+
+export async function apiCall(
+  service: string,
+  endpoint: string,
+  data: any,
+  opts?: runtime.CallOpts
+): Promise<any> {
+  const source = getCurrentRequest();
+  const resp = await runtime.RT.apiCall(service, endpoint, data, source, opts);
+
+  // Convert any call error to our APIError type.
+  // We do this here because NAPI doesn't have great support
+  // for custom exception types yet.
+  if (resp instanceof runtime.ApiCallError) {
+    throw new APIError(
+      resp.code as ErrCode,
+      resp.message,
+      undefined,
+      resp.details
+    );
+  }
+
+  return resp;
+}
+
+export async function streamInOut(
+  service: string,
+  endpoint: string,
+  data: any,
+  opts?: runtime.CallOpts
+): Promise<any> {
+  const source = getCurrentRequest();
+  const stream = await runtime.RT.stream(service, endpoint, data, source, opts);
+
+  return {
+    async send(msg: any) {
+      stream.send(msg);
+    },
+    async recv(): Promise<any> {
+      return stream.recv();
+    },
+    async close() {
+      stream.close();
+    },
+    async *[Symbol.asyncIterator]() {
+      while (true) {
+        try {
+          yield await stream.recv();
+        } catch (e) {
+          break;
+        }
+      }
+    }
+  };
+}
+
+export async function streamIn(
+  service: string,
+  endpoint: string,
+  data: any,
+  opts?: runtime.CallOpts
+): Promise<any> {
+  const source = getCurrentRequest();
+  const stream = await runtime.RT.stream(service, endpoint, data, source, opts);
+  const response = new Promise(async (resolve, reject) => {
+    try {
+      resolve(await stream.recv());
+    } catch (e) {
+      reject(e);
+    }
+  });
+
+  return {
+    async send(msg: any) {
+      stream.send(msg);
+    },
+    async close() {
+      stream.close();
+    },
+    async response(): Promise<any> {
+      return response;
+    }
+  };
+}
+
+export async function streamOut(
+  service: string,
+  endpoint: string,
+  data: any,
+  opts?: runtime.CallOpts
+): Promise<any> {
+  const source = getCurrentRequest();
+  const stream = await runtime.RT.stream(service, endpoint, data, source, opts);
+
+  return {
+    async recv(): Promise<any> {
+      return stream.recv();
+    },
+    async close() {
+      stream.close();
+    },
+    async *[Symbol.asyncIterator]() {
+      while (true) {
+        try {
+          yield await stream.recv();
+        } catch (e) {
+          break;
+        }
+      }
+    }
+  };
+}
diff --git a/runtimes/js/encore.dev/internal/api/node_http.ts b/runtimes/js/encore.dev/internal/api/node_http.ts
new file mode 100644
index 0000000000..73b6e609f1
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/api/node_http.ts
@@ -0,0 +1,341 @@
+import type {
+  IncomingHttpHeaders,
+  OutgoingHttpHeader,
+  OutgoingHttpHeaders
+} from "node:http";
+import type { AddressInfo, Socket, SocketReadyState } from "node:net";
+import * as stream from "node:stream";
+import * as runtime from "../runtime/mod";
+
+export class RawRequest extends stream.Readable {
+  complete: boolean;
+
+  trailers: NodeJS.Dict<string>;
+  trailersDistinct: NodeJS.Dict<string[]>;
+  rawTrailers: string[];
+
+  readonly connection: Socket | null; // deprecated
+  readonly socket: Socket | null;
+
+  private body: runtime.BodyReader;
+  private req: runtime.Request;
+
+  constructor(req: runtime.Request, body: runtime.BodyReader) {
+    super({});
+    this.req = req;
+    this.complete = false;
+
+    this.trailers = {};
+    this.trailersDistinct = {};
+    this.rawTrailers = [];
+
+    this.body = body;
+    this.body.start(this.push.bind(this), this.destroy.bind(this));
+
+    // Set the socket to a dummy value for legacy compatibility with Express.js.
+    this.socket = new DummySocket() as Socket;
+    this.connection = this.socket; // legacy alias
+  }
+
+  get method(): string {
+    return this.meta.apiCall!.method;
+  }
+
+  _url: string | undefined;
+  get url(): string {
+    if (!this._url) {
+      this._url = this.meta.apiCall!.pathAndQuery;
+    }
+    return this._url!;
+  }
+  set url(value: string) {
+    this._url = value;
+  }
+
+  get headers(): IncomingHttpHeaders {
+    return this.meta.apiCall!.headers;
+  }
+
+  _headersDistinct: NodeJS.Dict<string[]> | undefined;
+  get headersDistinct(): NodeJS.Dict<string[]> {
+    if (this._headersDistinct) {
+      return this._headersDistinct;
+    }
+
+    const headers: NodeJS.Dict<string[]> = {};
+    for (const [key, value] of Object.entries(this.headers)) {
+      if (value !== undefined) {
+        const val: string[] = Array.isArray(value) ? value : [value];
+        headers[key] = val;
+      }
+    }
+    this._headersDistinct = headers;
+    return headers;
+  }
+
+  _rawHeaders: string[] | undefined;
+  get rawHeaders(): string[] {
+    if (this._rawHeaders) {
+      return this._rawHeaders;
+    }
+
+    this._rawHeaders = Object.keys(this.headers);
+    return this._rawHeaders;
+  }
+
+  private _meta: runtime.RequestMeta | undefined;
+  private get meta(): runtime.RequestMeta {
+    if (this._meta === undefined) {
+      this._meta = this.req.meta();
+    }
+    return this._meta;
+  }
+
+  _read(size: number): void {
+    this.body.read();
+  }
+
+  setTimeout(msecs: number, callback?: () => void): this {
+    // Not yet implemented.
+    return this;
+  }
+}
+
+export class RawResponse extends stream.Writable {
+  readonly req: RawRequest;
+  chunkedEncoding: boolean;
+  shouldKeepAlive: boolean;
+  // useChunkedEncodingByDefault: boolean;
+  sendDate: boolean;
+  statusCode: number;
+  statusMessage: string | undefined;
+
+  finished: boolean; // deprecated
+  headersSent: boolean;
+  strictContentLength: boolean;
+
+  readonly connection: Socket | null; // deprecated
+  readonly socket: Socket | null;
+
+  private w: runtime.ResponseWriter;
+  private headers: OutgoingHttpHeaders;
+
+  constructor(req: RawRequest, w: runtime.ResponseWriter) {
+    super({ highWaterMark: 1024 * 1024 }); // TODO?
+    this.req = req;
+    this.chunkedEncoding = false; // TODO
+    this.shouldKeepAlive = true;
+    this.sendDate = true;
+    this.statusCode = 200;
+    this.statusMessage = undefined;
+    this.finished = false;
+    this.strictContentLength = false;
+    this.headersSent = false;
+    this.headers = {};
+
+    this.w = w;
+
+    // Set the socket to a dummy value for legacy compatibility with Express.js.
+    this.socket = new DummySocket() as Socket;
+    this.connection = this.socket; // legacy alias
+  }
+
+  write(
+    chunk: any,
+    callback?: ((error: Error | null | undefined) => void) | undefined
+  ): boolean;
+  write(
+    chunk: any,
+    encoding: BufferEncoding,
+    callback?: ((error: Error | null | undefined) => void) | undefined
+  ): boolean;
+  write(chunk: unknown, encoding?: unknown, callback?: unknown): boolean {
+    const res = super.write(chunk, encoding as any, callback as any);
+    // HACK: Work around pipe deadlock in Node.js when writing a large response.
+    return true;
+  }
+
+  // Needed for Next.js compatibility.
+  _implicitHeader() {
+    this._writeHeaderIfNeeded();
+  }
+
+  _writeHeaderIfNeeded() {
+    if (!this.headersSent) {
+      this.w.writeHead(
+        this.statusCode,
+        this.headers as Record<string, string | number | string[]>
+      );
+      this.headersSent = true;
+    }
+  }
+
+  _write(
+    chunk: Buffer,
+    _encoding: BufferEncoding,
+    callback: (error?: Error | null) => void
+  ) {
+    this._writeHeaderIfNeeded();
+    this.w.writeBody(chunk, callback);
+  }
+
+  _writev(
+    chunks: Array<{ chunk: Buffer }>,
+    callback: (error?: Error | null) => void
+  ) {
+    this._writeHeaderIfNeeded();
+    this.w.writeBodyMulti(
+      chunks.map((ch) => ch.chunk),
+      callback
+    );
+  }
+
+  _final(callback: (error?: Error | null | undefined) => void): void {
+    this._writeHeaderIfNeeded();
+    this.w.close(undefined, callback);
+  }
+
+  setTimeout(msecs: number, callback?: () => void): this {
+    // Not implemented yet.
+    return this;
+  }
+
+  setHeader(name: string, value: number | string | string[]): this {
+    this.headers[name] = value;
+    return this;
+  }
+
+  appendHeader(name: string, value: number | string | string[]): this {
+    const existing = this.headers[name];
+    const existingIsArr = Array.isArray(existing);
+    const valIsArr = Array.isArray(value);
+    if (existingIsArr && valIsArr) {
+      existing.push(...value);
+    } else if (existingIsArr) {
+      existing.push("" + value);
+    } else if (existing !== undefined) {
+      this.headers[name] = ["" + existing, "" + value];
+    } else {
+      this.headers[name] = value;
+    }
+    return this;
+  }
+
+  getHeader(name: string): number | string | string[] | undefined {
+    return this.headers[name];
+  }
+
+  getHeaders(): OutgoingHttpHeaders {
+    return this.headers;
+  }
+
+  getHeaderNames(): string[] {
+    return Object.keys(this.headers);
+  }
+
+  hasHeader(name: string): boolean {
+    return this.headers[name] !== undefined;
+  }
+
+  removeHeader(name: string): void {
+    delete this.headers[name];
+  }
+
+  addTrailers(
+    headers: OutgoingHttpHeaders | readonly [string, string][]
+  ): void {
+    // Not implemented yet.
+  }
+
+  flushHeaders(): void {
+    this._writeHeaderIfNeeded();
+  }
+
+  writeHead(
+    statusCode: number,
+    headers?: OutgoingHttpHeaders | OutgoingHttpHeader[]
+  ): this;
+  writeHead(
+    statusCode: number,
+    statusMessage?: string,
+    headers?: OutgoingHttpHeaders | OutgoingHttpHeader[]
+  ): this;
+  writeHead(
+    statusCode: number,
+    statusMessageOrHeaders?:
+      | string
+      | OutgoingHttpHeaders
+      | OutgoingHttpHeader[],
+    headers?: OutgoingHttpHeaders | OutgoingHttpHeader[]
+  ): this {
+    this.statusCode = statusCode;
+
+    const headersIn =
+      typeof statusMessageOrHeaders === "string"
+        ? headers
+        : statusMessageOrHeaders;
+
+    // Merge headers, if provided.
+    if (headersIn) {
+      if (Array.isArray(headersIn)) {
+        for (let i = 0; i < headersIn.length; i += 2) {
+          const key = headersIn[i];
+          const value = headersIn[i + 1];
+          if (typeof key === "string" && typeof value === "string") {
+            this.headers[key] = value;
+          }
+        }
+      } else {
+        for (const key in headersIn) {
+          const value = headersIn[key];
+          this.headers[key] = value;
+        }
+      }
+    }
+
+    this._writeHeaderIfNeeded();
+    return this;
+  }
+}
+
+// DummySocket is a dummy implementation of the net.Socket class.
+//
+// It's provided because certain libraries like Express expect the `socket` attribute
+// to be non-null on the request and response object.
+class DummySocket extends stream.Duplex {
+  destroySoon(): void { }
+  write(): boolean { return true; }
+  connect(): this { return this; }
+  setEncoding(_encoding?: BufferEncoding): this { return this; }
+  pause(): this { return this; }
+  resetAndDestroy(): this { return this; }
+  resume(): this { return this; }
+  setTimeout(_timeout: number, _callback?: () => void): this { return this; }
+  setNoDelay(_noDelay?: boolean): this { return this; }
+  setKeepAlive(_enable?: boolean, _initialDelay?: number): this { return this; }
+  address(): AddressInfo | {} { return {}; }
+  unref(): this { return this; }
+  ref(): this { return this; }
+  readonly autoSelectFamilyAttemptedAddresses: string[] = [];
+  readonly bufferSize: number = 0;
+  readonly bytesRead: number = 0;
+  readonly bytesWritten: number = 0;
+  readonly connecting: boolean = false;
+  readonly pending: boolean = false;
+  readonly destroyed: boolean = false;
+  readonly localAddress?: string = undefined;
+  readonly localPort?: number = undefined;
+  readonly localFamily?: string = undefined;
+  readonly readyState: SocketReadyState = 'open';
+  readonly remoteAddress?: string | undefined = undefined;
+  readonly remoteFamily?: string | undefined = undefined;
+  readonly remotePort?: number | undefined = undefined;
+  readonly timeout?: number | undefined = undefined;
+  end(): this { return this; }
+  addListener(_event: string, _listener: (...args: any[]) => void): this { return this; }
+  emit(_event: string | symbol, ..._args: any[]): boolean { return true; }
+  on(_event: string, _listener: (...args: any[]) => void): this { return this; }
+  once(_event: string, _listener: (...args: any[]) => void): this { return this; }
+  prependListener(_event: string, _listener: (...args: any[]) => void): this { return this; }
+  prependOnceListener(_event: string, _listener: (...args: any[]) => void): this { return this; }
+}
diff --git a/runtimes/js/encore.dev/internal/appinit/mod.ts b/runtimes/js/encore.dev/internal/appinit/mod.ts
new file mode 100644
index 0000000000..2c25f76b6a
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/appinit/mod.ts
@@ -0,0 +1,226 @@
+import { isMainThread, Worker } from "node:worker_threads";
+import { Gateway } from "../../api/gateway";
+import { Middleware, MiddlewareRequest, HandlerResponse } from "../../api/mod";
+import { IterableSocket, IterableStream, Sink } from "../../api/stream";
+import { RawRequest, RawResponse } from "../api/node_http";
+import { setCurrentRequest } from "../reqtrack/mod";
+import * as runtime from "../runtime/mod";
+import { fileURLToPath } from "node:url";
+
+export type Handler = {
+  apiRoute: runtime.ApiRoute;
+  middlewares: Middleware[];
+  endpointOptions: EndpointOptions;
+};
+
+export function registerHandlers(handlers: Handler[]) {
+  runtime.RT.registerHandlers(handlers.map((h) => transformHandler(h)));
+}
+
+export function registerTestHandler(handler: Handler) {
+  runtime.RT.registerTestHandler(transformHandler(handler));
+}
+
+export function registerGateways(gateways: Gateway[]) {
+  // This function exists to ensure gateways are imported and executed.
+  // It intentionally doesn't need to do anything.
+}
+
+export async function run(entrypoint: string) {
+  if (isMainThread) {
+    const extraWorkers = runtime.RT.numWorkerThreads() - 1;
+    if (extraWorkers > 0) {
+      const path = fileURLToPath(entrypoint);
+      for (let i = 0; i < extraWorkers; i++) {
+        new Worker(path);
+      }
+    }
+    return runtime.RT.runForever();
+  }
+
+  // This is a worker thread. The runtime is already initialized, so block forever.
+  await new Promise(() => {});
+}
+
+interface EndpointOptions {
+  expose: boolean;
+  auth: boolean;
+  isRaw: boolean;
+  isStream: boolean;
+  tags: string[];
+}
+
+export interface InternalHandlerResponse {
+  payload: any;
+  extraHeaders?: Record<string, string | string[]>;
+  status?: number;
+}
+
+// recursively calls all middlewares
+async function invokeMiddlewareChain(
+  curReq: runtime.Request,
+  req: MiddlewareRequest,
+  chain: Middleware[],
+  handler: () => Promise<any>
+): Promise<InternalHandlerResponse> {
+  const execute = async (
+    index: number,
+    req: MiddlewareRequest
+  ): Promise<HandlerResponse> => {
+    const currentMiddleware = chain.at(index);
+
+    // no more middlewares, execute the handler
+    if (currentMiddleware === undefined) {
+      const mwData = req.data;
+      if (mwData !== undefined) {
+        (curReq as any).middlewareData = mwData;
+      }
+      return new HandlerResponse(await handler());
+    }
+
+    // execute current middleware
+    return currentMiddleware(req, (req) => {
+      return execute(index + 1, req);
+    });
+  };
+
+  return (await execute(0, req)).__internalToResponse();
+}
+
+// calculate what middlewares should run for an endpoint
+function calculateMiddlewareChain(
+  endpointOptions: EndpointOptions,
+  ms: Middleware[]
+): Middleware[] {
+  const middlewares = ms.filter((m) => {
+    const target = m.options?.target;
+    if (!target) return true;
+    const { auth, expose, isRaw, isStream, tags } = target;
+    return (
+      (auth === undefined || auth === endpointOptions.auth) &&
+      (expose === undefined || expose === endpointOptions.expose) &&
+      (isRaw === undefined || isRaw === endpointOptions.isRaw) &&
+      (isStream === undefined || isStream === endpointOptions.isStream) &&
+      (tags === undefined ||
+        tags.some((tag) => endpointOptions.tags.includes(tag)))
+    );
+  });
+
+  return middlewares;
+}
+
+function transformHandler(h: Handler): runtime.ApiRoute {
+  const middlewares = calculateMiddlewareChain(
+    h.endpointOptions,
+    h.middlewares
+  );
+
+  if (h.apiRoute.streamingResponse || h.apiRoute.streamingRequest) {
+    return {
+      ...h.apiRoute,
+      // req is the upgrade request.
+      // stream is either a bidirectional stream, in stream or out stream.
+      handler: (
+        req: runtime.Request,
+        stream: runtime.Sink | runtime.Stream | runtime.Socket
+      ) => {
+        setCurrentRequest(req);
+
+        // make readable streams async iterators
+        const streamArg: IterableStream | IterableSocket | Sink =
+          stream instanceof runtime.Stream
+            ? new IterableStream(stream)
+            : stream instanceof runtime.Socket
+              ? new IterableSocket(stream)
+              : new Sink(stream);
+
+        if (middlewares.length === 0) {
+          const payload = req.payload();
+          return toResponse(
+            payload !== null
+              ? h.apiRoute.handler(payload, streamArg)
+              : h.apiRoute.handler(streamArg)
+          );
+        }
+
+        const handler = async () => {
+          // handshake payload
+          const payload = req.payload();
+          return payload !== null
+            ? h.apiRoute.handler(payload, streamArg)
+            : h.apiRoute.handler(streamArg);
+        };
+
+        const mwRequest = new MiddlewareRequest(
+          streamArg,
+          undefined,
+          undefined
+        );
+        return invokeMiddlewareChain(req, mwRequest, middlewares, handler);
+      }
+    };
+  }
+
+  if (h.apiRoute.raw) {
+    return {
+      ...h.apiRoute,
+      handler: (
+        req: runtime.Request,
+        resp: runtime.ResponseWriter,
+        body: runtime.BodyReader
+      ) => {
+        setCurrentRequest(req);
+
+        const rawReq = new RawRequest(req, body);
+        const rawResp = new RawResponse(rawReq, resp);
+
+        if (middlewares.length === 0) {
+          return toResponse(h.apiRoute.handler(rawReq, rawResp));
+        }
+
+        const handler = async () => {
+          return h.apiRoute.handler(rawReq, rawResp);
+        };
+
+        const mwRequest = new MiddlewareRequest(undefined, rawReq, rawResp);
+        return invokeMiddlewareChain(req, mwRequest, middlewares, handler);
+      }
+    };
+  }
+
+  return {
+    ...h.apiRoute,
+    handler: (req: runtime.Request) => {
+      setCurrentRequest(req);
+
+      if (middlewares.length === 0) {
+        const payload = req.payload();
+        return toResponse(
+          payload !== null ? h.apiRoute.handler(payload) : h.apiRoute.handler()
+        );
+      }
+
+      const handler = async () => {
+        const payload = req.payload();
+        return payload !== null
+          ? h.apiRoute.handler(payload)
+          : h.apiRoute.handler();
+      };
+
+      const mwRequest = new MiddlewareRequest(undefined, undefined, undefined);
+      return invokeMiddlewareChain(req, mwRequest, middlewares, handler);
+    }
+  };
+}
+
+function toResponse(
+  payload: any
+): InternalHandlerResponse | Promise<InternalHandlerResponse> {
+  if (payload instanceof Promise) {
+    return payload.then((payload) => {
+      return new HandlerResponse(payload).__internalToResponse();
+    });
+  } else {
+    return new HandlerResponse(payload).__internalToResponse();
+  }
+}
diff --git a/runtimes/js/encore.dev/internal/auth/mod.ts b/runtimes/js/encore.dev/internal/auth/mod.ts
new file mode 100644
index 0000000000..d813ea40a9
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/auth/mod.ts
@@ -0,0 +1,10 @@
+import {getCurrentRequest} from "../reqtrack/mod";
+
+export function getAuthData<T>(): T | null {
+    const authData = getCurrentRequest()?.getAuthData();
+    if (!authData) {
+        return null;
+    } else {
+        return authData as T;
+    }
+}
diff --git a/runtimes/js/encore.dev/internal/codegen/api.ts b/runtimes/js/encore.dev/internal/codegen/api.ts
new file mode 100644
index 0000000000..08c7b1ed92
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/codegen/api.ts
@@ -0,0 +1 @@
+export { apiCall, streamIn, streamOut, streamInOut } from "../api/mod";
diff --git a/runtimes/js/encore.dev/internal/codegen/appinit.ts b/runtimes/js/encore.dev/internal/codegen/appinit.ts
new file mode 100644
index 0000000000..ce88c030c8
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/codegen/appinit.ts
@@ -0,0 +1 @@
+export {registerGateways, registerHandlers, registerTestHandler, run, type Handler} from "../appinit/mod";      
\ No newline at end of file
diff --git a/runtimes/js/encore.dev/internal/codegen/auth.ts b/runtimes/js/encore.dev/internal/codegen/auth.ts
new file mode 100644
index 0000000000..67835026b6
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/codegen/auth.ts
@@ -0,0 +1 @@
+export {getAuthData} from "../auth/mod";
\ No newline at end of file
diff --git a/runtimes/js/encore.dev/internal/reqtrack/mod.ts b/runtimes/js/encore.dev/internal/reqtrack/mod.ts
new file mode 100644
index 0000000000..ee6cf413cc
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/reqtrack/mod.ts
@@ -0,0 +1,12 @@
+import * as runtime from "../runtime/mod";
+import { AsyncLocalStorage } from "node:async_hooks";
+
+const asyncLocalStorage = new AsyncLocalStorage();
+
+export function setCurrentRequest(req: runtime.Request) {
+  asyncLocalStorage.enterWith(req);
+}
+
+export function getCurrentRequest(): runtime.Request | null {
+  return (asyncLocalStorage.getStore() as runtime.Request) ?? null;
+}
diff --git a/runtimes/js/encore.dev/internal/runtime/.gitignore b/runtimes/js/encore.dev/internal/runtime/.gitignore
new file mode 100644
index 0000000000..ec4b9aba00
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/runtime/.gitignore
@@ -0,0 +1 @@
+/napi
diff --git a/runtimes/js/encore.dev/internal/runtime/.npmignore b/runtimes/js/encore.dev/internal/runtime/.npmignore
new file mode 100644
index 0000000000..1084848a95
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/runtime/.npmignore
@@ -0,0 +1,3 @@
+# Intentionally left blank, because we want the napi directory
+# to be included in packages, but we don't want it committed to the repository.
+# If this file does not exist then the npm packaging code will use the .gitignore file instead.
diff --git a/runtimes/js/encore.dev/internal/runtime/mod.ts b/runtimes/js/encore.dev/internal/runtime/mod.ts
new file mode 100644
index 0000000000..5190188b47
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/runtime/mod.ts
@@ -0,0 +1,13 @@
+import { Decimal } from "../../types/mod";
+import { Runtime } from "./napi/napi.cjs";
+
+export * from "./napi/napi.cjs";
+
+const testMode = process.env.NODE_ENV === "test";
+
+export const RT = new Runtime({
+  testMode,
+  typeConstructors: {
+    decimal: (val: string | number | bigint) => new Decimal(val)
+  }
+});
diff --git a/runtimes/js/encore.dev/internal/types/mod.ts b/runtimes/js/encore.dev/internal/types/mod.ts
new file mode 100644
index 0000000000..363f0eccfc
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/types/mod.ts
@@ -0,0 +1,10 @@
+type durationUnit = "ns" | "µs" | "ms" | "s" | "m" | "h";
+type durationComponent = `${number}${durationUnit}`;
+
+/**
+ * A duration is a string representing a length of time.
+ */
+export type DurationString =
+  | durationComponent
+  | `${durationComponent}${durationComponent}`
+  | `${durationComponent} ${durationComponent}`;
diff --git a/runtimes/js/encore.dev/internal/utils/constraints.ts b/runtimes/js/encore.dev/internal/utils/constraints.ts
new file mode 100644
index 0000000000..fffcc79b9e
--- /dev/null
+++ b/runtimes/js/encore.dev/internal/utils/constraints.ts
@@ -0,0 +1,12 @@
+type UnUnion<T, S> = T extends S ? ([S] extends [T] ? T : never) : never;
+type NotUnion<T> = UnUnion<T, T>;
+
+/**
+ * Literal requires that the given type is a literal value, and not a union of literals.
+ */
+export type Literal<Value extends OfType, OfType> = OfType extends Value
+  ? never // But the type must not extend the value (i.e. the two must not be equal)
+  : NotUnion<Value>; // And the type must not be a union of literals
+
+/** Value must be a single string literal */
+export type StringLiteral<Value extends string> = Literal<Value, string>;
diff --git a/runtimes/js/encore.dev/log/mod.ts b/runtimes/js/encore.dev/log/mod.ts
new file mode 100644
index 0000000000..b4350e04ec
--- /dev/null
+++ b/runtimes/js/encore.dev/log/mod.ts
@@ -0,0 +1,223 @@
+import { getCurrentRequest } from "../internal/reqtrack/mod";
+import * as runtime from "../internal/runtime/mod";
+
+export type { Logger };
+
+/* eslint-disable @typescript-eslint/unified-signatures */
+/**
+ * A field value we support logging
+ */
+// eslint-disable-next-line @typescript-eslint/ban-ts-comment
+// @ts-expect-error
+export type FieldValue =
+  | string
+  | number
+  | boolean
+  | null
+  | undefined
+  | FieldsObject
+  | FieldValue[];
+
+/**
+ * A map of fields that can be logged
+ */
+// eslint-disable-next-line @typescript-eslint/ban-ts-comment
+// @ts-expect-error
+export type FieldsObject = Record<string, FieldValue>;
+
+export enum LogLevel {
+  Trace = runtime.LogLevel.Trace,
+  Debug = runtime.LogLevel.Debug,
+  Info = runtime.LogLevel.Info,
+  Warn = runtime.LogLevel.Warn,
+  Error = runtime.LogLevel.Error,
+}
+
+class Logger {
+  private impl: runtime.Logger;
+
+  constructor(impl: runtime.Logger) {
+    this.impl = impl;
+  }
+
+  /**
+   * Returns a new logger with the specified level.
+   */
+  withLevel(level: LogLevel): Logger {
+    return new Logger(this.impl.withLevel(level));
+  }
+
+  /**
+   * Returns a new logger with the given fields added to the context.
+   */
+  with(fields: FieldsObject): Logger {
+    return new Logger(this.impl.with(fields));
+  }
+
+  /**
+   * Trace logs a message at the trace level.
+   */
+  trace(msg: string, fields?: FieldsObject) {
+    this.log(runtime.LogLevel.Trace, msg, fields);
+  }
+
+  /**
+   * Debug logs a message at the debug level.
+   */
+  debug(msg: string, fields?: FieldsObject) {
+    this.log(runtime.LogLevel.Debug, msg, fields);
+  }
+
+  /**
+   * Info logs a message at the info level.
+   */
+  info(msg: string, fields?: FieldsObject) {
+    this.log(runtime.LogLevel.Info, msg, fields);
+  }
+
+  /**
+   * Warn logs a message at the warn level.
+   */
+  warn(err: Error | unknown, fields?: FieldsObject): void;
+  warn(err: Error | unknown, msg: string, fields?: FieldsObject): void;
+  warn(msg: string, fields?: FieldsObject): void;
+  warn(errOrMsg: unknown, msgOrFields: unknown, fields?: unknown) {
+    this.log(runtime.LogLevel.Warn, errOrMsg, msgOrFields, fields);
+  }
+
+  error(err: Error | unknown, fields?: FieldsObject): void;
+  error(err: Error | unknown, msg: string, fields?: FieldsObject): void;
+  error(msg: string, fields?: FieldsObject): void;
+  error(errOrMsg: unknown, msgOrFields: unknown, fields?: unknown) {
+    this.log(runtime.LogLevel.Error, errOrMsg, msgOrFields, fields);
+  }
+
+  /**
+   * The actual logging implementation.
+   */
+  private log(
+    level: runtime.LogLevel,
+    errOrMsg: unknown,
+    msgOrFields?: unknown,
+    possibleFields?: unknown
+  ) {
+    let err: Error | undefined;
+    let msg: string;
+    let fields: FieldsObject | undefined;
+
+    // Parse the arguments
+    if (typeof errOrMsg === "string") {
+      // log(msg, fields?)
+      err = undefined;
+      msg = errOrMsg;
+      fields = msgOrFields as FieldsObject | undefined;
+    } else if (typeof msgOrFields === "string") {
+      // log(err, msg, fields?)
+      if (errOrMsg) {
+        if (errOrMsg instanceof Error) {
+          err = errOrMsg;
+        } else {
+          err = new Error(String(errOrMsg));
+        }
+      }
+      msg = msgOrFields;
+      fields = possibleFields as FieldsObject | undefined;
+    } else {
+      // log(err, fields?)
+      if (errOrMsg) {
+        if (errOrMsg instanceof Error) {
+          err = errOrMsg;
+        } else {
+          err = new Error(String(errOrMsg));
+        }
+      }
+
+      msg = "";
+      fields = msgOrFields as FieldsObject | undefined;
+
+      // if (possibleFields) {
+      //   throw new Error("Invalid arguments to log");
+      // }
+    }
+
+    const req = getCurrentRequest();
+
+    this.impl.log(req, level, msg, err, undefined, fields);
+  }
+}
+
+const log = new Logger(runtime.RT.logger());
+
+/**
+ * The default logger for the app
+ */
+export default log;
+
+/**
+ * Trace logs a message at the trace level
+ */
+export function trace(msg: string, fields?: FieldsObject) {
+  log.trace(msg, fields);
+}
+
+/**
+ * Debug logs a message at the debug level
+ */
+export function debug(msg: string, fields?: FieldsObject) {
+  log.debug(msg, fields);
+}
+
+/**
+ * Info logs a message at the info level
+ */
+export function info(msg: string, fields?: FieldsObject) {
+  log.info(msg, fields);
+}
+
+/**
+ * Warn logs a message at the warn level
+ */
+export function warn(err: Error | unknown, fields?: FieldsObject): void;
+export function warn(
+  err: Error | unknown,
+  msg: string,
+  fields?: FieldsObject
+): void;
+export function warn(msg: string, fields?: FieldsObject): void;
+export function warn(
+  errOrMsg: unknown,
+  msgOrFields: unknown,
+  fields?: unknown
+) {
+  // the type cast here is just for TSC to be happy - the underlying method uses the same overloads so
+  // will type check the arguments correctly
+  log.warn(
+    errOrMsg as Error,
+    msgOrFields as string,
+    fields as FieldsObject | undefined
+  );
+}
+
+/**
+ * Error logs a message at the error level
+ */
+export function error(err: Error | unknown, fields?: FieldsObject): void;
+export function error(
+  err: Error | unknown,
+  msg: string,
+  fields?: FieldsObject
+): void;
+export function error(msg: string, fields?: FieldsObject): void;
+export function error(
+  errOrMsg: unknown,
+  msgOrFields: unknown,
+  fields?: unknown
+) {
+  // the type cast here is just for TSC to be happy - the underlying method uses the same overloads so
+  // will type check the arguments correctly
+  log.error(
+    errOrMsg as Error,
+    msgOrFields as string,
+    fields as FieldsObject | undefined
+  );
+}
diff --git a/runtimes/js/encore.dev/mod.ts b/runtimes/js/encore.dev/mod.ts
new file mode 100644
index 0000000000..e961ca67dd
--- /dev/null
+++ b/runtimes/js/encore.dev/mod.ts
@@ -0,0 +1,19 @@
+export { appMeta } from "./app_meta";
+export type {
+  AppMeta,
+  BuildMeta,
+  CloudProvider,
+  DeployMeta,
+  EnvironmentMeta,
+  EnvironmentType
+} from "./app_meta";
+
+export { currentRequest } from "./req_meta";
+export type {
+  APICallMeta,
+  APIDesc,
+  Method,
+  PubSubMessageMeta,
+  RequestMeta,
+  TraceData
+} from "./req_meta";
diff --git a/runtimes/js/encore.dev/package-lock.json b/runtimes/js/encore.dev/package-lock.json
new file mode 100644
index 0000000000..c1401bf940
--- /dev/null
+++ b/runtimes/js/encore.dev/package-lock.json
@@ -0,0 +1,436 @@
+{
+  "name": "encore.dev",
+  "version": "0.0.0-devel.202311141645",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "encore.dev",
+      "version": "0.0.0-devel.202311141645",
+      "license": "MPL-2.0",
+      "devDependencies": {
+        "@types/node": "^20.11.19",
+        "tsc-esm-fix": "^2.20.26",
+        "typescript": "^5.3.3"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
+    "node_modules/@nodelib/fs.scandir": {
+      "version": "2.1.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+      "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+      "dev": true,
+      "dependencies": {
+        "@nodelib/fs.stat": "2.0.5",
+        "run-parallel": "^1.1.9"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.stat": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+      "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+      "dev": true,
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@nodelib/fs.walk": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+      "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+      "dev": true,
+      "dependencies": {
+        "@nodelib/fs.scandir": "2.1.5",
+        "fastq": "^1.6.0"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "20.11.23",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.11.23.tgz",
+      "integrity": "sha512-ZUarKKfQuRILSNYt32FuPL20HS7XwNT7/uRwSV8tiHWfyyVwDLYZNF6DZKc2bove++pgfsXn9sUwII/OsQ82cQ==",
+      "dev": true,
+      "dependencies": {
+        "undici-types": "~5.26.4"
+      }
+    },
+    "node_modules/braces": {
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "fill-range": "^7.1.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/depseek": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/depseek/-/depseek-0.4.0.tgz",
+      "integrity": "sha512-TknBvSGRZUP9TfNn7Kny8J1mb3J8T79/c1rIXRom6dpW8cEq4v81P6TJn9TJ49NwhZm97HLAAISHNP2ET2KaBg==",
+      "dev": true
+    },
+    "node_modules/dir-glob": {
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz",
+      "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==",
+      "dev": true,
+      "dependencies": {
+        "path-type": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/fast-glob": {
+      "version": "3.3.2",
+      "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.2.tgz",
+      "integrity": "sha512-oX2ruAFQwf/Orj8m737Y5adxDQO0LAB7/S5MnxCdTNDd4p6BsyIVsv9JQsATbTSq8KHRpLwIHbVlUNatxd+1Ow==",
+      "dev": true,
+      "dependencies": {
+        "@nodelib/fs.stat": "^2.0.2",
+        "@nodelib/fs.walk": "^1.2.3",
+        "glob-parent": "^5.1.2",
+        "merge2": "^1.3.0",
+        "micromatch": "^4.0.4"
+      },
+      "engines": {
+        "node": ">=8.6.0"
+      }
+    },
+    "node_modules/fastq": {
+      "version": "1.17.1",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.17.1.tgz",
+      "integrity": "sha512-sRVD3lWVIXWg6By68ZN7vho9a1pQcN/WBFaAAsDDFzlJjvoGx0P8z7V1t72grFJfJhu3YPZBuu25f7Kaw2jN1w==",
+      "dev": true,
+      "dependencies": {
+        "reusify": "^1.0.4"
+      }
+    },
+    "node_modules/fill-range": {
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "to-regex-range": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/fs-extra": {
+      "version": "11.2.0",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.2.0.tgz",
+      "integrity": "sha512-PmDi3uwK5nFuXh7XDTlVnS17xJS7vW36is2+w3xcv8SVxiB4NyATf4ctkVY5bkSjX0Y4nbvZCq1/EjtEyr9ktw==",
+      "dev": true,
+      "dependencies": {
+        "graceful-fs": "^4.2.0",
+        "jsonfile": "^6.0.1",
+        "universalify": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.14"
+      }
+    },
+    "node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/globby": {
+      "version": "13.2.2",
+      "resolved": "https://registry.npmjs.org/globby/-/globby-13.2.2.tgz",
+      "integrity": "sha512-Y1zNGV+pzQdh7H39l9zgB4PJqjRNqydvdYCDG4HFXM4XuvSaQQlEc91IU1yALL8gUTDomgBAfz3XJdmUS+oo0w==",
+      "dev": true,
+      "dependencies": {
+        "dir-glob": "^3.0.1",
+        "fast-glob": "^3.3.0",
+        "ignore": "^5.2.4",
+        "merge2": "^1.4.1",
+        "slash": "^4.0.0"
+      },
+      "engines": {
+        "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/graceful-fs": {
+      "version": "4.2.11",
+      "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+      "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ==",
+      "dev": true
+    },
+    "node_modules/ignore": {
+      "version": "5.3.1",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.1.tgz",
+      "integrity": "sha512-5Fytz/IraMjqpwfd34ke28PTVMjZjJG2MPn5t7OE4eUCUNf8BAa7b5WUS9/Qvr6mwOQS7Mk6vdsMno5he+T8Xw==",
+      "dev": true,
+      "engines": {
+        "node": ">= 4"
+      }
+    },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
+    "node_modules/json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true,
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/jsonfile": {
+      "version": "6.1.0",
+      "resolved": "https://registry.npmjs.org/jsonfile/-/jsonfile-6.1.0.tgz",
+      "integrity": "sha512-5dgndWOriYSm5cnYaJNhalLNDKOqFwyDB/rr1E9ZsGciGvKPs8R2xYGCacuf3z6K1YKDz182fd+fY3cn3pMqXQ==",
+      "dev": true,
+      "dependencies": {
+        "universalify": "^2.0.0"
+      },
+      "optionalDependencies": {
+        "graceful-fs": "^4.1.6"
+      }
+    },
+    "node_modules/meow": {
+      "version": "12.1.1",
+      "resolved": "https://registry.npmjs.org/meow/-/meow-12.1.1.tgz",
+      "integrity": "sha512-BhXM0Au22RwUneMPwSCnyhTOizdWoIEPU9sp0Aqa1PnDMR5Wv2FGXYDjuzJEIX+Eo2Rb8xuYe5jrnm5QowQFkw==",
+      "dev": true,
+      "engines": {
+        "node": ">=16.10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/merge2": {
+      "version": "1.4.1",
+      "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+      "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/micromatch": {
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz",
+      "integrity": "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==",
+      "dev": true,
+      "dependencies": {
+        "braces": "^3.0.2",
+        "picomatch": "^2.3.1"
+      },
+      "engines": {
+        "node": ">=8.6"
+      }
+    },
+    "node_modules/path-type": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
+      "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/picomatch": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "dev": true,
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/queue-microtask": {
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+      "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/reusify": {
+      "version": "1.0.4",
+      "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.0.4.tgz",
+      "integrity": "sha512-U9nH88a3fc/ekCF1l0/UP1IosiuIjyTh7hBvXVMHYgVcfGvt897Xguj2UOLDeI5BG2m7/uwyaLVT6fbtCwTyzw==",
+      "dev": true,
+      "engines": {
+        "iojs": ">=1.0.0",
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/run-parallel": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+      "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ],
+      "dependencies": {
+        "queue-microtask": "^1.2.2"
+      }
+    },
+    "node_modules/slash": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
+      "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
+      "dev": true,
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
+    "node_modules/tsc-esm-fix": {
+      "version": "2.20.26",
+      "resolved": "https://registry.npmjs.org/tsc-esm-fix/-/tsc-esm-fix-2.20.26.tgz",
+      "integrity": "sha512-N4V8OYKm+o5ayqaLc2of26UFOPhO0xMP4RJsuiqD5uRef8+eWNLV1/I9PfKzUiiUomUb7PblsqAvPzQcCGCtyg==",
+      "dev": true,
+      "dependencies": {
+        "depseek": "^0.4.0",
+        "fs-extra": "^11.2.0",
+        "globby": "^13.2.2",
+        "json5": "^2.2.3",
+        "meow": "^12.1.1",
+        "tslib": "^2.6.2"
+      },
+      "bin": {
+        "tsc-esm-fix": "target/es6/cli.mjs"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      }
+    },
+    "node_modules/tslib": {
+      "version": "2.6.2",
+      "resolved": "https://registry.npmjs.org/tslib/-/tslib-2.6.2.tgz",
+      "integrity": "sha512-AEYxH93jGFPn/a2iVAwW87VuUIkR1FVUKB77NwMF7nBTDkDrrT/Hpt/IrCJ0QXhW27jTBDcf5ZY7w6RiqTMw2Q==",
+      "dev": true
+    },
+    "node_modules/typescript": {
+      "version": "5.3.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.3.3.tgz",
+      "integrity": "sha512-pXWcraxM0uxAS+tN0AG/BF2TyqmHO014Z070UsJ+pFvYuRSq8KH8DmWpnbXe0pEPDHXZV3FcAbJkijJ5oNEnWw==",
+      "dev": true,
+      "bin": {
+        "tsc": "bin/tsc",
+        "tsserver": "bin/tsserver"
+      },
+      "engines": {
+        "node": ">=14.17"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "5.26.5",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-5.26.5.tgz",
+      "integrity": "sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==",
+      "dev": true
+    },
+    "node_modules/universalify": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/universalify/-/universalify-2.0.1.tgz",
+      "integrity": "sha512-gptHNQghINnc/vTGIk0SOFGFNXw7JVrlRUtConJRlvaw6DuX0wO5Jeko9sWrMBhh+PsYAZ7oXAiOnf/UKogyiw==",
+      "dev": true,
+      "engines": {
+        "node": ">= 10.0.0"
+      }
+    }
+  }
+}
diff --git a/runtimes/js/encore.dev/package.json b/runtimes/js/encore.dev/package.json
new file mode 100644
index 0000000000..b30e5a760e
--- /dev/null
+++ b/runtimes/js/encore.dev/package.json
@@ -0,0 +1,105 @@
+{
+  "name": "encore.dev",
+  "description": "Encore's JavaScript/TypeScript SDK",
+  "version": "0.0.0-devel.202311141645",
+  "license": "MPL-2.0",
+  "bugs": {
+    "url": "https://github.com/encoredev/encore/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/encoredev/encore",
+    "directory": "runtimes/js/encore.dev"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "lint": "eslint \"**/*.ts*\"",
+    "test": "bun test"
+  },
+  "type": "module",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./mod.ts",
+      "bun": "./mod.ts",
+      "default": "./dist/mod.js"
+    },
+    "./api": {
+      "types": "./api/mod.ts",
+      "bun": "./api/mod.ts",
+      "default": "./dist/api/mod.js"
+    },
+    "./auth": {
+      "types": "./auth/mod.ts",
+      "bun": "./auth/mod.ts",
+      "default": "./dist/auth/mod.js"
+    },
+    "./config": {
+      "types": "./config/mod.ts",
+      "bun": "./config/mod.ts",
+      "default": "./dist/config/mod.js"
+    },
+    "./cron": {
+      "types": "./cron/mod.ts",
+      "bun": "./cron/mod.ts",
+      "default": "./dist/cron/mod.js"
+    },
+    "./log": {
+      "types": "./log/mod.ts",
+      "bun": "./log/mod.ts",
+      "default": "./dist/log/mod.js"
+    },
+    "./pubsub": {
+      "types": "./pubsub/mod.ts",
+      "bun": "./pubsub/mod.ts",
+      "default": "./dist/pubsub/mod.js"
+    },
+    "./service": {
+      "types": "./service/mod.ts",
+      "bun": "./service/mod.ts",
+      "default": "./dist/service/mod.js"
+    },
+    "./storage/sqldb": {
+      "types": "./storage/sqldb/mod.ts",
+      "bun": "./storage/sqldb/mod.ts",
+      "default": "./dist/storage/sqldb/mod.js"
+    },
+    "./storage/objects": {
+      "types": "./storage/objects/mod.ts",
+      "bun": "./storage/objects/mod.ts",
+      "default": "./dist/storage/objects/mod.js"
+    },
+    "./validate": {
+      "types": "./validate/mod.ts",
+      "bun": "./validate/mod.ts",
+      "default": "./dist/validate/mod.js"
+    },
+    "./types": {
+      "types": "./types/mod.ts",
+      "bun": "./types/mod.ts",
+      "default": "./dist/types/mod.js"
+    },
+    "./internal/codegen/*": {
+      "types": "./internal/codegen/*.ts",
+      "bun": "./internal/codegen/*.ts",
+      "default": "./dist/internal/codegen/*.js"
+    }
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "files": [
+    "dist/",
+    "*.ts",
+    "**/*.ts",
+    "*.cjs",
+    "*.cts",
+    "README.md",
+    "LICENSE"
+  ],
+  "devDependencies": {
+    "@types/node": "^20.11.19",
+    "tsc-esm-fix": "^2.20.26",
+    "typescript": "^5.3.3"
+  }
+}
diff --git a/runtimes/js/encore.dev/pubsub/mod.ts b/runtimes/js/encore.dev/pubsub/mod.ts
new file mode 100644
index 0000000000..26fef2734e
--- /dev/null
+++ b/runtimes/js/encore.dev/pubsub/mod.ts
@@ -0,0 +1,72 @@
+export { Topic } from "./topic";
+export type { TopicConfig, DeliveryGuarantee } from "./topic";
+
+export { Subscription } from "./subscription";
+export type { SubscriptionConfig } from "./subscription";
+
+/**
+ * Attribute represents a field on a message that should be sent
+ * as an attribute in a PubSub message, rather than in the message
+ * body.
+ *
+ * This is useful for ordering messages, or for filtering messages
+ * on a subscription - otherwise you should not use this.
+ *
+ * To create attributes on a message, use the `Attribute` type:
+ *   type Message = {
+ *     user_id: Attribute<number>;
+ *     name: string;
+ *   };
+ *
+ *   const msg: Message = {
+ *     user_id: 123,
+ *     name:    "John Doe",
+ *   };
+ *
+ * The union of brandedAttribute is simply used to help the TypeScript compiler
+ * understand that the type is an attribute and allow the AttributesOf type
+ * to extract the keys of said type.
+ */
+export type Attribute<T extends string | number | boolean> =
+  | T
+  | brandedAttribute<T>;
+
+/**
+ * AttributesOf is a helper type to extract all keys from an object
+ * who's type is an Attribute type.
+ *
+ * For example:
+ *    type Message = {
+ *        user_id: Attribute<number>;
+ *        name: string;
+ *        age: Attribute<number>;
+ *    };
+ *
+ *    type MessageAttributes = AttributesOf<Message>; // "user_id" | "age"
+ */
+export type AttributesOf<T extends object> = keyof {
+  [Key in keyof // for (const Key in T)
+  T as Extract<T[Key], allBrandedTypes> extends never //  if (typeof T[Key] !== oneof(allBrandedTypes))
+  ? never // drop the key
+  : Key]: never; // else keep the key
+};
+
+/**
+ * supportedAttributeTypes is a union of all primitive types that are supported as attributes
+ */
+type supportedAttributeTypes = string | number | boolean;
+
+/**
+ * brandedAttribute is a helper type to brand a type as an attribute
+ * which is distinct from the base type. It is a compile time only
+ * type and has no runtime representation.
+ */
+type brandedAttribute<T> = T & { readonly __attributeBrand: unique symbol };
+
+/**
+ * allBrandedTypes is a helper type to create a union of all branded supported attribute types
+ *
+ * The result of this is: brandedAttribute<string> | brandedAttribute<number> | brandedAttribute<boolean>
+ */
+type allBrandedTypes<Union = supportedAttributeTypes> =
+  Union extends supportedAttributeTypes ? brandedAttribute<Union> : never;
diff --git a/runtimes/js/encore.dev/pubsub/subscription.ts b/runtimes/js/encore.dev/pubsub/subscription.ts
new file mode 100644
index 0000000000..4519e58c70
--- /dev/null
+++ b/runtimes/js/encore.dev/pubsub/subscription.ts
@@ -0,0 +1,129 @@
+import { setCurrentRequest } from "../internal/reqtrack/mod";
+import { DurationString } from "../internal/types/mod";
+import { Topic } from "./topic";
+import * as runtime from "../internal/runtime/mod";
+
+export class Subscription<Msg extends object> {
+  private readonly topic: Topic<Msg>;
+  private readonly name: string;
+  private readonly impl: runtime.PubSubSubscription;
+
+  constructor(topic: Topic<Msg>, name: string, cfg: SubscriptionConfig<Msg>) {
+    this.topic = topic;
+    this.name = name;
+
+    const handler = (msg: runtime.Request) => {
+      setCurrentRequest(msg);
+      return cfg.handler(msg.payload() as Msg);
+    };
+
+    this.impl = runtime.RT.pubsubSubscription({
+      topicName: topic.name,
+      subscriptionName: name,
+      handler,
+    });
+
+    this.startSubscribing();
+  }
+
+  private startSubscribing() {
+    const that = this;
+    this.impl.subscribe().finally(() => {
+      setTimeout(() => that.startSubscribing(), 1000);
+    });
+  }
+}
+
+/**
+ * SubscriptionConfig is used when creating a subscription
+ *
+ * The values given here may be clamped to the supported values by
+ * the target cloud. (i.e. ack deadline may be brought within the supported range
+ * by the target cloud pubsub implementation).
+ */
+export interface SubscriptionConfig<Msg> {
+  /**
+   * Handler is the function which will be called to process a message
+   * sent on the topic.
+   *
+   * When this function returns an error the message will be
+   * negatively acknowledged (nacked), which will cause a redelivery
+   * attempt to be made (unless the retry policy's MaxRetries has been reached).
+   */
+  handler: (msg: Msg) => Promise<unknown>;
+
+  /**
+   * MaxConcurrency is the maximum number of messages which will be processed
+   * simultaneously per instance of the service for this subscription.
+   *
+   * Note that this is per instance of the service, so if your service has
+   * scaled to 10 instances and this is set to 10, then 100 messages could be
+   * processed simultaneously.
+   *
+   * If the value is negative, then there will be no limit on the number
+   * of messages processed simultaneously.
+   *
+   * Note: This is not supported by all cloud providers; specifically on GCP
+   * when using Cloud Run instances on an unordered topic the subscription will
+   * be configured as a Push Subscription and will have an adaptive concurrency
+   * See [GCP Push Delivery Rate](https://cloud.google.com/pubsub/docs/push#push_delivery_rate).
+   *
+   * This setting also has no effect on Encore Cloud environments.
+   * If not set, it uses a reasonable default based on the cloud provider.
+   */
+  maxConcurrency?: number;
+
+  /**
+   * AckDeadline is the time a consumer has to process a message
+   * before it's returned to the subscription
+   *
+   * Default is 30 seconds, however the ack deadline must be at least
+   * 1 second.
+   */
+  ackDeadline?: DurationString;
+
+  /**
+   * MessageRetention is how long an undelivered message is kept
+   * on the topic before it's purged.
+   *
+   * Default is 7 days.
+   */
+  messageRetention?: DurationString;
+
+  /**
+   * RetryPolicy defines how a message should be retried when
+   * the subscriber returns an error
+   */
+  retryPolicy?: RetryPolicy;
+}
+
+/**
+ * RetryPolicy defines how a subscription should handle retries
+ * after errors either delivering the message or processing the message.
+ *
+ * The values given to this structure are parsed at compile time, such that
+ * the correct Cloud resources can be provisioned to support the queue.
+ *
+ * As such the values given here may be clamped to the supported values by
+ * the target cloud. (i.e. min/max values brought within the supported range
+ * by the target cloud).
+ */
+export interface RetryPolicy {
+  /**
+   * The minimum time to wait between retries. Defaults to 10 seconds.
+   */
+  minBackoff?: DurationString;
+
+  /**
+   * The maximum time to wait between retries. Defaults to 10 minutes.
+   */
+  maxBackoff?: DurationString;
+
+  /**
+   * MaxRetries is used to control deadletter queuing logic, when:
+   *   n == 0: A default value of 100 retries will be used
+   *   n > 0:  Encore will forward a message to a dead letter queue after n retries
+   *   n == pubsub.InfiniteRetries: Messages will not be forwarded to the dead letter queue by the Encore framework
+   */
+  maxRetries?: number;
+}
diff --git a/runtimes/js/encore.dev/pubsub/topic.ts b/runtimes/js/encore.dev/pubsub/topic.ts
new file mode 100644
index 0000000000..f2f35a8066
--- /dev/null
+++ b/runtimes/js/encore.dev/pubsub/topic.ts
@@ -0,0 +1,123 @@
+import { getCurrentRequest } from "../internal/reqtrack/mod";
+import type { AttributesOf } from "./mod";
+import * as runtime from "../internal/runtime/mod";
+
+/**
+ * A topic is a resource to which you can publish messages
+ * to be delivered to subscribers of that topic.
+ */
+export class Topic<Msg extends object> {
+  public readonly name: string;
+  public readonly cfg: TopicConfig<Msg>;
+  private impl: runtime.PubSubTopic;
+
+  constructor(name: string, cfg: TopicConfig<Msg>) {
+    this.name = name;
+    this.cfg = cfg;
+    this.impl = runtime.RT.pubsubTopic(name);
+  }
+
+  public async publish(msg: Msg): Promise<string> {
+    const source = getCurrentRequest();
+    return this.impl.publish(msg, source);
+  }
+}
+
+/**
+ * DeliveryGuarantee is used to configure the delivery contract for a topic.
+ */
+export type DeliveryGuarantee = "at-least-once" | "exactly-once";
+
+/**
+ * At Least Once delivery guarantees that a message for a subscription is delivered to
+ * a consumer at least once.
+ *
+ * On AWS and GCP there is no limit to the throughput for a topic.
+ */
+export const atLeastOnce: DeliveryGuarantee = "at-least-once";
+
+/**
+ * ExactlyOnce guarantees that a message for a subscription is delivered to
+ * a consumer exactly once, to the best of the system's ability.
+ *
+ * However, there are edge cases when a message might be redelivered.
+ * For example, if a networking issue causes the acknowledgement of success
+ * processing the message to be lost before the cloud provider receives it.
+ *
+ * It is also important to note that the ExactlyOnce delivery guarantee only
+ * applies to the delivery of the message to the consumer, and not to the
+ * original publishing of the message, such that if a message is published twice,
+ * such as due to an retry within the application logic, it will be delivered twice.
+ * (i.e. ExactlyOnce delivery does not imply message deduplication on publish)
+ *
+ * As such it's recommended that the subscription handler function is idempotent
+ * and is able to handle duplicate messages.
+ *
+ * Subscriptions attached to ExactlyOnce topics have higher message delivery latency compared to AtLeastOnce.
+ *
+ * By using ExactlyOnce semantics on a topic, the throughput will be limited depending on the cloud provider:
+ * - AWS: 300 messages per second for the topic (see [AWS SQS Quotas]).
+ * - GCP: At least 3,000 messages per second across all topics in the region
+ *      (can be higher on the region see [GCP PubSub Quotas]).
+ *
+ * [AWS SQS Quotas]: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/quotas-messages.html
+ * [GCP PubSub Quotas]: https://cloud.google.com/pubsub/quotas#quotas
+ */
+export const exactlyOnce: DeliveryGuarantee = "exactly-once";
+
+/**
+ * TopicConfig is used when creating a Topic
+ */
+export interface TopicConfig<Msg extends object> {
+  /**
+   * DeliveryGuarantee is used to configure the delivery guarantee of a Topic
+   */
+  deliveryGuarantee: DeliveryGuarantee;
+
+  /**
+   * OrderingAttribute is the message attribute to use as a ordering key for
+   * messages and delivery will ensure that messages with the same value will
+   * be delivered in the order they where published.
+   *
+   * If OrderingAttribute is not set, messages can be delivered in any order.
+   *
+   * It is important to note, that in the case of an error being returned by a
+   * subscription handler, the message will be retried before any subsequent
+   * messages for that ordering key are delivered. This means depending on the
+   * retry configuration, a large backlog of messages for a given ordering key
+   * may build up. When using OrderingAttribute, it is recommended to use reason
+   * about your failure modes and set the retry configuration appropriately.
+   *
+   * Once the maximum number of retries has been reached, the message will be
+   * forwarded to the dead letter queue, and the next message for that ordering
+   * key will be delivered.
+   *
+   * To create attributes on a message, use the `Attribute` type:
+   *
+   *  type UserEvent = {
+   *    user_id: Attribute<string>;
+   *    action:  string;
+   *  }
+   *
+   *  const topic = new Topic<UserEvent>("user-events", {
+   *    deliveryGuarantee: DeliveryGuarantee.AtLeastOnce,
+   *    orderingAttribute: "user_id", // Messages with the same user-id will be delivered in the order they where
+   * published
+   *  })
+   *
+   *  topic.publish(ctx, {user_id: "1", action: "login"})  // This message will be delivered before the logout
+   *  topic.publish(ctx, {user_id: "2", action: "login"})  // This could be delivered at any time because it has a different user id
+   *  topic.publish(ctx, {user_id: "1", action: "logout"}) // This message will be delivered after the first message
+   *
+   * By using OrderingAttribute, the throughput will be limited depending on the cloud provider:
+   *
+   * - AWS: 300 messages per second for the topic (see [AWS SQS Quotas]).
+   * - GCP: 1MB/s for each ordering key (see [GCP PubSub Quotas]).
+   *
+   * Note: OrderingAttribute currently has no effect during local development.
+   *
+   * [AWS SQS Quotas]: https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/quotas-messages.html
+   * [GCP PubSub Quotas]: https://cloud.google.com/pubsub/quotas#resource_limits
+   */
+  orderingAttribute?: AttributesOf<Msg>;
+}
diff --git a/runtimes/js/encore.dev/req_meta.ts b/runtimes/js/encore.dev/req_meta.ts
new file mode 100644
index 0000000000..72f74be1e0
--- /dev/null
+++ b/runtimes/js/encore.dev/req_meta.ts
@@ -0,0 +1,203 @@
+import { getCurrentRequest } from "./internal/reqtrack/mod";
+
+/** Describes an API endpoint. */
+export interface APIDesc {
+  /** The name of the service that the endpoint belongs to. */
+  service: string;
+
+  /** The name of the endpoint itself. */
+  endpoint: string;
+
+  /** Whether the endpoint is a raw endpoint. */
+  raw: boolean;
+
+  /** Whether the endpoint requires auth. */
+  auth: boolean;
+
+  /** Tags specified on the endpoint. */
+  tags: string[];
+}
+
+export type Method =
+  | "GET"
+  | "POST"
+  | "PUT"
+  | "PATCH"
+  | "DELETE"
+  | "HEAD"
+  | "OPTIONS"
+  | "CONNECT"
+  | "TRACE";
+
+/** Describes an API call being processed. */
+export interface APICallMeta {
+  /** Specifies that the request is an API call. */
+  type: "api-call";
+
+  /** Describes the API Endpoint being called. */
+  api: APIDesc;
+
+  /** The HTTP method used in the API call. */
+  method: Method;
+
+  /**
+   * The request URL path used in the API call,
+   * excluding any query string parameters.
+   * For example "/path/to/endpoint".
+   */
+  path: string;
+
+  /**
+   * The request URL path used in the API call,
+   * including any query string parameters.
+   * For example "/path/to/endpoint?with=querystring".
+   */
+  pathAndQuery: string;
+
+  /**
+   * The parsed path parameters for the API endpoint.
+   * The keys are the names of the path parameters,
+   * from the API definition.
+   *
+   * For example {id: 5}.
+   */
+  pathParams: Record<string, any>;
+
+  /**
+   * The request headers from the HTTP request.
+   * The values are arrays if the header contains multiple values,
+   * either separated by ";" or when the header key appears more than once.
+   */
+  headers: Record<string, string | string[]>;
+
+  /**
+   * The parsed request payload, as expected by the application code.
+   * Not provided for raw endpoints or when the API endpoint expects no
+   * request data.
+   */
+  parsedPayload?: Record<string, any>;
+
+  /**
+   * Contains values set in middlewares via `MiddlewareRequest.data`.
+   */
+  middlewareData?: Record<string, any>;
+}
+
+/** Describes a Pub/Sub message being processed. */
+export interface PubSubMessageMeta {
+  /** Specifies that the request is a Pub/Sub message. */
+  type: "pubsub-message";
+
+  /** The service processing the message. */
+  service: string;
+
+  /** The name of the Pub/Sub topic. */
+  topic: string;
+
+  /** The name of the Pub/Sub subscription. */
+  subscription: string;
+
+  /**
+   * The unique id of the Pub/Sub message.
+   * It is the same id returned by `topic.publish()`.
+   * The message id stays the same across delivery attempts.
+   */
+  messageId: string;
+
+  /**
+   * The delivery attempt. The first attempt starts at 1,
+   * and increases by 1 for each retry.
+   */
+  deliveryAttempt: number;
+
+  /**
+   * The parsed request payload, as expected by the application code.
+   */
+  parsedPayload?: Record<string, any>;
+}
+
+/** Provides information about the active trace. */
+export interface TraceData {
+  /** The trace id. */
+  traceId: string;
+  /** The current span id. */
+  spanId: string;
+
+  /**
+   * The trace id that initiated this trace, if any.
+   */
+  parentTraceId?: string;
+
+  /**
+   * The span that initiated this span, if any.
+   */
+  parentSpanId?: string;
+
+  /**
+   * The external correlation id provided when the trace
+   * was created, if any.
+   * For example via the `Request-Id` or `X-Correlation-Id` headers.
+   */
+  extCorrelationId?: string;
+}
+
+interface BaseRequestMeta {
+  /** Information about the trace, if the request is being traced */
+  trace?: TraceData;
+}
+
+/** Describes an API call or Pub/Sub message being processed. */
+export type RequestMeta = (APICallMeta | PubSubMessageMeta) & BaseRequestMeta;
+
+/**
+ * Returns information about the running Encore request,
+ * such as API calls and Pub/Sub messages being processed.
+ *
+ * Returns undefined only if no request is being processed,
+ * such as during system initialization.
+ */
+export function currentRequest(): RequestMeta | undefined {
+  const req = getCurrentRequest();
+  if (!req) {
+    return undefined;
+  }
+  const meta = req.meta();
+
+  const base: BaseRequestMeta = {
+    trace: meta.trace
+  };
+
+  if (meta.apiCall) {
+    const api: APICallMeta = {
+      type: "api-call",
+      api: {
+        service: meta.apiCall.api.service,
+        endpoint: meta.apiCall.api.endpoint,
+        raw: meta.apiCall.api.raw,
+        auth: meta.apiCall.api.requiresAuth,
+        tags: meta.apiCall.api.tags
+      },
+      method: meta.apiCall.method as Method,
+      path: meta.apiCall.path,
+      pathAndQuery: meta.apiCall.pathAndQuery,
+      pathParams: meta.apiCall.pathParams ?? {},
+      parsedPayload: meta.apiCall.parsedPayload,
+      headers: meta.apiCall.headers,
+      middlewareData: (req as any).middlewareData
+    };
+    return { ...base, ...api };
+  } else if (meta.pubsubMessage) {
+    const msg: PubSubMessageMeta = {
+      type: "pubsub-message",
+      service: meta.pubsubMessage.service,
+      topic: meta.pubsubMessage.topic,
+      subscription: meta.pubsubMessage.subscription,
+      messageId: meta.pubsubMessage.id,
+      deliveryAttempt: meta.pubsubMessage.deliveryAttempt,
+      parsedPayload: meta.pubsubMessage.parsedPayload
+    };
+    return { ...base, ...msg };
+  } else {
+    return undefined;
+  }
+}
diff --git a/runtimes/js/encore.dev/service/mod.ts b/runtimes/js/encore.dev/service/mod.ts
new file mode 100644
index 0000000000..ebdf2291be
--- /dev/null
+++ b/runtimes/js/encore.dev/service/mod.ts
@@ -0,0 +1,24 @@
+import { Middleware } from "../api/mod";
+
+/**
+ * Defines an Encore backend service.
+ *
+ * Use this class to define a new backend service with the given name.
+ * The scope of the service is its containing directory, and all subdirectories.
+ *
+ * It must be called from files named `encore.service.ts`, to enable Encore to
+ * efficiently identify possible service definitions.
+ */
+export class Service {
+  public readonly name: string;
+  public readonly cfg: ServiceConfig;
+
+  constructor(name: string, cfg?: ServiceConfig) {
+    this.name = name;
+    this.cfg = cfg ?? {};
+  }
+}
+
+export interface ServiceConfig {
+  middlewares?: Middleware[];
+}
diff --git a/runtimes/js/encore.dev/storage/objects/bucket.ts b/runtimes/js/encore.dev/storage/objects/bucket.ts
new file mode 100644
index 0000000000..e5c2da063d
--- /dev/null
+++ b/runtimes/js/encore.dev/storage/objects/bucket.ts
@@ -0,0 +1,245 @@
+import { getCurrentRequest } from "../../internal/reqtrack/mod";
+import * as runtime from "../../internal/runtime/mod";
+import { StringLiteral } from "../../internal/utils/constraints";
+import { unwrapErr } from "./error";
+import { BucketPerms, Uploader, SignedUploader, Downloader, SignedDownloader, Attrser, Lister, Remover, PublicUrler } from "./refs";
+
+export interface BucketConfig {
+  /**
+   * Whether the objects in the bucket should be publicly
+   * accessible, via CDN. Defaults to false if unset.
+  */
+  public?: boolean;
+
+  /**
+   * Whether to enable versioning of the objects in the bucket.
+   * Defaults to false if unset.
+   */
+  versioned?: boolean;
+}
+
+/**
+ * Defines a new Object Storage bucket infrastructure resource.
+ */
+export class Bucket extends BucketPerms implements Uploader, SignedUploader, Downloader, SignedDownloader, Attrser, Lister, Remover, PublicUrler {
+  impl: runtime.Bucket;
+
+  /**
+   * Creates a new bucket with the given name and configuration
+   */
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars
+  constructor(name: string, cfg?: BucketConfig) {
+    super();
+    this.impl = runtime.RT.bucket(name);
+  }
+
+  /**
+   * Reference an existing bucket by name.
+   * To create a new storage bucket, use `new StorageBucket(...)` instead.
+   */
+  static named<name extends string>(name: StringLiteral<name>): Bucket {
+    return new Bucket(name, {});
+  }
+
+  async *list(options: ListOptions): AsyncGenerator<ListEntry> {
+    const source = getCurrentRequest();
+    const iter = unwrapErr(await this.impl.list(options, source));
+    while (true) {
+      const entry = await iter.next();
+      if (entry === null) {
+        iter.markDone();
+        break;
+      }
+      yield entry;
+    }
+  }
+
+  /**
+   * Returns whether the object exists in the bucket.
+   * Throws an error on network failure.
+   */
+  async exists(name: string, options?: ExistsOptions): Promise<boolean> {
+    const source = getCurrentRequest();
+    const impl = this.impl.object(name);
+    const res = await impl.exists(options, source);
+    return unwrapErr(res);
+  }
+
+  /**
+   * Returns the object's attributes.
+   * Throws an error if the object does not exist.
+   */
+  async attrs(name: string, options?: AttrsOptions): Promise<ObjectAttrs> {
+    const source = getCurrentRequest();
+    const impl = this.impl.object(name);
+    const res = await impl.attrs(options, source);
+    return unwrapErr(res);
+  }
+
+  /**
+   * Uploads an object to the bucket.
+   */
+  async upload(name: string, data: Buffer, options?: UploadOptions): Promise<ObjectAttrs> {
+    const source = getCurrentRequest();
+    const impl = this.impl.object(name);
+    const res = await impl.upload(data, options, source);
+    return unwrapErr(res);
+  }
+
+  /**
+   * Generate an external URL to allow uploading an object to the bucket.
+   * 
+   * Anyone with possession of the URL can write to the given object name
+   * without any additional auth.
+   */
+  async signedUploadUrl(name: string, options?: UploadUrlOptions): Promise<SignedUploadUrl> {
+    const source = getCurrentRequest();
+    const impl = this.impl.object(name);
+    const res = await impl.signedUploadUrl(options, source);
+    return unwrapErr(res);
+  }
+
+  /**
+   * Generate an external URL to allow downloading an object from the bucket.
+   *
+   * Anyone with possession of the URL can download the given object without
+   * any additional auth.
+   */
+  async signedDownloadUrl(name: string, options?: DownloadUrlOptions): Promise<SignedDownloadUrl> {
+    const source = getCurrentRequest();
+    const impl = this.impl.object(name);
+    const res = await impl.signedDownloadUrl(options, source);
+    return unwrapErr(res);
+  }
+
+  /**
+   * Downloads an object from the bucket and returns its contents.
+   */
+  async download(name: string, options?: DownloadOptions): Promise<Buffer> {
+    const source = getCurrentRequest();
+    const impl = this.impl.object(name);
+    const res = await impl.downloadAll(options, source);
+    return unwrapErr(res);
+  }
+
+  /**
+   * Removes an object from the bucket.
+   * Throws an error on network failure.
+   */
+  async remove(name: string, options?: DeleteOptions): Promise<void> {
+    const source = getCurrentRequest();
+    const impl = this.impl.object(name);
+    const err = await impl.delete(options, source);
+    if (err) {
+      unwrapErr(err);
+    }
+  }
+
+  /**
+  * Returns the public URL for accessing the object with the given name.
+  * Throws an error if the bucket is not public.
+  */
+  publicUrl(name: string): string {
+    const obj = this.impl.object(name);
+    return obj.publicUrl();
+  }
+
+  ref<P extends BucketPerms>(): P {
+    return this as unknown as P
+  }
+}
+
+export interface ListOptions {
+  /**
+   * Only include objects with this prefix in the listing.
+   * If unset, all objects are included.
+  */
+  prefix?: string;
+
+  /** Maximum number of objects to return. Defaults to no limit. */
+  limit?: number;
+}
+
+export interface AttrsOptions {
+  /**
+   * The object version to retrieve attributes for.
+   * Defaults to the lastest version if unset.
+   *
+   * If bucket versioning is not enabled, this option is ignored.
+   */
+  version?: string;
+}
+
+export interface ExistsOptions {
+  /**
+   * The object version to check for existence.
+   * Defaults to the lastest version if unset.
+   *
+   * If bucket versioning is not enabled, this option is ignored.
+   */
+  version?: string;
+}
+
+export interface DeleteOptions {
+  /**
+   * The object version to delete.
+   * Defaults to the lastest version if unset.
+   *
+   * If bucket versioning is not enabled, this option is ignored.
+   */
+  version?: string;
+}
+
+export interface DownloadOptions {
+  /**
+   * The object version to download.
+   * Defaults to the lastest version if unset.
+   *
+   * If bucket versioning is not enabled, this option is ignored.
+   */
+  version?: string;
+}
+
+export interface ObjectAttrs {
+  name: string;
+  size: number;
+  /** The version of the object, if bucket versioning is enabled. */
+  version?: string;
+  etag: string;
+  contentType?: string;
+}
+
+export interface ListEntry {
+  name: string;
+  size: number;
+  etag: string;
+}
+
+export interface UploadOptions {
+  contentType?: string;
+  preconditions?: {
+    notExists?: boolean;
+  }
+}
+
+export interface UploadUrlOptions {
+  /** The expiration time of the url, in seconds from signing. The maximum
+   * value is seven days. If no value is given, a default of one hour is
+   * used. */
+  ttl?: number;
+}
+
+export interface SignedUploadUrl {
+  url: string;
+}
+
+export interface DownloadUrlOptions {
+  /** The expiration time of the url, in seconds from signing. The maximum
+   * value is seven days. If no value is given, a default of one hour is
+   * used. */
+  ttl?: number;
+}
+
+export interface SignedDownloadUrl {
+  url: string;
+}
diff --git a/runtimes/js/encore.dev/storage/objects/error.ts b/runtimes/js/encore.dev/storage/objects/error.ts
new file mode 100644
index 0000000000..d8e3896d10
--- /dev/null
+++ b/runtimes/js/encore.dev/storage/objects/error.ts
@@ -0,0 +1,94 @@
+import * as runtime from "../../internal/runtime/mod";
+
+export class ObjectsError extends Error {
+  constructor(msg: string) {
+    // extending errors causes issues after you construct them, unless you apply the following fixes
+    super(msg);
+
+    // set error name as constructor name, make it not enumerable to keep native Error behavior
+    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+    Object.defineProperty(this, "name", {
+      value: "ObjectsError",
+      enumerable: false,
+      configurable: true
+    });
+
+    // Fix the prototype chain, capture stack trace.
+    Object.setPrototypeOf(this, ObjectsError.prototype);
+    Error.captureStackTrace(this, this.constructor);
+  }
+}
+
+export class ObjectNotFound extends ObjectsError {
+  constructor(msg: string) {
+    // extending errors causes issues after you construct them, unless you apply the following fixes
+    super(msg);
+
+    // set error name as constructor name, make it not enumerable to keep native Error behavior
+    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+    Object.defineProperty(this, "name", {
+      value: "ObjectNotFound",
+      enumerable: false,
+      configurable: true
+    });
+
+    // Fix the prototype chain, capture stack trace.
+    Object.setPrototypeOf(this, ObjectNotFound.prototype);
+    Error.captureStackTrace(this, this.constructor);
+  }
+}
+
+export class PreconditionFailed extends ObjectsError {
+  constructor(msg: string) {
+    // extending errors causes issues after you construct them, unless you apply the following fixes
+    super(msg);
+
+    // set error name as constructor name, make it not enumerable to keep native Error behavior
+    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+    Object.defineProperty(this, "name", {
+      value: "PrecondionFailed",
+      enumerable: false,
+      configurable: true
+    });
+
+    // Fix the prototype chain, capture stack trace.
+    Object.setPrototypeOf(this, PreconditionFailed.prototype);
+    Error.captureStackTrace(this, this.constructor);
+  }
+}
+
+export class InvalidArgument extends ObjectsError {
+  constructor(msg: string) {
+    // extending errors causes issues after you construct them, unless you apply the following fixes
+    super(msg);
+
+    // set error name as constructor name, make it not enumerable to keep native Error behavior
+    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target#new.target_in_constructors
+    Object.defineProperty(this, "name", {
+      value: "InvalidArgument",
+      enumerable: false,
+      configurable: true
+    });
+
+    // Fix the prototype chain, capture stack trace.
+    Object.setPrototypeOf(this, InvalidArgument.prototype);
+    Error.captureStackTrace(this, this.constructor);
+  }
+}
+
+export function unwrapErr<T>(val: T | runtime.TypedObjectError): T {
+  if (val instanceof runtime.TypedObjectError) {
+    switch (val.kind) {
+      case runtime.ObjectErrorKind.NotFound:
+        throw new ObjectNotFound(val.message);
+      case runtime.ObjectErrorKind.PreconditionFailed:
+        throw new PreconditionFailed(val.message);
+      case runtime.ObjectErrorKind.InvalidArgument:
+        throw new InvalidArgument(val.message);
+      default:
+        throw new ObjectsError(val.message);
+    }
+  }
+
+  return val;
+}
diff --git a/runtimes/js/encore.dev/storage/objects/mod.ts b/runtimes/js/encore.dev/storage/objects/mod.ts
new file mode 100644
index 0000000000..d09e58c4ae
--- /dev/null
+++ b/runtimes/js/encore.dev/storage/objects/mod.ts
@@ -0,0 +1,15 @@
+export { Bucket } from "./bucket";
+export type { BucketConfig, ObjectAttrs, UploadOptions } from "./bucket";
+export { ObjectsError, ObjectNotFound, PreconditionFailed } from "./error";
+export type {
+  BucketPerms,
+  Uploader,
+  SignedUploader,
+  Downloader,
+  SignedDownloader,
+  Attrser,
+  Lister,
+  ReadWriter,
+  PublicUrler,
+  Remover
+} from "./refs";
diff --git a/runtimes/js/encore.dev/storage/objects/refs.ts b/runtimes/js/encore.dev/storage/objects/refs.ts
new file mode 100644
index 0000000000..08db740e37
--- /dev/null
+++ b/runtimes/js/encore.dev/storage/objects/refs.ts
@@ -0,0 +1,48 @@
+import type { AttrsOptions, DeleteOptions, DownloadOptions, DownloadUrlOptions, ExistsOptions, ListEntry,
+  ListOptions, ObjectAttrs, SignedDownloadUrl, SignedUploadUrl, UploadOptions, UploadUrlOptions} from "./bucket";
+
+export abstract class BucketPerms {
+  private bucketPerms(): void { };
+}
+
+export abstract class Uploader extends BucketPerms {
+  abstract upload(name: string, data: Buffer, options?: UploadOptions): Promise<ObjectAttrs>;
+}
+
+export abstract class SignedUploader extends BucketPerms {
+  abstract signedUploadUrl(name: string, options?: UploadUrlOptions): Promise<SignedUploadUrl>;
+}
+
+export abstract class Downloader extends BucketPerms {
+  abstract download(name: string, options?: DownloadOptions): Promise<Buffer>;
+}
+
+export abstract class SignedDownloader extends BucketPerms {
+  abstract signedDownloadUrl(name: string, options?: DownloadUrlOptions): Promise<SignedDownloadUrl>;
+}
+
+export abstract class Attrser extends BucketPerms {
+  abstract attrs(name: string, options?: AttrsOptions): Promise<ObjectAttrs>;
+  abstract exists(name: string, options?: ExistsOptions): Promise<boolean>;
+}
+
+export abstract class Lister extends BucketPerms {
+  abstract list(options: ListOptions): AsyncGenerator<ListEntry>;
+}
+
+export abstract class Remover extends BucketPerms {
+  abstract remove(name: string, options?: DeleteOptions): Promise<void>;
+}
+
+export abstract class PublicUrler extends BucketPerms {
+  abstract publicUrl(name: string): string;
+}
+
+export type ReadWriter =
+  & Uploader
+  & SignedUploader
+  & Downloader
+  & SignedDownloader
+  & Attrser
+  & Lister
+  & Remover;
diff --git a/runtimes/js/encore.dev/storage/sqldb/database.ts b/runtimes/js/encore.dev/storage/sqldb/database.ts
new file mode 100644
index 0000000000..0402873e38
--- /dev/null
+++ b/runtimes/js/encore.dev/storage/sqldb/database.ts
@@ -0,0 +1,381 @@
+import { getCurrentRequest } from "../../internal/reqtrack/mod";
+import * as runtime from "../../internal/runtime/mod";
+import { StringLiteral } from "../../internal/utils/constraints";
+
+export interface SQLMigrationsConfig {
+  path: string;
+  source?: "prisma" | "drizzle";
+}
+export interface SQLDatabaseConfig {
+  migrations?: string | SQLMigrationsConfig;
+}
+
+const driverName = "node-pg";
+
+/**
+ * Represents a single row from a query result
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export type Row = Record<string, any>;
+
+/** Represents a type that can be used in query template literals */
+export type Primitive =
+  | string
+  | string[]
+  | number
+  | number[]
+  | boolean
+  | boolean[]
+  | Buffer
+  | Date
+  | Date[]
+  | Record<string, any>
+  | Record<string, any>[]
+  | BigInt
+  | BigInt[]
+  | null
+  | undefined;
+
+type SQLQueryExecutor =
+  | runtime.SQLConn
+  | runtime.SQLDatabase
+  | runtime.Transaction;
+
+/** Base class containing shared query functionality */
+class BaseQueryExecutor {
+  constructor(protected readonly impl: SQLQueryExecutor) {}
+
+  /**
+   * query queries the database using a template string, replacing your placeholders in the template
+   * with parametrised values without risking SQL injections.
+   *
+   * It returns an async generator, that allows iterating over the results
+   * in a streaming fashion using `for await`.
+   *
+   * @example
+   *
+   * const email = "foo@example.com";
+   * const result = database.query`SELECT id FROM users WHERE email=${email}`
+   *
+   * This produces the query: "SELECT id FROM users WHERE email=$1".
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  async *query<T extends Row = Record<string, any>>(
+    strings: TemplateStringsArray,
+    ...params: Primitive[]
+  ): AsyncGenerator<T> {
+    const query = buildQuery(strings, params);
+    const args = buildQueryArgs(params);
+    const source = getCurrentRequest();
+    const cursor = await this.impl.query(query, args, source);
+    while (true) {
+      const row = await cursor.next();
+      if (row === null) break;
+      yield row.values() as T;
+    }
+  }
+
+  /**
+   * rawQuery queries the database using a raw parametrised SQL query and parameters.
+   *
+   * It returns an async generator, that allows iterating over the results
+   * in a streaming fashion using `for await`.
+   *
+   * @example
+   * const query = "SELECT id FROM users WHERE email=$1";
+   * const email = "foo@example.com";
+   * for await (const row of database.rawQuery(query, email)) {
+   *   console.log(row);
+   * }
+   *
+   * @param query - The raw SQL query string.
+   * @param params - The parameters to be used in the query.
+   * @returns An async generator that yields rows from the query result.
+   */
+  async *rawQuery<T extends Row = Record<string, any>>(
+    query: string,
+    ...params: Primitive[]
+  ): AsyncGenerator<T> {
+    const args = buildQueryArgs(params);
+    const source = getCurrentRequest();
+    const result = await this.impl.query(query, args, source);
+    while (true) {
+      const row = await result.next();
+      if (row === null) break;
+      yield row.values() as T;
+    }
+  }
+
+  /**
+   * queryAll queries the database using a template string, replacing your placeholders in the template
+   * with parametrised values without risking SQL injections.
+   *
+   * It returns an array of all results.
+   *
+   * @example
+   *
+   * const email = "foo@example.com";
+   * const result = database.queryAll`SELECT id FROM users WHERE email=${email}`
+   *
+   * This produces the query: "SELECT id FROM users WHERE email=$1".
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  async queryAll<T extends Row = Record<string, any>>(
+    strings: TemplateStringsArray,
+    ...params: Primitive[]
+  ): Promise<T[]> {
+    const query = buildQuery(strings, params);
+    const args = buildQueryArgs(params);
+    const source = getCurrentRequest();
+    const cursor = await this.impl.query(query, args, source);
+    const result: T[] = [];
+    while (true) {
+      const row = await cursor.next();
+      if (row === null) break;
+      result.push(row.values() as T);
+    }
+    return result;
+  }
+
+  /**
+   * rawQueryAll queries the database using a raw parametrised SQL query and parameters.
+   *
+   * It returns an array of all results.
+   *
+   * @example
+   *
+   * const query = "SELECT id FROM users WHERE email=$1";
+   * const email = "foo@example.com";
+   * const rows = await database.rawQueryAll(query, email);
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  async rawQueryAll<T extends Row = Record<string, any>>(
+    query: string,
+    ...params: Primitive[]
+  ): Promise<T[]> {
+    const args = buildQueryArgs(params);
+    const source = getCurrentRequest();
+    const cursor = await this.impl.query(query, args, source);
+    const result: T[] = [];
+    while (true) {
+      const row = await cursor.next();
+      if (row === null) break;
+      result.push(row.values() as T);
+    }
+    return result;
+  }
+
+  /**
+   * queryRow is like query but returns only a single row.
+   * If the query selects no rows it returns null.
+   * Otherwise it returns the first row and discards the rest.
+   *
+   * @example
+   * const email = "foo@example.com";
+   * const result = database.queryRow`SELECT id FROM users WHERE email=${email}`
+   */
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  async queryRow<T extends Row = Record<string, any>>(
+    strings: TemplateStringsArray,
+    ...params: Primitive[]
+  ): Promise<T | null> {
+    const query = buildQuery(strings, params);
+    const args = buildQueryArgs(params);
+    const source = getCurrentRequest();
+    const result = await this.impl.query(query, args, source);
+    const row = await result.next();
+    return row ? (row.values() as T) : null;
+  }
+
+  /**
+   * rawQueryRow is like rawQuery but returns only a single row.
+   * If the query selects no rows, it returns null.
+   * Otherwise, it returns the first row and discards the rest.
+   *
+   * @example
+   * const query = "SELECT id FROM users WHERE email=$1";
+   * const email = "foo@example.com";
+   * const result = await database.rawQueryRow(query, email);
+   * console.log(result);
+   *
+   * @param query - The raw SQL query string.
+   * @param params - The parameters to be used in the query.
+   * @returns A promise that resolves to a single row or null.
+   */
+  async rawQueryRow<T extends Row = Record<string, any>>(
+    query: string,
+    ...params: Primitive[]
+  ): Promise<T | null> {
+    const args = buildQueryArgs(params);
+    const source = getCurrentRequest();
+    const result = await this.impl.query(query, args, source);
+    const row = await result.next();
+    return row ? (row.values() as T) : null;
+  }
+
+  /**
+   * exec executes a query without returning any rows.
+   *
+   * @example
+   * const email = "foo@example.com";
+   * const result = database.exec`DELETE FROM users WHERE email=${email}`
+   */
+  async exec(
+    strings: TemplateStringsArray,
+    ...params: Primitive[]
+  ): Promise<void> {
+    const query = buildQuery(strings, params);
+    const args = buildQueryArgs(params);
+    const source = getCurrentRequest();
+
+    // Need to await the cursor to process any errors from things like
+    // unique constraint violations.
+    const cur = await this.impl.query(query, args, source);
+    await cur.next();
+  }
+
+  /**
+   * rawExec executes a query without returning any rows.
+   *
+   * @example
+   * const query = "DELETE FROM users WHERE email=$1";
+   * const email = "foo@example.com";
+   * await database.rawExec(query, email);
+   *
+   * @param query - The raw SQL query string.
+   * @param params - The parameters to be used in the query.
+   * @returns A promise that resolves when the query has been executed.
+   */
+  async rawExec(query: string, ...params: Primitive[]): Promise<void> {
+    const args = buildQueryArgs(params);
+    const source = getCurrentRequest();
+
+    // Need to await the cursor to process any errors from things like
+    // unique constraint violations.
+    const cur = await this.impl.query(query, args, source);
+    await cur.next();
+  }
+}
+
+/**
+ * Constructing a new database object will result in Encore provisioning a database with
+ * that name and returning this object to represent it.
+ *
+ * If you want to reference an existing database, use `Database.Named(name)` as it is a
+ * compile error to create duplicate databases.
+ */
+export class SQLDatabase extends BaseQueryExecutor {
+  declare protected readonly impl: runtime.SQLDatabase;
+
+  constructor(name: string, cfg?: SQLDatabaseConfig) {
+    super(runtime.RT.sqlDatabase(name));
+  }
+
+  /**
+   * Reference an existing database by name, if the database doesn't
+   * exist yet, use `new Database(name)` instead.
+   */
+  static named<name extends string>(name: StringLiteral<name>): SQLDatabase {
+    return new SQLDatabase(name);
+  }
+
+  /**
+   * Returns the connection string for the database
+   */
+  get connectionString(): string {
+    return this.impl.connString();
+  }
+
+  /**
+   * Acquires a database connection from the database pool.
+   *
+   * When the connection is closed or is garbage-collected, it is returned to the pool.
+   * @returns a new connection to the database
+   */
+  async acquire(): Promise<Connection> {
+    const impl = await this.impl.acquire();
+    return new Connection(impl);
+  }
+
+  /**
+   * Begins a database transaction.
+   *
+   * Make sure to always call `rollback` or `commit` to prevent hanging transactions.
+   * @returns a transaction object that implements AsycDisposable
+   */
+  async begin(): Promise<Transaction> {
+    const source = getCurrentRequest();
+    const impl = await this.impl.begin(source);
+    return new Transaction(impl);
+  }
+}
+
+export class Transaction extends BaseQueryExecutor implements AsyncDisposable {
+  declare protected readonly impl: runtime.Transaction;
+  private done: boolean = false;
+
+  constructor(impl: runtime.Transaction) {
+    super(impl);
+  }
+
+  /**
+   * Commit the transaction.
+   */
+  async commit() {
+    this.done = true;
+    const source = getCurrentRequest();
+    await this.impl.commit(source);
+  }
+
+  /**
+   * Rollback the transaction.
+   */
+  async rollback() {
+    this.done = true;
+    const source = getCurrentRequest();
+    await this.impl.rollback(source);
+  }
+
+  async [Symbol.asyncDispose]() {
+    if (!this.done) {
+      await this.rollback();
+    }
+  }
+}
+
+/**
+ * Represents a dedicated connection to a database.
+ */
+export class Connection extends BaseQueryExecutor {
+  declare protected readonly impl: runtime.SQLConn;
+
+  constructor(impl: runtime.SQLConn) {
+    super(impl);
+  }
+
+  /**
+   * Returns the connection to the database pool.
+   */
+  async close() {
+    await this.impl.close();
+  }
+}
+
+function buildQuery(strings: TemplateStringsArray, expr: Primitive[]): string {
+  let query = "";
+  for (let i = 0; i < strings.length; i++) {
+    query += strings[i];
+
+    if (i < expr.length) {
+      query += "$" + (i + 1);
+    }
+  }
+
+  // return queryWithComment(query, driverName);
+  return query;
+}
+
+function buildQueryArgs(params: Primitive[]): runtime.QueryArgs {
+  // Convert undefined to null.
+  return new runtime.QueryArgs(params.map((p) => p ?? null));
+}
diff --git a/runtimes/js/encore.dev/storage/sqldb/mod.ts b/runtimes/js/encore.dev/storage/sqldb/mod.ts
new file mode 100644
index 0000000000..f0ef7b19ac
--- /dev/null
+++ b/runtimes/js/encore.dev/storage/sqldb/mod.ts
@@ -0,0 +1,2 @@
+export { SQLDatabase } from "./database";
+export type { SQLDatabaseConfig, Row as ResultRow } from "./database";
diff --git a/runtimes/js/encore.dev/tsconfig.json b/runtimes/js/encore.dev/tsconfig.json
new file mode 100644
index 0000000000..435fcd1f93
--- /dev/null
+++ b/runtimes/js/encore.dev/tsconfig.json
@@ -0,0 +1,34 @@
+{
+  "$schema": "https://json.schemastore.org/tsconfig",
+  "include": ["**/*.ts", "**/*.cts"],
+  "exclude": ["dist/**", "**/*.test.ts"],
+  "compilerOptions": {
+    /* Basic Options */
+    "lib": ["ES2022"],
+    "target": "ES2022",
+    "module": "ES2022",
+
+    "outDir": "./dist",
+    "rootDir": ".",
+
+    /* Workspace Settings */
+    "composite": true,
+
+    /* Strict Type-Checking Options */
+    "strict": true,
+
+    /* Module Resolution Options */
+    "moduleResolution": "bundler",
+    "allowSyntheticDefaultImports": true,
+    "isolatedModules": true, // This is required to ensure we don't write code which results in runtime issues if transpiled file by file
+    "sourceMap": true,
+
+    "declaration": true,
+
+    /* Advanced Options */
+    "forceConsistentCasingInFileNames": true,
+    "skipLibCheck": true,
+
+    "types": ["node"]
+  }
+}
diff --git a/runtimes/js/encore.dev/types/mod.ts b/runtimes/js/encore.dev/types/mod.ts
new file mode 100644
index 0000000000..ac6bf293a4
--- /dev/null
+++ b/runtimes/js/encore.dev/types/mod.ts
@@ -0,0 +1,67 @@
+import * as runtime from "../internal/runtime/mod";
+
+export type ToDecimal = string | number | bigint;
+
+/**
+ * A decimal type that can hold values with arbitrary precision.
+ * Unlike JavaScript's native number type, this can accurately represent
+ * decimal values without floating-point precision errors.
+ */
+export class Decimal {
+  private impl: runtime.Decimal;
+
+  constructor(value: ToDecimal) {
+    this.impl = new runtime.Decimal(String(value));
+  }
+
+  private static fromImpl(impl: runtime.Decimal): Decimal {
+    const d = Object.create(Decimal.prototype);
+    d.impl = impl;
+    return d;
+  }
+
+  private toImpl(value: Decimal | ToDecimal): runtime.Decimal {
+    return value instanceof Decimal
+      ? value.impl
+      : new runtime.Decimal(String(value));
+  }
+
+  add(d: Decimal | ToDecimal): Decimal {
+    return Decimal.fromImpl(this.impl.add(this.toImpl(d)));
+  }
+
+  sub(d: Decimal | ToDecimal): Decimal {
+    return Decimal.fromImpl(this.impl.sub(this.toImpl(d)));
+  }
+
+  mul(d: Decimal | ToDecimal): Decimal {
+    return Decimal.fromImpl(this.impl.mul(this.toImpl(d)));
+  }
+
+  div(d: Decimal | ToDecimal): Decimal {
+    return Decimal.fromImpl(this.impl.div(this.toImpl(d)));
+  }
+
+  get value(): string {
+    return this.impl.toString();
+  }
+
+  toJSON(): string {
+    return this.impl.toString();
+  }
+  toString(): string {
+    return this.impl.toString();
+  }
+
+  [Symbol.toPrimitive](hint: string) {
+    if (hint === "number") {
+      return +this.value;
+    }
+
+    return this.value;
+  }
+
+  private get __encore_decimal(): boolean {
+    return true;
+  }
+}
diff --git a/runtimes/js/encore.dev/validate/mod.ts b/runtimes/js/encore.dev/validate/mod.ts
new file mode 100644
index 0000000000..0477b4b536
--- /dev/null
+++ b/runtimes/js/encore.dev/validate/mod.ts
@@ -0,0 +1,55 @@
+declare const __validate: unique symbol;
+
+export type Min<N extends number> = {
+  [__validate]?: {
+    minValue: N;
+  };
+};
+
+export type Max<N extends number> = {
+  [__validate]?: {
+    maxValue: N;
+  };
+};
+
+export type MinLen<N extends number> = {
+  [__validate]?: {
+    minLen: N;
+  };
+};
+
+export type MaxLen<N extends number> = {
+  [__validate]?: {
+    maxLen: N;
+  };
+};
+
+export type MatchesRegexp<S extends string> = {
+  [__validate]?: {
+    matchesRegexp: S;
+  };
+};
+
+export type StartsWith<S extends string> = {
+  [__validate]?: {
+    startsWith: S;
+  };
+};
+
+export type EndsWith<S extends string> = {
+  [__validate]?: {
+    endsWith: S;
+  };
+};
+
+export type IsEmail = {
+  [__validate]?: {
+    isEmail: true;
+  };
+};
+
+export type IsURL = {
+  [__validate]?: {
+    isURL: true;
+  };
+};
diff --git a/runtimes/js/src/api.rs b/runtimes/js/src/api.rs
new file mode 100644
index 0000000000..af290a1a8e
--- /dev/null
+++ b/runtimes/js/src/api.rs
@@ -0,0 +1,243 @@
+use crate::error::coerce_to_api_error;
+use crate::headers::parse_header_map;
+use crate::napi_util::{await_promise, PromiseHandler};
+use crate::pvalue::{
+    encode_auth_payload, encode_request_payload, parse_pvalues, pvalues_or_null,
+    transform_pvalues_response,
+};
+use crate::request_meta::RequestMeta;
+use crate::threadsafe_function::{
+    ThreadSafeCallContext, ThreadsafeFunction, ThreadsafeFunctionCallMode,
+};
+use crate::{raw_api, request_meta, websocket_api};
+use encore_runtime_core::api::{self, schema, HandlerResponse, HandlerResponseInner};
+use encore_runtime_core::model::RequestData;
+use napi::{Env, JsFunction, JsObject, JsUnknown, NapiRaw};
+use napi_derive::napi;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+#[napi(object)]
+pub struct APIRoute {
+    pub service: String,
+    pub name: String,
+    pub raw: bool,
+    pub streaming_request: bool,
+    pub streaming_response: bool,
+    pub handler: JsFunction,
+}
+
+pub fn new_api_handler(
+    env: Env,
+    func: JsFunction,
+    raw: bool,
+    streaming: bool,
+    resp_schema: Option<Arc<schema::Response>>,
+) -> napi::Result<Arc<dyn api::BoxedHandler>> {
+    if streaming {
+        return websocket_api::new_handler(env, func);
+    }
+    if raw {
+        return raw_api::new_handler(env, func);
+    }
+    let handler = ThreadsafeFunction::create(
+        env.raw(),
+        // SAFETY: `handler` is a valid JS function.
+        unsafe { func.raw() },
+        0,
+        typed_resolve_on_js_thread,
+    )?;
+    Ok(Arc::new(JSTypedHandler {
+        handler,
+        resp_schema,
+    }))
+}
+
+#[napi]
+pub struct Request {
+    pub(crate) inner: Arc<encore_runtime_core::model::Request>,
+}
+
+#[napi]
+impl Request {
+    pub fn new(inner: Arc<encore_runtime_core::model::Request>) -> Self {
+        Self { inner }
+    }
+
+    #[napi]
+    pub fn payload(&self, env: Env) -> napi::Result<JsUnknown> {
+        match &self.inner.data {
+            RequestData::RPC(data) => encode_request_payload(env, data.parsed_payload.as_ref()),
+            RequestData::Auth(data) => encode_auth_payload(env, &data.parsed_payload),
+            RequestData::PubSub(data) => pvalues_or_null(env, data.parsed_payload.as_ref()),
+            RequestData::Stream(data) => encode_request_payload(env, data.parsed_payload.as_ref()),
+        }
+    }
+
+    #[napi]
+    pub fn meta(&self) -> napi::Result<RequestMeta> {
+        request_meta::meta(&self.inner).map_err(napi::Error::from)
+    }
+
+    #[napi]
+    pub fn get_auth_data(&self, env: Env) -> napi::Result<JsUnknown> {
+        use RequestData::*;
+        match &self.inner.data {
+            RPC(data) => pvalues_or_null(env, data.auth_data.as_ref()),
+            Stream(data) => pvalues_or_null(env, data.auth_data.as_ref()),
+            Auth(_) | PubSub(_) => env.get_null().map(|val| val.into_unknown()),
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct APIPromiseHandler {
+    pub resp_schema: Option<Arc<schema::Response>>,
+}
+
+impl PromiseHandler for APIPromiseHandler {
+    type Output = HandlerResponse;
+
+    fn resolve(&self, env: Env, val: Option<napi::JsUnknown>) -> Self::Output {
+        let Some(val) = val else {
+            return Ok(HandlerResponseInner {
+                payload: None,
+                extra_headers: None,
+                status: None,
+            });
+        };
+
+        let obj: JsObject = val
+            .try_into()
+            .map_err(|e| api::Error::invalid_argument("invalid handler response", e))?;
+
+        let payload = obj
+            .get_named_property::<napi::JsUnknown>("payload")
+            .map_err(api::Error::internal)?;
+
+        let extra_headers = obj
+            .get_named_property::<napi::JsUnknown>("extraHeaders")
+            .map_err(api::Error::internal)?;
+
+        let status = obj
+            .get_named_property::<napi::JsUnknown>("status")
+            .map_err(api::Error::internal)?;
+
+        let status = if status
+            .get_type()
+            .is_ok_and(|t| matches!(t, napi::ValueType::Number))
+        {
+            Some(
+                status
+                    .coerce_to_number()
+                    .map_err(api::Error::internal)
+                    .and_then(|s| s.get_uint32().map_err(api::Error::internal))
+                    .and_then(|s| {
+                        u16::try_from(s).map_err(|e| {
+                            api::Error::invalid_argument("invalid http status code", e)
+                        })
+                    })?,
+            )
+        } else {
+            None
+        };
+
+        match parse_pvalues(payload) {
+            Ok(val) => {
+                let val = match &self.resp_schema {
+                    Some(schema) => val
+                        .map(|v| transform_pvalues_response(v, schema.clone()))
+                        .transpose()
+                        .map_err(|e| api::Error::invalid_argument("couldn't parse response", e))?,
+                    None => val,
+                };
+                Ok(HandlerResponseInner {
+                    payload: val,
+                    status,
+                    extra_headers: parse_header_map(extra_headers).map_err(|e| {
+                        api::Error::invalid_argument("unable to parse extraHeaders", e)
+                    })?,
+                })
+            }
+            Err(err) => self.error(env, err),
+        }
+    }
+
+    fn reject(&self, env: Env, val: napi::JsUnknown) -> Self::Output {
+        Err(coerce_to_api_error(env, val)?)
+    }
+
+    fn error(&self, _: Env, err: napi::Error) -> Self::Output {
+        Err(api::Error {
+            code: api::ErrCode::Internal,
+            message: api::ErrCode::Internal.default_public_message().into(),
+            internal_message: Some(err.to_string()),
+            stack: None,
+            details: None,
+        })
+    }
+}
+
+struct TypedRequestMessage {
+    req: Request,
+    resp_schema: Option<Arc<schema::Response>>,
+    tx: tokio::sync::mpsc::UnboundedSender<HandlerResponse>,
+}
+
+pub struct JSTypedHandler {
+    handler: ThreadsafeFunction<TypedRequestMessage>,
+    resp_schema: Option<Arc<schema::Response>>,
+}
+
+impl api::BoxedHandler for JSTypedHandler {
+    fn call(
+        self: Arc<Self>,
+        req: api::HandlerRequest,
+    ) -> Pin<Box<dyn Future<Output = api::ResponseData> + Send + 'static>> {
+        Box::pin(async move {
+            // Create a one-shot channel
+            let (tx, mut rx) = tokio::sync::mpsc::unbounded_channel();
+
+            // Call the handler.
+            let req = Request::new(req);
+            self.handler.call(
+                TypedRequestMessage {
+                    tx,
+                    req,
+                    resp_schema: self.resp_schema.clone(),
+                },
+                ThreadsafeFunctionCallMode::Blocking,
+            );
+
+            // Wait for a response.
+            let resp = match rx.recv().await {
+                Some(Ok(resp)) => Ok(resp),
+                Some(Err(err)) => Err(err),
+                None => Err(api::Error::internal(anyhow::anyhow!(
+                    "handler did not respond",
+                ))),
+            };
+
+            api::ResponseData::Typed(resp)
+        })
+    }
+}
+
+fn typed_resolve_on_js_thread(ctx: ThreadSafeCallContext<TypedRequestMessage>) -> napi::Result<()> {
+    let req = ctx.value.req.into_instance(ctx.env)?;
+    let handler = APIPromiseHandler {
+        resp_schema: ctx.value.resp_schema,
+    };
+    match ctx.callback.unwrap().call(None, &[req]) {
+        Ok(result) => {
+            await_promise(ctx.env, result, ctx.value.tx.clone(), handler);
+            Ok(())
+        }
+        Err(err) => {
+            let res = handler.error(ctx.env, err);
+            _ = ctx.value.tx.send(res);
+            Ok(())
+        }
+    }
+}
diff --git a/runtimes/js/src/cookies.rs b/runtimes/js/src/cookies.rs
new file mode 100644
index 0000000000..c460dacec5
--- /dev/null
+++ b/runtimes/js/src/cookies.rs
@@ -0,0 +1,123 @@
+use crate::pvalue::PVal;
+
+use encore_runtime_core::api::{self, Cookie, DateTime, PValue, PValues};
+use napi::{bindgen_prelude::*, JsObject, Result};
+
+// Helper struct to parse a PValue::Object from javascript into a PValue::Cookie
+pub(crate) struct JsCookie;
+
+impl JsCookie {
+    fn get_bool(vals: &PValues, key: &str) -> Result<Option<bool>> {
+        match vals.get(key) {
+            None => Ok(None),
+            Some(PValue::Bool(b)) => Ok(Some(*b)),
+            Some(_) => Err(Error::new(
+                Status::InvalidArg,
+                format!("cookie field {key} must be a boolean"),
+            )),
+        }
+    }
+    fn get_string(vals: &PValues, key: &str) -> Result<Option<String>> {
+        match vals.get(key) {
+            None => Ok(None),
+            Some(PValue::String(s)) => Ok(Some(s.clone())),
+            Some(_) => Err(Error::new(
+                Status::InvalidArg,
+                format!("cookie field {key} must be a string"),
+            )),
+        }
+    }
+    fn get_datetime(vals: &PValues, key: &str) -> Result<Option<DateTime>> {
+        match vals.get(key) {
+            None => Ok(None),
+            Some(PValue::DateTime(d)) => Ok(Some(*d)),
+            Some(_) => Err(Error::new(
+                Status::InvalidArg,
+                format!("cookie field {key} must be a datetime"),
+            )),
+        }
+    }
+    fn get_max_age(vals: &PValues, key: &str) -> Result<Option<u64>> {
+        match vals.get(key) {
+            None => Ok(None),
+            Some(PValue::Number(n)) => {
+                if n.is_i64() {
+                    let n = n.as_i64().unwrap();
+                    if n < 0 {
+                        Ok(Some(0u64))
+                    } else {
+                        Ok(Some(n as u64))
+                    }
+                } else if n.is_u64() {
+                    Ok(Some(n.as_u64().unwrap()))
+                } else {
+                    Err(Error::new(
+                        Status::InvalidArg,
+                        "cookie field {} must be an integer",
+                    ))
+                }
+            }
+            Some(_) => Err(Error::new(
+                Status::InvalidArg,
+                format!("cookie field {key} must be an integer"),
+            )),
+        }
+    }
+
+    pub fn parse_cookie(obj: &PValues, name: &str, value: &PValue) -> Result<Cookie> {
+        Ok(Cookie {
+            name: name.to_string(),
+            value: Box::new(value.clone()),
+            path: Self::get_string(obj, "path")?,
+            domain: Self::get_string(obj, "domain")?,
+            secure: Self::get_bool(obj, "secure")?,
+            http_only: Self::get_bool(obj, "httpOnly")?,
+            expires: Self::get_datetime(obj, "expires")?,
+            max_age: Self::get_max_age(obj, "maxAge")?,
+            same_site: Self::get_string(obj, "sameSite")?
+                .map(|s| match s.as_str() {
+                    "Lax" => Ok(api::SameSite::Lax),
+                    "Strict" => Ok(api::SameSite::Strict),
+                    "None" => Ok(api::SameSite::None),
+                    _ => Err(Error::new(
+                        Status::InvalidArg,
+                        "cookie field sameSite must be one of Lax, Strict or None",
+                    )),
+                })
+                .transpose()?,
+            partitioned: Self::get_bool(obj, "partitioned")?,
+        })
+    }
+}
+
+pub(crate) unsafe fn cookie_to_napi_value(
+    env: sys::napi_env,
+    c: api::Cookie,
+) -> Result<sys::napi_value> {
+    let env2 = Env::from_raw(env);
+    let mut cookie = env2.create_object()?;
+
+    cookie.set("name", &c.name)?;
+    cookie.set("value", PVal(*c.value))?;
+
+    if let Some(secure) = c.secure {
+        cookie.set("secure", secure)?;
+    }
+    if let Some(http_only) = c.http_only {
+        cookie.set("httpOnly", http_only)?;
+    }
+
+    if let Some(domain) = &c.domain {
+        cookie.set("domain", domain)?;
+    }
+    if let Some(path) = &c.path {
+        cookie.set("path", path)?;
+    }
+    if let Some(expires) = c.expires {
+        cookie.set("expires", PVal(PValue::DateTime(expires)))?;
+    }
+    if let Some(same_site) = c.same_site {
+        cookie.set("sameSite", same_site.to_string())?;
+    }
+    JsObject::to_napi_value(env, cookie)
+}
diff --git a/runtimes/js/src/error.rs b/runtimes/js/src/error.rs
new file mode 100644
index 0000000000..2010410269
--- /dev/null
+++ b/runtimes/js/src/error.rs
@@ -0,0 +1,92 @@
+use crate::{log::parse_js_stack, pvalue::parse_pvalues};
+use encore_runtime_core::api;
+use napi::{Env, JsUnknown};
+
+pub fn coerce_to_api_error(env: Env, val: napi::JsUnknown) -> Result<api::Error, api::Error> {
+    let obj = val.coerce_to_object().map_err(|_| api::Error {
+        code: api::ErrCode::Internal,
+        message: api::ErrCode::Internal.default_public_message().into(),
+        internal_message: Some("an unknown exception was thrown".into()),
+        details: None,
+        stack: None,
+    })?;
+
+    // Get the details field.
+    let details = obj
+        .get_named_property::<napi::JsUnknown>("details")
+        .and_then(parse_pvalues)
+        .map(|val| val.map(Box::new))
+        .map_err(|e| api::Error {
+            code: api::ErrCode::Internal,
+            message: api::ErrCode::Internal.default_public_message().into(),
+            internal_message: Some(format!("unable to parse error details: {e}")),
+            details: None,
+            stack: None,
+        })?;
+
+    // Get the message field.
+    let mut message: String = obj
+        .get_named_property::<JsUnknown>("message")
+        .and_then(|val| val.coerce_to_string())
+        .and_then(|val| env.from_js_value(val))
+        .map_err(|e| api::Error {
+            code: api::ErrCode::Internal,
+            message: api::ErrCode::Internal.default_public_message().into(),
+            internal_message: Some(format!("unable to parse error message: {e}")),
+            details: None,
+            stack: None,
+        })?;
+
+    // Get the error code field.
+    let code: api::ErrCode = obj
+        .get_named_property::<JsUnknown>("code")
+        .and_then(|val| val.coerce_to_string())
+        .and_then(|val| env.from_js_value::<String, _>(val))
+        .map(|val| {
+            val.parse::<api::ErrCode>()
+                .unwrap_or(api::ErrCode::Internal)
+        })
+        .unwrap_or(api::ErrCode::Internal);
+
+    // Get the cause field
+    let cause: Option<String> = obj
+        .get_named_property::<JsUnknown>("cause")
+        .ok()
+        .and_then(|val| {
+            let val_type = val.get_type().ok()?;
+            if val_type == napi::ValueType::Null || val_type == napi::ValueType::Undefined {
+                None
+            } else {
+                val.coerce_to_object()
+                    .and_then(|val| val.get_named_property::<JsUnknown>("message"))
+                    .and_then(|val| val.coerce_to_string())
+                    .and_then(|val| env.from_js_value(val))
+                    .ok()
+            }
+        });
+
+    if let Some(cause) = cause {
+        message.push_str(": ");
+        message.push_str(&cause);
+    }
+
+    // Get the JS stack
+    let stack = obj
+        .get_named_property::<JsUnknown>("stack")
+        .and_then(|val| parse_js_stack(&env, val))
+        .ok();
+
+    let mut internal_message = None;
+    if code == api::ErrCode::Internal {
+        internal_message = Some(message);
+        message = api::ErrCode::Internal.default_public_message().into();
+    }
+
+    Ok(api::Error {
+        code,
+        message,
+        stack,
+        internal_message,
+        details,
+    })
+}
diff --git a/runtimes/js/src/gateway.rs b/runtimes/js/src/gateway.rs
new file mode 100644
index 0000000000..c743987768
--- /dev/null
+++ b/runtimes/js/src/gateway.rs
@@ -0,0 +1,149 @@
+use crate::api::Request;
+use crate::error::coerce_to_api_error;
+use crate::napi_util::{await_promise, PromiseHandler};
+use crate::pvalue::parse_pvalues;
+use crate::threadsafe_function::{
+    ThreadSafeCallContext, ThreadsafeFunction, ThreadsafeFunctionCallMode,
+};
+use encore_runtime_core::api::HandlerResponse;
+use encore_runtime_core::api::{self, HandlerResponseInner};
+use napi::{Env, JsFunction, NapiRaw};
+use napi_derive::napi;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+#[napi]
+pub struct Gateway {
+    #[allow(dead_code)]
+    gateway: Option<api::gateway::Gateway>,
+}
+
+impl Gateway {
+    pub fn new(
+        env: Env,
+        gateway: Option<api::gateway::Gateway>,
+        cfg: GatewayConfig,
+    ) -> napi::Result<Self> {
+        if let Some(gw) = &gateway {
+            if let Some(auth) = gw.auth_handler() {
+                if let Some(handler) = cfg.auth {
+                    let handler: Arc<dyn api::TypedHandler> = to_auth_handler(env, handler)?;
+
+                    auth.set_local_handler_impl(Some(handler));
+                }
+            }
+        }
+
+        Ok(Self { gateway })
+    }
+}
+
+#[napi(object)]
+pub struct GatewayConfig {
+    pub auth: Option<JsFunction>,
+}
+
+fn to_auth_handler(env: Env, handler: JsFunction) -> napi::Result<Arc<JSAuthHandler>> {
+    let tsfn = ThreadsafeFunction::create(
+        env.raw(),
+        // SAFETY: `handler` is a valid JS function.
+        unsafe { handler.raw() },
+        0,
+        resolve_on_js_thread,
+    )?;
+
+    Ok(Arc::new(JSAuthHandler { handler: tsfn }))
+}
+
+pub struct JSAuthHandler {
+    handler: ThreadsafeFunction<AuthMessage>,
+}
+
+impl api::TypedHandler for JSAuthHandler {
+    fn call(
+        self: Arc<Self>,
+        req: api::HandlerRequest,
+    ) -> Pin<Box<dyn Future<Output = api::HandlerResponse> + Send + 'static>> {
+        Box::pin(async move {
+            // Create a one-shot channel
+            let (tx, mut rx) = tokio::sync::mpsc::unbounded_channel();
+
+            // Call the handler.
+            let req = Request::new(req);
+            self.handler.call(
+                AuthMessage { tx, req },
+                ThreadsafeFunctionCallMode::Blocking,
+            );
+
+            // Wait for a response.
+            match rx.recv().await {
+                Some(Ok(resp)) => Ok(resp),
+                Some(Err(err)) => Err(err),
+                None => Err(api::Error::internal(anyhow::anyhow!(
+                    "handler did not respond",
+                ))),
+            }
+        })
+    }
+}
+
+struct AuthMessage {
+    req: Request,
+    tx: tokio::sync::mpsc::UnboundedSender<HandlerResponse>,
+}
+
+fn resolve_on_js_thread(ctx: ThreadSafeCallContext<AuthMessage>) -> napi::Result<()> {
+    let req = ctx.value.req.into_instance(ctx.env)?;
+    let handler = AuthPromiseHandler;
+    match ctx.callback.unwrap().call(None, &[req]) {
+        Ok(result) => {
+            await_promise(ctx.env, result, ctx.value.tx.clone(), handler);
+            Ok(())
+        }
+        Err(err) => {
+            let res = handler.error(ctx.env, err);
+            _ = ctx.value.tx.send(res);
+            Ok(())
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+struct AuthPromiseHandler;
+
+impl PromiseHandler for AuthPromiseHandler {
+    type Output = HandlerResponse;
+
+    fn resolve(&self, env: Env, val: Option<napi::JsUnknown>) -> Self::Output {
+        let Some(val) = val else {
+            return Ok(HandlerResponseInner {
+                payload: None,
+                extra_headers: None,
+                status: None,
+            });
+        };
+        match parse_pvalues(val) {
+            Ok(val) => Ok(HandlerResponseInner {
+                payload: val,
+                extra_headers: None,
+                status: None,
+            }),
+            Err(err) => self.error(env, err),
+        }
+    }
+
+    fn reject(&self, env: Env, val: napi::JsUnknown) -> Self::Output {
+        Err(coerce_to_api_error(env, val)?)
+    }
+
+    fn error(&self, _: Env, err: napi::Error) -> Self::Output {
+        Err(api::Error {
+            code: api::ErrCode::Internal,
+            message: api::ErrCode::Internal.default_public_message().into(),
+            internal_message: Some(err.to_string()),
+            stack: None,
+            details: None,
+        })
+    }
+}
diff --git a/runtimes/js/src/headers.rs b/runtimes/js/src/headers.rs
new file mode 100644
index 0000000000..a128d68948
--- /dev/null
+++ b/runtimes/js/src/headers.rs
@@ -0,0 +1,106 @@
+use axum::http::{HeaderMap, HeaderName, HeaderValue};
+use napi::{
+    bindgen_prelude::{assert_type_of, check_status, type_of, FromNapiValue},
+    sys, Error, JsObject, JsUnknown, Result, ValueType,
+};
+
+pub fn parse_header_map(val: JsUnknown) -> Result<Option<HeaderMap>> {
+    if val
+        .get_type()
+        .is_ok_and(|t| matches!(t, napi::ValueType::Undefined | napi::ValueType::Null))
+    {
+        return Ok(None);
+    }
+
+    let val = WrappedHeaderMap::from_unknown(val)?;
+    Ok(Some(val.0))
+}
+
+pub struct WrappedHeaderMap(pub HeaderMap);
+
+impl FromNapiValue for WrappedHeaderMap {
+    unsafe fn from_napi_value(env: sys::napi_env, napi_val: sys::napi_value) -> Result<Self> {
+        assert_type_of!(env, napi_val, ValueType::Object)?;
+        let obj = JsObject::from_napi_value(env, napi_val)?;
+
+        let mut map = WrappedHeaderMap(HeaderMap::new());
+        for key in JsObject::keys(&obj)?.into_iter() {
+            if let Some(vals) = obj_get_header_val(env, napi_val, &key)? {
+                let hname = HeaderName::from_bytes(key.as_bytes()).map_err(|e| {
+                    Error::new(
+                        napi::Status::InvalidArg,
+                        format!("invalid header name: {e}"),
+                    )
+                })?;
+
+                for val in vals {
+                    let hval = HeaderValue::from_bytes(val.as_bytes()).map_err(|e| {
+                        Error::new(
+                            napi::Status::InvalidArg,
+                            format!("invalid header value: {e}"),
+                        )
+                    })?;
+
+                    map.0.append(&hname, hval);
+                }
+            }
+        }
+
+        Ok(map)
+    }
+}
+
+fn obj_get_header_val<K: AsRef<str>>(
+    env: sys::napi_env,
+    obj: sys::napi_value,
+    field: K,
+) -> Result<Option<Vec<String>>> {
+    let c_field = std::ffi::CString::new(field.as_ref())?;
+
+    unsafe {
+        let mut ret = std::ptr::null_mut();
+
+        check_status!(
+            sys::napi_get_named_property(env, obj, c_field.as_ptr(), &mut ret),
+            "Failed to get property with field `{}`",
+            field.as_ref()
+        )?;
+
+        let ty = type_of!(env, ret)?;
+
+        match ty {
+            ValueType::Undefined => Ok(None),
+            ValueType::String => {
+                let val = String::from_napi_value(env, ret)?;
+                Ok(Some(vec![val]))
+            }
+            ValueType::Object => {
+                let mut is_arr = false;
+                check_status!(
+                    sys::napi_is_array(env, ret, &mut is_arr),
+                    "Failed to detect whether given js is an array"
+                )?;
+
+                if is_arr {
+                    let vals = Vec::<String>::from_napi_value(env, ret).map_err(|_e| {
+                        Error::new(
+                            napi::Status::InvalidArg,
+                            "unable to parse header values array as strings",
+                        )
+                    })?;
+
+                    Ok(Some(vals))
+                } else {
+                    Err(Error::new(
+                        napi::Status::InvalidArg,
+                        "invalid header value type",
+                    ))
+                }
+            }
+            _ => Err(Error::new(
+                napi::Status::InvalidArg,
+                "header map value must be string or array of strings",
+            )),
+        }
+    }
+}
diff --git a/runtimes/js/src/lib.rs b/runtimes/js/src/lib.rs
new file mode 100644
index 0000000000..9147dce0bf
--- /dev/null
+++ b/runtimes/js/src/lib.rs
@@ -0,0 +1,21 @@
+#![deny(clippy::all)]
+
+pub mod api;
+mod cookies;
+mod error;
+mod gateway;
+mod headers;
+mod log;
+mod meta;
+mod napi_util;
+pub mod objects;
+pub mod pubsub;
+mod pvalue;
+mod raw_api;
+mod request_meta;
+pub mod runtime;
+mod secret;
+mod sqldb;
+mod stream;
+mod threadsafe_function;
+mod websocket_api;
diff --git a/runtimes/js/src/log.rs b/runtimes/js/src/log.rs
new file mode 100644
index 0000000000..50737bede1
--- /dev/null
+++ b/runtimes/js/src/log.rs
@@ -0,0 +1,263 @@
+use crate::api::Request;
+use encore_runtime_core::error::{AppError, StackFrame, StackTrace};
+use encore_runtime_core::log::Fields;
+use encore_runtime_core::log::LogFromExternalRuntime;
+use napi::{Env, Error};
+use napi_derive::napi;
+use std::collections::HashMap;
+
+/// A logger that can be used to log messages from the runtime.
+#[napi]
+pub struct Logger {
+    pub(crate) logger: encore_runtime_core::log::Logger,
+}
+
+#[napi]
+pub enum LogLevel {
+    Trace = 1,
+    Debug,
+    Info,
+    Warn,
+    Error,
+}
+
+impl From<LogLevel> for log::LevelFilter {
+    fn from(value: LogLevel) -> Self {
+        match value {
+            LogLevel::Trace => log::LevelFilter::Trace,
+            LogLevel::Debug => log::LevelFilter::Debug,
+            LogLevel::Info => log::LevelFilter::Info,
+            LogLevel::Warn => log::LevelFilter::Warn,
+            LogLevel::Error => log::LevelFilter::Error,
+        }
+    }
+}
+
+impl From<LogLevel> for log::Level {
+    fn from(value: LogLevel) -> Self {
+        match value {
+            LogLevel::Trace => log::Level::Trace,
+            LogLevel::Debug => log::Level::Debug,
+            LogLevel::Info => log::Level::Info,
+            LogLevel::Warn => log::Level::Warn,
+            LogLevel::Error => log::Level::Error,
+        }
+    }
+}
+
+impl Default for Logger {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[napi]
+impl Logger {
+    pub fn new() -> Self {
+        Self {
+            logger: encore_runtime_core::log::root().clone(),
+        }
+    }
+
+    /// log a message from the application
+    #[napi]
+    #[allow(clippy::too_many_arguments)]
+    pub fn log(
+        &self,
+        env: Env,
+        request: Option<&Request>,
+        level: LogLevel,
+        msg: String,
+        #[napi(ts_arg_type = "Error")] error: Option<napi::JsObject>,
+        #[napi(ts_arg_type = "string")] caller: Option<String>,
+        #[napi(ts_arg_type = "Record<string, unknown>")] fields: Option<
+            HashMap<String, napi::JsUnknown>,
+        >,
+    ) {
+        let error = convert_error(env, error).unwrap_or_else(|err| {
+            ::log::error!("couldn't convert error to api error: {err}");
+            None
+        });
+
+        let res = self
+            .logger
+            .log(
+                request.map(|r| r.inner.as_ref()),
+                level.into(),
+                msg,
+                error,
+                caller,
+                convert_fields(env, fields),
+            )
+            .map_err(Error::from);
+
+        if let Err(err) = res {
+            ::log::error!("logging failed: {err}");
+        }
+    }
+
+    /// Returns a new logger with the specified level
+    #[napi]
+    pub fn with_level(&self, level: LogLevel) -> Self {
+        Self {
+            logger: self.logger.with_level(level.into()),
+        }
+    }
+
+    /// Returns a new logger with the given fields added to the context
+    /// that the logger will use when emitting logs as extra fields
+    #[napi]
+    pub fn with(
+        &self,
+        env: Env,
+        #[napi(ts_arg_type = "Record<string, unknown>")] fields: HashMap<String, napi::JsUnknown>,
+    ) -> napi::Result<Self> {
+        let fields = convert_fields(env, Some(fields)).unwrap();
+
+        Ok(Self {
+            logger: self.logger.with(fields),
+        })
+    }
+}
+
+fn convert_error(env: Env, input: Option<napi::JsObject>) -> napi::Result<Option<AppError>> {
+    match input {
+        None => Ok(None),
+        Some(input) => {
+            let message: napi::JsUnknown = input.get_named_property("message")?;
+            let message = message.coerce_to_string()?;
+            let message: String = env.from_js_value(message)?;
+
+            // try to convert the JS stack trace
+            let stack: napi::Result<napi::JsUnknown> = input.get_named_property("stack");
+            let stack = stack
+                .map(|unknown| parse_js_stack(&env, unknown).unwrap_or_default())
+                .unwrap_or_default();
+
+            Ok(Some(AppError {
+                message,
+                stack,
+                cause: None,
+            }))
+        }
+    }
+}
+
+pub fn parse_js_stack(env: &Env, value: napi::JsUnknown) -> napi::Result<StackTrace> {
+    let value = value.coerce_to_string()?;
+    let value: String = env.from_js_value(value)?;
+    parse_stack(value)
+}
+
+pub fn parse_stack(s: String) -> napi::Result<StackTrace> {
+    Ok(s.lines()
+        .filter_map(extract_frame)
+        .filter(|frame| !is_common_frame(frame))
+        .collect::<Vec<StackFrame>>())
+}
+
+/// is_common_frame returns true if the frame is a common frame that should be ignored.
+/// as it is outside the users code base (such as it comes from the node runtime).
+fn is_common_frame(frame: &StackFrame) -> bool {
+    // "node:" is a node internal frame
+    // "bun:" is a bun internal frame
+    // "deno:" is a deno internal frame
+    // "" is a frame with no file, so a core JS function
+    frame.file.starts_with("node:")
+        || frame.file.starts_with("bun:")
+        || frame.file.starts_with("deno:")
+        || frame.file.contains("node_modules/encore.dev/")
+        || frame.file.is_empty()
+}
+
+/// Attempts to extract a stack frame from a line of text.
+///
+/// All frames in javascript engines are in one of the formats of (after whitespaces):
+/// - "at <function> (<file>:<line>:<column>)"
+/// - "at <file>:<line>:<column>"
+fn extract_frame(line: &str) -> Option<StackFrame> {
+    let line = line.trim_start().trim_end();
+    if !line.starts_with("at ") {
+        return None;
+    }
+    let line = line[2..].trim_start();
+
+    let (function, file, line, column) = if line.ends_with(')') {
+        match line.rsplit_once('(') {
+            Some((function, rest)) => {
+                let (file, line, column) = match extract_file_line_col(rest.strip_suffix(')')?) {
+                    Some((file, line, column)) => (file, line, column),
+                    None => return None,
+                };
+
+                (Some(function.trim()), file, line, column)
+            }
+            None => return None,
+        }
+    } else {
+        extract_file_line_col(line).map(|(file, line, column)| (None, file, line, column))?
+    };
+
+    // Format the file path to be relative to the current working directory
+    let file = match std::env::current_dir() {
+        Ok(cwd) => {
+            let prefix = format!("{}/", cwd.to_string_lossy());
+            file.strip_prefix(prefix.as_str()).unwrap_or(file.as_str())
+        }
+        Err(_) => file.as_str(),
+    };
+
+    Some(StackFrame {
+        file: file.to_string(),
+        line,
+        column,
+        module: None,
+        function: function.map(|s| s.to_string()),
+    })
+}
+
+fn extract_file_line_col(string: &str) -> Option<(String, u32, Option<u32>)> {
+    let string = string.strip_prefix("file://").unwrap_or(string);
+    let (file, rest) = string.split_once(':')?;
+
+    match rest.split_once(':') {
+        Some((line, column)) => Some((
+            file.trim().to_string(),
+            line.parse::<u32>().ok()?,
+            Some(column.parse::<u32>().ok()?),
+        )),
+        None => Some((file.trim().to_string(), rest.parse::<u32>().ok()?, None)),
+    }
+}
+
+/// converts a hash map of unknown JS values to a BTree of serde_json::Value's
+fn convert_fields(env: Env, input: Option<HashMap<String, napi::JsUnknown>>) -> Option<Fields> {
+    match input {
+        None => None,
+        Some(input) if input.is_empty() => None,
+        Some(input) => {
+            let mut fields = Fields::new();
+
+            for (key, value) in input {
+                let val: napi::Result<serde_json::Value> = env.from_js_value(&value);
+                match val {
+                    Ok(val) => {
+                        fields.insert(key, val);
+                    }
+                    Err(_) => {
+                        // if value is not deserializable (e.g Function), print its type
+                        let value_type = serde_json::Value::from(
+                            value
+                                .get_type()
+                                .unwrap_or(napi::ValueType::Unknown)
+                                .to_string(),
+                        );
+                        fields.insert(key, value_type);
+                    }
+                };
+            }
+
+            Some(fields)
+        }
+    }
+}
diff --git a/runtimes/js/src/meta.rs b/runtimes/js/src/meta.rs
new file mode 100644
index 0000000000..e7376ed0de
--- /dev/null
+++ b/runtimes/js/src/meta.rs
@@ -0,0 +1,137 @@
+use std::collections::HashMap;
+
+use encore_runtime_core::meta;
+use napi_derive::napi;
+
+#[napi(object)]
+#[derive(Debug, Clone)]
+pub struct AppMeta {
+    pub app_id: String,
+    pub api_base_url: String,
+    pub environment: EnvironmentMeta,
+    pub build: BuildMeta,
+    pub deploy: DeployMeta,
+}
+
+impl From<meta::AppMeta> for AppMeta {
+    fn from(rt: meta::AppMeta) -> Self {
+        AppMeta {
+            app_id: rt.app_id,
+            api_base_url: rt.api_base_url,
+            environment: rt.environment.into(),
+            build: rt.build.into(),
+            deploy: rt.deploy.into(),
+        }
+    }
+}
+
+#[napi(object)]
+#[derive(Debug, Clone)]
+pub struct EnvironmentMeta {
+    pub name: String,
+    pub r#type: EnvironmentType,
+    pub cloud: CloudProvider,
+}
+
+impl From<meta::EnvironmentMeta> for EnvironmentMeta {
+    fn from(rt: meta::EnvironmentMeta) -> Self {
+        EnvironmentMeta {
+            name: rt.name,
+            r#type: rt.r#type.into(),
+            cloud: rt.cloud.into(),
+        }
+    }
+}
+
+#[napi]
+#[derive(Debug)]
+pub enum EnvironmentType {
+    Production,
+    Development,
+    Ephemeral,
+    Test,
+}
+
+impl From<meta::EnvironmentType> for EnvironmentType {
+    fn from(rt: meta::EnvironmentType) -> Self {
+        match rt {
+            meta::EnvironmentType::Production => Self::Production,
+            meta::EnvironmentType::Development => Self::Development,
+            meta::EnvironmentType::Ephemeral => Self::Ephemeral,
+            meta::EnvironmentType::Test => Self::Test,
+        }
+    }
+}
+
+#[napi]
+#[derive(Debug)]
+#[allow(clippy::upper_case_acronyms)]
+pub enum CloudProvider {
+    AWS,
+    GCP,
+    Azure,
+    Encore,
+    Local,
+}
+
+impl From<meta::CloudProvider> for CloudProvider {
+    fn from(rt: meta::CloudProvider) -> Self {
+        match rt {
+            meta::CloudProvider::AWS => Self::AWS,
+            meta::CloudProvider::GCP => Self::GCP,
+            meta::CloudProvider::Azure => Self::Azure,
+            meta::CloudProvider::Encore => Self::Encore,
+            meta::CloudProvider::Local => Self::Local,
+        }
+    }
+}
+
+#[napi(object)]
+#[derive(Debug, Clone)]
+pub struct BuildMeta {
+    pub revision: String,
+    pub uncommitted_changes: bool,
+}
+
+impl From<meta::BuildMeta> for BuildMeta {
+    fn from(rt: meta::BuildMeta) -> Self {
+        BuildMeta {
+            revision: rt.revision,
+            uncommitted_changes: rt.uncommitted_changes,
+        }
+    }
+}
+
+#[napi(object)]
+#[derive(Debug, Clone)]
+pub struct HostedService {
+    pub name: String,
+}
+
+#[napi(object)]
+#[derive(Debug, Clone)]
+pub struct DeployMeta {
+    pub id: String,
+    pub deploy_time: String,
+    pub hosted_services: HashMap<String, HostedService>,
+}
+
+impl From<meta::DeployMeta> for DeployMeta {
+    fn from(rt: meta::DeployMeta) -> Self {
+        DeployMeta {
+            id: rt.id,
+            deploy_time: rt.deploy_time.to_string(),
+            hosted_services: rt
+                .hosted_services
+                .into_iter()
+                .map(|svc| (svc.name.clone(), svc.into()))
+                .collect(),
+        }
+    }
+}
+
+impl From<meta::HostedService> for HostedService {
+    fn from(rt: meta::HostedService) -> Self {
+        HostedService { name: rt.name }
+    }
+}
diff --git a/runtimes/js/src/napi_util.rs b/runtimes/js/src/napi_util.rs
new file mode 100644
index 0000000000..3ae9561ca4
--- /dev/null
+++ b/runtimes/js/src/napi_util.rs
@@ -0,0 +1,141 @@
+use napi::{Either, Env, JsFunction, JsObject, JsUnknown};
+use std::sync::RwLock;
+
+pub trait PromiseHandler: Clone + Send + Sync + 'static {
+    type Output: Send + 'static;
+
+    fn resolve(&self, env: Env, val: Option<napi::JsUnknown>) -> Self::Output;
+    fn reject(&self, env: Env, val: napi::JsUnknown) -> Self::Output;
+    fn error(&self, env: Env, err: napi::Error) -> Self::Output;
+}
+
+pub fn await_promise<T, H>(
+    env: Env,
+    result: JsUnknown,
+    tx: tokio::sync::mpsc::UnboundedSender<T>,
+    handler: H,
+) where
+    H: PromiseHandler<Output = T>,
+    T: Send + 'static,
+{
+    // An inner function to enable using ? for error handling.
+    let outer_handler = handler.clone();
+    let outer_tx = tx.clone();
+    let inner = move || -> napi::Result<()> {
+        // If the result is a promise, wait for it to resolve, and send the result to the channel.
+        // Otherwise, send the result immediately.
+        if result.is_promise()? {
+            let result: JsObject = result.try_into()?;
+            let then: JsFunction = result.get_named_property("then")?;
+
+            let cb = {
+                let handler = handler.clone();
+                let tx = tx.clone();
+                env.create_function_from_closure("callback", move |ctx| {
+                    let res = match ctx.try_get::<JsUnknown>(0) {
+                        Ok(Either::A(success)) => handler.resolve(env, Some(success)),
+                        Ok(Either::B(_)) => handler.resolve(env, None),
+                        Err(err) => handler.error(env, err),
+                    };
+
+                    _ = tx.send(res);
+                    ctx.env.get_undefined()
+                })?
+            };
+
+            let eb = {
+                let handler = handler.clone();
+                env.create_function_from_closure("error_callback", move |ctx| {
+                    let res = match ctx.get(0) {
+                        Ok(exception) => handler.reject(env, exception),
+                        Err(err) => handler.error(env, err),
+                    };
+
+                    _ = tx.send(res);
+                    ctx.env.get_undefined()
+                })?
+            };
+
+            then.call(Some(&result), &[cb, eb])?;
+        } else {
+            let res = handler.resolve(env, Some(result));
+            _ = tx.send(res);
+        }
+
+        Ok(())
+    };
+
+    inner().unwrap_or_else(move |err| {
+        let res = outer_handler.error(env, err);
+        _ = outer_tx.send(res);
+    });
+}
+
+/// EnvMap is a thread-safe map that stores values associated with Env objects.
+/// It is intended for storing one value per napi_env. We need the map to work with
+/// worker pooling, where we can have multiple napi envs that each need their own copy.
+/// It uses a vector under the hood since the number of values is small (one per worker).
+pub struct EnvMap<T> {
+    map: RwLock<Vec<(usize, T)>>,
+}
+
+impl<T> EnvMap<T> {
+    pub const fn new() -> Self {
+        Self {
+            map: RwLock::new(Vec::new()),
+        }
+    }
+
+    pub fn get(&self, env: Env) -> Option<T>
+    where
+        T: Clone,
+    {
+        let elems = self.map.read().unwrap();
+        for (addr, value) in elems.iter() {
+            if *addr == env.raw().addr() {
+                return Some(value.clone());
+            }
+        }
+        None
+    }
+
+    pub fn get_or_init<F>(&self, env: Env, init: F) -> T
+    where
+        T: Clone,
+        F: FnOnce() -> T,
+    {
+        let addr = env.raw().addr();
+
+        // First try to read
+        let num_scanned = {
+            let map = self.map.read().unwrap();
+            for (key, value) in map.iter() {
+                if *key == addr {
+                    return value.clone();
+                }
+            }
+            map.len()
+        };
+
+        // If not found, get write lock and initialize
+        let mut map = self.map.write().unwrap();
+
+        // Double-check in case another thread initialized it.
+        // We only need to check from the last scanned index
+        for (key, value) in map[num_scanned..].iter() {
+            if *key == addr {
+                return value.clone();
+            }
+        }
+
+        let value = init();
+        map.push((addr, value.clone()));
+        value
+    }
+}
+
+impl<T> Default for EnvMap<T> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
diff --git a/runtimes/js/src/objects.rs b/runtimes/js/src/objects.rs
new file mode 100644
index 0000000000..aff3d0a188
--- /dev/null
+++ b/runtimes/js/src/objects.rs
@@ -0,0 +1,425 @@
+use encore_runtime_core::objects as core;
+use napi::bindgen_prelude::Buffer;
+use napi::{Env, JsBuffer, JsObject};
+use napi_derive::napi;
+use std::time::Duration;
+
+use crate::api::Request;
+
+#[napi]
+pub struct Bucket {
+    bkt: core::Bucket,
+}
+
+#[napi]
+impl Bucket {
+    pub(crate) fn new(bkt: core::Bucket) -> Self {
+        Self { bkt }
+    }
+
+    #[napi]
+    pub fn object(&self, name: String) -> BucketObject {
+        BucketObject::new(self.bkt.object(name))
+    }
+
+    #[napi]
+    pub async fn list(
+        &self,
+        options: Option<ListOptions>,
+        source: Option<&Request>,
+    ) -> napi::Either<ListIterator, TypedObjectError> {
+        let options = options.unwrap_or_default().into();
+        let source = source.map(|s| s.inner.clone());
+        match self.bkt.list(options, source).await {
+            Ok(iter) => napi::Either::A(ListIterator::new(iter)),
+            Err(err) => napi::Either::B(err.into()),
+        }
+    }
+}
+
+#[napi]
+pub struct BucketObject {
+    obj: core::Object,
+}
+
+#[napi]
+impl BucketObject {
+    pub(crate) fn new(obj: core::Object) -> Self {
+        Self { obj }
+    }
+
+    #[napi]
+    pub async fn attrs(
+        &self,
+        options: Option<AttrsOptions>,
+        source: Option<&Request>,
+    ) -> napi::Either<ObjectAttrs, TypedObjectError> {
+        let options = options.unwrap_or_default().into();
+        let source = source.map(|s| s.inner.clone());
+        match self.obj.attrs(options, source).await {
+            Ok(attrs) => napi::Either::A(attrs.into()),
+            Err(err) => napi::Either::B(err.into()),
+        }
+    }
+
+    #[napi]
+    pub async fn exists(
+        &self,
+        options: Option<ExistsOptions>,
+        source: Option<&Request>,
+    ) -> napi::Either<bool, TypedObjectError> {
+        let opts = options.unwrap_or_default().into();
+        let source = source.map(|s| s.inner.clone());
+        match self.obj.exists(opts, source).await {
+            Ok(val) => napi::Either::A(val),
+            Err(err) => napi::Either::B(err.into()),
+        }
+    }
+
+    #[napi(ts_return_type = "Promise<ObjectAttrs | TypedObjectError>")]
+    pub fn upload(
+        &self,
+        env: Env,
+        data: JsBuffer,
+        opts: Option<UploadOptions>,
+        source: Option<&Request>,
+    ) -> napi::Result<JsObject> {
+        // TODO: reference the data via a Ref, so that we can keep it alive throughout the upload.
+        let data = data.into_value()?.as_ref().to_vec();
+
+        let cursor = std::io::Cursor::new(data);
+        let opts = opts.unwrap_or_default().into();
+        let source = source.map(|s| s.inner.clone());
+
+        let fut = self.obj.upload(Box::new(cursor), opts, source);
+
+        // We need to always execute the handler below so that we can decrement the ref count.
+        // To do so, we need the future to be a napi::Result::Ok. So wrap the result inside that
+        // so that the handler gets called regardless of result.
+        let fut = async move { Ok(fut.await) };
+
+        env.execute_tokio_future(fut, move |&mut _env, result| {
+            // TODO: Decrement the ref count on the data buffer.
+            match result {
+                Ok(attrs) => Ok(napi::Either::A(ObjectAttrs::from(attrs))),
+                Err(err) => Ok(napi::Either::B(TypedObjectError::from(err))),
+            }
+        })
+    }
+
+    #[napi]
+    pub async fn signed_upload_url(
+        &self,
+        options: Option<UploadUrlOptions>,
+        source: Option<&Request>,
+    ) -> napi::Either<SignedUploadUrl, TypedObjectError> {
+        let options = options.unwrap_or_default().into();
+        let source = source.map(|s| s.inner.clone());
+        match self.obj.signed_upload_url(options, source).await {
+            Ok(url) => napi::Either::A(SignedUploadUrl { url }),
+            Err(err) => napi::Either::B(err.into()),
+        }
+    }
+
+    #[napi]
+    pub async fn signed_download_url(
+        &self,
+        options: Option<DownloadUrlOptions>,
+        source: Option<&Request>,
+    ) -> napi::Either<SignedDownloadUrl, TypedObjectError> {
+        let options = options.unwrap_or_default().into();
+        let source = source.map(|s| s.inner.clone());
+        match self.obj.signed_download_url(options, source).await {
+            Ok(url) => napi::Either::A(SignedDownloadUrl { url }),
+            Err(err) => napi::Either::B(err.into()),
+        }
+    }
+
+    #[napi]
+    pub async fn download_all(
+        &self,
+        options: Option<DownloadOptions>,
+        source: Option<&Request>,
+    ) -> napi::Either<Buffer, TypedObjectError> {
+        let options = options.unwrap_or_default().into();
+        let source = source.map(|s| s.inner.clone());
+        match self.obj.download_all(options, source).await {
+            Ok(buf) => napi::Either::A(buf.into()),
+            Err(err) => napi::Either::B(err.into()),
+        }
+    }
+
+    #[napi]
+    pub async fn delete(
+        &self,
+        options: Option<DeleteOptions>,
+        source: Option<&Request>,
+    ) -> Option<TypedObjectError> {
+        let options = options.unwrap_or_default().into();
+        let source = source.map(|s| s.inner.clone());
+        match self.obj.delete(options, source).await {
+            Ok(()) => None,
+            Err(err) => Some(err.into()),
+        }
+    }
+
+    #[napi]
+    pub fn public_url(&self) -> napi::Result<String> {
+        match self.obj.public_url() {
+            Ok(url) => Ok(url),
+            Err(err) => Err(napi::Error::new(
+                napi::Status::GenericFailure,
+                err.to_string(),
+            )),
+        }
+    }
+}
+
+#[napi]
+pub struct ObjectAttrs {
+    pub name: String,
+    pub version: Option<String>,
+    pub size: i64,
+    pub content_type: Option<String>,
+    pub etag: String,
+}
+
+impl From<core::ObjectAttrs> for ObjectAttrs {
+    fn from(value: core::ObjectAttrs) -> Self {
+        Self {
+            name: value.name,
+            version: value.version,
+            size: value.size as i64,
+            content_type: value.content_type,
+            etag: value.etag,
+        }
+    }
+}
+
+#[napi]
+pub struct ListEntry {
+    pub name: String,
+    pub size: i64,
+    pub etag: String,
+}
+
+impl From<core::ListEntry> for ListEntry {
+    fn from(value: core::ListEntry) -> Self {
+        Self {
+            name: value.name,
+            size: value.size as i64,
+            etag: value.etag,
+        }
+    }
+}
+
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct UploadOptions {
+    pub content_type: Option<String>,
+    pub preconditions: Option<UploadPreconditions>,
+}
+
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct UploadPreconditions {
+    pub not_exists: Option<bool>,
+}
+
+impl From<UploadOptions> for core::UploadOptions {
+    fn from(value: UploadOptions) -> Self {
+        Self {
+            content_type: value.content_type,
+            preconditions: value.preconditions.map(|p| p.into()),
+        }
+    }
+}
+
+impl From<UploadPreconditions> for core::UploadPreconditions {
+    fn from(value: UploadPreconditions) -> Self {
+        Self {
+            not_exists: value.not_exists,
+        }
+    }
+}
+
+#[napi]
+pub enum ObjectErrorKind {
+    NotFound,
+    PreconditionFailed,
+    InvalidArgument,
+    Other,
+    Internal,
+}
+
+#[napi]
+pub struct TypedObjectError {
+    pub kind: ObjectErrorKind,
+    pub message: String,
+}
+
+impl From<core::Error> for TypedObjectError {
+    fn from(value: core::Error) -> Self {
+        let kind = match &value {
+            core::Error::NotFound => ObjectErrorKind::NotFound,
+            core::Error::PreconditionFailed => ObjectErrorKind::PreconditionFailed,
+            core::Error::InvalidArgument => ObjectErrorKind::InvalidArgument,
+            core::Error::Internal(_) => ObjectErrorKind::Internal,
+            core::Error::Other(_) => ObjectErrorKind::Other,
+        };
+        Self {
+            kind,
+            message: value.to_string(),
+        }
+    }
+}
+
+#[napi]
+pub struct ListIterator {
+    stream: tokio::sync::Mutex<Option<core::ListIterator>>,
+}
+
+#[napi]
+impl ListIterator {
+    fn new(stream: core::ListIterator) -> Self {
+        Self {
+            stream: tokio::sync::Mutex::new(Some(stream)),
+        }
+    }
+
+    #[napi]
+    pub async fn next(&self) -> napi::Result<Option<ListEntry>> {
+        let mut stream = self.stream.lock().await;
+        if let Some(stream) = stream.as_mut() {
+            let row =
+                stream.next().await.transpose().map_err(|e| {
+                    napi::Error::new(napi::Status::GenericFailure, format!("{e:#?}"))
+                })?;
+            Ok(row.map(ListEntry::from))
+        } else {
+            Err(napi::Error::new(
+                napi::Status::GenericFailure,
+                "iterator is closed",
+            ))
+        }
+    }
+
+    #[napi]
+    pub fn mark_done(&mut self) {
+        if let Some(stream) = self.stream.get_mut().take() {
+            drop(stream);
+        };
+    }
+}
+
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct ExistsOptions {
+    pub version: Option<String>,
+}
+
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct AttrsOptions {
+    pub version: Option<String>,
+}
+
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct UploadUrlOptions {
+    pub ttl: Option<i64>,
+}
+
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct SignedUploadUrl {
+    pub url: String,
+}
+
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct DownloadUrlOptions {
+    pub ttl: Option<i64>,
+}
+
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct SignedDownloadUrl {
+    pub url: String,
+}
+
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct DeleteOptions {
+    pub version: Option<String>,
+}
+
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct DownloadOptions {
+    pub version: Option<String>,
+}
+
+#[napi(object)]
+#[derive(Debug, Default)]
+pub struct ListOptions {
+    pub prefix: Option<String>,
+    pub limit: Option<i64>,
+}
+
+impl From<DownloadOptions> for core::DownloadOptions {
+    fn from(value: DownloadOptions) -> Self {
+        Self {
+            version: value.version,
+        }
+    }
+}
+
+impl From<DeleteOptions> for core::DeleteOptions {
+    fn from(value: DeleteOptions) -> Self {
+        Self {
+            version: value.version,
+        }
+    }
+}
+
+impl From<ExistsOptions> for core::ExistsOptions {
+    fn from(value: ExistsOptions) -> Self {
+        Self {
+            version: value.version,
+        }
+    }
+}
+
+impl From<AttrsOptions> for core::AttrsOptions {
+    fn from(value: AttrsOptions) -> Self {
+        Self {
+            version: value.version,
+        }
+    }
+}
+
+impl From<UploadUrlOptions> for core::UploadUrlOptions {
+    fn from(value: UploadUrlOptions) -> Self {
+        Self {
+            ttl: Duration::from_secs(value.ttl.map(|v| v as u64).unwrap_or(3600)),
+        }
+    }
+}
+
+impl From<DownloadUrlOptions> for core::DownloadUrlOptions {
+    fn from(value: DownloadUrlOptions) -> Self {
+        Self {
+            ttl: Duration::from_secs(value.ttl.map(|v| v as u64).unwrap_or(3600)),
+        }
+    }
+}
+
+impl From<ListOptions> for core::ListOptions {
+    fn from(value: ListOptions) -> Self {
+        Self {
+            prefix: value.prefix,
+            limit: value.limit.map(|v| v as u64),
+        }
+    }
+}
diff --git a/runtimes/js/src/pubsub.rs b/runtimes/js/src/pubsub.rs
new file mode 100644
index 0000000000..5eba2575db
--- /dev/null
+++ b/runtimes/js/src/pubsub.rs
@@ -0,0 +1,179 @@
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+use anyhow::Context;
+use napi::{Env, Error, JsFunction, JsObject, JsUnknown, NapiRaw, Status};
+use napi_derive::napi;
+
+use encore_runtime_core::pubsub::{SubscriptionObj, TopicObj};
+use encore_runtime_core::{api, model, pubsub};
+
+use crate::api::Request;
+use crate::error::coerce_to_api_error;
+use crate::napi_util::{await_promise, PromiseHandler};
+use crate::pvalue::parse_pvalues;
+use crate::threadsafe_function::{ThreadSafeCallContext, ThreadsafeFunction};
+
+#[napi]
+pub struct PubSubTopic {
+    topic: TopicObj,
+}
+
+#[napi]
+impl PubSubTopic {
+    pub(crate) fn new(topic: TopicObj) -> Self {
+        Self { topic }
+    }
+
+    #[napi(ts_return_type = "Promise<string>")]
+    pub fn publish(
+        &self,
+        env: Env,
+        body: JsUnknown,
+        source: Option<&Request>,
+    ) -> napi::Result<JsObject> {
+        let Some(payload) = parse_pvalues(body).context("failed to parse payload")? else {
+            return Err(Error::new(
+                Status::InvalidArg,
+                "no message payload provided",
+            ));
+        };
+
+        let source = source.map(|s| s.inner.clone());
+        let fut = self.topic.publish(payload, source);
+        let fut = async move {
+            match fut.await {
+                Ok(id) => Ok(id),
+                Err(e) => Err(Error::new(
+                    Status::GenericFailure,
+                    format!("failed to publish: {e}"),
+                )),
+            }
+        };
+
+        env.spawn_future(fut)
+    }
+}
+
+#[napi(object)]
+pub struct PubSubSubscriptionConfig {
+    pub topic_name: String,
+    pub subscription_name: String,
+    pub handler: JsFunction,
+}
+
+impl PubSubSubscriptionConfig {
+    pub fn to_handler(&self, env: Env) -> napi::Result<JSSubscriptionHandler> {
+        let tsfn = ThreadsafeFunction::create(
+            env.raw(),
+            // SAFETY: `handler` is a valid JS function.
+            unsafe { self.handler.raw() },
+            0,
+            resolve_on_js_thread,
+        )?;
+
+        Ok(JSSubscriptionHandler {
+            handler: Arc::new(tsfn),
+        })
+    }
+}
+
+#[napi]
+pub struct PubSubSubscription {
+    sub: Arc<SubscriptionObj>,
+    handler: Arc<JSSubscriptionHandler>,
+}
+
+impl PubSubSubscription {
+    pub fn new(sub: Arc<SubscriptionObj>, handler: Arc<JSSubscriptionHandler>) -> Self {
+        Self { sub, handler }
+    }
+}
+
+#[napi]
+impl PubSubSubscription {
+    #[napi]
+    pub async fn subscribe(&self) -> napi::Result<()> {
+        self.sub
+            .subscribe(self.handler.clone())
+            .await
+            .map_err(|e| Error::new(Status::GenericFailure, format!("failed to subscribe: {e}")))
+    }
+}
+
+struct PubSubMessageRequest {
+    req: Request,
+    tx: tokio::sync::mpsc::UnboundedSender<Result<(), api::Error>>,
+}
+
+#[derive(Debug)]
+pub struct JSSubscriptionHandler {
+    handler: Arc<ThreadsafeFunction<PubSubMessageRequest>>,
+}
+
+impl pubsub::SubscriptionHandler for JSSubscriptionHandler {
+    fn handle_message(
+        &self,
+        msg: Arc<model::Request>,
+    ) -> Pin<Box<dyn Future<Output = Result<(), api::Error>> + Send + '_>> {
+        let handler = self.handler.clone();
+        Box::pin(async move {
+            let (tx, mut rx) = tokio::sync::mpsc::unbounded_channel();
+            let req = Request::new(msg);
+            handler.call(
+                PubSubMessageRequest { req, tx },
+                crate::threadsafe_function::ThreadsafeFunctionCallMode::Blocking,
+            );
+
+            match rx.recv().await {
+                Some(Ok(())) => Ok(()),
+                Some(Err(err)) => Err(err),
+                None => Err(api::Error::internal(anyhow::anyhow!(
+                    "subscription handler did not respond",
+                ))),
+            }
+        })
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+struct SubscriptionPromiseHandler;
+
+impl PromiseHandler for SubscriptionPromiseHandler {
+    type Output = Result<(), api::Error>;
+
+    fn resolve(&self, _: Env, _: Option<JsUnknown>) -> Self::Output {
+        Ok(())
+    }
+
+    fn reject(&self, env: Env, val: napi::JsUnknown) -> Self::Output {
+        Err(coerce_to_api_error(env, val)?)
+    }
+
+    fn error(&self, _: Env, err: Error) -> Self::Output {
+        Err(api::Error {
+            code: api::ErrCode::Internal,
+            message: api::ErrCode::Internal.default_public_message().into(),
+            internal_message: Some(err.to_string()),
+            stack: None,
+            details: None,
+        })
+    }
+}
+
+fn resolve_on_js_thread(ctx: ThreadSafeCallContext<PubSubMessageRequest>) -> napi::Result<()> {
+    let handler = SubscriptionPromiseHandler;
+    let req = ctx.value.req.into_instance(ctx.env)?;
+    match ctx.callback.unwrap().call(None, &[req]) {
+        Ok(result) => {
+            await_promise(ctx.env, result, ctx.value.tx.clone(), handler);
+            Ok(())
+        }
+        Err(err) => {
+            let res = handler.error(ctx.env, err);
+            _ = ctx.value.tx.send(res);
+            Ok(())
+        }
+    }
+}
diff --git a/runtimes/js/src/pvalue.rs b/runtimes/js/src/pvalue.rs
new file mode 100644
index 0000000000..3bef8e9472
--- /dev/null
+++ b/runtimes/js/src/pvalue.rs
@@ -0,0 +1,413 @@
+use std::{str::FromStr, sync::Arc};
+
+use crate::cookies::{cookie_to_napi_value, JsCookie};
+use crate::runtime::Runtime;
+use chrono::TimeZone;
+use encore_runtime_core::api::{self, auth, schema, Decimal, PValue, PValues};
+use malachite::{rational::Rational, Integer, Natural};
+use napi::{
+    bindgen_prelude::*, sys, JsDate, JsObject, JsString, JsUnknown, NapiRaw, NapiValue, Result,
+};
+use serde_json::Number;
+
+#[allow(dead_code)]
+pub fn parse_pvalue(val: JsUnknown) -> Result<PValue> {
+    let val = PVal::from_unknown(val)?;
+    Ok(val.0)
+}
+
+pub fn parse_pvalues(val: JsUnknown) -> Result<Option<PValues>> {
+    if val
+        .get_type()
+        .is_ok_and(|t| t == napi::ValueType::Undefined || t == napi::ValueType::Null)
+    {
+        return Ok(None);
+    }
+
+    let val = PVals::from_unknown(val)?;
+    Ok(Some(val.0))
+}
+
+#[allow(dead_code)]
+pub fn pvalue_to_js(env: Env, val: &PValue) -> Result<JsUnknown> {
+    let env = env.raw();
+
+    unsafe {
+        // Safety: the memory representation is the same for &PValue and &PVal.
+        let pv = std::mem::transmute::<&PValue, &PVal>(val);
+        let val = ToNapiValue::to_napi_value(env, pv)?;
+        JsUnknown::from_raw(env, val)
+    }
+}
+
+#[allow(dead_code)]
+pub fn pvalues_to_js(env: Env, val: &PValues) -> Result<JsUnknown> {
+    let env = env.raw();
+    unsafe {
+        let pv = std::mem::transmute::<&PValues, &PVals>(val);
+        let val = ToNapiValue::to_napi_value(env, pv)?;
+        JsUnknown::from_raw(env, val)
+    }
+}
+
+// transforms vals according to the response schema
+pub fn transform_pvalues_response(
+    mut vals: PValues,
+    schema: Arc<schema::Response>,
+) -> Result<PValues> {
+    if let Some(cookie_schema) = &schema.cookie {
+        for (key, field) in cookie_schema.fields() {
+            if let Some(PValue::Object(obj)) = vals.get(key) {
+                let cookie_name = field.name_override.as_deref().unwrap_or(key.as_ref());
+                let cookie_value = obj.get("value").ok_or(Error::new(
+                    Status::InvalidArg,
+                    "cookie requires a value".to_owned(),
+                ))?;
+
+                let cookie = JsCookie::parse_cookie(obj, cookie_name, cookie_value)?;
+                vals.insert(key.to_string(), PValue::Cookie(cookie));
+            }
+        }
+    }
+
+    Ok(vals)
+}
+
+// transforms vals according to the request schema
+pub fn transform_pvalues_request(
+    mut vals: PValues,
+    schema: Arc<schema::Request>,
+) -> Result<PValues> {
+    if let Some(cookie_schema) = &schema.cookie {
+        for (key, field) in cookie_schema.fields() {
+            if let Some(PValue::Object(obj)) = vals.get(key) {
+                let cookie_name = field.name_override.as_deref().unwrap_or(key.as_ref());
+                let cookie_value = obj.get("value").ok_or(Error::new(
+                    Status::InvalidArg,
+                    "cookie requires a value".to_owned(),
+                ))?;
+
+                let cookie = JsCookie::parse_cookie(obj, cookie_name, cookie_value)?;
+                vals.insert(key.to_string(), PValue::Cookie(cookie));
+            }
+        }
+    }
+
+    Ok(vals)
+}
+
+#[derive(Clone, Debug)]
+pub struct PVal(pub PValue);
+#[derive(Clone, Debug)]
+pub struct PVals(pub PValues);
+
+impl ToNapiValue for PVal {
+    unsafe fn to_napi_value(env: sys::napi_env, val: Self) -> Result<sys::napi_value> {
+        match val.0 {
+            PValue::Null => unsafe { Null::to_napi_value(env, Null) },
+            PValue::Bool(b) => unsafe { bool::to_napi_value(env, b) },
+            PValue::Number(n) => unsafe { Number::to_napi_value(env, n.to_owned()) },
+            PValue::Decimal(d) => {
+                let env2 = Env::from_raw(env);
+                let decimal_js = Runtime::create_decimal(env2, &d.to_string())?;
+                unsafe { Ok(decimal_js.raw()) }
+            }
+            PValue::String(s) => unsafe { ToNapiValue::to_napi_value(env, s) },
+            PValue::Array(arr) => {
+                let env2 = Env::from_raw(env);
+                let mut out = env2.create_array(arr.len() as u32)?;
+
+                for (i, v) in arr.into_iter().enumerate() {
+                    out.set(i as u32, PVal(v))?;
+                }
+
+                unsafe { Array::to_napi_value(env, out) }
+            }
+            PValue::Object(obj) => unsafe { ToNapiValue::to_napi_value(env, PVals(obj)) },
+            PValue::Cookie(c) => crate::cookies::cookie_to_napi_value(env, c),
+            PValue::DateTime(dt) => {
+                let env2 = Env::from_raw(env);
+                let ts = dt.timestamp_millis();
+                let dt = env2.create_date(ts as f64)?;
+                JsDate::to_napi_value(env, dt)
+            }
+        }
+    }
+}
+
+impl ToNapiValue for &PVal {
+    unsafe fn to_napi_value(env: sys::napi_env, val: Self) -> Result<sys::napi_value> {
+        match &val.0 {
+            PValue::Null => unsafe { Null::to_napi_value(env, Null) },
+            PValue::Bool(b) => unsafe { bool::to_napi_value(env, *b) },
+            PValue::Number(n) => unsafe { Number::to_napi_value(env, n.to_owned()) },
+            PValue::Decimal(d) => {
+                let env2 = Env::from_raw(env);
+                let decimal_js = Runtime::create_decimal(env2, &d.to_string())?;
+                unsafe { Ok(decimal_js.raw()) }
+            }
+            PValue::String(s) => unsafe { ToNapiValue::to_napi_value(env, s) },
+            PValue::Array(arr) => {
+                let env2 = Env::from_raw(env);
+                let mut out = env2.create_array(arr.len() as u32)?;
+
+                for (i, v) in arr.iter().enumerate() {
+                    // Safety: the memory representation is the same for &PValue and &PVal.
+                    let pv = unsafe { std::mem::transmute::<&PValue, &PVal>(v) };
+                    out.set(i as u32, pv)?;
+                }
+
+                unsafe { Array::to_napi_value(env, out) }
+            }
+            PValue::Object(obj) => unsafe {
+                // Safety: the memory representation is the same for &PValue and &PVal.
+                let pv = std::mem::transmute::<&PValues, &PVals>(obj);
+                ToNapiValue::to_napi_value(env, pv)
+            },
+            PValue::Cookie(c) => cookie_to_napi_value(env, c.clone()),
+            PValue::DateTime(dt) => {
+                let env2 = Env::from_raw(env);
+                let ts = dt.timestamp_millis();
+                let dt = env2.create_date(ts as f64)?;
+                JsDate::to_napi_value(env, dt)
+            }
+        }
+    }
+}
+
+impl FromNapiValue for PVal {
+    unsafe fn from_napi_value(env: sys::napi_env, napi_val: sys::napi_value) -> Result<Self> {
+        let ty = type_of!(env, napi_val)?;
+        let val = PVal(match ty {
+            ValueType::Boolean => PValue::Bool(unsafe { bool::from_napi_value(env, napi_val)? }),
+            ValueType::Number => PValue::Number(unsafe { Number::from_napi_value(env, napi_val)? }),
+            ValueType::String => PValue::String(unsafe { String::from_napi_value(env, napi_val)? }),
+            ValueType::Object => {
+                let mut is_arr = false;
+                check_status!(
+                    unsafe { sys::napi_is_array(env, napi_val, &mut is_arr) },
+                    "Failed to detect whether given js is an array"
+                )?;
+
+                if is_arr {
+                    PValue::Array(unsafe {
+                        let vals = Vec::<PVal>::from_napi_value(env, napi_val)?;
+                        // Transmute Vec<PVal> to Vec<PValue> since that's what PValue::Array expects.
+                        // This is safe because PVal is a newtype around PValue.
+                        std::mem::transmute::<Vec<PVal>, Vec<PValue>>(vals)
+                    })
+                } else {
+                    // Is it a date?
+                    let mut is_date = false;
+                    check_status!(
+                        unsafe { sys::napi_is_date(env, napi_val, &mut is_date) },
+                        "Failed to detect whether given js is a date"
+                    )?;
+                    if is_date {
+                        let dt = JsDate::from_napi_value(env, napi_val)?;
+                        let millis = dt.value_of()?;
+                        let ts = timestamp_to_dt(millis);
+                        PValue::DateTime(ts)
+                    } else {
+                        // Check if it's a Decimal instance by checking for __encore_decimal property
+                        let obj = JsObject::from_napi_value(env, napi_val)?;
+
+                        if obj.has_property("__encore_decimal")? {
+                            let value_str = obj
+                                .get::<&str, JsString>("value")?
+                                .ok_or_else(|| {
+                                    Error::new(
+                                        Status::InvalidArg,
+                                        "Decimal object missing 'value' property".to_owned(),
+                                    )
+                                })?
+                                .into_utf8()?
+                                .into_owned()?;
+                            PValue::Decimal(Decimal::from_str(&value_str).map_err(|e| {
+                                Error::new(
+                                    Status::InvalidArg,
+                                    format!("Failed to parse Decimal value: {}", e),
+                                )
+                            })?)
+                        } else {
+                            PValue::Object(unsafe { PVals::from_napi_value(env, napi_val)?.0 })
+                        }
+                    }
+                }
+            }
+            ValueType::BigInt => {
+                let bi = BigInt::from_napi_value(env, napi_val)?;
+                let n = Natural::from_owned_limbs_asc(bi.words);
+                let i = Integer::from_sign_and_abs(!bi.sign_bit, n);
+                let r = Rational::from_integers(i, 1.into());
+                PValue::Decimal(r.into())
+            }
+            ValueType::Null => PValue::Null,
+            ValueType::Function => {
+                return Err(Error::new(
+                    Status::InvalidArg,
+                    "JS functions cannot be represented as a serde_json::Value".to_owned(),
+                ))
+            }
+            ValueType::Undefined => {
+                return Err(Error::new(
+                    Status::InvalidArg,
+                    "undefined cannot be represented as a serde_json::Value".to_owned(),
+                ))
+            }
+            ValueType::Symbol => {
+                return Err(Error::new(
+                    Status::InvalidArg,
+                    "JS symbols cannot be represented as a serde_json::Value".to_owned(),
+                ))
+            }
+            ValueType::External => {
+                return Err(Error::new(
+                    Status::InvalidArg,
+                    "External JS objects cannot be represented as a serde_json::Value".to_owned(),
+                ))
+            }
+            _ => {
+                return Err(Error::new(
+                    Status::InvalidArg,
+                    "Unknown JS variables cannot be represented as a serde_json::Value".to_owned(),
+                ))
+            }
+        });
+
+        Ok(val)
+    }
+}
+
+impl ToNapiValue for PVals {
+    unsafe fn to_napi_value(raw_env: sys::napi_env, val: Self) -> Result<sys::napi_value> {
+        let env = Env::from_raw(raw_env);
+        let mut obj = env.create_object()?;
+
+        for (k, v) in val.0.into_iter() {
+            obj.set(k, PVal(v))?;
+        }
+
+        unsafe { JsObject::to_napi_value(raw_env, obj) }
+    }
+}
+
+impl ToNapiValue for &PVals {
+    unsafe fn to_napi_value(raw_env: sys::napi_env, val: Self) -> Result<sys::napi_value> {
+        let env = Env::from_raw(raw_env);
+        let mut obj = env.create_object()?;
+
+        for (k, v) in val.0.iter() {
+            // Safety: the memory representation is the same for &PValue and &PVal.
+            let pv = unsafe { std::mem::transmute::<&PValue, &PVal>(v) };
+            obj.set(k, pv)?;
+        }
+
+        unsafe { JsObject::to_napi_value(raw_env, obj) }
+    }
+}
+
+impl FromNapiValue for PVals {
+    unsafe fn from_napi_value(env: sys::napi_env, napi_val: sys::napi_value) -> Result<Self> {
+        assert_type_of!(env, napi_val, ValueType::Object)?;
+        let obj = JsObject::from_napi_value(env, napi_val)?;
+
+        let mut map = PVals(PValues::new());
+        for key in JsObject::keys(&obj)?.into_iter() {
+            if let Some(val) = obj_get_pval(env, napi_val, &key)? {
+                map.0.insert(key, val);
+            }
+        }
+
+        Ok(map)
+    }
+}
+
+pub fn encode_request_payload(
+    env: Env,
+    p: Option<&api::RequestPayload>,
+) -> napi::Result<JsUnknown> {
+    let Some(p) = p else {
+        return Ok(env.get_null()?.into_unknown());
+    };
+
+    let mut obj = env.create_object()?;
+
+    add_fields_to_obj(&mut obj, p.path.as_ref())?;
+    add_fields_to_obj(&mut obj, p.query.as_ref())?;
+    add_fields_to_obj(&mut obj, p.header.as_ref())?;
+    add_fields_to_obj(&mut obj, p.cookie.as_ref())?;
+
+    match &p.body {
+        api::Body::Typed(typed) => add_fields_to_obj(&mut obj, typed.as_ref())?,
+        api::Body::Raw(_) => {}
+    }
+
+    Ok(obj.into_unknown())
+}
+
+pub fn encode_auth_payload(env: Env, p: &auth::AuthPayload) -> napi::Result<JsUnknown> {
+    let mut obj = env.create_object()?;
+    add_fields_to_obj(&mut obj, p.query.as_ref())?;
+    add_fields_to_obj(&mut obj, p.header.as_ref())?;
+    add_fields_to_obj(&mut obj, p.cookie.as_ref())?;
+    Ok(obj.into_unknown())
+}
+
+pub fn pvalues_or_null(env: Env, vals: Option<&PValues>) -> napi::Result<JsUnknown> {
+    vals.map_or_else(
+        || env.get_null().map(|v| v.into_unknown()),
+        |v| pvalues_to_js(env, v),
+    )
+}
+
+fn add_fields_to_obj<'a, I: IntoIterator<Item = (&'a String, &'a PValue)>>(
+    obj: &'a mut JsObject,
+    vals: Option<I>,
+) -> napi::Result<()> {
+    let Some(vals) = vals else {
+        return Ok(());
+    };
+
+    for (k, v) in vals.into_iter() {
+        let pv = unsafe { std::mem::transmute::<&PValue, &PVal>(v) };
+        obj.set(k, pv)?;
+    }
+    Ok(())
+}
+
+fn timestamp_to_dt(millis: f64) -> chrono::DateTime<chrono::FixedOffset> {
+    let millis = millis.trunc() as i64;
+    let secs = millis / 1000;
+    let nanos = (millis % 1000) * 1_000_000;
+    let ts = chrono::Utc.timestamp_opt(secs, nanos as u32);
+    ts.unwrap().fixed_offset()
+}
+
+// This is an inlined version of JsObject::get that distinguishes between null and undefined.
+fn obj_get_pval<K: AsRef<str>>(
+    env: sys::napi_env,
+    obj: sys::napi_value,
+    field: K,
+) -> Result<Option<PValue>> {
+    let c_field = std::ffi::CString::new(field.as_ref())?;
+
+    unsafe {
+        let mut ret = std::ptr::null_mut();
+
+        check_status!(
+            sys::napi_get_named_property(env, obj, c_field.as_ptr(), &mut ret),
+            "Failed to get property with field `{}`",
+            field.as_ref(),
+        )?;
+
+        let ty = type_of!(env, ret)?;
+
+        if ty == ValueType::Undefined {
+            return Ok(None);
+        }
+
+        let pval = PVal::from_napi_value(env, ret)?;
+        Ok(Some(pval.0))
+    }
+}
diff --git a/runtimes/js/src/raw_api.rs b/runtimes/js/src/raw_api.rs
new file mode 100644
index 0000000000..56fa4aa361
--- /dev/null
+++ b/runtimes/js/src/raw_api.rs
@@ -0,0 +1,505 @@
+#![allow(clippy::result_large_err)]
+
+use std::collections::HashMap;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+use axum::body::Body;
+use axum::http::{Response, StatusCode};
+use bytes::Bytes;
+use napi::bindgen_prelude::{Buffer, Either3};
+use napi::{Either, Env, JsFunction, JsUnknown, NapiRaw};
+use napi_derive::napi;
+use tokio::sync::{mpsc, oneshot};
+
+use encore_runtime_core::api::{self, ToResponse};
+
+use crate::api::Request;
+use crate::error::coerce_to_api_error;
+use crate::napi_util::{await_promise, PromiseHandler};
+use crate::stream;
+use crate::threadsafe_function::{
+    ThreadSafeCallContext, ThreadsafeFunction, ThreadsafeFunctionCallMode,
+};
+
+pub struct JSRawHandler {
+    handler: ThreadsafeFunction<RawRequestMessage>,
+}
+
+pub fn new_handler(env: Env, func: JsFunction) -> napi::Result<Arc<dyn api::BoxedHandler>> {
+    let handler = ThreadsafeFunction::create(
+        env.raw(),
+        // SAFETY: `handler` is a valid JS function.
+        unsafe { func.raw() },
+        0,
+        raw_resolve_on_js_thread,
+    )?;
+    Ok(Arc::new(JSRawHandler { handler }))
+}
+
+struct RawRequestMessage {
+    req: Request,
+    resp: ResponseWriter,
+    body: BodyReader,
+    err_tx: mpsc::UnboundedSender<Result<(), api::Error>>,
+}
+
+#[derive(Debug)]
+enum ResponseWriterState {
+    Initial {
+        resp: axum::http::response::Builder,
+        sender: oneshot::Sender<Response<Body>>,
+    },
+    StreamingBody {
+        write: stream::write::WriteHalf,
+    },
+    Done,
+}
+
+impl ResponseWriterState {
+    pub fn new(sender: oneshot::Sender<Response<Body>>) -> Self {
+        let resp = axum::response::Response::builder().status(StatusCode::OK);
+        Self::Initial { resp, sender }
+    }
+
+    pub fn set_head(
+        self,
+        status: u16,
+        headers: axum::http::HeaderMap,
+    ) -> Result<Self, (Self, anyhow::Error)> {
+        let status = match StatusCode::from_u16(status) {
+            Ok(status) => status,
+            Err(err) => return Err((self, err.into())),
+        };
+
+        match self {
+            Self::Initial { mut resp, sender } => {
+                resp = resp.status(status);
+                for (k, v) in headers.iter() {
+                    resp = resp.header(k, v);
+                }
+                Ok(Self::Initial { resp, sender })
+            }
+            _ => Ok(self),
+        }
+    }
+
+    pub fn flush_header(self) -> Result<Self, (Self, anyhow::Error)> {
+        match self {
+            Self::Initial { resp, sender } => {
+                let (write, read) = stream::write::new();
+                let read = tokio_util::io::ReaderStream::new(read);
+
+                let resp = match resp.body(Body::from_stream(read)) {
+                    Ok(resp) => resp,
+                    Err(err) => {
+                        ::log::error!(err = err.to_string(); "failed to set raw response body to flush header");
+                        return Err((Self::Done, err.into()));
+                    }
+                };
+
+                let _ = sender.send(resp);
+                Ok(Self::StreamingBody { write })
+            }
+            _ => Ok(self),
+        }
+    }
+
+    pub fn close(
+        self,
+        env: Env,
+        buf: Option<Bytes>,
+        callback: Option<JsFunction>,
+    ) -> Result<Self, (Self, anyhow::Error)> {
+        match self {
+            Self::Initial { resp, sender } => {
+                let body = match buf {
+                    Some(buf) => Body::from(buf),
+                    None => Body::empty(),
+                };
+                let resp = match resp.body(body) {
+                    Ok(resp) => resp,
+                    Err(err) => {
+                        ::log::error!(err = err.to_string(); "failed to close raw response body");
+                        return Err((Self::Done, err.into()));
+                    }
+                };
+                let _ = sender.send(resp);
+                Ok(Self::Done)
+            }
+            Self::StreamingBody { mut write } => {
+                if let Some(buf) = buf {
+                    write.write(buf, None);
+                }
+
+                let tx = match to_sender(env, callback) {
+                    Ok(tx) => tx,
+                    Err(err) => return Err((Self::StreamingBody { write }, err.into())),
+                };
+                write.end(tx);
+
+                Ok(Self::Done)
+            }
+            Self::Done => Ok(self),
+        }
+    }
+
+    pub fn write_body(
+        self,
+        env: Env,
+        buf: Bytes,
+        callback: Option<JsFunction>,
+    ) -> Result<Self, (Self, anyhow::Error)> {
+        self.write_body_multi(env, vec![buf], callback)
+    }
+
+    pub fn write_body_multi(
+        mut self,
+        env: Env,
+        bufs: Vec<Bytes>,
+        callback: Option<JsFunction>,
+    ) -> Result<Self, (Self, anyhow::Error)> {
+        self = self.flush_header_if_needed();
+
+        match self {
+            Self::StreamingBody { mut write } => {
+                let tx = match to_sender(env, callback) {
+                    Ok(tx) => tx,
+                    Err(err) => return Err((Self::StreamingBody { write }, err.into())),
+                };
+                write.writev(bufs, tx);
+                Ok(Self::StreamingBody { write })
+            }
+            _ => Ok(self),
+        }
+    }
+
+    fn flush_header_if_needed(self) -> Self {
+        match self {
+            Self::Initial { .. } => match self.flush_header() {
+                Ok(state) => state,
+                Err((state, _)) => state,
+            },
+            _ => self,
+        }
+    }
+}
+
+fn to_sender(env: Env, callback: Option<JsFunction>) -> napi::Result<Option<oneshot::Sender<()>>> {
+    let Some(callback) = callback else {
+        return Ok(None);
+    };
+    let (tx, rx) = oneshot::channel::<()>();
+
+    let mut callback = env.create_reference(callback)?;
+    let fut = async move {
+        _ = rx.await;
+        Ok(())
+    };
+    env.execute_tokio_future(fut, move |&mut env, _| {
+        let cb: JsFunction = env.get_reference_value(&callback)?;
+        callback.unref(env)?;
+        cb.call_without_args(None)?;
+        Ok(())
+    })?;
+    Ok(Some(tx))
+}
+
+#[napi]
+#[derive(Debug)]
+pub struct ResponseWriter {
+    // Option to support moving out of self.
+    state: Option<ResponseWriterState>,
+}
+
+#[napi]
+impl ResponseWriter {
+    #[napi]
+    #[allow(clippy::type_complexity)]
+    pub fn write_head(
+        &mut self,
+        status: u16,
+        headers: Either<Vec<String>, HashMap<String, Either3<String, i32, Vec<String>>>>,
+    ) -> napi::Result<()> {
+        let Some(state) = self.state.take() else {
+            return Err(napi::Error::new(
+                napi::Status::GenericFailure,
+                "missing state".to_string(),
+            ));
+        };
+
+        ::log::trace!("write_head: status={}, headers={:?}", status, headers);
+        let headers = parse_headers(headers)?;
+
+        let (state, result) = match state.set_head(status, headers) {
+            Ok(state) => (state, Ok(())),
+            Err((state, err)) => (state, Err(err)),
+        };
+        self.state = Some(state);
+        result.map_err(|err| napi::Error::new(napi::Status::GenericFailure, err.to_string()))
+    }
+
+    #[napi]
+    pub fn write_body(
+        &mut self,
+        env: Env,
+        buf: Buffer,
+        callback: Option<JsFunction>,
+    ) -> napi::Result<()> {
+        let Some(state) = self.state.take() else {
+            return Err(napi::Error::new(
+                napi::Status::GenericFailure,
+                "missing state".to_string(),
+            ));
+        };
+
+        ::log::trace!("write_body: self={:#?}", self);
+
+        let buf = Bytes::from(buf.to_vec());
+        let (state, result) = match state.write_body(env, buf, callback) {
+            Ok(state) => (state, Ok(())),
+            Err((state, err)) => (state, Err(err)),
+        };
+        self.state = Some(state);
+        result.map_err(|err| napi::Error::new(napi::Status::GenericFailure, err.to_string()))
+    }
+
+    #[napi]
+    pub fn write_body_multi(
+        &mut self,
+        env: Env,
+        bufs: Vec<Buffer>,
+        callback: Option<JsFunction>,
+    ) -> napi::Result<()> {
+        ::log::trace!("write_body_body: self={:#?}", self);
+        let Some(state) = self.state.take() else {
+            return Err(napi::Error::new(
+                napi::Status::GenericFailure,
+                "missing state".to_string(),
+            ));
+        };
+
+        let bufs: Vec<_> = bufs
+            .into_iter()
+            .map(|buf| Bytes::from(buf.to_vec()))
+            .collect();
+        let (state, result) = match state.write_body_multi(env, bufs, callback) {
+            Ok(state) => (state, Ok(())),
+            Err((state, err)) => (state, Err(err)),
+        };
+        self.state = Some(state);
+        result.map_err(|err| napi::Error::new(napi::Status::GenericFailure, err.to_string()))
+    }
+
+    #[napi]
+    pub fn close(
+        &mut self,
+        env: Env,
+        buf: Option<Buffer>,
+        callback: Option<JsFunction>,
+    ) -> napi::Result<()> {
+        ::log::trace!("close: self={:#?}", self);
+        let Some(state) = self.state.take() else {
+            return Err(napi::Error::new(
+                napi::Status::GenericFailure,
+                "missing state".to_string(),
+            ));
+        };
+
+        let buf = buf.map(|buf| Bytes::from(buf.to_vec()));
+        let (state, result) = match state.close(env, buf, callback) {
+            Ok(state) => (state, Ok(())),
+            Err((state, err)) => (state, Err(err)),
+        };
+        self.state = Some(state);
+        result.map_err(|err| napi::Error::new(napi::Status::GenericFailure, err.to_string()))
+    }
+}
+
+#[napi]
+pub struct BodyReader {
+    reader: stream::read::Reader<axum::body::BodyDataStream>,
+}
+
+#[napi]
+impl BodyReader {
+    pub fn new(body: axum::body::BodyDataStream) -> Self {
+        Self {
+            reader: stream::read::Reader::new(body),
+        }
+    }
+
+    #[napi]
+    pub fn start(&mut self, env: Env, push: JsFunction, destroy: JsFunction) -> napi::Result<()> {
+        self.reader.start(env, push, destroy)
+    }
+
+    #[napi]
+    pub fn read(&self) -> napi::Result<()> {
+        self.reader.read()
+    }
+}
+
+impl api::BoxedHandler for JSRawHandler {
+    fn call(
+        self: Arc<Self>,
+        req: api::HandlerRequest,
+    ) -> Pin<Box<dyn Future<Output = api::ResponseData> + Send + 'static>> {
+        Box::pin(async move {
+            let (body_tx, mut body_rx) = oneshot::channel();
+
+            let internal_caller = req.internal_caller.clone();
+
+            let Some(body) = req.take_raw_body() else {
+                let err = api::Error::internal(anyhow::anyhow!("missing body"));
+                return api::ResponseData::Raw(err.to_response(internal_caller));
+            };
+
+            // Call the handler.
+            let req = Request::new(req);
+            let resp = ResponseWriter {
+                state: Some(ResponseWriterState::new(body_tx)),
+            };
+            let body = BodyReader::new(body.into_data_stream());
+
+            let (err_tx, mut err_rx) = mpsc::unbounded_channel();
+
+            self.handler.call(
+                RawRequestMessage {
+                    req,
+                    resp,
+                    body,
+                    err_tx,
+                },
+                ThreadsafeFunctionCallMode::Blocking,
+            );
+
+            // Wait for a response body on body_rx, or an error to be received on err_rx.
+            let resp = tokio::select! {
+                resp = &mut body_rx => {
+                    match resp {
+                        Ok(resp) => resp,
+                        Err(_) => {
+                            let err_resp = api::Error::internal(anyhow::anyhow!("handler did not respond"));
+                            err_resp.to_response(internal_caller)
+                        }
+                    }
+                }
+                err = err_rx.recv() => {
+                    match err {
+                        Some(Err(err)) => err.to_response(internal_caller),
+                        _ => {
+                            // We didn't get an error. Wait for the response body instead.
+                            match body_rx.await {
+                                Ok(resp) => resp,
+                                Err(_) => {
+                                    let err_resp = api::Error::internal(anyhow::anyhow!("handler did not respond"));
+                                    err_resp.to_response(internal_caller)
+                                }
+                            }
+                        }
+                    }
+                }
+            };
+
+            api::ResponseData::Raw(resp)
+        })
+    }
+}
+
+#[allow(clippy::type_complexity)]
+fn parse_headers(
+    headers: Either<Vec<String>, HashMap<String, Either3<String, i32, Vec<String>>>>,
+) -> napi::Result<axum::http::HeaderMap> {
+    fn key_err(err: axum::http::header::InvalidHeaderName) -> napi::Error {
+        napi::Error::new(napi::Status::GenericFailure, err.to_string())
+    }
+    fn val_err(err: axum::http::header::InvalidHeaderValue) -> napi::Error {
+        napi::Error::new(napi::Status::GenericFailure, err.to_string())
+    }
+
+    let mut map = axum::http::HeaderMap::new();
+    match headers {
+        Either::A(headers) => {
+            for i in (0..headers.len()).step_by(2) {
+                let key: axum::http::HeaderName = headers[i].parse().map_err(key_err)?;
+                let value = &headers[i + 1];
+                let value: axum::http::HeaderValue = value.parse().map_err(val_err)?;
+                map.append(key, value);
+            }
+        }
+
+        Either::B(headers) => {
+            for (key, value) in headers {
+                let key: axum::http::HeaderName = key.parse().map_err(key_err)?;
+                match value {
+                    Either3::A(value) => {
+                        let value: axum::http::HeaderValue = value.parse().map_err(val_err)?;
+                        map.append(key, value);
+                    }
+                    Either3::B(value) => {
+                        let value: axum::http::HeaderValue =
+                            value.to_string().parse().map_err(val_err)?;
+                        map.append(key, value);
+                    }
+                    Either3::C(values) => {
+                        for value in values {
+                            let value: axum::http::HeaderValue = value.parse().map_err(val_err)?;
+                            map.append(key.clone(), value);
+                        }
+                    }
+                }
+            }
+        }
+    }
+
+    Ok(map)
+}
+
+fn raw_resolve_on_js_thread(ctx: ThreadSafeCallContext<RawRequestMessage>) -> napi::Result<()> {
+    let req = ctx.value.req.into_instance(ctx.env)?;
+    let resp = ctx.value.resp.into_instance(ctx.env)?;
+    let body = ctx.value.body.into_instance(ctx.env)?;
+    let req = req.as_object(ctx.env);
+    let resp = resp.as_object(ctx.env);
+    let body = body.as_object(ctx.env);
+
+    let handler = RawPromiseHandler;
+    match ctx.callback.unwrap().call(None, &[req, resp, body]) {
+        Ok(result) => {
+            await_promise(ctx.env, result, ctx.value.err_tx.clone(), handler);
+            Ok(())
+        }
+        Err(err) => {
+            let res = handler.error(ctx.env, err);
+            _ = ctx.value.err_tx.send(res);
+            Ok(())
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy)]
+struct RawPromiseHandler;
+
+impl PromiseHandler for RawPromiseHandler {
+    type Output = Result<(), api::Error>;
+
+    fn resolve(&self, _env: Env, _val: Option<JsUnknown>) -> Self::Output {
+        Ok(())
+    }
+
+    fn reject(&self, env: Env, val: napi::JsUnknown) -> Self::Output {
+        Err(coerce_to_api_error(env, val)?)
+    }
+
+    fn error(&self, _: Env, err: napi::Error) -> Self::Output {
+        Err(api::Error {
+            code: api::ErrCode::Internal,
+            message: api::ErrCode::Internal.default_public_message().into(),
+            internal_message: Some(err.to_string()),
+            stack: None,
+            details: None,
+        })
+    }
+}
diff --git a/runtimes/js/src/request_meta.rs b/runtimes/js/src/request_meta.rs
new file mode 100644
index 0000000000..72d8f6930b
--- /dev/null
+++ b/runtimes/js/src/request_meta.rs
@@ -0,0 +1,187 @@
+use chrono::{DateTime, SecondsFormat, Utc};
+use napi_derive::napi;
+
+use encore_runtime_core::{api::reqauth::meta::HeaderValueExt, model};
+
+use crate::pvalue::PVals;
+
+pub fn meta(req: &model::Request) -> Result<RequestMeta, serde_json::Error> {
+    let dt: DateTime<Utc> = req.start_time.into();
+    let started_at = dt.to_rfc3339_opts(SecondsFormat::Secs, true);
+
+    let (api_call, pubsub_message) = match &req.data {
+        model::RequestData::RPC(rpc) => {
+            let api = APICallData {
+                api: APIDesc {
+                    service: rpc.endpoint.name.service().to_string(),
+                    endpoint: rpc.endpoint.name.endpoint().to_string(),
+                    raw: rpc.endpoint.raw,
+                    requires_auth: rpc.endpoint.requires_auth,
+                    tags: rpc.endpoint.tags.clone(),
+                },
+                method: rpc.method.as_str().to_string(),
+                path: rpc.path.clone(),
+                path_and_query: rpc.path_and_query.clone(),
+                path_params: rpc
+                    .path_params
+                    .as_ref()
+                    .map(serde_json::to_value)
+                    .transpose()?,
+                parsed_payload: rpc
+                    .parsed_payload
+                    .as_ref()
+                    .map(serde_json::to_value)
+                    .transpose()?,
+                headers: serialize_headers(&rpc.req_headers),
+            };
+            (Some(api), None)
+        }
+
+        model::RequestData::Stream(data) => {
+            let api = APICallData {
+                api: APIDesc {
+                    service: data.endpoint.name.service().to_string(),
+                    endpoint: data.endpoint.name.endpoint().to_string(),
+                    raw: data.endpoint.raw,
+                    requires_auth: data.endpoint.requires_auth,
+                    tags: data.endpoint.tags.clone(),
+                },
+                method: Default::default(),
+                path: data.path.clone(),
+                path_and_query: data.path_and_query.clone(),
+                path_params: data
+                    .path_params
+                    .as_ref()
+                    .map(serde_json::to_value)
+                    .transpose()?,
+                parsed_payload: data
+                    .parsed_payload
+                    .as_ref()
+                    .map(serde_json::to_value)
+                    .transpose()?,
+                headers: Default::default(),
+            };
+            (Some(api), None)
+        }
+        model::RequestData::PubSub(msg) => {
+            let pubsub_message = PubSubMessageData {
+                service: msg.service.to_string(),
+                topic: msg.topic.to_string(),
+                subscription: msg.subscription.to_string(),
+                id: msg.message_id.clone(),
+                published_at: msg.published.to_rfc3339_opts(SecondsFormat::Secs, true),
+                delivery_attempt: msg.attempt,
+                parsed_payload: msg.parsed_payload.as_ref().map(|pv| PVals(pv.clone())),
+            };
+            (None, Some(pubsub_message))
+        }
+        model::RequestData::Auth(_) => (None, None),
+    };
+
+    let trace = Some(TraceData {
+        trace_id: req.span.0.serialize_encore(),
+        span_id: req.span.1.serialize_encore(),
+        parent_trace_id: req.parent_trace.map(|id| id.serialize_encore()),
+        parent_span_id: req.parent_span.map(|id| id.1.serialize_encore()),
+        ext_correlation_id: req.ext_correlation_id.clone(),
+    });
+
+    Ok(RequestMeta {
+        started_at,
+        trace,
+        api_call,
+        pubsub_message,
+    })
+}
+
+#[napi(object)]
+pub struct RequestMeta {
+    pub started_at: String,
+    pub trace: Option<TraceData>,
+    pub api_call: Option<APICallData>,
+    pub pubsub_message: Option<PubSubMessageData>,
+}
+
+#[napi(object)]
+pub struct APICallData {
+    pub api: APIDesc,
+    pub method: String,
+    pub path: String,
+    pub path_and_query: String,
+    pub path_params: Option<serde_json::Value>,
+    pub parsed_payload: Option<serde_json::Value>,
+    pub headers: serde_json::Map<String, serde_json::Value>,
+}
+
+#[napi(object)]
+pub struct APIDesc {
+    pub service: String,
+    pub endpoint: String,
+    pub raw: bool,
+    pub requires_auth: bool,
+    pub tags: Vec<String>,
+}
+
+#[napi(object)]
+pub struct PubSubMessageData {
+    pub service: String,
+    pub topic: String,
+    pub subscription: String,
+    pub id: String,
+    pub published_at: String,
+    pub delivery_attempt: u32,
+    pub parsed_payload: Option<PVals>,
+}
+
+#[napi(object)]
+pub struct TraceData {
+    pub trace_id: String,
+    pub span_id: String,
+    pub parent_trace_id: Option<String>,
+    pub parent_span_id: Option<String>,
+    pub ext_correlation_id: Option<String>,
+}
+
+fn serialize_headers(
+    headers: &axum::http::HeaderMap,
+) -> serde_json::Map<String, serde_json::Value> {
+    use serde_json::{map::Entry, Map, Value};
+    let mut map = Map::with_capacity(headers.len());
+
+    for (k, v) in headers {
+        let Ok(v) = v.to_utf8_str() else {
+            continue;
+        };
+
+        // Skip Encore-internal headers.
+        if v.starts_with("x-encore-meta") {
+            continue;
+        }
+
+        let v = Value::String(v.to_string());
+
+        // Insert the value as a string value if the entry does not yet exist.
+        // If it does exist, convert it to an array and append the new value.
+        match map.entry(k.as_str().to_string()) {
+            Entry::Vacant(entry) => {
+                entry.insert(v);
+            }
+
+            Entry::Occupied(entry) => {
+                let arr = entry.into_mut();
+                match arr {
+                    Value::String(s) => {
+                        let str = std::mem::replace(s, "".to_string());
+                        *arr = Value::Array(vec![Value::String(str), v]);
+                    }
+                    Value::Array(arr) => {
+                        arr.push(v);
+                    }
+                    _ => unreachable!(),
+                }
+            }
+        }
+    }
+
+    map
+}
diff --git a/runtimes/js/src/runtime.rs b/runtimes/js/src/runtime.rs
new file mode 100644
index 0000000000..c7251c3bb9
--- /dev/null
+++ b/runtimes/js/src/runtime.rs
@@ -0,0 +1,480 @@
+use crate::api::{new_api_handler, APIRoute, Request};
+use crate::gateway::{Gateway, GatewayConfig};
+use crate::log::Logger;
+use crate::napi_util::EnvMap;
+use crate::pubsub::{PubSubSubscription, PubSubSubscriptionConfig, PubSubTopic};
+use crate::pvalue::{parse_pvalues, transform_pvalues_request, PVals};
+use crate::secret::Secret;
+use crate::sqldb::SQLDatabase;
+use crate::{meta, objects, websocket_api};
+use encore_runtime_core::api::{AuthOpts, PValues};
+use encore_runtime_core::pubsub::SubName;
+use encore_runtime_core::{api, EncoreName, EndpointName};
+use napi::Ref;
+use napi::{bindgen_prelude::*, JsFunction, JsObject};
+use napi::{Error, JsUnknown, Status};
+use napi_derive::napi;
+use std::future::Future;
+use std::str::FromStr;
+use std::sync::{Arc, OnceLock};
+use std::thread;
+
+// TODO: remove storing of result after `get_or_try_init` is stabilized
+static RUNTIME: OnceLock<napi::Result<Arc<encore_runtime_core::Runtime>>> = OnceLock::new();
+
+// Type constructors registered from javascript so we can create those type from rust
+static TYPE_CONSTRUCTORS: EnvMap<Arc<TypeConstructorRefs>> = EnvMap::new();
+
+struct TypeConstructorRefs {
+    decimal: Ref<()>,
+}
+
+#[napi]
+pub struct Runtime {
+    pub(crate) runtime: Arc<encore_runtime_core::Runtime>,
+}
+
+#[napi]
+impl Runtime {
+    pub fn create_decimal(env: Env, val: &str) -> napi::Result<JsUnknown> {
+        let constructors = TYPE_CONSTRUCTORS.get(env).ok_or_else(|| {
+            Error::new(Status::GenericFailure, "Type constructors not initialized")
+        })?;
+
+        let constructor: JsFunction = env.get_reference_value(&constructors.decimal)?;
+        constructor.call(None, &[env.create_string(val)?])
+    }
+}
+
+#[napi(object)]
+pub struct RuntimeTypeConstructors {
+    pub decimal: JsFunction,
+}
+
+#[napi(object)]
+pub struct RuntimeOptions {
+    pub test_mode: Option<bool>,
+    pub type_constructors: RuntimeTypeConstructors,
+}
+
+fn init_runtime(test_mode: bool) -> napi::Result<encore_runtime_core::Runtime> {
+    // Initialize logging.
+    encore_runtime_core::log::init();
+
+    encore_runtime_core::Runtime::builder()
+        .with_test_mode(test_mode)
+        .with_meta_autodetect()
+        .with_runtime_config_from_env()
+        .build()
+        .map_err(|e| {
+            Error::new(
+                Status::GenericFailure,
+                format!("failed to initialize runtime: {e:?}"),
+            )
+        })
+}
+
+#[napi]
+impl Runtime {
+    #[napi(constructor)]
+    pub fn new(env: Env, options: RuntimeOptions) -> napi::Result<Self> {
+        let test_mode = options
+            .test_mode
+            .unwrap_or(std::env::var("NODE_ENV").is_ok_and(|val| val == "test"));
+
+        if test_mode {
+            // Don't reuse the runtime in tests, as vitest and other test frameworks
+            // use multiple workers to isolate tests from each other. We don't want tests
+            // to be making API calls to other tests' workers.
+            let runtime = Arc::new(init_runtime(true)?);
+
+            // If we're running tests, there's no specific entrypoint so
+            // start the runtime in the background immediately.
+            {
+                let rt = runtime.clone();
+                thread::spawn(move || {
+                    rt.run_blocking();
+                });
+            }
+
+            return Ok(Self { runtime });
+        }
+
+        let runtime = RUNTIME
+            .get_or_init(|| Ok(Arc::new(init_runtime(false)?)))
+            .clone()?;
+
+        TYPE_CONSTRUCTORS.get_or_init(env, || {
+            Arc::new(TypeConstructorRefs {
+                decimal: env
+                    .create_reference(options.type_constructors.decimal)
+                    .expect("couldn't create reference to Decimal"),
+            })
+        });
+
+        Ok(Self { runtime })
+    }
+
+    #[napi]
+    pub async fn run_forever(&self) {
+        let runtime = self.runtime.clone();
+        thread::spawn(move || {
+            runtime.run_blocking();
+        });
+
+        // Block the async function forever.
+        futures::future::pending::<()>().await;
+    }
+
+    #[napi]
+    pub fn sql_database(&self, encore_name: String) -> SQLDatabase {
+        let encore_name: encore_runtime_core::EncoreName = encore_name.into();
+        let db = self.runtime.sqldb().database(&encore_name);
+        SQLDatabase::new(db)
+    }
+
+    #[napi]
+    pub fn pubsub_topic(&self, encore_name: String) -> napi::Result<PubSubTopic> {
+        let topic = self
+            .runtime
+            .pubsub()
+            .topic(encore_name.into())
+            .ok_or_else(|| Error::new(Status::GenericFailure, "topic not found"))?;
+        Ok(PubSubTopic::new(topic))
+    }
+
+    #[napi]
+    pub fn bucket(&self, encore_name: String) -> napi::Result<objects::Bucket> {
+        let bkt = self
+            .runtime
+            .objects()
+            .bucket(encore_name.into())
+            .ok_or_else(|| Error::new(Status::GenericFailure, "bucket not found"))?;
+        Ok(objects::Bucket::new(bkt))
+    }
+
+    #[napi]
+    pub fn gateway(
+        &self,
+        env: Env,
+        encore_name: String,
+        cfg: GatewayConfig,
+    ) -> napi::Result<Gateway> {
+        let name: EncoreName = encore_name.into();
+        let gw = self.runtime.api().gateway(&name).cloned();
+        Gateway::new(env, gw, cfg)
+    }
+
+    /// Gets the root logger from the runtime
+    #[napi]
+    pub fn logger(&self) -> Logger {
+        Logger::new()
+    }
+
+    #[napi]
+    pub fn pubsub_subscription(
+        &self,
+        env: Env,
+        cfg: PubSubSubscriptionConfig,
+    ) -> napi::Result<PubSubSubscription> {
+        let handler = Arc::new(cfg.to_handler(env)?);
+        let sub = self
+            .runtime
+            .pubsub()
+            .subscription(SubName {
+                topic: cfg.topic_name.into(),
+                subscription: cfg.subscription_name.into(),
+            })
+            .ok_or_else(|| Error::new(Status::GenericFailure, "subscription not found"))?;
+        Ok(PubSubSubscription::new(sub, handler))
+    }
+
+    #[napi]
+    pub fn register_handler(&self, env: Env, route: APIRoute) -> napi::Result<()> {
+        let endpoint_name = encore_runtime_core::EndpointName::new(route.service, route.name);
+
+        let eps = self.runtime.api().endpoints();
+        let resp_schema = eps.get(&endpoint_name).map(|ep| ep.response.clone());
+
+        let handler = new_api_handler(
+            env,
+            route.handler,
+            route.raw,
+            route.streaming_request || route.streaming_response,
+            resp_schema,
+        )?;
+
+        // If we're not hosting an API server, this is a no-op.
+        let Some(srv) = self.runtime.api().server() else {
+            return Ok(());
+        };
+
+        srv.register_handler(endpoint_name, handler).map_err(|e| {
+            Error::new(
+                Status::GenericFailure,
+                format!("failed to register handler: {e:?}"),
+            )
+        })
+    }
+
+    #[napi]
+    pub fn register_test_handler(&self, env: Env, route: APIRoute) -> napi::Result<()> {
+        // Currently no difference between test and non-test handlers.
+        self.register_handler(env, route)
+    }
+
+    #[napi]
+    pub fn register_handlers(&self, env: Env, routes: Vec<APIRoute>) -> napi::Result<()> {
+        for route in routes {
+            self.register_handler(env, route)?;
+        }
+        Ok(())
+    }
+
+    #[napi]
+    pub fn secret(&self, encore_name: String) -> Option<Secret> {
+        self.runtime
+            .secrets()
+            .app_secret(encore_name.into())
+            .map(Secret::new)
+    }
+
+    #[napi(ts_return_type = "Promise<Record<string, any> | null | ApiCallError>")]
+    pub fn api_call(
+        &self,
+        env: Env,
+        service: String,
+        endpoint: String,
+        payload: Option<JsUnknown>,
+        source: Option<&Request>,
+        opts: Option<CallOpts>,
+    ) -> napi::Result<JsObject> {
+        let endpoint_name = encore_runtime_core::EndpointName::new(service, endpoint);
+
+        let eps = self.runtime.api().endpoints();
+        let req_schema = eps.get(&endpoint_name).map(|ep| ep.request[0].clone());
+
+        let payload = payload
+            .and_then(|p| parse_pvalues(p).transpose())
+            .transpose()?
+            .map(|payload| match req_schema {
+                Some(schema) => transform_pvalues_request(payload, schema)
+                    .map_err(|err| napi::Error::new(napi::Status::InvalidArg, err.to_string())),
+                None => Ok(payload),
+            })
+            .transpose()?;
+
+        let opts = opts.map(TryFrom::try_from).transpose()?;
+        let fut = self.do_api_call(endpoint_name, payload, source, opts);
+        let fut = async move {
+            let res: napi::Result<Either<Option<PValues>, APICallError>> = match fut.await {
+                Ok(data) => Ok(Either::A(data)),
+                Err(err) => Ok(Either::B(err.into())),
+            };
+            res
+        };
+
+        env.execute_tokio_future(fut, |&mut _env, res| {
+            Ok(match res {
+                Either::A(pvals) => Either::A(pvals.map(PVals)),
+                Either::B(err) => Either::B(err),
+            })
+        })
+    }
+
+    fn do_api_call<'a>(
+        &'a self,
+        endpoint: EndpointName,
+        payload: Option<PValues>,
+        source: Option<&'a Request>,
+        opts: Option<api::CallOpts>,
+    ) -> impl Future<Output = api::APIResult<Option<PValues>>> + 'static {
+        let source = source.map(|s| s.inner.clone());
+        let fut = self.runtime.api().call(endpoint, payload, source, opts);
+
+        async move {
+            let data = fut.await?;
+            Ok(match (data.header, data.body) {
+                (None, api::Body::Raw(_) | api::Body::Typed(None)) => None,
+                (None, api::Body::Typed(Some(body))) => Some(body),
+                (Some(header), api::Body::Raw(_) | api::Body::Typed(None)) => Some(header),
+                (Some(header), api::Body::Typed(Some(body))) => {
+                    let mut combined = header;
+                    combined.extend(body);
+                    Some(combined)
+                }
+            })
+        }
+    }
+
+    #[napi(ts_return_type = "Promise<WebSocketClient>")]
+    pub fn stream(
+        &self,
+        env: Env,
+        service: String,
+        endpoint: String,
+        payload: Option<JsUnknown>,
+        source: Option<&Request>,
+        opts: Option<CallOpts>,
+    ) -> napi::Result<JsObject> {
+        let payload = match payload {
+            Some(payload) => parse_pvalues(payload)?,
+            None => None,
+        };
+        let endpoint = encore_runtime_core::EndpointName::new(service, endpoint);
+        let source = source.map(|s| s.inner.clone());
+        let opts = opts.map(TryFrom::try_from).transpose()?;
+        let fut = self.runtime.api().stream(endpoint, payload, source, opts);
+
+        let fut = async move {
+            fut.await.map_err(|e| {
+                Error::new(
+                    Status::GenericFailure,
+                    format!("failed to make api call: {e:?}"),
+                )
+            })
+        };
+
+        env.execute_tokio_future(fut, |&mut _env, res| {
+            Ok(websocket_api::WebSocketClient::new(res))
+        })
+    }
+
+    /// Returns the version of the Encore runtime being used
+    #[napi]
+    pub fn version() -> String {
+        encore_runtime_core::version().to_string()
+    }
+
+    /// Returns the git commit hash used to build the Encore runtime
+    #[napi]
+    pub fn build_commit() -> String {
+        encore_runtime_core::build_commit().to_string()
+    }
+
+    #[napi]
+    pub fn app_meta(&self) -> meta::AppMeta {
+        let md = self.runtime.app_meta();
+        md.clone().into()
+    }
+
+    /// Reports the total number of worker threads,
+    /// including the main thread.
+    #[napi]
+    pub fn num_worker_threads(&self) -> u32 {
+        match self.runtime.compute().worker_threads {
+            Some(n) => {
+                if n > 0 {
+                    n as u32
+                } else {
+                    num_cpus::get() as u32
+                }
+            }
+            None => 1u32,
+        }
+    }
+}
+
+#[napi(object)]
+#[derive(Clone, Default, Debug)]
+/// CallOpts can be used to set options for API calls.
+pub struct CallOpts {
+    pub auth_data: Option<PVals>,
+}
+
+impl TryFrom<CallOpts> for api::CallOpts {
+    type Error = napi::Error<napi::Status>;
+
+    fn try_from(value: CallOpts) -> Result<api::CallOpts> {
+        let auth = if let Some(ref data) = value.auth_data {
+            let user_id = data
+                .0
+                .get("userID")
+                .and_then(|v| v.as_str())
+                .ok_or_else(|| {
+                    napi::Error::new(napi::Status::InvalidArg, "userID missing in auth data")
+                })?;
+            Some(AuthOpts {
+                user_id: user_id.to_string(),
+                data: data.0.clone(),
+            })
+        } else {
+            None
+        };
+
+        Ok(api::CallOpts { auth })
+    }
+}
+
+#[napi]
+pub struct APICallError {
+    pub code: String,
+    pub message: String,
+    pub details: Option<PVals>,
+}
+
+impl From<api::Error> for APICallError {
+    fn from(value: api::Error) -> Self {
+        Self {
+            code: value.code.to_string(),
+            message: value.message,
+            details: value.details.map(|d| PVals(*d)),
+        }
+    }
+}
+
+#[napi]
+pub struct Decimal {
+    inner: encore_runtime_core::api::Decimal,
+}
+
+#[napi]
+impl Decimal {
+    #[napi(constructor)]
+    pub fn new(value: String) -> napi::Result<Self> {
+        match encore_runtime_core::api::Decimal::from_str(&value) {
+            Ok(decimal) => Ok(Self { inner: decimal }),
+            Err(err) => Err(Error::new(
+                Status::InvalidArg,
+                format!("Invalid decimal format: '{}'", err),
+            )),
+        }
+    }
+
+    #[napi(js_name = "toString")]
+    pub fn js_to_string(&self) -> String {
+        self.inner.to_string()
+    }
+
+    #[napi]
+    pub fn add(&self, other: &Decimal) -> Decimal {
+        use std::ops::Add;
+        Decimal {
+            inner: self.inner.add(&other.inner),
+        }
+    }
+
+    #[napi]
+    pub fn sub(&self, other: &Decimal) -> Decimal {
+        use std::ops::Sub;
+        Decimal {
+            inner: self.inner.sub(&other.inner),
+        }
+    }
+
+    #[napi]
+    pub fn mul(&self, other: &Decimal) -> Decimal {
+        use std::ops::Mul;
+        Decimal {
+            inner: self.inner.mul(&other.inner),
+        }
+    }
+
+    #[napi]
+    pub fn div(&self, other: &Decimal) -> Decimal {
+        use std::ops::Div;
+        Decimal {
+            inner: self.inner.div(&other.inner),
+        }
+    }
+}
diff --git a/runtimes/js/src/secret.rs b/runtimes/js/src/secret.rs
new file mode 100644
index 0000000000..25c78bbe0f
--- /dev/null
+++ b/runtimes/js/src/secret.rs
@@ -0,0 +1,30 @@
+use napi::{Error, Status};
+use napi_derive::napi;
+use std::sync::Arc;
+
+#[napi]
+pub struct Secret {
+    secret: Arc<encore_runtime_core::secrets::Secret>,
+}
+
+impl Secret {
+    pub fn new(secret: Arc<encore_runtime_core::secrets::Secret>) -> Self {
+        Self { secret }
+    }
+}
+
+#[napi]
+impl Secret {
+    /// Returns the cached value of the secret.
+    #[napi]
+    pub fn cached(&self) -> napi::Result<String> {
+        let val = self.secret.get().map_err(|e| {
+            Error::new(
+                Status::GenericFailure,
+                format!("failed to resolve secret: {e}"),
+            )
+        })?;
+        String::from_utf8(val.to_vec())
+            .map_err(|e| Error::new(Status::GenericFailure, e.to_string()))
+    }
+}
diff --git a/runtimes/js/src/sqldb.rs b/runtimes/js/src/sqldb.rs
new file mode 100644
index 0000000000..80861719e8
--- /dev/null
+++ b/runtimes/js/src/sqldb.rs
@@ -0,0 +1,309 @@
+use crate::api::Request;
+use crate::pvalue::{parse_pvalue, pvalue_to_js};
+use encore_runtime_core::sqldb;
+use mappable_rc::Marc;
+use napi::{Env, JsUnknown};
+use napi_derive::napi;
+use std::collections::HashMap;
+use std::fmt::Display;
+use std::sync::{Arc, OnceLock};
+
+#[napi]
+pub struct SQLDatabase {
+    db: Arc<dyn sqldb::Database>,
+    pool: OnceLock<Marc<napi::Result<sqldb::Pool>>>,
+}
+
+#[napi]
+pub struct QueryArgs {
+    values: std::sync::Mutex<Vec<sqldb::RowValue>>,
+}
+
+#[napi]
+impl QueryArgs {
+    #[napi(constructor)]
+    pub fn new(params: Vec<JsUnknown>) -> napi::Result<Self> {
+        let values = convert_row_values(params)?;
+        Ok(Self {
+            values: std::sync::Mutex::new(values),
+        })
+    }
+}
+
+fn convert_row_values(params: Vec<JsUnknown>) -> napi::Result<Vec<sqldb::RowValue>> {
+    use napi::JsBuffer;
+    params
+        .into_iter()
+        .map(|val| -> napi::Result<sqldb::RowValue> {
+            if val.is_buffer()? {
+                let buf: JsBuffer = val.try_into()?;
+                let buf = buf.into_value()?;
+                return Ok(sqldb::RowValue::Bytes(buf.to_vec()));
+            }
+            let pval = parse_pvalue(val)?;
+            Ok(sqldb::RowValue::PVal(pval))
+        })
+        .collect()
+}
+
+#[napi]
+impl SQLDatabase {
+    pub(crate) fn new(db: Arc<dyn sqldb::Database>) -> Self {
+        Self {
+            db,
+            pool: OnceLock::new(),
+        }
+    }
+
+    /// Reports the connection string to connect to this database.
+    #[napi]
+    pub fn conn_string(&self) -> &str {
+        self.db.proxy_conn_string()
+    }
+
+    /// Begins a transaction
+    #[napi]
+    pub async fn begin(&self, source: Option<&Request>) -> napi::Result<Transaction> {
+        let source = source.map(|s| s.inner.as_ref());
+        let tx = self
+            .pool()?
+            .begin(source)
+            .await
+            .map_err(|e| napi::Error::new(napi::Status::GenericFailure, e.to_string()))?;
+
+        Ok(Transaction {
+            tx: tokio::sync::Mutex::new(Some(tx)),
+        })
+    }
+
+    #[napi]
+    pub async fn query(
+        &self,
+        query: String,
+        args: &QueryArgs,
+        source: Option<&Request>,
+    ) -> napi::Result<Cursor> {
+        let values: Vec<_> = args.values.lock().unwrap().drain(..).collect();
+        let source = source.map(|s| s.inner.as_ref());
+        let stream = self
+            .pool()?
+            .query_raw(&query, values, source)
+            .await
+            .map_err(|e| napi::Error::new(napi::Status::GenericFailure, e.to_string()))?;
+        Ok(Cursor {
+            stream: tokio::sync::Mutex::new(stream),
+        })
+    }
+
+    #[napi]
+    pub async fn query_row(
+        &self,
+        query: String,
+        args: &QueryArgs,
+        source: Option<&Request>,
+    ) -> napi::Result<Option<Row>> {
+        let values: Vec<_> = args.values.lock().unwrap().drain(..).collect();
+        let source = source.map(|s| s.inner.as_ref());
+        let mut stream = self
+            .pool()?
+            .query_raw(&query, values, source)
+            .await
+            .map_err(|e| napi::Error::new(napi::Status::GenericFailure, e.to_string()))?;
+        let row = stream
+            .next()
+            .await
+            .transpose()
+            .map_err(|e| napi::Error::new(napi::Status::GenericFailure, e.to_string()))?;
+        Ok(row.map(|row| Row { row }))
+    }
+
+    fn pool(&self) -> napi::Result<&sqldb::Pool> {
+        match self.pool_marc().as_ref() {
+            Ok(pool) => Ok(pool),
+            Err(e) => Err(e.clone()),
+        }
+    }
+
+    fn pool_marc(&self) -> &Marc<napi::Result<sqldb::Pool>> {
+        self.pool.get_or_init(|| {
+            let pool = self
+                .db
+                .new_pool()
+                .map_err(|e| napi::Error::new(napi::Status::GenericFailure, e));
+            Marc::new(pool)
+        })
+    }
+}
+
+#[napi]
+pub struct Transaction {
+    tx: tokio::sync::Mutex<Option<sqldb::Transaction>>,
+}
+
+#[napi]
+impl Transaction {
+    #[napi]
+    pub async fn commit(&self, source: Option<&Request>) -> napi::Result<()> {
+        let source = source.map(|s| s.inner.as_ref());
+        let tx = self.tx.lock().await.take().ok_or(napi::Error::new(
+            napi::Status::GenericFailure,
+            "transaction closed",
+        ))?;
+        tx.commit(source)
+            .await
+            .map_err(|e| napi::Error::new(napi::Status::GenericFailure, e.to_string()))
+    }
+
+    #[napi]
+    pub async fn rollback(&self, source: Option<&Request>) -> napi::Result<()> {
+        let source = source.map(|s| s.inner.as_ref());
+        let tx = self.tx.lock().await.take().ok_or(napi::Error::new(
+            napi::Status::GenericFailure,
+            "transaction closed",
+        ))?;
+        tx.rollback(source)
+            .await
+            .map_err(|e| napi::Error::new(napi::Status::GenericFailure, e.to_string()))
+    }
+
+    #[napi]
+    pub async fn query(
+        &self,
+        query: String,
+        args: &QueryArgs,
+        source: Option<&Request>,
+    ) -> napi::Result<Cursor> {
+        let values: Vec<_> = args.values.lock().unwrap().drain(..).collect();
+        let source = source.map(|s| s.inner.as_ref());
+        let tx = self.tx.lock().await;
+        let stream = tx
+            .as_ref()
+            .ok_or(napi::Error::new(
+                napi::Status::GenericFailure,
+                "transaction closed",
+            ))?
+            .query_raw(&query, values, source)
+            .await
+            .map_err(|e| napi::Error::new(napi::Status::GenericFailure, e.to_string()))?;
+        Ok(Cursor {
+            stream: tokio::sync::Mutex::new(stream),
+        })
+    }
+}
+
+#[napi]
+pub struct Cursor {
+    stream: tokio::sync::Mutex<sqldb::Cursor>,
+}
+
+#[napi]
+pub struct Row {
+    row: sqldb::Row,
+}
+
+#[napi]
+impl Row {
+    #[napi]
+    pub fn values(&self, env: Env) -> napi::Result<HashMap<String, JsUnknown>> {
+        let vals = self.row.values()?;
+        let mut map = HashMap::with_capacity(vals.len());
+        for (key, val) in vals {
+            let val: JsUnknown = match val {
+                sqldb::RowValue::PVal(val) => pvalue_to_js(env, &val)?,
+                sqldb::RowValue::Bytes(val) => {
+                    env.create_arraybuffer_with_data(val)?.into_unknown()
+                }
+                sqldb::RowValue::Uuid(val) => env.create_string(&val.to_string())?.into_unknown(),
+                sqldb::RowValue::Cidr(val) => env.create_string(&val.to_string())?.into_unknown(),
+                sqldb::RowValue::Inet(val) => env.create_string(&val.to_string())?.into_unknown(),
+            };
+            map.insert(key, val);
+        }
+        Ok(map)
+    }
+}
+
+#[napi]
+impl Cursor {
+    #[napi]
+    pub async fn next(&self) -> napi::Result<Option<Row>> {
+        let mut stream = self.stream.lock().await;
+        let row = stream
+            .next()
+            .await
+            .transpose()
+            .map_err(|e| napi::Error::new(napi::Status::GenericFailure, format!("{e:#?}")))?;
+
+        Ok(row.map(|row| Row { row }))
+    }
+}
+
+#[napi]
+impl SQLDatabase {
+    #[napi]
+    pub async fn acquire(&self) -> napi::Result<SQLConn> {
+        let conn = self.pool()?.acquire().await.map_err(to_napi_err)?;
+        log::info!("acquired connection");
+        Ok(SQLConn {
+            inner: Arc::new(conn),
+        })
+    }
+}
+
+#[napi]
+pub struct SQLConn {
+    inner: Arc<sqldb::Connection>,
+}
+
+#[napi]
+impl SQLConn {
+    #[napi]
+    pub async fn close(&self) {
+        self.inner.close().await
+    }
+
+    #[napi]
+    pub async fn query(
+        &self,
+        query: String,
+        args: &QueryArgs,
+        source: Option<&Request>,
+    ) -> napi::Result<Cursor> {
+        let values: Vec<_> = args.values.lock().unwrap().drain(..).collect();
+        let source = source.map(|s| s.inner.as_ref());
+        let stream = self
+            .inner
+            .query_raw(&query, values, source)
+            .await
+            .map_err(|e| napi::Error::new(napi::Status::GenericFailure, e.to_string()))?;
+        Ok(Cursor {
+            stream: tokio::sync::Mutex::new(stream),
+        })
+    }
+
+    #[napi]
+    pub async fn query_row(
+        &self,
+        query: String,
+        args: &QueryArgs,
+        source: Option<&Request>,
+    ) -> napi::Result<Option<Row>> {
+        let values: Vec<_> = args.values.lock().unwrap().drain(..).collect();
+        let source = source.map(|s| s.inner.as_ref());
+        let mut stream = self
+            .inner
+            .query_raw(&query, values, source)
+            .await
+            .map_err(|e| napi::Error::new(napi::Status::GenericFailure, e.to_string()))?;
+        let row = stream
+            .next()
+            .await
+            .transpose()
+            .map_err(|e| napi::Error::new(napi::Status::GenericFailure, e.to_string()))?;
+        Ok(row.map(|row| Row { row }))
+    }
+}
+
+fn to_napi_err<E: Display>(e: E) -> napi::Error {
+    napi::Error::new(napi::Status::GenericFailure, e.to_string())
+}
diff --git a/runtimes/js/src/stream/mod.rs b/runtimes/js/src/stream/mod.rs
new file mode 100644
index 0000000000..62955290ce
--- /dev/null
+++ b/runtimes/js/src/stream/mod.rs
@@ -0,0 +1,2 @@
+pub mod read;
+pub mod write;
diff --git a/runtimes/js/src/stream/read.rs b/runtimes/js/src/stream/read.rs
new file mode 100644
index 0000000000..5e95383f73
--- /dev/null
+++ b/runtimes/js/src/stream/read.rs
@@ -0,0 +1,236 @@
+use std::future::Future;
+
+use bytes::{Bytes, BytesMut};
+use futures::{Stream, StreamExt};
+use napi::{noop_finalize, Env, JsFunction, JsUnknown, NapiRaw, Status};
+
+use crate::threadsafe_function::{
+    ThreadSafeCallContext, ThreadsafeFunction, ThreadsafeFunctionCallMode,
+};
+
+pub struct Reader<S> {
+    state: ReaderState<S>,
+}
+
+impl<S, E> Reader<S>
+where
+    S: Stream<Item = Result<Bytes, E>> + Unpin + Send + 'static,
+    E: std::error::Error + Send + 'static,
+{
+    pub fn new(stream: S) -> Self {
+        Self {
+            state: ReaderState::Initial(stream),
+        }
+    }
+
+    pub fn start(&mut self, env: Env, push: JsFunction, destroy: JsFunction) -> napi::Result<()> {
+        let (tx, rx) = tokio::sync::mpsc::unbounded_channel();
+        let state = std::mem::replace(&mut self.state, ReaderState::Running(tx));
+        let stream = match state {
+            ReaderState::Initial(stream) => stream,
+            _ => {
+                return Err(napi::Error::new(
+                    Status::GenericFailure,
+                    "reader has already been started".to_owned(),
+                ))
+            }
+        };
+
+        let push = ThreadsafeFunction::create(
+            env.raw(),
+            // SAFETY: `push` is a valid JS function.
+            unsafe { push.raw() },
+            0,
+            execute_push,
+        )?;
+        let destroy = ThreadsafeFunction::create(
+            env.raw(),
+            // SAFETY: `destroy` is a valid JS function.
+            unsafe { destroy.raw() },
+            0,
+            execute_destroy,
+        )?;
+
+        let machine = StateMachine {
+            stream,
+            read_requests: rx,
+            push,
+            destroy,
+            did_destroy: false,
+        };
+        tokio::spawn(machine.run());
+        Ok(())
+    }
+
+    pub fn read(&self) -> napi::Result<()> {
+        match &self.state {
+            ReaderState::Running(tx) => {
+                let _ = tx.send(());
+                Ok(())
+            }
+            ReaderState::Initial(_) => Err(napi::Error::new(
+                Status::GenericFailure,
+                "reader has not been started".to_owned(),
+            )),
+        }
+    }
+}
+
+enum ReaderState<S> {
+    Initial(S),
+    Running(tokio::sync::mpsc::UnboundedSender<()>),
+}
+
+struct StateMachine<S> {
+    stream: S,
+    read_requests: tokio::sync::mpsc::UnboundedReceiver<()>,
+    push: ThreadsafeFunction<PushRequest>,
+    destroy: ThreadsafeFunction<DestroyRequest>,
+    did_destroy: bool,
+}
+
+impl<S, E> StateMachine<S>
+where
+    S: Stream<Item = Result<Bytes, E>> + Unpin + Send,
+    E: std::error::Error + Send + 'static,
+{
+    async fn run(mut self) {
+        'ReadRequestLoop: loop {
+            // Wait for a read request.
+            let Some(()) = self.read_requests.recv().await else {
+                // The sender was dropped.
+                self.notify_close();
+                return;
+            };
+
+            // Read repeatedly until push() returns false.
+            'PushLoop: loop {
+                match self.stream.next().await.transpose() {
+                    Ok(data) => {
+                        let is_none = data.is_none();
+                        match self.push(data).await {
+                            // The stream successfully ended.
+                            Ok(_) if is_none => {
+                                // Note: don't notify_close; the node:stream API will handle
+                                // automatically closing the stream when the data has actually been read.
+                                // If we close here we end up destroying the stream too early, preventing
+                                // the last data from being read.
+                                return;
+                            }
+
+                            // We haven't reached the high water mark yet; continue pushing data.
+                            Ok(true) => continue 'PushLoop,
+
+                            // We've reached the high water mark; wait for the next read request.
+                            Ok(false) => continue 'ReadRequestLoop,
+
+                            // Something went wrong communicating with node. Close the stream with an error.
+                            Err(err) => {
+                                self.notify_err(err);
+                                return;
+                            }
+                        }
+                    }
+                    Err(err) => {
+                        self.notify_err(err);
+                        return;
+                    }
+                }
+            }
+        }
+    }
+
+    fn notify_err<Err: std::error::Error + 'static>(&mut self, err: Err) {
+        if self.did_destroy {
+            return;
+        }
+        self.did_destroy = true;
+        let req = DestroyRequest {
+            err: Some(Box::new(err)),
+        };
+        self.destroy.call(req, ThreadsafeFunctionCallMode::Blocking);
+    }
+
+    fn notify_close(&mut self) {
+        if self.did_destroy {
+            return;
+        }
+        self.did_destroy = true;
+        let req = DestroyRequest { err: None };
+        self.destroy.call(req, ThreadsafeFunctionCallMode::Blocking);
+    }
+
+    fn push(&self, data: Option<Bytes>) -> impl Future<Output = napi::Result<bool>> {
+        let (tx, rx) = tokio::sync::oneshot::channel();
+        let req = PushRequest { data, response: tx };
+
+        let result = self.push.call(req, ThreadsafeFunctionCallMode::Blocking);
+
+        async move {
+            match result {
+                Status::Ok => match rx.await {
+                    Ok(more) => Ok(more),
+                    Err(_) => Err(napi::Error::new(
+                        Status::GenericFailure,
+                        "push response channel was dropped".to_owned(),
+                    )),
+                },
+
+                status => Err(napi::Error::new(
+                    status,
+                    "failed to call push function".to_owned(),
+                )),
+            }
+        }
+    }
+}
+
+struct PushRequest {
+    data: Option<Bytes>,
+    response: tokio::sync::oneshot::Sender<bool>,
+}
+
+fn execute_push(ctx: ThreadSafeCallContext<PushRequest>) -> napi::Result<()> {
+    let data: JsUnknown = match ctx.value.data {
+        Some(data) => {
+            // We need to convert this to a BytesMut since
+            // JavaScript may modify the buffer.
+            let mut data = BytesMut::from(data);
+            let buf = unsafe {
+                ctx.env.create_buffer_with_borrowed_data(
+                    data.as_mut_ptr(),
+                    data.len(),
+                    data,
+                    noop_finalize,
+                )?
+            };
+            buf.into_unknown()
+        }
+        None => ctx.env.get_null()?.into_unknown(),
+    };
+
+    let more = ctx
+        .callback
+        .unwrap()
+        .call(None, &[data])?
+        .coerce_to_bool()?
+        .get_value()?;
+    _ = ctx.value.response.send(more);
+    Ok(())
+}
+
+struct DestroyRequest {
+    err: Option<Box<dyn std::error::Error>>,
+}
+
+fn execute_destroy(ctx: ThreadSafeCallContext<DestroyRequest>) -> napi::Result<()> {
+    if let Some(err) = ctx.value.err {
+        let err = ctx
+            .env
+            .create_error(napi::Error::new(Status::GenericFailure, err.to_string()))?;
+        ctx.callback.unwrap().call(None, &[err.into_unknown()])?;
+    } else {
+        ctx.callback.unwrap().call_without_args(None)?;
+    }
+    Ok(())
+}
diff --git a/runtimes/js/src/stream/write.rs b/runtimes/js/src/stream/write.rs
new file mode 100644
index 0000000000..6eb543d8c7
--- /dev/null
+++ b/runtimes/js/src/stream/write.rs
@@ -0,0 +1,214 @@
+use std::collections::VecDeque;
+use std::pin::Pin;
+use std::task::{Context, Poll};
+
+use bytes::Bytes;
+use tokio::io::AsyncRead;
+use tokio::sync::oneshot;
+
+pub fn new() -> (WriteHalf, ReadHalf) {
+    let (sender, receiver) = tokio::sync::mpsc::unbounded_channel();
+    let write = WriteHalf { sender };
+    let read = ReadHalf {
+        events: receiver,
+        done: false,
+        done_callback: None,
+        bufs: VecDeque::with_capacity(16),
+        partial: None,
+    };
+    (write, read)
+}
+
+#[derive(Debug)]
+pub struct WriteHalf {
+    sender: tokio::sync::mpsc::UnboundedSender<StreamEvent>,
+}
+
+impl WriteHalf {
+    pub fn write(&mut self, data: Bytes, callback: Option<oneshot::Sender<()>>) {
+        // TODO: Log error?
+        _ = self.sender.send(StreamEvent {
+            data: StreamEventData::Write(data),
+            callback,
+        });
+    }
+
+    pub fn writev(&mut self, bufs: Vec<Bytes>, callback: Option<oneshot::Sender<()>>) {
+        // TODO: Log error?
+        _ = self.sender.send(StreamEvent {
+            data: StreamEventData::WriteMulti(bufs),
+            callback,
+        });
+    }
+
+    pub fn end(&mut self, callback: Option<oneshot::Sender<()>>) {
+        // TODO: Log error?
+        _ = self.sender.send(StreamEvent {
+            data: StreamEventData::End,
+            callback,
+        });
+    }
+}
+
+struct StreamEvent {
+    data: StreamEventData,
+    callback: Option<oneshot::Sender<()>>,
+}
+
+enum StreamEventData {
+    Write(Bytes),
+    WriteMulti(Vec<Bytes>),
+    End,
+}
+
+pub struct ReadHalf {
+    events: tokio::sync::mpsc::UnboundedReceiver<StreamEvent>,
+
+    // True if the write end has been closed.
+    done: bool,
+    done_callback: Option<oneshot::Sender<()>>,
+
+    // The bufs to read from.
+    bufs: VecDeque<BufWithCB>,
+    // The partially read buffer.
+    partial: Option<PartiallyRead>,
+}
+
+struct BufWithCB {
+    buf: Bytes,
+    callback: Option<oneshot::Sender<()>>,
+}
+
+struct PartiallyRead {
+    buf: Bytes,
+    pos: usize,
+    callback: Option<oneshot::Sender<()>>,
+}
+
+impl PartiallyRead {
+    /// The number of bytes left to read in the buffer.
+    fn len(&self) -> usize {
+        self.buf.len() - self.pos
+    }
+}
+
+impl AsyncRead for ReadHalf {
+    fn poll_read(
+        mut self: Pin<&mut Self>,
+        cx: &mut Context<'_>,
+        buf: &mut tokio::io::ReadBuf<'_>,
+    ) -> Poll<std::io::Result<()>> {
+        // First process any outstanding events.
+        if !self.done {
+            'EventLoop: loop {
+                match self.events.poll_recv(cx) {
+                    // The events channel has been closed.
+                    Poll::Ready(None) => {
+                        self.done = true;
+                        break 'EventLoop;
+                    }
+
+                    // There is no more events to read at the moment.
+                    Poll::Pending => break 'EventLoop,
+
+                    Poll::Ready(Some(event)) => {
+                        let mut callback = event.callback;
+                        match event.data {
+                            StreamEventData::Write(buf) => {
+                                self.bufs.push_back(BufWithCB { buf, callback });
+                            }
+                            StreamEventData::WriteMulti(bufs) => {
+                                let num_bufs = bufs.len();
+                                self.bufs.reserve(num_bufs);
+                                for (i, buf) in bufs.into_iter().enumerate() {
+                                    // Only add the callback to the last buffer.
+                                    let callback = if i == num_bufs - 1 {
+                                        callback.take()
+                                    } else {
+                                        None
+                                    };
+                                    self.bufs.push_back(BufWithCB { buf, callback });
+                                }
+                            }
+                            StreamEventData::End => {
+                                self.done = true;
+                                self.done_callback = callback;
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        let mut did_read = false;
+        'ReadLoop: loop {
+            let space_remaining = buf.remaining();
+            if space_remaining == 0 || (self.bufs.is_empty() && self.partial.is_none()) {
+                // No space remaining in the buffer, or no more data to read.
+                break 'ReadLoop;
+            }
+
+            // Determine the buffer to read from.
+            let mut partial = match self.partial.take() {
+                Some(partial) => partial,
+                None => {
+                    // Find the next non-empty buffer to read from.
+                    let next = 'BufferLoop: loop {
+                        match self.bufs.pop_front() {
+                            // Found a non-empty buffer.
+                            Some(next) if !next.buf.is_empty() => break next,
+                            // Found an empty buffer; skip it.
+                            Some(_) => continue 'BufferLoop,
+                            // No more buffers to read from.
+                            None => continue 'ReadLoop,
+                        }
+                    };
+                    PartiallyRead {
+                        buf: next.buf,
+                        pos: 0,
+                        callback: next.callback,
+                    }
+                }
+            };
+
+            // Post-condition: we have a non-empty buffer to read from, and self.partial is None.
+            assert!(self.partial.is_none());
+            assert!(partial.len() > 0);
+
+            if partial.len() > space_remaining {
+                // We can't fit the whole buffer in the space remaining.
+                let pos = partial.pos;
+                buf.put_slice(&partial.buf[pos..(pos + space_remaining)]);
+
+                // Store the partial read state in self.partial.
+                partial.pos += space_remaining;
+                self.partial = Some(partial);
+
+                return Poll::Ready(Ok(()));
+            } else {
+                // We can fit the whole buffer in the space remaining.
+                buf.put_slice(&partial.buf[partial.pos..]);
+
+                if let Some(callback) = partial.callback {
+                    _ = callback.send(());
+                }
+
+                // Store that we did read data so we can return Ready.
+                did_read = true;
+            }
+        }
+
+        if self.done {
+            if let Some(done_callback) = self.done_callback.take() {
+                _ = done_callback.send(());
+            }
+        }
+
+        if did_read || self.done {
+            // We read some data, or we're done, so we're ready.
+            Poll::Ready(Ok(()))
+        } else {
+            Poll::Pending
+        }
+    }
+}
diff --git a/runtimes/js/src/threadsafe_function.rs b/runtimes/js/src/threadsafe_function.rs
new file mode 100644
index 0000000000..bce58048e1
--- /dev/null
+++ b/runtimes/js/src/threadsafe_function.rs
@@ -0,0 +1,310 @@
+// Fork of threadsafe_function from napi-rs that allows calling JS function manually rather than
+// only returning args. This enables us to use the return value of the function.
+
+#![allow(clippy::single_component_path_imports)]
+
+use std::convert::Into;
+use std::ffi::CString;
+use std::fmt::Debug;
+use std::marker::PhantomData;
+use std::os::raw::c_void;
+use std::ptr;
+use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
+use std::sync::Arc;
+
+use napi::{check_status, sys, Env, Result, Status};
+use napi::{JsError, JsFunction, NapiValue};
+
+/// ThreadSafeFunction Context object
+/// the `value` is the value passed to `call` method
+pub struct ThreadSafeCallContext<T: 'static> {
+    pub env: Env,
+    pub value: T,
+    pub callback: Option<JsFunction>,
+}
+
+#[repr(u8)]
+pub enum ThreadsafeFunctionCallMode {
+    NonBlocking,
+    Blocking,
+}
+
+impl From<ThreadsafeFunctionCallMode> for sys::napi_threadsafe_function_call_mode {
+    fn from(value: ThreadsafeFunctionCallMode) -> Self {
+        match value {
+            ThreadsafeFunctionCallMode::Blocking => sys::ThreadsafeFunctionCallMode::blocking,
+            ThreadsafeFunctionCallMode::NonBlocking => sys::ThreadsafeFunctionCallMode::nonblocking,
+        }
+    }
+}
+
+/// Communicate with the addon's main thread by invoking a JavaScript function from other threads.
+///
+/// ## Example
+/// An example of using `ThreadsafeFunction`:
+///
+/// ```rust
+/// #[macro_use]
+/// extern crate napi_derive;
+///
+/// use std::thread;
+///
+/// use napi::{
+///     threadsafe_function::{
+///         ThreadSafeCallContext, ThreadsafeFunctionCallMode, ThreadsafeFunctionReleaseMode,
+///     },
+///     CallContext, Error, JsFunction, JsNumber, JsUndefined, Result, Status,
+/// };
+///
+/// #[js_function(1)]
+/// pub fn test_threadsafe_function(ctx: CallContext) -> Result<JsUndefined> {
+///   let func = ctx.get::<JsFunction>(0)?;
+///
+///   let tsfn =
+///       ctx
+///           .env
+///           .create_threadsafe_function(&func, 0, |ctx: ThreadSafeCallContext<Vec<u32>>| {
+///             ctx.value
+///                 .iter()
+///                 .map(|v| ctx.env.create_uint32(*v))
+///                 .collect::<Result<Vec<JsNumber>>>()
+///           })?;
+///
+///   let tsfn_cloned = tsfn.clone();
+///
+///   thread::spawn(move || {
+///       let output: Vec<u32> = vec![0, 1, 2, 3];
+///       // It's okay to call a threadsafe function multiple times.
+///       tsfn.call(Ok(output.clone()), ThreadsafeFunctionCallMode::Blocking);
+///   });
+///
+///   thread::spawn(move || {
+///       let output: Vec<u32> = vec![3, 2, 1, 0];
+///       // It's okay to call a threadsafe function multiple times.
+///       tsfn_cloned.call(Ok(output.clone()), ThreadsafeFunctionCallMode::NonBlocking);
+///   });
+///
+///   ctx.env.get_undefined()
+/// }
+/// ```
+pub struct ThreadsafeFunction<T: 'static> {
+    raw_tsfn: sys::napi_threadsafe_function,
+    aborted: Arc<AtomicBool>,
+    ref_count: Arc<AtomicUsize>,
+    _phantom: PhantomData<T>,
+}
+
+impl<T> Debug for ThreadsafeFunction<T> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ThreadsafeFunction").finish()
+    }
+}
+
+impl<T: 'static> Clone for ThreadsafeFunction<T> {
+    fn clone(&self) -> Self {
+        if !self.aborted.load(Ordering::Acquire) {
+            let acquire_status = unsafe { sys::napi_acquire_threadsafe_function(self.raw_tsfn) };
+            debug_assert!(
+                acquire_status == sys::Status::napi_ok,
+                "Acquire threadsafe function failed in clone"
+            );
+        }
+
+        Self {
+            raw_tsfn: self.raw_tsfn,
+            aborted: Arc::clone(&self.aborted),
+            ref_count: Arc::clone(&self.ref_count),
+            _phantom: PhantomData,
+        }
+    }
+}
+
+unsafe impl<T> Send for ThreadsafeFunction<T> {}
+unsafe impl<T> Sync for ThreadsafeFunction<T> {}
+
+impl<T: 'static> ThreadsafeFunction<T> {
+    /// See [napi_create_threadsafe_function](https://nodejs.org/api/n-api.html#n_api_napi_create_threadsafe_function)
+    /// for more information.
+    pub(crate) fn create<R: 'static + Send + FnMut(ThreadSafeCallContext<T>) -> Result<()>>(
+        env: sys::napi_env,
+        func: sys::napi_value,
+        max_queue_size: usize,
+        callback: R,
+    ) -> Result<Self> {
+        let mut async_resource_name = ptr::null_mut();
+        let s = "napi_rs_threadsafe_function";
+        let len = s.len();
+        let s = CString::new(s)?;
+        check_status!(unsafe {
+            sys::napi_create_string_utf8(env, s.as_ptr(), len, &mut async_resource_name)
+        })?;
+
+        let initial_thread_count = 1usize;
+        let mut raw_tsfn = ptr::null_mut();
+        let ptr = Box::into_raw(Box::new(callback)) as *mut c_void;
+        check_status!(unsafe {
+            sys::napi_create_threadsafe_function(
+                env,
+                func,
+                ptr::null_mut(),
+                async_resource_name,
+                max_queue_size,
+                initial_thread_count,
+                ptr,
+                Some(thread_finalize_cb::<T, R>),
+                ptr,
+                Some(call_js_cb::<T, R>),
+                &mut raw_tsfn,
+            )
+        })?;
+
+        let aborted = Arc::new(AtomicBool::new(false));
+        let aborted_ptr = Arc::into_raw(aborted.clone()) as *mut c_void;
+        check_status!(unsafe {
+            sys::napi_add_env_cleanup_hook(env, Some(cleanup_cb), aborted_ptr)
+        })?;
+
+        Ok(ThreadsafeFunction {
+            raw_tsfn,
+            aborted,
+            ref_count: Arc::new(AtomicUsize::new(initial_thread_count)),
+            _phantom: PhantomData,
+        })
+    }
+}
+
+impl<T: 'static> ThreadsafeFunction<T> {
+    /// See [napi_call_threadsafe_function](https://nodejs.org/api/n-api.html#n_api_napi_call_threadsafe_function)
+    /// for more information.
+    pub fn call(&self, value: T, mode: ThreadsafeFunctionCallMode) -> Status {
+        if self.aborted.load(Ordering::Acquire) {
+            return Status::Closing;
+        }
+        unsafe {
+            sys::napi_call_threadsafe_function(
+                self.raw_tsfn,
+                Box::into_raw(Box::new(value)) as *mut _,
+                mode.into(),
+            )
+        }
+        .into()
+    }
+}
+
+impl<T: 'static> Drop for ThreadsafeFunction<T> {
+    fn drop(&mut self) {
+        if !self.aborted.load(Ordering::Acquire) && self.ref_count.load(Ordering::Acquire) > 0usize
+        {
+            let release_status = unsafe {
+                sys::napi_release_threadsafe_function(
+                    self.raw_tsfn,
+                    sys::ThreadsafeFunctionReleaseMode::release,
+                )
+            };
+            assert!(
+                release_status == sys::Status::napi_ok,
+                "Threadsafe Function release failed"
+            );
+        }
+    }
+}
+
+unsafe extern "C" fn cleanup_cb(cleanup_data: *mut c_void) {
+    let aborted = Arc::<AtomicBool>::from_raw(cleanup_data.cast());
+    aborted.store(true, Ordering::SeqCst);
+}
+
+unsafe extern "C" fn thread_finalize_cb<T: 'static, R>(
+    _raw_env: sys::napi_env,
+    finalize_data: *mut c_void,
+    _finalize_hint: *mut c_void,
+) where
+    R: 'static + Send + FnMut(ThreadSafeCallContext<T>) -> Result<()>,
+{
+    // cleanup
+    drop(Box::<R>::from_raw(finalize_data.cast()));
+}
+
+unsafe extern "C" fn call_js_cb<T: 'static, R>(
+    raw_env: sys::napi_env,
+    js_callback: sys::napi_value,
+    context: *mut c_void,
+    data: *mut c_void,
+) where
+    R: 'static + Send + FnMut(ThreadSafeCallContext<T>) -> Result<()>,
+{
+    // env and/or callback can be null when shutting down
+    if raw_env.is_null() {
+        return;
+    }
+
+    let ctx: &mut R = &mut *context.cast::<R>();
+    let val: Result<T> = Ok(*Box::<T>::from_raw(data.cast()));
+
+    let mut recv = ptr::null_mut();
+    sys::napi_get_undefined(raw_env, &mut recv);
+
+    let ret = val.and_then(|v| {
+        (ctx)(ThreadSafeCallContext {
+            env: Env::from_raw(raw_env),
+            value: v,
+            callback: if js_callback.is_null() {
+                None
+            } else {
+                Some(JsFunction::from_raw(raw_env, js_callback).unwrap()) // TODO: unwrap
+            },
+        })
+    });
+
+    let status = match ret {
+        Ok(()) => sys::Status::napi_ok,
+        Err(e) => sys::napi_fatal_exception(raw_env, JsError::from(e).into_value(raw_env)),
+    };
+    if status == sys::Status::napi_ok {
+        return;
+    }
+    if status == sys::Status::napi_pending_exception {
+        let mut error_result = ptr::null_mut();
+        assert_eq!(
+            sys::napi_get_and_clear_last_exception(raw_env, &mut error_result),
+            sys::Status::napi_ok
+        );
+
+        // When shutting down, napi_fatal_exception sometimes returns another exception
+        let stat = sys::napi_fatal_exception(raw_env, error_result);
+        assert!(stat == sys::Status::napi_ok || stat == sys::Status::napi_pending_exception);
+    } else {
+        let error_code: Status = status.into();
+        let error_code_string = format!("{error_code:?}");
+        let mut error_code_value = ptr::null_mut();
+        assert_eq!(
+            sys::napi_create_string_utf8(
+                raw_env,
+                error_code_string.as_ptr() as *const _,
+                error_code_string.len(),
+                &mut error_code_value,
+            ),
+            sys::Status::napi_ok,
+        );
+        let error_msg = "Call JavaScript callback failed in thread safe function";
+        let mut error_msg_value = ptr::null_mut();
+        assert_eq!(
+            sys::napi_create_string_utf8(
+                raw_env,
+                error_msg.as_ptr() as *const _,
+                error_msg.len(),
+                &mut error_msg_value,
+            ),
+            sys::Status::napi_ok,
+        );
+        let mut error_value = ptr::null_mut();
+        assert_eq!(
+            sys::napi_create_error(raw_env, error_code_value, error_msg_value, &mut error_value),
+            sys::Status::napi_ok,
+        );
+        assert_eq!(
+            sys::napi_fatal_exception(raw_env, error_value),
+            sys::Status::napi_ok
+        );
+    }
+}
diff --git a/runtimes/js/src/websocket_api.rs b/runtimes/js/src/websocket_api.rs
new file mode 100644
index 0000000000..4475da1eee
--- /dev/null
+++ b/runtimes/js/src/websocket_api.rs
@@ -0,0 +1,251 @@
+use crate::api::{APIPromiseHandler, Request};
+use crate::napi_util::await_promise;
+use crate::napi_util::PromiseHandler;
+use crate::pvalue::{parse_pvalues, PVals};
+use crate::threadsafe_function::{
+    ThreadSafeCallContext, ThreadsafeFunction, ThreadsafeFunctionCallMode,
+};
+use encore_runtime_core::api::websocket::StreamMessagePayload;
+use encore_runtime_core::api::{self, HandlerRequest, HandlerResponse};
+use encore_runtime_core::api::{websocket_client, ToResponse};
+use napi::{Env, JsFunction, JsObject, JsUnknown, NapiRaw};
+use napi_derive::napi;
+use std::future::Future;
+use std::pin::Pin;
+use std::sync::Arc;
+
+struct WsRequestMessage {
+    req: Request,
+    payload: StreamMessagePayload,
+    tx: tokio::sync::mpsc::UnboundedSender<HandlerResponse>,
+}
+
+pub struct JSWebSocketHandler {
+    handler: ThreadsafeFunction<WsRequestMessage>,
+}
+
+impl api::BoxedHandler for JSWebSocketHandler {
+    fn call(
+        self: Arc<Self>,
+        req: HandlerRequest,
+    ) -> Pin<Box<dyn Future<Output = api::ResponseData> + Send + 'static>> {
+        Box::pin(async move {
+            let internal_caller = req.internal_caller.clone();
+            let resp = api::websocket::upgrade_request(req, |req, payload, tx| async move {
+                self.handler.call(
+                    WsRequestMessage {
+                        tx,
+                        payload,
+                        req: Request::new(req),
+                    },
+                    ThreadsafeFunctionCallMode::Blocking,
+                );
+            });
+
+            match resp {
+                Ok(resp) => api::ResponseData::Raw(resp),
+                Err(e) => api::ResponseData::Raw(e.to_response(internal_caller)),
+            }
+        })
+    }
+}
+
+pub fn new_handler(env: Env, func: JsFunction) -> napi::Result<Arc<dyn api::BoxedHandler>> {
+    let handler = ThreadsafeFunction::create(
+        env.raw(),
+        // SAFETY: `handler` is a valid JS function.
+        unsafe { func.raw() },
+        0,
+        ws_resolve_on_js_thread,
+    )?;
+
+    Ok(Arc::new(JSWebSocketHandler { handler }))
+}
+
+#[napi]
+struct Socket {
+    #[allow(dead_code)]
+    inner: api::websocket::Socket,
+}
+
+#[napi]
+impl Socket {
+    fn new(inner: api::websocket::Socket) -> Self {
+        Socket { inner }
+    }
+
+    #[napi]
+    #[allow(dead_code)]
+    pub fn send(&self, msg: PVals) -> napi::Result<()> {
+        self.inner
+            .send(msg.0)
+            .map_err(|e| napi::Error::new(napi::Status::Unknown, e))
+    }
+
+    #[napi]
+    #[allow(dead_code)]
+    pub async fn recv(&self) -> napi::Result<PVals> {
+        self.inner
+            .recv()
+            .await
+            .map(PVals)
+            .ok_or_else(|| napi::Error::new(napi::Status::Unknown, "socket receive channel closed"))
+    }
+
+    #[napi]
+    #[allow(dead_code)]
+    pub fn close(&self) {
+        self.inner.close()
+    }
+}
+
+#[napi]
+struct Sink {
+    #[allow(dead_code)]
+    inner: api::websocket::Sink,
+}
+
+#[napi]
+impl Sink {
+    fn new(inner: api::websocket::Sink) -> Self {
+        Sink { inner }
+    }
+
+    #[napi]
+    #[allow(dead_code)]
+    pub fn send(&self, msg: PVals) -> napi::Result<()> {
+        self.inner
+            .send(msg.0)
+            .map_err(|e| napi::Error::new(napi::Status::Unknown, e))
+    }
+
+    #[napi]
+    #[allow(dead_code)]
+    pub fn close(&self) {
+        self.inner.close()
+    }
+}
+
+#[napi]
+struct Stream {
+    #[allow(dead_code)]
+    inner: api::websocket::Stream,
+}
+
+#[napi]
+impl Stream {
+    fn new(inner: api::websocket::Stream) -> Self {
+        Stream { inner }
+    }
+
+    #[napi]
+    #[allow(dead_code)]
+    pub async fn recv(&self) -> napi::Result<PVals> {
+        self.inner
+            .recv()
+            .await
+            .ok_or_else(|| napi::Error::new(napi::Status::Unknown, "socket receive channel closed"))
+            .map(PVals)
+    }
+}
+
+#[napi]
+pub struct WebSocketClient {
+    inner: Arc<websocket_client::WebSocketClient>,
+}
+
+#[napi]
+impl WebSocketClient {
+    pub fn new(inner: websocket_client::WebSocketClient) -> Self {
+        WebSocketClient {
+            inner: Arc::new(inner),
+        }
+    }
+
+    #[napi]
+    #[allow(dead_code)]
+    pub fn send(&self, msg: JsUnknown) -> napi::Result<()> {
+        let Some(msg) = parse_pvalues(msg)? else {
+            return Err(napi::Error::new(
+                napi::Status::InvalidArg,
+                "no message data provided",
+            ));
+        };
+
+        self.inner
+            .send(msg)
+            .map_err(|e| napi::Error::new(napi::Status::Unknown, e))?;
+
+        Ok(())
+    }
+
+    #[napi(ts_return_type = "Promise<Record<string, any>>")]
+    #[allow(dead_code)]
+    pub fn recv(&self, env: Env) -> napi::Result<JsObject> {
+        let inner = self.inner.clone();
+        let fut = async move {
+            inner
+                .recv()
+                .await
+                .ok_or_else(|| {
+                    napi::Error::new(
+                        napi::Status::Unknown,
+                        "websocket client receive channel closed",
+                    )
+                })?
+                .map_err(|e| {
+                    log::warn!("unable to parse incoming message: {e}");
+                    napi::Error::new(
+                        napi::Status::GenericFailure,
+                        "unable to parse incoming message according to schema",
+                    )
+                })
+        };
+
+        env.execute_tokio_future(fut, |&mut _env, res| Ok(PVals(res)))
+    }
+
+    #[napi]
+    #[allow(dead_code)]
+    pub fn close(&self) {
+        self.inner.close()
+    }
+}
+
+fn ws_resolve_on_js_thread(ctx: ThreadSafeCallContext<WsRequestMessage>) -> napi::Result<()> {
+    let req = ctx
+        .value
+        .req
+        .into_instance(ctx.env)?
+        .as_object(ctx.env)
+        .into_unknown();
+
+    let stream_arg = match ctx.value.payload {
+        StreamMessagePayload::InOut(socket) => Socket::new(socket)
+            .into_instance(ctx.env)?
+            .as_object(ctx.env)
+            .into_unknown(),
+        StreamMessagePayload::Out(sink) => Sink::new(sink)
+            .into_instance(ctx.env)?
+            .as_object(ctx.env)
+            .into_unknown(),
+        StreamMessagePayload::In(stream) => Stream::new(stream)
+            .into_instance(ctx.env)?
+            .as_object(ctx.env)
+            .into_unknown(),
+    };
+
+    let handler = APIPromiseHandler { resp_schema: None };
+
+    match ctx.callback.unwrap().call(None, &[req, stream_arg]) {
+        Ok(result) => {
+            await_promise(ctx.env, result, ctx.value.tx.clone(), handler);
+            Ok(())
+        }
+        Err(err) => {
+            let res = handler.error(ctx.env, err);
+            _ = ctx.value.tx.send(res);
+            Ok(())
+        }
+    }
+}
diff --git a/rustfmt.toml b/rustfmt.toml
new file mode 100644
index 0000000000..ca5602aec2
--- /dev/null
+++ b/rustfmt.toml
@@ -0,0 +1,2 @@
+tab_spaces = 4
+edition = "2021"
diff --git a/supervisor/Cargo.toml b/supervisor/Cargo.toml
new file mode 100644
index 0000000000..82926b11f6
--- /dev/null
+++ b/supervisor/Cargo.toml
@@ -0,0 +1,37 @@
+[package]
+name = "encore-supervisor"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+env_logger = "0.11.3"
+libc = "0.2.155"
+log = { version = "0.4.22", features = ["kv"] }
+tokio = { version = "1.38.0", features = [
+    "process",
+    "macros",
+    "signal",
+    "rt",
+    "rt-multi-thread",
+] }
+tokio-retry = "0.3.0"
+tokio-util = { version = "0.7.11", features = ["rt"] }
+base64 = "0.21.5"
+prost = "0.12.3"
+prost-types = "0.12.3"
+serde_json = "1.0"
+flate2 = "1.0"
+serde = { version = "1.0", features = ["derive"] }
+pingora = { version = "0.4", features = [ "lb" ] }
+anyhow = "1.0.76"
+hyper = { version = "1.1.0", features = ["server", "http1", "http2", "client"] }
+url = "2.5.0"
+axum = { version = "0.7.5", features = ["ws"] }
+http = "1.0.0"
+futures = "0.3.30"
+reqwest = { version = "0.12.4", features = ["blocking", "stream", "json"] }
+bytes = { version = "1.5.0", features = [] }
+openssl = { version = "0.10.68", features = ["vendored"] }
+
+[build-dependencies]
+prost-build = { version = "0.12.1" }
diff --git a/supervisor/build.rs b/supervisor/build.rs
new file mode 100644
index 0000000000..f690c74a0e
--- /dev/null
+++ b/supervisor/build.rs
@@ -0,0 +1,12 @@
+use std::io::Result;
+
+fn main() -> Result<()> {
+    prost_build::compile_protos(
+        &[
+            "../proto/encore/runtime/v1/runtime.proto",
+            "../proto/encore/parser/meta/v1/meta.proto",
+        ],
+        &["../proto/"],
+    )?;
+    Ok(())
+}
diff --git a/supervisor/src/bin/supervisor-encore.rs b/supervisor/src/bin/supervisor-encore.rs
new file mode 100644
index 0000000000..3846b67433
--- /dev/null
+++ b/supervisor/src/bin/supervisor-encore.rs
@@ -0,0 +1,109 @@
+use encore_supervisor::config;
+use encore_supervisor::proxy;
+use encore_supervisor::supervisor::Supervisor;
+use std::env;
+use std::net::IpAddr;
+use std::net::Ipv4Addr;
+use tokio_util::sync::CancellationToken;
+
+#[tokio::main]
+pub async fn main() {
+    env_logger::init();
+
+    let supervisor_config =
+        config::load_supervisor_config().expect("could not load supervisor config");
+
+    // Get the exposed port from the environment variable, defaulting to 8080 if not set
+    let exposed_port = env::var("PORT")
+        .ok()
+        .and_then(|p| p.parse::<u16>().ok())
+        .unwrap_or(8080);
+
+    if supervisor_config.hosted_gateways.is_empty() && supervisor_config.hosted_services.len() > 1 {
+        panic!("Cannot run supervisor with no gateways and multiple services.");
+    }
+
+    let use_proxy = !supervisor_config.hosted_gateways.is_empty()
+        && !supervisor_config.hosted_services.is_empty();
+
+    // Assign a unique port to each hosted service
+    let mut service_ports = std::collections::HashMap::new();
+
+    // Start assigning services to ports (reserve the exposed port to the proxy if it's used)
+    let mut port: u16 = exposed_port + if use_proxy { 1 } else { 0 };
+
+    for service in &supervisor_config.hosted_services {
+        service_ports.insert(service.clone(), port);
+        port += 1;
+    }
+
+    // Create a process for each service and assign it to the selected port
+    let mut procs = Vec::new();
+    for (service_name, service_port) in &service_ports {
+        procs.push(
+            config::create_process_config(
+                vec![service_name.clone()],
+                vec![],
+                *service_port,
+                &service_ports,
+                &supervisor_config.binary_config,
+            )
+            .expect("Failed to create process for service"),
+        );
+    }
+
+    let upstream_port = port;
+    if !supervisor_config.hosted_gateways.is_empty() {
+        service_ports.insert("api-gateway".to_string(), port);
+        procs.push(
+            config::create_process_config(
+                vec![],
+                supervisor_config.hosted_gateways,
+                port,
+                &service_ports,
+                &supervisor_config.binary_config,
+            )
+            .expect("Failed to create process for gateways"),
+        );
+    }
+
+    let mut handles = Vec::new();
+    let mut results = Vec::new();
+    let root_token = CancellationToken::new();
+
+    let sv = Supervisor::new(procs);
+    let supervisor_token = root_token.child_token();
+    handles.push(tokio::spawn(sv.supervise(supervisor_token)));
+
+    if use_proxy {
+        let proxy = proxy::GatewayProxy::new(
+            reqwest::Client::new(),
+            std::net::SocketAddr::new(IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)), upstream_port),
+            service_ports.clone(),
+        );
+        let proxy_token = root_token.child_token();
+        let proxy_fut = proxy.serve(format!("0.0.0.0:{exposed_port}"), proxy_token);
+        handles.push(tokio::spawn(proxy_fut));
+    }
+
+    // Spawn a task to listen for SIGINT or SIGTERM and cancel the root token
+    tokio::spawn(async move {
+        // Wait for SIGINT or SIGTERM
+        tokio::signal::ctrl_c()
+            .await
+            .expect("Failed to listen for ctrl+c");
+        log::info!("Received shutdown signal. Initiating graceful shutdown...");
+        root_token.cancel();
+    });
+
+    for handle in handles {
+        results.push(handle.await);
+    }
+
+    for result in results {
+        if let Err(e) = result {
+            log::error!("Error while shutting down process: {:?}", e);
+        }
+    }
+    log::info!("All processes have exited. Shutting down.");
+}
diff --git a/supervisor/src/config.rs b/supervisor/src/config.rs
new file mode 100644
index 0000000000..ee161330fa
--- /dev/null
+++ b/supervisor/src/config.rs
@@ -0,0 +1,246 @@
+use crate::supervisor::Process;
+use anyhow::{Context, Result};
+use base64::Engine;
+use prost::Message;
+use runtime::v1 as runtimepb;
+use std::io::Read;
+use std::time::Duration;
+use std::{collections::HashMap, env, fs::File};
+use tokio_retry::strategy::ExponentialBackoff;
+
+pub mod runtime {
+    pub mod v1 {
+        include!(concat!(env!("OUT_DIR"), "/encore.runtime.v1.rs"));
+    }
+}
+
+// loads the binary config and the runtime config and merges them into a supervisor config
+pub fn load_supervisor_config() -> Result<SupervisorConfig> {
+    let (services, gateways) = load_hosted_processes()?;
+    Ok(SupervisorConfig {
+        binary_config: load_binary_config()?,
+        hosted_services: services,
+        hosted_gateways: gateways,
+    })
+}
+
+// loads the binary config (defaults to /encore/supervisor.config.json). It contains
+// information on how to start the available binaries and what services/gateways they contain
+fn load_binary_config() -> Result<BinaryConfig> {
+    // Parse config path from args, defaulting to /encore/supervisor.config.json if not specified
+    let args: Vec<String> = env::args().collect();
+    let config_path = args
+        .iter()
+        .position(|arg| arg == "-c")
+        .and_then(|index| args.get(index + 1))
+        .map(|s| s.to_string())
+        .unwrap_or_else(|| "/encore/supervisor.config.json".to_string());
+
+    // Open and read the supervisor config file
+    let mut file = File::open(config_path)?;
+    let mut contents = String::new();
+    file.read_to_string(&mut contents)?;
+    serde_json::from_str(&contents).map_err(|e| anyhow::anyhow!(e))
+}
+
+// attempts to read the encore runtime config either as proto or json. Extracts and returns the
+// hosted services and gateways.
+fn load_hosted_processes() -> Result<(Vec<String>, Vec<String>)> {
+    let infra_cfg_path = env::var("ENCORE_INFRA_CONFIG_PATH");
+    if let Ok(cfg) = infra_cfg_path {
+        let mut file = File::open(cfg).context("Failed to open ENCORE_INFRA_CONFIG_PATH")?;
+        let mut contents = String::new();
+        file.read_to_string(&mut contents)?;
+        let config: InfraConfig = serde_json::from_str(contents.as_str())
+            .context("Failed to parse InfraConfig as JSON")?;
+        return Ok((config.hosted_services, config.hosted_gateways));
+    }
+
+    // Read and decode the runtime config bytes from the environment variable
+    let runtime_config = env::var("ENCORE_RUNTIME_CONFIG")
+        .context("Failed to read ENCORE_RUNTIME_CONFIG env var")
+        .and_then(|encoded| {
+            if encoded.starts_with("gzip:") {
+                let gzipped = encoded.trim_start_matches("gzip:");
+                base64::engine::general_purpose::STANDARD
+                    .decode(gzipped.as_bytes())
+                    .context("failed base64 decoding ENCORE_RUNTIME_CONFIG")
+                    .and_then(|bytes| {
+                        let mut decoder = flate2::read::GzDecoder::new(&bytes[..]);
+                        let mut decompressed = Vec::new();
+                        decoder
+                            .read_to_end(&mut decompressed)
+                            .context("failed unzipping runtime config")?;
+                        Ok(decompressed)
+                    })
+            } else {
+                base64::engine::general_purpose::STANDARD
+                    .decode(encoded.as_bytes())
+                    .context("failed base64 decoding ENCORE_RUNTIME_CONFIG")
+            }
+        })?;
+
+    // Decode the runtime config based on its format (protobuf or JSON)
+    match runtimepb::RuntimeConfig::decode(&runtime_config[..]) {
+        Ok(config) => {
+            let deployment = config
+                .deployment
+                .context("Deployment not found in RuntimeConfig")?;
+            let gateways = config
+                .infra
+                .context("Infrastructure not found in RuntimeConfig")?
+                .resources
+                .context("Resources not found in Infrastructure")?
+                .gateways;
+            Ok((
+                deployment
+                    .hosted_services
+                    .iter()
+                    .map(|s| s.name.clone())
+                    .collect(),
+                deployment
+                    .hosted_gateways
+                    .iter()
+                    .map(|rid| {
+                        Ok(gateways
+                            .iter()
+                            .find(|g| g.rid == *rid)
+                            .context("Gateway rid not found in infra resources")?
+                            .encore_name
+                            .clone())
+                    })
+                    .collect::<Result<Vec<String>>>()?,
+            ))
+        }
+        Err(_) => {
+            // If protobuf decoding fails, try JSON decoding
+            let config: RuntimeConfig = serde_json::from_slice(&runtime_config)
+                .context("Failed to parse RuntimeConfig as JSON")?;
+            Ok((
+                config.hosted_services,
+                config.gateways.iter().map(|g| g.name.clone()).collect(),
+            ))
+        }
+    }
+}
+
+// Create a process config for a given set of services and gateways
+pub fn create_process_config(
+    services: Vec<String>,
+    gateways: Vec<String>,
+    port: u16,
+    service_ports: &HashMap<String, u16>,
+    cfg: &BinaryConfig,
+) -> Result<Process> {
+    // Append all supervisor environment variables
+    let mut env = std::env::vars().collect::<HashMap<String, String>>();
+
+    // Find a process config that contains all the services and gateways
+    let binary_config = cfg
+        .procs
+        .iter()
+        .find(|p| {
+            (services.iter().all(|s| p.services.contains(s)))
+                && (gateways.iter().all(|g| p.gateways.contains(g)))
+        })
+        .context(format!(
+            "No matching proc found for services {services:?} gateways {gateways:?}"
+        ))?;
+
+    // Add proc-specific environment variables
+    env.extend(binary_config.env.iter().map(|e| {
+        let parts: Vec<&str> = e.splitn(2, '=').collect();
+        (
+            parts[0].to_string(),
+            parts.get(1).unwrap_or(&"").to_string(),
+        )
+    }));
+
+    // Add the port and process config to the environment
+    env.extend(vec![
+        ("PORT".to_string(), port.to_string()),
+        (
+            "ENCORE_PROCESS_CONFIG".to_string(),
+            base64::engine::general_purpose::STANDARD.encode(
+                serde_json::to_string(&ProcessConfig {
+                    hosted_gateways: gateways,
+                    hosted_services: services,
+                    local_service_ports: service_ports.clone(),
+                })
+                .context("Failed to serialize ProcessConfig")?,
+            ),
+        ),
+    ]);
+
+    let policy = ExponentialBackoff::from_millis(100).max_delay(Duration::from_millis(1000));
+
+    Ok(Process {
+        name: binary_config.id.clone(),
+        program: binary_config
+            .command
+            .first()
+            .context("missing binary command")?
+            .to_string(),
+        args: binary_config.command[1..].to_vec(),
+        env: env.into_iter().collect(),
+        cwd: std::env::current_dir().context("Failed to get current directory")?,
+        restart_policy: Box::new(policy),
+    })
+}
+
+// Supervisor config is the config bundled with the supervisor binary
+// It contains the list of available binaries and which services and gateways they implement
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct SupervisorConfig {
+    pub binary_config: BinaryConfig,
+    pub hosted_services: Vec<String>,
+    pub hosted_gateways: Vec<String>,
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct InfraConfig {
+    #[serde(default)]
+    pub hosted_services: Vec<String>,
+    #[serde(default)]
+    pub hosted_gateways: Vec<String>,
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct BinaryConfig {
+    pub procs: Vec<Proc>,
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct Proc {
+    id: String,
+    command: Vec<String>,
+    env: Vec<String>,
+    services: Vec<String>,
+    gateways: Vec<String>,
+}
+
+// Process config is the config for a given process
+// It overrides the RuntimeConfig for local service discovery, port allocation
+// and which services and gateways are hosted on this process
+#[derive(serde::Serialize, serde::Deserialize)]
+struct ProcessConfig {
+    local_service_ports: HashMap<String, u16>,
+    hosted_gateways: Vec<String>,
+    hosted_services: Vec<String>,
+}
+
+// RuntimeConfig is a partial version of the config used for GO apps
+// Only hosted services and gateways are parsed as those are the only ones
+// we need to produce ProcessConfigs
+#[derive(serde::Serialize, serde::Deserialize)]
+struct RuntimeConfig {
+    #[serde(default)]
+    pub hosted_services: Vec<String>,
+    #[serde(default)]
+    pub gateways: Vec<GatewayConfig>,
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+struct GatewayConfig {
+    pub name: String,
+}
diff --git a/supervisor/src/lib.rs b/supervisor/src/lib.rs
new file mode 100644
index 0000000000..37a8669543
--- /dev/null
+++ b/supervisor/src/lib.rs
@@ -0,0 +1,3 @@
+pub mod config;
+pub mod proxy;
+pub mod supervisor;
diff --git a/supervisor/src/proxy.rs b/supervisor/src/proxy.rs
new file mode 100644
index 0000000000..997c9a96cb
--- /dev/null
+++ b/supervisor/src/proxy.rs
@@ -0,0 +1,269 @@
+use anyhow::{Context, Result};
+use axum::async_trait;
+use bytes::Bytes;
+use hyper::header;
+use pingora::http::ResponseHeader;
+use pingora::protocols::http::error_resp;
+use pingora::proxy::{http_proxy_service, ProxyHttp, Session};
+use pingora::server::configuration::{Opt, ServerConf};
+use pingora::services::Service;
+use pingora::upstreams::peer::HttpPeer;
+use pingora::{Error, ErrorSource, ErrorType, OrErr};
+use serde::{Deserialize, Serialize};
+use std::collections::HashMap;
+use std::net::SocketAddr;
+use std::sync::Arc;
+use tokio::sync::watch;
+use tokio_util::sync::CancellationToken;
+
+#[derive(Clone)]
+pub struct GatewayProxy {
+    services: HashMap<String, u16>,
+    upstream: SocketAddr,
+    client: reqwest::Client,
+}
+
+#[derive(Clone, Serialize, Deserialize)]
+pub struct HealthzResponse {
+    pub code: String,
+    pub message: String,
+    pub details: HealthzDetails,
+}
+
+#[derive(Clone, Serialize, Deserialize)]
+pub struct HealthzDetails {
+    pub app_revision: String,
+    pub encore_compiler: String,
+    pub deploy_id: String,
+    pub checks: Vec<HealthzCheckResult>,
+    pub enabled_experiments: Vec<String>,
+}
+
+#[derive(Clone, Serialize, Deserialize)]
+pub struct HealthzCheckResult {
+    pub name: String,
+    pub passed: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub error: Option<String>,
+}
+
+impl GatewayProxy {
+    pub fn new(
+        client: reqwest::Client,
+        upstream: SocketAddr,
+        services: HashMap<String, u16>,
+    ) -> Self {
+        GatewayProxy {
+            client,
+            upstream,
+            services,
+        }
+    }
+
+    pub async fn serve(self, listen_addr: String, token: CancellationToken) {
+        let conf = Arc::new(
+            ServerConf::new_with_opt_override(&Opt {
+                upgrade: false,
+                daemon: false,
+                nocapture: false,
+                test: false,
+                conf: None,
+            })
+            .unwrap(),
+        );
+        let mut proxy = http_proxy_service(&conf, self);
+
+        proxy.add_tcp(listen_addr.as_str());
+
+        let (tx, rx) = watch::channel(false);
+
+        tokio::select! {
+            _ = proxy.start_service(
+                #[cfg(unix)]
+                None,
+                rx,
+            ) => {},
+            _ = token.cancelled() => {
+                log::info!("Shutting down pingora proxy");
+                tx.send(true).expect("failed to shutdown pingora");
+            }
+        }
+    }
+
+    // concurrently calls /__encore/healthz for all services. Returns "unhealthy" if any of them
+    // does not return "ok".
+    pub async fn health_check(&self) -> Result<HealthzResponse> {
+        let handles = self.services.clone().into_iter().map(|(svc, port)| {
+            let client = self.client.clone();
+            let url = format!("http://127.0.0.1:{port}/__encore/healthz");
+            tokio::spawn(async move {
+                let err_resp = || HealthzResponse {
+                    code: "unhealthy".to_string(),
+                    message: "healhtcheck failed".to_string(),
+                    details: HealthzDetails {
+                        app_revision: "".to_string(),
+                        encore_compiler: "".to_string(),
+                        deploy_id: "".to_string(),
+                        checks: vec![HealthzCheckResult {
+                            name: format!("service.{svc}.initialized"),
+                            passed: false,
+                            error: None,
+                        }],
+                        enabled_experiments: vec![],
+                    },
+                };
+
+                match client
+                    .get(url.as_str())
+                    .send()
+                    .await
+                    .context("failed to get url")
+                    .and_then(|r| {
+                        if r.status().is_success() {
+                            Ok(r)
+                        } else {
+                            Err(anyhow::anyhow!("Unsuccessful request"))
+                        }
+                    }) {
+                    Ok(res) => {
+                        match res
+                            .json::<HealthzResponse>()
+                            .await
+                            .context("Failed to parse response body")
+                        {
+                            Ok(res) => res,
+                            Err(_) => err_resp(),
+                        }
+                    }
+                    Err(_) => err_resp(),
+                }
+            })
+        });
+
+        let results: Vec<HealthzResponse> = futures::future::join_all(handles)
+            .await
+            .into_iter()
+            .map(|r| r.context("failed future"))
+            .collect::<Result<Vec<_>>>()
+            .context("http healthcheck failed")?;
+
+        results
+            .iter()
+            .fold(None::<HealthzResponse>, |rtn, resp| match rtn {
+                Some(mut res) => {
+                    if resp.code != "ok" {
+                        res.code = "unhealthy".to_string();
+                        res.details.checks.extend(resp.details.checks.clone())
+                    }
+                    Some(res)
+                }
+                None => Some(resp.clone()),
+            })
+            .ok_or(anyhow::anyhow!("No results"))
+    }
+}
+
+#[async_trait]
+impl ProxyHttp for GatewayProxy {
+    type CTX = Option<String>;
+
+    fn new_ctx(&self) -> Self::CTX {
+        None
+    }
+
+    // see https://github.com/cloudflare/pingora/blob/main/docs/user_guide/internals.md for
+    // details on when different filters are called.
+
+    async fn request_filter(
+        &self,
+        session: &mut Session,
+        _ctx: &mut Self::CTX,
+    ) -> pingora::Result<bool>
+    where
+        Self::CTX: Send + Sync,
+    {
+        if session.req_header().uri.path() == "/__encore/healthz" {
+            let healthz_resp = self
+                .health_check()
+                .await
+                .or_err(ErrorType::HTTPStatus(503), "failed to run health check")?;
+            let healthz_bytes: Vec<u8> = serde_json::to_vec(&healthz_resp)
+                .or_err(ErrorType::HTTPStatus(503), "could not encode response")?;
+
+            let code = if healthz_resp.code == "ok" { 200 } else { 503 };
+            let mut header = ResponseHeader::build(code, None)?;
+            header.insert_header(header::CONTENT_LENGTH, healthz_bytes.len())?;
+            header.insert_header(header::CONTENT_TYPE, "application/json")?;
+            session
+                .write_response_header(Box::new(header), false)
+                .await?;
+            session
+                .write_response_body(Some(Bytes::from(healthz_bytes)), true)
+                .await?;
+
+            return Ok(true);
+        }
+        Ok(false)
+    }
+
+    async fn upstream_peer(
+        &self,
+        _session: &mut Session,
+        _ctx: &mut Self::CTX,
+    ) -> pingora::Result<Box<HttpPeer>> {
+        let peer: HttpPeer = HttpPeer::new(self.upstream, false, "localhost".to_string());
+        Ok(Box::new(peer))
+    }
+
+    async fn fail_to_proxy(&self, session: &mut Session, e: &Error, _ctx: &mut Self::CTX) -> u16
+    where
+        Self::CTX: Send + Sync,
+    {
+        // modified version of `Session::respond_error`
+
+        let code = match e.etype() {
+            ErrorType::HTTPStatus(code) => *code,
+            _ => {
+                match e.esource() {
+                    ErrorSource::Upstream => 502,
+                    ErrorSource::Downstream => {
+                        match e.etype() {
+                            ErrorType::WriteError
+                            | ErrorType::ReadError
+                            | ErrorType::ConnectionClosed => {
+                                /* conn already dead */
+                                return 0;
+                            }
+                            _ => 400,
+                        }
+                    }
+                    ErrorSource::Internal | ErrorSource::Unset => 500,
+                }
+            }
+        };
+
+        let (resp, body) = (
+            match code {
+                /* common error responses are pre-generated */
+                502 => error_resp::HTTP_502_RESPONSE.clone(),
+                400 => error_resp::HTTP_400_RESPONSE.clone(),
+                _ => error_resp::gen_error_response(code),
+            },
+            None,
+        );
+        session.set_keepalive(None);
+        session
+            .write_response_header(Box::new(resp), false)
+            .await
+            .unwrap_or_else(|e| {
+                log::error!("failed to send error response to downstream: {e}");
+            });
+
+        session
+            .write_response_body(body, true)
+            .await
+            .unwrap_or_else(|e| log::error!("failed to write body: {e}"));
+
+        code
+    }
+}
diff --git a/supervisor/src/supervisor.rs b/supervisor/src/supervisor.rs
new file mode 100644
index 0000000000..2631242f49
--- /dev/null
+++ b/supervisor/src/supervisor.rs
@@ -0,0 +1,170 @@
+//! Supervisor of Encore processes.
+//!
+//! The supervisor ensures all services (and gateways) hosted
+//! by the Encore deployment are started and running.
+
+use std::{ffi::OsStr, io, os::unix::ffi::OsStrExt, path::PathBuf, time::Duration};
+use tokio::process::{Child, Command};
+use tokio_retry::Retry;
+use tokio_util::{sync::CancellationToken, task::TaskTracker};
+
+/// The supervisor.
+pub struct Supervisor {
+    /// The processes to supervise.
+    procs: Vec<Process>,
+}
+
+impl Supervisor {
+    /// Creates a new supervisor.
+    pub fn new(procs: Vec<Process>) -> Self {
+        Self { procs }
+    }
+
+    /// Runs the supervisor.
+    ///
+    /// It returns when all processes have exited, due to either
+    /// crashing or cancellation.
+    pub async fn supervise(self, token: CancellationToken) {
+        let tracker = TaskTracker::new();
+
+        for p in self.procs {
+            let tok = token.clone();
+            tracker.spawn(async move {
+                let _ = p.run(tok.clone()).await;
+                tok.cancel();
+            });
+        }
+
+        tracker.close();
+        tracker.wait().await;
+    }
+}
+
+/// A supervised process.
+pub struct Process {
+    /// The name of the process, for display purposes.
+    pub name: String,
+
+    /// The binary to start.
+    pub program: String,
+
+    /// Arguments to the program.
+    pub args: Vec<String>,
+
+    /// The working directory of the process.
+    pub cwd: PathBuf,
+
+    /// Env variables to set for the process.
+    /// The current process's env vars are NOT inherited.
+    pub env: Vec<(String, String)>,
+
+    /// How to restart the process if it exits.
+    pub restart_policy: Box<dyn RestartPolicy>,
+}
+
+impl Process {
+    /// Runs the process, waiting for it to exit.
+    ///
+    /// It restarts the process on exit according to the restart policy,
+    /// unless the cancellation token is canceled.
+    async fn run(&self, token: CancellationToken) -> io::Result<()> {
+        let name = self.name.as_str();
+        Retry::spawn(self.restart_policy.retries(), move || {
+            let token = token.clone();
+
+            log::info!(proc = name; "starting process");
+
+            let res = self.run_once(token.clone());
+            async move {
+                // Wait for the process to complete.
+                let _ = res.await;
+                log::info!(proc = name; "process exited");
+                if token.is_cancelled() {
+                    Ok(())
+                } else {
+                    Err(io::Error::other("exited"))
+                }
+            }
+        })
+        .await
+    }
+
+    async fn run_once(&self, token: CancellationToken) -> io::Result<()> {
+        // If the token is already cancelled, do nothing.
+        if token.is_cancelled() {
+            return Err(io::Error::other("canceled"));
+        }
+
+        let envs = self.env.iter().map(|(k, v)| {
+            (
+                OsStr::from_bytes(k.as_bytes()),
+                OsStr::from_bytes(v.as_bytes()),
+            )
+        });
+
+        let mut cmd = Command::new(&self.program)
+            .args(&self.args)
+            .env_clear()
+            .envs(envs)
+            .current_dir(&self.cwd)
+            .spawn()?;
+
+        // Wait for the process to exit, or the token to be cancelled,
+        // whichever happens first.
+        tokio::select! {
+            status = cmd.wait() => status.map(|_| ()),
+
+            _ = token.cancelled() => {
+                kill_gracefully(&mut cmd).await
+            },
+        }
+    }
+}
+
+/// Attempts to kill a child process gracefully.
+async fn kill_gracefully(child: &mut Child) -> io::Result<()> {
+    do_kill_gracefully(child).await
+}
+
+#[cfg(target_os = "windows")]
+async fn do_kill_gracefully(child: &mut Child) -> io::Result<()> {
+    child.kill().await
+}
+
+#[cfg(not(target_os = "windows"))]
+async fn do_kill_gracefully(child: &mut Child) -> io::Result<()> {
+    use std::time::Duration;
+    if let Some(pid) = child.id() {
+        for (sig, wait) in [
+            (libc::SIGINT, Duration::from_secs(2)),
+            (libc::SIGTERM, Duration::from_secs(2)),
+        ] {
+            unsafe {
+                libc::kill(pid as i32, sig);
+            }
+
+            tokio::select! {
+                _ = child.wait() => return Ok(()),
+                _ = tokio::time::sleep(wait) => {
+                    // Still running, escalate.
+                }
+            }
+        }
+    }
+
+    // We're out of graceful signals.
+    child.kill().await
+}
+
+pub trait RestartPolicy: Send + Sync + 'static {
+    fn retries(&self) -> Box<dyn Iterator<Item = Duration> + Send + 'static>;
+}
+
+impl<T> RestartPolicy for T
+where
+    T: Iterator<Item = Duration> + Clone + Send + Sync + 'static,
+{
+    fn retries(&self) -> Box<dyn Iterator<Item = Duration> + Send + 'static> {
+        Box::new(self.clone())
+    }
+}
diff --git a/tools/publicapigen/main.go b/tools/publicapigen/main.go
new file mode 100644
index 0000000000..ff2896ee6e
--- /dev/null
+++ b/tools/publicapigen/main.go
@@ -0,0 +1,939 @@
+package main
+
+import (
+	"bytes"
+	"cmp"
+	"fmt"
+	"go/ast"
+	"go/parser"
+	"go/printer"
+	"go/token"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+
+	"github.com/rs/zerolog"
+	"github.com/rs/zerolog/log"
+	"golang.org/x/tools/go/ast/astutil"
+	"golang.org/x/tools/imports"
+)
+
+type registeredType struct {
+	node ast.Expr
+	docs *ast.CommentGroup
+}
+
+type registeredConstant struct {
+	node ast.Expr
+	typ  ast.Expr
+	docs *ast.CommentGroup
+}
+
+type parsedFile struct {
+	fileName string
+	dir      string
+	ast      *ast.File
+}
+
+var (
+	resolvedRepo        = repoDir()
+	gitRef              = repoCommit()
+	fset                = token.NewFileSet()
+	formattedFset       = token.NewFileSet()
+	files               = []*parsedFile{}
+	commentsToAddToFile = map[*ast.File]map[string]*ast.CommentGroup{}
+	constants           = map[string]map[string]registeredConstant{}
+	types               = map[string]map[string]registeredType{}
+	typesToDrop         = map[string]map[string]bool{}
+	usesPanicWrapper    = map[string]bool{} // package dir -> true
+)
+
+func main() {
+	log.Logger = zerolog.New(zerolog.NewConsoleWriter()).With().Timestamp().Caller().Logger()
+	log.Info().Msg("generating public api")
+
+	// Walk the directory tree and parse all the Go files
+	log.Info().Msg("parsing source files...")
+	if err := walkDir(filepath.Join(resolvedRepo, "runtimes", "go"), "./", readAST); err != nil {
+		log.Fatal().Err(err).Msg("unable to walk runtime directory to parse go files")
+	}
+	slices.SortFunc(files, func(a, b *parsedFile) int {
+		return cmp.Compare(a.fileName, b.fileName)
+	})
+
+	// Register all consts and types in our private files, just in case we reference them in the public API
+	log.Info().Msg("registering types...")
+	for _, f := range files {
+		if isPrivateFile(f.fileName) {
+			log.Debug().Str("file", f.fileName).Msg("registering types and constants from private implementation files")
+			registerTypes(f.fileName, f.ast)
+		}
+		registerTypesToDrop(f.ast)
+	}
+
+	// Then rewrite all the AST to remove implementations
+	log.Info().Msg("rewriting ast to remove implementations and unexported items...")
+	remaining := make([]*parsedFile, 0, len(files))
+	for _, f := range files {
+		log.Debug().Str("file", f.fileName).Msg("rewriting ast")
+		usesPanic, err := rewriteAST(f.ast)
+		if err != nil {
+			log.Fatal().Err(err).Str("file", f.fileName).Msg("unable to rewrite ast")
+		}
+
+		if len(f.ast.Decls) == 0 && f.ast.Doc == nil {
+			log.Debug().Str("file", f.fileName).Msg("removing file as there are no exported decelerations or package comments")
+			continue
+		}
+
+		if usesPanic {
+			usesPanicWrapper[f.dir] = true
+		}
+
+		remaining = append(remaining, f)
+	}
+	files = remaining
+
+	writtenPanicWrapper := make(map[string]bool) // package dir -> true
+
+	// Then write the AST to a file
+	outDir := outDir()
+	log.Info().Str("out", outDir).Msg("writing public api files...")
+	for _, f := range files {
+		if isPrivateFile(f.fileName) {
+			// "runtime" is a private package as are internal packages
+			// any files suffixed with _internal.go are also private and are considered unstable API's
+			continue
+		}
+
+		log.Debug().Str("file", f.fileName).Msg("writing public api file")
+
+		// Pretty print the file and then re-parse it
+		// This repopulates the AST with the comments and formatting
+		formattedFile := convertASTToFormattedSrc(fset, f.ast, f.fileName, nil)
+		formattedAST, err := parser.ParseFile(formattedFset, f.fileName, formattedFile, parser.ParseComments)
+		if err != nil {
+			log.Fatal().Err(err).Str("file", f.fileName).Msg("unable to convert back to an AST")
+		}
+
+		// Now we can add brand new comments list given set, we
+		// can write the help comment into the functions
+		writePendingComments(f.ast, formattedAST)
+
+		// Now let's write the file out
+		outputFile := filepath.Join(outDir, f.fileName)
+		outputDir := filepath.Dir(outputFile)
+
+		if err := os.MkdirAll(outputDir, 0755); err != nil {
+			log.Fatal().Err(err).Str("dir", outputDir).Msg("unable to create output directory")
+		}
+
+		if isEmptyFile(formattedAST) {
+			continue
+		}
+
+		var extraContents []byte
+		doWritePanicWrapper := usesPanicWrapper[f.dir] && !writtenPanicWrapper[f.dir]
+		if doWritePanicWrapper {
+			extraContents = []byte(panicWrapperSnippet)
+			writtenPanicWrapper[f.dir] = true
+		}
+		out := convertASTToFormattedSrc(formattedFset, formattedAST, f.fileName, extraContents)
+
+		if err := os.WriteFile(outputFile, out, 0644); err != nil {
+			log.Fatal().Err(err).Str("file", f.fileName).Msg("unable to write file")
+		}
+	}
+
+	if err := buildsSuccessfully(outDir); err != nil {
+		log.Fatal().Err(err).Msg("generated code does not build")
+	}
+
+	log.Info().Msg("done")
+}
+
+func isEmptyFile(f *ast.File) bool {
+	return len(f.Decls) == 0 && f.Doc.Text() == ""
+}
+
+func convertASTToFormattedSrc(fset *token.FileSet, fAST *ast.File, fileName string, extraContents []byte) []byte {
+	// Print the AST to a buffer
+	var buf bytes.Buffer
+	if err := printer.Fprint(&buf, fset, fAST); err != nil {
+		log.Fatal().Err(err).Str("file", fileName).Msg("unable to write ast to file")
+	}
+
+	// Add any extra contents
+	buf.Write(extraContents)
+
+	// Then pass that to goimports to format the imports
+	imports.LocalPrefix = "encore.dev"
+	formatted, err := imports.Process(fileName, buf.Bytes(), nil)
+	if err != nil {
+		log.Fatal().Err(err).Str("file", fileName).Msg("unable to process imports")
+	}
+
+	return formatted
+}
+
+func registerTypes(name string, fAST *ast.File) {
+	pkg := filepath.Base(filepath.Dir(name))
+	if _, found := types[pkg]; !found {
+		types[pkg] = map[string]registeredType{}
+		constants[pkg] = map[string]registeredConstant{}
+	}
+
+	for _, decl := range fAST.Decls {
+		switch d := decl.(type) {
+		case *ast.GenDecl:
+			for _, spec := range d.Specs {
+				switch s := spec.(type) {
+				case *ast.TypeSpec:
+					if s.Name != nil && s.Name.IsExported() {
+						log.Debug().Str("type", s.Name.Name).Msg("registering type")
+						types[pkg][s.Name.Name] = registeredType{s.Type, removePosFromCommentGroup(d.Doc)}
+					}
+				case *ast.ValueSpec:
+					dir := lookupDirective(d.Doc)
+					if d.Tok == token.CONST || (d.Tok == token.VAR && dir == mustKeep) {
+						for i, name := range s.Names {
+							if len(s.Values) <= i {
+								if len(s.Values) == 0 && name.IsExported() {
+									log.Debug().Str("const", name.Name).Msg("registering enum const")
+									constants[pkg][name.Name] = registeredConstant{nil, nil, removePosFromCommentGroup(s.Doc)}
+								}
+								break
+							}
+
+							if name.IsExported() {
+								log.Debug().Str("const", name.Name).Interface("value", s.Values[i]).Msg("registering basic const")
+								constants[pkg][name.Name] = registeredConstant{removePosition(s.Values[i]), removePosition(s.Type), removePosFromCommentGroup(s.Doc)}
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+}
+
+func registerTypesToDrop(fAST *ast.File) {
+	pkg := fAST.Name.Name
+	if _, found := typesToDrop[pkg]; !found {
+		typesToDrop[pkg] = map[string]bool{}
+	}
+
+	for _, decl := range fAST.Decls {
+		switch d := decl.(type) {
+		case *ast.GenDecl:
+			for _, spec := range d.Specs {
+				switch s := spec.(type) {
+				case *ast.TypeSpec:
+					if lookupDirective(d.Doc, s.Doc) == mustDrop {
+						fmt.Printf("dropping %s.%s\n", pkg, s.Name.Name)
+						typesToDrop[pkg][s.Name.Name] = true
+					}
+				}
+			}
+		}
+	}
+}
+
+// readAST parses the AST of all non-test Go files in a directory and stores it in the files map
+func readAST(path, rel string, file []os.DirEntry) error {
+	for _, f := range file {
+		if !strings.HasSuffix(f.Name(), ".go") {
+			// ignore non-go files
+			continue
+		}
+
+		if strings.HasSuffix(f.Name(), "_test.go") {
+			// Ignore test files
+			continue
+		}
+
+		log.Debug().Str("rel", rel).Str("file", f.Name()).Msg("parsing file")
+
+		fAST, err := parser.ParseFile(fset, filepath.Join(path, f.Name()), nil, parser.ParseComments)
+		if err != nil {
+			return fmt.Errorf("error parsing %s: %w", f.Name(), err)
+		}
+
+		// We only want to track comments if they are part of a decl we're keeping
+		// so we need to nil out this field on the file so they aren't tracked globally
+		fAST.Comments = nil
+		files = append(files, &parsedFile{
+			fileName: filepath.Join(rel, f.Name()),
+			dir:      rel,
+			ast:      fAST,
+		})
+	}
+
+	return nil
+}
+
+func rewriteAST(f *ast.File) (usesPanicWrapper bool, err error) {
+	var lastIfaceType *ast.InterfaceType
+
+	astutil.Apply(
+		f,
+		func(c *astutil.Cursor) bool {
+			switch node := c.Node().(type) {
+			case *ast.ImportSpec:
+				// Drop "_" imports as they are implementation details and not needed in the API contract
+				if node.Name != nil && node.Name.Name == "_" {
+					c.Delete()
+				}
+			case *ast.FuncDecl:
+				dir := lookupDirective(node.Doc)
+				if dir == mustKeep {
+					return false
+				}
+
+				// Should we delete this function declaration if it's unexported or a receiver on an unexported object?
+				shouldDelete := !node.Name.IsExported() || dir == mustDrop
+				if node.Recv != nil {
+					for i, field := range node.Recv.List {
+						if ident := typeName(field.Type); ident != nil && (!ident.IsExported() || typesToDrop[f.Name.Name][ident.Name]) {
+							shouldDelete = true
+							break
+						}
+
+						// Remove the node name from the receiver as we won't reference it inside an empty body
+						// if we keep the field
+						node.Recv.List[i].Names = nil
+					}
+				}
+
+				if shouldDelete {
+					clearCommentGroup(node.Doc)
+					c.Delete()
+					return false
+				}
+
+				start := token.NoPos
+				end := token.NoPos
+
+				if node.Body != nil {
+					start = node.Body.Lbrace
+					end = node.Body.Rbrace
+
+					if _, found := commentsToAddToFile[f]; !found {
+						commentsToAddToFile[f] = map[string]*ast.CommentGroup{}
+					}
+
+					startLine := fset.Position(start).Line
+					endLine := fset.Position(end).Line
+					filePath := strings.TrimPrefix(fset.File(node.Pos()).Name(), resolvedRepo)
+
+					commentsToAddToFile[f][funcName(node)] = &ast.CommentGroup{
+						List: []*ast.Comment{
+							{
+								Text: "// Encore will provide an implementation to this function at runtime, we do not expose",
+							},
+							{
+								Text: "// the implementation in the API contract as it is an implementation detail, which may change",
+							},
+							{
+								Text: "// between releases.",
+							},
+							{
+								Text: "//",
+							},
+							{
+								Text: "// The current implementation of this function can be found here:",
+							},
+							{
+								Text: "//    https://github.com/encoredev/encore/blob/" + gitRef + filePath + "#L" + strconv.Itoa(startLine) + "-L" + strconv.Itoa(endLine),
+							},
+						},
+					}
+				}
+
+				// Drop any parameters that are prefixed with "__" as these are used to indicate that
+				// the arguments are added in by Encore's code generators and should be ignored in
+				// the customer facing code.
+				newFieldList := &ast.FieldList{
+					Opening: token.NoPos,
+					Closing: token.NoPos,
+				}
+				for _, p := range node.Type.Params.List {
+					if len(p.Names) == 0 || strings.HasPrefix(p.Names[0].Name, "__") {
+						continue
+					}
+					newFieldList.List = append(newFieldList.List, p)
+				}
+				node.Type.Params = newFieldList
+
+				// If we have any results, add a placeholder names so we can use a naked return.
+				results := node.Type.Results
+				if results != nil && results.NumFields() > 0 {
+					for _, res := range results.List {
+						if len(res.Names) == 0 {
+							res.Names = []*ast.Ident{ast.NewIdent("_")}
+						}
+					}
+				}
+
+				// If we are keeping the function, replace the implementation with a panic
+				// as the code we're generating is only to help the IDE and users understand our API
+				// but isn't intended to be used in running apps
+				node.Body = &ast.BlockStmt{
+					Lbrace: token.NoPos,
+					List: []ast.Stmt{
+						&ast.ExprStmt{
+							X: &ast.CallExpr{
+								Fun:    ast.NewIdent("doPanic"),
+								Lparen: start,
+								Args: []ast.Expr{
+									&ast.BasicLit{
+										ValuePos: token.NoPos,
+										Kind:     token.STRING,
+										Value:    "\"encore apps must be run using the encore command\"",
+									},
+								},
+								Ellipsis: 0,
+								Rparen:   end,
+							},
+						},
+						&ast.ReturnStmt{},
+					},
+					Rbrace: token.NoPos,
+				}
+				usesPanicWrapper = true
+				return false
+
+			case *ast.TypeSpec:
+				var genDeclComment *ast.CommentGroup
+				if gd, ok := c.Parent().(*ast.GenDecl); ok {
+					genDeclComment = gd.Doc
+				}
+
+				dir := lookupDirective(node.Doc, node.Comment, genDeclComment)
+				keep := node.Name.IsExported() || dir == mustKeep
+				if dir == mustDrop || typesToDrop[f.Name.Name][node.Name.Name] {
+					keep = false
+				}
+
+				// Remove unexported types
+				if !keep {
+					c.Delete()
+					return false
+				} else if sel, ok := node.Type.(*ast.SelectorExpr); ok {
+					// else if we have a selector, rewrite the package name to see if this is an export from
+					// one of our private packages, in which case we want to copy it into the public API
+					if pkg, ok := sel.X.(*ast.Ident); ok && types[pkg.Name] != nil {
+						typ, found := types[pkg.Name][sel.Sel.Name]
+						if found {
+							node.Assign = token.NoPos // remove an alias assignment (as it was an alias for our own types)
+							node.Type = typ.node      // replace the type with the actual type
+							if typ.docs != nil {
+								if parent, ok := c.Parent().(*ast.GenDecl); ok {
+									if parent.Doc == nil {
+										parent.Doc = typ.docs // copy the docs over
+									}
+								} else if node.Doc == nil {
+									node.Doc = typ.docs // copy the docs over
+								}
+							}
+						}
+					}
+				}
+
+			case *ast.FuncType:
+				return false
+
+			case *ast.InterfaceType:
+				lastIfaceType = node
+
+			case *ast.ValueSpec:
+				// Remove unexported variables and constants
+				keep := false
+				for i, name := range node.Names {
+					if name.IsExported() {
+						keep = true
+					} else {
+						node.Names[i] = ast.NewIdent("_")
+					}
+				}
+
+				dir := lookupDirective(node.Doc, node.Comment)
+				if dir == mustKeep {
+					keep = true
+				} else if dir == mustDrop {
+					keep = false
+				}
+
+				if !keep {
+					c.Delete()
+					return false
+				}
+
+			case *ast.GenDecl:
+				dir := lookupDirective(node.Doc)
+				if dir == mustKeep {
+					return false
+				} else if dir == mustDrop {
+					c.Delete()
+					return false
+				}
+
+				// else if we have a selector, rewrite the package name to see if this is an export from
+				// one of our private packages, in which case we want to copy it into the public API
+				if node.Tok == token.CONST || node.Tok == token.VAR {
+					for _, spec := range node.Specs {
+						switch spec := spec.(type) {
+						case *ast.ValueSpec:
+							for i, value := range spec.Values {
+								if selector, ok := value.(*ast.SelectorExpr); ok {
+									if pkg, ok := selector.X.(*ast.Ident); ok && constants[pkg.Name] != nil {
+										typ, found := constants[pkg.Name][selector.Sel.Name]
+										if found {
+											if typ.node == nil && typ.typ == nil {
+												spec.Values = nil
+												spec.Type = nil
+											} else {
+												spec.Values[i] = typ.node
+
+												if typ.typ != nil {
+													// Copy the type over
+													spec.Type = typ.typ
+												}
+											}
+
+											if typ.docs != nil && spec.Doc == nil {
+												if _, found := commentsToAddToFile[f]; !found {
+													commentsToAddToFile[f] = map[string]*ast.CommentGroup{}
+												}
+
+												// copy the docs over in a later stage
+												// otherwise we'll put the first line of the doc in the wrong place
+												commentsToAddToFile[f][spec.Names[0].Name] = typ.docs
+											}
+										}
+									}
+								}
+							}
+						}
+					}
+				}
+
+			case *ast.Field:
+				// Keep exported fields if there's a doc saying we should
+				dir := lookupDirective(node.Doc, node.Comment)
+				keep := dir == mustKeep
+
+				if !keep {
+					// Remove unexported fields from structs
+					for i, name := range node.Names {
+						if name.IsExported() {
+							keep = true
+						} else {
+							node.Names[i] = ast.NewIdent("_")
+						}
+					}
+				}
+
+				// Is this field a type list? If so, keep it.
+				if bin, ok := node.Type.(*ast.BinaryExpr); ok && bin.Op == token.OR && node.Names == nil {
+					keep = true
+				}
+				// Or is it a type list with a single field within an interface?
+				if node.Names == nil && lastIfaceType != nil && posWithin(node.Pos(), lastIfaceType) {
+					keep = true
+				}
+
+				if dir == mustDrop {
+					keep = false
+				}
+
+				if !keep {
+					c.Delete()
+				}
+				return false
+			}
+
+			return true
+		},
+		func(c *astutil.Cursor) bool {
+			switch node := c.Node().(type) {
+			case *ast.GenDecl:
+				if len(node.Specs) == 0 {
+					clearCommentGroup(node.Doc)
+					c.Delete()
+				}
+
+			case *ast.StructType:
+				if len(node.Fields.List) == 0 {
+					node.Fields.List = append(node.Fields.List, &ast.Field{
+						Doc:   nil,
+						Names: []*ast.Ident{ast.NewIdent("_")},
+						Type:  ast.NewIdent("int"),
+						Tag:   nil,
+						Comment: &ast.CommentGroup{List: []*ast.Comment{
+							{
+								Slash: token.NoPos,
+								Text:  "// for godoc to show unexported fields",
+							},
+						}},
+					})
+				}
+			}
+
+			return true
+		},
+	)
+	return usesPanicWrapper, nil
+}
+
+func writePendingComments(originalFile *ast.File, formattedFile *ast.File) {
+	comments, found := commentsToAddToFile[originalFile]
+	if !found {
+		return
+	}
+
+	astutil.Apply(formattedFile, func(c *astutil.Cursor) bool {
+		switch node := c.Node().(type) {
+		case *ast.FuncDecl:
+			if comments, found := comments[funcName(node)]; found {
+				// check if the body is inline like this:
+				//   func Foo() { panic("foo") }
+				// and if so, then add a new line to the beginning of the comment
+				// to force it to be formatted like:
+				//   func Foo() {
+				//      // comment
+				//      panic("foo")
+				//   }
+				file := formattedFset.File(node.Pos())
+				panicPos := node.Body.List[0].Pos()
+				panicLine := file.Line(panicPos)
+				if file.LineStart(panicLine) < panicPos-3 {
+					comments.List[0].Text = "\n" + comments.List[0].Text
+				}
+
+				// Position the comment just before the first expression in the body
+				comments.List[0].Slash = panicPos - 1
+				formattedFile.Comments = append(formattedFile.Comments, comments)
+			}
+
+		case *ast.GenDecl:
+			if node.Tok == token.CONST {
+				for _, spec := range node.Specs {
+					name := spec.(*ast.ValueSpec).Names[0]
+					if comments, found := comments[name.Name]; found {
+						file := formattedFset.File(node.Pos())
+						comments.List[0].Slash = file.LineStart(file.Line(name.Pos()))
+						formattedFile.Comments = append(formattedFile.Comments, comments)
+					}
+				}
+			}
+		}
+		return true
+	}, nil)
+
+	// The comments _must_ be sorted, otherwise the formatter will get confused
+	// and put all out of order comments under the last ordered comment
+	sort.SliceStable(formattedFile.Comments, func(i, j int) bool {
+		return formattedFile.Comments[i].List[0].Slash < formattedFile.Comments[j].List[0].Slash
+	})
+}
+
+// walkDir recursively descends path, calling walkFn for directory
+func walkDir(dir, rel string, f func(path, rel string, files []os.DirEntry) error) error {
+	if rel == "types/uuid" {
+		// we don't want to rewrite this package
+		return nil
+	}
+
+	log.Debug().Str("rel", rel).Msg("walking directory")
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return err
+	}
+
+	// Split the files and dirs
+	var dirs, files []os.DirEntry
+	for _, entry := range entries {
+		if entry.IsDir() {
+			dirs = append(dirs, entry)
+		} else {
+			files = append(files, entry)
+		}
+	}
+
+	if err := f(dir, rel, files); err != nil {
+		return fmt.Errorf("error walking %s: %w", rel, err)
+	}
+
+	for _, d := range dirs {
+		dir2 := filepath.Join(dir, d.Name())
+		rel2 := path.Join(rel, d.Name())
+
+		if err := walkDir(dir2, rel2, f); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func repoDir() string {
+	cmd := exec.Command("git", "rev-parse", "--show-toplevel")
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		panic("unable to get repo directory")
+	}
+	return string(bytes.TrimSpace(out))
+}
+
+func repoCommit() string {
+	// First check if we have a tag pointed at this commit
+	cmd := exec.Command("git", "tag", "--points-at", "HEAD")
+	cmd.Dir = resolvedRepo
+	out, err := cmd.CombinedOutput()
+
+	// If that doesn't work, then just get the commit hash
+	if err != nil || string(bytes.TrimSpace(out)) == "" {
+		cmd := exec.Command("git", "rev-parse", "HEAD")
+		cmd.Dir = resolvedRepo
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			panic("unable to get repo commit")
+		}
+		return string(bytes.TrimSpace(out))
+	}
+
+	parts := strings.Split(string(bytes.TrimSpace(out)), "\n")
+	return strings.TrimSpace(parts[0])
+}
+
+func outDir() string {
+	srcDir := filepath.Dir(repoDir())
+	return filepath.Join(srcDir, "encore.dev")
+}
+
+// typeName returns the identifier of the expression unwrapping any pointers, selectors or generics, or nil if it is not an identifier
+func typeName(node ast.Expr) *ast.Ident {
+	// Remove any wrapped references
+	for {
+		if star, ok := node.(*ast.StarExpr); ok {
+			node = star.X
+			continue
+		}
+
+		if index, ok := node.(*ast.IndexExpr); ok {
+			node = index.X
+			continue
+		}
+
+		if indexList, ok := node.(*ast.IndexListExpr); ok {
+			node = indexList.X
+			continue
+		}
+
+		if selector, ok := node.(*ast.SelectorExpr); ok {
+			node = selector.X
+		}
+
+		break
+	}
+
+	if ident, ok := node.(*ast.Ident); ok {
+		return ident
+	}
+	return nil
+}
+
+func clearCommentGroup(node *ast.CommentGroup) {
+	if node == nil {
+		return
+	}
+	node.List = []*ast.Comment{node.List[0]}
+	node.List[0].Text = "  " // double space to prevent a panic when printing the file back out
+}
+
+type keepDirective string
+
+const (
+	none     keepDirective = "none"
+	mustKeep               = "keep"
+	mustDrop               = "drop"
+)
+
+// directiveCache caches the directive for a given comment group,
+// as the lookupDirective function mutates the comment which would
+// otherwise cause subsequent calls to return a different value.
+var directiveCache = make(map[*ast.CommentGroup]keepDirective)
+
+func lookupDirective(nodes ...*ast.CommentGroup) keepDirective {
+	result := none
+	for _, node := range nodes {
+		dir, cached := directiveCache[node]
+		if !cached {
+			dir = parseDirective(node)
+			clearDirectives(node)
+			directiveCache[node] = dir
+		}
+
+		if dir != none {
+			result = dir
+		}
+	}
+	return result
+}
+
+func parseDirective(node *ast.CommentGroup) keepDirective {
+	if node != nil && node.List != nil {
+		for _, comment := range node.List {
+			text := strings.TrimSpace(comment.Text)
+			switch text {
+			case "//publicapigen:keep":
+				return mustKeep
+			case "//publicapigen:drop":
+				return mustDrop
+			default:
+				continue
+			}
+		}
+	}
+	return none
+}
+
+func clearDirectives(node *ast.CommentGroup) {
+	if node != nil && node.List != nil {
+		for i, comment := range node.List {
+			text := strings.TrimSpace(comment.Text)
+			switch text {
+			case "//publicapigen:keep":
+			case "//publicapigen:drop":
+			default:
+				continue
+			}
+			if i == 0 {
+				comment.Text = "  "
+			} else {
+				comment.Text = "//" // empty comment line as I want the docs to remain active, but I can't remove this without causing a blank line between the comment group and what ever it's associated with
+			}
+		}
+	}
+}
+
+func isPrivateFile(fileName string) bool {
+	return strings.HasPrefix(fileName, "appruntime/") ||
+		strings.Contains(fileName, "internal/") ||
+		strings.HasSuffix(fileName, "_internal.go")
+}
+
+func removePosFromCommentGroup(doc *ast.CommentGroup) *ast.CommentGroup {
+	if doc == nil {
+		return nil
+	}
+
+	rtn := *doc
+
+	for i, originalLine := range rtn.List {
+		line := *originalLine
+		line.Slash = token.NoPos
+		rtn.List[i] = &line
+	}
+	return &rtn
+}
+
+func removePosition(node ast.Expr) ast.Expr {
+	if node == nil {
+		return nil
+	}
+
+	switch node := node.(type) {
+	case *ast.BasicLit:
+		lit := *node
+		lit.ValuePos = token.NoPos
+		return &lit
+
+	case *ast.Ident:
+		ident := *node
+		ident.NamePos = token.NoPos
+		return &ident
+
+	case *ast.SelectorExpr:
+		sel := *node
+		sel.X = removePosition(sel.X)
+		sel.Sel = removePosition(sel.Sel).(*ast.Ident)
+		return &sel
+
+	case *ast.UnaryExpr:
+		unary := *node
+		unary.OpPos = token.NoPos
+		unary.X = removePosition(unary.X)
+		return &unary
+
+	case *ast.BinaryExpr:
+		binary := *node
+		binary.OpPos = token.NoPos
+		binary.X = removePosition(binary.X)
+		binary.Y = removePosition(binary.Y)
+		return &binary
+
+	default:
+		log.Warn().Interface("node", node).Msg("unhandled node type to remove position from")
+		return node
+	}
+}
+
+func funcName(node *ast.FuncDecl) string {
+	var name strings.Builder
+
+	if node.Recv != nil {
+		name.WriteRune('(')
+		typ := node.Recv.List[0].Type
+
+		if star, ok := typ.(*ast.StarExpr); ok {
+			typ = star.X
+			name.WriteRune('*')
+		}
+
+		if index, ok := typ.(*ast.IndexExpr); ok {
+			name.WriteString(index.X.(*ast.Ident).Name)
+			name.WriteString("[]")
+		} else if indexList, ok := typ.(*ast.IndexListExpr); ok {
+			name.WriteString(indexList.X.(*ast.Ident).Name)
+			name.WriteString("[]")
+		} else {
+			name.WriteString(typ.(*ast.Ident).Name)
+		}
+
+		name.WriteString(").")
+	}
+
+	name.WriteString(node.Name.Name)
+	return name.String()
+}
+
+const panicWrapperSnippet = `
+// doPanic is a wrapper around panic to prevent static analysis tools
+// from thinking Encore APIs unconditionally panic.,
+func doPanic(v any) {
+	if os.Getenv("ENCORERUNTIME_NOPANIC") == "" {
+		panic(v)
+	}
+}
+`
+
+func posWithin(pos token.Pos, node ast.Node) bool {
+	return pos >= node.Pos() && pos < node.End()
+}
+
+func buildsSuccessfully(dir string) error {
+	cmd := exec.Command("go", "build", "./...")
+	cmd.Dir = dir
+	// nosemgrep trailofbits.go.invalid-usage-of-modified-variable.invalid-usage-of-modified-variable
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		err = fmt.Errorf("'go build' failed: %v: %s", err, out)
+	}
+	return err
+}
diff --git a/tools/semgrep-rules/README.md b/tools/semgrep-rules/README.md
new file mode 100644
index 0000000000..0ccad9de48
--- /dev/null
+++ b/tools/semgrep-rules/README.md
@@ -0,0 +1,3 @@
+# SemGrep Rules
+
+This directory contains a set of Semgrep rules we run against Encore's source code. You can find more information about the syntax of rules in the [Semgrep documentation](https://semgrep.dev/docs/writing-rules/overview/).
diff --git a/tools/semgrep-rules/semgrep-go/LICENSE b/tools/semgrep-rules/semgrep-go/LICENSE
new file mode 100644
index 0000000000..f35c67b9a2
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/LICENSE
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2020 Damian Gryski <damian@gryski.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
diff --git a/tools/semgrep-rules/semgrep-go/README.md b/tools/semgrep-rules/semgrep-go/README.md
new file mode 100644
index 0000000000..61bbcf484b
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/README.md
@@ -0,0 +1,102 @@
+semgrep-go
+==========
+
+> *Encore Note*
+> 
+> We've copied in the rules from https://github.com/dgryski/semgrep-go on 2023-07-27
+> However delete some rules that we don't want to run in our codebase and updated
+> some other rules.
+
+This repo holds patterns for finding odd Go code.
+
+The rules engines currently supported:
+
+* [semgrep](https://semgrep.dev/)
+* [ruleguard](https://github.com/quasilyte/go-ruleguard)
+
+I'll accept [comby](https://comby.dev) patterns if you can't get them to work with either semgrep or ruleguard.
+
+To run a single semgrep rule:
+
+```
+$ semgrep -f path/to/semgrep-go/rule.yml .
+```
+
+To run all semgrep rules:
+
+```
+$ semgrep -f path/to/semgrep-go/ .
+```
+
+To run all the ruleguard rules:
+
+```
+$ ruleguard -c=0 -rules path/to/semgrep-go/ruleguard.rules.go ./...
+```
+
+
+Semgrep checks:
+* badexponentiation: check for `2^x` and `10^x` which look like exponentiation
+* badnilguard: check for poorly formed nil guards
+* errtodo: check for TODOs in error handling code
+* hmac-bytes: check for using bytes.Equal() with HMACs
+* hostport: check for using fmt.Sprintf() instead of net.JoinHostPort()
+* mathbits: check for places you should use math/bits instead
+* mail-address: check for using fmt.Sprintf() instead of net/mail.Address.String()
+* oddbitwise: check for odd bit-wise expressions
+* oddcompare: check for odd comparisons
+* oddcompound: check for odd compound += or -= expressions
+* oddifsequence: check for an odd sequence of ifs
+* oddmathbits: check for odd uses of math/bits
+* parseint-downcast: check for places a parsed 64-bit int is downcast to 32-bits
+* returnnil: check for odd nil-returns
+* sprinterr: check for fmt.Sprint(err) instead of err.Error()
+* joinpath: check for using strings.Join() to construct paths
+* readfull: check for extra length check for io.ReadFull()
+* nilerr: returning a nil err instead of a nil value
+* errclosed: check for call strings.Contains() to detect net.ErrClosed
+* hmac-hash: check for bad hash.New passed to hmac.New()
+* readeof: check for ignoring io.EOF as a successful read
+* writestring: check for using io.WriteString(w, string(b))
+* wronglock: find incorrect lock/unlock pairs for rwmutex
+* contexttodo: find context.TODO() usage and suggest to change it
+* close-sql-query-rows: find places database/sql.Rows instance isn't Close()d
+* unixnano: check for time.Time comparisons using UnixNano()
+* timeafter: leaky use of time.After()
+* contextCancelable: checks for cancelable contexts not systematically canceled
+
+Ruleguard checks are in ruleguard.rules.go.
+* unconvert: check for unnecessary conversions
+* timeeq: check for using == and != with time.Time values
+* errnoterror: check for variables called `err` which are not the error type
+* ifbodythenbody: check for if statements with identical if and else bodies
+* subtractnoteq: check for x-y==0 instead of x==y
+* selfassign: check for variable self-assignments
+* oddnestedif: check for odd patterns of nested-ifs.
+* oddbitwise: check for odd bitwise expressions
+* ifreturn: check for off if/return sequences
+* oddifsequence: check for if sequences
+* nestedifsequence: check for odd nested if sequences
+* identicalassignments:  check for `x = y ; y = x` pairs.
+* oddcompoundop: check for odd compound operations
+* constswitch: check for switch statements with expressions
+* oddcomparisons: check for odd comparisons
+* oddmathbits: check for odd uses of math/bits
+* floateq: check for exact comparisons of floating point values
+* badexponent: check for `2^x` and `10^x` , which look like exponentiation
+* floatloop: check for using floats as loop counters
+* urlredacted: check for logging urls without calling url.Redacted()
+* sprinterr: check for calling fmt.Sprint(err) instead of err.Error()
+* largeloopcopy: check for large value copies in loops
+* joinpath: check for using strings.Join() to construct paths
+* readfull: check for extra length check for io.ReadFull()
+* nilerr: returning an nil error instead of a nil value
+* errnetclosed: check for call strings.Contains() to detect net.ErrClosed
+* hmac-hash: check for bad hash.New passed to hmac.New()
+* readeof: check for ignoring io.EOF as a successful read
+* writestring: check for using io.WriteString(w, string(b)) when b is []byte
+* badlock: find incorrect lock/unlock pairs for rwmutex
+* contexttodo: find context.TODO() usage and suggest to change it
+_
+
+*Find this useful? [Buy me a coffee!](https://www.buymeacoffee.com/dgryski)*
diff --git a/tools/semgrep-rules/semgrep-go/badexponentiation.yml b/tools/semgrep-rules/semgrep-go/badexponentiation.yml
new file mode 100644
index 0000000000..13d539c516
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/badexponentiation.yml
@@ -0,0 +1,9 @@
+rules:
+  - id: bad-exponentiation
+    patterns:
+        - pattern-either:
+              - pattern: 10 ^ $X
+              - pattern: 2 ^ $X
+    message: "Caret (^) is not exponentiation"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/badnilguard.yml b/tools/semgrep-rules/semgrep-go/badnilguard.yml
new file mode 100644
index 0000000000..c135f90e1a
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/badnilguard.yml
@@ -0,0 +1,13 @@
+rules:
+  - id: bad-nil-guard
+    patterns:
+        - pattern-either:
+              - pattern: $X == nil && <... $X.$F ...>
+              - pattern: $X != nil || <... $X.$F ...>
+              - pattern: <... $X.$F ...> && $X != nil
+              - pattern: <... $X.$F ...> || $X == nil
+              - pattern: <... $X.$F ...> && $X == nil
+              - pattern: <... $X.$F ...> || $X != nil
+    message: "Bad nil guard"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/close-sql-query-rows.yml b/tools/semgrep-rules/semgrep-go/close-sql-query-rows.yml
new file mode 100644
index 0000000000..9be89b1b75
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/close-sql-query-rows.yml
@@ -0,0 +1,57 @@
+rules:
+  - id: rows-not-closed
+    patterns:
+        - pattern: $Q.QueryxContext(...)
+        - pattern-not-inside: return $X.QueryxContext(...)
+
+        # direct close
+        - pattern-not-inside: |
+            $ROWS, $ERR = $Q.QueryxContext(...)
+            ...
+            $ROWS.Close()
+        # defer close
+        - pattern-not-inside: |
+            $ROWS, $ERR = $Q.QueryxContext(...)
+            ...
+            defer $ROWS.Close()
+        # passing rows to another function that is expected to close it
+        - pattern-not-inside: |
+            $ROWS, $ERR = $Q.QueryxContext(...)
+            ...
+            $FUNC($ROWS)
+        # close outside if
+        - pattern-not-inside: |
+            if ... {
+              ...
+              $ROWS, $ERR = $Q.QueryxContext(...)
+              ...
+            } else { ... }
+            $ROWS.Close()
+        - pattern-not-inside: |
+            if ... {
+              ...
+              $ROWS, $ERR = $Q.QueryxContext(...)
+              ...
+            } else { ... }
+            ...
+            defer $ROWS.Close()
+        # close outside else
+        - pattern-not-inside: |
+            if ... { ...  } else {
+              ...
+              $ROWS, $ERR = $Q.QueryxContext(...)
+              ...
+            }
+            ...
+            $ROWS.Close()
+        - pattern-not-inside: |
+            if ... { ...  } else {
+              ...
+              $ROWS, $ERR = $Q.QueryxContext(...)
+              ...
+            }
+            ...
+            defer $ROWS.Close()
+    message: "QueryxContext rows must be closed (or use ExecContext)"
+    languages: [go]
+    severity: ERROR
\ No newline at end of file
diff --git a/tools/semgrep-rules/semgrep-go/contextCancelable.yml b/tools/semgrep-rules/semgrep-go/contextCancelable.yml
new file mode 100644
index 0000000000..00558bd10d
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/contextCancelable.yml
@@ -0,0 +1,24 @@
+rules:
+  - id: cancelable-context-not-systematically-cancelled
+    patterns:
+      - pattern: $_, $X := context.$CANCELABLE(...)
+      - pattern-not-inside: |
+          $_, $X := context.$CANCELABLE(...)
+          ...
+          defer $X()
+      - pattern-not-inside: |
+          $_, $X := context.$CANCELABLE(...)
+          ...
+          $X()
+      - pattern-not-inside: |
+          $C = quicktest.New(...)
+          ...
+          $_, $X := context.$CANCELABLE(...)
+          ...
+          $C.Cleanup($X)
+      - metavariable-regex:
+          metavariable: '$CANCELABLE'
+          regex: '(WithDeadline|WithTimeout)'
+    message: it is good practice to call context cancellation function, $X(), in any case
+    languages: [go]
+    severity: WARNING
diff --git a/tools/semgrep-rules/semgrep-go/contextTODO.yml b/tools/semgrep-rules/semgrep-go/contextTODO.yml
new file mode 100644
index 0000000000..a0001e007c
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/contextTODO.yml
@@ -0,0 +1,9 @@
+rules:
+  - id: context-todo
+    patterns:
+        - pattern-either:
+              - pattern: |
+                      context.TODO()
+    message: "Consider to use well-defined context"
+    languages: [go]
+    severity: WARNING
diff --git a/tools/semgrep-rules/semgrep-go/ctx-time.yml b/tools/semgrep-rules/semgrep-go/ctx-time.yml
new file mode 100644
index 0000000000..6ec5d2b4e8
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/ctx-time.yml
@@ -0,0 +1,24 @@
+rules:
+- id: ctx-done-and-timers
+  patterns:
+    - pattern-either: 
+      - pattern: |
+          select {
+          case <-ctx.Done():
+              $BODY
+          case <-time.After(...):
+              $BODY
+          }
+      - pattern: |
+          $T := time.NewTicker(...)
+          ...
+          select {
+          case <-ctx.Done():
+              $BODY
+          case <-$T.C:
+              $BODY
+          }
+  message: "ctx.Done() and time.After/time.NewTicker"
+  languages: [go]
+  severity: ERROR
+
diff --git a/tools/semgrep-rules/semgrep-go/errclosed.yml b/tools/semgrep-rules/semgrep-go/errclosed.yml
new file mode 100644
index 0000000000..ee6b70b050
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/errclosed.yml
@@ -0,0 +1,10 @@
+rules:
+  - id: use-net-errclosed
+    patterns:
+            - pattern: strings.Contains($ERR.Error(), $X)
+            - metavariable-regex:
+                      metavariable: $X
+                      regex: '".*closed network connection.*"'
+    message: "Use errors.Is($ERR, net.ErrClosed) instead"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/errnilcheck.yml b/tools/semgrep-rules/semgrep-go/errnilcheck.yml
new file mode 100644
index 0000000000..2eef785b2b
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/errnilcheck.yml
@@ -0,0 +1,32 @@
+
+rules:
+  - id: err-nil-check
+    patterns:
+        - pattern-either:
+              - pattern: |
+                      if err != nil {
+                              return err
+                      }
+                      return nil
+              - pattern: |
+                      if err != nil {
+                              return $X, err
+                      }
+                      return $X, nil
+        - pattern-not-inside: |
+            if err != nil {
+                    return err
+            } else if ... {
+                    return ...
+            }       
+            return nil
+        - pattern-not-inside: |
+            if err != nil {
+                    return $X, err
+            } else if ... {
+                    return ...
+            }       
+            return $X, nil
+    message: "superfluous nil err check before return"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/errtodo.yml b/tools/semgrep-rules/semgrep-go/errtodo.yml
new file mode 100644
index 0000000000..8c498b66f4
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/errtodo.yml
@@ -0,0 +1,22 @@
+rules:
+  - id: err-todo
+    patterns:
+        - pattern-either:
+                - patterns:
+                        - pattern-inside:
+                              if err != nil {
+                                      ...
+                              }
+                        - pattern-regex: // ?(TODO|FIXME).*
+
+        - pattern-either:
+                - patterns:
+                        - pattern-inside: |
+                                      if ... ; err != nil {
+                                              ...
+                                      }
+                        - pattern-regex: // ?(TODO|FIXME).*
+
+    message: "TODO in error handling code"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/gofuzz.yml b/tools/semgrep-rules/semgrep-go/gofuzz.yml
new file mode 100644
index 0000000000..d974646437
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/gofuzz.yml
@@ -0,0 +1,18 @@
+rules:
+  - id: go-fuzz-to-native-fuzzing
+    patterns:
+            - pattern: func Fuzz($DATA []byte) int { $...BODY }
+    fix: |
+      // remove gofuzz build tag
+      // rename file to _test.go
+      // convert corpus with file2fuzz
+      func FuzzData(f *testing.F) {
+        f.Fuzz(func(t *testing.T, $DATA []byte) {
+          func() int {
+            $...BODY
+          }()
+        })
+      }
+    message: "old-style go-fuzz fuzz function found"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/hashsum.yml b/tools/semgrep-rules/semgrep-go/hashsum.yml
new file mode 100644
index 0000000000..47dfc02a98
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/hashsum.yml
@@ -0,0 +1,25 @@
+rules:
+  - id: hash-sum-without-write
+    patterns:
+                - pattern-either:
+                        - pattern: |
+                                $HASH.New().Sum($SLICE)
+                        - pattern: |
+                                $H := $HASH.New()
+                                ...
+                                $H.Sum($SLICE)
+                - pattern-not: |
+                        $H := $HASH.New()
+                        ...
+                        $H.Write(...)
+                        ...
+                        $H.Sum($SLICE)
+                - pattern-not: |
+                        $H := $HASH.New()
+                        ...
+                        $FUNC(..., $H, ...)
+                        ...
+                        $H.Sum($SLICE)
+    message: "odd hash.Sum call flow"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/hmac-bytes.yml b/tools/semgrep-rules/semgrep-go/hmac-bytes.yml
new file mode 100644
index 0000000000..629a8fe6c5
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/hmac-bytes.yml
@@ -0,0 +1,19 @@
+rules:
+  - id: use-hmac-equal
+    patterns:
+        - pattern-either:
+              - pattern: |
+                      $MAC = hmac.New(...)
+                      ...
+                      $H = $MAC.Sum(...)
+                      ...
+                      bytes.Equal($H, ...)
+              - pattern: |
+                      $MAC = hmac.New(...)
+                      ...
+                      $H = $MAC.Sum(...)
+                      ...
+                      bytes.Equal(..., $H)
+    message: "Comparing a MAC with bytes.Equal()"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/hmac-hash.yml b/tools/semgrep-rules/semgrep-go/hmac-hash.yml
new file mode 100644
index 0000000000..625d271c18
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/hmac-hash.yml
@@ -0,0 +1,21 @@
+rules:
+  - id: hmac-needs-new
+    patterns:
+        - pattern-either:
+                - pattern: | 
+                        $H := $HASH.New()
+                        ...
+                        $FUNC := func() hash.Hash { return $H }
+                        ...
+                        hmac.New($FUNC, ...)
+                - pattern: | 
+                        $H := $HASH.New()
+                        ...
+                        hmac.New(func() hash.Hash { return $H }, ...)
+
+                - pattern: |
+                        hmac.New(func() hash.Hash { return ( $H : hash.Hash) }, ...)
+
+    message: "calling hmac.New with unchanging hash.New"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/hostport.yml b/tools/semgrep-rules/semgrep-go/hostport.yml
new file mode 100644
index 0000000000..9182c17bc3
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/hostport.yml
@@ -0,0 +1,28 @@
+# https://github.com/golang/go/issues/28308, from @stapelberg
+rules:
+- id: sprintf-host-port
+  pattern-either:
+    - patterns:
+        - pattern-either:
+          - pattern: fmt.Sprintf("%s:%s", $NET, $XX)
+          - pattern: fmt.Sprintf("%s:%d", $NET, $XX)
+          - pattern: fmt.Sprintf("%s:%s", $XX, $NET)
+          - pattern: fmt.Sprintf("%s:%d", $XX, $NET)
+          - pattern: $NET = fmt.Sprintf("%s:%d", ..., ...)
+          - pattern: $NET = fmt.Sprintf("%s:%s", ..., ...)
+        - metavariable-regex:
+            metavariable: '$NET'
+            regex: '((?i).*(port|addr|host|listen|bind))|((?i)^ip$)|(ip[A-Z0-9].*|.*(Ip)$|.*(Ip)[A-Z0-9].*)'
+    - patterns:
+      - pattern: fmt.Sprintf($XX, $NET)
+      - metavariable-regex:
+          metavariable: '$XX'
+          regex: '"%s:[0-9]+"'
+      - metavariable-regex:
+          metavariable: '$NET'
+          regex: '((?i).*(port|addr|host|listen|bind))|((?i)^ip$)|(ip[A-Z0-9].*|.*(Ip)$|.*(Ip)[A-Z0-9].*)'
+  message: |
+    use net.JoinHostPort instead of fmt.Sprintf($XX, $NET)
+  languages: [go]
+  severity: ERROR
+
diff --git a/tools/semgrep-rules/semgrep-go/http-ctx-goroutine.yml b/tools/semgrep-rules/semgrep-go/http-ctx-goroutine.yml
new file mode 100644
index 0000000000..7068c3e0dd
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/http-ctx-goroutine.yml
@@ -0,0 +1,14 @@
+
+rules:
+  - id: http-request-go-context
+    patterns:
+    - pattern-either: 
+      - pattern: |
+          $CTX := ($R : *http.Request).Context()
+          ...
+          go $F($CTX, ...)
+      - pattern: |
+          go $F(($R : *http.Request).Context(), ...)
+    message: "passing an http-request scoped Context to a goroutine"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/ioutil-discard.yml b/tools/semgrep-rules/semgrep-go/ioutil-discard.yml
new file mode 100644
index 0000000000..70e7874873
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/ioutil-discard.yml
@@ -0,0 +1,7 @@
+rules:
+- id: deprecated-ioutil-discard
+  pattern: ioutil.Discard
+  fix: io.Discard
+  message: ioutil.Discard is deprecated
+  languages: [go]
+  severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/ioutil-nop-closer.yml b/tools/semgrep-rules/semgrep-go/ioutil-nop-closer.yml
new file mode 100644
index 0000000000..ac6d959411
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/ioutil-nop-closer.yml
@@ -0,0 +1,7 @@
+rules:
+- id: deprecated-ioutil-nopcloser
+  pattern: ioutil.NopCloser($R)
+  fix:  io.NopCloser($R)
+  message: ioutil.NopCloser is deprecated
+  languages: [go]
+  severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/ioutil-readall.yml b/tools/semgrep-rules/semgrep-go/ioutil-readall.yml
new file mode 100644
index 0000000000..e9e25d7abf
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/ioutil-readall.yml
@@ -0,0 +1,7 @@
+rules:
+- id: deprecated-ioutil-readall
+  pattern: ioutil.ReadAll($R)
+  fix: io.ReadAll($R)
+  message: ioutil.ReadAll is deprecated
+  languages: [go]
+  severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/ioutil-readdir.yml b/tools/semgrep-rules/semgrep-go/ioutil-readdir.yml
new file mode 100644
index 0000000000..01832f0352
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/ioutil-readdir.yml
@@ -0,0 +1,7 @@
+
+rules:
+- id: deprecated-ioutil-readdir
+  pattern: ioutil.ReadDir($D)
+  message: ioutil.ReadDir is deprecated
+  languages: [go]
+  severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/ioutil-readfile.yml b/tools/semgrep-rules/semgrep-go/ioutil-readfile.yml
new file mode 100644
index 0000000000..529d1ccc02
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/ioutil-readfile.yml
@@ -0,0 +1,7 @@
+rules:
+- id: deprecated-ioutil-readfile
+  pattern: ioutil.ReadFile($F)
+  fix: os.ReadFile($F)
+  message: ioutil.ReadFile is deprecated
+  languages: [go]
+  severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/ioutil-tmpdir.yml b/tools/semgrep-rules/semgrep-go/ioutil-tmpdir.yml
new file mode 100644
index 0000000000..2812cc9d60
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/ioutil-tmpdir.yml
@@ -0,0 +1,7 @@
+rules:
+- id: deprecated-ioutil-tempdir
+  pattern: ioutil.TempDir($D, $P)
+  fix: os.MkdirTemp($D, $P)
+  message: ioutil.TempDir is deprecated
+  languages: [go]
+  severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/ioutil-tmpfile.yml b/tools/semgrep-rules/semgrep-go/ioutil-tmpfile.yml
new file mode 100644
index 0000000000..944ead8c57
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/ioutil-tmpfile.yml
@@ -0,0 +1,7 @@
+rules:
+- id: deprecated-ioutil-tempfile
+  pattern: ioutil.TempFile($D, $P)
+  fix: os.CreateTemp($D, $P)
+  message: ioutil.TempFile is deprecated
+  languages: [go]
+  severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/ioutil-writefile.yml b/tools/semgrep-rules/semgrep-go/ioutil-writefile.yml
new file mode 100644
index 0000000000..fbc639b472
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/ioutil-writefile.yml
@@ -0,0 +1,7 @@
+rules:
+- id: deprecated-ioutil-writefile
+  pattern: ioutil.WriteFile($F, $D, $P)
+  fix: os.WriteFile($F, $D, $P)
+  message: ioutil.WriteFile is deprecated
+  languages: [go]
+  severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/joinpath.yml b/tools/semgrep-rules/semgrep-go/joinpath.yml
new file mode 100644
index 0000000000..518a4dd02e
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/joinpath.yml
@@ -0,0 +1,11 @@
+rules:
+  - id: use-strings-join-path
+    patterns:
+           - pattern-either:
+                        - pattern: strings.Join(..., "/")
+                        - pattern: strings.Join(..., "\\")
+                        - pattern: strings.Join(..., `\`)
+                        - pattern: strings.Join(..., os.PathSeparator)
+    message: "did you want path.Join() or filepath.Join()?"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/json-writer.yml b/tools/semgrep-rules/semgrep-go/json-writer.yml
new file mode 100644
index 0000000000..98aa0c579d
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/json-writer.yml
@@ -0,0 +1,35 @@
+rules:
+  - id: json-encoder-needs-type
+    patterns:
+                - pattern: |
+                        $ENC := json.NewEncoder(($W: http.ResponseWriter))
+                        ...
+                        $ENC.Encode(...)
+                - pattern-not: |
+                        $ENC := json.NewEncoder(($W: http.ResponseWriter))
+                        ...
+                        $W.Header().Set("=~/Content-Type/i", "=~/application/json/")
+                        ...
+                        $ENC.Encode(...)
+                - pattern-not-inside: |
+                        $W.Header().Set("=~/Content-Type/i", "=~/application/json/")
+                        ...
+                        $ENC := json.NewEncoder($W)
+                        ...
+                        $ENC.Encode(...)
+                - pattern-not: |
+                        $ENC := json.NewEncoder(($W: http.ResponseWriter))
+                        ...
+                        $W.Header().Add("=~/Content-Type/i", "=~/application/json/")
+                        ...
+                        $ENC.Encode(...)
+                - pattern-not-inside: |
+                        $W.Header().Add("=~/Content-Type/i", "=~/application/json/")
+                        ...
+                        $ENC := json.NewEncoder($W)
+                        ...
+                        $ENC.Encode(...)
+
+    message: "calling json.Encode() on an http.ResponseWriter will set Content-Type text/plain"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/mail-address.yml b/tools/semgrep-rules/semgrep-go/mail-address.yml
new file mode 100644
index 0000000000..9596eeaa34
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/mail-address.yml
@@ -0,0 +1,12 @@
+rules:
+  - id: sprintf-mail-address
+    pattern-either:
+        - pattern: fmt.Sprintf(`"%s" <%s>`, $NAME, $EMAIL)
+        - pattern: fmt.Sprintf(`"%s"<%s>`, $NAME, $EMAIL)
+        - pattern: fmt.Sprintf("\"%s\"<%s>", $NAME, $EMAIL)
+        - pattern: fmt.Sprintf("\"%s\" <%s>", $NAME, $EMAIL)
+        - pattern: fmt.Sprintf("%s<%s>", $NAME, $EMAIL)
+    message: "use net/mail Address.String() instead of fmt.Sprintf()"
+    fix: "(&mail.Address{Name:$NAME, Address:$EMAIL}).String()"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/marshaljson.yml b/tools/semgrep-rules/semgrep-go/marshaljson.yml
new file mode 100644
index 0000000000..8207c9404d
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/marshaljson.yml
@@ -0,0 +1,11 @@
+rules:
+  - id: marshal-json-misspell
+    pattern-either:
+      - patterns:
+          - pattern-regex: (?i)func \((.+)\) marshal[l]?json\((.*)\)
+          - pattern-not-regex: func \(.+\) MarshalJSON\(
+    fix: func ($1) MarshalJSON($2)
+    message: |
+      Misspelling of MarshalJSON.
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/marshalyaml.yml b/tools/semgrep-rules/semgrep-go/marshalyaml.yml
new file mode 100644
index 0000000000..f9ceaefb75
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/marshalyaml.yml
@@ -0,0 +1,11 @@
+rules:
+  - id: marshal-yaml-misspell
+    pattern-either:
+      - patterns:
+          - pattern-regex: (?i)func \((.+)\) marshal[l]?yaml\((.*)\)
+          - pattern-not-regex: func \(.+\) MarshalYAML\(
+    fix: func ($1) MarshalYAML($2)
+    message: |
+      Misspelling of MarshalYAML.
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/mathbits.yml b/tools/semgrep-rules/semgrep-go/mathbits.yml
new file mode 100644
index 0000000000..58c62e4844
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/mathbits.yml
@@ -0,0 +1,23 @@
+rules:
+  - id: use-math-bits
+    patterns:
+        - pattern-either:
+              - pattern: $X >> $N | $X << (8 - $N)
+              - pattern: $X << $N | $X >> (8 - $N)
+              - pattern: $X >> (8 - $N) | $X << $N
+              - pattern: $X << (8 - $N) | $X >> $N
+              - pattern: $X >> $N | $X << (16 - $N)
+              - pattern: $X << $N | $X >> (16 - $N)
+              - pattern: $X >> (16 - $N) | $X << $N
+              - pattern: $X << (16 - $N) | $X >> $N
+              - pattern: $X >> $N | $X << (32 - $N)
+              - pattern: $X << $N | $X >> (32 - $N)
+              - pattern: $X >> (32 - $N) | $X << $N
+              - pattern: $X << (32 - $N) | $X >> $N
+              - pattern: $X >> $N | $X << (64 - $N)
+              - pattern: $X << $N | $X >> (64 - $N)
+              - pattern: $X >> (64 - $N) | $X << $N
+              - pattern: $X << (64 - $N) | $X >> $N
+    message: "Try using math/bits instead"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/nilerr.yml b/tools/semgrep-rules/semgrep-go/nilerr.yml
new file mode 100644
index 0000000000..85ff5e62e1
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/nilerr.yml
@@ -0,0 +1,15 @@
+rules:
+  - id: return-nil-err
+    patterns:
+        - pattern-either:
+              - pattern: |
+                      if err == nil {
+                              return err
+                      }
+              - pattern: |
+                      if err == nil {
+                              return ..., err
+                      }
+    message: "return nil err instead of nil value"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/nrtxn.yml b/tools/semgrep-rules/semgrep-go/nrtxn.yml
new file mode 100644
index 0000000000..4b13e1e39c
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/nrtxn.yml
@@ -0,0 +1,16 @@
+rules:
+  - id: newrelic-start-without-end
+    patterns:
+                - pattern-not-inside: |
+                        $TXN := $NR.StartTransaction($N)
+                        ...
+                        defer $TXN.End()
+                - pattern-not-inside: |
+                            $TXN := $NR.StartTransaction($N)
+                            ...
+                            $TXN.End()
+                - pattern-either:
+                   - pattern: $TXN := $NR.StartTransaction($N)
+    message: "missing new relic end transaction"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddbitwise.yml b/tools/semgrep-rules/semgrep-go/oddbitwise.yml
new file mode 100644
index 0000000000..a52d622e2e
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddbitwise.yml
@@ -0,0 +1,14 @@
+rules:
+  - id: odd-bitwise
+    patterns:
+        - pattern-either:
+              - pattern: $X | $X
+              - pattern: $X | ^$X
+              - pattern: ^$X | $X
+              - pattern: $X & $X
+              - pattern: $X & ^$X
+              - pattern: ^$X & $X
+              - pattern: $X &^ $X
+    message: "Odd bitwise expression"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddcompare-subtract-eq-zero.yml b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-eq-zero.yml
new file mode 100644
index 0000000000..f442bdf4a1
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-eq-zero.yml
@@ -0,0 +1,10 @@
+# flag these odd comparisons as they all have simpler
+# equivalents with just $X and $Y and no zero term
+rules:
+  - id: odd-comparison-subtract-eq-zero
+    patterns:
+      - pattern: $X - $Y == 0
+    fix: $X == $Y
+    message: "Odd comparison"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddcompare-subtract-gt-zero.yml b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-gt-zero.yml
new file mode 100644
index 0000000000..31d6904f05
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-gt-zero.yml
@@ -0,0 +1,10 @@
+# flag these odd comparisons as they all have simpler
+# equivalents with just $X and $Y and no zero term
+rules:
+  - id: odd-comparison-subtract-gt-zero
+    patterns:
+      - pattern: $X - $Y > 0
+    fix: $X > $Y
+    message: "Odd comparison"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddcompare-subtract-gte-zero.yml b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-gte-zero.yml
new file mode 100644
index 0000000000..f66766c72c
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-gte-zero.yml
@@ -0,0 +1,10 @@
+# flag these odd comparisons as they all have simpler
+# equivalents with just $X and $Y and no zero term
+rules:
+  - id: odd-comparison-subtract-gte-zero
+    patterns:
+      - pattern: $X - $Y >= 0
+    fix: $X >= $Y
+    message: "Odd comparison"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddcompare-subtract-lt-zero.yml b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-lt-zero.yml
new file mode 100644
index 0000000000..f921dad5aa
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-lt-zero.yml
@@ -0,0 +1,10 @@
+# flag these odd comparisons as they all have simpler
+# equivalents with just $X and $Y and no zero term
+rules:
+  - id: odd-comparison-subtract-lt-zero
+    patterns:
+      - pattern: $X - $Y < 0
+    fix: $Y > $X
+    message: "Odd comparison"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddcompare-subtract-lte-zero.yml b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-lte-zero.yml
new file mode 100644
index 0000000000..ecda1ff8ab
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-lte-zero.yml
@@ -0,0 +1,10 @@
+# flag these odd comparisons as they all have simpler
+# equivalents with just $X and $Y and no zero term
+rules:
+  - id: odd-comparison-subtract-lte-zero
+    patterns:
+      - pattern: $X - $Y <= 0
+    fix: $Y >= $X
+    message: "Odd comparison"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddcompare-subtract-neq-zero.yml b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-neq-zero.yml
new file mode 100644
index 0000000000..4f9aa6cc24
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddcompare-subtract-neq-zero.yml
@@ -0,0 +1,10 @@
+# flag these odd comparisons as they all have simpler
+# equivalents with just $X and $Y and no zero term
+rules:
+  - id: odd-comparison-subtract-neq-zero
+    patterns:
+      - pattern: $X - $Y != 0
+    fix: $X != $Y
+    message: "Odd comparison"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddcompare-xor-eq-zero.yml b/tools/semgrep-rules/semgrep-go/oddcompare-xor-eq-zero.yml
new file mode 100644
index 0000000000..abac492354
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddcompare-xor-eq-zero.yml
@@ -0,0 +1,10 @@
+# flag these odd comparisons as they all have simpler
+# equivalents with just $X and $Y and no zero term
+rules:
+  - id: odd-comparison-xor-eq-zero
+    patterns:
+      - pattern: $X ^ $Y == 0
+    fix: $X == $Y
+    message: "Odd comparison"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddcompare-xor-neq-zero.yml b/tools/semgrep-rules/semgrep-go/oddcompare-xor-neq-zero.yml
new file mode 100644
index 0000000000..6740579e97
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddcompare-xor-neq-zero.yml
@@ -0,0 +1,10 @@
+# flag these odd comparisons as they all have simpler
+# equivalents with just $X and $Y and no zero term
+rules:
+  - id: odd-comparison-xor-neq-zero
+    patterns:
+      - pattern: $X ^ $Y != 0
+    fix: $X != $Y
+    message: "Odd comparison"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddcompound.yml b/tools/semgrep-rules/semgrep-go/oddcompound.yml
new file mode 100644
index 0000000000..b49ba9d298
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddcompound.yml
@@ -0,0 +1,11 @@
+rules:
+  - id: odd-compound-expression
+    patterns:
+        - pattern-either:
+              - pattern: $X += $X + $Y
+              - pattern: $X += $X - $Y
+              - pattern: $X -= $X + $Y
+              - pattern: $X -= $X - $Y
+    message: "Odd compound += or -= expression"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddifsequence.yml b/tools/semgrep-rules/semgrep-go/oddifsequence.yml
new file mode 100644
index 0000000000..c9410c0071
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddifsequence.yml
@@ -0,0 +1,134 @@
+rules:
+  - id: odd-sequence-ifs
+    patterns:
+        - pattern-either:
+          - pattern: |
+                  if $X { return ... }
+                  if $X { ... }
+          - pattern: |
+                  if ! $X { return ... }
+                  if $X { ... }
+          - pattern: |
+                  if $X { return ... }
+                  if ! $X { ... }
+          - pattern: |
+                  if $X == $Y { return ... }
+                  if $X != $Y { ... }
+          - pattern: |
+                  if $X != $Y { return ... }
+                  if $X == $Y { ... }
+          - pattern: |
+                  if $X { return  ... }
+                  for $X { ... }
+
+          - pattern: |
+                  if $X { break }
+                  if $X { ... }
+          - pattern: |
+                  if ! $X { break }
+                  if $X { ... }
+          - pattern: |
+                  if $X { break }
+                  if ! $X { ... }
+          - pattern: |
+                  if $X == $Y { break }
+                  if $X != $Y { ... }
+          - pattern: |
+                  if $X != $Y { break }
+                  if $X == $Y { ... }
+          - pattern: |
+                  if $X { break }
+                  for $X { ... }
+
+          - pattern: |
+                  if $X { continue }
+                  if $X { ... }
+          - pattern: |
+                  if ! $X { continue }
+                  if $X { ... }
+          - pattern: |
+                  if $X { continue }
+                  if ! $X { ... }
+          - pattern: |
+                  if $X == $Y { continue }
+                  if $X != $Y { ... }
+          - pattern: |
+                  if $X != $Y { continue }
+                  if $X == $Y { ... }
+          - pattern: |
+                  if $X { continue }
+                  for $X { ... }
+
+          - pattern: |
+                  if $X {
+                          if $X { ... }
+                          ...
+                  }
+          - pattern: |
+                  if $X {
+                          if ! $X { ... }
+                          ...
+                  }
+          - pattern: |
+                  if ! $X {
+                          if $X { ... }
+                        ...
+                  }
+          - pattern: |
+                  if $X == $Y {
+                          if $X != $Y { ... }
+                          ...
+                  }
+          - pattern: |
+                  if $X != $Y {
+                          if $X == $Y { ... }
+                          ...
+                  }
+          - pattern: |
+                  if $X {
+                          for ! $X { ... }
+                          ...
+                  }
+          - pattern: |
+                  if ! $X {
+                          for $X { ... }
+                        ...
+                  }
+          - pattern: |
+                  if $X == $Y {
+                          for $X != $Y { ... }
+                          ...
+                  }
+          - pattern: |
+                  if $X != $Y {
+                          for $X == $Y { ... }
+                          ...
+                  }
+          - pattern: |
+                  for $X {
+                          if $X { ... }
+                          ...
+                  }
+          - pattern: |
+                  for $X {
+                          if ! $X { ... }
+                          ...
+                  }
+          - pattern: |
+                  for ! $X {
+                          if $X { ... }
+                          ...
+                  }
+          - pattern: |
+                  for $X == $Y {
+                          if $X != $Y { ... }
+                          ...
+                  }
+          - pattern: |
+                  for $X != $Y {
+                          if $X == $Y { ... }
+                          ...
+                  }
+    message: "Odd sequence of ifs"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/oddmathbits.yml b/tools/semgrep-rules/semgrep-go/oddmathbits.yml
new file mode 100644
index 0000000000..edd9bcf8c8
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/oddmathbits.yml
@@ -0,0 +1,11 @@
+rules:
+  - id: odd-bits-leadingzeros
+    patterns:
+        - pattern-either:
+              - pattern: 64 - bits.LeadingZeros64($X)
+              - pattern: 32 - bits.LeadingZeros32($X)
+              - pattern: 16 - bits.LeadingZeros16($X)
+              - pattern: 8 - bits.LeadingZeros8($X)
+    message: "Odd bits.LeadingZeros() expression should perhaps be bits.Len()"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/os-error-is-exist.yml b/tools/semgrep-rules/semgrep-go/os-error-is-exist.yml
new file mode 100644
index 0000000000..6504e908b1
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/os-error-is-exist.yml
@@ -0,0 +1,8 @@
+rules:
+  - id: os-error-is-exist
+    patterns:
+     - pattern: os.IsExist($ERR)
+    fix: errors.Is($ERR, fs.ErrExist)
+    message: "New code should use errors.Is with the appropriate error type"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/os-error-is-not-exist.yml b/tools/semgrep-rules/semgrep-go/os-error-is-not-exist.yml
new file mode 100644
index 0000000000..74892da727
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/os-error-is-not-exist.yml
@@ -0,0 +1,8 @@
+rules:
+  - id: os-error-is-not-exist
+    patterns:
+     - pattern: os.IsNotExist($ERR)
+    fix: errors.Is($ERR, fs.ErrNotExist)
+    message: "New code should use errors.Is with the appropriate error type"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/os-error-is-permission.yml b/tools/semgrep-rules/semgrep-go/os-error-is-permission.yml
new file mode 100644
index 0000000000..6843d5352c
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/os-error-is-permission.yml
@@ -0,0 +1,8 @@
+rules:
+  - id: os-error-is-permission
+    patterns:
+     - pattern: os.IsPermission($ERR)
+    fix: errors.Is($ERR, fs.ErrPermission)
+    message: "New code should use errors.Is with the appropriate error type"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/os-error-is-timeout.yml b/tools/semgrep-rules/semgrep-go/os-error-is-timeout.yml
new file mode 100644
index 0000000000..5ee2470422
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/os-error-is-timeout.yml
@@ -0,0 +1,7 @@
+rules:
+  - id: os-error-is-timeout
+    patterns:
+     - pattern: os.IsTimeout(...)
+    message: "New code should use errors.Is with the appropriate error type"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/parseint-downcast.yml b/tools/semgrep-rules/semgrep-go/parseint-downcast.yml
new file mode 100644
index 0000000000..bcb6fe32f6
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/parseint-downcast.yml
@@ -0,0 +1,31 @@
+rules:
+  - id: parseint-downcast
+    patterns:
+      - pattern-either:
+              - pattern: |
+                              $X, ... = strconv.ParseInt(..., ..., 64)
+                              ...
+                              int32($X)
+              - pattern: |
+                              $X, ... = strconv.ParseInt(..., ..., 64)
+                              ...
+                              uint32($X)
+              - pattern: |
+                              $X, ... = strconv.ParseUint(..., ..., 64)
+                              ...
+                              int32($X)
+              - pattern: |
+                              $X, ... = strconv.ParseUint(..., ..., 64)
+                              ...
+                              uint32($X)
+              - pattern: |
+                              $X = strconv.Atoi(...)
+                              ...
+                              int32($X)
+              - pattern: |
+                              $X = strconv.Atoi(...)
+                              ...
+                              uint32($X)
+    message: "64-bit integer parsed and downcast to u/int32"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/readeof.yml b/tools/semgrep-rules/semgrep-go/readeof.yml
new file mode 100644
index 0000000000..09bd948b08
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/readeof.yml
@@ -0,0 +1,16 @@
+rules:
+  - id: read-io-eof
+    patterns:
+                    - pattern: |
+                        $N, $ERR := $R.Read(($SLICE : []byte))
+                        if $ERR != nil {
+                            return ...
+                        }
+                    - pattern-not: |
+                        $N, $ERR := rand.Read(($SLICE : []byte))
+                        if $ERR != nil {
+                            return ...
+                        }
+    message: "Read() can return n bytes and io.EOF"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/readfull.yml b/tools/semgrep-rules/semgrep-go/readfull.yml
new file mode 100644
index 0000000000..be614f33e7
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/readfull.yml
@@ -0,0 +1,17 @@
+rules:
+  - id: io-readfull-n
+    patterns:
+        - pattern-either:
+              - pattern: |
+                      $N, $ERR = io.ReadFull($R, $SLICE)
+                      if $ERR != nil || $N != len($SLICE) {
+                              ...
+                      }
+              - pattern: |
+                      $N, $ERR = io.ReadFull($R, $SLICE)
+                      if $N != len($SLICE) || $ERR != nil {
+                              ...
+                      }
+    message: "io.ReadFull() returns err == nil iff n == len(slice)"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/returnnil.yml b/tools/semgrep-rules/semgrep-go/returnnil.yml
new file mode 100644
index 0000000000..04c3b61501
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/returnnil.yml
@@ -0,0 +1,16 @@
+rules:
+  - id: return-nil
+    patterns:
+        - pattern-either:
+              - pattern: |
+                      if $X == nil {
+                              return $X
+                      }
+              - pattern: |
+                      if $X != nil {
+                              return ...
+                      }
+                      return $X
+    message: "return nil instead of nil value"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/ruleguard.rules.go b/tools/semgrep-rules/semgrep-go/ruleguard.rules.go
new file mode 100644
index 0000000000..623f3c3e26
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/ruleguard.rules.go
@@ -0,0 +1,562 @@
+//go:build ignore
+// +build ignore
+
+package gorules
+
+import "github.com/quasilyte/go-ruleguard/dsl"
+
+// This is a collection of rules for ruleguard: https://github.com/quasilyte/go-ruleguard
+
+// Remove extra conversions: mdempsky/unconvert
+func unconvert(m dsl.Matcher) {
+	m.Match("int($x)").Where(m["x"].Type.Is("int") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+
+	m.Match("float32($x)").Where(m["x"].Type.Is("float32") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+	m.Match("float64($x)").Where(m["x"].Type.Is("float64") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+
+	// m.Match("byte($x)").Where(m["x"].Type.Is("byte")).Report("unnecessary conversion").Suggest("$x")
+	// m.Match("rune($x)").Where(m["x"].Type.Is("rune")).Report("unnecessary conversion").Suggest("$x")
+	m.Match("bool($x)").Where(m["x"].Type.Is("bool") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+
+	m.Match("int8($x)").Where(m["x"].Type.Is("int8") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+	m.Match("int16($x)").Where(m["x"].Type.Is("int16") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+	m.Match("int32($x)").Where(m["x"].Type.Is("int32") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+	m.Match("int64($x)").Where(m["x"].Type.Is("int64") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+
+	m.Match("uint8($x)").Where(m["x"].Type.Is("uint8") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+	m.Match("uint16($x)").Where(m["x"].Type.Is("uint16") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+	m.Match("uint32($x)").Where(m["x"].Type.Is("uint32") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+	m.Match("uint64($x)").Where(m["x"].Type.Is("uint64") && !m["x"].Const).Report("unnecessary conversion").Suggest("$x")
+
+	m.Match("time.Duration($x)").Where(m["x"].Type.Is("time.Duration") &&
+		!m["x"].Node.Is("BasicLit") &&
+		!m["x"].Text.Matches("^[0-9_]*$")).Report("unnecessary conversion").Suggest("$x")
+}
+
+// Don't use == or != with time.Time
+// https://github.com/dominikh/go-tools/issues/47 : Wontfix
+func timeeq(m dsl.Matcher) {
+	m.Match("$t0 == $t1").Where(m["t0"].Type.Is("time.Time")).Report("using == with time.Time")
+	m.Match("$t0 != $t1").Where(m["t0"].Type.Is("time.Time")).Report("using != with time.Time")
+	m.Match(`map[$k]$v`).Where(m["k"].Type.Is("time.Time")).Report("map with time.Time keys are easy to misuse")
+}
+
+// err but no an error
+func errnoterror(m dsl.Matcher) {
+
+	// Would be easier to check for all err identifiers instead, but then how do we get the type from m[] ?
+
+	m.Match(
+		"if $*_, err := $x; $err != nil { $*_ } else if $_ { $*_ }",
+		"if $*_, err := $x; $err != nil { $*_ } else { $*_ }",
+		"if $*_, err := $x; $err != nil { $*_ }",
+
+		"if $*_, err = $x; $err != nil { $*_ } else if $_ { $*_ }",
+		"if $*_, err = $x; $err != nil { $*_ } else { $*_ }",
+		"if $*_, err = $x; $err != nil { $*_ }",
+
+		"$*_, err := $x; if $err != nil { $*_ } else if $_ { $*_ }",
+		"$*_, err := $x; if $err != nil { $*_ } else { $*_ }",
+		"$*_, err := $x; if $err != nil { $*_ }",
+
+		"$*_, err = $x; if $err != nil { $*_ } else if $_ { $*_ }",
+		"$*_, err = $x; if $err != nil { $*_ } else { $*_ }",
+		"$*_, err = $x; if $err != nil { $*_ }",
+	).
+		Where(m["err"].Text == "err" && !m["err"].Type.Is("error") && m["x"].Text != "recover()").
+		Report("err variable not error type")
+}
+
+// Identical if and else bodies
+func ifbodythenbody(m dsl.Matcher) {
+	m.Match("if $*_ { $body } else { $body }").
+		Report("identical if and else bodies")
+
+	// Lots of false positives.
+	// m.Match("if $*_ { $body } else if $*_ { $body }").
+	//	Report("identical if and else bodies")
+}
+
+// Odd inequality: A - B < 0 instead of !=
+// Too many false positives.
+/*
+func subtractnoteq(m dsl.Matcher) {
+	m.Match("$a - $b < 0").Report("consider $a != $b")
+	m.Match("$a - $b > 0").Report("consider $a != $b")
+	m.Match("0 < $a - $b").Report("consider $a != $b")
+	m.Match("0 > $a - $b").Report("consider $a != $b")
+}
+*/
+
+// Self-assignment
+func selfassign(m dsl.Matcher) {
+	m.Match("$x = $x").Report("useless self-assignment")
+}
+
+// Odd nested ifs
+func oddnestedif(m dsl.Matcher) {
+	m.Match("if $x { if $x { $*_ }; $*_ }",
+		"if $x == $y { if $x != $y {$*_ }; $*_ }",
+		"if $x != $y { if $x == $y {$*_ }; $*_ }",
+		"if $x { if !$x { $*_ }; $*_ }",
+		"if !$x { if $x { $*_ }; $*_ }").
+		Report("odd nested ifs")
+
+	m.Match("for $x { if $x { $*_ }; $*_ }",
+		"for $x == $y { if $x != $y {$*_ }; $*_ }",
+		"for $x != $y { if $x == $y {$*_ }; $*_ }",
+		"for $x { if !$x { $*_ }; $*_ }",
+		"for !$x { if $x { $*_ }; $*_ }").
+		Report("odd nested for/ifs")
+}
+
+// odd bitwise expressions
+func oddbitwise(m dsl.Matcher) {
+	m.Match("$x | $x",
+		"$x | ^$x",
+		"^$x | $x").
+		Report("odd bitwise OR")
+
+	m.Match("$x & $x",
+		"$x & ^$x",
+		"^$x & $x").
+		Report("odd bitwise AND")
+
+	m.Match("$x &^ $x").
+		Report("odd bitwise AND-NOT")
+}
+
+// odd sequence of if tests with return
+func ifreturn(m dsl.Matcher) {
+	m.Match("if $x { return $*_ }; if $x {$*_ }").Report("odd sequence of if test")
+	m.Match("if $x { return $*_ }; if !$x {$*_ }").Report("odd sequence of if test")
+	m.Match("if !$x { return $*_ }; if $x {$*_ }").Report("odd sequence of if test")
+	m.Match("if $x == $y { return $*_ }; if $x != $y {$*_ }").Report("odd sequence of if test")
+	m.Match("if $x != $y { return $*_ }; if $x == $y {$*_ }").Report("odd sequence of if test")
+
+}
+
+func oddifsequence(m dsl.Matcher) {
+	/*
+		m.Match("if $x { $*_ }; if $x {$*_ }").Report("odd sequence of if test")
+
+		m.Match("if $x == $y { $*_ }; if $y == $x {$*_ }").Report("odd sequence of if tests")
+		m.Match("if $x != $y { $*_ }; if $y != $x {$*_ }").Report("odd sequence of if tests")
+
+		m.Match("if $x < $y { $*_ }; if $y > $x {$*_ }").Report("odd sequence of if tests")
+		m.Match("if $x <= $y { $*_ }; if $y >= $x {$*_ }").Report("odd sequence of if tests")
+
+		m.Match("if $x > $y { $*_ }; if $y < $x {$*_ }").Report("odd sequence of if tests")
+		m.Match("if $x >= $y { $*_ }; if $y <= $x {$*_ }").Report("odd sequence of if tests")
+	*/
+}
+
+// odd sequence of nested if tests
+func nestedifsequence(m dsl.Matcher) {
+	/*
+		m.Match("if $x < $y { if $x >= $y {$*_ }; $*_ }").Report("odd sequence of nested if tests")
+		m.Match("if $x <= $y { if $x > $y {$*_ }; $*_ }").Report("odd sequence of nested if tests")
+		m.Match("if $x > $y { if $x <= $y {$*_ }; $*_ }").Report("odd sequence of nested if tests")
+		m.Match("if $x >= $y { if $x < $y {$*_ }; $*_ }").Report("odd sequence of nested if tests")
+	*/
+}
+
+// odd sequence of assignments
+func identicalassignments(m dsl.Matcher) {
+	m.Match("$x  = $y; $y = $x").Report("odd sequence of assignments")
+}
+
+func oddcompoundop(m dsl.Matcher) {
+	m.Match("$x += $x + $_",
+		"$x += $x - $_").
+		Report("odd += expression")
+
+	m.Match("$x -= $x + $_",
+		"$x -= $x - $_").
+		Report("odd -= expression")
+}
+
+func constswitch(m dsl.Matcher) {
+	m.Match("switch $x { $*_ }", "switch $*_; $x { $*_ }").
+		Where(m["x"].Const && !m["x"].Text.Matches(`^runtime\.`)).
+		Report("constant switch")
+}
+
+// oddcomparisons flags comparisons which all have simpler
+// equivalents with just $x and $y and no zero term
+func oddcomparisons(m dsl.Matcher) {
+	m.Match("$x - $y == 0").
+		Report("odd comparison").
+		Suggest("$x == $y")
+
+	m.Match("$x - $y != 0").
+		Report("odd comparison").
+		Suggest("$x != $y")
+
+	m.Match("$x - $y < 0").
+		Report("odd comparison").
+		Suggest("$y > $x")
+
+	m.Match("$x - $y <= 0").
+		Report("odd comparison").
+		Suggest("$y >= $x")
+
+	m.Match("$x - $y > 0").
+		Report("odd comparison").
+		Suggest("$x > $y")
+
+	m.Match("$x - $y >= 0").
+		Report("odd comparison").
+		Suggest("$x >= $y")
+
+	m.Match("$x ^ $y == 0").
+		Report("odd comparison").
+		Suggest("$x == $y")
+
+	m.Match("$x ^ $y != 0").
+		Report("odd comparison").
+		Suggest("$x != $y")
+}
+
+func oddmathbits(m dsl.Matcher) {
+	m.Match(
+		"64 - bits.LeadingZeros64($x)",
+		"32 - bits.LeadingZeros32($x)",
+		"16 - bits.LeadingZeros16($x)",
+		"8 - bits.LeadingZeros8($x)",
+	).Report("odd math/bits expression: use bits.Len*() instead?")
+}
+
+func floateq(m dsl.Matcher) {
+	m.Match(
+		"$x == $y",
+		"$x != $y",
+	).
+		Where(m["x"].Type.Is("float32") && !m["x"].Const && !m["y"].Text.Matches("0(.0+)?")).
+		Report("floating point tested for equality")
+
+	m.Match(
+		"$x == $y",
+		"$x != $y",
+	).
+		Where(m["x"].Type.Is("float64") && !m["x"].Const && !m["y"].Text.Matches("0(.0+)?")).
+		Report("floating point tested for equality")
+
+	m.Match("switch $x { $*_ }", "switch $*_; $x { $*_ }").
+		Where(m["x"].Type.Is("float32")).
+		Report("floating point as switch expression")
+
+	m.Match("switch $x { $*_ }", "switch $*_; $x { $*_ }").
+		Where(m["x"].Type.Is("float64")).
+		Report("floating point as switch expression")
+
+}
+
+func badexponent(m dsl.Matcher) {
+	m.Match(
+		"2 ^ $x",
+		"10 ^ $x",
+	).
+		Report("caret (^) is not exponentiation")
+}
+
+func floatloop(m dsl.Matcher) {
+	m.Match(
+		"for $i := $x; $i < $y; $i += $z { $*_ }",
+		"for $i = $x; $i < $y; $i += $z { $*_ }",
+	).
+		Where(m["i"].Type.Is("float64")).
+		Report("floating point for loop counter")
+
+	m.Match(
+		"for $i := $x; $i < $y; $i += $z { $*_ }",
+		"for $i = $x; $i < $y; $i += $z { $*_ }",
+	).
+		Where(m["i"].Type.Is("float32")).
+		Report("floating point for loop counter")
+}
+
+func urlredacted(m dsl.Matcher) {
+
+	m.Match(
+		"log.Println($x, $*_)",
+		"log.Println($*_, $x, $*_)",
+		"log.Println($*_, $x)",
+		"log.Printf($*_, $x, $*_)",
+		"log.Printf($*_, $x)",
+
+		"log.Println($x, $*_)",
+		"log.Println($*_, $x, $*_)",
+		"log.Println($*_, $x)",
+		"log.Printf($*_, $x, $*_)",
+		"log.Printf($*_, $x)",
+	).
+		Where(m["x"].Type.Is("*url.URL")).
+		Report("consider $x.Redacted() when outputting URLs")
+}
+
+func sprinterr(m dsl.Matcher) {
+	m.Match(`fmt.Sprint($err)`,
+		`fmt.Sprintf("%s", $err)`,
+		`fmt.Sprintf("%v", $err)`,
+	).
+		Where(m["err"].Type.Is("error")).
+		Report("maybe call $err.Error() instead of fmt.Sprint()?")
+
+}
+
+func largeloopcopy(m dsl.Matcher) {
+	m.Match(
+		`for $_, $v := range $_ { $*_ }`,
+	).
+		Where(m["v"].Type.Size > 512).
+		Report(`loop copies large value each iteration`)
+}
+
+func joinpath(m dsl.Matcher) {
+	m.Match(
+		`strings.Join($_, "/")`,
+		`strings.Join($_, "\\")`,
+		"strings.Join($_, `\\`)",
+	).
+		Report(`did you mean path.Join() or filepath.Join() ?`)
+}
+
+func readfull(m dsl.Matcher) {
+	m.Match(`$n, $err := io.ReadFull($_, $slice)
+                 if $err != nil || $n != len($slice) {
+                              $*_
+		 }`,
+		`$n, $err := io.ReadFull($_, $slice)
+                 if $n != len($slice) || $err != nil {
+                              $*_
+		 }`,
+		`$n, $err = io.ReadFull($_, $slice)
+                 if $err != nil || $n != len($slice) {
+                              $*_
+		 }`,
+		`$n, $err = io.ReadFull($_, $slice)
+                 if $n != len($slice) || $err != nil {
+                              $*_
+		 }`,
+		`if $n, $err := io.ReadFull($_, $slice); $n != len($slice) || $err != nil {
+                              $*_
+		 }`,
+		`if $n, $err := io.ReadFull($_, $slice); $err != nil || $n != len($slice) {
+                              $*_
+		 }`,
+		`if $n, $err = io.ReadFull($_, $slice); $n != len($slice) || $err != nil {
+                              $*_
+		 }`,
+		`if $n, $err = io.ReadFull($_, $slice); $err != nil || $n != len($slice) {
+                              $*_
+		 }`,
+	).Report("io.ReadFull() returns err == nil iff n == len(slice)")
+}
+
+func nilerr(m dsl.Matcher) {
+	m.Match(
+		`if err == nil { return err }`,
+		`if err == nil { return $*_, err }`,
+	).
+		Report(`return nil error instead of nil value`)
+
+}
+
+func mailaddress(m dsl.Matcher) {
+	m.Match(
+		"fmt.Sprintf(`\"%s\" <%s>`, $NAME, $EMAIL)",
+		"fmt.Sprintf(`\"%s\"<%s>`, $NAME, $EMAIL)",
+		"fmt.Sprintf(`%s <%s>`, $NAME, $EMAIL)",
+		"fmt.Sprintf(`%s<%s>`, $NAME, $EMAIL)",
+		`fmt.Sprintf("\"%s\"<%s>", $NAME, $EMAIL)`,
+		`fmt.Sprintf("\"%s\" <%s>", $NAME, $EMAIL)`,
+		`fmt.Sprintf("%s<%s>", $NAME, $EMAIL)`,
+		`fmt.Sprintf("%s <%s>", $NAME, $EMAIL)`,
+	).
+		Report("use net/mail Address.String() instead of fmt.Sprintf()").
+		Suggest("(&mail.Address{Name:$NAME, Address:$EMAIL}).String()")
+
+}
+
+func errnetclosed(m dsl.Matcher) {
+	m.Match(
+		`strings.Contains($err.Error(), $text)`,
+	).
+		Where(m["text"].Text.Matches("\".*closed network connection.*\"")).
+		Report(`String matching against error texts is fragile; use net.ErrClosed instead`).
+		Suggest(`errors.Is($err, net.ErrClosed)`)
+
+}
+
+func hmacnew(m dsl.Matcher) {
+	m.Match("hmac.New(func() hash.Hash { return $x }, $_)",
+		`$f := func() hash.Hash { return $x }
+	$*_
+	hmac.New($f, $_)`,
+	).Where(m["x"].Pure).
+		Report("invalid hash passed to hmac.New()")
+}
+
+func readeof(m dsl.Matcher) {
+	m.Match(
+		`$n, $err = $r.Read($_)
+	if $err != nil {
+	    return $*_
+	}`,
+		`$n, $err := $r.Read($_)
+	if $err != nil {
+	    return $*_
+	}`).Where(m["r"].Type.Implements("io.Reader")).
+		Report("Read() can return n bytes and io.EOF")
+}
+
+func writestring(m dsl.Matcher) {
+	m.Match(`io.WriteString($w, string($b))`).
+		Where(m["b"].Type.Is("[]byte")).
+		Suggest("$w.Write($b)")
+}
+
+func fmtfprint(m dsl.Matcher) {
+	m.Match(`fmt.Fprint($w, string($b))`).
+		Where(m["b"].Type.Is("[]byte")).
+		Suggest("$w.Write($b)")
+}
+
+func badlock(m dsl.Matcher) {
+	// Shouldn't give many false positives without type filter
+	// as Lock+Unlock pairs in combination with defer gives us pretty
+	// a good chance to guess correctly. If we constrain the type to sync.Mutex
+	// then it'll be harder to match embedded locks and custom methods
+	// that may forward the call to the sync.Mutex (or other synchronization primitive).
+
+	m.Match(`$mu.Lock(); defer $mu.RUnlock()`).Report(`maybe $mu.RLock() was intended?`)
+	m.Match(`$mu.RLock(); defer $mu.Unlock()`).Report(`maybe $mu.Lock() was intended?`)
+
+	// `mu1` and `mu2` are added to make possible report a line where `m2` is used (with a defer)
+	m.Match(`$mu1.Lock(); defer $mu2.Lock()`).
+		Where(m["mu1"].Text == m["mu2"].Text).
+		At(m["mu2"]).
+		Report(`maybe defer $mu1.Unlock() was intended?`)
+	m.Match(`$mu1.RLock(); defer $mu2.RLock()`).
+		Where(m["mu1"].Text == m["mu2"].Text).
+		At(m["mu2"]).
+		Report(`maybe defer $mu1.RUnlock() was intended?`)
+}
+
+func setenvUsedInTests(m dsl.Matcher) {
+	m.Match(
+		`os.Setenv($key, $val); defer os.Unsetenv($key)`,
+		`os.Setenv($key, $val); defer os.Setenv($key, "")`,
+	).
+		Where(m.File().Name.Matches("_test.go")).
+		Report(`should prefer t.Setenv within tests`).
+		Suggest(`t.Setenv($key, $val)`)
+}
+
+func contextTODO(m dsl.Matcher) {
+	m.Match(`context.TODO()`).Report(`consider to use well-defined context`)
+}
+
+func wrongerrcall(m dsl.Matcher) {
+	m.Match(
+		`if $x.Err() != nil { return err }`,
+		`if $x.Err() != nil { return $*_, err }`,
+	).
+		Report(`maybe returning wrong error after Err() call`)
+}
+
+// ioutil.Discard => io.Discard
+func ioutilDiscard(m dsl.Matcher) {
+	m.Match(
+		`ioutil.Discard`,
+	).
+		Report(`As of Go 1.16, this value is simply io.Discard.`).
+		Suggest(`io.Discard`)
+}
+
+// ioutil.NopCloser => io.NopCloser
+func ioutilNopCloser(m dsl.Matcher) {
+	m.Match(
+		`ioutil.NopCloser($r)`,
+	).Where(m["r"].Type.Implements("io.Reader")).
+		Report(`As of Go 1.16, this function simply calls io.NopCloser.`).
+		Suggest(`io.NopCloser($r)`)
+}
+
+// ioutil.ReadAll => io.ReadAll
+func ioutilReadAll(m dsl.Matcher) {
+	m.Match(
+		`ioutil.ReadAll($r)`,
+	).Where(m["r"].Type.Implements("io.Reader")).
+		Report(`As of Go 1.16, this function simply calls io.ReadAll.`).
+		Suggest(`io.ReadAll($r)`)
+}
+
+// ioutil.ReadDir => os.ReadDir
+func ioutilReadDir(m dsl.Matcher) {
+	m.Match(
+		`ioutil.ReadDir($d)`,
+	).Where(m["d"].Type.Is("string")).
+		Report(`As of Go 1.16, os.ReadDir is a more efficient and correct choice: it returns a list of fs.DirEntry instead of fs.FileInfo, and it returns partial results in the case of an error midway through reading a directory.`).
+		Suggest(`os.ReadDir($d)`)
+}
+
+// ioutil.ReadFile => os.ReadFile
+func ioutilReadFile(m dsl.Matcher) {
+	m.Match(
+		`ioutil.ReadFile($f)`,
+	).Where(m["f"].Type.Is("string")).
+		Report(`As of Go 1.16, this function simply calls os.ReadFile.`).
+		Suggest(`os.ReadFile($f)`)
+}
+
+// ioutil.TempDir => os.MkdirTemp
+func ioutilTempDir(m dsl.Matcher) {
+	m.Match(
+		`ioutil.TempDir($d, $p)`,
+	).Where(m["d"].Type.Is("string") && m["p"].Type.Is("string")).
+		Report(`As of Go 1.17, this function simply calls os.MkdirTemp.`).
+		Suggest(`os.MkdirTemp($d, $p)`)
+}
+
+// ioutil.TempFile => os.CreateTemp
+func ioutilTempFile(m dsl.Matcher) {
+	m.Match(
+		`ioutil.TempFile($d, $p)`,
+	).Where(m["d"].Type.Is("string") && m["p"].Type.Is("string")).
+		Report(`As of Go 1.17, this function simply calls os.CreateTemp.`).
+		Suggest(`os.CreateTemp($d, $p)`)
+}
+
+// ioutil.WriteFile => os.WriteFile
+func ioutilWriteFile(m dsl.Matcher) {
+	m.Import("io/fs")
+	m.Match(
+		`ioutil.WriteFile($f, $d, $p)`,
+	).Where(m["f"].Type.Is("string") && m["d"].Type.Is("[]byte") && m["p"].Type.Is("fs.FileMode")).
+		Report(`As of Go 1.16, this function simply calls os.WriteFile.`).
+		Suggest(`os.WriteFile($f, $d, $p)`)
+}
+
+func ioWriterWriteMisuse(m dsl.Matcher) {
+	// io.Writer.Write([]byte(string)) => io.WriteString(io.Writer, string)
+	m.Match(`$w.Write([]byte($s))`).
+		Where(m["s"].Type.Is("string") && m["w"].Type.HasMethod("io.Writer.Write") && !m["w"].Type.HasMethod("io.StringWriter.WriteString")).
+		Report(`Use io.WriteString when writing a string to an io.Writer`).
+		Suggest(`io.WriteString($w, $s)`)
+
+	// interface{ io.Writer; io.StringWriter }.Write([]byte(string)) => interface{ io.Writer; io.StringWriter }.WriteString(string)
+	m.Match(`$w.Write([]byte($s))`).
+		Where(m["s"].Type.Is("string") && m["w"].Type.HasMethod("io.Writer.Write") && m["w"].Type.HasMethod("io.StringWriter.WriteString")).
+		Report(`Use WriteString when writing a string to an io.StringWriter`).
+		Suggest(`$w.WriteString($s)`)
+}
+
+func ioStringWriterWriteStringMisuse(m dsl.Matcher) {
+	// interface{ io.Writer; io.StringWriter }.WriteString(string([]byte)) => interface{ io.Writer; io.StringWriter }.Write([]byte)
+	m.Match(`$w.WriteString(string($b))`).
+		Where(m["b"].Type.Is("[]byte") && m["w"].Type.HasMethod("io.Writer.Write") && m["w"].Type.HasMethod("io.StringWriter.WriteString")).
+		Report(`Use Write when writing a []byte to an io.Writer`).
+		Suggest(`$w.Write($b)`)
+}
diff --git a/tools/semgrep-rules/semgrep-go/sortslice.yml b/tools/semgrep-rules/semgrep-go/sortslice.yml
new file mode 100644
index 0000000000..c2560ff579
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/sortslice.yml
@@ -0,0 +1,40 @@
+rules:
+  - id: bad-sort-slice-function
+    patterns:
+        - pattern-either:
+            - pattern: |
+                sort.Slice($SLICE, func($I, $J int) bool {
+                    return $SLICE[$I] < $SLICE[$I]
+                })
+            - pattern: |
+                sort.Slice($SLICE, func($I, $J int) bool {
+                    return $SLICE[$J] < $SLICE[$I]
+                })
+            - pattern: |
+                sort.Slice($SLICE, func($I, $J int) bool {
+                    return $SLICE[$I].$FIELD < $SLICE[$I].$FIELD
+                })
+            - pattern: |
+                sort.Slice($SLICE, func($I, $J int) bool {
+                    return $SLICE[$J].$FIELD < $SLICE[$J].$FIELD
+                })
+            - pattern: |
+                sort.Slice($SLICE, func($I, $J int) bool {
+                    return $SLICE[$I] > $SLICE[$I]
+                })
+            - pattern: |
+                sort.Slice($SLICE, func($I, $J int) bool {
+                    return $SLICE[$J] > $SLICE[$I]
+                })
+            - pattern: |
+                sort.Slice($SLICE, func($I, $J int) bool {
+                    return $SLICE[$I].$FIELD > $SLICE[$I].$FIELD
+                })
+            - pattern: |
+                sort.Slice($SLICE, func($I, $J int) bool {
+                    return $SLICE[$J].$FIELD > $SLICE[$J].$FIELD
+                })
+
+    message: "Maybe bad sort.Slice() less function"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/sprinterr.yml b/tools/semgrep-rules/semgrep-go/sprinterr.yml
new file mode 100644
index 0000000000..f9b8e4e2f2
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/sprinterr.yml
@@ -0,0 +1,54 @@
+rules:
+  - id: use-err-error
+    patterns:
+        - pattern-not: |
+                if err != nil {
+                        ..., err = ...
+                        <... fmt.Sprint(err) ...>
+                }
+        - pattern-not: |
+                if err != nil {
+                        err = ...
+                        <... fmt.Sprint(err) ...>
+                }
+
+        - pattern-either:
+              - pattern: |
+                        if err != nil {
+                                ...
+                                <... fmt.Sprint(err) ...>
+                        }
+              - pattern: |
+                        if err == nil {
+                                ...
+                                return ...
+                        }
+                        ...
+                        <...  fmt.Sprint(err) ...>
+              - pattern: |
+                        if err != nil {
+                                ...
+                                <... fmt.Sprintf("%s", err) ...>
+                        }
+              - pattern: |
+                        if err == nil {
+                                ...
+                                return ...
+                        }
+                        ...
+                        <...  fmt.Sprintf("%s", err) ...>
+              - pattern: |
+                        if err != nil {
+                                ...
+                                <... fmt.Sprintf("%v", err) ...>
+                        }
+              - pattern: |
+                        if err == nil {
+                                ...
+                                return ...
+                        }
+                        ...
+                        <...  fmt.Sprintf("%v", err) ...>
+    message: "Use err.Error() instead"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/timeafter.yml b/tools/semgrep-rules/semgrep-go/timeafter.yml
new file mode 100644
index 0000000000..56d4ad63a0
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/timeafter.yml
@@ -0,0 +1,16 @@
+rules:
+  - id: leaky-time-after
+    patterns:
+        - pattern-either:
+              - pattern: |
+                  for {
+                      ...
+                      select {
+                      case <- time.After(...):
+                          ...
+                      }
+                      ...
+                  }
+    message: "Leaky use of time.After in for-select, see: https://groups.google.com/g/golang-nuts/c/cCdm0Ixwi9A/m/jMiJJScAEAAJ"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/unixnano-after.yml b/tools/semgrep-rules/semgrep-go/unixnano-after.yml
new file mode 100644
index 0000000000..bda7cd7e32
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/unixnano-after.yml
@@ -0,0 +1,8 @@
+rules:
+  - id: not-after
+    patterns:
+      - pattern: $T1.UnixNano() <= $T2.UnixNano()
+    message: >
+      unless checking for wall clock inconsistencies, use !$T1.After($T2)
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/unixnano-before.yml b/tools/semgrep-rules/semgrep-go/unixnano-before.yml
new file mode 100644
index 0000000000..5ea8defa4f
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/unixnano-before.yml
@@ -0,0 +1,8 @@
+rules:
+  - id: not-before
+    patterns:
+      - pattern: $T1.UnixNano() >= $T2.UnixNano()
+    message: >
+        unless checking for wall clock inconsistencies, use !$T1.Before($T2)
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/unmarshaljson.yml b/tools/semgrep-rules/semgrep-go/unmarshaljson.yml
new file mode 100644
index 0000000000..8d30e81894
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/unmarshaljson.yml
@@ -0,0 +1,11 @@
+rules:
+  - id: unmarshal-json-misspell
+    pattern-either:
+      - patterns:
+          - pattern-regex: (?i)func \((.+)\) unmarshal[l]?json\((.*)\)
+          - pattern-not-regex: func \(.+\) UnmarshalJSON\(
+    fix: func ($1) UnmarshalJSON($2)
+    message: |
+      Misspelling of UnmarshalJSON.
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/unmarshalyaml.yml b/tools/semgrep-rules/semgrep-go/unmarshalyaml.yml
new file mode 100644
index 0000000000..a910eaae69
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/unmarshalyaml.yml
@@ -0,0 +1,11 @@
+rules:
+  - id: unmarshal-yaml-misspell
+    pattern-either:
+      - patterns:
+          - pattern-regex: (?i)func \((.+)\) unmarshal[l]?yaml\((.*)\)
+          - pattern-not-regex: func \(.+\) UnmarshalYAML\(
+    fix: func ($1) UnmarshalYAML($2)
+    message: |
+      Misspelling of UnmarshalYAML.
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/use-fprintf-not-write-fsprint.yml b/tools/semgrep-rules/semgrep-go/use-fprintf-not-write-fsprint.yml
new file mode 100644
index 0000000000..c4bb77f5bc
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/use-fprintf-not-write-fsprint.yml
@@ -0,0 +1,7 @@
+rules:
+  - id: use-fprintf-not-write-fsprint
+    patterns:
+        - pattern: $W.Write([]byte(fmt.Sprintf($...VALS)))
+    message: "use fmt.Fprintf($W, $...VALS) instead of fmt.Sprintf and []byte conversion"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/use-write-not-fprint.yml b/tools/semgrep-rules/semgrep-go/use-write-not-fprint.yml
new file mode 100644
index 0000000000..b9a55ea7d1
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/use-write-not-fprint.yml
@@ -0,0 +1,7 @@
+rules:
+  - id: use-write-not-fprint
+    patterns:
+        - pattern: fmt.Fprint($W, string($VAR))
+    message: "use $W.Write($VAR) instead of fmt.Fprint when $VAR is []byte"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/use-writer-not-writestring.yml b/tools/semgrep-rules/semgrep-go/use-writer-not-writestring.yml
new file mode 100644
index 0000000000..20a4e20440
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/use-writer-not-writestring.yml
@@ -0,0 +1,7 @@
+rules:
+  - id: use-writer-not-writestring
+    patterns:
+        - pattern: io.WriteString($W, string($VAR))
+    message: "use $W.Write($VAR) instead of io.WriteString when $VAR is []byte"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/wrongerrcall.yml b/tools/semgrep-rules/semgrep-go/wrongerrcall.yml
new file mode 100644
index 0000000000..08fa3a63ed
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/wrongerrcall.yml
@@ -0,0 +1,16 @@
+rules:
+  - id: maybe-wrong-err
+    patterns:
+        - pattern-either:
+              - pattern: |
+                      if $F.Err() != nil {
+                              return ..., <... err ...>
+                      }
+              - pattern: |
+                      if $F.Err() != nil {
+                              return <... err ...>
+                      }
+
+    message: "maybe returning wrong error"
+    languages: [go]
+    severity: ERROR
diff --git a/tools/semgrep-rules/semgrep-go/wronglock.yml b/tools/semgrep-rules/semgrep-go/wronglock.yml
new file mode 100644
index 0000000000..5f8422ce46
--- /dev/null
+++ b/tools/semgrep-rules/semgrep-go/wronglock.yml
@@ -0,0 +1,19 @@
+rules:
+  - id: wrong-lock-unlock
+    patterns:
+        - pattern-either:
+              - pattern: |
+                  $M.Lock()
+                  defer $M.RUnlock()
+              - pattern: |
+                  $M.RLock()
+                  defer $M.Unlock()
+              - pattern: |
+                  $M.Lock()
+                  defer $M.Lock()
+              - pattern: |
+                  $M.RLock()
+                  defer $M.RLock()
+    message: "Wrong lock/unlock pair?"
+    languages: [go]
+    severity: ERROR
diff --git a/ts_llm_instructions.txt b/ts_llm_instructions.txt
new file mode 100644
index 0000000000..14bbbd7368
--- /dev/null
+++ b/ts_llm_instructions.txt
@@ -0,0 +1,1829 @@
+<llm_info>
+  If the user asks you questions, you should assume you are Corey and act accordingly.
+</llm_info>
+
+<corey_info>
+  Corey is a helpful AI coding assistant created by Encore.
+  Corey acts as the world's most proficient developers would.
+  Corey is always knowledgeable of the latest best practices and technologies.
+  Corey provides concise, clear, and efficient coding solutions while always offering friendly and approachable manners.
+  Unless otherwise specified by the user, Corey defaults to using Encore.ts, a typescript backend framework, for backend development.
+  Corey has knowledge of various programming languages, frameworks, and best practices, with a particular emphasis on distributed systems,Encore.ts, Node.js, TypeScript, React, Next.js, and modern development.
+</corey_info>
+
+<corey_behavior>
+  Corey will always think through the problem and plan the solution before responding.
+  Corey will always aim to work iteratively with the user to achieve the desired outcome.
+  Corey will always optimize the solution for the user's needs and goals.
+</corey_behavior>
+
+<nodejs_style_guide>
+ Corey MUST write valid TypeScript code, which uses state-of-the-art Node.js v20+ features and follows best practices:
+  - Always use ES6+ syntax.
+  - Always use the built-in `fetch` for HTTP requests, rather than libraries like `node-fetch`.
+  - Always use Node.js `import`, never use `require`.
+</nodejs_style_guide>
+
+<typescript_style_guide>
+  <rule>Use interface or type definitions for complex objects</rule>
+  <rule>Prefer TypeScript's built-in utility types (e.g., Record, Partial, Pick) over any</rule>
+</typescript_style_guide>
+
+<encore_ts_domain_knowledge>
+
+<api_definition>
+
+<core_concepts>
+<concept>Encore.ts provides type-safe TypeScript API endpoints with built-in request validation</concept>
+<concept>APIs are async functions with TypeScript interfaces defining request/response types</concept>
+<concept>Source code parsing enables automatic request validation against schemas</concept>
+</core_concepts>
+
+<syntax>
+import { api } from "encore.dev/api";
+export const endpoint = api(options, async handler);
+</syntax>
+  <options>
+    <option name="method">HTTP method (GET, POST, etc.)</option>
+    <option name="expose">Boolean controlling public access (default: false)</option>
+    <option name="auth">Boolean requiring authentication (optional)</option>
+    <option name="path">URL path pattern (optional)</option>
+  </options>
+<code_example name="basic_endpoint">
+import { api } from "encore.dev/api";
+interface PingParams {
+name: string;
+}
+interface PingResponse {
+message: string;
+}
+export const ping = api(
+{ method: "POST" },
+async (p: PingParams): Promise<PingResponse> => {
+return { message: Hello ${p.name}! };
+}
+);
+</code_example>
+<schema_patterns>
+<pattern type="full">
+api({ ... }, async (params: Params): Promise<Response> => {})
+</pattern>
+<pattern type="response_only">
+api({ ... }, async (): Promise<Response> => {})
+</pattern>
+<pattern type="request_only">
+api({ ... }, async (params: Params): Promise<void> => {})
+</pattern>
+<pattern type="no_data">
+api({ ... }, async (): Promise<void> => {})
+</pattern>
+</schema_patterns>
+<parameter_types>
+<type name="Header">
+<description>Maps field to HTTP header</description>
+<syntax>fieldName: Header<"Header-Name"></syntax>
+</type>
+  <type name="Query">
+    <description>Maps field to URL query parameter</description>
+    <syntax>fieldName: Query<type></syntax>
+  </type>
+  <type name="Path">
+    <description>Maps to URL path parameters using :param or *wildcard syntax</description>
+    <syntax>path: "/route/:param/*wildcard"</syntax>
+  </type>
+</parameter_types>
+</api_definition>
+
+<api_calls>
+  <core_concepts>
+<concept>Service-to-service calls use simple function call syntax</concept>
+<concept>Services are imported from ~encore/clients module</concept>
+<concept>Provides compile-time type checking and IDE autocompletion</concept>
+</core_concepts>
+<implementation>
+  <step>Import target service from ~encore/clients</step>
+  <step>Call API endpoints as regular async functions</step>
+  <step>Receive type-safe responses with full IDE support</step>
+</implementation>
+<code_example name="service_call">
+import { hello } from "~encore/clients";
+export const myOtherAPI = api({}, async (): Promise<void> => {
+const resp = await hello.ping({ name: "World" });
+console.log(resp.message); // "Hello World!"
+});
+</code_example>
+</api_calls>
+
+<application_structure>
+<core_principles>
+  <principle>Use monorepo design for entire backend application</principle>
+  <principle>One Encore app enables full application model benefits</principle>
+  <principle>Supports both monolith and microservices approaches</principle>
+  <principle>Services cannot be nested within other services</principle>
+</core_principles>
+
+<service_definition>
+  <steps>
+    <step>Create encore.service.ts file in service directory</step>
+    <step>Export service instance using Service class</step>
+  </steps>
+  
+  <code_example>
+  import { Service } from "encore.dev/service";
+  export default new Service("my-service");
+  </code_example>
+</service_definition>
+
+<application_patterns>
+  <pattern name="single_service">
+    <description>Best starting point, especially for new projects</description>
+    <structure>
+    /my-app
+    ├── package.json
+    ├── encore.app
+    ├── encore.service.ts    // service root
+    ├── api.ts              // endpoints
+    └── db.ts               // database
+    </structure>
+  </pattern>
+
+  <pattern name="multi_service">
+    <description>Distributed system with multiple independent services</description>
+    <structure>
+    /my-app
+    ├── encore.app
+    ├── hello/
+    │   ├── migrations/
+    │   ├── encore.service.ts
+    │   ├── hello.ts
+    │   └── hello_test.ts
+    └── world/
+        ├── encore.service.ts
+        └── world.ts
+    </structure>
+  </pattern>
+
+  <pattern name="large_scale">
+    <description>Systems-based organization for large applications</description>
+    <example_structure name="trello_clone">
+    /my-trello-clone
+    ├── encore.app
+    ├── trello/             // system
+    │   ├── board/         // service
+    │   └── card/          // service
+    ├── premium/           // system
+    │   ├── payment/       // service
+    │   └── subscription/  // service
+    └── usr/               // system
+        ├── org/           // service
+        └── user/          // service
+    </example_structure>
+  </pattern>
+</application_patterns>
+</application_structure>
+
+<raw_endpoints>
+<core_concepts>
+<concept>Raw endpoints provide lower-level HTTP request access</concept>
+<concept>Uses Node.js/Express.js style request handling</concept>
+<concept>Useful for webhook implementations and custom HTTP handling</concept>
+</core_concepts>
+<implementation>
+  <syntax>api.raw(options, handler)</syntax>
+  <parameters>
+    <param name="options">Configuration object with expose, path, method</param>
+    <param name="handler">Async function receiving (req, resp) parameters</param>
+  </parameters>
+</implementation>
+<code_example name="raw_endpoint">
+import { api } from "encore.dev/api";
+export const myRawEndpoint = api.raw(
+{ expose: true, path: "/raw", method: "GET" },
+async (req, resp) => {
+resp.writeHead(200, { "Content-Type": "text/plain" });
+resp.end("Hello, raw world!");
+}
+);
+</code_example>
+<usage_example>
+<command>curl http://localhost:4000/raw</command>
+<response>Hello, raw world!</response>
+</usage_example>
+<use_cases>
+<case>Webhook handling</case>
+<case>Custom HTTP response formatting</case>
+<case>Direct request/response control</case>
+</use_cases>
+</raw_endpoints>
+
+<api_errors>
+<error_format>
+  <example type="json">
+{
+    "code": "not_found",
+    "message": "sprocket not found",
+    "details": null
+}
+  </example>
+  
+  <implementation>
+    <code_example>
+import { APIError, ErrCode } from "encore.dev/api";
+throw new APIError(ErrCode.NotFound, "sprocket not found");
+// shorthand version:
+throw APIError.notFound("sprocket not found");
+    </code_example>
+  </implementation>
+</error_format>
+
+<error_codes>
+  <code name="OK">
+    <string_value>ok</string_value>
+    <http_status>200 OK</http_status>
+  </code>
+  
+  <code name="Canceled">
+    <string_value>canceled</string_value>
+    <http_status>499 Client Closed Request</http_status>
+  </code>
+  
+  <code name="Unknown">
+    <string_value>unknown</string_value>
+    <http_status>500 Internal Server Error</http_status>
+  </code>
+  
+  <code name="InvalidArgument">
+    <string_value>invalid_argument</string_value>
+    <http_status>400 Bad Request</http_status>
+  </code>
+  
+  <code name="DeadlineExceeded">
+    <string_value>deadline_exceeded</string_value>
+    <http_status>504 Gateway Timeout</http_status>
+  </code>
+  
+  <code name="NotFound">
+    <string_value>not_found</string_value>
+    <http_status>404 Not Found</http_status>
+  </code>
+  
+  <code name="AlreadyExists">
+    <string_value>already_exists</string_value>
+    <http_status>409 Conflict</http_status>
+  </code>
+  
+  <code name="PermissionDenied">
+    <string_value>permission_denied</string_value>
+    <http_status>403 Forbidden</http_status>
+  </code>
+  
+  <code name="ResourceExhausted">
+    <string_value>resource_exhausted</string_value>
+    <http_status>429 Too Many Requests</http_status>
+  </code>
+  
+  <code name="FailedPrecondition">
+    <string_value>failed_precondition</string_value>
+    <http_status>400 Bad Request</http_status>
+  </code>
+  
+  <code name="Aborted">
+    <string_value>aborted</string_value>
+    <http_status>409 Conflict</http_status>
+  </code>
+  
+  <code name="OutOfRange">
+    <string_value>out_of_range</string_value>
+    <http_status>400 Bad Request</http_status>
+  </code>
+  
+  <code name="Unimplemented">
+    <string_value>unimplemented</string_value>
+    <http_status>501 Not Implemented</http_status>
+  </code>
+  
+  <code name="Internal">
+    <string_value>internal</string_value>
+    <http_status>500 Internal Server Error</http_status>
+  </code>
+  
+  <code name="Unavailable">
+    <string_value>unavailable</string_value>
+    <http_status>503 Unavailable</http_status>
+  </code>
+  
+  <code name="DataLoss">
+    <string_value>data_loss</string_value>
+    <http_status>500 Internal Server Error</http_status>
+  </code>
+  
+  <code name="Unauthenticated">
+    <string_value>unauthenticated</string_value>
+    <http_status>401 Unauthorized</http_status>
+  </code>
+</error_codes>
+
+<features>
+  <feature name="additional_details">
+    <description>Use withDetails method on APIError to attach structured details that will be returned to external clients</description>
+  </feature>
+</features>
+</api_errors>
+
+<sql_databases>
+<overview>
+  <core_concept>Encore treats SQL databases as logical resources and natively supports PostgreSQL databases</core_concept>
+</overview>
+
+<database_creation>
+  <steps>
+    <step>Import SQLDatabase from encore.dev/storage/sqldb</step>
+    <step>Call new SQLDatabase with name and config</step>
+    <step>Define schema in migrations directory</step>
+  </steps>
+
+  <code_example>
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+
+const db = new SQLDatabase("todo", {
+  migrations: "./migrations",
+});
+
+-- todo/migrations/1_create_table.up.sql --
+CREATE TABLE todo_item (
+  id BIGSERIAL PRIMARY KEY,
+  title TEXT NOT NULL,
+  done BOOLEAN NOT NULL DEFAULT false
+);
+  </code_example>
+</database_creation>
+
+<migrations>
+  <conventions>
+    <naming>
+      <rule>Start with number followed by underscore</rule>
+      <rule>Must increase sequentially</rule>
+      <rule>End with .up.sql</rule>
+      <examples>
+        <example>001_first_migration.up.sql</example>
+        <example>002_second_migration.up.sql</example>
+      </examples>
+    </naming>
+    
+    <structure>
+      <directory>migrations within service directory</directory>
+      <pattern>number_name.up.sql</pattern>
+    </structure>
+  </conventions>
+</migrations>
+
+<database_operations>
+  <querying>
+    <methods>
+      <overview>
+      These are the supported methods when using the SQLDatabase module with Encore.ts. Do not use any methods not listed here.
+      </overview>
+      <method name="query">
+        <description>Returns async iterator for multiple rows</description>
+        <examples>
+          <example>
+const allTodos = await db.query`SELECT * FROM todo_item`;
+for await (const todo of allTodos) {
+  // Process each todo
+}
+          </example>
+          <example note="Specify the type of the row to be returned for type safety">
+const rows = await db.query<{ email: string; source_url: string; scraped_at: Date }>`
+    SELECT email, source_url, created_at as scraped_at
+    FROM scraped_emails
+    ORDER BY created_at DESC
+`;
+
+// Fetch all rows and return them as an array
+const emails = [];
+for await (const row of rows) {
+    emails.push(row);
+}
+
+return { emails };
+          </example>
+        </examples>
+      </method>
+      
+      <method name="queryRow">
+        <description>Returns single row or null</description>
+        <example>
+async function getTodoTitle(id: number): string | undefined {
+  const row = await db.queryRow`SELECT title FROM todo_item WHERE id = ${id}`;
+  return row?.title;
+}
+        </example>
+      </method>
+    </methods>
+  </querying>
+
+  <inserting>
+    <method name="exec">
+      <description>For inserts and queries not returning rows</description>
+      <example>
+await db.exec`
+  INSERT INTO todo_item (title, done)
+  VALUES (${title}, false)
+`;
+      </example>
+    </method>
+  </inserting>
+</database_operations>
+
+<database_access>
+  <cli_commands>
+    <command name="db shell">Opens psql shell to named database</command>
+    <command name="db conn-uri">Outputs connection string</command>
+    <command name="db proxy">Sets up local connection proxy</command>
+  </cli_commands>
+</database_access>
+
+<error_handling>
+  <migrations>
+    <process>Encore rolls back failed migrations</process>
+    <tracking>
+      <table>schema_migrations</table>
+      <columns>
+        <column name="version" type="bigint">Tracks last applied migration</column>
+        <column name="dirty" type="boolean">Not used by default</column>
+      </columns>
+    </tracking>
+  </migrations>
+</error_handling>
+
+<advanced_topics>
+  <sharing_databases>
+    <method name="shared_module">Export SQLDatabase object from shared module</method>
+    <method name="named_reference">Use SQLDatabase.named("name") to reference existing database</method>
+  </sharing_databases>
+
+  <extensions>
+    <available>
+      <extension>pgvector</extension>
+      <extension>PostGIS</extension>
+    </available>
+    <source>Uses encoredotdev/postgres Docker image</source>
+  </extensions>
+
+  <orm_support>
+    <compatibility>
+      <requirement>ORM must support standard SQL driver connection</requirement>
+      <requirement>Migration framework must generate standard SQL files</requirement>
+    </compatibility>
+    <supported_orms>
+      <orm>Prisma</orm>
+      <orm>Drizzle</orm>
+    </supported_orms>
+  </orm_support>
+</advanced_topics>
+
+</sql_databases>
+
+<cron_jobs>
+
+<description>Encore.ts provides declarative Cron Jobs for periodic and recurring tasks</description>
+
+<implementation>
+  <steps>
+    <step>Import CronJob from encore.dev/cron</step>
+    <step>Call new CronJob with unique ID and config</step>
+    <step>Define API endpoint for the job to call</step>
+  </steps>
+
+  <code_example>
+import { CronJob } from "encore.dev/cron";
+import { api } from "encore.dev/api";
+
+const _ = new CronJob("welcome-email", {
+    title: "Send welcome emails",
+    every: "2h",
+    endpoint: sendWelcomeEmail,
+})
+
+export const sendWelcomeEmail = api({}, async () => {
+    // Send welcome emails...
+});
+  </code_example>
+</implementation>
+
+<scheduling>
+  <periodic>
+    <field name="every">
+      <description>Runs on periodic basis starting at midnight UTC</description>
+      <constraint>Interval must divide 24 hours evenly</constraint>
+      <valid_examples>
+        <example>10m (minutes)</example>
+        <example>6h (hours)</example>
+      </valid_examples>
+      <invalid_examples>
+        <example>7h (not divisible into 24)</example>
+      </invalid_examples>
+    </field>
+  </periodic>
+
+  <advanced>
+    <field name="schedule">
+      <description>Uses Cron expressions for complex scheduling</description>
+      <example>
+        <pattern>0 4 15 * *</pattern>
+        <meaning>Runs at 4am UTC on the 15th of each month</meaning>
+      </example>
+    </field>
+  </advanced>
+</scheduling>
+
+</cron_jobs>
+
+<pubsub>
+<overview>
+  <description>System for asynchronous event broadcasting between services</description>
+  <benefits>
+    <benefit>Decouples services for better reliability</benefit>
+    <benefit>Improves system responsiveness</benefit>
+    <benefit>Cloud-agnostic implementation</benefit>
+  </benefits>
+</overview>
+
+<topics>
+  <definition>
+    <rules>
+      <rule>Must be package level variables</rule>
+      <rule>Cannot be created inside functions</rule>
+      <rule>Accessible from any service</rule>
+    </rules>
+    
+    <code_example name="topic_creation">
+import { Topic } from "encore.dev/pubsub"
+
+export interface SignupEvent {
+    userID: string;
+}
+
+export const signups = new Topic<SignupEvent>("signups", {
+    deliveryGuarantee: "at-least-once",
+});
+    </code_example>
+  </definition>
+
+  <publishing>
+    <description>Publish events using topic.publish method</description>
+    <code_example name="publishing">
+const messageID = await signups.publish({userID: id});
+    </code_example>
+  </publishing>
+</topics>
+
+<subscriptions>
+  <definition>
+    <requirements>
+      <requirement>Topic to subscribe to</requirement>
+      <requirement>Unique name for topic</requirement>
+      <requirement>Handler function</requirement>
+      <requirement>Configuration object</requirement>
+    </requirements>
+
+    <code_example name="subscription_creation">
+import { Subscription } from "encore.dev/pubsub";
+
+const _ = new Subscription(signups, "send-welcome-email", {
+    handler: async (event) => {
+        // Send a welcome email using the event.
+    },
+});
+    </code_example>
+  </definition>
+
+  <error_handling>
+    <process>Failed events are retried based on retry policy</process>
+    <dlq>After max retries, events move to dead-letter queue</dlq>
+  </error_handling>
+</subscriptions>
+
+<delivery_guarantees>
+  <at_least_once>
+    <description>Default delivery mode with possible message duplication</description>
+    <requirement>Handlers must be idempotent</requirement>
+  </at_least_once>
+
+  <exactly_once>
+    <description>Stronger delivery guarantees with minimized duplicates</description>
+    <limitations>
+      <aws>300 messages per second per topic</aws>
+      <gcp>3,000+ messages per second per region</gcp>
+    </limitations>
+    <note>Does not deduplicate on publish side</note>
+  </exactly_once>
+</delivery_guarantees>
+
+<advanced_features>
+  <message_attributes>
+    <description>Key-value pairs for filtering or ordering</description>
+    <code_example name="attributes">
+import { Topic, Attribute } from "encore.dev/pubsub";
+
+export interface SignupEvent {
+    userID: string;
+    source: Attribute<string>;
+}
+    </code_example>
+  </message_attributes>
+
+  <ordered_delivery>
+    <description>Messages delivered in order by orderingAttribute</description>
+    <limitations>
+      <aws>300 messages per second per topic</aws>
+      <gcp>1 MBps per ordering key</gcp>
+    </limitations>
+    <code_example name="ordered_topic">
+import { Topic, Attribute } from "encore.dev/pubsub";
+
+export interface CartEvent {
+    shoppingCartID: Attribute<number>;
+    event: string;
+}
+
+export const cartEvents = new Topic<CartEvent>("cart-events", {
+    deliveryGuarantee: "at-least-once",
+    orderingAttribute: "shoppingCartID",
+})
+    </code_example>
+    <note>No effect in local environments</note>
+  </ordered_delivery>
+</advanced_features>
+</pubsub>
+
+<object_storage>
+
+<description>Simple and scalable solution for storing files and unstructured data</description>
+
+<buckets>
+  <definition>
+    <rules>
+      <rule>Must be package level variables</rule>
+      <rule>Cannot be created inside functions</rule>
+      <rule>Accessible from any service</rule>
+    </rules>
+
+    <code_example name="bucket_creation">
+import { Bucket } from "encore.dev/storage/objects";
+
+export const profilePictures = new Bucket("profile-pictures", {
+  versioned: false
+});
+    </code_example>
+  </definition>
+
+  <operations>
+    <upload>
+      <description>Upload files to bucket using upload method</description>
+      <code_example>
+const data = Buffer.from(...); // image data
+const attributes = await profilePictures.upload("my-image.jpeg", data, {
+  contentType: "image/jpeg",
+});
+      </code_example>
+    </upload>
+
+    <download>
+      <description>Download files using download method</description>
+      <code_example>
+const data = await profilePictures.download("my-image.jpeg");
+      </code_example>
+    </download>
+
+    <list>
+      <description>List objects using async iterator</description>
+      <code_example>
+for await (const entry of profilePictures.list({})) {
+  // Process entry
+}
+      </code_example>
+    </list>
+
+    <delete>
+      <description>Delete objects using remove method</description>
+      <code_example>
+await profilePictures.remove("my-image.jpeg");
+      </code_example>
+    </delete>
+
+    <attributes>
+      <description>Get object information using attrs method</description>
+      <code_example>
+const attrs = await profilePictures.attrs("my-image.jpeg");
+const exists = await profilePictures.exists("my-image.jpeg");
+      </code_example>
+    </attributes>
+  </operations>
+</buckets>
+
+<public_access>
+  <configuration>
+    <description>Configure publicly accessible buckets</description>
+    <code_example>
+export const publicProfilePictures = new Bucket("public-profile-pictures", {
+  public: true,
+  versioned: false
+});
+    </code_example>
+  </configuration>
+
+  <usage>
+    <description>Access public objects using publicUrl method</description>
+    <code_example>
+const url = publicProfilePictures.publicUrl("my-image.jpeg");
+    </code_example>
+  </usage>
+</public_access>
+
+<error_handling>
+  <errors>
+    <error name="ObjectNotFound">Thrown when object doesn't exist</error>
+    <error name="PreconditionFailed">Thrown when upload preconditions not met</error>
+    <error name="ObjectsError">Base error type for all object storage errors</error>
+  </errors>
+</error_handling>
+
+<bucket_references>
+  <description>System for controlled bucket access permissions</description>
+  <permissions>
+    <permission name="Downloader">Download objects</permission>
+    <permission name="Uploader">Upload objects</permission>
+    <permission name="Lister">List objects</permission>
+    <permission name="Attrser">Get object attributes</permission>
+    <permission name="Remover">Remove objects</permission>
+    <permission name="ReadWriter">Complete read-write access</permission>
+  </permissions>
+
+  <usage>
+    <code_example>
+import { Uploader } from "encore.dev/storage/objects";
+const ref = profilePictures.ref<Uploader>();
+    </code_example>
+    <note>Must be called from within a service for proper permission tracking</note>
+  </usage>
+</bucket_references>
+</object_storage>
+
+<secrets_management>
+
+<description>Built-in secrets manager for secure storage of API keys, passwords, and private keys</description>
+
+<implementation>
+  <usage>
+    <description>Define secrets as top-level variables using secret function</description>
+    <code_example name="secret_definition">
+import { secret } from "encore.dev/config";
+
+const githubToken = secret("GitHubAPIToken");
+    </code_example>
+
+    <code_example name="secret_usage">
+async function callGitHub() {
+  const resp = await fetch("https:///api.github.com/user", {
+    credentials: "include",
+    headers: {
+      Authorization: `token ${githubToken()}`,
+    },
+  });
+}
+    </code_example>
+    <note>Secret keys are globally unique across the application</note>
+  </usage>
+</implementation>
+
+<secret_storage>
+  <methods>
+    <method name="cloud_dashboard">
+      <steps>
+        <step>Open app in Encore Cloud dashboard: https://app.encore.cloud</step>
+        <step>Navigate to Settings > Secrets</step>
+        <step>Create and manage secrets for different environments</step>
+      </steps>
+    </method>
+
+    <method name="cli">
+      <command>encore secret set --type &lt;types&gt; &lt;secret-name&gt;</command>
+      <types>
+        <type>production (prod)</type>
+        <type>development (dev)</type>
+        <type>preview (pr)</type>
+        <type>local</type>
+      </types>
+      <example>encore secret set --type prod SSHPrivateKey</example>
+    </method>
+
+    <method name="local_override">
+      <description>Override secrets locally using .secrets.local.cue file</description>
+      <example>
+GitHubAPIToken: "my-local-override-token"
+SSHPrivateKey: "custom-ssh-private-key"
+      </example>
+    </method>
+  </methods>
+</secret_storage>
+
+<environment_settings>
+  <rules>
+    <rule>One secret value per environment type</rule>
+    <rule>Environment-specific values override environment type values</rule>
+  </rules>
+</environment_settings>
+</secrets_management>
+
+<streaming_apis>
+<overview>
+  <description>API endpoints that enable data streaming via WebSocket connections</description>
+  <stream_types>
+    <type name="StreamIn">Client to server streaming</type>
+    <type name="StreamOut">Server to client streaming</type>
+    <type name="StreamInOut">Bidirectional streaming</type>
+  </stream_types>
+</overview>
+
+<stream_implementations>
+  <stream_in>
+    <description>Stream data from client to server</description>
+    <code_example>
+import { api } from "encore.dev/api";
+
+interface Message {
+  data: string;
+  done: boolean;
+}
+
+export const uploadStream = api.streamIn<Message>(
+  { path: "/upload", expose: true },
+  async (stream) => {
+    for await (const data of stream) {
+      // Process incoming data
+      if (data.done) break;
+    }
+  }
+);
+    </code_example>
+  </stream_in>
+
+  <stream_out>
+    <description>Stream data from server to client</description>
+    <code_example>
+export const dataStream = api.streamOut<Message>(
+  { path: "/stream", expose: true },
+  async (stream) => {
+    // Send messages to client
+    await stream.send({ data: "message" });
+    await stream.close();
+  }
+);
+    </code_example>
+  </stream_out>
+
+  <stream_inout>
+    <description>Bidirectional streaming</description>
+    <code_example>
+export const chatStream = api.streamInOut<InMessage, OutMessage>(
+  { path: "/chat", expose: true },
+  async (stream) => {
+    for await (const msg of stream) {
+      await stream.send(/* response */);
+    }
+  }
+);
+    </code_example>
+  </stream_inout>
+</stream_implementations>
+
+<features>
+  <handshake>
+    <description>Initial HTTP request for connection setup</description>
+    <supports>
+      <item>Path parameters</item>
+      <item>Query parameters</item>
+      <item>Headers</item>
+      <item>Authentication data</item>
+    </supports>
+  </handshake>
+
+  <client_usage>
+    <code_example>
+const stream = client.serviceName.endpointName();
+await stream.send({ /* message */ });
+for await (const msg of stream) {
+  // Handle incoming messages
+}
+    </code_example>
+  </client_usage>
+
+  <service_to_service>
+    <description>Internal streaming between services using ~encore/clients import</description>
+    <code_example>
+import { service } from "~encore/clients";
+const stream = await service.streamEndpoint();
+    </code_example>
+  </service_to_service>
+</features>
+</streaming_apis>
+
+<validation>
+<overview>
+  <description>Built-in request validation using TypeScript types for both runtime and compile-time type safety</description>
+  <core_example>
+import { Header, Query, api } from "encore.dev/api";
+
+interface Request {
+  limit?: Query<number>;               // Optional query parameter
+  myHeader: Header<"X-My-Header">;     // Required header
+  type: "sprocket" | "widget";         // Required enum in body
+}
+
+export const myEndpoint = api<Request, Response>(
+  { expose: true, method: "POST", path: "/api" },
+  async ({ limit, myHeader, type }) => {
+    // Implementation
+  }
+);
+  </core_example>
+</overview>
+
+<validation_types>
+  <basic_types>
+    <type name="string">
+      <example>name: string;</example>
+    </type>
+    <type name="number">
+      <example>age: number;</example>
+    </type>
+    <type name="boolean">
+      <example>isActive: boolean;</example>
+    </type>
+    <type name="arrays">
+      <example>
+strings: string[];
+numbers: number[];
+objects: { name: string }[];
+mixed: (string | number)[];
+      </example>
+    </type>
+    <type name="enums">
+      <example>type: "BLOG_POST" | "COMMENT";</example>
+    </type>
+  </basic_types>
+
+  <modifiers>
+    <modifier name="optional">
+      <syntax>fieldName?: type;</syntax>
+      <example>name?: string;</example>
+    </modifier>
+    <modifier name="nullable">
+      <syntax>fieldName: type | null;</syntax>
+      <example>name: string | null;</example>
+    </modifier>
+  </modifiers>
+</validation_types>
+
+<validation_rules>
+  <rules>
+    <rule name="Min/Max">
+      <description>Validate number ranges</description>
+      <example>count: number & (Min<3> & Max<1000>);</example>
+    </rule>
+    <rule name="MinLen/MaxLen">
+      <description>Validate string/array lengths</description>
+      <example>username: string & (MinLen<5> & MaxLen<20>);</example>
+    </rule>
+    <rule name="Format">
+      <description>Validate string formats</description>
+      <example>contact: string & (IsURL | IsEmail);</example>
+    </rule>
+  </rules>
+</validation_rules>
+
+<source_types>
+  <body>
+    <description>Default for methods with request bodies</description>
+    <parse_from>JSON request body</parse_from>
+  </body>
+
+  <query>
+    <description>URL query parameters</description>
+    <usage>Use Query type or default for GET/HEAD/DELETE</usage>
+  </query>
+
+  <headers>
+    <description>HTTP headers</description>
+    <usage>Use Header<"Name-Of-Header"> type</usage>
+  </headers>
+
+  <params>
+    <description>URL path parameters</description>
+    <example>path: "/user/:id", param: { id: string }</example>
+  </params>
+</source_types>
+
+<error_handling>
+  <response>
+    <status>400 Bad Request</status>
+    <format>
+{
+  "code": "invalid_argument",
+  "message": "unable to decode request body",
+  "internal_message": "Error details"
+}
+    </format>
+  </response>
+</error_handling>
+</validation>
+
+<static_assets>
+<overview>
+  <description>Encore.ts's built-in support for serving static assets (images, HTML, CSS, JavaScript)</description>
+  <use_case>Serving static websites or pre-compiled single-page applications (SPAs)</use_case>
+</overview>
+
+<implementation>
+  <basic_usage>
+    <description>Serve static files using api.static function</description>
+    <code_example>
+import { api } from "encore.dev/api";
+export const assets = api.static(
+  { expose: true, path: "/frontend/*path", dir: "./assets" },
+);
+    </code_example>
+    <behavior>
+      <rule>Serves files from ./assets under /frontend path prefix</rule>
+      <rule>Automatically serves index.html files at directory roots</rule>
+    </behavior>
+  </basic_usage>
+
+  <root_serving>
+    <description>Serve files at domain root using fallback routes</description>
+    <code_example>
+export const assets = api.static(
+  { expose: true, path: "/!path", dir: "./assets" },
+);
+    </code_example>
+    <note>Uses !path syntax instead of *path to avoid conflicts</note>
+  </root_serving>
+
+  <custom_404>
+    <description>Configure custom 404 response</description>
+    <code_example>
+export const assets = api.static(
+  { 
+    expose: true, 
+    path: "/!path", 
+    dir: "./assets", 
+    notFound: "./not_found.html" 
+  },
+);
+    </code_example>
+  </custom_404>
+</implementation>
+
+</static_assets>
+
+<graphql>
+
+<description>Encore.ts has GraphQL support through raw endpoints with automatic tracing</description>
+
+<implementation>
+  <steps>
+    <step>Create raw endpoint for client requests</step>
+    <step>Pass request to GraphQL library</step>
+    <step>Handle queries and mutations</step>
+    <step>Return GraphQL response</step>
+  </steps>
+
+  <apollo_example>
+    <code_example>
+import { HeaderMap } from "@apollo/server";
+import { api } from "encore.dev/api";
+const { ApolloServer, gql } = require("apollo-server");
+import { json } from "node:stream/consumers";
+
+const server = new ApolloServer({ typeDefs, resolvers });
+await server.start();
+
+export const graphqlAPI = api.raw(
+  { expose: true, path: "/graphql", method: "*" },
+  async (req, res) => {
+    server.assertStarted("/graphql");
+    
+    const headers = new HeaderMap();
+    for (const [key, value] of Object.entries(req.headers)) {
+      if (value !== undefined) {
+        headers.set(key, Array.isArray(value) ? value.join(", ") : value);
+      }
+    }
+
+    const httpGraphQLResponse = await server.executeHTTPGraphQLRequest({
+      httpGraphQLRequest: {
+        headers,
+        method: req.method!.toUpperCase(),
+        body: await json(req),
+        search: new URLSearchParams(req.url ?? "").toString(),
+      },
+      context: async () => ({ req, res }),
+    });
+
+    // Set response headers and status
+    for (const [key, value] of httpGraphQLResponse.headers) {
+      res.setHeader(key, value);
+    }
+    res.statusCode = httpGraphQLResponse.status || 200;
+
+    // Write response
+    if (httpGraphQLResponse.body.kind === "complete") {
+      res.end(httpGraphQLResponse.body.string);
+      return;
+    }
+    
+    for await (const chunk of httpGraphQLResponse.body.asyncIterator) {
+      res.write(chunk);
+    }
+    res.end();
+  }
+);
+    </code_example>
+  </apollo_example>
+</implementation>
+
+<rest_integration>
+
+  <example>
+    <schema>
+type Query {
+  books: [Book]
+}
+
+type Book {
+  title: String!
+  author: String!
+}
+    </schema>
+
+    <resolver>
+import { book } from "~encore/clients";
+import { QueryResolvers } from "../__generated__/resolvers-types";
+
+const queries: QueryResolvers = {
+  books: async () => {
+    const { books } = await book.list();
+    return books;
+  },
+};
+    </resolver>
+
+    <rest_endpoint>
+import { api } from "encore.dev/api";
+import { Book } from "../__generated__/resolvers-types";
+
+export const list = api(
+  { expose: true, method: "GET", path: "/books" },
+  async (): Promise<{ books: Book[] }> => {
+    return { books: db };
+  }
+);
+    </rest_endpoint>
+  </example>
+</rest_integration>
+</graphql>
+
+<authentication>
+<overview>
+  <description>Authentication system for identifying API callers in both consumer and B2B applications</description>
+  <activation>Set auth: true in API endpoint options</activation>
+</overview>
+
+<auth_handler>
+  <implementation>
+    <description>Required for APIs with auth: true</description>
+    <code_example>
+import { Header, Gateway } from "encore.dev/api";
+import { authHandler } from "encore.dev/auth";
+
+interface AuthParams {
+    authorization: Header<"Authorization">;
+}
+
+interface AuthData {
+    userID: string;
+}
+
+export const auth = authHandler<AuthParams, AuthData>(
+    async (params) => {
+        // Authenticate user based on params
+        return {userID: "my-user-id"};
+    }
+)
+
+export const gateway = new Gateway({
+    authHandler: auth,
+})
+    </code_example>
+  </implementation>
+
+  <rejection>
+    <description>Reject authentication by throwing exception</description>
+    <code_example>
+throw APIError.unauthenticated("bad credentials");
+    </code_example>
+  </rejection>
+</auth_handler>
+
+<authentication_process>
+  <step name="determine_auth">
+    <triggers>
+      <trigger>Any request containing auth parameters</trigger>
+      <trigger>Regardless of endpoint authentication requirements</trigger>
+    </triggers>
+    <outcomes>
+      <outcome type="success">Returns AuthData - request authenticated</outcome>
+      <outcome type="unauthenticated">Throws Unauthenticated - treated as no auth</outcome>
+      <outcome type="error">Throws other error - request aborted</outcome>
+    </outcomes>
+  </step>
+
+  <step name="endpoint_call">
+    <rules>
+      <rule>If endpoint requires auth and request not authenticated - reject</rule>
+      <rule>If authenticated, auth data passed to endpoint regardless of requirements</rule>
+    </rules>
+  </step>
+</authentication_process>
+
+<auth_data_usage>
+  <access>
+    <method>Import getAuthData from ~encore/auth</method>
+    <feature>Type-safe resolution of auth data</feature>
+  </access>
+
+  <propagation>
+    <description>Automatic propagation in internal API calls</description>
+    <constraint>Calls to auth-required endpoints fail if original request lacks auth</constraint>
+  </propagation>
+</auth_data_usage>
+</authentication>
+
+<metadata>
+<overview>
+  <description>Access environment and application information through metadata API</description>
+  <location>Available in encore.dev package</location>
+</overview>
+
+<app_metadata>
+  <function>appMeta()</function>
+  <returns>
+    <field name="appId">Application name</field>
+    <field name="apiBaseUrl">Public API access URL</field>
+    <field name="environment">Current running environment</field>
+    <field name="build">Version control revision information</field>
+    <field name="deploy">Deployment ID and timestamp</field>
+  </returns>
+</app_metadata>
+
+<request_metadata>
+  <function>currentRequest()</function>
+  <types>
+    <api_call>
+      <interface>
+interface APICallMeta {
+  type: "api-call";
+  api: APIDesc;
+  method: Method;
+  path: string;
+  pathAndQuery: string;
+  pathParams: Record<string, any>;
+  headers: Record<string, string | string[]>;
+  parsedPayload?: Record<string, any>;
+}
+      </interface>
+    </api_call>
+
+    <pubsub>
+      <interface>
+interface PubSubMessageMeta {
+  type: "pubsub-message";
+  service: string;
+  topic: string;
+  subscription: string;
+  messageId: string;
+  deliveryAttempt: number;
+  parsedPayload?: Record<string, any>;
+}
+      </interface>
+    </pubsub>
+  </types>
+  <note>Returns undefined if called during service initialization</note>
+</request_metadata>
+
+<use_cases>
+  <case name="cloud_services">
+    <description>Implement different behavior based on cloud provider</description>
+    <code_example>
+import { appMeta } from "encore.dev";
+
+async function audit(userID: string, event: Record<string, any>) {
+  const cloud = appMeta().environment.cloud;
+  switch (cloud) {
+    case "aws": return writeIntoRedshift(userID, event);
+    case "gcp": return writeIntoBigQuery(userID, event);
+    case "local": return writeIntoFile(userID, event);
+    default: throw new Error(`unknown cloud: ${cloud}`);
+  }
+}
+    </code_example>
+  </case>
+
+  <case name="environment_check">
+    <description>Modify behavior based on environment type</description>
+    <code_example>
+switch (appMeta().environment.type) {
+  case "test":
+  case "development":
+    await markEmailVerified(userID);
+    break;
+  default:
+    await sendVerificationEmail(userID);
+    break;
+}
+    </code_example>
+  </case>
+</use_cases>
+</metadata>
+
+<middleware>
+
+<description>Reusable code running before/after API requests across multiple endpoints</description>
+
+<implementation>
+  <basic_usage>
+    <description>Create middleware using middleware helper from encore.dev/api</description>
+    <code_example>
+import { middleware } from "encore.dev/api";
+
+export default new Service("myService", {
+    middlewares: [
+        middleware({ target: { auth: true } }, async (req, next) => {
+            // Pre-handler logic
+            const resp = await next(req);
+            // Post-handler logic
+            return resp
+        })
+    ]
+});
+    </code_example>
+  </basic_usage>
+
+  <request_access>
+    <types>
+      <type name="typed_api">
+        <field>req.requestMeta</field>
+      </type>
+      <type name="streaming">
+        <field>req.requestMeta</field>
+        <field>req.stream</field>
+      </type>
+      <type name="raw">
+        <field>req.rawRequest</field>
+        <field>req.rawResponse</field>
+      </type>
+    </types>
+  </request_access>
+
+  <response_handling>
+    <description>HandlerResponse object with header modification capabilities</description>
+    <methods>
+      <method>resp.header.set(key, value)</method>
+      <method>resp.header.add(key, value)</method>
+    </methods>
+  </response_handling>
+</implementation>
+
+<configuration>
+  <ordering>
+    <description>Middleware executes in order of definition</description>
+    <code_example>
+export default new Service("myService", {
+    middlewares: [
+        first,
+        second,
+        third
+    ],
+});
+    </code_example>
+  </ordering>
+
+  <targeting>
+    <description>Specify which endpoints middleware applies to</description>
+    <best_practice>Use target option instead of runtime filtering for better performance</best_practice>
+    <note>Defaults to all endpoints if target not specified</note>
+  </targeting>
+</configuration>
+</middleware>
+
+<orm_integration>
+<overview>
+  <description>Built-in support for ORMs and migration frameworks through named databases and SQL migration files</description>
+  <compatibility>
+    <orm_requirement>Must support standard SQL driver connections</orm_requirement>
+    <migration_requirement>Must generate standard SQL migration files</migration_requirement>
+  </compatibility>
+</overview>
+
+<database_connection>
+  <setup>
+    <description>Use SQLDatabase class for named databases and connection strings</description>
+    <code_example>
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+
+const SiteDB = new SQLDatabase("siteDB", {
+  migrations: "./migrations",
+});
+
+const connStr = SiteDB.connectionString;
+    </code_example>
+  </setup>
+</database_connection>
+
+</orm_integration>
+
+<drizzle_integration_example>
+<overview>
+  <description>Integration guide for using Drizzle ORM with Encore.ts</description>
+</overview>
+
+<implementation_steps>
+  <step name="database_setup">
+    <description>Initialize SQLDatabase and configure Drizzle connection</description>
+    <code_example name="database.ts">
+import { api } from "encore.dev/api";
+import { SQLDatabase } from "encore.dev/storage/sqldb";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { users } from "./schema";
+
+const db = new SQLDatabase("test", {
+  migrations: {
+    path: "migrations",
+    source: "drizzle",
+  },
+});
+
+const orm = drizzle(db.connectionString);
+await orm.select().from(users);
+    </code_example>
+  </step>
+
+  <step name="drizzle_config">
+    <description>Create Drizzle configuration file</description>
+    <code_example name="drizzle.config.ts">
+import 'dotenv/config';
+import { defineConfig } from 'drizzle-kit';
+
+export default defineConfig({
+  out: 'migrations',
+  schema: 'schema.ts',
+  dialect: 'postgresql',
+});
+    </code_example>
+  </step>
+
+  <step name="schema_definition">
+    <description>Define database schema using Drizzle's pg-core</description>
+    <code_example name="schema.ts">
+import * as p from "drizzle-orm/pg-core";
+
+export const users = p.pgTable("users", {
+  id: p.serial().primaryKey(),
+  name: p.text(),
+  email: p.text().unique(),
+});
+    </code_example>
+  </step>
+
+  <step name="migration_generation">
+    <description>Generate database migrations</description>
+    <command>drizzle-kit generate</command>
+    <location>Run in directory containing drizzle.config.ts</location>
+  </step>
+
+  <step name="migration_application">
+    <description>Migrations automatically applied during Encore application runtime</description>
+    <note>Manual migration commands not required</note>
+  </step>
+</implementation_steps>
+</drizzle_integration_example>
+
+<cors>
+<overview>
+  <description>CORS controls which website origins can access your API</description>
+  <scope>Browser requests to resources on different origins (scheme, domain, port)</scope>
+</overview>
+
+<configuration>
+  <location>Specified in encore.app file under global_cors key</location>
+  <structure>
+    <options>
+      <option name="debug">
+        <description>Enables CORS debug logging</description>
+        <type>boolean</type>
+      </option>
+
+      <option name="allow_headers">
+        <description>Additional accepted headers</description>
+        <type>string[]</type>
+        <special_value>"*" for all headers</special_value>
+      </option>
+
+      <option name="expose_headers">
+        <description>Additional exposed headers beyond defaults</description>
+        <type>string[]</type>
+        <special_value>"*" for all headers</special_value>
+      </option>
+
+      <option name="allow_origins_without_credentials">
+        <description>Allowed origins for non-credentialed requests</description>
+        <type>string[]</type>
+        <default>["*"]</default>
+      </option>
+
+      <option name="allow_origins_with_credentials">
+        <description>Allowed origins for credentialed requests</description>
+        <type>string[]</type>
+        <wildcard_support>
+          <example>https://*.example.com</example>
+          <example>https://*-myapp.example.com</example>
+        </wildcard_support>
+      </option>
+    </options>
+  </structure>
+</configuration>
+
+<default_behavior>
+  <rules>
+    <rule>Allows unauthenticated requests from all origins</rule>
+    <rule>Disallows authenticated requests from other origins</rule>
+    <rule>All origins allowed in local development</rule>
+  </rules>
+</default_behavior>
+
+<header_handling>
+  <automatic>
+    <description>Encore automatically configures headers through static analysis</description>
+    <trigger>Request or response types containing header fields</trigger>
+  </automatic>
+
+  <manual>
+    <description>Additional headers can be configured via allow_headers and expose_headers</description>
+    <use_case>Custom headers in raw endpoints not detected by static analysis</use_case>
+  </manual>
+</header_handling>
+</cors>
+
+<logging>
+
+<description>Built-in structured logging combining free-form messages with type-safe key-value pairs</description>
+  
+<implementation>
+  <setup>
+    <import>import log from "encore.dev/log";</import>
+  </setup>
+
+  <log_levels>
+    <level name="error">Critical issues</level>
+    <level name="warn">Warning conditions</level>
+    <level name="info">General information</level>
+    <level name="debug">Debugging information</level>
+    <level name="trace">Detailed tracing</level>
+  </log_levels>
+
+  <usage>
+    <basic>
+      <description>Direct logging with message and optional structured data</description>
+      <code_example>
+log.info("log message", {is_subscriber: true})
+log.error(err, "something went terribly wrong!")
+      </code_example>
+    </basic>
+
+    <with_context>
+      <description>Group logs with shared key-value pairs</description>
+      <code_example>
+const logger = log.with({is_subscriber: true})
+logger.info("user logged in", {login_method: "oauth"}) // includes is_subscriber=true
+      </code_example>
+    </with_context>
+  </usage>
+</implementation>
+
+</logging>
+
+<encore_ts_example_apps>
+
+<hello_world_example_repo>
+https://github.com/encoredev/examples/tree/main/ts/hello-world
+</hello_world_example_repo>
+
+<url_shortener_example_repo>
+https://github.com/encoredev/examples/tree/main/ts/url-shortener
+</url_shortener_example_repo>
+
+<uptime_monitor_example_repo>
+https://github.com/encoredev/examples/tree/main/ts/uptime
+</uptime_monitor_example_repo>
+
+</encore_ts_example_apps>
+
+<package_management>
+    <default_approach>Use a single root-level package.json file (monorepo approach) for Encore.ts projects including frontend dependencies</default_approach>
+    <alternative_approach>
+        <support>Separate package.json files in sub-packages</support>
+        <limitations>
+            <limitation>Encore.ts application must use one package with a single package.json file</limitation>
+            <limitation>Other separate packages must be pre-transpiled to JavaScript</limitation>
+        </limitations>
+    </alternative_approach>
+</package_management>
+
+</encore_ts_domain_knowledge>
+
+<encore_cli_reference>
+<execution_commands>
+<run>
+<command>encore run [--debug] [--watch=true] [flags]</command>
+<purpose>Runs your application</purpose>
+</run>
+</execution_commands>
+
+<app_management>
+<clone>
+<command>encore app clone [app-id] [directory]</command>
+<purpose>Clone an Encore app to your computer</purpose>
+</clone>
+
+<create>
+<command>encore app create [name]</command>
+<purpose>Create a new Encore app</purpose>
+</create>
+
+<init>
+<command>encore app init [name]</command>
+<purpose>Create new app from existing repository</purpose>
+</init>
+
+<link>
+<command>encore app link [app-id]</command>
+<purpose>Link app with server</purpose>
+</link>
+</app_management>
+
+<authentication>
+<login>
+<command>encore auth login</command>
+<purpose>Log in to Encore</purpose>
+</login>
+
+<logout>
+<command>encore auth logout</command>
+<purpose>Logs out current user</purpose>
+</logout>
+
+<signup>
+<command>encore auth signup</command>
+<purpose>Create new account</purpose>
+</signup>
+
+<whoami>
+<command>encore auth whoami</command>
+<purpose>Show current user</purpose>
+</whoami>
+</authentication>
+
+<daemon_management>
+<restart>
+<command>encore daemon</command>
+<purpose>Restart daemon for unexpected behavior</purpose>
+</restart>
+
+<env>
+<command>encore daemon env</command>
+<purpose>Output environment information</purpose>
+</env>
+</daemon_management>
+
+<database_commands>
+<shell>
+<command>encore db shell database-name [--env=name]</command>
+<purpose>Connect via psql shell</purpose>
+<permissions>--write, --admin, --superuser flags available</permissions>
+</shell>
+
+<connection>
+<command>encore db conn-uri database-name [--env=name]</command>
+<purpose>Output connection string</purpose>
+</connection>
+
+<proxy>
+<command>encore db proxy [--env=name]</command>
+<purpose>Set up local database connection proxy</purpose>
+</proxy>
+
+<reset>
+<command>encore db reset [service-names...]</command>
+<purpose>Reset specified service databases</purpose>
+</reset>
+</database_commands>
+
+<code_generation>
+<client>
+<command>encore gen client [app-id] [--env=name] [--lang=lang]</command>
+<purpose>Generate API client</purpose>
+<languages>
+- go: Go client with net/http
+- typescript: TypeScript with Fetch API
+- javascript: JavaScript with Fetch API
+- openapi: OpenAPI spec
+</languages>
+</client>
+</code_generation>
+
+<logging>
+<command>encore logs [--env=prod] [--json]</command>
+<purpose>Stream application logs</purpose>
+</logging>
+
+<kubernetes>
+<configure>
+<command>encore k8s configure --env=ENV_NAME</command>
+<purpose>Update kubectl config for environment</purpose>
+</configure>
+</kubernetes>
+
+<secrets>
+<set>
+<command>encore secret set --type types secret-name</command>
+<purpose>Set secret value</purpose>
+<types>production, development, preview, local</types>
+</set>
+
+<list>
+<command>encore secret list [keys...]</command>
+<purpose>List secrets</purpose>
+</list>
+
+<archive>
+<command>encore secret archive id</command>
+<purpose>Archive secret value</purpose>
+</archive>
+
+<unarchive>
+<command>encore secret unarchive id</command>
+<purpose>Unarchive secret value</purpose>
+</unarchive>
+</secrets>
+
+<version_management>
+<check>
+<command>encore version</command>
+<purpose>Report current version</purpose>
+</check>
+
+<update>
+<command>encore version update</command>
+<purpose>Check and apply updates</purpose>
+</update>
+</version_management>
+
+<vpn>
+<start>
+<command>encore vpn start</command>
+<purpose>Set up secure connection to private environments</purpose>
+</start>
+
+<status>
+<command>encore vpn status</command>
+<purpose>Check VPN connection status</purpose>
+</status>
+
+<stop>
+<command>encore vpn stop</command>
+<purpose>Stop VPN connection</purpose>
+</stop>
+</vpn>
+
+<build>
+<docker>
+<command>encore build docker</command>
+<purpose>Build portable Docker image</purpose>
+<flags>
+- --base string: Define base image
+- --push: Push to remote repository
+</flags>
+</docker>
+</build>
+</encore_cli_reference>
diff --git a/tsparser/Cargo.toml b/tsparser/Cargo.toml
new file mode 100644
index 0000000000..c864c5bdab
--- /dev/null
+++ b/tsparser/Cargo.toml
@@ -0,0 +1,57 @@
+[package]
+name = "encore-tsparser"
+version = "0.1.0"
+edition = "2021"
+
+[[bin]]
+name = "tsparser-encore"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+swc_ecma_parser = { version = "0.141.21", features = ["typescript"] }
+swc_ecma_ast = "0.110.9"
+swc_ecma_visit = { version = "0.96.9", features = ["path"] }
+swc_ecma_transforms_base = "0.134.30"
+swc_ecma_loader = { version = "0.45.9", features = ["node", "tsc"] }
+swc_common = { version = "0.33.8", features = ["tty-emitter"] }
+walkdir = "2"
+anyhow = { version = "1.0.75", features = ["backtrace"] }
+clean-path = "0.2.1"
+log = "0.4.20"
+env_logger = "0.10.0"
+txtar = { version = "1.0.0", path = "./txtar" }
+litparser = { version = "0.1.0", path = "./litparser" }
+litparser-derive = { version = "0.1.0", path = "./litparser-derive" }
+prost = "0.12.1"
+tempdir = "0.3.7"
+cron-parser = "0.8.0"
+chrono = "0.4.31"
+regex = "1.9.5"
+once_cell = "1.18.0"
+handlebars = { version = "4.4.0", features = ["no_logging"] }
+serde = { version = "1.0.188", features = ["rc"] }
+serde_json = { version = "1.0.107", features = ["preserve_order"] }
+url = "2.4.1"
+convert_case = "0.6.0"
+itertools = "0.13.0"
+duct = "0.13.6"
+indexmap = { version = "2.1.0", features = ["serde"] }
+serde_yaml = "0.9.32"
+symlink = "0.1.0"
+tracing = "0.1.40"
+tracing-subscriber = { version = "0.3.18", features = ["env-filter"] }
+junction = "1.2.0"
+thiserror = "1.0.64"
+matchit = "0.7.3"
+semver = "1.0.24"
+pg_query = "6.1.1"
+
+[build-dependencies]
+prost-build = { version = "0.12.1" }
+
+[dev-dependencies]
+assert_fs = "1.1.1"
+assert_matches = "1.5.0"
+insta = { version = "1.38.0", features = ["yaml", "glob"] }
+once_cell = "1.19.0"
diff --git a/tsparser/build.rs b/tsparser/build.rs
new file mode 100644
index 0000000000..355e75cf59
--- /dev/null
+++ b/tsparser/build.rs
@@ -0,0 +1,9 @@
+use std::io::Result;
+
+fn main() -> Result<()> {
+    prost_build::compile_protos(
+        &["../proto/encore/parser/meta/v1/meta.proto"],
+        &["../proto/"],
+    )?;
+    Ok(())
+}
diff --git a/tsparser/examples/testparse.rs b/tsparser/examples/testparse.rs
new file mode 100644
index 0000000000..0438b90c05
--- /dev/null
+++ b/tsparser/examples/testparse.rs
@@ -0,0 +1,112 @@
+use std::fmt;
+use std::io::{self, Write};
+use std::path::PathBuf;
+use std::rc::Rc;
+use std::sync::{Arc, Mutex};
+
+use swc_common::errors::{Emitter, EmitterWriter, Handler, HANDLER};
+use swc_common::{Globals, SourceMap, SourceMapper, GLOBALS};
+
+use encore_tsparser::builder;
+use encore_tsparser::builder::Builder;
+use encore_tsparser::parser::parser::ParseContext;
+
+fn main() {
+    env_logger::init();
+
+    // Read the app root from the first arg.
+    let app_root = PathBuf::from(std::env::args().nth(1).expect("missing app root"));
+
+    let globals = Globals::new();
+
+    let cm: Rc<SourceMap> = Default::default();
+    let errors: Rc<Mutex<Vec<String>>> = Default::default();
+    let emitter = ErrorList {
+        cm: cm.clone(),
+        errors: errors.clone(),
+    };
+
+    let errs = Rc::new(Handler::with_emitter(true, false, Box::new(emitter)));
+
+    GLOBALS.set(&globals, || {
+        HANDLER.set(&errs, || {
+            let builder = Builder::new().expect("unable to construct builder");
+
+            {
+                let pp = builder::PrepareParams {
+                    app_root: app_root.clone(),
+                    encore_dev_version: builder::PackageVersion::Published("0.0.0".to_string()),
+                };
+                builder.prepare(&pp).unwrap();
+            }
+
+            let pc = ParseContext::new(app_root.clone(), None, cm.clone(), errs.clone()).unwrap();
+
+            let app = builder::App {
+                root: app_root.clone(),
+                platform_id: None,
+                local_id: "test".to_string(),
+            };
+            let pp = builder::ParseParams {
+                app: &app,
+                pc: &pc,
+                working_dir: &app_root,
+                parse_tests: false,
+            };
+
+            match builder.parse(&pp) {
+                Some(_desc) => {
+                    println!("successfully parsed {}", app_root.display());
+                }
+                None => {
+                    // Get any errors from the emitter.
+                    let errs = errors.lock().unwrap();
+                    let mut err_msg = String::new();
+                    for err in errs.iter() {
+                        err_msg.push_str(err);
+                        err_msg.push('\n');
+                    }
+                    eprintln!("{err_msg}");
+                    panic!("parse failure")
+                }
+            }
+        })
+    })
+}
+
+struct ErrorList {
+    cm: Rc<dyn SourceMapper>,
+    errors: Rc<Mutex<Vec<String>>>,
+}
+
+impl Emitter for ErrorList {
+    fn emit(&mut self, db: &swc_common::errors::DiagnosticBuilder<'_>) {
+        let buf: AtomicBuf = Default::default();
+
+        let mut w = EmitterWriter::new(Box::new(buf.clone()), Some(self.cm.clone()), false, false);
+        w.emit(db);
+
+        let s = buf.to_string();
+        self.errors.lock().unwrap().push(s);
+    }
+}
+
+#[derive(Default, Clone)]
+struct AtomicBuf(Arc<Mutex<Vec<u8>>>);
+
+impl fmt::Display for AtomicBuf {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", String::from_utf8_lossy(&self.0.lock().unwrap()))
+    }
+}
+
+impl Write for AtomicBuf {
+    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
+        self.0.lock().unwrap().extend_from_slice(buf);
+        Ok(buf.len())
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
diff --git a/tsparser/litparser-derive/.gitignore b/tsparser/litparser-derive/.gitignore
new file mode 100644
index 0000000000..ea8c4bf7f3
--- /dev/null
+++ b/tsparser/litparser-derive/.gitignore
@@ -0,0 +1 @@
+/target
diff --git a/tsparser/litparser-derive/Cargo.lock b/tsparser/litparser-derive/Cargo.lock
new file mode 100644
index 0000000000..db7cbba01a
--- /dev/null
+++ b/tsparser/litparser-derive/Cargo.lock
@@ -0,0 +1,1186 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "Inflector"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe438c63458706e03479442743baae6c88256498e6431708f6dfc520a26515d3"
+dependencies = [
+ "lazy_static",
+ "regex",
+]
+
+[[package]]
+name = "ahash"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c99f64d1e06488f620f932677e24bc6e2897582980441ae90a671415bd7ec2f"
+dependencies = [
+ "cfg-if",
+ "getrandom",
+ "once_cell",
+ "version_check",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea5d730647d4fadd988536d06fecce94b7b4f2a7efdae548f1cf4b63205518ab"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
+
+[[package]]
+name = "ast_node"
+version = "0.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c09c69dffe06d222d072c878c3afe86eee2179806f20503faec97250268b4c24"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "swc_macros_common",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "atty"
+version = "0.2.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b39be18770d11421cdb1b9947a45dd3f37e93092cbf377614828a319d5fee8"
+dependencies = [
+ "hermit-abi 0.1.19",
+ "libc",
+ "winapi",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "better_scoped_tls"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "794edcc9b3fb07bb4aecaa11f093fd45663b4feadb782d68303a2268bc2701de"
+dependencies = [
+ "scoped-tls",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+
+[[package]]
+name = "cc"
+version = "1.0.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "dashmap"
+version = "5.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"
+dependencies = [
+ "cfg-if",
+ "hashbrown 0.14.0",
+ "lock_api",
+ "once_cell",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "duration-string"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fcc1d9ae294a15ed05aeae8e11ee5f2b3fe971c077d45a42fb20825fba6ee13"
+
+[[package]]
+name = "either"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "from_variant"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03ec5dc38ee19078d84a692b1c41181ff9f94331c76cee66ff0208c770b5e54f"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "swc_macros_common",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be4136b2a15dd319360be1c07d9933517ccf0be8f16bf62a3bee4f0d618df427"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
+
+[[package]]
+name = "hashbrown"
+version = "0.14.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2c6201b9ff9fd90a5a3bac2e56a830d0caa509576f0e503818ee82c181b3437a"
+
+[[package]]
+name = "hermit-abi"
+version = "0.1.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "62b467343b94ba476dcb2500d242dadbb39557df889310ac77c5d99100aaac33"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "hermit-abi"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d77f7ec81a6d05a3abb01ab6eb7590f6083d08449fe5a1c8b1e620283546ccb7"
+
+[[package]]
+name = "idna"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "indexmap"
+version = "1.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
+dependencies = [
+ "autocfg",
+ "hashbrown 0.12.3",
+]
+
+[[package]]
+name = "is-macro"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4467ed1321b310c2625c5aa6c1b1ffc5de4d9e42668cf697a08fb033ee8265e"
+dependencies = [
+ "Inflector",
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af150ab688ff2122fcef229be89cb50dd66af9e01a4ff320cc137eecc9bacc38"
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.148"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cdc71e17332e86d2e1d38c1f99edcb6288ee11b815fb1a4b049eaa2114d369b"
+
+[[package]]
+name = "litparser"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "duration-string",
+ "swc_ecma_ast",
+]
+
+[[package]]
+name = "litparser-derive"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "litparser",
+ "prettyplease",
+ "proc-macro2",
+ "quote",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_ecma_loader",
+ "swc_ecma_parser 0.139.1",
+ "swc_ecma_transforms_base",
+ "swc_ecma_visit",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "memchr"
+version = "2.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4a24736216ec316047a1fc4252e27dabb04218aa4a3f37c6e7ddbf1f9782b54"
+
+[[package]]
+name = "normpath"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a9da8c9922c35a1033d76f7272dfc2e7ee20392083d75aeea6ced23c6266578"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "num-bigint"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+ "serde",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "num_cpus"
+version = "1.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
+dependencies = [
+ "hermit-abi 0.3.3",
+ "libc",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-targets",
+]
+
+[[package]]
+name = "path-clean"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ecba01bf2678719532c5e3059e0b5f0811273d94b397088b82e3bd0a78c78fdd"
+
+[[package]]
+name = "pathdiff"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8835116a5c179084a830efb3adc117ab007512b535bc1a21c991d3b32a6b44dd"
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
+
+[[package]]
+name = "phf"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+ "proc-macro-hack",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
+dependencies = [
+ "phf_shared",
+ "rand",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "58fdf3184dd560f160dd73922bea2d5cd6e8f064bf4b13110abd81b03697b4e0"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro-hack",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+
+[[package]]
+name = "pmutil"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52a40bc70c2c58040d2d8b167ba9a5ff59fc9dab7ad44771cfde3dcfde7a09c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "ppv-lite86"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b40af805b3121feab8a3c29f04d8ad262fa8e0561883e7653e024ae4479e6de"
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "prettyplease"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae005bd773ab59b4725093fd7df83fd7892f7d8eafb48dbd7de6e024e4215f9d"
+dependencies = [
+ "proc-macro2",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "proc-macro-hack"
+version = "0.5.20+deprecated"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc375e1527247fe1a97d8b7156678dfe7c1af2fc075c9a4db3690ecd2a148068"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.67"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "psm"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5787f7cda34e3033a72192c018bc5883100330f362ef279a8cbccfce8bb4e874"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "regex"
+version = "1.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "697061221ea1b4a94a624f67d0ae2bfe4e22b8a17b6a192afb11046542cc8c47"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2f401f4955220693b56f8ec66ee9c78abffd8d1c4f23dc41a23839eb88f0795"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "ryu"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "serde"
+version = "1.0.188"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.188"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b420ce6e3d8bd882e9b243c6eed35dbc9a6110c9769e74b584e0d68d1f20c65"
+dependencies = [
+ "itoa",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "siphasher"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+
+[[package]]
+name = "smallvec"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
+
+[[package]]
+name = "smartstring"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fb72c633efbaa2dd666986505016c32c3044395ceaf881518399d2f4127ee29"
+dependencies = [
+ "autocfg",
+ "static_assertions",
+ "version_check",
+]
+
+[[package]]
+name = "stable_deref_trait"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8f112729512f8e442d81f95a8a7ddf2b7c6b8a1a6f509a95864142b30cab2d3"
+
+[[package]]
+name = "stacker"
+version = "0.1.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c886bd4480155fd3ef527d45e9ac8dd7118a898a46530b7b94c3e21866259fce"
+dependencies = [
+ "cc",
+ "cfg-if",
+ "libc",
+ "psm",
+ "winapi",
+]
+
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
+[[package]]
+name = "string_cache"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f91138e76242f575eb1d3b38b4f1362f10d3a43f47d182a5b359af488a02293b"
+dependencies = [
+ "new_debug_unreachable",
+ "once_cell",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+ "serde",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.5.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb30289b722be4ff74a408c3cc27edeaad656e06cb1fe8fa9231fa59c728988"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+]
+
+[[package]]
+name = "string_enum"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8fa4d4f81d7c05b9161f8de839975d3326328b8ba2831164b465524cc2f55252"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "swc_macros_common",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "swc_atoms"
+version = "0.5.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f54563d7dcba626d4acfe14ed12def7ecc28e004debe3ecd2c3ee07cc47e449"
+dependencies = [
+ "once_cell",
+ "rustc-hash",
+ "serde",
+ "string_cache",
+ "string_cache_codegen",
+ "triomphe",
+]
+
+[[package]]
+name = "swc_cached"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97b8051bbf1c23817f9f2912fce18d9a6efcaaf8f8e1a4c69dbaf72bcaf71136"
+dependencies = [
+ "ahash",
+ "anyhow",
+ "dashmap",
+ "once_cell",
+ "regex",
+ "serde",
+]
+
+[[package]]
+name = "swc_common"
+version = "0.32.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c84742fc22df1c293da5354c1cc8a5b45a045e9dc941005c1fd9cb4e9bdabc1"
+dependencies = [
+ "ast_node",
+ "atty",
+ "better_scoped_tls",
+ "cfg-if",
+ "either",
+ "from_variant",
+ "new_debug_unreachable",
+ "num-bigint",
+ "once_cell",
+ "rustc-hash",
+ "serde",
+ "siphasher",
+ "string_cache",
+ "swc_atoms",
+ "swc_eq_ignore_macros",
+ "swc_visit",
+ "termcolor",
+ "tracing",
+ "unicode-width",
+ "url",
+]
+
+[[package]]
+name = "swc_ecma_ast"
+version = "0.109.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e063a1614daed3ea8be56e5dd8edb17003409088d2fc9ce4aca3378879812607"
+dependencies = [
+ "bitflags 2.4.0",
+ "is-macro",
+ "num-bigint",
+ "scoped-tls",
+ "string_enum",
+ "swc_atoms",
+ "swc_common",
+ "unicode-id",
+]
+
+[[package]]
+name = "swc_ecma_loader"
+version = "0.44.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b2b3a3ec38fc9c691b787d32ac2aa5eb6871d1fe74ac4a10638fbd9b9bc407b"
+dependencies = [
+ "anyhow",
+ "dashmap",
+ "normpath",
+ "once_cell",
+ "path-clean",
+ "pathdiff",
+ "serde",
+ "serde_json",
+ "swc_cached",
+ "swc_common",
+ "tracing",
+]
+
+[[package]]
+name = "swc_ecma_parser"
+version = "0.139.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e2abc67575c5fcc77cfb9b3eaaeb73bac2cac265504a1fc06a04d0ebbc4c53b"
+dependencies = [
+ "either",
+ "num-bigint",
+ "num-traits",
+ "serde",
+ "smallvec",
+ "smartstring",
+ "stacker",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "tracing",
+ "typed-arena",
+]
+
+[[package]]
+name = "swc_ecma_parser"
+version = "0.140.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c968599841fcecfdc2e490188ad93251897a1bb912882547e6889e14a368399"
+dependencies = [
+ "either",
+ "num-bigint",
+ "num-traits",
+ "serde",
+ "smallvec",
+ "smartstring",
+ "stacker",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "tracing",
+ "typed-arena",
+]
+
+[[package]]
+name = "swc_ecma_transforms_base"
+version = "0.133.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd570349c3be938eff1214bba74f2d4d8dafc2e433eedb69e8ae220d425569d7"
+dependencies = [
+ "better_scoped_tls",
+ "bitflags 2.4.0",
+ "indexmap",
+ "once_cell",
+ "phf",
+ "rustc-hash",
+ "serde",
+ "smallvec",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_ecma_parser 0.140.0",
+ "swc_ecma_utils",
+ "swc_ecma_visit",
+ "tracing",
+]
+
+[[package]]
+name = "swc_ecma_utils"
+version = "0.123.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b6d6b59ebd31b25fe2692ff705c806961e7856de8b7e91fd0942328886cd315"
+dependencies = [
+ "indexmap",
+ "num_cpus",
+ "once_cell",
+ "rustc-hash",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_ecma_visit",
+ "tracing",
+ "unicode-id",
+]
+
+[[package]]
+name = "swc_ecma_visit"
+version = "0.95.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2774848b306e17fa280c598ecb192cc2c72a1163942b02d48606514336e9e7c5"
+dependencies = [
+ "num-bigint",
+ "swc_atoms",
+ "swc_common",
+ "swc_ecma_ast",
+ "swc_visit",
+ "tracing",
+]
+
+[[package]]
+name = "swc_eq_ignore_macros"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05a95d367e228d52484c53336991fdcf47b6b553ef835d9159db4ba40efb0ee8"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "swc_macros_common"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7a273205ccb09b51fabe88c49f3b34c5a4631c4c00a16ae20e03111d6a42e832"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "swc_visit"
+version = "0.5.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e87c337fbb2d191bf371173dea6a957f01899adb8f189c6c31b122a6cfc98fc3"
+dependencies = [
+ "either",
+ "swc_visit_macros",
+]
+
+[[package]]
+name = "swc_visit_macros"
+version = "0.5.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0f322730fb82f3930a450ac24de8c98523af7d34ab8cb2f46bcb405839891a99"
+dependencies = [
+ "Inflector",
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "swc_macros_common",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7303ef2c05cd654186cb250d29049a24840ca25d2747c25c0381c8d9e2f582e8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "termcolor"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6093bad37da69aab9d123a8091e4be0aa4a03e4d601ec641c327398315f62b64"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tracing"
+version = "0.1.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+dependencies = [
+ "cfg-if",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f4f31f56159e98206da9efd823404b79b6ef3143b4a7ab76e67b1751b25a4ab"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.37",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0955b8137a1df6f1a2e9a37d8a6656291ff0297c1a97c24e0d8425fe2312f79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "triomphe"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee8098afad3fb0c54a9007aab6804558410503ad676d4633f9c2559a00ac0f"
+dependencies = [
+ "serde",
+ "stable_deref_trait",
+]
+
+[[package]]
+name = "typed-arena"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6af6ae20167a9ece4bcb41af5b80f8a1f1df981f6391189ce00fd257af04126a"
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+
+[[package]]
+name = "unicode-id"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1b6def86329695390197b82c1e244a54a131ceb66c996f2088a3876e2ae083f"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-width"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
+
+[[package]]
+name = "url"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+]
+
+[[package]]
+name = "version_check"
+version = "0.9.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "wasi"
+version = "0.11.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f29e6f9198ba0d26b4c9f07dbe6f9ed633e1f3d5b8b414090084349e46a52596"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
diff --git a/tsparser/litparser-derive/Cargo.toml b/tsparser/litparser-derive/Cargo.toml
new file mode 100644
index 0000000000..445f589fa5
--- /dev/null
+++ b/tsparser/litparser-derive/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "litparser-derive"
+version = "0.1.0"
+edition = "2021"
+
+[lib]
+proc-macro = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+syn = { version = "2.0", features = ["extra-traits"] }
+quote = "1.0"
+proc-macro2 = "1.0.67"
+anyhow = "1.0"
+litparser = { version = "0.1.0", path = "../litparser" }
+swc_ecma_parser = { version = "0.141.21", features = ["typescript"] }
+swc_ecma_ast = "0.110.9"
+swc_common = { version = "0.33.8", features = ["tty-emitter"] }
+
+[dev-dependencies]
+prettyplease = "0.2"
diff --git a/tsparser/litparser-derive/src/lib.rs b/tsparser/litparser-derive/src/lib.rs
new file mode 100644
index 0000000000..997caba2e0
--- /dev/null
+++ b/tsparser/litparser-derive/src/lib.rs
@@ -0,0 +1,261 @@
+extern crate proc_macro;
+
+use quote::{format_ident, quote, quote_spanned};
+use syn::spanned::Spanned;
+use syn::{parse_macro_input, parse_quote, Data, DeriveInput, Fields, GenericParam, Generics};
+
+#[proc_macro_derive(LitParser)]
+pub fn derive_lit_parser(input: proc_macro::TokenStream) -> proc_macro::TokenStream {
+    // Parse the input tokens into a syntax tree
+    let input = parse_macro_input!(input as DeriveInput);
+
+    let name = input.ident;
+
+    // Add a bound `T: LitParser` to every type parameter T.
+    let generics = add_trait_bounds(input.generics);
+    let (impl_generics, ty_generics, where_clause) = generics.split_for_impl();
+
+    let input_ident = format_ident!("input");
+    let impl_stream = generate_impl(&input.data, &input_ident);
+
+    // Build the output, possibly using quasi-quotation
+    let expanded = quote! {
+        // The generated impl.
+        #[allow(non_snake_case)]
+        impl #impl_generics litparser::LitParser for #name #ty_generics #where_clause {
+            fn parse_lit(#input_ident: &swc_ecma_ast::Expr) -> litparser::ParseResult<Self> {
+                #impl_stream
+            }
+        }
+    };
+
+    // Hand the output tokens back to the compiler.
+    proc_macro::TokenStream::from(expanded)
+}
+
+// Add a bound `T: LitParser` to every type parameter T.
+fn add_trait_bounds(mut generics: Generics) -> Generics {
+    for param in &mut generics.params {
+        if let GenericParam::Type(ref mut type_param) = *param {
+            type_param
+                .bounds
+                .push(parse_quote!(tsparser::litparser::LitParser));
+        }
+    }
+    generics
+}
+
+// Generate an implementation to parse literals for a type.
+fn generate_impl(data: &Data, input_ident: &syn::Ident) -> proc_macro2::TokenStream {
+    let init_stream = fields_init(data);
+    let match_stream = match_expr(data, input_ident);
+    let return_stream = gen_return(data, input_ident);
+    match *data {
+        Data::Struct(ref data) => match data.fields {
+            Fields::Named(_) => {
+                quote! {
+                    #init_stream
+                    #match_stream
+                    #return_stream
+                }
+            }
+            Fields::Unnamed(_) => {
+                unimplemented!()
+            }
+            Fields::Unit => {
+                unimplemented!()
+            }
+        },
+        Data::Enum(_) | Data::Union(_) => unimplemented!(),
+    }
+}
+
+/// Turns a struct into a list of field initialization statements in the form:
+///    let field_name: ::std::option::Option<field_type> = None;
+fn fields_init(data: &Data) -> proc_macro2::TokenStream {
+    match *data {
+        Data::Struct(ref data) => match data.fields {
+            Fields::Named(ref fields) => {
+                let inits = fields.named.iter().map(|f| {
+                    let name = &f.ident;
+                    let typ = &f.ty;
+                    quote_spanned! {f.span() =>
+                        let mut #name: ::std::option::Option<#typ> = None;
+                    }
+                });
+                quote! { #(#inits)* }
+            }
+            Fields::Unnamed(_) => {
+                todo!()
+            }
+            Fields::Unit => {
+                todo!()
+            }
+        },
+        Data::Enum(_) | Data::Union(_) => unimplemented!(),
+    }
+}
+
+fn match_expr(data: &Data, input_ident: &syn::Ident) -> proc_macro2::TokenStream {
+    let lit_ident = format_ident!("lit");
+    let prop_ident = format_ident!("prop");
+    let kv_ident = format_ident!("kv");
+    let field_case_stream = gen_field_match_cases(data, &prop_ident, &kv_ident);
+    let match_prop_stream = match_prop(&prop_ident, &kv_ident, field_case_stream);
+    quote! {
+        match #input_ident {
+            swc_ecma_ast::Expr::Object(ref #lit_ident) => {
+                for #prop_ident in &#lit_ident.props {
+                    #match_prop_stream
+                }
+            }
+            _ => return Err(litparser::ParseError {
+                span: <swc_ecma_ast::Expr as swc_common::Spanned>::span(#input_ident),
+                message: "expected object literal".to_string(),
+            }),
+        }
+    }
+}
+
+// Generates an expression for matching a prop with the given prop expression.
+fn match_prop(
+    prop_ident: &syn::Ident,
+    kv_ident: &syn::Ident,
+    match_case_stream: proc_macro2::TokenStream,
+) -> proc_macro2::TokenStream {
+    quote! {
+        match #prop_ident {
+            swc_ecma_ast::PropOrSpread::Spread(_) => {
+                return Err(litparser::ParseError {
+                    span: <swc_ecma_ast::PropOrSpread as swc_common::Spanned>::span(#prop_ident),
+                    message: "spread operator unsupported".to_string(),
+                });
+            }
+            swc_ecma_ast::PropOrSpread::Prop(prop) => match prop.as_ref() {
+                swc_ecma_ast::Prop::Shorthand(_)
+                | swc_ecma_ast::Prop::Assign(_)
+                | swc_ecma_ast::Prop::Getter(_)
+                | swc_ecma_ast::Prop::Setter(_)
+                | swc_ecma_ast::Prop::Method(_) => {
+                    return Err(litparser::ParseError {
+                        span: <swc_ecma_ast::Prop as swc_common::Spanned>::span(prop),
+                        message: format!("prop type {:?} not supported", prop),
+                    });
+                }
+
+                swc_ecma_ast::Prop::KeyValue(#kv_ident) => match &#kv_ident.key {
+                    swc_ecma_ast::PropName::Ident(ident) => match ident.sym.as_ref() {
+                        #match_case_stream
+                    },
+                    swc_ecma_ast::PropName::Str(str) => match str.value.as_ref() {
+                        #match_case_stream
+                    }
+                    swc_ecma_ast::PropName::Num(_)
+                    | swc_ecma_ast::PropName::BigInt(_)
+                    | swc_ecma_ast::PropName::Computed(_) => {
+                        return Err(litparser::ParseError {
+                            span: <swc_ecma_ast::KeyValueProp as swc_common::Spanned>::span(#kv_ident),
+                            message: format!("prop name kind {:?} not supported", kv.key),
+                        });
+                    }
+                },
+            }
+        }
+    }
+}
+
+// Generates an expression for the match cases for the fields.
+fn gen_field_match_cases(
+    data: &Data,
+    prop_ident: &syn::Ident,
+    kv_ident: &syn::Ident,
+) -> proc_macro2::TokenStream {
+    match *data {
+        Data::Struct(ref data) => match data.fields {
+            Fields::Named(ref fields) => {
+                let match_cases = fields.named.iter().map(|f| {
+                    let name = f.ident.as_ref().unwrap();
+                    let match_literal = format!("{name}");
+                    quote_spanned! {f.span() =>
+                        #match_literal => {
+                            if #name.is_some() {
+                                return Err(litparser::ParseError {
+                                    span: <swc_ecma_ast::Prop as swc_common::Spanned>::span(#prop_ident),
+                                    message: format!("field {} set twice", #match_literal),
+                                });
+                            }
+                            let val = LitParser::parse_lit(&*#kv_ident.value)?;
+                            #name = Some(val);
+                        }
+                    }
+                });
+                quote! {
+                    #(#match_cases)*
+                    x @ _ => {
+                        return Err(litparser::ParseError {
+                            span: <swc_ecma_ast::Prop as swc_common::Spanned>::span(#prop_ident),
+                            message: "unexpected field".to_string(),
+                        });
+                    }
+                }
+            }
+            Fields::Unnamed(_) => {
+                todo!()
+            }
+            Fields::Unit => {
+                todo!()
+            }
+        },
+        Data::Enum(_) | Data::Union(_) => unimplemented!(),
+    }
+}
+
+fn gen_return(data: &Data, input_ident: &syn::Ident) -> proc_macro2::TokenStream {
+    match *data {
+        Data::Struct(ref data) => match data.fields {
+            Fields::Named(ref fields) => {
+                let field_names = fields.named.iter().map(|f| {
+                    let name = &f.ident;
+
+                    if is_optional(&f.ty) {
+                        quote_spanned! {f.span() =>
+                            #name: #name.flatten()
+                        }
+                    } else {
+                        quote_spanned! {f.span() =>
+                            #name: #name.ok_or_else(|| litparser::ParseError {
+                                span: <swc_ecma_ast::Expr as swc_common::Spanned>::span(#input_ident),
+                                message: format!("field {} is required but is missing", stringify!(#name)),
+                            })?
+                        }
+                    }
+                });
+                quote! {
+                    Ok(Self {
+                        #(#field_names),*
+                    })
+                }
+            }
+            Fields::Unnamed(_) => {
+                todo!()
+            }
+            Fields::Unit => {
+                todo!()
+            }
+        },
+        Data::Enum(_) | Data::Union(_) => unimplemented!(),
+    }
+}
+
+fn is_optional(ty: &syn::Type) -> bool {
+    match ty {
+        syn::Type::Path(syn::TypePath {
+            qself: None,
+            path: syn::Path { segments, .. },
+        }) => {
+            // Return true if the last path segment is "Option".
+            segments.last().is_some_and(|seg| seg.ident == "Option")
+        }
+        _ => false,
+    }
+}
diff --git a/tsparser/litparser-derive/tests/integration_tests.rs b/tsparser/litparser-derive/tests/integration_tests.rs
new file mode 100644
index 0000000000..a7f289eb98
--- /dev/null
+++ b/tsparser/litparser-derive/tests/integration_tests.rs
@@ -0,0 +1,118 @@
+#![allow(clippy::disallowed_names)]
+use std::option;
+
+use litparser_derive::LitParser;
+use swc_common::errors::{ColorConfig, Handler};
+use swc_common::input::StringInput;
+use swc_common::sync::Lrc;
+use swc_common::{FileName, SourceMap};
+use swc_ecma_parser::lexer::Lexer;
+use swc_ecma_parser::{Parser, Syntax};
+
+use litparser::{LitParser, ParseResult};
+
+#[test]
+fn test_parse() {
+    #[derive(LitParser)]
+    struct Foo {
+        foo: String,
+        bar: std::time::Duration,
+    }
+
+    let expr = parse(r#"{ foo: "foo", bar: "1h" }"#);
+    let foo = Foo::parse_lit(&expr).expect("failed to parse lit");
+    assert_eq!(foo.foo, "foo");
+    assert_eq!(foo.bar, std::time::Duration::from_secs(3600));
+}
+
+#[test]
+fn test_parse_str_keys() {
+    #[derive(LitParser)]
+    struct Foo {
+        foo: String,
+        bar: i32,
+    }
+
+    let expr = parse(r#"{ "foo": "foo", "bar": 3 }"#);
+    let foo = Foo::parse_lit(&expr).expect("failed to parse lit");
+    assert_eq!(foo.foo, "foo");
+    assert_eq!(foo.bar, 3);
+}
+
+#[test]
+#[allow(dead_code)]
+fn test_parse_refs() {
+    struct Dummy<'a> {
+        foo: Option<&'a str>,
+    }
+    impl LitParser for Dummy<'_> {
+        fn parse_lit(_input: &swc_ecma_ast::Expr) -> ParseResult<Self> {
+            Ok(Self { foo: None })
+        }
+    }
+
+    #[derive(LitParser)]
+    struct Foo<'a> {
+        foo: String,
+        dummy: Dummy<'a>,
+    }
+
+    let expr = parse(r#"{ foo: "foo", "dummy": null }"#);
+    let foo = Foo::parse_lit(&expr).expect("failed to parse lit");
+    assert_eq!(foo.foo, "foo");
+}
+
+#[test]
+fn test_parse_option() {
+    // let foo: Option<Option<T>> = None;
+
+    #[derive(LitParser)]
+    struct Foo {
+        // Try with different ways of writing Option, since we parse the syntax tree.
+        foo: Option<String>,
+        bar: option::Option<String>,
+        baz: std::option::Option<String>,
+        boo: ::std::option::Option<String>,
+    }
+
+    // The empty case
+    {
+        let expr = parse(r#"{ }"#);
+        let foo = Foo::parse_lit(&expr).expect("failed to parse lit");
+        assert_eq!(foo.foo, None);
+        assert_eq!(foo.bar, None);
+        assert_eq!(foo.baz, None);
+        assert_eq!(foo.boo, None);
+    }
+
+    // The non-empty case
+    {
+        let expr = parse(r#"{ foo: "foo", bar: "bar", baz: "baz", boo: "boo" }"#);
+        let foo = Foo::parse_lit(&expr).expect("failed to parse lit");
+        assert_eq!(foo.foo, Some("foo".to_string()));
+        assert_eq!(foo.bar, Some("bar".to_string()));
+        assert_eq!(foo.baz, Some("baz".to_string()));
+        assert_eq!(foo.boo, Some("boo".to_string()));
+    }
+}
+
+fn parse(src: &str) -> Box<swc_ecma_ast::Expr> {
+    let cm: Lrc<SourceMap> = Default::default();
+    let handler = Handler::with_tty_emitter(ColorConfig::Auto, true, false, Some(cm.clone()));
+
+    let fm = cm.new_source_file(FileName::Custom("test.ts".into()), src.into());
+    let lexer = Lexer::new(
+        Syntax::Es(Default::default()),
+        Default::default(),
+        StringInput::from(&*fm),
+        None,
+    );
+
+    let mut parser = Parser::new_from(lexer);
+
+    for e in parser.take_errors() {
+        e.into_diagnostic(&handler).emit();
+    }
+
+    parser.parse_expr().expect("failed to parse expr")
+}
diff --git a/tsparser/litparser/.gitignore b/tsparser/litparser/.gitignore
new file mode 100644
index 0000000000..ea8c4bf7f3
--- /dev/null
+++ b/tsparser/litparser/.gitignore
@@ -0,0 +1 @@
+/target
diff --git a/tsparser/litparser/Cargo.lock b/tsparser/litparser/Cargo.lock
new file mode 100644
index 0000000000..898a10eb82
--- /dev/null
+++ b/tsparser/litparser/Cargo.lock
@@ -0,0 +1,752 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "Inflector"
+version = "0.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fe438c63458706e03479442743baae6c88256498e6431708f6dfc520a26515d3"
+dependencies = [
+ "lazy_static",
+ "regex",
+]
+
+[[package]]
+name = "aho-corasick"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea5d730647d4fadd988536d06fecce94b7b4f2a7efdae548f1cf4b63205518ab"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.75"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4668cab20f66d8d020e1fbc0ebe47217433c1b6c8f2040faf858554e394ace6"
+
+[[package]]
+name = "ast_node"
+version = "0.9.5"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "swc_macros_common",
+ "syn",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "better_scoped_tls"
+version = "0.1.1"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+dependencies = [
+ "scoped-tls",
+]
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clean-path"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaa6b4b263a5d737e9bf6b7c09b72c41a5480aec4d7219af827f6564e950b6a5"
+
+[[package]]
+name = "duration-string"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6fcc1d9ae294a15ed05aeae8e11ee5f2b3fe971c077d45a42fb20825fba6ee13"
+
+[[package]]
+name = "either"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+
+[[package]]
+name = "form_urlencoded"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a62bc1cf6f830c2ec14a513a9fb124d0a213a629668a4186f329db21fe045652"
+dependencies = [
+ "percent-encoding",
+]
+
+[[package]]
+name = "from_variant"
+version = "0.1.6"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "swc_macros_common",
+ "syn",
+]
+
+[[package]]
+name = "hstr"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de90d3db62411eb62eddabe402d706ac4970f7ac8d088c05f11069cad9be9857"
+dependencies = [
+ "new_debug_unreachable",
+ "once_cell",
+ "phf",
+ "rustc-hash",
+ "smallvec",
+]
+
+[[package]]
+name = "idna"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d20d6b07bfbc108882d88ed8e37d39636dcc260e15e30c45e6ba089610b917c"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+]
+
+[[package]]
+name = "is-macro"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4467ed1321b310c2625c5aa6c1b1ffc5de4d9e42668cf697a08fb033ee8265e"
+dependencies = [
+ "Inflector",
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.148"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9cdc71e17332e86d2e1d38c1f99edcb6288ee11b815fb1a4b049eaa2114d369b"
+
+[[package]]
+name = "litparser"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "clean-path",
+ "duration-string",
+ "swc_ecma_ast",
+]
+
+[[package]]
+name = "lock_api"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1cc9717a20b1bb222f333e6a92fd32f7d8a18ddc5a3191a11af45dcbf4dcd16"
+dependencies = [
+ "autocfg",
+ "scopeguard",
+]
+
+[[package]]
+name = "memchr"
+version = "2.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4a24736216ec316047a1fc4252e27dabb04218aa4a3f37c6e7ddbf1f9782b54"
+
+[[package]]
+name = "num-bigint"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "608e7659b5c3d7cba262d894801b9ec9d00de989e8a82bd4bef91d08da45cdc0"
+dependencies = [
+ "autocfg",
+ "num-integer",
+ "num-traits",
+ "serde",
+]
+
+[[package]]
+name = "num-integer"
+version = "0.1.45"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "225d3389fb3509a24c93f5c29eb6bde2586b98d9f016636dff58d7c6f7569cd9"
+dependencies = [
+ "autocfg",
+ "num-traits",
+]
+
+[[package]]
+name = "num-traits"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+
+[[package]]
+name = "parking_lot"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3742b2c103b9f06bc9fff0a37ff4912935851bee6d36f3c02bcc755bcfec228f"
+dependencies = [
+ "lock_api",
+ "parking_lot_core",
+]
+
+[[package]]
+name = "parking_lot_core"
+version = "0.9.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93f00c865fe7cabf650081affecd3871070f26767e7b2070a3ffae14c654b447"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "redox_syscall",
+ "smallvec",
+ "windows-targets",
+]
+
+[[package]]
+name = "percent-encoding"
+version = "2.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
+
+[[package]]
+name = "phf"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ade2d8b8f33c7333b51bcf0428d37e217e9f32192ae4772156f65063b8ce03dc"
+dependencies = [
+ "phf_macros",
+ "phf_shared 0.11.2",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "48e4cc64c2ad9ebe670cb8fd69dd50ae301650392e81c05f9bfcb2d5bdbc24b0"
+dependencies = [
+ "phf_shared 0.11.2",
+ "rand",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3444646e286606587e49f3bcf1679b8cef1dc2c5ecc29ddacaffc305180d464b"
+dependencies = [
+ "phf_generator",
+ "phf_shared 0.11.2",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.11.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "90fcb95eef784c2ac79119d1dd819e162b5da872ce6f3c3abe1e8ca1c082f72b"
+dependencies = [
+ "siphasher",
+]
+
+[[package]]
+name = "pin-project-lite"
+version = "0.2.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8afb450f006bf6385ca15ef45d71d2288452bc3683ce2e2cacc0d18e4be60b58"
+
+[[package]]
+name = "pmutil"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52a40bc70c2c58040d2d8b167ba9a5ff59fc9dab7ad44771cfde3dcfde7a09c6"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.67"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d433d9f1a3e8c1263d9456598b16fec66f4acc9a74dacffd35c7bb09b3a1328"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "rand_core",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+
+[[package]]
+name = "redox_syscall"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "regex"
+version = "1.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "697061221ea1b4a94a624f67d0ae2bfe4e22b8a17b6a192afb11046542cc8c47"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2f401f4955220693b56f8ec66ee9c78abffd8d1c4f23dc41a23839eb88f0795"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+
+[[package]]
+name = "rustc-hash"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
+
+[[package]]
+name = "scoped-tls"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
+
+[[package]]
+name = "scopeguard"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
+
+[[package]]
+name = "serde"
+version = "1.0.188"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.188"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "siphasher"
+version = "0.3.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+
+[[package]]
+name = "smallvec"
+version = "1.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "942b4a808e05215192e39f4ab80813e599068285906cc91aa64f923db842bd5a"
+
+[[package]]
+name = "string_cache"
+version = "0.8.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f91138e76242f575eb1d3b38b4f1362f10d3a43f47d182a5b359af488a02293b"
+dependencies = [
+ "new_debug_unreachable",
+ "once_cell",
+ "parking_lot",
+ "phf_shared 0.10.0",
+ "precomputed-hash",
+ "serde",
+]
+
+[[package]]
+name = "string_enum"
+version = "0.4.1"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "swc_macros_common",
+ "syn",
+]
+
+[[package]]
+name = "swc_atoms"
+version = "0.6.4"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+dependencies = [
+ "hstr",
+ "once_cell",
+ "rustc-hash",
+ "serde",
+]
+
+[[package]]
+name = "swc_common"
+version = "0.33.8"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+dependencies = [
+ "ast_node",
+ "better_scoped_tls",
+ "cfg-if",
+ "either",
+ "from_variant",
+ "new_debug_unreachable",
+ "num-bigint",
+ "once_cell",
+ "rustc-hash",
+ "serde",
+ "siphasher",
+ "string_cache",
+ "swc_atoms",
+ "swc_eq_ignore_macros",
+ "swc_visit",
+ "tracing",
+ "unicode-width",
+ "url",
+]
+
+[[package]]
+name = "swc_ecma_ast"
+version = "0.110.9"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+dependencies = [
+ "bitflags 2.4.0",
+ "is-macro",
+ "num-bigint",
+ "phf",
+ "scoped-tls",
+ "string_enum",
+ "swc_atoms",
+ "swc_common",
+ "unicode-id",
+]
+
+[[package]]
+name = "swc_eq_ignore_macros"
+version = "0.1.2"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "swc_macros_common"
+version = "0.3.8"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+dependencies = [
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "swc_visit"
+version = "0.5.7"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+dependencies = [
+ "either",
+ "swc_visit_macros",
+]
+
+[[package]]
+name = "swc_visit_macros"
+version = "0.5.8"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+dependencies = [
+ "Inflector",
+ "pmutil",
+ "proc-macro2",
+ "quote",
+ "swc_macros_common",
+ "syn",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7303ef2c05cd654186cb250d29049a24840ca25d2747c25c0381c8d9e2f582e8"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tinyvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87cc5ceb3875bb20c2890005a4e226a4651264a5c75edb2421b52861a0a0cb50"
+dependencies = [
+ "tinyvec_macros",
+]
+
+[[package]]
+name = "tinyvec_macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
+
+[[package]]
+name = "tracing"
+version = "0.1.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ce8c33a8d48bd45d624a6e523445fd21ec13d3653cd51f681abf67418f54eb8"
+dependencies = [
+ "cfg-if",
+ "pin-project-lite",
+ "tracing-attributes",
+ "tracing-core",
+]
+
+[[package]]
+name = "tracing-attributes"
+version = "0.1.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f4f31f56159e98206da9efd823404b79b6ef3143b4a7ab76e67b1751b25a4ab"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tracing-core"
+version = "0.1.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0955b8137a1df6f1a2e9a37d8a6656291ff0297c1a97c24e0d8425fe2312f79a"
+dependencies = [
+ "once_cell",
+]
+
+[[package]]
+name = "unicode-bidi"
+version = "0.3.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92888ba5573ff080736b3648696b70cafad7d250551175acbaa4e0385b3e1460"
+
+[[package]]
+name = "unicode-id"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b1b6def86329695390197b82c1e244a54a131ceb66c996f2088a3876e2ae083f"
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+
+[[package]]
+name = "unicode-normalization"
+version = "0.1.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c5713f0fc4b5db668a2ac63cdb7bb4469d8c9fed047b1d0292cc7b0ce2ba921"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-width"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e51733f11c9c4f72aa0c160008246859e340b00807569a0da0e7a1079b27ba85"
+
+[[package]]
+name = "url"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "143b538f18257fac9cad154828a57c6bf5157e1aa604d4816b5995bf6de87ae5"
+dependencies = [
+ "form_urlencoded",
+ "idna",
+ "percent-encoding",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
+
+[[patch.unused]]
+name = "swc_ecma_loader"
+version = "0.45.9"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+
+[[patch.unused]]
+name = "swc_ecma_parser"
+version = "0.141.21"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+
+[[patch.unused]]
+name = "swc_ecma_transforms_base"
+version = "0.134.30"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
+
+[[patch.unused]]
+name = "swc_ecma_visit"
+version = "0.96.9"
+source = "git+https://github.com/encoredev/swc?branch=node-resolve-exports#6b46199fc5b329cf3f051d26b3e3d7687af0034b"
diff --git a/tsparser/litparser/Cargo.toml b/tsparser/litparser/Cargo.toml
new file mode 100644
index 0000000000..1f84641ecf
--- /dev/null
+++ b/tsparser/litparser/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "litparser"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+anyhow = "1.0"
+duration-string = "0.3.0"
+swc_ecma_ast = "0.110.9"
+swc_common = { version = "0.33.8", features = ["tty-emitter"] }
+clean-path = "0.2.1"
+num-bigint = "0.4.5"
+num-integer = "0.1.46"
+num-traits = "0.2.19"
diff --git a/tsparser/litparser/src/lib.rs b/tsparser/litparser/src/lib.rs
new file mode 100644
index 0000000000..ad8ef06f92
--- /dev/null
+++ b/tsparser/litparser/src/lib.rs
@@ -0,0 +1,479 @@
+use duration_string::DurationString;
+use num_bigint::{BigInt, ToBigInt};
+use std::{
+    error::Error,
+    fmt::{Debug, Display},
+    ops::{Deref, DerefMut},
+    path::{Component, PathBuf},
+};
+use swc_common::{errors::HANDLER, pass::Either, util::take::Take, Span, Spanned};
+use swc_ecma_ast as ast;
+
+#[derive(Debug, Clone, Hash)]
+pub struct ParseError {
+    pub span: Span,
+    pub message: String,
+}
+
+impl Error for ParseError {}
+
+impl Display for ParseError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_str(&self.message)
+    }
+}
+
+impl ParseError {
+    pub fn report(self) {
+        HANDLER.with(|handler| {
+            handler.span_err(self.span, &self.message);
+        });
+    }
+}
+
+#[macro_export]
+macro_rules! report_and_continue {
+    ($e:expr) => {
+        match $e {
+            Ok(v) => v,
+            Err(err) => {
+                err.report();
+                continue;
+            }
+        }
+    };
+}
+
+#[macro_export]
+macro_rules! report_and_return {
+    ($e:expr) => {
+        match $e {
+            Ok(v) => v,
+            Err(err) => {
+                err.report();
+                return;
+            }
+        }
+    };
+}
+
+pub trait ToParseErr {
+    fn parse_err<S: Into<String>>(&self, message: S) -> ParseError;
+}
+
+impl<T> ToParseErr for T
+where
+    T: Spanned,
+{
+    fn parse_err<S: Into<String>>(&self, message: S) -> ParseError {
+        ParseError {
+            span: self.span(),
+            message: message.into(),
+        }
+    }
+}
+
+pub type ParseResult<T> = Result<T, ParseError>;
+
+pub trait LitParser: Sized {
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self>;
+}
+
+impl<T> LitParser for Sp<T>
+where
+    T: LitParser,
+{
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        let res = T::parse_lit(input)?;
+        Ok(Sp(input.span(), res))
+    }
+}
+
+impl LitParser for String {
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        match input {
+            ast::Expr::Lit(ast::Lit::Str(str)) => Ok(str.value.to_string()),
+            _ => Err(input.parse_err("expected string literal")),
+        }
+    }
+}
+
+impl LitParser for bool {
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        match input {
+            ast::Expr::Lit(ast::Lit::Bool(b)) => Ok(b.value),
+            _ => Err(input.parse_err("expected boolean literal")),
+        }
+    }
+}
+
+impl LitParser for i32 {
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        let big = parse_const_bigint(input)?;
+        big.try_into()
+            .map_err(|_| input.parse_err("expected number literal"))
+    }
+}
+
+impl LitParser for u32 {
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        let big = parse_const_bigint(input)?;
+        big.try_into()
+            .map_err(|_| input.parse_err("expected unsigned number literal"))
+    }
+}
+
+impl LitParser for i64 {
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        let big = parse_const_bigint(input)?;
+        big.try_into()
+            .map_err(|_| input.parse_err("expected number literal"))
+    }
+}
+
+impl LitParser for u64 {
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        let big = parse_const_bigint(input)?;
+        big.try_into()
+            .map_err(|_| input.parse_err("expected unsigned number literal"))
+    }
+}
+
+impl LitParser for ast::Expr {
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        Ok(input.clone())
+    }
+}
+
+impl<T> LitParser for Option<T>
+where
+    T: LitParser,
+{
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Option<T>> {
+        let t = T::parse_lit(input)?;
+        Ok(Some(t))
+    }
+}
+
+impl<L, R> LitParser for Either<L, R>
+where
+    L: LitParser,
+    R: LitParser,
+{
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Either<L, R>> {
+        let res = L::parse_lit(input)
+            .map(Either::Left)
+            .or_else(|_| R::parse_lit(input).map(Either::Right))?;
+
+        Ok(res)
+    }
+}
+
+impl LitParser for std::time::Duration {
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        match input {
+            ast::Expr::Lit(ast::Lit::Str(str)) => {
+                let dur = DurationString::try_from(str.value.to_string())
+                    .map_err(|e| str.parse_err(e))?;
+                Ok(dur.into())
+            }
+            _ => Err(input.parse_err("expected duration string literal")),
+        }
+    }
+}
+
+impl<T> LitParser for Vec<T>
+where
+    T: LitParser,
+{
+    fn parse_lit(input: &swc_ecma_ast::Expr) -> ParseResult<Self> {
+        match input {
+            ast::Expr::Array(array) => {
+                let mut vec = Vec::new();
+                for elem in &array.elems {
+                    if let Some(expr) = elem {
+                        let parsed_elem = T::parse_lit(&expr.expr)?;
+                        vec.push(parsed_elem);
+                    } else {
+                        return Err(array.span.parse_err("expected array element"));
+                    }
+                }
+                Ok(vec)
+            }
+            _ => Err(input.parse_err("expected array literal")),
+        }
+    }
+}
+
+/// Represents a local, relative path (without ".." or a root).
+#[derive(Debug, Clone)]
+pub struct LocalRelPath {
+    pub span: Span,
+    pub buf: PathBuf,
+}
+
+impl Spanned for LocalRelPath {
+    fn span(&self) -> Span {
+        self.span
+    }
+}
+
+impl LocalRelPath {
+    pub fn try_from<S: AsRef<str>>(sp: Span, str: S) -> ParseResult<Self> {
+        let str = str.as_ref();
+        let path = PathBuf::from(str);
+        for c in path.components() {
+            match c {
+                Component::CurDir => {}
+                Component::Normal(_) => {}
+                _ => return Err(sp.parse_err("expected a local relative path")),
+            }
+        }
+        Ok(LocalRelPath {
+            span: sp,
+            buf: clean_path::clean(path),
+        })
+    }
+}
+
+impl LitParser for LocalRelPath {
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        match input {
+            ast::Expr::Lit(ast::Lit::Str(str)) => LocalRelPath::try_from(str.span, &str.value),
+            _ => Err(input.parse_err("expected a local relative path")),
+        }
+    }
+}
+
+#[derive(Debug)]
+pub enum Nullable<T> {
+    Present(T),
+    Null,
+}
+
+impl<T> LitParser for Nullable<T>
+where
+    T: LitParser,
+{
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        match input {
+            ast::Expr::Lit(ast::Lit::Null(_)) => Ok(Nullable::Null),
+            _ => {
+                let t = T::parse_lit(input)?;
+                Ok(Nullable::Present(t))
+            }
+        }
+    }
+}
+
+impl<T> Clone for Nullable<T>
+where
+    T: Clone,
+{
+    fn clone(&self) -> Self {
+        match self {
+            Nullable::Present(t) => Nullable::Present(t.clone()),
+            Nullable::Null => Nullable::Null,
+        }
+    }
+}
+
+fn parse_const_bigint(expr: &ast::Expr) -> ParseResult<BigInt> {
+    match expr {
+        ast::Expr::Lit(ast::Lit::Num(num)) => {
+            let int = num.value as i64;
+            if int as f64 != num.value {
+                return Err(num.parse_err("expected integer literal"));
+            }
+            let Some(big) = int.to_bigint() else {
+                return Err(num.parse_err("integer too large"));
+            };
+            Ok(big)
+        }
+        ast::Expr::Unary(unary) => match unary.op {
+            ast::UnaryOp::Minus => {
+                let x = parse_const_bigint(&unary.arg)?;
+                Ok(-x)
+            }
+            ast::UnaryOp::Plus => parse_const_bigint(&unary.arg),
+            _ => Err(unary.parse_err(format!("unsupported unary operator {:?}", unary.op))),
+        },
+        ast::Expr::Bin(bin) => {
+            let x = parse_const_bigint(&bin.left)?;
+            let y = parse_const_bigint(&bin.right)?;
+            match bin.op {
+                ast::BinaryOp::Add => Ok(x + y),
+                ast::BinaryOp::Sub => Ok(x - y),
+                ast::BinaryOp::Mul => Ok(x * y),
+                ast::BinaryOp::Mod => Ok(x % y),
+                ast::BinaryOp::Div => {
+                    // Does it divide evenly?
+                    use num_integer::Integer;
+                    use num_traits::Zero;
+                    let (quo, remainder) = x.div_rem(&y);
+                    if remainder.is_zero() {
+                        Ok(quo)
+                    } else {
+                        Err(bin.parse_err("expected integer division"))
+                    }
+                }
+                _ => Err(bin.parse_err(format!("expected arithmetic operator, got {:?}", bin.op))),
+            }
+        }
+        _ => Err(expr.parse_err("expected integer literal")),
+    }
+}
+
+pub struct Sp<T>(Span, T);
+
+impl<T> Clone for Sp<T>
+where
+    T: Clone,
+{
+    fn clone(&self) -> Self {
+        Sp(self.0, self.1.clone())
+    }
+}
+
+impl<T> Sp<T> {
+    pub fn new(sp: Span, val: T) -> Self {
+        Self(sp, val)
+    }
+
+    pub fn with_dummy(val: T) -> Self {
+        Self::new(Span::dummy(), val)
+    }
+
+    pub fn with<U>(&self, val: U) -> Sp<U> {
+        Sp::new(self.0, val)
+    }
+
+    pub fn split(self) -> (Span, T) {
+        (self.0, self.1)
+    }
+
+    pub fn span(&self) -> Span {
+        self.0
+    }
+
+    pub fn take(self) -> T {
+        self.1
+    }
+
+    pub fn map<F, U>(self, f: F) -> Sp<U>
+    where
+        F: FnOnce(T) -> U,
+    {
+        Sp(self.0, f(self.1))
+    }
+
+    pub fn get(&self) -> &T {
+        &self.1
+    }
+
+    pub fn as_deref(&self) -> &T::Target
+    where
+        T: Deref,
+    {
+        self.1.deref()
+    }
+}
+
+impl<T, E> Sp<Result<T, E>> {
+    pub fn transpose(self) -> Result<Sp<T>, E> {
+        match self.1 {
+            Ok(inner) => Ok(Sp(self.0, inner)),
+            Err(err) => Err(err),
+        }
+    }
+}
+
+impl<T> AsRef<T> for Sp<T> {
+    fn as_ref(&self) -> &T {
+        &self.1
+    }
+}
+
+impl<T> AsMut<T> for Sp<T> {
+    fn as_mut(&mut self) -> &mut T {
+        &mut self.1
+    }
+}
+
+impl<T> Deref for Sp<T> {
+    type Target = T;
+
+    fn deref(&self) -> &Self::Target {
+        &self.1
+    }
+}
+
+impl<T> DerefMut for Sp<T> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.1
+    }
+}
+
+impl<T> PartialEq for Sp<T>
+where
+    T: PartialEq,
+{
+    fn eq(&self, other: &Self) -> bool {
+        self.1 == other.1
+    }
+}
+
+impl<T> Eq for Sp<T> where T: Eq {}
+
+impl<T> PartialOrd for Sp<T>
+where
+    T: PartialOrd,
+{
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        self.1.partial_cmp(&other.1)
+    }
+}
+
+impl<T> Ord for Sp<T>
+where
+    T: Ord,
+{
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        self.1.cmp(&other.1)
+    }
+}
+
+impl<T> Copy for Sp<T> where T: Copy {}
+
+impl<T> Debug for Sp<T>
+where
+    T: Debug,
+{
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.1.fmt(f)
+    }
+}
+
+impl<T> Display for Sp<T>
+where
+    T: Display,
+{
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        self.1.fmt(f)
+    }
+}
+
+impl<T> From<T> for Sp<T>
+where
+    T: Spanned,
+{
+    fn from(value: T) -> Self {
+        Self(value.span(), value)
+    }
+}
+
+impl<T> Spanned for Sp<T> {
+    fn span(&self) -> Span {
+        self.0
+    }
+}
diff --git a/tsparser/src/app/mod.rs b/tsparser/src/app/mod.rs
new file mode 100644
index 0000000000..7739a0c388
--- /dev/null
+++ b/tsparser/src/app/mod.rs
@@ -0,0 +1,206 @@
+use std::collections::{HashMap, HashSet};
+
+use matchit::InsertError;
+use swc_common::errors::HANDLER;
+use swc_common::Span;
+
+use crate::encore::parser::meta::v1;
+use crate::legacymeta::compute_meta;
+use crate::parser::parser::{ParseContext, ParseResult};
+use crate::parser::resources::apis::api::{Endpoint, Method, Methods};
+use crate::parser::resources::Resource;
+use crate::parser::respath::Path;
+use crate::parser::types::visitor::VisitWith;
+use crate::parser::types::{validation, visitor, ObjectId, ResolveState, Type, Validated};
+use crate::parser::Range;
+use crate::span_err::ErrReporter;
+use litparser::Sp;
+
+#[derive(Debug)]
+pub struct AppDesc {
+    pub parse: ParseResult,
+    pub meta: v1::Data,
+}
+
+struct Router {
+    methods: HashMap<Method, matchit::Router<Range>>,
+}
+
+impl Router {
+    fn new() -> Self {
+        Router {
+            methods: HashMap::new(),
+        }
+    }
+}
+
+impl Router {
+    fn try_add(&mut self, methods: &Methods, path: &Path, range: Range) {
+        let methods = match methods {
+            Methods::All => Method::all().to_vec(),
+            Methods::Some(vec) => vec.to_vec(),
+        };
+
+        for method in methods {
+            let method_router = self.methods.entry(method).or_default();
+            if let Err(e) = method_router.insert(path.to_string(), range) {
+                match e {
+                    InsertError::Conflict { with } => {
+                        let prev_range = *method_router.at(&with).unwrap().value;
+                        HANDLER.with(|handler| {
+                            handler
+                                .struct_span_err(
+                                    range,
+                                    "api endpoints with conflicting paths defined",
+                                )
+                                .span_note(prev_range, "previously defined here")
+                                .emit()
+                        })
+                    }
+                    _ => HANDLER.with(|handler| handler.span_err(range, &e.to_string())),
+                }
+            }
+        }
+    }
+}
+
+pub fn validate_and_describe(pc: &ParseContext, parse: ParseResult) -> Option<AppDesc> {
+    AppValidator { pc, parse: &parse }.validate();
+
+    if pc.errs.has_errors() {
+        return None;
+    }
+
+    match compute_meta(pc, &parse) {
+        Ok(meta) => Some(AppDesc { parse, meta }),
+        Err(err) => {
+            err.report();
+            None
+        }
+    }
+}
+
+struct AppValidator<'a> {
+    pc: &'a ParseContext,
+    parse: &'a ParseResult,
+}
+
+impl AppValidator<'_> {
+    fn validate(&self) {
+        self.validate_apis();
+        self.validate_pubsub();
+        self.validate_sqldb();
+    }
+
+    fn validate_apis(&self) {
+        let mut seen = std::collections::HashMap::new();
+        for resource in &self.parse.resources {
+            if let Resource::APIEndpoint(ep) = resource {
+                let key = (ep.service_name.clone(), ep.name.clone());
+                if let Some(prev) = seen.insert(key, ep.name_range) {
+                    HANDLER.with(|handler| {
+                        handler
+                            .struct_span_err(
+                                ep.name_range,
+                                "api endpoints with conflicting names defined within the same service",
+                            )
+                            .span_note(prev, "previously defined here")
+                            .emit();
+                    })
+                }
+            }
+        }
+
+        for service in self.parse.services.iter() {
+            let mut router = Router::new();
+            for bind in &service.binds {
+                if let Resource::APIEndpoint(endpoint) = &bind.resource {
+                    let encoding = &endpoint.encoding;
+                    router.try_add(&encoding.methods, &encoding.path, endpoint.range);
+
+                    self.validate_endpoint(endpoint);
+                }
+            }
+        }
+    }
+
+    fn validate_endpoint(&self, ep: &Endpoint) {
+        if let Some(schema) = &ep.encoding.raw_req_schema {
+            self.validate_validations(schema);
+        }
+        if let Some(schema) = &ep.encoding.raw_resp_schema {
+            self.validate_validations(schema);
+        }
+    }
+
+    fn validate_validations(&self, schema: &Sp<Type>) {
+        struct Visitor<'a> {
+            state: &'a ResolveState,
+            span: Span,
+            seen_decls: HashSet<ObjectId>,
+        }
+
+        impl visitor::Visit for Visitor<'_> {
+            fn resolve_state(&self) -> &ResolveState {
+                self.state
+            }
+            fn seen_decls(&mut self) -> &mut HashSet<ObjectId> {
+                &mut self.seen_decls
+            }
+
+            fn visit_validated(&mut self, node: &Validated) {
+                if let Err(err) = node.expr.supports_type(&node.typ) {
+                    let s = err.to_string();
+                    self.span.err(&s);
+                } else {
+                    // Don't recurse into the validation expression, as it would report an error
+                    // below as if the expression was standalone.
+                    node.typ.visit_with(self);
+                }
+            }
+
+            fn visit_validation(&mut self, node: &validation::Expr) {
+                HANDLER.with(|h| {
+                    h.struct_span_err(
+                        self.span,
+                        &format!("unsupported standalone validation expression: {node}"),
+                    )
+                    .note("validation expressions must be attached to a regular type using '&'")
+                    .emit()
+                });
+            }
+        }
+
+        let state = self.pc.type_checker.state();
+        let mut visitor = Visitor {
+            state,
+            span: schema.span(),
+            seen_decls: HashSet::new(),
+        };
+        schema.visit_with(&mut visitor);
+    }
+
+    fn validate_pubsub(&self) {
+        for res in self.parse.resources.iter() {
+            if let Resource::PubSubTopic(topic) = &res {
+                self.validate_validations(&topic.message_type);
+            }
+        }
+    }
+
+    fn validate_sqldb(&self) {
+        let mut seen = std::collections::HashMap::new();
+        for resource in &self.parse.resources {
+            if let Resource::SQLDatabase(db) = resource {
+                if let Some(prev_range) = seen.insert(db.name.clone(), db.span) {
+                    HANDLER.with(|handler| {
+                        handler
+                            .struct_span_err(db.span, "SQL Database with this name already defined")
+                            .span_note(prev_range, "previously defined here")
+                            .emit();
+                    })
+                }
+            }
+        }
+    }
+}
diff --git a/tsparser/src/bin/tsparser-encore.rs b/tsparser/src/bin/tsparser-encore.rs
new file mode 100644
index 0000000000..d32e9f5cac
--- /dev/null
+++ b/tsparser/src/bin/tsparser-encore.rs
@@ -0,0 +1,346 @@
+use std::convert::Infallible;
+use std::fmt::{self, Display};
+use std::io::{self, BufRead, Write};
+use std::path::PathBuf;
+use std::rc::Rc;
+use std::sync::{Arc, Mutex};
+
+use anyhow::Result;
+use prost::Message;
+use serde::Deserialize;
+use swc_common::errors::{Emitter, EmitterWriter, Handler, HANDLER};
+use swc_common::{Globals, SourceMap, SourceMapper, GLOBALS};
+use tracing_subscriber::fmt::format::FmtSpan;
+
+use encore_tsparser::builder::{Builder, DebugMode, NodeJSRuntime, PlainError};
+use encore_tsparser::parser::parser::ParseContext;
+use encore_tsparser::{app, builder};
+
+fn main() -> Result<()> {
+    tracing_subscriber::fmt()
+        .with_span_events(FmtSpan::ENTER)
+        .with_env_filter(tracing_subscriber::EnvFilter::from_default_env())
+        .with_writer(io::stderr)
+        .init();
+    let cwd = std::env::current_dir()?;
+
+    let globals = Globals::new();
+
+    let cm: Rc<SourceMap> = Default::default();
+    let errors: Rc<Mutex<Vec<String>>> = Default::default();
+    let emitter = ErrorList {
+        cm: cm.clone(),
+        errors: errors.clone(),
+    };
+
+    let errs = Rc::new(Handler::with_emitter(true, false, Box::new(emitter)));
+
+    GLOBALS.set(&globals, || -> Result<()> {
+        HANDLER.set(&errs, || -> Result<()> {
+            let builder = Builder::new()?;
+            let mut parse: Option<(builder::App, app::AppDesc)> = None;
+
+            let prepare = match parse_cmd()? {
+                Some(Command::Prepare(prepare)) => prepare,
+                Some(_) => anyhow::bail!("expected prepare command"),
+                None => return Ok(()),
+            };
+
+            {
+                let pp = builder::PrepareParams {
+                    app_root: prepare.app_root.clone(),
+
+                    encore_dev_version: match prepare.local_runtime_override {
+                        Some(buf) => builder::PackageVersion::Local(buf.join("encore.dev")),
+                        None => builder::PackageVersion::Published(
+                            // Remove the leading "v" from the runtime version, as JS version numbers don't use it.
+                            prepare.runtime_version.trim_start_matches("v").to_string(),
+                        ),
+                    },
+                };
+
+                match builder.prepare(&pp) {
+                    Ok(result) => {
+                        let json = serde_json::to_string(&result)?;
+                        write_result(<Result<_, Infallible>>::Ok(json.as_bytes()))?;
+                    }
+                    Err(err) => {
+                        log::error!("failed to prepare: {:?}", err);
+                        write_result(Err(err))?
+                    }
+                }
+            }
+
+            let pc = match ParseContext::new(prepare.app_root, None, cm.clone(), errs.clone()) {
+                Ok(pc) => pc,
+                Err(err) => {
+                    log::error!("failed to construct parse context: {:?}", err);
+                    write_result(Err(err))?;
+                    return Ok(());
+                }
+            };
+
+            loop {
+                let cmd = match parse_cmd()? {
+                    Some(cmd) => cmd,
+                    None => return Ok(()),
+                };
+
+                match cmd {
+                    Command::Prepare(input) => {
+                        log::debug!("got prepare input {:?}", input);
+                    }
+
+                    Command::Parse(input) => {
+                        log::debug!("got parse input {:?}", input);
+                        if parse.is_some() {
+                            anyhow::bail!("already parsed!");
+                        }
+
+                        let app = builder::App {
+                            root: input.app_root.clone(),
+                            platform_id: input.platform_id,
+                            local_id: input.local_id,
+                        };
+                        let pp = builder::ParseParams {
+                            app: &app,
+                            pc: &pc,
+                            working_dir: &cwd,
+                            parse_tests: input.parse_tests,
+                        };
+
+                        match builder.parse(&pp) {
+                            Some(result) => {
+                                log::info!("parse successful");
+                                write_result(<Result<_, Infallible>>::Ok(
+                                    result.meta.encode_to_vec().as_slice(),
+                                ))?;
+                                parse = Some((app, result));
+                            }
+                            None => {
+                                // Get errors from the emitter.
+                                let errs = errors.lock().unwrap();
+                                let mut err_msg = String::new();
+                                for err in errs.iter() {
+                                    err_msg.push_str(err);
+                                    err_msg.push('\n');
+                                }
+
+                                // Don't include stack trace or detailed error info
+                                // if this is a parse error.
+                                write_result(Err(anyhow::anyhow!(PlainError(err_msg))))?
+                            }
+                        }
+                    }
+
+                    Command::Compile(input) => match &parse {
+                        None => anyhow::bail!("no parse!"),
+                        Some((app, parse)) => {
+                            let cp = builder::CompileParams {
+                                app,
+                                pc: &pc,
+                                working_dir: &cwd,
+                                desc: parse,
+                                debug: input.debug,
+                                nodejs_runtime: input.nodejs_runtime,
+                            };
+
+                            log::info!("starting compile");
+                            match builder.compile(&cp) {
+                                Ok(compile) => {
+                                    log::info!("compile successful");
+                                    let json = serde_json::to_string(&compile)?;
+                                    write_result(<Result<_, Infallible>>::Ok(json.as_bytes()))?;
+                                }
+                                Err(err) => {
+                                    log::error!("failed to compile: {:?}", err);
+                                    write_result(Err(err))?
+                                }
+                            };
+                        }
+                    },
+
+                    Command::Test(_input) => match &parse {
+                        None => anyhow::bail!("no parse!"),
+                        Some((app, parse)) => {
+                            let p = builder::TestParams {
+                                app,
+                                pc: &pc,
+                                working_dir: &cwd,
+                                parse,
+                            };
+
+                            match builder.test(&p) {
+                                Ok(compile) => {
+                                    let json = serde_json::to_string(&compile)?;
+                                    write_result(<Result<_, Infallible>>::Ok(json.as_bytes()))?;
+                                }
+                                Err(err) => write_result(Err(err))?,
+                            };
+                        }
+                    },
+
+                    Command::GenUserFacing(_input) => match &parse {
+                        None => anyhow::bail!("no parse!"),
+                        Some((app, parse)) => {
+                            let cp = builder::CodegenParams {
+                                app,
+                                pc: &pc,
+                                working_dir: &cwd,
+                                desc: parse,
+                            };
+
+                            log::info!("starting generate user facing code");
+                            match builder.generate_code(&cp) {
+                                Ok(_) => write_result(<Result<_, Infallible>>::Ok(&[]))?,
+                                Err(err) => {
+                                    log::error!("failed to generate code: {:?}", err);
+                                    write_result(Err(err))?
+                                }
+                            };
+                        }
+                    },
+                }
+            }
+        })
+    })
+}
+
+fn write_data(is_ok: bool, data: &[u8]) -> io::Result<()> {
+    let mut stdout = std::io::stdout().lock();
+    let byte_len = ((data.len() + 1) as u32).to_le_bytes();
+    stdout.write_all(&byte_len)?;
+    stdout.write_all(&[if is_ok { 0 } else { 1 }])?;
+    stdout.write_all(data)?;
+    stdout.flush()?;
+    Ok(())
+}
+
+fn write_result<E>(res: Result<&[u8], E>) -> io::Result<()>
+where
+    E: Display,
+{
+    match res {
+        Ok(bytes) => write_data(true, bytes),
+        Err(err) => {
+            let s = err.to_string();
+            write_data(false, s.as_bytes())
+        }
+    }
+}
+
+enum Command {
+    Prepare(PrepareInput),
+    Parse(ParseInput),
+    Compile(CompileInput),
+    Test(TestInput),
+    GenUserFacing(GenUserFacingInput),
+}
+
+fn parse_cmd() -> Result<Option<Command>> {
+    let stdin = io::stdin();
+    let mut stdin = stdin.lock();
+
+    // Read a line and see what it says.
+    let line = {
+        let mut line = String::new();
+        stdin.read_line(&mut line)?;
+        line
+    };
+
+    match line.trim() {
+        "" => Ok(None),
+        "prepare" => {
+            let mut de = serde_json::Deserializer::from_reader(stdin);
+            let input = PrepareInput::deserialize(&mut de)?;
+            Ok(Some(Command::Prepare(input)))
+        }
+        "parse" => {
+            let mut de = serde_json::Deserializer::from_reader(stdin);
+            let input = ParseInput::deserialize(&mut de)?;
+            Ok(Some(Command::Parse(input)))
+        }
+        "gen-user-facing" => {
+            let mut de = serde_json::Deserializer::from_reader(stdin);
+            let input = GenUserFacingInput::deserialize(&mut de)?;
+            Ok(Some(Command::GenUserFacing(input)))
+        }
+        "compile" => {
+            let mut de = serde_json::Deserializer::from_reader(stdin);
+            let input = CompileInput::deserialize(&mut de)?;
+            Ok(Some(Command::Compile(input)))
+        }
+        "test" => {
+            let mut de = serde_json::Deserializer::from_reader(stdin);
+            let input = TestInput::deserialize(&mut de)?;
+            Ok(Some(Command::Test(input)))
+        }
+        _ => anyhow::bail!("unknown command {:#?}", line),
+    }
+}
+
+#[derive(Deserialize, Debug)]
+struct ParseInput {
+    app_root: PathBuf,
+    platform_id: Option<String>,
+    local_id: String,
+    parse_tests: bool,
+}
+
+#[derive(Deserialize, Debug)]
+struct PrepareInput {
+    app_root: PathBuf,
+    runtime_version: String,
+    #[serde(default)]
+    local_runtime_override: Option<PathBuf>,
+}
+
+#[derive(Deserialize, Debug)]
+struct CompileInput {
+    debug: DebugMode,
+    #[serde(default)]
+    nodejs_runtime: NodeJSRuntime,
+}
+
+#[derive(Deserialize, Debug)]
+struct TestInput {}
+
+#[derive(Deserialize, Debug)]
+struct GenUserFacingInput {}
+
+struct ErrorList {
+    cm: Rc<dyn SourceMapper>,
+    errors: Rc<Mutex<Vec<String>>>,
+}
+
+impl Emitter for ErrorList {
+    fn emit(&mut self, db: &swc_common::errors::DiagnosticBuilder<'_>) {
+        let buf: AtomicBuf = Default::default();
+
+        let mut w = EmitterWriter::new(Box::new(buf.clone()), Some(self.cm.clone()), false, false);
+        w.emit(db);
+
+        let s = buf.to_string();
+        self.errors.lock().unwrap().push(s);
+    }
+}
+
+#[derive(Default, Clone)]
+struct AtomicBuf(Arc<Mutex<Vec<u8>>>);
+
+impl fmt::Display for AtomicBuf {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "{}", String::from_utf8_lossy(&self.0.lock().unwrap()))
+    }
+}
+
+impl Write for AtomicBuf {
+    fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
+        self.0.lock().unwrap().extend_from_slice(buf);
+        Ok(buf.len())
+    }
+
+    fn flush(&mut self) -> io::Result<()> {
+        Ok(())
+    }
+}
diff --git a/tsparser/src/builder/codegen.rs b/tsparser/src/builder/codegen.rs
new file mode 100644
index 0000000000..75c45448d8
--- /dev/null
+++ b/tsparser/src/builder/codegen.rs
@@ -0,0 +1,664 @@
+use std::collections::HashMap;
+use std::fs;
+use std::fs::DirBuilder;
+use std::io::Write;
+use std::path::{Component, Path, PathBuf};
+
+use crate::app::AppDesc;
+use anyhow::Context;
+use clean_path::Clean;
+use itertools::Itertools;
+use serde_json::{json, Value};
+
+use crate::builder::package_mgmt::resolve_package_manager;
+use crate::parser::parser::ParseContext;
+use crate::parser::resourceparser::bind::BindKind::Create;
+use crate::parser::resources::apis::api::Methods;
+use crate::parser::resources::Resource;
+use crate::parser::{FilePath, Range};
+
+use super::prepare::{PackageVersion, PrepareError};
+use super::{App, Builder};
+
+#[derive(Debug)]
+pub struct CodegenParams<'a> {
+    pub app: &'a App,
+    pub pc: &'a ParseContext,
+    pub working_dir: &'a Path,
+    pub desc: &'a AppDesc,
+}
+
+pub struct CodegenResult {
+    /// The path to node_modules.
+    pub node_modules: PathBuf,
+}
+
+impl Builder<'_> {
+    pub fn setup_deps(
+        &self,
+        app_root: &Path,
+        encore_dev_version: &PackageVersion,
+    ) -> Result<(), PrepareError> {
+        let pkg_mgr = resolve_package_manager(app_root)?;
+        pkg_mgr.setup_deps(encore_dev_version)
+    }
+
+    pub fn generate_code(&self, params: &CodegenParams) -> Result<CodegenResult, PrepareError> {
+        // Find the node_modules dir and the relative path back to the app root.
+        let (node_modules, _rel_return_path) = self
+            .find_node_modules_dir(&params.app.root)
+            .ok_or(PrepareError::NodeModulesNotFound)?;
+
+        let files = self.codegen_data(params)?;
+
+        write_gen_encore_dir(&params.app.root, &files)?;
+
+        Ok(CodegenResult { node_modules })
+    }
+
+    fn codegen_data(&self, params: &CodegenParams) -> Result<Vec<CodegenFile>, PrepareError> {
+        let mut files = vec![];
+
+        let mut auth_ctx = Vec::new();
+
+        let get_svc_rel_path = |svc_root: &Path, range: Range, strip_ext: bool| -> String {
+            match range.file(&params.pc.file_set) {
+                FilePath::Real(mut buf) => {
+                    if strip_ext {
+                        buf.set_extension("");
+                    }
+                    let rel = match buf.strip_prefix(svc_root) {
+                        Ok(p) => p,
+                        Err(_) => &buf,
+                    };
+
+                    rel.to_owned()
+                        .as_os_str()
+                        .to_str()
+                        .expect("unicode path")
+                        .to_owned()
+                }
+                FilePath::Custom(str) => str,
+            }
+        };
+
+        // Generate the files for each service.
+        for svc in &params.desc.parse.services {
+            let mut endpoints = Vec::new();
+            let mut gateways = Vec::new();
+            let mut subscriptions = Vec::new();
+            let mut auth_handlers = Vec::new();
+            let mut service = None;
+
+            let svc_rel_path = params.app.rel_path_string(&svc.root)?;
+
+            for b in &svc.binds {
+                match &b.resource {
+                    Resource::APIEndpoint(ep) => {
+                        if ep.static_assets.is_some() {
+                            continue; // Skip static assets.
+                        }
+                        endpoints.push(ep);
+                    }
+                    Resource::Gateway(gw) => {
+                        let bind_name = b
+                            .name
+                            .as_deref()
+                            .context("gateway objects must be assigned to a variable")
+                            .map_err(PrepareError::Internal)?;
+                        gateways.push((gw, bind_name));
+                    }
+                    Resource::PubSubSubscription(sub) => {
+                        subscriptions.push(sub);
+                    }
+                    Resource::AuthHandler(ah) if b.kind == Create => {
+                        auth_handlers.push(ah);
+                    }
+                    Resource::Service(svc) => {
+                        service = Some(svc);
+                    }
+                    _ => {}
+                }
+            }
+
+            // Add the auth handlers to the auth context.
+            for ah in &auth_handlers {
+                // Don't strip the extension here, so we support e.g. "auth.controller.ts" -> "auth.controller.js".
+                let rel_path = get_svc_rel_path(&svc.root, ah.range, false);
+
+                let import_path = Path::new("../../../")
+                    .join(&svc_rel_path)
+                    .join(rel_path)
+                    .with_extension("js");
+                auth_ctx.push(json!({
+                    "name": ah.name,
+                    "import_path": import_path,
+                }));
+            }
+
+            // Service Main
+            {
+                let mut endpoint_ctx = Vec::new();
+                let mut subscription_ctx = Vec::new();
+
+                let service_ctx = service
+                    .map(|service| {
+                        let rel_path = get_svc_rel_path(&svc.root, service.range, true);
+                        let import_path = Path::new("../../../../../")
+                            .join(&svc_rel_path)
+                            .join(rel_path);
+
+                        json!({
+                            "name": service.name,
+                            "import_path": import_path,
+                        })
+                    })
+                    .unwrap_or_else(|| json!({"name": svc.name}));
+
+                for rpc in &endpoints {
+                    let rel_path = get_svc_rel_path(&svc.root, rpc.range, true);
+                    let import_path = Path::new("../../../../../")
+                        .join(&svc_rel_path)
+                        .join(rel_path);
+
+                    let has_params = if rpc.streaming_request || rpc.streaming_response {
+                        rpc.encoding.handshake.is_some()
+                    } else {
+                        !rpc.encoding.default_request_encoding().params.is_empty()
+                    };
+
+                    endpoint_ctx.push(json!({
+                        "name": rpc.name,
+                        "raw": rpc.raw,
+                        "has_params": has_params,
+                        "streaming_request": rpc.streaming_request,
+                        "streaming_response": rpc.streaming_response,
+                        "import_path": import_path,
+                        "service_name": svc.name,
+                        "endpoint_options": json!({
+                            "expose": rpc.expose,
+                            "auth": rpc.require_auth,
+                            "isRaw": rpc.raw,
+                            "isStream": rpc.streaming_request || rpc.streaming_response,
+                            "tags": rpc.tags,
+                        }),
+                    }));
+                }
+
+                for sub in &subscriptions {
+                    let rel_path = get_svc_rel_path(&svc.root, sub.range, true);
+                    let import_path = Path::new("../../../../../")
+                        .join(&svc_rel_path)
+                        .join(rel_path);
+
+                    subscription_ctx.push(json!({
+                        "topic_name": sub.topic.name,
+                        "sub_name": sub.topic.name,
+                        "import_path": import_path,
+                    }));
+                }
+
+                let ctx = &json!({
+                    "name": svc.name,
+                    "endpoints": endpoint_ctx,
+                    "subscriptions": subscription_ctx,
+                    "service": service_ctx,
+                });
+                let main = self.entrypoint_service_main.render(&self.reg, ctx)?;
+
+                files.push(CodegenFile {
+                    path: PathBuf::from("internal")
+                        .join("entrypoints")
+                        .join("services")
+                        .join(&svc.name)
+                        .join("main")
+                        .with_extension("ts"),
+                    contents: main,
+                });
+            }
+
+            // Gateway Main
+            for (gw, bind_name) in &gateways {
+                let name = &gw.name;
+
+                // Compute the import path for the endpoint.
+                let rel_path = get_svc_rel_path(&svc.root, gw.range, true);
+                let import_path = Path::new("../../../../../")
+                    .join(&svc_rel_path)
+                    .join(rel_path);
+
+                let ctx = &json!({
+                    "name": name,
+                    "gateways": [{
+                        "encore_name": gw.name,
+                        "bind_name": bind_name,
+                        "import_path": import_path,
+                    }],
+                });
+                let main = self.entrypoint_gateway_main.render(&self.reg, ctx)?;
+
+                files.push(CodegenFile {
+                    path: PathBuf::from("internal")
+                        .join("entrypoints")
+                        .join("gateways")
+                        .join(name)
+                        .join("main")
+                        .with_extension("ts"),
+                    contents: main,
+                });
+            }
+
+            // Catalog client
+            {
+                let mut endpoint_ctx = Vec::new();
+                let svc_rel_path = params.app.rel_path_string(&svc.root)?;
+                // let node_modules_to_svc = node_modules_to_app_root.join(&svc_rel_path);
+
+                let mut has_streams = false;
+
+                for rpc in &endpoints {
+                    if rpc.streaming_request || rpc.streaming_response {
+                        has_streams = true;
+                    }
+
+                    // Don't strip the extension here, so we support e.g. "site.controller.ts" -> "site.controller.js".
+                    let rel_path = get_svc_rel_path(&svc.root, rpc.range, false);
+
+                    let import_path = Path::new("../../../../")
+                        .join(&svc_rel_path)
+                        .join(rel_path)
+                        .with_extension("js");
+
+                    let has_params = if rpc.streaming_request || rpc.streaming_response {
+                        rpc.encoding.handshake.is_some()
+                    } else {
+                        !rpc.encoding.default_request_encoding().params.is_empty()
+                    };
+
+                    endpoint_ctx.push(json!({
+                        "name": rpc.name,
+                        "raw": rpc.raw,
+                        "has_params": has_params,
+                        "streaming_request": rpc.streaming_request,
+                        "streaming_response": rpc.streaming_response,
+                        "import_path": import_path,
+                        "endpoint_options": json!({
+                            "expose": rpc.expose,
+                            "auth": rpc.require_auth,
+                            "isRaw": rpc.raw,
+                            "isStream": rpc.streaming_request || rpc.streaming_response,
+                            "tags": rpc.tags,
+                        }),
+                    }));
+                }
+
+                let service_ctx = service
+                    .map(|service| {
+                        let rel_path = get_svc_rel_path(&svc.root, service.range, true);
+                        let import_path =
+                            Path::new("../../../../").join(&svc_rel_path).join(rel_path);
+
+                        json!({
+                            "name": service.name,
+                            "import_path": import_path,
+                        })
+                    })
+                    .unwrap_or_else(|| json!({"name": svc.name}));
+
+                let ctx = &json!({
+                    "name": svc.name,
+                    "endpoints": endpoint_ctx,
+                    "has_streams": has_streams,
+                    "service": service_ctx,
+                });
+
+                let service_d_ts = self.catalog_clients_service_d_ts.render(&self.reg, ctx)?;
+                files.push(CodegenFile {
+                    path: PathBuf::from("internal")
+                        .join("clients")
+                        .join(&svc.name)
+                        .join("endpoints")
+                        .with_extension("d.ts"),
+                    contents: service_d_ts,
+                });
+
+                let service_js = self.catalog_clients_service_js.render(&self.reg, ctx)?;
+                files.push(CodegenFile {
+                    path: PathBuf::from("internal")
+                        .join("clients")
+                        .join(&svc.name)
+                        .join("endpoints")
+                        .with_extension("js"),
+                    contents: service_js,
+                });
+
+                let service_testing_js = self
+                    .catalog_clients_service_testing_js
+                    .render(&self.reg, ctx)?;
+                files.push(CodegenFile {
+                    path: PathBuf::from("internal")
+                        .join("clients")
+                        .join(&svc.name)
+                        .join("endpoints_testing")
+                        .with_extension("js"),
+                    contents: service_testing_js,
+                });
+            }
+        }
+
+        // Catalog Auth
+        {
+            let ctx = &json!({
+               "auth_handlers": auth_ctx,
+            });
+
+            let index_d_ts = self.catalog_auth_index_ts.render(&self.reg, ctx)?;
+            files.push(CodegenFile {
+                path: PathBuf::from("auth").join("index").with_extension("ts"),
+                contents: index_d_ts,
+            });
+
+            let auth_ts = self.catalog_auth_auth_ts.render(&self.reg, ctx)?;
+            files.push(CodegenFile {
+                path: PathBuf::from("internal")
+                    .join("auth")
+                    .join("auth")
+                    .with_extension("ts"),
+                contents: auth_ts,
+            });
+        }
+
+        // Combined Main
+        {
+            let mut endpoint_ctx = Vec::new();
+            let mut gateway_ctx = Vec::new();
+            let mut subscription_ctx = Vec::new();
+            let mut services_ctx = HashMap::new();
+
+            for svc in &params.desc.parse.services {
+                let mut endpoints = Vec::new();
+                let mut gateways = Vec::new();
+                let mut subscriptions = Vec::new();
+
+                let svc_rel_path = params.app.rel_path_string(&svc.root)?;
+
+                for b in &svc.binds {
+                    match &b.resource {
+                        Resource::APIEndpoint(ep) => {
+                            if ep.static_assets.is_some() {
+                                continue; // Skip static assets.
+                            }
+                            endpoints.push(ep);
+                        }
+                        Resource::Gateway(gw) => {
+                            let bind_name = b
+                                .name
+                                .as_deref()
+                                .context("gateway objects must be assigned to a variable")
+                                .map_err(PrepareError::Internal)?;
+                            gateways.push((gw, bind_name));
+                        }
+                        Resource::PubSubSubscription(sub) => {
+                            subscriptions.push(sub);
+                        }
+                        Resource::Service(service) => {
+                            let rel_path = get_svc_rel_path(&svc.root, service.range, true);
+                            let import_path =
+                                Path::new("../../../../").join(&svc_rel_path).join(rel_path);
+                            services_ctx.insert(
+                                svc.name.clone(),
+                                json!({
+                                    "name": service.name,
+                                    "import_path": import_path,
+                                }),
+                            );
+                        }
+                        _ => {}
+                    }
+                }
+
+                // Service Main
+                for rpc in &endpoints {
+                    if !services_ctx.contains_key(&svc.name) {
+                        services_ctx.insert(svc.name.clone(), json!({"name": svc.name}));
+                    }
+
+                    let rel_path = get_svc_rel_path(&svc.root, rpc.range, true);
+                    let import_path = Path::new("../../../../").join(&svc_rel_path).join(rel_path);
+
+                    let has_params = if rpc.streaming_request || rpc.streaming_response {
+                        rpc.encoding.handshake.is_some()
+                    } else {
+                        !rpc.encoding.default_request_encoding().params.is_empty()
+                    };
+
+                    endpoint_ctx.push(json!({
+                        "name": rpc.name,
+                        "raw": rpc.raw,
+                        "has_params": has_params,
+                        "streaming_request": rpc.streaming_request,
+                        "streaming_response": rpc.streaming_response,
+                        "service_name": svc.name,
+                        "import_path": import_path,
+                        "endpoint_options": json!({
+                            "expose": rpc.expose,
+                            "auth": rpc.require_auth,
+                            "isRaw": rpc.raw,
+                            "isStream": rpc.streaming_request || rpc.streaming_response,
+                            "tags": rpc.tags,
+                        }),
+                    }));
+                }
+
+                // Gateway Main
+                for (gw, bind_name) in &gateways {
+                    let _name = &gw.name;
+                    let rel_path = get_svc_rel_path(&svc.root, gw.range, true);
+                    let import_path = Path::new("../../../../").join(&svc_rel_path).join(rel_path);
+
+                    gateway_ctx.push(json!({
+                        "encore_name": gw.name,
+                        "bind_name": bind_name,
+                        "import_path": import_path,
+                    }));
+                }
+
+                // Subscriptions
+                for sub in &subscriptions {
+                    let rel_path = get_svc_rel_path(&svc.root, sub.range, true);
+                    let import_path = Path::new("../../../../").join(&svc_rel_path).join(rel_path);
+
+                    subscription_ctx.push(json!({
+                        "topic_name": sub.topic.name,
+                        "sub_name": sub.topic.name,
+                        "import_path": import_path,
+                    }));
+                }
+            }
+
+            let ctx = &json!({
+                "endpoints": endpoint_ctx,
+                "gateways": gateway_ctx,
+                "subscriptions": subscription_ctx,
+                "services": services_ctx,
+            });
+            let main = self.entrypoint_combined_main.render(&self.reg, ctx)?;
+
+            files.push(CodegenFile {
+                path: PathBuf::from("internal")
+                    .join("entrypoints")
+                    .join("combined")
+                    .join("main")
+                    .with_extension("ts"),
+                contents: main,
+            });
+        }
+
+        // Catalog Index
+        {
+            let mut services_ctx = Vec::new();
+            for svc in &params.desc.parse.services {
+                services_ctx.push(json!({
+                    "name": svc.name,
+                }));
+            }
+
+            let ctx = &json!({
+                "services": services_ctx,
+            });
+
+            let index_js = self.catalog_clients_index_js.render(&self.reg, ctx)?;
+            files.push(CodegenFile {
+                path: PathBuf::from("clients").join("index").with_extension("js"),
+                contents: index_js,
+            });
+
+            let index_d_ts = self.catalog_clients_index_d_ts.render(&self.reg, ctx)?;
+            files.push(CodegenFile {
+                path: PathBuf::from("clients")
+                    .join("index")
+                    .with_extension("d.ts"),
+                contents: index_d_ts,
+            });
+        }
+
+        let mut duplicates = files.iter().duplicates_by(|f| f.path.clone());
+        if let Some(dup) = duplicates.next() {
+            return Err(PrepareError::Internal(anyhow::anyhow!(
+                "duplicate file path: {:?}",
+                dup.path
+            )));
+        }
+
+        Ok(files)
+    }
+
+    /// Find the node_modules_dir in parent directories of base,
+    /// and at the same time compute the relative path from it to get
+    /// back to base.
+    pub fn find_node_modules_dir(&self, base: &Path) -> Option<(PathBuf, PathBuf)> {
+        let pred = |p: &Path| p.join("node_modules").exists();
+        let (ancestor, return_path) = find_ancestor(base, pred)?;
+
+        let node_modules_dir = ancestor.join("node_modules").clean();
+
+        // Prepend "../" to the return path since we're appending "node_modules" above.
+        let return_path = Path::new("..").join(return_path).clean();
+        Some((node_modules_dir, return_path))
+    }
+}
+
+fn _http_methods(methods: &Methods) -> Value {
+    match methods {
+        Methods::All => json!("*"),
+        Methods::Some(methods) => {
+            let strs = methods.iter().map(|m| m.as_str()).collect::<Vec<_>>();
+            json!(strs)
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct CodegenFile {
+    pub path: PathBuf,
+    // relative to the node_modules/.encoredev folder
+    pub contents: String,
+}
+
+fn write_gen_encore_dir(app_root: &Path, files: &[CodegenFile]) -> Result<(), PrepareError> {
+    let base_dir = app_root.join("encore.gen");
+    for f in files {
+        if f.path.is_absolute() {
+            return Err(PrepareError::Internal(anyhow::anyhow!(
+                "path {:?} is not relative to the encore.gen folder",
+                f.path
+            )));
+        }
+
+        let file_path = base_dir.join(&f.path);
+        // Create the parent of the file, if needed
+        if let Some(parent) = file_path.parent() {
+            DirBuilder::new()
+                .recursive(true)
+                .create(parent)
+                .map_err(PrepareError::GenerateCode)?;
+        }
+
+        let file = fs::File::create(file_path).map_err(PrepareError::GenerateCode)?;
+        let mut buf = std::io::BufWriter::new(file);
+        buf.write_all(f.contents.as_bytes())
+            .map_err(PrepareError::GenerateCode)?;
+        buf.flush().map_err(PrepareError::GenerateCode)?;
+    }
+
+    Ok(())
+}
+
+/// Finds the first ancestor of base that satisfies predicate.
+/// It returns the path to the ancestor (in the form "../../.." etc),
+/// as well as the return path back to the base directory.
+/// If predicate(base) is true, it reports (".", ".").
+fn find_ancestor(base: &Path, predicate: fn(&Path) -> bool) -> Option<(PathBuf, PathBuf)> {
+    let mut comps = base.components();
+    let mut return_path = Vec::new();
+
+    // Algorithm sketch as follows.
+    // 1. Check if the predicate is satisfied on the current path. If true, return.
+    // 2. Otherwise, remove the last component of the path, and add it to the return path.
+    // 3. Add the component to the return path, and go to step 1.
+    loop {
+        let curr = comps.as_path();
+        if predicate(curr) {
+            // Compute the return path. If it's empty return ".".
+            let return_path = if !return_path.is_empty() {
+                // The components of the return path have been inserted in backwards order,
+                // so reverse it now.
+                return_path.iter().rev().collect::<PathBuf>()
+            } else {
+                PathBuf::from(".")
+            };
+            return Some((curr.to_path_buf(), return_path));
+        }
+
+        let comp = comps.next_back()?;
+
+        match comp {
+            Component::Normal(_) | Component::ParentDir => {
+                return_path.push(comp);
+            }
+
+            // "." doesn't affect the predicate or the return path, so ignore it.
+            Component::CurDir => {}
+
+            // We've reached the beginning of the path and haven't found a match;
+            // we're done.
+            Component::Prefix(_) | Component::RootDir => return None,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_find_ancestor() {
+        {
+            let pred = |p: &Path| p.ends_with("true");
+            let base = Path::new("/foo/true/bar/baz");
+
+            let (ancestor, return_path) = find_ancestor(base, pred).unwrap();
+            assert_eq!(ancestor, Path::new("/foo/true"));
+            assert_eq!(return_path, Path::new("bar/baz"));
+        }
+
+        {
+            let pred = |_p: &Path| true;
+            let base = Path::new("/foo/bar/baz");
+
+            let (ancestor, return_path) = find_ancestor(base, pred).unwrap();
+            assert_eq!(ancestor, Path::new("/foo/bar/baz"));
+            assert_eq!(return_path, Path::new("."));
+        }
+    }
+}
diff --git a/tsparser/src/builder/compile.rs b/tsparser/src/builder/compile.rs
new file mode 100644
index 0000000000..5509b7c99e
--- /dev/null
+++ b/tsparser/src/builder/compile.rs
@@ -0,0 +1,126 @@
+use std::fs;
+use std::path::{Path, PathBuf};
+
+use crate::app::AppDesc;
+use anyhow::{Context, Result};
+use serde::Serialize;
+
+use crate::builder::codegen::CodegenParams;
+use crate::builder::transpiler::{
+    EsbuildCompiler, ExternalPackages, Input, InputKind, OutputTranspiler, TranspileParams,
+};
+use crate::parser::parser::ParseContext;
+
+use super::{App, Builder, DebugMode, NodeJSRuntime};
+
+#[derive(Debug)]
+pub struct CompileParams<'a> {
+    pub app: &'a App,
+    pub pc: &'a ParseContext,
+    pub working_dir: &'a Path,
+    pub desc: &'a AppDesc,
+    pub debug: DebugMode,
+    pub nodejs_runtime: NodeJSRuntime,
+}
+
+#[derive(Serialize, Debug)]
+pub struct CompileResult {
+    pub outputs: Vec<JSBuildOutput>,
+}
+
+#[derive(Serialize, Debug)]
+pub struct JSBuildOutput {
+    pub artifact_dir: PathBuf,
+    pub entrypoints: Vec<Entrypoint>,
+}
+
+#[derive(Serialize, Debug)]
+pub struct Entrypoint {
+    pub cmd: CmdSpec,
+    pub services: Vec<String>,
+    pub gateways: Vec<String>,
+    pub use_runtime_config_v2: bool,
+}
+
+pub type ArtifactString = String;
+
+#[derive(Serialize, Debug)]
+pub struct CmdSpec {
+    pub command: Vec<ArtifactString>,
+    pub env: Vec<ArtifactString>,
+    pub prioritized_files: Vec<ArtifactString>,
+}
+
+impl Builder<'_> {
+    pub fn compile(&self, params: &CompileParams) -> Result<CompileResult> {
+        self.generate_code(&CodegenParams {
+            app: params.app,
+            pc: params.pc,
+            working_dir: params.working_dir,
+            desc: params.desc,
+        })
+        .context("generate code")?;
+
+        let build_dir = params.app.root.join(".encore").join("build");
+        fs::create_dir_all(&build_dir)?;
+
+        let (node_modules, _) = self
+            .find_node_modules_dir(params.app.root.as_path())
+            .ok_or_else(|| anyhow::anyhow!("could not find node_modules directory"))?;
+
+        let transpiler = EsbuildCompiler {
+            node_modules_dir: node_modules.as_path(),
+            external: ExternalPackages::All,
+        };
+
+        let inputs = {
+            let mut inputs = Vec::with_capacity(
+                params.desc.parse.services.len() + params.desc.meta.gateways.len(),
+            );
+
+            let service_names = params
+                .desc
+                .parse
+                .services
+                .iter()
+                .map(|s| s.name.clone())
+                .collect();
+            let gateway_names = params
+                .desc
+                .meta
+                .gateways
+                .iter()
+                .map(|g| g.encore_name.clone())
+                .collect();
+
+            inputs.push(Input {
+                kind: InputKind::Combined(gateway_names, service_names),
+                entrypoint: params
+                    .app
+                    .root
+                    .join("encore.gen")
+                    .join("internal")
+                    .join("entrypoints")
+                    .join("combined")
+                    .join("main.ts"),
+            });
+
+            inputs
+        };
+
+        let result = transpiler.transpile(TranspileParams {
+            artifact_dir: build_dir.as_path(),
+            cwd: params.app.root.as_path(),
+            debug: params.debug,
+            nodejs_runtime: params.nodejs_runtime,
+            inputs,
+        })?;
+
+        Ok(CompileResult {
+            outputs: vec![JSBuildOutput {
+                artifact_dir: build_dir,
+                entrypoints: result.entrypoints,
+            }],
+        })
+    }
+}
diff --git a/tsparser/src/builder/mod.rs b/tsparser/src/builder/mod.rs
new file mode 100644
index 0000000000..6678003d28
--- /dev/null
+++ b/tsparser/src/builder/mod.rs
@@ -0,0 +1,226 @@
+use std::path::{Path, PathBuf};
+
+use convert_case::{Case, Casing};
+use handlebars::*;
+use prepare::PrepareError;
+use serde::{Deserialize, Serialize};
+
+pub use codegen::{CodegenParams, CodegenResult};
+pub use compile::CompileParams;
+pub use parse::{ParseError, ParseParams};
+pub use prepare::{PackageVersion, PrepareParams};
+pub use test::TestParams;
+
+mod codegen;
+mod compile;
+mod package_mgmt;
+mod parse;
+mod prepare;
+mod test;
+mod transpiler;
+
+pub struct Builder<'a> {
+    reg: Handlebars<'a>,
+    entrypoint_service_main: Template<'a>,
+    entrypoint_gateway_main: Template<'a>,
+    entrypoint_combined_main: Template<'a>,
+
+    catalog_clients_index_js: Template<'a>,
+    catalog_clients_index_d_ts: Template<'a>,
+    catalog_clients_service_js: Template<'a>,
+    catalog_clients_service_testing_js: Template<'a>,
+    catalog_clients_service_d_ts: Template<'a>,
+    catalog_auth_index_ts: Template<'a>,
+    catalog_auth_auth_ts: Template<'a>,
+}
+
+impl Builder<'_> {
+    pub fn new() -> Result<Self, PrepareError> {
+        let mut reg = Handlebars::new();
+        reg.register_helper("toJSON", Box::new(to_json));
+        reg.register_helper("stripExt", Box::new(strip_ext));
+        reg.register_helper("toPascalCase", Box::new(to_pascal_case));
+        reg.register_helper("encoreNameToIdent", Box::new(encore_name_to_ident));
+        let entrypoint_service_main =
+            Template::new(&mut reg, "service_main", ENTRYPOINT_SERVICE_MAIN)
+                .map_err(|e| PrepareError::Internal(e.into()))?;
+        let entrypoint_gateway_main =
+            Template::new(&mut reg, "gateway_main", ENTRYPOINT_GATEWAY_MAIN)
+                .map_err(|e| PrepareError::Internal(e.into()))?;
+        let entrypoint_combined_main =
+            Template::new(&mut reg, "combined_main", ENTRYPOINT_COMBINED_MAIN)
+                .map_err(|e| PrepareError::Internal(e.into()))?;
+        let catalog_clients_index_js = Template::new(
+            &mut reg,
+            "catalog_clients_index_js",
+            CATALOG_CLIENTS_INDEX_JS,
+        )
+        .map_err(|e| PrepareError::Internal(e.into()))?;
+        let catalog_clients_index_d_ts = Template::new(
+            &mut reg,
+            "catalog_clients_index_d_ts",
+            CATALOG_CLIENTS_INDEX_D_TS,
+        )
+        .map_err(|e| PrepareError::Internal(e.into()))?;
+        let catalog_clients_service_js = Template::new(
+            &mut reg,
+            "catalog_clients_service_js",
+            CATALOG_CLIENTS_SERVICE_JS,
+        )
+        .map_err(|e| PrepareError::Internal(e.into()))?;
+        let catalog_clients_service_testing_js = Template::new(
+            &mut reg,
+            "catalog_clients_service_test_js",
+            CATALOG_CLIENTS_SERVICE_TESTING_JS,
+        )
+        .map_err(|e| PrepareError::Internal(e.into()))?;
+        let catalog_clients_service_d_ts = Template::new(
+            &mut reg,
+            "catalog_clients_service_d_ts",
+            CATALOG_CLIENTS_SERVICE_D_TS,
+        )
+        .map_err(|e| PrepareError::Internal(e.into()))?;
+        let catalog_auth_index_ts =
+            Template::new(&mut reg, "catalog_auth_index_ts", CATALOG_AUTH_INDEX_TS)
+                .map_err(|e| PrepareError::Internal(e.into()))?;
+        let catalog_auth_auth_ts =
+            Template::new(&mut reg, "catalog_auth_auth_ts", CATALOG_AUTH_AUTH_TS)
+                .map_err(|e| PrepareError::Internal(e.into()))?;
+
+        Ok(Self {
+            reg,
+            entrypoint_service_main,
+            entrypoint_gateway_main,
+            entrypoint_combined_main,
+            catalog_clients_index_js,
+            catalog_clients_index_d_ts,
+            catalog_clients_service_js,
+            catalog_clients_service_testing_js,
+            catalog_clients_service_d_ts,
+            catalog_auth_index_ts,
+            catalog_auth_auth_ts,
+        })
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct App {
+    pub root: PathBuf,
+    pub platform_id: Option<String>,
+    pub local_id: String,
+}
+
+impl App {
+    /// Compute the relative path from the app root.
+    /// It reports an error if the path is not under the app root.
+    fn rel_path<'b>(&self, path: &'b Path) -> Result<&'b Path, PrepareError> {
+        let suffix = path.strip_prefix(&self.root).map_err(|err| {
+            PrepareError::Internal(anyhow::anyhow!(
+                "unable to compute relative path to app root from {path:?}: {err}"
+            ))
+        })?;
+
+        Ok(suffix)
+    }
+
+    /// Compute the relative path from the app root as a String.
+    fn rel_path_string(&self, path: &Path) -> Result<String, PrepareError> {
+        let suffix = self.rel_path(path)?;
+        let s = suffix
+            .to_str()
+            .ok_or(PrepareError::Internal(anyhow::anyhow!(
+                "invalid path: {:?}",
+                path
+            )))?;
+        Ok(s.to_string())
+    }
+}
+
+struct Template<'a> {
+    name: &'a str,
+}
+
+impl<'a> Template<'a> {
+    fn new(reg: &mut Handlebars, name: &'a str, template_str: &str) -> Result<Self, PrepareError> {
+        reg.register_template_string(name, template_str)
+            .map_err(|e| PrepareError::Internal(e.into()))?;
+
+        Ok(Self { name })
+    }
+
+    fn render(&self, reg: &Handlebars, data: &impl Serialize) -> Result<String, PrepareError> {
+        reg.render(self.name, data)
+            .map_err(|e| PrepareError::Internal(e.into()))
+    }
+}
+
+const ENTRYPOINT_SERVICE_MAIN: &str =
+    include_str!("templates/entrypoints/services/main.handlebars");
+const ENTRYPOINT_GATEWAY_MAIN: &str =
+    include_str!("templates/entrypoints/gateways/main.handlebars");
+const ENTRYPOINT_COMBINED_MAIN: &str =
+    include_str!("templates/entrypoints/combined/main.handlebars");
+
+const CATALOG_CLIENTS_INDEX_JS: &str =
+    include_str!("templates/catalog/clients/index_js.handlebars");
+const CATALOG_CLIENTS_INDEX_D_TS: &str =
+    include_str!("templates/catalog/clients/index_d_ts.handlebars");
+const CATALOG_CLIENTS_SERVICE_JS: &str =
+    include_str!("templates/catalog/clients/endpoints_js.handlebars");
+const CATALOG_CLIENTS_SERVICE_TESTING_JS: &str =
+    include_str!("templates/catalog/clients/endpoints_testing_js.handlebars");
+const CATALOG_CLIENTS_SERVICE_D_TS: &str =
+    include_str!("templates/catalog/clients/endpoints_d_ts.handlebars");
+const CATALOG_AUTH_INDEX_TS: &str = include_str!("templates/catalog/auth/index_ts.handlebars");
+const CATALOG_AUTH_AUTH_TS: &str = include_str!("templates/catalog/auth/auth_ts.handlebars");
+
+handlebars_helper!(strip_ext: |v: String| v.rsplit_once('.').map(|(a, _)| a.to_string()).unwrap_or(v));
+handlebars_helper!(to_pascal_case: |v: String| v.to_case(Case::Pascal));
+handlebars_helper!(encore_name_to_ident: |v: String| v.replace('-', "_"));
+
+fn to_json(
+    h: &Helper<'_, '_>,
+    _: &Handlebars<'_>,
+    _: &Context,
+    _rc: &mut RenderContext<'_, '_>,
+    out: &mut dyn Output,
+) -> HelperResult {
+    // get parameter from helper or throw an error
+    let param = h
+        .param(0)
+        .map(|v| serde_json::to_string(v.value()).unwrap())
+        .unwrap_or_default();
+    out.write(param.as_ref())?;
+    Ok(())
+}
+
+/// An error that is rendered plainly, without a backtrace.
+#[derive(Debug)]
+pub struct PlainError(pub String);
+
+impl std::fmt::Display for PlainError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.0)
+    }
+}
+
+#[derive(Deserialize, Debug, Copy, Clone)]
+#[serde(rename_all = "lowercase")]
+pub enum DebugMode {
+    Disabled,
+    Enabled,
+    Break,
+}
+
+#[derive(Deserialize, Debug, Copy, Clone)]
+#[serde(rename_all = "lowercase")]
+pub enum NodeJSRuntime {
+    NodeJS,
+    Bun,
+}
+
+impl Default for NodeJSRuntime {
+    fn default() -> Self {
+        Self::NodeJS
+    }
+}
diff --git a/tsparser/src/builder/package_mgmt.rs b/tsparser/src/builder/package_mgmt.rs
new file mode 100644
index 0000000000..730fd073c0
--- /dev/null
+++ b/tsparser/src/builder/package_mgmt.rs
@@ -0,0 +1,465 @@
+use std::collections::HashMap;
+use std::io;
+use std::path::{Path, PathBuf};
+use std::str::FromStr;
+
+use duct::cmd;
+use serde::Deserialize;
+
+use crate::builder::compile::CmdSpec;
+
+use super::prepare::{PackageVersion, PrepareError};
+
+#[derive(Debug, Clone)]
+pub enum InstalledVersion {
+    /// The package is not installed.
+    NotInstalled,
+    /// The package is installed but older than the required version.
+    Older(String),
+    /// The package is installed but different than the required version,
+    /// in a way that cannot be compared (i.e. not semver but "local development" version).
+    Different(String),
+    /// The package is equal to the required version.
+    Current,
+    /// The package is newer than the required version.
+    Newer(String),
+}
+
+impl PackageVersion {
+    /// Reports whether the package is installed and if it is, whether it's the correct version.
+    /// The `package_path` is needed to resolve local paths when running in development mode,
+    /// since `npm install /path/to/package.json` rewrites it to a path relative from the package.json directory.
+    pub fn is_installed(&self, ver: &str, package_path: &Path) -> InstalledVersion {
+        use InstalledVersion::*;
+        match self {
+            Self::Local(want) => {
+                if let Some(path) = ver.strip_prefix("file:") {
+                    let got = PathBuf::from(path);
+
+                    // Check for exact match or cleaned match.
+                    if got == *want || clean_path::clean(&got) == clean_path::clean(want) {
+                        return Current;
+                    } else if got.is_relative() {
+                        // Check if the paths are equal after resolving relative to the package.json directory.
+                        let abs = package_path.join(&got);
+                        if abs == *want || clean_path::clean(abs) == clean_path::clean(want) {
+                            return Current;
+                        }
+                    }
+                }
+
+                Different(ver.to_string())
+            }
+
+            Self::Published(want) => {
+                let got = ver.trim_start_matches(['^', '=', '~']);
+
+                // Check if the version is an exact match.
+                if got == want {
+                    return Current;
+                }
+
+                // Parse the version and check if it's equal or greater, semver-wise.
+                let installed = semver::Version::parse(got).ok();
+                let want = semver::Version::parse(want).ok();
+                if let (Some(installed), Some(want)) = (installed, want) {
+                    use std::cmp::Ordering;
+                    match installed.cmp(&want) {
+                        Ordering::Less => Older(got.to_string()),
+                        Ordering::Equal => Current,
+                        Ordering::Greater => Newer(got.to_string()),
+                    }
+                } else {
+                    Different(got.to_string())
+                }
+            }
+        }
+    }
+}
+
+fn find_workspace_package_manager(mut dir: PathBuf) -> Result<Option<String>, PrepareError> {
+    while dir.pop() {
+        let package_json_path = dir.join("package.json");
+        if package_json_path.exists() {
+            let package_json = PackageJson::parse_file(&package_json_path)?;
+            if let Some(pm) = package_json.package_manager.as_deref() {
+                if !pm.is_empty() {
+                    return Ok(package_json.package_manager);
+                }
+            }
+        }
+    }
+
+    Ok(None)
+}
+
+pub(super) fn resolve_package_manager(
+    package_dir: &Path,
+) -> Result<Box<dyn PackageManager>, PrepareError> {
+    let package_json_path = package_dir.join("package.json");
+    let package_json = PackageJson::parse_file(&package_json_path)?;
+
+    let package_manager = match package_json.package_manager {
+        Some(ref pm) if !pm.is_empty() => Some(pm.clone()),
+        _ => find_workspace_package_manager(package_dir.to_path_buf())?,
+    };
+
+    let package_manager = package_manager.as_deref().unwrap_or("npm");
+    let package_manager = match package_manager.split_once('@') {
+        Some((name, _)) => name,
+        None => package_manager,
+    };
+
+    match package_manager.to_lowercase().as_ref() {
+        "npm" => Ok(Box::new(NpmPackageManager {
+            pkg_json: package_json,
+            dir: package_dir.to_path_buf(),
+        })),
+        "bun" => Ok(Box::new(BunPackageManager {
+            pkg_json: package_json,
+            dir: package_dir.to_path_buf(),
+        })),
+        "yarn" => Ok(Box::new(YarnPackageManager {
+            pkg_json: package_json,
+            dir: package_dir.to_path_buf(),
+        })),
+        "pnpm" => Ok(Box::new(PnpmPackageManager {
+            pkg_json: package_json,
+            dir: package_dir.to_path_buf(),
+        })),
+        _ => Err(PrepareError::UnsupportedPackageManagerError(
+            package_manager.to_string(),
+        )),
+    }
+}
+
+pub(super) trait PackageManager {
+    fn setup_deps(&self, encore_dev_version: &PackageVersion) -> Result<(), PrepareError>;
+
+    fn run_tests(&self) -> CmdSpec;
+
+    #[allow(dead_code)]
+    fn mgr_name(&self) -> &'static str;
+}
+
+struct NpmPackageManager {
+    pkg_json: PackageJson,
+    dir: PathBuf,
+}
+
+impl PackageManager for NpmPackageManager {
+    fn setup_deps(&self, encore_dev_version: &PackageVersion) -> Result<(), PrepareError> {
+        // Install `encore.dev` if necessary
+        let installed = self.pkg_json.dependencies.get("encore.dev");
+        let v = installed.map_or(InstalledVersion::NotInstalled, |v| {
+            encore_dev_version.is_installed(v, &self.dir)
+        });
+
+        // First ensure the package.json file is up to date.
+        let modified = update_package_json(&self.dir, v, encore_dev_version)?;
+
+        // If we modified anything or don't have a node_modules directory, run 'npm install'.
+        if modified || !self.dir.join("node_modules").exists() {
+            cmd!("npm", "install")
+                .dir(&self.dir)
+                .stdout_to_stderr()
+                .run()
+                .map_err(|e| PrepareError::InstallNodeModules(e, "npm install".into()))?;
+        }
+
+        Ok(())
+    }
+
+    fn run_tests(&self) -> CmdSpec {
+        CmdSpec {
+            command: vec![
+                "npm".to_string(),
+                "run".to_string(),
+                "test".to_string(),
+                // Specify '--' so that additional arguments added from the test runner
+                // aren't interpreted by npm.
+                "--".to_string(),
+            ],
+            env: vec![],
+            prioritized_files: vec![],
+        }
+    }
+
+    fn mgr_name(&self) -> &'static str {
+        "npm"
+    }
+}
+
+struct BunPackageManager {
+    pkg_json: PackageJson,
+    dir: PathBuf,
+}
+
+impl PackageManager for BunPackageManager {
+    fn setup_deps(&self, encore_dev_version: &PackageVersion) -> Result<(), PrepareError> {
+        // Install `encore.dev` if necessary
+        let installed = self.pkg_json.dependencies.get("encore.dev");
+        let v = installed.map_or(InstalledVersion::NotInstalled, |v| {
+            encore_dev_version.is_installed(v, &self.dir)
+        });
+
+        // First ensure the package.json file is up to date.
+        let modified = update_package_json(&self.dir, v, encore_dev_version)?;
+
+        // If we modified anything or don't have a node_modules directory, run 'bun install'.
+        if modified || !self.dir.join("node_modules").exists() {
+            let backend = std::env::var("BUN_INSTALL_BACKEND").unwrap_or_default();
+            if backend.is_empty() {
+                cmd!("bun", "install")
+                    .dir(&self.dir)
+                    .stdout_to_stderr()
+                    .run()
+                    .map_err(|e| PrepareError::InstallNodeModules(e, "bun install".into()))?;
+            } else {
+                cmd!("bun", "install", "--backend", &backend)
+                    .dir(&self.dir)
+                    .stdout_to_stderr()
+                    .run()
+                    .map_err(|e| {
+                        PrepareError::InstallNodeModules(
+                            e,
+                            format!("bun install --backend {backend}"),
+                        )
+                    })?;
+            }
+        }
+
+        Ok(())
+    }
+
+    fn run_tests(&self) -> CmdSpec {
+        CmdSpec {
+            command: vec![
+                "bun".to_string(),
+                "run".to_string(),
+                "test".to_string(),
+                // Specify '--' so that additional arguments added from the test runner
+                // aren't interpreted by bun.
+                "--".to_string(),
+            ],
+            env: vec![],
+            prioritized_files: vec![],
+        }
+    }
+
+    fn mgr_name(&self) -> &'static str {
+        "bun"
+    }
+}
+
+struct YarnPackageManager {
+    pkg_json: PackageJson,
+    dir: PathBuf,
+}
+
+impl PackageManager for YarnPackageManager {
+    fn setup_deps(&self, encore_dev_version: &PackageVersion) -> Result<(), PrepareError> {
+        self.ensure_nodelinker()?;
+
+        // Install `encore.dev` if necessary
+        let installed = self.pkg_json.dependencies.get("encore.dev");
+        let v = installed.map_or(InstalledVersion::NotInstalled, |v| {
+            encore_dev_version.is_installed(v, &self.dir)
+        });
+
+        // First ensure the package.json file is up to date.
+        let modified = update_package_json(&self.dir, v, encore_dev_version)?;
+
+        // If we modified anything or don't have a node_modules directory, run 'npm install'.
+        if modified || !self.dir.join("node_modules").exists() {
+            cmd!("yarn", "install")
+                .dir(&self.dir)
+                .stdout_to_stderr()
+                .run()
+                .map_err(|e| PrepareError::InstallNodeModules(e, "yarn install".into()))?;
+        }
+
+        Ok(())
+    }
+
+    fn run_tests(&self) -> CmdSpec {
+        CmdSpec {
+            command: vec!["yarn".to_string(), "run".to_string(), "test".to_string()],
+            env: vec![],
+            prioritized_files: vec![],
+        }
+    }
+
+    fn mgr_name(&self) -> &'static str {
+        "yarn"
+    }
+}
+
+impl YarnPackageManager {
+    /// Ensures the .yarnrc.yml file exists in the app root and has the nodeLinker set to "node-modules".
+    fn ensure_nodelinker(&self) -> Result<(), PrepareError> {
+        let file_path = self.dir.join(".yarnrc.yml");
+        if !file_path.exists() {
+            // Create the file with our desired contents.
+            let content = "nodeLinker: node-modules\n";
+            std::fs::write(&file_path, content).map_err(PrepareError::SetupYarnNodeLinker)?;
+            return Ok(());
+        }
+
+        // Read the file as yaml.
+        let contents =
+            std::fs::read_to_string(&file_path).map_err(PrepareError::SetupYarnNodeLinker)?;
+        let mut map = serde_yaml::from_str::<serde_yaml::Mapping>(&contents).map_err(|err| {
+            PrepareError::SetupYarnNodeLinker(io::Error::new(io::ErrorKind::InvalidData, err))
+        })?;
+
+        // Modify the map and write it back out.
+        map.insert(
+            serde_yaml::Value::String("nodeLinker".into()),
+            serde_yaml::Value::String("node-modules".into()),
+        );
+        let contents = serde_yaml::to_string(&map).map_err(|err| {
+            PrepareError::SetupYarnNodeLinker(io::Error::new(io::ErrorKind::InvalidData, err))
+        })?;
+        std::fs::write(&file_path, contents).map_err(PrepareError::SetupYarnNodeLinker)?;
+
+        Ok(())
+    }
+}
+
+struct PnpmPackageManager {
+    pkg_json: PackageJson,
+    dir: PathBuf,
+}
+
+impl PackageManager for PnpmPackageManager {
+    fn setup_deps(&self, encore_dev_version: &PackageVersion) -> Result<(), PrepareError> {
+        // Install `encore.dev` if necessary
+        let installed = self.pkg_json.dependencies.get("encore.dev");
+        let v = installed.map_or(InstalledVersion::NotInstalled, |v| {
+            encore_dev_version.is_installed(v, &self.dir)
+        });
+
+        // First ensure the package.json file is up to date.
+        let modified = update_package_json(&self.dir, v, encore_dev_version)?;
+
+        // If we modified anything or don't have a node_modules directory, run 'npm install'.
+        if modified || !self.dir.join("node_modules").exists() {
+            cmd!("pnpm", "install")
+                .dir(&self.dir)
+                .stdout_to_stderr()
+                .run()
+                .map_err(|e| PrepareError::InstallNodeModules(e, "pnpm install".into()))?;
+        }
+        Ok(())
+    }
+
+    fn run_tests(&self) -> CmdSpec {
+        CmdSpec {
+            command: vec![
+                "pnpm".to_string(),
+                "run".to_string(),
+                "test".to_string(),
+                // Specify '--' so that additional arguments added from the test runner
+                // aren't interpreted by npm.
+                "--".to_string(),
+            ],
+            env: vec![],
+            prioritized_files: vec![],
+        }
+    }
+
+    fn mgr_name(&self) -> &'static str {
+        "pnpm"
+    }
+}
+
+/// Updates the package.json file in the given directory to include the specified version of encore.dev.
+/// Returns whether the package.json file was modified.
+fn update_package_json(
+    dir: &Path,
+    v: InstalledVersion,
+    encore_dev_version: &PackageVersion,
+) -> Result<bool, PrepareError> {
+    let path = dir.join("package.json");
+    match v {
+        InstalledVersion::Newer(v) => Err(PrepareError::EncoreDevTooNew(v)),
+
+        InstalledVersion::Current => Ok(false),
+
+        InstalledVersion::Older(_)
+        | InstalledVersion::Different(_)
+        | InstalledVersion::NotInstalled => {
+            let ver = match encore_dev_version {
+                PackageVersion::Local(buf) => format!("file:{}", buf.to_string_lossy()),
+                PackageVersion::Published(ver) => format!("^{ver}"),
+            };
+
+            // Update package.json.
+            {
+                let data = std::fs::read_to_string(&path).map_err(PrepareError::ReadPackageJson)?;
+                let mut data: serde_json::Map<String, serde_json::Value> =
+                    serde_json::from_str(&data).map_err(|source| {
+                        PrepareError::InvalidPackageJson {
+                            source,
+                            path: path.clone(),
+                        }
+                    })?;
+
+                // Update the "encore.dev" key in the "dependencies" map.
+                {
+                    let Some(deps) = data
+                        .entry("dependencies")
+                        .or_insert_with(|| serde_json::Value::Object(serde_json::Map::new()))
+                        .as_object_mut()
+                    else {
+                        return Err(PrepareError::ReadPackageJson(io::Error::new(
+                            io::ErrorKind::InvalidData,
+                            "dependencies field is not an object",
+                        )));
+                    };
+                    deps.insert("encore.dev".to_string(), ver.into());
+                }
+
+                // Write it back out.
+                let data = serde_json::to_string_pretty(&data).map_err(|source| {
+                    PrepareError::InvalidPackageJson {
+                        source,
+                        path: path.clone(),
+                    }
+                })?;
+                std::fs::write(&path, &data).map_err(PrepareError::WritePackageJson)?;
+            }
+
+            Ok(true)
+        }
+    }
+}
+
+#[derive(Deserialize)]
+struct PackageJson {
+    #[serde(default, rename = "packageManager")]
+    package_manager: Option<String>,
+
+    #[serde(default)]
+    dependencies: HashMap<String, String>,
+}
+
+impl FromStr for PackageJson {
+    type Err = serde_json::Error;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        serde_json::from_str(s)
+    }
+}
+
+impl PackageJson {
+    pub fn parse_file(path: &Path) -> Result<Self, PrepareError> {
+        let data = std::fs::read_to_string(path).map_err(PrepareError::ReadPackageJson)?;
+        data.parse()
+            .map_err(|source| PrepareError::InvalidPackageJson {
+                source,
+                path: path.to_path_buf(),
+            })
+    }
+}
diff --git a/tsparser/src/builder/parse.rs b/tsparser/src/builder/parse.rs
new file mode 100644
index 0000000000..e65296d218
--- /dev/null
+++ b/tsparser/src/builder/parse.rs
@@ -0,0 +1,46 @@
+use std::fmt::Display;
+use std::path::Path;
+
+use crate::app::{validate_and_describe, AppDesc};
+use crate::parser::parser::{ParseContext, Parser};
+use crate::parser::resourceparser::PassOneParser;
+
+use super::{App, Builder};
+
+#[derive(Debug, Clone)]
+pub struct ParseParams<'a> {
+    pub app: &'a App,
+    pub pc: &'a ParseContext,
+    pub working_dir: &'a Path,
+    pub parse_tests: bool,
+}
+
+#[derive(Debug)]
+pub struct ParseError;
+
+impl Display for ParseError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "failed to parse TypeScript code")
+    }
+}
+
+impl Builder<'_> {
+    pub fn parse(&self, params: &ParseParams) -> Option<AppDesc> {
+        let pc = params.pc;
+        let pass1 = PassOneParser::new(
+            pc.file_set.clone(),
+            pc.type_checker.clone(),
+            Default::default(),
+        );
+        let parser = Parser::new(pc, pass1);
+
+        let result = parser.parse();
+        let desc = validate_and_describe(pc, result)?;
+
+        if pc.errs.has_errors() {
+            None
+        } else {
+            Some(desc)
+        }
+    }
+}
diff --git a/tsparser/src/builder/prepare.rs b/tsparser/src/builder/prepare.rs
new file mode 100644
index 0000000000..31acc042dc
--- /dev/null
+++ b/tsparser/src/builder/prepare.rs
@@ -0,0 +1,63 @@
+use std::{io, path::PathBuf};
+
+use thiserror::Error;
+
+use super::Builder;
+
+#[derive(Debug, Clone)]
+pub struct PrepareParams {
+    pub encore_dev_version: PackageVersion,
+    pub app_root: PathBuf,
+}
+
+#[derive(Debug, Clone)]
+pub enum PackageVersion {
+    Local(PathBuf),
+    Published(String),
+}
+
+#[derive(Debug, Error)]
+pub enum PrepareError {
+    #[error("package.json file not found (expected at {0})")]
+    PackageJsonNotFound(PathBuf),
+    #[error("failed to read package.json: {0}")]
+    ReadPackageJson(#[source] io::Error),
+    #[error("failed to update package.json: {0}")]
+    WritePackageJson(#[source] io::Error),
+    #[error("invalid package.json: {source}")]
+    InvalidPackageJson {
+        source: serde_json::Error,
+        path: PathBuf,
+    },
+    #[error("package manager '{0}' not supported")]
+    UnsupportedPackageManagerError(String),
+
+    #[error(
+        "installed 'encore.dev' package version ({0}) newer than 'encore' release, run 'encore version update' first"
+    )]
+    EncoreDevTooNew(String),
+
+    #[error("installing node_modules failed: {0}, run '{1}' manually to see the error")]
+    InstallNodeModules(#[source] io::Error, String),
+
+    #[error("failed to install 'encore.dev' package: {0}")]
+    InstallEncoreDev(#[source] io::Error),
+
+    #[error("failed to configure yarn nodeLinker to node-modules: {0}")]
+    SetupYarnNodeLinker(#[source] io::Error),
+
+    #[error("node_modules directory not found")]
+    NodeModulesNotFound,
+
+    #[error("unable to generate code")]
+    GenerateCode(#[source] io::Error),
+
+    #[error("internal error: {0}")]
+    Internal(#[source] anyhow::Error),
+}
+
+impl Builder<'_> {
+    pub fn prepare(&self, params: &PrepareParams) -> Result<(), PrepareError> {
+        self.setup_deps(&params.app_root, &params.encore_dev_version)
+    }
+}
diff --git a/tsparser/src/builder/templates/catalog/auth/auth_ts.handlebars b/tsparser/src/builder/templates/catalog/auth/auth_ts.handlebars
new file mode 100644
index 0000000000..12b04e43d2
--- /dev/null
+++ b/tsparser/src/builder/templates/catalog/auth/auth_ts.handlebars
@@ -0,0 +1,27 @@
+{{#if auth_handlers}}
+{{#each auth_handlers}}
+import { getAuthData as _getAuthData } from "encore.dev/internal/codegen/auth";
+import { {{name}} as _auth_{{name}} } from {{toJSON import_path}};
+{{/each}}
+
+export type AuthData = {{#each auth_handlers }}{{#unless @first}}
+    | {{/unless}}Awaited<ReturnType<typeof _auth_{{name}}>>{{/each}};
+
+export function getAuthData(): AuthData | null {
+    return _getAuthData()
+}
+
+{{else}}
+export type AuthData = null;
+
+// getAuthData throws an error until an auth handler is added
+export function getAuthData(): AuthData | null {
+    throw new Error("authData cannot be called when there are no auth handlers.")
+}
+{{/if}}
+declare module "encore.dev/api" {
+  interface CallOpts {
+    authData?: AuthData;
+  }
+}
+
diff --git a/tsparser/src/builder/templates/catalog/auth/index_ts.handlebars b/tsparser/src/builder/templates/catalog/auth/index_ts.handlebars
new file mode 100644
index 0000000000..dde28c20a8
--- /dev/null
+++ b/tsparser/src/builder/templates/catalog/auth/index_ts.handlebars
@@ -0,0 +1 @@
+export {type AuthData, getAuthData} from "../internal/auth/auth";
\ No newline at end of file
diff --git a/tsparser/src/builder/templates/catalog/clients/endpoints_d_ts.handlebars b/tsparser/src/builder/templates/catalog/clients/endpoints_d_ts.handlebars
new file mode 100644
index 0000000000..a286b4d8d9
--- /dev/null
+++ b/tsparser/src/builder/templates/catalog/clients/endpoints_d_ts.handlebars
@@ -0,0 +1,88 @@
+import { CallOpts } from "encore.dev/api";
+
+{{#if has_streams}}
+import {
+  StreamInOutHandlerFn,
+  StreamInHandlerFn,
+  StreamOutHandlerFn,
+  StreamOutWithResponse,
+  StreamIn,
+  StreamInOut,
+} from "encore.dev/api";
+
+{{#each endpoints}}
+{{#if (or streaming_request streaming_response)}}
+import { {{name}} as {{name}}_handler } from {{toJSON import_path}};
+{{/if}}
+{{/each}}
+
+type StreamHandshake<Type extends (...args: any[]) => any> = Parameters<Type> extends [infer H, any] ? H : void;
+
+type StreamRequest<Type> = Type extends
+  | StreamInOutHandlerFn<any, infer Req, any>
+  | StreamInHandlerFn<any, infer Req, any>
+  | StreamOutHandlerFn<any, any>
+  ? Req
+  : never;
+
+type StreamResponse<Type> = Type extends
+  | StreamInOutHandlerFn<any, any, infer Resp>
+  | StreamInHandlerFn<any, any, infer Resp>
+  | StreamOutHandlerFn<any, infer Resp>
+  ? Resp
+  : never;
+
+{{/if}}
+type Parameters<T> = T extends (...args: infer P) => unknown ? P : never;
+type WithCallOpts<T extends (...args: any) => any> = (
+  ...args: [...Parameters<T>, opts?: CallOpts]
+) => ReturnType<T>;
+
+{{#each endpoints}}
+{{#if (or streaming_request streaming_response)~}}
+
+{{#if (and streaming_request streaming_response)}}
+export function {{name}}(
+  ...args: StreamHandshake<typeof {{name}}_handler> extends void
+    ? [opts?: CallOpts]
+    : [data: StreamHandshake<typeof {{name}}_handler>, opts?: CallOpts]
+): Promise<
+  StreamInOut<
+    StreamResponse<typeof {{name}}_handler>,
+    StreamRequest<typeof {{name}}_handler>
+  >
+>;
+{{else}}
+{{#if streaming_request}}
+export function {{name}}(
+  ...args: StreamHandshake<typeof {{name}}_handler> extends void
+    ? [opts?: CallOpts]
+    : [data: StreamHandshake<typeof {{name}}_handler>, opts?: CallOpts]
+): Promise<
+  StreamOutWithResponse<
+    StreamRequest<typeof {{name}}_handler>,
+    StreamResponse<typeof {{name}}_handler>
+  >
+>;
+{{/if}}
+{{#if streaming_response}}
+export function {{name}}(
+  ...args: StreamHandshake<typeof {{name}}_handler> extends void
+    ? [opts?: CallOpts]
+    : [data: StreamHandshake<typeof {{name}}_handler>, opts?: CallOpts]
+): Promise<
+  StreamIn<
+    StreamResponse<typeof {{name}}_handler>
+  >
+>;
+{{/if}}
+{{/if}}
+
+{{~else}}
+import { {{name}} as {{name}}_handler } from {{toJSON import_path}};
+declare const {{name}}: WithCallOpts<typeof {{name}}_handler>;
+export { {{name}} };
+
+{{/if}}
+{{/each}}
+
diff --git a/tsparser/src/builder/templates/catalog/clients/endpoints_js.handlebars b/tsparser/src/builder/templates/catalog/clients/endpoints_js.handlebars
new file mode 100644
index 0000000000..dac467eb53
--- /dev/null
+++ b/tsparser/src/builder/templates/catalog/clients/endpoints_js.handlebars
@@ -0,0 +1,32 @@
+import { apiCall, streamIn, streamOut, streamInOut } from "encore.dev/internal/codegen/api";
+
+const TEST_ENDPOINTS = typeof ENCORE_DROP_TESTS === "undefined" && process.env.NODE_ENV === "test"
+    ? await import("./endpoints_testing.js")
+    : null;
+
+{{#each endpoints}}
+{{#if has_params}}
+export async function {{name}}(params, opts) {
+{{else}}
+export async function {{name}}(opts) {
+    const params = undefined;
+{{/if}}
+    if (typeof ENCORE_DROP_TESTS === "undefined" && process.env.NODE_ENV === "test") {
+        return TEST_ENDPOINTS.{{name}}(params, opts);
+    }
+
+    {{#if (or streaming_request streaming_response)}}
+    {{#if (and streaming_request streaming_response)}}
+    return streamInOut("{{../name}}", "{{name}}", params, opts);
+    {{else}}
+    {{#if streaming_request}}
+    return streamIn("{{../name}}", "{{name}}", params, opts);
+    {{else}}
+    return streamOut("{{../name}}", "{{name}}", params, opts);
+    {{/if}}
+    {{/if}}
+    {{else}}
+    return apiCall("{{../name}}", "{{name}}", params, opts);
+    {{/if}}
+}
+{{/each}}
diff --git a/tsparser/src/builder/templates/catalog/clients/endpoints_testing_js.handlebars b/tsparser/src/builder/templates/catalog/clients/endpoints_testing_js.handlebars
new file mode 100644
index 0000000000..494b7ee4f1
--- /dev/null
+++ b/tsparser/src/builder/templates/catalog/clients/endpoints_testing_js.handlebars
@@ -0,0 +1,34 @@
+import { apiCall, streamIn, streamOut, streamInOut } from "encore.dev/internal/codegen/api";
+import { registerTestHandler } from "encore.dev/internal/codegen/appinit";
+
+{{#with service}}
+{{#if import_path}}
+import * as {{encoreNameToIdent name}}_service from {{toJSON import_path}};
+{{/if}}
+{{/with}}
+
+{{#each endpoints}}
+export async function {{name}}(params, opts) {
+    const handler = (await import({{toJSON (stripExt import_path)}})).{{name}};
+    registerTestHandler({
+        apiRoute: { service: "{{../name}}", name: "{{name}}", raw: {{toJSON raw}}, handler, streamingRequest: {{ streaming_request }}, streamingResponse: {{ streaming_response }} },
+        middlewares: {{#if ../service.import_path}}{{encoreNameToIdent ../service.name}}_service.default.cfg.middlewares || {{/if}}[],
+        endpointOptions: {{toJSON endpoint_options}},
+    });
+
+    {{#if (or streaming_request streaming_response)}}
+    {{#if (and streaming_request streaming_response)}}
+    return streamInOut("{{../name}}", "{{name}}", params, opts);
+    {{else}}
+    {{#if streaming_request}}
+    return streamIn("{{../name}}", "{{name}}", params, opts);
+    {{else}}
+    return streamOut("{{../name}}", "{{name}}", params, opts);
+    {{/if}}
+    {{/if}}
+    {{else}}
+    return apiCall("{{../name}}", "{{name}}", params, opts);
+    {{/if}}
+}
+
+{{/each}}
diff --git a/tsparser/src/builder/templates/catalog/clients/index_d_ts.handlebars b/tsparser/src/builder/templates/catalog/clients/index_d_ts.handlebars
new file mode 100644
index 0000000000..a3c48ed8ff
--- /dev/null
+++ b/tsparser/src/builder/templates/catalog/clients/index_d_ts.handlebars
@@ -0,0 +1,3 @@
+{{#each services}}
+export * as {{encoreNameToIdent name}} from "../internal/clients/{{name}}/endpoints";
+{{/each}}
diff --git a/tsparser/src/builder/templates/catalog/clients/index_js.handlebars b/tsparser/src/builder/templates/catalog/clients/index_js.handlebars
new file mode 100644
index 0000000000..6b85da454f
--- /dev/null
+++ b/tsparser/src/builder/templates/catalog/clients/index_js.handlebars
@@ -0,0 +1,3 @@
+{{#each services}}
+export * as {{encoreNameToIdent name}} from "../internal/clients/{{name}}/endpoints.js";
+{{/each}}
diff --git a/tsparser/src/builder/templates/entrypoints/combined/main.handlebars b/tsparser/src/builder/templates/entrypoints/combined/main.handlebars
new file mode 100644
index 0000000000..ce5eae9e63
--- /dev/null
+++ b/tsparser/src/builder/templates/entrypoints/combined/main.handlebars
@@ -0,0 +1,44 @@
+import { registerGateways, registerHandlers, run, type Handler } from "encore.dev/internal/codegen/appinit";
+
+{{#each gateways}}
+import { {{bind_name}} as {{encoreNameToIdent encore_name}}GW } from {{toJSON import_path}};
+{{/each}}
+{{#each endpoints}}
+import { {{name}} as {{encoreNameToIdent service_name}}_{{name}}Impl{{@index}} } from {{toJSON import_path}};
+{{/each}}
+{{#each subscriptions}}
+import {{toJSON import_path}};
+{{/each}}
+{{#each services}}
+{{#if import_path}}
+import * as {{encoreNameToIdent name}}_service from {{toJSON import_path}};
+{{/if}}
+{{/each}}
+
+const gateways: any[] = [
+{{#each gateways}}
+    {{encoreNameToIdent encore_name}}GW,
+{{/each}}
+];
+
+const handlers: Handler[] = [
+{{#each endpoints}}
+    {
+        apiRoute: {
+            service:           {{toJSON service_name}},
+            name:              {{toJSON name}},
+            handler:           {{encoreNameToIdent service_name}}_{{name}}Impl{{@index}},
+            raw:               {{toJSON raw}},
+            streamingRequest:  {{toJSON streaming_request}},
+            streamingResponse: {{toJSON streaming_response}},
+        },
+        endpointOptions: {{toJSON endpoint_options}},
+        middlewares: {{#with (lookup (lookup ../services service_name) "import_path")}}{{encoreNameToIdent ../service_name}}_service.default.cfg.middlewares || {{/with}}[],
+    },
+{{/each}}
+];
+
+registerGateways(gateways);
+registerHandlers(handlers);
+
+await run(import.meta.url);
diff --git a/tsparser/src/builder/templates/entrypoints/gateways/main.handlebars b/tsparser/src/builder/templates/entrypoints/gateways/main.handlebars
new file mode 100644
index 0000000000..07a77e8729
--- /dev/null
+++ b/tsparser/src/builder/templates/entrypoints/gateways/main.handlebars
@@ -0,0 +1,18 @@
+import { registerGateways, run } from "encore.dev/internal/codegen/appinit";
+import { Worker, isMainThread } from "node:worker_threads";
+import { fileURLToPath } from "node:url";
+import { availableParallelism } from "node:os";
+
+{{#each gateways}}
+import { {{bind_name}} as {{encoreNameToIdent encore_name}}Impl } from {{toJSON import_path}};
+{{/each}}
+
+const gateways = [
+{{#each gateways}}
+    {{encoreNameToIdent encore_name}}Impl,
+{{/each}}
+];
+
+registerGateways(gateways);
+
+await run(import.meta.url);
diff --git a/tsparser/src/builder/templates/entrypoints/services/main.handlebars b/tsparser/src/builder/templates/entrypoints/services/main.handlebars
new file mode 100644
index 0000000000..139ee49e5c
--- /dev/null
+++ b/tsparser/src/builder/templates/entrypoints/services/main.handlebars
@@ -0,0 +1,37 @@
+import { registerHandlers, run, type Handler } from "encore.dev/internal/codegen/appinit";
+import { Worker, isMainThread } from "node:worker_threads";
+import { fileURLToPath } from "node:url";
+import { availableParallelism } from "node:os";
+
+{{#each endpoints}}
+import { {{name}} as {{name}}Impl{{@index}} } from {{toJSON import_path}};
+{{/each}}
+{{#each subscriptions}}
+import {{toJSON import_path}};
+{{/each}}
+{{#with service}}
+{{#if import_path}}
+import * as {{encoreNameToIdent name}}_service from {{toJSON import_path}};
+{{/if}}
+{{/with}}
+
+const handlers: Handler[] = [
+{{#each endpoints}}
+    {
+        apiRoute: {
+            service:           {{toJSON ../name}},
+            name:              {{toJSON name}},
+            handler:           {{name}}Impl{{@index}},
+            raw:               {{toJSON raw}},
+            streamingRequest:  {{toJSON streaming_request}},
+            streamingResponse: {{toJSON streaming_response}},
+        },
+        endpointOptions: {{toJSON endpoint_options}},
+        middlewares: {{#if ../service.import_path}}{{encoreNameToIdent ../service.name}}_service.default.cfg.middlewares || {{/if}}[],
+    },
+{{/each}}
+];
+
+registerHandlers(handlers);
+
+await run(import.meta.url);
diff --git a/tsparser/src/builder/test.rs b/tsparser/src/builder/test.rs
new file mode 100644
index 0000000000..9a4fc937a7
--- /dev/null
+++ b/tsparser/src/builder/test.rs
@@ -0,0 +1,64 @@
+use std::collections::HashMap;
+use std::fs;
+use std::path::Path;
+
+use crate::app::AppDesc;
+use serde::{Deserialize, Serialize};
+
+use crate::builder::codegen::CodegenParams;
+use crate::builder::compile::CmdSpec;
+use crate::builder::package_mgmt::resolve_package_manager;
+use crate::parser::parser::ParseContext;
+
+use super::{prepare::PrepareError, App, Builder};
+
+#[derive(Debug)]
+pub struct TestParams<'a> {
+    pub app: &'a App,
+    pub pc: &'a ParseContext,
+    pub working_dir: &'a Path,
+    pub parse: &'a AppDesc,
+}
+
+#[derive(Serialize, Debug)]
+pub struct TestResult {
+    pub cmd: Option<CmdSpec>,
+}
+
+impl Builder<'_> {
+    pub fn test(&self, params: &TestParams) -> Result<TestResult, PrepareError> {
+        // Is there a "test" script defined in package.json?
+        {
+            #[derive(Deserialize)]
+            struct PackageJson {
+                #[serde(default)]
+                scripts: HashMap<String, String>,
+            }
+            let package_json_path = params.app.root.join("package.json");
+            let package_json =
+                fs::read_to_string(&package_json_path).map_err(PrepareError::ReadPackageJson)?;
+            let package_json: PackageJson =
+                serde_json::from_str(&package_json).map_err(|source| {
+                    PrepareError::InvalidPackageJson {
+                        source,
+                        path: package_json_path.to_path_buf(),
+                    }
+                })?;
+            if !package_json.scripts.contains_key("test") {
+                log::info!("no test script defined in package.json, skipping tests");
+                return Ok(TestResult { cmd: None });
+            }
+        }
+
+        self.generate_code(&CodegenParams {
+            app: params.app,
+            pc: params.pc,
+            working_dir: params.working_dir,
+            desc: params.parse,
+        })?;
+
+        let pkg_mgr = resolve_package_manager(&params.app.root)?;
+        let cmd = pkg_mgr.run_tests();
+        Ok(TestResult { cmd: Some(cmd) })
+    }
+}
diff --git a/tsparser/src/builder/transpiler.rs b/tsparser/src/builder/transpiler.rs
new file mode 100644
index 0000000000..0ef994a454
--- /dev/null
+++ b/tsparser/src/builder/transpiler.rs
@@ -0,0 +1,182 @@
+use std::ffi::OsStr;
+use std::path::{Path, PathBuf};
+
+use crate::builder::compile::{CmdSpec, Entrypoint};
+use crate::builder::{DebugMode, PlainError};
+use anyhow::{Context, Result};
+
+use super::NodeJSRuntime;
+
+#[allow(dead_code)]
+pub enum ExternalPackages<'a> {
+    All,
+    Some(&'a [&'a str]),
+    None,
+}
+
+#[allow(dead_code)]
+pub enum InputKind {
+    Combined(Vec<String>, Vec<String>),
+    Service(String),
+    Gateway(String),
+}
+
+pub struct Input {
+    // What kind of input is it.
+    pub kind: InputKind,
+
+    /// The path to the pre-compiled entrypoint of the service.
+    pub entrypoint: PathBuf,
+}
+
+pub struct TranspileParams<'a> {
+    /// Where the built artifacts should be written.
+    pub artifact_dir: &'a Path,
+
+    /// The working directory to use to run the transpiler,
+    /// for generating useful error messages.
+    pub cwd: &'a Path,
+
+    /// The services and gateways to transpile.
+    pub inputs: Vec<Input>,
+
+    // If we should transpile for debug
+    pub debug: DebugMode,
+
+    // What runtime should be used as entrypoint
+    pub nodejs_runtime: NodeJSRuntime,
+}
+
+pub struct TranspileResult {
+    /// The compiled entrypoints.
+    pub entrypoints: Vec<Entrypoint>,
+}
+
+pub(super) trait OutputTranspiler {
+    fn transpile(&self, params: TranspileParams) -> Result<TranspileResult>;
+}
+
+#[allow(dead_code)]
+pub struct EsbuildCompiler<'a> {
+    pub node_modules_dir: &'a Path,
+    pub external: ExternalPackages<'a>,
+}
+
+impl OutputTranspiler for EsbuildCompiler<'_> {
+    fn transpile(&self, p: TranspileParams) -> Result<TranspileResult> {
+        let bundle = move |inputs: Vec<Input>, name_prefix| -> Result<Vec<Entrypoint>> {
+            // let program = self.node_modules_dir.join(".bin").join("esbuild");
+            let tsbundler_path = std::env::var("ENCORE_TSBUNDLER_PATH")
+                .ok()
+                .unwrap_or("tsbundler-encore".into());
+
+            let mut cmd = std::process::Command::new(tsbundler_path);
+            cmd.current_dir(p.cwd);
+            cmd.arg("--bundle")
+                .arg("--engine=node:21")
+                // .arg("--format=esm")
+                // .arg("--platform=node")
+                // .arg("--sourcemap")
+                // .arg("--out-extension:.js=.mjs")
+                // .arg("--entry-names=[dir]/[name]")
+                .arg(format!(
+                    "--outdir={}",
+                    p.artifact_dir.join(name_prefix).to_string_lossy(),
+                ));
+
+            for input in &inputs {
+                cmd.arg(&input.entrypoint);
+            }
+
+            log::info!("running tsbundler-encore: {:?}", cmd);
+            let output = cmd.output().context("failed to tsbundler-encore")?;
+            if !output.status.success() {
+                anyhow::bail!(PlainError(
+                    String::from_utf8_lossy(&output.stderr).to_string()
+                ));
+            }
+            log::info!("successfully bundled");
+
+            let mut entrypoints = Vec::new();
+            for i in inputs {
+                let entrypoint_path = {
+                    let (file_stem, dir) = file_stem_and_dir(&i.entrypoint)?;
+                    format!(
+                        "$ARTIFACT_DIR/{}/{}/{}.mjs",
+                        name_prefix,
+                        dir.to_string_lossy(),
+                        file_stem.to_string_lossy(),
+                    )
+                };
+
+                let mut command = match p.nodejs_runtime {
+                    NodeJSRuntime::NodeJS => vec!["node".into(), "--enable-source-maps".into()],
+                    NodeJSRuntime::Bun => vec!["bun".into(), "run".into()],
+                };
+
+                match p.debug {
+                    DebugMode::Disabled => {}
+                    DebugMode::Enabled => command.push("--inspect".to_string()),
+                    DebugMode::Break => command.push("--inspect-brk".to_string()),
+                }
+
+                // Finally we want to add the path to the bundled app
+                command.push(entrypoint_path.clone());
+
+                let (services, gateways) = match i.kind {
+                    InputKind::Service(name) => (vec![name], vec![]),
+                    InputKind::Gateway(name) => (vec![], vec![name]),
+                    InputKind::Combined(gateways, services) => (services, gateways),
+                };
+                entrypoints.push(Entrypoint {
+                    cmd: CmdSpec {
+                        command,
+                        env: vec![],
+                        prioritized_files: vec![entrypoint_path],
+                    },
+                    services,
+                    gateways,
+                    use_runtime_config_v2: true,
+                });
+            }
+
+            Ok(entrypoints)
+        };
+
+        let (service_inputs, gateway_inputs, combined_inputs) = {
+            let mut service_inputs = Vec::new();
+            let mut gateway_inputs = Vec::new();
+            let mut combined_inputs = Vec::new();
+            for i in p.inputs {
+                match i.kind {
+                    InputKind::Service(_) => service_inputs.push(i),
+                    InputKind::Gateway(_) => gateway_inputs.push(i),
+                    InputKind::Combined(_, _) => {
+                        combined_inputs.push(i);
+                    }
+                }
+            }
+            (service_inputs, gateway_inputs, combined_inputs)
+        };
+
+        if !combined_inputs.is_empty() {
+            let entrypoints = bundle(combined_inputs, "combined")?;
+            Ok(TranspileResult { entrypoints })
+        } else {
+            let services = bundle(service_inputs, "services")?;
+            let gateways = bundle(gateway_inputs, "gateways")?;
+            let entrypoints = services.into_iter().chain(gateways).collect();
+
+            Ok(TranspileResult { entrypoints })
+        }
+    }
+}
+
+fn file_stem_and_dir(p: &Path) -> Result<(&OsStr, &OsStr)> {
+    let file_stem = p.file_stem().context("no file name in entrypoint")?;
+    let dir_name = p
+        .parent()
+        .and_then(|parent| parent.file_name())
+        .context("no parent")?;
+    Ok((file_stem, dir_name))
+}
diff --git a/tsparser/src/legacymeta/api_schema.rs b/tsparser/src/legacymeta/api_schema.rs
new file mode 100644
index 0000000000..27a12ff2da
--- /dev/null
+++ b/tsparser/src/legacymeta/api_schema.rs
@@ -0,0 +1,20 @@
+use crate::parser::respath::Path;
+use crate::parser::types::{FieldName, Interface};
+
+pub(super) fn strip_path_params(path: &Path, typ: &mut Interface) {
+    if !path.has_dynamic_segments() {
+        return;
+    }
+
+    let is_path_param = |name: &str| path.dynamic_segments().any(|seg| seg.lit_or_name() == name);
+
+    // Drop any fields whose type is Path.
+    typ.fields.retain(|f| {
+        if let FieldName::String(name) = &f.name {
+            if is_path_param(name) {
+                return false;
+            }
+        }
+        true
+    });
+}
diff --git a/tsparser/src/legacymeta/mod.rs b/tsparser/src/legacymeta/mod.rs
new file mode 100644
index 0000000000..f05cfc1baa
--- /dev/null
+++ b/tsparser/src/legacymeta/mod.rs
@@ -0,0 +1,835 @@
+use std::collections::{HashMap, HashSet};
+use std::path::Path;
+use std::rc::Rc;
+
+use swc_common::errors::HANDLER;
+
+use crate::encore::parser::meta::v1::{self, selector, Selector};
+use crate::legacymeta::schema::{loc_from_range, SchemaBuilder};
+use crate::parser::parser::{ParseContext, ParseResult, Service};
+use crate::parser::resourceparser::bind::{Bind, BindKind};
+use crate::parser::resources::apis::{authhandler, gateway};
+use crate::parser::resources::infra::cron::CronJobSchedule;
+use crate::parser::resources::infra::{cron, objects, pubsub_subscription, pubsub_topic, sqldb};
+use crate::parser::resources::Resource;
+use crate::parser::types::validation;
+use crate::parser::types::{Object, ObjectId};
+use crate::parser::usageparser::Usage;
+use crate::parser::{respath, FilePath, Range};
+use litparser::{ParseResult as PResult, ToParseErr};
+
+mod api_schema;
+mod schema;
+
+const DEFAULT_API_GATEWAY_NAME: &str = "api-gateway";
+
+pub fn compute_meta(pc: &ParseContext, parse: &ParseResult) -> PResult<v1::Data> {
+    let app_root = pc.app_root.as_path();
+
+    let schema = SchemaBuilder::new(pc, app_root);
+    MetaBuilder {
+        pc,
+        schema,
+        parse,
+        app_root,
+        data: new_meta(),
+    }
+    .build()
+}
+
+struct MetaBuilder<'a> {
+    pc: &'a ParseContext,
+    schema: SchemaBuilder<'a>,
+    parse: &'a ParseResult,
+    app_root: &'a Path,
+
+    data: v1::Data,
+}
+
+impl MetaBuilder<'_> {
+    pub fn build(mut self) -> PResult<v1::Data> {
+        // self.data.app_revision = parse_app_revision(&self.app_root)?;
+        self.data.app_revision = std::env::var("ENCORE_APP_REVISION").unwrap_or_default();
+
+        let mut svc_index = HashMap::new();
+        let mut svc_to_pkg_index = HashMap::new();
+        for svc in &self.parse.services {
+            let Some(rel_path) = self.rel_path_string(svc.root.as_path()) else {
+                HANDLER.with(|h| {
+                    h.err(&format!(
+                        "unable to compute relative path to service: {}",
+                        svc.name
+                    ))
+                });
+                continue;
+            };
+
+            svc_to_pkg_index.insert(svc.name.clone(), self.data.pkgs.len());
+            self.data.pkgs.push(v1::Package {
+                rel_path: rel_path.clone(),
+                name: svc.name.clone(),
+                service_name: svc.name.clone(),
+                doc: svc.doc.clone().unwrap_or_default(),
+
+                rpc_calls: vec![],   // added below
+                secrets: vec![],     // added below
+                trace_nodes: vec![], // TODO?
+            });
+
+            svc_index.insert(svc.name.clone(), self.data.svcs.len());
+            self.data.svcs.push(v1::Service {
+                name: svc.name.clone(),
+                rel_path,
+                rpcs: vec![],      // filled in later
+                databases: vec![], // filled in later
+                buckets: vec![],   // filled in later
+                has_config: false, // TODO change when config is supported
+
+                // We no longer care about migrations in a service, so just set
+                // this to the empty array. The field is required for backwards compatibility.
+                migrations: vec![],
+            });
+        }
+
+        // Store resources that are dependent on other resources
+        // so we can do another pass to resolve them.
+        enum Dependent<'a> {
+            // Depends on topic objects
+            PubSubSubscription((&'a Bind, &'a pubsub_subscription::Subscription)),
+
+            // Depends on endpoint objects
+            CronJob((&'a Bind, &'a cron::CronJob)),
+
+            // Depends on auth handler objects
+            Gateway((&'a Bind, &'a gateway::Gateway)),
+        }
+
+        let mut dependent: Vec<Dependent> = Vec::new();
+        let mut topic_idx: HashMap<ObjectId, usize> = HashMap::new();
+        let mut endpoint_idx: HashMap<ObjectId, (usize, usize)> = HashMap::new();
+        let mut topic_by_name: HashMap<String, usize> = HashMap::new();
+
+        let mut auth_handlers: HashMap<ObjectId, Rc<authhandler::AuthHandler>> = HashMap::new();
+
+        for b in &self.parse.binds {
+            if b.kind != BindKind::Create {
+                continue;
+            }
+            match &b.resource {
+                // Do nothing for these resources:
+                Resource::Service(_) => {}
+                Resource::ServiceClient(_) => {}
+
+                Resource::APIEndpoint(ep) => {
+                    let handshake_schema = self.schema.transform_handshake(ep)?;
+                    let request_schema = self.schema.transform_request(ep)?;
+                    let response_schema = self
+                        .schema
+                        .transform_response(ep.encoding.raw_resp_schema.clone().map(|s| s.take()))
+                        .map_err(|err| {
+                            let sp = ep
+                                .encoding
+                                .raw_resp_schema
+                                .as_ref()
+                                .map_or(ep.range.to_span(), |s| s.span());
+                            sp.parse_err(err.to_string())
+                        })?;
+
+                    let access_type: i32 = match (ep.expose, ep.require_auth) {
+                        (false, _) => v1::rpc::AccessType::Private as i32,
+                        (true, false) => v1::rpc::AccessType::Public as i32,
+                        (true, true) => v1::rpc::AccessType::Auth as i32,
+                    };
+
+                    let static_assets = ep
+                        .static_assets
+                        .as_ref()
+                        .map(|sa| -> PResult<v1::rpc::StaticAssets> {
+                            let dir_rel_path = self.rel_path_string(&sa.dir).ok_or(
+                                sa.dir.parse_err("could not resolve static asset directory"),
+                            )?;
+                            let not_found_rel_path = sa
+                                .not_found
+                                .as_ref()
+                                .map(|p| {
+                                    self.rel_path_string(p).ok_or(
+                                        p.parse_err("could not resolve static notFound path"),
+                                    )
+                                })
+                                .transpose()?;
+                            Ok(v1::rpc::StaticAssets {
+                                dir_rel_path,
+                                not_found_rel_path,
+                                not_found_status: sa.not_found_status,
+                            })
+                        })
+                        .transpose()?;
+
+                    let tags = ep
+                        .tags
+                        .iter()
+                        .map(|tag| Selector {
+                            r#type: selector::Type::Tag.into(),
+                            value: tag.clone(),
+                        })
+                        .collect();
+
+                    let rpc = v1::Rpc {
+                        name: ep.name.clone(),
+                        doc: ep.doc.clone(),
+                        service_name: ep.service_name.clone(),
+                        access_type,
+                        handshake_schema,
+                        request_schema,
+                        response_schema,
+                        proto: if ep.raw {
+                            v1::rpc::Protocol::Raw
+                        } else {
+                            v1::rpc::Protocol::Regular
+                        } as i32,
+                        path: Some(ep.encoding.path.to_meta()),
+                        http_methods: ep.encoding.methods.to_vec(),
+                        tags,
+                        sensitive: ep.sensitive,
+                        loc: Some(loc_from_range(self.app_root, &self.pc.file_set, ep.range)?),
+                        allow_unauthenticated: !ep.require_auth,
+                        body_limit: ep.body_limit,
+                        expose: {
+                            let mut map = HashMap::new();
+                            if ep.expose {
+                                map.insert(
+                                    DEFAULT_API_GATEWAY_NAME.to_string(),
+                                    v1::rpc::ExposeOptions {},
+                                );
+                            }
+                            map
+                        },
+                        streaming_request: ep.streaming_request,
+                        streaming_response: ep.streaming_response,
+                        static_assets,
+                    };
+
+                    let Some(service_idx) =
+                        svc_index.get(&ep.service_name).map(|idx| idx.to_owned())
+                    else {
+                        return Err(ep
+                            .range
+                            .to_span()
+                            .parse_err(format!("missing service {}", ep.service_name)));
+                    };
+                    let service = &mut self.data.svcs[service_idx];
+
+                    if let Some(obj) = &b.object {
+                        let ep_idx = service.rpcs.len();
+                        endpoint_idx.insert(obj.id, (service_idx, ep_idx));
+                    }
+
+                    service.rpcs.push(rpc);
+                }
+
+                Resource::AuthHandler(ah) => {
+                    if let Some(obj) = &b.object {
+                        auth_handlers.insert(obj.id, ah.clone());
+                    }
+                }
+
+                Resource::SQLDatabase(db) => {
+                    self.data.sql_databases.push(self.sql_database(db)?);
+                }
+
+                Resource::Bucket(bkt) => {
+                    self.data.buckets.push(self.bucket(bkt));
+                }
+
+                Resource::PubSubTopic(topic) => {
+                    let idx = self.data.pubsub_topics.len();
+                    let top = self.pubsub_topic(topic)?;
+                    self.data.pubsub_topics.push(top);
+                    if let Some(obj) = &b.object {
+                        topic_idx.insert(obj.id, idx);
+                    }
+                    topic_by_name.insert(topic.name.clone(), idx);
+                }
+
+                Resource::Secret(secret) => {
+                    let service = self.service_for_range(&secret.range).ok_or(
+                        secret
+                            .range
+                            .parse_err("secrets must be loaded from within services"),
+                    )?;
+
+                    let pkg_idx = svc_to_pkg_index
+                        .get(&service.name)
+                        .ok_or(
+                            secret
+                                .range
+                                .parse_err(format!("missing service: {}", &service.name)),
+                        )?
+                        .to_owned();
+                    let pkg = &mut self.data.pkgs[pkg_idx];
+                    pkg.secrets.push(secret.name.clone());
+                }
+
+                // Dependent resources
+                // TODO: Include Cache Keyspace here too.
+                Resource::PubSubSubscription(sub) => {
+                    dependent.push(Dependent::PubSubSubscription((b, sub)));
+                }
+                Resource::CronJob(cj) => {
+                    dependent.push(Dependent::CronJob((b, cj)));
+                }
+                Resource::Gateway(gw) => {
+                    dependent.push(Dependent::Gateway((b, gw)));
+                }
+            }
+        }
+
+        // Keep track of things we've seen so we can report errors pointing at
+        // the previous definition when we see a duplicate.
+        let mut first_gateway: Option<&gateway::Gateway> = None;
+        let mut first_auth_handler: Option<&Object> = None;
+
+        // Make a second pass for resources that depend on other resources.
+        for r in &dependent {
+            match r {
+                Dependent::PubSubSubscription((b, sub)) => {
+                    let topic_idx = topic_idx
+                        .get(&sub.topic.id)
+                        .ok_or_else(|| sub.topic.parse_err("topic not found"))?
+                        .to_owned();
+                    let result = self.pubsub_subscription(b, sub)?;
+                    let topic = &mut self.data.pubsub_topics[topic_idx];
+                    topic.subscriptions.push(result);
+                }
+
+                Dependent::CronJob((_b, cj)) => {
+                    let (svc_idx, ep_idx) = endpoint_idx
+                        .get(&cj.endpoint.id)
+                        .ok_or(cj.endpoint.parse_err("endpoint not found"))?
+                        .to_owned();
+                    let svc = &self.data.svcs[svc_idx];
+                    let ep = &svc.rpcs[ep_idx];
+
+                    let title = cj.title.clone().unwrap_or(cj.name.clone());
+                    let result = v1::CronJob {
+                        id: cj.name.clone(),
+                        doc: cj.doc.to_owned(),
+                        title,
+                        endpoint: Some(v1::QualifiedName {
+                            pkg: svc.rel_path.clone(),
+                            name: ep.name.clone(),
+                        }),
+                        schedule: match &cj.schedule {
+                            CronJobSchedule::Cron(expr) => format!("schedule:{}", expr.0),
+                            CronJobSchedule::Every(mins) => format!("every:{mins}"),
+                        },
+                    };
+                    self.data.cron_jobs.push(result);
+                }
+
+                Dependent::Gateway((_b, gw)) => {
+                    let auth_handler = if let Some(auth_handler) = &gw.auth_handler {
+                        let Some(ah) = auth_handlers.get(&auth_handler.id) else {
+                            gw.range.err("auth handler not found");
+                            continue;
+                        };
+
+                        let service_name = self
+                            .service_for_range(&ah.range)
+                            .ok_or(
+                                ah.range
+                                    .parse_err("unable to determine service for auth handler"),
+                            )?
+                            .name
+                            .clone();
+
+                        let loc = loc_from_range(self.app_root, &self.pc.file_set, ah.range)?;
+                        let params = self
+                            .schema
+                            .typ(&ah.encoding.auth_param)
+                            .map_err(|err| ah.encoding.auth_param.parse_err(err.to_string()))?;
+                        let auth_data = self
+                            .schema
+                            .typ(&ah.encoding.auth_data)
+                            .map_err(|err| ah.encoding.auth_data.parse_err(err.to_string()))?;
+                        Some(v1::AuthHandler {
+                            name: ah.name.clone(),
+                            doc: ah.doc.clone().unwrap_or_default(),
+                            pkg_path: loc.pkg_path.clone(),
+                            pkg_name: loc.pkg_name.clone(),
+                            loc: Some(loc),
+                            params: Some(params),
+                            auth_data: Some(auth_data),
+                            service_name,
+                        })
+                    } else {
+                        None
+                    };
+
+                    let service_name = self
+                        .service_for_range(&gw.range)
+                        .ok_or(
+                            gw.range
+                                .parse_err("unable to determine service for gateway"),
+                        )?
+                        .name
+                        .clone();
+
+                    if let Some(first) = first_gateway {
+                        HANDLER.with(|h| {
+                            h.struct_span_err(
+                                gw.range.to_span(),
+                                "multiple gateways not yet supported",
+                            )
+                            .span_help(first.range.to_span(), "previous gateway defined here")
+                            .emit();
+                        });
+                        continue;
+                    } else {
+                        first_gateway = Some(gw);
+                    }
+
+                    if let Some(ah) = &gw.auth_handler {
+                        if let Some(first) = first_auth_handler {
+                            HANDLER.with(|h| {
+                                h.struct_span_err(
+                                    ah.range.to_span(),
+                                    "multiple auth handlers not yet supported",
+                                )
+                                .span_help(
+                                    first.range.to_span(),
+                                    "previous auth handler defined here",
+                                )
+                                .emit();
+                            });
+                            continue;
+                        } else {
+                            first_auth_handler = Some(ah);
+                        }
+                    }
+
+                    self.data.auth_handler.clone_from(&auth_handler);
+
+                    if gw.name != "api-gateway" {
+                        gw.range.err("only the 'api-gateway' gateway is supported");
+                        continue;
+                    }
+                    let encore_name = DEFAULT_API_GATEWAY_NAME.to_string();
+
+                    self.data.gateways.push(v1::Gateway {
+                        encore_name,
+                        explicit: Some(v1::gateway::Explicit {
+                            service_name,
+                            auth_handler,
+                        }),
+                    });
+                }
+            }
+        }
+
+        let mut seen_publishers = HashSet::new();
+        let mut seen_calls = HashSet::new();
+
+        let mut bucket_perms = HashMap::new();
+        for u in &self.parse.usages {
+            match u {
+                Usage::PublishTopic(publish) => {
+                    let svc =
+                        self.service_for_range(&publish.range)
+                            .ok_or(publish.range.parse_err(
+                                "unable to determine which service this 'publish' call is within",
+                            ))?;
+
+                    // Add the publisher if it hasn't already been seen.
+                    let key = (svc.name.clone(), publish.topic.name.clone());
+                    if seen_publishers.insert(key) {
+                        let service_name = svc.name.clone();
+
+                        let idx = topic_by_name
+                            .get(&publish.topic.name)
+                            .ok_or(publish.range.parse_err("could not resolve topic"))?
+                            .to_owned();
+                        let topic = &mut self.data.pubsub_topics[idx];
+                        topic
+                            .publishers
+                            .push(v1::pub_sub_topic::Publisher { service_name });
+                    }
+                }
+                Usage::AccessDatabase(access) => {
+                    let Some(svc) = self.service_for_range(&access.range) else {
+                        access
+                            .range
+                            .parse_err("cannot determine which service is accessing this database");
+                        continue;
+                    };
+
+                    let idx = svc_index.get(&svc.name).unwrap();
+                    self.data.svcs[*idx].databases.push(access.db.name.clone());
+                }
+
+                Usage::Bucket(access) => {
+                    let Some(svc) = self.service_for_range(&access.range) else {
+                        access
+                            .range
+                            .err("cannot determine which service is accessing this bucket");
+                        continue;
+                    };
+
+                    use objects::Operation;
+                    let ops = access.ops.iter().map(|op| match op {
+                        Operation::DeleteObject => v1::bucket_usage::Operation::DeleteObject,
+                        Operation::ListObjects => v1::bucket_usage::Operation::ListObjects,
+                        Operation::ReadObjectContents => {
+                            v1::bucket_usage::Operation::ReadObjectContents
+                        }
+                        Operation::WriteObject => v1::bucket_usage::Operation::WriteObject,
+                        Operation::UpdateObjectMetadata => {
+                            v1::bucket_usage::Operation::UpdateObjectMetadata
+                        }
+                        Operation::GetObjectMetadata => {
+                            v1::bucket_usage::Operation::GetObjectMetadata
+                        }
+                        Operation::GetPublicUrl => v1::bucket_usage::Operation::GetPublicUrl,
+                        Operation::SignedUploadUrl => v1::bucket_usage::Operation::SignedUploadUrl,
+                        Operation::SignedDownloadUrl => {
+                            v1::bucket_usage::Operation::SignedDownloadUrl
+                        }
+                    } as i32);
+
+                    let idx = svc_index.get(&svc.name).unwrap();
+                    bucket_perms
+                        .entry((*idx, &access.bucket.name))
+                        .or_insert(vec![])
+                        .extend(ops);
+                }
+
+                Usage::CallEndpoint(call) => {
+                    let src_service = self
+                        .service_for_range(&call.range)
+                        .ok_or(call.range.parse_err("unable to determine service for call"))?
+                        .name
+                        .clone();
+                    let dst_service = call.endpoint.0.clone();
+                    let dst_endpoint = call.endpoint.1.clone();
+
+                    let dst_idx = svc_to_pkg_index
+                        .get(&dst_service)
+                        .ok_or(
+                            call.range
+                                .parse_err("could not resolve destination service"),
+                        )?
+                        .to_owned();
+
+                    let dst_pkg_rel_path = self.data.pkgs[dst_idx].rel_path.clone();
+
+                    let src_idx = svc_to_pkg_index
+                        .get(&src_service)
+                        .ok_or(call.range.parse_err("could not resolve calling service"))?
+                        .to_owned();
+                    let src_pkg = &mut self.data.pkgs[src_idx];
+
+                    let call_key = (src_service, dst_service, dst_endpoint.clone());
+                    if seen_calls.insert(call_key) {
+                        src_pkg.rpc_calls.push(v1::QualifiedName {
+                            pkg: dst_pkg_rel_path.clone(),
+                            name: dst_endpoint,
+                        });
+                    }
+                }
+            }
+        }
+
+        // Add the computed bucket permissions to the services.
+        for ((svc_idx, bucket), mut operations) in bucket_perms {
+            // Make the bucket perms sorted and unique.
+            operations.sort();
+            operations.dedup();
+            self.data.svcs[svc_idx].buckets.push(v1::BucketUsage {
+                bucket: bucket.clone(),
+                operations,
+            });
+        }
+
+        // Sort the packages for deterministic output.
+        self.data.pkgs.sort_by(|a, b| a.name.cmp(&b.name));
+
+        // Remove duplicate secrets.
+        for pkg in &mut self.data.pkgs {
+            pkg.secrets.sort();
+            pkg.secrets.dedup();
+        }
+
+        for svc in &mut self.data.svcs {
+            // Remove duplicate database access.
+            svc.databases.sort();
+            svc.databases.dedup();
+
+            // Sort buckets by name for deterministic output.
+            svc.buckets.sort_by(|a, b| a.bucket.cmp(&b.bucket));
+
+            // Sort the endpoints for deterministic output.
+            svc.rpcs.sort_by(|a, b| a.name.cmp(&b.name));
+        }
+
+        // If there is no gateway, add a default one.
+        if self.data.gateways.is_empty() {
+            self.data.gateways.push(v1::Gateway {
+                encore_name: "api-gateway".to_string(),
+                explicit: None,
+            });
+        }
+
+        self.data.decls = self.schema.into_decls();
+        Ok(self.data)
+    }
+
+    fn pubsub_topic(&mut self, topic: &pubsub_topic::Topic) -> PResult<v1::PubSubTopic> {
+        use pubsub_topic::DeliveryGuarantee;
+        let message_type = self.schema.typ(&topic.message_type).map_err(|e| {
+            topic
+                .message_type
+                .parse_err(format!("could not resolve message type: {e}"))
+        })?;
+        Ok(v1::PubSubTopic {
+            name: topic.name.clone(),
+            doc: topic.doc.clone(),
+            message_type: Some(message_type),
+            delivery_guarantee: match topic.delivery_guarantee {
+                DeliveryGuarantee::AtLeastOnce => v1::pub_sub_topic::DeliveryGuarantee::AtLeastOnce,
+                DeliveryGuarantee::ExactlyOnce => v1::pub_sub_topic::DeliveryGuarantee::ExactlyOnce,
+            } as i32,
+            ordering_key: topic.ordering_attribute.clone().unwrap_or_default(),
+            publishers: vec![],    // filled in below
+            subscriptions: vec![], // filled in below
+        })
+    }
+
+    fn pubsub_subscription(
+        &self,
+        bind: &Bind,
+        sub: &pubsub_subscription::Subscription,
+    ) -> PResult<v1::pub_sub_topic::Subscription> {
+        let service_name = self
+            .service_for_range(&bind.range.unwrap_or(sub.range))
+            .ok_or(
+                sub.range
+                    .parse_err("unable to determine which service the subscription belongs to"),
+            )?
+            .name
+            .clone();
+
+        Ok(v1::pub_sub_topic::Subscription {
+            name: sub.name.clone(),
+            service_name,
+            ack_deadline: sub.config.ack_deadline.as_nanos() as i64,
+            message_retention: sub.config.message_retention.as_nanos() as i64,
+            max_concurrency: sub.config.max_concurrency.map(|v| v as i32),
+            retry_policy: Some(v1::pub_sub_topic::RetryPolicy {
+                min_backoff: sub.config.min_retry_backoff.as_nanos() as i64,
+                max_backoff: sub.config.max_retry_backoff.as_nanos() as i64,
+                max_retries: sub.config.max_retries as i64,
+            }),
+        })
+    }
+
+    fn sql_database(&self, db: &sqldb::SQLDatabase) -> PResult<v1::SqlDatabase> {
+        // Transform the migrations into the metadata format.
+        let (migration_rel_path, migrations, allow_non_sequential_migrations) = match &db.migrations
+        {
+            Some(spec) => {
+                let rel_path = self
+                    .rel_path_string(&spec.dir)
+                    .ok_or(spec.parse_err("unable to resolve migration directory"))?;
+
+                let migrations = spec
+                    .migrations
+                    .iter()
+                    .map(|m| v1::DbMigration {
+                        filename: m.file_name.clone(),
+                        description: m.description.clone(),
+                        number: m.number,
+                    })
+                    .collect::<Vec<_>>();
+                (Some(rel_path), migrations, spec.non_seq_migrations)
+            }
+            None => (None, vec![], false),
+        };
+
+        Ok(v1::SqlDatabase {
+            name: db.name.clone(),
+            doc: db.doc.clone(),
+            migration_rel_path,
+            migrations,
+            allow_non_sequential_migrations,
+        })
+    }
+
+    fn bucket(&self, bkt: &objects::Bucket) -> v1::Bucket {
+        v1::Bucket {
+            name: bkt.name.clone(),
+            doc: bkt.doc.clone(),
+            versioned: bkt.versioned,
+            public: bkt.public,
+        }
+    }
+
+    /// Compute the relative path from the app root.
+    /// It reports an error if the path is not under the app root.
+    fn rel_path<'b>(&self, path: &'b Path) -> Option<&'b Path> {
+        path.strip_prefix(self.app_root).ok()
+    }
+
+    /// Compute the relative path from the app root as a String.
+    fn rel_path_string(&self, path: &Path) -> Option<String> {
+        let suffix = self.rel_path(path)?;
+        suffix.to_str().map(|s| s.to_string())
+    }
+
+    fn service_for_range(&self, range: &Range) -> Option<&Service> {
+        let path = match range.file(&self.pc.file_set) {
+            FilePath::Real(path) => path,
+            FilePath::Custom(_) => return None,
+        };
+        self.parse
+            .services
+            .iter()
+            .find(|svc| path.starts_with(svc.root.as_path()))
+    }
+}
+
+impl respath::Path {
+    fn to_meta(&self) -> v1::Path {
+        use respath::{Segment, ValueType};
+        use v1::path_segment::{ParamType, SegmentType};
+        v1::Path {
+            r#type: v1::path::Type::Url as i32,
+            segments: self
+                .segments
+                .iter()
+                .map(|seg| match seg.get() {
+                    Segment::Literal(lit) => v1::PathSegment {
+                        r#type: SegmentType::Literal as i32,
+                        value_type: ParamType::String as i32,
+                        value: lit.clone(),
+                        validation: None,
+                    },
+                    Segment::Param {
+                        name,
+                        value_type,
+                        validation,
+                    } => v1::PathSegment {
+                        r#type: SegmentType::Param as i32,
+                        value_type: match value_type {
+                            ValueType::String => ParamType::String as i32,
+                            ValueType::Int => ParamType::Int as i32,
+                            ValueType::Bool => ParamType::Bool as i32,
+                        },
+                        value: name.clone(),
+                        validation: validation.as_ref().map(validation::Expr::to_pb),
+                    },
+                    Segment::Wildcard { name, validation } => v1::PathSegment {
+                        r#type: SegmentType::Wildcard as i32,
+                        value_type: ParamType::String as i32,
+                        value: name.clone(),
+                        validation: validation.as_ref().map(validation::Expr::to_pb),
+                    },
+                    Segment::Fallback { name, validation } => v1::PathSegment {
+                        r#type: SegmentType::Fallback as i32,
+                        value_type: ParamType::String as i32,
+                        value: name.clone(),
+                        validation: validation.as_ref().map(validation::Expr::to_pb),
+                    },
+                })
+                .collect(),
+        }
+    }
+}
+
+fn new_meta() -> v1::Data {
+    v1::Data {
+        module_path: "app".to_string(),
+        app_revision: "".to_string(),
+        uncommitted_changes: false,
+        decls: vec![],
+        pkgs: vec![],
+        svcs: vec![],
+        auth_handler: None,
+        cron_jobs: vec![],
+        pubsub_topics: vec![],
+        middleware: vec![],
+        cache_clusters: vec![],
+        experiments: vec![],
+        metrics: vec![],
+        sql_databases: vec![],
+        buckets: vec![],
+        gateways: vec![],
+        language: v1::Lang::Typescript as i32,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use swc_common::errors::{Handler, HANDLER};
+    use swc_common::{Globals, SourceMap, GLOBALS};
+    use tempdir::TempDir;
+
+    use crate::parser::parser::Parser;
+    use crate::parser::resourceparser::PassOneParser;
+    use crate::testutil::testresolve::TestResolver;
+    use crate::testutil::JS_RUNTIME_PATH;
+
+    use super::*;
+
+    fn parse(tmp_dir: &Path, src: &str) -> anyhow::Result<v1::Data> {
+        let globals = Globals::new();
+        let cm: Rc<SourceMap> = Default::default();
+        let errs = Rc::new(Handler::with_tty_emitter(
+            swc_common::errors::ColorConfig::Auto,
+            true,
+            false,
+            Some(cm.clone()),
+        ));
+
+        GLOBALS.set(&globals, || -> anyhow::Result<_> {
+            HANDLER.set(&errs, || -> anyhow::Result<_> {
+                let ar = txtar::from_str(src);
+                ar.materialize(tmp_dir)?;
+
+                let resolver = Box::new(TestResolver::new(tmp_dir.to_path_buf(), ar.clone()));
+                let pc = ParseContext::with_resolver(
+                    tmp_dir.to_path_buf(),
+                    Some(JS_RUNTIME_PATH.clone()),
+                    resolver,
+                    cm,
+                    errs.clone(),
+                )
+                .unwrap();
+                let _mods = pc.loader.load_archive(tmp_dir, &ar).unwrap();
+
+                let pass1 = PassOneParser::new(
+                    pc.file_set.clone(),
+                    pc.type_checker.clone(),
+                    Default::default(),
+                );
+                let parser = Parser::new(&pc, pass1);
+                let parse = parser.parse();
+                let md = compute_meta(&pc, &parse)?;
+                Ok(md)
+            })
+        })
+    }
+
+    #[test]
+    fn test_legacymeta() -> anyhow::Result<()> {
+        let src = r#"
+-- foo.ts --
+import { Bar } from './bar.ts';
+-- bar.ts --
+export const Bar = 5;
+        "#;
+        let tmp_dir = TempDir::new("tsparser-test")?;
+        let meta = parse(tmp_dir.path(), src)?;
+        assert_eq!(meta.svcs.len(), 0);
+        Ok(())
+    }
+}
diff --git a/tsparser/src/legacymeta/schema.rs b/tsparser/src/legacymeta/schema.rs
new file mode 100644
index 0000000000..30823e2166
--- /dev/null
+++ b/tsparser/src/legacymeta/schema.rs
@@ -0,0 +1,675 @@
+use std::borrow::Cow;
+use std::collections::HashMap;
+use std::path::Path;
+
+use anyhow::Result;
+use itertools::Itertools;
+use litparser::{ParseResult, ToParseErr};
+use swc_common::errors::HANDLER;
+
+use crate::encore::parser::schema::v1::r#type as styp;
+use crate::encore::parser::schema::v1::{self as schema};
+use crate::legacymeta::api_schema::strip_path_params;
+use crate::parser::parser::ParseContext;
+
+use crate::parser::resources::apis::api::Endpoint;
+use crate::parser::resources::apis::encoding::resolve_wire_spec;
+use crate::parser::types::{
+    drop_empty_or_void, unwrap_validated, Basic, Custom, EnumValue, FieldName, Generic, Interface,
+    Literal, Named, ObjectId, Type, Union, WireLocation,
+};
+use crate::parser::{FilePath, FileSet, Range};
+
+pub(super) struct SchemaBuilder<'a> {
+    pc: &'a ParseContext,
+    app_root: &'a Path,
+
+    decls: Vec<schema::Decl>,
+    obj_to_decl: HashMap<ObjectId, u32>,
+}
+
+struct BuilderCtx<'a, 'b> {
+    builder: &'a mut SchemaBuilder<'b>,
+
+    // The id of the current decl being built.
+    // Used for generating TypeParameterRefs.
+    decl_id: Option<u32>,
+}
+
+impl<'a> SchemaBuilder<'a> {
+    pub(super) fn new(pc: &'a ParseContext, app_root: &'a Path) -> Self {
+        SchemaBuilder {
+            pc,
+            app_root,
+            decls: Vec::new(),
+            obj_to_decl: HashMap::new(),
+        }
+    }
+
+    pub(super) fn into_decls(self) -> Vec<schema::Decl> {
+        self.decls
+    }
+
+    pub(super) fn typ(&mut self, typ: &Type) -> Result<schema::Type> {
+        let mut ctx = BuilderCtx {
+            builder: self,
+            decl_id: None,
+        };
+        ctx.typ(typ)
+    }
+
+    pub fn transform_handshake(&mut self, ep: &Endpoint) -> ParseResult<Option<schema::Type>> {
+        let mut ctx = BuilderCtx {
+            builder: self,
+            decl_id: None,
+        };
+        ctx.transform_handshake(ep)
+    }
+    pub fn transform_request(&mut self, ep: &Endpoint) -> ParseResult<Option<schema::Type>> {
+        let mut ctx = BuilderCtx {
+            builder: self,
+            decl_id: None,
+        };
+        ctx.transform_request(ep)
+    }
+
+    pub fn transform_response(&mut self, typ: Option<Type>) -> Result<Option<schema::Type>> {
+        match typ {
+            Some(typ) => Ok(Some(self.typ(&typ)?)),
+            None => Ok(None),
+        }
+    }
+}
+
+impl BuilderCtx<'_, '_> {
+    #[tracing::instrument(skip(self), ret, level = "trace")]
+    fn typ(&mut self, typ: &Type) -> Result<schema::Type> {
+        Ok(match typ {
+            Type::Basic(tt) => self.basic(tt),
+            Type::Array(tt) => {
+                let elem = self.typ(&tt.0)?;
+                schema::Type {
+                    typ: Some(styp::Typ::List(Box::new(schema::List {
+                        elem: Some(Box::new(elem)),
+                    }))),
+                    validation: None,
+                }
+            }
+            Type::Interface(tt) => self.interface(tt)?,
+
+            Type::Enum(tt) => schema::Type {
+                // Treat this as a union.
+                typ: Some(styp::Typ::Union(schema::Union {
+                    types: tt
+                        .members
+                        .iter()
+                        .cloned()
+                        .map(|m| schema::Type {
+                            typ: Some(styp::Typ::Literal(schema::Literal {
+                                value: Some(match m.value {
+                                    EnumValue::String(str) => schema::literal::Value::Str(str),
+                                    EnumValue::Number(n) => schema::literal::Value::Int(n),
+                                }),
+                            })),
+                            validation: None,
+                        })
+                        .collect(),
+                })),
+                validation: None,
+            },
+
+            Type::Union(union) => schema::Type {
+                typ: Some(styp::Typ::Union(schema::Union {
+                    types: self.types(&union.types)?,
+                })),
+                validation: None,
+            },
+            Type::Tuple(_) => anyhow::bail!("tuple types are not yet supported in schemas"),
+            Type::Literal(tt) => schema::Type {
+                typ: Some(styp::Typ::Literal(self.literal(tt))),
+                validation: None,
+            },
+            Type::Class(_) => anyhow::bail!("class types are not yet supported in schemas"),
+            Type::Named(tt) => {
+                let has_type_params = tt.obj.kind.type_params().count() > 0;
+                let state = self.builder.pc.type_checker.state();
+                if state.is_universe(tt.obj.module_id) {
+                    let underlying = tt.underlying(state);
+                    self.typ(&underlying)?
+                } else if has_type_params {
+                    tracing::trace!(
+                        "got named type with type arguments, resolving to underlying type"
+                    );
+                    // The type is a generic type.
+                    // To avoid having to reproduce the full generic type resolution,
+                    // concretize the type here.
+                    let underlying = tt.underlying(state);
+                    tracing::trace!(underlying = ?underlying, "underlying type");
+                    self.typ(&underlying)?
+                } else {
+                    schema::Type {
+                        typ: Some(styp::Typ::Named(self.named(tt)?)),
+                        validation: None,
+                    }
+                }
+            }
+            Type::Optional(_) => anyhow::bail!("optional types are not yet supported in schemas"),
+            Type::This(_) => anyhow::bail!("this types are not yet supported in schemas"),
+            Type::Generic(typ) => match typ {
+                Generic::TypeParam(param) => {
+                    let decl_id = self
+                        .decl_id
+                        .ok_or_else(|| anyhow::anyhow!("missing decl_id"))?;
+                    schema::Type {
+                        typ: Some(styp::Typ::TypeParameter(schema::TypeParameterRef {
+                            decl_id,
+                            param_idx: param.idx as u32,
+                        })),
+                        validation: None,
+                    }
+                }
+
+                typ => {
+                    anyhow::bail!(
+                        "unresolved generic types are not supported in schemas, got: {:#?}",
+                        typ
+                    )
+                }
+            },
+
+            Type::Validation(expr) => {
+                anyhow::bail!(
+                    "unresolved standalone validation expression not supported in api schema: {:#?}",
+                    expr
+                )
+            }
+
+            Type::Validated(validated) => {
+                let mut typ = self.typ(&validated.typ)?;
+                // Simplify the validation expression, if possible.
+                let expr = validated.expr.clone().simplify();
+                typ.validation = Some(expr.to_pb());
+                typ
+            }
+
+            Type::Custom(Custom::WireSpec(spec)) => self.typ(&spec.underlying)?,
+            Type::Custom(Custom::Decimal) => schema::Type {
+                typ: Some(styp::Typ::Builtin(schema::Builtin::Decimal as i32)),
+                validation: None,
+            },
+        })
+    }
+
+    fn basic(&self, typ: &Basic) -> schema::Type {
+        let b = |b: schema::Builtin| schema::Type {
+            typ: Some(styp::Typ::Builtin(b as i32)),
+            validation: None,
+        };
+        match typ {
+            Basic::Any | Basic::Unknown => b(schema::Builtin::Any),
+            Basic::String => b(schema::Builtin::String),
+            Basic::Boolean => b(schema::Builtin::Bool),
+            Basic::Date => b(schema::Builtin::Time),
+            Basic::Number => {
+                // TODO handle float/int distinction somehow
+                b(schema::Builtin::Float64)
+            }
+            Basic::Null => schema::Type {
+                typ: Some(styp::Typ::Literal(schema::Literal {
+                    value: Some(schema::literal::Value::Null(true)),
+                })),
+                validation: None,
+            },
+            Basic::BigInt => b(schema::Builtin::Decimal),
+            Basic::Void | Basic::Object | Basic::Symbol | Basic::Undefined | Basic::Never => {
+                HANDLER.with(|h| h.err(&format!("unsupported basic type in schema: {typ:?}")));
+                b(schema::Builtin::Any)
+            }
+        }
+    }
+
+    fn literal(&self, typ: &Literal) -> schema::Literal {
+        use schema::literal::Value;
+        let val = match typ.clone() {
+            Literal::String(val) => Value::Str(val),
+            Literal::Boolean(bool) => Value::Boolean(bool),
+            Literal::Number(float) => {
+                // If this can be represented as an int64, do that.
+                let int = float as i64;
+                if float == (int as f64) {
+                    Value::Int(int)
+                } else {
+                    Value::Float(float)
+                }
+            }
+            Literal::BigInt(str) => Value::Str(str),
+        };
+        schema::Literal { value: Some(val) }
+    }
+
+    fn interface(&mut self, typ: &Interface) -> Result<schema::Type> {
+        // Is this an index signature?
+        if let Some((key, value)) = typ.index.as_ref() {
+            if !typ.fields.is_empty() {
+                anyhow::bail!("index signature with additional fields is not supported");
+            }
+            return Ok(schema::Type {
+                typ: Some(styp::Typ::Map(Box::new(schema::Map {
+                    key: Some(Box::new(self.typ(key)?)),
+                    value: Some(Box::new(self.typ(value)?)),
+                }))),
+                validation: None,
+            });
+        }
+
+        let mut fields = Vec::with_capacity(typ.fields.len());
+        for f in &typ.fields {
+            let FieldName::String(field_name) = &f.name else {
+                continue;
+            };
+            let (tt, had_undefined) = drop_undefined_union(&f.typ);
+            let optional = f.optional || had_undefined;
+
+            let mut tags = vec![];
+
+            // Tag it as `encore:"optional"` if the field is optional.
+            if optional {
+                tags.push(schema::Tag {
+                    key: "encore".into(),
+                    name: "optional".into(),
+                    options: vec![],
+                });
+            }
+
+            let mut query_string_name = String::new();
+
+            // Resolve any wire spec overrides.
+            let (tt, validation_expr) = unwrap_validated(&tt);
+            let (mut typ, wire) = if let Some(spec) = resolve_wire_spec(tt) {
+                (
+                    self.typ(&spec.underlying)?,
+                    match &spec.location {
+                        WireLocation::Header => {
+                            let name = spec.name_override.clone().unwrap_or(field_name.clone());
+                            tags.push(schema::Tag {
+                                key: "header".into(),
+                                name,
+                                options: if f.optional {
+                                    vec!["optional".into()]
+                                } else {
+                                    vec![]
+                                },
+                            });
+
+                            Some(schema::WireSpec {
+                                location: Some(schema::wire_spec::Location::Header(
+                                    schema::wire_spec::Header {
+                                        name: spec.name_override.clone(),
+                                    },
+                                )),
+                            })
+                        }
+                        WireLocation::Query => {
+                            query_string_name =
+                                spec.name_override.clone().unwrap_or(field_name.clone());
+                            tags.push(schema::Tag {
+                                key: "query".into(),
+                                name: query_string_name.clone(),
+                                options: if f.optional {
+                                    vec!["optional".into()]
+                                } else {
+                                    vec![]
+                                },
+                            });
+
+                            Some(schema::WireSpec {
+                                location: Some(schema::wire_spec::Location::Query(
+                                    schema::wire_spec::Query {
+                                        name: spec.name_override.clone(),
+                                    },
+                                )),
+                            })
+                        }
+
+                        WireLocation::PubSubAttr => {
+                            let name = spec.name_override.clone().unwrap_or(field_name.clone());
+                            tags.push(schema::Tag {
+                                key: "pubsub-attr".into(),
+                                name,
+                                options: vec![],
+                            });
+
+                            None
+                        }
+
+                        WireLocation::Cookie => {
+                            let name = spec.name_override.as_ref().unwrap_or(field_name);
+                            tags.push(schema::Tag {
+                                key: "cookie".into(),
+                                name: name.clone(),
+                                options: if f.optional {
+                                    vec!["optional".into()]
+                                } else {
+                                    vec![]
+                                },
+                            });
+
+                            Some(schema::WireSpec {
+                                location: Some(schema::wire_spec::Location::Cookie(
+                                    schema::wire_spec::Cookie {
+                                        name: spec.name_override.clone(),
+                                    },
+                                )),
+                            })
+                        }
+
+                        WireLocation::HttpStatus => {
+                            tags.push(schema::Tag {
+                                key: "encore".into(),
+                                name: "httpstatus".into(),
+                                options: if f.optional {
+                                    vec!["optional".into()]
+                                } else {
+                                    vec![]
+                                },
+                            });
+
+                            Some(schema::WireSpec {
+                                location: Some(schema::wire_spec::Location::HttpStatus(
+                                    schema::wire_spec::HttpStatus {},
+                                )),
+                            })
+                        }
+                    },
+                )
+            } else {
+                (self.typ(tt)?, None)
+            };
+
+            // Propagate the validation expression to the field.
+            if let Some(expr) = validation_expr {
+                typ.validation = Some(expr.to_pb());
+            }
+
+            let raw_tag = tags
+                .iter()
+                .map(|tag| {
+                    let mut s = tag.key.clone();
+                    s.push(':');
+                    s.push('"');
+                    s.push_str(&tag.name);
+                    for opt in &tag.options {
+                        s.push(',');
+                        s.push_str(opt);
+                    }
+                    s.push('"');
+                    s
+                })
+                .join(" ");
+
+            let doc = self
+                .builder
+                .pc
+                .loader
+                .module_containing_pos(f.range.start)
+                .and_then(|module| module.preceding_comments(f.range.start));
+            fields.push(schema::Field {
+                typ: Some(typ),
+                name: field_name.clone(),
+                json_name: field_name.clone(),
+                optional,
+                wire,
+                tags,
+                raw_tag,
+                query_string_name,
+                doc: doc.unwrap_or_else(|| "".into()),
+            });
+        }
+
+        Ok(schema::Type {
+            typ: Some(styp::Typ::Struct(schema::Struct { fields })),
+            validation: None,
+        })
+    }
+
+    fn named(&mut self, typ: &Named) -> Result<schema::Named> {
+        let type_arguments = self.types(&typ.type_arguments)?;
+        let obj = &typ.obj;
+        if let Some(decl_id) = self.builder.obj_to_decl.get(&obj.id) {
+            return Ok(schema::Named {
+                id: *decl_id,
+                type_arguments,
+            });
+        }
+
+        // Allocate a new decl.
+        let id = self.builder.decls.len() as u32;
+        let Some(name) = typ.obj.name.as_ref() else {
+            anyhow::bail!("missing name for named object");
+        };
+
+        // Allocate the object and add it to the list without the underlying type.
+        // We'll add the underlying type afterwards to properly handle recursive types.
+        let loc = loc_from_range(self.builder.app_root, &self.builder.pc.file_set, obj.range)?;
+
+        let decl = schema::Decl {
+            id,
+            name: name.clone(),
+            r#type: None,        // computed below
+            type_params: vec![], // TODO
+            doc: "".into(),      // TODO
+            loc: Some(loc),
+        };
+        self.builder.decls.push(decl);
+        self.builder.obj_to_decl.insert(obj.id, id);
+
+        let obj_typ = self.builder.pc.type_checker.resolve_obj_type(obj);
+        let obj_typ = self
+            .builder
+            .pc
+            .type_checker
+            .concrete(obj.module_id, &obj_typ);
+
+        let mut nested = BuilderCtx {
+            builder: self.builder,
+            decl_id: Some(id),
+        };
+
+        let schema_typ = nested.typ(&obj_typ)?;
+        self.builder.decls.get_mut(id as usize).unwrap().r#type = Some(schema_typ);
+
+        Ok(schema::Named { id, type_arguments })
+    }
+
+    fn new_named_from_type(
+        &mut self,
+        name: String,
+        underlying: Type,
+        range: Range,
+        type_arguments: Vec<Type>,
+    ) -> Result<schema::Named> {
+        let type_arguments = self.types(&type_arguments)?;
+        let underlying = self.typ(&underlying)?;
+
+        // Allocate a new decl.
+        let id = self.builder.decls.len() as u32;
+        // Allocate the object and add it to the list without the underlying type.
+        // We'll add the underlying type afterwards to properly handle recursive types.
+        let loc = loc_from_range(self.builder.app_root, &self.builder.pc.file_set, range)?;
+        let decl = schema::Decl {
+            id,
+            name: name.clone(),
+            r#type: Some(underlying),
+            type_params: vec![], // TODO
+            doc: "".into(),      // TODO
+            loc: Some(loc),
+        };
+        self.builder.decls.push(decl);
+        Ok(schema::Named { id, type_arguments })
+    }
+
+    fn types(&mut self, types: &[Type]) -> Result<Vec<schema::Type>> {
+        let mut result = Vec::with_capacity(types.len());
+        for t in types {
+            result.push(self.typ(t)?);
+        }
+        Ok(result)
+    }
+
+    fn transform_handshake(&mut self, ep: &Endpoint) -> ParseResult<Option<schema::Type>> {
+        let schema = ep.encoding.raw_handshake_schema.as_ref().map(|s| s.get());
+        self.transform_request_type(ep, schema).map_err(|err| {
+            let sp = ep
+                .encoding
+                .raw_handshake_schema
+                .as_ref()
+                .map_or(ep.range.to_span(), |s| s.span());
+            sp.parse_err(err.to_string())
+        })
+    }
+    fn transform_request(&mut self, ep: &Endpoint) -> ParseResult<Option<schema::Type>> {
+        let schema = ep.encoding.raw_req_schema.as_ref().map(|s| s.get());
+        self.transform_request_type(ep, schema).map_err(|err| {
+            let sp = ep
+                .encoding
+                .raw_req_schema
+                .as_ref()
+                .map_or(ep.range.to_span(), |s| s.span());
+            sp.parse_err(err.to_string())
+        })
+    }
+
+    fn transform_request_type(
+        &mut self,
+        ep: &Endpoint,
+        raw_schema: Option<&Type>,
+    ) -> Result<Option<schema::Type>> {
+        let Some(typ) = raw_schema.cloned() else {
+            return Ok(None);
+        };
+
+        let rs = self.builder.pc.type_checker.state();
+        Ok(match typ {
+            Type::Interface(mut interface) => {
+                strip_path_params(&ep.encoding.path, &mut interface);
+                let Some(typ) = drop_empty_or_void(Type::Interface(interface)) else {
+                    return Ok(None);
+                };
+                Some(self.typ(&typ)?)
+            }
+            Type::Named(ref named) => {
+                let underlying = named.underlying(rs).clone();
+                if let Type::Interface(mut iface) = underlying {
+                    strip_path_params(&ep.encoding.path, &mut iface);
+                    let obj = &named.obj;
+                    let Some(underlying) = drop_empty_or_void(Type::Interface(iface)) else {
+                        return Ok(None);
+                    };
+
+                    let named = self.new_named_from_type(
+                        obj.name.clone().unwrap(),
+                        underlying,
+                        obj.range,
+                        named.type_arguments.clone(),
+                    )?;
+
+                    return Ok(Some(schema::Type {
+                        typ: Some(styp::Typ::Named(named)),
+                        validation: None,
+                    }));
+                } else {
+                    match drop_empty_or_void(typ) {
+                        Some(typ) => Some(self.typ(&typ)?),
+                        None => None,
+                    }
+                }
+            }
+            _ => match drop_empty_or_void(typ) {
+                Some(typ) => Some(self.typ(&typ)?),
+                None => None,
+            },
+        })
+    }
+}
+
+/// If typ is a union type containing, drop the undefined type and return the modified
+/// union and `true` to indicate the type included "| undefined".
+/// Otherwise, returns the original type and `false`.
+fn drop_undefined_union(typ: &Type) -> (Cow<'_, Type>, bool) {
+    if let Type::Union(union) = &typ {
+        for (i, t) in union.types.iter().enumerate() {
+            if let Type::Basic(Basic::Undefined) = &t {
+                // If we have a union with only two types, return the other type.
+                return if union.types.len() == 2 {
+                    (Cow::Borrowed(&union.types[1 - i]), true)
+                } else {
+                    let mut types = union.types.clone();
+                    types.swap_remove(i);
+                    (Cow::Owned(Type::Union(Union { types })), true)
+                };
+            }
+        }
+    }
+
+    (Cow::Borrowed(typ), false)
+}
+
+pub(super) fn loc_from_range(
+    app_root: &Path,
+    fset: &FileSet,
+    range: Range,
+) -> ParseResult<schema::Loc> {
+    let loc = range.loc(fset)?;
+    let (pkg_path, pkg_name, filename) = match loc.file {
+        FilePath::Custom(ref str) => {
+            return Err(range.parse_err(format!("unsupported file path in schema: {str}")));
+        }
+        FilePath::Real(buf) => match buf.strip_prefix(app_root) {
+            Ok(rel_path) => {
+                let file_name = rel_path
+                    .file_name()
+                    .map(|s| s.to_string_lossy().to_string())
+                    .ok_or(range.parse_err("missing file name"))?;
+                let pkg_name = rel_path
+                    .parent()
+                    .and_then(|p| p.file_name())
+                    .or_else(|| app_root.file_name())
+                    .map(|s| s.to_string_lossy().to_string())
+                    .ok_or(range.parse_err("missing package name"))?;
+                let pkg_path = rel_path
+                    .parent()
+                    .map_or(".".to_string(), |s| s.to_string_lossy().to_string());
+                (pkg_path, pkg_name, file_name)
+            }
+            Err(_) => {
+                // The file is not relative to the app root.
+                // Use a simplified path.
+                let file_name = buf
+                    .file_name()
+                    .map(|s| s.to_string_lossy().to_string())
+                    .ok_or(range.parse_err(format!("missing file name: {}", buf.display())))?;
+                let pkg_name = buf
+                    .parent()
+                    .and_then(|p| p.file_name())
+                    .map(|s| s.to_string_lossy().to_string())
+                    .ok_or(
+                        range.parse_err(format!("missing package name for {}", buf.display())),
+                    )?;
+                let pkg_path = format!("unknown/{pkg_name}");
+                (pkg_path, pkg_name, file_name)
+            }
+        },
+    };
+
+    Ok(schema::Loc {
+        pkg_path,
+        pkg_name,
+        filename,
+        start_pos: loc.start_pos as i32,
+        end_pos: loc.end_pos as i32,
+        src_line_start: loc.src_line_start as i32,
+        src_line_end: loc.src_line_end as i32,
+        src_col_start: loc.src_col_start as i32,
+        src_col_end: loc.src_col_end as i32,
+    })
+}
diff --git a/tsparser/src/lib.rs b/tsparser/src/lib.rs
new file mode 100644
index 0000000000..792882a6fa
--- /dev/null
+++ b/tsparser/src/lib.rs
@@ -0,0 +1,25 @@
+pub mod app;
+pub mod builder;
+mod legacymeta;
+pub mod parser;
+mod span_err;
+
+pub mod encore {
+    pub mod parser {
+        pub mod meta {
+            pub mod v1 {
+                include!(concat!(env!("OUT_DIR"), "/encore.parser.meta.v1.rs"));
+            }
+        }
+
+        pub mod schema {
+            pub mod v1 {
+                include!(concat!(env!("OUT_DIR"), "/encore.parser.schema.v1.rs"));
+            }
+        }
+    }
+}
+
+mod runtimeresolve;
+#[cfg(test)]
+pub mod testutil;
diff --git a/tsparser/src/parser/doc_comments.rs b/tsparser/src/parser/doc_comments.rs
new file mode 100644
index 0000000000..70ff5fa2e9
--- /dev/null
+++ b/tsparser/src/parser/doc_comments.rs
@@ -0,0 +1,198 @@
+/// Compute the doc comment on the line(s) immediately preceding the given position.
+/// It returns None if there are no comments.
+pub fn doc_comments_before(
+    source_map: &swc_common::SourceMap,
+    comments: &dyn swc_common::comments::Comments,
+    pos: swc_common::BytePos,
+) -> Option<String> {
+    // Get the file and line number of the position.
+    // It returns Err(file) if there is no line number information, in which
+    // case we won't be able to find any comments.
+    let Ok(res) = source_map.lookup_line(pos) else {
+        return None;
+    };
+
+    let candidates = comments.get_leading(pos).or_else(|| {
+        // If there are no comments at the pos, look up the start of the line
+        // and try there.
+        let start_pos = res.sf.lines.get(res.line)?;
+        comments.get_leading(*start_pos)
+    })?;
+
+    // The list of comments includes all consecutive comments in the AST, even if
+    // there are lines without comments in-between. We only want to include the comments that
+    // are attached to each other.
+
+    let mut comments = Vec::new();
+
+    // Iterate over the comments in reverse. For every comment, ensure the line number
+    for (i, c) in candidates.iter().rev().enumerate() {
+        if i > 0 && c.kind == swc_common::comments::CommentKind::Block {
+            // If we have a block comment that's not the first comment, ignore it.
+            // We only ever combine multiple line comments.
+            break;
+        }
+
+        // Ensure we don't have any gaps in lines between the AST node and the comment in question.
+        let Some(start_pos_ith_line) = res.sf.lines.get(res.line - (i + 1)) else {
+            break;
+        };
+        if c.span.hi >= *start_pos_ith_line {
+            comments.push(c);
+        } else {
+            break;
+        }
+
+        // If this was a block comment, don't consider any additional comments.
+        if c.kind == swc_common::comments::CommentKind::Block {
+            break;
+        }
+    }
+
+    if !comments.is_empty() {
+        let mut result = String::new();
+        for comment in comments.iter().rev() {
+            let is_jsdoc = comment.kind == swc_common::comments::CommentKind::Block
+                && comment.text.starts_with('*');
+
+            for line in comment.text.lines() {
+                let mut trimmed = line.trim();
+                if is_jsdoc {
+                    if trimmed.starts_with("/**") {
+                        trimmed = trimmed[3..].trim_start();
+                    } else if trimmed.starts_with("*/") {
+                        trimmed = trimmed[2..].trim_start();
+                    } else if trimmed.starts_with('*') {
+                        trimmed = trimmed[1..].trim_start();
+                    }
+                }
+                result.push_str(trimmed);
+                result.push('\n');
+            }
+        }
+
+        let trimmed = result.trim();
+        if !trimmed.is_empty() {
+            return Some(trimmed.to_string());
+        }
+    }
+
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use swc_common::comments::SingleThreadedComments;
+    use swc_common::input::StringInput;
+    use swc_common::{FileName, SourceMap, Spanned};
+    use swc_ecma_ast as ast;
+    use swc_ecma_parser::lexer::Lexer;
+    use swc_ecma_parser::{Parser, Syntax};
+
+    fn decl_comments(src: &str) -> Vec<Option<String>> {
+        let source_map: SourceMap = Default::default();
+        let file = source_map.new_source_file(FileName::Custom("test.ts".into()), src.into());
+        let comments: Box<SingleThreadedComments> = Box::default();
+        let lexer = Lexer::new(
+            Syntax::Typescript(Default::default()),
+            ast::EsVersion::Es2022,
+            StringInput::from(file.as_ref()),
+            Some(&comments),
+        );
+
+        let mut parser = Parser::new_from(lexer);
+        let ast = parser.parse_module().unwrap();
+
+        let mut result = Vec::new();
+        for it in ast.body {
+            if let ast::ModuleItem::Stmt(ast::Stmt::Decl(decl)) = it {
+                let c = doc_comments_before(&source_map, &comments, decl.span_lo());
+                result.push(c);
+            }
+        }
+
+        result
+    }
+
+    #[test]
+    fn parse_comments() {
+        let comments = decl_comments(
+            r#"
+let a = 0;
+
+// one-line
+let b = 1;
+
+// ignored due to line-break
+
+// one
+// two
+let c = 2;
+// ignored due to trailing comment
+
+/* line block
+comment */
+let d = 3;
+
+/* encroaching on decl
+*/ let e = 4;
+
+/* same line as decl */ let f = 5;
+
+// line comment
+/* followed by block
+comment */
+let g = 6;
+
+/* block */
+// line one
+// line two
+let h = 7;
+
+// line one
+/* block */
+// line two
+let i = 8;
+
+/**
+ * JSDoc comment
+ * multiple lines
+ */
+ let j = 9;
+            "#,
+        );
+        assert_eq!(
+            comments,
+            vec![
+                None,
+                Some("one-line".into()),
+                Some("one\ntwo".into()),
+                Some("line block\ncomment".into()),
+                Some("encroaching on decl".into()),
+                Some("same line as decl".into()),
+                Some("followed by block\ncomment".into()),
+                Some("line one\nline two".into()),
+                Some("line two".into()),
+                Some("JSDoc comment\nmultiple lines".into()),
+            ]
+        );
+    }
+
+    #[test]
+    fn parse_jsdoc() {
+        let comments = decl_comments(
+            r#"
+/**
+ * JSDoc comment
+ * multiple lines
+ */
+let i = 0;
+            "#,
+        );
+        assert_eq!(
+            comments,
+            vec![Some("JSDoc comment\nmultiple lines".into()),]
+        );
+    }
+}
diff --git a/tsparser/src/parser/fileset.rs b/tsparser/src/parser/fileset.rs
new file mode 100644
index 0000000000..ab5f55e3b8
--- /dev/null
+++ b/tsparser/src/parser/fileset.rs
@@ -0,0 +1,278 @@
+use std::io;
+use std::path::{Path, PathBuf};
+
+use crate::parser::doc_comments::doc_comments_before;
+use litparser::{ParseResult, ToParseErr};
+use serde::Serialize;
+use swc_common::errors::HANDLER;
+use swc_common::sync::Lrc;
+use swc_common::{Span, Spanned, SyntaxContext};
+
+pub struct FileSet {
+    source_map: Lrc<swc_common::SourceMap>,
+}
+
+impl std::fmt::Debug for FileSet {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("FileSet").finish()
+    }
+}
+
+impl FileSet {
+    pub(super) fn new(source_map: Lrc<swc_common::SourceMap>) -> Lrc<Self> {
+        Lrc::new(Self { source_map })
+    }
+
+    pub fn lookup_file<P: Into<Pos>>(&self, pos: P) -> Option<Lrc<SourceFile>> {
+        let pos = pos.into();
+        if pos.0 == 0 {
+            return None;
+        }
+        let f = self.source_map.lookup_byte_offset(pos.into());
+        Some(Lrc::new(SourceFile { file: f.sf }))
+    }
+
+    pub fn lookup_line<P: Into<Pos>>(&self, pos: P) -> (Lrc<SourceFile>, Option<usize>) {
+        let pos = pos.into();
+        match self.source_map.lookup_line(pos.into()) {
+            Ok(file_and_line) => {
+                let f = Lrc::new(SourceFile {
+                    file: file_and_line.sf,
+                });
+                (f, Some(file_and_line.line))
+            }
+            Err(file) => (Lrc::new(SourceFile { file }), None),
+        }
+    }
+
+    pub fn load_file(&self, path: &Path) -> io::Result<Lrc<SourceFile>> {
+        let file = self.source_map.load_file(path)?;
+        Ok(Lrc::new(SourceFile { file }))
+    }
+
+    pub fn new_source_file(&self, file_name: FilePath, src: String) -> Lrc<SourceFile> {
+        let file = self.source_map.new_source_file(file_name.into(), src);
+        Lrc::new(SourceFile { file })
+    }
+
+    pub fn preceding_comments(
+        &self,
+        comments: &dyn swc_common::comments::Comments,
+        pos: Pos,
+    ) -> Option<String> {
+        doc_comments_before(&self.source_map, comments, pos.into())
+    }
+}
+
+pub struct SourceFile {
+    file: Lrc<swc_common::SourceFile>,
+}
+
+impl SourceFile {
+    pub fn name(&self) -> FilePath {
+        match self.file.name {
+            swc_common::FileName::Real(ref p) => FilePath::Real(p.to_owned()),
+            swc_common::FileName::Custom(ref s) => FilePath::Custom(s.to_owned()),
+            _ => panic!("expected real file name"),
+        }
+    }
+}
+
+impl<'a> From<&'a SourceFile> for swc_common::input::StringInput<'a> {
+    fn from(file: &'a SourceFile) -> Self {
+        file.file.as_ref().into()
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub enum FilePath {
+    Real(PathBuf),
+    Custom(String),
+}
+
+impl FilePath {
+    pub fn is_tsx(&self) -> bool {
+        match self {
+            FilePath::Real(p) => p.extension().is_some_and(|ext| ext == "tsx"),
+            FilePath::Custom(p) => p.ends_with(".tsx"),
+        }
+    }
+
+    pub fn is_dts(&self) -> bool {
+        match self {
+            FilePath::Real(p) => p.ends_with(".d.ts"),
+            FilePath::Custom(p) => p.ends_with(".d.ts"),
+        }
+    }
+}
+
+impl std::fmt::Display for FilePath {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            FilePath::Real(p) => write!(f, "FilePath::Real({})", p.display()),
+            FilePath::Custom(p) => write!(f, "FilePath::Custom({p})"),
+        }
+    }
+}
+
+impl From<FilePath> for swc_common::FileName {
+    fn from(value: FilePath) -> Self {
+        match value {
+            FilePath::Real(p) => swc_common::FileName::Real(p),
+            FilePath::Custom(p) => swc_common::FileName::Custom(p),
+        }
+    }
+}
+
+impl From<PathBuf> for FilePath {
+    fn from(p: PathBuf) -> Self {
+        Self::Real(p)
+    }
+}
+
+impl From<&str> for FilePath {
+    fn from(p: &str) -> Self {
+        Self::from(PathBuf::from(p))
+    }
+}
+
+#[derive(Debug, Clone, Copy, Hash, PartialEq, Eq, Ord, PartialOrd, Serialize)]
+pub struct Pos(pub u32);
+
+impl From<Pos> for swc_common::BytePos {
+    fn from(value: Pos) -> Self {
+        swc_common::BytePos(value.0)
+    }
+}
+
+impl From<swc_common::BytePos> for Pos {
+    fn from(pos: swc_common::BytePos) -> Self {
+        Self(pos.0)
+    }
+}
+
+#[derive(Debug, Clone, Copy, Hash, PartialEq, Eq, Ord, PartialOrd, Serialize)]
+pub struct Range {
+    pub start: Pos,
+    pub end: Pos,
+}
+
+impl Range {
+    /// Report the file name this range is in.
+    pub fn file(&self, fset: &FileSet) -> FilePath {
+        let f = fset.source_map.lookup_byte_offset(self.start.into());
+        match &f.sf.name {
+            swc_common::FileName::Real(p) => FilePath::Real(p.to_owned()),
+            swc_common::FileName::Custom(s) => FilePath::Custom(s.to_owned()),
+            _ => panic!("expected real file name"),
+        }
+    }
+
+    /// Report the file name this range is in.
+    pub fn loc(&self, fset: &FileSet) -> ParseResult<Loc> {
+        let sp = self.to_span();
+        Ok(match fset.source_map.span_to_lines(sp) {
+            Ok(lines) => {
+                let file = match &lines.file.name {
+                    swc_common::FileName::Real(p) => FilePath::Real(p.to_owned()),
+                    swc_common::FileName::Custom(s) => FilePath::Custom(s.to_owned()),
+                    _ => {
+                        return Err(sp.parse_err("expected real file name"));
+                    }
+                };
+                match (lines.lines.first(), lines.lines.last()) {
+                    (Some(first), Some(last)) => Loc {
+                        file,
+                        start_pos: (self.start.0 - lines.file.start_pos.0) as usize,
+                        end_pos: (self.end.0 - lines.file.start_pos.0) as usize,
+                        src_line_start: first.line_index + 1,
+                        src_line_end: last.line_index + 1,
+                        src_col_start: first.start_col.0,
+                        src_col_end: last.end_col.0,
+                    },
+                    (_, _) => {
+                        return Err(sp.parse_err("missing line information"));
+                    }
+                }
+            }
+            Err(_) => {
+                return Err(sp.parse_err("missing file information"));
+            }
+        })
+    }
+
+    /// Whether the range contains another range.
+    pub fn contains(&self, other: &Self) -> bool {
+        self.start <= other.start && other.end <= self.end
+    }
+
+    pub fn to_span(&self) -> swc_common::Span {
+        swc_common::Span {
+            lo: swc_common::BytePos(self.start.0),
+            hi: swc_common::BytePos(self.end.0),
+            ctxt: SyntaxContext::empty(),
+        }
+    }
+
+    pub fn err(&self, msg: &str) {
+        HANDLER.with(|handler| handler.span_err(self.to_span(), msg))
+    }
+}
+
+impl Spanned for Range {
+    fn span(&self) -> Span {
+        self.to_span()
+    }
+}
+
+pub struct Loc {
+    pub file: FilePath,
+
+    /// Start and end positions within the file.
+    pub start_pos: usize,
+    pub end_pos: usize,
+
+    /// Start and end lines within the file.
+    pub src_line_start: usize,
+    pub src_line_end: usize,
+
+    /// Start and end columns within the line.
+    pub src_col_start: usize,
+    pub src_col_end: usize,
+}
+
+impl From<swc_common::Span> for Range {
+    fn from(span: swc_common::Span) -> Self {
+        Self {
+            start: Pos(span.lo.0),
+            end: Pos(span.hi.0),
+        }
+    }
+}
+
+impl From<Range> for swc_common::Span {
+    fn from(range: Range) -> Self {
+        swc_common::Span {
+            lo: range.start.into(),
+            hi: range.end.into(),
+            ctxt: SyntaxContext::empty(),
+        }
+    }
+}
+
+impl From<Range> for swc_common::MultiSpan {
+    fn from(range: Range) -> Self {
+        swc_common::MultiSpan::from_span(range.into())
+    }
+}
+
+impl Default for Range {
+    fn default() -> Self {
+        ZERO_RANGE
+    }
+}
+
+pub const ZERO_RANGE: Range = Range {
+    start: Pos(0),
+    end: Pos(0),
+};
diff --git a/tsparser/src/parser/mod.rs b/tsparser/src/parser/mod.rs
new file mode 100644
index 0000000000..cc6761763b
--- /dev/null
+++ b/tsparser/src/parser/mod.rs
@@ -0,0 +1,13 @@
+mod doc_comments;
+mod fileset;
+pub mod module_loader;
+#[allow(clippy::module_inception)]
+pub mod parser;
+pub mod resourceparser;
+pub mod resources;
+pub mod respath;
+mod service_discovery;
+pub mod types;
+pub mod usageparser;
+
+pub use fileset::{FilePath, FileSet, Pos, Range, ZERO_RANGE};
diff --git a/tsparser/src/parser/module_loader.rs b/tsparser/src/parser/module_loader.rs
new file mode 100644
index 0000000000..b2888af9ac
--- /dev/null
+++ b/tsparser/src/parser/module_loader.rs
@@ -0,0 +1,448 @@
+use std::cell::{OnceCell, RefCell};
+use std::collections::HashMap;
+use std::ffi::OsStr;
+use std::io;
+use std::path::{Path, PathBuf};
+
+use swc_common::comments::{Comments, NoopComments, SingleThreadedComments};
+use swc_common::errors::Handler;
+use swc_common::input::StringInput;
+use swc_common::sync::Lrc;
+use swc_common::{FileName, Mark, Span, Spanned};
+use swc_ecma_ast as ast;
+use swc_ecma_ast::EsVersion;
+use swc_ecma_loader::resolve::Resolve;
+use swc_ecma_parser::lexer::Lexer;
+use swc_ecma_parser::{Parser, Syntax};
+use swc_ecma_visit::FoldWith;
+use thiserror::Error;
+
+use crate::parser::fileset::SourceFile;
+use crate::parser::{FilePath, FileSet, Pos};
+
+// File extensions that should be parsed as modules
+const MODULE_EXTENSIONS: &[&str] = &["js", "ts", "mjs", "mts", "cjs", "cts", "jsx", "tsx"];
+
+/// A unique id for a module.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct ModuleId(pub usize);
+
+pub struct ModuleLoader {
+    errs: Lrc<Handler>,
+    file_set: Lrc<FileSet>,
+    resolver: Box<dyn Resolve>,
+    encore_gen_root: PathBuf,
+    by_path: RefCell<HashMap<FilePath, Lrc<Module>>>,
+
+    // The universe module, if it's been loaded.
+    universe: OnceCell<Lrc<Module>>,
+
+    /// The generated encore.gen/clients module.
+    encore_app_clients: OnceCell<Lrc<Module>>,
+    /// The generated encore.gen/auth module.
+    encore_auth: OnceCell<Lrc<Module>>,
+}
+
+impl std::fmt::Debug for ModuleLoader {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ModuleLoader")
+            .field("file_set", &self.file_set)
+            .field("mods", &self.by_path)
+            .finish()
+    }
+}
+
+#[derive(Debug, Error)]
+pub enum Error {
+    #[error("unable to resolve module {0}")]
+    UnableToResolve(String, #[source] anyhow::Error),
+    #[error("invalid filename {0}")]
+    InvalidFilename(FileName),
+    #[error("unable to load file from filesystem")]
+    LoadFile(#[source] io::Error),
+    #[error("error when parsing module")]
+    ParseError(swc_ecma_parser::error::Error),
+}
+
+impl Error {
+    pub fn span(&self) -> Option<Span> {
+        match self {
+            Error::UnableToResolve(..) | Error::InvalidFilename(_) | Error::LoadFile(_) => None,
+            Error::ParseError(e) => Some(e.span()),
+        }
+    }
+
+    pub fn msg(&self) -> String {
+        match self {
+            Error::UnableToResolve(s, source) => {
+                format!("unable to resolve module {s}: {source:?}")
+            }
+            Error::InvalidFilename(_) | Error::LoadFile(_) => self.to_string(),
+            Error::ParseError(e) => e.clone().into_kind().msg().to_string(),
+        }
+    }
+}
+
+impl ModuleLoader {
+    pub fn new(
+        errs: Lrc<Handler>,
+        file_set: Lrc<FileSet>,
+        resolver: Box<dyn Resolve>,
+        app_root: PathBuf,
+    ) -> Self {
+        let encore_gen_root = app_root.join("encore.gen");
+        Self {
+            errs,
+            file_set,
+            resolver,
+            encore_gen_root,
+            by_path: RefCell::new(HashMap::new()),
+            universe: OnceCell::new(),
+            encore_app_clients: OnceCell::new(),
+            encore_auth: OnceCell::new(),
+        }
+    }
+
+    pub fn modules(&self) -> Vec<Lrc<Module>> {
+        self.by_path.borrow().values().cloned().collect::<Vec<_>>()
+    }
+
+    pub fn module_containing_pos(&self, pos: Pos) -> Option<Lrc<Module>> {
+        let file = self.file_set.lookup_file(pos)?;
+        let path = file.name();
+        self.by_path.borrow().get(&path).cloned()
+    }
+
+    pub fn resolve_import_from_module(
+        &self,
+        module: &Module,
+        import_path: &str,
+    ) -> Result<Option<Lrc<Module>>, Error> {
+        self.resolve_import(&module.swc_file_path, import_path)
+    }
+
+    pub fn resolve_import(
+        &self,
+        from_file: &swc_common::FileName,
+        import_path: &str,
+    ) -> Result<Option<Lrc<Module>>, Error> {
+        // Special case for the generated clients.
+        // TODO: Fix this to do actual import path resolution.
+        // It's a bit tricky because we can't use the resolver since the files may not exist.
+        if import_path == "~encore/clients" {
+            return Ok(Some(self.encore_app_clients()));
+        } else if import_path == "~encore/auth" {
+            return Ok(Some(self.encore_auth()));
+        }
+
+        let target_file_path = {
+            // TODO: cache this
+            let mod_path = self
+                .resolver
+                .resolve(from_file, import_path)
+                .map_err(|err| Error::UnableToResolve(import_path.to_string(), err))?;
+            match mod_path {
+                FileName::Real(ref buf) => {
+                    if let Some(ext) = buf.extension().and_then(OsStr::to_str) {
+                        if !MODULE_EXTENSIONS.contains(&ext) {
+                            return Ok(None);
+                        }
+                    }
+
+                    // Check for the generated clients again, using the resolved path,
+                    // in case the "~encore/*" alias is not set up.
+                    if let Ok(suffix) = buf.strip_prefix(&self.encore_gen_root) {
+                        // Need to check for trailing slash since the resolved path
+                        // will be something like "clients/index.js".
+                        if suffix.starts_with("clients/") {
+                            return Ok(Some(self.encore_app_clients()));
+                        } else if suffix.starts_with("auth/") {
+                            return Ok(Some(self.encore_auth()));
+                        }
+                    }
+
+                    FilePath::Real(buf.clone())
+                }
+                FileName::Custom(ref str) => FilePath::Custom(str.clone()),
+                _ => return Err(Error::InvalidFilename(mod_path)),
+            }
+        };
+
+        if let Some(module) = self.by_path.borrow().get(&target_file_path) {
+            return Ok(Some(module.clone()));
+        }
+
+        // Determine the module path.
+        // https://www.typescriptlang.org/docs/handbook/module-resolution.html#relative-vs-non-relative-module-imports
+        let module_path = if import_path.starts_with("./")
+            || import_path.starts_with("../")
+            || import_path.starts_with('/')
+        {
+            None
+        } else {
+            Some(import_path.to_owned())
+        };
+
+        match target_file_path {
+            FilePath::Real(ref path) => self.load_fs_file(path.as_path(), module_path).map(Some),
+            FilePath::Custom(_) => self
+                .load_custom_file(target_file_path, "", module_path)
+                .map(Some),
+        }
+    }
+
+    /// Load a file from the filesystem into the module loader.
+    pub fn load_fs_file(
+        &self,
+        path: &Path,
+        module_path: Option<String>,
+    ) -> Result<Lrc<Module>, Error> {
+        // Is it already stored?
+        let file_name = FilePath::from(path.to_owned());
+        if let Some(module) = self.by_path.borrow().get(&file_name) {
+            return Ok(module.clone());
+        }
+
+        let file = self.file_set.load_file(path).map_err(Error::LoadFile)?;
+        let module = self.parse_and_store(file, module_path)?;
+        Ok(module)
+    }
+
+    /// Load a file from the filesystem into the module loader.
+    fn load_custom_file<S: Into<String>>(
+        &self,
+        file_name: FilePath,
+        src: S,
+        module_path: Option<String>,
+    ) -> Result<Lrc<Module>, Error> {
+        // Is it already stored?
+        if let Some(module) = self.by_path.borrow().get(&file_name) {
+            return Ok(module.clone());
+        }
+        let file = self
+            .file_set
+            .new_source_file(file_name.to_owned(), src.into());
+        let module = self.parse_and_store(file, module_path)?;
+        Ok(module)
+    }
+
+    pub fn universe(&self) -> Lrc<Module> {
+        self.universe
+            .get_or_init(|| {
+                let file = self
+                    .file_set
+                    .new_source_file(FilePath::Real("universe.ts".into()), UNIVERSE_TS.into());
+                self.parse_and_store(file, Some("__universe__".into()))
+                    .unwrap()
+            })
+            .to_owned()
+    }
+
+    pub fn encore_app_clients(&self) -> Lrc<Module> {
+        self.encore_app_clients
+            .get_or_init(|| {
+                let file = self
+                    .file_set
+                    .new_source_file(FilePath::Real("encore.gen/clients".into()), "".into());
+                self.parse_and_store(file, Some("encore.gen/clients".into()))
+                    .unwrap()
+            })
+            .to_owned()
+    }
+
+    pub fn encore_auth(&self) -> Lrc<Module> {
+        self.encore_auth
+            .get_or_init(|| {
+                let file = self
+                    .file_set
+                    .new_source_file(FilePath::Real("encore.gen/auth".into()), "".into());
+                self.parse_and_store(file, Some("encore.gen/auth".into()))
+                    .unwrap()
+            })
+            .to_owned()
+    }
+
+    /// Parse and store a file.
+    fn parse_and_store(
+        &self,
+        file: Lrc<SourceFile>,
+        module_path: Option<String>,
+    ) -> Result<Lrc<Module>, Error> {
+        let (ast, comments) = self.parse_file(file.clone())?;
+
+        let mut mods = self.by_path.borrow_mut();
+        let id = ModuleId(mods.len() + 1);
+
+        let module = Module::new(
+            self.file_set.clone(),
+            id,
+            file.name(),
+            module_path,
+            ast,
+            Some(comments),
+        );
+        mods.insert(module.file_path.clone(), module.clone());
+        Ok(module)
+    }
+
+    /// Parse a file.
+    fn parse_file(
+        &self,
+        file: Lrc<SourceFile>,
+    ) -> Result<(ast::Module, Box<SingleThreadedComments>), Error> {
+        let comments: Box<SingleThreadedComments> = Box::default();
+
+        let syntax = Syntax::Typescript(swc_ecma_parser::TsConfig {
+            tsx: file.name().is_tsx(),
+            dts: file.name().is_dts(),
+            decorators: true,
+            no_early_errors: false,
+            disallow_ambiguous_jsx_like: false,
+        });
+
+        let lexer = Lexer::new(
+            syntax,
+            EsVersion::Es2022,
+            StringInput::from(file.as_ref()),
+            Some(&comments),
+        );
+        let mut parser = Parser::new_from(lexer);
+        for e in parser.take_errors() {
+            e.into_diagnostic(&self.errs).emit();
+        }
+
+        let ast = parser.parse_module().map_err(Error::ParseError)?;
+
+        // Resolve identifiers.
+        let mut resolver = swc_ecma_transforms_base::resolver(Mark::new(), Mark::new(), true);
+        let ast_module = ast.fold_with(&mut resolver);
+
+        Ok((ast_module, comments))
+    }
+}
+
+pub struct Module {
+    file_set: Lrc<FileSet>,
+    pub id: ModuleId,
+    pub ast: swc_ecma_ast::Module,
+    pub file_path: FilePath,
+    pub swc_file_path: swc_common::FileName,
+    /// How the module was imported, if it's an external module.
+    pub module_path: Option<String>,
+    pub comments: Box<dyn Comments>,
+    cached_imports: OnceCell<Vec<ast::ImportDecl>>,
+}
+
+impl std::fmt::Debug for Module {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Module")
+            .field("id", &self.id)
+            .field("file_path", &self.file_path)
+            .field("swc_file_path", &self.swc_file_path)
+            .field("module_path", &self.module_path)
+            .finish()
+    }
+}
+
+impl Module {
+    fn new(
+        file_set: Lrc<FileSet>,
+        id: ModuleId,
+        file_path: FilePath,
+        module_path: Option<String>,
+        ast: ast::Module,
+        comments: Option<Box<dyn Comments>>,
+    ) -> Lrc<Self> {
+        let comments: Box<dyn Comments> = comments.unwrap_or_else(|| Box::new(NoopComments {}));
+        let swc_file_path = file_path.clone().into();
+        Lrc::new(Self {
+            file_set,
+            id,
+            ast,
+            file_path,
+            swc_file_path,
+            module_path,
+            comments,
+            cached_imports: OnceCell::new(),
+        })
+    }
+
+    pub fn imports(&self) -> &Vec<ast::ImportDecl> {
+        self.cached_imports
+            .get_or_init(move || imports_from_mod(&self.ast))
+    }
+
+    pub fn preceding_comments(&self, pos: Pos) -> Option<String> {
+        self.file_set.preceding_comments(&self.comments, pos)
+    }
+}
+
+impl Spanned for Module {
+    fn span(&self) -> Span {
+        self.ast.span
+    }
+}
+
+/// imports_from_mod returns the import declarations in the given module.
+fn imports_from_mod(ast: &ast::Module) -> Vec<ast::ImportDecl> {
+    (ast.body)
+        .iter()
+        .filter_map(|it| match &it {
+            ast::ModuleItem::ModuleDecl(ast::ModuleDecl::Import(imp)) => Some(imp.clone()),
+            _ => None,
+        })
+        .collect()
+}
+
+#[cfg(test)]
+impl ModuleLoader {
+    /// Injects a new file into the module loader.
+    /// If a file with that name has already been added it does nothing.
+    pub fn inject_file(&self, path: FilePath, src: &str) -> anyhow::Result<Lrc<Module>> {
+        // Check if the file has already been added if the file has a unique identity.
+        // For other file types (like anonymous files) don't check for this so that we can inject
+        //  multiple anonymous files for testing purposes.
+        match path {
+            FilePath::Real(..) => {
+                if let Some(module) = self.by_path.borrow().get(&path) {
+                    return Ok(module.clone());
+                }
+            }
+            FilePath::Custom(_) => {}
+        }
+
+        use swc_common::{Globals, GLOBALS};
+        let globals = Globals::new();
+        GLOBALS.set(&globals, || {
+            let file = self.file_set.new_source_file(path, src.into());
+            let module = self.parse_and_store(file, None)?;
+            Ok(module)
+        })
+    }
+
+    pub fn load_archive(
+        &self,
+        base: &Path,
+        ar: &txtar::Archive,
+    ) -> anyhow::Result<HashMap<FilePath, Lrc<Module>>> {
+        let mut result = HashMap::new();
+        for file in &ar.files {
+            if file.name.extension().is_none_or(|ext| ext != "ts") {
+                continue;
+            }
+
+            let file_name = FilePath::Real(base.join(&file.name));
+            let file = self.file_set.new_source_file(file_name, file.data.clone());
+            let module = self.parse_and_store(file, None)?;
+            result.insert(module.file_path.clone(), module);
+        }
+
+        if self.errs.has_errors() {
+            Err(anyhow::anyhow!("parse error"))
+        } else {
+            Ok(result)
+        }
+    }
+}
+
+const UNIVERSE_TS: &str = include_str!("./universe.ts");
diff --git a/tsparser/src/parser/parser.rs b/tsparser/src/parser/parser.rs
new file mode 100644
index 0000000000..6017d4c633
--- /dev/null
+++ b/tsparser/src/parser/parser.rs
@@ -0,0 +1,436 @@
+use std::collections::HashMap;
+use std::ffi::OsStr;
+use std::fmt::Formatter;
+use std::path::{Path, PathBuf};
+
+use anyhow::Result;
+use swc_common::errors::{Handler, HANDLER};
+use swc_common::sync::Lrc;
+use swc_common::{SourceMap, Spanned, DUMMY_SP};
+use swc_ecma_loader::resolve::Resolve;
+use swc_ecma_loader::resolvers::node::NodeModulesResolver;
+use swc_ecma_loader::TargetEnv;
+use walkdir::WalkDir;
+
+use crate::parser::module_loader::ModuleLoader;
+use crate::parser::resourceparser::bind::{Bind, BindKind};
+use crate::parser::resourceparser::PassOneParser;
+use crate::parser::resources::apis::service_client::ServiceClient;
+use crate::parser::resources::Resource;
+use crate::parser::service_discovery::{discover_services, DiscoveredService};
+use crate::parser::types::TypeChecker;
+use crate::parser::usageparser::{Usage, UsageResolver};
+use crate::parser::{FilePath, FileSet};
+use crate::runtimeresolve::{EncoreRuntimeResolver, TsConfigPathResolver};
+use crate::span_err::ErrReporter;
+
+use super::resourceparser::bind::ResourceOrPath;
+use super::resourceparser::UnresolvedBind;
+use super::resources::ResourcePath;
+
+pub struct ParseContext {
+    /// App root to parse for Encore resources.
+    /// The directory containing the 'encore.app' file.
+    pub app_root: PathBuf,
+
+    /// The module loader to use.
+    pub loader: Lrc<ModuleLoader>,
+
+    pub type_checker: Lrc<TypeChecker>,
+
+    /// The file set to use.
+    pub file_set: Lrc<FileSet>,
+
+    /// The error handler to emit errors to.
+    pub errs: Lrc<Handler>,
+}
+
+impl std::fmt::Debug for ParseContext {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ParseContext")
+            .field("app_root", &self.app_root)
+            .finish()
+    }
+}
+
+impl ParseContext {
+    pub fn new(
+        app_root: PathBuf,
+        js_runtime_path: Option<PathBuf>,
+        cm: Lrc<SourceMap>,
+        errs: Lrc<Handler>,
+    ) -> Result<Self> {
+        let resolver = NodeModulesResolver::with_export_conditions(
+            TargetEnv::Node,
+            Default::default(),
+            true,
+            vec!["bun".into(), "deno".into(), "types".into()],
+        );
+        Self::with_resolver(app_root, js_runtime_path, resolver, cm, errs)
+    }
+
+    pub fn with_resolver<R>(
+        app_root: PathBuf,
+        js_runtime_path: Option<PathBuf>,
+        resolver: R,
+        cm: Lrc<SourceMap>,
+        errs: Lrc<Handler>,
+    ) -> Result<Self>
+    where
+        R: Resolve + 'static,
+    {
+        let mut resolver =
+            EncoreRuntimeResolver::new(resolver, js_runtime_path, vec!["types".into()]);
+
+        // Do we have a tsconfig.json file in the app root?
+        {
+            let tsconfig_path = app_root.join("tsconfig.json");
+            if tsconfig_path.exists() {
+                let tsconfig = Lrc::new(TsConfigPathResolver::from_file(&tsconfig_path)?);
+                resolver = resolver.with_tsconfig_resolver(tsconfig.clone());
+            }
+        }
+
+        let file_set = FileSet::new(cm.clone());
+        let loader = Lrc::new(ModuleLoader::new(
+            errs.clone(),
+            file_set.clone(),
+            Box::new(resolver),
+            app_root.clone(),
+        ));
+        let type_checker = Lrc::new(TypeChecker::new(loader.clone()));
+
+        Ok(Self {
+            app_root,
+            loader,
+            type_checker,
+            file_set,
+            errs,
+        })
+    }
+}
+
+pub struct Parser<'a> {
+    pc: &'a ParseContext,
+    pass1: PassOneParser<'a>,
+}
+
+#[derive(Debug)]
+pub struct ParseResult {
+    pub resources: Vec<Resource>,
+    pub binds: Vec<Lrc<Bind>>,
+    pub usages: Vec<Usage>,
+    pub services: Vec<Service>,
+}
+
+impl<'a> Parser<'a> {
+    pub fn new(pc: &'a ParseContext, pass1: PassOneParser<'a>) -> Self {
+        Self { pc, pass1 }
+    }
+
+    /// Run the parser.
+    pub fn parse(mut self) -> ParseResult {
+        fn ignored(entry: &walkdir::DirEntry) -> bool {
+            match entry.file_name().to_str().unwrap_or_default() {
+                "node_modules" | "encore.gen" | "__tests__" => true,
+                x => {
+                    // Ignore hidden files and .{test,spec}.{ts,js} files.
+                    x.starts_with('.')
+                        || x.ends_with(".test.ts")
+                        || x.ends_with(".spec.ts")
+                        || x.ends_with(".test.js")
+                        || x.ends_with(".spec.js")
+                }
+            }
+        }
+
+        fn is_service(e: &walkdir::DirEntry) -> bool {
+            e.path().ends_with("encore.service.ts")
+        }
+
+        let walker = WalkDir::new(&self.pc.app_root)
+            .sort_by(|a, b| {
+                if is_service(a) {
+                    std::cmp::Ordering::Less
+                } else if is_service(b) {
+                    std::cmp::Ordering::Greater
+                } else {
+                    a.file_name().cmp(b.file_name())
+                }
+            })
+            .into_iter()
+            .filter_entry(|e| !ignored(e));
+
+        // Parse the modules in the app root.
+        let (mut resources, binds) = {
+            let loader = &self.pc.loader;
+            let mut all_resources = Vec::new();
+            let mut all_binds = Vec::new();
+
+            // Keep track of the current service being parsed.
+            let mut curr_service: Option<(PathBuf, String)> = None;
+
+            for entry in walker {
+                let entry = match entry {
+                    Ok(e) => e,
+                    Err(err) => {
+                        HANDLER.with(|h| h.err(&format!("unable to walk filesystem: {err}")));
+                        continue;
+                    }
+                };
+
+                if entry.file_type().is_dir() {
+                    // Is this directory outside the service directory?
+                    // If so, unset the current service.
+                    if let Some((service_dir, _)) = &curr_service {
+                        if !entry.path().starts_with(service_dir) {
+                            curr_service = None;
+                        }
+                    }
+                    continue;
+                }
+
+                // Skip non-files.
+                if !entry.file_type().is_file() {
+                    continue;
+                }
+
+                let path = entry.path();
+
+                // Skip non-".ts" files.
+                let ext = entry.path().extension().and_then(OsStr::to_str);
+                if ext.is_none_or(|ext| ext != "ts") {
+                    continue;
+                }
+
+                // Parse the module.
+                let module = match loader.load_fs_file(entry.path(), None) {
+                    Ok(module) => module,
+                    Err(err) => {
+                        HANDLER.with(|handler| {
+                            if let Some(span) = err.span() {
+                                handler.span_err(span, &err.msg());
+                            } else {
+                                handler.err(&err.msg());
+                            }
+                        });
+                        continue;
+                    }
+                };
+                let module_span = module.ast.span();
+                let service_name = curr_service.as_ref().map(|(_, name)| name.as_str());
+                let (resources, binds) = self.pass1.parse(module, service_name);
+
+                // Is this a service file? If so, make sure there was a service defined.
+                if is_service(&entry) {
+                    let found = resources.iter().any(|r| matches!(r, Resource::Service(_)));
+                    if !found {
+                        module_span
+                            .shrink_to_lo()
+                            .err("encore.service.ts must define a Service resource");
+                    }
+                }
+
+                // Check if we should update the service being parsed.
+                for res in &resources {
+                    if let Resource::Service(svc) = res {
+                        let Some(parent) = path.parent() else {
+                            HANDLER.with(|h| {
+                                h.err(&format!("path {path:?} does not have a parent directory"))
+                            });
+                            continue;
+                        };
+
+                        curr_service = Some((parent.to_path_buf(), svc.name.clone()));
+                        break;
+                    }
+                }
+
+                all_resources.extend(resources);
+                all_binds.extend(binds);
+            }
+
+            (all_resources, all_binds)
+        };
+
+        // Resolve the initial binds.
+        let mut binds = resolve_binds(&resources, binds);
+
+        // Discover the services we have.
+        let services = discover_services(&self.pc.file_set, &binds);
+
+        // Inject additional binds for the generated services.
+        let (additional_resources, additional_binds) =
+            self.inject_generated_service_clients(&services);
+
+        resources.extend(additional_resources);
+        binds.extend(additional_binds);
+
+        let resolver =
+            UsageResolver::new(&self.pc.loader, &self.pc.type_checker, &resources, &binds);
+        let mut usages = Vec::new();
+
+        for module in self.pc.loader.modules() {
+            let exprs = resolver.scan_usage_exprs(&module);
+            let u = resolver.resolve_usage(&module, &exprs);
+            usages.extend(u);
+        }
+
+        let services = collect_services(&self.pc.file_set, &binds, services);
+
+        ParseResult {
+            resources,
+            binds,
+            usages,
+            services,
+        }
+    }
+
+    fn inject_generated_service_clients(
+        &mut self,
+        services: &[DiscoveredService],
+    ) -> (Vec<Resource>, Vec<Lrc<Bind>>) {
+        // Find the services we have
+        let mut resources = Vec::new();
+        let mut binds = Vec::new();
+
+        let module = self.pc.loader.encore_app_clients();
+        for svc in services {
+            let client = Lrc::new(ServiceClient {
+                service_name: svc.name.clone(),
+            });
+            let resource = Resource::ServiceClient(client.clone());
+            resources.push(resource.clone());
+
+            let id = self.pass1.alloc_bind_id();
+            binds.push(Lrc::new(Bind {
+                id,
+                name: Some(svc.name.clone()),
+                object: None,
+                kind: BindKind::Create,
+                resource,
+                range: None,
+                internal_bound_id: None,
+                module_id: module.id,
+            }));
+        }
+
+        (resources, binds)
+    }
+}
+
+fn resolve_binds(resources: &[Resource], binds: Vec<UnresolvedBind>) -> Vec<Lrc<Bind>> {
+    // Collect the resources we support by path.
+    let resource_paths = resources
+        .iter()
+        .filter_map(|r| match r {
+            Resource::SQLDatabase(db) => Some((
+                ResourcePath::SQLDatabase {
+                    name: db.name.clone(),
+                },
+                r,
+            )),
+            _ => None,
+        })
+        .collect::<HashMap<ResourcePath, &Resource>>();
+
+    let mut result = Vec::with_capacity(binds.len());
+    for b in binds {
+        let resource: Resource = match b.resource {
+            ResourceOrPath::Resource(res) => res,
+            ResourceOrPath::Path(path) => {
+                let Some(res) = resource_paths.get(&path) else {
+                    b.range
+                        .map_or(DUMMY_SP, |r| r.to_span())
+                        .err(&format!("resource not found: {path:?}"));
+                    continue;
+                };
+                (*res).to_owned()
+            }
+        };
+
+        result.push(Lrc::new(Bind {
+            id: b.id,
+            range: b.range,
+            resource,
+            kind: b.kind,
+            module_id: b.module_id,
+            name: b.name,
+            object: b.object,
+            internal_bound_id: b.internal_bound_id,
+        }));
+    }
+
+    result
+}
+
+/// Describes an Encore service.
+#[derive(Debug)]
+pub struct Service {
+    pub name: String,
+
+    /// Associated documentation.
+    pub doc: Option<String>,
+
+    /// The root directory of the service.
+    pub root: PathBuf,
+
+    /// The binds defined within the service.
+    pub binds: Vec<Lrc<Bind>>,
+}
+
+fn collect_services(
+    file_set: &FileSet,
+    binds: &[Lrc<Bind>],
+    discovered: Vec<DiscoveredService>,
+) -> Vec<Service> {
+    let mut services = Vec::with_capacity(discovered.len());
+    for svc in discovered.into_iter() {
+        services.push(Service {
+            name: svc.name,
+            root: svc.root,
+
+            // Filled in below.
+            binds: vec![],
+            doc: None,
+        });
+    }
+
+    // Sort the services by path so we can do a binary search below.
+    services.sort_by(|a, b| a.root.cmp(&b.root));
+
+    for b in binds {
+        let Some(range) = b.range else { continue };
+        let file_path = range.file(file_set);
+        let path: &Path = match file_path {
+            FilePath::Real(ref buf) => buf.as_path(),
+            FilePath::Custom(_) => continue,
+        };
+
+        // found is where the bind would be inserted:
+        // - Ok(idx) means an exact path match
+        // - Err(idx) means where the path would be inserted.
+        //   For this case we need to check if the path is a subdirectory of the service root.
+        let found = services.binary_search_by_key(&path, |s| s.root.as_path());
+        match found {
+            Ok(idx) => services[idx].binds.push(b.clone()),
+            Err(idx) => {
+                // Is this path a subdirectory of the preceding service root?
+                if idx > 0 {
+                    let svc = &mut services[idx - 1];
+                    if path.starts_with(&svc.root) {
+                        // If we have a service resource, copy its documentation.
+                        if let Resource::Service(s) = &b.resource {
+                            svc.doc = s.doc.clone();
+                        }
+
+                        svc.binds.push(b.clone());
+                        continue;
+                    }
+                }
+            }
+        }
+    }
+
+    services
+}
diff --git a/tsparser/src/parser/resourceparser/bind.rs b/tsparser/src/parser/resourceparser/bind.rs
new file mode 100644
index 0000000000..e34105a765
--- /dev/null
+++ b/tsparser/src/parser/resourceparser/bind.rs
@@ -0,0 +1,103 @@
+use std::hash::{Hash, Hasher};
+use std::rc::Rc;
+
+use swc_ecma_ast as ast;
+
+use crate::parser::module_loader::ModuleId;
+use crate::parser::resources::{Resource, ResourcePath};
+use crate::parser::types::Object;
+use crate::parser::Range;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct Id(u32);
+
+impl From<u32> for Id {
+    fn from(id: u32) -> Self {
+        Self(id)
+    }
+}
+
+#[derive(Debug)]
+pub enum ResourceOrPath {
+    Resource(Resource),
+    Path(ResourcePath),
+}
+
+#[derive(Debug)]
+pub enum BindName {
+    Named(ast::Ident),
+    DefaultExport,
+    Anonymous,
+}
+
+impl BindName {
+    pub fn name(&self) -> Option<String> {
+        match self {
+            BindName::Named(ident) => Some(ident.sym.to_string()),
+            BindName::DefaultExport => Some("default".to_string()),
+            BindName::Anonymous => None,
+        }
+    }
+
+    pub fn ident(&self) -> Option<&ast::Ident> {
+        if let BindName::Named(name) = self {
+            Some(name)
+        } else {
+            None
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct BindData {
+    pub resource: ResourceOrPath,
+    pub range: Range,
+
+    /// The identifier it is bound to.
+    pub ident: BindName,
+    // The object it is bound to, if any.
+    pub object: Option<Rc<Object>>,
+    pub kind: BindKind,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BindKind {
+    Create,
+    Reference,
+}
+
+#[derive(Debug)]
+pub struct Bind {
+    pub id: Id,
+    pub range: Option<Range>,
+    pub resource: Resource,
+    pub kind: BindKind,
+
+    /// The module the bind is defined in.
+    pub module_id: ModuleId,
+
+    /// The identifier it is bound to, if any.
+    /// None means it's an anonymous bind (e.g. `_`).
+    pub name: Option<String>,
+
+    /// The object it is bound to, if any.
+    pub object: Option<Rc<Object>>,
+
+    /// The identifier it's bound to in the source module.
+    /// None means it's an anonymous bind (e.g. `_`).
+    /// It's used for computing usage within the module itself,
+    /// where we need to know its id.
+    pub internal_bound_id: Option<ast::Id>,
+}
+
+impl PartialEq<Self> for Bind {
+    fn eq(&self, other: &Self) -> bool {
+        self.id == other.id
+    }
+}
+
+impl Hash for Bind {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        self.id.hash(state);
+    }
+}
diff --git a/tsparser/src/parser/resourceparser/mod.rs b/tsparser/src/parser/resourceparser/mod.rs
new file mode 100644
index 0000000000..c9f4f4cf03
--- /dev/null
+++ b/tsparser/src/parser/resourceparser/mod.rs
@@ -0,0 +1,169 @@
+use std::borrow::Cow;
+use std::rc::Rc;
+
+use bind::BindName;
+use swc_common::sync::Lrc;
+use swc_ecma_ast as ast;
+
+use crate::parser::module_loader::Module;
+use crate::parser::resourceparser::bind::BindData;
+use crate::parser::resourceparser::resource_parser::ResourceParserRegistry;
+use crate::parser::resources::Resource;
+use crate::parser::types::TypeChecker;
+use crate::parser::{FileSet, Pos};
+
+use self::bind::BindKind;
+
+use super::module_loader::ModuleId;
+use super::types::Object;
+use super::Range;
+
+pub mod bind;
+pub mod paths;
+pub mod resource_parser;
+
+#[derive(Debug)]
+pub struct PassOneParser<'a> {
+    file_set: Lrc<FileSet>,
+    type_checker: Lrc<TypeChecker>,
+    registry: ResourceParserRegistry<'a>,
+    next_id: u32,
+}
+
+#[derive(Debug)]
+pub struct UnresolvedBind {
+    pub id: bind::Id,
+    pub range: Option<Range>,
+    pub resource: bind::ResourceOrPath,
+    pub kind: BindKind,
+
+    /// The module the bind is defined in.
+    pub module_id: ModuleId,
+
+    /// The identifier it is bound to, if any.
+    /// None means it's an anonymous bind (e.g. `_`).
+    pub name: Option<String>,
+
+    /// The object it is bound to, if any.
+    pub object: Option<Rc<Object>>,
+
+    /// The identifier it's bound to in the source module.
+    /// None means it's an anonymous bind (e.g. `_`).
+    /// It's used for computing usage within the module itself,
+    /// where we need to know its id.
+    pub internal_bound_id: Option<ast::Id>,
+}
+
+impl<'a> PassOneParser<'a> {
+    pub fn new(
+        file_set: Lrc<FileSet>,
+        type_checker: Lrc<TypeChecker>,
+        registry: ResourceParserRegistry<'a>,
+    ) -> Self {
+        Self {
+            file_set,
+            type_checker,
+            registry,
+            next_id: 0,
+        }
+    }
+
+    pub fn alloc_bind_id(&mut self) -> bind::Id {
+        self.next_id += 1;
+        self.next_id.into()
+    }
+
+    pub fn parse(
+        &mut self,
+        module: Lrc<Module>,
+        service_name: Option<&str>,
+    ) -> (Vec<Resource>, Vec<UnresolvedBind>) {
+        let parsers = self.registry.interested_parsers(&module);
+
+        let mut ctx = ResourceParseContext::new(
+            &self.file_set,
+            &self.type_checker,
+            module.clone(),
+            service_name.map(Cow::Borrowed),
+        );
+
+        for parser in parsers {
+            let num_resources = ctx.resources.len();
+            (parser.run)(&mut ctx);
+
+            // Look at any new resources to see if we have a new service.
+            // If so, update our ctx so that later parsers have up-to-date information.
+            for res in &ctx.resources[num_resources..] {
+                if let Resource::Service(svc) = res {
+                    ctx.service_name = Some(Cow::Owned(svc.name.clone()));
+                }
+            }
+        }
+
+        let mut binds = Vec::with_capacity(ctx.binds.len());
+        for b in ctx.binds {
+            self.next_id += 1;
+            binds.push(UnresolvedBind {
+                id: self.next_id.into(),
+                name: b.ident.name(),
+                object: b.object,
+                kind: b.kind,
+                resource: b.resource,
+                range: Some(b.range),
+                internal_bound_id: b.ident.ident().map(|i| i.to_id()),
+                module_id: module.id,
+            });
+        }
+
+        (ctx.resources, binds)
+    }
+}
+
+/// Encompasses the necessary information for parsing resources from a single TS file.
+#[derive(Debug)]
+pub struct ResourceParseContext<'a> {
+    pub module: Lrc<Module>,
+    pub type_checker: &'a TypeChecker,
+    pub service_name: Option<Cow<'a, str>>,
+    file_set: &'a FileSet,
+    resources: Vec<Resource>,
+    binds: Vec<BindData>,
+}
+
+impl<'a> ResourceParseContext<'a> {
+    pub fn new(
+        file_set: &'a FileSet,
+        type_checker: &'a TypeChecker,
+        module: Lrc<Module>,
+        service_name: Option<Cow<'a, str>>,
+    ) -> Self {
+        Self {
+            module,
+            type_checker,
+            file_set,
+            service_name,
+            resources: Vec::new(),
+            binds: Vec::new(),
+        }
+    }
+
+    /// Register a resource.
+    pub fn add_resource(&mut self, res: Resource) {
+        log::debug!("found resource {}", res);
+        self.resources.push(res);
+    }
+
+    /// Register a bind.
+    pub fn add_bind(&mut self, bind: BindData) {
+        // Treat "_" as an anonymous bind.
+        let ident = match bind.ident {
+            BindName::Named(name) if name.sym == "_" => BindName::Anonymous,
+            x => x,
+        };
+        self.binds.push(BindData { ident, ..bind });
+    }
+
+    pub fn preceding_comments(&self, pos: Pos) -> Option<String> {
+        self.file_set.preceding_comments(&self.module.comments, pos)
+    }
+}
diff --git a/tsparser/src/parser/resourceparser/paths.rs b/tsparser/src/parser/resourceparser/paths.rs
new file mode 100644
index 0000000000..2ba83131db
--- /dev/null
+++ b/tsparser/src/parser/resourceparser/paths.rs
@@ -0,0 +1,7 @@
+/// A path to a package, e.g. `@foo/bar`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct PkgPath<'a>(pub &'a str);
+
+/// A path to a specific object in a package, e.g. 'Moo' in '@foo/bar'.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub struct PkgObj<'a>(pub PkgPath<'a>, pub &'a str);
diff --git a/tsparser/src/parser/resourceparser/resource_parser.rs b/tsparser/src/parser/resourceparser/resource_parser.rs
new file mode 100644
index 0000000000..3551e88568
--- /dev/null
+++ b/tsparser/src/parser/resourceparser/resource_parser.rs
@@ -0,0 +1,125 @@
+use std::collections::{HashMap, HashSet};
+
+use swc_ecma_ast as ast;
+
+use crate::parser::module_loader::Module;
+use crate::parser::resourceparser::paths::PkgPath;
+use crate::parser::resourceparser::ResourceParseContext;
+use crate::parser::resources::DEFAULT_RESOURCE_PARSERS;
+
+/// A parser for a specific resource type.
+#[derive(Debug)]
+pub struct ResourceParser {
+    pub name: &'static str,
+
+    pub interesting_pkgs: &'static [PkgPath<'static>],
+
+    pub run: fn(&mut ResourceParseContext),
+}
+
+impl PartialEq for ResourceParser {
+    fn eq(&self, other: &Self) -> bool {
+        self.name == other.name
+    }
+}
+
+#[derive(Debug)]
+pub struct ResourceParserRegistry<'a> {
+    /// List of registered parsers.
+    parsers: Vec<&'a ResourceParser>,
+    interested_for_paths: HashMap<PkgPath<'a>, Vec<&'a ResourceParser>>,
+}
+
+impl Default for ResourceParserRegistry<'_> {
+    fn default() -> Self {
+        Self::new(DEFAULT_RESOURCE_PARSERS)
+    }
+}
+
+impl<'a> ResourceParserRegistry<'a> {
+    pub fn new(parsers: &[&'a ResourceParser]) -> Self {
+        let mut registry = Self {
+            parsers: Vec::new(),
+            interested_for_paths: HashMap::new(),
+        };
+        for p in parsers {
+            registry.register(p);
+        }
+        registry
+    }
+
+    /// Register a new parser.
+    pub fn register(&mut self, parser: &'a ResourceParser) {
+        self.parsers.push(parser);
+        for path in parser.interesting_pkgs {
+            self.interested_for_paths
+                .entry(*path)
+                .or_default()
+                .push(parser);
+        }
+    }
+
+    /// Compute the parsers interested in processing the given module.
+    pub fn interested_parsers(&self, module: &Module) -> Vec<&'a ResourceParser> {
+        let mut parsers = Vec::new();
+        let mut seen_parsers = HashSet::new();
+
+        // Iterate over the imports in this module and collect all the interested parsers.
+        for it in &module.ast.body {
+            if let ast::ModuleItem::ModuleDecl(ast::ModuleDecl::Import(import)) = it {
+                let path = PkgPath(&import.src.value);
+                if let Some(found) = self.interested_for_paths.get(&path) {
+                    for p in found {
+                        // If we haven't already seen the parser with that name,
+                        // add it to the list of parsers to run.
+                        if !seen_parsers.contains(p.name) {
+                            seen_parsers.insert(p.name);
+                            parsers.push(*p);
+                        }
+                    }
+                }
+            }
+        }
+
+        parsers
+    }
+}
+
+#[cfg(test)]
+mod tests {
+
+    use crate::parser::resources::apis::api::ENDPOINT_PARSER;
+
+    use crate::testutil::testparse::test_parse;
+
+    use super::*;
+
+    #[test]
+    fn test_parser_registry() {
+        let registry = ResourceParserRegistry::new(&[&ENDPOINT_PARSER]);
+
+        // Should return the parser when the import path matches.
+        {
+            let res = test_parse("import { APIEndpoint } from 'encore.dev/api';");
+            let got = registry.interested_parsers(&res);
+            let want = vec![&ENDPOINT_PARSER];
+            assert_eq!(got, want);
+        }
+
+        // Should also work for wildcard imports.
+        {
+            let res = test_parse("import * as foo from 'encore.dev/api';");
+            let got = registry.interested_parsers(&res);
+            let want = vec![&ENDPOINT_PARSER];
+            assert_eq!(got, want);
+        }
+
+        // Should be empty otherwise.
+        {
+            let res = test_parse("import { APIEndpoint } from 'encore.dev/api2';");
+            let got = registry.interested_parsers(&res);
+            let want: Vec<&ResourceParser> = vec![];
+            assert_eq!(got, want);
+        }
+    }
+}
diff --git a/tsparser/src/parser/resources/apis/api.rs b/tsparser/src/parser/resources/apis/api.rs
new file mode 100644
index 0000000000..0d0085a644
--- /dev/null
+++ b/tsparser/src/parser/resources/apis/api.rs
@@ -0,0 +1,891 @@
+use std::path::PathBuf;
+use std::str::FromStr;
+
+use swc_common::errors::HANDLER;
+use swc_common::sync::Lrc;
+use swc_common::{Span, Spanned};
+use swc_ecma_ast::{self as ast, FnExpr};
+
+use litparser::{
+    report_and_continue, LitParser, LocalRelPath, Nullable, ParseResult, Sp, ToParseErr,
+};
+use litparser_derive::LitParser;
+
+use crate::parser::module_loader::Module;
+use crate::parser::resourceparser::bind::{BindData, BindKind, BindName, ResourceOrPath};
+use crate::parser::resourceparser::paths::PkgPath;
+use crate::parser::resourceparser::resource_parser::ResourceParser;
+use crate::parser::resources::apis::encoding::{
+    describe_endpoint, describe_static_assets, describe_stream_endpoint, EndpointEncoding,
+};
+use crate::parser::resources::parseutil::{
+    extract_bind_name, extract_type_param, iter_references, ReferenceParser, TrackedNames,
+};
+use crate::parser::resources::Resource;
+use crate::parser::respath::Path;
+use crate::parser::usageparser::{ResolveUsageData, Usage};
+use crate::parser::{FilePath, Range};
+use crate::span_err::ErrReporter;
+
+#[derive(Debug, Clone)]
+pub struct Endpoint {
+    pub range: Range,
+    pub name: String,
+    pub name_range: Range,
+    pub service_name: String,
+    pub doc: Option<String>,
+    pub expose: bool,
+    pub raw: bool,
+    pub require_auth: bool,
+    pub tags: Vec<String>,
+    pub sensitive: bool,
+
+    /// Body limit in bytes.
+    /// None means no limit.
+    pub body_limit: Option<u64>,
+
+    pub streaming_request: bool,
+    pub streaming_response: bool,
+    pub static_assets: Option<StaticAssets>,
+
+    pub encoding: EndpointEncoding,
+}
+
+#[derive(Debug, Clone)]
+pub enum Methods {
+    All,
+    Some(Vec<Method>),
+}
+
+impl Methods {
+    pub fn to_vec(&self) -> Vec<String> {
+        let methods = match self {
+            Methods::All => Method::all(),
+            Methods::Some(vec) => vec,
+        };
+        methods.iter().map(|s| s.as_str().to_string()).collect()
+    }
+
+    pub fn contains(&self, m: Method) -> bool {
+        match self {
+            Methods::All => true,
+            Methods::Some(vec) => vec.contains(&m),
+        }
+    }
+
+    pub fn first(&self) -> Option<Method> {
+        match self {
+            Methods::All => Some(Method::Post),
+            Methods::Some(vec) => vec.first().cloned(),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialOrd, Ord, PartialEq, Eq, Hash)]
+pub enum Method {
+    Get,
+    Post,
+    Patch,
+    Put,
+    Delete,
+    Head,
+    Options,
+    Trace,
+    Connect,
+}
+
+impl Method {
+    /// Whether the method supports a request body.
+    pub fn supports_body(&self) -> bool {
+        match self {
+            Self::Post | Self::Put | Self::Patch | Self::Connect => true,
+            Self::Get | Self::Delete | Self::Head | Self::Options | Self::Trace => false,
+        }
+    }
+
+    pub fn as_str(&self) -> &'static str {
+        match self {
+            Self::Connect => "CONNECT",
+            Self::Delete => "DELETE",
+            Self::Get => "GET",
+            Self::Head => "HEAD",
+            Self::Options => "OPTIONS",
+            Self::Patch => "PATCH",
+            Self::Post => "POST",
+            Self::Put => "PUT",
+            Self::Trace => "TRACE",
+        }
+    }
+
+    /// List all methods.
+    pub fn all() -> &'static [Self] {
+        &[
+            Self::Get,
+            Self::Post,
+            Self::Patch,
+            Self::Put,
+            Self::Delete,
+            Self::Head,
+            Self::Options,
+            Self::Trace,
+            // Skip connect for now, since axum doesn't support it.
+            // Self::Connect,
+        ]
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct InvalidMethodError;
+
+impl std::fmt::Display for InvalidMethodError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "invalid method")
+    }
+}
+
+impl FromStr for Method {
+    type Err = InvalidMethodError;
+
+    fn from_str(s: &str) -> Result<Self, Self::Err> {
+        Ok(match s {
+            "CONNECT" => Self::Connect,
+            "DELETE" => Self::Delete,
+            "GET" => Self::Get,
+            "HEAD" => Self::Head,
+            "OPTIONS" => Self::Options,
+            "PATCH" => Self::Patch,
+            "POST" => Self::Post,
+            "PUT" => Self::Put,
+            "TRACE" => Self::Trace,
+            _ => return Err(InvalidMethodError),
+        })
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct StaticAssets {
+    /// Files to serve.
+    pub dir: Sp<PathBuf>,
+
+    /// File to serve when the path is not found.
+    pub not_found: Option<Sp<PathBuf>>,
+
+    /// Http Status Code to use when serving not_found
+    pub not_found_status: Option<u32>,
+}
+
+pub const ENDPOINT_PARSER: ResourceParser = ResourceParser {
+    name: "endpoint",
+    interesting_pkgs: &[PkgPath("encore.dev/api")],
+
+    run: |pass| {
+        let module = pass.module.clone();
+
+        let service_name = match &pass.service_name {
+            Some(name) => Some(name.to_string()),
+            None => {
+                // TODO handle this in a better way.
+                match &module.file_path {
+                    FilePath::Real(ref buf) => buf
+                        .parent()
+                        .and_then(|p| p.file_name())
+                        .and_then(|s| s.to_str())
+                        .map(|s| s.to_string()),
+                    FilePath::Custom(_) => None,
+                }
+            }
+        };
+
+        let names = TrackedNames::new(&[("encore.dev/api", "api")]);
+
+        for r in iter_references::<APIEndpointLiteral>(&module, &names) {
+            let r = report_and_continue!(r);
+            let Some(service_name) = service_name.as_ref() else {
+                module.err("unable to determine service name for file");
+                continue;
+            };
+
+            let (config_span, cfg) = r.config.split();
+            let path_span = cfg.path.as_ref().map_or(config_span, |p| p.span());
+            let path_str = cfg
+                .path
+                .as_deref()
+                .cloned()
+                .unwrap_or_else(|| format!("/{}.{}", &service_name, r.endpoint_name));
+
+            let path = match Path::parse(path_span, &path_str, Default::default()) {
+                Ok(path) => path,
+                Err(err) => {
+                    if cfg.path.is_some() {
+                        err.report();
+                    } else {
+                        // We don't have an explicit path, so add a note to the error.
+                        HANDLER.with(|h| {
+                            h.struct_span_err(err.span, &err.error.to_string())
+                                .span_note(
+                                    config_span,
+                                    &format!("no path provided, so defaulting to {path_str}"),
+                                )
+                                .emit();
+                        });
+                    }
+                    continue;
+                }
+            };
+
+            let object = pass
+                .type_checker
+                .resolve_obj(pass.module.clone(), &ast::Expr::Ident(r.bind_name.clone()));
+
+            let methods = cfg.method.unwrap_or(Methods::Some(vec![Method::Post]));
+
+            let raw = matches!(r.kind, EndpointKind::Raw);
+
+            let mut streaming_request = false;
+            let mut streaming_response = false;
+            let mut static_assets = None;
+
+            let encoding = match r.kind {
+                EndpointKind::Typed { request, response } => {
+                    let request = match request {
+                        None => None,
+                        Some(t) => Some(pass.type_checker.resolve_type(module.clone(), &t)),
+                    };
+                    let response = match response {
+                        None => None,
+                        Some(t) => Some(pass.type_checker.resolve_type(module.clone(), &t)),
+                    };
+
+                    report_and_continue!(describe_endpoint(
+                        r.range.to_span(),
+                        pass.type_checker,
+                        methods,
+                        path,
+                        request,
+                        response,
+                        false,
+                    ))
+                }
+                EndpointKind::Raw => {
+                    report_and_continue!(describe_endpoint(
+                        r.range.to_span(),
+                        pass.type_checker,
+                        methods,
+                        path,
+                        None,
+                        None,
+                        true,
+                    ))
+                }
+                EndpointKind::TypedStream {
+                    handshake,
+                    request,
+                    response,
+                } => {
+                    streaming_request = request.is_stream();
+                    streaming_response = response.is_stream();
+
+                    // always register as a get endpoint
+                    let methods = Methods::Some(vec![Method::Get]);
+
+                    let request = request
+                        .ts_type()
+                        .map(|t| pass.type_checker.resolve_type(module.clone(), t));
+                    let response = response
+                        .ts_type()
+                        .map(|t| pass.type_checker.resolve_type(module.clone(), t));
+                    let handshake =
+                        handshake.map(|t| pass.type_checker.resolve_type(module.clone(), &t));
+
+                    report_and_continue!(describe_stream_endpoint(
+                        r.range.to_span(),
+                        pass.type_checker,
+                        methods,
+                        path,
+                        request,
+                        response,
+                        handshake,
+                    ))
+                }
+                EndpointKind::StaticAssets {
+                    dir,
+                    not_found,
+                    not_found_status,
+                } => {
+                    // Support HEAD and GET for static assets.
+                    let methods = Methods::Some(vec![Method::Head, Method::Get]);
+
+                    let FilePath::Real(module_file_path) = &module.file_path else {
+                        module
+                            .ast
+                            .err("cannot use custom file path for static assets");
+                        continue;
+                    };
+
+                    // Ensure the path has at most one dynamic segment, at the end.
+                    {
+                        let mut seen_dynamic = false;
+                        for seg in &path.segments {
+                            if seen_dynamic {
+                                if seg.is_dynamic() {
+                                    path_span.err("static assets path cannot contain multiple dynamic segments");
+                                } else {
+                                    path_span.err("static assets path cannot have static segments after dynamic segments");
+                                }
+                                break;
+                            }
+
+                            if seg.is_dynamic() {
+                                seen_dynamic = true;
+                            }
+                        }
+                    }
+
+                    let assets_dir = dir.with(module_file_path.parent().unwrap().join(&dir.buf));
+                    if let Err(err) = std::fs::read_dir(assets_dir.as_path()) {
+                        dir.err(&format!("unable to read static assets directory: {err}"));
+                    }
+
+                    // Ensure the not_found file exists.
+                    let not_found_path =
+                        not_found.map(|p| p.with(module_file_path.parent().unwrap().join(&p.buf)));
+                    if let Some(not_found_path) = &not_found_path {
+                        if !not_found_path.is_file() {
+                            not_found_path.err("file does not exist");
+                        }
+                    }
+
+                    static_assets = Some(StaticAssets {
+                        dir: assets_dir,
+                        not_found: not_found_path,
+                        not_found_status,
+                    });
+
+                    describe_static_assets(r.range.to_span(), methods, path)
+                }
+            };
+
+            // Compute the body limit. Null means no limit. No value means 2MiB.
+            let body_limit: Option<u64> = match cfg.bodyLimit {
+                Some(Nullable::Present(val)) => Some(val),
+                Some(Nullable::Null) => None,
+                None => Some(2 * 1024 * 1024),
+            };
+
+            let resource = Resource::APIEndpoint(Lrc::new(Endpoint {
+                range: r.range,
+                name: r.endpoint_name,
+                name_range: r.bind_name.span.into(),
+                service_name: service_name.clone(),
+                doc: r.doc_comment,
+                expose: cfg.expose.unwrap_or(false),
+                require_auth: cfg.auth.unwrap_or(false),
+                raw,
+                streaming_request,
+                streaming_response,
+                static_assets,
+                body_limit,
+                encoding,
+                tags: cfg.tags.unwrap_or_default(),
+                sensitive: cfg.sensitive.unwrap_or(false),
+            }));
+
+            pass.add_resource(resource.clone());
+            pass.add_bind(BindData {
+                range: r.range,
+                resource: ResourceOrPath::Resource(resource),
+                object,
+                kind: BindKind::Create,
+                ident: BindName::Named(r.bind_name),
+            });
+        }
+    },
+};
+
+#[derive(Debug)]
+pub struct CallEndpointUsage {
+    pub range: Range,
+    pub endpoint: (String, String),
+}
+
+#[derive(Debug)]
+pub struct ReferenceEndpointUsage {
+    pub range: Range,
+    pub endpoint: Lrc<Endpoint>,
+}
+
+pub fn resolve_endpoint_usage(_data: &ResolveUsageData, _endpoint: Lrc<Endpoint>) -> Option<Usage> {
+    // Endpoints are just normal functions in TS, so no usage to resolve.
+    None
+}
+
+#[derive(Debug)]
+struct APIEndpointLiteral {
+    pub range: Range,
+    pub doc_comment: Option<String>,
+    pub endpoint_name: String,
+    pub bind_name: ast::Ident,
+    pub config: Sp<EndpointConfig>,
+    pub kind: EndpointKind,
+}
+
+impl Spanned for APIEndpointLiteral {
+    fn span(&self) -> Span {
+        self.range.to_span()
+    }
+}
+
+#[derive(Debug)]
+enum ParameterType {
+    Stream(ast::TsType),
+    Single(ast::TsType),
+    None,
+}
+
+impl ParameterType {
+    fn is_stream(&self) -> bool {
+        matches!(self, ParameterType::Stream(..))
+    }
+
+    fn ts_type(&self) -> Option<&ast::TsType> {
+        match self {
+            ParameterType::Stream(t) => Some(t),
+            ParameterType::Single(t) => Some(t),
+            ParameterType::None => None,
+        }
+    }
+}
+
+#[derive(Debug)]
+enum EndpointKind {
+    Typed {
+        request: Option<ast::TsType>,
+        response: Option<ast::TsType>,
+    },
+    TypedStream {
+        handshake: Option<ast::TsType>,
+        request: ParameterType,
+        response: ParameterType,
+    },
+    StaticAssets {
+        dir: Sp<LocalRelPath>,
+        not_found: Option<Sp<LocalRelPath>>,
+        not_found_status: Option<u32>,
+    },
+    Raw,
+}
+
+#[derive(LitParser, Debug)]
+#[allow(non_snake_case)]
+struct EndpointConfig {
+    method: Option<Methods>,
+    path: Option<Sp<String>>,
+    expose: Option<bool>,
+    auth: Option<bool>,
+    bodyLimit: Option<Nullable<u64>>,
+    tags: Option<Vec<String>>,
+    sensitive: Option<bool>,
+
+    // For static assets.
+    dir: Option<Sp<LocalRelPath>>,
+    notFound: Option<Sp<LocalRelPath>>,
+    notFoundStatus: Option<u32>,
+}
+
+impl ReferenceParser for APIEndpointLiteral {
+    fn parse_resource_reference(
+        module: &Module,
+        path: &swc_ecma_visit::AstNodePath,
+    ) -> ParseResult<Option<Self>> {
+        for node in path.iter().rev() {
+            if let swc_ecma_visit::AstParentNodeRef::CallExpr(
+                expr,
+                swc_ecma_visit::fields::CallExprField::Callee,
+            ) = node
+            {
+                let doc_comment = module.preceding_comments(expr.span.lo.into());
+                let Some(bind_name) = extract_bind_name(path)? else {
+                    return Err(
+                        expr.parse_err("API endpoint must be bound to an exported variable")
+                    );
+                };
+
+                let Some(config) = expr.args.first() else {
+                    return Err(expr.parse_err(
+                        "API endpoint must have a config object as its first argument",
+                    ));
+                };
+                let cfg = <Sp<EndpointConfig>>::parse_lit(config.expr.as_ref())?;
+
+                let ast::Callee::Expr(callee) = &expr.callee else {
+                    return Err(expr.callee.parse_err("invalid api definition expression"));
+                };
+
+                // Determine what kind of endpoint it is.
+                return Ok(Some(match callee.as_ref() {
+                    ast::Expr::Member(member) if member.prop.is_ident_with("raw") => {
+                        // Raw endpoint
+                        let Some(_) = &expr.args.get(1) else {
+                            return Err(expr.args[0].span_hi().parse_err(
+                                "API endpoint must have a handler function as its second argument",
+                            ));
+                        };
+
+                        Self {
+                            range: expr.span.into(),
+                            doc_comment,
+                            endpoint_name: bind_name.sym.to_string(),
+                            bind_name,
+                            config: cfg,
+                            kind: EndpointKind::Raw,
+                        }
+                    }
+
+                    ast::Expr::Member(member) if member.prop.is_ident_with("streamInOut") => {
+                        // Bidirectional stream
+                        let Some(handler) = &expr.args.get(1) else {
+                            return Err(expr.args[0].span_hi().parse_err(
+                                "API endpoint must have a handler function as its second argument",
+                            ));
+                        };
+
+                        let Some(type_params) = expr.type_args.as_deref() else {
+                            return Err(
+                                expr.parse_err("missing type parameters in call to streamInOut")
+                            );
+                        };
+
+                        let (has_handshake, _return_type) =
+                            parse_stream_endpoint_signature(&handler.expr)?;
+
+                        let type_params_count = type_params.params.len();
+                        let expected_count = if has_handshake { 3 } else { 2 };
+
+                        if type_params_count != expected_count {
+                            return Err(type_params.parse_err(format!("wrong number of type parameters, expected {expected_count}, found {type_params_count}")));
+                        }
+
+                        let handshake = has_handshake
+                            .then(|| {
+                                extract_type_param(Some(type_params), 0).ok_or_else(|| {
+                                    type_params.parse_err("missing type for stream handshake")
+                                })
+                            })
+                            .transpose()?;
+
+                        let Some(request) = extract_type_param(
+                            Some(type_params),
+                            if has_handshake { 1 } else { 0 },
+                        ) else {
+                            return Err(type_params.parse_err("missing request type parameter"));
+                        };
+
+                        let Some(response) = extract_type_param(
+                            Some(type_params),
+                            if has_handshake { 2 } else { 1 },
+                        ) else {
+                            return Err(type_params.parse_err("missing response type parameter"));
+                        };
+
+                        Self {
+                            range: expr.span.into(),
+                            doc_comment,
+                            endpoint_name: bind_name.sym.to_string(),
+                            bind_name,
+                            config: cfg,
+                            kind: EndpointKind::TypedStream {
+                                handshake: handshake.cloned(),
+                                request: ParameterType::Stream(request.clone()),
+                                response: ParameterType::Stream(response.clone()),
+                            },
+                        }
+                    }
+                    ast::Expr::Member(member) if member.prop.is_ident_with("streamIn") => {
+                        // Incoming stream
+                        let Some(handler) = &expr.args.get(1) else {
+                            return Err(expr.args[0].span_hi().parse_err(
+                                "API endpoint must have a handler function as its second argument",
+                            ));
+                        };
+
+                        let Some(type_params) = expr.type_args.as_deref() else {
+                            return Err(
+                                expr.parse_err("missing type parameters in call to streamIn")
+                            );
+                        };
+
+                        let (has_handshake, return_type) =
+                            parse_stream_endpoint_signature(&handler.expr)?;
+
+                        let type_params_count = type_params.params.len();
+                        let expected_count = if has_handshake { [2, 3] } else { [1, 2] };
+
+                        if !expected_count.contains(&type_params_count) {
+                            return Err(type_params.parse_err(format!("wrong number of type parameters, expected one of {expected_count:?}, found {type_params_count}")));
+                        }
+
+                        let handshake = has_handshake
+                            .then(|| {
+                                extract_type_param(Some(type_params), 0).ok_or_else(|| {
+                                    type_params.parse_err("missing type for handshake")
+                                })
+                            })
+                            .transpose()?;
+
+                        let Some(request) = extract_type_param(
+                            Some(type_params),
+                            if has_handshake { 1 } else { 0 },
+                        ) else {
+                            return Err(type_params.parse_err("missing request type parameter"));
+                        };
+
+                        let response = extract_type_param(
+                            Some(type_params),
+                            if has_handshake { 2 } else { 1 },
+                        );
+
+                        let response = match response {
+                            None => match return_type {
+                                Some(t) => ParameterType::Single(t.clone()),
+                                None => ParameterType::None,
+                            },
+                            Some(t) => ParameterType::Single(t.clone()),
+                        };
+
+                        Self {
+                            range: expr.span.into(),
+                            doc_comment,
+                            endpoint_name: bind_name.sym.to_string(),
+                            bind_name,
+                            config: cfg,
+                            kind: EndpointKind::TypedStream {
+                                handshake: handshake.cloned(),
+                                request: ParameterType::Stream(request.clone()),
+                                response,
+                            },
+                        }
+                    }
+                    ast::Expr::Member(member) if member.prop.is_ident_with("streamOut") => {
+                        // Outgoing stream
+                        let Some(handler) = &expr.args.get(1) else {
+                            return Err(expr.args[0].span_hi().parse_err(
+                                "API endpoint must have a handler function as its second argument",
+                            ));
+                        };
+
+                        let Some(type_params) = expr.type_args.as_deref() else {
+                            return Err(
+                                expr.parse_err("missing type parameters in call to streamOut")
+                            );
+                        };
+
+                        let (has_handshake, _return_type) =
+                            parse_stream_endpoint_signature(&handler.expr)?;
+
+                        let type_params_count = type_params.params.len();
+                        let expected_count = if has_handshake { 2 } else { 1 };
+
+                        if type_params_count != expected_count {
+                            return Err(type_params.parse_err(format!("wrong number of type parameters, expected {expected_count}, found {type_params_count}")));
+                        }
+
+                        let handshake = if has_handshake {
+                            let t = extract_type_param(Some(type_params), 0);
+                            if t.is_none() {
+                                return Err(
+                                    type_params.parse_err("missing type parameter for handshake")
+                                );
+                            }
+                            t
+                        } else {
+                            None
+                        };
+
+                        let Some(response) = extract_type_param(
+                            Some(type_params),
+                            if has_handshake { 1 } else { 0 },
+                        ) else {
+                            return Err(
+                                type_params.parse_err("missing type parameter for response")
+                            );
+                        };
+
+                        Self {
+                            range: expr.span.into(),
+                            doc_comment,
+                            endpoint_name: bind_name.sym.to_string(),
+                            bind_name,
+                            config: cfg,
+                            kind: EndpointKind::TypedStream {
+                                handshake: handshake.cloned(),
+                                request: ParameterType::None,
+                                response: ParameterType::Stream(response.clone()),
+                            },
+                        }
+                    }
+
+                    ast::Expr::Member(member) if member.prop.is_ident_with("static") => {
+                        // Static assets
+                        let Some(dir) = cfg.dir.clone() else {
+                            return Err(config
+                                .expr
+                                .parse_err("static assets must have the 'dir' field set"));
+                        };
+
+                        let not_found = cfg.notFound.clone();
+                        let not_found_status = cfg.notFoundStatus;
+
+                        Self {
+                            range: expr.span.into(),
+                            doc_comment,
+                            endpoint_name: bind_name.sym.to_string(),
+                            bind_name,
+                            config: cfg,
+                            kind: EndpointKind::StaticAssets {
+                                dir,
+                                not_found,
+                                not_found_status,
+                            },
+                        }
+                    }
+                    _ => {
+                        // Regular endpoint
+                        let Some(handler) = &expr.args.get(1) else {
+                            return Err(expr.args[0]
+                                .span_hi()
+                                .parse_err("API endpoint must have a handler function"));
+                        };
+                        let (mut req, mut resp) = parse_endpoint_signature(&handler.expr)?;
+
+                        if req.is_none() {
+                            req = extract_type_param(expr.type_args.as_deref(), 0);
+                        }
+                        if resp.is_none() {
+                            resp = extract_type_param(expr.type_args.as_deref(), 1);
+                        }
+
+                        Self {
+                            range: expr.span.into(),
+                            doc_comment,
+                            endpoint_name: bind_name.sym.to_string(),
+                            bind_name,
+                            config: cfg,
+                            kind: EndpointKind::Typed {
+                                request: req.cloned(),
+                                response: resp.cloned(),
+                            },
+                        }
+                    }
+                }));
+            }
+        }
+
+        Ok(None)
+    }
+}
+
+fn parse_stream_endpoint_signature(expr: &ast::Expr) -> ParseResult<(bool, Option<&ast::TsType>)> {
+    let (has_handshake_param, type_params, return_type) = match expr {
+        ast::Expr::Fn(FnExpr { function, .. }) => (
+            function.params.len() == 2,
+            function.type_params.as_deref(),
+            function.return_type.as_deref(),
+        ),
+        ast::Expr::Arrow(arrow) => (
+            arrow.params.len() == 2,
+            arrow.type_params.as_deref(),
+            arrow.return_type.as_deref(),
+        ),
+        _ => return Ok((false, None)),
+    };
+
+    if let Some(type_params) = type_params {
+        return Err(type_params.parse_err("stream endpoint handler cannot have type parameters"));
+    }
+
+    let return_type = return_type.map(|t| t.type_ann.as_ref());
+
+    Ok((has_handshake_param, return_type))
+}
+
+fn parse_endpoint_signature(
+    expr: &ast::Expr,
+) -> ParseResult<(Option<&ast::TsType>, Option<&ast::TsType>)> {
+    let (req_param, type_params, return_type) = match expr {
+        ast::Expr::Fn(func) => (
+            func.function.params.first().map(|p| &p.pat),
+            func.function.type_params.as_deref(),
+            func.function.return_type.as_deref(),
+        ),
+        ast::Expr::Arrow(arrow) => (
+            arrow.params.first(),
+            arrow.type_params.as_deref(),
+            arrow.return_type.as_deref(),
+        ),
+        _ => return Ok((None, None)),
+    };
+
+    if let Some(type_params) = type_params {
+        return Err(type_params.parse_err("endpoint handler cannot have type parameters"));
+    }
+
+    let req_type = match req_param {
+        None => None,
+        Some(param) => match &param {
+            ast::Pat::Ident(pat) => pat.type_ann.as_deref(),
+            ast::Pat::Array(pat) => pat.type_ann.as_deref(),
+            ast::Pat::Rest(pat) => pat.type_ann.as_deref(),
+            ast::Pat::Object(pat) => pat.type_ann.as_deref(),
+
+            ast::Pat::Assign(_) | ast::Pat::Invalid(_) | ast::Pat::Expr(_) => None,
+        },
+    };
+
+    let req = req_type.map(|t| t.type_ann.as_ref());
+    let resp = return_type.map(|t| t.type_ann.as_ref());
+
+    Ok((req, resp))
+}
+
+impl LitParser for Methods {
+    fn parse_lit(expr: &ast::Expr) -> ParseResult<Self> {
+        Ok(match expr {
+            ast::Expr::Lit(ast::Lit::Str(s)) => {
+                if s.value.as_ref() == "*" {
+                    Self::All
+                } else {
+                    match Method::from_str(s.value.as_ref()) {
+                        Ok(m) => Self::Some(vec![m]),
+                        Err(err) => {
+                            return Err(s.parse_err(format!("invalid method: {err}")));
+                        }
+                    }
+                }
+            }
+            ast::Expr::Array(arr) => {
+                let mut methods = Vec::with_capacity(arr.elems.len());
+                for ast::ExprOrSpread { expr, .. } in arr.elems.iter().flatten() {
+                    if let ast::Expr::Lit(ast::Lit::Str(s)) = expr.as_ref() {
+                        if s.value.as_ref() == "*" {
+                            return if arr.elems.len() > 1 {
+                                Err(arr
+                                    .parse_err("invalid methods: cannot mix * and other methods"))
+                            } else {
+                                Ok(Self::All)
+                            };
+                        }
+                        let m = Method::from_str(s.value.as_ref())
+                            .map_err(|err| s.parse_err(err.to_string()))?;
+                        methods.push(m);
+                    }
+                }
+                methods.sort();
+                methods.dedup();
+                Self::Some(methods)
+            }
+            _ => {
+                return Err(expr.parse_err("invalid methods: must be string or array of strings"));
+            }
+        })
+    }
+}
diff --git a/tsparser/src/parser/resources/apis/authhandler.rs b/tsparser/src/parser/resources/apis/authhandler.rs
new file mode 100644
index 0000000000..dd2026653c
--- /dev/null
+++ b/tsparser/src/parser/resources/apis/authhandler.rs
@@ -0,0 +1,216 @@
+use litparser::{report_and_continue, ParseResult, ToParseErr};
+use swc_common::sync::Lrc;
+use swc_ecma_ast as ast;
+use swc_ecma_ast::TsTypeParamInstantiation;
+
+use crate::parser::module_loader::Module;
+use crate::parser::resourceparser::bind::{BindData, BindKind, BindName, ResourceOrPath};
+use crate::parser::resourceparser::paths::PkgPath;
+use crate::parser::resourceparser::resource_parser::ResourceParser;
+use crate::parser::resources::apis::encoding::{describe_auth_handler, AuthHandlerEncoding};
+use crate::parser::resources::parseutil::{
+    extract_bind_name, iter_references, ReferenceParser, TrackedNames,
+};
+use crate::parser::resources::Resource;
+use crate::parser::{FilePath, Range};
+use crate::span_err::ErrReporter;
+
+use super::encoding::iface_fields;
+
+#[derive(Debug, Clone)]
+pub struct AuthHandler {
+    pub range: Range,
+    pub name: String,
+    pub service_name: String,
+    pub doc: Option<String>,
+    pub encoding: AuthHandlerEncoding,
+}
+
+pub const AUTHHANDLER_PARSER: ResourceParser = ResourceParser {
+    name: "authhandler",
+    interesting_pkgs: &[PkgPath("encore.dev/auth")],
+
+    run: |pass| {
+        let module = pass.module.clone();
+
+        let service_name = match &pass.service_name {
+            Some(name) => Some(name.to_string()),
+            None => {
+                // TODO handle this in a better way.
+                match &module.file_path {
+                    FilePath::Real(ref buf) => buf
+                        .parent()
+                        .and_then(|p| p.file_name())
+                        .and_then(|s| s.to_str())
+                        .map(|s| s.to_string()),
+                    FilePath::Custom(_) => None,
+                }
+            }
+        };
+
+        let names = TrackedNames::new(&[("encore.dev/auth", "authHandler")]);
+
+        'RefLoop: for r in iter_references::<AuthHandlerLiteral>(&module, &names) {
+            let r = report_and_continue!(r);
+            let Some(service_name) = service_name.as_ref() else {
+                module.err("unable to determine service name for file");
+                continue;
+            };
+
+            let request = pass.type_checker.resolve_type(module.clone(), &r.request);
+            let response = pass.type_checker.resolve_type(module.clone(), &r.response);
+
+            let fields = match iface_fields(pass.type_checker, &request) {
+                Ok(fields) => fields,
+                Err(e) => {
+                    e.report();
+                    continue;
+                }
+            };
+
+            for (_, v) in fields {
+                if !v.is_custom() {
+                    v.range().to_span().err(
+                        "authHandler parameter type can only consist of Query and Header fields",
+                    );
+                    continue 'RefLoop;
+                }
+            }
+
+            let object = pass
+                .type_checker
+                .resolve_obj(pass.module.clone(), &ast::Expr::Ident(r.bind_name.clone()));
+
+            let encoding = describe_auth_handler(pass.type_checker.state(), request, response);
+
+            let resource = Resource::AuthHandler(Lrc::new(AuthHandler {
+                range: r.range,
+                name: r.endpoint_name,
+                service_name: service_name.to_string(),
+                doc: r.doc_comment,
+                encoding,
+            }));
+
+            pass.add_resource(resource.clone());
+            pass.add_bind(BindData {
+                range: r.range,
+                resource: ResourceOrPath::Resource(resource),
+                object,
+                kind: BindKind::Create,
+                ident: BindName::Named(r.bind_name),
+            });
+        }
+    },
+};
+
+#[derive(Debug)]
+struct AuthHandlerLiteral {
+    pub range: Range,
+    pub doc_comment: Option<String>,
+    pub endpoint_name: String,
+    pub bind_name: ast::Ident,
+    pub request: ast::TsType,
+    pub response: ast::TsType,
+}
+
+impl ReferenceParser for AuthHandlerLiteral {
+    fn parse_resource_reference(
+        module: &Module,
+        path: &swc_ecma_visit::AstNodePath,
+    ) -> ParseResult<Option<Self>> {
+        for node in path.iter().rev() {
+            if let swc_ecma_visit::AstParentNodeRef::CallExpr(
+                expr,
+                swc_ecma_visit::fields::CallExprField::Callee,
+            ) = node
+            {
+                let doc_comment = module.preceding_comments(expr.span.lo.into());
+                let Some(bind_name) = extract_bind_name(path)? else {
+                    return Err(expr.parse_err("auth handler must be bound to a variable"));
+                };
+
+                let Some(handler) = &expr.args.first() else {
+                    return Err(expr.parse_err(
+                        "auth handler must have a handler function as its first argument",
+                    ));
+                };
+                let (mut req, mut resp) = parse_auth_handler_signature(&handler.expr)?;
+
+                if req.is_none() {
+                    req = extract_type_param(expr.type_args.as_deref(), 0);
+                }
+                if resp.is_none() {
+                    resp = extract_type_param(expr.type_args.as_deref(), 1);
+                }
+
+                let Some(req) = req else {
+                    return Err(expr
+                        .parse_err("auth handler must have an explicitly defined parameter type"));
+                };
+                let Some(resp) = resp else {
+                    return Err(
+                        expr.parse_err("auth handler must have an explicitly defined result type")
+                    );
+                };
+
+                return Ok(Some(Self {
+                    range: expr.span.into(),
+                    doc_comment,
+                    endpoint_name: bind_name.sym.to_string(),
+                    bind_name,
+                    request: req.clone(),
+                    response: resp.clone(),
+                }));
+            }
+        }
+        Ok(None)
+    }
+}
+
+fn parse_auth_handler_signature(
+    expr: &ast::Expr,
+) -> ParseResult<(Option<&ast::TsType>, Option<&ast::TsType>)> {
+    let (req_param, type_params, return_type) = match expr {
+        ast::Expr::Fn(func) => (
+            func.function.params.first().map(|p| &p.pat),
+            func.function.type_params.as_deref(),
+            func.function.return_type.as_deref(),
+        ),
+        ast::Expr::Arrow(arrow) => (
+            arrow.params.first(),
+            arrow.type_params.as_deref(),
+            arrow.return_type.as_deref(),
+        ),
+        _ => return Ok((None, None)),
+    };
+
+    if let Some(type_params) = &type_params {
+        return Err(type_params.parse_err("auth handler cannot have type parameters"));
+    }
+
+    let req_type = match req_param {
+        None => None,
+        Some(param) => match &param {
+            ast::Pat::Ident(pat) => pat.type_ann.as_deref(),
+            ast::Pat::Array(pat) => pat.type_ann.as_deref(),
+            ast::Pat::Rest(pat) => pat.type_ann.as_deref(),
+            ast::Pat::Object(pat) => pat.type_ann.as_deref(),
+
+            ast::Pat::Assign(_) | ast::Pat::Invalid(_) | ast::Pat::Expr(_) => None,
+        },
+    };
+
+    let req = req_type.map(|t| t.type_ann.as_ref());
+    let resp = return_type.map(|t| t.type_ann.as_ref());
+
+    Ok((req, resp))
+}
+
+fn extract_type_param(
+    params: Option<&TsTypeParamInstantiation>,
+    idx: usize,
+) -> Option<&ast::TsType> {
+    let params = params?;
+    let param = params.params.get(idx)?;
+    Some(param.as_ref())
+}
diff --git a/tsparser/src/parser/resources/apis/encoding.rs b/tsparser/src/parser/resources/apis/encoding.rs
new file mode 100644
index 0000000000..4a27b4e15f
--- /dev/null
+++ b/tsparser/src/parser/resources/apis/encoding.rs
@@ -0,0 +1,644 @@
+use std::collections::HashMap;
+
+use litparser::{ParseResult, Sp, ToParseErr};
+use swc_common::Span;
+use thiserror::Error;
+
+use crate::parser::resources::apis::api::{Method, Methods};
+use crate::parser::respath::Path;
+use crate::parser::types::{
+    drop_empty_or_void, unwrap_promise, unwrap_validated, validation, Basic, Custom, FieldName,
+    Interface, InterfaceField, ResolveState, Type, TypeChecker, WireLocation, WireSpec,
+};
+use crate::parser::Range;
+use crate::span_err::{ErrorWithSpanExt, SpErr};
+
+/// Describes how an API endpoint can be encoded on the wire.
+#[derive(Debug, Clone)]
+pub struct EndpointEncoding {
+    /// The endpoint's definition span
+    pub span: Span,
+
+    /// The endpoint's API path.
+    pub path: Path,
+
+    /// The methods the endpoint can be called with.
+    pub methods: Methods,
+
+    /// The default method to use for calling this endpoint.
+    pub default_method: Method,
+
+    pub req: Vec<RequestEncoding>,
+    pub resp: ResponseEncoding,
+
+    /// Schema for the websocket handshake, if stream.
+    pub handshake: Option<RequestEncoding>,
+
+    /// The raw request and schemas, from the source code.
+    pub raw_handshake_schema: Option<Sp<Type>>,
+    pub raw_req_schema: Option<Sp<Type>>,
+    pub raw_resp_schema: Option<Sp<Type>>,
+}
+
+impl EndpointEncoding {
+    pub fn default_request_encoding(&self) -> &RequestEncoding {
+        &self.req[0]
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialOrd, Ord, PartialEq, Eq, Hash)]
+pub enum ParamLocation {
+    Path,
+    Header,
+    Query,
+    Body,
+    Cookie,
+}
+
+#[derive(Debug, Clone)]
+pub enum ParamData {
+    Path { index: usize },
+    Header { header: String },
+    Query { query: String },
+    Body,
+    Cookie,
+    HTTPStatus,
+}
+
+#[derive(Debug, Clone)]
+pub struct Param {
+    pub name: String,
+    pub loc: ParamData,
+    pub typ: Type,
+    pub optional: bool,
+    pub range: Range,
+}
+
+#[derive(Debug, Clone)]
+pub struct RequestEncoding {
+    /// The method(s) this encoding is for.
+    pub methods: Methods,
+
+    /// Parsed params.
+    pub params: Vec<Param>,
+}
+
+#[derive(Debug, Clone)]
+pub struct ResponseEncoding {
+    /// Parsed params.
+    pub params: Vec<Param>,
+}
+
+#[derive(Debug, Clone)]
+pub struct AuthHandlerEncoding {
+    pub auth_param: Sp<Type>,
+    pub auth_data: Sp<Type>,
+}
+
+impl RequestEncoding {
+    pub fn path(&self) -> impl Iterator<Item = &Param> {
+        self.params
+            .iter()
+            .filter(|p| matches!(p.loc, ParamData::Path { .. }))
+    }
+
+    pub fn header(&self) -> impl Iterator<Item = &Param> {
+        self.params
+            .iter()
+            .filter(|p| matches!(p.loc, ParamData::Header { .. }))
+    }
+
+    pub fn query(&self) -> impl Iterator<Item = &Param> {
+        self.params
+            .iter()
+            .filter(|p| matches!(p.loc, ParamData::Query { .. }))
+    }
+
+    pub fn body(&self) -> impl Iterator<Item = &Param> {
+        self.params
+            .iter()
+            .filter(|p| matches!(p.loc, ParamData::Body))
+    }
+
+    pub fn cookie(&self) -> impl Iterator<Item = &Param> {
+        self.params
+            .iter()
+            .filter(|p| matches!(p.loc, ParamData::Cookie))
+    }
+}
+
+impl ResponseEncoding {
+    pub fn cookie(&self) -> impl Iterator<Item = &Param> {
+        self.params
+            .iter()
+            .filter(|p| matches!(p.loc, ParamData::Cookie))
+    }
+
+    pub fn header(&self) -> impl Iterator<Item = &Param> {
+        self.params
+            .iter()
+            .filter(|p| matches!(p.loc, ParamData::Header { .. }))
+    }
+
+    pub fn body(&self) -> impl Iterator<Item = &Param> {
+        self.params
+            .iter()
+            .filter(|p| matches!(p.loc, ParamData::Body))
+    }
+
+    pub fn http_status(&self) -> Option<&Param> {
+        self.params
+            .iter()
+            .find(|p| matches!(p.loc, ParamData::HTTPStatus))
+    }
+}
+
+pub fn describe_stream_endpoint(
+    def_span: Span,
+    tc: &TypeChecker,
+    methods: Methods,
+    path: Path,
+    req: Option<Sp<Type>>,
+    resp: Option<Sp<Type>>,
+    handshake: Option<Sp<Type>>,
+) -> ParseResult<EndpointEncoding> {
+    let resp = if let Some(resp) = resp {
+        let (span, resp) = resp.split();
+        drop_empty_or_void(unwrap_promise(tc.state(), &resp).clone()).map(|t| Sp::new(span, t))
+    } else {
+        None
+    };
+
+    let default_method = default_method(&methods);
+
+    let (handshake_enc, _req_schema) = describe_req(
+        def_span,
+        tc,
+        &Methods::Some(vec![Method::Get]),
+        Some(&path),
+        &handshake,
+        false,
+    )?;
+
+    let handshake_enc = match handshake_enc.as_slice() {
+        [] => None,
+        [ref enc] => Some(enc.clone()),
+        _ => return Err(def_span.parse_err("unexpected handshake encoding")),
+    };
+
+    let (req_enc, _req_schema) = if handshake_enc.is_some() {
+        describe_req(def_span, tc, &methods, None, &req, false)?
+    } else {
+        describe_req(def_span, tc, &methods, Some(&path), &req, false)?
+    };
+
+    let (resp_enc, _resp_schema) = describe_resp(tc, &methods, &resp)?;
+
+    let path = if let Some(ref enc) = handshake_enc {
+        rewrite_path_types(enc, path, false)?
+    } else {
+        path
+    };
+
+    Ok(EndpointEncoding {
+        span: def_span,
+        path,
+        methods,
+        default_method,
+        req: req_enc,
+        resp: resp_enc,
+        handshake: handshake_enc,
+        raw_handshake_schema: handshake,
+        raw_req_schema: req,
+        raw_resp_schema: resp,
+    })
+}
+
+pub fn describe_endpoint(
+    def_span: Span,
+    tc: &TypeChecker,
+    methods: Methods,
+    path: Path,
+    req: Option<Sp<Type>>,
+    resp: Option<Sp<Type>>,
+    raw: bool,
+) -> ParseResult<EndpointEncoding> {
+    let resp = if let Some(resp) = resp {
+        let (span, resp) = resp.split();
+        drop_empty_or_void(unwrap_promise(tc.state(), &resp).clone()).map(|t| Sp::new(span, t))
+    } else {
+        None
+    };
+
+    let default_method = default_method(&methods);
+
+    let (req_enc, _req_schema) = describe_req(def_span, tc, &methods, Some(&path), &req, raw)?;
+    let (resp_enc, _resp_schema) = describe_resp(tc, &methods, &resp)?;
+
+    let path = rewrite_path_types(&req_enc[0], path, raw)?;
+
+    Ok(EndpointEncoding {
+        span: def_span,
+        path,
+        methods,
+        default_method,
+        req: req_enc,
+        resp: resp_enc,
+        handshake: None,
+        raw_handshake_schema: None,
+        raw_req_schema: req,
+        raw_resp_schema: resp,
+    })
+}
+
+pub fn describe_static_assets(def_span: Span, methods: Methods, path: Path) -> EndpointEncoding {
+    EndpointEncoding {
+        span: def_span,
+        path,
+        methods: methods.clone(),
+        default_method: Method::Get,
+        req: vec![RequestEncoding {
+            methods,
+            params: vec![],
+        }],
+        resp: ResponseEncoding { params: vec![] },
+        handshake: None,
+        raw_handshake_schema: None,
+        raw_req_schema: None,
+        raw_resp_schema: None,
+    }
+}
+
+fn describe_req(
+    def_span: Span,
+    tc: &TypeChecker,
+    methods: &Methods,
+    path: Option<&Path>,
+    req_schema: &Option<Sp<Type>>,
+    raw: bool,
+) -> ParseResult<(Vec<RequestEncoding>, Option<FieldMap>)> {
+    let Some(req_schema) = req_schema else {
+        // We don't have any request schema. This is valid if and only if
+        // we have no path parameters or it's a raw endpoint.
+        if path.is_none() || !path.unwrap().has_dynamic_segments() || raw {
+            return Ok((
+                vec![RequestEncoding {
+                    methods: methods.clone(),
+                    params: vec![],
+                }],
+                None,
+            ));
+        } else {
+            return Err(
+                def_span.parse_err("request schema must be defined when having path parameters")
+            );
+        }
+    };
+
+    let mut fields =
+        iface_fields(tc, req_schema).map_err(|err| err.span.parse_err(err.error.to_string()))?;
+    let path_params = if let Some(path) = path {
+        extract_path_params(path, &mut fields)?
+    } else {
+        vec![]
+    };
+
+    // If there are no fields remaining, we can use this encoding for all methods.
+    if fields.is_empty() {
+        return Ok((
+            vec![RequestEncoding {
+                methods: methods.clone(),
+                params: path_params,
+            }],
+            None,
+        ));
+    }
+
+    // Otherwise, the fields should be grouped by location depending on the method.
+    let mut encodings = Vec::new();
+
+    for (loc, methods) in split_by_loc(methods) {
+        let mut params = path_params.clone();
+        params.extend(extract_loc_params(&fields, loc)?);
+        encodings.push(RequestEncoding {
+            methods: Methods::Some(methods),
+            params,
+        });
+    }
+
+    Ok((encodings, Some(fields)))
+}
+
+fn describe_resp(
+    tc: &TypeChecker,
+    _methods: &Methods,
+    resp_schema: &Option<Sp<Type>>,
+) -> ParseResult<(ResponseEncoding, Option<FieldMap>)> {
+    let Some(resp_schema) = resp_schema else {
+        return Ok((ResponseEncoding { params: vec![] }, None));
+    };
+
+    let fields =
+        iface_fields(tc, resp_schema).map_err(|err| err.span.parse_err(err.error.to_string()))?;
+
+    // Validate that maximum one field has HttpStatus location
+    let http_status_count = fields
+        .values()
+        .filter(|f| {
+            matches!(
+                f.custom.as_ref().map(|s| &s.location),
+                Some(&WireLocation::HttpStatus)
+            )
+        })
+        .count();
+
+    if http_status_count > 1 {
+        return Err(resp_schema
+            .span()
+            .parse_err("only one field can be of type HttpStatus in a response"));
+    }
+
+    let params = extract_loc_params(&fields, ParamLocation::Body)?;
+
+    let fields = if fields.is_empty() {
+        None
+    } else {
+        Some(fields)
+    };
+
+    Ok((ResponseEncoding { params }, fields))
+}
+
+pub fn describe_auth_handler(
+    ctx: &ResolveState,
+    params: Sp<Type>,
+    response: Sp<Type>,
+) -> AuthHandlerEncoding {
+    let (span, response) = response.split();
+    let response = unwrap_promise(ctx, &response).clone();
+
+    AuthHandlerEncoding {
+        auth_param: params,
+        auth_data: Sp::new(span, response),
+    }
+}
+
+fn default_method(methods: &Methods) -> Method {
+    match methods {
+        Methods::All => Method::Post,
+        Methods::Some(methods) => {
+            if methods.contains(&Method::Post) {
+                Method::Post
+            } else {
+                methods[0]
+            }
+        }
+    }
+}
+
+fn split_by_loc(methods: &Methods) -> Vec<(ParamLocation, Vec<Method>)> {
+    let methods = match methods {
+        Methods::All => Method::all(),
+        Methods::Some(methods) => methods,
+    };
+
+    let mut locs = HashMap::new();
+    for m in methods {
+        let loc = if m.supports_body() {
+            ParamLocation::Body
+        } else {
+            ParamLocation::Query
+        };
+        locs.entry(loc).or_insert(Vec::new()).push(*m);
+    }
+
+    let mut items: Vec<_> = locs.into_iter().collect();
+    items.sort();
+    items
+}
+
+pub type FieldMap = HashMap<String, Field>;
+
+#[derive(Debug)]
+pub struct Field {
+    name: String,
+    typ: Type,
+    optional: bool,
+    custom: Option<WireSpec>,
+    range: Range,
+}
+
+impl Field {
+    pub fn is_custom(&self) -> bool {
+        self.custom.is_some()
+    }
+
+    pub fn range(&self) -> Range {
+        self.range
+    }
+}
+
+#[derive(Error, Debug)]
+pub enum Error {
+    #[error("expected named interface type, found {0}")]
+    ExpectedNamedInterfaceType(String),
+    #[error("invalid custom type field")]
+    InvalidCustomType(#[source] anyhow::Error),
+}
+
+pub(crate) fn iface_fields<'a>(
+    tc: &'a TypeChecker,
+    typ: &'a Sp<Type>,
+) -> Result<FieldMap, SpErr<Error>> {
+    fn to_fields(iface: &Interface) -> Result<FieldMap, SpErr<Error>> {
+        let mut map = HashMap::new();
+        for f in &iface.fields {
+            if let FieldName::String(name) = &f.name {
+                map.insert(name.clone(), rewrite_custom_type_field(f, name));
+            }
+        }
+        Ok(map)
+    }
+
+    let span = typ.span();
+    let typ = unwrap_promise(tc.state(), typ);
+    match typ {
+        Type::Basic(Basic::Void) => Ok(HashMap::new()),
+        Type::Interface(iface) => to_fields(iface),
+        Type::Named(named) => {
+            let underlying = Sp::new(span, tc.underlying(named.obj.module_id, typ));
+            iface_fields(tc, &underlying)
+        }
+        _ => Err(Error::ExpectedNamedInterfaceType(format!("{typ:?}")).with_span(span)),
+    }
+}
+
+fn extract_path_params(path: &Path, fields: &mut FieldMap) -> ParseResult<Vec<Param>> {
+    let mut params = Vec::new();
+    for (index, seg) in path.dynamic_segments().enumerate() {
+        let name = seg.lit_or_name();
+        let Some(f) = fields.remove(name) else {
+            return Err(seg.parse_err("path parameter not found in request schema"));
+        };
+        params.push(Param {
+            name: name.to_string(),
+            loc: ParamData::Path { index },
+            typ: f.typ.clone(),
+            optional: f.optional,
+            range: f.range,
+        });
+    }
+
+    Ok(params)
+}
+
+fn extract_loc_params(fields: &FieldMap, default_loc: ParamLocation) -> ParseResult<Vec<Param>> {
+    let mut params = Vec::new();
+
+    for f in fields.values() {
+        let get_name = |spec: &WireSpec, field_name: &str| -> String {
+            spec.name_override
+                .as_deref()
+                .unwrap_or(field_name)
+                .to_string()
+        };
+
+        // Determine the parameter data based on location
+        let param_data = match &f.custom {
+            Some(spec) => match spec.location {
+                WireLocation::Header => ParamData::Header {
+                    header: get_name(spec, &f.name),
+                },
+                WireLocation::Query => ParamData::Query {
+                    query: get_name(spec, &f.name),
+                },
+                WireLocation::PubSubAttr => ParamData::Body,
+                WireLocation::Cookie => ParamData::Cookie,
+                WireLocation::HttpStatus => ParamData::HTTPStatus,
+            },
+            None => match default_loc {
+                ParamLocation::Query => ParamData::Query {
+                    query: f.name.clone(),
+                },
+                ParamLocation::Body => ParamData::Body,
+                ParamLocation::Cookie => ParamData::Cookie,
+                ParamLocation::Header => ParamData::Header {
+                    header: f.name.clone(),
+                },
+                ParamLocation::Path => {
+                    return Err(f
+                        .range
+                        .to_span()
+                        .parse_err("path params are not supported as a default loc"))
+                }
+            },
+        };
+
+        params.push(Param {
+            name: f.name.clone(),
+            loc: param_data,
+            typ: f.typ.clone(),
+            optional: f.optional,
+            range: f.range,
+        });
+    }
+    Ok(params)
+}
+
+fn rewrite_path_types(req: &RequestEncoding, path: Path, raw: bool) -> ParseResult<Path> {
+    use crate::parser::respath::{Segment, ValueType};
+    // Get the path params into a map, keyed by name.
+    let path_params = req
+        .path()
+        .map(|param| (param.name.as_str(), param))
+        .collect::<HashMap<_, _>>();
+
+    fn typ_to_value_type(param: &Param) -> ParseResult<(ValueType, Option<validation::Expr>)> {
+        // Unwrap any validation expression before we check the type.
+        let (typ, expr) = unwrap_validated(&param.typ);
+        if let Some(expr) = &expr {
+            if let Err(err) = expr.supports_type(typ) {
+                return Err(param.range.parse_err(err.to_string()));
+            }
+        }
+
+        match typ {
+            Type::Basic(Basic::String) => Ok((ValueType::String, expr.cloned())),
+            Type::Basic(Basic::Boolean) => Ok((ValueType::Bool, expr.cloned())),
+            Type::Basic(Basic::Number | Basic::BigInt) => Ok((ValueType::Int, expr.cloned())),
+            typ => Err(param
+                .range
+                .to_span()
+                .parse_err(format!("unsupported path parameter type: {typ:?}"))),
+        }
+    }
+
+    let resolve_value_type = |span: Span, name: &str| {
+        match path_params.get(name) {
+            Some(param) => typ_to_value_type(param),
+            None => {
+                // Raw endpoints assume path params are strings.
+                if raw {
+                    Ok((ValueType::String, None))
+                } else {
+                    Err(span.parse_err("path parameter not found in request schema"))
+                }
+            }
+        }
+    };
+
+    let mut segments = Vec::with_capacity(path.segments.len());
+    for seg in path.segments.into_iter() {
+        let (seg_span, seg) = seg.split();
+        let seg = match seg {
+            Segment::Literal(_) => seg,
+            Segment::Param { name, .. } => {
+                let (value_type, validation) = resolve_value_type(seg_span, &name)?;
+                Segment::Param {
+                    name,
+                    value_type,
+                    validation,
+                }
+            }
+            Segment::Wildcard { name, .. } => {
+                let (_, validation) = resolve_value_type(seg_span, &name)?;
+                Segment::Wildcard { name, validation }
+            }
+            Segment::Fallback { name, .. } => {
+                let (_, validation) = resolve_value_type(seg_span, &name)?;
+                Segment::Fallback { name, validation }
+            }
+        };
+        segments.push(Sp::new(seg_span, seg));
+    }
+
+    Ok(Path {
+        span: path.span,
+        segments,
+    })
+}
+
+pub fn resolve_wire_spec(typ: &Type) -> Option<&WireSpec> {
+    match typ {
+        Type::Custom(Custom::WireSpec(spec)) => Some(spec),
+        Type::Validated(v) => resolve_wire_spec(&v.typ),
+        Type::Optional(opt) => resolve_wire_spec(&opt.0),
+        _ => None,
+    }
+}
+
+fn rewrite_custom_type_field(field: &InterfaceField, field_name: &str) -> Field {
+    let mut standard_field = Field {
+        name: field_name.to_string(),
+        typ: field.typ.clone(),
+        optional: field.optional,
+        custom: None,
+        range: field.range,
+    };
+
+    if let Some(spec) = resolve_wire_spec(&field.typ) {
+        standard_field.custom = Some(spec.clone());
+    };
+
+    standard_field
+}
diff --git a/tsparser/src/parser/resources/apis/gateway.rs b/tsparser/src/parser/resources/apis/gateway.rs
new file mode 100644
index 0000000000..1723841d8c
--- /dev/null
+++ b/tsparser/src/parser/resources/apis/gateway.rs
@@ -0,0 +1,73 @@
+use litparser_derive::LitParser;
+use swc_common::sync::Lrc;
+use swc_ecma_ast as ast;
+
+use litparser::{report_and_continue, LitParser};
+
+use crate::parser::resourceparser::bind::{BindData, BindKind, ResourceOrPath};
+use crate::parser::resourceparser::paths::PkgPath;
+use crate::parser::resourceparser::resource_parser::ResourceParser;
+use crate::parser::resources::parseutil::{
+    iter_references, resolve_object_for_bind_name, TrackedNames, UnnamedClassResource,
+};
+use crate::parser::resources::Resource;
+use crate::parser::types::Object;
+use crate::parser::Range;
+use crate::span_err::ErrReporter;
+
+#[derive(Debug, Clone)]
+pub struct Gateway {
+    pub range: Range,
+    pub name: String,
+    pub doc: Option<String>,
+    pub auth_handler: Option<Lrc<Object>>,
+}
+
+#[allow(non_snake_case, dead_code)]
+#[derive(Debug, LitParser)]
+struct DecodedGatewayConfig {
+    authHandler: Option<ast::Expr>,
+}
+
+pub const GATEWAY_PARSER: ResourceParser = ResourceParser {
+    name: "gateway",
+    interesting_pkgs: &[PkgPath("encore.dev/api")],
+
+    run: |pass| {
+        let names = TrackedNames::new(&[("encore.dev/api", "Gateway")]);
+
+        let module = pass.module.clone();
+        type Res = UnnamedClassResource<DecodedGatewayConfig>;
+        for r in iter_references::<Res>(&module, &names) {
+            let r = report_and_continue!(r);
+
+            let object =
+                resolve_object_for_bind_name(pass.type_checker, pass.module.clone(), &r.bind_name);
+
+            let auth_handler = if let Some(expr) = r.config.authHandler {
+                let Some(obj) = pass.type_checker.resolve_obj(pass.module.clone(), &expr) else {
+                    expr.err("cannot resolve auth handler");
+                    continue;
+                };
+                Some(obj)
+            } else {
+                None
+            };
+
+            let resource = Resource::Gateway(Lrc::new(Gateway {
+                range: r.range,
+                name: "api-gateway".into(),
+                doc: r.doc_comment,
+                auth_handler,
+            }));
+            pass.add_resource(resource.clone());
+            pass.add_bind(BindData {
+                range: r.range,
+                resource: ResourceOrPath::Resource(resource),
+                object,
+                kind: BindKind::Create,
+                ident: r.bind_name,
+            });
+        }
+    },
+};
diff --git a/tsparser/src/parser/resources/apis/mod.rs b/tsparser/src/parser/resources/apis/mod.rs
new file mode 100644
index 0000000000..a707684ba7
--- /dev/null
+++ b/tsparser/src/parser/resources/apis/mod.rs
@@ -0,0 +1,6 @@
+pub mod api;
+pub mod authhandler;
+pub mod encoding;
+pub mod gateway;
+pub mod service;
+pub mod service_client;
diff --git a/tsparser/src/parser/resources/apis/service.rs b/tsparser/src/parser/resources/apis/service.rs
new file mode 100644
index 0000000000..fb103ab61c
--- /dev/null
+++ b/tsparser/src/parser/resources/apis/service.rs
@@ -0,0 +1,138 @@
+use litparser::{report_and_continue, ParseResult};
+use swc_common::sync::Lrc;
+use swc_common::Spanned;
+use swc_ecma_ast::{self as ast};
+
+use litparser::LitParser;
+use litparser_derive::LitParser;
+
+use crate::parser::module_loader::Module;
+use crate::parser::resourceparser::bind::{BindData, BindKind};
+use crate::parser::resourceparser::bind::{BindName, ResourceOrPath};
+use crate::parser::resourceparser::paths::PkgPath;
+use crate::parser::resourceparser::resource_parser::ResourceParser;
+use crate::parser::resources::parseutil::{
+    extract_bind_name, extract_resource_name, iter_references, TrackedNames,
+};
+use crate::parser::resources::parseutil::{is_default_export, ReferenceParser};
+use crate::parser::resources::Resource;
+use crate::parser::{FilePath, Range};
+use crate::span_err::ErrReporter;
+
+#[derive(Debug, Clone)]
+pub struct Service {
+    pub range: Range,
+    pub name: String,
+    pub doc: Option<String>,
+}
+
+#[allow(dead_code)]
+#[derive(LitParser, Default, Debug)]
+struct DecodedServiceConfig {
+    middlewares: Option<ast::Expr>,
+}
+
+pub static SERVICE_PARSER: ResourceParser = ResourceParser {
+    name: "service",
+    interesting_pkgs: &[PkgPath("encore.dev/service")],
+
+    run: |pass| {
+        let names = TrackedNames::new(&[("encore.dev/service", "Service")]);
+
+        let module = pass.module.clone();
+        {
+            for (i, r) in iter_references::<ServiceLiteral>(&module, &names).enumerate() {
+                let r = report_and_continue!(r);
+
+                if i > 0 {
+                    r.range
+                        .err("cannot have multiple service declarations in the same module");
+                    continue;
+                }
+
+                // This resource is only allowed to be defined in a module named "encore.service.ts".
+                // Check that that is the case.
+                match &pass.module.file_path {
+                    FilePath::Real(buf) if buf.ends_with("encore.service.ts") => {}
+                    _ => {
+                        r.range
+                            .err("service declarations are only allowed in encore.service.ts");
+                        continue;
+                    }
+                }
+
+                let resource = Resource::Service(Lrc::new(Service {
+                    range: r.range,
+                    name: r.resource_name,
+                    doc: r.doc_comment,
+                }));
+                pass.add_resource(resource.clone());
+                pass.add_bind(BindData {
+                    range: r.range,
+                    resource: ResourceOrPath::Resource(resource),
+                    object: None,
+                    kind: BindKind::Create,
+                    ident: BindName::DefaultExport,
+                });
+            }
+        }
+    },
+};
+
+#[allow(dead_code)]
+#[derive(Debug)]
+struct ServiceLiteral {
+    pub range: Range,
+    pub doc_comment: Option<String>,
+    pub resource_name: String,
+    pub config: Option<DecodedServiceConfig>,
+}
+
+impl ReferenceParser for ServiceLiteral {
+    fn parse_resource_reference(
+        module: &Module,
+        path: &swc_ecma_visit::AstNodePath,
+    ) -> ParseResult<Option<Self>> {
+        for node in path.iter().rev() {
+            if let swc_ecma_visit::AstParentNodeRef::NewExpr(
+                expr,
+                swc_ecma_visit::fields::NewExprField::Callee,
+            ) = node
+            {
+                let Some(args) = &expr.args else {
+                    expr.span().err("missing constructor arguments");
+                    continue;
+                };
+
+                if let Some(bind_name) = extract_bind_name(path)? {
+                    bind_name
+                        .span()
+                        .err("service definitions should not be bound to a variable");
+                    continue;
+                }
+
+                let resource_name = extract_resource_name(expr.span, args, 0)?;
+                let doc_comment = module.preceding_comments(expr.span.lo.into());
+
+                let config = args
+                    .get(1)
+                    .map(|arg| DecodedServiceConfig::parse_lit(&arg.expr))
+                    .transpose()?;
+
+                if !is_default_export(path, (*expr).into()) {
+                    expr.span().err("service must be default export");
+                    continue;
+                }
+
+                return Ok(Some(Self {
+                    range: expr.span.into(),
+                    doc_comment,
+                    resource_name: resource_name.to_string(),
+                    config,
+                }));
+            }
+        }
+
+        Ok(None)
+    }
+}
diff --git a/tsparser/src/parser/resources/apis/service_client.rs b/tsparser/src/parser/resources/apis/service_client.rs
new file mode 100644
index 0000000000..d072234dbf
--- /dev/null
+++ b/tsparser/src/parser/resources/apis/service_client.rs
@@ -0,0 +1,29 @@
+use crate::parser::resources::apis::api::CallEndpointUsage;
+use crate::parser::usageparser::{ResolveUsageData, Usage, UsageExprKind};
+use crate::span_err::ErrReporter;
+use swc_common::sync::Lrc;
+
+#[derive(Debug, Clone)]
+pub struct ServiceClient {
+    pub service_name: String,
+}
+
+pub fn resolve_service_client_usage(
+    data: &ResolveUsageData,
+    client: Lrc<ServiceClient>,
+) -> Option<Usage> {
+    match &data.expr.kind {
+        UsageExprKind::MethodCall(method) => {
+            let method_name = method.method.as_ref();
+
+            Some(Usage::CallEndpoint(CallEndpointUsage {
+                range: data.expr.range,
+                endpoint: (client.service_name.clone(), method_name.to_string()),
+            }))
+        }
+        _ => {
+            data.expr.err("invalid service client usage");
+            None
+        }
+    }
+}
diff --git a/tsparser/src/parser/resources/infra/cron.rs b/tsparser/src/parser/resources/infra/cron.rs
new file mode 100644
index 0000000000..0e1ea76bf9
--- /dev/null
+++ b/tsparser/src/parser/resources/infra/cron.rs
@@ -0,0 +1,133 @@
+use std::rc::Rc;
+
+use litparser_derive::LitParser;
+use swc_common::sync::Lrc;
+use swc_common::{Span, Spanned};
+use swc_ecma_ast as ast;
+
+use litparser::{report_and_continue, LitParser, ParseResult, Sp, ToParseErr};
+
+use crate::parser::resourceparser::bind::{BindData, BindKind, ResourceOrPath};
+use crate::parser::resourceparser::paths::PkgPath;
+use crate::parser::resourceparser::resource_parser::ResourceParser;
+use crate::parser::resourceparser::ResourceParseContext;
+use crate::parser::resources::parseutil::{
+    iter_references, resolve_object_for_bind_name, NamedClassResource, TrackedNames,
+};
+use crate::parser::resources::Resource;
+use crate::parser::types::Object;
+
+#[derive(Debug, Clone)]
+pub struct CronJob {
+    pub name: String,
+    pub title: Option<String>,
+    pub doc: Option<String>,
+    pub schedule: CronJobSchedule,
+    pub endpoint: Sp<Rc<Object>>,
+}
+
+#[derive(Debug, Clone)]
+pub enum CronJobSchedule {
+    Every(u32), // every N minutes
+    Cron(CronExpr),
+}
+
+#[derive(Debug, Clone)]
+pub struct CronExpr(pub String);
+
+#[derive(Debug, LitParser)]
+struct DecodedCronJobConfig {
+    endpoint: ast::Expr,
+    title: Option<String>,
+    every: Option<Sp<std::time::Duration>>,
+    schedule: Option<Sp<CronExpr>>,
+}
+
+pub const CRON_PARSER: ResourceParser = ResourceParser {
+    name: "cron",
+    interesting_pkgs: &[PkgPath("encore.dev/cron")],
+
+    run: |pass| {
+        let names = TrackedNames::new(&[("encore.dev/cron", "CronJob")]);
+
+        let module = pass.module.clone();
+        type Res = NamedClassResource<DecodedCronJobConfig>;
+        for r in iter_references::<Res>(&module, &names) {
+            let r = report_and_continue!(r);
+            report_and_continue!(parse_cron_job(pass, r));
+        }
+    },
+};
+
+fn parse_cron_job(
+    pass: &mut ResourceParseContext,
+    r: NamedClassResource<DecodedCronJobConfig>,
+) -> ParseResult<()> {
+    let object = resolve_object_for_bind_name(pass.type_checker, pass.module.clone(), &r.bind_name);
+
+    let endpoint = pass
+        .type_checker
+        .resolve_obj(pass.module.clone(), &r.config.endpoint)
+        .ok_or(r.config.endpoint.parse_err("cannot resolve endpoint"))?;
+
+    let schedule = r.config.parse_schedule(r.range.to_span())?;
+    let resource = Resource::CronJob(Lrc::new(CronJob {
+        name: r.resource_name.to_owned(),
+        doc: r.doc_comment,
+        title: r.config.title,
+        endpoint: Sp::new(r.config.endpoint.span(), endpoint),
+        schedule,
+    }));
+    pass.add_resource(resource.clone());
+    pass.add_bind(BindData {
+        range: r.range,
+        resource: ResourceOrPath::Resource(resource),
+        object,
+        kind: BindKind::Create,
+        ident: r.bind_name,
+    });
+    Ok(())
+}
+
+impl LitParser for CronExpr {
+    fn parse_lit(input: &ast::Expr) -> ParseResult<Self> {
+        match input {
+            ast::Expr::Lit(ast::Lit::Str(str)) => {
+                // Ensure the cron expression is valid
+                let expr = str.value.as_ref();
+                cron_parser::parse(expr, &chrono::Utc::now())
+                    .map_err(|err| input.parse_err(err.to_string()))?;
+                Ok(CronExpr(expr.to_string()))
+            }
+            _ => Err(input.parse_err("expected cron expression")),
+        }
+    }
+}
+
+impl DecodedCronJobConfig {
+    fn parse_schedule(&self, def_span: Span) -> ParseResult<CronJobSchedule> {
+        match (self.every, self.schedule.as_ref()) {
+            (None, Some(schedule)) => Ok(CronJobSchedule::Cron(schedule.clone().take())),
+            (Some(every), None) => {
+                // TODO introduce more robust validation and error reporting here.
+                let secs = every.as_secs();
+                if secs % 60 != 0 {
+                    return Err(every
+                        .span()
+                        .parse_err("`every` must be a multiple of 60 seconds"));
+                }
+                let mins = secs / 60;
+                if mins > (24 * 60) {
+                    return Err(every.span().parse_err("`every` must be at most 24 hours"));
+                }
+                Ok(CronJobSchedule::Every(mins as u32))
+            }
+            (None, None) => {
+                Err(def_span.parse_err("expected either `every` or `schedule` to be set"))
+            }
+            (Some(_), Some(_)) => {
+                Err(def_span.parse_err("expected either `every` or `schedule` to be set, not both"))
+            }
+        }
+    }
+}
diff --git a/tsparser/src/parser/resources/infra/mod.rs b/tsparser/src/parser/resources/infra/mod.rs
new file mode 100644
index 0000000000..2babf8b0f6
--- /dev/null
+++ b/tsparser/src/parser/resources/infra/mod.rs
@@ -0,0 +1,6 @@
+pub mod cron;
+pub mod objects;
+pub mod pubsub_subscription;
+pub mod pubsub_topic;
+pub mod secret;
+pub mod sqldb;
diff --git a/tsparser/src/parser/resources/infra/objects.rs b/tsparser/src/parser/resources/infra/objects.rs
new file mode 100644
index 0000000000..3caef16c3a
--- /dev/null
+++ b/tsparser/src/parser/resources/infra/objects.rs
@@ -0,0 +1,306 @@
+use std::ops::Deref;
+
+use litparser::{report_and_continue, LitParser};
+use litparser_derive::LitParser;
+use swc_common::sync::Lrc;
+use swc_ecma_ast as ast;
+
+use crate::parser::resourceparser::bind::ResourceOrPath;
+use crate::parser::resourceparser::bind::{BindData, BindKind};
+use crate::parser::resourceparser::paths::PkgPath;
+use crate::parser::resourceparser::resource_parser::ResourceParser;
+use crate::parser::resources::parseutil::{
+    iter_references, resolve_object_for_bind_name, TrackedNames,
+};
+use crate::parser::resources::parseutil::{NamedClassResourceOptionalConfig, NamedStaticMethod};
+use crate::parser::resources::Resource;
+use crate::parser::resources::ResourcePath;
+use crate::parser::types::{Generic, Type};
+use crate::parser::usageparser::{MethodCall, ResolveUsageData, Usage, UsageExprKind};
+use crate::parser::Range;
+use crate::span_err::ErrReporter;
+
+#[derive(Debug, Clone)]
+pub struct Bucket {
+    pub name: String,
+    pub doc: Option<String>,
+    pub versioned: bool,
+    pub public: bool,
+}
+
+#[derive(LitParser, Default)]
+struct DecodedBucketConfig {
+    pub versioned: Option<bool>,
+    pub public: Option<bool>,
+}
+
+pub const OBJECTS_PARSER: ResourceParser = ResourceParser {
+    name: "objects",
+    interesting_pkgs: &[PkgPath("encore.dev/storage/objects")],
+
+    run: |pass| {
+        let names = TrackedNames::new(&[("encore.dev/storage/objects", "Bucket")]);
+
+        let module = pass.module.clone();
+        {
+            type Res = NamedClassResourceOptionalConfig<DecodedBucketConfig>;
+            for r in iter_references::<Res>(&module, &names) {
+                let r = report_and_continue!(r);
+                let cfg = r.config.unwrap_or_default();
+
+                let object = resolve_object_for_bind_name(
+                    pass.type_checker,
+                    pass.module.clone(),
+                    &r.bind_name,
+                );
+
+                let resource = Resource::Bucket(Lrc::new(Bucket {
+                    name: r.resource_name,
+                    doc: r.doc_comment,
+                    versioned: cfg.versioned.unwrap_or(false),
+                    public: cfg.public.unwrap_or(false),
+                }));
+
+                pass.add_resource(resource.clone());
+                pass.add_bind(BindData {
+                    range: r.range,
+                    resource: ResourceOrPath::Resource(resource),
+                    object,
+                    kind: BindKind::Create,
+                    ident: r.bind_name,
+                });
+            }
+        }
+
+        {
+            for r in iter_references::<NamedStaticMethod>(&module, &names) {
+                let r = report_and_continue!(r);
+                let object = resolve_object_for_bind_name(
+                    pass.type_checker,
+                    pass.module.clone(),
+                    &r.bind_name,
+                );
+                pass.add_bind(BindData {
+                    range: r.range,
+                    resource: ResourceOrPath::Path(ResourcePath::Bucket {
+                        name: r.resource_name,
+                    }),
+                    object,
+                    kind: BindKind::Reference,
+                    ident: r.bind_name,
+                });
+            }
+        }
+    },
+};
+
+pub fn resolve_bucket_usage(data: &ResolveUsageData, bucket: Lrc<Bucket>) -> Option<Usage> {
+    match &data.expr.kind {
+        UsageExprKind::MethodCall(call) => {
+            if call.method.as_ref() == "ref" {
+                let Some(type_args) = call.call.type_args.as_deref() else {
+                    call.call
+                        .span
+                        .err("expected a type argument in call to Bucket.ref");
+                    return None;
+                };
+
+                let Some(type_arg) = type_args.params.first() else {
+                    call.call
+                        .span
+                        .err("expected a type argument in call to Bucket.ref");
+                    return None;
+                };
+
+                return parse_bucket_ref(data, bucket, call, type_arg);
+            }
+
+            let op = match call.method.as_ref() {
+                "list" => Operation::ListObjects,
+                "exists" | "attrs" => Operation::GetObjectMetadata,
+                "upload" => Operation::WriteObject,
+                "signedUploadUrl" => Operation::SignedUploadUrl,
+                "signedDownloadUrl" => Operation::SignedDownloadUrl,
+                "download" => Operation::ReadObjectContents,
+                "remove" => Operation::DeleteObject,
+
+                "publicUrl" => {
+                    // Make sure the bucket is public.
+                    if !bucket.public {
+                        call.call
+                            .span
+                            .err("cannot call publicUrl on a non-public bucket");
+                    }
+
+                    // Technically, getting a public URL does not require additional
+                    // permissions, but we track it anyway so that we can track which
+                    // service(s) need to receive the bucket configuration.
+                    Operation::GetPublicUrl
+                }
+
+                _ => {
+                    call.method.err("unsupported bucket operation");
+                    return None;
+                }
+            };
+
+            Some(Usage::Bucket(BucketUsage {
+                range: data.expr.range,
+                bucket,
+                ops: vec![op],
+            }))
+        }
+
+        _ => {
+            data.expr
+                .range
+                .to_span()
+                .err("invalid use of bucket resource");
+            None
+        }
+    }
+}
+
+fn parse_bucket_ref(
+    data: &ResolveUsageData,
+    bucket: Lrc<Bucket>,
+    _call: &MethodCall,
+    type_arg: &ast::TsType,
+) -> Option<Usage> {
+    fn process_type(
+        data: &ResolveUsageData,
+        sp: &swc_common::Span,
+        t: &Type,
+        depth: usize,
+    ) -> Option<Vec<Operation>> {
+        if depth > 10 {
+            // Prevent infinite recursion.
+            return None;
+        }
+
+        match t {
+            Type::Named(named) => {
+                let ops = match named.obj.name.as_deref() {
+                    Some("Lister") => vec![Operation::ListObjects],
+                    Some("Attrser") => vec![Operation::GetObjectMetadata],
+                    Some("Uploader") => vec![Operation::WriteObject],
+                    Some("SignedUploader") => vec![Operation::SignedUploadUrl],
+                    Some("Downloader") => vec![Operation::ReadObjectContents],
+                    Some("SignedDownloader") => vec![Operation::SignedDownloadUrl],
+                    Some("Remover") => vec![Operation::DeleteObject],
+                    Some("PublicUrler") => vec![Operation::GetPublicUrl],
+                    _ => {
+                        let underlying = data.type_checker.resolve_obj_type(&named.obj);
+                        return process_type(data, sp, &underlying, depth + 1);
+                    }
+                };
+
+                Some(ops)
+            }
+
+            Type::Class(cls) => {
+                let ops = cls
+                    .methods
+                    .iter()
+                    .filter_map(|method| {
+                        let op = match method.as_str() {
+                            "list" => Operation::ListObjects,
+                            "exists" | "attrs" => Operation::GetObjectMetadata,
+                            "upload" => Operation::WriteObject,
+                            "signedUploadUrl" => Operation::SignedUploadUrl,
+                            "download" => Operation::ReadObjectContents,
+                            "signedDownloadUrl" => Operation::SignedDownloadUrl,
+                            "remove" => Operation::DeleteObject,
+                            "publicUrl" => Operation::GetPublicUrl,
+                            _ => {
+                                // Ignore other methods.
+                                return None;
+                            }
+                        };
+
+                        Some(op)
+                    })
+                    .collect();
+                Some(ops)
+            }
+
+            Type::Generic(Generic::Intersection(int)) => {
+                let mut result = Vec::new();
+                for t in &[&int.x, &int.y] {
+                    if let Some(ops) = process_type(data, sp, t, depth + 1) {
+                        result.extend(ops);
+                    }
+                }
+
+                if result.is_empty() {
+                    None
+                } else {
+                    Some(result)
+                }
+            }
+
+            _ => {
+                sp.err(&format!("unsupported bucket permission type {t:#?}"));
+                None
+            }
+        }
+    }
+
+    let typ = data
+        .type_checker
+        .resolve_type(data.module.clone(), type_arg);
+
+    if let Some(ops) = process_type(data, &typ.span(), typ.deref(), 0) {
+        if !bucket.public && ops.contains(&Operation::GetPublicUrl) {
+            typ.span()
+                .err("cannot use publicUrl on a non-public bucket");
+        }
+
+        Some(Usage::Bucket(BucketUsage {
+            range: data.expr.range,
+            bucket,
+            ops,
+        }))
+    } else {
+        typ.err("no bucket permissions found in type argument");
+        None
+    }
+}
+
+#[derive(Debug)]
+pub struct BucketUsage {
+    pub range: Range,
+    pub bucket: Lrc<Bucket>,
+    pub ops: Vec<Operation>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Operation {
+    /// Listing objects and accessing their metadata during list operations.
+    ListObjects,
+
+    /// Reading the contents of an object.
+    ReadObjectContents,
+
+    /// Creating or updating an object, with contents and metadata.
+    WriteObject,
+
+    /// Updating the metadata of an object, without reading or writing its contents.
+    UpdateObjectMetadata,
+
+    /// Reading the metadata of an object, or checking for its existence.
+    GetObjectMetadata,
+
+    /// Deleting an object.
+    DeleteObject,
+
+    /// Getting the public URL for the bucket/an object.
+    GetPublicUrl,
+
+    /// Generating a signed URL to allow an external recipient to create or
+    /// update an object.
+    SignedUploadUrl,
+
+    /// Generating a signed URL to allow an external recipient to read an object.
+    SignedDownloadUrl,
+}
diff --git a/tsparser/src/parser/resources/infra/pubsub_subscription.rs b/tsparser/src/parser/resources/infra/pubsub_subscription.rs
new file mode 100644
index 0000000000..b4a4567f60
--- /dev/null
+++ b/tsparser/src/parser/resources/infra/pubsub_subscription.rs
@@ -0,0 +1,132 @@
+use std::rc::Rc;
+
+use litparser_derive::LitParser;
+use swc_common::sync::Lrc;
+use swc_common::Spanned;
+use swc_ecma_ast as ast;
+
+use litparser::{report_and_continue, LitParser, Sp};
+
+use crate::parser::resourceparser::bind::{BindData, BindKind, ResourceOrPath};
+use crate::parser::resourceparser::paths::PkgPath;
+use crate::parser::resourceparser::resource_parser::ResourceParser;
+use crate::parser::resources::parseutil::{
+    iter_references, resolve_object_for_bind_name, NamedClassResource, TrackedNames,
+};
+use crate::parser::resources::Resource;
+use crate::parser::types::Object;
+use crate::parser::Range;
+use crate::span_err::ErrReporter;
+
+#[derive(Debug, Clone)]
+pub struct Subscription {
+    pub range: Range,
+    pub topic: Sp<Rc<Object>>,
+    pub name: String,
+    pub doc: Option<String>,
+    pub config: SubscriptionConfig,
+}
+
+#[derive(Debug, Clone)]
+pub struct SubscriptionConfig {
+    pub ack_deadline: std::time::Duration,
+    pub message_retention: std::time::Duration,
+    pub min_retry_backoff: std::time::Duration,
+    pub max_retry_backoff: std::time::Duration,
+    pub max_retries: u32,
+    pub max_concurrency: Option<u32>,
+}
+
+#[allow(non_snake_case)]
+#[derive(Debug, LitParser)]
+struct DecodedSubscriptionConfig {
+    #[allow(dead_code)]
+    handler: ast::Expr,
+    #[allow(dead_code)]
+    maxConcurrency: Option<u32>,
+    ackDeadline: Option<std::time::Duration>,
+    messageRetention: Option<std::time::Duration>,
+    retryPolicy: Option<DecodedRetryPolicy>,
+}
+
+#[allow(non_snake_case)]
+#[derive(Debug, LitParser)]
+struct DecodedRetryPolicy {
+    minBackoff: Option<std::time::Duration>,
+    maxBackoff: Option<std::time::Duration>,
+    maxRetries: Option<u32>,
+}
+
+pub const SUBSCRIPTION_PARSER: ResourceParser = ResourceParser {
+    name: "pubsub_subscription",
+    interesting_pkgs: &[PkgPath("encore.dev/pubsub")],
+
+    run: |pass| {
+        let names = TrackedNames::new(&[("encore.dev/pubsub", "Subscription")]);
+        let module = pass.module.clone();
+
+        type Res = NamedClassResource<DecodedSubscriptionConfig, 1, 2>;
+        for r in iter_references::<Res>(&module, &names) {
+            let r = report_and_continue!(r);
+            let topic_expr = r.constructor_args[0].clone();
+            if let Some(spread) = topic_expr.spread.as_ref() {
+                spread.err("cannot use ... for PubSub topic reference");
+                continue;
+            }
+            let object =
+                resolve_object_for_bind_name(pass.type_checker, pass.module.clone(), &r.bind_name);
+
+            let Some(topic) = pass
+                .type_checker
+                .resolve_obj(pass.module.clone(), &topic_expr.expr)
+            else {
+                topic_expr.expr.err("cannot resolve topic reference");
+                continue;
+            };
+
+            let resource = Resource::PubSubSubscription(Lrc::new(Subscription {
+                range: r.range,
+                topic: Sp::new(topic_expr.expr.span(), topic),
+                name: r.resource_name.to_owned(),
+                doc: r.doc_comment,
+                config: SubscriptionConfig {
+                    ack_deadline: r
+                        .config
+                        .ackDeadline
+                        .unwrap_or(std::time::Duration::from_secs(30)),
+                    message_retention: r
+                        .config
+                        .messageRetention
+                        .unwrap_or(std::time::Duration::from_secs(7 * 24 * 60 * 60)),
+                    min_retry_backoff: r
+                        .config
+                        .retryPolicy
+                        .as_ref()
+                        .and_then(|p| p.minBackoff)
+                        .unwrap_or(std::time::Duration::from_secs(10)),
+                    max_retry_backoff: r
+                        .config
+                        .retryPolicy
+                        .as_ref()
+                        .and_then(|p| p.maxBackoff)
+                        .unwrap_or(std::time::Duration::from_secs(10 * 60)),
+                    max_retries: r
+                        .config
+                        .retryPolicy
+                        .as_ref()
+                        .and_then(|p| p.maxRetries)
+                        .unwrap_or(100),
+                    max_concurrency: r.config.maxConcurrency,
+                },
+            }));
+            pass.add_resource(resource.clone());
+            pass.add_bind(BindData {
+                range: r.range,
+                resource: ResourceOrPath::Resource(resource),
+                object,
+                kind: BindKind::Create,
+                ident: r.bind_name,
+            });
+        }
+    },
+};
diff --git a/tsparser/src/parser/resources/infra/pubsub_topic.rs b/tsparser/src/parser/resources/infra/pubsub_topic.rs
new file mode 100644
index 0000000000..a673da63bf
--- /dev/null
+++ b/tsparser/src/parser/resources/infra/pubsub_topic.rs
@@ -0,0 +1,157 @@
+use litparser_derive::LitParser;
+use swc_common::sync::Lrc;
+use swc_ecma_ast as ast;
+
+use litparser::{report_and_continue, LitParser, ParseResult, Sp, ToParseErr};
+
+use crate::parser::module_loader::Module;
+use crate::parser::resourceparser::bind::{BindData, BindKind, BindName, ResourceOrPath};
+use crate::parser::resourceparser::paths::PkgPath;
+use crate::parser::resourceparser::resource_parser::ResourceParser;
+use crate::parser::resources::parseutil::{
+    extract_type_param, iter_references, resolve_object_for_bind_name, NamedClassResource,
+    ReferenceParser, TrackedNames,
+};
+use crate::parser::resources::Resource;
+use crate::parser::types::Type;
+use crate::parser::usageparser::{ResolveUsageData, Usage, UsageExprKind};
+use crate::parser::Range;
+use crate::span_err::ErrReporter;
+
+#[derive(Debug, Clone)]
+pub struct Topic {
+    pub name: String,
+    pub doc: Option<String>,
+    pub delivery_guarantee: DeliveryGuarantee,
+    pub ordering_attribute: Option<String>,
+    pub message_type: Sp<Type>,
+}
+
+#[derive(Debug, Clone, Copy)]
+pub enum DeliveryGuarantee {
+    AtLeastOnce,
+    ExactlyOnce,
+}
+
+#[derive(Debug, LitParser)]
+#[allow(non_snake_case, dead_code)]
+struct DecodedTopicConfig {
+    deliveryGuarantee: Option<Sp<String>>,
+    orderingAttribute: Option<String>,
+}
+
+impl DecodedTopicConfig {
+    fn delivery_guarantee(&self) -> ParseResult<DeliveryGuarantee> {
+        let Some(delivery_guarantee) = &self.deliveryGuarantee else {
+            return Ok(DeliveryGuarantee::AtLeastOnce);
+        };
+
+        match delivery_guarantee.as_str() {
+            "at-least-once" => Ok(DeliveryGuarantee::AtLeastOnce),
+            "exactly-once" => Ok(DeliveryGuarantee::ExactlyOnce),
+            _ => Err(delivery_guarantee.parse_err("invalid delivery guarantee")),
+        }
+    }
+}
+
+pub const TOPIC_PARSER: ResourceParser = ResourceParser {
+    name: "pubsub_topic",
+    interesting_pkgs: &[PkgPath("encore.dev/pubsub")],
+
+    run: |pass| {
+        let names = TrackedNames::new(&[("encore.dev/pubsub", "Topic")]);
+        let module = pass.module.clone();
+
+        for r in iter_references::<PubSubTopicDefinition>(&module, &names) {
+            let r = report_and_continue!(r);
+            let object =
+                resolve_object_for_bind_name(pass.type_checker, pass.module.clone(), &r.bind_name);
+
+            let message_type = pass
+                .type_checker
+                .resolve_type(pass.module.clone(), &r.message_type);
+
+            let delivery_guarantee = report_and_continue!(r.config.delivery_guarantee());
+            let resource = Resource::PubSubTopic(Lrc::new(Topic {
+                name: r.resource_name.to_owned(),
+                doc: r.doc_comment,
+                delivery_guarantee,
+                message_type,
+                ordering_attribute: r.config.orderingAttribute,
+            }));
+            pass.add_resource(resource.clone());
+            pass.add_bind(BindData {
+                range: r.range,
+                resource: ResourceOrPath::Resource(resource),
+                object,
+                kind: BindKind::Create,
+                ident: r.bind_name,
+            });
+        }
+    },
+};
+
+#[derive(Debug)]
+struct PubSubTopicDefinition {
+    pub range: Range,
+    pub resource_name: String,
+    pub config: DecodedTopicConfig,
+    pub doc_comment: Option<String>,
+    pub bind_name: BindName,
+    pub message_type: ast::TsType,
+}
+
+impl ReferenceParser for PubSubTopicDefinition {
+    fn parse_resource_reference(
+        module: &Module,
+        path: &swc_ecma_visit::AstNodePath,
+    ) -> ParseResult<Option<Self>> {
+        let Some(res) =
+            NamedClassResource::<DecodedTopicConfig, 0, 1>::parse_resource_reference(module, path)?
+        else {
+            return Ok(None);
+        };
+
+        let Some(message_type) = extract_type_param(res.expr.type_args.as_deref(), 0) else {
+            return Err(res.expr.parse_err("missing message type parameter"));
+        };
+
+        Ok(Some(Self {
+            range: res.expr.span.into(),
+            resource_name: res.resource_name,
+            config: res.config,
+            doc_comment: res.doc_comment,
+            bind_name: res.bind_name,
+            message_type: message_type.to_owned(),
+        }))
+    }
+}
+
+#[derive(Debug)]
+pub struct PublishUsage {
+    pub range: Range,
+    pub topic: Lrc<Topic>,
+}
+
+pub fn resolve_topic_usage(data: &ResolveUsageData, topic: Lrc<Topic>) -> Option<Usage> {
+    match &data.expr.kind {
+        UsageExprKind::MethodCall(method) => {
+            if method.method.as_ref() == "publish" {
+                Some(Usage::PublishTopic(PublishUsage {
+                    range: data.expr.range,
+                    topic,
+                }))
+            } else {
+                None
+            }
+        }
+        UsageExprKind::ConstructorArg(_arg) => {
+            // TODO validate: used as a subscription arg most likely
+            None
+        }
+        _ => {
+            data.expr.err("invalid topic usage");
+            None
+        }
+    }
+}
diff --git a/tsparser/src/parser/resources/infra/secret.rs b/tsparser/src/parser/resources/infra/secret.rs
new file mode 100644
index 0000000000..be62cf25f8
--- /dev/null
+++ b/tsparser/src/parser/resources/infra/secret.rs
@@ -0,0 +1,119 @@
+use crate::parser::module_loader::Module;
+use crate::parser::resourceparser::bind::{BindData, BindKind, BindName, ResourceOrPath};
+use crate::parser::resourceparser::paths::PkgPath;
+use crate::parser::resourceparser::resource_parser::ResourceParser;
+use crate::parser::resources::parseutil::{
+    extract_bind_name, iter_references, ReferenceParser, TrackedNames,
+};
+use crate::parser::resources::Resource;
+use crate::parser::Range;
+use crate::span_err::ErrReporter;
+use litparser::{report_and_continue, LitParser, ParseResult};
+use swc_common::errors::HANDLER;
+use swc_common::sync::Lrc;
+use swc_common::Span;
+use swc_ecma_ast as ast;
+
+#[derive(Debug, Clone)]
+pub struct Secret {
+    pub range: Range,
+    pub name: String,
+    pub doc: Option<String>,
+}
+
+pub const SECRET_PARSER: ResourceParser = ResourceParser {
+    name: "secret",
+    interesting_pkgs: &[PkgPath("encore.dev/config")],
+
+    run: |pass| {
+        let module = pass.module.clone();
+        let names = TrackedNames::new(&[("encore.dev/config", "secret")]);
+
+        for r in iter_references::<SecretLiteral>(&module, &names) {
+            let r = report_and_continue!(r);
+            let resource = Resource::Secret(Lrc::new(Secret {
+                range: r.range,
+                name: r.secret_name,
+                doc: r.doc_comment,
+            }));
+
+            let object = pass
+                .type_checker
+                .resolve_obj(pass.module.clone(), &ast::Expr::Ident(r.bind_name.clone()));
+
+            pass.add_resource(resource.clone());
+            pass.add_bind(BindData {
+                range: r.range,
+                resource: ResourceOrPath::Resource(resource),
+                object,
+                kind: BindKind::Create,
+                ident: BindName::Named(r.bind_name),
+            });
+        }
+    },
+};
+
+#[derive(Debug)]
+struct SecretLiteral {
+    pub range: Range,
+    pub doc_comment: Option<String>,
+    pub secret_name: String,
+    pub bind_name: ast::Ident,
+}
+
+fn inside_function(path: &swc_ecma_visit::AstNodePath) -> Option<Span> {
+    for item in path.iter().rev() {
+        match item {
+            swc_ecma_visit::AstParentNodeRef::ArrowExpr(expr, ..) => return Some(expr.span),
+            swc_ecma_visit::AstParentNodeRef::Function(expr, ..) => return Some(expr.span),
+            _ => continue,
+        }
+    }
+
+    None
+}
+
+impl ReferenceParser for SecretLiteral {
+    fn parse_resource_reference(
+        module: &Module,
+        path: &swc_ecma_visit::AstNodePath,
+    ) -> ParseResult<Option<Self>> {
+        for node in path.iter().rev() {
+            if let swc_ecma_visit::AstParentNodeRef::CallExpr(
+                expr,
+                swc_ecma_visit::fields::CallExprField::Callee,
+            ) = node
+            {
+                if let Some(fn_span) = inside_function(path) {
+                    HANDLER.with(|handler| {
+                        handler
+                            .struct_span_err(expr.span, "secrets must be defined globally")
+                            .span_note(fn_span, "secret defined within this function")
+                            .emit();
+                    });
+                    return Ok(None);
+                }
+
+                let doc_comment = module.preceding_comments(expr.span.lo.into());
+                let Some(bind_name) = extract_bind_name(path)? else {
+                    expr.span.err("secrets must be bound to a variable");
+                    continue;
+                };
+
+                let Some(secret_name) = &expr.args.first() else {
+                    expr.span.err("secret() takes a single argument, the name of the secret as a string literal");
+                    continue;
+                };
+                let secret_name = String::parse_lit(secret_name.expr.as_ref())?;
+
+                return Ok(Some(Self {
+                    range: expr.span.into(),
+                    doc_comment,
+                    secret_name,
+                    bind_name,
+                }));
+            }
+        }
+        Ok(None)
+    }
+}
diff --git a/tsparser/src/parser/resources/infra/sqldb.rs b/tsparser/src/parser/resources/infra/sqldb.rs
new file mode 100644
index 0000000000..88b048c002
--- /dev/null
+++ b/tsparser/src/parser/resources/infra/sqldb.rs
@@ -0,0 +1,450 @@
+use std::path::{Path, PathBuf};
+use std::str::FromStr;
+
+use itertools::Either;
+use litparser_derive::LitParser;
+use once_cell::sync::Lazy;
+use regex::Regex;
+use swc_common::sync::Lrc;
+use swc_common::{Span, Spanned};
+use swc_ecma_ast as ast;
+
+use litparser::{report_and_continue, LitParser, Sp, ToParseErr};
+use litparser::{LocalRelPath, ParseResult};
+
+use crate::parser::resourceparser::bind::ResourceOrPath;
+use crate::parser::resourceparser::bind::{BindData, BindKind};
+use crate::parser::resourceparser::paths::PkgPath;
+use crate::parser::resourceparser::resource_parser::ResourceParser;
+use crate::parser::resources::parseutil::{
+    iter_references, resolve_object_for_bind_name, TrackedNames,
+};
+use crate::parser::resources::parseutil::{NamedClassResourceOptionalConfig, NamedStaticMethod};
+use crate::parser::resources::Resource;
+use crate::parser::resources::ResourcePath;
+use crate::parser::usageparser::{ResolveUsageData, Usage, UsageExprKind};
+use crate::parser::{FilePath, Range};
+use crate::span_err::{ErrReporter, ErrorWithSpanExt};
+
+#[derive(Debug, Clone)]
+pub struct SQLDatabase {
+    pub span: Span,
+    pub name: String,
+    pub doc: Option<String>,
+    pub migrations: Option<Sp<DBMigrations>>,
+}
+
+#[derive(Clone, Debug)]
+pub enum MigrationFileSource {
+    Prisma,
+    Drizzle,
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum MigrationFileSourceParseError {
+    #[error("unexpected value for migration file source: {0}")]
+    UnexpectedValue(String),
+}
+
+impl FromStr for MigrationFileSource {
+    type Err = MigrationFileSourceParseError;
+
+    fn from_str(input: &str) -> Result<MigrationFileSource, Self::Err> {
+        match input {
+            "prisma" => Ok(MigrationFileSource::Prisma),
+            "drizzle" => Ok(MigrationFileSource::Drizzle),
+            _ => Err(MigrationFileSourceParseError::UnexpectedValue(
+                input.to_string(),
+            )),
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct DBMigrations {
+    pub dir: PathBuf,
+    pub migrations: Vec<DBMigration>,
+    pub non_seq_migrations: bool,
+}
+
+#[derive(Debug, Clone)]
+pub struct DBMigration {
+    pub file_name: String,
+    pub description: String,
+    pub number: u64,
+}
+
+#[derive(LitParser, Debug)]
+struct MigrationsConfig {
+    path: LocalRelPath,
+    source: Option<String>,
+}
+
+#[derive(LitParser, Default, Debug)]
+struct DecodedDatabaseConfig {
+    migrations: Option<Either<LocalRelPath, MigrationsConfig>>,
+}
+
+pub const SQLDB_PARSER: ResourceParser = ResourceParser {
+    name: "sqldb",
+    interesting_pkgs: &[PkgPath("encore.dev/storage/sqldb")],
+
+    run: |pass| {
+        let names = TrackedNames::new(&[("encore.dev/storage/sqldb", "SQLDatabase")]);
+
+        let module = pass.module.clone();
+        {
+            type Res = NamedClassResourceOptionalConfig<DecodedDatabaseConfig>;
+            for r in iter_references::<Res>(&module, &names) {
+                let r = report_and_continue!(r);
+                let cfg = r.config.unwrap_or_default();
+
+                let migrations = match (cfg.migrations, &pass.module.file_path) {
+                    (None, _) => None,
+                    (_, FilePath::Custom(_)) => {
+                        pass.module
+                            .ast
+                            .span()
+                            .shrink_to_lo()
+                            .err("cannot use custom file path for db migrations");
+                        continue;
+                    }
+                    (Some(Either::Left(rel)), FilePath::Real(path)) => {
+                        let dir = path.parent().unwrap().join(rel.buf);
+                        let migrations =
+                            report_and_continue!(parse_migrations(rel.span, &dir, None));
+                        Some(Sp::new(
+                            rel.span,
+                            DBMigrations {
+                                dir,
+                                migrations,
+                                non_seq_migrations: false,
+                            },
+                        ))
+                    }
+                    (Some(Either::Right(cfg)), FilePath::Real(path)) => {
+                        let dir = path.parent().unwrap().join(cfg.path.buf);
+                        let source = if let Some(ref string) = cfg.source {
+                            match MigrationFileSource::from_str(string) {
+                                Ok(source) => Some(source),
+                                Err(e) => {
+                                    e.with_span(r.range.into()).report();
+                                    continue;
+                                }
+                            }
+                        } else {
+                            None
+                        };
+
+                        let migrations = report_and_continue!(parse_migrations(
+                            cfg.path.span,
+                            &dir,
+                            source.as_ref()
+                        ));
+                        let non_seq_migrations =
+                            matches!(source, Some(MigrationFileSource::Prisma));
+                        Some(Sp::new(
+                            cfg.path.span,
+                            DBMigrations {
+                                dir,
+                                migrations,
+                                non_seq_migrations,
+                            },
+                        ))
+                    }
+                };
+
+                let object = resolve_object_for_bind_name(
+                    pass.type_checker,
+                    pass.module.clone(),
+                    &r.bind_name,
+                );
+
+                let resource = Resource::SQLDatabase(Lrc::new(SQLDatabase {
+                    span: r.range.to_span(),
+                    name: r.resource_name,
+                    doc: r.doc_comment,
+                    migrations,
+                }));
+                pass.add_resource(resource.clone());
+                pass.add_bind(BindData {
+                    range: r.range,
+                    resource: ResourceOrPath::Resource(resource),
+                    object,
+                    kind: BindKind::Create,
+                    ident: r.bind_name,
+                });
+            }
+        }
+
+        {
+            for r in iter_references::<NamedStaticMethod>(&module, &names) {
+                let r = report_and_continue!(r);
+                let object = resolve_object_for_bind_name(
+                    pass.type_checker,
+                    pass.module.clone(),
+                    &r.bind_name,
+                );
+                pass.add_bind(BindData {
+                    range: r.range,
+                    resource: ResourceOrPath::Path(ResourcePath::SQLDatabase {
+                        name: r.resource_name,
+                    }),
+                    object,
+                    kind: BindKind::Reference,
+                    ident: r.bind_name,
+                });
+            }
+        }
+    },
+};
+
+fn visit_dirs(
+    span: Span,
+    dir: &Path,
+    depth: i8,
+    max_depth: i8,
+    cb: &mut dyn FnMut(&std::fs::DirEntry) -> ParseResult<()>,
+) -> ParseResult<()> {
+    let entries = std::fs::read_dir(dir).map_err(|err| span.parse_err(err.to_string()))?;
+    for entry in entries {
+        let entry = entry.map_err(|err| span.parse_err(err.to_string()))?;
+        let path = entry.path();
+        if path.is_dir() && depth < max_depth {
+            visit_dirs(span, &path, depth + 1, max_depth, cb)?;
+        } else {
+            cb(&entry)?;
+        }
+    }
+    Ok(())
+}
+
+fn parse_default(span: Span, dir: &Path) -> ParseResult<Vec<DBMigration>> {
+    let mut migrations = vec![];
+    static FILENAME_RE: Lazy<Regex> =
+        Lazy::new(|| Regex::new(r"^(\d+)_([^.]+)\.(up|down).sql$").unwrap());
+
+    visit_dirs(span, dir, 0, 0, &mut |entry| -> ParseResult<()> {
+        let path = entry.path();
+        let name = entry.file_name();
+        let name = name.to_str().ok_or(span.parse_err(format!(
+            "invalid migration filename: {}",
+            name.to_string_lossy()
+        )))?;
+
+        // If the file is not an SQL file ignore it, to allow for other files to be present
+        // in the migration directory. For SQL files we want to ensure they're properly named
+        // so that we complain loudly about potential typos. (It's theoretically possible to
+        // typo the filename extension as well, but it's less likely due to syntax highlighting).
+        let ext = path.extension().and_then(|ext| ext.to_str());
+        if ext != Some("sql") {
+            return Ok(());
+        }
+
+        // Ensure the file name matches the regex.
+        let captures = FILENAME_RE
+            .captures(name)
+            .ok_or(span.parse_err(format!("invalid migration filename: {name}")))?;
+        if captures[3].eq("up") {
+            migrations.push(DBMigration {
+                file_name: name.to_string(),
+                description: captures[2].to_string(),
+                number: captures[1]
+                    .parse::<u64>()
+                    .map_err(|err| span.parse_err(err.to_string()))?,
+            });
+        }
+        Ok(())
+    })?;
+
+    migrations.sort_by_key(|m| m.number);
+    Ok(migrations)
+}
+
+fn parse_drizzle(span: Span, dir: &Path) -> ParseResult<Vec<DBMigration>> {
+    let mut migrations = vec![];
+
+    static FILENAME_RE: Lazy<Regex> = Lazy::new(|| Regex::new(r"^(\d+)_([^.]+)\.sql$").unwrap());
+
+    visit_dirs(span, dir, 0, 0, &mut |entry| -> ParseResult<()> {
+        let path = entry.path();
+        let name = entry.file_name();
+        let name = name.to_str().ok_or(span.parse_err(format!(
+            "invalid migration filename: {}",
+            name.to_string_lossy()
+        )))?;
+
+        // If the file is not an SQL file ignore it, to allow for other files to be present
+        // in the migration directory. For SQL files we want to ensure they're properly named
+        // so that we complain loudly about potential typos. (It's theoretically possible to
+        // typo the filename extension as well, but it's less likely due to syntax highlighting).
+        let ext = path.extension().and_then(|ext| ext.to_str());
+        if ext != Some("sql") {
+            return Ok(());
+        }
+
+        // Ensure the file name matches the regex.
+        let captures = FILENAME_RE
+            .captures(name)
+            .ok_or(span.parse_err(format!("invalid migration filename: {name}")))?;
+        migrations.push(DBMigration {
+            file_name: name.to_string(),
+            description: captures[2].to_string(),
+            number: captures[1]
+                .parse::<u64>()
+                .map_err(|err| span.parse_err(err.to_string()))?,
+        });
+
+        Ok(())
+    })?;
+    Ok(migrations)
+}
+
+fn parse_prisma(span: Span, dir: &Path) -> ParseResult<Vec<DBMigration>> {
+    let mut migrations = vec![];
+
+    static FILENAME_RE: Lazy<Regex> = Lazy::new(|| Regex::new(r"^(\d+)_(.*)$").unwrap());
+
+    visit_dirs(span, dir, 0, 1, &mut |entry| -> ParseResult<()> {
+        let path = entry.path();
+        let name = entry.file_name();
+        let name = name.to_str().ok_or(span.parse_err(format!(
+            "invalid migration filename: {}",
+            name.to_string_lossy()
+        )))?;
+        if name != "migration.sql" {
+            return Ok(());
+        }
+        let dir_name = path
+            .parent()
+            .ok_or(span.parse_err("migration directory has no parent"))?
+            .file_name()
+            .ok_or(span.parse_err("migration directory has no name"))?
+            .to_str()
+            .ok_or(span.parse_err("migration directory has invalid name"))?;
+
+        // Ensure the file name matches the regex.
+        let captures = FILENAME_RE
+            .captures(dir_name)
+            .ok_or(span.parse_err(format!("invalid migration directory name: {dir_name}")))?;
+        migrations.push(DBMigration {
+            file_name: path
+                .strip_prefix(dir)
+                .map_err(|_| {
+                    span.parse_err(format!(
+                        "migration directory is not a subdirectory of {}",
+                        dir.display()
+                    ))
+                })?
+                .to_string_lossy()
+                .to_string(),
+            description: captures[2].to_string(),
+            number: captures[1]
+                .parse::<u64>()
+                .map_err(|err| span.parse_err(err.to_string()))?,
+        });
+        Ok(())
+    })?;
+    Ok(migrations)
+}
+
+fn parse_migrations(
+    span: Span,
+    dir: &Path,
+    source: Option<&MigrationFileSource>,
+) -> ParseResult<Vec<DBMigration>> {
+    if !dir.exists() {
+        return Err(span.parse_err("migrations directory does not exist"));
+    } else if !dir.is_dir() {
+        return Err(span.parse_err("migrations path is not a directory"));
+    }
+
+    let mut migrations = match source {
+        Some(MigrationFileSource::Drizzle) => parse_drizzle(span, dir),
+        Some(MigrationFileSource::Prisma) => parse_prisma(span, dir),
+        None => parse_default(span, dir),
+    }?;
+    migrations.sort_by_key(|m| m.number);
+    Ok(migrations)
+}
+
+pub fn resolve_database_usage(data: &ResolveUsageData, db: Lrc<SQLDatabase>) -> Option<Usage> {
+    // Validate database queries, when possible.
+    match &data.expr.kind {
+        UsageExprKind::TemplateCall(call) => {
+            let method = &call.method.sym;
+            if method == "query" || method == "queryRow" || method == "queryAll" || method == "exec"
+            {
+                if let Some(err) = parse_template_query(&call.tpl) {
+                    let msg = match err {
+                        pg_query::Error::Parse(msg) => msg,
+                        other => other.to_string(),
+                    };
+                    call.tpl
+                        .tpl
+                        .span
+                        .err(&format!("invalid database query: {}", msg));
+                }
+            }
+        }
+
+        UsageExprKind::MethodCall(call) => {
+            let method = &call.method.sym;
+            if method == "rawQuery"
+                || method == "rawQueryRow"
+                || method == "rawQueryAll"
+                || method == "rawExec"
+            {
+                // If we have string literal as the query, validate it.
+                if let Some(ast::Lit::Str(str)) =
+                    call.call.args.first().and_then(|arg| arg.expr.as_lit())
+                {
+                    if let Err(err) = pg_query::parse(str.value.as_str()) {
+                        let msg = match err {
+                            pg_query::Error::Parse(msg) => msg,
+                            other => other.to_string(),
+                        };
+                        str.span.err(&format!("invalid database query: {}", msg));
+                    }
+                }
+            }
+        }
+
+        // Ignore other usage expressions.
+        _ => {}
+    }
+
+    match &data.expr.kind {
+        UsageExprKind::MethodCall(_)
+        | UsageExprKind::TemplateCall(_)
+        | UsageExprKind::FieldAccess(_)
+        | UsageExprKind::CallArg(_)
+        | UsageExprKind::ConstructorArg(_) => Some(Usage::AccessDatabase(AccessDatabaseUsage {
+            range: data.expr.range,
+            db,
+        })),
+
+        UsageExprKind::Other(_) | UsageExprKind::Callee(_) => {
+            data.expr.err("invalid use of database resource");
+            None
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct AccessDatabaseUsage {
+    pub range: Range,
+    pub db: Lrc<SQLDatabase>,
+}
+
+fn parse_template_query(tpl: &ast::TaggedTpl) -> Option<pg_query::Error> {
+    let mut query = String::new();
+    for (i, q) in tpl.tpl.quasis.iter().enumerate() {
+        query.push_str(&q.raw);
+        if !q.tail {
+            query.push_str(&format!("${}", i + 1));
+        }
+    }
+
+    pg_query::parse(&query).err()
+}
diff --git a/tsparser/src/parser/resources/mod.rs b/tsparser/src/parser/resources/mod.rs
new file mode 100644
index 0000000000..9074ebdea7
--- /dev/null
+++ b/tsparser/src/parser/resources/mod.rs
@@ -0,0 +1,79 @@
+use std::fmt::{Display, Formatter};
+
+use swc_common::sync::Lrc;
+
+use crate::parser::resourceparser::resource_parser::ResourceParser;
+use crate::parser::resources::apis::api::ENDPOINT_PARSER;
+use crate::parser::resources::apis::authhandler::AUTHHANDLER_PARSER;
+use crate::parser::resources::apis::gateway::GATEWAY_PARSER;
+use crate::parser::resources::apis::service::SERVICE_PARSER;
+use crate::parser::resources::infra::cron::CRON_PARSER;
+use crate::parser::resources::infra::objects::OBJECTS_PARSER;
+use crate::parser::resources::infra::pubsub_subscription::SUBSCRIPTION_PARSER;
+use crate::parser::resources::infra::pubsub_topic::TOPIC_PARSER;
+use crate::parser::resources::infra::secret::SECRET_PARSER;
+use crate::parser::resources::infra::sqldb::SQLDB_PARSER;
+
+pub mod apis;
+pub mod infra;
+mod parseutil;
+
+#[derive(Debug, Clone)]
+pub enum Resource {
+    ServiceClient(Lrc<apis::service_client::ServiceClient>),
+    APIEndpoint(Lrc<apis::api::Endpoint>),
+    AuthHandler(Lrc<apis::authhandler::AuthHandler>),
+    Gateway(Lrc<apis::gateway::Gateway>),
+    Service(Lrc<apis::service::Service>),
+    SQLDatabase(Lrc<infra::sqldb::SQLDatabase>),
+    Bucket(Lrc<infra::objects::Bucket>),
+    PubSubTopic(Lrc<infra::pubsub_topic::Topic>),
+    PubSubSubscription(Lrc<infra::pubsub_subscription::Subscription>),
+    CronJob(Lrc<infra::cron::CronJob>),
+    Secret(Lrc<infra::secret::Secret>),
+}
+
+#[derive(Debug, Eq, Hash, PartialEq, Clone)]
+pub enum ResourcePath {
+    SQLDatabase { name: String },
+    Bucket { name: String },
+}
+
+impl Display for Resource {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Resource::ServiceClient(client) => write!(f, "ServiceClient({})", client.service_name),
+            Resource::APIEndpoint(api) => {
+                write!(f, "APIEndpoint({}::{})", api.service_name, api.name)
+            }
+            Resource::AuthHandler(handler) => {
+                write!(f, "AuthHandler({}::{})", handler.service_name, handler.name)
+            }
+            Resource::Gateway(gw) => {
+                write!(f, "Gateway({})", gw.name)
+            }
+            Resource::SQLDatabase(db) => write!(f, "SQLDatabase({})", db.name),
+            Resource::Bucket(db) => write!(f, "Bucket({})", db.name),
+            Resource::PubSubTopic(topic) => write!(f, "PubSubTopic({})", topic.name),
+            Resource::PubSubSubscription(sub) => write!(f, "PubSubSubscription({})", sub.name),
+            Resource::CronJob(cron) => write!(f, "CronJob({})", cron.name),
+            Resource::Secret(secret) => write!(f, "Secret({})", secret.name),
+            Resource::Service(svc) => write!(f, "Service({})", svc.name),
+        }
+    }
+}
+
+pub static DEFAULT_RESOURCE_PARSERS: &[&ResourceParser] = &[
+    // The service parser must come first, as other resources may depend on
+    // knowing which service they belong to.
+    &SERVICE_PARSER,
+    &ENDPOINT_PARSER,
+    &AUTHHANDLER_PARSER,
+    &GATEWAY_PARSER,
+    &SQLDB_PARSER,
+    &OBJECTS_PARSER,
+    &TOPIC_PARSER,
+    &SUBSCRIPTION_PARSER,
+    &CRON_PARSER,
+    &SECRET_PARSER,
+];
diff --git a/tsparser/src/parser/resources/parseutil.rs b/tsparser/src/parser/resources/parseutil.rs
new file mode 100644
index 0000000000..53ed3b5195
--- /dev/null
+++ b/tsparser/src/parser/resources/parseutil.rs
@@ -0,0 +1,519 @@
+use std::collections::{HashMap, HashSet};
+use std::rc::Rc;
+
+use litparser::{LitParser, ParseResult, ToParseErr};
+use swc_common::{Span, Spanned};
+use swc_ecma_ast::{self as ast, CallExpr, MemberExpr, NewExpr, TsTypeParamInstantiation};
+use swc_ecma_visit::VisitWithPath;
+
+use crate::parser::module_loader::Module;
+use crate::parser::resourceparser::bind::BindName;
+use crate::parser::types::{Object, TypeChecker};
+use crate::parser::Range;
+
+pub trait ReferenceParser
+where
+    Self: Sized,
+{
+    fn parse_resource_reference(
+        module: &Module,
+        path: &swc_ecma_visit::AstNodePath,
+    ) -> ParseResult<Option<Self>>;
+}
+
+pub struct NamedClassResource<Config, const NAME_IDX: usize = 0, const CONFIG_IDX: usize = 1> {
+    pub range: Range,
+    pub constructor_args: Vec<ast::ExprOrSpread>,
+    pub doc_comment: Option<String>,
+    pub resource_name: String,
+    pub bind_name: BindName,
+    pub config: Config,
+    pub expr: ast::NewExpr,
+}
+
+impl<Config, const NAME_IDX: usize, const CONFIG_IDX: usize> Spanned
+    for NamedClassResource<Config, NAME_IDX, CONFIG_IDX>
+{
+    fn span(&self) -> Span {
+        self.range.to_span()
+    }
+}
+
+impl<Config: LitParser, const NAME_IDX: usize, const CONFIG_IDX: usize> ReferenceParser
+    for NamedClassResource<Config, NAME_IDX, CONFIG_IDX>
+{
+    fn parse_resource_reference(
+        module: &Module,
+        path: &swc_ecma_visit::AstNodePath,
+    ) -> ParseResult<Option<Self>> {
+        let res = match NamedClassResourceOptionalConfig::<Config, NAME_IDX, CONFIG_IDX>::parse_resource_reference(module, path)? {
+            None => return Ok(None),
+            Some(res) => res,
+        };
+        let Some(config) = res.config else {
+            return Err(res
+                .range
+                .to_span()
+                .parse_err("missing required config object"));
+        };
+
+        Ok(Some(Self {
+            range: res.range,
+            constructor_args: res.constructor_args,
+            doc_comment: res.doc_comment,
+            resource_name: res.resource_name,
+            bind_name: res.bind_name,
+            config,
+            expr: res.expr,
+        }))
+    }
+}
+
+#[derive(Debug)]
+pub struct NamedClassResourceOptionalConfig<
+    Config,
+    const NAME_IDX: usize = 0,
+    const CONFIG_IDX: usize = 1,
+> {
+    pub range: Range,
+    pub constructor_args: Vec<ast::ExprOrSpread>,
+    pub doc_comment: Option<String>,
+    pub resource_name: String,
+    pub bind_name: BindName,
+    pub config: Option<Config>,
+    pub expr: ast::NewExpr,
+}
+
+impl<Config, const NAME_IDX: usize, const CONFIG_IDX: usize> Spanned
+    for NamedClassResourceOptionalConfig<Config, NAME_IDX, CONFIG_IDX>
+{
+    fn span(&self) -> Span {
+        self.range.to_span()
+    }
+}
+
+impl<Config: LitParser, const NAME_IDX: usize, const CONFIG_IDX: usize> ReferenceParser
+    for NamedClassResourceOptionalConfig<Config, NAME_IDX, CONFIG_IDX>
+{
+    fn parse_resource_reference(
+        module: &Module,
+        path: &swc_ecma_visit::AstNodePath,
+    ) -> ParseResult<Option<Self>> {
+        for node in path.iter().rev() {
+            if let swc_ecma_visit::AstParentNodeRef::NewExpr(
+                expr,
+                swc_ecma_visit::fields::NewExprField::Callee,
+            ) = node
+            {
+                let Some(args) = &expr.args else {
+                    return Err(expr.span.parse_err("missing constructor arguments"));
+                };
+
+                let bind_name = match extract_bind_name(path)? {
+                    Some(name) => BindName::Named(name),
+                    None => {
+                        if is_default_export(path, (*expr).into()) {
+                            BindName::DefaultExport
+                        } else {
+                            BindName::Anonymous
+                        }
+                    }
+                };
+                let resource_name = extract_resource_name(expr.span, args, NAME_IDX)?;
+                let doc_comment = module.preceding_comments(expr.span.lo.into());
+
+                let config = args
+                    .get(CONFIG_IDX)
+                    .map(|arg| Config::parse_lit(&arg.expr))
+                    .transpose()?;
+
+                return Ok(Some(Self {
+                    range: expr.span.into(),
+                    constructor_args: args.clone(),
+                    resource_name: resource_name.to_string(),
+                    doc_comment,
+                    bind_name,
+                    config,
+                    expr: (*expr).to_owned(),
+                }));
+            }
+        }
+        Ok(None)
+    }
+}
+
+pub struct UnnamedClassResource<Config, const CONFIG_IDX: usize = 0> {
+    pub range: Range,
+    #[allow(dead_code)]
+    pub constructor_args: Vec<ast::ExprOrSpread>,
+    pub doc_comment: Option<String>,
+    pub bind_name: BindName,
+    pub config: Config,
+}
+
+impl<Config, const CONFIG_IDX: usize> Spanned for UnnamedClassResource<Config, CONFIG_IDX> {
+    fn span(&self) -> Span {
+        self.range.to_span()
+    }
+}
+
+impl<Config: LitParser, const CONFIG_IDX: usize> ReferenceParser
+    for UnnamedClassResource<Config, CONFIG_IDX>
+{
+    fn parse_resource_reference(
+        module: &Module,
+        path: &swc_ecma_visit::AstNodePath,
+    ) -> ParseResult<Option<Self>> {
+        for node in path.iter().rev() {
+            if let swc_ecma_visit::AstParentNodeRef::NewExpr(
+                expr,
+                swc_ecma_visit::fields::NewExprField::Callee,
+            ) = node
+            {
+                let Some(args) = &expr.args else {
+                    return Err(expr.span.parse_err("missing constructor arguments"));
+                };
+                let Some(config_arg) = args.get(CONFIG_IDX) else {
+                    return Err(expr.span.parse_err("missing config object"));
+                };
+
+                let bind_name = match extract_bind_name(path)? {
+                    Some(name) => BindName::Named(name),
+                    None => {
+                        if is_default_export(path, (*expr).into()) {
+                            BindName::DefaultExport
+                        } else {
+                            BindName::Anonymous
+                        }
+                    }
+                };
+
+                let config = Config::parse_lit(&config_arg.expr)?;
+                let doc_comment = module.preceding_comments(expr.span.lo.into());
+
+                return Ok(Some(Self {
+                    range: expr.span.into(),
+                    constructor_args: args.clone(),
+                    doc_comment,
+                    bind_name,
+                    config,
+                }));
+            }
+        }
+        Ok(None)
+    }
+}
+
+pub struct NamedStaticMethod<const NAME_IDX: usize = 0> {
+    pub range: Range,
+    #[allow(dead_code)]
+    pub constructor_args: Vec<ast::ExprOrSpread>,
+    #[allow(dead_code)]
+    pub doc_comment: Option<String>,
+    pub resource_name: String,
+    pub bind_name: BindName,
+}
+
+impl<const NAME_IDX: usize> ReferenceParser for NamedStaticMethod<NAME_IDX> {
+    fn parse_resource_reference(
+        module: &Module,
+        path: &swc_ecma_visit::AstNodePath,
+    ) -> ParseResult<Option<Self>> {
+        for (idx, node) in path.iter().rev().enumerate() {
+            if let swc_ecma_visit::AstParentNodeRef::MemberExpr(
+                expr,
+                swc_ecma_visit::fields::MemberExprField::Obj,
+            ) = node
+            {
+                let ast::MemberProp::Ident(method_name) = &expr.prop else {
+                    continue;
+                };
+                if method_name.sym != "named" {
+                    continue;
+                }
+
+                let idx = path.len() - idx - 1;
+
+                // Make sure the parent is a call expression.
+                // The path goes:
+                // CallExpr -> Callee -> Expr -> MemberExpr
+                // So we want idx-3.
+                let Some(parent) = path.get(idx - 3) else {
+                    continue;
+                };
+                let swc_ecma_visit::AstParentNodeRef::CallExpr(
+                    call,
+                    swc_ecma_visit::fields::CallExprField::Callee,
+                ) = parent
+                else {
+                    continue;
+                };
+
+                let bind_name = match extract_bind_name(path)? {
+                    Some(name) => BindName::Named(name),
+                    None => {
+                        if is_default_export(path, (*expr).into()) {
+                            BindName::DefaultExport
+                        } else {
+                            BindName::Anonymous
+                        }
+                    }
+                };
+                let resource_name = extract_resource_name(call.span, &call.args, NAME_IDX)?;
+                let doc_comment = module.preceding_comments(call.span.lo.into());
+
+                return Ok(Some(Self {
+                    range: call.span.into(),
+                    constructor_args: call.args.clone(),
+                    resource_name: resource_name.to_string(),
+                    doc_comment,
+                    bind_name,
+                }));
+            }
+        }
+        Ok(None)
+    }
+}
+
+/// Extracts the name of a resource.
+pub fn extract_resource_name(
+    span: swc_common::Span,
+    args: &[ast::ExprOrSpread],
+    idx: usize,
+) -> ParseResult<&str> {
+    let Some(val) = args.get(idx) else {
+        return Err(span.parse_err(format!("missing resource name as argument[{idx}]")));
+    };
+    if val.spread.is_none() {
+        if let ast::Expr::Lit(ast::Lit::Str(str)) = val.expr.as_ref() {
+            return Ok(str.value.as_ref());
+        }
+    }
+
+    Err(span.parse_err("expected string literal"))
+}
+
+pub fn extract_bind_name(path: &swc_ecma_visit::AstNodePath) -> ParseResult<Option<ast::Ident>> {
+    for node in path.iter().rev() {
+        if let swc_ecma_visit::AstParentNodeRef::VarDecl(
+            var,
+            swc_ecma_visit::fields::VarDeclField::Decls(idx),
+        ) = node
+        {
+            let Some(decl) = var.decls.get(*idx) else {
+                return Err(var
+                    .span
+                    .parse_err(format!("missing declaration at index {idx}")));
+            };
+            match &decl.name {
+                ast::Pat::Ident(bind_name) => {
+                    return Ok(Some(bind_name.id.clone()));
+                }
+                _ => {
+                    return Err(decl.name.parse_err("expected identifier as bind name"));
+                }
+            }
+        }
+    }
+    Ok(None)
+}
+
+pub enum Expr<'a> {
+    New(&'a NewExpr),
+    Call(&'a CallExpr),
+    Member(&'a MemberExpr),
+}
+
+impl<'a> From<&'a NewExpr> for Expr<'a> {
+    fn from(expr: &'a NewExpr) -> Self {
+        Self::New(expr)
+    }
+}
+impl<'a> From<&'a CallExpr> for Expr<'a> {
+    fn from(expr: &'a CallExpr) -> Self {
+        Self::Call(expr)
+    }
+}
+
+impl<'a> From<&'a MemberExpr> for Expr<'a> {
+    fn from(expr: &'a MemberExpr) -> Self {
+        Self::Member(expr)
+    }
+}
+
+// checks if `expr` is the default export in `path`
+pub fn is_default_export(path: &swc_ecma_visit::AstNodePath, expr: Expr) -> bool {
+    for node in path.iter().rev() {
+        match node {
+            swc_ecma_visit::AstParentNodeRef::ExportDefaultExpr(
+                swc_ecma_ast::ExportDefaultExpr {
+                    expr: exported_expr,
+                    ..
+                },
+                swc_ecma_visit::fields::ExportDefaultExprField::Expr,
+            ) => {
+                return match expr {
+                    Expr::Member(member_expr) => {
+                        matches!(**exported_expr, swc_ecma_ast::Expr::Member(ref expr) if expr == member_expr)
+                    }
+                    Expr::Call(call_expr) => {
+                        matches!(**exported_expr, swc_ecma_ast::Expr::Call(ref expr) if expr == call_expr)
+                    }
+                    Expr::New(new_expr) => {
+                        matches!(**exported_expr, swc_ecma_ast::Expr::New(ref expr) if expr == new_expr)
+                    }
+                }
+            }
+            _ => continue,
+        }
+    }
+    false
+}
+
+pub struct TrackedNames<'a>(HashMap<&'a str, Vec<&'a str>>);
+
+impl<'a> TrackedNames<'a> {
+    pub fn new(names: &'a [(&'a str, &'a str)]) -> Self {
+        let mut modules = HashMap::new();
+        for &(module, name) in names {
+            modules.entry(module).or_insert_with(Vec::new).push(name);
+        }
+
+        Self(modules)
+    }
+
+    pub fn get(&self, module: &str) -> Option<&[&str]> {
+        self.0.get(module).map(|v| &v[..])
+    }
+}
+
+/// Collect the idents matching the given names to track.
+fn collect_import_idents<'a>(
+    module: &'a Module,
+    tracked_names: &'a TrackedNames<'a>,
+) -> (HashSet<ast::Id>, HashMap<ast::Id, &'a [&'a str]>) {
+    let mut local_names = HashSet::new();
+    let mut module_names = HashMap::new();
+
+    for it in &module.ast.body {
+        if let ast::ModuleItem::ModuleDecl(ast::ModuleDecl::Import(import)) = it {
+            // Is the module in question one we care about?
+            let Some(tracked) = tracked_names.get(import.src.value.as_ref()) else {
+                continue;
+            };
+
+            // Iterate over the specifiers and determine the local idents.
+            for spec in &import.specifiers {
+                match spec {
+                    ast::ImportSpecifier::Named(named) => {
+                        // We are importing specific names from the module.
+                        // Determine if the name is one we care about.
+                        let is_relevant = tracked.iter().any(|t| match named.imported {
+                            Some(ast::ModuleExportName::Ident(ref i)) => i.sym.as_ref() == *t,
+                            Some(ast::ModuleExportName::Str(_)) => false,
+                            None => named.local.sym.as_ref() == *t,
+                        });
+
+                        if is_relevant {
+                            // The name is one we care about, so add it to the set.
+                            local_names.insert(named.local.to_id());
+                        }
+                    }
+
+                    ast::ImportSpecifier::Default(_) => {
+                        // We are importing the default export from the module.
+
+                        // Do we want to handle this? If so we need to identify the
+                        // default import when calling this function.
+                        // For now, do nothing.
+                    }
+                    ast::ImportSpecifier::Namespace(namespace) => {
+                        // We're importing the module as a namespace ("import * as foo from 'foo'").
+                        module_names.insert(namespace.local.to_id(), tracked);
+                    }
+                }
+            }
+        }
+    }
+
+    (local_names, module_names)
+}
+
+pub fn iter_references<R: ReferenceParser>(
+    module: &Module,
+    names: &TrackedNames,
+) -> impl Iterator<Item = ParseResult<R>> {
+    let (local_ids, _module_ids) = collect_import_idents(module, names);
+    let mut visitor = <IterReferenceVisitor<'_, R>>::new(module, local_ids);
+    module
+        .ast
+        .visit_with_path(&mut visitor, &mut Default::default());
+    visitor.results.into_iter()
+}
+
+struct IterReferenceVisitor<'a, R> {
+    module: &'a Module,
+    local_ids: HashSet<ast::Id>,
+    results: Vec<ParseResult<R>>,
+}
+
+impl<'a, R> IterReferenceVisitor<'a, R> {
+    fn new(module: &'a Module, local_ids: HashSet<ast::Id>) -> Self {
+        Self {
+            module,
+            local_ids,
+            results: Vec::new(),
+        }
+    }
+}
+
+impl<R: ReferenceParser> swc_ecma_visit::VisitAstPath for IterReferenceVisitor<'_, R> {
+    fn visit_ident<'ast: 'r, 'r>(
+        &mut self,
+        n: &'ast ast::Ident,
+        path: &mut swc_ecma_visit::AstNodePath<'r>,
+    ) {
+        if !self.local_ids.contains(&n.to_id()) {
+            return;
+        };
+        // TODO check for module_ids
+
+        // If this is part of an import declaration, ignore it.
+        if path
+            .kinds()
+            .iter()
+            .any(|p| matches!(p, swc_ecma_visit::AstParentKind::ImportDecl(_)))
+        {
+            return;
+        }
+
+        match R::parse_resource_reference(self.module, path) {
+            Ok(None) => {} // do nothing
+            Ok(Some(r)) => self.results.push(Ok(r)),
+            Err(e) => self.results.push(Err(e)),
+        }
+    }
+}
+
+pub fn extract_type_param(
+    params: Option<&TsTypeParamInstantiation>,
+    idx: usize,
+) -> Option<&ast::TsType> {
+    let params = params?;
+    let param = params.params.get(idx)?;
+    Some(param.as_ref())
+}
+
+pub fn resolve_object_for_bind_name(
+    type_checker: &TypeChecker,
+    module: Rc<Module>,
+    bind_name: &BindName,
+) -> Option<Rc<Object>> {
+    match bind_name {
+        BindName::Anonymous => None,
+        BindName::DefaultExport => type_checker.resolve_default_export(module.clone()),
+        BindName::Named(ref id) => {
+            type_checker.resolve_obj(module.clone(), &ast::Expr::Ident(id.clone()))
+        }
+    }
+}
diff --git a/tsparser/src/parser/respath.rs b/tsparser/src/parser/respath.rs
new file mode 100644
index 0000000000..2ca5f7a49c
--- /dev/null
+++ b/tsparser/src/parser/respath.rs
@@ -0,0 +1,349 @@
+use std::{fmt::Write, ops::Deref};
+
+use litparser::Sp;
+use swc_common::{BytePos, Span};
+
+use crate::span_err::{ErrorWithSpanExt, SpErr};
+
+use super::types::validation;
+
+#[derive(Debug, Clone)]
+pub struct Path {
+    pub span: Span,
+    pub segments: Vec<Sp<Segment>>,
+}
+
+impl Path {
+    pub fn dynamic_segments(&self) -> impl Iterator<Item = &Sp<Segment>> {
+        self.segments
+            .iter()
+            .filter(|s| !matches!(s.get(), Segment::Literal(_)))
+    }
+
+    pub fn has_dynamic_segments(&self) -> bool {
+        self.dynamic_segments().next().is_some()
+    }
+}
+
+impl std::fmt::Display for Path {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        for seg in &self.segments {
+            f.write_char('/')?;
+            if let Some(sigil) = seg.sigil() {
+                f.write_char(sigil)?;
+            }
+            f.write_str(seg.lit_or_name())?;
+        }
+        Ok(())
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub enum Segment {
+    Literal(String),
+    Param {
+        name: String,
+        value_type: ValueType,
+        validation: Option<validation::Expr>,
+    },
+    Wildcard {
+        name: String,
+        validation: Option<validation::Expr>,
+    },
+    Fallback {
+        name: String,
+        validation: Option<validation::Expr>,
+    },
+}
+
+impl Segment {
+    pub fn sigil(&self) -> Option<char> {
+        match self {
+            Segment::Literal(_s) => None,
+            Segment::Param { .. } => Some(':'),
+            Segment::Wildcard { .. } => Some('*'),
+            Segment::Fallback { .. } => Some('!'),
+        }
+    }
+
+    pub fn lit_or_name(&self) -> &str {
+        match self {
+            Segment::Literal(s) => s,
+            Segment::Param { name, .. } => name,
+            Segment::Wildcard { name, .. } => name,
+            Segment::Fallback { name, .. } => name,
+        }
+    }
+
+    pub fn is_literal(&self) -> bool {
+        matches!(self, Segment::Literal(_))
+    }
+
+    pub fn is_dynamic(&self) -> bool {
+        !self.is_literal()
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq)]
+pub enum ValueType {
+    String,
+    Int,
+    Bool,
+}
+
+pub struct ParseOptions {
+    pub allow_wildcard: bool,
+    pub allow_fallback: bool,
+    pub prefix_slash: bool,
+}
+
+impl Default for ParseOptions {
+    fn default() -> Self {
+        ParseOptions {
+            allow_wildcard: true,
+            allow_fallback: true,
+            prefix_slash: true,
+        }
+    }
+}
+
+#[derive(Debug, thiserror::Error, Clone, PartialEq, Eq)]
+pub enum PathParseError {
+    #[error("empty path")]
+    EmptyPath,
+    #[error("path must start with '/'")]
+    MustStartWithSlash,
+    #[error("path must not start with '/'")]
+    MustNotStartWithSlash,
+    #[error("path cannot contain empty path segment")]
+    EmptySegment,
+    #[error("path parameters must have a name")]
+    UnnamedParam,
+    #[error("wildcard segment must be at the end of the path")]
+    WildcardNotAtEnd,
+    #[error("fallback segment must be at the end of the path")]
+    FallbackNotAtEnd,
+    #[error("path cannot contain query parameters (the '?' character)")]
+    ContainsQuery,
+    #[error("path cannot contain url fragment (the '#' character)")]
+    ContainsFragment,
+    #[error("path cannot contain url scheme")]
+    ContainsScheme,
+    #[error("path cannot contain url authority")]
+    ContainsAuthority,
+    #[error("path cannot contain hostname")]
+    ContainsHostname,
+    #[error("path is invalid: {0}")]
+    Invalid(String),
+}
+
+impl Path {
+    pub fn parse(
+        span: Span,
+        path: &str,
+        opts: ParseOptions,
+    ) -> Result<Self, SpErr<PathParseError>> {
+        if path.is_empty() {
+            return Err(PathParseError::EmptyPath.with_span(span));
+        } else if !path.starts_with('/') && opts.prefix_slash {
+            return Err(PathParseError::MustStartWithSlash.with_span(span));
+        } else if path.starts_with('/') && !opts.prefix_slash {
+            return Err(PathParseError::MustNotStartWithSlash.with_span(span));
+        }
+
+        // Ensure this is a valid url path.
+        parse_url_path(path).map_err(|err| err.with_span(span))?;
+
+        let mut segments = vec![];
+
+        let path_end = path.len();
+        let mut idx = 0;
+        while idx < path_end {
+            if opts.prefix_slash || !segments.is_empty() {
+                idx += 1; // drop leading slash
+            }
+
+            let seg_start = idx;
+            let seg_end = {
+                let remainder = &path[idx..];
+                idx + remainder.find('/').unwrap_or(remainder.len())
+            };
+
+            // Find the next path segment.
+            let val = &path[seg_start..seg_end];
+            let seg: Segment = match val.chars().next() {
+                Some(':') => Segment::Param {
+                    name: val[1..].to_string(),
+                    value_type: ValueType::String,
+                    validation: None,
+                },
+                Some('*') if opts.allow_wildcard => Segment::Wildcard {
+                    name: val[1..].to_string(),
+                    validation: None,
+                },
+                Some('!') if opts.allow_wildcard => Segment::Fallback {
+                    name: val[1..].to_string(),
+                    validation: None,
+                },
+                _ => Segment::Literal(val.to_string()),
+            };
+
+            let span = span
+                .with_lo(span.lo + BytePos(seg_start as u32))
+                .with_hi(span.hi + BytePos(seg_end as u32));
+
+            segments.push(Sp::new(span, seg));
+            idx = seg_end;
+        }
+
+        // Validate the segments.
+        for (idx, seg) in segments.iter().enumerate() {
+            match seg.deref() {
+                Segment::Literal(lit) if lit.is_empty() && segments.len() > 1 => {
+                    return Err(PathParseError::EmptySegment.with_span(seg.span()));
+                }
+                Segment::Param { name, .. } if name.is_empty() => {
+                    return Err(PathParseError::UnnamedParam.with_span(seg.span()));
+                }
+                Segment::Wildcard { name, .. } if name.is_empty() => {
+                    return Err(PathParseError::UnnamedParam.with_span(seg.span()));
+                }
+                Segment::Wildcard { .. } if idx != segments.len() - 1 => {
+                    return Err(PathParseError::WildcardNotAtEnd.with_span(seg.span()));
+                }
+                Segment::Fallback { .. } if idx != segments.len() - 1 => {
+                    return Err(PathParseError::FallbackNotAtEnd.with_span(seg.span()));
+                }
+                _ => {}
+            }
+        }
+
+        Ok(Path { span, segments })
+    }
+}
+
+fn parse_url_path(path: &str) -> Result<(), PathParseError> {
+    // The url crate only supports parsing absolute urls, so use a dummy base
+    // and ensure it is the same after parsing.
+    let base = url::Url::parse("base://url.here").expect("internal error: invalid base url");
+
+    let url = url::Url::options()
+        .base_url(Some(&base))
+        .parse(path)
+        .map_err(|err| PathParseError::Invalid(err.to_string()))?;
+
+    if url.scheme() != base.scheme() {
+        return Err(PathParseError::ContainsScheme);
+    } else if url.authority() != base.authority() {
+        return Err(PathParseError::ContainsAuthority);
+    }
+
+    match url.host_str() {
+        None => {
+            // We should always have a host since the base url has one.
+            return Err(PathParseError::ContainsHostname);
+        }
+        Some(host) => {
+            if host != base.host_str().unwrap() {
+                return Err(PathParseError::ContainsHostname);
+            }
+        }
+    }
+
+    if url.query().is_some() {
+        Err(PathParseError::ContainsQuery)
+    } else if url.fragment().is_some() {
+        Err(PathParseError::ContainsFragment)
+    } else {
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use swc_common::DUMMY_SP;
+
+    use super::*;
+
+    #[test]
+    fn test_parse() {
+        let tests = vec![
+            ("/", Ok(vec![Segment::Literal("".to_string())])),
+            ("/foo", Ok(vec![Segment::Literal("foo".to_string())])),
+            (
+                "/foo/bar",
+                Ok(vec![
+                    Segment::Literal("foo".to_string()),
+                    Segment::Literal("bar".to_string()),
+                ]),
+            ),
+            (
+                "/:foo/*bar",
+                Ok(vec![
+                    Segment::Param {
+                        name: "foo".to_string(),
+                        value_type: ValueType::String,
+                        validation: None,
+                    },
+                    Segment::Wildcard {
+                        name: "bar".to_string(),
+                        validation: None,
+                    },
+                ]),
+            ),
+            ("", Err(PathParseError::EmptyPath)),
+            ("/foo//bar", Err(PathParseError::EmptySegment)),
+            ("/foo/", Err(PathParseError::EmptySegment)),
+            ("/:foo/*", Err(PathParseError::UnnamedParam)),
+            ("/:foo/*/bar", Err(PathParseError::UnnamedParam)),
+            ("/:foo/*bar/baz", Err(PathParseError::WildcardNotAtEnd)),
+            ("/foo?bar=baz", Err(PathParseError::ContainsQuery)),
+            ("/foo#bar", Err(PathParseError::ContainsFragment)),
+            (
+                "/foo/!fallback",
+                Ok(vec![
+                    Segment::Literal("foo".to_string()),
+                    Segment::Fallback {
+                        name: "fallback".to_string(),
+                        validation: None,
+                    },
+                ]),
+            ),
+        ];
+
+        for (path, want) in tests {
+            let got = Path::parse(DUMMY_SP, path, Default::default());
+            match (got, want) {
+                (Ok(got), Ok(want)) => {
+                    let segments: Vec<_> = got.segments.into_iter().map(|s| s.take()).collect();
+                    assert_eq!(segments, want, "path {path:?}");
+                }
+                (Err(got), Err(want)) => {
+                    assert_eq!(got.error, want, "path {path:?}");
+                }
+                (Ok(got), Err(want)) => {
+                    panic!("got {got:?}, want err {want:?}, path {path:?}");
+                }
+                (Err(got), Ok(want)) => {
+                    panic!("got err {got:?}, want {want:?}, path {path:?}");
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn test_parse_url_path() {
+        let ok_paths = &["foo", "/foo/bar", "/foo/:bar", "/*wildcard", "/!fallback"];
+        let err_paths = &["http://foo.com"];
+
+        for path in ok_paths {
+            let path = parse_url_path(path);
+            assert!(path.is_ok(), "path {path:?} should be ok");
+        }
+
+        for path in err_paths {
+            let path = parse_url_path(path);
+            assert!(path.is_err(), "path {path:?} should be err");
+        }
+    }
+}
diff --git a/tsparser/src/parser/service_discovery.rs b/tsparser/src/parser/service_discovery.rs
new file mode 100644
index 0000000000..cc9feca911
--- /dev/null
+++ b/tsparser/src/parser/service_discovery.rs
@@ -0,0 +1,268 @@
+use std::collections::{HashMap, HashSet};
+use std::path::PathBuf;
+
+use swc_common::errors::HANDLER;
+use swc_common::sync::Lrc;
+
+use crate::parser::resourceparser::bind::Bind;
+use crate::parser::resources::Resource;
+use crate::parser::{FilePath, FileSet};
+
+/// Discover the services in an Encore application, based on the parsed resources.
+pub fn discover_services<'a>(
+    file_set: &'a FileSet,
+    binds: &'a Vec<Lrc<Bind>>,
+) -> Vec<DiscoveredService> {
+    let sd = ServiceDiscoverer {
+        file_set,
+        binds,
+        services: HashMap::new(),
+        strong_root: HashSet::new(),
+    };
+    sd.discover()
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct DiscoveredService {
+    pub name: String,
+    pub root: PathBuf,
+}
+
+struct ServiceDiscoverer<'a> {
+    // Inputs
+    file_set: &'a FileSet,
+    binds: &'a Vec<Lrc<Bind>>,
+
+    // Outputs
+    services: HashMap<PathBuf, DiscoveredService>,
+    strong_root: HashSet<PathBuf>,
+}
+
+impl ServiceDiscoverer<'_> {
+    fn discover(mut self) -> Vec<DiscoveredService> {
+        for b in self.binds {
+            match &b.resource {
+                Resource::Service(svc) => {
+                    self.possible_service_root(b.as_ref(), true, Some(svc.name.clone()))
+                }
+                Resource::APIEndpoint(_) => self.possible_service_root(b.as_ref(), false, None),
+                Resource::PubSubSubscription(_) => {
+                    self.possible_service_root(b.as_ref(), false, None)
+                }
+                Resource::Gateway(_) => self.possible_service_root(b.as_ref(), false, None),
+                Resource::AuthHandler(_) => self.possible_service_root(b.as_ref(), false, None),
+                _ => {}
+            }
+        }
+
+        let mut svcs = self.services.into_values().collect::<Vec<_>>();
+
+        // Validate the services.
+        for (i, svc) in svcs.iter().enumerate() {
+            for other in &svcs[i + 1..] {
+                if svc.root.starts_with(&other.root) {
+                    HANDLER.with(|h| {
+                        h.err(&format!(
+                            "service {} cannot be contained within service {}",
+                            svc.name, other.name
+                        ))
+                    });
+                } else if other.root.starts_with(&svc.root) {
+                    HANDLER.with(|h| {
+                        h.err(&format!(
+                            "service {} cannot be contained within service {}",
+                            other.name, svc.name,
+                        ))
+                    });
+                } else if svc.name == other.name {
+                    HANDLER.with(|h| h.err(&format!("service {} defined twice", svc.name,)));
+                }
+            }
+        }
+
+        // Sort the services by name for deterministic output.
+        svcs.sort_by(|a, b| a.name.cmp(&b.name));
+
+        svcs
+    }
+
+    fn possible_service_root(&mut self, bind: &Bind, strong: bool, service_name: Option<String>) {
+        let Some(range) = bind.range else {
+            return;
+        };
+        let file = range.file(self.file_set);
+        let file_path = match file {
+            FilePath::Real(ref buf) => buf,
+            FilePath::Custom(_) => return,
+        };
+        let Some(root) = file_path.parent().map(|p| p.to_path_buf()) else {
+            return;
+        };
+
+        // Determine the service name.
+        let service_name = match service_name {
+            Some(name) => name,
+            None => {
+                // Ensure we have a valid service name.
+                let dir_name = root
+                    .file_name()
+                    .and_then(|x| x.to_str())
+                    .map(|x| x.to_string());
+                let Some(dir_name) = dir_name else {
+                    return;
+                };
+                dir_name
+            }
+        };
+
+        if strong {
+            // Always mark the root as a strong root, even if it is already marked as a service.
+            self.strong_root.insert(root.clone());
+        }
+
+        // If the service is already marked, we don't need to do anything.
+        if self.services.contains_key(&root) {
+            return;
+        }
+
+        // Loop over the existing services and remove any that are subdirectories of this one.
+        // Also look for any existing services which are parents of this root.
+        let mut to_delete = Vec::new();
+        for existing_root in self.services.keys() {
+            // If the existing service is a subdirectory of this one, we can remove it.
+            if existing_root.starts_with(&root) {
+                // If the existing service is a strong root, we can't merge it with this one.
+                if self.strong_root.contains(existing_root) {
+                    continue;
+                } else {
+                    // The existing service is a descendant of this one,
+                    // so remove it in favor of this one.
+                    to_delete.push(existing_root.clone());
+                }
+            } else if root.starts_with(existing_root) && !strong {
+                // The new service is a descendant of an existing service, and this is not
+                // a strong root so we consider this to be part of the existing service,
+                // so we're done.
+                return;
+            }
+        }
+
+        // Delete ones marked for deletion.
+        for root in to_delete {
+            self.services.remove(&root);
+        }
+
+        // The new service is not a descendant of any existing service, so add it.
+        self.services.insert(
+            root.clone(),
+            DiscoveredService {
+                name: service_name.to_string(),
+                root,
+            },
+        );
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::path::Path;
+    use std::rc::Rc;
+
+    use swc_common::errors::{Handler, HANDLER};
+    use swc_common::{Globals, SourceMap, GLOBALS};
+    use tempdir::TempDir;
+
+    use crate::parser::parser::{ParseContext, Parser};
+    use crate::parser::resourceparser::PassOneParser;
+    use crate::testutil::testresolve::TestResolver;
+    use crate::testutil::JS_RUNTIME_PATH;
+
+    use super::*;
+
+    fn parse(tmp_dir: &Path, src: &str) -> anyhow::Result<Vec<DiscoveredService>> {
+        let globals = Globals::new();
+        let cm: Rc<SourceMap> = Default::default();
+        let errs = Rc::new(Handler::with_tty_emitter(
+            swc_common::errors::ColorConfig::Auto,
+            true,
+            false,
+            Some(cm.clone()),
+        ));
+
+        GLOBALS.set(&globals, || {
+            HANDLER.set(&errs, || {
+                let ar = txtar::from_str(src);
+                ar.materialize(tmp_dir)?;
+
+                let resolver = Box::new(TestResolver::new(tmp_dir.to_path_buf(), ar.clone()));
+                let pc = ParseContext::with_resolver(
+                    tmp_dir.to_path_buf(),
+                    Some(JS_RUNTIME_PATH.clone()),
+                    resolver,
+                    cm,
+                    errs.clone(),
+                )
+                .unwrap();
+                pc.loader.load_archive(tmp_dir, &ar)?;
+
+                let pass1 = PassOneParser::new(
+                    pc.file_set.clone(),
+                    pc.type_checker.clone(),
+                    Default::default(),
+                );
+                let parser = Parser::new(&pc, pass1);
+                let result = parser.parse();
+                Ok(discover_services(&pc.file_set, &result.binds))
+            })
+        })
+    }
+
+    #[test]
+    fn test_api_endpoints() {
+        let tmp_dir = TempDir::new("tsparser-test").unwrap();
+        let svcs = parse(
+            tmp_dir.path(),
+            r#"
+-- systemA/svc1/foo.ts --
+import { api } from "encore.dev/api";
+
+export const foo = api(
+  { method: "POST" },
+  async (): Promise<void> => {}
+);
+
+-- systemA/svc2/bar.ts --
+import { api } from "encore.dev/api";
+
+export const bar = api(
+  { method: "POST" },
+  async (): Promise<void> => {}
+);
+
+-- svc3/bar.ts --
+import { api } from "encore.dev/api";
+
+export const bar = api(
+  { method: "POST" },
+  async (): Promise<void> => {}
+);
+"#,
+        );
+
+        match svcs {
+            Err(err) => {
+                panic!("{err:#?}");
+            }
+            Ok(svcs) => {
+                let tmp_root = tmp_dir.path();
+                assert_eq!(svcs.len(), 3);
+                assert_eq!(svcs[0].name, "svc1");
+                assert_eq!(svcs[1].name, "svc2");
+                assert_eq!(svcs[2].name, "svc3");
+                assert_eq!(svcs[0].root, tmp_root.join("systemA/svc1"));
+                assert_eq!(svcs[1].root, tmp_root.join("systemA/svc2"));
+                assert_eq!(svcs[2].root, tmp_root.join("svc3"));
+            }
+        }
+    }
+}
diff --git a/tsparser/src/parser/types/ast_id.rs b/tsparser/src/parser/types/ast_id.rs
new file mode 100644
index 0000000000..619f03bc92
--- /dev/null
+++ b/tsparser/src/parser/types/ast_id.rs
@@ -0,0 +1,55 @@
+use std::hash::Hash;
+use swc_ecma_ast as ast;
+
+/// AstId is a convenience wrapper around ast::Id that also tracks the name of the identifier,
+/// for debugging purposes. It can be swapped out for ast::Id later.
+#[derive(Debug)]
+pub struct AstId(ast::Id, String);
+
+impl AstId {
+    pub fn new(id: ast::Id, name: String) -> Self {
+        Self(id, name)
+    }
+}
+
+impl std::fmt::Display for AstId {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.1)
+    }
+}
+
+impl From<ast::Id> for AstId {
+    fn from(id: ast::Id) -> Self {
+        Self(id, "unknown".into())
+    }
+}
+
+impl From<&ast::Ident> for AstId {
+    fn from(ident: &ast::Ident) -> Self {
+        Self(ident.to_id(), ident.sym.as_ref().to_string())
+    }
+}
+
+impl Hash for AstId {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.0.hash(state);
+    }
+}
+
+impl PartialEq for AstId {
+    fn eq(&self, other: &Self) -> bool {
+        self.0.eq(&other.0)
+    }
+}
+impl Eq for AstId {}
+
+impl PartialOrd for AstId {
+    fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+        Some(self.cmp(other))
+    }
+}
+impl Ord for AstId {
+    fn cmp(&self, other: &Self) -> std::cmp::Ordering {
+        self.0.cmp(&other.0)
+    }
+}
diff --git a/tsparser/src/parser/types/binding.rs b/tsparser/src/parser/types/binding.rs
new file mode 100644
index 0000000000..5a373f4636
--- /dev/null
+++ b/tsparser/src/parser/types/binding.rs
@@ -0,0 +1,291 @@
+use swc_ecma_ast as ast;
+
+pub(super) struct BindingPat {
+    /// The ast id, for id tracking.
+    pub id: ast::Id,
+
+    /// The variable name this is bound to.
+    pub name: String,
+
+    /// The type annotation, if any.
+    pub type_ann: Option<ast::TsTypeAnn>,
+
+    /// The default value if the destructuring expression fails to match.
+    #[allow(dead_code)]
+    pub default: Option<ast::Expr>,
+
+    /// The destructuring expression to evaluate the RHS against
+    /// to arrive at the value.
+    pub destructure_path: Vec<DestructuringExpr>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) enum DestructuringExpr {
+    /// The whole expression.
+    Full,
+    /// A single entry in an array with the given index.
+    ArrayIndex(usize),
+    /// The remainder of an array; e.g. `...xs`, starting from the given index (inclusive).
+    ArrayRest(usize),
+    /// A single entry in an object with the given key.
+    ObjectKey(DestructuringObjectKey),
+
+    /// The remainder of an object; e.g. `...xs`.
+    ObjectRest {
+        /// The keys that have already been destructured.
+        except: Vec<String>,
+    },
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) enum DestructuringObjectKey {
+    /// A literal key.
+    Ident(String),
+    /// A computed key.
+    Computed(ast::Expr),
+}
+
+pub(super) fn bindings(pat: &ast::Pat) -> Vec<BindingPat> {
+    /// Compute sub_bindings for a pattern, stripping the DestructuringExpr::Full
+    /// from the head of the destructure_path. This is used so that
+    /// we don't end up with "full" expressions other than for "let x = ...".
+    fn sub_bindings(pat: &ast::Pat) -> Vec<BindingPat> {
+        let mut result = bindings(pat);
+        for b in &mut result {
+            if matches!(b.destructure_path.first(), Some(DestructuringExpr::Full)) {
+                b.destructure_path.remove(0);
+            }
+        }
+        result
+    }
+
+    match pat {
+        ast::Pat::Ident(ident) => {
+            // A basic identifier, e.g. "let x = ..."
+            vec![BindingPat {
+                id: ident.id.to_id(),
+                name: ident.id.sym.as_ref().to_string(),
+                type_ann: ident.type_ann.as_ref().map(|ann| *ann.clone()),
+                default: None,
+                destructure_path: vec![DestructuringExpr::Full],
+            }]
+        }
+
+        ast::Pat::Array(arr) => {
+            // An array destructuring expression, e.g. "let [x, y] = ..."
+            let mut result = Vec::with_capacity(arr.elems.len());
+            for (idx, elem) in arr.elems.iter().enumerate() {
+                // Skip over None elems (e.g. "let [x, , y] = ...")
+                let Some(elem) = elem else { continue };
+
+                match elem {
+                    // Handle the rest expression here as we know we're dealing
+                    // with an array destructuring.
+                    ast::Pat::Rest(rest) => {
+                        // A rest expression, e.g. "...xs"
+                        let rest_bindings = sub_bindings(&rest.arg);
+                        for mut rb in rest_bindings {
+                            // Add the rest expression.
+                            rb.destructure_path
+                                .insert(0, DestructuringExpr::ArrayRest(idx));
+                            result.push(rb);
+                        }
+                    }
+
+                    _ => {
+                        // For every child binding, add it to the result
+                        // while wrapping it in an array index expression.
+                        let elem_bindings = sub_bindings(elem);
+                        for mut eb in elem_bindings {
+                            eb.destructure_path
+                                .insert(0, DestructuringExpr::ArrayIndex(idx));
+                            result.push(eb);
+                        }
+                    }
+                }
+            }
+
+            result
+        }
+
+        ast::Pat::Object(obj) => {
+            // An object destructuring expression, e.g. "let {x, y} = ..."
+            let mut result = Vec::with_capacity(obj.props.len());
+            let mut rest: Option<&ast::RestPat> = None;
+            for prop in obj.props.iter() {
+                match prop {
+                    ast::ObjectPatProp::KeyValue(kv) => {
+                        // E.g. "let {x: y} = ...", indicates a nested destructuring
+                        // where x is not actually bound.
+                        let bindings = sub_bindings(&kv.value);
+
+                        // Figure out what the prop key is.
+                        let obj_key: DestructuringObjectKey = match &kv.key {
+                            ast::PropName::Ident(id) => {
+                                DestructuringObjectKey::Ident(id.sym.to_string())
+                            }
+                            ast::PropName::Str(str) => {
+                                DestructuringObjectKey::Ident(str.value.to_string())
+                            }
+                            ast::PropName::Num(num) => {
+                                DestructuringObjectKey::Ident(num.value.to_string())
+                            }
+                            ast::PropName::BigInt(big) => {
+                                DestructuringObjectKey::Ident(big.value.to_string())
+                            }
+                            ast::PropName::Computed(computed) => {
+                                DestructuringObjectKey::Computed(*computed.expr.clone())
+                            }
+                        };
+
+                        for mut b in bindings {
+                            b.destructure_path
+                                .insert(0, DestructuringExpr::ObjectKey(obj_key.clone()));
+                            result.push(b);
+                        }
+                    }
+
+                    ast::ObjectPatProp::Assign(assign) => {
+                        // E.g. "let {x} = ..." or "let { x = default_value } = ...".
+                        // Indicates a new bind named x, optionally with a default value.
+                        let key = assign.key.sym.to_string();
+                        result.push(BindingPat {
+                            id: assign.key.to_id(),
+                            name: key.clone(),
+                            type_ann: None,
+                            default: assign.value.as_ref().map(|v| *v.clone()),
+                            destructure_path: vec![DestructuringExpr::ObjectKey(
+                                DestructuringObjectKey::Ident(key),
+                            )],
+                        });
+                    }
+
+                    ast::ObjectPatProp::Rest(r) => {
+                        // E.g. "let {x, ...xs} = ...", indicates a rest expression.
+                        rest = Some(r);
+                    }
+                }
+            }
+
+            // If we have a rest expression, compute the except list.
+            if let Some(rest) = rest {
+                // Determine the keys that have already been destructured.
+                let mut except = Vec::with_capacity(result.len());
+                for b in &result {
+                    if let Some(DestructuringExpr::ObjectKey(DestructuringObjectKey::Ident(id))) =
+                        b.destructure_path.first()
+                    {
+                        except.push(id.clone());
+                    }
+                }
+
+                let rest_bindings = sub_bindings(&rest.arg);
+                for mut b in rest_bindings {
+                    b.destructure_path.insert(
+                        0,
+                        DestructuringExpr::ObjectRest {
+                            except: except.clone(),
+                        },
+                    );
+                    result.push(b);
+                }
+            }
+
+            result
+        }
+
+        ast::Pat::Assign(_assign) => {
+            // TODO what does this even mean?
+            todo!("assign pattern")
+        }
+
+        ast::Pat::Rest(_) => {
+            // This shouldn't happen here as we handle it in the array and object cases directly.
+            vec![]
+        }
+        ast::Pat::Invalid(_) | ast::Pat::Expr(_) => {
+            // These shouldn't happen; ignore them.
+            vec![]
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use crate::parser::types::binding::{DestructuringExpr, DestructuringObjectKey};
+    use crate::testutil::testparse::test_parse;
+
+    #[test]
+    fn test_bindings() {
+        let tests = vec![
+            ("x", vec![("x", vec![DestructuringExpr::Full])]),
+            (
+                "{x}",
+                vec![(
+                    "x",
+                    vec![DestructuringExpr::ObjectKey(DestructuringObjectKey::Ident(
+                        "x".into(),
+                    ))],
+                )],
+            ),
+            (
+                "{x: y}",
+                vec![(
+                    "y",
+                    vec![DestructuringExpr::ObjectKey(DestructuringObjectKey::Ident(
+                        "x".into(),
+                    ))],
+                )],
+            ),
+            (
+                "{a, ...rest, b: c}",
+                vec![
+                    (
+                        "a",
+                        vec![DestructuringExpr::ObjectKey(DestructuringObjectKey::Ident(
+                            "a".into(),
+                        ))],
+                    ),
+                    (
+                        "c",
+                        vec![DestructuringExpr::ObjectKey(DestructuringObjectKey::Ident(
+                            "b".into(),
+                        ))],
+                    ),
+                    (
+                        "rest",
+                        vec![DestructuringExpr::ObjectRest {
+                            except: vec!["a".into(), "b".into()],
+                        }],
+                    ),
+                ],
+            ),
+            (
+                "[, a, , b, ...rest]",
+                vec![
+                    ("a", vec![DestructuringExpr::ArrayIndex(1)]),
+                    ("b", vec![DestructuringExpr::ArrayIndex(3)]),
+                    ("rest", vec![DestructuringExpr::ArrayRest(4)]),
+                ],
+            ),
+        ];
+
+        for (expr, want) in tests {
+            let stmt = format!("let {expr} = 1;");
+            let module = test_parse(&stmt);
+            let var = module.ast.body[0]
+                .as_stmt()
+                .unwrap()
+                .as_decl()
+                .unwrap()
+                .as_var()
+                .unwrap();
+            let got = super::bindings(&var.decls[0].name);
+            assert_eq!(got.len(), want.len());
+            for (got, want) in got.iter().zip(want.iter()) {
+                assert_eq!(got.name, want.0, "expr: {expr}");
+                assert_eq!(got.destructure_path, want.1, "expr: {expr}");
+            }
+        }
+    }
+}
diff --git a/tsparser/src/parser/types/mod.rs b/tsparser/src/parser/types/mod.rs
new file mode 100644
index 0000000000..8632de1bed
--- /dev/null
+++ b/tsparser/src/parser/types/mod.rs
@@ -0,0 +1,18 @@
+mod ast_id;
+mod binding;
+mod object;
+mod typ;
+mod type_resolve;
+mod type_string;
+mod utils;
+pub mod visitor;
+
+mod resolved;
+#[cfg(test)]
+mod tests;
+pub mod validation;
+
+pub use object::{Object, ObjectId, ObjectKind, ResolveState};
+pub use typ::*;
+pub use type_resolve::TypeChecker;
+pub use utils::*;
diff --git a/tsparser/src/parser/types/object.rs b/tsparser/src/parser/types/object.rs
new file mode 100644
index 0000000000..47a5ec29a2
--- /dev/null
+++ b/tsparser/src/parser/types/object.rs
@@ -0,0 +1,870 @@
+use std::cell::{Cell, OnceCell, RefCell};
+use std::collections::HashMap;
+use std::fmt::Debug;
+use std::hash::Hash;
+use std::rc::Rc;
+
+use anyhow::Result;
+use serde::Serialize;
+use swc_common::errors::HANDLER;
+use swc_common::sync::Lrc;
+use swc_common::Spanned;
+use swc_ecma_ast as ast;
+
+use crate::parser::module_loader::ModuleId;
+use crate::parser::types::ast_id::AstId;
+use crate::parser::types::binding::bindings;
+use crate::parser::types::typ;
+use crate::parser::{module_loader, Range};
+
+#[derive(Debug, Clone, Copy, Hash, PartialEq, Eq)]
+pub struct ObjectId(pub(super) usize);
+
+/// An Object describes a named language entity such as a module, constant, type, variable, function, etc.
+pub struct Object {
+    pub id: ObjectId,
+    pub range: Range,
+    pub name: Option<String>,
+    pub kind: ObjectKind,
+    pub module_id: ModuleId,
+    pub(super) state: RefCell<CheckState>,
+}
+
+impl Serialize for Object {
+    fn serialize<S: serde::Serializer>(&self, serializer: S) -> Result<S::Ok, S::Error> {
+        serializer.serialize_str(self.name.as_ref().unwrap_or(&"".to_string()))
+    }
+}
+
+impl Debug for Object {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Object")
+            // .field("id", &self.id)
+            // .field("range", &self.range)
+            .field("name", &self.name)
+            // .field("kind", &self.kind)
+            // .field("module_id", &self.module_id)
+            .finish()
+    }
+}
+
+impl Hash for Object {
+    fn hash<H: std::hash::Hasher>(&self, state: &mut H) {
+        self.id.hash(state);
+    }
+}
+
+impl PartialEq for Object {
+    fn eq(&self, other: &Self) -> bool {
+        self.id == other.id
+    }
+}
+
+impl Eq for Object {}
+
+#[derive(Debug)]
+pub enum ObjectKind {
+    TypeName(TypeName),
+    Enum(Enum),
+    Var(Var),
+    Using(Using),
+    Func(Func),
+    Class(Class),
+    Module(Rc<Module>),
+    Namespace(Namespace),
+}
+
+impl ObjectKind {
+    pub fn type_params<'a>(&'a self) -> Box<dyn Iterator<Item = &'a ast::TsTypeParam> + 'a> {
+        match self {
+            ObjectKind::TypeName(TypeName { decl }) => match decl {
+                TypeNameDecl::Interface(i) => {
+                    Box::new(i.type_params.iter().flat_map(|p| p.params.iter()))
+                }
+                TypeNameDecl::TypeAlias(t) => {
+                    Box::new(t.type_params.iter().flat_map(|p| p.params.iter()))
+                }
+            },
+            _ => Box::new([].iter()),
+        }
+    }
+}
+
+#[derive(Debug)]
+pub(super) enum CheckState {
+    NotStarted,
+    InProgress,
+    Completed(typ::Type),
+}
+
+#[derive(Debug)]
+pub struct TypeName {
+    pub decl: TypeNameDecl,
+}
+
+#[derive(Debug)]
+pub enum TypeNameDecl {
+    Interface(ast::TsInterfaceDecl),
+    TypeAlias(ast::TsTypeAliasDecl),
+}
+
+#[derive(Debug)]
+pub struct Class {
+    #[allow(dead_code)]
+    pub spec: Box<ast::Class>,
+}
+
+#[derive(Debug)]
+pub struct Enum {
+    pub members: Vec<ast::TsEnumMember>,
+}
+
+#[derive(Debug)]
+pub struct Func {
+    #[allow(dead_code)]
+    pub spec: Box<ast::Function>,
+}
+
+#[derive(Debug)]
+pub struct Namespace {
+    pub data: Box<NSData>,
+}
+
+#[derive(Debug)]
+pub struct Var {
+    pub type_ann: Option<ast::TsTypeAnn>,
+    pub expr: Option<Box<ast::Expr>>,
+}
+
+#[derive(Debug)]
+pub struct Using {
+    pub type_ann: Option<ast::TsTypeAnn>,
+    pub expr: Option<Box<ast::Expr>>,
+}
+
+#[derive(Debug)]
+pub struct NamedReexport {
+    pub orig_name: String,
+    pub renamed: Option<String>,
+}
+
+#[derive(Debug)]
+pub enum Reexport {
+    List {
+        items: Vec<NamedReexport>,
+        import_path: String,
+    },
+    All {
+        import_path: String,
+    },
+}
+
+#[derive(Debug)]
+pub struct NSData {
+    /// The objects imported by the module.
+    pub imports: HashMap<AstId, ImportedName>,
+
+    /// Top-level objects, keyed by their id.
+    pub top_level: HashMap<AstId, Rc<Object>>,
+
+    /// The named exports.
+    pub named_exports: HashMap<String, Rc<Object>>,
+
+    /// The default export, if any.
+    pub default_export: Option<Rc<Object>>,
+
+    // Reexports from other modules.
+    pub reexports: Vec<Reexport>,
+
+    /// Export items that haven't yet been processed.
+    #[allow(dead_code)]
+    pub unprocessed_exports: Vec<ast::ModuleItem>,
+}
+
+#[derive(Debug)]
+pub struct Module {
+    pub base: Lrc<module_loader::Module>,
+    pub data: Box<NSData>,
+}
+
+#[derive(Debug, Clone)]
+pub struct ImportedName {
+    pub range: Range,
+    pub import_path: String,
+    pub kind: ImportKind,
+}
+
+#[derive(Debug, Clone)]
+pub enum ImportKind {
+    Named(String),
+    Default,
+    Namespace,
+}
+
+impl NSData {
+    fn new() -> Self {
+        Self {
+            imports: HashMap::new(),
+            top_level: HashMap::new(),
+            named_exports: HashMap::new(),
+            default_export: None,
+            reexports: vec![],
+            unprocessed_exports: vec![],
+        }
+    }
+
+    pub fn get_named_export(
+        &self,
+        ctx: &ResolveState,
+        curr_module: &swc_common::FileName,
+        needle: &str,
+    ) -> Option<Rc<Object>> {
+        if needle == "default" {
+            if let Some(default) = &self.default_export {
+                return Some(default.clone());
+            }
+        }
+        if let Some(obj) = self.named_exports.get(needle) {
+            return Some(obj.clone());
+        }
+
+        for re in &self.reexports {
+            match re {
+                Reexport::List { import_path, items } => {
+                    for item in items {
+                        let export_name = item.renamed.as_ref().unwrap_or(&item.orig_name);
+                        if export_name == needle {
+                            let module = ctx.resolve_module_import(curr_module, import_path)?;
+                            return module.data.get_named_export(
+                                ctx,
+                                &module.base.swc_file_path,
+                                &item.orig_name,
+                            );
+                        }
+                    }
+                }
+
+                Reexport::All { import_path } => {
+                    if let Some(module) = ctx.resolve_module_import(curr_module, import_path) {
+                        if let Some(export) = module.data.get_named_export(ctx, curr_module, needle)
+                        {
+                            return Some(export);
+                        }
+                    }
+                }
+            }
+        }
+        None
+    }
+
+    fn add_top_level(&mut self, id: AstId, obj: Rc<Object>) -> Rc<Object> {
+        if let Some(other) = self.top_level.get(&id) {
+            // Unhandled overload most likely, return the existing object for now.
+            return other.clone();
+        }
+
+        self.top_level.insert(id, obj.clone());
+        obj
+    }
+
+    fn add_import(&mut self, id: AstId, import: ImportedName) {
+        if self.imports.contains_key(&id) {
+            HANDLER.with(|handler| {
+                handler.span_err(import.range.to_span(), &format!("`{id}` already imported"));
+            });
+            return;
+        }
+
+        self.imports.insert(id, import);
+    }
+}
+
+fn process_module_items(ctx: &ResolveState, ns: &mut NSData, items: &[ast::ModuleItem]) {
+    for it in items {
+        match it {
+            ast::ModuleItem::ModuleDecl(md) => match md {
+                ast::ModuleDecl::Import(import) => process_import(ns, import),
+                ast::ModuleDecl::ExportDecl(decl) => {
+                    let objs = process_decl(ctx, ns, &decl.decl);
+                    for obj in objs {
+                        if let Some(name) = &obj.name {
+                            ns.named_exports.insert(name.clone(), obj);
+                        }
+                    }
+                }
+
+                ast::ModuleDecl::ExportDefaultDecl(decl) => {
+                    let obj = process_default_decl(ctx, &decl.decl);
+                    if ns.default_export.is_some() {
+                        obj.range.err("duplicate default export");
+                    }
+                    ns.default_export = Some(obj);
+                }
+
+                // TODO(andre) Can this affect the module namespace?
+                ast::ModuleDecl::ExportDefaultExpr(_expr) => {
+                    // TODO this is e.g `export default new SQLDatabase`
+                    // need to resolve to object
+                    log::debug!("TODO export default expr");
+                }
+
+                ast::ModuleDecl::ExportNamed(decl) => {
+                    // Re-exporting from another module.
+                    let Some(src) = &decl.src else {
+                        log::debug!("ExportNamed without src");
+                        continue;
+                    };
+
+                    ns.reexports.push(Reexport::List {
+                        import_path: src.value.to_string(),
+                        items: decl
+                            .specifiers
+                            .iter()
+                            .filter_map(|spec| match spec {
+                                ast::ExportSpecifier::Named(named) => {
+                                    let orig_name = module_export_name_to_string(&named.orig);
+                                    Some(NamedReexport {
+                                        orig_name,
+                                        renamed: named
+                                            .exported
+                                            .as_ref()
+                                            .map(module_export_name_to_string),
+                                    })
+                                }
+                                ast::ExportSpecifier::Default(_) => {
+                                    log::debug!("TODO: ExportNamed with default");
+                                    None
+                                }
+                                ast::ExportSpecifier::Namespace(_) => {
+                                    log::debug!("TODO: ExportNamed with namespace");
+                                    None
+                                }
+                            })
+                            .collect(),
+                    });
+                }
+
+                ast::ModuleDecl::ExportAll(decl) => {
+                    // Re-exporting * from another module.
+                    ns.reexports.push(Reexport::All {
+                        import_path: decl.src.value.to_string(),
+                    });
+                }
+
+                ast::ModuleDecl::TsImportEquals(_) => {
+                    log::debug!("TODO ts import equals");
+                }
+
+                ast::ModuleDecl::TsExportAssignment(decl) => {
+                    log::debug!("TsExportAssignment {:#?}", decl);
+                }
+
+                ast::ModuleDecl::TsNamespaceExport(decl) => {
+                    log::debug!("TsNamespaceExport {:#?}", decl);
+                }
+            },
+
+            ast::ModuleItem::Stmt(stmt) => {
+                process_stmt(ctx, ns, stmt);
+            }
+        }
+    }
+}
+
+/// Process an import declaration, adding imports to the module.
+fn process_import(ns: &mut NSData, import: &ast::ImportDecl) {
+    for specifier in &import.specifiers {
+        match specifier {
+            ast::ImportSpecifier::Named(named) => {
+                let export_name = named.imported.as_ref().map_or_else(
+                    || named.local.clone(),
+                    |export_name| match export_name {
+                        ast::ModuleExportName::Ident(id) => id.clone(),
+                        ast::ModuleExportName::Str(str) => {
+                            ast::Ident::new(str.value.clone(), str.span)
+                        }
+                    },
+                );
+
+                ns.add_import(
+                    AstId::from(&named.local),
+                    ImportedName {
+                        range: named.span.into(),
+                        import_path: import.src.value.to_string(),
+                        kind: ImportKind::Named(export_name.sym.as_ref().to_string()),
+                    },
+                );
+            }
+            ast::ImportSpecifier::Default(default) => {
+                ns.add_import(
+                    AstId::from(&default.local),
+                    ImportedName {
+                        range: default.span.into(),
+                        import_path: import.src.value.to_string(),
+                        kind: ImportKind::Default,
+                    },
+                );
+            }
+            ast::ImportSpecifier::Namespace(ns_import) => {
+                // import * as foo
+                ns.add_import(
+                    AstId::from(&ns_import.local),
+                    ImportedName {
+                        range: ns_import.span.into(),
+                        import_path: import.src.value.to_string(),
+                        kind: ImportKind::Namespace,
+                    },
+                );
+            }
+        }
+    }
+}
+
+fn process_stmt(ctx: &ResolveState, ns: &mut NSData, stmt: &ast::Stmt) -> Vec<Rc<Object>> {
+    match stmt {
+        ast::Stmt::Decl(decl) => process_decl(ctx, ns, decl),
+        ast::Stmt::Block(block) => {
+            let mut objs = vec![];
+            for stmt in &block.stmts {
+                objs.extend(process_stmt(ctx, ns, stmt));
+            }
+            objs
+        }
+
+        // NOTE(andre): I believe other statements can't really declare things,
+        // since they're inside blocks.
+        _ => vec![],
+    }
+}
+
+fn process_decl(ctx: &ResolveState, ns: &mut NSData, decl: &ast::Decl) -> Vec<Rc<Object>> {
+    let range: Range = decl.span().into();
+    match decl {
+        ast::Decl::Class(d) => {
+            let name = Some(d.ident.sym.to_string());
+            let obj = ctx.new_obj(
+                name,
+                range,
+                ObjectKind::Class(Class {
+                    spec: d.class.clone(),
+                }),
+            );
+            ns.add_top_level(AstId::from(&d.ident), obj.clone());
+            vec![obj]
+        }
+
+        ast::Decl::Fn(d) => {
+            let name = Some(d.ident.sym.to_string());
+            let obj = ctx.new_obj(
+                name,
+                range,
+                ObjectKind::Func(Func {
+                    spec: d.function.clone(),
+                }),
+            );
+            ns.add_top_level(AstId::from(&d.ident), obj.clone());
+            vec![obj]
+        }
+
+        ast::Decl::Var(d) => {
+            let mut objs = vec![];
+            for var_decl in &d.decls {
+                for b in bindings(&var_decl.name) {
+                    let name = Some(b.name.to_string());
+                    let range = var_decl.span.into();
+                    let obj = ctx.new_obj(
+                        name,
+                        range,
+                        ObjectKind::Var(Var {
+                            type_ann: b.type_ann,
+                            expr: var_decl.init.clone(),
+                        }),
+                    );
+                    ns.add_top_level(AstId::new(b.id, b.name.clone()), obj.clone());
+                    objs.push(obj);
+                }
+            }
+            objs
+        }
+
+        ast::Decl::Using(d) => {
+            let mut objs = vec![];
+            for var_decl in &d.decls {
+                for b in bindings(&var_decl.name) {
+                    let name = Some(b.name.to_string());
+                    let range = var_decl.span.into();
+                    let obj = ctx.new_obj(
+                        name,
+                        range,
+                        ObjectKind::Using(Using {
+                            type_ann: b.type_ann,
+                            expr: var_decl.init.clone(),
+                        }),
+                    );
+                    ns.add_top_level(AstId::new(b.id, b.name.clone()), obj.clone());
+                    objs.push(obj);
+                }
+            }
+            objs
+        }
+
+        ast::Decl::TsInterface(d) => {
+            let name = Some(d.id.sym.to_string());
+            let obj = ctx.new_obj(
+                name,
+                range,
+                ObjectKind::TypeName(TypeName {
+                    decl: TypeNameDecl::Interface(*d.clone()),
+                }),
+            );
+            ns.add_top_level(AstId::from(&d.id), obj.clone());
+            vec![obj]
+        }
+
+        ast::Decl::TsTypeAlias(d) => {
+            let name = d.id.sym.to_string();
+            let obj = ctx.new_obj(
+                Some(name),
+                range,
+                ObjectKind::TypeName(TypeName {
+                    decl: TypeNameDecl::TypeAlias(*d.clone()),
+                }),
+            );
+            ns.add_top_level(AstId::from(&d.id), obj.clone());
+            vec![obj]
+        }
+
+        ast::Decl::TsEnum(d) => {
+            let name = Some(d.id.sym.to_string());
+            let obj = ctx.new_obj(
+                name,
+                range,
+                ObjectKind::Enum(Enum {
+                    members: d.members.clone(),
+                }),
+            );
+            ns.add_top_level(AstId::from(&d.id), obj.clone());
+            vec![obj]
+        }
+
+        ast::Decl::TsModule(d) => {
+            // Namespace declaration
+            match &d.id {
+                ast::TsModuleName::Ident(id) => {
+                    let mut ns2 = Namespace {
+                        data: Box::new(NSData::new()),
+                    };
+                    if let Some(body) = &d.body {
+                        process_namespace_body(ctx, &mut ns2.data, body);
+                    }
+
+                    let name = Some(id.sym.to_string());
+                    let obj = ctx.new_obj(name, range, ObjectKind::Namespace(ns2));
+                    ns.add_top_level(AstId::from(id), obj.clone());
+                    vec![obj]
+                }
+                ast::TsModuleName::Str(_) => {
+                    // This is not valid for namespace declarations, ignore it.
+                    vec![]
+                }
+            }
+        }
+    }
+}
+
+fn process_default_decl(ctx: &ResolveState, decl: &ast::DefaultDecl) -> Rc<Object> {
+    let range: Range = decl.span().into();
+    match decl {
+        ast::DefaultDecl::Class(d) => {
+            let name = d.ident.as_ref().map(|id| id.sym.to_string());
+            ctx.new_obj(
+                name,
+                range,
+                ObjectKind::Class(Class {
+                    spec: d.class.clone(),
+                }),
+            )
+        }
+
+        ast::DefaultDecl::Fn(d) => {
+            let name = d.ident.as_ref().map(|id| id.sym.to_string());
+            ctx.new_obj(
+                name,
+                range,
+                ObjectKind::Func(Func {
+                    spec: d.function.clone(),
+                }),
+            )
+        }
+
+        ast::DefaultDecl::TsInterfaceDecl(d) => {
+            let name = Some(d.id.sym.to_string());
+            ctx.new_obj(
+                name,
+                range,
+                ObjectKind::TypeName(TypeName {
+                    decl: TypeNameDecl::Interface(*d.clone()),
+                }),
+            )
+        }
+    }
+}
+
+fn process_namespace_body(ctx: &ResolveState, ns: &mut NSData, body: &ast::TsNamespaceBody) {
+    match body {
+        ast::TsNamespaceBody::TsModuleBlock(block) => {
+            process_module_items(ctx, ns, &block.body[..]);
+        }
+        ast::TsNamespaceBody::TsNamespaceDecl(decl) => {
+            let name = Some(decl.id.sym.to_string());
+            let mut ns2 = Namespace {
+                data: Box::new(NSData::new()),
+            };
+            process_namespace_body(ctx, &mut ns2.data, &decl.body);
+
+            let range = decl.span.into();
+            let obj = ctx.new_obj(name, range, ObjectKind::Namespace(ns2));
+            ns.add_top_level(AstId::from(&decl.id), obj);
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct ResolveState {
+    loader: Lrc<module_loader::ModuleLoader>,
+    module_objects: RefCell<HashMap<ModuleId, Rc<Object>>>,
+    module_stack: RefCell<Vec<ModuleId>>,
+    universe: OnceCell<Rc<Module>>,
+    next_id: Cell<usize>,
+}
+
+impl ResolveState {
+    pub(super) fn new(loader: Lrc<module_loader::ModuleLoader>) -> Self {
+        Self {
+            loader,
+            module_objects: RefCell::new(HashMap::new()),
+            module_stack: RefCell::new(vec![]),
+            universe: OnceCell::new(),
+            next_id: Cell::new(1),
+        }
+    }
+
+    pub(super) fn universe(&self) -> Rc<Module> {
+        if let Some(universe) = self.universe.get() {
+            return universe.to_owned();
+        }
+
+        let ast = self.loader.universe();
+        let module = self.get_or_init_module(ast);
+        self.universe.set(module.clone()).unwrap();
+        self.universe.get().unwrap().to_owned()
+    }
+
+    pub(super) fn new_obj(
+        &self,
+        name: Option<String>,
+        range: Range,
+        kind: ObjectKind,
+    ) -> Rc<Object> {
+        let obj_id = self.next_id.get();
+        self.next_id.set(obj_id + 1);
+
+        let module_id = self.module_id().expect("no current module");
+        Rc::new(Object {
+            id: ObjectId(obj_id),
+            range,
+            module_id,
+            name,
+            kind,
+            state: RefCell::new(CheckState::NotStarted),
+        })
+    }
+
+    pub fn lookup_module(&self, id: ModuleId) -> Option<Rc<Module>> {
+        self.module_objects
+            .borrow()
+            .get(&id)
+            .and_then(|obj| match &obj.kind {
+                ObjectKind::Module(module) => Some(module.clone()),
+                _ => None,
+            })
+    }
+
+    pub fn is_universe(&self, id: ModuleId) -> bool {
+        let universe = self.universe();
+        universe.base.id == id
+    }
+
+    pub fn is_module_path(&self, id: ModuleId, name: &str) -> bool {
+        if let Some(module) = self.lookup_module(id) {
+            module.base.module_path.as_ref().is_some_and(|p| p == name)
+        } else {
+            false
+        }
+    }
+
+    pub fn get_or_init_module(&self, module: Lrc<module_loader::Module>) -> Rc<Module> {
+        let module_id = module.id;
+        if let Some(m) = self.lookup_module(module_id) {
+            return m;
+        }
+
+        let mut data = Box::new(NSData::new());
+        self.with_curr_module(module_id, || {
+            process_module_items(self, &mut data, &module.ast.body[..])
+        });
+
+        let new_module = Rc::new(Module { base: module, data });
+
+        self.module_objects.borrow_mut().insert(
+            module_id,
+            self.with_curr_module(module_id, || {
+                self.new_obj(
+                    None,
+                    new_module.base.ast.span.into(),
+                    ObjectKind::Module(new_module.clone()),
+                )
+            }),
+        );
+
+        new_module
+    }
+
+    fn with_curr_module<Fn, Res>(&self, module_id: ModuleId, f: Fn) -> Res
+    where
+        Fn: FnOnce() -> Res,
+    {
+        self.module_stack.borrow_mut().push(module_id);
+        let result = f();
+        self.module_stack.borrow_mut().pop();
+        result
+    }
+
+    fn module_id(&self) -> Result<ModuleId> {
+        let stack = self.module_stack.borrow();
+        let module = stack
+            .last()
+            .ok_or_else(|| anyhow::anyhow!("internal error: no module on stack"))?;
+        Ok(module.to_owned())
+    }
+
+    pub(super) fn resolve_module_default_export(&self, module_id: ModuleId) -> Option<Rc<Object>> {
+        self.lookup_module(module_id)?.data.default_export.clone()
+    }
+
+    pub(super) fn resolve_module_ident(
+        &self,
+        module_id: ModuleId,
+        ident: &ast::Ident,
+    ) -> Option<Rc<Object>> {
+        let module = self.lookup_module(module_id)?;
+
+        // Is it a top-level object in this module?
+        let ast_id = AstId::from(ident);
+        if let Some(obj) = module.data.top_level.get(&ast_id) {
+            return Some(obj.clone());
+        }
+
+        // Otherwise, is it an import?
+        if let Some(imp_name) = module.data.imports.get(&ast_id) {
+            return self.resolve_import(&module, imp_name);
+        }
+
+        // Is it in universe scope?
+        {
+            let universe = self.universe();
+            let name = ident.sym.as_ref();
+            if let Some(obj) = universe.data.named_exports.get(name) {
+                return Some(obj.clone());
+            }
+        }
+
+        // Otherwise we don't know about this object.
+        None
+    }
+
+    pub(super) fn resolve_module_import(
+        &self,
+        from_file: &swc_common::FileName,
+        import_path: &str,
+    ) -> Option<Rc<Module>> {
+        let ast_module = match self.loader.resolve_import(from_file, import_path) {
+            Ok(Some(ast_module)) => ast_module,
+            Ok(None) | Err(_) => return None,
+        };
+        Some(self.get_or_init_module(ast_module))
+    }
+
+    pub(super) fn resolve_import(&self, module: &Module, imp: &ImportedName) -> Option<Rc<Object>> {
+        let ast_module = match self
+            .loader
+            .resolve_import(&module.base.swc_file_path, &imp.import_path)
+        {
+            Ok(None) => return None,
+            Ok(Some(ast_module)) => Ok(ast_module),
+            Err(err) => Err(err),
+        };
+
+        let ast_module = ast_module
+            .inspect_err(|err| {
+                HANDLER.with(|handler| {
+                    handler.span_err(imp.range.to_span(), &format!("import not found: {err}"))
+                })
+            })
+            .ok()?;
+
+        match &imp.kind {
+            ImportKind::Named(name) => {
+                let imported = self.get_or_init_module(ast_module);
+                let obj = imported
+                    .data
+                    .get_named_export(self, &imported.base.swc_file_path, name);
+
+                if obj.is_none() {
+                    HANDLER.with(|handler| {
+                        handler.span_err(imp.range.to_span(), &format!("object not found: {name}"));
+                    });
+                }
+
+                obj
+            }
+            ImportKind::Default => {
+                let imported = self.get_or_init_module(ast_module);
+                let obj =
+                    imported
+                        .data
+                        .get_named_export(self, &imported.base.swc_file_path, "default");
+
+                if obj.is_none() {
+                    HANDLER.with(|handler| {
+                        handler.span_err(imp.range.to_span(), "default export not found");
+                    });
+                }
+
+                obj
+            }
+            ImportKind::Namespace => {
+                let imported = self.get_or_init_module(ast_module);
+                let obj = self.module_objects.borrow().get(&imported.base.id).cloned();
+
+                if obj.is_none() {
+                    HANDLER.with(|handler| {
+                        handler.span_err(
+                            imp.range.to_span(),
+                            "object for namespaced import not found",
+                        );
+                    });
+                }
+
+                obj
+            }
+        }
+    }
+}
+
+fn module_export_name_to_string(name: &ast::ModuleExportName) -> String {
+    match name {
+        ast::ModuleExportName::Ident(i) => i.sym.to_string(),
+        ast::ModuleExportName::Str(str) => str.value.as_str().to_string(),
+    }
+}
diff --git a/tsparser/src/parser/types/resolved.rs b/tsparser/src/parser/types/resolved.rs
new file mode 100644
index 0000000000..c7302d0f6b
--- /dev/null
+++ b/tsparser/src/parser/types/resolved.rs
@@ -0,0 +1,177 @@
+use std::borrow::{Borrow, Cow};
+use std::cmp::Ordering;
+use std::fmt;
+use std::hash::{Hash, Hasher};
+use std::ops::Deref;
+
+use Resolved::*;
+
+pub enum Resolved<'a, B: ?Sized + 'a>
+where
+    B: ToOwned,
+{
+    New(<B as ToOwned>::Owned),
+    Changed(&'a B),
+    Same(&'a B),
+}
+
+impl<'a, B: ?Sized + 'a> From<Resolved<'a, B>> for Cow<'a, B>
+where
+    B: ToOwned,
+{
+    fn from(val: Resolved<'a, B>) -> Self {
+        match val {
+            New(owned) => Cow::Owned(owned),
+            Changed(borrowed) | Same(borrowed) => Cow::Borrowed(borrowed),
+        }
+    }
+}
+
+impl<B: ?Sized + ToOwned> Clone for Resolved<'_, B> {
+    fn clone(&self) -> Self {
+        match *self {
+            New(ref o) => {
+                let b: &B = o.borrow();
+                New(b.to_owned())
+            }
+            Changed(b) => Changed(b),
+            Same(b) => Same(b),
+        }
+    }
+
+    fn clone_from(&mut self, source: &Self) {
+        match (self, source) {
+            (&mut New(ref mut dest), New(o)) => o.borrow().clone_into(dest),
+            (t, s) => t.clone_from(s),
+        }
+    }
+}
+
+impl<B: ?Sized + ToOwned> Resolved<'_, B> {
+    /// Converts `Same` to `Changed`.
+    pub fn same_to_changed(self) -> Self {
+        match self {
+            Same(borrowed) => Changed(borrowed),
+            _ => self,
+        }
+    }
+    ///
+    /// Converts `Same` to `Changed`.
+    pub fn into_new(self) -> Resolved<'static, B> {
+        match self {
+            Same(borrowed) | Changed(borrowed) => New(borrowed.to_owned()),
+            New(typ) => New(typ),
+        }
+    }
+
+    /// Extracts the owned data.
+    ///
+    /// Clones the data if it is not already owned.
+    pub fn into_owned(self) -> <B as ToOwned>::Owned {
+        match self {
+            Same(borrowed) | Changed(borrowed) => borrowed.to_owned(),
+            New(owned) => owned,
+        }
+    }
+}
+
+impl<B: ?Sized + ToOwned> Deref for Resolved<'_, B>
+where
+    B::Owned: Borrow<B>,
+{
+    type Target = B;
+
+    fn deref(&self) -> &B {
+        match *self {
+            Changed(borrowed) | Same(borrowed) => borrowed,
+            New(ref owned) => owned.borrow(),
+        }
+    }
+}
+
+impl<B: ?Sized> Eq for Resolved<'_, B> where B: Eq + ToOwned {}
+
+impl<B: ?Sized> Ord for Resolved<'_, B>
+where
+    B: Ord + ToOwned,
+{
+    #[inline]
+    fn cmp(&self, other: &Self) -> Ordering {
+        Ord::cmp(&**self, &**other)
+    }
+}
+
+impl<'b, B: ?Sized, C: ?Sized> PartialEq<Resolved<'b, C>> for Resolved<'_, B>
+where
+    B: PartialEq<C> + ToOwned,
+    C: ToOwned,
+{
+    #[inline]
+    fn eq(&self, other: &Resolved<'b, C>) -> bool {
+        PartialEq::eq(&**self, &**other)
+    }
+}
+
+impl<'a, B: ?Sized> PartialOrd for Resolved<'a, B>
+where
+    B: PartialOrd + ToOwned,
+{
+    #[inline]
+    fn partial_cmp(&self, other: &Resolved<'a, B>) -> Option<Ordering> {
+        PartialOrd::partial_cmp(&**self, &**other)
+    }
+}
+
+impl<B: ?Sized, D> fmt::Debug for Resolved<'_, B>
+where
+    D: fmt::Debug,
+    B: fmt::Debug + ToOwned<Owned = D>,
+{
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match *self {
+            Changed(ref b) => write!(f, "Changed({b:?})"),
+            Same(ref b) => write!(f, "Same({b:?})"),
+            New(ref o) => write!(f, "New({o:?})"),
+        }
+    }
+}
+
+impl<B: ?Sized, D> fmt::Display for Resolved<'_, B>
+where
+    D: fmt::Display,
+    B: fmt::Display + ToOwned<Owned = D>,
+{
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match *self {
+            Changed(ref b) | Same(ref b) => fmt::Display::fmt(b, f),
+            New(ref o) => fmt::Display::fmt(o, f),
+        }
+    }
+}
+
+impl<B: ?Sized, D> Default for Resolved<'_, B>
+where
+    D: Default,
+    B: ToOwned<Owned = D>,
+{
+    /// Creates an owned Resolved<'a, B> with the default value for the contained owned value.
+    fn default() -> Self {
+        New(<B as ToOwned>::Owned::default())
+    }
+}
+
+impl<B: ?Sized> Hash for Resolved<'_, B>
+where
+    B: Hash + ToOwned,
+{
+    #[inline]
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        Hash::hash(&**self, state)
+    }
+}
+
+impl<T: ?Sized + ToOwned> AsRef<T> for Resolved<'_, T> {
+    fn as_ref(&self) -> &T {
+        self
+    }
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@basic.ts.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@basic.ts.snap
new file mode 100644
index 0000000000..80b8f4de24
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@basic.ts.snap
@@ -0,0 +1,566 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/basic.ts
+---
+{
+    "Interface": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Number,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "optional",
+                    ),
+                    optional: true,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Exclude1": Union(
+        Union {
+            types: [
+                Literal(
+                    String(
+                        "bar",
+                    ),
+                ),
+                Literal(
+                    String(
+                        "optional",
+                    ),
+                ),
+            ],
+        },
+    ),
+    "Pick1": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Pick2": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "optional",
+                    ),
+                    optional: true,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Omit1": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Number,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "optional",
+                    ),
+                    optional: true,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Omit2": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "optional",
+                    ),
+                    optional: true,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Partial1": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: true,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: true,
+                    typ: Basic(
+                        Number,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "optional",
+                    ),
+                    optional: true,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Optional": Generic(
+        Intersection(
+            Intersection {
+                x: Generic(
+                    Mapped(
+                        Mapped {
+                            in_type: Named(
+                                Named {
+                                    obj: Object {
+                                        name: Some(
+                                            "Exclude",
+                                        ),
+                                    },
+                                    type_arguments: [
+                                        Generic(
+                                            Keyof(
+                                                Keyof(
+                                                    Generic(
+                                                        TypeParam(
+                                                            TypeParam {
+                                                                idx: 0,
+                                                                constraint: None,
+                                                            },
+                                                        ),
+                                                    ),
+                                                ),
+                                            ),
+                                        ),
+                                        Generic(
+                                            TypeParam(
+                                                TypeParam {
+                                                    idx: 1,
+                                                    constraint: Some(
+                                                        Generic(
+                                                            Keyof(
+                                                                Keyof(
+                                                                    Generic(
+                                                                        TypeParam(
+                                                                            TypeParam {
+                                                                                idx: 0,
+                                                                                constraint: None,
+                                                                            },
+                                                                        ),
+                                                                    ),
+                                                                ),
+                                                            ),
+                                                        ),
+                                                    ),
+                                                },
+                                            ),
+                                        ),
+                                    ],
+                                },
+                            ),
+                            value_type: Generic(
+                                Index(
+                                    Index {
+                                        source: Generic(
+                                            TypeParam(
+                                                TypeParam {
+                                                    idx: 0,
+                                                    constraint: None,
+                                                },
+                                            ),
+                                        ),
+                                        index: Generic(
+                                            MappedKeyType(
+                                                MappedKeyType,
+                                            ),
+                                        ),
+                                    },
+                                ),
+                            ),
+                            optional: None,
+                        },
+                    ),
+                ),
+                y: Named(
+                    Named {
+                        obj: Object {
+                            name: Some(
+                                "Partial",
+                            ),
+                        },
+                        type_arguments: [
+                            Named(
+                                Named {
+                                    obj: Object {
+                                        name: Some(
+                                            "Pick",
+                                        ),
+                                    },
+                                    type_arguments: [
+                                        Generic(
+                                            TypeParam(
+                                                TypeParam {
+                                                    idx: 0,
+                                                    constraint: None,
+                                                },
+                                            ),
+                                        ),
+                                        Generic(
+                                            TypeParam(
+                                                TypeParam {
+                                                    idx: 1,
+                                                    constraint: Some(
+                                                        Generic(
+                                                            Keyof(
+                                                                Keyof(
+                                                                    Generic(
+                                                                        TypeParam(
+                                                                            TypeParam {
+                                                                                idx: 0,
+                                                                                constraint: None,
+                                                                            },
+                                                                        ),
+                                                                    ),
+                                                                ),
+                                                            ),
+                                                        ),
+                                                    ),
+                                                },
+                                            ),
+                                        ),
+                                    ],
+                                },
+                            ),
+                        ],
+                    },
+                ),
+            },
+        ),
+    ),
+    "Optional1": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Number,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "optional",
+                    ),
+                    optional: true,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: true,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Index": Interface(
+        Interface {
+            fields: [],
+            index: Some(
+                (
+                    Basic(
+                        String,
+                    ),
+                    Union(
+                        Union {
+                            types: [
+                                Basic(
+                                    Boolean,
+                                ),
+                                Basic(
+                                    Number,
+                                ),
+                            ],
+                        },
+                    ),
+                ),
+            ),
+            call: None,
+        },
+    ),
+    "Intersect1": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Number,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Intersect2": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Literal(
+                        String(
+                            "literal",
+                        ),
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Intersect3": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Never,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Intersect4": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Literal(
+                        String(
+                            "optional",
+                        ),
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Intersect5": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "a",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Any,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "b",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "c",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Never,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Enum1": Enum(
+        EnumType {
+            members: [
+                EnumMember {
+                    name: "A",
+                    value: Number(
+                        0,
+                    ),
+                },
+                EnumMember {
+                    name: "B",
+                    value: Number(
+                        1,
+                    ),
+                },
+                EnumMember {
+                    name: "C",
+                    value: Number(
+                        2,
+                    ),
+                },
+                EnumMember {
+                    name: "D",
+                    value: String(
+                        "foo",
+                    ),
+                },
+                EnumMember {
+                    name: "E",
+                    value: Number(
+                        5,
+                    ),
+                },
+                EnumMember {
+                    name: "F",
+                    value: Number(
+                        6,
+                    ),
+                },
+            ],
+        },
+    ),
+    "EnumFields": Union(
+        Union {
+            types: [
+                Literal(
+                    String(
+                        "A",
+                    ),
+                ),
+                Literal(
+                    String(
+                        "B",
+                    ),
+                ),
+                Literal(
+                    String(
+                        "C",
+                    ),
+                ),
+                Literal(
+                    String(
+                        "D",
+                    ),
+                ),
+                Literal(
+                    String(
+                        "E",
+                    ),
+                ),
+                Literal(
+                    String(
+                        "F",
+                    ),
+                ),
+            ],
+        },
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@export_default.ts.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@export_default.ts.snap
new file mode 100644
index 0000000000..fa923108bc
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@export_default.ts.snap
@@ -0,0 +1,24 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/export_default.ts
+---
+{
+    "default": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "name",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@export_wildcard.txt.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@export_wildcard.txt.snap
new file mode 100644
index 0000000000..14d6f01c1e
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@export_wildcard.txt.snap
@@ -0,0 +1,24 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/export_wildcard.txt
+---
+{
+    "foo": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@extends.ts.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@extends.ts.snap
new file mode 100644
index 0000000000..8fda36b7ac
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@extends.ts.snap
@@ -0,0 +1,210 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/extends.ts
+---
+{
+    "Foo": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Union(
+                        Union {
+                            types: [
+                                Basic(
+                                    String,
+                                ),
+                                Basic(
+                                    Number,
+                                ),
+                                Basic(
+                                    Null,
+                                ),
+                            ],
+                        },
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Number,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "optional",
+                    ),
+                    optional: true,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Bar": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Union(
+                        Union {
+                            types: [
+                                Basic(
+                                    String,
+                                ),
+                                Basic(
+                                    Null,
+                                ),
+                            ],
+                        },
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "optional",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "moo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Number,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Generic": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Union(
+                        Union {
+                            types: [
+                                Generic(
+                                    TypeParam(
+                                        TypeParam {
+                                            idx: 0,
+                                            constraint: None,
+                                        },
+                                    ),
+                                ),
+                                Basic(
+                                    Null,
+                                ),
+                            ],
+                        },
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "ExtendGeneric": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Union(
+                        Union {
+                            types: [
+                                Union(
+                                    Union {
+                                        types: [
+                                            Basic(
+                                                String,
+                                            ),
+                                            Basic(
+                                                Number,
+                                            ),
+                                        ],
+                                    },
+                                ),
+                                Basic(
+                                    Null,
+                                ),
+                            ],
+                        },
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "MergeGeneric": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Union(
+                        Union {
+                            types: [
+                                Literal(
+                                    Number(
+                                        5.0,
+                                    ),
+                                ),
+                                Basic(
+                                    Null,
+                                ),
+                            ],
+                        },
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@generic.ts.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@generic.ts.snap
new file mode 100644
index 0000000000..bdba64d50e
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@generic.ts.snap
@@ -0,0 +1,448 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/generic.ts
+---
+{
+    "Interface": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        TypeParam(
+                            TypeParam {
+                                idx: 0,
+                                constraint: None,
+                            },
+                        ),
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "InterfaceDefault": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        TypeParam(
+                            TypeParam {
+                                idx: 0,
+                                constraint: None,
+                            },
+                        ),
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "InterfaceDefaultMulti": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        TypeParam(
+                            TypeParam {
+                                idx: 0,
+                                constraint: None,
+                            },
+                        ),
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        TypeParam(
+                            TypeParam {
+                                idx: 1,
+                                constraint: None,
+                            },
+                        ),
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "baz",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        TypeParam(
+                            TypeParam {
+                                idx: 2,
+                                constraint: None,
+                            },
+                        ),
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "qux",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        TypeParam(
+                            TypeParam {
+                                idx: 3,
+                                constraint: None,
+                            },
+                        ),
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "quux",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        TypeParam(
+                            TypeParam {
+                                idx: 4,
+                                constraint: None,
+                            },
+                        ),
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "corge",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        TypeParam(
+                            TypeParam {
+                                idx: 5,
+                                constraint: None,
+                            },
+                        ),
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "X": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Y": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Z": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "M1": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Object,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Undefined,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "baz",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Null,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "qux",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "quux",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Number,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "corge",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "M2": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Object,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Undefined,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "baz",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Null,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "qux",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        BigInt,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "quux",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Number,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "corge",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "M3": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Object,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Undefined,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "baz",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Null,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "qux",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        BigInt,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "quux",
+                    ),
+                    optional: false,
+                    typ: Literal(
+                        Boolean(
+                            false,
+                        ),
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "corge",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Boolean,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "M4": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Object,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Undefined,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "baz",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        Null,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "qux",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        BigInt,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "quux",
+                    ),
+                    optional: false,
+                    typ: Literal(
+                        Boolean(
+                            false,
+                        ),
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "corge",
+                    ),
+                    optional: false,
+                    typ: Literal(
+                        String(
+                            "literal",
+                        ),
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@generics.ts.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@generics.ts.snap
new file mode 100644
index 0000000000..1b322a73db
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@generics.ts.snap
@@ -0,0 +1,253 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/generics.ts
+---
+{
+    "Generic1": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "cond",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        Conditional(
+                            Conditional {
+                                check_type: Generic(
+                                    TypeParam(
+                                        TypeParam {
+                                            idx: 0,
+                                            constraint: None,
+                                        },
+                                    ),
+                                ),
+                                extends_type: Basic(
+                                    String,
+                                ),
+                                true_type: Literal(
+                                    String(
+                                        "literal",
+                                    ),
+                                ),
+                                false_type: Basic(
+                                    Number,
+                                ),
+                            },
+                        ),
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Generic2": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "value",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        TypeParam(
+                            TypeParam {
+                                idx: 0,
+                                constraint: None,
+                            },
+                        ),
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "cond",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        Conditional(
+                            Conditional {
+                                check_type: Generic(
+                                    TypeParam(
+                                        TypeParam {
+                                            idx: 0,
+                                            constraint: None,
+                                        },
+                                    ),
+                                ),
+                                extends_type: Basic(
+                                    String,
+                                ),
+                                true_type: Literal(
+                                    String(
+                                        "literal",
+                                    ),
+                                ),
+                                false_type: Basic(
+                                    Number,
+                                ),
+                            },
+                        ),
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "Concrete1": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "one",
+                    ),
+                    optional: false,
+                    typ: Named(
+                        Named {
+                            obj: Object {
+                                name: Some(
+                                    "Generic1",
+                                ),
+                            },
+                            type_arguments: [
+                                Basic(
+                                    String,
+                                ),
+                            ],
+                        },
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "two",
+                    ),
+                    optional: false,
+                    typ: Named(
+                        Named {
+                            obj: Object {
+                                name: Some(
+                                    "Generic1",
+                                ),
+                            },
+                            type_arguments: [
+                                Literal(
+                                    String(
+                                        "test",
+                                    ),
+                                ),
+                            ],
+                        },
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "three",
+                    ),
+                    optional: false,
+                    typ: Named(
+                        Named {
+                            obj: Object {
+                                name: Some(
+                                    "Generic2",
+                                ),
+                            },
+                            type_arguments: [
+                                Basic(
+                                    Null,
+                                ),
+                            ],
+                        },
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "four",
+                    ),
+                    optional: false,
+                    typ: Named(
+                        Named {
+                            obj: Object {
+                                name: Some(
+                                    "Generic2",
+                                ),
+                            },
+                            type_arguments: [
+                                Named(
+                                    Named {
+                                        obj: Object {
+                                            name: Some(
+                                                "Generic1",
+                                            ),
+                                        },
+                                        type_arguments: [
+                                            Basic(
+                                                Boolean,
+                                            ),
+                                        ],
+                                    },
+                                ),
+                            ],
+                        },
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "five",
+                    ),
+                    optional: false,
+                    typ: Named(
+                        Named {
+                            obj: Object {
+                                name: Some(
+                                    "GenericIface",
+                                ),
+                            },
+                            type_arguments: [
+                                Named(
+                                    Named {
+                                        obj: Object {
+                                            name: Some(
+                                                "Generic1",
+                                            ),
+                                        },
+                                        type_arguments: [
+                                            Basic(
+                                                Boolean,
+                                            ),
+                                        ],
+                                    },
+                                ),
+                            ],
+                        },
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "GenericIface": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Generic(
+                        TypeParam(
+                            TypeParam {
+                                idx: 0,
+                                constraint: None,
+                            },
+                        ),
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@infer.txt.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@infer.txt.snap
new file mode 100644
index 0000000000..068b868385
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@infer.txt.snap
@@ -0,0 +1,61 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/infer.txt
+---
+{
+    "Iface": Generic(
+        Conditional(
+            Conditional {
+                check_type: Generic(
+                    TypeParam(
+                        TypeParam {
+                            idx: 0,
+                            constraint: None,
+                        },
+                    ),
+                ),
+                extends_type: Interface(
+                    Interface {
+                        fields: [
+                            InterfaceField {
+                                name: String(
+                                    "X",
+                                ),
+                                optional: false,
+                                typ: Generic(
+                                    Inferred(
+                                        Inferred(
+                                            0,
+                                        ),
+                                    ),
+                                ),
+                            },
+                        ],
+                        index: None,
+                        call: None,
+                    },
+                ),
+                true_type: Generic(
+                    Inferred(
+                        Inferred(
+                            0,
+                        ),
+                    ),
+                ),
+                false_type: Basic(
+                    Never,
+                ),
+            },
+        ),
+    ),
+    "Infer1": Basic(
+        String,
+    ),
+    "Infer2": Basic(
+        Never,
+    ),
+    "Infer3": Basic(
+        String,
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@keyofenum.ts.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@keyofenum.ts.snap
new file mode 100644
index 0000000000..0feb969bf5
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@keyofenum.ts.snap
@@ -0,0 +1,97 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/keyofenum.ts
+---
+{
+    "ObjectValues": Generic(
+        Index(
+            Index {
+                source: Generic(
+                    TypeParam(
+                        TypeParam {
+                            idx: 0,
+                            constraint: None,
+                        },
+                    ),
+                ),
+                index: Generic(
+                    Keyof(
+                        Keyof(
+                            Generic(
+                                TypeParam(
+                                    TypeParam {
+                                        idx: 0,
+                                        constraint: None,
+                                    },
+                                ),
+                            ),
+                        ),
+                    ),
+                ),
+            },
+        ),
+    ),
+    "MY_ENUM": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "VARIANT_1",
+                    ),
+                    optional: false,
+                    typ: Literal(
+                        String(
+                            "VARIANT_1",
+                        ),
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "VARIANT_2",
+                    ),
+                    optional: false,
+                    typ: Literal(
+                        String(
+                            "VARIANT_2",
+                        ),
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "VARIANT_3",
+                    ),
+                    optional: false,
+                    typ: Literal(
+                        String(
+                            "VARIANT_3",
+                        ),
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "MyEnum": Union(
+        Union {
+            types: [
+                Literal(
+                    String(
+                        "VARIANT_1",
+                    ),
+                ),
+                Literal(
+                    String(
+                        "VARIANT_2",
+                    ),
+                ),
+                Literal(
+                    String(
+                        "VARIANT_3",
+                    ),
+                ),
+            ],
+        },
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@qualified_name.ts.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@qualified_name.ts.snap
new file mode 100644
index 0000000000..08cc187874
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@qualified_name.ts.snap
@@ -0,0 +1,13 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/qualified_name.ts
+---
+{
+    "T1": Basic(
+        String,
+    ),
+    "T2": Basic(
+        Number,
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@reexport_single.txt.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@reexport_single.txt.snap
new file mode 100644
index 0000000000..4a89083647
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@reexport_single.txt.snap
@@ -0,0 +1,24 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/reexport_single.txt
+---
+{
+    "foo": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@reexport_wildcard.txt.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@reexport_wildcard.txt.snap
new file mode 100644
index 0000000000..71f2d3ed82
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@reexport_wildcard.txt.snap
@@ -0,0 +1,12 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/reexport_wildcard.txt
+---
+{
+    "foo": Literal(
+        String(
+            "foo",
+        ),
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@validation.ts.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@validation.ts.snap
new file mode 100644
index 0000000000..d3bf6356f8
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@validation.ts.snap
@@ -0,0 +1,131 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/validation.ts
+---
+{
+    "Params": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "foo",
+                    ),
+                    optional: false,
+                    typ: Validated(
+                        Validated {
+                            typ: Basic(
+                                Number,
+                            ),
+                            expr: And(
+                                [
+                                    Rule(
+                                        MinVal(
+                                            N(
+                                                3.0,
+                                            ),
+                                        ),
+                                    ),
+                                    Rule(
+                                        MaxVal(
+                                            N(
+                                                1000.0,
+                                            ),
+                                        ),
+                                    ),
+                                ],
+                            ),
+                        },
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "bar",
+                    ),
+                    optional: false,
+                    typ: Validated(
+                        Validated {
+                            typ: Basic(
+                                String,
+                            ),
+                            expr: And(
+                                [
+                                    Rule(
+                                        MinLen(
+                                            5,
+                                        ),
+                                    ),
+                                    Rule(
+                                        MaxLen(
+                                            20,
+                                        ),
+                                    ),
+                                ],
+                            ),
+                        },
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "urlOrEmail",
+                    ),
+                    optional: false,
+                    typ: Validated(
+                        Validated {
+                            typ: Basic(
+                                String,
+                            ),
+                            expr: Or(
+                                [
+                                    Rule(
+                                        Is(
+                                            Url,
+                                        ),
+                                    ),
+                                    Rule(
+                                        Is(
+                                            Email,
+                                        ),
+                                    ),
+                                ],
+                            ),
+                        },
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "emails",
+                    ),
+                    optional: false,
+                    typ: Validated(
+                        Validated {
+                            typ: Array(
+                                Array(
+                                    Validated(
+                                        Validated {
+                                            typ: Basic(
+                                                String,
+                                            ),
+                                            expr: Rule(
+                                                Is(
+                                                    Email,
+                                                ),
+                                            ),
+                                        },
+                                    ),
+                                ),
+                            ),
+                            expr: Rule(
+                                MaxLen(
+                                    10,
+                                ),
+                            ),
+                        },
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+}
diff --git a/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@wirespec.ts.snap b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@wirespec.ts.snap
new file mode 100644
index 0000000000..850a3d0271
--- /dev/null
+++ b/tsparser/src/parser/types/snapshots/encore_tsparser__parser__types__tests__resolve_types@wirespec.ts.snap
@@ -0,0 +1,148 @@
+---
+source: tsparser/src/parser/types/tests.rs
+expression: result
+input_file: tsparser/src/parser/types/testdata/wirespec.ts
+---
+{
+    "Foo": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "a",
+                    ),
+                    optional: false,
+                    typ: Custom(
+                        WireSpec(
+                            WireSpec {
+                                location: Query,
+                                underlying: Basic(
+                                    Number,
+                                ),
+                                name_override: None,
+                            },
+                        ),
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "b",
+                    ),
+                    optional: false,
+                    typ: Validated(
+                        Validated {
+                            typ: Custom(
+                                WireSpec(
+                                    WireSpec {
+                                        location: Query,
+                                        underlying: Basic(
+                                            Number,
+                                        ),
+                                        name_override: None,
+                                    },
+                                ),
+                            ),
+                            expr: Rule(
+                                MaxVal(
+                                    N(
+                                        10.0,
+                                    ),
+                                ),
+                            ),
+                        },
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "c",
+                    ),
+                    optional: false,
+                    typ: Validated(
+                        Validated {
+                            typ: Custom(
+                                WireSpec(
+                                    WireSpec {
+                                        location: Query,
+                                        underlying: Basic(
+                                            String,
+                                        ),
+                                        name_override: None,
+                                    },
+                                ),
+                            ),
+                            expr: Rule(
+                                MinLen(
+                                    3,
+                                ),
+                            ),
+                        },
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "d",
+                    ),
+                    optional: false,
+                    typ: Validated(
+                        Validated {
+                            typ: Custom(
+                                WireSpec(
+                                    WireSpec {
+                                        location: Header,
+                                        underlying: Basic(
+                                            String,
+                                        ),
+                                        name_override: Some(
+                                            "X-Header",
+                                        ),
+                                    },
+                                ),
+                            ),
+                            expr: Rule(
+                                MinLen(
+                                    3,
+                                ),
+                            ),
+                        },
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+    "ResponseWithStatus": Interface(
+        Interface {
+            fields: [
+                InterfaceField {
+                    name: String(
+                        "data",
+                    ),
+                    optional: false,
+                    typ: Basic(
+                        String,
+                    ),
+                },
+                InterfaceField {
+                    name: String(
+                        "status",
+                    ),
+                    optional: false,
+                    typ: Custom(
+                        WireSpec(
+                            WireSpec {
+                                location: HttpStatus,
+                                underlying: Basic(
+                                    Number,
+                                ),
+                                name_override: None,
+                            },
+                        ),
+                    ),
+                },
+            ],
+            index: None,
+            call: None,
+        },
+    ),
+}
diff --git a/tsparser/src/parser/types/testdata/basic.ts b/tsparser/src/parser/types/testdata/basic.ts
new file mode 100644
index 0000000000..36f9050f16
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/basic.ts
@@ -0,0 +1,43 @@
+// Basic interface
+export interface Interface {
+  foo: string;
+  bar: number;
+  optional?: boolean;
+}
+
+// Utility types
+export type Exclude1 = Exclude<keyof Interface, "foo">;
+export type Pick1 = Pick<Interface, "foo">;
+export type Pick2 = Pick<Interface, "foo" | "optional">;
+export type Omit1 = Omit<Interface, "foo">;
+export type Omit2 = Omit<Interface, "foo" | "bar">;
+
+export type Partial1 = Partial<Interface>;
+
+export type Optional<T, K extends keyof T> = Omit<T, K> & Partial<Pick<T, K>>;
+export type Optional1 = Optional<Interface, "foo">;
+
+// Index signatures
+export type Index = { [key: string]: boolean | number };
+
+// Intersections
+export type Intersect1 = { foo: string } & { bar: number };
+export type Intersect2 = { foo: string } & { foo: "literal" };
+export type Intersect3 = { foo: string } & { foo: number };
+export type Intersect4 = { foo?: "optional" } & { foo: string };
+export type Intersect5 = { a: string; b: string; c: string } & {
+  a: any;
+  b: unknown;
+  c: never;
+};
+
+// Enums
+export enum Enum1 {
+  A,
+  B,
+  C,
+  D = "foo",
+  E = 5,
+  F
+}
+export type EnumFields = keyof typeof Enum1;
diff --git a/tsparser/src/parser/types/testdata/export_default.ts b/tsparser/src/parser/types/testdata/export_default.ts
new file mode 100644
index 0000000000..efaae2af72
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/export_default.ts
@@ -0,0 +1,3 @@
+export default interface foo {
+  name: string;
+}
diff --git a/tsparser/src/parser/types/testdata/extends.ts b/tsparser/src/parser/types/testdata/extends.ts
new file mode 100644
index 0000000000..86a21dbd35
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/extends.ts
@@ -0,0 +1,23 @@
+export interface Foo {
+  foo: string | number | null;
+  bar: number;
+  optional?: boolean;
+}
+
+export interface Bar extends Foo {
+  foo: string | null; // now never a number
+  optional: boolean; // now required
+  moo: string;
+}
+
+export interface Generic<T> {
+  foo: T | null;
+}
+
+export interface ExtendGeneric extends Generic<string | number> {
+  bar: string;
+}
+
+export interface MergeGeneric extends Generic<number> {
+  foo: 5 | null;
+}
diff --git a/tsparser/src/parser/types/testdata/generic.ts b/tsparser/src/parser/types/testdata/generic.ts
new file mode 100644
index 0000000000..03aa7ca7aa
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/generic.ts
@@ -0,0 +1,42 @@
+// Basic interface with generic param
+export interface Interface<T> {
+  foo: T;
+}
+
+// Basic interface with generic param with default type
+export interface InterfaceDefault<T = string> {
+  foo: T;
+}
+
+// Interface with multiple generic param with default type
+export interface InterfaceDefaultMulti<
+  A,
+  B,
+  C,
+  D = string,
+  E = number,
+  F = boolean
+> {
+  foo: A;
+  bar: B;
+  baz: C;
+  qux: D;
+  quux: E;
+  corge: F;
+}
+
+export type X = Interface<string>;
+export type Y = InterfaceDefault;
+export type Z = InterfaceDefault<boolean>;
+
+export type M1 = InterfaceDefaultMulti<object, undefined, null>;
+export type M2 = InterfaceDefaultMulti<object, undefined, null, bigint>;
+export type M3 = InterfaceDefaultMulti<object, undefined, null, bigint, false>;
+export type M4 = InterfaceDefaultMulti<
+  object,
+  undefined,
+  null,
+  bigint,
+  false,
+  "literal"
+>;
diff --git a/tsparser/src/parser/types/testdata/generics.ts b/tsparser/src/parser/types/testdata/generics.ts
new file mode 100644
index 0000000000..cc7dd09481
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/generics.ts
@@ -0,0 +1,20 @@
+export type Generic1<T> = {
+  cond: T extends string ? "literal" : number;
+}
+
+export type Generic2<T> = {
+  value: T;
+  cond: T extends string ? "literal" : number;
+}
+
+export type Concrete1 = {
+  one: Generic1<string>;
+  two: Generic1<"test">;
+  three: Generic2<null>;
+  four: Generic2<Generic1<boolean>>;
+  five: GenericIface<Generic1<boolean>>;
+}
+
+export interface GenericIface<T> {
+  foo: T;
+}
diff --git a/tsparser/src/parser/types/testdata/infer.txt b/tsparser/src/parser/types/testdata/infer.txt
new file mode 100644
index 0000000000..d274981a7d
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/infer.txt
@@ -0,0 +1,5 @@
+export type Iface<T> = T extends { X: infer A } ? A : never;
+
+export type Infer1 = Iface<{ X: string }>; // string
+export type Infer2 = Iface<{ Y: string }>; // never
+export type Infer3 = { X: string } extends { X: infer A } ? A : never; // string
diff --git a/tsparser/src/parser/types/testdata/keyofenum.ts b/tsparser/src/parser/types/testdata/keyofenum.ts
new file mode 100644
index 0000000000..d3401bed2c
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/keyofenum.ts
@@ -0,0 +1,9 @@
+export type ObjectValues<T> = T[keyof T];
+
+export const MY_ENUM = {
+  VARIANT_1: "VARIANT_1",
+  VARIANT_2: "VARIANT_2",
+  VARIANT_3: "VARIANT_3"
+} as const;
+
+export type MyEnum = ObjectValues<typeof MY_ENUM>;
diff --git a/tsparser/src/parser/types/testdata/qualified_name.ts b/tsparser/src/parser/types/testdata/qualified_name.ts
new file mode 100644
index 0000000000..9167042a96
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/qualified_name.ts
@@ -0,0 +1,11 @@
+namespace Foo {
+  export type Bar = string;
+
+  export namespace Nested {
+    export type Baz = number;
+  }
+};
+
+
+export type T1 = Foo.Bar;
+export type T2 = Foo.Nested.Baz;
diff --git a/tsparser/src/parser/types/testdata/reexport_single.txt b/tsparser/src/parser/types/testdata/reexport_single.txt
new file mode 100644
index 0000000000..7525e183db
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/reexport_single.txt
@@ -0,0 +1,6 @@
+export { foo } from "./foo";
+
+-- foo.ts --
+export interface foo {
+  bar: string;
+}
diff --git a/tsparser/src/parser/types/testdata/reexport_wildcard.txt b/tsparser/src/parser/types/testdata/reexport_wildcard.txt
new file mode 100644
index 0000000000..8a7fd1c8ec
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/reexport_wildcard.txt
@@ -0,0 +1,10 @@
+export { foo } from "./foo";
+
+-- foo.ts --
+export * from "./bar";
+
+-- bar.ts --
+export const foo = "foo";
+export interface bar {
+    num: number;
+}
diff --git a/tsparser/src/parser/types/testdata/validation.ts b/tsparser/src/parser/types/testdata/validation.ts
new file mode 100644
index 0000000000..edbd2f6879
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/validation.ts
@@ -0,0 +1,15 @@
+import { Min, Max, MinLen, MaxLen, IsURL, IsEmail } from "encore.dev/validate";
+
+export interface Params {
+  // A number between 3 and 1000 (inclusive).
+  foo: number & (Min<3> & Max<1000>);
+
+  // A string between 5 and 20 characters long.
+  bar: string & (MinLen<5> & MaxLen<20>);
+
+  // A string that is either a URL or an email address.
+  urlOrEmail: string & (IsURL | IsEmail);
+
+  // An array of up to 10 email addresses.
+  emails: Array<string & IsEmail> & MaxLen<10>;
+}
diff --git a/tsparser/src/parser/types/testdata/wirespec.ts b/tsparser/src/parser/types/testdata/wirespec.ts
new file mode 100644
index 0000000000..5d533a935e
--- /dev/null
+++ b/tsparser/src/parser/types/testdata/wirespec.ts
@@ -0,0 +1,14 @@
+import { Query, Header, HttpStatus } from "encore.dev/api";
+import { MinLen, Max } from "encore.dev/validate";
+
+export interface Foo {
+  a: Query<number>;
+  b: Query<number> & Max<10>;
+  c: Query<string> & MinLen<3>;
+  d: Header<"X-Header"> & MinLen<3>;
+}
+
+export interface ResponseWithStatus {
+  data: string;
+  status: HttpStatus;
+}
diff --git a/tsparser/src/parser/types/tests.rs b/tsparser/src/parser/types/tests.rs
new file mode 100644
index 0000000000..ffe05bc7f0
--- /dev/null
+++ b/tsparser/src/parser/types/tests.rs
@@ -0,0 +1,107 @@
+use super::*;
+use std::fs;
+use std::rc::Rc;
+
+use crate::parser::parser::ParseContext;
+use crate::parser::types::type_resolve::Ctx;
+use crate::parser::FilePath;
+use crate::testutil::testresolve::TestResolver;
+use crate::testutil::JS_RUNTIME_PATH;
+use indexmap::IndexMap;
+use insta::{assert_debug_snapshot, glob};
+use itertools::Itertools;
+use object::Reexport;
+use swc_common::errors::{Handler, HANDLER};
+use swc_common::{Globals, SourceMap, GLOBALS};
+use tempdir::TempDir;
+
+#[test]
+fn resolve_types() {
+    // tracing_subscriber::fmt()
+    //     .with_span_events(FmtSpan::ACTIVE)
+    //     .init();
+    env_logger::init();
+    glob!("testdata/*", |path| {
+        let globals = Globals::new();
+        let errs = Rc::new(Handler::with_tty_emitter(
+            swc_common::errors::ColorConfig::Auto,
+            true,
+            false,
+            None,
+        ));
+
+        GLOBALS.set(&globals, || {
+            HANDLER.set(&errs, || {
+                let input = fs::read_to_string(path).unwrap();
+                let ar = txtar::from_str(&input);
+                let tmp_dir = TempDir::new("tsparser-test").unwrap();
+                ar.materialize(&tmp_dir).unwrap();
+
+                let resolver =
+                    Box::new(TestResolver::new(tmp_dir.path().to_path_buf(), ar.clone()));
+                let cm: Rc<SourceMap> = Default::default();
+
+                let pc = ParseContext::with_resolver(
+                    tmp_dir.path().to_path_buf(),
+                    Some(JS_RUNTIME_PATH.clone()),
+                    resolver,
+                    cm,
+                    errs.clone(),
+                )
+                .unwrap();
+
+                let _mods = pc.loader.load_archive(tmp_dir.path(), &ar).unwrap();
+
+                let file_name = FilePath::Real(tmp_dir.path().join("test.ts"));
+                let module = pc.loader.inject_file(file_name, &ar.comment).unwrap();
+
+                let resolve = ResolveState::new(pc.loader.clone());
+                let module = resolve.get_or_init_module(module);
+                let ctx = Ctx::new(&resolve, module.base.id);
+
+                let mut result = module
+                    .data
+                    .named_exports
+                    .iter()
+                    .sorted_by(|a, b| a.1.range.cmp(&b.1.range))
+                    .map(|(name, obj)| {
+                        let typ = ctx.obj_type(obj);
+                        let typ = ctx.underlying(&typ).into_owned();
+                        (name, typ)
+                    })
+                    .collect::<IndexMap<_, _>>();
+
+                let default_key = "default".to_string();
+                if let Some(default_export) = module.data.default_export.as_ref() {
+                    let typ = ctx.obj_type(default_export);
+                    let typ = ctx.underlying(&typ).into_owned();
+                    result.insert(&default_key, typ);
+                }
+
+                for re in &module.data.reexports {
+                    match re {
+                        Reexport::All { .. } => {}
+                        Reexport::List { items, .. } => {
+                            for it in items {
+                                let export_name = it.renamed.as_ref().unwrap_or(&it.orig_name);
+                                let obj = module
+                                    .data
+                                    .get_named_export(
+                                        &resolve,
+                                        &module.base.swc_file_path,
+                                        export_name,
+                                    )
+                                    .unwrap();
+                                let typ = ctx.obj_type(&obj);
+                                let typ = ctx.underlying(&typ).into_owned();
+                                result.insert(export_name, typ);
+                            }
+                        }
+                    }
+                }
+
+                assert_debug_snapshot!(result);
+            })
+        })
+    });
+}
diff --git a/tsparser/src/parser/types/typ.rs b/tsparser/src/parser/types/typ.rs
new file mode 100644
index 0000000000..d3ef0c5215
--- /dev/null
+++ b/tsparser/src/parser/types/typ.rs
@@ -0,0 +1,1343 @@
+use crate::parser::types::type_resolve::Ctx;
+use crate::parser::types::{object, validation, Object, ResolveState};
+use crate::parser::Range;
+use indexmap::IndexMap;
+use itertools::Itertools;
+use serde::Serialize;
+use std::borrow::Cow;
+use std::collections::HashMap;
+use std::fmt::{Debug, Display};
+use std::hash::{Hash, Hasher};
+use std::rc::Rc;
+use swc_common::errors::HANDLER;
+
+#[derive(Debug, Clone, Hash, PartialEq, Eq)]
+pub struct TypeArgId(usize);
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub enum Type {
+    /// strings, etc
+    Basic(Basic),
+    /// T[], Array<T>
+    Array(Array),
+    /// { foo: string }
+    Interface(Interface),
+    /// a | b | c
+    Union(Union),
+    /// [string, number]
+    Tuple(Tuple),
+    /// "foo"
+    Literal(Literal),
+    /// class Foo {}
+    Class(ClassType),
+    /// enum Foo {}
+    Enum(EnumType),
+
+    /// A named type, with optional type arguments.
+    Named(Named),
+
+    /// e.g. "string?" in tuples
+    Optional(Optional),
+
+    /// "this", see https://www.typescriptlang.org/docs/handbook/advanced-types.html#polymorphic-this-types
+    This(This),
+
+    Generic(Generic),
+
+    /// A standalone validation expression.
+    Validation(validation::Expr),
+
+    /// A type with validation applied to it.
+    Validated(Validated),
+
+    // A custom type of some kind.
+    Custom(Custom),
+}
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Array(pub Box<Type>);
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Optional(pub Box<Type>);
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Tuple {
+    pub types: Vec<Type>,
+}
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Union {
+    pub types: Vec<Type>,
+}
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Validated {
+    pub typ: Box<Type>,
+    pub expr: validation::Expr,
+}
+
+#[derive(Debug, Clone, Serialize, Hash)]
+pub enum Custom {
+    /// A specification of how the type should be encoded on the wire.
+    WireSpec(WireSpec),
+    /// A Decimal type with arbitrary precision.
+    Decimal,
+}
+
+impl Custom {
+    pub fn identical(&self, other: &Custom) -> bool {
+        match (self, other) {
+            (Custom::WireSpec(a), Custom::WireSpec(b)) => a.identical(b),
+            (Custom::Decimal, Custom::Decimal) => true,
+            _ => false,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, Hash)]
+pub struct WireSpec {
+    /// What location in the request should be used for this field.
+    pub location: WireLocation,
+
+    /// The underlying type this is.
+    pub underlying: Box<Type>,
+
+    /// Whether this specifies a name override.
+    pub name_override: Option<String>,
+}
+
+#[derive(Debug, Clone, Serialize, Hash, PartialEq, Eq)]
+pub enum WireLocation {
+    Query,
+    Header,
+    PubSubAttr,
+    Cookie,
+    HttpStatus,
+}
+
+impl WireSpec {
+    pub fn identical(&self, other: &WireSpec) -> bool {
+        self.location == other.location
+            && self.name_override == other.name_override
+            && self.underlying.identical(&other.underlying)
+    }
+}
+
+impl Type {
+    pub fn is_void(&self) -> bool {
+        matches!(self, Type::Basic(Basic::Void))
+    }
+}
+
+impl Type {
+    pub fn identical(&self, other: &Type) -> bool {
+        match (self, other) {
+            (Type::Basic(a), Type::Basic(b)) => a == b,
+            (Type::Array(a), Type::Array(b)) => a.0.identical(&b.0),
+            (Type::Interface(a), Type::Interface(b)) => a.identical(b),
+            (Type::Union(a), Type::Union(b)) => {
+                a.types.iter().zip(&b.types).all(|(a, b)| a.identical(b))
+            }
+            (Type::Tuple(a), Type::Tuple(b)) => {
+                a.types.iter().zip(&b.types).all(|(a, b)| a.identical(b))
+            }
+            (Type::Literal(a), Type::Literal(b)) => a == b,
+            (Type::Class(a), Type::Class(b)) => a.identical(b),
+            (Type::Named(a), Type::Named(b)) => a.identical(b),
+            (Type::Optional(a), Type::Optional(b)) => a.0.identical(&b.0),
+            (Type::This(This), Type::This(This)) => true,
+            (Type::Generic(a), Type::Generic(b)) => a.identical(b),
+            (Type::Enum(a), Type::Enum(b)) => a.identical(b),
+            (Type::Custom(a), Type::Custom(b)) => a.identical(b),
+            _ => false,
+        }
+    }
+
+    /// Returns a union type that merges `self` and `other`, if possible.
+    /// If the types cannot be merged, it returns None.
+    #[tracing::instrument(ret, level = "trace")]
+    pub(super) fn union_merge(&self, other: &Type) -> Option<Type> {
+        match (self, other) {
+            // 'any' and any type unify to 'any'.
+            (Type::Basic(Basic::Any), _) | (_, Type::Basic(Basic::Any)) => {
+                Some(Type::Basic(Basic::Any))
+            }
+
+            // Type literals unify with their basic type
+            (Type::Basic(basic), Type::Literal(lit)) | (Type::Literal(lit), Type::Basic(basic))
+                if *basic == lit.basic() =>
+            {
+                Some(Type::Basic(*basic))
+            }
+
+            // Unify validation.
+            (Type::Validation(a), Type::Validation(b)) => {
+                Some(Type::Validation(a.clone().or(b.clone())))
+            }
+            (Type::Validated(validated), Type::Validation(expr))
+            | (Type::Validation(expr), Type::Validated(validated)) => {
+                Some(Type::Validated(Validated {
+                    typ: validated.typ.to_owned(),
+                    expr: validated.expr.clone().or(expr.clone()),
+                }))
+            }
+
+            // TODO more rules?
+
+            // Identical types unify.
+            (this, other) if this.identical(other) => Some(this.clone()),
+
+            // Otherwise no unification is possible.
+            (_, _) => None,
+        }
+    }
+
+    pub(super) fn simplify_or_union(self, other: Type) -> Type {
+        match self.union_merge(&other) {
+            Some(typ) => typ,
+            None => Type::Union(Union {
+                types: vec![self, other],
+            }),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize)]
+pub enum Basic {
+    Any,
+    String,
+    Boolean,
+    Number,
+    Object,
+    BigInt,
+    Date,
+    Symbol,
+    Undefined,
+    Null,
+    Void,
+    Unknown,
+    Never,
+}
+
+impl Display for Basic {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let s: &'static str = match self {
+            Basic::Any => "any",
+            Basic::String => "string",
+            Basic::Boolean => "boolean",
+            Basic::Number => "number",
+            Basic::Object => "object",
+            Basic::BigInt => "bigint",
+            Basic::Date => "Date",
+            Basic::Symbol => "symbol",
+            Basic::Undefined => "undefined",
+            Basic::Null => "null",
+            Basic::Void => "void",
+            Basic::Unknown => "unknown",
+            Basic::Never => "never",
+        };
+        f.write_str(s)
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub enum Literal {
+    String(String),
+    Boolean(bool),
+    Number(f64),
+    BigInt(String),
+}
+
+impl Literal {
+    pub fn basic(&self) -> Basic {
+        match self {
+            Literal::String(_) => Basic::String,
+            Literal::Boolean(_) => Basic::Boolean,
+            Literal::Number(_) => Basic::Number,
+            Literal::BigInt(_) => Basic::BigInt,
+        }
+    }
+}
+
+impl PartialEq for Literal {
+    fn eq(&self, other: &Self) -> bool {
+        match (self, other) {
+            (Literal::String(a), Literal::String(b)) => a == b,
+            (Literal::Boolean(a), Literal::Boolean(b)) => a == b,
+            (Literal::Number(a), Literal::Number(b)) => a == b,
+            (Literal::BigInt(a), Literal::BigInt(b)) => a == b,
+            _ => false,
+        }
+    }
+}
+
+// Safe because the float literals don't include non-Eq values like NaN since they're literals.
+impl Eq for Literal {}
+
+impl Hash for Literal {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        fn integer_decode(val: f64) -> (u64, i16, i8) {
+            let bits: u64 = val.to_bits();
+            let sign: i8 = if bits >> 63 == 0 { 1 } else { -1 };
+            let mut exponent: i16 = ((bits >> 52) & 0x7ff) as i16;
+            let mantissa = if exponent == 0 {
+                (bits & 0xfffffffffffff) << 1
+            } else {
+                (bits & 0xfffffffffffff) | 0x10000000000000
+            };
+
+            exponent -= 1023 + 52;
+            (mantissa, exponent, sign)
+        }
+
+        match self {
+            Literal::String(s) => s.hash(state),
+            Literal::Boolean(b) => b.hash(state),
+            Literal::Number(n) => {
+                self.hash(state);
+                integer_decode(*n).hash(state);
+            }
+            Literal::BigInt(s) => s.hash(state),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Interface {
+    /// Explicitly defined fields.
+    pub fields: Vec<InterfaceField>,
+
+    /// Set for index signature types, like `[key: string]: number`.
+    pub index: Option<(Box<Type>, Box<Type>)>,
+
+    /// Callable signature, like `(a: number): string`.
+    /// The first tuple element is the args, and the second is the returns.
+    pub call: Option<(Vec<Type>, Vec<Type>)>,
+}
+
+impl Interface {
+    pub fn identical(&self, other: &Interface) -> bool {
+        if self.fields.len() != other.fields.len() {
+            return false;
+        }
+        if self.index.is_some() != other.index.is_some() {
+            return false;
+        }
+
+        // Collect the fields by name.
+        #[allow(clippy::mutable_key_type)]
+        let by_name = self
+            .fields
+            .iter()
+            .map(|f| (f.name.clone(), f))
+            .collect::<HashMap<_, _>>();
+
+        // Check that all fields in `other` are in `self`.
+        for field in &other.fields {
+            if let Some(self_field) = by_name.get(&field.name) {
+                if !self_field.identical(field) {
+                    return false;
+                }
+            } else {
+                return false;
+            }
+        }
+
+        // Compare index signatures.
+        if let (Some((self_key, self_value)), Some((other_key, other_value))) =
+            (&self.index, &other.index)
+        {
+            if !self_key.identical(other_key) || !self_value.identical(other_value) {
+                return false;
+            }
+        }
+
+        true
+    }
+}
+
+#[derive(Debug, Clone, Hash, Serialize, Eq, PartialEq)]
+pub enum FieldName {
+    String(String),
+    Symbol(Rc<Object>),
+}
+
+impl FieldName {
+    pub fn eq_str(&self, str: &str) -> bool {
+        match self {
+            FieldName::String(s) => s == str,
+            FieldName::Symbol(_) => false,
+        }
+    }
+}
+
+#[derive(Clone, Hash, Serialize)]
+pub struct InterfaceField {
+    pub range: Range,
+    pub name: FieldName,
+    pub optional: bool,
+    pub typ: Type,
+}
+
+impl Debug for InterfaceField {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("InterfaceField")
+            .field("name", &self.name)
+            .field("optional", &self.optional)
+            .field("typ", &self.typ)
+            .finish()
+    }
+}
+
+impl InterfaceField {
+    pub fn identical(&self, other: &InterfaceField) -> bool {
+        self.name == other.name && self.typ.identical(&other.typ) && self.optional == other.optional
+    }
+}
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct ClassType {
+    pub methods: Vec<String>,
+    // TODO: include class fields here
+}
+
+impl ClassType {
+    pub fn identical(&self, _other: &ClassType) -> bool {
+        todo!()
+    }
+}
+
+#[derive(Debug, Clone, Hash, Serialize, Eq, PartialEq)]
+pub struct EnumType {
+    pub members: Vec<EnumMember>,
+}
+
+#[derive(Debug, Clone, Hash, Serialize, Eq, PartialEq)]
+pub struct EnumMember {
+    pub name: String,
+    pub value: EnumValue,
+}
+
+#[derive(Debug, Clone, Hash, Serialize, Eq, PartialEq)]
+pub enum EnumValue {
+    String(String),
+    Number(i64),
+}
+
+impl EnumValue {
+    pub fn to_literal(self) -> Literal {
+        match self {
+            EnumValue::String(s) => Literal::String(s),
+            EnumValue::Number(n) => Literal::Number(n as f64),
+        }
+    }
+
+    pub fn to_type(self) -> Type {
+        Type::Literal(self.to_literal())
+    }
+}
+
+impl EnumType {
+    pub fn identical(&self, other: &EnumType) -> bool {
+        if self.members.len() != other.members.len() {
+            return false;
+        }
+        *self == *other
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct Named {
+    pub obj: Rc<object::Object>,
+    pub type_arguments: Vec<Type>,
+}
+
+impl Hash for Named {
+    fn hash<H: Hasher>(&self, state: &mut H) {
+        self.obj.id.hash(state);
+        self.type_arguments.hash(state);
+    }
+}
+
+impl Named {
+    pub fn new(obj: Rc<object::Object>, type_arguments: Vec<Type>) -> Self {
+        Self {
+            obj,
+            type_arguments,
+        }
+    }
+
+    pub fn identical(&self, other: &Named) -> bool {
+        if self.obj.id != other.obj.id || self.type_arguments.len() != other.type_arguments.len() {
+            return false;
+        }
+
+        for (a, b) in self.type_arguments.iter().zip(&other.type_arguments) {
+            if !a.identical(b) {
+                return false;
+            }
+        }
+        true
+    }
+
+    pub fn underlying(&self, state: &ResolveState) -> Type {
+        let ctx = Ctx::new(state, self.obj.module_id);
+        ctx.underlying_named(self)
+    }
+}
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub enum Generic {
+    /// A reference to a generic type parameter.
+    TypeParam(TypeParam),
+
+    /// An index lookup, like `T[U]`, where at least one of the types is a generic.
+    Index(Index),
+
+    /// A mapped type.
+    Mapped(Mapped),
+
+    /// A reference to the 'key' type when evaluating a mapped type.
+    MappedKeyType(MappedKeyType),
+
+    Keyof(Keyof),
+    Conditional(Conditional),
+    // A reference to the 'as' type when evaluating a mapped type.
+    // MappedAsType,
+
+    // An intersection type.
+    Intersection(Intersection),
+
+    /// A reference to an inferred type parameter,
+    /// referencing its index in infer_type_params.
+    Inferred(Inferred),
+}
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Index {
+    pub source: Box<Type>,
+    pub index: Box<Type>,
+}
+
+/// A reference to an inferred type parameter,
+/// referencing its index in infer_type_params.
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Inferred(pub usize);
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Keyof(pub Box<Type>);
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct This;
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct MappedKeyType;
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct TypeParam {
+    // The index of the type parameter in the current scope.
+    pub idx: usize,
+
+    // Any additional constraint on the type parameter.
+    // If provided, it can be assumed that the type parameter is assignable to this type.
+    pub constraint: Option<Box<Type>>,
+}
+
+impl TypeParam {
+    pub fn identical(&self, other: &TypeParam) -> bool {
+        self.idx == other.idx
+            && match (self.constraint.as_ref(), other.constraint.as_ref()) {
+                (Some(a), Some(b)) => a.identical(b),
+                (None, None) => true,
+                _ => false,
+            }
+    }
+}
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Mapped {
+    /// The type being evaluated to find property names.
+    /// Must be evaluated using the property name in the evaluation context.
+    pub in_type: Box<Type>,
+
+    /// The value of each property in the mapped type.
+    /// Must be evaluated using the property name in the evaluation context.
+    pub value_type: Box<Type>,
+
+    /// Whether to force fields to be optional (Some(True)), to make them required (Some(False)),
+    /// or to keep them as-is (None).
+    pub optional: Option<bool>,
+    // Indicates a remapping of the property name.
+    // Must be evaluated using the property name in the evaluation context.
+    // pub as_type: Option<Box<Type>>,
+}
+
+impl Mapped {
+    pub fn identical(&self, other: &Mapped) -> bool {
+        self.in_type.identical(&other.in_type) && self.value_type.identical(&other.value_type)
+    }
+}
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Intersection {
+    pub x: Box<Type>,
+    pub y: Box<Type>,
+}
+
+impl Intersection {
+    pub fn identical(&self, other: &Intersection) -> bool {
+        self.x.identical(&other.x) && self.y.identical(&other.y)
+    }
+}
+
+#[derive(Debug, Clone, Hash, Serialize)]
+pub struct Conditional {
+    pub check_type: Box<Type>,
+    pub extends_type: Box<Type>,
+    pub true_type: Box<Type>,
+    pub false_type: Box<Type>,
+}
+
+impl Generic {
+    pub fn identical(&self, other: &Generic) -> bool {
+        match (self, other) {
+            (Generic::TypeParam(a), Generic::TypeParam(b)) => a.identical(b),
+            (Generic::Mapped(a), Generic::Mapped(b)) => a.identical(b),
+            _ => false,
+        }
+    }
+}
+
+impl Type {
+    pub fn iter_unions<'a>(&'a self) -> Box<dyn Iterator<Item = &'a Type> + 'a> {
+        match self {
+            Type::Union(union) => Box::new(union.types.iter().flat_map(|t| t.iter_unions())),
+            Type::Optional(tt) => Box::new(
+                tt.0.iter_unions()
+                    .chain(std::iter::once(&Type::Basic(Basic::Undefined))),
+            ),
+            Type::Validated(v) => v.typ.iter_unions(),
+            _ => Box::new(std::iter::once(self)),
+        }
+    }
+
+    pub fn into_iter_unions(self) -> Box<dyn Iterator<Item = Type>> {
+        match self {
+            Type::Union(union) => {
+                Box::new(union.types.into_iter().flat_map(|t| t.into_iter_unions()))
+            }
+            Type::Optional(tt) => Box::new(
+                tt.0.into_iter_unions()
+                    .chain(std::iter::once(Type::Basic(Basic::Undefined))),
+            ),
+            Type::Validated(v) => v.typ.into_iter_unions(),
+            _ => Box::new(std::iter::once(self)),
+        }
+    }
+}
+
+impl Type {
+    /// Reports whether `self` is assignable to `other`.
+    /// If the result is indeterminate due to an unresolved type, it reports None.
+    pub fn assignable(&self, state: &ResolveState, other: &Type) -> Option<bool> {
+        match (self, other) {
+            (_, Type::Basic(Basic::Any)) => Some(true),
+            (_, Type::Basic(Basic::Never)) => Some(false),
+            (Type::Generic(_), _) | (_, Type::Generic(_)) => None,
+
+            // Unwrap named types.
+            (Type::Named(a), b) => {
+                let a = a.underlying(state);
+                a.assignable(state, b)
+            }
+            (a, Type::Named(b)) => {
+                let b = b.underlying(state);
+                a.assignable(state, &b)
+            }
+
+            (Type::Basic(a), Type::Basic(b)) => Some(a == b),
+            (Type::Literal(a), Type::Basic(b)) => Some(matches!(
+                (a, b),
+                (_, Basic::Any)
+                    | (Literal::String(_), Basic::String)
+                    | (Literal::Boolean(_), Basic::Boolean)
+                    | (Literal::Number(_), Basic::Number)
+                    | (Literal::BigInt(_), Basic::BigInt)
+            )),
+
+            (Type::Validated(v), _) | (_, Type::Validated(v)) => v.typ.assignable(state, other),
+
+            (this, Type::Optional(other)) => {
+                if matches!(this, Type::Basic(Basic::Undefined)) {
+                    Some(true)
+                } else {
+                    this.assignable(state, &other.0)
+                }
+            }
+
+            (Type::Tuple(this), other) => match other {
+                Type::Tuple(other) => {
+                    if this.types.len() != other.types.len() {
+                        return Some(false);
+                    }
+
+                    let mut found_none = false;
+                    for (this, other) in this.types.iter().zip(&other.types) {
+                        match this.assignable(state, other) {
+                            Some(true) => {}
+                            Some(false) => return Some(false),
+                            None => found_none = true,
+                        }
+                    }
+                    if found_none {
+                        None
+                    } else {
+                        Some(true)
+                    }
+                }
+
+                Type::Array(other) => {
+                    // Ensure every element in `this` is a subtype of `other`.
+                    for this in &this.types {
+                        match this.assignable(state, &other.0) {
+                            Some(true) => {}
+                            Some(false) => return Some(false),
+                            None => return None,
+                        }
+                    }
+                    Some(true)
+                }
+                _ => Some(false),
+            },
+
+            (Type::Enum(a), other) => {
+                let this_fields: HashMap<&str, &EnumValue> =
+                    HashMap::from_iter(a.members.iter().map(|m| (m.name.as_str(), &m.value)));
+                match other {
+                    Type::Enum(other) => {
+                        // Does every field in `other` exist in `this_fields`?
+                        for mem in &other.members {
+                            if let Some(this_field) = this_fields.get(mem.name.as_str()) {
+                                if **this_field == mem.value {
+                                    continue;
+                                }
+                            }
+                            return Some(false);
+                        }
+                        Some(true)
+                    }
+
+                    Type::Interface(other) => {
+                        // Does every field in `other` exist in `iface`?
+                        let mut found_none = false;
+                        for field in &other.fields {
+                            if let FieldName::String(name) = &field.name {
+                                if let Some(this_field) = this_fields.get(name.as_str()) {
+                                    let this_typ = (*this_field).clone().to_type();
+                                    match this_typ.assignable(state, &field.typ) {
+                                        Some(true) => continue,
+                                        Some(false) => return Some(false),
+                                        None => found_none = true,
+                                    }
+                                }
+                            }
+                        }
+                        if found_none {
+                            None
+                        } else {
+                            Some(true)
+                        }
+                    }
+                    _ => Some(false),
+                }
+            }
+
+            (Type::Interface(iface), other) => {
+                #[allow(clippy::mutable_key_type)]
+                let this_fields: HashMap<&FieldName, &InterfaceField> =
+                    HashMap::from_iter(iface.fields.iter().map(|f| (&f.name, f)));
+                match other {
+                    Type::Interface(other) => {
+                        // Does every field in `other` exist in `iface`?
+                        let mut found_none = false;
+                        for field in &other.fields {
+                            if let Some(this_field) = this_fields.get(&field.name) {
+                                match this_field.typ.assignable(state, &field.typ) {
+                                    Some(true) => {}
+                                    Some(false) => return Some(false),
+                                    None => found_none = true,
+                                }
+                            } else {
+                                return Some(false);
+                            }
+                        }
+                        if found_none {
+                            None
+                        } else {
+                            Some(true)
+                        }
+                    }
+                    _ => Some(false),
+                }
+            }
+
+            (this, Type::Union(other)) => {
+                // Is every element in `this` assignable to `other`?
+                'ThisLoop: for t in this.iter_unions() {
+                    let mut found_none = false;
+                    for o in &other.types {
+                        match t.assignable(state, o) {
+                            // Found a match; check the next element in `this`.
+                            Some(true) => continue 'ThisLoop,
+
+                            // Not a match; keep going.
+                            Some(false) => {}
+                            None => found_none = true,
+                        }
+                    }
+
+                    // Couldn't find any match
+                    return if found_none { None } else { Some(false) };
+                }
+
+                // All elements passed the test.
+                Some(true)
+            }
+
+            (a, b) => Some(a.identical(b)),
+        }
+    }
+}
+
+pub enum Extends<'a> {
+    Yes(Vec<(usize, Cow<'a, Type>)>),
+    No,
+    Unknown,
+}
+
+impl Extends<'_> {
+    pub fn into_static(self) -> Extends<'static> {
+        match self {
+            Extends::Yes(v) => Extends::Yes(
+                v.into_iter()
+                    .map(|(idx, t)| (idx, Cow::Owned(t.into_owned())))
+                    .collect(),
+            ),
+            Extends::No => Extends::No,
+            Extends::Unknown => Extends::Unknown,
+        }
+    }
+}
+
+impl Type {
+    /// Reports whether `self` is assignable to `other`.
+    /// If the result is indeterminate due to an unresolved type, it reports None.
+    pub fn extends<'a>(&'a self, state: &'_ ResolveState, other: &'_ Type) -> Extends<'a> {
+        use Extends::*;
+
+        fn empty_yes_or_no(val: bool) -> Extends<'static> {
+            if val {
+                Yes(vec![])
+            } else {
+                No
+            }
+        }
+
+        match (self, other) {
+            (this, Type::Generic(Generic::Inferred(inferred))) => {
+                Yes(vec![(inferred.0, Cow::Borrowed(this))])
+            }
+
+            (_, Type::Basic(Basic::Any)) => Yes(vec![]),
+            (_, Type::Basic(Basic::Never)) => No,
+            (Type::Generic(_), _) | (_, Type::Generic(_)) => Unknown,
+
+            // Unwrap named types.
+            (Type::Named(a), b) => {
+                let a = a.underlying(state);
+                a.extends(state, b).into_static()
+            }
+            (a, Type::Named(b)) => {
+                let b = b.underlying(state);
+                a.extends(state, &b)
+            }
+
+            (Type::Basic(a), Type::Basic(b)) => empty_yes_or_no(a == b),
+            (Type::Literal(a), Type::Basic(b)) => empty_yes_or_no(matches!(
+                (a, b),
+                (_, Basic::Any)
+                    | (Literal::String(_), Basic::String)
+                    | (Literal::Boolean(_), Basic::Boolean)
+                    | (Literal::Number(_), Basic::Number)
+                    | (Literal::BigInt(_), Basic::BigInt)
+            )),
+
+            (Type::Validated(v), _) | (_, Type::Validated(v)) => {
+                v.typ.extends(state, other).into_static()
+            }
+
+            (this, Type::Optional(other)) => {
+                if matches!(this, Type::Basic(Basic::Undefined)) {
+                    Yes(vec![])
+                } else {
+                    this.extends(state, &other.0)
+                }
+            }
+
+            (Type::Tuple(this), other) => match other {
+                Type::Tuple(other) => {
+                    if this.types.len() != other.types.len() {
+                        return No;
+                    }
+
+                    let mut found_unknown = false;
+                    let mut inferred = vec![];
+                    for (this, other) in this.types.iter().zip(&other.types) {
+                        match this.extends(state, other) {
+                            Yes(inf) => {
+                                inferred.extend(inf);
+                            }
+                            No => return No,
+                            Unknown => found_unknown = true,
+                        }
+                    }
+                    if found_unknown {
+                        Unknown
+                    } else {
+                        Yes(inferred)
+                    }
+                }
+
+                Type::Array(other) => {
+                    // Ensure every element in `this` is a subtype of `other`.
+                    let mut inferred = vec![];
+                    for this in &this.types {
+                        match this.extends(state, &other.0) {
+                            Yes(infer) => inferred.extend(infer),
+                            No => return No,
+                            Unknown => return Unknown,
+                        }
+                    }
+
+                    // Since `this` is a tuple but `other` is a single array type,
+                    // it's possible we'll have multiple inferred types for the same index.
+                    // Group them by index and turn them into a union type if necessary.
+                    inferred.sort_by_key(|(idx, _)| *idx);
+
+                    let inferred = inferred
+                        .into_iter()
+                        .chunk_by(|(idx, _)| *idx)
+                        .into_iter()
+                        .map(|(idx, types)| {
+                            let types = types.map(|(_, t)| t.into_owned()).collect();
+                            let typ = simplify_union(types);
+                            (idx, Cow::Owned(typ))
+                        })
+                        .collect();
+
+                    Yes(inferred)
+                }
+                _ => No,
+            },
+
+            (Type::Enum(a), other) => {
+                let this_fields: HashMap<&str, &EnumValue> =
+                    HashMap::from_iter(a.members.iter().map(|m| (m.name.as_str(), &m.value)));
+                match other {
+                    Type::Enum(other) => {
+                        // Does every field in `other` exist in `this_fields`?
+                        for mem in &other.members {
+                            if let Some(this_field) = this_fields.get(mem.name.as_str()) {
+                                if **this_field == mem.value {
+                                    continue;
+                                }
+                            }
+                            return No;
+                        }
+                        Yes(vec![])
+                    }
+
+                    Type::Interface(other) => {
+                        // Does every field in `other` exist in `iface`?
+                        let mut found_none = false;
+                        for field in &other.fields {
+                            if let FieldName::String(name) = &field.name {
+                                if let Some(this_field) = this_fields.get(name.as_str()) {
+                                    let this_typ = (*this_field).clone().to_type();
+                                    match this_typ.assignable(state, &field.typ) {
+                                        Some(true) => continue,
+                                        Some(false) => return No,
+                                        None => found_none = true,
+                                    }
+                                }
+                            }
+                        }
+                        if found_none {
+                            Unknown
+                        } else {
+                            Yes(vec![])
+                        }
+                    }
+                    _ => No,
+                }
+            }
+
+            (Type::Interface(iface), other) => {
+                #[allow(clippy::mutable_key_type)]
+                let this_fields: HashMap<&FieldName, &InterfaceField> =
+                    HashMap::from_iter(iface.fields.iter().map(|f| (&f.name, f)));
+                match other {
+                    Type::Interface(other) => {
+                        // Does every field in `other` exist in `iface`?
+                        let mut found_unknown = false;
+                        let mut inferred = vec![];
+                        for field in &other.fields {
+                            if let Some(this_field) = this_fields.get(&field.name) {
+                                match this_field.typ.extends(state, &field.typ) {
+                                    Yes(inf) => inferred.extend(inf),
+                                    No => return No,
+                                    Unknown => found_unknown = true,
+                                }
+                            } else {
+                                return No;
+                            }
+                        }
+                        if found_unknown {
+                            Unknown
+                        } else {
+                            Yes(inferred)
+                        }
+                    }
+                    _ => No,
+                }
+            }
+
+            (this, Type::Union(other)) => {
+                // Is every element in `this` assignable to `other`?
+                let mut found_yes = false;
+                let mut found_unknown = false;
+                let mut inferred = Vec::new();
+                for t in this.iter_unions() {
+                    for o in &other.types {
+                        match t.extends(state, o) {
+                            Yes(inf) => {
+                                found_yes = true;
+                                inferred.extend(inf);
+                            }
+                            No => {}
+                            Unknown => found_unknown = true,
+                        }
+                    }
+                }
+
+                if found_yes {
+                    Yes(inferred)
+                } else if found_unknown {
+                    Unknown
+                } else {
+                    No
+                }
+            }
+
+            (a, b) => empty_yes_or_no(a.identical(b)),
+        }
+    }
+}
+
+pub fn simplify_union(types: Vec<Type>) -> Type {
+    let mut results: Vec<Type> = Vec::with_capacity(types.len());
+
+    for typ in types {
+        // Ignore `never` in unions.
+        if matches!(typ, Type::Basic(Basic::Never)) {
+            continue;
+        }
+
+        let mut found = false;
+        for unified_typ in &mut results {
+            match unified_typ.union_merge(&typ) {
+                Some(u) => {
+                    *unified_typ = u;
+                    found = true;
+                    break;
+                }
+                None => {
+                    // No unification possible; keep going.
+                }
+            }
+        }
+
+        if !found {
+            results.push(typ);
+        }
+    }
+
+    match results.len() {
+        0 => Type::Basic(Basic::Never),
+        1 => results.remove(0),
+        _ => Type::Union(Union { types: results }),
+    }
+}
+
+/// Computes (a & b), the intersection of two types.
+#[tracing::instrument(level = "trace", skip(ctx), ret)]
+pub fn intersect<'a: 'b, 'b>(
+    ctx: &'b Ctx<'a>,
+    a: Cow<'a, Type>,
+    b: Cow<'a, Type>,
+) -> Cow<'a, Type> {
+    let union_with = |a: Cow<'_, Type>, b: Cow<'_, Type>| {
+        let result = a
+            .into_owned()
+            .into_iter_unions()
+            .filter_map(
+                |typ| match intersect(ctx, Cow::Owned(typ), b.clone()).into_owned() {
+                    Type::Basic(Basic::Never) => None,
+                    other => Some(other),
+                },
+            )
+            .collect();
+        Cow::Owned(simplify_union(result))
+    };
+    let literal = |lit: &Literal, b: &Basic| -> bool {
+        matches!(
+            (lit, b),
+            (
+                Literal::String(_),
+                Basic::String | Basic::Any | Basic::Unknown
+            ) | (
+                Literal::Boolean(_),
+                Basic::Boolean | Basic::Any | Basic::Unknown
+            ) | (
+                Literal::Number(_),
+                Basic::Number | Basic::Any | Basic::Unknown
+            ) | (
+                Literal::BigInt(_),
+                Basic::BigInt | Basic::Any | Basic::Unknown
+            )
+        )
+    };
+
+    match (a.as_ref(), b.as_ref()) {
+        // T & unknown == T
+        (Type::Basic(Basic::Unknown), _) => b,
+        (_, Type::Basic(Basic::Unknown)) => a,
+
+        // T & any == any
+        (Type::Basic(Basic::Any), _) | (_, Type::Basic(Basic::Any)) => {
+            Cow::Owned(Type::Basic(Basic::Any))
+        }
+
+        // T & never == never
+        (Type::Basic(Basic::Never), _) | (_, Type::Basic(Basic::Never)) => {
+            Cow::Owned(Type::Basic(Basic::Never))
+        }
+
+        (Type::Basic(a), Type::Basic(b)) => {
+            if a == b {
+                Cow::Owned(Type::Basic(*a))
+            } else {
+                Cow::Owned(Type::Basic(Basic::Never))
+            }
+        }
+
+        // Intersection distributes into unions.
+        (Type::Union(a), Type::Union(b)) => {
+            let mut types = Vec::with_capacity(a.types.len() * b.types.len());
+            for typ in &a.types {
+                for other in &b.types {
+                    match intersect(ctx, Cow::Borrowed(typ), Cow::Borrowed(other)).into_owned() {
+                        Type::Basic(Basic::Never) => {}
+                        other => types.push(other),
+                    }
+                }
+            }
+            Cow::Owned(simplify_union(types))
+        }
+        (Type::Union(_), _) => union_with(a, b),
+        (_, Type::Union(_)) => union_with(b, a),
+
+        (Type::Literal(x), Type::Literal(y)) if x == y => a,
+        (Type::Literal(lit), Type::Basic(x)) => {
+            if literal(lit, x) {
+                a
+            } else {
+                Cow::Owned(Type::Basic(Basic::Never))
+            }
+        }
+        (Type::Basic(x), Type::Literal(lit)) => {
+            if literal(lit, x) {
+                b
+            } else {
+                Cow::Owned(Type::Basic(Basic::Never))
+            }
+        }
+
+        (Type::Array(x), Type::Array(y)) => Cow::Owned(Type::Array(Array(Box::new(
+            intersect(
+                ctx,
+                Cow::Borrowed(x.0.as_ref()),
+                Cow::Borrowed(y.0.as_ref()),
+            )
+            .into_owned(),
+        )))),
+        (Type::Array(x), Type::Tuple(y)) | (Type::Tuple(y), Type::Array(x)) => {
+            Cow::Owned(Type::Array(Array(Box::new(if y.types.is_empty() {
+                Type::Basic(Basic::Never)
+            } else {
+                // Inspect the first element of the tuple for intersection.
+                // It's not completely correct but close enough for now.
+                intersect(ctx, Cow::Borrowed(x.0.as_ref()), Cow::Borrowed(&y.types[0])).into_owned()
+            }))))
+        }
+
+        (Type::Tuple(x), Type::Tuple(y)) => {
+            let mut types = Vec::with_capacity(x.types.len().min(y.types.len()));
+            for (a, b) in x.types.iter().zip(y.types.iter()) {
+                types.push(intersect(ctx, Cow::Borrowed(a), Cow::Borrowed(b)).into_owned());
+            }
+            Cow::Owned(Type::Tuple(Tuple { types }))
+        }
+
+        (Type::Optional(x), Type::Optional(y)) => Cow::Owned(Type::Optional(Optional(Box::new(
+            intersect(ctx, Cow::Borrowed(&x.0), Cow::Borrowed(&y.0)).into_owned(),
+        )))),
+        // Treat optional as "T | undefined".
+        (Type::Optional(x), y) | (y, Type::Optional(x)) => {
+            union_with(Cow::Borrowed(&x.0), Cow::Borrowed(y))
+        }
+
+        (Type::This(This), Type::This(This)) => Cow::Owned(Type::This(This)),
+
+        // Combine validation expressions into a validated type.
+        (Type::Validated(a), Type::Validation(b)) => Cow::Owned(Type::Validated(Validated {
+            typ: a.typ.clone(),
+            expr: a.expr.clone().and(b.clone()),
+        })),
+        (Type::Validation(a), Type::Validated(b)) => Cow::Owned(Type::Validated(Validated {
+            typ: b.typ.clone(),
+            expr: a.clone().and(b.expr.clone()),
+        })),
+
+        // Merge validation expressions together.
+        (Type::Validation(a), Type::Validation(b)) => {
+            Cow::Owned(Type::Validation(a.clone().and(b.clone())))
+        }
+        (_, Type::Validation(expr)) => Cow::Owned(Type::Validated(Validated {
+            typ: Box::new(a.into_owned()),
+            expr: expr.clone(),
+        })),
+        (Type::Validation(expr), _) => Cow::Owned(Type::Validated(Validated {
+            typ: Box::new(b.into_owned()),
+            expr: expr.clone(),
+        })),
+
+        (Type::Generic(_), _) | (_, Type::Generic(_)) => {
+            Cow::Owned(Type::Generic(Generic::Intersection(Intersection {
+                x: Box::new(a.into_owned()),
+                y: Box::new(b.into_owned()),
+            })))
+        }
+
+        (Type::Class(_), Type::Class(_)) => {
+            Cow::Owned(Type::Generic(Generic::Intersection(Intersection {
+                x: Box::new(a.into_owned()),
+                y: Box::new(b.into_owned()),
+            })))
+        }
+
+        (Type::Named(x), _) => {
+            let x = ctx.underlying_named(x);
+            intersect(ctx, Cow::Owned(x), b)
+        }
+        (_, Type::Named(y)) => {
+            let y = ctx.underlying_named(y);
+            intersect(ctx, a, Cow::Owned(y))
+        }
+
+        (Type::Interface(_), Type::Interface(_)) => {
+            let Type::Interface(x) = a.into_owned() else {
+                unreachable!();
+            };
+            let Type::Interface(y) = b.into_owned() else {
+                unreachable!();
+            };
+
+            let fields = {
+                let mut y_fields = y
+                    .fields
+                    .into_iter()
+                    .map(|f| (f.name.clone(), Some(f)))
+                    .collect::<IndexMap<_, _>>();
+
+                // Fields are added together.
+                // If they have the same name, the type is the intersection.
+                let mut result = Vec::with_capacity(x.fields.len() + y_fields.len());
+
+                for mut field in x.fields {
+                    if let Some(other) = y_fields.get_mut(&field.name) {
+                        // Intersect the type.
+                        let other = other.take().expect("field name should not appear twice");
+                        field.typ = intersect(ctx, Cow::Owned(field.typ), Cow::Owned(other.typ))
+                            .into_owned();
+                        field.optional = field.optional && other.optional;
+                    }
+                    result.push(field);
+                }
+
+                // Add any remaining fields from `y`.
+                for (_, other) in y_fields {
+                    if let Some(other) = other {
+                        result.push(other);
+                    }
+                }
+                result
+            };
+
+            // If we have any fields, ignore the index signature.
+            let index = if fields.is_empty() {
+                None
+            } else {
+                match (x.index, y.index) {
+                    (Some((x_key, x_value)), Some((y_key, y_value))) => {
+                        let key =
+                            intersect(ctx, Cow::Owned(*x_key), Cow::Owned(*y_key)).into_owned();
+                        let value =
+                            intersect(ctx, Cow::Owned(*x_value), Cow::Owned(*y_value)).into_owned();
+                        Some((Box::new(key), Box::new(value)))
+                    }
+                    (Some((k, v)), None) | (None, Some((k, v))) => Some((k, v)),
+                    (None, None) => None,
+                }
+            };
+
+            if x.call.is_some() || y.call.is_some() {
+                HANDLER.with(|handler| {
+                    handler.err("intersection of call signature types not yet supported");
+                })
+            }
+
+            Cow::Owned(Type::Interface(Interface {
+                fields,
+                index,
+                call: None,
+            }))
+        }
+
+        (Type::Interface(_), _) | (_, Type::Interface(_)) => {
+            Cow::Owned(Type::Generic(Generic::Intersection(Intersection {
+                x: Box::new(a.into_owned()),
+                y: Box::new(b.into_owned()),
+            })))
+        }
+
+        (_, _) => Cow::Owned(Type::Basic(Basic::Never)),
+    }
+}
+
+pub fn unwrap_validated(typ: &Type) -> (&Type, Option<&validation::Expr>) {
+    match typ {
+        Type::Validated(validated) => (&validated.typ, Some(&validated.expr)),
+        _ => (typ, None),
+    }
+}
diff --git a/tsparser/src/parser/types/type_resolve.rs b/tsparser/src/parser/types/type_resolve.rs
new file mode 100644
index 0000000000..8f4a7da009
--- /dev/null
+++ b/tsparser/src/parser/types/type_resolve.rs
@@ -0,0 +1,2242 @@
+use std::borrow::Cow;
+use std::borrow::Cow::{Borrowed, Owned};
+use std::cell::RefCell;
+use std::fmt::Debug;
+use std::ops::Deref;
+use std::rc::Rc;
+
+use litparser::Sp;
+use swc_common::errors::HANDLER;
+use swc_common::sync::Lrc;
+use swc_common::{BytePos, Span, Spanned};
+use swc_ecma_ast::{self as ast, TsTypeParam};
+
+use crate::parser::module_loader::ModuleId;
+use crate::parser::types::object::{CheckState, ObjectKind, ResolveState, TypeNameDecl};
+use crate::parser::types::{validation, Object};
+use crate::parser::{module_loader, Range};
+use crate::span_err::ErrReporter;
+
+use super::resolved::{Resolved, Resolved::*};
+use super::typ::*;
+
+#[derive(Debug)]
+pub struct TypeChecker {
+    ctx: ResolveState,
+}
+
+impl TypeChecker {
+    pub fn new(loader: Lrc<module_loader::ModuleLoader>) -> Self {
+        Self {
+            ctx: ResolveState::new(loader),
+        }
+    }
+
+    pub fn state(&self) -> &ResolveState {
+        &self.ctx
+    }
+
+    pub fn resolve_type(&self, module: Lrc<module_loader::Module>, expr: &ast::TsType) -> Sp<Type> {
+        // Ensure the module is initialized.
+        let module_id = module.id;
+        _ = self.ctx.get_or_init_module(module);
+
+        let ctx = Ctx::new(&self.ctx, module_id);
+        let typ = ctx.typ(expr);
+        Sp::new(
+            expr.span(),
+            match ctx.concrete(&typ) {
+                New(typ) => typ,
+                Changed(typ) => typ.clone(),
+                Same(_) => typ,
+            },
+        )
+    }
+
+    pub fn concrete(&self, module_id: ModuleId, typ: &Type) -> Type {
+        // Ensure the module is initialized.
+        let ctx = Ctx::new(&self.ctx, module_id);
+        ctx.concrete(typ).into_owned()
+    }
+
+    pub fn underlying(&self, module_id: ModuleId, typ: &Type) -> Type {
+        let ctx = Ctx::new(&self.ctx, module_id);
+        ctx.underlying(typ).into_owned()
+    }
+
+    pub fn resolve_obj(
+        &self,
+        module: Lrc<module_loader::Module>,
+        expr: &ast::Expr,
+    ) -> Option<Rc<Object>> {
+        // Ensure the module is initialized.
+        let module_id = module.id;
+        _ = self.ctx.get_or_init_module(module);
+
+        let ctx = Ctx::new(&self.ctx, module_id);
+        ctx.resolve_obj(expr)
+    }
+
+    pub fn resolve_obj_type(&self, obj: &Object) -> Type {
+        let ctx = Ctx::new(&self.ctx, obj.module_id);
+        ctx.obj_type(obj)
+    }
+
+    pub fn resolve_default_export(&self, module: Lrc<module_loader::Module>) -> Option<Rc<Object>> {
+        // Ensure the module is initialized.
+        let module_id = module.id;
+        _ = self.ctx.get_or_init_module(module);
+
+        let ctx = Ctx::new(&self.ctx, module_id);
+        ctx.resolve_default_export()
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct Ctx<'a> {
+    state: &'a ResolveState,
+
+    /// The current module being resolved.
+    module: ModuleId,
+
+    /// The type parameters in the current type resolution scope.
+    type_params: &'a [&'a ast::TsTypeParam],
+
+    /// The type arguments in the current type resolution scope.
+    type_args: &'a [Type],
+
+    /// Context for the current mapped type being processed, if any.
+    mapped_key_id: Option<ast::Id>,
+
+    /// The mapped key type to substitute when concretising, if any.
+    mapped_key_type: Option<&'a Type>,
+
+    /// Encountered "infer Type" type parameters in the current scope.
+    /// Rc<RefCell<...>> so we can mutate it in nested contexts.
+    infer_type_params: Option<Rc<RefCell<Vec<ast::Id>>>>,
+
+    /// Type arguments to fill in for inferred type parameters.
+    infer_type_args: &'a [Cow<'a, Type>],
+}
+
+impl<'a> Ctx<'a> {
+    pub fn new(state: &'a ResolveState, module: ModuleId) -> Self {
+        Self {
+            state,
+            module,
+            type_params: &[],
+            type_args: &[],
+            mapped_key_id: None,
+            mapped_key_type: None,
+            infer_type_params: None,
+            infer_type_args: &[],
+        }
+    }
+
+    fn with_type_params(self, type_params: &'a [&'a ast::TsTypeParam]) -> Self {
+        Self {
+            type_params,
+            ..self
+        }
+    }
+
+    fn with_type_args(self, type_args: &'a [Type]) -> Self {
+        Self { type_args, ..self }
+    }
+
+    fn with_mapped_key_id(self, mapped_key_id: Option<ast::Id>) -> Self {
+        Self {
+            mapped_key_id,
+            ..self
+        }
+    }
+
+    fn with_mapped_key_type(self, mapped_key_type: Option<&'a Type>) -> Self {
+        Self {
+            mapped_key_type,
+            ..self
+        }
+    }
+
+    fn with_infer_type_params(self, infer_type_params: Rc<RefCell<Vec<ast::Id>>>) -> Self {
+        Self {
+            infer_type_params: Some(infer_type_params),
+            ..self
+        }
+    }
+
+    fn with_infer_type_args(self, infer_type_args: &'a [Cow<'a, Type>]) -> Self {
+        Self {
+            infer_type_args,
+            ..self
+        }
+    }
+}
+
+impl Ctx<'_> {
+    pub fn typ(&self, typ: &ast::TsType) -> Type {
+        match typ {
+            ast::TsType::TsKeywordType(tt) => self.keyword(tt),
+            ast::TsType::TsThisType(_) => Type::This(This),
+            ast::TsType::TsArrayType(tt) => self.array(tt),
+            ast::TsType::TsTupleType(tt) => self.tuple(tt),
+            ast::TsType::TsUnionOrIntersectionType(ast::TsUnionOrIntersectionType::TsUnionType(tt)) => self.union(tt),
+            ast::TsType::TsUnionOrIntersectionType(ast::TsUnionOrIntersectionType::TsIntersectionType(tt)) => self.intersection(tt),
+            ast::TsType::TsParenthesizedType(tt) => self.typ(&tt.type_ann),
+            ast::TsType::TsTypeLit(tt) => self.type_lit(tt),
+            ast::TsType::TsTypeRef(tt) => self.type_ref(tt),
+            ast::TsType::TsOptionalType(tt) => self.optional(tt),
+            ast::TsType::TsTypeQuery(tt) => self.type_query(tt),
+
+            ast::TsType::TsConditionalType(tt) => self.conditional(tt),
+            ast::TsType::TsLitType(tt) => self.lit_type(tt),
+            ast::TsType::TsTypeOperator(tt) => self.type_op(tt),
+            ast::TsType::TsMappedType(tt) => self.mapped(tt),
+            ast::TsType::TsIndexedAccessType(tt) => self.indexed_access(tt),
+            ast::TsType::TsInferType(tt) => self.infer(tt),
+
+            ast::TsType::TsFnOrConstructorType(_)
+            | ast::TsType::TsRestType(_) // same?
+            | ast::TsType::TsTypePredicate(_) // https://www.typescriptlang.org/docs/handbook/2/narrowing.html#using-type-predicates, https://www.typescriptlang.org/docs/handbook/2/classes.html#this-based-type-guards
+            | ast::TsType::TsImportType(_) // ??
+            => {
+                HANDLER.with(|handler| handler.span_err(typ.span(), &format!("unsupported: {typ:#?}")));
+                Type::Basic(Basic::Never)
+            }, // typeof
+        }
+    }
+
+    pub fn types<'b, I: IntoIterator<Item = &'b ast::TsType>>(&self, types: I) -> Vec<Type> {
+        types.into_iter().map(|t| self.typ(t)).collect()
+    }
+
+    pub fn btyp(&self, typ: &ast::TsType) -> Box<Type> {
+        Box::new(self.typ(typ))
+    }
+
+    /// Resolves keyof, unique, readonly, etc.
+    fn type_op(&self, tt: &ast::TsTypeOperator) -> Type {
+        let underlying = self.typ(&tt.type_ann);
+        match tt.op {
+            ast::TsTypeOperatorOp::ReadOnly => underlying,
+            ast::TsTypeOperatorOp::Unique => underlying,
+            ast::TsTypeOperatorOp::KeyOf => self.keyof(&underlying),
+        }
+    }
+
+    /// Resolves a mapped type, which represents another type being modified.
+    /// https://www.typescriptlang.org/docs/handbook/2/mapped-types.html
+    fn mapped(&self, tt: &ast::TsMappedType) -> Type {
+        // [K in keyof T]: T[K]
+
+        let Some(value_type) = &tt.type_ann else {
+            HANDLER.with(|handler| handler.span_err(tt.span, "missing value type annotation"));
+            return Type::Basic(Basic::Never);
+        };
+
+        let Some(in_type) = &tt.type_param.constraint else {
+            HANDLER.with(|handler| handler.span_err(tt.span, "missing 'in' type annotation"));
+            return Type::Basic(Basic::Never);
+        };
+
+        if let Some(name_type) = &tt.name_type {
+            HANDLER.with(|handler| {
+                handler.span_err(name_type.span(), "'as' type annotation not yet supported")
+            });
+            return Type::Basic(Basic::Never);
+        };
+
+        // First parse the "in" type.
+        let in_type = self.btyp(in_type);
+
+        // Next, introduce a nested ctx that introduces the "K" mapped type parameter.
+        let nested = self
+            .clone()
+            // .with_type_args(&[])
+            .with_mapped_key_id(Some(tt.type_param.name.to_id()));
+
+        // Next, parse the value type.
+        let value_type = nested.btyp(value_type);
+
+        let optional = match tt.optional {
+            None => None,
+            Some(ast::TruePlusMinus::Plus | ast::TruePlusMinus::True) => Some(true),
+            Some(ast::TruePlusMinus::Minus) => Some(false),
+        };
+
+        Type::Generic(Generic::Mapped(Mapped {
+            in_type,
+            value_type,
+            optional,
+        }))
+    }
+
+    // https://www.typescriptlang.org/docs/handbook/2/indexed-access-types.html#handbook-content
+    fn indexed_access(&self, tt: &ast::TsIndexedAccessType) -> Type {
+        let obj = self.typ(&tt.obj_type);
+        let idx = self.typ(&tt.index_type);
+        self.type_index(tt.span, &obj, &idx)
+    }
+
+    fn type_index(&self, span: Span, obj: &Type, idx: &Type) -> Type {
+        match (obj, idx) {
+            // If either obj or index is a generic type, we need to store it as a Generic::Index.
+            pair @ ((Type::Generic(_), _) | (_, Type::Generic(_))) => {
+                Type::Generic(Generic::Index(Index {
+                    source: Box::new(pair.0.clone()),
+                    index: Box::new(pair.1.clone()),
+                }))
+            }
+
+            (Type::Named(named), idx) => {
+                let underlying = named.underlying(self.state);
+                self.type_index(span, &underlying, idx)
+            }
+
+            (obj, Type::Named(idx)) => {
+                let underlying = idx.underlying(self.state);
+                self.type_index(span, obj, &underlying)
+            }
+
+            // Otherwise, look up the concrete result.
+            (Type::Interface(iface), idx) => match idx {
+                Type::Literal(Literal::String(s)) => iface
+                    .fields
+                    .iter()
+                    .find(|f| match &f.name {
+                        FieldName::String(name) => *name == *s,
+                        FieldName::Symbol(_) => false,
+                    })
+                    .map_or(Type::Basic(Basic::Never), |f| {
+                        let typ = f.typ.clone();
+                        // If the field is optional, wrap the type in Optional.
+                        if f.optional {
+                            Type::Optional(Optional(Box::new(typ)))
+                        } else {
+                            typ
+                        }
+                    }),
+
+                Type::Basic(Basic::String | Basic::Number) => iface
+                    .index
+                    .as_ref()
+                    .map_or(Type::Basic(Basic::Never), |(_, value)| *value.clone()),
+
+                Type::Union(union) => {
+                    let mut types = vec![];
+                    for index_type in union.types.clone() {
+                        match index_type {
+                            Type::Literal(Literal::String(ref str)) => {
+                                for field in &iface.fields {
+                                    if field.name.eq_str(str) {
+                                        types.push(field.typ.clone());
+                                        break;
+                                    }
+                                }
+                            }
+                            _ => {
+                                HANDLER.with(|handler| {
+                                    handler.span_err(
+                                        span,
+                                        "only string literals supported when using index access with union",
+                                    )
+                                });
+                                return Type::Basic(Basic::Never);
+                            }
+                        }
+                    }
+
+                    Type::Union(Union { types })
+                }
+                _ => {
+                    HANDLER.with(|handler| {
+                        handler.span_err(span, "unsupported index access type operation")
+                    });
+                    Type::Basic(Basic::Never)
+                }
+            },
+
+            (Type::Validated(v), idx) => {
+                let typ = self.type_index(span, &v.typ, idx);
+                Type::Validated(Validated {
+                    typ: Box::new(typ),
+                    expr: v.expr.clone(),
+                })
+            }
+
+            (obj, idx) => {
+                HANDLER.with(|handler| {
+                    handler.span_err(
+                        span,
+                        &format!(
+                            "unsupported indexed access type operation: obj {obj:#?} index {idx:#?}"
+                        ),
+                    )
+                });
+                Type::Basic(Basic::Never)
+            }
+        }
+    }
+
+    fn infer(&self, tt: &ast::TsInferType) -> Type {
+        // Do we have an infer context?
+        if let Some(params) = self.infer_type_params.as_ref() {
+            let id = tt.type_param.name.to_id();
+            let mut params = params.borrow_mut();
+            let idx = params.len();
+            params.push(id);
+            Type::Generic(Generic::Inferred(Inferred(idx)))
+        } else {
+            tt.span.err("infer type outside of infer context");
+            Type::Basic(Basic::Never)
+        }
+
+        // TODO figure out what type to return here
+    }
+
+    /// Given a type, produces a union type of the underlying keys,
+    /// e.g. `keyof {foo: string; bar: number}` yields `"foo" | "bar"`.
+    fn keyof(&self, typ: &Type) -> Type {
+        match typ {
+            Type::Basic(tt) => match tt {
+                Basic::Any => Type::Union(Union {
+                    types: vec![
+                        Type::Basic(Basic::String),
+                        Type::Basic(Basic::Number),
+                        Type::Basic(Basic::Symbol),
+                    ],
+                }),
+
+                // These should technically enumerate the built-in properties
+                // on these types, but we haven't implemented that yet.
+                Basic::String | Basic::Boolean | Basic::Number | Basic::BigInt | Basic::Symbol => {
+                    Type::Union(Union { types: vec![] })
+                }
+
+                // keyof these yields never.
+                Basic::Object
+                | Basic::Undefined
+                | Basic::Null
+                | Basic::Void
+                | Basic::Date
+                | Basic::Unknown
+                | Basic::Never => Type::Basic(Basic::Never),
+            },
+
+            Type::Enum(tt) => Type::Union(Union {
+                types: tt
+                    .members
+                    .iter()
+                    .map(|m| Type::Literal(Literal::String(m.name.clone())))
+                    .collect(),
+            }),
+
+            // These should technically enumerate the built-in properties
+            // on these types, but we haven't implemented that yet.
+            Type::Array(_) | Type::Tuple(_) => Type::Union(Union { types: vec![] }),
+
+            Type::Interface(interface) => {
+                let keys = interface
+                    .fields
+                    .iter()
+                    .filter_map(|f| match &f.name {
+                        FieldName::String(name) => {
+                            Some(Type::Literal(Literal::String(name.clone())))
+                        }
+                        FieldName::Symbol(_) => None,
+                    })
+                    .collect();
+                Type::Union(Union { types: keys })
+            }
+
+            Type::Named(_) => {
+                let underlying = self.underlying(typ);
+                self.keyof(&underlying)
+            }
+
+            Type::Class(_) => {
+                HANDLER.with(|handler| handler.err("keyof ClassType not yet supported"));
+                Type::Basic(Basic::Never)
+            }
+
+            Type::Optional(typ) => self.keyof(&typ.0),
+            Type::Union(union) => {
+                let res: Vec<_> = union.types.iter().map(|t| self.keyof(t)).collect();
+                Type::Union(Union { types: res })
+            }
+
+            // keyof "blah" is the same as keyof string, which should yield all properties.
+            Type::Literal(_) => Type::Union(Union { types: vec![] }),
+
+            Type::This(This) => Type::Basic(Basic::Never),
+
+            Type::Generic(generic) => Type::Generic(Generic::Keyof(Keyof(Box::new(
+                Type::Generic(generic.clone()),
+            )))),
+            Type::Validated(v) => self.keyof(&v.typ),
+            Type::Validation(_) => {
+                HANDLER.with(|handler| handler.err("keyof ValidationExpr unsupported"));
+                Type::Basic(Basic::Never)
+            }
+
+            Type::Custom(Custom::WireSpec(spec)) => self.keyof(&spec.underlying),
+            Type::Custom(Custom::Decimal) => Type::Basic(Basic::Never),
+        }
+    }
+
+    /// Resolves the typeof operator.
+    fn type_query(&self, typ: &ast::TsTypeQuery) -> Type {
+        if typ.type_args.is_some() {
+            HANDLER.with(|handler| {
+                handler.span_err(typ.span, "typeof with type args not yet supported")
+            });
+            return Type::Basic(Basic::Never);
+        }
+
+        match &typ.expr_name {
+            ast::TsTypeQueryExpr::TsEntityName(ast::TsEntityName::Ident(ident)) => {
+                let obj = self.ident_obj(ident);
+                if let Some(obj) = obj {
+                    self.obj_type(&obj)
+                } else {
+                    HANDLER.with(|handler| handler.span_err(ident.span, "unknown identifier"));
+                    Type::Basic(Basic::Never)
+                }
+            }
+            _ => {
+                HANDLER.with(|handler| {
+                    handler.span_err(typ.span, "typeof with non-ident not yet supported")
+                });
+                Type::Basic(Basic::Never)
+            }
+        }
+    }
+
+    fn type_lit(&self, type_lit: &ast::TsTypeLit) -> Type {
+        let mut fields: Vec<InterfaceField> = Vec::with_capacity(type_lit.members.len());
+        let mut index = None;
+        for m in &type_lit.members {
+            match m {
+                ast::TsTypeElement::TsPropertySignature(p) => {
+                    let name = match *p.key {
+                        ast::Expr::Ident(ref i) => FieldName::String(i.sym.as_ref().to_string()),
+                        ast::Expr::Lit(ast::Lit::Str(ref str)) => {
+                            FieldName::String(str.value.to_string())
+                        }
+                        _ => {
+                            HANDLER.with(|handler| {
+                                handler.span_err(p.key.span(), "unsupported property key")
+                            });
+                            continue;
+                        }
+                    };
+
+                    if let Some(type_params) = &p.type_params {
+                        HANDLER.with(|handler| {
+                            handler.span_err(type_params.span(), "unsupported type parameters")
+                        });
+                        continue;
+                    }
+                    if p.type_ann.is_none() {
+                        HANDLER.with(|handler| {
+                            handler.span_err(p.span(), "unsupported missing type annotation")
+                        });
+                        continue;
+                    }
+
+                    let typ = self.typ(p.type_ann.as_ref().unwrap().type_ann.as_ref());
+                    fields.push(InterfaceField {
+                        range: m.span().into(),
+                        name,
+                        typ,
+                        optional: p.optional,
+                    });
+                }
+
+                ast::TsTypeElement::TsIndexSignature(idx) => {
+                    // [foo: K]: V;
+                    let Some(ast::TsFnParam::Ident(ident)) = idx.params.first() else {
+                        HANDLER.with(|handler| {
+                            handler.span_err(idx.span(), "missing index signature key")
+                        });
+                        continue;
+                    };
+                    let Some(key_type_ann) = &ident.type_ann else {
+                        HANDLER.with(|handler| {
+                            handler.span_err(ident.span(), "missing key type annotation")
+                        });
+                        continue;
+                    };
+
+                    let Some(value_type_ann) = &idx.type_ann else {
+                        HANDLER.with(|handler| {
+                            handler.span_err(idx.span(), "missing value type annotation")
+                        });
+                        continue;
+                    };
+
+                    let key = self.typ(&key_type_ann.type_ann);
+                    let value = self.typ(&value_type_ann.type_ann);
+                    index = Some((Box::new(key), Box::new(value)))
+                }
+
+                ast::TsTypeElement::TsMethodSignature(_)
+                | ast::TsTypeElement::TsCallSignatureDecl(_)
+                | ast::TsTypeElement::TsConstructSignatureDecl(_)
+                | ast::TsTypeElement::TsGetterSignature(_)
+                | ast::TsTypeElement::TsSetterSignature(_) => {
+                    HANDLER.with(|handler| {
+                        handler.span_err(m.span(), &format!("unsupported: {type_lit:#?}"))
+                    });
+                    continue;
+                }
+            }
+        }
+
+        Type::Interface(Interface {
+            fields,
+
+            // TODO should these be set?
+            index,
+            call: None,
+        })
+    }
+
+    /// Resolves literals.
+    fn lit_type(&self, lit_type: &ast::TsLitType) -> Type {
+        Type::Literal(match &lit_type.lit {
+            ast::TsLit::Str(val) => Literal::String(val.value.to_string()),
+            ast::TsLit::Number(val) => Literal::Number(val.value),
+            ast::TsLit::Bool(val) => Literal::Boolean(val.value),
+            ast::TsLit::BigInt(val) => Literal::BigInt(val.value.to_string()),
+            ast::TsLit::Tpl(_) => {
+                // A template literal.
+                // https://www.typescriptlang.org/docs/handbook/2/template-literal-types.html
+                HANDLER.with(|handler| {
+                    handler.span_err(
+                        lit_type.span,
+                        "template literal expression not yet supported",
+                    )
+                });
+                Literal::String("".into())
+            }
+        })
+    }
+
+    fn type_ref(&self, typ: &ast::TsTypeRef) -> Type {
+        let obj = match &typ.type_name {
+            ast::TsEntityName::Ident(ident) => {
+                let ident_id = ident.to_id();
+                // Is this a reference to a type parameter?
+                let type_param = self
+                    .type_params
+                    .iter()
+                    .enumerate()
+                    .find(|tp| tp.1.name.to_id() == ident_id)
+                    .map(|tp| (tp.0, *tp.1));
+                if let Some((idx, type_param)) = type_param {
+                    return if let Some(type_arg) = self.type_args.get(idx) {
+                        type_arg.clone()
+                    } else {
+                        let constraint = type_param.constraint.as_ref().map(|c| self.btyp(c));
+                        Type::Generic(Generic::TypeParam(TypeParam { idx, constraint }))
+                    };
+                }
+
+                // Otherwise, is this a reference to the current mapped 'key' type?
+                if let Some(mapped_type_ctx) = &self.mapped_key_id {
+                    if ident.to_id() == *mapped_type_ctx {
+                        // Do we have a mapped key type?
+                        return if let Some(mapped_key_type) = self.mapped_key_type {
+                            mapped_key_type.clone()
+                        } else {
+                            Type::Generic(Generic::MappedKeyType(MappedKeyType))
+                        };
+                    }
+                }
+
+                // Otherwise, is this a reference to an inferred type parameter?
+                if let Some(infer_type_params) = &self.infer_type_params {
+                    let inferred_type_param = infer_type_params
+                        .borrow()
+                        .iter()
+                        .enumerate()
+                        .find(|tp| *tp.1 == ident_id)
+                        .map(|tp| tp.0);
+                    if let Some(idx) = inferred_type_param {
+                        return if let Some(type_arg) = self.infer_type_args.get(idx) {
+                            type_arg.clone().into_owned()
+                        } else {
+                            Type::Generic(Generic::Inferred(Inferred(idx)))
+                        };
+                    }
+                }
+
+                let Some(obj) = self.ident_obj(ident) else {
+                    HANDLER.with(|handler| handler.span_err(ident.span, "unknown identifier"));
+                    return Type::Basic(Basic::Never);
+                };
+                obj
+            }
+            ast::TsEntityName::TsQualifiedName(qn) => {
+                let Some(obj) = self.qualified_name_obj(qn) else {
+                    HANDLER.with(|handler| handler.span_err(qn.span(), "unknown qualified name"));
+                    return Type::Basic(Basic::Never);
+                };
+                obj
+            }
+        };
+
+        // Is this a reference to the built-in 'Date' class?
+        if obj.name.as_ref().is_some_and(|s| s == "Date") && self.state.is_universe(obj.module_id) {
+            return Type::Basic(Basic::Date);
+        }
+
+        let num_params = typ.type_params.as_ref().map_or(0, |p| p.params.len());
+        let mut type_arguments = Vec::with_capacity(num_params);
+        if let Some(params) = &typ.type_params {
+            for p in &params.params {
+                type_arguments.push(self.typ(p));
+            }
+        }
+
+        // Is this a reference to the built-in 'Array' class?
+        if obj.name.as_ref().is_some_and(|s| s == "Array") && self.state.is_universe(obj.module_id)
+        {
+            let elem = type_arguments.pop().unwrap_or(Type::Basic(Basic::Never));
+            return Type::Array(Array(Box::new(elem)));
+        }
+
+        // Is this a reference to the "Header", "Query", "Cookie", or "HttpStatus" wire spec overrides?
+        if obj
+            .name
+            .as_ref()
+            .is_some_and(|s| s == "Header" || s == "Query" || s == "Cookie" || s == "HttpStatus")
+            && self.state.is_module_path(obj.module_id, "encore.dev/api")
+        {
+            if let Some(wire_spec) = self.parse_wire_spec(typ.span, &obj, &type_arguments) {
+                return Type::Custom(Custom::WireSpec(wire_spec));
+            }
+        }
+
+        // Is this a encore Decimal?
+        if obj.name.as_ref().is_some_and(|s| s == "Decimal")
+            && self.state.is_module_path(obj.module_id, "encore.dev/types")
+        {
+            return Type::Custom(Custom::Decimal);
+        }
+
+        // Is this a reference to the "Attribute" pub/sub wire spec override?
+        if obj.name.as_ref().is_some_and(|s| s == "Attribute")
+            && self
+                .state
+                .is_module_path(obj.module_id, "encore.dev/pubsub")
+        {
+            if let Some(wire_spec) = self.parse_wire_spec(typ.span, &obj, &type_arguments) {
+                return Type::Custom(Custom::WireSpec(wire_spec));
+            }
+        }
+
+        match &obj.kind {
+            ObjectKind::TypeName(_) => {
+                let named = Named::new(obj, type_arguments);
+
+                if self
+                    .state
+                    .is_module_path(named.obj.module_id, "encore.dev/validate")
+                {
+                    if let Some(expr) = self.parse_validation(typ.span, &named) {
+                        return Type::Validation(expr);
+                    }
+                }
+
+                // Don't reference named types in the universe,
+                // otherwise we try to find them on disk.
+                // if self.state.is_universe(named.obj.module_id) {
+                // named.underlying(self.state).clone()
+                // } else {
+                Type::Named(named)
+                // }
+            }
+            ObjectKind::Enum(_) | ObjectKind::Class(_) => {
+                Type::Named(Named::new(obj, type_arguments))
+            }
+            ObjectKind::Var(_) | ObjectKind::Using(_) | ObjectKind::Func(_) => {
+                HANDLER.with(|handler| handler.span_err(typ.span, "value used as type"));
+                Type::Basic(Basic::Never)
+            }
+            ObjectKind::Module(_) => {
+                HANDLER.with(|handler| handler.span_err(typ.span, "module used as type"));
+                Type::Basic(Basic::Never)
+            }
+            ObjectKind::Namespace(_) => {
+                HANDLER.with(|handler| handler.span_err(typ.span, "namespace used as type"));
+                Type::Basic(Basic::Never)
+            }
+        }
+    }
+
+    fn qualified_name_obj(&self, qn: &ast::TsQualifiedName) -> Option<Rc<Object>> {
+        let obj = match &qn.left {
+            ast::TsEntityName::Ident(ident) => self.ident_obj(ident)?,
+            ast::TsEntityName::TsQualifiedName(qn) => self.qualified_name_obj(qn)?,
+        };
+
+        let name = qn.right.sym.as_str();
+        match &obj.kind {
+            ObjectKind::TypeName(_) => {
+                qn.right
+                    .span
+                    .err("cannot yet resolve qualified name on type");
+                None
+            }
+            ObjectKind::Enum(_) => {
+                qn.right
+                    .span
+                    .err("cannot yet resolve qualified name on enum");
+                None
+            }
+            ObjectKind::Var(_) => {
+                qn.right
+                    .span
+                    .err("cannot yet resolve qualified name on variable");
+                None
+            }
+            ObjectKind::Using(_) => {
+                qn.right
+                    .span
+                    .err("cannot yet resolve qualified name on using");
+                None
+            }
+            ObjectKind::Func(_) => {
+                qn.right
+                    .span
+                    .err("cannot yet resolve qualified name on function");
+                None
+            }
+            ObjectKind::Class(_) => {
+                qn.right
+                    .span
+                    .err("cannot yet resolve qualified name on class");
+                None
+            }
+            ObjectKind::Module(module) => {
+                if name == "default" {
+                    module.data.default_export.clone()
+                } else {
+                    module.data.named_exports.get(name).cloned()
+                }
+            }
+            ObjectKind::Namespace(ns) => {
+                if name == "default" {
+                    ns.data.default_export.clone()
+                } else {
+                    ns.data.named_exports.get(name).cloned()
+                }
+            }
+        }
+    }
+
+    fn array(&self, tt: &ast::TsArrayType) -> Type {
+        Type::Array(Array(Box::new(self.typ(&tt.elem_type))))
+    }
+
+    fn optional(&self, tt: &ast::TsOptionalType) -> Type {
+        Type::Optional(Optional(Box::new(self.typ(&tt.type_ann))))
+    }
+
+    fn tuple(&self, tuple: &ast::TsTupleType) -> Type {
+        let types = self.types(tuple.elem_types.iter().filter_map(|t|
+            // As far as I can tell labels don't actually impact type-checking
+            // at all, so we can ignore them.
+            // See https://www.typescriptlang.org/docs/handbook/release-notes/typescript-4-0.html.
+            if t.label.is_some() {
+                None
+            } else {
+                Some(t.ty.as_ref())
+            }));
+
+        Type::Tuple(Tuple { types })
+    }
+
+    fn union(&self, union_type: &ast::TsUnionType) -> Type {
+        let types = self.types(union_type.types.iter().map(|t| t.as_ref()));
+        simplify_union(types)
+    }
+
+    // https://www.typescriptlang.org/docs/handbook/2/conditional-types.html
+    fn conditional(&self, tt: &ast::TsConditionalType) -> Type {
+        let check = self.typ(&tt.check_type);
+        let infer_params: Rc<RefCell<Vec<ast::Id>>> = Default::default();
+        let extends = self
+            .clone()
+            .with_infer_type_params(infer_params.clone())
+            .typ(&tt.extends_type);
+
+        // Do we have a union type in `check`, and the AST is a naked type parameter?
+        // If so, we need to treat it as a distributive conditional type.
+        // See: https://www.typescriptlang.org/docs/handbook/advanced-types.html#distributive-conditional-types
+        if let Type::Union(union) = &check {
+            if let ast::TsType::TsTypeRef(ref check) = tt.check_type.as_ref() {
+                if check.type_params.is_none() {
+                    if let Some(ident) = check.type_name.as_ident() {
+                        if self
+                            .type_params
+                            .iter()
+                            .any(|tp| tp.name.to_id() == ident.to_id())
+                        {
+                            // Apply the conditional to each type in the union.
+                            let result = union
+                                .types
+                                .iter()
+                                .map(|t| match t.assignable(self.state, &extends) {
+                                    Some(true) => self.typ(&tt.true_type),
+                                    Some(false) => self.typ(&tt.false_type),
+                                    None => Type::Generic(Generic::Conditional(Conditional {
+                                        check_type: Box::new(t.clone()),
+                                        extends_type: Box::new(extends.clone()),
+                                        true_type: self.btyp(&tt.true_type),
+                                        false_type: self.btyp(&tt.false_type),
+                                    })),
+                                })
+                                .collect::<Vec<_>>();
+                            return simplify_union(result);
+                        }
+                    }
+                }
+            }
+        }
+
+        match check.extends(self.state, &extends) {
+            Extends::Yes(mut inferred) => {
+                // Convert the inferred types to a vector with the gaps
+                // filled in with the `unknown` type.
+                inferred.sort_by_key(|(i, _)| *i);
+                let mut inf = Vec::new();
+                for (idx, typ) in inferred {
+                    while inf.len() < idx {
+                        inf.push(Cow::Owned(Type::Basic(Basic::Unknown)));
+                    }
+                    inf.push(typ);
+                }
+
+                self.clone()
+                    .with_infer_type_params(infer_params)
+                    .with_infer_type_args(&inf[..])
+                    .typ(&tt.true_type)
+            }
+
+            Extends::No => self.typ(&tt.false_type),
+            Extends::Unknown => Type::Generic(Generic::Conditional(Conditional {
+                check_type: Box::new(check),
+                extends_type: Box::new(extends),
+                true_type: self
+                    .clone()
+                    .with_infer_type_params(infer_params)
+                    .btyp(&tt.true_type),
+                false_type: self.btyp(&tt.false_type),
+            })),
+        }
+    }
+
+    fn intersection(&self, typ: &ast::TsIntersectionType) -> Type {
+        let mut result = Owned(self.typ(&typ.types[0]));
+        for t in &typ.types[1..] {
+            let t = self.typ(t);
+            result = intersect(self, result, Owned(t));
+        }
+        result.into_owned()
+    }
+
+    fn keyword(&self, typ: &ast::TsKeywordType) -> Type {
+        let basic: Basic = match typ.kind {
+            ast::TsKeywordTypeKind::TsAnyKeyword => Basic::Any,
+            ast::TsKeywordTypeKind::TsUnknownKeyword => Basic::Unknown,
+            ast::TsKeywordTypeKind::TsNumberKeyword => Basic::Number,
+            ast::TsKeywordTypeKind::TsObjectKeyword => Basic::Object,
+            ast::TsKeywordTypeKind::TsBooleanKeyword => Basic::Boolean,
+            ast::TsKeywordTypeKind::TsBigIntKeyword => Basic::BigInt,
+            ast::TsKeywordTypeKind::TsStringKeyword => Basic::String,
+            ast::TsKeywordTypeKind::TsSymbolKeyword => Basic::Symbol,
+            ast::TsKeywordTypeKind::TsVoidKeyword => Basic::Void,
+            ast::TsKeywordTypeKind::TsUndefinedKeyword => Basic::Undefined,
+            ast::TsKeywordTypeKind::TsNullKeyword => Basic::Null,
+            ast::TsKeywordTypeKind::TsNeverKeyword => Basic::Never,
+            ast::TsKeywordTypeKind::TsIntrinsicKeyword => {
+                HANDLER.with(|handler| {
+                    handler.span_err(typ.span, "unimplemented: TsIntrinsicKeyword")
+                });
+                Basic::Never
+            }
+        };
+
+        Type::Basic(basic)
+    }
+
+    fn type_alias_decl(&self, decl: &ast::TsTypeAliasDecl) -> Type {
+        if let Some(type_params) = &decl.type_params {
+            let args: Vec<_> = type_params.params.iter().collect();
+            self.clone().with_type_params(&args[..]).typ(&decl.type_ann)
+        } else {
+            self.typ(&decl.type_ann)
+        }
+    }
+
+    fn interface_decl(&self, decl: &ast::TsInterfaceDecl) -> Type {
+        if let Some(type_params) = &decl.type_params {
+            let args: Vec<_> = type_params.params.iter().collect();
+            self.clone()
+                .with_type_params(&args[..])
+                .do_interface_decl(decl)
+        } else {
+            self.do_interface_decl(decl)
+        }
+    }
+
+    fn do_interface_decl(&self, decl: &ast::TsInterfaceDecl) -> Type {
+        let base = self.typ(&ast::TsType::TsTypeLit(ast::TsTypeLit {
+            span: decl.span,
+            members: decl.body.body.clone(),
+        }));
+        if decl.extends.is_empty() {
+            return base;
+        }
+
+        // We have an extends clause. Compute the intersection.
+        let mut result = Owned(base);
+        for extends in &decl.extends {
+            // Resolve the extend type, using its type arguments if necessary.
+            let t = if let Some(type_args) = extends.type_args.as_ref() {
+                let Some(obj) = self.resolve_obj(&extends.expr) else {
+                    HANDLER.with(|handler| {
+                        handler.span_err(extends.span, "extends with non-ident type")
+                    });
+                    continue;
+                };
+
+                // We have to manually construct a Named here, because the type arguments
+                // are not provided alongside the type expression.
+                let types: Vec<_> = type_args.params.iter().map(|t| self.typ(t)).collect();
+                let named = Named::new(obj, types);
+                let typ = Type::Named(named);
+                self.concrete(&typ).into_owned()
+            } else {
+                self.expr(&extends.expr)
+            };
+
+            result = intersect(self, result, Owned(t));
+        }
+        result.into_owned()
+    }
+
+    fn expr(&self, expr: &ast::Expr) -> Type {
+        match expr {
+            ast::Expr::This(_) => Type::This(This),
+            ast::Expr::Array(lit) => self.array_lit(lit),
+            ast::Expr::Object(lit) => self.object_lit(lit),
+            ast::Expr::Fn(_) => {
+                HANDLER.with(|handler| handler.span_err(expr.span(), "fn expr not yet supported"));
+                Type::Basic(Basic::Never)
+            }
+            ast::Expr::Unary(expr) => match expr.op {
+                // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/void
+                ast::UnaryOp::Void => Type::Basic(Basic::Undefined),
+
+                // This is the JavaScript typeof operator, not the TypeScript typeof operator.
+                // See https://www.typescriptlang.org/docs/handbook/2/typeof-types.html
+                ast::UnaryOp::TypeOf => Type::Basic(Basic::String),
+
+                ast::UnaryOp::Plus => Type::Basic(Basic::Number),
+                ast::UnaryOp::Minus => match self.expr(&expr.arg) {
+                    Type::Literal(Literal::Number(num)) => Type::Literal(Literal::Number(-num)),
+                    other => other,
+                },
+
+                ast::UnaryOp::Bang | ast::UnaryOp::Tilde | ast::UnaryOp::Delete => {
+                    self.expr(&expr.arg)
+                }
+            },
+            ast::Expr::Update(expr) => self.expr(&expr.arg),
+            ast::Expr::Bin(expr) => {
+                let left = self.expr(&expr.left);
+                let right = self.expr(&expr.right);
+
+                match left.union_merge(&right) {
+                    Some(unified) => unified,
+                    // TODO handle this correctly.
+                    None => left,
+                }
+            }
+            ast::Expr::Assign(expr) => self.expr(&expr.right),
+            ast::Expr::Member(expr) => self.member_expr(expr),
+            ast::Expr::SuperProp(_) => {
+                HANDLER
+                    .with(|handler| handler.span_err(expr.span(), "super prop not yet supported"));
+                Type::Basic(Basic::Never)
+            }
+            ast::Expr::Cond(cond) => {
+                let left = self.expr(&cond.cons);
+                let right = self.expr(&cond.alt);
+                left.simplify_or_union(right)
+            }
+            ast::Expr::Call(expr) => {
+                HANDLER.with(|handler| handler.span_err(expr.span, "call expr not yet supported"));
+                Type::Basic(Basic::Never)
+            }
+            ast::Expr::New(expr) => {
+                // The type of a class instance is the same as the class itself.
+                if let Some(type_args) = &expr.type_args {
+                    let type_args: Vec<_> = self.types(type_args.params.iter().map(|t| t.as_ref()));
+                    self.clone()
+                        .with_type_args(&type_args[..])
+                        .expr(&expr.callee)
+                } else {
+                    self.expr(&expr.callee)
+                }
+            }
+            ast::Expr::Seq(expr) => match expr.exprs.last() {
+                Some(expr) => self.expr(expr),
+                None => Type::Basic(Basic::Never),
+            },
+            ast::Expr::Ident(expr) => {
+                let Some(obj) = self.ident_obj(expr) else {
+                    HANDLER.with(|handler| handler.span_err(expr.span, "unknown identifier"));
+                    return Type::Basic(Basic::Never);
+                };
+
+                let named = Named::new(obj, vec![]);
+                Type::Named(named)
+            }
+            ast::Expr::PrivateName(expr) => {
+                let Some(obj) = self.ident_obj(&expr.id) else {
+                    HANDLER.with(|handler| handler.span_err(expr.id.span, "unknown identifier"));
+                    return Type::Basic(Basic::Never);
+                };
+
+                Type::Named(Named::new(obj, vec![]))
+            }
+            ast::Expr::Lit(expr) => match &expr {
+                ast::Lit::Str(val) => Type::Literal(Literal::String(val.value.to_string())),
+                ast::Lit::Bool(val) => Type::Literal(Literal::Boolean(val.value)),
+                ast::Lit::Num(val) => Type::Literal(Literal::Number(val.value)),
+                ast::Lit::Null(_) => Type::Basic(Basic::Null),
+                ast::Lit::BigInt(_) => Type::Basic(Basic::BigInt),
+                ast::Lit::Regex(_) => {
+                    HANDLER
+                        .with(|handler| handler.span_err(expr.span(), "regex not yet supported"));
+                    Type::Basic(Basic::Never)
+                }
+                ast::Lit::JSXText(_) => {
+                    HANDLER.with(|handler| {
+                        handler.span_err(expr.span(), "jsx text not yet supported")
+                    });
+                    Type::Basic(Basic::Never)
+                }
+            },
+            ast::Expr::Tpl(_) => Type::Basic(Basic::String),
+            ast::Expr::TaggedTpl(_) => {
+                HANDLER.with(|handler| {
+                    handler.span_err(expr.span(), "tagged template not yet supported")
+                });
+                Type::Basic(Basic::Never)
+            }
+            ast::Expr::Arrow(_) => {
+                HANDLER
+                    .with(|handler| handler.span_err(expr.span(), "arrow expr not yet supported"));
+                Type::Basic(Basic::Never)
+            }
+            ast::Expr::Class(_) => {
+                HANDLER
+                    .with(|handler| handler.span_err(expr.span(), "class expr not yet supported"));
+                Type::Basic(Basic::Never)
+            }
+            ast::Expr::Yield(expr) => match &expr.arg {
+                Some(arg) => self.expr(arg),
+                None => Type::Basic(Basic::Undefined),
+            },
+            ast::Expr::MetaProp(expr) => match expr.kind {
+                // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/new.target
+                ast::MetaPropKind::NewTarget => {
+                    HANDLER.with(|handler| {
+                        handler.span_err(expr.span, "new.target not yet supported")
+                    });
+                    Type::Basic(Basic::Never)
+                }
+                // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/import.meta
+                ast::MetaPropKind::ImportMeta => Type::Basic(Basic::Object),
+            },
+            ast::Expr::Await(expr) => {
+                let prom = self.expr(&expr.arg);
+                if let Type::Named(mut named) = prom {
+                    if named.obj.name.as_deref() == Some("Promise")
+                        && self.state.is_universe(named.obj.module_id)
+                        && !named.type_arguments.is_empty()
+                    {
+                        return named.type_arguments.swap_remove(0);
+                    }
+                }
+                Type::Basic(Basic::Unknown)
+            }
+
+            ast::Expr::Paren(expr) => self.expr(&expr.expr),
+
+            ast::Expr::JSXMember(_)
+            | ast::Expr::JSXNamespacedName(_)
+            | ast::Expr::JSXEmpty(_)
+            | ast::Expr::JSXElement(_)
+            | ast::Expr::JSXFragment(_) => Type::Basic(Basic::Never),
+
+            // <T>foo
+            ast::Expr::TsTypeAssertion(expr) => self.typ(&expr.type_ann),
+            // foo as T
+            ast::Expr::TsAs(expr) => self.typ(&expr.type_ann),
+
+            ast::Expr::TsConstAssertion(expr) => self.expr(&expr.expr),
+
+            // https://www.typescriptlang.org/docs/handbook/release-notes/typescript-4-9.html
+            ast::Expr::TsSatisfies(expr) => self.expr(&expr.expr),
+
+            ast::Expr::TsInstantiation(expr) => {
+                if !expr.type_args.params.is_empty() {
+                    let type_args: Vec<_> =
+                        self.types(expr.type_args.params.iter().map(|t| t.as_ref()));
+                    self.clone().with_type_args(&type_args[..]).expr(&expr.expr)
+                } else {
+                    self.expr(&expr.expr)
+                }
+            }
+
+            // The "foo!" operator
+            ast::Expr::TsNonNull(expr) => {
+                let base = self.expr(&expr.expr);
+                match base {
+                    Type::Optional(typ) => *typ.0,
+                    Type::Union(union) => {
+                        let non_null = union
+                            .types
+                            .into_iter()
+                            .filter(|t| {
+                                !matches!(
+                                    t,
+                                    Type::Basic(Basic::Undefined) | Type::Basic(Basic::Null)
+                                )
+                            })
+                            .collect::<Vec<_>>();
+                        match non_null.len() {
+                            0 => Type::Basic(Basic::Never),
+                            1 => non_null[0].clone(),
+                            _ => Type::Union(Union { types: non_null }),
+                        }
+                    }
+                    _ => base,
+                }
+            }
+
+            // "foo?.bar"
+            ast::Expr::OptChain(expr) => {
+                HANDLER.with(|handler| {
+                    handler.span_err(expr.span, "optional chaining not yet supported")
+                });
+                Type::Basic(Basic::Never)
+            }
+
+            ast::Expr::Invalid(_) => Type::Basic(Basic::Never),
+        }
+    }
+
+    fn array_lit(&self, lit: &ast::ArrayLit) -> Type {
+        let elem_types = Vec::with_capacity(lit.elems.len());
+
+        // Track the current element type.
+        let mut elem_type: Option<Type> = None;
+
+        for elem in lit.elems.iter().flatten() {
+            let mut base = self.expr(&elem.expr);
+            if elem.spread.is_some() {
+                // The type of [...["a"]] is string[].
+                if let Type::Array(arr) = base {
+                    base = *arr.0;
+                }
+            }
+
+            match &elem_type {
+                Some(Type::Union(_elem_types)) => {}
+                Some(typ) => {
+                    elem_type = Some(Type::Union(Union {
+                        types: vec![typ.clone(), base],
+                    }));
+                }
+                None => {
+                    elem_type = Some(base);
+                }
+            }
+        }
+
+        Type::Union(Union { types: elem_types })
+    }
+
+    fn object_lit(&self, lit: &ast::ObjectLit) -> Type {
+        let mut fields = Vec::with_capacity(lit.props.len());
+
+        for prop in &lit.props {
+            match prop {
+                ast::PropOrSpread::Prop(prop) => {
+                    let (name, typ) = match prop.as_ref() {
+                        ast::Prop::Shorthand(id) => {
+                            let Some(obj) = self.ident_obj(id) else {
+                                HANDLER.with(|handler| {
+                                    handler.span_err(id.span, "unknown identifier")
+                                });
+                                return Type::Basic(Basic::Never);
+                            };
+
+                            let obj_type = self.obj_type(&obj);
+                            (Cow::Borrowed(id.sym.as_ref()), obj_type)
+                        }
+                        ast::Prop::KeyValue(kv) => {
+                            let key = self.prop_name_to_string(&kv.key);
+                            let val_typ = self.expr(&kv.value);
+                            (key, val_typ)
+                        }
+                        ast::Prop::Assign(prop) => {
+                            HANDLER.with(|handler| {
+                                handler
+                                    .span_err(prop.span(), "unsupported assign in object literal")
+                            });
+                            return Type::Basic(Basic::Never);
+                        }
+                        ast::Prop::Getter(prop) => {
+                            let key = self.prop_name_to_string(&prop.key);
+                            // We can't figure out the value type here as it relies on
+                            // doing type analysis on the function body.
+                            (key, Type::Basic(Basic::Unknown))
+                        }
+                        ast::Prop::Setter(prop) => {
+                            let key = self.prop_name_to_string(&prop.key);
+                            // We can't figure out the value type here as it relies on
+                            // doing type analysis on the function body.
+                            (key, Type::Basic(Basic::Unknown))
+                        }
+                        ast::Prop::Method(prop) => {
+                            let key = self.prop_name_to_string(&prop.key);
+                            // We can't figure out the value type here as it relies on
+                            // doing type analysis on the function body.
+                            (key, Type::Basic(Basic::Unknown))
+                        }
+                    };
+                    fields.push(InterfaceField {
+                        range: prop.span().into(),
+                        name: FieldName::String(name.into_owned()),
+                        typ,
+                        optional: false,
+                    });
+                }
+                ast::PropOrSpread::Spread(spread) => {
+                    let typ = self.expr(&spread.expr);
+                    match typ {
+                        Type::Interface(interface) => {
+                            fields.extend(interface.fields);
+                        }
+                        _ => {
+                            HANDLER.with(|handler| {
+                                handler.span_err(spread.span(), "unsupported spread")
+                            });
+                        }
+                    }
+                }
+            }
+        }
+
+        Type::Interface(Interface {
+            fields,
+
+            // TODO should these be set?
+            index: None,
+            call: None,
+        })
+    }
+
+    fn member_expr(&self, expr: &ast::MemberExpr) -> Type {
+        let obj_type = self.expr(&expr.obj);
+        self.resolve_member_prop(&obj_type, &expr.prop)
+    }
+
+    fn resolve_member_prop(&self, obj_type: &Type, prop: &ast::MemberProp) -> Type {
+        match obj_type {
+            Type::Basic(_)
+            | Type::Literal(_)
+            | Type::Array(_)
+            | Type::Tuple(_)
+            | Type::Union(_)
+            | Type::Optional(_)
+            | Type::This(_)
+            | Type::Generic(_)
+            | Type::Class(_)
+            | Type::Validation(_) => {
+                HANDLER.with(|handler| handler.span_err(prop.span(), "unsupported member on type"));
+                Type::Basic(Basic::Never)
+            }
+            Type::Enum(tt) => {
+                for m in tt.members.iter() {
+                    let name = m.name.as_str();
+                    let matches = match prop {
+                        ast::MemberProp::Ident(i) => name == i.sym.as_ref(),
+                        ast::MemberProp::PrivateName(i) => name == i.id.sym.as_ref(),
+                        ast::MemberProp::Computed(i) => match self.expr(&i.expr) {
+                            Type::Literal(lit) => match lit {
+                                Literal::String(str) => name == str,
+                                Literal::Number(num) => name == num.to_string().as_str(),
+                                _ => false,
+                            },
+                            _ => false,
+                        },
+                    };
+                    if matches {
+                        return m.value.clone().to_type();
+                    }
+                }
+                Type::Basic(Basic::Never)
+            }
+            Type::Interface(tt) => {
+                for field in tt.fields.iter() {
+                    let matches = match prop {
+                        ast::MemberProp::Ident(i) => field.name.eq_str(i.sym.as_ref()),
+                        ast::MemberProp::PrivateName(i) => field.name.eq_str(i.id.sym.as_ref()),
+                        ast::MemberProp::Computed(i) => match self.expr(&i.expr) {
+                            Type::Literal(lit) => match lit {
+                                Literal::String(str) => field.name.eq_str(&str),
+                                Literal::Number(num) => field.name.eq_str(num.to_string().as_str()),
+                                _ => false,
+                            },
+                            _ => false,
+                        },
+                    };
+                    if matches {
+                        return field.typ.clone();
+                    }
+                }
+
+                // Otherwise use the index signature's value type, if present.
+                if let Some(idx) = &tt.index {
+                    *idx.1.clone()
+                } else {
+                    Type::Basic(Basic::Never)
+                }
+            }
+            Type::Named(_) => {
+                let underlying = self.underlying(obj_type);
+                self.resolve_member_prop(&underlying, prop)
+            }
+            Type::Validated(v) => self.resolve_member_prop(&v.typ, prop),
+            Type::Custom(Custom::WireSpec(spec)) => {
+                self.resolve_member_prop(&spec.underlying, prop)
+            }
+            Type::Custom(Custom::Decimal) => {
+                // Decimal has no properties accessible
+                Type::Basic(Basic::Never)
+            }
+        }
+    }
+
+    /// Resolves a prop name to the underlying string literal.
+    fn prop_name_to_string<'b>(&self, prop: &'b ast::PropName) -> Cow<'b, str> {
+        match prop {
+            ast::PropName::Ident(id) => Borrowed(id.sym.as_ref()),
+            ast::PropName::Str(str) => Borrowed(str.value.as_ref()),
+            ast::PropName::Num(num) => Owned(num.value.to_string()),
+            ast::PropName::BigInt(bigint) => Owned(bigint.value.to_string()),
+            ast::PropName::Computed(expr) => {
+                if let Type::Literal(lit) = self.expr(&expr.expr) {
+                    match lit {
+                        Literal::String(str) => return Owned(str),
+                        Literal::Number(num) => return Owned(num.to_string()),
+                        _ => {}
+                    }
+                }
+
+                HANDLER.with(|handler| handler.span_err(expr.span, "unsupported computed prop"));
+                Borrowed("")
+            }
+        }
+    }
+}
+
+impl Ctx<'_> {
+    pub fn obj_type(&self, obj: &Object) -> Type {
+        if matches!(&obj.kind, ObjectKind::Module(_)) {
+            // Modules don't have a type.
+            return Type::Basic(Basic::Never);
+        };
+
+        match obj.state.borrow().deref() {
+            CheckState::Completed(typ) => return typ.clone(),
+            CheckState::InProgress => {
+                // TODO support certain types of circular references.
+                HANDLER.with(|handler| {
+                    handler.span_err(obj.range.to_span(), "circular type reference");
+                });
+                return Type::Basic(Basic::Never);
+            }
+            CheckState::NotStarted => {
+                // Fall through below to do actual type-checking.
+                // Needs to be handled separately to avoid borrowing issues.
+            }
+        }
+        // Post-condition: state is NotStarted.
+
+        // Mark this object as being checked.
+        *obj.state.borrow_mut() = CheckState::InProgress;
+
+        let type_params: Vec<_> = obj.kind.type_params().collect();
+
+        let typ = {
+            // Create a nested ctx that uses the object's module.
+            let ctx = Ctx::new(self.state, obj.module_id).with_type_params(&type_params);
+            ctx.resolve_obj_type(obj)
+        };
+
+        *obj.state.borrow_mut() = CheckState::Completed(typ.clone());
+        typ
+    }
+
+    fn resolve_obj_type(&self, obj: &Object) -> Type {
+        match &obj.kind {
+            ObjectKind::TypeName(tn) => match &tn.decl {
+                TypeNameDecl::Interface(iface) => self.interface_decl(iface),
+                TypeNameDecl::TypeAlias(ta) => self.type_alias_decl(ta),
+            },
+
+            ObjectKind::Enum(o) => {
+                let mut members = Vec::with_capacity(o.members.len());
+                let mut prev_value = None;
+                for m in &o.members {
+                    // Determine the initializer type, if provided.
+                    let init = m.init.as_ref().map(|t| self.expr(t));
+                    let value = match init {
+                        None => {
+                            // We didn't have an initializer.
+                            // Determine the value based on the previous value.
+                            match prev_value {
+                                // No previous value; this is the first entry.
+                                None => EnumValue::Number(0),
+                                Some(EnumValue::Number(i)) => EnumValue::Number(i + 1),
+                                Some(EnumValue::String(_)) => {
+                                    HANDLER.with(|h| {
+                                        h.span_err(
+                                            m.span(),
+                                            "implicit enum value cannot follow string value",
+                                        )
+                                    });
+                                    EnumValue::Number(0)
+                                }
+                            }
+                        }
+                        Some(Type::Literal(lit)) => match lit {
+                            Literal::String(str) => EnumValue::String(str),
+                            Literal::Number(num) => {
+                                // Ensure the number is an integer.
+                                if num.fract() != 0.0 {
+                                    HANDLER.with(|h| {
+                                        h.span_err(m.span(), "enum value must be an integer")
+                                    });
+                                }
+                                EnumValue::Number(num as i64)
+                            }
+                            _ => {
+                                HANDLER.with(|h| h.span_err(m.span(), "unsupported enum value"));
+                                EnumValue::Number(0)
+                            }
+                        },
+                        _ => {
+                            HANDLER.with(|h| h.span_err(m.span(), "unsupported enum value"));
+                            EnumValue::Number(0)
+                        }
+                    };
+
+                    let name = match &m.id {
+                        ast::TsEnumMemberId::Ident(id) => id.sym.as_ref().to_string(),
+                        ast::TsEnumMemberId::Str(str) => str.value.as_ref().to_string(),
+                    };
+                    prev_value = Some(value.clone());
+                    members.push(EnumMember { name, value });
+                }
+                Type::Enum(EnumType { members })
+            }
+
+            ObjectKind::Var(o) => {
+                // Do we have a type annotation? If so, use that.
+                if let Some(type_ann) = &o.type_ann {
+                    self.typ(&type_ann.type_ann)
+                } else if let Some(expr) = &o.expr {
+                    self.expr(expr)
+                } else {
+                    Type::Basic(Basic::Never)
+                }
+            }
+
+            ObjectKind::Using(o) => {
+                // Do we have a type annotation? If so, use that.
+                if let Some(type_ann) = &o.type_ann {
+                    self.typ(&type_ann.type_ann)
+                } else if let Some(expr) = &o.expr {
+                    self.expr(expr)
+                } else {
+                    Type::Basic(Basic::Never)
+                }
+            }
+
+            ObjectKind::Func(_o) => {
+                HANDLER.with(|handler| {
+                    handler.span_err(obj.range.to_span(), "function types not yet supported");
+                });
+                Type::Basic(Basic::Never)
+            }
+
+            ObjectKind::Class(o) => {
+                let methods = o
+                    .spec
+                    .body
+                    .iter()
+                    .filter_map(|mem| match mem {
+                        ast::ClassMember::Method(m) => {
+                            m.key.as_ident().map(|id| id.sym.to_string())
+                        }
+                        _ => None,
+                    })
+                    .collect();
+                Type::Class(ClassType { methods })
+            }
+
+            ObjectKind::Module(_o) => Type::Basic(Basic::Never),
+            ObjectKind::Namespace(_o) => {
+                // TODO include namespace objects in interface
+                Type::Basic(Basic::Object)
+            }
+        }
+    }
+
+    fn resolve_obj(&self, expr: &ast::Expr) -> Option<Rc<Object>> {
+        match self.expr(expr) {
+            Type::Named(named) => Some(named.obj.clone()),
+            _ => None,
+        }
+    }
+
+    fn ident_obj(&self, ident: &ast::Ident) -> Option<Rc<Object>> {
+        // Does this represent a type parameter?
+        self.state.resolve_module_ident(self.module, ident)
+    }
+
+    fn resolve_default_export(&self) -> Option<Rc<Object>> {
+        self.state.resolve_module_default_export(self.module)
+    }
+}
+
+impl Ctx<'_> {
+    #[tracing::instrument(skip(self), ret, level = "trace")]
+    pub fn concrete<'b>(&'b self, typ: &'b Type) -> Resolved<'b, Type> {
+        match typ {
+            // Basic types that never change.
+            Type::Basic(_) | Type::Literal(_) | Type::Enum(_) | Type::This(_) => Same(typ),
+
+            // Nested types that recurse.
+            Type::Array(elem) => match self.concrete(&elem.0) {
+                New(t) => New(Type::Array(Array(Box::new(t)))),
+                Changed(t) => New(Type::Array(Array(Box::new(t.clone())))),
+                Same(_) => Same(typ),
+            },
+            Type::Tuple(tuple) => match self.concrete_list(&tuple.types) {
+                New(t) => New(Type::Tuple(Tuple { types: t })),
+                Changed(t) => New(Type::Tuple(Tuple {
+                    types: t.to_owned(),
+                })),
+                Same(_) => Same(typ),
+            },
+            Type::Union(union) => match self.concrete_list(&union.types) {
+                New(t) => New(Type::Union(Union { types: t })),
+                Changed(t) => New(Type::Union(Union {
+                    types: t.to_owned(),
+                })),
+                Same(_) => Same(typ),
+            },
+            Type::Optional(opt) => match self.concrete(&opt.0) {
+                New(t) => New(Type::Optional(Optional(Box::new(t)))),
+                Changed(t) => New(Type::Optional(Optional(Box::new(t.to_owned())))),
+                Same(_) => Same(typ),
+            },
+
+            Type::Named(named) => match self.concrete_list(&named.type_arguments) {
+                New(t) => New(Type::Named(Named::new(named.obj.clone(), t))),
+                Changed(t) => New(Type::Named(Named::new(named.obj.clone(), t.to_owned()))),
+                Same(_) => Same(typ),
+            },
+
+            Type::Interface(iface) => {
+                let concrete_fields =
+                    |fields: &'b [InterfaceField]| -> Resolved<'b, [InterfaceField]> {
+                        for (i, field) in fields.iter().enumerate() {
+                            let t = match self.concrete(&field.typ) {
+                                New(t) => t,
+                                Changed(t) => t.clone(),
+                                Same(_) => continue,
+                            };
+                            // We have a new type, so we need to clone the entire list.
+                            let mut res = Vec::with_capacity(fields.len());
+                            res.extend(fields[0..i].iter().cloned());
+
+                            res.push(InterfaceField {
+                                range: field.range,
+                                typ: t,
+                                name: field.name.clone(),
+                                optional: field.optional,
+                            });
+
+                            // Copy all remaining elements.
+                            res.extend(fields[i + 1..].iter().map(|t| InterfaceField {
+                                range: t.range,
+                                name: t.name.clone(),
+                                typ: self.concrete(&t.typ).into_owned(),
+                                optional: t.optional,
+                            }));
+
+                            return New(res);
+                        }
+
+                        // All types are the same, so we can just return the original list.
+                        Same(fields)
+                    };
+
+                let fields = concrete_fields(&iface.fields);
+                let index = iface
+                    .index
+                    .as_ref()
+                    .map(|(key, val)| (self.concrete(key), self.concrete(val)));
+                let call = iface
+                    .call
+                    .as_ref()
+                    .map(|(params, ret)| (self.concrete_list(params), self.concrete_list(ret)));
+
+                // If we have any parts that aren't Same, we need to make the whole thing New.
+                // Otherwise return the original type.
+                if !matches!(fields, Same(_))
+                    || !matches!(index, Some((Same(_), _) | (_, Same(_))))
+                    || !matches!(call, Some((Same(_), _) | (_, Same(_))))
+                {
+                    New(Type::Interface(Interface {
+                        fields: fields.into_owned(),
+                        index: index
+                            .map(|(k, v)| (Box::new(k.into_owned()), Box::new(v.into_owned()))),
+                        call: call.map(|(p, r)| (p.into_owned(), r.into_owned())),
+                    }))
+                } else {
+                    Same(typ)
+                }
+            }
+
+            // TODO is this correct?
+            // Class types are already concrete.
+            Type::Class(_) => Same(typ),
+
+            Type::Generic(generic) => match generic {
+                Generic::TypeParam(param) => {
+                    // If the type parameter is a concrete type, return that.
+                    if let Some(arg) = self.type_args.get(param.idx) {
+                        Changed(arg)
+                    } else {
+                        // We don't have a concrete type, so return the original type.
+                        Same(typ)
+                    }
+                }
+
+                Generic::Inferred(inferred) => {
+                    // If we have a concrete inferred type, return that.
+                    if let Some(arg) = self.infer_type_args.get(inferred.0) {
+                        Changed(arg)
+                    } else {
+                        // We don't have a concrete type, so return the original type.
+                        Same(typ)
+                    }
+                }
+
+                Generic::Keyof(source) => {
+                    let concrete_source = self.concrete(&source.0);
+                    let keys = self.keyof(&concrete_source);
+                    New(keys)
+                }
+
+                Generic::Intersection(intersection) => {
+                    let x = self.concrete(&intersection.x);
+                    let y = self.concrete(&intersection.y);
+
+                    match (x, y) {
+                        (Same(_), Same(_)) => Same(typ),
+                        (x, y) => match intersect(self, x.into(), y.into()) {
+                            Owned(t) => New(t),
+                            Borrowed(t) => Changed(t),
+                        },
+                    }
+                }
+
+                Generic::Conditional(cond) => {
+                    let check = self.concrete(&cond.check_type);
+                    let extends = self.concrete(&cond.extends_type);
+
+                    // Is this a "distributed conditional type"?
+                    // See https://www.typescriptlang.org/docs/handbook/advanced-types.html#distributive-conditional-types
+
+                    match (cond.check_type.as_ref(), check.into_owned()) {
+                        (Type::Generic(Generic::TypeParam(param)), Type::Union(check)) => {
+                            // If check is a union, apply the check to each type in the union.
+                            let mut type_args = self.type_args.to_owned();
+
+                            // Construct a modified context that modifies the given type argument
+                            // to refer only to the concrete type for this union.
+                            let result: Vec<_> = check
+                                .types
+                                .into_iter()
+                                .filter_map(|c| {
+                                    // Modify the type args.
+                                    if type_args.len() > param.idx {
+                                        type_args[param.idx] = c.clone();
+                                    }
+                                    let nested = self.clone().with_type_args(&type_args);
+                                    match c.assignable(self.state, &extends) {
+                                        Some(true) => {
+                                            Some(nested.concrete(&cond.true_type).into_owned())
+                                        }
+                                        Some(false) => {
+                                            Some(nested.concrete(&cond.false_type).into_owned())
+                                        }
+                                        // This implies there's a generic type in this mix,
+                                        // which shouldn't happen when concretizing.
+                                        None => None,
+                                    }
+                                })
+                                .collect();
+
+                            New(simplify_union(result))
+                        }
+
+                        // Otherwise just check the single element.
+                        (_, check) => match check.extends(self.state, &extends).into_static() {
+                            Extends::Yes(mut inferred) => {
+                                // Convert the inferred types to a vector with the gaps
+                                // filled in with the `unknown` type.
+                                inferred.sort_by_key(|(i, _)| *i);
+                                let mut inf = Vec::new();
+                                for (idx, typ) in inferred {
+                                    while inf.len() < idx {
+                                        inf.push(Cow::Owned(Type::Basic(Basic::Unknown)));
+                                    }
+                                    inf.push(typ);
+                                }
+
+                                self.clone()
+                                    .with_infer_type_args(&inf[..])
+                                    .concrete(&cond.true_type)
+                                    .into_new()
+                            }
+                            Extends::No => self.concrete(&cond.false_type).same_to_changed(),
+
+                            // We don't yet have enough type information to resolve the conditional.
+                            // Still, return a new type with the concretized types we have.
+                            Extends::Unknown => {
+                                New(Type::Generic(Generic::Conditional(Conditional {
+                                    check_type: Box::new(check),
+                                    extends_type: Box::new(extends.into_owned()),
+                                    true_type: Box::new(
+                                        self.concrete(&cond.true_type).into_owned(),
+                                    ),
+                                    false_type: Box::new(
+                                        self.concrete(&cond.false_type).into_owned(),
+                                    ),
+                                })))
+                            }
+                        },
+                    }
+                }
+
+                Generic::Index(index) => {
+                    let source = self.concrete(&index.source);
+                    let index = self.concrete(&index.index);
+                    let result = self.type_index(Span::default(), &source, &index);
+                    New(result)
+                }
+
+                Generic::Mapped(mapped) => {
+                    let mut iface = Interface {
+                        fields: vec![],
+                        index: None,
+                        call: None,
+                    };
+
+                    let keys = self.underlying(&mapped.in_type).into_owned();
+                    for key in keys.into_iter_unions() {
+                        let value = self
+                            .clone()
+                            .with_mapped_key_type(Some(&key))
+                            .concrete(&mapped.value_type)
+                            .into_owned();
+
+                        // If the value resolves to 'never' it should be skipped.
+                        if let Type::Basic(Basic::Never) = &value {
+                            continue;
+                        }
+
+                        // Get the underlying key type if it's named.
+
+                        match key {
+                            // Never means the field should be excluded.
+                            Type::Basic(Basic::Never) => {
+                                HANDLER.with(|handler| {
+                                    handler.err("unexpected 'never' type as mapped type key");
+                                });
+                            }
+
+                            // An unresolved generic type means we can't resolve this yet.
+                            Type::Generic(_) => {
+                                return New(Type::Generic(Generic::Mapped(Mapped {
+                                    in_type: Box::new(self.concrete(&mapped.in_type).into_owned()),
+                                    value_type: Box::new(
+                                        self.concrete(&mapped.value_type).into_owned(),
+                                    ),
+                                    optional: mapped.optional,
+                                })))
+                            }
+
+                            // Do we have a wildcard type like "string" or "number"?
+                            // If so treat it as an index signature.
+                            source @ (Type::Basic(Basic::String)
+                            | Type::Basic(Basic::Number)
+                            | Type::Basic(Basic::Symbol)) => {
+                                // TODO actually do the mapping/filtering
+                                iface.index = Some((Box::new(source.clone()), Box::new(value)));
+                            }
+
+                            // Do we have a string literal?
+                            Type::Literal(Literal::String(str)) => {
+                                // Unwrap optional and record it on the field instead.
+                                let (typ, optional) = match value {
+                                    // Never means the field should be excluded.
+                                    Type::Basic(Basic::Never) => continue,
+                                    Type::Optional(typ) => (*typ.0, true),
+                                    typ => (typ, false),
+                                };
+
+                                iface.fields.push(InterfaceField {
+                                    range: Range::default(),
+                                    name: FieldName::String(str.clone()),
+                                    typ,
+                                    optional,
+                                });
+                            }
+
+                            typ => {
+                                HANDLER.with(|handler| {
+                                    handler.err(&format!("unsupported mapped key type: {typ:#?}"));
+                                });
+                            }
+                        }
+                    }
+
+                    // If the mapped type contains optional modifiers, apply them.
+                    if let Some(optional) = &mapped.optional {
+                        if let Some((key, value)) = iface.index.take() {
+                            let value = if *optional {
+                                match value.as_ref() {
+                                    Type::Optional(_) => value,
+                                    _ => Box::new(Type::Optional(Optional(value))),
+                                }
+                            } else if let Type::Optional(Optional(inner)) = *value {
+                                inner
+                            } else {
+                                value
+                            };
+                            iface.index = Some((key, value));
+                        }
+
+                        for field in iface.fields.iter_mut() {
+                            field.optional = *optional;
+                        }
+                    }
+
+                    New(Type::Interface(iface))
+                }
+
+                Generic::MappedKeyType(_) => match self.mapped_key_type {
+                    Some(key) => Changed(key),
+                    None => Same(typ),
+                },
+            },
+
+            Type::Validated(v) => match self.concrete(&v.typ) {
+                New(inner) => New(Type::Validated(Validated {
+                    typ: Box::new(inner),
+                    expr: v.expr.clone(),
+                })),
+                Changed(inner) => New(Type::Validated(Validated {
+                    typ: Box::new(inner.clone()),
+                    expr: v.expr.clone(),
+                })),
+                Same(_) => Same(typ),
+            },
+
+            Type::Validation(_) => Same(typ),
+            Type::Custom(Custom::WireSpec(spec)) => match self.concrete(&spec.underlying) {
+                New(inner) => New(Type::Custom(Custom::WireSpec(WireSpec {
+                    underlying: Box::new(inner),
+                    ..spec.clone()
+                }))),
+                Changed(inner) => New(Type::Custom(Custom::WireSpec(WireSpec {
+                    underlying: Box::new(inner.clone()),
+                    ..spec.clone()
+                }))),
+                Same(_) => Same(typ),
+            },
+            Type::Custom(Custom::Decimal) => Same(typ), // Decimal is already concrete
+        }
+    }
+
+    pub fn underlying_named(&self, named: &Named) -> Type {
+        let type_params = named.obj.kind.type_params().collect::<Vec<_>>();
+
+        // Create a complete list of type arguments with defaults applied where needed
+        if named.type_arguments.len() < type_params.len() {
+            let mut args = named.type_arguments.clone();
+
+            // For each parameter that wasn't provided, try to use its default
+            for param in type_params.iter().skip(args.len()) {
+                if let Some(default) = param.default.as_ref() {
+                    args.push(self.typ(default));
+                }
+            }
+
+            self.underlying_type(named, &args, &type_params)
+        } else {
+            self.underlying_type(named, &named.type_arguments, &type_params)
+        }
+    }
+
+    pub fn underlying<'b>(&'b self, typ: &'b Type) -> Resolved<'b, Type> {
+        // Ensure we resolve the concrete type.
+        match self.concrete(typ) {
+            Same(tt) => match tt {
+                Type::Named(named) => New(named.underlying(self.state)),
+                _ => Same(typ),
+            },
+            Changed(tt) => match tt {
+                Type::Named(named) => New(named.underlying(self.state)),
+                _ => Changed(tt),
+            },
+            New(tt) => match tt {
+                Type::Named(named) => New(named.underlying(self.state)),
+                _ => New(tt),
+            },
+        }
+    }
+
+    fn underlying_type(
+        &self,
+        named: &Named,
+        type_arguments: &[Type],
+        type_params: &[&TsTypeParam],
+    ) -> Type {
+        let type_args = self.concrete_list(type_arguments);
+        let typ = self.obj_type(&named.obj);
+
+        let ctx = self
+            .clone()
+            .with_type_params(type_params)
+            .with_type_args(&type_args);
+
+        let span = tracing::trace_span!("underlying_named", ?named, ?type_args);
+        let _guard = span.enter();
+        ctx.underlying(&typ).into_owned()
+    }
+
+    fn concrete_list<'b>(&'b self, v: &'b [Type]) -> Resolved<'b, [Type]> {
+        for (i, typ) in v.iter().enumerate() {
+            let t = match self.concrete(typ) {
+                New(t) => t,
+                Changed(t) => t.clone(),
+                Same(_) => continue,
+            };
+
+            // We have a new type, so we need to clone the entire list.
+            let mut res = Vec::with_capacity(v.len());
+            res.extend(v[0..i].iter().cloned());
+            res.push(t);
+
+            // Copy all remaining elements.
+            res.extend(v[i + 1..].iter().map(|t| self.concrete(t).into_owned()));
+            return New(res);
+        }
+
+        // All types are the same, so we can just return the original list.
+        Same(v)
+    }
+
+    #[allow(dead_code)]
+    fn doc_comment(&self, pos: BytePos) -> Option<String> {
+        self.state
+            .lookup_module(self.module)
+            .and_then(|m| m.base.preceding_comments(pos.into()))
+    }
+
+    fn parse_validation(&self, sp: Span, named: &Named) -> Option<validation::Expr> {
+        let name = named.obj.name.as_deref()?;
+
+        #[allow(dead_code)]
+        fn i64_lit(typ: &Type) -> Option<i64> {
+            if let Type::Literal(Literal::Number(n)) = typ {
+                let i = *n as i64;
+                if i as f64 == *n {
+                    return Some(i);
+                }
+            }
+            None
+        }
+
+        fn u64_lit(typ: &Type) -> Option<u64> {
+            if let Type::Literal(Literal::Number(n)) = typ {
+                let u = *n as u64;
+                if u as f64 == *n {
+                    return Some(u);
+                }
+            }
+            None
+        }
+
+        fn f64_lit(typ: &Type) -> Option<f64> {
+            if let Type::Literal(Literal::Number(n)) = typ {
+                return Some(*n);
+            }
+            None
+        }
+
+        fn str_lit(typ: &Type) -> Option<String> {
+            if let Type::Literal(Literal::String(s)) = typ {
+                return Some(s.clone());
+            }
+            None
+        }
+
+        use validation::{Expr, Is, Rule, N};
+        match name {
+            "Min" => {
+                if let Some(num) = named.type_arguments.first().and_then(f64_lit) {
+                    Some(Expr::Rule(Rule::MinVal(N(num))))
+                } else {
+                    sp.err("Min requires a number literal as its first type argument");
+                    None
+                }
+            }
+            "Max" => {
+                if let Some(num) = named.type_arguments.first().and_then(f64_lit) {
+                    Some(Expr::Rule(Rule::MaxVal(validation::N(num))))
+                } else {
+                    sp.err("Max requires a number literal as its first type argument");
+                    None
+                }
+            }
+            "MinLen" => {
+                if let Some(num) = named.type_arguments.first().and_then(u64_lit) {
+                    Some(Expr::Rule(Rule::MinLen(num)))
+                } else {
+                    sp.err("MinLen requires a number literal as its first type argument");
+                    None
+                }
+            }
+            "MaxLen" => {
+                if let Some(num) = named.type_arguments.first().and_then(u64_lit) {
+                    Some(Expr::Rule(Rule::MaxLen(num)))
+                } else {
+                    sp.err("MaxLen requires a number literal as its first type argument");
+                    None
+                }
+            }
+            "StartsWith" => {
+                if let Some(str) = named.type_arguments.first().and_then(str_lit) {
+                    Some(Expr::Rule(Rule::StartsWith(str)))
+                } else {
+                    sp.err("StartsWith requires a string literal as its first type argument");
+                    None
+                }
+            }
+            "EndsWith" => {
+                if let Some(str) = named.type_arguments.first().and_then(str_lit) {
+                    Some(Expr::Rule(Rule::EndsWith(str)))
+                } else {
+                    sp.err("EndsWith requires a string literal as its first type argument");
+                    None
+                }
+            }
+            "MatchesRegexp" => {
+                if let Some(str) = named.type_arguments.first().and_then(str_lit) {
+                    Some(Expr::Rule(Rule::MatchesRegexp(str)))
+                } else {
+                    sp.err("MatchesRegexp requires a string literal as its first type argument");
+                    None
+                }
+            }
+            "IsEmail" => Some(Expr::Rule(Rule::Is(Is::Email))),
+            "IsURL" => Some(Expr::Rule(Rule::Is(Is::Url))),
+            _ => None,
+        }
+    }
+
+    fn parse_wire_spec(&self, span: Span, obj: &Object, type_args: &[Type]) -> Option<WireSpec> {
+        let location = match &obj.name.as_deref() {
+            Some("Header") => WireLocation::Header,
+            Some("Query") => WireLocation::Query,
+            Some("Attribute") => WireLocation::PubSubAttr,
+            Some("Cookie") => WireLocation::Cookie,
+            Some("HttpStatus") => WireLocation::HttpStatus,
+            _ => return None,
+        };
+
+        fn str_lit(sp: Span, typ: &Type) -> Option<String> {
+            if let Type::Literal(Literal::String(s)) = typ {
+                return Some(s.clone());
+            }
+            sp.err("expected a string literal as the second type argument");
+            None
+        }
+
+        let (underlying, name_override) = match &location {
+            WireLocation::HttpStatus => {
+                // HttpStatus doesn't take generic parameters and should have no type args
+                if !type_args.is_empty() {
+                    span.err("HttpStatus doesn't take generic type parameters");
+                    return None;
+                }
+                (Type::Basic(Basic::Number), None)
+            }
+            _ => {
+                match (type_args.first(), type_args.get(1)) {
+                    (None, None) => (Type::Basic(Basic::String), None),
+
+                    (Some(first), None) => {
+                        // If we only have a single argument, check its type.
+                        // If it's a string literal it's the name, otherwise it's the type.
+                        match first {
+                            Type::Literal(Literal::String(lit)) => {
+                                (Type::Basic(Basic::String), Some(lit.to_string()))
+                            }
+                            _ => (first.clone(), None),
+                        }
+                    }
+
+                    (Some(typ), Some(name)) => (typ.clone(), str_lit(span, name)),
+                    (None, Some(_)) => unreachable!(),
+                }
+            }
+        };
+
+        Some(WireSpec {
+            location,
+            underlying: Box::new(underlying),
+            name_override,
+        })
+    }
+}
diff --git a/tsparser/src/parser/types/type_string.rs b/tsparser/src/parser/types/type_string.rs
new file mode 100644
index 0000000000..9e82975ac0
--- /dev/null
+++ b/tsparser/src/parser/types/type_string.rs
@@ -0,0 +1,242 @@
+use std::fmt::{Display, Write};
+
+use super::{validation, Basic, Custom, Generic, Interface, Type, Validated, WireSpec};
+
+impl Display for Type {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        let mut renderer = TypeRenderer { buf: f };
+        renderer.render_type(self)
+    }
+}
+
+struct TypeRenderer<B> {
+    buf: B,
+}
+
+impl<B> TypeRenderer<B>
+where
+    B: Write,
+{
+    fn render_type(&mut self, typ: &Type) -> std::fmt::Result {
+        match typ {
+            Type::Basic(b) => self.render_basic(b),
+            Type::Array(arr) => {
+                self.buf.write_str("Array<")?;
+                self.render_type(&arr.0)?;
+                self.buf.write_char('>')
+            }
+            Type::Interface(iface) => self.render_iface(iface),
+            Type::Union(union) => {
+                for (i, typ) in union.types.iter().enumerate() {
+                    if i > 0 {
+                        self.buf.write_str(" | ")?;
+                    }
+                    self.render_type(typ)?;
+                }
+                Ok(())
+            }
+            Type::Tuple(tup) => {
+                self.buf.write_char('[')?;
+                for (i, typ) in tup.types.iter().enumerate() {
+                    if i > 0 {
+                        self.buf.write_str(", ")?;
+                    }
+                    self.render_type(typ)?;
+                }
+                self.buf.write_char(']')
+            }
+            Type::Literal(lit) => self.render_literal(lit),
+            Type::Class(cls) => self.render_class(cls),
+            Type::Enum(e) => self.render_enum(e),
+            Type::Named(named) => self.render_named(named),
+            Type::Optional(opt) => {
+                self.render_type(&opt.0)?;
+                self.buf.write_char('?')
+            }
+            Type::This(_) => self.buf.write_str("this"),
+            Type::Generic(g) => self.render_generic(g),
+            Type::Validation(v) => self.render_validation(v),
+            Type::Validated(v) => self.render_validated(v),
+            Type::Custom(c) => self.render_custom(c),
+        }
+    }
+
+    fn render_basic(&mut self, b: &Basic) -> std::fmt::Result {
+        use Basic::*;
+        let s = match b {
+            Any => "any",
+            String => "string",
+            Boolean => "boolean",
+            Number => "number",
+            Object => "object",
+            BigInt => "bigint",
+            Date => "Date",
+            Symbol => "symbol",
+            Undefined => "undefined",
+            Null => "null",
+            Void => "void",
+            Unknown => "unknown",
+            Never => "never",
+        };
+        self.buf.write_str(s)
+    }
+
+    fn render_iface(&mut self, iface: &Interface) -> std::fmt::Result {
+        self.buf.write_str("interface { ")?;
+        for (i, field) in iface.fields.iter().enumerate() {
+            if i > 0 {
+                self.buf.write_str("; ")?;
+            }
+
+            use super::FieldName;
+            self.buf.write_str(match &field.name {
+                FieldName::String(s) => s,
+                FieldName::Symbol(_) => "symbol",
+            })?;
+            if field.optional {
+                self.buf.write_char('?')?;
+            }
+            self.buf.write_str(": ")?;
+            self.render_type(&field.typ)?;
+        }
+        self.buf.write_str(" }")
+    }
+
+    fn render_literal(&mut self, lit: &super::Literal) -> std::fmt::Result {
+        use super::Literal;
+        match lit {
+            Literal::String(s) => self.buf.write_fmt(format_args!("{s:#?}")),
+            Literal::Boolean(b) => self.buf.write_fmt(format_args!("{b}")),
+            Literal::Number(n) => self.buf.write_fmt(format_args!("{n}")),
+            Literal::BigInt(n) => self.buf.write_str(n),
+        }
+    }
+
+    fn render_class(&mut self, _cls: &super::ClassType) -> std::fmt::Result {
+        self.buf.write_str("class {}")
+    }
+
+    fn render_enum(&mut self, e: &super::EnumType) -> std::fmt::Result {
+        self.buf.write_str("enum { ")?;
+        for (i, mem) in e.members.iter().enumerate() {
+            if i > 0 {
+                self.buf.write_str(", ")?;
+            }
+            self.buf.write_str(&mem.name)?;
+        }
+        self.buf.write_str(" }")
+    }
+
+    fn render_named(&mut self, named: &super::Named) -> std::fmt::Result {
+        let name = named.obj.name.as_deref().unwrap_or("UnknownObject");
+        self.buf.write_str(name)?;
+
+        if !named.type_arguments.is_empty() {
+            self.buf.write_char('<')?;
+            for (i, arg) in named.type_arguments.iter().enumerate() {
+                if i > 0 {
+                    self.buf.write_str(", ")?;
+                }
+                self.render_type(arg)?;
+            }
+            self.buf.write_char('>')?;
+        }
+        Ok(())
+    }
+
+    fn render_validation(&mut self, v: &validation::Expr) -> std::fmt::Result {
+        self.buf.write_fmt(format_args!("{v}"))
+    }
+
+    fn render_validated(&mut self, v: &Validated) -> std::fmt::Result {
+        self.render_type(&v.typ)?;
+        self.buf.write_fmt(format_args!(" & {}", v.expr))
+    }
+
+    fn render_custom(&mut self, c: &Custom) -> std::fmt::Result {
+        match c {
+            Custom::WireSpec(s) => self.render_wire_spec(s),
+            Custom::Decimal => write!(self.buf, "Decimal"),
+        }
+    }
+
+    fn render_wire_spec(&mut self, s: &WireSpec) -> std::fmt::Result {
+        match &s.location {
+            super::WireLocation::Query => {
+                self.buf.write_str("Query<")?;
+                self.render_type(&s.underlying)?;
+                if let Some(name) = &s.name_override {
+                    self.buf.write_fmt(format_args!(", {name:#?}"))?;
+                }
+                self.buf.write_char('>')
+            }
+            super::WireLocation::Header => {
+                self.buf.write_str("Header<")?;
+                self.render_type(&s.underlying)?;
+                if let Some(name) = &s.name_override {
+                    self.buf.write_fmt(format_args!(", {name:#?}"))?;
+                }
+                self.buf.write_char('>')
+            }
+            super::WireLocation::PubSubAttr => {
+                self.buf.write_str("Attribute<")?;
+                self.render_type(&s.underlying)?;
+                if let Some(name) = &s.name_override {
+                    self.buf.write_fmt(format_args!(", {name:#?}"))?;
+                }
+                self.buf.write_char('>')
+            }
+            super::WireLocation::Cookie => {
+                self.buf.write_str("Cookie<")?;
+                self.render_type(&s.underlying)?;
+                if let Some(name) = &s.name_override {
+                    self.buf.write_fmt(format_args!(", {name:#?}"))?;
+                }
+                self.buf.write_char('>')
+            }
+            super::WireLocation::HttpStatus => {
+                // HttpStatus doesn't take generic parameters, it's just the union type itself
+                self.buf.write_str("HttpStatus")
+            }
+        }
+    }
+
+    fn render_generic(&mut self, g: &Generic) -> std::fmt::Result {
+        match g {
+            Generic::TypeParam(tp) => self.buf.write_fmt(format_args!("TypeParam#{}", tp.idx)),
+            Generic::Index(idx) => {
+                self.render_type(&idx.source)?;
+                self.buf.write_char('[')?;
+                self.render_type(&idx.index)?;
+                self.buf.write_char(']')
+            }
+            Generic::Mapped(m) => {
+                self.buf.write_str("{ [P in ")?;
+                self.render_type(&m.in_type)?;
+                self.buf.write_str("]: ")?;
+                self.render_type(&m.value_type)?;
+                self.buf.write_str(" }")
+            }
+            Generic::MappedKeyType(_) => self.buf.write_char('P'),
+            Generic::Keyof(k) => {
+                self.buf.write_str("keyof ")?;
+                self.render_type(&k.0)
+            }
+            Generic::Conditional(c) => {
+                self.render_type(&c.check_type)?;
+                self.buf.write_str(" extends ")?;
+                self.render_type(&c.extends_type)?;
+                self.buf.write_str(" ? ")?;
+                self.render_type(&c.true_type)?;
+                self.buf.write_str(" : ")?;
+                self.render_type(&c.false_type)
+            }
+            Generic::Inferred(i) => self.buf.write_fmt(format_args!("Inferred#{}", i.0)),
+            Generic::Intersection(i) => {
+                self.render_type(&i.x)?;
+                self.buf.write_str(" & ")?;
+                self.render_type(&i.y)
+            }
+        }
+    }
+}
diff --git a/tsparser/src/parser/types/utils.rs b/tsparser/src/parser/types/utils.rs
new file mode 100644
index 0000000000..0ea9c133aa
--- /dev/null
+++ b/tsparser/src/parser/types/utils.rs
@@ -0,0 +1,26 @@
+use crate::parser::types::{Basic, ResolveState, Type};
+
+pub fn unwrap_promise<'a>(state: &ResolveState, typ: &'a Type) -> &'a Type {
+    if let Type::Named(named) = &typ {
+        if named.obj.name.as_deref() == Some("Promise") && state.is_universe(named.obj.module_id) {
+            if let Some(t) = named.type_arguments.first() {
+                return t;
+            }
+        }
+    }
+    typ
+}
+
+pub fn drop_empty_or_void(typ: Type) -> Option<Type> {
+    match typ {
+        Type::Interface(iface) => {
+            if iface.fields.is_empty() && iface.index.is_none() {
+                None
+            } else {
+                Some(Type::Interface(iface))
+            }
+        }
+        Type::Basic(Basic::Void) => None,
+        _ => Some(typ),
+    }
+}
diff --git a/tsparser/src/parser/types/validation.rs b/tsparser/src/parser/types/validation.rs
new file mode 100644
index 0000000000..25950e4f75
--- /dev/null
+++ b/tsparser/src/parser/types/validation.rs
@@ -0,0 +1,439 @@
+use crate::encore::parser::schema::v1 as schema;
+use core::hash::{Hash, Hasher};
+use serde::Serialize;
+use std::{
+    error::Error,
+    fmt::{Display, Write},
+    ops::Deref,
+};
+
+use super::{Basic, Custom, Type};
+
+#[derive(Debug, Clone, Hash, Serialize, PartialEq, Eq)]
+pub enum Expr {
+    Rule(Rule),
+    And(Vec<Expr>),
+    Or(Vec<Expr>),
+}
+
+impl Display for Expr {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::Rule(r) => f.write_fmt(format_args!("{r}")),
+            Self::And(a) => {
+                f.write_char('(')?;
+                for (i, e) in a.iter().enumerate() {
+                    if i > 0 {
+                        f.write_str(" & ")?;
+                    }
+                    f.write_fmt(format_args!("{e}"))?;
+                }
+                f.write_char(')')
+            }
+            Self::Or(a) => {
+                f.write_char('(')?;
+                for (i, e) in a.iter().enumerate() {
+                    if i > 0 {
+                        f.write_str(" | ")?;
+                    }
+                    f.write_fmt(format_args!("{e}"))?;
+                }
+                f.write_char(')')
+            }
+        }
+    }
+}
+
+#[derive(Debug, Clone, Hash, Serialize, PartialEq, Eq)]
+pub enum Rule {
+    MinLen(u64),
+    MaxLen(u64),
+    MinVal(N),
+    MaxVal(N),
+    StartsWith(String),
+    EndsWith(String),
+    MatchesRegexp(String),
+    Is(Is),
+}
+
+impl Display for Rule {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::MinLen(n) => f.write_fmt(format_args!("MinLen<{n}>")),
+            Self::MaxLen(n) => f.write_fmt(format_args!("MaxLen<{n}>")),
+            Self::MinVal(n) => f.write_fmt(format_args!("Min<{n}>")),
+            Self::MaxVal(n) => f.write_fmt(format_args!("Max<{n}>")),
+            Self::StartsWith(s) => f.write_fmt(format_args!("StartsWith<{s:#?}>")),
+            Self::EndsWith(s) => f.write_fmt(format_args!("EndsWith<{s:#?}")),
+            Self::MatchesRegexp(s) => f.write_fmt(format_args!("MatchesRegexp<{s:#?}")),
+            Self::Is(Is::Email) => f.write_str("IsEmail"),
+            Self::Is(Is::Url) => f.write_str("IsURL"),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Hash, Serialize, PartialEq, Eq)]
+pub enum Is {
+    Email,
+    Url,
+}
+
+impl Rule {
+    pub fn merge_and(&self, other: &Self) -> Option<Self> {
+        use Rule::*;
+        Some(match (self, other) {
+            (MinLen(a), MinLen(b)) => MinLen((*a).max(*b)),
+            (MaxLen(a), MaxLen(b)) => MaxLen((*a).min(*b)),
+            (MinVal(a), MinVal(b)) => MinVal(N((*a).max(**b))),
+            (MaxVal(a), MaxVal(b)) => MaxVal(N((*a).min(**b))),
+            _ => return None,
+        })
+    }
+
+    pub fn merge_or(&self, other: &Self) -> Option<Self> {
+        use Rule::*;
+        Some(match (self, other) {
+            (MinLen(a), MinLen(b)) => MinLen((*a).min(*b)),
+            (MaxLen(a), MaxLen(b)) => MaxLen((*a).max(*b)),
+            (MinVal(a), MinVal(b)) => MinVal(N((*a).min(**b))),
+            (MaxVal(a), MaxVal(b)) => MaxVal(N((*a).max(**b))),
+            _ => return None,
+        })
+    }
+
+    pub fn to_pb(&self) -> schema::validation_rule::Rule {
+        use schema::validation_rule::Rule as VR;
+        match self {
+            Rule::MinLen(n) => VR::MinLen(*n),
+            Rule::MaxLen(n) => VR::MaxLen(*n),
+            Rule::MinVal(n) => VR::MinVal(**n),
+            Rule::MaxVal(n) => VR::MaxVal(**n),
+            Rule::StartsWith(str) => VR::StartsWith(str.clone()),
+            Rule::EndsWith(str) => VR::EndsWith(str.clone()),
+            Rule::MatchesRegexp(str) => VR::MatchesRegexp(str.clone()),
+            Rule::Is(is) => VR::Is(match is {
+                Is::Email => schema::validation_rule::Is::Email,
+                Is::Url => schema::validation_rule::Is::Url,
+            } as i32),
+        }
+    }
+
+    pub fn supports_type(&self, typ: &Type) -> bool {
+        // If this is a WireSpec, unwrap it as it is intended to be transparent.
+        let typ = match typ {
+            Type::Custom(Custom::WireSpec(spec)) => &spec.underlying,
+            _ => typ,
+        };
+
+        match self {
+            Self::MinLen(_) | Self::MaxLen(_) => {
+                matches!(typ, Type::Array(_) | Type::Basic(Basic::String))
+            }
+            Self::MinVal(_) | Self::MaxVal(_) => {
+                matches!(
+                    typ,
+                    Type::Basic(Basic::Number) | Type::Custom(Custom::Decimal)
+                )
+            }
+            Self::StartsWith(_)
+            | Self::EndsWith(_)
+            | Self::MatchesRegexp(_)
+            | Self::Is(Is::Email)
+            | Self::Is(Is::Url) => {
+                matches!(typ, Type::Basic(Basic::String))
+            }
+        }
+    }
+}
+
+impl Expr {
+    pub fn and(self, other: Self) -> Self {
+        match (self, other) {
+            (Expr::And(mut a), Expr::And(mut b)) => {
+                // Can we merge any of the rules into a?
+                a.append(&mut b);
+                Expr::And(a)
+            }
+            (Expr::And(mut a), b) => {
+                a.push(b);
+                Expr::And(a)
+            }
+            (a, Expr::And(mut b)) => {
+                b.insert(0, a);
+                Expr::And(b)
+            }
+            (a, b) => Expr::And(vec![a, b]),
+        }
+    }
+
+    pub fn or(self, other: Self) -> Self {
+        match (self, other) {
+            (Expr::Or(mut a), Expr::Or(mut b)) => {
+                a.append(&mut b);
+                Expr::Or(a)
+            }
+            (Expr::Or(mut a), b) => {
+                a.push(b);
+                Expr::Or(a)
+            }
+            (a, Expr::Or(mut b)) => {
+                b.insert(0, a);
+                Expr::Or(b)
+            }
+            (a, b) => Expr::Or(vec![a, b]),
+        }
+    }
+
+    pub fn rule(rule: Rule) -> Self {
+        Expr::Rule(rule)
+    }
+
+    pub fn simplify(self) -> Self {
+        match self {
+            Self::And(mut exprs) => {
+                let mut i = 0;
+                let mut size = exprs.len();
+                while i < size {
+                    if !matches!(&exprs[i], Expr::Rule(_)) {
+                        i += 1;
+                        continue;
+                    };
+
+                    let j = i + 1;
+                    let (a, b) = exprs.split_at_mut(j);
+                    let Expr::Rule(i_rule) = &mut a[i] else {
+                        panic!("logic error");
+                    };
+
+                    let mut b_size = b.len();
+                    let mut b_idx = 0;
+                    'outer: while b_idx < b_size {
+                        if let Expr::Rule(other) = &b[b_idx] {
+                            if let Some(merged) = i_rule.merge_and(other) {
+                                *i_rule = merged;
+
+                                // Swap this element to the end of b
+                                // and update the sizes.
+                                b.swap(b_idx, b_size - 1);
+                                size -= 1;
+                                b_size -= 1;
+
+                                // Don't increment the index since we now have
+                                // a new element at the current index.
+                                continue 'outer;
+                            }
+                        }
+                        b_idx += 1;
+                    }
+
+                    i += 1;
+                }
+
+                exprs.truncate(size);
+                if exprs.len() == 1 {
+                    exprs.pop().unwrap()
+                } else {
+                    Self::And(exprs)
+                }
+            }
+
+            Self::Or(mut exprs) => {
+                let mut i = 0;
+                let mut size = exprs.len();
+                while i < size {
+                    if !matches!(&exprs[i], Expr::Rule(_)) {
+                        i += 1;
+                        continue;
+                    };
+
+                    let j = i + 1;
+                    let (a, b) = exprs.split_at_mut(j);
+                    let Expr::Rule(i_rule) = &mut a[i] else {
+                        panic!("logic error");
+                    };
+
+                    let mut b_size = b.len();
+                    let mut b_idx = 0;
+                    'outer: while b_idx < b_size {
+                        if let Expr::Rule(other) = &b[b_idx] {
+                            if let Some(merged) = i_rule.merge_or(other) {
+                                *i_rule = merged;
+
+                                // Swap this element to the end of b
+                                // and update the sizes.
+                                b.swap(b_idx, b_size - 1);
+                                size -= 1;
+                                b_size -= 1;
+
+                                // Don't increment the index since we now have
+                                // a new element at the current index.
+                                continue 'outer;
+                            }
+                        }
+                        b_idx += 1;
+                    }
+
+                    i += 1;
+                }
+
+                exprs.truncate(size);
+                if exprs.len() == 1 {
+                    exprs.pop().unwrap()
+                } else {
+                    Self::Or(exprs)
+                }
+            }
+
+            _ => self,
+        }
+    }
+
+    pub fn to_pb(&self) -> schema::ValidationExpr {
+        use schema::validation_expr::Expr as VE;
+
+        schema::ValidationExpr {
+            expr: Some(match self {
+                Expr::Rule(r) => VE::Rule(schema::ValidationRule {
+                    rule: Some(r.to_pb()),
+                }),
+                Expr::And(exprs) => VE::And(schema::validation_expr::And {
+                    exprs: exprs.iter().map(Self::to_pb).collect(),
+                }),
+                Expr::Or(exprs) => VE::Or(schema::validation_expr::Or {
+                    exprs: exprs.iter().map(Self::to_pb).collect(),
+                }),
+            }),
+        }
+    }
+
+    pub fn supports_type<'a>(
+        &'a self,
+        typ: &'a Type,
+    ) -> Result<(), UnsupportedValidationsError<'a>> {
+        match self {
+            Self::And(exprs) | Self::Or(exprs) => {
+                let mut errors = Vec::new();
+                for expr in exprs {
+                    if let Err(e) = expr.supports_type(typ) {
+                        errors.extend(e.0);
+                    }
+                }
+                if errors.is_empty() {
+                    Ok(())
+                } else {
+                    Err(UnsupportedValidationsError(errors))
+                }
+            }
+            Self::Rule(rule) => {
+                if !rule.supports_type(typ) {
+                    let v = UnsupportedValidation { typ, rule };
+                    Err(UnsupportedValidationsError(vec![v]))
+                } else {
+                    Ok(())
+                }
+            }
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct UnsupportedValidation<'a> {
+    pub typ: &'a Type,
+    pub rule: &'a Rule,
+}
+
+#[derive(Debug, Clone)]
+pub struct UnsupportedValidationsError<'a>(pub Vec<UnsupportedValidation<'a>>);
+
+impl Display for UnsupportedValidation<'_> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_fmt(format_args!(
+            "{} cannot be applied to {}",
+            self.rule, self.typ
+        ))
+    }
+}
+
+impl Display for UnsupportedValidationsError<'_> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        if self.0.len() == 1 {
+            write!(f, "unsupported validation: {}", &self.0[0])
+        } else {
+            f.write_str("unsupported validation: ")?;
+            for (i, rule) in self.0.iter().enumerate() {
+                if i > 0 {
+                    f.write_str(", ")?;
+                }
+                write!(f, "{rule}")?;
+            }
+            Ok(())
+        }
+    }
+}
+
+impl Error for UnsupportedValidationsError<'_> {}
+impl Error for UnsupportedValidation<'_> {}
+
+#[derive(Debug, Clone, Copy, Serialize)]
+pub struct N(pub f64);
+
+impl Display for N {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.0)
+    }
+}
+
+impl Deref for N {
+    type Target = f64;
+
+    fn deref(&self) -> &f64 {
+        &self.0
+    }
+}
+
+impl PartialEq for N {
+    fn eq(&self, other: &Self) -> bool {
+        self.0 == other.0
+    }
+}
+
+impl Eq for N {}
+
+impl Hash for N {
+    fn hash<H: Hasher>(&self, h: &mut H) {
+        if self.0 == 0.0f64 {
+            // There are 2 zero representations, +0 and -0, which
+            // compare equal but have different bits. We use the +0 hash
+            // for both so that hash(+0) == hash(-0).
+            0.0f64.to_bits().hash(h);
+        } else {
+            self.0.to_bits().hash(h);
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    #[test]
+    fn test_simplify() {
+        use super::*;
+
+        {
+            let expr = Expr::Or(vec![
+                Expr::Rule(Rule::MinLen(10)),
+                Expr::Rule(Rule::MinLen(30)),
+            ]);
+            let simplified = expr.simplify();
+            assert_eq!(simplified, Expr::Rule(Rule::MinLen(10)));
+        }
+
+        {
+            let expr = Expr::And(vec![
+                Expr::Rule(Rule::MaxVal(N(10.0))),
+                Expr::Rule(Rule::MaxVal(N(30.0))),
+            ]);
+            let simplified = expr.simplify();
+            assert_eq!(simplified, Expr::Rule(Rule::MaxVal(N(10.0))));
+        }
+    }
+}
diff --git a/tsparser/src/parser/types/visitor.rs b/tsparser/src/parser/types/visitor.rs
new file mode 100644
index 0000000000..3b13eb8a4f
--- /dev/null
+++ b/tsparser/src/parser/types/visitor.rs
@@ -0,0 +1,563 @@
+use std::collections::HashSet;
+
+use litparser::Sp;
+
+use super::{
+    validation, Array, Basic, ClassType, Conditional, Custom, EnumType, Generic, Index, Inferred,
+    Interface, InterfaceField, Intersection, Keyof, Literal, Mapped, MappedKeyType, Named,
+    ObjectId, Optional, ResolveState, This, Tuple, Type, TypeParam, Union, Validated, WireSpec,
+};
+
+pub trait Visit {
+    fn resolve_state(&self) -> &ResolveState;
+    fn seen_decls(&mut self) -> &mut HashSet<ObjectId>;
+
+    #[inline]
+    fn visit_basic(&mut self, node: &Basic) {
+        <Basic as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_array(&mut self, node: &Array) {
+        <Array as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_interface(&mut self, node: &Interface) {
+        <Interface as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_interface_field(&mut self, node: &InterfaceField) {
+        <InterfaceField as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_union(&mut self, node: &Union) {
+        <Union as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_tuple(&mut self, node: &Tuple) {
+        <Tuple as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_literal(&mut self, node: &Literal) {
+        <Literal as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_class(&mut self, node: &ClassType) {
+        <ClassType as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_enum(&mut self, node: &EnumType) {
+        <EnumType as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_named(&mut self, node: &Named) {
+        <Named as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_optional(&mut self, node: &Optional) {
+        <Optional as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_this(&mut self, node: &This) {
+        <This as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_validation(&mut self, node: &validation::Expr) {
+        <validation::Expr as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_validated(&mut self, node: &Validated) {
+        <Validated as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_type(&mut self, node: &Type) {
+        <Type as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_types(&mut self, node: &[Type]) {
+        <[Type] as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_generic(&mut self, node: &Generic) {
+        <Generic as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_type_param(&mut self, node: &TypeParam) {
+        <TypeParam as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_index(&mut self, node: &Index) {
+        <Index as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_mapped(&mut self, node: &Mapped) {
+        <Mapped as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_mapped_key_type(&mut self, node: &MappedKeyType) {
+        <MappedKeyType as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_keyof(&mut self, node: &Keyof) {
+        <Keyof as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_conditional(&mut self, node: &Conditional) {
+        <Conditional as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_intersection(&mut self, node: &Intersection) {
+        <Intersection as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_inferred(&mut self, node: &Inferred) {
+        <Inferred as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_custom(&mut self, node: &Custom) {
+        <Custom as VisitWith<Self>>::visit_children_with(node, self)
+    }
+
+    #[inline]
+    fn visit_wire_spec(&mut self, node: &WireSpec) {
+        <WireSpec as VisitWith<Self>>::visit_children_with(node, self)
+    }
+}
+
+pub trait VisitWith<V: ?Sized + Visit> {
+    fn visit_with(&self, visitor: &mut V);
+    fn visit_children_with(&self, visitor: &mut V);
+}
+
+impl<V> VisitWith<V> for This
+where
+    V: ?Sized + Visit,
+{
+    #[inline]
+    fn visit_with(&self, _visitor: &mut V) {}
+
+    #[inline]
+    fn visit_children_with(&self, _visitor: &mut V) {}
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Basic {
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_basic(visitor, self)
+    }
+    fn visit_children_with(&self, _visitor: &mut V) {}
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Interface {
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_interface(visitor, self)
+    }
+
+    fn visit_children_with(&self, visitor: &mut V) {
+        self.fields
+            .iter()
+            .for_each(|item| <InterfaceField as VisitWith<V>>::visit_with(item, visitor))
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for InterfaceField {
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_interface_field(visitor, self)
+    }
+
+    fn visit_children_with(&self, visitor: &mut V) {
+        <Type as VisitWith<V>>::visit_with(&self.typ, visitor)
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Array {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_array(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <Type as VisitWith<V>>::visit_with(&self.0, visitor)
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Union {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_union(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        self.types
+            .iter()
+            .for_each(|item| <Type as VisitWith<V>>::visit_with(item, visitor))
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Tuple {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_tuple(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        self.types
+            .iter()
+            .for_each(|item| <Type as VisitWith<V>>::visit_with(item, visitor))
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Optional {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_optional(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <Type as VisitWith<V>>::visit_with(&self.0, visitor)
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for validation::Expr {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_validation(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, _visitor: &mut V) {}
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Validated {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_validated(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <Type as VisitWith<V>>::visit_with(&self.typ, visitor);
+        <validation::Expr as VisitWith<V>>::visit_with(&self.expr, visitor);
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Literal {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_literal(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, _visitor: &mut V) {}
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for ClassType {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_class(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, _visitor: &mut V) {}
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for EnumType {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_enum(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, _visitor: &mut V) {}
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for TypeParam {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_type_param(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        if let Some(constraint) = &self.constraint {
+            <Type as VisitWith<V>>::visit_with(constraint, visitor);
+        }
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Index {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_index(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <Type as VisitWith<V>>::visit_with(&self.source, visitor);
+        <Type as VisitWith<V>>::visit_with(&self.index, visitor);
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Mapped {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_mapped(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <Type as VisitWith<V>>::visit_with(&self.in_type, visitor);
+        <Type as VisitWith<V>>::visit_with(&self.value_type, visitor);
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for MappedKeyType {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_mapped_key_type(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, _visitor: &mut V) {}
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Keyof {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_keyof(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <Type as VisitWith<V>>::visit_with(&self.0, visitor);
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Conditional {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_conditional(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <Type as VisitWith<V>>::visit_with(&self.check_type, visitor);
+        <Type as VisitWith<V>>::visit_with(&self.extends_type, visitor);
+        <Type as VisitWith<V>>::visit_with(&self.true_type, visitor);
+        <Type as VisitWith<V>>::visit_with(&self.false_type, visitor);
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Intersection {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_intersection(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <Type as VisitWith<V>>::visit_with(&self.x, visitor);
+        <Type as VisitWith<V>>::visit_with(&self.y, visitor);
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Inferred {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_inferred(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, _visitor: &mut V) {}
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Named {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_named(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        // Only recurse if we haven't seen this object before, to avoid infinite recursion
+        // with recursive types.
+        if visitor.seen_decls().insert(self.obj.id) {
+            let underlying = self.underlying(visitor.resolve_state());
+            <Type as VisitWith<V>>::visit_with(&underlying, visitor);
+        }
+
+        self.type_arguments
+            .iter()
+            .for_each(|item| <Type as VisitWith<V>>::visit_with(item, visitor))
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Generic {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_generic(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        match self {
+            Generic::TypeParam(inner) => <TypeParam as VisitWith<V>>::visit_with(inner, visitor),
+            Generic::Index(inner) => <Index as VisitWith<V>>::visit_with(inner, visitor),
+            Generic::Mapped(inner) => <Mapped as VisitWith<V>>::visit_with(inner, visitor),
+            Generic::MappedKeyType(inner) => {
+                <MappedKeyType as VisitWith<V>>::visit_with(inner, visitor)
+            }
+            Generic::Keyof(inner) => <Keyof as VisitWith<V>>::visit_with(inner, visitor),
+            Generic::Conditional(inner) => {
+                <Conditional as VisitWith<V>>::visit_with(inner, visitor)
+            }
+            Generic::Intersection(inner) => {
+                <Intersection as VisitWith<V>>::visit_with(inner, visitor)
+            }
+            Generic::Inferred(inner) => <Inferred as VisitWith<V>>::visit_with(inner, visitor),
+        }
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Custom {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_custom(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        match self {
+            Custom::WireSpec(inner) => <WireSpec as VisitWith<V>>::visit_with(inner, visitor),
+            Custom::Decimal => {} // No children to visit
+        }
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for WireSpec {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_wire_spec(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <Type as VisitWith<V>>::visit_with(&self.underlying, visitor)
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for Type {
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_type(visitor, self)
+    }
+
+    fn visit_children_with(&self, visitor: &mut V) {
+        match self {
+            Self::Basic(basic) => <Basic as VisitWith<V>>::visit_with(basic, visitor),
+            Self::Array(array) => <Array as VisitWith<V>>::visit_with(array, visitor),
+            Type::Interface(interface) => {
+                <Interface as VisitWith<V>>::visit_with(interface, visitor)
+            }
+            Type::Union(union) => <Union as VisitWith<V>>::visit_with(union, visitor),
+            Type::Tuple(tuple) => <Tuple as VisitWith<V>>::visit_with(tuple, visitor),
+            Type::Literal(literal) => <Literal as VisitWith<V>>::visit_with(literal, visitor),
+            Type::Class(class_type) => <ClassType as VisitWith<V>>::visit_with(class_type, visitor),
+            Type::Enum(enum_type) => <EnumType as VisitWith<V>>::visit_with(enum_type, visitor),
+            Type::Named(named) => <Named as VisitWith<V>>::visit_with(named, visitor),
+            Type::Optional(opt) => <Optional as VisitWith<V>>::visit_with(opt, visitor),
+            Type::This(t) => <This as VisitWith<V>>::visit_with(t, visitor),
+            Type::Generic(generic) => <Generic as VisitWith<V>>::visit_with(generic, visitor),
+            Type::Validation(expr) => <validation::Expr as VisitWith<V>>::visit_with(expr, visitor),
+            Type::Validated(expr) => <Validated as VisitWith<V>>::visit_with(expr, visitor),
+            Type::Custom(custom) => <Custom as VisitWith<V>>::visit_with(custom, visitor),
+        }
+    }
+}
+
+impl<V: ?Sized + Visit> VisitWith<V> for [Type] {
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <V as Visit>::visit_types(visitor, self)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        self.iter()
+            .for_each(|item| <Type as VisitWith<V>>::visit_with(item, visitor))
+    }
+}
+
+impl<V, T> VisitWith<V> for std::boxed::Box<T>
+where
+    V: ?Sized + Visit,
+    T: VisitWith<V>,
+{
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <T as VisitWith<V>>::visit_with(&**self, visitor)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <T as VisitWith<V>>::visit_children_with(&**self, visitor)
+    }
+}
+
+impl<V, T> VisitWith<V> for Sp<T>
+where
+    V: ?Sized + Visit,
+    T: VisitWith<V>,
+{
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <T as VisitWith<V>>::visit_with(&**self, visitor)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <T as VisitWith<V>>::visit_children_with(&**self, visitor)
+    }
+}
+
+impl<V, T> VisitWith<V> for std::vec::Vec<T>
+where
+    V: ?Sized + Visit,
+    [T]: VisitWith<V>,
+{
+    #[inline]
+    fn visit_with(&self, visitor: &mut V) {
+        <[T] as VisitWith<V>>::visit_with(self, visitor)
+    }
+
+    #[inline]
+    fn visit_children_with(&self, visitor: &mut V) {
+        <[T] as VisitWith<V>>::visit_children_with(self, visitor)
+    }
+}
diff --git a/tsparser/src/parser/universe.ts b/tsparser/src/parser/universe.ts
new file mode 100644
index 0000000000..ccd9b6ee62
--- /dev/null
+++ b/tsparser/src/parser/universe.ts
@@ -0,0 +1,63 @@
+
+export class Promise<T> { }
+
+/**
+ * Make all properties in T optional
+ */
+export type Partial<T> = {
+  [P in keyof T]?: T[P];
+};
+
+/**
+ * Make all properties in T required
+ */
+export type Required<T> = {
+  [P in keyof T]-?: T[P];
+};
+
+/**
+ * Make all properties in T readonly
+ */
+export type Readonly<T> = {
+  readonly [P in keyof T]: T[P];
+};
+
+/**
+ * From T, pick a set of properties whose keys are in the union K
+ */
+export type Pick<T, K extends keyof T> = {
+  [P in K]: T[P];
+};
+
+/**
+ * Construct a type with a set of properties K of type T
+ */
+export type Record<K extends keyof any, T> = {
+  [P in K]: T;
+};
+
+/**
+ * Exclude from T those types that are assignable to U
+ */
+export type Exclude<T, U> = T extends U ? never : T;
+
+/**
+ * Extract from T those types that are assignable to U
+ */
+export type Extract<T, U> = T extends U ? T : never;
+
+/**
+ * Construct a type with the properties of T except for those in type K.
+ */
+export type Omit<T, K extends keyof any> = Pick<T, Exclude<keyof T, K>>;
+
+/**
+ * Exclude null and undefined from T
+ */
+export type NonNullable<T> = T & {};
+
+/** Builtin date class. */
+export class Date { };
+
+/** Builtin array type */
+export type Array<T> = T[];
diff --git a/tsparser/src/parser/usageparser/mod.rs b/tsparser/src/parser/usageparser/mod.rs
new file mode 100644
index 0000000000..cd47298836
--- /dev/null
+++ b/tsparser/src/parser/usageparser/mod.rs
@@ -0,0 +1,715 @@
+use std::collections::HashMap;
+
+use swc_common::errors::HANDLER;
+use swc_common::sync::Lrc;
+use swc_common::Spanned;
+use swc_ecma_ast as ast;
+use swc_ecma_visit::fields::{
+    CallExprField, CalleeField, MemberExprField, NewExprField, TaggedTplField,
+};
+use swc_ecma_visit::{AstNodePath, AstParentNodeRef, VisitAstPath, VisitWithPath};
+
+use crate::parser::module_loader::{Module, ModuleId, ModuleLoader};
+use crate::parser::resourceparser::bind::Bind;
+use crate::parser::resources::{apis, infra, Resource};
+use crate::parser::Range;
+
+use super::types::TypeChecker;
+
+#[derive(Debug)]
+pub struct UsageExpr {
+    pub range: Range,
+    pub bind: Lrc<Bind>,
+    pub kind: UsageExprKind,
+}
+
+impl Spanned for UsageExpr {
+    fn span(&self) -> swc_common::Span {
+        self.range.to_span()
+    }
+}
+
+#[derive(Debug)]
+pub enum UsageExprKind {
+    /// A field on a resource being accessed.
+    FieldAccess(FieldAccess),
+
+    /// A method on a resource being called.
+    MethodCall(MethodCall),
+
+    /// A method on a resource being called, as a tagged template literal.
+    TemplateCall(TemplateCall),
+
+    /// A resource being called as a function.
+    Callee(Callee),
+
+    /// A resource being passed as a function argument.
+    CallArg(CallArg),
+
+    /// A resource passed as a constructor argument.
+    ConstructorArg(ConstructorArg),
+
+    /// Any other resource usage.
+    Other(Other),
+}
+
+#[derive(Debug)]
+pub struct MethodCall {
+    pub method: ast::Ident,
+    pub call: ast::CallExpr,
+}
+
+#[derive(Debug)]
+pub struct TemplateCall {
+    pub method: ast::Ident,
+    pub tpl: ast::TaggedTpl,
+}
+
+#[derive(Debug)]
+pub struct FieldAccess {
+    pub field: ast::Ident,
+}
+
+#[derive(Debug)]
+pub struct Callee {
+    _call: ast::CallExpr,
+}
+
+#[derive(Debug)]
+pub struct CallArg {
+    pub arg_idx: usize,
+    _call: ast::CallExpr,
+}
+
+#[derive(Debug)]
+pub struct ConstructorArg {
+    pub arg_idx: usize,
+    _call: ast::NewExpr,
+}
+
+#[derive(Debug)]
+pub struct Other {
+    _enclosing_expr: ast::Expr,
+}
+
+pub struct UsageResolver<'a> {
+    module_loader: &'a ModuleLoader,
+    type_checker: &'a TypeChecker,
+    resources: &'a [Resource],
+    binds_by_module: HashMap<ModuleId, Vec<Lrc<Bind>>>,
+}
+
+impl<'a> UsageResolver<'a> {
+    pub fn new(
+        module_loader: &'a ModuleLoader,
+        type_checker: &'a TypeChecker,
+        resources: &'a [Resource],
+        binds: &[Lrc<Bind>],
+    ) -> Self {
+        let mut resolver = Self {
+            module_loader,
+            type_checker,
+            resources,
+            binds_by_module: HashMap::new(),
+        };
+
+        for b in binds {
+            resolver
+                .binds_by_module
+                .entry(b.module_id)
+                .or_default()
+                .push(b.clone());
+        }
+
+        resolver
+    }
+
+    pub fn scan_usage_exprs(&self, module: &Module) -> Vec<UsageExpr> {
+        let external = self.external_binds_to_scan_for(module);
+        let internal = self.internal_binds_to_scan_for(module);
+        let combined: Vec<BindToScan> = external.into_iter().chain(internal).collect();
+
+        let mut visitor = UsageVisitor::new(&combined);
+        module
+            .ast
+            .visit_with_path(&mut visitor, &mut Default::default());
+
+        visitor.usages
+    }
+
+    /// external_binds_to_scan_for computes the external binds to scan for given a module.
+    fn external_binds_to_scan_for(&self, module: &Module) -> Vec<BindToScan<'_>> {
+        let mut external = Vec::new();
+
+        for imp in module.imports() {
+            // Type-only imports don't contribute to usage.
+            if imp.type_only {
+                continue;
+            }
+
+            // Resolve the module
+            let resolved_module = match self
+                .module_loader
+                .resolve_import(&module.swc_file_path, &imp.src.value)
+            {
+                Ok(None) => continue,
+                Ok(Some(resolved_module)) => resolved_module,
+                Err(err) => {
+                    HANDLER.with(|handler| {
+                        handler.span_err(err.span().unwrap_or_else(|| imp.span()), &err.msg())
+                    });
+                    continue;
+                }
+            };
+
+            let resolved_binds = self.binds_by_module.get(&resolved_module.id);
+            for names in &imp.specifiers {
+                match names {
+                    ast::ImportSpecifier::Named(named) => {
+                        // src_name is the original name of the bind in the module it was defined.
+                        let src_name: &str = match &named.imported {
+                            Some(ast::ModuleExportName::Ident(id)) => id.sym.as_ref(),
+                            Some(ast::ModuleExportName::Str(id)) => id.value.as_ref(),
+                            None => named.local.sym.as_ref(),
+                        };
+
+                        // found_bind is the matching bind in the resolved module, if any.
+                        let found_bind = resolved_binds
+                            .into_iter()
+                            .flatten()
+                            .find(|b| b.name.as_ref().is_some_and(|i| i == src_name));
+
+                        if let Some(bind) = found_bind {
+                            external.push(BindToScan {
+                                bound_name: named.local.to_id(),
+                                selector: None,
+                                bind: bind.to_owned(),
+                            });
+                        }
+                    }
+
+                    spec @ ast::ImportSpecifier::Default(_)
+                    | spec @ ast::ImportSpecifier::Namespace(_) => {
+                        let local_name = match &spec {
+                            ast::ImportSpecifier::Default(default) => &default.local,
+                            ast::ImportSpecifier::Namespace(ns) => &ns.local,
+                            _ => unreachable!(),
+                        };
+
+                        for bind in resolved_binds.into_iter().flatten() {
+                            // don't add anonymous binds e.g `const _ = new ...`
+                            if bind.name.is_some() {
+                                external.push(BindToScan {
+                                    bound_name: local_name.to_id(),
+                                    selector: bind.name.as_deref(),
+                                    bind: bind.to_owned(),
+                                });
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        external
+    }
+
+    /// internal_binds_to_scan_for computes the internal binds to scan for given a module.
+    fn internal_binds_to_scan_for(&self, module: &Module) -> Vec<BindToScan<'_>> {
+        let mut internal = Vec::new();
+
+        if let Some(module_binds) = self.binds_by_module.get(&module.id) {
+            for b in module_binds {
+                if let Some(id) = &b.internal_bound_id {
+                    internal.push(BindToScan {
+                        bound_name: id.to_owned(),
+                        selector: None,
+                        bind: b.to_owned(),
+                    });
+                }
+            }
+        }
+
+        internal
+    }
+}
+
+#[derive(Debug)]
+pub enum Usage {
+    CallEndpoint(apis::api::CallEndpointUsage),
+    PublishTopic(infra::pubsub_topic::PublishUsage),
+    AccessDatabase(infra::sqldb::AccessDatabaseUsage),
+    Bucket(infra::objects::BucketUsage),
+}
+
+pub struct ResolveUsageData<'a> {
+    pub module: &'a Lrc<Module>,
+    pub type_checker: &'a TypeChecker,
+    pub expr: &'a UsageExpr,
+    pub resources: &'a [Resource],
+}
+
+impl UsageResolver<'_> {
+    pub fn resolve_usage(&self, module: &Lrc<Module>, exprs: &[UsageExpr]) -> Vec<Usage> {
+        let mut usages = Vec::new();
+        for expr in exprs {
+            let data = ResolveUsageData {
+                module,
+                type_checker: self.type_checker,
+                expr,
+                resources: self.resources,
+            };
+            match &expr.bind.resource {
+                Resource::APIEndpoint(ep) => {
+                    if let Some(usage) = apis::api::resolve_endpoint_usage(&data, ep.clone()) {
+                        usages.push(usage)
+                    }
+                }
+                Resource::ServiceClient(client) => {
+                    if let Some(u) =
+                        apis::service_client::resolve_service_client_usage(&data, client.clone())
+                    {
+                        usages.push(u)
+                    }
+                }
+                Resource::PubSubTopic(topic) => {
+                    if let Some(u) = infra::pubsub_topic::resolve_topic_usage(&data, topic.clone())
+                    {
+                        usages.push(u)
+                    }
+                }
+                Resource::SQLDatabase(db) => {
+                    if let Some(u) = infra::sqldb::resolve_database_usage(&data, db.clone()) {
+                        usages.push(u)
+                    }
+                }
+                Resource::Bucket(bkt) => {
+                    if let Some(u) = infra::objects::resolve_bucket_usage(&data, bkt.clone()) {
+                        usages.push(u)
+                    }
+                }
+                _ => {}
+            }
+        }
+
+        usages
+    }
+}
+
+#[derive(Debug, PartialEq)]
+struct BindToScan<'a> {
+    /// The bound name within the module being parsed.
+    /// If [selector] is None it's the id of the bind itself (`import { Name } from 'module'`).
+    /// Otherwise it's the id of the module (`import module from 'module'`), and the specific
+    /// bind's name is found in [selector].
+    bound_name: ast::Id,
+
+    /// The selector within the bound name, in the case of module imports.
+    selector: Option<&'a str>,
+
+    /// The bind itself.
+    bind: Lrc<Bind>,
+}
+
+struct UsageVisitor<'a> {
+    binds: HashMap<ast::Id, &'a BindToScan<'a>>,
+    usages: Vec<UsageExpr>,
+}
+
+impl<'a> UsageVisitor<'a> {
+    pub fn new(binds: &'a [BindToScan]) -> Self {
+        let mut map = HashMap::with_capacity(binds.len());
+        for b in binds {
+            map.insert(b.bound_name.clone(), b);
+        }
+
+        Self {
+            binds: map,
+            usages: Vec::new(),
+        }
+    }
+
+    /// Report whether the given id represents the bind definition itself.
+    fn is_bind_def(&self, bind: &Bind, id: &ast::Ident) -> bool {
+        bind.range.is_some_and(|r| r.contains(&id.span.into()))
+    }
+
+    /// Report whether the given path represents an import declaration.
+    fn is_import_def(&self, path: &AstNodePath) -> bool {
+        for k in path.kinds().iter() {
+            if let swc_ecma_visit::AstParentKind::ImportDecl(_) = k {
+                return true;
+            }
+        }
+        false
+    }
+
+    fn classify_usage(&self, bind: Lrc<Bind>, path: &AstNodePath) -> Option<UsageExpr> {
+        let idx = path.len() - 1;
+        let parent = path.get(idx - 1);
+        let grandparent = path.get(idx - 2);
+
+        match parent {
+            Some(AstParentNodeRef::MemberExpr(sel, MemberExprField::Obj)) => {
+                // We have a member expression, where the object ("foo" in foo.bar) is the bind.
+                // Ensure "bar" is a static identifier and not a private field or a computed property.
+                match &sel.prop {
+                    ast::MemberProp::PrivateName(_) => {
+                        // self.errs.emit(
+                        //     private.span.into(),
+                        //     "cannot use private member for resource",
+                        //     Error,
+                        // );
+                        None
+                    }
+                    ast::MemberProp::Computed(_) => {
+                        // self.errs.emit(
+                        //     computed.span.into(),
+                        //     "cannot use computed member for resource",
+                        //     Error,
+                        // );
+                        None
+                    }
+                    ast::MemberProp::Ident(id) => {
+                        // bind.SomeField or bind.SomeField() or bind.SomeField`foo`
+
+                        if let Some(AstParentNodeRef::CallExpr(call, CallExprField::Callee)) =
+                            path.get(idx - 4)
+                        {
+                            Some(UsageExpr {
+                                range: call.span.into(),
+                                bind: bind.clone(),
+                                kind: UsageExprKind::MethodCall(MethodCall {
+                                    call: (*call).to_owned(),
+                                    method: id.to_owned(),
+                                }),
+                            })
+                        } else if let Some(AstParentNodeRef::TaggedTpl(tpl, TaggedTplField::Tag)) =
+                            path.get(idx - 3)
+                        {
+                            Some(UsageExpr {
+                                range: tpl.span.into(),
+                                bind: bind.clone(),
+                                kind: UsageExprKind::TemplateCall(TemplateCall {
+                                    method: id.to_owned(),
+                                    tpl: (*tpl).to_owned(),
+                                }),
+                            })
+                        } else {
+                            Some(UsageExpr {
+                                range: sel.span.into(),
+                                bind: bind.clone(),
+                                kind: UsageExprKind::FieldAccess(FieldAccess {
+                                    field: id.to_owned(),
+                                }),
+                            })
+                        }
+                    }
+                }
+            }
+
+            Some(AstParentNodeRef::Callee(_, CalleeField::Expr)) => {
+                // This bind is being called as a function.
+                if let Some(AstParentNodeRef::CallExpr(call, _)) = grandparent {
+                    Some(UsageExpr {
+                        range: call.span.into(),
+                        bind: bind.clone(),
+                        kind: UsageExprKind::Callee(Callee {
+                            _call: (*call).to_owned(),
+                        }),
+                    })
+                } else {
+                    // TODO emit error (parent of Callee should always be a Call)
+                    None
+                }
+            }
+
+            _ => {
+                match grandparent {
+                    // The bind is being passed as an argument to a function.
+                    Some(AstParentNodeRef::CallExpr(call, CallExprField::Args(idx))) => {
+                        Some(UsageExpr {
+                            range: call.span.into(),
+                            bind: bind.clone(),
+                            kind: UsageExprKind::CallArg(CallArg {
+                                _call: (*call).to_owned(),
+                                arg_idx: *idx,
+                            }),
+                        })
+                    }
+
+                    Some(AstParentNodeRef::NewExpr(new, NewExprField::Args(idx))) => {
+                        Some(UsageExpr {
+                            range: new.span.into(),
+                            bind: bind.clone(),
+                            kind: UsageExprKind::ConstructorArg(ConstructorArg {
+                                _call: (*new).to_owned(),
+                                arg_idx: *idx,
+                            }),
+                        })
+                    }
+
+                    // Some other expression.
+                    _ => {
+                        // Find the largest enclosing expression.
+                        let enclosing = path.iter().find_map(|node| match node {
+                            AstParentNodeRef::Expr(expr, _) => Some(*expr),
+                            _ => None,
+                        });
+                        enclosing.map(|enclosing| UsageExpr {
+                            range: enclosing.span().into(),
+                            bind: bind.clone(),
+                            kind: UsageExprKind::Other(Other {
+                                _enclosing_expr: enclosing.to_owned(),
+                            }),
+                        })
+                    }
+                }
+            }
+        }
+    }
+}
+
+impl VisitAstPath for UsageVisitor<'_> {
+    fn visit_ident<'ast: 'r, 'r>(&mut self, n: &'ast ast::Ident, path: &mut AstNodePath<'r>) {
+        if let Some(b) = self.binds.get(&n.to_id()) {
+            // If this ident represents the bind's definition itself, ignore it.
+            if self.is_bind_def(&b.bind, n) {
+                return;
+            }
+
+            // If this ident is part of an import declaration we don't consider that a usage.
+            if self.is_import_def(path) {
+                return;
+            }
+
+            if let Some(u) = self.classify_usage(b.bind.clone(), path) {
+                self.usages.push(u);
+            }
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use assert_fs::fixture::PathChild;
+    use assert_fs::TempDir;
+    use std::path::PathBuf;
+    use std::rc::Rc;
+
+    use assert_matches::assert_matches;
+    use swc_common::errors::Handler;
+    use swc_common::{Globals, SourceMap, DUMMY_SP, GLOBALS};
+
+    use crate::parser::parser::ParseContext;
+    use crate::parser::resourceparser::bind::BindKind;
+    use crate::parser::resources::apis::api::{Endpoint, Method, Methods};
+    use crate::parser::resources::apis::encoding::{
+        EndpointEncoding, RequestEncoding, ResponseEncoding,
+    };
+    use crate::parser::resources::Resource;
+    use crate::parser::respath::Path;
+    use crate::testutil::testresolve::TestResolver;
+    use crate::testutil::JS_RUNTIME_PATH;
+
+    use super::*;
+
+    #[test]
+    fn test_scan_external_binds() {
+        let globals = Globals::new();
+        GLOBALS.set(&globals, || {
+            let ar = txtar::from_str(
+                "
+-- foo.ts --
+import { Bar } from './bar.ts';
+-- bar.ts --
+export const Bar = 5;
+        ",
+            );
+
+            let base = PathBuf::from("/dummy");
+            let resolver = Box::new(TestResolver::new(base.to_path_buf(), ar.clone()));
+            let tmp = TempDir::new().unwrap();
+            let app_root = tmp.child("app_root").to_path_buf();
+            let cm: Rc<SourceMap> = Default::default();
+            let errs = Rc::new(Handler::with_tty_emitter(
+                swc_common::errors::ColorConfig::Auto,
+                true,
+                false,
+                Some(cm.clone()),
+            ));
+            let pc = ParseContext::with_resolver(
+                app_root,
+                Some(JS_RUNTIME_PATH.clone()),
+                resolver,
+                cm,
+                errs,
+            )
+            .unwrap();
+            let mods = pc.loader.load_archive(&base, &ar).unwrap();
+
+            let foo_mod = mods.get(&"/dummy/foo.ts".into()).unwrap();
+            let bar_mod = mods.get(&"/dummy/bar.ts".into()).unwrap();
+
+            let res = Resource::APIEndpoint(Lrc::new(Endpoint {
+                range: Default::default(),
+                service_name: "svc".into(),
+                name: "Bar".into(),
+                name_range: Default::default(),
+                doc: None,
+                expose: true,
+                raw: false,
+                require_auth: false,
+                body_limit: None,
+                encoding: EndpointEncoding {
+                    span: DUMMY_SP,
+                    default_method: Method::Post,
+                    methods: Methods::Some(vec![Method::Post]),
+                    handshake: None,
+                    req: vec![RequestEncoding {
+                        methods: Methods::Some(vec![Method::Post]),
+                        params: vec![],
+                    }],
+                    resp: ResponseEncoding { params: vec![] },
+                    path: Path::parse(DUMMY_SP, "/svc.Bar", Default::default()).unwrap(),
+                    raw_handshake_schema: None,
+                    raw_req_schema: None,
+                    raw_resp_schema: None,
+                },
+                streaming_request: false,
+                streaming_response: false,
+                static_assets: None,
+                tags: vec![],
+                sensitive: false,
+            }));
+
+            let bar_binds = vec![Lrc::new(Bind {
+                kind: BindKind::Create,
+                object: None,
+                id: 1.into(),
+                range: None,
+                name: Some("Bar".into()),
+                resource: res.clone(),
+                internal_bound_id: None,
+                module_id: bar_mod.id,
+            })];
+
+            let resources = [res];
+            let ur = UsageResolver::new(&pc.loader, &pc.type_checker, &resources, &bar_binds);
+
+            let result = ur.external_binds_to_scan_for(foo_mod);
+            assert_eq!(result.len(), 1);
+            assert_eq!(result[0].bind, bar_binds[0]);
+        });
+    }
+
+    #[test]
+    fn test_scan_usage() {
+        let globals = Globals::new();
+        GLOBALS.set(&globals, || {
+            let ar = txtar::from_str(
+                "
+-- foo.ts --
+import { Bar } from './bar.ts';
+
+Bar.field;      // FieldAccess
+Bar.method();   // MethodCall
+Bar();          // Callee
+foo(x, Bar)     // CallArg
+new Class(Bar); // ConstructorArg
+let foo = Bar;  // Other
+
+// Inside nested function calls
+const _ = nested(
+  () => {
+    bb.on('close', async () => {
+      const _ = await Bar.nested_method();
+    })
+  }
+)
+
+Bar.tpl`blah`;  // TemplateCall
+
+-- bar.ts --
+export const Bar = 5;
+            ",
+            );
+
+            let base = PathBuf::from("/dummy");
+            let resolver = Box::new(TestResolver::new(base.clone(), ar.clone()));
+            let tmp = TempDir::new().unwrap();
+            let app_root = tmp.child("app_root").to_path_buf();
+            let cm: Rc<SourceMap> = Default::default();
+            let errs = Rc::new(Handler::with_tty_emitter(
+                swc_common::errors::ColorConfig::Auto,
+                true,
+                false,
+                Some(cm.clone()),
+            ));
+            let pc = ParseContext::with_resolver(app_root, Some(JS_RUNTIME_PATH.clone()), resolver, cm, errs).unwrap();
+            let mods = pc.loader.load_archive(&base, &ar).unwrap();
+
+            let foo_mod = mods.get(&"/dummy/foo.ts".into()).unwrap();
+            let bar_mod = mods.get(&"/dummy/bar.ts".into()).unwrap();
+
+            let res = Resource::APIEndpoint(Lrc::new(Endpoint {
+                range: Default::default(),
+                name: "Bar".to_string(),
+                name_range: Default::default(),
+                service_name: "svc".to_string(),
+                doc: None,
+                expose: true,
+                raw: false,
+                require_auth: false,
+                body_limit: None,
+                encoding: EndpointEncoding {
+                    span: DUMMY_SP,
+                    default_method: Method::Post,
+                    methods: Methods::Some(vec![Method::Post]),
+                    handshake: None,
+                    req: vec![RequestEncoding {
+                        methods: Methods::Some(vec![Method::Post]),
+                        params: vec![],
+                    }],
+                    resp: ResponseEncoding {
+                        params: vec![],
+                    },
+                    path: Path::parse(DUMMY_SP, "/svc.Bar", Default::default()).unwrap(),
+                    raw_handshake_schema: None,
+                    raw_req_schema: None,
+                    raw_resp_schema: None,
+                },
+                streaming_request: false,
+                streaming_response: false,
+                static_assets: None,
+                tags: vec![],
+                sensitive: false,
+            }));
+            let bar_binds = vec![Lrc::new(Bind {
+                kind: BindKind::Create,
+                object: None,
+                id: 1.into(),
+                range: None,
+                name: Some("Bar".into()),
+                resource: res.clone(),
+                internal_bound_id: None,
+                module_id: bar_mod.id,
+            })];
+
+            let resources = [res];
+            let ur = UsageResolver::new(&pc.loader, &pc.type_checker, &resources, &bar_binds);
+
+            let usages = ur.scan_usage_exprs(foo_mod);
+            assert_eq!(usages.len(), 8);
+
+            assert_matches!(&usages[0].kind, UsageExprKind::FieldAccess(field) if field.field.as_ref() == "field");
+            assert_matches!(&usages[1].kind, UsageExprKind::MethodCall(method) if method.method.as_ref() == "method");
+            assert_matches!(&usages[2].kind, UsageExprKind::Callee(_));
+            assert_matches!(&usages[3].kind, UsageExprKind::CallArg(arg) if arg.arg_idx == 1);
+            assert_matches!(&usages[4].kind, UsageExprKind::ConstructorArg(arg) if arg.arg_idx == 0);
+            assert_matches!(&usages[5].kind, UsageExprKind::Other(_));
+            assert_matches!(&usages[6].kind, UsageExprKind::MethodCall(method) if method.method.as_ref() == "nested_method");
+            assert_matches!(&usages[7].kind, UsageExprKind::TemplateCall(tpl) if tpl.method.as_ref() == "tpl");
+        });
+    }
+}
diff --git a/tsparser/src/runtimeresolve/exports.rs b/tsparser/src/runtimeresolve/exports.rs
new file mode 100644
index 0000000000..3d25a63041
--- /dev/null
+++ b/tsparser/src/runtimeresolve/exports.rs
@@ -0,0 +1,300 @@
+use std::collections::HashSet;
+use std::fmt;
+use std::path::PathBuf;
+
+use indexmap::IndexMap;
+use serde::de::{self, Deserialize, Deserializer, MapAccess, Visitor};
+
+/// The parsed representation of the "exports" field in a package.json file.
+/// See https://nodejs.org/api/packages.html#package-entry-points for syntax.
+#[derive(Debug)]
+pub(super) struct Exports {
+    subpaths: IndexMap<String, Subpath>,
+}
+
+impl Exports {
+    /// Resolves a relative path to a target file path.
+    pub fn resolve_import_path(
+        &self,
+        rel_path: &str,
+        conditions: &HashSet<&str>,
+    ) -> Option<PathBuf> {
+        let mut wildcard_match = None;
+        for (candidate, subpath) in self.subpaths.iter() {
+            match candidate_matches(candidate, rel_path) {
+                None => continue,
+                Some(Match::Exact) => {
+                    return subpath.matches(conditions).and_then(|m| match m {
+                        SubpathMatch::Target(path) => Some(path.into()),
+                        SubpathMatch::Exclude => None,
+                    });
+                }
+                Some(Match::Wildcard { replacement }) => {
+                    match subpath.matches(conditions) {
+                        None => continue,
+
+                        // If we have a target, save it as a candidate.
+                        // We have to keep looking as there may be an exclude directive later.
+                        Some(SubpathMatch::Target(path)) => {
+                            if wildcard_match.is_none() {
+                                wildcard_match = Some((path, replacement));
+                            }
+                        }
+
+                        // If we have an exclude, stop looking and immediately return none.
+                        Some(SubpathMatch::Exclude) => return None,
+                    }
+                }
+            }
+        }
+
+        wildcard_match.map(|(path, replacement)| path.replace('*', replacement).into())
+    }
+}
+
+enum Match<'a> {
+    Exact,
+    Wildcard { replacement: &'a str },
+}
+
+fn candidate_matches<'a>(candidate: &str, rel_path: &'a str) -> Option<Match<'a>> {
+    let candidate = match (candidate, rel_path) {
+        (".", "") => return Some(Match::Exact),
+        (".", _) => return None,
+        (_, _) => {
+            // Strip "./" prefix.
+            let candidate = candidate.strip_prefix("./").unwrap_or(candidate);
+            if candidate == rel_path {
+                return Some(Match::Exact);
+            }
+            candidate
+        }
+    };
+
+    if let Some(idx) = candidate.find('*') {
+        let (prefix, suffix) = candidate.split_at(idx);
+        if rel_path.starts_with(prefix) && rel_path.ends_with(suffix) {
+            // Get the middle part of the path, to be injected into the result.
+            let replacement = &rel_path[prefix.len()..(rel_path.len() - suffix.len())];
+            return Some(Match::Wildcard { replacement });
+        }
+    }
+
+    None
+}
+
+#[derive(Debug, PartialEq, Eq)]
+enum Subpath {
+    Target(String),
+    Conditions(IndexMap<String, Subpath>),
+    Exclude,
+}
+
+enum SubpathMatch<'a> {
+    Target(&'a str),
+    Exclude,
+}
+
+impl Subpath {
+    fn matches(&self, active_conditions: &HashSet<&str>) -> Option<SubpathMatch<'_>> {
+        match self {
+            Subpath::Target(path) => Some(SubpathMatch::Target(path)),
+            Subpath::Exclude => Some(SubpathMatch::Exclude),
+            Subpath::Conditions(conds) => {
+                for (cond, subpath) in conds.iter() {
+                    if active_conditions.contains(cond.as_str()) {
+                        return subpath.matches(active_conditions);
+                    }
+                }
+                None
+            }
+        }
+    }
+}
+
+// The "exports" value can be defined in lots of ways.
+//
+// - A single subpath, e.g. "exports": "./index.js".
+//   Syntactic sugar for {".": "./index.js"}
+//
+// - A condition spec: {"node": "./index.node.js"}
+//   Conditions can be nested: {"node": {"import": "./index.node.js", "default": "./index.js"}}
+//
+// - An ordered map of subpaths key-value pairs: {".": "./index.js", "./foo/*": "./foo/*.js"}
+// - Each subpath value can be one of:
+//   - A single target path, e.g. "./index.js" (possibly with wildcards, "./foo/*.js")
+//   - A condition spec.
+//   - Null, indicating the subpath is not exported (overriding other exports that may match).
+
+impl<'de> Deserialize<'de> for Exports {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        struct StringOrMap;
+        impl<'de> Visitor<'de> for StringOrMap {
+            type Value = Exports;
+
+            fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+                formatter.write_str("string or map")
+            }
+
+            fn visit_str<E>(self, value: &str) -> Result<Self::Value, E>
+            where
+                E: de::Error,
+            {
+                let mut subpaths = IndexMap::<String, Subpath>::new();
+                subpaths.insert(".".into(), Subpath::Target(value.to_string()));
+                Ok(Exports { subpaths })
+            }
+
+            fn visit_map<M>(self, mut access: M) -> Result<Self::Value, M::Error>
+            where
+                M: MapAccess<'de>,
+            {
+                let mut subpaths = IndexMap::new();
+
+                // Peek at the first entry to decide whether it's a map of subpaths or conditions.
+                let Some((key, value)) = access.next_entry::<String, Subpath>()? else {
+                    // Empty map.
+                    return Ok(Exports { subpaths });
+                };
+
+                if !key.starts_with('.') {
+                    let mut conditions: IndexMap<String, Subpath> =
+                        Deserialize::deserialize(de::value::MapAccessDeserializer::new(access))?;
+                    conditions.insert(key, value);
+                    subpaths.insert(".".to_string(), Subpath::Conditions(conditions));
+                    return Ok(Exports { subpaths });
+                }
+
+                subpaths.insert(key, value);
+                while let Some((key, value)) = access.next_entry::<String, Subpath>()? {
+                    subpaths.insert(key, value);
+                }
+
+                Ok(Exports { subpaths })
+            }
+        }
+
+        deserializer.deserialize_any(StringOrMap)
+    }
+}
+
+struct SubpathVisitor;
+
+impl<'de> Visitor<'de> for SubpathVisitor {
+    type Value = Subpath;
+
+    fn expecting(&self, formatter: &mut fmt::Formatter) -> fmt::Result {
+        formatter.write_str("string or map")
+    }
+
+    fn visit_unit<E>(self) -> Result<Self::Value, E>
+    where
+        E: de::Error,
+    {
+        Ok(Subpath::Exclude)
+    }
+
+    fn visit_str<E>(self, value: &str) -> Result<Self::Value, E>
+    where
+        E: de::Error,
+    {
+        Ok(Subpath::Target(value.to_string()))
+    }
+
+    fn visit_map<M>(self, map: M) -> Result<Self::Value, M::Error>
+    where
+        M: MapAccess<'de>,
+    {
+        let conditions: IndexMap<String, Subpath> =
+            Deserialize::deserialize(de::value::MapAccessDeserializer::new(map))?;
+        Ok(Subpath::Conditions(conditions))
+    }
+}
+
+impl<'de> Deserialize<'de> for Subpath {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        deserializer.deserialize_any(SubpathVisitor)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn parse_subpaths() {
+        let exports: Exports = serde_json::from_str(
+            r#"{
+            ".": "./index.js",
+            "./foo/*": "./foo/*.js",
+            "./bar": {"node": "./bar.node.js", "default": "./bar.js"},
+            "./baz": {"node": "./baz.node.js", "default": null},
+            "./qux": null
+        }"#,
+        )
+        .unwrap();
+        assert_eq!(exports.subpaths.len(), 5);
+        assert_eq!(
+            exports.subpaths.get(".").unwrap(),
+            &Subpath::Target("./index.js".into())
+        );
+        assert_eq!(
+            exports.subpaths.get("./foo/*").unwrap(),
+            &Subpath::Target("./foo/*.js".into())
+        );
+        assert_eq!(
+            exports.subpaths.get("./bar").unwrap(),
+            &Subpath::Conditions({
+                let mut map = IndexMap::new();
+                map.insert("node".to_owned(), Subpath::Target("./bar.node.js".into()));
+                map.insert("default".to_owned(), Subpath::Target("./bar.js".into()));
+                map
+            })
+        );
+        assert_eq!(
+            exports.subpaths.get("./baz").unwrap(),
+            &Subpath::Conditions({
+                let mut map = IndexMap::new();
+                map.insert("node".to_owned(), Subpath::Target("./baz.node.js".into()));
+                map.insert("default".to_owned(), Subpath::Exclude);
+                map
+            })
+        );
+        assert_eq!(exports.subpaths.get("./qux").unwrap(), &Subpath::Exclude);
+    }
+
+    #[test]
+    fn parse_toplevel_conditions() {
+        let exports: Exports = serde_json::from_str(
+            r#"{
+            "node": {"import": "./bar.node.js", "default": "./bar.js"},
+            "default": "./index.js"
+        }"#,
+        )
+        .unwrap();
+        assert_eq!(exports.subpaths.len(), 1);
+        assert_eq!(
+            exports.subpaths.get(".").unwrap(),
+            &Subpath::Conditions({
+                let mut map = IndexMap::new();
+                map.insert(
+                    "node".to_owned(),
+                    Subpath::Conditions({
+                        let mut map = IndexMap::new();
+                        map.insert("import".to_owned(), Subpath::Target("./bar.node.js".into()));
+                        map.insert("default".to_owned(), Subpath::Target("./bar.js".into()));
+                        map
+                    }),
+                );
+                map.insert("default".to_owned(), Subpath::Target("./index.js".into()));
+                map
+            })
+        );
+    }
+}
diff --git a/tsparser/src/runtimeresolve/mod.rs b/tsparser/src/runtimeresolve/mod.rs
new file mode 100644
index 0000000000..af1a4eb9a4
--- /dev/null
+++ b/tsparser/src/runtimeresolve/mod.rs
@@ -0,0 +1,6 @@
+mod exports;
+mod node;
+mod tsconfig;
+
+pub use node::EncoreRuntimeResolver;
+pub use tsconfig::TsConfigPathResolver;
diff --git a/tsparser/src/runtimeresolve/node.rs b/tsparser/src/runtimeresolve/node.rs
new file mode 100644
index 0000000000..ec38b21911
--- /dev/null
+++ b/tsparser/src/runtimeresolve/node.rs
@@ -0,0 +1,155 @@
+use std::collections::HashSet;
+use std::{
+    fs::File,
+    io::BufReader,
+    path::{Component, Path, PathBuf},
+};
+
+use anyhow::{bail, Context, Error};
+use clean_path::Clean;
+use serde::Deserialize;
+use swc_common::sync::Lrc;
+use swc_common::FileName;
+use swc_ecma_loader::resolve::Resolve;
+
+use crate::runtimeresolve::exports::Exports;
+use crate::runtimeresolve::tsconfig::TsConfigPathResolver;
+
+static PACKAGE: &str = "package.json";
+
+#[derive(Deserialize)]
+struct PackageJson {
+    #[allow(dead_code)]
+    #[serde(default)]
+    main: Option<String>,
+    #[allow(dead_code)]
+    #[serde(default)]
+    module: Option<String>,
+    #[serde(default)]
+    exports: Option<Exports>,
+}
+
+#[derive(Debug)]
+pub struct EncoreRuntimeResolver<R> {
+    inner: R,
+    js_runtime_path: Option<PathBuf>,
+    extra_export_conditions: Vec<String>,
+    tsconfig_resolver: Option<Lrc<TsConfigPathResolver>>,
+}
+
+static DEFAULT_CONDITIONS: &[&str] = &["node-addons", "node", "import", "require", "default"];
+
+impl<R> EncoreRuntimeResolver<R> {
+    pub fn new(
+        inner: R,
+        js_runtime_path: Option<PathBuf>,
+        extra_export_conditions: Vec<String>,
+    ) -> Self {
+        Self {
+            inner,
+            js_runtime_path,
+            extra_export_conditions,
+            tsconfig_resolver: None,
+        }
+    }
+
+    pub fn with_tsconfig_resolver(self, resolver: Lrc<TsConfigPathResolver>) -> Self {
+        Self {
+            tsconfig_resolver: Some(resolver),
+            ..self
+        }
+    }
+
+    /// Resolve a path from the "exports" directive in the package.json file, if present.
+    fn resolve_export(&self, pkg_dir: &Path, rel_target: &str) -> Result<Option<PathBuf>, Error> {
+        let package_json_path = pkg_dir.join(PACKAGE);
+        if !package_json_path.is_file() {
+            bail!("package.json not found: {}", package_json_path.display());
+        }
+
+        let file = File::open(&package_json_path)?;
+        let reader = BufReader::new(file);
+        let pkg: PackageJson = serde_json::from_reader(reader).context(format!(
+            "failed to deserialize {}",
+            package_json_path.display()
+        ))?;
+
+        let Some(exports) = &pkg.exports else {
+            bail!("no exports field in {}", package_json_path.display());
+        };
+
+        let mut conditions =
+            HashSet::from_iter(self.extra_export_conditions.iter().map(|s| s.as_str()));
+        conditions.extend(DEFAULT_CONDITIONS);
+
+        // The result is relative to the package directory, whereas we want to return an absolute path.
+        let result = exports
+            .resolve_import_path(rel_target, &conditions)
+            .map(|p| p.to_path_buf());
+        Ok(result.map(|p| pkg_dir.join(p)))
+    }
+
+    /// Resolve the package name from a target import path, e.g.:
+    /// - "foo" => ("foo", "")
+    /// - "foo/bar" => ("foo", "bar")
+    /// - "@foo/bar" => ("@foo/bar", "")
+    /// - "@foo/bar/baz" => ("@foo/bar", "baz")
+    fn pkg_name_from_target<'b>(&self, target: &'b str) -> (&'b str, &'b str) {
+        match target.find('/') {
+            None => (target, ""),
+            Some(idx) => {
+                if target.starts_with('@') {
+                    let rem = &target[idx + 1..];
+                    match rem.find('/') {
+                        None => (target, ""),
+                        Some(rem_idx) => {
+                            let sep = idx + rem_idx + 1;
+                            (&target[..sep], &target[sep + 1..])
+                        }
+                    }
+                } else {
+                    (&target[..idx], &target[(idx + 1)..])
+                }
+            }
+        }
+    }
+
+    fn resolve_encore_module(&self, target: &str) -> Result<Option<PathBuf>, Error> {
+        let Some(js_runtime_path) = &self.js_runtime_path else {
+            return Ok(None);
+        };
+
+        let target_path = Path::new(target);
+        let mut components = target_path.components();
+
+        if let Some(Component::Normal(_)) = components.next() {
+            // It's a normal import, not an absolute or relative path.
+            let (pkg_name, pkg_path) = self.pkg_name_from_target(target);
+            let pkg_dir = js_runtime_path.join(pkg_name);
+
+            if pkg_dir.exists() {
+                return self.resolve_export(&pkg_dir, pkg_path);
+            }
+        }
+
+        Ok(None)
+    }
+}
+
+impl<R> Resolve for EncoreRuntimeResolver<R>
+where
+    R: Resolve,
+{
+    fn resolve(&self, base: &FileName, target: &str) -> Result<FileName, Error> {
+        if let Some(tsconfig) = &self.tsconfig_resolver {
+            if let Some(buf) = tsconfig.resolve(target) {
+                return self.inner.resolve(tsconfig.base(), buf.as_ref());
+            }
+        }
+
+        match self.resolve_encore_module(target)? {
+            Some(buf) => Ok(FileName::Real(buf.clean())),
+            None => self.inner.resolve(base, target),
+        }
+    }
+}
diff --git a/tsparser/src/runtimeresolve/tsconfig.rs b/tsparser/src/runtimeresolve/tsconfig.rs
new file mode 100644
index 0000000000..fea4231d2f
--- /dev/null
+++ b/tsparser/src/runtimeresolve/tsconfig.rs
@@ -0,0 +1,313 @@
+use std::borrow::Cow;
+use std::io;
+use std::path::{Path, PathBuf};
+
+use indexmap::IndexMap;
+use serde::Deserialize;
+use swc_common::FileName;
+use thiserror::Error;
+
+#[derive(Debug)]
+pub struct TsConfigPathResolver {
+    /// The base path from which relative paths are resolved.
+    base: PathBuf,
+    base_filename: FileName,
+
+    /// The parsed paths, sorted by descending prefix length (before any '*' wildcard).
+    paths: Vec<PathEntry>,
+}
+
+#[derive(Error, Debug)]
+pub enum TsConfigError {
+    #[error("reading {0} failed")]
+    Read(PathBuf, #[source] io::Error),
+    #[error("parsing {0} failed")]
+    Parse(PathBuf, #[source] serde_json::Error),
+    #[error("{0} has no parent directory")]
+    NoParent(PathBuf),
+}
+
+impl TsConfigPathResolver {
+    pub fn from_file(tsconfig_path: &Path) -> Result<Self, TsConfigError> {
+        let tsconfig_dir = tsconfig_path
+            .parent()
+            .ok_or_else(|| TsConfigError::NoParent(tsconfig_path.to_path_buf()))?;
+        let tsconfig = std::fs::read_to_string(tsconfig_path)
+            .map_err(|e| TsConfigError::Read(tsconfig_path.to_path_buf(), e))?;
+        let tsconfig = strip_jsonc_comments(&tsconfig, false);
+        let tsconfig: TSConfig = serde_json::from_str(&tsconfig)
+            .map_err(|e| TsConfigError::Parse(tsconfig_path.to_path_buf(), e))?;
+        Ok(Self::from_config(tsconfig_dir, tsconfig))
+    }
+
+    pub fn from_config(tsconfig_dir: &Path, tsconfig: TSConfig) -> Self {
+        let base = tsconfig
+            .compiler_options
+            .base_url
+            .map(|p| tsconfig_dir.join(p))
+            .unwrap_or(tsconfig_dir.to_path_buf());
+
+        let mut paths: Vec<PathEntry> = tsconfig
+            .compiler_options
+            .paths
+            .into_iter()
+            .map(|(key, val)| {
+                let key = PathVal::from(key);
+                let values = val.into_iter().map(PathVal::from).collect();
+                PathEntry { key, values }
+            })
+            .collect();
+
+        // Sort the paths by descending prefix length.
+        paths.sort_by(|a, b| {
+            let a = a.key.prefix_len();
+            let b = b.key.prefix_len();
+            b.cmp(&a)
+        });
+
+        let base_filename = FileName::Real(base.clone());
+
+        Self {
+            base,
+            base_filename,
+            paths,
+        }
+    }
+
+    pub fn base(&self) -> &FileName {
+        &self.base_filename
+    }
+
+    pub fn resolve(&self, import: &str) -> Option<Cow<'_, str>> {
+        for entry in &self.paths {
+            match &entry.key {
+                PathVal::Exact(key) if import == key => {
+                    for val in &entry.values {
+                        if let PathVal::Exact(val) = val {
+                            for candidate in file_candidates(self.base.join(val)) {
+                                if candidate.exists() {
+                                    return Some(Cow::Borrowed(val));
+                                }
+                            }
+                        }
+                    }
+                }
+
+                PathVal::Wildcard { prefix, suffix }
+                    if import.starts_with(prefix) && import.ends_with(suffix) =>
+                {
+                    let wildcard = &import[prefix.len()..import.len() - suffix.len()];
+                    for val in &entry.values {
+                        match val {
+                            PathVal::Wildcard { prefix, suffix } => {
+                                let mut rel_path = String::with_capacity(
+                                    prefix.len() + suffix.len() + wildcard.len() + 2,
+                                );
+                                rel_path.push_str(prefix);
+                                rel_path.push_str(wildcard);
+                                rel_path.push_str(suffix);
+
+                                for candidate in file_candidates(self.base.join(&rel_path)) {
+                                    if candidate.exists() {
+                                        return Some(Cow::Owned(rel_path));
+                                    }
+                                }
+                            }
+                            PathVal::Exact(val) => {
+                                for candidate in file_candidates(self.base.join(val)) {
+                                    if candidate.exists() {
+                                        return Some(Cow::Borrowed(val));
+                                    }
+                                }
+                            }
+                        }
+                    }
+                }
+                _ => {}
+            }
+        }
+
+        None
+    }
+}
+
+#[derive(Debug)]
+struct PathEntry {
+    key: PathVal,
+    values: Vec<PathVal>,
+}
+
+/// Represents a path, possibly with a wildcard.
+#[derive(Debug)]
+enum PathVal {
+    /// The path is an exact path.
+    Exact(String),
+
+    /// The path is a wildcard path, with the given prefix and suffix surrounding the '*'.
+    Wildcard { prefix: String, suffix: String },
+}
+
+impl PathVal {
+    /// Returns the length of the prefix, or of the full path if it is an exact path.
+    fn prefix_len(&self) -> usize {
+        match self {
+            PathVal::Exact(s) => s.len(),
+            PathVal::Wildcard { prefix, .. } => prefix.len(),
+        }
+    }
+}
+
+impl From<String> for PathVal {
+    fn from(s: String) -> Self {
+        match s.split_once('*') {
+            Some((prefix, suffix)) => PathVal::Wildcard {
+                prefix: prefix.to_string(),
+                suffix: suffix.to_string(),
+            },
+            None => PathVal::Exact(s),
+        }
+    }
+}
+
+#[derive(Deserialize)]
+pub struct TSConfig {
+    #[serde(default, rename = "compilerOptions")]
+    pub compiler_options: CompilerOptions,
+}
+
+#[derive(Deserialize, Default)]
+pub struct CompilerOptions {
+    #[serde(rename = "baseUrl")]
+    pub base_url: Option<PathBuf>,
+    pub paths: IndexMap<String, Vec<String>>,
+}
+
+/// Takes a string of jsonc content and returns a comment free version
+/// which should parse fine as regular json.
+/// Nested block comments are supported.
+/// preserve_locations will replace most comments with spaces, so that JSON parsing
+/// errors should point to the right location.
+///
+/// From https://github.com/serde-rs/json/issues/168#issuecomment-761831843.
+fn strip_jsonc_comments(jsonc_input: &str, preserve_locations: bool) -> String {
+    let mut json_output = String::new();
+
+    let mut block_comment_depth: u8 = 0;
+    let mut is_in_string: bool = false; // Comments cannot be in strings
+
+    for line in jsonc_input.split('\n') {
+        let mut last_char: Option<char> = None;
+        for cur_char in line.chars() {
+            // Check whether we're in a string
+            if block_comment_depth == 0 && last_char != Some('\\') && cur_char == '"' {
+                is_in_string = !is_in_string;
+            }
+
+            // Check for line comment start
+            if !is_in_string && last_char == Some('/') && cur_char == '/' {
+                last_char = None;
+                if preserve_locations {
+                    json_output.push_str("  ");
+                }
+                break; // Stop outputting or parsing this line
+            }
+            // Check for block comment start
+            if !is_in_string && last_char == Some('/') && cur_char == '*' {
+                block_comment_depth += 1;
+                last_char = None;
+                if preserve_locations {
+                    json_output.push_str("  ");
+                }
+                // Check for block comment end
+            } else if !is_in_string && last_char == Some('*') && cur_char == '/' {
+                block_comment_depth = block_comment_depth.saturating_sub(1);
+                last_char = None;
+                if preserve_locations {
+                    json_output.push_str("  ");
+                }
+                // Output last char if not in any block comment
+            } else {
+                if block_comment_depth == 0 {
+                    if let Some(last_char) = last_char {
+                        json_output.push(last_char);
+                    }
+                } else if preserve_locations {
+                    json_output.push(' ');
+                }
+                last_char = Some(cur_char);
+            }
+        }
+
+        // Add last char and newline if not in any block comment
+        if let Some(last_char) = last_char {
+            if block_comment_depth == 0 {
+                json_output.push(last_char);
+            } else if preserve_locations {
+                json_output.push(' ');
+            }
+        }
+
+        // Remove trailing whitespace from line
+        while json_output.ends_with(' ') {
+            json_output.pop();
+        }
+        json_output.push('\n');
+    }
+
+    json_output
+}
+
+struct PathResolveIterator {
+    base: PathBuf,
+    base_ext: Option<String>,
+    candidates: &'static [&'static str],
+    idx: usize,
+}
+
+impl Iterator for PathResolveIterator {
+    type Item = PathBuf;
+
+    fn next(&mut self) -> Option<Self::Item> {
+        if self.idx < self.candidates.len() {
+            let candidate = self.candidates[self.idx];
+            self.idx += 1;
+
+            if candidate.is_empty() {
+                Some(self.base.clone())
+            } else if let Some(base_ext) = &self.base_ext {
+                // Combine the candidate extension with the base extension.
+                let ext = format!("{base_ext}.{candidate}");
+                Some(self.base.with_extension(ext))
+            } else {
+                Some(self.base.with_extension(candidate))
+            }
+        } else {
+            None
+        }
+    }
+}
+
+fn file_candidates(base: PathBuf) -> impl Iterator<Item = PathBuf> {
+    let base_ext = base
+        .extension()
+        .and_then(|s| s.to_str())
+        .map(|s| s.to_string());
+
+    let candidates: &'static [&'static str] = match base_ext.as_deref() {
+        Some("js") => &["ts", "tsx", "d.ts", "js", "jsx"],
+        Some("mjs") => &["mts", "d.mts", "mjs"],
+        Some("cjs") => &["cts", "d.cts", "cjs"],
+
+        // If we don't have an extension, or it's not recognized, try all extensions.
+        _ => &[
+            "ts", "tsx", "d.ts", "js", "jsx", "mts", "d.mts", "mjs", "cts", "d.cts", "cjs", "",
+        ],
+    };
+
+    PathResolveIterator {
+        base,
+        candidates,
+        base_ext,
+        idx: 0,
+    }
+}
diff --git a/tsparser/src/span_err.rs b/tsparser/src/span_err.rs
new file mode 100644
index 0000000000..ea44178e47
--- /dev/null
+++ b/tsparser/src/span_err.rs
@@ -0,0 +1,59 @@
+use swc_common::{errors::HANDLER, Span, Spanned};
+
+pub trait ErrReporter {
+    fn err(&self, msg: &str);
+}
+
+impl<T> ErrReporter for T
+where
+    T: Spanned,
+{
+    fn err(&self, msg: &str) {
+        HANDLER.with(|h| h.span_err(self.span(), msg));
+    }
+}
+
+#[derive(Debug)]
+pub struct SpErr<E> {
+    pub span: Span,
+    pub error: E,
+}
+
+impl<E> SpErr<E>
+where
+    E: std::error::Error,
+{
+    pub fn new(span: Span, error: E) -> Self {
+        SpErr { span, error }
+    }
+
+    pub fn report(&self) {
+        HANDLER.with(|handler| handler.span_err(self.span, &self.error.to_string()))
+    }
+}
+
+impl<E> std::error::Error for SpErr<E>
+where
+    E: std::error::Error,
+{
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        self.error.source()
+    }
+}
+
+impl<E> std::fmt::Display for SpErr<E>
+where
+    E: std::fmt::Display,
+{
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        std::fmt::Display::fmt(&self.error, f)
+    }
+}
+
+pub trait ErrorWithSpanExt: std::error::Error + Sized {
+    fn with_span(self, span: Span) -> SpErr<Self> {
+        SpErr::new(span, self)
+    }
+}
+
+impl<T> ErrorWithSpanExt for T where T: std::error::Error {}
diff --git a/tsparser/src/testutil/mod.rs b/tsparser/src/testutil/mod.rs
new file mode 100644
index 0000000000..5bd0845ef6
--- /dev/null
+++ b/tsparser/src/testutil/mod.rs
@@ -0,0 +1,17 @@
+use duct::cmd;
+use once_cell::sync::Lazy;
+use std::path::PathBuf;
+
+pub mod testparse;
+pub mod testresolve;
+pub mod typeparse;
+
+pub static JS_RUNTIME_PATH: Lazy<PathBuf> = Lazy::new(js_runtime_path);
+
+fn js_runtime_path() -> PathBuf {
+    let repo_root = cmd!("git", "rev-parse", "--show-toplevel")
+        .stdout_capture()
+        .read()
+        .unwrap();
+    PathBuf::from(repo_root.trim()).join("runtimes").join("js")
+}
diff --git a/tsparser/src/testutil/testparse.rs b/tsparser/src/testutil/testparse.rs
new file mode 100644
index 0000000000..c739840b3b
--- /dev/null
+++ b/tsparser/src/testutil/testparse.rs
@@ -0,0 +1,23 @@
+use std::rc::Rc;
+use swc_common::sync::Lrc;
+
+use crate::parser::module_loader::Module;
+use crate::parser::parser::ParseContext;
+use assert_fs::TempDir;
+use swc_common::errors::Handler;
+use swc_common::SourceMap;
+
+pub fn test_parse(src: &str) -> Lrc<Module> {
+    let root = TempDir::new().unwrap();
+
+    let cm: Rc<SourceMap> = Default::default();
+    let errs = Rc::new(Handler::with_tty_emitter(
+        swc_common::errors::ColorConfig::Auto,
+        true,
+        false,
+        Some(cm.clone()),
+    ));
+
+    let pc = ParseContext::new(root.to_path_buf(), None, cm, errs).unwrap();
+    pc.loader.inject_file("test.ts".into(), src).unwrap()
+}
diff --git a/tsparser/src/testutil/testresolve.rs b/tsparser/src/testutil/testresolve.rs
new file mode 100644
index 0000000000..b5dbd2222d
--- /dev/null
+++ b/tsparser/src/testutil/testresolve.rs
@@ -0,0 +1,94 @@
+use anyhow::{anyhow, bail, Error};
+use std::path::PathBuf;
+use swc_common::FileName;
+use swc_ecma_loader::resolve::Resolve;
+
+pub struct TestResolver {
+    root_dir: PathBuf,
+    ar: txtar::Archive,
+}
+
+impl TestResolver {
+    pub fn new(root_dir: PathBuf, ar: txtar::Archive) -> Self {
+        Self { root_dir, ar }
+    }
+}
+
+impl Resolve for TestResolver {
+    fn resolve(&self, base: &FileName, module_specifier: &str) -> Result<FileName, Error> {
+        // Fake the existence of the runtime module for now.
+        if module_specifier.starts_with("encore.dev/") {
+            let mut path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+                .join("runtime")
+                .join(
+                    // Get the suffix after the "encore.dev/" part.
+                    PathBuf::from(module_specifier)
+                        .strip_prefix("encore.dev/")
+                        .unwrap(),
+                );
+            path.set_extension("ts");
+            return Ok(FileName::Real(path));
+        }
+
+        let base = match base {
+            FileName::Real(v) => v,
+            _ => bail!("TestResolver supports only files"),
+        };
+
+        let base_dir = base.parent().ok_or(anyhow!(
+            "file has no parent directory: {}",
+            base.to_string_lossy()
+        ))?;
+
+        let mut path = base_dir.join(module_specifier);
+        path.set_extension("ts");
+        path = clean_path::clean(path);
+
+        for file in &self.ar.files {
+            let cleaned = clean_path::clean(self.root_dir.join(&file.name));
+            if cleaned == path {
+                return Ok(FileName::Real(path));
+            }
+        }
+        Err(anyhow!("import not found: {}", module_specifier))
+    }
+}
+
+pub struct NoopResolver;
+
+impl Resolve for NoopResolver {
+    fn resolve(&self, _: &FileName, _: &str) -> Result<FileName, Error> {
+        bail!("NoopResolver does not support resolving files");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_resolve() {
+        let ar = txtar::from_str(
+            "
+-- foo.ts --
+import { Bar } from './bar.ts';
+-- bar.ts --
+export const Bar = 5;
+        ",
+        );
+
+        let root = PathBuf::from("");
+        let r = TestResolver::new(root, ar);
+
+        let base = FileName::Real("foo.ts".into());
+        assert_eq!(
+            r.resolve(&base, "./bar.ts").unwrap(),
+            FileName::Real("bar.ts".into())
+        );
+
+        assert_eq!(
+            r.resolve(&base, "./moo.ts").unwrap_err().to_string(),
+            "import not found: ./moo.ts"
+        );
+    }
+}
diff --git a/tsparser/src/testutil/typeparse.rs b/tsparser/src/testutil/typeparse.rs
new file mode 100644
index 0000000000..09a30ca205
--- /dev/null
+++ b/tsparser/src/testutil/typeparse.rs
@@ -0,0 +1,35 @@
+use anyhow::Result;
+use swc_common::errors::{ColorConfig, Handler};
+use swc_common::input::StringInput;
+use swc_common::sync::Lrc;
+use swc_common::{FileName, SourceMap};
+use swc_ecma_ast as ast;
+use swc_ecma_ast::EsVersion;
+use swc_ecma_parser::lexer::Lexer;
+use swc_ecma_parser::{Parser, Syntax};
+
+pub fn parse_type_expr(s: &str) -> Result<ast::TsType> {
+    let cm: Lrc<SourceMap> = Default::default();
+    let handler = Handler::with_tty_emitter(ColorConfig::Auto, true, false, Some(cm.clone()));
+
+    let filename = FileName::Real("test.ts".into());
+    let fm = cm.new_source_file(filename, s.into());
+    let lexer = Lexer::new(
+        Syntax::Typescript(Default::default()),
+        EsVersion::Es2022,
+        StringInput::from(&*fm),
+        None,
+    );
+    let mut parser = Parser::new_from(lexer);
+    for e in parser.take_errors() {
+        e.into_diagnostic(&handler).emit();
+    }
+    let result = parser
+        .parse_type()
+        .map_err(|e| {
+            // Unrecoverable fatal error occurred
+            e.into_diagnostic(&handler).emit();
+        })
+        .unwrap();
+    Ok(*result)
+}
diff --git a/tsparser/tests/common/mod.rs b/tsparser/tests/common/mod.rs
new file mode 100644
index 0000000000..8554b54716
--- /dev/null
+++ b/tsparser/tests/common/mod.rs
@@ -0,0 +1,8 @@
+use clean_path::Clean;
+use std::path::PathBuf;
+
+pub fn js_runtime_path() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR"))
+        .join("../runtimes/js")
+        .clean()
+}
diff --git a/tsparser/tests/parse_tests.rs b/tsparser/tests/parse_tests.rs
new file mode 100644
index 0000000000..33c5390642
--- /dev/null
+++ b/tsparser/tests/parse_tests.rs
@@ -0,0 +1,70 @@
+use std::fs;
+use std::path::Path;
+use std::rc::Rc;
+
+use anyhow::Result;
+use common::js_runtime_path;
+use insta::glob;
+use swc_common::errors::{Handler, HANDLER};
+use swc_common::{Globals, SourceMap, GLOBALS};
+use tempdir::TempDir;
+
+use encore_tsparser::builder::Builder;
+use encore_tsparser::parser::parser::ParseContext;
+use encore_tsparser::{app, builder};
+
+mod common;
+
+#[test]
+fn test_parser() {
+    env_logger::init();
+    glob!("testdata/*.txt", |path| {
+        let input = fs::read_to_string(path).unwrap();
+        let ar = txtar::from_str(&input);
+        let tmp_dir = TempDir::new("parse").unwrap();
+        ar.materialize(&tmp_dir).unwrap();
+        match parse_txtar(tmp_dir.path()) {
+            Ok(_) => {}
+            Err(e) => {
+                panic!("{:#?}\n{}", e, e.backtrace());
+            }
+        }
+    });
+}
+
+fn parse_txtar(app_root: &Path) -> Result<app::AppDesc> {
+    let globals = Globals::new();
+    let cm: Rc<SourceMap> = Default::default();
+    let errs = Rc::new(Handler::with_tty_emitter(
+        swc_common::errors::ColorConfig::Auto,
+        true,
+        false,
+        Some(cm.clone()),
+    ));
+
+    GLOBALS.set(&globals, || -> Result<app::AppDesc> {
+        HANDLER.set(&errs, || -> Result<app::AppDesc> {
+            let builder = Builder::new()?;
+            let pc = ParseContext::new(
+                app_root.to_path_buf(),
+                Some(js_runtime_path()),
+                cm,
+                errs.clone(),
+            )?;
+
+            let app = builder::App {
+                root: app_root.to_path_buf(),
+                platform_id: None,
+                local_id: "test".to_string(),
+            };
+            let pp = builder::ParseParams {
+                app: &app,
+                pc: &pc,
+                working_dir: app_root,
+                parse_tests: false,
+            };
+
+            builder.parse(&pp).ok_or(anyhow::anyhow!("parse failed"))
+        })
+    })
+}
diff --git a/tsparser/tests/testdata/builtins.txt b/tsparser/tests/testdata/builtins.txt
new file mode 100644
index 0000000000..1b4706746f
--- /dev/null
+++ b/tsparser/tests/testdata/builtins.txt
@@ -0,0 +1,15 @@
+-- foo/foo.ts --
+import { api } from "encore.dev/api";
+
+type Params = Record<string, string>;
+
+export const ping = api<Params, void>({}, () => {});
+
+-- package.json --
+{
+  "name": "foo",
+  "type": "module",
+  "dependencies": {
+    "encore.dev": "^1.35.0"
+  }
+}
diff --git a/tsparser/tests/testdata/mapped_types.txt b/tsparser/tests/testdata/mapped_types.txt
new file mode 100644
index 0000000000..d374f3c444
--- /dev/null
+++ b/tsparser/tests/testdata/mapped_types.txt
@@ -0,0 +1,21 @@
+-- foo/foo.ts --
+import { api } from "encore.dev/api";
+
+type OnlyBoolsAndHorses = {
+  [key: string]: boolean | number;
+};
+
+interface Params {
+    blah: OnlyBoolsAndHorses;
+};
+
+export const ping = api<Params, void>({}, () => {});
+
+-- package.json --
+{
+  "name": "foo",
+  "type": "module",
+  "dependencies": {
+    "encore.dev": "^1.35.0"
+  }
+}
diff --git a/tsparser/tests/testdata/query_header.txt b/tsparser/tests/testdata/query_header.txt
new file mode 100644
index 0000000000..d882df702f
--- /dev/null
+++ b/tsparser/tests/testdata/query_header.txt
@@ -0,0 +1,27 @@
+-- foo/foo.ts --
+import { api, Query, Header } from "encore.dev/api";
+
+interface Params {
+    q1: Query;
+    q2: Query<boolean>;
+    q3: Query<"my-query">;
+    q4: Query<boolean, "my-query">;
+
+    h1: Header;
+    h2: Header<boolean>;
+    h3: Header<"my-header">;
+    h4: Header<boolean, "my-header">;
+};
+
+export const t1 = api<Params, void>({}, () => {});
+export const t2 = api<void, Params>({}, () => {});
+export const t3 = api<Params, Params>({}, () => {});
+
+-- package.json --
+{
+  "name": "foo",
+  "type": "module",
+  "dependencies": {
+    "encore.dev": "^1.35.0"
+  }
+}
diff --git a/tsparser/tests/testdata/tsconfig.txt b/tsparser/tests/testdata/tsconfig.txt
new file mode 100644
index 0000000000..1a2d79a78e
--- /dev/null
+++ b/tsparser/tests/testdata/tsconfig.txt
@@ -0,0 +1,27 @@
+-- foo/foo.ts --
+import { api } from "encore.dev/api";
+import { blah } from "@bar/bar";
+
+export const ping = api<void, void>({}, () => {});
+
+-- bar/bar.ts --
+
+export const blah = 5;
+
+-- package.json --
+{
+  "type": "module",
+  "dependencies": {
+    "encore.dev": "^1.35.0"
+  }
+}
+
+-- tsconfig.json --
+{
+  "compilerOptions": {
+    "paths": {
+      "~encore/*": ["./encore.gen/*"],
+      "@bar/*": ["./bar/*"]
+    }
+  }
+}
diff --git a/tsparser/txtar/.gitignore b/tsparser/txtar/.gitignore
new file mode 100644
index 0000000000..ea8c4bf7f3
--- /dev/null
+++ b/tsparser/txtar/.gitignore
@@ -0,0 +1 @@
+/target
diff --git a/tsparser/txtar/Cargo.lock b/tsparser/txtar/Cargo.lock
new file mode 100644
index 0000000000..eb0af5962a
--- /dev/null
+++ b/tsparser/txtar/Cargo.lock
@@ -0,0 +1,694 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c378d78423fdad8089616f827526ee33c19f2fddbd5de1629152c9593ba4783"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "15c4c2c83f81532e5845a733998b6971faca23490340a418e9b72a3ec9de12ea"
+
+[[package]]
+name = "assert_fs"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f070617a68e5c2ed5d06ee8dd620ee18fb72b99f6c094bed34cf8ab07c875b48"
+dependencies = [
+ "anstyle",
+ "doc-comment",
+ "globwalk",
+ "predicates 3.0.3",
+ "predicates-core",
+ "predicates-tree",
+ "tempfile",
+]
+
+[[package]]
+name = "autocfg"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
+
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
+[[package]]
+name = "bitflags"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
+
+[[package]]
+name = "bstr"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba3569f383e8f1598449f1a423e72e99569137b47740b1da11ef19af3d5c3223"
+dependencies = [
+ "lazy_static",
+ "memchr",
+ "regex-automata 0.1.10",
+]
+
+[[package]]
+name = "bstr"
+version = "1.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c2f7349907b712260e64b0afe2f84692af14a454be26187d9df565c7f69266a"
+dependencies = [
+ "memchr",
+ "serde",
+]
+
+[[package]]
+name = "cc"
+version = "1.0.83"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1174fb0b6ec23863f8b971027804a42614e347eafb0a95bf0b12cdae21fc4d0"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "clean-path"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aaa6b4b263a5d737e9bf6b7c09b72c41a5480aec4d7219af827f6564e950b6a5"
+
+[[package]]
+name = "console"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c926e00cc70edefdc64d3a5ff31cc65bb97a3460097762bd23afb4d8145fccf8"
+dependencies = [
+ "encode_unicode",
+ "lazy_static",
+ "libc",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "difflib"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6184e33543162437515c2e2b48714794e37845ec9851711914eec9d308f6ebe8"
+
+[[package]]
+name = "doc-comment"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fea41bba32d969b513997752735605054bc0dfa92b4c56bf1189f2e174be7a10"
+
+[[package]]
+name = "either"
+version = "1.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a26ae43d7bcc3b814de94796a5e736d4029efb0ee900c12e2d54c993ad1a1e07"
+
+[[package]]
+name = "encode_unicode"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a357d28ed41a50f9c765dbfe56cbc04a64e53e5fc58ba79fbc34c10ef3df831f"
+
+[[package]]
+name = "errno"
+version = "0.3.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136526188508e25c6fef639d7927dfb3e0e3084488bf202267829cf7fc23dbdd"
+dependencies = [
+ "errno-dragonfly",
+ "libc",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "errno-dragonfly"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa68f1b12764fab894d2755d2518754e71b4fd80ecfb822714a1206c2aab39bf"
+dependencies = [
+ "cc",
+ "libc",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6999dc1837253364c2ebb0704ba97994bd874e8f195d665c50b7548f6ea92764"
+
+[[package]]
+name = "float-cmp"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98de4bbd547a563b716d8dfa9aad1cb19bfab00f4fa09a6a4ed21dbcf44ce9c4"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "globset"
+version = "0.4.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "759c97c1e17c55525b57192c06a267cda0ac5210b222d6b82189a2338fa1c13d"
+dependencies = [
+ "aho-corasick",
+ "bstr 1.6.2",
+ "fnv",
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "globwalk"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93e3af942408868f6934a7b85134a3230832b9977cf66125df2f9edcfce4ddcc"
+dependencies = [
+ "bitflags 1.3.2",
+ "ignore",
+ "walkdir",
+]
+
+[[package]]
+name = "ignore"
+version = "0.4.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbe7873dab538a9a44ad79ede1faf5f30d49f9a5c883ddbab48bce81b64b7492"
+dependencies = [
+ "globset",
+ "lazy_static",
+ "log",
+ "memchr",
+ "regex",
+ "same-file",
+ "thread_local",
+ "walkdir",
+ "winapi-util",
+]
+
+[[package]]
+name = "itertools"
+version = "0.10.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b0fd2260e829bddf4cb6ea802289de2f86d6a7a690192fbe91b3f46e0f2c8473"
+dependencies = [
+ "either",
+]
+
+[[package]]
+name = "lazy_static"
+version = "1.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e2abad23fbc42b3700f2f279844dc832adb2b2eb069b2df918f455c4e18cc646"
+
+[[package]]
+name = "libc"
+version = "0.2.147"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4668fb0ea861c1df094127ac5f1da3409a82116a4ba74fca2e58ef927159bb3"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57bcfdad1b858c2db7c38303a6d2ad4dfaf5eb53dfeb0910128b2c26d6158503"
+
+[[package]]
+name = "log"
+version = "0.4.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5e6163cb8c49088c2c36f57875e58ccd8c87c7427f7fbd50ea6710b2f3f2e8f"
+
+[[package]]
+name = "memchr"
+version = "2.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f232d6ef707e1956a43342693d2a31e72989554d58299d7a88738cc95b0d35c"
+
+[[package]]
+name = "normalize-line-endings"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61807f77802ff30975e01f4f071c8ba10c022052f98b3294119f3e615d13e5be"
+
+[[package]]
+name = "num-traits"
+version = "0.2.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f30b0abd723be7e2ffca1272140fac1a2f084c77ec3e123c192b66af1ee9e6c2"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "once_cell"
+version = "1.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
+
+[[package]]
+name = "predicates"
+version = "2.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59230a63c37f3e18569bdb90e4a89cbf5bf8b06fea0b84e65ea10cc4df47addd"
+dependencies = [
+ "difflib",
+ "float-cmp",
+ "itertools",
+ "normalize-line-endings",
+ "predicates-core",
+ "regex",
+]
+
+[[package]]
+name = "predicates"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09963355b9f467184c04017ced4a2ba2d75cbcb4e7462690d388233253d4b1a9"
+dependencies = [
+ "anstyle",
+ "difflib",
+ "itertools",
+ "predicates-core",
+]
+
+[[package]]
+name = "predicates-core"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b794032607612e7abeb4db69adb4e33590fa6cf1149e95fd7cb00e634b92f174"
+
+[[package]]
+name = "predicates-tree"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "368ba315fb8c5052ab692e68a0eefec6ec57b23a36959c14496f0b0df2c0cecf"
+dependencies = [
+ "predicates-core",
+ "termtree",
+]
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.66"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "18fb31db3f9bddb2ea821cde30a9f70117e3f119938b5ee630b7403aa6e2ead9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5267fca4496028628a95160fc423a33e8b2e6af8a5302579e322e4b520293cae"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "redox_syscall"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "567664f262709473930a4bf9e51bf2ebf3348f2e748ccc50dea20646858f8f29"
+dependencies = [
+ "bitflags 1.3.2",
+]
+
+[[package]]
+name = "regex"
+version = "1.9.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "697061221ea1b4a94a624f67d0ae2bfe4e22b8a17b6a192afb11046542cc8c47"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-automata 0.3.8",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-automata"
+version = "0.1.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c230d73fb8d8c1b9c0b3135c5142a8acee3a0558fb8db5cf1cb65f8d7862132"
+
+[[package]]
+name = "regex-automata"
+version = "0.3.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2f401f4955220693b56f8ec66ee9c78abffd8d1c4f23dc41a23839eb88f0795"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbb5fb1acd8a1a18b3dd5be62d25485eb770e05afb408a9627d14d451bae12da"
+
+[[package]]
+name = "rustix"
+version = "0.38.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0c3dde1fc030af041adc40e79c0e7fbcf431dd24870053d187d7c66e4b87453"
+dependencies = [
+ "bitflags 2.4.0",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.188"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf9e0fcba69a370eed61bcf2b728575f726b50b55cba78064753d708ddc7549e"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.188"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4eca7ac642d82aa35b60049a6eccb4be6be75e599bd2e9adb5f875a737654af2"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "similar"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "420acb44afdae038210c99e69aae24109f32f15500aa708e81d46c9f29d55fcf"
+dependencies = [
+ "bstr 0.2.17",
+ "unicode-segmentation",
+]
+
+[[package]]
+name = "similar-asserts"
+version = "1.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e041bb827d1bfca18f213411d51b665309f1afb37a04a5d1464530e13779fc0f"
+dependencies = [
+ "console",
+ "similar",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "718fa2415bcb8d8bd775917a1bf12a7931b6dfa890753378538118181e0cb398"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cb94d2f3cc536af71caac6b6fcebf65860b347e7ce0cc9ebe8f70d3e521054ef"
+dependencies = [
+ "cfg-if",
+ "fastrand",
+ "redox_syscall",
+ "rustix",
+ "windows-sys 0.48.0",
+]
+
+[[package]]
+name = "termtree"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3369f5ac52d5eb6ab48c6b4ffdc8efbcad6b89c765749064ba298f2c68a16a76"
+
+[[package]]
+name = "thiserror"
+version = "1.0.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d6d7a740b8a666a7e828dd00da9c0dc290dff53154ea77ac109281de90589b7"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.48"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49922ecae66cc8a249b77e68d1d0623c1b2c514f0060c27cdc68bd62a1219d35"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "thread_local"
+version = "1.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3fdd6f064ccff2d6567adcb3873ca630700f00b5ad3f060c25b5dcfd9a4ce152"
+dependencies = [
+ "cfg-if",
+ "once_cell",
+]
+
+[[package]]
+name = "txtar"
+version = "1.0.0"
+dependencies = [
+ "assert_fs",
+ "clean-path",
+ "predicates 2.1.5",
+ "similar-asserts",
+ "thiserror",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "301abaae475aa91687eb82514b328ab47a211a533026cb25fc3e519b86adfc3c"
+
+[[package]]
+name = "unicode-segmentation"
+version = "1.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1dd624098567895118886609431a7c3b8f516e41d30e0643f03d94592a147e36"
+
+[[package]]
+name = "walkdir"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d71d857dc86794ca4c280d616f7da00d2dbfd8cd788846559a6813e6aa4b54ee"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-util"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70ec6ce85bb158151cae5e5c87f95a8e97d2c0c4b001223f33a334e3ce5de178"
+dependencies = [
+ "winapi",
+]
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.48.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "677d2418bec65e3338edb076e806bc1ec15693c5d0104683f2efe857f61056a9"
+dependencies = [
+ "windows-targets 0.48.5",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9a2fa6e2155d7247be68c096456083145c183cbbbc2764150dda45a87197940c"
+dependencies = [
+ "windows_aarch64_gnullvm 0.48.5",
+ "windows_aarch64_msvc 0.48.5",
+ "windows_i686_gnu 0.48.5",
+ "windows_i686_msvc 0.48.5",
+ "windows_x86_64_gnu 0.48.5",
+ "windows_x86_64_gnullvm 0.48.5",
+ "windows_x86_64_msvc 0.48.5",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b38e32f0abccf9987a4e3079dfb67dcd799fb61361e53e2882c3cbaf0d905d8"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc35310971f3b2dbbf3f0690a219f40e2d9afcf64f9ab7cc1be722937c26b4bc"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a75915e7def60c94dcef72200b9a8e58e5091744960da64ec734a6c6e9b3743e"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f55c233f70c4b27f66c523580f78f1004e8b5a8b659e05a4eb49d4166cca406"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53d40abd2583d23e4718fddf1ebec84dbff8381c07cae67ff7768bbf19c6718e"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b7b52767868a23d5bab768e390dc5f5c55825b6d30b86c844ff2dc7414044cc"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.48.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed94fce61571a4006852b7389a063ab983c02eb1bb37b47f8272ce92d06d9538"
diff --git a/tsparser/txtar/Cargo.toml b/tsparser/txtar/Cargo.toml
new file mode 100644
index 0000000000..2dfe7f54dc
--- /dev/null
+++ b/tsparser/txtar/Cargo.toml
@@ -0,0 +1,24 @@
+[package]
+name = "txtar"
+version = "1.0.0"
+edition = "2021"
+authors = ["Frank de Jong <f.jin@protonmail.com>"]
+description = "A Rust implementation of the txtar Go package"
+license = "MIT/Apache-2.0"
+readme = "README.md"
+repository = "https://gitlab.com/foo-jin/txtar"
+documentation = "https://docs.rs/txtar/latest/txtar/"
+categories = ["filesystem", "development-tools::testing"]
+keywords = ["fs", "filesystem", "txtar", "tempfs"]
+exclude = [".gitignore"]
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+clean-path = "0.2.1"
+thiserror = "1.0"
+
+[dev-dependencies]
+assert_fs = "1.0.7"
+predicates = "2.1.1"
+similar-asserts = "1.2.0"
diff --git a/tsparser/txtar/LICENSE-APACHE b/tsparser/txtar/LICENSE-APACHE
new file mode 100644
index 0000000000..15055dd2f3
--- /dev/null
+++ b/tsparser/txtar/LICENSE-APACHE
@@ -0,0 +1,201 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+   To apply the Apache License to your work, attach the following
+   boilerplate notice, with the fields enclosed by brackets "[]"
+   replaced with your own identifying information. (Don't include
+   the brackets!)  The text should be enclosed in the appropriate
+   comment syntax for the file format. We also recommend that a
+   file or class name and description of purpose be included on the
+   same "printed page" as the copyright notice for easier
+   identification within third-party archives.
+
+Copyright 2022 Frank de Jong
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
diff --git a/tsparser/txtar/LICENSE-MIT b/tsparser/txtar/LICENSE-MIT
new file mode 100644
index 0000000000..220805c658
--- /dev/null
+++ b/tsparser/txtar/LICENSE-MIT
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2022 Frank de Jong
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/tsparser/txtar/README.md b/tsparser/txtar/README.md
new file mode 100644
index 0000000000..2a3804a879
--- /dev/null
+++ b/tsparser/txtar/README.md
@@ -0,0 +1,75 @@
+# txtar
+
+[![crates.io version][1]][2]
+[![docs.rs docs][3]][4]
+[![license][5]][6]
+
+A Rust implementation of the [txtar](https://github.com/golang/tools/tree/master/txtar) Go package.
+
+```sh
+cargo add txtar
+```
+
+## Usage
+```rust no_run
+let txt = "\
+comment1
+comment2
+-- file1 --
+File 1 text.
+-- foo/bar --
+File 2 text.
+-- empty --
+-- noNL --
+hello world";
+
+let archive = txtar::from_str(txt);
+archive.materialize("/tmp/somedir/").unwrap();
+```
+
+## Txtar goals
+As described in the Go package:
+
+> Package txtar implements a trivial text-based file archive format.
+>
+> The goals for the format are:
+>
+>	- be trivial enough to create and edit by hand.
+>	- be able to store trees of text files describing go command test cases.
+>	- diff nicely in git history and code reviews.
+>
+> Non-goals include being a completely general archive format,
+> storing binary data, storing file modes, storing special files like
+> symbolic links, and so on.
+
+
+## Txtar format spec
+The format spec as written in the `txtar` Go package source code:
+
+> Txtar format
+>
+> A txtar archive is zero or more comment lines and then a sequence of file entries.
+> Each file entry begins with a file marker line of the form "-- FILENAME --"
+> and is followed by zero or more file content lines making up the file data.
+> The comment or file content ends at the next file marker line.
+> The file marker line must begin with the three-byte sequence "-- "
+> and end with the three-byte sequence " --", but the enclosed
+> file name can be surrounded by additional white space,
+> all of which is stripped.
+>
+> If the txtar file is missing a trailing newline on the final line,
+> parsers should consider a final newline to be present anyway.
+>
+> There are no possible syntax errors in a txtar archive.
+
+## License
+
+[MIT](./LICENSE-MIT) OR [Apache-2.0](./LICENSE-APACHE)
+
+
+[1]: https://img.shields.io/crates/v/txtar.svg?style=flat-square
+[2]: https://crates.io/crates/txtar
+[3]: https://img.shields.io/badge/docs-latest-blue.svg?style=flat-square
+[4]: https://docs.rs/txtar
+[5]: https://img.shields.io/crates/l/txtar.svg?style=flat-square
+[6]: #license
diff --git a/tsparser/txtar/src/error.rs b/tsparser/txtar/src/error.rs
new file mode 100644
index 0000000000..0c97f5299c
--- /dev/null
+++ b/tsparser/txtar/src/error.rs
@@ -0,0 +1,11 @@
+use std::io;
+
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum MaterializeError {
+    #[error("{0}")]
+    Io(#[from] io::Error),
+    #[error("{0}: outside parent directory")]
+    DirEscape(String),
+}
diff --git a/tsparser/txtar/src/lib.rs b/tsparser/txtar/src/lib.rs
new file mode 100644
index 0000000000..0870d376d9
--- /dev/null
+++ b/tsparser/txtar/src/lib.rs
@@ -0,0 +1,394 @@
+//! `txtar` is a rust implementation of the `txtar` Go package.
+//!
+//! # About
+//!
+//! `txtar`s purpose is best described in the original Go package:
+//!
+//! > Package txtar implements a trivial text-based file archive format.
+//! >
+//! > The goals for the format are:
+//! >
+//! > - be trivial enough to create and edit by hand.
+//! > - be able to store trees of text files describing go command test cases.
+//! > - diff nicely in git history and code reviews.
+//! >
+//! > Non-goals include being a completely general archive format,
+//! > storing binary data, storing file modes, storing special files like
+//! > symbolic links, and so on.
+//!
+//!
+//! ## format spec
+//! The format spec as written in the `txtar` Go package source code:
+//!
+//! > Txtar format
+//! >
+//! > A txtar archive is zero or more comment lines and then a sequence of file entries.
+//! > Each file entry begins with a file marker line of the form "`-- FILENAME --`"
+//! > and is followed by zero or more file content lines making up the file data.
+//! > The comment or file content ends at the next file marker line.
+//! > The file marker line must begin with the three-byte sequence "`-- `"
+//! > and end with the three-byte sequence "` --`", but the enclosed
+//! > file name can be surrounding by additional white space,
+//! > all of which is stripped.
+//! >
+//! > If the txtar file is missing a trailing newline on the final line,
+//! > parsers should consider a final newline to be present anyway.
+//! >
+//! > There are no possible syntax errors in a txtar archive.
+//!
+//! # Example
+//!
+//! ```rust no_run
+//! let txt = "\
+//! comment1
+//! comment2
+//! -- file1 --
+//! File 1 text.
+//! -- foo/bar --
+//! File 2 text.
+//! -- empty --
+//! -- noNL --
+//! hello world";
+//!
+//! let archive = txtar::from_str(txt);
+//! archive.materialize("/tmp/somedir/").unwrap();
+//! ```
+
+mod error;
+
+use std::{
+    fmt::Display,
+    fs,
+    io::{self, BufWriter, Write},
+    path::{Path, PathBuf},
+    str,
+};
+
+use clean_path::Clean;
+
+pub use error::MaterializeError;
+
+/**
+An archive represents a tree of text files.
+
+This type is used to read txtar files from disk and materialize the
+corresponding file layout.
+
+# Examples
+
+```rust no_run
+use txtar::Archive;
+
+let txt = "\
+comment1
+comment2
+-- file1 --
+File 1 text.
+-- foo --
+File 2 text.
+-- empty --
+-- noNL --
+hello world";
+
+let archive = Archive::from(txt);
+archive.materialize("/tmp/somedir/").unwrap();
+```
+**/
+#[derive(Debug, Default, Eq, PartialEq, Clone)]
+pub struct Archive {
+    // internal invariant:
+    // comment is fix_newlined
+    pub comment: String,
+    pub files: Vec<File>,
+}
+
+#[derive(Debug, Eq, PartialEq, Clone)]
+pub struct File {
+    pub name: PathBuf,
+    // internal invariant:
+    // data is fix_newlined
+    pub data: String,
+}
+
+impl File {
+    pub fn new<P: AsRef<Path>>(name: P, data: &str) -> File {
+        let name = name.as_ref().to_owned();
+        let mut data = data.to_owned();
+        fix_newline(&mut data);
+
+        File { name, data }
+    }
+}
+
+impl Archive {
+    fn new(comment: &str, files: Vec<File>) -> Archive {
+        let mut comment = comment.to_owned();
+        fix_newline(&mut comment);
+
+        Archive { comment, files }
+    }
+
+    /// Serialize the archive as txtar into the I/O stream.
+    pub fn to_writer<W: Write>(&self, writer: &mut W) -> io::Result<()> {
+        write!(writer, "{self}")
+    }
+
+    /// Writes each file in this archive to the directory at the given
+    /// path.
+    ///
+    /// # Errors
+    ///
+    /// This function will error in the event a file would be written
+    /// outside of the directory or if an existing file would be
+    /// overwritten. Additionally, any errors caused by the underlying
+    /// I/O operations will be propagated.
+    pub fn materialize<P: AsRef<Path>>(&self, path: P) -> Result<(), MaterializeError> {
+        let path = path.as_ref();
+        for File { name, data } in &self.files {
+            let name_path = name.clean();
+            if name_path.starts_with("../") || name_path.is_absolute() {
+                return Err(MaterializeError::DirEscape(
+                    name_path.to_string_lossy().to_string(),
+                ));
+            }
+
+            let rel_path = name_path;
+            let path = path.join(rel_path);
+            if let Some(p) = path.parent() {
+                fs::create_dir_all(p)?;
+            }
+
+            let mut file = fs::File::options()
+                .write(true)
+                .create_new(true)
+                .open(path)?;
+            let mut w = BufWriter::new(&mut file);
+            w.write_all(data.as_bytes())?;
+        }
+
+        Ok(())
+    }
+}
+
+impl Display for Archive {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "{}", self.comment)?;
+
+        for File { name, data } in &self.files {
+            let name = name.display();
+            writeln!(f, "-- {name} --")?;
+            write!(f, "{data}")?;
+        }
+
+        Ok(())
+    }
+}
+
+impl TryFrom<&[u8]> for Archive {
+    type Error = std::str::Utf8Error;
+
+    fn try_from(slice: &[u8]) -> Result<Self, Self::Error> {
+        let s = str::from_utf8(slice)?;
+        Ok(Archive::from(s))
+    }
+}
+
+impl From<&str> for Archive {
+    fn from(s: &str) -> Archive {
+        let (comment, mut name, mut s) = split_file_markers(s);
+        let mut files = Vec::new();
+
+        while !name.is_empty() {
+            let (data, next_name, rest) = split_file_markers(s);
+
+            let file = File::new(name, data);
+            files.push(file);
+
+            name = next_name;
+            s = rest;
+        }
+
+        Archive::new(comment, files)
+    }
+}
+
+/// Read an archive from a string of txtar data.
+pub fn from_str(s: &str) -> Archive {
+    Archive::from(s)
+}
+
+/// Try to read an archive from bytes of txtar data.
+pub fn from_bytes(slice: &[u8]) -> Result<Archive, std::str::Utf8Error> {
+    Archive::try_from(slice)
+}
+
+fn split_file_markers(s: &str) -> (&str, &str, &str) {
+    const NEWLINE_MARKER: &str = "\n-- ";
+    const MARKER: &str = "-- ";
+    const MARKER_END: &str = " --";
+
+    let (prefix, rest) = if s.starts_with(MARKER) {
+        ("", s)
+    } else {
+        match s.find(NEWLINE_MARKER) {
+            None => return (s, "", ""),
+            Some(offset) => s.split_at(offset + 1),
+        }
+    };
+    debug_assert!(rest.starts_with(MARKER));
+
+    let (filename, suffix) = match rest.split_once('\n') {
+        None if rest.ends_with(MARKER_END) => (rest, ""),
+        None => return (s, "", ""),
+        Some((n, pf)) => (n, pf),
+    };
+
+    let filename = filename.trim_end_matches('\r');
+    debug_assert!(filename.ends_with(MARKER_END));
+
+    let filename = filename
+        .strip_prefix(MARKER)
+        .and_then(|filename| filename.strip_suffix(MARKER_END))
+        .unwrap()
+        .trim();
+    (prefix, filename, suffix)
+}
+
+fn fix_newline(s: &mut String) {
+    if !s.is_empty() && !s.ends_with('\n') {
+        s.push('\n');
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use assert_fs::{prelude::*, TempDir};
+    use predicates::prelude::{predicate::str::contains, *};
+    use similar_asserts::assert_eq;
+
+    const BASIC: &str = "\
+comment1
+comment2
+-- file1 --
+File 1 text.
+-- foo --
+File 2 text.
+-- empty --
+-- noNL --
+hello world";
+
+    #[test]
+    fn parse_format() {
+        // Test simplest
+        {
+            let simplest = "-- simplest.txt --";
+            let expected = format!("{simplest}\n");
+            check_parse_format("simplest", simplest, &expected);
+        }
+
+        // Test basic variety of inputs
+        {
+            let basic = BASIC;
+            let expected = format!("{basic}\n");
+            check_parse_format("basic", basic, &expected);
+        }
+
+        // Test CRLF input
+        {
+            let crlf = "blah\r\n-- hello --\r\nhello\r\n";
+            let expected = "\
+Archive { comment: \"blah\\r\\n\", files: [File { name: \"hello\", data: \"hello\\r\\n\" }] }";
+
+            let arch = format!("{:?}", Archive::from(crlf));
+            assert_eq!(&arch, expected, "parse[CRLF input]",);
+        }
+
+        // Test whitespace handling
+        {
+            let txtar = "--  a  --";
+            let expected = "-- a --\n";
+            check_parse_format("whitespace", txtar, expected)
+        }
+    }
+
+    fn check_parse_format(name: &str, txtar: &str, expected: &str) {
+        let arch = Archive::from(txtar);
+        let txtar = arch.to_string();
+        assert_eq!(txtar, expected, "parse[{name}]");
+    }
+
+    #[test]
+    fn materialize_basic() {
+        let dir = TempDir::new().unwrap();
+        let exists = predicate::path::exists();
+        let empty = predicate::str::is_empty().from_utf8().from_file_path();
+        {
+            let good = Archive::from("-- good.txt --");
+            good.materialize(&dir)
+                .expect("good.materialize should not error");
+            dir.child("good.txt").assert(exists).assert(empty);
+        }
+        {
+            let basic = Archive::from(BASIC);
+            basic
+                .materialize(&dir)
+                .expect("basic.materialize should not error");
+
+            check_contents(&dir, "file1", "File 1 text.");
+            check_contents(&dir, "foo", "File 2 text.");
+            check_contents(&dir, "noNL", "hello world");
+            dir.child("empty").assert(exists).assert(empty);
+        }
+        {
+            let bad_rel = Archive::from("-- ../bad.txt --");
+            check_bad_materialize(&dir, bad_rel, "../bad.txt");
+
+            let bad_abs = Archive::from("-- /bad.txt --");
+            check_bad_materialize(&dir, bad_abs, "/bad.txt");
+        }
+    }
+
+    #[test]
+    fn materialize_nested() {
+        let dir = TempDir::new().unwrap();
+
+        {
+            let nested = Archive::from(
+                "comment\n\
+			 -- foo/foo.txt --\nThis is foo.\n\
+			 -- bar/bar.txt --\nThis is bar.\n\
+			 -- bar/deep/deeper/abyss.txt --\nThis is in the DEEPS.",
+            );
+            nested
+                .materialize(&dir)
+                .expect("nested.materialize should not error");
+
+            check_contents(&dir, "foo/foo.txt", "This is foo.");
+            check_contents(&dir, "bar/bar.txt", "This is bar.");
+            check_contents(&dir, "bar/deep/deeper/abyss.txt", "This is in the DEEPS.");
+        }
+        {
+            let bad_nested_rel = Archive::from("-- bar/deep/deeper/../../../../escaped.txt --");
+            check_bad_materialize(&dir, bad_nested_rel, "../escaped.txt");
+        }
+    }
+
+    fn check_contents(dir: &TempDir, child: &str, contents: &str) {
+        let exists = predicate::path::exists();
+        let newline_ending = predicate::str::ends_with("\n").from_utf8().from_file_path();
+        dir.child(child)
+            .assert(exists)
+            .assert(contains(contents))
+            .assert(newline_ending);
+    }
+
+    fn check_bad_materialize(dir: &TempDir, bad_rel: Archive, expected: &str) {
+        let err = bad_rel.materialize(dir);
+        match err {
+            Err(MaterializeError::DirEscape(p)) => assert_eq!(p, expected.to_string()),
+            Err(e) => panic!("expected `MaterializeError::DirEscape`, got {e:?}"),
+            Ok(_) => panic!("materialize({expected}) outside of parent dir should have failed"),
+        }
+    }
+}
diff --git a/v2/app/api_framework.go b/v2/app/api_framework.go
new file mode 100644
index 0000000000..1761ead7be
--- /dev/null
+++ b/v2/app/api_framework.go
@@ -0,0 +1,124 @@
+package app
+
+import (
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app/apiframework"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/authhandler"
+	"encr.dev/v2/parser/apis/middleware"
+	"encr.dev/v2/parser/apis/servicestruct"
+	"encr.dev/v2/parser/infra/pubsub"
+)
+
+func configureAPIFramework(pc *parsectx.Context, services []*Service, res *parser.Result) option.Option[*apiframework.AppDesc] {
+	var (
+		endpoints      = parser.Resources[*api.Endpoint](res)
+		middlewares    = parser.Resources[*middleware.Middleware](res)
+		authHandlers   = parser.Resources[*authhandler.AuthHandler](res)
+		serviceStructs = parser.Resources[*servicestruct.ServiceStruct](res)
+		subscriptions  = parser.Resources[*pubsub.Subscription](res)
+	)
+
+	if len(endpoints) == 0 && len(middlewares) == 0 && len(authHandlers) == 0 && len(serviceStructs) == 0 && len(subscriptions) == 0 {
+		return option.None[*apiframework.AppDesc]()
+	}
+
+	fw := &apiframework.AppDesc{}
+
+	// First handle global API framework usage
+	// i.e. auth handlers and middleware which apply across all services
+
+	// Add the middleware
+	var svcMiddleware []*middleware.Middleware
+	for _, mw := range middlewares {
+		if mw.Global {
+			fw.GlobalMiddleware = append(fw.GlobalMiddleware, mw)
+		} else {
+			svcMiddleware = append(svcMiddleware, mw)
+		}
+	}
+
+	// Add the app's auth handler
+	for _, ah := range authHandlers {
+		if fw.AuthHandler.Empty() {
+			fw.AuthHandler = option.Some(ah)
+		} else {
+			pc.Errs.Add(
+				authhandler.ErrMultipleAuthHandlers.
+					AtGoNode(fw.AuthHandler.MustGet().Decl.AST.Type, errors.AsError("first auth handler defined here")).
+					AtGoNode(ah.Decl.AST.Type, errors.AsError("second auth handler defined here")),
+			)
+		}
+	}
+
+	modifySvcDesc := func(pkg *pkginfo.Package, errTemplate *errors.Template, fn func(svc *Service, desc *apiframework.ServiceDesc)) {
+		for _, svc := range services {
+			if pkg.FSPath.HasPrefix(svc.FSRoot) {
+				// We've found the service. Initialize the framework service description
+				// if necessary, and then call fn.
+				desc, ok := svc.Framework.Get()
+				if !ok {
+					desc = &apiframework.ServiceDesc{
+						RootPkg: pkg,
+					}
+					svc.Framework = option.Some(desc)
+				}
+				fn(svc, desc)
+				return
+			}
+		}
+
+		// We couldn't find the service. Add an error and don't call fn.
+		if errTemplate != nil {
+			pc.Errs.Add(*errTemplate)
+		} else {
+			pc.Errs.Add(errNoServiceFound(pkg.ImportPath))
+		}
+	}
+
+	for _, ep := range endpoints {
+		modifySvcDesc(ep.Package(), nil, func(svc *Service, desc *apiframework.ServiceDesc) {
+			desc.Endpoints = append(desc.Endpoints, ep)
+		})
+	}
+
+	for _, mw := range middlewares {
+		if !mw.Global {
+			missingErr := middleware.ErrSvcMiddlewareNotInService.AtGoNode(mw.Decl.AST.Name)
+
+			// Per-service middleware.
+			modifySvcDesc(mw.Package(), &missingErr, func(svc *Service, desc *apiframework.ServiceDesc) {
+				desc.Middleware = append(desc.Middleware, mw)
+			})
+		}
+	}
+
+	for _, ss := range serviceStructs {
+		modifySvcDesc(ss.Package(), nil, func(svc *Service, desc *apiframework.ServiceDesc) {
+			if desc.ServiceStruct.Empty() {
+				desc.ServiceStruct = option.Some(ss)
+			} else {
+				pc.Errs.Add(
+					servicestruct.ErrDuplicateServiceStructs.
+						AtGoNode(desc.ServiceStruct.MustGet().Decl.AST, errors.AsError("first service struct defined here")).
+						AtGoNode(ss.Decl.AST, errors.AsError("second service struct defined here")),
+				)
+			}
+		})
+	}
+
+	// Call modifySvcDesc for subscriptions and auth handlers, even though they don't actually
+	// modify the framework description, to actually tag the package as a service.
+	for _, ss := range subscriptions {
+		modifySvcDesc(ss.Package(), nil, func(svc *Service, desc *apiframework.ServiceDesc) {})
+	}
+	for _, ah := range authHandlers {
+		modifySvcDesc(ah.Package(), nil, func(svc *Service, desc *apiframework.ServiceDesc) {})
+	}
+
+	return option.Some(fw)
+}
diff --git a/v2/app/apiframework/apiframework.go b/v2/app/apiframework/apiframework.go
new file mode 100644
index 0000000000..e9a7957371
--- /dev/null
+++ b/v2/app/apiframework/apiframework.go
@@ -0,0 +1,36 @@
+package apiframework
+
+import (
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/authhandler"
+	"encr.dev/v2/parser/apis/middleware"
+	"encr.dev/v2/parser/apis/servicestruct"
+)
+
+// AppDesc describes an Encore Framework-based application.
+type AppDesc struct {
+	// GlobalMiddleware is the list of application-global middleware.
+	GlobalMiddleware []*middleware.Middleware
+
+	// AuthHandler defines the application's auth handler, if any.
+	AuthHandler option.Option[*authhandler.AuthHandler]
+}
+
+// ServiceDesc describes an Encore Framework-based service.
+//
+// For code that deals with general services, use *service.Service instead of this type.
+type ServiceDesc struct {
+	// Middleware are the service-specific middleware
+	Middleware []*middleware.Middleware
+
+	// RootPkg is the root package of the service.
+	RootPkg *pkginfo.Package
+
+	// Endpoints are the endpoints defined in this service.
+	Endpoints []*api.Endpoint
+
+	// ServiceStruct defines the service's service struct, if any.
+	ServiceStruct option.Option[*servicestruct.ServiceStruct]
+}
diff --git a/v2/app/app.go b/v2/app/app.go
new file mode 100644
index 0000000000..467ead2a43
--- /dev/null
+++ b/v2/app/app.go
@@ -0,0 +1,122 @@
+package app
+
+import (
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/app/apiframework"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/middleware"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/usage"
+)
+
+// Desc describes an Encore application.
+type Desc struct {
+	Errs *perr.List
+
+	BuildInfo  parsectx.BuildInfo
+	MainModule *pkginfo.Module
+	Parse      *parser.Result
+	Services   []*Service
+	Gateways   []*Gateway
+
+	// Framework describes API Framework-specific application-global data.
+	Framework option.Option[*apiframework.AppDesc]
+
+	// ResourceUsageOutsideServices describes resources that are used outside of a service.
+	ResourceUsageOutsideServices map[resource.Resource][]usage.Usage
+}
+
+// MatchingMiddleware reports which middleware applies to the given RPC,
+// and the order they apply in.
+func (d *Desc) MatchingMiddleware(ep *api.Endpoint) []*middleware.Middleware {
+	var matches []*middleware.Middleware
+
+	// Ensure middleware ordering is preserved.
+
+	// First add global middleware.
+	d.Framework.ForAll(func(fw *apiframework.AppDesc) {
+		for _, mw := range fw.GlobalMiddleware {
+			if mw.Target.ContainsAny(ep.Tags) {
+				matches = append(matches, mw)
+			}
+		}
+	})
+
+	// Then add service-specific middleware.
+	if svc, ok := d.ServiceForPath(ep.File.Pkg.FSPath); ok {
+		svc.Framework.ForAll(func(fw *apiframework.ServiceDesc) {
+			for _, mw := range fw.Middleware {
+				if mw.Target.ContainsAny(ep.Tags) {
+					matches = append(matches, mw)
+				}
+			}
+		})
+	}
+
+	return matches
+}
+
+// MatchingGlobalMiddleware reports which global middleware applies to the given RPC,
+// and the order they apply in.
+func (d *Desc) MatchingGlobalMiddleware(ep *api.Endpoint) []*middleware.Middleware {
+	var matches []*middleware.Middleware
+	d.Framework.ForAll(func(fw *apiframework.AppDesc) {
+		for _, mw := range fw.GlobalMiddleware {
+			if mw.Target.ContainsAny(ep.Tags) {
+				matches = append(matches, mw)
+			}
+		}
+	})
+	return matches
+}
+
+// ValidateAndDescribe validates the application and computes the
+// application description.
+func ValidateAndDescribe(pc *parsectx.Context, result *parser.Result) *Desc {
+	defer pc.Trace("app.ValidateAndDescribe").Done()
+
+	// First we want to discover the service layout
+	services := discoverServices(pc, result)
+
+	// We always have a default API gateway, for now.
+	gateways := []*Gateway{{EncoreName: "api-gateway"}}
+
+	// Now we can configure the API framework by combining the service information
+	// with the parse results.
+	framework := configureAPIFramework(pc, services, result)
+
+	desc := &Desc{
+		Errs:                         pc.Errs,
+		BuildInfo:                    pc.Build,
+		MainModule:                   result.MainModule(),
+		Parse:                        result,
+		Services:                     services,
+		Gateways:                     gateways,
+		Framework:                    framework,
+		ResourceUsageOutsideServices: make(map[resource.Resource][]usage.Usage),
+	}
+
+	// Find each services infra binds and usage.
+	desc.locateResourceBinds(result)
+	desc.locateResourceUsage(result)
+
+	// Run the application-level validations against the application description.
+	desc.validate(pc, result)
+
+	return desc
+}
+
+// ServiceForPath returns the service a given folder path belongs to, if any.
+func (d *Desc) ServiceForPath(path paths.FS) (*Service, bool) {
+	for _, svc := range d.Services {
+		if path.HasPrefix(svc.FSRoot) {
+			return svc, true
+		}
+	}
+	return nil, false
+}
diff --git a/v2/app/errors.go b/v2/app/errors.go
new file mode 100644
index 0000000000..adae1fb755
--- /dev/null
+++ b/v2/app/errors.go
@@ -0,0 +1,44 @@
+package app
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+const (
+	serviceHelp = "For more information on services and how to define them, see https://encore.dev/docs/primitives/services"
+)
+
+var (
+	errRange = errors.Range(
+		"app",
+		"",
+	)
+
+	errServiceContainedWitinAnother = errRange.Newf(
+		"Service contained within another service",
+		"The service %s was found within the service %s. Encore does not allow services to be nested.",
+		errors.WithDetails(serviceHelp),
+	)
+
+	errDuplicateServiceNames = errRange.Newf(
+		"Duplicate service names",
+		"Two services were found with the same name %q, services must have unique names.",
+	)
+
+	errNoServiceFound = errRange.Newf(
+		"No service found",
+		"No service was found for package %q.",
+		errors.MarkAsInternalError(),
+	)
+
+	errResourceDefinedOutsideOfService = errRange.New(
+		"Resource defined outside of service",
+		"Resources can only be defined within a service.",
+	)
+
+	errResourceUsedOutsideService = errRange.New(
+		"Invalid resource usage",
+		"Infrastructure resources can only be referenced within services.",
+		errors.WithDetails("To use infrastructure resources outside services, instead pass a reference to the resource into the library."),
+	)
+)
diff --git a/v2/app/gateway.go b/v2/app/gateway.go
new file mode 100644
index 0000000000..c40f3d23f9
--- /dev/null
+++ b/v2/app/gateway.go
@@ -0,0 +1,7 @@
+package app
+
+// Gateway describes an Encore gateway.
+type Gateway struct {
+	// EncoreName is the encore-name of the gateway.
+	EncoreName string
+}
diff --git a/v2/app/legacymeta/legacymeta.go b/v2/app/legacymeta/legacymeta.go
new file mode 100644
index 0000000000..1677fc9064
--- /dev/null
+++ b/v2/app/legacymeta/legacymeta.go
@@ -0,0 +1,650 @@
+package legacymeta
+
+import (
+	"cmp"
+	"fmt"
+	"go/token"
+	gotoken "go/token"
+	"slices"
+	"sort"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/paths"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	"encr.dev/v2/app"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/resourcepaths"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/authhandler"
+	"encr.dev/v2/parser/apis/middleware"
+	"encr.dev/v2/parser/apis/servicestruct"
+	"encr.dev/v2/parser/infra/caches"
+	"encr.dev/v2/parser/infra/config"
+	"encr.dev/v2/parser/infra/crons"
+	"encr.dev/v2/parser/infra/metrics"
+	"encr.dev/v2/parser/infra/objects"
+	"encr.dev/v2/parser/infra/pubsub"
+	"encr.dev/v2/parser/infra/secrets"
+	"encr.dev/v2/parser/infra/sqldb"
+	"encr.dev/v2/parser/resource"
+)
+
+type builder struct {
+	errs *perr.List
+	app  *app.Desc
+	md   *meta.Data // metadata being generated
+
+	decls map[declKey]uint32
+	nodes *TraceNodes
+}
+
+func Compute(errs *perr.List, appDesc *app.Desc) (*meta.Data, *TraceNodes) {
+	b := &builder{
+		errs:  errs,
+		app:   appDesc,
+		decls: make(map[declKey]uint32),
+	}
+	b.nodes = newTraceNodes(b)
+
+	md := b.Build()
+
+	return md, b.nodes
+}
+
+func (b *builder) Build() *meta.Data {
+	// TODO(andre) We assume the framework is used for now.
+	// When we add support for not using the framework we'll need
+	// to handle this differently.
+
+	b.md = &meta.Data{
+		ModulePath:         string(b.app.MainModule.Path),
+		AppRevision:        b.app.BuildInfo.Revision,
+		UncommittedChanges: b.app.BuildInfo.UncommittedChanges,
+		Experiments:        b.app.BuildInfo.Experiments.StringList(),
+		Language:           meta.Lang_GO,
+	}
+	md := b.md
+
+	for _, gw := range b.app.Gateways {
+		b.md.Gateways = append(b.md.Gateways, &meta.Gateway{
+			EncoreName: gw.EncoreName,
+		})
+	}
+
+	svcByName := make(map[string]*meta.Service, len(b.app.Services))
+	for _, svc := range b.app.Services {
+		out := &meta.Service{
+			Name: svc.Name,
+		}
+		svcByName[svc.Name] = out
+		md.Svcs = append(md.Svcs, out)
+
+		if fw, ok := svc.Framework.Get(); ok {
+			out.RelPath = b.relPath(fw.RootPkg.ImportPath)
+			for _, ep := range fw.Endpoints {
+				rpc := &meta.RPC{
+					Name:           ep.Name,
+					Doc:            zeroNil(ep.Doc),
+					ServiceName:    svc.Name,
+					RequestSchema:  b.schemaTypeUnwrapPointer(ep.Request),
+					ResponseSchema: b.schemaTypeUnwrapPointer(ep.Response),
+					Proto:          meta.RPC_REGULAR,
+					Loc:            b.schemaLoc(ep.Decl.File, ep.Decl.AST),
+					Path:           b.apiPath(ep.Decl.AST.Pos(), ep.Path),
+					HttpMethods:    ep.HTTPMethods,
+					Tags:           ep.Tags.ToProto(),
+					Sensitive:      ep.Sensitive,
+					Expose:         make(map[string]*meta.RPC_ExposeOptions),
+				}
+				if ep.Raw {
+					rpc.Proto = meta.RPC_RAW
+				}
+
+				switch ep.Access {
+				case api.Public:
+					rpc.AccessType = meta.RPC_PUBLIC
+					rpc.Expose["api-gateway"] = &meta.RPC_ExposeOptions{}
+					rpc.AllowUnauthenticated = true
+				case api.Auth:
+					rpc.AccessType = meta.RPC_AUTH
+					rpc.Expose["api-gateway"] = &meta.RPC_ExposeOptions{}
+				case api.Private:
+					rpc.AccessType = meta.RPC_PRIVATE
+					rpc.AllowUnauthenticated = true
+				default:
+					b.errs.Addf(ep.Decl.AST.Pos(), "internal error: unknown API access type %v", ep.Access)
+				}
+
+				out.Rpcs = append(out.Rpcs, rpc)
+				b.nodes.addEndpoint(ep, svc.Name)
+			}
+
+			// Sort the RPCs for deterministic output.
+			slices.SortFunc(out.Rpcs, func(a, b *meta.RPC) int {
+				return cmp.Compare(a.Name, b.Name)
+			})
+
+			// Do we have a database associated with the service?
+			// Note: we use the binds because it's possible to have an
+			// implicit bind that's not actually used. This is to ensure
+			// compatibility with the v1 parser.
+			for res := range svc.ResourceBinds {
+				switch res := res.(type) {
+				case *sqldb.Database:
+					out.Databases = append(out.Databases, res.Name)
+					// If the database name is the same as the service,
+					// it's the database defined by said service.
+					if res.Name == svc.Name {
+						out.Migrations = fns.Map(res.Migrations, transformMigration)
+					}
+				}
+			}
+
+		}
+	}
+
+	appPackages := b.app.Parse.AppPackages()
+	pkgByPath := make(map[paths.Pkg]*meta.Package, len(appPackages))
+	for _, pkg := range appPackages {
+		metaPkg := &meta.Package{
+			RelPath:     b.relPath(pkg.ImportPath),
+			Name:        pkg.Name,
+			Doc:         pkg.Doc,
+			ServiceName: "",
+			Secrets:     nil,
+			RpcCalls:    nil,
+			TraceNodes:  nil,
+		}
+		pkgByPath[pkg.ImportPath] = metaPkg
+
+		if svc, ok := b.app.ServiceForPath(pkg.FSPath); ok {
+			metaPkg.ServiceName = svc.Name
+		}
+
+		// Don't add main packages to the list of packages.
+		// Still track it in the map since other resources
+		// may depend on the package being known.
+		if pkg.Name != "main" {
+			md.Pkgs = append(md.Pkgs, metaPkg)
+		}
+
+		seenRPCCalls := make(map[pkginfo.QualifiedName]bool)
+		addRPCCall := func(ep *api.Endpoint) {
+			pkg := ep.Package()
+			qn := pkginfo.Q(pkg.ImportPath, ep.Name)
+			if !seenRPCCalls[qn] {
+				seenRPCCalls[qn] = true
+				metaPkg.RpcCalls = append(metaPkg.RpcCalls, &meta.QualifiedName{
+					Pkg:  b.relPath(pkg.ImportPath),
+					Name: ep.Name,
+				})
+			}
+		}
+
+		for _, u := range b.app.Parse.UsagesInPkg(pkg.ImportPath) {
+			switch u := u.(type) {
+			case *api.CallUsage:
+				addRPCCall(u.Endpoint)
+			case *api.ReferenceUsage:
+				// NOTE: The legacy meta does not distinguish between calls and references,
+				// and adds both to the list of RPC calls. Replicate this behavior.
+				addRPCCall(u.Endpoint)
+			}
+		}
+	}
+
+	// Keep track of state needed for dependent resources.
+	var (
+		// dependent are the resources that depend on other resources.
+		// They're processed in a second pass.
+		dependent []resource.Resource
+
+		topicMap   = make(map[pkginfo.QualifiedName]*meta.PubSubTopic)
+		clusterMap = make(map[pkginfo.QualifiedName]*meta.CacheCluster)
+	)
+
+	selectorLookup := computeSelectorLookup(b.app)
+	for _, r := range b.app.Parse.Resources() {
+		switch r := r.(type) {
+		case *crons.Job:
+			cj := &meta.CronJob{
+				Id:       r.Name,
+				Title:    r.Title,
+				Doc:      zeroNil(r.Doc),
+				Schedule: r.Schedule,
+				Endpoint: nil,
+			}
+			md.CronJobs = append(md.CronJobs, cj)
+			if ep, ok := b.app.Parse.ResourceForQN(r.Endpoint).Get(); ok {
+				endpoint := ep.(*api.Endpoint)
+				cj.Endpoint = &meta.QualifiedName{
+					Pkg:  b.relPath(endpoint.File.Pkg.ImportPath),
+					Name: endpoint.Name,
+				}
+			} else {
+				b.errs.Addf(r.EndpointAST.Pos(), "could not find endpoint %q", r.Endpoint)
+			}
+
+		case *authhandler.AuthHandler:
+			if svc, ok := b.app.ServiceForPath(r.Decl.File.FSPath); ok {
+				ah := &meta.AuthHandler{
+					Name:        r.Name,
+					Doc:         r.Doc,
+					PkgPath:     r.Package().ImportPath.String(),
+					PkgName:     r.Package().Name,
+					Loc:         b.schemaLoc(r.Decl.File, r.Decl.AST),
+					Params:      b.schemaTypeUnwrapPointer(r.Param),
+					ServiceName: svc.Name,
+				}
+				if data, ok := r.AuthData.Get(); ok {
+					ah.AuthData = b.typeDeclRefUnwrapPointer(data)
+				}
+				md.AuthHandler = ah
+				b.nodes.addAuthHandler(r, svc.Name)
+			} else {
+				b.errs.Addf(r.Decl.AST.Pos(), "auth handler %q must be defined within a service", r.Name)
+			}
+
+		case *sqldb.Database:
+			db := &meta.SQLDatabase{
+				Name:             r.Name,
+				Doc:              zeroNil(r.Doc),
+				MigrationRelPath: zeroNil(r.MigrationDir.String()),
+				Migrations:       fns.Map(r.Migrations, transformMigration),
+			}
+			md.SqlDatabases = append(md.SqlDatabases, db)
+
+		case *pubsub.Topic:
+			topic := &meta.PubSubTopic{
+				Name:          r.Name,
+				Doc:           zeroNil(r.Doc),
+				MessageType:   b.typeDeclRefUnwrapPointer(r.MessageType),
+				OrderingKey:   r.OrderingAttribute,
+				Publishers:    nil,
+				Subscriptions: nil, // filled in later
+			}
+
+			seenPublishers := make(map[string]bool)
+			addPublisher := func(svcName string) {
+				if !seenPublishers[svcName] {
+					seenPublishers[svcName] = true
+					topic.Publishers = append(topic.Publishers, &meta.PubSubTopic_Publisher{
+						ServiceName: svcName,
+					})
+				}
+			}
+
+			// Find all the publishers
+			for _, u := range b.app.Parse.Usages(r) {
+				switch u := u.(type) {
+				case *pubsub.PublishUsage:
+					if svc, ok := b.app.ServiceForPath(u.DeclaredIn().FSPath); ok {
+						// Is the publish call within a service? If so add that service as the publisher.
+						addPublisher(svc.Name)
+					} else if res2, ok := b.app.Parse.ResourceConstructorContaining(u).Get(); ok {
+						// Otherwise, is the publish call within a global middleware?
+						// If so add all services that middleware applies to.
+						switch res2 := res2.(type) {
+						case *middleware.Middleware:
+							if res2.Global {
+								for _, svc := range selectorLookup.GetServices(res2.Target) {
+									addPublisher(svc.Name)
+								}
+							}
+						}
+					}
+
+				case *pubsub.RefUsage:
+					if u.HasPerm(pubsub.PublishPerm) {
+						if svc, ok := b.app.ServiceForPath(u.DeclaredIn().FSPath); ok {
+							// Is the publish call within a service? If so add that service as the publisher.
+							addPublisher(svc.Name)
+						}
+					}
+				}
+			}
+
+			// Sort the publishers
+			slices.SortFunc(topic.Publishers, func(a, b *meta.PubSubTopic_Publisher) int {
+				return cmp.Compare(a.ServiceName, b.ServiceName)
+			})
+
+			switch r.DeliveryGuarantee {
+			case pubsub.ExactlyOnce:
+				topic.DeliveryGuarantee = meta.PubSubTopic_EXACTLY_ONCE
+			case pubsub.AtLeastOnce:
+				topic.DeliveryGuarantee = meta.PubSubTopic_AT_LEAST_ONCE
+			default:
+				panic(fmt.Sprintf("unknown delivery guarantee %v", r.DeliveryGuarantee))
+			}
+
+			for _, b := range b.app.Parse.PkgDeclBinds(r) {
+				topicMap[b.QualifiedName()] = topic
+			}
+			md.PubsubTopics = append(md.PubsubTopics, topic)
+
+		case *objects.Bucket:
+			bkt := &meta.Bucket{
+				Name:      r.Name,
+				Doc:       zeroNil(r.Doc),
+				Versioned: r.Versioned,
+				Public:    r.Public,
+			}
+			md.Buckets = append(md.Buckets, bkt)
+
+			permsBySvc := make(map[string][]objects.Perm)
+			addPerms := func(svcName string, perms ...objects.Perm) {
+				permsBySvc[svcName] = append(permsBySvc[svcName], perms...)
+			}
+
+			// Record all the permissions.
+			for _, u := range b.app.Parse.Usages(r) {
+				switch u := u.(type) {
+				case *objects.MethodUsage:
+					if svc, ok := b.app.ServiceForPath(u.DeclaredIn().FSPath); ok {
+						addPerms(svc.Name, u.Perm)
+					}
+				case *objects.RefUsage:
+					if svc, ok := b.app.ServiceForPath(u.DeclaredIn().FSPath); ok {
+						addPerms(svc.Name, u.Perms...)
+					}
+				}
+			}
+
+			// Collect the perms
+			for svcName, perms := range permsBySvc {
+				if svc, ok := svcByName[svcName]; ok {
+					ops := fns.Map(perms, func(p objects.Perm) meta.BucketUsage_Operation {
+						op, ok := p.ToMeta()
+						if !ok {
+							b.errs.Addf(token.NoPos, "unsupported permission %v", p)
+						}
+						return op
+					})
+					slices.Sort(ops)
+					svc.Buckets = append(svc.Buckets, &meta.BucketUsage{
+						Bucket:     bkt.Name,
+						Operations: ops,
+					})
+				}
+			}
+
+		case *caches.Cluster:
+			cluster := &meta.CacheCluster{
+				Name:           r.Name,
+				Doc:            r.Doc,
+				Keyspaces:      nil,
+				EvictionPolicy: r.EvictionPolicy,
+			}
+			for _, b := range b.app.Parse.PkgDeclBinds(r) {
+				clusterMap[b.QualifiedName()] = cluster
+			}
+			md.CacheClusters = append(md.CacheClusters, cluster)
+
+		case *metrics.Metric:
+			var svcName *string
+			if svc, ok := b.app.ServiceForPath(r.File.Pkg.FSPath); ok {
+				svcName = &svc.Name
+			}
+
+			m := &meta.Metric{
+				Name:        r.Name,
+				ValueType:   b.builtinType(r.ValueType),
+				Doc:         r.Doc,
+				ServiceName: svcName,
+			}
+			for _, label := range r.Labels {
+				m.Labels = append(m.Labels, &meta.Metric_Label{
+					Key:  label.Key,
+					Doc:  label.Doc,
+					Type: b.builtinType(label.Type),
+				})
+			}
+
+			if typ, ok := r.LabelType.Get(); ok {
+				// Register any declarations
+				b.schemaType(typ)
+			}
+
+			switch r.Type {
+			case metrics.Counter:
+				m.Kind = meta.Metric_COUNTER
+			case metrics.Gauge:
+				m.Kind = meta.Metric_GAUGE
+			default:
+				panic(fmt.Sprintf("unknown metric type %v", r.Type))
+			}
+
+			md.Metrics = append(md.Metrics, m)
+
+		case *config.Load:
+			if svc, ok := b.app.ServiceForPath(r.File.Pkg.FSPath); ok {
+				if metaSvc, ok := svcByName[svc.Name]; ok {
+					metaSvc.HasConfig = true
+				}
+			}
+			// Register the types.
+			b.schemaType(r.Type)
+
+		case *secrets.Secrets:
+			pkg, ok := pkgByPath[r.Package().ImportPath]
+			if !ok {
+				b.errs.Addf(r.ASTExpr().Pos(), "could not find package %q", r.Package().ImportPath)
+				continue
+			}
+			pkg.Secrets = append(pkg.Secrets, r.Keys...)
+			sort.Strings(pkg.Secrets)
+
+		case *middleware.Middleware:
+			mw := &meta.Middleware{
+				Name: &meta.QualifiedName{
+					Pkg:  b.relPath(r.Package().ImportPath),
+					Name: r.Decl.Name,
+				},
+				Doc:         r.Doc,
+				Loc:         b.schemaLoc(r.Decl.File, r.Decl.AST),
+				Global:      r.Global,
+				ServiceName: nil,
+				Target:      r.Target.ToProto(),
+			}
+			md.Middleware = append(md.Middleware, mw)
+			if svc, ok := b.app.ServiceForPath(r.File.Pkg.FSPath); ok {
+				mw.ServiceName = &svc.Name
+			}
+
+			b.nodes.addMiddleware(r)
+
+		case *servicestruct.ServiceStruct:
+			if svc, ok := b.app.ServiceForPath(r.Decl.File.FSPath); ok {
+				b.nodes.addServiceStruct(r, svc.Name)
+			}
+
+		case *pubsub.Subscription, *caches.Keyspace:
+			dependent = append(dependent, r)
+		}
+	}
+
+	// Make a second pass for resources that depend on other resources.
+	for _, r := range dependent {
+		switch r := r.(type) {
+		case *pubsub.Subscription:
+			topic, ok := topicMap[r.Topic]
+			if !ok {
+				b.errs.Addf(r.ASTExpr().Pos(), "topic %q not found",
+					r.Topic.NaiveDisplayName())
+				continue
+			}
+
+			svc, ok := b.app.ServiceForPath(r.File.Pkg.FSPath)
+			if !ok {
+				b.errs.Addf(r.ASTExpr().Pos(), "pubsub subscription %q must be defined within a service",
+					r.Name)
+				continue
+			}
+
+			topic.Subscriptions = append(topic.Subscriptions, &meta.PubSubTopic_Subscription{
+				Name:             r.Name,
+				ServiceName:      svc.Name,
+				AckDeadline:      r.Cfg.AckDeadline.Nanoseconds(),
+				MessageRetention: r.Cfg.MessageRetention.Nanoseconds(),
+				MaxConcurrency:   zeroNil(int32(r.Cfg.MaxConcurrency)),
+				RetryPolicy: &meta.PubSubTopic_RetryPolicy{
+					MinBackoff: r.Cfg.MinRetryBackoff.Nanoseconds(),
+					MaxBackoff: r.Cfg.MaxRetryBackoff.Nanoseconds(),
+					MaxRetries: int64(r.Cfg.MaxRetries),
+				},
+			})
+
+			b.nodes.addSub(r, svc.Name, topic.Name)
+
+		case *caches.Keyspace:
+			cluster, ok := clusterMap[r.Cluster]
+			if !ok {
+				b.errs.Addf(r.ASTExpr().Pos(), "cluster %q not found",
+					r.Cluster.NaiveDisplayName())
+				continue
+			}
+
+			svc, ok := b.app.ServiceForPath(r.File.Pkg.FSPath)
+			if !ok {
+				b.errs.Addf(r.ASTExpr().Pos(), "cache keyspace must be defined within a service")
+				continue
+			}
+
+			cluster.Keyspaces = append(cluster.Keyspaces, &meta.CacheCluster_Keyspace{
+				Service:     svc.Name,
+				KeyType:     b.schemaType(r.KeyType),
+				ValueType:   b.schemaType(r.ValueType),
+				PathPattern: b.keyspacePath(r.Path),
+				Doc:         r.Doc,
+			})
+		}
+	}
+
+	// Add the allocated trace nodes to each package.
+	for pkgPath, pkg := range pkgByPath {
+		pkg.TraceNodes = b.nodes.forPkg(pkgPath)
+	}
+
+	// If we have an auth handler, consider that an explicit gateway.
+	if md.AuthHandler != nil && len(md.Gateways) == 0 {
+		md.Gateways = append(md.Gateways, &meta.Gateway{
+			EncoreName: "api-gateway",
+			Explicit: &meta.Gateway_Explicit{
+				ServiceName: md.AuthHandler.ServiceName,
+				AuthHandler: md.AuthHandler,
+			},
+		})
+	} else if len(md.Gateways) == 0 {
+		// Otherwise, add a default gateway.
+		md.Gateways = append(md.Gateways, &meta.Gateway{
+			EncoreName: "api-gateway",
+			Explicit:   nil,
+		})
+	}
+
+	return md
+}
+
+func (b *builder) apiPath(pos gotoken.Pos, path *resourcepaths.Path) *meta.Path {
+	res := &meta.Path{
+		Type: meta.Path_URL,
+	}
+	for _, p := range path.Segments {
+		seg := &meta.PathSegment{
+			Value: p.Value,
+		}
+
+		switch p.ValueType {
+		case schema.String:
+			seg.ValueType = meta.PathSegment_STRING
+		case schema.Bool:
+			seg.ValueType = meta.PathSegment_BOOL
+		case schema.Int8:
+			seg.ValueType = meta.PathSegment_INT8
+		case schema.Int16:
+			seg.ValueType = meta.PathSegment_INT16
+		case schema.Int32:
+			seg.ValueType = meta.PathSegment_INT32
+		case schema.Int64:
+			seg.ValueType = meta.PathSegment_INT64
+		case schema.Int:
+			seg.ValueType = meta.PathSegment_INT
+		case schema.Uint8:
+			seg.ValueType = meta.PathSegment_UINT8
+		case schema.Uint16:
+			seg.ValueType = meta.PathSegment_UINT16
+		case schema.Uint32:
+			seg.ValueType = meta.PathSegment_UINT32
+		case schema.Uint64:
+			seg.ValueType = meta.PathSegment_UINT64
+		case schema.Uint:
+			seg.ValueType = meta.PathSegment_UINT
+		case schema.UUID:
+			seg.ValueType = meta.PathSegment_UUID
+		default:
+			b.errs.Addf(pos, "internal error: unknown path segment value type %v", p.ValueType)
+		}
+
+		switch p.Type {
+		case resourcepaths.Literal:
+			seg.Type = meta.PathSegment_LITERAL
+		case resourcepaths.Param:
+			seg.Type = meta.PathSegment_PARAM
+		case resourcepaths.Wildcard:
+			seg.Type = meta.PathSegment_WILDCARD
+		case resourcepaths.Fallback:
+			seg.Type = meta.PathSegment_FALLBACK
+		}
+
+		res.Segments = append(res.Segments, seg)
+	}
+	return res
+}
+
+func transformMigration(res sqldb.MigrationFile) *meta.DBMigration {
+	return &meta.DBMigration{
+		Filename:    res.Filename,
+		Number:      uint64(res.Number),
+		Description: res.Description,
+	}
+}
+
+func (b *builder) keyspacePath(path *resourcepaths.Path) *meta.Path {
+	res := &meta.Path{
+		Type: meta.Path_CACHE_KEYSPACE,
+	}
+	for _, p := range path.Segments {
+		seg := &meta.PathSegment{
+			Value: p.Value,
+		}
+
+		switch p.Type {
+		case resourcepaths.Literal:
+			seg.Type = meta.PathSegment_LITERAL
+		case resourcepaths.Param:
+			seg.Type = meta.PathSegment_PARAM
+		}
+
+		res.Segments = append(res.Segments, seg)
+	}
+	return res
+}
+
+func (b *builder) relPath(pkg paths.Pkg) string {
+	rel, ok := b.app.MainModule.Path.RelativePathToPkg(pkg)
+	if !ok {
+		panic("cannot compute relative path to package outside main module: " + pkg.String())
+	}
+	return rel.String()
+}
+
+func zeroNil[T comparable](val T) *T {
+	var zero T
+	if val == zero {
+		return nil
+	}
+	return &val
+}
diff --git a/v2/app/legacymeta/schema.go b/v2/app/legacymeta/schema.go
new file mode 100644
index 0000000000..00223b6bdd
--- /dev/null
+++ b/v2/app/legacymeta/schema.go
@@ -0,0 +1,392 @@
+package legacymeta
+
+import (
+	"fmt"
+	"go/ast"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/idents"
+	"encr.dev/pkg/paths"
+	schema "encr.dev/proto/encore/parser/schema/v1"
+	"encr.dev/v2/internals/pkginfo"
+	schemav2 "encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"github.com/fatih/structtag"
+)
+
+func (b *builder) builtinType(typ schemav2.BuiltinType) schema.Builtin {
+	switch typ.Kind {
+	case schemav2.Bool:
+		return schema.Builtin_BOOL
+	case schemav2.Int:
+		return schema.Builtin_INT
+	case schemav2.Int8:
+		return schema.Builtin_INT8
+	case schemav2.Int16:
+		return schema.Builtin_INT16
+	case schemav2.Int32:
+		return schema.Builtin_INT32
+	case schemav2.Int64:
+		return schema.Builtin_INT64
+	case schemav2.Uint:
+		return schema.Builtin_UINT
+	case schemav2.Uint8:
+		return schema.Builtin_UINT8
+	case schemav2.Uint16:
+		return schema.Builtin_UINT16
+	case schemav2.Uint32:
+		return schema.Builtin_UINT32
+	case schemav2.Uint64:
+		return schema.Builtin_UINT64
+
+	case schemav2.Float32:
+		return schema.Builtin_FLOAT32
+	case schemav2.Float64:
+		return schema.Builtin_FLOAT64
+	case schemav2.String:
+		return schema.Builtin_STRING
+	case schemav2.Bytes:
+		return schema.Builtin_BYTES
+
+	case schemav2.Time:
+		return schema.Builtin_TIME
+	case schemav2.UUID:
+		return schema.Builtin_UUID
+	case schemav2.JSON:
+		return schema.Builtin_JSON
+	case schemav2.UserID:
+		return schema.Builtin_USER_ID
+
+	default:
+		panic(fmt.Sprintf("unknown builtin type %v", typ.Kind))
+	}
+}
+
+func (b *builder) schemaType(typ schemav2.Type) *schema.Type {
+	switch typ := typ.(type) {
+	case nil:
+		return nil
+
+	case schemav2.BuiltinType:
+		return &schema.Type{Typ: &schema.Type_Builtin{
+			Builtin: b.builtinType(typ),
+		}}
+
+	case schemav2.NamedType:
+		if typ.DeclInfo.File.Pkg.ImportPath == "encore.dev/config" {
+			return b.configValue(typ)
+		}
+		return &schema.Type{Typ: &schema.Type_Named{
+			Named: &schema.Named{
+				Id:            b.decl(typ.Decl()),
+				TypeArguments: b.schemaTypes(typ.TypeArgs...),
+			},
+		}}
+
+	case schemav2.StructType:
+		var fields []*schema.Field
+		for _, f := range typ.Fields {
+			if f.IsAnonymous() {
+				continue // not supported by meta
+			}
+			field := b.structField(f)
+			if f.IsExported() { // to match legacy meta behavior
+				fields = append(fields, field)
+			}
+		}
+
+		return &schema.Type{Typ: &schema.Type_Struct{
+			Struct: &schema.Struct{
+				Fields: fields,
+			},
+		}}
+
+	case schemav2.MapType:
+		return &schema.Type{Typ: &schema.Type_Map{
+			Map: &schema.Map{
+				Key:   b.schemaType(typ.Key),
+				Value: b.schemaType(typ.Value),
+			},
+		}}
+
+	case schemav2.ListType:
+		// An array of bytes (like [16]byte for a UUID) is not represented
+		// as the builtin BYTES in the schemav2 parser, but the legacy metadata does.
+		if typ.Len >= 0 && schemautil.IsBuiltinKind(typ.Elem, schemav2.Uint8) {
+			return &schema.Type{Typ: &schema.Type_Builtin{
+				Builtin: schema.Builtin_BYTES,
+			}}
+		}
+
+		return &schema.Type{Typ: &schema.Type_List{
+			List: &schema.List{
+				Elem: b.schemaType(typ.Elem),
+			},
+		}}
+
+	case schemav2.PointerType:
+		return &schema.Type{Typ: &schema.Type_Pointer{
+			Pointer: &schema.Pointer{
+				Base: b.schemaType(typ.Elem),
+			},
+		}}
+
+	case schemav2.TypeParamRefType:
+		return &schema.Type{Typ: &schema.Type_TypeParameter{
+			TypeParameter: &schema.TypeParameterRef{
+				DeclId:   b.decl(typ.Decl),
+				ParamIdx: uint32(typ.Index),
+			},
+		}}
+
+	default:
+		b.errs.Addf(typ.ASTExpr().Pos(), "unsupported schema type %T", typ)
+	}
+
+	return nil
+}
+
+// schemaTypeUnwrapPointer returns the schema type for the given type,
+// but unwraps the initial pointer if it is one.
+// This is used for backwards compatibility with the legacy metadata,
+// where certain types where returned without the leading pointer
+// (most usages of *est.Param).
+func (b *builder) schemaTypeUnwrapPointer(typ schemav2.Type) *schema.Type {
+	if ptr, ok := typ.(schemav2.PointerType); ok {
+		return b.schemaType(ptr.Elem)
+	}
+	return b.schemaType(typ)
+}
+
+func (b *builder) structField(f schemav2.StructField) *schema.Field {
+	field := &schema.Field{
+		Typ:             b.schemaType(f.Type),
+		Name:            f.Name.MustGet(),
+		Doc:             f.Doc,
+		JsonName:        "",
+		Optional:        false,
+		QueryStringName: "",
+		RawTag:          f.Tag.String(),
+		Tags:            nil,
+	}
+
+	for _, tag := range f.Tag.Tags() {
+		field.Tags = append(field.Tags, &schema.Tag{
+			Key:     tag.Key,
+			Name:    tag.Name,
+			Options: tag.Options,
+		})
+	}
+
+	// Process encore tags
+	if enc, _ := f.Tag.Get("encore"); enc != nil {
+		ops := append([]string{enc.Name}, enc.Options...)
+		for _, o := range ops {
+			switch o {
+			case "optional":
+				field.Optional = true
+			case "httpstatus":
+				// Set WireSpec for HttpStatus fields
+				field.Wire = &schema.WireSpec{
+					Location: &schema.WireSpec_HttpStatus_{
+						HttpStatus: &schema.WireSpec_HttpStatus{},
+					},
+				}
+			}
+		}
+	}
+
+	// Set WireSpec for header fields
+	if header, _ := f.Tag.Get("header"); header != nil {
+		headerSpec := &schema.WireSpec_Header{}
+		if header.Name != "" {
+			headerSpec.Name = &header.Name
+		}
+		field.Wire = &schema.WireSpec{
+			Location: &schema.WireSpec_Header_{
+				Header: headerSpec,
+			},
+		}
+	}
+
+	getQueryTag := func() *structtag.Tag {
+		if q, _ := f.Tag.Get("query"); q != nil {
+			return q
+		}
+		if q, _ := f.Tag.Get("qs"); q != nil {
+			return q
+		}
+		return nil
+	}
+
+	// Set WireSpec for query string fields
+	if query := getQueryTag(); query != nil {
+		querySpec := &schema.WireSpec_Query{}
+		if query.Name != "" {
+			querySpec.Name = &query.Name
+		}
+		field.Wire = &schema.WireSpec{
+			Location: &schema.WireSpec_Query_{
+				Query: querySpec,
+			},
+		}
+	}
+
+	// Set WireSpec for cookie fields
+	if cookie, _ := f.Tag.Get("cookie"); cookie != nil {
+		cookieSpec := &schema.WireSpec_Cookie{}
+		if cookie.Name != "" {
+			cookieSpec.Name = &cookie.Name
+		}
+		field.Wire = &schema.WireSpec{
+			Location: &schema.WireSpec_Cookie_{
+				Cookie: cookieSpec,
+			},
+		}
+	}
+
+	if js, _ := f.Tag.Get("json"); js != nil {
+		if v := js.Name; v != "" {
+			field.JsonName = v
+		}
+	}
+
+	if qs := getQueryTag(); qs != nil {
+		if v := qs.Name; v != "" {
+			field.QueryStringName = v
+		}
+	}
+	if field.QueryStringName == "" {
+		field.QueryStringName = idents.Convert(field.Name, idents.SnakeCase)
+	}
+
+	return field
+}
+
+func (b *builder) configValue(typ schemav2.NamedType) *schema.Type {
+	switch typ.DeclInfo.Name {
+	case "Value", "Values":
+		isList := typ.DeclInfo.Name == "Values"
+		elem := b.schemaType(typ.TypeArgs[0])
+
+		if isList {
+			elem = &schema.Type{Typ: &schema.Type_List{
+				List: &schema.List{
+					Elem: elem,
+				},
+			}}
+		}
+
+		return &schema.Type{Typ: &schema.Type_Config{
+			Config: &schema.ConfigValue{
+				Elem:         elem,
+				IsValuesList: isList,
+			},
+		}}
+
+	default:
+		// Should be a named config type, like "type String = Value[string]".
+		if named, ok := typ.Decl().Type.(schemav2.NamedType); ok {
+			return b.configValue(named)
+		} else {
+			b.errs.Addf(typ.ASTExpr().Pos(), "unsupported config type %q", typ.DeclInfo.Name)
+			return nil
+		}
+	}
+}
+
+func (b *builder) schemaTypes(typs ...schemav2.Type) []*schema.Type {
+	return fns.Map(typs, b.schemaType)
+}
+
+func (b *builder) declInfo(info *pkginfo.PkgDeclInfo) uint32 {
+	return b.declKey(info.File.Pkg.ImportPath, info.Name)
+}
+
+func (b *builder) decl(decl schemav2.Decl) uint32 {
+	typeDecl, ok := decl.(*schemav2.TypeDecl)
+	if !ok {
+		b.errs.Fatalf(decl.ASTNode().Pos(), "cannot add declaration %q of type %T", decl.String(), decl)
+		return 0 // unreachable
+	}
+
+	pkgName, ok := typeDecl.PkgName().Get()
+	if !ok {
+		b.errs.Fatalf(decl.ASTNode().Pos(), "cannot add declaration %q that's not at package level", decl.String())
+		return 0 // unreachable
+	}
+
+	// Do we already have this declaration added?
+	file := decl.DeclaredIn()
+	pkg := file.Pkg
+	k := declKey{pkgPath: pkg.ImportPath, pkgName: pkgName}
+	if n, ok := b.decls[k]; ok {
+		return n
+	}
+
+	// Otherwise add it.
+	declIdx := uint32(len(b.md.Decls))
+	b.decls[k] = declIdx
+
+	typeParams := fns.Map(typeDecl.TypeParams, func(p schemav2.DeclTypeParam) *schema.TypeParameter {
+		return &schema.TypeParameter{Name: p.Name}
+	})
+
+	// Allocate the object and add it to the list
+	// without the underlying type. We'll add the
+	// underlying type afterwards to properly handle
+	// recursive and mutually recursive types.
+	d := &schema.Decl{
+		Id:         declIdx,
+		Name:       pkgName,
+		Type:       nil, // computed below
+		TypeParams: typeParams,
+		Doc:        typeDecl.Info.Doc,
+		Loc:        b.schemaLoc(file, decl.ASTNode()),
+	}
+	b.md.Decls = append(b.md.Decls, d)
+
+	d.Type = b.schemaType(typeDecl.Type)
+
+	return declIdx
+}
+
+func (b *builder) schemaLoc(f *pkginfo.File, node ast.Node) *schema.Loc {
+	tokenFile := f.Token()
+	sPos, ePos := tokenFile.Position(node.Pos()), tokenFile.Position(node.Pos())
+	return &schema.Loc{
+		PkgName:      f.Pkg.Name,
+		PkgPath:      string(f.Pkg.ImportPath),
+		Filename:     f.Name,
+		StartPos:     int32(tokenFile.Offset(node.Pos())),
+		EndPos:       int32(tokenFile.Offset(node.End())),
+		SrcLineStart: int32(sPos.Line),
+		SrcLineEnd:   int32(ePos.Line),
+		SrcColStart:  int32(sPos.Column),
+		SrcColEnd:    int32(ePos.Column),
+	}
+}
+
+type declKey struct {
+	pkgPath paths.Pkg
+	pkgName string
+}
+
+func (b *builder) declKey(pkgPath paths.Pkg, pkgName string) uint32 {
+	k := declKey{pkgPath: pkgPath, pkgName: pkgName}
+	if n, ok := b.decls[k]; ok {
+		return n
+	}
+
+	n := uint32(len(b.decls))
+	b.decls[k] = n
+	return n
+}
+
+func (b *builder) typeDeclRef(typ *schemav2.TypeDeclRef) *schema.Type {
+	return b.schemaType(typ.ToType())
+}
+
+func (b *builder) typeDeclRefUnwrapPointer(typ *schemav2.TypeDeclRef) *schema.Type {
+	return b.schemaTypeUnwrapPointer(typ.ToType())
+}
diff --git a/v2/app/legacymeta/selector_lookup.go b/v2/app/legacymeta/selector_lookup.go
new file mode 100644
index 0000000000..1358836053
--- /dev/null
+++ b/v2/app/legacymeta/selector_lookup.go
@@ -0,0 +1,80 @@
+package legacymeta
+
+import (
+	"fmt"
+
+	"encr.dev/v2/app"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/selector"
+)
+
+// selectorLookup is a helper cache for looking up services and RPC's by selector
+type selectorLookup struct {
+	services  map[selector.Key]map[*app.Service]struct{}
+	endpoints map[selector.Key]map[*api.Endpoint]struct{}
+}
+
+// computeSelectorLookup creates a selector lookup from this application
+func computeSelectorLookup(appDesc *app.Desc) *selectorLookup {
+	s := &selectorLookup{
+		services:  make(map[selector.Key]map[*app.Service]struct{}),
+		endpoints: make(map[selector.Key]map[*api.Endpoint]struct{}),
+	}
+
+	// Record all RPCs
+	for _, ep := range parser.Resources[*api.Endpoint](appDesc.Parse) {
+		svc, ok := appDesc.ServiceForPath(ep.File.FSPath)
+		if !ok {
+			panic(fmt.Sprintf("no service found for endpoint %s.%s", ep.File.Pkg.Name, ep.Name))
+		}
+
+		// Track against all
+		s.recordEndpoint(selector.Selector{Type: selector.All}, ep, svc)
+
+		// Track against any defined tags
+		ep.Tags.ForEach(func(sel selector.Selector) {
+			s.recordEndpoint(sel, ep, svc)
+		})
+	}
+
+	return s
+}
+
+// recordRPC tracks both the RPC for the selector, but also the service the RPC is in
+func (sm *selectorLookup) recordEndpoint(s selector.Selector, ep *api.Endpoint, svc *app.Service) {
+	key := s.Key()
+	if sm.endpoints[key] == nil {
+		sm.endpoints[key] = make(map[*api.Endpoint]struct{})
+	}
+	sm.endpoints[key][ep] = struct{}{}
+
+	if sm.services[key] == nil {
+		sm.services[key] = make(map[*app.Service]struct{})
+	}
+	sm.services[key][svc] = struct{}{}
+}
+
+// GetEndpoints returns all the rpcs which match any of the given selectors
+func (sm *selectorLookup) GetEndpoints(targets selector.Set) (rtn []*api.Endpoint) {
+	targets.ForEach(func(s selector.Selector) {
+		if rpcs, found := sm.endpoints[s.Key()]; found {
+			for rpc := range rpcs {
+				rtn = append(rtn, rpc)
+			}
+		}
+	})
+	return
+}
+
+// GetServices returns all services which match any of the given selectors
+func (sm *selectorLookup) GetServices(targets selector.Set) (rtn []*app.Service) {
+	targets.ForEach(func(s selector.Selector) {
+		if services, found := sm.services[s.Key()]; found {
+			for svc := range services {
+				rtn = append(rtn, svc)
+			}
+		}
+	})
+	return
+}
diff --git a/v2/app/legacymeta/trace_nodes.go b/v2/app/legacymeta/trace_nodes.go
new file mode 100644
index 0000000000..a47af2ca31
--- /dev/null
+++ b/v2/app/legacymeta/trace_nodes.go
@@ -0,0 +1,218 @@
+package legacymeta
+
+import (
+	"fmt"
+	"go/ast"
+	"path"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/authhandler"
+	"encr.dev/v2/parser/apis/middleware"
+	"encr.dev/v2/parser/apis/servicestruct"
+	"encr.dev/v2/parser/infra/pubsub"
+)
+
+func newTraceNodes(b *builder) *TraceNodes {
+	return &TraceNodes{
+		b:           b,
+		nodes:       make(map[paths.Pkg][]*meta.TraceNode),
+		middlewares: make(map[*middleware.Middleware]*meta.TraceNode),
+		subs:        make(map[*pubsub.Subscription]*meta.TraceNode),
+		svcStructs:  make(map[*servicestruct.ServiceStruct]*meta.TraceNode),
+		endpoints:   make(map[*api.Endpoint]*meta.TraceNode),
+	}
+}
+
+// TraceNodes describes the allocated [meta.TraceNode] in the app.
+// The public methods are safe to use even on a nil TraceNodes.
+type TraceNodes struct {
+	b     *builder
+	id    int32
+	nodes map[paths.Pkg][]*meta.TraceNode
+
+	authHandler *meta.TraceNode
+	middlewares map[*middleware.Middleware]*meta.TraceNode
+	subs        map[*pubsub.Subscription]*meta.TraceNode
+	svcStructs  map[*servicestruct.ServiceStruct]*meta.TraceNode
+	endpoints   map[*api.Endpoint]*meta.TraceNode
+}
+
+func (n *TraceNodes) AuthHandler() uint32 {
+	if n == nil {
+		return 0
+	}
+	return nodeID(n.authHandler)
+}
+
+func (n *TraceNodes) Middleware(mw *middleware.Middleware) uint32 {
+	if n == nil {
+		return 0
+	}
+	return nodeID(n.middlewares[mw])
+}
+
+func (n *TraceNodes) Sub(sub *pubsub.Subscription) uint32 {
+	if n == nil {
+		return 0
+	}
+	return nodeID(n.subs[sub])
+}
+
+func (n *TraceNodes) SvcStruct(svcStruct *servicestruct.ServiceStruct) uint32 {
+	if n == nil {
+		return 0
+	}
+	return nodeID(n.svcStructs[svcStruct])
+}
+
+func (n *TraceNodes) Endpoint(ep *api.Endpoint) uint32 {
+	if n == nil {
+		return 0
+	}
+	return nodeID(n.endpoints[ep])
+}
+
+func (n *TraceNodes) addAuthHandler(ah *authhandler.AuthHandler, svcName string) {
+	traceNode, context := n.alloc(ah.Decl.File, ah.Decl.AST)
+	traceNode.Context = &meta.TraceNode_AuthHandlerDef{
+		AuthHandlerDef: &meta.AuthHandlerDefNode{
+			ServiceName: svcName,
+			Name:        ah.Decl.Name,
+			Context:     string(context),
+		},
+	}
+	n.authHandler = traceNode
+}
+
+func (n *TraceNodes) addServiceStruct(s *servicestruct.ServiceStruct, svcName string) {
+	traceNode, context := n.alloc(s.Decl.File, s.Decl.AST)
+	traceNode.Context = &meta.TraceNode_ServiceInit{
+		ServiceInit: &meta.ServiceInitNode{
+			ServiceName:   svcName,
+			SetupFuncName: option.Map(s.Init, func(init *schema.FuncDecl) string { return init.Name }).GetOrElse(""),
+			Context:       string(context),
+		},
+	}
+	n.svcStructs[s] = traceNode
+}
+
+func (n *TraceNodes) addSub(sub *pubsub.Subscription, svcName, topicName string) {
+	traceNode, context := n.alloc(sub.File, sub.AST)
+	traceNode.Context = &meta.TraceNode_PubsubSubscriber{
+		PubsubSubscriber: &meta.PubSubSubscriberNode{
+			TopicName:      topicName,
+			SubscriberName: sub.Name,
+			ServiceName:    svcName,
+			Context:        string(context),
+		},
+	}
+	n.subs[sub] = traceNode
+}
+
+func (n *TraceNodes) addMiddleware(mw *middleware.Middleware) {
+	relPath := n.b.relPath(mw.File.Pkg.ImportPath)
+	traceNode, context := n.alloc(mw.Decl.File, mw.Decl.AST)
+	traceNode.Context = &meta.TraceNode_MiddlewareDef{
+		MiddlewareDef: &meta.MiddlewareDefNode{
+			PkgRelPath: relPath,
+			Name:       mw.Decl.Name,
+			Context:    string(context),
+			Target:     mw.Target.ToProto(),
+		},
+	}
+	n.middlewares[mw] = traceNode
+}
+
+func (n *TraceNodes) addEndpoint(ep *api.Endpoint, svcName string) {
+	traceNode, context := n.alloc(ep.Decl.File, ep.Decl.AST)
+	traceNode.Context = &meta.TraceNode_RpcDef{
+		RpcDef: &meta.RPCDefNode{
+			ServiceName: svcName,
+			RpcName:     ep.Name,
+			Context:     string(context),
+		},
+	}
+	n.endpoints[ep] = traceNode
+}
+
+// alloc allocates a trace node.
+func (n *TraceNodes) alloc(file *pkginfo.File, node ast.Node) (traceNode *meta.TraceNode, context []byte) {
+	pkgPath := file.Pkg.ImportPath
+	fileRelPath := path.Join(n.b.relPath(pkgPath), file.Name)
+
+	tokenFile := file.Token()
+	startIdx := tokenFile.Offset(node.Pos())
+	endIdx := tokenFile.Offset(node.End())
+	context = file.Contents()[startIdx:endIdx]
+
+	n.id++
+
+	switch node := node.(type) {
+	case *ast.CallExpr:
+		traceNode = &meta.TraceNode{
+			Id:       n.id,
+			Filepath: fileRelPath,
+			StartPos: int32(tokenFile.Offset(node.Lparen)),
+			EndPos:   int32(tokenFile.Offset(node.Rparen)),
+		}
+	case *ast.FuncDecl:
+		traceNode = &meta.TraceNode{
+			Id:       n.id,
+			Filepath: fileRelPath,
+			StartPos: int32(tokenFile.Offset(node.Type.Pos())),
+			EndPos:   int32(tokenFile.Offset(node.Type.End())),
+		}
+	case *ast.TypeSpec:
+		traceNode = &meta.TraceNode{
+			Id:       n.id,
+			Filepath: fileRelPath,
+			StartPos: int32(tokenFile.Offset(node.Pos())),
+			EndPos:   int32(tokenFile.Offset(node.End())),
+		}
+	case *ast.SelectorExpr:
+		traceNode = &meta.TraceNode{
+			Id:       n.id,
+			Filepath: fileRelPath,
+			StartPos: int32(tokenFile.Offset(node.Pos())),
+			EndPos:   int32(tokenFile.Offset(node.End())),
+		}
+	case *ast.Ident:
+		traceNode = &meta.TraceNode{
+			Id:       n.id,
+			Filepath: fileRelPath,
+			StartPos: int32(tokenFile.Offset(node.Pos())),
+			EndPos:   int32(tokenFile.Offset(node.End())),
+		}
+	default:
+		panic(fmt.Sprintf("unhandled trace expression node %T", node))
+	}
+	n.nodes[pkgPath] = append(n.nodes[pkgPath], traceNode)
+
+	start := tokenFile.Pos(int(traceNode.StartPos))
+	end := tokenFile.Pos(int(traceNode.EndPos))
+	sPos, ePos := tokenFile.Position(start), tokenFile.Position(end)
+	traceNode.SrcLineStart = int32(sPos.Line)
+	traceNode.SrcLineEnd = int32(ePos.Line)
+	traceNode.SrcColStart = int32(sPos.Column)
+	traceNode.SrcColEnd = int32(ePos.Column)
+
+	return
+}
+
+func (n *TraceNodes) forPkg(pkgPath paths.Pkg) []*meta.TraceNode {
+	return n.nodes[pkgPath]
+}
+
+// nodeID returns the trace node id for the given node.
+// If node is nil it returns 0.
+func nodeID(node *meta.TraceNode) uint32 {
+	if node == nil {
+		return 0
+	}
+	return uint32(node.Id)
+}
diff --git a/v2/app/resource_usage.go b/v2/app/resource_usage.go
new file mode 100644
index 0000000000..57f92fbced
--- /dev/null
+++ b/v2/app/resource_usage.go
@@ -0,0 +1,51 @@
+package app
+
+import (
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/resource/usage"
+)
+
+// locateResourceBinds finds all resource binds and assigns them to the appropriate service.
+func (d *Desc) locateResourceBinds(result *parser.Result) {
+	allBinds := result.AllBinds()
+
+	for _, bind := range allBinds {
+		res := result.ResourceForBind(bind)
+		svc, found := d.ServiceForPath(bind.Package().FSPath)
+		if found {
+			// If we found the service, then we know the resource is used within the service.
+			svc.ResourceBinds[res] = append(svc.ResourceBinds[res], bind)
+		}
+	}
+}
+
+// locateResourceUsage finds all resource usages and assigns them to the appropriate service.
+// If a resource is used outside of a service, it is assigned to the top-level app description.
+func (d *Desc) locateResourceUsage(result *parser.Result) {
+	allUsages := result.AllUsages()
+
+	for _, use := range allUsages {
+		res := result.ResourceForBind(use.ResourceBind())
+
+		svc, found := d.ServiceForPath(use.DeclaredIn().Pkg.FSPath)
+		if found {
+			// If we found the service, then we know the resource is used within the service.
+			resUsages, found := svc.ResourceUsage[res]
+			if !found {
+				resUsages = make([]usage.Usage, 0, 1)
+				svc.ResourceUsage[res] = resUsages
+			}
+
+			svc.ResourceUsage[res] = append(resUsages, use)
+		} else {
+			// Otherwise, the resource is used outside of a service.
+			resUsages, found := d.ResourceUsageOutsideServices[res]
+			if !found {
+				resUsages = make([]usage.Usage, 0, 1)
+				d.ResourceUsageOutsideServices[res] = resUsages
+			}
+
+			d.ResourceUsageOutsideServices[res] = append(resUsages, use)
+		}
+	}
+}
diff --git a/v2/app/service.go b/v2/app/service.go
new file mode 100644
index 0000000000..3d5f0c6076
--- /dev/null
+++ b/v2/app/service.go
@@ -0,0 +1,36 @@
+package app
+
+import (
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/app/apiframework"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/usage"
+)
+
+// Service describes an Encore service.
+type Service struct {
+	// Name is the name of the service.
+	Name string
+
+	// Num is the 1-based service number in the application.
+	Num int
+
+	// FSRoot is the root directory of the service.
+	FSRoot paths.FS
+
+	// Framework contains API Framework-specific data for this service.
+	Framework option.Option[*apiframework.ServiceDesc]
+
+	// ResourceBinds describes the infra resources bound within the service.
+	ResourceBinds map[resource.Resource][]resource.Bind
+
+	// ResourceUsage describes the infra resources the service accesses and how.
+	ResourceUsage map[resource.Resource][]usage.Usage
+}
+
+// ContainsPackage reports whether the service contains the given package.
+func (s *Service) ContainsPackage(pkg *pkginfo.Package) bool {
+	return s.FSRoot.HasPrefix(pkg.FSPath)
+}
diff --git a/v2/app/service_discovery.go b/v2/app/service_discovery.go
new file mode 100644
index 0000000000..7ceb473ceb
--- /dev/null
+++ b/v2/app/service_discovery.go
@@ -0,0 +1,165 @@
+package app
+
+import (
+	"cmp"
+	"slices"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/authhandler"
+	"encr.dev/v2/parser/apis/servicestruct"
+	"encr.dev/v2/parser/infra/pubsub"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/usage"
+)
+
+// discoverServices discovers the services in the whole application.
+//
+// Services are defined as a collection of packages which are considered
+// to form a single logical service, which can be deployed and scaled as an
+// atomic unit.
+//
+// Services are defined by a root filesystem directory, with everything under
+// that directory considered part of the service.
+//
+// This means services cannot be nested, and a service cannot be split across
+// multiple filesystem directories (such as in separate git repositories).
+//
+// It operates in three phases:
+//
+// 1. Find any API Framework service structs and mark those packages as services (service structs are always the root of a service)
+// 2. Find any API Framework API's not currently in a service and mark those packages as services
+// 3. Find any PubSub subscribers not currently in a service and mark those packages as services
+//
+// This does not setup the service framework data.
+//
+// The returned slice is sorted by service name.
+func discoverServices(pc *parsectx.Context, result *parser.Result) []*Service {
+	defer pc.Trace("app.discoverServices").Done()
+
+	sd := &serviceDiscovery{
+		services:   make(map[paths.FS]*Service),
+		strongRoot: make(map[paths.FS]struct{}),
+	}
+
+	for _, r := range result.Resources() {
+		switch r := r.(type) {
+		case *servicestruct.ServiceStruct:
+			sd.possibleServiceRoot(r.Decl.File.Pkg, true)
+		case *api.Endpoint:
+			sd.possibleServiceRoot(r.Decl.File.Pkg, false)
+		case *pubsub.Subscription:
+			sd.possibleServiceRoot(r.File.Pkg, false)
+		case *authhandler.AuthHandler:
+			sd.possibleServiceRoot(r.Decl.File.Pkg, false)
+		}
+	}
+
+	// We then make an ordered slice of the services discovered
+	services := make([]*Service, 0, len(sd.services))
+	for _, s := range sd.services {
+		services = append(services, s)
+	}
+
+	// Note: we sort by the FSRoot because we use that for binary searches in [ServiceForPath]
+	slices.SortStableFunc(services, func(a, b *Service) int {
+		return cmp.Compare(a.FSRoot.ToIO(), b.FSRoot.ToIO())
+	})
+
+	// Finally, let's validate our services so we can report errors
+	// FIXME: we should put this back in as otherwise we need to specify
+	//        the expected behaviour for an Encore app with no services!
+	// if len(services) == 0 {
+	//	pc.Errs.AddStd(srcerrors.NoServicesFound())
+	// }
+
+	// Finally, let's validate our services
+	for i, s := range services {
+		for j := i + 1; j < len(services); j++ {
+			// we need to check both directions of nesting as we only loop over one direction
+			if s.FSRoot.HasPrefix(services[j].FSRoot) {
+				pc.Errs.Add(errServiceContainedWitinAnother(s.Name, services[j].Name))
+			} else if services[j].FSRoot.HasPrefix(s.FSRoot) {
+				pc.Errs.Add(errServiceContainedWitinAnother(services[j].Name, s.Name))
+			}
+
+			if s.Name == services[j].Name {
+				pc.Errs.Add(errDuplicateServiceNames(s.Name).InFile(s.FSRoot.ToIO()).InFile(services[j].FSRoot.ToIO()))
+			}
+		}
+	}
+
+	// Sort the services by name and assign the service numbers.
+	slices.SortFunc(services, func(a, b *Service) int {
+		return cmp.Compare(a.Name, b.Name)
+	})
+	for idx, svc := range services {
+		svc.Num = idx + 1
+	}
+
+	return services
+}
+
+type serviceDiscovery struct {
+	errs     *perr.List            // errs is the error list to add errors to.
+	services map[paths.FS]*Service // services maps the root folder to a service to the service
+
+	// strongRoot marks a folder as a strong root, meaning we won't allow it to be merged
+	// with a service in a parent folder.
+	strongRoot map[paths.FS]struct{}
+}
+
+// possibleServiceRoot marks a folder as a possible service if it is not already marked as being part of a service.
+//
+// If strong is true, the root path always becomes a new service, event if it is within an existing service.
+//
+// If any existing services are descendants of the new service, they are removed from the list, unless
+// the previous service was marked as a strong root.
+func (sd *serviceDiscovery) possibleServiceRoot(pkg *pkginfo.Package, strong bool) {
+	name := pkg.Name
+	root := pkg.FSPath
+
+	if strong {
+		// Always mark the root as a strong root, even if it is already marked as a service.
+		sd.strongRoot[root] = struct{}{}
+	}
+
+	// If the service is already marked, we don't need to do anything.
+	if _, ok := sd.services[root]; ok {
+		return
+	}
+
+	// Loop over the existing services and remove any that are descendants of this root
+	// but also look for any existing services which are ancestors of this root.
+	for existingRoot := range sd.services {
+		switch {
+		// If the existing service is a descendant of the new service, we can remove it.
+		case existingRoot.HasPrefix(root):
+			// If the existing service is a strong root, we can't merge it with this service.
+			if _, ok := sd.strongRoot[existingRoot]; ok {
+				continue
+			}
+
+			// If the existing service is a descendant of the new service, we can remove it.
+			delete(sd.services, existingRoot)
+
+		// If the new service is a descendant of an existing service, we're done
+		// because we don't allow nested services so this directory is part of the existing service.
+		case root.HasPrefix(existingRoot) && !strong:
+			return
+		}
+	}
+
+	// If we get here, the new service is not a descendant of any existing services.
+	// We can add it to the list of services.
+	sd.services[root] = &Service{
+		Name:          name,
+		FSRoot:        root,
+		ResourceBinds: make(map[resource.Resource][]resource.Bind),
+		ResourceUsage: make(map[resource.Resource][]usage.Usage),
+	}
+}
diff --git a/v2/app/service_discovery_test.go b/v2/app/service_discovery_test.go
new file mode 100644
index 0000000000..6b157460ff
--- /dev/null
+++ b/v2/app/service_discovery_test.go
@@ -0,0 +1,232 @@
+package app
+
+import (
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+)
+
+func Test_discoverServices(t *testing.T) {
+	tests := []struct {
+		name         string
+		txtar        string
+		wantServices []string
+		wantErrors   []string
+	}{
+		// Happy Path Tests
+		{
+			name: "services defined by APIs",
+			txtar: `
+-- systemA/svc1/foo.go --
+package svc1
+
+import "context"
+
+//encore:api public
+func Foo(ctx context.Context) error { return nil }
+
+-- systemA/svc2/bar.go --
+package svc2
+
+import "context"
+
+//encore:api public
+func Bar(ctx context.Context) error { return nil }
+
+-- svc3/bar.go --
+package svc3
+
+import "context"
+
+//encore:api public
+func Bar(ctx context.Context) error { return nil }
+`,
+			wantServices: []string{"svc1", "svc2", "svc3"},
+		},
+		{
+			name: "services defined by service structs",
+			txtar: `
+-- svc1/foo.go --
+package svc1
+
+import "context"
+
+//encore:service
+type Foo struct{}
+
+func initFoo() (*Foo, error) { return nil, nil }
+`,
+			wantServices: []string{"svc1"},
+		},
+		{
+			name: "services defined by pubsub subscriptions",
+			txtar: `
+-- svc1/foo.go --
+package svc1
+
+import (
+ 	"context"
+
+	"encore.dev/pubsub"
+)
+
+type Msg struct{}
+
+var T = pubsub.NewTopic[Msg]("topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+
+var _ = pubsub.NewSubscription[Msg](T, "sub", pubsub.SubscriptionConfig[Msg]{
+	Handler: func(ctx context.Context, msg Msg) error { return nil },
+})
+`,
+			wantServices: []string{"svc1"},
+		},
+		{
+			name: "services defined by auth handler",
+			txtar: `
+-- svc1/foo.go --
+package svc1
+
+import (
+ 	"context"
+
+	"encore.dev/beta/auth"
+)
+
+//encore:authhandler
+func MyAuthHandler(ctx context.Context, token string) (auth.UID, error) { return "", nil }
+`,
+			wantServices: []string{"svc1"},
+		},
+		{
+			name: "services with nested packages with API's and pubsub subscriptions",
+			txtar: `
+-- svc1/foo.go --
+package svc1
+
+import "context"
+
+//encore:api public
+func Foo(ctx context.Context) error { return nil }
+
+-- svc1/events/bar.go --
+package events
+
+import (
+	"context"
+	
+	"encore.dev/pubsub"
+)
+
+type Msg struct{}
+
+var T = pubsub.NewTopic[Msg]("topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+
+var _ = pubsub.NewSubscription[Msg](T, "sub", pubsub.SubscriptionConfig[Msg]{
+	Handler: func(ctx context.Context, msg Msg) error { return nil },
+})
+
+-- svc1/apis/baz.go --
+package apis
+
+import "context"
+
+//encore:api public
+func Baz(ctx context.Context) error { return nil }
+`,
+			wantServices: []string{"svc1"},
+		},
+
+		// Error Tests
+		//		{
+		//			name: "error if no services",
+		//			txtar: `
+		//-- svc1/foo.go --
+		//package svc1
+		//
+		//type Foo struct{}
+		//`,
+		//			wantErrors: []string{"No services were found in the application"},
+		//		},
+		{
+			// Note: this test is also testing that the Go package name is being used
+			// by the API framework - not the folder names/path
+			name: "error on duplicate service names",
+			txtar: `
+-- systemA/svc1/foo.go --
+package svc
+
+import "context"
+
+//encore:api public
+func Foo(ctx context.Context) error { return nil }
+
+-- systemB/svc2/bar.go --
+package svc
+
+import "context"
+
+//encore:api public
+func Bar(ctx context.Context) error { return nil }
+`,
+			wantErrors: []string{"Two services were found with the same name \"svc\", services must have unique names"},
+		},
+		{
+			name: "error if services declared in each other",
+			txtar: `
+-- svc1/foo.go --
+package svc1
+
+import "context"
+
+//encore:api public
+func Foo(ctx context.Context) error { return nil }
+
+-- svc1/svc2/bar.go --
+package svc2
+
+//encore:service
+type Bar struct{}
+
+func initBar() (*Bar, error) { return nil, nil }
+`,
+			wantErrors: []string{"The service svc2 was found within the service svc1. Encore does not allow services to be nested"},
+		},
+	}
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			c := qt.New(t)
+
+			ctx, result := Parse(c, tt.txtar)
+
+			services := discoverServices(ctx.Context, result)
+
+			if len(tt.wantErrors) > 0 {
+				for _, s := range services {
+					c.Logf("got service: %s (%s)", s.Name, s.FSRoot)
+				}
+				ctx.DeferExpectError(tt.wantErrors...)
+			} else {
+				ctx.FailTestOnErrors()
+
+				wanted := make(map[string]struct{})
+				for _, s := range tt.wantServices {
+					wanted[s] = struct{}{}
+				}
+
+				for _, s := range services {
+					if _, ok := wanted[s.Name]; !ok {
+						c.Errorf("unexpected service %q", s.Name)
+					}
+					delete(wanted, s.Name)
+				}
+
+				for s := range wanted {
+					c.Errorf("missing service %q", s)
+				}
+			}
+
+		})
+	}
+}
diff --git a/v2/app/setup_test.go b/v2/app/setup_test.go
new file mode 100644
index 0000000000..85fabd197a
--- /dev/null
+++ b/v2/app/setup_test.go
@@ -0,0 +1,44 @@
+package app
+
+import (
+	"os"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/rogpeppe/go-internal/testscript"
+
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser"
+)
+
+func TestMain(m *testing.M) {
+	os.Exit(testscript.RunMain(m, nil))
+}
+
+// Parse will take the given archiveContent and parse it into a testutil.Context and parser.Result.
+//
+// If the parser errors, the test will immediately fail.
+func Parse(c *qt.C, archiveContent string) (*testutil.Context, *parser.Result) {
+
+	archive := testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+
+go 1.20
+
+require encore.dev v1.13.4
+
+` + archiveContent)
+
+	tc := testutil.NewContext(c, false, archive)
+	tc.GoModDownload()
+	p := parser.NewParser(tc.Context)
+	tc.FailTestOnBailout()
+	parserResult := p.Parse()
+
+	if tc.Errs.Len() > 0 {
+		c.Fatalf("parsing failed: %v", tc.Errs.FormatErrors())
+	}
+
+	return tc, parserResult
+}
diff --git a/v2/app/testdata/auth_handler_call.txt b/v2/app/testdata/auth_handler_call.txt
new file mode 100644
index 0000000000..37beaba5de
--- /dev/null
+++ b/v2/app/testdata/auth_handler_call.txt
@@ -0,0 +1,59 @@
+! parse
+err 'cannot reference auth handler svc.MyAuth from another package'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/beta/auth"
+)
+
+type MyData struct {
+    Name string
+}
+
+//encore:authhandler
+func MyAuth(ctx context.Context, token string) (auth.UID, *MyData, error) { return "", nil, nil }
+
+-- svc2/svc2.go --
+package svc2
+
+import (
+    "context"
+    "test/svc"
+)
+
+func Foo() {
+    svc.MyAuth(context.Background(), "foo")
+}
+
+-- want: errors --
+
+── Invalid auth handler usage ─────────────────────────────────────────────────────────────[E9999]──
+
+You can not directly call an auth handler from another package.
+
+    ╭─[ svc2/svc2.go:9:5 ]
+    │
+  7 │
+  8 │ func Foo() {
+  9 │     svc.MyAuth(context.Background(), "foo")
+    ⋮     ────┬─────
+    ⋮         ╰─ called here
+ 10 │ }
+ 11 │
+────╯
+
+    ╭─[ svc/svc.go:13:6 ]
+    │
+ 11 │
+ 12 │ //encore:authhandler
+ 13 │ func MyAuth(ctx context.Context, token string) (auth.UID, *MyData, error) { return "", nil, nil }
+    ⋮      ──┬───
+    ⋮        ╰─ auth handler defined here
+ 14 │
+────╯
+
+For more information on auth handlers and how to define them, see
+https://encore.dev/docs/develop/auth
diff --git a/parser/testdata/auth_handler_data.txt b/v2/app/testdata/auth_handler_data.txt
similarity index 100%
rename from parser/testdata/auth_handler_data.txt
rename to v2/app/testdata/auth_handler_data.txt
diff --git a/v2/app/testdata/auth_handler_invalid_builtin.txt b/v2/app/testdata/auth_handler_invalid_builtin.txt
new file mode 100644
index 0000000000..b206c87239
--- /dev/null
+++ b/v2/app/testdata/auth_handler_invalid_builtin.txt
@@ -0,0 +1,39 @@
+! parse
+err 'second parameter must be of type string, or a pointer to a named struct'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/beta/auth"
+)
+
+//encore:authhandler
+func MyAuth(ctx context.Context, p int) (auth.UID, error) { return "", nil }
+
+-- want: errors --
+
+── Invalid auth handler Signature ─────────────────────────────────────────────────────────[E9999]──
+
+The second parameter must be a string or a pointer to a named struct.
+
+    ╭─[ svc/svc.go:9:36 ]
+    │
+  7 │
+  8 │ //encore:authhandler
+  9 │ func MyAuth(ctx context.Context, p int) (auth.UID, error) { return "", nil }
+    ⋮                                    ───
+ 10 │
+────╯
+
+hint: valid signatures are:
+	- func(ctx context.Context, p *Params) (auth.UID, error)
+	- func(ctx context.Context, p *Params) (auth.UID, *UserData, error)
+	- func(ctx context.Context, token string) (auth.UID, error)
+	- func(ctx context.Context, token string) (auth.UID, *UserData, error)
+
+note: *Params and *UserData are custom data types you define
+
+For more information on auth handlers and how to define them, see
+https://encore.dev/docs/develop/auth
diff --git a/v2/app/testdata/auth_handler_invalid_field_source.txt b/v2/app/testdata/auth_handler_invalid_field_source.txt
new file mode 100644
index 0000000000..f178f7d77c
--- /dev/null
+++ b/v2/app/testdata/auth_handler_invalid_field_source.txt
@@ -0,0 +1,49 @@
+! parse
+err 'all struct fields used in auth handler parameter Params must'
+err 'for the field\(s\): Foo, Bar'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/beta/auth"
+)
+
+type Params struct {
+    Authorization string `header:"Authorization"`
+    Foo string
+    ClientID string `query:"client_id"`
+    Bar int
+}
+
+//encore:authhandler
+func MyAuth(ctx context.Context, p *Params) (auth.UID, error) { return "", nil }
+
+-- want: errors --
+
+── Invalid auth payload ───────────────────────────────────────────────────────────────────[E9999]──
+
+All fields used within an auth payload must originate from either an HTTP header, a query
+parameter, or a cookie.
+
+    ╭─[ svc/svc.go:10:5 ]
+    │
+  8 │ type Params struct {
+  9 │     Authorization string `header:"Authorization"`
+ 10 │     Foo string
+    ⋮     ────┬─────
+    ⋮         ╰─ you must specify a "header", "query", or "cookie" tag for this field
+ 11 │     ClientID string `query:"client_id"`
+ 12 │     Bar int
+    ⋮     ───┬───
+    ⋮        ╰─ you must specify a "header", "query", or "cookie" tag for this field
+ 13 │ }
+ 14 │
+────╯
+
+You can specify them for each field using the struct tags, for example with `header:"X-My-Header"`,
+`query:"my-query", or `cookie:"my-cookie"`.
+
+For more information on auth handlers and how to define them, see
+https://encore.dev/docs/develop/auth
diff --git a/v2/app/testdata/auth_handler_invalid_named_type.txt b/v2/app/testdata/auth_handler_invalid_named_type.txt
new file mode 100644
index 0000000000..9e718639be
--- /dev/null
+++ b/v2/app/testdata/auth_handler_invalid_named_type.txt
@@ -0,0 +1,41 @@
+! parse
+err 'Params must be a struct type'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/beta/auth"
+)
+
+type Params int
+
+//encore:authhandler
+func MyAuth(ctx context.Context, p Params) (auth.UID, error) { return "", nil }
+
+-- want: errors --
+
+── Invalid auth handler Signature ─────────────────────────────────────────────────────────[E9999]──
+
+The second parameter must be a string or a pointer to a named struct.
+
+    ╭─[ svc/svc.go:11:36 ]
+    │
+  9 │
+ 10 │ //encore:authhandler
+ 11 │ func MyAuth(ctx context.Context, p Params) (auth.UID, error) { return "", nil }
+    ⋮                                    ──────
+ 12 │
+────╯
+
+hint: valid signatures are:
+	- func(ctx context.Context, p *Params) (auth.UID, error)
+	- func(ctx context.Context, p *Params) (auth.UID, *UserData, error)
+	- func(ctx context.Context, token string) (auth.UID, error)
+	- func(ctx context.Context, token string) (auth.UID, *UserData, error)
+
+note: *Params and *UserData are custom data types you define
+
+For more information on auth handlers and how to define them, see
+https://encore.dev/docs/develop/auth
diff --git a/v2/app/testdata/auth_handler_multiple.txt b/v2/app/testdata/auth_handler_multiple.txt
new file mode 100644
index 0000000000..fd8b0afaec
--- /dev/null
+++ b/v2/app/testdata/auth_handler_multiple.txt
@@ -0,0 +1,49 @@
+! parse
+err 'cannot declare multiple auth handlers'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/beta/auth"
+)
+
+//encore:authhandler
+func MyAuth(ctx context.Context, token string) (auth.UID, error) { return "", nil }
+
+//encore:authhandler
+func MyAuth2(ctx context.Context, token string) (auth.UID, error) { return "", nil }
+
+-- want: errors --
+
+── Multiple auth handlers found ───────────────────────────────────────────────────────────[E9999]──
+
+Multiple auth handlers were found in the application. Encore only allows one auth handler to be
+defined per application.
+
+    ╭─[ svc/svc.go:9:1 ]
+    │
+  7 │
+  8 │ //encore:authhandler
+  9 │ func MyAuth(ctx context.Context, token string) (auth.UID, error) { return "", nil }
+    ⋮  ───────────────────────────────┬────────────────────────────────
+    ⋮                                 ╰─ first auth handler defined here
+ 10 │
+ 11 │ //encore:authhandler
+ 12 │ func MyAuth2(ctx context.Context, token string) (auth.UID, error) { return "", nil }
+    ⋮  ────────────────────────────────┬────────────────────────────────
+    ⋮                                  ╰─ second auth handler defined here
+ 13 │
+────╯
+
+hint: valid signatures are:
+	- func(ctx context.Context, p *Params) (auth.UID, error)
+	- func(ctx context.Context, p *Params) (auth.UID, *UserData, error)
+	- func(ctx context.Context, token string) (auth.UID, error)
+	- func(ctx context.Context, token string) (auth.UID, *UserData, error)
+
+note: *Params and *UserData are custom data types you define
+
+For more information on auth handlers and how to define them, see
+https://encore.dev/docs/develop/auth
diff --git a/v2/app/testdata/auth_handler_reference.txt b/v2/app/testdata/auth_handler_reference.txt
new file mode 100644
index 0000000000..4d8ac59df1
--- /dev/null
+++ b/v2/app/testdata/auth_handler_reference.txt
@@ -0,0 +1,55 @@
+! parse
+err 'cannot reference auth handler svc.MyAuth from another package'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/beta/auth"
+)
+
+//encore:authhandler
+func MyAuth(ctx context.Context, token string) (auth.UID, error) { return "", nil }
+
+-- svc2/svc2.go --
+package svc2
+
+import (
+    "context"
+    "test/svc"
+)
+
+func Foo() {
+    _ = svc.MyAuth
+}
+
+-- want: errors --
+
+── Invalid auth handler usage ─────────────────────────────────────────────────────────────[E9999]──
+
+Auth handlers can only be called, but not referenced.
+
+    ╭─[ svc2/svc2.go:9:9 ]
+    │
+  7 │
+  8 │ func Foo() {
+  9 │     _ = svc.MyAuth
+    ⋮         ────┬─────
+    ⋮             ╰─ referenced here
+ 10 │ }
+ 11 │
+────╯
+
+    ╭─[ svc/svc.go:9:6 ]
+    │
+  7 │
+  8 │ //encore:authhandler
+  9 │ func MyAuth(ctx context.Context, token string) (auth.UID, error) { return "", nil }
+    ⋮      ──┬───
+    ⋮        ╰─ auth handler defined here
+ 10 │
+────╯
+
+For more information on auth handlers and how to define them, see
+https://encore.dev/docs/develop/auth
diff --git a/parser/testdata/auth_handler_simple.txt b/v2/app/testdata/auth_handler_simple.txt
similarity index 100%
rename from parser/testdata/auth_handler_simple.txt
rename to v2/app/testdata/auth_handler_simple.txt
diff --git a/v2/app/testdata/auth_handler_struct.txt b/v2/app/testdata/auth_handler_struct.txt
new file mode 100644
index 0000000000..8e30f67841
--- /dev/null
+++ b/v2/app/testdata/auth_handler_struct.txt
@@ -0,0 +1,21 @@
+parse
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/beta/auth"
+)
+
+type FooParams struct{}
+
+//encore:api public
+func Foo(ctx context.Context, p *FooParams) error { return nil }
+
+type Params struct {
+    Authorization string `header:"Authorization"`
+}
+
+//encore:authhandler
+func MyAuth(ctx context.Context, p *Params) (auth.UID, error) { return "", nil }
diff --git a/v2/app/testdata/auth_handler_svc_struct.txt b/v2/app/testdata/auth_handler_svc_struct.txt
new file mode 100644
index 0000000000..811f0ac7a2
--- /dev/null
+++ b/v2/app/testdata/auth_handler_svc_struct.txt
@@ -0,0 +1,24 @@
+parse
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/beta/auth"
+)
+
+type FooParams struct{}
+
+//encore:api public
+func Foo(ctx context.Context, p *FooParams) error { return nil }
+
+type Params struct {
+    Authorization string `header:"Authorization"`
+}
+
+//encore:service
+type Service struct{}
+
+//encore:authhandler
+func (s *Service) MyAuth(ctx context.Context, p *Params) (auth.UID, error) { return "", nil }
diff --git a/v2/app/testdata/cache_cluster_outside_svc.txt b/v2/app/testdata/cache_cluster_outside_svc.txt
new file mode 100644
index 0000000000..b4b446c41e
--- /dev/null
+++ b/v2/app/testdata/cache_cluster_outside_svc.txt
@@ -0,0 +1,33 @@
+parse
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/cache"
+    "test/lib"
+)
+
+type Key[T any] struct {
+    Foo T
+}
+
+var keyspace = cache.NewStringKeyspace[Key[string]](lib.Cluster, cache.KeyspaceConfig{
+    KeyPattern: "foo/:Foo",
+})
+
+//encore:api public
+func Foo(ctx context.Context) error { return nil }
+
+-- lib/lib.go --
+package lib
+
+import (
+    "context"
+
+    "encore.dev/storage/cache"
+)
+
+var Cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
diff --git a/v2/app/testdata/cache_definition.txt b/v2/app/testdata/cache_definition.txt
new file mode 100644
index 0000000000..ebb6a6c730
--- /dev/null
+++ b/v2/app/testdata/cache_definition.txt
@@ -0,0 +1,22 @@
+parse
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/cache"
+)
+
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+var keyspace = cache.NewStringKeyspace[string](cluster, cache.KeyspaceConfig{
+    KeyPattern: "foo/:key",
+    DefaultExpiry: cache.ExpireIn(10 * time.Second),
+})
+
+//encore:api public
+func Foo(context.Context) error {
+    return nil
+}
diff --git a/v2/app/testdata/cache_err_duplicate_cluster.txt b/v2/app/testdata/cache_err_duplicate_cluster.txt
new file mode 100644
index 0000000000..62146ccff6
--- /dev/null
+++ b/v2/app/testdata/cache_err_duplicate_cluster.txt
@@ -0,0 +1,38 @@
+! parse
+err 'cache cluster names must be unique'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/cache"
+)
+
+var cluster1 = cache.NewCluster("cluster", cache.ClusterConfig{})
+var cluster2 = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+//encore:api public
+func Foo(ctx context.Context) error { return nil }
+-- want: errors --
+
+── Duplicate Cache Cluster ────────────────────────────────────────────────────────────────[E9999]──
+
+Cache clusters must have unique names.
+
+    ╭─[ svc/svc.go:9:33 ]
+    │
+  7 │ )
+  8 │
+  9 │ var cluster1 = cache.NewCluster("cluster", cache.ClusterConfig{})
+    ⋮                                 ─────────
+ 10 │ var cluster2 = cache.NewCluster("cluster", cache.ClusterConfig{})
+    ⋮                                 ─────────
+ 11 │
+ 12 │ //encore:api public
+────╯
+
+I you wish to reuse the same cluster, export the original cache.Cluster object and reuse it here.
+
+For more information see https://encore.dev/docs/primitives/caching
diff --git a/v2/app/testdata/cache_err_duplicate_paths.txt b/v2/app/testdata/cache_err_duplicate_paths.txt
new file mode 100644
index 0000000000..d189cc03e6
--- /dev/null
+++ b/v2/app/testdata/cache_err_duplicate_paths.txt
@@ -0,0 +1,55 @@
+! parse
+err 'cache KeyPattern conflict'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/cache"
+)
+
+type Key[T any] struct {
+    Foo T
+}
+
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+var keyspace1 = cache.NewStringKeyspace[Key[string]](cluster, cache.KeyspaceConfig{
+    KeyPattern: "foo/:Foo",
+})
+
+var keyspace2 = cache.NewStringKeyspace[Key[string]](cluster, cache.KeyspaceConfig{
+    KeyPattern: "foo/bar/:Foo",
+})
+
+//encore:api public
+func Foo(ctx context.Context) error { return nil }
+-- want: errors --
+
+── Path Conflict ──────────────────────────────────────────────────────────────────────────[E9999]──
+
+The path segment `bar` conflicts with the path `/foo/:Foo`.
+
+    ╭─[ svc/svc.go:16:18 ]
+    │
+ 14 │
+ 15 │ var keyspace1 = cache.NewStringKeyspace[Key[string]](cluster, cache.KeyspaceConfig{
+ 16 │     KeyPattern: "foo/:Foo",
+    ⋮                  ───────
+    ·
+    ·
+ 18 │
+ 19 │ var keyspace2 = cache.NewStringKeyspace[Key[string]](cluster, cache.KeyspaceConfig{
+ 20 │     KeyPattern: "foo/bar/:Foo",
+    ⋮                  ───────────
+ 21 │ })
+ 22 │
+────╯
+
+Paths must be not be empty and always start with a '/'. You cannot define paths that conflict with
+each other, including static and parameterized paths. For example `/blog/:id` would conflict with
+`/:username`.
+
+For more information about configuring Paths, see https://encore.dev/docs/primitives/apis#rest-apis
diff --git a/v2/app/testdata/cache_err_generic_type_nonbasic.txt b/v2/app/testdata/cache_err_generic_type_nonbasic.txt
new file mode 100644
index 0000000000..c9220294d2
--- /dev/null
+++ b/v2/app/testdata/cache_err_generic_type_nonbasic.txt
@@ -0,0 +1,50 @@
+! parse
+err 'has invalid key type parameter: struct field Foo is not a basic type'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/cache"
+)
+
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+type Key[T any] struct {
+    Foo T
+}
+
+var keyspace = cache.NewStringKeyspace[Key[Key[string]]](cluster, cache.KeyspaceConfig{
+    KeyPattern: "foo/:Foo",
+})
+
+//encore:api public
+func Foo(context.Context) error {
+    return nil
+}
+
+-- want: errors --
+
+── Invalid Cache Key Type ─────────────────────────────────────────────────────────────────[E9999]──
+
+The field Foo is invalid: must be a basic type
+
+    ╭─[ svc/svc.go:12:5 ]
+    │
+ 10 │
+ 11 │ type Key[T any] struct {
+ 12 │     Foo T
+    ⋮     ──┬──
+    ⋮       ╰─ found Key[string]
+ 13 │ }
+ 14 │
+ 15 │ var keyspace = cache.NewStringKeyspace[Key[Key[string]]](cluster, cache.KeyspaceConfig{
+    ⋮                                        ───────┬────────
+    ⋮                                               ╰─ instantiated here
+ 16 │     KeyPattern: "foo/:Foo",
+ 17 │ })
+────╯
+
+For more information see https://encore.dev/docs/primitives/caching
diff --git a/v2/app/testdata/cache_err_keyspace_invalid.txt b/v2/app/testdata/cache_err_keyspace_invalid.txt
new file mode 100644
index 0000000000..7c16d276b7
--- /dev/null
+++ b/v2/app/testdata/cache_err_keyspace_invalid.txt
@@ -0,0 +1,51 @@
+! parse
+err 'field Bar not used in KeyPattern'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/cache"
+)
+
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+type Key struct {
+    ID int
+    Bar string
+}
+
+var keyspace = cache.NewStringKeyspace[Key](cluster, cache.KeyspaceConfig{
+    KeyPattern: "foo/:ID",
+})
+
+//encore:api public
+func Foo(context.Context) error {
+    return nil
+}
+
+-- want: errors --
+
+── Invalid Cache Key Type ─────────────────────────────────────────────────────────────────[E9999]──
+
+Invalid use of the key type, the field Bar was not used in the KeyPattern
+
+    ╭─[ svc/svc.go:13:5 ]
+    │
+ 11 │ type Key struct {
+ 12 │     ID int
+ 13 │     Bar string
+    ⋮     ──────────
+    ·
+    ·
+ 15 │
+ 16 │ var keyspace = cache.NewStringKeyspace[Key](cluster, cache.KeyspaceConfig{
+ 17 │     KeyPattern: "foo/:ID",
+    ⋮                 ─────────
+ 18 │ })
+ 19 │
+────╯
+
+For more information see https://encore.dev/docs/primitives/caching
diff --git a/v2/app/testdata/cache_err_keyspace_outside_svc.txt b/v2/app/testdata/cache_err_keyspace_outside_svc.txt
new file mode 100644
index 0000000000..e6a0a42e54
--- /dev/null
+++ b/v2/app/testdata/cache_err_keyspace_outside_svc.txt
@@ -0,0 +1,71 @@
+! parse
+err 'cache.NewStringKeyspace can only be called from within Encore services'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/cache"
+)
+
+var Cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+//encore:api public
+func Foo(ctx context.Context) error { return nil }
+
+-- lib/lib.go --
+package lib
+
+import (
+    "context"
+
+    "encore.dev/storage/cache"
+    "test/svc"
+)
+
+type Key[T any] struct {
+    Foo T
+}
+
+var keyspace = cache.NewStringKeyspace[Key[string]](svc.Cluster, cache.KeyspaceConfig{
+    KeyPattern: "foo/:Foo",
+})
+-- want: errors --
+
+── Invalid Cache Keyspace ─────────────────────────────────────────────────────────────────[E9999]──
+
+Cache keyspaces must be defined within a service.
+
+    ╭─[ lib/lib.go:14:16 ]
+    │
+ 12 │ }
+ 13 │
+ 14 │ var keyspace = cache.NewStringKeyspace[Key[string]](svc.Cluster, cache.KeyspaceConfig{
+    ⋮                ────────────────────────────────────
+ 15 │     KeyPattern: "foo/:Foo",
+ 16 │ })
+────╯
+
+For more information see https://encore.dev/docs/primitives/caching
+
+
+
+
+── Resource defined outside of service ────────────────────────────────────────────────────[E9999]──
+
+Resources can only be defined within a service.
+
+    ╭─[ lib/lib.go:14:16 ]
+    │
+ 12 │     }
+ 13 │
+ 14 │     var keyspace = cache.NewStringKeyspace[Key[string]](svc.Cluster, cache.KeyspaceConfig{
+    ⋮                    ▲
+    ⋮ ╭──────────────────╯
+ 15 │ │       KeyPattern: "foo/:Foo",
+ 16 │ │   })
+    ⋮ │    ▲
+    ⋮ ├────╯
+────╯
diff --git a/v2/app/testdata/cache_generic_type.txt b/v2/app/testdata/cache_generic_type.txt
new file mode 100644
index 0000000000..78cc174441
--- /dev/null
+++ b/v2/app/testdata/cache_generic_type.txt
@@ -0,0 +1,25 @@
+parse
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/cache"
+)
+
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+type Key[T any] struct {
+    Foo T
+}
+
+var keyspace = cache.NewStringKeyspace[Key[string]](cluster, cache.KeyspaceConfig{
+    KeyPattern: "foo/:Foo",
+})
+
+//encore:api public
+func Foo(context.Context) error {
+    return nil
+}
diff --git a/v2/app/testdata/config.txt b/v2/app/testdata/config.txt
new file mode 100644
index 0000000000..78517c586e
--- /dev/null
+++ b/v2/app/testdata/config.txt
@@ -0,0 +1,45 @@
+# Verify calls to config.Load are called
+parse
+expectOut 'config svc Config\[int\]'
+output 'config svc named:{type_arguments:{builtin:INT}}'
+
+-- libraries/shared/shared.go --
+package shared
+
+import (
+    "encore.dev/config"
+)
+
+type LibraryConfig struct {
+    Name    config.String
+    Enabled config.Bool
+    ValueList config.Value[[]int]
+    List []int
+}
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/config"
+
+    "test/libraries/shared"
+)
+
+type Config[T any] struct {
+    Library    shared.LibraryConfig
+    OtherValue config.Value[T]
+    NameList   config.Values[string]
+    ValueList config.Value[[]T]
+    List []T
+}
+
+var cfg = config.Load[Config[int]]()
+
+
+// encore:api
+func Subscriber1(ctx context.Context) error {
+    return nil
+}
diff --git a/v2/app/testdata/config_err_unexported_field.txt b/v2/app/testdata/config_err_unexported_field.txt
new file mode 100644
index 0000000000..9cdaaa28f7
--- /dev/null
+++ b/v2/app/testdata/config_err_unexported_field.txt
@@ -0,0 +1,54 @@
+! parse
+err 'Field subField is not exported and is in a datatype which is used by a call'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/config"
+)
+
+type SubType struct {
+    subField string
+}
+
+type Config struct {
+    FooEnabled bool
+    Sub        SubType
+}
+
+var Cfg = config.Load[Config]()
+
+
+//encore:api
+func Subscriber1(ctx context.Context) error {
+    return nil
+}
+
+-- want: errors --
+
+── Invalid config type ────────────────────────────────────────────────────────────────────[E9999]──
+
+Field is not exported and is in a datatype which is used by a call to `config.Load[T]()`.
+Unexported fields cannot be initialised by Encore, thus are not allowed in this context.
+
+    ╭─[ svc/svc.go:10:5 ]
+    │
+  8 │
+  9 │ type SubType struct {
+ 10 │     subField string
+    ⋮     ───────────────
+    ·
+    ·
+ 16 │ }
+ 17 │
+ 18 │ var Cfg = config.Load[Config]()
+    ⋮           ──────────┬──────────
+    ⋮                     ╰─ config loaded here
+ 19 │
+ 20 │
+────╯
+
+For more information on configuration, see https://encore.dev/docs/develop/config
diff --git a/v2/app/testdata/config_err_use_from_other_service.txt b/v2/app/testdata/config_err_use_from_other_service.txt
new file mode 100644
index 0000000000..6bba1985e5
--- /dev/null
+++ b/v2/app/testdata/config_err_use_from_other_service.txt
@@ -0,0 +1,69 @@
+# Verify calls to config.Load are called
+! parse
+err 'A config instance can only be referenced from within the service that the call to'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/config"
+)
+
+type Config struct {
+    FooEnabled bool
+}
+
+var Cfg = config.Load[Config]()
+
+
+//encore:api
+func Subscriber1(ctx context.Context) error {
+    return nil
+}
+
+
+-- libraries/foo/foo.go --
+package foo
+
+import (
+    "test/svc"
+)
+
+func init() {
+    if svc.Cfg.FooEnabled {
+        // do something
+    }
+}
+
+-- want: errors --
+
+── Cross service config use ───────────────────────────────────────────────────────────────[E9999]──
+
+A config instance can only be referenced from within the service that the call to
+`config.Load[T]()` was made in.
+
+    ╭─[ libraries/foo/foo.go:8:8 ]
+    │
+  6 │
+  7 │ func init() {
+  8 │     if svc.Cfg.FooEnabled {
+    ⋮        ────────┬─────────
+    ⋮                ╰─ used here
+  9 │         // do something
+ 10 │     }
+────╯
+
+    ╭─[ svc/svc.go:13:11 ]
+    │
+ 11 │ }
+ 12 │
+ 13 │ var Cfg = config.Load[Config]()
+    ⋮           ──────────┬──────────
+    ⋮                     ╰─ defined here
+ 14 │
+ 15 │
+────╯
+
+For more information on configuration, see https://encore.dev/docs/develop/config
diff --git a/v2/app/testdata/config_err_wrapper_used_in_wrapper.txt b/v2/app/testdata/config_err_wrapper_used_in_wrapper.txt
new file mode 100644
index 0000000000..30c2eb3760
--- /dev/null
+++ b/v2/app/testdata/config_err_wrapper_used_in_wrapper.txt
@@ -0,0 +1,47 @@
+! parse
+err 'The type of config.Value'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/config"
+)
+
+type Config struct {
+    Name config.Value[config.Value[string]]
+}
+
+var cfg = config.Load[Config]()
+
+
+// encore:api
+func Subscriber1(ctx context.Context) error {
+    return nil
+}
+
+-- want: errors --
+
+── Invalid config type ────────────────────────────────────────────────────────────────────[E9999]──
+
+The type of config.Value[T] cannot be another config.Value[T]
+
+    ╭─[ svc/svc.go:10:23 ]
+    │
+  8 │
+  9 │ type Config struct {
+ 10 │     Name config.Value[config.Value[string]]
+    ⋮                       ─────────┬──────────
+    ⋮                                ╰─ cannot use config.Value inside a config.Value
+ 11 │ }
+ 12 │
+ 13 │ var cfg = config.Load[Config]()
+    ⋮           ──────────┬──────────
+    ⋮                     ╰─ config loaded here
+ 14 │
+ 15 │
+────╯
+
+For more information on configuration, see https://encore.dev/docs/develop/config
diff --git a/v2/app/testdata/cron_job_definition.txt b/v2/app/testdata/cron_job_definition.txt
new file mode 100644
index 0000000000..24831f40d3
--- /dev/null
+++ b/v2/app/testdata/cron_job_definition.txt
@@ -0,0 +1,95 @@
+# Verify the cron job definition
+parse
+output 'rpc svc.CronAPI access=public raw=false path=/cron'
+output 'cronJob cronfooboo title="Cron Foo Boo"'
+output 'cronJob cronfoo title="Cron Foo Bar"'
+output 'cronJob cronfood title="Cron Food Bar"'
+output 'cronJob cronfoocious title="Cron Foo Bar Bazz"'
+output 'cronJob cron-every title="Cron Foo Bar Bazz"'
+output 'cronJob cron-external'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"time"
+
+	"test/external"
+	"encore.dev/cron"
+)
+
+var _ = cron.NewJob("cronfooboo", cron.JobConfig{
+	Title:     "Cron Foo Boo",
+	Schedule: "* * * * 5",
+	Endpoint: CronAPI,
+})
+
+// A cron job to send out emails to newsletter subscribers.
+// On two lines.
+var _ = cron.NewJob("cronfoo", cron.JobConfig{
+	Title:     "Cron Foo Bar",
+	Schedule: "* * * * 5",
+	Endpoint: CronAPI,
+})
+
+/*
+	In this example, we are defining a cron job, together with
+	a random string.
+
+	var _, bd = cron.NewJob("cronfood", cron.JobConfig{
+		Title:     "Cron Food Bar",
+		Schedule: "* * * * 5",
+		Endpoint: CronAPI,
+	}), "barfoo"
+
+	We are being very explicit, and we are also giving a description
+	that includes a code snippet.
+*/
+var _, bd = cron.NewJob("cronfood", cron.JobConfig{
+	Title:     "Cron Food Bar",
+	Schedule: "* * * * 5",
+	Endpoint: CronAPI,
+}), "barfoo"
+
+// A cron job to send out push notifications to new subscribers.
+var _ = cron.NewJob("cronfoocious", cron.JobConfig{
+	Title:     "Cron Foo Bar Bazz",
+	Schedule: "* * * * 4",
+	Endpoint: CronAPI,
+})
+
+// A cron job using Every instead of Schedule
+var _ = cron.NewJob("cron-every", cron.JobConfig{
+	Title:     "Cron Foo Bar Bazz",
+	Every:    3 * cron.Minute,
+	Endpoint: CronAPI,
+})
+
+// A cron job using an external endpoint
+var _ = cron.NewJob("cron-external", cron.JobConfig{
+	Every:    cron.Minute,
+	Endpoint: external.Endpoint,
+})
+
+//encore:api public path=/cron
+func CronAPI(ctx context.Context) (*Response, error) {
+	msg := "Hello, Cron!"
+	return &Response{Message: msg}, nil
+}
+
+type Response struct {
+	Message string
+}
+
+-- external/external.go --
+package external
+
+import (
+	"context"
+)
+
+//encore:api private
+func Endpoint(ctx context.Context) error {
+	return nil
+}
diff --git a/v2/app/testdata/cron_job_definition_init.txt b/v2/app/testdata/cron_job_definition_init.txt
new file mode 100644
index 0000000000..f3e30a1ae8
--- /dev/null
+++ b/v2/app/testdata/cron_job_definition_init.txt
@@ -0,0 +1,76 @@
+# Verify the cron job definition
+! parse
+err 'A cron job cannot be declared here, they can only be declared in a package level variable.'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/cron"
+)
+
+func init() {
+    // A cron job to send out emails to newsletter subscribers.
+    // On two lines.
+    var _ = cron.NewJob("cronfoo", cron.JobConfig{
+        Title:    "Cron Foo Bar",
+        Schedule: "* * * * 5",
+        Endpoint: Cron,
+    })
+}
+
+//encore:api public path=/cron
+func Cron(ctx context.Context) (*Response, error) {
+	msg := "Hello, Cron!"
+	return &Response{Message: msg}, nil
+}
+
+type Response struct {
+	Message string
+}
+
+-- want: errors --
+
+── Invalid call ───────────────────────────────────────────────────────────────────────────[E9999]──
+
+cron.NewJob cannot be called here. It must be called from a package level variable.
+
+    ╭─[ svc/svc.go:12:13 ]
+    │
+ 10 │     // A cron job to send out emails to newsletter subscribers.
+ 11 │     // On two lines.
+ 12 │     var _ = cron.NewJob("cronfoo", cron.JobConfig{
+    ⋮             ───────────
+ 13 │         Title:    "Cron Foo Bar",
+ 14 │         Schedule: "* * * * 5",
+────╯
+
+
+
+
+── Invalid API Usage ──────────────────────────────────────────────────────────────────────[E9999]──
+
+APIs can not be referenced without being called, unless they are used as a cron job endpoint, or a
+PubSub subscription handler.
+
+    ╭─[ svc/svc.go:15:19 ]
+    │
+ 13 │         Title:    "Cron Foo Bar",
+ 14 │         Schedule: "* * * * 5",
+ 15 │         Endpoint: Cron,
+    ⋮                   ─┬──
+    ⋮                    ╰─ used here
+    ·
+    ·
+ 18 │
+ 19 │ //encore:api public path=/cron
+ 20 │ func Cron(ctx context.Context) (*Response, error) {
+    ⋮      ─┬──
+    ⋮       ╰─ defined here
+ 21 │     msg := "Hello, Cron!"
+ 22 │     return &Response{Message: msg}, nil
+────╯
+
+For more information on how to use APIs see https://encore.dev/docs/primitives/apis
diff --git a/v2/app/testdata/cron_job_definition_repeat.txt b/v2/app/testdata/cron_job_definition_repeat.txt
new file mode 100644
index 0000000000..2e609e5970
--- /dev/null
+++ b/v2/app/testdata/cron_job_definition_repeat.txt
@@ -0,0 +1,72 @@
+# Verify the cron job definition
+! parse
+err 'cron job cronfood defined twice'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/cron"
+)
+
+/*
+	In this example, we are defining a cron job, together with
+	a random string.
+
+	var _, bd = cron.NewJob("cronfood", cron.JobConfig{
+		Title:    "Cron Food Bar",
+		Schedule: "* * * * 5",
+		Endpoint: Cron,
+	}), "barfoo"
+
+	We are being very explicit, and we are also giving a description
+	that includes a code snippet.
+*/
+var _, bd = cron.NewJob("cronfood", cron.JobConfig{
+	Title:    "Cron Food Bar",
+	Schedule: "* * * * 5",
+	Endpoint: Cron,
+}), "barfoo"
+
+// A cron job to send out push notiifications to new subscribers.
+var _ = cron.NewJob("cronfood", cron.JobConfig{
+	Title:    "Cron Foo Bar Bazz",
+	Schedule: "* * * * 4",
+	Endpoint: Cron,
+})
+
+//encore:api public path=/cron
+func Cron(ctx context.Context) (*Response, error) {
+	msg := "Hello, Cron!"
+	return &Response{Message: msg}, nil
+}
+
+type Response struct {
+	Message string
+}
+
+-- want: errors --
+
+── Duplicate Cron Jobs ────────────────────────────────────────────────────────────────────[E9999]──
+
+Multiple cron jobs with the same name were found. Cronjob names must be unique.
+
+    ╭─[ svc/svc.go:22:25 ]
+    │
+ 20 │     that includes a code snippet.
+ 21 │ */
+ 22 │ var _, bd = cron.NewJob("cronfood", cron.JobConfig{
+    ⋮                         ──────────
+    ·
+    ·
+ 27 │
+ 28 │ // A cron job to send out push notiifications to new subscribers.
+ 29 │ var _ = cron.NewJob("cronfood", cron.JobConfig{
+    ⋮                     ──────────
+ 30 │     Title:    "Cron Foo Bar Bazz",
+ 31 │     Schedule: "* * * * 4",
+────╯
+
+For more information, see https://encore.dev/docs/primitives/cron-jobs
diff --git a/v2/app/testdata/cron_job_definition_rpc.txt b/v2/app/testdata/cron_job_definition_rpc.txt
new file mode 100644
index 0000000000..b8b0cebc34
--- /dev/null
+++ b/v2/app/testdata/cron_job_definition_rpc.txt
@@ -0,0 +1,73 @@
+# Verify the cron job definition
+! parse
+err 'A cron job cannot be declared here, they can only be declared in a package level variable.'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/cron"
+)
+
+//encore:api public path=/cron
+func Cron(ctx context.Context) (*Response, error) {
+	msg := "Hello, Cron!"
+    // A cron job to send out emails to newsletter subscribers.
+    // On two lines.
+    var _ = cron.NewJob("cronfoo", cron.JobConfig{
+        Title:    "Cron Foo Bar",
+        Schedule: "* * * * 5",
+        Endpoint: Cron,
+    })
+	return &Response{Message: msg}, nil
+}
+
+type Response struct {
+	Message string
+}
+
+-- want: errors --
+
+── Invalid call ───────────────────────────────────────────────────────────────────────────[E9999]──
+
+cron.NewJob cannot be called here. It must be called from a package level variable.
+
+    ╭─[ svc/svc.go:14:13 ]
+    │
+ 12 │     // A cron job to send out emails to newsletter subscribers.
+ 13 │     // On two lines.
+ 14 │     var _ = cron.NewJob("cronfoo", cron.JobConfig{
+    ⋮             ───────────
+ 15 │         Title:    "Cron Foo Bar",
+ 16 │         Schedule: "* * * * 5",
+────╯
+
+
+
+
+── Invalid API Usage ──────────────────────────────────────────────────────────────────────[E9999]──
+
+APIs can not be referenced without being called, unless they are used as a cron job endpoint, or a
+PubSub subscription handler.
+
+    ╭─[ svc/svc.go:10:6 ]
+    │
+  8 │
+  9 │ //encore:api public path=/cron
+ 10 │ func Cron(ctx context.Context) (*Response, error) {
+    ⋮      ─┬──
+    ⋮       ╰─ defined here
+    ·
+    ·
+ 15 │         Title:    "Cron Foo Bar",
+ 16 │         Schedule: "* * * * 5",
+ 17 │         Endpoint: Cron,
+    ⋮                   ─┬──
+    ⋮                    ╰─ used here
+ 18 │     })
+ 19 │     return &Response{Message: msg}, nil
+────╯
+
+For more information on how to use APIs see https://encore.dev/docs/primitives/apis
diff --git a/v2/app/testdata/cron_job_err_not_api.txt b/v2/app/testdata/cron_job_err_not_api.txt
new file mode 100644
index 0000000000..efed9e4934
--- /dev/null
+++ b/v2/app/testdata/cron_job_err_not_api.txt
@@ -0,0 +1,62 @@
+# Verify the cron job definition
+! parse
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"time"
+
+	"encore.dev/cron"
+)
+
+var _ = cron.NewJob("my-job", cron.JobConfig{
+	Schedule: "* * * * 5",
+	Endpoint: CronFunc,
+})
+
+
+func CronFunc(ctx context.Context) error {
+    return nil
+}
+-- want: errors --
+
+── Invalid call to cron.NewJob ────────────────────────────────────────────────────────────[E9999]──
+
+Endpoint does not reference an Encore API
+
+    ╭─[ svc/svc.go:12:12 ]
+    │
+ 10 │ var _ = cron.NewJob("my-job", cron.JobConfig{
+ 11 │     Schedule: "* * * * 5",
+ 12 │     Endpoint: CronFunc,
+    ⋮               ────────
+ 13 │ })
+ 14 │
+────╯
+
+For more information, see https://encore.dev/docs/primitives/cron-jobs
+
+
+
+
+── Resource defined outside of service ────────────────────────────────────────────────────[E9999]──
+
+Resources can only be defined within a service.
+
+    ╭─[ svc/svc.go:10:9 ]
+    │
+  8 │     )
+  9 │
+ 10 │     var _ = cron.NewJob("my-job", cron.JobConfig{
+    ⋮             ▲
+    ⋮ ╭───────────╯
+ 11 │ │       Schedule: "* * * * 5",
+ 12 │ │       Endpoint: CronFunc,
+ 13 │ │   })
+    ⋮ │    ▲
+    ⋮ ├────╯
+ 14 │
+ 15 │
+────╯
diff --git a/v2/app/testdata/et.txt b/v2/app/testdata/et.txt
new file mode 100644
index 0000000000..04f6ec6f20
--- /dev/null
+++ b/v2/app/testdata/et.txt
@@ -0,0 +1,26 @@
+parse
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+)
+
+//encore:api public
+func Foo(context.Context) error { return nil }
+
+
+-- svc/svc_test.go --
+package svc
+
+import (
+    "context"
+    "testing"
+
+    "encore.dev/et"
+)
+
+func TestFoo(t *testing.T) {
+    et.AuthHandler(MyAuth)
+}
diff --git a/v2/app/testdata/metrics_counter.txt b/v2/app/testdata/metrics_counter.txt
new file mode 100644
index 0000000000..87ccf4f1ae
--- /dev/null
+++ b/v2/app/testdata/metrics_counter.txt
@@ -0,0 +1,25 @@
+parse
+output 'metric counter UINT64 COUNTER \[\]'
+output 'metric counter_with_labels UINT64 COUNTER \[label STRING Label doc string.\n\]'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/metrics"
+)
+
+var Counter = metrics.NewCounter[uint64]("counter", metrics.CounterConfig{})
+
+type Labels struct {
+	Label string // Label doc string.
+}
+
+var CounterWithLabels = metrics.NewCounterGroup[Labels, uint64]("counter_with_labels", metrics.CounterConfig{})
+
+//encore:api public
+func Foo(context.Context) error {
+	return nil
+}
diff --git a/v2/app/testdata/metrics_gauge.txt b/v2/app/testdata/metrics_gauge.txt
new file mode 100644
index 0000000000..ef262c00c7
--- /dev/null
+++ b/v2/app/testdata/metrics_gauge.txt
@@ -0,0 +1,25 @@
+parse
+output 'metric gauge FLOAT64 GAUGE \[\]'
+output 'metric gauge_with_labels FLOAT64 GAUGE \[label STRING Label doc string.\n\]'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/metrics"
+)
+
+var Gauge = metrics.NewGauge[float64]("gauge", metrics.CounterConfig{})
+
+type Labels struct {
+	Label string // Label doc string.
+}
+
+var GaugeWithLabels = metrics.NewGaugeGroup[Labels, float64]("gauge_with_labels", metrics.CounterConfig{})
+
+//encore:api public
+func Foo(context.Context) error {
+	return nil
+}
\ No newline at end of file
diff --git a/v2/app/testdata/middleware.txt b/v2/app/testdata/middleware.txt
new file mode 100644
index 0000000000..89dacebc6a
--- /dev/null
+++ b/v2/app/testdata/middleware.txt
@@ -0,0 +1,41 @@
+parse
+
+-- svc/svc.go --
+package svc
+
+import "context"
+
+
+//encore:api public tag:foo
+func API(ctx context.Context) error { return nil }
+
+-- svc/mw/mw.go --
+package mw
+
+import "encore.dev/middleware"
+
+//encore:middleware target=tag:foo
+func TaggedInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+
+//encore:middleware target=all
+func AllInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+
+
+-- lib/globalmw/globalmw.go --
+package globalmw
+
+import "encore.dev/middleware"
+
+//encore:middleware global target=tag:foo
+func TaggedInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+
+//encore:middleware global target=all
+func AllInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
diff --git a/v2/app/testdata/middleware_err_no_matches.txt b/v2/app/testdata/middleware_err_no_matches.txt
new file mode 100644
index 0000000000..1d9c0e479f
--- /dev/null
+++ b/v2/app/testdata/middleware_err_no_matches.txt
@@ -0,0 +1,83 @@
+! parse
+
+-- svc/svc.go --
+package svc
+
+import "context"
+
+
+//encore:api public tag:bar
+func API(ctx context.Context) error { return nil }
+
+-- svc/mw/mw.go --
+package mw
+
+import "encore.dev/middleware"
+
+//encore:middleware target=tag:foo
+func TaggedInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+
+//encore:middleware target=all
+func AllInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+
+
+-- lib/globalmw/globalmw.go --
+package globalmw
+
+import "encore.dev/middleware"
+
+//encore:middleware global target=tag:foo
+func TaggedInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+
+//encore:middleware global target=all
+func AllInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+-- want: errors --
+
+── Invalid middleware target ──────────────────────────────────────────────────────────────[E9999]──
+
+There are not matching targets in service "svc".
+
+   ╭─[ svc/mw/mw.go:5:28 ]
+   │
+ 3 │ import "encore.dev/middleware"
+ 4 │
+ 5 │ //encore:middleware target=tag:foo
+   ⋮                            ───────
+ 6 │ func TaggedInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+ 7 │     return next(req)
+───╯
+
+hint: middleware must have the signature:
+	func(req middleware.Request, next middleware.Next) middleware.Response
+
+For more information on how to use middleware, see https://encore.dev/docs/develop/middleware
+
+
+
+
+── Invalid middleware target ──────────────────────────────────────────────────────────────[E9999]──
+
+There are not matching targets in the application.
+
+   ╭─[ lib/globalmw/globalmw.go:5:35 ]
+   │
+ 3 │ import "encore.dev/middleware"
+ 4 │
+ 5 │ //encore:middleware global target=tag:foo
+   ⋮                                   ───────
+ 6 │ func TaggedInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+ 7 │     return next(req)
+───╯
+
+hint: middleware must have the signature:
+	func(req middleware.Request, next middleware.Next) middleware.Response
+
+For more information on how to use middleware, see https://encore.dev/docs/develop/middleware
diff --git a/v2/app/testdata/middleware_err_not_in_service.txt b/v2/app/testdata/middleware_err_not_in_service.txt
new file mode 100644
index 0000000000..b7d8368d57
--- /dev/null
+++ b/v2/app/testdata/middleware_err_not_in_service.txt
@@ -0,0 +1,61 @@
+! parse
+
+-- svc/svc.go --
+package svc
+
+import "context"
+
+
+//encore:api public tag:foo
+func API(ctx context.Context) error { return nil }
+
+-- svc/mw/mw.go --
+package mw
+
+import "encore.dev/middleware"
+
+//encore:middleware target=tag:foo
+func TaggedInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+
+//encore:middleware target=all
+func AllInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+
+
+-- lib/globalmw/globalmw.go --
+package globalmw
+
+import "encore.dev/middleware"
+
+//encore:middleware global target=tag:foo
+func TaggedInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+
+//encore:middleware target=all
+func AllInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+-- want: errors --
+
+── Invalid middleware function ────────────────────────────────────────────────────────────[E9999]──
+
+Middleware must be defined in a service unless it is marked as being global.
+
+    ╭─[ lib/globalmw/globalmw.go:11:6 ]
+    │
+  9 │
+ 10 │ //encore:middleware target=all
+ 11 │ func AllInSvc(req middleware.Request, next middleware.Next) middleware.Response {
+    ⋮      ────────
+ 12 │     return next(req)
+ 13 │ }
+────╯
+
+hint: middleware must have the signature:
+	func(req middleware.Request, next middleware.Next) middleware.Response
+
+For more information on how to use middleware, see https://encore.dev/docs/develop/middleware
diff --git a/v2/app/testdata/missing_generic_param.txt b/v2/app/testdata/missing_generic_param.txt
new file mode 100644
index 0000000000..cdd8538422
--- /dev/null
+++ b/v2/app/testdata/missing_generic_param.txt
@@ -0,0 +1,67 @@
+# This test makes sure we don't panic when parsing a missing generic type
+! parse
+-- foo.go --
+package foo
+
+import "context"
+
+type Params struct {
+    C *Generic
+}
+
+type Generic[T any] struct {
+    Val *T
+}
+
+//encore:api public
+func Dummy(ctx context.Context, p *Params) error {
+    return nil
+}
+-- want: errors --
+
+── Missing type argument ──────────────────────────────────────────────────────────────────[E9999]──
+
+Missing type argument
+
+    ╭─[ foo.go:6:7 ]
+    │
+  4 │
+  5 │ type Params struct {
+  6 │     C *Generic
+    ⋮       ───┬────
+    ⋮          ╰─ missing from here
+  7 │ }
+  8 │
+  9 │ type Generic[T any] struct {
+    ⋮              ──┬──
+    ⋮                ╰─ missing type parameter defined here
+ 10 │     Val *T
+ 11 │ }
+────╯
+
+For more information, see https://encore.dev/docs/develop/api-schemas
+
+
+
+
+── Missing type argument ──────────────────────────────────────────────────────────────────[E9999]──
+
+Missing type argument
+
+    ╭─[ foo.go:6:7 ]
+    │
+  4 │
+  5 │ type Params struct {
+  6 │     C *Generic
+    ⋮       ───┬────
+    ⋮          ╰─ missing from here
+  7 │ }
+  8 │
+  9 │ type Generic[T any] struct {
+    ⋮              ──┬──
+    ⋮                ╰─ missing type parameter defined here
+ 10 │     Val *T
+ 11 │ }
+────╯
+
+For more information, see https://encore.dev/docs/develop/api-schemas
diff --git a/v2/app/testdata/pubsub.txt b/v2/app/testdata/pubsub.txt
new file mode 100644
index 0000000000..1d6a592ea1
--- /dev/null
+++ b/v2/app/testdata/pubsub.txt
@@ -0,0 +1,110 @@
+# Verify that pub sub is parsed
+parse
+output 'pubsubTopic basic-topic'
+output 'pubsubTopic another-topic'
+output 'pubsubPublisher basic-topic foo'
+output 'pubsubSubscriber basic-topic basic-subscription svc 45000000000 396000000000000 3 8000000000 1920000000000'
+output 'pubsubSubscriber basic-topic another-subscription svc 30000000000 604800000000000 100 10000000000 600000000000'
+output 'pubsubSubscriber basic-topic a-third-subscription foo 1000000000 119999999000 47 14399999998000 17999999997000'
+
+-- shared/topics.go --
+package shared
+
+import (
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var (
+    BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+    AnotherTopic = pubsub.NewTopic[*MessageType]("another-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.ExactlyOnce })
+)
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "time"
+
+    "encore.dev/pubsub"
+
+    "test/shared"
+    "test/svc/domain"
+)
+
+
+var (
+    _ = pubsub.NewSubscription(shared.BasicTopic, "basic-subscription",
+        pubsub.SubscriptionConfig {
+            Handler: Subscriber1,
+            MaxConcurrency: 25,
+            AckDeadline: 45 * time.Second,
+            MessageRetention: 5 * time.Hour * 24 + -10 * time.Hour,
+            RetryPolicy: &pubsub.RetryPolicy{
+                MaxRetries: 3,
+                MinBackoff: 8 * time.Second,
+                MaxBackoff: 32 * time.Minute,
+            },
+        },
+    )
+
+    _ = pubsub.NewSubscription(shared.BasicTopic, "another-subscription",
+        pubsub.SubscriptionConfig { Handler: domain.SubscriptionCode },
+    )
+)
+
+// encore:api
+func Subscriber1(ctx context.Context, msg *shared.MessageType) error {
+    return nil
+}
+
+-- svc/domain/code.go --
+package domain
+
+import (
+    "context"
+
+    "test/shared"
+)
+
+func SubscriptionCode(ctx context.Context, msg *shared.MessageType) error {
+    return nil
+}
+
+-- foo/code.go --
+package foo
+
+import (
+    "context"
+    "time"
+
+    "encore.dev/pubsub"
+
+    "test/shared"
+)
+
+var _ = pubsub.NewSubscription(
+    shared.BasicTopic,
+    "a-third-subscription",
+    pubsub.SubscriptionConfig {
+        Handler: func(ctx context.Context, msg *shared.MessageType) error {
+          return nil
+      },
+      AckDeadline: 1 * time.Second,
+      MessageRetention: 2 * time.Minute + -1 * time.Microsecond,
+      RetryPolicy: &pubsub.RetryPolicy{
+          MaxRetries: -3 + 10 * 5,
+          MinBackoff: 4 * time.Hour + -2 * time.Microsecond,
+          MaxBackoff: 5 * time.Hour + -3 * time.Microsecond,
+      },
+    },
+)
+
+// encore:api
+func DoStuff(ctx context.Context) error {
+    shared.BasicTopic.Publish(ctx, &shared.MessageType{Name: "foo"})
+}
diff --git a/v2/app/testdata/pubsub_err_attributes_not_start_encore.txt b/v2/app/testdata/pubsub_err_attributes_not_start_encore.txt
new file mode 100644
index 0000000000..e73d710099
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_attributes_not_start_encore.txt
@@ -0,0 +1,38 @@
+# Verify that pub sub is parsed
+! parse
+err 'PubSub message attributes must not be prefixed with "encore".'
+
+-- shared/topics.go --
+package shared
+
+import (
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string `pubsub-attr:"encorename"`
+}
+
+var BasicTopic = pubsub.NewTopic[*MessageType]("same-name", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+
+-- want: errors --
+
+── Invalid attribute prefix ───────────────────────────────────────────────────────────────[E9999]──
+
+PubSub message attributes must not be prefixed with "encore".
+
+    ╭─[ shared/topics.go:8:17 ]
+    │
+  6 │
+  7 │ type MessageType struct {
+  8 │     Name string `pubsub-attr:"encorename"`
+    ⋮                 ──────────────────────────
+  9 │ }
+ 10 │
+ 11 │ var BasicTopic = pubsub.NewTopic[*MessageType]("same-name", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+    ⋮                                  ─────┬──────
+    ⋮                                       ╰─ used as a message type in this topic
+ 12 │
+────╯
+
+For more information on PubSub, see https://encore.dev/docs/primitives/pubsub
diff --git a/v2/app/testdata/pubsub_err_duplicate_subscription_names.txt b/v2/app/testdata/pubsub_err_duplicate_subscription_names.txt
new file mode 100644
index 0000000000..d8b0658b35
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_duplicate_subscription_names.txt
@@ -0,0 +1,92 @@
+! parse
+err 'Subscriptions names on topics must be unique.'
+
+-- shared/topics.go --
+package shared
+
+import (
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var (
+    BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+)
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+
+    "test/shared"
+)
+
+
+var (
+    _ = pubsub.NewSubscription(shared.BasicTopic, "same-name", pubsub.SusbcriptionConfig { Handler: Subscriber1 })
+)
+
+// encore:api
+func Subscriber1(ctx context.Context, msg *shared.MessageType) error {
+    return nil
+}
+
+-- foo/code.go --
+package foo
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+
+    "test/shared"
+)
+
+var _ = pubsub.NewSubscription(
+    shared.BasicTopic,
+    "same-name",
+    pubsub.SusbcriptionConfig { Handler: func(ctx context.Context, msg *shared.MessageType) error {
+        return nil
+    }},
+)
+
+// encore:api
+func DoStuff(ctx context.Context) error {
+    shared.BasicTopic.Publish(ctx, &shared.MessageType{Name: "foo"})
+}
+
+-- want: errors --
+
+── Duplicate PubSub subscription on topic ─────────────────────────────────────────────────[E9999]──
+
+Subscription names on topics must be unique.
+
+    ╭─[ svc/svc.go:13:51 ]
+    │
+ 11 │
+ 12 │ var (
+ 13 │     _ = pubsub.NewSubscription(shared.BasicTopic, "same-name", pubsub.SusbcriptionConfig { Handler: Subscriber1 })
+    ⋮                                                   ─────┬─────
+    ⋮                                                        ╰─ duplicated here
+ 14 │ )
+ 15 │
+────╯
+
+    ╭─[ foo/code.go:13:5 ]
+    │
+ 11 │ var _ = pubsub.NewSubscription(
+ 12 │     shared.BasicTopic,
+ 13 │     "same-name",
+    ⋮     ─────┬─────
+    ⋮          ╰─ originally defined here
+ 14 │     pubsub.SusbcriptionConfig { Handler: func(ctx context.Context, msg *shared.MessageType) error {
+ 15 │         return nil
+────╯
+
+For more information on PubSub, see https://encore.dev/docs/primitives/pubsub
diff --git a/v2/app/testdata/pubsub_err_import_aliased_and_used_in_func.txt b/v2/app/testdata/pubsub_err_import_aliased_and_used_in_func.txt
new file mode 100644
index 0000000000..0094d7a7a5
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_import_aliased_and_used_in_func.txt
@@ -0,0 +1,35 @@
+! parse
+err 'A pubsub topic cannot be declared here, they can only be declared in a package level variable.'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    pb "encore.dev/pubsub"
+)
+
+type MyMessage struct {}
+
+//encore:api
+func SomeAPI(ctx context.Context) error {
+    topic := pb.NewTopic[MyMessage]("basic-topic")
+    topic.Publish(ctx, &MyMessage{})
+}
+
+-- want: errors --
+
+── Invalid call ───────────────────────────────────────────────────────────────────────────[E9999]──
+
+pubsub.NewTopic cannot be called here. It must be called from a package level variable.
+
+    ╭─[ svc/svc.go:13:14 ]
+    │
+ 11 │ //encore:api
+ 12 │ func SomeAPI(ctx context.Context) error {
+ 13 │     topic := pb.NewTopic[MyMessage]("basic-topic")
+    ⋮              ───────────
+ 14 │     topic.Publish(ctx, &MyMessage{})
+ 15 │ }
+────╯
diff --git a/v2/app/testdata/pubsub_err_missing_delivery_guarantee.txt b/v2/app/testdata/pubsub_err_missing_delivery_guarantee.txt
new file mode 100644
index 0000000000..6027e31412
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_missing_delivery_guarantee.txt
@@ -0,0 +1,48 @@
+! parse
+err 'pubsub.NewTopic requires the configuration field named "DeliveryGuarantee" to be explicitly set.'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var (
+    BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{})
+    _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig { Handler: Subscriber })
+)
+
+// encore:api
+func DoStuff(ctx context.Context) error {
+    return BasicTopic.Publish(ctx, &MessageType{Name: "foo"})
+}
+
+func Subscriber(ctx context.Context, msg *MessageType) error {
+    return nil
+}
+
+-- want: errors --
+
+── Invalid PubSub topic config ────────────────────────────────────────────────────────────[E9999]──
+
+The configuration field named "DeliveryGuarantee" must be set to pubsub.AtLeastOnce or
+pubsub.ExactlyOnce.
+
+    ╭─[ svc/svc.go:14:63 ]
+    │
+ 12 │
+ 13 │ var (
+ 14 │     BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{})
+    ⋮                                                               ────────────────────
+ 15 │     _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig { Handler: Subscriber })
+ 16 │ )
+────╯
+
+For more information on PubSub, see https://encore.dev/docs/primitives/pubsub
diff --git a/v2/app/testdata/pubsub_err_new_topic_func_aliased.txt b/v2/app/testdata/pubsub_err_new_topic_func_aliased.txt
new file mode 100644
index 0000000000..def2f9ab8a
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_new_topic_func_aliased.txt
@@ -0,0 +1,33 @@
+! parse
+err 'pubsub.NewTopic can only be called as a function to create a new instance and not referenced'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+)
+
+type MyMessage struct {}
+
+var creator = pubsub.NewTopic[MyMessage]
+
+var topic = creator("my-topic")
+
+-- want: errors --
+
+── Invalid reference ──────────────────────────────────────────────────────────────────────[E9999]──
+
+pubsub.NewTopic cannot be referenced without being called.
+
+    ╭─[ svc/svc.go:11:15 ]
+    │
+  9 │ type MyMessage struct {}
+ 10 │
+ 11 │ var creator = pubsub.NewTopic[MyMessage]
+    ⋮               ───────────────
+ 12 │
+ 13 │ var topic = creator("my-topic")
+────╯
diff --git a/v2/app/testdata/pubsub_err_ordering_attribute_missing.txt b/v2/app/testdata/pubsub_err_ordering_attribute_missing.txt
new file mode 100644
index 0000000000..b0c0035152
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_ordering_attribute_missing.txt
@@ -0,0 +1,41 @@
+# Verify that pub sub is parsed
+! parse
+
+-- shared/topics.go --
+package shared
+
+import (
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    ID   int64  `pubsub-attr:"msg-id"`
+    Name string `pubsub-attr:"name"`
+}
+
+var BasicTopic = pubsub.NewTopic[*MessageType]("same-name", pubsub.TopicConfig{
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+    OrderingAttribute: "ID",
+})
+
+-- want: errors --
+
+── Invalid PubSub topic config ────────────────────────────────────────────────────────────[E9999]──
+
+The configuration field named "OrderingAttribute" must be a one of the export attributes on the
+message type.
+
+    ╭─[ shared/topics.go:14:24 ]
+    │
+ 12 │ var BasicTopic = pubsub.NewTopic[*MessageType]("same-name", pubsub.TopicConfig{
+ 13 │     DeliveryGuarantee: pubsub.AtLeastOnce,
+ 14 │     OrderingAttribute: "ID",
+    ⋮                        ────
+ 15 │ })
+ 16 │
+────╯
+
+For example `pubsub.NewTopic[MyMessage]("my-topic", pubsub.TopicConfig{ DeliveryGuarantee:
+pubsub.AtLeastOnce })`
+
+For more information on PubSub, see https://encore.dev/docs/primitives/pubsub
diff --git a/v2/app/testdata/pubsub_err_subscriber_different_service.txt b/v2/app/testdata/pubsub_err_subscriber_different_service.txt
new file mode 100644
index 0000000000..703df59a04
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_subscriber_different_service.txt
@@ -0,0 +1,82 @@
+! parse
+err 'The function passed to `pubsub.NewSubscription` must be declared in the the same service as the'
+
+-- shared/shared.go --
+package shared
+
+type MessageType struct {
+    Name string
+}
+
+-- svc1/svc.go --
+package svc1
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+
+    "test/shared"
+    "test/svc2"
+)
+
+var BasicTopic = pubsub.NewTopic[*shared.MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+
+var _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig { Handler: svc2.Subscriber })
+
+// encore:api
+func Stuff(ctx context.Context) error {
+    return nil
+}
+
+-- svc2/svc.go --
+package svc2
+
+import (
+    "context"
+
+    "test/shared"
+)
+
+//encore:api
+func Subscriber(ctx context.Context, msg *shared.MessageType) error {
+    return nil
+}
+
+-- want: errors --
+
+── Invalid PubSub subscription handler ────────────────────────────────────────────────────[E9999]──
+
+The handler for the subscription must be defined in the same service as the call to
+pubsub.NewSubscription.
+
+    ╭─[ svc1/svc.go:14:103 ]
+    │
+ 12 │ var BasicTopic = pubsub.NewTopic[*shared.MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+ 13 │
+ 14 │ var _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig { Handler: svc2.Subscriber })
+    ⋮                                                                                                       ───────┬───────
+    ⋮                                                                                                              ╰─ handler specified here
+ 15 │
+ 16 │ // encore:api
+────╯
+
+    ╭─[ svc2/svc.go:10:6 ]
+    │
+  8 │
+  9 │ //encore:api
+ 10 │ func Subscriber(ctx context.Context, msg *shared.MessageType) error {
+    ⋮      ────┬─────
+    ⋮          ╰─ endpoint defined here
+ 11 │     return nil
+ 12 │ }
+────╯
+
+A pubsub subscription must have a unique name per topic and be given a handler function for
+processing the message. The handler for the subscription must be defined in the same service as the
+call to pubsub.NewSubscription and can be an inline function. For example:
+	pubsub.NewSubscription(myTopic, "subscription-name", pubsub.SubscriptionConfig[MyMessage]{
+		Handler: func(ctx context.Context, event MyMessage) error { return nil },
+	})
+
+For more information on PubSub, see https://encore.dev/docs/primitives/pubsub
diff --git a/v2/app/testdata/pubsub_err_subscriber_missing_handler.txt b/v2/app/testdata/pubsub_err_subscriber_missing_handler.txt
new file mode 100644
index 0000000000..48a006eb71
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_subscriber_missing_handler.txt
@@ -0,0 +1,45 @@
+! parse
+err 'pubsub.NewSubscription requires the configuration field named "Handler" to populated with the'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var (
+    BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+    _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig{})
+)
+
+// encore:api
+func DoStuff(ctx context.Context) error {
+    return BasicTopic.Publish(ctx, &MessageType{Name: "foo"})
+}
+
+func Subscriber(ctx context.Context, msg *MessageType) error {
+    return nil
+}
+
+-- want: errors --
+
+── Invalid Argument ───────────────────────────────────────────────────────────────────────[E9999]──
+
+Missing required field `Handler`
+
+    ╭─[ svc/svc.go:15:66 ]
+    │
+ 13 │ var (
+ 14 │     BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+ 15 │     _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig{})
+    ⋮                                                                  ───────────────────────────
+ 16 │ )
+ 17 │
+────╯
diff --git a/v2/app/testdata/pubsub_err_subscriber_nil_handler.txt b/v2/app/testdata/pubsub_err_subscriber_nil_handler.txt
new file mode 100644
index 0000000000..801b529704
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_subscriber_nil_handler.txt
@@ -0,0 +1,45 @@
+! parse
+err 'pubsub.NewSubscription requires the configuration field named "Handler" to populated with the'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var (
+    BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+    _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig{ Handler: nil })
+)
+
+// encore:api
+func DoStuff(ctx context.Context) error {
+    return BasicTopic.Publish(ctx, &MessageType{Name: "foo"})
+}
+
+func Subscriber(ctx context.Context, msg *MessageType) error {
+    return nil
+}
+
+-- want: errors --
+
+── Invalid Argument ───────────────────────────────────────────────────────────────────────[E9999]──
+
+Missing required field `Handler`
+
+    ╭─[ svc/svc.go:15:66 ]
+    │
+ 13 │ var (
+ 14 │     BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+ 15 │     _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig{ Handler: nil })
+    ⋮                                                                  ─────────────────────────────────────────
+ 16 │ )
+ 17 │
+────╯
diff --git a/v2/app/testdata/pubsub_err_subscriber_not_function.txt b/v2/app/testdata/pubsub_err_subscriber_not_function.txt
new file mode 100644
index 0000000000..8c196a8bc7
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_subscriber_not_function.txt
@@ -0,0 +1,72 @@
+! parse
+err 'The function passed to `pubsub.NewSubscription` must be declared in the the same service'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "test/shared"
+
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var (
+    BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+    _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig { Handler: shared.Subscriber })
+)
+
+// encore:api
+func DoStuff(ctx context.Context) error {
+    return BasicTopic.Publish(ctx, &MessageType{Name: "foo"})
+}
+
+-- shared/shared.go --
+package shared
+
+func Subscriber(ctx context.Context, msg *shared.MessageType) error {
+    return nil
+}
+
+-- want: errors --
+
+── Invalid PubSub subscription handler ────────────────────────────────────────────────────[E9999]──
+
+The handler for the subscription must be defined in the same service as the call to
+pubsub.NewSubscription.
+
+    ╭─[ svc/svc.go:17:103 ]
+    │
+ 15 │ var (
+ 16 │     BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+ 17 │     _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig { Handler: shared.Subscriber })
+    ⋮                                                                                                       ────────┬────────
+    ⋮                                                                                                               ╰─ handler specified here
+ 18 │ )
+ 19 │
+────╯
+
+   ╭─[ shared/shared.go:3:6 ]
+   │
+ 1 │ package shared
+ 2 │
+ 3 │ func Subscriber(ctx context.Context, msg *shared.MessageType) error {
+   ⋮      ────┬─────
+   ⋮          ╰─ handler function defined here
+ 4 │     return nil
+ 5 │ }
+───╯
+
+A pubsub subscription must have a unique name per topic and be given a handler function for
+processing the message. The handler for the subscription must be defined in the same service as the
+call to pubsub.NewSubscription and can be an inline function. For example:
+	pubsub.NewSubscription(myTopic, "subscription-name", pubsub.SubscriptionConfig[MyMessage]{
+		Handler: func(ctx context.Context, event MyMessage) error { return nil },
+	})
+
+For more information on PubSub, see https://encore.dev/docs/primitives/pubsub
diff --git a/v2/app/testdata/pubsub_err_subscription_func_not_in_service.txt b/v2/app/testdata/pubsub_err_subscription_func_not_in_service.txt
new file mode 100644
index 0000000000..703df59a04
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_subscription_func_not_in_service.txt
@@ -0,0 +1,82 @@
+! parse
+err 'The function passed to `pubsub.NewSubscription` must be declared in the the same service as the'
+
+-- shared/shared.go --
+package shared
+
+type MessageType struct {
+    Name string
+}
+
+-- svc1/svc.go --
+package svc1
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+
+    "test/shared"
+    "test/svc2"
+)
+
+var BasicTopic = pubsub.NewTopic[*shared.MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+
+var _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig { Handler: svc2.Subscriber })
+
+// encore:api
+func Stuff(ctx context.Context) error {
+    return nil
+}
+
+-- svc2/svc.go --
+package svc2
+
+import (
+    "context"
+
+    "test/shared"
+)
+
+//encore:api
+func Subscriber(ctx context.Context, msg *shared.MessageType) error {
+    return nil
+}
+
+-- want: errors --
+
+── Invalid PubSub subscription handler ────────────────────────────────────────────────────[E9999]──
+
+The handler for the subscription must be defined in the same service as the call to
+pubsub.NewSubscription.
+
+    ╭─[ svc1/svc.go:14:103 ]
+    │
+ 12 │ var BasicTopic = pubsub.NewTopic[*shared.MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+ 13 │
+ 14 │ var _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig { Handler: svc2.Subscriber })
+    ⋮                                                                                                       ───────┬───────
+    ⋮                                                                                                              ╰─ handler specified here
+ 15 │
+ 16 │ // encore:api
+────╯
+
+    ╭─[ svc2/svc.go:10:6 ]
+    │
+  8 │
+  9 │ //encore:api
+ 10 │ func Subscriber(ctx context.Context, msg *shared.MessageType) error {
+    ⋮      ────┬─────
+    ⋮          ╰─ endpoint defined here
+ 11 │     return nil
+ 12 │ }
+────╯
+
+A pubsub subscription must have a unique name per topic and be given a handler function for
+processing the message. The handler for the subscription must be defined in the same service as the
+call to pubsub.NewSubscription and can be an inline function. For example:
+	pubsub.NewSubscription(myTopic, "subscription-name", pubsub.SubscriptionConfig[MyMessage]{
+		Handler: func(ctx context.Context, event MyMessage) error { return nil },
+	})
+
+For more information on PubSub, see https://encore.dev/docs/primitives/pubsub
diff --git a/v2/app/testdata/pubsub_err_subscription_name_invalid.txt b/v2/app/testdata/pubsub_err_subscription_name_invalid.txt
new file mode 100644
index 0000000000..a4f1bb6e33
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_subscription_name_invalid.txt
@@ -0,0 +1,50 @@
+! parse
+err 'The pubsub.NewSubscription must be subscription name be defined in "kebab-case"'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var (
+    BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+    _ = pubsub.NewSubscription(BasicTopic, "basic subscription", pubsub.SusbcriptionConfig { Handler: Subscriber })
+)
+
+// encore:api
+func DoStuff(ctx context.Context) error {
+    return BasicTopic.Publish(ctx, &MessageType{Name: "foo"})
+}
+
+func Subscriber(ctx context.Context, msg *MessageType) error {
+    return nil
+}
+
+-- want: errors --
+
+── Invalid resource name ──────────────────────────────────────────────────────────────────[E9999]──
+
+The pubsub.NewSubscription subscription name must be defined in "kebab-case".
+
+    ╭─[ svc/svc.go:15:44 ]
+    │
+ 13 │ var (
+ 14 │     BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+ 15 │     _ = pubsub.NewSubscription(BasicTopic, "basic subscription", pubsub.SusbcriptionConfig { Handler: Subscriber })
+    ⋮                                            ─────────┬──────────
+    ⋮                                                     ╰─ try basic-subscription?
+ 16 │ )
+ 17 │
+────╯
+
+pubsub.NewSubscription subscription name's must be defined as string literals, be between 1 and 63
+characters long, and defined in "kebab-case", meaning it must start with a letter, end with a
+letter or number and only contain lower case letters, numbers and dashes.
diff --git a/v2/app/testdata/pubsub_err_topic_declared_in_func.txt b/v2/app/testdata/pubsub_err_topic_declared_in_func.txt
new file mode 100644
index 0000000000..c89dcf83ee
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_topic_declared_in_func.txt
@@ -0,0 +1,35 @@
+! parse
+err 'A pubsub topic cannot be declared here, they can only be declared in a package level variable.'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+)
+
+type MyMessage struct {}
+
+//encore:api
+func SomeAPI(ctx context.Context) error {
+    topic := pubsub.NewTopic[MyMessage]("basic-topic")
+    topic.Publish(ctx, &MyMessage{})
+}
+
+-- want: errors --
+
+── Invalid call ───────────────────────────────────────────────────────────────────────────[E9999]──
+
+pubsub.NewTopic cannot be called here. It must be called from a package level variable.
+
+    ╭─[ svc/svc.go:13:14 ]
+    │
+ 11 │ //encore:api
+ 12 │ func SomeAPI(ctx context.Context) error {
+ 13 │     topic := pubsub.NewTopic[MyMessage]("basic-topic")
+    ⋮              ───────────────
+ 14 │     topic.Publish(ctx, &MyMessage{})
+ 15 │ }
+────╯
diff --git a/v2/app/testdata/pubsub_err_topic_invalid_usage.txt b/v2/app/testdata/pubsub_err_topic_invalid_usage.txt
new file mode 100644
index 0000000000..f1277df3a9
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_topic_invalid_usage.txt
@@ -0,0 +1,40 @@
+# Verify that pub sub is parsed
+! parse2
+
+-- svc/svc.go --
+package svc
+
+import (
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var BasicTopic = pubsub.NewTopic[*MessageType]("same-name", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+
+func SomeFunc(t *pubsub.Topic[*MessageType]) {}
+
+func init() {
+    SomeFunc(BasicTopic)
+}
+-- want: errors --
+
+── Invalid reference to pubsub.Topic ──────────────────────────────────────────────────────[E9999]──
+
+A reference to pubsub.Topic is not permissible here.
+
+    ╭─[ svc/svc.go:16:14 ]
+    │
+ 14 │
+ 15 │ func init() {
+ 16 │     SomeFunc(BasicTopic)
+    ⋮              ──────────
+ 17 │ }
+────╯
+
+The topic can only be referenced by calling methods on it, or to pass it to pubsub.NewSubscription
+or et.Topic.
+
+For more information on PubSub, see https://encore.dev/docs/primitives/pubsub
diff --git a/v2/app/testdata/pubsub_err_topic_must_be_unique.txt b/v2/app/testdata/pubsub_err_topic_must_be_unique.txt
new file mode 100644
index 0000000000..5e4c89810f
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_topic_must_be_unique.txt
@@ -0,0 +1,61 @@
+# Verify that pub sub is parsed
+! parse
+err 'A PubSub topic name must be unique within an application.'
+
+-- shared/topics.go --
+package shared
+
+import (
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var BasicTopic = pubsub.NewTopic[*MessageType]("same-name", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var AnotherTopic = pubsub.NewTopic[*MessageType]("same-name", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+
+-- want: errors --
+
+── Duplicate PubSub topic name ────────────────────────────────────────────────────────────[E9999]──
+
+A PubSub topic name must be unique within a service.
+
+    ╭─[ svc/svc.go:13:50 ]
+    │
+ 11 │ }
+ 12 │
+ 13 │ var AnotherTopic = pubsub.NewTopic[*MessageType]("same-name", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+    ⋮                                                  ─────┬─────
+    ⋮                                                       ╰─ duplicated here
+ 14 │
+────╯
+
+    ╭─[ shared/topics.go:11:48 ]
+    │
+  9 │ }
+ 10 │
+ 11 │ var BasicTopic = pubsub.NewTopic[*MessageType]("same-name", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+    ⋮                                                ─────┬─────
+    ⋮                                                     ╰─ originally defined here
+ 12 │
+────╯
+
+If you wish to reuse the same topic, then you can export the original Topic object import it here.
+
+For more information on PubSub, see https://encore.dev/docs/primitives/pubsub
diff --git a/v2/app/testdata/pubsub_err_topic_name_invalid.txt b/v2/app/testdata/pubsub_err_topic_name_invalid.txt
new file mode 100644
index 0000000000..66f3a7b4b7
--- /dev/null
+++ b/v2/app/testdata/pubsub_err_topic_name_invalid.txt
@@ -0,0 +1,45 @@
+! parse
+err 'The pubsub.NewTopic must be topic name be defined in "kebab-case"'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var (
+    BasicTopic = pubsub.NewTopic[*MessageType]("basic topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+)
+
+// encore:api
+func DoStuff(ctx context.Context) error {
+    return BasicTopic.Publish(ctx, &MessageType{Name: "foo"})
+}
+
+-- want: errors --
+
+── Invalid resource name ──────────────────────────────────────────────────────────────────[E9999]──
+
+The pubsub.NewTopic topic name must be defined in "kebab-case".
+
+    ╭─[ svc/svc.go:14:48 ]
+    │
+ 12 │
+ 13 │ var (
+ 14 │     BasicTopic = pubsub.NewTopic[*MessageType]("basic topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+    ⋮                                                ──────┬──────
+    ⋮                                                      ╰─ try basic-topic?
+ 15 │ )
+ 16 │
+────╯
+
+pubsub.NewTopic topic name's must be defined as string literals, be between 1 and 63 characters
+long, and defined in "kebab-case", meaning it must start with a letter, end with a letter or number
+and only contain lower case letters, numbers and dashes.
diff --git a/v2/app/testdata/pubsub_publish_in_middleware.txt b/v2/app/testdata/pubsub_publish_in_middleware.txt
new file mode 100644
index 0000000000..b915d6c51a
--- /dev/null
+++ b/v2/app/testdata/pubsub_publish_in_middleware.txt
@@ -0,0 +1,48 @@
+parse
+output 'pubsubPublisher middlware basic MiddlewareFunc'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    UserID int64 `pubsub-attr:"user_id"`
+    Name string
+}
+
+var (
+    BasicTopic = pubsub.NewTopic[*MessageType]("basic", pubsub.TopicConfig{
+        DeliveryGuarantee: pubsub.AtLeastOnce,
+        OrderingAttribute: "user_id",
+    })
+)
+
+// encore:api
+func DoStuff(ctx context.Context) error {
+    return BasicTopic.Publish(ctx, &MessageType{UserID: 1, Name: "foo"})
+}
+
+
+-- middleware/middleware.go --
+package middleware
+
+import (
+	"time"
+
+	"encore.dev/middleware"
+	"encore.dev/pubsub"
+
+	"test/svc"
+)
+
+//encore:middleware global target=all
+func MiddlewareFunc(req middleware.Request, next middleware.Next) middleware.Response {
+    svc.BasicTopic.Publish(req.Context(), &svc.MessageType{UserID: 1, Name: "bar"})
+
+	return next(req)
+}
diff --git a/v2/app/testdata/pubsub_subscriber_creates_service.txt b/v2/app/testdata/pubsub_subscriber_creates_service.txt
new file mode 100644
index 0000000000..37e33bf2b4
--- /dev/null
+++ b/v2/app/testdata/pubsub_subscriber_creates_service.txt
@@ -0,0 +1,53 @@
+# Verify that pub sub is parsed
+parse
+output 'pubsubTopic basic-topic'
+output 'pubsubPublisher basic-topic svc'
+output 'pubsubSubscriber basic-topic foo-service-sub foo'
+
+-- shared/topics.go --
+package shared
+
+import (
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var (
+    BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+)
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "test/shared"
+)
+
+// encore:api
+func DoStuff(ctx context.Context, msg *shared.MessageType) error {
+    shared.BasicTopic.Publish(ctx, msg)
+}
+
+-- foo/code.go --
+package foo
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+
+    "test/shared"
+)
+
+var _ = pubsub.NewSubscription(
+    shared.BasicTopic,
+    "foo-service-sub",
+    pubsub.SusbcriptionConfig { Handler: func(ctx context.Context, msg *shared.MessageType) error {
+        return nil
+    }},
+)
diff --git a/v2/app/testdata/pubsub_subscriber_in_same_service.txt b/v2/app/testdata/pubsub_subscriber_in_same_service.txt
new file mode 100644
index 0000000000..2e3e5ef8c4
--- /dev/null
+++ b/v2/app/testdata/pubsub_subscriber_in_same_service.txt
@@ -0,0 +1,31 @@
+parse
+output 'pubsubTopic basic-topic'
+output 'pubsubPublisher basic-topic svc'
+output 'pubsubSubscriber basic-topic basic-subscription svc'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/pubsub"
+)
+
+type MessageType struct {
+    Name string
+}
+
+var (
+    BasicTopic = pubsub.NewTopic[*MessageType]("basic-topic", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })
+    _ = pubsub.NewSubscription(BasicTopic, "basic-subscription", pubsub.SusbcriptionConfig { Handler: Subscriber })
+)
+
+// encore:api
+func DoStuff(ctx context.Context) error {
+    return BasicTopic.Publish(ctx, &MessageType{Name: "foo"})
+}
+
+func Subscriber(ctx context.Context, msg *MessageType) error {
+    return nil
+}
diff --git a/v2/app/testdata/recursive_types.txt b/v2/app/testdata/recursive_types.txt
new file mode 100644
index 0000000000..9cd9e60e51
--- /dev/null
+++ b/v2/app/testdata/recursive_types.txt
@@ -0,0 +1,33 @@
+parse
+-- foo.go --
+package foo
+
+import "context"
+
+// We must reference these types in an RPC parameter to actually validate them.
+type Params struct {
+    A *SelfRecursive
+    B *MutuallyRecursive
+    C *Generic[Generic[MutuallyRecursive]]
+}
+
+//encore:api public
+func Dummy(ctx context.Context, p *Params) error {
+    return nil
+}
+
+type SelfRecursive struct {
+    A *SelfRecursive
+}
+
+type MutuallyRecursive struct {
+    Other *Other
+}
+
+type Other struct {
+    Original *MutuallyRecursive
+}
+
+type Generic[T any] struct {
+    Val *T
+}
diff --git a/v2/app/testdata/rlog_call_outside_svc.txt b/v2/app/testdata/rlog_call_outside_svc.txt
new file mode 100644
index 0000000000..e1647ff207
--- /dev/null
+++ b/v2/app/testdata/rlog_call_outside_svc.txt
@@ -0,0 +1,25 @@
+parse
+
+-- foo/foo.go --
+package foo
+
+import "encore.dev/rlog"
+
+func Log() {
+    rlog.Info("test")
+}
+
+-- bar/bar.go --
+package bar
+
+import (
+    "context"
+
+    "test/foo"
+)
+
+//encore:api public
+func CallFoo(ctx context.Context) error {
+    foo.Log()
+    return nil
+}
diff --git a/parser/testdata/rpc_auth.txt b/v2/app/testdata/rpc_auth.txt
similarity index 86%
rename from parser/testdata/rpc_auth.txt
rename to v2/app/testdata/rpc_auth.txt
index af29a54d12..5c6201d00f 100644
--- a/parser/testdata/rpc_auth.txt
+++ b/v2/app/testdata/rpc_auth.txt
@@ -1,5 +1,5 @@
 parse
-stdout 'rpc svc.API access=auth raw=false'
+output 'rpc svc.API access=auth raw=false'
 
 -- svc/svc.go --
 package svc
diff --git a/v2/app/testdata/rpc_auth_no_authhandler.txt b/v2/app/testdata/rpc_auth_no_authhandler.txt
new file mode 100644
index 0000000000..68f3f7f217
--- /dev/null
+++ b/v2/app/testdata/rpc_auth_no_authhandler.txt
@@ -0,0 +1,32 @@
+! parse
+err 'cannot use "auth" access type'
+
+-- svc/svc.go --
+package svc
+
+import "context"
+
+//encore:api auth
+func API(ctx context.Context) error { return nil }
+
+-- want: errors --
+
+── No Auth Handler Defined ────────────────────────────────────────────────────────────────[E9999]──
+
+An auth handler must be defined to use the auth directive on an API.
+
+   ╭─[ svc/svc.go:5:14 ]
+   │
+ 3 │ import "context"
+ 4 │
+ 5 │ //encore:api auth
+   ⋮              ────
+ 6 │ func API(ctx context.Context) error { return nil }
+ 7 │
+───╯
+
+You can specify them for each field using the struct tags, for example with `header:"X-My-Header"`
+or `query:"my-query"`.
+
+For more information on auth handlers and how to define them, see
+https://encore.dev/docs/develop/auth
diff --git a/v2/app/testdata/rpc_call_selector.txt b/v2/app/testdata/rpc_call_selector.txt
new file mode 100644
index 0000000000..b6f47a1199
--- /dev/null
+++ b/v2/app/testdata/rpc_call_selector.txt
@@ -0,0 +1,19 @@
+# Verify that the parser isn't confusing t.Foo() with calling Foo()
+parse
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+)
+
+//encore:api public
+func Foo(ctx context.Context) error {
+    var t typ
+    t.Foo()
+    return nil
+}
+
+type typ struct{}
+func (typ) Foo() { }
\ No newline at end of file
diff --git a/v2/app/testdata/rpc_err_any.txt b/v2/app/testdata/rpc_err_any.txt
new file mode 100644
index 0000000000..1e54ad86d6
--- /dev/null
+++ b/v2/app/testdata/rpc_err_any.txt
@@ -0,0 +1,38 @@
+! parse
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+)
+
+type Params struct {
+    Foo any
+}
+
+//encore:api public
+func Any(ctx context.Context, p *Params) error { return nil }
+-- want: errors --
+
+── Invalid API schema ─────────────────────────────────────────────────────────────────────[E9999]──
+
+Interfaces are not supported in API schemas.
+
+    ╭─[ svc/svc.go:8:9 ]
+    │
+  6 │
+  7 │ type Params struct {
+  8 │     Foo any
+    ⋮         ─┬─
+    ⋮          ╰─ defined here
+    ·
+    ·
+ 10 │
+ 11 │ //encore:api public
+ 12 │ func Any(ctx context.Context, p *Params) error { return nil }
+    ⋮                                 ───┬───
+    ⋮                                    ╰─ used here
+────╯
+
+For more information on API schemas, see https://encore.dev/docs/develop/api-schemas
diff --git a/v2/app/testdata/rpc_invalid_header_type.txt b/v2/app/testdata/rpc_invalid_header_type.txt
new file mode 100644
index 0000000000..01d973d74f
--- /dev/null
+++ b/v2/app/testdata/rpc_invalid_header_type.txt
@@ -0,0 +1,47 @@
+! parse
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/types/uuid"
+)
+
+type Nested struct {
+    Baz string
+}
+
+type Params struct {
+    Foo uuid.UUID
+    Bar *Nested `header:"X-Bar"`
+}
+
+//encore:api public method=POST
+func Str(ctx context.Context, p *Params) error { return nil }
+
+-- want: errors --
+
+── Invalid request type ───────────────────────────────────────────────────────────────────[E9999]──
+
+API request parameters of type *Nested are not supported in headers. You can only use built-in
+types types such as strings, booleans, int, time.Time.
+
+    ╭─[ svc/svc.go:14:9 ]
+    │
+ 12 │ type Params struct {
+ 13 │     Foo uuid.UUID
+ 14 │     Bar *Nested `header:"X-Bar"`
+    ⋮         ───┬───
+    ⋮            ╰─ unsupported type
+    ·
+    ·
+ 16 │
+ 17 │ //encore:api public method=POST
+ 18 │ func Str(ctx context.Context, p *Params) error { return nil }
+    ⋮                               ────┬────
+    ⋮                                   ╰─ used here
+ 19 │
+────╯
+
+See https://encore.dev/docs/develop/api-schemas#supported-types for more information.
diff --git a/v2/app/testdata/rpc_invalid_path_param_name.txt b/v2/app/testdata/rpc_invalid_path_param_name.txt
new file mode 100644
index 0000000000..33e93de609
--- /dev/null
+++ b/v2/app/testdata/rpc_invalid_path_param_name.txt
@@ -0,0 +1,38 @@
+! parse
+err 'unexpected parameter name ''bar'', expected ''foo'' \(to match path parameter '':foo''\)'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/types/uuid"
+)
+
+//encore:api public path=/str/:foo
+func Str(ctx context.Context, bar string) error { return nil }
+
+-- want: errors --
+
+── Invalid API Function ───────────────────────────────────────────────────────────────────[E9999]──
+
+Unexpected parameter name "bar" expected "foo" (to match path parameter ":foo").
+
+    ╭─[ svc/svc.go:8:31 ]
+    │
+  6 │ )
+  7 │
+  8 │ //encore:api public path=/str/:foo
+    ⋮                               ────
+  9 │ func Str(ctx context.Context, bar string) error { return nil }
+    ⋮                               ──────────
+ 10 │
+────╯
+
+hint: valid signatures are:
+	- func(context.Context) error
+	- func(context.Context) (*ResponseData, error)
+	- func(context.Context, *RequestData) error
+	- func(context.Context, *RequestType) (*ResponseData, error)
+
+For more information on how to use APIs, see https://encore.dev/docs/primitives/apis
diff --git a/v2/app/testdata/rpc_invalid_path_param_type.txt b/v2/app/testdata/rpc_invalid_path_param_type.txt
new file mode 100644
index 0000000000..56df03b792
--- /dev/null
+++ b/v2/app/testdata/rpc_invalid_path_param_type.txt
@@ -0,0 +1,40 @@
+! parse
+err 'path parameter ''p'' must be a string, .+'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/types/uuid"
+)
+
+type Struct struct{}
+
+//encore:api public path=/str/:p
+func Str(ctx context.Context, p *Struct) error { return nil }
+
+-- want: errors --
+
+── Invalid API Function ───────────────────────────────────────────────────────────────────[E9999]──
+
+Path parameter "p" must be a string, bool, integer, or encore.dev/types/uuid.UUID.
+
+    ╭─[ svc/svc.go:10:31 ]
+    │
+  8 │ type Struct struct{}
+  9 │
+ 10 │ //encore:api public path=/str/:p
+    ⋮                               ──
+ 11 │ func Str(ctx context.Context, p *Struct) error { return nil }
+    ⋮                               ─────────
+ 12 │
+────╯
+
+hint: valid signatures are:
+	- func(context.Context) error
+	- func(context.Context) (*ResponseData, error)
+	- func(context.Context, *RequestData) error
+	- func(context.Context, *RequestType) (*ResponseData, error)
+
+For more information on how to use APIs, see https://encore.dev/docs/primitives/apis
diff --git a/v2/app/testdata/rpc_invalid_path_too_few_params.txt b/v2/app/testdata/rpc_invalid_path_too_few_params.txt
new file mode 100644
index 0000000000..64af0116fd
--- /dev/null
+++ b/v2/app/testdata/rpc_invalid_path_too_few_params.txt
@@ -0,0 +1,38 @@
+! parse
+err 'invalid API signature: expected function parameters named ''foo'', ''bar'' to match API path params'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/types/uuid"
+)
+
+//encore:api public path=/str/:foo/:bar
+func Str(ctx context.Context) error { return nil }
+
+-- want: errors --
+
+── Invalid API Function ───────────────────────────────────────────────────────────────────[E9999]──
+
+Expected function parameters named 'foo', 'bar' to match Endpoint path params.
+
+    ╭─[ svc/svc.go:8:31 ]
+    │
+  6 │ )
+  7 │
+  8 │ //encore:api public path=/str/:foo/:bar
+    ⋮                               ──── ────
+  9 │ func Str(ctx context.Context) error { return nil }
+    ⋮         ─────────────────────
+ 10 │
+────╯
+
+hint: valid signatures are:
+	- func(context.Context) error
+	- func(context.Context) (*ResponseData, error)
+	- func(context.Context, *RequestData) error
+	- func(context.Context, *RequestType) (*ResponseData, error)
+
+For more information on how to use APIs, see https://encore.dev/docs/primitives/apis
diff --git a/v2/app/testdata/rpc_invalid_query_type.txt b/v2/app/testdata/rpc_invalid_query_type.txt
new file mode 100644
index 0000000000..8477f8274d
--- /dev/null
+++ b/v2/app/testdata/rpc_invalid_query_type.txt
@@ -0,0 +1,50 @@
+! parse
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/types/uuid"
+)
+
+type Nested struct {
+    Baz string
+}
+
+type Params struct {
+    Foo uuid.UUID
+    Bar *Nested
+}
+
+//encore:api public method=GET
+func Str(ctx context.Context, p *Params) error { return nil }
+
+-- want: errors --
+
+── Invalid request type ───────────────────────────────────────────────────────────────────[E9999]──
+
+API request parameters of type *Nested are not supported in query strings. You can only use
+built-in types, or slices of built-in types such as strings, booleans, int, time.Time.
+
+    ╭─[ svc/svc.go:14:9 ]
+    │
+ 12 │ type Params struct {
+ 13 │     Foo uuid.UUID
+ 14 │     Bar *Nested
+    ⋮         ───┬───
+    ⋮            ╰─ unsupported type
+ 15 │ }
+ 16 │
+ 17 │ //encore:api public method=GET
+    ⋮                     ────┬─────
+    ⋮                         ╰─ you could change this to a POST or PUT request
+ 18 │ func Str(ctx context.Context, p *Params) error { return nil }
+    ⋮                               ────┬────
+    ⋮                                   ╰─ used here
+ 19 │
+────╯
+
+APIs which are sent as GET, HEAD or DELETE requests are unable to contain JSON bodies, thus all
+parameters must be sent as query strings or headers. See
+https://encore.dev/docs/develop/api-schemas#supported-types for more information.
diff --git a/v2/app/testdata/rpc_legacy_syntax.txt b/v2/app/testdata/rpc_legacy_syntax.txt
new file mode 100644
index 0000000000..facc7b5b4f
--- /dev/null
+++ b/v2/app/testdata/rpc_legacy_syntax.txt
@@ -0,0 +1,10 @@
+parse
+output 'svc.API access=private raw=false'
+
+-- svc/svc.go --
+package svc
+
+import "context"
+
+// encore:api
+func API(ctx context.Context) error { return nil }
\ No newline at end of file
diff --git a/v2/app/testdata/rpc_method.txt b/v2/app/testdata/rpc_method.txt
new file mode 100644
index 0000000000..c507aa2d37
--- /dev/null
+++ b/v2/app/testdata/rpc_method.txt
@@ -0,0 +1,18 @@
+parse
+output 'rpc svc.Str access=public .* recv=\*Service'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/types/uuid"
+)
+
+//encore:service
+type Service struct {}
+
+type Params struct{}
+
+//encore:api public
+func (s *Service) Str(ctx context.Context, p *Params) error { return nil }
diff --git a/v2/app/testdata/rpc_non_raw_path.txt b/v2/app/testdata/rpc_non_raw_path.txt
new file mode 100644
index 0000000000..d8bf6d23cc
--- /dev/null
+++ b/v2/app/testdata/rpc_non_raw_path.txt
@@ -0,0 +1,9 @@
+parse
+
+-- svc/svc.go --
+package svc
+
+import "context"
+
+//encore:api public path=/foo/bar
+func API(ctx context.Context) error { return nil }
\ No newline at end of file
diff --git a/v2/app/testdata/rpc_outside_service.txt b/v2/app/testdata/rpc_outside_service.txt
new file mode 100644
index 0000000000..98e9a6cc99
--- /dev/null
+++ b/v2/app/testdata/rpc_outside_service.txt
@@ -0,0 +1,58 @@
+! parse
+err 'cannot reference API one.One outside of a service'
+
+-- one/one.go --
+package one
+
+import (
+    "context"
+)
+
+//encore:api public
+func One(ctx context.Context) error {
+    return nil
+}
+
+-- two/two.go --
+package two
+
+import (
+    "context"
+
+    "test/one"
+)
+
+func Foo(ctx context.Context) error {
+    return one.One(ctx)
+}
+
+-- want: errors --
+
+── Invalid API call ───────────────────────────────────────────────────────────────────────[E9999]──
+
+APIs can only be called from within a service, the current call site is outside any services within
+the application.
+
+    ╭─[ two/two.go:10:12 ]
+    │
+  8 │
+  9 │ func Foo(ctx context.Context) error {
+ 10 │     return one.One(ctx)
+    ⋮            ───┬───
+    ⋮               ╰─ called here
+ 11 │ }
+ 12 │
+────╯
+
+    ╭─[ one/one.go:8:6 ]
+    │
+  6 │
+  7 │ //encore:api public
+  8 │ func One(ctx context.Context) error {
+    ⋮      ─┬─
+    ⋮       ╰─ defined here
+  9 │     return nil
+ 10 │ }
+────╯
+
+For more information on how to use APIs see https://encore.dev/docs/primitives/apis
diff --git a/v2/app/testdata/rpc_path_params.txt b/v2/app/testdata/rpc_path_params.txt
new file mode 100644
index 0000000000..bbf0232d11
--- /dev/null
+++ b/v2/app/testdata/rpc_path_params.txt
@@ -0,0 +1,18 @@
+parse
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/types/uuid"
+)
+
+//encore:api public path=/str/:p
+func Str(ctx context.Context, p string) error { return nil }
+
+//encore:api public path=/int/:p
+func Int(ctx context.Context, p int) error { return nil }
+
+//encore:api public path=/uuid/:p
+func UUID(ctx context.Context, p uuid.UUID) error { return nil }
\ No newline at end of file
diff --git a/v2/app/testdata/rpc_raw_call.txt b/v2/app/testdata/rpc_raw_call.txt
new file mode 100644
index 0000000000..5882372e23
--- /dev/null
+++ b/v2/app/testdata/rpc_raw_call.txt
@@ -0,0 +1,51 @@
+! parse
+err 'calling raw API endpoint svc.API from another endpoint is not yet supported'
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "net/http"
+)
+
+//encore:api public raw
+func API(w http.ResponseWriter, req *http.Request) { }
+
+//encore:api public
+func NonRaw(ctx context.Context) error {
+    API(nil, nil)
+    return nil
+}
+
+-- want: errors --
+
+── Invalid API call ───────────────────────────────────────────────────────────────────────[E9999]──
+
+Raw APIs cannot be called from within an Encore application.
+
+    ╭─[ svc/svc.go:9:6 ]
+    │
+  7 │
+  8 │ //encore:api public raw
+  9 │ func API(w http.ResponseWriter, req *http.Request) { }
+    ⋮      ─┬─
+    ⋮       ╰─ defined here
+    ·
+    ·
+ 11 │ //encore:api public
+ 12 │ func NonRaw(ctx context.Context) error {
+ 13 │     API(nil, nil)
+    ⋮     ─┬─
+    ⋮      ╰─ used here
+ 14 │     return nil
+ 15 │ }
+────╯
+
+hint: valid signatures are:
+	- func(context.Context) error
+	- func(context.Context) (*ResponseData, error)
+	- func(context.Context, *RequestData) error
+	- func(context.Context, *RequestType) (*ResponseData, error)
+
+For more information on how to use APIs, see https://encore.dev/docs/primitives/apis
diff --git a/v2/app/testdata/rpc_raw_custom_path.txt b/v2/app/testdata/rpc_raw_custom_path.txt
new file mode 100644
index 0000000000..6da8042d6d
--- /dev/null
+++ b/v2/app/testdata/rpc_raw_custom_path.txt
@@ -0,0 +1,12 @@
+# Verify that one can use custom paths for raw endpoints
+
+parse
+output 'rpc svc.API access=public raw=true path=/foo'
+
+-- svc/svc.go --
+package svc
+
+import "net/http"
+
+//encore:api public raw path=/foo
+func API(w http.ResponseWriter, req *http.Request) { }
\ No newline at end of file
diff --git a/v2/app/testdata/rpc_raw_duplicate_path.txt b/v2/app/testdata/rpc_raw_duplicate_path.txt
new file mode 100644
index 0000000000..adafc4b0f6
--- /dev/null
+++ b/v2/app/testdata/rpc_raw_duplicate_path.txt
@@ -0,0 +1,45 @@
+# Verify that one can use custom paths for raw endpoints
+
+! parse
+err 'invalid API path: cannot combine path segment ''svc.Bar'' with path ''/:foo'''
+
+-- svc/svc.go --
+package svc
+
+import "net/http"
+
+//encore:api public raw path=/:foo
+func Foo(w http.ResponseWriter, req *http.Request) { }
+
+//encore:api public raw
+func Bar(w http.ResponseWriter, req *http.Request) { }
+
+-- want: errors --
+
+── Path Conflict ──────────────────────────────────────────────────────────────────────────[E9999]──
+
+The path segment `foo` conflicts with the path `/fakesvcfortest.TestFunc`.
+
+    ╭─[ fakesvcfortest/test.go:7:6 ]
+    │
+  5 │
+  6 │ //encore:api public
+  7 │ func TestFunc(ctx context.Context) error { return nil }
+    ⋮      ────────
+────╯
+
+   ╭─[ svc/svc.go:5:31 ]
+   │
+ 3 │ import "net/http"
+ 4 │
+ 5 │ //encore:api public raw path=/:foo
+   ⋮                               ────
+ 6 │ func Foo(w http.ResponseWriter, req *http.Request) { }
+ 7 │
+───╯
+
+Paths must be not be empty and always start with a '/'. You cannot define paths that conflict with
+each other, including static and parameterized paths. For example `/blog/:id` would conflict with
+`/:username`.
+
+For more information about configuring Paths, see https://encore.dev/docs/primitives/apis#rest-apis
diff --git a/v2/app/testdata/rpc_raw_internal.txt b/v2/app/testdata/rpc_raw_internal.txt
new file mode 100644
index 0000000000..7306e98524
--- /dev/null
+++ b/v2/app/testdata/rpc_raw_internal.txt
@@ -0,0 +1,37 @@
+# Verify that one cannot use internal and raw RPCs
+
+! parse
+err 'private APIs cannot be declared raw'
+
+-- svc/svc.go --
+package svc
+
+import "net/http"
+
+//encore:api raw
+func API(w http.ResponseWriter, req *http.Request) { }
+
+-- want: errors --
+
+── Invalid API Directive ──────────────────────────────────────────────────────────────────[E9999]──
+
+Private APIs cannot be declared as raw endpoints.
+
+   ╭─[ svc/svc.go:5:14 ]
+   │
+ 3 │ import "net/http"
+ 4 │
+ 5 │ //encore:api raw
+   ⋮              ─┬─
+   ⋮               ╰─ declared as raw here
+ 6 │ func API(w http.ResponseWriter, req *http.Request) { }
+ 7 │
+───╯
+
+hint: valid signatures are:
+	- func(context.Context) error
+	- func(context.Context) (*ResponseData, error)
+	- func(context.Context, *RequestData) error
+	- func(context.Context, *RequestType) (*ResponseData, error)
+
+For more information on how to use APIs, see https://encore.dev/docs/primitives/apis
diff --git a/parser/testdata/rpc_raw_public.txt b/v2/app/testdata/rpc_raw_public.txt
similarity index 80%
rename from parser/testdata/rpc_raw_public.txt
rename to v2/app/testdata/rpc_raw_public.txt
index cda169c6ae..66bf226bb4 100644
--- a/parser/testdata/rpc_raw_public.txt
+++ b/v2/app/testdata/rpc_raw_public.txt
@@ -1,7 +1,7 @@
 # Verify that one can use public and raw RPCs
 
 parse
-stdout 'rpc svc.API access=public raw=true'
+output 'rpc svc.API access=public raw=true'
 
 -- svc/svc.go --
 package svc
diff --git a/v2/app/testdata/rpc_receiver_invalid.txt b/v2/app/testdata/rpc_receiver_invalid.txt
new file mode 100644
index 0000000000..eadf9bc655
--- /dev/null
+++ b/v2/app/testdata/rpc_receiver_invalid.txt
@@ -0,0 +1,46 @@
+! parse
+err 'type SomeOtherType is not defined as an encore:service struct'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/types/uuid"
+)
+
+//encore:service
+type Service struct {}
+
+type Params struct{}
+
+type SomeOtherType struct {}
+
+//encore:api public
+func (s *SomeOtherType) Str(ctx context.Context, p *Params) error { return nil }
+
+-- want: errors --
+
+── Invalid service struct for API ─────────────────────────────────────────────────────────[E9999]──
+
+API endpoints defined as receiver functions must be defined on a service struct.
+
+    ╭─[ svc/svc.go:9:6 ]
+    │
+  7 │
+  8 │ //encore:service
+  9 │ type Service struct {}
+    ⋮      ───┬───
+    ⋮         ╰─ this is the service struct for this service
+    ·
+    ·
+ 14 │
+ 15 │ //encore:api public
+ 16 │ func (s *SomeOtherType) Str(ctx context.Context, p *Params) error { return nil }
+    ⋮      ────────┬─────────
+    ⋮              ╰─ try changing this to `*Service`
+ 17 │
+────╯
+
+For more information on service structs, see
+https://encore.dev/docs/primitives/services-and-apis/service-structs
diff --git a/v2/app/testdata/rpc_receiver_typo.txt b/v2/app/testdata/rpc_receiver_typo.txt
new file mode 100644
index 0000000000..73bc99ba1f
--- /dev/null
+++ b/v2/app/testdata/rpc_receiver_typo.txt
@@ -0,0 +1,35 @@
+! parse
+err 'undefined type: Serviice'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/types/uuid"
+)
+
+//encore:service
+type Service struct {}
+
+type Params struct{}
+
+//encore:api public
+func (s *Serviice) Str(ctx context.Context, p *Params) error { return nil }
+
+-- want: errors --
+
+── Unknown identifier ─────────────────────────────────────────────────────────────────────[E9999]──
+
+Unknown identifier `Serviice`
+
+    ╭─[ svc/svc.go:14:10 ]
+    │
+ 12 │
+ 13 │ //encore:api public
+ 14 │ func (s *Serviice) Str(ctx context.Context, p *Params) error { return nil }
+    ⋮          ────────
+ 15 │
+────╯
+
+For more information, see https://encore.dev/docs/develop/api-schemas
diff --git a/v2/app/testdata/rpc_without_calling.txt b/v2/app/testdata/rpc_without_calling.txt
new file mode 100644
index 0000000000..515d619ac4
--- /dev/null
+++ b/v2/app/testdata/rpc_without_calling.txt
@@ -0,0 +1,62 @@
+# Verify that not calling an endpoint is caught by the parser
+! parse
+err 'cannot reference API endpoint one.One without calling it'
+
+-- one/one.go --
+package one
+
+import (
+    "context"
+)
+
+//encore:api public
+func One(ctx context.Context) error {
+    return nil
+}
+
+-- two/two.go --
+package two
+
+import (
+    "context"
+
+    "test/one"
+)
+
+//encore:api public
+func Foo(ctx context.Context) error {
+    f := one.One
+    f()
+    return nil
+}
+
+-- want: errors --
+
+── Invalid API Usage ──────────────────────────────────────────────────────────────────────[E9999]──
+
+APIs can not be referenced without being called, unless they are used as a cron job endpoint, or a
+PubSub subscription handler.
+
+    ╭─[ two/two.go:11:10 ]
+    │
+  9 │ //encore:api public
+ 10 │ func Foo(ctx context.Context) error {
+ 11 │     f := one.One
+    ⋮          ───┬───
+    ⋮             ╰─ used here
+ 12 │     f()
+ 13 │     return nil
+────╯
+
+    ╭─[ one/one.go:8:6 ]
+    │
+  6 │
+  7 │ //encore:api public
+  8 │ func One(ctx context.Context) error {
+    ⋮      ─┬─
+    ⋮       ╰─ defined here
+  9 │     return nil
+ 10 │ }
+────╯
+
+For more information on how to use APIs see https://encore.dev/docs/primitives/apis
diff --git a/v2/app/testdata/secrets.txt b/v2/app/testdata/secrets.txt
new file mode 100644
index 0000000000..f147bb9b18
--- /dev/null
+++ b/v2/app/testdata/secrets.txt
@@ -0,0 +1,17 @@
+# Verify that secrets are parsed successfully
+
+parse
+
+-- svc/svc.go --
+package svc
+
+import "context"
+
+var secrets struct {
+    Foo string
+}
+
+//encore:api public
+func Foo(ctx context.Context) error {
+    return nil
+}
diff --git a/v2/app/testdata/secrets_non_string.txt b/v2/app/testdata/secrets_non_string.txt
new file mode 100644
index 0000000000..858ca0e764
--- /dev/null
+++ b/v2/app/testdata/secrets_non_string.txt
@@ -0,0 +1,30 @@
+# Verify that secret fields are of type string
+
+! parse
+err 'field Foo is not of type string'
+
+-- svc/svc.go --
+package svc
+
+var secrets struct {
+    Foo int
+}
+
+-- want: errors --
+
+── Invalid secrets struct ─────────────────────────────────────────────────────────────────[E9999]──
+
+Secrets must be of type string.
+
+   ╭─[ svc/svc.go:4:9 ]
+   │
+ 2 │
+ 3 │ var secrets struct {
+ 4 │     Foo int
+   ⋮         ─┬─
+   ⋮          ╰─ got int
+ 5 │ }
+ 6 │
+───╯
+
+For more information about how to use secrets, see https://encore.dev/docs/primitives/secrets
diff --git a/v2/app/testdata/servicestruct_creates_service.txt b/v2/app/testdata/servicestruct_creates_service.txt
new file mode 100644
index 0000000000..a9ffaab86a
--- /dev/null
+++ b/v2/app/testdata/servicestruct_creates_service.txt
@@ -0,0 +1,15 @@
+# Verify that a service struct forces the creation of a service
+# even if it has no API's defined.
+
+parse
+output 'svc foobar '
+
+-- foobar/svc.go --
+package foobar
+
+import (
+	"context"
+)
+
+//encore:service
+type Service struct {}
diff --git a/v2/app/testdata/servicestruct_duplicate.txt b/v2/app/testdata/servicestruct_duplicate.txt
new file mode 100644
index 0000000000..8b667d0357
--- /dev/null
+++ b/v2/app/testdata/servicestruct_duplicate.txt
@@ -0,0 +1,47 @@
+! parse
+err 'duplicate encore:service directive'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/types/uuid"
+)
+
+//encore:service
+type Service struct {}
+
+//encore:service
+type Duplicate struct {}
+
+type Params struct{}
+
+//encore:api public
+func (s *Service) Str(ctx context.Context, p *Params) error { return nil }
+
+-- want: errors --
+
+── Multiple service structs found ─────────────────────────────────────────────────────────[E9999]──
+
+Multiple service structs were found in the same service. Encore only allows one service struct to
+be defined per service.
+
+    ╭─[ svc/svc.go:9:6 ]
+    │
+  7 │
+  8 │ //encore:service
+  9 │ type Service struct {}
+    ⋮      ────────┬────────
+    ⋮              ╰─ first service struct defined here
+ 10 │
+ 11 │ //encore:service
+ 12 │ type Duplicate struct {}
+    ⋮      ─────────┬─────────
+    ⋮               ╰─ second service struct defined here
+ 13 │
+ 14 │ type Params struct{}
+────╯
+
+For more information on service structs, see
+https://encore.dev/docs/primitives/services-and-apis/service-structs
diff --git a/v2/app/testdata/servicestruct_ref.txt b/v2/app/testdata/servicestruct_ref.txt
new file mode 100644
index 0000000000..7f558beec3
--- /dev/null
+++ b/v2/app/testdata/servicestruct_ref.txt
@@ -0,0 +1,60 @@
+! parse
+err 'cannot reference encore:service struct type svc.Service from another service'
+
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+)
+
+//encore:service
+type Service struct {}
+
+//encore:api public
+func (*Service) Foo(ctx context.Context) error { return nil }
+
+-- svc2/svc2.go --
+package svc2
+
+import (
+	"context"
+
+	"test/svc"
+)
+
+//encore:api public
+func Bar(ctx context.Context) error { return nil }
+
+func Foo(s *svc.Service) {}
+
+-- want: errors --
+
+── Service struct referenced in another service ───────────────────────────────────────────[E9999]──
+
+Service structs cannot be referenced in other services. They can only be referenced in the service
+that defines them.
+
+    ╭─[ svc2/svc2.go:12:13 ]
+    │
+ 10 │ func Bar(ctx context.Context) error { return nil }
+ 11 │
+ 12 │ func Foo(s *svc.Service) {}
+    ⋮             ─────┬─────
+    ⋮                  ╰─ referenced in service "svc2"
+ 13 │
+────╯
+
+    ╭─[ svc/svc.go:8:6 ]
+    │
+  6 │
+  7 │ //encore:service
+  8 │ type Service struct {}
+    ⋮      ───┬───
+    ⋮         ╰─ defined in service "svc"
+  9 │
+ 10 │ //encore:api public
+────╯
+
+For more information on service structs, see
+https://encore.dev/docs/primitives/services-and-apis/service-structs
diff --git a/v2/app/testdata/sqldb_cross_service.txt b/v2/app/testdata/sqldb_cross_service.txt
new file mode 100644
index 0000000000..72ac058d46
--- /dev/null
+++ b/v2/app/testdata/sqldb_cross_service.txt
@@ -0,0 +1,33 @@
+parse
+output 'svc svcb dbs=svca'
+
+-- svca/migrations/1_foo.up.sql --
+-- svca/svca.go --
+package svca
+
+import (
+    "context"
+
+    "encore.dev/storage/sqldb"
+)
+
+var Moo = sqldb.Named("svca")
+
+//encore:api public
+func Foo(ctx context.Context) error {
+    return nil
+}
+-- svcb/svcb.go --
+package svcb
+
+import (
+    "context"
+
+    "test/svca"
+)
+
+//encore:api public
+func Bar(ctx context.Context) error {
+    _ = svca.Moo.Query()
+    return nil
+}
diff --git a/v2/app/testdata/sqldb_err_unknown_db.txt b/v2/app/testdata/sqldb_err_unknown_db.txt
new file mode 100644
index 0000000000..1496e8d901
--- /dev/null
+++ b/v2/app/testdata/sqldb_err_unknown_db.txt
@@ -0,0 +1,36 @@
+! parse
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/sqldb"
+)
+
+var Moo = sqldb.Named("unknown-db")
+
+//encore:api public
+func Foo(ctx context.Context) error {
+    return nil
+}
+-- want: errors --
+
+── Unknown sqldb database ─────────────────────────────────────────────────────────────────[E9999]──
+
+No database named "unknown-db" was found in the application. Ensure it is created somewhere using
+sqldb.NewDatabase to be able to reference it.
+
+    ╭─[ svc/svc.go:9:5 ]
+    │
+  7 │ )
+  8 │
+  9 │ var Moo = sqldb.Named("unknown-db")
+    ⋮     ───────────────────────────────
+ 10 │
+ 11 │ //encore:api public
+────╯
+
+For more information about how to use databases in Encore, see
+https://encore.dev/docs/primitives/databases
diff --git a/v2/app/testdata/sqldb_err_unknown_db_stdlib.txt b/v2/app/testdata/sqldb_err_unknown_db_stdlib.txt
new file mode 100644
index 0000000000..cac7caa763
--- /dev/null
+++ b/v2/app/testdata/sqldb_err_unknown_db_stdlib.txt
@@ -0,0 +1,26 @@
+! parse
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/sqldb"
+)
+
+var Moo = sqldb.Named("unknown-db").Stdlib()
+
+//encore:api public
+func Foo(ctx context.Context) error {
+    return nil
+}
+-- want: errors --
+
+── Unknown sqldb database ─────────────────────────────────────────────────────────────────[E9999]──
+
+No database named "unknown-db" was found in the application. Ensure it is created somewhere using
+sqldb.NewDatabase to be able to reference it.
+
+For more information about how to use databases in Encore, see
+https://encore.dev/docs/primitives/databases
diff --git a/v2/app/testdata/sqldb_helper.txt b/v2/app/testdata/sqldb_helper.txt
new file mode 100644
index 0000000000..ce70685eff
--- /dev/null
+++ b/v2/app/testdata/sqldb_helper.txt
@@ -0,0 +1,34 @@
+parse
+output 'svc svc dbs=svc'
+output 'resource SQLDBResource svc.Moo db=svc'
+
+-- svc/migrations/1_dummy.up.sql --
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "test/pkg"
+
+    "encore.dev/storage/sqldb"
+)
+
+var Moo = sqldb.Named("svc")
+
+//encore:api public
+func Foo(ctx context.Context) error {
+    pkg.Foo(Moo)
+    return nil
+}
+-- pkg/pkg.go --
+package pkg
+
+import (
+    "context"
+    
+    "encore.dev/storage/sqldb"
+)
+
+func Foo(db *sqldb.Database) {
+    _ = db.Query
+}
diff --git a/v2/app/testdata/sqldb_outside_ref.txt b/v2/app/testdata/sqldb_outside_ref.txt
new file mode 100644
index 0000000000..916c392c54
--- /dev/null
+++ b/v2/app/testdata/sqldb_outside_ref.txt
@@ -0,0 +1,48 @@
+! parse
+err 'cannot reference resource svc.Moo outside the service'
+
+-- svc/migrations/1_dummy.up.sql --
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/sqldb"
+)
+
+var Moo = sqldb.Named("svc")
+
+//encore:api public
+func Foo(ctx context.Context) error {
+    return nil
+}
+-- pkg/pkg.go --
+package pkg
+
+import (
+    "context"
+    "test/svc"
+)
+
+func Foo() {
+    _ = svc.Moo.Query
+}
+-- want: errors --
+
+── Invalid resource usage ─────────────────────────────────────────────────────────────────[E9999]──
+
+Infrastructure resources can only be referenced within services.
+
+    ╭─[ pkg/pkg.go:9:9 ]
+    │
+  7 │
+  8 │ func Foo() {
+  9 │     _ = svc.Moo.Query
+    ⋮         ──────┬──────
+    ⋮               ╰─ used here
+ 10 │ }
+────╯
+
+To use infrastructure resources outside services, instead pass a reference to the resource into the
+library.
diff --git a/v2/app/testdata/sqldb_outside_svc.txt b/v2/app/testdata/sqldb_outside_svc.txt
new file mode 100644
index 0000000000..b8a1ee49dd
--- /dev/null
+++ b/v2/app/testdata/sqldb_outside_svc.txt
@@ -0,0 +1,20 @@
+parse
+
+-- svc/migrations/1_dummy.up.sql --
+-- svc/svc.go --
+package svc
+
+import "context"
+
+//encore:api
+func Foo(ctx context.Context) error { return nil }
+-- pkg/pkg.go --
+package pkg
+
+import (
+    "context"
+
+    "encore.dev/storage/sqldb"
+)
+
+var Moo = sqldb.Named("svc")
diff --git a/v2/app/testdata/sqldb_outside_svc_test.txt b/v2/app/testdata/sqldb_outside_svc_test.txt
new file mode 100644
index 0000000000..6fa3c866a3
--- /dev/null
+++ b/v2/app/testdata/sqldb_outside_svc_test.txt
@@ -0,0 +1,20 @@
+ parse
+
+-- svc/migrations/1_dummy.up.sql --
+-- svc/svc.go --
+package svc
+
+import "context"
+
+//encore:api
+func Foo(ctx context.Context) error { return nil }
+-- pkg/pkg_test.go --
+package pkg
+
+import (
+    "context"
+
+    "encore.dev/storage/sqldb"
+)
+
+var Moo = sqldb.Named("svc")
diff --git a/v2/app/testdata/sqldb_success.txt b/v2/app/testdata/sqldb_success.txt
new file mode 100644
index 0000000000..d825346974
--- /dev/null
+++ b/v2/app/testdata/sqldb_success.txt
@@ -0,0 +1,31 @@
+parse
+output 'svc myservice dbs=myservice'
+output 'resource SQLDBResource myservice.Moo db=myservice'
+
+-- myservice/migrations/1_foo.up.sql --
+-- myservice/myservice.go --
+package myservice
+
+import (
+    "context"
+
+    "encore.dev/storage/sqldb"
+)
+
+var Moo = sqldb.Named("myservice")
+
+//encore:api public
+func Foo(ctx context.Context) error {
+    return nil
+}
+-- myservice/pkg/pkg.go --
+package pkg
+
+import (
+    "context"
+    "test/myservice"
+)
+
+func Foo() {
+    _ = myservice.Moo.Baz()
+}
diff --git a/v2/app/testdata/sqldb_without_call.txt b/v2/app/testdata/sqldb_without_call.txt
new file mode 100644
index 0000000000..16ac71ab51
--- /dev/null
+++ b/v2/app/testdata/sqldb_without_call.txt
@@ -0,0 +1,30 @@
+parse
+
+-- svc/migrations/1_dummy.up.sql --
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+
+    "encore.dev/storage/sqldb"
+)
+
+var Moo = sqldb.Named("svc")
+
+//encore:api public
+func Foo(ctx context.Context) error {
+    return nil
+}
+-- svc/pkg/pkg.go --
+package pkg
+
+import (
+    "context"
+    "test/svc"
+)
+
+func Foo() {
+    _ = svc.Moo
+    _ = svc.Moo.Query
+}
diff --git a/v2/app/testdata/struct_duplicate_json_ignore.txt b/v2/app/testdata/struct_duplicate_json_ignore.txt
new file mode 100644
index 0000000000..7ea6a48c4d
--- /dev/null
+++ b/v2/app/testdata/struct_duplicate_json_ignore.txt
@@ -0,0 +1,25 @@
+parse
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    
+    "encore.dev/beta/auth"
+)
+
+type SomeStruct struct {
+    A string `json:"-"`
+    B string `json:"-"`
+}
+
+//encore:api public
+func Foo(ctx context.Context, p *SomeStruct) error {
+    return nil
+}
+
+//encore:api public
+func Bar(ctx context.Context) (*SomeStruct, error) {
+    return nil, nil
+}
diff --git a/v2/app/testdata/svc_migration_db.txt b/v2/app/testdata/svc_migration_db.txt
new file mode 100644
index 0000000000..d4774f6bdd
--- /dev/null
+++ b/v2/app/testdata/svc_migration_db.txt
@@ -0,0 +1,36 @@
+parse
+output 'svc foo dbs=bar,foo,moo'
+
+-- foo/foo.go --
+package foo
+
+import (
+    "context"
+
+    "encore.dev/storage/sqldb"
+)
+
+var Moo = sqldb.Named("moo")
+var Bar = sqldb.Named("bar")
+
+//encore:api public
+func Foo(ctx context.Context) error {
+    sqldb.QueryRow(ctx, "")
+    Moo.Exec(ctx, "")
+    Bar.Stdlib()
+    return nil
+}
+-- foo/migrations/1_dummy.up.sql --
+-- moo/migrations/1_dummy.up.sql --
+-- bar/migrations/1_dummy.up.sql --
+-- moo/moo.go --
+package moo
+import "context"
+//encore:api public
+func Dummy(context.Context) error { return nil }
+
+-- bar/bar.go --
+package bar
+import "context"
+//encore:api public
+func Dummy(context.Context) error { return nil }
diff --git a/v2/app/testdata/type_ref_non_svc.txt b/v2/app/testdata/type_ref_non_svc.txt
new file mode 100644
index 0000000000..1432cd274b
--- /dev/null
+++ b/v2/app/testdata/type_ref_non_svc.txt
@@ -0,0 +1,28 @@
+parse
+
+-- svc/svc.go --
+package svc
+
+import (
+    "context"
+    "encore.dev/beta/auth"
+)
+
+type FooParams struct {
+    Name string
+}
+
+//encore:api public
+func Foo(ctx context.Context, p *FooParams) error { return nil }
+
+-- pkg/pkg.go --
+package pkg
+
+import (
+    "context"
+    "test/svc"
+)
+
+func Test() {
+    _ = &svc.FooParams{}
+}
\ No newline at end of file
diff --git a/v2/app/validate.go b/v2/app/validate.go
new file mode 100644
index 0000000000..95be143ee3
--- /dev/null
+++ b/v2/app/validate.go
@@ -0,0 +1,82 @@
+package app
+
+import (
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/apis/authhandler"
+	"encr.dev/v2/parser/apis/middleware"
+	"encr.dev/v2/parser/infra/caches"
+	"encr.dev/v2/parser/infra/objects"
+	"encr.dev/v2/parser/infra/pubsub"
+	"encr.dev/v2/parser/infra/secrets"
+	"encr.dev/v2/parser/infra/sqldb"
+)
+
+// validate checks that the application is in a valid state across all services and compilation units.
+func (d *Desc) validate(pc *parsectx.Context, result *parser.Result) {
+	defer pc.Trace("app.validate").Done()
+
+	// Validate the framework
+	if fw, ok := d.Framework.Get(); ok {
+		d.validateAuthHandlers(pc, fw)
+		d.validateAPIs(pc, fw, result)
+		d.validateMiddleware(pc, fw)
+		d.validateServiceStructs(pc, result)
+	}
+
+	// Validate infrastructure
+	d.validateCaches(pc, result)
+	d.validateConfigs(pc, result)
+	d.validateCrons(pc, result)
+	d.validateDatabases(pc, result)
+	d.validatePubSub(pc, result)
+	d.validateObjects(pc, result)
+
+	// Validate all resources are defined within a service
+	for _, b := range result.AllBinds() {
+		r := result.ResourceForBind(b)
+		switch r.(type) {
+		case *pubsub.Topic:
+			// We allow pubsub topics to be declared outside of service code
+			continue
+		case *objects.Bucket:
+			// We allow buckets to be declared outside of service code
+			continue
+		case *middleware.Middleware:
+			// Middleware is also allowed to be declared outside of service code if it's global (validateMiddleware checks this already)
+			continue
+		case *authhandler.AuthHandler:
+			// AuthHandlers are also allowed to be declared outside of service code as it's shared code between all services
+			continue
+		case *secrets.Secrets:
+			// Secrets are allowed anywhere
+			continue
+		case *sqldb.Database:
+			// Databases are allowed anywhere
+			continue
+		case *caches.Cluster:
+			// Cache clusters are allowed anywhere
+			continue
+
+		default:
+			_, ok := d.ServiceForPath(b.Package().FSPath)
+
+			// It's permitted to declare resources in test files
+			// or in the main pkg in the case of 'encore alpha exec'.
+			mainPkgPath := d.BuildInfo.MainPkg.GetOrElse("")
+			inTestFile, inMainPkg := false, false
+			if file, ok := b.DeclaredIn().Get(); ok {
+				if file.TestFile {
+					inTestFile = true
+				}
+				if mainPkgPath != "" && mainPkgPath.LexicallyContains(file.Pkg.ImportPath) {
+					inMainPkg = true
+				}
+			}
+
+			if !ok && !inTestFile && !inMainPkg {
+				pc.Errs.Add(errResourceDefinedOutsideOfService.AtGoNode(r))
+			}
+		}
+	}
+}
diff --git a/v2/app/validate_apis.go b/v2/app/validate_apis.go
new file mode 100644
index 0000000000..aa8bf38f01
--- /dev/null
+++ b/v2/app/validate_apis.go
@@ -0,0 +1,128 @@
+package app
+
+import (
+	"fmt"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/v2/app/apiframework"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/resourcepaths"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/authhandler"
+	"encr.dev/v2/parser/apis/servicestruct"
+	"encr.dev/v2/parser/infra/crons"
+	"encr.dev/v2/parser/infra/pubsub"
+	"encr.dev/v2/parser/resource"
+)
+
+func (d *Desc) validateAPIs(pc *parsectx.Context, fw *apiframework.AppDesc, result *parser.Result) {
+
+	apiPaths := resourcepaths.NewSet()
+
+	for _, svc := range d.Services {
+		fwSvc, ok := svc.Framework.Get()
+		if !ok {
+			continue
+		}
+
+		svcStruct, hasSvcStruct := fwSvc.ServiceStruct.Get()
+
+		for _, ep := range fwSvc.Endpoints {
+			// Check if an auth handler is defined for an endpoint that requires auth.
+			if ep.Access == api.Auth && fw.AuthHandler.Empty() {
+				pc.Errs.Add(
+					errors.AtOptionalNode(authhandler.ErrNoAuthHandlerDefined, ep.AccessField),
+				)
+			}
+
+			// Check for duplicate paths by adding them to the set
+			// Note, errors will be reported automatically to pc.Errs
+			for _, method := range ep.HTTPMethods {
+				apiPaths.Add(pc.Errs, method, ep.Path)
+			}
+
+			if receiver, ok := ep.Recv.Get(); ok {
+				if !hasSvcStruct {
+					pc.Errs.Add(
+						servicestruct.ErrReceiverNotAServiceStruct.
+							AtGoNode(receiver.AST, errors.AsError("there are no service structs defined in this service")),
+					)
+				} else if receiver.Decl != svcStruct.Decl {
+					pc.Errs.Add(
+						servicestruct.ErrReceiverNotAServiceStruct.
+							AtGoNode(receiver.AST, errors.AsError(
+								fmt.Sprintf("try changing this to `*%s`", svcStruct.Decl.Name),
+							)).
+							AtGoNode(svcStruct.Decl.AST.Name, errors.AsHelp(
+								"this is the service struct for this service",
+							)),
+					)
+				}
+			}
+
+			if ep.Raw {
+				for _, rawUsage := range result.Usages(ep) {
+					pc.Errs.Add(
+						api.ErrRawEndpointsCannotBeCalled.
+							AtGoNode(rawUsage, errors.AsError("used here")).
+							AtGoNode(ep.Decl.AST.Name, errors.AsHelp("defined here")),
+					)
+				}
+			} else {
+				// If typed endpoint, validate the types of the request and response
+				if ep.Request != nil {
+					// The request is always the first parameter after any path params (and after the ctx)
+					field, _ := schemautil.GetArgument(ep.Decl.AST.Type.Params, len(ep.Path.Params())+1)
+					d.validateType(pc, field.Type, ep.Request)
+				}
+
+				if ep.Response != nil {
+					// The response is always the first return value
+					d.validateType(pc, ep.Decl.AST.Type.Results.List[0].Type, ep.Response)
+				}
+			}
+
+			// Check for usages outside of services
+			for _, invalidUsage := range d.ResourceUsageOutsideServices[ep] {
+				pc.Errs.Add(
+					api.ErrAPICalledOutsideService.
+						AtGoNode(invalidUsage, errors.AsError("called here")).
+						AtGoNode(ep.Decl.AST.Name, errors.AsHelp("defined here")),
+				)
+			}
+
+			// Check for invalid references
+			for _, usage := range result.Usages(ep) {
+				switch usage := usage.(type) {
+				case *api.ReferenceUsage:
+					if usage.File.TestFile {
+						// Ignore test files as we allow the MockAPI function to reference the API
+						continue
+					}
+
+					// API's can only be referenced
+					isValid := result.ResourceConstructorContaining(usage).Contains(func(res resource.Resource) bool {
+						switch res := res.(type) {
+						case *pubsub.Subscription:
+							return res.Handler == usage.Ref
+						case *crons.Job:
+							return res.EndpointAST == usage.Ref
+						default:
+							return false
+						}
+					})
+
+					if !isValid {
+						pc.Errs.Add(
+							api.ErrInvalidEndpointUsage.
+								AtGoNode(usage, errors.AsError("used here")).
+								AtGoNode(ep.Decl.AST.Name, errors.AsHelp("defined here")),
+						)
+					}
+				}
+			}
+		}
+	}
+}
diff --git a/v2/app/validate_authhandlers.go b/v2/app/validate_authhandlers.go
new file mode 100644
index 0000000000..8b8ca58cb0
--- /dev/null
+++ b/v2/app/validate_authhandlers.go
@@ -0,0 +1,19 @@
+package app
+
+import (
+	"encr.dev/v2/app/apiframework"
+	"encr.dev/v2/internals/parsectx"
+)
+
+func (d *Desc) validateAuthHandlers(pc *parsectx.Context, fw *apiframework.AppDesc) {
+	handler, found := fw.AuthHandler.Get()
+	if !found {
+		return
+	}
+
+	// Validate the auth data can be marshalled
+	// (the same validation we run on request/response types)
+	if authData, found := handler.AuthData.Get(); found {
+		d.validateType(pc, handler.Decl.AST.Type.Results.List[1].Type, authData.ToType())
+	}
+}
diff --git a/v2/app/validate_caches.go b/v2/app/validate_caches.go
new file mode 100644
index 0000000000..b9cb6401fd
--- /dev/null
+++ b/v2/app/validate_caches.go
@@ -0,0 +1,82 @@
+package app
+
+import (
+	"fmt"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/resourcepaths"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/infra/caches"
+)
+
+func (d *Desc) validateCaches(pc *parsectx.Context, results *parser.Result) {
+	type cache struct {
+		resource *caches.Cluster
+		paths    *resourcepaths.Set
+	}
+	found := make(map[string]cache)
+	byBinding := make(map[pkginfo.QualifiedName]string)
+
+	// First find all clusters
+	var keyspaces []*caches.Keyspace
+	for _, res := range d.Parse.Resources() {
+		switch res := res.(type) {
+		case *caches.Cluster:
+			if existing, ok := found[res.Name]; ok {
+				pc.Errs.Add(
+					caches.ErrDuplicateCacheCluster.
+						AtGoNode(existing.resource.AST.Args[0]).
+						AtGoNode(res.AST.Args[0]),
+				)
+				continue
+			}
+
+			found[res.Name] = cache{
+				resource: res,
+				paths:    resourcepaths.NewSet(),
+			}
+
+			for _, bind := range d.Parse.PkgDeclBinds(res) {
+				byBinding[bind.QualifiedName()] = res.Name
+			}
+
+		case *caches.Keyspace:
+			keyspaces = append(keyspaces, res)
+		}
+	}
+
+	// Then verify all keyspaces
+	for _, ks := range keyspaces {
+		clusterName := byBinding[ks.Cluster]
+		cluster, ok := found[clusterName]
+		if !ok {
+			pc.Errs.Add(caches.ErrCouldNotResolveCacheCluster.AtGoNode(ks.AST.Args[0]))
+			continue
+		}
+
+		cluster.paths.Add(pc.Errs, "*", ks.Path)
+
+		svc, ok := d.ServiceForPath(ks.File.FSPath)
+		if !ok {
+			pc.Errs.Add(caches.ErrKeyspaceNotInService.AtGoNode(ks.AST.Fun))
+			continue
+		}
+
+		for _, use := range results.Usages(ks) {
+			errTxt := "used here"
+			useSvc, ok := d.ServiceForPath(use.DeclaredIn().FSPath)
+			if ok {
+				errTxt = fmt.Sprintf("used in %q", useSvc.Name)
+			}
+
+			if useSvc != svc {
+				pc.Errs.Add(caches.ErrKeyspaceUsedInOtherService.
+					AtGoNode(use, errors.AsError(errTxt)).
+					AtGoNode(ks, errors.AsHelp(fmt.Sprintf("declared in %q", svc.Name))),
+				)
+			}
+		}
+	}
+}
diff --git a/v2/app/validate_config.go b/v2/app/validate_config.go
new file mode 100644
index 0000000000..e1666fe2bc
--- /dev/null
+++ b/v2/app/validate_config.go
@@ -0,0 +1,41 @@
+package app
+
+import (
+	"encr.dev/pkg/errors"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/infra/config"
+)
+
+func (d *Desc) validateConfigs(pc *parsectx.Context, result *parser.Result) {
+	// validate all config loads
+	for _, res := range result.Resources() {
+		switch res := res.(type) {
+		case *config.Load:
+			d.validateConfig(pc, result, res)
+		}
+	}
+}
+
+func (d *Desc) validateConfig(pc *parsectx.Context, result *parser.Result, cfg *config.Load) {
+	// Verify the config
+	svc, ok := d.ServiceForPath(cfg.File.FSPath)
+	if !ok {
+		pc.Errs.Add(config.ErrConfigUsedOutsideOfService.AtGoNode(cfg))
+		return
+	}
+	if svc.FSRoot != cfg.File.Pkg.FSPath {
+		pc.Errs.Add(config.ErrConfigUsedInSubPackage.AtGoNode(cfg))
+	}
+
+	// Verify usages are in the same service
+	for _, use := range result.Usages(cfg) {
+		if !use.DeclaredIn().FSPath.HasPrefix(svc.FSRoot) {
+			pc.Errs.Add(
+				config.ErrCrossServiceConfigUse.
+					AtGoNode(use, errors.AsError("used here")).
+					AtGoNode(cfg, errors.AsHelp("defined here")),
+			)
+		}
+	}
+}
diff --git a/v2/app/validate_crons.go b/v2/app/validate_crons.go
new file mode 100644
index 0000000000..f0ebc40acc
--- /dev/null
+++ b/v2/app/validate_crons.go
@@ -0,0 +1,32 @@
+package app
+
+import (
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/infra/crons"
+	"encr.dev/v2/parser/resource"
+)
+
+func (d *Desc) validateCrons(pc *parsectx.Context, result *parser.Result) {
+	foundCronjobs := make(map[string]*crons.Job)
+
+	cronjobs := parser.Resources[*crons.Job](result)
+	for _, cronjob := range cronjobs {
+		if previous, ok := foundCronjobs[cronjob.Name]; ok {
+			pc.Errs.Add(
+				crons.ErrDuplicateNames.
+					AtGoNode(cronjob.AST.Args[0]).
+					AtGoNode(previous.AST.Args[0]),
+			)
+		}
+		foundCronjobs[cronjob.Name] = cronjob
+
+		res, ok := result.ResourceForQN(cronjob.Endpoint).Get()
+		if !ok || res.Kind() != resource.APIEndpoint {
+			pc.Errs.Add(
+				crons.ErrEndpointNotAnAPI.AtGoNode(cronjob.EndpointAST),
+			)
+			continue
+		}
+	}
+}
diff --git a/v2/app/validate_databases.go b/v2/app/validate_databases.go
new file mode 100644
index 0000000000..ebd3fbcd36
--- /dev/null
+++ b/v2/app/validate_databases.go
@@ -0,0 +1,35 @@
+package app
+
+import (
+	"encr.dev/pkg/errors"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/infra/sqldb"
+)
+
+func (d *Desc) validateDatabases(pc *parsectx.Context, result *parser.Result) {
+	foundDBs := make(map[string]*sqldb.Database)
+
+	dbs := parser.Resources[*sqldb.Database](result)
+	for _, db := range dbs {
+		if previous, ok := foundDBs[db.Name]; ok {
+			pc.Errs.Add(
+				sqldb.ErrDuplicateNames.
+					AtGoNode(db.AST.Args[0]).
+					AtGoNode(previous.AST.Args[0]),
+			)
+		}
+		foundDBs[db.Name] = db
+	}
+
+	// Check for usages outside of services
+	for _, db := range dbs {
+		for _, u := range d.ResourceUsageOutsideServices[db] {
+			if !u.DeclaredIn().TestFile {
+				pc.Errs.Add(
+					errResourceUsedOutsideService.AtGoNode(u, errors.AsError("used here")),
+				)
+			}
+		}
+	}
+}
diff --git a/v2/app/validate_middleware.go b/v2/app/validate_middleware.go
new file mode 100644
index 0000000000..d3ae2fa623
--- /dev/null
+++ b/v2/app/validate_middleware.go
@@ -0,0 +1,50 @@
+package app
+
+import (
+	"fmt"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/v2/app/apiframework"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/parser/apis/middleware"
+	"encr.dev/v2/parser/apis/selector"
+)
+
+func (d *Desc) validateMiddleware(pc *parsectx.Context, fw *apiframework.AppDesc) {
+	var allTags selector.Set
+
+	for _, svc := range d.Services {
+		var svcTags selector.Set
+
+		if fwSvc, ok := svc.Framework.Get(); ok {
+			// Collect all tags used in the service.
+			for _, ep := range fwSvc.Endpoints {
+				svcTags.Merge(ep.Tags)
+			}
+
+			// Check that service middleware targets are valid.
+			for _, m := range fwSvc.Middleware {
+				m.Target.ForEach(func(s selector.Selector) {
+					if s.Type == selector.Tag && !svcTags.Contains(s) {
+						pc.Errs.Add(middleware.ErrInvalidTargetForService(svc.Name).AtGoNode(s))
+					}
+				})
+			}
+		}
+
+		allTags.Merge(svcTags)
+	}
+
+	for _, m := range fw.GlobalMiddleware {
+		m.Target.ForEach(func(s selector.Selector) {
+			if s.Type == selector.Tag && !allTags.Contains(s) {
+				pc.Errs.Add(middleware.ErrInvalidTargetForApp.AtGoNode(s))
+			}
+		})
+
+		svc, ok := d.ServiceForPath(m.File.FSPath)
+		if ok {
+			pc.Errs.Add(middleware.ErrGlobalMiddlewareDefinedInService.AtGoNode(m.Decl.AST.Name, errors.AsError(fmt.Sprintf("defined in service %q", svc.Name))))
+		}
+	}
+}
diff --git a/v2/app/validate_objects.go b/v2/app/validate_objects.go
new file mode 100644
index 0000000000..db297a62f0
--- /dev/null
+++ b/v2/app/validate_objects.go
@@ -0,0 +1,56 @@
+package app
+
+import (
+	"encr.dev/pkg/errors"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/infra/objects"
+)
+
+func (d *Desc) validateObjects(pc *parsectx.Context, result *parser.Result) {
+	buckets := make(map[string]*objects.Bucket)
+
+	for _, res := range d.Parse.Resources() {
+		switch res := res.(type) {
+		case *objects.Bucket:
+			if existing, ok := buckets[res.Name]; ok {
+				pc.Errs.Add(objects.ErrBucketNameNotUnique.
+					AtGoNode(existing.AST.Args[0], errors.AsHelp("originally defined here")).
+					AtGoNode(res.AST.Args[0], errors.AsError("duplicated here")),
+				)
+			} else {
+				buckets[res.Name] = res
+			}
+
+			// Make sure any BucketRef calls are within a service.
+			for _, use := range d.Parse.Usages(res) {
+				switch use := use.(type) {
+				case *objects.RefUsage:
+					if use.HasPerm(objects.GetPublicURL) && !res.Public {
+						pc.Errs.Add(objects.ErrBucketNotPublic.
+							AtGoNode(use, errors.AsError("used here")))
+					}
+					errTxt := "used here"
+					if _, ok := d.ServiceForPath(use.DeclaredIn().FSPath); !ok && !use.DeclaredIn().TestFile {
+						pc.Errs.Add(objects.ErrBucketRefOutsideService.
+							AtGoNode(use, errors.AsError(errTxt)),
+						)
+					}
+
+				case *objects.MethodUsage:
+					if use.Perm == objects.GetPublicURL && !res.Public {
+						pc.Errs.Add(objects.ErrBucketNotPublic.
+							AtGoNode(use, errors.AsError("used here")))
+					}
+
+					errTxt := "used here"
+					if _, ok := d.ServiceForPath(use.DeclaredIn().FSPath); !ok && !use.DeclaredIn().TestFile {
+						pc.Errs.Add(objects.ErrUnsupportedOperationOutsideService(use.Method).
+							AtGoNode(use, errors.AsError(errTxt)),
+						)
+					}
+				}
+			}
+		}
+	}
+}
diff --git a/v2/app/validate_pubsub.go b/v2/app/validate_pubsub.go
new file mode 100644
index 0000000000..db05102db2
--- /dev/null
+++ b/v2/app/validate_pubsub.go
@@ -0,0 +1,164 @@
+package app
+
+import (
+	"go/ast"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/servicestruct"
+	"encr.dev/v2/parser/infra/pubsub"
+)
+
+func (d *Desc) validatePubSub(pc *parsectx.Context, result *parser.Result) {
+	type topic struct {
+		resource *pubsub.Topic
+		subs     map[string]*pubsub.Subscription
+	}
+	topics := make(map[string]topic)
+	topicsByBinding := make(map[pkginfo.QualifiedName]string)
+	serviceStructs := make(map[paths.Pkg]*servicestruct.ServiceStruct)
+
+	var subs []*pubsub.Subscription
+
+	for _, res := range d.Parse.Resources() {
+		switch res := res.(type) {
+		case *pubsub.Topic:
+			if existing, ok := topics[res.Name]; ok {
+				pc.Errs.Add(pubsub.ErrTopicNameNotUnique.
+					AtGoNode(existing.resource.AST.Args[0], errors.AsHelp("originally defined here")).
+					AtGoNode(res.AST.Args[0], errors.AsError("duplicated here")),
+				)
+			} else {
+				topics[res.Name] = topic{
+					resource: res,
+					subs:     make(map[string]*pubsub.Subscription),
+				}
+
+				for _, bind := range d.Parse.PkgDeclBinds(res) {
+					topicsByBinding[bind.QualifiedName()] = res.Name
+				}
+			}
+
+			// Make sure any TopicRef calls are within a service.
+			for _, use := range d.Parse.Usages(res) {
+				if _, ok := use.(*pubsub.RefUsage); ok {
+					errTxt := "used here"
+					if _, ok := d.ServiceForPath(use.DeclaredIn().FSPath); !ok && !use.DeclaredIn().TestFile {
+						pc.Errs.Add(pubsub.ErrTopicRefOutsideService.
+							AtGoNode(use, errors.AsError(errTxt)),
+						)
+					}
+				}
+			}
+
+		case *pubsub.Subscription:
+			subs = append(subs, res)
+
+		case *servicestruct.ServiceStruct:
+			serviceStructs[res.Decl.File.Pkg.ImportPath] = res
+		}
+	}
+
+	for _, sub := range subs {
+		topicName := topicsByBinding[sub.Topic]
+		topic, ok := topics[topicName]
+		if !ok {
+			pc.Errs.Add(pubsub.ErrSubscriptionTopicNotResource.AtGoNode(sub.AST.Args[0]))
+			continue
+		}
+
+		if existing, ok := topic.subs[sub.Name]; ok {
+			pc.Errs.Add(pubsub.ErrSubscriptionNameNotUnique.
+				AtGoNode(existing.AST.Args[1], errors.AsHelp("originally defined here")).
+				AtGoNode(sub.AST.Args[1], errors.AsError("duplicated here")),
+			)
+		} else {
+			topic.subs[sub.Name] = sub
+		}
+
+		subService, ok := d.ServiceForPath(sub.File.FSPath)
+		if !ok {
+			pc.Errs.Add(pubsub.ErrUnableToIdentifyServicesInvolved.AtGoNode(sub, errors.AsError("unable to identify service for subscription")))
+		}
+
+		// Verify the handler is ok
+		handlerIsAPIEndpoint := false
+		if handlerUsage, ok := result.UsageFromNode(sub.Handler).Get(); ok {
+			if endpointUsage, ok := handlerUsage.(*api.ReferenceUsage); ok {
+				ep := endpointUsage.Endpoint
+
+				endpointService, ok := d.ServiceForPath(ep.File.FSPath)
+				if !ok {
+					pc.Errs.Add(pubsub.ErrUnableToIdentifyServicesInvolved.AtGoNode(ep, errors.AsError("unable to identify service for endpoint")))
+				}
+
+				if endpointService != subService {
+					pc.Errs.Add(
+						pubsub.ErrSubscriptionHandlerNotDefinedInSameService.
+							AtGoNode(sub.Handler, errors.AsError("handler specified here")).
+							AtGoNode(ep.Decl.AST.Name, errors.AsHelp("endpoint defined here")),
+					)
+				}
+
+				handlerIsAPIEndpoint = true
+			}
+		}
+
+		// Do we have a method handler?
+		if method, ok := sub.MethodHandler.Get(); ok {
+			// Make sure the type is a service struct
+			if _, ok := serviceStructs[method.Decl.File.Pkg.ImportPath]; !ok {
+				pc.Errs.Add(
+					pubsub.ErrMethodHandlerTypeNotServiceStruct.
+						AtGoNode(sub.Handler, errors.AsError("handler specified here")),
+				)
+			} else if method.Decl.File.Pkg.ImportPath != sub.File.Pkg.ImportPath {
+				pc.Errs.Add(
+					pubsub.ErrMethodHandlerDifferentPackage.
+						AtGoNode(sub.Handler, errors.AsError("handler specified here")),
+				)
+			}
+		}
+
+		if !handlerIsAPIEndpoint {
+			qn, ok := sub.File.Names().ResolvePkgLevelRef(sub.Handler)
+			if ok {
+				if pkg, ok := result.PackageAt(qn.PkgPath).Get(); ok {
+					funcName := option.Map(pkg.Names().FuncDecl(qn.Name), func(f *ast.FuncDecl) *ast.Ident {
+						return f.Name
+					}).GetOrElse(nil)
+
+					if svc, ok := d.ServiceForPath(pkg.FSPath); ok {
+						if svc != subService {
+							pc.Errs.Add(
+								pubsub.ErrSubscriptionHandlerNotDefinedInSameService.
+									AtGoNode(sub.Handler, errors.AsError("handler specified here")).
+									AtGoNode(funcName, errors.AsHelp("handler function defined here")),
+							)
+						}
+					} else {
+						pc.Errs.Add(
+							pubsub.ErrSubscriptionHandlerNotDefinedInSameService.
+								AtGoNode(sub.Handler, errors.AsError("handler specified here")).
+								AtGoNode(funcName, errors.AsHelp("handler function defined here")),
+						)
+					}
+				} else {
+					pc.Errs.Add(
+						pubsub.ErrUnableToIdentifyServicesInvolved.
+							AtGoNode(sub.Handler, errors.AsError("unable to identify package for this reference")),
+					)
+				}
+			} else {
+				// this is ok, because it means we're not dealing with an ident or selector - thus
+				// it can't be a valid function reference and the normal Go compiler will pick this up
+			}
+
+		}
+	}
+}
diff --git a/v2/app/validate_servicestructs.go b/v2/app/validate_servicestructs.go
new file mode 100644
index 0000000000..29f5719343
--- /dev/null
+++ b/v2/app/validate_servicestructs.go
@@ -0,0 +1,34 @@
+package app
+
+import (
+	"fmt"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/apis/servicestruct"
+)
+
+func (d *Desc) validateServiceStructs(pc *parsectx.Context, result *parser.Result) {
+	for _, svc := range d.Services {
+		if fwSvc, ok := svc.Framework.Get(); ok {
+			if ss, ok := fwSvc.ServiceStruct.Get(); ok {
+				for _, use := range result.Usages(ss) {
+					refText := "referenced here"
+					useSvc, ok := d.ServiceForPath(use.DeclaredIn().FSPath)
+					if ok {
+						refText = fmt.Sprintf("referenced in service %q", useSvc.Name)
+					}
+
+					if !use.DeclaredIn().FSPath.HasPrefix(svc.FSRoot) && !use.DeclaredIn().TestFile {
+						pc.Errs.Add(
+							servicestruct.ErrServiceStructReferencedInAnotherService.
+								AtGoNode(use, errors.AsError(refText)).
+								AtGoNode(ss.Decl.AST.Name, errors.AsHelp(fmt.Sprintf("defined in service %q", svc.Name))),
+						)
+					}
+				}
+			}
+		}
+	}
+}
diff --git a/v2/app/validate_test.go b/v2/app/validate_test.go
new file mode 100644
index 0000000000..c26a4ae5b6
--- /dev/null
+++ b/v2/app/validate_test.go
@@ -0,0 +1,354 @@
+package app
+
+import (
+	"bytes"
+	"flag"
+	"fmt"
+	"os"
+	goregexp "regexp"
+	"sort"
+	"strings"
+	"testing"
+
+	"cuelang.org/go/pkg/regexp"
+	"github.com/pkg/diff"
+	"github.com/rogpeppe/go-internal/testscript"
+
+	"encr.dev/pkg/errinsrc/srcerrors"
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app/apiframework"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/apis/middleware"
+	"encr.dev/v2/parser/infra/config"
+	"encr.dev/v2/parser/infra/crons"
+	"encr.dev/v2/parser/infra/metrics"
+	"encr.dev/v2/parser/infra/pubsub"
+	"encr.dev/v2/parser/infra/sqldb"
+)
+
+var goldenUpdate = flag.Bool("golden-update", os.Getenv("GOLDEN_UPDATE") != "", "update golden files")
+
+func TestValidation(t *testing.T) {
+	type testCfg struct {
+		ignoreOutputCommand bool
+	}
+	t.Parallel()
+
+	update := false
+	if goldenUpdate != nil && *goldenUpdate {
+		update = true
+	}
+
+	sourceDir := "testdata"
+
+	testscript.Run(t, testscript.Params{
+		Dir:           sourceDir,
+		UpdateScripts: update,
+		Setup: func(env *testscript.Env) error {
+			if err := testutil.TestScriptSetupFunc(env); err != nil {
+				return err
+			}
+			env.Values["stderr"] = &bytes.Buffer{}
+			env.Values["stdout"] = &bytes.Buffer{}
+			env.Values["cfg"] = &testCfg{}
+			return nil
+		},
+		Cmds: map[string]func(ts *testscript.TestScript, neg bool, args []string){
+			// The "parse" command runs the parser on the given testscript
+			// and reports a failure if there are any errors.
+			//
+			// use like:
+			//  - `parse`
+			//  - `! parse` (if you want to check that there are errors)
+			"parse":  parse,
+			"parse2": parse,
+
+			// expectOut is a command that checks the stdout output contains the
+			// given regex.
+			//
+			// It unique to the v2 parser as that has different handling of types, as such
+			// if it is used in a testscript, we ignore any following calls to "output"
+			"expectOut": func(ts *testscript.TestScript, neg bool, args []string) {
+				ts.Value("cfg").(*testCfg).ignoreOutputCommand = true
+
+				stdout := ts.Value("stdout").(*bytes.Buffer)
+				m, err := regexp.Match(args[0], stdout.String())
+				if err != nil {
+					ts.Fatalf("invalid pattern: %v", err)
+				}
+				if !m && !neg {
+					ts.Fatalf("output does not match %q", args[0])
+				} else if m && neg {
+					ts.Fatalf("output unexpectedly matches %q", args[0])
+				}
+			},
+
+			// The "output" command checks that the output into stdout that we've collected
+			// contains the given regex
+			"output": func(ts *testscript.TestScript, neg bool, args []string) {
+				if ts.Value("cfg").(*testCfg).ignoreOutputCommand {
+					// "expectOut" was called, so we ignore this command
+					return
+				}
+
+				stdout := ts.Value("stdout").(*bytes.Buffer)
+				m, err := regexp.Match(args[0], stdout.String())
+				if err != nil {
+					ts.Fatalf("invalid pattern: %v", err)
+				}
+				if !m && !neg {
+					ts.Fatalf("output does not match %q", args[0])
+				} else if m && neg {
+					ts.Fatalf("output unexpectedly matches %q", args[0])
+				}
+			},
+
+			// The "Err" command is a no-op in the v2 parser, as we used expected errors
+			// inside the test files to assert the full error message
+			"err": func(ts *testscript.TestScript, neg bool, args []string) {},
+		},
+	})
+}
+
+func parse(ts *testscript.TestScript, neg bool, args []string) {
+	update := false
+	if goldenUpdate != nil && *goldenUpdate {
+		update = true
+	}
+	sourceDir := "testdata"
+
+	stdout := ts.Value("stdout").(*bytes.Buffer)
+	printf := func(format string, args ...interface{}) {
+		stdout.WriteString(fmt.Sprintf(format, args...) + "\n")
+	}
+	stderr := ts.Value("stderr").(*bytes.Buffer)
+	defer func() {
+		if err := recover(); err != nil {
+			if l, ok := perr.IsBailout(err); ok {
+				ts.Fatalf("bailout: %v", l.FormatErrors())
+			} else {
+				// We convert to an srcerrors error so that we can capture the stack
+				e := srcerrors.UnhandledPanic(err)
+				ts.Fatalf("panic: %v", e)
+			}
+		}
+
+		ts.Logf("stdout: %s", stdout.String())
+		ts.Logf("stderr: %s", stderr.String())
+	}()
+
+	// Setup the parse context
+	tc := testutil.NewContextForTestScript(ts, false)
+	tc.GoModTidy()
+	tc.GoModDownload()
+	p := parser.NewParser(tc.Context)
+
+	// Parse the testscript
+	parseResult := p.Parse()
+
+	// ValidateAndDescribe the testscript
+	desc := ValidateAndDescribe(tc.Context, parseResult)
+
+	// If we're expecting parse errors, assert that we have them
+	if neg {
+		assertGoldenErrors(ts, tc.Errs, sourceDir, update)
+	}
+
+	// If we have errors, and we didn't expect them, fail the test
+	// If we have no errors, and we expected them, fail the test
+	// Otherwise write any errors to stderr so they can be asserted on
+	if tc.Errs.Len() > 0 {
+		if !neg {
+			ts.Fatalf("unexpected errors: %s", tc.Errs.FormatErrors())
+		}
+
+		stderr.WriteString(tc.Errs.FormatErrors())
+	} else if tc.Errs.Len() == 0 && neg {
+		ts.Fatalf("expected errors, but none found")
+	}
+
+	// Now write to stdout the description of the parsed app
+	for _, svc := range desc.Services {
+		if svc.Name != "fakesvcfortest" {
+			var dbNames []string
+			for res := range svc.ResourceUsage {
+				if db, ok := res.(*sqldb.Database); ok {
+					dbNames = append(dbNames, db.Name)
+				}
+			}
+			sort.Strings(dbNames)
+			printf("svc %s dbs=%s", svc.Name, strings.Join(dbNames, ","))
+		}
+	}
+
+	for _, svc := range desc.Services {
+		if svc.Name == "fakesvcfortest" {
+			// this service only exists to suppress the "no services found error"
+			continue
+		}
+
+		svc.Framework.ForAll(func(fw *apiframework.ServiceDesc) {
+
+			for _, rpc := range fw.Endpoints {
+				if rpc == nil {
+					ts.Fatalf("rpc is nil")
+				}
+				recvName := option.Map(rpc.Recv, func(recv *schema.Receiver) string {
+					switch t := recv.Type.(type) {
+					case *schema.NamedType:
+						return "*" + t.Decl().Name
+					case schema.NamedType:
+						return "*" + t.Decl().Name
+					case *schema.PointerType:
+						return "*" + t.Elem.(*schema.NamedType).Decl().Name
+					case schema.PointerType:
+						return "*" + t.Elem.(schema.NamedType).Decl().Name
+					default:
+						panic(fmt.Sprintf("a reciver should only be a named type or pointer type: got %T", t))
+					}
+				}).GetOrElse("")
+
+				printf("rpc %s.%s access=%v raw=%v path=%v recv=%v",
+					svc.Name, rpc.Name, rpc.Access, rpc.Raw, rpc.Path, recvName,
+				)
+			}
+		})
+	}
+
+	// First find all the bindings for each topic
+	topicsByName := make(map[pkginfo.QualifiedName]*pubsub.Topic)
+	for _, res := range desc.Parse.Resources() {
+		switch res := res.(type) {
+		case *pubsub.Topic:
+			for _, b := range desc.Parse.PkgDeclBinds(res) {
+				topicsByName[b.QualifiedName()] = res
+			}
+		}
+	}
+
+	for _, res := range desc.Parse.Resources() {
+		switch res := res.(type) {
+		case *config.Load:
+			svc, found := desc.ServiceForPath(res.File.FSPath)
+			if !found {
+				ts.Fatalf("could not find service for path %s", res.File.FSPath)
+			}
+			printf("config %s %s", svc.Name, res.Type)
+		case *crons.Job:
+			printf("cronJob %s title=%q", res.Name, res.Title)
+		case *sqldb.Database:
+			for _, b := range desc.Parse.PkgDeclBinds(res) {
+				printf("resource SQLDBResource %s.%s db=%s",
+					b.File.Pkg.Name, b.BoundName.Name, res.Name)
+			}
+		case *pubsub.Topic:
+			printf("pubsubTopic %s", res.Name)
+
+			for _, u := range desc.Parse.Usages(res) {
+				if pub, ok := u.(*pubsub.PublishUsage); ok {
+					if svc, found := desc.ServiceForPath(pub.File.FSPath); found {
+						printf("pubsubPublisher %s %s\n", res.Name, svc.Name)
+					} else {
+						if res2, ok := parseResult.ResourceConstructorContaining(u).Get(); ok {
+							switch res2 := res2.(type) {
+							case *middleware.Middleware:
+								if res2.Global {
+									printf("pubsubPublisher middlware %s %s\n", res.Name, res2.Decl.Name)
+								}
+							}
+						}
+
+					}
+				}
+			}
+
+		case *pubsub.Subscription:
+			svc, found := desc.ServiceForPath(res.File.FSPath)
+			if !found {
+				ts.Fatalf("could not find service for path %s", res.File.FSPath)
+			}
+			printf("pubsubSubscriber %s %s %s %d %d %d %d %d",
+				topicsByName[res.Topic].Name, res.Name, svc.Name, res.Cfg.AckDeadline,
+				res.Cfg.MessageRetention, res.Cfg.MaxRetries, res.Cfg.MinRetryBackoff,
+				res.Cfg.MaxRetryBackoff)
+		case *metrics.Metric:
+			printf("metric %s %s %s %s", res.Name, strings.ToUpper(res.ValueType.String()), strings.ToUpper(res.Type.String()), res.Labels)
+		}
+	}
+}
+
+func assertGoldenErrors(ts *testscript.TestScript, errs *perr.List, sourceDir string, updateGoldenFiles bool) {
+	// Read the want: errors file
+	// allow for it not to exist
+	wantFile := ts.MkAbs("want: errors")
+	data, err := os.ReadFile(wantFile)
+	var wantErrors string
+	if err == nil {
+		wantErrors = string(data)
+	}
+
+	// Build up the "got errors string"
+	var b strings.Builder
+	errs.MakeRelative(ts.Getenv("WORK"), "")
+	for i := 0; i < errs.Len(); i++ {
+		err := *errs.At(i) // Copy the error so we can modify it
+
+		// Remove the stack for the error, as it will change whenever the parser
+		// changes, and that's not what we're testing for
+		err.Stack = nil
+
+		// Remove the code for the error, as it will change whenever the parser
+		// has new errors introduced
+		err.Params.Code = 9999
+
+		if i != 0 {
+			b.WriteString("\n\n")
+		}
+
+		b.WriteString(err.Error())
+	}
+	gotErrors := b.String()
+
+	// Remove all trailing whitespace for every line
+	gotErrors = goregexp.MustCompile(`(?m)[ \t]+$`).ReplaceAllString(gotErrors, "")
+
+	// Ensure there is a single trailing newline
+	gotErrors = strings.TrimSpace(gotErrors)
+	if gotErrors != "" {
+		gotErrors = "\n" + gotErrors + "\n"
+	}
+
+	// The two errors are the same, so we can return
+	if wantErrors == gotErrors {
+		return
+	}
+
+	// If we're updating the golden files, then write the new file
+	// and don't fail the test
+	if updateGoldenFiles {
+		testutil.UpdateArchiveFile(ts, sourceDir, "want: errors", gotErrors)
+		return
+	}
+
+	// pkg/diff is quadratic at the moment.
+	// If the product of the number of lines in the inputs is too large,
+	// don't call pkg.Diff at all as it might take tons of memory or time.
+	// We found one million to be reasonable for an average laptop.
+	const maxLineDiff = 1_000_000
+	if strings.Count(wantErrors, "\n")*strings.Count(gotErrors, "\n") > maxLineDiff {
+		ts.Fatalf("errors differ (two large to diff)")
+		return
+	}
+
+	var sb strings.Builder
+	if err := diff.Text("want: errors", "got: errors", wantErrors, gotErrors, &sb); err != nil {
+		ts.Check(err)
+	}
+
+	ts.Logf("%s", sb.String())
+	ts.Fatalf("wanted errors differ from the actual errors")
+}
diff --git a/v2/app/validate_types.go b/v2/app/validate_types.go
new file mode 100644
index 0000000000..65e97c04d6
--- /dev/null
+++ b/v2/app/validate_types.go
@@ -0,0 +1,53 @@
+package app
+
+import (
+	"go/ast"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/apis/api/apienc"
+)
+
+// validateType validates the type of a field can be marshalled.
+// according to Encore's requirements.
+//
+// This walks the type recursively and validates the whole thing
+func (d *Desc) validateType(pc *parsectx.Context, usedAt ast.Node, typ schema.Type) {
+	// Convert generic types to their concrete types
+	typ = schemautil.ConcretizeGenericType(pc.Errs, typ)
+
+	// Walk the type recursively
+	schemautil.Walk(typ, func(t schema.Type) bool {
+		switch t := t.(type) {
+		case schema.StructType:
+			for _, field := range t.Fields {
+				if field.IsAnonymous() {
+					// We don't support anonymous fields anywhere within
+					// Encore types that we need to marshal.
+					pc.Errs.Add(
+						apienc.ErrAnonymousFieldsNotSupported.
+							AtGoNode(field.AST, errors.AsError("defined here")).
+							AtGoNode(usedAt, errors.AsHelp("used here")),
+					)
+				}
+			}
+
+		case schema.FuncType:
+			pc.Errs.Add(
+				apienc.ErrFuncNotSupported.
+					AtGoNode(t.ASTExpr(), errors.AsError("defined here")).
+					AtGoNode(usedAt, errors.AsHelp("used here")),
+			)
+
+		case schema.InterfaceType:
+			pc.Errs.Add(
+				apienc.ErrInterfaceNotSupported.
+					AtGoNode(t.ASTExpr(), errors.AsError("defined here")).
+					AtGoNode(usedAt, errors.AsHelp("used here")),
+			)
+		}
+		return true
+	})
+}
diff --git a/v2/codegen/apigen/apigen.go b/v2/codegen/apigen/apigen.go
new file mode 100644
index 0000000000..44a41e2f3a
--- /dev/null
+++ b/v2/codegen/apigen/apigen.go
@@ -0,0 +1,99 @@
+package apigen
+
+import (
+	"maps"
+
+	"encore.dev/appruntime/exported/config"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/apigen/authhandlergen"
+	"encr.dev/v2/codegen/apigen/endpointgen"
+	"encr.dev/v2/codegen/apigen/maingen"
+	"encr.dev/v2/codegen/apigen/middlewaregen"
+	"encr.dev/v2/codegen/apigen/servicestructgen"
+	"encr.dev/v2/codegen/apigen/userfacinggen"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/authhandler"
+	"encr.dev/v2/parser/apis/middleware"
+)
+
+type Params struct {
+	Gen           *codegen.Generator
+	Desc          *app.Desc
+	MainModule    *pkginfo.Module
+	RuntimeModule *pkginfo.Module
+
+	CompilerVersion string
+	AppRevision     string
+	AppUncommitted  bool
+
+	Test option.Option[codegen.TestConfig]
+
+	ExecScriptMainPkg option.Option[paths.Pkg]
+}
+
+func Process(p Params) *config.Static {
+	gp := maingen.GenParams{
+		Gen:               p.Gen,
+		Desc:              p.Desc,
+		MainModule:        p.MainModule,
+		RuntimeModule:     p.RuntimeModule,
+		Test:              p.Test,
+		ExecScriptMainPkg: p.ExecScriptMainPkg,
+
+		CompilerVersion: p.CompilerVersion,
+		AppRevision:     p.AppRevision,
+		AppUncommitted:  p.AppUncommitted,
+
+		APIHandlers:    make(map[*api.Endpoint]*codegen.VarDecl),
+		Middleware:     make(map[*middleware.Middleware]*codegen.VarDecl),
+		ServiceStructs: make(map[*app.Service]*codegen.VarDecl),
+
+		// Set below
+		AuthHandler: option.None[*codegen.VarDecl](),
+	}
+
+	if fw, ok := p.Desc.Framework.Get(); ok {
+
+		svcStructBySvc := make(map[string]*codegen.VarDecl)
+
+		for _, svc := range p.Desc.Services {
+			var svcStruct option.Option[*codegen.VarDecl]
+
+			var svcMiddleware map[*middleware.Middleware]*codegen.VarDecl
+			if svcDesc, ok := svc.Framework.Get(); ok {
+				if ss, ok := svcDesc.ServiceStruct.Get(); ok {
+					decl := servicestructgen.Gen(p.Gen, svc, ss)
+					gp.ServiceStructs[svc] = decl
+					svcStruct = option.Some(decl)
+					svcStructBySvc[svc.Name] = decl
+				}
+
+				svcMiddleware = middlewaregen.Gen(p.Gen, svcDesc.Middleware, svcStruct)
+				maps.Copy(gp.Middleware, svcMiddleware)
+			}
+
+			eps := endpointgen.Gen(p.Gen, p.Desc, svc, svcStruct, svcMiddleware)
+			maps.Copy(gp.APIHandlers, eps)
+
+			// Generate user-facing code with the implementation in place.
+			userfacinggen.Gen(p.Gen, svc, svcStruct)
+		}
+
+		gp.AuthHandler = option.Map(fw.AuthHandler, func(ah *authhandler.AuthHandler) *codegen.VarDecl {
+			var svcStruct option.Option[*codegen.VarDecl]
+			if svc, ok := p.Desc.ServiceForPath(ah.Decl.File.FSPath); ok {
+				svcStruct = option.AsOptional(svcStructBySvc[svc.Name])
+			}
+			return authhandlergen.Gen(p.Gen, p.Desc, ah, svcStruct)
+		})
+
+		mws := middlewaregen.Gen(p.Gen, fw.GlobalMiddleware, option.None[*codegen.VarDecl]())
+		maps.Copy(gp.Middleware, mws)
+	}
+
+	return maingen.Gen(gp)
+}
diff --git a/v2/codegen/apigen/apigenutil/apigenutil.go b/v2/codegen/apigen/apigenutil/apigenutil.go
new file mode 100644
index 0000000000..95e5f790d1
--- /dev/null
+++ b/v2/codegen/apigen/apigenutil/apigenutil.go
@@ -0,0 +1,209 @@
+package apigenutil
+
+import (
+	"fmt"
+	"strings"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/v2/codegen/internal/genutil"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/apis/api/apienc"
+)
+
+// DecodeHeaders generates code for decoding HTTP headers from the http request
+// given by httpReqExpr and storing the result into the params given by paramsExpr.
+func DecodeHeaders(g *Group, httpHeaderExpr, paramExpr *Statement, dec *genutil.TypeUnmarshaller, params []*apienc.ParameterEncoding) {
+	if len(params) == 0 {
+		return
+	}
+
+	g.Comment("Decode headers")
+	g.Id("h").Op(":=").Add(httpHeaderExpr)
+	for _, f := range params {
+		singleValExpr := Id("h").Dot("Get").Call(Lit(f.WireName))
+		listValExpr := Id("h").Dot("Values").Call(Lit(f.WireName))
+		decodeExpr := dec.UnmarshalSingleOrList(f.Type, f.WireName, singleValExpr, listValExpr, false)
+		g.Add(paramExpr.Clone().Dot(f.SrcName).Op("=").Add(decodeExpr))
+	}
+	g.Line()
+}
+
+// DecodeQuery is like DecodeHeaders but for query strings.
+func DecodeQuery(g *Group, urlValuesExpr, paramExpr *Statement, dec *genutil.TypeUnmarshaller, params []*apienc.ParameterEncoding) {
+	if len(params) == 0 {
+		return
+	}
+	g.Comment("Decode query string")
+	g.Id("qs").Op(":=").Add(urlValuesExpr)
+
+	for _, f := range params {
+		singleValExpr := Id("qs").Dot("Get").Call(Lit(f.WireName))
+		listValExpr := Id("qs").Index(Lit(f.WireName))
+		decodeExpr := dec.UnmarshalSingleOrList(f.Type, f.WireName, singleValExpr, listValExpr, false)
+		g.Add(paramExpr.Clone()).Dot(f.SrcName).Op("=").Add(decodeExpr)
+	}
+	g.Line()
+}
+
+// DecodeCookie is like DecodeHeaders but for cookies.
+func DecodeCookie(errs *perr.List, g *Group, httpReqExpr, paramExpr *Statement, dec *genutil.TypeUnmarshaller, params []*apienc.ParameterEncoding) {
+	if len(params) == 0 {
+		return
+	}
+	g.Comment("Decode cookies")
+
+	cookieType := pkginfo.Q("net/http", "Cookie")
+
+	for _, f := range params {
+		g.If(List(Id("c"), Id("_")).Op(":=").Add(httpReqExpr.Clone()).Dot("Cookie").Call(Lit(f.WireName)).Op(";").Id("c").Op("!=").Nil()).BlockFunc(func(g *Group) {
+			// Cookies can either be a builtin or a *http.Cookie.
+			if builtin, ok := f.Type.(schema.BuiltinType); ok {
+				decodeExpr := dec.UnmarshalBuiltin(builtin.Kind, f.WireName, Id("c").Dot("Value"), false)
+				g.Add(paramExpr.Clone()).Dot(f.SrcName).Op("=").Add(decodeExpr)
+			} else if info, ok := schemautil.DerefNamedInfo(f.Type, true); ok && info.QualifiedName() == cookieType {
+				g.Add(paramExpr.Clone()).Dot(f.SrcName).Op("=").Id("c")
+				g.Add(dec.IncNonEmpty())
+			} else {
+				errs.Addf(f.Type.ASTExpr().Pos(), "cannot unmarshal cookie into field of type %s", f.Type)
+			}
+		})
+	}
+	g.Line()
+}
+
+const jsonIterPkg = "github.com/json-iterator/go"
+
+// DecodeBody decodes an io.Reader request body into the given parameters.
+func DecodeBody(g *Group, ioReaderExpr *Statement, paramsExpr *Statement, dec *genutil.TypeUnmarshaller, params []*apienc.ParameterEncoding) {
+	if len(params) == 0 {
+		return
+	}
+
+	g.Comment("Decode request body")
+	g.Id("payload").Op(":=").Add(dec.ReadBody(ioReaderExpr))
+	g.Id("iter").Op(":=").Qual(jsonIterPkg, "ParseBytes").Call(Id("json"), Id("payload"))
+	g.Line()
+
+	g.For(Id("iter").Dot("ReadObjectCB").Call(
+		Func().Params(Id("_").Op("*").Qual(jsonIterPkg, "Iterator"), Id("key").String()).Bool().Block(
+			Switch(Qual("strings", "ToLower").Call(Id("key"))).BlockFunc(func(g *Group) {
+				for _, f := range params {
+					g.Case(Lit(strings.ToLower(f.WireName))).Block(
+						dec.ParseJSON(f.SrcName, Id("iter"), Op("&").Add(paramsExpr.Clone()).Dot(f.SrcName)),
+					)
+				}
+				g.Default().Block(Id("_").Op("=").Id("iter").Dot("SkipAndReturnBytes").Call())
+			}),
+			Return(True()),
+		)).Block(),
+	)
+	g.Line()
+}
+
+// EncodeHeaders generates code for encoding HTTP headers into a http.Header map.
+func EncodeHeaders(errs *perr.List, g *Group, httpHeaderExpr, paramExpr *Statement, params []*apienc.ParameterEncoding) {
+	if len(params) == 0 {
+		return
+	}
+
+	g.Line()
+	g.Comment("Encode headers")
+	g.Add(httpHeaderExpr.Clone().Op("=").Make(Qual("net/http", "Header"), Lit(len(params))))
+
+	for _, f := range params {
+		kind, isList, ok := schemautil.IsBuiltinOrList(f.Type)
+		if !ok {
+			errs.Addf(f.Type.ASTExpr().Pos(), "cannot marshal %s to string", f.Type)
+			continue
+		}
+
+		if isList {
+			strVals := genutil.MarshalBuiltinList(kind, paramExpr.Clone().Dot(f.SrcName))
+			g.Add(httpHeaderExpr.Clone()).Index(
+				Qual("net/textproto", "CanonicalMIMEHeaderKey").Call(Lit(f.WireName)),
+			).Op("=").Add(strVals)
+		} else {
+			strVal := genutil.MarshalBuiltin(kind, paramExpr.Clone().Dot(f.SrcName))
+			g.Add(httpHeaderExpr.Clone().Dot("Set").Call(Lit(f.WireName), strVal))
+		}
+	}
+	g.Line()
+}
+
+// EncodeQuery generates code for encoding URL query values into a url.Values map.
+func EncodeQuery(errs *perr.List, g *Group, urlValuesExpr, paramExpr *Statement, params []*apienc.ParameterEncoding) {
+	if len(params) == 0 {
+		return
+	}
+
+	g.Line()
+	g.Comment("Encode query string")
+	g.Add(urlValuesExpr.Clone().Op("=").Make(Qual("net/url", "Values"), Lit(len(params))))
+
+	for _, f := range params {
+		kind, isList, ok := schemautil.IsBuiltinOrList(f.Type)
+		if !ok {
+			errs.Addf(f.Type.ASTExpr().Pos(), "cannot marshal %s to string", f.Type)
+			continue
+		}
+
+		if isList {
+			strVals := genutil.MarshalBuiltinList(kind, paramExpr.Clone().Dot(f.SrcName))
+			g.Add(urlValuesExpr.Clone()).Index(Lit(f.WireName)).Op("=").Add(strVals)
+		} else {
+			strVal := genutil.MarshalBuiltin(kind, paramExpr.Clone().Dot(f.SrcName))
+			g.Add(urlValuesExpr.Clone().Dot("Set").Call(Lit(f.WireName), strVal))
+		}
+	}
+	g.Line()
+}
+
+// EncodeBody encodes a request body into the given *jsoniter.Stream.
+func EncodeBody(gu *genutil.Helper, g *Group, streamExpr, paramExpr *Statement, params []*apienc.ParameterEncoding) {
+	if len(params) == 0 {
+		return
+	}
+
+	g.Line()
+	g.Comment("Encode request body")
+	g.Add(streamExpr.Clone().Dot("WriteObjectStart").Call())
+
+	for i, p := range params {
+		writeBlock := g
+
+		// If this field is omitted when empty, we need to wrap the write in an if statement.
+		if p.OmitEmpty {
+			g.If(gu.IsNotJSONEmpty(paramExpr.Clone().Dot(p.SrcName), p.Type)).BlockFunc(func(g *Group) {
+				g.Comment(fmt.Sprintf("%s is set to omitempty, so we need to check if it's empty before writing it", p.SrcName))
+				writeBlock = g
+			})
+		}
+
+		writeBlock.Add(streamExpr.Clone().Dot("WriteObjectField").Call(Lit(p.WireName)))
+		writeBlock.Add(streamExpr.Clone().Dot("WriteVal").Call(paramExpr.Clone().Dot(p.SrcName)))
+		if i+1 < len(params) {
+			// If we're not on the last field, write a comma.
+			// we do this within the writeBlock so that we don't write a comma if we're omitting the field.
+			writeBlock.Add(streamExpr.Clone().Dot("WriteMore").Call())
+		}
+	}
+	g.Add(streamExpr.Clone().Dot("WriteObjectEnd").Call())
+	g.Line()
+}
+
+// BuildErr returns an expression for returning an encore.dev/beta/errs.Error with the given code and message.
+func BuildErr(code, msg string) *Statement {
+	p := "encore.dev/beta/errs"
+	return Qual(p, "B").Call().Dot("Code").Call(Qual(p, code)).Dot("Msg").Call(Lit(msg)).Dot("Err").Call()
+}
+
+// BuildErrf is like BuildErr but with a format string.
+func BuildErrf(code, format string, args ...Code) *Statement {
+	p := "encore.dev/beta/errs"
+	args = append([]Code{Lit(format)}, args...)
+	return Qual(p, "B").Call().Dot("Code").Call(Qual(p, code)).Dot("Msgf").Call(args...).Dot("Err").Call()
+}
diff --git a/v2/codegen/apigen/authhandlergen/authhandlergen.go b/v2/codegen/apigen/authhandlergen/authhandlergen.go
new file mode 100644
index 0000000000..f85e493a06
--- /dev/null
+++ b/v2/codegen/apigen/authhandlergen/authhandlergen.go
@@ -0,0 +1,145 @@
+package authhandlergen
+
+import (
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/apigen/apigenutil"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/apis/api/apienc"
+	"encr.dev/v2/parser/apis/authhandler"
+)
+
+func Gen(gen *codegen.Generator, appDesc *app.Desc, ah *authhandler.AuthHandler, svcStruct option.Option[*codegen.VarDecl]) *codegen.VarDecl {
+	f := gen.File(ah.Decl.File.Pkg, "authhandler")
+	enc := apienc.DescribeAuth(gen.Errs, ah.Param)
+	gu := gen.Util
+	desc := f.VarDecl("AuthDesc", ah.Name)
+
+	svcName := "UNKNOWN"
+	svcNum := 0
+	if svc, ok := appDesc.ServiceForPath(ah.Decl.File.FSPath); ok {
+		svcName = svc.Name
+		svcNum = svc.Num
+	}
+
+	desc.Value(Op("&").Add(apiQ("AuthHandlerDesc")).Types(
+		gu.Type(ah.Param),
+	).Values(Dict{
+		Id("Service"): Lit(svcName),
+		Id("SvcNum"):  Lit(svcNum),
+		Id("DefLoc"):  Lit(gen.TraceNodes.AuthHandler()),
+
+		Id("Endpoint"):    Lit(ah.Name),
+		Id("HasAuthData"): Lit(ah.AuthData.Present()),
+		Id("DecodeAuth"):  renderDecodeAuth(gen, f, ah, enc),
+		Id("AuthHandler"): renderAuthHandler(gen, ah, svcStruct),
+	}))
+
+	f.Add(Func().Id("init").Params().Block(
+		Qual("encore.dev/appruntime/apisdk/api", "RegisterAuthHandler").Call(
+			desc.Qual(),
+		),
+	))
+
+	if authData, ok := ah.AuthData.Get(); ok {
+		snippet := Qual("encore.dev/appruntime/apisdk/api", "RegisterAuthDataType").
+			Types(gu.Type(authData.ToType())).Call()
+
+		if dstPkg := authData.Decl.File.Pkg; dstPkg.ImportPath == ah.Decl.File.Pkg.ImportPath {
+			// It's in the same package as the auth handler; add it to the file we're already generating.
+			f.Add(Func().Id("init").Params().Block(snippet))
+		} else {
+			// It's a different package; inject a new file.
+			gen.File(dstPkg, "authdata").Add(Func().Id("init").Params().Block(snippet))
+		}
+	}
+
+	return desc
+}
+
+func apiQ(name string) *Statement {
+	return Qual("encore.dev/appruntime/apisdk/api", name)
+}
+
+func renderDecodeAuth(gen *codegen.Generator, f *codegen.File, ah *authhandler.AuthHandler, enc *apienc.AuthEncoding) *Statement {
+	gu := gen.Util
+	return Func().Params(
+		Id("httpReq").Op("*").Qual("net/http", "Request"),
+	).Params(Id("params").Add(gu.Type(ah.Param)), Err().Error()).BlockFunc(func(g *Group) {
+		// Initialize params if it's a pointer so we're always dealing with a valid value
+		if schemautil.IsPointer(ah.Param) {
+			g.Id("params").Op("=").Add(gu.Initialize(ah.Param))
+		}
+
+		isLegacyToken := enc.LegacyTokenFormat
+		if isLegacyToken {
+			g.If(
+				Id("auth").Op(":=").Id("httpReq").Dot("Header").Dot("Get").Call(Lit("Authorization")),
+				Id("auth").Op("!=").Lit(""),
+			).Block(
+				For(
+					List(Id("_"), Id("prefix")).Op(":=").Range().Index(Op("...")).String().Values(Lit("Bearer "), Lit("Token ")),
+				).Block(
+					If(Qual("strings", "HasPrefix").Call(Id("auth"), Id("prefix"))).Block(
+						If(
+							Id("params").Op("=").Id("auth").Index(Id("len").Call(Id("prefix")).Op(":")),
+							Id("params").Op("!=").Lit(""),
+						).Block(
+							Return(Id("params"), Nil()),
+						),
+					),
+				),
+			)
+			g.Return(gu.Zero(ah.Param), apigenutil.BuildErr("Unauthenticated", "invalid auth param"))
+			return
+		}
+
+		dec := gu.NewTypeUnmarshaller("dec")
+		g.Add(dec.Init())
+		apigenutil.DecodeHeaders(g, Id("httpReq").Dot("Header"), Id("params"), dec, enc.HeaderParameters)
+		apigenutil.DecodeQuery(g, Id("httpReq").Dot("URL").Dot("Query").Call(), Id("params"), dec, enc.QueryParameters)
+		apigenutil.DecodeCookie(gen.Errs, g, Id("httpReq"), Id("params"), dec, enc.CookieParameters)
+
+		g.If(dec.NumNonEmptyValues().Op("==").Lit(0)).Block(
+			Return(gu.Zero(ah.Param), apigenutil.BuildErr("Unauthenticated", "missing auth param")),
+		).Else().If(Err().Op(":=").Add(dec.Err()), Err().Op("!=").Nil()).Block(
+			Return(gu.Zero(ah.Param), apigenutil.BuildErrf("InvalidArgument", "invalid auth param: %v", Err())),
+		)
+		g.Return(Id("params"), Nil())
+	})
+}
+
+func renderAuthHandler(gen *codegen.Generator, ah *authhandler.AuthHandler, svcStruct option.Option[*codegen.VarDecl]) *Statement {
+	gu := gen.Util
+	return Func().Params(
+		Id("ctx").Qual("context", "Context"),
+		Id("params").Add(gu.Type(ah.Param)),
+	).Params(Id("info").Qual("encore.dev/appruntime/exported/model", "AuthInfo"), Err().Error()).BlockFunc(func(g *Group) {
+		// fnExpr is the expression for the function we want to call,
+		// either just MyRPCName or svc.MyRPCName if we have a service struct.
+		var fnExpr *Statement
+
+		if ss, ok := svcStruct.Get(); ok && ah.Recv.Present() {
+			g.List(Id("svc"), Id("initErr")).Op(":=").Add(ss.Qual()).Dot("Get").Call()
+			g.If(Id("initErr").Op("!=").Nil()).Block(
+				Return(Id("info"), Id("initErr")),
+			)
+			fnExpr = Id("svc").Dot(ah.Name)
+		} else {
+			fnExpr = Qual(ah.Decl.File.Pkg.ImportPath.String(), ah.Name)
+		}
+
+		threeParams := ah.AuthData.Present()
+		g.ListFunc(func(g *Group) {
+			g.Id("info").Dot("UID")
+			if threeParams {
+				g.Id("info").Dot("UserData")
+			}
+			g.Err()
+		}).Op("=").Add(fnExpr).Call(Id("ctx"), Id("params"))
+		g.Return(Id("info"), Err())
+	})
+}
diff --git a/v2/codegen/apigen/authhandlergen/authhandlergen_test.go b/v2/codegen/apigen/authhandlergen/authhandlergen_test.go
new file mode 100644
index 0000000000..63b3ef5875
--- /dev/null
+++ b/v2/codegen/apigen/authhandlergen/authhandlergen_test.go
@@ -0,0 +1,32 @@
+package authhandlergen
+
+import (
+	"testing"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/apigen/servicestructgen"
+	"encr.dev/v2/codegen/internal/codegentest"
+)
+
+func TestCodegen(t *testing.T) {
+	fn := func(gen *codegen.Generator, desc *app.Desc) {
+		ah := desc.Framework.MustGet().AuthHandler.MustGet()
+
+		var svcStruct option.Option[*codegen.VarDecl]
+		if len(desc.Services) > 0 {
+			svc := desc.Services[0]
+			if fw, ok := svc.Framework.Get(); ok {
+				if ss, ok := fw.ServiceStruct.Get(); ok {
+					decl := servicestructgen.Gen(gen, svc, ss)
+					svcStruct = option.Some(decl)
+
+				}
+			}
+		}
+		Gen(gen, desc, ah, svcStruct)
+	}
+
+	codegentest.Run(t, fn)
+}
diff --git a/v2/codegen/apigen/authhandlergen/testdata/authdata.txt b/v2/codegen/apigen/authhandlergen/testdata/authdata.txt
new file mode 100644
index 0000000000..e02b8f5ce5
--- /dev/null
+++ b/v2/codegen/apigen/authhandlergen/testdata/authdata.txt
@@ -0,0 +1,67 @@
+-- code.go --
+package code
+
+import ("context"; "encore.dev/beta/auth")
+
+type MyAuthParams struct {
+	ClientID string `header:"X-Client-ID"`
+	APIKey   string `query:"key"`
+}
+
+type MyAuthData struct {
+    Username string
+}
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, p *MyAuthParams) (auth.UID, *MyAuthData, error) {
+    return "", nil, nil
+}
+-- want:encore_internal__authhandler.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__model "encore.dev/appruntime/exported/model"
+	__etype "encore.dev/appruntime/shared/etype"
+	errs "encore.dev/beta/errs"
+	"net/http"
+)
+
+var EncoreInternal_authhandler_AuthDesc_AuthHandler = &__api.AuthHandlerDesc[*MyAuthParams]{
+	AuthHandler: func(ctx context.Context, params *MyAuthParams) (info __model.AuthInfo, err error) {
+		info.UID, info.UserData, err = AuthHandler(ctx, params)
+		return info, err
+	},
+	DecodeAuth: func(httpReq *http.Request) (params *MyAuthParams, err error) {
+		params = new(MyAuthParams)
+		dec := new(__etype.Unmarshaller)
+		// Decode headers
+		h := httpReq.Header
+		params.ClientID = __etype.UnmarshalOne(dec, __etype.UnmarshalString, "x-client-id", h.Get("x-client-id"), false)
+
+		// Decode query string
+		qs := httpReq.URL.Query()
+		params.APIKey = __etype.UnmarshalOne(dec, __etype.UnmarshalString, "key", qs.Get("key"), false)
+
+		if dec.NonEmptyValues == 0 {
+			return (*MyAuthParams)(nil), errs.B().Code(errs.Unauthenticated).Msg("missing auth param").Err()
+		} else if err := dec.Error; err != nil {
+			return (*MyAuthParams)(nil), errs.B().Code(errs.InvalidArgument).Msgf("invalid auth param: %v", err).Err()
+		}
+		return params, nil
+	},
+	DefLoc:      uint32(0x0),
+	Endpoint:    "AuthHandler",
+	HasAuthData: true,
+	Service:     "code",
+	SvcNum:      1,
+}
+
+func init() {
+	__api.RegisterAuthHandler(EncoreInternal_authhandler_AuthDesc_AuthHandler)
+}
+
+func init() {
+	__api.RegisterAuthDataType[*MyAuthData]()
+}
diff --git a/v2/codegen/apigen/authhandlergen/testdata/basic.txt b/v2/codegen/apigen/authhandlergen/testdata/basic.txt
new file mode 100644
index 0000000000..61998a7fea
--- /dev/null
+++ b/v2/codegen/apigen/authhandlergen/testdata/basic.txt
@@ -0,0 +1,48 @@
+-- basic.go --
+package basic
+
+import ("context"; "encore.dev/beta/auth")
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, token string) (auth.UID, error) {
+    return "", nil
+}
+-- want:encore_internal__authhandler.go --
+package basic
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__model "encore.dev/appruntime/exported/model"
+	errs "encore.dev/beta/errs"
+	"net/http"
+	"strings"
+)
+
+var EncoreInternal_authhandler_AuthDesc_AuthHandler = &__api.AuthHandlerDesc[string]{
+	AuthHandler: func(ctx context.Context, params string) (info __model.AuthInfo, err error) {
+		info.UID, err = AuthHandler(ctx, params)
+		return info, err
+	},
+	DecodeAuth: func(httpReq *http.Request) (params string, err error) {
+		if auth := httpReq.Header.Get("Authorization"); auth != "" {
+			for _, prefix := range [...]string{"Bearer ", "Token "} {
+				if strings.HasPrefix(auth, prefix) {
+					if params = auth[len(prefix):]; params != "" {
+						return params, nil
+					}
+				}
+			}
+		}
+		return "", errs.B().Code(errs.Unauthenticated).Msg("invalid auth param").Err()
+	},
+	DefLoc:      uint32(0x0),
+	Endpoint:    "AuthHandler",
+	HasAuthData: false,
+	Service:     "basic",
+	SvcNum:      1,
+}
+
+func init() {
+	__api.RegisterAuthHandler(EncoreInternal_authhandler_AuthDesc_AuthHandler)
+}
diff --git a/v2/codegen/apigen/authhandlergen/testdata/servicestruct.txt b/v2/codegen/apigen/authhandlergen/testdata/servicestruct.txt
new file mode 100644
index 0000000000..d5beb3293f
--- /dev/null
+++ b/v2/codegen/apigen/authhandlergen/testdata/servicestruct.txt
@@ -0,0 +1,70 @@
+-- code.go --
+package code
+
+import ("context"; "encore.dev/beta/auth")
+
+//encore:service
+type Service struct{}
+
+//encore:authhandler
+func (*Service) AuthHandler(ctx context.Context, token string) (auth.UID, error) {
+    return "", nil
+}
+-- want:encore_internal__authhandler.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__model "encore.dev/appruntime/exported/model"
+	errs "encore.dev/beta/errs"
+	"net/http"
+	"strings"
+)
+
+var EncoreInternal_authhandler_AuthDesc_AuthHandler = &__api.AuthHandlerDesc[string]{
+	AuthHandler: func(ctx context.Context, params string) (info __model.AuthInfo, err error) {
+		svc, initErr := EncoreInternal_svcstruct_Service.Get()
+		if initErr != nil {
+			return info, initErr
+		}
+		info.UID, err = svc.AuthHandler(ctx, params)
+		return info, err
+	},
+	DecodeAuth: func(httpReq *http.Request) (params string, err error) {
+		if auth := httpReq.Header.Get("Authorization"); auth != "" {
+			for _, prefix := range [...]string{"Bearer ", "Token "} {
+				if strings.HasPrefix(auth, prefix) {
+					if params = auth[len(prefix):]; params != "" {
+						return params, nil
+					}
+				}
+			}
+		}
+		return "", errs.B().Code(errs.Unauthenticated).Msg("invalid auth param").Err()
+	},
+	DefLoc:      uint32(0x0),
+	Endpoint:    "AuthHandler",
+	HasAuthData: false,
+	Service:     "code",
+	SvcNum:      1,
+}
+
+func init() {
+	__api.RegisterAuthHandler(EncoreInternal_authhandler_AuthDesc_AuthHandler)
+}
+-- want:encore_internal__svcstruct.go --
+package code
+
+import __service "encore.dev/appruntime/apisdk/service"
+
+func init() {
+	__service.Register(EncoreInternal_svcstruct_Service)
+}
+
+var EncoreInternal_svcstruct_Service = &__service.Decl[Service]{
+	Name:        "Service",
+	Service:     "code",
+	Setup:       nil,
+	SetupDefLoc: uint32(0x0),
+}
diff --git a/v2/codegen/apigen/authhandlergen/testdata/struct.txt b/v2/codegen/apigen/authhandlergen/testdata/struct.txt
new file mode 100644
index 0000000000..f6f2fec5cb
--- /dev/null
+++ b/v2/codegen/apigen/authhandlergen/testdata/struct.txt
@@ -0,0 +1,74 @@
+-- code.go --
+package code
+
+import ("context"; "net/http"; "encore.dev/beta/auth")
+
+type MyAuthParams struct {
+	ClientID string `header:"X-Client-ID"`
+	APIKey   string `query:"key"`
+	SessionToken string `cookie:"session_token"`
+	OtherCookie *http.Cookie `cookie:"other_cookie"`
+	IntCookie int `cookie:"int_cookie"`
+}
+
+//encore:authhandler
+func AuthHandler(ctx context.Context, p *MyAuthParams) (auth.UID, error) {
+    return "", nil
+}
+-- want:encore_internal__authhandler.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__model "encore.dev/appruntime/exported/model"
+	__etype "encore.dev/appruntime/shared/etype"
+	errs "encore.dev/beta/errs"
+	"net/http"
+)
+
+var EncoreInternal_authhandler_AuthDesc_AuthHandler = &__api.AuthHandlerDesc[*MyAuthParams]{
+	AuthHandler: func(ctx context.Context, params *MyAuthParams) (info __model.AuthInfo, err error) {
+		info.UID, err = AuthHandler(ctx, params)
+		return info, err
+	},
+	DecodeAuth: func(httpReq *http.Request) (params *MyAuthParams, err error) {
+		params = new(MyAuthParams)
+		dec := new(__etype.Unmarshaller)
+		// Decode headers
+		h := httpReq.Header
+		params.ClientID = __etype.UnmarshalOne(dec, __etype.UnmarshalString, "x-client-id", h.Get("x-client-id"), false)
+
+		// Decode query string
+		qs := httpReq.URL.Query()
+		params.APIKey = __etype.UnmarshalOne(dec, __etype.UnmarshalString, "key", qs.Get("key"), false)
+
+		// Decode cookies
+		if c, _ := httpReq.Cookie("session_token"); c != nil {
+			params.SessionToken = __etype.UnmarshalOne(dec, __etype.UnmarshalString, "session_token", c.Value, false)
+		}
+		if c, _ := httpReq.Cookie("other_cookie"); c != nil {
+			params.OtherCookie = c
+			dec.IncNonEmpty()
+		}
+		if c, _ := httpReq.Cookie("int_cookie"); c != nil {
+			params.IntCookie = __etype.UnmarshalOne(dec, __etype.UnmarshalInt, "int_cookie", c.Value, false)
+		}
+
+		if dec.NonEmptyValues == 0 {
+			return (*MyAuthParams)(nil), errs.B().Code(errs.Unauthenticated).Msg("missing auth param").Err()
+		} else if err := dec.Error; err != nil {
+			return (*MyAuthParams)(nil), errs.B().Code(errs.InvalidArgument).Msgf("invalid auth param: %v", err).Err()
+		}
+		return params, nil
+	},
+	DefLoc:      uint32(0x0),
+	Endpoint:    "AuthHandler",
+	HasAuthData: false,
+	Service:     "code",
+	SvcNum:      1,
+}
+
+func init() {
+	__api.RegisterAuthHandler(EncoreInternal_authhandler_AuthDesc_AuthHandler)
+}
diff --git a/v2/codegen/apigen/endpointgen/api_calls.go b/v2/codegen/apigen/endpointgen/api_calls.go
new file mode 100644
index 0000000000..96405a7326
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/api_calls.go
@@ -0,0 +1,98 @@
+package endpointgen
+
+import (
+	"go/ast"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/apis/api"
+)
+
+func rewriteAPICalls(gen *codegen.Generator, parse *parser.Result, svc *app.Service, ep *api.Endpoint, desc *handlerDesc) {
+	var fd *codegen.FuncDecl
+
+	for _, u := range parse.Usages(ep) {
+		if call, ok := u.(*api.CallUsage); ok {
+			// Generate the wrapper the first time it's needed.
+			if fd == nil {
+				fd = genCallWrapper(gen, svc, ep, desc)
+			}
+
+			rw := gen.Rewrite(call.File)
+			if sel, ok := call.Call.Fun.(*ast.SelectorExpr); ok {
+				rw.ReplaceNode(sel.Sel, []byte(fd.Name()))
+			} else {
+				rw.ReplaceNode(call.Call.Fun, []byte(fd.Name()))
+			}
+		}
+	}
+}
+
+func genCallWrapper(gen *codegen.Generator, svc *app.Service, ep *api.Endpoint, handler *handlerDesc) *codegen.FuncDecl {
+	gu := gen.Util
+	fw := svc.Framework.MustGet()
+	f := gen.File(fw.RootPkg, "apicalls")
+	fd := f.FuncDecl(ep.Name)
+
+	type param struct {
+		name string
+		typ  *Statement
+	}
+
+	var params []param
+	addParam := func(name string, typ *Statement) {
+		params = append(params, param{name, typ})
+		fd.Params(Id(name).Add(typ.Clone()))
+	}
+
+	// Generate parameters
+	fd.Params(Id("ctx").Qual("context", "Context"))
+	for idx, param := range ep.Path.Params() {
+		addParam(handler.req.pathParamFieldName(idx), gu.Builtin(param.Pos(), param.ValueType))
+	}
+	if ep.Request != nil {
+		addParam(handler.req.reqDataPayloadName(), gu.Type(ep.Request))
+	}
+
+	// Generate results
+	if ep.Response != nil {
+		fd.Results(gu.Type(ep.Response))
+	}
+	fd.Results(Error())
+
+	// Generate body
+	fd.BodyFunc(func(g *Group) {
+		g.ListFunc(func(g *Group) {
+			if ep.Response != nil {
+				g.Id("resp")
+			} else {
+				g.Id("_")
+			}
+			g.Err()
+		}).Op(":=").Id(handler.desc.Name()).Dot("Call").CallFunc(func(g *Group) {
+			g.Add(apiQ("NewCallContext")).Call(Id("ctx"))
+			g.Op("&").Id(handler.req.TypeName()).Values(DictFunc(func(d Dict) {
+				for _, p := range params {
+					d[Id(p.name)] = Id(p.name)
+				}
+			}))
+		})
+		g.If(Err().Op("!=").Nil()).BlockFunc(func(g *Group) {
+			if ep.Response != nil {
+				g.Return(gu.Zero(ep.Response), Err())
+			} else {
+				g.Return(Err())
+			}
+		})
+		if ep.Response != nil {
+			g.Return(Id("resp"), Nil())
+		} else {
+			g.Return(Nil())
+		}
+	})
+
+	return fd
+}
diff --git a/v2/codegen/apigen/endpointgen/endpointgen.go b/v2/codegen/apigen/endpointgen/endpointgen.go
new file mode 100644
index 0000000000..e743972247
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/endpointgen.go
@@ -0,0 +1,203 @@
+package endpointgen
+
+import (
+	"strconv"
+	"strings"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app"
+	"encr.dev/v2/app/apiframework"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/internals/resourcepaths"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/middleware"
+	"encr.dev/v2/parser/apis/selector"
+)
+
+func Gen(gen *codegen.Generator, appDesc *app.Desc, svc *app.Service, svcStruct option.Option[*codegen.VarDecl], svcMiddleware map[*middleware.Middleware]*codegen.VarDecl) map[*api.Endpoint]*codegen.VarDecl {
+	epMap := make(map[*api.Endpoint]*codegen.VarDecl)
+
+	if fw, ok := svc.Framework.Get(); ok {
+		f := gen.File(fw.RootPkg, "api")
+
+		var handlers []*handlerDesc
+		for _, ep := range fw.Endpoints {
+			handler := genAPIDesc(gen, f, appDesc, svc, svcStruct, fw, ep, svcMiddleware)
+			rewriteAPICalls(gen, appDesc.Parse, svc, ep, handler)
+			epMap[ep] = handler.desc
+			handlers = append(handlers, handler)
+		}
+
+		registerHandlers(appDesc, f, handlers)
+	}
+
+	return epMap
+}
+
+func genAPIDesc(
+	gen *codegen.Generator, f *codegen.File, appDesc *app.Desc, svc *app.Service, svcStruct option.Option[*codegen.VarDecl],
+	fw *apiframework.ServiceDesc, ep *api.Endpoint, svcMiddleware map[*middleware.Middleware]*codegen.VarDecl,
+) *handlerDesc {
+	gu := gen.Util
+	reqDesc := &requestDesc{gu: gen.Util, ep: ep}
+	respDesc := &responseDesc{gu: gen.Util, ep: ep}
+	handler := &handlerDesc{
+		gu:        gen.Util,
+		ep:        ep,
+		svcStruct: svcStruct,
+		req:       reqDesc,
+		resp:      respDesc,
+	}
+
+	f.Add(reqDesc.TypeDecl())
+	f.Add(respDesc.TypeDecl())
+
+	methods := ep.HTTPMethods
+	if len(methods) == 1 && methods[0] == "*" {
+		// All methods, from https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods
+		methods = []string{"GET", "HEAD", "POST", "PUT", "DELETE", "CONNECT", "OPTIONS", "TRACE", "PATCH"}
+	}
+
+	var access *Statement
+	switch ep.Access {
+	case api.Public:
+		access = apiQ("Public")
+	case api.Auth:
+		access = apiQ("RequiresAuth")
+	case api.Private:
+		access = apiQ("Private")
+	default:
+		gen.Errs.Addf(ep.Decl.AST.Pos(), "unhandled access type %v", ep.Access)
+	}
+
+	pos := ep.Decl.AST.Pos()
+	desc := f.VarDecl("APIDesc", ep.Name)
+	desc.Value(Op("&").Add(apiQ("Desc")).Types(
+		reqDesc.Type(),
+		respDesc.Type(),
+	).Values(Dict{
+		Id("Service"):        Lit(svc.Name),
+		Id("SvcNum"):         Lit(svc.Num),
+		Id("Endpoint"):       Lit(ep.Name),
+		Id("Methods"):        gu.GoToJen(pos, methods),
+		Id("Raw"):            Lit(ep.Raw),
+		Id("Fallback"):       Lit(ep.Path.HasFallback()),
+		Id("Path"):           Lit(ep.Path.String()),
+		Id("RawPath"):        Lit(rawPath(ep.Path)),
+		Id("DefLoc"):         Lit(gen.TraceNodes.Endpoint(ep)),
+		Id("PathParamNames"): pathParamNames(ep.Path),
+		Id("Tags"):           tagNames(ep.Tags),
+		Id("Access"):         access,
+
+		Id("DecodeReq"):      reqDesc.DecodeRequest(),
+		Id("CloneReq"):       reqDesc.Clone(),
+		Id("ReqPath"):        reqDesc.ReqPath(),
+		Id("ReqUserPayload"): reqDesc.UserPayload(),
+
+		Id("AppHandler"): handler.Typed(),
+		Id("RawHandler"): handler.Raw(),
+		Id("EncodeResp"): respDesc.EncodeResponse(),
+		Id("CloneResp"):  respDesc.Clone(),
+
+		Id("EncodeExternalReq"):  reqDesc.EncodeExternalReq(),
+		Id("DecodeExternalResp"): respDesc.DecodeExternalResp(),
+
+		Id("ServiceMiddleware"):   serviceMiddleware(ep, fw, svcMiddleware),
+		Id("GlobalMiddlewareIDs"): globalMiddleware(appDesc, ep),
+	}))
+
+	handler.desc = desc
+	return handler
+}
+
+func serviceMiddleware(ep *api.Endpoint, fw *apiframework.ServiceDesc, svcMiddleware map[*middleware.Middleware]*codegen.VarDecl) *Statement {
+	return Index().Op("*").Add(apiQ("Middleware")).ValuesFunc(func(g *Group) {
+		for _, mw := range fw.Middleware {
+			if mw.Target.ContainsAny(ep.Tags) {
+				g.Add(svcMiddleware[mw].Qual())
+			}
+		}
+	})
+}
+
+func globalMiddleware(appDesc *app.Desc, ep *api.Endpoint) *Statement {
+	return Index().String().ValuesFunc(func(g *Group) {
+		for _, mw := range appDesc.MatchingGlobalMiddleware(ep) {
+			g.Add(Lit(mw.ID()))
+		}
+	})
+}
+
+func registerHandlers(appDesc *app.Desc, file *codegen.File, handlers []*handlerDesc) {
+	f := file.Jen
+	f.Func().Id("init").Params().BlockFunc(func(g *Group) {
+		for _, h := range handlers {
+			g.Qual("encore.dev/appruntime/apisdk/api", "RegisterEndpoint").CallFunc(func(g *Group) {
+				g.Add(h.desc.Qual())
+
+				g.Add(Id(h.ep.Name))
+			})
+		}
+	})
+}
+
+func apiQ(name string) *Statement {
+	return Qual("encore.dev/appruntime/apisdk/api", name)
+}
+
+// rawPath creates a raw path representation, replacing path parameters
+// with their indices to ensure all httprouter paths use consistent path param names,
+// since otherwise httprouter reports path conflicts.
+func rawPath(path *resourcepaths.Path) string {
+	var b strings.Builder
+	nParam := 0
+	for _, s := range path.Segments {
+		b.WriteByte('/')
+
+		switch s.Type {
+		case resourcepaths.Literal:
+			b.WriteString(s.Value)
+			continue
+
+		case resourcepaths.Param:
+			b.WriteByte(':')
+		case resourcepaths.Wildcard:
+			b.WriteByte('*')
+		case resourcepaths.Fallback:
+			// Fallback paths map to a wildcard route in httprouter terms.
+			b.WriteByte('*')
+		}
+		b.WriteString(strconv.Itoa(nParam))
+		nParam++
+	}
+	return b.String()
+}
+
+// pathParamNames yields a []string literal containing the names
+// of the path parameters, in order.
+func pathParamNames(path *resourcepaths.Path) Code {
+	if path.NumParams() == 0 {
+		return Nil()
+	}
+	return Index().String().ValuesFunc(func(g *Group) {
+		for _, s := range path.Params() {
+			g.Lit(s.Value)
+		}
+	})
+}
+
+// tagNames yields a []string literal containing the tag names.
+func tagNames(tags selector.Set) Code {
+	if tags.Len() == 0 {
+		return Nil()
+	}
+	return Index().String().ValuesFunc(func(g *Group) {
+		tags.ForEach(func(sel selector.Selector) {
+			if sel.Type == selector.Tag {
+				g.Lit(sel.Value)
+			}
+		})
+	})
+}
diff --git a/v2/codegen/apigen/endpointgen/endpointgen_test.go b/v2/codegen/apigen/endpointgen/endpointgen_test.go
new file mode 100644
index 0000000000..4fd1fcfb49
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/endpointgen_test.go
@@ -0,0 +1,30 @@
+package endpointgen
+
+import (
+	"testing"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/apigen/servicestructgen"
+	"encr.dev/v2/codegen/apigen/userfacinggen"
+	"encr.dev/v2/codegen/internal/codegentest"
+)
+
+func TestCodegen(t *testing.T) {
+	fn := func(gen *codegen.Generator, desc *app.Desc) {
+		svc := desc.Services[0]
+		var svcStruct option.Option[*codegen.VarDecl]
+		if fw, ok := svc.Framework.Get(); ok {
+			if ss, ok := fw.ServiceStruct.Get(); ok {
+				decl := servicestructgen.Gen(gen, svc, ss)
+				svcStruct = option.Some(decl)
+
+			}
+
+			userfacinggen.Gen(gen, svc, svcStruct)
+		}
+		Gen(gen, desc, svc, svcStruct, nil)
+	}
+	codegentest.Run(t, fn)
+}
diff --git a/v2/codegen/apigen/endpointgen/handlers.go b/v2/codegen/apigen/endpointgen/handlers.go
new file mode 100644
index 0000000000..68ebda1c82
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/handlers.go
@@ -0,0 +1,97 @@
+package endpointgen
+
+import (
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/internal/genutil"
+	"encr.dev/v2/parser/apis/api"
+)
+
+type handlerDesc struct {
+	gu        *genutil.Helper
+	ep        *api.Endpoint
+	svcStruct option.Option[*codegen.VarDecl]
+
+	req  *requestDesc
+	resp *responseDesc
+	desc *codegen.VarDecl
+}
+
+func (h *handlerDesc) Typed() *Statement {
+	ep := h.ep
+	if ep.Raw {
+		return Nil()
+	}
+
+	return Func().Params(
+		Id("ctx").Qual("context", "Context"),
+		h.req.reqDataExpr().Add(h.req.Type()),
+	).Params(h.resp.Type(), Error()).BlockFunc(func(g *Group) {
+		// fnExpr is the expression for the function we want to call,
+		// either just MyRPCName or svc.MyRPCName if we have a service struct.
+		var fnExpr *Statement
+
+		// If we have a service struct, initialize it first.
+		if ss, ok := h.svcStruct.Get(); ok && ep.Recv.Present() {
+			g.List(Id("svc"), Id("initErr")).Op(":=").Add(ss.Qual()).Dot("Get").Call()
+			g.If(Id("initErr").Op("!=").Nil()).Block(
+				Return(h.resp.zero(), Id("initErr")),
+			)
+			fnExpr = Id("svc").Dot(ep.Name)
+		} else {
+			fnExpr = Id(ep.Name)
+		}
+
+		g.Do(func(s *Statement) {
+			if ep.Response != nil {
+				s.List(Id("resp"), Err())
+			} else {
+				s.Err()
+			}
+		}).Op(":=").Add(fnExpr).CallFunc(func(g *Group) {
+			g.Id("ctx")
+			for _, arg := range h.req.HandlerArgs() {
+				g.Add(arg)
+			}
+		})
+		g.If(Err().Op("!=").Nil()).Block(Return(h.resp.zero(), Err()))
+
+		if ep.Response != nil {
+			g.Return(Id("resp"), Nil())
+		} else {
+			g.Return(h.resp.zero(), Nil())
+		}
+	})
+}
+
+func (h *handlerDesc) Raw() *Statement {
+	ep := h.ep
+	if !ep.Raw {
+		return Nil()
+	}
+
+	return Func().Params(
+		Id("w").Qual("net/http", "ResponseWriter"),
+		Id("req").Op("*").Qual("net/http", "Request"),
+	).BlockFunc(func(g *Group) {
+		// fnExpr is the expression for the function we want to call,
+		// either just MyRPCName or svc.MyRPCName if we have a service struct.
+		var fnExpr *Statement
+
+		// If we have a service struct, initialize it first.
+		if ss, ok := h.svcStruct.Get(); ok && ep.Recv.Present() {
+			g.List(Id("svc"), Id("initErr")).Op(":=").Add(ss.Qual()).Dot("Get").Call()
+			g.If(Id("initErr").Op("!=").Nil()).Block(
+				Qual("encore.dev/beta/errs", "HTTPErrorWithCode").Call(Id("w"), Id("initErr"), Lit(0)),
+				Return(),
+			)
+			fnExpr = Id("svc").Dot(ep.Name)
+		} else {
+			fnExpr = Id(ep.Name)
+		}
+
+		g.Add(fnExpr).Call(Id("w"), Id("req"))
+	})
+}
diff --git a/v2/codegen/apigen/endpointgen/request.go b/v2/codegen/apigen/endpointgen/request.go
new file mode 100644
index 0000000000..5c14466866
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/request.go
@@ -0,0 +1,369 @@
+package endpointgen
+
+import (
+	"fmt"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/v2/codegen/apigen/apigenutil"
+	"encr.dev/v2/codegen/internal/genutil"
+	"encr.dev/v2/internals/resourcepaths"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/api/apienc"
+)
+
+const jsonIterPkg = "github.com/json-iterator/go"
+
+// requestDesc describes the generated request type that contains the combined
+// request data + path parameters for the request.
+type requestDesc struct {
+	gu *genutil.Helper
+	ep *api.Endpoint
+}
+
+func (d *requestDesc) TypeName() string {
+	return "EncoreInternal_" + d.ep.Name + "Req"
+}
+
+func (d *requestDesc) Type() *Statement {
+	return Op("*").Id(d.TypeName())
+}
+
+func (d *requestDesc) TypeDecl() *Statement {
+	return Type().Id(d.TypeName()).StructFunc(func(g *Group) {
+		if d.ep.Request != nil {
+			g.Id(d.reqDataPayloadName()).Add(d.gu.Type(d.ep.Request))
+		}
+		// Note: the path parameter order is important and must match the order of the segments as defined
+		// as the parameters of the user's endpoint function. This behaviour is expected by the mocking
+		// system - see runtimes/go/appruntime/apisdk/api/reflection.go.
+		for i, seg := range d.ep.Path.Params() {
+			g.Id(d.pathParamFieldName(i)).Add(d.gu.Builtin(d.ep.Decl.AST.Pos(), seg.ValueType))
+		}
+	})
+}
+
+func (d *requestDesc) DecodeRequest() *Statement {
+	return Func().Params(
+		d.httpReqExpr().Op("*").Qual("net/http", "Request"),
+		d.pathParamsName().Add(apiQ("UnnamedParams")),
+		Id("json").Qual(jsonIterPkg, "API"),
+	).Params(
+		d.reqDataExpr().Add(d.Type()),
+		Id("pathParams").Add(apiQ("UnnamedParams")),
+		Err().Error(),
+	).BlockFunc(func(g *Group) {
+		g.Add(d.reqDataExpr()).Op("=").New(Id(d.TypeName()))
+
+		if d.ep.Path.NumParams() == 0 && d.ep.Request == nil {
+			// Nothing to do; return an empty struct
+			g.Return(d.reqDataExpr(), Nil(), Nil())
+			return
+		}
+
+		dec := d.gu.NewTypeUnmarshaller("dec")
+		g.Add(dec.Init())
+		d.renderPathDecoding(g, dec)
+		d.renderRequestDecoding(g, dec)
+
+		g.If(Err().Op(":=").Add(dec.Err()), Err().Op("!=").Nil()).Block(
+			Return(Nil(), Nil(), Err()),
+		)
+
+		g.Return(d.reqDataExpr(), d.pathParamsName(), Nil())
+	})
+}
+
+// HandlerArgs returns the list of arguments to pass to the handler.
+func (d *requestDesc) HandlerArgs() []Code {
+	numPathParams := d.ep.Path.NumParams()
+	args := make([]Code, 0, 1+numPathParams)
+	for i := 0; i < numPathParams; i++ {
+		args = append(args, d.reqDataPathParamExpr(i))
+	}
+	if d.ep.Request != nil {
+		args = append(args, d.reqDataPayloadExpr())
+	}
+	return args
+}
+
+// renderPathDecoding renders the code to decode the path parameters.
+// The path parameters are accessible via the `pathParamsExpr` parameter.
+//
+// The generated code writes to the path segment fields in the request struct,
+// which is accessed via the `reqDescExpr` parameter.
+func (d *requestDesc) renderPathDecoding(g *Group, dec *genutil.TypeUnmarshaller) {
+	// Collect all the non-literal path segments, and keep track of the wildcard segment, if any.
+	segs := make([]resourcepaths.Segment, 0, len(d.ep.Path.Segments))
+	seenWildcard := false
+	wildcardIdx := 0
+	for _, s := range d.ep.Path.Segments {
+		if s.Type != resourcepaths.Literal {
+			segs = append(segs, s)
+		}
+		if !seenWildcard {
+			// Fallback is also considered a wildcard for these purposes.
+			if s.Type == resourcepaths.Wildcard || s.Type == resourcepaths.Fallback {
+				seenWildcard = true
+			} else if s.Type == resourcepaths.Param {
+				wildcardIdx++
+			}
+		}
+	}
+
+	if seenWildcard {
+		g.Comment("Trim the leading slash from wildcard parameter, as Encore's semantics excludes it,")
+		g.Comment("while the httprouter implementation includes it.")
+		g.Add(d.pathSegmentValue(wildcardIdx)).Op("=").Qual("strings", "TrimPrefix").Call(
+			d.pathSegmentValue(wildcardIdx), Lit("/"))
+		g.Line()
+	}
+
+	// Decode the path params
+	for segIdx, seg := range segs {
+		pathSegmentValue := d.pathSegmentValue(segIdx)
+
+		// If the segment type is a string, then we want to unescape it.
+		switch seg.ValueType {
+		case schema.String, schema.UUID:
+			g.If(
+				List(Id("value"), Err()).Op(":=").Qual("net/url", "PathUnescape").Call(pathSegmentValue),
+				Err().Op("==").Nil().Block(
+					d.pathSegmentValue(segIdx).Op("=").Id("value"),
+				),
+			)
+		}
+
+		g.Do(func(s *Statement) {
+			// If it's a raw endpoint the params are not used, but validate them regardless.
+			if d.ep.Raw {
+				s.Id("_").Op("=")
+			} else {
+				s.Add(d.reqDataPathParamExpr(segIdx).Op("="))
+			}
+		}).Add(dec.UnmarshalBuiltin(seg.ValueType, seg.Value, pathSegmentValue, true))
+	}
+}
+
+// httpReqExpr returns an expression to access the HTTP request variable
+func (d *requestDesc) httpReqExpr() *Statement {
+	return Id("httpReq")
+}
+
+// reqDataExpr returns the expression to access the reqData variable.
+func (d *requestDesc) reqDataExpr() *Statement {
+	return Id("reqData")
+}
+
+// reqDataPayloadName returns the name of the payload field in the reqData struct.
+func (d *requestDesc) reqDataPayloadName() string {
+	// Note: this hardcoded value is used by reflection during mocking.
+	// If you change this, update runtimes/go/appruntime/apisdk/api/reflection.go as well.
+	return "Payload"
+}
+
+// httpHeaderExpr returns an expression to access the HTTP header variable,
+// for request encoding.
+func (d *requestDesc) httpHeaderExpr() *Statement {
+	return Id("httpHeader")
+}
+
+// queryStringExpr returns an expression to access the url.Values query string variable,
+// for request encoding.
+func (d *requestDesc) queryStringExpr() *Statement {
+	return Id("queryString")
+}
+
+// jsonStream returns an expression to access the *jsoniter.Stream variable,
+// for request encoding.
+func (d *requestDesc) jsonStream() *Statement {
+	return Id("stream")
+}
+
+// reqDataPayloadExpr returns an expression for accessing the payload
+// in the reqData variable.
+func (d *requestDesc) reqDataPayloadExpr() *Statement {
+	return d.reqDataExpr().Dot(d.reqDataPayloadName())
+}
+
+// reqDataPathParamExpr returns an expression for accessing the i'th path parameter
+// in the reqData variable.
+func (d *requestDesc) reqDataPathParamExpr(i int) *Statement {
+	return d.reqDataExpr().Dot(d.pathParamFieldName(i))
+}
+
+// reqDataPathParamName returns the field name for the i'th path parameter
+// in the reqData struct.
+func (d *requestDesc) pathParamFieldName(i int) string {
+	return fmt.Sprintf("P%d", i)
+}
+
+// pathParamsName renders an expression for the name of the path parameters.
+func (d *requestDesc) pathParamsName() *Statement {
+	return Id("ps")
+}
+
+// pathSegmentValue renders an expression to retrieve the value (as a string) of the i'th path segment.
+func (d *requestDesc) pathSegmentValue(i int) *Statement {
+	return d.pathParamsName().Index(Lit(i))
+}
+
+func (d *requestDesc) renderRequestDecoding(g *Group, dec *genutil.TypeUnmarshaller) {
+	if d.ep.Request == nil {
+		return
+	}
+
+	if schemautil.IsPointer(d.ep.Request) {
+		g.Id("params").Op(":=").Add(d.gu.Initialize(d.ep.Request))
+		g.Add(d.reqDataPayloadExpr()).Op("=").Id("params")
+	} else {
+		g.Id("params").Op(":=").Op("&").Add(d.reqDataPayloadExpr())
+	}
+
+	// Parsing requests for HTTP methods without a body (GET, HEAD, DELETE) are handled by parsing the query string,
+	// while other methods are parsed by reading the body and unmarshalling it as JSON.
+	// If the same endpoint supports both, handle it with a switch.
+	reqs := d.ep.RequestEncoding()
+	if d.gu.Errs.Len() > 0 {
+		return
+	}
+	g.Add(Switch(Id("m").Op(":=").Add(d.httpReqExpr()).Dot("Method"), Id("m")).BlockFunc(
+		func(g *Group) {
+			for _, r := range reqs {
+				g.CaseFunc(func(g *Group) {
+					for _, m := range r.HTTPMethods {
+						g.Lit(m)
+					}
+				}).BlockFunc(func(g *Group) {
+					d.decodeRequestParameters(g, dec, r)
+				})
+			}
+			g.Default().Add(Id("panic").Call(Lit("HTTP method is not supported")))
+		},
+	))
+}
+
+func (d *requestDesc) decodeRequestParameters(g *Group, dec *genutil.TypeUnmarshaller, req *apienc.RequestEncoding) {
+	apigenutil.DecodeHeaders(g, d.httpReqExpr().Dot("Header"), Id("params"), dec, req.HeaderParameters)
+	apigenutil.DecodeQuery(g, d.httpReqExpr().Dot("URL").Dot("Query").Call(), Id("params"), dec, req.QueryParameters)
+	apigenutil.DecodeBody(g, d.httpReqExpr().Dot("Body"), Id("params"), dec, req.BodyParameters)
+}
+
+// Clone returns the function literal to clone the request.
+func (d *requestDesc) Clone() *Statement {
+	const recv = "r"
+	return Func().Params(Id(recv).Add(d.Type())).Params(d.Type(), Error()).BlockFunc(func(g *Group) {
+		// We could optimize the clone operation if there are no reference types (pointers, maps, slices)
+		// in the struct. For now, simply serialize it as JSON and back.
+		g.Var().Id("clone").Add(d.Type())
+		g.List(Id("bytes"), Id("err")).Op(":=").Qual(jsonIterPkg, "ConfigDefault").Dot("Marshal").Call(Id(recv))
+		g.If(Err().Op("==").Nil()).Block(
+			Err().Op("=").Qual(jsonIterPkg, "ConfigDefault").Dot("Unmarshal").Call(Id("bytes"), Op("&").Id("clone")),
+		)
+		g.Return(Id("clone"), Err())
+	})
+}
+
+// ReqPath returns the function literal to compute the request path.
+func (d *requestDesc) ReqPath() *Statement {
+	return Func().Params(
+		d.reqDataExpr().Add(d.Type()),
+	).Params(
+		String(),
+		apiQ("UnnamedParams"),
+		Error(),
+	).BlockFunc(func(g *Group) {
+		pathParams := d.ep.Path.Params()
+		if len(pathParams) == 0 {
+			g.Return(Lit(d.ep.Path.String()), Nil(), Nil())
+			return
+		}
+
+		g.Id("params").Op(":=").Add(apiQ("UnnamedParams")).ValuesFunc(func(g *Group) {
+			for paramIdx, f := range pathParams {
+				g.Add(genutil.MarshalBuiltin(f.ValueType, d.reqDataPathParamExpr(paramIdx)))
+			}
+		})
+
+		// Construct the path as an expression in the form
+		//		"/foo" + params[N].Value + "/bar"
+		pathExpr := CustomFunc(Options{
+			Separator: " + ",
+		}, func(g *Group) {
+			idx := 0
+			for _, seg := range d.ep.Path.Segments {
+				if seg.Type == resourcepaths.Literal {
+					g.Lit("/" + seg.Value)
+				} else {
+					g.Lit("/")
+					g.Qual("net/url", "PathEscape").Call(Id("params").Index(Lit(idx)))
+					idx++
+				}
+			}
+		})
+		g.Return(pathExpr, Id("params"), Nil())
+	})
+}
+
+// UserPayload returns the function literal to compute the user payload.
+func (d *requestDesc) UserPayload() *Statement {
+	return Func().Params(
+		// input
+		d.reqDataExpr().Add(d.Type()),
+	).Params(
+		// output
+		Any(),
+	).BlockFunc(func(g *Group) {
+		if d.ep.Request == nil {
+			g.Return(Nil())
+		} else {
+			g.Return(d.reqDataPayloadExpr())
+		}
+	})
+}
+
+func (d *requestDesc) EncodeExternalReq() *Statement {
+	return Func().Params(
+		d.reqDataExpr().Add(d.Type()),
+		d.jsonStream().Add(Op("*").Qual(jsonIterPkg, "Stream")),
+	).Params(
+		d.httpHeaderExpr().Add(Qual("net/http", "Header")),
+		d.queryStringExpr().Add(Qual("net/url", "Values")),
+		Err().Error(),
+	).BlockFunc(func(g *Group) {
+		if d.ep.Request == nil {
+			// Nothing to do.
+			g.Return(Nil(), Nil(), Nil())
+			return
+		}
+
+		if schemautil.IsPointer(d.ep.Request) {
+			g.Id("params").Op(":=").Add(d.reqDataPayloadExpr())
+
+			g.If(Id("params").Op("==").Nil()).Block(
+				Comment("If the payload is nil, we need to return an empty request body."),
+				Return(d.httpHeaderExpr(), d.queryStringExpr(), Err()),
+			)
+		} else {
+			g.Id("params").Op(":=").Op("&").Add(d.reqDataPayloadExpr())
+		}
+
+		encodings := d.ep.RequestEncoding()
+		if len(encodings) == 0 {
+			// This only happens in the case of an error, which has
+			// then already been reported by RequestEncoding.
+			g.Return(Nil(), Nil(), Nil())
+			return
+		}
+
+		enc := encodings[0]
+
+		apigenutil.EncodeHeaders(d.gu.Errs, g, d.httpHeaderExpr(), Id("params"), enc.HeaderParameters)
+		apigenutil.EncodeQuery(d.gu.Errs, g, d.queryStringExpr(), Id("params"), enc.QueryParameters)
+		apigenutil.EncodeBody(d.gu, g, d.jsonStream(), Id("params"), enc.BodyParameters)
+
+		g.Return(d.httpHeaderExpr(), d.queryStringExpr(), Err())
+	})
+}
diff --git a/v2/codegen/apigen/endpointgen/response.go b/v2/codegen/apigen/endpointgen/response.go
new file mode 100644
index 0000000000..6336a8e442
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/response.go
@@ -0,0 +1,231 @@
+package endpointgen
+
+import (
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/v2/codegen/apigen/apigenutil"
+	"encr.dev/v2/codegen/internal/genutil"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/api/apienc"
+)
+
+// responseDesc describes the generated response type.
+type responseDesc struct {
+	gu *genutil.Helper
+	ep *api.Endpoint
+}
+
+func (d *responseDesc) TypeName() string {
+	return "EncoreInternal_" + d.ep.Name + "Resp"
+}
+
+func (d *responseDesc) Type() *Statement {
+	return Id(d.TypeName())
+}
+
+func (d *responseDesc) TypeDecl() *Statement {
+	return Type().Id(d.TypeName()).Op("=").Do(func(s *Statement) {
+		if d.ep.Response != nil {
+			s.Add(d.gu.Type(d.ep.Response))
+		} else {
+			s.Add(apiQ("Void"))
+		}
+	})
+}
+
+func (d *responseDesc) ZeroType() *Statement {
+	if d.ep.Response != nil {
+		return d.gu.Zero(d.ep.Response)
+	} else {
+		return apiQ("Void").Values()
+	}
+}
+
+func (d *responseDesc) EncodeResponse() *Statement {
+	if d.ep.Raw {
+		return Nil()
+	}
+
+	return Func().Params(
+		Id("w").Qual("net/http", "ResponseWriter"),
+		Id("json").Qual("github.com/json-iterator/go", "API"),
+		Id("resp").Add(d.Type()),
+		Id("status").Int(),
+	).Params(Err().Error()).BlockFunc(func(g *Group) {
+		if d.ep.Response == nil {
+			g.Return(Nil())
+			return
+		}
+
+		resp := apienc.DescribeResponse(d.gu.Errs, d.ep.Response)
+		if len(resp.BodyParameters) > 0 {
+			g.Id("respData").Op(":=").Index().Byte().Parens(Lit("null\n"))
+		} else {
+			g.Id("respData").Op(":=").Index().Byte().Values(LitRune('\n'))
+		}
+		if len(resp.HeaderParameters) > 0 {
+			g.Var().Id("headers").Map(String()).Index().String()
+		}
+
+		responseEncoder := CustomFunc(Options{Separator: "\n"}, func(g *Group) {
+			if len(resp.BodyParameters) > 0 {
+				g.Comment("Encode JSON body")
+				g.List(Id("respData"), Err()).Op("=").Qual("encore.dev/appruntime/shared/serde", "SerializeJSONFunc").Call(
+					Id("json"),
+					Func().Params(
+						Id("ser").Op("*").Qual("encore.dev/appruntime/shared/serde", "JSONSerializer"),
+					).BlockFunc(
+						func(g *Group) {
+							for _, f := range resp.BodyParameters {
+								g.Add(Id("ser").Dot("WriteField").Call(Lit(f.WireName), Id("resp").Dot(f.SrcName), Lit(f.OmitEmpty)))
+							}
+						}))
+				g.If(Err().Op("!=").Nil()).Block(
+					Return(Err()),
+				)
+				g.Id("respData").Op("=").Append(Id("respData"), LitRune('\n'))
+			}
+
+			if len(resp.HeaderParameters) > 0 {
+				g.Line().Comment("Encode headers")
+				g.Id("headers").Op("=").Map(String()).Index().String().Values(DictFunc(func(dict Dict) {
+					for _, f := range resp.HeaderParameters {
+						if builtin, ok := f.Type.(schema.BuiltinType); ok {
+							encExpr := genutil.MarshalBuiltin(builtin.Kind, Id("resp").Dot(f.SrcName))
+							dict[Lit(f.WireName)] = Index().String().Values(encExpr)
+						} else {
+							d.gu.Errs.Addf(f.Type.ASTExpr().Pos(), "unsupported type in header: %s", d.gu.TypeToString(f.Type))
+						}
+					}
+				}))
+			}
+		})
+
+		// If response is a ptr we need to check it's not nil
+		if schemautil.IsPointer(d.ep.Response) {
+			g.If(Id("resp").Op("!=").Nil()).Block(responseEncoder)
+		} else {
+			g.Add(responseEncoder)
+		}
+
+		if len(resp.HeaderParameters) > 0 {
+			g.Line().Comment("Set response headers")
+			g.For(List(Id("k"), Id("vs")).Op(":=").Range().Id("headers")).Block(
+				For(List(Id("_"), Id("v")).Op(":=").Range().Id("vs")).Block(
+					Id("w").Dot("Header").Call().Dot("Add").Call(Id("k"), Id("v")),
+				),
+			)
+		}
+
+		g.Line().Comment("Set HTTP status code")
+		if resp.HTTPStatusParameter != nil {
+			g.Id("statusCode").Op(":=").Id("status")
+
+			var statusFieldCond *Statement
+			if schemautil.IsPointer(d.ep.Response) {
+				statusFieldCond = Id("resp").Op("!=").Nil().Op("&&").Id("resp").Dot(resp.HTTPStatusParameter.SrcName).Op("!=").Lit(0)
+			} else {
+				statusFieldCond = Id("resp").Dot(resp.HTTPStatusParameter.SrcName).Op("!=").Lit(0)
+			}
+
+			g.If(statusFieldCond).Block(
+				Id("statusCode").Op("=").Int().Call(Id("resp").Dot(resp.HTTPStatusParameter.SrcName)),
+			)
+
+			g.If(Id("statusCode").Op("!=").Lit(0)).Block(
+				Id("w").Dot("WriteHeader").Call(Id("statusCode")),
+			)
+		} else {
+			g.If(Id("status").Op("!=").Lit(0)).Block(
+				Id("w").Dot("WriteHeader").Call(Id("status")),
+			)
+		}
+
+		g.Line().Comment("Write response body")
+		g.Id("w").Dot("Write").Call(Id("respData"))
+		g.Return(Nil())
+	})
+}
+
+func (d *responseDesc) DecodeExternalResp() *Statement {
+	if d.ep.Raw {
+		// TODO(andre) support
+		return Nil()
+	}
+
+	return Func().Params(
+		Id("httpResp").Op("*").Qual("net/http", "Response"),
+		Id("json").Qual("github.com/json-iterator/go", "API"),
+	).Params(
+		Id("resp").Add(d.Type()),
+		Err().Error(),
+	).BlockFunc(func(g *Group) {
+		if d.ep.Response == nil {
+			g.Return(d.ZeroType(), Nil())
+			return
+		}
+
+		g.Id("resp").Op("=").Add(d.gu.Initialize(d.ep.Response))
+
+		enc := d.ep.ResponseEncoding()
+		dec := d.gu.NewTypeUnmarshaller("dec")
+		g.Add(dec.Init())
+
+		if enc.HTTPStatusParameter != nil {
+			g.Line().Comment("Set HTTP status field")
+			statusType := d.gu.Type(enc.HTTPStatusParameter.Type)
+			g.Id("resp").Dot(enc.HTTPStatusParameter.SrcName).Op("=").Add(statusType).Call(Id("httpResp").Dot("StatusCode"))
+		}
+
+		apigenutil.DecodeHeaders(g, Id("httpResp").Dot("Header"), Id("resp"), dec, enc.HeaderParameters)
+		apigenutil.DecodeBody(g, Id("httpResp").Dot("Body"), Id("resp"), dec, enc.BodyParameters)
+
+		g.If(Err().Op(":=").Add(dec.Err()), Err().Op("!=").Nil()).Block(
+			Return(d.ZeroType(), Err()),
+		)
+		g.Return(Id("resp"), Nil())
+	})
+}
+
+// httpRespExpr returns an expression to access the HTTP response writer variable.
+func (d *requestDesc) httpRespExpr() *Statement {
+	return Id("httpResp")
+}
+
+// respDataExpr returns the expression to access the respData variable.
+func (d *responseDesc) respDataExpr() *Statement {
+	return Id("respData")
+}
+
+// respDataPayloadExpr returns an expression for accessing the payload
+// in the reqData variable.
+func (d *responseDesc) respDataPayloadExpr() *Statement {
+	return d.respDataExpr()
+}
+
+// zero returns an expression representing the zero value
+// of the response type.
+func (d *responseDesc) zero() *Statement {
+	if d.ep.Response != nil {
+		return d.gu.Zero(d.ep.Response)
+	} else {
+		return apiQ("Void").Values()
+	}
+}
+
+// Clone returns the function literal to clone the request.
+func (d *responseDesc) Clone() *Statement {
+	const recv = "r"
+	return Func().Params(Id(recv).Add(d.Type())).Params(d.Type(), Error()).BlockFunc(func(g *Group) {
+		// We could optimize the clone operation if there are no reference types (pointers, maps, slices)
+		// in the struct. For now, simply serialize it as JSON and back.
+		g.Var().Id("clone").Add(d.Type())
+		g.List(Id("bytes"), Id("err")).Op(":=").Qual(jsonIterPkg, "ConfigDefault").Dot("Marshal").Call(Id(recv))
+		g.If(Err().Op("==").Nil()).Block(
+			Err().Op("=").Qual(jsonIterPkg, "ConfigDefault").Dot("Unmarshal").Call(Id("bytes"), Op("&").Id("clone")),
+		)
+		g.Return(Id("clone"), Err())
+	})
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/api_call.txt b/v2/codegen/apigen/endpointgen/testdata/api_call.txt
new file mode 100644
index 0000000000..622842e890
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/api_call.txt
@@ -0,0 +1,212 @@
+-- svca/svca.go --
+package svca
+
+import "context"
+
+//encore:api public
+func Foo(ctx context.Context) error { return nil }
+
+//encore:api public
+func Bar(ctx context.Context) error { return Foo(ctx) }
+-- svcb/svcb.go --
+package svcb
+
+import ("context"; "example.com/svca")
+
+//encore:api public
+func Baz(ctx context.Context) error { return svca.Foo(ctx) }
+-- want:svca/encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package svca
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) error
+
+	Bar(ctx context.Context) error
+}
+-- want:svca/encore_internal__api.go --
+package svca
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Bar, Bar)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		err := Foo(ctx)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/svca.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/svca.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/svca.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "svca",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
+
+type EncoreInternal_BarReq struct{}
+
+type EncoreInternal_BarResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Bar = &__api.Desc[*EncoreInternal_BarReq, EncoreInternal_BarResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_BarReq) (EncoreInternal_BarResp, error) {
+		err := Bar(ctx)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_BarReq) (*EncoreInternal_BarReq, error) {
+		var clone *EncoreInternal_BarReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_BarResp) (EncoreInternal_BarResp, error) {
+		var clone EncoreInternal_BarResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_BarResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_BarReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_BarReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_BarReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_BarResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Bar",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/svca.Bar",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/svca.Bar",
+	ReqPath: func(reqData *EncoreInternal_BarReq) (string, __api.UnnamedParams, error) {
+		return "/svca.Bar", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_BarReq) any {
+		return nil
+	},
+	Service:           "svca",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
+-- want:svca/encore_internal__apicalls.go --
+package svca
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+)
+
+func EncoreInternal_apicalls_Foo(ctx context.Context) error {
+	_, err := EncoreInternal_api_APIDesc_Foo.Call(__api.NewCallContext(ctx), &EncoreInternal_FooReq{})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+-- want:svca/svca.go --
+package svca
+
+import "context"
+
+//encore:api public
+func Foo(ctx context.Context) error { return nil }
+
+//encore:api public
+func Bar(ctx context.Context) error { return EncoreInternal_apicalls_Foo(ctx) }
+-- want:svcb/svcb.go --
+package svcb
+
+import ("context"; "example.com/svca")
+
+//encore:api public
+func Baz(ctx context.Context) error { return svca.EncoreInternal_apicalls_Foo(ctx) }
diff --git a/v2/codegen/apigen/endpointgen/testdata/api_call_servicestruct.txt b/v2/codegen/apigen/endpointgen/testdata/api_call_servicestruct.txt
new file mode 100644
index 0000000000..aa09c846b1
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/api_call_servicestruct.txt
@@ -0,0 +1,163 @@
+-- svca/svca.go --
+package svca
+
+import "context"
+
+//encore:service
+type Service struct{}
+
+//encore:api public
+func (s *Service) Foo(context.Context) error { return nil }
+
+-- svcb/svcb.go --
+package svcb
+
+import ("context"; "example.com/svca")
+
+//encore:api public
+func Baz(ctx context.Context) error { return svca.Foo(ctx) }
+-- want:svca/encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package svca
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+func Foo(ctx context.Context) error {
+	svc, err := EncoreInternal_svcstruct_Service.Get()
+	if err != nil {
+		return err
+	}
+	return svc.Foo(ctx)
+}
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) error
+}
+-- want:svca/encore_internal__api.go --
+package svca
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		svc, initErr := EncoreInternal_svcstruct_Service.Get()
+		if initErr != nil {
+			return __api.Void{}, initErr
+		}
+		err := svc.Foo(ctx)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/svca.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/svca.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/svca.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "svca",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
+-- want:svca/encore_internal__apicalls.go --
+package svca
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+)
+
+func EncoreInternal_apicalls_Foo(ctx context.Context) error {
+	_, err := EncoreInternal_api_APIDesc_Foo.Call(__api.NewCallContext(ctx), &EncoreInternal_FooReq{})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+-- want:svca/encore_internal__svcstruct.go --
+package svca
+
+import __service "encore.dev/appruntime/apisdk/service"
+
+func init() {
+	__service.Register(EncoreInternal_svcstruct_Service)
+}
+
+var EncoreInternal_svcstruct_Service = &__service.Decl[Service]{
+	Name:        "Service",
+	Service:     "svca",
+	Setup:       nil,
+	SetupDefLoc: uint32(0x0),
+}
+-- want:svcb/svcb.go --
+package svcb
+
+import ("context"; "example.com/svca")
+
+//encore:api public
+func Baz(ctx context.Context) error { return svca.EncoreInternal_apicalls_Foo(ctx) }
diff --git a/v2/codegen/apigen/endpointgen/testdata/basic.txt b/v2/codegen/apigen/endpointgen/testdata/basic.txt
new file mode 100644
index 0000000000..c1ffbaca1f
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/basic.txt
@@ -0,0 +1,104 @@
+-- basic.go --
+package basic
+
+import "context"
+
+//encore:api public
+func Foo(ctx context.Context) error { return nil }
+
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package basic
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) error
+}
+-- want:encore_internal__api.go --
+package basic
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		err := Foo(ctx)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/basic.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/basic.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/basic.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "basic",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/complex_omitempty.txt b/v2/codegen/apigen/endpointgen/testdata/complex_omitempty.txt
new file mode 100644
index 0000000000..993eb917e5
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/complex_omitempty.txt
@@ -0,0 +1,169 @@
+-- basic.go --
+package basic
+
+import "context"
+
+type NotComparable struct{
+    Foo []string
+}
+
+type NamedNotComparable NotComparable
+
+type Int int
+
+type Params struct {
+    X NotComparable `json:"x,omitempty"`
+    Integer Int `json:"int,omitempty"`
+}
+
+//encore:api public
+func Foo(ctx context.Context, p *Params) error { return nil }
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package basic
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context, p *Params) error
+}
+-- want:encore_internal__api.go --
+package basic
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__etype "encore.dev/appruntime/shared/etype"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct {
+	Payload *Params
+}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		err := Foo(ctx, reqData.Payload)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		dec := new(__etype.Unmarshaller)
+		params := new(Params)
+		reqData.Payload = params
+		switch m := httpReq.Method; m {
+		case "POST":
+			// Decode request body
+			payload := dec.ReadBody(httpReq.Body)
+			iter := jsoniter.ParseBytes(json, payload)
+
+			for iter.ReadObjectCB(func(_ *jsoniter.Iterator, key string) bool {
+				switch strings.ToLower(key) {
+				case "x":
+					dec.ParseJSON("X", iter, &params.X)
+				case "int":
+					dec.ParseJSON("Integer", iter, &params.Integer)
+				default:
+					_ = iter.SkipAndReturnBytes()
+				}
+				return true
+			}) {
+			}
+
+		default:
+			panic("HTTP method is not supported")
+		}
+		if err := dec.Error; err != nil {
+			return nil, nil, err
+		}
+		return reqData, ps, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		params := reqData.Payload
+		if params == nil {
+			// If the payload is nil, we need to return an empty request body.
+			return httpHeader, queryString, err
+		}
+
+		// Encode request body
+		stream.WriteObjectStart()
+		if true {
+			// X is set to omitempty, so we need to check if it's empty before writing it
+			stream.WriteObjectField("x")
+			stream.WriteVal(params.X)
+			stream.WriteMore()
+		}
+		if params.Integer != 0 {
+			// Integer is set to omitempty, so we need to check if it's empty before writing it
+			stream.WriteObjectField("int")
+			stream.WriteVal(params.Integer)
+		}
+		stream.WriteObjectEnd()
+
+		return httpHeader, queryString, err
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"POST"},
+	Path:                "/basic.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/basic.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/basic.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return reqData.Payload
+	},
+	Service:           "basic",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/endpoint_tags.txt b/v2/codegen/apigen/endpointgen/testdata/endpoint_tags.txt
new file mode 100644
index 0000000000..e14e1b88fa
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/endpoint_tags.txt
@@ -0,0 +1,103 @@
+-- code.go --
+package code
+
+import "context"
+
+//encore:api public tag:foo tag:bar
+func Tagged(ctx context.Context) error { return nil }
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Tagged(ctx context.Context) error
+}
+-- want:encore_internal__api.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Tagged, Tagged)
+}
+
+type EncoreInternal_TaggedReq struct{}
+
+type EncoreInternal_TaggedResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Tagged = &__api.Desc[*EncoreInternal_TaggedReq, EncoreInternal_TaggedResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_TaggedReq) (EncoreInternal_TaggedResp, error) {
+		err := Tagged(ctx)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_TaggedReq) (*EncoreInternal_TaggedReq, error) {
+		var clone *EncoreInternal_TaggedReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_TaggedResp) (EncoreInternal_TaggedResp, error) {
+		var clone EncoreInternal_TaggedResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_TaggedResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_TaggedReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_TaggedReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_TaggedReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_TaggedResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Tagged",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/code.Tagged",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/code.Tagged",
+	ReqPath: func(reqData *EncoreInternal_TaggedReq) (string, __api.UnnamedParams, error) {
+		return "/code.Tagged", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_TaggedReq) any {
+		return nil
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              []string{"bar", "foo"},
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/fallback_path.txt b/v2/codegen/apigen/endpointgen/testdata/fallback_path.txt
new file mode 100644
index 0000000000..cbf96cd06e
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/fallback_path.txt
@@ -0,0 +1,120 @@
+-- code.go --
+package code
+
+import "context"
+
+//encore:api public path=/!fallback
+func Foo(ctx context.Context, fallback string) error { return nil }
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context, fallback string) error
+}
+-- want:encore_internal__api.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__etype "encore.dev/appruntime/shared/etype"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct {
+	P0 string
+}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		err := Foo(ctx, reqData.P0)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		dec := new(__etype.Unmarshaller)
+		// Trim the leading slash from wildcard parameter, as Encore's semantics excludes it,
+		// while the httprouter implementation includes it.
+		ps[0] = strings.TrimPrefix(ps[0], "/")
+
+		if value, err := url.PathUnescape(ps[0]); err == nil {
+			ps[0] = value
+		}
+		reqData.P0 = __etype.UnmarshalOne(dec, __etype.UnmarshalString, "fallback", ps[0], true)
+		if err := dec.Error; err != nil {
+			return nil, nil, err
+		}
+		return reqData, ps, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            true,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/!fallback",
+	PathParamNames:      []string{"fallback"},
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/*0",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		params := __api.UnnamedParams{__etype.MarshalOne(__etype.MarshalString, reqData.P0)}
+		return "/" + url.PathEscape(params[0]), params, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/path_params.txt b/v2/codegen/apigen/endpointgen/testdata/path_params.txt
new file mode 100644
index 0000000000..9c75109958
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/path_params.txt
@@ -0,0 +1,168 @@
+-- code.go --
+package code
+
+import "context"
+
+type Params struct {
+    String string
+    Int int
+}
+
+//encore:api public path=/foo/:id/*baz
+func Foo(ctx context.Context, id int, baz string, p *Params) error { return nil }
+
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context, id int, baz string, p *Params) error
+}
+-- want:encore_internal__api.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__etype "encore.dev/appruntime/shared/etype"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct {
+	Payload *Params
+	P0      int
+	P1      string
+}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		err := Foo(ctx, reqData.P0, reqData.P1, reqData.Payload)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		dec := new(__etype.Unmarshaller)
+		// Trim the leading slash from wildcard parameter, as Encore's semantics excludes it,
+		// while the httprouter implementation includes it.
+		ps[1] = strings.TrimPrefix(ps[1], "/")
+
+		reqData.P0 = __etype.UnmarshalOne(dec, __etype.UnmarshalInt, "id", ps[0], true)
+		if value, err := url.PathUnescape(ps[1]); err == nil {
+			ps[1] = value
+		}
+		reqData.P1 = __etype.UnmarshalOne(dec, __etype.UnmarshalString, "baz", ps[1], true)
+		params := new(Params)
+		reqData.Payload = params
+		switch m := httpReq.Method; m {
+		case "POST":
+			// Decode request body
+			payload := dec.ReadBody(httpReq.Body)
+			iter := jsoniter.ParseBytes(json, payload)
+
+			for iter.ReadObjectCB(func(_ *jsoniter.Iterator, key string) bool {
+				switch strings.ToLower(key) {
+				case "string":
+					dec.ParseJSON("String", iter, &params.String)
+				case "int":
+					dec.ParseJSON("Int", iter, &params.Int)
+				default:
+					_ = iter.SkipAndReturnBytes()
+				}
+				return true
+			}) {
+			}
+
+		default:
+			panic("HTTP method is not supported")
+		}
+		if err := dec.Error; err != nil {
+			return nil, nil, err
+		}
+		return reqData, ps, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		params := reqData.Payload
+		if params == nil {
+			// If the payload is nil, we need to return an empty request body.
+			return httpHeader, queryString, err
+		}
+
+		// Encode request body
+		stream.WriteObjectStart()
+		stream.WriteObjectField("String")
+		stream.WriteVal(params.String)
+		stream.WriteMore()
+		stream.WriteObjectField("Int")
+		stream.WriteVal(params.Int)
+		stream.WriteObjectEnd()
+
+		return httpHeader, queryString, err
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"POST"},
+	Path:                "/foo/:id/*baz",
+	PathParamNames:      []string{"id", "baz"},
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/foo/:0/*1",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		params := __api.UnnamedParams{__etype.MarshalOne(__etype.MarshalInt, reqData.P0), __etype.MarshalOne(__etype.MarshalString, reqData.P1)}
+		return "/foo" + "/" + url.PathEscape(params[0]) + "/" + url.PathEscape(params[1]), params, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return reqData.Payload
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/raw_endpoint.txt b/v2/codegen/apigen/endpointgen/testdata/raw_endpoint.txt
new file mode 100644
index 0000000000..00d883e4ac
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/raw_endpoint.txt
@@ -0,0 +1,183 @@
+-- code.go --
+package code
+import "net/http"
+
+//encore:api public raw
+func Foo(w http.ResponseWriter, req *http.Request) {}
+
+//encore:service
+type Service struct{}
+
+//encore:api public raw
+func (s *Service) Bar(w http.ResponseWriter, req *http.Request) {}
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+import (
+	"context"
+	"errors"
+	"net/http"
+)
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+func Bar(ctx context.Context, req *http.Request) (*http.Response, error) {
+	return nil, errors.New("encore: calling raw endpoints is not yet supported")
+}
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface{}
+-- want:encore_internal__api.go --
+package code
+
+import (
+	__api "encore.dev/appruntime/apisdk/api"
+	errs "encore.dev/beta/errs"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Bar, Bar)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access:     __api.Public,
+	AppHandler: nil,
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: nil,
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp:          nil,
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "HEAD", "POST", "PUT", "DELETE", "CONNECT", "OPTIONS", "TRACE", "PATCH"},
+	Path:                "/code.Foo",
+	PathParamNames:      nil,
+	Raw:                 true,
+	RawHandler: func(w http.ResponseWriter, req *http.Request) {
+		Foo(w, req)
+	},
+	RawPath: "/code.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/code.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
+
+type EncoreInternal_BarReq struct{}
+
+type EncoreInternal_BarResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Bar = &__api.Desc[*EncoreInternal_BarReq, EncoreInternal_BarResp]{
+	Access:     __api.Public,
+	AppHandler: nil,
+	CloneReq: func(r *EncoreInternal_BarReq) (*EncoreInternal_BarReq, error) {
+		var clone *EncoreInternal_BarReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_BarResp) (EncoreInternal_BarResp, error) {
+		var clone EncoreInternal_BarResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: nil,
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_BarReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_BarReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_BarReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp:          nil,
+	Endpoint:            "Bar",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "HEAD", "POST", "PUT", "DELETE", "CONNECT", "OPTIONS", "TRACE", "PATCH"},
+	Path:                "/code.Bar",
+	PathParamNames:      nil,
+	Raw:                 true,
+	RawHandler: func(w http.ResponseWriter, req *http.Request) {
+		svc, initErr := EncoreInternal_svcstruct_Service.Get()
+		if initErr != nil {
+			errs.HTTPErrorWithCode(w, initErr, 0)
+			return
+		}
+		svc.Bar(w, req)
+	},
+	RawPath: "/code.Bar",
+	ReqPath: func(reqData *EncoreInternal_BarReq) (string, __api.UnnamedParams, error) {
+		return "/code.Bar", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_BarReq) any {
+		return nil
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
+-- want:encore_internal__svcstruct.go --
+package code
+
+import __service "encore.dev/appruntime/apisdk/service"
+
+func init() {
+	__service.Register(EncoreInternal_svcstruct_Service)
+}
+
+var EncoreInternal_svcstruct_Service = &__service.Decl[Service]{
+	Name:        "Service",
+	Service:     "code",
+	Setup:       nil,
+	SetupDefLoc: uint32(0x0),
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/recursive.txt b/v2/codegen/apigen/endpointgen/testdata/recursive.txt
new file mode 100644
index 0000000000..954355835d
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/recursive.txt
@@ -0,0 +1,219 @@
+-- basic.go --
+package basic
+
+import "context"
+
+type Recursive struct {
+    Basic []Recursive
+    Pointer []*Recursive
+    Mutual []MutualTwo
+}
+
+type MutualOne struct {
+    Basic []MutualTwo
+    Pointer []*MutualTwo
+    Self []Recursive
+    SelfPointer []*Recursive
+}
+
+type MutualTwo struct {
+    Basic []MutualOne
+    Pointer []*MutualOne
+}
+
+//encore:api public
+func Foo(ctx context.Context, p *Recursive) (*Recursive, error) { return p, nil }
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package basic
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context, p *Recursive) (*Recursive, error)
+}
+-- want:encore_internal__api.go --
+package basic
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__etype "encore.dev/appruntime/shared/etype"
+	__serde "encore.dev/appruntime/shared/serde"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct {
+	Payload *Recursive
+}
+
+type EncoreInternal_FooResp = *Recursive
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		resp, err := Foo(ctx, reqData.Payload)
+		if err != nil {
+			return (*Recursive)(nil), err
+		}
+		return resp, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		resp = new(Recursive)
+		dec := new(__etype.Unmarshaller)
+		// Decode request body
+		payload := dec.ReadBody(httpResp.Body)
+		iter := jsoniter.ParseBytes(json, payload)
+
+		for iter.ReadObjectCB(func(_ *jsoniter.Iterator, key string) bool {
+			switch strings.ToLower(key) {
+			case "basic":
+				dec.ParseJSON("Basic", iter, &resp.Basic)
+			case "pointer":
+				dec.ParseJSON("Pointer", iter, &resp.Pointer)
+			case "mutual":
+				dec.ParseJSON("Mutual", iter, &resp.Mutual)
+			default:
+				_ = iter.SkipAndReturnBytes()
+			}
+			return true
+		}) {
+		}
+
+		if err := dec.Error; err != nil {
+			return (*Recursive)(nil), err
+		}
+		return resp, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		dec := new(__etype.Unmarshaller)
+		params := new(Recursive)
+		reqData.Payload = params
+		switch m := httpReq.Method; m {
+		case "POST":
+			// Decode request body
+			payload := dec.ReadBody(httpReq.Body)
+			iter := jsoniter.ParseBytes(json, payload)
+
+			for iter.ReadObjectCB(func(_ *jsoniter.Iterator, key string) bool {
+				switch strings.ToLower(key) {
+				case "basic":
+					dec.ParseJSON("Basic", iter, &params.Basic)
+				case "pointer":
+					dec.ParseJSON("Pointer", iter, &params.Pointer)
+				case "mutual":
+					dec.ParseJSON("Mutual", iter, &params.Mutual)
+				default:
+					_ = iter.SkipAndReturnBytes()
+				}
+				return true
+			}) {
+			}
+
+		default:
+			panic("HTTP method is not supported")
+		}
+		if err := dec.Error; err != nil {
+			return nil, nil, err
+		}
+		return reqData, ps, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		params := reqData.Payload
+		if params == nil {
+			// If the payload is nil, we need to return an empty request body.
+			return httpHeader, queryString, err
+		}
+
+		// Encode request body
+		stream.WriteObjectStart()
+		stream.WriteObjectField("Basic")
+		stream.WriteVal(params.Basic)
+		stream.WriteMore()
+		stream.WriteObjectField("Pointer")
+		stream.WriteVal(params.Pointer)
+		stream.WriteMore()
+		stream.WriteObjectField("Mutual")
+		stream.WriteVal(params.Mutual)
+		stream.WriteObjectEnd()
+
+		return httpHeader, queryString, err
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		respData := []byte("null\n")
+		if resp != nil {
+			// Encode JSON body
+			respData, err = __serde.SerializeJSONFunc(json, func(ser *__serde.JSONSerializer) {
+				ser.WriteField("Basic", resp.Basic, false)
+				ser.WriteField("Pointer", resp.Pointer, false)
+				ser.WriteField("Mutual", resp.Mutual, false)
+			})
+			if err != nil {
+				return err
+			}
+			respData = append(respData, '\n')
+		}
+
+		// Set HTTP status code
+		if status != 0 {
+			w.WriteHeader(status)
+		}
+
+		// Write response body
+		w.Write(respData)
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"POST"},
+	Path:                "/basic.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/basic.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/basic.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return reqData.Payload
+	},
+	Service:           "basic",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/request_headers.txt b/v2/codegen/apigen/endpointgen/testdata/request_headers.txt
new file mode 100644
index 0000000000..9008794914
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/request_headers.txt
@@ -0,0 +1,141 @@
+-- code.go --
+package code
+
+import "context"
+
+type Params struct {
+    Foo   string `header:"X-Foo"`
+    Ignore string `header:"-"`
+    Strings []string `header:"X-Strings"`
+}
+
+//encore:api public
+func Foo(ctx context.Context, p *Params) error { return nil }
+
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context, p *Params) error
+}
+-- want:encore_internal__api.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__etype "encore.dev/appruntime/shared/etype"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/textproto"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct {
+	Payload *Params
+}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		err := Foo(ctx, reqData.Payload)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		dec := new(__etype.Unmarshaller)
+		params := new(Params)
+		reqData.Payload = params
+		switch m := httpReq.Method; m {
+		case "POST":
+			// Decode headers
+			h := httpReq.Header
+			params.Foo = __etype.UnmarshalOne(dec, __etype.UnmarshalString, "x-foo", h.Get("x-foo"), false)
+			params.Strings = __etype.UnmarshalList(dec, __etype.UnmarshalString, "x-strings", h.Values("x-strings"), false)
+
+		default:
+			panic("HTTP method is not supported")
+		}
+		if err := dec.Error; err != nil {
+			return nil, nil, err
+		}
+		return reqData, ps, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		params := reqData.Payload
+		if params == nil {
+			// If the payload is nil, we need to return an empty request body.
+			return httpHeader, queryString, err
+		}
+
+		// Encode headers
+		httpHeader = make(http.Header, 2)
+		httpHeader.Set("x-foo", __etype.MarshalOne(__etype.MarshalString, params.Foo))
+		httpHeader[textproto.CanonicalMIMEHeaderKey("x-strings")] = __etype.MarshalList(__etype.MarshalString, params.Strings)
+
+		return httpHeader, queryString, err
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"POST"},
+	Path:                "/code.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/code.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/code.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return reqData.Payload
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/request_params.txt b/v2/codegen/apigen/endpointgen/testdata/request_params.txt
new file mode 100644
index 0000000000..8b37e74579
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/request_params.txt
@@ -0,0 +1,168 @@
+-- basic.go --
+package basic
+
+import "context"
+
+type Params struct {
+    String string   `json:",omitempty"`
+    Array  [3]byte  `json:",omitempty"`
+    Int int
+}
+
+//encore:api public
+func Foo(ctx context.Context, p *Params) error { return nil }
+
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package basic
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context, p *Params) error
+}
+-- want:encore_internal__api.go --
+package basic
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__etype "encore.dev/appruntime/shared/etype"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct {
+	Payload *Params
+}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		err := Foo(ctx, reqData.Payload)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		dec := new(__etype.Unmarshaller)
+		params := new(Params)
+		reqData.Payload = params
+		switch m := httpReq.Method; m {
+		case "POST":
+			// Decode request body
+			payload := dec.ReadBody(httpReq.Body)
+			iter := jsoniter.ParseBytes(json, payload)
+
+			for iter.ReadObjectCB(func(_ *jsoniter.Iterator, key string) bool {
+				switch strings.ToLower(key) {
+				case "string":
+					dec.ParseJSON("String", iter, &params.String)
+				case "array":
+					dec.ParseJSON("Array", iter, &params.Array)
+				case "int":
+					dec.ParseJSON("Int", iter, &params.Int)
+				default:
+					_ = iter.SkipAndReturnBytes()
+				}
+				return true
+			}) {
+			}
+
+		default:
+			panic("HTTP method is not supported")
+		}
+		if err := dec.Error; err != nil {
+			return nil, nil, err
+		}
+		return reqData, ps, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		params := reqData.Payload
+		if params == nil {
+			// If the payload is nil, we need to return an empty request body.
+			return httpHeader, queryString, err
+		}
+
+		// Encode request body
+		stream.WriteObjectStart()
+		if params.String != "" {
+			// String is set to omitempty, so we need to check if it's empty before writing it
+			stream.WriteObjectField("String")
+			stream.WriteVal(params.String)
+			stream.WriteMore()
+		}
+		if true {
+			// Array is set to omitempty, so we need to check if it's empty before writing it
+			stream.WriteObjectField("Array")
+			stream.WriteVal(params.Array)
+			stream.WriteMore()
+		}
+		stream.WriteObjectField("Int")
+		stream.WriteVal(params.Int)
+		stream.WriteObjectEnd()
+
+		return httpHeader, queryString, err
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"POST"},
+	Path:                "/basic.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/basic.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/basic.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return reqData.Payload
+	},
+	Service:           "basic",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/request_query.txt b/v2/codegen/apigen/endpointgen/testdata/request_query.txt
new file mode 100644
index 0000000000..3464e3a17b
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/request_query.txt
@@ -0,0 +1,140 @@
+-- code.go --
+package code
+
+import "context"
+
+type Params struct {
+    Foo   string `query:"foo"`
+    Ignore string `query:"-"`
+    Ints []int `query:"ints"`
+}
+
+//encore:api public
+func Foo(ctx context.Context, p *Params) error { return nil }
+
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context, p *Params) error
+}
+-- want:encore_internal__api.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__etype "encore.dev/appruntime/shared/etype"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct {
+	Payload *Params
+}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		err := Foo(ctx, reqData.Payload)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		dec := new(__etype.Unmarshaller)
+		params := new(Params)
+		reqData.Payload = params
+		switch m := httpReq.Method; m {
+		case "POST":
+			// Decode query string
+			qs := httpReq.URL.Query()
+			params.Foo = __etype.UnmarshalOne(dec, __etype.UnmarshalString, "foo", qs.Get("foo"), false)
+			params.Ints = __etype.UnmarshalList(dec, __etype.UnmarshalInt, "ints", qs["ints"], false)
+
+		default:
+			panic("HTTP method is not supported")
+		}
+		if err := dec.Error; err != nil {
+			return nil, nil, err
+		}
+		return reqData, ps, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		params := reqData.Payload
+		if params == nil {
+			// If the payload is nil, we need to return an empty request body.
+			return httpHeader, queryString, err
+		}
+
+		// Encode query string
+		queryString = make(url.Values, 2)
+		queryString.Set("foo", __etype.MarshalOne(__etype.MarshalString, params.Foo))
+		queryString["ints"] = __etype.MarshalList(__etype.MarshalInt, params.Ints)
+
+		return httpHeader, queryString, err
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"POST"},
+	Path:                "/code.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/code.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/code.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return reqData.Payload
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/response_headers.txt b/v2/codegen/apigen/endpointgen/testdata/response_headers.txt
new file mode 100644
index 0000000000..b55af78024
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/response_headers.txt
@@ -0,0 +1,141 @@
+-- code.go --
+package code
+
+import "context"
+
+type Params struct {
+    Foo   string `header:"X-Foo"`
+    Ignore string `header:"-"`
+}
+
+//encore:api public
+func Foo(ctx context.Context) (*Params, error) { return nil, nil }
+
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) (*Params, error)
+}
+-- want:encore_internal__api.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__etype "encore.dev/appruntime/shared/etype"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = *Params
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		resp, err := Foo(ctx)
+		if err != nil {
+			return (*Params)(nil), err
+		}
+		return resp, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		resp = new(Params)
+		dec := new(__etype.Unmarshaller)
+		// Decode headers
+		h := httpResp.Header
+		resp.Foo = __etype.UnmarshalOne(dec, __etype.UnmarshalString, "x-foo", h.Get("x-foo"), false)
+
+		if err := dec.Error; err != nil {
+			return (*Params)(nil), err
+		}
+		return resp, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		respData := []byte{'\n'}
+		var headers map[string][]string
+		if resp != nil {
+
+			// Encode headers
+			headers = map[string][]string{"x-foo": []string{__etype.MarshalOne(__etype.MarshalString, resp.Foo)}}
+		}
+
+		// Set response headers
+		for k, vs := range headers {
+			for _, v := range vs {
+				w.Header().Add(k, v)
+			}
+		}
+
+		// Set HTTP status code
+		if status != 0 {
+			w.WriteHeader(status)
+		}
+
+		// Write response body
+		w.Write(respData)
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/code.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/code.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/code.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/response_params.txt b/v2/codegen/apigen/endpointgen/testdata/response_params.txt
new file mode 100644
index 0000000000..8e132e0646
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/response_params.txt
@@ -0,0 +1,154 @@
+-- basic.go --
+package basic
+
+import "context"
+
+type Params struct {
+    String string
+    Int int
+}
+
+//encore:api public
+func Foo(ctx context.Context) (*Params, error) { return nil, nil }
+
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package basic
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) (*Params, error)
+}
+-- want:encore_internal__api.go --
+package basic
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__etype "encore.dev/appruntime/shared/etype"
+	__serde "encore.dev/appruntime/shared/serde"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = *Params
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		resp, err := Foo(ctx)
+		if err != nil {
+			return (*Params)(nil), err
+		}
+		return resp, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		resp = new(Params)
+		dec := new(__etype.Unmarshaller)
+		// Decode request body
+		payload := dec.ReadBody(httpResp.Body)
+		iter := jsoniter.ParseBytes(json, payload)
+
+		for iter.ReadObjectCB(func(_ *jsoniter.Iterator, key string) bool {
+			switch strings.ToLower(key) {
+			case "string":
+				dec.ParseJSON("String", iter, &resp.String)
+			case "int":
+				dec.ParseJSON("Int", iter, &resp.Int)
+			default:
+				_ = iter.SkipAndReturnBytes()
+			}
+			return true
+		}) {
+		}
+
+		if err := dec.Error; err != nil {
+			return (*Params)(nil), err
+		}
+		return resp, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		respData := []byte("null\n")
+		if resp != nil {
+			// Encode JSON body
+			respData, err = __serde.SerializeJSONFunc(json, func(ser *__serde.JSONSerializer) {
+				ser.WriteField("String", resp.String, false)
+				ser.WriteField("Int", resp.Int, false)
+			})
+			if err != nil {
+				return err
+			}
+			respData = append(respData, '\n')
+		}
+
+		// Set HTTP status code
+		if status != 0 {
+			w.WriteHeader(status)
+		}
+
+		// Write response body
+		w.Write(respData)
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/basic.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/basic.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/basic.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "basic",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/response_status.txt b/v2/codegen/apigen/endpointgen/testdata/response_status.txt
new file mode 100644
index 0000000000..c1be2d3348
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/response_status.txt
@@ -0,0 +1,158 @@
+-- basic.go --
+package basic
+
+import "context"
+
+type Params struct {
+ String string
+ Int    int `encore:"httpstatus"`
+}
+
+//encore:api public
+func Foo(ctx context.Context) (*Params, error) { return nil, nil }
+
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package basic
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) (*Params, error)
+}
+-- want:encore_internal__api.go --
+package basic
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__etype "encore.dev/appruntime/shared/etype"
+	__serde "encore.dev/appruntime/shared/serde"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = *Params
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		resp, err := Foo(ctx)
+		if err != nil {
+			return (*Params)(nil), err
+		}
+		return resp, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		resp = new(Params)
+		dec := new(__etype.Unmarshaller)
+
+		// Set HTTP status field
+		resp.Int = int(httpResp.StatusCode)
+		// Decode request body
+		payload := dec.ReadBody(httpResp.Body)
+		iter := jsoniter.ParseBytes(json, payload)
+
+		for iter.ReadObjectCB(func(_ *jsoniter.Iterator, key string) bool {
+			switch strings.ToLower(key) {
+			case "string":
+				dec.ParseJSON("String", iter, &resp.String)
+			default:
+				_ = iter.SkipAndReturnBytes()
+			}
+			return true
+		}) {
+		}
+
+		if err := dec.Error; err != nil {
+			return (*Params)(nil), err
+		}
+		return resp, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		respData := []byte("null\n")
+		if resp != nil {
+			// Encode JSON body
+			respData, err = __serde.SerializeJSONFunc(json, func(ser *__serde.JSONSerializer) {
+				ser.WriteField("String", resp.String, false)
+			})
+			if err != nil {
+				return err
+			}
+			respData = append(respData, '\n')
+		}
+
+		// Set HTTP status code
+		statusCode := status
+		if resp != nil && resp.Int != 0 {
+			statusCode = int(resp.Int)
+		}
+		if statusCode != 0 {
+			w.WriteHeader(statusCode)
+		}
+
+		// Write response body
+		w.Write(respData)
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/basic.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/basic.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/basic.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "basic",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/service_struct.txt b/v2/codegen/apigen/endpointgen/testdata/service_struct.txt
new file mode 100644
index 0000000000..a5e860f3e8
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/service_struct.txt
@@ -0,0 +1,133 @@
+-- basic.go --
+package basic
+
+import "context"
+
+//encore:service
+type Service struct{}
+
+//encore:api public
+func (s *Service) Foo(ctx context.Context) error { return nil }
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package basic
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+func Foo(ctx context.Context) error {
+	svc, err := EncoreInternal_svcstruct_Service.Get()
+	if err != nil {
+		return err
+	}
+	return svc.Foo(ctx)
+}
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) error
+}
+-- want:encore_internal__api.go --
+package basic
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		svc, initErr := EncoreInternal_svcstruct_Service.Get()
+		if initErr != nil {
+			return __api.Void{}, initErr
+		}
+		err := svc.Foo(ctx)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/basic.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/basic.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/basic.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "basic",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
+-- want:encore_internal__svcstruct.go --
+package basic
+
+import __service "encore.dev/appruntime/apisdk/service"
+
+func init() {
+	__service.Register(EncoreInternal_svcstruct_Service)
+}
+
+var EncoreInternal_svcstruct_Service = &__service.Decl[Service]{
+	Name:        "Service",
+	Service:     "basic",
+	Setup:       nil,
+	SetupDefLoc: uint32(0x0),
+}
diff --git a/v2/codegen/apigen/endpointgen/testdata/unexported.txt b/v2/codegen/apigen/endpointgen/testdata/unexported.txt
new file mode 100644
index 0000000000..7bf694dc75
--- /dev/null
+++ b/v2/codegen/apigen/endpointgen/testdata/unexported.txt
@@ -0,0 +1,150 @@
+-- code.go --
+package code
+
+import "context"
+
+type Response struct {
+    Exported bool
+    unexported string
+}
+
+//encore:api public
+func Foo(ctx context.Context) (*Response, error) { return nil, nil }
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) (*Response, error)
+}
+-- want:encore_internal__api.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__etype "encore.dev/appruntime/shared/etype"
+	__serde "encore.dev/appruntime/shared/serde"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+	"strings"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = *Response
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Public,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		resp, err := Foo(ctx)
+		if err != nil {
+			return (*Response)(nil), err
+		}
+		return resp, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		resp = new(Response)
+		dec := new(__etype.Unmarshaller)
+		// Decode request body
+		payload := dec.ReadBody(httpResp.Body)
+		iter := jsoniter.ParseBytes(json, payload)
+
+		for iter.ReadObjectCB(func(_ *jsoniter.Iterator, key string) bool {
+			switch strings.ToLower(key) {
+			case "exported":
+				dec.ParseJSON("Exported", iter, &resp.Exported)
+			default:
+				_ = iter.SkipAndReturnBytes()
+			}
+			return true
+		}) {
+		}
+
+		if err := dec.Error; err != nil {
+			return (*Response)(nil), err
+		}
+		return resp, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		respData := []byte("null\n")
+		if resp != nil {
+			// Encode JSON body
+			respData, err = __serde.SerializeJSONFunc(json, func(ser *__serde.JSONSerializer) {
+				ser.WriteField("Exported", resp.Exported, false)
+			})
+			if err != nil {
+				return err
+			}
+			respData = append(respData, '\n')
+		}
+
+		// Set HTTP status code
+		if status != 0 {
+			w.WriteHeader(status)
+		}
+
+		// Write response body
+		w.Write(respData)
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/code.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/code.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/code.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
diff --git a/v2/codegen/apigen/maingen/load_app.go b/v2/codegen/apigen/maingen/load_app.go
new file mode 100644
index 0000000000..74afac32de
--- /dev/null
+++ b/v2/codegen/apigen/maingen/load_app.go
@@ -0,0 +1,193 @@
+package maingen
+
+import (
+	"cmp"
+	"maps"
+	"net/http"
+	"slices"
+	"sort"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encore.dev/appruntime/exported/config"
+	"encore.dev/appruntime/exported/experiments"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app"
+	"encr.dev/v2/app/apiframework"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/api/apienc"
+	"encr.dev/v2/parser/infra/pubsub"
+)
+
+type testParams struct {
+	ExternalTestBinary bool
+	EnvsToEmbed        map[string]string
+}
+
+func GenAppConfig(p GenParams, test option.Option[testParams]) *config.Static {
+	allowHeaders, exposeHeaders := computeCORSHeaders(p.Desc)
+
+	rootDir := p.Desc.MainModule.RootDir.ToDisplay()
+	if GenerateForInternalPackageTests {
+		rootDir = "testing_path:main"
+	}
+
+	cfg := &config.Static{
+		EncoreCompiler: p.CompilerVersion,
+		AppCommit: config.CommitInfo{
+			Revision:    p.AppRevision,
+			Uncommitted: p.AppUncommitted,
+		},
+		CORSAllowHeaders:   allowHeaders,
+		CORSExposeHeaders:  exposeHeaders,
+		PubsubTopics:       pubsubTopics(p.Gen, p.Desc),
+		Testing:            test.Present(),
+		TestServiceMap:     testServiceMap(p.Desc),
+		TestAppRootPath:    rootDir,
+		BundledServices:    bundledServices(p.Desc),
+		EnabledExperiments: p.Gen.Build.Experiments.StringList(),
+		EmbeddedEnvs:       make(map[string]string),
+	}
+
+	if test, ok := test.Get(); ok {
+		cfg.PrettyPrintLogs = test.ExternalTestBinary
+		maps.Copy(cfg.EmbeddedEnvs, test.EnvsToEmbed)
+	}
+
+	return cfg
+}
+
+func pubsubTopics(gen *codegen.Generator, appDesc *app.Desc) map[string]*config.StaticPubsubTopic {
+	result := make(map[string]*config.StaticPubsubTopic)
+	// Get all the topics and subscriptions
+	var (
+		topics      []*pubsub.Topic
+		subsByTopic = make(map[pkginfo.QualifiedName][]*pubsub.Subscription)
+	)
+	for _, r := range appDesc.Parse.Resources() {
+		switch r := r.(type) {
+		case *pubsub.Topic:
+			topics = append(topics, r)
+		case *pubsub.Subscription:
+			subsByTopic[r.Topic] = append(subsByTopic[r.Topic], r)
+		}
+	}
+
+	for _, topic := range topics {
+		subs := make(map[string]*config.StaticPubsubSubscription)
+		for _, b := range appDesc.Parse.PkgDeclBinds(topic) {
+			qn := b.QualifiedName()
+			for _, sub := range subsByTopic[qn] {
+				// HACK: we should have a better way of knowing which service a subscription belongs to
+				if svc, ok := appDesc.ServiceForPath(sub.File.Pkg.FSPath); ok {
+
+					subs[sub.Name] = &config.StaticPubsubSubscription{
+						Service:  svc.Name,
+						SvcNum:   uint16(svc.Num),
+						TraceIdx: gen.TraceNodes.Sub(sub),
+					}
+				}
+			}
+		}
+
+		result[topic.Name] = &config.StaticPubsubTopic{
+			Subscriptions: subs,
+		}
+	}
+
+	return result
+}
+
+func bundledServices(appDesc *app.Desc) []string {
+	// Sort the names by service number since that's what we're indexing by.
+	svcs := slices.Clone(appDesc.Services)
+	slices.SortFunc(svcs, func(a, b *app.Service) int {
+		return cmp.Compare(a.Num, b.Num)
+	})
+
+	return fns.Map(svcs, func(svc *app.Service) string {
+		return svc.Name
+	})
+}
+
+func testServiceMap(appDesc *app.Desc) map[string]string {
+	result := make(map[string]string)
+	for _, svc := range appDesc.Services {
+		path := svc.FSRoot.ToIO()
+		if GenerateForInternalPackageTests {
+			path = "testing_path:" + svc.Name
+		}
+		result[svc.Name] = path
+	}
+	return result
+}
+
+func enabledExperiments(experiments *experiments.Set) *Statement {
+	list := experiments.StringList()
+
+	if len(list) == 0 {
+		return Nil()
+	}
+
+	return Index().String().ValuesFunc(func(g *Group) {
+		for _, e := range list {
+			g.Lit(e)
+		}
+	})
+}
+
+func computeCORSHeaders(appDesc *app.Desc) (allowHeaders, exposeHeaders []string) {
+	// computeRequestHeaders computes the headers that are part of the request for a given RPC.
+	computeRequestHeaders := func(ep *api.Endpoint) []*apienc.ParameterEncoding {
+		var params []*apienc.ParameterEncoding
+		for _, r := range ep.RequestEncoding() {
+			params = append(params, r.HeaderParameters...)
+		}
+		return params
+	}
+
+	// computeResponseHeaders computes the headers that are part of the response for a given RPC.
+	computeResponseHeaders := func(ep *api.Endpoint) []*apienc.ParameterEncoding {
+		return ep.ResponseEncoding().HeaderParameters
+	}
+
+	type result struct {
+		computeHeaders func(ep *api.Endpoint) []*apienc.ParameterEncoding
+		seenHeader     map[string]bool
+		headers        []string
+	}
+
+	var (
+		allow  = &result{computeHeaders: computeRequestHeaders}
+		expose = &result{computeHeaders: computeResponseHeaders}
+	)
+
+	for _, res := range []*result{allow, expose} {
+		res.seenHeader = make(map[string]bool)
+
+		for _, svc := range appDesc.Services {
+			svc.Framework.ForAll(func(fw *apiframework.ServiceDesc) {
+				for _, ep := range fw.Endpoints {
+					for _, param := range res.computeHeaders(ep) {
+						name := http.CanonicalHeaderKey(param.WireName)
+						if !res.seenHeader[name] {
+							res.seenHeader[name] = true
+							res.headers = append(res.headers, name)
+						}
+					}
+				}
+			})
+		}
+		// Sort the headers so that the generated code is deterministic.
+		sort.Strings(res.headers)
+	}
+	return allow.headers, expose.headers
+}
+
+// GenerateForInternalPackageTests is set to true
+// when we're running the maingen package tests, to generate code without
+// temporary directories in the file paths (for reproducibility).
+var GenerateForInternalPackageTests = false
diff --git a/v2/codegen/apigen/maingen/maingen.go b/v2/codegen/apigen/maingen/maingen.go
new file mode 100644
index 0000000000..567222f02e
--- /dev/null
+++ b/v2/codegen/apigen/maingen/maingen.go
@@ -0,0 +1,125 @@
+package maingen
+
+import (
+	gotoken "go/token"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encore.dev/appruntime/exported/config"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/app"
+	"encr.dev/v2/app/apiframework"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/middleware"
+)
+
+type GenParams struct {
+	Gen           *codegen.Generator
+	Desc          *app.Desc
+	MainModule    *pkginfo.Module
+	RuntimeModule *pkginfo.Module
+
+	// CompilerVersion is the version of the compiler to embed in the generated code.
+	CompilerVersion string
+	// AppRevision is the revision of the app to embed in the generated code.
+	AppRevision string
+	// AppUncommitted tracks whether there were uncommitted changes in the app
+	// at the time of build.
+	AppUncommitted bool
+
+	APIHandlers    map[*api.Endpoint]*codegen.VarDecl
+	AuthHandler    option.Option[*codegen.VarDecl]
+	Middleware     map[*middleware.Middleware]*codegen.VarDecl
+	ServiceStructs map[*app.Service]*codegen.VarDecl
+
+	// Test contains configuration for generating test code.
+	Test option.Option[codegen.TestConfig]
+
+	// ExecScriptMainPkg is the main package to build for an ExecScript execution.
+	ExecScriptMainPkg option.Option[paths.Pkg]
+}
+
+func Gen(p GenParams) *config.Static {
+	if test, ok := p.Test.Get(); ok {
+		return genTestConfigs(p, test)
+	} else if execScript, ok := p.ExecScriptMainPkg.Get(); ok {
+		return genExecScriptMain(p, execScript)
+	} else {
+		return genMain(p)
+	}
+}
+
+func genMain(p GenParams) *config.Static {
+	mainPkgDir := p.MainModule.RootDir.Join("encore_internal", "main")
+	mainPkgPath := paths.Pkg(p.MainModule.Path).JoinSlash("encore_internal", "main")
+
+	file := p.Gen.InjectFile(mainPkgPath, "main", mainPkgDir, "main.go", "main")
+	f := file.Jen
+
+	// All services should be imported by the main package so they get initialized on system startup
+	// Services may not have API handlers as they could be purely operating on PubSub subscriptions
+	// so without this anonymous package import, that service might not be initialized.
+	for _, svc := range p.Desc.Services {
+		if fw, ok := svc.Framework.Get(); ok {
+			rootPkg := fw.RootPkg
+			if rootPkg.ImportPath != mainPkgPath {
+				f.Anon(rootPkg.ImportPath.String())
+			}
+		}
+	}
+	// Make sure auth handlers and global middleware are imported as well so they get registered.
+	if fw, ok := p.Desc.Framework.Get(); ok {
+		if ah, ok := fw.AuthHandler.Get(); ok {
+			f.Anon(ah.Decl.File.Pkg.ImportPath.String())
+		}
+
+		for _, mw := range fw.GlobalMiddleware {
+			f.Anon(mw.Decl.File.Pkg.ImportPath.String())
+		}
+	}
+
+	f.Func().Id("main").Params().Block(
+		Qual("encore.dev/appruntime/apisdk/app/appinit", "AppMain").Call(),
+	)
+
+	return GenAppConfig(p, option.None[testParams]())
+}
+
+func genExecScriptMain(p GenParams, mainPkgPath paths.Pkg) *config.Static {
+	mainPkgDir, ok := p.MainModule.FSPathToPkg(mainPkgPath)
+	if !ok {
+		p.Desc.Errs.Addf(gotoken.NoPos, "cannot find package %s in module %s",
+			mainPkgPath, p.MainModule.Path)
+		return nil
+	}
+
+	file := p.Gen.InjectFile(mainPkgPath, "main", mainPkgDir, "encore_internal__execscript.go", "execscript")
+	f := file.Jen
+
+	// All services should be imported by the main package so they get initialized on system startup
+	// Services may not have API handlers as they could be purely operating on PubSub subscriptions
+	// so without this anonymous package import, that service might not be initialized.
+	for _, svc := range p.Desc.Services {
+		svc.Framework.ForAll(func(svcDesc *apiframework.ServiceDesc) {
+			rootPkg := svcDesc.RootPkg
+			if rootPkg.ImportPath != mainPkgPath {
+				f.Anon(rootPkg.ImportPath.String())
+			}
+		})
+	}
+
+	// Make sure auth handlers and global middleware are imported as well so they get registered.
+	if fw, ok := p.Desc.Framework.Get(); ok {
+		if ah, ok := fw.AuthHandler.Get(); ok {
+			f.Anon(ah.Decl.File.Pkg.ImportPath.String())
+		}
+		for _, mw := range fw.GlobalMiddleware {
+			f.Anon(mw.Decl.File.Pkg.ImportPath.String())
+		}
+	}
+
+	return GenAppConfig(p, option.None[testParams]())
+}
diff --git a/v2/codegen/apigen/maingen/maingen_test.go b/v2/codegen/apigen/maingen/maingen_test.go
new file mode 100644
index 0000000000..1e54a74c6f
--- /dev/null
+++ b/v2/codegen/apigen/maingen/maingen_test.go
@@ -0,0 +1,36 @@
+package maingen_test
+
+import (
+	"encoding/json"
+	"fmt"
+	"testing"
+
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/apigen"
+	"encr.dev/v2/codegen/apigen/maingen"
+	"encr.dev/v2/codegen/internal/codegentest"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+func TestCodegen(t *testing.T) {
+	maingen.GenerateForInternalPackageTests = true
+	fn := func(gen *codegen.Generator, desc *app.Desc) {
+		loader := pkginfo.New(gen.Context)
+		mainModule := loader.MainModule()
+		params := apigen.Params{
+			Gen:           gen,
+			Desc:          desc,
+			MainModule:    mainModule,
+			RuntimeModule: loader.RuntimeModule(),
+		}
+		staticConfig := apigen.Process(params)
+
+		// Create a synthetic file for golden tests to catch config changes.
+		f := gen.InjectFile("synthetic/static_config", "synthetic", mainModule.RootDir.Join("synthetic"), "static_config.go", "static_config")
+		configData, _ := json.MarshalIndent(staticConfig, "", "\t")
+		f.Jen.Comment(fmt.Sprintf("\nThis is a synthetic file describing the generated static config:\n\n%s\n", configData))
+	}
+
+	codegentest.Run(t, fn)
+}
diff --git a/v2/codegen/apigen/maingen/testdata/auth_handler.txt b/v2/codegen/apigen/maingen/testdata/auth_handler.txt
new file mode 100644
index 0000000000..779ea9269a
--- /dev/null
+++ b/v2/codegen/apigen/maingen/testdata/auth_handler.txt
@@ -0,0 +1,193 @@
+-- code.go --
+package code
+
+import ("context"; "encore.dev/beta/auth")
+
+//encore:api
+func Foo(ctx context.Context) error { return nil }
+
+type MyAuthData struct { Username string }
+
+//encore:authhandler
+func AuthHandler(context.Context, string) (auth.UID, *MyAuthData, error) {
+    return "", nil, nil
+}
+
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) error
+}
+-- want:encore_internal/main/main.go --
+package main
+
+import (
+	appinit "encore.dev/appruntime/apisdk/app/appinit"
+	_ "example.com"
+)
+
+func main() {
+	appinit.AppMain()
+}
+-- want:encore_internal__api.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Private,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		err := Foo(ctx)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/code.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/code.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/code.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
+-- want:encore_internal__authhandler.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	__model "encore.dev/appruntime/exported/model"
+	errs "encore.dev/beta/errs"
+	"net/http"
+	"strings"
+)
+
+var EncoreInternal_authhandler_AuthDesc_AuthHandler = &__api.AuthHandlerDesc[string]{
+	AuthHandler: func(ctx context.Context, params string) (info __model.AuthInfo, err error) {
+		info.UID, info.UserData, err = AuthHandler(ctx, params)
+		return info, err
+	},
+	DecodeAuth: func(httpReq *http.Request) (params string, err error) {
+		if auth := httpReq.Header.Get("Authorization"); auth != "" {
+			for _, prefix := range [...]string{"Bearer ", "Token "} {
+				if strings.HasPrefix(auth, prefix) {
+					if params = auth[len(prefix):]; params != "" {
+						return params, nil
+					}
+				}
+			}
+		}
+		return "", errs.B().Code(errs.Unauthenticated).Msg("invalid auth param").Err()
+	},
+	DefLoc:      uint32(0x0),
+	Endpoint:    "AuthHandler",
+	HasAuthData: true,
+	Service:     "code",
+	SvcNum:      1,
+}
+
+func init() {
+	__api.RegisterAuthHandler(EncoreInternal_authhandler_AuthDesc_AuthHandler)
+}
+
+func init() {
+	__api.RegisterAuthDataType[*MyAuthData]()
+}
+-- want:synthetic/static_config.go --
+package synthetic
+
+/*
+
+This is a synthetic file describing the generated static config:
+
+{
+	"EncoreCompiler": "",
+	"AppCommit": {
+		"revision": "",
+		"uncommitted": false
+	},
+	"CORSAllowHeaders": null,
+	"CORSExposeHeaders": null,
+	"PubsubTopics": {},
+	"Testing": false,
+	"TestServiceMap": {
+		"code": "testing_path:code"
+	},
+	"TestAppRootPath": "testing_path:main",
+	"PrettyPrintLogs": false,
+	"BundledServices": [
+		"code"
+	],
+	"EmbeddedEnvs": {}
+}
+*/
diff --git a/v2/codegen/apigen/maingen/testdata/basic.txt b/v2/codegen/apigen/maingen/testdata/basic.txt
new file mode 100644
index 0000000000..4a196ce318
--- /dev/null
+++ b/v2/codegen/apigen/maingen/testdata/basic.txt
@@ -0,0 +1,142 @@
+-- code.go --
+package code
+
+import "context"
+
+//encore:api
+func Foo(ctx context.Context) error { return nil }
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) error
+}
+-- want:encore_internal/main/main.go --
+package main
+
+import (
+	appinit "encore.dev/appruntime/apisdk/app/appinit"
+	_ "example.com"
+)
+
+func main() {
+	appinit.AppMain()
+}
+-- want:encore_internal__api.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Private,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		err := Foo(ctx)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/code.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/code.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/code.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
+-- want:synthetic/static_config.go --
+package synthetic
+
+/*
+
+This is a synthetic file describing the generated static config:
+
+{
+	"EncoreCompiler": "",
+	"AppCommit": {
+		"revision": "",
+		"uncommitted": false
+	},
+	"CORSAllowHeaders": null,
+	"CORSExposeHeaders": null,
+	"PubsubTopics": {},
+	"Testing": false,
+	"TestServiceMap": {
+		"code": "testing_path:code"
+	},
+	"TestAppRootPath": "testing_path:main",
+	"PrettyPrintLogs": false,
+	"BundledServices": [
+		"code"
+	],
+	"EmbeddedEnvs": {}
+}
+*/
diff --git a/v2/codegen/apigen/maingen/testdata/multiple_services.txt b/v2/codegen/apigen/maingen/testdata/multiple_services.txt
new file mode 100644
index 0000000000..51e1c9baa2
--- /dev/null
+++ b/v2/codegen/apigen/maingen/testdata/multiple_services.txt
@@ -0,0 +1,248 @@
+-- foo/foo.go --
+package foo
+
+import "context"
+
+//encore:api
+func Foo(ctx context.Context) error { return nil }
+-- bar/bar.go --
+package bar
+
+import "context"
+
+//encore:api
+func Bar(ctx context.Context) error { return nil }
+-- want:bar/encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package bar
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Bar(ctx context.Context) error
+}
+-- want:bar/encore_internal__api.go --
+package bar
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Bar, Bar)
+}
+
+type EncoreInternal_BarReq struct{}
+
+type EncoreInternal_BarResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Bar = &__api.Desc[*EncoreInternal_BarReq, EncoreInternal_BarResp]{
+	Access: __api.Private,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_BarReq) (EncoreInternal_BarResp, error) {
+		err := Bar(ctx)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_BarReq) (*EncoreInternal_BarReq, error) {
+		var clone *EncoreInternal_BarReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_BarResp) (EncoreInternal_BarResp, error) {
+		var clone EncoreInternal_BarResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_BarResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_BarReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_BarReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_BarReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_BarResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Bar",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/bar.Bar",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/bar.Bar",
+	ReqPath: func(reqData *EncoreInternal_BarReq) (string, __api.UnnamedParams, error) {
+		return "/bar.Bar", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_BarReq) any {
+		return nil
+	},
+	Service:           "bar",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
+-- want:encore_internal/main/main.go --
+package main
+
+import (
+	appinit "encore.dev/appruntime/apisdk/app/appinit"
+	_ "example.com/bar"
+	_ "example.com/foo"
+)
+
+func main() {
+	appinit.AppMain()
+}
+-- want:foo/encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package foo
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) error
+}
+-- want:foo/encore_internal__api.go --
+package foo
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Private,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		err := Foo(ctx)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/foo.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/foo.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/foo.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "foo",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            2,
+	Tags:              nil,
+}
+-- want:synthetic/static_config.go --
+package synthetic
+
+/*
+
+This is a synthetic file describing the generated static config:
+
+{
+	"EncoreCompiler": "",
+	"AppCommit": {
+		"revision": "",
+		"uncommitted": false
+	},
+	"CORSAllowHeaders": null,
+	"CORSExposeHeaders": null,
+	"PubsubTopics": {},
+	"Testing": false,
+	"TestServiceMap": {
+		"bar": "testing_path:bar",
+		"foo": "testing_path:foo"
+	},
+	"TestAppRootPath": "testing_path:main",
+	"PrettyPrintLogs": false,
+	"BundledServices": [
+		"bar",
+		"foo"
+	],
+	"EmbeddedEnvs": {}
+}
+*/
diff --git a/v2/codegen/apigen/maingen/testdata/service_struct.txt b/v2/codegen/apigen/maingen/testdata/service_struct.txt
new file mode 100644
index 0000000000..ee56e907f9
--- /dev/null
+++ b/v2/codegen/apigen/maingen/testdata/service_struct.txt
@@ -0,0 +1,175 @@
+-- code.go --
+package code
+
+import "context"
+
+//encore:service
+type Service struct{}
+
+//encore:api
+func (s *Service) Foo(ctx context.Context) error { return nil }
+
+func initService() (*Service, error) { return nil, nil }
+
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+import "context"
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+func Foo(ctx context.Context) error {
+	svc, err := EncoreInternal_svcstruct_Service.Get()
+	if err != nil {
+		return err
+	}
+	return svc.Foo(ctx)
+}
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	Foo(ctx context.Context) error
+}
+-- want:encore_internal/main/main.go --
+package main
+
+import (
+	appinit "encore.dev/appruntime/apisdk/app/appinit"
+	_ "example.com"
+)
+
+func main() {
+	appinit.AppMain()
+}
+-- want:encore_internal__api.go --
+package code
+
+import (
+	"context"
+	__api "encore.dev/appruntime/apisdk/api"
+	jsoniter "github.com/json-iterator/go"
+	"net/http"
+	"net/url"
+)
+
+func init() {
+	__api.RegisterEndpoint(EncoreInternal_api_APIDesc_Foo, Foo)
+}
+
+type EncoreInternal_FooReq struct{}
+
+type EncoreInternal_FooResp = __api.Void
+
+var EncoreInternal_api_APIDesc_Foo = &__api.Desc[*EncoreInternal_FooReq, EncoreInternal_FooResp]{
+	Access: __api.Private,
+	AppHandler: func(ctx context.Context, reqData *EncoreInternal_FooReq) (EncoreInternal_FooResp, error) {
+		svc, initErr := EncoreInternal_svcstruct_Service.Get()
+		if initErr != nil {
+			return __api.Void{}, initErr
+		}
+		err := svc.Foo(ctx)
+		if err != nil {
+			return __api.Void{}, err
+		}
+		return __api.Void{}, nil
+	},
+	CloneReq: func(r *EncoreInternal_FooReq) (*EncoreInternal_FooReq, error) {
+		var clone *EncoreInternal_FooReq
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	CloneResp: func(r EncoreInternal_FooResp) (EncoreInternal_FooResp, error) {
+		var clone EncoreInternal_FooResp
+		bytes, err := jsoniter.ConfigDefault.Marshal(r)
+		if err == nil {
+			err = jsoniter.ConfigDefault.Unmarshal(bytes, &clone)
+		}
+		return clone, err
+	},
+	DecodeExternalResp: func(httpResp *http.Response, json jsoniter.API) (resp EncoreInternal_FooResp, err error) {
+		return __api.Void{}, nil
+	},
+	DecodeReq: func(httpReq *http.Request, ps __api.UnnamedParams, json jsoniter.API) (reqData *EncoreInternal_FooReq, pathParams __api.UnnamedParams, err error) {
+		reqData = new(EncoreInternal_FooReq)
+		return reqData, nil, nil
+	},
+	DefLoc: uint32(0x0),
+	EncodeExternalReq: func(reqData *EncoreInternal_FooReq, stream *jsoniter.Stream) (httpHeader http.Header, queryString url.Values, err error) {
+		return nil, nil, nil
+	},
+	EncodeResp: func(w http.ResponseWriter, json jsoniter.API, resp EncoreInternal_FooResp, status int) (err error) {
+		return nil
+	},
+	Endpoint:            "Foo",
+	Fallback:            false,
+	GlobalMiddlewareIDs: []string{},
+	Methods:             []string{"GET", "POST"},
+	Path:                "/code.Foo",
+	PathParamNames:      nil,
+	Raw:                 false,
+	RawHandler:          nil,
+	RawPath:             "/code.Foo",
+	ReqPath: func(reqData *EncoreInternal_FooReq) (string, __api.UnnamedParams, error) {
+		return "/code.Foo", nil, nil
+	},
+	ReqUserPayload: func(reqData *EncoreInternal_FooReq) any {
+		return nil
+	},
+	Service:           "code",
+	ServiceMiddleware: []*__api.Middleware{},
+	SvcNum:            1,
+	Tags:              nil,
+}
+-- want:encore_internal__svcstruct.go --
+package code
+
+import __service "encore.dev/appruntime/apisdk/service"
+
+func init() {
+	__service.Register(EncoreInternal_svcstruct_Service)
+}
+
+var EncoreInternal_svcstruct_Service = &__service.Decl[Service]{
+	Name:        "Service",
+	Service:     "code",
+	Setup:       initService,
+	SetupDefLoc: uint32(0x0),
+}
+-- want:synthetic/static_config.go --
+package synthetic
+
+/*
+
+This is a synthetic file describing the generated static config:
+
+{
+	"EncoreCompiler": "",
+	"AppCommit": {
+		"revision": "",
+		"uncommitted": false
+	},
+	"CORSAllowHeaders": null,
+	"CORSExposeHeaders": null,
+	"PubsubTopics": {},
+	"Testing": false,
+	"TestServiceMap": {
+		"code": "testing_path:code"
+	},
+	"TestAppRootPath": "testing_path:main",
+	"PrettyPrintLogs": false,
+	"BundledServices": [
+		"code"
+	],
+	"EmbeddedEnvs": {}
+}
+*/
diff --git a/v2/codegen/apigen/maingen/testdata/subscription.txt b/v2/codegen/apigen/maingen/testdata/subscription.txt
new file mode 100644
index 0000000000..35257593c1
--- /dev/null
+++ b/v2/codegen/apigen/maingen/testdata/subscription.txt
@@ -0,0 +1,81 @@
+-- code.go --
+package code
+
+import "context"
+import "encore.dev/pubsub"
+
+type Event struct {}
+
+var Topic = pubsub.NewTopic[*Event]("topic", pubsub.TopicConfig{
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+
+
+var _ = pubsub.NewSubscription(Topic, "subscription",
+    pubsub.SubscriptionConfig[*Event]{
+        Handler: func(ctx context.Context, event *Event) error {
+            return nil
+        },
+    },
+)
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package code
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+-- want:encore_internal/main/main.go --
+package main
+
+import (
+	appinit "encore.dev/appruntime/apisdk/app/appinit"
+	_ "example.com"
+)
+
+func main() {
+	appinit.AppMain()
+}
+-- want:encore_internal__api.go --
+package code
+
+func init() {}
+-- want:synthetic/static_config.go --
+package synthetic
+
+/*
+
+This is a synthetic file describing the generated static config:
+
+{
+	"EncoreCompiler": "",
+	"AppCommit": {
+		"revision": "",
+		"uncommitted": false
+	},
+	"CORSAllowHeaders": null,
+	"CORSExposeHeaders": null,
+	"PubsubTopics": {
+		"topic": {
+			"Subscriptions": {
+				"subscription": {
+					"Service": "code",
+					"SvcNum": 1,
+					"TraceIdx": 0
+				}
+			}
+		}
+	},
+	"Testing": false,
+	"TestServiceMap": {
+		"code": "testing_path:code"
+	},
+	"TestAppRootPath": "testing_path:main",
+	"PrettyPrintLogs": false,
+	"BundledServices": [
+		"code"
+	],
+	"EmbeddedEnvs": {}
+}
+*/
diff --git a/v2/codegen/apigen/maingen/testgen.go b/v2/codegen/apigen/maingen/testgen.go
new file mode 100644
index 0000000000..584d3de490
--- /dev/null
+++ b/v2/codegen/apigen/maingen/testgen.go
@@ -0,0 +1,32 @@
+package maingen
+
+import (
+	"encore.dev/appruntime/exported/config"
+	"encr.dev/pkg/option"
+	"encr.dev/v2/codegen"
+)
+
+func genTestConfigs(p GenParams, test codegen.TestConfig) *config.Static {
+	for _, pkg := range test.Packages {
+		// HACK(andre) Ensure we always import the testsupport package in every test binary,
+		// since the "testing" package depends on it for the testing runtime hooks.
+		p.Gen.InsertTestSupport(pkg)
+
+		//	f := p.Gen.InjectFile(pkg.ImportPath+"!test", pkg.Name+"_test", pkg.FSPath, "encore_internal__test.go", "encoretest")
+		//	f.ImportAnon("encore.dev/appruntime/shared/testsupport")
+		//
+		//	if fw, ok := p.Desc.Framework.Get(); ok {
+		//		if ah, ok := fw.AuthHandler.Get(); ok {
+		//			f.ImportAnon(ah.Decl.File.Pkg.ImportPath)
+		//		}
+		//		for _, mw := range fw.GlobalMiddleware {
+		//			f.ImportAnon(mw.File.Pkg.ImportPath)
+		//		}
+		//	}
+	}
+
+	return GenAppConfig(p, option.Some(testParams{
+		EnvsToEmbed:        test.EnvsToEmbed,
+		ExternalTestBinary: len(test.EnvsToEmbed) > 0,
+	}))
+}
diff --git a/v2/codegen/apigen/middlewaregen/middlewaregen.go b/v2/codegen/apigen/middlewaregen/middlewaregen.go
new file mode 100644
index 0000000000..223a10f286
--- /dev/null
+++ b/v2/codegen/apigen/middlewaregen/middlewaregen.go
@@ -0,0 +1,64 @@
+package middlewaregen
+
+import (
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/apis/middleware"
+)
+
+func Gen(gen *codegen.Generator, mws []*middleware.Middleware, svcStruct option.Option[*codegen.VarDecl]) map[*middleware.Middleware]*codegen.VarDecl {
+	mwMap := make(map[*middleware.Middleware]*codegen.VarDecl)
+
+	pkgMap := make(map[*pkginfo.Package][]*middleware.Middleware)
+	for _, mw := range mws {
+		pkgMap[mw.File.Pkg] = append(pkgMap[mw.File.Pkg], mw)
+	}
+
+	for pkg, mws := range pkgMap {
+		f := gen.File(pkg, "middleware")
+		for _, mw := range mws {
+			mwMap[mw] = genMiddleware(gen, f, mw, svcStruct)
+		}
+	}
+
+	return mwMap
+}
+
+func genMiddleware(gen *codegen.Generator, f *codegen.File, mw *middleware.Middleware, svcStruct option.Option[*codegen.VarDecl]) *codegen.VarDecl {
+	invoke := Qual(mw.File.Pkg.ImportPath.String(), mw.Decl.Name)
+	if !mw.Global && mw.Recv.Present() && svcStruct.Present() {
+		invoke = Func().Params(
+			Id("req").Qual("encore.dev/middleware", "Request"),
+			Id("next").Qual("encore.dev/middleware", "Next"),
+		).Params(Qual("encore.dev/middleware", "Response")).BlockFunc(func(g *Group) {
+			g.List(Id("svc"), Err()).Op(":=").Add(svcStruct.MustGet().Qual()).Dot("Get").Call()
+			g.If(Err().Op("!=").Nil()).Block(
+				Return(Qual("encore.dev/middleware", "Response").Values(Dict{
+					Id("Err"):        Err(),
+					Id("HTTPStatus"): Qual("encore.dev/beta/errs", "HTTPStatus").Call(Err()),
+				})),
+			)
+			g.Return(Id("svc").Dot(mw.Decl.Name).Call(Id("req"), Id("next")))
+		})
+	}
+
+	decl := f.VarDecl("middleware", mw.Decl.Name).Value(Op("&").Qual("encore.dev/appruntime/apisdk/api", "Middleware").Values(Dict{
+		Id("ID"):      Lit(mw.ID()),
+		Id("PkgName"): Lit(mw.File.Pkg.Name),
+		Id("Name"):    Lit(mw.Decl.Name),
+		Id("Global"):  Lit(mw.Global),
+		Id("DefLoc"):  Lit(gen.TraceNodes.Middleware(mw)),
+		Id("Invoke"):  invoke,
+	}))
+
+	if mw.Global {
+		f.Jen.Func().Id("init").Params().Block(
+			Qual("encore.dev/appruntime/apisdk/api", "RegisterGlobalMiddleware").Call(decl.Qual()),
+		)
+	}
+
+	return decl
+}
diff --git a/v2/codegen/apigen/middlewaregen/middlewaregen_test.go b/v2/codegen/apigen/middlewaregen/middlewaregen_test.go
new file mode 100644
index 0000000000..9ff852c69e
--- /dev/null
+++ b/v2/codegen/apigen/middlewaregen/middlewaregen_test.go
@@ -0,0 +1,28 @@
+package middlewaregen
+
+import (
+	"testing"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/apigen/servicestructgen"
+	"encr.dev/v2/codegen/internal/codegentest"
+)
+
+func TestCodegen(t *testing.T) {
+	fn := func(gen *codegen.Generator, desc *app.Desc) {
+		Gen(gen, desc.Framework.MustGet().GlobalMiddleware, option.None[*codegen.VarDecl]())
+		for _, svc := range desc.Services {
+			var svcStruct option.Option[*codegen.VarDecl]
+			if fw, ok := svc.Framework.Get(); ok {
+				if ss, ok := fw.ServiceStruct.Get(); ok {
+					svcStruct = option.Some(servicestructgen.Gen(gen, svc, ss))
+				}
+			}
+			Gen(gen, svc.Framework.MustGet().Middleware, svcStruct)
+		}
+	}
+
+	codegentest.Run(t, fn)
+}
diff --git a/v2/codegen/apigen/middlewaregen/testdata/basic.txt b/v2/codegen/apigen/middlewaregen/testdata/basic.txt
new file mode 100644
index 0000000000..51cf258f77
--- /dev/null
+++ b/v2/codegen/apigen/middlewaregen/testdata/basic.txt
@@ -0,0 +1,26 @@
+-- basic.go --
+package basic
+
+import ("context"; "encore.dev/middleware")
+
+//encore:middleware target=all
+func Middleware(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+
+// Note: we need an API endpoint to be able to define service-specific middleware
+//encore:api
+func API(context.Context) error { return nil }
+-- want:encore_internal__middleware.go --
+package basic
+
+import __api "encore.dev/appruntime/apisdk/api"
+
+var EncoreInternal_middleware_middleware_Middleware = &__api.Middleware{
+	DefLoc:  uint32(0x0),
+	Global:  false,
+	ID:      "example.com.Middleware",
+	Invoke:  Middleware,
+	Name:    "Middleware",
+	PkgName: "basic",
+}
diff --git a/v2/codegen/apigen/middlewaregen/testdata/global.txt b/v2/codegen/apigen/middlewaregen/testdata/global.txt
new file mode 100644
index 0000000000..e7f37d70bb
--- /dev/null
+++ b/v2/codegen/apigen/middlewaregen/testdata/global.txt
@@ -0,0 +1,26 @@
+-- global.go --
+package global
+
+import "encore.dev/middleware"
+
+//encore:middleware global target=all
+func Middleware(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+-- want:encore_internal__middleware.go --
+package global
+
+import __api "encore.dev/appruntime/apisdk/api"
+
+func init() {
+	__api.RegisterGlobalMiddleware(EncoreInternal_middleware_middleware_Middleware)
+}
+
+var EncoreInternal_middleware_middleware_Middleware = &__api.Middleware{
+	DefLoc:  uint32(0x0),
+	Global:  true,
+	ID:      "example.com.Middleware",
+	Invoke:  Middleware,
+	Name:    "Middleware",
+	PkgName: "global",
+}
diff --git a/v2/codegen/apigen/middlewaregen/testdata/service_struct.txt b/v2/codegen/apigen/middlewaregen/testdata/service_struct.txt
new file mode 100644
index 0000000000..3d3549e4ea
--- /dev/null
+++ b/v2/codegen/apigen/middlewaregen/testdata/service_struct.txt
@@ -0,0 +1,57 @@
+-- code.go --
+package code
+
+import ("context"; "encore.dev/middleware")
+
+//encore:service
+type Service struct{}
+
+//encore:middleware target=all
+func (s *Service) Middleware(req middleware.Request, next middleware.Next) middleware.Response {
+    return next(req)
+}
+
+// Note: we need an API endpoint to be able to define service-specific middleware
+//encore:api
+func (s *Service) API(context.Context) error { return nil }
+-- want:encore_internal__middleware.go --
+package code
+
+import (
+	__api "encore.dev/appruntime/apisdk/api"
+	errs "encore.dev/beta/errs"
+	middleware "encore.dev/middleware"
+)
+
+var EncoreInternal_middleware_middleware_Middleware = &__api.Middleware{
+	DefLoc: uint32(0x0),
+	Global: false,
+	ID:     "example.com.Middleware",
+	Invoke: func(req middleware.Request, next middleware.Next) middleware.Response {
+		svc, err := EncoreInternal_svcstruct_Service.Get()
+		if err != nil {
+			return middleware.Response{
+				Err:        err,
+				HTTPStatus: errs.HTTPStatus(err),
+			}
+		}
+		return svc.Middleware(req, next)
+	},
+	Name:    "Middleware",
+	PkgName: "code",
+}
+-- want:encore_internal__svcstruct.go --
+package code
+
+import __service "encore.dev/appruntime/apisdk/service"
+
+func init() {
+	__service.Register(EncoreInternal_svcstruct_Service)
+}
+
+var EncoreInternal_svcstruct_Service = &__service.Decl[Service]{
+	Name:        "Service",
+	Service:     "code",
+	Setup:       nil,
+	SetupDefLoc: uint32(0x0),
+}
diff --git a/v2/codegen/apigen/servicestructgen/servicestructgen.go b/v2/codegen/apigen/servicestructgen/servicestructgen.go
new file mode 100644
index 0000000000..2988037a7d
--- /dev/null
+++ b/v2/codegen/apigen/servicestructgen/servicestructgen.go
@@ -0,0 +1,33 @@
+package servicestructgen
+
+import (
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/parser/apis/servicestruct"
+)
+
+func Gen(gen *codegen.Generator, svc *app.Service, s *servicestruct.ServiceStruct) *codegen.VarDecl {
+	initFuncName := option.Map(s.Init, func(init *schema.FuncDecl) *Statement {
+		return Id(init.Name)
+	}).GetOrElse(Nil())
+
+	f := gen.File(s.Decl.File.Pkg, "svcstruct")
+	decl := f.VarDecl(s.Decl.Name).Value(Op("&").Qual("encore.dev/appruntime/apisdk/service", "Decl").Types(
+		Id(s.Decl.Name),
+	).Values(Dict{
+		Id("Service"):     Lit(svc.Name),
+		Id("Name"):        Lit(s.Decl.Name),
+		Id("Setup"):       initFuncName,
+		Id("SetupDefLoc"): Lit(gen.TraceNodes.SvcStruct(s)),
+	}))
+
+	f.Jen.Func().Id("init").Params().Block(
+		Qual("encore.dev/appruntime/apisdk/service", "Register").Call(decl.Qual()),
+	)
+
+	return decl
+}
diff --git a/v2/codegen/apigen/servicestructgen/servicestructgen_test.go b/v2/codegen/apigen/servicestructgen/servicestructgen_test.go
new file mode 100644
index 0000000000..3bc83d79d1
--- /dev/null
+++ b/v2/codegen/apigen/servicestructgen/servicestructgen_test.go
@@ -0,0 +1,18 @@
+package servicestructgen
+
+import (
+	"testing"
+
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/internal/codegentest"
+)
+
+func TestCodegen(t *testing.T) {
+	fn := func(gen *codegen.Generator, desc *app.Desc) {
+		svc := desc.Services[0]
+		Gen(gen, svc, svc.Framework.MustGet().ServiceStruct.MustGet())
+	}
+
+	codegentest.Run(t, fn)
+}
diff --git a/v2/codegen/apigen/servicestructgen/testdata/basic.txt b/v2/codegen/apigen/servicestructgen/testdata/basic.txt
new file mode 100644
index 0000000000..e666d86775
--- /dev/null
+++ b/v2/codegen/apigen/servicestructgen/testdata/basic.txt
@@ -0,0 +1,26 @@
+-- basic.go --
+package basic
+
+import "context"
+
+//encore:service
+type Service struct {
+}
+
+//encore:api
+func API(context.Context) error { return nil }
+-- want:encore_internal__svcstruct.go --
+package basic
+
+import __service "encore.dev/appruntime/apisdk/service"
+
+func init() {
+	__service.Register(EncoreInternal_svcstruct_Service)
+}
+
+var EncoreInternal_svcstruct_Service = &__service.Decl[Service]{
+	Name:        "Service",
+	Service:     "basic",
+	Setup:       nil,
+	SetupDefLoc: uint32(0x0),
+}
diff --git a/v2/codegen/apigen/servicestructgen/testdata/init_svc.txt b/v2/codegen/apigen/servicestructgen/testdata/init_svc.txt
new file mode 100644
index 0000000000..4c4b9b7ef3
--- /dev/null
+++ b/v2/codegen/apigen/servicestructgen/testdata/init_svc.txt
@@ -0,0 +1,30 @@
+-- basic.go --
+package basic
+
+import "context"
+
+//encore:service
+type Service struct {
+}
+
+func initService() (*Service, error) {
+    return nil, nil
+}
+
+//encore:api
+func API(context.Context) error { return nil }
+-- want:encore_internal__svcstruct.go --
+package basic
+
+import __service "encore.dev/appruntime/apisdk/service"
+
+func init() {
+	__service.Register(EncoreInternal_svcstruct_Service)
+}
+
+var EncoreInternal_svcstruct_Service = &__service.Decl[Service]{
+	Name:        "Service",
+	Service:     "basic",
+	Setup:       initService,
+	SetupDefLoc: uint32(0x0),
+}
diff --git a/v2/codegen/apigen/userfacinggen/testdata/service_struct.txt b/v2/codegen/apigen/userfacinggen/testdata/service_struct.txt
new file mode 100644
index 0000000000..ddc9f63503
--- /dev/null
+++ b/v2/codegen/apigen/userfacinggen/testdata/service_struct.txt
@@ -0,0 +1,150 @@
+-- basic.go --
+package basic
+
+import ("context"; "net/http")
+
+//encore:service
+type Service struct{}
+
+// Foo is an amazing API which does
+// x, y and z - it's really cool!
+//encore:api public
+func (s *Service) Foo(ctx context.Context) error { return nil }
+
+//encore:api public raw
+func (s *Service) Raw(w http.ResponseWriter, req *http.Request) {}
+
+type Data struct{}
+
+//encore:api public
+func (s *Service) WithReq(context.Context, *Data) error { return nil }
+
+//encore:api public
+func (s *Service) WithResp(context.Context) (*Data, error) { return nil, nil }
+
+//encore:api public
+func (s *Service) WithReqResp(context.Context, *Data) (*Data, error) { return nil, nil }
+
+//encore:api public path=/pathing/:name/:age/*other
+func (s *Service) WithPathParams(ctx context.Context, name string, age int, other string) error { return nil }
+
+//encore:api public path=/fallback/!url
+func (s *Service) WithFallback(ctx context.Context, url string) error { return nil }
+
+// This API doesn't
+// exist on the service struct, but should still
+// appear
+//
+// on the service Interface
+//encore:api public
+func NoServiceStruct(context.Context) error { return nil }
+-- want:encore.gen.go --
+// Code generated by encore. DO NOT EDIT.
+
+package basic
+
+import (
+	"context"
+	"errors"
+	"net/http"
+)
+
+// These functions are automatically generated and maintained by Encore
+// to simplify calling them from other services, as they were implemented as methods.
+// They are automatically updated by Encore whenever your API endpoints change.
+
+// Foo is an amazing API which does
+// x, y and z - it's really cool!
+func Foo(ctx context.Context) error {
+	svc, err := EncoreInternal_svcstruct_Service.Get()
+	if err != nil {
+		return err
+	}
+	return svc.Foo(ctx)
+}
+
+func Raw(ctx context.Context, req *http.Request) (*http.Response, error) {
+	return nil, errors.New("encore: calling raw endpoints is not yet supported")
+}
+
+func WithReq(ctx context.Context, p *Data) error {
+	svc, err := EncoreInternal_svcstruct_Service.Get()
+	if err != nil {
+		return err
+	}
+	return svc.WithReq(ctx, p)
+}
+
+func WithResp(ctx context.Context) (*Data, error) {
+	svc, err := EncoreInternal_svcstruct_Service.Get()
+	if err != nil {
+		return (*Data)(nil), err
+	}
+	return svc.WithResp(ctx)
+}
+
+func WithReqResp(ctx context.Context, p *Data) (*Data, error) {
+	svc, err := EncoreInternal_svcstruct_Service.Get()
+	if err != nil {
+		return (*Data)(nil), err
+	}
+	return svc.WithReqResp(ctx, p)
+}
+
+func WithPathParams(ctx context.Context, name string, age int, other string) error {
+	svc, err := EncoreInternal_svcstruct_Service.Get()
+	if err != nil {
+		return err
+	}
+	return svc.WithPathParams(ctx, name, age, other)
+}
+
+func WithFallback(ctx context.Context, url string) error {
+	svc, err := EncoreInternal_svcstruct_Service.Get()
+	if err != nil {
+		return err
+	}
+	return svc.WithFallback(ctx, url)
+}
+
+// Interface defines the service's API surface area, primarily for mocking purposes.
+//
+// Raw endpoints are currently excluded from this interface, as Encore does not yet
+// support service-to-service API calls to raw endpoints.
+type Interface interface {
+	// Foo is an amazing API which does
+	// x, y and z - it's really cool!
+	Foo(ctx context.Context) error
+
+	WithReq(ctx context.Context, p *Data) error
+
+	WithResp(ctx context.Context) (*Data, error)
+
+	WithReqResp(ctx context.Context, p *Data) (*Data, error)
+
+	WithPathParams(ctx context.Context, name string, age int, other string) error
+
+	WithFallback(ctx context.Context, url string) error
+
+	// This API doesn't
+	// exist on the service struct, but should still
+	// appear
+	//
+	// on the service Interface
+	NoServiceStruct(ctx context.Context) error
+}
+-- want:encore_internal__svcstruct.go --
+package basic
+
+import __service "encore.dev/appruntime/apisdk/service"
+
+func init() {
+	__service.Register(EncoreInternal_svcstruct_Service)
+}
+
+var EncoreInternal_svcstruct_Service = &__service.Decl[Service]{
+	Name:        "Service",
+	Service:     "basic",
+	Setup:       nil,
+	SetupDefLoc: uint32(0x0),
+}
diff --git a/v2/codegen/apigen/userfacinggen/userfacinggen.go b/v2/codegen/apigen/userfacinggen/userfacinggen.go
new file mode 100644
index 0000000000..9600dcd252
--- /dev/null
+++ b/v2/codegen/apigen/userfacinggen/userfacinggen.go
@@ -0,0 +1,185 @@
+package userfacinggen
+
+import (
+	"strings"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/pkg/namealloc"
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app"
+	"encr.dev/v2/app/apiframework"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/internal/genutil"
+	"encr.dev/v2/parser/apis/api"
+)
+
+// Gen generates the encore.gen.go file containing user-facing
+// generated code. If nothing needs to be generated it returns nil.
+func Gen(gen *codegen.Generator, svc *app.Service, withSvcStructImpl option.Option[*codegen.VarDecl]) option.Option[*codegen.File] {
+	if fw, ok := svc.Framework.Get(); ok {
+		return genUserFacing(gen, fw, withSvcStructImpl)
+	}
+	return option.None[*codegen.File]()
+}
+
+func genUserFacing(gen *codegen.Generator, svc *apiframework.ServiceDesc, withImpl option.Option[*codegen.VarDecl]) option.Option[*codegen.File] {
+	f := gen.InjectFile(svc.RootPkg.ImportPath, svc.RootPkg.Name, svc.RootPkg.FSPath,
+		"encore.gen.go", "encoregen")
+
+	f.Jen.HeaderComment("Code generated by encore. DO NOT EDIT.")
+
+	f.Jen.Comment("These functions are automatically generated and maintained by Encore")
+	f.Jen.Comment("to simplify calling them from other services, as they were implemented as methods.")
+	f.Jen.Comment("They are automatically updated by Encore whenever your API endpoints change.")
+	f.Jen.Line()
+
+	// count is the number of declarations we've generated in this file
+	count := 0
+
+	// Generate endpoint functions for endpoints defined on the service struct
+	for _, ep := range svc.Endpoints {
+		if ep.Recv.Empty() {
+			continue
+		}
+
+		genEndpoint(gen.Util, f, ep, withImpl)
+		f.Jen.Line()
+		count++
+	}
+
+	// Generate the service interface (this is useful for mocking)
+	if len(svc.Endpoints) > 0 {
+		f.Jen.Comment("Interface defines the service's API surface area, primarily for mocking purposes.")
+		f.Jen.Comment("")
+		f.Jen.Comment("Raw endpoints are currently excluded from this interface, as Encore does not yet")
+		f.Jen.Comment("support service-to-service API calls to raw endpoints.")
+		f.Jen.Type().Id("Interface").InterfaceFunc(func(g *Group) {
+			for _, ep := range svc.Endpoints {
+				if !ep.Raw {
+					getEndpointPrototype(gen.Util, g, ep, false, option.None[*codegen.VarDecl]())
+					count++
+					g.Line()
+				}
+			}
+		})
+		f.Jen.Line()
+	}
+
+	if count == 0 {
+		// If we've generated no declarations, then this file can be deleted
+		return option.None[*codegen.File]()
+	} else {
+		return option.Some(f)
+	}
+}
+
+func genEndpoint(gu *genutil.Helper, f *codegen.File, ep *api.Endpoint, withImpl option.Option[*codegen.VarDecl]) {
+	stmt, pathParamNames, alloc, ctxName, paramName := getEndpointPrototype(gu, f.Jen.Group, ep, true, withImpl)
+	stmt.BlockFunc(func(g *Group) {
+		if svcStruct, ok := withImpl.Get(); ok {
+			if ep.Raw {
+				g.Return(Nil(), Qual("errors", "New").Call(Lit("encore: calling raw endpoints is not yet supported")))
+			} else {
+				svcName := alloc("svc", false)
+				g.List(Id(svcName), Err()).Op(":=").Id(svcStruct.Name()).Dot("Get").Call()
+				g.If(Err().Op("!=").Nil()).Block(ReturnFunc(func(g *Group) {
+					if ep.Raw {
+						g.Nil()
+					} else if ep.Response != nil {
+						g.Add(gu.Zero(ep.Response))
+					}
+					g.Err()
+				}))
+
+				g.Return(Id("svc").Dot(ep.Name).CallFunc(func(g *Group) {
+					g.Id(ctxName)
+					for _, name := range pathParamNames {
+						g.Id(name)
+					}
+					if paramName != "" {
+						g.Id(paramName)
+					}
+				}))
+			}
+		} else {
+			g.Comment("The implementation is elided here, and generated at compile-time by Encore.")
+			if ep.Raw {
+				g.Return(Nil(), Nil())
+			} else if ep.Response != nil {
+				g.Return(gu.Zero(ep.Response), Nil())
+			} else {
+				// Just an error return
+				g.Return(Nil())
+			}
+		}
+	})
+}
+
+func getEndpointPrototype(gu *genutil.Helper, grp *Group, ep *api.Endpoint, withFuncKeyWord bool, withImpl option.Option[*codegen.VarDecl]) (*Statement, []string, func(input string, pathParam bool) string, string, string) {
+	// Add the doc comment
+	if ep.Doc != "" {
+		for _, line := range strings.Split(strings.TrimSpace(ep.Doc), "\n") {
+			grp.Comment(line)
+		}
+	}
+
+	var pathParamNames []string
+
+	var names namealloc.Allocator
+	alloc := func(input string, pathParam bool) string {
+		name := names.Get(input)
+		if pathParam {
+			pathParamNames = append(pathParamNames, name)
+		}
+		return name
+	}
+
+	var (
+		ctxName    = alloc("ctx", false)
+		rawReqName string
+		paramName  string
+	)
+
+	var stmt *Statement
+	if withFuncKeyWord {
+		stmt = grp.Func().Id(ep.Name)
+	} else {
+		stmt = grp.Id(ep.Name)
+	}
+
+	stmt = stmt.ParamsFunc(func(g *Group) {
+		g.Id(ctxName).Qual("context", "Context")
+		for _, p := range ep.Path.Params() {
+			typ := gu.Builtin(p.Pos(), p.ValueType)
+			g.Id(alloc(p.Value, true)).Add(typ)
+		}
+		if ep.Raw {
+			rawReqName = alloc("req", false)
+			g.Id(rawReqName).Op("*").Qual("net/http", "Request")
+		} else if req := ep.Request; req != nil {
+			paramName = alloc("p", false)
+			g.Id(paramName).Add(gu.Type(req))
+		}
+	}).Do(func(s *Statement) {
+		if withImpl.Present() {
+			if ep.Raw {
+				s.Params(Op("*").Qual("net/http", "Response"), Error())
+			} else if resp := ep.Response; resp != nil {
+				s.Params(gu.Type(resp), Error())
+			} else {
+				s.Params(Error())
+			}
+		} else {
+			if ep.Raw {
+				s.Params(Op("*").Qual("net/http", "Response"), Error())
+			} else if resp := ep.Response; resp != nil {
+				s.Params(gu.Type(resp), Error())
+			} else {
+				s.Error()
+			}
+		}
+	})
+
+	return stmt, pathParamNames, alloc, ctxName, paramName
+}
diff --git a/v2/codegen/apigen/userfacinggen/userfacinggen_test.go b/v2/codegen/apigen/userfacinggen/userfacinggen_test.go
new file mode 100644
index 0000000000..d0ebb1fdcd
--- /dev/null
+++ b/v2/codegen/apigen/userfacinggen/userfacinggen_test.go
@@ -0,0 +1,26 @@
+package userfacinggen
+
+import (
+	"testing"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/apigen/servicestructgen"
+	"encr.dev/v2/codegen/internal/codegentest"
+)
+
+func TestCodegen(t *testing.T) {
+	fn := func(gen *codegen.Generator, desc *app.Desc) {
+		svc := desc.Services[0]
+		var svcStruct option.Option[*codegen.VarDecl]
+		if fw, ok := svc.Framework.Get(); ok {
+			if ss, ok := fw.ServiceStruct.Get(); ok {
+				decl := servicestructgen.Gen(gen, svc, ss)
+				svcStruct = option.Some(decl)
+			}
+		}
+		Gen(gen, svc, svcStruct)
+	}
+	codegentest.Run(t, fn)
+}
diff --git a/v2/codegen/config.go b/v2/codegen/config.go
new file mode 100644
index 0000000000..a8503f3146
--- /dev/null
+++ b/v2/codegen/config.go
@@ -0,0 +1,18 @@
+package codegen
+
+import (
+	"encr.dev/v2/internals/pkginfo"
+)
+
+// TestConfig describes common configuration for code generation
+// when running tests.
+type TestConfig struct {
+	// Packages are the packages to generate test code for.
+	Packages []*pkginfo.Package
+
+	// EnvsToEmbed are the environment variables to embed inside
+	// the test binaries themselves. This is useful when
+	// building tests with "go test -c", where the binary is
+	// built first and executed later (such as by GoLand).
+	EnvsToEmbed map[string]string
+}
diff --git a/v2/codegen/cuegen/definition_generator.go b/v2/codegen/cuegen/definition_generator.go
new file mode 100644
index 0000000000..2b71ffef9e
--- /dev/null
+++ b/v2/codegen/cuegen/definition_generator.go
@@ -0,0 +1,167 @@
+package cuegen
+
+import (
+	"bytes"
+	"fmt"
+	"slices"
+	"strings"
+
+	"cuelang.org/go/cue/ast"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+)
+
+// definitionGenerator is used to count the number of types a specific named type
+// is used (named types include type arguments, such that Option[string] != Option[int]).
+//
+// It also counts the number of times a unique named type uses a decl.
+//
+// This allows us to:
+// - determine if we should inline a named type into a config field if it's only used once
+// - generate a unique name for a generic decl if it's used with multiple type arguments
+type definitionGenerator struct {
+	seenTypes      map[schemautil.TypeHash]schema.NamedType
+	definitionName map[schemautil.TypeHash]string // type -> name
+	counts         map[schemautil.TypeHash]int    // type -> usage count
+	nameCount      map[string]int                 // name -> usage count for base name
+}
+
+func newDefinitionGenerator() *definitionGenerator {
+	return &definitionGenerator{
+		seenTypes:      make(map[schemautil.TypeHash]schema.NamedType),
+		definitionName: make(map[schemautil.TypeHash]string),
+		nameCount:      make(map[string]int),
+		counts:         make(map[schemautil.TypeHash]int),
+	}
+}
+
+// ID returns the id for the named type. If two named types are passed in
+// which are identical, it will return the same id.
+//
+// This function then also creates a unique definition name for the named type
+// which we could use within the generated CUE file
+func (n *definitionGenerator) hash(named schema.NamedType) schemautil.TypeHash {
+	hash := schemautil.Hash(named)
+	if _, ok := n.seenTypes[hash]; ok {
+		return hash
+	}
+	n.seenTypes[hash] = named
+
+	// Create a unique name for this definition
+	defaultName := n.typeToDefinitionName(named)
+	usageCount, found := n.nameCount[defaultName]
+	if !found {
+		n.definitionName[hash] = defaultName
+	} else {
+		n.definitionName[hash] = fmt.Sprintf("%s_%d", defaultName, usageCount)
+	}
+	n.nameCount[defaultName] = usageCount + 1
+
+	return hash
+}
+
+func (n *definitionGenerator) CueIdent(named schema.NamedType) *ast.Ident {
+	return ast.NewIdent("#" + n.definitionName[n.hash(named)])
+}
+
+func (n *definitionGenerator) Inc(named schema.NamedType) {
+	id := n.hash(named)
+	n.counts[id]++
+}
+
+func (n *definitionGenerator) Count(named schema.NamedType) int {
+	id := n.hash(named)
+	return n.counts[id]
+}
+
+func (n *definitionGenerator) NamesWithCountsOver(x int) []schema.NamedType {
+	rtn := make([]schema.NamedType, 0, len(n.seenTypes))
+
+	// Get the keys in sorted order for deterministic output
+	keys := fns.MapKeys(n.seenTypes)
+	slices.SortFunc(keys, func(a, b schemautil.TypeHash) int {
+		return bytes.Compare(a[:], b[:])
+	})
+
+	for _, hash := range keys {
+		if n.counts[hash] > x {
+			rtn = append(rtn, n.seenTypes[hash])
+		}
+	}
+
+	return rtn
+}
+
+// typeToDefinitionName converts a schema type into a possible name we could
+// use for the CUE definition.
+//
+// It will not return anything for inline structs.
+// It will include type arguments in the name so the same decl created with
+// different types will result in different names.
+func (n *definitionGenerator) typeToDefinitionName(typ schema.Type) string {
+	switch typ := typ.(type) {
+	case schema.NamedType:
+		var name strings.Builder
+		name.WriteString(typ.DeclInfo.Name)
+		for _, typeArg := range typ.TypeArgs {
+			name.WriteString("_")
+			name.WriteString(n.typeToDefinitionName(typeArg))
+		}
+		return name.String()
+	case schema.ListType:
+		return "List_" + n.typeToDefinitionName(typ.Elem)
+	case schema.MapType:
+		return "Map_" + n.typeToDefinitionName(typ.Key) + "_" + n.typeToDefinitionName(typ.Value)
+	case schema.PointerType:
+		return n.typeToDefinitionName(typ.Elem)
+	case schema.BuiltinType:
+		switch typ.Kind {
+		case schema.Any:
+			return "any"
+		case schema.Bool:
+			return "bool"
+		case schema.Int8:
+			return "int8"
+		case schema.Int16:
+			return "int16"
+		case schema.Int32:
+			return "int32"
+		case schema.Int64:
+			return "int64"
+		case schema.Uint8:
+			return "uint8"
+		case schema.Uint16:
+			return "uint16"
+		case schema.Uint32:
+			return "uint32"
+		case schema.Uint64:
+			return "uint64"
+		case schema.Float32:
+			return "float32"
+		case schema.Float64:
+			return "float64"
+		case schema.String:
+			return "string"
+		case schema.Bytes:
+			return "bytes"
+		case schema.Time:
+			return "string"
+		case schema.UUID:
+			return "string"
+		case schema.JSON:
+			return "string"
+		case schema.UserID:
+			return "string"
+		case schema.Int:
+			return "int"
+		case schema.Uint:
+			return "uint"
+		default:
+			return ""
+		}
+	}
+
+	return ""
+}
diff --git a/v2/codegen/cuegen/errors.go b/v2/codegen/cuegen/errors.go
new file mode 100644
index 0000000000..3ff2a4350c
--- /dev/null
+++ b/v2/codegen/cuegen/errors.go
@@ -0,0 +1,25 @@
+package cuegen
+
+import "encr.dev/pkg/errors"
+
+var (
+	errRange = errors.Range(
+		"cuegen",
+		"",
+	)
+
+	errNotNamedStruct = errRange.New(
+		"Invalid type for config.Load",
+		"The type argument passed to config.Load must be a named struct type.",
+	)
+
+	errInvalidFieldLabel = errRange.New(
+		"Invalid field label",
+		"The field could not be rendered as a valid CUE label.",
+	)
+
+	errInvalidCUEExpr = errRange.New(
+		"Invalid CUE struct tag expression",
+		"The struct tag expression is not a valid CUE expression.",
+	)
+)
diff --git a/v2/codegen/cuegen/generator.go b/v2/codegen/cuegen/generator.go
new file mode 100644
index 0000000000..5cff11a077
--- /dev/null
+++ b/v2/codegen/cuegen/generator.go
@@ -0,0 +1,110 @@
+package cuegen
+
+import (
+	"bytes"
+	"cmp"
+	"slices"
+
+	"cuelang.org/go/cue/ast"
+	"cuelang.org/go/cue/ast/astutil"
+	"cuelang.org/go/cue/format"
+	"cuelang.org/go/cue/token"
+
+	"encr.dev/v2/app"
+	"encr.dev/v2/parser/infra/config"
+)
+
+type Generator struct {
+	desc *app.Desc
+}
+
+func NewGenerator(desc *app.Desc) *Generator {
+	return &Generator{
+		desc: desc,
+	}
+}
+
+// UserFacing generates a CUE file for the given service.
+//
+// It includes constraints and requirements based on the types passed to `encore.dev/config.Load[T]()`
+// within the service.
+func (g *Generator) UserFacing(svc *app.Service) ([]byte, error) {
+	var loads []*config.Load
+	for res := range svc.ResourceBinds {
+		if cfg, ok := res.(*config.Load); ok {
+			loads = append(loads, cfg)
+		}
+	}
+	if len(loads) == 0 {
+		return nil, nil
+	}
+
+	// Sort the loads so we iterate over them in a deterministic order.
+	slices.SortFunc(loads, func(a, b *config.Load) int {
+		// Sort by package path, then file name, then position.
+		// We can't sort by position first because we're not guaranteed
+		// files are added to the *token.FileSet in the same order since
+		// we're parsing files concurrently.
+		if n := cmp.Compare(a.File.Pkg.ImportPath, b.File.Pkg.ImportPath); n != 0 {
+			return n
+		} else if n := cmp.Compare(a.File.Name, b.File.Name); n != 0 {
+			return n
+		} else {
+			return cmp.Compare(a.Pos(), b.Pos())
+		}
+	})
+
+	// Create a base file
+	service := &serviceFile{
+		g:             g,
+		svc:           svc,
+		file:          &ast.File{},
+		neededImports: make(map[string]string),
+		fieldLookup:   make(map[string]*ast.Field),
+		typeUsage:     newDefinitionGenerator(),
+	}
+
+	// Count the number of times each named type is used
+	// this allows us to determine if we inline the named type
+	// or create and use a Definition
+	for _, configLoad := range loads {
+		service.countNamedUsagesAndCollectImports(configLoad.Type)
+	}
+
+	// Add all the top level fields required by this service
+	for _, configLoad := range loads {
+		service.registerTopLevelField(configLoad.Type)
+	}
+
+	// For the first top level field in a service, if it's not go a comment above it, then we want to put it's label position
+	// as a new section. This forces a blank line between the type declarations and the first field.
+	if len(service.topLevelFields) > 0 {
+		if field, ok := service.topLevelFields[0].(*ast.Field); ok {
+			if !hasCommentInPosition(field, 0) {
+				if ident, ok := field.Label.(*ast.Ident); ok {
+					ident.NamePos = token.NewSection.Pos()
+				}
+			}
+		}
+	}
+
+	// Now generate the CUE
+	service.generateCue()
+
+	// Cleanup the generated AST
+	if err := astutil.Sanitize(service.file); err != nil {
+		return nil, err
+	}
+
+	// Format the AST into a set of bytes we can write
+	b, err := format.Node(
+		service.file,
+		format.Simplify(),
+		format.UseSpaces(4),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	return bytes.TrimSpace(b), nil
+}
diff --git a/v2/codegen/cuegen/generator_test.go b/v2/codegen/cuegen/generator_test.go
new file mode 100644
index 0000000000..27097b9338
--- /dev/null
+++ b/v2/codegen/cuegen/generator_test.go
@@ -0,0 +1,62 @@
+package cuegen
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/pkg/golden"
+	"encr.dev/v2/app"
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser"
+)
+
+func TestMain(m *testing.M) {
+	golden.TestMain(m)
+}
+
+func TestCodeGen_TestMain(t *testing.T) {
+	c := qt.New(t)
+	tests, err := filepath.Glob("./testdata/*.txt")
+	if err != nil {
+		t.Fatal(err)
+	}
+	c.Assert(err, qt.IsNil)
+
+	for _, test := range tests {
+		path := test
+		name := strings.TrimSuffix(filepath.Base(test), ".txt")
+		c.Run(name, func(c *qt.C) {
+			archiveData, err := os.ReadFile(path)
+			c.Assert(err, qt.IsNil)
+			a := txtar.Parse(archiveData)
+
+			a.Files = append(a.Files, txtar.File{
+				Name: "go.mod",
+				Data: []byte("module encore.app\nrequire encore.dev v1.13.4\n"),
+			})
+
+			tc := testutil.NewContext(c, false, a)
+			tc.GoModDownload()
+
+			tc.FailTestOnErrors()
+			defer tc.FailTestOnBailout()
+
+			result := parser.NewParser(tc.Context).Parse()
+			desc := app.ValidateAndDescribe(tc.Context, result)
+			gen := NewGenerator(desc)
+
+			for _, svc := range desc.Services {
+				f, err := gen.UserFacing(svc)
+				c.Assert(err, qt.IsNil)
+
+				golden.TestAgainst(c.TB, fmt.Sprintf("%s_%s.cue", name, svc.Name), string(f))
+			}
+		})
+	}
+}
diff --git a/v2/codegen/cuegen/service.go b/v2/codegen/cuegen/service.go
new file mode 100644
index 0000000000..ce53ecc56e
--- /dev/null
+++ b/v2/codegen/cuegen/service.go
@@ -0,0 +1,461 @@
+package cuegen
+
+import (
+	"fmt"
+	"reflect"
+	"slices"
+
+	"cuelang.org/go/cue/ast"
+	"cuelang.org/go/cue/parser"
+	"cuelang.org/go/cue/token"
+
+	"encr.dev/v2/app"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+)
+
+// service represents the single generated file we will create for a service
+// from all of it's config.Load calls
+type serviceFile struct {
+	errs           *perr.List
+	g              *Generator
+	svc            *app.Service
+	file           *ast.File
+	neededImports  map[string]string // map of package path to name
+	topLevelFields []any
+	fieldLookup    map[string]*ast.Field
+
+	typeUsage *definitionGenerator
+}
+
+// countNamedUsagesAndCollectImports counts the number of times a named type is used in the service
+func (s *serviceFile) countNamedUsagesAndCollectImports(typ schema.Type) {
+	var processType func(typ schema.Type)
+	processType = func(typ schema.Type) {
+		switch typ := typ.(type) {
+		case schema.NamedType:
+			if unwrapped, wasConfig := unwrapConfig(s.errs, typ); wasConfig {
+				processType(unwrapped)
+			} else {
+				s.typeUsage.Inc(typ)
+			}
+
+		case schema.BuiltinType:
+			if typ.Kind == schema.Time {
+				s.neededImports["time"] = "time"
+			}
+		}
+	}
+
+	schemautil.Walk(typ, func(typ schema.Type) bool {
+		processType(typ)
+		return true
+	})
+}
+
+func (s *serviceFile) registerTopLevelField(typ schema.Type) {
+	st, ok := schemautil.ResolveNamedStruct(typ, false)
+	if !ok {
+		s.errs.Add(errNotNamedStruct.AtGoNode(typ.ASTExpr()))
+		return
+	}
+	concrete := schemautil.ConcretizeWithTypeArgs(s.errs, st.Decl.Type, st.TypeArgs)
+
+	fields := s.structToFields(concrete.(schema.StructType))
+
+	for _, field := range fields {
+		f := field.CUE
+		name, _, err := ast.LabelName(f.Label)
+		if err != nil {
+			s.errs.Add(errInvalidFieldLabel.AtGoNode(field.Go.AST).Wrapping(err))
+			continue
+		}
+
+		// If we already know about the field, merge the definitions
+		// (this could be the case from multiple calls to `config.Load` inside
+		// the same service to either the same or different struct types
+		// with both have the same field name
+		if existing, found := s.fieldLookup[name]; found {
+			if len(f.Comments()) > 0 {
+				if len(existing.Comments()) == 0 {
+					existing.SetComments(f.Comments())
+				} else {
+					existingCommentGrp := existing.Comments()[0]
+					for _, comment := range f.Comments() {
+						if !commentAlreadyPresent(existing, comment) {
+							existingCommentGrp.List = append(existingCommentGrp.List, comment.List...)
+						}
+					}
+
+					// If after this check the existing comment group is now multiline, we need to move the comment groups
+					// position to be before the field label.
+					if len(existingCommentGrp.List) > 0 {
+						existingCommentGrp.Position = 0
+						existingCommentGrp.List[0].Slash = token.NewSection.Pos()
+					}
+				}
+			}
+
+			// Merge the values if they are different
+			if !reflect.DeepEqual(existing.Value, f.Value) {
+				existing.Value = ast.NewBinExpr(token.AND, existing.Value, f.Value)
+			}
+		} else {
+			// otherwise add this field
+			s.fieldLookup[name] = f
+			s.topLevelFields = append(s.topLevelFields, f)
+		}
+	}
+}
+
+func (s *serviceFile) generateCue() {
+	// If there are no top level fields, we've got nothing to do here
+	if len(s.topLevelFields) == 0 {
+		return
+	}
+
+	// Add the package name and description comment
+	pkg := &ast.Package{Name: ast.NewIdent(s.svc.Name)}
+	s.file.Decls = append(s.file.Decls, pkg)
+	s.file.AddComment(&ast.CommentGroup{
+		List: []*ast.Comment{
+			{Text: "// Code generated by encore. DO NOT EDIT."},
+			{Text: "//"},
+			{Text: "// The contents of this file are generated from the structs used in"},
+			{Text: "// conjunction with Encore's `config.Load[T]()` function. This file"},
+			{Text: "// automatically be regenerated if the data types within the struct"},
+			{Text: "// are changed."},
+			{Text: "//"},
+			{Text: "// For more information about this file, see:"},
+			{Text: "// https://encore.dev/docs/develop/config"},
+		},
+	})
+
+	s.generateEnvironmentalDefinitions()
+
+	// Add any missing imports
+	if len(s.neededImports) > 0 {
+		// Get an ordered list of the imports
+		imports := make([]string, 0, len(s.neededImports))
+		for pkg := range s.neededImports {
+			imports = append(imports, pkg)
+		}
+		slices.Sort(imports)
+
+		// Create all the import specs
+		for _, importPath := range imports {
+			var ident *ast.Ident = nil
+			if s.neededImports[importPath] != importPath {
+				ident = ast.NewIdent(s.neededImports[importPath])
+			}
+
+			spec := ast.NewImport(ident, importPath)
+			s.file.Imports = append(s.file.Imports, spec)
+		}
+
+		// Now add the import statement
+		s.file.Decls = append(s.file.Decls, &ast.ImportDecl{
+			Specs: s.file.Imports,
+		})
+	}
+
+	// Now write the top level fields required in the config
+	appConfigStruct := &ast.Field{
+		Label: ast.NewIdent("#Config"),
+		Value: ast.NewStruct(s.topLevelFields...),
+	}
+	appConfigStruct.AddComment(&ast.CommentGroup{
+		List: []*ast.Comment{
+			{Text: "// #Config is the top level configuration for the application and is generated"},
+			{Text: "// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition"},
+			{Text: "// of this struct which is closed, such that the CUE tooling can any typos of field names."},
+			{Text: "// this definition is then immediately inlined, so any fields within it are expected"},
+			{Text: "// as fields at the package level."},
+		},
+	})
+	s.file.Decls = append(s.file.Decls, appConfigStruct, ast.NewIdent("#Config"))
+
+	// Write any declarations we've used multiple times to the file
+	for _, named := range s.typeUsage.NamesWithCountsOver(1) {
+		concrete := schemautil.ConcretizeWithTypeArgs(s.errs, named.Decl().Type, named.TypeArgs)
+		defIdent := s.typeUsage.CueIdent(named)
+		fieldType := s.toCueType(concrete)
+
+		field := &ast.Field{
+			Label: defIdent,
+			Value: fieldType,
+		}
+		if named.DeclInfo.Doc != "" {
+			addCommentToField(field, named.DeclInfo.Doc)
+		} else {
+			// If there isn't a doc, we want to force a new section
+			// above the name (empty line above).
+			// The doc block will add this for us
+			defIdent.NamePos = token.NewSection.Pos()
+		}
+		s.file.Decls = append(s.file.Decls, field)
+	}
+}
+
+type structField struct {
+	Go  schema.StructField
+	CUE *ast.Field
+}
+
+// structToFields converts a struct to a list of fields which can then be
+// either included in a definition, a line struct or the file level declarations
+func (s *serviceFile) structToFields(st schema.StructType) []structField {
+	var fields []structField
+
+	for _, f := range st.Fields {
+		if f.IsAnonymous() {
+			// TODO error?
+			continue
+		}
+		isOptional := false
+
+		// Convert the type to CUE
+		field := &ast.Field{
+			Label: ast.NewIdent(f.Name.MustGet()),
+			Value: s.toCueType(f.Type),
+		}
+
+		for _, tag := range f.Tag.Tags() {
+			if tag.Key == "json" {
+				if tag.Name != "" {
+					field.Label = ast.NewIdent(tag.Name)
+				}
+				for _, option := range tag.Options {
+					if option == "omitempty" {
+						isOptional = true
+					}
+				}
+			}
+
+			if tag.Key == "cue" {
+				if tag.Name != "" {
+					expr, err := parser.ParseExpr("encore struct", tag.Name)
+					if err != nil {
+						s.errs.Add(errInvalidCUEExpr.AtGoNode(f.AST).Wrapping(err))
+						continue
+					}
+					field.Value = ast.NewBinExpr(token.AND, field.Value, expr)
+				}
+				for _, option := range tag.Options {
+					if option == "opt" {
+						isOptional = true
+					}
+				}
+			}
+		}
+
+		// Mark the field as optional if it is
+		if isOptional {
+			field.Optional = token.Blank.Pos()
+		}
+
+		// Add the documentation to the field
+		if f.Doc != "" {
+			addCommentToField(field, f.Doc)
+		}
+
+		fields = append(fields, structField{Go: f, CUE: field})
+	}
+
+	return fields
+}
+
+// Convert a schema type into a cue type
+func (s *serviceFile) toCueType(unknownType schema.Type) ast.Expr {
+	switch typ := unknownType.(type) {
+	case schema.NamedType:
+		if underlying, wasConfig := unwrapConfig(s.errs, typ); wasConfig {
+			return s.toCueType(underlying)
+		}
+
+		usageCount := s.typeUsage.Count(typ)
+		if usageCount <= 1 {
+			// inline the type if it's only used once
+			concrete := schemautil.ConcretizeWithTypeArgs(s.errs, typ.Decl().Type, typ.TypeArgs)
+			return s.toCueType(concrete)
+		} else {
+			return s.typeUsage.CueIdent(typ)
+		}
+	case schema.StructType:
+		fields := s.structToFields(typ)
+		fieldsInterface := make([]any, len(fields))
+		for i, field := range fields {
+			fieldsInterface[i] = field.CUE
+		}
+
+		return ast.NewStruct(fieldsInterface...)
+	case schema.MapType:
+		keyType := s.toCueType(typ.Key)
+		valueType := s.toCueType(typ.Value)
+		return ast.NewStruct(ast.NewList(keyType), valueType)
+
+	case schema.ListType:
+		listType := s.toCueType(typ.Elem)
+		return ast.NewList(&ast.Ellipsis{Type: listType})
+
+	case schema.BuiltinType:
+		return s.builtinToCue(typ.Kind)
+
+	case schema.PointerType:
+		// Pointers are not supported in CUE, so we just convert the underlying type.
+		return s.toCueType(typ.Elem)
+
+	default:
+		// TODO error instead
+		panic(fmt.Sprintf("unexpected type: %T", typ))
+	}
+}
+
+func (s *serviceFile) builtinToCue(kind schema.BuiltinKind) ast.Expr {
+	switch kind {
+	case schema.Any:
+		return ast.NewIdent("_") // top
+	case schema.Bool:
+		return ast.NewIdent("bool")
+	case schema.Int8:
+		return ast.NewIdent("int8")
+	case schema.Int16:
+		return ast.NewIdent("int16")
+	case schema.Int32:
+		return ast.NewIdent("int32")
+	case schema.Int64:
+		return ast.NewIdent("int64")
+	case schema.Uint8:
+		return ast.NewIdent("uint8")
+	case schema.Uint16:
+		return ast.NewIdent("uint16")
+	case schema.Uint32:
+		return ast.NewIdent("uint32")
+	case schema.Uint64:
+		return ast.NewIdent("uint64")
+	case schema.Float32:
+		return ast.NewIdent("float32")
+	case schema.Float64:
+		return ast.NewIdent("float64")
+	case schema.String:
+		return ast.NewIdent("string")
+	case schema.Bytes:
+		return ast.NewIdent("bytes")
+	case schema.Time:
+		return ast.NewSel(ast.NewIdent("time"), "Time")
+	case schema.UUID:
+		return ast.NewIdent("string")
+	case schema.JSON:
+		return ast.NewIdent("string")
+	case schema.UserID:
+		return ast.NewIdent("string")
+	case schema.Int:
+		return ast.NewIdent("int")
+	case schema.Uint:
+		return ast.NewIdent("uint")
+	default:
+		// TODO error instead
+		panic(fmt.Sprintf("unknown builtin: %s", kind))
+	}
+}
+
+func (s *serviceFile) generateEnvironmentalDefinitions() {
+	appMetadata := createStruct(
+		"#Meta",
+		createTaggedDefinition(
+			"APIBaseURL", "APIBaseURL",
+			"The base URL which can be used to call the API of this running application.",
+			ast.NewIdent("string"),
+		),
+		createStruct(
+			"Environment",
+			createTaggedDefinition(
+				"Name", "EnvName",
+				"The name of this environment",
+				ast.NewIdent("string"),
+			),
+			createTaggedEnumDefinition(
+				"Type", "EnvType",
+				"The type of environment that the application is running in",
+				"production", "development", "ephemeral", "test",
+			),
+			createTaggedEnumDefinition(
+				"Cloud", "CloudType",
+				"The cloud provider that the application is running in",
+				"aws", "azure", "gcp", "encore", "local",
+			),
+		),
+	)
+
+	appMetadata.AddComment(&ast.CommentGroup{
+		List: []*ast.Comment{
+			{Text: "// #Meta contains metadata about the running Encore application."},
+			{Text: "// The values in this struct will be injected by Encore upon deployment and can be"},
+			{Text: "// referenced from other config values for example when configuring a callback URL:"},
+			{Text: "//    CallbackURL: \"\\(#Meta.APIBaseURL)/webhooks.Handle`\""},
+		},
+	})
+
+	s.file.Decls = append(s.file.Decls, appMetadata)
+}
+
+func createStruct(name string, fields ...any) *ast.Field {
+	return &ast.Field{
+		Label: ast.NewIdent(name),
+		Value: ast.NewStruct(fields...),
+	}
+}
+
+func createTaggedEnumDefinition(name string, tagName string, comment string, options ...string) *ast.Field {
+	set := make([]ast.Expr, len(options))
+	for i, key := range options {
+		set[i] = ast.NewString(key)
+	}
+
+	return createTaggedDefinition(
+		name, tagName,
+		comment,
+		ast.NewBinExpr(token.OR, set...),
+	)
+}
+
+func createTaggedDefinition(name string, tagName string, comment string, value ast.Expr) *ast.Field {
+	field := &ast.Field{
+		Label: ast.NewIdent(name),
+		Value: value,
+		Attrs: []*ast.Attribute{
+			{
+				At: token.NoPos,
+				Text: fmt.Sprintf(
+					"@tag(%s)",
+					tagName,
+				),
+			},
+		},
+	}
+
+	field.AddComment(&ast.CommentGroup{
+		Position: 4,
+		List: []*ast.Comment{
+			{
+				Slash: token.NoPos,
+				Text:  fmt.Sprintf("// %s", comment),
+			},
+		},
+	})
+
+	return field
+}
+
+func unwrapConfig(errs *perr.List, typ schema.Type) (unwrapped schema.Type, wasConfig bool) {
+	if named, ok := typ.(schema.NamedType); ok {
+		if underlying, isList, isConfig := schemautil.UnwrapConfigType(errs, named); isConfig {
+			if isList {
+				underlying = schema.ListType{Elem: underlying}
+			}
+			return underlying, true
+		}
+	}
+	return typ, false
+}
diff --git a/v2/codegen/cuegen/testdata/basic_config.txt b/v2/codegen/cuegen/testdata/basic_config.txt
new file mode 100644
index 0000000000..509ec5ebcd
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_config.txt
@@ -0,0 +1,31 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type Config struct {
+    Name        string    // The users name
+    Port        uint16
+    ReadOnly    bool      // true if we're in read only mode
+
+    // MagicNumber is complicated and requires
+    // a multi-line comment to explain it.
+    MagicNumber int
+
+    ID          uuid.UUID // An ID
+
+    PublicKey []byte
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/basic_config_svc.cue b/v2/codegen/cuegen/testdata/basic_config_svc.cue
new file mode 100644
index 0000000000..e996d8e05b
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_config_svc.cue
@@ -0,0 +1,41 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	Name:     string // The users name
+	Port:     uint16
+	ReadOnly: bool // true if we're in read only mode
+
+	// MagicNumber is complicated and requires
+	// a multi-line comment to explain it.
+	MagicNumber: int
+	ID:          string // An ID
+	PublicKey:   bytes
+}
+#Config
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/basic_inline_struct.txt b/v2/codegen/cuegen/testdata/basic_inline_struct.txt
new file mode 100644
index 0000000000..a7af041024
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_inline_struct.txt
@@ -0,0 +1,25 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type Config struct {
+    // The options for the HTTP server
+    HTTP struct {
+        Enabled bool // Is this option enabled?
+        Port    uint32 // What port should we run on?
+    }
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/basic_inline_struct_svc.cue b/v2/codegen/cuegen/testdata/basic_inline_struct_svc.cue
new file mode 100644
index 0000000000..dd1d9ccc96
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_inline_struct_svc.cue
@@ -0,0 +1,37 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	// The options for the HTTP server
+	HTTP: {
+		Enabled: bool   // Is this option enabled?
+		Port:    uint32 // What port should we run on?
+	}
+}
+#Config
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/basic_lists.txt b/v2/codegen/cuegen/testdata/basic_lists.txt
new file mode 100644
index 0000000000..08d23362f9
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_lists.txt
@@ -0,0 +1,22 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type Config struct {
+    Ages      []int32
+    OtherBits []string
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/basic_lists_svc.cue b/v2/codegen/cuegen/testdata/basic_lists_svc.cue
new file mode 100644
index 0000000000..088ebda3da
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_lists_svc.cue
@@ -0,0 +1,34 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	Ages: [...int32]
+	OtherBits: [...string]
+}
+#Config
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/basic_maps.txt b/v2/codegen/cuegen/testdata/basic_maps.txt
new file mode 100644
index 0000000000..61a3607b5c
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_maps.txt
@@ -0,0 +1,21 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type Config struct {
+    Ages map[string]int
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/basic_maps_svc.cue b/v2/codegen/cuegen/testdata/basic_maps_svc.cue
new file mode 100644
index 0000000000..2abb93d0cf
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_maps_svc.cue
@@ -0,0 +1,33 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	Ages: [string]: int
+}
+#Config
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/basic_named_struct_multiple_uses.txt b/v2/codegen/cuegen/testdata/basic_named_struct_multiple_uses.txt
new file mode 100644
index 0000000000..38ba49e372
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_named_struct_multiple_uses.txt
@@ -0,0 +1,29 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+// ServerOptions represent options for a server
+type ServerOptions struct {
+    Enabled bool // Is this option enabled?
+    Port    uint32 // What port should we run on?
+}
+
+type Config struct {
+    HTTP ServerOptions // The options for the HTTP server
+    TCP  ServerOptions // The options for the TCP server
+    GRPC ServerOptions // The options for the GRPC server
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/basic_named_struct_multiple_uses_svc.cue b/v2/codegen/cuegen/testdata/basic_named_struct_multiple_uses_svc.cue
new file mode 100644
index 0000000000..649b7c0b0f
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_named_struct_multiple_uses_svc.cue
@@ -0,0 +1,41 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	HTTP: #ServerOptions // The options for the HTTP server
+	TCP:  #ServerOptions // The options for the TCP server
+	GRPC: #ServerOptions // The options for the GRPC server
+}
+#Config
+
+// ServerOptions represent options for a server
+#ServerOptions: {
+	Enabled: bool   // Is this option enabled?
+	Port:    uint32 // What port should we run on?
+}
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/basic_named_struct_single_use.txt b/v2/codegen/cuegen/testdata/basic_named_struct_single_use.txt
new file mode 100644
index 0000000000..f1aeb79aee
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_named_struct_single_use.txt
@@ -0,0 +1,26 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type ServerOptions struct {
+    Enabled bool // Is this option enabled?
+    Port    uint32 // What port should we run on?
+}
+
+type Config struct {
+    HTTP ServerOptions // The options for the HTTP server
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/basic_named_struct_single_use_svc.cue b/v2/codegen/cuegen/testdata/basic_named_struct_single_use_svc.cue
new file mode 100644
index 0000000000..dd1d9ccc96
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_named_struct_single_use_svc.cue
@@ -0,0 +1,37 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	// The options for the HTTP server
+	HTTP: {
+		Enabled: bool   // Is this option enabled?
+		Port:    uint32 // What port should we run on?
+	}
+}
+#Config
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/basic_no_config.txt b/v2/codegen/cuegen/testdata/basic_no_config.txt
new file mode 100644
index 0000000000..467a038405
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_no_config.txt
@@ -0,0 +1,11 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/basic_no_config_svc.cue b/v2/codegen/cuegen/testdata/basic_no_config_svc.cue
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/v2/codegen/cuegen/testdata/basic_with_cue_imports.txt b/v2/codegen/cuegen/testdata/basic_with_cue_imports.txt
new file mode 100644
index 0000000000..46d7cc1e10
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_with_cue_imports.txt
@@ -0,0 +1,20 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    SomeTime time.Time
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/basic_with_cue_imports_svc.cue b/v2/codegen/cuegen/testdata/basic_with_cue_imports_svc.cue
new file mode 100644
index 0000000000..42216090cf
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_with_cue_imports_svc.cue
@@ -0,0 +1,34 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+import "time"
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	SomeTime: time.Time
+}
+#Config
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/basic_wrappers.txt b/v2/codegen/cuegen/testdata/basic_wrappers.txt
new file mode 100644
index 0000000000..c662d89b20
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_wrappers.txt
@@ -0,0 +1,34 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type Config struct {
+    Name        config.String    // The users name
+    Port        config.Uint16
+    ReadOnly    config.Bool      // true if we're in read only mode
+
+    // MagicNumber is complicated and requires
+    // a multi-line comment to explain it.
+    MagicNumber config.Int
+
+    Start       config.Time // The time at which the service was first started
+    ID          config.UUID // An ID
+
+    PublicKey config.Value[[]byte]
+
+    AdminUsers config.Values[string]
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/basic_wrappers_svc.cue b/v2/codegen/cuegen/testdata/basic_wrappers_svc.cue
new file mode 100644
index 0000000000..c13ad98bdd
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/basic_wrappers_svc.cue
@@ -0,0 +1,44 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+import "time"
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	Name:     string // The users name
+	Port:     uint16
+	ReadOnly: bool // true if we're in read only mode
+
+	// MagicNumber is complicated and requires
+	// a multi-line comment to explain it.
+	MagicNumber: int
+	Start:       time.Time // The time at which the service was first started
+	ID:          string    // An ID
+	PublicKey:   bytes
+	AdminUsers: [...string]
+}
+#Config
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/cue_optional_tag.txt b/v2/codegen/cuegen/testdata/cue_optional_tag.txt
new file mode 100644
index 0000000000..ee59e5da3e
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/cue_optional_tag.txt
@@ -0,0 +1,29 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type ServerOption struct {
+    Option   int64
+    Disabled bool `cue:",opt"` // True if this is disabled
+}
+
+type Config struct {
+    HTTP    ServerOption
+    Another ServerOption
+    TCP     ServerOption `cue:",opt"`
+    GRPC    ServerOption `cue:",opt"`
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/cue_optional_tag_svc.cue b/v2/codegen/cuegen/testdata/cue_optional_tag_svc.cue
new file mode 100644
index 0000000000..33c5012efd
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/cue_optional_tag_svc.cue
@@ -0,0 +1,41 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	HTTP:    #ServerOption
+	Another: #ServerOption
+	TCP?:    #ServerOption
+	GRPC?:   #ServerOption
+}
+#Config
+
+#ServerOption: {
+	Option:    int64
+	Disabled?: bool // True if this is disabled
+}
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/cue_tags.txt b/v2/codegen/cuegen/testdata/cue_tags.txt
new file mode 100644
index 0000000000..9bb8a7d10d
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/cue_tags.txt
@@ -0,0 +1,23 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type Config struct {
+    A int
+    B int `cue:"A+C"`
+    C int `cue:"B-A"`
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/cue_tags_svc.cue b/v2/codegen/cuegen/testdata/cue_tags_svc.cue
new file mode 100644
index 0000000000..7f2ab1f680
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/cue_tags_svc.cue
@@ -0,0 +1,35 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	A: int
+	B: int & A+C
+	C: int & B-A
+}
+#Config
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/generic_named_types.txt b/v2/codegen/cuegen/testdata/generic_named_types.txt
new file mode 100644
index 0000000000..af3fd62f41
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/generic_named_types.txt
@@ -0,0 +1,41 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+// Generic option which can be disbaled
+type DisablableOption[T any] struct {
+    Option   T
+    Disabled bool // True if this is disabled
+}
+
+type List[T any] []T
+
+// A nice generic map
+type Map[K any, V any] map[K]V
+
+type Config struct {
+    HTTP    DisablableOption[uint16] // The options for the HTTP server
+    Another DisablableOption[uint64]
+    TCP     DisablableOption[uint16] // The options for the TCP server
+    GRPC    DisablableOption[uint64] // The options for the GRPC server
+    List1   List[string]             // A list of strings
+    List2   List[string]
+    List3   List[int]
+    Map1    Map[string, string]
+    Map2    Map[int, string]
+    Map3    Map[string, string]
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/generic_named_types_svc.cue b/v2/codegen/cuegen/testdata/generic_named_types_svc.cue
new file mode 100644
index 0000000000..98588310a5
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/generic_named_types_svc.cue
@@ -0,0 +1,61 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	HTTP:    #DisablableOption_uint16 // The options for the HTTP server
+	Another: #DisablableOption_uint64
+	TCP:     #DisablableOption_uint16 // The options for the TCP server
+	GRPC:    #DisablableOption_uint64 // The options for the GRPC server
+	List1:   #List_string             // A list of strings
+	List2:   #List_string
+	List3: [...int]
+	Map1: #Map_string_string
+	Map2: [int]: string
+	Map3: #Map_string_string
+}
+#Config
+
+#List_string: [...string]
+
+// Generic option which can be disbaled
+#DisablableOption_uint64: {
+	Option:   uint64
+	Disabled: bool // True if this is disabled
+}
+
+// Generic option which can be disbaled
+#DisablableOption_uint16: {
+	Option:   uint16
+	Disabled: bool // True if this is disabled
+}
+
+// A nice generic map
+#Map_string_string: {
+	[string]: string
+}
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/generic_top_level_type.txt b/v2/codegen/cuegen/testdata/generic_top_level_type.txt
new file mode 100644
index 0000000000..5039c3a560
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/generic_top_level_type.txt
@@ -0,0 +1,21 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type Config[T int] struct {
+    Value T `json:"value,omitempty"` // Some config
+}
+
+var _ = config.Load[*Config[uint]]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/generic_top_level_type_svc.cue b/v2/codegen/cuegen/testdata/generic_top_level_type_svc.cue
new file mode 100644
index 0000000000..47c6eac110
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/generic_top_level_type_svc.cue
@@ -0,0 +1,33 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	value?: uint // Some config
+}
+#Config
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/json_tags.txt b/v2/codegen/cuegen/testdata/json_tags.txt
new file mode 100644
index 0000000000..21eb96b68b
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/json_tags.txt
@@ -0,0 +1,29 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type ServerOption struct {
+    Option   int64
+    Disabled bool `json:",omitempty"` // True if this is disabled
+}
+
+type Config struct {
+    HTTP    ServerOption
+    Another ServerOption `json:"a_n_o_t_h_e_r"`
+    TCP     ServerOption `json:",omitempty"`
+    GRPC    ServerOption `json:",omitempty"`
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/cuegen/testdata/json_tags_svc.cue b/v2/codegen/cuegen/testdata/json_tags_svc.cue
new file mode 100644
index 0000000000..3c77d38715
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/json_tags_svc.cue
@@ -0,0 +1,41 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	HTTP:          #ServerOption
+	a_n_o_t_h_e_r: #ServerOption
+	TCP?:          #ServerOption
+	GRPC?:         #ServerOption
+}
+#Config
+
+#ServerOption: {
+	Option:    int64
+	Disabled?: bool // True if this is disabled
+}
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/merge_identical_comments.txt b/v2/codegen/cuegen/testdata/merge_identical_comments.txt
new file mode 100644
index 0000000000..2fdcc5223f
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/merge_identical_comments.txt
@@ -0,0 +1,69 @@
+-- svc/a.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type AsConfig struct {
+    // Multiline test
+    // comment to deduplicate.
+    Foo config.String
+}
+
+var _ = config.Load[*AsConfig]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+
+-- svc/b.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type BsConfig struct{
+    Foo config.String // Some extra comment
+}
+
+var _ = config.Load[BsConfig]()
+
+-- svc/c.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type CsConfig struct{
+    // Multiline test
+    // comment to deduplicate.
+    Foo config.String
+}
+
+var _ = config.Load[CsConfig]()
+
+-- svc/d.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type DsConfig struct{
+    Foo config.String // Some extra comment
+}
+
+var _ = config.Load[DsConfig]()
diff --git a/v2/codegen/cuegen/testdata/merge_identical_comments_svc.cue b/v2/codegen/cuegen/testdata/merge_identical_comments_svc.cue
new file mode 100644
index 0000000000..a9eaaf0c1d
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/merge_identical_comments_svc.cue
@@ -0,0 +1,36 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	// Multiline test
+	// comment to deduplicate.
+	// Some extra comment
+	Foo: string
+}
+#Config
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/multiple_configs_in_service.txt b/v2/codegen/cuegen/testdata/multiple_configs_in_service.txt
new file mode 100644
index 0000000000..bd99e3dadd
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/multiple_configs_in_service.txt
@@ -0,0 +1,54 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type Config struct {
+    Name        string    // The users name
+    Port        uint16
+    ReadOnly    bool      // true if we're in read only mode
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+
+-- svc/a_file.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type OtherConfig struct{
+    Foo config.String // Foo is great in Otherconfig
+    Bar config.Int
+}
+
+var _ = config.Load[OtherConfig]()
+
+-- svc/z_file.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type ThisConfig struct{
+    Foo config.String // And even better in ThisConfig
+    Baz config.Bool
+}
+
+var _ = config.Load[ThisConfig]()
diff --git a/v2/codegen/cuegen/testdata/multiple_configs_in_service_svc.cue b/v2/codegen/cuegen/testdata/multiple_configs_in_service_svc.cue
new file mode 100644
index 0000000000..95cca15a23
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/multiple_configs_in_service_svc.cue
@@ -0,0 +1,40 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	// Foo is great in Otherconfig
+	// And even better in ThisConfig
+	Foo:      string
+	Bar:      int
+	Name:     string // The users name
+	Port:     uint16
+	ReadOnly: bool // true if we're in read only mode
+	Baz:      bool
+}
+#Config
\ No newline at end of file
diff --git a/v2/codegen/cuegen/testdata/types_from_multiple_packages.txt b/v2/codegen/cuegen/testdata/types_from_multiple_packages.txt
new file mode 100644
index 0000000000..3038262779
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/types_from_multiple_packages.txt
@@ -0,0 +1,59 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+
+	"encore.app/svc/utils"
+	"encore.app/svc/helpers"
+)
+
+type Config struct {
+    A helpers.ExtraConfig
+    B utils.ExtraConfig
+    C helpers.ExtraConfig
+    D utils.ExtraConfig
+    E helpers.SingleUse
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+
+-- svc/utils/config.go --
+package utils
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type ExtraConfig struct{
+    Foo config.String
+    Bar config.Int
+}
+
+-- svc/helpers/config.go --
+package helpers
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type ExtraConfig struct{
+    Foo config.String
+    Baz config.Value[[]byte]
+}
+
+type SingleUse struct {
+    Lock bool
+}
diff --git a/v2/codegen/cuegen/testdata/types_from_multiple_packages_svc.cue b/v2/codegen/cuegen/testdata/types_from_multiple_packages_svc.cue
new file mode 100644
index 0000000000..170264b52c
--- /dev/null
+++ b/v2/codegen/cuegen/testdata/types_from_multiple_packages_svc.cue
@@ -0,0 +1,47 @@
+// Code generated by encore. DO NOT EDIT.
+//
+// The contents of this file are generated from the structs used in
+// conjunction with Encore's `config.Load[T]()` function. This file
+// automatically be regenerated if the data types within the struct
+// are changed.
+//
+// For more information about this file, see:
+// https://encore.dev/docs/develop/config
+package svc
+
+// #Meta contains metadata about the running Encore application.
+// The values in this struct will be injected by Encore upon deployment and can be
+// referenced from other config values for example when configuring a callback URL:
+//    CallbackURL: "\(#Meta.APIBaseURL)/webhooks.Handle`"
+#Meta: {
+	APIBaseURL: string @tag(APIBaseURL) // The base URL which can be used to call the API of this running application.
+	Environment: {
+		Name:  string                                              @tag(EnvName)   // The name of this environment
+		Type:  "production" | "development" | "ephemeral" | "test" @tag(EnvType)   // The type of environment that the application is running in
+		Cloud: "aws" | "azure" | "gcp" | "encore" | "local"        @tag(CloudType) // The cloud provider that the application is running in
+	}
+}
+
+// #Config is the top level configuration for the application and is generated
+// from the Go types you've passed into `config.Load[T]()`. Encore uses a definition
+// of this struct which is closed, such that the CUE tooling can any typos of field names.
+// this definition is then immediately inlined, so any fields within it are expected
+// as fields at the package level.
+#Config: {
+	A: #ExtraConfig
+	B: #ExtraConfig_1
+	C: #ExtraConfig
+	D: #ExtraConfig_1
+	E: Lock: bool
+}
+#Config
+
+#ExtraConfig: {
+	Foo: string
+	Baz: bytes
+}
+
+#ExtraConfig_1: {
+	Foo: string
+	Bar: int
+}
\ No newline at end of file
diff --git a/v2/codegen/cuegen/utils.go b/v2/codegen/cuegen/utils.go
new file mode 100644
index 0000000000..aaad7fa815
--- /dev/null
+++ b/v2/codegen/cuegen/utils.go
@@ -0,0 +1,87 @@
+package cuegen
+
+import (
+	"strings"
+
+	"cuelang.org/go/cue/ast"
+	"cuelang.org/go/cue/token"
+)
+
+// addCommentToField adds the given string to a Field
+//
+// If the str is a single line, then the comment group will be positioned at
+// the end of the node it is attached to.
+//
+// If the str is a multi-line string, then the comment group will be positioned
+// at the before the node it is attached to.
+func addCommentToField(field *ast.Field, str string) {
+	lines := strings.Split(strings.TrimSpace(str), "\n")
+
+	// Position 4 = after the attached node, position 0 = before the attached node
+	commentPosition := int8(4)
+	_, isStruct := field.Value.(*ast.StructLit)
+	if len(lines) > 1 || isStruct {
+		commentPosition = 0
+	}
+	grp := &ast.CommentGroup{
+		Position: commentPosition,
+	}
+
+	for _, line := range lines {
+		grp.List = append(grp.List, &ast.Comment{Text: "// " + line})
+	}
+
+	// If this comment is multiline, then the first line should be positioned on a NewSection for force an empty line
+	// before the comment group
+	if commentPosition == 0 {
+		grp.List[0].Slash = token.NewSection.Pos()
+	}
+
+	field.AddComment(grp)
+}
+
+// commentAlreadyPresent returns true if the field already contains all of the comment of `contains`
+// within one of it's existing comment groups
+func commentAlreadyPresent(field *ast.Field, contains *ast.CommentGroup) bool {
+	if len(contains.List) == 0 {
+		return true
+	}
+
+commentGroupLoop:
+	for _, c := range field.Comments() {
+		// Range over this group comment
+	groupLineLoop:
+		for i, line := range c.List {
+			if i+len(contains.List) > len(c.List) {
+				// If we've not got enough lines to contain the entire comment, then
+				// we can try the next comment group
+				continue commentGroupLoop
+			}
+
+			// If we find the first line then great, let's check it
+			if strings.TrimSpace(line.Text) == strings.TrimSpace(contains.List[0].Text) {
+				for j, containsLine := range contains.List {
+					if strings.TrimSpace(c.List[i+j].Text) != strings.TrimSpace(containsLine.Text) {
+						continue groupLineLoop
+					}
+				}
+
+				// If here the entire comment group is contained within field already
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func hasCommentInPosition(field *ast.Field, pos int8) bool {
+	for _, c := range field.Comments() {
+		if len(c.List) > 1 {
+			return true
+		}
+		if c.Position == pos {
+			return true
+		}
+	}
+	return false
+}
diff --git a/v2/codegen/decls.go b/v2/codegen/decls.go
new file mode 100644
index 0000000000..07658fb99c
--- /dev/null
+++ b/v2/codegen/decls.go
@@ -0,0 +1,266 @@
+package codegen
+
+import (
+	"fmt"
+	"io"
+	"slices"
+	"strings"
+
+	"github.com/dave/jennifer/jen"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+var importNames = map[string]string{
+	"github.com/felixge/httpsnoop":        "httpsnoop",
+	"github.com/json-iterator/go":         "jsoniter",
+	"github.com/julienschmidt/httprouter": "httprouter",
+
+	"encore.dev/appruntime/apisdk/api":      "__api",
+	"encore.dev/appruntime/apisdk/app":      "__app",
+	"encore.dev/appruntime/infrasdk/config": "__config",
+	"encore.dev/appruntime/shared/etype":    "__etype",
+	"encore.dev/appruntime/exported/model":  "__model",
+	"encore.dev/appruntime/shared/serde":    "__serde",
+	"encore.dev/appruntime/apisdk/service":  "__service",
+	"encore.dev/beta/errs":                  "errs",
+	"encore.dev/storage/sqldb":              "sqldb",
+	"encore.dev/types/uuid":                 "uuid",
+}
+
+func newFile(pkg *pkginfo.Package, baseName, shortName string) *File {
+	return newFileForPath(pkg.ImportPath, pkg.Name, pkg.FSPath, baseName, shortName)
+}
+
+func newFileForPath(pkgPath paths.Pkg, pkgName string, pkgDir paths.FS, baseName, shortName string) *File {
+	jenFile := jen.NewFilePathName(pkgPath.String(), pkgName)
+
+	for pkgPath, alias := range importNames {
+		jenFile.ImportAlias(pkgPath, alias)
+	}
+
+	return &File{
+		Jen:       jenFile,
+		dir:       pkgDir,
+		pkgPath:   pkgPath,
+		baseName:  baseName,
+		shortName: shortName,
+	}
+}
+
+// File represents a generated file for a specific package.
+type File struct {
+	Jen *jen.File // the jen file we're generating
+
+	// dir is the filesystem directory where the file should exist
+	// within the application source tree. It need not match
+	// any existing physical directory in the case of overlays.
+	dir paths.FS
+
+	pkgPath  paths.Pkg // the package the file belongs to
+	baseName string    // the file's base name
+	// shortName is the short version of the base name, for generated files.
+	// For example if the base name is "encore_internal__metrics.go",
+	// shortName is "metrics".
+	shortName string
+
+	decls []any // ordered list of Decl or jen.Code
+}
+
+// ImportAnon adds an anonymous ("_"-prefixed) import of the given packages.
+func (f *File) ImportAnon(pkgs ...paths.Pkg) {
+	f.Jen.Anon(fns.Map(pkgs, func(pkg paths.Pkg) string {
+		return pkg.String()
+	})...)
+}
+
+// name returns the computed file name.
+func (f *File) name() string {
+	return f.baseName
+}
+
+// Add adds a declaration to the file.
+func (f *File) Add(code jen.Code) {
+	if code != nil {
+		f.decls = append(f.decls, code)
+	}
+}
+
+// Render renders the file to the given writer.
+func (f *File) Render(w io.Writer) error {
+	for i, d := range f.decls {
+		if i > 0 {
+			f.Jen.Line()
+		}
+
+		switch d := d.(type) {
+		case Decl:
+			f.Jen.Add(d.Code())
+		case jen.Code:
+			f.Jen.Add(d)
+		default:
+			panic(fmt.Sprintf("internal error: unknown decl type: %T", d))
+		}
+	}
+	return f.Jen.Render(w)
+}
+
+type Decl interface {
+	Name() string
+	Qual() *jen.Statement
+	Code() *jen.Statement
+}
+
+func (f *File) HasDecl(nameParts ...string) bool {
+	for _, decl := range f.decls {
+		switch decl := decl.(type) {
+		case *FuncDecl:
+			if slices.Equal(decl.nameParts, nameParts) {
+				return true
+			}
+		case *VarDecl:
+			if slices.Equal(decl.nameParts, nameParts) {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func (f *File) FuncDecl(nameParts ...string) *FuncDecl {
+	if len(nameParts) == 0 {
+		panic("gen.VarDecl: empty nameParts")
+	}
+	d := &FuncDecl{
+		File:      f,
+		nameParts: nameParts,
+	}
+	f.decls = append(f.decls, d)
+	return d
+}
+
+func (f *File) VarDecl(nameParts ...string) *VarDecl {
+	if len(nameParts) == 0 {
+		panic("gen.VarDecl: empty nameParts")
+	}
+	d := &VarDecl{
+		File:      f,
+		nameParts: nameParts,
+	}
+	f.decls = append(f.decls, d)
+	return d
+}
+
+// FuncDecl represents a generated declaration.
+type FuncDecl struct {
+	File *File // file the declaration belongs to.
+
+	// nameParts are the suffix parts of the generated name.
+	// For example, if the parts are ["foo", "bar"] and the
+	// file shortName is "metrics", the generated declaration name
+	// is "EncoreInternal_metrics_foo_bar".
+	nameParts []string
+
+	// typeParams are the type parameters of the generated function.
+	typeParams []jen.Code
+
+	// params are the parameters of the generated function.
+	params []jen.Code
+
+	// results are the results of the generated function.
+	results []jen.Code
+
+	// body is the body of the generated function.
+	body *jen.Statement
+}
+
+// Name returns the package-level name of the declaration.
+func (d *FuncDecl) Name() string {
+	return "EncoreInternal_" + d.File.shortName + "_" + strings.Join(d.nameParts, "_")
+}
+
+// Qual returns the qualified name of the declaration.
+func (d *FuncDecl) Qual() *jen.Statement {
+	return jen.Qual(d.File.pkgPath.String(), d.Name())
+}
+
+// Code returns the generated code.
+func (d *FuncDecl) Code() *jen.Statement {
+	s := jen.Func().Id(d.Name())
+	if len(d.typeParams) > 0 {
+		s = s.Types(d.typeParams...)
+	}
+	if len(d.params) > 0 {
+		s = s.Params(d.params...)
+	}
+	if len(d.results) > 0 {
+		s = s.Params(d.results...)
+	}
+	if d.body != nil {
+		s = s.Add(d.body)
+	} else {
+		s = s.Block()
+	}
+	return s
+}
+
+// TypeParams appends to the type parameters of the generated function.
+func (d *FuncDecl) TypeParams(params ...jen.Code) *FuncDecl {
+	d.typeParams = append(d.typeParams, params...)
+	return d
+}
+
+// Params appends to the parameters of the generated function.
+func (d *FuncDecl) Params(params ...jen.Code) *FuncDecl {
+	d.params = append(d.params, params...)
+	return d
+}
+
+// Results appends to the results of the generated function.
+func (d *FuncDecl) Results(results ...jen.Code) *FuncDecl {
+	d.results = append(d.results, results...)
+	return d
+}
+
+// Body sets the body of the generated function.
+func (d *FuncDecl) Body(code ...jen.Code) *FuncDecl {
+	d.body = jen.Block(code...)
+	return d
+}
+
+// BodyFunc computes the body of the generated function.
+func (d *FuncDecl) BodyFunc(fn func(g *jen.Group)) *FuncDecl {
+	d.body = jen.BlockFunc(fn)
+	return d
+}
+
+type VarDecl struct {
+	File *File // file the declaration belongs to.
+
+	// nameParts are the suffix parts of the generated name.
+	// For example, if the parts are ["foo", "bar"] and the
+	// file shortName is "metrics", the generated declaration name
+	// is "EncoreInternal_metrics_foo_bar".
+	nameParts []string
+
+	value *jen.Statement
+}
+
+func (d *VarDecl) Value(code ...jen.Code) *VarDecl {
+	d.value = jen.Add(code...)
+	return d
+}
+
+func (d *VarDecl) Code() *jen.Statement {
+	return jen.Var().Id(d.Name()).Op("=").Add(d.value)
+}
+
+func (d *VarDecl) Name() string {
+	return "EncoreInternal_" + d.File.shortName + "_" + strings.Join(d.nameParts, "_")
+}
+
+func (d *VarDecl) Qual() *jen.Statement {
+	return jen.Qual(d.File.pkgPath.String(), d.Name())
+}
diff --git a/v2/codegen/errors.go b/v2/codegen/errors.go
new file mode 100644
index 0000000000..a42fcdc806
--- /dev/null
+++ b/v2/codegen/errors.go
@@ -0,0 +1,16 @@
+package codegen
+
+import "encr.dev/pkg/errors"
+
+var (
+	errRange = errors.Range(
+		"codegen",
+		"",
+	)
+
+	errRender = errRange.New(
+		"Failed to render codegen",
+		"Generated code could not be parsed.",
+		errors.MarkAsInternalError(),
+	)
+)
diff --git a/v2/codegen/gen.go b/v2/codegen/gen.go
new file mode 100644
index 0000000000..bb005b6352
--- /dev/null
+++ b/v2/codegen/gen.go
@@ -0,0 +1,124 @@
+package codegen
+
+import (
+	"bytes"
+	"fmt"
+	"slices"
+	"strconv"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/app/legacymeta"
+	"encr.dev/v2/codegen/internal/genutil"
+	"encr.dev/v2/codegen/rewrite"
+	"encr.dev/v2/internals/overlay"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+type Generator struct {
+	*parsectx.Context
+
+	Util             *genutil.Helper
+	TraceNodes       *legacymeta.TraceNodes
+	rewrites         map[*pkginfo.File]*rewrite.Rewriter
+	files            map[fileKey]*File
+	addedAppInit     map[paths.Pkg]bool
+	addedTestSupport map[paths.Pkg]bool
+}
+
+func New(c *parsectx.Context, traceNodes *legacymeta.TraceNodes) *Generator {
+	return &Generator{
+		Context:          c,
+		Util:             genutil.NewHelper(c.Errs),
+		TraceNodes:       traceNodes,
+		rewrites:         make(map[*pkginfo.File]*rewrite.Rewriter),
+		files:            make(map[fileKey]*File),
+		addedAppInit:     make(map[paths.Pkg]bool),
+		addedTestSupport: make(map[paths.Pkg]bool),
+	}
+}
+
+func (g *Generator) Rewrite(file *pkginfo.File) *rewrite.Rewriter {
+	if r, ok := g.rewrites[file]; ok {
+		return r
+	}
+	r := rewrite.New(file.Contents(), file.Token().Base())
+	g.rewrites[file] = r
+	return r
+}
+
+type fileKey struct {
+	pkgPath  paths.Pkg
+	baseName string
+}
+
+func (g *Generator) File(pkg *pkginfo.Package, shortName string) *File {
+	baseName := "encore_internal__" + shortName + ".go"
+	key := fileKey{pkg.ImportPath, baseName}
+	if f, ok := g.files[key]; ok {
+		return f
+	}
+	f := newFile(pkg, baseName, shortName)
+	g.files[key] = f
+	return f
+}
+
+func (g *Generator) InjectFile(pkgPath paths.Pkg, pkgName string, pkgDir paths.FS, baseName, shortName string) *File {
+	key := fileKey{pkgPath, baseName}
+	if f, ok := g.files[key]; ok {
+		return f
+	}
+	f := newFileForPath(pkgPath, pkgName, pkgDir, baseName, shortName)
+	g.files[key] = f
+	return f
+}
+
+func (g *Generator) Overlays() []overlay.File {
+	var of []overlay.File
+
+	var buf bytes.Buffer
+	for _, f := range g.files {
+		source := f.dir.Join(f.name())
+
+		buf.Reset()
+		if err := f.Render(&buf); err != nil {
+			g.Errs.Add(errRender.InFile(source.ToIO()).Wrapping(err))
+			continue
+		}
+
+		// Get a copy of the buffer since we reuse it across files.
+		contents := slices.Clone(buf.Bytes())
+
+		of = append(of, overlay.File{
+			Source:   source,
+			Contents: contents,
+		})
+	}
+
+	for f, rw := range g.rewrites {
+		source := f.Pkg.FSPath.Join(f.Name)
+		of = append(of, overlay.File{
+			Source:   source,
+			Contents: rw.Data(),
+		})
+	}
+
+	return of
+}
+
+// InsertTestSupport inserts an import of the testsupport package in the given package.
+func (g *Generator) InsertTestSupport(pkg *pkginfo.Package) {
+	if g.addedTestSupport[pkg.ImportPath] {
+		return
+	}
+	g.addedTestSupport[pkg.ImportPath] = true
+
+	file := pkg.Files[0]
+	rw := g.Rewrite(file)
+	a := file.AST()
+
+	insertPos := a.Name.End()
+	ln := g.FS.Position(insertPos)
+	rw.Insert(insertPos, []byte(fmt.Sprintf("\nimport _ %s;/*line :%d:%d*/",
+		strconv.Quote("encore.dev/appruntime/shared/testsupport"), ln.Line, ln.Column)))
+}
diff --git a/v2/codegen/infragen/cachegen/cachegen.go b/v2/codegen/infragen/cachegen/cachegen.go
new file mode 100644
index 0000000000..42690c86e0
--- /dev/null
+++ b/v2/codegen/infragen/cachegen/cachegen.go
@@ -0,0 +1,131 @@
+package cachegen
+
+import (
+	"fmt"
+	"strconv"
+	"strings"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/resourcepaths"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/infra/caches"
+)
+
+func GenKeyspace(gen *codegen.Generator, pkg *pkginfo.Package, keyspaces []*caches.Keyspace) {
+	f := gen.File(pkg, "cache")
+	for idx, ks := range keyspaces {
+		genKeyspaceMappers(gen, f, ks, idx)
+	}
+}
+
+func genKeyspaceMappers(gen *codegen.Generator, f *codegen.File, ks *caches.Keyspace, idx int) {
+	// Construct the key mapper function. We use the index since keyspaces
+	// do not have resource names.
+	mapper := f.FuncDecl("keyMapper", strconv.Itoa(idx))
+
+	const input = "in"
+	mapper.Params(Id(input).Add(gen.Util.Type(ks.KeyType)))
+	mapper.Results(String())
+	mapper.Body(Return(computePathExpression(gen.Errs, ks)))
+
+	// Insert the label mapper configuration into the config literal.
+	snippet := fmt.Sprintf("EncoreInternal_KeyMapper: %s,", mapper.Name())
+	gen.Rewrite(ks.File).Insert(ks.ConfigLiteral.Lbrace+1, []byte(snippet))
+}
+
+const input = "in"
+
+func computePathExpression(errs *perr.List, ks *caches.Keyspace) *Statement {
+	structFields, isBuiltin := getStructFields(errs, ks.KeyType)
+	var (
+		pathLit strings.Builder
+		fmtArgs []Code
+	)
+	for i, seg := range ks.Path.Segments {
+		if i > 0 {
+			pathLit.WriteString("/")
+		}
+		if seg.Type == resourcepaths.Literal {
+			pathLit.WriteString(seg.Value)
+			continue
+		}
+
+		if isBuiltin {
+			verb, expr := rewriteBuiltin(structFields[builtinKey], Id(input))
+			pathLit.WriteString(verb)
+			fmtArgs = append(fmtArgs, expr)
+		} else {
+			verb, expr := rewriteBuiltin(structFields[seg.Value], Id(input).Dot(seg.Value))
+			pathLit.WriteString(verb)
+			fmtArgs = append(fmtArgs, expr)
+		}
+	}
+
+	if len(fmtArgs) == 0 {
+		// If there are no formatting arguments, return the string as a constant literal.
+		return Lit(pathLit.String())
+	} else {
+		// Otherwise pass them to fmt.Sprintf.
+		args := append([]Code{Lit(pathLit.String())}, fmtArgs...)
+		return Qual("fmt", "Sprintf").Call(args...)
+	}
+}
+
+// builtinKey is the key to use into the structFields map when the key is a builtin.
+const builtinKey = "__builtin__"
+
+// getStructFields resolves the struct key fields for the given keyspace.
+func getStructFields(errs *perr.List, keyType schema.Type) (structFields map[string]schema.BuiltinKind, isBuiltin bool) {
+	if b, ok := keyType.(schema.BuiltinType); ok {
+		return map[string]schema.BuiltinKind{builtinKey: b.Kind}, true
+	}
+
+	// structFields provides a map of field names to the builtin
+	// they represent. We're guaranteed these are all builtins by
+	// the parser.
+	structFields = make(map[string]schema.BuiltinKind)
+	ref, ok := schemautil.ResolveNamedStruct(keyType, false)
+	if !ok {
+		errs.AddPos(keyType.ASTExpr().Pos(), "invalid cache key type: must be a named struct")
+		return nil, false
+	} else if ref.Pointers > 0 {
+		errs.AddPos(keyType.ASTExpr().Pos(), "invalid cache key type: must not be a pointer type")
+		return nil, false
+	}
+	st := schemautil.ConcretizeWithTypeArgs(errs, ref.Decl.Type, ref.TypeArgs).(schema.StructType)
+
+	for _, f := range st.Fields {
+		if f.IsAnonymous() {
+			errs.AddPos(f.AST.Pos(), "anonymous fields are not supported in cache keys")
+			continue
+		} else if f.Type.Family() != schema.Builtin {
+			errs.Addf(f.AST.Pos(), "invalid cache key field %s: must be builtin",
+				f.Name.MustGet())
+			continue
+		}
+
+		structFields[f.Name.MustGet()] = f.Type.(schema.BuiltinType).Kind
+	}
+	return structFields, false
+}
+
+// rewriteBuiltin returns the code to rewrite a builtin type for use as a cache key.
+func rewriteBuiltin(kind schema.BuiltinKind, expr Code) (verb string, rewritten Code) {
+	switch kind {
+	case schema.String:
+		return "%s", Qual("strings", "ReplaceAll").Call(expr, Lit("/"), Lit(`\/`))
+	case schema.Bytes:
+		return "%s", Qual("bytes", "ReplaceAll").Call(
+			expr,
+			Index().Byte().Parens(Lit("/")),
+			Index().Byte().Parens(Lit(`\/`)),
+		)
+	default:
+		return "%v", expr
+	}
+}
diff --git a/v2/codegen/infragen/configgen/configgen.go b/v2/codegen/infragen/configgen/configgen.go
new file mode 100644
index 0000000000..c3f78b6f0d
--- /dev/null
+++ b/v2/codegen/infragen/configgen/configgen.go
@@ -0,0 +1,518 @@
+package configgen
+
+import (
+	"bytes"
+	"cmp"
+	"fmt"
+	"slices"
+	"strconv"
+	"strings"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/pkg/eerror"
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/internal/genutil"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/infra/config"
+)
+
+func Gen(gen *codegen.Generator, svc *app.Service, pkg *pkginfo.Package, loads []*config.Load) {
+	f := gen.File(pkg, "config_unmarshal")
+
+	builder := &configUnmarshalersBuilder{
+		errs:           gen.Errs,
+		gu:             gen.Util,
+		f:              f.Jen,
+		seenNames:      make(map[string]int),
+		allocatedNames: make(map[pkginfo.QualifiedName]string),
+		unmarshalers:   make([]*Statement, 0),
+	}
+	f.Jen.ImportAlias("github.com/json-iterator/go", "jsoniter")
+
+	f.Jen.Comment(`These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().`)
+
+	// Find all the types to write, and then write unmarshalers for them
+	typesToWrite := builder.FindAllDecls(loads)
+
+	// Write load functions for generic types
+	for _, load := range loads {
+		builder.generateConcreteUnmarshalers(load.Type)
+	}
+	if len(builder.unmarshalers) > 0 {
+		builder.f.Line()
+		builder.f.Comment("// Concrete unmarshalers for all config.Load calls, including those using generic types.")
+		builder.f.Comment("// These instances are used directly by calls to `config.Load[T]()`.")
+		builder.f.Var().DefsFunc(func(f *Group) {
+			for _, typ := range builder.unmarshalers {
+				f.Add(typ)
+			}
+		})
+	}
+
+	// Write unmarshalers for all the types needed for config
+	for _, decl := range typesToWrite {
+		if err := builder.WriteTypeUnmarshaler(decl); err != nil {
+			gen.Errs.Addf(decl.AST.Pos(), "failed to generate config unmarshaler for %s: %v", decl.Name, err)
+		}
+	}
+
+	// Rewrite load functions to inject marshallers
+	for _, load := range loads {
+		rw := gen.Rewrite(load.File)
+		var buf bytes.Buffer
+		buf.WriteString(strconv.Quote(svc.Name))
+		buf.WriteString(", ")
+		buf.WriteString(ConfigUnmarshalFuncName(gen.Util, load.Type))
+		ep := gen.FS.Position(load.FuncCall.Rparen)
+		_, _ = fmt.Fprintf(&buf, "/*line :%d:%d*/", ep.Line, ep.Column)
+		rw.Replace(load.FuncCall.Lparen+1, load.FuncCall.Rparen, buf.Bytes())
+	}
+}
+
+type configUnmarshalersBuilder struct {
+	errs *perr.List
+	gu   *genutil.Helper
+	f    *File
+
+	// allocatedNames tracks maps type declarations to the allocated name
+	// of the unmarshaller for that type.
+	allocatedNames map[pkginfo.QualifiedName]string
+	// seenNames tracks the number of times a declaration of a given name has been seen,
+	// to avoid duplicates.
+	seenNames map[string]int
+
+	// Generated code
+	unmarshalers []*Statement
+}
+
+// FindAllDecls returns a list of all decl's used within a list of config loads.
+func (cb *configUnmarshalersBuilder) FindAllDecls(loads []*config.Load) []*schema.TypeDecl {
+	typesToWrite := make(map[*schema.TypeDecl]struct{})
+
+	// Walk the config load calls in this service and find all the named types used
+	for _, load := range loads {
+		schemautil.Walk(load.Type, func(node schema.Type) bool {
+			switch n := node.(type) {
+			case schema.NamedType:
+				// Ignore config.Foo types
+				if n.DeclInfo.File.Pkg.ImportPath != "encore.dev/config" {
+					typesToWrite[n.Decl()] = struct{}{}
+				}
+			}
+			return true
+		})
+	}
+
+	// Now convert the list of decls into a sorted list of nodes
+	decls := make([]*schema.TypeDecl, 0, len(typesToWrite))
+	for decl := range typesToWrite {
+		decls = append(decls, decl)
+	}
+	slices.SortFunc(decls, func(a, b *schema.TypeDecl) int {
+		// Sort first by pkg path and then by name
+		if n := cmp.Compare(a.File.Pkg.ImportPath, b.File.Pkg.ImportPath); n != 0 {
+			return n
+		}
+		return cmp.Compare(a.Name, b.Name)
+	})
+
+	return decls
+}
+
+// WriteTypeUnmarshaler writes a function which will unmarshal the given decl from JSON to the instance of the
+// Go type. If the decl takes type parameters, then the function generated will also be generic and will require
+// unmarshalers for the type parameters to be passed in.
+func (cb *configUnmarshalersBuilder) WriteTypeUnmarshaler(decl *schema.TypeDecl) (err error) {
+	unmarshalerName, _ := cb.typeUnmarshalerName(decl)
+
+	cb.f.Line()
+	cb.f.Commentf(
+		"// %s will unmarshal the JSON representation into the given type, taking account for "+
+			"\n// the `config.Value` dynamic functions.",
+		unmarshalerName,
+	)
+	f := cb.f.Func().Id(unmarshalerName)
+	rtnType := Id("obj").Add(genutil.Q(decl.Info))
+
+	// This is the function body (plus arguments) needed for config.Unmarshaler
+	unmarshalBody := Params(
+		Id("itr").Op("*").Qual("github.com/json-iterator/go", "Iterator"),
+		Id("path").Index().String(),
+	).Params(
+		rtnType,
+	).BlockFunc(func(f *Group) {
+		struc, ok := decl.Type.(schema.StructType)
+		if !ok {
+			err = eerror.New("codegen", "can only unmarshal struct types", nil)
+			return
+		}
+		cb.readStruct(f, struc)
+		f.Return()
+	})
+
+	// If this is a generic type, we add an additional wrapper so we can provide the generic parameters
+	if len(decl.TypeParams) > 0 {
+		typeParams := make([]Code, len(decl.TypeParams))
+		outerParams := make([]Code, len(decl.TypeParams))
+		returnTypeParams := make([]Code, len(decl.TypeParams))
+		for i, param := range decl.TypeParams {
+			typeParams[i] = Id(param.Name).Any()
+			outerParams[i] = Id(cb.typeParamUnmarshalerName(param)).Qual("encore.dev/config", "Unmarshaler").Types(Id(param.Name))
+			returnTypeParams[i] = Id(param.Name)
+		}
+		f = f.Types(typeParams...)
+		rtnType = rtnType.Types(returnTypeParams...)
+
+		// Then the outer function needs to return a concrete instance of an unmarshaler which
+		// uses the unmarshal body
+		f = f.Params(outerParams...).
+			Params(Id("concreteUnmarshaler").Qual("encore.dev/config", "Unmarshaler").Types(Id(decl.Name).Types(returnTypeParams...))).
+			Block(Return(Func().Add(unmarshalBody)))
+	} else {
+		// If this isn't generic, we can just use the unmarshal body directly
+		f.Add(unmarshalBody)
+	}
+
+	return
+}
+
+// readType generates code to read a single instance of the given type directly from `iter` which should be a pointer
+// to a jsoniter.Iterator.
+//
+// The `reader` code returned by this function is expected to be used as the right hand side of a single assignment
+// statement.
+// i.e. `var x = readType(...)` => `var x = iter.ReadBool()`
+//
+// The second return value is the identifier of the type from the first return value.
+// ie. `bool`
+func (cb *configUnmarshalersBuilder) readType(typ schema.Type, pathElement Code) (reader Code, rtnTyp *Statement) {
+	switch t := typ.(type) {
+	case schema.NamedType:
+		if underlying, isList, isConfig := schemautil.UnwrapConfigType(cb.errs, t); isConfig {
+			if isList {
+				code, _ := cb.readType(schema.ListType{Elem: underlying}, pathElement)
+				_, returnType := cb.readType(underlying, pathElement)
+				return Qual("encore.dev/config", "CreateValueList").Call(code, Append(Id("path"), pathElement)), Qual("encore.dev/config", "Values").Types(returnType)
+			} else {
+				code, returnType := cb.readType(underlying, pathElement)
+				return Qual("encore.dev/config", "CreateValue").Types(returnType).Call(
+					code, Append(Id("path"), pathElement)), Qual("encore.dev/config", "Value").Types(returnType)
+			}
+		}
+
+		funcRef, returnType := cb.typeUnmarshalerFunc(typ)
+
+		return funcRef.Call(
+			Id("itr"),
+			Append(Id("path"), pathElement),
+		), returnType
+
+	case schema.StructType:
+		var returnType = Nil()
+		block := BlockFunc(func(f *Group) {
+			returnType = cb.readStruct(f, t)
+			f.Return()
+		})
+		return Func().Params().Params(Id("obj").Add(returnType)).Add(block).Call(), returnType
+
+	case schema.MapType:
+		_, keyType := cb.readType(t.Key, nil)
+		valueUnmarshaler, valueType := cb.readType(t.Value, Id("keyAsString"))
+		rtnType := Map(keyType).Add(valueType)
+
+		// Call a helper method in the runtime package, which requires us to pass a callback
+		// which returns the unmarshalled keys and values.
+		return Qual("encore.dev/config", "ReadMap").Types(keyType, valueType).Call(
+				Id("itr"),
+				Func().Params(
+					Id("itr").Op("*").Qual("github.com/json-iterator/go", "Iterator"),
+					Id("keyAsString").String(),
+				).Params(keyType, valueType).BlockFunc(func(f *Group) {
+					// Note because _all_ keys in JSON objects are strings, we use
+					// the etype unmarshaler to unmarshal the key to the underlying datatype
+					f.Comment("Decode the map key from the JSON string to the underlying type it needs to be")
+					u := cb.gu.NewTypeUnmarshaller("keyDecoder")
+					f.Add(u.Init())
+					builtin, ok := t.Key.(schema.BuiltinType)
+					if !ok {
+						cb.errs.Addf(t.Key.ASTExpr().Pos(), "map keys must be builtins")
+						return
+					}
+					f.Id("key").Op(":=").Add(u.UnmarshalBuiltin(builtin.Kind, "keyAsString", Id("keyAsString"), true))
+					f.If(Err().Op(":=").Add(u.Err()), Err().Op("!=").Nil()).Block(
+						Panic(Qual("fmt", "Sprintf").Call(Lit("unable to decode the config: %v"), Err())))
+
+					// Then we can just return the key and value
+					f.Return(Id("key"), valueUnmarshaler)
+				}),
+			),
+			rtnType
+
+	case schema.ListType:
+		unmarshaler, returnType := cb.readType(t.Elem, Qual("strconv", "Itoa").Call(Id("idx")))
+
+		// We'll call a helper method in the runtime package, which requires us to pass
+		// an unmarshaler for the list type and builds the return slice
+		return Qual("encore.dev/config", "ReadArray").Types(returnType).Call(
+				Id("itr"),
+				Func().Params(
+					Id("itr").Op("*").Qual("github.com/json-iterator/go", "Iterator"),
+					Id("idx").Int(),
+				).Add(returnType).Block(
+					Return(unmarshaler),
+				),
+			),
+			Index().Add(returnType)
+
+	case schema.BuiltinType:
+		return cb.readBuiltin(t.Kind)
+
+	case schema.PointerType:
+		reader, returnType := cb.readType(t.Elem, pathElement)
+
+		return Func().Params().Op("*").Add(returnType).Block(
+			Comment("// If the value is null, we return nil"),
+			If(Id("itr").Dot("ReadNil").Call()).Block(
+				Return(Nil()),
+			),
+			Line(),
+			Comment("// Otherwise we unmarshal the value and return a pointer to it"),
+			Id("obj").Op(":=").Add(reader),
+			Return(Op("&").Id("obj")),
+		).Call(), Op("*").Add(returnType)
+
+	case schema.TypeParamRefType:
+		typeParam := t.Decl.TypeParameters()[t.Index]
+		funcName := cb.typeParamUnmarshalerName(typeParam)
+
+		return Id(funcName).Call(Id("itr"), Append(Id("path"), pathElement)), Id(typeParam.Name)
+
+	default:
+		panic(fmt.Sprintf("unsupported type for config unmarshalling: %T", t))
+	}
+}
+
+// readStruct generates code to read a struct from the given iterator. The code generated by this function
+// expects a zero value of the struct to be present in the variable `obj`. This code will be written into the
+// group `f` passed in as a argument.
+//
+// The returned type will be the type definition of the struct.
+func (cb *configUnmarshalersBuilder) readStruct(f *Group, struc schema.StructType) (returnType *Statement) {
+	fieldTypes := make([]Code, len(struc.Fields))
+
+	f.Id("itr").Dot("ReadObjectCB").Call(Func().Params(
+		Id("itr").Op("*").Qual("github.com/json-iterator/go", "Iterator"),
+		Id("field").String(),
+	).Bool().Block(
+		Switch(Id("field")).BlockFunc(func(f *Group) {
+			for i, field := range struc.Fields {
+				if field.IsAnonymous() {
+					continue // TODO(andre) should this be an error?
+				}
+
+				fieldName := field.Name.MustGet()
+				jsonName := fieldName
+				for _, tag := range field.Tag.Tags() {
+					if tag.Key == "json" {
+						if tag.Name != "" {
+							jsonName = tag.Name
+						}
+					}
+				}
+
+				rhs, returnType := cb.readType(field.Type, Lit(jsonName))
+				f.Case(Lit(jsonName)).Block(Id("obj").Dot(fieldName).Op("=").Add(rhs))
+
+				fieldTypes[i] = Id(fieldName).Add(returnType)
+
+			}
+
+			f.Default().Block(Id("itr").Dot("Skip").Call())
+		}),
+		Return(True()),
+	))
+
+	return Struct(fieldTypes...)
+}
+
+// typeUnmarshalerFunc returns a `f` function which can be used to read the given value of `typ` and the type
+// that function f returns.
+//
+// The returned function will either be an inline function or an identifier for function defined in the package
+// and is expected to comply with the `config.Unmarshaler[T]` type defined in the runtime.
+func (cb *configUnmarshalersBuilder) typeUnmarshalerFunc(typ schema.Type) (f *Statement, returnType *Statement) {
+	switch t := typ.(type) {
+	case schema.NamedType:
+		// Treat the config type as its underlying type
+		if underlying, isList, isConfig := schemautil.UnwrapConfigType(cb.errs, t); isConfig {
+			if isList {
+				underlying = schema.ListType{Elem: underlying}
+			}
+			return cb.typeUnmarshalerFunc(underlying)
+		}
+
+		name, returnType := cb.typeUnmarshalerName(t.Decl())
+
+		if len(t.TypeArgs) == 0 {
+			return Id(name), returnType
+		} else {
+			returnTypes := make([]Code, len(t.TypeArgs))
+			call := CallFunc(func(f *Group) {
+				for i, arg := range t.TypeArgs {
+					funcToCall, returnType := cb.typeUnmarshalerFunc(arg)
+					returnTypes[i] = returnType
+					f.Add(funcToCall)
+				}
+			})
+
+			f := Id(name).Types(returnTypes...).Add(call)
+
+			return f, returnType.Types(returnTypes...)
+		}
+	default:
+		unmarshaler, returnType := cb.readType(typ, nil)
+
+		return Func().Params(
+			Id("itr").Op("*").Qual("github.com/json-iterator/go", "Iterator"),
+			Id("path").Index().String(),
+		).Params(
+			returnType,
+		).Block(
+			Return(unmarshaler),
+		), returnType
+
+	}
+}
+
+// typeUnmarshalerName returns a generated name for the unmarshaler function for the given type and the type that
+// the decl is.
+func (cb *configUnmarshalersBuilder) typeUnmarshalerName(decl *schema.TypeDecl) (reader string, rtnTyp *Statement) {
+	rtnTyp = genutil.Q(decl.Info)
+
+	// If we've already allocated a name for this type, reuse it.
+	key := decl.Info.QualifiedName()
+	if allocated, ok := cb.allocatedNames[key]; ok {
+		return allocated, rtnTyp
+	}
+
+	// Otherwise allocate a new name.
+	name := fmt.Sprintf("encoreInternalTypeConfigUnmarshaler_%s_%s", decl.File.Pkg.Name, decl.Name)
+	if n := cb.seenNames[name]; n > 0 {
+		name += strconv.Itoa(n + 1)
+	}
+	cb.seenNames[decl.Name]++
+	cb.allocatedNames[key] = name
+
+	return name, rtnTyp
+}
+
+// readBuiltin returns reader code for reading the built in type from `itr` (a `*jsonitor.Iterator`) and the
+// Go type for the built in value.
+func (cb *configUnmarshalersBuilder) readBuiltin(builtin schema.BuiltinKind) (reader Code, rtnTyp *Statement) {
+	switch builtin {
+	case schema.Bool:
+		return Id("itr").Dot("ReadBool").Call(), Bool()
+	case schema.Int:
+		return Id("itr").Dot("ReadInt").Call(), Int()
+	case schema.Int8:
+		return Id("itr").Dot("ReadInt8").Call(), Int8()
+	case schema.Int16:
+		return Id("itr").Dot("ReadInt16").Call(), Int16()
+	case schema.Int32:
+		return Id("itr").Dot("ReadInt32").Call(), Int32()
+	case schema.Int64:
+		return Id("itr").Dot("ReadInt64").Call(), Int64()
+	case schema.Uint:
+		return Id("itr").Dot("ReadUint").Call(), Uint()
+	case schema.Uint8:
+		return Id("itr").Dot("ReadUint8").Call(), Uint8()
+	case schema.Uint16:
+		return Id("itr").Dot("ReadUint16").Call(), Uint16()
+	case schema.Uint32:
+		return Id("itr").Dot("ReadUint32").Call(), Uint32()
+	case schema.Uint64:
+		return Id("itr").Dot("ReadUint64").Call(), Uint64()
+	case schema.Float32:
+		return Id("itr").Dot("ReadFloat32").Call(), Float32()
+	case schema.Float64:
+		return Id("itr").Dot("ReadFloat64").Call(), Float64()
+	case schema.String:
+		return Id("itr").Dot("ReadString").Call(), String()
+	case schema.Bytes, schema.Time, schema.UUID, schema.JSON, schema.UserID:
+		var rtnTyp *Statement
+		switch builtin {
+		case schema.Bytes:
+			rtnTyp = Index().Byte()
+		case schema.Time:
+			rtnTyp = Qual("time", "Time")
+		case schema.UUID:
+			rtnTyp = Qual("encore.dev/types/uuid", "UUID")
+		case schema.JSON:
+			rtnTyp = Qual("encoding/json", "RawMessage")
+		case schema.UserID:
+			rtnTyp = Qual("encore.dev/beta/auth", "UID")
+		}
+
+		return Func().Params().Params(Id("rtn").Add(rtnTyp)).BlockFunc(func(g *Group) {
+			u := cb.gu.NewTypeUnmarshaller("decoder")
+			g.Add(u.Init())
+			g.Id("rtn").Op("=").Add(u.UnmarshalBuiltin(
+				builtin,
+				"value",
+				Id("itr").Dot("ReadString").Call(),
+				true,
+			))
+			g.If(Err().Op(":=").Add(u.Err()), Err().Op("!=").Nil()).Block(
+				Panic(Qual("fmt", "Sprintf").Call(Lit("unable to decode the config: %v"), Err())),
+			)
+			g.Return()
+		}).Call(), rtnTyp
+	default:
+		panic(fmt.Sprintf("unsupported builtin type: %v", builtin))
+	}
+}
+
+// typeParamUnmarshalerName generates a name for an unmarshaler function given as a argument to a generic unmarshaler
+// function.
+func (cb *configUnmarshalersBuilder) typeParamUnmarshalerName(param schema.DeclTypeParam) string {
+	return fmt.Sprintf("_%s_unmarshaler", param.Name)
+}
+
+// generateConcreteUnmarshaler generates a function that unmarshals a concrete type, taking into account any
+// type arguments passed to the given type
+func (cb *configUnmarshalersBuilder) generateConcreteUnmarshalers(typ schema.Type) {
+	funcBody, _ := cb.typeUnmarshalerFunc(typ)
+	funcName := ConfigUnmarshalFuncName(cb.gu, typ)
+
+	cb.unmarshalers = append(cb.unmarshalers, Id(funcName).Op("=").Add(funcBody))
+}
+
+// ConfigUnmarshalFuncName returns a unique name for an unmarshal function fo a concrete
+// instance of a type. For example the following types will result in the given names:
+//
+// - `int` -> `encoreInternal_LoadConfig_int`
+// - `ConfigType` -> `encoreInternal_LoadConfig_ConfigType`
+// - `ConfigType[int, string]` -> `encoreInternal_LoadConfig_ConfigType_int_string_`
+func ConfigUnmarshalFuncName(gu *genutil.Helper, typ schema.Type) string {
+	typeAsString := gu.TypeToString(typ)
+	typeAsString = strings.NewReplacer(
+		"*", "ptr_",
+		"[", "_",
+		"]", "_",
+		",", "_",
+		".", "_",
+		" ", "",
+		"\t", "",
+		"\n", "",
+	).Replace(typeAsString)
+
+	return fmt.Sprintf("encoreInternalConfigUnmarshaler_%s", typeAsString)
+}
diff --git a/v2/codegen/infragen/configgen/configgen_test.go b/v2/codegen/infragen/configgen/configgen_test.go
new file mode 100644
index 0000000000..86163d91cb
--- /dev/null
+++ b/v2/codegen/infragen/configgen/configgen_test.go
@@ -0,0 +1,18 @@
+package configgen_test
+
+import (
+	"testing"
+
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/infragen"
+	"encr.dev/v2/codegen/internal/codegentest"
+)
+
+func TestCodegen(t *testing.T) {
+	fn := func(gen *codegen.Generator, desc *app.Desc) {
+		infragen.Process(gen, desc)
+	}
+
+	codegentest.Run(t, fn)
+}
diff --git a/v2/codegen/infragen/configgen/testdata/basic_config.txt b/v2/codegen/infragen/configgen/testdata/basic_config.txt
new file mode 100644
index 0000000000..606b705a6f
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/basic_config.txt
@@ -0,0 +1,132 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type Config struct {
+    Name        string    // The users name
+    Port        uint16
+    ReadOnly    bool      // true if we're in read only mode
+
+    // MagicNumber is complicated and requires
+    // a multi-line comment to explain it.
+    MagicNumber int
+
+    ID          uuid.UUID // An ID
+
+    PublicKey []byte
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import (
+	__etype "encore.dev/appruntime/shared/etype"
+	uuid "encore.dev/types/uuid"
+	"fmt"
+	jsoniter "github.com/json-iterator/go"
+)
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Name":
+			obj.Name = itr.ReadString()
+		case "Port":
+			obj.Port = itr.ReadUint16()
+		case "ReadOnly":
+			obj.ReadOnly = itr.ReadBool()
+		case "MagicNumber":
+			obj.MagicNumber = itr.ReadInt()
+		case "ID":
+			obj.ID = func() (rtn uuid.UUID) {
+				decoder := new(__etype.Unmarshaller)
+				rtn = __etype.UnmarshalOne(decoder, __etype.UnmarshalUUID, "value", itr.ReadString(), true)
+				if err := decoder.Error; err != nil {
+					panic(fmt.Sprintf("unable to decode the config: %v", err))
+				}
+				return
+			}()
+		case "PublicKey":
+			obj.PublicKey = func() (rtn []byte) {
+				decoder := new(__etype.Unmarshaller)
+				rtn = __etype.UnmarshalOne(decoder, __etype.UnmarshalBytes, "value", itr.ReadString(), true)
+				if err := decoder.Error; err != nil {
+					panic(fmt.Sprintf("unable to decode the config: %v", err))
+				}
+				return
+			}()
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+	"encore.dev/types/uuid"
+)
+
+type Config struct {
+    Name        string    // The users name
+    Port        uint16
+    ReadOnly    bool      // true if we're in read only mode
+
+    // MagicNumber is complicated and requires
+    // a multi-line comment to explain it.
+    MagicNumber int
+
+    ID          uuid.UUID // An ID
+
+    PublicKey []byte
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :24:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/basic_inline_struct.txt b/v2/codegen/infragen/configgen/testdata/basic_inline_struct.txt
new file mode 100644
index 0000000000..fa912fd660
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/basic_inline_struct.txt
@@ -0,0 +1,105 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    // The options for the HTTP server
+    HTTP struct {
+        Enabled bool // Is this option enabled?
+        Port    uint32 // What port should we run on?
+    }
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import jsoniter "github.com/json-iterator/go"
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "HTTP":
+			obj.HTTP = func() (obj struct {
+				Enabled bool
+				Port    uint32
+			}) {
+				itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+					switch field {
+					case "Enabled":
+						obj.Enabled = itr.ReadBool()
+					case "Port":
+						obj.Port = itr.ReadUint32()
+					default:
+						itr.Skip()
+					}
+					return true
+				})
+				return
+			}()
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    // The options for the HTTP server
+    HTTP struct {
+        Enabled bool // Is this option enabled?
+        Port    uint32 // What port should we run on?
+    }
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :17:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/basic_lists.txt b/v2/codegen/infragen/configgen/testdata/basic_lists.txt
new file mode 100644
index 0000000000..2173fd9eaf
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/basic_lists.txt
@@ -0,0 +1,92 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    Ages      []int32
+    OtherBits []string
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import (
+	config "encore.dev/config"
+	jsoniter "github.com/json-iterator/go"
+)
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Ages":
+			obj.Ages = config.ReadArray[int32](itr, func(itr *jsoniter.Iterator, idx int) int32 {
+				return itr.ReadInt32()
+			})
+		case "OtherBits":
+			obj.OtherBits = config.ReadArray[string](itr, func(itr *jsoniter.Iterator, idx int) string {
+				return itr.ReadString()
+			})
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    Ages      []int32
+    OtherBits []string
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :14:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/basic_maps.txt b/v2/codegen/infragen/configgen/testdata/basic_maps.txt
new file mode 100644
index 0000000000..0fecca8a5f
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/basic_maps.txt
@@ -0,0 +1,94 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    Ages map[string]int
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import (
+	__etype "encore.dev/appruntime/shared/etype"
+	config "encore.dev/config"
+	"fmt"
+	jsoniter "github.com/json-iterator/go"
+)
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Ages":
+			obj.Ages = config.ReadMap[string, int](itr, func(itr *jsoniter.Iterator, keyAsString string) (string, int) {
+				// Decode the map key from the JSON string to the underlying type it needs to be
+				keyDecoder := new(__etype.Unmarshaller)
+				key := __etype.UnmarshalOne(keyDecoder, __etype.UnmarshalString, "keyAsString", keyAsString, true)
+				if err := keyDecoder.Error; err != nil {
+					panic(fmt.Sprintf("unable to decode the config: %v", err))
+				}
+				return key, itr.ReadInt()
+			})
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    Ages map[string]int
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :13:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/basic_named_struct_multiple_uses.txt b/v2/codegen/infragen/configgen/testdata/basic_named_struct_multiple_uses.txt
new file mode 100644
index 0000000000..2c95069693
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/basic_named_struct_multiple_uses.txt
@@ -0,0 +1,118 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+// ServerOptions represent options for a server
+type ServerOptions struct {
+    Enabled bool // Is this option enabled?
+    Port    uint32 // What port should we run on?
+}
+
+type Config struct {
+    HTTP ServerOptions // The options for the HTTP server
+    TCP  ServerOptions // The options for the TCP server
+    GRPC ServerOptions // The options for the GRPC server
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import jsoniter "github.com/json-iterator/go"
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "HTTP":
+			obj.HTTP = encoreInternalTypeConfigUnmarshaler_svc_ServerOptions(itr, append(path, "HTTP"))
+		case "TCP":
+			obj.TCP = encoreInternalTypeConfigUnmarshaler_svc_ServerOptions(itr, append(path, "TCP"))
+		case "GRPC":
+			obj.GRPC = encoreInternalTypeConfigUnmarshaler_svc_ServerOptions(itr, append(path, "GRPC"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_svc_ServerOptions will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_ServerOptions(itr *jsoniter.Iterator, path []string) (obj ServerOptions) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Enabled":
+			obj.Enabled = itr.ReadBool()
+		case "Port":
+			obj.Port = itr.ReadUint32()
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+// ServerOptions represent options for a server
+type ServerOptions struct {
+    Enabled bool // Is this option enabled?
+    Port    uint32 // What port should we run on?
+}
+
+type Config struct {
+    HTTP ServerOptions // The options for the HTTP server
+    TCP  ServerOptions // The options for the TCP server
+    GRPC ServerOptions // The options for the GRPC server
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :21:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/basic_named_struct_single_use.txt b/v2/codegen/infragen/configgen/testdata/basic_named_struct_single_use.txt
new file mode 100644
index 0000000000..0def2273a8
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/basic_named_struct_single_use.txt
@@ -0,0 +1,108 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type ServerOptions struct {
+    Enabled bool // Is this option enabled?
+    Port    uint32 // What port should we run on?
+}
+
+type Config struct {
+    HTTP ServerOptions // The options for the HTTP server
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import jsoniter "github.com/json-iterator/go"
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "HTTP":
+			obj.HTTP = encoreInternalTypeConfigUnmarshaler_svc_ServerOptions(itr, append(path, "HTTP"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_svc_ServerOptions will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_ServerOptions(itr *jsoniter.Iterator, path []string) (obj ServerOptions) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Enabled":
+			obj.Enabled = itr.ReadBool()
+		case "Port":
+			obj.Port = itr.ReadUint32()
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type ServerOptions struct {
+    Enabled bool // Is this option enabled?
+    Port    uint32 // What port should we run on?
+}
+
+type Config struct {
+    HTTP ServerOptions // The options for the HTTP server
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :18:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/basic_no_config.txt b/v2/codegen/infragen/configgen/testdata/basic_no_config.txt
new file mode 100644
index 0000000000..467a038405
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/basic_no_config.txt
@@ -0,0 +1,11 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/basic_with_cue_imports.txt b/v2/codegen/infragen/configgen/testdata/basic_with_cue_imports.txt
new file mode 100644
index 0000000000..5f34615082
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/basic_with_cue_imports.txt
@@ -0,0 +1,95 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    SomeTime time.Time
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import (
+	__etype "encore.dev/appruntime/shared/etype"
+	"fmt"
+	jsoniter "github.com/json-iterator/go"
+	"time"
+)
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "SomeTime":
+			obj.SomeTime = func() (rtn time.Time) {
+				decoder := new(__etype.Unmarshaller)
+				rtn = __etype.UnmarshalOne(decoder, __etype.UnmarshalTime, "value", itr.ReadString(), true)
+				if err := decoder.Error; err != nil {
+					panic(fmt.Sprintf("unable to decode the config: %v", err))
+				}
+				return
+			}()
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+    "time"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    SomeTime time.Time
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :14:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/basic_wrappers.txt b/v2/codegen/infragen/configgen/testdata/basic_wrappers.txt
new file mode 100644
index 0000000000..dcee87fe37
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/basic_wrappers.txt
@@ -0,0 +1,151 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    Name        config.String    // The users name
+    Port        config.Uint16
+    ReadOnly    config.Bool      // true if we're in read only mode
+
+    // MagicNumber is complicated and requires
+    // a multi-line comment to explain it.
+    MagicNumber config.Int
+
+    Start       config.Time // The time at which the service was first started
+    ID          config.UUID // An ID
+
+    PublicKey config.Value[[]byte]
+
+    AdminUsers config.Values[string]
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import (
+	__etype "encore.dev/appruntime/shared/etype"
+	config "encore.dev/config"
+	uuid "encore.dev/types/uuid"
+	"fmt"
+	jsoniter "github.com/json-iterator/go"
+	"time"
+)
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Name":
+			obj.Name = config.CreateValue[string](itr.ReadString(), append(path, "Name"))
+		case "Port":
+			obj.Port = config.CreateValue[uint16](itr.ReadUint16(), append(path, "Port"))
+		case "ReadOnly":
+			obj.ReadOnly = config.CreateValue[bool](itr.ReadBool(), append(path, "ReadOnly"))
+		case "MagicNumber":
+			obj.MagicNumber = config.CreateValue[int](itr.ReadInt(), append(path, "MagicNumber"))
+		case "Start":
+			obj.Start = config.CreateValue[time.Time](func() (rtn time.Time) {
+				decoder := new(__etype.Unmarshaller)
+				rtn = __etype.UnmarshalOne(decoder, __etype.UnmarshalTime, "value", itr.ReadString(), true)
+				if err := decoder.Error; err != nil {
+					panic(fmt.Sprintf("unable to decode the config: %v", err))
+				}
+				return
+			}(), append(path, "Start"))
+		case "ID":
+			obj.ID = config.CreateValue[uuid.UUID](func() (rtn uuid.UUID) {
+				decoder := new(__etype.Unmarshaller)
+				rtn = __etype.UnmarshalOne(decoder, __etype.UnmarshalUUID, "value", itr.ReadString(), true)
+				if err := decoder.Error; err != nil {
+					panic(fmt.Sprintf("unable to decode the config: %v", err))
+				}
+				return
+			}(), append(path, "ID"))
+		case "PublicKey":
+			obj.PublicKey = config.CreateValue[[]byte](func() (rtn []byte) {
+				decoder := new(__etype.Unmarshaller)
+				rtn = __etype.UnmarshalOne(decoder, __etype.UnmarshalBytes, "value", itr.ReadString(), true)
+				if err := decoder.Error; err != nil {
+					panic(fmt.Sprintf("unable to decode the config: %v", err))
+				}
+				return
+			}(), append(path, "PublicKey"))
+		case "AdminUsers":
+			obj.AdminUsers = config.CreateValueList(config.ReadArray[string](itr, func(itr *jsoniter.Iterator, idx int) string {
+				return itr.ReadString()
+			}), append(path, "AdminUsers"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    Name        config.String    // The users name
+    Port        config.Uint16
+    ReadOnly    config.Bool      // true if we're in read only mode
+
+    // MagicNumber is complicated and requires
+    // a multi-line comment to explain it.
+    MagicNumber config.Int
+
+    Start       config.Time // The time at which the service was first started
+    ID          config.UUID // An ID
+
+    PublicKey config.Value[[]byte]
+
+    AdminUsers config.Values[string]
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :26:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/cue_optional_tag.txt b/v2/codegen/infragen/configgen/testdata/cue_optional_tag.txt
new file mode 100644
index 0000000000..36e0e1e456
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/cue_optional_tag.txt
@@ -0,0 +1,120 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type ServerOption struct {
+    Option   int64
+    Disabled bool `cue:",opt"` // True if this is disabled
+}
+
+type Config struct {
+    HTTP    ServerOption
+    Another ServerOption
+    TCP     ServerOption `cue:",opt"`
+    GRPC    ServerOption `cue:",opt"`
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import jsoniter "github.com/json-iterator/go"
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "HTTP":
+			obj.HTTP = encoreInternalTypeConfigUnmarshaler_svc_ServerOption(itr, append(path, "HTTP"))
+		case "Another":
+			obj.Another = encoreInternalTypeConfigUnmarshaler_svc_ServerOption(itr, append(path, "Another"))
+		case "TCP":
+			obj.TCP = encoreInternalTypeConfigUnmarshaler_svc_ServerOption(itr, append(path, "TCP"))
+		case "GRPC":
+			obj.GRPC = encoreInternalTypeConfigUnmarshaler_svc_ServerOption(itr, append(path, "GRPC"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_svc_ServerOption will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_ServerOption(itr *jsoniter.Iterator, path []string) (obj ServerOption) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Option":
+			obj.Option = itr.ReadInt64()
+		case "Disabled":
+			obj.Disabled = itr.ReadBool()
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type ServerOption struct {
+    Option   int64
+    Disabled bool `cue:",opt"` // True if this is disabled
+}
+
+type Config struct {
+    HTTP    ServerOption
+    Another ServerOption
+    TCP     ServerOption `cue:",opt"`
+    GRPC    ServerOption `cue:",opt"`
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :21:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/cue_tags.txt b/v2/codegen/infragen/configgen/testdata/cue_tags.txt
new file mode 100644
index 0000000000..5a23fa94cc
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/cue_tags.txt
@@ -0,0 +1,89 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    A int
+    B int `cue:"A+C"`
+    C int `cue:"B-A"`
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import jsoniter "github.com/json-iterator/go"
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "A":
+			obj.A = itr.ReadInt()
+		case "B":
+			obj.B = itr.ReadInt()
+		case "C":
+			obj.C = itr.ReadInt()
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    A int
+    B int `cue:"A+C"`
+    C int `cue:"B-A"`
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :15:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/generics.txt b/v2/codegen/infragen/configgen/testdata/generics.txt
new file mode 100644
index 0000000000..5874675d87
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/generics.txt
@@ -0,0 +1,258 @@
+-- generics.go --
+package generics
+
+import (
+    "context"
+    "encore.dev/config"
+)
+
+type CfgType[T any] struct {
+	ReadOnlyMode config.Bool
+	PublicKey    config.Bytes
+	AdminUsers   config.Values[string]
+
+	SubConfig config.Value[struct {
+		SubKey *SubCfgType[T]
+	}]
+
+	Currencies map[string]struct {
+		Name    config.String
+		Code    config.String
+		Aliases config.Values[string]
+	}
+
+	AnotherList config.Values[struct {
+		Name config.String
+	}]
+}
+
+type SubCfgType[T any] struct {
+	MaxCount T
+}
+
+var cfg = config.Load[*CfgType[uint]]()
+
+type ConfigResponse struct {
+	ReadOnlyMode bool
+	PublicKey    []byte
+	SubKeyCount  uint
+	AdminUsers   []string
+}
+
+// There must be an API endopint to use config.Load.
+//encore:api public
+func Dummy(context.Context) error { return nil }
+-- want:encore_internal__config_unmarshal.go --
+package generics
+
+import (
+	__etype "encore.dev/appruntime/shared/etype"
+	config "encore.dev/config"
+	"fmt"
+	jsoniter "github.com/json-iterator/go"
+)
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_examplecom_CfgType_uint_ = func(itr *jsoniter.Iterator, path []string) *CfgType[uint] {
+		return func() *CfgType[uint] {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_generics_CfgType[uint](func(itr *jsoniter.Iterator, path []string) uint {
+				return itr.ReadUint()
+			})(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_generics_CfgType will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_generics_CfgType[T any](_T_unmarshaler config.Unmarshaler[T]) (concreteUnmarshaler config.Unmarshaler[CfgType[T]]) {
+	return func(itr *jsoniter.Iterator, path []string) (obj CfgType[T]) {
+		itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+			switch field {
+			case "ReadOnlyMode":
+				obj.ReadOnlyMode = config.CreateValue[bool](itr.ReadBool(), append(path, "ReadOnlyMode"))
+			case "PublicKey":
+				obj.PublicKey = config.CreateValue[[]byte](func() (rtn []byte) {
+					decoder := new(__etype.Unmarshaller)
+					rtn = __etype.UnmarshalOne(decoder, __etype.UnmarshalBytes, "value", itr.ReadString(), true)
+					if err := decoder.Error; err != nil {
+						panic(fmt.Sprintf("unable to decode the config: %v", err))
+					}
+					return
+				}(), append(path, "PublicKey"))
+			case "AdminUsers":
+				obj.AdminUsers = config.CreateValueList(config.ReadArray[string](itr, func(itr *jsoniter.Iterator, idx int) string {
+					return itr.ReadString()
+				}), append(path, "AdminUsers"))
+			case "SubConfig":
+				obj.SubConfig = config.CreateValue[struct {
+					SubKey *SubCfgType[T]
+				}](func() (obj struct {
+					SubKey *SubCfgType[T]
+				}) {
+					itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+						switch field {
+						case "SubKey":
+							obj.SubKey = func() *SubCfgType[T] {
+								// If the value is null, we return nil
+								if itr.ReadNil() {
+									return nil
+								}
+
+								// Otherwise we unmarshal the value and return a pointer to it
+								obj := encoreInternalTypeConfigUnmarshaler_generics_SubCfgType[T](func(itr *jsoniter.Iterator, path []string) T {
+									return _T_unmarshaler(itr, append(path))
+								})(itr, append(path, "SubKey"))
+								return &obj
+							}()
+						default:
+							itr.Skip()
+						}
+						return true
+					})
+					return
+				}(), append(path, "SubConfig"))
+			case "Currencies":
+				obj.Currencies = config.ReadMap[string, struct {
+					Name    config.Value[string]
+					Code    config.Value[string]
+					Aliases config.Values[string]
+				}](itr, func(itr *jsoniter.Iterator, keyAsString string) (string, struct {
+					Name    config.Value[string]
+					Code    config.Value[string]
+					Aliases config.Values[string]
+				}) {
+					// Decode the map key from the JSON string to the underlying type it needs to be
+					keyDecoder := new(__etype.Unmarshaller)
+					key := __etype.UnmarshalOne(keyDecoder, __etype.UnmarshalString, "keyAsString", keyAsString, true)
+					if err := keyDecoder.Error; err != nil {
+						panic(fmt.Sprintf("unable to decode the config: %v", err))
+					}
+					return key, func() (obj struct {
+						Name    config.Value[string]
+						Code    config.Value[string]
+						Aliases config.Values[string]
+					}) {
+						itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+							switch field {
+							case "Name":
+								obj.Name = config.CreateValue[string](itr.ReadString(), append(path, "Name"))
+							case "Code":
+								obj.Code = config.CreateValue[string](itr.ReadString(), append(path, "Code"))
+							case "Aliases":
+								obj.Aliases = config.CreateValueList(config.ReadArray[string](itr, func(itr *jsoniter.Iterator, idx int) string {
+									return itr.ReadString()
+								}), append(path, "Aliases"))
+							default:
+								itr.Skip()
+							}
+							return true
+						})
+						return
+					}()
+				})
+			case "AnotherList":
+				obj.AnotherList = config.CreateValueList(config.ReadArray[struct {
+					Name config.Value[string]
+				}](itr, func(itr *jsoniter.Iterator, idx int) struct {
+					Name config.Value[string]
+				} {
+					return func() (obj struct {
+						Name config.Value[string]
+					}) {
+						itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+							switch field {
+							case "Name":
+								obj.Name = config.CreateValue[string](itr.ReadString(), append(path, "Name"))
+							default:
+								itr.Skip()
+							}
+							return true
+						})
+						return
+					}()
+				}), append(path, "AnotherList"))
+			default:
+				itr.Skip()
+			}
+			return true
+		})
+		return
+	}
+}
+
+// encoreInternalTypeConfigUnmarshaler_generics_SubCfgType will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_generics_SubCfgType[T any](_T_unmarshaler config.Unmarshaler[T]) (concreteUnmarshaler config.Unmarshaler[SubCfgType[T]]) {
+	return func(itr *jsoniter.Iterator, path []string) (obj SubCfgType[T]) {
+		itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+			switch field {
+			case "MaxCount":
+				obj.MaxCount = _T_unmarshaler(itr, append(path, "MaxCount"))
+			default:
+				itr.Skip()
+			}
+			return true
+		})
+		return
+	}
+}
+-- want:generics.go --
+package generics
+
+import (
+    "context"
+    "encore.dev/config"
+)
+
+type CfgType[T any] struct {
+	ReadOnlyMode config.Bool
+	PublicKey    config.Bytes
+	AdminUsers   config.Values[string]
+
+	SubConfig config.Value[struct {
+		SubKey *SubCfgType[T]
+	}]
+
+	Currencies map[string]struct {
+		Name    config.String
+		Code    config.String
+		Aliases config.Values[string]
+	}
+
+	AnotherList config.Values[struct {
+		Name config.String
+	}]
+}
+
+type SubCfgType[T any] struct {
+	MaxCount T
+}
+
+var cfg = config.Load[*CfgType[uint]]("generics", encoreInternalConfigUnmarshaler_ptr_examplecom_CfgType_uint_/*line :32:39*/)
+
+type ConfigResponse struct {
+	ReadOnlyMode bool
+	PublicKey    []byte
+	SubKeyCount  uint
+	AdminUsers   []string
+}
+
+// There must be an API endopint to use config.Load.
+//encore:api public
+func Dummy(context.Context) error { return nil }
diff --git a/v2/codegen/infragen/configgen/testdata/json_tags.txt b/v2/codegen/infragen/configgen/testdata/json_tags.txt
new file mode 100644
index 0000000000..b69416a5bb
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/json_tags.txt
@@ -0,0 +1,120 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type ServerOption struct {
+    Option   int64
+    Disabled bool `json:",omitempty"` // True if this is disabled
+}
+
+type Config struct {
+    HTTP    ServerOption
+    Another ServerOption `json:"a_n_o_t_h_e_r"`
+    TCP     ServerOption `json:",omitempty"`
+    GRPC    ServerOption `json:",omitempty"`
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import jsoniter "github.com/json-iterator/go"
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "HTTP":
+			obj.HTTP = encoreInternalTypeConfigUnmarshaler_svc_ServerOption(itr, append(path, "HTTP"))
+		case "a_n_o_t_h_e_r":
+			obj.Another = encoreInternalTypeConfigUnmarshaler_svc_ServerOption(itr, append(path, "a_n_o_t_h_e_r"))
+		case "TCP":
+			obj.TCP = encoreInternalTypeConfigUnmarshaler_svc_ServerOption(itr, append(path, "TCP"))
+		case "GRPC":
+			obj.GRPC = encoreInternalTypeConfigUnmarshaler_svc_ServerOption(itr, append(path, "GRPC"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_svc_ServerOption will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_ServerOption(itr *jsoniter.Iterator, path []string) (obj ServerOption) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Option":
+			obj.Option = itr.ReadInt64()
+		case "Disabled":
+			obj.Disabled = itr.ReadBool()
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type ServerOption struct {
+    Option   int64
+    Disabled bool `json:",omitempty"` // True if this is disabled
+}
+
+type Config struct {
+    HTTP    ServerOption
+    Another ServerOption `json:"a_n_o_t_h_e_r"`
+    TCP     ServerOption `json:",omitempty"`
+    GRPC    ServerOption `json:",omitempty"`
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :21:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
diff --git a/v2/codegen/infragen/configgen/testdata/merge_identical_comments.txt b/v2/codegen/infragen/configgen/testdata/merge_identical_comments.txt
new file mode 100644
index 0000000000..f3b335da7e
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/merge_identical_comments.txt
@@ -0,0 +1,218 @@
+-- svc/a.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type AsConfig struct {
+    // Multiline test
+    // comment to deduplicate.
+    Foo config.String
+}
+
+var _ = config.Load[*AsConfig]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+
+-- svc/b.go --
+package svc
+
+import (
+	"encore.dev/config"
+)
+
+type BsConfig struct{
+    Foo config.String // Some extra comment
+}
+
+var _ = config.Load[BsConfig]()
+
+-- svc/c.go --
+package svc
+
+import (
+	"encore.dev/config"
+)
+
+type CsConfig struct{
+    // Multiline test
+    // comment to deduplicate.
+    Foo config.String
+}
+
+var _ = config.Load[CsConfig]()
+
+-- svc/d.go --
+package svc
+
+import (
+	"encore.dev/config"
+)
+
+type DsConfig struct{
+    Foo config.String // Some extra comment
+}
+
+var _ = config.Load[DsConfig]()
+-- want:svc/a.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type AsConfig struct {
+    // Multiline test
+    // comment to deduplicate.
+    Foo config.String
+}
+
+var _ = config.Load[*AsConfig]("svc", encoreInternalConfigUnmarshaler_ptr_svc_AsConfig/*line :15:32*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+
+-- want:svc/b.go --
+package svc
+
+import (
+	"encore.dev/config"
+)
+
+type BsConfig struct{
+    Foo config.String // Some extra comment
+}
+
+var _ = config.Load[BsConfig]("svc", encoreInternalConfigUnmarshaler_svc_BsConfig/*line :11:31*/)
+
+-- want:svc/c.go --
+package svc
+
+import (
+	"encore.dev/config"
+)
+
+type CsConfig struct{
+    // Multiline test
+    // comment to deduplicate.
+    Foo config.String
+}
+
+var _ = config.Load[CsConfig]("svc", encoreInternalConfigUnmarshaler_svc_CsConfig/*line :13:31*/)
+
+-- want:svc/d.go --
+package svc
+
+import (
+	"encore.dev/config"
+)
+
+type DsConfig struct{
+    Foo config.String // Some extra comment
+}
+
+var _ = config.Load[DsConfig]("svc", encoreInternalConfigUnmarshaler_svc_DsConfig/*line :11:31*/)
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import (
+	config "encore.dev/config"
+	jsoniter "github.com/json-iterator/go"
+)
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_AsConfig = func(itr *jsoniter.Iterator, path []string) *AsConfig {
+		return func() *AsConfig {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_AsConfig(itr, append(path))
+			return &obj
+		}()
+	}
+	encoreInternalConfigUnmarshaler_svc_BsConfig = encoreInternalTypeConfigUnmarshaler_svc_BsConfig
+	encoreInternalConfigUnmarshaler_svc_CsConfig = encoreInternalTypeConfigUnmarshaler_svc_CsConfig
+	encoreInternalConfigUnmarshaler_svc_DsConfig = encoreInternalTypeConfigUnmarshaler_svc_DsConfig
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_AsConfig will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_AsConfig(itr *jsoniter.Iterator, path []string) (obj AsConfig) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Foo":
+			obj.Foo = config.CreateValue[string](itr.ReadString(), append(path, "Foo"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_svc_BsConfig will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_BsConfig(itr *jsoniter.Iterator, path []string) (obj BsConfig) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Foo":
+			obj.Foo = config.CreateValue[string](itr.ReadString(), append(path, "Foo"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_svc_CsConfig will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_CsConfig(itr *jsoniter.Iterator, path []string) (obj CsConfig) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Foo":
+			obj.Foo = config.CreateValue[string](itr.ReadString(), append(path, "Foo"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_svc_DsConfig will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_DsConfig(itr *jsoniter.Iterator, path []string) (obj DsConfig) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Foo":
+			obj.Foo = config.CreateValue[string](itr.ReadString(), append(path, "Foo"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
diff --git a/v2/codegen/infragen/configgen/testdata/multi_package.txt b/v2/codegen/infragen/configgen/testdata/multi_package.txt
new file mode 100644
index 0000000000..a3f65540b3
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/multi_package.txt
@@ -0,0 +1,98 @@
+-- pkg/temporal/temporal.go --
+package temporal
+type ClientOptions struct {
+	HostPort  string
+	Namespace string
+}
+
+-- helloworld.go --
+package helloworld
+
+import (
+    "context"
+    "encore.dev/config"
+
+    "example.com/pkg/temporal"
+)
+
+type Config struct {
+	Temporal config.Value[temporal.ClientOptions]
+}
+
+var cfg = config.Load[Config]()
+
+// There must be an API endpoint to use config.Load.
+//encore:api
+func Dummy(context.Context) error { return nil }
+-- want:encore_internal__config_unmarshal.go --
+package helloworld
+
+import (
+	config "encore.dev/config"
+	temporal "example.com/pkg/temporal"
+	jsoniter "github.com/json-iterator/go"
+)
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_examplecom_Config = encoreInternalTypeConfigUnmarshaler_helloworld_Config
+)
+
+// encoreInternalTypeConfigUnmarshaler_helloworld_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_helloworld_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Temporal":
+			obj.Temporal = config.CreateValue[temporal.ClientOptions](encoreInternalTypeConfigUnmarshaler_temporal_ClientOptions(itr, append(path, "Temporal")), append(path, "Temporal"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_temporal_ClientOptions will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_temporal_ClientOptions(itr *jsoniter.Iterator, path []string) (obj temporal.ClientOptions) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "HostPort":
+			obj.HostPort = itr.ReadString()
+		case "Namespace":
+			obj.Namespace = itr.ReadString()
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:helloworld.go --
+package helloworld
+
+import (
+    "context"
+    "encore.dev/config"
+
+    "example.com/pkg/temporal"
+)
+
+type Config struct {
+	Temporal config.Value[temporal.ClientOptions]
+}
+
+var cfg = config.Load[Config]("helloworld", encoreInternalConfigUnmarshaler_examplecom_Config/*line :14:31*/)
+
+// There must be an API endpoint to use config.Load.
+//encore:api
+func Dummy(context.Context) error { return nil }
diff --git a/v2/codegen/infragen/configgen/testdata/multiple_configs_in_service.txt b/v2/codegen/infragen/configgen/testdata/multiple_configs_in_service.txt
new file mode 100644
index 0000000000..b06ebff59c
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/multiple_configs_in_service.txt
@@ -0,0 +1,184 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    Name        string    // The users name
+    Port        uint16
+    ReadOnly    bool      // true if we're in read only mode
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+
+-- svc/a_file.go --
+package svc
+
+import (
+	"encore.dev/config"
+)
+
+type OtherConfig struct{
+    Foo config.String // Foo is great in Otherconfig
+    Bar config.Int
+}
+
+var _ = config.Load[OtherConfig]()
+
+-- svc/z_file.go --
+package svc
+
+import (
+	"encore.dev/config"
+)
+
+type ThisConfig struct{
+    Foo config.String // And even better in ThisConfig
+    Baz config.Bool
+}
+
+var _ = config.Load[ThisConfig]()
+-- want:svc/a_file.go --
+package svc
+
+import (
+	"encore.dev/config"
+)
+
+type OtherConfig struct{
+    Foo config.String // Foo is great in Otherconfig
+    Bar config.Int
+}
+
+var _ = config.Load[OtherConfig]("svc", encoreInternalConfigUnmarshaler_svc_OtherConfig/*line :12:34*/)
+
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import (
+	config "encore.dev/config"
+	jsoniter "github.com/json-iterator/go"
+)
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_svc_OtherConfig = encoreInternalTypeConfigUnmarshaler_svc_OtherConfig
+	encoreInternalConfigUnmarshaler_ptr_svc_Config  = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+	encoreInternalConfigUnmarshaler_svc_ThisConfig = encoreInternalTypeConfigUnmarshaler_svc_ThisConfig
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Name":
+			obj.Name = itr.ReadString()
+		case "Port":
+			obj.Port = itr.ReadUint16()
+		case "ReadOnly":
+			obj.ReadOnly = itr.ReadBool()
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_svc_OtherConfig will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_OtherConfig(itr *jsoniter.Iterator, path []string) (obj OtherConfig) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Foo":
+			obj.Foo = config.CreateValue[string](itr.ReadString(), append(path, "Foo"))
+		case "Bar":
+			obj.Bar = config.CreateValue[int](itr.ReadInt(), append(path, "Bar"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_svc_ThisConfig will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_ThisConfig(itr *jsoniter.Iterator, path []string) (obj ThisConfig) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Foo":
+			obj.Foo = config.CreateValue[string](itr.ReadString(), append(path, "Foo"))
+		case "Baz":
+			obj.Baz = config.CreateValue[bool](itr.ReadBool(), append(path, "Baz"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+)
+
+type Config struct {
+    Name        string    // The users name
+    Port        uint16
+    ReadOnly    bool      // true if we're in read only mode
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :15:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+
+-- want:svc/z_file.go --
+package svc
+
+import (
+	"encore.dev/config"
+)
+
+type ThisConfig struct{
+    Foo config.String // And even better in ThisConfig
+    Baz config.Bool
+}
+
+var _ = config.Load[ThisConfig]("svc", encoreInternalConfigUnmarshaler_svc_ThisConfig/*line :12:33*/)
diff --git a/v2/codegen/infragen/configgen/testdata/name_conflicts.txt b/v2/codegen/infragen/configgen/testdata/name_conflicts.txt
new file mode 100644
index 0000000000..178763143f
--- /dev/null
+++ b/v2/codegen/infragen/configgen/testdata/name_conflicts.txt
@@ -0,0 +1,195 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+
+	"example.com/svc/utils"
+	"example.com/svc/helpers"
+)
+
+type Config struct {
+    A helpers.ExtraConfig
+    B utils.ExtraConfig
+    C helpers.ExtraConfig
+    D utils.ExtraConfig
+    E helpers.SingleUse
+}
+
+var _ = config.Load[*Config]()
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+
+-- svc/utils/config.go --
+package utils
+
+import (
+	"encore.dev/config"
+)
+
+type ExtraConfig struct{
+    Foo config.String
+    Bar config.Int
+}
+
+-- svc/helpers/config.go --
+package helpers
+
+import (
+	"encore.dev/config"
+)
+
+type ExtraConfig struct{
+    Foo config.String
+    Baz config.Value[[]byte]
+}
+
+type SingleUse struct {
+    Lock bool
+}
+-- want:svc/encore_internal__config_unmarshal.go --
+package svc
+
+import (
+	__etype "encore.dev/appruntime/shared/etype"
+	config "encore.dev/config"
+	helpers "example.com/svc/helpers"
+	utils "example.com/svc/utils"
+	"fmt"
+	jsoniter "github.com/json-iterator/go"
+)
+
+/*
+These functions are automatically generated and maintained by Encore to allow config values
+to be unmarshalled into the correct types. They are not intended to be used directly. They
+are automatically updated by Encore whenever you change the data types used within your
+calls to config.Load[T]().
+*/
+
+// Concrete unmarshalers for all config.Load calls, including those using generic types.
+// These instances are used directly by calls to `config.Load[T]()`.
+var (
+	encoreInternalConfigUnmarshaler_ptr_svc_Config = func(itr *jsoniter.Iterator, path []string) *Config {
+		return func() *Config {
+			// If the value is null, we return nil
+			if itr.ReadNil() {
+				return nil
+			}
+
+			// Otherwise we unmarshal the value and return a pointer to it
+			obj := encoreInternalTypeConfigUnmarshaler_svc_Config(itr, append(path))
+			return &obj
+		}()
+	}
+)
+
+// encoreInternalTypeConfigUnmarshaler_svc_Config will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_svc_Config(itr *jsoniter.Iterator, path []string) (obj Config) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "A":
+			obj.A = encoreInternalTypeConfigUnmarshaler_helpers_ExtraConfig(itr, append(path, "A"))
+		case "B":
+			obj.B = encoreInternalTypeConfigUnmarshaler_utils_ExtraConfig(itr, append(path, "B"))
+		case "C":
+			obj.C = encoreInternalTypeConfigUnmarshaler_helpers_ExtraConfig(itr, append(path, "C"))
+		case "D":
+			obj.D = encoreInternalTypeConfigUnmarshaler_utils_ExtraConfig(itr, append(path, "D"))
+		case "E":
+			obj.E = encoreInternalTypeConfigUnmarshaler_helpers_SingleUse(itr, append(path, "E"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_helpers_ExtraConfig will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_helpers_ExtraConfig(itr *jsoniter.Iterator, path []string) (obj helpers.ExtraConfig) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Foo":
+			obj.Foo = config.CreateValue[string](itr.ReadString(), append(path, "Foo"))
+		case "Baz":
+			obj.Baz = config.CreateValue[[]byte](func() (rtn []byte) {
+				decoder := new(__etype.Unmarshaller)
+				rtn = __etype.UnmarshalOne(decoder, __etype.UnmarshalBytes, "value", itr.ReadString(), true)
+				if err := decoder.Error; err != nil {
+					panic(fmt.Sprintf("unable to decode the config: %v", err))
+				}
+				return
+			}(), append(path, "Baz"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_helpers_SingleUse will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_helpers_SingleUse(itr *jsoniter.Iterator, path []string) (obj helpers.SingleUse) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Lock":
+			obj.Lock = itr.ReadBool()
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+
+// encoreInternalTypeConfigUnmarshaler_utils_ExtraConfig will unmarshal the JSON representation into the given type, taking account for
+// the `config.Value` dynamic functions.
+func encoreInternalTypeConfigUnmarshaler_utils_ExtraConfig(itr *jsoniter.Iterator, path []string) (obj utils.ExtraConfig) {
+	itr.ReadObjectCB(func(itr *jsoniter.Iterator, field string) bool {
+		switch field {
+		case "Foo":
+			obj.Foo = config.CreateValue[string](itr.ReadString(), append(path, "Foo"))
+		case "Bar":
+			obj.Bar = config.CreateValue[int](itr.ReadInt(), append(path, "Bar"))
+		default:
+			itr.Skip()
+		}
+		return true
+	})
+	return
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+
+	"encore.dev/config"
+
+	"example.com/svc/utils"
+	"example.com/svc/helpers"
+)
+
+type Config struct {
+    A helpers.ExtraConfig
+    B utils.ExtraConfig
+    C helpers.ExtraConfig
+    D utils.ExtraConfig
+    E helpers.SingleUse
+}
+
+var _ = config.Load[*Config]("svc", encoreInternalConfigUnmarshaler_ptr_svc_Config/*line :20:30*/)
+
+//encore:api
+func MyAPI(ctx context.Context) (error) {
+	return nil
+}
+
diff --git a/v2/codegen/infragen/infragen.go b/v2/codegen/infragen/infragen.go
new file mode 100644
index 0000000000..1652bd70d5
--- /dev/null
+++ b/v2/codegen/infragen/infragen.go
@@ -0,0 +1,86 @@
+package infragen
+
+import (
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/infragen/cachegen"
+	"encr.dev/v2/codegen/infragen/configgen"
+	"encr.dev/v2/codegen/infragen/metricsgen"
+	"encr.dev/v2/codegen/infragen/pubsubgen"
+	"encr.dev/v2/codegen/infragen/secretsgen"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/infra/caches"
+	"encr.dev/v2/parser/infra/config"
+	"encr.dev/v2/parser/infra/metrics"
+	"encr.dev/v2/parser/infra/pubsub"
+	"encr.dev/v2/parser/infra/secrets"
+	"encr.dev/v2/parser/resource"
+)
+
+func Process(gg *codegen.Generator, appDesc *app.Desc) {
+	type groupKey struct {
+		pkg  paths.Pkg
+		kind resource.Kind
+	}
+
+	groups := make(map[groupKey][]resource.Resource)
+	pkgMap := make(map[paths.Pkg]*pkginfo.Package)
+	for _, r := range appDesc.Parse.Resources() {
+		// Group by package.
+		var pkg *pkginfo.Package
+		switch r := r.(type) {
+		case *caches.Keyspace:
+			pkg = r.File.Pkg
+		case *metrics.Metric:
+			pkg = r.File.Pkg
+		case *secrets.Secrets:
+			pkg = r.File.Pkg
+		case *pubsub.Subscription:
+			pkg = r.File.Pkg
+		case *config.Load:
+			pkg = r.File.Pkg
+		default:
+			continue
+		}
+
+		key := groupKey{pkg: pkg.ImportPath, kind: r.Kind()}
+		groups[key] = append(groups[key], r)
+		pkgMap[pkg.ImportPath] = pkg
+	}
+
+	for key, resources := range groups {
+		pkg := pkgMap[key.pkg]
+		switch key.kind {
+		case resource.CacheKeyspace:
+			cachegen.GenKeyspace(gg, pkg, fns.Map(resources, func(r resource.Resource) *caches.Keyspace {
+				return r.(*caches.Keyspace)
+			}))
+		case resource.Metric:
+			metricsgen.Gen(gg, pkg, fns.Map(resources, func(r resource.Resource) *metrics.Metric {
+				return r.(*metrics.Metric)
+			}))
+		case resource.PubSubSubscription:
+			pubsubgen.Gen(gg, pkg, appDesc, fns.Map(resources, func(r resource.Resource) *pubsub.Subscription {
+				return r.(*pubsub.Subscription)
+			}))
+		case resource.Secrets:
+			svc, _ := appDesc.ServiceForPath(pkg.FSPath)
+			secretsgen.Gen(gg, option.AsOptional(svc), pkg, fns.Map(resources, func(r resource.Resource) *secrets.Secrets {
+				return r.(*secrets.Secrets)
+			}))
+		case resource.ConfigLoad:
+			svc, ok := appDesc.ServiceForPath(pkg.FSPath)
+			if !ok {
+				gg.Errs.Addf(resources[0].(*config.Load).AST.Pos(), "config loads must be declared in a service package")
+				continue
+			}
+
+			configgen.Gen(gg, svc, pkg, fns.Map(resources, func(r resource.Resource) *config.Load {
+				return r.(*config.Load)
+			}))
+		}
+	}
+}
diff --git a/v2/codegen/infragen/metricsgen/metricsgen.go b/v2/codegen/infragen/metricsgen/metricsgen.go
new file mode 100644
index 0000000000..d7e380bf43
--- /dev/null
+++ b/v2/codegen/infragen/metricsgen/metricsgen.go
@@ -0,0 +1,107 @@
+package metricsgen
+
+import (
+	"fmt"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/pkg/idents"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/infra/metrics"
+)
+
+func Gen(gen *codegen.Generator, pkg *pkginfo.Package, metrics []*metrics.Metric) {
+	f := gen.File(pkg, "metrics")
+	for _, m := range metrics {
+		genLabelMapper(gen, f, m)
+	}
+}
+
+func genLabelMapper(gen *codegen.Generator, f *codegen.File, m *metrics.Metric) {
+	// If there is no label type there's nothing to do.
+	if m.LabelType.Empty() {
+		return
+	}
+	labelType := m.LabelType.MustGet()
+
+	declRef, ok := schemautil.ResolveNamedStruct(labelType, false)
+	if !ok {
+		gen.Errs.AddPos(labelType.ASTExpr().Pos(), "invalid metric label type: must be a named struct")
+		return
+	} else if declRef.Pointers > 0 {
+		gen.Errs.AddPos(labelType.ASTExpr().Pos(), "invalid metric label type: must not be a pointer type")
+		return
+	}
+	concrete := schemautil.ConcretizeWithTypeArgs(gen.Errs, declRef.Decl.Type, declRef.TypeArgs).(schema.StructType)
+
+	mapper := f.FuncDecl("labelMapper", m.Name)
+
+	const input = "in"
+	mapper.Params(Id(input).Add(gen.Util.Type(labelType)))
+	mapper.Results(Index().Qual("encore.dev/metrics", "KeyValue"))
+
+	mapper.Body(
+		Return(Index().Qual("encore.dev/metrics", "KeyValue").ValuesFunc(func(g *Group) {
+			for _, f := range concrete.Fields {
+				if f.IsAnonymous() {
+					gen.Errs.AddPos(f.AST.Pos(), "anonymous fields are not supported in metric labels")
+					continue
+				}
+
+				key := idents.Convert(f.Name.MustGet(), idents.SnakeCase)
+				g.Add(Values(Dict{
+					Id("Key"):   Lit(key),
+					Id("Value"): fieldToString(gen.Errs, f, Id(input).Dot(f.Name.MustGet())),
+				}))
+			}
+		})),
+	)
+
+	// Insert the label mapper configuration into the metrics config literal.
+	snippet := fmt.Sprintf("EncoreInternal_LabelMapper: %s,", mapper.Name())
+	gen.Rewrite(m.File).Insert(m.ConfigLiteral.Lbrace+1, []byte(snippet))
+}
+
+// fieldToString returns the code to convert the given value of the given builtin type to a string.
+// If the field is not a valid builtin or is anonymous, it reports an error.
+func fieldToString(errs *perr.List, field schema.StructField, val Code) Code {
+	fieldName := field.Name.MustGet()
+
+	typ, ok := field.Type.(schema.BuiltinType)
+	if !ok {
+		errs.Addf(field.AST.Pos(), "invalid metric label field %s: must be string, bool, or integer type",
+			fieldName)
+		return Null()
+	}
+
+	kind := typ.Kind
+	switch true {
+	case kind == schema.String:
+		return val
+	case kind == schema.Bool:
+		return Qual("strconv", "FormatBool").Call(val)
+
+	case schemautil.IsBuiltinKind(typ, schemautil.Signed...):
+		cast := kind != schema.Int64
+		if cast {
+			val = Int64().Call(val)
+		}
+		return Qual("strconv", "FormatInt").Call(val, Lit(10))
+
+	case schemautil.IsBuiltinKind(typ, schemautil.Unsigned...):
+		cast := kind != schema.Uint64
+		if cast {
+			val = Uint64().Call(val)
+		}
+		return Qual("strconv", "FormatUint").Call(val, Lit(10))
+
+	default:
+		errs.Addf(field.AST.Pos(), "invalid metric label field %s: must be string, bool, or integer type",
+			fieldName)
+		return Null()
+	}
+}
diff --git a/v2/codegen/infragen/pubsubgen/pubsubgen.go b/v2/codegen/infragen/pubsubgen/pubsubgen.go
new file mode 100644
index 0000000000..e193883860
--- /dev/null
+++ b/v2/codegen/infragen/pubsubgen/pubsubgen.go
@@ -0,0 +1,64 @@
+package pubsubgen
+
+import (
+	"strings"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/infra/pubsub"
+	"encr.dev/v2/parser/resource"
+)
+
+func Gen(gen *codegen.Generator, pkg *pkginfo.Package, appDesc *app.Desc, subs []*pubsub.Subscription) {
+	var file *codegen.File // created on first use
+	for _, sub := range subs {
+		if method, ok := sub.MethodHandler.Get(); ok {
+			if file == nil {
+				file = gen.File(pkg, "pubsub")
+			}
+			rewriteMethodHandler(gen, file, appDesc, sub, method)
+		}
+	}
+}
+
+func rewriteMethodHandler(gen *codegen.Generator, f *codegen.File, appDesc *app.Desc, sub *pubsub.Subscription, method pubsub.MethodHandler) {
+	res, ok := appDesc.Parse.ResourceForQN(sub.Topic).Get()
+	if !ok || res.Kind() != resource.PubSubTopic {
+		gen.Errs.Add(
+			pubsub.ErrSubscriptionTopicNotResource.AtGoNode(sub.AST.Args[0]),
+		)
+		return
+	}
+	topic := res.(*pubsub.Topic)
+
+	svc, ok := appDesc.ServiceForPath(sub.File.FSPath)
+	if !ok {
+		gen.Errs.Add(
+			pubsub.ErrInvalidMethodHandler.AtGoNode(sub.Handler),
+		)
+		return
+	}
+
+	handler := f.FuncDecl("handler", strings.ReplaceAll(sub.Name, "-", "_"))
+
+	handler.Params(Id("ctx").Qual("context", "Context"), Id("msg").Add(gen.Util.Type(topic.MessageType.ToType())))
+	handler.Results(Error())
+
+	handler.BodyFunc(func(g *Group) {
+		// svc, err := service.Get[*SvcStruct]()
+		g.List(Id("svc"), Err()).Op(":=").Qual("encore.dev/appruntime/apisdk/service", "Get").Types(
+			Op("*").Id(method.Decl.Name),
+		).Call(Lit(svc.Name))
+		// if err != nil { return err }
+		g.If(Err().Op("!=").Nil()).Block(
+			Return(Err()),
+		)
+		// return svc.Method(ctx, msg)
+		g.Return(Id("svc").Dot(method.Method).Call(Id("ctx"), Id("msg")))
+	})
+
+	gen.Rewrite(sub.File).Replace(sub.Handler.Pos(), sub.Handler.End(), []byte(handler.Name()))
+}
diff --git a/v2/codegen/infragen/pubsubgen/pubsubgen_test.go b/v2/codegen/infragen/pubsubgen/pubsubgen_test.go
new file mode 100644
index 0000000000..20d848126d
--- /dev/null
+++ b/v2/codegen/infragen/pubsubgen/pubsubgen_test.go
@@ -0,0 +1,18 @@
+package pubsubgen_test
+
+import (
+	"testing"
+
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/infragen"
+	"encr.dev/v2/codegen/internal/codegentest"
+)
+
+func TestCodegen(t *testing.T) {
+	fn := func(gen *codegen.Generator, desc *app.Desc) {
+		infragen.Process(gen, desc)
+	}
+
+	codegentest.Run(t, fn)
+}
diff --git a/v2/codegen/infragen/pubsubgen/testdata/basic.txt b/v2/codegen/infragen/pubsubgen/testdata/basic.txt
new file mode 100644
index 0000000000..6f4c29b8d9
--- /dev/null
+++ b/v2/codegen/infragen/pubsubgen/testdata/basic.txt
@@ -0,0 +1,21 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/pubsub"
+)
+
+type Event struct {}
+
+var Topic = pubsub.NewTopic[*Event]("topic", pubsub.TopicConfig{
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+
+var _ = pubsub.NewSubscription(Topic, "subscription",
+    pubsub.SubscriptionConfig[*Event]{
+        Handler: func(ctx context.Context, event *Event) error {
+            return nil
+        },
+    },
+)
diff --git a/v2/codegen/infragen/pubsubgen/testdata/method_handler.txt b/v2/codegen/infragen/pubsubgen/testdata/method_handler.txt
new file mode 100644
index 0000000000..8d110d433a
--- /dev/null
+++ b/v2/codegen/infragen/pubsubgen/testdata/method_handler.txt
@@ -0,0 +1,95 @@
+-- svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/pubsub"
+)
+
+//encore:service
+type Service struct{}
+
+func (s *Service) PointerMethod(ctx context.Context, event *Event) error {
+    return nil
+}
+
+func (s Service) NonPointerMethod(ctx context.Context, event *Event) error {
+    return nil
+}
+
+type Event struct {}
+
+var Topic = pubsub.NewTopic[*Event]("topic", pubsub.TopicConfig{
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+
+var _ = pubsub.NewSubscription(Topic, "pointer",
+    pubsub.SubscriptionConfig[*Event]{
+        Handler: pubsub.MethodHandler((*Service).PointerMethod),
+    },
+)
+
+var _ = pubsub.NewSubscription(Topic, "non-pointer",
+    pubsub.SubscriptionConfig[*Event]{
+        Handler: pubsub.MethodHandler(Service.NonPointerMethod),
+    },
+)
+-- want:svc/encore_internal__pubsub.go --
+package svc
+
+import (
+	"context"
+	__service "encore.dev/appruntime/apisdk/service"
+)
+
+func EncoreInternal_pubsub_handler_pointer(ctx context.Context, msg *Event) error {
+	svc, err := __service.Get[*Service]("svc")
+	if err != nil {
+		return err
+	}
+	return svc.PointerMethod(ctx, msg)
+}
+
+func EncoreInternal_pubsub_handler_non_pointer(ctx context.Context, msg *Event) error {
+	svc, err := __service.Get[*Service]("svc")
+	if err != nil {
+		return err
+	}
+	return svc.NonPointerMethod(ctx, msg)
+}
+-- want:svc/svc.go --
+package svc
+
+import (
+	"context"
+	"encore.dev/pubsub"
+)
+
+//encore:service
+type Service struct{}
+
+func (s *Service) PointerMethod(ctx context.Context, event *Event) error {
+    return nil
+}
+
+func (s Service) NonPointerMethod(ctx context.Context, event *Event) error {
+    return nil
+}
+
+type Event struct {}
+
+var Topic = pubsub.NewTopic[*Event]("topic", pubsub.TopicConfig{
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+
+var _ = pubsub.NewSubscription(Topic, "pointer",
+    pubsub.SubscriptionConfig[*Event]{
+        Handler: EncoreInternal_pubsub_handler_pointer,
+    },
+)
+
+var _ = pubsub.NewSubscription(Topic, "non-pointer",
+    pubsub.SubscriptionConfig[*Event]{
+        Handler: EncoreInternal_pubsub_handler_non_pointer,
+    },
+)
diff --git a/v2/codegen/infragen/secretsgen/secretsgen.go b/v2/codegen/infragen/secretsgen/secretsgen.go
new file mode 100644
index 0000000000..5a6aae17bc
--- /dev/null
+++ b/v2/codegen/infragen/secretsgen/secretsgen.go
@@ -0,0 +1,48 @@
+package secretsgen
+
+import (
+	"bytes"
+	"fmt"
+	"strconv"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/infra/secrets"
+)
+
+func Gen(gen *codegen.Generator, svc option.Option[*app.Service], pkg *pkginfo.Package, secrets []*secrets.Secrets) {
+	addedImport := make(map[*pkginfo.File]bool)
+	for _, secret := range secrets {
+		file := secret.File
+		rw := gen.Rewrite(file)
+
+		if !addedImport[file] {
+			// Add an import of the runtime package to be able to load secrets.
+			insertPos := file.AST().Name.End()
+			ln := gen.FS.Position(insertPos)
+
+			rw.Insert(insertPos, []byte(fmt.Sprintf("\nimport __encore_secrets %s;/*line :%d:%d*/",
+				strconv.Quote("encore.dev/appruntime/infrasdk/secrets"),
+				ln.Line, ln.Column)))
+			addedImport[secret.File] = true
+		}
+
+		getName := func(svc *app.Service) string { return svc.Name }
+		svcName := strconv.Quote(option.Map(svc, getName).GetOrElse(""))
+
+		// Rewrite the value spec to load the secrets.
+		spec := secret.Spec
+		var buf bytes.Buffer
+		buf.WriteString("{\n")
+		for _, key := range secret.Keys {
+			fmt.Fprintf(&buf, "\t%s: __encore_secrets.Load(%s, %s),\n", key, strconv.Quote(key), svcName)
+		}
+		ep := gen.FS.Position(spec.End())
+		fmt.Fprintf(&buf, "}/*line :%d:%d*/", ep.Line, ep.Column)
+		rw.Insert(spec.Type.Pos(), []byte("= "))
+		rw.Insert(spec.End(), buf.Bytes())
+
+	}
+}
diff --git a/v2/codegen/internal/codegentest/codegentest.go b/v2/codegen/internal/codegentest/codegentest.go
new file mode 100644
index 0000000000..2f431603c7
--- /dev/null
+++ b/v2/codegen/internal/codegentest/codegentest.go
@@ -0,0 +1,168 @@
+package codegentest
+
+import (
+	stdcmp "cmp"
+	"errors"
+	"flag"
+	"io/fs"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp"
+	"github.com/rogpeppe/go-internal/renameio"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/v2/app"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/compiler/build"
+	"encr.dev/v2/internals/overlay"
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser"
+)
+
+type Case struct {
+	Name     string
+	Code     string
+	Want     map[string]string // file name -> contents
+	WantErrs []string
+}
+
+var goldenUpdate = flag.Bool("golden-update", os.Getenv("GOLDEN_UPDATE") != "", "update golden files")
+
+func Run(t *testing.T, fn func(*codegen.Generator, *app.Desc)) {
+	flag.Parse()
+	c := qt.New(t)
+	tests := readTestCases(c, "testdata")
+	for _, test := range tests {
+		c.Run(test.name, func(c *qt.C) {
+			tc := testutil.NewContext(c, false, test.input)
+			tc.FailTestOnErrors()
+
+			// Create a go.mod file in the main module directory if it doesn't already exist.
+			modPath := tc.MainModuleDir.Join("go.mod").ToIO()
+			if _, err := os.Stat(modPath); err != nil {
+				if !errors.Is(err, fs.ErrNotExist) {
+					c.Fatal(err)
+				}
+				modContents := "module example.com\nrequire encore.dev v1.13.4"
+				err := os.WriteFile(modPath, []byte(modContents), 0644)
+				c.Assert(err, qt.IsNil)
+			}
+
+			tc.GoModTidy()
+			tc.GoModDownload()
+
+			p := parser.NewParser(tc.Context)
+			parserResult := p.Parse()
+			gen := codegen.New(tc.Context, nil)
+			appDesc := app.ValidateAndDescribe(tc.Context, parserResult)
+
+			// Run the codegen
+			fn(gen, appDesc)
+
+			// Construct the map of generated code.
+			overlays := gen.Overlays()
+			got := make(map[string]string, len(overlays))
+			for _, o := range overlays {
+				// Try to compute a reasonable display path for the file.
+				// If it's local within the main module, use that.
+				// Otherwise check if it's within the runtime module,
+				// and finally fall back to the absolute path.
+				key := o.Source.ToIO()
+
+				mainRel, err := filepath.Rel(tc.MainModuleDir.ToIO(), o.Source.ToIO())
+				if err == nil && filepath.IsLocal(mainRel) {
+					key = mainRel
+				} else {
+					runtimeRel, err := filepath.Rel(tc.Build.EncoreRuntime.ToIO(), o.Source.ToIO())
+					if err == nil && filepath.IsLocal(runtimeRel) {
+						key = runtimeRel
+					}
+				}
+
+				got[key] = string(o.Contents)
+			}
+
+			if *goldenUpdate {
+				updateGoldenFiles(c, test, got)
+			} else if diff := cmp.Diff(got, test.want); diff != "" {
+				c.Fatalf("generated code differs (-got +want):\n%s", diff)
+			}
+
+			// Make sure it compiles
+			goBuild(tc, overlays)
+		})
+	}
+}
+
+func readTestCases(c *qt.C, dir string) []*testCase {
+	files, err := filepath.Glob(filepath.Join(dir, "*.txt"))
+	c.Assert(err, qt.IsNil)
+
+	var cases []*testCase
+	for _, file := range files {
+		cases = append(cases, parseTestCase(c, file))
+	}
+	return cases
+}
+
+type testCase struct {
+	filename string
+	name     string
+	input    *txtar.Archive
+	want     map[string]string
+}
+
+func parseTestCase(c *qt.C, file string) *testCase {
+	ar, err := txtar.ParseFile(file)
+	c.Assert(err, qt.IsNil)
+
+	want := make(map[string]string)
+	for i := 0; i < len(ar.Files); i++ {
+		f := ar.Files[i]
+
+		if fn, ok := strings.CutPrefix(f.Name, "want:"); ok {
+			want[fn] = string(f.Data)
+			ar.Files = slices.Delete(ar.Files, i, i+1)
+			i--
+		}
+	}
+
+	return &testCase{
+		filename: file,
+		name:     strings.TrimSuffix(filepath.Base(file), ".txt"),
+		input:    ar,
+		want:     want,
+	}
+}
+
+func updateGoldenFiles(c *qt.C, tc *testCase, got map[string]string) {
+	var goldenFiles []txtar.File
+	for key, val := range got {
+		goldenFiles = append(goldenFiles, txtar.File{
+			Name: "want:" + key,
+			Data: []byte(val),
+		})
+	}
+
+	slices.SortFunc(goldenFiles, func(a, b txtar.File) int {
+		return stdcmp.Compare(a.Name, b.Name)
+	})
+
+	tc.input.Files = append(tc.input.Files, goldenFiles...)
+	err := renameio.WriteFile(tc.filename, txtar.Format(tc.input))
+	c.Assert(err, qt.IsNil)
+}
+
+func goBuild(tc *testutil.Context, overlays []overlay.File) {
+	build.Build(tc.Context.Ctx, &build.Config{
+		Ctx:      tc.Context,
+		Overlays: overlays,
+		MainPkg:  "./...",
+		NoBinary: true,
+	})
+}
diff --git a/v2/codegen/internal/genutil/etype.go b/v2/codegen/internal/genutil/etype.go
new file mode 100644
index 0000000000..30672b227e
--- /dev/null
+++ b/v2/codegen/internal/genutil/etype.go
@@ -0,0 +1,126 @@
+package genutil
+
+import (
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/schema"
+)
+
+// MarshalBuiltin generates the code to marshal a builtin type.
+// The resulting code if an expression of type string.
+func MarshalBuiltin(kind schema.BuiltinKind, value *Statement) Code {
+	return Qual("encore.dev/appruntime/shared/etype", "MarshalOne").Call(
+		Qual("encore.dev/appruntime/shared/etype", "Marshal"+builtinToName(kind)),
+		value.Clone(),
+	)
+}
+
+// MarshalBuiltinList generates the code to marshal a list of builtins.
+// The resulting code is an expression of type []string.
+func MarshalBuiltinList(kind schema.BuiltinKind, value *Statement) Code {
+	return Qual("encore.dev/appruntime/shared/etype", "MarshalList").Call(
+		Qual("encore.dev/appruntime/shared/etype", "Marshal"+builtinToName(kind)),
+		value.Clone(),
+	)
+}
+
+type TypeUnmarshaller struct {
+	errs *perr.List
+
+	// unmarshallerExpr is the code gen expression to resolve the unmarshaller.
+	// It's typically just an identifier, but it can be more complex if need be.
+	unmarshallerExpr *Statement
+}
+
+func (g *Helper) NewTypeUnmarshaller(objName string) *TypeUnmarshaller {
+	expr := Id(objName)
+	return &TypeUnmarshaller{errs: g.Errs, unmarshallerExpr: expr}
+}
+
+// UnmarshallerTypeName returns a type expression for the etype.Unmarshaller type
+// in the runtime, in the form "*etype.Unmarshaller".
+func UnmarshallerTypeName() *Statement {
+	return Op("*").Qual("encore.dev/appruntime/shared/etype", "Unmarshaller")
+}
+
+func (u *TypeUnmarshaller) Init() *Statement {
+	return u.unmarshallerExpr.Clone().Op(":=").New(Qual("encore.dev/appruntime/shared/etype", "Unmarshaller"))
+}
+
+func (u *TypeUnmarshaller) Err() *Statement {
+	return u.unmarshallerExpr.Clone().Dot("Error")
+}
+
+func (u *TypeUnmarshaller) HasError() *Statement {
+	return u.unmarshallerExpr.Clone().Dot("Error").Op("!=").Nil()
+}
+
+// NumNonEmptyValues returns an integer expression that reports
+// the number of non-empty values the unmarshaller has processed.
+func (u *TypeUnmarshaller) NumNonEmptyValues() *Statement {
+	return u.unmarshallerExpr.Clone().Dot("NonEmptyValues")
+}
+
+// IncNonEmpty returns a statement to increment the number of
+// non-empty values the unmarshaller has processed.
+func (u *TypeUnmarshaller) IncNonEmpty() *Statement {
+	return u.unmarshallerExpr.Clone().Dot("IncNonEmpty").Call()
+}
+
+func (u *TypeUnmarshaller) UnmarshalBuiltin(kind schema.BuiltinKind, fieldName string, value *Statement, required bool) *Statement {
+	return Qual("encore.dev/appruntime/shared/etype", "UnmarshalOne").Call(
+		u.unmarshallerExpr.Clone(),
+		Qual("encore.dev/appruntime/shared/etype", "Unmarshal"+builtinToName(kind)),
+		Lit(fieldName),
+		value.Clone(),
+		Lit(required),
+	)
+}
+
+// UnmarshalBuiltinList unmarshals a list of builtins.
+func (u *TypeUnmarshaller) UnmarshalBuiltinList(kind schema.BuiltinKind, fieldName string, value *Statement, required bool) *Statement {
+	return Qual("encore.dev/appruntime/shared/etype", "UnmarshalList").Call(
+		u.unmarshallerExpr.Clone(),
+		Qual("encore.dev/appruntime/shared/etype", "Unmarshal"+builtinToName(kind)),
+		Lit(fieldName),
+		value.Clone(),
+		Lit(required),
+	)
+}
+
+// UnmarshalSingleOrList returns the code to unmarshal a supported type.
+// The type must be a builtin or a list of builtins.
+func (u *TypeUnmarshaller) UnmarshalSingleOrList(typ schema.Type, fieldName string, singleValue, listOfValues *Statement, required bool) *Statement {
+	if builtin, ok := typ.(schema.BuiltinType); ok {
+		return u.UnmarshalBuiltin(builtin.Kind, fieldName, singleValue, required)
+	} else if list, ok := typ.(schema.ListType); ok {
+		if builtin, ok := list.Elem.(schema.BuiltinType); ok {
+			return u.UnmarshalBuiltinList(builtin.Kind, fieldName, listOfValues, required)
+		}
+	}
+	u.errs.Addf(typ.ASTExpr().Pos(), "cannot unmarshal string to type %s", typ)
+	return Null()
+}
+
+// ReadBody returns an expression to read the full request body into a []byte.
+func (u *TypeUnmarshaller) ReadBody(bodyExpr *Statement) *Statement {
+	return u.unmarshallerExpr.Clone().Dot("ReadBody").Call(bodyExpr.Clone())
+}
+
+// ParseJSON returns an expression to parse json.
+// It uses the iterator accessed through the given iteratorExpr to parse JSON into the given dstExpr.
+// The dstExpr must be a pointer value.
+// The field name is only used for error reporting.
+func (u *TypeUnmarshaller) ParseJSON(fieldName string, iteratorExpr *Statement, dstExpr *Statement) *Statement {
+	return u.unmarshallerExpr.Clone().Dot("ParseJSON").Call(Lit(fieldName), iteratorExpr, dstExpr)
+}
+
+// builtinToName returns the string name of the builtin.
+//
+// Each kind's name corresponds with the functions in etype.
+// That is, if this function returns "Foo" it expects the etype package
+// in the runtime to contain "MarshalFoo and UnmarshalFoo".
+func builtinToName(kind schema.BuiltinKind) string {
+	return kind.String()
+}
diff --git a/v2/codegen/internal/genutil/types.go b/v2/codegen/internal/genutil/types.go
new file mode 100644
index 0000000000..d7e3d68b54
--- /dev/null
+++ b/v2/codegen/internal/genutil/types.go
@@ -0,0 +1,368 @@
+package genutil
+
+import (
+	"fmt"
+	gotoken "go/token"
+	"reflect"
+	"strings"
+
+	. "github.com/dave/jennifer/jen"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+)
+
+func NewHelper(errs *perr.List) *Helper {
+	return &Helper{Errs: errs}
+}
+
+type Helper struct {
+	Errs *perr.List
+}
+
+// Type generates a Go type from a schema type.
+func (g *Helper) Type(typ schema.Type) *Statement {
+	switch typ := typ.(type) {
+	case schema.NamedType:
+		return g.named(typ)
+	case schema.StructType:
+		return g.struct_(typ)
+	case schema.MapType:
+		return Map(g.Type(typ.Key)).Add(g.Type(typ.Value))
+	case schema.ListType:
+		elem := g.Type(typ.Elem)
+		if typ.Len != -1 {
+			return Index(Lit(typ.Len)).Add(elem)
+		}
+		return Index().Add(elem)
+	case schema.PointerType:
+		return Op("*").Add(g.Type(typ.Elem))
+	case schema.BuiltinType:
+		return g.Builtin(typ.AST.Pos(), typ.Kind)
+	case schema.InterfaceType:
+		g.Errs.AddPos(typ.AST.Pos(), "unexpected interface type")
+		return Any()
+	case schema.TypeParamRefType:
+		typeParam := typ.Decl.TypeParameters()[typ.Index]
+		return Id(typeParam.Name)
+	default:
+		g.Errs.Addf(typ.ASTExpr().Pos(), "unexpected schema type %T", typ)
+		return Any()
+	}
+}
+
+func (g *Helper) named(named schema.NamedType) *Statement {
+	st := Q(named.DeclInfo)
+
+	if len(named.TypeArgs) > 0 {
+		types := fns.Map(named.TypeArgs, func(arg schema.Type) Code {
+			return g.Type(arg)
+		})
+		st = st.Types(types...)
+	}
+
+	return st
+}
+
+func (g *Helper) struct_(st schema.StructType) *Statement {
+	fields := make([]Code, len(st.Fields))
+
+	for i, field := range st.Fields {
+		var f *Statement
+		typExpr := g.Type(field.Type)
+		if field.IsAnonymous() {
+			f = typExpr
+		} else {
+			f = Id(field.Name.MustGet()).Add(typExpr)
+		}
+
+		// Add field tags
+		if field.Tag.Len() > 0 {
+			tagMap := make(map[string]string)
+			for _, tag := range field.Tag.Tags() {
+				tagMap[tag.Key] = tag.Value()
+			}
+			f = f.Tag(tagMap)
+		}
+
+		// Add doc comment
+		if doc := strings.TrimSpace(field.Doc); doc != "" {
+			f = f.Comment(doc)
+		}
+		fields[i] = f
+	}
+
+	return Struct(fields...)
+}
+
+func (g *Helper) Builtin(pos gotoken.Pos, kind schema.BuiltinKind) *Statement {
+	switch kind {
+	case schema.Any:
+		return Any()
+	case schema.Bool:
+		return Bool()
+	case schema.Int:
+		return Int()
+	case schema.Int8:
+		return Int8()
+	case schema.Int16:
+		return Int16()
+	case schema.Int32:
+		return Int32()
+	case schema.Int64:
+		return Int64()
+	case schema.Uint:
+		return Uint()
+	case schema.Uint8:
+		return Uint8()
+	case schema.Uint16:
+		return Uint16()
+	case schema.Uint32:
+		return Uint32()
+	case schema.Uint64:
+		return Uint64()
+	case schema.Float32:
+		return Float32()
+	case schema.Float64:
+		return Float64()
+	case schema.String:
+		return String()
+	case schema.Bytes:
+		return Index().Byte()
+
+	case schema.Time:
+		return Qual("time", "Time")
+	case schema.JSON:
+		return Qual("encoding/json", "RawMessage")
+	case schema.UUID:
+		return Qual("encore.dev/types/uuid", "UUID")
+	case schema.UserID:
+		return Qual("encore.dev/beta/auth", "UID")
+	case schema.Error:
+		return Error()
+	default:
+		g.Errs.Addf(pos, "unsupported builtin kind: %v", kind)
+		return Id("unsupported")
+	}
+}
+
+// TypeToString converts a schema.Type to a string.
+func (g *Helper) TypeToString(typ schema.Type) string {
+	// We wrap the type before rendering in "var _ {type}" so Jen correctly formats,
+	// then we strip the "var _" part.
+	return fmt.Sprintf("%#v", Var().Id("_").Add(g.Type(typ)))[6:]
+}
+
+// Q returns a qualified name (using [jen.Qual]) for the given info.
+func Q(info *pkginfo.PkgDeclInfo) *Statement {
+	return Qual(info.File.Pkg.ImportPath.String(), info.Name)
+}
+
+func (g *Helper) GoToJen(pos gotoken.Pos, val any) *Statement {
+	return g.goToJen(pos, reflect.ValueOf(val))
+}
+
+func (g *Helper) goToJen(pos gotoken.Pos, val reflect.Value) *Statement {
+	switch val.Kind() {
+	// All the types supported by jen.Lit can be passed directly.
+	case reflect.Bool, reflect.String,
+		reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64,
+		reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64,
+		reflect.Float32, reflect.Float64,
+		reflect.Complex64, reflect.Complex128,
+		reflect.Uintptr:
+		return Lit(val.Interface())
+
+	case reflect.Slice, reflect.Array:
+		return g.goTypeToJen(pos, val.Type()).ValuesFunc(func(group *Group) {
+			for i := 0; i < val.Len(); i++ {
+				group.Add(g.goToJen(pos, val.Index(i)))
+			}
+		})
+	case reflect.Map:
+		return g.goTypeToJen(pos, val.Type()).ValuesFunc(func(group *Group) {
+			iter := val.MapRange()
+			for iter.Next() {
+				group.Add(g.goToJen(pos, iter.Key())).Op(":").Add(g.goToJen(pos, iter.Value()))
+			}
+		})
+	default:
+		g.Errs.Addf(pos, "unsupported type: %T", val.Interface())
+		return Null()
+	}
+}
+
+func (g *Helper) goTypeToJen(pos gotoken.Pos, typ reflect.Type) *Statement {
+	switch typ.Kind() {
+	case reflect.Bool:
+		return Bool()
+	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
+		return Int()
+	case reflect.Uint, reflect.Uint8, reflect.Uint16, reflect.Uint32, reflect.Uint64:
+		return Uint()
+	case reflect.Float32, reflect.Float64:
+		return Float32()
+	case reflect.String:
+		return String()
+	case reflect.Slice:
+		return Index().Add(g.goTypeToJen(pos, typ.Elem()))
+	case reflect.Pointer:
+		return Op("*").Add(g.goTypeToJen(pos, typ.Elem()))
+	case reflect.Array:
+		return Index(Lit(typ.Len())).Add(g.goTypeToJen(pos, typ.Elem()))
+	case reflect.Map:
+		return Map(g.goTypeToJen(pos, typ.Key())).Add(g.goTypeToJen(pos, typ.Elem()))
+	default:
+		g.Errs.Addf(pos, "unsupported Go type in codegen: %v", typ)
+		return Null()
+	}
+}
+
+// IsNotJSONEmpty returns a jen expression evaluating whether expr is not "empty".
+// "Empty" is defined by the encoding/json package as:
+// "false, 0, a nil pointer, a nil interface value, and any empty array, slice, map, or string."
+func (g *Helper) IsNotJSONEmpty(expr *Statement, typ schema.Type) *Statement {
+	// Dereference any named types so we get at the underlying type.
+	for {
+		if named, ok := typ.(schema.NamedType); ok {
+			typ = named.Decl().Type
+		} else {
+			break
+		}
+	}
+
+	switch typ := typ.(type) {
+	case schema.InterfaceType, schema.FuncType, schema.PointerType:
+		return expr.Op("!=").Nil()
+	case schema.MapType:
+		return Len(expr).Op("!=").Lit(0)
+	case schema.ListType:
+		switch {
+		case typ.Len < 0: // slice
+			return Len(expr).Op("!=").Lit(0)
+		case typ.Len == 0:
+			// zero-length array, always empty
+			return False()
+		case typ.Len > 0:
+			// positive-length array, never empty
+			return True()
+		}
+	case schema.BuiltinType:
+		switch typ.Kind {
+		case schema.Any, schema.Error:
+			return expr.Op("!=").Nil()
+		case schema.Bool:
+			return expr
+		case schema.Int, schema.Int8, schema.Int16, schema.Int32, schema.Int64, schema.Uint, schema.Uint8, schema.Uint16, schema.Uint32, schema.Uint64, schema.Float32, schema.Float64:
+			return expr.Op("!=").Lit(0)
+		case schema.String:
+			return expr.Op("!=").Lit("")
+		case schema.Bytes, schema.JSON:
+			return Len(expr).Op("!=").Lit(0)
+		case schema.Time:
+			// Technically not 100% compliant but closer to
+			// the user's intention.
+			return Op("!").Parens(expr.Dot("IsZero").Call())
+		case schema.UserID:
+			return expr.Op("!=").Lit("")
+		}
+	}
+	return True()
+}
+
+// Zero returns a jen expression representing the zero value
+// for the given type. If the type is nil it returns "nil".
+func (g *Helper) Zero(typ schema.Type) *Statement {
+	isNillable := func(typ schema.Type) bool {
+		switch typ := typ.(type) {
+		case nil, schema.PointerType, schema.MapType, schema.FuncType, schema.InterfaceType:
+			return true
+		case schema.ListType:
+			return typ.Len == -1 // -1 == slice, anything else is an array
+		default:
+			return false
+		}
+	}
+
+	typ, numPointers := schemautil.Deref(typ)
+
+	if named, ok := typ.(schema.NamedType); ok {
+		// If the underlying type is nillable or we have dereferenced pointers,
+		// return (*Foo)(nil).
+		if numPointers > 0 || isNillable(named.Decl().Type) {
+			// Return (*Foo)(nil) if the underlying type is nillable.
+			ops := strings.Repeat("*", numPointers)
+			return Parens(Op(ops).Add(g.Type(named))).Call(Nil())
+		}
+
+	}
+	if numPointers > 0 || isNillable(typ) {
+		return Nil()
+	} else if builtin, ok := typ.(schema.BuiltinType); ok {
+		return g.builtinZero(builtin)
+	}
+
+	// Otherwise return (Foo{}).
+	// We need to wrap the type in parens as both generic types
+	// and other types need brackets around them for the zero value.
+	//
+	// i.e.
+	// 	if val != (Foo{}) { ... }
+	// 	if val != (Foo[Generic]{}) { ... }
+	return Parens(g.Type(typ).Values())
+}
+
+// Initialize returns a jen expression for initializing
+// the given type. If the type is a pointer type it returns new(Foo),
+// and make(Foo) for slices and maps.
+//
+// Certain types like function types and interfaces return "nil"
+// as there is no canonical way to initialize them to a non-zero value.
+func (g *Helper) Initialize(typ schema.Type) *Statement {
+	switch typ := typ.(type) {
+	case schema.PointerType:
+		return New(g.Type(typ.Elem))
+	case schema.ListType:
+		return g.Type(typ).Values()
+	case schema.MapType:
+		return Make(g.Type(typ))
+	case schema.BuiltinType:
+		return g.Zero(typ)
+	default:
+		return g.Zero(typ)
+	}
+}
+
+func (g *Helper) builtinZero(builtin schema.BuiltinType) *Statement {
+	switch builtin.Kind {
+	case schema.Bool:
+		return False()
+	case schema.Int, schema.Int8, schema.Int16, schema.Int32, schema.Int64,
+		schema.Uint, schema.Uint8, schema.Uint16, schema.Uint32, schema.Uint64:
+		return Lit(0)
+	case schema.Float32, schema.Float64:
+		return Lit(0.0)
+	case schema.String:
+		return Lit("")
+	case schema.Bytes:
+		return Nil()
+	case schema.Time:
+		return Parens(Qual("time", "Time").Values())
+	case schema.UUID:
+		return Parens(Qual("encore.dev/types/uuid", "UUID").Values())
+	case schema.JSON:
+		// Zero for JSON is nil, we don't return a typed nil as you can't use them
+		// in if statements.
+		return Nil()
+	case schema.UserID:
+		return Qual("encore.dev/beta/auth", "UID").Call(Lit(""))
+	case schema.Error:
+		return Parens(Id("error")).Call(nil)
+	default:
+		g.Errs.Addf(builtin.ASTExpr().Pos(), "unsupported builtin type: %v", builtin.Kind)
+		return Null()
+	}
+}
diff --git a/v2/codegen/rewrite/rewrite.go b/v2/codegen/rewrite/rewrite.go
new file mode 100644
index 0000000000..ec0d2bfc37
--- /dev/null
+++ b/v2/codegen/rewrite/rewrite.go
@@ -0,0 +1,135 @@
+package rewrite
+
+import (
+	"bytes"
+	"fmt"
+	"go/ast"
+	"go/token"
+)
+
+func New(data []byte, base int) *Rewriter {
+	return &Rewriter{
+		base: 0,
+		segs: []segment{{
+			data:  data,
+			start: base,
+			end:   base + len(data),
+		}},
+	}
+}
+
+type Rewriter struct {
+	base int
+	segs []segment
+}
+
+func (r *Rewriter) Replace(start, end token.Pos, data []byte) {
+	si, so := r.seg(start, false)
+	ei, eo := r.seg(end, true)
+	r.replace(si, so, ei, eo, data)
+}
+
+func (r *Rewriter) ReplaceNode(node ast.Node, data []byte) {
+	r.Replace(node.Pos(), node.End(), data)
+}
+
+func (r *Rewriter) Append(data []byte) {
+	start := 0
+	if len(r.segs) > 0 {
+		start = r.segs[len(r.segs)-1].end
+	}
+	r.segs = append(r.segs, segment{
+		start: int(start),
+		end:   int(start),
+		data:  data,
+	})
+}
+
+func (r *Rewriter) Insert(start token.Pos, data []byte) {
+	// If the pos is at the very end of the file, insert a new segment directly,
+	// since calling r.seg(start) would panic.
+	if len(r.segs) > 0 && r.segs[len(r.segs)-1].end == int(start) {
+		r.segs = append(r.segs, segment{
+			start: int(start),
+			end:   int(start) + len(data),
+			data:  data,
+		})
+		return
+	}
+
+	si, so := r.seg(start, false)
+	r.replace(si, so, si, so, data)
+}
+
+func (r *Rewriter) Delete(start, end token.Pos) {
+	si, so := r.seg(start, false)
+	ei, eo := r.seg(end, true)
+	r.replace(si, so, ei, eo, nil)
+}
+
+func (r *Rewriter) Data() []byte {
+	var buf bytes.Buffer
+	for _, seg := range r.segs {
+		buf.Write(seg.data)
+	}
+	return buf.Bytes()
+}
+
+func (r *Rewriter) replace(si, so, ei, eo int, data []byte) {
+	if si == ei {
+		// Same segment; cut it into two
+		start := r.segs[si]
+		end := segment{
+			start: start.start + eo,
+			end:   start.end,
+			data:  start.data[eo:],
+		}
+		start.data = start.data[:so]
+		start.end = start.start + so
+		mid := segment{
+			start: start.end,
+			end:   end.start,
+			data:  data,
+		}
+		r.segs = append(r.segs[:si], append([]segment{start, mid, end}, r.segs[ei+1:]...)...)
+	} else {
+		// Already different segments; adjust start/end and replace segments in-between
+		start := r.segs[si]
+		end := r.segs[ei]
+		start.end = start.start + so
+		start.data = start.data[:so]
+		end.start += eo
+		end.data = end.data[eo:]
+		mid := segment{
+			start: start.end,
+			end:   end.start,
+			data:  data,
+		}
+		r.segs = append(r.segs[:si], append([]segment{start, mid, end}, r.segs[ei+1:]...)...)
+	}
+}
+
+func (r *Rewriter) seg(pos token.Pos, isEnd bool) (idx int, offset int) {
+	p := int(pos)
+	if isEnd {
+		for i, seg := range r.segs {
+			if seg.start < p && p <= seg.end {
+				return i, min(int(p-seg.start), len(seg.data))
+			}
+		}
+	} else {
+		for i, seg := range r.segs {
+			if seg.start <= p && p < seg.end {
+				return i, min(int(p-seg.start), len(seg.data))
+			}
+		}
+	}
+
+	panic(fmt.Sprintf("original file does not contain pos %v", pos))
+}
+
+type segment struct {
+	start int // inclusive
+	end   int // exclusive
+	data  []byte
+}
diff --git a/v2/codegen/rewrite/rewrite_test.go b/v2/codegen/rewrite/rewrite_test.go
new file mode 100644
index 0000000000..5145e35539
--- /dev/null
+++ b/v2/codegen/rewrite/rewrite_test.go
@@ -0,0 +1,66 @@
+package rewrite
+
+import (
+	"bytes"
+	"testing"
+)
+
+func TestReplaceEnd(t *testing.T) {
+	rw := New([]byte("test"), 1)
+	rw.Replace(4, 5, []byte("ting"))
+	if got, want := rw.Data(), []byte("testing"); !bytes.Equal(got, want) {
+		t.Errorf("got data %s, want %s", got, want)
+	}
+
+}
+
+func TestSplit(t *testing.T) {
+	rw := New([]byte("test"), 1)
+	rw.Replace(2, 4, []byte("ou"))  // "tout"
+	rw.Replace(1, 2, []byte("rea")) // "reaout"
+	rw.Insert(4, []byte("h"))       // "reaouht"
+	rw.Insert(4, []byte("a"))       // "reaouaht"
+	if got, want := rw.Data(), []byte("reaouhat"); !bytes.Equal(got, want) {
+		t.Errorf("got data %s, want %s", got, want)
+	}
+}
+
+func TestReplaceAcrossSegments(t *testing.T) {
+	rw := New([]byte("foo bar"), 1)
+	rw.Replace(5, 6, []byte("l"))  // "foo lar"
+	rw.Replace(2, 7, []byte("hi")) // "fhir"
+	if got, want := rw.Data(), []byte("fhir"); !bytes.Equal(got, want) {
+		t.Errorf("got data %s, want %s", got, want)
+	}
+}
+
+func TestReplaceTwice(t *testing.T) {
+	rw := New([]byte("foo bar"), 1)
+	rw.Replace(5, 6, []byte("l"))     // "foo lar"
+	rw.Replace(2, 7, []byte("hi"))    // "fhir"
+	rw.Replace(2, 7, []byte("hello")) // "fhellor"
+	if got, want := rw.Data(), []byte("fhellor"); !bytes.Equal(got, want) {
+		t.Errorf("got data %s, want %s", got, want)
+	}
+}
+
+func TestDelete(t *testing.T) {
+	rw := New([]byte("foo bar"), 1)
+	rw.Replace(5, 6, []byte("l")) // "foo lar"
+	rw.Delete(2, 7)
+	if got, want := rw.Data(), []byte("fr"); !bytes.Equal(got, want) {
+		t.Errorf("got data %s, want %s", got, want)
+	}
+}
+
+func TestInsertAtEnd(t *testing.T) {
+	rw := New([]byte(""), 1)
+	rw.Insert(1, []byte("// test"))
+	if got, want := rw.Data(), []byte("// test"); !bytes.Equal(got, want) {
+		t.Errorf("got data %s, want %s", got, want)
+	}
+	rw.Delete(1, 4)
+	if got, want := rw.Data(), []byte("test"); !bytes.Equal(got, want) {
+		t.Errorf("got data %s, want %s", got, want)
+	}
+}
diff --git a/v2/compiler/build/build.go b/v2/compiler/build/build.go
new file mode 100644
index 0000000000..7623be1a70
--- /dev/null
+++ b/v2/compiler/build/build.go
@@ -0,0 +1,481 @@
+// Package build supports building and testing Encore applications
+// with codegen and rewrite overlays.
+package build
+
+import (
+	"bytes"
+	"context"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"go/token"
+	"os"
+	"os/exec"
+	"path"
+	"path/filepath"
+	"runtime"
+	"slices"
+	"strconv"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+
+	"encore.dev/appruntime/exported/config"
+	"encr.dev/internal/etrace"
+	builderpkg "encr.dev/pkg/builder"
+	"encr.dev/pkg/errinsrc/srcerrors"
+	"encr.dev/pkg/paths"
+	"encr.dev/pkg/xos"
+	"encr.dev/v2/internals/overlay"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/perr"
+)
+
+type Config struct {
+	// Ctx controls the build.
+	Ctx *parsectx.Context
+
+	// Overlays describes the code generation overlays to apply,
+	// in the form of rewritten files or generated files.
+	Overlays []overlay.File
+
+	// KeepOutput keeps the temporary build directory from being deleted in the case of failure.
+	KeepOutput bool
+
+	// Env are additional environment variables to set.
+	Env []string
+
+	// MainPkg is the main package to build.
+	MainPkg paths.Pkg
+
+	// NoBinary specifies that no binary should be built.
+	// It's used if MainPkg specifies multiple packages,
+	// which for example is the case when checking for compilation errors
+	// without building a binary (such as during tests).
+	NoBinary bool
+
+	// StaticConfig is the static config to embed into the binary.
+	StaticConfig *config.Static
+}
+
+type Result struct {
+	Dir paths.FS
+	Exe paths.FS
+}
+
+func Build(ctx context.Context, cfg *Config) *Result {
+	b := &builder{
+		ctx:  ctx,
+		cfg:  cfg,
+		mode: buildMode,
+		errs: cfg.Ctx.Errs,
+	}
+	return b.Build()
+}
+
+// Mode is the build mode.
+type mode string
+
+const (
+	buildMode mode = "build"
+	testMode  mode = "test"
+)
+
+type builder struct {
+	// inputs
+	ctx  context.Context
+	cfg  *Config
+	mode mode
+
+	// internal state
+
+	// errs is the error list to use.
+	errs *perr.List
+
+	// overlayPath is set when the overlay file is written.
+	overlayPath paths.FS
+
+	workdir paths.FS
+	// deleteWorkDir reports whether the workdir should be deleted.
+	// It's true for temporarily generated workdirs.
+	tempWorkDir bool
+}
+
+func (b *builder) Build() *Result {
+	workdir, tempWorkDir := b.prepareWorkDir()
+	b.workdir = workdir
+
+	if tempWorkDir {
+		defer func() {
+			// If we have a bailout or any errors, delete the workdir.
+			if _, ok := perr.CatchBailout(recover()); ok || b.errs.Len() > 0 {
+				if !b.cfg.KeepOutput && workdir != "" {
+					_ = os.RemoveAll(workdir.ToIO())
+				}
+			}
+		}()
+	}
+
+	res := &Result{
+		Dir: b.workdir,
+		Exe: b.binaryPath(),
+	}
+
+	for _, fn := range []func(){
+		b.writeModFile,
+		b.buildMain,
+	} {
+		fn()
+		// Abort early if we encountered any errors.
+		if b.errs.Len() > 0 {
+			break
+		}
+	}
+	return res
+}
+
+func (b *builder) writeModFile() {
+	etrace.Sync0(b.ctx, "", "writeModFile", func(ctx context.Context) {
+		newPath := b.cfg.Ctx.Build.EncoreRuntime.ToIO()
+		oldPath := "encore.dev"
+
+		modFilePath := b.cfg.Ctx.MainModuleDir.Join("go.mod")
+		sumFilePath := b.cfg.Ctx.MainModuleDir.Join("go.sum")
+		modData, err := os.ReadFile(modFilePath.ToIO())
+		if err != nil {
+			b.errs.Addf(token.NoPos, "unable to read go.mod: %v", err)
+			return
+		}
+		mainMod, err := modfile.Parse("go.mod", modData, nil)
+		if err != nil {
+			b.errs.Addf(token.NoPos, "unable to parse go.mod: %v", err)
+			return
+		}
+
+		// Make sure there's a dependency on encore.dev so it can be replaced.
+		if err := mainMod.AddRequire("encore.dev", "v0.0.0"); err != nil {
+			b.errs.Addf(token.NoPos, "unable to add 'require encore.dev' directive to go.mod: %v", err)
+			return
+		}
+		if err := mainMod.AddReplace(oldPath, "", newPath, ""); err != nil {
+			b.errs.Addf(token.NoPos, "unable to add 'replace encore.dev' directive to go.mod: %v", err)
+			return
+		}
+
+		// We require Go 1.18+ now that we use generics in code gen.
+		if !isGo118Plus(mainMod) {
+			_ = mainMod.AddGoStmt("1.18")
+		}
+		mainMod.Cleanup()
+
+		data := modfile.Format(mainMod.Syntax)
+
+		gomodpath := b.workdir.Join("go.mod")
+		gosumpath := b.workdir.Join("go.sum")
+		if err := xos.WriteFile(gomodpath.ToIO(), data, 0o644); err != nil {
+			b.errs.Addf(token.NoPos, "unable to write go.mod: %v", err)
+			return
+		}
+
+		// Write an initial overlay for use with 'go mod tidy' when writing the go.mod file.
+		overlayFiles := slices.Clone(b.cfg.Overlays)
+		overlayPath, err := overlay.Write(b.workdir, overlayFiles)
+		if err != nil {
+			b.errs.Addf(token.NoPos, "unable to write overlay file: %v", err)
+			return
+		}
+
+		// Run `go mod tidy` on this modfile.
+		{
+
+			build := b.cfg.Ctx.Build
+			goroot := build.GOROOT
+			cmd := exec.Command(goroot.Join("bin", "go"+b.exe()).ToIO(),
+				"mod", "tidy",
+				"-overlay="+overlayPath.ToIO(),
+				"-modfile="+gomodpath.ToIO(),
+			)
+
+			// Copy the env before we add additional env vars
+			// to avoid accidentally sharing the same backing array.
+			env := make([]string, len(b.cfg.Env))
+			copy(env, b.cfg.Env)
+			env = append(env,
+				"GO111MODULE=on",
+				"GOROOT="+goroot.ToIO(),
+				"GOTOOLCHAIN=local",
+			)
+			if goos := build.GOOS; goos != "" {
+				env = append(env, "GOOS="+goos)
+			}
+			if goarch := build.GOARCH; goarch != "" {
+				env = append(env, "GOARCH="+goarch)
+			}
+			if !build.CgoEnabled {
+				env = append(env, "CGO_ENABLED=0")
+			}
+
+			cmd.Env = append(os.Environ(), env...)
+			cmd.Dir = b.cfg.Ctx.MainModuleDir.ToIO()
+
+			out, err := cmd.CombinedOutput()
+			if err != nil {
+				if len(out) == 0 {
+					out = []byte(err.Error())
+				}
+				out = convertCompileErrors(b.errs, out, b.workdir.ToIO(), b.cfg.Ctx.MainModuleDir.ToIO(), b.cfg.Ctx.MainModuleDir.ToIO())
+				if len(out) > 0 {
+					// HACK(andre): Make this nicer
+					b.errs.AddStd(fmt.Errorf("'go mod tidy' failed: %s", out))
+				}
+			}
+		}
+
+		// Add the go.mod and go.sum files to the overlay, and write a new overlay file.
+		overlayFiles = append(overlayFiles, overlay.File{
+			Source: modFilePath,
+			Dest:   gomodpath,
+		}, overlay.File{
+			Source: sumFilePath,
+			Dest:   gosumpath,
+		})
+		b.overlayPath, err = overlay.Write(b.workdir, overlayFiles)
+		if err != nil {
+			b.errs.Addf(token.NoPos, "unable to write overlay file: %v", err)
+			return
+		}
+	})
+}
+
+func (b *builder) buildMain() {
+	etrace.Sync0(b.ctx, "", "buildMain", func(ctx context.Context) {
+		build := b.cfg.Ctx.Build
+		tags := append([]string{"encore", "encore_internal", "encore_app"}, build.BuildTags...)
+		args := []string{
+			"build",
+			"-tags=" + strings.Join(tags, ","),
+			"-overlay=" + b.overlayPath.ToIO(),
+		}
+
+		if !b.cfg.NoBinary {
+			args = append(args, "-o="+b.binaryPath().ToIO())
+		}
+
+		var ldflags strings.Builder
+		b.writeStaticConfig(&ldflags)
+
+		if b.cfg.Ctx.Build.StaticLink {
+			// Enable external linking if we use cgo.
+			if b.cfg.Ctx.Build.CgoEnabled {
+				ldflags.WriteString(" -linkmode external")
+			}
+
+			ldflags.WriteString(` -extldflags "-static"`)
+		}
+		args = append(args, "-ldflags", ldflags.String())
+
+		if b.cfg.Ctx.Build.Debug > builderpkg.DebugModeDisabled {
+			// Disable inlining for better debugging.
+			args = append(args, "-gcflags", "all=-N -l")
+		}
+
+		args = append(args, b.cfg.MainPkg.String())
+		
+		goroot := build.GOROOT
+		cmd := exec.Command(goroot.Join("bin", "go"+b.exe()).ToIO(), args...)
+
+		// Copy the env before we add additional env vars
+		// to avoid accidentally sharing the same backing array.
+		env := make([]string, len(b.cfg.Env))
+		copy(env, b.cfg.Env)
+
+		env = append(env,
+			"GO111MODULE=on",
+			"GOROOT="+goroot.ToIO(),
+			"GOTOOLCHAIN=local",
+		)
+		if goos := build.GOOS; goos != "" {
+			env = append(env, "GOOS="+goos)
+		}
+		if goarch := build.GOARCH; goarch != "" {
+			env = append(env, "GOARCH="+goarch)
+		}
+		if !build.CgoEnabled {
+			env = append(env, "CGO_ENABLED=0")
+		}
+		cmd.Env = append(os.Environ(), env...)
+		cmd.Dir = b.cfg.Ctx.MainModuleDir.ToIO()
+		out, err := cmd.CombinedOutput()
+		if err != nil {
+			if len(out) == 0 {
+				out = []byte(err.Error())
+			}
+			out = convertCompileErrors(b.errs, out, b.workdir.ToIO(), b.cfg.Ctx.MainModuleDir.ToIO(), b.cfg.Ctx.MainModuleDir.ToIO())
+			if len(out) > 0 {
+				// HACK(andre): Make this nicer
+				b.errs.AddStd(fmt.Errorf("compilation failure: %s", out))
+			}
+		}
+	})
+}
+
+func (b *builder) writeStaticConfig(ldflags *strings.Builder) {
+	// Marshal the static config and add it as a linker flag.
+	ldflags.WriteString("-X 'encore.dev/appruntime/shared/appconf.static=")
+	data, err := json.Marshal(b.cfg.StaticConfig)
+	if err != nil {
+		b.errs.Fatalf(token.NoPos, "unable to marshal static config: %v", err)
+	}
+	ldflags.WriteString(base64.StdEncoding.EncodeToString(data))
+	ldflags.WriteByte('\'')
+}
+
+const BinaryName = "encore_app_out"
+
+func (b *builder) exe() string {
+	goos := b.cfg.Ctx.Build.GOOS
+	if goos == "" {
+		goos = runtime.GOOS
+	}
+	if goos == "windows" {
+		return ".exe"
+	}
+	return ""
+}
+
+func (b *builder) binaryPath() paths.FS {
+	return b.workdir.Join(BinaryName + b.exe())
+}
+
+// convertCompileErrors goes through the errors and converts basic compiler errors into
+// ErrInSrc errors, which are more useful for the user.
+func convertCompileErrors(errList *perr.List, out []byte, workdir, appRoot, relwd string) []byte {
+	wdroot := filepath.Join(appRoot, relwd)
+	lines := bytes.Split(out, []byte{'\n'})
+	prefix := append([]byte(workdir), '/')
+	modified := false
+
+	output := make([][]byte, 0)
+
+	for _, line := range lines {
+		if !bytes.HasPrefix(line, prefix) {
+			output = append(output, line)
+			continue
+		}
+		idx := bytes.IndexByte(line, ':')
+		if idx == -1 || idx < len(prefix) {
+			output = append(output, line)
+			continue
+		}
+
+		filename := line[:idx]
+		appPath := filepath.Join(appRoot, string(filename[len(prefix):]))
+		if _, err := filepath.Rel(wdroot, appPath); err == nil {
+			parts := strings.SplitN(string(line), ":", 4)
+			if len(parts) != 4 {
+				output = append(output, line)
+				continue
+			}
+
+			lineNumber, err := strconv.Atoi(parts[1])
+			if err != nil {
+				output = append(output, line)
+				continue
+			}
+
+			colNumber, err := strconv.Atoi(parts[2])
+			if err != nil {
+				output = append(output, line)
+				continue
+			}
+
+			modified = true
+			errList.AddStd(srcerrors.GenericGoCompilerError(changeToAppRootFile(parts[0], workdir, appRoot), lineNumber, colNumber, parts[3]))
+		} else {
+			output = append(output, line)
+		}
+	}
+
+	if !modified {
+		return out
+	}
+
+	// Append the err list for both the workDir and the appRoot
+	// as files might be coming from either of them
+	errList.MakeRelative(workdir, relwd)
+	errList.MakeRelative(appRoot, relwd)
+
+	return bytes.Join(output, []byte{'\n'})
+}
+
+// changeToAppRootFile will return the compiledFile path inside the appRoot directory
+// if that file exists within the app root. Otherwise it will return the original
+// compiledFile path.
+//
+// This means when we display compiler errors to the user, we will show them their
+// original rewritten code, where line numbers and column numbers will align with
+// their own code.
+//
+// However for generated files which don't exist in their own folders, we will
+// still be able to render the source causing the issue
+func changeToAppRootFile(compiledFile string, workDirectory, appRoot string) string {
+	if strings.HasPrefix(compiledFile, workDirectory) {
+		fileInOriginalSrc := strings.TrimPrefix(compiledFile, workDirectory)
+		fileInOriginalSrc = path.Join(appRoot, fileInOriginalSrc)
+
+		if _, err := os.Stat(fileInOriginalSrc); err == nil {
+			return fileInOriginalSrc
+		}
+	}
+
+	return compiledFile
+}
+
+func isGo118Plus(f *modfile.File) bool {
+	if f.Go == nil {
+		return false
+	}
+	m := modfile.GoVersionRE.FindStringSubmatch(f.Go.Version)
+	if m == nil {
+		return false
+	}
+	major, _ := strconv.Atoi(m[1])
+	minor, _ := strconv.Atoi(m[2])
+	return major > 1 || (major == 1 && minor >= 18)
+}
+
+func (b *builder) prepareWorkDir() (workdir paths.FS, temporary bool) {
+	work, isTemp := (func() (string, bool) {
+		// If we have an appID, use a persistent work dir.
+		if appID, ok := b.cfg.Ctx.AppID.Get(); ok {
+			baseDir, err := os.UserCacheDir()
+			if err != nil {
+				b.errs.Fatalf(token.NoPos, "unable to get user cache dir: %v", err)
+			}
+			// Use a per-mode work directory since the generated files are different.
+			// Otherwise concurrent build and test runs interfere and cause spurious compilation errors.
+			workdir := filepath.Join(baseDir, "encore-build", appID, string(b.mode))
+			return workdir, false
+		}
+
+		tmp, err := os.MkdirTemp("", "encore-build")
+		if err != nil {
+			b.errs.Fatalf(token.NoPos, "unable to create workdir: %v", err)
+		}
+		return tmp, true
+	})()
+
+	// NOTE(andre): There appears to be a bug in go's handling of overlays
+	// when the source or destination is a symlink.
+	// I haven't dug into the root cause exactly, but it causes weird issues
+	// with tests since macOS's /var/tmp is a symlink to /private/var/tmp.
+	if d, err := filepath.EvalSymlinks(work); err == nil {
+		work = d
+	}
+
+	if err := os.MkdirAll(work, 0o755); err != nil {
+		b.errs.Fatalf(token.NoPos, "unable to create workdir: %v", err)
+	}
+
+	return paths.RootedFSPath(work, "."), isTemp
+}
diff --git a/v2/compiler/build/build_test.go b/v2/compiler/build/build_test.go
new file mode 100644
index 0000000000..b3aedd8c6e
--- /dev/null
+++ b/v2/compiler/build/build_test.go
@@ -0,0 +1,170 @@
+package build
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"go/token"
+	"log"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	"github.com/rogpeppe/go-internal/testscript"
+	"github.com/rogpeppe/go-internal/txtar"
+	"github.com/rs/zerolog"
+
+	builderpkg "encr.dev/pkg/builder"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/overlay"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/testutil"
+)
+
+func TestMain(m *testing.M) {
+	os.Exit(testscript.RunMain(m, map[string]func() int{
+		"run": run,
+	}))
+}
+
+func TestBuild(t *testing.T) {
+	// Get existing go cache, if any
+	gocache, err := exec.Command("go", "env", "GOCACHE").CombinedOutput()
+	if err != nil {
+		t.Fatal(err)
+	}
+	gocache = bytes.TrimSpace(gocache)
+	if len(gocache) == 0 {
+		gocache = []byte(t.TempDir())
+	}
+
+	testscript.Run(t, testscript.Params{
+		Dir: "testdata",
+		Setup: func(env *testscript.Env) error {
+			env.Setenv(testutil.EnvRepoDirOverride, testutil.EncoreRepoDir)
+			env.Setenv("GOCACHE", string(gocache))
+			fsPath := paths.RootedFSPath(env.WorkDir, ".")
+			overlays, err := processOverlays(fsPath)
+			if err != nil {
+				return err
+			}
+			jsonOverlays, _ := json.Marshal(overlays)
+			env.Setenv("CODEGEN_OVERLAYS", string(jsonOverlays))
+			return nil
+		},
+	})
+}
+
+func run() int {
+	if len(os.Args) != 2 {
+		log.Fatal("usage: run <pkg>")
+	}
+
+	var overlays []overlay.File
+	if desc := os.Getenv("CODEGEN_OVERLAYS"); desc != "" {
+		if err := json.Unmarshal([]byte(desc), &overlays); err != nil {
+			log.Fatalf("failed to unmarshal CODEGEN_OVERLAYS: %v", err)
+		}
+	}
+
+	work := os.Getenv("WORK")
+	res := build(work, paths.MustPkgPath(os.Args[1]), overlays)
+	cmd := exec.Command(res.Exe.ToIO())
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		return 1
+	}
+	return 0
+}
+
+func build(workdir string, pkgPath paths.Pkg, overlays []overlay.File) *Result {
+	runtimeArchive := testutil.ParseTxtar(dummyEncoreRuntime)
+	if err := txtar.Write(runtimeArchive, workdir); err != nil {
+		log.Fatalf("failed to write runtime archive: %v", err)
+	}
+	wd := paths.RootedFSPath(workdir, ".")
+
+	ctx := context.Background()
+	fs := token.NewFileSet()
+	errs := perr.NewList(ctx, fs)
+	pc := &parsectx.Context{
+		Ctx: ctx,
+		Log: zerolog.New(zerolog.NewConsoleWriter()).Level(zerolog.InfoLevel),
+		Build: parsectx.BuildInfo{
+			Experiments: nil,
+			GOARCH:      runtime.GOARCH,
+			GOOS:        runtime.GOOS,
+			GOROOT:      paths.RootedFSPath(runtime.GOROOT(), "."),
+			// HACK(andre): Make this nicer
+			EncoreRuntime: wd.Join("encore-runtime"),
+			BuildTags:     nil,
+			CgoEnabled:    false,
+			StaticLink:    false,
+			Debug:         builderpkg.DebugModeDisabled,
+		},
+		FS:            fs,
+		ParseTests:    false,
+		Errs:          errs,
+		MainModuleDir: wd,
+	}
+
+	res := Build(ctx, &Config{
+		Ctx:        pc,
+		Overlays:   overlays,
+		MainPkg:    pkgPath,
+		KeepOutput: false,
+	})
+	if errs.Len() > 0 {
+		log.Fatalf("build failed: %s", errs.FormatErrors())
+	}
+	return res
+}
+
+const dummyEncoreRuntime = `
+-- encore-runtime/go.mod --
+module encore.dev
+-- encore-runtime/go.sum --
+`
+
+func processOverlays(workdir paths.FS) ([]overlay.File, error) {
+	var overlays []overlay.File
+
+	files, _ := os.ReadDir(workdir.ToIO())
+	for _, f := range files {
+		if f.IsDir() {
+			continue
+		}
+
+		name := f.Name()
+		overlayPath, ok := strings.CutPrefix(name, "overlay:")
+		if !ok {
+			continue
+		}
+		overlayPath = strings.ReplaceAll(overlayPath, "\\", "/")
+
+		src := workdir.Join(filepath.FromSlash(overlayPath))
+		dst := workdir.Join(name)
+
+		contents, err := os.ReadFile(dst.ToIO())
+		if err != nil {
+			log.Fatal(err)
+		}
+		overlays = append(overlays, overlay.File{
+			Source:   src,
+			Contents: contents,
+		})
+
+		if err := os.Remove(dst.ToIO()); err != nil {
+			return nil, fmt.Errorf("unable to delete file: %v", err)
+		}
+	}
+
+	return overlays, nil
+}
diff --git a/v2/compiler/build/errors.go b/v2/compiler/build/errors.go
new file mode 100644
index 0000000000..bc319c5bae
--- /dev/null
+++ b/v2/compiler/build/errors.go
@@ -0,0 +1,11 @@
+package build
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range("test", "", errors.WithRangeSize(20))
+
+	ErrTestFailed = errRange.New("Test Failure", "One or more more tests failed.")
+)
diff --git a/v2/compiler/build/testdata/basic.txt b/v2/compiler/build/testdata/basic.txt
new file mode 100644
index 0000000000..30cdaa475d
--- /dev/null
+++ b/v2/compiler/build/testdata/basic.txt
@@ -0,0 +1,13 @@
+run example.com
+cmp stderr expected_output
+
+-- main.go --
+package main
+func main() {
+    println("Hello, world!")
+}
+-- go.mod --
+module example.com
+
+-- expected_output --
+Hello, world!
diff --git a/v2/compiler/build/testdata/overlay.txt b/v2/compiler/build/testdata/overlay.txt
new file mode 100644
index 0000000000..a3ff94d4fd
--- /dev/null
+++ b/v2/compiler/build/testdata/overlay.txt
@@ -0,0 +1,23 @@
+run example.com
+cmp stderr expected_output
+
+-- main.go --
+package main
+func main() {
+}
+-- overlay:main.go --
+package main
+func main() {
+    OverlayPrint() // defined in overlay
+}
+-- overlay:print.go --
+package main
+import ("fmt"; "os")
+func OverlayPrint() {
+    fmt.Fprintln(os.Stderr, "Hello, overlay world!")
+}
+-- go.mod --
+module example.com
+
+-- expected_output --
+Hello, overlay world!
diff --git a/v2/compiler/build/testdata/rewrite.txt b/v2/compiler/build/testdata/rewrite.txt
new file mode 100644
index 0000000000..4f1205af06
--- /dev/null
+++ b/v2/compiler/build/testdata/rewrite.txt
@@ -0,0 +1,18 @@
+run example.com
+cmp stderr expected_output
+
+-- main.go --
+package main
+func main() {
+    println("Hello, world!")
+}
+-- overlay:main.go --
+package main
+func main() {
+    println("Hello, rewritten world!")
+}
+-- go.mod --
+module example.com
+
+-- expected_output --
+Hello, rewritten world!
diff --git a/v2/compiler/build/tests.go b/v2/compiler/build/tests.go
new file mode 100644
index 0000000000..4891b1d554
--- /dev/null
+++ b/v2/compiler/build/tests.go
@@ -0,0 +1,197 @@
+// Package build supports building and testing Encore applications
+// with codegen and rewrite overlays.
+package build
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"strings"
+
+	"encr.dev/internal/etrace"
+	builderpkg "encr.dev/pkg/builder"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/perr"
+)
+
+type TestConfig struct {
+	GenerateTestSpecConfig
+	RunTestsConfig
+}
+
+func Test(ctx context.Context, cfg *TestConfig) {
+	b := &builder{
+		ctx:  ctx,
+		cfg:  &cfg.Config,
+		mode: testMode,
+		errs: cfg.Ctx.Errs,
+	}
+	spec := b.GenerateTestSpec(&cfg.GenerateTestSpecConfig)
+	b.RunTests(spec, &cfg.RunTestsConfig)
+}
+
+type TestSpec struct {
+	Command string
+	Args    []string
+	Environ []string
+
+	cfg *Config
+}
+
+type GenerateTestSpecConfig struct {
+	Config
+
+	// Args are additional arguments to "go test".
+	Args []string
+}
+
+func GenerateTestSpec(ctx context.Context, cfg *GenerateTestSpecConfig) *TestSpec {
+	b := &builder{
+		ctx:  ctx,
+		cfg:  &cfg.Config,
+		mode: testMode,
+		errs: cfg.Ctx.Errs,
+	}
+	return b.GenerateTestSpec(cfg)
+}
+
+func RunTests(ctx context.Context, spec *TestSpec, cfg *RunTestsConfig) {
+	b := &builder{
+		ctx:  ctx,
+		cfg:  spec.cfg,
+		mode: testMode,
+		errs: spec.cfg.Ctx.Errs,
+	}
+	b.RunTests(spec, cfg)
+}
+
+type RunTestsConfig struct {
+	// Stdout specifies the stdout to use.
+	Stdout io.Writer
+
+	// Stderr specifies the stderr to use.
+	Stderr io.Writer
+
+	// WorkingDir is the working directory to invoke
+	// the "go test" command from.
+	WorkingDir paths.FS
+}
+
+func (b *builder) RunTests(spec *TestSpec, testCfg *RunTestsConfig) {
+	if b.cfg.KeepOutput && b.workdir != "" {
+		_, _ = fmt.Fprintf(testCfg.Stdout, "wrote generated code to: %s\n", b.workdir.ToIO())
+	}
+	b.runTests(spec, testCfg)
+}
+
+func (b *builder) GenerateTestSpec(cfg *GenerateTestSpecConfig) *TestSpec {
+	workdir, tempWorkDir := b.prepareWorkDir()
+	b.workdir = workdir
+
+	if tempWorkDir {
+		defer func() {
+			// If we have a bailout or any errors, delete the workdir.
+			if _, ok := perr.CatchBailout(recover()); ok || b.errs.Len() > 0 {
+				if !b.cfg.KeepOutput && workdir != "" {
+					_ = os.RemoveAll(workdir.ToIO())
+				}
+			}
+		}()
+	}
+
+	for _, fn := range []func(){
+		b.writeModFile,
+	} {
+		fn()
+		// Abort early if we encountered any errors.
+		if b.errs.Len() > 0 {
+			break
+		}
+	}
+
+	return b.generateTestSpec(cfg)
+}
+
+func (b *builder) runTests(spec *TestSpec, testCfg *RunTestsConfig) {
+	etrace.Sync0(b.ctx, "", "runTests", func(ctx context.Context) {
+		cmd := exec.CommandContext(b.cfg.Ctx.Ctx, spec.Command, spec.Args...)
+		cmd.Env = spec.Environ
+		cmd.Dir = testCfg.WorkingDir.ToIO()
+		cmd.Stdout = testCfg.Stdout
+		cmd.Stderr = testCfg.Stderr
+
+		err := cmd.Run()
+		if err != nil {
+			if err.Error() == "exit status 1" {
+				// This is a standard error code for failed tests.
+				// so we don't need to wrap it.
+				b.errs.Add(ErrTestFailed)
+			} else {
+				// Otherwise we wrap the error.
+				b.errs.Add(ErrTestFailed.Wrapping(err))
+			}
+		}
+	})
+}
+
+func (b *builder) generateTestSpec(testCfg *GenerateTestSpecConfig) *TestSpec {
+	build := b.cfg.Ctx.Build
+	tags := append([]string{"encore", "encore_internal", "encore_app"}, build.BuildTags...)
+	args := []string{
+		"test",
+		"-tags=" + strings.Join(tags, ","),
+		"-overlay=" + b.overlayPath.ToIO(),
+		"-vet=off",
+	}
+
+	var ldflags strings.Builder
+	b.writeStaticConfig(&ldflags)
+
+	if b.cfg.Ctx.Build.StaticLink {
+		// Enable external linking if we use cgo.
+		if b.cfg.Ctx.Build.CgoEnabled {
+			ldflags.WriteString(" -linkmode external")
+		}
+
+		ldflags.WriteString(` -extldflags "-static"`)
+	}
+	args = append(args, "-ldflags", ldflags.String())
+
+	if b.cfg.Ctx.Build.Debug != builderpkg.DebugModeDisabled {
+		// Disable inlining for better debugging.
+		args = append(args, `-gcflags "all=-N -l"`)
+	}
+
+	args = append(args, testCfg.Args...)
+
+	goroot := build.GOROOT
+
+	// Copy the env before we add additional env vars
+	// to avoid accidentally sharing the same backing array.
+	env := make([]string, len(b.cfg.Env))
+	copy(env, b.cfg.Env)
+
+	env = append(env,
+		"GO111MODULE=on",
+		"GOROOT="+goroot.ToIO(),
+		"GOTOOLCHAIN=local",
+	)
+	if goos := build.GOOS; goos != "" {
+		env = append(env, "GOOS="+goos)
+	}
+	if goarch := build.GOARCH; goarch != "" {
+		env = append(env, "GOARCH="+goarch)
+	}
+	if !build.CgoEnabled {
+		env = append(env, "CGO_ENABLED=0")
+	}
+
+	return &TestSpec{
+		Command: goroot.Join("bin", "go"+b.exe()).ToIO(),
+		Args:    args,
+		Environ: append(os.Environ(), env...),
+		cfg:     b.cfg,
+	}
+}
diff --git a/v2/internals/overlay/overlay.go b/v2/internals/overlay/overlay.go
new file mode 100644
index 0000000000..7cf767716e
--- /dev/null
+++ b/v2/internals/overlay/overlay.go
@@ -0,0 +1,78 @@
+package overlay
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"encr.dev/pkg/paths"
+)
+
+// File describes a file to generate or rewrite.
+type File struct {
+	// Source is where on the filesystem the original file (in the case of a rewrite)
+	// or where the generated file should be overlaid into.
+	Source paths.FS
+
+	// Contents are the file contents of the overlaid file.
+	Contents []byte
+
+	// If set, overrides Contents and uses the dest directly instead.
+	Dest paths.FS
+}
+
+// Write writes the overlay files to the workdir
+// and generates an overlay.json file suitable for passing to 'go build -overlay'.
+// It returns the path to the written overlay.json file (which lives within workdir).
+func Write(workdir paths.FS, files []File) (overlayFile paths.FS, err error) {
+	overlay := make(map[string]string) // src -> dst
+	seenNames := make(map[string]bool)
+
+	addFile := func(f File) error {
+		src := f.Source.ToIO()
+		if f.Dest != "" {
+			overlay[src] = f.Dest.ToIO()
+			return nil
+		}
+
+		baseName := "gen_" + filepath.Base(filepath.Dir(src)) + "__" + filepath.Base(src)
+		if _, exists := overlay[src]; exists {
+			return fmt.Errorf("duplicate overlay of %s", src)
+		}
+
+		// Compute a reasonable destination name for the file.
+		ext := filepath.Ext(baseName)
+		nameWithoutExt := strings.TrimSuffix(baseName, ext)
+
+		// Keep generating names until we get one that doesn't conflict.
+		candidate := baseName
+		for i := 1; seenNames[candidate]; i++ {
+			candidate = fmt.Sprintf("%s_%d%s", nameWithoutExt, i, ext)
+		}
+		seenNames[candidate] = true
+		dst := workdir.Join(candidate)
+
+		// Write the file.
+		overlay[src] = dst.ToIO()
+		if err := os.WriteFile(dst.ToIO(), f.Contents, 0644); err != nil {
+			return fmt.Errorf("write overlay file %s: %v", dst, err)
+		}
+		return nil
+	}
+
+	for _, f := range files {
+		if err := addFile(f); err != nil {
+			return "", err
+		}
+	}
+
+	// Compute the overlay.json data.
+	data, _ := json.Marshal(map[string]any{"Replace": overlay})
+	overlayFile = workdir.Join("overlay.json")
+	if err := os.WriteFile(overlayFile.ToIO(), data, 0644); err != nil {
+		return "", fmt.Errorf("write overlay file %s: %v", overlayFile, err)
+	}
+	return overlayFile, nil
+}
diff --git a/v2/internals/parsectx/pctx.go b/v2/internals/parsectx/pctx.go
new file mode 100644
index 0000000000..411b5741a4
--- /dev/null
+++ b/v2/internals/parsectx/pctx.go
@@ -0,0 +1,215 @@
+package parsectx
+
+import (
+	"context"
+	"fmt"
+	"go/token"
+	"io"
+	"io/fs"
+	"os"
+	"runtime/trace"
+	"strings"
+	"time"
+
+	"github.com/rs/xid"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/experiments"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/perr"
+)
+
+// Context holds all the context for parsing.
+type Context struct {
+	// AppID is a unique id of the application, used for workdir caching.
+	// If left empty, a random workdir is used.
+	AppID option.Option[string]
+
+	// Ctx provides cancellation.
+	Ctx context.Context
+
+	// Log is the configured logger.
+	Log zerolog.Logger
+
+	// Build controls what files to build.
+	Build BuildInfo
+
+	// MainModuleDir is the directory containing the main module.
+	MainModuleDir paths.FS
+
+	// FS holds the fileset used for parsing.
+	FS *token.FileSet
+
+	// ParseTests controls whether to parse test files.
+	ParseTests bool
+
+	// Errs contains encountered errors.
+	Errs *perr.List
+
+	// Overlay is an optional replacement for reading files using the os pkg.
+	// If unset, os is used instead.
+	Overlay OverlaidOSFS
+}
+
+func (c *Context) ReadFile(dir string) ([]byte, error) {
+	if c.Overlay == nil {
+		return os.ReadFile(dir)
+	}
+	return c.Overlay.ReadFile(dir)
+}
+
+func (c *Context) ReadDir(dir string) ([]fs.DirEntry, error) {
+	if c.Overlay == nil {
+		return os.ReadDir(dir)
+	}
+	return c.Overlay.ReadDir(dir)
+}
+
+func (c *Context) ReadFileInfo(dir string) ([]fs.FileInfo, error) {
+	entries, err := c.ReadDir(dir)
+	if err != nil {
+		return nil, err
+	}
+	return fns.MapErr(entries, func(entry fs.DirEntry) (fs.FileInfo, error) {
+		return entry.Info()
+	})
+}
+
+func (c *Context) IsDir(path string) bool {
+	stat := os.Stat
+	if c.Overlay != nil {
+		stat = c.Overlay.Stat
+	}
+	fi, err := stat(path)
+	return err == nil && fi.IsDir()
+}
+
+func (c *Context) OpenFile(file string) (io.ReadCloser, error) {
+	if c.Overlay == nil {
+		return os.Open(file)
+	}
+	return c.Overlay.Open(file)
+}
+
+func (c *Context) PkgOverlay() map[string][]byte {
+	if c.Overlay == nil {
+		return nil
+	}
+	return c.Overlay.PkgOverlay()
+}
+
+// OverlaidOSFS is an interface that allows overlaying the os package with custom implementations.
+// This is used to allow for e.g. in-memory files. The name parameters are os paths, like the
+// corresponding methods in the os package.
+type OverlaidOSFS interface {
+	ReadDir(name string) ([]os.DirEntry, error)
+	ReadFile(name string) ([]byte, error)
+	Stat(name string) (os.FileInfo, error)
+	Open(name string) (io.ReadCloser, error)
+	PkgOverlay() map[string][]byte
+}
+
+// BuildInfo represents the information needed to parse and build an Encore application.
+type BuildInfo struct {
+	GOARCH string   // target architecture
+	GOOS   string   // target operating system
+	GOROOT paths.FS // GOROOT to use
+
+	EncoreRuntime paths.FS // Encore runtime to use
+
+	BuildTags  []string // additional build tags to set
+	CgoEnabled bool
+
+	// Experiments are the enabled experiments.
+	Experiments *experiments.Set
+
+	// StaticLink enables static linking of C libraries.
+	StaticLink bool
+
+	// Debug enables compiling in debug mode.
+	Debug builder.DebugMode
+
+	// Revision specifies the revision of the build.
+	Revision string
+
+	// UncommittedChanges, if true, specifies there are uncommitted changes
+	// part of the build .
+	UncommittedChanges bool
+
+	// MainPkg is the existing main package to use, if any.
+	// If None a main package is generated.
+	MainPkg option.Option[paths.Pkg]
+}
+
+// Trace traces the execution of a function.
+// It emits trace-level log messages, using the given message and key-value pairs.
+// It returns the logger for logging additional information during the processing.
+//
+// Usage:
+//
+//	tr := ctx.Trace("operation-name", "key", value)
+//	// ... invoke tr.Emit(...) to log additional information
+//	defer tr.Done()
+func (c *Context) Trace(op string, kvs ...any) *TraceLogger {
+	// If we're not tracing, do nothing.
+	if c.Log.GetLevel() > zerolog.TraceLevel && !trace.IsEnabled() {
+		return nil
+	}
+
+	taskCtx, task := trace.NewTask(c.Ctx, op)
+
+	log := c.Log.With().Str("op", op).Str("op_id", "op_"+xid.New().String()).Logger()
+	log.Trace().Caller(1).Fields(kvs).Msg("start")
+	now := time.Now()
+	return &TraceLogger{taskCtx: taskCtx, task: task, log: log, start: now, prev: now}
+}
+
+type TraceLogger struct {
+	taskCtx context.Context
+	task    *trace.Task
+	log     zerolog.Logger
+	start   time.Time
+	prev    time.Time
+}
+
+func (t *TraceLogger) Done(kvs ...any) {
+	if t == nil {
+		return
+	}
+	t.emit("done", kvs)
+	t.task.End()
+}
+
+func (t *TraceLogger) Emit(msg string, kvs ...any) {
+	if t == nil {
+		return
+	}
+	t.emit(msg, kvs)
+
+	// Write to the trace log if tracing is enabled.
+	if trace.IsEnabled() {
+		var logMsg strings.Builder
+		logMsg.WriteString(msg)
+		for i := 0; i < len(kvs)/2; i++ {
+			key := kvs[2*i]
+			value := kvs[2*i+1]
+			fmt.Fprintf(&logMsg, " %v=%v", key, value)
+		}
+
+		trace.Log(t.taskCtx, "", logMsg.String())
+	}
+}
+
+func (t *TraceLogger) emit(msg string, kvs []any) {
+	now := time.Now()
+	t.prev = now
+	t.log.Trace().
+		Caller(1).
+		Dur("from_start", now.Sub(t.start)).
+		Dur("from_prev", now.Sub(t.prev)).
+		Fields(kvs).
+		Msg(msg)
+}
diff --git a/v2/internals/perr/aserror.go b/v2/internals/perr/aserror.go
new file mode 100644
index 0000000000..9933047633
--- /dev/null
+++ b/v2/internals/perr/aserror.go
@@ -0,0 +1,67 @@
+package perr
+
+import (
+	"fmt"
+
+	"encr.dev/pkg/errinsrc"
+)
+
+// ListAsErr is a wrapper around a List that implements the error interface
+// allowing us to return a List as an error from functions that parse or compile
+// an application.
+//
+// We've not implemented Error on List directly because we want to avoid accidentally
+// returning a List as an error, and want to be explicit about it.
+type ListAsErr struct {
+	prefix string
+	list   *List
+}
+
+var (
+	_ error              = (*ListAsErr)(nil)
+	_ errinsrc.ErrorList = (*ListAsErr)(nil) // We implement this to maintain compatibility with errinsrc detection within the Encore Platform
+)
+
+// Error returns the list of errors formatted as a single string.
+func (r *ListAsErr) Error() string {
+	if r.prefix != "" {
+		return fmt.Sprintf("%s: %s", r.prefix, r.list.FormatErrors())
+	}
+
+	return r.list.FormatErrors()
+}
+
+// Unwrap returns the list of errors that make up this error.
+//
+// Note: This version of Unwrap is a Go 1.20+ feature
+//
+//goland:noinspection GoStandardMethods
+func (r *ListAsErr) Unwrap() []error {
+	rtn := make([]error, len(r.list.errs))
+	for i, err := range r.list.errs {
+		rtn[i] = err
+	}
+	return rtn
+}
+
+// As implements the As method of the error interface.
+//
+// It supports the following types:
+//   - **ListAsErr
+//   - **List
+func (r *ListAsErr) As(err any) bool {
+	switch err := err.(type) {
+	case **ListAsErr:
+		*err = r
+	case **List:
+		*err = r.list
+	default:
+		return false
+	}
+	return true
+}
+
+// ErrorList returns the list of errors in the source that make up this error.
+func (r *ListAsErr) ErrorList() []*errinsrc.ErrInSrc {
+	return r.list.errs
+}
diff --git a/v2/internals/perr/perr.go b/v2/internals/perr/perr.go
new file mode 100644
index 0000000000..e232189fd8
--- /dev/null
+++ b/v2/internals/perr/perr.go
@@ -0,0 +1,332 @@
+// Package perr provides utilities for handling parse errors.
+package perr
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"go/ast"
+	"go/scanner"
+	"go/token"
+	"path/filepath"
+	"strings"
+	"sync"
+
+	"golang.org/x/tools/go/packages"
+
+	"encr.dev/pkg/errinsrc"
+	"encr.dev/pkg/errinsrc/srcerrors"
+	"encr.dev/pkg/errlist"
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/paths"
+	daemonpb "encr.dev/proto/encore/daemon"
+)
+
+// NewList constructs a new list.
+//
+// It takes a ctx to add an error on context cancellation
+// since code often uses ctx cancellation to cause a bailout.
+func NewList(ctx context.Context, fset *token.FileSet, fileReaders ...paths.FileReader) *List {
+	return &List{ctx: ctx, fset: fset, fileReaders: fileReaders}
+}
+
+// List is a list of errors.
+// The same instance is shared between different components.
+type List struct {
+	ctx         context.Context
+	fset        *token.FileSet
+	fileReaders []paths.FileReader
+
+	mu   sync.Mutex
+	errs errinsrc.List
+}
+
+// AsError returns this list an error if there are
+// errors in the list, otherwise it returns nil.
+func (l *List) AsError() error {
+	if l.Len() == 0 {
+		return nil
+	}
+
+	return &ListAsErr{list: l}
+}
+
+// Add adds a templated error
+func (l *List) Add(template errors.Template) {
+	l.add(errinsrc.FromTemplate(template, l.fset, l.fileReaders...))
+}
+
+// Add adds an error at the given pos.
+func (l *List) AddPos(pos token.Pos, msg string) {
+	l.add(srcerrors.GenericError(l.fset.Position(pos), msg, l.fileReaders...))
+}
+
+// Addf is equivalent to l.Add(pos, fmt.Sprintf(format, args...))
+func (l *List) Addf(pos token.Pos, format string, args ...any) {
+	l.AddPos(pos, fmt.Sprintf(format, args...))
+}
+
+// AddStd adds an error from the stdlib packages that uses
+// scanner.ErrorList or *scanner.Error under the hood.
+func (l *List) AddStd(err error) {
+	if err == nil {
+		return
+	}
+
+	switch err := err.(type) {
+	case *errinsrc.ErrInSrc:
+		l.add(err)
+
+	case errinsrc.ErrorList:
+		for _, e := range err.ErrorList() {
+			l.add(e)
+		}
+
+	case *scanner.Error:
+		l.add(srcerrors.GenericGoParserError(err, l.fileReaders...))
+
+	case scanner.ErrorList:
+		for _, e := range err {
+			l.add(srcerrors.GenericGoParserError(e, l.fileReaders...))
+		}
+
+	case packages.Error:
+		l.add(srcerrors.GenericGoPackageError(err, l.fileReaders...))
+
+	default:
+		l.add(srcerrors.StandardLibraryError(err))
+	}
+}
+
+func (l *List) AddStdNode(err error, node ast.Node) {
+	if err == nil {
+		return
+	}
+
+	add := func(err *errinsrc.ErrInSrc) {
+		err.WithGoNode(l.fset, node, l.fileReaders...)
+		l.add(err)
+	}
+
+	switch err := err.(type) {
+	case *errinsrc.ErrInSrc:
+		add(err)
+
+	case errinsrc.ErrorList:
+		for _, e := range err.ErrorList() {
+			add(e)
+		}
+
+	case *scanner.Error:
+		add(srcerrors.GenericGoParserError(err, l.fileReaders...))
+
+	case scanner.ErrorList:
+		for _, e := range err {
+			add(srcerrors.GenericGoParserError(e, l.fileReaders...))
+		}
+
+	case packages.Error:
+		add(srcerrors.GenericGoPackageError(err, l.fileReaders...))
+
+	default:
+		add(srcerrors.StandardLibraryError(err))
+	}
+}
+
+func (l *List) Fatal(pos token.Pos, msg string) {
+	l.AddPos(pos, msg)
+	l.Bailout()
+}
+
+func (l *List) Fatalf(pos token.Pos, format string, args ...any) {
+	l.Addf(pos, format, args...)
+	l.Bailout()
+}
+
+func (l *List) Assert(template errors.Template) {
+	l.Add(template)
+	l.Bailout()
+}
+
+func (l *List) AssertStd(err error) {
+	if err != nil {
+		l.AddStd(err)
+		l.Bailout()
+	}
+}
+
+// Len returns the number of errors reported.
+func (l *List) Len() int {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	n := len(l.errs)
+
+	if err := l.ctx.Err(); err != nil {
+		n++
+	}
+	return n
+}
+
+// At returns the i'th error. i must be 0 <= i < l.Len().
+func (l *List) At(i int) *errinsrc.ErrInSrc {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	return l.errs[i]
+}
+
+func (l *List) FS() *token.FileSet {
+	return l.fset
+}
+
+func (l *List) add(e *errinsrc.ErrInSrc) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.errs = append(l.errs, e)
+}
+
+// FormatErrors formats the errors as a newline-separated string.
+// If there are no errors it returns "no errors".
+func (l *List) FormatErrors() string {
+	if n := l.Len(); n == 0 {
+		return "no errors"
+	}
+
+	var b strings.Builder
+	for _, err := range l.errs {
+		fmt.Fprintf(&b, "%s\n", err.Error())
+	}
+	if err := l.ctx.Err(); err != nil {
+		fmt.Fprintf(&b, "%s\n", err.Error())
+	}
+	return b.String()
+}
+
+func (l *List) GoString() string {
+	return "&perr.List{...}"
+}
+
+// MakeRelative rewrites the errors by making filenames within the
+// app root relative to the relwd (which must be a relative path
+// within the root).
+func (l *List) MakeRelative(root, relwd string) {
+	wdroot := filepath.Join(root, relwd)
+	for _, e := range l.errs {
+		for _, loc := range e.Params.Locations {
+			if loc.File != nil {
+				fn := loc.File.RelPath
+				if strings.HasPrefix(fn, root) {
+					if rel, err := filepath.Rel(wdroot, fn); err == nil {
+						loc.File.RelPath = rel
+					}
+				}
+			}
+		}
+	}
+}
+
+// SendToStream sends a GRPC command with this
+// full errlist
+//
+// If l is nil or empty, it sends a nil command
+// allowing the client to know that there are no
+// longer an error present
+func (l *List) SendToStream(stream interface {
+	Send(*daemonpb.CommandMessage) error
+}) error {
+	var bytes []byte
+	if l != nil && len(l.errs) > 0 {
+		// TODO: For now we use the older errlist format in JSON to preserve
+		// backward compatibility with the daemon while it could receive
+		// errors from v1 or v2.
+		//
+		// Once we remove v1, we can remove this shim
+		errList := errlist.New(l.fset)
+		errList.List = l.errs
+
+		var err error
+		bytes, err = json.Marshal(errList)
+		if err != nil {
+			panic("unable to marshal error list")
+		}
+	}
+	return stream.Send(
+		&daemonpb.CommandMessage{
+			Msg: &daemonpb.CommandMessage_Errors{
+				Errors: &daemonpb.CommandDisplayErrors{
+					Errinsrc: bytes,
+				},
+			},
+		},
+	)
+}
+
+// BailoutOnErrors calls fn and bailouts if fn reports any errors.
+func (l *List) BailoutOnErrors(fn func()) {
+	n := l.Len()
+	fn()
+	if l.Len() > n {
+		l.Bailout()
+	}
+}
+
+func (l *List) Bailout() {
+	panic(bailout{l})
+}
+
+type bailout struct{ l *List }
+
+func (b bailout) GoString() string {
+	return fmt.Sprintf("perr.bailout: %s", b.l.FormatErrors())
+}
+
+func (b bailout) String() string {
+	return fmt.Sprintf("perr.bailout: %s", b.l.FormatErrors())
+}
+
+// CatchBailout catches a bailout panic and reports whether there was one.
+// If true it also returns the error list that caused the bailout.
+// Intended usage is:
+//
+//	  if l, ok := perr.CatchBailout(recover()); ok {
+//		// handle bailout
+//	  }
+func CatchBailout(recovered any) (l *List, ok bool) {
+	if recovered != nil {
+		if b, ok := recovered.(bailout); ok {
+			return b.l, true
+		} else {
+			panic(recovered)
+		}
+	}
+	return nil, false
+}
+
+// CatchBailoutAndPanic is like CatchBailout but also catches other panics.
+// In both types of panics it converts the result to an error.
+//
+// If there is no panic it returns the error provided in the first argument
+// back to the caller. That way, it can usually be used like so
+// (inside a deferred function):
+//
+//	err, _ = perr.CatchBailoutAndPanic(err, recover())
+func CatchBailoutAndPanic(currentErr error, recovered any) (err error, caught bool) {
+	if recovered == nil {
+		return currentErr, false
+	}
+
+	if b, ok := recovered.(bailout); ok {
+		err = b.l.AsError()
+	} else {
+		err = srcerrors.UnhandledPanic(recovered)
+	}
+	return err, true
+}
+
+// IsBailout reports whether a recovered value is a bailout panic.
+// It reports the list that caused the bailout alongside.
+func IsBailout(recovered any) (l *List, ok bool) {
+	if b, ok := recovered.(bailout); ok {
+		return b.l, true
+	}
+	return nil, false
+}
diff --git a/v2/internals/pkginfo/errors.go b/v2/internals/pkginfo/errors.go
new file mode 100644
index 0000000000..9d3a887705
--- /dev/null
+++ b/v2/internals/pkginfo/errors.go
@@ -0,0 +1,34 @@
+package pkginfo
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"pkginfo",
+		"",
+
+		errors.WithRangeSize(25),
+	)
+
+	errReadingGoMod = errRange.New(
+		"Error Reading go.mod",
+		"An error occurred while trying to read the go.mod file.",
+	)
+
+	errInvalidModulePath = errRange.Newf(
+		"Invalid Module Path",
+		"The module path %q in the go.mod file is invalid.",
+	)
+
+	errReadingFile = errRange.New(
+		"Error Reading File",
+		"An error occurred while trying to read a file.",
+	)
+
+	errMatchingFile = errRange.New(
+		"Error Matching File",
+		"An error occurred while trying to match a file to the build.",
+	)
+)
diff --git a/v2/internals/pkginfo/loader.go b/v2/internals/pkginfo/loader.go
new file mode 100644
index 0000000000..2c02c9b1d4
--- /dev/null
+++ b/v2/internals/pkginfo/loader.go
@@ -0,0 +1,209 @@
+package pkginfo
+
+import (
+	"go/build"
+	"go/token"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"sync"
+
+	"golang.org/x/tools/go/packages"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/perr"
+)
+
+// New creates a new Loader.
+func New(c *parsectx.Context) *Loader {
+	l := &Loader{
+		c:       c,
+		modules: make(map[paths.Mod]*Module),
+		parsed:  make(map[paths.Pkg]*parseResult),
+	}
+	l.init()
+	return l
+}
+
+// A Loader provides lazy loading of package information.
+type Loader struct {
+	c *parsectx.Context
+
+	// initialized by init.
+	mainModule     *Module
+	runtimeModule  *Module
+	buildCtx       *build.Context
+	packagesConfig *packages.Config
+
+	// modules contains loaded module information.
+	modulesMu sync.Mutex
+	modules   map[paths.Mod]*Module
+
+	// parsed is a cache of parse results, guarded by parsedMu.
+	parsedMu sync.Mutex
+	parsed   map[paths.Pkg]*parseResult // importPath -> result
+}
+
+func (l *Loader) init() {
+	// Resolve the main module.
+	l.mainModule = l.loadModuleFromDisk(l.c.MainModuleDir, "")
+	// Manually cache the main module.
+	l.modules[l.mainModule.Path] = l.mainModule
+
+	// Resolve the encore.dev runtime module.
+	l.runtimeModule = &Module{
+		l:       l,
+		RootDir: l.c.Build.EncoreRuntime,
+		Path:    "encore.dev",
+		Version: "v1.0.0",
+	}
+	l.modules["encore.dev"] = l.runtimeModule
+
+	// Resolve the stdlib module.
+	{
+		// If this is the standard library go/packages doesn't return
+		// a Module object. Instead look it up from our GOROOT.
+		goroot := l.c.Build.GOROOT
+		rootPath := goroot.Join("src")
+
+		// Construct a synthetic Module object for the standard library.
+		l.modules[paths.StdlibMod()] = &Module{
+			l:       l,
+			RootDir: rootPath,
+			Path:    "std",
+			Version: "",
+		}
+	}
+
+	b := l.c.Build
+	d := &build.Default
+	l.buildCtx = &build.Context{
+		GOARCH: b.GOARCH,
+		GOOS:   b.GOOS,
+		GOROOT: b.GOROOT.ToIO(),
+
+		Dir:         l.c.MainModuleDir.ToIO(),
+		CgoEnabled:  b.CgoEnabled,
+		UseAllFiles: false,
+		Compiler:    d.Compiler,
+		BuildTags:   append(slices.Clone(d.BuildTags), b.BuildTags...),
+		ToolTags:    slices.Clone(d.ToolTags),
+		ReleaseTags: slices.Clone(d.ReleaseTags),
+		OpenFile:    l.c.OpenFile,
+		ReadDir:     l.c.ReadFileInfo,
+		IsDir:       l.c.IsDir,
+	}
+
+	// Set up the go/packages configuration for resolving modules.
+	cgoEnabled := "0"
+	if b.CgoEnabled {
+		cgoEnabled = "1"
+	}
+	UpdateGoPath(b.GOROOT)
+	l.packagesConfig = &packages.Config{
+		Mode:    packages.NeedName | packages.NeedFiles | packages.NeedModule,
+		Context: l.c.Ctx,
+		Dir:     l.c.MainModuleDir.ToIO(),
+		Env: append(os.Environ(),
+			"GOOS="+b.GOOS,
+			"GOARCH="+b.GOARCH,
+			"GOROOT="+b.GOROOT.ToIO(),
+			"CGO_ENABLED="+cgoEnabled,
+			"PATH="+b.GOROOT.Join("bin").ToIO()+string(filepath.ListSeparator)+os.Getenv("PATH"),
+		),
+		Fset:    l.c.FS,
+		Tests:   l.c.ParseTests,
+		Overlay: l.c.PkgOverlay(),
+		Logf: func(format string, args ...any) {
+			l.c.Log.Debug().Str("component", "pkgload").Msgf("go/packages: "+format, args...)
+		},
+	}
+}
+
+// MainModule returns the parsed main module.
+func (l *Loader) MainModule() *Module {
+	return l.mainModule
+}
+
+// RuntimeModule returns the parsed runtime module.
+func (l *Loader) RuntimeModule() *Module {
+	return l.runtimeModule
+}
+
+// MustLoadPkg loads a package.
+// If the package contains no Go files, it bails out.
+func (l *Loader) MustLoadPkg(cause token.Pos, pkgPath paths.Pkg) (pkg *Package) {
+	pkg, ok := l.LoadPkg(cause, pkgPath)
+	if !ok {
+		l.c.Errs.Addf(cause, "could not find package %q", pkgPath)
+		l.c.Errs.Bailout()
+	}
+	return pkg
+}
+
+// LoadPkg loads a package.
+// If the package contains no Go files to build, it returns (nil, false).
+func (l *Loader) LoadPkg(cause token.Pos, pkgPath paths.Pkg) (pkg *Package, ok bool) {
+	// Do we have the result cached already?
+	l.parsedMu.Lock()
+	result, wasCached := l.parsed[pkgPath]
+	if !wasCached {
+		// Not cached; store a new entry so other goroutines will wait for us.
+		result = &parseResult{done: make(chan struct{})}
+		l.parsed[pkgPath] = result
+		defer close(result.done)
+	}
+	l.parsedMu.Unlock()
+
+	if wasCached {
+		// We have a cached package. Wait for parsing to complete.
+		select {
+		case <-result.done:
+			if result.bailout {
+				return nil, false
+			}
+			return result.pkg, result.ok
+
+		case <-l.c.Ctx.Done():
+			// The context was cancelled first.
+			return nil, false
+		}
+	}
+
+	// Not cached. Do the parsing.
+	// Catch any err since this runs in a separate goroutine.
+	defer func() {
+		if _, caught := perr.CatchBailout(recover()); caught {
+			result.bailout = true
+			pkg = nil
+			ok = false
+		}
+	}()
+
+	module := l.resolveModuleForPkg(cause, pkgPath)
+	relPath, ok := module.Path.RelativePathToPkg(pkgPath)
+	if !ok {
+		return nil, false
+	}
+
+	result.pkg, result.ok = l.doParsePkg(loadPkgSpec{
+		cause: cause,
+		path:  pkgPath,
+		dir:   module.RootDir.Join(relPath.ToIO()),
+	})
+	return result.pkg, result.ok
+}
+
+// UpdateGoPath updates the PATH environment variable to use the
+// "go" binary from Encore's GOROOT.
+// This is necessary because packages.Load invokes "go list" under the hood,
+// and we want to ensure it uses the same 'go' binary as Encore.
+func UpdateGoPath(goRoot paths.FS) {
+	curr := os.Getenv("PATH")
+	prefix := goRoot.Join("bin").ToIO() + string(filepath.ListSeparator)
+	if !strings.HasPrefix(curr, prefix) {
+		_ = os.Setenv("PATH", prefix+curr)
+	}
+}
diff --git a/v2/internals/pkginfo/loader_test.go b/v2/internals/pkginfo/loader_test.go
new file mode 100644
index 0000000000..d8d6b273e0
--- /dev/null
+++ b/v2/internals/pkginfo/loader_test.go
@@ -0,0 +1,171 @@
+package pkginfo_test
+
+import (
+	"go/token"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/testutil"
+)
+
+func TestLoader(t *testing.T) {
+	t.Run("single", func(t *testing.T) {
+		c := qt.New(t)
+		a := parse(`
+-- foo/foo.go --
+// Package doc
+package pkgname // main file
+-- go.mod --
+module example.com
+`)
+
+		tc := testutil.NewContext(c, false, a)
+		tc.FailTestOnErrors()
+		l := pkginfo.New(tc.Context)
+
+		pkg, ok := l.LoadPkg(token.NoPos, "example.com/foo")
+		c.Assert(ok, qt.Equals, true)
+		c.Check(pkg.Name, qt.Equals, "pkgname")
+		c.Check(pkg.ImportPath, qt.Equals, paths.MustPkgPath("example.com/foo"))
+		c.Check(pkg.Doc, qt.Equals, "Package doc\n")
+
+		c.Assert(pkg.Files, qt.HasLen, 1)
+		f := pkg.Files[0]
+		c.Check(f.Name, qt.Equals, "foo.go")
+		c.Check(f.Pkg, qt.Equals, pkg)
+		c.Check(f.TestFile, qt.IsFalse)
+		c.Check(string(f.Contents()), qt.Equals, string(a.Files[0].Data))
+	})
+
+	t.Run("with_tests", func(t *testing.T) {
+		c := qt.New(t)
+		a := parse(`
+-- foo/foo.go --
+package foo // main file
+-- foo/foo_test.go --
+package foo // test file
+-- go.mod --
+module example.com
+	`)
+
+		tc := testutil.NewContext(c, true, a)
+		tc.FailTestOnErrors()
+		l := pkginfo.New(tc.Context)
+
+		pkg, ok := l.LoadPkg(token.NoPos, "example.com/foo")
+		c.Assert(ok, qt.Equals, true)
+		c.Assert(pkg.Files, qt.HasLen, 2)
+
+		c.Check(pkg.Files[0].Name, qt.Equals, "foo.go")
+		c.Check(pkg.Files[0].TestFile, qt.IsFalse)
+		c.Check(string(pkg.Files[0].Contents()), qt.Equals, string(a.Files[0].Data))
+
+		c.Check(pkg.Files[1].Name, qt.Equals, "foo_test.go")
+		c.Check(pkg.Files[1].TestFile, qt.IsTrue)
+		c.Check(string(pkg.Files[1].Contents()), qt.Equals, string(a.Files[1].Data))
+	})
+
+	t.Run("with_external_tests", func(t *testing.T) {
+		c := qt.New(t)
+		a := parse(`
+-- foo/foo.go --
+package foo // main file
+-- foo/foo_test.go --
+package foo_test // external test file
+-- go.mod --
+module example.com
+	`)
+
+		tc := testutil.NewContext(c, true, a)
+		tc.FailTestOnErrors()
+		l := pkginfo.New(tc.Context)
+
+		pkg, ok := l.LoadPkg(token.NoPos, "example.com/foo")
+		c.Assert(ok, qt.Equals, true)
+		c.Assert(pkg.Files, qt.HasLen, 2)
+
+		c.Check(pkg.Files[0].Name, qt.Equals, "foo.go")
+		c.Check(pkg.Files[0].TestFile, qt.IsFalse)
+		c.Check(string(pkg.Files[0].Contents()), qt.Equals, string(a.Files[0].Data))
+
+		c.Check(pkg.Files[1].Name, qt.Equals, "foo_test.go")
+		c.Check(pkg.Files[1].TestFile, qt.IsTrue)
+		c.Check(string(pkg.Files[1].Contents()), qt.Equals, string(a.Files[1].Data))
+	})
+
+	t.Run("with_tests_ignored", func(t *testing.T) {
+		c := qt.New(t)
+		a := parse(`
+-- foo/foo.go --
+package foo // main file
+-- foo/foo_test.go --
+package foo // test file
+-- go.mod --
+module example.com
+	`)
+
+		tc := testutil.NewContext(c, false, a)
+		tc.FailTestOnErrors()
+
+		l := pkginfo.New(tc.Context)
+
+		pkg, ok := l.LoadPkg(token.NoPos, "example.com/foo")
+		c.Assert(ok, qt.Equals, true)
+		c.Assert(pkg.Files, qt.HasLen, 1)
+
+		c.Check(pkg.Files[0].Name, qt.Equals, "foo.go")
+		c.Check(pkg.Files[0].TestFile, qt.IsFalse)
+		c.Check(string(pkg.Files[0].Contents()), qt.Equals, string(a.Files[0].Data))
+	})
+
+	t.Run("with_parse_failure", func(t *testing.T) {
+		c := qt.New(t)
+
+		a := parse(`
+-- foo/foo.go --
+asdf
+-- go.mod --
+module example.com
+	`)
+
+		tc := testutil.NewContext(c, false, a)
+		l := pkginfo.New(tc.Context)
+
+		defer tc.DeferExpectError(`expected 'package', found asdf`)
+
+		l.LoadPkg(token.NoPos, "example.com/foo")
+	})
+
+	t.Run("external_module", func(t *testing.T) {
+		c := qt.New(t)
+		a := parse(`
+-- go.mod --
+module example.com
+require rsc.io/hello v1.0.0
+`)
+		tc := testutil.NewContext(c, false, a)
+		l := pkginfo.New(tc.Context)
+		defer tc.FailTestOnBailout()
+		tc.GoModDownload()
+		pkg := l.MustLoadPkg(token.NoPos, "rsc.io/hello")
+		c.Assert(pkg.Files, qt.HasLen, 1)
+		c.Assert(pkg.Name, qt.Equals, "main")
+		c.Assert(pkg.Doc, qt.Equals, "Hello greets the world.\n")
+
+		f := pkg.Files[0]
+		c.Check(f.Name, qt.Equals, "hello.go")
+		c.Check(f.TestFile, qt.IsFalse)
+		c.Check(f.FSPath.ToIO(), qt.Matches, `.*/mod/rsc\.io/hello@v1\.0\.0/hello.go`)
+		c.Check(fns.MapKeys(f.Imports), qt.ContentEquals, []paths.Pkg{"fmt", "rsc.io/quote"})
+		c.Check(string(pkg.Files[0].Contents()), qt.Contains, "fmt.Println(quote.Hello())")
+	})
+}
+
+func parse(in string) *txtar.Archive {
+	return txtar.Parse([]byte(in))
+}
diff --git a/v2/internals/pkginfo/modresolve.go b/v2/internals/pkginfo/modresolve.go
new file mode 100644
index 0000000000..1633de4eaa
--- /dev/null
+++ b/v2/internals/pkginfo/modresolve.go
@@ -0,0 +1,207 @@
+package pkginfo
+
+import (
+	"errors"
+	"go/token"
+	"io/fs"
+	"os"
+	"slices"
+
+	"golang.org/x/mod/modfile"
+	"golang.org/x/tools/go/packages"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+)
+
+// File modresolve contains tools for resolving an import path
+// into information about the module it belongs to.
+
+// loadModuleFromDisk loads the module information from the given directory.
+// It does not consult the module cache; use resolveModule for that.
+func (l *Loader) loadModuleFromDisk(rootDir paths.FS, fallbackModPath paths.Mod) (m *Module) {
+	tr := l.c.Trace("pkgload.loadModuleFromDisk", "dir", rootDir)
+	defer tr.Done("result", m)
+
+	// Load the go.mod file from disk and validate it.
+	gomodFilePath := rootDir.Join("go.mod").ToIO()
+	data, err := os.ReadFile(gomodFilePath)
+	if err != nil {
+		if errors.Is(err, fs.ErrNotExist) && fallbackModPath != "" {
+			// The dependency predates Go Modules. Simulate an empty module.
+			return &Module{
+				RootDir: rootDir,
+				Path:    fallbackModPath,
+				Version: "v0.0.0-00010101000000-000000000000",
+			}
+		}
+
+		l.c.Errs.Assert(errReadingGoMod.Wrapping(err).InFile(gomodFilePath))
+	}
+	modFile, err := modfile.Parse(gomodFilePath, data, nil)
+	if err != nil {
+		l.c.Errs.Assert(errReadingGoMod.Wrapping(err).InFile(gomodFilePath))
+	}
+	if !paths.ValidModPath(modFile.Module.Mod.Path) {
+		l.c.Errs.Assert(errInvalidModulePath(modFile.Module.Mod.Path).InFile(gomodFilePath))
+	}
+
+	m = &Module{
+		RootDir: rootDir,
+		Path:    paths.MustModPath(modFile.Module.Mod.Path),
+		Version: modFile.Module.Mod.Version,
+		file:    option.Some(modFile),
+	}
+
+	// Parse the dependencies.
+	// We ignore other directives (like replace) because they don't impact
+	// how package paths are resolved to modules.
+	for _, dep := range modFile.Require {
+		depModPath := dep.Mod.Path
+		// ignore invalid module paths. We could raise an error,
+		// but the build step catches dependency issues anyway.
+		if !paths.ValidModPath(depModPath) {
+			continue
+		}
+		if m.Path.LexicallyContains(paths.MustPkgPath(depModPath)) {
+			m.sortedNestedDeps = append(m.sortedNestedDeps, paths.MustModPath(depModPath))
+		} else {
+			m.sortedOtherDeps = append(m.sortedOtherDeps, paths.MustModPath(depModPath))
+		}
+	}
+	slices.Sort(m.sortedNestedDeps)
+	slices.Sort(m.sortedOtherDeps)
+
+	return m
+}
+
+var stdModule = paths.StdlibMod()
+
+// moduleForPkgPath resolves the module path that contains
+// the given import path, based on the module information.
+// It consults the module path and the module's require directives.
+func (l *Loader) moduleForPkgPath(pkgPath paths.Pkg) (modPath paths.Mod, found bool) {
+	// We resolve all packages by consulting the versions
+	// in the main module, since only the main module's dependencies
+	// track exactly which versions are used (due to MVS).
+	m := l.mainModule
+
+	// Fast path: first check if it's contained in the main module,
+	// since that's what we scan the most frequently.
+	if m.Path.LexicallyContains(pkgPath) {
+		// The package is rooted within this module.
+		// It's possible it's a nested module.
+		if nested, ok := findModule(m.sortedNestedDeps, pkgPath); ok {
+			return nested, true
+		}
+		// It belongs to this module.
+		return m.Path, true
+	}
+
+	// Otherwise fall back to all the other dependencies.
+	if modPath, found = findModule(m.sortedOtherDeps, pkgPath); found {
+		return modPath, true
+	}
+
+	// We couldn't find it in any module the main module depends on.
+	// See if it belongs to the standard library.
+	if stdModule.LexicallyContains(pkgPath) {
+		// The package is rooted within the standard library.
+		return stdModule, true
+	}
+
+	// Couldn't find it. Give up.
+	return "", false
+}
+
+// findModule finds the module that contains pkg given a
+// sorted list of modules to consult.
+func findModule(sortedMods []paths.Mod, pkg paths.Pkg) (modPath paths.Mod, found bool) {
+	idx, exactMatch := slices.BinarySearch(sortedMods, paths.Mod(pkg))
+	// Two cases to consider: an exact match (unlikely) or a prefix match.
+	if exactMatch {
+		return sortedMods[idx], true
+	}
+
+	// idx represents where the path would be inserted in the list.
+	// Since we're interested in prefix matches, we expect the module the
+	// package path is contained within to be at idx-1.
+	// If idx == 0 the module wasn't found.
+	if idx == 0 {
+		return "", false
+	} else if candidate := sortedMods[idx-1]; candidate.LexicallyContains(pkg) {
+		return candidate, true
+	} else {
+		// It's possible to end up here if there are multiple dependencies
+		// with module paths that are prefixes of one another.
+		//
+		// Consider the deps: ["foo", "foo/bar", "foo/bar/baz"].
+		// Doing a binary search for "foo/qux" would return (idx=3, exactMatch=false),
+		// but the module that contains "foo/qux" is "foo" at idx=0.
+		//
+		// To handle this case, keep iterating backwards until we find a prefix match.
+		for i := idx - 2; i >= 0; i-- {
+			if candidate := sortedMods[i]; candidate.LexicallyContains(pkg) {
+				return candidate, true
+			}
+		}
+
+		return "", false
+	}
+}
+
+// resolveModuleForPkg resolves information about the module that contains a package.
+func (l *Loader) resolveModuleForPkg(cause token.Pos, pkgPath paths.Pkg) (result *Module) {
+	// Which module does this package belong to?
+	modPath, found := l.moduleForPkgPath(pkgPath)
+	if !found {
+		l.c.Errs.Addf(cause, "package %q not found belonging to any module", pkgPath)
+		l.c.Errs.Bailout()
+		return nil // unreachable
+	}
+
+	// Is the module already cached?
+	l.modulesMu.Lock()
+	cached, ok := l.modules[modPath]
+	l.modulesMu.Unlock()
+	if ok {
+		return cached
+	}
+
+	tr := l.c.Trace("resolve module for package", "pkgPath", pkgPath)
+	defer tr.Done("result", result)
+
+	pkgs, err := packages.Load(l.packagesConfig, "pattern="+string(pkgPath))
+	l.c.Errs.AssertStd(err)
+
+	var pkg *packages.Package
+	for _, candidate := range pkgs {
+		if candidate.PkgPath == string(pkgPath) {
+			pkg = candidate
+			break
+		}
+	}
+	if pkg == nil {
+		l.c.Errs.Fatalf(cause, "cannot find package %q", pkgPath)
+	} else if len(pkg.Errors) > 0 {
+		for _, err := range pkg.Errors {
+			l.c.Errs.AddStd(err)
+		}
+		l.c.Errs.Bailout()
+	} else if len(pkg.GoFiles) == 0 {
+		l.c.Errs.Fatalf(cause, "package %q has no Go files", pkgPath)
+	}
+
+	// Load the module from disk.
+	if pkg.Module == nil || pkg.Module.Dir == "" {
+		l.c.Errs.Fatalf(cause, "package %q has no module information", pkgPath)
+	}
+	rootPath := paths.RootedFSPath(pkg.Module.Dir, ".")
+	result = l.loadModuleFromDisk(rootPath, modPath)
+
+	// Add the module to the cache.
+	l.modulesMu.Lock()
+	defer l.modulesMu.Unlock()
+	l.modules[modPath] = result
+	return result
+}
diff --git a/v2/internals/pkginfo/modresolve_test.go b/v2/internals/pkginfo/modresolve_test.go
new file mode 100644
index 0000000000..d30196a7d6
--- /dev/null
+++ b/v2/internals/pkginfo/modresolve_test.go
@@ -0,0 +1,51 @@
+package pkginfo
+
+import (
+	"slices"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+
+	"encr.dev/pkg/paths"
+)
+
+func Test_findModule(t *testing.T) {
+	c := qt.New(t)
+	deps := []paths.Mod{
+		"foo",
+		"foo/bar",
+		"foo/bar/baz",
+		"foo/unrelated",
+		"encore.dev",
+	}
+	slices.Sort(deps)
+
+	yes := func(pkg paths.Pkg, mod paths.Mod) {
+		got, ok := findModule(deps, pkg)
+		c.Assert(ok, qt.IsTrue, qt.Commentf("pkg=%q", pkg))
+		c.Assert(got, qt.Equals, mod, qt.Commentf("pkg=%q", pkg))
+	}
+	no := func(pkg paths.Pkg, mod paths.Mod) {
+		_, ok := findModule(deps, pkg)
+		c.Assert(ok, qt.IsFalse, qt.Commentf("pkg=%q", pkg))
+	}
+
+	yes("foo", "foo")
+	yes("foo/qux", "foo")
+	yes("foo/barbar", "foo")
+
+	yes("foo/bar", "foo/bar")
+	yes("foo/bar/boo", "foo/bar")
+	yes("foo/bar/baz", "foo/bar/baz")
+	yes("foo/bar/baz/boo", "foo/bar/baz")
+	yes("foo/bar/baz/boo", "foo/bar/baz")
+	yes("encore.dev", "encore.dev")
+	yes("encore.dev/foo", "encore.dev")
+	yes("encore.dev/foo/bar", "encore.dev")
+
+	no("fo", "")
+	no("foono", "")
+	no("encore", "")
+	no("encore.devno", "")
+	no("x", "")
+}
diff --git a/v2/internals/pkginfo/names.go b/v2/internals/pkginfo/names.go
new file mode 100644
index 0000000000..56b32e7477
--- /dev/null
+++ b/v2/internals/pkginfo/names.go
@@ -0,0 +1,881 @@
+package pkginfo
+
+import (
+	"fmt"
+	"go/ast"
+	"go/build"
+	"go/token"
+	"path"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+
+	"github.com/agnivade/levenshtein"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/parsectx"
+)
+
+// resolvePkgNames resolves package-level names for the given package.
+func resolvePkgNames(pkg *Package) *PkgNames {
+	decls := make(map[string]*PkgDeclInfo)
+	scope := newScope(nil)
+
+	for _, f := range pkg.Files {
+		for _, d := range f.AST().Decls {
+			switch d := d.(type) {
+			case *ast.FuncDecl:
+				// HACK(andre) If the RPC was defined as a method on a service struct we
+				// generate a synthetic package-level func as part of the user-facing code generation.
+				// This happens after parsing, so at the parsing phase we ignore the user-facing code generation.
+				//
+				// To properly parse code that references those package-level funcs, register
+				// service struct-based APIs as existing with synthetic package-level identifiers.
+				isServiceStructAPI := d.Recv != nil && isEncoreAPI(d)
+
+				if d.Recv == nil || isServiceStructAPI {
+					scope.Insert(d.Name.Name, pkgObject)
+					decls[d.Name.Name] = &PkgDeclInfo{
+						Name: d.Name.Name,
+						File: f,
+						Pos:  d.Name.Pos(),
+						Doc:  d.Doc.Text(),
+						Type: token.FUNC,
+						Func: d,
+					}
+				}
+
+			case *ast.GenDecl:
+				for _, spec := range d.Specs {
+					var doc string
+					switch spec := spec.(type) {
+					case *ast.ValueSpec:
+						doc = spec.Doc.Text()
+						if doc == "" {
+							doc = spec.Comment.Text()
+						}
+					case *ast.TypeSpec:
+						doc = spec.Doc.Text()
+						if doc == "" {
+							doc = spec.Comment.Text()
+						}
+					}
+					if doc == "" && len(d.Specs) == 1 {
+						doc = d.Doc.Text()
+					}
+
+					switch spec := spec.(type) {
+					case *ast.ImportSpec:
+						// Skip, file-level
+					case *ast.ValueSpec:
+						for _, name := range spec.Names {
+							scope.Insert(name.Name, pkgObject)
+							decls[name.Name] = &PkgDeclInfo{
+								Name:    name.Name,
+								File:    f,
+								Pos:     name.Pos(),
+								Doc:     doc,
+								Type:    d.Tok,
+								Spec:    spec,
+								GenDecl: d,
+							}
+						}
+					case *ast.TypeSpec:
+						scope.Insert(spec.Name.Name, pkgObject)
+						decls[spec.Name.Name] = &PkgDeclInfo{
+							Name:    spec.Name.Name,
+							File:    f,
+							Pos:     spec.Name.Pos(),
+							Doc:     doc,
+							Type:    d.Tok,
+							GenDecl: d,
+							Spec:    spec,
+						}
+					}
+				}
+			}
+		}
+	}
+
+	return &PkgNames{
+		PkgDecls: decls,
+		pkgScope: scope,
+	}
+}
+
+// fileNameResolver resolves file-local names within a package.
+type fileNameResolver struct {
+	l   *Loader
+	f   *File
+	pkg *Package
+	tr  *parsectx.TraceLogger
+
+	// res is the resulting name information.
+	res *FileNames
+
+	// scope is the current scope being processed.
+	scope *scope
+}
+
+func resolveFileNames(f *File) *FileNames {
+	tr := f.l.c.Trace("pkgload.resolveFileNames", "pkg", f.Pkg.ImportPath, "file", f.Name)
+	defer tr.Done()
+	r := &fileNameResolver{
+		l:  f.l,
+		f:  f,
+		tr: tr,
+		res: &FileNames{
+			loader:           f.l,
+			file:             f,
+			idents:           make(map[*ast.Ident]identKind),
+			knownImportNames: make(map[string]*importedPkg),
+		},
+		scope: f.Pkg.Names().pkgScope,
+	}
+
+	r.processImports()
+	for _, decl := range f.AST().Decls {
+		switch decl := decl.(type) {
+		case *ast.GenDecl:
+			for _, spec := range decl.Specs {
+				switch spec := spec.(type) {
+				case *ast.ValueSpec:
+					for _, name := range spec.Names {
+						r.ident(name)
+					}
+					r.exprList(spec.Values)
+					r.expr(spec.Type)
+				case *ast.TypeSpec:
+					r.expr(spec.Type)
+					r.expr(spec.Type)
+				}
+			}
+
+		case *ast.FuncDecl:
+			r.funcDecl(decl)
+		}
+	}
+
+	return r.res
+}
+
+// processImports finds the file-local names of imports we care about.
+// The name mapping is stored in r.File.PathToName and r.File.NameToPath.
+func (r *fileNameResolver) processImports() {
+	for _, decl := range r.f.AST().Decls {
+		gd, ok := decl.(*ast.GenDecl)
+		if !ok || gd.Tok != token.IMPORT {
+			continue
+		}
+		for _, spec := range gd.Specs {
+			is := spec.(*ast.ImportSpec)
+			pos := is.Path.Pos()
+
+			strPath, err := strconv.Unquote(is.Path.Value)
+			if err != nil {
+				r.l.c.Errs.Addf(pos, "invalid import path %s", is.Path.Value)
+				continue
+			}
+
+			var dstPkgPath paths.Pkg
+			if build.IsLocalImport(strPath) {
+				dstPkgPath = r.pkg.ImportPath.JoinSlash(paths.RelSlash(strPath))
+			} else {
+				dstPkgPath, ok = paths.PkgPath(strPath)
+				if !ok {
+					r.l.c.Errs.Addf(pos, "invalid import path %q", strPath)
+					continue
+				}
+			}
+
+			// Do we have a local name?
+			localName := ""
+			if is.Name != nil {
+				if is.Name.Name == "." {
+					// TODO(andre) handle this
+					r.l.c.Errs.Fatalf(pos, "dot imports are currently unsupported by Encore's static analysis")
+					continue
+				}
+				localName = is.Name.Name
+			}
+
+			// Track this import as long as the local name is not "_".
+			if localName != "_" {
+				// localName is generally "" if the package was imported without
+				// giving it an explicit alias (like `import foo "path/to/foo"`).
+				// If that's the case, attempt to classify the package name.
+				if localName == "" {
+					localName = r.resolveKnownPkgName(dstPkgPath)
+				}
+
+				r.res.imports = append(r.res.imports, &importedPkg{
+					importPath:      dstPkgPath,
+					lastPathSegment: path.Base(dstPkgPath.String()),
+					localName:       localName,
+				})
+			}
+
+		}
+	}
+}
+
+// resolveKnownPkgName returns the known package name for the given import path, if any.
+// It uses the fact that the encore.dev module and the standard library guarantee
+// that the last path segment is the package name.
+//
+// If the name is not known it reports "".
+func (r *fileNameResolver) resolveKnownPkgName(pkgPath paths.Pkg) (name string) {
+	stdlib := paths.StdlibMod()
+	encoreRuntime := r.l.runtimeModule.Path
+	if stdlib.LexicallyContains(pkgPath) || encoreRuntime.LexicallyContains(pkgPath) {
+		return path.Base(pkgPath.String())
+	}
+	return ""
+}
+
+func (r *fileNameResolver) funcDecl(fd *ast.FuncDecl) {
+	r.openScope()
+	defer r.closeScope()
+
+	// First resolve types before introducing names
+	for _, param := range fd.Type.Params.List {
+		r.expr(param.Type)
+	}
+	if fd.Type.Results != nil {
+		for _, result := range fd.Type.Results.List {
+			r.expr(result.Type)
+		}
+	}
+
+	if fd.Recv != nil {
+		for _, field := range fd.Recv.List {
+			for _, name := range field.Names {
+				r.scope.Insert(name.Name, localObject)
+			}
+		}
+	}
+	for _, field := range fd.Type.Params.List {
+		for _, name := range field.Names {
+			r.scope.Insert(name.Name, localObject)
+		}
+	}
+	if fd.Type.Results != nil {
+		for _, field := range fd.Type.Results.List {
+			for _, name := range field.Names {
+				r.scope.Insert(name.Name, localObject)
+			}
+		}
+	}
+	if fd.Body != nil {
+		r.stmtList(fd.Body.List)
+	}
+}
+
+func (r *fileNameResolver) stmt(stmt ast.Stmt) {
+	if stmt == nil {
+		return
+	}
+
+	switch stmt := stmt.(type) {
+	case *ast.AssignStmt:
+		r.exprList(stmt.Rhs)
+		for _, lhs := range stmt.Lhs {
+			if id, ok := lhs.(*ast.Ident); ok && stmt.Tok == token.DEFINE {
+				r.define(id, localObject)
+			}
+		}
+
+	case *ast.BlockStmt:
+		r.openScope()
+		defer r.closeScope()
+		r.stmtList(stmt.List)
+
+	case *ast.DeclStmt:
+		decl := stmt.Decl.(*ast.GenDecl)
+		for _, spec := range decl.Specs {
+			switch spec := spec.(type) {
+			case *ast.ValueSpec:
+				r.exprList(spec.Values)
+				r.expr(spec.Type)
+				for _, name := range spec.Names {
+					r.define(name, localObject)
+				}
+			case *ast.TypeSpec:
+				r.expr(spec.Type)
+				r.define(spec.Name, localObject)
+			}
+		}
+
+	case *ast.DeferStmt:
+		r.expr(stmt.Call)
+
+	case *ast.ExprStmt:
+		r.expr(stmt.X)
+
+	case *ast.ForStmt:
+		r.openScope()
+		defer r.closeScope()
+		r.stmt(stmt.Init)
+		r.expr(stmt.Cond)
+		r.stmt(stmt.Post)
+		r.stmt(stmt.Body)
+
+	case *ast.GoStmt:
+		r.expr(stmt.Call)
+
+	case *ast.IfStmt:
+		r.openScope()
+		defer r.closeScope()
+		r.stmt(stmt.Init)
+		r.expr(stmt.Cond)
+		r.stmt(stmt.Body)
+		r.stmt(stmt.Else)
+
+	case *ast.IncDecStmt:
+		r.expr(stmt.X)
+
+	case *ast.LabeledStmt:
+		r.stmt(stmt.Stmt)
+
+	case *ast.RangeStmt:
+		r.openScope()
+		defer r.closeScope()
+		r.expr(stmt.X)
+		r.expr(stmt.Key)
+		r.expr(stmt.Value)
+		r.stmt(stmt.Body)
+
+	case *ast.ReturnStmt:
+		r.exprList(stmt.Results)
+
+	case *ast.SelectStmt:
+		r.stmtList(stmt.Body.List)
+
+	case *ast.SendStmt:
+		r.expr(stmt.Value)
+		r.expr(stmt.Chan)
+
+	case *ast.SwitchStmt:
+		r.openScope()
+		defer r.closeScope()
+		r.stmt(stmt.Init)
+		r.expr(stmt.Tag)
+		r.stmt(stmt.Body)
+
+	case *ast.TypeSwitchStmt:
+		r.openScope()
+		defer r.closeScope()
+		r.stmt(stmt.Init)
+		r.stmt(stmt.Assign)
+		r.stmt(stmt.Body)
+
+	case *ast.CommClause:
+		r.openScope()
+		defer r.closeScope()
+		r.stmt(stmt.Comm)
+		r.stmtList(stmt.Body)
+
+	case *ast.CaseClause:
+		r.exprList(stmt.List)
+		r.openScope()
+		defer r.closeScope()
+		r.stmtList(stmt.Body)
+
+	case *ast.BadStmt, *ast.BranchStmt, *ast.EmptyStmt:
+		// do nothing
+
+	default:
+		panic(fmt.Sprintf("unhandled ast.Stmt type: %T", stmt))
+	}
+}
+
+func (r *fileNameResolver) expr(expr ast.Expr) {
+	switch expr := expr.(type) {
+	case nil:
+		// do nothing
+
+	case *ast.Ident:
+		r.ident(expr)
+
+	case *ast.Ellipsis:
+		r.expr(expr.Elt)
+
+	case *ast.FuncLit:
+		r.openScope()
+		defer r.closeScope()
+
+		// First resolve types before introducing names
+		for _, param := range expr.Type.Params.List {
+			r.expr(param.Type)
+		}
+		if expr.Type.Results != nil {
+			for _, result := range expr.Type.Results.List {
+				r.expr(result.Type)
+			}
+		}
+
+		for _, field := range expr.Type.Params.List {
+			for _, name := range field.Names {
+				r.define(name, localObject)
+			}
+		}
+		if expr.Type.Results != nil {
+			for _, field := range expr.Type.Results.List {
+				for _, name := range field.Names {
+					r.define(name, localObject)
+				}
+			}
+		}
+		if expr.Body != nil {
+			r.stmt(expr.Body)
+		}
+
+	case *ast.CompositeLit:
+		r.expr(expr.Type)
+		r.exprList(expr.Elts)
+
+	case *ast.ParenExpr:
+		r.expr(expr.X)
+
+	case *ast.SelectorExpr:
+		r.expr(expr.X)
+		// Note: we don't treat 'Foo' in 'x.Foo' as an identifier,
+		// as it does not introduce a new name to any scope.
+
+	case *ast.IndexExpr:
+		r.expr(expr.X)
+		r.expr(expr.Index)
+
+	case *ast.IndexListExpr:
+		// An IndexListExpr node represents an expression followed by multiple indices.
+		// e.g. `X[A, B, C]` or `X[1, 2]`
+		r.expr(expr.X)
+		for _, index := range expr.Indices {
+			r.expr(index)
+		}
+
+	case *ast.SliceExpr:
+		r.expr(expr.X)
+		r.expr(expr.Low)
+		r.expr(expr.High)
+		r.expr(expr.Max)
+
+	case *ast.TypeAssertExpr:
+		r.expr(expr.X)
+		r.expr(expr.Type)
+
+	case *ast.CallExpr:
+		r.expr(expr.Fun)
+		r.exprList(expr.Args)
+
+	case *ast.StarExpr:
+		r.expr(expr.X)
+
+	case *ast.UnaryExpr:
+		r.expr(expr.X)
+
+	case *ast.BinaryExpr:
+		r.expr(expr.X)
+		r.expr(expr.Y)
+
+	case *ast.KeyValueExpr:
+		// HACK: We want to track uses of functions. This is tricky because
+		// struct types use keys that are idents that refer to the struct field,
+		// while map types can use keys to refer to idents in scope.
+		//
+		// Unfortunately We cannot easily know the type of the composite literal
+		// without typechecking. However, funcs are incomparable and therefore
+		// are not valid as map keys. So let's simply avoid tracking idents
+		// in the keys, and rely on the compiler to eventually catch this for us.
+		if _, ok := expr.Key.(*ast.Ident); !ok {
+			r.expr(expr.Key)
+		}
+		r.expr(expr.Value)
+
+	case *ast.ArrayType:
+		r.expr(expr.Len)
+		r.expr(expr.Elt)
+
+	case *ast.StructType:
+		for _, field := range expr.Fields.List {
+			r.expr(field.Type)
+			// Don't look at names; they don't resolve to outside scope
+		}
+
+	case *ast.FuncType:
+		for _, field := range expr.Params.List {
+			r.expr(field.Type)
+			// Don't look at names; they don't resolve to outside scope
+		}
+		if expr.Results != nil {
+			for _, field := range expr.Results.List {
+				r.expr(field.Type)
+				// Don't look at names; they don't resolve to outside scope
+			}
+		}
+
+	case *ast.InterfaceType:
+		for _, field := range expr.Methods.List {
+			r.expr(field.Type)
+			// Don't look at names; they don't resolve to outside scope
+		}
+
+	case *ast.MapType:
+		r.expr(expr.Key)
+		r.expr(expr.Value)
+
+	case *ast.ChanType:
+		r.expr(expr.Value)
+
+	case *ast.BadExpr, *ast.BasicLit:
+		// do nothing
+
+	default:
+		// If we don't process this then return false
+		panic(fmt.Sprintf("unhandled ast.Expr type: %T", expr))
+	}
+}
+
+func (r *fileNameResolver) stmtList(stmts []ast.Stmt) {
+	for _, s := range stmts {
+		r.stmt(s)
+	}
+}
+
+func (r *fileNameResolver) exprList(exprs []ast.Expr) {
+	for _, x := range exprs {
+		r.expr(x)
+	}
+}
+
+func (r *fileNameResolver) ident(id *ast.Ident) {
+	// Map this ident. If the name is already in scope, use that definition.
+	// Otherwise check if it's an imported name.
+	if kind := r.scope.LookupParent(id.Name); kind != none {
+		r.res.idents[id] = kind
+	} else {
+		r.res.idents[id] = importName
+	}
+}
+
+func (r *fileNameResolver) define(id *ast.Ident, kind identKind) {
+	r.res.idents[id] = kind
+	r.scope.Insert(id.Name, kind)
+}
+
+func (r *fileNameResolver) openScope() {
+	r.scope = newScope(r.scope)
+}
+
+func (r *fileNameResolver) closeScope() {
+	r.scope = r.scope.Pop()
+}
+
+func isEncoreAPI(fd *ast.FuncDecl) bool {
+	fd.Doc.Text()
+	if fd.Doc == nil {
+		return false
+	}
+
+	const directive = "encore:api"
+	for _, c := range fd.Doc.List {
+		if strings.HasPrefix(c.Text, "//"+directive) {
+			return true
+		}
+	}
+
+	// Legacy syntax
+	lines := strings.Split(fd.Doc.Text(), "\n")
+	for _, line := range lines {
+		if strings.HasPrefix(line, directive) {
+			return true
+		}
+	}
+
+	return false
+}
+
+// PkgDeclInfo provides metadata for a package-level declaration.
+type PkgDeclInfo struct {
+	Name string
+	File *File
+	Pos  token.Pos
+	Doc  string
+
+	// Type describes what type of declaration this is.
+	// It's one of CONST, TYPE, VAR, or FUNC.
+	Type token.Token
+
+	// Spec is the spec for this declaration and GenDecl the declaration block
+	// it belongs to. They are set only when Type != FUNC.
+	Spec    ast.Spec
+	GenDecl *ast.GenDecl
+
+	// Func is the function declaration, if Type == FUNC.
+	Func *ast.FuncDecl // for Type == FUNC
+	// Recv is the receiver type, if Type == FUNC and the function is a method.
+	Recv *PkgDeclInfo
+}
+
+func (i *PkgDeclInfo) QualifiedName() QualifiedName {
+	return Q(i.File.Pkg.ImportPath, i.Name)
+}
+
+// PkgNames contains name information that's package-global.
+type PkgNames struct {
+	// PkgDecls contains package-level declarations, keyed by name.
+	PkgDecls map[string]*PkgDeclInfo
+
+	// Funcs are all the func declarations.
+	Funcs []*PkgDeclInfo
+
+	// pkgScope tracks the scope information for the package scope.
+	// It's stored to avoid having to recompute it when querying
+	// for individual files' file-level name information.
+	pkgScope *scope
+}
+
+func (n *PkgNames) FuncDecl(name string) option.Option[*ast.FuncDecl] {
+	if fn, ok := n.PkgDecls[name]; ok && fn.Type == token.FUNC {
+		return option.Some(fn.Func)
+	}
+	return option.None[*ast.FuncDecl]()
+}
+
+func (n *PkgNames) GoString() string {
+	return "&pkginfo.PkgNames{...}"
+}
+
+// FileNames contains name resolution results for a single file.
+type FileNames struct {
+	loader *Loader // the loader this file comes from
+
+	// file is the file the names belong to.
+	file *File
+
+	// idents maps identifiers in the file to information about them.
+	idents map[*ast.Ident]identKind
+
+	imports []*importedPkg
+
+	// knownImportNames tracks the resolved import names for this file.
+	knownImportNamesMu sync.Mutex
+	knownImportNames   map[string]*importedPkg
+
+	//// localNameToPkg maps local names to the package they refer to.
+	//localNameToPkg map[string]*importedPkg
+	//
+	//
+	//// nameToPath contains resolved local name -> import
+	//nameToPath map[string]paths.Pkg // local name -> path
+}
+
+func (n *FileNames) GoString() string {
+	return "&pkginfo.FileNames{...}"
+}
+
+// ResolvePkgPath resolves the package path a given identifier name
+// resolves to.
+func (f *FileNames) ResolvePkgPath(cause token.Pos, name string) (pkgPath paths.Pkg, ok bool) {
+	return f.resolveImportPath(cause, name)
+}
+
+// ResolvePkgLevelRef resolves the node to the package-level reference it refers to.
+// Expr must be either *ast.Ident or *ast.SelectorExpr.
+// If it doesn't refer to a package-level reference it returns ok == false.
+func (f *FileNames) ResolvePkgLevelRef(expr ast.Expr) (name QualifiedName, ok bool) {
+	// Unwrap type arguments
+	switch x := expr.(type) {
+	case *ast.IndexExpr:
+		expr = x.X
+	case *ast.IndexListExpr:
+		expr = x.X
+	}
+
+	// Resolve the identifier
+	switch node := expr.(type) {
+	case *ast.Ident:
+		// If it's an ident, then we're looking for something which resolves to a package-level object defined
+		// in the same package as the ident is located in.
+		if f.idents[node] == pkgObject {
+			return QualifiedName{f.file.Pkg.ImportPath, node.Name}, true
+		}
+	case *ast.SelectorExpr:
+		// If it's a selector, then we're looking for something which has been imported from another package
+		if pkgName, ok := node.X.(*ast.Ident); ok {
+			if f.idents[pkgName] == importName {
+				if importPath, ok := f.resolveImportPath(expr.Pos(), pkgName.Name); ok {
+					return QualifiedName{importPath, node.Sel.Name}, true
+				}
+			}
+		}
+	}
+
+	return QualifiedName{}, false
+}
+
+func (f *FileNames) resolveImportPath(cause token.Pos, identName string) (pkgPath paths.Pkg, ok bool) {
+	// Do we already have this name resolved?
+	f.knownImportNamesMu.Lock()
+	pkg := f.knownImportNames[identName]
+	f.knownImportNamesMu.Unlock()
+	if pkg != nil {
+		return pkg.importPath, true
+	}
+
+	// Otherwise, resolve it. We do this by looking at the imported packages
+	// and determine which one is most likely to be the one we're looking for.
+
+	resolvePkg := func() *importedPkg {
+		// First look for an explicit import alias.
+		for _, pkg := range f.imports {
+			if pkg.localName == identName {
+				return pkg
+			}
+		}
+
+		// Use heuristics to guess the package.
+
+		// Bucket the packages into a group of exact matches
+		// and everything else.
+		var (
+			exactMatches []*importedPkg
+			otherPkgs    = make([]*importedPkg, 0, len(f.imports))
+		)
+		for _, pkg := range f.imports {
+			// If there is an explicit local name, ignore the package
+			// since we've already checked those above.
+			if pkg.localName != "" {
+				continue
+			}
+
+			if pkg.lastPathSegment == identName {
+				exactMatches = append(exactMatches, pkg)
+			} else {
+				otherPkgs = append(otherPkgs, pkg)
+			}
+		}
+
+		processGroup := func(pkgs []*importedPkg) *importedPkg {
+			for _, pkg := range pkgs {
+				// Load the package to determine if it has the name we're looking for.
+				pkg.loadOnce.Do(func() {
+					pkg.loadedPkg = f.loader.MustLoadPkg(cause, pkg.importPath)
+				})
+
+				if pkg.loadedPkg.Name == identName {
+					// We've found the package we're looking for.
+					return pkg
+				}
+			}
+			return nil
+		}
+
+		// Check the exact matches first.
+		if pkg := processGroup(exactMatches); pkg != nil {
+			return pkg
+		}
+
+		// If not, check the remaining packages. Sort them
+		// by levenshtein distance to start with the likeliest
+		// candidates first.
+		distances := fns.Map(otherPkgs, func(pkg *importedPkg) int {
+			return levenshtein.ComputeDistance(pkg.lastPathSegment, identName)
+		})
+		sort.Slice(otherPkgs, func(i, j int) bool {
+			return distances[i] < distances[j]
+		})
+		return processGroup(otherPkgs)
+	}
+
+	if pkg := resolvePkg(); pkg != nil {
+		f.knownImportNamesMu.Lock()
+		f.knownImportNames[identName] = pkg
+		f.knownImportNamesMu.Unlock()
+		return pkg.importPath, true
+	}
+
+	return "", false
+}
+
+type identKind string
+
+const (
+	// none is a none identKind.
+	none identKind = ""
+
+	// pkgObject is used for identifiers pointing to package-level
+	// objects in the same package as the identifier.
+	pkgObject identKind = "pkgObject"
+
+	// localObject is used for identifiers pointing to
+	// function-local objects.
+	localObject identKind = "localObject"
+
+	// importName is used for identifiers pointing to
+	// an imported package.
+	importName identKind = "importName"
+)
+
+// importedPkg represents a package that has been imported
+// in a file.
+//
+// Since the local name is the package name, which can
+// be different from the last element of the import path, we
+// can't know for sure which package it refers to until
+// we've parsed that package.
+type importedPkg struct {
+	importPath paths.Pkg
+
+	// lastPathSegment is the last segment of the import path.
+	// It's used as a heuristic to guess which package to
+	// parse first.
+	lastPathSegment string
+
+	// localName is the name of the package in the file.
+	localName string
+
+	// loadedPkg is the loaded package, if any.
+	// It must be accessed using the sync.Once.
+	loadOnce  sync.Once
+	loadedPkg *Package
+}
+
+// scope maps names to information about them.
+type scope struct {
+	names  map[string]identKind
+	parent *scope
+}
+
+func newScope(parent *scope) *scope {
+	return &scope{
+		names:  make(map[string]identKind),
+		parent: parent,
+	}
+}
+
+func (s *scope) Pop() *scope {
+	return s.parent
+}
+
+func (s *scope) Insert(name string, kind identKind) {
+	if name != "_" {
+		s.names[name] = kind
+	}
+}
+
+func (s *scope) Lookup(name string) identKind {
+	return s.names[name]
+}
+
+func (s *scope) LookupParent(name string) identKind {
+	if kind := s.names[name]; kind != none {
+		return kind
+	} else if s.parent != nil {
+		return s.parent.LookupParent(name)
+	}
+	return none
+}
diff --git a/v2/internals/pkginfo/names_test.go b/v2/internals/pkginfo/names_test.go
new file mode 100644
index 0000000000..ad20a00748
--- /dev/null
+++ b/v2/internals/pkginfo/names_test.go
@@ -0,0 +1,97 @@
+package pkginfo_test
+
+import (
+	"go/token"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp/cmpopts"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/testutil"
+)
+
+func TestNames(t *testing.T) {
+	t.Run("empty_pkg", func(t *testing.T) {
+		c := qt.New(t)
+		a := parse(`
+-- foo/foo.go --
+// Package doc
+package pkgname // main file
+-- go.mod --
+module example.com
+`)
+
+		tc := testutil.NewContext(c, false, a)
+		tc.FailTestOnErrors()
+		l := pkginfo.New(tc.Context)
+
+		pkg := l.MustLoadPkg(token.NoPos, "example.com/foo")
+		c.Assert(pkg.Names().PkgDecls, qt.HasLen, 0)
+	})
+
+	t.Run("external_module", func(t *testing.T) {
+		c := qt.New(t)
+		a := parse(`
+-- go.mod --
+module example.com
+require rsc.io/quote v1.5.2
+-- foo/foo.go --
+package foo
+import "rsc.io/quote"
+var _ = quote.Hello()
+`)
+		tc := testutil.NewContext(c, false, a)
+		defer tc.FailTestOnBailout()
+		tc.GoModTidy()
+
+		l := pkginfo.New(tc.Context)
+		pkg := l.MustLoadPkg(token.NoPos, "rsc.io/quote")
+
+		c.Assert(pkg.Names().PkgDecls, qt.CmpEquals(
+			cmpopts.IgnoreFields(pkginfo.PkgDeclInfo{}, "File", "Func", "Pos", "GenDecl", "Spec", "Doc"),
+		), map[string]*pkginfo.PkgDeclInfo{
+			"Glass": {Name: "Glass", Type: token.FUNC},
+			"Go":    {Name: "Go", Type: token.FUNC},
+			"Hello": {Name: "Hello", Type: token.FUNC},
+			"Opt":   {Name: "Opt", Type: token.FUNC},
+		})
+
+		gotPath, ok := pkg.Files[0].Names().ResolvePkgPath(token.NoPos, "sampler")
+		c.Assert(ok, qt.IsTrue)
+		c.Assert(gotPath, qt.Equals, paths.Pkg("rsc.io/sampler"))
+	})
+
+	t.Run("external_module_major_version", func(t *testing.T) {
+		c := qt.New(t)
+		a := parse(`
+-- go.mod --
+module example.com
+require rsc.io/quote v1.5.3-0.20180710144737-5d9f230bcfba
+-- foo/foo.go --
+package foo
+import "rsc.io/quote"
+var _ = quote.HelloV3()
+`)
+		tc := testutil.NewContext(c, false, a)
+		defer tc.FailTestOnBailout()
+		tc.GoModTidy()
+
+		l := pkginfo.New(tc.Context)
+		pkg := l.MustLoadPkg(token.NoPos, "rsc.io/quote/v3")
+
+		c.Assert(pkg.Names().PkgDecls, qt.CmpEquals(
+			cmpopts.IgnoreFields(pkginfo.PkgDeclInfo{}, "File", "Func", "Pos", "GenDecl", "Spec", "Doc"),
+		), map[string]*pkginfo.PkgDeclInfo{
+			"HelloV3": {Name: "HelloV3", Type: token.FUNC},
+			"GlassV3": {Name: "GlassV3", Type: token.FUNC},
+			"GoV3":    {Name: "GoV3", Type: token.FUNC},
+			"OptV3":   {Name: "OptV3", Type: token.FUNC},
+		})
+
+		gotPath, ok := pkg.Files[0].Names().ResolvePkgPath(token.NoPos, "sampler")
+		c.Assert(ok, qt.IsTrue)
+		c.Assert(gotPath, qt.Equals, paths.Pkg("rsc.io/sampler"))
+	})
+}
diff --git a/v2/internals/pkginfo/pkgparse.go b/v2/internals/pkginfo/pkgparse.go
new file mode 100644
index 0000000000..3e4a2b2fd2
--- /dev/null
+++ b/v2/internals/pkginfo/pkgparse.go
@@ -0,0 +1,211 @@
+package pkginfo
+
+import (
+	"cmp"
+	"fmt"
+	"go/ast"
+	goparser "go/parser"
+	"go/token"
+	"io/fs"
+	"path/filepath"
+	"slices"
+	"strconv"
+	"strings"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/paths"
+)
+
+// File pkgparse implements parsing of packages.
+
+// parseResult is the result from attempting to parse a package.
+type parseResult struct {
+	done    chan struct{} // closed when parsing is completed
+	pkg     *Package
+	ok      bool
+	bailout bool
+}
+
+// loadPkgSpec is the specification for how to load a package.
+type loadPkgSpec struct {
+	// cause is the source position that caused the load.
+	// It's used to generate useful error messages.
+	cause token.Pos
+
+	// path is the package path.
+	path paths.Pkg
+
+	// dir is the directory containing the package.
+	dir paths.FS
+}
+
+// doParsePkg parses a single package in the given directory.
+// It returns (nil, false) if the directory contains no Go files.
+func (l *Loader) doParsePkg(s loadPkgSpec) (pkg *Package, ok bool) {
+	l.c.Errs.BailoutOnErrors(func() {
+		astPkgs, files := l.parseAST(s)
+		pkg = l.processPkg(s, astPkgs, files)
+	})
+	return pkg, pkg != nil
+}
+
+// processPkg combines the results of parsing a package into a single *Package.
+func (l *Loader) processPkg(s loadPkgSpec, pkgs []*ast.Package, files []*File) *Package {
+	if n := len(pkgs); n > 1 {
+		// Make sure the extra packages are just "_test" packages.
+		// Pull out the package names.
+
+		slices.SortFunc(pkgs, func(a, b *ast.Package) int {
+			return cmp.Compare(a.Name, b.Name)
+		})
+		pkgNames := fns.Map(pkgs, func(pkg *ast.Package) string { return pkg.Name })
+		if n == 2 && pkgNames[1] == pkgNames[0]+"_test" {
+			// We're good
+		} else {
+			names := strings.Join(pkgNames[:n-1], ", ") + " and " + pkgNames[n-1]
+			l.c.Errs.Addf(s.cause, fmt.Sprintf("found multiple package names in package %s: %s", s.path, names))
+		}
+	} else if n == 0 {
+		// No Go files; ignore directory
+		return nil
+	}
+
+	p := pkgs[0]
+	pkg := &Package{
+		AST:        p,
+		Name:       p.Name,
+		ImportPath: s.path,
+		FSPath:     s.dir,
+		Files:      files,
+		Imports:    make(map[paths.Pkg]ast.Node),
+	}
+
+	for _, f := range files {
+		f.Pkg = pkg
+		// Fill in imports.
+		for importPath, pointer := range f.Imports {
+			pkg.Imports[importPath] = pointer
+		}
+
+		// Fill in package docs.
+		if pkg.Doc == "" && !f.TestFile && f.initialAST.Doc != nil {
+			pkg.Doc = f.initialAST.Doc.Text()
+		}
+	}
+
+	return pkg
+}
+
+// parseAST is like go/parser.ParseDir but it constructs *File objects instead.
+func (l *Loader) parseAST(s loadPkgSpec) ([]*ast.Package, []*File) {
+	dir := s.dir.ToIO()
+	entries, err := l.c.ReadDir(dir)
+	if err != nil {
+		l.c.Errs.Addf(s.cause, "parse package %q: %v", s.path, err)
+		return nil, nil
+	}
+	shouldParseFile := func(info fs.DirEntry) bool {
+		name := info.Name()
+		switch {
+		// Don't parse encore.gen.go files, since they're not intended to be checked in.
+		// We've had several issues where things work locally but not in CI/CD because
+		// the encore.gen.go file was parsed for local development which papered over issues.
+		case strings.Contains(name, "encore.gen.go"):
+			return false
+		case !l.c.ParseTests && strings.HasSuffix(name, "_test.go"):
+			return false
+		case !strings.HasSuffix(name, ".go"):
+			return false
+		default:
+			return true
+		}
+	}
+
+	type fileInfo struct {
+		path     paths.FS
+		ioPath   string
+		baseName string
+	}
+
+	infos := make([]fileInfo, 0, len(entries))
+	for _, e := range entries {
+		if !e.IsDir() && shouldParseFile(e) {
+			baseName := e.Name()
+			ioPath := filepath.Join(dir, baseName)
+			path := s.dir.Join(baseName)
+			infos = append(infos, fileInfo{path: path, ioPath: ioPath, baseName: baseName})
+		}
+	}
+
+	var pkgs []*ast.Package
+	var files []*File
+	seenPkgs := make(map[string]*ast.Package) // package name -> pkg
+
+	for _, d := range infos {
+		// Check if this file should be part of the build
+		matched, err := l.buildCtx.MatchFile(dir, d.baseName)
+		if err != nil {
+			l.c.Errs.Add(errMatchingFile.InFile(d.ioPath).Wrapping(err))
+			continue
+		} else if !matched {
+			continue
+		} else if strings.EqualFold(d.baseName, "encore.gen.go") {
+			continue
+		}
+
+		reader, err := l.c.OpenFile(d.ioPath)
+		if err != nil {
+			l.c.Errs.Add(errReadingFile.InFile(d.ioPath).Wrapping(err))
+			continue
+		}
+
+		// Parse the package and imports only so code can consult that.
+		// We parse the full AST on-demand later.
+		mode := goparser.ParseComments | goparser.ImportsOnly
+		astFile, err := goparser.ParseFile(l.c.FS, d.ioPath, reader, mode)
+		_ = reader.Close()
+		if err != nil {
+			l.c.Errs.AddStd(err)
+			continue
+		}
+
+		pkgName := astFile.Name.Name
+		pkg, found := seenPkgs[pkgName]
+		if !found {
+			pkg = &ast.Package{
+				Name:  pkgName,
+				Files: make(map[string]*ast.File),
+			}
+			seenPkgs[pkgName] = pkg
+			pkgs = append(pkgs, pkg)
+		}
+
+		pkg.Files[d.ioPath] = astFile
+
+		isTestFile := strings.HasSuffix(d.baseName, "_test.go") || strings.HasSuffix(pkgName, "_test")
+		files = append(files, &File{
+			l:        l,
+			Name:     d.baseName,
+			FSPath:   d.path,
+			Pkg:      nil, // will be set later
+			Imports:  getFileImports(astFile),
+			TestFile: isTestFile,
+
+			initialAST: astFile,
+		})
+	}
+
+	return pkgs, files
+}
+
+func getFileImports(f *ast.File) map[paths.Pkg]ast.Node {
+	imports := make(map[paths.Pkg]ast.Node)
+	for _, s := range f.Imports {
+		if importPath, err := strconv.Unquote(s.Path.Value); err == nil {
+			if p, ok := paths.PkgPath(importPath); ok {
+				imports[p] = s
+			}
+		}
+	}
+	return imports
+}
diff --git a/v2/internals/pkginfo/types.go b/v2/internals/pkginfo/types.go
new file mode 100644
index 0000000000..c563dfeb70
--- /dev/null
+++ b/v2/internals/pkginfo/types.go
@@ -0,0 +1,184 @@
+package pkginfo
+
+import (
+	"fmt"
+	"go/ast"
+	goparser "go/parser"
+	"go/token"
+	"path"
+	"sync"
+
+	"golang.org/x/mod/modfile"
+	"golang.org/x/tools/go/ast/inspector"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+)
+
+// Module describes a Go module.
+type Module struct {
+	l *Loader // the loader that created it.
+
+	RootDir paths.FS  // the dir containing go.mod
+	Path    paths.Mod // module path
+	Version string    // module version
+
+	// file is the parsed modfile.
+	// It's None if the module predates Go Modules.
+	file option.Option[*modfile.File]
+
+	// sortedNestedDeps and sortedOtherDeps contain lists of
+	// this module's dependencies, categorized into nested dependencies
+	// (with module paths rooted within this module) and other dependencies (the rest).
+	//
+	// The lists are sorted to facilitate efficient lookups
+	// to determine the right module to query for a given import path.
+	sortedNestedDeps []paths.Mod
+	sortedOtherDeps  []paths.Mod
+}
+
+// FSPathToPkg computes the filesystem path to the given package.
+// The package must lexically live within the given module,
+// otherwise it reports ok == false.
+func (m *Module) FSPathToPkg(pkgPath paths.Pkg) (path paths.FS, ok bool) {
+	if rel, ok := m.Path.RelativePathToPkg(pkgPath); ok {
+		return m.RootDir.Join(rel.ToIO()), true
+	}
+
+	return "", false
+}
+
+type Package struct {
+	l          *Loader // the loader that created it.
+	AST        *ast.Package
+	Name       string
+	Doc        string
+	ImportPath paths.Pkg
+	FSPath     paths.FS
+	Files      []*File
+	Imports    map[paths.Pkg]ast.Node // union of all imports from files
+
+	namesOnce  sync.Once
+	namesCache *PkgNames
+}
+
+func (p *Package) GoString() string {
+	return fmt.Sprintf("&pkginfo.Package{ImportPath: %q, Name: %q}", p.ImportPath, p.Name)
+}
+
+// Names returns the computed package-level names.
+func (p *Package) Names() *PkgNames {
+	p.namesOnce.Do(func() {
+		p.namesCache = resolvePkgNames(p)
+	})
+	return p.namesCache
+}
+
+type File struct {
+	l        *Loader                // the loader that created it.
+	Name     string                 // file name ("foo.go")
+	Pkg      *Package               // package it belongs to
+	FSPath   paths.FS               // where the file lives on disk
+	Imports  map[paths.Pkg]ast.Node // imports in the file, keyed by import path pointed at the import spec
+	TestFile bool                   // whether the file is a test file
+
+	// initialAST is the AST for the initial parse that only includes
+	// package docs and imports.
+	initialAST *ast.File
+
+	// Filled in lazily; each one guarded by a sync.Once.
+	astCacheOnce sync.Once
+	cachedAST    *ast.File
+	cachedToken  *token.File
+
+	contentsOnce   sync.Once
+	cachedContents []byte
+
+	namesOnce  sync.Once
+	namesCache *FileNames
+
+	inspectorOnce  sync.Once
+	inspectorCache *inspector.Inspector
+}
+
+func (f *File) GoString() string {
+	if f == nil {
+		return "(*pkginfo.File)(nil)"
+	}
+
+	pkgPath := "(UNKNOWN)"
+	if f.Pkg != nil {
+		pkgPath = f.Pkg.ImportPath.String()
+	}
+	return fmt.Sprintf("&pkginfo.File{Pkg: %q, Name: %q}", pkgPath, f.Name)
+}
+
+// Names returns the computed file-level names.
+func (f *File) Names() *FileNames {
+	f.namesOnce.Do(func() {
+		f.namesCache = resolveFileNames(f)
+	})
+	return f.namesCache
+}
+
+// Contents returns the full file contents.
+func (f *File) Contents() []byte {
+	f.contentsOnce.Do(func() {
+		ioPath := f.FSPath.ToIO()
+		data, err := f.l.c.ReadFile(ioPath)
+		if err != nil {
+			f.l.c.Errs.Assert(errReadingFile.InFile(ioPath).Wrapping(err))
+		}
+		f.cachedContents = data
+	})
+	return f.cachedContents
+}
+
+// AST returns the parsed AST for this file.
+func (f *File) AST() *ast.File {
+	f.astCacheOnce.Do(func() {
+		astFile, err := goparser.ParseFile(f.l.c.FS, f.FSPath.ToIO(), f.Contents(), goparser.ParseComments)
+		f.l.c.Errs.AssertStd(err)
+		f.cachedAST = astFile
+		f.cachedToken = f.l.c.FS.File(astFile.Pos())
+	})
+	return f.cachedAST
+}
+
+func (f *File) Token() *token.File {
+	// Ensure f.cachedToken is set.
+	_ = f.AST()
+
+	return f.cachedToken
+}
+
+// ASTInspector returns an AST inspector that's optimized for finding
+// nodes of particular types. See [inspector.Inspector] for more information.
+func (f *File) ASTInspector() *inspector.Inspector {
+	f.inspectorOnce.Do(func() {
+		tr := f.l.c.Trace("ASTInspector", "pkg", f.Pkg.ImportPath, "file", f.Name)
+		defer tr.Done()
+
+		f.inspectorCache = inspector.New([]*ast.File{f.AST()})
+	})
+
+	return f.inspectorCache
+}
+
+// A QualifiedName is the combination of a package path and a package-level name.
+// It can be used to uniquely reference a package-level declaration.
+type QualifiedName struct {
+	PkgPath paths.Pkg
+	Name    string
+}
+
+// NaiveDisplayName returns the name as "pkgname.Name" by assuming
+// the package name is equal to the last path component.
+func (q QualifiedName) NaiveDisplayName() string {
+	return path.Base(string(q.PkgPath)) + "." + q.Name
+}
+
+// Q is a helper function to construct a QualifiedName.
+func Q(pkgPath paths.Pkg, name string) QualifiedName {
+	return QualifiedName{PkgPath: pkgPath, Name: name}
+}
diff --git a/v2/internals/posmap/posmap.go b/v2/internals/posmap/posmap.go
new file mode 100644
index 0000000000..5b08b35dc9
--- /dev/null
+++ b/v2/internals/posmap/posmap.go
@@ -0,0 +1,77 @@
+package posmap
+
+import (
+	"go/ast"
+	"sort"
+
+	"encr.dev/pkg/option"
+)
+
+func Build[NodeLike ast.Node](nodes ...NodeLike) Map[NodeLike] {
+	return (&Builder[NodeLike]{}).Add(nodes...).Build()
+}
+
+type Builder[NodeLike ast.Node] struct {
+	nodes []NodeLike
+}
+
+func (b *Builder[NodeLike]) Add(nodes ...NodeLike) *Builder[NodeLike] {
+	b.nodes = append(b.nodes, nodes...)
+	return b
+}
+
+func (b *Builder[NodeLike]) Build() Map[NodeLike] {
+	sort.Slice(b.nodes, func(i, j int) bool {
+		return b.nodes[i].Pos() < b.nodes[j].Pos()
+	})
+	return Map[NodeLike]{
+		nodes: b.nodes,
+	}
+}
+
+type Map[NodeLike ast.Node] struct {
+	nodes []NodeLike
+}
+
+func (m Map[NodeLike]) All() []NodeLike {
+	return m.nodes
+}
+
+func (m Map[NodeLike]) Within(node ast.Node) []NodeLike {
+	startIdx := sort.Search(len(m.nodes), func(i int) bool {
+		return m.nodes[i].Pos() >= node.Pos()
+	})
+
+	endIdx := startIdx
+	for endIdx < len(m.nodes) && m.nodes[endIdx].End() <= node.End() {
+		endIdx++
+	}
+
+	nodes := make([]NodeLike, endIdx-startIdx)
+	copy(nodes, m.nodes[startIdx:endIdx])
+	return nodes
+}
+
+func (m Map[NodeLike]) Containing(node ast.Node) option.Option[NodeLike] {
+	idx := sort.Search(len(m.nodes), func(i int) bool {
+		return m.nodes[i].Pos() >= node.Pos()
+	})
+
+	// The containing resource, if any, has a starting position before this node
+	// and an ending position after this node.
+	if idx > 0 {
+		candidate := m.nodes[idx-1]
+		if candidate.Pos() <= node.Pos() && candidate.End() >= node.End() {
+			return option.Some(candidate)
+		}
+	}
+
+	if len(m.nodes) > 0 {
+		candidate := m.nodes[0]
+		if candidate.Pos() <= node.Pos() && candidate.End() >= node.End() {
+			return option.Some(candidate)
+		}
+	}
+
+	return option.None[NodeLike]()
+}
diff --git a/v2/internals/resourcepaths/errors.go b/v2/internals/resourcepaths/errors.go
new file mode 100644
index 0000000000..d429b7fcef
--- /dev/null
+++ b/v2/internals/resourcepaths/errors.go
@@ -0,0 +1,96 @@
+package resourcepaths
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"paths",
+		"Paths must be not be empty and always start with a '/'. You cannot define paths that conflict "+
+			"with each other, including static and parameterized paths. For example `/blog/:id` would conflict with `/:username`.\n\n"+
+			"For more information about configuring Paths, see https://encore.dev/docs/primitives/apis#rest-apis",
+
+		errors.WithRangeSize(20),
+	)
+
+	errEmptyPath = errRange.New(
+		"Invalid Path",
+		"Paths must not be empty.",
+	)
+
+	errInvalidPathPrefix = errRange.New(
+		"Invalid Path",
+		"Paths cannot start with a '/'.",
+	)
+
+	errInvalidPathMissingPrefix = errRange.New(
+		"Invalid Path",
+		"Paths must always start with a '/'.",
+	)
+
+	errInvalidPathURI = errRange.New(
+		"Invalid Path",
+		"Paths must be valid URIs. There was an error parsing the path.",
+	)
+
+	errPathContainedQuery = errRange.New(
+		"Invalid Path",
+		"Paths must not contain the '?' character.",
+	)
+
+	errEmptySegment = errRange.New(
+		"Invalid Path",
+		"Paths cannot contain an empty segment, i.e. a double slash ('//').",
+	)
+
+	errTrailingSlash = errRange.New(
+		"Invalid Path",
+		"Paths cannot end with a trailing slash ('/').",
+	)
+
+	errParameterMissingName = errRange.New(
+		"Invalid Path",
+		"Path parameters must have a name. For example, `/:id` is valid, but `/:` is not.",
+	)
+
+	errInvalidParamIdentifier = errRange.New(
+		"Invalid Path",
+		"Path parameters must be valid Go identifiers.",
+	)
+
+	errWildcardNotLastSegment = errRange.New(
+		"Invalid Path",
+		"Path wildcards must be the last segment in the path.",
+	)
+
+	errFallbackNotLastSegment = errRange.New(
+		"Invalid Path",
+		"Path fallbacks must be the last segment in the path.",
+	)
+
+	errDuplicatePath = errRange.New(
+		"Path Conflict",
+		"Duplicate Paths found.",
+	)
+
+	errConflictingParameterizedPath = errRange.Newf(
+		"Path Conflict",
+		"The parameter `:%s` conflicts with the path `%s`.",
+	)
+
+	errConflictingWildcardPath = errRange.Newf(
+		"Path Conflict",
+		"The wildcard `*%s` conflicts with the path `%s`.",
+	)
+
+	errConflictingLiteralPath = errRange.Newf(
+		"Path Conflict",
+		"The path segment `%s` conflicts with the path `%s`.",
+	)
+
+	errConflictingFallbackPath = errRange.Newf(
+		"Path Conflict",
+		"The fallback `!%s` conflicts with the path `%s`.",
+	)
+)
diff --git a/v2/internals/resourcepaths/paths.go b/v2/internals/resourcepaths/paths.go
new file mode 100644
index 0000000000..599f596e4b
--- /dev/null
+++ b/v2/internals/resourcepaths/paths.go
@@ -0,0 +1,467 @@
+// Package resourcepaths parses API and other resource paths.
+package resourcepaths
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"net/url"
+	"strings"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/schema"
+)
+
+// Path represents a parsed path.
+type Path struct {
+	StartPos token.Pos
+	Segments []Segment
+}
+
+var _ ast.Node = (*Path)(nil)
+
+func (p *Path) Pos() token.Pos {
+	return p.StartPos
+}
+
+func (p *Path) End() token.Pos {
+	if len(p.Segments) > 0 {
+		return p.Segments[len(p.Segments)-1].End()
+	}
+	return p.StartPos
+}
+
+// String returns the path's string representation.
+func (p *Path) String() string {
+	var b strings.Builder
+	for _, s := range p.Segments {
+		b.WriteByte('/')
+
+		switch s.Type {
+		case Param:
+			b.WriteByte(':')
+		case Wildcard:
+			b.WriteByte('*')
+		case Fallback:
+			b.WriteByte('!')
+		}
+		b.WriteString(s.Value)
+	}
+	return b.String()
+}
+
+// NumParams reports the number of parameterized (non-literal) segments in the path.
+func (p *Path) NumParams() int {
+	n := 0
+	for _, s := range p.Segments {
+		if s.Type != Literal {
+			n++
+		}
+	}
+	return n
+}
+
+// Params returns the segments that are not literals.
+func (p *Path) Params() []Segment {
+	var params []Segment
+	for _, s := range p.Segments {
+		if s.Type != Literal {
+			params = append(params, s)
+		}
+	}
+	return params
+}
+
+// HasFallback is true if the path contains a fallback segment.
+func (p *Path) HasFallback() bool {
+	for _, s := range p.Segments {
+		if s.Type == Fallback {
+			return true
+		}
+	}
+	return false
+}
+
+// Segment represents a parsed path segment.
+type Segment struct {
+	Type      SegmentType
+	Value     string // literal if Type == Literal; name of parameter otherwise
+	ValueType schema.BuiltinKind
+	StartPos  token.Pos
+	EndPos    token.Pos
+}
+
+var _ ast.Node = Segment{}
+
+func (s *Segment) String() string {
+	switch s.Type {
+	case Param:
+		return ":" + s.Value
+	case Wildcard:
+		return "*" + s.Value
+	case Fallback:
+		return "!" + s.Value
+	default:
+		return s.Value
+	}
+}
+
+func (s Segment) Pos() token.Pos {
+	return s.StartPos
+}
+
+func (s Segment) End() token.Pos {
+	return s.EndPos
+}
+
+// SegmentType represents the different types of path segments recognized by the parser.
+type SegmentType int
+
+const (
+	// Literal is a literal string path segment.
+	Literal SegmentType = iota
+	// Param represents a single path segment of any (non-empty) value.
+	Param
+	// Wildcard represents zero or more path segments of any value.
+	Wildcard
+	// Fallback represents zero or more path segments of any value
+	// that are lower priority than any other path.
+	Fallback
+)
+
+type Options struct {
+	// AllowWildcard indicates whether the parser should allow wildcard segments.
+	AllowWildcard bool
+
+	// AllowFallback indicates whether the parser should allow fallback segments.
+	AllowFallback bool
+
+	// PrefixSlash indicates whether the parser should require a leading slash
+	// or require that it's not present
+	PrefixSlash bool
+}
+
+// Parse parses a slash-separated path into path segments.
+//
+// strPos is the position of where the path string was found in the source code.
+func Parse(errs *perr.List, startPos token.Pos, path string, options Options) (parsedPath *Path, ok bool) {
+	endPos := token.Pos(len([]byte(path))) + startPos
+
+	if path == "" {
+		errs.Add(errEmptyPath.AtGoPos(startPos, endPos))
+		return nil, false
+	} else if path[0] != '/' && options.PrefixSlash {
+		errs.Add(errInvalidPathMissingPrefix.AtGoPos(startPos, endPos))
+		return nil, false
+	} else if path[0] == '/' && !options.PrefixSlash {
+		errs.Add(errInvalidPathPrefix.AtGoPos(startPos, endPos))
+		return nil, false
+	}
+
+	urlPath := path
+	if !options.PrefixSlash {
+		urlPath = "/" + urlPath
+	}
+	if _, err := url.ParseRequestURI(urlPath); err != nil {
+		errs.Add(errInvalidPathURI.AtGoPos(startPos, endPos).Wrapping(err))
+		return nil, false
+	} else if idx := strings.IndexByte(path, '?'); idx != -1 {
+		errs.Add(errPathContainedQuery.AtGoPos(startPos, endPos))
+		return nil, false
+	}
+
+	var segs []Segment
+	segStart := startPos
+	for path != "" {
+		if options.PrefixSlash || len(segs) > 0 {
+			path = path[1:] // drop leading '/'
+			segStart++
+		}
+
+		// Find the next path segment
+		var val string
+		idx := strings.IndexByte(path, '/')
+		segEnd := segStart
+		switch idx {
+		case 0:
+			errs.Add(errEmptySegment.AtGoPos(segStart-1, segStart))
+			return nil, false
+		case -1:
+			val = path
+			path = ""
+		default:
+			val = path[:idx]
+			path = path[idx:]
+		}
+		segEnd += token.Pos(len([]byte(val))) - 1
+
+		segType := Literal
+		if val != "" && val[0] == ':' {
+			segType = Param
+			val = val[1:]
+		} else if val != "" && val[0] == '*' && options.AllowWildcard {
+			segType = Wildcard
+			val = val[1:]
+		} else if val != "" && val[0] == '!' && options.AllowFallback {
+			segType = Fallback
+			val = val[1:]
+		}
+		segs = append(segs, Segment{
+			Type: segType, Value: val, ValueType: schema.String,
+			StartPos: segStart - 1, EndPos: segEnd,
+		})
+		segStart = segEnd + 1
+	}
+
+	// Validate the segments
+	for i, s := range segs {
+		switch s.Type {
+		case Literal:
+			if s.Value == "" {
+				errs.Add(errTrailingSlash.AtGoNode(s))
+				return nil, false
+			}
+		case Param:
+			switch {
+			case s.Value == "":
+				errs.Add(errParameterMissingName.AtGoNode(s))
+				return nil, false
+			case !token.IsIdentifier(s.Value):
+				errs.Add(errInvalidParamIdentifier.AtGoNode(s))
+				return nil, false
+			}
+		case Wildcard:
+			switch {
+			case s.Value == "":
+				errs.Add(errParameterMissingName.AtGoNode(s))
+				return nil, false
+			case !token.IsIdentifier(s.Value):
+				errs.Add(errInvalidParamIdentifier.AtGoNode(s))
+				return nil, false
+			case len(segs) > (i + 1):
+				errs.Add(errWildcardNotLastSegment.AtGoNode(s))
+				return nil, false
+			}
+		case Fallback:
+			switch {
+			case s.Value == "":
+				errs.Add(errParameterMissingName.AtGoNode(s))
+				return nil, false
+			case !token.IsIdentifier(s.Value):
+				errs.Add(errInvalidParamIdentifier.AtGoNode(s))
+				return nil, false
+			case len(segs) > (i + 1):
+				errs.Add(errFallbackNotLastSegment.AtGoNode(s))
+				return nil, false
+			}
+		}
+	}
+
+	return &Path{StartPos: startPos, Segments: segs}, true
+}
+
+func (p *Path) ToProto() *meta.Path {
+	mp := &meta.Path{}
+	mp.Type = meta.Path_URL
+
+	for _, seg := range p.Segments {
+		s := &meta.PathSegment{Value: seg.Value}
+		switch seg.Type {
+		case Literal:
+			s.Type = meta.PathSegment_LITERAL
+		case Param:
+			s.Type = meta.PathSegment_PARAM
+		case Wildcard:
+			s.Type = meta.PathSegment_WILDCARD
+		case Fallback:
+			s.Type = meta.PathSegment_FALLBACK
+		default:
+			panic(fmt.Sprintf("unhandled path segment type %v", seg.Type))
+		}
+
+		if s.Type != meta.PathSegment_LITERAL {
+			switch seg.ValueType {
+			case schema.String:
+				s.ValueType = meta.PathSegment_STRING
+			case schema.Bool:
+				s.ValueType = meta.PathSegment_BOOL
+			case schema.Int:
+				s.ValueType = meta.PathSegment_INT
+			case schema.Int8:
+				s.ValueType = meta.PathSegment_INT8
+			case schema.Int16:
+				s.ValueType = meta.PathSegment_INT16
+			case schema.Int32:
+				s.ValueType = meta.PathSegment_INT32
+			case schema.Int64:
+				s.ValueType = meta.PathSegment_INT64
+			case schema.Uint:
+				s.ValueType = meta.PathSegment_UINT
+			case schema.Uint8:
+				s.ValueType = meta.PathSegment_UINT8
+			case schema.Uint16:
+				s.ValueType = meta.PathSegment_UINT16
+			case schema.Uint32:
+				s.ValueType = meta.PathSegment_UINT32
+			case schema.Uint64:
+				s.ValueType = meta.PathSegment_UINT64
+			case schema.UUID:
+				s.ValueType = meta.PathSegment_UUID
+			default:
+				panic(fmt.Sprintf("unhandled path segment value type %v", seg.ValueType))
+			}
+		}
+
+		mp.Segments = append(mp.Segments, s)
+	}
+	return mp
+}
+
+// Set tracks a set of paths, ensuring they are compatible with each other.
+// The zero value is ready to use.
+type Set struct {
+	methods map[string]*node
+}
+
+func NewSet() *Set {
+	return &Set{
+		methods: make(map[string]*node),
+	}
+}
+
+// Add adds a path to the set of paths.
+func (s *Set) Add(errs *perr.List, method string, path *Path) (ok bool) {
+	if s.methods == nil {
+		s.methods = make(map[string]*node)
+	}
+
+	var candidates []string
+	if method == "*" {
+		// Check all defined methods
+		for m := range s.methods {
+			if m != method {
+				candidates = append(candidates, m)
+			}
+		}
+	} else {
+		candidates = []string{"*"}
+	}
+
+	// Always check the target method last, so we don't add to the set if there's an error
+	// for another method.
+	candidates = append(candidates, method)
+
+CandidateLoop:
+	for _, m := range candidates {
+		curr := s.methods[m]
+		if curr == nil {
+			curr = &node{}
+			s.methods[m] = curr
+		}
+
+		for _, seg := range path.Segments {
+			next, ok := s.match(errs, path, seg, curr)
+			if !ok {
+				return false
+			} else if next != nil {
+				curr = next
+			} else {
+				// Could not find a match; add it to the tree (if this is the target method)
+				if m != method {
+					continue CandidateLoop
+				}
+				curr.children = append(curr.children, &node{s: seg})
+				curr = curr.children[len(curr.children)-1]
+			}
+		}
+
+		if curr.p != nil {
+			errs.Add(errDuplicatePath.AtGoNode(path).AtGoNode(curr.p))
+			return false
+		} else if m == method {
+			curr.p = path
+		}
+	}
+
+	return true
+}
+
+func (s *Set) match(errs *perr.List, path *Path, seg Segment, curr *node) (next *node, ok bool) {
+	for _, ch := range curr.children {
+		switch ch.s.Type {
+		case Wildcard:
+			switch seg.Type {
+			case Param:
+				errs.Add(errConflictingParameterizedPath(seg.Value, ch.findPath()).
+					AtGoNode(path).
+					AtGoNode(ch.findPath()))
+				return nil, false
+			case Wildcard:
+				errs.Add(errConflictingWildcardPath(seg.Value, ch.findPath()).
+					AtGoNode(path).
+					AtGoNode(ch.findPath()))
+				return nil, false
+			case Literal:
+				errs.Add(errConflictingLiteralPath(seg.Value, ch.findPath()).
+					AtGoNode(path).
+					AtGoNode(ch.findPath()))
+				return nil, false
+			}
+		case Param:
+			switch seg.Type {
+			case Param:
+				return ch, true
+			case Wildcard:
+				errs.Add(errConflictingWildcardPath(seg.Value, ch.findPath()).
+					AtGoNode(path).
+					AtGoNode(ch.findPath()))
+				return nil, false
+			case Literal:
+				errs.Add(errConflictingLiteralPath(seg.Value, ch.findPath()).
+					AtGoNode(path).
+					AtGoNode(ch.findPath()))
+				return nil, false
+			}
+		case Literal:
+			switch seg.Type {
+			case Wildcard:
+				errs.Add(errConflictingWildcardPath(seg.Value, ch.findPath()).
+					AtGoNode(path).
+					AtGoNode(ch.findPath()))
+				return nil, false
+			case Param:
+				errs.Add(errConflictingLiteralPath(seg.Value, ch.findPath()).
+					AtGoNode(path).
+					AtGoNode(ch.findPath()))
+				return nil, false
+			case Literal:
+				if seg.Value == ch.s.Value {
+					return ch, true
+				}
+			}
+		case Fallback:
+			switch seg.Type {
+			case Fallback:
+				errs.Add(errConflictingFallbackPath(seg.Value, ch.findPath()).
+					AtGoNode(path).
+					AtGoNode(ch.findPath()))
+				return nil, false
+			}
+		}
+	}
+	return nil, true
+}
+
+type node struct {
+	s        Segment
+	children []*node
+	p        *Path // leaf path, if any
+}
+
+func (n *node) findPath() *Path {
+	for n.p == nil {
+		n = n.children[0]
+	}
+	return n.p
+}
diff --git a/v2/internals/resourcepaths/paths_test.go b/v2/internals/resourcepaths/paths_test.go
new file mode 100644
index 0000000000..2902939e29
--- /dev/null
+++ b/v2/internals/resourcepaths/paths_test.go
@@ -0,0 +1,113 @@
+package resourcepaths
+
+import (
+	"context"
+	"go/token"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+
+	"encr.dev/pkg/errinsrc"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/schema"
+)
+
+func init() {
+	errinsrc.ColoursInErrors(false)
+}
+
+func TestParseURL(t *testing.T) {
+	c := qt.New(t)
+
+	str := schema.String
+	tests := []struct {
+		Path string
+		Want []Segment
+		Err  string
+	}{
+		{"foo", nil, "Paths must always start with a '/'"},
+		{"/foo", []Segment{{Literal, "foo", str, 0, 3}}, ""},
+		{"/foo/", nil, "Paths cannot end with a trailing slash ('/')"},
+		{"/foo/bar", []Segment{{Literal, "foo", str, 0, 3}, {Literal, "bar", str, 4, 7}}, ""},
+		{"/foo//bar", nil, "Paths cannot contain an empty segment, i.e. a double slash ('//')."},
+		{"/:foo/*bar", []Segment{{Param, "foo", str, 0, 4}, {Wildcard, "bar", str, 5, 9}}, ""},
+		{"/:foo/*", nil, "Path parameters must have a name."},
+		{"/:foo/*/bar", nil, "Path parameters must have a name."},
+		{"/:foo/*bar/baz", nil, "Path wildcards must be the last segment in the path."},
+		{"/:foo/*;", nil, "Path parameters must be valid Go identifiers."},
+		{"/:;", nil, "Path parameters must be valid Go identifiers."},
+		{"/\u0000", nil, "invalid control character in URL"},
+		{"/foo?bar=baz", nil, `Paths must not contain the '?' character.`},
+		{"/foo/!fallback", []Segment{
+			{Literal, "foo", str, 0, 3},
+			{Fallback, "fallback", str, 4, 13}}, ""},
+	}
+
+	for _, test := range tests {
+		c.Run(test.Path, func(c *qt.C) {
+			errs := perr.NewList(context.Background(), token.NewFileSet())
+			p, ok := Parse(errs, 0, test.Path, Options{
+				AllowWildcard: true,
+				AllowFallback: true,
+				PrefixSlash:   true,
+			})
+			if !ok {
+				c.Assert(errs.FormatErrors(), qt.Contains, test.Err)
+			} else if test.Err != "" {
+				c.Fatalf("expected err %q, got nil", test.Err)
+			} else {
+				c.Assert(p.Segments, qt.DeepEquals, test.Want)
+				c.Assert(errs.Len(), qt.Equals, 0)
+			}
+		})
+	}
+}
+
+func TestAdd(t *testing.T) {
+	c := qt.New(t)
+
+	paths := []struct {
+		Method string
+		Path   string
+		Err    string
+	}{
+		{"POST", "/foo", ``},
+		{"POST", "/foo", `Duplicate Paths found.`},
+		{"GET", "/foo", ``},
+		{"*", "/foo", `Duplicate Paths found.`},
+		{"*", "/bar", ``},
+		{"PATCH", "/bar", `Duplicate Paths found.`},
+		{"POST", "/foo/bar", ``},
+		{"POST", "/foo/:bar", "The path segment `bar` conflicts with the path `/foo/bar`"},
+		{"POST", "/moo/:bar", ``},
+		{"POST", "/moo/:baz", `Duplicate Paths found.`},
+		{"POST", "/moo/:baz/test", ``},
+		{"POST", "/moo/:baa/*wild", "The wildcard `*wild` conflicts with the path `/moo/:baz/test`."},
+		{"GET", "/moo/:baa/*wild", ``},
+		{"POST", "/test/*wild", ``},
+		{"POST", "/test/*card", "The wildcard `*card` conflicts with the path `/test/*wild`."},
+		{"POST", "/test/!fallback", ""},
+		{"GET", "/test/!fallback", ""},
+		{"POST", "/test/!fallback", "The fallback `!fallback` conflicts with the path `/test/!fallback`."},
+	}
+
+	set := &Set{}
+
+	for _, test := range paths {
+		errs := perr.NewList(context.Background(), token.NewFileSet())
+		p, ok := Parse(errs, 0, test.Path, Options{
+			AllowWildcard: true,
+			AllowFallback: true,
+			PrefixSlash:   true,
+		})
+		c.Assert(ok, qt.IsTrue)
+		ok = set.Add(errs, test.Method, p)
+		if test.Err != "" {
+			c.Assert(errs.FormatErrors(), qt.Contains, test.Err, qt.Commentf("%s %s", test.Method, test.Path))
+			c.Assert(ok, qt.IsFalse)
+		} else {
+			c.Assert(errs.Len(), qt.Equals, 0, qt.Commentf("%s %s: %v", test.Method, test.Path, errs.AsError()))
+			c.Assert(ok, qt.IsTrue)
+		}
+	}
+}
diff --git a/v2/internals/scan/collect.go b/v2/internals/scan/collect.go
new file mode 100644
index 0000000000..2c5fd92262
--- /dev/null
+++ b/v2/internals/scan/collect.go
@@ -0,0 +1,50 @@
+package scan
+
+import (
+	"fmt"
+	"os"
+
+	"golang.org/x/mod/modfile"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+// ProcessModule parses all the packages in the module located at modRoot.
+// It calls process for each package. Multiple goroutines may call process
+// concurrently.
+func ProcessModule(errs *perr.List, loader *pkginfo.Loader, moduleRoot paths.FS, process func(pkg *pkginfo.Package)) {
+	// Resolve the module path for the main module.
+	modFilePath := moduleRoot.Join("go.mod")
+	modPath, err := resolveModulePath(modFilePath)
+	if err != nil {
+		errs.Add(errResolvingModulePath.InFile(modFilePath.ToIO()).Wrapping(err))
+		return
+	}
+
+	quit := make(chan struct{})
+	defer close(quit)
+	pkgCh := Packages(quit, errs, loader, moduleRoot, paths.Pkg(modPath))
+
+	for pkg := range pkgCh {
+		process(pkg)
+	}
+}
+
+// resolveModulePath resolves the main module's module path
+// by reading the go.mod file at goModPath.
+func resolveModulePath(goModPath paths.FS) (paths.Mod, error) {
+	data, err := os.ReadFile(goModPath.ToIO())
+	if err != nil {
+		return "", err
+	}
+	modFile, err := modfile.Parse(goModPath.ToDisplay(), data, nil)
+	if err != nil {
+		return "", err
+	}
+	if !paths.ValidModPath(modFile.Module.Mod.Path) {
+		return "", fmt.Errorf("invalid module path %q", modFile.Module.Mod.Path)
+	}
+	return paths.MustModPath(modFile.Module.Mod.Path), nil
+}
diff --git a/v2/internals/scan/collect_test.go b/v2/internals/scan/collect_test.go
new file mode 100644
index 0000000000..d0af875b97
--- /dev/null
+++ b/v2/internals/scan/collect_test.go
@@ -0,0 +1,40 @@
+package scan
+
+import (
+	"cmp"
+	"slices"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/testutil"
+)
+
+func TestProcessModule(t *testing.T) {
+	c := qt.New(t)
+	a := testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+-- foo/foo.go --
+package foo
+-- foo/bar/bar.go --
+package bar
+`)
+	tc := testutil.NewContext(c, false, a)
+	tc.FailTestOnErrors()
+	loader := pkginfo.New(tc.Context)
+
+	var got testutil.PackageList
+	ProcessModule(tc.Errs, loader, tc.MainModuleDir, got.Collector())
+	c.Assert(got, qt.HasLen, 2)
+
+	// Sort the packages by import path since collectPackages processes
+	// packages concurrently.
+	slices.SortFunc(got, func(a, b *pkginfo.Package) int {
+		return cmp.Compare(a.ImportPath, b.ImportPath)
+	})
+	c.Assert(got[0].ImportPath, qt.Equals, paths.Pkg("example.com/foo"))
+	c.Assert(got[1].ImportPath, qt.Equals, paths.Pkg("example.com/foo/bar"))
+}
diff --git a/v2/internals/scan/errors.go b/v2/internals/scan/errors.go
new file mode 100644
index 0000000000..74f67115c9
--- /dev/null
+++ b/v2/internals/scan/errors.go
@@ -0,0 +1,18 @@
+package scan
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"scan",
+		"",
+		errors.WithRangeSize(25),
+	)
+
+	errResolvingModulePath = errRange.New(
+		"Error Resolving Module Path",
+		"An error occurred while trying to resolve the module path.",
+	)
+)
diff --git a/v2/internals/scan/scan.go b/v2/internals/scan/scan.go
new file mode 100644
index 0000000000..9f05d3a75c
--- /dev/null
+++ b/v2/internals/scan/scan.go
@@ -0,0 +1,126 @@
+package scan
+
+import (
+	"go/token"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"sync"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+// Packages scans and parses the Go packages for all subdirectories in the root.
+func Packages(quit chan struct{}, errs *perr.List, l *pkginfo.Loader, root paths.FS, basePkgPath paths.Pkg) <-chan *pkginfo.Package {
+	// a worker accepts work in the form of package paths to parse
+	// and sends the parsed results back on the results channel.
+	// It calls wg.Done() when it's done.
+	worker := func(wg *sync.WaitGroup, work <-chan paths.Pkg, results chan<- *pkginfo.Package) {
+		defer wg.Done()
+		for pkgPath := range work {
+			if pkg, ok := l.LoadPkg(token.NoPos, pkgPath); ok {
+				select {
+				case results <- pkg:
+				case <-quit:
+					return // we're done
+				}
+			}
+		}
+	}
+
+	// Enqueue all the directories to parse
+	work := make(chan paths.Pkg, 100)
+	go func() {
+		defer close(work) // no more work when we're done
+		err := walkGoPackages(root, basePkgPath, func(pkgPath paths.Pkg) {
+			select {
+			case work <- pkgPath:
+			case <-quit:
+				return // we're done
+			}
+		})
+		if err != nil {
+			errs.AddStd(err)
+		}
+	}()
+
+	// Start the workers. One per GOMAXPROCS, but at least 4
+	numWorkers := runtime.GOMAXPROCS(0)
+	if numWorkers < 4 {
+		numWorkers = 4
+	}
+	results := make(chan *pkginfo.Package, numWorkers)
+	var activeWorkers sync.WaitGroup
+	for i := 0; i < numWorkers; i++ {
+		activeWorkers.Add(1)
+		go worker(&activeWorkers, work, results)
+	}
+
+	// When all the workers are done, close the results channel
+	go func() {
+		activeWorkers.Wait()
+		close(results)
+	}()
+
+	return results
+}
+
+type walkFunc func(pkgPath paths.Pkg)
+
+// walkGoPackages recursively walks all subdirectories of root,
+// calling walkFn for each directory that contains a go package
+// (as indicated by the presence of any .go files).
+func walkGoPackages(root paths.FS, basePkgPath paths.Pkg, walkFn walkFunc) error {
+	return walkDir(root.ToIO(), basePkgPath, walkFn)
+}
+
+func walkDir(dir string, pkgPath paths.Pkg, walkFn walkFunc) error {
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		return err
+	}
+
+	// Iterate through the entries and keep track of any directories
+	// we come across as well as whether there are any Go files.
+	var subdirs []string
+	foundGoFile := false
+	for _, e := range entries {
+		name := e.Name()
+		if ignored(name) {
+			continue
+		} else if e.IsDir() {
+			subdirs = append(subdirs, name)
+		} else if !foundGoFile {
+			// Only compute if we haven't already found a .go file
+			foundGoFile = strings.HasSuffix(name, ".go")
+		}
+	}
+
+	if foundGoFile {
+		walkFn(pkgPath)
+	}
+	for _, d := range subdirs {
+		subDir := filepath.Join(dir, d)
+		subPkg := pkgPath.JoinSlash(paths.RelSlash(d))
+		if err := walkDir(subDir, subPkg, walkFn); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// ignored returns true if a given directory should be ignored for parsing.
+func ignored(dir string) bool {
+	name := filepath.Base(filepath.Clean(dir))
+	if strings.EqualFold(name, "node_modules") {
+		return true
+	}
+	// Don't watch hidden folders like `.git` or `.idea`.
+	if len(name) > 1 && name[0] == '.' {
+		return true
+	}
+	return false
+}
diff --git a/v2/internals/scan/scan_test.go b/v2/internals/scan/scan_test.go
new file mode 100644
index 0000000000..4d3f6907d0
--- /dev/null
+++ b/v2/internals/scan/scan_test.go
@@ -0,0 +1,74 @@
+package scan
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp/cmpopts"
+
+	"encr.dev/pkg/paths"
+)
+
+func TestWalkDirs(t *testing.T) {
+	tests := []struct {
+		// Tree represents a directory tree. See createTree.
+		Tree string
+		// Pkgs are the packages yielded by the walk,
+		// separated by space.
+		Pkgs string
+	}{
+		{"a", ""},
+		{"foo/", ""},
+		{"a.go", "."},
+		{"a.go foo/b.go foo/bar/c foo/bar/baz/d.go", ". foo foo/bar/baz"},
+	}
+
+	// createTree creates the directory tree represented by tree.
+	// Nodes are space-separated; dirs end with a trailing slash.
+	//
+	// "a b/c d/" represents a root with one file "a",
+	// the directory "b" (containing file "c") and an empty directory "d".
+	// It reports the directory root.
+	createTree := func(tree string) (root string) {
+		root = t.TempDir()
+		for _, node := range strings.Fields(tree) {
+			// Create the dir if we have a slash
+			if idx := strings.LastIndexByte(node, '/'); idx > 0 {
+				p := filepath.Join(root, filepath.FromSlash(node[:idx]))
+				if err := os.MkdirAll(p, 0755); err != nil {
+					t.Fatal(err)
+				}
+			}
+			if !strings.HasSuffix(node, "/") {
+				f, err := os.Create(filepath.Join(root, filepath.FromSlash(node)))
+				if err != nil {
+					t.Fatal(err)
+				}
+				f.Close()
+			}
+		}
+		return root
+	}
+
+	c := qt.New(t)
+	for _, test := range tests {
+		root := createTree(test.Tree)
+		basePkgPath := paths.MustPkgPath("x")
+		var got []paths.Pkg
+		err := walkGoPackages(paths.RootedFSPath(root, "."), basePkgPath, func(p paths.Pkg) {
+			got = append(got, p)
+		})
+		c.Assert(err, qt.IsNil)
+
+		// Compare the packages
+		wantPkgs := strings.Fields(test.Pkgs)
+		want := make([]paths.Pkg, len(wantPkgs))
+		for i, p := range wantPkgs {
+			want[i] = basePkgPath.JoinSlash(paths.RelSlash(p))
+		}
+		c.Assert(got, qt.CmpEquals(cmpopts.EquateEmpty()), want, qt.Commentf("tree: %s", test.Tree))
+	}
+}
diff --git a/v2/internals/schema/decls.go b/v2/internals/schema/decls.go
new file mode 100644
index 0000000000..ff868326c3
--- /dev/null
+++ b/v2/internals/schema/decls.go
@@ -0,0 +1,277 @@
+package schema
+
+import (
+	"go/ast"
+	"slices"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+// Decl is the common interface for different kinds of declarations.
+type Decl interface {
+	Kind() DeclKind
+
+	DeclaredIn() *pkginfo.File
+	// PkgName reports the name if this is a package-level declaration.
+	// Otherwise it reports None.
+	PkgName() option.Option[string]
+
+	// ASTNode returns the AST node that this declaration represents.
+	// It's a *ast.FuncDecl or *ast.TypeSpec.
+	ASTNode() ast.Node
+	// String returns the shorthand name for this declaration,
+	// in the form "pkgname.DeclName".
+	String() string
+	// TypeParameters are the type parameters on this declaration.
+	TypeParameters() []DeclTypeParam
+}
+
+// DeclKind represents different kinds of declarations.
+type DeclKind int
+
+const (
+	// DeclType represents a type declaration.
+	DeclType DeclKind = iota
+	// DeclFunc represents a func declaration.
+	DeclFunc
+)
+
+// TypeDecl represents a type declaration.
+type TypeDecl struct {
+	// AST is the AST node that this declaration represents.
+	AST *ast.TypeSpec
+
+	Info *pkginfo.PkgDeclInfo // the underlying declaration info
+	File *pkginfo.File        // the file declaring the type
+	Name string               // name of the type declaration
+	Type Type                 // the declaration's underlying type
+
+	// TypeParams are any type parameters on this declaration.
+	// (note: instantiated types used within this declaration would not be captured here)
+	TypeParams []DeclTypeParam
+}
+
+func (d *TypeDecl) Clone() *TypeDecl {
+	return &TypeDecl{
+		AST:        d.AST,
+		Info:       d.Info,
+		File:       d.File,
+		Name:       d.Name,
+		Type:       d.Type,
+		TypeParams: slices.Clone(d.TypeParams),
+	}
+}
+
+// DeclTypeParam represents a type parameter on a declaration.
+// For example A in "type Foo[A any] struct { ... }"
+type DeclTypeParam struct {
+	// AST is the AST node that this type param represents.
+	// Note that multiple fields may share the same *ast.Field node,
+	// in cases with multiple names, like "type Foo[A, B any]".
+	AST *ast.Field
+
+	Name string // the identifier given to the type parameter.
+}
+
+// A FuncDecl represents a function declaration.
+type FuncDecl struct {
+	AST *ast.FuncDecl
+
+	File *pkginfo.File            // the file declaring the type
+	Name string                   // the name of the function
+	Recv option.Option[*Receiver] // none if not a method
+	Type FuncType                 // signature
+
+	// TypeParams are any type parameters on this declaration.
+	// (note: instantiated types used within this declaration would not be captured here)
+	TypeParams []DeclTypeParam
+}
+
+// A Receiver represents a method receiver.
+// It describes the name and type of the receiver.
+type Receiver struct {
+	AST *ast.FieldList
+	// Name is the name of the receiver (e.g. "a" in "func (a *Foo) Bar()").
+	// It's None if the receiver is unnamed (e.g. "func (*Foo) Bar()").
+	Name option.Option[string]
+
+	// Type is the type of the receiver.
+	// It's either a NamedType or a NamedType wrapped in a PointerType.
+	Type Type
+
+	// Decl is the underlying type declaration the receiver points to.
+	Decl *TypeDecl
+}
+
+func (*TypeDecl) Kind() DeclKind                    { return DeclType }
+func (d *TypeDecl) DeclaredIn() *pkginfo.File       { return d.File }
+func (d *TypeDecl) ASTNode() ast.Node               { return d.AST }
+func (d *TypeDecl) String() string                  { return d.File.Pkg.Name + "." + d.Name }
+func (d *TypeDecl) TypeParameters() []DeclTypeParam { return d.TypeParams }
+func (d *TypeDecl) PkgName() option.Option[string]  { return option.Some(d.Name) }
+
+func (*FuncDecl) Kind() DeclKind                    { return DeclFunc }
+func (d *FuncDecl) DeclaredIn() *pkginfo.File       { return d.File }
+func (d *FuncDecl) ASTNode() ast.Node               { return d.AST }
+func (d *FuncDecl) String() string                  { return d.File.Pkg.Name + "." + d.Name }
+func (d *FuncDecl) TypeParameters() []DeclTypeParam { return d.TypeParams }
+func (d *FuncDecl) PkgName() option.Option[string] {
+	if d.Recv.Empty() {
+		return option.Some(d.Name)
+	}
+	return option.None[string]()
+}
+
+// ParseTypeDecl parses the type from a package declaration.
+// It errors if the declaration is not a type.
+func (p *Parser) ParseTypeDecl(d *pkginfo.PkgDeclInfo) *TypeDecl {
+	pkg := d.File.Pkg
+
+	// Have we already parsed this?
+	key := declKey{pkg: pkg.ImportPath, name: d.Name}
+	p.declsMu.Lock()
+	cached, ok := p.decls[key]
+	p.declsMu.Unlock()
+
+	if ok {
+		if td, ok := cached.(*TypeDecl); ok {
+			return td
+		} else {
+			p.c.Errs.Fatalf(d.Spec.Pos(), "decl %s is not a TypeDecl", d.Name)
+		}
+	}
+
+	// We haven't parsed this yet; do so now.
+	// Allocate a decl immediately so that we can properly handle
+	// recursive types by short-circuiting above the second time we get here.
+	spec, ok := d.Spec.(*ast.TypeSpec)
+	if !ok {
+		p.c.Errs.Fatal(d.Spec.Pos(), "unable to get TypeSpec from PkgDecl spec")
+	}
+
+	decl := &TypeDecl{
+		AST:        spec,
+		Name:       d.Name,
+		File:       d.File,
+		Info:       d,
+		TypeParams: nil,
+		// Type is set below
+	}
+	p.declsMu.Lock()
+	p.decls[key] = decl
+	p.declsMu.Unlock()
+
+	// If this is a parameterized declaration, get the type parameters
+	var typeParamsInScope map[string]int
+	typeParamsInScope, decl.TypeParams = computeDeclTypeParams(spec.TypeParams)
+
+	r := p.newTypeResolver(decl, typeParamsInScope)
+	decl.Type = r.parseType(d.File, spec.Type)
+
+	return decl
+}
+
+// ParseFuncDecl parses the func from a package declaration.
+// It errors if the type is not a func declaration.
+func (p *Parser) ParseFuncDecl(file *pkginfo.File, fd *ast.FuncDecl) (*FuncDecl, bool) {
+	// Have we already parsed this?
+	key := declKey{pkg: file.Pkg.ImportPath, name: fd.Name.Name}
+
+	// Is there a receiver? If so we need to add that to the cache key.
+	var recv option.Option[*Receiver]
+	if fd.Recv != nil {
+		r, ok := p.parseRecv(file, fd.Recv)
+		if !ok {
+			return nil, false
+		}
+		key.recvName = r.Decl.Name
+		recv = option.Some(r)
+	}
+
+	p.declsMu.Lock()
+	cached, ok := p.decls[key]
+	p.declsMu.Unlock()
+
+	if ok {
+		if fd, ok := cached.(*FuncDecl); ok {
+			return fd, true
+		} else {
+			p.c.Errs.Add(errDeclIsntFunction(fd.Name).AtGoNode(fd.AST))
+			return nil, false
+		}
+	}
+
+	// We haven't parsed this yet; do so now.
+	// Allocate a decl immediately so that we can properly handle
+	// recursive types by short-circuiting above the second time we get here.
+
+	decl := &FuncDecl{
+		AST:  fd,
+		File: file,
+		Name: fd.Name.Name,
+		Recv: recv,
+		// Type, and TypeParams are set below
+	}
+	p.declsMu.Lock()
+	p.decls[key] = decl
+	p.declsMu.Unlock()
+
+	// If this is a parameterized declaration, get the type parameters.
+	// If the function is a method, get the type parameters from the receiver's type declaration.
+	// Otherwise, use the ones on the function, if any.
+	var typeParamsInScope map[string]int
+	if recv.Present() {
+		// Type params on the receiver do not become type params on the func declaration,
+		// so we use "_" to ignore that value, unlike in the "else" case below.
+		typeParamsInScope, _ = computeDeclTypeParams(recv.MustGet().Decl.AST.TypeParams)
+	} else {
+		typeParamsInScope, decl.TypeParams = computeDeclTypeParams(fd.Type.TypeParams)
+	}
+
+	// Resolve the function type.
+	r := p.newTypeResolver(decl, typeParamsInScope)
+	decl.Type = r.parseFuncType(file, fd.Type)
+	return decl, true
+}
+
+// computeDeclTypeParams computes the type parameter placeholders for a declaration.
+// For example, given the "[A, B any]" in the following declaration:
+//
+//	type Foo[A, B any] struct { ... }
+//
+// it returns:
+//
+//	nameMap = {"A": 0, "B": 1}
+//	params = [{Name: "A"}, {Name: "B"}]
+func computeDeclTypeParams(typeParams *ast.FieldList) (nameMap map[string]int, params []DeclTypeParam) {
+	if typeParams == nil {
+		return nil, nil
+	}
+	numParams := typeParams.NumFields()
+	params = make([]DeclTypeParam, 0, numParams)
+	nameMap = make(map[string]int, numParams)
+
+	paramIdx := 0
+	for _, typeParam := range typeParams.List {
+		for _, name := range typeParam.Names {
+			params = append(params, DeclTypeParam{
+				AST:  typeParam,
+				Name: name.Name,
+			})
+			nameMap[name.Name] = paramIdx
+			paramIdx++
+		}
+	}
+	return nameMap, params
+}
+
+// declKey is a unique key for the given declaration.
+type declKey struct {
+	pkg  paths.Pkg
+	name string
+
+	// recvName specifies the name of the receiver for method declarations.
+	recvName string
+}
diff --git a/v2/internals/schema/errors.go b/v2/internals/schema/errors.go
new file mode 100644
index 0000000000..822204b17b
--- /dev/null
+++ b/v2/internals/schema/errors.go
@@ -0,0 +1,29 @@
+package schema
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"schema",
+		"For more information, see https://encore.dev/docs/develop/api-schemas",
+
+		errors.WithRangeSize(10),
+	)
+
+	errExpectedOnReciever = errRange.Newf(
+		"Invalid receiver",
+		"Expected exactly 1 receiver, got %d.",
+	)
+
+	errUnknownIdentifier = errRange.Newf(
+		"Unknown identifier",
+		"Unknown identifier `%s`",
+	)
+
+	errDeclIsntFunction = errRange.Newf(
+		"Invalid declaration",
+		"Declaration `%s` is not a function",
+	)
+)
diff --git a/v2/internals/schema/schema_parser.go b/v2/internals/schema/schema_parser.go
new file mode 100644
index 0000000000..a8282b0491
--- /dev/null
+++ b/v2/internals/schema/schema_parser.go
@@ -0,0 +1,489 @@
+// Package schema implements parsing of Go types into Encore's schema format.
+package schema
+
+import (
+	"go/ast"
+	"go/token"
+	"go/types"
+	"reflect"
+	"strconv"
+	"sync"
+
+	"github.com/fatih/structtag"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+// NewParser constructs a new schema parser.
+func NewParser(c *parsectx.Context, l *pkginfo.Loader) *Parser {
+	return &Parser{
+		c:     c,
+		l:     l,
+		decls: make(map[declKey]Decl),
+	}
+}
+
+// Parser parses Go types into Encore's schema format.
+type Parser struct {
+	c *parsectx.Context
+	l *pkginfo.Loader
+
+	declsMu sync.Mutex
+	decls   map[declKey]Decl // pkg/path.Name -> decl
+}
+
+// ParseType parses the schema from a type expression.
+func (p *Parser) ParseType(file *pkginfo.File, expr ast.Expr) Type {
+	r := p.newTypeResolver(nil, nil)
+	return r.parseType(file, expr)
+}
+
+// newTypeResolver is a helper function to create a new typeResolver.
+func (p *Parser) newTypeResolver(decl Decl, typeParamsInScope map[string]int) *typeResolver {
+	return &typeResolver{
+		p:                 p,
+		errs:              p.c.Errs,
+		decl:              decl,
+		typeParamsInScope: typeParamsInScope,
+	}
+}
+
+// typeResolver resolves types from AST expressions.
+type typeResolver struct {
+	// p is the parser that created this type resolver.
+	p    *Parser
+	errs *perr.List
+
+	// decl is the declaration being parsed, if any.
+	// It's nil if the type expression isn't attached to a declaration.
+	decl Decl
+
+	// typeParamsInScope contains the in-scope type parameters
+	// as part of the declaration being processed.
+	// It is nil if no declaration is being processed.
+	//
+	// The keys are the names of the type parameter ("T" and "U" in "type Foo[T any, U io.Reader]")
+	// and the values are the index of the type parameter in the declaration (above, 0 for T and 1 for U).
+	typeParamsInScope map[string]int
+}
+
+// parseType parses a type expression and returns it.
+//
+// This function will never return nil as it will Bailout upon any error.
+func (r *typeResolver) parseType(file *pkginfo.File, expr ast.Expr) Type {
+	typ := func() Type {
+		switch expr := expr.(type) {
+		case *ast.StarExpr:
+			// Pointer
+			return PointerType{
+				AST:  expr,
+				Elem: r.parseType(file, expr.X),
+			}
+
+		case *ast.Ident:
+			pkgNames := file.Pkg.Names()
+
+			// Check if we have a type parameter defined for this
+			if idx, ok := r.typeParamsInScope[expr.Name]; ok {
+				return TypeParamRefType{
+					AST:   expr,
+					Decl:  r.decl,
+					Index: idx,
+				}
+			}
+
+			// Local type name
+			if d, ok := pkgNames.PkgDecls[expr.Name]; ok && d.Type == token.TYPE {
+				return newNamedType(r.p, expr, d)
+			}
+
+			// Finally check if it's a built-in type
+			if b, ok := builtinTypes[expr.Name]; ok {
+				if b == unsupported {
+					r.errs.Addf(expr.Pos(), "unsupported type: %s", expr.Name)
+				}
+				return BuiltinType{
+					AST:  expr,
+					Kind: b,
+				}
+			}
+
+			switch expr.Name {
+			case "any":
+				return InterfaceType{
+					AST: &ast.InterfaceType{
+						// HACK: Set dummy positions to make the error messages nicer,
+						// pointing at "any" instead of reporting no position whatsoever.
+						Interface: expr.Pos(),
+						Methods: &ast.FieldList{
+							Opening: expr.Pos(),
+							Closing: expr.End() - 1,
+						},
+					},
+				}
+			}
+
+			r.errs.Addf(expr.Pos(), "undefined type: %s", expr.Name)
+
+		case *ast.SelectorExpr:
+			fileNames := file.Names()
+
+			// pkg.T
+			if pkgName, ok := expr.X.(*ast.Ident); ok {
+				pkgPath, ok := fileNames.ResolvePkgPath(pkgName.Pos(), pkgName.Name)
+				if !ok {
+					r.errs.Addf(expr.X.Pos(), "unknown package: %s", pkgName.Name)
+					r.errs.Bailout()
+				}
+
+				// Do we have a supported builtin?
+				if kind, ok := r.parseEncoreBuiltin(pkgPath, expr.Sel.Name); ok {
+					return BuiltinType{AST: expr, Kind: kind}
+				}
+
+				// Otherwise, load the external package and resolve the type.
+				otherPkg := r.p.l.MustLoadPkg(pkgName.Pos(), pkgPath)
+				if d, ok := otherPkg.Names().PkgDecls[expr.Sel.Name]; ok && d.Type == token.TYPE {
+					return newNamedType(r.p, expr, d)
+				}
+			}
+			r.errs.Addf(expr.Pos(), "%s is not a type", types.ExprString(expr))
+
+		case *ast.StructType:
+			st := StructType{
+				AST:    expr,
+				Fields: make([]StructField, 0, expr.Fields.NumFields()),
+			}
+
+			for _, field := range expr.Fields.List {
+				typ := r.parseType(file, field.Type)
+				if len(field.Names) == 0 {
+					// r.errs.AddPos(field.Pos(), "cannot use anonymous fields in Encore struct types")
+					continue
+				}
+
+				// Parse the struct tags, if any.
+				var tags structtag.Tags
+				if field.Tag != nil {
+					val, _ := strconv.Unquote(field.Tag.Value)
+					t, err := structtag.Parse(val)
+					if err != nil {
+						r.errs.Addf(field.Tag.Pos(), "invalid struct tag: %v", err.Error())
+					} else {
+						tags = *t
+					}
+				}
+
+				docs := field.Doc.Text()
+				if docs == "" {
+					docs = field.Comment.Text()
+				}
+
+				for _, name := range field.Names {
+					st.Fields = append(st.Fields, StructField{
+						AST:  field,
+						Name: option.Some(name.Name),
+						Type: typ,
+						Tag:  tags,
+						Doc:  docs,
+					})
+				}
+			}
+			return st
+
+		case *ast.MapType:
+			key := r.parseType(file, expr.Key)
+			value := r.parseType(file, expr.Value)
+			return MapType{
+				AST:   expr,
+				Key:   key,
+				Value: value,
+			}
+
+		case *ast.ArrayType:
+			elem := r.parseType(file, expr.Elt)
+
+			result := ListType{AST: expr, Len: -1, Elem: elem}
+			if expr.Len == nil {
+				// We have a slice, not an array.
+
+				// Translate list of bytes to the builtin Bytes kind.
+				if elem.Family() == Builtin && elem.(BuiltinType).Kind == Uint8 {
+					return BuiltinType{AST: expr, Kind: Bytes}
+				}
+				return result
+			}
+
+			// We have an array. Determine its length.
+
+			// It's possible to define arrays with length equal to some constant
+			// expression, but we don't support parsing that right now and treat
+			// it as a slice.
+			if basicLit, ok := expr.Len.(*ast.BasicLit); ok && basicLit.Kind == token.INT {
+				if n, err := strconv.Atoi(basicLit.Value); err == nil {
+					result.Len = n
+				}
+			}
+
+			// Fall back to a list type if we couldn't determine the length.
+			return result
+
+		case *ast.InterfaceType:
+			// TODO(andre) Parse more complete information about the interface.
+			typ := InterfaceType{AST: expr}
+
+			if expr.Methods != nil {
+				for _, field := range expr.Methods.List {
+					switch {
+					case len(field.Names) > 0:
+						typ.Methods = append(typ.Methods, field)
+					case field.Type == nil:
+						// shouldn't happen but let's be defensive
+					default:
+						// type switch or embedded interface
+						switch field.Type.(type) {
+						case *ast.BinaryExpr, *ast.UnaryExpr:
+							typ.TypeLists = append(typ.TypeLists, field.Type)
+						default:
+							t := r.parseType(file, field.Type)
+							typ.EmbeddedIfaces = append(typ.EmbeddedIfaces, t)
+						}
+					}
+				}
+			}
+
+			return typ
+
+		case *ast.ChanType:
+			r.errs.AddPos(expr.Pos(), "cannot use channel types in Encore schema definitions")
+
+		case *ast.FuncType:
+			return r.parseFuncType(file, expr)
+
+		case *ast.IndexExpr:
+			// Generic type application with a single type, like "Foo[int]"
+			return r.resolveTypeWithTypeArgs(file, expr, expr.X, []ast.Expr{expr.Index})
+
+		case *ast.IndexListExpr:
+			// Same as IndexExpr, but with multiple types, like "Foo[int, string]"
+			return r.resolveTypeWithTypeArgs(file, expr, expr.X, expr.Indices)
+
+		default:
+			r.errs.Addf(expr.Pos(), "%s is not a supported type; got %+v",
+				types.ExprString(expr), reflect.TypeOf(expr))
+		}
+		r.errs.Bailout()
+		return nil
+	}()
+
+	return typ
+}
+
+// parseFuncType parses an *ast.FuncType into a *FuncType.
+func (r *typeResolver) parseFuncType(file *pkginfo.File, ft *ast.FuncType) FuncType {
+	res := FuncType{
+		AST:     ft,
+		Params:  make([]Param, 0, ft.Params.NumFields()),
+		Results: make([]Param, 0, ft.Results.NumFields()),
+	}
+
+	// iters describes how to iterate over the parameters and results.
+	iters := []struct {
+		fields *ast.FieldList
+		dst    *[]Param
+	}{
+		{ft.Params, &res.Params},
+		{ft.Results, &res.Results},
+	}
+
+	// Loop over all the fields and parse the types.
+	for _, it := range iters {
+		// The fields are nil if the function has no parameters or results.
+		if it.fields == nil {
+			continue
+		}
+
+		for _, field := range it.fields.List {
+			typ := r.parseType(file, field.Type)
+			// If we have any names it means they all have names.
+			if len(field.Names) > 0 {
+				for _, name := range field.Names {
+					*it.dst = append(*it.dst, Param{
+						AST:  field,
+						Name: option.Some(name.Name),
+						Type: typ,
+					})
+				}
+			} else {
+				// Otherwise we have a type-only parameter.
+				*it.dst = append(*it.dst, Param{
+					AST:  field,
+					Name: option.None[string](),
+					Type: typ,
+				})
+			}
+		}
+	}
+
+	return res
+}
+
+func (r *typeResolver) resolveTypeWithTypeArgs(file *pkginfo.File, indexExpr, expr ast.Expr, typeArgs []ast.Expr) Type {
+	baseType := r.parseType(file, expr)
+	if baseType.Family() != Named {
+		r.errs.Addf(expr.Pos(), "cannot use type arguments with non-named type %s", types.ExprString(baseType.ASTExpr()))
+		return baseType
+	}
+
+	named := baseType.(NamedType)
+	named.AST = indexExpr // Use the index expression as the AST for the named type as we've resolved the type arguments.
+	decl := named.Decl()
+	if len(decl.TypeParams) != len(typeArgs) {
+		r.errs.Addf(expr.Pos(), "expected %d type parameters, got %d for reference to %s",
+			len(decl.TypeParams), len(typeArgs), decl.Name)
+		return baseType
+	}
+
+	named.TypeArgs = make([]Type, len(typeArgs))
+	for idx, expr := range typeArgs {
+		named.TypeArgs[idx] = r.parseType(file, expr)
+	}
+	return named
+}
+
+const (
+	uuidImportPath paths.Pkg = "encore.dev/types/uuid"
+	authImportPath paths.Pkg = "encore.dev/beta/auth"
+)
+
+// parseRecv parses a receiver AST into a Receiver.
+func (p *Parser) parseRecv(f *pkginfo.File, fields *ast.FieldList) (*Receiver, bool) {
+	if fields.NumFields() != 1 {
+		p.c.Errs.Add(errExpectedOnReciever(fields.NumFields()).AtGoNode(fields))
+		return nil, false
+	}
+
+	// To properly parse the receiver in the presence of type parameters,
+	// we first need to resolve what the named type is that the receiver is attached to
+	// WITHOUT the type parameters. Then we can construct a typeResolver
+	// with the correct decl context.
+	field := fields.List[0]
+	recvIdent := p.resolveReceiverIdent(field.Type)
+	pkgDecl := f.Pkg.Names().PkgDecls[recvIdent.Name]
+	if pkgDecl == nil {
+		p.c.Errs.Add(errUnknownIdentifier(recvIdent.Name).AtGoNode(recvIdent))
+		return nil, false
+	}
+	decl := p.ParseTypeDecl(pkgDecl)
+
+	// Now that we have the declaration we can create a type resolver that
+	// uses the type declaration's type parameters, and use that to resolve
+	// the receiver type.
+	typeParamsInScope, _ := computeDeclTypeParams(decl.AST.TypeParams)
+	tr := p.newTypeResolver(decl, typeParamsInScope)
+
+	recv := &Receiver{
+		AST:  fields,
+		Decl: decl,
+		Type: tr.parseType(f, field.Type),
+	}
+	if len(field.Names) > 0 {
+		recv.Name = option.Some(field.Names[0].Name)
+	}
+
+	return recv, true
+}
+
+// parseEncoreBuiltin returns the builtin kind for the given package path and name.
+// If the type is not one of the Encore builtins it reports (unsupported, false).
+func (r *typeResolver) parseEncoreBuiltin(pkgPath paths.Pkg, name string) (BuiltinKind, bool) {
+	switch {
+	case pkgPath == uuidImportPath && name == "UUID":
+		return UUID, true
+	case pkgPath == authImportPath && name == "UID":
+		return UserID, true
+	case pkgPath == "time" && name == "Time":
+		return Time, true
+	case pkgPath == "encoding/json" && name == "RawMessage":
+		return JSON, true
+	}
+	return unsupported, false
+}
+
+var builtinTypes = map[string]BuiltinKind{
+	"bool":       Bool,
+	"int":        Int,
+	"int8":       Int8,
+	"int16":      Int16,
+	"int32":      Int32,
+	"int64":      Int64,
+	"uint":       Uint,
+	"uint8":      Uint8,
+	"uint16":     Uint16,
+	"uint32":     Uint32,
+	"uint64":     Uint64,
+	"uintptr":    unsupported,
+	"float32":    Float32,
+	"float64":    Float64,
+	"complex64":  unsupported,
+	"complex128": unsupported,
+	"string":     String,
+	"byte":       Uint8,
+	"rune":       Uint32,
+	"error":      Error,
+}
+
+// resolveReceiverIdent resolves the identifier for the receiver of a method.
+// It recurses through *ast.StarExpr, *ast.IndexExpr and *ast.IndexListExpr
+// to handle pointer/non-pointer as well as methods on generic types.
+func (p *Parser) resolveReceiverIdent(expr ast.Expr) *ast.Ident {
+	orig := expr // keep track of original for error messages
+	for i := 0; i < 10; i++ {
+		switch x := expr.(type) {
+		case *ast.Ident:
+			// We're done
+			return x
+
+		case *ast.StarExpr:
+			expr = x.X
+		case *ast.IndexExpr:
+			expr = x.X
+		case *ast.IndexListExpr:
+			expr = x.X
+		default:
+			p.c.Errs.Addf(orig.Pos(), "invalid receiver expression: %s (invalid type %T)", types.ExprString(orig), x)
+		}
+	}
+	p.c.Errs.Fatalf(orig.Pos(), "invalid receiver expression: %s (recursion limit reached)", types.ExprString(orig))
+	return nil // unreachable
+}
+
+// newNamedType is a helper to construct a lazy-loaded NamedType.
+func newNamedType(p *Parser, expr ast.Expr, info *pkginfo.PkgDeclInfo) NamedType {
+	return NamedType{
+		AST:      expr,
+		DeclInfo: info,
+		decl: &lazyDecl{
+			p:    p,
+			info: info,
+		},
+	}
+}
+
+// newEagerNamedType is a helper to construct an eagerly loaded NamedType.
+func newEagerNamedType(expr ast.Expr, typeArgs []Type, decl *TypeDecl) NamedType {
+	lazy := &lazyDecl{}
+	lazy.once.Do(func() {}) // mark the lazy.once as used
+	lazy.decl = decl
+
+	return NamedType{
+		AST:      expr,
+		DeclInfo: decl.Info,
+		TypeArgs: typeArgs,
+		decl:     lazy,
+	}
+}
diff --git a/v2/internals/schema/schema_parser_test.go b/v2/internals/schema/schema_parser_test.go
new file mode 100644
index 0000000000..77a02824c4
--- /dev/null
+++ b/v2/internals/schema/schema_parser_test.go
@@ -0,0 +1,437 @@
+package schema
+
+import (
+	"go/ast"
+	"go/token"
+	"strconv"
+	"testing"
+
+	"github.com/fatih/structtag"
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/testutil"
+)
+
+func TestParser_ParseType(t *testing.T) {
+	type testCase struct {
+		name     string
+		imports  []string
+		typ      string
+		want     Type
+		wantErrs []string
+	}
+
+	file := fileForPkg("foo", "example.com")
+	tests := []testCase{
+		{
+			name: "builtin_int",
+			typ:  "int",
+			want: BuiltinType{Kind: Int, AST: ast.NewIdent("int")},
+		},
+		{
+			name:     "unsupported_builtin",
+			typ:      "uintptr",
+			wantErrs: []string{".*unsupported type: uintptr"},
+		},
+		{
+			name: "pointer",
+			typ:  "*string",
+			want: PointerType{Elem: BuiltinType{Kind: String, AST: ast.NewIdent("string")}},
+		},
+		{
+			name: "decl",
+			typ:  "foo\n\ntype foo int",
+			want: namedTypeWithDecl(&TypeDecl{
+				Name: "foo",
+				Type: BuiltinType{Kind: Int, AST: ast.NewIdent("int")},
+				File: file,
+			}),
+		},
+		{
+			name: "decl_with_type_params",
+			typ:  "foo[int]\n\ntype foo[T any] T",
+			want: namedTypeWithDecl(
+				(func() *TypeDecl {
+					d := new(TypeDecl)
+					*d = TypeDecl{
+						Name: "foo",
+						File: file,
+						Type: TypeParamRefType{
+							AST:   ast.NewIdent("T"),
+							Index: 0,
+							Decl:  d,
+						},
+						TypeParams: []DeclTypeParam{
+							{Name: "T"},
+						},
+					}
+					return d
+				})(),
+				BuiltinType{Kind: Int, AST: ast.NewIdent("int")},
+			),
+		},
+		{
+			name:    "builtin_encore_uuid",
+			imports: []string{"encore.dev/types/uuid"},
+			typ:     "uuid.UUID",
+			want:    BuiltinType{Kind: UUID, AST: ast.NewIdent("uuid.UUID")},
+		},
+		{
+			name:    "builtin_encore_userid",
+			imports: []string{"encore.dev/beta/auth"},
+			typ:     "auth.UID",
+			want:    BuiltinType{Kind: UserID, AST: ast.NewIdent("auth.UID")},
+		},
+		{
+			name:    "builtin_time",
+			imports: []string{"time"},
+			typ:     "time.Time",
+			want:    BuiltinType{Kind: Time, AST: ast.NewIdent("time.Time")},
+		},
+		{
+			name:    "builtin_json",
+			imports: []string{"encoding/json"},
+			typ:     "json.RawMessage",
+			want:    BuiltinType{Kind: JSON, AST: ast.NewIdent("json.RawMessage")},
+		},
+		{
+			name: "builtin_error",
+			typ:  "error",
+			want: BuiltinType{Kind: Error, AST: ast.NewIdent("error")},
+		},
+		{
+			name:    "external_stdlib_type",
+			imports: []string{"database/sql"},
+			typ:     "sql.NullString",
+			want: namedTypeWithDecl(&TypeDecl{
+				Name: "NullString",
+				File: fileForPkg("sql", "database/sql"),
+				Type: StructType{
+					Fields: []StructField{
+						{
+							Name: option.Some("String"),
+							Type: BuiltinType{Kind: String},
+						},
+						{
+							Name: option.Some("Valid"),
+							Type: BuiltinType{Kind: Bool},
+						},
+					},
+				},
+			}),
+		},
+		{
+			name: "map",
+			typ:  "map[struct{A int}]struct{}",
+			want: MapType{
+				Key: StructType{Fields: []StructField{
+					{Name: option.Some("A"), Type: BuiltinType{Kind: Int}},
+				}},
+				Value: StructType{},
+			},
+		},
+		{
+			name: "slice",
+			typ:  "[]bool",
+			want: ListType{
+				Elem: BuiltinType{Kind: Bool, AST: ast.NewIdent("bool")},
+				Len:  -1,
+			},
+		},
+		{
+			name: "array",
+			typ:  "[3]bool",
+			want: ListType{
+				Elem: BuiltinType{Kind: Bool, AST: ast.NewIdent("bool")},
+				Len:  3,
+			},
+		},
+		{
+			name: "array_unknown_const",
+			typ:  "[someConst]bool\nconst someConst = 3",
+			want: ListType{
+				Elem: BuiltinType{Kind: Bool, AST: ast.NewIdent("bool")},
+				Len:  -1, // unknown
+			},
+		},
+		{
+			name: "multi_generic",
+			typ:  "foo[int, string]\n\ntype foo[T any, U any] struct{A T; B U}",
+			want: namedTypeWithDecl(
+				(func() *TypeDecl {
+					d := new(TypeDecl)
+					*d = TypeDecl{
+						Name: "foo",
+						File: file,
+						Type: StructType{
+							Fields: []StructField{
+								{
+									Name: option.Some("A"),
+									Type: TypeParamRefType{
+										AST:   ast.NewIdent("A"),
+										Index: 0,
+										Decl:  d,
+									},
+								},
+								{
+									Name: option.Some("B"),
+									Type: TypeParamRefType{
+										AST:   ast.NewIdent("B"),
+										Index: 1,
+										Decl:  d,
+									},
+								},
+							},
+						},
+						TypeParams: []DeclTypeParam{
+							{Name: "T"},
+							{Name: "U"},
+						},
+					}
+					return d
+				})(),
+				BuiltinType{Kind: Int, AST: ast.NewIdent("int")},
+				BuiltinType{Kind: String, AST: ast.NewIdent("string")},
+			),
+		},
+	}
+
+	// testArchive renders the txtar archive to use for a given test.
+	testArchive := func(test testCase) *txtar.Archive {
+		imports := ""
+		if len(test.imports) > 0 {
+			imports = "import (\n"
+			for _, imp := range test.imports {
+				imports += "\t" + strconv.Quote(imp) + "\n"
+			}
+			imports += ")\n"
+		}
+
+		return testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+require encore.dev v1.13.4
+-- code.go --
+package foo
+` + imports + `
+
+var x ` + test.typ + `
+`)
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := qt.New(t)
+			a := testArchive(test)
+			tc := testutil.NewContext(c, false, a)
+			tc.GoModDownload()
+
+			l := pkginfo.New(tc.Context)
+			p := NewParser(tc.Context, l)
+
+			if len(test.wantErrs) > 0 {
+				defer tc.DeferExpectError(test.wantErrs...)
+			} else {
+				tc.FailTestOnErrors()
+				defer tc.FailTestOnBailout()
+			}
+
+			pkg := l.MustLoadPkg(token.NoPos, "example.com")
+			f := pkg.Files[0]
+			typeExpr := pkg.Names().PkgDecls["x"].Spec.(*ast.ValueSpec).Type
+			got := p.ParseType(f, typeExpr)
+
+			if len(test.wantErrs) == 0 {
+				// Check for equality, ignoring all the AST nodes and pkginfo types.
+				var options []cmp.Option
+				options = []cmp.Option{
+					cmpopts.IgnoreInterfaces(struct{ ast.Node }{}),
+					cmpopts.IgnoreTypes(&pkginfo.File{}),
+					cmpopts.EquateEmpty(),
+					cmpopts.IgnoreUnexported(StructField{}, structtag.Tags{}),
+					cmp.Comparer(func(a, b *pkginfo.Package) bool {
+						return a.ImportPath == b.ImportPath
+					}),
+					cmp.Comparer(func(a, b NamedType) bool {
+						return cmp.Equal(a.Decl(), b.Decl(), options...) && cmp.Equal(a.TypeArgs, b.TypeArgs, options...)
+					}),
+				}
+
+				c.Assert(got.String(), qt.CmpEquals(options...), test.want.String())
+			}
+		})
+	}
+}
+
+func TestParser_ParseFuncDecl(t *testing.T) {
+	type testCase struct {
+		name     string
+		imports  []string
+		decl     string
+		want     *FuncDecl
+		wantErrs []string
+	}
+	file := fileForPkg("foo", "example.com")
+	tests := []testCase{
+		{
+			name: "simple",
+			decl: "func x() {}",
+			want: &FuncDecl{
+				Name: "x",
+				File: fileForPkg("foo", "example.com"),
+				Recv: option.None[*Receiver](),
+				Type: FuncType{
+					Params:  nil,
+					Results: nil,
+				},
+			},
+		},
+		{
+			name: "recv",
+			decl: "type Foo[A, B any] struct{}\nfunc (f *Foo[A, B]) x() {}",
+			want: &FuncDecl{
+				Name: "x",
+				File: file,
+				Recv: option.Some((func() *Receiver {
+					FooDecl := &TypeDecl{
+						File:       file,
+						Name:       "Foo",
+						Type:       StructType{},
+						TypeParams: []DeclTypeParam{{Name: "A"}, {Name: "B"}},
+					}
+
+					return &Receiver{
+						Name: option.Some("f"),
+						Decl: FooDecl,
+						Type: PointerType{
+							Elem: namedTypeWithDecl(FooDecl,
+								TypeParamRefType{
+									Decl:  FooDecl,
+									Index: 0,
+								},
+								TypeParamRefType{
+									Decl:  FooDecl,
+									Index: 1,
+								},
+							),
+						},
+					}
+				})()),
+				Type: FuncType{
+					Params:  nil,
+					Results: nil,
+				},
+			},
+		},
+	}
+
+	// testArchive renders the txtar archive to use for a given test.
+	testArchive := func(test testCase) *txtar.Archive {
+		imports := ""
+		if len(test.imports) > 0 {
+			imports = "import (\n"
+			for _, imp := range test.imports {
+				imports += "\t" + strconv.Quote(imp) + "\n"
+			}
+			imports += ")\n"
+		}
+
+		return testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+require encore.dev v1.13.4
+-- code.go --
+package foo
+` + imports + `
+
+` + test.decl + `
+`)
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := qt.New(t)
+			a := testArchive(test)
+			tc := testutil.NewContext(c, false, a)
+			tc.GoModDownload()
+
+			l := pkginfo.New(tc.Context)
+			p := NewParser(tc.Context, l)
+
+			if len(test.wantErrs) > 0 {
+				defer tc.DeferExpectError(test.wantErrs...)
+			} else {
+				tc.FailTestOnErrors()
+				defer tc.FailTestOnBailout()
+			}
+
+			pkg := l.MustLoadPkg(token.NoPos, "example.com")
+
+			// Find the first func decl.
+			var fd *ast.FuncDecl
+			f := pkg.Files[0]
+			for _, decl := range f.AST().Decls {
+				if f, ok := decl.(*ast.FuncDecl); ok {
+					fd = f
+					break
+				}
+			}
+			c.Assert(fd, qt.IsNotNil)
+
+			got, ok := p.ParseFuncDecl(f, fd)
+			c.Assert(ok, qt.IsTrue)
+
+			if len(test.wantErrs) == 0 {
+				// Check for equality, ignoring all the AST nodes and pkginfo types.
+				var options []cmp.Option
+				options = []cmp.Option{
+					cmpopts.IgnoreInterfaces(struct{ ast.Node }{}),
+					cmpopts.IgnoreTypes(&pkginfo.File{}),
+					cmpopts.EquateEmpty(),
+					cmpopts.IgnoreUnexported(StructField{}),
+					cmp.Comparer(func(a, b *pkginfo.Package) bool {
+						return a.ImportPath == b.ImportPath
+					}),
+					cmp.Comparer(func(a, b NamedType) bool {
+						return cmp.Equal(a.Decl(), b.Decl(), options...) && cmp.Equal(a.TypeArgs, b.TypeArgs, options...)
+					}),
+				}
+
+				c.Assert(got.String(), qt.CmpEquals(options...), test.want.String())
+			}
+		})
+	}
+}
+
+func namedTypeWithDecl(decl *TypeDecl, typeArgs ...Type) NamedType {
+	lazy := &lazyDecl{}
+	lazy.once.Do(func() {}) // mark the lazy.once as used
+	lazy.decl = decl
+
+	return NamedType{
+		AST:      nil,
+		TypeArgs: typeArgs,
+		// Approximate the PkgDeclInfo
+		DeclInfo: &pkginfo.PkgDeclInfo{
+			Name: decl.Name,
+			File: decl.File,
+			Pos:  token.NoPos,
+			Type: token.TYPE,
+			Spec: decl.AST,
+		},
+		decl: lazy,
+	}
+}
+
+func fileForPkg(pkgName string, pkgPath paths.Pkg) *pkginfo.File {
+	return &pkginfo.File{Pkg: &pkginfo.Package{
+		Name:       pkgName,
+		ImportPath: pkgPath,
+	}}
+}
diff --git a/v2/internals/schema/schematest/schematest.go b/v2/internals/schema/schematest/schematest.go
new file mode 100644
index 0000000000..32f518ccc7
--- /dev/null
+++ b/v2/internals/schema/schematest/schematest.go
@@ -0,0 +1,53 @@
+// Package schematest provides utilities for writing tests
+// that make assertions about schema types and declarations.
+package schematest
+
+import (
+	"go/token"
+
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+)
+
+func Ptr(elem schema.Type) schema.Type {
+	return schema.PointerType{Elem: elem}
+}
+
+func Builtin(kind schema.BuiltinKind) schema.BuiltinType {
+	return schema.BuiltinType{Kind: kind}
+}
+
+func Named(info *pkginfo.PkgDeclInfo) schema.Type {
+	return schema.NamedType{DeclInfo: info}
+}
+
+func Slice(elem schema.Type) schema.Type {
+	return schema.ListType{Elem: elem}
+}
+
+func TypeInfo(name string) *pkginfo.PkgDeclInfo {
+	return &pkginfo.PkgDeclInfo{
+		Name: name,
+		Type: token.TYPE,
+	}
+}
+
+func Param(typ schema.Type) schema.Param {
+	return schema.Param{Type: typ}
+}
+
+func String() schema.BuiltinType {
+	return Builtin(schema.String)
+}
+
+func Bool() schema.BuiltinType {
+	return Builtin(schema.Bool)
+}
+
+func Int() schema.BuiltinType {
+	return Builtin(schema.Int)
+}
+
+func Error() schema.BuiltinType {
+	return Builtin(schema.Error)
+}
diff --git a/v2/internals/schema/schemautil/astutil.go b/v2/internals/schema/schemautil/astutil.go
new file mode 100644
index 0000000000..db1e0bb446
--- /dev/null
+++ b/v2/internals/schema/schemautil/astutil.go
@@ -0,0 +1,30 @@
+package schemautil
+
+import (
+	"go/ast"
+
+	"encr.dev/pkg/option"
+)
+
+// GetArgument gets the n'th argument from the field list.
+// It reports the name of the n'th argument if it has one.
+func GetArgument(fields *ast.FieldList, n int) (f *ast.Field, name option.Option[string]) {
+	idx := 0
+	for _, f := range fields.List {
+		num := len(f.Names)
+		if num == 0 {
+			num = 1
+		}
+		for i := 0; i < num; i++ {
+			if idx == n {
+				var name option.Option[string]
+				if hasName := i < len(f.Names); hasName {
+					name = option.Some(f.Names[i].Name)
+				}
+				return f, name
+			}
+			idx++
+		}
+	}
+	return nil, option.None[string]()
+}
diff --git a/v2/internals/schema/schemautil/astutil_test.go b/v2/internals/schema/schemautil/astutil_test.go
new file mode 100644
index 0000000000..d6a04803d4
--- /dev/null
+++ b/v2/internals/schema/schemautil/astutil_test.go
@@ -0,0 +1,99 @@
+package schemautil
+
+import (
+	"go/ast"
+	"reflect"
+	"testing"
+
+	"encr.dev/pkg/option"
+)
+
+func TestGetArgument(t *testing.T) {
+	noName := &ast.Field{
+		Names: nil,
+		Type:  ast.NewIdent("noName"),
+	}
+	oneName := &ast.Field{
+		Names: []*ast.Ident{ast.NewIdent("a")},
+		Type:  ast.NewIdent("oneName"),
+	}
+	twoNames := &ast.Field{
+		Names: []*ast.Ident{ast.NewIdent("b"), ast.NewIdent("c")},
+		Type:  ast.NewIdent("twoNames"),
+	}
+	tests := []struct {
+		name     string
+		fields   []*ast.Field
+		n        int
+		wantF    *ast.Field
+		wantName option.Option[string]
+	}{
+		{
+			name:     "empty",
+			fields:   []*ast.Field{},
+			n:        0,
+			wantF:    nil,
+			wantName: option.None[string](),
+		},
+		{
+			name:     "noName",
+			fields:   []*ast.Field{noName},
+			n:        0,
+			wantF:    noName,
+			wantName: option.None[string](),
+		},
+		{
+			name:     "noName_overflow",
+			fields:   []*ast.Field{noName},
+			n:        1,
+			wantF:    nil,
+			wantName: option.None[string](),
+		},
+		{
+			name:     "multi_noName",
+			fields:   []*ast.Field{noName, noName},
+			n:        1,
+			wantF:    noName,
+			wantName: option.None[string](),
+		},
+		{
+			name:     "first",
+			fields:   []*ast.Field{oneName, twoNames},
+			n:        0,
+			wantF:    oneName,
+			wantName: option.Some("a"),
+		},
+		{
+			name:     "second",
+			fields:   []*ast.Field{oneName, twoNames},
+			n:        1,
+			wantF:    twoNames,
+			wantName: option.Some("b"),
+		},
+		{
+			name:     "third",
+			fields:   []*ast.Field{oneName, twoNames},
+			n:        2,
+			wantF:    twoNames,
+			wantName: option.Some("c"),
+		},
+		{
+			name:     "fourth",
+			fields:   []*ast.Field{oneName, twoNames, noName},
+			n:        3,
+			wantF:    noName,
+			wantName: option.None[string](),
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			gotF, gotName := GetArgument(&ast.FieldList{List: tt.fields}, tt.n)
+			if !reflect.DeepEqual(gotF, tt.wantF) {
+				t.Errorf("GetArgument() gotF = %v, want %v", gotF, tt.wantF)
+			}
+			if !reflect.DeepEqual(gotName, tt.wantName) {
+				t.Errorf("GetArgument() gotName = %v, want %v", gotName, tt.wantName)
+			}
+		})
+	}
+}
diff --git a/v2/internals/schema/schemautil/errors.go b/v2/internals/schema/schemautil/errors.go
new file mode 100644
index 0000000000..165fcb85cb
--- /dev/null
+++ b/v2/internals/schema/schemautil/errors.go
@@ -0,0 +1,19 @@
+package schemautil
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"schema",
+		"For more information, see https://encore.dev/docs/develop/api-schemas",
+
+		errors.WithRangeSize(10),
+	)
+
+	errMissingTypeArg = errRange.New(
+		"Missing type argument",
+		"Missing type argument",
+	)
+)
diff --git a/v2/internals/schema/schemautil/schemautil.go b/v2/internals/schema/schemautil/schemautil.go
new file mode 100644
index 0000000000..5fa392ae74
--- /dev/null
+++ b/v2/internals/schema/schemautil/schemautil.go
@@ -0,0 +1,469 @@
+package schemautil
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"fmt"
+	"go/ast"
+	"go/types"
+	"reflect"
+	"slices"
+	"strconv"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+)
+
+// IsNamed reports whether a given type is a named type with the given
+// package path and name.
+func IsNamed(t schema.Type, pkg paths.Pkg, name string) bool {
+	if named, ok := t.(schema.NamedType); ok {
+		decl := named.DeclInfo
+		return decl.Name == name && decl.File.Pkg.ImportPath == pkg
+	}
+	return false
+}
+
+// IsPointer reports whether t is a pointer type.
+func IsPointer(t schema.Type) bool {
+	_, ok := t.(schema.PointerType)
+	return ok
+}
+
+// IsBuiltinKind reports whether the given type is a builtin
+// of one of the given kinds.
+func IsBuiltinKind(t schema.Type, kinds ...schema.BuiltinKind) bool {
+	if b, ok := t.(schema.BuiltinType); ok {
+		for _, k := range kinds {
+			if b.Kind == k {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+// IsBuiltinOrList reports whether the given type is a builtin,
+// a list of builtins, or neither.
+func IsBuiltinOrList(t schema.Type) (kind schema.BuiltinKind, isList bool, ok bool) {
+	if b, ok := t.(schema.BuiltinType); ok {
+		return b.Kind, false, true
+	}
+	if list, ok := t.(schema.ListType); ok {
+		if b, ok := list.Elem.(schema.BuiltinType); ok {
+			return b.Kind, true, true
+		}
+	}
+	return schema.Invalid, false, false
+}
+
+var Signed = []schema.BuiltinKind{
+	schema.Int,
+	schema.Int8,
+	schema.Int16,
+	schema.Int32,
+	schema.Int64,
+}
+
+var Unsigned = []schema.BuiltinKind{
+	schema.Uint,
+	schema.Uint8,
+	schema.Uint16,
+	schema.Uint32,
+	schema.Uint64,
+}
+
+// Integers is a list of all integer builtin kinds.
+var Integers = append(append([]schema.BuiltinKind{}, Signed...), Unsigned...)
+
+// Deref dereferences a type until it is not a pointer type.
+// It returns the number of pointer dereferences required.
+func Deref(t schema.Type) (schema.Type, int) {
+	n := 0
+	for {
+		if ptr, ok := t.(schema.PointerType); ok {
+			t = ptr.Elem
+			n++
+			continue
+		}
+		return t, n
+	}
+}
+
+// ResolveNamedStruct reports whether a given type is a named type
+// pointing to a struct type.
+//
+// It always requires at most one pointer dereference, and if
+// requirePointer is true it must be exactly one pointer dereference.
+//
+// If it doesn't match the requirements it returns (nil, false).
+func ResolveNamedStruct(t schema.Type, requirePointer bool) (ref *schema.TypeDeclRef, ok bool) {
+	t, derefs := Deref(t)
+	if derefs > 1 || (requirePointer && derefs == 0) {
+		return nil, false
+	}
+
+	if named, ok := t.(schema.NamedType); ok {
+		if decl := named.Decl(); decl.Type.Family() == schema.Struct {
+			return &schema.TypeDeclRef{
+				Decl:     decl,
+				Pointers: derefs,
+				TypeArgs: named.TypeArgs,
+			}, true
+		}
+	}
+	return nil, false
+}
+
+// DerefNamedInfo returns what package declaration a given named type references, if any.
+//
+// It always requires at most one pointer dereference, and if
+// requirePointer is true it must be exactly one pointer dereference.
+//
+// If the type is not a named type or otherwise doesn't match the requirements, it returns (nil, false).
+func DerefNamedInfo(t schema.Type, requirePointer bool) (info *pkginfo.PkgDeclInfo, ok bool) {
+	t, derefs := Deref(t)
+	if derefs > 1 || (requirePointer && derefs == 0) {
+		return nil, false
+	}
+	if named, ok := t.(schema.NamedType); ok {
+		return named.DeclInfo, true
+	}
+	return nil, false
+}
+
+// ConcretizeGenericType takes a type and applies any type arguments
+// into the slots of the type parameters, producing a concrete type.
+//
+// To be more robust in the presence of typing errors it supports partial application,
+// where the number of type arguments may be different than the number of type parameters on the decl.
+func ConcretizeGenericType(errs *perr.List, typ schema.Type) schema.Type {
+	return concretize(errs, typ.ASTExpr(), typ, nil, nil)
+}
+
+// ConcretizeWithTypeArgs is like ConcretizeGenericType but operates with
+// a list of type arguments. It is used when the type arguments are known
+// separately from the type itself, such as when using *schema.TypeDeclRef.
+func ConcretizeWithTypeArgs(errs *perr.List, typ schema.Type, typeArgs []schema.Type) schema.Type {
+	return concretize(errs, typ.ASTExpr(), typ, typeArgs, nil)
+}
+
+func concretize(errs *perr.List, referencedFrom ast.Node, typ schema.Type, typeArgs []schema.Type, seenDecls map[TypeHash]*schema.TypeDecl) schema.Type {
+	// seenDecls is used to avoid infinite recursion
+	// for mutually recursive types.
+	if seenDecls == nil {
+		seenDecls = make(map[TypeHash]*schema.TypeDecl)
+	}
+
+	switch typ := typ.(type) {
+	case schema.TypeParamRefType:
+		// We have a reference to a type parameter.
+		// Is the corresponding type argument in scope? If so replace it.
+		if typ.Index < len(typeArgs) {
+			return typeArgs[typ.Index]
+		} else {
+			errs.Add(
+				errMissingTypeArg.
+					AtGoNode(typ.AST),
+			)
+			return typ // return the type param ref as a placeholder
+		}
+
+	case schema.BuiltinType:
+		return typ
+	case schema.PointerType:
+		return schema.PointerType{AST: typ.AST, Elem: concretize(errs, typ.AST, typ.Elem, typeArgs, seenDecls)}
+	case schema.ListType:
+		return schema.ListType{AST: typ.AST, Elem: concretize(errs, typ.AST.Elt, typ.Elem, typeArgs, seenDecls), Len: typ.Len}
+	case schema.MapType:
+		return schema.MapType{
+			AST:   typ.AST,
+			Key:   concretize(errs, typ.AST.Key, typ.Key, typeArgs, seenDecls),
+			Value: concretize(errs, typ.AST.Value, typ.Value, typeArgs, seenDecls),
+		}
+	case schema.StructType:
+		result := schema.StructType{
+			AST:    typ.AST,
+			Fields: make([]schema.StructField, len(typ.Fields)),
+		}
+		for i, f := range typ.Fields {
+			result.Fields[i] = f // copy
+			result.Fields[i].Type = concretize(errs, f.AST.Type, f.Type, typeArgs, seenDecls)
+		}
+		return result
+	case schema.NamedType:
+		if typParams := typ.Decl().TypeParams; len(typParams) > len(typ.TypeArgs) {
+			numMissing := len(typParams) - len(typ.TypeArgs)
+			idx := len(typParams) - numMissing
+			errs.Add(
+				errMissingTypeArg.
+					AtGoNode(referencedFrom, errors.AsError("missing from here")).
+					AtGoNode(typParams[idx].AST, errors.AsHelp("missing type parameter defined here")),
+			)
+			return typ // return the named type as a placeholder
+		}
+
+		// Clone the named type. Clone the slice so we don't overwrite the original.
+		clone := typ
+		clone.TypeArgs = slices.Clone(typ.TypeArgs)
+
+		for i, arg := range clone.TypeArgs {
+			clone.TypeArgs[i] = concretize(errs, typ.AST, arg, typeArgs, seenDecls)
+		}
+
+		// If we've already seen this declaration, don't clone it to avoid
+		// infinite recursion.
+		hash := Hash(typ)
+		if decl, ok := seenDecls[hash]; ok {
+			return clone.WithDecl(decl)
+		}
+
+		decl := clone.Decl().Clone()
+
+		// Clone and concretize the declaration.
+		seenDecls[hash] = decl
+		decl.Type = concretize(errs, typ.AST, decl.Type, clone.TypeArgs, seenDecls)
+		return clone.WithDecl(decl)
+
+	case schema.FuncType:
+		// Clone the function type. Clone the slices so we don't overwrite the original.
+		clone := typ // copy
+		clone.Params = slices.Clone(typ.Params)
+		clone.Results = slices.Clone(typ.Results)
+
+		for i, p := range clone.Params {
+			clone.Params[i].Type = concretize(errs, p.AST.Type, p.Type, typeArgs, seenDecls)
+		}
+		for i, p := range clone.Results {
+			clone.Results[i].Type = concretize(errs, p.AST.Type, p.Type, typeArgs, seenDecls)
+		}
+		return clone
+	case schema.InterfaceType:
+		// TODO(andre) we currently don't track any information
+		// about interfaces, so nothing to do right now.
+		return typ
+	default:
+		panic(fmt.Sprintf("unknown type %T", typ))
+	}
+}
+
+type pkgDeclKey struct {
+	pkg  paths.Pkg
+	name string
+}
+
+// Walk performs a depth-first walk of all schema nodes starting at node, calling visitor for each type.
+//
+// If visitor returns false, the walk is aborted.
+func Walk(root schema.Type, visitor func(node schema.Type) bool) {
+	declChain := make([]pkgDeclKey, 0, 10)
+	walk(root, visitor, declChain)
+}
+
+func walk(node schema.Type, visitor func(typ schema.Type) bool, declChain []pkgDeclKey) bool {
+	// Check the visitor against the node type
+	if !visitor(node) {
+		return false
+	}
+
+	switch node := node.(type) {
+	case schema.NamedType:
+		for _, typ := range node.TypeArgs {
+			if !walk(typ, visitor, declChain) {
+				return false
+			}
+		}
+
+		// Have we already visited this decl?
+		declKey := pkgDeclKey{pkg: node.DeclInfo.File.Pkg.ImportPath, name: node.DeclInfo.Name}
+		for i := len(declChain) - 1; i >= 0; i-- {
+			if declChain[i] == declKey {
+				return true // keep going elsewhere
+			}
+		}
+		declChain = append(declChain, declKey)
+
+		return walk(node.Decl().Type, visitor, declChain)
+	case schema.StructType:
+		for _, field := range node.Fields {
+			if !walk(field.Type, visitor, declChain) {
+				return false
+			}
+		}
+	case schema.MapType:
+		if !walk(node.Key, visitor, declChain) {
+			return false
+		}
+		return walk(node.Value, visitor, declChain)
+	case schema.ListType:
+		return walk(node.Elem, visitor, declChain)
+	case schema.BuiltinType:
+		return true // keep going elsewhere
+	case schema.PointerType:
+		return walk(node.Elem, visitor, declChain)
+	case schema.FuncType:
+		for _, part := range [...][]schema.Param{node.Params, node.Results} {
+			for _, p := range part {
+				if !walk(p.Type, visitor, declChain) {
+					return false
+				}
+			}
+		}
+		return true
+	case schema.InterfaceType:
+		return true
+	case schema.TypeParamRefType:
+		return true
+	default:
+		panic(fmt.Sprintf("unsupported node type encountered during walk: %+v", reflect.TypeOf(node)))
+	}
+
+	return true
+}
+
+type TypeHash [32]byte
+
+// Hash produces a hash of the given type.
+// Identical types return identical hashes.
+func Hash(typ schema.Type) TypeHash {
+	var buf bytes.Buffer
+	hashType(&buf, typ)
+	return sha256.Sum256(buf.Bytes())
+}
+
+func hashType(buf *bytes.Buffer, t schema.Type) {
+	switch t := t.(type) {
+	case schema.NamedType:
+		buf.WriteString("named:")
+		buf.WriteString(t.DeclInfo.File.Pkg.ImportPath.String())
+		buf.WriteString(".")
+		buf.WriteString(t.DeclInfo.Name)
+		if len(t.TypeArgs) > 0 {
+			buf.WriteString("[")
+			for i, arg := range t.TypeArgs {
+				if i > 0 {
+					buf.WriteString(", ")
+				}
+				hashType(buf, arg)
+			}
+			buf.WriteString("]")
+		}
+
+	case schema.StructType:
+		buf.WriteString("struct{")
+		for _, f := range t.Fields {
+			if name, ok := f.Name.Get(); ok {
+				buf.WriteString(name)
+				hashType(buf, f.Type)
+				buf.WriteString(";")
+			}
+		}
+		buf.WriteString("}")
+
+	case schema.MapType:
+		buf.WriteString("map[")
+		hashType(buf, t.Key)
+		buf.WriteString("]")
+		hashType(buf, t.Value)
+
+	case schema.ListType:
+		if t.Len >= 0 {
+			fmt.Fprintf(buf, "[%d]", t.Len)
+		} else {
+			buf.WriteString("[]")
+		}
+		hashType(buf, t.Elem)
+
+	case schema.PointerType:
+		buf.WriteString("*")
+		hashType(buf, t.Elem)
+
+	case schema.FuncType:
+		buf.WriteString("func(")
+		for i, p := range t.Params {
+			if i > 0 {
+				buf.WriteString(", ")
+			}
+			hashType(buf, p.Type)
+		}
+		buf.WriteString(")")
+
+		if len(t.Results) > 0 {
+			buf.WriteString(" (")
+			for i, p := range t.Results {
+				if i > 0 {
+					buf.WriteString(", ")
+				}
+				hashType(buf, p.Type)
+			}
+			buf.WriteString(")")
+		}
+
+	case schema.InterfaceType:
+		// We don't track interface methods yet, so outsource
+		// this to go/types for now.
+		types.WriteExpr(buf, t.AST)
+
+	case schema.BuiltinType:
+		buf.WriteString(t.String())
+
+	case schema.TypeParamRefType:
+		buf.WriteString("typeparamref:")
+		buf.WriteString(t.Decl.DeclaredIn().Pkg.ImportPath.String())
+		buf.WriteString(".")
+		if name, ok := t.Decl.PkgName().Get(); ok {
+			buf.WriteString(name)
+		} else {
+			buf.WriteString("anon")
+		}
+		buf.WriteString("#")
+		buf.WriteString(strconv.Itoa(t.Index))
+
+	default:
+		panic(fmt.Sprintf("unknown type %T", t))
+	}
+}
+
+// UnwrapConfigType unwraps a config.Value[T] or config.Values[T] type to T or []T respectively.
+// If the type is not a config.Value[T] or config.Values[T] type, it returns the type unchanged.
+// If there are any errors encountered they are reported to errs.
+func UnwrapConfigType(errs *perr.List, t schema.NamedType) (typ schema.Type, isList, isConfig bool) {
+	if t.DeclInfo.File.Pkg.ImportPath != "encore.dev/config" {
+		return t, false, false
+	}
+
+	if t.DeclInfo.Name == "Values" {
+		if len(t.TypeArgs) == 0 {
+			// Invalid use of config.Values[T]
+			errs.AddPos(t.AST.Pos(), "invalid use of config.Values[T]: no type arguments provided")
+			return schema.BuiltinType{Kind: schema.Invalid}, true, true
+		}
+
+		return t.TypeArgs[0], true, true
+	} else if t.DeclInfo.Name == "Value" {
+		if len(t.TypeArgs) == 0 {
+			// Invalid use of config.Value[T]
+			errs.AddPos(t.AST.Pos(), "invalid use of config.Value[T]: no type arguments provided")
+			return schema.BuiltinType{Kind: schema.Invalid}, false, true
+		}
+		return t.TypeArgs[0], false, true
+	} else {
+		// Use of some helper type alias, like config.Bool
+		decl := t.Decl()
+		if named, ok := decl.Type.(schema.NamedType); ok && named.DeclInfo.Name == "Value" {
+			if len(named.TypeArgs) == 0 {
+				// Invalid use of config.Value[T]
+				errs.AddPos(t.AST.Pos(), "invalid use of config.Value[T]: no type arguments provided")
+				return schema.BuiltinType{Kind: schema.Invalid}, false, true
+			}
+			return named.TypeArgs[0], false, true
+		} else {
+			// Invalid use of config.Value[T]
+			errs.Addf(t.AST.Pos(), "unrecognized config type: %s", t.DeclInfo.Name)
+			return schema.BuiltinType{Kind: schema.Invalid}, false, true
+		}
+	}
+}
diff --git a/v2/internals/schema/types.go b/v2/internals/schema/types.go
new file mode 100644
index 0000000000..d87c8b94b0
--- /dev/null
+++ b/v2/internals/schema/types.go
@@ -0,0 +1,259 @@
+package schema
+
+import (
+	"go/ast"
+	"go/types"
+	"sync"
+
+	"github.com/fatih/structtag"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+type TypeFamily int
+
+const (
+	Unknown TypeFamily = iota
+	Named
+	Struct
+	Map
+	List
+	Builtin
+	Pointer
+	Func
+	Interface
+	TypeParamRef
+)
+
+type Type interface {
+	Family() TypeFamily
+	ASTExpr() ast.Expr
+	String() string // Resolve to a string representation of the type.
+}
+
+type NamedType struct {
+	AST ast.Expr // *ast.Ident or *ast.SelectorExpr
+
+	// DeclInfo is the declaration info for the declaration
+	// this refers to.
+	DeclInfo *pkginfo.PkgDeclInfo
+
+	// TypeArgs are the type arguments used to instantiate this named type.
+	TypeArgs []Type
+
+	// decl lazy-initializes the type declaration.
+	// It's a pointer since it's stateful via sync.Once.
+	decl *lazyDecl
+}
+
+// lazyDecl is a lazily-initialized type decl.
+type lazyDecl struct {
+	p    *Parser
+	info *pkginfo.PkgDeclInfo
+
+	once sync.Once
+	decl *TypeDecl
+}
+
+func (t NamedType) Decl() *TypeDecl {
+	return t.decl.Decl()
+}
+
+func (t NamedType) WithDecl(decl *TypeDecl) NamedType {
+	return newEagerNamedType(t.AST, t.TypeArgs, decl)
+}
+
+func (d *lazyDecl) Decl() *TypeDecl {
+	d.once.Do(func() {
+		d.decl = d.p.ParseTypeDecl(d.info)
+	})
+	return d.decl
+}
+
+type StructType struct {
+	AST    *ast.StructType
+	Fields []StructField
+}
+
+type StructField struct {
+	// AST is the AST node that this field represents.
+	// Note that multiple fields may share the same *ast.Field node,
+	// in cases with multiple names, like "Foo, Bar int".
+	AST *ast.Field
+
+	Name option.Option[string] // field name, or None if anonymous
+	Type Type
+	Doc  string
+	Tag  structtag.Tags
+}
+
+func (f *StructField) IsAnonymous() bool {
+	return f.Name.Empty()
+}
+
+func (f *StructField) IsExported() bool {
+	return f.IsAnonymous() || f.Name.Contains(ast.IsExported)
+}
+
+type MapType struct {
+	AST   *ast.MapType
+	Key   Type
+	Value Type
+}
+
+type ListType struct {
+	AST  *ast.ArrayType
+	Len  int // -1 for a slice
+	Elem Type
+}
+
+type PointerType struct {
+	AST  *ast.StarExpr
+	Elem Type
+}
+
+type BuiltinType struct {
+	AST  ast.Expr
+	Kind BuiltinKind
+}
+
+type FuncType struct {
+	AST     *ast.FuncType
+	Params  []Param
+	Results []Param
+}
+
+type InterfaceType struct {
+	AST *ast.InterfaceType
+
+	// EmbeddedIfaces are the interfaces this interface embeds.
+	EmbeddedIfaces []Type
+
+	// TODO change these out for more useful information.
+	TypeLists []ast.Expr
+	Methods   []*ast.Field
+}
+
+// Param represents a parameter or result field.
+type Param struct {
+	AST  *ast.Field
+	Name option.Option[string] // parameter name, or None if a type-only parameter.
+	Type Type
+}
+
+// TypeParamRefType is a reference to a `TypeParameter` within a declaration block
+type TypeParamRefType struct {
+	AST *ast.Ident
+
+	Decl  Decl // the declaration this type parameter is defined on
+	Index int  // Index into the type parameter slice on the declaration
+}
+
+type BuiltinKind int
+
+//go:generate stringer -type=BuiltinKind -output=types_string.go
+
+const (
+	Invalid BuiltinKind = iota
+	Any
+	Bool
+
+	Int
+	Int8
+	Int16
+	Int32
+	Int64
+	Uint
+	Uint8
+	Uint16
+	Uint32
+	Uint64
+
+	Float32
+	Float64
+	String
+	Bytes
+
+	// Additional Encore Types
+
+	Time
+	UUID
+	JSON
+	UserID
+	Error // builtin "error" type, for convenience
+
+	// unsupported is a special value used
+	// to indicate the particular builtin is known,
+	// but is not something Encore supports.
+	unsupported BuiltinKind = -1
+)
+
+var _ Type = NamedType{}
+var _ Type = StructType{}
+var _ Type = MapType{}
+var _ Type = ListType{}
+var _ Type = PointerType{}
+var _ Type = BuiltinType{}
+var _ Type = FuncType{}
+var _ Type = InterfaceType{}
+var _ Type = TypeParamRefType{}
+
+func (NamedType) Family() TypeFamily        { return Named }
+func (StructType) Family() TypeFamily       { return Struct }
+func (MapType) Family() TypeFamily          { return Map }
+func (ListType) Family() TypeFamily         { return List }
+func (PointerType) Family() TypeFamily      { return Pointer }
+func (BuiltinType) Family() TypeFamily      { return Builtin }
+func (FuncType) Family() TypeFamily         { return Func }
+func (InterfaceType) Family() TypeFamily    { return Interface }
+func (TypeParamRefType) Family() TypeFamily { return TypeParamRef }
+
+func (t NamedType) ASTExpr() ast.Expr        { return t.AST }
+func (t StructType) ASTExpr() ast.Expr       { return t.AST }
+func (t MapType) ASTExpr() ast.Expr          { return t.AST }
+func (t ListType) ASTExpr() ast.Expr         { return t.AST }
+func (t PointerType) ASTExpr() ast.Expr      { return t.AST }
+func (t BuiltinType) ASTExpr() ast.Expr      { return t.AST }
+func (t FuncType) ASTExpr() ast.Expr         { return t.AST }
+func (t InterfaceType) ASTExpr() ast.Expr    { return t.AST }
+func (t TypeParamRefType) ASTExpr() ast.Expr { return t.AST }
+
+func (t NamedType) String() string {
+	name := t.DeclInfo.Name
+	if t.TypeArgs != nil {
+		name += "["
+		for i, arg := range t.TypeArgs {
+			if i > 0 {
+				name += ", "
+			}
+			name += arg.String()
+		}
+		name += "]"
+	}
+	return name
+}
+func (t StructType) String() string       { return "struct" }
+func (t MapType) String() string          { return "map[" + t.Key.String() + "]" + t.Value.String() }
+func (t ListType) String() string         { return "[]" + t.Elem.String() }
+func (t PointerType) String() string      { return "*" + t.Elem.String() }
+func (t BuiltinType) String() string      { return types.ExprString(t.AST) }
+func (t FuncType) String() string         { return "function" }
+func (t InterfaceType) String() string    { return "interface" }
+func (t TypeParamRefType) String() string { return t.AST.Name }
+
+// TypeDeclRef is a reference to a type declaration, through zero or more pointers
+// and possibly with type arguments.
+type TypeDeclRef struct {
+	Decl     *TypeDecl
+	TypeArgs []Type
+	Pointers int
+}
+
+func (r *TypeDeclRef) ToType() Type {
+	var typ Type = newEagerNamedType(r.Decl.Type.ASTExpr(), r.TypeArgs, r.Decl)
+	for i := 0; i < r.Pointers; i++ {
+		typ = PointerType{Elem: typ}
+	}
+	return typ
+}
diff --git a/v2/internals/schema/types_string.go b/v2/internals/schema/types_string.go
new file mode 100644
index 0000000000..c7fe57d114
--- /dev/null
+++ b/v2/internals/schema/types_string.go
@@ -0,0 +1,46 @@
+// Code generated by "stringer -type=BuiltinKind -output=types_string.go"; DO NOT EDIT.
+
+package schema
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[Invalid-0]
+	_ = x[Any-1]
+	_ = x[Bool-2]
+	_ = x[Int-3]
+	_ = x[Int8-4]
+	_ = x[Int16-5]
+	_ = x[Int32-6]
+	_ = x[Int64-7]
+	_ = x[Uint-8]
+	_ = x[Uint8-9]
+	_ = x[Uint16-10]
+	_ = x[Uint32-11]
+	_ = x[Uint64-12]
+	_ = x[Float32-13]
+	_ = x[Float64-14]
+	_ = x[String-15]
+	_ = x[Bytes-16]
+	_ = x[Time-17]
+	_ = x[UUID-18]
+	_ = x[JSON-19]
+	_ = x[UserID-20]
+	_ = x[Error-21]
+	_ = x[unsupported - -1]
+}
+
+const _BuiltinKind_name = "unsupportedInvalidAnyBoolIntInt8Int16Int32Int64UintUint8Uint16Uint32Uint64Float32Float64StringBytesTimeUUIDJSONUserIDError"
+
+var _BuiltinKind_index = [...]uint8{0, 11, 18, 21, 25, 28, 32, 37, 42, 47, 51, 56, 62, 68, 74, 81, 88, 94, 99, 103, 107, 111, 117, 122}
+
+func (i BuiltinKind) String() string {
+	i -= -1
+	if i < 0 || i >= BuiltinKind(len(_BuiltinKind_index)-1) {
+		return "BuiltinKind(" + strconv.FormatInt(int64(i+-1), 10) + ")"
+	}
+	return _BuiltinKind_name[_BuiltinKind_index[i]:_BuiltinKind_index[i+1]]
+}
diff --git a/v2/internals/testutil/testutil.go b/v2/internals/testutil/testutil.go
new file mode 100644
index 0000000000..4cf96beabd
--- /dev/null
+++ b/v2/internals/testutil/testutil.go
@@ -0,0 +1,271 @@
+package testutil
+
+import (
+	"context"
+	"fmt"
+	"go/ast"
+	"go/build"
+	"go/token"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"runtime"
+	"sync"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp"
+	"github.com/rogpeppe/go-internal/testscript"
+	"github.com/rogpeppe/go-internal/txtar"
+	"github.com/rs/zerolog"
+
+	"encr.dev/internal/env"
+	"encr.dev/pkg/errinsrc"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+type Context struct {
+	*parsectx.Context
+	TestC *qt.C
+}
+
+// NewContext constructs a new Context for testing.
+// It defaults the build info to the host system.
+func NewContext(c *qt.C, parseTests bool, archive *txtar.Archive) *Context {
+	mainModuleDir := WriteTxtar(c, archive)
+
+	return newContextForFSPath(c, mainModuleDir, parseTests)
+}
+
+// NewContextForTestScript constructs a new Context for testing when using testscript
+//
+// Your testscript test should call this [TestScriptSetupFunc] in the TestScript.Setup function.
+func NewContextForTestScript(ts *testscript.TestScript, parseTests bool) *Context {
+	c := GetTestC(ts)
+	workdir := ts.Value("wd").(string)
+
+	// Write the go.mod file for the testscript as we don't expect each test to do this
+	additional := ParseTxtar(`-- go.mod --
+module test
+
+go 1.20
+
+require encore.dev v1.13.4
+-- fakesvcfortest/test.go --
+// this service only exists to suppress the "no services found error"
+package fakesvcfortest
+
+import "context"
+
+//encore:api public
+func TestFunc(ctx context.Context) error { return nil }`)
+	ts.Check(txtar.Write(additional, workdir))
+
+	return newContextForFSPath(c, workdir, parseTests)
+}
+
+// TestScriptSetupFunc is a testscript setup function which sets up the testscript environment for
+// testing with testutil.
+func TestScriptSetupFunc(env *testscript.Env) error {
+	env.Values["TESTUTIL_SCRIPT_SETUP"] = true
+	env.Values["wd"] = env.WorkDir
+
+	tb, ok := env.T().(testing.TB)
+	if !ok {
+		env.T().Fatal("testscript's T did not implement testing.TB as expected")
+	}
+	env.Values["c"] = qt.New(tb)
+
+	return nil
+}
+
+// GetTestC returns the *qt.C for the current testscript test.
+//
+// This should only be called from within a testscript test which has had [TestScriptSetupFunc] called
+// during the TestScript.Setup function.
+func GetTestC(ts *testscript.TestScript) *qt.C {
+	if value := ts.Value("TESTUTIL_SCRIPT_SETUP"); value != nil {
+		if b, ok := value.(bool); !ok || !b {
+			ts.Fatalf("testutil.TestScriptSetupFunc was not called in the TestScript.Setup function")
+		}
+	}
+
+	return ts.Value("c").(*qt.C)
+}
+
+func newContextForFSPath(c *qt.C, mainModuleDir string, parseTests bool) *Context {
+	errinsrc.ColoursInErrors(false) // disable colours in errors for tests
+	errinsrc.IncludeStackByDefault = true
+
+	ctx, cancel := context.WithCancelCause(context.Background())
+	c.Cleanup(func() {
+		cancel(fmt.Errorf("test %s aborted", c.Name()))
+	})
+
+	d := &build.Default
+	info := parsectx.BuildInfo{
+		Experiments:   nil,
+		GOARCH:        d.GOARCH,
+		GOOS:          d.GOOS,
+		GOROOT:        paths.RootedFSPath(env.EncoreGoRoot(), "."),
+		BuildTags:     nil,
+		CgoEnabled:    true,
+		EncoreRuntime: paths.RootedFSPath(filepath.Join(RuntimeDir, "go"), "."),
+	}
+
+	fset := token.NewFileSet()
+	parseCtx := &parsectx.Context{
+		Log:           zerolog.New(zerolog.NewConsoleWriter(zerolog.ConsoleTestWriter(c))).Level(zerolog.InfoLevel),
+		MainModuleDir: paths.RootedFSPath(mainModuleDir, mainModuleDir),
+		Ctx:           ctx,
+		Build:         info,
+		FS:            fset,
+		ParseTests:    parseTests, // might as well
+		Errs:          perr.NewList(ctx, fset),
+	}
+
+	return &Context{Context: parseCtx, TestC: c}
+}
+
+// FailTestOnErrors is function that fails the test if an errors
+// are encountered when running fn.
+func (c *Context) FailTestOnErrors() {
+	if c.TestC == nil {
+		panic("parsectx.Context created outside of NewContext")
+	}
+
+	n := c.Errs.Len()
+	c.TestC.Cleanup(func() {
+		if c.Errs.Len() > n {
+			c.TestC.Fatalf("parse errors: %s", c.Errs.FormatErrors())
+		}
+	})
+}
+
+// FailTestOnBailout is a defer function that fails the test if a bailout
+// was triggered. It must be called as "defer c.FailTestOnBailout()".
+func (c *Context) FailTestOnBailout() {
+	c.TestC.Helper()
+	if l, caught := perr.CatchBailout(recover()); caught {
+		c.TestC.Fatalf("bailout: %s", l.FormatErrors())
+	}
+}
+
+// DeferExpectError is a defer function that expects errors to be present.
+// Each argument is matched with the corresponding error.
+// If the number of errors differs from the number of matches the test fails.
+func (c *Context) DeferExpectError(matches ...string) {
+	// Ignore any bailout; we'll check the list directly.
+	perr.CatchBailout(recover())
+
+	l := c.Errs
+	n := l.Len()
+	if len(matches) != n {
+		c.TestC.Fatalf("expected %d errors, got %d: %s", len(matches), n, l.FormatErrors())
+	}
+
+	for i := 0; i < n; i++ {
+		err := l.At(i)
+		re := regexp.MustCompile(matches[i])
+		errMsg := err.Error()
+		c.TestC.Check(re.MatchString(errMsg), qt.IsTrue, qt.Commentf("err %v does not match regexp %q",
+			errMsg, matches[i]))
+	}
+}
+
+// GoModTidy runs "go mod tidy" on the main module.
+func (c *Context) GoModTidy() {
+	// nosemgrep go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
+	cmd := exec.Command(c.goBin(), "mod", "tidy")
+	cmd.Dir = c.MainModuleDir.ToIO()
+	c.TestC.Log("running 'go mod tidy'")
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		c.TestC.Fatalf("go mod tidy: %v\n%s", err, out)
+	}
+	c.TestC.Log("'go mod tidy' completed successfully")
+}
+
+// GoModDownload runs "go mod download all" on the main module.
+func (c *Context) GoModDownload() {
+	// The "all" arg is needed to force 'go mod download' to update
+	// the go.sum file. See https://go-review.googlesource.com/c/go/+/318629.
+
+	// nosemgrep go.lang.security.audit.dangerous-exec-command.dangerous-exec-command
+	cmd := exec.Command(c.goBin(), "mod", "download", "all")
+	cmd.Dir = c.MainModuleDir.ToIO()
+	c.TestC.Log("running 'go mod download'")
+	// nosemgrep
+	if out, err := cmd.CombinedOutput(); err != nil {
+		c.TestC.Fatalf("go mod download: %v\n%s", err, out)
+	}
+	c.TestC.Log("'go mod download' completed successfully")
+}
+
+func (c *Context) goBin() string {
+	s := c.Build.GOROOT.Join("bin", "go").ToIO()
+	if runtime.GOOS == "windows" {
+		s += ".exe"
+	}
+	return s
+}
+
+func ParseTxtar(s string) *txtar.Archive {
+	return txtar.Parse([]byte(s))
+}
+
+// WriteTxtar writes the given txtar archive to a temporary directory
+// and returns the directory path.
+func WriteTxtar(c *qt.C, a *txtar.Archive) (dir string) {
+	c.Helper()
+	dir = c.TempDir()
+
+	// NOTE(andre): There appears to be a bug in go's handling of overlays
+	// when the source or destination is a symlink.
+	// I haven't dug into the root cause exactly, but it causes weird issues
+	// with tests since macOS's /var/tmp is a symlink to /private/var/tmp.
+	if d, err := filepath.EvalSymlinks(dir); err == nil {
+		dir = d
+	}
+
+	err := txtar.Write(a, dir)
+	c.Assert(err, qt.IsNil)
+	return dir
+}
+
+// FindNodes finds all nodes of the type T in the given AST.
+func FindNodes[T ast.Node](root ast.Node) []T {
+	var results []T
+	ast.Inspect(root, func(n ast.Node) bool {
+		if t, ok := n.(T); ok {
+			results = append(results, t)
+		}
+		return true
+	})
+	return results
+}
+
+// A PackageList is a list of packages that knows how to
+// collect itself, by passing (*PackageList).Collector() to
+// the scan.ProcessModule function. It's primarily a helper function
+// for testing purposes.
+type PackageList []*pkginfo.Package
+
+func (l *PackageList) Collector() func(pkg *pkginfo.Package) {
+	var mu sync.Mutex
+	return func(pkg *pkginfo.Package) {
+		mu.Lock()
+		*l = append(*l, pkg)
+		mu.Unlock()
+	}
+}
+
+// ResourceDeepEquals is a quicktest comparator for resource.Resource and resource.Bind
+// that forces the comparison to include unexported fields
+var ResourceDeepEquals = qt.CmpEquals(
+	cmp.AllowUnexported(option.Option[*pkginfo.File]{}),
+)
diff --git a/v2/internals/testutil/update_archive_file.go b/v2/internals/testutil/update_archive_file.go
new file mode 100644
index 0000000000..9840cacbeb
--- /dev/null
+++ b/v2/internals/testutil/update_archive_file.go
@@ -0,0 +1,66 @@
+package testutil
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/rogpeppe/go-internal/renameio"
+	"github.com/rogpeppe/go-internal/testscript"
+	"github.com/rogpeppe/go-internal/txtar"
+)
+
+func UpdateArchiveFile(ts *testscript.TestScript, sourceDir string, filename string, content string) {
+	wd := ts.Getenv("WORK")
+
+	// Work out the archive name from the work directory
+	// testscript always creates a directory with the name `script-<archive name>`
+	baseName := filepath.Base(wd)
+	if !strings.HasPrefix(baseName, "script-") {
+		ts.Fatalf("unable to identify archvie name from work directory `%s`", baseName)
+	}
+	archiveName := strings.TrimPrefix(baseName, "script-")
+
+	// Check the possible extensions
+	foundExt := false
+	possibleExts := []string{".txt", ".txtar"}
+	for _, ext := range possibleExts {
+		archivePath := filepath.Join(sourceDir, archiveName+ext)
+		if _, err := os.Stat(archivePath); err == nil {
+			archiveName = archiveName + ext
+			foundExt = true
+			break
+		}
+	}
+	if !foundExt {
+		ts.Fatalf("unable to identify archive file from work directory `%s/%s`", sourceDir, archiveName)
+	}
+
+	ts.Logf("Updating archive file `%s` with expected file `%s`...", archiveName, filename)
+
+	// Read the archive
+	archivePath := filepath.Join(sourceDir, archiveName)
+	ar, err := txtar.ParseFile(archivePath)
+	if err != nil {
+		ts.Fatalf("unable to read archive file `%s`: %v", archiveName, err)
+	}
+
+	// Update the archive
+	fileFound := false
+	for i, f := range ar.Files {
+		if f.Name == filename {
+			ar.Files[i].Data = []byte(content)
+			fileFound = true
+			break
+		}
+	}
+	if !fileFound {
+		ar.Files = append(ar.Files, txtar.File{Name: filename, Data: []byte(content)})
+	}
+
+	// Write the archive
+	err = renameio.WriteFile(archivePath, txtar.Format(ar))
+	if err != nil {
+		ts.Fatalf("unable to write archive file `%s`: %v", archiveName, err)
+	}
+}
diff --git a/v2/internals/testutil/utils.go b/v2/internals/testutil/utils.go
new file mode 100644
index 0000000000..243cfcf35d
--- /dev/null
+++ b/v2/internals/testutil/utils.go
@@ -0,0 +1,45 @@
+package testutil
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"encr.dev/internal/env"
+)
+
+var (
+	EncoreRepoDir = repoDir()
+	RuntimeDir    = filepath.Join(EncoreRepoDir, "runtimes")
+)
+
+// EnvRepoDirOverride is the name of the environment variable to override
+// the resolution of the path to this repository. It exists because
+// we have some tests that run in a temporary directory (such as when using
+// testscript in process execution mode, like compiler/build/build_test.go),
+// in which case the normal approach of invoking `git rev-parse --show-toplevel`
+// doesn't work.
+const EnvRepoDirOverride = "ENCORE_REPO_DIR"
+
+func init() {
+	// If we're not in the Encore repo, use the runtime path from the environment.
+	if _, err := os.Stat(filepath.Join(EncoreRepoDir, "go.mod")); err != nil {
+		RuntimeDir = env.EncoreRuntimesPath()
+	}
+}
+
+func repoDir() string {
+	if dir := os.Getenv(EnvRepoDirOverride); dir != "" {
+		return dir
+	}
+
+	cmd := exec.Command("git", "rev-parse", "--show-toplevel")
+	// nosemgrep
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		panic(fmt.Sprintf("unable to get repo directory: %s", out))
+	}
+	return string(bytes.TrimSpace(out))
+}
diff --git a/v2/parser/apis/api/api.go b/v2/parser/apis/api/api.go
new file mode 100644
index 0000000000..4f5522c7dd
--- /dev/null
+++ b/v2/parser/apis/api/api.go
@@ -0,0 +1,394 @@
+package api
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"slices"
+	"strings"
+	"sync"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/resourcepaths"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/apis/api/apienc"
+	"encr.dev/v2/parser/apis/directive"
+	"encr.dev/v2/parser/apis/selector"
+	"encr.dev/v2/parser/resource"
+)
+
+type AccessType string
+
+const (
+	Public  AccessType = "public"
+	Private AccessType = "private"
+	// Auth is like public but requires authentication.
+	Auth AccessType = "auth"
+)
+
+type Endpoint struct {
+	errs *perr.List
+
+	Name             string
+	Doc              string
+	File             *pkginfo.File
+	Decl             *schema.FuncDecl
+	Access           AccessType
+	AccessField      option.Option[directive.Field]
+	Raw              bool
+	Path             *resourcepaths.Path
+	HTTPMethods      []string
+	HTTPMethodsField option.Option[directive.Field]
+	Request          schema.Type // request data; nil for Raw Endpoints
+	Response         schema.Type // response data; nil for Raw Endpoints
+	Tags             selector.Set
+	Recv             option.Option[*schema.Receiver] // None if not a method
+
+	// Sensitive indicates whether the endpoint has been tagged as sensitive,
+	// meaning all request/response information will be redacted in traces.
+	Sensitive bool
+
+	reqEncOnce  sync.Once
+	reqEncoding []*apienc.RequestEncoding
+
+	respEncOnce  sync.Once
+	respEncoding *apienc.ResponseEncoding
+}
+
+func (ep *Endpoint) GoString() string {
+	if ep == nil {
+		return "(*api.Endpoint)(nil)"
+	}
+	return fmt.Sprintf("&api.Endpoint{Name: %q}", ep.Name)
+}
+
+func (ep *Endpoint) Kind() resource.Kind       { return resource.APIEndpoint }
+func (ep *Endpoint) Package() *pkginfo.Package { return ep.File.Pkg }
+func (ep *Endpoint) Pos() token.Pos            { return ep.Decl.AST.Pos() }
+func (ep *Endpoint) End() token.Pos            { return ep.Decl.AST.End() }
+func (ep *Endpoint) SortKey() string           { return ep.File.Pkg.ImportPath.String() + "." + ep.Name }
+
+func (ep *Endpoint) RequestEncoding() []*apienc.RequestEncoding {
+	if ep.Request == nil {
+		return nil
+	}
+
+	ep.reqEncOnce.Do(func() {
+		requestParam := ep.Decl.Type.Params[len(ep.Decl.Type.Params)-1]
+		ep.reqEncoding = apienc.DescribeRequest(ep.errs, requestParam, ep.Request, ep.HTTPMethodsField, ep.HTTPMethods...)
+	})
+	return ep.reqEncoding
+}
+
+func (ep *Endpoint) ResponseEncoding() *apienc.ResponseEncoding {
+	ep.respEncOnce.Do(func() {
+		ep.respEncoding = apienc.DescribeResponse(ep.errs, ep.Response)
+	})
+	return ep.respEncoding
+}
+
+type ParseData struct {
+	Errs   *perr.List
+	Schema *schema.Parser
+
+	File *pkginfo.File
+	Func *ast.FuncDecl
+	Dir  *directive.Directive
+	Doc  string
+}
+
+// Parse parses an API endpoint. It may return nil on errors.
+func Parse(d ParseData) *Endpoint {
+	rpc, ok := validateDirective(d.Errs, d.Dir)
+	if !ok {
+		return nil
+	}
+	rpc.errs = d.Errs
+
+	// If there was no path, default to "pkg.Decl".
+	if rpc.Path == nil {
+		rpc.Path = &resourcepaths.Path{
+			StartPos: d.Func.Name.Pos(),
+			Segments: []resourcepaths.Segment{{
+				Type:      resourcepaths.Literal,
+				Value:     d.File.Pkg.Name + "." + d.Func.Name.Name,
+				ValueType: schema.String,
+				StartPos:  d.Func.Name.Pos(),
+				EndPos:    d.Func.Name.End(),
+			}},
+		}
+	}
+
+	decl, ok := d.Schema.ParseFuncDecl(d.File, d.Func)
+	if !ok {
+		return nil
+	}
+
+	rpc.Name = d.Func.Name.Name
+	rpc.Doc = d.Doc
+	rpc.Decl = decl
+	rpc.File = d.File
+	rpc.Recv = decl.Recv
+
+	// Validate the API.
+	if rpc.Raw {
+		initRawRPC(d.Errs, rpc)
+	} else {
+		initTypedRPC(d.Errs, rpc)
+	}
+
+	// If we didn't get any HTTP methods, set a reasonable default.
+	// TODO(andre) Replace this with the API encoding.
+	if len(rpc.HTTPMethods) == 0 {
+		if rpc.Raw {
+			rpc.HTTPMethods = []string{"*"}
+		} else {
+			// For non-raw endpoints, if there's a request payload
+			// default to POST-only.
+			if rpc.Request != nil {
+				rpc.HTTPMethods = []string{"POST"}
+			} else {
+				rpc.HTTPMethods = []string{"GET", "POST"}
+			}
+		}
+	}
+
+	// RequestEncoding will validate the request payload.
+	rpc.RequestEncoding()
+
+	// ResponseEncoding will validate the response payload.
+	rpc.ResponseEncoding()
+
+	return rpc
+}
+
+func initTypedRPC(errs *perr.List, endpoint *Endpoint) {
+	decl := endpoint.Decl
+	sig := decl.Type
+	numParams := len(sig.Params)
+	if numParams == 0 {
+		errs.Add(errWrongNumberParams(numParams).AtGoNode(sig.AST.Params))
+		return
+	}
+
+	numResults := len(sig.Results)
+	if numResults == 0 || numResults > 2 {
+		errs.Add(errWrongNumberResults(numResults).AtGoNode(sig.AST.Results))
+		return
+	}
+
+	// First type should always be context.Context
+	ctxParam := sig.Params[0]
+	if !schemautil.IsNamed(ctxParam.Type, "context", "Context") {
+		errs.Add(errInvalidFirstParam.AtGoNode(ctxParam.AST))
+		return
+	}
+
+	// For each path parameter, expect a parameter to match it
+	var pathParams []*resourcepaths.Segment
+	for i := 0; i < len(endpoint.Path.Segments); i++ {
+		if s := &endpoint.Path.Segments[i]; s.Type != resourcepaths.Literal {
+			pathParams = append(pathParams, s)
+		}
+	}
+
+	seenParams := 0
+	for i := 0; i < numParams-1; i++ {
+		param := sig.Params[i+1] // +1 to skip context.Context
+
+		// Is it a path parameter?
+		if i < len(pathParams) {
+			seg := pathParams[i]
+			b := validatePathParam(errs, param, seg)
+			pathParams[seenParams].ValueType = b
+			seenParams++
+		} else {
+			// Otherwise it must be a payload parameter
+			payloadIdx := i - len(pathParams)
+			if payloadIdx > 0 {
+				errs.Add(errMultiplePayloads.AtGoNode(param.AST))
+				continue
+			}
+			endpoint.Request = param.Type
+		}
+	}
+
+	if seenParams < len(pathParams) {
+		var missing []string
+		var missingParams []*resourcepaths.Segment
+		for i := seenParams; i < len(pathParams); i++ {
+			missing = append(missing, pathParams[i].Value)
+			missingParams = append(missingParams, pathParams[i])
+		}
+
+		err := errInvalidPathParams(strings.Join(missing, "', '")).AtGoNode(sig.AST.Params)
+		for _, p := range missingParams {
+			err = err.AtGoNode(p)
+		}
+
+		errs.Add(err)
+	}
+
+	// First return value must be *T or *pkg.T
+	if numResults >= 2 {
+		result := sig.Results[0]
+		endpoint.Response = result.Type
+	}
+
+	// Make sure the last return is of type error.
+	if err := sig.Results[numResults-1]; !schemautil.IsBuiltinKind(err.Type, schema.Error) {
+		errs.Add(errLastResultMustBeError.AtGoNode(err.AST))
+		return
+	}
+}
+
+func initRawRPC(errs *perr.List, endpoint *Endpoint) {
+	decl := endpoint.Decl
+	sig := decl.Type
+	params := sig.Params
+	if len(params) < 2 {
+		errs.Add(errInvalidRawParams(len(params)).AtGoNode(sig.AST.Params))
+		return
+	} else if len(params) > 2 {
+		errs.Add(errInvalidRawParams(len(params)).AtGoNode(sig.AST.Params))
+	} else if len(sig.Results) > 0 {
+		errs.Add(errInvalidRawResults(len(sig.Results)).AtGoNode(sig.AST.Results))
+		return
+	}
+
+	// Ensure signature is func(http.ResponseWriter, *http.Request).
+	if !schemautil.IsNamed(params[0].Type, "net/http", "ResponseWriter") {
+		errs.Add(errRawNotResponeWriter.AtGoNode(params[0].AST))
+	}
+	if deref, n := schemautil.Deref(params[1].Type); n != 1 || !schemautil.IsNamed(deref, "net/http", "Request") {
+		errs.Add(errRawNotRequest.AtGoNode(params[1].AST))
+	}
+}
+
+// validatePathParam validates that the given func parameter is compatible with the given path segment.
+// It checks that the names match and that the func parameter is of a permissible type.
+// It returns the func parameter's builtin kind.
+func validatePathParam(errs *perr.List, param schema.Param, seg *resourcepaths.Segment) schema.BuiltinKind {
+	if !option.Contains(param.Name, seg.Value) {
+		errs.Add(errUnexpectedParameterName(param.Name, seg.Value, seg.String()).AtGoNode(seg).AtGoNode(param.AST))
+	}
+
+	builtin, _ := param.Type.(schema.BuiltinType)
+	b := builtin.Kind
+
+	// Wildcard path parameters must be strings.
+	if b != schema.String && (seg.Type == resourcepaths.Wildcard || seg.Type == resourcepaths.Fallback) {
+		errs.Add(errWildcardMustBeString(param.Name).AtGoNode(seg).AtGoNode(param.AST))
+	}
+
+	switch b {
+	case schema.String, schema.Bool,
+		schema.Int, schema.Int8, schema.Int16, schema.Int32, schema.Int64,
+		schema.Uint, schema.Uint8, schema.Uint16, schema.Uint32, schema.Uint64,
+		schema.UUID:
+		return b
+	default:
+		errs.Add(errInvalidPathParamType(param.Name).AtGoNode(seg).AtGoNode(param.AST))
+		return schema.Invalid
+	}
+}
+
+// validateDirective validates the given encore:api directive
+// and returns an API with the respective fields set.
+func validateDirective(errs *perr.List, dir *directive.Directive) (*Endpoint, bool) {
+	endpoint := &Endpoint{
+		Raw: dir.HasOption("raw"),
+	}
+
+	var accessField directive.Field
+	var rawTag directive.Field
+
+	accessOptions := []string{"public", "private", "auth"}
+	ok := directive.Validate(errs, dir, directive.ValidateSpec{
+		AllowedOptions: append([]string{"raw", "sensitive"}, accessOptions...),
+		AllowedFields:  []string{"path", "method"},
+
+		ValidateOption: func(errs *perr.List, opt directive.Field) (ok bool) {
+			// If this is an access option, check for duplicates.
+			if slices.Contains(accessOptions, opt.Value) {
+				if endpoint.Access != "" {
+					errs.Add(errDuplicateAccessOptions(endpoint.Access, opt.Value, strings.Join(accessOptions, ", ")).AtGoNode(opt).AtGoNode(accessField))
+					return false
+				}
+				accessField = opt
+				endpoint.Access = AccessType(opt.Value)
+				endpoint.AccessField = option.Some(opt)
+			}
+
+			switch opt.Value {
+			case "raw":
+				rawTag = opt
+			case "sensitive":
+				endpoint.Sensitive = true
+			}
+
+			return true
+		},
+		ValidateField: func(errs *perr.List, f directive.Field) (ok bool) {
+			switch f.Key {
+			case "path":
+				endpoint.Path, ok = resourcepaths.Parse(
+					errs,
+					f.End()-token.Pos(len([]byte(f.Value))-1),
+					f.Value,
+					resourcepaths.Options{
+						AllowWildcard: true,
+						AllowFallback: true,
+						PrefixSlash:   true,
+					},
+				)
+				if !ok {
+					return false
+				}
+
+			case "method":
+				endpoint.HTTPMethods = f.List()
+				endpoint.HTTPMethodsField = option.Some(f)
+				for _, m := range endpoint.HTTPMethods {
+					for _, c := range m {
+						if !(c >= 'A' && c <= 'Z') && !(c >= 'a' && c <= 'z') {
+							errs.Add(errInvalidEndpointMethod(m).AtGoNode(f))
+							return false
+						} else if !(c >= 'A' && c <= 'Z') {
+							errs.Add(errEndpointMethodMustBeAllCaps.AtGoNode(f))
+							return false
+						}
+					}
+				}
+			}
+			return true
+		},
+		ValidateTag: func(errs *perr.List, tag directive.Field) (ok bool) {
+			sel, ok := selector.Parse(errs, tag.Pos(), tag.Value)
+			if !ok {
+				return false
+			}
+			endpoint.Tags.Add(sel)
+			return true
+		},
+	})
+	if !ok {
+		return nil, false
+	}
+
+	// Access defaults to private if not provided.
+	if endpoint.Access == "" {
+		endpoint.Access = Private
+	}
+	if endpoint.Access == Private && endpoint.Raw {
+		// We don't support private raw APIs for now.
+		errs.Add(errRawEndpointCantBePrivate.AtGoNode(rawTag, errors.AsError("declared as raw here")).AtGoNode(accessField, errors.AsError("set as private here")))
+		return nil, false
+	}
+
+	return endpoint, true
+}
diff --git a/v2/parser/apis/api/api_test.go b/v2/parser/apis/api/api_test.go
new file mode 100644
index 0000000000..acd96b0ec0
--- /dev/null
+++ b/v2/parser/apis/api/api_test.go
@@ -0,0 +1,197 @@
+package api
+
+import (
+	"go/ast"
+	"go/token"
+	"strconv"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/resourcepaths"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser/apis/directive"
+	"encr.dev/v2/parser/apis/selector"
+)
+
+func TestParseRPC(t *testing.T) {
+	type testCase struct {
+		name     string
+		imports  []string
+		def      string
+		want     *Endpoint
+		wantErrs []string
+	}
+	tests := []testCase{
+		{
+			name: "basic",
+			def: `
+// Foo does things.
+//encore:api public
+func Foo(ctx context.Context) error {}
+`,
+			want: &Endpoint{
+				Name:        "Foo",
+				Doc:         "Foo does things.\n",
+				Access:      Public,
+				AccessField: option.Some(directive.Field{Value: "public"}),
+				Path: &resourcepaths.Path{Segments: []resourcepaths.Segment{
+					{Type: resourcepaths.Literal, Value: "foo.Foo", ValueType: schema.String},
+				}},
+				HTTPMethods: []string{"GET", "POST"},
+			},
+		},
+		{
+			name: "with_fields",
+			def: `
+//encore:api private path=/foo method=PUT tag:some-tag
+func Foo(ctx context.Context) error {}
+`,
+			want: &Endpoint{
+				Name:        "Foo",
+				Doc:         "",
+				Access:      Private,
+				AccessField: option.Some(directive.Field{Value: "private"}),
+				Path: &resourcepaths.Path{Segments: []resourcepaths.Segment{
+					{Type: resourcepaths.Literal, Value: "foo", ValueType: schema.String},
+				}},
+				HTTPMethods: []string{"PUT"},
+				Tags:        selector.NewSet(selector.Selector{Type: selector.Tag, Value: "some-tag"}),
+			},
+		},
+		{
+			name: "with_string_param",
+			def: `
+//encore:api auth path=/:key
+func Foo(ctx context.Context, key string) error {}
+`,
+			want: &Endpoint{
+				Name:        "Foo",
+				Doc:         "",
+				Access:      Auth,
+				AccessField: option.Some(directive.Field{Value: "auth"}),
+				Path: &resourcepaths.Path{Segments: []resourcepaths.Segment{
+					{Type: resourcepaths.Param, Value: "key", ValueType: schema.String},
+				}},
+				HTTPMethods: []string{"GET", "POST"},
+			},
+		},
+		{
+			name: "with_int_param",
+			def: `
+//encore:api auth path=/foo/:key
+func Foo(ctx context.Context, key int) error {}
+`,
+			want: &Endpoint{
+				Name:        "Foo",
+				Doc:         "",
+				Access:      Auth,
+				AccessField: option.Some(directive.Field{Value: "auth"}),
+				Path: &resourcepaths.Path{Segments: []resourcepaths.Segment{
+					{Type: resourcepaths.Literal, Value: "foo", ValueType: schema.String},
+					{Type: resourcepaths.Param, Value: "key", ValueType: schema.Int},
+				}},
+				HTTPMethods: []string{"GET", "POST"},
+			},
+		},
+		{
+			name:    "raw",
+			imports: []string{"net/http"},
+			def: `
+//encore:api public raw path=/raw
+func Raw(w http.ResponseWriter, req *http.Request) {}
+`,
+			want: &Endpoint{
+				Name:        "Raw",
+				Doc:         "",
+				Access:      Public,
+				AccessField: option.Some(directive.Field{Value: "public"}),
+				Raw:         true,
+				Path: &resourcepaths.Path{Segments: []resourcepaths.Segment{
+					{Type: resourcepaths.Literal, Value: "raw", ValueType: schema.String},
+				}},
+				HTTPMethods: []string{"*"},
+			},
+		},
+	}
+
+	// testArchive renders the txtar archive to use for a given test.
+	testArchive := func(test testCase) *txtar.Archive {
+		importList := append([]string{"context"}, test.imports...)
+		imports := ""
+		if len(importList) > 0 {
+			imports = "import (\n"
+			for _, imp := range importList {
+				imports += "\t" + strconv.Quote(imp) + "\n"
+			}
+			imports += ")\n"
+		}
+
+		return testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+require encore.dev v1.13.4
+-- code.go --
+package foo
+` + imports + `
+
+` + test.def + `
+`)
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := qt.New(t)
+			a := testArchive(test)
+			tc := testutil.NewContext(c, false, a)
+			tc.GoModDownload()
+
+			l := pkginfo.New(tc.Context)
+			schemaParser := schema.NewParser(tc.Context, l)
+
+			if len(test.wantErrs) > 0 {
+				defer tc.DeferExpectError(test.wantErrs...)
+			} else {
+				tc.FailTestOnErrors()
+				defer tc.FailTestOnBailout()
+			}
+
+			pkg := l.MustLoadPkg(token.NoPos, "example.com")
+			f := pkg.Files[0]
+			fd := testutil.FindNodes[*ast.FuncDecl](f.AST())[0]
+
+			// Parse the directive from the func declaration.
+			dir, doc, ok := directive.Parse(tc.Errs, fd.Doc)
+			c.Assert(ok, qt.IsTrue, qt.Commentf("directive not found in %s", fd.Name.Name))
+			pd := ParseData{
+				Errs:   tc.Errs,
+				Schema: schemaParser,
+				File:   f,
+				Func:   fd,
+				Dir:    dir,
+				Doc:    doc,
+			}
+
+			got := Parse(pd)
+			if len(test.wantErrs) == 0 {
+				// Check for equality, ignoring all the AST nodes and pkginfo types.
+				cmpEqual := qt.CmpEquals(
+					cmpopts.IgnoreInterfaces(struct{ ast.Node }{}),
+					cmpopts.IgnoreTypes(&schema.FuncDecl{}, &schema.TypeDecl{}, &pkginfo.File{}, &pkginfo.Package{}, token.Pos(0)),
+					cmpopts.EquateEmpty(),
+					cmpopts.IgnoreUnexported(schema.StructField{}, schema.NamedType{}, Endpoint{}),
+					cmp.Comparer(func(a, b *pkginfo.Package) bool {
+						return a.ImportPath == b.ImportPath
+					}),
+				)
+				c.Assert(got, cmpEqual, test.want)
+			}
+		})
+	}
+}
diff --git a/v2/parser/apis/api/apienc/encoding.go b/v2/parser/apis/api/apienc/encoding.go
new file mode 100644
index 0000000000..fdd9fa4484
--- /dev/null
+++ b/v2/parser/apis/api/apienc/encoding.go
@@ -0,0 +1,556 @@
+package apienc
+
+import (
+	"fmt"
+	"slices"
+	"sort"
+	"strings"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/idents"
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/apis/authhandler"
+	"encr.dev/v2/parser/apis/directive"
+)
+
+// WireLoc is the location of a parameter in the HTTP request/response.
+type WireLoc string
+
+const (
+	Undefined  WireLoc = "undefined"  // Parameter location is undefined
+	Header     WireLoc = "header"     // Parameter is placed in the HTTP header
+	Query      WireLoc = "query"      // Parameter is placed in the query string
+	Body       WireLoc = "body"       // Parameter is placed in the body
+	Cookie     WireLoc = "cookie"     // Parameter is placed in cookies
+	HTTPStatus WireLoc = "httpstatus" // Parameter represents the HTTP status code
+)
+
+var (
+	QueryTag = tagDescription{
+		location:        Query,
+		overrideDefault: true,
+	}
+	QsTag     = QueryTag
+	HeaderTag = tagDescription{
+		location:        Header,
+		overrideDefault: true,
+		wireFormatter:   strings.ToLower,
+	}
+	JSONTag = tagDescription{
+		location:        Body,
+		omitEmptyOption: "omitempty",
+		overrideDefault: false,
+	}
+	CookieTag = tagDescription{
+		location:        Cookie,
+		omitEmptyOption: "omitempty",
+		overrideDefault: true,
+	}
+	HTTPStatusTag = tagDescription{
+		location:        HTTPStatus,
+		overrideDefault: true,
+	}
+)
+
+// requestTags is a description of tags used for requests
+var requestTags = map[string]tagDescription{
+	"query":  QueryTag,
+	"qs":     QsTag,
+	"header": HeaderTag,
+	"json":   JSONTag,
+}
+
+// responseTags is a description of tags used for responses
+var responseTags = map[string]tagDescription{
+	"header": HeaderTag,
+	"json":   JSONTag,
+}
+
+// authTags is a description of tags used for auth
+var authTags = map[string]tagDescription{
+	"query":  QueryTag,
+	"header": HeaderTag,
+	"cookie": CookieTag,
+}
+
+// tagDescription is used to map struct field tags to param locations
+// if overrideDefault is set, tagDescription.location will be used instead of encodingHints.defaultLocation
+// if the tag matches the paramLocation, the param name will be replaced with the
+// tag name
+type tagDescription struct {
+	location        WireLoc
+	overrideDefault bool
+	omitEmptyOption string
+	wireFormatter   func(name string) string
+}
+
+// encodingHints is used to determine the default location and applicable tag overrides for http
+// request/response encoding
+type encodingHints struct {
+	defaultLocation WireLoc
+	tags            map[string]tagDescription
+}
+
+// APIEncoding expresses how an RPC should be encoded on the wire for both the request and responses.
+type APIEncoding struct {
+	DefaultMethod string `json:"default_method"`
+	// Expresses how the default request encoding and method should be
+	// Note: DefaultRequestEncoding.HTTPMethods will always be a slice with length 1
+	DefaultRequestEncoding *RequestEncoding `json:"request_encoding"`
+	// Expresses all the different ways the request can be encoded for this RPC
+	RequestEncoding []*RequestEncoding `json:"all_request_encodings"`
+	// Expresses how the response to this RPC will be encoded
+	ResponseEncoding *ResponseEncoding `json:"response_encoding"`
+}
+
+// RequestEncodingForMethod returns the request encoding required for the given HTTP method.
+// If the method is not supported by the RPC it reports nil.
+func (e *APIEncoding) RequestEncodingForMethod(method string) *RequestEncoding {
+	var wildcardOption *RequestEncoding
+
+	for _, reqEnc := range e.RequestEncoding {
+		for _, m := range reqEnc.HTTPMethods {
+			if strings.EqualFold(m, method) {
+				return reqEnc
+			}
+
+			if m == "*" {
+				wildcardOption = reqEnc
+			}
+		}
+	}
+	return wildcardOption
+}
+
+// ResponseEncoding expresses how a response should be encoded on the wire
+type ResponseEncoding struct {
+	// Contains metadata about how to marshal an HTTP parameter
+	HeaderParameters []*ParameterEncoding `json:"header_parameters"`
+	BodyParameters   []*ParameterEncoding `json:"body_parameters"`
+	// HTTPStatusParameter contains encoding info for the HTTP status field, if any
+	HTTPStatusParameter *ParameterEncoding `json:"http_status_parameter,omitempty"`
+}
+
+func (r *ResponseEncoding) AllParameters() []*ParameterEncoding {
+	params := append(r.HeaderParameters, r.BodyParameters...)
+	if r.HTTPStatusParameter != nil {
+		params = append(params, r.HTTPStatusParameter)
+	}
+	return params
+}
+
+// RequestEncoding expresses how a request should be encoded for an explicit set of HTTPMethods
+type RequestEncoding struct {
+	// The HTTP methods this encoding can be used for
+	HTTPMethods []string `json:"http_methods"`
+	// Contains metadata about how to marshal an HTTP parameter
+	HeaderParameters []*ParameterEncoding `json:"header_parameters"`
+	QueryParameters  []*ParameterEncoding `json:"query_parameters"`
+	BodyParameters   []*ParameterEncoding `json:"body_parameters"`
+}
+
+func (r *RequestEncoding) AllParameters() []*ParameterEncoding {
+	return append(append(r.HeaderParameters, r.QueryParameters...), r.BodyParameters...)
+}
+
+// ParameterEncoding expresses how a parameter should be encoded on the wire
+type ParameterEncoding struct {
+	// SrcName is the name of the struct field
+	SrcName string `json:"src_name"`
+	// WireName is how the name is encoded on the wire.
+	WireName string `json:"wire_name"`
+	// Location is the location this encoding is for.
+	Location WireLoc `json:"location"`
+	// OmitEmpty specifies whether the parameter should be omitted if it's empty.
+	OmitEmpty bool `json:"omit_empty"`
+	// Doc is the documentation of the struct field
+	Doc string `json:"doc"`
+	// Type is the field's type description.
+	Type schema.Type `json:"type"`
+}
+
+// DescribeResponse generates a ParameterEncoding per field of the response struct and returns it as
+// the ResponseEncoding
+func DescribeResponse(errs *perr.List, responseSchema schema.Type) *ResponseEncoding {
+	if responseSchema == nil {
+		return &ResponseEncoding{}
+	}
+
+	responseStruct, ok := getConcreteNamedStruct(errs, responseSchema)
+	if !ok {
+		errs.Add(errResponseMustBeNamedStruct.AtGoNode(responseSchema.ASTExpr()))
+		return &ResponseEncoding{}
+	}
+
+	fields, ok := describeParams(errs, &encodingHints{Body, responseTags}, responseStruct)
+	if !ok {
+		// describeParams already added the error to errs
+		return &ResponseEncoding{}
+	}
+
+	// Extract HTTP status parameter from fields and check for multiple status fields
+	var httpStatusParameter *ParameterEncoding
+	if len(fields[HTTPStatus]) > 0 {
+		switch len(fields[HTTPStatus]) {
+		case 1:
+			httpStatusParameter = fields[HTTPStatus][0]
+		default:
+			errs.Add(errMultipleHTTPStatusFields.AtGoNode(responseStruct.ASTExpr()))
+		}
+	}
+
+	// Check for reserved header prefixes
+	for _, field := range fields[Header] {
+		if strings.HasPrefix(strings.ToLower(field.WireName), "x-encore-") {
+			errs.Add(errReservedHeaderPrefix.AtGoNode(field.Type.ASTExpr()))
+		}
+	}
+
+	if keys := keyDiff(fields, Header, Body, HTTPStatus); len(keys) > 0 {
+		err := errResponseTypeMustOnlyBeBodyOrHeaders.AtGoNode(responseSchema.ASTExpr())
+
+		for _, k := range keys {
+			for _, field := range fields[k] {
+				err = err.AtGoNode(field.Type.ASTExpr(), errors.AsError(fmt.Sprintf("found %s", field.Location)))
+			}
+		}
+		errs.Add(err)
+		return &ResponseEncoding{}
+	}
+
+	return &ResponseEncoding{
+		BodyParameters:      fields[Body],
+		HeaderParameters:    fields[Header],
+		HTTPStatusParameter: httpStatusParameter,
+	}
+}
+
+func getConcreteNamedStruct(errs *perr.List, typ schema.Type) (st schema.StructType, ok bool) {
+	if res, ok := schemautil.ResolveNamedStruct(typ, false); ok {
+		concrete := schemautil.ConcretizeWithTypeArgs(errs, res.Decl.Type, res.TypeArgs)
+		return concrete.(schema.StructType), true
+	}
+	return schema.StructType{}, false
+}
+
+// keyDiff returns the diff between src.keys and keys
+func keyDiff[T comparable, V any](src map[T]V, keys ...T) (diff []T) {
+	for k := range src {
+		if !slices.Contains(keys, k) {
+			diff = append(diff, k)
+		}
+	}
+	return diff
+}
+
+// DescribeRequest groups the provided httpMethods by default WireLoc and returns a RequestEncoding
+// per WireLoc
+func DescribeRequest(errs *perr.List, requestAST schema.Param, requestSchema schema.Type, methodsField option.Option[directive.Field], httpMethods ...string) []*RequestEncoding {
+	methodsByDefaultLocation := make(map[WireLoc][]string)
+	for _, m := range httpMethods {
+		switch m {
+		case "GET", "HEAD", "DELETE":
+			methodsByDefaultLocation[Query] = append(methodsByDefaultLocation[Query], m)
+		case "*":
+			methodsByDefaultLocation[Body] = []string{"POST", "PUT", "PATCH"}
+			methodsByDefaultLocation[Query] = []string{"GET", "HEAD", "DELETE"}
+		default:
+			methodsByDefaultLocation[Body] = append(methodsByDefaultLocation[Body], m)
+		}
+	}
+
+	if requestSchema == nil {
+		// If there is no request schema, add an empty encoding that supports
+		// all methods allowed by the endpoint.
+		enc := &RequestEncoding{
+			HTTPMethods: httpMethods,
+		}
+		if len(httpMethods) > 0 && httpMethods[0] == "*" {
+			enc.HTTPMethods = []string{"POST", "PUT", "PATCH", "GET", "HEAD", "DELETE"}
+		}
+		return []*RequestEncoding{enc}
+	}
+
+	st, ok := getConcreteNamedStruct(errs, requestSchema)
+	if !ok {
+		errs.Add(errRequestMustBeNamedStruct.AtGoNode(requestSchema.ASTExpr()))
+		return nil
+	}
+
+	var reqs []*RequestEncoding
+	for location, methods := range methodsByDefaultLocation {
+		var fields map[WireLoc][]*ParameterEncoding
+
+		fields, ok := describeParams(errs, &encodingHints{location, requestTags}, st)
+		if !ok {
+			// report error in describeParams
+			return nil
+		}
+
+		// Check for reserved header prefixes or invalid data types
+		for _, field := range fields[Header] {
+			if strings.HasPrefix(strings.ToLower(field.WireName), "x-encore-") {
+				errs.Add(errReservedHeaderPrefix.AtGoNode(field.Type.ASTExpr()))
+			}
+
+			if _, _, ok := schemautil.IsBuiltinOrList(field.Type); !ok {
+				errs.Add(
+					errInvalidHeaderType(field.Type.String()).
+						AtGoNode(field.Type.ASTExpr(), errors.AsError("unsupported type")).
+						AtGoNode(requestAST.AST, errors.AsHelp("used here")),
+				)
+			}
+		}
+
+		// Check for invalid datatype in query parameters
+		for _, field := range fields[Query] {
+			if _, _, ok := schemautil.IsBuiltinOrList(field.Type); !ok {
+				err := errInvalidQueryStringType(field.Type.String()).
+					AtGoNode(field.Type.ASTExpr(), errors.AsError("unsupported type")).
+					AtGoNode(requestAST.AST, errors.AsHelp("used here"))
+
+				if field, ok := methodsField.Get(); ok {
+					httpMethod := strings.ToUpper(field.Value)
+					switch httpMethod {
+					case "GET", "HEAD", "DELETE":
+						err = err.AtGoNode(field, errors.AsHelp("you could change this to a POST or PUT request"))
+					}
+				}
+
+				errs.Add(err)
+			}
+		}
+
+		if errs.Len() > 0 {
+			return nil
+		}
+
+		if keys := keyDiff(fields, Query, Header, Body); len(keys) > 0 {
+			err := errRequestInvalidLocation.AtGoNode(requestSchema.ASTExpr())
+
+			for _, k := range keys {
+				for _, field := range fields[k] {
+					err = err.AtGoNode(field.Type.ASTExpr(), errors.AsError(fmt.Sprintf("found %s", field.Location)))
+				}
+			}
+			errs.Add(err)
+			return nil
+		}
+		reqs = append(reqs, &RequestEncoding{
+			HTTPMethods:      methods,
+			QueryParameters:  fields[Query],
+			HeaderParameters: fields[Header],
+			BodyParameters:   fields[Body],
+		})
+	}
+
+	// Sort by first method to get a deterministic order (list is randomized by map above)
+	sort.Slice(reqs, func(i, j int) bool {
+		return reqs[i].HTTPMethods[0] < reqs[j].HTTPMethods[0]
+	})
+	return reqs
+}
+
+// AuthEncoding expresses how a response should be encoded on the wire.
+type AuthEncoding struct {
+	// LegacyTokenFormat specifies whether the auth encoding uses the legacy format of
+	// "just give us a token as a string". If true, the other parameters are all empty.
+	LegacyTokenFormat bool
+
+	// Contains metadata about how to marshal an HTTP parameter
+	HeaderParameters []*ParameterEncoding `json:"header_parameters"`
+	QueryParameters  []*ParameterEncoding `json:"query_parameters"`
+	CookieParameters []*ParameterEncoding `json:"cookie_parameters"`
+}
+
+// DescribeAuth generates a ParameterEncoding per field of the auth struct and returns it as
+// the AuthEncoding. If authSchema is nil it returns nil.
+func DescribeAuth(errs *perr.List, authSchema schema.Type) *AuthEncoding {
+	if authSchema == nil {
+		return nil
+	}
+
+	// Do we have a legacy, string-based handler?
+	if builtin, ok := authSchema.(schema.BuiltinType); ok {
+		if builtin.Kind != schema.String {
+			errs.Add(authhandler.ErrInvalidAuthSchemaType.AtGoNode(builtin.ASTExpr()))
+		}
+		return &AuthEncoding{LegacyTokenFormat: true}
+	}
+
+	st, ok := getConcreteNamedStruct(errs, authSchema)
+	if !ok {
+		errs.Add(authhandler.ErrInvalidAuthSchemaType.AtGoNode(authSchema.ASTExpr()))
+		return nil
+	}
+
+	fields, ok := describeParams(errs, &encodingHints{Undefined, authTags}, st)
+	if !ok {
+		// reported by describeParams
+		return nil
+	}
+	if locationDiff := keyDiff(fields, Header, Query, Cookie); len(locationDiff) > 0 {
+		err := authhandler.ErrInvalidFieldTags.AtGoNode(authSchema.ASTExpr())
+
+		for _, k := range locationDiff {
+			for _, field := range fields[k] {
+				err = err.AtGoNode(field.Type.ASTExpr(), errors.AsError(fmt.Sprintf("found %s", field.Location)))
+			}
+		}
+		errs.Add(err)
+		return nil
+	}
+	return &AuthEncoding{
+		QueryParameters:  fields[Query],
+		HeaderParameters: fields[Header],
+		CookieParameters: fields[Cookie],
+	}
+}
+
+// describeParams calls describeParam() for each field in the payload struct
+func describeParams(errs *perr.List, encodingHints *encodingHints, payload schema.StructType) (fields map[WireLoc][]*ParameterEncoding, ok bool) {
+	paramByLocation := make(map[WireLoc][]*ParameterEncoding)
+	for _, f := range payload.Fields {
+		if !f.IsExported() {
+			continue
+		}
+
+		f, ok := describeParam(errs, encodingHints, f)
+		if !ok {
+			return nil, false
+		}
+
+		if f != nil {
+			paramByLocation[f.Location] = append(paramByLocation[f.Location], f)
+		}
+	}
+	return paramByLocation, true
+}
+
+// formatName formats a parameter name with the default formatting for the location (e.g. snakecase for query)
+func formatName(location WireLoc, name string) string {
+	switch location {
+	case Query:
+		return idents.Convert(name, idents.SnakeCase)
+	default:
+		return name
+	}
+}
+
+// IgnoreField returns true if the field name is "-" is any of the valid request or response tags
+// or if the field is marked with encore:"httpstatus" (which shouldn't appear in client types)
+func IgnoreField(field schema.StructField) bool {
+	for _, tag := range field.Tag.Tags() {
+		if _, found := requestTags[tag.Key]; found && tag.Name == "-" {
+			return true
+		}
+		// Skip fields with encore:"httpstatus" tag - they're for internal HTTP status handling only
+		if tag.Key == "encore" && tag.Name == "httpstatus" {
+			return true
+		}
+	}
+	return false
+}
+
+// describeParam returns the ParameterEncoding which uses field tags to describe how the parameter
+// (e.g. qs, query, header) should be encoded in HTTP (name and location).
+//
+// It returns nil, nil if the field is not to be encoded.
+func describeParam(errs *perr.List, encodingHints *encodingHints, field schema.StructField) (*ParameterEncoding, bool) {
+	if field.Name.Empty() {
+		// TODO(andre) We don't yet support encoding anonymous fields.
+		errs.Add(errAnonymousFields.AtGoNode(field.AST))
+		return nil, false
+	}
+	srcName := field.Name.MustGet()
+
+	defaultWireName := formatName(encodingHints.defaultLocation, srcName)
+	param := ParameterEncoding{
+		OmitEmpty: false,
+		SrcName:   srcName,
+		Doc:       field.Doc,
+		Type:      field.Type,
+		WireName:  defaultWireName,
+	}
+
+	// Determine which location we should use for this field.
+	location := encodingHints.defaultLocation
+	var usedOverrideTag string
+	for _, tag := range field.Tag.Tags() {
+		// Handle fields with encore:"httpstatus" tag
+		if tag.Key == "encore" && tag.Name == "httpstatus" {
+			if !isValidHTTPStatusType(field.Type) {
+				errs.Add(errHTTPStatusFieldMustBeInt.AtGoNode(field.AST))
+				return nil, false
+			}
+
+			return &ParameterEncoding{
+				SrcName:   srcName,
+				WireName:  "httpstatus",
+				Location:  HTTPStatus,
+				OmitEmpty: false,
+				Doc:       field.Doc,
+				Type:      field.Type,
+			}, true
+		}
+
+		tagHint, ok := encodingHints.tags[tag.Key]
+		if !ok {
+			continue
+		}
+
+		// If the presence of this tag overrides the default, update the location.
+		if tagHint.overrideDefault {
+			if usedOverrideTag != "" {
+				// There is only allowed to be a single override.
+				errs.Add(errTagConflict(usedOverrideTag, tag.Key).AtGoNode(field.AST.Tag))
+				return nil, false
+			}
+			location = tagHint.location
+			usedOverrideTag = tag.Key
+		}
+	}
+
+	// For the location, see if there is tag information for it.
+	for _, tag := range field.Tag.Tags() {
+		if tagHint, ok := encodingHints.tags[tag.Key]; ok && tagHint.location == location {
+			// We have found the tag that applies to the default location.
+			// Determine if this tag actually has a name. If not, use the existing name.
+			if tag.Name == "-" {
+				// This field is to be ignored.
+				return nil, true
+			}
+			if tag.Name != "" {
+				if tagHint.wireFormatter != nil {
+					param.WireName = tagHint.wireFormatter(tag.Name)
+				} else {
+					param.WireName = tag.Name
+				}
+			}
+			param.OmitEmpty = tag.HasOption("omitempty")
+		}
+	}
+
+	param.Location = location
+	return &param, true
+}
+
+// isValidHTTPStatusType returns true if the given type is valid for HTTP status fields.
+// Valid types are integer types that can hold a http status code
+func isValidHTTPStatusType(typ schema.Type) bool {
+	builtin, ok := typ.(schema.BuiltinType)
+	if !ok {
+		return false
+	}
+
+	switch builtin.Kind {
+	case schema.Int, schema.Int16, schema.Int32, schema.Int64,
+		schema.Uint, schema.Uint16, schema.Uint32, schema.Uint64:
+		return true
+	default:
+		return false
+	}
+}
diff --git a/v2/parser/apis/api/apienc/errors.go b/v2/parser/apis/api/apienc/errors.go
new file mode 100644
index 0000000000..00551a4bf1
--- /dev/null
+++ b/v2/parser/apis/api/apienc/errors.go
@@ -0,0 +1,91 @@
+package apienc
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"apienc",
+		"For more information on API schemas, see https://encore.dev/docs/develop/api-schemas",
+		errors.WithRangeSize(20),
+	)
+
+	errAnonymousFields = errRange.New(
+		"Invalid API schema",
+		"Anonymous fields in top-level request/response types are not supported.",
+	)
+
+	errTagConflict = errRange.Newf(
+		"Invalid API schema",
+		"The tag \"%s\" cannot be used with the tag \"%s\".",
+	)
+
+	errResponseMustBeNamedStruct = errRange.New(
+		"Invalid response type",
+		"API response types must be named structs.",
+	)
+
+	errResponseTypeMustOnlyBeBodyOrHeaders = errRange.New(
+		"Invalid response type",
+		"API response type must only contain a body, headers or status parameters.",
+	)
+
+	errRequestMustBeNamedStruct = errRange.New(
+		"Invalid request type",
+		"API request types must be named structs.",
+	)
+
+	errRequestInvalidLocation = errRange.New(
+		"Invalid request type",
+		"API request must only contain query, body, and header parameters.",
+	)
+
+	errReservedHeaderPrefix = errRange.New(
+		"Use of reserved header prefix",
+		"HTTP headers starting with \"X-Encore\" are reserved for internal use.",
+	)
+
+	ErrFuncNotSupported = errRange.New(
+		"Invalid API schema",
+		"Functions are not supported in API schemas.",
+	)
+
+	ErrInterfaceNotSupported = errRange.New(
+		"Invalid API schema",
+		"Interfaces are not supported in API schemas.",
+	)
+
+	ErrAnonymousFieldsNotSupported = errRange.New(
+		"Invalid API schema",
+		"Anonymous fields are not supported in API schemas.",
+	)
+
+	errInvalidHeaderType = errRange.Newf(
+		"Invalid request type",
+		"API request parameters of type %s are not supported in headers. You can only "+
+			"use built-in types types such as strings, booleans, int, time.Time.",
+
+		errors.WithDetails("See https://encore.dev/docs/develop/api-schemas#supported-types for more information."),
+	)
+
+	errInvalidQueryStringType = errRange.Newf(
+		"Invalid request type",
+		"API request parameters of type %s are not supported in query strings. You can only "+
+			"use built-in types, or slices of built-in types such as strings, booleans, int, time.Time.",
+
+		errors.WithDetails("APIs which are sent as GET, HEAD or DELETE requests are unable to contain JSON bodies, "+
+			"thus all parameters must be sent as query strings or headers. "+
+			"See https://encore.dev/docs/develop/api-schemas#supported-types for more information."),
+	)
+
+	errMultipleHTTPStatusFields = errRange.New(
+		"Invalid response type",
+		"Only one field can be tagged with encore:\"httpstatus\" per response struct.",
+	)
+
+	errHTTPStatusFieldMustBeInt = errRange.New(
+		"Invalid response type",
+		"Fields tagged with encore:\"httpstatus\" must be of an integer type.",
+	)
+)
diff --git a/v2/parser/apis/api/errors.go b/v2/parser/apis/api/errors.go
new file mode 100644
index 0000000000..355dd1765f
--- /dev/null
+++ b/v2/parser/apis/api/errors.go
@@ -0,0 +1,137 @@
+package api
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+const rawHint = `hint: signature must be func(http.ResponseWriter, *http.Request)
+
+For more information on how to use raw APIs see https://encore.dev/docs/primitives/raw-endpoints`
+
+const baseHint = "For more information on how to use APIs see https://encore.dev/docs/primitives/apis"
+
+var (
+	errRange = errors.Range(
+		"api",
+		`hint: valid signatures are:
+	- func(context.Context) error
+	- func(context.Context) (*ResponseData, error)
+	- func(context.Context, *RequestData) error
+	- func(context.Context, *RequestType) (*ResponseData, error)
+
+For more information on how to use APIs, see https://encore.dev/docs/primitives/apis`,
+
+		errors.WithRangeSize(50),
+	)
+
+	errDuplicateAccessOptions = errRange.Newf(
+		"Invalid API Directive",
+		"Multiple access options have been defined for the API; %s and %s. Pick once from %s.",
+	)
+
+	errInvalidEndpointMethod = errRange.Newf(
+		"Invalid API Directive",
+		"Invalid endpoint method %q.",
+	)
+
+	errEndpointMethodMustBeAllCaps = errRange.New(
+		"Invalid API Directive",
+		"Endpoint method must be ALLCAPS.",
+	)
+
+	errRawEndpointCantBePrivate = errRange.New(
+		"Invalid API Directive",
+		"Private APIs cannot be declared as raw endpoints.",
+	)
+
+	errWrongNumberParams = errRange.Newf(
+		"Invalid API Function",
+		"API functions must have at least 1 parameter, found %d parameters.",
+	)
+
+	errWrongNumberResults = errRange.Newf(
+		"Invalid API Function",
+		"API functions must have at most 1 or 2 results, found %d results.",
+	)
+
+	errInvalidFirstParam = errRange.New(
+		"Invalid API Function",
+		"The first parameter of an API function must be context.Context.",
+	)
+
+	errMultiplePayloads = errRange.New(
+		"Invalid API Function",
+		"API functions can only have one payload parameter.",
+	)
+
+	errInvalidPathParams = errRange.Newf(
+		"Invalid API Function",
+		"Expected function parameters named '%s' to match Endpoint path params.",
+	)
+
+	errLastResultMustBeError = errRange.New(
+		"Invalid API Function",
+		"The last result of an API function must be error.",
+	)
+
+	errInvalidRawParams = errRange.Newf(
+		"Invalid API Function",
+		"Raw APIs must have a two parameters of type http.ResponseWriter and *http.Request, got %d parameters.",
+
+		errors.WithDetails(rawHint),
+	)
+
+	errInvalidRawResults = errRange.Newf(
+		"Invalid API Function",
+		"Raw APIs must not return any results, got %d results.",
+
+		errors.WithDetails(rawHint),
+	)
+
+	errRawNotResponeWriter = errRange.New(
+		"Invalid API Function",
+		"Raw APIs must have a first parameter of type http.ResponseWriter.",
+
+		errors.WithDetails(rawHint),
+	)
+	errRawNotRequest = errRange.New(
+		"Invalid API Function",
+		"Raw APIs must have a second parameter of type *http.Request.",
+
+		errors.WithDetails(rawHint),
+	)
+
+	errUnexpectedParameterName = errRange.Newf(
+		"Invalid API Function",
+		"Unexpected parameter name %q expected %q (to match path parameter %q).",
+	)
+
+	errWildcardMustBeString = errRange.Newf(
+		"Invalid API Function",
+		"Wildcard parameter %q must be a string.",
+	)
+
+	errInvalidPathParamType = errRange.Newf(
+		"Invalid API Function",
+		"Path parameter %q must be a string, bool, integer, or encore.dev/types/uuid.UUID.",
+	)
+
+	ErrInvalidEndpointUsage = errRange.New(
+		"Invalid API Usage",
+		"APIs can not be referenced without being called, unless they are used as a cron job endpoint, or a PubSub subscription handler.",
+
+		errors.WithDetails(baseHint),
+	)
+
+	ErrAPICalledOutsideService = errRange.New(
+		"Invalid API call",
+		"APIs can only be called from within a service, the current call site is outside any services within the application.",
+
+		errors.WithDetails(baseHint),
+	)
+
+	ErrRawEndpointsCannotBeCalled = errRange.New(
+		"Invalid API call",
+		"Raw APIs cannot be called from within an Encore application.",
+	)
+)
diff --git a/v2/parser/apis/api/usage.go b/v2/parser/apis/api/usage.go
new file mode 100644
index 0000000000..a3aefd502f
--- /dev/null
+++ b/v2/parser/apis/api/usage.go
@@ -0,0 +1,71 @@
+package api
+
+import (
+	"go/ast"
+
+	"encr.dev/v2/parser/resource/usage"
+)
+
+type CallUsage struct {
+	usage.Base
+
+	// Endpoint is the endpoint being called.
+	Endpoint *Endpoint
+
+	// Call is the function call expression.
+	Call *ast.CallExpr
+}
+
+type ReferenceUsage struct {
+	usage.Base
+
+	// Endpoint is the endpoint being referenced.
+	Endpoint *Endpoint
+
+	// Ref is the reference expression.
+	Ref ast.Expr
+}
+
+func ResolveEndpointUsage(data usage.ResolveData, ep *Endpoint) usage.Usage {
+	switch expr := data.Expr.(type) {
+	case *usage.FuncCall:
+		return &CallUsage{
+			Base: usage.Base{
+				File: expr.File,
+				Bind: expr.Bind,
+				Expr: expr,
+			},
+			Endpoint: ep,
+			Call:     expr.Call,
+		}
+	case *usage.Other:
+		return &ReferenceUsage{
+			Base: usage.Base{
+				File: expr.File,
+				Bind: expr.Bind,
+				Expr: expr,
+			},
+			Endpoint: ep,
+			Ref:      expr.BindRef,
+		}
+	case *usage.FuncArg:
+		// If this is a test file and we're calling `et.MockEndpoint[WithMiddleware]` this is allowed.
+		if pkg, ok := expr.PkgFunc.Get(); ok && expr.DeclaredIn().TestFile && pkg.PkgPath == "encore.dev/et" && pkg.Name == "MockEndpoint" {
+			return &ReferenceUsage{
+				Base: usage.Base{
+					File: expr.File,
+					Bind: expr.Bind,
+					Expr: expr,
+				},
+				Endpoint: ep,
+				Ref:      expr.ASTExpr(),
+			}
+		}
+	}
+
+	// Check if the resource is referenced in a permissible location.
+	// Walk the stack to find the
+
+	data.Errs.Add(ErrInvalidEndpointUsage.AtGoNode(data.Expr))
+	return nil
+}
diff --git a/v2/parser/apis/authhandler/authhandler.go b/v2/parser/apis/authhandler/authhandler.go
new file mode 100644
index 0000000000..5494eb04d5
--- /dev/null
+++ b/v2/parser/apis/authhandler/authhandler.go
@@ -0,0 +1,161 @@
+package authhandler
+
+import (
+	"go/ast"
+	"go/token"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/apis/directive"
+	"encr.dev/v2/parser/resource"
+)
+
+// AuthHandler describes an Encore authentication handler.
+type AuthHandler struct {
+	Decl *schema.FuncDecl
+	Doc  string
+	Name string // the name of the auth handler.
+
+	// Param is the auth parameters.
+	// It's either a builtin string for token-based authentication,
+	// or a named struct type for complex auth parameters.
+	Param schema.Type
+
+	// Recv is the type the auth handler is defined as a method on, if any.
+	Recv option.Option[*schema.Receiver]
+
+	// AuthData is the custom auth data type the app specifies
+	// as part of the returns from the auth handler, if any.
+	AuthData option.Option[*schema.TypeDeclRef]
+}
+
+func (ah *AuthHandler) Kind() resource.Kind       { return resource.AuthHandler }
+func (ah *AuthHandler) Package() *pkginfo.Package { return ah.Decl.File.Pkg }
+func (ah *AuthHandler) Pos() token.Pos            { return ah.Decl.AST.Pos() }
+func (ah *AuthHandler) End() token.Pos            { return ah.Decl.AST.End() }
+func (ah *AuthHandler) SortKey() string           { return ah.Decl.File.Pkg.ImportPath.String() + "." + ah.Name }
+
+type ParseData struct {
+	Errs   *perr.List
+	Schema *schema.Parser
+
+	File *pkginfo.File
+	Func *ast.FuncDecl
+	Dir  *directive.Directive
+	Doc  string
+}
+
+// Parse parses the auth handler in the provided declaration.
+// It may return nil on errors.
+func Parse(d ParseData) *AuthHandler {
+	decl, ok := d.Schema.ParseFuncDecl(d.File, d.Func)
+	if !ok {
+		return nil
+	}
+
+	ah := &AuthHandler{
+		Decl: decl,
+		Name: decl.Name,
+		Doc:  d.Doc,
+		Recv: decl.Recv,
+	}
+
+	sig := decl.Type
+	numParams := len(sig.Params)
+
+	// Validate the input
+	if numParams != 2 {
+		d.Errs.Add(errInvalidNumberParameters(numParams).AtGoNode(sig.AST.Params))
+
+		if numParams < 2 {
+			return ah
+		}
+	}
+
+	numResults := len(sig.Results)
+	if numResults < 2 || numResults > 3 {
+		d.Errs.Add(errInvalidNumberResults(numResults).AtGoNode(sig.AST.Results))
+
+		if numParams < 2 {
+			return ah
+		}
+	}
+
+	// First param should always be context.Context
+	ctxParam := sig.Params[0]
+	if !schemautil.IsNamed(ctxParam.Type, "context", "Context") {
+		d.Errs.Add(errInvalidFirstParameter.AtGoNode(ctxParam.AST))
+	}
+
+	ah.Param = sig.Params[1].Type
+
+	// Second param should be string, or a pointer to a named struct
+	{
+		param := ah.Param
+		if schemautil.IsBuiltinKind(param, schema.String) {
+			// All good
+		} else if ref, ok := schemautil.ResolveNamedStruct(param, true); !ok {
+			d.Errs.Add(ErrInvalidAuthSchemaType.AtGoNode(param.ASTExpr()))
+		} else {
+			validateStructFields(d.Errs, ref.Decl.Type.(schema.StructType))
+		}
+	}
+
+	// First result must be auth.UID
+	if uid := sig.Results[0]; !schemautil.IsBuiltinKind(uid.Type, schema.UserID) {
+		d.Errs.Add(errInvalidFirstResult.AtGoNode(uid.AST.Type))
+	}
+
+	// If we have three results, the second one must be a pointer to a named struct.
+	if numResults > 2 {
+		if ref, ok := schemautil.ResolveNamedStruct(sig.Results[1].Type, true); !ok {
+			d.Errs.Add(errInvalidSecondResult.AtGoNode(sig.Results[1].AST.Type))
+		} else {
+			ah.AuthData = option.Some(ref)
+		}
+	}
+
+	return ah
+}
+
+// validateStructFields checks that the struct fields have the correct tags.
+// and all fields are either a header or query string
+func validateStructFields(errs *perr.List, ref schema.StructType) {
+	fieldErr := ErrInvalidFieldTags
+
+nextField:
+	for _, field := range ref.Fields {
+		// No tags, then we tell them they need to specify it
+		if field.Tag.Len() == 0 {
+			fieldErr = fieldErr.AtGoNode(field.AST, errors.AsError("you must specify a \"header\", \"query\", or \"cookie\" tag for this field"))
+			continue
+		}
+
+		// Check each tag to see if we have a header or query tag
+		for _, tagKey := range field.Tag.Keys() {
+			errMsg := ""
+
+			tag, err := field.Tag.Get(tagKey)
+			if err == nil {
+				switch tagKey {
+				case "header", "query", "qs", "cookie":
+					if tag.Name != "" && tag.Name != "-" {
+						continue nextField
+					} else {
+						errMsg = "you must specify a name for this field"
+					}
+				}
+			}
+
+			fieldErr = fieldErr.AtGoNode(field.AST.Tag, errors.AsError(errMsg))
+		}
+	}
+
+	if len(fieldErr.Locations) > 0 {
+		errs.Add(fieldErr)
+	}
+}
diff --git a/v2/parser/apis/authhandler/authhandler_test.go b/v2/parser/apis/authhandler/authhandler_test.go
new file mode 100644
index 0000000000..dc2329d22b
--- /dev/null
+++ b/v2/parser/apis/authhandler/authhandler_test.go
@@ -0,0 +1,158 @@
+package authhandler
+
+import (
+	"go/ast"
+	"go/token"
+	"strconv"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	. "encr.dev/v2/internals/schema/schematest"
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser/apis/directive"
+)
+
+func TestParseAuthHandler(t *testing.T) {
+	type testCase struct {
+		name     string
+		imports  []string
+		def      string
+		want     *AuthHandler
+		wantErrs []string
+	}
+
+	ctxParam := Param(Named(TypeInfo("Context")))
+	uidResult := Param(Builtin(schema.UserID))
+
+	tests := []testCase{
+		{
+			name: "basic_legacy",
+			def: `
+//encore:authhandler
+func Foo(ctx context.Context, token string) (auth.UID, error) {}
+`,
+			want: &AuthHandler{
+				Decl: &schema.FuncDecl{
+					Name: "Foo",
+					Type: schema.FuncType{
+						Params: []schema.Param{
+							ctxParam,
+							Param(String()),
+						},
+						Results: []schema.Param{
+							uidResult,
+							Param(Error()),
+						},
+					},
+				},
+				Param: String(),
+			},
+		},
+		{
+			name: "struct_params",
+			def: `
+type Params struct{}
+//encore:authhandler
+func Foo(ctx context.Context, p *Params) (auth.UID, error) {}
+`,
+			want: &AuthHandler{
+				Decl: &schema.FuncDecl{
+					Name: "Foo",
+					Type: schema.FuncType{
+						Params: []schema.Param{
+							ctxParam,
+							Param(Ptr(Named(TypeInfo("Params")))),
+						},
+						Results: []schema.Param{
+							uidResult,
+							Param(Error()),
+						},
+					},
+				},
+				Param: Ptr(Named(TypeInfo("Params"))),
+			},
+		},
+	}
+
+	// testArchive renders the txtar archive to use for a given test.
+	testArchive := func(test testCase) *txtar.Archive {
+		importList := append([]string{"context", "encore.dev/beta/auth"}, test.imports...)
+		imports := ""
+		if len(importList) > 0 {
+			imports = "import (\n"
+			for _, imp := range importList {
+				imports += "\t" + strconv.Quote(imp) + "\n"
+			}
+			imports += ")\n"
+		}
+
+		return testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+require encore.dev v1.13.4
+-- code.go --
+package foo
+` + imports + `
+
+` + test.def + `
+`)
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := qt.New(t)
+			a := testArchive(test)
+			tc := testutil.NewContext(c, false, a)
+			tc.GoModDownload()
+
+			l := pkginfo.New(tc.Context)
+			schemaParser := schema.NewParser(tc.Context, l)
+
+			if len(test.wantErrs) > 0 {
+				defer tc.DeferExpectError(test.wantErrs...)
+			} else {
+				tc.FailTestOnErrors()
+				defer tc.FailTestOnBailout()
+			}
+
+			pkg := l.MustLoadPkg(token.NoPos, "example.com")
+			f := pkg.Files[0]
+			fd := testutil.FindNodes[*ast.FuncDecl](f.AST())[0]
+
+			// Parse the directive from the func declaration.
+			dir, doc, ok := directive.Parse(tc.Errs, fd.Doc)
+			c.Assert(ok, qt.IsTrue)
+
+			pd := ParseData{
+				Errs:   tc.Errs,
+				Schema: schemaParser,
+				File:   f,
+				Func:   fd,
+				Dir:    dir,
+				Doc:    doc,
+			}
+
+			got := Parse(pd)
+
+			if len(test.wantErrs) == 0 {
+				// Check for equality, ignoring all the AST nodes and pkginfo types.
+				cmpEqual := qt.CmpEquals(
+					cmpopts.IgnoreInterfaces(struct{ ast.Node }{}),
+					cmpopts.IgnoreTypes(&schema.FuncDecl{}, &schema.TypeDecl{}, &pkginfo.File{}, &pkginfo.Package{}, token.Pos(0)),
+					cmpopts.EquateEmpty(),
+					cmpopts.IgnoreUnexported(schema.StructField{}, schema.NamedType{}),
+					cmp.Comparer(func(a, b *pkginfo.Package) bool {
+						return a.ImportPath == b.ImportPath
+					}),
+				)
+				c.Assert(got, cmpEqual, test.want)
+			}
+		})
+	}
+}
diff --git a/v2/parser/apis/authhandler/errors.go b/v2/parser/apis/authhandler/errors.go
new file mode 100644
index 0000000000..6fc634286b
--- /dev/null
+++ b/v2/parser/apis/authhandler/errors.go
@@ -0,0 +1,91 @@
+package authhandler
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+const authLink = "For more information on auth handlers and how to define them, see https://encore.dev/docs/develop/auth"
+
+var (
+	errRange = errors.Range(
+		"authhandler",
+		`hint: valid signatures are:
+	- func(ctx context.Context, p *Params) (auth.UID, error)
+	- func(ctx context.Context, p *Params) (auth.UID, *UserData, error)
+	- func(ctx context.Context, token string) (auth.UID, error)
+	- func(ctx context.Context, token string) (auth.UID, *UserData, error)
+
+note: *Params and *UserData are custom data types you define
+
+`+authLink,
+
+		errors.WithRangeSize(20),
+	)
+
+	errInvalidNumberParameters = errRange.Newf(
+		"Invalid auth handler Signature",
+		"The auth handler must have exactly 2 parameters, found %d.",
+	)
+
+	errInvalidNumberResults = errRange.Newf(
+		"Invalid auth handler Signature",
+		"The auth handler must have 2 or 3 result parameters, found %d.",
+	)
+
+	errInvalidFirstParameter = errRange.New(
+		"Invalid auth handler Signature",
+		"The first parameter must be a context.Context.",
+	)
+
+	ErrInvalidAuthSchemaType = errRange.New(
+		"Invalid auth handler Signature",
+		"The second parameter must be a string or a pointer to a named struct.",
+	)
+
+	errInvalidFirstResult = errRange.New(
+		"Invalid auth handler Signature",
+		"The first result must be of type auth.UID.",
+	)
+
+	errInvalidSecondResult = errRange.New(
+		"Invalid auth handler Signature",
+		"The second result must be a pointer to a named struct.",
+	)
+
+	errCannotCallFromAnotherPackage = errRange.New(
+		"Invalid auth handler usage",
+		"You can not directly call an auth handler from another package.",
+		errors.WithDetails(authLink),
+	)
+
+	errInvalidReference = errRange.New(
+		"Invalid auth handler usage",
+		"Auth handlers can only be called, but not referenced.",
+		errors.WithDetails(authLink),
+	)
+
+	ErrInvalidFieldTags = errRange.New(
+		"Invalid auth payload",
+		"All fields used within an auth payload must originate from either an HTTP header, a query parameter, or a cookie.",
+
+		errors.WithDetails(
+			"You can specify them for each field using the struct tags, for example with `header:\"X-My-Header\"`, `query:\"my-query\", or `cookie:\"my-cookie\"`.\n\n"+
+				authLink,
+		),
+	)
+
+	ErrMultipleAuthHandlers = errRange.New(
+		"Multiple auth handlers found",
+		"Multiple auth handlers were found in the application. Encore only allows one auth handler to be defined per application.",
+	)
+
+	ErrNoAuthHandlerDefined = errRange.New(
+		"No Auth Handler Defined",
+		"An auth handler must be defined to use the auth directive on an API.",
+
+		errors.WithDetails(
+			"You can specify them for each field using the struct tags, for example with `header:\"X-My-Header\"` or `query:\"my-query\"`.\n\n"+
+				authLink,
+		),
+	)
+)
diff --git a/v2/parser/apis/authhandler/usage.go b/v2/parser/apis/authhandler/usage.go
new file mode 100644
index 0000000000..4c7fea8684
--- /dev/null
+++ b/v2/parser/apis/authhandler/usage.go
@@ -0,0 +1,27 @@
+package authhandler
+
+import (
+	"encr.dev/pkg/errors"
+	"encr.dev/v2/parser/resource/usage"
+)
+
+func ResolveAuthHandlerUsage(data usage.ResolveData, handler *AuthHandler) usage.Usage {
+	switch expr := data.Expr.(type) {
+	case *usage.FuncCall:
+		if expr.DeclaredIn().Pkg != handler.Package() {
+			data.Errs.Add(
+				errCannotCallFromAnotherPackage.
+					AtGoNode(expr, errors.AsError("called here")).
+					AtGoNode(handler.Decl.AST.Name, errors.AsHelp("auth handler defined here")),
+			)
+		}
+	default:
+		data.Errs.Add(
+			errInvalidReference.
+				AtGoNode(expr, errors.AsError("referenced here")).
+				AtGoNode(handler.Decl.AST.Name, errors.AsHelp("auth handler defined here")),
+		)
+	}
+
+	return nil
+}
diff --git a/v2/parser/apis/directive/directive.go b/v2/parser/apis/directive/directive.go
new file mode 100644
index 0000000000..c0eee48401
--- /dev/null
+++ b/v2/parser/apis/directive/directive.go
@@ -0,0 +1,335 @@
+package directive
+
+import (
+	"bytes"
+	"fmt"
+	"go/ast"
+	"go/token"
+	"regexp"
+	"slices"
+	"strings"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/idents"
+	"encr.dev/v2/internals/perr"
+)
+
+// Directive represents a parsed "encore:" directive.
+type Directive struct {
+	AST *ast.CommentGroup // the comment group containing the directive
+
+	Name    string  // "foo" in "encore:foo"
+	Options []Field // options that are enabled ("public" and "raw" in "encore:api public raw path=/foo")
+	Fields  []Field // key-value pairs ({"path": "/foo"} in "encore:api public raw path=/foo")
+	Tags    []Field // tag names ("tag:foo" in "encore:api public tag:foo")
+
+	start   token.Pos // start position of the directive
+	nameEnd token.Pos
+	end     token.Pos // end position of the directive
+}
+
+var _ ast.Node = (*Directive)(nil)
+
+func (d Directive) Pos() token.Pos {
+	return d.start
+}
+
+func (d Directive) End() token.Pos {
+	return d.end
+}
+
+type Field struct {
+	Key   string
+	Value string
+
+	start token.Pos // position of the key
+	end   token.Pos // position of the end value
+}
+
+// Equal reports whether two fields are equal.
+// It's implemented for testing purposes.
+func (f Field) Equal(other Field) bool {
+	return f.Key == other.Key && f.Value == other.Value
+}
+
+var _ ast.Node = (*Field)(nil)
+
+func (f Field) Pos() token.Pos {
+	return f.start
+}
+
+func (f Field) End() token.Pos {
+	return f.end
+}
+
+// List returns the field value as a list, split by commas.
+func (f Field) List() []string {
+	return strings.Split(f.Value, ",")
+}
+
+// String returns the string representation of d.
+func (d Directive) String() string {
+	var b strings.Builder
+	b.WriteString("encore:")
+	b.WriteString(d.Name)
+	for _, o := range d.Options {
+		b.WriteByte(' ')
+		b.WriteString(o.Value)
+	}
+	for _, f := range d.Fields {
+		b.WriteByte(' ')
+		b.WriteString(f.Key)
+		b.WriteByte('=')
+		b.WriteString(f.Value)
+	}
+	for _, t := range d.Tags {
+		b.WriteByte(' ')
+		b.WriteString(t.Value)
+	}
+	return b.String()
+}
+
+// HasOption reports whether the directive contains the given option.
+func (d Directive) HasOption(name string) bool {
+	for _, o := range d.Options {
+		if o.Value == name {
+			return true
+		}
+	}
+	return false
+}
+
+// Get returns the value of the given field, if any.
+// If the field doesn't exist it reports "".
+func (d Directive) Get(name string) string {
+	for _, f := range d.Fields {
+		if f.Key == name {
+			return f.Value
+		}
+	}
+	return ""
+}
+
+// GetList returns the value of the given field, split by commas.
+// If the field doesn't exist it reports nil.
+func (d Directive) GetList(name string) []string {
+	for _, f := range d.Fields {
+		if f.Key == name {
+			return f.List()
+		}
+	}
+	return nil
+}
+
+// Parse parses the encore:foo directives in cg.
+// It returns the parsed directives, if any, and the
+// remaining doc text after stripping the directive lines.
+func Parse(errs *perr.List, cg *ast.CommentGroup) (dir *Directive, doc string, ok bool) {
+	if cg == nil {
+		return nil, "", true
+	}
+
+	// Go has standardized on directives in the form "//[a-z0-9]+:[a-z0-9+]".
+	// Encore has allowed a space between // and the Directive,
+	// but we would like to migrate to the standard syntax.
+	//
+	// First try the standard syntax and fall back to the legacy syntax
+	// if we don't find any directives.
+
+	// Standard syntax
+	var dirs []*Directive
+	for _, c := range cg.List {
+		const prefix = "//encore:"
+		if strings.HasPrefix(c.Text, prefix) {
+			dir, ok := parseOne(errs, c.Pos()+2, c.Text[len(prefix):])
+			if !ok {
+				return nil, "", false
+			}
+			dir.AST = cg
+			dirs = append(dirs, &dir)
+		}
+	}
+	if len(dirs) == 1 {
+		doc := cg.Text() // skips directives for us
+		return dirs[0], doc, true
+	} else if len(dirs) > 1 {
+		err := errMultipleDirectives
+		for _, dir := range dirs {
+			err = err.AtGoNode(dir)
+		}
+		errs.Add(err)
+		return nil, "", false
+	}
+
+	// Legacy syntax
+	lines := strings.Split(cg.Text(), "\n")
+	var docLines []string
+
+	for _, line := range lines {
+		const prefix = "encore:"
+		if strings.HasPrefix(line, prefix) {
+			pos := cg.Pos()
+
+			// Find the position of the directive.
+			for _, c := range cg.List {
+				idx := bytes.Index([]byte(c.Text), []byte(line))
+				if idx >= 0 {
+					pos = c.Pos() + token.Pos(idx)
+					break
+				}
+			}
+
+			dir, ok := parseOne(errs, pos, line[len(prefix):])
+			if !ok {
+				return nil, "", false
+			}
+			dir.AST = cg
+			dirs = append(dirs, &dir)
+			continue
+		}
+		docLines = append(docLines, line)
+	}
+
+	if len(dirs) == 0 {
+		return nil, cg.Text(), true
+	} else if len(dirs) > 1 {
+		err := errMultipleDirectives
+		for _, dir := range dirs {
+			err = err.AtGoNode(dir)
+		}
+		errs.Add(err)
+		return nil, "", false
+	}
+	doc = strings.TrimSpace(strings.Join(docLines, "\n"))
+	return dirs[0], doc, true
+}
+
+var (
+	// nameRe is the regexp for validating option names and field names.
+	nameRe = regexp.MustCompile(`^[a-z]+$`)
+	// tagRe is the regexp for validating tag values.
+	tagRe = regexp.MustCompile(`^[a-z]([-_a-z0-9]*[a-z0-9])?$`)
+)
+
+// parseOne parses a single Directive from line.
+// It does not set Directive.AST.
+func parseOne(errs *perr.List, pos token.Pos, line string) (d Directive, ok bool) {
+	fields := fields(pos+7, line) // +7 for "encore:"
+	if len(fields) == 0 {
+		errs.Add(errMissingDirectiveName.AtGoPos(pos, pos+7+token.Pos(len([]byte(line)))))
+		return Directive{}, false
+	}
+
+	// seen tracks fields already seen, to detect duplicates.
+	seen := make(map[string]Field, len(fields))
+
+	d.Name = fields[0].Value
+	d.start = pos
+	d.nameEnd = pos + 7 + token.Pos(len([]byte(d.Name)))
+	d.end = pos + +7 + token.Pos(len([]byte(line)))
+
+	for _, f := range fields[1:] {
+		// seenKey is the key to use for detecting duplicates.
+		// Default it to the field itself.
+		seenKey := f.Value
+
+		if strings.HasPrefix(f.Value, "tag:") {
+			tag := f.Value[len("tag:"):]
+
+			if other, found := seen[seenKey]; found {
+				errs.Add(errDuplicateTag(seenKey).AtGoNode(other).AtGoNode(f))
+				return Directive{}, false
+			} else if !tagRe.MatchString(tag) {
+				errs.Add(errInvalidTag(tag).
+					AtGoPos(f.start+4, f.end, errors.AsError(
+						fmt.Sprintf("try %q?", idents.GenerateSuggestion(tag, idents.KebabCase)),
+					)))
+				return Directive{}, false
+			}
+
+			d.Tags = append(d.Tags, f)
+		} else if key, value, ok := strings.Cut(f.Value, "="); ok {
+			seenKey = key
+			f.Key = key
+			f.Value = value
+
+			if value == "" {
+				errs.Add(errFieldHasNoValue.AtGoNode(f))
+				return Directive{}, false
+			} else if !nameRe.MatchString(key) {
+				errs.Add(errInvalidFieldName(key).AtGoPos(f.start, f.start+token.Pos(len([]byte(key)))))
+				return Directive{}, false
+			} else if other, found := seen[seenKey]; found {
+				errs.Add(errDuplicateField(seenKey).AtGoNode(f).AtGoNode(other))
+				return Directive{}, false
+			}
+			d.Fields = append(d.Fields, f)
+		} else {
+			if !nameRe.MatchString(f.Value) {
+				errs.Add(errInvalidOptionName(f.Value).AtGoNode(f))
+				return Directive{}, false
+			} else if other, found := seen[seenKey]; found {
+				errs.Add(errDuplicateOption(seenKey).AtGoNode(f).AtGoNode(other))
+				return Directive{}, false
+			}
+			d.Options = append(d.Options, f)
+		}
+
+		seen[seenKey] = f
+	}
+
+	return d, true
+}
+
+type ValidateSpec struct {
+	// AllowedFields and AllowedOptions are the allowed fields and options.
+	// Expected values must be found in the corresponding list.
+	AllowedOptions []string
+	AllowedFields  []string
+
+	// ValidateOption, if non-nil, is called for each option in the directive.
+	ValidateOption func(*perr.List, Field) (ok bool)
+
+	// ValidateField, if non-nil, is called for each field in the directive.
+	ValidateField func(*perr.List, Field) (ok bool)
+
+	// ValidateTag, if non-nil, is called for each tag in the directive.
+	// It is called with the whole tag, including the "tag:" prefix.
+	ValidateTag func(*perr.List, Field) (ok bool)
+}
+
+// Validate checks that the directive is valid according to spec.
+func Validate(errs *perr.List, d *Directive, spec ValidateSpec) (ok bool) {
+	// Check the options.
+	for _, o := range d.Options {
+		if !slices.Contains(spec.AllowedOptions, o.Value) {
+			errs.Add(errUnknownOption(o.Value, strings.Join(spec.AllowedOptions, ", ")).AtGoNode(o))
+			return false
+		}
+		if spec.ValidateOption != nil {
+			if !spec.ValidateOption(errs, o) {
+				return false
+			}
+		}
+	}
+
+	for _, f := range d.Fields {
+		if !slices.Contains(spec.AllowedFields, f.Key) {
+			errs.Add(errUnknownField(f.Key, strings.Join(spec.AllowedFields, ", ")).AtGoNode(f))
+			return false
+		}
+		if spec.ValidateField != nil {
+			if !spec.ValidateField(errs, f) {
+				return false
+			}
+		}
+	}
+	for _, t := range d.Tags {
+		if spec.ValidateTag != nil {
+			if !spec.ValidateTag(errs, t) {
+				return false
+			}
+		}
+	}
+	return true
+}
diff --git a/v2/parser/apis/directive/directive_test.go b/v2/parser/apis/directive/directive_test.go
new file mode 100644
index 0000000000..8128e30af9
--- /dev/null
+++ b/v2/parser/apis/directive/directive_test.go
@@ -0,0 +1,100 @@
+package directive
+
+import (
+	"context"
+	"go/token"
+	"regexp"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp/cmpopts"
+
+	"encr.dev/v2/internals/perr"
+)
+
+func TestParseDirective(t *testing.T) {
+	testcases := []struct {
+		desc     string
+		line     string
+		expected Directive
+		wantErr  string
+	}{
+		{
+			desc: "api public endpoint",
+			line: "api public",
+			expected: Directive{
+				Name:    "api",
+				Options: []Field{{Value: "public"}},
+			},
+		},
+		{
+			desc: "custom method",
+			line: "api public method=FOO",
+			expected: Directive{
+				Name:    "api",
+				Options: []Field{{Value: "public"}},
+				Fields:  []Field{{Key: "method", Value: "FOO"}},
+			},
+		},
+		{
+			desc: "multiple methods",
+			line: "api public raw method=GET,POST",
+			expected: Directive{
+				Name:    "api",
+				Options: []Field{{Value: "public"}, {Value: "raw"}},
+				Fields:  []Field{{Key: "method", Value: "GET,POST"}},
+			},
+		},
+		{
+			desc: "api with tags",
+			line: "api public tag:foo method=FOO raw tag:bar",
+			expected: Directive{
+				Name:    "api",
+				Options: []Field{{Value: "public"}, {Value: "raw"}},
+				Fields:  []Field{{Key: "method", Value: "FOO"}},
+				Tags:    []Field{{Value: "tag:foo"}, {Value: "tag:bar"}},
+			},
+		},
+		{
+			desc:    "api with duplicate tag",
+			line:    "api public tag:foo tag:foo",
+			wantErr: `(?m)The tag "tag:foo" is already defined on this declaration\.`,
+		},
+		{
+			desc: "middleware",
+			line: "middleware target=tag:foo,tag:bar",
+			expected: Directive{
+				Name:   "middleware",
+				Fields: []Field{{Key: "target", Value: "tag:foo,tag:bar"}},
+			},
+		},
+		{
+			desc:    "middleware empty target",
+			line:    "middleware target=",
+			wantErr: `(?m)Directive fields must have a value\.`,
+		},
+	}
+	for _, tc := range testcases {
+		t.Run(tc.desc, func(t *testing.T) {
+			c := qt.New(t)
+			fs := token.NewFileSet()
+			errs := perr.NewList(context.Background(), fs)
+			dir, ok := parseOne(errs, 0, tc.line)
+			if tc.wantErr != "" {
+				re := regexp.MustCompile(tc.wantErr)
+				if errStr := errs.FormatErrors(); !re.MatchString(errStr) {
+					c.Fatalf("error did not match regexp %s: %s", tc.wantErr, errStr)
+				}
+			} else {
+				c.Assert(ok, qt.IsTrue)
+
+				cmp := qt.CmpEquals(
+					cmpopts.EquateEmpty(),
+					cmpopts.IgnoreUnexported(Field{}),
+					cmpopts.IgnoreUnexported(Directive{}),
+				)
+				c.Assert(dir, cmp, tc.expected)
+			}
+		})
+	}
+}
diff --git a/v2/parser/apis/directive/errors.go b/v2/parser/apis/directive/errors.go
new file mode 100644
index 0000000000..817ee283a1
--- /dev/null
+++ b/v2/parser/apis/directive/errors.go
@@ -0,0 +1,69 @@
+package directive
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"directive",
+		"",
+
+		errors.WithRangeSize(20),
+	)
+
+	errMultipleDirectives = errRange.New(
+		"Multiple Directives",
+		"Multiple directives are not allowed on the same declaration.",
+	)
+
+	errMissingDirectiveName = errRange.New(
+		"Invalid Encore Directive",
+		"Directives must have a name. For example, `//encore:api` is valid, but `//encore:` is not.",
+	)
+
+	errDuplicateTag = errRange.Newf(
+		"Duplicate Tag",
+		"The tag %q is already defined on this declaration. Tags must be unique per directive.",
+	)
+
+	errInvalidTag = errRange.Newf(
+		"Invalid Tag",
+		"Invalid tag %q. Tags must start with a letter and contain only letters, numbers, hyphens and underscores.",
+	)
+
+	errFieldHasNoValue = errRange.New(
+		"Invalid Directive Field",
+		"Directive fields must have a value. For example, `//encore:api foo=bar` is valid, but `//encore:api foo=` is not.",
+	)
+
+	errInvalidFieldName = errRange.Newf(
+		"Invalid Directive Field",
+		"Invalid field name %q. Field names must start only contain letters.",
+	)
+
+	errDuplicateField = errRange.Newf(
+		"Duplicate Directive Field",
+		"The field %q is already defined on this directive. Fields must be unique per directive.",
+	)
+
+	errUnknownField = errRange.Newf(
+		"Invalid Directive Field",
+		"Unknown field %q. Fields must be one of %s.",
+	)
+
+	errInvalidOptionName = errRange.Newf(
+		"Invalid Directive Option",
+		"Invalid option name %q. Options must start only contain letters.",
+	)
+
+	errDuplicateOption = errRange.Newf(
+		"Duplicate Directive Option",
+		"The option %q is already defined on this directive. Options must be unique per directive.",
+	)
+
+	errUnknownOption = errRange.Newf(
+		"Invalid Directive Option",
+		"Unknown option %q. Options must be one of %s.",
+	)
+)
diff --git a/v2/parser/apis/directive/fields.go b/v2/parser/apis/directive/fields.go
new file mode 100644
index 0000000000..0644e905f6
--- /dev/null
+++ b/v2/parser/apis/directive/fields.go
@@ -0,0 +1,123 @@
+package directive
+
+import (
+	"go/token"
+	"unicode"
+	"unicode/utf8"
+)
+
+var asciiSpace = [256]uint8{'\t': 1, '\n': 1, '\v': 1, '\f': 1, '\r': 1, ' ': 1}
+
+// Fields splits the string s around each instance of one or more consecutive white space
+// characters, as defined by unicode.IsSpace, returning a slice of substrings of s or an
+// empty slice if s contains only white space.
+func fields(startPos token.Pos, s string) []Field {
+	// First count the fields.
+	// This is an exact count if s is ASCII, otherwise it is an approximation.
+	n := 0
+	wasSpace := 1
+	// setBits is used to track which bits are set in the bytes of s.
+	setBits := uint8(0)
+	for i := 0; i < len(s); i++ {
+		r := s[i]
+		setBits |= r
+		isSpace := int(asciiSpace[r])
+		n += wasSpace & ^isSpace
+		wasSpace = isSpace
+	}
+
+	if setBits >= utf8.RuneSelf {
+		// Some runes in the input string are not ASCII.
+		return fieldsFunc(startPos, s, unicode.IsSpace)
+	}
+	// ASCII fast path
+	a := make([]Field, n)
+	na := 0
+	fieldStart := 0
+	i := 0
+	// Skip spaces in the front of the input.
+	for i < len(s) && asciiSpace[s[i]] != 0 {
+		i++
+	}
+	fieldStart = i
+	for i < len(s) {
+		if asciiSpace[s[i]] == 0 {
+			i++
+			continue
+		}
+		a[na] = Field{
+			Value: s[fieldStart:i],
+			start: startPos + token.Pos(fieldStart),
+			end:   startPos + token.Pos(i),
+		}
+		na++
+		i++
+		// Skip spaces in between fields.
+		for i < len(s) && asciiSpace[s[i]] != 0 {
+			i++
+		}
+		fieldStart = i
+	}
+	if fieldStart < len(s) { // Last field might end at EOF.
+		a[na] = Field{
+			Value: s[fieldStart:],
+			start: startPos + token.Pos(fieldStart),
+			end:   startPos + token.Pos(len(s)),
+		}
+	}
+	return a
+}
+
+// FieldsFunc splits the string s at each run of Unicode code points c satisfying f(c)
+// and returns an array of slices of s. If all code points in s satisfy f(c) or the
+// string is empty, an empty slice is returned.
+//
+// FieldsFunc makes no guarantees about the order in which it calls f(c)
+// and assumes that f always returns the same value for a given c.
+func fieldsFunc(startPos token.Pos, s string, f func(rune) bool) []Field {
+	// A span is used to record a slice of s of the form s[start:end].
+	// The start index is inclusive and the end index is exclusive.
+	type span struct {
+		start int
+		end   int
+	}
+	spans := make([]span, 0, 32)
+
+	// Find the field start and end indices.
+	// Doing this in a separate pass (rather than slicing the string s
+	// and collecting the result substrings right away) is significantly
+	// more efficient, possibly due to cache effects.
+	start := -1 // valid span start if >= 0
+	for end, rune := range s {
+		if f(rune) {
+			if start >= 0 {
+				spans = append(spans, span{start, end})
+				// Set start to a negative value.
+				// Note: using -1 here consistently and reproducibly
+				// slows down this code by a several percent on amd64.
+				start = ^start
+			}
+		} else {
+			if start < 0 {
+				start = end
+			}
+		}
+	}
+
+	// Last field might end at EOF.
+	if start >= 0 {
+		spans = append(spans, span{start, len(s)})
+	}
+
+	// Create strings from recorded field indices.
+	a := make([]Field, len(spans))
+	for i, span := range spans {
+		a[i] = Field{
+			Value: s[span.start:span.end],
+			start: startPos + token.Pos(len([]byte(s[:span.start]))),
+		}
+		a[i].end = a[i].start + token.Pos(len([]byte(a[i].Value)))
+	}
+
+	return a
+}
diff --git a/v2/parser/apis/errors.go b/v2/parser/apis/errors.go
new file mode 100644
index 0000000000..8aaa0936ac
--- /dev/null
+++ b/v2/parser/apis/errors.go
@@ -0,0 +1,17 @@
+package apis
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"parser/apis",
+		"",
+	)
+
+	errUnexpectedDirective = errRange.Newf(
+		"Invalid directive",
+		"Unexpected directive %q on function declaration.",
+	)
+)
diff --git a/v2/parser/apis/middleware/errors.go b/v2/parser/apis/middleware/errors.go
new file mode 100644
index 0000000000..8efaec5350
--- /dev/null
+++ b/v2/parser/apis/middleware/errors.go
@@ -0,0 +1,66 @@
+package middleware
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"middleware",
+		"hint: middleware must have the signature:\n\t"+
+			"func(req middleware.Request, next middleware.Next) middleware.Response\n\n"+
+			"For more information on how to use middleware, see https://encore.dev/docs/develop/middleware",
+
+		errors.WithRangeSize(20),
+	)
+
+	errInvalidSelectorType = errRange.Newf(
+		"Invalid middleware selector",
+		"Middleware target only supports tags a selectors (got '%s').",
+	)
+
+	errWrongNumberParams = errRange.Newf(
+		"Invalid middleware function",
+		"Middleware functions must have exactly 2 parameters, found %d parameters.",
+	)
+
+	errWrongNumberResults = errRange.Newf(
+		"Invalid middleware function",
+		"Middleware functions must have exactly 1 result, found %d results.",
+	)
+
+	errInvalidFirstParam = errRange.New(
+		"Invalid middleware function",
+		"The first parameter of a middleware function must be middleware.Request.",
+	)
+
+	errInvalidSecondParam = errRange.New(
+		"Invalid middleware function",
+		"The second parameter of a middleware function must be middleware.Next.",
+	)
+
+	errInvalidReturnType = errRange.New(
+		"Invalid middleware function",
+		"The return type of a middleware function must be middleware.Response.",
+	)
+
+	ErrInvalidTargetForService = errRange.Newf(
+		"Invalid middleware target",
+		"There are not matching targets in service %q.",
+	)
+
+	ErrInvalidTargetForApp = errRange.New(
+		"Invalid middleware target",
+		"There are not matching targets in the application.",
+	)
+
+	ErrSvcMiddlewareNotInService = errRange.New(
+		"Invalid middleware function",
+		"Middleware must be defined in a service unless it is marked as being global.",
+	)
+
+	ErrGlobalMiddlewareDefinedInService = errRange.New(
+		"Invalid middleware function",
+		"Global middleware cannot be defined in a service.",
+	)
+)
diff --git a/v2/parser/apis/middleware/middleware.go b/v2/parser/apis/middleware/middleware.go
new file mode 100644
index 0000000000..9dee15ef69
--- /dev/null
+++ b/v2/parser/apis/middleware/middleware.go
@@ -0,0 +1,176 @@
+package middleware
+
+import (
+	"cmp"
+	"fmt"
+	"go/ast"
+	"go/token"
+	"slices"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/apis/directive"
+	"encr.dev/v2/parser/apis/selector"
+	"encr.dev/v2/parser/internal/utils"
+	"encr.dev/v2/parser/resource"
+)
+
+// Middleware describes an Encore middleware.
+type Middleware struct {
+	Decl *schema.FuncDecl
+	Doc  string
+	File *pkginfo.File // file it's declared in
+
+	// Global specifies whether the middleware is global or service-local.
+	Global bool
+
+	// Target specifies the set of API endpoints the middleware applies to.
+	Target selector.Set
+
+	// Recv is the type the middleware is defined as a method on, if any.
+	Recv option.Option[*schema.Receiver]
+}
+
+// ID returns a unique id for this specific middleware.
+func (mw *Middleware) ID() string {
+	return mw.Decl.File.Pkg.ImportPath.String() + "." + mw.Decl.Name
+}
+
+func (mw *Middleware) Kind() resource.Kind       { return resource.Middleware }
+func (mw *Middleware) Package() *pkginfo.Package { return mw.File.Pkg }
+func (mw *Middleware) Pos() token.Pos            { return mw.Decl.AST.Pos() }
+func (mw *Middleware) End() token.Pos            { return mw.Decl.AST.End() }
+func (mw *Middleware) SortKey() string {
+	return mw.Decl.File.Pkg.ImportPath.String() + "." + mw.Decl.Name
+}
+
+type ParseData struct {
+	Errs   *perr.List
+	Schema *schema.Parser
+
+	File *pkginfo.File
+	Func *ast.FuncDecl
+	Dir  *directive.Directive
+	Doc  string
+}
+
+// Parse parses the middleware in the provided declaration.
+// It may return nil on errors.
+func Parse(d ParseData) *Middleware {
+	decl, ok := d.Schema.ParseFuncDecl(d.File, d.Func)
+	if !ok {
+		return nil
+	}
+
+	mw := &Middleware{
+		Decl:   decl,
+		Doc:    d.Doc,
+		File:   d.File,
+		Recv:   decl.Recv,
+		Global: d.Dir.HasOption("global"),
+	}
+	ok = directive.Validate(d.Errs, d.Dir, directive.ValidateSpec{
+		AllowedOptions: []string{"global"},
+		AllowedFields:  []string{"target"},
+		ValidateOption: nil,
+		ValidateField: func(errs *perr.List, f directive.Field) (ok bool) {
+			switch f.Key {
+			case "target":
+				parts := f.List()
+				for _, p := range parts {
+					sel, ok := selector.Parse(errs, f.Pos()+7, p) // + 7 for "target="
+					if !ok {
+						return false
+					}
+
+					switch sel.Type {
+					case selector.Tag, selector.All:
+					default:
+						errs.Add(errInvalidSelectorType(sel.Type).AtGoNode(f))
+						return false
+					}
+					mw.Target.Add(sel)
+				}
+			}
+			return true
+		},
+		ValidateTag: nil,
+	})
+	if !ok {
+		return mw
+	}
+
+	sig := decl.Type
+	numParams := len(sig.Params)
+
+	// Validate the input
+	if numParams < 2 {
+		d.Errs.Add(errWrongNumberParams(numParams).AtGoNode(sig.AST.Params))
+		return mw
+	} else if numParams > 2 {
+		d.Errs.Add(errWrongNumberParams(numParams).AtGoNode(sig.AST.Params))
+	}
+
+	numResults := len(sig.Results)
+	if numResults < 1 {
+		d.Errs.Add(errWrongNumberResults(numResults).AtGoNode(sig.AST.Results))
+		return mw
+	} else if numResults > 1 {
+		d.Errs.Add(errWrongNumberResults(numResults).AtGoNode(sig.AST.Results))
+	}
+
+	if !schemautil.IsNamed(sig.Params[0].Type, "encore.dev/middleware", "Request") {
+		d.Errs.Add(
+			errInvalidFirstParam.
+				AtGoNode(sig.Params[0].AST, errors.AsError(fmt.Sprintf("got %s", utils.PrettyPrint(sig.Params[0].Type.ASTExpr())))),
+		)
+	}
+	if !schemautil.IsNamed(sig.Params[1].Type, "encore.dev/middleware", "Next") {
+		d.Errs.Add(
+			errInvalidSecondParam.
+				AtGoNode(sig.Params[1].AST, errors.AsError(fmt.Sprintf("got %s", utils.PrettyPrint(sig.Params[1].Type.ASTExpr())))),
+		)
+	}
+	if !schemautil.IsNamed(sig.Results[0].Type, "encore.dev/middleware", "Response") {
+		d.Errs.Add(
+			errInvalidReturnType.
+				AtGoNode(sig.Results[0].AST, errors.AsError(fmt.Sprintf("got %s", utils.PrettyPrint(sig.Results[0].Type.ASTExpr())))),
+		)
+	}
+
+	return mw
+}
+
+// Sort sorts the middleware to ensure they execute in deterministic order.
+func Sort(mws []*Middleware) {
+	sortFn := func(a, b *Middleware) int {
+		// Globals come first
+		if a.Global != b.Global {
+			if a.Global {
+				return -1
+			} else {
+				return 1
+			}
+		}
+
+		// Then sort by package path
+		aPkg, bPkg := a.Decl.File.Pkg, b.Decl.File.Pkg
+		if n := cmp.Compare(aPkg.ImportPath, bPkg.ImportPath); n != 0 {
+			return n
+		}
+
+		// Then sort by file name
+		if n := cmp.Compare(a.Decl.File.Name, b.Decl.File.Name); n != 0 {
+			return n
+		}
+
+		// Sort by declaration order within the file
+		return cmp.Compare(a.Decl.AST.Pos(), b.Decl.AST.Pos())
+	}
+
+	slices.SortStableFunc(mws, sortFn)
+}
diff --git a/v2/parser/apis/middleware/middleware_test.go b/v2/parser/apis/middleware/middleware_test.go
new file mode 100644
index 0000000000..935e944bd9
--- /dev/null
+++ b/v2/parser/apis/middleware/middleware_test.go
@@ -0,0 +1,137 @@
+package middleware
+
+import (
+	"go/ast"
+	"go/token"
+	"strconv"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	. "encr.dev/v2/internals/schema/schematest"
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser/apis/directive"
+	"encr.dev/v2/parser/apis/selector"
+)
+
+func TestParseMiddleware(t *testing.T) {
+	type testCase struct {
+		name     string
+		imports  []string
+		def      string
+		want     *Middleware
+		wantErrs []string
+	}
+
+	mwParams := []schema.Param{
+		Param(Named(TypeInfo("Request"))),
+		Param(Named(TypeInfo("Next"))),
+	}
+	mwResults := []schema.Param{
+		Param(Named(TypeInfo("Response"))),
+	}
+
+	tests := []testCase{
+		{
+			name: "basic",
+			def: `
+//encore:middleware target=tag:foo
+func Foo(req middleware.Request, next middleware.Next) middleware.Response {}
+`,
+			want: &Middleware{
+				Decl: &schema.FuncDecl{
+					Name: "Foo",
+					Type: schema.FuncType{
+						Params:  mwParams,
+						Results: mwResults,
+					},
+				},
+				Target: selector.NewSet(selector.Selector{
+					Type:  selector.Tag,
+					Value: "foo",
+				}),
+			},
+		},
+	}
+
+	// testArchive renders the txtar archive to use for a given test.
+	testArchive := func(test testCase) *txtar.Archive {
+		importList := append([]string{"context", "encore.dev/middleware"}, test.imports...)
+		imports := ""
+		if len(importList) > 0 {
+			imports = "import (\n"
+			for _, imp := range importList {
+				imports += "\t" + strconv.Quote(imp) + "\n"
+			}
+			imports += ")\n"
+		}
+
+		return testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+require encore.dev v1.13.4
+-- code.go --
+package foo
+` + imports + `
+
+` + test.def + `
+`)
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := qt.New(t)
+			a := testArchive(test)
+			tc := testutil.NewContext(c, false, a)
+			tc.GoModDownload()
+
+			l := pkginfo.New(tc.Context)
+			schemaParser := schema.NewParser(tc.Context, l)
+
+			if len(test.wantErrs) > 0 {
+				defer tc.DeferExpectError(test.wantErrs...)
+			} else {
+				tc.FailTestOnErrors()
+				defer tc.FailTestOnBailout()
+			}
+
+			pkg := l.MustLoadPkg(token.NoPos, "example.com")
+			f := pkg.Files[0]
+			fd := testutil.FindNodes[*ast.FuncDecl](f.AST())[0]
+
+			// Parse the directive from the func declaration.
+			dir, doc, ok := directive.Parse(tc.Errs, fd.Doc)
+			c.Assert(ok, qt.IsTrue)
+			c.Assert(ok, qt.IsTrue)
+
+			pd := ParseData{
+				Errs:   tc.Errs,
+				Schema: schemaParser,
+				File:   f,
+				Func:   fd,
+				Dir:    dir,
+				Doc:    doc,
+			}
+
+			got := Parse(pd)
+			if len(test.wantErrs) == 0 {
+				// Check for equality, ignoring all the AST nodes and pkginfo types.
+				cmpEqual := qt.CmpEquals(
+					cmpopts.IgnoreInterfaces(struct{ ast.Node }{}),
+					cmpopts.IgnoreTypes(&schema.FuncDecl{}, &schema.TypeDecl{}, &pkginfo.File{}, &pkginfo.Package{}, token.Pos(0)),
+					cmpopts.EquateEmpty(),
+					cmpopts.IgnoreUnexported(schema.StructField{}, schema.NamedType{}),
+					cmp.Comparer(func(a, b *pkginfo.Package) bool {
+						return a.ImportPath == b.ImportPath
+					}),
+				)
+				c.Assert(got, cmpEqual, test.want)
+			}
+		})
+	}
+}
diff --git a/v2/parser/apis/parser.go b/v2/parser/apis/parser.go
new file mode 100644
index 0000000000..3959554e52
--- /dev/null
+++ b/v2/parser/apis/parser.go
@@ -0,0 +1,131 @@
+package apis
+
+import (
+	"go/ast"
+	"go/token"
+
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/authhandler"
+	"encr.dev/v2/parser/apis/directive"
+	"encr.dev/v2/parser/apis/middleware"
+	"encr.dev/v2/parser/apis/servicestruct"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+var Parser = &resourceparser.Parser{
+	Name: "APIs",
+
+	InterestingImports: resourceparser.RunAlways,
+	Run: func(p *resourceparser.Pass) {
+		for _, file := range p.Pkg.Files {
+			for _, decl := range file.AST().Decls {
+				switch decl := decl.(type) {
+				case *ast.FuncDecl:
+					if decl.Doc == nil {
+						continue
+					}
+
+					dir, doc, ok := directive.Parse(p.Errs, decl.Doc)
+					if !ok {
+						continue
+					} else if dir == nil {
+						continue
+					}
+
+					switch dir.Name {
+					case "api":
+						ep := api.Parse(api.ParseData{
+							Errs:   p.Errs,
+							Schema: p.SchemaParser,
+							File:   file,
+							Func:   decl,
+							Dir:    dir,
+							Doc:    doc,
+						})
+
+						if ep != nil {
+							p.RegisterResource(ep)
+							// We unconditionally register a package-level bind here,
+							// even if the endpoint is defined on a service struct.
+							//
+							// This is the case because we generate a package-level
+							// wrapper function that forwards to the service struct
+							// method in that case.
+							p.AddNamedBind(file, ep.Decl.AST.Name, ep)
+						}
+
+					case "authhandler":
+						ah := authhandler.Parse(authhandler.ParseData{
+							Errs:   p.Errs,
+							Schema: p.SchemaParser,
+							File:   file,
+							Func:   decl,
+							Dir:    dir,
+							Doc:    doc,
+						})
+						if ah != nil {
+							p.RegisterResource(ah)
+							if ah.Recv.Empty() {
+								p.AddNamedBind(file, ah.Decl.AST.Name, ah)
+							}
+						}
+
+					case "middleware":
+						mw := middleware.Parse(middleware.ParseData{
+							Errs:   p.Errs,
+							Schema: p.SchemaParser,
+							File:   file,
+							Func:   decl,
+							Dir:    dir,
+							Doc:    doc,
+						})
+
+						if mw != nil {
+							p.RegisterResource(mw)
+							if mw.Recv.Empty() {
+								p.AddNamedBind(file, mw.Decl.AST.Name, mw)
+							}
+						}
+
+					default:
+						p.Errs.Add(errUnexpectedDirective(dir.Name).AtGoNode(decl))
+					}
+
+				case *ast.GenDecl:
+					if decl.Tok != token.TYPE {
+						continue
+					} else if decl.Doc == nil {
+						continue
+					}
+
+					dir, doc, ok := directive.Parse(p.Errs, decl.Doc)
+					if !ok {
+						continue
+					} else if dir == nil {
+						continue
+					}
+
+					switch dir.Name {
+					case "service":
+						ss := servicestruct.Parse(servicestruct.ParseData{
+							Errs:   p.Errs,
+							Schema: p.SchemaParser,
+							File:   file,
+							Decl:   decl,
+							Dir:    dir,
+							Doc:    doc,
+						})
+
+						if ss != nil {
+							p.RegisterResource(ss)
+							p.AddNamedBind(file, ss.Decl.AST.Name, ss)
+						}
+
+					default:
+						p.Errs.Add(errUnexpectedDirective(dir.Name).AtGoNode(decl))
+					}
+				}
+			}
+		}
+	},
+}
diff --git a/v2/parser/apis/selector/errors.go b/v2/parser/apis/selector/errors.go
new file mode 100644
index 0000000000..445915ea5a
--- /dev/null
+++ b/v2/parser/apis/selector/errors.go
@@ -0,0 +1,29 @@
+package selector
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"selector",
+		"",
+
+		errors.WithRangeSize(10),
+	)
+
+	errMissingSelectorType = errRange.New(
+		"Invalid Selector",
+		"Missing selector type.",
+	)
+
+	errUnknownSelectorType = errRange.Newf(
+		"Invalid Selector",
+		"Unknown selector type %q.",
+	)
+
+	errInvalidSelectorValue = errRange.Newf(
+		"Invalid Selector",
+		"Invalid selector value %q.",
+	)
+)
diff --git a/v2/parser/apis/selector/selector.go b/v2/parser/apis/selector/selector.go
new file mode 100644
index 0000000000..4353f853ab
--- /dev/null
+++ b/v2/parser/apis/selector/selector.go
@@ -0,0 +1,236 @@
+package selector
+
+import (
+	"go/ast"
+	"go/token"
+	"regexp"
+	"slices"
+	"sort"
+	"strings"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
+	"encr.dev/v2/internals/perr"
+)
+
+type Type string
+
+// NOTE: New types added should be also added to meta.proto and est/selectors.go.
+
+const (
+	All Type = "all"
+	Tag Type = "tag"
+)
+
+type Selector struct {
+	// Ensure this type is not comparable,
+	// since it contains position information.
+	_ [0]func()
+
+	Type  Type
+	Value string
+
+	startPos token.Pos
+	endPos   token.Pos
+}
+
+// Key is a suitable key for a [Selector],
+// since selectors are not otherwise comparable.
+type Key struct {
+	Type  Type
+	Value string
+}
+
+var _ ast.Node = Selector{}
+
+func (s Selector) Pos() token.Pos {
+	return s.startPos
+}
+
+func (s Selector) End() token.Pos {
+	return s.endPos
+}
+
+func (s Selector) String() string {
+	if s.Type == All {
+		return "all"
+	}
+	return string(s.Type) + ":" + s.Value
+}
+
+// Key returns a Key for s.
+func (s Selector) Key() Key {
+	return Key{Type: s.Type, Value: s.Value}
+}
+
+// Equals reports whether s and o are equal on type and value.
+//
+// It does not compare the start and end positions.
+func (s Selector) Equals(o Selector) bool {
+	return s.Key() == o.Key()
+}
+
+func (s Selector) ToProto() *meta.Selector {
+	pb := &meta.Selector{Type: meta.Selector_UNKNOWN, Value: s.Value}
+	switch s.Type {
+	case All:
+		pb.Type = meta.Selector_ALL
+	case Tag:
+		pb.Type = meta.Selector_TAG
+	}
+	return pb
+}
+
+func Parse(errs *perr.List, startPos token.Pos, s string) (Selector, bool) {
+	if s == "all" {
+		return Selector{Type: All, Value: ""}, true
+	}
+
+	typ, val, ok := strings.Cut(s, ":")
+	if !ok {
+		errs.Add(errMissingSelectorType.AtGoPos(startPos, startPos+token.Pos(len([]byte(s)))))
+		return Selector{}, false
+	}
+
+	sel := Selector{
+		Type:     Type(typ),
+		Value:    val,
+		startPos: startPos,
+		endPos:   startPos + token.Pos(len([]byte(s))),
+	}
+
+	var re *regexp.Regexp
+	switch sel.Type {
+	case Tag:
+		re = tagRegexp
+	default:
+		errs.Add(errUnknownSelectorType(typ).AtGoNode(sel))
+		return Selector{}, false
+	}
+
+	if !re.MatchString(val) {
+		errs.Add(errInvalidSelectorValue(val).AtGoNode(sel))
+		return Selector{}, false
+	}
+
+	return sel, true
+}
+
+var (
+	tagRegexp = regexp.MustCompile(`^[a-z]([-_a-z0-9]*[a-z0-9])?$`)
+)
+
+type Set struct {
+	vals []Selector
+}
+
+func NewSet(sels ...Selector) Set {
+	var s Set
+	for _, sel := range sels {
+		s.Add(sel)
+	}
+	return s
+}
+
+// Add adds a selector to the set. It reports whether the selector was added,
+// meaning it reports false iff the set already contained that selector.
+//
+// Add ensures that the set is sorted.
+func (s *Set) Add(sel Selector) (added bool) {
+	idx := sort.Search(len(s.vals), func(i int) bool {
+		v := &s.vals[i]
+		return v.Type >= sel.Type && v.Value >= sel.Value
+	})
+
+	if idx < len(s.vals) && (s.vals)[idx].Equals(sel) {
+		return false
+	}
+
+	// Insert at the end
+	if idx == len(s.vals) {
+		s.vals = append(s.vals, sel)
+		return true
+	}
+
+	// Make space for the new selector by shifting the rest of the slice
+	s.vals = append(s.vals[:idx+1], s.vals[idx:]...)
+
+	// Insert the new selector
+	s.vals[idx] = sel
+
+	return true
+}
+
+// Merge adds all the selectors from other to s.
+//
+// It is equivalent to calling Add for each selector in other.
+func (s *Set) Merge(other Set) {
+	for _, sel := range other.vals {
+		s.Add(sel)
+	}
+}
+
+// Contains reports whether the set contains the given selector.
+func (s *Set) Contains(sel Selector) bool {
+	idx := sort.Search(len(s.vals), func(i int) bool {
+		v := &s.vals[i]
+		return v.Type >= sel.Type && v.Value >= sel.Value
+	})
+	return idx < len(s.vals) && (s.vals)[idx].Equals(sel)
+}
+
+// ContainsAny reports whether the set contains any of the selectors in other.
+//
+// It compares in linear time O(N) where N is the number of selectors in the
+// larger set. It is faster than calling Contains for each selector in other.
+func (s *Set) ContainsAny(other Set) bool {
+	// If this set contains the "all" selector it always matches.
+	if slices.IndexFunc(s.vals, func(sel Selector) bool { return sel.Type == All }) != -1 {
+		return true
+	}
+
+	i, j := 0, 0
+	for i < len(s.vals) && j < len(other.vals) {
+		iv, jv := &s.vals[i], &other.vals[j]
+
+		switch {
+		case iv.Type == All:
+			return true
+
+		case iv.Type == jv.Type:
+			if s.vals[i].Equals(other.vals[j]) {
+				return true
+			} else if iv.Value < jv.Value {
+				i++
+			} else {
+				j++
+			}
+
+		case iv.Type < jv.Type:
+			i++
+		case iv.Type > jv.Type:
+			j++
+		}
+	}
+	return false
+}
+
+// ForEach calls fn for each selector in the set.
+func (s *Set) ForEach(fn func(Selector)) {
+	for _, sel := range s.vals {
+		fn(sel)
+	}
+}
+
+// Len returns the number of selectors in the set.
+func (s *Set) Len() int {
+	return len(s.vals)
+}
+
+// ToProto returns the set as a slice of proto selectors.
+func (s *Set) ToProto() []*meta.Selector {
+	pbs := make([]*meta.Selector, len(s.vals))
+	for i, sel := range s.vals {
+		pbs[i] = sel.ToProto()
+	}
+	return pbs
+}
diff --git a/v2/parser/apis/selector/selector_test.go b/v2/parser/apis/selector/selector_test.go
new file mode 100644
index 0000000000..75006c9025
--- /dev/null
+++ b/v2/parser/apis/selector/selector_test.go
@@ -0,0 +1,28 @@
+package selector
+
+import "testing"
+
+func TestSet_ContainsAny(t *testing.T) {
+	tests := []struct {
+		name  string
+		set   []Selector
+		input []Selector
+		want  bool
+	}{
+		{
+			name:  "empty_input",
+			set:   []Selector{{Type: All}},
+			input: nil,
+			want:  true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			s := NewSet(tt.set...)
+			in := NewSet(tt.input...)
+			if got := s.ContainsAny(in); got != tt.want {
+				t.Errorf("ContainsAny() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
diff --git a/v2/parser/apis/servicestruct/errors.go b/v2/parser/apis/servicestruct/errors.go
new file mode 100644
index 0000000000..b9c96cf7b9
--- /dev/null
+++ b/v2/parser/apis/servicestruct/errors.go
@@ -0,0 +1,54 @@
+package servicestruct
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"servicestruct",
+		"For more information on service structs, see https://encore.dev/docs/primitives/services-and-apis/service-structs",
+
+		errors.WithRangeSize(20),
+	)
+
+	errInvalidDirectivePlacement = errRange.New(
+		"Invalid encore:service directive",
+		"encore:service directives must be placed on the declaration of a struct, not a group.",
+	)
+
+	errServiceStructMustNotBeGeneric = errRange.New(
+		"Invalid service struct",
+		"Service structs cannot be defined as generic types.",
+	)
+
+	errServiceInitCannotBeGeneric = errRange.New(
+		"Invalid service init function",
+		"Service init functions cannot be defined as generic functions.",
+	)
+
+	errServiceInitCannotHaveParams = errRange.New(
+		"Invalid service init function",
+		"Service init functions cannot have parameters.",
+	)
+
+	errServiceInitInvalidReturnType = errRange.Newf(
+		"Invalid service init function",
+		"Service init functions must return (*%s, error).",
+	)
+
+	ErrDuplicateServiceStructs = errRange.New(
+		"Multiple service structs found",
+		"Multiple service structs were found in the same service. Encore only allows one service struct to be defined per service.",
+	)
+
+	ErrReceiverNotAServiceStruct = errRange.New(
+		"Invalid service struct for API",
+		"API endpoints defined as receiver functions must be defined on a service struct.",
+	)
+
+	ErrServiceStructReferencedInAnotherService = errRange.New(
+		"Service struct referenced in another service",
+		"Service structs cannot be referenced in other services. They can only be referenced in the service that defines them.",
+	)
+)
diff --git a/v2/parser/apis/servicestruct/servicestruct.go b/v2/parser/apis/servicestruct/servicestruct.go
new file mode 100644
index 0000000000..dcddaf8712
--- /dev/null
+++ b/v2/parser/apis/servicestruct/servicestruct.go
@@ -0,0 +1,121 @@
+package servicestruct
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/apis/directive"
+	"encr.dev/v2/parser/internal/utils"
+	"encr.dev/v2/parser/resource"
+)
+
+// ServiceStruct describes a dependency injection struct for a service.
+type ServiceStruct struct {
+	Decl *schema.TypeDecl // decl is the type declaration
+	Doc  string
+
+	// Init is the function for initializing this group.
+	// It is nil if there is no initialization function.
+	Init option.Option[*schema.FuncDecl]
+}
+
+func (ss *ServiceStruct) Kind() resource.Kind       { return resource.ServiceStruct }
+func (ss *ServiceStruct) Package() *pkginfo.Package { return ss.Decl.File.Pkg }
+func (ss *ServiceStruct) Pos() token.Pos            { return ss.Decl.AST.Pos() }
+func (ss *ServiceStruct) End() token.Pos            { return ss.Decl.AST.End() }
+func (ss *ServiceStruct) SortKey() string {
+	return ss.Decl.File.Pkg.ImportPath.String() + "." + ss.Decl.Name
+}
+
+type ParseData struct {
+	Errs   *perr.List
+	Schema *schema.Parser
+
+	File *pkginfo.File
+	Decl *ast.GenDecl
+	Dir  *directive.Directive
+	Doc  string
+}
+
+// Parse parses the service struct in the provided type declaration.
+func Parse(d ParseData) *ServiceStruct {
+	// We don't allow anything on the directive besides "encore:service".
+	directive.Validate(d.Errs, d.Dir, directive.ValidateSpec{})
+
+	// We only support encore:service directives directly on the type declaration,
+	// not on a group of type declarations.
+	if len(d.Decl.Specs) != 1 {
+		d.Errs.Add(errInvalidDirectivePlacement.AtGoNode(d.Dir.AST))
+		if len(d.Decl.Specs) == 0 {
+			// We can't continue without at least one spec.
+			d.Errs.Bailout()
+		}
+	}
+
+	spec := d.Decl.Specs[0].(*ast.TypeSpec)
+	declInfo := d.File.Pkg.Names().PkgDecls[spec.Name.Name]
+	decl := d.Schema.ParseTypeDecl(declInfo)
+
+	ss := &ServiceStruct{
+		Decl: decl,
+		Doc:  d.Doc,
+	}
+
+	// Find the init function for this service struct, if any.
+	initFunc := d.File.Pkg.Names().PkgDecls["init"+ss.Decl.Name]
+	if initFunc != nil && initFunc.Type == token.FUNC {
+		init, ok := d.Schema.ParseFuncDecl(initFunc.File, initFunc.Func)
+		if ok {
+			ss.Init = option.Some(init)
+		}
+	}
+
+	validateServiceStruct(d, ss)
+	return ss
+}
+
+// validateServiceStruct validates that the service struct and associated init function
+// has the correct structure.
+func validateServiceStruct(d ParseData, ss *ServiceStruct) {
+	if len(ss.Decl.TypeParams) > 0 {
+		d.Errs.Add(errServiceStructMustNotBeGeneric.AtGoNode(ss.Decl.TypeParams[0].AST))
+	}
+
+	ss.Init.ForAll(func(initFunc *schema.FuncDecl) {
+		if len(initFunc.TypeParams) > 0 {
+			d.Errs.Add(errServiceInitCannotBeGeneric.AtGoNode(initFunc.TypeParams[0].AST))
+		}
+		if len(initFunc.Type.Params) > 0 {
+			d.Errs.Add(errServiceInitCannotHaveParams.AtGoNode(initFunc.Type.Params[0].AST))
+		}
+
+		// Ensure the return type is (*T, error) where T is the service struct.
+		if len(initFunc.Type.Results) != 2 {
+			// Wrong number of returns
+			d.Errs.Add(errServiceInitInvalidReturnType(ss.Decl.Name).AtGoNode(initFunc.AST))
+		} else if result, n := schemautil.Deref(initFunc.Type.Results[0].Type); n != 1 || !schemautil.IsNamed(result, ss.Decl.File.Pkg.ImportPath, ss.Decl.Name) {
+			// First type is not *T
+			d.Errs.Add(
+				errServiceInitInvalidReturnType(ss.Decl.Name).
+					AtGoNode(initFunc.AST, errors.AsError(
+						fmt.Sprintf("got %s", utils.PrettyPrint(initFunc.Type.Results[0].Type.ASTExpr())),
+					)),
+			)
+		} else if !schemautil.IsBuiltinKind(initFunc.Type.Results[1].Type, schema.Error) {
+			// Second type is not builtin error.
+			d.Errs.Add(
+				errServiceInitInvalidReturnType(ss.Decl.Name).
+					AtGoNode(initFunc.AST, errors.AsError(
+						fmt.Sprintf("got %s", utils.PrettyPrint(initFunc.Type.Results[1].Type.ASTExpr())),
+					)),
+			)
+		}
+	})
+}
diff --git a/v2/parser/apis/servicestruct/servicestruct_test.go b/v2/parser/apis/servicestruct/servicestruct_test.go
new file mode 100644
index 0000000000..4a2d16f9ea
--- /dev/null
+++ b/v2/parser/apis/servicestruct/servicestruct_test.go
@@ -0,0 +1,197 @@
+package servicestruct
+
+import (
+	"go/ast"
+	"go/token"
+	"strconv"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser/apis/directive"
+)
+
+func TestParseServiceStruct(t *testing.T) {
+	type testCase struct {
+		name     string
+		imports  []string
+		def      string
+		want     *ServiceStruct
+		wantErrs []string
+	}
+	file := fileForPkg("foo", "example.com")
+	tests := []testCase{
+		{
+			name: "basic",
+			def: `
+//encore:service
+type Foo struct {}
+`,
+			want: &ServiceStruct{
+				Decl: &schema.TypeDecl{
+					File:       file,
+					Name:       "Foo",
+					Type:       schema.StructType{},
+					TypeParams: nil,
+				},
+			},
+		},
+		{
+			name: "with_init_func",
+			def: `
+//encore:service
+type Foo struct {}
+func initFoo() (*Foo, error) {}
+`,
+			want: &ServiceStruct{
+				Decl: &schema.TypeDecl{
+					File:       file,
+					Name:       "Foo",
+					Type:       schema.StructType{},
+					TypeParams: nil,
+				},
+				Init: option.Some(&schema.FuncDecl{
+					Name: "initFoo",
+					Type: schema.FuncType{
+						Results: []schema.Param{
+							{Type: schema.PointerType{Elem: schema.NamedType{
+								DeclInfo: &pkginfo.PkgDeclInfo{
+									Name: "Foo",
+									Type: token.TYPE,
+								},
+							}}},
+							{Type: schema.BuiltinType{Kind: schema.Error}},
+						},
+					},
+				}),
+			},
+		},
+		{
+			name: "error_init_no_service",
+			def: `
+//encore:service
+type Foo struct {}
+func initFoo() error {}
+`,
+			wantErrs: []string{`.*Service init functions must return \(\*Foo, error\)`},
+		},
+		{
+			name: "error_init_no_pointer",
+			def: `
+//encore:service
+type Foo struct {}
+func initFoo() (Foo, error) {}
+`,
+			wantErrs: []string{`.*Service init functions must return \(\*Foo, error\)`},
+		},
+		{
+			name: "error_init_shadow_error",
+			def: `
+//encore:service
+type Foo struct {}
+func initFoo() (*Foo, error) {}
+type error int
+`,
+			wantErrs: []string{`.*Service init functions must return \(\*Foo, error\)`},
+		},
+		{
+			name: "error_init_bad_params",
+			def: `
+//encore:service
+type Foo struct {}
+func initFoo(int) (*Foo, error) {}
+`,
+			wantErrs: []string{`.*Service init functions cannot have parameters`},
+		},
+	}
+
+	// testArchive renders the txtar archive to use for a given test.
+	testArchive := func(test testCase) *txtar.Archive {
+		importList := append([]string{"context"}, test.imports...)
+		imports := ""
+		if len(importList) > 0 {
+			imports = "import (\n"
+			for _, imp := range importList {
+				imports += "\t" + strconv.Quote(imp) + "\n"
+			}
+			imports += ")\n"
+		}
+
+		return testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+require encore.dev v1.13.4
+-- code.go --
+package foo
+` + imports + `
+
+` + test.def + `
+`)
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := qt.New(t)
+			a := testArchive(test)
+			tc := testutil.NewContext(c, false, a)
+			tc.GoModDownload()
+
+			l := pkginfo.New(tc.Context)
+			schemaParser := schema.NewParser(tc.Context, l)
+
+			if len(test.wantErrs) > 0 {
+				defer tc.DeferExpectError(test.wantErrs...)
+			} else {
+				tc.FailTestOnErrors()
+				defer tc.FailTestOnBailout()
+			}
+
+			pkg := l.MustLoadPkg(token.NoPos, "example.com")
+			f := pkg.Files[0]
+			gd := testutil.FindNodes[*ast.GenDecl](f.AST())[1]
+
+			// Parse the directive from the func declaration.
+			dir, doc, ok := directive.Parse(tc.Errs, gd.Doc)
+			c.Assert(ok, qt.IsTrue)
+
+			pd := ParseData{
+				Errs:   tc.Errs,
+				Schema: schemaParser,
+				File:   f,
+				Decl:   gd,
+				Dir:    dir,
+				Doc:    doc,
+			}
+
+			got := Parse(pd)
+			if len(test.wantErrs) == 0 {
+				// Check for equality, ignoring all the AST nodes and pkginfo types.
+				cmpEqual := qt.CmpEquals(
+					cmpopts.IgnoreInterfaces(struct{ ast.Node }{}),
+					cmpopts.IgnoreTypes(&schema.FuncDecl{}, &schema.TypeDecl{}, &pkginfo.File{}, &pkginfo.Package{}, token.Pos(0)),
+					cmpopts.EquateEmpty(),
+					cmpopts.IgnoreUnexported(schema.StructField{}, schema.NamedType{}),
+					cmp.Comparer(func(a, b *pkginfo.Package) bool {
+						return a.ImportPath == b.ImportPath
+					}),
+				)
+				c.Assert(got, cmpEqual, test.want)
+			}
+		})
+	}
+}
+
+func fileForPkg(pkgName string, pkgPath paths.Pkg) *pkginfo.File {
+	return &pkginfo.File{Pkg: &pkginfo.Package{
+		Name:       pkgName,
+		ImportPath: pkgPath,
+	}}
+}
diff --git a/v2/parser/apis/servicestruct/usage.go b/v2/parser/apis/servicestruct/usage.go
new file mode 100644
index 0000000000..f7b34b04b1
--- /dev/null
+++ b/v2/parser/apis/servicestruct/usage.go
@@ -0,0 +1,22 @@
+package servicestruct
+
+import (
+	"encr.dev/v2/parser/resource/usage"
+)
+
+type Usage struct {
+	usage.Base
+
+	ServiceStruct *ServiceStruct
+}
+
+func ResolveServiceStructUsage(data usage.ResolveData, s *ServiceStruct) usage.Usage {
+	return &Usage{
+		Base: usage.Base{
+			File: data.Expr.DeclaredIn(),
+			Bind: data.Expr.ResourceBind(),
+			Expr: data.Expr,
+		},
+		ServiceStruct: s,
+	}
+}
diff --git a/v2/parser/infra/caches/cache_test.go b/v2/parser/infra/caches/cache_test.go
new file mode 100644
index 0000000000..30683ea410
--- /dev/null
+++ b/v2/parser/infra/caches/cache_test.go
@@ -0,0 +1,57 @@
+package caches
+
+import (
+	"testing"
+
+	"encr.dev/v2/parser/resource/resourcetest"
+)
+
+func TestParseCluster(t *testing.T) {
+	tests := []resourcetest.Case[*Cluster]{
+		{
+			Name: "basic",
+			Code: `
+// Cluster docs
+var x = cache.NewCluster("name", cache.ClusterConfig{})
+`,
+			Want: &Cluster{
+				Name:           "name",
+				Doc:            "Cluster docs\n",
+				EvictionPolicy: "allkeys-lru",
+			},
+		},
+		{
+			Name: "with_eviction_policy",
+			Code: `
+// Cluster docs
+var x = cache.NewCluster("name", cache.ClusterConfig{EvictionPolicy: cache.VolatileLFU})
+`,
+			Want: &Cluster{
+				Name:           "name",
+				Doc:            "Cluster docs\n",
+				EvictionPolicy: "volatile-lfu",
+			},
+		},
+		{
+			Name: "with_bad_eviction_policy",
+			Code: `
+// Cluster docs
+var x = cache.NewCluster("name", cache.ClusterConfig{EvictionPolicy: "x"})
+`,
+			WantErrs: []string{`.*Invalid Cache Eviction Policy.*`},
+		},
+		{
+			Name: "with_invalid_eviction_policy",
+			Code: `
+// Cluster docs
+var x = cache.NewCluster("name", cache.ClusterConfig{EvictionPolicy: cache.NonExisting})
+`,
+			WantErrs: []string{
+				".*Field `EvictionPolicy` must be a constant literal.*",
+				"Must be one of the constants defined in the cache package",
+			},
+		},
+	}
+
+	resourcetest.Run(t, ClusterParser, tests)
+}
diff --git a/v2/parser/infra/caches/cluster.go b/v2/parser/infra/caches/cluster.go
new file mode 100644
index 0000000000..41af6839b0
--- /dev/null
+++ b/v2/parser/infra/caches/cluster.go
@@ -0,0 +1,103 @@
+package caches
+
+import (
+	"go/ast"
+	"go/token"
+
+	"encore.dev/storage/cache"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	literals "encr.dev/v2/parser/infra/internal/literals"
+	parseutil "encr.dev/v2/parser/infra/internal/parseutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+type Cluster struct {
+	AST            *ast.CallExpr
+	Name           string // The unique name of the cache cluster
+	Doc            string // The documentation on the cluster
+	EvictionPolicy string
+	File           *pkginfo.File
+}
+
+func (c *Cluster) Kind() resource.Kind       { return resource.CacheCluster }
+func (c *Cluster) Package() *pkginfo.Package { return c.File.Pkg }
+func (c *Cluster) ASTExpr() ast.Expr         { return c.AST }
+func (c *Cluster) ResourceName() string      { return c.Name }
+func (c *Cluster) Pos() token.Pos            { return c.AST.Pos() }
+func (c *Cluster) End() token.Pos            { return c.AST.End() }
+func (c *Cluster) SortKey() string           { return c.Name }
+
+var ClusterParser = &resourceparser.Parser{
+	Name: "Cache Cluster",
+
+	InterestingImports: []paths.Pkg{"encore.dev/storage/cache"},
+	Run: func(p *resourceparser.Pass) {
+		name := pkginfo.QualifiedName{PkgPath: "encore.dev/storage/cache", Name: "NewCluster"}
+
+		spec := &parseutil.ReferenceSpec{
+			MinTypeArgs: 0,
+			MaxTypeArgs: 0,
+			Parse:       parseCluster,
+		}
+
+		parseutil.FindPkgNameRefs(p.Pkg, []pkginfo.QualifiedName{name}, func(file *pkginfo.File, name pkginfo.QualifiedName, stack []ast.Node) {
+			parseutil.ParseReference(p, spec, parseutil.ReferenceData{
+				File:         file,
+				Stack:        stack,
+				ResourceFunc: name,
+			})
+		})
+	},
+}
+
+func parseCluster(d parseutil.ReferenceInfo) {
+	displayName := d.ResourceFunc.NaiveDisplayName()
+	if len(d.Call.Args) != 2 {
+		d.Pass.Errs.Add(errExpectsTwoArgs(displayName).AtGoNode(d.Call))
+		return
+	}
+
+	clusterName := parseutil.ParseResourceName(d.Pass.Errs, displayName, "cache cluster name",
+		d.Call.Args[0], parseutil.KebabName, "")
+	if clusterName == "" {
+		// we already reported the error inside ParseResourceName
+		return
+	}
+
+	cfgLit, ok := literals.ParseStruct(d.Pass.Errs, d.File, "cache.ClusterConfig", d.Call.Args[1])
+	if !ok {
+		return // error reported by ParseStruct
+	}
+
+	// Decode the config
+	type decodedConfig struct {
+		EvictionPolicy string   `literal:",optional,default"`
+		DefaultExpiry  ast.Expr `literal:",optional,dynamic"`
+	}
+	defaultValues := decodedConfig{
+		EvictionPolicy: string(cache.AllKeysLRU),
+	}
+	config := literals.Decode[decodedConfig](d.Pass.Errs, cfgLit, &defaultValues)
+
+	switch cache.EvictionPolicy(config.EvictionPolicy) {
+	case cache.AllKeysLRU, cache.AllKeysLFU, cache.AllKeysRandom, cache.VolatileLRU,
+		cache.VolatileLFU, cache.VolatileTTL, cache.VolatileRandom, cache.NoEviction:
+		// all good
+	default:
+		d.Pass.Errs.Add(errInvalidEvictionPolicy.AtGoNode(d.Call.Args[1]))
+		return
+	}
+
+	cluster := &Cluster{
+		AST:            d.Call,
+		Name:           clusterName,
+		Doc:            d.Doc,
+		EvictionPolicy: config.EvictionPolicy,
+		File:           d.File,
+	}
+
+	d.Pass.RegisterResource(cluster)
+	d.Pass.AddBind(d.File, d.Ident, cluster)
+}
diff --git a/v2/parser/infra/caches/errors.go b/v2/parser/infra/caches/errors.go
new file mode 100644
index 0000000000..1ce6f8da58
--- /dev/null
+++ b/v2/parser/infra/caches/errors.go
@@ -0,0 +1,93 @@
+package caches
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"cache",
+		`For more information see https://encore.dev/docs/primitives/caching`,
+
+		errors.WithRangeSize(25),
+	)
+
+	errExpectsTwoArgs = errRange.Newf("Invalid cache construction", "%s expects two arguments, got %d.)")
+
+	ErrCouldNotResolveCacheCluster = errRange.New(
+		"Invalid Cache Keyspace Construction",
+		`Could not resolve the cache cluster: must refer to a package level variable.`,
+	)
+
+	errPrefixReserved = errRange.New(
+		"Invalid Cache Key Pattern",
+		"The prefix `__encore` is reserved for internal use by Encore.",
+	)
+
+	errKeyPatternMustBeNamedKey = errRange.New(
+		"Invalid Cache Key Pattern",
+		"KeyPattern parameter must be named ':key' for basic (non-struct) key types",
+	)
+
+	errInvalidKeyTypeParameter = errRange.Newf(
+		"Invalid Cache Key Type",
+		"%s has an invalid key type parameter: %s",
+	)
+
+	errKeyContainsAnonymousFields = errRange.New(
+		"Invalid Cache Key Type",
+		"The key type must not contain anonymous fields.",
+	)
+
+	errKeyContainsUnexportedFields = errRange.New(
+		"Invalid Cache Key Type",
+		"The key type must not contain unexported fields.",
+	)
+
+	errFieldNotUsedInKeyPattern = errRange.Newf(
+		"Invalid Cache Key Type",
+		"Invalid use of the key type, the field %s was not used in the KeyPattern",
+	)
+
+	errFieldIsInvalid = errRange.Newf(
+		"Invalid Cache Key Type",
+		"The field %s is invalid: %s",
+	)
+
+	errFieldDoesntExist = errRange.Newf(
+		"Invalid Cache Key Pattern",
+		"Field %s does not existing in key type %s",
+	)
+
+	errMustBeANamedStructType = errRange.New(
+		"Invalid Cache Value Type",
+		"Must be a named struct type.",
+	)
+
+	errStructMustNotBePointer = errRange.New(
+		"Invalid Cache Value Type",
+		"Must not be a pointer type.",
+	)
+
+	errInvalidEvictionPolicy = errRange.New(
+		"Invalid Cache Eviction Policy",
+		"Must be one of the constants defined in the cache package.",
+	)
+
+	ErrDuplicateCacheCluster = errRange.New(
+		"Duplicate Cache Cluster",
+		"Cache clusters must have unique names.",
+
+		errors.PrependDetails("I you wish to reuse the same cluster, export the original cache.Cluster object and reuse it here."),
+	)
+
+	ErrKeyspaceNotInService = errRange.New(
+		"Invalid Cache Keyspace",
+		"Cache keyspaces must be defined within a service.",
+	)
+
+	ErrKeyspaceUsedInOtherService = errRange.New(
+		"Invalid Cache Keyspace Usage",
+		"Cache keyspaces must be used within the same service they are defined in.",
+	)
+)
diff --git a/v2/parser/infra/caches/keyspace.go b/v2/parser/infra/caches/keyspace.go
new file mode 100644
index 0000000000..0630d1cd27
--- /dev/null
+++ b/v2/parser/infra/caches/keyspace.go
@@ -0,0 +1,280 @@
+package caches
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"strings"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/resourcepaths"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/infra/internal/literals"
+	"encr.dev/v2/parser/infra/internal/parseutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+type Keyspace struct {
+	AST     *ast.CallExpr
+	Doc     string        // The documentation on the keyspace
+	File    *pkginfo.File // File the keyspace is declared in.
+	Cluster pkginfo.QualifiedName
+
+	KeyType   schema.Type
+	ValueType schema.Type
+	Path      *resourcepaths.Path
+
+	// The struct literal for the config. Used to inject additional configuration
+	// at compile-time.
+	ConfigLiteral *ast.CompositeLit
+}
+
+func (k *Keyspace) Kind() resource.Kind       { return resource.CacheKeyspace }
+func (k *Keyspace) Package() *pkginfo.Package { return k.File.Pkg }
+func (k *Keyspace) ASTExpr() ast.Expr         { return k.AST }
+func (k *Keyspace) Pos() token.Pos            { return k.AST.Pos() }
+func (k *Keyspace) End() token.Pos            { return k.AST.End() }
+func (k *Keyspace) SortKey() string {
+	return fmt.Sprintf("%s:%s:%d", k.File.Pkg.ImportPath, k.File.Name, k.AST.Pos())
+}
+
+var KeyspaceParser = &resourceparser.Parser{
+	Name: "Cache Keyspace",
+
+	InterestingImports: []paths.Pkg{"encore.dev/storage/cache"},
+	Run: func(p *resourceparser.Pass) {
+		var (
+			names []pkginfo.QualifiedName
+			specs = make(map[pkginfo.QualifiedName]*parseutil.ReferenceSpec)
+		)
+		for _, c := range keyspaceConstructors {
+			name := pkginfo.QualifiedName{PkgPath: "encore.dev/storage/cache", Name: c.FuncName}
+			names = append(names, name)
+
+			numTypeArgs := 1
+			if c.ValueKind != implicitValue {
+				numTypeArgs = 2
+			}
+
+			c := c // capture for closure
+			parseFn := func(d parseutil.ReferenceInfo) {
+				parseKeyspace(c, d)
+			}
+
+			spec := &parseutil.ReferenceSpec{
+				MinTypeArgs: numTypeArgs,
+				MaxTypeArgs: numTypeArgs,
+				Parse:       parseFn,
+			}
+			specs[name] = spec
+		}
+
+		parseutil.FindPkgNameRefs(p.Pkg, names, func(file *pkginfo.File, name pkginfo.QualifiedName, stack []ast.Node) {
+			spec := specs[name]
+			parseutil.ParseReference(p, spec, parseutil.ReferenceData{
+				File:         file,
+				Stack:        stack,
+				ResourceFunc: name,
+			})
+		})
+	},
+}
+
+type valueKind int
+
+const (
+	// implicitValue means the user does not specify the value type as
+	// a type parameter, but is implicit from the constructor name.
+	// If used, the ImplicitValueType field must be set on the constructor spec.
+	implicitValue valueKind = iota
+
+	// basicValue means the constructor supports basic types only.
+	basicValue
+
+	// structValue means the constructor supports struct values only.
+	structValue
+)
+
+// cacheKeyspaceConstructor describes a particular cache keyspace constructor.
+type cacheKeyspaceConstructor struct {
+	FuncName          string
+	ValueKind         valueKind
+	ImplicitValueType schema.Type
+}
+
+var keyspaceConstructors = []cacheKeyspaceConstructor{
+	{"NewStringKeyspace", implicitValue, schema.BuiltinType{Kind: schema.String}},
+	{"NewIntKeyspace", implicitValue, schema.BuiltinType{Kind: schema.Int64}},
+	{"NewFloatKeyspace", implicitValue, schema.BuiltinType{Kind: schema.Float64}},
+	{"NewListKeyspace", basicValue, nil},
+	{"NewSetKeyspace", basicValue, nil},
+	{"NewStructKeyspace", structValue, nil},
+}
+
+func parseKeyspace(c cacheKeyspaceConstructor, d parseutil.ReferenceInfo) {
+	errs := d.Pass.Errs
+	constructorName := d.ResourceFunc.NaiveDisplayName()
+	if len(d.Call.Args) != 2 {
+		errs.Add(errExpectsTwoArgs(constructorName, len(d.Call.Args)).AtGoNode(d.Call))
+		return
+	}
+
+	clusterRef, ok := d.File.Names().ResolvePkgLevelRef(d.Call.Args[0])
+	if !ok {
+		errs.Add(ErrCouldNotResolveCacheCluster.AtGoNode(d.Call.Args[0]))
+		return
+	}
+
+	cfgLit, ok := literals.ParseStruct(errs, d.File, "cache.KeyspaceConfig", d.Call.Args[1])
+	if !ok {
+		return // error reported by ParseStruct
+	}
+
+	keyNode := d.TypeArgs[0].ASTExpr()
+	patternNode := cfgLit.Expr("KeyPattern")
+
+	// Decode the config
+	type decodedConfig struct {
+		KeyPattern    string   `literal:",required"`
+		DefaultExpiry ast.Expr `literal:",optional,dynamic"`
+	}
+	config := literals.Decode[decodedConfig](errs, cfgLit, nil)
+
+	const reservedPrefix = "__encore"
+	if strings.HasPrefix(config.KeyPattern, reservedPrefix) {
+		errs.Add(errPrefixReserved.AtGoNode(patternNode))
+		return
+	}
+
+	path, ok := resourcepaths.Parse(
+		errs,
+		cfgLit.Pos("KeyPattern")+1, // + 1 to offset the opening \"
+		config.KeyPattern,
+		resourcepaths.Options{
+			AllowWildcard: false,
+			AllowFallback: false,
+			PrefixSlash:   false,
+		},
+	)
+	if !ok {
+		return
+	}
+
+	// Get key and value types.
+	keyType := d.TypeArgs[0]
+	var valueType schema.Type
+	if c.ValueKind == implicitValue {
+		valueType = c.ImplicitValueType
+	} else {
+		valueType = d.TypeArgs[1]
+	}
+
+	// Check that the key type is a basic type or a named struct
+	{
+		validateBuiltin := func(b schema.BuiltinKind) error {
+			switch b {
+			case schema.Any:
+				return fmt.Errorf("'any'/'interface{}' is not supported")
+			case schema.JSON:
+				return fmt.Errorf("json.RawMessage is not supported")
+			case schema.Float64, schema.Float32:
+				return fmt.Errorf("floating point values are not supported")
+			}
+			return nil
+		}
+
+		builtinKey, keyIsBuiltin := keyType.(schema.BuiltinType)
+
+		unusedSegments := make(map[string]resourcepaths.Segment)
+		for _, seg := range path.Segments {
+			if seg.Type == resourcepaths.Literal {
+				continue
+			}
+			name := seg.Value
+			unusedSegments[name] = seg
+
+			if keyIsBuiltin && name != "key" {
+				errs.Add(errKeyPatternMustBeNamedKey.AtGoNode(seg))
+			}
+		}
+
+		// It should either be a builtin type or a (possibly pointer to a) named struct.
+		if keyIsBuiltin {
+			if err := validateBuiltin(builtinKey.Kind); err != nil {
+				errs.Add(errInvalidKeyTypeParameter(constructorName, err.Error()).AtGoNode(keyNode))
+			}
+		} else {
+			ref, ok := schemautil.ResolveNamedStruct(keyType, false)
+			if !ok {
+				errs.Add(errInvalidKeyTypeParameter(constructorName, "must be a basic type or a named struct type").AtGoNode(keyNode))
+			} else if ref.Pointers > 0 {
+				errs.Add(errInvalidKeyTypeParameter(constructorName, "must not be a pointer type").AtGoNode(keyNode))
+			} else {
+				// Validate the struct fields.
+				st := schemautil.ConcretizeWithTypeArgs(errs, ref.Decl.Type, ref.TypeArgs).(schema.StructType)
+
+				// Validate struct fields
+				for _, f := range st.Fields {
+					if f.IsAnonymous() {
+						errs.Add(errKeyContainsAnonymousFields.AtGoNode(f.AST))
+						continue
+					} else if !f.IsExported() {
+						errs.Add(errKeyContainsUnexportedFields.AtGoNode(f.AST))
+						continue
+					}
+
+					fieldName := f.Name.MustGet() // guaranteed by f.IsAnonymous check above
+					if _, exists := unusedSegments[fieldName]; !exists {
+						errs.Add(errFieldNotUsedInKeyPattern(fieldName).AtGoNode(f.AST).AtGoNode(patternNode))
+					} else {
+						delete(unusedSegments, fieldName)
+					}
+
+					if builtin, ok := f.Type.(schema.BuiltinType); ok {
+						if err := validateBuiltin(builtin.Kind); err != nil {
+							errs.Add(errFieldIsInvalid(fieldName, err.Error()).AtGoNode(f.AST))
+						}
+					} else {
+						errs.Add(errFieldIsInvalid(fieldName, "must be a basic type").
+							AtGoNode(f.AST, errors.AsError(fmt.Sprintf("found %s", f.Type))).
+							AtGoNode(keyNode, errors.AsHelp("instantiated here")))
+					}
+				}
+
+				// Ensure all path segments are valid field names
+				for fieldName, segment := range unusedSegments {
+					errs.Add(errFieldDoesntExist(fieldName, ref.Decl).AtGoNode(segment).AtGoNode(ref.Decl.AST.Name))
+				}
+			}
+		}
+	}
+
+	// Check the value type. We only need to do this for struct types since they need
+	// to be represented as 'any' constraints. Basic type constructors enforce that the value type
+	// through the Go type system and don't need to be verified again.
+	if c.ValueKind == structValue {
+		if ref, ok := schemautil.ResolveNamedStruct(valueType, false); !ok {
+			errs.Add(errMustBeANamedStructType.AtGoNode(d.TypeArgs[1].ASTExpr()))
+		} else if ref.Pointers > 0 {
+			errs.Add(errStructMustNotBePointer.AtGoNode(d.TypeArgs[1].ASTExpr()))
+		}
+	}
+
+	ks := &Keyspace{
+		AST:           d.Call,
+		Doc:           d.Doc,
+		File:          d.File,
+		Cluster:       clusterRef,
+		ConfigLiteral: cfgLit.Lit(),
+		Path:          path,
+		KeyType:       keyType,
+		ValueType:     valueType,
+	}
+
+	d.Pass.RegisterResource(ks)
+	d.Pass.AddBind(d.File, d.Ident, ks)
+}
diff --git a/v2/parser/infra/caches/keyspace_test.go b/v2/parser/infra/caches/keyspace_test.go
new file mode 100644
index 0000000000..219caa9bae
--- /dev/null
+++ b/v2/parser/infra/caches/keyspace_test.go
@@ -0,0 +1,143 @@
+package caches
+
+import (
+	"testing"
+
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/resourcepaths"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schematest"
+	"encr.dev/v2/parser/resource/resourcetest"
+)
+
+func TestParseKeyspace(t *testing.T) {
+	tests := []resourcetest.Case[*Keyspace]{
+		{
+			Name: "basic",
+			Code: `
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+// Keyspace docs
+var x = cache.NewStringKeyspace[string](cluster, cache.KeyspaceConfig{
+	KeyPattern: ":key",
+})
+`,
+			Want: &Keyspace{
+				Doc:       "Keyspace docs\n",
+				KeyType:   schematest.String(),
+				ValueType: schematest.String(),
+				Cluster:   pkginfo.Q("example.com", "cluster"),
+				Path: &resourcepaths.Path{
+					Segments: []resourcepaths.Segment{
+						{Type: resourcepaths.Param, Value: "key", ValueType: schema.String},
+					},
+				},
+			},
+		},
+		{
+			Name: "int",
+			Code: `
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+var x = cache.NewIntKeyspace[int64](cluster, cache.KeyspaceConfig{
+		KeyPattern: "int",
+	})
+`,
+			Want: &Keyspace{
+				KeyType:   schematest.Builtin(schema.Int64),
+				ValueType: schematest.Builtin(schema.Int64),
+				Cluster:   pkginfo.Q("example.com", "cluster"),
+				Path: &resourcepaths.Path{
+					Segments: []resourcepaths.Segment{
+						{Type: resourcepaths.Literal, Value: "int", ValueType: schema.String},
+					},
+				},
+			},
+		}, {
+			Name: "float",
+			Code: `
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+var x = cache.NewFloatKeyspace[string](cluster, cache.KeyspaceConfig{
+	KeyPattern: "float",
+})
+`,
+			Want: &Keyspace{
+				KeyType:   schematest.String(),
+				ValueType: schematest.Builtin(schema.Float64),
+				Cluster:   pkginfo.Q("example.com", "cluster"),
+				Path: &resourcepaths.Path{
+					Segments: []resourcepaths.Segment{
+						{Type: resourcepaths.Literal, Value: "float", ValueType: schema.String},
+					},
+				},
+			},
+		},
+		{
+			Name: "list",
+			Code: `
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+var x = cache.NewListKeyspace[string, bool](cluster, cache.KeyspaceConfig{
+	KeyPattern: "list",
+})
+`,
+			Want: &Keyspace{
+				KeyType:   schematest.String(),
+				ValueType: schematest.Bool(),
+				Cluster:   pkginfo.Q("example.com", "cluster"),
+				Path: &resourcepaths.Path{
+					Segments: []resourcepaths.Segment{
+						{Type: resourcepaths.Literal, Value: "list", ValueType: schema.String},
+					},
+				},
+			},
+		},
+		{
+			Name: "set",
+			Code: `
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+var x = cache.NewSetKeyspace[string, bool](cluster, cache.KeyspaceConfig{
+	KeyPattern: "set",
+})
+`,
+			Want: &Keyspace{
+				KeyType:   schematest.String(),
+				ValueType: schematest.Bool(),
+				Cluster:   pkginfo.Q("example.com", "cluster"),
+				Path: &resourcepaths.Path{
+					Segments: []resourcepaths.Segment{
+						{Type: resourcepaths.Literal, Value: "set", ValueType: schema.String},
+					},
+				},
+			},
+		},
+		{
+			Name: "struct",
+			Code: `
+type Foo struct {
+	Bar string
+}
+
+var cluster = cache.NewCluster("cluster", cache.ClusterConfig{})
+
+var x = cache.NewStructKeyspace[string, Foo](cluster, cache.KeyspaceConfig{
+	KeyPattern: "struct",
+})
+`,
+			Want: &Keyspace{
+				KeyType:   schematest.String(),
+				ValueType: schematest.Named(schematest.TypeInfo("Foo")),
+				Cluster:   pkginfo.Q("example.com", "cluster"),
+				Path: &resourcepaths.Path{
+					Segments: []resourcepaths.Segment{
+						{Type: resourcepaths.Literal, Value: "struct", ValueType: schema.String},
+					},
+				},
+			},
+		},
+	}
+
+	resourcetest.Run(t, KeyspaceParser, tests)
+}
diff --git a/v2/parser/infra/caches/testdata/cluster.txt b/v2/parser/infra/caches/testdata/cluster.txt
new file mode 100644
index 0000000000..f748d41d0e
--- /dev/null
+++ b/v2/parser/infra/caches/testdata/cluster.txt
@@ -0,0 +1,18 @@
+parse cache
+
+-- cluster.go --
+package test
+
+import "encore.dev/storage/cache"
+
+var a = cache.NewCluster( // res CacheCluster: {"Name": "foo", "EvictionPolicy": "allkeys-lru"}
+    "foo", cache.ClusterConfig{
+        EvictionPolicy: cache.AllKeysLRU,
+    },
+)
+
+var b = cache.NewCluster( // ERR invalid "EvictionPolicy" value: "x"
+    "foo", cache.ClusterConfig{
+        EvictionPolicy: "x",
+    },
+)
diff --git a/v2/parser/infra/caches/usage.go b/v2/parser/infra/caches/usage.go
new file mode 100644
index 0000000000..0f20f66c91
--- /dev/null
+++ b/v2/parser/infra/caches/usage.go
@@ -0,0 +1,22 @@
+package caches
+
+import (
+	"encr.dev/v2/parser/resource/usage"
+)
+
+type KeyspaceUsage struct {
+	usage.Base
+
+	Keyspace *Keyspace
+}
+
+func ResolveKeyspaceUsage(data usage.ResolveData, keyspace *Keyspace) usage.Usage {
+	return &KeyspaceUsage{
+		Base: usage.Base{
+			File: data.Expr.DeclaredIn(),
+			Bind: data.Expr.ResourceBind(),
+			Expr: data.Expr,
+		},
+		Keyspace: keyspace,
+	}
+}
diff --git a/v2/parser/infra/config/config.go b/v2/parser/infra/config/config.go
new file mode 100644
index 0000000000..a1cd0b9a21
--- /dev/null
+++ b/v2/parser/infra/config/config.go
@@ -0,0 +1,154 @@
+package config
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/infra/internal/parseutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+// Load represents a config load statement.
+type Load struct {
+	AST  *ast.CallExpr
+	File *pkginfo.File
+
+	// Type is the type of the config struct being loaded.
+	// It's guaranteed to be a (possibly pointer to a) named struct type.
+	Type schema.Type
+
+	// FuncCall is the AST node that represents the config.Load expression.
+	FuncCall *ast.CallExpr
+}
+
+func (*Load) Kind() resource.Kind         { return resource.ConfigLoad }
+func (l *Load) Package() *pkginfo.Package { return l.File.Pkg }
+func (l *Load) ASTExpr() ast.Expr         { return l.AST }
+func (l *Load) Pos() token.Pos            { return l.AST.Pos() }
+func (l *Load) End() token.Pos            { return l.AST.End() }
+func (l *Load) SortKey() string {
+	return fmt.Sprintf("%s:%s:%d", l.File.Pkg.ImportPath, l.File.Name, l.AST.Pos())
+}
+
+var LoadParser = &resourceparser.Parser{
+	Name: "ConfigLoad",
+
+	InterestingImports: []paths.Pkg{"encore.dev/config"},
+	Run: func(p *resourceparser.Pass) {
+		name := pkginfo.QualifiedName{PkgPath: "encore.dev/config", Name: "Load"}
+
+		spec := &parseutil.ReferenceSpec{
+			MinTypeArgs: 0,
+			MaxTypeArgs: 1,
+			Parse:       parseLoad,
+		}
+		parseutil.FindPkgNameRefs(p.Pkg, []pkginfo.QualifiedName{name}, func(file *pkginfo.File, name pkginfo.QualifiedName, stack []ast.Node) {
+			parseutil.ParseReference(p, spec, parseutil.ReferenceData{
+				File:         file,
+				Stack:        stack,
+				ResourceFunc: name,
+			})
+		})
+	},
+}
+
+func parseLoad(d parseutil.ReferenceInfo) {
+	errs := d.Pass.Errs
+
+	if len(d.Call.Args) > 0 {
+		errs.Add(errInvalidLoad.AtGoNode(d.Call))
+		return
+	}
+
+	if len(d.TypeArgs) != 1 {
+		errs.Add(errInvalidConfigType.AtGoNode(d.Call))
+	}
+
+	// Resolve the named struct used for the config type
+	ref, ok := schemautil.ResolveNamedStruct(d.TypeArgs[0], false)
+	if !ok {
+		errs.Add(errInvalidConfigType.AtGoNode(d.TypeArgs[0].ASTExpr()))
+		return
+	}
+
+	load := &Load{
+		AST:      d.Call,
+		File:     d.File,
+		Type:     d.TypeArgs[0],
+		FuncCall: d.Call,
+	}
+
+	concrete := schemautil.ConcretizeWithTypeArgs(errs, ref.ToType(), ref.TypeArgs)
+	walkCfgToVerify(d.Pass.Errs, load, concrete, false)
+
+	d.Pass.RegisterResource(load)
+	d.Pass.AddBind(d.File, d.Ident, load)
+}
+
+func walkCfgToVerify(errs *perr.List, load *Load, decl schema.Type, insideConfigValue bool) {
+	switch decl := decl.(type) {
+	case schema.BuiltinType:
+		// no-op ok
+	case schema.NamedType:
+		if decl.DeclInfo.File.Pkg.ImportPath == "encore.dev/config" {
+			if insideConfigValue {
+				errs.Add(errNestedValueUsage.
+					AtGoNode(decl.ASTExpr(), errors.AsError("cannot use config.Value inside a config.Value")).
+					AtGoNode(load, errors.AsHelp("config loaded here")),
+				)
+			}
+
+			switch decl.DeclInfo.Name {
+			case "Value", "Values":
+				// Value / Values are magic wrappers that are used to indicate a realtime
+				// config update
+				if len(decl.TypeArgs) > 0 {
+					walkCfgToVerify(errs, load, decl.TypeArgs[0], true)
+
+					// return so we don't verify the standard type
+					return
+				}
+			}
+		} else {
+			insideConfigValue = false
+		}
+
+		walkCfgToVerify(errs, load, decl.Decl().Type, insideConfigValue)
+	case schema.PointerType:
+		walkCfgToVerify(errs, load, decl.Elem, false)
+	case schema.ListType:
+		walkCfgToVerify(errs, load, decl.Elem, false)
+	case schema.MapType:
+		walkCfgToVerify(errs, load, decl.Key, false)
+		walkCfgToVerify(errs, load, decl.Value, false)
+	case schema.StructType:
+		for _, field := range decl.Fields {
+			if !field.IsExported() {
+				errs.Add(errUnexportedField.
+					AtGoNode(field.AST).
+					AtGoNode(load, errors.AsHelp("config loaded here")),
+				)
+			} else if field.IsAnonymous() {
+				errs.Add(errAnonymousField.
+					AtGoNode(field.AST).
+					AtGoNode(load, errors.AsHelp("config loaded here")),
+				)
+			} else {
+				walkCfgToVerify(errs, load, field.Type, false)
+			}
+		}
+	default:
+		errs.Add(errInvalidConfigTypeUsed.
+			AtGoNode(decl.ASTExpr(), errors.AsError("unsupported type")).
+			AtGoNode(load, errors.AsHelp("config loaded here")),
+		)
+	}
+}
diff --git a/v2/parser/infra/config/errors.go b/v2/parser/infra/config/errors.go
new file mode 100644
index 0000000000..6d6fddc539
--- /dev/null
+++ b/v2/parser/infra/config/errors.go
@@ -0,0 +1,59 @@
+package config
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"config",
+		"For more information on configuration, see https://encore.dev/docs/develop/config",
+
+		errors.WithRangeSize(25),
+	)
+
+	errInvalidLoad = errRange.New(
+		"Invalid call to config.Load[T]()",
+		"A call to config.Load[T]() does not accept any arguments.",
+	)
+
+	errInvalidConfigType = errRange.New(
+		"Invalid call to config.Load[T]()",
+		"A call to config.Load[T]() must be passed a named struct type as it's argument.",
+	)
+
+	ErrConfigUsedOutsideOfService = errRange.New(
+		"Invalid call to config.Load[T]()",
+		"A call to config.Load[T]() can only be made from within a service.",
+	)
+
+	ErrConfigUsedInSubPackage = errRange.New(
+		"Invalid call to config.Load[T]()",
+		"A call to config.Load[T]() can only be made from the top level package of a service.",
+	)
+
+	ErrCrossServiceConfigUse = errRange.New(
+		"Cross service config use",
+		"A config instance can only be referenced from within the service that the call to `config.Load[T]()` was made in.",
+	)
+
+	errUnexportedField = errRange.New(
+		"Invalid config type",
+		"Field is not exported and is in a datatype which is used by a call to `config.Load[T]()`. Unexported fields cannot be initialised by Encore, thus are not allowed in this context.",
+	)
+
+	errAnonymousField = errRange.New(
+		"Invalid config type",
+		"Field is an anonymous field and is in a datatype which is used by a call to `config.Load[T]()`. Anonymous fields cannot be initialised by Encore, thus are not allowed in this context.",
+	)
+
+	errInvalidConfigTypeUsed = errRange.New(
+		"Invalid config type",
+		"Types used within data structures which are used by a call to `config.Load[T]()` must either be a built-in type a inline struct or a named struct type.",
+	)
+
+	errNestedValueUsage = errRange.New(
+		"Invalid config type",
+		"The type of config.Value[T] cannot be another config.Value[T]",
+	)
+)
diff --git a/v2/parser/infra/config/usage.go b/v2/parser/infra/config/usage.go
new file mode 100644
index 0000000000..4197a3c3d2
--- /dev/null
+++ b/v2/parser/infra/config/usage.go
@@ -0,0 +1,23 @@
+package config
+
+import (
+	"encr.dev/v2/parser/resource/usage"
+)
+
+type ReferenceUsage struct {
+	usage.Base
+
+	// Load is the config load being used.
+	Cfg *Load
+}
+
+func ResolveConfigUsage(data usage.ResolveData, load *Load) usage.Usage {
+	return &ReferenceUsage{
+		Base: usage.Base{
+			File: data.Expr.DeclaredIn(),
+			Bind: data.Expr.ResourceBind(),
+			Expr: data.Expr,
+		},
+		Cfg: load,
+	}
+}
diff --git a/v2/parser/infra/crons/cron.go b/v2/parser/infra/crons/cron.go
new file mode 100644
index 0000000000..e57e3ae1af
--- /dev/null
+++ b/v2/parser/infra/crons/cron.go
@@ -0,0 +1,197 @@
+package crons
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"sort"
+
+	cronparser "github.com/robfig/cron/v3"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	literals "encr.dev/v2/parser/infra/internal/literals"
+	parseutil "encr.dev/v2/parser/infra/internal/parseutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+type Job struct {
+	AST      *ast.CallExpr
+	File     *pkginfo.File
+	Name     string // The unique name of the cron job
+	Doc      string // The documentation on the cron job
+	Title    string // cron job title
+	Schedule string
+
+	Endpoint    pkginfo.QualifiedName // The Endpoint reference
+	EndpointAST ast.Expr
+}
+
+func (j *Job) Kind() resource.Kind       { return resource.CronJob }
+func (j *Job) Package() *pkginfo.Package { return j.File.Pkg }
+func (j *Job) ASTExpr() ast.Expr         { return j.AST }
+func (j *Job) ResourceName() string      { return j.Name }
+func (j *Job) Pos() token.Pos            { return j.AST.Pos() }
+func (j *Job) End() token.Pos            { return j.AST.End() }
+func (j *Job) SortKey() string           { return j.Name }
+
+var JobParser = &resourceparser.Parser{
+	Name: "Cron Job",
+
+	InterestingImports: []paths.Pkg{"encore.dev/cron"},
+	Run: func(p *resourceparser.Pass) {
+		name := pkginfo.QualifiedName{PkgPath: "encore.dev/cron", Name: "NewJob"}
+
+		spec := &parseutil.ReferenceSpec{
+			MinTypeArgs: 0,
+			MaxTypeArgs: 0,
+			Parse:       parseCronJob,
+		}
+
+		parseutil.FindPkgNameRefs(p.Pkg, []pkginfo.QualifiedName{name}, func(file *pkginfo.File, name pkginfo.QualifiedName, stack []ast.Node) {
+			parseutil.ParseReference(p, spec, parseutil.ReferenceData{
+				File:         file,
+				Stack:        stack,
+				ResourceFunc: name,
+			})
+		})
+	},
+}
+
+const (
+	minute int64 = 60
+	hour         = 60 * minute
+)
+
+var cronjobParser = cronparser.NewParser(cronparser.Minute | cronparser.Hour | cronparser.Dom | cronparser.Month | cronparser.Dow)
+
+func parseCronJob(d parseutil.ReferenceInfo) {
+	displayName := d.ResourceFunc.NaiveDisplayName()
+	if len(d.Call.Args) != 2 {
+		d.Pass.Errs.Add(errExpects2Arguments(len(d.Call.Args)).AtGoNode(d.Call))
+		return
+	}
+
+	jobName := parseutil.ParseResourceName(d.Pass.Errs, displayName, "cron job name",
+		d.Call.Args[0], parseutil.KebabName, "")
+	if jobName == "" {
+		// we already reported the error inside ParseResourceName
+		return
+	}
+
+	cfgLit, ok := literals.ParseStruct(d.Pass.Errs, d.File, "cron.JobConfig", d.Call.Args[1])
+	if !ok {
+		return // error reported by ParseStruct
+	}
+
+	// Decode the config
+	type decodedConfig struct {
+		Title    string   `literal:",optional"`
+		Endpoint ast.Expr `literal:",required,dynamic"`
+		Every    int64    `literal:",optional"`
+		Schedule string   `literal:",optional"`
+	}
+	config := literals.Decode[decodedConfig](d.Pass.Errs, cfgLit, nil)
+
+	// Resolve the endpoint
+	endpoint, ok := d.File.Names().ResolvePkgLevelRef(config.Endpoint)
+	if !ok {
+		d.Pass.Errs.Add(
+			errUnableToResolveEndpoint.AtGoNode(config.Endpoint),
+		)
+		return
+	}
+
+	job := &Job{
+		AST:         d.Call,
+		File:        d.File,
+		Name:        jobName,
+		Doc:         d.Doc,
+		Title:       config.Title,
+		Endpoint:    endpoint,
+		EndpointAST: config.Endpoint,
+	}
+	if job.Title == "" {
+		job.Title = jobName
+	}
+
+	// Parse the schedule
+	switch {
+	case config.Every != 0 && config.Schedule != "":
+		d.Pass.Errs.Add(errScheduleSetTwice.AtGoNode(cfgLit.Expr("Schedule")).AtGoNode(cfgLit.Expr("Every")))
+		return
+	case config.Schedule != "":
+		_, err := cronjobParser.Parse(config.Schedule)
+		if err != nil {
+			d.Pass.Errs.Add(errInvalidSchedule.Wrapping(err).AtGoNode(cfgLit.Expr("Schedule")))
+			return
+		}
+		job.Schedule = fmt.Sprintf("schedule:%s", config.Schedule)
+	case config.Every != 0:
+		if rem := config.Every % minute; rem != 0 {
+			d.Pass.Errs.Add(errEveryMustBeInteger(config.Every).AtGoNode(cfgLit.Expr("Every")))
+			return
+		}
+
+		minutes := config.Every / minute
+		if minutes < 1 {
+			d.Pass.Errs.Add(errEveryMustBeOneOrGreater(config.Every).AtGoNode(cfgLit.Expr("Every")))
+			return
+		} else if minutes > 24*60 {
+			d.Pass.Errs.Add(errEveryMustBeLessThan24Hours(minutes).AtGoNode(cfgLit.Expr("Every")))
+			return
+		} else if suggestion, ok := isCronIntervalAllowed(int(minutes)); !ok {
+			suggestionStr := formatMinutes(suggestion)
+			minutesStr := formatMinutes(int(minutes))
+
+			d.Pass.Errs.Add(
+				errEveryMustBeMultipleOfMinute(minutesStr).
+					AtGoNode(cfgLit.Expr("Every"), errors.AsHelp(fmt.Sprintf("try setting it to %s", suggestionStr))),
+			)
+			return
+		}
+		job.Schedule = fmt.Sprintf("every:%d", minutes)
+	}
+
+	d.Pass.RegisterResource(job)
+	d.Pass.AddBind(d.File, d.Ident, job)
+}
+
+// abs returns the absolute value of x.
+func abs(x int) int {
+	if x < 0 {
+		return -x
+	}
+	return x
+}
+
+func formatMinutes(minutes int) string {
+	if minutes < 60 {
+		return fmt.Sprintf("%d * cron.Minute", minutes)
+	} else if minutes%60 == 0 {
+		return fmt.Sprintf("%d * cron.Hour", minutes/60)
+	}
+	return fmt.Sprintf("%d * cron.Hour + %d * cron.Minute", minutes/60, minutes%60)
+}
+
+func isCronIntervalAllowed(val int) (suggestion int, ok bool) {
+	allowed := []int{
+		1, 2, 3, 4, 5, 6, 8, 9, 10, 12, 15, 16, 18, 20, 24, 30, 32, 36, 40, 45,
+		48, 60, 72, 80, 90, 96, 120, 144, 160, 180, 240, 288, 360, 480, 720, 1440,
+	}
+	idx := sort.SearchInts(allowed, val)
+
+	if idx == len(allowed) {
+		return allowed[len(allowed)-1], false
+	} else if allowed[idx] == val {
+		return val, true
+	} else if idx == 0 {
+		return allowed[0], false
+	} else if abs(val-allowed[idx-1]) < abs(val-allowed[idx]) {
+		return allowed[idx-1], false
+	}
+
+	return allowed[idx], false
+}
diff --git a/v2/parser/infra/crons/cron_test.go b/v2/parser/infra/crons/cron_test.go
new file mode 100644
index 0000000000..04afaeacb0
--- /dev/null
+++ b/v2/parser/infra/crons/cron_test.go
@@ -0,0 +1,52 @@
+package crons
+
+import (
+	"testing"
+
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/resource/resourcetest"
+)
+
+func TestParseJob(t *testing.T) {
+	tests := []resourcetest.Case[*Job]{
+		{
+			Name: "basic",
+			Code: `
+// Job docs
+var x = cron.NewJob("name", cron.JobConfig{
+	Title: "title",
+	Every: 3 * cron.Hour,
+	Endpoint: MyEndpoint,
+})
+
+func MyEndpoint() {}
+`,
+			Want: &Job{
+				Name:     "name",
+				Title:    "title",
+				Doc:      "Job docs\n",
+				Schedule: "every:180",
+				Endpoint: pkginfo.Q("example.com", "MyEndpoint"),
+			},
+		},
+		{
+			Name: "underscore_ident",
+			Code: `
+var _ = cron.NewJob("name", cron.JobConfig{
+	Every: 3 * cron.Hour,
+	Endpoint: MyEndpoint,
+})
+
+func MyEndpoint() {}
+`,
+			Want: &Job{
+				Name:     "name",
+				Title:    "name", // defaults from name if not specified
+				Schedule: "every:180",
+				Endpoint: pkginfo.Q("example.com", "MyEndpoint"),
+			},
+		},
+	}
+
+	resourcetest.Run(t, JobParser, tests)
+}
diff --git a/v2/parser/infra/crons/errors.go b/v2/parser/infra/crons/errors.go
new file mode 100644
index 0000000000..f897d70231
--- /dev/null
+++ b/v2/parser/infra/crons/errors.go
@@ -0,0 +1,64 @@
+package crons
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"cron",
+		"For more information, see https://encore.dev/docs/primitives/cron-jobs",
+
+		errors.WithRangeSize(10),
+	)
+
+	errExpects2Arguments = errRange.Newf(
+		"Invalid call to cron.NewJob",
+		"Expected 2 arguments, got %d",
+	)
+
+	errScheduleSetTwice = errRange.New(
+		"Invalid call to cron.NewJob",
+		"The cron execution schedule was set twice, once in Every and once in Schedule. At least one of these must be set, but not both",
+	)
+
+	errInvalidSchedule = errRange.New(
+		"Invalid call to cron.NewJob",
+		"Schedule must be a valid cron expression",
+	)
+
+	errEveryMustBeInteger = errRange.Newf(
+		"Invalid call to cron.NewJob",
+		"Every must be an integer number of minutes, got %d seconds.",
+	)
+
+	errEveryMustBeOneOrGreater = errRange.Newf(
+		"Invalid call to cron.NewJob",
+		"Every must be between 1 minute and 24 hours, got %d seconds.",
+	)
+
+	errEveryMustBeLessThan24Hours = errRange.Newf(
+		"Invalid call to cron.NewJob",
+		"Every must be between 1 minute and 24 hours (1440 minutes), got %d minutes.",
+	)
+
+	errEveryMustBeMultipleOfMinute = errRange.Newf(
+		"Invalid call to cron.NewJob",
+		"Every 24 hour time range (from 00:00 to 23:59) needs to be evenly divided by the interval value (%s).",
+	)
+
+	ErrDuplicateNames = errRange.New(
+		"Duplicate Cron Jobs",
+		"Multiple cron jobs with the same name were found. Cronjob names must be unique.",
+	)
+
+	errUnableToResolveEndpoint = errRange.New(
+		"Invalid call to cron.NewJob",
+		"Unable to resolve endpoint to a package level name. Is it defined?",
+	)
+
+	ErrEndpointNotAnAPI = errRange.New(
+		"Invalid call to cron.NewJob",
+		"Endpoint does not reference an Encore API",
+	)
+)
diff --git a/v2/parser/infra/internal/literals/constants.go b/v2/parser/infra/internal/literals/constants.go
new file mode 100644
index 0000000000..6acd3e8f1d
--- /dev/null
+++ b/v2/parser/infra/internal/literals/constants.go
@@ -0,0 +1,59 @@
+package literals
+
+import (
+	"go/constant"
+	"time"
+
+	"encore.dev/storage/cache"
+	"encr.dev/pkg/paths"
+)
+
+var constants = map[paths.Pkg]map[string]any{
+	"encore.dev/pubsub": {
+		"NoRetries":       -2,
+		"InfiniteRetries": -1,
+		"AtLeastOnce":     1,
+		"ExactlyOnce":     2,
+	},
+	"encore.dev/cron": {
+		"Minute": 60,
+		"Hour":   60 * 60,
+	},
+	"encore.dev/storage/cache": {
+		"AllKeysLRU":     string(cache.AllKeysLRU),
+		"AllKeysLFU":     string(cache.AllKeysLFU),
+		"AllKeysRandom":  string(cache.AllKeysRandom),
+		"VolatileLRU":    string(cache.VolatileLRU),
+		"VolatileLFU":    string(cache.VolatileLFU),
+		"VolatileTTL":    string(cache.VolatileTTL),
+		"VolatileRandom": string(cache.VolatileRandom),
+		"NoEviction":     string(cache.NoEviction),
+	},
+	"time": {
+		"Nanosecond":  int64(time.Nanosecond),
+		"Microsecond": int64(time.Microsecond),
+		"Millisecond": int64(time.Millisecond),
+		"Second":      int64(time.Second),
+		"Minute":      int64(time.Minute),
+		"Hour":        int64(time.Hour),
+	},
+}
+
+// runtimeConstant returns the value of a constant within the runtime,
+// if it's known to this file.
+func runtimeConstant(pkg paths.Pkg, name string) (constant.Value, bool) {
+	pkgMap, found := constants[pkg]
+	if !found {
+		return constant.MakeUnknown(), false
+	}
+
+	if value, found := pkgMap[name]; found {
+		// constant.Make recognizes int64 but not int.
+		// If we have an int, turn it to int64.
+		if val, ok := value.(int); ok {
+			return constant.Make(int64(val)), true
+		}
+		return constant.Make(value), true
+	}
+	return constant.MakeUnknown(), false
+}
diff --git a/v2/parser/infra/internal/literals/decode.go b/v2/parser/infra/internal/literals/decode.go
new file mode 100644
index 0000000000..5c13d7ca21
--- /dev/null
+++ b/v2/parser/infra/internal/literals/decode.go
@@ -0,0 +1,166 @@
+package literals
+
+import (
+	"go/ast"
+	"go/constant"
+	"reflect"
+
+	"github.com/fatih/structtag"
+
+	"encr.dev/v2/internals/perr"
+)
+
+func Decode[T any](errs *perr.List, literal *Struct, defaultValues *T) T {
+	var decodeTo T
+	dst := reflect.ValueOf(&decodeTo)
+	if dst.Elem().Kind() != reflect.Struct {
+		errs.Assert(errArgumentMustBeStruct.AtGoNode(literal.ast))
+	}
+	dst = dst.Elem()
+
+	var defaultValue reflect.Value
+	if defaultValues != nil {
+		defaultValue = reflect.ValueOf(defaultValues).Elem()
+	}
+
+	fieldPaths := decodeStruct(errs, literal, dst, defaultValue)
+
+	decodedFields := make(map[string]bool)
+	for _, fp := range fieldPaths {
+		decodedFields[fp] = true
+	}
+
+	// Make sure all the fields we care about have been decoded and nothing else.
+	for _, f := range literal.FieldPaths() {
+		if !decodedFields[f] {
+			errs.Add(errUnexpectedField.AtGoNode(literal.Expr(f)))
+		}
+	}
+
+	return decodeTo
+}
+
+func decodeStruct(errs *perr.List, literal *Struct, dst reflect.Value, defaultValues reflect.Value) (fieldPaths []string) {
+	for i := 0; i < dst.NumField(); i++ {
+		fieldType := dst.Type().Field(i)
+		if fieldType.Anonymous {
+			errs.Assert(errAnonymousFieldsNotSupported)
+		} else if !ast.IsExported(fieldType.Name) {
+			errs.Assert(errUnexportedFieldsNotSupported)
+		}
+
+		var fieldDefault reflect.Value
+		if defaultValues.IsValid() {
+			fieldDefault = defaultValues.Field(i)
+		}
+
+		paths := decodeField(errs, literal, fieldType, dst.Field(i), fieldDefault)
+		fieldPaths = append(fieldPaths, paths...)
+	}
+	return fieldPaths
+}
+
+// decodeField decodes a single constant literal field.
+// It reports the field path it decoded.
+func decodeField(errs *perr.List, literal *Struct, fieldType reflect.StructField, field reflect.Value, defaultField reflect.Value) (fieldPaths []string) {
+	// Determine the path we want to find the field at
+	fieldPath := fieldType.Name
+
+	required := false
+	dynamicOK := false
+	zeroValueOK := false
+	useDefaultValue := false
+
+	tag, err := structtag.Parse(string(fieldType.Tag))
+	if err != nil {
+		errs.Assert(errInvalidTag.AtGoNode(literal.Expr(fieldPath)).Wrapping(err))
+	}
+	if tagOpts, err := tag.Get("literal"); err == nil {
+		if tagOpts.Name != "" {
+			fieldPath = tagOpts.Name
+		}
+		required = !tagOpts.HasOption("optional")
+		dynamicOK = tagOpts.HasOption("dynamic")
+		zeroValueOK = tagOpts.HasOption("zero-ok")
+		useDefaultValue = tagOpts.HasOption("default")
+	}
+
+	fieldPaths = []string{fieldPath}
+
+	// If the field is required and isn't set, return an error.
+	if isSet := literal.IsSet(fieldPath); !isSet {
+		if required {
+			pos := literal.Pos(fieldPath)
+			errs.Add(errMissingRequiredField(fieldPath).AtGoPos(pos, pos))
+			return
+		} else {
+			if useDefaultValue && defaultField.IsValid() {
+				// If the field is optional and we have a default value, use it.
+				field.Set(defaultField)
+			}
+			// Nothing to do
+			return
+		}
+	}
+
+	// If the field is not dynamic and we don't allow dynamic fields, return an error.
+	isDynamic := !literal.IsConstant(fieldPath)
+	if isDynamic && !dynamicOK {
+		errs.Add(errIsntConstant(fieldPath).AtGoNode(literal.Expr(fieldPath)))
+		return
+	} else if isDynamic {
+		// Make sure the type is Expr.
+		if field.Type().PkgPath() != "go/ast" || field.Type().Name() != "Expr" {
+			errs.Assert(errDyanmicFieldNotExpr.AtGoNode(literal.Expr(fieldPath)))
+		}
+		field.Set(reflect.ValueOf(literal.Expr(fieldPath)))
+		return
+	}
+
+	val := literal.ConstantValue(fieldPath)
+	switch fieldType.Type.Kind() {
+	case reflect.String:
+		if val.Kind() == constant.String {
+			field.SetString(constant.StringVal(val))
+		} else {
+			errs.Add(errWrongDynamicType(fieldPath, "string").AtGoNode(literal.Expr(fieldPath)))
+		}
+
+	case reflect.Int, reflect.Int64, reflect.Uint, reflect.Uint64:
+		if val.Kind() == constant.Int {
+			n, _ := constant.Int64Val(val)
+			field.SetInt(n)
+		} else {
+			errs.Add(errWrongDynamicType(fieldPath, "integer").AtGoNode(literal.Expr(fieldPath)))
+		}
+
+	case reflect.Bool:
+		if val.Kind() == constant.Bool {
+			field.SetBool(constant.BoolVal(val))
+		} else {
+			errs.Add(errWrongDynamicType(fieldPath, "boolean").AtGoNode(literal.Expr(fieldPath)))
+		}
+
+	case reflect.Struct:
+		child, ok := literal.ChildStruct(fieldPath)
+		if !ok {
+			errs.Add(errWrongDynamicType(fieldPath, "inline struct").AtGoNode(literal.Expr(fieldPath)))
+			return
+		}
+		childPaths := decodeStruct(errs, child, field, defaultField)
+		for _, p := range childPaths {
+			fieldPaths = append(fieldPaths, fieldPath+"."+p)
+		}
+		return fieldPaths
+
+	default:
+		errs.Assert(errUnsupportedType(fieldType.Type.Kind()).AtGoNode(literal.Expr(fieldPath)))
+	}
+
+	// Now that we've set the value, if the field is required make sure it's not the zero value.
+	if required && !zeroValueOK && field.IsZero() {
+		errs.Add(errZeroValue(fieldPath).AtGoNode(literal.Expr(fieldPath)))
+	}
+
+	return fieldPaths
+}
diff --git a/v2/parser/infra/internal/literals/decode_test.go b/v2/parser/infra/internal/literals/decode_test.go
new file mode 100644
index 0000000000..c73170cf09
--- /dev/null
+++ b/v2/parser/infra/internal/literals/decode_test.go
@@ -0,0 +1,72 @@
+package literals
+
+import (
+	"go/ast"
+	"testing"
+	"time"
+
+	qt "github.com/frankban/quicktest"
+
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/testutil"
+)
+
+func TestDecode(t *testing.T) {
+	c := qt.New(t)
+	tc := testutil.NewContext(c, false, testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+require encore.dev v1.13.4
+-- foo.go --
+package foo
+
+import ("time"; "encore.dev/pubsub")
+
+var x = pubsub.SubscriptionConfig{
+	AckDeadline: 45 * time.Second,
+	MessageRetention: 5 * time.Hour * 24 + -10 * time.Hour,
+	RetryPolicy: &pubsub.RetryPolicy{
+		MaxRetries: 3,
+		MinBackoff: 8 * time.Second,
+		MaxBackoff: 32 * time.Minute,
+	},
+}
+`))
+	tc.FailTestOnErrors()
+	tc.GoModTidy()
+
+	loader := pkginfo.New(tc.Context)
+	pkg := loader.MustLoadPkg(0, "example.com")
+
+	cfgLit, ok := ParseStruct(tc.Errs, pkg.Files[0], "pubsub.SubscriptionConfig",
+		pkg.Names().PkgDecls["x"].Spec.(*ast.ValueSpec).Values[0])
+	c.Assert(ok, qt.IsTrue)
+
+	type decodedConfig struct {
+		// Optional configuration
+		AckDeadline      time.Duration `literal:",optional"`
+		MessageRetention time.Duration `literal:",optional"`
+		RetryPolicy      struct {
+			MinRetryBackoff time.Duration `literal:"MinBackoff,optional"`
+			MaxRetryBackoff time.Duration `literal:"MaxBackoff,optional"`
+			MaxRetries      int           `literal:"MaxRetries,optional"`
+		} `literal:",optional"`
+	}
+
+	cfg := Decode[decodedConfig](tc.Errs, cfgLit, nil)
+
+	c.Assert(cfg, qt.DeepEquals, decodedConfig{
+		AckDeadline:      45 * time.Second,
+		MessageRetention: 5*time.Hour*24 + -10*time.Hour,
+		RetryPolicy: struct {
+			MinRetryBackoff time.Duration `literal:"MinBackoff,optional"`
+			MaxRetryBackoff time.Duration `literal:"MaxBackoff,optional"`
+			MaxRetries      int           `literal:"MaxRetries,optional"`
+		}{
+			MaxRetries:      3,
+			MinRetryBackoff: 8 * time.Second,
+			MaxRetryBackoff: 32 * time.Minute,
+		},
+	})
+
+}
diff --git a/v2/parser/infra/internal/literals/errors.go b/v2/parser/infra/internal/literals/errors.go
new file mode 100644
index 0000000000..a6e8bcb65d
--- /dev/null
+++ b/v2/parser/infra/internal/literals/errors.go
@@ -0,0 +1,127 @@
+package literals
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"literals",
+		"",
+
+		errors.WithRangeSize(20),
+	)
+
+	errArgumentMustBeStruct = errRange.New(
+		"Invalid Argument",
+		"The argument must be given as a struct literal.",
+
+		errors.MarkAsInternalError(),
+	)
+
+	errUnexpectedField = errRange.New(
+		"Invalid Argument",
+		"Unexpected field in struct literal.",
+	)
+
+	errAnonymousFieldsNotSupported = errRange.New(
+		"Invalid Argument",
+		"Anonymous fields are not supported.",
+
+		errors.MarkAsInternalError(),
+	)
+
+	errUnexportedFieldsNotSupported = errRange.New(
+		"Invalid Argument",
+		"Unexported fields are not supported.",
+
+		errors.MarkAsInternalError(),
+	)
+
+	errInvalidTag = errRange.New(
+		"Invalid Argument",
+		"Invalid tag on field",
+
+		errors.MarkAsInternalError(),
+	)
+
+	errMissingRequiredField = errRange.Newf(
+		"Invalid Argument",
+		"Missing required field `%s`",
+	)
+
+	errIsntConstant = errRange.Newf(
+		"Invalid Argument",
+		"Field `%s` must be a constant literal.",
+	)
+
+	errDyanmicFieldNotExpr = errRange.New(
+		"Invalid Argument",
+		"Dynamic field must be an expression.",
+	)
+
+	errWrongDynamicType = errRange.Newf(
+		"Invalid Argument",
+		"The field `%s` must be a %s literal.",
+	)
+
+	errUnsupportedType = errRange.Newf(
+		"Invalid Argument",
+		"Unsupported type %v.",
+	)
+
+	errZeroValue = errRange.Newf(
+		"Invalid Argument",
+		"The field `%s` must not be the zero value.",
+	)
+
+	errNotLiteral = errRange.Newf(
+		"Invalid Argument",
+		"Expected a literal instance of %s, got %s.",
+	)
+
+	errExpectedKeyToBeIdentifier = errRange.Newf(
+		"Invalid Argument",
+		"Expected key to be an identifier, got %v.",
+	)
+
+	errExpectedKeyPair = errRange.Newf(
+		"Invalid Argument",
+		"Expected key pair, got %v.",
+	)
+
+	errPanicParsingExpression = errRange.Newf(
+		"Internal Error",
+		"Unexpected panic while parsing expression: %v",
+
+		errors.MarkAsInternalError(),
+	)
+
+	errUnableToParseLiteral = errRange.New(
+		"Internal Error",
+		"Unable to parse literal.",
+
+		errors.MarkAsInternalError(),
+	)
+
+	errDivideByZero = errRange.New(
+		"Invalid Argument",
+		"Cannot divide by zero.",
+	)
+
+	errInvalidShift = errRange.New(
+		"Invalid Argument",
+		"Shift count must be an unsigned integer.",
+	)
+
+	errUnsupportedOperation = errRange.Newf(
+		"Invalid Argument",
+		"%s is an unsupported operation here.",
+	)
+
+	errDefaultTagNotSupported = errRange.New(
+		"Invalid Argument",
+		"Default tags are not supported.",
+		errors.MarkAsInternalError(),
+	)
+)
diff --git a/v2/parser/infra/internal/literals/literals.go b/v2/parser/infra/internal/literals/literals.go
new file mode 100644
index 0000000000..4980957479
--- /dev/null
+++ b/v2/parser/infra/internal/literals/literals.go
@@ -0,0 +1,463 @@
+package literals
+
+import (
+	"errors"
+	"fmt"
+	"go/ast"
+	"go/constant"
+	"go/token"
+	"reflect"
+	"strconv"
+	"strings"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+var noOpCasts = map[paths.Pkg][]string{
+	"encore.dev/cron": {"Duration"},
+	"time":            {"Duration"},
+}
+
+// ParseString parses the node as a string literal.
+// If it's not a string literal it reports "", false.
+func ParseString(node ast.Node) (string, bool) {
+	if lit, ok := node.(*ast.BasicLit); ok && lit.Kind == token.STRING {
+		if val, err := strconv.Unquote(lit.Value); err == nil {
+			return val, true
+		}
+	}
+	return "", false
+}
+
+// ParseStruct parses struct literal and returns a LiterialStruct object
+//
+// If there is a nested struct literal, then it's values will be nested in a dot syntax; i.e. `parentStructFieldName.childStructFieldName`
+func ParseStruct(errs *perr.List, file *pkginfo.File, expectedType string, node ast.Expr) (lit *Struct, ok bool) {
+	cl, ok := node.(*ast.CompositeLit)
+	if !ok {
+		errs.Add(errNotLiteral(expectedType, PrettyPrint(node)).AtGoNode(node))
+		return nil, false
+	}
+
+	lit = &Struct{
+		ast:            cl,
+		constantFields: make(map[string]constant.Value),
+		allFields:      make(map[string]ast.Expr),
+		childStructs:   make(map[string]*Struct),
+	}
+	ok = true
+
+elemLoop:
+	for _, elem := range cl.Elts {
+		switch elem := elem.(type) {
+		case *ast.KeyValueExpr:
+			ident, ok := elem.Key.(*ast.Ident)
+			if !ok {
+				errs.Add(errExpectedKeyToBeIdentifier(reflect.TypeOf(elem.Key)).AtGoNode(elem.Key))
+				continue elemLoop
+			}
+			if ident == nil {
+				errs.Add(errExpectedKeyToBeIdentifier("nil").AtGoNode(elem.Key))
+				continue elemLoop
+			}
+
+			// Parse any sub data structures
+			var subStruct *ast.CompositeLit
+			switch value := elem.Value.(type) {
+			case *ast.UnaryExpr:
+				if value.Op == token.AND {
+					if compositeLiteral, ok := value.X.(*ast.CompositeLit); ok {
+						subStruct = compositeLiteral
+					}
+				}
+
+			case *ast.CompositeLit:
+				subStruct = value
+			}
+
+			if subStruct != nil {
+				subLit, subOk := ParseStruct(errs, file, "struct", subStruct)
+				ok = ok && subOk
+				lit.childStructs[ident.Name] = subLit
+			} else if valueIdent, ok := elem.Value.(*ast.Ident); ok && valueIdent.Name == "nil" {
+				// no-op for nil's
+			} else {
+				// Parse the value
+				lit.allFields[ident.Name] = elem.Value
+				value := ParseConstant(errs, file, elem.Value)
+				if value.Kind() != constant.Unknown {
+					lit.constantFields[ident.Name] = value
+				}
+			}
+		default:
+			errs.Add(errExpectedKeyPair(reflect.TypeOf(elem)).AtGoNode(elem))
+		}
+	}
+
+	return
+}
+
+func ParseConstant(errs *perr.List, file *pkginfo.File, value ast.Expr) (rtn constant.Value) {
+	defer func() {
+		if r := recover(); r != nil {
+			rtn = constant.MakeUnknown()
+			errs.Add(errPanicParsingExpression(r).AtGoNode(value))
+		}
+	}()
+
+	switch value := value.(type) {
+	case *ast.FuncLit:
+		// Functions are not literal constant values
+		return constant.MakeUnknown()
+
+	case *ast.Ident:
+		switch value.Name {
+		case "true":
+			return constant.MakeBool(true)
+		case "false":
+			return constant.MakeBool(false)
+		default:
+			return constant.MakeUnknown()
+		}
+
+	case *ast.BasicLit:
+		v, err := basicLit(value)
+		if err != nil {
+			errs.Add(errUnableToParseLiteral.Wrapping(err).AtGoNode(value))
+			return constant.MakeUnknown()
+		} else {
+			return v
+		}
+
+	case *ast.SelectorExpr:
+		if obj, ok := file.Names().ResolvePkgLevelRef(value); ok {
+			if v, found := runtimeConstant(obj.PkgPath, obj.Name); found {
+				return v
+			}
+		}
+
+		return constant.MakeUnknown()
+
+	case *ast.BinaryExpr:
+		lhs := ParseConstant(errs, file, value.X)
+		rhs := ParseConstant(errs, file, value.Y)
+		if lhs.Kind() == constant.Unknown || rhs.Kind() == constant.Unknown {
+			return constant.MakeUnknown()
+		}
+
+		switch value.Op {
+		case token.MUL, token.ADD, token.SUB, token.REM, token.AND, token.OR, token.XOR, token.AND_NOT:
+			return constant.BinaryOp(lhs, value.Op, rhs)
+		case token.QUO:
+			// constant.BinaryOp panics when dividing by zero
+			if floatValue, _ := constant.Float64Val(constant.ToFloat(rhs)); floatValue <= 0.000000001 && floatValue >= -0.000000001 {
+				errs.Add(errDivideByZero.AtGoNode(value))
+				return constant.MakeUnknown()
+			}
+
+			return constant.BinaryOp(lhs, value.Op, rhs)
+		case token.EQL, token.NEQ, token.LSS, token.LEQ, token.GTR, token.GEQ:
+			return constant.MakeBool(constant.Compare(lhs, value.Op, rhs))
+
+		case token.SHL, token.SHR:
+			shiftValue, ok := constant.Uint64Val(constant.ToInt(rhs))
+			if !ok {
+				errs.Add(errInvalidShift.AtGoNode(value))
+			}
+			return constant.Shift(lhs, value.Op, uint(shiftValue))
+
+		default:
+			errs.Add(errUnsupportedOperation(value.Op).AtGoNode(value))
+			return constant.MakeUnknown()
+		}
+
+	case *ast.UnaryExpr:
+		x := ParseConstant(errs, file, value.X)
+		return constant.UnaryOp(value.Op, x, 0)
+
+	case *ast.CallExpr:
+		// We allow casts like "time.Duration(143)" or "cron.Duration(143)"
+		// so we transparently go through them
+		if sel, ok := value.Fun.(*ast.SelectorExpr); ok && len(value.Args) == 1 {
+			if obj, ok := file.Names().ResolvePkgLevelRef(sel); ok {
+				if pkgFuncs, found := noOpCasts[obj.PkgPath]; found {
+					for _, allowed := range pkgFuncs {
+						if allowed == obj.Name {
+							return ParseConstant(errs, file, value.Args[0])
+						}
+					}
+				}
+			}
+		}
+		return constant.MakeUnknown()
+
+	case *ast.ParenExpr:
+		return ParseConstant(errs, file, value.X)
+
+	default:
+		errs.Add(errUnsupportedType(reflect.TypeOf(value).Kind()).AtGoNode(value))
+		return constant.MakeUnknown()
+	}
+}
+
+func basicLit(value *ast.BasicLit) (constant.Value, error) {
+	switch value.Kind {
+	case token.IDENT:
+		return constant.MakeString(value.Value), nil
+	case token.INT:
+		v, err := strconv.ParseInt(value.Value, 10, 64)
+		if err != nil {
+			return constant.MakeUnknown(), err
+		}
+		return constant.MakeInt64(v), nil
+	case token.FLOAT:
+		v, err := strconv.ParseFloat(value.Value, 64)
+		if err != nil {
+			return constant.MakeUnknown(), err
+		}
+		return constant.MakeFloat64(v), nil
+	case token.CHAR:
+		c, _, _, err := strconv.UnquoteChar(value.Value, value.Value[0])
+		return constant.MakeFromBytes([]byte{byte(c)}), err
+	case token.STRING:
+		return constant.MakeString(value.Value[1 : len(value.Value)-1]), nil
+	default:
+		return nil, errors.New("unsupported literal type")
+	}
+}
+
+// Struct represents a struct literal at compile time
+type Struct struct {
+	ast            *ast.CompositeLit         // The AST node which presents the literal
+	constantFields map[string]constant.Value // All found constant expressions
+	allFields      map[string]ast.Expr       // All field expressions (constant or otherwise)
+	childStructs   map[string]*Struct        // Any child struct literals
+}
+
+func (l *Struct) Lit() *ast.CompositeLit {
+	return l.ast
+}
+
+// FullyConstant returns true if every value in this struct and the child structs fully known as compile time
+// as a constant value
+func (l *Struct) FullyConstant() bool {
+	for _, sub := range l.childStructs {
+		if !sub.FullyConstant() {
+			return false
+		}
+	}
+	return len(l.constantFields) == len(l.allFields)
+}
+
+// DynamicFields returns the names of the fields and ast.Expr that are not constant
+//
+// Child structs will be included with the field name prefixed with the struct name;
+// i.e. `parentField.childField`
+func (l *Struct) DynamicFields() map[string]ast.Expr {
+	fields := make(map[string]ast.Expr)
+	for name, expr := range l.allFields {
+		if _, found := l.constantFields[name]; !found {
+			fields[name] = expr
+		}
+	}
+
+	for name, sub := range l.childStructs {
+		for k, v := range sub.DynamicFields() {
+			fields[name+"."+k] = v
+		}
+	}
+
+	return fields
+}
+
+// IsSet returns true if the given field is set in this struct
+//
+// You can reference a child struct field with `.`; i.e. `parent.child`
+func (l *Struct) IsSet(fieldName string) bool {
+	// Recurse into child fields
+	before, after, found := strings.Cut(fieldName, ".")
+	if found {
+		if child, found := l.childStructs[before]; found {
+			return child.IsSet(after)
+		} else {
+			return false
+		}
+	} else if _, found := l.childStructs[fieldName]; found {
+		return true
+	}
+
+	_, found = l.allFields[fieldName]
+	return found
+}
+
+func (l *Struct) IsConstant(fieldName string) bool {
+	// Recurse into child fields
+	before, after, found := strings.Cut(fieldName, ".")
+	if found {
+		if child, found := l.childStructs[before]; found {
+			return child.IsConstant(after)
+		} else {
+			return false
+		}
+	} else if child, found := l.childStructs[fieldName]; found {
+		return child.FullyConstant()
+	}
+
+	_, found = l.constantFields[fieldName]
+	return found
+}
+
+func (l *Struct) ChildStruct(fieldName string) (st *Struct, ok bool) {
+	st, ok = l.childStructs[fieldName]
+	return
+}
+
+// Pos returns the position of the field in the source code
+//
+// If the field is not found, the closest position to where
+// the field should have been will be returned
+//
+// You can reference a child struct field with `.`; i.e. `parent.child`
+func (l *Struct) Pos(fieldName string) token.Pos {
+	before, after, found := strings.Cut(fieldName, ".")
+	if found {
+		if child, found := l.childStructs[before]; found {
+			return child.Pos(after)
+		} else {
+			return l.ast.Pos()
+		}
+	}
+
+	value, found := l.allFields[fieldName]
+	if found {
+		return value.Pos()
+	} else {
+		return l.ast.Pos()
+	}
+}
+
+// FieldPaths reports all field paths in the struct,
+// recursively including child structs (in the `parent.child` syntax).
+func (l *Struct) FieldPaths() []string {
+	var res []string
+	for name := range l.allFields {
+		res = append(res, name)
+	}
+	for name, child := range l.childStructs {
+		for _, path := range child.FieldPaths() {
+			res = append(res, name+"."+path)
+		}
+	}
+	return res
+}
+
+// Expr returns ast.Expr for the given field name.
+//
+// If the field is known, it returns the ast.Expr
+// If the field is not known, it returns nil
+//
+// You can reference a child struct field with `.`; i.e. `parent.child`
+func (l *Struct) Expr(fieldName string) ast.Expr {
+	// Recurse into child fields
+	before, after, found := strings.Cut(fieldName, ".")
+	if found {
+		if child, found := l.childStructs[before]; found {
+			return child.Expr(after)
+		} else {
+			return nil
+		}
+	}
+
+	value, found := l.allFields[fieldName]
+	if found {
+		return value
+	} else {
+		return nil
+	}
+}
+
+// ConstantValue returns the value of the field as a constant.Value. If the field is not constant or
+// does not exist, an unknown value will be returned
+//
+// You can reference a child struct field with `.`; i.e. `parent.child`
+func (l *Struct) ConstantValue(fieldName string) constant.Value {
+	// Recurse into child fields
+	before, after, found := strings.Cut(fieldName, ".")
+	if found {
+		if child, found := l.childStructs[before]; found {
+			return child.ConstantValue(after)
+		} else {
+			return constant.MakeUnknown()
+		}
+	}
+
+	value, found := l.constantFields[fieldName]
+	if !found {
+		return constant.MakeUnknown()
+	}
+	return value
+}
+
+// Int64 returns the value of the field as an int64
+//
+// This function will convert other number types into an Int64, but will not convert strings.
+// If after conversion the value is 0, the defaultValue will be returned
+//
+// You can reference a child struct field with `.`; i.e. `parent.child`
+func (l *Struct) Int64(fieldName string, defaultValue int64) int64 {
+	realValue, ok := constant.Int64Val(constant.ToInt(l.ConstantValue(fieldName)))
+	if !ok || realValue == 0 {
+		return defaultValue
+	}
+	return realValue
+}
+
+// Str returns the value of the field as an string
+//
+// This function will convert all types to a string
+// If after conversion the value is "", the defaultValue will be returned
+//
+// You can reference a child struct field with `.`; i.e. `parent.child`
+func (l *Struct) Str(fieldName string, defaultValue string) string {
+	value := l.ConstantValue(fieldName)
+
+	str := value.ExactString()
+	if value.Kind() == constant.String || value.Kind() == constant.Unknown {
+		str = constant.StringVal(value)
+
+	}
+
+	if str == "" {
+		return defaultValue
+	} else {
+		return str
+	}
+}
+
+func PrettyPrint(node ast.Expr) string {
+	switch node := node.(type) {
+	case *ast.Ident:
+		return node.Name
+
+	case *ast.SelectorExpr:
+		return fmt.Sprintf("%s.%s", PrettyPrint(node.X), node.Sel.Name)
+
+	case *ast.IndexExpr:
+		return fmt.Sprintf("%s[%s]", PrettyPrint(node.X), PrettyPrint(node.Index))
+
+	case *ast.IndexListExpr:
+		indices := make([]string, 0, len(node.Indices))
+		for _, n := range node.Indices {
+			indices = append(indices, PrettyPrint(n))
+		}
+		return fmt.Sprintf("%s[%s]", PrettyPrint(node.X), strings.Join(indices, ", "))
+
+	case *ast.FuncLit:
+		return "a function literal"
+
+	default:
+		return fmt.Sprintf("a %v", reflect.TypeOf(node))
+	}
+}
diff --git a/v2/parser/infra/internal/literals/literals_test.go b/v2/parser/infra/internal/literals/literals_test.go
new file mode 100644
index 0000000000..c97d972a1a
--- /dev/null
+++ b/v2/parser/infra/internal/literals/literals_test.go
@@ -0,0 +1,142 @@
+package literals
+
+import (
+	"fmt"
+	"go/ast"
+	"go/constant"
+	"go/token"
+	"strconv"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/testutil"
+)
+
+func TestParseConstantValue(t *testing.T) {
+	type testCase struct {
+		Expr    string
+		Imports []string
+		Want    any
+		Err     string
+	}
+
+	tests := []testCase{
+		{
+			Expr: "true",
+			Want: true,
+		},
+		{
+			Expr: "false",
+			Want: false,
+		},
+		{
+			Expr: "\"hello world\"",
+			Want: "hello world",
+		},
+		{
+			Expr: "\"hello world\" == \"hello world\"",
+			Want: true,
+		},
+		{
+			Expr: "\"hello world\" != \"hello world\"",
+			Want: false,
+		},
+		{
+			Imports: []string{"encore.dev/cron"},
+			Expr:    "1*cron.Minute",
+			Want:    1 * 60,
+		},
+		{
+			Imports: []string{"encore.dev/cron"},
+			Expr:    "(4/2)*cron.Minute",
+			Want:    2 * 60,
+		},
+		{
+			Imports: []string{"encore.dev/cron"},
+			Expr:    "(4-2)*cron.Minute + cron.Hour",
+			Want:    2*60 + 3600,
+		},
+		{
+			Expr: "5 / 2",
+			Want: 2.5,
+		},
+		{
+			Expr: "(5 - 4) - 1",
+			Want: int64(0),
+		},
+		// Note the "(?s)" allows for "." to match newlines
+		// This is needed when running tests with the tag `dev_build` which includes
+		// stack traces from the parser in the error message.
+		{
+			Expr: "2.3 / 0",
+			Err:  `(?s).+Cannot divide by zero.*`,
+		},
+	}
+
+	// testArchive renders the txtar archive to use for a given test.
+	testArchive := func(test testCase) *txtar.Archive {
+		imports := ""
+		if len(test.Imports) > 0 {
+			imports = "import (\n"
+			for _, imp := range test.Imports {
+				imports += "\t" + strconv.Quote(imp) + "\n"
+			}
+			imports += ")\n"
+		}
+
+		return testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+require encore.dev v1.13.4
+-- code.go --
+package foo
+` + imports + `
+
+const x = ` + test.Expr + `
+`)
+	}
+
+	for i, test := range tests {
+		t.Run(fmt.Sprintf("test[%d]", i), func(t *testing.T) {
+			c := qt.New(t)
+			a := testArchive(test)
+			tc := testutil.NewContext(c, false, a)
+			tc.GoModDownload()
+
+			l := pkginfo.New(tc.Context)
+			pkg := l.MustLoadPkg(token.NoPos, "example.com")
+			decl := pkg.Names().PkgDecls["x"]
+			x := decl.Spec.(*ast.ValueSpec).Values[0]
+
+			value := ParseConstant(tc.Errs, decl.File, x)
+
+			if test.Err != "" {
+				c.Check(value.Kind(), qt.Equals, constant.Unknown, qt.Commentf("Wanted an Unknown value, got: %s", value.Kind().String()))
+				c.Check(tc.Errs.Len(), qt.Not(qt.Equals), 0)
+				c.Check(tc.Errs.FormatErrors(), qt.Matches, test.Err)
+			} else {
+				c.Check(tc.Errs.Len(), qt.Equals, 0)
+				c.Check(value.Kind(), qt.Not(qt.Equals), constant.Unknown, qt.Commentf("Result was unknown: %s", tc.Errs.FormatErrors()))
+
+				switch w := test.Want.(type) {
+				case bool:
+					c.Check(constant.BoolVal(value), qt.Equals, test.Want)
+				case string:
+					c.Check(constant.StringVal(value), qt.Equals, test.Want)
+				case float64:
+					got, _ := constant.Float64Val(constant.ToFloat(value))
+					c.Check(got, qt.Equals, test.Want)
+				case int:
+					got, _ := constant.Int64Val(constant.ToInt(value))
+					c.Check(got, qt.Equals, int64(w))
+				case int64:
+					got, _ := constant.Int64Val(constant.ToInt(value))
+					c.Check(got, qt.Equals, test.Want)
+				}
+			}
+		})
+	}
+}
diff --git a/v2/parser/infra/internal/locations/locations.go b/v2/parser/infra/internal/locations/locations.go
new file mode 100644
index 0000000000..4d866615e4
--- /dev/null
+++ b/v2/parser/infra/internal/locations/locations.go
@@ -0,0 +1,61 @@
+package locations
+
+import (
+	"go/ast"
+)
+
+type Classification interface {
+	classification()
+}
+
+type PkgVar struct {
+	Ident *ast.Ident
+	Name  string
+}
+
+type InFunc struct {
+	Node ast.Node // *ast.FuncDecl or *ast.FuncLit
+}
+
+type OtherPkgExpr struct{}
+
+func (PkgVar) classification()       {}
+func (InFunc) classification()       {}
+func (OtherPkgExpr) classification() {}
+
+// Classify classifies the current location based on the ancestor stack.
+// The last node in the stack is the expression to classify.
+func Classify(stack []ast.Node) (c Classification) {
+	num := len(stack)
+
+	// target is the target expression
+	target := stack[num-1]
+
+	// First determine if we're inside any function declaration,
+	// as that takes precedence over any other classification.
+	for i := num - 2; i >= 0; i-- {
+		switch node := stack[i].(type) {
+		case *ast.FuncDecl, *ast.FuncLit:
+			return InFunc{Node: node}
+		}
+	}
+
+	// Iterate over the node stack from inside to out.
+	for i := num - 2; i >= 0; i-- {
+		switch node := stack[i].(type) {
+
+		case *ast.ValueSpec:
+			for n := 0; n < len(node.Names); n++ {
+				if len(node.Values) > n && node.Values[n] == target {
+					// We've found the value that contains the resource.
+					return PkgVar{
+						Ident: node.Names[n],
+						Name:  node.Names[n].Name,
+					}
+				}
+			}
+		}
+	}
+
+	return OtherPkgExpr{}
+}
diff --git a/v2/parser/infra/internal/locations/locations_test.go b/v2/parser/infra/internal/locations/locations_test.go
new file mode 100644
index 0000000000..8a9e8882b3
--- /dev/null
+++ b/v2/parser/infra/internal/locations/locations_test.go
@@ -0,0 +1,102 @@
+package locations
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"slices"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"golang.org/x/tools/go/ast/inspector"
+)
+
+func TestClassify(t *testing.T) {
+	tests := []struct {
+		name string
+		expr string
+		want Classification
+	}{
+		{
+			name: "simple_pkg_var",
+			expr: "var x = TARGET",
+			want: PkgVar{Ident: ast.NewIdent("x"), Name: "x"},
+		},
+		{
+			name: "field_lookup",
+			expr: "var x = TARGET.Stdlib",
+			want: OtherPkgExpr{},
+		},
+		{
+			name: "method_call",
+			expr: "var x = TARGET.Stdlib()",
+			want: OtherPkgExpr{},
+		},
+		{
+			name: "method_call_in_func_lit",
+			expr: "var x = func() { TARGET.Stdlib() }",
+			want: InFunc{Node: &ast.FuncLit{}},
+		},
+		{
+			name: "method_call_in_func_lit_call",
+			expr: "var x = func() { TARGET.Stdlib() }()",
+			want: InFunc{Node: &ast.FuncLit{}},
+		},
+		{
+			name: "in_func_decl",
+			expr: "func foo() { TARGET }",
+			want: InFunc{Node: &ast.FuncDecl{}},
+		},
+		{
+			name: "func_arg",
+			expr: "var x = foo(blah, TARGET)",
+			want: OtherPkgExpr{},
+		},
+		{
+			name: "func_arg_method",
+			expr: "var x = foo(TARGET.Stdlib())",
+			want: OtherPkgExpr{},
+		},
+		{
+			name: "unary_expr",
+			expr: "var x = +TARGET",
+			want: OtherPkgExpr{},
+		},
+	}
+
+	cmpOpts := []cmp.Option{
+		cmpopts.IgnoreInterfaces(struct {
+			ast.Expr
+			ast.Stmt
+		}{}),
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			c := qt.New(t)
+			stack := parseStack(c, test.expr)
+			got := Classify(stack)
+			c.Assert(got, qt.CmpEquals(cmpOpts...), test.want)
+		})
+	}
+}
+
+func parseStack(c *qt.C, expr string) []ast.Node {
+	code := "package pkg\n\n" + expr
+	fs := token.NewFileSet()
+	file, err := parser.ParseFile(fs, c.Name()+".go", code, parser.ParseComments)
+	c.Assert(err, qt.IsNil)
+
+	insp := inspector.New([]*ast.File{file})
+
+	var found []ast.Node
+	insp.WithStack([]ast.Node{(*ast.Ident)(nil)}, func(n ast.Node, push bool, stack []ast.Node) bool {
+		if id, ok := stack[len(stack)-1].(*ast.Ident); ok && id.Name == "TARGET" {
+			found = slices.Clone(stack)
+		}
+		return true
+	})
+	c.Assert(found, qt.Not(qt.IsNil))
+	return found
+}
diff --git a/v2/parser/infra/internal/parseutil/aststringer.go b/v2/parser/infra/internal/parseutil/aststringer.go
new file mode 100644
index 0000000000..70042c2f0d
--- /dev/null
+++ b/v2/parser/infra/internal/parseutil/aststringer.go
@@ -0,0 +1,89 @@
+package parseutil
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"reflect"
+	"strings"
+)
+
+// Converts a node to a string which looks like the original go code.
+// such as a ast.SelectorExpr will become "foo.Blah"
+//
+// It's not intended to be an exact representation, but rather a helperful
+// representation for error messages.
+func nodeAsGoSrc(node ast.Node) string {
+	switch node := node.(type) {
+	case *ast.Ident:
+		return node.Name
+
+	case *ast.SelectorExpr:
+		return fmt.Sprintf("%s.%s", nodeAsGoSrc(node.X), node.Sel.Name)
+
+	case *ast.IndexExpr:
+		return fmt.Sprintf("%s[%s]", nodeAsGoSrc(node.X), nodeAsGoSrc(node.Index))
+
+	case *ast.IndexListExpr:
+		indices := make([]string, 0, len(node.Indices))
+		for _, n := range node.Indices {
+			indices = append(indices, nodeAsGoSrc(n))
+		}
+		return fmt.Sprintf("%s[%s]", nodeAsGoSrc(node.X), strings.Join(indices, ", "))
+
+	case *ast.FuncLit:
+		return "a function literal"
+
+	case *ast.BasicLit:
+		return node.Value
+
+	case *ast.CallExpr:
+		return fmt.Sprintf("%s(...)", nodeAsGoSrc(node.Fun))
+
+	default:
+		return fmt.Sprintf("a %v", reflect.TypeOf(node))
+	}
+}
+
+// NodeType converts a node to a string that can be used in an error message.
+// such as a ast.CallExpr will return "a function call to foo.Blah"
+func NodeType(node ast.Node) string {
+	switch node := node.(type) {
+	case *ast.Ident:
+		return "an identifier"
+
+	case *ast.SelectorExpr:
+		return "an identifier"
+
+	case *ast.IndexExpr:
+		return "a identifier"
+
+	case *ast.IndexListExpr:
+		return "a identifier"
+
+	case *ast.FuncLit:
+		return "a function literal"
+
+	case *ast.BasicLit:
+		switch node.Kind {
+		case token.INT:
+			return "an integer literal"
+		case token.FLOAT:
+			return "a float literal"
+		case token.IMAG:
+			return "an imaginary literal"
+		case token.CHAR:
+			return "a character literal"
+		case token.STRING:
+			return "a string literal"
+		default:
+			return "a literal"
+		}
+
+	case *ast.CallExpr:
+		return fmt.Sprintf("a function call to %s", nodeAsGoSrc(node.Fun))
+
+	default:
+		return fmt.Sprintf("a %v", reflect.TypeOf(node))
+	}
+}
diff --git a/v2/parser/infra/internal/parseutil/errors.go b/v2/parser/infra/internal/parseutil/errors.go
new file mode 100644
index 0000000000..2f6c0e89cf
--- /dev/null
+++ b/v2/parser/infra/internal/parseutil/errors.go
@@ -0,0 +1,52 @@
+package parseutil
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"parseutil",
+		"",
+	)
+
+	errRequiresTypeArgumentsNoneFound = errRange.Newf(
+		"Missing type arguments",
+		"%s requires type arguments, but none were found.",
+	)
+
+	errWrongNumberOfTypeArguments = errRange.Newf(
+		"Wrong number of type arguments",
+		"%s requires%s %d type arguments, but %d were found.",
+	)
+
+	errCannotBeReferencedWithoutBeingCalled = errRange.Newf(
+		"Invalid reference",
+		"%s cannot be referenced without being called.",
+	)
+
+	errCannotBeCalledHere = errRange.Newf(
+		"Invalid call",
+		"%s cannot be called here. It must be called from %s.",
+	)
+
+	errResourceNameMustBeStringLiteral = errRange.Newf(
+		"Invalid resource name",
+		"A %s requires the %s given as a string literal.",
+	)
+
+	errResourceNameInvalidLength = errRange.Newf(
+		"Invalid resource name",
+		"The %s %s needs to be between 1 and 63 characters long.",
+	)
+
+	errResourceNameNotCorrectFormat = errRange.Newf(
+		"Invalid resource name",
+		"The %s %s must be defined in \"%s\".",
+	)
+
+	errResourceNameReserved = errRange.Newf(
+		"Invalid resource name",
+		"The %s %s %q used the reserved prefix %q.",
+	)
+)
diff --git a/v2/parser/infra/internal/parseutil/names.go b/v2/parser/infra/internal/parseutil/names.go
new file mode 100644
index 0000000000..ea72c34ceb
--- /dev/null
+++ b/v2/parser/infra/internal/parseutil/names.go
@@ -0,0 +1,110 @@
+package parseutil
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"regexp"
+	"strings"
+
+	"encr.dev/pkg/errinsrc/srcerrors"
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/idents"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/parser/infra/internal/literals"
+)
+
+const resourceNameMaxLength int = 63
+
+type resourceNameSpec struct {
+	regexp         *regexp.Regexp
+	errDetails     func(resourceName, paramName string) string
+	invalidNameErr func(node ast.Node, resourceName, paramName, name string) errors.Template
+	reservedErr    func(fset *token.FileSet, node ast.Node, resourceType, paramName, name, reservedPrefix string) error
+}
+
+var KebabName = resourceNameSpec{
+	regexp:     regexp.MustCompile(`^[a-z]([-a-z0-9]*[a-z0-9])?$`),
+	errDetails: resourceNameHelpKebabCase,
+	invalidNameErr: func(node ast.Node, resourceType, paramName, name string) errors.Template {
+		err := errResourceNameNotCorrectFormat(resourceType, paramName, "kebab-case").
+			WithDetails(resourceNameHelpKebabCase(resourceType, paramName)).
+			AtGoNode(node, errors.AsError(fmt.Sprintf("try %s?", idents.GenerateSuggestion(name, idents.KebabCase))))
+
+		return err
+	},
+	reservedErr: func(fset *token.FileSet, node ast.Node, resourceType, paramName, name, reservedPrefix string) error {
+		return srcerrors.ResourceNameReserved(fset, node, resourceType, paramName, name, reservedPrefix, false)
+	},
+}
+
+var SnakeName = resourceNameSpec{
+	regexp:     regexp.MustCompile(`^[a-z]([_a-z0-9]*[a-z0-9])?$`),
+	errDetails: resourceNameHelpSnakeCase,
+	invalidNameErr: func(node ast.Node, resourceType, paramName, name string) errors.Template {
+		err := errResourceNameNotCorrectFormat(resourceType, paramName, "snake_case").
+			WithDetails(resourceNameHelpSnakeCase(resourceType, paramName)).
+			AtGoNode(node, errors.AsError(fmt.Sprintf("try %s?", idents.GenerateSuggestion(name, idents.SnakeCase))))
+
+		return err
+	},
+	reservedErr: func(fset *token.FileSet, node ast.Node, resourceType, paramName, name, reservedPrefix string) error {
+		return srcerrors.ResourceNameReserved(fset, node, resourceType, paramName, name, reservedPrefix, true)
+	},
+}
+
+// ParseResourceName checks the given node is a string literal
+// and that it conforms to the given spec.
+//
+// If an error is encountered, it will report a parse error and return an empty string
+// otherwise it will return the parsed resource name
+func ParseResourceName(errs *perr.List, resourceType string, paramName string, node ast.Expr, nameSpec resourceNameSpec, reservedPrefix string) string {
+	name, ok := literals.ParseString(node)
+	if !ok {
+		errs.Add(
+			errResourceNameMustBeStringLiteral(resourceType, paramName).
+				WithDetails(nameSpec.errDetails(resourceType, paramName)).
+				AtGoNode(node, errors.AsError(fmt.Sprintf("was given %s", NodeType(node)))),
+		)
+		return ""
+	}
+	name = strings.TrimSpace(name)
+	if name == "" || len(name) > resourceNameMaxLength {
+		errs.Add(
+			errResourceNameInvalidLength(resourceType, paramName).
+				WithDetails(nameSpec.errDetails(resourceType, paramName)).
+				AtGoNode(node, errors.AsError(fmt.Sprintf("is %d long", len(name)))),
+		)
+		return ""
+	}
+
+	if !nameSpec.regexp.MatchString(name) {
+		errs.Add(nameSpec.invalidNameErr(node, resourceType, paramName, name))
+		return ""
+	} else if reservedPrefix != "" && strings.HasPrefix(name, reservedPrefix) {
+		errs.Add(
+			errResourceNameReserved(resourceType, paramName, name, reservedPrefix).
+				WithDetails(nameSpec.errDetails(resourceType, paramName)).
+				AtGoNode(node),
+		)
+		return ""
+	}
+
+	return name
+}
+
+func resourceNameHelpKebabCase(resourceName string, paramName string) string {
+	return fmt.Sprintf("%s %s's must be defined as string literals, "+
+		"be between 1 and 63 characters long, and defined in \"kebab-case\", meaning it must start with a letter, end with a letter "+
+		"or number and only contain lower case letters, numbers and dashes.",
+		resourceName, paramName,
+	)
+}
+
+func resourceNameHelpSnakeCase(resourceName string, paramName string) string {
+	return fmt.Sprintf("%s %s's must be defined as string literals, "+
+		"be between 1 and 63 characters long, and defined in \"snake_case\", meaning it must start with a letter, end with a letter "+
+		"or number and only contain lower case letters, numbers and underscores.",
+		resourceName, paramName,
+	)
+}
diff --git a/v2/parser/infra/internal/parseutil/parseutil.go b/v2/parser/infra/internal/parseutil/parseutil.go
new file mode 100644
index 0000000000..9ae1cd9936
--- /dev/null
+++ b/v2/parser/infra/internal/parseutil/parseutil.go
@@ -0,0 +1,143 @@
+package parseutil
+
+import (
+	"go/ast"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+// FindPkgNameRefs finds all references in the given package that references
+// any of the given pkgNames. For each such reference it calls fn.
+func FindPkgNameRefs(pkg *pkginfo.Package, pkgNames []pkginfo.QualifiedName, fn func(f *pkginfo.File, name pkginfo.QualifiedName, stack []ast.Node)) {
+	// Scan files that contain the required imports.
+	requiredImports := computeRequiredImports(pkgNames)
+	// If the union of all imports is not a subset of the package's imports,
+	// might as well not even look at individual files.
+	if !hasRequiredImports(pkg.Imports, requiredImports) {
+		return
+	}
+
+	// Turn cfg.Funcs into a lookup table.
+	wantNames := make(map[pkginfo.QualifiedName]bool, len(pkgNames))
+	for _, name := range pkgNames {
+		wantNames[name] = true
+	}
+
+	for _, file := range pkg.Files {
+		if !hasRequiredImports(file.Imports, requiredImports) {
+			continue
+		}
+
+		// We have a file that contains the required imports.
+		// Scan it for resource creation calls.
+		inspector := file.ASTInspector()
+		fileNames := file.Names()
+
+		// nodeFilter are the AST types we care about inspecting.
+		nodeFilter := []ast.Node{(*ast.SelectorExpr)(nil)}
+
+		// Walk the AST to find references. Use stack information to resolve whether a particular
+		// reference is in a valid location.
+		inspector.WithStack(nodeFilter, func(n ast.Node, push bool, stack []ast.Node) (proceed bool) {
+			// If we're popping the stack, there's nothing to do.
+			if !push {
+				return true
+			}
+
+			// We have a reference to a selector. See if that selector
+			// references the constructors we care about.
+			sel := n.(*ast.SelectorExpr) // guaranteed based on our node filter.
+			name, ok := fileNames.ResolvePkgLevelRef(sel)
+			if !ok {
+				// Not a package-level reference.
+				return true
+			} else if !wantNames[name] {
+				// Not a reference we care about. Keep recursing.
+				return true
+			}
+
+			fn(file, name, stack)
+			return true
+		})
+	}
+}
+
+// computeRequiredImports computes the required imports based on
+// a list of func names to look for.
+func computeRequiredImports(funcs []pkginfo.QualifiedName) []paths.Pkg {
+	var result []paths.Pkg
+	seen := make(map[paths.Pkg]bool)
+	for _, f := range funcs {
+		if !seen[f.PkgPath] {
+			seen[f.PkgPath] = true
+			result = append(result, f.PkgPath)
+		}
+	}
+	return result
+}
+
+// hasRequiredImports reports whether the given imports set
+// contains all the required imports.
+func hasRequiredImports(imports map[paths.Pkg]ast.Node, required []paths.Pkg) bool {
+	for _, pkg := range required {
+		if _, found := imports[pkg]; !found {
+			return false
+		}
+	}
+	return true
+}
+
+// resolveTypeArgs resolves the type argument expressions for the given node.
+func resolveTypeArgs(node ast.Node) []ast.Expr {
+	switch n := node.(type) {
+	case *ast.IndexExpr:
+		return []ast.Expr{n.Index}
+	case *ast.IndexListExpr:
+		return n.Indices
+	}
+	return nil
+}
+
+func resolveResourceDoc(stack []ast.Node) (doc string) {
+	getDoc := func(candidates ...*ast.CommentGroup) string {
+		for _, cg := range candidates {
+			if t := cg.Text(); t != "" {
+				return t
+			}
+		}
+		return ""
+	}
+
+	for i := len(stack) - 1; i >= 0; i-- {
+		switch node := stack[i].(type) {
+		case *ast.Field:
+			if cmt := getDoc(node.Doc, node.Comment); cmt != "" {
+				return cmt
+			}
+		case *ast.ValueSpec:
+			if cmt := getDoc(node.Doc, node.Comment); cmt != "" {
+				return cmt
+			}
+
+		case *ast.GenDecl:
+			if cmt := getDoc(node.Doc); cmt != "" {
+				return cmt
+			}
+
+		case *ast.Comment:
+			if node == nil {
+				return ""
+			}
+			return node.Text
+
+		case *ast.CommentGroup:
+			return getDoc(node)
+
+		case *ast.BlockStmt, *ast.StructType, *ast.InterfaceType, *ast.FuncType:
+			return ""
+		}
+	}
+
+	return ""
+}
diff --git a/v2/parser/infra/internal/parseutil/reference.go b/v2/parser/infra/internal/parseutil/reference.go
new file mode 100644
index 0000000000..ed651c9e02
--- /dev/null
+++ b/v2/parser/infra/internal/parseutil/reference.go
@@ -0,0 +1,112 @@
+package parseutil
+
+import (
+	"go/ast"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/parser/infra/internal/locations"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+type ReferenceSpec struct {
+	MinTypeArgs int
+	MaxTypeArgs int
+	Parse       func(ReferenceInfo)
+}
+
+type ReferenceInfo struct {
+	Pass         *resourceparser.Pass
+	ResourceFunc pkginfo.QualifiedName
+	File         *pkginfo.File
+
+	Stack    []ast.Node
+	Call     *ast.CallExpr
+	TypeArgs []schema.Type
+	Doc      string
+
+	// Ident is the identifier this reference is assigned to, if any.
+	Ident option.Option[*ast.Ident]
+}
+
+type ReferenceData struct {
+	File         *pkginfo.File
+	Stack        []ast.Node
+	ResourceFunc pkginfo.QualifiedName
+}
+
+func ParseReference(p *resourceparser.Pass, spec *ReferenceSpec, data ReferenceData) {
+	selIdx := len(data.Stack) - 1
+	constructor := data.ResourceFunc
+
+	// Do we have any type arguments?
+	maybeHasTypeArgs := spec.MaxTypeArgs > 0
+
+	// If we have any type arguments it will be in the parent of the selector.
+	var typeArgs []schema.Type
+	if maybeHasTypeArgs {
+		typeArgsIdx := selIdx - 1
+		if typeArgsIdx < 0 {
+			p.Errs.Add(errRequiresTypeArgumentsNoneFound(constructor.NaiveDisplayName()).AtGoNode(data.Stack[selIdx]))
+			return
+		}
+		args := resolveTypeArgs(data.Stack[typeArgsIdx])
+		if len(args) < spec.MinTypeArgs {
+			qualifier := " at least"
+			if spec.MinTypeArgs == spec.MaxTypeArgs {
+				qualifier = ""
+			}
+
+			p.Errs.Add(errWrongNumberOfTypeArguments(constructor.NaiveDisplayName(), qualifier, spec.MinTypeArgs, len(args)).AtGoNode(data.Stack[selIdx]))
+			return
+		} else if len(args) > spec.MaxTypeArgs {
+			qualifier := " at most"
+			if spec.MinTypeArgs == spec.MaxTypeArgs {
+				qualifier = ""
+			}
+			p.Errs.Add(errWrongNumberOfTypeArguments(constructor.NaiveDisplayName(), qualifier, spec.MaxTypeArgs, len(args)).AtGoNode(data.Stack[selIdx]))
+		}
+		for _, arg := range args {
+			typeArgs = append(typeArgs, p.SchemaParser.ParseType(data.File, arg))
+		}
+	}
+
+	// Make sure the reference is called
+	callIdx := selIdx - 1
+	if len(typeArgs) > 0 {
+		// If there are type arguments there's an intermediary IndexExpr or IndexListExpr node.
+		callIdx--
+	}
+	call, ok := data.Stack[callIdx].(*ast.CallExpr)
+	if !ok {
+		p.Errs.Add(errCannotBeReferencedWithoutBeingCalled(constructor.NaiveDisplayName()).AtGoNode(data.Stack[selIdx]))
+		return
+	}
+
+	// Classify the location of the current node
+	cls := locations.Classify(data.Stack[:callIdx+1])
+
+	var pkgIdent *ast.Ident
+	switch cls := cls.(type) {
+	case locations.PkgVar:
+		pkgIdent = cls.Ident
+	case locations.OtherPkgExpr:
+		// Allowed; not assigned to a variable
+	default:
+		// Everything else is disallowed
+		p.Errs.Add(errCannotBeCalledHere(constructor.NaiveDisplayName(), "a package level variable").AtGoNode(data.Stack[selIdx]))
+		return
+	}
+
+	spec.Parse(ReferenceInfo{
+		Pass:         p,
+		File:         data.File,
+		Stack:        data.Stack,
+		Ident:        option.AsOptional(pkgIdent),
+		Call:         call,
+		TypeArgs:     typeArgs,
+		Doc:          resolveResourceDoc(data.Stack),
+		ResourceFunc: data.ResourceFunc,
+	})
+}
diff --git a/v2/parser/infra/metrics/errors.go b/v2/parser/infra/metrics/errors.go
new file mode 100644
index 0000000000..4b629baf6e
--- /dev/null
+++ b/v2/parser/infra/metrics/errors.go
@@ -0,0 +1,48 @@
+package metrics
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"metrics",
+		"For more information on metrics, see https://encore.dev/docs/observability/metrics",
+		errors.WithRangeSize(20),
+	)
+
+	errInvalidArgCount = errRange.Newf(
+		"Invalid metric construction",
+		"%s requires 2 arguments; the metric name and the config object, got %d arguments.",
+	)
+
+	errInvalidMetricType = errRange.New(
+		"Invalid metric construction",
+		"The metric value type must be a builtin type.",
+	)
+
+	errInvalidLabelType = errRange.New(
+		"Invalid metric construction",
+		"The metric label type must be a named struct type.",
+	)
+
+	errLabelNoPointer = errRange.New(
+		"Invalid metric construction",
+		"The metric label type must not be a pointer.",
+	)
+
+	errLabelNoAnonymous = errRange.New(
+		"Invalid metric label type",
+		"Anonymous fields are not supported in metric labels.",
+	)
+
+	errLabelInvalidType = errRange.New(
+		"Invalid metric label type",
+		"Invalid metric label field: must be string, bool, or integer type.",
+	)
+
+	errLabelReservedName = errRange.New(
+		"Invalid metric label name",
+		"Metric labels cannot be named 'service' as this is reserved by Encore.",
+	)
+)
diff --git a/v2/parser/infra/metrics/metrics.go b/v2/parser/infra/metrics/metrics.go
new file mode 100644
index 0000000000..6d9e17a77d
--- /dev/null
+++ b/v2/parser/infra/metrics/metrics.go
@@ -0,0 +1,232 @@
+package metrics
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"strings"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/idents"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	literals "encr.dev/v2/parser/infra/internal/literals"
+	parseutil "encr.dev/v2/parser/infra/internal/parseutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+//go:generate stringer -type=MetricType -output=metrics_string.go
+
+type MetricType int
+
+const (
+	Counter MetricType = iota
+	Gauge
+)
+
+type Metric struct {
+	AST  *ast.CallExpr
+	Name string     // The unique name of the metric
+	Doc  string     // The documentation on the metric
+	Type MetricType // the type of metric it is
+
+	// File is the file the metric is declared in.
+	File *pkginfo.File
+
+	// LabelType is the label type of the metric,
+	// if the metric is a group.
+	LabelType option.Option[schema.Type]
+
+	// Labels is the list of parsed labels.
+	Labels []Label
+
+	ValueType schema.BuiltinType
+
+	// The struct literal for the config. Used to inject additional configuration
+	// at compile-time.
+	ConfigLiteral *ast.CompositeLit
+}
+
+func (m *Metric) Kind() resource.Kind       { return resource.Metric }
+func (m *Metric) Package() *pkginfo.Package { return m.File.Pkg }
+func (m *Metric) ASTExpr() ast.Expr         { return m.AST }
+func (m *Metric) ResourceName() string      { return m.Name }
+func (m *Metric) Pos() token.Pos            { return m.AST.Pos() }
+func (m *Metric) End() token.Pos            { return m.AST.End() }
+func (m *Metric) SortKey() string           { return m.Name }
+
+type Label struct {
+	Key  string
+	Type schema.BuiltinType
+	Doc  string
+}
+
+func (l Label) String() string {
+	return fmt.Sprintf("%s %s %s", l.Key, strings.ToUpper(l.Type.String()), l.Doc)
+}
+
+// metricConstructor describes a particular metric constructor function.
+type metricConstructor struct {
+	FuncName    string
+	ConfigName  string
+	ConfigParse configParseFunc
+	HasLabels   bool
+	Type        MetricType
+}
+
+var metricConstructors = []metricConstructor{
+	{"NewCounter", "CounterConfig", parseCounterConfig, false, Counter},
+	{"NewCounterGroup", "CounterConfig", parseCounterConfig, true, Counter},
+	{"NewGauge", "GaugeConfig", parseGaugeConfig, false, Gauge},
+	{"NewGaugeGroup", "GaugeConfig", parseGaugeConfig, true, Gauge},
+}
+
+var MetricParser = &resourceparser.Parser{
+	Name: "Metric",
+
+	InterestingImports: []paths.Pkg{"encore.dev/metrics"},
+	Run: func(p *resourceparser.Pass) {
+		var (
+			names []pkginfo.QualifiedName
+			specs = make(map[pkginfo.QualifiedName]*parseutil.ReferenceSpec)
+		)
+		for _, c := range metricConstructors {
+			name := pkginfo.QualifiedName{PkgPath: "encore.dev/metrics", Name: c.FuncName}
+			names = append(names, name)
+
+			numTypeArgs := 1
+			if c.HasLabels {
+				numTypeArgs = 2
+			}
+
+			c := c // capture for closure
+			parseFn := func(d parseutil.ReferenceInfo) {
+				parseMetric(c, d)
+			}
+
+			spec := &parseutil.ReferenceSpec{
+				MinTypeArgs: numTypeArgs,
+				MaxTypeArgs: numTypeArgs,
+				Parse:       parseFn,
+			}
+			specs[name] = spec
+		}
+
+		parseutil.FindPkgNameRefs(p.Pkg, names, func(file *pkginfo.File, name pkginfo.QualifiedName, stack []ast.Node) {
+			spec := specs[name]
+			parseutil.ParseReference(p, spec, parseutil.ReferenceData{
+				File:         file,
+				Stack:        stack,
+				ResourceFunc: name,
+			})
+		})
+	},
+}
+
+func parseMetric(c metricConstructor, d parseutil.ReferenceInfo) {
+	displayName := d.ResourceFunc.NaiveDisplayName()
+	errs := d.Pass.Errs
+	if len(d.Call.Args) != 2 {
+		errs.Add(errInvalidArgCount(displayName, len(d.Call.Args)).AtGoNode(d.Call))
+		return
+	}
+
+	// Validate the metric name.
+	metricName := parseutil.ParseResourceName(errs, displayName, "metric name",
+		d.Call.Args[0], parseutil.SnakeName, "e_")
+	if metricName == "" {
+		// we already reported the error inside ParseResourceName
+		return
+	}
+
+	// Validate the metric value type.
+	valueType := d.TypeArgs[0]
+	if c.HasLabels {
+		valueType = d.TypeArgs[1]
+	}
+	if valueType.Family() != schema.Builtin {
+		errs.Add(errInvalidMetricType.AtGoNode(valueType.ASTExpr()))
+		return
+	}
+
+	var labelType option.Option[schema.Type]
+	var labelFields []Label
+	if c.HasLabels {
+		// Make sure it's a named struct, without pointers.
+		typeArg := d.TypeArgs[0]
+		declRef, ok := schemautil.ResolveNamedStruct(typeArg, false)
+		if !ok {
+			errs.Add(errInvalidLabelType.AtGoNode(typeArg.ASTExpr()))
+			return
+		} else if declRef.Pointers > 0 {
+			errs.Add(errLabelNoPointer.AtGoNode(typeArg.ASTExpr()))
+			return
+		}
+
+		// Make sure all the fields are builtin types.
+		concrete := schemautil.ConcretizeWithTypeArgs(errs, declRef.Decl.Type, declRef.TypeArgs).(schema.StructType)
+		validKinds := append([]schema.BuiltinKind{schema.Bool, schema.String}, schemautil.Integers...)
+		for _, f := range concrete.Fields {
+			if f.IsAnonymous() {
+				errs.Add(errLabelNoAnonymous.AtGoNode(f.AST))
+			} else if !schemautil.IsBuiltinKind(f.Type, validKinds...) {
+				errs.Add(errLabelInvalidType.AtGoNode(f.AST.Type, errors.AsError(fmt.Sprintf("got %s", literals.PrettyPrint(f.AST.Type)))))
+			} else {
+				// Validate the label
+				label := idents.Convert(f.Name.MustGet(), idents.SnakeCase)
+				if label == "service" {
+					errs.Add(errLabelReservedName.AtGoNode(f.AST.Names[0]))
+				}
+
+				labelFields = append(labelFields, Label{
+					Key:  label,
+					Type: f.Type.(schema.BuiltinType),
+					Doc:  f.Doc,
+				})
+			}
+		}
+		labelType = option.Some(typeArg)
+	}
+
+	m := &Metric{
+		AST:       d.Call,
+		Name:      metricName,
+		Doc:       d.Doc,
+		Type:      c.Type,
+		File:      d.File,
+		ValueType: valueType.(schema.BuiltinType),
+		LabelType: labelType,
+		Labels:    labelFields,
+	}
+
+	// Parse and validate the metric configuration.
+	cfgLit, ok := literals.ParseStruct(errs, d.File, "metrics.MetricConfig", d.Call.Args[1])
+	if !ok {
+		return // error reported by ParseStruct
+	}
+	c.ConfigParse(c, d, cfgLit, m)
+	m.ConfigLiteral = cfgLit.Lit()
+
+	d.Pass.RegisterResource(m)
+	d.Pass.AddBind(d.File, d.Ident, m)
+}
+
+type configParseFunc func(c metricConstructor, d parseutil.ReferenceInfo, cfgLit *literals.Struct, dst *Metric)
+
+func parseCounterConfig(c metricConstructor, d parseutil.ReferenceInfo, cfgLit *literals.Struct, dst *Metric) {
+	// We don't have any actual configuration yet.
+	// Parse anyway to make sure we don't have any fields we don't expect.
+	type decodedConfig struct{}
+	_ = literals.Decode[decodedConfig](d.Pass.Errs, cfgLit, nil)
+}
+
+func parseGaugeConfig(c metricConstructor, d parseutil.ReferenceInfo, cfgLit *literals.Struct, dst *Metric) {
+	// We don't have any actual configuration yet.
+	// Parse anyway to make sure we don't have any fields we don't expect.
+	type decodedConfig struct{}
+	_ = literals.Decode[decodedConfig](d.Pass.Errs, cfgLit, nil)
+}
diff --git a/v2/parser/infra/metrics/metrics_string.go b/v2/parser/infra/metrics/metrics_string.go
new file mode 100644
index 0000000000..b92f9a98b1
--- /dev/null
+++ b/v2/parser/infra/metrics/metrics_string.go
@@ -0,0 +1,24 @@
+// Code generated by "stringer -type=MetricType -output=metrics_string.go"; DO NOT EDIT.
+
+package metrics
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[Counter-0]
+	_ = x[Gauge-1]
+}
+
+const _MetricType_name = "CounterGauge"
+
+var _MetricType_index = [...]uint8{0, 7, 12}
+
+func (i MetricType) String() string {
+	if i < 0 || i >= MetricType(len(_MetricType_index)-1) {
+		return "MetricType(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _MetricType_name[_MetricType_index[i]:_MetricType_index[i+1]]
+}
diff --git a/v2/parser/infra/metrics/metrics_test.go b/v2/parser/infra/metrics/metrics_test.go
new file mode 100644
index 0000000000..0450d293f7
--- /dev/null
+++ b/v2/parser/infra/metrics/metrics_test.go
@@ -0,0 +1,79 @@
+package metrics
+
+import (
+	"testing"
+
+	"github.com/google/go-cmp/cmp/cmpopts"
+
+	"encr.dev/v2/internals/schema/schematest"
+	"encr.dev/v2/parser/resource/resourcetest"
+)
+
+func TestParseMetrics(t *testing.T) {
+	tests := []resourcetest.Case[*Metric]{
+		{
+			Name: "counter",
+			Code: `
+// Metric docs
+var x = metrics.NewCounter[int]("name", metrics.CounterConfig{})
+`,
+			Want: &Metric{
+				Name:      "name",
+				Doc:       "Metric docs\n",
+				ValueType: schematest.Int(),
+				Type:      Counter,
+			},
+		},
+		{
+			Name: "gauge",
+			Code: `
+// Metric docs
+var x = metrics.NewGauge[int]("name", metrics.GaugeConfig{})
+`,
+			Want: &Metric{
+				Name:      "name",
+				Doc:       "Metric docs\n",
+				Type:      Gauge,
+				ValueType: schematest.Int(),
+			},
+		},
+		{
+			Name: "counter_group",
+			Code: `
+// Metric docs
+var x = metrics.NewCounterGroup[Labels, int]("name", metrics.CounterConfig{})
+
+type Labels struct {
+	ID string
+}
+`,
+			Want: &Metric{
+				Name:      "name",
+				Doc:       "Metric docs\n",
+				Type:      Counter,
+				Labels:    []Label{{Key: "id", Type: schematest.String()}},
+				ValueType: schematest.Int(),
+			},
+		},
+		{
+			Name: "gauge_group",
+			Code: `
+// Metric docs
+var x = metrics.NewGaugeGroup[Labels, int]("name", metrics.GaugeConfig{})
+
+type Labels struct {
+	ID string
+}
+`,
+			Want: &Metric{
+				Name:      "name",
+				Doc:       "Metric docs\n",
+				Labels:    []Label{{Key: "id", Type: schematest.String()}},
+				ValueType: schematest.Int(),
+				Type:      Gauge,
+			},
+		},
+	}
+
+	resourcetest.Run(t, MetricParser, tests, cmpopts.IgnoreFields(Metric{}, "LabelType"))
+}
diff --git a/v2/parser/infra/objects/bucket.go b/v2/parser/infra/objects/bucket.go
new file mode 100644
index 0000000000..c048557e87
--- /dev/null
+++ b/v2/parser/infra/objects/bucket.go
@@ -0,0 +1,92 @@
+package objects
+
+import (
+	"go/ast"
+	"go/token"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	literals "encr.dev/v2/parser/infra/internal/literals"
+	parseutil "encr.dev/v2/parser/infra/internal/parseutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+type Bucket struct {
+	AST       *ast.CallExpr
+	File      *pkginfo.File
+	Name      string // The unique name of the bucket
+	Doc       string // The documentation on the bucket
+	Versioned bool
+	Public    bool
+}
+
+func (t *Bucket) Kind() resource.Kind       { return resource.Bucket }
+func (t *Bucket) Package() *pkginfo.Package { return t.File.Pkg }
+func (t *Bucket) ASTExpr() ast.Expr         { return t.AST }
+func (t *Bucket) ResourceName() string      { return t.Name }
+func (t *Bucket) Pos() token.Pos            { return t.AST.Pos() }
+func (t *Bucket) End() token.Pos            { return t.AST.End() }
+func (t *Bucket) SortKey() string           { return t.Name }
+
+var BucketParser = &resourceparser.Parser{
+	Name: "Bucket",
+
+	InterestingImports: []paths.Pkg{"encore.dev/storage/objects"},
+	Run: func(p *resourceparser.Pass) {
+		name := pkginfo.QualifiedName{Name: "NewBucket", PkgPath: "encore.dev/storage/objects"}
+
+		spec := &parseutil.ReferenceSpec{
+			MinTypeArgs: 0,
+			MaxTypeArgs: 0,
+			Parse:       parseBucket,
+		}
+
+		parseutil.FindPkgNameRefs(p.Pkg, []pkginfo.QualifiedName{name}, func(file *pkginfo.File, name pkginfo.QualifiedName, stack []ast.Node) {
+			parseutil.ParseReference(p, spec, parseutil.ReferenceData{
+				File:         file,
+				Stack:        stack,
+				ResourceFunc: name,
+			})
+		})
+	},
+}
+
+func parseBucket(d parseutil.ReferenceInfo) {
+	errs := d.Pass.Errs
+
+	if len(d.Call.Args) != 2 {
+		errs.Add(errNewBucketArgCount(len(d.Call.Args)).AtGoNode(d.Call))
+		return
+	}
+
+	bucketName := parseutil.ParseResourceName(d.Pass.Errs, "objects.NewBucket", "bucket name",
+		d.Call.Args[0], parseutil.KebabName, "")
+	if bucketName == "" {
+		// we already reported the error inside ParseResourceName
+		return
+	}
+
+	cfgLit, ok := literals.ParseStruct(d.Pass.Errs, d.File, "objects.BucketConfig", d.Call.Args[1])
+	if !ok {
+		return // error reported by ParseStruct
+	}
+
+	// Decode the config
+	type decodedConfig struct {
+		Versioned bool `literal:",optional"`
+		Public    bool `literal:",optional"`
+	}
+	config := literals.Decode[decodedConfig](d.Pass.Errs, cfgLit, nil)
+
+	bkt := &Bucket{
+		AST:       d.Call,
+		File:      d.File,
+		Name:      bucketName,
+		Doc:       d.Doc,
+		Versioned: config.Versioned,
+		Public:    config.Public,
+	}
+	d.Pass.RegisterResource(bkt)
+	d.Pass.AddBind(d.File, d.Ident, bkt)
+}
diff --git a/v2/parser/infra/objects/errors.go b/v2/parser/infra/objects/errors.go
new file mode 100644
index 0000000000..660e8d22ca
--- /dev/null
+++ b/v2/parser/infra/objects/errors.go
@@ -0,0 +1,62 @@
+package objects
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+const (
+	objectsNewBucketHelp = "For example `objects.NewBucket(\"my-bucket\", objects.BucketConfig{ Versioned: false })`"
+
+	objectsBucketUsageHelp = "The bucket can only be referenced by calling methods on it, or by using objects.BucketRef."
+)
+
+var (
+	errRange = errors.Range(
+		"pubsub",
+		"For more information on Object Storage, see https://encore.dev/docs/primitives/object-storage",
+	)
+
+	errNewBucketArgCount = errRange.Newf(
+		"Invalid objects.NewBucket call",
+		"A call to objects.NewBucket requires 2 arguments; the bucket name and the config object, got %d arguments.",
+		errors.PrependDetails(objectsNewBucketHelp),
+	)
+
+	errInvalidBucketUsage = errRange.New(
+		"Invalid reference to objects.Bucket",
+		"A reference to an objects.Bucket is not permissible here.",
+		errors.PrependDetails(objectsBucketUsageHelp),
+	)
+
+	ErrBucketNameNotUnique = errRange.New(
+		"Duplicate bucket name",
+		"An object storage bucket name must be unique.",
+
+		errors.PrependDetails("If you wish to reuse the same bucket, then you can export the original Bucket object and reference it from here."),
+	)
+
+	ErrUnsupportedOperationOutsideService = errRange.Newf(
+		"Unsupported bucket operation outside of service",
+		"The %s operation can only be performed within a service. Use objects.BucketRef to pass the bucket reference to other, non-service components.",
+	)
+
+	errBucketRefNoTypeArgs = errRange.New(
+		"Invalid call to objects.BucketRef",
+		"A type argument indicating the requested permissions must be provided.",
+	)
+
+	errBucketRefInvalidPerms = errRange.New(
+		"Unrecognized permissions in call to objects.BucketRef",
+		"The supported permissions are objects.{Uploader,Downloader,Attrser,Lister,Remover,PublicURLer,ReadWriter}.",
+	)
+
+	ErrBucketRefOutsideService = errRange.New(
+		"Call to objects.BucketRef outside service",
+		"objects.BucketRef can only be called from within a service.",
+	)
+
+	ErrBucketNotPublic = errRange.New(
+		"Call to PublicURL for non-public objects.Bucket",
+		"The PublicURL method can only be called on a public bucket.",
+	)
+)
diff --git a/v2/parser/infra/objects/usage.go b/v2/parser/infra/objects/usage.go
new file mode 100644
index 0000000000..f09e792614
--- /dev/null
+++ b/v2/parser/infra/objects/usage.go
@@ -0,0 +1,205 @@
+package objects
+
+import (
+	"slices"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/resource/usage"
+
+	meta "encr.dev/proto/encore/parser/meta/v1"
+)
+
+type MethodUsage struct {
+	usage.Base
+	Method string
+	Perm   Perm
+}
+
+type RefUsage struct {
+	usage.Base
+	Perms []Perm
+}
+
+func (u *RefUsage) HasPerm(perm Perm) bool {
+	for _, p := range u.Perms {
+		if p == perm {
+			return true
+		}
+	}
+	return false
+}
+
+type Perm string
+
+const (
+	ListObjects          Perm = "list-objects"
+	ReadObjectContents   Perm = "read-object-contents"
+	WriteObject          Perm = "write-object"
+	UpdateObjectMetadata Perm = "update-object-metadata"
+	GetObjectMetadata    Perm = "get-object-metadata"
+	DeleteObject         Perm = "delete-object"
+	GetPublicURL         Perm = "get-public-url"
+	SignedUploadURL      Perm = "signed-upload-url"
+	SignedDownloadURL    Perm = "signed-download-url"
+)
+
+func (p Perm) ToMeta() (meta.BucketUsage_Operation, bool) {
+	switch p {
+	case ListObjects:
+		return meta.BucketUsage_LIST_OBJECTS, true
+	case ReadObjectContents:
+		return meta.BucketUsage_READ_OBJECT_CONTENTS, true
+	case WriteObject:
+		return meta.BucketUsage_WRITE_OBJECT, true
+	case UpdateObjectMetadata:
+		return meta.BucketUsage_UPDATE_OBJECT_METADATA, true
+	case GetObjectMetadata:
+		return meta.BucketUsage_GET_OBJECT_METADATA, true
+	case DeleteObject:
+		return meta.BucketUsage_DELETE_OBJECT, true
+	case GetPublicURL:
+		return meta.BucketUsage_GET_PUBLIC_URL, true
+	case SignedUploadURL:
+		return meta.BucketUsage_SIGNED_UPLOAD_URL, true
+	case SignedDownloadURL:
+		return meta.BucketUsage_SIGNED_DOWNLOAD_URL, true
+	default:
+		return meta.BucketUsage_UNKNOWN, false
+	}
+}
+
+func ResolveBucketUsage(data usage.ResolveData, bkt *Bucket) usage.Usage {
+	switch expr := data.Expr.(type) {
+	case *usage.MethodCall:
+		var perm Perm
+		switch expr.Method {
+		case "Upload":
+			perm = WriteObject
+		case "Download":
+			perm = ReadObjectContents
+		case "List":
+			perm = ListObjects
+		case "Remove":
+			perm = DeleteObject
+		case "PublicURL":
+			perm = GetPublicURL
+		case "SignedUploadURL":
+			perm = SignedUploadURL
+		case "SignedDownloadURL":
+			perm = SignedDownloadURL
+		case "Attrs", "Exists":
+			perm = GetObjectMetadata
+		default:
+			return nil
+		}
+
+		return &MethodUsage{
+			Base: usage.Base{
+				File: expr.File,
+				Bind: expr.Bind,
+				Expr: expr,
+			},
+			Method: expr.Method,
+			Perm:   perm,
+		}
+
+	case *usage.FuncArg:
+		switch {
+		case option.Contains(expr.PkgFunc, pkginfo.Q("encore.dev/storage/objects", "BucketRef")):
+			return parseBucketRef(data.Errs, expr)
+		}
+	}
+
+	data.Errs.Add(errInvalidBucketUsage.AtGoNode(data.Expr))
+	return nil
+}
+
+func parseBucketRef(errs *perr.List, expr *usage.FuncArg) usage.Usage {
+	if len(expr.TypeArgs) < 1 {
+		errs.Add(errBucketRefNoTypeArgs.AtGoNode(expr.Call))
+		return nil
+	}
+
+	checkUsage := func(types ...schema.Type) (usage.Usage, bool) {
+		if len(types) == 0 {
+			return nil, false
+		}
+
+		var perms []Perm
+		for _, typ := range types {
+			switch {
+			case isNamed(typ, "Uploader"):
+				perms = append(perms, WriteObject)
+			case isNamed(typ, "SignedUploader"):
+				perms = append(perms, SignedUploadURL)
+			case isNamed(typ, "Downloader"):
+				perms = append(perms, ReadObjectContents)
+			case isNamed(typ, "SignedDownloader"):
+				perms = append(perms, SignedDownloadURL)
+			case isNamed(typ, "Lister"):
+				perms = append(perms, ListObjects)
+			case isNamed(typ, "Remover"):
+				perms = append(perms, DeleteObject)
+			case isNamed(typ, "Attrser"):
+				perms = append(perms, GetObjectMetadata)
+			case isNamed(typ, "PublicURLer"):
+				perms = append(perms, GetPublicURL)
+			case isNamed(typ, "ReadWriter"):
+				perms = append(perms,
+					WriteObject, ReadObjectContents, ListObjects, DeleteObject,
+					GetObjectMetadata, SignedUploadURL, SignedDownloadURL, UpdateObjectMetadata)
+			default:
+				return nil, false
+			}
+		}
+
+		// Sort and de-dup the perms.
+		slices.Sort(perms)
+		perms = slices.Compact(perms)
+
+		return &RefUsage{
+			Base: usage.Base{
+				File: expr.File,
+				Bind: expr.Bind,
+				Expr: expr,
+			},
+			Perms: perms,
+		}, true
+	}
+
+	// Do we have a simple usage directly as the type argument?
+	if u, ok := checkUsage(expr.TypeArgs[0]); ok {
+		return u
+	}
+
+	// Determine if we have a custom ref type,
+	// either in the form "type Foo = pubsub.Publisher[Msg]"
+	// or in the form "type Foo interface { pubsub.Publisher[Msg] }"
+	if named, ok := expr.TypeArgs[0].(schema.NamedType); ok {
+		underlying := named.Decl().Type
+		if u, ok := checkUsage(underlying); ok {
+			return u
+		}
+
+		// Otherwise make sure the interface only embeds the one supported type we have (pubsub.Publisher).
+		// We'll need to extend this in the future to support multiple permissions.
+		if iface, ok := underlying.(schema.InterfaceType); ok {
+			if len(iface.Methods) == 0 && len(iface.TypeLists) == 0 {
+				if u, ok := checkUsage(iface.EmbeddedIfaces...); ok {
+					return u
+				}
+			}
+		}
+	}
+
+	errs.Add(errBucketRefInvalidPerms.AtGoNode(expr.Call))
+	return nil
+}
+
+func isNamed(typ schema.Type, name string) bool {
+	return schemautil.IsNamed(typ, "encore.dev/storage/objects", name)
+}
diff --git a/v2/parser/infra/objects/usage_test.go b/v2/parser/infra/objects/usage_test.go
new file mode 100644
index 0000000000..3aa00811e6
--- /dev/null
+++ b/v2/parser/infra/objects/usage_test.go
@@ -0,0 +1,165 @@
+package objects_test
+
+import (
+	"testing"
+
+	"encr.dev/v2/parser/infra/objects"
+	"encr.dev/v2/parser/resource/usage"
+	"encr.dev/v2/parser/resource/usage/usagetest"
+)
+
+func TestResolveBucketUsage(t *testing.T) {
+	tests := []usagetest.Case{
+		{
+			Name: "none",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+`,
+			Want: []usage.Usage{},
+		},
+		{
+			Name: "upload",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+func Foo() { bkt.Upload(context.Background(), "key") }
+
+`,
+			Want: []usage.Usage{&objects.MethodUsage{Method: "Upload", Perm: objects.WriteObject}},
+		},
+		{
+			Name: "sign_upload_url",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+func Foo() { bkt.SignedUploadURL(context.Background(), "key") }
+
+`,
+			Want: []usage.Usage{&objects.MethodUsage{Method: "SignedUploadURL", Perm: objects.SignedUploadURL}},
+		},
+		{
+			Name: "sign_download_url",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+func Foo() { bkt.SignedDownloadURL(context.Background(), "key") }
+
+`,
+			Want: []usage.Usage{&objects.MethodUsage{Method: "SignedDownloadURL", Perm: objects.SignedDownloadURL}},
+		},
+		{
+			Name: "attrs",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+func Foo() { bkt.Attrs(context.Background(), "key") }
+`,
+			Want: []usage.Usage{&objects.MethodUsage{Method: "Attrs", Perm: objects.GetObjectMetadata}},
+		},
+		{
+			Name: "exists",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+func Foo() { bkt.Exists(context.Background(), "key") }
+`,
+			Want: []usage.Usage{&objects.MethodUsage{Method: "Exists", Perm: objects.GetObjectMetadata}},
+		},
+		{
+			Name: "ref",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+var ref = objects.BucketRef[objects.Uploader](bkt)
+`,
+			Want: []usage.Usage{&objects.RefUsage{
+				Perms: []objects.Perm{objects.WriteObject},
+			}},
+		},
+		{
+			Name: "ref_multi",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+var ref = objects.BucketRef[objects.ReadWriter](bkt)
+`,
+			Want: []usage.Usage{&objects.RefUsage{
+				Perms: []objects.Perm{
+					objects.DeleteObject,
+					objects.GetObjectMetadata,
+					objects.ListObjects,
+					objects.ReadObjectContents,
+					objects.SignedDownloadURL,
+					objects.SignedUploadURL,
+					objects.UpdateObjectMetadata,
+					objects.WriteObject,
+				},
+			}},
+		},
+		{
+			Name: "custom_ref_alias",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+type MyRef = objects.Uploader
+
+var ref = objects.BucketRef[MyRef](bkt)
+`,
+			Want: []usage.Usage{&objects.RefUsage{
+				Perms: []objects.Perm{objects.WriteObject},
+			}},
+		},
+		{
+			Name: "custom_ref_interface",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+type MyRef interface { objects.Uploader }
+
+var ref = objects.BucketRef[MyRef](bkt)
+`,
+			Want: []usage.Usage{&objects.RefUsage{
+				Perms: []objects.Perm{objects.WriteObject},
+			}},
+		},
+		{
+			Name: "custom_ref_interface_multi",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+type MyRef interface { objects.Uploader; objects.Downloader; objects.SignedUploader }
+
+var ref = objects.BucketRef[MyRef](bkt)
+`,
+			Want: []usage.Usage{&objects.RefUsage{
+				Perms: []objects.Perm{
+					objects.ReadObjectContents,
+					objects.SignedUploadURL,
+					objects.WriteObject},
+			}},
+		},
+		{
+			Name: "invalid_ref",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+type MyRef interface { objects.Uploader; ~int | string; Publish() int }
+
+var ref = objects.BucketRef[MyRef](bkt)
+`,
+			WantErrs: []string{"Unrecognized permissions in call to objects.BucketRef"},
+		},
+		{
+			Name: "invalid_ref_2",
+			Code: `
+var bkt = objects.NewBucket("bucket", objects.BucketConfig{})
+
+var ref = objects.BucketRef[string](bkt)
+`,
+			WantErrs: []string{"Unrecognized permissions in call to objects.BucketRef"},
+		},
+	}
+
+	usagetest.Run(t, []string{"encore.dev/storage/objects"}, tests)
+}
diff --git a/v2/parser/infra/pubsub/errors.go b/v2/parser/infra/pubsub/errors.go
new file mode 100644
index 0000000000..acb548737c
--- /dev/null
+++ b/v2/parser/infra/pubsub/errors.go
@@ -0,0 +1,155 @@
+package pubsub
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+const (
+	pubsubNewTopicHelp = "For example `pubsub.NewTopic[MyMessage](\"my-topic\", pubsub.TopicConfig{ DeliveryGuarantee: pubsub.AtLeastOnce })`"
+
+	pubsubNewSubscriptionHelp = "A pubsub subscription must have a unique name per topic and be given a handler function for processing the message. " +
+		"The handler for the subscription must be defined in the same service as the call to pubsub.NewSubscription and can be an inline function. " +
+		"For example:\n" +
+		"\tpubsub.NewSubscription(myTopic, \"subscription-name\", pubsub.SubscriptionConfig[MyMessage]{\n" +
+		"\t\tHandler: func(ctx context.Context, event MyMessage) error { return nil },\n" +
+		"\t})"
+
+	pubsubTopicUsageHelp = "The topic can only be referenced by calling methods on it, or to pass it to pubsub.NewSubscription or et.Topic."
+
+	pubsubMethodHandlerHelp = "For example `pubsub.MethodHandler(Service.MethodName)` or `pubsub.MethodHandler((*Service).MethodName)`.`"
+)
+
+var (
+	errRange = errors.Range(
+		"pubsub",
+		"For more information on PubSub, see https://encore.dev/docs/primitives/pubsub",
+	)
+
+	errNewTopicArgCount = errRange.Newf(
+		"Invalid pubsub.NewTopic call",
+		"A call to pubsub.NewTopic requires 2 arguments; the topic name and the config object, got %d arguments.",
+		errors.PrependDetails(pubsubNewTopicHelp),
+	)
+
+	errInvalidMessageType = errRange.New(
+		"Invalid PubSub message type",
+		"The message type for a PubSub topic or subscription must be a named struct type.",
+		errors.PrependDetails(pubsubNewTopicHelp),
+	)
+
+	errInvalidDeliveryGuarantee = errRange.New(
+		"Invalid PubSub topic config",
+		"The configuration field named \"DeliveryGuarantee\" must be set to pubsub.AtLeastOnce or pubsub.ExactlyOnce.",
+	)
+
+	errOrderingKeyNotExported = errRange.New(
+		"Invalid PubSub topic config",
+		"The configuration field named \"OrderingAttribute\" must be a one of the export attributes on the message type.",
+		errors.PrependDetails(pubsubNewTopicHelp),
+	)
+
+	errInvalidTopicUsage = errRange.New(
+		"Invalid reference to pubsub.Topic",
+		"A reference to pubsub.Topic is not permissible here.",
+		errors.PrependDetails(pubsubTopicUsageHelp),
+	)
+
+	errNewSubscriptionArgCount = errRange.Newf(
+		"Invalid pubsub.NewSubscription call",
+		"A call to pubsub.NewSubscription requires 3 arguments; the topic, the subscription name and the config object, got %d arguments.",
+		errors.PrependDetails(pubsubNewSubscriptionHelp),
+	)
+
+	ErrSubscriptionTopicNotResource = errRange.New(
+		"Invalid call to pubsub.NewSubscription",
+		"pubsub.NewSubscription requires the first argument to be a resource of type pubsub.Topic.",
+		errors.PrependDetails(pubsubNewSubscriptionHelp),
+	)
+
+	errInvalidAttrPrefix = errRange.New(
+		"Invalid attribute prefix",
+		"PubSub message attributes must not be prefixed with \"encore\".",
+	)
+
+	ErrTopicNameNotUnique = errRange.New(
+		"Duplicate PubSub topic name",
+		"A PubSub topic name must be unique within a service.",
+
+		errors.PrependDetails("If you wish to reuse the same topic, then you can export the original Topic object import it here."),
+	)
+
+	ErrSubscriptionNameNotUnique = errRange.New(
+		"Duplicate PubSub subscription on topic",
+		"Subscription names on topics must be unique.",
+	)
+
+	ErrUnableToIdentifyServicesInvolved = errRange.New(
+		"Unable to identify services involved",
+		"Unable to identify services involved in the PubSub subscription.",
+		errors.MarkAsInternalError(),
+	)
+
+	ErrSubscriptionHandlerNotDefinedInSameService = errRange.New(
+		"Invalid PubSub subscription handler",
+		"The handler for the subscription must be defined in the same service as the call to pubsub.NewSubscription.",
+		errors.PrependDetails(pubsubNewSubscriptionHelp),
+	)
+
+	errSubscriptionAckDeadlineTooShort = errRange.New(
+		"Invalid PubSub subscription config",
+		"The ack deadline must be at least 1 second.",
+	)
+
+	errSubscriptionMessageRetentionTooShort = errRange.New(
+		"Invalid PubSub subscription config",
+		"The message retention must be at least 1 minute.",
+	)
+
+	errSubscriptionMinRetryBackoffTooShort = errRange.New(
+		"Invalid PubSub subscription config",
+		"The min backoff for retries must be at least 1 second.",
+	)
+
+	errSubscriptionMaxRetryBackoffTooShort = errRange.New(
+		"Invalid PubSub subscription config",
+		"The max backoff for retries must be at least 1 second.",
+	)
+
+	errSubscriptionMaxRetriesTooSmall = errRange.New(
+		"Invalid PubSub subscription config",
+		"The max number of retries must be a positive number or the constants `pubsub.InfiniteRetries` or `pubsub.NoRetries`.",
+	)
+
+	errTopicRefNoTypeArgs = errRange.New(
+		"Invalid call to pubsub.TopicRef",
+		"A type argument indicating the requested permissions must be provided.",
+	)
+
+	errTopicRefInvalidPerms = errRange.New(
+		"Unrecognized permissions in call to pubsub.TopicRef",
+		"The only supported permission is currently pubsub.Publisher[MyMessage].",
+	)
+
+	ErrTopicRefOutsideService = errRange.New(
+		"Call to pubsub.TopicRef outside service",
+		"pubsub.TopicRef can only be called from within a service.",
+	)
+
+	ErrInvalidMethodHandler = errRange.New(
+		"Invalid call to pubsub.MethodHandler",
+		"pubsub.MethodHandler requires the first argument to be a reference to a method on a service struct.",
+		errors.PrependDetails(pubsubMethodHandlerHelp),
+	)
+
+	ErrMethodHandlerTypeNotServiceStruct = errRange.New(
+		"Invalid call to pubsub.MethodHandler",
+		"pubsub.MethodHandler can only reference methods that are defined on service structs.",
+		errors.PrependDetails(pubsubMethodHandlerHelp),
+	)
+
+	ErrMethodHandlerDifferentPackage = errRange.New(
+		"Invalid call to pubsub.MethodHandler",
+		"pubsub.MethodHandler can only reference the service struct defined in the same package as the subscription.",
+		errors.PrependDetails(pubsubMethodHandlerHelp),
+	)
+)
diff --git a/v2/parser/infra/pubsub/subscription.go b/v2/parser/infra/pubsub/subscription.go
new file mode 100644
index 0000000000..9196276ae0
--- /dev/null
+++ b/v2/parser/infra/pubsub/subscription.go
@@ -0,0 +1,237 @@
+package pubsub
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"time"
+
+	"golang.org/x/tools/go/ast/astutil"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/infra/internal/literals"
+	"encr.dev/v2/parser/infra/internal/parseutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+type Subscription struct {
+	AST   *ast.CallExpr
+	File  *pkginfo.File
+	Name  string // The unique name of the pub sub subscription
+	Doc   string // The documentation on the pub sub subscription
+	Topic pkginfo.QualifiedName
+	Cfg   SubscriptionConfig
+
+	// Handler is the AST expression defining the handler function.
+	Handler ast.Expr
+
+	// MethodHandler specifies whether the handler is a method on a service struct.
+	MethodHandler option.Option[MethodHandler]
+}
+
+// MethodHandler is used to describe a handler that references a method on a service struct.
+type MethodHandler struct {
+	// The type declaration the handler is a method on.
+	Decl *pkginfo.PkgDeclInfo
+	// Method is the name of the method.
+	Method string
+}
+
+type SubscriptionConfig struct {
+	AckDeadline      time.Duration
+	MessageRetention time.Duration
+	MinRetryBackoff  time.Duration
+	MaxRetryBackoff  time.Duration
+	MaxRetries       int
+	MaxConcurrency   int
+}
+
+func (s *Subscription) Kind() resource.Kind       { return resource.PubSubSubscription }
+func (s *Subscription) Package() *pkginfo.Package { return s.File.Pkg }
+func (s *Subscription) ASTExpr() ast.Expr         { return s.AST }
+func (s *Subscription) ResourceName() string      { return s.Name }
+func (s *Subscription) Pos() token.Pos            { return s.AST.Pos() }
+func (s *Subscription) End() token.Pos            { return s.AST.End() }
+func (s *Subscription) SortKey() string {
+	return s.Topic.PkgPath.String() + "." + s.Topic.Name + "." + s.Name
+}
+
+var SubscriptionParser = &resourceparser.Parser{
+	Name: "PubSub Subscription",
+
+	InterestingImports: []paths.Pkg{"encore.dev/pubsub"},
+	Run: func(p *resourceparser.Pass) {
+		name := pkginfo.QualifiedName{Name: "NewSubscription", PkgPath: "encore.dev/pubsub"}
+
+		spec := &parseutil.ReferenceSpec{
+			MinTypeArgs: 0,
+			MaxTypeArgs: 1,
+			Parse:       parsePubSubSubscription,
+		}
+
+		parseutil.FindPkgNameRefs(p.Pkg, []pkginfo.QualifiedName{name}, func(file *pkginfo.File, name pkginfo.QualifiedName, stack []ast.Node) {
+			parseutil.ParseReference(p, spec, parseutil.ReferenceData{
+				File:         file,
+				Stack:        stack,
+				ResourceFunc: name,
+			})
+		})
+	},
+}
+
+func parsePubSubSubscription(d parseutil.ReferenceInfo) {
+	displayName := d.ResourceFunc.NaiveDisplayName()
+	errs := d.Pass.Errs
+	if len(d.Call.Args) != 3 {
+		errs.Add(errNewSubscriptionArgCount(len(d.Call.Args)).AtGoNode(d.Call))
+		return
+	}
+
+	topicExpr := d.Call.Args[0]
+	topicObj, ok := d.File.Names().ResolvePkgLevelRef(topicExpr)
+	if !ok {
+		errs.Add(ErrSubscriptionTopicNotResource.AtGoNode(topicExpr))
+		return
+	}
+
+	subscriptionName := parseutil.ParseResourceName(d.Pass.Errs, displayName, "subscription name",
+		d.Call.Args[1], parseutil.KebabName, "")
+	if subscriptionName == "" {
+		// we already reported the error inside ParseResourceName
+		return
+	}
+
+	// Parse the literal struct representing the subscription configuration
+	// so we can extract the reference to the handler function
+	cfgLit, ok := literals.ParseStruct(d.Pass.Errs, d.File, "pubsub.SubscriptionConfig", d.Call.Args[2])
+	if !ok {
+		return // error reported by ParseStruct
+	}
+
+	type retryConfig struct {
+		MinRetryBackoff time.Duration `literal:"MinBackoff,optional,default"`
+		MaxRetryBackoff time.Duration `literal:"MaxBackoff,optional,default"`
+		MaxRetries      int           `literal:"MaxRetries,optional,default"`
+	}
+	type decodedConfig struct {
+		Handler ast.Expr `literal:",dynamic,required"`
+
+		// Optional configuration
+		MaxConcurrency   int           `literal:",optional,default"`
+		AckDeadline      time.Duration `literal:",optional,default"`
+		MessageRetention time.Duration `literal:",optional,default"`
+		RetryPolicy      retryConfig   `literal:",optional,default"`
+	}
+	defaults := decodedConfig{
+		MaxConcurrency:   100,
+		AckDeadline:      30 * time.Second,
+		MessageRetention: 7 * 24 * time.Hour,
+		RetryPolicy: retryConfig{
+			MinRetryBackoff: 10 * time.Second,
+			MaxRetryBackoff: 10 * time.Minute,
+			MaxRetries:      100,
+		},
+	}
+
+	cfg := literals.Decode[decodedConfig](d.Pass.Errs, cfgLit, &defaults)
+
+	// Verify we have a config which is in-range of acceptable values
+	if cfg.AckDeadline < 1*time.Second {
+		errs.Add(errSubscriptionAckDeadlineTooShort.AtGoNode(cfgLit.Expr("AckDeadline"), errors.AsError(fmt.Sprintf("got %s", cfg.AckDeadline))))
+	}
+
+	if cfg.MessageRetention < 1*time.Minute {
+		errs.Add(errSubscriptionMessageRetentionTooShort.AtGoNode(cfgLit.Expr("MessageRetention"), errors.AsError(fmt.Sprintf("got %s", cfg.MessageRetention))))
+	}
+
+	if cfg.RetryPolicy.MinRetryBackoff < 1*time.Second {
+		errs.Add(errSubscriptionMinRetryBackoffTooShort.AtGoNode(cfgLit.Expr("RetryPolicy.MinBackoff"), errors.AsError(fmt.Sprintf("got %s", cfg.RetryPolicy.MinRetryBackoff))))
+	}
+
+	if cfg.RetryPolicy.MaxRetryBackoff < 1*time.Second {
+		errs.Add(errSubscriptionMaxRetryBackoffTooShort.AtGoNode(cfgLit.Expr("RetryPolicy.MaxBackoff"), errors.AsError(fmt.Sprintf("got %s", cfg.RetryPolicy.MaxRetryBackoff))))
+	}
+
+	if cfg.RetryPolicy.MaxRetries < -2 {
+		errs.Add(errSubscriptionMaxRetriesTooSmall.AtGoNode(cfgLit.Expr("RetryPolicy.MaxRetries"), errors.AsError(fmt.Sprintf("got %d", cfg.RetryPolicy.MaxRetries))))
+	}
+
+	subCfg := SubscriptionConfig{
+		AckDeadline:      cfg.AckDeadline,
+		MessageRetention: cfg.MessageRetention,
+		MinRetryBackoff:  cfg.RetryPolicy.MinRetryBackoff,
+		MaxRetryBackoff:  cfg.RetryPolicy.MaxRetryBackoff,
+		MaxRetries:       cfg.RetryPolicy.MaxRetries,
+		MaxConcurrency:   cfg.MaxConcurrency,
+	}
+
+	if cfg.Handler == nil {
+		return
+	}
+
+	methodHandler := parseMethodHandler(d, cfg.Handler)
+	sub := &Subscription{
+		AST:           d.Call,
+		File:          d.File,
+		Name:          subscriptionName,
+		Doc:           d.Doc,
+		Topic:         topicObj,
+		Cfg:           subCfg,
+		Handler:       cfg.Handler,
+		MethodHandler: methodHandler,
+	}
+	d.Pass.RegisterResource(sub)
+	d.Pass.AddBind(d.File, d.Ident, sub)
+}
+
+// parseMethodHandler parses whether the subscription handler references
+// a method on a type.
+func parseMethodHandler(d parseutil.ReferenceInfo, handler ast.Expr) option.Option[MethodHandler] {
+	var (
+		none   = option.None[MethodHandler]()
+		f      = d.File
+		errs   = d.Pass.Errs
+		parser = d.Pass.SchemaParser
+	)
+
+	// If the handler is a method handler it must be of the form:
+	//  pubsub.MethodHandler(Service.Method) or pubsub.MethodHandler((*Service).Method)
+	call, ok := handler.(*ast.CallExpr)
+	if !ok {
+		return none
+	}
+
+	qn, ok := f.Names().ResolvePkgLevelRef(call.Fun)
+	if !ok || qn.PkgPath != "encore.dev/pubsub" || qn.Name != "MethodHandler" {
+		return none
+	} else if len(call.Args) != 1 {
+		errs.Add(ErrInvalidMethodHandler.AtGoNode(call))
+		return none
+	}
+
+	// The first arg must be in the form (*Service).Method or Service.Method.
+	sel, ok := call.Args[0].(*ast.SelectorExpr)
+	if !ok {
+		errs.Add(ErrInvalidMethodHandler.AtGoNode(call))
+		return none
+	}
+	x := astutil.Unparen(sel.X)
+
+	// Parse the type declaration.
+	typ := parser.ParseType(f, x)
+	decl, ok := schemautil.DerefNamedInfo(typ, false)
+	if !ok {
+		errs.Add(ErrInvalidMethodHandler.AtGoNode(call))
+		return none
+	}
+
+	return option.Some(MethodHandler{
+		Decl:   decl,
+		Method: sel.Sel.Name,
+	})
+}
diff --git a/v2/parser/infra/pubsub/topic.go b/v2/parser/infra/pubsub/topic.go
new file mode 100644
index 0000000000..65e45e2ab2
--- /dev/null
+++ b/v2/parser/infra/pubsub/topic.go
@@ -0,0 +1,160 @@
+package pubsub
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"strings"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	literals "encr.dev/v2/parser/infra/internal/literals"
+	parseutil "encr.dev/v2/parser/infra/internal/parseutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+type DeliveryGuarantee int
+
+const (
+	AtLeastOnce DeliveryGuarantee = iota
+	ExactlyOnce
+)
+
+type Topic struct {
+	AST               *ast.CallExpr
+	File              *pkginfo.File
+	Name              string              // The unique name of the pub sub topic
+	Doc               string              // The documentation on the pub sub topic
+	DeliveryGuarantee DeliveryGuarantee   // What guarantees does the pub sub topic have?
+	OrderingAttribute string              // What field in the message type should be used to ensure First-In-First-Out (FIFO) for messages with the same key
+	MessageType       *schema.TypeDeclRef // The message type of the pub sub topic
+}
+
+func (t *Topic) Kind() resource.Kind       { return resource.PubSubTopic }
+func (t *Topic) Package() *pkginfo.Package { return t.File.Pkg }
+func (t *Topic) ASTExpr() ast.Expr         { return t.AST }
+func (t *Topic) ResourceName() string      { return t.Name }
+func (t *Topic) Pos() token.Pos            { return t.AST.Pos() }
+func (t *Topic) End() token.Pos            { return t.AST.End() }
+func (t *Topic) SortKey() string           { return t.Name }
+
+var TopicParser = &resourceparser.Parser{
+	Name: "PubSub Topic",
+
+	InterestingImports: []paths.Pkg{"encore.dev/pubsub"},
+	Run: func(p *resourceparser.Pass) {
+		name := pkginfo.QualifiedName{Name: "NewTopic", PkgPath: "encore.dev/pubsub"}
+
+		spec := &parseutil.ReferenceSpec{
+			MinTypeArgs: 1,
+			MaxTypeArgs: 1,
+			Parse:       parsePubSubTopic,
+		}
+
+		parseutil.FindPkgNameRefs(p.Pkg, []pkginfo.QualifiedName{name}, func(file *pkginfo.File, name pkginfo.QualifiedName, stack []ast.Node) {
+			parseutil.ParseReference(p, spec, parseutil.ReferenceData{
+				File:         file,
+				Stack:        stack,
+				ResourceFunc: name,
+			})
+		})
+	},
+}
+
+func parsePubSubTopic(d parseutil.ReferenceInfo) {
+	errs := d.Pass.Errs
+
+	if len(d.Call.Args) != 2 {
+		errs.Add(errNewTopicArgCount(len(d.Call.Args)).AtGoNode(d.Call))
+		return
+	}
+
+	topicName := parseutil.ParseResourceName(d.Pass.Errs, "pubsub.NewTopic", "topic name",
+		d.Call.Args[0], parseutil.KebabName, "")
+	if topicName == "" {
+		// we already reported the error inside ParseResourceName
+		return
+	}
+
+	messageType, ok := schemautil.ResolveNamedStruct(d.TypeArgs[0], false)
+	if !ok {
+		errs.Add(errInvalidMessageType.AtGoNode(d.TypeArgs[0].ASTExpr(), errors.AsError(fmt.Sprintf("got %s", parseutil.NodeType(d.TypeArgs[0].ASTExpr())))))
+		return
+	}
+
+	cfgLit, ok := literals.ParseStruct(d.Pass.Errs, d.File, "pubsub.TopicConfig", d.Call.Args[1])
+	if !ok {
+		return // error reported by ParseStruct
+	}
+
+	// Decode the config
+	type decodedConfig struct {
+		DeliveryGuarantee int    `literal:",optional"` // optional rather than required because we check for a zero value below
+		OrderingAttribute string `literal:",optional"`
+	}
+	config := literals.Decode[decodedConfig](d.Pass.Errs, cfgLit, nil)
+
+	// Get the ordering key
+	if config.OrderingAttribute != "" {
+		var foundField ast.Node
+
+		// Make sure the OrderingAttribute value exists in the struct.
+		str := messageType.Decl.Type.(schema.StructType)
+		for _, field := range str.Fields {
+			if attr, err := field.Tag.Get("pubsub-attr"); err == nil && attr.Name == config.OrderingAttribute {
+				foundField = field.AST
+				break
+			}
+		}
+
+		if foundField == nil || !ast.IsExported(foundField.(*ast.Field).Names[0].Name) {
+			if foundField == nil {
+				foundField = cfgLit.Expr("OrderingAttribute")
+			}
+			errs.Add(errOrderingKeyNotExported.AtGoNode(foundField))
+		}
+	}
+
+	deliveryGuarantee := DeliveryGuarantee(config.DeliveryGuarantee) - 1 // The runtime variables are 1 indexed so we can detect a zero value
+	if deliveryGuarantee != AtLeastOnce && deliveryGuarantee != ExactlyOnce {
+		pos := cfgLit.Pos("DeliveryGuarantee")
+		errs.Add(errInvalidDeliveryGuarantee.AtGoPos(pos, pos))
+	}
+
+	// Validate the message attributes are not using the reserved prefix
+	if str, ok := messageType.Decl.Type.(schema.StructType); ok {
+		for _, field := range str.Fields {
+			for _, tagKey := range field.Tag.Keys() {
+				tag, err := field.Tag.Get(tagKey)
+				if err == nil {
+					switch tagKey {
+					case "pubsub-attr":
+						if strings.HasPrefix(tag.Name, "encore") {
+							errs.Add(errInvalidAttrPrefix.
+								AtGoNode(field.AST.Tag).
+								AtGoNode(d.TypeArgs[0].ASTExpr(), errors.AsHelp("used as a message type in this topic")))
+						}
+					}
+				}
+			}
+		}
+	} else {
+		panic("not a struct")
+	}
+
+	topic := &Topic{
+		AST:               d.Call,
+		File:              d.File,
+		Name:              topicName,
+		Doc:               d.Doc,
+		DeliveryGuarantee: deliveryGuarantee,
+		OrderingAttribute: config.OrderingAttribute,
+		MessageType:       messageType,
+	}
+	d.Pass.RegisterResource(topic)
+	d.Pass.AddBind(d.File, d.Ident, topic)
+}
diff --git a/v2/parser/infra/pubsub/usage.go b/v2/parser/infra/pubsub/usage.go
new file mode 100644
index 0000000000..048b663c9b
--- /dev/null
+++ b/v2/parser/infra/pubsub/usage.go
@@ -0,0 +1,115 @@
+package pubsub
+
+import (
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/resource/usage"
+)
+
+type PublishUsage struct {
+	usage.Base
+}
+
+type RefUsage struct {
+	usage.Base
+	Perms []Perm
+}
+
+func (u *RefUsage) HasPerm(perm Perm) bool {
+	for _, p := range u.Perms {
+		if p == perm {
+			return true
+		}
+	}
+	return false
+}
+
+type Perm string
+
+const (
+	PublishPerm Perm = "publish"
+)
+
+func ResolveTopicUsage(data usage.ResolveData, topic *Topic) usage.Usage {
+	switch expr := data.Expr.(type) {
+	case *usage.MethodCall:
+		if expr.Method == "Publish" {
+			return &PublishUsage{
+				Base: usage.Base{
+					File: expr.File,
+					Bind: expr.Bind,
+					Expr: expr,
+				},
+			}
+		} else {
+			return nil
+		}
+
+	case *usage.FuncArg:
+		switch {
+		case option.Contains(expr.PkgFunc, pkginfo.Q("encore.dev/pubsub", "NewSubscription")):
+			// Allowed usage
+			return nil
+		case option.Contains(expr.PkgFunc, pkginfo.Q("encore.dev/et", "Topic")):
+			// Allowed usage
+			return nil
+		case option.Contains(expr.PkgFunc, pkginfo.Q("encore.dev/pubsub", "TopicRef")):
+			return parseTopicRef(data.Errs, expr)
+		}
+	}
+
+	data.Errs.Add(errInvalidTopicUsage.AtGoNode(data.Expr))
+	return nil
+}
+
+func parseTopicRef(errs *perr.List, expr *usage.FuncArg) usage.Usage {
+	if len(expr.TypeArgs) < 1 {
+		errs.Add(errTopicRefNoTypeArgs.AtGoNode(expr.Call))
+		return nil
+	}
+
+	checkUsage := func(typ schema.Type) (usage.Usage, bool) {
+		if schemautil.IsNamed(typ, "encore.dev/pubsub", "Publisher") {
+			return &RefUsage{
+				Base: usage.Base{
+					File: expr.File,
+					Bind: expr.Bind,
+					Expr: expr,
+				},
+				Perms: []Perm{PublishPerm},
+			}, true
+		}
+		return nil, false
+	}
+
+	// Do we have a simple usage directly as the type argument?
+	if u, ok := checkUsage(expr.TypeArgs[0]); ok {
+		return u
+	}
+
+	// Determine if we have a custom ref type,
+	// either in the form "type Foo = pubsub.Publisher[Msg]"
+	// or in the form "type Foo interface { pubsub.Publisher[Msg] }"
+	if named, ok := expr.TypeArgs[0].(schema.NamedType); ok {
+		underlying := named.Decl().Type
+		if u, ok := checkUsage(underlying); ok {
+			return u
+		}
+
+		// Otherwise make sure the interface only embeds the one supported type we have (pubsub.Publisher).
+		// We'll need to extend this in the future to support multiple permissions.
+		if iface, ok := underlying.(schema.InterfaceType); ok {
+			if len(iface.EmbeddedIfaces) == 1 && len(iface.Methods) == 0 && len(iface.TypeLists) == 0 {
+				if u, ok := checkUsage(iface.EmbeddedIfaces[0]); ok {
+					return u
+				}
+			}
+		}
+	}
+
+	errs.Add(errTopicRefInvalidPerms.AtGoNode(expr.Call))
+	return nil
+}
diff --git a/v2/parser/infra/pubsub/usage_test.go b/v2/parser/infra/pubsub/usage_test.go
new file mode 100644
index 0000000000..12760810db
--- /dev/null
+++ b/v2/parser/infra/pubsub/usage_test.go
@@ -0,0 +1,120 @@
+package pubsub_test
+
+import (
+	"testing"
+
+	"encr.dev/v2/parser/infra/pubsub"
+	"encr.dev/v2/parser/resource/usage"
+	"encr.dev/v2/parser/resource/usage/usagetest"
+)
+
+func TestResolveTopicUsage(t *testing.T) {
+	tests := []usagetest.Case{
+		{
+			Name: "none",
+			Code: `
+type Msg struct{}
+
+var topic = pubsub.NewTopic[Msg]("topic", pubsub.TopicConfig{DeliveryGuarantee: pubsub.AtLeastOnce})
+
+`,
+			Want: []usage.Usage{},
+		},
+		{
+			Name: "publish",
+			Code: `
+type Msg struct{}
+
+var topic = pubsub.NewTopic[Msg]("topic", pubsub.TopicConfig{DeliveryGuarantee: pubsub.AtLeastOnce})
+
+func Foo() { topic.Publish(context.Background(), Msg{}) }
+
+`,
+			Want: []usage.Usage{&pubsub.PublishUsage{}},
+		},
+		{
+			Name: "ref",
+			Code: `
+type Msg struct{}
+
+var topic = pubsub.NewTopic[Msg]("topic", pubsub.TopicConfig{DeliveryGuarantee: pubsub.AtLeastOnce})
+
+var ref = pubsub.TopicRef[pubsub.Publisher[Msg]](topic)
+`,
+			Want: []usage.Usage{&pubsub.RefUsage{
+				Perms: []pubsub.Perm{pubsub.PublishPerm},
+			}},
+		},
+		{
+			Name: "custom_ref_alias",
+			Code: `
+type Msg struct{}
+
+var topic = pubsub.NewTopic[Msg]("topic", pubsub.TopicConfig{DeliveryGuarantee: pubsub.AtLeastOnce})
+
+type MyRef = pubsub.Publisher[Msg]
+
+var ref = pubsub.TopicRef[MyRef](topic)
+`,
+			Want: []usage.Usage{&pubsub.RefUsage{
+				Perms: []pubsub.Perm{pubsub.PublishPerm},
+			}},
+		},
+		{
+			Name: "custom_ref_interface",
+			Code: `
+type Msg struct{}
+
+var topic = pubsub.NewTopic[Msg]("topic", pubsub.TopicConfig{DeliveryGuarantee: pubsub.AtLeastOnce})
+
+type MyRef interface { pubsub.Publisher[Msg] }
+
+var ref = pubsub.TopicRef[MyRef](topic)
+`,
+			Want: []usage.Usage{&pubsub.RefUsage{
+				Perms: []pubsub.Perm{pubsub.PublishPerm},
+			}},
+		},
+		{
+			Name: "generic_custom_ref_interface",
+			Code: `
+type Msg struct{}
+
+var topic = pubsub.NewTopic[Msg]("topic", pubsub.TopicConfig{DeliveryGuarantee: pubsub.AtLeastOnce})
+
+type MyRef[T any] interface { pubsub.Publisher[T] }
+
+var ref = pubsub.TopicRef[MyRef[Msg]](topic)
+`,
+			Want: []usage.Usage{&pubsub.RefUsage{
+				Perms: []pubsub.Perm{pubsub.PublishPerm},
+			}},
+		},
+		{
+			Name: "invalid_ref",
+			Code: `
+type Msg struct{}
+
+var topic = pubsub.NewTopic[Msg]("topic", pubsub.TopicConfig{DeliveryGuarantee: pubsub.AtLeastOnce})
+
+type MyRef interface { pubsub.Publisher[Msg]; ~int | string; Publish() int }
+
+var ref = pubsub.TopicRef[MyRef](topic)
+`,
+			WantErrs: []string{"Unrecognized permissions in call to pubsub.TopicRef"},
+		},
+		{
+			Name: "invalid_ref_2",
+			Code: `
+type Msg struct{}
+
+var topic = pubsub.NewTopic[Msg]("topic", pubsub.TopicConfig{DeliveryGuarantee: pubsub.AtLeastOnce})
+
+var ref = pubsub.TopicRef[string](topic)
+`,
+			WantErrs: []string{"Unrecognized permissions in call to pubsub.TopicRef"},
+		},
+	}
+
+	usagetest.Run(t, []string{"encore.dev/pubsub"}, tests)
+}
diff --git a/v2/parser/infra/secrets/errors.go b/v2/parser/infra/secrets/errors.go
new file mode 100644
index 0000000000..a9c2e0836a
--- /dev/null
+++ b/v2/parser/infra/secrets/errors.go
@@ -0,0 +1,39 @@
+package secrets
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	errRange = errors.Range(
+		"secrets",
+		"For more information about how to use secrets, see https://encore.dev/docs/primitives/secrets",
+
+		errors.WithRangeSize(20),
+	)
+
+	errSecretsMustBeStruct = errRange.New(
+		"Invalid secrets variable",
+		"The \"secrets\" variable type must be an inline struct.",
+	)
+
+	errSecretsDefinedSeperately = errRange.New(
+		"Invalid secrets variable",
+		"The \"secrets\" variable must be declared separately and not in a var block.",
+	)
+
+	errSecretsGivenValue = errRange.New(
+		"Invalid secrets variable",
+		"The \"secrets\" variable must not be given a value. Encore will ensure that the secrets are loaded at runtime.",
+	)
+
+	errAnonymousFields = errRange.New(
+		"Invalid secrets struct",
+		"Anonymous fields are not allowed in the secrets struct.",
+	)
+
+	errSecretsMustBeString = errRange.New(
+		"Invalid secrets struct",
+		"Secrets must be of type string.",
+	)
+)
diff --git a/v2/parser/infra/secrets/secrets.go b/v2/parser/infra/secrets/secrets.go
new file mode 100644
index 0000000000..6af33621c1
--- /dev/null
+++ b/v2/parser/infra/secrets/secrets.go
@@ -0,0 +1,94 @@
+package secrets
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/schema/schemautil"
+	"encr.dev/v2/parser/infra/internal/literals"
+	"encr.dev/v2/parser/infra/internal/parseutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+// Secrets represents a secrets struct.
+type Secrets struct {
+	AST   *ast.StructType
+	File  *pkginfo.File // Where the secrets struct is declared
+	Ident *ast.Ident    // The identifier of the secrets struct
+	Keys  []string      // Secret keys to load
+
+	// Spec is the value spec that defines the 'secrets' variable.
+	Spec *ast.ValueSpec
+}
+
+type SecretKey struct {
+	Name string
+}
+
+func (*Secrets) Kind() resource.Kind         { return resource.Secrets }
+func (s *Secrets) Package() *pkginfo.Package { return s.File.Pkg }
+func (s *Secrets) ASTExpr() ast.Expr         { return s.AST }
+func (s *Secrets) Pos() token.Pos            { return s.AST.Pos() }
+func (s *Secrets) End() token.Pos            { return s.AST.End() }
+func (s *Secrets) SortKey() string {
+	return fmt.Sprintf("%s:%s:%d", s.File.Pkg.ImportPath, s.File.Name, s.AST.Pos())
+}
+
+var SecretsParser = &resourceparser.Parser{
+	Name:               "Secrets",
+	InterestingImports: resourceparser.RunAlways,
+
+	Run: func(p *resourceparser.Pass) {
+		secrets := p.Pkg.Names().PkgDecls["secrets"]
+		if secrets == nil || secrets.Type != token.VAR {
+			return // nothing to do
+		}
+
+		// Note: we can't use schema.ParseTypeDecl since this is not a type declaration.
+		// Resolve the type expression manually instead.
+		spec := secrets.Spec.(*ast.ValueSpec)
+		if spec.Type == nil {
+			p.Errs.Add(errSecretsMustBeStruct.AtGoNode(spec, errors.AsError(fmt.Sprintf("got %s", parseutil.NodeType(spec)))))
+			return
+		} else if len(spec.Names) != 1 {
+			p.Errs.Add(errSecretsDefinedSeperately.AtGoNode(spec))
+			return
+		} else if len(spec.Values) != 0 {
+			p.Errs.Add(errSecretsGivenValue.AtGoNode(spec.Values[0]))
+			return
+		}
+
+		st, ok := p.SchemaParser.ParseType(secrets.File, spec.Type).(schema.StructType)
+		if !ok {
+			p.Errs.Add(errSecretsMustBeStruct.AtGoNode(spec, errors.AsError(fmt.Sprintf("got %s", parseutil.NodeType(spec)))))
+			return
+		}
+
+		res := &Secrets{
+			AST:   spec.Type.(*ast.StructType),
+			File:  secrets.File,
+			Spec:  spec,
+			Ident: spec.Names[0],
+		}
+
+		for _, f := range st.Fields {
+			if f.IsAnonymous() {
+				p.Errs.Add(errAnonymousFields.AtGoNode(f.AST))
+				continue
+			}
+			if !schemautil.IsBuiltinKind(f.Type, schema.String) {
+				p.Errs.Add(errSecretsMustBeString.AtGoNode(f.AST.Type, errors.AsError(fmt.Sprintf("got %s", literals.PrettyPrint(f.Type.ASTExpr())))))
+				continue
+			}
+			res.Keys = append(res.Keys, f.Name.MustGet())
+		}
+
+		p.RegisterResource(res)
+		p.AddNamedBind(res.File, res.Ident, res)
+	},
+}
diff --git a/v2/parser/infra/sqldb/errors.go b/v2/parser/infra/sqldb/errors.go
new file mode 100644
index 0000000000..0caed95bdf
--- /dev/null
+++ b/v2/parser/infra/sqldb/errors.go
@@ -0,0 +1,62 @@
+package sqldb
+
+import (
+	"encr.dev/pkg/errors"
+)
+
+var (
+	ErrDuplicateNames = errRange.New(
+		"Duplicate Databases",
+		"Multiple databases with the same name were found. Database names must be unique.",
+	)
+
+	errRange = errors.Range(
+		"sqldb",
+		"For more information about how to use databases in Encore, see https://encore.dev/docs/primitives/databases",
+
+		errors.WithRangeSize(20),
+	)
+
+	errUnableToParseMigrations = errRange.New(
+		"Unable to parse migrations",
+		"Encore was unable to parse the database migrations. Please ensure that the migrations are in the correct format.",
+	)
+
+	errNamedRequiresDatabaseName = errRange.Newf(
+		"Invalid call to sqldb.Named",
+		"sqldb.Named requires a database name to be passed as the only argument, got %d arguments.",
+	)
+
+	errNamedRequiresDatabaseNameString = errRange.New(
+		"Invalid call to sqldb.Named",
+		"sqldb.Named requires a database name to be passed as a string literal.",
+	)
+	errNewDatabaseArgCount = errRange.Newf(
+		"Invalid sqldb.NewDatabase call",
+		"A call to sqldb.NewDatabase requires 2 arguments: the database name and the config object, got %d arguments.",
+	)
+	errNewDatabaseAbsPath = errRange.New(
+		"Invalid sqldb.NewDatabase call",
+		"The migration path must be a relative path rooted within the package directory, got an absolute path.",
+	)
+	errNewDatabaseNonLocalPath = errRange.New(
+		"Invalid sqldb.NewDatabase call",
+		"The migration path must be a relative path rooted within the package directory, got a non-local path.",
+	)
+	errNewDatabaseMigrationDirNotFound = errRange.New(
+		"Invalid sqldb.NewDatabase call",
+		"The migration directory does not exist.",
+	)
+	errMigrationsNotInMainModule = errRange.New(
+		"Invalid database migration directory",
+		"The migration path must be within the application's main module.",
+	)
+	errInvalidPkgLevelQuery = errRange.Newf(
+		"Invalid use of sqldb package-level function",
+		"The package-level query function sqldb.%s can only be used within Encore services that don't use sqldb.NewDatabase.",
+	)
+	ErrDatabaseNotFound = errRange.Newf(
+		"Unknown sqldb database",
+		"No database named %q was found in the application. Ensure it is created somewhere using sqldb.NewDatabase to be able to reference it.",
+	)
+)
diff --git a/v2/parser/infra/sqldb/implicit.go b/v2/parser/infra/sqldb/implicit.go
new file mode 100644
index 0000000000..cf537af57a
--- /dev/null
+++ b/v2/parser/infra/sqldb/implicit.go
@@ -0,0 +1,127 @@
+package sqldb
+
+import (
+	"cmp"
+	"go/ast"
+	"slices"
+	"sort"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/usage"
+)
+
+// ComputeImplicitUsage computes the implicit usage of SQLDB resources via package-level
+// sqldb.{Query,QueryRow,Exec,etc} calls.
+func ComputeImplicitUsage(errs *perr.List, pkgs []*pkginfo.Package, binds []resource.Bind) []usage.Expr {
+	// Compute the list of package paths that define SQLDB implicit binds.
+	type sqldbBind struct {
+		Pkg  paths.Pkg
+		Bind resource.Bind
+	}
+
+	var sqldbBinds []sqldbBind
+	for _, b := range binds {
+		if implicit, ok := b.(*resource.ImplicitBind); ok {
+			// Is this a SQLDB resource?
+			ref := implicit.Resource
+			if _, ok := ref.Resource.(*Database); ok {
+				sqldbBinds = append(sqldbBinds, sqldbBind{Pkg: b.Package().ImportPath, Bind: b})
+			} else if ref.Path != nil && ref.Path[0].Kind == resource.SQLDatabase {
+				sqldbBinds = append(sqldbBinds, sqldbBind{Pkg: b.Package().ImportPath, Bind: b})
+			}
+		}
+	}
+
+	// Sort them to allow for binary searches.
+	slices.SortFunc(sqldbBinds, func(a, b sqldbBind) int {
+		if n := cmp.Compare(a.Pkg, b.Pkg); n != 0 {
+			return n
+		}
+		return cmp.Compare(a.Bind.Pos(), b.Bind.Pos())
+	})
+
+	findBind := func(pkg paths.Pkg) (b resource.Bind, ok bool) {
+		i := sort.Search(len(sqldbBinds), func(i int) bool {
+			return sqldbBinds[i].Pkg >= pkg
+		})
+		if i < len(sqldbBinds) && sqldbBinds[i].Pkg == pkg {
+			return sqldbBinds[i].Bind, true
+		} else if i > 0 && sqldbBinds[i-1].Pkg.LexicallyContains(pkg) {
+			return sqldbBinds[i-1].Bind, true
+		}
+		return nil, false
+	}
+
+	const sqldbPkg paths.Pkg = "encore.dev/storage/sqldb"
+
+	var usages []usage.Expr
+	for _, pkg := range pkgs {
+		if _, found := pkg.Imports[sqldbPkg]; !found {
+			continue
+		}
+		for _, file := range pkg.Files {
+			if _, found := file.Imports[sqldbPkg]; !found {
+				continue
+			}
+
+			// The file is using sqldb, so scan its AST for usages.
+			insp := file.ASTInspector()
+			names := file.Names()
+			insp.WithStack([]ast.Node{(*ast.SelectorExpr)(nil)}, func(n ast.Node, push bool, stack []ast.Node) bool {
+				if !push {
+					return true
+				}
+
+				sel := n.(*ast.SelectorExpr)
+				qn, ok := names.ResolvePkgLevelRef(sel)
+				if !ok || qn.PkgPath != sqldbPkg {
+					return true
+				}
+
+				switch qn.Name {
+				case "Exec", "ExecTx", "QueryRow", "QueryRowTx", "Query", "QueryTx", "Begin":
+					validUsage := false
+					if bind, ok := findBind(file.Pkg.ImportPath); ok {
+						if u := classifySQLDBUsage(file, bind, sel, stack); u != nil {
+							usages = append(usages, u)
+							validUsage = true
+						}
+					}
+					if !validUsage {
+						errs.Add(errInvalidPkgLevelQuery(qn.Name).AtGoNode(sel))
+					}
+				}
+
+				return true
+			})
+		}
+	}
+
+	return usages
+}
+
+func classifySQLDBUsage(file *pkginfo.File, bind resource.Bind, sel *ast.SelectorExpr, stack []ast.Node) usage.Expr {
+	idx := len(stack) - 1
+	if idx >= 1 {
+		if call, ok := stack[idx-1].(*ast.CallExpr); ok {
+			return &usage.MethodCall{
+				File:   file,
+				Bind:   bind,
+				Call:   call,
+				Method: sel.Sel.Name,
+				Args:   call.Args,
+			}
+		}
+	}
+
+	// Otherwise it's a field access.
+	return &usage.FieldAccess{
+		File:  file,
+		Bind:  bind,
+		Expr:  sel,
+		Field: sel.Sel.Name,
+	}
+}
diff --git a/v2/parser/infra/sqldb/named.go b/v2/parser/infra/sqldb/named.go
new file mode 100644
index 0000000000..b75bdd16f5
--- /dev/null
+++ b/v2/parser/infra/sqldb/named.go
@@ -0,0 +1,61 @@
+package sqldb
+
+import (
+	"fmt"
+	"go/ast"
+
+	"encr.dev/pkg/errors"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/infra/internal/literals"
+	"encr.dev/v2/parser/infra/internal/parseutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+var NamedParser = &resourceparser.Parser{
+	Name: "Named SQL Database",
+
+	InterestingImports: []paths.Pkg{"encore.dev/storage/sqldb"},
+	Run: func(p *resourceparser.Pass) {
+		name := pkginfo.QualifiedName{Name: "Named", PkgPath: "encore.dev/storage/sqldb"}
+
+		spec := &parseutil.ReferenceSpec{
+			Parse:       parseNamedSQLDB,
+			MinTypeArgs: 0,
+			MaxTypeArgs: 0,
+		}
+
+		parseutil.FindPkgNameRefs(p.Pkg, []pkginfo.QualifiedName{name}, func(file *pkginfo.File, name pkginfo.QualifiedName, stack []ast.Node) {
+			parseutil.ParseReference(p, spec, parseutil.ReferenceData{
+				File:         file,
+				Stack:        stack,
+				ResourceFunc: name,
+			})
+		})
+	},
+}
+
+func parseNamedSQLDB(d parseutil.ReferenceInfo) {
+	if len(d.Call.Args) != 1 {
+		d.Pass.Errs.Add(errNamedRequiresDatabaseName(len(d.Call.Args)).AtGoNode(d.Call))
+		return
+	}
+
+	dbName, ok := literals.ParseString(d.Call.Args[0])
+	if !ok {
+		d.Pass.Errs.Add(
+			errNamedRequiresDatabaseNameString.
+				AtGoNode(d.Call.Args[0], errors.AsError(fmt.Sprintf("got %v", parseutil.NodeType(d.Call.Args[0])))),
+		)
+		return
+	}
+
+	if len(dbName) <= 0 {
+		d.Pass.Errs.Add(
+			errNamedRequiresDatabaseNameString.AtGoNode(d.Call.Args[0], errors.AsError("got an empty string")),
+		)
+	}
+
+	d.Pass.AddPathBind(d.File, d.Ident, resource.Path{{resource.SQLDatabase, dbName}})
+}
diff --git a/v2/parser/infra/sqldb/sqldb.go b/v2/parser/infra/sqldb/sqldb.go
new file mode 100644
index 0000000000..dc1270b351
--- /dev/null
+++ b/v2/parser/infra/sqldb/sqldb.go
@@ -0,0 +1,272 @@
+package sqldb
+
+import (
+	"bytes"
+	"errors"
+	"fmt"
+	"go/ast"
+	"go/token"
+	"io/fs"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strconv"
+	"strings"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/infra/internal/literals"
+	"encr.dev/v2/parser/infra/internal/parseutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+type Database struct {
+	AST          *ast.CallExpr
+	Pkg          *pkginfo.Package
+	Name         string // The database name
+	Doc          string
+	File         option.Option[*pkginfo.File]
+	MigrationDir paths.MainModuleRelSlash
+	Migrations   []MigrationFile
+}
+
+func (d *Database) Kind() resource.Kind       { return resource.SQLDatabase }
+func (d *Database) Package() *pkginfo.Package { return d.Pkg }
+func (d *Database) ResourceName() string      { return d.Name }
+func (d *Database) Pos() token.Pos            { return token.NoPos }
+func (d *Database) End() token.Pos            { return token.NoPos }
+func (d *Database) SortKey() string           { return d.Name }
+
+type MigrationFile struct {
+	Filename    string
+	Number      uint64
+	Description string
+}
+
+var DatabaseParser = &resourceparser.Parser{
+	Name: "SQL Database",
+
+	InterestingImports: []paths.Pkg{"encore.dev/storage/sqldb"},
+	Run: func(p *resourceparser.Pass) {
+		name := pkginfo.QualifiedName{PkgPath: "encore.dev/storage/sqldb", Name: "NewDatabase"}
+
+		spec := &parseutil.ReferenceSpec{
+			MinTypeArgs: 0,
+			MaxTypeArgs: 0,
+			Parse:       parseDatabase,
+		}
+
+		parseutil.FindPkgNameRefs(p.Pkg, []pkginfo.QualifiedName{name}, func(file *pkginfo.File, name pkginfo.QualifiedName, stack []ast.Node) {
+			parseutil.ParseReference(p, spec, parseutil.ReferenceData{
+				File:         file,
+				Stack:        stack,
+				ResourceFunc: name,
+			})
+		})
+	},
+}
+
+func parseDatabase(d parseutil.ReferenceInfo) {
+	errs := d.Pass.Errs
+
+	if len(d.Call.Args) != 2 {
+		errs.Add(errNewDatabaseArgCount(len(d.Call.Args)).AtGoNode(d.Call))
+		return
+	}
+
+	databaseName := parseutil.ParseResourceName(d.Pass.Errs, "sqldb.NewDatabase", "database name",
+		d.Call.Args[0], parseutil.SnakeName, "")
+	if databaseName == "" {
+		// we already reported the error inside ParseResourceName
+		return
+	}
+
+	cfgLit, ok := literals.ParseStruct(d.Pass.Errs, d.File, "sqldb.DatabaseConfig", d.Call.Args[1])
+	if !ok {
+		return // error reported by ParseStruct
+	}
+
+	// Decode the config
+	type decodedConfig struct {
+		Migrations string `literal:",required"`
+	}
+	config := literals.Decode[decodedConfig](d.Pass.Errs, cfgLit, nil)
+
+	if path.IsAbs(config.Migrations) {
+		errs.Add(errNewDatabaseAbsPath.AtGoNode(cfgLit.Expr("Migrations")))
+		return
+	}
+	migDir := filepath.FromSlash(config.Migrations)
+	if !filepath.IsLocal(migDir) {
+		errs.Add(errNewDatabaseNonLocalPath.AtGoNode(cfgLit.Expr("Migrations")))
+		return
+	}
+
+	migrationDir := d.Pass.Pkg.FSPath.Join(migDir)
+	if fi, err := os.Stat(migrationDir.ToIO()); errors.Is(err, fs.ErrNotExist) || (err == nil && !fi.IsDir()) {
+		errs.Add(errNewDatabaseMigrationDirNotFound.AtGoNode(cfgLit.Expr("Migrations")))
+		return
+	} else if err != nil {
+		errs.AddStd(err)
+		return
+	}
+
+	// Compute the relative path to the migration directory from the main module.
+	relMigrationDir, err := filepath.Rel(d.Pass.MainModuleDir.ToIO(), migrationDir.ToIO())
+	if err != nil || !filepath.IsLocal(relMigrationDir) {
+		errs.Add(errMigrationsNotInMainModule)
+		return
+	}
+
+	migrations, err := parseMigrations(migrationDir)
+	if err != nil {
+		errs.Add(errUnableToParseMigrations.AtGoNode(cfgLit.Expr("Migrations")).Wrapping(err))
+		return
+	}
+
+	db := &Database{
+		AST:          d.Call,
+		Pkg:          d.Pass.Pkg,
+		Name:         databaseName,
+		Doc:          d.Doc,
+		MigrationDir: paths.MainModuleRelSlash(filepath.ToSlash(relMigrationDir)),
+		Migrations:   migrations,
+	}
+	d.Pass.RegisterResource(db)
+	d.Pass.AddBind(d.File, d.Ident, db)
+}
+
+var MigrationParser = &resourceparser.Parser{
+	Name: "SQL Database",
+
+	InterestingSubdirs: []string{"migrations"},
+	Run: func(p *resourceparser.Pass) {
+		migrationDir := p.Pkg.FSPath.Join("migrations")
+		migrations, err := parseMigrations(migrationDir)
+		if err != nil {
+			// HACK(andre): We should only look for migration directories inside services,
+			// but when this code runs we don't yet know what services exist.
+			// For now, use some heuristics to guess if this is a service and otherwise ignore it.
+			if !pkgIsLikelyService(p.Pkg) {
+				return
+			}
+
+			err := fmt.Errorf("parsing db migrations in %s: %v", p.Pkg.ImportPath, err)
+			p.Errs.Add(errUnableToParseMigrations.Wrapping(err))
+			return
+		} else if len(migrations) == 0 {
+			return
+		}
+
+		// HACK(andre): We also need to do the check here, otherwise we get
+		// spurious databases that are defined outside of services.
+		if !pkgIsLikelyService(p.Pkg) {
+			return
+		}
+
+		// Compute the relative path to the migration directory from the main module.
+		relMigrationDir, err := filepath.Rel(p.MainModuleDir.ToIO(), migrationDir.ToIO())
+		if err != nil || !filepath.IsLocal(relMigrationDir) {
+			p.Errs.Add(errMigrationsNotInMainModule)
+			return
+		}
+
+		res := &Database{
+			Pkg:          p.Pkg,
+			Name:         p.Pkg.Name,
+			MigrationDir: paths.MainModuleRelSlash(filepath.ToSlash(relMigrationDir)),
+			Migrations:   migrations,
+		}
+		p.RegisterResource(res)
+		p.AddImplicitBind(res)
+	},
+}
+
+var migrationRe = regexp.MustCompile(`^(\d+)(_[^.]+)?\.(up|down).sql$`)
+
+func parseMigrations(migrationDir paths.FS) ([]MigrationFile, error) {
+	files, err := os.ReadDir(migrationDir.ToIO())
+	if err != nil {
+		return nil, fmt.Errorf("could not read migrations: %v", err)
+	}
+	migrations := make([]MigrationFile, 0, len(files))
+	for _, f := range files {
+		if f.IsDir() {
+			continue
+		}
+
+		// If the file is not an SQL file ignore it, to allow for other files to be present
+		// in the migration directory. For SQL files we want to ensure they're properly named
+		// so that we complain loudly about potential typos. (It's theoretically possible to
+		// typo the filename extension as well, but it's less likely due to syntax highlighting).
+		if filepath.Ext(strings.ToLower(f.Name())) != ".sql" {
+			continue
+		}
+
+		match := migrationRe.FindStringSubmatch(f.Name())
+		if match == nil {
+			return nil, fmt.Errorf("db migration %s: invalid name (must be of the format '[123]_[description].[up|down].sql')",
+				f.Name())
+		}
+		num, err := strconv.ParseUint(match[1], 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("db migration %s: invalid version number %q (must be a positive integer)",
+				f.Name(), match[1])
+		}
+
+		description := strings.TrimPrefix(match[2], "_")
+		if match[3] == "up" {
+			migrations = append(migrations, MigrationFile{
+				Filename:    f.Name(),
+				Number:      num,
+				Description: description,
+			})
+		}
+	}
+	sort.Slice(migrations, func(i, j int) bool {
+		return migrations[i].Number < migrations[j].Number
+	})
+
+	// Catch invalid migration numbers.
+	seen := make(map[uint64]bool, len(migrations))
+	for _, mig := range migrations {
+		fn, num := mig.Filename, mig.Number
+		if num <= 0 {
+			return nil, fmt.Errorf("db migration %s: invalid migration number %d", fn, num)
+		} else if seen[num] {
+			return nil, fmt.Errorf("db migration %s: duplicate migration with number %d", fn, num)
+		}
+		seen[num] = true
+	}
+
+	return migrations, nil
+}
+
+func pkgIsLikelyService(pkg *pkginfo.Package) bool {
+	isLikelyService := func(file *pkginfo.File) bool {
+		contents := file.Contents()
+		switch {
+		case bytes.Contains(contents, []byte("encore:api")):
+			return true
+		case bytes.Contains(contents, []byte("pubsub.NewSubscription")):
+			return true
+		case bytes.Contains(contents, []byte("encore:authhandler")):
+			return true
+		case bytes.Contains(contents, []byte("encore:service")):
+			return true
+		default:
+			return false
+		}
+	}
+
+	for _, file := range pkg.Files {
+		if isLikelyService(file) {
+			return true
+		}
+	}
+	return false
+}
diff --git a/v2/parser/infra/sqldb/sqldb_test.go b/v2/parser/infra/sqldb/sqldb_test.go
new file mode 100644
index 0000000000..23f7199c70
--- /dev/null
+++ b/v2/parser/infra/sqldb/sqldb_test.go
@@ -0,0 +1,64 @@
+package sqldb
+
+import (
+	"testing"
+
+	"encr.dev/v2/parser/resource/resourcetest"
+)
+
+func TestParseDatabase(t *testing.T) {
+	tests := []resourcetest.Case[*Database]{
+		{
+			Name: "constructor",
+			Code: `
+var x = sqldb.NewDatabase("name", sqldb.DatabaseConfig{
+	Migrations: "some/migration/path",
+})
+-- some/migration/path/foo.txt --
+`,
+			Want: &Database{
+				Name:         "name",
+				MigrationDir: "some/migration/path",
+			},
+		},
+		{
+			Name: "migration_file",
+			Code: `
+var x = sqldb.NewDatabase("name", sqldb.DatabaseConfig{
+	Migrations: "some/migration/path",
+})
+-- some/migration/path/1_foo.up.sql --
+CREATE TABLE foo (id int);
+`,
+			Want: &Database{
+				Name:         "name",
+				MigrationDir: "some/migration/path",
+				Migrations: []MigrationFile{{
+					Filename:    "1_foo.up.sql",
+					Number:      1,
+					Description: "foo",
+				}},
+			},
+		},
+		{
+			Name: "abs_path",
+			Code: `
+var x = sqldb.NewDatabase("name", sqldb.DatabaseConfig{
+	Migrations: "/path",
+})
+`,
+			WantErrs: []string{`.*The migration path must be a relative path.*`},
+		},
+		{
+			Name: "non_local_path",
+			Code: `
+var x = sqldb.NewDatabase("name", sqldb.DatabaseConfig{
+	Migrations: "../path",
+})
+`,
+			WantErrs: []string{`.*The migration path must be a relative path.*`},
+		},
+	}
+
+	resourcetest.Run(t, DatabaseParser, tests)
+}
diff --git a/v2/parser/infra/sqldb/usage.go b/v2/parser/infra/sqldb/usage.go
new file mode 100644
index 0000000000..f794dcd82a
--- /dev/null
+++ b/v2/parser/infra/sqldb/usage.go
@@ -0,0 +1,19 @@
+package sqldb
+
+import (
+	"encr.dev/v2/parser/resource/usage"
+)
+
+type DatabaseUsage struct {
+	usage.Base
+}
+
+func ResolveDatabaseUsage(data usage.ResolveData, db *Database) usage.Usage {
+	return &DatabaseUsage{
+		Base: usage.Base{
+			File: data.Expr.DeclaredIn(),
+			Bind: data.Expr.ResourceBind(),
+			Expr: data.Expr,
+		},
+	}
+}
diff --git a/v2/parser/internal/utils/prettyprint.go b/v2/parser/internal/utils/prettyprint.go
new file mode 100644
index 0000000000..c3af528fd6
--- /dev/null
+++ b/v2/parser/internal/utils/prettyprint.go
@@ -0,0 +1,37 @@
+package utils
+
+import (
+	"fmt"
+	"go/ast"
+	"reflect"
+	"strings"
+)
+
+func PrettyPrint(node ast.Expr) string {
+	switch node := node.(type) {
+	case *ast.Ident:
+		return node.Name
+
+	case *ast.SelectorExpr:
+		return fmt.Sprintf("%s.%s", PrettyPrint(node.X), node.Sel.Name)
+
+	case *ast.IndexExpr:
+		return fmt.Sprintf("%s[%s]", PrettyPrint(node.X), PrettyPrint(node.Index))
+
+	case *ast.IndexListExpr:
+		indices := make([]string, 0, len(node.Indices))
+		for _, n := range node.Indices {
+			indices = append(indices, PrettyPrint(n))
+		}
+		return fmt.Sprintf("%s[%s]", PrettyPrint(node.X), strings.Join(indices, ", "))
+
+	case *ast.FuncLit:
+		return "a function literal"
+
+	case *ast.StarExpr:
+		return fmt.Sprintf("a pointer to %s", PrettyPrint(node.X))
+
+	default:
+		return fmt.Sprintf("a %v", reflect.TypeOf(node))
+	}
+}
diff --git a/v2/parser/parser.go b/v2/parser/parser.go
new file mode 100644
index 0000000000..898ba2a755
--- /dev/null
+++ b/v2/parser/parser.go
@@ -0,0 +1,255 @@
+package parser
+
+import (
+	"cmp"
+	"slices"
+	"sync"
+
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/scan"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/parser/apis"
+	"encr.dev/v2/parser/apis/api"
+	"encr.dev/v2/parser/apis/authhandler"
+	"encr.dev/v2/parser/apis/servicestruct"
+	"encr.dev/v2/parser/infra/caches"
+	"encr.dev/v2/parser/infra/config"
+	"encr.dev/v2/parser/infra/crons"
+	"encr.dev/v2/parser/infra/metrics"
+	"encr.dev/v2/parser/infra/objects"
+	"encr.dev/v2/parser/infra/pubsub"
+	"encr.dev/v2/parser/infra/secrets"
+	"encr.dev/v2/parser/infra/sqldb"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+	"encr.dev/v2/parser/resource/usage"
+)
+
+func NewParser(c *parsectx.Context) *Parser {
+	loader := pkginfo.New(c)
+	schemaParser := schema.NewParser(c, loader)
+	return &Parser{
+		c:             c,
+		loader:        loader,
+		schemaParser:  schemaParser,
+		registry:      resourceparser.NewRegistry(allParsers),
+		usageResolver: newUsageResolver(),
+	}
+}
+
+type Parser struct {
+	c             *parsectx.Context
+	loader        *pkginfo.Loader
+	schemaParser  *schema.Parser
+	registry      *resourceparser.Registry
+	usageResolver *usage.Resolver
+}
+
+func (p *Parser) MainModule() *pkginfo.Module {
+	return p.loader.MainModule()
+}
+
+func (p *Parser) RuntimeModule() *pkginfo.Module {
+	return p.loader.RuntimeModule()
+}
+
+// Parse parses the given application for uses of the Encore API Framework
+// and the Encore infrastructure SDK.
+func (p *Parser) Parse() *Result {
+	var (
+		mu        sync.Mutex
+		pkgs      []*pkginfo.Package
+		resources []resource.Resource
+		binds     []resource.Bind
+	)
+
+	scan.ProcessModule(p.c.Errs, p.loader, p.c.MainModuleDir, func(pkg *pkginfo.Package) {
+		if pkg.Name == "main" {
+			// Ignore main packages that aren't the main package we're building, if any.
+			if mainPkg, ok := p.c.Build.MainPkg.Get(); !ok || pkg.ImportPath != mainPkg {
+				return
+			}
+		}
+
+		pass := &resourceparser.Pass{
+			Context:      p.c,
+			SchemaParser: p.schemaParser,
+			Pkg:          pkg,
+		}
+
+		interested := p.registry.InterestedParsers(pkg)
+		for _, p := range interested {
+			p.Run(pass)
+		}
+
+		mu.Lock()
+		pkgs = append(pkgs, pkg)
+		resources = append(resources, pass.Resources()...)
+		binds = append(binds, pass.Binds()...)
+		mu.Unlock()
+	})
+
+	// Normally every resource is independent, but in the case of implicit sqldb
+	// databases that come up as a result of having a "migrations" folder
+	// we can end up with duplicate resources if we also have a sqldb.NewDatabase call.
+	// Deduplicate them for now.
+	resources, binds = deduplicateSQLDBResources(resources, binds)
+
+	// Sort resources by package and position so the array is stable between runs
+	// as we process modules in parallel we can't rely on the order of the
+	// resources being stable coming into this function.
+	slices.SortFunc(resources, func(a, b resource.Resource) int {
+		p1, p2 := p.c.FS.Position(a.Pos()), p.c.FS.Position(b.Pos())
+		if n := cmp.Compare(p1.Filename, p2.Filename); n != 0 {
+			return n
+		} else if n := cmp.Compare(p1.Line, p2.Line); n != 0 {
+			return n
+		} else if n := cmp.Compare(p1.Column, p2.Column); n != 0 {
+			return n
+		}
+		return cmp.Compare(a.Pos(), b.Pos())
+	})
+
+	// Then sort the binds
+	slices.SortFunc(binds, func(a, b resource.Bind) int {
+		if a.Package() != b.Package() {
+			return cmp.Compare(a.Package().FSPath, b.Package().FSPath)
+		}
+
+		return cmp.Compare(a.Pos(), b.Pos())
+	})
+
+	// Finally, sort the packages
+	slices.SortFunc(pkgs, func(a, b *pkginfo.Package) int {
+		return cmp.Compare(a.FSPath, b.FSPath)
+	})
+
+	// Because we've ordered pkgs and binds, usageExprs will be stable
+	usageExprs := usage.ParseExprs(p.schemaParser, pkgs, binds)
+
+	// Add the implicit sqldb usages.
+	usageExprs = append(usageExprs, sqldb.ComputeImplicitUsage(p.c.Errs, pkgs, binds)...)
+
+	return computeResult(p.c.Errs, p.MainModule(), p.usageResolver, pkgs, resources, binds, usageExprs)
+}
+
+// allParsers are all the resource parsers we support.
+var allParsers = []*resourceparser.Parser{
+	apis.Parser,
+	caches.ClusterParser,
+	caches.KeyspaceParser,
+	config.LoadParser,
+	crons.JobParser,
+	metrics.MetricParser,
+	pubsub.TopicParser,
+	pubsub.SubscriptionParser,
+	secrets.SecretsParser,
+	sqldb.DatabaseParser,
+	sqldb.MigrationParser,
+	sqldb.NamedParser,
+	objects.BucketParser,
+}
+
+func newUsageResolver() *usage.Resolver {
+	r := usage.NewResolver()
+	// Infrastructure SDK
+	usage.RegisterUsageResolver[*caches.Keyspace](r, caches.ResolveKeyspaceUsage)
+	usage.RegisterUsageResolver[*config.Load](r, config.ResolveConfigUsage)
+	usage.RegisterUsageResolver[*pubsub.Topic](r, pubsub.ResolveTopicUsage)
+	usage.RegisterUsageResolver[*sqldb.Database](r, sqldb.ResolveDatabaseUsage)
+	usage.RegisterUsageResolver[*objects.Bucket](r, objects.ResolveBucketUsage)
+
+	// API Framework
+	usage.RegisterUsageResolver[*api.Endpoint](r, api.ResolveEndpointUsage)
+	usage.RegisterUsageResolver[*authhandler.AuthHandler](r, authhandler.ResolveAuthHandlerUsage)
+	usage.RegisterUsageResolver[*servicestruct.ServiceStruct](r, servicestruct.ResolveServiceStructUsage)
+	return r
+}
+
+// deduplicateSQLDBResources deduplicates SQL Database resources and their associated binds
+// in the case where we have multiple SQL Database resources with the same name,
+// as a result of having an explicit bind (via sqldb.NewDatabase) and an implicit bind (via a "migrations" folder).
+func deduplicateSQLDBResources(resources []resource.Resource, binds []resource.Bind) ([]resource.Resource, []resource.Bind) {
+	bindsPerDB := make(map[string][]resource.Bind)
+	bindsPerMigrationDir := make(map[paths.MainModuleRelSlash][]resource.Bind)
+	for _, b := range binds {
+		// All the binds we're interested in contain a resource and not a path.
+		r := b.ResourceRef().Resource
+		if db, ok := r.(*sqldb.Database); ok {
+			bindsPerDB[db.Name] = append(bindsPerDB[db.Name], b)
+			bindsPerMigrationDir[db.MigrationDir] = append(bindsPerMigrationDir[db.MigrationDir], b)
+		}
+	}
+
+	resourcesToRemove := make(map[resource.Resource]bool)
+	bindsToRemove := make(map[resource.Bind]bool)
+	for _, binds := range bindsPerDB {
+		implicitIdx := slices.IndexFunc(binds, func(b resource.Bind) bool {
+			_, ok := b.(*resource.ImplicitBind)
+			return ok
+		})
+		explicitIdx := slices.IndexFunc(binds, func(b resource.Bind) bool {
+			_, ok := b.(*resource.ImplicitBind)
+			return !ok
+		})
+
+		if implicitIdx >= 0 && explicitIdx >= 0 {
+			// We have both types of binds. Delete the implicit one.
+			implicit := binds[implicitIdx]
+			bindsToRemove[implicit] = true
+
+			// If they refer to different underlying resources, delete the implicit resource.
+			explicit := binds[explicitIdx]
+			if res := implicit.ResourceRef().Resource; res != nil && res != explicit.ResourceRef().Resource {
+				resourcesToRemove[res] = true
+			}
+		}
+	}
+
+	// Now do the same based on migration dir
+	for _, binds := range bindsPerMigrationDir {
+		implicitIdx := slices.IndexFunc(binds, func(b resource.Bind) bool {
+			_, ok := b.(*resource.ImplicitBind)
+			return ok
+		})
+		explicitIdx := slices.IndexFunc(binds, func(b resource.Bind) bool {
+			_, ok := b.(*resource.ImplicitBind)
+			return !ok
+		})
+
+		if implicitIdx >= 0 && explicitIdx >= 0 {
+			// We have both types of binds. Delete the implicit one.
+			implicit := binds[implicitIdx]
+			bindsToRemove[implicit] = true
+
+			// If they refer to different underlying resources, delete the implicit resource.
+			explicit := binds[explicitIdx]
+			if res := implicit.ResourceRef().Resource; res != nil && res != explicit.ResourceRef().Resource {
+				resourcesToRemove[res] = true
+			}
+		}
+	}
+
+	if len(resourcesToRemove) == 0 && len(bindsToRemove) == 0 {
+		// Nothing to do.
+		return resources, binds
+	}
+
+	updatedResources := make([]resource.Resource, 0, len(resources))
+	updatedBinds := make([]resource.Bind, 0, len(binds))
+
+	for _, r := range resources {
+		if !resourcesToRemove[r] {
+			updatedResources = append(updatedResources, r)
+		}
+	}
+	for _, b := range binds {
+		if !bindsToRemove[b] {
+			updatedBinds = append(updatedBinds, b)
+		}
+	}
+
+	return updatedResources, updatedBinds
+}
diff --git a/v2/parser/parser_test.go b/v2/parser/parser_test.go
new file mode 100644
index 0000000000..6b90f0b73f
--- /dev/null
+++ b/v2/parser/parser_test.go
@@ -0,0 +1,89 @@
+package parser
+
+import (
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser/infra/sqldb"
+	"encr.dev/v2/parser/resource"
+)
+
+func Test_deduplicateSQLDBResources(t *testing.T) {
+	fooDB := &sqldb.Database{Name: "foo", MigrationDir: "./foo/migrations"}
+	barDB := &sqldb.Database{Name: "bar", MigrationDir: "./bar/migrations"}
+	quxDB := &sqldb.Database{Name: "qux", MigrationDir: "./bar/migrations"} // same migrations as bar
+
+	fooImplicitBind := &resource.ImplicitBind{Resource: resource.ResourceOrPath{Resource: fooDB}}
+	fooExplicitBind := &resource.PkgDeclBind{Resource: resource.ResourceOrPath{Resource: fooDB}}
+	barImplicitBind := &resource.ImplicitBind{Resource: resource.ResourceOrPath{Resource: barDB}}
+	quxExplicitBind := &resource.PkgDeclBind{Resource: resource.ResourceOrPath{Resource: quxDB}}
+
+	foo2DB := &sqldb.Database{Name: "foo"}
+	foo2ImplicitBind := &resource.ImplicitBind{Resource: resource.ResourceOrPath{Resource: foo2DB}}
+
+	tests := []struct {
+		name      string
+		res       []resource.Resource
+		binds     []resource.Bind
+		wantRes   []resource.Resource
+		wantBinds []resource.Bind
+	}{
+		{
+			name:      "implicit_only",
+			res:       []resource.Resource{fooDB},
+			binds:     []resource.Bind{fooImplicitBind},
+			wantRes:   []resource.Resource{fooDB},
+			wantBinds: []resource.Bind{fooImplicitBind},
+		},
+		{
+			name:    "resource_only",
+			res:     []resource.Resource{fooDB},
+			wantRes: []resource.Resource{fooDB},
+		},
+		{
+			name:      "explicit_only",
+			res:       []resource.Resource{fooDB},
+			binds:     []resource.Bind{fooExplicitBind},
+			wantRes:   []resource.Resource{fooDB},
+			wantBinds: []resource.Bind{fooExplicitBind},
+		},
+		{
+			name:      "deduplicate_simple",
+			res:       []resource.Resource{fooDB},
+			binds:     []resource.Bind{fooExplicitBind, fooImplicitBind},
+			wantRes:   []resource.Resource{fooDB},
+			wantBinds: []resource.Bind{fooExplicitBind},
+		},
+		{
+			name:      "deduplicate_keep_other_db",
+			res:       []resource.Resource{fooDB, barDB},
+			binds:     []resource.Bind{fooExplicitBind, barImplicitBind, fooImplicitBind},
+			wantRes:   []resource.Resource{fooDB, barDB},
+			wantBinds: []resource.Bind{fooExplicitBind, barImplicitBind},
+		},
+		{
+			name:      "deduplicate_multiple_identical_resources",
+			res:       []resource.Resource{fooDB, foo2DB},
+			binds:     []resource.Bind{fooExplicitBind, foo2ImplicitBind},
+			wantRes:   []resource.Resource{fooDB},
+			wantBinds: []resource.Bind{fooExplicitBind},
+		},
+		{
+			name:      "deduplicate_different_db",
+			res:       []resource.Resource{barDB, quxDB},
+			binds:     []resource.Bind{barImplicitBind, quxExplicitBind},
+			wantRes:   []resource.Resource{quxDB},
+			wantBinds: []resource.Bind{quxExplicitBind},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			c := qt.New(t)
+			gotRes, gotBinds := deduplicateSQLDBResources(tt.res, tt.binds)
+			c.Assert(gotRes, testutil.ResourceDeepEquals, tt.wantRes)
+			c.Assert(gotBinds, testutil.ResourceDeepEquals, tt.wantBinds)
+		})
+	}
+}
diff --git a/v2/parser/resource/bind.go b/v2/parser/resource/bind.go
new file mode 100644
index 0000000000..8f950a6f7e
--- /dev/null
+++ b/v2/parser/resource/bind.go
@@ -0,0 +1,88 @@
+package resource
+
+import (
+	"go/ast"
+	"go/token"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+type Bind interface {
+	Pos() token.Pos
+	ResourceRef() ResourceOrPath
+	Package() *pkginfo.Package
+	DeclaredIn() option.Option[*pkginfo.File]
+
+	// DescriptionForTest describes the bind for testing purposes.
+	DescriptionForTest() string
+}
+
+// A PkgDeclBind is a bind consisting of a package declaration.
+type PkgDeclBind struct {
+	Resource ResourceOrPath
+	File     *pkginfo.File
+
+	// BoundName is the package-level identifier the bind is declared with.
+	BoundName *ast.Ident
+}
+
+func (b *PkgDeclBind) Pos() token.Pos              { return b.BoundName.Pos() }
+func (b *PkgDeclBind) ResourceRef() ResourceOrPath { return b.Resource }
+func (b *PkgDeclBind) Package() *pkginfo.Package   { return b.File.Pkg }
+func (b *PkgDeclBind) DescriptionForTest() string  { return b.QualifiedName().NaiveDisplayName() }
+func (b *PkgDeclBind) DeclaredIn() option.Option[*pkginfo.File] {
+	return option.Some(b.File)
+}
+
+// QualifiedName returns the qualified name of the resource.
+func (b *PkgDeclBind) QualifiedName() pkginfo.QualifiedName {
+	return pkginfo.QualifiedName{
+		PkgPath: b.File.Pkg.ImportPath,
+		Name:    b.BoundName.Name,
+	}
+}
+
+// An AnonymousBind is similar to PkgDeclBind in that it's a package declaration,
+// but unlike PkgDeclBind it's bound to an "_" identifier so that it has no name.
+type AnonymousBind struct {
+	Resource ResourceOrPath
+	File     *pkginfo.File
+}
+
+func (b *AnonymousBind) Pos() token.Pos              { return b.File.Pkg.AST.Pos() }
+func (b *AnonymousBind) ResourceRef() ResourceOrPath { return b.Resource }
+func (b *AnonymousBind) Package() *pkginfo.Package   { return b.File.Pkg }
+func (b *AnonymousBind) DescriptionForTest() string  { return "anonymous" }
+func (b *AnonymousBind) DeclaredIn() option.Option[*pkginfo.File] {
+	return option.Some(b.File)
+}
+
+// An ImplicitBind is a bind that implicitly binds to a package and its subpackages.
+type ImplicitBind struct {
+	Resource ResourceOrPath
+	Pkg      *pkginfo.Package
+}
+
+func (b *ImplicitBind) Pos() token.Pos              { return b.Pkg.AST.Pos() }
+func (b *ImplicitBind) ResourceRef() ResourceOrPath { return b.Resource }
+func (b *ImplicitBind) Package() *pkginfo.Package   { return b.Pkg }
+func (b *ImplicitBind) DescriptionForTest() string  { return "implicit" }
+func (b *ImplicitBind) DeclaredIn() option.Option[*pkginfo.File] {
+	return option.None[*pkginfo.File]()
+}
+
+// ResourceOrPath is a reference to a particular resource,
+// either referencing the resource object directly
+// or through a path.
+type ResourceOrPath struct {
+	Resource Resource
+	Path     Path
+}
+
+type Path []PathEntry
+
+type PathEntry struct {
+	Kind Kind
+	Name string
+}
diff --git a/v2/parser/resource/resource.go b/v2/parser/resource/resource.go
new file mode 100644
index 0000000000..4dc281211a
--- /dev/null
+++ b/v2/parser/resource/resource.go
@@ -0,0 +1,53 @@
+package resource
+
+import (
+	"go/ast"
+)
+
+//go:generate stringer -type=Kind -output=resource_string.go
+
+type Kind int
+
+const (
+	Unknown Kind = iota
+
+	// Infrastructure SDK Resources
+	PubSubTopic
+	PubSubSubscription
+	SQLDatabase
+	Metric
+	CronJob
+	CacheCluster
+	CacheKeyspace
+	ConfigLoad
+	Secrets
+	Bucket
+
+	// API Framework Resources
+	APIEndpoint
+	AuthHandler
+	Middleware
+	ServiceStruct
+)
+
+type Resource interface {
+	// Node is embedded so we can use the resource in a [posmap.Map].
+	// The position should be the position of the resource declaration.
+	ast.Node
+
+	// Kind is the kind of resource this is.
+	Kind() Kind
+
+	// SortKey is a string that can be used to sort resources.
+	// The sort key's value is arbitrary but should provide a
+	// consistent sort order regardless of the parsing order.
+	// The sort key only matters between resources of the same Kind.
+	SortKey() string
+}
+
+type Named interface {
+	Resource
+
+	// ResourceName is the name of the resource.
+	ResourceName() string
+}
diff --git a/v2/parser/resource/resource_string.go b/v2/parser/resource/resource_string.go
new file mode 100644
index 0000000000..bd1eaac365
--- /dev/null
+++ b/v2/parser/resource/resource_string.go
@@ -0,0 +1,37 @@
+// Code generated by "stringer -type=Kind -output=resource_string.go"; DO NOT EDIT.
+
+package resource
+
+import "strconv"
+
+func _() {
+	// An "invalid array index" compiler error signifies that the constant values have changed.
+	// Re-run the stringer command to generate them again.
+	var x [1]struct{}
+	_ = x[Unknown-0]
+	_ = x[PubSubTopic-1]
+	_ = x[PubSubSubscription-2]
+	_ = x[SQLDatabase-3]
+	_ = x[Metric-4]
+	_ = x[CronJob-5]
+	_ = x[CacheCluster-6]
+	_ = x[CacheKeyspace-7]
+	_ = x[ConfigLoad-8]
+	_ = x[Secrets-9]
+	_ = x[Bucket-10]
+	_ = x[APIEndpoint-11]
+	_ = x[AuthHandler-12]
+	_ = x[Middleware-13]
+	_ = x[ServiceStruct-14]
+}
+
+const _Kind_name = "UnknownPubSubTopicPubSubSubscriptionSQLDatabaseMetricCronJobCacheClusterCacheKeyspaceConfigLoadSecretsBucketAPIEndpointAuthHandlerMiddlewareServiceStruct"
+
+var _Kind_index = [...]uint8{0, 7, 18, 36, 47, 53, 60, 72, 85, 95, 102, 108, 119, 130, 140, 153}
+
+func (i Kind) String() string {
+	if i < 0 || i >= Kind(len(_Kind_index)-1) {
+		return "Kind(" + strconv.FormatInt(int64(i), 10) + ")"
+	}
+	return _Kind_name[_Kind_index[i]:_Kind_index[i+1]]
+}
diff --git a/v2/parser/resource/resourceparser/registry.go b/v2/parser/resource/resourceparser/registry.go
new file mode 100644
index 0000000000..3e09ce1dfe
--- /dev/null
+++ b/v2/parser/resource/resourceparser/registry.go
@@ -0,0 +1,88 @@
+package resourceparser
+
+import (
+	"os"
+	"slices"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+)
+
+func NewRegistry(parsers []*Parser) *Registry {
+	forImports, always := parsersForImports(parsers)
+	subdirs := fns.Filter(parsers, func(p *Parser) bool { return len(p.InterestingSubdirs) > 0 })
+	return &Registry{
+		parsers:              parsers,
+		alwaysInterested:     always,
+		interestedForImports: forImports,
+		subdirsInterested:    subdirs,
+	}
+}
+
+type Registry struct {
+	parsers []*Parser
+
+	// alwaysInterested are the parses that should be run against all packages.
+	alwaysInterested []*Parser
+
+	// interestedForImports maps from import paths to the list of parsers
+	// interested in packages that import that package.
+	interestedForImports map[paths.Pkg][]*Parser
+
+	// subdirsInterested are the parses that are interested in
+	// specific subdirs.
+	subdirsInterested []*Parser
+}
+
+// InterestedParsers returns the parsers interested in processing a given package.
+func (r *Registry) InterestedParsers(pkg *pkginfo.Package) []*Parser {
+	parsers := slices.Clone(r.alwaysInterested)
+
+	addParser := func(p *Parser) {
+		if !slices.Contains(parsers, p) {
+			parsers = append(parsers, p)
+		}
+	}
+
+	// Find the interested parsers based on imports.
+	for imp := range pkg.Imports {
+		// Add the parsers that are interested in this package as long
+		// as they're not already in the list.
+		// Note: this is O(n^2) but n is small, so this should be faster than maintaining a set.
+		for _, p := range r.interestedForImports[imp] {
+			addParser(p)
+		}
+	}
+
+	// Find the interested parsers based on subdirs.
+ParserLoop:
+	for _, p := range r.subdirsInterested {
+		for _, dir := range p.InterestingSubdirs {
+			if stat, err := os.Stat(pkg.FSPath.Join(dir).ToIO()); err == nil && stat.IsDir() {
+				addParser(p)
+				continue ParserLoop
+			}
+		}
+	}
+
+	return parsers
+}
+
+// parsersForImports returns a map from package paths to the list of parsers
+// interested in that package.
+func parsersForImports(parsers []*Parser) (forImports map[paths.Pkg][]*Parser, always []*Parser) {
+	forImports = make(map[paths.Pkg][]*Parser)
+
+ParserLoop:
+	for _, parser := range parsers {
+		for _, imp := range parser.InterestingImports {
+			if imp == "*" {
+				always = append(always, parser)
+				continue ParserLoop
+			}
+			forImports[imp] = append(forImports[imp], parser)
+		}
+	}
+	return forImports, always
+}
diff --git a/v2/parser/resource/resourceparser/resourceparser.go b/v2/parser/resource/resourceparser/resourceparser.go
new file mode 100644
index 0000000000..845ca63584
--- /dev/null
+++ b/v2/parser/resource/resourceparser/resourceparser.go
@@ -0,0 +1,105 @@
+package resourceparser
+
+import (
+	"go/ast"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/parser/resource"
+)
+
+type Parser struct {
+	Name string
+
+	// InterestingImports are the imports paths that the parser is interested in.
+	// If a package imports any one of them, the Run method is invoked.
+	InterestingImports []paths.Pkg
+
+	// InterestingSubdirs are the subdirectories of a package that a parser is interested in.
+	// If a package has any one of these subdirectories, the Run method is invoked.
+	// Its purpose is to support our current way of defining databases via a "migrations" dir.
+	InterestingSubdirs []string
+
+	Run func(*Pass)
+}
+
+// RunAlways is a value for InterestingImports to indicate to always run the parser.
+var RunAlways = []paths.Pkg{"*"}
+
+type Pass struct {
+	*parsectx.Context
+	SchemaParser *schema.Parser
+
+	Pkg *pkginfo.Package
+
+	resources []resource.Resource
+	binds     []resource.Bind
+}
+
+func (p *Pass) RegisterResource(resource resource.Resource) {
+	p.resources = append(p.resources, resource)
+}
+
+func (p *Pass) Resources() []resource.Resource {
+	return p.resources
+}
+
+func (p *Pass) Binds() []resource.Bind {
+	return p.binds
+}
+
+func (p *Pass) AddBind(file *pkginfo.File, boundName option.Option[*ast.Ident], res resource.Resource) {
+	if id, ok := boundName.Get(); ok {
+		p.AddNamedBind(file, id, res)
+	} else {
+		p.AddAnonymousBind(file, res)
+	}
+}
+
+func (p *Pass) AddNamedBind(file *pkginfo.File, boundName *ast.Ident, res resource.Resource) {
+	if boundName.Name == "_" {
+		p.AddAnonymousBind(file, res)
+	} else {
+		p.binds = append(p.binds, &resource.PkgDeclBind{
+			Resource:  resource.ResourceOrPath{Resource: res},
+			File:      file,
+			BoundName: boundName,
+		})
+	}
+}
+
+func (p *Pass) AddAnonymousBind(file *pkginfo.File, res resource.Resource) {
+	p.binds = append(p.binds, &resource.AnonymousBind{
+		Resource: resource.ResourceOrPath{Resource: res},
+		File:     file,
+	})
+}
+
+func (p *Pass) AddPathBind(file *pkginfo.File, boundName option.Option[*ast.Ident], path resource.Path) {
+	if len(path) == 0 {
+		panic("AddPathBind: empty path")
+	}
+
+	if id, ok := boundName.Get(); !ok || id.Name == "_" {
+		p.binds = append(p.binds, &resource.AnonymousBind{
+			Resource: resource.ResourceOrPath{Path: path},
+			File:     file,
+		})
+	} else {
+		p.binds = append(p.binds, &resource.PkgDeclBind{
+			Resource:  resource.ResourceOrPath{Path: path},
+			File:      file,
+			BoundName: id,
+		})
+	}
+}
+
+func (p *Pass) AddImplicitBind(res resource.Resource) {
+	p.binds = append(p.binds, &resource.ImplicitBind{
+		Resource: resource.ResourceOrPath{Resource: res},
+		Pkg:      p.Pkg,
+	})
+}
diff --git a/v2/parser/resource/resourcetest/resourcetest.go b/v2/parser/resource/resourcetest/resourcetest.go
new file mode 100644
index 0000000000..5a58f2195e
--- /dev/null
+++ b/v2/parser/resource/resourcetest/resourcetest.go
@@ -0,0 +1,125 @@
+package resourcetest
+
+import (
+	"go/ast"
+	"go/token"
+	"os"
+	"strconv"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/resourceparser"
+)
+
+type Case[R resource.Resource] struct {
+	Name     string
+	Imports  []string
+	Code     string
+	Want     R
+	WantErrs []string
+}
+
+func Run[R resource.Resource](t *testing.T, parser *resourceparser.Parser, tests []Case[R], cmpOpts ...cmp.Option) {
+	// testArchive renders the txtar archive to use for a given test.
+	testArchive := func(test Case[R]) *txtar.Archive {
+		importList := []string{"context"}
+		for _, imp := range parser.InterestingImports {
+			importList = append(importList, imp.String())
+		}
+		importList = append(importList, test.Imports...)
+
+		imports := ""
+		if len(importList) > 0 {
+			imports = "import (\n"
+			for _, imp := range importList {
+				imports += "\t" + strconv.Quote(imp) + "\n"
+			}
+			imports += ")\n"
+		}
+
+		return testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+require encore.dev v1.13.4
+-- code.go --
+package foo
+` + imports + `
+
+` + test.Code + `
+`)
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+			c := qt.New(t)
+			a := testArchive(test)
+			tc := testutil.NewContext(c, false, a)
+			tc.GoModDownload()
+
+			l := pkginfo.New(tc.Context)
+			schemaParser := schema.NewParser(tc.Context, l)
+
+			if len(test.WantErrs) > 0 {
+				defer tc.DeferExpectError(test.WantErrs...)
+			} else {
+				tc.FailTestOnErrors()
+				defer tc.FailTestOnBailout()
+			}
+
+			pkg := l.MustLoadPkg(token.NoPos, "example.com")
+			pass := &resourceparser.Pass{
+				Context:      tc.Context,
+				SchemaParser: schemaParser,
+				Pkg:          pkg,
+			}
+			parser.Run(pass)
+			got := pass.Resources()
+
+			if len(test.WantErrs) == 0 {
+				c.Assert(got, qt.HasLen, 1)
+
+				lookupMap := map[string]string{
+					"APPROOT": tc.MainModuleDir.ToIO(),
+				}
+
+				// Check for equality, ignoring all the AST nodes and pkginfo types.
+				opts := append([]cmp.Option{
+					cmpopts.IgnoreInterfaces(struct{ ast.Expr }{}),
+					cmpopts.IgnoreTypes(&schema.FuncDecl{}, &schema.TypeDecl{}, &pkginfo.File{}, &pkginfo.Package{}, token.Pos(0)),
+					cmpopts.EquateEmpty(),
+					cmpopts.IgnoreUnexported(schema.StructField{}, schema.NamedType{}),
+					cmp.AllowUnexported(option.Option[*pkginfo.File]{}),
+					cmp.Comparer(func(a, b *pkginfo.Package) bool {
+						return a.ImportPath == b.ImportPath
+					}),
+
+					cmp.Comparer(func(a, b paths.FS) bool {
+						return rewrite(a, lookupMap) == rewrite(b, lookupMap)
+					}),
+					cmp.Comparer(func(a, b *pkginfo.PkgDeclInfo) bool {
+						// HACK(andre) We only check the subset of information that
+						// the test helpers actually set. We should be more careful.
+						return a.Name == b.Name
+					}),
+				}, cmpOpts...)
+				c.Assert(got[0], qt.CmpEquals(opts...), test.Want)
+			}
+		})
+	}
+}
+
+func rewrite[T ~string](val T, lookup map[string]string) T {
+	return T(os.Expand(string(val), func(key string) string {
+		return lookup[key]
+	}))
+}
diff --git a/v2/parser/resource/usage/resolver.go b/v2/parser/resource/usage/resolver.go
new file mode 100644
index 0000000000..8a14c523a5
--- /dev/null
+++ b/v2/parser/resource/usage/resolver.go
@@ -0,0 +1,69 @@
+package usage
+
+import (
+	"go/ast"
+	"go/token"
+
+	"encr.dev/pkg/option"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser/resource"
+)
+
+// Usage describes an infrastructure usage being used.
+type Usage interface {
+	ast.Node
+
+	usage() // marker method
+	ResourceBind() resource.Bind
+	ASTExpr() ast.Expr
+	DeclaredIn() *pkginfo.File
+}
+
+type Base struct {
+	File *pkginfo.File
+	Bind resource.Bind
+	Expr Expr
+}
+
+func (b *Base) DeclaredIn() *pkginfo.File   { return b.File }
+func (b *Base) ASTExpr() ast.Expr           { return b.Expr.ASTExpr() }
+func (b *Base) ResourceBind() resource.Bind { return b.Bind }
+func (b *Base) Pos() token.Pos              { return b.Expr.Pos() }
+func (b *Base) End() token.Pos              { return b.Expr.End() }
+
+func (b *Base) usage() {}
+
+type Resolver struct {
+	resolvers map[resource.Kind]func(ResolveData, resource.Resource) Usage
+}
+
+func (r *Resolver) Resolve(errs *perr.List, expr Expr, res resource.Resource) option.Option[Usage] {
+	fn, ok := r.resolvers[res.Kind()]
+	if !ok {
+		return option.None[Usage]()
+	}
+	data := ResolveData{
+		Errs: errs,
+		Expr: expr,
+	}
+	return option.AsOptional(fn(data, res))
+}
+
+func NewResolver() *Resolver {
+	return &Resolver{
+		resolvers: make(map[resource.Kind]func(ResolveData, resource.Resource) Usage),
+	}
+}
+
+func RegisterUsageResolver[Res resource.Resource](r *Resolver, fn func(ResolveData, Res) Usage) {
+	var zero Res
+
+	if r.resolvers[zero.Kind()] != nil {
+		panic("usage resolver already registered for type " + zero.Kind().String())
+	}
+
+	r.resolvers[zero.Kind()] = func(data ResolveData, res resource.Resource) Usage {
+		return fn(data, res.(Res))
+	}
+}
diff --git a/v2/parser/resource/usage/testdata/pubsub_usage.txt b/v2/parser/resource/usage/testdata/pubsub_usage.txt
new file mode 100644
index 0000000000..2e28ca09e6
--- /dev/null
+++ b/v2/parser/resource/usage/testdata/pubsub_usage.txt
@@ -0,0 +1,29 @@
+-- svc/svc.go --
+package svc
+
+import "encore.dev/pubsub"
+
+type Message struct{}
+
+var Topic = pubsub.NewTopic[*Message]("foo", pubsub.TopicConfig{
+    DeliveryGuarantee: pubsub.AtLeastOnce,
+})
+
+var Sub = pubsub.NewSubscription(Topic, "bar", // use svc.Topic fn pubsub.NewSubscription arg 0
+    pubsub.SubscriptionConfig{
+        Handler: func(m *Message) error {
+            return nil
+        },
+    },
+)
+
+func init() {
+    Topic.Foo() // use svc.Topic call Foo
+}
+
+-- usage/usage.go --
+package usage
+import "example.com/svc"
+
+var x = svc.Topic.Publish(svc.Message{}) // use svc.Topic call Publish
+var y = Topic.Publish(svc.Message{})
diff --git a/v2/parser/resource/usage/testdata/secret_usage.txt b/v2/parser/resource/usage/testdata/secret_usage.txt
new file mode 100644
index 0000000000..ee5a0a0f0d
--- /dev/null
+++ b/v2/parser/resource/usage/testdata/secret_usage.txt
@@ -0,0 +1,11 @@
+-- svc/svc.go --
+package svc
+
+var secrets struct {
+    Foo string
+}
+
+func init() {
+    secrets.Foo // use svc.secrets field Foo
+    x := secrets // use svc.secrets other
+}
diff --git a/v2/parser/resource/usage/testdata/sqldb_usage.txt b/v2/parser/resource/usage/testdata/sqldb_usage.txt
new file mode 100644
index 0000000000..5d75e37d07
--- /dev/null
+++ b/v2/parser/resource/usage/testdata/sqldb_usage.txt
@@ -0,0 +1,27 @@
+-- svc/migrations/1_foo.up.sql --
+-- svc/svc.go --
+package svc
+
+import "context"
+import "encore.dev/storage/sqldb"
+
+var DB = sqldb.Named("svc")
+
+func init() {
+    DB.Foo() // use svc.DB call Foo
+    DB.Foo // use svc.DB field Foo
+    DB // use svc.DB other
+
+    1 + DB // use svc.DB other
+    x = DB // use svc.DB other
+}
+
+//encore:api public
+func Dummy(context.Context) error { return nil }
+
+-- usage/usage.go --
+package usage
+import "example.com/svc"
+
+var x = svc.DB.QueryRow() // use svc.DB call QueryRow
+var y = DB.Publish(svc.Message{})
diff --git a/v2/parser/resource/usage/usage.go b/v2/parser/resource/usage/usage.go
new file mode 100644
index 0000000000..70a8e94b97
--- /dev/null
+++ b/v2/parser/resource/usage/usage.go
@@ -0,0 +1,352 @@
+package usage
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"slices"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/schema"
+	"encr.dev/v2/parser/resource"
+)
+
+// ResolveData is the data being passed to usage resolver functions.
+type ResolveData struct {
+	Errs *perr.List
+	Expr Expr
+}
+
+type Expr interface {
+	// Node allows use to use the expression in error messages
+	// where the Pos/End is used to point directly at the resource
+	// bind being used, rather than the overall expression.
+	ast.Node
+
+	ResourceBind() resource.Bind
+	ASTExpr() ast.Expr
+	DeclaredIn() *pkginfo.File
+
+	// DescriptionForTest describes the expression for testing purposes.
+	DescriptionForTest() string
+}
+
+// FuncCall describes a resource being called as a function.
+type FuncCall struct {
+	File *pkginfo.File
+	Bind resource.Bind
+	Call *ast.CallExpr
+	Args []ast.Expr
+}
+
+func (f *FuncCall) DeclaredIn() *pkginfo.File   { return f.File }
+func (f *FuncCall) ASTExpr() ast.Expr           { return f.Call }
+func (f *FuncCall) ResourceBind() resource.Bind { return f.Bind }
+func (f *FuncCall) DescriptionForTest() string  { return "called" }
+func (f *FuncCall) Pos() token.Pos              { return f.Call.Fun.Pos() }
+func (f *FuncCall) End() token.Pos              { return f.Call.Fun.End() }
+
+// MethodCall describes a resource usage via a method call.
+type MethodCall struct {
+	File   *pkginfo.File
+	Bind   resource.Bind
+	Call   *ast.CallExpr
+	Method string
+	Args   []ast.Expr
+}
+
+func (m *MethodCall) DeclaredIn() *pkginfo.File   { return m.File }
+func (m *MethodCall) ASTExpr() ast.Expr           { return m.Call }
+func (m *MethodCall) ResourceBind() resource.Bind { return m.Bind }
+func (m *MethodCall) DescriptionForTest() string  { return fmt.Sprintf("call %s", m.Method) }
+func (m *MethodCall) Pos() token.Pos              { return m.Call.Fun.Pos() }
+func (m *MethodCall) End() token.Pos              { return m.Call.Fun.End() }
+
+// FieldAccess describes a resource usage via a field access.
+type FieldAccess struct {
+	File  *pkginfo.File
+	Bind  resource.Bind
+	Expr  *ast.SelectorExpr
+	Field string
+}
+
+func (f *FieldAccess) DeclaredIn() *pkginfo.File   { return f.File }
+func (f *FieldAccess) ASTExpr() ast.Expr           { return f.Expr }
+func (f *FieldAccess) ResourceBind() resource.Bind { return f.Bind }
+func (f *FieldAccess) DescriptionForTest() string  { return fmt.Sprintf("field %s", f.Field) }
+func (f *FieldAccess) Pos() token.Pos              { return f.Expr.Pos() }
+func (f *FieldAccess) End() token.Pos              { return f.Expr.End() }
+
+// FuncArg describes a resource being used as a function argument.
+type FuncArg struct {
+	File *pkginfo.File
+	Bind resource.Bind
+	Call *ast.CallExpr
+
+	// TypeArgs are the type arguments to the function being called, if any.
+	TypeArgs []schema.Type
+
+	// ArgIdx is the function argument index that represents
+	// the resource bind, starting at 0.
+	ArgIdx int
+
+	// PkgFunc is the package-level function that's being called.
+	// It's None if the function is not a package-level function.
+	PkgFunc option.Option[pkginfo.QualifiedName]
+}
+
+func (f *FuncArg) DeclaredIn() *pkginfo.File   { return f.File }
+func (f *FuncArg) ASTExpr() ast.Expr           { return f.Call }
+func (f *FuncArg) ResourceBind() resource.Bind { return f.Bind }
+func (f *FuncArg) DescriptionForTest() string {
+	if fn, ok := f.PkgFunc.Get(); ok {
+		return fmt.Sprintf("fn %s arg %d", fn.NaiveDisplayName(), f.ArgIdx)
+	}
+	return fmt.Sprintf("arg %d", f.ArgIdx)
+}
+func (f *FuncArg) Pos() token.Pos { return f.Call.Args[f.ArgIdx].Pos() }
+func (f *FuncArg) End() token.Pos { return f.Call.Args[f.ArgIdx].End() }
+
+// Other describes any other resource usage.
+type Other struct {
+	File    *pkginfo.File
+	Bind    resource.Bind
+	Expr    ast.Expr
+	BindRef ast.Expr
+}
+
+func (o *Other) DeclaredIn() *pkginfo.File   { return o.File }
+func (o *Other) ASTExpr() ast.Expr           { return o.Expr }
+func (o *Other) ResourceBind() resource.Bind { return o.Bind }
+func (o *Other) DescriptionForTest() string  { return "other" }
+func (o *Other) Pos() token.Pos              { return o.BindRef.Pos() }
+func (o *Other) End() token.Pos              { return o.BindRef.End() }
+
+func ParseExprs(schema *schema.Parser, pkgs []*pkginfo.Package, binds []resource.Bind) []Expr {
+	p := &usageParser{
+		schema:      schema,
+		bindsPerPkg: make(map[paths.Pkg][]resource.Bind, len(binds)),
+		bindNames:   make(map[pkginfo.QualifiedName]resource.Bind, len(binds)),
+	}
+	for _, b := range binds {
+		pkg := b.Package()
+		p.bindsPerPkg[pkg.ImportPath] = append(p.bindsPerPkg[pkg.ImportPath], b)
+
+		if pkgDecl, ok := b.(*resource.PkgDeclBind); ok {
+			p.bindNames[pkgDecl.QualifiedName()] = b
+		}
+	}
+
+	var usages []Expr
+	for _, pkg := range pkgs {
+		usages = append(usages, p.scanUsage(pkg)...)
+	}
+
+	return usages
+}
+
+type usageParser struct {
+	schema      *schema.Parser
+	bindsPerPkg map[paths.Pkg][]resource.Bind
+	bindNames   map[pkginfo.QualifiedName]resource.Bind
+}
+
+func (p *usageParser) scanUsage(pkg *pkginfo.Package) (usages []Expr) {
+	external, internal, files := p.bindsToScanFor(pkg)
+
+	haveExternal := len(external) > 0
+	haveInternal := len(internal) > 0
+
+	// Compute types to scan for.
+	var types []ast.Node
+	if haveExternal {
+		types = append(types, (*ast.SelectorExpr)(nil))
+	}
+	if haveInternal {
+		types = append(types, (*ast.Ident)(nil))
+	}
+
+	for _, f := range files {
+		inspector := f.ASTInspector()
+		names := f.Names()
+		inspector.WithStack(types, func(n ast.Node, push bool, stack []ast.Node) bool {
+			if !push {
+				return true
+			}
+
+			// If we're scanning for both *ast.SelectorExpr and *ast.Ident,
+			// we will first scan the *ast.SelectorExpr and then recurse and then scan the *ast.Ident.
+			// To avoid having to deal with this case, detect this case and ignore the *ast.Ident
+			// the second time around.
+			if haveExternal && haveInternal {
+				if id, ok := n.(*ast.Ident); ok {
+					if sel, ok := stack[len(stack)-2].(*ast.SelectorExpr); ok && sel.Sel == id {
+						return true
+					}
+				}
+			}
+
+			expr := n.(ast.Expr) // guaranteed since the types we scan for are all expressions
+			if qn, ok := names.ResolvePkgLevelRef(expr); ok {
+				if bind, ok := p.bindNames[qn]; ok {
+					// Make sure this is not the actual bind definition, to avoid reporting spurious usages.
+					if !p.isBind(pkg, expr, bind) {
+						if u := p.classifyExpr(f, bind, stack); u != nil {
+							usages = append(usages, u)
+						}
+					}
+				}
+			}
+			return true
+		})
+	}
+
+	return usages
+}
+
+// bindsToScanFor returns the binds to scan for in a given package,
+// and which files to scan.
+// The 'external' binds are those that are imported from other packages,
+// and 'internal' binds are those that are defined in the same package.
+func (p *usageParser) bindsToScanFor(pkg *pkginfo.Package) (external, internal []resource.Bind, files []*pkginfo.File) {
+	internal = p.bindsPerPkg[pkg.ImportPath]
+
+	if len(internal) > 0 {
+		// If we have any internal binds we need to scan all files,
+		// since we can't rely on the file-level imports to tell us
+		// which files to scan.
+		files = pkg.Files
+	}
+
+	for imp := range pkg.Imports {
+		external = append(external, p.bindsPerPkg[imp]...)
+	}
+
+	if len(external) > 0 && len(internal) == 0 {
+		// If we have external binds but no internal binds,
+		// figure out which files to parse precisely.
+	FileLoop:
+		for _, f := range pkg.Files {
+			for imp := range f.Imports {
+				if len(p.bindsPerPkg[imp]) > 0 {
+					files = append(files, f)
+					continue FileLoop
+				}
+			}
+		}
+	}
+
+	return
+}
+
+func (p *usageParser) isBind(pkg *pkginfo.Package, expr ast.Expr, bind resource.Bind) bool {
+	if pkg.ImportPath != bind.Package().ImportPath {
+		return false
+	}
+
+	// If the bind isn't a package decl it can't be this bind.
+	pkgDecl, ok := bind.(*resource.PkgDeclBind)
+	if !ok {
+		return false
+	}
+
+	switch x := expr.(type) {
+	case *ast.SelectorExpr:
+		return x.Sel == pkgDecl.BoundName
+	case *ast.Ident:
+		return x == pkgDecl.BoundName
+	}
+	return false
+}
+
+func (p *usageParser) classifyExpr(file *pkginfo.File, bind resource.Bind, stack []ast.Node) Expr {
+	idx := len(stack) - 1
+
+	if idx >= 1 {
+		if sel, ok := stack[idx-1].(*ast.SelectorExpr); ok {
+			// bind.SomeField or bind.SomeMethod()
+
+			// Check if this is a method call
+			if idx >= 2 {
+				if call, ok := stack[idx-2].(*ast.CallExpr); ok {
+					return &MethodCall{
+						File:   file,
+						Bind:   bind,
+						Call:   call,
+						Method: sel.Sel.Name,
+						Args:   call.Args,
+					}
+				}
+			}
+
+			// Otherwise it's a field access
+			return &FieldAccess{
+				File:  file,
+				Bind:  bind,
+				Expr:  sel,
+				Field: sel.Sel.Name,
+			}
+		}
+
+		// Is this bind being referenced in a function call argument?
+		if call, ok := stack[idx-1].(*ast.CallExpr); ok {
+
+			if call.Fun == stack[idx] {
+				return &FuncCall{
+					File: file,
+					Bind: bind,
+					Call: call,
+					Args: call.Args,
+				}
+			}
+
+			// Find which argument this is.
+			if argIdx := slices.Index(call.Args, stack[idx].(ast.Expr)); argIdx >= 0 {
+				pkgFunc := option.CommaOk(file.Names().ResolvePkgLevelRef(call.Fun))
+				return &FuncArg{
+					File:     file,
+					Bind:     bind,
+					Call:     call,
+					TypeArgs: p.parseTypeArgs(file, call),
+					PkgFunc:  pkgFunc,
+					ArgIdx:   argIdx,
+				}
+			}
+		}
+	}
+
+	// It's some other kind of usage. Find the largest enclosing expression.
+	enclosing := stack[idx].(ast.Expr) // guaranteed to be an expr by the caller.
+	for i := idx; i >= 0; i-- {
+		if expr, ok := stack[i].(ast.Expr); ok {
+			enclosing = expr
+		}
+	}
+
+	return &Other{
+		File:    file,
+		Bind:    bind,
+		Expr:    enclosing,
+		BindRef: stack[idx].(ast.Expr), // guaranteed to be an expr by the caller.
+	}
+}
+
+func (p *usageParser) parseTypeArgs(file *pkginfo.File, call *ast.CallExpr) []schema.Type {
+	var args []ast.Expr
+	switch fun := call.Fun.(type) {
+	case *ast.IndexExpr:
+		args = []ast.Expr{fun.Index}
+	case *ast.IndexListExpr:
+		args = fun.Indices
+	default:
+		return nil
+	}
+
+	return fns.Map(args, func(arg ast.Expr) schema.Type {
+		return p.schema.ParseType(file, arg)
+	})
+}
diff --git a/v2/parser/resource/usage/usage_test.go b/v2/parser/resource/usage/usage_test.go
new file mode 100644
index 0000000000..39d57a0189
--- /dev/null
+++ b/v2/parser/resource/usage/usage_test.go
@@ -0,0 +1,157 @@
+package usage_test
+
+import (
+	"cmp"
+	"flag"
+	goparser "go/parser"
+	gotoken "go/token"
+	"os"
+	"path/filepath"
+	"slices"
+	"strings"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	gocmp "github.com/google/go-cmp/cmp"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/resource/usage"
+)
+
+var goldenUpdate = flag.Bool("golden-update", os.Getenv("GOLDEN_UPDATE") != "", "update golden files")
+
+func TestParse(t *testing.T) {
+	flag.Parse()
+	c := qt.New(t)
+	tests := readTestCases(c, "testdata")
+	for _, test := range tests {
+		c.Run(test.name, func(c *qt.C) {
+			tc := testutil.NewContext(c, false, test.input)
+			tc.FailTestOnErrors()
+			defer tc.FailTestOnBailout()
+
+			// Create a go.mod file in the main module directory if it doesn't already exist.
+			modPath := tc.MainModuleDir.Join("go.mod").ToIO()
+			if _, err := os.Stat(modPath); err != nil {
+				if !os.IsNotExist(err) {
+					c.Fatal(err)
+				}
+				modContents := "module example.com\nrequire encore.dev v1.13.4"
+				err := os.WriteFile(modPath, []byte(modContents), 0644)
+				c.Assert(err, qt.IsNil)
+			}
+
+			tc.GoModTidy()
+			tc.GoModDownload()
+
+			p := parser.NewParser(tc.Context)
+			res := p.Parse()
+
+			got := fns.Map(res.AllUsageExprs(), func(u usage.Expr) usageDesc {
+				return usageToDesc(tc.Context, u)
+			})
+			want := test.wants
+
+			// Sort the slices to be able to compare them.
+			for _, slice := range [][]usageDesc{got, want} {
+				slices.SortFunc(slice, func(a, b usageDesc) int {
+					if n := cmp.Compare(a.Filename, b.Filename); n != 0 {
+						return n
+					} else if n := cmp.Compare(a.Line, b.Line); n != 0 {
+						return n
+					} else if n := cmp.Compare(a.Resource, b.Resource); n != 0 {
+						return n
+					}
+					return cmp.Compare(a.Operation, b.Operation)
+				})
+			}
+
+			if *goldenUpdate {
+				//updateGoldenFiles(c, test, got)
+			}
+			if diff := gocmp.Diff(got, want); diff != "" {
+				c.Fatalf("generated code differs (-got +want):\n%s", diff)
+			}
+		})
+	}
+}
+
+type testCase struct {
+	filename string
+	name     string
+	input    *txtar.Archive
+	wants    []usageDesc
+}
+
+type usageDesc struct {
+	Filename  string
+	Line      int
+	Resource  string
+	Operation string
+}
+
+func readTestCases(c *qt.C, dir string) []*testCase {
+	files, err := filepath.Glob(filepath.Join(dir, "*.txt"))
+	c.Assert(err, qt.IsNil)
+
+	var cases []*testCase
+	for _, file := range files {
+		cases = append(cases, parseTestCase(c, file))
+	}
+	return cases
+}
+
+func parseTestCase(c *qt.C, file string) *testCase {
+	ar, err := txtar.ParseFile(file)
+	c.Assert(err, qt.IsNil)
+
+	tc := &testCase{
+		filename: file,
+		name:     strings.TrimSuffix(filepath.Base(file), ".txt"),
+		input:    ar,
+	}
+
+	for _, f := range ar.Files {
+		if strings.HasSuffix(f.Name, ".go") {
+			fset := gotoken.NewFileSet()
+			astFile, err := goparser.ParseFile(fset, f.Name, f.Data, goparser.ParseComments)
+			c.Assert(err, qt.IsNil)
+
+			for _, cg := range astFile.Comments {
+				for i, comment := range cg.List {
+					if remainder, ok := strings.CutPrefix(comment.Text, "// use "); ok {
+						resource, op, _ := strings.Cut(remainder, " ")
+						tc.wants = append(tc.wants, usageDesc{
+							Filename:  f.Name,
+							Line:      fset.Position(cg.Pos()).Line + i,
+							Resource:  resource,
+							Operation: op,
+						})
+					}
+				}
+			}
+
+		}
+	}
+
+	return tc
+}
+
+func usageToDesc(pc *parsectx.Context, u usage.Expr) usageDesc {
+	pos := pc.FS.Position(u.ASTExpr().Pos())
+	filename := pos.Filename
+	if rel, err := filepath.Rel(pc.MainModuleDir.ToIO(), pos.Filename); err == nil {
+		filename = rel
+	}
+
+	return usageDesc{
+		Filename:  filename,
+		Line:      pos.Line,
+		Resource:  u.ResourceBind().DescriptionForTest(),
+		Operation: u.DescriptionForTest(),
+	}
+}
diff --git a/v2/parser/resource/usage/usagetest/usagetest.go b/v2/parser/resource/usage/usagetest/usagetest.go
new file mode 100644
index 0000000000..2df49c4c8d
--- /dev/null
+++ b/v2/parser/resource/usage/usagetest/usagetest.go
@@ -0,0 +1,80 @@
+package usagetest
+
+import (
+	"strconv"
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/google/go-cmp/cmp"
+	"github.com/google/go-cmp/cmp/cmpopts"
+	"github.com/rogpeppe/go-internal/txtar"
+
+	"encr.dev/v2/internals/testutil"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/resource/usage"
+)
+
+type Case struct {
+	Name     string
+	Imports  []string
+	Code     string
+	Want     []usage.Usage
+	WantErrs []string
+}
+
+func Run(t *testing.T, standardImports []string, tests []Case, cmpOpts ...cmp.Option) {
+	// testArchive renders the txtar archive to use for a given test.
+	testArchive := func(test Case) *txtar.Archive {
+		importList := append([]string{"context"}, standardImports...)
+		importList = append(importList, test.Imports...)
+
+		imports := ""
+		if len(importList) > 0 {
+			imports = "import (\n"
+			for _, imp := range importList {
+				imports += "\t" + strconv.Quote(imp) + "\n"
+			}
+			imports += ")\n"
+		}
+
+		return testutil.ParseTxtar(`
+-- go.mod --
+module example.com
+require encore.dev v1.13.4
+-- code.go --
+package foo
+` + imports + `
+
+` + test.Code + `
+`)
+	}
+
+	for _, test := range tests {
+		t.Run(test.Name, func(t *testing.T) {
+			c := qt.New(t)
+			a := testArchive(test)
+			tc := testutil.NewContext(c, false, a)
+			tc.GoModDownload()
+
+			if len(test.WantErrs) > 0 {
+				defer tc.DeferExpectError(test.WantErrs...)
+			} else {
+				tc.FailTestOnErrors()
+				defer tc.FailTestOnBailout()
+			}
+
+			pp := parser.NewParser(tc.Context)
+			result := pp.Parse()
+
+			if len(test.WantErrs) == 0 {
+				// Check for equality, ignoring all the AST nodes and pkginfo types.
+				opts := append([]cmp.Option{
+					cmpopts.IgnoreTypes(usage.Base{}),
+					cmpopts.EquateEmpty(),
+				}, cmpOpts...)
+				usages := result.AllUsages()
+				c.Assert(usages, qt.CmpEquals(opts...), test.Want)
+			}
+		})
+	}
+}
diff --git a/v2/parser/result.go b/v2/parser/result.go
new file mode 100644
index 0000000000..1149a4e4ef
--- /dev/null
+++ b/v2/parser/result.go
@@ -0,0 +1,276 @@
+package parser
+
+import (
+	"fmt"
+	"go/ast"
+	"go/token"
+	"reflect"
+	"strings"
+
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/internals/posmap"
+	"encr.dev/v2/parser/infra/sqldb"
+	"encr.dev/v2/parser/resource"
+	"encr.dev/v2/parser/resource/usage"
+)
+
+// computeResult computes the combined resource description.
+func computeResult(errs *perr.List, mainModule *pkginfo.Module, ur *usage.Resolver, appPackages []*pkginfo.Package, resources []resource.Resource, binds []resource.Bind, usageExprs []usage.Expr) *Result {
+	d := &Result{
+		mainModule:    mainModule,
+		appPackages:   appPackages,
+		resources:     resources,
+		allBinds:      binds,
+		allUsageExprs: usageExprs,
+
+		resMap:         make(map[resource.Resource]*resourceMeta),
+		byType:         make(map[reflect.Type][]resource.Resource),
+		bindToResource: make(map[resource.Bind]resource.Resource, len(binds)),
+		qnToBind:       make(map[pkginfo.QualifiedName]resource.Bind, len(binds)),
+		usageByPkg:     make(map[paths.Pkg][]usage.Usage),
+	}
+
+	d.initResources()
+	d.initBinds(errs, binds)
+	d.initUsages(errs, ur, usageExprs)
+	return d
+}
+
+func Resources[R resource.Resource](res *Result) []R {
+	var zero R
+	resources := res.byType[reflect.TypeOf(zero)]
+	return fns.Map(resources, func(r resource.Resource) R {
+		return r.(R)
+	})
+}
+
+type Result struct {
+	mainModule    *pkginfo.Module
+	appPackages   []*pkginfo.Package
+	resources     []resource.Resource
+	allBinds      []resource.Bind
+	allUsageExprs []usage.Expr
+
+	resMap         map[resource.Resource]*resourceMeta
+	byType         map[reflect.Type][]resource.Resource
+	bindToResource map[resource.Bind]resource.Resource
+	qnToBind       map[pkginfo.QualifiedName]resource.Bind
+	resByPos       posmap.Map[resource.Resource]
+	usageByPos     posmap.Map[usage.Usage]
+	usageByPkg     map[paths.Pkg][]usage.Usage
+}
+
+func (d *Result) MainModule() *pkginfo.Module {
+	return d.mainModule
+}
+
+func (d *Result) AppPackages() []*pkginfo.Package {
+	return d.appPackages
+}
+
+func (d *Result) PackageAt(path paths.Pkg) option.Option[*pkginfo.Package] {
+	for _, pkg := range d.appPackages {
+		if pkg.ImportPath == path {
+			return option.Some(pkg)
+		}
+	}
+
+	return option.None[*pkginfo.Package]()
+}
+
+func (d *Result) Resources() []resource.Resource {
+	return d.resources
+}
+
+func (d *Result) AllBinds() []resource.Bind {
+	return d.allBinds
+}
+
+func (d *Result) AllUsageExprs() []usage.Expr {
+	return d.allUsageExprs
+}
+
+func (d *Result) ResourceForBind(b resource.Bind) resource.Resource {
+	return d.bindToResource[b]
+}
+
+func (d *Result) ResourceForQN(qn pkginfo.QualifiedName) option.Option[resource.Resource] {
+	return option.Map(d.BindForQN(qn), d.ResourceForBind)
+}
+
+func (d *Result) BindForQN(qn pkginfo.QualifiedName) option.Option[resource.Bind] {
+	return option.AsOptional(d.qnToBind[qn])
+}
+
+func (d *Result) Binds(res resource.Resource) []resource.Bind {
+	return d.rd(res).binds
+}
+
+func (d *Result) PkgDeclBinds(res resource.Resource) []*resource.PkgDeclBind {
+	return d.rd(res).pkgDecls
+}
+
+func (d *Result) Usages(res resource.Resource) []usage.Usage {
+	return d.rd(res).usages
+}
+
+func (d *Result) AllUsages() []usage.Usage {
+	var all []usage.Usage
+	for _, res := range d.resources {
+		all = append(all, d.Usages(res)...)
+	}
+	return all
+}
+
+func (d *Result) ResourceConstructorContaining(node ast.Node) option.Option[resource.Resource] {
+	return d.resByPos.Containing(node)
+}
+
+func (d *Result) UsageFromNode(node ast.Node) option.Option[usage.Usage] {
+	return d.usageByPos.Containing(node)
+}
+
+func (d *Result) UsagesInPkg(pkgPath paths.Pkg) []usage.Usage {
+	return d.usageByPkg[pkgPath]
+}
+
+func (d *Result) rd(res resource.Resource) *resourceMeta {
+	m := d.resMap[res]
+	if m == nil {
+		m = &resourceMeta{}
+		d.resMap[res] = m
+	}
+	return m
+}
+
+// resourceMeta describes metadata about a resource.
+type resourceMeta struct {
+	binds    []resource.Bind
+	pkgDecls []*resource.PkgDeclBind
+	usages   []usage.Usage
+}
+
+func (m *resourceMeta) addBind(b resource.Bind) {
+	m.binds = append(m.binds, b)
+	if pkgDecl, ok := b.(*resource.PkgDeclBind); ok {
+		m.pkgDecls = append(m.pkgDecls, pkgDecl)
+	}
+}
+
+func (m *resourceMeta) addUsage(u usage.Usage) {
+	m.usages = append(m.usages, u)
+}
+
+func (d *Result) initResources() {
+	d.resByPos = posmap.Build(d.resources...)
+
+	for _, res := range d.resources {
+		typ := reflect.TypeOf(res)
+		d.byType[typ] = append(d.byType[typ], res)
+	}
+}
+
+func (d *Result) initBinds(errs *perr.List, binds []resource.Bind) {
+	byPath := make(map[string]resource.Resource, len(d.resources))
+
+	for _, r := range d.resources {
+		// If we have a named resource, add it to the path map.
+		if named, ok := r.(resource.Named); ok {
+			p := resource.Path{{named.Kind(), named.ResourceName()}}
+			byPath[pathKey(p)] = r
+		}
+	}
+
+	addBind := func(r resource.Resource, b resource.Bind) {
+		d.rd(r).addBind(b)
+		d.bindToResource[b] = r
+		if pkgBind, ok := b.(*resource.PkgDeclBind); ok && pkgBind != nil {
+			d.qnToBind[pkgBind.QualifiedName()] = b
+		}
+	}
+
+	for _, b := range binds {
+		// Do we have a specific resource reference?
+		ref := b.ResourceRef()
+		if r := ref.Resource; r != nil {
+			addBind(r, b)
+			continue
+		}
+
+		// Otherwise figure out the resource from the bind path.
+		key := pathKey(ref.Path)
+		if r, ok := byPath[key]; ok {
+			addBind(r, b)
+		} else {
+			switch {
+			case len(ref.Path) > 0 && ref.Path[0].Kind == resource.SQLDatabase:
+				dbName := ref.Path[0].Name
+				errs.Add(sqldb.ErrDatabaseNotFound(dbName).AtGoPos(b.Pos(), token.NoPos))
+			default:
+
+				// NOTE(andre): We could end up here in the future when we support
+				// named references to PubSub subscriptions, since those would
+				// involve a two-segment resource path (first the topic and then the subscription),
+				// which we don't support today (the construction of byPath above only handles
+				// the case of single-segment resource paths).
+				// Since we don't support that today, this is fine for now.
+				errs.Addf(b.Pos(), "internal compiler error: unknown resource (path %q)", key)
+			}
+		}
+	}
+}
+
+func (d *Result) initUsages(errs *perr.List, ur *usage.Resolver, usageExprs []usage.Expr) {
+	resourcesByBindName := make(map[pkginfo.QualifiedName]resource.Resource, len(d.resources))
+	for r, m := range d.resMap {
+		for _, pkgDecl := range m.pkgDecls {
+			resourcesByBindName[pkgDecl.QualifiedName()] = r
+		}
+	}
+
+	var allUsages []usage.Usage
+
+	processUsage := func(r resource.Resource, expr usage.Expr) {
+		if u, ok := ur.Resolve(errs, expr, r).Get(); ok {
+			d.rd(r).addUsage(u)
+			allUsages = append(allUsages, u)
+
+			pkgPath := u.DeclaredIn().Pkg.ImportPath
+			d.usageByPkg[pkgPath] = append(d.usageByPkg[pkgPath], u)
+		}
+	}
+
+	for _, u := range usageExprs {
+		bind := u.ResourceBind()
+		ref := bind.ResourceRef()
+		if r := ref.Resource; r != nil {
+			processUsage(r, u)
+		} else if pkgDecl, ok := bind.(*resource.PkgDeclBind); ok {
+			if r, ok := resourcesByBindName[pkgDecl.QualifiedName()]; ok {
+				processUsage(r, u)
+			} else {
+				errs.Addf(u.ASTExpr().Pos(), "internal compiler error: resource reference not found: %s",
+					pkgDecl.QualifiedName().NaiveDisplayName())
+			}
+		} else {
+			errs.Addf(u.ASTExpr().Pos(), "internal compiler error: invalid resource bind: %T", bind)
+		}
+	}
+
+	d.usageByPos = posmap.Build[usage.Usage](allUsages...)
+}
+
+func pathKey(path resource.Path) string {
+	var b strings.Builder
+	for i, e := range path {
+		if i > 0 {
+			b.WriteString("/")
+		}
+		fmt.Fprintf(&b, "%s:%s", e.Kind.String(), e.Name)
+	}
+	return b.String()
+}
diff --git a/v2/tsbuilder/tsbuilder.go b/v2/tsbuilder/tsbuilder.go
new file mode 100644
index 0000000000..9a04985d9b
--- /dev/null
+++ b/v2/tsbuilder/tsbuilder.go
@@ -0,0 +1,410 @@
+package tsbuilder
+
+import (
+	"context"
+	"encoding/binary"
+	"encoding/json"
+	"fmt"
+	"io"
+	"maps"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sync"
+	"time"
+
+	"encore.dev/appruntime/exported/experiments"
+	"github.com/cockroachdb/errors"
+	"google.golang.org/protobuf/proto"
+
+	"encr.dev/internal/env"
+	"encr.dev/internal/lookpath"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	metav1 "encr.dev/proto/encore/parser/meta/v1"
+)
+
+func New() *BuilderImpl {
+	return &BuilderImpl{
+		cmds: make(map[*runningCmd]bool),
+	}
+}
+
+type BuilderImpl struct {
+	mu   sync.Mutex
+	cmds map[*runningCmd]bool
+}
+
+type parseInput struct {
+	AppRoot    string `json:"app_root"`
+	PlatformID string `json:"platform_id,omitempty"`
+	LocalID    string `json:"local_id"`
+	ParseTests bool   `json:"parse_tests"`
+}
+
+type data struct {
+	cmd    *exec.Cmd
+	stdin  io.Writer
+	stdout io.Reader
+}
+
+func getTSParserPath() (string, error) {
+	const tsParserBinaryName = "tsparser-encore"
+
+	if path := os.Getenv("ENCORE_TSPARSER_PATH"); path != "" {
+		return path, nil
+	}
+
+	// Check the encore bin directory.
+	if bin, ok := env.EncoreBin().Get(); ok {
+		candidate := filepath.Join(bin, tsParserBinaryName)
+		if _, err := os.Stat(candidate); err == nil {
+			return candidate, nil
+		}
+	}
+
+	// Now default to the path
+	return tsParserBinaryName, nil
+}
+
+func (i *BuilderImpl) Close() error {
+	i.mu.Lock()
+	cmds := maps.Clone(i.cmds)
+	i.mu.Unlock()
+
+	for c := range cmds {
+		_ = c.cmd.Cancel()
+	}
+
+	for c := range cmds {
+		<-c.done
+	}
+	return nil
+}
+
+func (i *BuilderImpl) Parse(ctx context.Context, p builder.ParseParams) (*builder.ParseResult, error) {
+	exe, err := getTSParserPath()
+	if err != nil {
+		return nil, err
+	}
+
+	runtimesDir := p.Build.EncoreRuntimes.GetOrElseF(func() paths.FS { return paths.FS(env.EncoreRuntimesPath()) })
+	jsRuntimePath := jsRuntimeRoot(runtimesDir)
+
+	cmd := exec.CommandContext(ctx, exe)
+	cmd.Dir = filepath.Join(p.App.Root(), p.WorkingDir)
+
+	cmd.Env = append(os.Environ(),
+		"RUST_LOG=error",
+		"RUST_BACKTRACE=1",
+	)
+	cmd.Env = append(cmd.Env, p.Build.Environ...)
+	cmd.Env = append(cmd.Env,
+		"ENCORE_JS_RUNTIME_PATH="+jsRuntimePath.ToIO(),
+		"ENCORE_APP_REVISION="+p.Build.Revision,
+	)
+
+	// If we have an encore-bin directory, add it to the path.
+	if bin, ok := env.EncoreBin().Get(); ok {
+		cmd.Env = append(cmd.Env, "PATH="+os.Getenv("PATH")+string(filepath.ListSeparator)+bin)
+	}
+
+	// Close the process when the ctx is canceled.
+	cmd.WaitDelay = 1 * time.Second
+
+	stdin, err := cmd.StdinPipe()
+	if err != nil {
+		return nil, fmt.Errorf("unable to get stdin: %s", err)
+	}
+	stdout, err := cmd.StdoutPipe()
+	if err != nil {
+		return nil, fmt.Errorf("unable to get stdin: %s", err)
+	}
+
+	if stderr, ok := p.Stderr.Get(); ok {
+		cmd.Stderr = stderr
+	} else {
+		cmd.Stderr = os.Stderr
+	}
+
+	if err := cmd.Start(); err != nil {
+		return nil, fmt.Errorf("unable to start builder: %s", err)
+	}
+
+	rc := newRunningCmd(cmd)
+	i.mu.Lock()
+	i.cmds[rc] = true
+	i.mu.Unlock()
+
+	go func() {
+		<-rc.done
+		i.mu.Lock()
+		delete(i.cmds, rc)
+		i.mu.Unlock()
+	}()
+
+	{
+		input := prepareInput{
+			AppRoot:        paths.FS(p.App.Root()),
+			JSRuntimeRoot:  jsRuntimePath,
+			RuntimeVersion: version.Version,
+		}
+		if p.Build.UseLocalJSRuntime {
+			input.LocalRuntimeOverride = jsRuntimePath.ToIO()
+		}
+		inputData, _ := json.Marshal(input)
+		_, _ = stdin.Write([]byte("prepare\n"))
+		if _, err := stdin.Write(inputData); err != nil {
+			return nil, fmt.Errorf("unable to write to stdin: %s", err)
+		}
+
+		isSuccess, parseResp, err := readResp(stdout)
+		if err != nil {
+			return nil, fmt.Errorf("unable to read response: %s", err)
+		} else if !isSuccess {
+			return nil, errors.New(string(parseResp))
+		}
+	}
+
+	input, _ := json.Marshal(parseInput{
+		AppRoot:    p.App.Root(),
+		PlatformID: p.App.PlatformID(),
+		LocalID:    p.App.LocalID(),
+		ParseTests: p.ParseTests,
+	})
+	_, _ = stdin.Write([]byte("parse\n"))
+	if _, err := stdin.Write(input); err != nil {
+		return nil, fmt.Errorf("unable to write to stdin: %s", err)
+	}
+
+	isSuccess, parseResp, err := readResp(stdout)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read response: %s", err)
+	} else if !isSuccess {
+		return nil, errors.New(string(parseResp))
+	}
+
+	var md metav1.Data
+	if err := proto.Unmarshal(parseResp, &md); err != nil {
+		return nil, fmt.Errorf("unable to parse app: %s", err)
+	}
+
+	data := &data{
+		cmd:    cmd,
+		stdin:  stdin,
+		stdout: stdout,
+	}
+
+	return &builder.ParseResult{Meta: &md, Data: data}, nil
+}
+
+type compileInput struct {
+	UseLocalRuntime bool              `json:"use_local_runtime"`
+	Debug           builder.DebugMode `json:"debug"`
+	NodeJSRuntime   NodeJSRuntime     `json:"nodejs_runtime"`
+}
+
+func (i *BuilderImpl) Compile(ctx context.Context, p builder.CompileParams) (*builder.CompileResult, error) {
+	data := p.Parse.Data.(*data)
+
+	nodejsRuntime := NodeJS
+	if experiments.BunRuntime.Enabled(p.Experiments) {
+		nodejsRuntime = Bun
+	}
+
+	input, _ := json.Marshal(compileInput{
+		UseLocalRuntime: p.Build.UseLocalJSRuntime,
+		Debug:           p.Build.DebugMode,
+		NodeJSRuntime:   nodejsRuntime,
+	})
+
+	_, _ = data.stdin.Write([]byte("compile\n"))
+	if _, err := data.stdin.Write(input); err != nil {
+		return nil, fmt.Errorf("unable to write to stdin: %s", err)
+	}
+
+	isSuccess, compileResp, err := readResp(data.stdout)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read response: %s", err)
+	} else if !isSuccess {
+		return nil, errors.New(string(compileResp))
+	}
+
+	var res struct {
+		Outputs []*builder.JSBuildOutput `json:"outputs"`
+	}
+
+	if err := json.Unmarshal(compileResp, &res); err != nil {
+		return nil, fmt.Errorf("unable to decode response: %s", err)
+	}
+
+	return &builder.CompileResult{
+		OS:   p.Build.GOOS,
+		Arch: p.Build.GOARCH,
+		Outputs: fns.Map(res.Outputs, func(o *builder.JSBuildOutput) builder.BuildOutput {
+			return o
+		}),
+	}, nil
+}
+
+func (i *BuilderImpl) UseNewRuntimeConfig() bool {
+	return true
+}
+
+func (i *BuilderImpl) NeedsMeta() bool {
+	return true
+}
+
+func (i *BuilderImpl) ServiceConfigs(ctx context.Context, p builder.ServiceConfigsParams) (*builder.ServiceConfigsResult, error) {
+	return &builder.ServiceConfigsResult{
+		// These are not currently supported
+		Configs:     nil,
+		ConfigFiles: nil,
+	}, nil
+}
+
+type testInput struct {
+	RuntimeVersion  string `json:"runtime_version"`
+	UseLocalRuntime bool   `json:"use_local_runtime"`
+}
+
+func (i *BuilderImpl) RunTests(ctx context.Context, p builder.RunTestsParams) error {
+	cwd := p.WorkingDir.ToIO()
+	binary, err := lookpath.InDir(cwd, p.Spec.Environ, p.Spec.Command)
+	if err != nil {
+		return err
+	}
+
+	cmd := exec.CommandContext(ctx, binary, p.Spec.Args...)
+	cmd.Env = p.Spec.Environ
+	cmd.Dir = cwd
+	cmd.Stdout = p.Stdout
+	cmd.Stderr = p.Stderr
+	return cmd.Run()
+}
+
+func (i *BuilderImpl) TestSpec(ctx context.Context, p builder.TestSpecParams) (*builder.TestSpecResult, error) {
+	data := p.Compile.Parse.Data.(*data)
+
+	input, _ := json.Marshal(testInput{
+		RuntimeVersion:  version.Version,
+		UseLocalRuntime: p.Compile.Build.UseLocalJSRuntime,
+	})
+
+	_, _ = data.stdin.Write([]byte("test\n"))
+	if _, err := data.stdin.Write(input); err != nil {
+		return nil, fmt.Errorf("unable to write to stdin: %s", err)
+	}
+
+	isSuccess, testResp, err := readResp(data.stdout)
+	if err != nil {
+		return nil, fmt.Errorf("unable to read response: %s", err)
+	} else if !isSuccess {
+		return nil, errors.New(string(testResp))
+	}
+
+	var res struct {
+		Cmd option.Option[*builder.CmdSpec] `json:"cmd"`
+	}
+	if err := json.Unmarshal(testResp, &res); err != nil {
+		return nil, fmt.Errorf("unable to decode response: %s", err)
+	}
+
+	cmdSpec, ok := res.Cmd.Get()
+	if !ok {
+		return nil, builder.ErrNoTests
+	}
+
+	command := cmdSpec.Command.Expand("")
+	args := append(command[1:], p.Args...)
+
+	// Default to the error log level to avoid spamming the logs.
+	envs := append(os.Environ(), "ENCORE_LOG_LEVEL=error")
+
+	envs = append(envs, p.Env...)
+	envs = append(envs, cmdSpec.Env.Expand("")...)
+
+	return &builder.TestSpecResult{
+		Command:     command[0],
+		Args:        args,
+		Environ:     envs,
+		BuilderData: nil,
+	}, nil
+}
+
+func (i *BuilderImpl) GenUserFacing(ctx context.Context, p builder.GenUserFacingParams) error {
+	data := p.Parse.Data.(*data)
+
+	input, _ := json.Marshal(genUserFacingInput{})
+
+	_, _ = data.stdin.Write([]byte("gen-user-facing\n"))
+	if _, err := data.stdin.Write(input); err != nil {
+		return fmt.Errorf("unable to write to stdin: %s", err)
+	}
+
+	isSuccess, genUserFacingRep, err := readResp(data.stdout)
+	if err != nil {
+		return fmt.Errorf("unable to read response: %s", err)
+	} else if !isSuccess {
+		return errors.New(string(genUserFacingRep))
+	}
+	return nil
+}
+
+type genUserFacingInput struct {
+}
+
+type NodeJSRuntime string
+
+const (
+	NodeJS NodeJSRuntime = "nodejs"
+	Bun    NodeJSRuntime = "bun"
+)
+
+type prepareInput struct {
+	JSRuntimeRoot        paths.FS `json:"js_runtime_root"`
+	AppRoot              paths.FS `json:"app_root"`
+	RuntimeVersion       string   `json:"runtime_version"`
+	LocalRuntimeOverride string   `json:"local_runtime_override,omitempty"`
+}
+
+func readResp(reader io.Reader) (isSuccess bool, data []byte, err error) {
+	var respLen uint32
+	if err := binary.Read(reader, binary.LittleEndian, &respLen); err != nil {
+		return false, nil, fmt.Errorf("unable to read response length: %s", err)
+	}
+	resp := make([]byte, respLen)
+	if _, err := io.ReadFull(reader, resp); err != nil {
+		return false, nil, fmt.Errorf("unable to read response: %s", err)
+	}
+
+	isSuccess, data = resp[0] == 0, resp[1:]
+	return isSuccess, data, nil
+}
+
+// Reports the JS Runtime root directory.
+func jsRuntimeRoot(runtimesPath paths.FS) paths.FS {
+	return runtimesPath.Join("js")
+}
+
+type runningCmd struct {
+	cmd  *exec.Cmd
+	done chan struct{}
+	err  error
+}
+
+func newRunningCmd(c *exec.Cmd) *runningCmd {
+	rc := &runningCmd{
+		cmd:  c,
+		done: make(chan struct{}),
+		err:  nil,
+	}
+	go func() {
+		defer close(rc.done)
+		rc.err = c.Wait()
+	}()
+	return rc
+}
diff --git a/v2/v2builder/v2builder.go b/v2/v2builder/v2builder.go
new file mode 100644
index 0000000000..5523fe0c78
--- /dev/null
+++ b/v2/v2builder/v2builder.go
@@ -0,0 +1,503 @@
+package v2builder
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"go/token"
+	"io/fs"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/cockroachdb/errors"
+	"github.com/rs/zerolog"
+
+	"encore.dev/appruntime/exported/config"
+	"encr.dev/internal/env"
+	"encr.dev/internal/etrace"
+	"encr.dev/internal/version"
+	"encr.dev/pkg/builder"
+	"encr.dev/pkg/cueutil"
+	"encr.dev/pkg/fns"
+	"encr.dev/pkg/option"
+	"encr.dev/pkg/paths"
+	"encr.dev/pkg/vfs"
+	"encr.dev/v2/app"
+	"encr.dev/v2/app/legacymeta"
+	"encr.dev/v2/codegen"
+	"encr.dev/v2/codegen/apigen"
+	"encr.dev/v2/codegen/apigen/userfacinggen"
+	"encr.dev/v2/codegen/cuegen"
+	"encr.dev/v2/codegen/infragen"
+	"encr.dev/v2/compiler/build"
+	"encr.dev/v2/internals/parsectx"
+	"encr.dev/v2/internals/perr"
+	"encr.dev/v2/internals/pkginfo"
+	"encr.dev/v2/parser"
+	"encr.dev/v2/parser/resource"
+)
+
+type BuilderImpl struct{}
+
+func (BuilderImpl) Close() error { return nil }
+
+func (BuilderImpl) Parse(ctx context.Context, p builder.ParseParams) (*builder.ParseResult, error) {
+	return etrace.Sync2(ctx, "", "v2builder.Parse", func(ctx context.Context) (res *builder.ParseResult, err error) {
+		defer func() {
+			err, _ = perr.CatchBailoutAndPanic(err, recover())
+		}()
+		fset := token.NewFileSet()
+		errs := perr.NewList(ctx, fset)
+
+		runtimesDir := p.Build.EncoreRuntimes.GetOrElseF(func() paths.FS { return paths.FS(env.EncoreRuntimesPath()) })
+		pc := &parsectx.Context{
+			AppID: option.Some(p.App.PlatformOrLocalID()),
+			Ctx:   ctx,
+			Log:   p.Build.Logger.GetOrElse(zerolog.New(zerolog.NewConsoleWriter())).Level(zerolog.InfoLevel),
+			Build: parsectx.BuildInfo{
+				Experiments: p.Experiments,
+				// We use GetOrElseF here because GoRoot / Runtime path will panic
+				// if they are not set, but we don't want to panic if the option
+				// is set.
+				GOROOT: p.Build.GoRoot.GetOrElseF(func() paths.FS {
+					return paths.RootedFSPath(env.EncoreGoRoot(), ".")
+				}),
+				EncoreRuntime: runtimesDir.Join("go"),
+
+				GOARCH:             p.Build.GOARCH,
+				GOOS:               p.Build.GOOS,
+				CgoEnabled:         p.Build.CgoEnabled,
+				StaticLink:         p.Build.StaticLink,
+				Debug:              p.Build.DebugMode,
+				BuildTags:          p.Build.BuildTags,
+				Revision:           p.Build.Revision,
+				UncommittedChanges: p.Build.UncommittedChanges,
+				MainPkg:            p.Build.MainPkg,
+			},
+			MainModuleDir: paths.RootedFSPath(p.App.Root(), "."),
+			FS:            fset,
+			ParseTests:    p.ParseTests,
+			Errs:          errs,
+		}
+
+		parser := parser.NewParser(pc)
+		parserResult := parser.Parse()
+		appDesc := app.ValidateAndDescribe(pc, parserResult)
+		meta, traceNodes := legacymeta.Compute(pc.Errs, appDesc)
+		mainModule := parser.MainModule()
+		runtimeModule := parser.RuntimeModule()
+
+		if pc.Errs.Len() > 0 {
+			return nil, pc.Errs.AsError()
+		}
+
+		return &builder.ParseResult{
+			Meta: meta,
+			Data: &parseData{
+				pc:            pc,
+				appDesc:       appDesc,
+				mainModule:    mainModule,
+				runtimeModule: runtimeModule,
+				traceNodes:    traceNodes,
+			},
+		}, nil
+	})
+}
+
+type parseData struct {
+	pc            *parsectx.Context
+	appDesc       *app.Desc
+	mainModule    *pkginfo.Module
+	runtimeModule *pkginfo.Module
+	traceNodes    *legacymeta.TraceNodes
+}
+
+func (BuilderImpl) Compile(ctx context.Context, p builder.CompileParams) (*builder.CompileResult, error) {
+	return etrace.Sync2(ctx, "", "v2builder.Compile", func(ctx context.Context) (res *builder.CompileResult, err error) {
+		defer func() {
+			err, _ = perr.CatchBailoutAndPanic(err, recover())
+		}()
+
+		pd := p.Parse.Data.(*parseData)
+
+		codegenOp := p.OpTracker.Add("Generating boilerplate code", time.Now())
+
+		gg := codegen.New(pd.pc, pd.traceNodes)
+		infragen.Process(gg, pd.appDesc)
+		staticConfig := apigen.Process(apigen.Params{
+			Gen:               gg,
+			Desc:              pd.appDesc,
+			MainModule:        pd.mainModule,
+			RuntimeModule:     pd.runtimeModule,
+			CompilerVersion:   p.EncoreVersion.GetOrElse(fmt.Sprintf("EncoreCLI/%s", version.Version)),
+			AppRevision:       p.Build.Revision,
+			AppUncommitted:    p.Build.UncommittedChanges,
+			ExecScriptMainPkg: p.Build.MainPkg,
+		})
+
+		if pd.pc.Errs.Len() > 0 {
+			p.OpTracker.Fail(codegenOp, pd.pc.Errs.AsError())
+			return res, pd.pc.Errs.AsError()
+		}
+		p.OpTracker.Done(codegenOp, 450*time.Millisecond)
+
+		compileOp := p.OpTracker.Add("Compiling application source code", time.Now())
+		buildResult := build.Build(ctx, &build.Config{
+			Ctx:          pd.pc,
+			Overlays:     gg.Overlays(),
+			MainPkg:      paths.Pkg(p.Build.MainPkg.GetOrElse("./encore_internal/main")),
+			KeepOutput:   p.Build.KeepOutput,
+			StaticConfig: staticConfig,
+			Env:          p.Environ,
+		})
+
+		output := &builder.GoBuildOutput{ArtifactDir: buildResult.Dir}
+		res = &builder.CompileResult{
+			OS:      p.Build.GOOS,
+			Arch:    p.Build.GOARCH,
+			Outputs: []builder.BuildOutput{output},
+		}
+
+		// Set the built binaries according to the multi-proc build setting.
+		relExe, err := filepath.Rel(output.ArtifactDir.ToIO(), buildResult.Exe.ToIO())
+		if err != nil {
+			return nil, errors.Wrap(err, "unable to compute relative path to executable")
+		}
+
+		exeFile := builder.ArtifactString("${ARTIFACT_DIR}").Join(relExe)
+
+		cmd := builder.ArtifactStrings{exeFile}
+
+		if p.Build.DebugMode == builder.DebugModeBreak {
+			dlvPath, err := exec.LookPath("dlv")
+			if err != nil {
+				return nil, errors.New("unable to find the dlv debugger. Please install and make sure it's in $PATH.")
+			}
+			cmd = append(builder.ArtifactStrings{builder.ArtifactString(dlvPath), "--listen=127.0.0.1:2345", "--headless=true", "--api-version=2", "--accept-multiclient", "--wd", builder.ArtifactString(p.App.Root()), "exec"}, cmd...)
+		}
+
+		spec := builder.CmdSpec{
+			Command:          cmd,
+			PrioritizedFiles: builder.ArtifactStrings{exeFile},
+		}
+		output.Entrypoints = []builder.Entrypoint{{
+			Cmd:      spec,
+			Services: fns.Map(pd.appDesc.Services, func(svc *app.Service) string { return svc.Name }),
+			Gateways: fns.Map(pd.appDesc.Gateways, func(gw *app.Gateway) string { return gw.EncoreName }),
+		}}
+
+		// Check if the compile result caused errors and if it did return
+		if pd.pc.Errs.Len() > 0 {
+			p.OpTracker.Fail(compileOp, pd.pc.Errs.AsError())
+			return res, pd.pc.Errs.AsError()
+		}
+		p.OpTracker.Done(compileOp, 450*time.Millisecond)
+
+		// Then check if the config generation caused an error
+		if pd.pc.Errs.Len() > 0 {
+			return res, pd.pc.Errs.AsError()
+		}
+
+		return res, nil
+	})
+}
+
+func (i BuilderImpl) ServiceConfigs(ctx context.Context, p builder.ServiceConfigsParams) (res *builder.ServiceConfigsResult, err error) {
+	defer func() {
+		if l, ok := perr.CatchBailout(recover()); ok && l.Len() > 0 {
+			err = l.AsError()
+		}
+	}()
+
+	pd := p.Parse.Data.(*parseData)
+	cfg := computeConfigs(pd.pc.Errs, pd.appDesc, pd.mainModule, p.CueMeta)
+	if err != nil {
+		return nil, err
+	}
+	return &builder.ServiceConfigsResult{
+		Configs:     cfg.configs,
+		ConfigFiles: cfg.files,
+	}, nil
+}
+
+func (i BuilderImpl) UseNewRuntimeConfig() bool {
+	return false
+}
+
+func (i BuilderImpl) NeedsMeta() bool {
+	return false
+}
+
+func (i BuilderImpl) RunTests(ctx context.Context, p builder.RunTestsParams) error {
+	return etrace.Sync1(ctx, "", "v2builder.Test", func(ctx context.Context) (err error) {
+		defer func() {
+			err, _ = perr.CatchBailoutAndPanic(err, recover())
+		}()
+
+		data, ok := p.Spec.BuilderData.(*testBuilderData)
+		if !ok {
+			return errors.Newf("invalid builder data type %T", p.Spec.BuilderData)
+		}
+
+		build.RunTests(ctx, data.spec, &build.RunTestsConfig{
+			Stdout:     p.Stdout,
+			Stderr:     p.Stderr,
+			WorkingDir: p.WorkingDir,
+		})
+
+		if data.pc.Errs.Len() > 0 {
+			return data.pc.Errs.AsError()
+		}
+
+		return nil
+	})
+}
+
+type testBuilderData struct {
+	spec *build.TestSpec
+	pc   *parsectx.Context
+}
+
+func (i BuilderImpl) TestSpec(ctx context.Context, p builder.TestSpecParams) (*builder.TestSpecResult, error) {
+	return etrace.Sync2(ctx, "", "v2builder.TestSpec", func(ctx context.Context) (res *builder.TestSpecResult, err error) {
+		spec, err := i.generateTestSpec(ctx, p)
+		if err != nil {
+			return nil, err
+		}
+
+		pd := p.Compile.Parse.Data.(*parseData)
+		data := &testBuilderData{
+			spec: spec,
+			pc:   pd.pc,
+		}
+
+		return &builder.TestSpecResult{
+			Command:     spec.Command,
+			Args:        spec.Args,
+			Environ:     spec.Environ,
+			BuilderData: data,
+		}, nil
+	})
+}
+
+func (i BuilderImpl) generateTestSpec(ctx context.Context, p builder.TestSpecParams) (*build.TestSpec, error) {
+	return etrace.Sync2(ctx, "", "v2builder.generateTestSpec", func(ctx context.Context) (res *build.TestSpec, err error) {
+		defer func() {
+			err, _ = perr.CatchBailoutAndPanic(err, recover())
+		}()
+
+		pd := p.Compile.Parse.Data.(*parseData)
+
+		gg := codegen.New(pd.pc, pd.traceNodes)
+		staticConfig := etrace.Sync1(ctx, "", "codegen", func(ctx context.Context) *config.Static {
+			testCfg := codegen.TestConfig{}
+			for _, pkg := range pd.appDesc.Parse.AppPackages() {
+				isTestFile := func(f *pkginfo.File) bool { return f.TestFile }
+				hasTestFiles := slices.IndexFunc(pkg.Files, isTestFile) != -1
+				if hasTestFiles {
+					testCfg.Packages = append(testCfg.Packages, pkg)
+				}
+			}
+			testCfg.EnvsToEmbed = i.testEnvVarsToEmbed(p.Args, p.Env)
+
+			infragen.Process(gg, pd.appDesc)
+			return apigen.Process(apigen.Params{
+				Gen:             gg,
+				Desc:            pd.appDesc,
+				MainModule:      pd.mainModule,
+				RuntimeModule:   pd.runtimeModule,
+				CompilerVersion: p.Compile.EncoreVersion.GetOrElse(fmt.Sprintf("EncoreCLI/%s", version.Version)),
+				AppRevision:     p.Compile.Build.Revision,
+				AppUncommitted:  p.Compile.Build.UncommittedChanges,
+				Test:            option.Some(testCfg),
+			})
+		})
+
+		spec := build.GenerateTestSpec(ctx, &build.GenerateTestSpecConfig{
+			Config: build.Config{
+				Ctx:          pd.pc,
+				Overlays:     gg.Overlays(),
+				KeepOutput:   p.Compile.Build.KeepOutput,
+				Env:          p.Env,
+				StaticConfig: staticConfig,
+			},
+			Args: p.Args,
+		})
+
+		if pd.pc.Errs.Len() > 0 {
+			return nil, pd.pc.Errs.AsError()
+		}
+		return spec, nil
+	})
+}
+
+// testEnvVars takes a list of env vars and filters them down to the ones
+// that should be embedded within the test binary.
+func (i BuilderImpl) testEnvVarsToEmbed(args, envs []string) map[string]string {
+	if !slices.Contains(args, "-c") {
+		return nil
+	}
+
+	toEmbed := make(map[string]string)
+	for _, e := range envs {
+		if strings.HasPrefix(e, "ENCORE_") {
+			if key, value, ok := strings.Cut(e, "="); ok {
+				toEmbed[key] = value
+			}
+		}
+	}
+	return toEmbed
+}
+
+type configResult struct {
+	configs map[string]string
+	files   fs.FS
+}
+
+func computeConfigs(errs *perr.List, desc *app.Desc, mainModule *pkginfo.Module, cueMeta *cueutil.Meta) configResult {
+	files := pickupConfigFiles(errs, mainModule)
+
+	// TODO this is technically different from the "app root"
+	// but it's close enough for now.
+	appRoot := mainModule.RootDir.ToIO()
+
+	// TODO this is a hack until we have proper resource usage tracking
+	serviceUsesConfig := make(map[string]resource.Resource, len(desc.Services))
+	for _, b := range desc.Parse.AllBinds() {
+		r := desc.Parse.ResourceForBind(b)
+		if r.Kind() == resource.ConfigLoad {
+			if svc, ok := desc.ServiceForPath(b.Package().FSPath); ok {
+				serviceUsesConfig[svc.Name] = r
+			}
+		}
+	}
+
+	configs := make(map[string]string, len(desc.Services))
+	for _, svc := range desc.Services {
+		resourceNode, ok := serviceUsesConfig[svc.Name]
+		if !ok {
+			continue
+		}
+
+		rel, err := filepath.Rel(appRoot, svc.FSRoot.ToIO())
+		if err != nil {
+			errs.AddStdNode(err, resourceNode)
+			continue
+		}
+		// Convert the path since io/fs operates on forward slashes.
+		rel = filepath.ToSlash(rel)
+		cfg, err := cueutil.LoadFromFS(files, rel, cueMeta)
+		if err != nil {
+			errs.AddStdNode(err, resourceNode)
+			continue
+		}
+		cfgData, err := cfg.MarshalJSON()
+		if err != nil {
+			errs.AddStdNode(err, resourceNode)
+			continue
+		}
+
+		configs[svc.Name] = string(cfgData)
+	}
+	return configResult{configs, files}
+}
+
+func pickupConfigFiles(errs *perr.List, mainModule *pkginfo.Module) fs.FS {
+	inCueModFolder := func(path string, info fs.DirEntry) bool {
+		// If it's not a directory, get the parent directory
+		if !info.IsDir() {
+			path = filepath.Dir(path)
+		}
+
+		for i := 0; i < 30; i++ {
+			base := filepath.Base(path)
+			if strings.ToLower(base) == "cue.mod" {
+				return true
+			}
+
+			parent := filepath.Dir(path)
+			if parent == path {
+				break
+			}
+			path = parent
+		}
+		return false
+	}
+
+	// Create a virtual filesystem for the config files
+	configFiles, err := vfs.FromDir(mainModule.RootDir.ToIO(), func(path string, info fs.DirEntry) bool {
+		return filepath.Ext(path) == ".cue" || inCueModFolder(path, info)
+	})
+
+	if err != nil {
+		errs.AssertStd(fmt.Errorf("unable to package configuration files: %w", err))
+	}
+	return configFiles
+}
+
+func (i BuilderImpl) GenUserFacing(ctx context.Context, p builder.GenUserFacingParams) error {
+	return etrace.Sync1(ctx, "", "v2builder.GenUserFacing", func(ctx context.Context) (err error) {
+		defer func() {
+			err, _ = perr.CatchBailoutAndPanic(err, recover())
+		}()
+
+		pd := p.Parse.Data.(*parseData)
+		errs := pd.pc.Errs
+		gg := codegen.New(pd.pc, pd.traceNodes)
+		cueGen := cuegen.NewGenerator(pd.appDesc)
+
+		var buf bytes.Buffer
+		for _, svc := range pd.appDesc.Services {
+			// Generate the user-facing Go code.
+			{
+				// Service structs are not needed if there is no implementation to be generated
+				svcStruct := option.None[*codegen.VarDecl]()
+
+				buf.Reset()
+				if f, ok := userfacinggen.Gen(gg, svc, svcStruct).Get(); ok {
+					if err := f.Render(&buf); err != nil {
+						errs.Addf(token.NoPos, "unable to render userfacing go code: %v", err)
+						continue
+					}
+				}
+
+				i.writeOrDeleteFile(errs, buf.Bytes(), svc.FSRoot.Join("encore.gen.go"))
+			}
+
+			// Generate the user-facing CUE code.
+			{
+				data, err := cueGen.UserFacing(svc)
+				if err != nil {
+					errs.AddStd(err)
+					continue
+				}
+				dst := svc.FSRoot.Join("encore.gen.cue")
+				i.writeOrDeleteFile(errs, data, dst)
+			}
+		}
+
+		if errs.Len() > 0 {
+			return errs.AsError()
+		}
+
+		return nil
+	})
+}
+
+// writeOrDeleteFile writes the given data to dst. If data is empty, it will
+// instead delete the file at dst.
+func (i BuilderImpl) writeOrDeleteFile(errs *perr.List, data []byte, dst paths.FS) {
+	if len(data) == 0 {
+		// No need for any generated code. Try to remove the existing file
+		// if it's there as it's no longer needed.
+		_ = os.Remove(dst.ToIO())
+	} else {
+		if err := os.WriteFile(dst.ToIO(), data, 0644); err != nil {
+			errs.AddStd(err)
+		}
+	}
+}